[
  {
    "path": ".dockerignore",
    "content": "**/node_modules\n**/state.json\n**/README.md\n**/.git\n**/.gitignore\n**/data\n**/test\n**/uploads\n**/docker\n!client/**/node_modules\n"
  },
  {
    "path": ".github/ISSUE_TEMPLATE/bug-report-form.yml",
    "content": "name: 🐞 Bug Report\ndescription: File a bug/issue\ntitle: \"***The title of your Issue here***\"\nlabels: [Bug, Needs Triage]\nbody:\n- type: checkboxes\n  attributes:\n    label: Is there an existing issue for this?\n    description: Please search to see if an issue already exists for the bug you encountered.\n    options:\n    - label: I have searched the existing issues\n      required: true\n- type: checkboxes\n  attributes:\n    label: Are you using the latest version of STIG Manager?\n    description: The latest release is ![GitHub release](https://img.shields.io/github/v/release/NUWCDIVNPT/stig-manager?label=%20). You can see the version you are using in the app on the Home tab, in the badge next to the STIG Manager name and logo. The STIGMan project is in development using an agile process that releases new features and bugfixes frequently. \n    options:\n      - label: I am using the latest [Release](https://github.com/NUWCDIVNPT/stig-manager/releases).\n      - label: I am NOT using the latest [Release](https://github.com/NUWCDIVNPT/stig-manager/releases). I am aware that the first thing I will be asked to do is update the application so that I have the latest bugfixes. \n- type: checkboxes\n  id: issue-location\n  attributes:\n    label: Where are you experiencing the issue?\n    description: Select one or more.\n    options:\n     - label: API\n     -  label: UI or other client\n     -  label: Deployment\n     -  label: Elsewhere\n- type: textarea\n  attributes:\n    label: Current Behavior\n    description: A description of what you're experiencing.\n  validations:\n    required: true\n- type: textarea\n  attributes:\n    label: Expected Behavior\n    description: A description of what you expected to happen.\n  validations:\n    required: false\n- type: textarea\n  attributes:\n    label: Steps To Reproduce\n    description: Steps to reproduce the behavior.\n    placeholder: |\n      1. In this environment...\n      2. With this config...\n      3. Run '...'\n      4. See error...\n  validations:\n    required: false\n- type: textarea\n  attributes:\n    label: Can you provide screenshots, logs, or other useful artifacts?\n    description: |\n      Links? References? Anything that will give us more context about the issue you are encountering!\n\n      Tip: You can attach images or log files by clicking this area to highlight it and then dragging files in.\n  validations:\n    required: false\n- type: textarea\n  attributes:\n    label: Describe your Environment\n    description: |\n      examples:\n        - **Hosting**: Are you hosting your own deployment of STIGMan or being provided with an instance? \n        - **Browser**: Chrome\n        - **OS**: Ubuntu 20.04\n        - **Node**: 13.14.0\n        - **npm**: 7.6.3\n    value: |\n        - Hosting:\n        - Browser:\n        - OS:\n        - Node:\n        - npm:\n    render: markdown\n  validations:\n    required: false    \n"
  },
  {
    "path": ".github/ISSUE_TEMPLATE/feature_request.md",
    "content": "---\nname: Feature request\nabout: Suggest an idea for this project\ntitle: 'FEATURE REQUEST: '\nlabels: enhancement\nassignees: ''\n\n---\n\n**Is your feature request related to a problem? Please describe.**\nA clear and concise description of what the problem is. Ex. I'm always frustrated when [...]\n\n**Describe the solution you'd like**\nA clear and concise description of what you want to happen.\n\n**Describe alternatives you've considered**\nA clear and concise description of any alternative solutions or features you've considered.\n\n**Additional context**\nAdd any other context or screenshots about the feature request here.\n"
  },
  {
    "path": ".github/workflows/api-audit-test-coverage-response.yml",
    "content": "name: API source\non:\n  workflow_dispatch:\n  pull_request:\n    branches:\n      - main\n      - test-coverage\n    paths:\n      - \"api/source/**\"\n      - \"test/api/**\"\n      - \".github/workflows/api-audit-test-coverage-response.yml\"\n\n  push:\n    branches:\n      - main\n      - test-coverage\n    paths:\n      - \"api/source/**\"\n      - \"test/api/**\"\n      - \".github/workflows/api-audit-test-coverage-response.yml\"\n\nenv:\n  STIGMAN_API_PORT: 64001\n  STIGMAN_DB_HOST: localhost\n  STIGMAN_DB_PORT: 3306\n  STIGMAN_DB_PASSWORD: stigman\n  STIGMAN_API_AUTHORITY: http://127.0.0.1:8080/auth/realms/stigman\n  STIGMAN_SWAGGER_ENABLED: true\n  STIGMAN_SWAGGER_SERVER: http://localhost:64001/api\n  STIGMAN_SWAGGER_REDIRECT: http://localhost:64001/api-docs/oauth2-redirect.html\n  STIGMAN_DEV_RESPONSE_VALIDATION: logOnly\n  STIGMAN_EXPERIMENTAL_APPDATA: 'true'\n  STIGMAN_DEV_ALLOW_INSECURE_TOKENS: 'true'\n\n  NODE_V8_COVERAGE: /home/runner/work/stig-manager/stig-manager/api/source/coverage/tmp/\n\npermissions:\n  pull-requests: read # allows SonarCloud to decorate PRs with analysis results\n\njobs:\n  npm_audit:\n    name: npm audit\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - name: install dependencies\n        run: npm ci\n        working-directory: ./api/source/\n      - name: Audit Dependencies and Create PR Comment if needed\n        uses: oke-py/npm-audit-action@2c6b2da234031fbf72af81a04c76b3a152bb2222 # pin@v2\n        with:\n          github_token: ${{ secrets.GITHUB_TOKEN }}\n          create_issues: false\n          create_pr_comments: true\n          working_directory: ./api/source/\n  test_api:\n    name: Run tests with coverage\n    runs-on: ubuntu-latest\n    steps:\n      - name: Check out the repo\n        uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: lts/*\n      - name: coverage directory\n        run: printenv NODE_V8_COVERAGE\n      - name: Install app dependencies\n        working-directory: ./api/source\n        run: npm ci\n      - name: Install test dependencies\n        run: npm ci\n        working-directory: ./test/api/\n      - name: Install utils test dependencies\n        run: npm ci\n        working-directory: ./test/utils/\n      - name: Run mock Keycloak\n        id: idp-run\n        working-directory: ./test/api/mock-keycloak\n        run: |\n          python3 -m http.server 8080 &\n      - name: Run MySQL container\n        id: mysql-run\n        run: |\n          docker run -d --name stig-manager-db \\\n          -p 3306:3306 \\\n          -e MYSQL_ROOT_PASSWORD=rootpw \\\n          -e MYSQL_DATABASE=stigman \\\n          -e MYSQL_USER=stigman \\\n          -e MYSQL_PASSWORD=stigman \\\n          mysql:8.0.24\n      - name: Install c8 coverage reporter\n        run: |\n          sudo npm install -g c8\n      - name: Run app and echo pid\n        working-directory: ./api/source\n        run: sh -c 'echo $$ > /tmp/test.pid ; exec c8 -r html node index.js > api-log.json 2>&1' &\n      - name: pid file check\n        working-directory: ./api/source\n        run: cat /tmp/test.pid\n      - name: Wait for bootstrap\n        run: for i in {1..10}; do [ $i -gt 1 ] && sleep 5; curl --output /dev/null --silent --fail http://localhost:64001/api/op/configuration && s=0 && break || s=$?; printf '.'; done; (exit $s)\n      - name: Run tests with coverage\n        working-directory: ./test/api/\n        run: npm test\n      - name: Upload mocha test report\n        id: artifact-upload-mocha\n        uses: actions/upload-artifact@v4\n        if: ${{ always() }}\n        with:\n          name: mocha-report\n          path: ./test/api/mochawesome-report\n      - name: Kill child pid\n        working-directory: ./api/source\n        run: kill -SIGINT $(ps -ef --ppid `cat /tmp/test.pid` -o pid= )\n      - name: Wait until c8 process ends, or 60 seconds, whichever is shorter.\n        run: timeout 60 tail --pid=`cat /tmp/test.pid` -f /dev/null\n      - name: run c8 text/lcov report\n        working-directory: ./api/source\n        run: c8 report -r lcov -r text -r html\n      - name: Upload coverage artifact\n        id: artifact-upload-coverage\n        uses: actions/upload-artifact@v4\n        if: ${{ always() }}\n        with:\n          name: coverage-report\n          path: ./api/source/coverage\n      - name: Upload API logs\n        id: artifact-upload-api-logs\n        uses: actions/upload-artifact@v4\n        if: ${{ always() }}\n        with:\n          name: api-log\n          path: ./api/source/api-log.json\n  response_validation:\n    name: Response validation\n    needs:\n      - test_api\n    runs-on: ubuntu-latest\n    steps:\n      - name: Download API log artifact\n        uses: actions/download-artifact@v4\n        with:\n          name: api-log\n          path: ./logs\n      - name: Test for response validation messages\n        working-directory: ./logs\n        run: |\n          jq -s 'map(select(.type==\"responseValidation\")|{method:.data.request.method,url:.data.request.url,errors:.data.error.errors,body:.data.body})' api-log.json > response-validation.json\n          exit $(jq '. | length' response-validation.json)\n      - name: Upload response validation artifact\n        if: ${{ failure() }}\n        uses: actions/upload-artifact@v4\n        with:\n          name: response-validation\n          path: ./logs/response-validation.json\n  SonarCloudAnalysis-API:\n    name: SonarCloud Analysis\n    needs: test_api\n    runs-on: ubuntu-latest\n    steps:\n      - name: Check if PR is from a fork\n        id: check_fork\n        run: |\n          if [ \"${{ github.event.pull_request.head.repo.fork }}\" == \"true\" ]; then\n            echo \"This is a PR from a fork, skipping sonarcloud analysis.\"\n            echo \"SKIP_STEP=true\" >> $GITHUB_ENV\n          fi\n      - name: Checkout repository\n        if: env.SKIP_STEP != 'true'\n        uses: actions/checkout@v4\n        with:\n          fetch-depth: 0 # Important to fetch all history for accurate blame information\n      - name: Download lcov artifact\n        if: env.SKIP_STEP != 'true'\n        uses: actions/download-artifact@v4\n        with:\n          name: coverage-report\n      - name: Move lcov.info to api/source\n        if: env.SKIP_STEP != 'true'\n        run: mv lcov.info ./api/source/\n\n      - name: Analyze API with SonarCloud\n        if: env.SKIP_STEP != 'true'\n        uses: SonarSource/sonarqube-scan-action@v6.0.0\n        env:\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information\n          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN_API }} # Needed to push to SonarCloud\n        with:\n          # Additional arguments for the sonarcloud scanner\n          projectBaseDir: ./api/source\n          args: -Dsonar.projectKey=nuwcdivnpt_stig-manager-api\n            -Dsonar.projectName=nuwcdivnpt_stig-manager-api\n            -Dsonar.organization=nuwcdivnpt\n            -Dsonar.inclusions=**/*.js\n            -Dsonar.exclusions=**/node_modules/**,**/coverage-report/**\n            -Dsonar.javascript.lcov.reportPaths=./lcov.info\n\n    #   This will fail the action if Quality Gate fails (leaving out for now )\n    #  - name: Check Quality Gate\n    #    uses: sonarsource/sonarqube-quality-gate-action@master\n    #    env:\n    #      SONAR_TOKEN:\n"
  },
  {
    "path": ".github/workflows/api-binary-tests.yml",
    "content": "\nname: Build and Test Linux Binary\non:\n  workflow_dispatch:\n  pull_request:\n    branches:\n      - main\n    paths:\n      - \"api/source/**\"\n      - \"test/api/**\"\n      - \".github/workflows/api-binary-tests.yml\"\n      - \"api/build.sh\"\n      - \"client/build.sh\"\n      - \"docs/build.sh\"\n\n  push:\n    branches:\n      - main\n    paths:\n      - \"api/source/**\"\n      - \"test/api/**\"\n      - \".github/workflows/api-binary-tests.yml\"\n      - \"api/build.sh\"\n      - \"client/build.sh\"\n      - \"docs/build.sh\"\n\n      \nenv:\n  STIGMAN_API_PORT: 64001\n  STIGMAN_DB_HOST: localhost\n  STIGMAN_DB_PORT: 3306\n  STIGMAN_DB_PASSWORD: stigman\n  STIGMAN_API_AUTHORITY: http://127.0.0.1:8080/auth/realms/stigman\n  STIGMAN_SWAGGER_ENABLED: true\n  STIGMAN_SWAGGER_SERVER: http://127.0.0.1:64001/api\n  STIGMAN_SWAGGER_REDIRECT: http://127.0.0.1:64001/api-docs/oauth2-redirect.html\n  STIGMAN_DEV_RESPONSE_VALIDATION: logOnly\n  STIGMAN_EXPERIMENTAL_APPDATA: 'true'\n  STIGMAN_OIDC_PROVIDER: http://127.0.0.1:8080/auth/realms/stigman\n  STIGMAN_DEV_ALLOW_INSECURE_TOKENS: 'true'\njobs:\n  build-artifacts:\n    name: Build binary artifacts\n    runs-on: ubuntu-latest\n    steps:\n      - name: Check out the repo\n        uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: lts/*\n\n      - name: Get repository metadata\n        id: repo\n        uses: actions/github-script@v7\n        with:\n          script: |\n            const repo = await github.rest.repos.get(context.repo)\n            return repo.data     \n\n      - name: install uglify\n        run: |\n          sudo npm install -g uglify-js    \n\n      - name: run build script\n        id: run-the-build-script\n        working-directory: ./api\n        run: ./build.sh\n\n      - name: Upload builds\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: binary-artifacts\n          path: ./api/bin/\n          if-no-files-found: error\n\n      - name: Upload archives\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: binary-archives\n          path: ./api/dist/\n          if-no-files-found: error\n\n  run-test-linux-binary-artifact:\n    name: Run and test linux artifact\n    needs: build-artifacts\n    runs-on: ubuntu-latest\n    steps:\n      - name: Check out the repo\n        uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: lts/*\n\n      - name: Run mock Keycloak\n        id: idp-run\n        working-directory: test/api/mock-keycloak\n        run: |\n          python3 -m http.server 8080 &\n\n      - name: Run MySQL container\n        id: mysql-run\n        run: |\n          docker run -d --name stig-manager-db \\\n          -p 3306:3306 \\\n          -e MYSQL_ROOT_PASSWORD=rootpw \\\n          -e MYSQL_DATABASE=stigman \\\n          -e MYSQL_USER=stigman \\\n          -e MYSQL_PASSWORD=stigman \\\n          mysql:8.0.24\n      - name: wait 10 seconds\n        run: sleep 10\n\n      - name: Download builds\n        uses: actions/download-artifact@v4\n        with:\n          name: binary-artifacts  \n          path: ./binary-artifacts\n\n      - name: Set execute permissions on binary\n        run: chmod +x ./binary-artifacts/stig-manager-linuxstatic\n      \n      - name: Run linux binary and log output\n        working-directory: ./\n        run: |\n          mkdir -p ./binary-artifacts/logs\n          echo \"Running tests on binary artifacts\"\n          ./binary-artifacts/stig-manager-linuxstatic > ./binary-artifacts/logs/output.log 2>&1 &\n          echo $! > binary-artifacts/stig-manager.pid\n\n      - name: Wait for bootstrap\n        run: for i in {1..10}; do [ $i -gt 1 ] && sleep 5; curl --output /dev/null --silent --fail http://localhost:64001/api/op/configuration && s=0 && break || s=$?; printf '.'; done; (exit $s)\n          \n      - name: Install test dependencies\n        run: npm ci\n        working-directory: ./test/api/\n      - name: Install utils test dependencies\n        run: npm ci\n        working-directory: ./test/utils/\n      - name: Run tests with coverage and log output\n        working-directory: ./test/api/\n        run: |\n          set -o pipefail\n          npm test 2>&1 | tee ../../binary-artifacts/logs/test-output.log\n\n      - name: Stop linux binary\n        if: always()\n        run: |\n          if [ -f binary-artifacts/stig-manager.pid ]; then\n            kill $(cat binary-artifacts/stig-manager.pid) || true\n          fi\n\n      - name: Upload logs\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: test-logs\n          path: ./binary-artifacts/logs/"
  },
  {
    "path": ".github/workflows/api-container-tests.yml",
    "content": "name: API containers\non:\n  workflow_dispatch:\n  pull_request:\n    branches:\n      - main\n    paths:\n      - \"api/source/**\"\n      - \"test/api/**\"\n      - \"Dockerfile\"\n      - \".github/workflows/api-container-tests.yml\"\n\njobs:\n  fetch-mysql-versions:\n    runs-on: ubuntu-latest\n    outputs:\n      MYSQL_VERSIONS: ${{ steps.fetch-versions.outputs.version_array }}\n    steps:\n      - name: Fetch MySQL Versions\n        id: fetch-versions\n        run: |\n          # Fetch latest 3 MySQL 8.0.x versions plus 8.0.24\n          MYSQL_8_0=$(curl -s \"https://registry.hub.docker.com/v2/repositories/library/mysql/tags/?page_size=100\" | jq -r '.results[].name | select(test(\"^8\\\\.0\\\\.\\\\d+$\"))' | sort -V | tail -n2 | cat <(echo \"8.0.24\") - | sort -V | uniq)\n          \n          # Fetch latest 2 MySQL 8.4.x versions\n          MYSQL_8_4=$(curl -s \"https://registry.hub.docker.com/v2/repositories/library/mysql/tags/?page_size=100\" | jq -r '.results[].name | select(test(\"^8\\\\.4\\\\.\\\\d+$\"))' | sort -V | tail -n2)\n          \n          # Combine both version lists into JSON array\n          VERSIONS=$(echo \"$MYSQL_8_0\" \"$MYSQL_8_4\" | tr ' ' '\\n' | jq -Rnc '[inputs]')\n          echo \"version_array=$VERSIONS\" >> $GITHUB_OUTPUT\n\n  test_api:\n    needs: fetch-mysql-versions\n    name: ${{ matrix.container.name }} and MySQL ${{ matrix.mysql_version }}\n    runs-on: ubuntu-latest\n    strategy:\n      matrix:\n        container:\n            - name: \"stig-manager-alpine\"\n              build_arg: \"node:lts-alpine\"\n        mysql_version: ${{fromJson(needs.fetch-mysql-versions.outputs.MYSQL_VERSIONS)}}\n    steps:\n      - name: Check out the repo\n        uses: actions/checkout@v4\n      - name: Build image for ${{ matrix.container.name }}\n        id: image-build\n        run: |\n          docker build -t ${{ matrix.container.name }} --build-arg BASE_IMAGE=${{ matrix.container.build_arg }} .\n      - name: Run mock Keycloak\n        id: id-run\n        working-directory: ./test/api/mock-keycloak\n        run: |\n          python3 -m http.server 8080 &\n      - name: Run MySQL container version ${{ matrix.mysql_version }}\n        id: mysql-run\n        run: |\n          docker run -d --name stig-manager-db \\\n          -p 3306:3306 \\\n          -e MYSQL_ROOT_PASSWORD=rootpw \\\n          -e MYSQL_DATABASE=stigman \\\n          -e MYSQL_USER=stigman \\\n          -e MYSQL_PASSWORD=stigman \\\n          mysql:${{ matrix.mysql_version }}\n      - name: Run STIG Manager container ${{ matrix.container.name }}\n        id: api-run\n        run: |\n          docker run -d --name stig-manager-api \\\n          --net=host \\\n          -e STIGMAN_API_PORT=64001 \\\n          -e STIGMAN_DB_HOST=localhost \\\n          -e STIGMAN_DB_PORT=3306 \\\n          -e STIGMAN_DB_PASSWORD=stigman \\\n          -e STIGMAN_API_AUTHORITY=http://127.0.0.1:8080/auth/realms/stigman \\\n          -e STIGMAN_DEV_RESPONSE_VALIDATION=logOnly \\\n          -e STIGMAN_EXPERIMENTAL_APPDATA=true \\\n          -e STIGMAN_DEV_ALLOW_INSECURE_TOKENS=true \\\n          ${{ matrix.container.name }}\n\n      - name: Install test dependencies\n        run: npm ci\n        working-directory: ./test/api/\n      - name: Install utils test dependencies\n        run: npm ci\n        working-directory: ./test/utils/\n\n      - name: Wait for bootstrap\n        run: for i in {1..10}; do [ $i -gt 1 ] && sleep 5; curl --output /dev/null --silent --fail http://localhost:64001/api/op/configuration && s=0 && break || s=$?; printf '.'; done; (exit $s)\n      - name: Run tests with coverage\n        working-directory: ./test/api/\n        run: npm test\n      - name: Upload mocha test report\n        id: artifact-upload-mocha\n        uses: actions/upload-artifact@v4\n        if: ${{ always() }}\n        with:\n          name: mocha-report-${{ matrix.container.name }}-${{ matrix.mysql_version }}\n          path: ./test/api/mochawesome-report\n   \n      - name: Extract API container log\n        id: api-log-extract\n        if: ${{ always() }}\n        working-directory: ./test/api\n        run: |\n          docker logs stig-manager-api > api-log-${{ matrix.container.name }}-${{ matrix.mysql_version }}-${{ github.run_id }}.json\n      - name: Upload API log artifact\n        uses: actions/upload-artifact@v4\n        id: api-log-upload\n        if: ${{ always() }}\n        with:\n          name: api-log-${{ matrix.container.name }}-${{ matrix.mysql_version }}-${{ github.run_id }}\n          path: ./test/api/api-log-${{ matrix.container.name }}-${{ matrix.mysql_version }}-${{ github.run_id }}.json\n      - name: Collect all container logs on failure\n        if: ${{ cancelled() || failure() }}\n        uses: jwalton/gh-docker-logs@54a2a89cd6a2c929525f26ca67a7a4857a5dc1d9 # pin@v1\n        with:\n          dest: \"./logs-${{ matrix.container.name }}-${{ matrix.mysql_version }}\"\n      - name: Tar container logs\n        if: ${{ cancelled() || failure() }}\n        run: tar cvzf ./logs-${{ matrix.container.name }}-${{ matrix.mysql_version }}.tgz ./logs-${{ matrix.container.name }}-${{ matrix.mysql_version }}\n      - name: Upload container logs artifact\n        if: ${{ cancelled() || failure() }}\n        uses: actions/upload-artifact@v4\n        with:\n          name: logs-${{ matrix.container.name }}-${{ matrix.mysql_version }}.tgz\n          path: ./logs-${{ matrix.container.name }}-${{ matrix.mysql_version }}.tgz\n      \n"
  },
  {
    "path": ".github/workflows/api-spec-validation.yml",
    "content": "name: API spec validation\r\non:\r\n  workflow_dispatch:\r\n  pull_request:\r\n    branches:\r\n      - main\r\n    paths:\r\n      - \"api/source/specification/**\"\r\n      - \".github/workflows/api-spec-validation.yml\"\r\n  push:\r\n    branches:\r\n      - main\r\n    paths:\r\n      - \"api/source/specification/**\"\r\n      - \".github/workflows/api-spec-validation.yml\"\r\n\r\njobs:\r\n  validate_asyncapi:\r\n    name: Validate AsyncAPI specs\r\n    runs-on: ubuntu-latest\r\n    steps:\r\n      - uses: actions/checkout@v4\r\n      - uses: actions/setup-node@v4\r\n        with:\r\n          node-version: lts/*\r\n      - name: Validate log-socket.yaml\r\n        run: npx --yes @asyncapi/cli@2 validate api/source/specification/log-socket.yaml\r\n"
  },
  {
    "path": ".github/workflows/api-state-tests.yml",
    "content": "name: API state tests\non:\n  workflow_dispatch:\n  pull_request:\n    branches:\n      - main\n    paths:\n      - \"api/source/**\"\n      - \"test/state/**\"\n      - \".github/workflows/api-state-tests.yml\"\njobs:\n  api-state-tests:\n    name: state tests\n    runs-on: ubuntu-latest\n    strategy:\n      matrix: \n        component: [\"bootstrap\", \"db\", \"jwks\", \"oidc\", \"tokenValidation\"]\n    steps:\n      - name: Check out the repo\n        uses: actions/checkout@v4\n      - name: Install api libraries\n        working-directory: ./api/source\n        run: npm ci\n      - name: Install Test dependencies\n        working-directory: ./test/state\n        run: npm ci\n      - name: Install Test utils dependencies\n        working-directory: ./test/utils\n        run: npm ci\n      - name: Run tests\n        working-directory: ./test/state\n        run: npx mocha --reporter mochawesome --showFailed --exit './mocha/${{ matrix.component}}.test.js'\n      - name: Upload mocha test report\n        uses: actions/upload-artifact@v4\n        if: ${{ always() }}\n        with:\n          name: mocha-report-${{ matrix.component}}\n          path: ./test/state/mochawesome-report\n\n"
  },
  {
    "path": ".github/workflows/build-binary-artifacts.yml",
    "content": "\nname: Build Binary Artifacts and Sign\non:\n  workflow_dispatch:\n  push:\n    branches:\n      - main\n    paths:\n      - 'api/source/**'\n      - 'client/src/**'\n      - 'client/build.sh'\n      - 'docs/**'\n      - '.github/workflows/build-client.yml'\n      - '.github/workflows/build-docs.yml'\n      - '.github/workflows/build-binary-artifacts.yml'\n    tags:\n      - 1.**\njobs:\n  build-binary-artifacts-and-sign:\n    name: Build binary artifacts, sign, export\n    runs-on: ubuntu-latest\n    steps:\n      - name: Check out the repo\n        uses: actions/checkout@v4\n        with:\n          ref: main\n          fetch-depth: 0\n\n      - name: Get repository metadata\n        id: repo\n        uses: actions/github-script@v7\n        with:\n          script: |\n            const repo = await github.rest.repos.get(context.repo)\n            return repo.data     \n\n      - name: install uglify\n        run: |\n          sudo npm install -g uglify-js    \n\n      - name: run build script\n        id: run-the-build-script\n        working-directory: ./api\n        run: ./build.sh\n\n      - name: Import GPG Key\n        id: import_gpg\n        run: | \n          if ! echo \"${{ secrets.STIGMAN_PRIVATE_KEY }}\" | gpg --import; then\n            echo \"::warning ::Private key GPG Import failed\"\n            exit 1\n          fi\n\n      - name: Get latest tag\n        id: get_tag\n        run: |\n          DESCRIBE=$(git describe --tags | sed 's/\\(.*\\)-.*/\\1/')\n          echo \"tag=$DESCRIBE\" >> $GITHUB_ENV\n\n      - name: Sign Dist Artifacts\n        id: sign_artifacts\n        working-directory: ./api/dist\n        run: |\n        \n         if ! gpg --default-key nuwcdivnpt-bot@users.noreply.github.com --armor --detach-sig ./stig-manager-linux-${{ env.tag }}.tar.xz; then\n            echo \"::warning ::Linux Signing failed\"\n            exit 1\n          fi\n         if ! gpg --default-key nuwcdivnpt-bot@users.noreply.github.com --armor --detach-sig ./stig-manager-win-${{ env.tag }}.zip; then\n            echo \"::warning ::Windows Signing failed\"\n            exit 1\n         fi\n        \n      - name: Verify Signatures\n        id: verify_signatures\n        working-directory: ./api/dist\n        run: |\n          if ! gpg --verify stig-manager-linux-${{ env.tag }}.tar.xz.asc stig-manager-linux-${{ env.tag }}.tar.xz; then\n            echo \"::warning ::Signature verification for Linux failed\"\n            exit 1\n          fi\n          if ! gpg --verify stig-manager-win-${{ env.tag }}.zip.asc stig-manager-win-${{ env.tag }}.zip; then\n            echo \"::warning ::Signature verification for Windows failed\"\n            exit 1\n          fi\n   \n      - name: Upload builds\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: binary-artifacts\n          path: ./api/bin/\n          if-no-files-found: error\n\n      - name: Upload archives\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: binary-archives\n          path: ./api/dist/\n          if-no-files-found: error"
  },
  {
    "path": ".github/workflows/build-client.yml",
    "content": "name: Build client\non:\n  workflow_dispatch:\n  workflow_call:\njobs:\n  builder:\n    name: builder\n    runs-on: ubuntu-latest\n    steps:\n      - name: Check out the repo\n        uses: actions/checkout@v4\n        with:\n          ref: ${{ github.ref }}\n      - name: Install uglify-js\n        run: npm install -g uglify-js\n      - name: Create distribution\n        working-directory: ./client\n        run: ./build.sh\n      - name: Upload distribution\n        uses: actions/upload-artifact@v4\n        with:\n          name: client-dist\n          path: ./client/dist\n"
  },
  {
    "path": ".github/workflows/build-docs.yml",
    "content": "name: Build docs\non:\n  workflow_dispatch:\n  workflow_call:\njobs:\n  builder:\n    name: builder\n    runs-on: ubuntu-latest\n    steps:\n      - name: Check out the repo\n        uses: actions/checkout@v4\n        with:\n          ref: ${{ github.ref }}\n      - name: run image, generating docs\n        working-directory: ./docs\n        run: ./build.sh\n      - name: Upload docs\n        uses: actions/upload-artifact@v4\n        with:\n          name: docs-build\n          path: ./docs/_build/html\n"
  },
  {
    "path": ".github/workflows/client-sonarcloud.yml",
    "content": "name: Client SonarCloud\non:\n  workflow_dispatch:\n  pull_request:\n    branches:\n      - main\n    paths:\n      - \"client/src/js/**\"\n      - \"client/src/css/**\"\n      - \"client/src/serviceWorker.js\"\n      - \".github/workflows/client-sonarcloud.yml\"\n\n  push:\n    branches:\n      - main\n    paths:\n      - \"client/src/js/**\"\n      - \"client/src/css/**\"\n      - \"client/src/serviceWorker.js\"\n      - \".github/workflows/client-sonarcloud.yml\"\n\npermissions:\n  pull-requests: read # allows SonarCloud to decorate PRs with analysis results\n\njobs:\n  SonarCloudAnalysis-Client:\n    name: SonarCloud Analysis client\n    runs-on: ubuntu-latest\n    steps:\n      - name: Check if PR is from a fork\n        id: check_fork\n        run: |\n          if [ \"${{ github.event.pull_request.head.repo.fork }}\" == \"true\" ]; then\n            echo \"This is a PR from a fork, skipping sonarcloud analysis.\"\n            echo \"SKIP_STEP=true\" >> $GITHUB_ENV\n          fi\n      #checkout the repo\n      - name: Checkout repository\n        if: env.SKIP_STEP != 'true'\n        uses: actions/checkout@v4\n        with:\n          fetch-depth: 0 # Important to fetch all history for accurate blame information\n      \n      - name: Analyze client with SonarCloud\n        if: env.SKIP_STEP != 'true'\n        uses: SonarSource/sonarqube-scan-action@v6.0.0\n        env:\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information\n          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN_CLIENT }} # Needed to push to SonarCloud\n        with:\n          projectBaseDir: ./client/src\n          # Additional arguments for the sonarcloud scanner\n          args: -Dsonar.projectKey=nuwcdivnpt_stig-manager-client\n            -Dsonar.projectName=nuwcdivnpt_stig-manager-client\n            -Dsonar.organization=nuwcdivnpt\n            -Dsonar.inclusions=**/*.js,**/*.html,**/*.css\n            -Dsonar.exclusions=**/node_modules/**\n\n    #   This will fail the action if Quality Gate fails (leaving out for now )\n    #  - name: Check Quality Gate\n    #    uses: sonarsource/sonarqube-quality-gate-action@master\n    #    env:\n    #      SONAR_TOKEN:\n"
  },
  {
    "path": ".github/workflows/pub-docker.yml",
    "content": "name: Publish Docker images\nenv:\n  DOCKERHUB_REPOSITORY: nuwcdivnpt/stig-manager\non:\n  workflow_dispatch:\n  push:\n    branches:\n      - main\n    paths:\n      - 'api/source/**'\n      - 'client/src/**'\n      - 'client/build.sh'\n      - 'docs/**'\n      - 'Dockerfile'\n      - '.github/workflows/build-client.yml'\n      - '.github/workflows/build-docs.yml'\n      - '.github/workflows/pub-docker.yml'\n    tags:\n      - 1.**\njobs:\n  build-client:\n    uses: nuwcdivnpt/stig-manager/.github/workflows/build-client.yml@main\n  build-docs:\n    uses: nuwcdivnpt/stig-manager/.github/workflows/build-docs.yml@main\n  build-push-alpine:\n    name: Build and push from Alpine base\n    needs:\n      - build-client\n      - build-docs\n    runs-on: ubuntu-latest\n    steps:\n      - name: Check out the repo\n        uses: actions/checkout@v4\n        with:\n          ref: main\n          fetch-depth: 0\n      - name: Download client distribution\n        uses: actions/download-artifact@v4\n        with:\n          name: client-dist\n          path: ./client/dist\n      - name: Download documentation\n        uses: actions/download-artifact@v4\n        with:\n          name: docs-build\n          path: ./docs/_build/html\n      - name: Get repository metadata\n        id: repo\n        uses: actions/github-script@v7\n        with:\n          script: |\n            const repo = await github.rest.repos.get(context.repo)\n            return repo.data\n      - name: Prepare variables\n        id: prep\n        run: |\n          DOCKER_IMAGE=${{ env.DOCKERHUB_REPOSITORY }}\n          BRANCH=$(git symbolic-ref --short HEAD)\n          SHA=$(git rev-parse --short=10 HEAD)\n          DESCRIBE=$(git describe --tags)\n          TAG=$(git describe --tags --abbrev=0)\n          TAGS=${DOCKER_IMAGE}:latest\n          [[ ${{ github.ref_type }} == \"tag\" ]] && TAGS=\"$TAGS,${DOCKER_IMAGE}:${{ github.ref_name }}\" \n          [[ ${{ github.event_name }} == \"workflow_dispatch\" && ${{ github.ref_name }} != \"main\" ]] && TAGS=\"${DOCKER_IMAGE}:${{ github.ref_name }}\"\n          echo \"version=${TAG}\" >> $GITHUB_OUTPUT\n          echo \"sha=${SHA}\" >> $GITHUB_OUTPUT\n          echo \"tag=${TAG}\" >> $GITHUB_OUTPUT\n          echo \"branch=${BRANCH}\" >> $GITHUB_OUTPUT\n          echo \"tags=${TAGS}\" >> $GITHUB_OUTPUT\n          echo \"describe=${DESCRIBE}\" >> $GITHUB_OUTPUT\n          echo \"created=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\" >> $GITHUB_OUTPUT\n      - name: Set up Docker Buildx\n        uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # pin@v2\n      - name: Login to DockerHub\n        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # pin@v2\n        with:\n          username: ${{ secrets.DOCKERHUB_ORG_OWNER_USERNAME }}\n          password: ${{ secrets.DOCKERHUB_ORG_OWNER_PW }}\n      - name: Build and push\n        id: docker_build\n        uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6 # pin@v3\n        with:\n          context: .\n          platforms: linux/amd64,linux/arm64\n          file: ./Dockerfile\n          push: true\n          build-args: |\n            COMMIT_BRANCH=${{ steps.prep.outputs.branch }}\n            COMMIT_SHA=${{ steps.prep.outputs.sha }}\n            COMMIT_TAG=${{ steps.prep.outputs.tag }}\n            COMMIT_DESCRIBE=${{ steps.prep.outputs.describe }}\n          tags: ${{ steps.prep.outputs.tags }}\n          labels: |\n            org.opencontainers.image.title=${{ fromJson(steps.repo.outputs.result).name }}\n            org.opencontainers.image.description=${{ fromJson(steps.repo.outputs.result).description }}\n            org.opencontainers.image.url=${{ fromJson(steps.repo.outputs.result).html_url }}\n            org.opencontainers.image.source=${{ fromJson(steps.repo.outputs.result).clone_url }}\n            org.opencontainers.image.version=${{ steps.prep.outputs.version }}\n            org.opencontainers.image.created=${{ steps.prep.outputs.created }}\n            org.opencontainers.image.revision=${{ steps.prep.outputs.describe }}\n            org.opencontainers.image.licenses=${{ fromJson(steps.repo.outputs.result).license.spdx_id }}\n      - name: Image digest\n        run: echo ${{ steps.docker_build.outputs.digest }}\n      - name: Update Docker Hub Description\n        if: github.event_name != 'workflow_dispatch'\n        uses: peter-evans/dockerhub-description@202973a37c8a723405c0c5f0a71b6d99db470dae # pin@v3\n        with:\n          username: ${{ secrets.DOCKERHUB_ORG_OWNER_USERNAME }}\n          password: ${{ secrets.DOCKERHUB_ORG_OWNER_PW }}\n          repository: ${{ env.DOCKERHUB_REPOSITORY }}\n          short-description: An API and Web client for managing STIG assessments.\n          readme-filepath: ./docs/the-project/DockerHub_Readme.md\n"
  },
  {
    "path": ".github/workflows/unit-tests.yml",
    "content": "name: Unit tests\non:\n  workflow_dispatch:\n  pull_request:\n    branches:\n      - main\n    paths:\n      - \"api/source/**\"\n      - \"test/unit/**\"\n      - \".github/workflows/unit-tests.yml\"\n  push:\n    branches:\n      - main\n    paths:\n      - \"api/source/**\"\n      - \"test/unit/**\"\n      - \".github/workflows/unit-tests.yml\"\n\njobs:\n  unit-tests:\n    name: Run unit tests\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: lts/*\n      - name: Install API dependencies\n        run: npm ci\n        working-directory: ./api/source/\n      - name: Install test dependencies\n        run: npm ci\n        working-directory: ./test/unit/\n      - name: Run unit tests\n        working-directory: ./test/unit/\n        run: npm test\n"
  },
  {
    "path": ".readthedocs.yml",
    "content": "# .readthedocs.yml\r\n# Read the Docs configuration file\r\n# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details\r\n\r\n# Required\r\nversion: 2\r\n\r\n# Set the OS, Python version and other tools you might need\r\nbuild:\r\n  os: ubuntu-22.04\r\n  tools:\r\n    python: \"3.12\"\r\n\r\n    \r\n# Build documentation in the docs/ directory with Sphinx\r\nsphinx:\r\n   configuration: docs/conf.py\r\n\r\n# Optionally build your docs in additional formats such as PDF\r\n# formats:\r\n   # - pdf\r\n\r\n# Optionally set the version of Python and requirements required to build your docs\r\npython:\r\n   install:\r\n   - requirements: docs/requirements.txt"
  },
  {
    "path": "CONTRIBUTING.md",
    "content": "# Contributing to STIG Manager\n\n**NOTE: This CONTRIBUTING.md describes our software contribution policy. You do not need to follow the Developer's Certificate of Origin (DCO) process for commenting on the STIG Manager repository documentation, such as CONTRIBUTING.md, INTENT.md, etc. or for submitting issues. For more information about developing and contributing to the project, please see the [STIG Manager Contribution Guide](https://stig-manager.readthedocs.io/en/latest/the-project/contributing.html) that is part of our [overall documentation](https://stig-manager.readthedocs.io/en/latest/index.html)**\n\n## Policy\n\n### 1. Introduction\n\nThe project maintainer for this Project will only accept contributions using the Developer's Certificate of Origin 1.1 located at [developercertificate.org](https://developercertificate.org) (\"DCO\"). The DCO is a legally binding statement asserting that you are the creator of your contribution, or that you otherwise have the authority to distribute the contribution, and that you are intentionally making the contribution available under the license associated with the Project (\"License\").\n\n### 2. Developer Certificate of Origin Process\n\nBefore submitting contributing code to this repository for the first time, you'll need to sign a Developer Certificate of Origin (DCO) (see below). To agree to the DCO, add your name and email address to the [CONTRIBUTORS.md](CONTRIBUTORS.md) file. At a high level, adding your information to this file tells us that you have the right to submit the work you're contributing and indicates that you consent to our treating the contribution in a way consistent with the license associated with this software (as described in [LICENSE.md](LICENSE.md)) and its documentation (\"Project\").\n\n### 3. Important Points\n\nPseudonymous or anonymous contributions are permissible, but you must be reachable at the email address provided in the Signed-off-by line.\n\nIf your contribution is significant, you are also welcome to add your name and copyright date to the source file header.\n\nU.S. Federal law prevents the government from accepting gratuitous services unless certain conditions are met. By submitting a pull request, you acknowledge that your services are offered without expectation of payment and that you expressly waive any future pay claims against the U.S. Federal government related to your contribution.\n\nIf you are a U.S. Federal government employee and use a `*.mil` or `*.gov` email address, we interpret your Signed-off-by to mean that the contribution was created in whole or in part by you and that your contribution is not subject to copyright protections.\n\n### 4. DCO Text\n\nThe full text of the DCO is included below and is available online at [developercertificate.org](https://developercertificate.org):\n\n```txt\nDeveloper Certificate of Origin\nVersion 1.1\n\nCopyright (C) 2004, 2006 The Linux Foundation and its contributors.\n1 Letterman Drive\nSuite D4700\nSan Francisco, CA, 94129\n\nEveryone is permitted to copy and distribute verbatim copies of this\nlicense document, but changing it is not allowed.\n\nDeveloper's Certificate of Origin 1.1\n\nBy making a contribution to this project, I certify that:\n\n(a) The contribution was created in whole or in part by me and I\n    have the right to submit it under the open source license\n    indicated in the file; or\n\n(b) The contribution is based upon previous work that, to the best\n    of my knowledge, is covered under an appropriate open source\n    license and I have the right under that license to submit that\n    work with modifications, whether created in whole or in part\n    by me, under the same open source license (unless I am\n    permitted to submit under a different license), as indicated\n    in the file; or\n\n(c) The contribution was provided directly to me by some other\n    person who certified (a), (b) or (c) and I have not modified\n    it.\n\n(d) I understand and agree that this project and the contribution\n    are public and that a record of the contribution (including all\n    personal information I submit with it, including my sign-off) is\n    maintained indefinitely and may be redistributed consistent with\n    this project or the open source license(s) involved.\n```\n"
  },
  {
    "path": "CONTRIBUTORS.md",
    "content": "# Contributors\n\n**By adding your name, email address, and copyright date below, you understand and agree to the terms of the [Developer's Certificate of Origin](https://developercertificate.org/) (DCO) version 1.1, and you are submitting all contributions you make to this Project pursuant to the terms described in [LICENSE.md](LICENSE.md).**\n\n## Signed-off-by\n\n- Copyright 2020-2026 U.S. Federal Government (in countries where recognized)\n- Copyright 2020-2026 Carl Smigielski, carl.a.smigielski@saic.com\n- Copyright 2020-2026 Christopher Daley, cdaley@rite-solutions.com\n- Copyright 2023-2026 Mathew Ferreira, mferreira@rite-solutions.com\n- Copyright 2021 Russell Johnson, russell.d.johnson@saic.com\n- Copyright 2024 Rajesh Shrestha, rshrestha@rite-solutions.com\n- Copyright 2024 David Whalen, david.whalen@usmc.mil\n- Copyright 2025 Christian Rodriguez, christian.a.rodriguez@mantech.com\n- _Add the copyright date, your name, and email address here. (PLEASE KEEP THIS LINE)_\n\n## Note for U.S. Federal Employees\n\nIf you're a U.S. Federal Government employee and use a `*.mil` or `*.gov` email address to agree to the DCO, we interpret your signed DCO to mean that the contribution was created in whole or in part by you as part of your job with the U.S. Federal Government and that your contribution is not subject to copyright protections.\n"
  },
  {
    "path": "Dockerfile",
    "content": "# STIG Manager OSS\n# \n# COPY commands assume the following lines in .dockerignore\n# **/node_modules\n# **/state.json\n# **/README.md\n# **/.git\n# **/.gitignore\n# **/data\n# **/docs\n# **/test\n# **/uploads\n# **/docker\n\nARG BASE_IMAGE=\"node:lts-alpine\"\nFROM ${BASE_IMAGE}\nLABEL maintainer=\"carl.a.smigielski@saic.com\"\nARG COMMIT_BRANCH=\"\"\nARG COMMIT_SHA=\"\"\nARG COMMIT_TAG=\"\"\nARG COMMIT_DESCRIBE=\"\"\nLABEL commit-branch=${COMMIT_BRANCH}\nLABEL commit-sha=${COMMIT_SHA}\nLABEL commit-tag=${COMMIT_TAG}\nLABEL commit-describe=${COMMIT_DESCRIBE}\n\nWORKDIR /home/node\nUSER node\n\n# Install app dependencies\nCOPY --chown=node:node ./api/source .\nRUN npm ci\n\nRUN mkdir client\n# Requires the client build files. Alternatively, copy ./client/src \nCOPY --chown=node:node ./client/dist ./client\n\nRUN mkdir docs\nCOPY --chown=node:node ./docs/_build/html ./docs\n\n# Ensure sticky bit is set on all world-writable directories (fixes tenable 1000749)\nUSER root\nRUN df -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type d -perm -0002 2>/dev/null | xargs chmod a+t 2>/dev/null | echo 'tenable 1000749'\nUSER node\n\n# Set environment\nENV COMMIT_SHA=${COMMIT_SHA} \\\nCOMMIT_BRANCH=${COMMIT_BRANCH} \\\nCOMMIT_TAG=${COMMIT_TAG} \\\nCOMMIT_DESCRIBE=${COMMIT_DESCRIBE} \\\nSTIGMAN_CLIENT_DIRECTORY=./client \\\nSTIGMAN_DOCS_DIRECTORY=./docs\n\nEXPOSE 54000\nCMD [ \"node\", \"index.js\" ]\n"
  },
  {
    "path": "INTENT.md",
    "content": "# Licensing Intent\nThe intent is that this software and documentation (\"Project\") should be treated as if it is licensed under the license associated with the Project (\"License\") in the LICENSE.md file. However, because we are part of the United States (U.S.) Federal Government, it is not that simple.\n\nThe portions of this Project written by United States (U.S.) Federal government employees within the scope of their federal employment are ineligible for copyright protection in the U.S.; this is generally understood to mean that these portions of the Project are placed in the public domain.\n\nIn countries where copyright protection is available (which does not include the U.S.), contributions made by U.S. Federal government employees are released under the License. Merged contributions from private contributors are released under the License.\n"
  },
  {
    "path": "LICENSE.md",
    "content": "\r\n---\r\n\r\n*For all code except the STIG Manager client*\r\n\r\n---\r\n\r\n## MIT License\r\n\r\n```\r\nCopyright (c) 2020-2026 U.S. Federal Government (in countries where recognized)\r\nCopyright (c) 2020-2026 Science Applications International Corporation\r\nCopyright (c) 2020-2026 Rite-Solutions, An Arcfield Company\r\n\r\nPermission is hereby granted, free of charge, to any person obtaining a copy\r\nof this software and associated documentation files (the \"Software\"), to deal\r\nin the Software without restriction, including without limitation the rights\r\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\r\ncopies of the Software, and to permit persons to whom the Software is\r\nfurnished to do so, subject to the following conditions:\r\n\r\nThe above copyright notice and this permission notice shall be included in all\r\ncopies or substantial portions of the Software.\r\n```\r\n---\r\n\r\n*For the STIG Manager client, which uses the ExtJS 3.4 JavaScript framework licensed under the GNU General Public License*\r\n\r\n---\r\n\r\n## GNU GENERAL PUBLIC LICENSE\r\nVersion 3, 29 June 2007\r\n\r\nCopyright (C) 2007 [Free Software Foundation, Inc.](http://fsf.org/)\r\n\r\nEveryone is permitted to copy and distribute verbatim copies of this license\r\ndocument, but changing it is not allowed.\r\n\r\n## Preamble\r\n\r\nThe GNU General Public License is a free, copyleft license for software and\r\nother kinds of works.\r\n\r\nThe licenses for most software and other practical works are designed to take\r\naway your freedom to share and change the works. By contrast, the GNU General\r\nPublic License is intended to guarantee your freedom to share and change all\r\nversions of a program--to make sure it remains free software for all its users.\r\nWe, the Free Software Foundation, use the GNU General Public License for most\r\nof our software; it applies also to any other work released this way by its\r\nauthors. You can apply it to your programs, too.\r\n\r\nWhen we speak of free software, we are referring to freedom, not price. Our\r\nGeneral Public Licenses are designed to make sure that you have the freedom to\r\ndistribute copies of free software (and charge for them if you wish), that you\r\nreceive source code or can get it if you want it, that you can change the\r\nsoftware or use pieces of it in new free programs, and that you know you can do\r\nthese things.\r\n\r\nTo protect your rights, we need to prevent others from denying you these rights\r\nor asking you to surrender the rights. Therefore, you have certain\r\nresponsibilities if you distribute copies of the software, or if you modify it:\r\nresponsibilities to respect the freedom of others.\r\n\r\nFor example, if you distribute copies of such a program, whether gratis or for\r\na fee, you must pass on to the recipients the same freedoms that you received.\r\nYou must make sure that they, too, receive or can get the source code. And you\r\nmust show them these terms so they know their rights.\r\n\r\nDevelopers that use the GNU GPL protect your rights with two steps:\r\n\r\n  1. assert copyright on the software, and\r\n  2. offer you this License giving you legal permission to copy, distribute\r\n     and/or modify it.\r\n\r\nFor the developers' and authors' protection, the GPL clearly explains that\r\nthere is no warranty for this free software. For both users' and authors' sake,\r\nthe GPL requires that modified versions be marked as changed, so that their\r\nproblems will not be attributed erroneously to authors of previous versions.\r\n\r\nSome devices are designed to deny users access to install or run modified\r\nversions of the software inside them, although the manufacturer can do so. This\r\nis fundamentally incompatible with the aim of protecting users' freedom to\r\nchange the software. The systematic pattern of such abuse occurs in the area of\r\nproducts for individuals to use, which is precisely where it is most\r\nunacceptable. Therefore, we have designed this version of the GPL to prohibit\r\nthe practice for those products. If such problems arise substantially in other\r\ndomains, we stand ready to extend this provision to those domains in future\r\nversions of the GPL, as needed to protect the freedom of users.\r\n\r\nFinally, every program is threatened constantly by software patents. States\r\nshould not allow patents to restrict development and use of software on\r\ngeneral-purpose computers, but in those that do, we wish to avoid the special\r\ndanger that patents applied to a free program could make it effectively\r\nproprietary. To prevent this, the GPL assures that patents cannot be used to\r\nrender the program non-free.\r\n\r\nThe precise terms and conditions for copying, distribution and modification\r\nfollow.\r\n\r\n## TERMS AND CONDITIONS\r\n\r\n### 0. Definitions.\r\n\r\n*This License* refers to version 3 of the GNU General Public License.\r\n\r\n*Copyright* also means copyright-like laws that apply to other kinds of works,\r\nsuch as semiconductor masks.\r\n\r\n*The Program* refers to any copyrightable work licensed under this License.\r\nEach licensee is addressed as *you*. *Licensees* and *recipients* may be\r\nindividuals or organizations.\r\n\r\nTo *modify* a work means to copy from or adapt all or part of the work in a\r\nfashion requiring copyright permission, other than the making of an exact copy.\r\nThe resulting work is called a *modified version* of the earlier work or a work\r\n*based on* the earlier work.\r\n\r\nA *covered work* means either the unmodified Program or a work based on the\r\nProgram.\r\n\r\nTo *propagate* a work means to do anything with it that, without permission,\r\nwould make you directly or secondarily liable for infringement under applicable\r\ncopyright law, except executing it on a computer or modifying a private copy.\r\nPropagation includes copying, distribution (with or without modification),\r\nmaking available to the public, and in some countries other activities as well.\r\n\r\nTo *convey* a work means any kind of propagation that enables other parties to\r\nmake or receive copies. Mere interaction with a user through a computer\r\nnetwork, with no transfer of a copy, is not conveying.\r\n\r\nAn interactive user interface displays *Appropriate Legal Notices* to the\r\nextent that it includes a convenient and prominently visible feature that\r\n\r\n  1. displays an appropriate copyright notice, and\r\n  2. tells the user that there is no warranty for the work (except to the\r\n     extent that warranties are provided), that licensees may convey the work\r\n     under this License, and how to view a copy of this License.\r\n\r\nIf the interface presents a list of user commands or options, such as a menu, a\r\nprominent item in the list meets this criterion.\r\n\r\n### 1. Source Code.\r\n\r\nThe *source code* for a work means the preferred form of the work for making\r\nmodifications to it. *Object code* means any non-source form of a work.\r\n\r\nA *Standard Interface* means an interface that either is an official standard\r\ndefined by a recognized standards body, or, in the case of interfaces specified\r\nfor a particular programming language, one that is widely used among developers\r\nworking in that language.\r\n\r\nThe *System Libraries* of an executable work include anything, other than the\r\nwork as a whole, that (a) is included in the normal form of packaging a Major\r\nComponent, but which is not part of that Major Component, and (b) serves only\r\nto enable use of the work with that Major Component, or to implement a Standard\r\nInterface for which an implementation is available to the public in source code\r\nform. A *Major Component*, in this context, means a major essential component\r\n(kernel, window system, and so on) of the specific operating system (if any) on\r\nwhich the executable work runs, or a compiler used to produce the work, or an\r\nobject code interpreter used to run it.\r\n\r\nThe *Corresponding Source* for a work in object code form means all the source\r\ncode needed to generate, install, and (for an executable work) run the object\r\ncode and to modify the work, including scripts to control those activities.\r\nHowever, it does not include the work's System Libraries, or general-purpose\r\ntools or generally available free programs which are used unmodified in\r\nperforming those activities but which are not part of the work. For example,\r\nCorresponding Source includes interface definition files associated with source\r\nfiles for the work, and the source code for shared libraries and dynamically\r\nlinked subprograms that the work is specifically designed to require, such as\r\nby intimate data communication or control flow between those subprograms and\r\nother parts of the work.\r\n\r\nThe Corresponding Source need not include anything that users can regenerate\r\nautomatically from other parts of the Corresponding Source.\r\n\r\nThe Corresponding Source for a work in source code form is that same work.\r\n\r\n### 2. Basic Permissions.\r\n\r\nAll rights granted under this License are granted for the term of copyright on\r\nthe Program, and are irrevocable provided the stated conditions are met. This\r\nLicense explicitly affirms your unlimited permission to run the unmodified\r\nProgram. The output from running a covered work is covered by this License only\r\nif the output, given its content, constitutes a covered work. This License\r\nacknowledges your rights of fair use or other equivalent, as provided by\r\ncopyright law.\r\n\r\nYou may make, run and propagate covered works that you do not convey, without\r\nconditions so long as your license otherwise remains in force. You may convey\r\ncovered works to others for the sole purpose of having them make modifications\r\nexclusively for you, or provide you with facilities for running those works,\r\nprovided that you comply with the terms of this License in conveying all\r\nmaterial for which you do not control copyright. Those thus making or running\r\nthe covered works for you must do so exclusively on your behalf, under your\r\ndirection and control, on terms that prohibit them from making any copies of\r\nyour copyrighted material outside their relationship with you.\r\n\r\nConveying under any other circumstances is permitted solely under the\r\nconditions stated below. Sublicensing is not allowed; section 10 makes it\r\nunnecessary.\r\n\r\n### 3. Protecting Users' Legal Rights From Anti-Circumvention Law.\r\n\r\nNo covered work shall be deemed part of an effective technological measure\r\nunder any applicable law fulfilling obligations under article 11 of the WIPO\r\ncopyright treaty adopted on 20 December 1996, or similar laws prohibiting or\r\nrestricting circumvention of such measures.\r\n\r\nWhen you convey a covered work, you waive any legal power to forbid\r\ncircumvention of technological measures to the extent such circumvention is\r\neffected by exercising rights under this License with respect to the covered\r\nwork, and you disclaim any intention to limit operation or modification of the\r\nwork as a means of enforcing, against the work's users, your or third parties'\r\nlegal rights to forbid circumvention of technological measures.\r\n\r\n### 4. Conveying Verbatim Copies.\r\n\r\nYou may convey verbatim copies of the Program's source code as you receive it,\r\nin any medium, provided that you conspicuously and appropriately publish on\r\neach copy an appropriate copyright notice; keep intact all notices stating that\r\nthis License and any non-permissive terms added in accord with section 7 apply\r\nto the code; keep intact all notices of the absence of any warranty; and give\r\nall recipients a copy of this License along with the Program.\r\n\r\nYou may charge any price or no price for each copy that you convey, and you may\r\noffer support or warranty protection for a fee.\r\n\r\n### 5. Conveying Modified Source Versions.\r\n\r\nYou may convey a work based on the Program, or the modifications to produce it\r\nfrom the Program, in the form of source code under the terms of section 4,\r\nprovided that you also meet all of these conditions:\r\n\r\n  - a) The work must carry prominent notices stating that you modified it, and\r\n    giving a relevant date.\r\n  - b) The work must carry prominent notices stating that it is released under\r\n    this License and any conditions added under section 7. This requirement\r\n    modifies the requirement in section 4 to *keep intact all notices*.\r\n  - c) You must license the entire work, as a whole, under this License to\r\n    anyone who comes into possession of a copy. This License will therefore\r\n    apply, along with any applicable section 7 additional terms, to the whole\r\n    of the work, and all its parts, regardless of how they are packaged. This\r\n    License gives no permission to license the work in any other way, but it\r\n    does not invalidate such permission if you have separately received it.\r\n  - d) If the work has interactive user interfaces, each must display\r\n    Appropriate Legal Notices; however, if the Program has interactive\r\n    interfaces that do not display Appropriate Legal Notices, your work need\r\n    not make them do so.\r\n\r\nA compilation of a covered work with other separate and independent works,\r\nwhich are not by their nature extensions of the covered work, and which are not\r\ncombined with it such as to form a larger program, in or on a volume of a\r\nstorage or distribution medium, is called an *aggregate* if the compilation and\r\nits resulting copyright are not used to limit the access or legal rights of the\r\ncompilation's users beyond what the individual works permit. Inclusion of a\r\ncovered work in an aggregate does not cause this License to apply to the other\r\nparts of the aggregate.\r\n\r\n### 6. Conveying Non-Source Forms.\r\n\r\nYou may convey a covered work in object code form under the terms of sections 4\r\nand 5, provided that you also convey the machine-readable Corresponding Source\r\nunder the terms of this License, in one of these ways:\r\n\r\n  - a) Convey the object code in, or embodied in, a physical product (including\r\n    a physical distribution medium), accompanied by the Corresponding Source\r\n    fixed on a durable physical medium customarily used for software\r\n    interchange.\r\n  - b) Convey the object code in, or embodied in, a physical product (including\r\n    a physical distribution medium), accompanied by a written offer, valid for\r\n    at least three years and valid for as long as you offer spare parts or\r\n    customer support for that product model, to give anyone who possesses the\r\n    object code either\r\n    1. a copy of the Corresponding Source for all the software in the product\r\n       that is covered by this License, on a durable physical medium\r\n       customarily used for software interchange, for a price no more than your\r\n       reasonable cost of physically performing this conveying of source, or\r\n    2. access to copy the Corresponding Source from a network server at no\r\n       charge.\r\n  - c) Convey individual copies of the object code with a copy of the written\r\n    offer to provide the Corresponding Source. This alternative is allowed only\r\n    occasionally and noncommercially, and only if you received the object code\r\n    with such an offer, in accord with subsection 6b.\r\n  - d) Convey the object code by offering access from a designated place\r\n    (gratis or for a charge), and offer equivalent access to the Corresponding\r\n    Source in the same way through the same place at no further charge. You\r\n    need not require recipients to copy the Corresponding Source along with the\r\n    object code. If the place to copy the object code is a network server, the\r\n    Corresponding Source may be on a different server operated by you or a\r\n    third party) that supports equivalent copying facilities, provided you\r\n    maintain clear directions next to the object code saying where to find the\r\n    Corresponding Source. Regardless of what server hosts the Corresponding\r\n    Source, you remain obligated to ensure that it is available for as long as\r\n    needed to satisfy these requirements.\r\n  - e) Convey the object code using peer-to-peer transmission, provided you\r\n    inform other peers where the object code and Corresponding Source of the\r\n    work are being offered to the general public at no charge under subsection\r\n    6d.\r\n\r\nA separable portion of the object code, whose source code is excluded from the\r\nCorresponding Source as a System Library, need not be included in conveying the\r\nobject code work.\r\n\r\nA *User Product* is either\r\n\r\n  1. a *consumer product*, which means any tangible personal property which is\r\n     normally used for personal, family, or household purposes, or\r\n  2. anything designed or sold for incorporation into a dwelling.\r\n\r\nIn determining whether a product is a consumer product, doubtful cases shall be\r\nresolved in favor of coverage. For a particular product received by a\r\nparticular user, *normally used* refers to a typical or common use of that\r\nclass of product, regardless of the status of the particular user or of the way\r\nin which the particular user actually uses, or expects or is expected to use,\r\nthe product. A product is a consumer product regardless of whether the product\r\nhas substantial commercial, industrial or non-consumer uses, unless such uses\r\nrepresent the only significant mode of use of the product.\r\n\r\n*Installation Information* for a User Product means any methods, procedures,\r\nauthorization keys, or other information required to install and execute\r\nmodified versions of a covered work in that User Product from a modified\r\nversion of its Corresponding Source. The information must suffice to ensure\r\nthat the continued functioning of the modified object code is in no case\r\nprevented or interfered with solely because modification has been made.\r\n\r\nIf you convey an object code work under this section in, or with, or\r\nspecifically for use in, a User Product, and the conveying occurs as part of a\r\ntransaction in which the right of possession and use of the User Product is\r\ntransferred to the recipient in perpetuity or for a fixed term (regardless of\r\nhow the transaction is characterized), the Corresponding Source conveyed under\r\nthis section must be accompanied by the Installation Information. But this\r\nrequirement does not apply if neither you nor any third party retains the\r\nability to install modified object code on the User Product (for example, the\r\nwork has been installed in ROM).\r\n\r\nThe requirement to provide Installation Information does not include a\r\nrequirement to continue to provide support service, warranty, or updates for a\r\nwork that has been modified or installed by the recipient, or for the User\r\nProduct in which it has been modified or installed. Access to a network may be\r\ndenied when the modification itself materially and adversely affects the\r\noperation of the network or violates the rules and protocols for communication\r\nacross the network.\r\n\r\nCorresponding Source conveyed, and Installation Information provided, in accord\r\nwith this section must be in a format that is publicly documented (and with an\r\nimplementation available to the public in source code form), and must require\r\nno special password or key for unpacking, reading or copying.\r\n\r\n### 7. Additional Terms.\r\n\r\n*Additional permissions* are terms that supplement the terms of this License by\r\nmaking exceptions from one or more of its conditions. Additional permissions\r\nthat are applicable to the entire Program shall be treated as though they were\r\nincluded in this License, to the extent that they are valid under applicable\r\nlaw. If additional permissions apply only to part of the Program, that part may\r\nbe used separately under those permissions, but the entire Program remains\r\ngoverned by this License without regard to the additional permissions.\r\n\r\nWhen you convey a copy of a covered work, you may at your option remove any\r\nadditional permissions from that copy, or from any part of it. (Additional\r\npermissions may be written to require their own removal in certain cases when\r\nyou modify the work.) You may place additional permissions on material, added\r\nby you to a covered work, for which you have or can give appropriate copyright\r\npermission.\r\n\r\nNotwithstanding any other provision of this License, for material you add to a\r\ncovered work, you may (if authorized by the copyright holders of that material)\r\nsupplement the terms of this License with terms:\r\n\r\n  - a) Disclaiming warranty or limiting liability differently from the terms of\r\n    sections 15 and 16 of this License; or\r\n  - b) Requiring preservation of specified reasonable legal notices or author\r\n    attributions in that material or in the Appropriate Legal Notices displayed\r\n    by works containing it; or\r\n  - c) Prohibiting misrepresentation of the origin of that material, or\r\n    requiring that modified versions of such material be marked in reasonable\r\n    ways as different from the original version; or\r\n  - d) Limiting the use for publicity purposes of names of licensors or authors\r\n    of the material; or\r\n  - e) Declining to grant rights under trademark law for use of some trade\r\n    names, trademarks, or service marks; or\r\n  - f) Requiring indemnification of licensors and authors of that material by\r\n    anyone who conveys the material (or modified versions of it) with\r\n    contractual assumptions of liability to the recipient, for any liability\r\n    that these contractual assumptions directly impose on those licensors and\r\n    authors.\r\n\r\nAll other non-permissive additional terms are considered *further restrictions*\r\nwithin the meaning of section 10. If the Program as you received it, or any\r\npart of it, contains a notice stating that it is governed by this License along\r\nwith a term that is a further restriction, you may remove that term. If a\r\nlicense document contains a further restriction but permits relicensing or\r\nconveying under this License, you may add to a covered work material governed\r\nby the terms of that license document, provided that the further restriction\r\ndoes not survive such relicensing or conveying.\r\n\r\nIf you add terms to a covered work in accord with this section, you must place,\r\nin the relevant source files, a statement of the additional terms that apply to\r\nthose files, or a notice indicating where to find the applicable terms.\r\n\r\nAdditional terms, permissive or non-permissive, may be stated in the form of a\r\nseparately written license, or stated as exceptions; the above requirements\r\napply either way.\r\n\r\n### 8. Termination.\r\n\r\nYou may not propagate or modify a covered work except as expressly provided\r\nunder this License. Any attempt otherwise to propagate or modify it is void,\r\nand will automatically terminate your rights under this License (including any\r\npatent licenses granted under the third paragraph of section 11).\r\n\r\nHowever, if you cease all violation of this License, then your license from a\r\nparticular copyright holder is reinstated\r\n\r\n  - a) provisionally, unless and until the copyright holder explicitly and\r\n    finally terminates your license, and\r\n  - b) permanently, if the copyright holder fails to notify you of the\r\n    violation by some reasonable means prior to 60 days after the cessation.\r\n\r\nMoreover, your license from a particular copyright holder is reinstated\r\npermanently if the copyright holder notifies you of the violation by some\r\nreasonable means, this is the first time you have received notice of violation\r\nof this License (for any work) from that copyright holder, and you cure the\r\nviolation prior to 30 days after your receipt of the notice.\r\n\r\nTermination of your rights under this section does not terminate the licenses\r\nof parties who have received copies or rights from you under this License. If\r\nyour rights have been terminated and not permanently reinstated, you do not\r\nqualify to receive new licenses for the same material under section 10.\r\n\r\n### 9. Acceptance Not Required for Having Copies.\r\n\r\nYou are not required to accept this License in order to receive or run a copy\r\nof the Program. Ancillary propagation of a covered work occurring solely as a\r\nconsequence of using peer-to-peer transmission to receive a copy likewise does\r\nnot require acceptance. However, nothing other than this License grants you\r\npermission to propagate or modify any covered work. These actions infringe\r\ncopyright if you do not accept this License. Therefore, by modifying or\r\npropagating a covered work, you indicate your acceptance of this License to do\r\nso.\r\n\r\n### 10. Automatic Licensing of Downstream Recipients.\r\n\r\nEach time you convey a covered work, the recipient automatically receives a\r\nlicense from the original licensors, to run, modify and propagate that work,\r\nsubject to this License. You are not responsible for enforcing compliance by\r\nthird parties with this License.\r\n\r\nAn *entity transaction* is a transaction transferring control of an\r\norganization, or substantially all assets of one, or subdividing an\r\norganization, or merging organizations. If propagation of a covered work\r\nresults from an entity transaction, each party to that transaction who receives\r\na copy of the work also receives whatever licenses to the work the party's\r\npredecessor in interest had or could give under the previous paragraph, plus a\r\nright to possession of the Corresponding Source of the work from the\r\npredecessor in interest, if the predecessor has it or can get it with\r\nreasonable efforts.\r\n\r\nYou may not impose any further restrictions on the exercise of the rights\r\ngranted or affirmed under this License. For example, you may not impose a\r\nlicense fee, royalty, or other charge for exercise of rights granted under this\r\nLicense, and you may not initiate litigation (including a cross-claim or\r\ncounterclaim in a lawsuit) alleging that any patent claim is infringed by\r\nmaking, using, selling, offering for sale, or importing the Program or any\r\nportion of it.\r\n\r\n### 11. Patents.\r\n\r\nA *contributor* is a copyright holder who authorizes use under this License of\r\nthe Program or a work on which the Program is based. The work thus licensed is\r\ncalled the contributor's *contributor version*.\r\n\r\nA contributor's *essential patent claims* are all patent claims owned or\r\ncontrolled by the contributor, whether already acquired or hereafter acquired,\r\nthat would be infringed by some manner, permitted by this License, of making,\r\nusing, or selling its contributor version, but do not include claims that would\r\nbe infringed only as a consequence of further modification of the contributor\r\nversion. For purposes of this definition, *control* includes the right to grant\r\npatent sublicenses in a manner consistent with the requirements of this\r\nLicense.\r\n\r\nEach contributor grants you a non-exclusive, worldwide, royalty-free patent\r\nlicense under the contributor's essential patent claims, to make, use, sell,\r\noffer for sale, import and otherwise run, modify and propagate the contents of\r\nits contributor version.\r\n\r\nIn the following three paragraphs, a *patent license* is any express agreement\r\nor commitment, however denominated, not to enforce a patent (such as an express\r\npermission to practice a patent or covenant not to sue for patent\r\ninfringement). To *grant* such a patent license to a party means to make such\r\nan agreement or commitment not to enforce a patent against the party.\r\n\r\nIf you convey a covered work, knowingly relying on a patent license, and the\r\nCorresponding Source of the work is not available for anyone to copy, free of\r\ncharge and under the terms of this License, through a publicly available\r\nnetwork server or other readily accessible means, then you must either\r\n\r\n  1. cause the Corresponding Source to be so available, or\r\n  2. arrange to deprive yourself of the benefit of the patent license for this\r\n     particular work, or\r\n  3. arrange, in a manner consistent with the requirements of this License, to\r\n     extend the patent license to downstream recipients.\r\n\r\n*Knowingly relying* means you have actual knowledge that, but for the patent\r\nlicense, your conveying the covered work in a country, or your recipient's use\r\nof the covered work in a country, would infringe one or more identifiable\r\npatents in that country that you have reason to believe are valid.\r\n\r\nIf, pursuant to or in connection with a single transaction or arrangement, you\r\nconvey, or propagate by procuring conveyance of, a covered work, and grant a\r\npatent license to some of the parties receiving the covered work authorizing\r\nthem to use, propagate, modify or convey a specific copy of the covered work,\r\nthen the patent license you grant is automatically extended to all recipients\r\nof the covered work and works based on it.\r\n\r\nA patent license is *discriminatory* if it does not include within the scope of\r\nits coverage, prohibits the exercise of, or is conditioned on the non-exercise\r\nof one or more of the rights that are specifically granted under this License.\r\nYou may not convey a covered work if you are a party to an arrangement with a\r\nthird party that is in the business of distributing software, under which you\r\nmake payment to the third party based on the extent of your activity of\r\nconveying the work, and under which the third party grants, to any of the\r\nparties who would receive the covered work from you, a discriminatory patent\r\nlicense\r\n\r\n  - a) in connection with copies of the covered work conveyed by you (or copies\r\n    made from those copies), or\r\n  - b) primarily for and in connection with specific products or compilations\r\n    that contain the covered work, unless you entered into that arrangement, or\r\n    that patent license was granted, prior to 28 March 2007.\r\n\r\nNothing in this License shall be construed as excluding or limiting any implied\r\nlicense or other defenses to infringement that may otherwise be available to\r\nyou under applicable patent law.\r\n\r\n### 12. No Surrender of Others' Freedom.\r\n\r\nIf conditions are imposed on you (whether by court order, agreement or\r\notherwise) that contradict the conditions of this License, they do not excuse\r\nyou from the conditions of this License. If you cannot convey a covered work so\r\nas to satisfy simultaneously your obligations under this License and any other\r\npertinent obligations, then as a consequence you may not convey it at all. For\r\nexample, if you agree to terms that obligate you to collect a royalty for\r\nfurther conveying from those to whom you convey the Program, the only way you\r\ncould satisfy both those terms and this License would be to refrain entirely\r\nfrom conveying the Program.\r\n\r\n### 13. Use with the GNU Affero General Public License.\r\n\r\nNotwithstanding any other provision of this License, you have permission to\r\nlink or combine any covered work with a work licensed under version 3 of the\r\nGNU Affero General Public License into a single combined work, and to convey\r\nthe resulting work. The terms of this License will continue to apply to the\r\npart which is the covered work, but the special requirements of the GNU Affero\r\nGeneral Public License, section 13, concerning interaction through a network\r\nwill apply to the combination as such.\r\n\r\n### 14. Revised Versions of this License.\r\n\r\nThe Free Software Foundation may publish revised and/or new versions of the GNU\r\nGeneral Public License from time to time. Such new versions will be similar in\r\nspirit to the present version, but may differ in detail to address new problems\r\nor concerns.\r\n\r\nEach version is given a distinguishing version number. If the Program specifies\r\nthat a certain numbered version of the GNU General Public License *or any later\r\nversion* applies to it, you have the option of following the terms and\r\nconditions either of that numbered version or of any later version published by\r\nthe Free Software Foundation. If the Program does not specify a version number\r\nof the GNU General Public License, you may choose any version ever published by\r\nthe Free Software Foundation.\r\n\r\nIf the Program specifies that a proxy can decide which future versions of the\r\nGNU General Public License can be used, that proxy's public statement of\r\nacceptance of a version permanently authorizes you to choose that version for\r\nthe Program.\r\n\r\nLater license versions may give you additional or different permissions.\r\nHowever, no additional obligations are imposed on any author or copyright\r\nholder as a result of your choosing to follow a later version.\r\n\r\n### 15. Disclaimer of Warranty.\r\n\r\nTHERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE\r\nLAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER\r\nPARTIES PROVIDE THE PROGRAM *AS IS* WITHOUT WARRANTY OF ANY KIND, EITHER\r\nEXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF\r\nMERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE\r\nQUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE\r\nDEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR\r\nCORRECTION.\r\n\r\n### 16. Limitation of Liability.\r\n\r\nIN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY\r\nCOPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS\r\nPERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL,\r\nINCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE\r\nTHE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED\r\nINACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE\r\nPROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY\r\nHAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.\r\n\r\n### 17. Interpretation of Sections 15 and 16.\r\n\r\nIf the disclaimer of warranty and limitation of liability provided above cannot\r\nbe given local legal effect according to their terms, reviewing courts shall\r\napply local law that most closely approximates an absolute waiver of all civil\r\nliability in connection with the Program, unless a warranty or assumption of\r\nliability accompanies a copy of the Program in return for a fee.\r\n\r\n## END OF TERMS AND CONDITIONS ###\r\n\r\n### How to Apply These Terms to Your New Programs\r\n\r\nIf you develop a new program, and you want it to be of the greatest possible\r\nuse to the public, the best way to achieve this is to make it free software\r\nwhich everyone can redistribute and change under these terms.\r\n\r\nTo do so, attach the following notices to the program. It is safest to attach\r\nthem to the start of each source file to most effectively state the exclusion\r\nof warranty; and each file should have at least the *copyright* line and a\r\npointer to where the full notice is found.\r\n\r\n\t<one line to give the program's name and a brief idea of what it does.>\r\n\tCopyright (C) <year>  <name of author>\r\n\t\r\n\tThis program is free software: you can redistribute it and/or modify\r\n\tit under the terms of the GNU General Public License as published by\r\n\tthe Free Software Foundation, either version 3 of the License, or\r\n\t(at your option) any later version.\r\n\t\r\n\tThis program is distributed in the hope that it will be useful,\r\n\tbut WITHOUT ANY WARRANTY; without even the implied warranty of\r\n\tMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\r\n\tGNU General Public License for more details.\r\n\t\r\n\tYou should have received a copy of the GNU General Public License\r\n\talong with this program.  If not, see <http://www.gnu.org/licenses/>.\r\n\r\nAlso add information on how to contact you by electronic and paper mail.\r\n\r\nIf the program does terminal interaction, make it output a short notice like\r\nthis when it starts in an interactive mode:\r\n\r\n\t<program>  Copyright (C) <year>  <name of author>\r\n\tThis program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.\r\n\tThis is free software, and you are welcome to redistribute it\r\n\tunder certain conditions; type `show c' for details.\r\n\r\nThe hypothetical commands `show w` and `show c` should show the appropriate\r\nparts of the General Public License. Of course, your program's commands might\r\nbe different; for a GUI interface, you would use an *about box*.\r\n\r\nYou should also get your employer (if you work as a programmer) or school, if\r\nany, to sign a *copyright disclaimer* for the program, if necessary. For more\r\ninformation on this, and how to apply and follow the GNU GPL, see\r\n[http://www.gnu.org/licenses/](http://www.gnu.org/licenses/).\r\n\r\nThe GNU General Public License does not permit incorporating your program into\r\nproprietary programs. If your program is a subroutine library, you may consider\r\nit more useful to permit linking proprietary applications with the library. If\r\nthis is what you want to do, use the GNU Lesser General Public License instead\r\nof this License. But first, please read\r\n[http://www.gnu.org/philosophy/why-not-lgpl.html](http://www.gnu.org/philosophy/why-not-lgpl.html).\r\n\r\n---\r\n\r\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\r\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\r\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\r\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\r\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\r\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\r\nSOFTWARE.\r\n\r\n\r\n"
  },
  {
    "path": "README.md",
    "content": "# STIG Manager\n\nSTIG Manager is an API and web client for managing STIG assessments of Information Systems, sponsored by the [NAVSEA Warfare Centers](https://www.navsea.navy.mil/Home/Warfare-Centers/). The application presents a unified view of STIG compliance drawn from manual reviews in the web app, file imports (.ckl/.cklb/XCCDF), or automated integrations via the API. STIG Manager supports DISA [Security Technical Implementation Guides (STIGs)](https://public.cyber.mil/stigs/) and Security Requirements Guides (SRGs).\n\n## Who It's For\n\nIf you need to track STIG evaluation status across multiple assets, STIGs, or systems, this tool addresses the challenges of managing assessment data that would otherwise be scattered across individual checklist files or spreadsheets.\n\nSystem administrators can record compliance status in real-time as they harden systems, and scan results from external tools can flow in automatically via the API, providing ISSOs and security managers with live visibility into assessment progress. Working from a shared data set ensures all users maintain a consistent view of compliance status.\n\n## Key Capabilities\n\n- **Collection-Based Organization**: Group Assets, STIGs, and Reviews into Collections that align with your RMF packages or organizational structure; use customizable Labels to categorize Assets and filter views.\n- **Progress Tracking and Metrics**: Real-time dashboards showing assessment completion rates, findings by severity, CORA risk scoring, and status tracking.\n- **Multi-Source Review Integration**: Combine manual evaluations with imported scan results (XCCDF) and checklists (CKL) in a unified data management interface.\n- **Intelligent STIG Revision Management**: When DISA releases new STIG versions, only Rules with changed check content require re-evaluation. Existing reviews are automatically matched to updated Rules where appropriate.\n- **Bulk Operations**: Evaluate the same Rule across multiple Assets simultaneously in the Collection Review workspace, apply batch updates, and import/export entire Collections.\n- **Collaborative Workflows**: Role-based access controls, Accept/Reject review validation, and configurable review requirements per Collection.\n- **API-First Architecture**: Complete REST API (OpenAPI 3.0.1) enables integration with automated scanning tools and custom workflows. The API-first architecture allows custom or third-party clients to interact with assessment data. \n\n## Screenshots\n\n### Collection Dashboard\n*Real-time metrics showing assessment completion, findings by severity, and CORA risk scoring*\n\n<img src=\"docs/assets/images/metrics-report-collection.png\" alt=\"Collection Dashboard\" width=\"800\">\n\n### Asset Review Workspace\n*Assessment interface with Rule details, CCI/Control mappings, and reference to previous assessments on similar Assets*\n\n<img src=\"docs/assets/images/asset-review.png\" alt=\"Asset Review Workspace\" width=\"800\">\n\n### Collection Review Workspace\n*Evaluate the same STIG Rule across all Assets in a Collection, with color-coded status and the ability to apply bulk updates*\n\n<img src=\"docs/assets/images/collection-review.png\" alt=\"Collection Review Workspace\" width=\"800\">\n\n### Meta-Collection Dashboard\n*Aggregate metrics across all Collections you have access to, providing organization-wide visibility into assessment status*\n\n<img src=\"docs/assets/images/meta-collection-dashboard.png\" alt=\"Meta-Collection Dashboard\" width=\"800\">\n\n\n## Role in RMF Workflows\n\nSTIG Manager primarily supports **RMF Steps 3 (Implement Security Controls)** and **4 (Assess Security Controls)** by serving as the authoritative reference for current STIG assessment status. During **Step 6 (Monitor Security Controls)**, it tracks review ages, maintains assessment history, and identifies what requires re-evaluation when STIGs update or systems change.\n\nThe tool fits within existing processes that typically involve eMASS (or similar RMF platforms), SCAP compliance scanners, and other security tools. STIG Manager does not replace these systems—it specializes in STIG assessment tracking and can import results from scanning tools, export checklists for package submission, and support custom automation via its API.\n\n## Getting Started\n\n- [User Walkthrough](https://stig-manager.readthedocs.io/en/latest/user-guide/user-quickstart.html) - Learn the core workflows for security analysts\n- [Admin Walkthrough](https://stig-manager.readthedocs.io/en/latest/admin-guide/admin-quickstart.html) - Setup and Collection management for Application Managers\n- [Installation Guide](https://stig-manager.readthedocs.io/en/latest/installation-and-setup/installation-and-setup.html) - Deployment instructions and configuration\n- [Environment Variables Reference](https://stig-manager.readthedocs.io/en/latest/installation-and-setup/environment-variables.html)\n\n## Deployment Options\n\n**Containerized (Recommended):**\n- Official [Docker images](https://hub.docker.com/r/nuwcdivnpt/stig-manager) available on Docker Hub and DoD Iron Bank\n  - Quick-start Docker Compose orchestration includes all dependencies (Keycloak, MySQL)\n- [Reference orchestration with CAC/PKI authentication](https://github.com/NUWCDIVNPT/stigman-orchestration) demonstrates nginx reverse proxy integration\n  - Supports Kubernetes, OpenShift, or any OCI-compliant container runtime\n\n**Direct Deployment:**\n- Run from source using Node.js LTS\n- Pre-compiled binaries for Windows/Linux/macOS (no Node.js required)\n\n**Infrastructure Requirements:**\n- OpenID Connect (OIDC) provider for authentication (Keycloak, Okta, Azure Entra ID, and F5 tested)\n- MySQL 8.4+ database\n- Optional reverse proxy for CAC/PKI authentication\n\nThe application is stateless and can scale horizontally. Configuration is managed entirely through environment variables.\n\n## Documentation and Resources\n\nThe [STIG Manager documentation](https://stig-manager.readthedocs.io/en/latest/index.html) includes User and Setup Guides, video tutorials, terminology references, and deployment scenarios.\n\n- [YouTube Channel](https://www.youtube.com/@stig-manager) - Video tutorials and feature demonstrations\n- [Release Notes](https://github.com/NUWCDIVNPT/stig-manager/releases) - Version history\n- [Contribution Guide](CONTRIBUTING.md) - DCO requirements and development setup\n\n## Related Resources\n\n**[STIGMan Watcher](https://github.com/NUWCDIVNPT/stigman-watcher)** - A command-line utility that monitors filesystem directories and automatically imports .ckl/.cklb checklists and XCCDF scan results into STIG Manager. Useful for automated workflows and continuous integration with scanning tools.\n\n**[Reference orchestration with CAC/PKI authentication](https://github.com/NUWCDIVNPT/stigman-orchestration)** - A sample Docker Compose setup that includes nginx configured for CAC/PKI authentication in front of STIG Manager and Keycloak.\n\n**[C-PAT](https://github.com/NSWC-Crane/C-PAT)** - The Crane POA&M Automation Tool, developed by NSWC Crane, integrates with STIG Manager's API to automate vulnerability documentation and POA&M tracking throughout the RMF process.\n\n\n## Sponsor\n\nSTIG Manager is sponsored by the [NAVSEA Warfare Centers](https://www.navsea.navy.mil/Home/Warfare-Centers/). While its primary goal is to support NAVSEA compliance processes, the tool is designed to be flexible and adaptable to other workflows. This project follows [Code.mil](https://code.mil) [guidance](https://github.com/Code-dot-mil/code.mil) for open source software released by the U.S. Department of Defense.\n\nFor inquiries, contact the RMF Tools team at RMF_Tools@us.navy.mil."
  },
  {
    "path": "SECURITY.md",
    "content": "# Security Policy\n\n## Supported Versions\n\nThe STIG Manager Team makes every effort to produce secure software. The project addresses vulnerabilities in the application with new mainline releases. Old versions will not be patched. All users are expected to stay up to date with security and feature updates by running only the latest release available. \n\n| Version | Supported          |\n| ------- | ------------------ |\n| Current   | :white_check_mark: |\n| All previous   | :x:                |\n\n\n## Reporting a Vulnerability\n\nVulnerability scans are run regularly against project components and any issues identified are addressed. Nevertheless, we are grateful to anyone reporting a vulnerability and helping us to make STIG Manager better and more secure. Additionally, we encourage everyone to disclose bugs in a responsible way, allowing us and other STIGMan users to react accordingly and in a timely manner. That means:\n\n- If you want to report a critical security bug or vulnerability please send a bug report to RMF_Tools@us.navy.mil before publishing it. We will acknowledge your email within a week (7 days), and will send a more detailed response up to 48 hours after that indicating the next steps in handling your report. After the initial reply to your report, the security team will endeavor to keep you informed of the progress towards a fix and an announcement. We may ask for additional information or guidance. When disclosing vulnerabilities please include the following:\n    - The word \"SECURITY\" in the subject line.\n    - Your name and affiliation (if any).\n    - Scope of vulnerability. Let us know who could use this exploit.\n    - Documented steps to identify the vulnerability. It is important that we can reproduce your findings.\n\n\n- If you want to report a non-critical bug, please open an issue on the GitHub project. If you are using a scanning tool to identify a vulnerability, please attempt to determine whether or not the issue is a false positive before reporting, and if it is not, include the specific scanner, settings, and config you used to identify it.\n\n- Report security bugs in third-party modules to the person or team maintaining the module.\n\n- This is an open source project. If you discover a bug and fix it, you are very welcome to submit a PR. Your fix will be reviewed, and if accepted, you will become a valued addition to our CONTRIBUTORS.md file!\n\n- Known vulnerabilities will be published on the [Security Advisories page of the project's GitHub site.](https://github.com/NUWCDIVNPT/stig-manager/security/advisories)\n\n\n## Securing STIG Manager\n\nSTIG Manager is one component of a system that must be deployed according to your individual or organizational security requirements. \n\nPlease see the [project Documentation for more information on this topic.](https://stig-manager.readthedocs.io/en/latest/installation-and-setup/securing.html)\n"
  },
  {
    "path": "api/README.md",
    "content": "# STIG Manager API for Node.js\n\n## Required Node version\nThe API requires Node 14.0.0 or greater\n\n## Building binaries\n- Read the comments in `build.sh` regarding build requirements\n- Run `./build.sh` or `build.sh --sign`\n- Binaries are written to `./bin`\n- Archives with launcher scripts are written to `./dist`\n\n## Configuring and running the API\nThe API is configured through [environment variables](../docs/Environment_Variables.md). The entry point is `index.js`\n"
  },
  {
    "path": "api/bin/.gitignore",
    "content": "## Directory for the STIG Manager API binaries\n\n# Content can be written here by executing:\n# $ ../build.sh\n#\n# This file hopes to prevent commits to this directory\n\n# Ignore everything in this directory\n*\n\n# Except this file\n!.gitignore\n"
  },
  {
    "path": "api/build.sh",
    "content": "#!/bin/bash\n\n# This file is used to build API binaries on the team workstations. It is not tested elsewhere, yet.\n# Requires:\n# - Node.js and module \"@yao-pkg/pkg\" (npm install -g @yao-pkg/pkg@6.10)\n# - zip\n# - tar\n\n\ncheck_exit_status() {\n  if [[ $? -eq 0 ]]; then\n    echo \"[BUILD_TASK] $1 succeeded\"\n  else\n    echo \"[BUILD_TASK] $1 failed\"\n    exit $2\n  fi\n}\n\nLAUNCHERDIR=launchers\nBINDIR=bin\nDISTDIR=dist\n\n# Change to this script directory\ncd \"$(dirname \"$(realpath \"$0\")\")\"\n\n# Prepare\n[ ! -d \"$BINDIR\" ] && mkdir -p \"$BINDIR\"\n[ ! -d \"$DISTDIR\" ] && mkdir -p \"$DISTDIR\"\nrm -rf $BINDIR/*\nrm -rf $DISTDIR/*\necho \"Fetching node_modules\"\nrm -rf ./source/node_modules\ncd ./source\nnpm ci\nnpm install -g @yao-pkg/pkg@6.10\ncd ..\n../client/build.sh\n../docs/build.sh\n\nDESCRIBE=$(git describe --tags | sed 's/\\(.*\\)-.*/\\1/')\ncheck_exit_status \"Getting latest tag\" 4\necho $DESCRIBE\n\n# Make binaries\necho \"Building binaries\"\npkg ./source/index.js -C gzip --public --public-packages=* --no-bytecode -c pkg.config.json\ncheck_exit_status \"Building binaries\" 1\n\necho \"Creating archives with launchers\"\n# Windows archive\nzip --junk-paths $DISTDIR/stig-manager-win-$DESCRIBE.zip $LAUNCHERDIR/stig-manager.bat $BINDIR/stig-manager-win.exe\ncheck_exit_status \"Zipping Windows Archive\" 3\n\n# Linux archive\ntar -cJvf $DISTDIR/stig-manager-linux-$DESCRIBE.tar.xz --xform='s|^|stig-manager/|S' -C $LAUNCHERDIR stig-manager.sh -C ../$BINDIR stig-manager-linuxstatic\ncheck_exit_status \"Zipping Linux Archive\" 4\n\necho \"Build artifacts are in $DISTDIR\""
  },
  {
    "path": "api/dist/.gitignore",
    "content": "## Directory for the STIG Manager API distribution archives\n\n# Content can be written here by executing:\n# $ ../build.sh\n#\n# This file hopes to prevent commits to this directory\n\n# Ignore everything in this directory\n*\n\n# Except this file\n!.gitignore\n"
  },
  {
    "path": "api/launchers/gen-launchers.py",
    "content": "#!/usr/bin/python3\nimport sys\nimport os\nimport io\nimport csv\nimport textwrap\n\nif len(sys.argv) > 1 and sys.argv[1] == 'win':\n  system = 'win'\n  comment = '::'\n  command = 'set'\n  launch = 'stig-manager-win.exe'\n  filename = 'stig-manager.bat'\n  newline = '\\r\\n'\nelse:\n  system = 'linux'\n  comment = '#'\n  command = 'export'\n  launch = './stig-manager-linuxstatic'\n  filename = 'stig-manager.sh'\n  newline = '\\n'\n\n\nwith open('../../docs/installation-and-setup/envvars.csv', 'r') as csvfile:\n    reader = csv.DictReader(csvfile)\n    with io.open(filename, 'w', newline=newline) as f:\n      for row in reader:\n          row['Description'] = row['Description'].replace('**Default**', 'Default:')\n          row['Description'] = row['Description'].replace('**No default**', 'No default.')\n          row['Description'] = row['Description'].replace('``', '\"')\n          row['Description'] = '\\n'.join(textwrap.wrap(row['Description'], width=80, initial_indent=comment + '  ', subsequent_indent=comment + '  '))\n          f.write('{0}==============================================================================\\n'.format(comment))\n          content = '{0} {1}\\n{0}\\n{2}\\n{0}\\n{0}  Affects: {3}\\n'.format(comment, row['Variable'], row['Description'], row['Affects'])\n          f.write(content)\n          f.write('{0}==============================================================================\\n'.format(comment))\n          f.write('{0} {1} {2}=\\n'.format(comment, command, row['Variable']))\n          f.write('\\n')\n      f.write(launch + '\\n')\n\nif system == 'linux':\n  os.chmod(filename, 0o755)\n"
  },
  {
    "path": "api/launchers/stig-manager.bat",
    "content": "::==============================================================================\r\n:: STIGMAN_API_ADDRESS\r\n::\r\n::  | Default: \"0.0.0.0\" | The IP address on which the the API server will\r\n::  listen\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_API_ADDRESS=\r\n\r\n::==============================================================================\r\n:: STIGMAN_API_MAX_JSON_BODY\r\n::\r\n::  | Default: \"5242880\" | The maximum size in bytes of the request body when\r\n::  Content-Type is application/json\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_API_MAX_JSON_BODY=\r\n\r\n::==============================================================================\r\n:: STIGMAN_API_MAX_UPLOAD\r\n::\r\n::  | Default: \"1073741824\" | The maximum size in bytes of the file uploaded\r\n::  with Content-Type multipart/form-data\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_API_MAX_UPLOAD=\r\n\r\n::==============================================================================\r\n:: STIGMAN_API_PORT\r\n::\r\n::  | Default: \"54000\" | The TCP port on which the server will listen\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_API_PORT=\r\n\r\n::==============================================================================\r\n:: STIGMAN_API_TLS_CERT_FILE\r\n::\r\n::  | No default. | A absolute path to the file that contains the PEM encoded\r\n::  Server certificate used for TLS. Additionally requires setting\r\n::  \"STIGMAN_API_TLS_KEY_FILE\" to enable TLS.\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_API_TLS_CERT_FILE=\r\n\r\n::==============================================================================\r\n:: STIGMAN_API_TLS_KEY_FILE\r\n::\r\n::  | No default. | A absolute path to the file that contains the PEM encoded\r\n::  Server private key used for TLS. Additionally requires setting\r\n::  \"STIGMAN_API_TLS_CERT_FILE\" to enable TLS.\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_API_TLS_KEY_FILE=\r\n\r\n::==============================================================================\r\n:: STIGMAN_API_TLS_KEY_PASSPHRASE\r\n::\r\n::  | No default. | If necessary, the passphrase that decrypts the PEM encoded\r\n::  Server private key used for TLS. Additionally requires setting\r\n::  \"STIGMAN_API_TLS_CERT_FILE\" to enable TLS.\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_API_TLS_KEY_PASSPHRASE=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLASSIFICATION\r\n::\r\n::  | Default: \"U\" | Sets the classification banner, if any. Available values:\r\n::  \"NONE\" \"U\" \"CUI\" \"C\" \"S\" \"TS\" \"SCI\"\r\n::\r\n::  Affects: API, Client\r\n::==============================================================================\r\n:: set STIGMAN_CLASSIFICATION=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_ADMIN_TIMEOUT\r\n::\r\n::  | Default: \"0\" | The maximum time (in minutes) a user with admin privileges\r\n::  can be inactive in the web client before discarding their access token and\r\n::  requiring reauthorization. Activity is defined as mouse click, keypress, or\r\n::  scrolling in any tab or window of a same-origin browsing context group. Set\r\n::  to zero to disable idle detection.\r\n::\r\n::  Affects: Client\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_ADMIN_TIMEOUT=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_API_BASE\r\n::\r\n::  | Default: \"api\" | The base URL for Client requests to the API relative to\r\n::  \"window.location\"\r\n::\r\n::  Affects: Client\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_API_BASE=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_CONSOLE_MODE\r\n::\r\n::  | Default: \"production\" | The console mode of the web client, setting to\r\n::  \"development\" enables console logging which is otherwise disabled\r\n::\r\n::  Affects: Client\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_CONSOLE_MODE=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_DIRECTORY\r\n::\r\n::  | Default: \"./clients\" | The location of the web client files, relative to\r\n::  the API source directory. Note that if running source from a clone of the\r\n::  GitHub repository, the client is located at `../../clients` relative to the\r\n::  API directory.\r\n::\r\n::  Affects: API, Client\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_DIRECTORY=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_DISABLED\r\n::\r\n::  | Default: \"false\" | Whether to *not* serve the reference web client\r\n::\r\n::  Affects: Client\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_DISABLED=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_DISPLAY_APPMANAGERS\r\n::\r\n::  | Default: \"true\" | Whether to display application managers the home page of\r\n::  web client\r\n::\r\n::  Affects: Client\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_DISPLAY_APPMANAGERS=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_EXTRA_SCOPES\r\n::\r\n::  | No default. | A space separated list of OAuth2 scopes to request in\r\n::  addition to \"stig-manager:stig\" \"stig-manager:stig:read\" \"stig-\r\n::  manager:collection\" \"stig-manager:user\" \"stig-manager:user:read\" \"stig-\r\n::  manager:op\". Some OIDC providers (Okta) generate a refresh token only if the\r\n::  scope \"offline_access\" is requested\r\n::\r\n::  Affects: Client\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_EXTRA_SCOPES=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_ID\r\n::\r\n::  | Default: \"stig-manager\" | The OIDC clientId of the web client\r\n::\r\n::  Affects: Client\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_ID=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_OIDC_PROVIDER\r\n::\r\n::  | Default: Value of \"STIGMAN_OIDC_PROVIDER\" | Client override of the base\r\n::  URL of the OIDC provider issuing signed JWTs for the API.  The string\r\n::  \"/.well-known/openid-configuration\" will be appended by the client when\r\n::  fetching metadata.\r\n::\r\n::  Affects: Client \r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_OIDC_PROVIDER=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_REAUTH_ACTION\r\n::\r\n::  | Default: \"popup\" | How to prompt for re-authentication when user\r\n::  credentials expire. Available values: \"popup\", \"iframe\", \"tab\", or \"reload\".\r\n::  See :ref:`stigman_client_reauth_action` in the Authentication document for\r\n::  details.\r\n::\r\n::  Affects: Client\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_REAUTH_ACTION=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_RESPONSE_MODE\r\n::\r\n::  | Default: \"fragment\" | The response_mode the web client should specify when\r\n::  requesting an authorization code from the OIDC provider. Available values:\r\n::  \"fragment\", \"query\"\r\n::\r\n::  Affects: Client\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_RESPONSE_MODE=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_SCOPE_PREFIX\r\n::\r\n::  | No default. | String used as a prefix for each scope when authenticating\r\n::  to the OIDC Provider. Some providers (Azure AD) expect scope requests in the\r\n::  format \"api://<application_id>/<scope>\", where \"api://<application_id>/\" is\r\n::  the required prefix.\r\n::\r\n::  Affects: Client\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_SCOPE_PREFIX=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_STATE_EVENTS\r\n::\r\n::  | Default: \"true\" | Whether the web client listens for server sent events\r\n::  (SSE) about the API state. Should only be disabled temporarily while\r\n::  resolving buffering issues on a reverse proxy.\r\n::\r\n::  Affects: Client\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_STATE_EVENTS=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_STRICT_PKCE\r\n::\r\n::  | Default: \"true\" | Whether the web client verifies the OIDC provider is\r\n::  advertising PKCE/S256 support in compliance with RFC 8414. A non-compliant\r\n::  provider supports PKCE/S256 without advertising it. Independent of this\r\n::  value, the web client always exclusively uses PKCE/S256 in the Authorization\r\n::  Code Flow.\r\n::\r\n::  Affects: Client\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_STRICT_PKCE=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_USER_TIMEOUT\r\n::\r\n::  | Default: \"0\" | The maximum time (in minutes) a regular user can be\r\n::  inactive in the web client before discarding their access token and\r\n::  requiring reauthorization. Activity is defined as mouse click, keypress, or\r\n::  scrolling in any tab or window of a same-origin browsing context group. Set\r\n::  to zero to disable idle detection.\r\n::\r\n::  Affects: Client\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_USER_TIMEOUT=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_WELCOME_IMAGE \r\n::\r\n::  | No default. | The URL of an image hosted elsewhere that will be rendered\r\n::  in the Home tab Welcome widget. The STIGMan app does not serve the image\r\n::  itself, only the reference to it. The URL should be in relation to and\r\n::  accessible from the client's browser. The image will be scaled to a max\r\n::  width or height of 125 pixels - If no alternate image is specified, the seal\r\n::  of the Department of the Navy (the project sponsor)  will be displayed.\r\n::\r\n::  Affects: Client Appearance\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_WELCOME_IMAGE =\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_WELCOME_LINK\r\n::\r\n::  | No default. | Value of an optional link that will follow the Welcome\r\n::  message in the Home tab Welcome widget.\r\n::\r\n::  Affects: Client Appearance\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_WELCOME_LINK=\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_WELCOME_MESSAGE \r\n::\r\n::  | No default. | Text that will be displayed in the Home tab Welcome widget.\r\n::\r\n::  Affects: Client Appearance\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_WELCOME_MESSAGE =\r\n\r\n::==============================================================================\r\n:: STIGMAN_CLIENT_WELCOME_TITLE \r\n::\r\n::  | Default: \"Support\" | The tile that will be displayed for the custom Home\r\n::  tab Welcome message.\r\n::\r\n::  Affects: Client Appearance\r\n::==============================================================================\r\n:: set STIGMAN_CLIENT_WELCOME_TITLE =\r\n\r\n::==============================================================================\r\n:: STIGMAN_DB_HOST\r\n::\r\n::  | Default: \"localhost\" | The database hostname or IP from to the API server\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_DB_HOST=\r\n\r\n::==============================================================================\r\n:: STIGMAN_DB_MAX_CONNECTIONS\r\n::\r\n::  | Default: \"25\" | The maximum size of the database connection pool\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_DB_MAX_CONNECTIONS=\r\n\r\n::==============================================================================\r\n:: STIGMAN_DB_PASSWORD\r\n::\r\n::  | No default. | The password used to login to the database\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_DB_PASSWORD=\r\n\r\n::==============================================================================\r\n:: STIGMAN_DB_PORT\r\n::\r\n::  | Default: \"3306\" | The database TCP port relative to the API server\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_DB_PORT=\r\n\r\n::==============================================================================\r\n:: STIGMAN_DB_SCHEMA\r\n::\r\n::  | Default: \"stigman\" | The schema where the STIG Manager object are found\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_DB_SCHEMA=\r\n\r\n::==============================================================================\r\n:: STIGMAN_DB_TLS_CA_FILE\r\n::\r\n::  | No default. | An absolute path or a path relative to the API /tls\r\n::  directory that contains the PEM encoded CA certificate used to sign the\r\n::  database TLS certificate. Setting this variable enables TLS connections to\r\n::  the database.\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_DB_TLS_CA_FILE=\r\n\r\n::==============================================================================\r\n:: STIGMAN_DB_TLS_CERT_FILE\r\n::\r\n::  | No default. | An absolute path or a path relative to the API /tls\r\n::  directory that contains the PEM encoded Client certificate used when\r\n::  authenticating the database client. Additionally requires setting values for\r\n::  \"STIGMAN_DB_TLS_CA_FILE\" and \"STIGMAN_DB_TLS_KEY_FILE\".\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_DB_TLS_CERT_FILE=\r\n\r\n::==============================================================================\r\n:: STIGMAN_DB_TLS_KEY_FILE\r\n::\r\n::  | No default. | An absolute path or a path relative to the API /tls\r\n::  directory that contains the PEM encoded Client private key used when\r\n::  authenticating the database client. Additionally requires setting values for\r\n::  \"STIGMAN_DB_TLS_CA_FILE\" and \"STIGMAN_DB_TLS_CERT_FILE\".\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_DB_TLS_KEY_FILE=\r\n\r\n::==============================================================================\r\n:: STIGMAN_DB_USER\r\n::\r\n::  | Default: \"stigman\" | The user account used to login to the database\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_DB_USER=\r\n\r\n::==============================================================================\r\n:: STIGMAN_DEPENDENCY_RETRIES\r\n::\r\n::  | Default: \"24\" | During startup, the number of attempts made to establish\r\n::  connections to the database and OIDC Provider. Retries are made every 5\r\n::  seconds and the API process exits if unsuccessful.\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_DEPENDENCY_RETRIES=\r\n\r\n::==============================================================================\r\n:: STIGMAN_DEV_ALLOW_INSECURE_TOKENS\r\n::\r\n::  | Default: \"false\" | Controls whether known insecure JWT signing keys are\r\n::  allowed. Only for development/testing purposes. Setting to 'true' is NOT\r\n::  recommended for production environments.\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_DEV_ALLOW_INSECURE_TOKENS=\r\n\r\n::==============================================================================\r\n:: STIGMAN_DEV_LOG_OPT_STATS\r\n::\r\n::  | Default: \"true\" | Controls whether the API will track API operation\r\n::  statistics used for populating \"Requests\" portion of \"/op/appinfo\" response\r\n::  body. Setting to 'false' is NOT recommended for production environments, as\r\n::  this info can be useful for troubleshooting.\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_DEV_LOG_OPT_STATS=\r\n\r\n::==============================================================================\r\n:: STIGMAN_DEV_RESPONSE_VALIDATION\r\n::\r\n::  | Default: \"none\" | Controls whether the API will perform response\r\n::  validation on API responses. If set to 'logOnly' the API will output log\r\n::  entries indicating deviations from the OAS specification. Intended for\r\n::  development/testing purposes. Available values: \"none\", \"logOnly\"\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_DEV_RESPONSE_VALIDATION=\r\n\r\n::==============================================================================\r\n:: STIGMAN_DOCS_DIRECTORY\r\n::\r\n::  | Default: \"./docs\" | The location of the documentation files, relative to\r\n::  the API source directory. Note that if running source from a clone of the\r\n::  GitHub repository, the docs are located at `../../docs/_build/html` relative\r\n::  to the API directory.\r\n::\r\n::  Affects: API, Documentation\r\n::==============================================================================\r\n:: set STIGMAN_DOCS_DIRECTORY=\r\n\r\n::==============================================================================\r\n:: STIGMAN_DOCS_DISABLED\r\n::\r\n::  | Default: \"false\" | Whether to *not* serve the project Documentation.\r\n::  NOTE: If you choose to serve the Client from the API container but not the\r\n::  Documentation, the links do the Docs on the home page will not work.\r\n::\r\n::  Affects: Documentation\r\n::==============================================================================\r\n:: set STIGMAN_DOCS_DISABLED=\r\n\r\n::==============================================================================\r\n:: STIGMAN_EXPERIMENTAL_APPDATA\r\n::\r\n::  | Default:  \"false\" | Set to \"true\" to enable the experimental AppData\r\n::  import/export API endpoints and User Interface.\r\n::\r\n::  Affects: API, Client\r\n::==============================================================================\r\n:: set STIGMAN_EXPERIMENTAL_APPDATA=\r\n\r\n::==============================================================================\r\n:: STIGMAN_EXPERIMENTAL_LOGSTREAM\r\n::\r\n::  | Default:  \"true\" | Set to \"false\" to disable the experimental WebSocket\r\n::  for streaming API logs and the corresponding User Interface.\r\n::\r\n::  Affects: API, Client\r\n::==============================================================================\r\n:: set STIGMAN_EXPERIMENTAL_LOGSTREAM=\r\n\r\n::==============================================================================\r\n:: STIGMAN_LOG_LEVEL\r\n::\r\n::  | Default: \"3\" | Controls the granularity of the generated log output, from\r\n::  1 to 4. Each level is inclusive of the ones before it. Level 1 will log only\r\n::  errors, level 2 includes warnings, level 3 includes status and transaction\r\n::  logs, and level 4 includes debug-level logs\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_LOG_LEVEL=\r\n\r\n::==============================================================================\r\n:: STIGMAN_LOG_MODE\r\n::\r\n::  | Default: \"combined\" | Controls whether the logs will create one “combined”\r\n::  log entry for http requests that includes both the request and response\r\n::  information; or two separate log entries, one for the request and one for\r\n::  the response, that can be correlated via a generated Request GUID in each\r\n::  entry\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_LOG_MODE=\r\n\r\n::==============================================================================\r\n:: STIGMAN_JWKS_CACHE_MAX_AGE\r\n::\r\n::  | Default: \"10\" | The time in minutes after which the API's cache of JWT\r\n::  signing keys is deemed stale and the API becomes unavailable. Cache\r\n::  refreshes are scheduled at intervals of half this value and also occur when\r\n::  an unknown signing key is presented. Scheduled refresh failures are retried\r\n::  every 10 seconds.\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_JWKS_CACHE_MAX_AGE=\r\n\r\n::==============================================================================\r\n:: STIGMAN_JWT_ASSERTION_CLAIM\r\n::\r\n::  | Default: \"jti\" | The access token claim whose value is the OIDC provider's\r\n::  Assertion ID. Updates to this value trigger the API to update a User's\r\n::  \"lastClaims\" property. The claim MUST NOT be nested and MUST be a valid\r\n::  ECMAScript identifier. See :ref:`jwt_requirements` for token value format\r\n::  requirements.\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_JWT_ASSERTION_CLAIM=\r\n\r\n::==============================================================================\r\n:: STIGMAN_JWT_AUD_VALUE\r\n::\r\n::  | No default. | If present, a string which must be included in the access\r\n::  token \"aud\" claim for requests to endpoints requiring authorization. See\r\n::  :ref:`jwt_requirements` for token value format requirements.\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_JWT_AUD_VALUE=\r\n\r\n::==============================================================================\r\n:: STIGMAN_JWT_EMAIL_CLAIM\r\n::\r\n::  | Default: \"email\" | The access token claim whose value is the user's email\r\n::  address. The claim MUST NOT be nested and MUST be a valid ECMAScript\r\n::  identifier. See :ref:`jwt_requirements` for token value format requirements.\r\n::\r\n::  Affects: API, Client\r\n::==============================================================================\r\n:: set STIGMAN_JWT_EMAIL_CLAIM=\r\n\r\n::==============================================================================\r\n:: STIGMAN_JWT_NAME_CLAIM\r\n::\r\n::  | Default: \"name\" | The access token claim whose value is the user's full\r\n::  name. The claim MUST NOT be nested and MUST be a valid ECMAScript\r\n::  identifier. See :ref:`jwt_requirements` for token value format requirements.\r\n::\r\n::  Affects: API, Client\r\n::==============================================================================\r\n:: set STIGMAN_JWT_NAME_CLAIM=\r\n\r\n::==============================================================================\r\n:: STIGMAN_JWT_PRIVILEGES_CLAIM\r\n::\r\n::  | Default: \"realm_access.roles\" | The access token claim whose value is the\r\n::  user's privileges. The claim MAY be nested but SHOULD avoid invalid\r\n::  ECMAScript identifiers. See :ref:`jwt_requirements` for token value format\r\n::  requirements.\r\n::\r\n::  Affects: API, Client\r\n::==============================================================================\r\n:: set STIGMAN_JWT_PRIVILEGES_CLAIM=\r\n\r\n::==============================================================================\r\n:: STIGMAN_JWT_SCOPE_CLAIM\r\n::\r\n::  | Default: \"scope\" | The access token claim whose value is the user's\r\n::  scopes. Some OIDC Providers (Okta, Azure AD) use the claim \"scp\" to\r\n::  enumerate scopes. The claim MUST NOT be nested and MUST be a valid\r\n::  ECMAScript identifier. See :ref:`jwt_requirements` for token value format\r\n::  requirements.\r\n::\r\n::  Affects: API, Client\r\n::==============================================================================\r\n:: set STIGMAN_JWT_SCOPE_CLAIM=\r\n\r\n::==============================================================================\r\n:: STIGMAN_JWT_SERVICENAME_CLAIM\r\n::\r\n::  | Default: \"clientId\" | The access token claim whose value is the service\r\n::  account's client. The claim MUST NOT be nested and MUST be a valid\r\n::  ECMAScript identifier. See :ref:`jwt_requirements` for token value format\r\n::  requirements.\r\n::\r\n::  Affects: API, Client\r\n::==============================================================================\r\n:: set STIGMAN_JWT_SERVICENAME_CLAIM=\r\n\r\n::==============================================================================\r\n:: STIGMAN_JWT_USERNAME_CLAIM\r\n::\r\n::  | Default: \"preferred_username\" | The access token claim whose value is the\r\n::  user's username. The claim MUST NOT be nested and MUST be a valid ECMAScript\r\n::  identifier. See :ref:`jwt_requirements` for token value format requirements.\r\n::\r\n::  Affects: API, Client\r\n::==============================================================================\r\n:: set STIGMAN_JWT_USERNAME_CLAIM=\r\n\r\n::==============================================================================\r\n:: STIGMAN_OIDC_CA_CERTS\r\n::\r\n::  | No default. | The full path to a file with one or more PEM-encoded CA\r\n::  certificates for validating TLS connections to the OIDC Provider.\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_OIDC_CA_CERTS=\r\n\r\n::==============================================================================\r\n:: STIGMAN_OIDC_PROVIDER\r\n::\r\n::  | Default: \"http://localhost:8080/auth/realms/stigman\" | The base URL of the\r\n::  OIDC provider issuing signed JWTs for the API.  The string \"/.well-\r\n::  known/openid-configuration\" will be appended when fetching metadata.\r\n::\r\n::  Affects: API, Client\r\n::==============================================================================\r\n:: set STIGMAN_OIDC_PROVIDER=\r\n\r\n::==============================================================================\r\n:: STIGMAN_SWAGGER_ENABLED\r\n::\r\n::  | Default: \"false\" | Whether to enable the SwaggerUI SPA at /api-docs\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_SWAGGER_ENABLED=\r\n\r\n::==============================================================================\r\n:: STIGMAN_SWAGGER_OIDC_PROVIDER\r\n::\r\n::  | Default: Value of \"STIGMAN_OIDC_PROVIDER\" | SwaggerUI override of the base\r\n::  URL of the OIDC provider issuing signed JWTs for the API.  The string\r\n::  \"/.well-known/openid-configuration\" will be appended by the SwaggerUI when\r\n::  fetching metadata.\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_SWAGGER_OIDC_PROVIDER=\r\n\r\n::==============================================================================\r\n:: STIGMAN_SWAGGER_REDIRECT\r\n::\r\n::  | Default: \"http://localhost:54000/api-docs/oauth2-redirect.html\" | The\r\n::  redirect URL sent by SwaggerUI to the OIDC provider when authorizing\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_SWAGGER_REDIRECT=\r\n\r\n::==============================================================================\r\n:: STIGMAN_SWAGGER_SERVER\r\n::\r\n::  | Default: \"http://localhost:54000/api\" | The API server URL relative to the\r\n::  SwaggerUI\r\n::\r\n::  Affects: API\r\n::==============================================================================\r\n:: set STIGMAN_SWAGGER_SERVER=\r\n\r\nstig-manager-win.exe\r\n"
  },
  {
    "path": "api/launchers/stig-manager.sh",
    "content": "#==============================================================================\n# STIGMAN_API_ADDRESS\n#\n#  | Default: \"0.0.0.0\" | The IP address on which the the API server will listen\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_API_ADDRESS=\n\n#==============================================================================\n# STIGMAN_API_MAX_JSON_BODY\n#\n#  | Default: \"5242880\" | The maximum size in bytes of the request body when\n#  Content-Type is application/json\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_API_MAX_JSON_BODY=\n\n#==============================================================================\n# STIGMAN_API_MAX_UPLOAD\n#\n#  | Default: \"1073741824\" | The maximum size in bytes of the file uploaded with\n#  Content-Type multipart/form-data\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_API_MAX_UPLOAD=\n\n#==============================================================================\n# STIGMAN_API_PORT\n#\n#  | Default: \"54000\" | The TCP port on which the server will listen\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_API_PORT=\n\n#==============================================================================\n# STIGMAN_API_TLS_CERT_FILE\n#\n#  | No default. | A absolute path to the file that contains the PEM encoded\n#  Server certificate used for TLS. Additionally requires setting\n#  \"STIGMAN_API_TLS_KEY_FILE\" to enable TLS.\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_API_TLS_CERT_FILE=\n\n#==============================================================================\n# STIGMAN_API_TLS_KEY_FILE\n#\n#  | No default. | A absolute path to the file that contains the PEM encoded\n#  Server private key used for TLS. Additionally requires setting\n#  \"STIGMAN_API_TLS_CERT_FILE\" to enable TLS.\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_API_TLS_KEY_FILE=\n\n#==============================================================================\n# STIGMAN_API_TLS_KEY_PASSPHRASE\n#\n#  | No default. | If necessary, the passphrase that decrypts the PEM encoded\n#  Server private key used for TLS. Additionally requires setting\n#  \"STIGMAN_API_TLS_CERT_FILE\" to enable TLS.\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_API_TLS_KEY_PASSPHRASE=\n\n#==============================================================================\n# STIGMAN_CLASSIFICATION\n#\n#  | Default: \"U\" | Sets the classification banner, if any. Available values:\n#  \"NONE\" \"U\" \"CUI\" \"C\" \"S\" \"TS\" \"SCI\"\n#\n#  Affects: API, Client\n#==============================================================================\n# export STIGMAN_CLASSIFICATION=\n\n#==============================================================================\n# STIGMAN_CLIENT_ADMIN_TIMEOUT\n#\n#  | Default: \"0\" | The maximum time (in minutes) a user with admin privileges\n#  can be inactive in the web client before discarding their access token and\n#  requiring reauthorization. Activity is defined as mouse click, keypress, or\n#  scrolling in any tab or window of a same-origin browsing context group. Set\n#  to zero to disable idle detection.\n#\n#  Affects: Client\n#==============================================================================\n# export STIGMAN_CLIENT_ADMIN_TIMEOUT=\n\n#==============================================================================\n# STIGMAN_CLIENT_API_BASE\n#\n#  | Default: \"api\" | The base URL for Client requests to the API relative to\n#  \"window.location\"\n#\n#  Affects: Client\n#==============================================================================\n# export STIGMAN_CLIENT_API_BASE=\n\n#==============================================================================\n# STIGMAN_CLIENT_CONSOLE_MODE\n#\n#  | Default: \"production\" | The console mode of the web client, setting to\n#  \"development\" enables console logging which is otherwise disabled\n#\n#  Affects: Client\n#==============================================================================\n# export STIGMAN_CLIENT_CONSOLE_MODE=\n\n#==============================================================================\n# STIGMAN_CLIENT_DIRECTORY\n#\n#  | Default: \"./clients\" | The location of the web client files, relative to\n#  the API source directory. Note that if running source from a clone of the\n#  GitHub repository, the client is located at `../../clients` relative to the\n#  API directory.\n#\n#  Affects: API, Client\n#==============================================================================\n# export STIGMAN_CLIENT_DIRECTORY=\n\n#==============================================================================\n# STIGMAN_CLIENT_DISABLED\n#\n#  | Default: \"false\" | Whether to *not* serve the reference web client\n#\n#  Affects: Client\n#==============================================================================\n# export STIGMAN_CLIENT_DISABLED=\n\n#==============================================================================\n# STIGMAN_CLIENT_DISPLAY_APPMANAGERS\n#\n#  | Default: \"true\" | Whether to display application managers the home page of\n#  web client\n#\n#  Affects: Client\n#==============================================================================\n# export STIGMAN_CLIENT_DISPLAY_APPMANAGERS=\n\n#==============================================================================\n# STIGMAN_CLIENT_EXTRA_SCOPES\n#\n#  | No default. | A space separated list of OAuth2 scopes to request in\n#  addition to \"stig-manager:stig\" \"stig-manager:stig:read\" \"stig-\n#  manager:collection\" \"stig-manager:user\" \"stig-manager:user:read\" \"stig-\n#  manager:op\". Some OIDC providers (Okta) generate a refresh token only if the\n#  scope \"offline_access\" is requested\n#\n#  Affects: Client\n#==============================================================================\n# export STIGMAN_CLIENT_EXTRA_SCOPES=\n\n#==============================================================================\n# STIGMAN_CLIENT_ID\n#\n#  | Default: \"stig-manager\" | The OIDC clientId of the web client\n#\n#  Affects: Client\n#==============================================================================\n# export STIGMAN_CLIENT_ID=\n\n#==============================================================================\n# STIGMAN_CLIENT_OIDC_PROVIDER\n#\n#  | Default: Value of \"STIGMAN_OIDC_PROVIDER\" | Client override of the base URL\n#  of the OIDC provider issuing signed JWTs for the API.  The string \"/.well-\n#  known/openid-configuration\" will be appended by the client when fetching\n#  metadata.\n#\n#  Affects: Client \n#==============================================================================\n# export STIGMAN_CLIENT_OIDC_PROVIDER=\n\n#==============================================================================\n# STIGMAN_CLIENT_REAUTH_ACTION\n#\n#  | Default: \"popup\" | How to prompt for re-authentication when user\n#  credentials expire. Available values: \"popup\", \"iframe\", \"tab\", or \"reload\".\n#  See :ref:`stigman_client_reauth_action` in the Authentication document for\n#  details.\n#\n#  Affects: Client\n#==============================================================================\n# export STIGMAN_CLIENT_REAUTH_ACTION=\n\n#==============================================================================\n# STIGMAN_CLIENT_RESPONSE_MODE\n#\n#  | Default: \"fragment\" | The response_mode the web client should specify when\n#  requesting an authorization code from the OIDC provider. Available values:\n#  \"fragment\", \"query\"\n#\n#  Affects: Client\n#==============================================================================\n# export STIGMAN_CLIENT_RESPONSE_MODE=\n\n#==============================================================================\n# STIGMAN_CLIENT_SCOPE_PREFIX\n#\n#  | No default. | String used as a prefix for each scope when authenticating to\n#  the OIDC Provider. Some providers (Azure AD) expect scope requests in the\n#  format \"api://<application_id>/<scope>\", where \"api://<application_id>/\" is\n#  the required prefix.\n#\n#  Affects: Client\n#==============================================================================\n# export STIGMAN_CLIENT_SCOPE_PREFIX=\n\n#==============================================================================\n# STIGMAN_CLIENT_STATE_EVENTS\n#\n#  | Default: \"true\" | Whether the web client listens for server sent events\n#  (SSE) about the API state. Should only be disabled temporarily while\n#  resolving buffering issues on a reverse proxy.\n#\n#  Affects: Client\n#==============================================================================\n# export STIGMAN_CLIENT_STATE_EVENTS=\n\n#==============================================================================\n# STIGMAN_CLIENT_STRICT_PKCE\n#\n#  | Default: \"true\" | Whether the web client verifies the OIDC provider is\n#  advertising PKCE/S256 support in compliance with RFC 8414. A non-compliant\n#  provider supports PKCE/S256 without advertising it. Independent of this\n#  value, the web client always exclusively uses PKCE/S256 in the Authorization\n#  Code Flow.\n#\n#  Affects: Client\n#==============================================================================\n# export STIGMAN_CLIENT_STRICT_PKCE=\n\n#==============================================================================\n# STIGMAN_CLIENT_USER_TIMEOUT\n#\n#  | Default: \"0\" | The maximum time (in minutes) a regular user can be inactive\n#  in the web client before discarding their access token and requiring\n#  reauthorization. Activity is defined as mouse click, keypress, or scrolling\n#  in any tab or window of a same-origin browsing context group. Set to zero to\n#  disable idle detection.\n#\n#  Affects: Client\n#==============================================================================\n# export STIGMAN_CLIENT_USER_TIMEOUT=\n\n#==============================================================================\n# STIGMAN_CLIENT_WELCOME_IMAGE \n#\n#  | No default. | The URL of an image hosted elsewhere that will be rendered in\n#  the Home tab Welcome widget. The STIGMan app does not serve the image itself,\n#  only the reference to it. The URL should be in relation to and accessible\n#  from the client's browser. The image will be scaled to a max width or height\n#  of 125 pixels - If no alternate image is specified, the seal of the\n#  Department of the Navy (the project sponsor)  will be displayed.\n#\n#  Affects: Client Appearance\n#==============================================================================\n# export STIGMAN_CLIENT_WELCOME_IMAGE =\n\n#==============================================================================\n# STIGMAN_CLIENT_WELCOME_LINK\n#\n#  | No default. | Value of an optional link that will follow the Welcome\n#  message in the Home tab Welcome widget.\n#\n#  Affects: Client Appearance\n#==============================================================================\n# export STIGMAN_CLIENT_WELCOME_LINK=\n\n#==============================================================================\n# STIGMAN_CLIENT_WELCOME_MESSAGE \n#\n#  | No default. | Text that will be displayed in the Home tab Welcome widget.\n#\n#  Affects: Client Appearance\n#==============================================================================\n# export STIGMAN_CLIENT_WELCOME_MESSAGE =\n\n#==============================================================================\n# STIGMAN_CLIENT_WELCOME_TITLE \n#\n#  | Default: \"Support\" | The tile that will be displayed for the custom Home\n#  tab Welcome message.\n#\n#  Affects: Client Appearance\n#==============================================================================\n# export STIGMAN_CLIENT_WELCOME_TITLE =\n\n#==============================================================================\n# STIGMAN_DB_HOST\n#\n#  | Default: \"localhost\" | The database hostname or IP from to the API server\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_DB_HOST=\n\n#==============================================================================\n# STIGMAN_DB_MAX_CONNECTIONS\n#\n#  | Default: \"25\" | The maximum size of the database connection pool\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_DB_MAX_CONNECTIONS=\n\n#==============================================================================\n# STIGMAN_DB_PASSWORD\n#\n#  | No default. | The password used to login to the database\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_DB_PASSWORD=\n\n#==============================================================================\n# STIGMAN_DB_PORT\n#\n#  | Default: \"3306\" | The database TCP port relative to the API server\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_DB_PORT=\n\n#==============================================================================\n# STIGMAN_DB_SCHEMA\n#\n#  | Default: \"stigman\" | The schema where the STIG Manager object are found\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_DB_SCHEMA=\n\n#==============================================================================\n# STIGMAN_DB_TLS_CA_FILE\n#\n#  | No default. | An absolute path or a path relative to the API /tls directory\n#  that contains the PEM encoded CA certificate used to sign the database TLS\n#  certificate. Setting this variable enables TLS connections to the database.\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_DB_TLS_CA_FILE=\n\n#==============================================================================\n# STIGMAN_DB_TLS_CERT_FILE\n#\n#  | No default. | An absolute path or a path relative to the API /tls directory\n#  that contains the PEM encoded Client certificate used when authenticating the\n#  database client. Additionally requires setting values for\n#  \"STIGMAN_DB_TLS_CA_FILE\" and \"STIGMAN_DB_TLS_KEY_FILE\".\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_DB_TLS_CERT_FILE=\n\n#==============================================================================\n# STIGMAN_DB_TLS_KEY_FILE\n#\n#  | No default. | An absolute path or a path relative to the API /tls directory\n#  that contains the PEM encoded Client private key used when authenticating the\n#  database client. Additionally requires setting values for\n#  \"STIGMAN_DB_TLS_CA_FILE\" and \"STIGMAN_DB_TLS_CERT_FILE\".\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_DB_TLS_KEY_FILE=\n\n#==============================================================================\n# STIGMAN_DB_USER\n#\n#  | Default: \"stigman\" | The user account used to login to the database\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_DB_USER=\n\n#==============================================================================\n# STIGMAN_DEPENDENCY_RETRIES\n#\n#  | Default: \"24\" | During startup, the number of attempts made to establish\n#  connections to the database and OIDC Provider. Retries are made every 5\n#  seconds and the API process exits if unsuccessful.\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_DEPENDENCY_RETRIES=\n\n#==============================================================================\n# STIGMAN_DEV_ALLOW_INSECURE_TOKENS\n#\n#  | Default: \"false\" | Controls whether known insecure JWT signing keys are\n#  allowed. Only for development/testing purposes. Setting to 'true' is NOT\n#  recommended for production environments.\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_DEV_ALLOW_INSECURE_TOKENS=\n\n#==============================================================================\n# STIGMAN_DEV_LOG_OPT_STATS\n#\n#  | Default: \"true\" | Controls whether the API will track API operation\n#  statistics used for populating \"Requests\" portion of \"/op/appinfo\" response\n#  body. Setting to 'false' is NOT recommended for production environments, as\n#  this info can be useful for troubleshooting.\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_DEV_LOG_OPT_STATS=\n\n#==============================================================================\n# STIGMAN_DEV_RESPONSE_VALIDATION\n#\n#  | Default: \"none\" | Controls whether the API will perform response validation\n#  on API responses. If set to 'logOnly' the API will output log entries\n#  indicating deviations from the OAS specification. Intended for\n#  development/testing purposes. Available values: \"none\", \"logOnly\"\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_DEV_RESPONSE_VALIDATION=\n\n#==============================================================================\n# STIGMAN_DOCS_DIRECTORY\n#\n#  | Default: \"./docs\" | The location of the documentation files, relative to\n#  the API source directory. Note that if running source from a clone of the\n#  GitHub repository, the docs are located at `../../docs/_build/html` relative\n#  to the API directory.\n#\n#  Affects: API, Documentation\n#==============================================================================\n# export STIGMAN_DOCS_DIRECTORY=\n\n#==============================================================================\n# STIGMAN_DOCS_DISABLED\n#\n#  | Default: \"false\" | Whether to *not* serve the project Documentation.  NOTE:\n#  If you choose to serve the Client from the API container but not the\n#  Documentation, the links do the Docs on the home page will not work.\n#\n#  Affects: Documentation\n#==============================================================================\n# export STIGMAN_DOCS_DISABLED=\n\n#==============================================================================\n# STIGMAN_EXPERIMENTAL_APPDATA\n#\n#  | Default:  \"false\" | Set to \"true\" to enable the experimental AppData\n#  import/export API endpoints and User Interface.\n#\n#  Affects: API, Client\n#==============================================================================\n# export STIGMAN_EXPERIMENTAL_APPDATA=\n\n#==============================================================================\n# STIGMAN_EXPERIMENTAL_LOGSTREAM\n#\n#  | Default:  \"true\" | Set to \"false\" to disable the experimental WebSocket for\n#  streaming API logs and the corresponding User Interface.\n#\n#  Affects: API, Client\n#==============================================================================\n# export STIGMAN_EXPERIMENTAL_LOGSTREAM=\n\n#==============================================================================\n# STIGMAN_LOG_LEVEL\n#\n#  | Default: \"3\" | Controls the granularity of the generated log output, from 1\n#  to 4. Each level is inclusive of the ones before it. Level 1 will log only\n#  errors, level 2 includes warnings, level 3 includes status and transaction\n#  logs, and level 4 includes debug-level logs\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_LOG_LEVEL=\n\n#==============================================================================\n# STIGMAN_LOG_MODE\n#\n#  | Default: \"combined\" | Controls whether the logs will create one “combined”\n#  log entry for http requests that includes both the request and response\n#  information; or two separate log entries, one for the request and one for the\n#  response, that can be correlated via a generated Request GUID in each entry\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_LOG_MODE=\n\n#==============================================================================\n# STIGMAN_JWKS_CACHE_MAX_AGE\n#\n#  | Default: \"10\" | The time in minutes after which the API's cache of JWT\n#  signing keys is deemed stale and the API becomes unavailable. Cache refreshes\n#  are scheduled at intervals of half this value and also occur when an unknown\n#  signing key is presented. Scheduled refresh failures are retried every 10\n#  seconds.\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_JWKS_CACHE_MAX_AGE=\n\n#==============================================================================\n# STIGMAN_JWT_ASSERTION_CLAIM\n#\n#  | Default: \"jti\" | The access token claim whose value is the OIDC provider's\n#  Assertion ID. Updates to this value trigger the API to update a User's\n#  \"lastClaims\" property. The claim MUST NOT be nested and MUST be a valid\n#  ECMAScript identifier. See :ref:`jwt_requirements` for token value format\n#  requirements.\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_JWT_ASSERTION_CLAIM=\n\n#==============================================================================\n# STIGMAN_JWT_AUD_VALUE\n#\n#  | No default. | If present, a string which must be included in the access\n#  token \"aud\" claim for requests to endpoints requiring authorization. See\n#  :ref:`jwt_requirements` for token value format requirements.\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_JWT_AUD_VALUE=\n\n#==============================================================================\n# STIGMAN_JWT_EMAIL_CLAIM\n#\n#  | Default: \"email\" | The access token claim whose value is the user's email\n#  address. The claim MUST NOT be nested and MUST be a valid ECMAScript\n#  identifier. See :ref:`jwt_requirements` for token value format requirements.\n#\n#  Affects: API, Client\n#==============================================================================\n# export STIGMAN_JWT_EMAIL_CLAIM=\n\n#==============================================================================\n# STIGMAN_JWT_NAME_CLAIM\n#\n#  | Default: \"name\" | The access token claim whose value is the user's full\n#  name. The claim MUST NOT be nested and MUST be a valid ECMAScript identifier.\n#  See :ref:`jwt_requirements` for token value format requirements.\n#\n#  Affects: API, Client\n#==============================================================================\n# export STIGMAN_JWT_NAME_CLAIM=\n\n#==============================================================================\n# STIGMAN_JWT_PRIVILEGES_CLAIM\n#\n#  | Default: \"realm_access.roles\" | The access token claim whose value is the\n#  user's privileges. The claim MAY be nested but SHOULD avoid invalid\n#  ECMAScript identifiers. See :ref:`jwt_requirements` for token value format\n#  requirements.\n#\n#  Affects: API, Client\n#==============================================================================\n# export STIGMAN_JWT_PRIVILEGES_CLAIM=\n\n#==============================================================================\n# STIGMAN_JWT_SCOPE_CLAIM\n#\n#  | Default: \"scope\" | The access token claim whose value is the user's scopes.\n#  Some OIDC Providers (Okta, Azure AD) use the claim \"scp\" to enumerate scopes.\n#  The claim MUST NOT be nested and MUST be a valid ECMAScript identifier. See\n#  :ref:`jwt_requirements` for token value format requirements.\n#\n#  Affects: API, Client\n#==============================================================================\n# export STIGMAN_JWT_SCOPE_CLAIM=\n\n#==============================================================================\n# STIGMAN_JWT_SERVICENAME_CLAIM\n#\n#  | Default: \"clientId\" | The access token claim whose value is the service\n#  account's client. The claim MUST NOT be nested and MUST be a valid ECMAScript\n#  identifier. See :ref:`jwt_requirements` for token value format requirements.\n#\n#  Affects: API, Client\n#==============================================================================\n# export STIGMAN_JWT_SERVICENAME_CLAIM=\n\n#==============================================================================\n# STIGMAN_JWT_USERNAME_CLAIM\n#\n#  | Default: \"preferred_username\" | The access token claim whose value is the\n#  user's username. The claim MUST NOT be nested and MUST be a valid ECMAScript\n#  identifier. See :ref:`jwt_requirements` for token value format requirements.\n#\n#  Affects: API, Client\n#==============================================================================\n# export STIGMAN_JWT_USERNAME_CLAIM=\n\n#==============================================================================\n# STIGMAN_OIDC_CA_CERTS\n#\n#  | No default. | The full path to a file with one or more PEM-encoded CA\n#  certificates for validating TLS connections to the OIDC Provider.\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_OIDC_CA_CERTS=\n\n#==============================================================================\n# STIGMAN_OIDC_PROVIDER\n#\n#  | Default: \"http://localhost:8080/auth/realms/stigman\" | The base URL of the\n#  OIDC provider issuing signed JWTs for the API.  The string \"/.well-\n#  known/openid-configuration\" will be appended when fetching metadata.\n#\n#  Affects: API, Client\n#==============================================================================\n# export STIGMAN_OIDC_PROVIDER=\n\n#==============================================================================\n# STIGMAN_SWAGGER_ENABLED\n#\n#  | Default: \"false\" | Whether to enable the SwaggerUI SPA at /api-docs\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_SWAGGER_ENABLED=\n\n#==============================================================================\n# STIGMAN_SWAGGER_OIDC_PROVIDER\n#\n#  | Default: Value of \"STIGMAN_OIDC_PROVIDER\" | SwaggerUI override of the base\n#  URL of the OIDC provider issuing signed JWTs for the API.  The string\n#  \"/.well-known/openid-configuration\" will be appended by the SwaggerUI when\n#  fetching metadata.\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_SWAGGER_OIDC_PROVIDER=\n\n#==============================================================================\n# STIGMAN_SWAGGER_REDIRECT\n#\n#  | Default: \"http://localhost:54000/api-docs/oauth2-redirect.html\" | The\n#  redirect URL sent by SwaggerUI to the OIDC provider when authorizing\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_SWAGGER_REDIRECT=\n\n#==============================================================================\n# STIGMAN_SWAGGER_SERVER\n#\n#  | Default: \"http://localhost:54000/api\" | The API server URL relative to the\n#  SwaggerUI\n#\n#  Affects: API\n#==============================================================================\n# export STIGMAN_SWAGGER_SERVER=\n\n./stig-manager-linuxstatic\n"
  },
  {
    "path": "api/nuwcdivnpt-bot.gpg.asc",
    "content": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQENBGXcsB0BCADIpexQoymA+0AGb9ojtisErQ5cp+xWv3SlPd5kOhuCpbhRhTnB\nyQMBr50jqpPZeDtV80V9zyrGg+yLy4MdWM0sBIaW9ixDYeOShRei/GKHVrKxvJI7\nYQLZhkng4LqQLgI1AimEzBm5roqfrDQoEnvsj8PbD3iXj7kPrPoUeqZ/3DIVIvKw\nDtwfiWb7ycWJjjWe9g9F6T4YLbAidNVwo8QAnGrr7YFKtqhKYpjkK8ZHIDArpzVU\nkqTeFJpkC9MchTLmYMLdgjfJAV/NcA7NA+8pUC+jIoT7oLkMgw47iH6ifjarw2+w\nHUGuOrhpBF9WCW9OUlJmknjUQEeJeUYn5bXjABEBAAG0Xm51d2NkaXZucHQtYm90\nQHVzZXJzLm5vcmVwbHkuZ2l0aHViLmNvbSAoU3RpZ21hbktleSkgPG51d2NkaXZu\ncHQtYm90QHVzZXJzLm5vcmVwbHkuZ2l0aHViLmNvbT6JAVQEEwEKAD4WIQRR1CQf\nlX8LfXypLo8UO6ovUu6kagUCZdywHQIbLwUJEswDAAULCQgHAgYVCgkICwIEFgID\nAQIeAQIXgAAKCRAUO6ovUu6kagZXB/oDogvKYf5vDc8Cu2mrvtGbKO2VXDeLHQJ4\nN1X/ZK/Lr4RTZFYDqHJPiqJYlhg58sR+EDsy2HWI3Qxpk7C65SrEF0CwEfNbcHtH\n71g7KwHrgDEJw46yCmrt61pjAXVCeokVDPpUozYFoZoCRUHPpWDKEhcR2sizhOeh\n0HCOcV2yq308IZKzemAaJU9sAKcjHNB7RQkNbLl50/awINQY0F2kFCUItI8GQ9JA\n1+belDh0x5r2dQWCT4O2IIJjUhnKdoMovtp2TlU/ynpKKt781CKF7L548r35eaSM\nKRvO2kdsvFuvYe3372kkpkT8edEtxduJnqzZMWyINV43mtCk1GV/uQENBGXcsB0B\nCADJtfxgwXWBt3XY0s5iBKPFZFkYEgBKrFJF5YHJV2o8P6+AWIg03KynoJg0yf0h\n006tTegUYi53NJpUACUtkRRaDAy4g3xV4bLfK+aN50GWGqIdlIeFeaq93RYLgwL3\nGTB/msHoA6CTlQSrSIpjxeqifBPKcklq540AVR4aenntqEjHjpxEjkfzeB0nM1kA\nu/4H9N8/B8FM4PqOzF5YlTaTK/UtCJU6TqMTTAg0VMlZjRRItjUUt3Oq+4bOakeX\nF+JUiOaYaaYO2OJGiLm9HMuaRSiZGaothkZ/C5LgtkDqIGVcCMgYH0L4l+14IaVJ\niu60rX9Yhca0OOa9gqbR4VQLABEBAAGJAnIEGAEKACYWIQRR1CQflX8LfXypLo8U\nO6ovUu6kagUCZdywHQIbLgUJEswDAAFACRAUO6ovUu6kasB0IAQZAQoAHRYhBHS9\nEu1c1I822bsN1VTlnNMfBHn8BQJl3LAdAAoJEFTlnNMfBHn8fAgH/RBVKMde+uEt\n18c9gYXLInBu1qvzFIbYpH2hUHXSZcvdaj5AH7i6OF2Ix0jQiaFrnY14FawQkofp\nKd2uYjgyqbdKqn+wTwQhFGgyy5PQBuoLyKmlLXJgIHdsjsmMckDG6R6cA7du4IZx\nAUCYsJEoAcnQXuP/XRXDiu8ODpOkMtqnmUn74gDtTALQ5j9mMwVrm7TfT0lFsjj5\nW8I2SqZS4YQWKIfdbtUmqHWrzWwVYbzBBkK34YkaFdHd7YpLFSpGUJRgkQfPCu2U\ncuO1Tn25VaYaw8xTstk5ul/3sPyuGvbaJnvFBtt+xQgQo6H0+aAbhDDxzxrhtUTg\n0MPOw657viZijwf/Vgj1WfpXCxY6v3B4Qghg3dOgsQDAinrWM9xaYueT9bkBWjnD\nfZ4Z3iNfUipLFDwJ2XeRBz5MQGwK3d5N11xDMXnYO6IH5m0+0vSLmh12hWQYdGAa\npedI3qbKsZ4/UQfG8ZfKyeBUunZDWNTbR61rFKi+ZNb4W4vF5pVX4kLIIzcJpqa7\n8+cUWuD5jUKJt9fZ0cEUlLmZqJ7jsseHE81L2sULIo74p2xgGX1kGpNw5/oyyHRf\n/Rf7n9Wqs21lvHK4cqIpmTTUxkEOVomoB7LWlrqhUNMEPmnJes5oWkfN/t1euy8o\nOJ/jXthJZVWrxBzZtOmsDMQmJNhTXhgTxlEzvQ==\n=b4ti\n-----END PGP PUBLIC KEY BLOCK-----"
  },
  {
    "path": "api/pkg.config.json",
    "content": "{\n    \"name\": \"stig-manager\",\n    \"pkg\": {\n        \"scripts\": [\"./source/controllers/**/*.js\", \"./source/service/**/*.js\"],\n        \"assets\": [\n            \"../client/dist/**/*\",\n            \"../docs/_build/html\",\n            \"./source/service/**/*.sql\",\n            \"./source/node_modules/csv-stringify/**/*\",\n            \"./source/node_modules/swagger-ui-dist/**/*\",\n            \"./source/node_modules/axios/**/*\",\n            \"./source/utils/*.xlsx\"\n        ],\n        \"targets\": [\"node24-win\", \"node24-linuxstatic\"],\n        \"outputPath\": \"./bin\"\n    }\n}\n"
  },
  {
    "path": "api/source/README.md",
    "content": ""
  },
  {
    "path": "api/source/bootstrap/bootstrapUtils.js",
    "content": "const path = require('node:path')\nconst logger = require('../utils/logger')\nconst extensionCheck = require('./extensionCheck')\n\nfunction modulePathResolver( handlersPath, route, apiDoc ) {\n    const pathKey = route.openApiRoute.substring(route.basePath.length)\n    const schema = apiDoc.paths[pathKey][route.method.toLowerCase()]\n    const controller = schema.tags[0]\n    const operationId = schema['operationId']\n    const modulePath = path.join(handlersPath, controller)\n    const handler = require(modulePath)\n    if (handler[operationId] === undefined) {\n      throw new Error(\n        `Could not find a [${operationId}] function in ${modulePath} when trying to route [${route.method} ${route.expressRoute}].`,\n      )\n    }\n    return extensionCheck.bind(handler[operationId])\n}\n\nfunction buildResponseValidationConfig(willValidateResponse) {\n    if (willValidateResponse){\n        return {\n            onError: (error, body, req) => {\n                logger.writeError('rest', 'responseValidation', {\n                    error,\n                    request: logger.serializeRequest(req),\n                    body\n                })\n            }\n        }\n    }\n    else {\n        return false\n    }\n}\n\nfunction logAppConfig(config) {\n    logger.writeInfo('bootstrapUtils', 'starting bootstrap', {\n      version: config.version,\n      env: logger.serializeEnvironment(),\n      dirname: __dirname,\n      cwd: process.cwd()\n    })\n    logger.writeInfo('bootstrapUtils', 'configuration', config)\n  \n}\n  \nmodule.exports = {\n    modulePathResolver,\n    buildResponseValidationConfig,\n    logAppConfig\n}"
  },
  {
    "path": "api/source/bootstrap/client.js",
    "content": "const express = require('express')\nconst path = require('path')\nconst writer = require('../utils/writer')\nconst logger = require('../utils/logger')\nconst config = require('../utils/config')\n\nfunction serveClient(app) {\n\n    if (config.client.disabled) {\n        logger.writeDebug('serveClient', 'client', {message: 'client disabled'})\n        return\n    }\n    try {\n        serveClientEnv(app)\n        serveStaticFiles(app)\n        logger.writeDebug('serveClient', 'client', { message: 'succeeded setting up client' })\n    }\n    catch (err) {\n        logger.writeError('serveClient', 'client', {message: err.message, stack: err.stack})\n    }\n}\n\nfunction getClientEnv(){\n    const envJS = \n    `const STIGMAN = {\n        Env: {\n            version: \"${config.version}\",\n            consoleMode: \"${config.client.consoleMode}\",\n            apiBase: \"${config.client.apiBase}\",\n            displayAppManagers: ${config.client.displayAppManagers},\n            stateEvents: ${config.client.stateEvents},\n            welcome: {\n                image: \"${config.client.welcome.image}\",\n                title: \"${config.client.welcome.title.replace(/\"/g, '\\\\\"')}\",\n                message: \"${config.client.welcome.message.replace(/\"/g, '\\\\\"')}\",\n                link: \"${config.client.welcome.link}\"\n            },\n            commit: {\n                branch: \"${config.commit.branch}\",\n                sha: \"${config.commit.sha}\",\n                tag: \"${config.commit.tag}\",\n                describe: \"${config.commit.describe}\"\n            },\n            oauth: {\n                authority:  \"${config.client.authority}\",\n                clientId: \"${config.client.clientId}\",\n                extraScopes: \"${config.client.extraScopes ?? ''}\",\n                scopePrefix: \"${config.client.scopePrefix ?? ''}\",\n                responseMode: \"${config.client.responseMode}\",\n                reauthAction: \"${config.client.reauthAction}\",\n                strictPkce: ${config.client.strictPkce},\n                audienceValue: \"${config.oauth.audienceValue ?? ''}\",\n                claims: ${JSON.stringify(config.oauth.claims)},\n                idleTimeoutUser: ${config.client.idleTimeoutUser},\n                idleTimeoutAdmin: ${config.client.idleTimeoutAdmin},\n            },\n            experimental: {\n                appData: \"${config.experimental.appData}\",\n                logStream: \"${config.experimental.logStream}\"\n            }\n        }   \n    }`\n    return envJS\n}\n\nfunction serveClientEnv(app){\n    const envJS = getClientEnv()\n    app.get('/js/Env.js', function (req, res) {\n        req.component = 'static'\n        writer.writeWithContentType(res, { payload: envJS, contentType: \"application/javascript\" })\n    })\n}\n\nfunction serveStaticFiles(app){\n    const staticPath = path.join(__dirname, \"../\",  config.client.directory)\n    logger.writeDebug('serveStaticFiles', 'client', {client_static: staticPath})\n    const expressStatic = express.static(staticPath)\n\n    app.use('/', (req, res, next) => {\n        req.component = 'static'\n        expressStatic(req, res, next)\n    })\n}\n\nmodule.exports = {\n    serveClient,\n}\n"
  },
  {
    "path": "api/source/bootstrap/dependencies.js",
    "content": "const logger = require('../utils/logger')\nconst auth = require('../utils/auth')\nconst db = require('../service/utils')\nconst { serializeError } = require('../utils/serializeError')\nconst state = require('../utils/state')\n\nasync function initializeDependencies() {\n  try {\n      await Promise.all([\n          auth.initializeAuth(),\n          db.initializeDatabase()\n      ])\n  } \n  catch (e) {\n    logger.writeError('dependencies', 'fail', {message:'Unable to setup dependencies'})\n    state.setState('fail')\n  }\n}\n\nmodule.exports = {\n  initializeDependencies\n}\n"
  },
  {
    "path": "api/source/bootstrap/docs.js",
    "content": "\nconst express = require('express')\nconst path = require('path')\nconst fs = require('fs')\nconst logger = require('../utils/logger')\nconst config = require('../utils/config')\nconst swaggerUi = require('swagger-ui-express')\nconst jsyaml = require('js-yaml')\n\nfunction serveDocs(app) {\n    if (config.docs.disabled) {\n        logger.writeDebug('serveDocs', 'client', {message: 'documentation disabled'})\n        return\n    }\n    try {\n        app.use('/docs', express.static(path.join(__dirname, \"../\", config.docs.docsDirectory)))\n        logger.writeDebug('serveDocs', 'client', {message: 'succeeded setting up documentation'})\n    }\n    catch (err) {\n        logger.writeError('serveDocs', 'client', {message: err.message, stack: err.stack})\n    }\n}\n\nfunction serveApiDocs(app) {\n    const oasDoc = getOAS()\n    if (config.swaggerUi.enabled) {\n        configureSwaggerUI(app, oasDoc)\n    }\n    else \n    {\n        logger.writeDebug('serveApiDocs', 'SwaggerUI', { message: 'Swagger UI is disabled in configuration' })\n    }\n}\n\nfunction getOAS(){\n    // Read and modify OpenAPI specification\n    const apiSpecPath = path.join(__dirname, '../specification/stig-manager.yaml') \n    let spec = fs.readFileSync(apiSpecPath, 'utf8')\n    let oasDoc = jsyaml.load(spec)\n    // Replace with config values\n    oasDoc.info.version = config.version\n    oasDoc.servers[0].url = config.swaggerUi.server\n    oasDoc.components.securitySchemes.oauth.openIdConnectUrl = `${config.client.authority}/.well-known/openid-configuration`\n    config.definition = oasDoc\n    return oasDoc\n}\n\nfunction configureSwaggerUI(app, oasDoc){\n    app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(oasDoc, null, {\n        oauth2RedirectUrl: config.swaggerUi.oauth2RedirectUrl,\n        oauth: {\n        usePkceWithAuthorizationCodeGrant: true\n        }\n    }))\n    app.get(['/swagger.json','/openapi.json'], function(req, res) {\n        res.json(oasDoc)\n    })\n    logger.writeDebug('configureSwaggerUI', 'client', {message: 'succeeded setting up swagger-ui'})\n}\n\nmodule.exports = { serveDocs, serveApiDocs }"
  },
  {
    "path": "api/source/bootstrap/errorHandlers.js",
    "content": "const logger = require('../utils/logger')\nconst smErrors = require('../utils/error')\nconst { serializeError } = require('../utils/serializeError')\nconst path = require('path')\n\nfunction configureErrorHandlers(app) {\n  // express-openapi-validator does not expose top-level HttpError in their index.js. \n  // We can get it from framework.types.js\n  // CAUTION: We break here if express-openapi-validator changes this \n  const eovPath = path.dirname(require.resolve('express-openapi-validator'))\n  const eovErrors = require(path.join(eovPath, 'framework', 'types.js'))\n  app.use((err, req, res, next) => {\n    if (!(err instanceof smErrors.SmError) && !(err instanceof eovErrors.HttpError)) {\n      logger.writeError('rest', 'error', {\n        request: logger.serializeRequest(req),\n        error: serializeError(err)\n      })\n    }\n\n    res.errorBody = { error: err.message, code: err.code, detail: err.detail}\n    if (err.status === 500 || !(err.status)) res.errorBody.stack = err.stack\n    if (!res._headerSent) {\n      res.status(err.status || 500).header(err.headers).json(res.errorBody)\n    }\n    else {\n      res.write(JSON.stringify(res.errorBody) + '\\n')\n      res.end()\n    }\n  })\n}\n\nmodule.exports = configureErrorHandlers\n"
  },
  {
    "path": "api/source/bootstrap/extensionCheck.js",
    "content": "const SmError = require('../utils/error')\n\nfunction extensionCheck(req, res, next) {\n  if (req.openapi?.schema['x-elevation-required'] && !req.query.elevate) {\n    next(new SmError.ElevationError())\n    return\n  }\n  this(req, res, next)\n}\n\nmodule.exports = extensionCheck"
  },
  {
    "path": "api/source/bootstrap/middlewares.js",
    "content": "\nconst path = require('node:path')\nconst multer  = require('multer')\nconst express = require('express')\nconst cors = require('cors')\nconst { middleware: openApiMiddleware } = require('express-openapi-validator')\nconst config = require('../utils/config')\nconst { modulePathResolver, buildResponseValidationConfig } = require('./bootstrapUtils')\nconst auth = require('../utils/auth')\nconst configureErrorHandlers = require('./errorHandlers')\nconst { requestLogger } = require('../utils/logger')\nconst state = require('../utils/state')\nconst logger = require('../utils/logger')\n\nfunction configureMiddleware(app) {\n\n    // Must run before any app.use() call: Express's lazyrouter binds the query\n    // parser at the moment the first middleware is registered and ignores\n    // later changes.\n    app.set('query parser', 'simple')\n\n    const middlewareConfigFunctions = [\n      configureMulter,\n      configureExpress,\n      configureCors,\n      configureLogging,\n      configureServiceCheck,\n      configureAuth,\n      configureOpenApi,\n      configureErrorHandlers,\n  ]\n\n  logger.writeInfo('middleware', 'bootstrap', { message: 'configuring middleware' })\n\n  for (const middlewareConfigFunction of middlewareConfigFunctions) {\n      middlewareConfigFunction(app)\n  }\n\n  logger.writeInfo('middleware', 'bootstrap', { message: 'middleware configured' })\n}\n\nfunction configureMulter(app) {\n    let storage =  multer.memoryStorage()\n    const upload = multer({ \n      storage,\n      limits: {\n        fileSize: parseInt(config.http.maxUpload)\n      }\n    })\n    app.use(upload.single('importFile'))\n}\n\nfunction configureCors(app) {\n  app.use(cors())\n}\n\nfunction configureLogging(app) {\n  app.use(requestLogger)\n}\n\nfunction configureServiceCheck(app) {\n  app.use((req, res, next) => {\n    try {\n      if (\n        state.currentState !== 'available' && req.url.startsWith('/api') && !req.url.startsWith('/api/op/state')) {\n        res.status(503).json(state.apiState)\n      }\n      else {\n        next()\n      }\n    }\n    catch (e) {\n      next(e)\n    }\n  })\n}\n\nfunction configureAuth(app) {\n  app.use('/api', auth.validateToken)\n  app.use('/api', auth.setupUser)\n}\n\nfunction configureExpress(app) {\n    app.use(express.urlencoded( {extended: true}))\n    app.use(express.json({\n        strict: false, // allow root to be any JSON value, per https://datatracker.ietf.org/doc/html/rfc7159#section-2\n        limit: parseInt(config.http.maxJsonBody)\n    })) //Handle JSON request body\n}\n\nfunction configureOpenApi(app) {\n \n  const apiSpecPath = path.join(__dirname, '../specification/stig-manager.yaml')\n  app.use( \"/api\", openApiMiddleware ({\n      apiSpec: apiSpecPath,\n      validateRequests: {\n          coerceTypes: false,\n          allowUnknownQueryParameters: false,\n      },\n      validateResponses: buildResponseValidationConfig(config.settings.responseValidation === \"logOnly\"),\n      validateApiSpec: true,\n      $refParser: {\n          mode: 'dereference',\n      },\n      operationHandlers: {\n          basePath: path.join(__dirname, '../controllers'),\n          resolver: modulePathResolver,\n      },\n      validateSecurity: {\n          handlers:{\n          oauth: auth.validateOauthSecurity \n          }\n      },\n      fileUploader: false\n  }))\n}\n\nmodule.exports = configureMiddleware\n\n\n"
  },
  {
    "path": "api/source/bootstrap/server.js",
    "content": "const logger = require('../utils/logger')\nconst path = require('node:path')\nconst logSocket = require('../utils/logSocket')\nconst state = require('../utils/state')\nconst OperationSvc = require(`../service/OperationService`)\nconst { serializeError } = require('../utils/serializeError')\nconst config = require('../utils/config')\nconst { initializeDependencies } = require('./dependencies')\n\nfunction setupTls() {\n  if (config.http.tls?.key_file && config.http.tls?.cert_file) {\n    const fs = require('node:fs')\n    let key, cert\n    try {\n      key = fs.readFileSync(config.http.tls.key_file)\n    } catch (e) {\n      logger.writeError('server', 'tls_key_read_error', {message: `Failed reading TLS key file: ${config.http.tls.key_file}`, error: serializeError(e)})\n      throw e\n    }\n    try {\n      cert = fs.readFileSync(config.http.tls.cert_file)\n    } catch (e) {\n      logger.writeError('server', 'tls_cert_read_error', {message: `Failed reading TLS certificate file: ${config.http.tls.cert_file}`, error: serializeError(e)})\n      throw e\n    }\n    const tlsOptions = {\n      key: key,\n      cert: cert\n    }\n    if (config.http.tls.key_passphrase) {\n      tlsOptions.passphrase = config.http.tls.key_passphrase\n    }\n    return tlsOptions\n  } else {\n    return null\n  }\n}\n\nasync function startServer(app, startTime) {\n  let server\n  if (config.http.tls?.key_file && config.http.tls?.cert_file) {\n    const https = require('node:https')\n    const tlsOptions = setupTls()\n    logger.writeInfo('server', 'tls_enabled', {message: 'Creating server with TLS/HTTPS'})\n    server = https.createServer(tlsOptions, app)\n  } else {\n    const http = require('node:http')\n    server = http.createServer(app)\n  }\n  server.on('upgrade', (request) => {\n    logger.writeInfo('server', 'upgrade-request', { \n      url: request.url,\n      headers: request.headers,\n      remoteAddress: request.socket.remoteAddress\n    })\n  })\n\n  const onListenError = (e) => {\n    logger.writeError('server', 'shutdown', { message: `Server failed establishing or while listening on port ${config.http.port}`, error: serializeError(e) })\n    state.setState('fail')\n  }\n  server.on('error', onListenError)\n\n  await logSocket.setupLogSocket(server, path.join(__dirname, '../specification/log-socket.yaml'))\n\n  server.listen(config.http.port, async function () {\n    server.removeListener('error', onListenError)\n    logger.writeInfo('server', 'listening', {\n      port: config.http.port,\n      api: '/api',\n      client: config.client.disabled ? undefined : '/',\n      documentation: config.docs.disabled ? undefined : '/docs',\n      swagger: config.swaggerUi.enabled ? '/api-docs' : undefined\n    })\n    await initializeDependencies()\n    // Set/change classification if indicated\n    await applyConfigurationSettings()\n    logStartupDuration(startTime)\n  })\n}\n\nasync function applyConfigurationSettings() {\n  if (config.settings.setClassification) {\n    await OperationSvc.setConfigurationItem('classification', config.settings.setClassification)\n  }\n}\n\nfunction logStartupDuration(startTime) {\n  const endTime = process.hrtime.bigint()\n  logger.writeInfo('server', 'started', {\n    durationS: Number(endTime - startTime) / 1e9\n  })\n}\n\nmodule.exports = startServer\n"
  },
  {
    "path": "api/source/bootstrap/signals.js",
    "content": "const state = require('../utils/state')\nconst logger = require('../utils/logger')\n\n// This function sets up signal handlers for the process\n// and listens for SIGINT, SIGTERM, and SIGHUP signals\nmodule.exports.setupSignalHandlers = () => {\n  const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];\n\n  const signalHandler = (signal) => {\n    logger.writeInfo('signals','signal', {signal})\n    state.setState('stop')\n  }\n\n  for (const signal of signals) {\n    process.on(signal, signalHandler)\n  }\n}\n"
  },
  {
    "path": "api/source/controllers/Asset.js",
    "content": "'use strict';\n\nconst writer = require('../utils/writer')\nconst config = require('../utils/config')\nconst escape = require('../utils/escape')\nconst AssetService = require(`../service/AssetService`)\nconst CollectionService = require(`../service/CollectionService`)\nconst Collection = require('./Collection')\nconst Security = require('../utils/roles')\nconst dbUtils = require(`../service/utils`)\nconst {XMLBuilder} = require(\"fast-xml-parser\")\nconst SmError = require('../utils/error')\nconst {escapeForXml} = require('../utils/escape')\n\n\nmodule.exports.createAsset = async function createAsset (req, res, next) {\n  try {\n    let projections = req.query.projection\n    let assets = req.body\n    const collectionId = req.body.collectionId\n\n    const grant = req.userObject.grants[collectionId]\n    if (!grant || grant.roleId < 3) throw new SmError.PrivilegeError()\n\n    assets.noncomputing = assets.hasOwnProperty(\"noncomputing\") ? (assets.noncomputing ? 1 : 0) : 0\n    assets = [assets]\n\n    const failures = await dbUtils.createAssetValidation({assets, collectionId})\n\n    if (failures.length > 0) {\n      throw new SmError.UnprocessableError(failures)\n    }\n\n    let assetId\n    assetId = await AssetService.createAssets({assets, collectionId, svcStatus: res.svcStatus})\n    \n    const response = await AssetService.getAsset({\n      assetId,\n      projections,\n      grant,\n    })\n    res.status(201).json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.createAssets = async function createAssets (req, res, next) {\n  try {\n\n    let projections = req.query.projection\n    const collectionId  = req.params.collectionId\n    let assets = req.body\n    let dryRun = req.query.dryRun\n\n    const grant = req.userObject.grants[collectionId]\n    if (!grant || grant.roleId < 3) throw new SmError.PrivilegeError()\n\n    // if batch normalize assets (put collection Id into the asset object) and make non-computing a 'boolean int'\n    assets = assets.map(asset => ({\n      ...asset,\n      collectionId,\n      noncomputing: asset.hasOwnProperty(\"noncomputing\") ? (asset.noncomputing ? 1 : 0) : 0\n    }))\n\n    const failures = await dbUtils.createAssetValidation({assets, collectionId})\n\n    if (failures.length > 0) {\n      res.status(200).json({\n        error: 'Validation Error',\n        detail: failures\n      })\n      return\n    }\n\n    if(dryRun) {\n      res.status(204).send()\n      return\n    }\n    \n    let assetIds\n    assetIds = await AssetService.createAssets( {assets, collectionId, svcStatus: res.svcStatus})\n    \n    const response = await AssetService.getAssets({\n      filter: {\n        collectionId: collectionId,\n        assetIds,\n      },\n      projections,\n      grant,\n    })\n    res.status(201).json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n\n}\n\nmodule.exports.deleteAsset = async function deleteAsset (req, res, next) {\n  try {\n    let projections = req.query.projection\n    const { assetId, grant } = await getAssetInfoAndVerifyAccess(req)\n    const response = await AssetService.getAsset({assetId, projections, grant})\n    await AssetService.deleteAsset(assetId, req.userObject.userId, res.svcStatus)\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.removeStigFromAsset = async function (req, res, next) {\n  try {\n    let benchmarkId = req.params.benchmarkId\n    const {assetId, grant} = await getAssetInfoAndVerifyAccess(req)\n    await AssetService.removeStigFromAsset({assetId, benchmarkId, grant, svcStatus: res.svcStatus})\n    const response = await AssetService.getStigsByAsset({assetId, grant})\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.removeStigsFromAsset = async function removeStigsFromAsset (req, res, next) {\n  try {\n    const {assetId, grant} = await getAssetInfoAndVerifyAccess(req)\n    await AssetService.removeStigsFromAsset(assetId, grant, res.svcStatus)\n    const response = await AssetService.getStigsByAsset({assetId, grant})\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.exportAssets = async function exportAssets (projections, elevate, userObject) {\n  // let assets =  await AssetService.getAssets({projections})\n  // return assets\n} \n\nmodule.exports.getAsset = async function (req, res, next) {\n  try {\n    const assetId = req.params.assetId\n    const projections = req.query.projection\n\n    const grant = await dbUtils.getGrantByAssetId(assetId, req.userObject.grants)\n    if (!grant) throw new SmError.PrivilegeError()\n\n    const response = await AssetService.getAsset({assetId, projections, grant})\n    if (!response) throw new SmError.PrivilegeError()\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getAssets = async function (req, res, next) {\n  try {\n    const collectionId = req.query.collectionId\n    const name = req.query.name\n    const nameMatch = req.query['name-match']\n    const benchmarkId = req.query.benchmarkId\n    const metadata = req.query.metadata\n    const labelIds = req.query.labelId\n    const labelNames = req.query.labelName\n    const labelMatch = req.query.labelMatch\n    const projections = req.query.projection\n    const grant = req.userObject.grants[collectionId]\n\n    if (!grant) throw new SmError.PrivilegeError('No Grant in Collection')\n    \n    const response = await AssetService.getAssets({\n      filter: {\n        collectionId,\n        labels: {labelIds, labelNames, labelMatch}, \n        name,\n        nameMatch,\n        benchmarkId,\n        metadata\n      },\n      projections,\n      grant\n    })\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getStigsByAsset = async function (req, res, next) {\n  try {\n    const {assetId, grant} = await getAssetInfoAndVerifyAccess(req, Security.ROLES.Restricted)\n    const response = await AssetService.getStigsByAsset({assetId, grant} )\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getChecklistByAssetStig = async function getChecklistByAssetStig (req, res, next) {\n  try {\n    const assetId = req.params.assetId\n    const benchmarkId = req.params.benchmarkId\n    const revisionStr = req.params.revisionStr\n    const format = req.query.format || 'json'\n    const projections = req.query.projection\n\n    const access = await dbUtils.getUserAssetStigAccess({assetId, benchmarkId, grants: req.userObject.grants})\n    if (access === 'none') throw new SmError.PrivilegeError()\n\n    const checklist = await AssetService.getChecklistByAssetStig(assetId, benchmarkId, revisionStr, format, projections, req.userObject )\n    if (format.startsWith('json')) {\n      res.json(format === 'json-access' ? {access, checklist} : checklist)\n      return\n    }\n    \n    const dateString = escape.filenameComponentFromDate()\n    const fileBasename = `${checklist.marking}_${checklist.assetName}-${benchmarkId}-${checklist.revisionStrResolved}`\n    if (format === 'cklb') {\n      checklist.cklb.title = fileBasename\n      writer.writeInlineFile(res, JSON.stringify(checklist.cklb), `${fileBasename}_${dateString}.cklb`, 'application/json')  // revisionStrResolved provides specific rev string, if \"latest\" was asked for.\n    }\n    else if (format === 'ckl') {\n      const builder = new XMLBuilder({\n        attributeNamePrefix : \"@_\",\n        textNodeName : \"#text\",\n        ignoreAttributes : true,\n        format: true,\n        indentBy: \"  \",\n        supressEmptyNode: false,\n        processEntities: false,\n        tagValueProcessor: escapeForXml,\n        attrValueProcessor: escapeForXml\n      })\n      let xml = `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\\n<!-- STIG Manager ${config.version} -->\\n<!-- Classification: ${checklist.marking} -->\\n`\n      xml += builder.build(checklist.xmlJs)\n      writer.writeInlineFile(res, xml, `${fileBasename}_${dateString}.ckl`, 'application/xml')  // revisionStrResolved provides specific rev string, if \"latest\" was asked for.\n    }\n    else if (format === 'xccdf') {\n      const builder = new XMLBuilder({\n        attributeNamePrefix : \"@_\",\n        textNodeName : \"#text\",\n        ignoreAttributes : false,\n        cdataTagName: \"__cdata\",\n        cdataPositionChar: \"\\\\c\",\n        format: true,\n        indentBy: \"  \",\n        supressEmptyNode: true,\n        processEntities: false,\n        tagValueProcessor: escapeForXml,\n        attrValueProcessor: escapeForXml\n      })\n      let xml = `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\\n<!-- STIG Manager ${config.version} -->\\n<!-- Classification: ${checklist.marking} -->\\n`\n      xml += builder.build(checklist.xmlJs)\n      writer.writeInlineFile(res, xml, `${fileBasename}-xccdf_${dateString}.xml`, 'application/xml')  // revisionStrResolved provides specific rev string, if \"latest\" was asked for.\n    }\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getChecklistByAsset = async function (req, res, next) {\n  try {\n    const {assetId, grant} = await getAssetInfoAndVerifyAccess(req, Security.ROLES.Restricted)\n\n    const format = req.query.format //default of .ckl provided by EOV\n\n    const assetResponse = await AssetService.getAsset({assetId, projections: ['stigs'], grant} )\n    const availableBenchmarkIds = assetResponse.stigs.map( r => r.benchmarkId )\n    if (availableBenchmarkIds.length === 0) {\n      res.status(204).end()\n      return\n    }\n    const requestedBenchmarkIds = req.query.benchmarkId ?? availableBenchmarkIds\n    if (!requestedBenchmarkIds.every( requestedBenchmarkId => availableBenchmarkIds.includes(requestedBenchmarkId))) {\n      throw new SmError.ClientError('Asset is not mapped to all requested benchmarkIds')\n    }\n\n    const stigs = requestedBenchmarkIds.map( benchmarkId => ({benchmarkId, revisionStr: 'latest'}) )\n\n    const response = await AssetService.getChecklistByAsset(assetId, stigs, format)\n\n    const dateString = escape.filenameComponentFromDate()\n    if (format === 'cklb') {\n      writer.writeInlineFile(res, JSON.stringify(response.cklb), `${response.assetName}_${dateString}.cklb`, 'application/json') \n    }\n    else if (format === 'ckl') {\n      const builder = new XMLBuilder({\n        attributeNamePrefix : \"@_\",\n        textNodeName : \"#text\",\n        ignoreAttributes : true,\n        format: true,\n        indentBy: \"  \",\n        supressEmptyNode: false,\n        processEntities: false,\n        tagValueProcessor: escapeForXml,\n        attrValueProcessor: escapeForXml\n      })\n      let xml = `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\\n<!-- STIG Manager ${config.version} -->\\n<!-- Classification: ${response.marking} -->\\n`\n      xml += builder.build(response.xmlJs)\n      writer.writeInlineFile(res, xml, `${response.marking}_${response.assetName}_${dateString}.ckl`, 'application/xml')\n    }\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getAssetsByStig = async function getAssetsByStig (req, res, next) {\n  try {\n    const benchmarkId = req.params.benchmarkId\n    const labelIds = req.query.labelId\n    const labelNames = req.query.labelName\n    const labelMatch = req.query.labelMatch\n    const projections = req.query.projection\n\n    const {collectionId, grant} = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const response = await AssetService.getAssetsByStig({\n      collectionId, \n      benchmarkId, \n      labels: {labelIds, labelNames, labelMatch},\n      projections, \n      grant\n    })\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.replaceAsset = async function replaceAsset (req, res, next) {\n  try {\n    const projections = req.query.projection\n    const body = req.body\n\n    const {assetId, grant} = await getAssetInfoAndVerifyAccess(req)\n\n    const currentAsset = await AssetService.getAsset({assetId, projections, grant})\n    // Check if the asset is being transferred\n    const transferring = body.collectionId && currentAsset.collection.collectionId !== body.collectionId ? \n      {oldCollectionId: currentAsset.collection.collectionId, newCollectionId: body.collectionId} : null\n    if (transferring) {\n      // If so, Check if the user has an appropriate grant to the asset's updated collection\n      const updatedCollectionGrant = req.userObject.grants[body.collectionId]\n      if ( !updatedCollectionGrant || updatedCollectionGrant.roleId < 3 ) {\n        throw new SmError.PrivilegeError(`insufficient privilege in destination collection to transfer this asset.`)\n      }\n    }\n    await AssetService.updateAsset({\n      assetId,\n      body,\n      transferring,\n      svcStatus: res.svcStatus\n    })\n    const asset = await AssetService.getAsset({assetId, projections, grant})\n    res.json(asset)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.attachAssetsToStig = async function attachAssetsToStig (req, res, next) {\n  try {\n    let benchmarkId = req.params.benchmarkId\n    let assetIds = req.body\n    let projections = req.query.projection\n\n    const { collectionId, grant } = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage)\n    let collection = await CollectionService.getCollection( collectionId, ['assets'], false, req.userObject)\n    let collectionAssets = collection.assets.map( a => a.assetId)\n    if (assetIds.every( a => collectionAssets.includes(a))) {\n      await AssetService.attachAssetsToStig( collectionId, benchmarkId, assetIds )\n      let response = await AssetService.getAssetsByStig({collectionId, benchmarkId, projections, grant})\n      res.json(response)\n    }\n    else {\n      throw new SmError.PrivilegeError('One or more assetId is not a Collection member.')\n    }\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.attachStigToAsset = async function attachStigToAsset (req, res, next) {\n  try {\n\n    let benchmarkId = req.params.benchmarkId\n    const {assetId, grant} = await getAssetInfoAndVerifyAccess(req, Security.ROLES.Manage)\n    await AssetService.attachStigToAsset({\n      assetId,\n      benchmarkId,\n      grant,\n      svcStatus: res.svcStatus\n    })\n    const response = await AssetService.getStigsByAsset({assetId, grant})\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.updateAsset = async function updateAsset (req, res, next) {\n  try {\n    const projections = req.query.projection\n    const body = req.body\n\n    const {assetId, grant} = await getAssetInfoAndVerifyAccess(req, Security.ROLES.Manage)\n\n    // If this user has no grants permitting access to the asset, the response will be undefined\n    const currentAsset = await AssetService.getAsset({assetId, projections, grant} )\n    // if (!currentAsset) {\n    //   throw new SmError.PrivilegeError('User has insufficient privilege to modify this asset.')\n    // }\n    // // Check if the user has an appropriate grant to the asset's collection\n    // const currentCollectionGrant = req.userObject.grants[currentAsset.collection.collectionId]\n    // if ( !currentCollectionGrant || currentCollectionGrant.roleId < 3 ) {\n    //   throw new SmError.PrivilegeError(`User has insufficient privilege in collectionId ${currentAsset.collection.collectionId} to modify this asset.`)\n    // }\n    // Check if the asset's collectionId is being changed\n    const transferring = body.collectionId && currentAsset.collection.collectionId !== body.collectionId ? \n      {oldCollectionId: currentAsset.collection.collectionId, newCollectionId: body.collectionId} : null\n    if (transferring) {\n      // If so, Check if the user has an appropriate grant to the asset's updated collection\n      const updatedCollectionGrant = req.userObject.grants[body.collectionId]\n      if ( !updatedCollectionGrant || updatedCollectionGrant.roleId < 3 ) {\n        throw new SmError.PrivilegeError(`User has insufficient privilege in destination collection to transfer this asset.`)\n      }\n    }\n    await AssetService.updateAsset({\n      assetId,\n      body,\n      projections,\n      transferring,\n      currentCollectionId: currentAsset.collection.collectionId,\n      userObject: req.userObject,\n      svcStatus: res.svcStatus\n    })\n    const response = await AssetService.getAsset({assetId, projections, grant})\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getAssetMetadata = async function (req, res, next) {\n  try {\n    let { assetId } = await getAssetInfoAndVerifyAccess(req, Security.ROLES.Restricted)\n    let result = await AssetService.getAssetMetadata(assetId, req.userObject)\n    res.json(result)\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.patchAssetMetadata = async function (req, res, next) {\n  try {\n    let { assetId } = await getAssetInfoAndVerifyAccess(req)\n    let metadata = req.body\n    await AssetService.patchAssetMetadata(assetId, metadata)\n    let result = await AssetService.getAssetMetadata(assetId)\n    res.json(result)\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.putAssetMetadata = async function (req, res, next) {\n  try {\n    let { assetId } = await getAssetInfoAndVerifyAccess(req)\n    let body = req.body\n    await AssetService.putAssetMetadata(assetId, body)\n    let result = await AssetService.getAssetMetadata(assetId)\n    res.json(result)\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.getAssetMetadataKeys = async function (req, res, next) {\n  try {\n    let { assetId } = await getAssetInfoAndVerifyAccess(req, Security.ROLES.Restricted)\n    let result = await AssetService.getAssetMetadataKeys(assetId, req.userObject)\n    if (!result) {\n      throw new SmError.NotFoundError('metadata keys not found')\n    }\n    res.json(result)\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.getAssetMetadataValue = async function (req, res, next) {\n  try {\n    let { assetId } = await getAssetInfoAndVerifyAccess(req, Security.ROLES.Restricted)\n    let key = req.params.key\n    let result = await AssetService.getAssetMetadataValue(assetId, key, req.userObject)\n    if (!result) { \n      throw new SmError.NotFoundError('metadata key not found')\n    }\n    res.json(result)\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.putAssetMetadataValue = async function (req, res, next) {\n  try {\n    let { assetId } = await getAssetInfoAndVerifyAccess(req)\n    let key = req.params.key\n    let value = req.body\n\n    await AssetService.putAssetMetadataValue(assetId, key, value)\n    res.status(204).send()\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\n\nmodule.exports.deleteAssetMetadataKey = async function (req, res, next) {\n  try {\n    let { assetId } = await getAssetInfoAndVerifyAccess(req)\n    let key = req.params.key\n\n    await AssetService.deleteAssetMetadataKey(assetId, key, req.userObject)\n    res.status(204).send()\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.patchAssets = async function (req, res, next) {\n  try {\n    // feature supports delete only\n    const collectionId = getCollectionIdAndVerifyAccess(req, Security.ROLES.Manage)\n    const patchRequest = req.body\n\n    // optimization: replace below with targeted sql query, select from asset where assetId in ? and collectionId != ?\n    const collection = await CollectionService.getCollection( collectionId, ['assets'], false, req.userObject)\n    const collectionAssets = collection.assets.map( a => a.assetId)\n    if (!patchRequest.assetIds.every( a => collectionAssets.includes(a))) {\n      throw new SmError.PrivilegeError('One or more assetId is not a Collection member.')\n    }\n    await AssetService.deleteAssets(patchRequest.assetIds, req.userObject.userId, res.svcStatus)\n    res.json({\n      operation: 'deleted',\n      assetIds: patchRequest.assetIds\n    })\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nfunction getCollectionIdAndVerifyAccess(request, minimumRole = Security.ROLES.Manage) {\n  let collectionId = request.query.collectionId\n  const grant = request.userObject.grants[collectionId]\n  if (grant?.roleId < minimumRole || !grant) {\n    throw new SmError.PrivilegeError()\n  }\n  return collectionId\n}\n\n/**\n * Retrieves asset information and verifies user access to the asset which the operation is effecting.\n * Also, ensures that the user has sufficient access level to perform the operation.\n * @param {Object} request - The request object.\n * @returns {Promise<Object>} - A promise that resolves to an object containing the assetId and a grant.\n * @throws {SmError.PrivilegeError} - user does not have sufficient access level or the asset does not exist.\n */\nasync function getAssetInfoAndVerifyAccess(request, roleId = Security.ROLES.Manage) {\n  const assetId = request.params.assetId\n  const row = await dbUtils.selectCollectionByAssetId(assetId)\n  const grant = request.userObject.grants[row?.collectionId]\n  // check if user has sufficient access level\n  if (!grant || grant.roleId < roleId) {\n    throw new SmError.PrivilegeError(\"Insufficient access to this asset's collection.\")\n  }\n  return {assetId, grant}\n}\n"
  },
  {
    "path": "api/source/controllers/Collection.js",
    "content": "'use strict';\n\nconst writer = require('../utils/writer')\nconst config = require('../utils/config')\nconst escape = require('../utils/escape')\nconst CollectionService = require(`../service/CollectionService`)\nconst AssetService = require(`../service/AssetService`)\nconst STIGService = require(`../service/STIGService`)\nconst UserService = require(`../service/UserService`)\nconst Serialize = require(`../utils/serializers`)\nconst Security = require('../utils/roles')\nconst SmError = require('../utils/error')\nconst Archiver = require('archiver')\nconst {XMLBuilder} = require(\"fast-xml-parser\")\nconst {escapeForXml} = require('../utils/escape')\nconst dbUtils = require('../service/utils')\n\nmodule.exports.defaultSettings = {\n  fields: {\n    detail: {\n      enabled: 'always',\n      required: 'always'\n    },\n    comment: {\n      enabled: 'findings',\n      required: 'findings'\n    }\n  },\n  status: {\n    canAccept: true,\n    resetCriteria: 'result',\n    minAcceptGrant: 3\n  },\n  history: {\n    maxReviews: 5\n  },\n  importOptions:{\n    autoStatus: {\n      fail: 'saved',\n      notapplicable: 'saved',\n      pass: 'saved'\n    },\n    unreviewed: 'commented',\n    unreviewedCommented: 'informational',\n    emptyDetail: 'replace',\n    emptyComment: 'ignore',\n    allowCustom: true\n  }\n}\n\nmodule.exports.createCollection = async function createCollection (req, res, next) {\n  try {\n    const projection = req.query.projection\n    const elevate = req.query.elevate\n    const body = req.body\n    if ( elevate || req.userObject.privileges.create_collection ) {\n      if (elevate && (body.settings !== undefined || body.labels !== undefined || body.metadata !== undefined)) {\n        throw new SmError.PrivilegeError('Elevated requests cannot set collection settings, labels, or metadata.')\n      }\n      if (!hasUniqueGrants(body.grants)) {\n        throw new SmError.UnprocessableError('Duplicate user or user group in grant array')\n      }\n      const userIds = body.grants.map(g => g.userId).filter(Boolean)\n      const invalidUserIds = await dbUtils.selectInvalidUserIds(userIds)\n      if (invalidUserIds.length > 0) {\n        throw new SmError.UserInconsistentError()\n      }\n      try {\n        const response = await CollectionService.createCollection( body, projection, req.userObject, res.svcStatus)\n        res.status(201).json(response)\n      }\n      catch (err) {\n        // This is MySQL specific, should abstract\n        if (err.code === 'ER_DUP_ENTRY') {\n          throw new SmError.UnprocessableError('Duplicate name exists.')\n        }\n        else {\n          throw err\n        }\n      }\n    }\n    else {\n      throw new SmError.PrivilegeError()\n    }\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.deleteCollection = async function deleteCollection (req, res, next) {\n  try {\n    const elevate = req.query.elevate\n    const projections = req.query.projection\n    const { collectionId } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Owner, true)\n    const response = await CollectionService.getCollection(collectionId, projections, elevate, req.userObject)\n    await CollectionService.deleteCollection(collectionId, req.userObject.userId)\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.exportCollections = async function exportCollections (projection, elevate, userObject) {\n  try {\n    return await CollectionService.queryCollections({projection, elevate})\n  }\n  catch (err) {\n    next(err)\n  }\n} \n\nmodule.exports.getChecklistByCollectionStig = async function getChecklistByCollectionStig (req, res, next) {\n  try {\n    const benchmarkId = req.params.benchmarkId\n    const revisionStr = req.params.revisionStr\n    const { collectionId } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const response = await CollectionService.getChecklistByCollectionStig(collectionId, benchmarkId, revisionStr, req.userObject )\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getCollection = async function getCollection (req, res, next) {\n  try {\n    const projection = req.query.projection\n    const elevate = req.query.elevate\n    const { collectionId } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted, true)\n    const response = await CollectionService.getCollection(collectionId, projection, elevate, req.userObject )\n    res.status(typeof response === 'undefined' ? 204 : 200).json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getCollections = async function getCollections (req, res, next) {\n  try {\n    const projections = req.query.projection\n    const elevate = req.query.elevate\n    const name = req.query.name\n    const nameMatch = req.query['name-match']\n    const metadata = req.query.metadata\n    const response = await CollectionService.queryCollections({\n      filter: {name, nameMatch, metadata},\n      projections,\n      elevate,\n      grants: req.userObject.grants,\n      userId: req.userObject.userId\n    })\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getFindingsByCollection = async function getFindingsByCollection (req, res, next) {\n  try {\n    const aggregator = req.query.aggregator\n    const benchmarkId = req.query.benchmarkId\n    const assetId = req.query.assetId\n    const acceptedOnly = req.query.acceptedOnly\n    const projections = req.query.projection\n    const {collectionId, grant} = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const response = await CollectionService.getFindingsByCollection({collectionId, aggregator, benchmarkId, assetId, acceptedOnly, projections, grant})\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getPoamByCollection = async function getPoamByCollection (req, res, next) {\n  try {\n    const {\n      aggregator, \n      benchmarkId, \n      assetId, \n      acceptedOnly, \n      date, \n      office, \n      status, \n      mccastPackageId, \n      mccastAuthName, \n      format\n    } = req.query\n    const defaults = {\n      date, \n      office, \n      status, \n      mccastPackageId, \n      mccastAuthName\n    }\n    const {collectionId, grant} = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const findings = await CollectionService.getFindingsByCollection({\n      collectionId, aggregator, benchmarkId, assetId, acceptedOnly, \n      projections: [\n        'rulesWithDiscussion',\n        'groups',\n        'assets',\n        'stigs',\n        'ccis'\n      ],\n      grant})\n    \n    const poFns = {\n      EMASS: Serialize.poamObjectFromFindings,\n      MCCAST: Serialize.mccastPoamObjectFromFindings\n    }\n    const xlsx = await Serialize.xlsxFromPoamObject(poFns[format](findings, defaults), format)\n    writer.writeInlineFile( res, xlsx, `POAM-${format}-${grant.name}_${escape.filenameComponentFromDate()}.xlsx`, 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet')\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\n// module.exports.getStigAssetsByCollectionUser = async function getStigAssetsByCollectionUser (req, res, next) {\n//   try {\n//     const userId = req.params.userId\n//     const { collectionId } = await getCollectionInfoAndCheckPermission(req)\n//     const response = await CollectionService.getStigAssetsByCollectionUser(collectionId, userId, req.userObject )\n//     res.json(response)\n//   }\n//   catch (err) {\n//     next(err)\n//   }\n// }\n\nmodule.exports.getStigsByCollection = async function getStigsByCollection (req, res, next) {\n  try {\n    const { collectionId, grant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const labelIds = req.query.labelId\n    const labelNames = req.query.labelName\n    const labelMatch = req.query.labelMatch\n    const projections = req.query.projection\n    const response = await CollectionService.getStigsByCollection({collectionId, labelIds, labelNames, labelMatch, projections, grant})\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getStigByCollection = async function getStigByCollection (req, res, next) {\n  try {\n    const { collectionId, grant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const benchmarkId = req.params.benchmarkId\n    const projections = req.query.projection\n    const response = await CollectionService.getStigsByCollection({collectionId, projections, grant, benchmarkId})\n    if (!response[0]) {\n      res.status(204)\n    }\n    res.json(response[0])\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.replaceCollection = async function replaceCollection (req, res, next) {\n  try {\n    const elevate = req.query.elevate\n    const {collectionId, grant} = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage, true)\n    const projection = req.query.projection\n    const body = req.body\n\n    if (elevate && (body.settings !== undefined || body.labels !== undefined || body.metadata !== undefined)) {\n      throw new SmError.PrivilegeError('Elevated requests cannot set collection settings, labels, or metadata.')\n    }\n    if (!hasUniqueGrants(body.grants)) {\n      throw new SmError.UnprocessableError('Duplicate user in grant array')\n    }\n\n    const userIds = body.grants.map(g => g.userId).filter(Boolean)\n    const invalidUserIds = await dbUtils.selectInvalidUserIds(userIds)\n    if (invalidUserIds.length > 0) {\n      throw new SmError.UserInconsistentError()\n    }\n\n    const existingGrants = (await CollectionService.getCollection(collectionId, ['grants'], false, req.userObject))\n    ?.grants\n    .map(g => {\n      const flattenedGrant = {roleId: g.roleId}\n      if (g.user) {\n        flattenedGrant.userId = g.user.userId\n      }\n      else {\n        flattenedGrant.userGroupId = g.userGroup.userGroupId\n      }\n      return flattenedGrant\n    })\n\n      if (!elevate && (grant.roleId !== Security.ROLES.Owner && !requestedOwnerGrantsMatchExisting(body.grants, existingGrants))) {\n        throw new SmError.PrivilegeError('Cannot create or modify owner grants.')\n    }\n    let response = await CollectionService.replaceCollection(collectionId, body, projection, req.userObject, res.svcStatus)\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.updateCollection = async function updateCollection (req, res, next) {\n  try {\n    const elevate = req.query.elevate\n    const {collectionId, grant} = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage, true)\n    const projection = req.query.projection\n    const body = req.body\n    if (elevate && (body.settings !== undefined || body.labels !== undefined || body.metadata !== undefined)) {\n      throw new SmError.PrivilegeError('Elevated requests cannot set collection settings, labels, or metadata.')\n    }\n    if (body.grants) {\n      if (!hasUniqueGrants(body.grants)) {\n        throw new SmError.UnprocessableError('Duplicate user in grant array')\n      }\n      const userIds = body.grants.map(g => g.userId).filter(Boolean)\n      const invalidUserIds = await dbUtils.selectInvalidUserIds(userIds)\n      if (invalidUserIds.length > 0) {\n        throw new SmError.UserInconsistentError()\n      }\n  \n      const existingGrants = (await CollectionService.getCollection(collectionId, ['grants'], false, req.userObject ))\n        ?.grants\n        .map(g => {\n          const flattenedGrant = {roleId: g.roleId}\n          if (g.user) {\n            flattenedGrant.userId = g.user.userId\n          }\n          else {\n            flattenedGrant.userGroupId = g.userGroup.userGroupId\n          }\n          return flattenedGrant\n        })\n\n      if (!elevate && (grant.roleId !== Security.ROLES.Owner && !requestedOwnerGrantsMatchExisting(body.grants, existingGrants))) {\n        throw new SmError.PrivilegeError('Cannot create or modify owner grants.')\n      }\n    }\n    let response = await CollectionService.updateCollection(collectionId, body, projection, req.userObject, res.svcStatus)\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nfunction hasUniqueGrants(requestedGrants) {\n  const userItems = {}\n  const userGroupItems = {}\n  for (const grant of requestedGrants) {\n    if (userItems[grant.userId]) return false\n    if (userGroupItems[grant.userGroupId]) return false\n    const itemsObject = grant.userId ? userItems : userGroupItems\n    itemsObject[grant.userId ?? grant.userGroupId] = true\n  }\n  return true\n}\n\nfunction requestedOwnerGrantsMatchExisting(requestedGrants, existingGrants) {\n  const accumulateOwners = (accumulator, currentValue) => {\n    if (currentValue.roleId === Security.ROLES.Owner) \n      accumulator.push(currentValue.userId ? `U${currentValue.userId}` : `UG${currentValue.userGroupId}`)\n    return accumulator\n  }\n  const haveSameSet = (a, b) => {\n    return a.every(item => b.includes(item)) && b.every(item => a.includes(item))\n  }\n  const existingOwners = existingGrants.reduce(accumulateOwners, [])\n  const requestedOwners = requestedGrants.reduce(accumulateOwners, [])\n  \n  return !(existingOwners.length !== requestedOwners.length || !haveSameSet(existingOwners, requestedOwners))\n}\n\n/**\n * Retrieves collectionId and collection grant and checks user's access grant level or elevate.\n * Also allows for elevate\n * @param {Object} request - The request object.\n * @param {number} minimumRole - The minimum rokle required. Defaults to Security.ROLES.Manage.\n * @param {boolean} allowElevate - Whether to allow elevation of access level. Defaults to false.\n * @returns {Promise} - An object containing the collectionId and grant.\n * @throws {SmError.PrivilegeError} - If the user does not have sufficient privileges.\n */\nasync function getCollectionInfoAndCheckPermission(request, minimumRole = Security.ROLES.Manage, supportsElevation = false) {\n  let collectionId = request.params.collectionId\n  const elevate = request.query.elevate\n  const grant = request.userObject.grants[collectionId]\n\n  // if elevating, check that collection exists\n  if(supportsElevation && elevate) {\n    const exists = await CollectionService.doesCollectionExist(collectionId)\n    if (!exists) {\n      throw new SmError.NotFoundError(\"Collection not found\")\n    }\n  }\n\n  // If elevate is not set and supported, and the user does not have a grant, or the grant level is below the minimum required, throw an error.\n  if (!( (supportsElevation && elevate) || (grant?.roleId >= minimumRole) )) {\n    throw new SmError.PrivilegeError()\n  }\n  return {collectionId, grant}\n}\n\nmodule.exports.getCollectionInfoAndCheckPermission = getCollectionInfoAndCheckPermission\n\n\nmodule.exports.getCollectionMetadata = async function (req, res, next) {\n  try {\n    let { collectionId } = await getCollectionInfoAndCheckPermission(req)\n    let result = await CollectionService.getCollectionMetadata(collectionId, req.userObject)\n    res.json(result)\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.patchCollectionMetadata = async function (req, res, next) {\n  try {\n    let { collectionId } = await getCollectionInfoAndCheckPermission(req)\n    let metadata = req.body\n    await CollectionService.patchCollectionMetadata(collectionId, metadata)\n    let result = await CollectionService.getCollectionMetadata(collectionId)\n    res.json(result)\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.putCollectionMetadata = async function (req, res, next) {\n  try {\n    let { collectionId } = await getCollectionInfoAndCheckPermission(req)\n    let body = req.body\n    await CollectionService.putCollectionMetadata( collectionId, body)\n    let result = await CollectionService.getCollectionMetadata(collectionId)\n    res.json(result)\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.getCollectionMetadataKeys = async function (req, res, next) {\n  try {\n    let { collectionId } = await getCollectionInfoAndCheckPermission(req)\n    let result = await CollectionService.getCollectionMetadataKeys(collectionId, req.userObject)\n    if (!result) {\n      throw new SmError.NotFoundError('metadata keys not found')\n    } \n    res.json(result)\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.getCollectionMetadataValue = async function (req, res, next) {\n  try {\n    let { collectionId } = await getCollectionInfoAndCheckPermission(req)\n    let key = req.params.key\n    let result = await CollectionService.getCollectionMetadataValue(collectionId, key, req.userObject)\n    if (!result) {\n      throw new SmError.NotFoundError('metadata key not found')\n    }\n    res.json(result)\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.putCollectionMetadataValue = async function (req, res, next) {\n  try {\n    let { collectionId } = await getCollectionInfoAndCheckPermission(req)\n    let key = req.params.key\n    let value = req.body\n    await CollectionService.putCollectionMetadataValue(collectionId, key, value)\n    res.status(204).send()\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.deleteCollectionMetadataKey = async function (req, res, next) {\n  try {\n    let { collectionId } = await getCollectionInfoAndCheckPermission(req)\n    let key = req.params.key\n    await CollectionService.deleteCollectionMetadataKey(collectionId, key, req.userObject)\n    res.status(204).send()\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.deleteReviewHistoryByCollection = async function (req, res, next) {\n  try {\n    let { collectionId } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage)\n    const retentionDate = req.query.retentionDate\n    const assetId = req.query.assetId\n    \n    let result = await CollectionService.deleteReviewHistoryByCollection(collectionId, retentionDate, assetId)\n    res.json(result)\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.getReviewHistoryByCollection = async function (req, res, next) {\n  try {\n    let { collectionId } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Full)\n    const startDate = req.query.startDate\n    const endDate = req.query.endDate\n    const assetId = req.query.assetId\n    const ruleId = req.query.ruleId\n    const status = req.query.status\n\n    let result = await CollectionService.getReviewHistoryByCollection(collectionId, startDate, endDate, assetId, ruleId, status)\n    res.json(result)\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.getReviewHistoryStatsByCollection = async function (req, res, next) {\n  try {\n    let { collectionId } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Full)\n    const startDate = req.query.startDate\n    const endDate = req.query.endDate\n    const assetId = req.query.assetId\n    const ruleId = req.query.ruleId\n    const status = req.query.status\n    const projection = req.query.projection\n\n    let result = await CollectionService.getReviewHistoryStatsByCollection(collectionId, startDate, endDate, assetId, ruleId, status, projection)\n    res.json(result)\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.getCollectionLabels = async function (req, res, next) {\n  try {\n    const { collectionId, grant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const response = await CollectionService.getCollectionLabels( collectionId, grant )\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.createCollectionLabel = async function (req, res, next) {\n  try {\n    const { collectionId, grant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage)\n    const labelId = await CollectionService.createCollectionLabel( collectionId, req.body )\n    const response = await CollectionService.getCollectionLabelById( collectionId, labelId, grant )\n    res.status(201).json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.createCollectionLabels = async function (req, res, next) {\n  try {\n    const { collectionId, grant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage)\n\n    const createdLabelNames = await CollectionService.createCollectionLabels(collectionId, req.body)\n\n    const createdLabels = await CollectionService.getCollectionLabelsByName(collectionId, createdLabelNames, grant)\n\n    res.status(201).json(createdLabels)\n  } catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getCollectionLabelById = async function (req, res, next) {\n  try {\n    const { collectionId, grant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const response = await CollectionService.getCollectionLabelById( collectionId, req.params.labelId, grant )\n    if (!response) {\n      throw new SmError.NotFoundError()\n    }\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.patchCollectionLabelById = async function (req, res, next) {\n  try {\n    const { collectionId, grant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage)\n    const affectedRows = await CollectionService.patchCollectionLabelById( collectionId, req.params.labelId, req.body )\n    if (affectedRows === 0) {\n      throw new SmError.NotFoundError()\n    }\n    const response = await CollectionService.getCollectionLabelById( collectionId, req.params.labelId, grant )\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.deleteCollectionLabelById = async function (req, res, next) {\n  try {\n    const { collectionId } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage)\n    const affectedRows = await CollectionService.deleteCollectionLabelById(collectionId, req.params.labelId)\n    if (affectedRows === 0) {\n      throw new SmError.NotFoundError()\n    }\n    res.status(204).end()\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getAssetsByCollectionLabelId = async function (req, res, next) {\n  try {\n    const {collectionId, grant} = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const response = await CollectionService.getAssetsByCollectionLabelId( collectionId, req.params.labelId, grant )\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.putAssetsByCollectionLabelId = async function (req, res, next) {\n  try {\n    const { collectionId } = await getCollectionInfoAndCheckPermission(req)\n    const labelId = req.params.labelId\n    const assetIds = req.body\n    let collection = await CollectionService.getCollection( collectionId, ['assets','labels'], false, req.userObject)\n\n    if (!collection.labels.find( l => l.labelId === labelId)) {\n      throw new SmError.PrivilegeError('The labelId is not associated with this Collection.')\n    }\n\n    let collectionAssets = collection.assets.map( a => a.assetId)\n    if (assetIds.every( a => collectionAssets.includes(a))) {\n      await CollectionService.putAssetsByCollectionLabelId( collectionId, labelId, assetIds, res.svcStatus )\n      const response = await CollectionService.getAssetsByCollectionLabelId( collectionId, req.params.labelId, req.userObject )\n      res.json(response)\n    }\n    else {\n      throw new SmError.PrivilegeError('One or more assetId is not a Collection member.')\n    }\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.postCklArchiveByCollection = async function (req, res, next) {\n  try {\n    const { collectionId, grant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const mode = req.query.mode || 'mono'\n    const parsedRequest = await processAssetStigRequests (req.body, collectionId, mode, grant)\n    await postArchiveByCollection({\n      format: `ckl-${mode}`,\n      req,\n      res,\n      parsedRequest\n    })\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.postCklbArchiveByCollection = async function (req, res, next) {\n  try {\n    const { collectionId, grant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const mode = req.query.mode || 'mono'\n    const parsedRequest = await processAssetStigRequests (req.body, collectionId, mode, grant)\n    await postArchiveByCollection({\n      format: `cklb-${mode}`,\n      req,\n      res,\n      parsedRequest\n    })\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.postXccdfArchiveByCollection = async function (req, res, next) {\n  try {\n    const { collectionId, grant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const parsedRequest = await processAssetStigRequests (req.body, collectionId, 'mono', grant)\n    await postArchiveByCollection({\n      format: 'xccdf',\n      req,\n      res,\n      parsedRequest\n    })\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nasync function postArchiveByCollection ({format = 'ckl-mono', req, res, parsedRequest}) {\n  const builder = new XMLBuilder({\n    attributeNamePrefix : \"@_\",\n    textNodeName : \"#text\",\n    ignoreAttributes: format.startsWith('ckl-'),\n    cdataTagName: \"__cdata\",\n    cdataPositionChar: \"\\\\c\",\n    format: true,\n    indentBy: \"  \",\n    supressEmptyNode: format === 'xccdf',\n    processEntities: false,\n    tagValueProcessor: escapeForXml,\n    attrValueProcessor: escapeForXml\n})\n  const zip = Archiver('zip', {zlib: {level: 9}})\n  const started = new Date()\n  const dateString = escape.filenameComponentFromDate(started)\n  \n  // Query for highest classification marking of STIG revisions\n  let classificationPrefix = config.settings.setClassification === 'NONE' ? 'U' : config.settings.setClassification\n  if (classificationPrefix === 'U' || classificationPrefix === 'CUI') {\n    const uniqueRevisions = Array.from(parsedRequest.assetStigArguments.reduce((map, arg) => {\n      arg.stigs.forEach(stig => map.set(`${stig.benchmarkId}:${stig.revisionStr}`, stig))\n      return map\n    }, new Map()).values())\n    const highestMarking = await STIGService.getHighestMarkingByRevisions(uniqueRevisions)\n    classificationPrefix = highestMarking === 'CUI' || highestMarking === 'FOUO' ? 'CUI' : 'U'\n  } \n \n  const attachmentName = escape.escapeFilename(`${classificationPrefix}_${parsedRequest.collection.name}-${format.startsWith('ckl-') ? \n    'CKL' : format.startsWith('cklb-') ? 'CKLB' : 'XCCDF'}_${dateString}.zip`)\n  res.attachment(attachmentName)\n  zip.pipe(res)\n  const manifest = {\n    started: started.toISOString(),\n    finished: '',\n    errorCount: 0,\n    errors: [],\n    memberCount: 0,\n    members: [],\n    requestParams: {\n      collection: parsedRequest.collection,\n      assetStigs: req.body\n    }\n  }\n\n  zip.on('error', function (e) {\n    manifest.errors.push({message: e.message, stack: e.stack})\n    manifest.errorCount += 1\n  })\n  for (const arg of parsedRequest.assetStigArguments) {\n    try {\n      let response\n      switch (format) {\n        case 'ckl-mono':\n        case 'ckl-multi':\n          response = await AssetService.cklFromAssetStigs(arg.assetId, arg.stigs)\n          break\n        case 'cklb-mono':\n        case 'cklb-multi':\n          response = await AssetService.cklbFromAssetStigs(arg.assetId, arg.stigs)\n          break\n        case 'xccdf':\n          response = await AssetService.xccdfFromAssetStig(arg.assetId, arg.stigs[0].benchmarkId, arg.stigs[0].revisionStr)\n      }\n      let data\n      if (response.xmlJs) {\n        data = `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\\n<!-- STIG Manager ${config.version} -->\\n<!-- Classification: ${response.marking} -->\\n`\n        data += builder.build(response.xmlJs)  \n      }\n      else {\n        data = JSON.stringify(response.cklb)\n      }\n      let filename = `${response.marking ? response.marking + '_' : ''}${arg.assetName}`\n      if (format === 'ckl-mono' || format === 'cklb-mono' || format === 'xccdf') {\n        filename += `-${arg.stigs[0].benchmarkId}-${response.revisionStrResolved}`\n      }\n      filename += `${format === 'xccdf' ? '-xccdf.xml' : format.startsWith('ckl-') ? '.ckl' : '.cklb'}`\n      filename = escape.escapeFilename(filename)\n      zip.append(data, {name: filename})\n      manifest.members.push(filename)\n      manifest.memberCount += 1\n    }\n    catch (e) {\n      arg.error = {message: e.message, stack: e.stack}\n      manifest.errors.push(arg)\n      manifest.errorCount += 1\n    }\n  }\n  manifest.finished = new Date().toISOString()\n  manifest.members.sort((a,b) => a.localeCompare(b))\n  zip.append(JSON.stringify(manifest, null, 2), {name: '_manifest.json'})\n  await zip.finalize()\n}\n\nmodule.exports.getUnreviewedAssetsByCollection = async function (req, res, next) {\n  try {\n    const { collectionId, grant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const benchmarkId = req.query.benchmarkId\n    const assetId = req.query.assetId\n    const severities = req.query.severity || []\n    const labelIds = req.query.labelId || []\n    const labelNames = req.query.labelName || []\n    const projections = req.query.projection || []\n    \n    const response = await CollectionService.getUnreviewedAssetsByCollection( {\n      collectionId,\n      benchmarkId,\n      assetId,\n      labelIds,\n      labelNames,\n      severities,\n      projections,\n      grant,\n      userObject: req.userObject\n    })\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getUnreviewedRulesByCollection = async function (req, res, next) {\n  try {\n    const {collectionId, grant} = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const benchmarkId = req.query.benchmarkId\n    const ruleId = req.query.ruleId\n    const severities = req.query.severity || []\n    const labelIds = req.query.labelId || []\n    const labelNames = req.query.labelName || []\n    const projections = req.query.projection || []\n    const response = await CollectionService.getUnreviewedRulesByCollection( {\n      collectionId,\n      benchmarkId,\n      ruleId,\n      severities,\n      labelIds,\n      labelNames,\n      projections,\n      grant,\n      userObject: req.userObject\n    })\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\n// for the archive streaming endpoints\nasync function processAssetStigRequests (assetStigRequests, collectionId, mode = 'mono', grant) {\n  const assetStigArguments = []\n  let collectionName\n\n  // Pre-fetch the available revisions of STIGs that were accompanied by a requested revision\n\n  // Build a Set of the requested STIGs that were accomapnied by a requested revision\n  const requestedStigRevisionsSet = assetStigRequests.reduce((acc, value) => {\n    if (value.stigs) {\n      for (const item of value.stigs) {\n        if (typeof item !== 'string') {\n          acc.add(item.benchmarkId)\n        }\n      }\n    }\n    return acc\n  }, new Set())\n  const requestedStigRevisionsArray = [...requestedStigRevisionsSet]\n  // Create an object that can have benchmarkId properties and values of revisionStr arrays\n  let availableRevisions = {}\n  if (requestedStigRevisionsArray.length) {\n    availableRevisions = await STIGService.getRevisionStrsByBenchmarkIds(requestedStigRevisionsArray)\n  }\n\n  // iterate through the request\n  for (const requested of assetStigRequests) {\n    const assetId = requested.assetId\n    \n    // Try to fetch asset as this user.\n    const assetResponse = await AssetService.getAsset({assetId, projections: ['stigs'], grant} )\n    // Does user have a grant permitting access to the asset?\n    if (!assetResponse) {\n      throw new SmError.PrivilegeError()\n    }\n    // Is asset a member of collectionId?\n    if (assetResponse.collection.collectionId !== collectionId) {\n      throw new SmError.UnprocessableError(`Asset id ${assetId} is not a member of Collection id ${collectionId}.`)\n    }\n    if (!collectionName) { collectionName = assetResponse.collection.name } // will be identical for other assets\n    // Does the asset have STIG assignments?\n    if (assetResponse.stigs.length === 0) {\n      throw new SmError.UnprocessableError(`Asset id ${assetId} has no STIG assignments.`)\n    }\n\n    // create Set with keys being the asset's benchmarkId assignments\n    const assignedStigsSet = new Set(assetResponse.stigs.map( stig => stig.benchmarkId))\n\n    // create Map with keys being the requested benchmarkIds for the asset and values being an array of requested revisionStrs for that benchmarkId\n    const requestedRevisionsMap = new Map()\n\n    if (!requested.stigs) {\n      // request doesn't specify STIGs, so create keys for each assigned benchmarkId and set each value to an array containing the default revision string\n      for (const stig of assetResponse.stigs) {\n        requestedRevisionsMap.set(stig.benchmarkId, [stig.revisionStr])\n      } \n    }\n    else {\n      // request includes specific STIGs\n      for (const stig of requested.stigs) {\n        if (typeof stig === 'string' && assignedStigsSet.has(stig)) {\n          // value is a benchmarkId string that matches an available STIG mapping\n\n          // get already requested revisions for this STIG or any empty array\n          const revisions = requestedRevisionsMap.get(stig) ?? []\n          // add the default revision string to the requested revisions\n          revisions.push(assetResponse.stigs.find( assetStig => assetStig.benchmarkId === stig).revisionStr)\n          // update the Map\n          requestedRevisionsMap.set(stig, revisions)\n        }\n        else if ((stig.revisionStr === 'latest' && assignedStigsSet.has(stig.benchmarkId)) || \n          (assignedStigsSet.has(stig.benchmarkId) && availableRevisions[stig.benchmarkId].includes(stig.revisionStr))) {\n          // value is an object that matches an available STIG/Revision mapping\n\n          // get already requested revisions for this STIG or any empty array\n          const revisions = requestedRevisionsMap.get(stig.benchmarkId) ?? []\n          // add this requested revision string to the requested revisions\n          revisions.push(stig.revisionStr)\n          // update the Map\n          requestedRevisionsMap.set(stig.benchmarkId, revisions)\n        }\n        else {\n          throw new SmError.UnprocessableError(`Asset id ${assetId} is not mapped to ${JSON.stringify(stig)}.`)\n        }\n      }\n    }\n\n    // For generating individual filenames\n    const assetName = assetResponse.name\n\n    if (mode === 'mono') {\n      // XCCDF and mono CKLs\n      for (const entry of requestedRevisionsMap) {\n        for (const revisionStr of entry[1]) {\n          assetStigArguments.push({\n            assetId,\n            assetName,\n            stigs: [{benchmarkId: entry[0], revisionStr}]\n          }) \n        }\n      }\n    }\n    else {\n      // multi-STIG CKLs\n      const stigsParam = []\n      for (const entry of requestedRevisionsMap) {\n        for (const revisionStr of entry[1]) {\n          stigsParam.push({benchmarkId: entry[0], revisionStr})\n        }\n      }\n      assetStigArguments.push({\n        assetId,\n        assetName,\n        stigs: stigsParam\n      })\n    }\n  }\n  return {\n    collection: {\n      collectionId,\n      name: collectionName,\n    },\n    assetStigArguments\n  }\n}\n\nmodule.exports.writeStigPropsByCollectionStig = async function (req, res, next) {\n  try {\n    const { collectionId, grant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage)\n    const benchmarkId = req.params.benchmarkId\n    const assetIds = req.body.assetIds\n    const defaultRevisionStr = req.body.defaultRevisionStr\n    const existingRevisions = await STIGService.getRevisionsByBenchmarkId({benchmarkId, grants: req.userObject.grants})\n    //if defaultRevisionStr is present, check that specified revision is valid for the benchmark\n    if (defaultRevisionStr && defaultRevisionStr !== \"latest\" && existingRevisions.find(benchmark => benchmark.revisionStr === defaultRevisionStr) === undefined) {\n      throw new SmError.UnprocessableError(\"The revisionStr is is not valid for the specified benchmarkId\")\n    }\n    // The OAS layer mandated if assetIds is absent then defaultRevisionStr must be present\n    // we do not permit setting the default revision of an unassigned STIG\n    if (!assetIds && !await CollectionService.doesCollectionIncludeStig({collectionId, benchmarkId})) {\n      throw new SmError.UnprocessableError('Cannot set the default revision of a benchmarkId that has no mapped Assets')\n    }\n    if (assetIds && assetIds.length === 0 && defaultRevisionStr) {\n      throw new SmError.UnprocessableError('Cannot set the default revision of a benchmarkId and also remove all mapped Assets')\n    }\n    if (assetIds?.length) {\n      const collectionHasAssets = await CollectionService.doesCollectionIncludeAssets({\n        collectionId,\n        assetIds\n      })\n      if (!collectionHasAssets) {\n        throw new SmError.PrivilegeError('One or more assetId is not a Collection member.')\n      }\n    }\n    await CollectionService.writeStigPropsByCollectionStig( {\n      collectionId,\n      benchmarkId,\n      assetIds,\n      defaultRevisionStr,\n      svcStatus: res.svcStatus\n    })\n    const response = await CollectionService.getStigsByCollection({collectionId, grant, benchmarkId})\n    if (response[0]) {\n      res.json(response[0])\n    }\n    else {\n      res.status(204).send()\n    }\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.cloneCollection = async function (req, res, next) {\n  try {\n    function progressCb(json) {\n      res.write(JSON.stringify(json) + '\\n')\n    }\n    if ( req.userObject.privileges.create_collection ) {\n      const { collectionId } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage)\n      const options = {\n        grants: true,\n        labels: true,\n        assets: true,\n        stigMappings: 'withReviews',\n        pinRevisions: 'matchSource',\n        ...req.body.options\n      }\n\n      res.setHeader('Content-Type', 'application/x-ndjson; charset=utf-8');\n      res.setHeader('X-Accel-Buffering', 'no'); // Disable buffering for nginx\n\n      const cloned = await CollectionService.cloneCollection({\n        collectionId, \n        userObject: req.userObject, \n        name: req.body.name,\n        description: req.body.description,\n        options, \n        svcStatus: res.svcStatus,\n        progressCb\n      })\n      if (cloned) {\n        // // hack the existing userObject\n        req.userObject.grants[cloned.destCollectionId] = {\n          collectionId: cloned.destCollectionId,\n          name: req.body.name,\n          roleId: 4,\n          grantIds: []\n        }\n        const collection = await CollectionService.getCollection(cloned.destCollectionId, req.query.projection, false, req.userObject )\n        res.write(JSON.stringify({stage: 'result', collection}) + '\\n')\n      }\n      res.end()\n    }\n    else {\n      throw new SmError.PrivilegeError('User has not been granted createCollection privilege')\n    }\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.exportToCollection = async function (req, res, next) {\n  try {\n    function progressCb(json) {\n      res.write(JSON.stringify(json) + '\\n')\n    }\n\n    const { collectionId: srcCollectionId, grant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    req.params.collectionId = req.params.dstCollectionId\n    const { collectionId: dstCollectionId } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage)\n    req.params.collectionId = srcCollectionId\n    const parsedRequest = await processAssetStigRequests (req.body, srcCollectionId, 'multi', grant)\n    \n    res.setHeader('Content-Type', 'application/x-ndjson; charset=utf-8');\n    res.setHeader('X-Accel-Buffering', 'no'); // Disable buffering for nginx\n\n    await CollectionService.exportToCollection({\n      srcCollectionId,\n      dstCollectionId,\n      assetStigArguments: parsedRequest.assetStigArguments,\n      userObject: req.userObject, \n      progressCb,\n      svcStatus: res.svcStatus\n    })\n    res.end()\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getEffectiveAclByCollectionUser =  async function (req, res, next) {\n  try{\n    const {collectionId} = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage)\n    const userId = req.params.userId\n    if (!await CollectionService._hasCollectionGrant({collectionId, userId})) throw new SmError.UnprocessableError('user has no direct or group grant in collection')\n    const response = await CollectionService.getEffectiveAclByCollectionUser({collectionId, userId})\n    res.json(response)\n  }\n  catch(err){\n    next(err)\n   }\n}\n\nmodule.exports.putGrantByCollectionGrant = async function (req, res, next) {\n  try {\n    const grantId = req.params.grantId\n    const elevate = req.query.elevate\n    const grant = req.body\n\n    if (grant.userId) {\n      const invalidUserIds = await dbUtils.selectInvalidUserIds([grant.userId])\n      if (invalidUserIds.length) {\n        throw new SmError.UserInconsistentError()\n      }\n    }\n\n    const {collectionId, grant: requesterGrant} = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage, true)\n    const currentGrant = (await CollectionService._getCollectionGrant({collectionId, grantId}))[0]\n    if (!currentGrant) {\n      throw new SmError.NotFoundError('no such grant in collection')\n    }\n    if (!elevate && currentGrant.roleId === 4 && requesterGrant.roleId !== 4) {\n      throw new SmError.PrivilegeError('cannot modify owner grants')\n    }\n    if (!elevate && grant.roleId === 4 && requesterGrant.roleId !== 4) {\n      throw new SmError.PrivilegeError('cannot create owner grants')\n    }\n    \n    await CollectionService.putGrantById({grantId, grant, isRoleChange: currentGrant.roleId !== grant.roleId, svcStatus: res.svcStatus})\n    const updatedGrant = (await CollectionService._getCollectionGrant({collectionId, grantId}))[0]\n    res.json(updatedGrant)\n  }\n  catch (err) {\n    if (err.code === 'ER_NO_REFERENCED_ROW_2') {\n      err = new SmError.UnprocessableError('no such grantee')\n    }\n    else if (err.code === 'ER_DUP_ENTRY') {\n      err = new SmError.UnprocessableError('grantee has a conflicting grant')\n    }\n    next(err)\n  }\n}\n\nmodule.exports.getGrantByCollectionGrant = async function (req, res, next) {\n  try {\n    const grantId = req.params.grantId\n    const { collectionId } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage, true)\n    const grant = (await CollectionService._getCollectionGrant({collectionId, grantId}))[0]\n    if (!grant) throw new SmError.NotFoundError('no such grant in collection')\n    res.json(grant)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getGrantsByCollection = async function (req, res, next) {\n  try {\n    const { collectionId } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage, true)\n    const grants = await CollectionService._getCollectionGrant({collectionId})\n    res.json(grants)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.postGrantsByCollection = async function (req, res, next) {\n  try {\n    const { collectionId, grant: requesterGrant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage, true)\n    const grants = req.body\n    const elevate = req.query.elevate\n    const userIds = grants.map(g => g.userId).filter(Boolean)\n    const invalidUserIds = await dbUtils.selectInvalidUserIds(userIds)\n    if (invalidUserIds.length > 0) {\n      throw new SmError.UserInconsistentError()\n    }\n\n    const roles = grants.map( g => g.roleId)\n    if (!elevate && roles.includes(4) && requesterGrant.roleId !== 4) {\n      throw new SmError.PrivilegeError('cannot create owner grants')\n    }\n    const grantIds = await CollectionService.postGrantsByCollection(collectionId, grants)\n    const newGrants = await CollectionService._getCollectionGrant({collectionId, grantIds})\n    res.status(201).json(newGrants)\n  }\n  catch (err) {\n    if (err.code === 'ER_NO_REFERENCED_ROW_2') {\n      err = new SmError.UnprocessableError('no such grantee')\n    }\n    else if (err.code === 'ER_DUP_ENTRY') {\n      err = new SmError.UnprocessableError('grantee has a conflicting grant')\n    }\n    next(err)\n  }\n}\n\nmodule.exports.deleteGrantByCollectionGrant = async function (req, res, next) {\n  try {\n    const grantId = req.params.grantId\n    const elevate = req.query.elevate\n    const { collectionId, grant: requesterGrant } = await getCollectionInfoAndCheckPermission(req, Security.ROLES.Manage, true)\n    const currentGrant = (await CollectionService._getCollectionGrant({collectionId, grantId}))[0]\n    if (!currentGrant) {\n      throw new SmError.NotFoundError('no such grant in collection')\n    }\n    if (!elevate && currentGrant.roleId === 4 && requesterGrant.roleId !== 4) {\n      throw new SmError.PrivilegeError('cannot remove owner grants')\n    }\n    await CollectionService.deleteGrantById(grantId)\n    res.json(currentGrant)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getAclRulesByCollectionGrant = async function (req, res, next) {\n  try {\n    const grantId = req.params.grantId\n    const { collectionId } = await getCollectionInfoAndCheckPermission(req)\n    const grant = (await CollectionService._getCollectionGrant({collectionId, grantId}))[0]\n    if (!grant) throw new SmError.NotFoundError('no such grant in collection')\n    const response = await CollectionService.queryReviewAcl({grantId})\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.putAclRulesByCollectionGrant = async function (req, res, next) {\n  try {\n    const grantId = req.params.grantId\n    const { collectionId } = await getCollectionInfoAndCheckPermission(req)\n    const grant = (await CollectionService._getCollectionGrant({collectionId, grantId}))[0]\n    if (!grant) throw new SmError.NotFoundError('no such grant in collection')\n    const acl = req.body\n    const validated = await CollectionService._reviewAclValidate({grantId, acl})\n    if (validated.fail.length > 0) {\n      throw new SmError.UnprocessableError(validated.fail)\n    }\n    await CollectionService.setValidatedAcl({\n      validatedAcl: validated.pass,\n      grantId,\n      attributionUserId: req.userObject.userId,\n      svcStatus: res.svcStatus\n    })\n    const response = await CollectionService.queryReviewAcl({grantId})\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n"
  },
  {
    "path": "api/source/controllers/Job.js",
    "content": "const SmError = require('../utils/error');\nconst JobService = require(`../service/JobService`)\n\nconst userJobIdBase = 100\n\nexports.getJobs = async (req, res, next) => {\n  try {\n    const projections = req.query.projection\n    const jobs = await JobService.getJobs({projections})\n    res.json(jobs)\n  } catch (error) {\n    next(error) \n  }\n}\n\nexports.postJob = async (req, res, next) => {\n  try {\n    const jobId = await JobService.createJob({\n      jobData: req.body, \n      userId: req.userObject.userId, \n      svcStatus: res.svcStatus\n    })\n    const newJob = await JobService.getJob(jobId)\n    res.status(201).json(newJob)\n  } catch (error) {\n    if (error.code === 'ER_DUP_ENTRY') {\n      error = new SmError.UnprocessableError('Job name already exists')\n    } else if (error.code === 'ER_NO_REFERENCED_ROW_2') {\n      error = new SmError.UnprocessableError('Unknown taskId in list')\n    }\n    next(error)\n  }\n}\n\nexports.getJob = async (req, res, next) => {\n  try {\n    const projections = req.query.projection\n    const jobId = req.params.jobId\n    const job = await JobService.getJob(jobId, {projections})\n    if (!job) {\n      throw new SmError.NotFoundError(`Job with ID [${jobId}] not found.`)\n    }\n    res.json(job)\n  } catch (error) {\n    next(error) \n  }\n}\n\nexports.deleteJob = async (req, res, next) => {\n  try {\n    const jobId = req.params.jobId\n    if (parseInt(jobId) < userJobIdBase) {\n      throw new SmError.UnprocessableError(`Job is a system job and cannot be deleted.`)\n    }\n    // has desired side-effect of removing events named with the jobId, even if job does not exist\n    const wasDeleted = await JobService.deleteJob(jobId)\n    if (!wasDeleted) {\n      throw new SmError.NotFoundError(`Job with ID [${jobId}] not found.`)\n    }\n    res.status(204).end()\n  } catch (error) {\n    next(error) \n  }\n}\n\nexports.patchJob = async (req, res, next) => {\n  try {\n    const jobId = req.params.jobId\n    if (parseInt(jobId) < userJobIdBase) {\n      const bodyKeys = Object.keys(req.body)\n      if (!bodyKeys.every(key => key === 'event')) {\n        throw new SmError.UnprocessableError(`System jobs can only be modified with event properties.`)\n      }\n    }\n    const existingJob = await JobService.getJob(jobId)\n    if (!existingJob) {\n      throw new SmError.NotFoundError(`Job with ID [${jobId}] not found.`)\n    }\n    await JobService.patchJob({\n      jobId,\n      jobData: req.body, \n      userId: req.userObject.userId, \n      svcStatus: res.svcStatus\n    })\n    const patchedJob = await JobService.getJob(jobId)\n    res.status(200).json(patchedJob)\n  } catch (error) {\n    if (error.code === 'ER_DUP_ENTRY') {\n      error = new SmError.UnprocessableError('Job name already exists')\n    } else if (error.code === 'ER_NO_REFERENCED_ROW_2') {\n      error = new SmError.UnprocessableError('Unknown taskId in list')\n    }\n    next(error)\n  }\n}\n\nexports.getRunsByJob = async (req, res, next) => {\n  try {\n    const jobId = req.params.jobId\n    const job = await JobService.getJob(jobId)\n    if (!job) {\n      throw new SmError.NotFoundError(`Job with ID [${jobId}] not found.`)\n    }\n    const runs = await JobService.getRunsByJob(jobId)\n    res.json(runs)\n  } catch (error) {\n    next(error)\n  }\n}\n\nexports.runImmediateJob = async (req, res, next) => {\n  try {\n    const jobId = req.params.jobId\n    const job = await JobService.getJob(jobId)\n    if (!job) {\n      throw new SmError.NotFoundError(`Job with ID [${jobId}] not found.`)\n    }\n    const runId = await JobService.runImmediateJob(jobId)\n    res.json({runId})\n  } catch (error) {\n    next(error)\n  }\n}\n\nexports.getRunById = async (req, res, next) => {\n  try {\n    const runId = req.params.runId\n    const run = await JobService.getRunById(runId)\n    if (!run) {\n      throw new SmError.NotFoundError(`Run with ID [${runId}] not found.`)\n    }\n    res.json(run)\n  } catch (error) {\n    next(error) \n  }\n}\n\nexports.deleteRunById = async (req, res, next) => {\n  try {\n    const runId = req.params.runId\n    const wasDeleted = await JobService.deleteRunById(runId)\n    if (!wasDeleted) {\n      throw new SmError.NotFoundError(`Run with ID [${runId}] not found.`)\n    }\n    res.status(204).end()\n  } catch (error) {\n    next(error)\n  }\n}\n\nexports.getOutputByRun = async (req, res, next) => {\n  try {\n    const runId = req.params.runId\n    const afterSeq = req.query['after-seq']\n    const output = await JobService.getOutputByRun(runId, { filters: { afterSeq } })\n    res.json(output)\n  } catch (error) {\n    next(error)\n  } \n}\n\nexports.getAllTasks = async (req, res, next) => {\n  try {\n    const tasks = await JobService.getAllTasks()\n    res.json(tasks)\n  } catch (error) {\n    next(error)\n  }\n}\n\n\n"
  },
  {
    "path": "api/source/controllers/Metrics.js",
    "content": "const config = require('../utils/config')\nconst MetricsService = require(`../service/MetricsService`)\nconst Collection = require('./Collection')\nconst Security = require('../utils/roles')\nconst SmError = require('../utils/error')\nconst {stringify: csvStringify} = require('csv-stringify/sync')\n\nasync function getCollectionMetrics (req, res, next, {style, aggregation, firstRowOnly = false}) {\n  try {\n    const { collectionId, grant } = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const returnType = req.query.format || 'json'\n    const filter = {\n      labelNames: req.query.labelName,\n      labelMatch: req.query.labelMatch,\n      labelIds: req.query.labelId,\n      assetIds: req.query.assetId,\n      benchmarkIds: req.query.benchmarkId,\n    }\n    const rows = await MetricsService.queryMetrics({\n      collectionId,\n      filter,\n      grant,\n      style,\n      aggregation,\n      returnType \n    })\n    if (returnType === 'csv') {\n      res.type('text/csv')\n      res.send(csvStringify(rows, {header: true}))\n    }\n    else {\n      res.json(firstRowOnly ? rows[0] : rows)\n    }\n  }\n  catch (e) {\n    next(e)\n  }\n}\n\nasync function getMetaMetrics (req, res, next, {style, aggregation, firstRowOnly = false}) {\n  try {\n    const returnType = req.query.format || 'json'\n    const filter = {\n      collectionIds: req.query.collectionId,\n      benchmarkIds: req.query.benchmarkId,\n      revisionIds: req.query.revisionId\n    }\n    const rows = await MetricsService.queryMetaMetrics({\n      filter,\n      grants: req.userObject.grants,\n      style,\n      aggregation,\n      returnType \n    })\n    if (returnType === 'csv') {\n      res.type('text/csv')\n      res.send(csvStringify(rows, {header: true}))\n    }\n    else {\n      res.json(firstRowOnly ? rows[0] : rows)\n    }\n  }\n  catch (e) {\n    next(e)\n  }\n}\n\n\nmodule.exports.getMetricsDetailByCollection = async function (req, res, next) {\n  return getCollectionMetrics(req, res, next, {style: 'detail', aggregation: 'unagg'})\n}\nmodule.exports.getMetricsDetailByCollectionAggAsset = async function (req, res, next) {\n  return getCollectionMetrics(req, res, next, {style: 'detail', aggregation: 'asset'})\n}\nmodule.exports.getMetricsDetailByCollectionAgg = async function (req, res, next) {\n  return getCollectionMetrics(req, res, next, {style: 'detail', aggregation: 'collection', firstRowOnly: true})\n}\nmodule.exports.getMetricsDetailByCollectionAggLabel = async function (req, res, next) {\n  return getCollectionMetrics(req, res, next, {style: 'detail', aggregation: 'label'})\n}\nmodule.exports.getMetricsDetailByCollectionAggStig = async function (req, res, next) {\n  return getCollectionMetrics(req, res, next, {style: 'detail', aggregation: 'stig'})\n}\nmodule.exports.getMetricsSummaryByCollection = async function (req, res, next) {\n  return getCollectionMetrics(req, res, next, {style: 'summary', aggregation: 'unagg'})\n}\nmodule.exports.getMetricsSummaryByCollectionAggAsset = async function (req, res, next) {\n  return getCollectionMetrics(req, res, next, {style: 'summary', aggregation: 'asset'})\n}\nmodule.exports.getMetricsSummaryByCollectionAgg = async function (req, res, next) {\n  return getCollectionMetrics(req, res, next, {style: 'summary', aggregation: 'collection', firstRowOnly: true})\n}\nmodule.exports.getMetricsSummaryByCollectionAggLabel = async function (req, res, next) {\n  return getCollectionMetrics(req, res, next, {style: 'summary', aggregation: 'label'})\n}\nmodule.exports.getMetricsSummaryByCollectionAggStig = async function (req, res, next) {\n  return getCollectionMetrics(req, res, next, {style: 'summary', aggregation: 'stig'})\n}\nmodule.exports.getMetricsDetailByMeta = async function (req, res, next) {\n  return getMetaMetrics(req, res, next, {style: 'detail', aggregation: 'meta', firstRowOnly: true})\n}\nmodule.exports.getMetricsDetailByMetaAggCollection = async function (req, res, next) {\n  return getMetaMetrics(req, res, next, {style: 'detail', aggregation: 'collection'})\n}\nmodule.exports.getMetricsDetailByMetaAggStig = async function (req, res, next) {\n  return getMetaMetrics(req, res, next, {style: 'detail', aggregation: 'metaStig'})\n}\nmodule.exports.getMetricsSummaryByMeta = async function (req, res, next) {\n  return getMetaMetrics(req, res, next, {style: 'summary', aggregation: 'meta', firstRowOnly: true})\n}\nmodule.exports.getMetricsSummaryByMetaAggCollection = async function (req, res, next) {\n  return getMetaMetrics(req, res, next, {style: 'summary', aggregation: 'collection'})\n}\nmodule.exports.getMetricsSummaryByMetaAggStig = async function (req, res, next) {\n  return getMetaMetrics(req, res, next, {style: 'summary', aggregation: 'metaStig'})\n}"
  },
  {
    "path": "api/source/controllers/Operation.js",
    "content": "const config = require('../utils/config')\nconst OperationService = require(`../service/OperationService`)\nconst escape = require('../utils/escape')\nconst {JSONPath} = require('jsonpath-plus')\nconst SmError = require('../utils/error.js')\nconst state = require('../utils/state')\n\nmodule.exports.getConfiguration = async function getConfiguration (req, res, next) {\n  try {\n    const dbConfigs = await OperationService.getConfiguration()\n    const {version, commit, lastMigration} = config\n    res.json({ version, commit, lastMigration, ...dbConfigs })\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.setConfigurationItem = async function setConfigurationItem (req, res, next) {\n  try {\n    //TODO: Implement\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getAppData = async function getAppData (req, res, next) {\n  try {\n    if (!config.experimental.appData) throw new SmError.NotFoundError('endpoint disabled, to enable set STIGMAN_EXPERIMENTAL_APPDATA=true')\n    if (!req.query.elevate) throw new SmError.PrivilegeError()\n    const format = req.query.format || 'gzip'\n    res.attachment(`appdata-v${config.lastMigration}_${escape.filenameComponentFromDate()}.jsonl${format==='gzip'?'.gz':''}`)\n    if (format === 'jsonl') res.type('application/jsonl')\n\n    // the service method will stream the appdata file to the response object\n    OperationService.getAppData(res, format)\n    // the service ends the response by closing the gzip stream\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getAppDataTables = async function (req, res, next) {\n  try {\n    if (!req.query.elevate) throw new SmError.PrivilegeError()\n    const response = await OperationService.getAppDataTables()\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.replaceAppData = async function replaceAppData (req, res, next) {\n  // write JSONL to the response; called from the service method\n  function progressCb(json) {\n    res.write(JSON.stringify(json) + '\\n')\n  }\n  \n  try {\n    if (!config.experimental.appData) throw new SmError.NotFoundError('endpoint disabled, to enable set STIGMAN_EXPERIMENTAL_APPDATA=true')\n    if (!req.query.elevate) throw new SmError.PrivilegeError()\n    let chunks = []\n    for await (const chunk of req) {\n      chunks.push(chunk)\n    }\n    const buffer = Buffer.concat(chunks)\n    res.setHeader('Content-Type', 'application/jsonl; charset=utf-8')\n    res.setHeader('X-Accel-Buffering', 'no'); // Disable buffering for nginx\n    res.setHeader('Transfer-Encoding', 'chunked')\n    await OperationService.replaceAppData(buffer, req.headers['content-type'], progressCb )\n    res.end()\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getDefinition = async function getDefinition (req, res, next) {\n  try {\n    let jsonpath = req.query.jsonpath\n    if (jsonpath) {\n      res.json(JSONPath(jsonpath, config.definition))\n    }\n    else {\n      res.json(config.definition)\n    }\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getAppInfo = async function getAppInfo (req, res, next) {\n  try {\n    let elevate = req.query.elevate\n    if ( elevate ) {\n      const options = {\n        includeRowCounts: req.query.includeRowCounts\n      }\n      const response = await OperationService.getAppInfo(options)\n      res.json(response)\n    }\n    else {\n      throw new SmError.PrivilegeError()\n    }\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getState = function (req, res, next) {\n  try {\n    res.json(state.apiState)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getDetails = module.exports.getAppInfo\n\nmodule.exports.streamStateSse = function (req, res, next) {\n  try {\n    res.setHeader('Content-Type', 'text/event-stream');\n    res.setHeader('Cache-Control', 'no-cache');\n    res.setHeader('Connection', 'keep-alive');\n    res.setHeader('X-Accel-Buffering', 'no'); // Disable buffering for nginx\n\n    // Helper to send SSE events\n    function sendEvent(eventName, data) {\n      if (eventName) res.write(`event: ${eventName}\\n`);\n      res.write(`data: ${typeof data === 'string' ? data : JSON.stringify(data)}\\n\\n`);\n    }\n\n    // Send initial state\n    sendEvent('state-report', state.apiState);\n\n    // Event listeners\n    const stateChangedListener = () => sendEvent('state-changed', state.apiState);\n    const dependencyChangedListener = () => sendEvent('dependency-changed', state.apiState);\n\n    state.on('state-changed', stateChangedListener);\n    state.on('dependency-changed', dependencyChangedListener);\n\n    // Keep-alive ping every 30 seconds\n    const keepAlive = setInterval(() => {\n      sendEvent('state-report', state.apiState);\n    }, 30000);\n\n    // Cleanup on client disconnect\n    req.on('close', () => {\n      clearInterval(keepAlive);\n      state.off('state-changed', stateChangedListener);\n      state.off('dependency-changed', dependencyChangedListener);\n      res.end();\n    });\n  } catch (err) {\n    next(err);\n  }\n}\n"
  },
  {
    "path": "api/source/controllers/Review.js",
    "content": "'use strict';\n\nconst config = require('../utils/config')\nconst ReviewService = require(`../service/ReviewService`)\nconst CollectionService = require(`../service/CollectionService`)\nconst Collection = require(`./Collection`)\nconst SmError = require('../utils/error')\nconst Security = require('../utils/roles')\nconst dbUtils = require('../service/utils')\nconst _this = this\nconst AssetService = require('../service/AssetService')\n\nmodule.exports.postReviewsByAsset = async function postReviewsByAsset (req, res, next) {\n  try {\n    const { collectionId } = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const assetId = req.params.assetId\n    const reviews = req.body\n\n    // check assetId exists, is enabled, and belongs to the collection in the URL path\n    const assetRow = await dbUtils.selectCollectionByAssetId(assetId)\n    if (!assetRow || assetRow.collectionId.toString() !== collectionId) {\n      throw new SmError.PrivilegeError()\n    }\n\n    const result = await ReviewService.putReviewsByAsset({\n      assetId,\n      reviews,\n      collectionId, \n      userId: req.userObject.userId,\n      grant: req.userObject.grants[collectionId],\n      svcStatus: res.svcStatus\n    })\n    res.json(result)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.deleteReviewByAssetRule = async function deleteReviewByAssetRule (req, res, next) {\n  try {\n    let assetId = req.params.assetId\n    let ruleId = req.params.ruleId\n    let projections = req.query.projection\n    \n    const {collectionId, grant} = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const userHasRule = await ReviewService.checkRuleByAssetUser({ruleId, assetId, collectionId, grant, checkWritable: true})\n    if (userHasRule) {\n      let response = await ReviewService.deleteReviewByAssetRule({assetId, ruleId, projections, grant, svcStatus: res.svcStatus})\n      res.status(response ? 200 : 204).json(response)\n    }\n    else {\n      throw new SmError.PrivilegeError()\n    }\n  \n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.exportReviews = async function exportReviews (includeHistory) {\n  return await ReviewService.exportReviews(includeHistory)\n} \n\nmodule.exports.getReviewByAssetRule = async function (req, res, next) {\n  try {\n    let assetId = req.params.assetId\n    let ruleId = req.params.ruleId\n    let projections = req.query.projection\n    const {collectionId, grant} = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n\n    const assetExists = await AssetService.doesAssetExist(assetId) \n    if (!assetExists) {\n      throw new SmError.PrivilegeError()\n    }\n    \n    let response = await ReviewService.getReviews({\n      projections, \n      filter: {\n        collectionId,\n        assetId: assetId,\n        ruleId: ruleId\n      },\n      grant,\n      userObject: req.userObject\n    })\n    // res.json(response[0])\n    // res.status(typeof response === 'undefined' ? 204 : 200).json(response[0])\n    res.status(response.length == 0 ? 204 : 200).json(response[0])\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getReviewsByCollection = async function getReviewsByCollection (req, res, next) {\n  try {\n    let projections = req.query.projection\n    const {collectionId, grant} = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n\n    let response = await ReviewService.getReviews({\n      projections,\n      filter: {\n        collectionId,\n        result: req.query.result,\n        status: req.query.status,\n        rules: req.query.rules || 'default-mapped',\n        ruleId: req.query.ruleId,\n        groupId: req.query.groupId,\n        cci: req.query.cci,\n        userId: req.query.userId,\n        assetId: req.query.assetId,\n        benchmarkId: req.query.benchmarkId,\n        metadata: req.query.metadata\n      },\n      grant,\n      userObject: req.userObject\n    })\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getReviewsByAsset = async function (req, res, next) {\n  try {\n    let assetId = req.params.assetId\n    let projections = req.query.projection\n    const {collectionId, grant} = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n\n    const assetExists = await AssetService.doesAssetExist(assetId) \n    if (!assetExists) {\n      throw new SmError.PrivilegeError()\n    }\n    \n    let response = await ReviewService.getReviews({\n      projections,\n      filter: {\n        collectionId,\n        assetId: assetId,\n        rules: req.query.rules || 'default-mapped',\n        result: req.query.result,\n        status: req.query.status,\n        benchmarkId: req.query.benchmarkId,\n        metadata: req.query.metadata\n      },\n      grant,\n      userObject: req.userObject\n    })\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.putReviewByAssetRule = async function (req, res, next) {\n  try {\n    const {collectionId, grant} = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const {assetId, ruleId} = {...req.params}\n    const review = {...req.body, ruleId}\n    const projections = req.query.projection\n\n    // check assetId exists, is enabled, and belongs to the collection in the URL path\n    const assetRow = await dbUtils.selectCollectionByAssetId(assetId)\n    if (!assetRow || assetRow.collectionId.toString() !== collectionId) {\n      throw new SmError.PrivilegeError()\n    }\n\n    const result = await ReviewService.putReviewsByAsset({\n      assetId,\n      reviews: [review],\n      collectionId, \n      userId: req.userObject.userId,\n      grant: req.userObject.grants[collectionId],\n      svcStatus: res.svcStatus\n    })\n    if (result.rejected.length) {\n      throw new SmError.PrivilegeError(result.rejected[0].reason)\n    }\n    const rows =  await ReviewService.getReviews({\n      projections,\n      filter: {collectionId, assetId, ruleId},\n      grant,\n      userObject: req.userObject\n    })\n    res.status(result.affected.inserted > 0 ? 201 : 200).json(rows[0])\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.patchReviewByAssetRule = async function (req, res, next) {\n  try {\n    if (Object.hasOwn(req.body, 'resultEngine') && !Object.hasOwn(req.body, 'result')) {\n      throw new SmError.UnprocessableError('Request body with resultEngine must include a result')\n    }\n    const {collectionId, grant} = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const {assetId, ruleId} = {...req.params}\n\n    // check assetId exists, is enabled, and belongs to the collection in the URL path —\n    // must run before the pre-write existence read so a foreign-collection asset\n    // cannot satisfy the \"review must exist\" gate and reveal review state via 404 vs 403\n    const assetRow = await dbUtils.selectCollectionByAssetId(assetId)\n    if (!assetRow || assetRow.collectionId.toString() !== collectionId) {\n      throw new SmError.PrivilegeError()\n    }\n\n    const currentReviews =  await ReviewService.getReviews({\n      filter: {collectionId, assetId, ruleId},\n      grant,\n      userObject: req.userObject\n    })\n    if (currentReviews.length === 0) {\n      throw new SmError.NotFoundError('Review must exist to be patched')\n    }\n    const review = {...req.body, ruleId}\n    const projections = req.query.projection\n    const result = await ReviewService.putReviewsByAsset({\n      assetId,\n      reviews: [review],\n      collectionId, \n      userId: req.userObject.userId,\n      grant: req.userObject.grants[collectionId],\n      svcStatus: res.svcStatus\n    })\n    if (result.rejected.length) {\n      throw new SmError.PrivilegeError(result.rejected[0].reason)\n    }\n    const rows =  await ReviewService.getReviews({\n      projections,\n      filter: {collectionId, assetId, ruleId},\n      grant,\n      userObject: req.userObject\n    })\n    res.json(rows[0])\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.getReviewMetadata = async function (req, res, next) {\n  try {\n    let assetId = req.params.assetId\n    let ruleId = req.params.ruleId\n    const {collectionId, grant} = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const userHasRule = await ReviewService.checkRuleByAssetUser({ruleId, assetId, collectionId, grant})\n    if (userHasRule) {\n      let response = await ReviewService.getReviewMetadata( assetId, ruleId, req.userObject)\n      res.json(response)\n    }\n    else {\n      throw new SmError.PrivilegeError('User has insufficient privilege to get the review of this rule.')\n    }\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.patchReviewMetadata = async function (req, res, next) {\n  try {\n    let assetId = req.params.assetId\n    let ruleId = req.params.ruleId\n    let metadata = req.body\n    const {collectionId, grant} = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const userHasRule = await ReviewService.checkRuleByAssetUser({ruleId, assetId, collectionId, grant, checkWritable: true})\n    if (userHasRule) {\n      await ReviewService.patchReviewMetadata( assetId, ruleId, metadata)\n      let response = await ReviewService.getReviewMetadata( assetId, ruleId)\n      res.json(response)\n    }\n    else {\n      throw new SmError.PrivilegeError('User has insufficient privilege to patch the review of this rule.')\n    }\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.putReviewMetadata = async function (req, res, next) {\n  try {\n    let assetId = req.params.assetId\n    let ruleId = req.params.ruleId\n    let body = req.body\n    const {collectionId, grant} = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const userHasRule = await ReviewService.checkRuleByAssetUser({ruleId, assetId, collectionId, grant, checkWritable: true})\n    if (userHasRule) {\n      await ReviewService.putReviewMetadata( assetId, ruleId, body)\n      let response = await ReviewService.getReviewMetadata( assetId, ruleId)\n      res.json(response)\n    }\n    else {\n      throw new SmError.PrivilegeError('User has insufficient privilege to put the review of this rule.')\n    }\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.getReviewMetadataKeys = async function (req, res, next) {\n  try {\n    let assetId = req.params.assetId\n    let ruleId = req.params.ruleId\n    const {collectionId, grant} = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const userHasRule = await ReviewService.checkRuleByAssetUser({ruleId, assetId, collectionId, grant})\n    if (userHasRule) {\n      let response = await ReviewService.getReviewMetadataKeys( assetId, ruleId, req.userObject)\n      if (!response) {\n        throw new SmError.NotFoundError('metadata keys not found')\n      }\n      res.json(response)\n    }\n    else {\n      throw new SmError.PrivilegeError('User has insufficient privilege to get the review of this rule.')\n    }\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.getReviewMetadataValue = async function (req, res, next) {\n  try {\n    let assetId = req.params.assetId\n    let ruleId = req.params.ruleId\n    let key = req.params.key\n    const {collectionId, grant} = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const userHasRule = await ReviewService.checkRuleByAssetUser({ruleId, assetId, collectionId, grant})\n    if (userHasRule) {\n      let response = await ReviewService.getReviewMetadataValue( assetId, ruleId, key, req.userObject)\n      if (!response) {\n        throw new SmError.NotFoundError('metadata key not found')\n      }\n      res.json(response)\n    }\n    else {\n      throw new SmError.PrivilegeError('User has insufficient privilege to get the review of this rule.')\n    }\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.putReviewMetadataValue = async function (req, res, next) {\n  try {\n    let assetId = req.params.assetId\n    let ruleId = req.params.ruleId\n    let key = req.params.key\n    let value = req.body\n    const {collectionId, grant} = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const userHasRule = await ReviewService.checkRuleByAssetUser({ruleId, assetId, collectionId, grant, checkWritable: true})\n    if (userHasRule) {\n      await ReviewService.putReviewMetadataValue( assetId, ruleId, key, value)\n      res.status(204).send()\n    }\n    else {\n      throw new SmError.PrivilegeError('User has insufficient privilege to put the review of this rule.')\n    }\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.deleteReviewMetadataKey = async function (req, res, next) {\n  try {\n    let assetId = req.params.assetId\n    let ruleId = req.params.ruleId\n    let key = req.params.key\n    const {collectionId, grant} = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const userHasRule = await ReviewService.checkRuleByAssetUser({ruleId, assetId, collectionId, grant, checkWritable: true})\n    if (userHasRule) {\n      await ReviewService.deleteReviewMetadataKey( assetId, ruleId, key, req.userObject)\n      res.status(204).send()\n    }\n    else {\n      throw new SmError.PrivilegeError('User has insufficient privilege to delete the review of this rule.')\n    }\n  }\n  catch (err) {\n    next(err)\n  }  \n}\n\nmodule.exports.postReviewBatch = async function (req, res, next) {\n  try {\n  \n    const { collectionId, grant } = await Collection.getCollectionInfoAndCheckPermission(req, Security.ROLES.Restricted)\n    const collectionSettings = await CollectionService.getCollectionSettings(collectionId)\n    const historySettings = collectionSettings.history\n    const statusSettings = collectionSettings.status\n    const userId = req.userObject.userId\n  \n    let {source, assets, rules, action, updateFilters, dryRun = false} = req.body\n    // normalize status property\n    if (typeof source.review.status === 'string') {\n      source.review.status = {\n        label: source.review.status,\n        text: null\n      }\n    }\n    // reject unpermitted accept/reject\n    if (source.review.status?.label === 'accepted' || source.review.status?.label === 'rejected') {\n      if (!statusSettings.canAccept) {\n        throw new SmError.PrivilegeError('Reviews cannot be accepted/rejected in this Collection') \n      }\n      if (grant.roleId < statusSettings.minAcceptGrant) {\n        throw new SmError.PrivilegeError('User cannot accept/reject Reviews in this Collection') \n      }\n    }\n    // validate action\n    if (!source.review.result && (action === 'insert' || action === 'merge')) {\n      throw new SmError.UnprocessableError('Cannot insert a NULL result')\n    }\n    // default action if missing\n    if (!action) {\n      action = source.review.result ? 'merge' : 'update'\n    }\n\n    // are grant checks required\n    let skipGrantCheck = false\n    if (assets.benchmarkIds && rules.benchmarkIds && assets.benchmarkIds.length === rules.benchmarkIds.length) {\n      skipGrantCheck = assets.benchmarkIds.every( i => rules.benchmarkIds.includes(i)) &&\n        rules.benchmarkIds.every( i => assets.benchmarkIds.includes(i))\n    }\n\n    const result = await ReviewService.postReviewBatch({\n      source, \n      assets, \n      rules,\n      action,\n      updateFilters,\n      dryRun,\n      collectionId, \n      userId,\n      grant,\n      svcStatus: res.svcStatus,\n      historyMaxReviews: historySettings.maxReviews,\n      skipGrantCheck\n    })\n    res.json(result)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\n"
  },
  {
    "path": "api/source/controllers/STIG.js",
    "content": "'use strict';\n\nconst config = require('../utils/config');\nconst SmError = require('../utils/error');\nconst parsers = require('../utils/parsers.js')\nconst STIGService = require(`../service/STIGService`)\n\nmodule.exports.importBenchmark = async function importManualBenchmark (req, res, next) {\n  try {\n    if (!req.query.elevate) throw new SmError.PrivilegeError()\n    const extension = req.file.originalname.substring(req.file.originalname.lastIndexOf(\".\")+1)\n    const clobber = req.query.clobber ?? false\n    if (extension.toLowerCase() != 'xml') {\n      throw new SmError.ClientError(`File extension .${extension} not supported`)\n    }\n    let benchmark\n    try {\n      benchmark = parsers.benchmarkFromXccdf(req.file.buffer)\n    }\n    catch(err){\n      throw new SmError.ClientError(err.message)\n    }\n    if (benchmark.scap) {\n      throw new SmError.UnprocessableError('SCAP Benchmarks are not imported.')\n    }\n\n    const markingMatch = req.file.originalname.match(/^(CUI|U|FOUO)_/)\n    benchmark.revision.marking = markingMatch?.[1] ?? null\n\n    const revision = await STIGService.insertManualBenchmark(benchmark, clobber, res.svcStatus)\n    res.json(revision)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\n\nmodule.exports.deleteRevisionByString = async function deleteRevisionByString (req, res, next) {\n  try {\n    if (!req.query.elevate) throw new SmError.PrivilegeError()\n    const benchmarkId = req.params.benchmarkId\n    const revisionStr = req.params.revisionStr\n    const force = req.query.force\n      const response = await STIGService.getRevisionByString({\n      benchmarkId, \n      revisionStr,\n      grants: req.userObject.grants,\n      elevate: req.query.elevate\n    })\n    if(response === undefined) {\n      throw new SmError.NotFoundError('No matching revisionStr found.')\n    }\n    const existingRevisions = await STIGService.getRevisionsByBenchmarkId({benchmarkId, grants: req.userObject.grants})\n    const stigAssigned = await STIGService.getStigById(benchmarkId, req.userObject, true)\n    if (stigAssigned.collectionIds.length && existingRevisions.length == 1 && !force) {\n      throw new SmError.UnprocessableError(\"The revisionStr is the last remaining revision for this benchmark, which is assigned to one or more Collections. Set force=true to force the delete\")\n    }      \n    if (response.collectionIds.length && !force) {\n      throw new SmError.UnprocessableError(\"The revisionStr is pinned to one or more Collections. Set force=true to force the delete\")\n    }\n    else {\n      await STIGService.deleteRevisionByString(benchmarkId, revisionStr, res.svcStatus)\n      res.json(response)\n    }\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.deleteStigById = async function deleteStigById (req, res, next) {\n  if ( req.query.elevate ) {\n    try {\n      const benchmarkId = req.params.benchmarkId\n      const force = req.query.force\n      const response = await STIGService.getStigById(benchmarkId, req.userObject, true)\n      if(response === undefined) {\n        throw new SmError.NotFoundError('No matching benchmarkId found.')\n      }\n      if (response.collectionIds.length && !force) {\n        throw new SmError.UnprocessableError(\"The benchmarkId is assigned to one or more Collections. Set force=true to force the delete\")\n      }\n      await STIGService.deleteStigById(benchmarkId, res.svcStatus)\n      res.json(response)\n    }\n    catch (err) {\n      next(err)\n    }\n  }\n  else {\n    next(new SmError.PrivilegeError())\n  } \n}\n\nmodule.exports.getCci = async function getCci (req, res, next) {\n  let cci = req.params.cci\n  let projection = req.query.projection\n  try {\n    let response = await STIGService.getCci(cci, projection, req.userObject)\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getCcisByRevision = async function getCcisByRevision (req, res, next) {\n  let benchmarkId = req.params.benchmarkId\n  let revisionStr = req.params.revisionStr\n  try {\n    let response = await STIGService.getCcisByRevision(benchmarkId, revisionStr, req.userObject)\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getGroupByRevision = async function getGroupByRevision (req, res, next) {\n  let projection = req.query.projection\n  let benchmarkId = req.params.benchmarkId\n  let revisionStr = req.params.revisionStr\n  let groupId = req.params.groupId\n  try {\n    let response = await STIGService.getGroupByRevision(benchmarkId, revisionStr, groupId, projection, req.userObject)\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getGroupsByRevision = async function getGroupsByRevision (req, res, next) {\n  let projection = req.query.projection\n  let benchmarkId = req.params.benchmarkId\n  let revisionStr = req.params.revisionStr\n  try {\n    let response = await STIGService.getGroupsByRevision(benchmarkId, revisionStr, projection, req.userObject)\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getRevisionByString = async function getRevisionByString (req, res, next) {\n  try {\n    const benchmarkId = req.params.benchmarkId\n    const revisionStr = req.params.revisionStr\n    const elevate = req.query.elevate\n    const response = await STIGService.getRevisionByString({\n      benchmarkId, \n      revisionStr,\n      grants: req.userObject.grants,\n      elevate\n    })\n    res.status(response ? 200 : 404).json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getRevisionsByBenchmarkId = async function getRevisionsByBenchmarkId (req, res, next) {\n  const benchmarkId = req.params.benchmarkId\n  const elevate = req.query.elevate\n  try {\n    const response = await STIGService.getRevisionsByBenchmarkId({benchmarkId, grants: req.userObject.grants, elevate})\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getRuleByRuleId = async function getRuleByRuleId (req, res, next) {\n  let projection = req.query.projection\n  let ruleId = req.params.ruleId\n  try {\n    let response = await STIGService.getRuleByRuleId(ruleId, projection, req.userObject)\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getRuleByRevision = async function getRulesByRevision (req, res, next) {\n  let projection = req.query.projection\n  let benchmarkId = req.params.benchmarkId\n  let revisionStr = req.params.revisionStr\n  let ruleId = req.params.ruleId\n  try {\n    let response = await STIGService.getRuleByRevision(benchmarkId, revisionStr, ruleId, projection, req.userObject)\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getRulesByRevision = async function getRulesByRevision (req, res, next) {\n  let projection = req.query.projection\n  let benchmarkId = req.params.benchmarkId\n  let revisionStr = req.params.revisionStr\n  try {\n    let response = await STIGService.getRulesByRevision(benchmarkId, revisionStr, projection, req.userObject)\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getSTIGs = async function getSTIGs (req, res, next) {\n  const title = req.query.title\n  const elevate = req.query.elevate\n  const projection = req.query.projection || []\n  try {\n    let response = await STIGService.getSTIGs(title, projection, req.userObject, elevate)\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getStigById = async function getStigById (req, res, next) {\n  let benchmarkId = req.params.benchmarkId\n  const elevate = req.query.elevate\n  try {\n    let response = await STIGService.getStigById(benchmarkId, req.userObject, elevate)\n    if(!response) {\n      throw new SmError.NotFoundError()\n    }\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getScapMap = async function getStigById (req, res, next) {\n  res.json([\n    {\n      scapBenchmarkId: 'CAN_Ubuntu_18-04_STIG',\n      benchmarkId: 'U_CAN_Ubuntu_18-04_STIG'\n    },\n    {\n      scapBenchmarkId: 'Mozilla_Firefox_RHEL',\n      benchmarkId: 'Mozilla_Firefox'\n    },\n    {\n      scapBenchmarkId: 'Mozilla_Firefox_Windows',\n      benchmarkId: 'Mozilla_Firefox'\n    },\n    {\n      scapBenchmarkId: 'MOZ_Firefox_Linux',\n      benchmarkId: 'MOZ_Firefox_STIG'\n    },\n    {\n      scapBenchmarkId: 'MOZ_Firefox_Windows',\n      benchmarkId: 'MOZ_Firefox_STIG'\n    },    \n    {\n      scapBenchmarkId: 'Solaris_10_X86_STIG',\n      benchmarkId: 'Solaris_10_X86'\n    }\n  ])\n}\n"
  },
  {
    "path": "api/source/controllers/User.js",
    "content": "'use strict';\n\nconst config = require('../utils/config')\nconst UserService = require(`../service/UserService`)\nconst AssetService = require(`../service/AssetService`)\nconst CollectionService = require(`../service/CollectionService`)\nconst SmError = require('../utils/error')\nconst dbUtils = require('../service/utils')\n\nasync function validateCollectionGrants(collectionGrants, {elevate}) {\n  if (collectionGrants?.length) {\n    // Verify each grant for a valid collectionId\n    let requestedIds = collectionGrants.map( g => g.collectionId )\n    let availableCollections = await CollectionService.queryCollections({elevate})\n    let availableIds = availableCollections.map( c => c.collectionId)\n    if (! requestedIds.every( id => availableIds.includes(id) ) ) {\n      throw new SmError.UnprocessableError('One or more collectionIds are invalid.')\n    }\n  }\n}\n\n/*  */\nmodule.exports.createUser = async function createUser (req, res, next) {\n  try {\n    const elevate = req.query.elevate\n    if (!elevate) throw new SmError.PrivilegeError()\n    let body = req.body\n    let projection = req.query.projection\n\n    if (body.hasOwnProperty('collectionGrants') ) {\n      await validateCollectionGrants(body.collectionGrants, {elevate})\n    }\n    body.status = 'available'\n    try {\n      let response = await UserService.createUser(body, projection, elevate, req.userObject, res.svcStatus)\n      res.status(201).json(response)\n    }\n    catch (err) {\n      // This is MySQL specific, should abstract\n      if (err.code === 'ER_DUP_ENTRY') {\n        throw new SmError.UnprocessableError('Duplicate name exists.')\n      }\n      else {\n        throw err\n      }\n    }\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.deleteUser = async function deleteUser (req, res, next) {\n  try {\n    let elevate = req.query.elevate\n    if (elevate) {\n      let userId = req.params.userId\n      let projection = req.query.projection\n      let userData = await UserService.getUserByUserId(userId, [], elevate, req.userObject)\n      if (userData?.lastAccess) {\n        // User has accessed the system, so we need to reject the request\n        throw new SmError.UnprocessableError('User has accessed the system. Use PATCH to remove collection grants or configure Authentication provider to reject user entirely.')\n      }\n      let response = await UserService.deleteUser(userId, projection, elevate, req.userObject)\n      res.json(response)\n    }\n    else {\n      throw new SmError.PrivilegeError()    \n    }\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.exportUsers = async function exportUsers (projection, elevate, userObject) {\n  if (elevate) {\n    return await UserService.getUsers(null, null, projection, elevate, userObject )\n  }\n  else {\n    throw new SmError.PrivilegeError()    \n  }\n} \n\nmodule.exports.exportUserGroups = async function exportUserGroups (projections, elevate) {\n\n  if (elevate) {\n    return await UserService.queryUserGroups({projections})\n  }\n  else {\n    throw new SmError.PrivilegeError()    \n  }\n}\n\nmodule.exports.getUser = async function getUser (req, res, next) {\n  try {\n    const projection = ['collectionGrants', 'statistics', 'userGroups']\n    if (req.query.projection) {\n      projection.push(req.query.projection)\n    }\n\n    let response = await UserService.getUserByUserId(req.userObject.userId, projection)\n    response.privileges = req.userObject.privileges\n    res.json(response)\n}\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getUserByUserId = async function getUserByUserId (req, res, next) {\n  try {\n    let elevate = req.query.elevate\n    if ( elevate ) {\n      let userId = req.params.userId\n      let projection = req.query.projection\n      let response = await UserService.getUserByUserId(userId, projection, elevate, req.userObject)\n      if(!response) {\n        throw new SmError.NotFoundError()\n      }\n      res.json(response)\n    }\n    else {\n      throw new SmError.PrivilegeError()    \n    }\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.getUsers = async function getUsers (req, res, next) {\n  try {\n    let elevate = req.query.elevate\n    let username = req.query.username\n    let usernameMatch = req.query['username-match']\n    let privilege = req.query['privilege']\n    let status = req.query.status\n    let projection = req.query.projection\n    if ( !elevate && projection?.length > 0) {\n      throw new SmError.PrivilegeError()\n    }\n    let response = await UserService.getUsers( username, usernameMatch, privilege, status, projection, elevate, req.userObject)\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.replaceUser = async function replaceUser (req, res, next) {\n  try {\n    let elevate = req.query.elevate\n    let userId = req.params.userId\n    if (!elevate) throw new SmError.PrivilegeError() \n    let body = req.body\n    let projection = req.query.projection\n\n    let userData = await UserService.getUserByUserId(userId)\n    if (!userData) {\n      throw new SmError.NotFoundError(\"UserId not found.\")\n    }\n\n    const intendedStatus = body.status || userData.status\n    if (intendedStatus === 'unavailable') {\n      if (body.collectionGrants?.length || body.userGroups?.length) {\n        throw new SmError.UserInconsistentError()\n      }\n    }\n    if (body.status) {\n      body.statusUser = req.userObject.userId\n      body.statusDate = new Date()\n    } \n\n    if (body.collectionGrants?.length) {\n      await validateCollectionGrants(body.collectionGrants, {elevate})\n    }\n\n    let response = await UserService.replaceUser(userId, body, projection, elevate, req.userObject, res.svcStatus)\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\nmodule.exports.updateUser = async function updateUser (req, res, next) {\n  try {\n    let elevate = req.query.elevate\n    if (!elevate) throw new SmError.PrivilegeError()\n    let userId = req.params.userId\n    let body = req.body\n    let projection = req.query.projection\n\n    let userData = await UserService.getUserByUserId(userId)\n    if (!userData) {\n      throw new SmError.NotFoundError(\"UserId not found.\")\n    }\n\n    // Determine intended status: body.status or current status\n    const intendedStatus = body.status || userData.status\n    if (intendedStatus === 'unavailable') {\n      if (body.collectionGrants?.length || body.userGroups?.length) {\n        throw new SmError.UserInconsistentError()\n      }\n      body.collectionGrants = []\n      body.userGroups = []\n    }\n    if (body.status) {\n      body.statusUser = req.userObject.userId\n      body.statusDate = new Date()\n    } \n\n    if (body.collectionGrants?.length) {\n      await validateCollectionGrants(body.collectionGrants, {elevate})\n    }\n\n    let response = await UserService.replaceUser(userId, body, projection, elevate, req.userObject, res.svcStatus)\n    res.json(response)\n  }\n  catch(err) {\n    next(err)\n  }\n}\n\n/* c8 ignore start */\nmodule.exports.setUserData = async function setUserData (username, fields) {\n  try {\n    await UserService.setUserData(username, fields)\n    return await UserService.getUserByUsername(username)\n  }\n  catch (e) {\n    next(err)\n\n  }\n}\n/* c8 ignore end */\nmodule.exports.createUserGroup = async (req, res, next) => {\n  try {\n    if (!req.query.elevate) throw new SmError.PrivilegeError()\n    const {userIds, collectionGrants, ...userGroupFields} = req.body\n    const invalidUserIds = await dbUtils.selectInvalidUserIds(userIds)\n    if (invalidUserIds.length) {\n      throw new SmError.UserInconsistentError()\n    }\n\n    await validateCollectionGrants(collectionGrants, {elevate: req.query.elevate})\n\n    let userGroupId\n    try{\n      userGroupId = await UserService.addOrUpdateUserGroup({\n        userGroupFields,\n        userIds,\n        collectionGrants,\n        createdUserId: req.userObject.userId,\n        modifiedUserId: req.userObject.userId\n      })\n    }\n    catch (err) {\n      throw err.code === 'ER_DUP_ENTRY' ? new SmError.UnprocessableError('Group name is already in use.') : err\n    }\n    const response = await UserService.queryUserGroups({\n      projections: req.query.projection,\n      filters: {userGroupId}\n    })\n    res.status(201).json(response[0])\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getUserGroups = async (req, res, next) => {\n  try {\n    if (req.query.projection?.includes('collections') && !req.query.elevate) {\n      throw new SmError.PrivilegeError('collections projection requires elevation')\n    }\n    const response = await UserService.queryUserGroups({\n      projections: req.query.projection\n    })\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getUserGroup = async (req, res, next) => {\n  try {\n    if (req.query.projection?.includes('collections') && !req.query.elevate) {\n      throw new SmError.PrivilegeError('collections projection requires elevation')\n    }\n    const response = await UserService.queryUserGroups({\n      projections: req.query.projection,\n      filters: {userGroupId: req.params.userGroupId}\n    })\n    if (!response[0]) throw new SmError.NotFoundError()\n    res.json(response[0])\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nasync function putOrPatchUserGroup (req, res, next) {\n  try {\n    if (!req.query.elevate) throw new SmError.PrivilegeError()\n    const {userIds, collectionGrants, ...userGroupFields} = req.body\n    const invalidUserIds = await dbUtils.selectInvalidUserIds(userIds)\n    if (invalidUserIds.length) {\n      throw new SmError.UserInconsistentError()\n    }\n\n    await validateCollectionGrants(collectionGrants, {elevate: req.query.elevate})\n\n    const userGroup = await UserService.queryUserGroups({\n      projections: [],\n      filters: {userGroupId: req.params.userGroupId}\n    })\n    if (!userGroup.length) throw new SmError.NotFoundError(\"UserGroup not found.\")\n    const userGroupId = await UserService.addOrUpdateUserGroup({\n      userGroupId: req.params.userGroupId,\n      userGroupFields,\n      userIds,\n      collectionGrants,\n      modifiedUserId: req.userObject.userId\n    })\n    const response = await UserService.queryUserGroups({\n      projections: req.query.projection,\n      filters: {userGroupId}\n    })\n    res.json(response[0])\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.patchUserGroup = putOrPatchUserGroup\nmodule.exports.putUserGroup = putOrPatchUserGroup\n\nmodule.exports.deleteUserGroup = async (req, res, next) => {\n  try{\n    if (!req.query.elevate) throw new SmError.PrivilegeError()\n    const response = await UserService.queryUserGroups({\n      projections: req.query.projection,\n      filters: {userGroupId: req.params.userGroupId}\n    })\n    await UserService.deleteUserGroup({\n      userGroupId: req.params.userGroupId,\n    })\n    res.json(response[0])\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.getUserWebPreferences = async (req, res, next) => {\n  try {\n    const response = await UserService.getUserWebPreferences(req.userObject.userId)\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\nmodule.exports.patchUserWebPreferences = async (req, res, next) => {\n  try {\n    const body = req.body\n    await UserService.patchUserWebPreferences(req.userObject.userId, body)\n    const response = await UserService.getUserWebPreferences(req.userObject.userId)\n    res.json(response)\n  }\n  catch (err) {\n    next(err)\n  }\n}\n\n"
  },
  {
    "path": "api/source/healthcheck.js",
    "content": "const http = require(\"http\")\n\nconst options = {  \n    host : \"localhost\",\n    port: process.env.STIGMAN_API_PORT || 54000,\n    path: \"/api/op/definition?jsonpath=%24.info.version\",\n    timeout : 2000\n}\n\nconst request = http.request(options, (res) => {  \n    console.log(`STATUS: ${res.statusCode}`)\n    if (res.statusCode == 200) {\n        process.exit(0)\n    }\n    else {\n        process.exit(1)\n    }\n})\n\nrequest.on('error', function(err) {  \n    console.log('ERROR')\n    process.exit(1)\n})\n\nrequest.end()\n"
  },
  {
    "path": "api/source/index.js",
    "content": "'use strict'\nconst startTime = process.hrtime.bigint()\nconst express = require('express')\nconst logger = require('./utils/logger')\nconst state = require('./utils/state')\nconst signals = require('./bootstrap/signals')\nconst config = require('./utils/config')\nconst { serializeError } = require('./utils/serializeError')\nconst configureMiddleware  = require('./bootstrap/middlewares.js')\nconst bootstrapUtils = require('./bootstrap/bootstrapUtils.js')\nconst client = require('./bootstrap/client.js')\nconst docs = require('./bootstrap/docs.js')\nconst startServer = require('./bootstrap/server')\n\nsignals.setupSignalHandlers()\nbootstrapUtils.logAppConfig(config)\n\n//Catch unhandled errors. \nprocess.on('uncaughtException', (err, origin) => {\n  logger.writeError('app','uncaught', serializeError(err))\n})\nprocess.on('unhandledRejection', (reason, promise) => {\n  logger.writeError('app','unhandled', {reason, promise})\n})\n\nconst app = express()\nconfigureMiddleware(app, config)\nrun()\n\nasync function run() {\n  try {\n    client.serveClient(app)\n    docs.serveDocs(app)\n    docs.serveApiDocs(app)\n    await startServer(app, startTime)\n  }\n  catch (err) {\n    logger.writeError(err.message)\n    state.setState('fail')\n  }\n}\n\n"
  },
  {
    "path": "api/source/package.json",
    "content": "{\n  \"name\": \"stig-management-api\",\n  \"version\": \"1.6.9\",\n  \"description\": \"An API for managing evaluations of Security Technical Implementation Guide (STIG) assessments.\",\n  \"main\": \"index.js\",\n  \"scripts\": {\n    \"prestart\": \"npm install\",\n    \"start\": \"node index.js\"\n  },\n  \"keywords\": [\n    \"swagger\"\n  ],\n  \"license\": \"MIT\",\n  \"private\": true,\n  \"dependencies\": {\n    \"ajv\": \"^8.17.1\",\n    \"ajv-formats\": \"^3.0.1\",\n    \"archiver\": \"^7.0.1\",\n    \"async-retry\": \"^1.3.3\",\n    \"compression\": \"^1.8.1\",\n    \"cors\": \"^2.8.5\",\n    \"csv-stringify\": \"^6.5.1\",\n    \"express\": \"^4.21.2\",\n    \"express-openapi-validator\": \"^5.6.2\",\n    \"fast-xml-parser\": \"^5.5.8\",\n    \"he\": \"^1.2.0\",\n    \"js-yaml\": \"^4.1.0\",\n    \"jsonpath-plus\": \"^10.3.0\",\n    \"jsonwebtoken\": \"^9.0.2\",\n    \"jszip\": \"^3.10.1\",\n    \"jwks-rsa\": \"^3.1.0\",\n    \"multer\": \"^2.1.1\",\n    \"mysql2\": \"^3.11.2\",\n    \"net-keepalive\": \"^4.0.17\",\n    \"on-finished\": \"^2.4.1\",\n    \"on-headers\": \"^1.1.0\",\n    \"semver\": \"^7.6.3\",\n    \"swagger-ui-express\": \"^4.1.6\",\n    \"umzug\": \"^2.3.0\",\n    \"undici\": \"^6.24.0\",\n    \"ws\": \"^8.18.3\",\n    \"xlsx-template\": \"file:utils/xlsx-template-js-zip-upgrade\"\n  }\n}\n"
  },
  {
    "path": "api/source/service/AssetService.js",
    "content": "'use strict';\nconst { randomUUID } = require('node:crypto')\nconst dbUtils = require('./utils')\nconst config = require('../utils/config')\n\nlet _this = this\n\n/**\nGeneralized queries for asset(s).\n**/\nexports.queryAssets = async function ({projections = [], filter = {}, grant = {}}) {\n  const ctes = []\n  const columns = [\n    'CAST(a.assetId as char) as assetId',\n    'a.name',\n    'a.fqdn',\n    `json_object (\n      'collectionId', CAST(c.collectionId as char),\n      'name', c.name\n    ) as \"collection\"`,\n    'a.description',\n    'a.ip',\n    `coalesce(\n      (select\n        json_arrayagg(BIN_TO_UUID(cl.uuid,1))\n      from\n        collection_label_asset_map cla\n        left join collection_label cl on cla.clId = cl.clId\n      where\n        cla.assetId = a.assetId),\n      json_array()\n    ) as labelIds`,\n    `coalesce(\n      (select\n        json_arrayagg(json_object(\n          'labelId', BIN_TO_UUID(cl.uuid,1),\n          'name', cl.name,\n          'color', cl.color\n        ))\n      from\n        collection_label_asset_map cla\n        left join collection_label cl on cla.clId = cl.clId\n      where\n        cla.assetId = a.assetId),\n      json_array()\n    ) as labels`,\n    'a.mac',\n    'a.noncomputing',\n    'a.metadata'\n  ]\n  const joins = [\n    'enabled_asset a',\n    'left join enabled_collection c on a.collectionId = c.collectionId',\n    'left join stig_asset_map sa on a.assetId = sa.assetId'\n  ]\n  if (grant.roleId === 1) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: grant.grantIds}))\n    joins.push('inner join cteAclEffective cae on sa.saId = cae.saId')\n  }\n\n    // PROJECTIONS\n    if (projections.includes('statusStats')) {\n      columns.push(`(select json_object(\n        'stigCount', COUNT(saStatusStats.benchmarkId),\n        'ruleCount', SUM(rStatusStats.ruleCount),\n        'acceptedCount', SUM(saStatusStats.accepted),\n        'rejectedCount', SUM(saStatusStats.rejected),\n        'submittedCount', SUM(saStatusStats.submitted),\n        'savedCount', SUM(saStatusStats.saved),\n        'minTs', DATE_FORMAT(LEAST(MIN(saStatusStats.minTs), MIN(saStatusStats.maxTs)),'%Y-%m-%dT%H:%i:%sZ'),\n        'maxTs', DATE_FORMAT(GREATEST(MAX(saStatusStats.minTs), MAX(saStatusStats.maxTs)),'%Y-%m-%dT%H:%i:%sZ')\n        )\n        from\n          stig_asset_map saStatusStats\n          left join enabled_asset aStatusStats using (assetId)\n          left join default_rev drStatusStats on (saStatusStats.benchmarkId = drStatusStats.benchmarkId and aStatusStats.collectionId = drStatusStats.collectionId)\n          left join revision rStatusStats on drStatusStats.revId = rStatusStats.revId\n        where\n          FIND_IN_SET(saStatusStats.saId, GROUP_CONCAT(sa.saId))\n        ) as \"statusStats\"`)\n    }\n\n    if (projections.includes('stigs')) {\n      //iterate: If benchmarkId is a predicate in main query, this incorrectly only shows that STIG\n      joins.push('left join default_rev dr on (sa.benchmarkId=dr.benchmarkId and a.collectionId = dr.collectionId)')\n      joins.push('left join revision on dr.revId = revision.revId')\n      columns.push(`cast(\n        concat('[', \n          coalesce (\n            group_concat(distinct \n              case when sa.benchmarkId is not null then \n                json_object(\n                  'benchmarkId', sa.benchmarkId, \n                  'revisionStr', revision.revisionStr, \n                  'benchmarkDate', date_format(revision.benchmarkDateSql,'%Y-%m-%d'),\n                  'revisionPinned', CASE WHEN dr.revisionPinned = 1 THEN CAST(true as json) ELSE CAST(false as json) END, \n                  'ruleCount', revision.ruleCount)\n              else null end \n            order by sa.benchmarkId),\n            ''),\n        ']')\n      as json) as \"stigs\"`)\n    }\n\n      // PREDICATES\n  const predicates = {\n    statements: [],\n    binds: []\n  }\n  if (filter.assetId) {\n    predicates.statements.push('a.assetId = ?')\n    predicates.binds.push(filter.assetId)\n  }\n  \n  if (filter.assetIds && filter.assetIds.length > 0) {\n    predicates.statements.push(`a.assetId IN ?`)\n    predicates.binds.push([filter.assetIds])\n  }\n  if (filter.labels?.labelNames || filter.labels?.labelIds || filter.labels?.labelMatch) {\n    joins.push(\n      'left join collection_label_asset_map cla2 on a.assetId = cla2.assetId',\n      'left join collection_label cl2 on cla2.clId = cl2.clId'\n    )\n    const labelPredicates = []\n    if (filter.labels.labelIds) {\n      labelPredicates.push('cl2.uuid IN ?')\n      const uuidBinds = filter.labels.labelIds.map( uuid => dbUtils.uuidToSqlString(uuid))\n      predicates.binds.push([uuidBinds])\n    }\n    if (filter.labels.labelNames) {\n      labelPredicates.push('cl2.name IN ?')\n      predicates.binds.push([filter.labels.labelNames])\n    }\n    if (filter.labels.labelMatch === 'null') {\n      labelPredicates.push('cl2.uuid IS NULL')\n    }\n    const labelPredicatesClause = `(${labelPredicates.join(' OR ')})`\n    predicates.statements.push(labelPredicatesClause)\n  }\n  if ( filter.name ) {\n    let matchStr = '= ?'\n    if ( filter.nameMatch && filter.nameMatch !== 'exact') {\n      matchStr = 'LIKE ?'\n      switch (filter.nameMatch) {\n        case 'startsWith':\n          filter.name = `${filter.name}%`\n          break\n        case 'endsWith':\n          filter.name = `%${filter.name}`\n          break\n        case 'contains':\n          filter.name = `%${filter.name}%`\n          break\n      }\n    }\n    predicates.statements.push(`a.name ${matchStr}`)\n    predicates.binds.push(filter.name)\n  }\n  if (filter.collectionId) {\n    predicates.statements.push('a.collectionId = ?')\n    predicates.binds.push(filter.collectionId)\n  }\n  if (filter.benchmarkId) {\n    predicates.statements.push('sa.benchmarkId = ?')\n    predicates.binds.push(filter.benchmarkId)\n  }\n  if (filter.metadata ) {\n    for (const pair of filter.metadata) {\n      const [key, value] = pair.split(/:(.*)/s)\n      predicates.statements.push('JSON_CONTAINS(a.metadata, ?, ?)')\n      predicates.binds.push( JSON.stringify(value), `$.${key}`)\n    }\n  }\n\n  const groupBy = [\n    'a.assetId'\n  ]\n  const orderBy = []\n\n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, groupBy, orderBy, format: true})\n  let [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\nexports.queryChecklist = async function (inPredicates, projections = []) {\n  let connection\n  try {\n    const columns = [\n      'CAST(:assetId as char) as \"assetId\"',\n      'rgr.ruleId',\n      'rgr.title as \"ruleTitle\"',\n      'rgr.version',\n      'rgr.groupId',\n      'rgr.groupTitle',\n      'rgr.severity',\n      `result.api as \"result\"`,\n      `CASE WHEN review.resultEngine = 0 THEN NULL ELSE review.resultEngine END as resultEngine`,\n      `review.autoResult`,\n      `status.api as \"status\"`,\n      `review.statusTs`,\n      `review.ts`,\n      `review.touchTs`\n    ]\n    if (projections.includes('rule')) {\n      columns.push(`json_object(\n        'ruleId', rgr.ruleId,\n        'severity', rgr.severity,\n        'title', rgr.title,\n        'version', rgr.version,\n        'groupId', rgr.groupId,\n        'groupTitle', rgr.groupTitle,\n        'detail', json_object(\n          'weight', rgr.weight,\n          'vulnDiscussion', rgr.vulnDiscussion,\n          'falsePositives', rgr.falsePositives,\n          'falseNegatives', rgr.falseNegatives,\n          'documentable', rgr.documentable,\n          'mitigations', rgr.mitigations,\n          'severityOverrideGuidance', rgr.severityOverrideGuidance,\n          'potentialImpacts', rgr.potentialImpacts,\n          'thirdPartyTools', rgr.thirdPartyTools,\n          'mitigationControl', rgr.mitigationControl,\n          'responsibility', rgr.responsibility\n        ),\n        'ccis', coalesce(\n          (\n            select json_arrayagg(json_object(\n              'cci', rgrcc.cci,\n              'apAcronym', cci.apAcronym,\n              'definition', cci.definition,\n              'control', crm.parentControl\n            ))\n            from rev_group_rule_cci_map rgrcc\n            inner join cci using (cci)\n            left join cci_reference_map crm using (cci)\n            where rgrcc.rgrId = rgr.rgrId\n          ),\n          json_array()\n        ),\n        'check', json_object(\n          'system', rgr.checkSystem,\n          'content', (\n            select cc.content\n            from check_content cc\n            where cc.digest = rgr.checkDigest\n            limit 1\n          )\n        ),\n        'fix', json_object(\n          'fixref', rgr.fixref,\n          'text', (\n            select ft.text\n            from fix_text ft\n            where ft.digest = rgr.fixDigest\n            limit 1\n          )\n        ),\n        'ruleIds', coalesce(\n          (\n            select json_arrayagg(rvcd2.ruleId)\n            from rule_version_check_digest rvcd2\n            where rvcd2.version = rgr.version\n              and rvcd2.checkDigest = rgr.checkDigest\n          ),\n          json_array()\n        ),\n        'stigs', json_array(\n          json_object(\n            'benchmarkId', rev.benchmarkId,\n            'revisionStr', concat('V', rev.version, 'R', rev.release)\n          )\n        )\n      ) as rule`)\n    }\n    if (projections.includes('detail')) {\n      columns.push('review.detail as \"detail\"')\n    }\n    if (projections.includes('comment')) {\n      columns.push('review.comment as \"comment\"')\n    }\n    const joins = [\n      'current_rev rev',\n      'left join rev_group_rule_map rgr using (revId)',\n      'left join rule_version_check_digest rvcd using (ruleId)',\n      'left join review on (rvcd.version = review.version and rvcd.checkDigest = review.checkDigest and review.assetId = :assetId)',\n      'left join result on review.resultId=result.resultId',\n      'left join status on review.statusId=status.statusId',\n      'left join enabled_asset a on review.assetId=a.assetId'\n    ]\n    const predicates = {\n      statements: [],\n      binds: {}\n    }\n    if (inPredicates.assetId) {\n      predicates.binds.assetId = inPredicates.assetId\n    }\n    if (inPredicates.benchmarkId) {\n      predicates.statements.push('rev.benchmarkId = :benchmarkId')\n      predicates.binds.benchmarkId = inPredicates.benchmarkId\n    }\n    if (inPredicates.revisionStr !== 'latest') {\n      joins.splice(0, 1, 'revision rev')\n      const {version, release} = dbUtils.parseRevisionStr(inPredicates.revisionStr)\n      const revId =  `${inPredicates.benchmarkId}-${version}-${release}`\n      predicates.statements.push('rev.revId = :revId')\n      predicates.binds.revId = revId\n    }\n    const groupBy = [\n      'rgr.rgrId',\n      'result.api',\n      'review.reviewId',\n      'status.api',\n    ]\n    const orderBy = [\n      'substring(rgr.groupId from 3) + 0'\n    ]\n\n    const sql = dbUtils.makeQueryString({columns, joins, predicates, groupBy, orderBy}) \n    connection = await dbUtils.pool.getConnection()\n    connection.config.namedPlaceholders = true\n\n    let [rows] = await connection.query( sql, predicates.binds )\n    return (rows)\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\nexports.cklFromAssetStigs = async function cklFromAssetStigs (assetId, stigs) {\n  let connection\n  try {\n    let revisionStrResolved // Will hold specific revision string value, as opposed to \"latest\" \n    const xmlJs = {\n      CHECKLIST: {\n        ASSET: {\n          ROLE: 'None',\n          ASSET_TYPE: 'Computing',\n          MARKING: null,\n          HOST_NAME: null,\n          HOST_IP: null,\n          HOST_MAC: null,\n          HOST_GUID: null,\n          HOST_FQDN: null,\n          TECH_AREA: null,\n          TARGET_KEY: '2777',\n          WEB_OR_DATABASE: 'false',\n          WEB_DB_SITE: null,\n          WEB_DB_INSTANCE: null\n        },\n        STIGS: {\n          iSTIG: []\n        }\n      }\n    }\n\n    const sqlGetAsset = \"select name, fqdn, ip, mac, noncomputing, metadata from enabled_asset where assetId = ?\"\n    const sqlGetChecklist =`SELECT \n      rgr.groupId,\n      rgr.severity,\n      rgr.groupTitle,\n      rgr.ruleId,\n      rgr.title as \"ruleTitle\",\n      rgr.weight,\n      rgr.version,\n      rgr.vulnDiscussion,\n      rgr.iaControls,\n      rgr.falsePositives,\n      rgr.falseNegatives,\n      rgr.documentable,\n      rgr.mitigations,\n      rgr.potentialImpacts,\n      rgr.thirdPartyTools,\n      rgr.mitigationControl,\n      rgr.responsibility,\n      rgr.severityOverrideGuidance,\n      result.ckl as \"result\",\n      LEFT(review.detail,32767) as \"detail\",\n      LEFT(review.comment,32767) as \"comment\",\n      cc.content as \"checkContent\",\n      ft.text as \"fixText\",\n      group_concat(rgrcc.cci ORDER BY rgrcc.cci) as \"ccis\"\n    FROM\n      revision rev \n      left join rev_group_rule_map rgr on rev.revId = rgr.revId \n      left join rule_version_check_digest rvcd on rgr.ruleId = rvcd.ruleId\n      left join severity_cat_map sc on rgr.severity = sc.severity \n      \n      left join rev_group_rule_cci_map rgrcc on rgr.rgrId = rgrcc.rgrId\n\n      left join check_content cc on rgr.checkDigest = cc.digest\n\n      left join fix_text ft on rgr.fixDigest = ft.digest\n\n      left join review on (rvcd.version = review.version and rvcd.checkDigest = review.checkDigest and review.assetId = ?)\n      left join result on review.resultId = result.resultId \n      left join status on review.statusId = status.statusId \n\n    WHERE\n      rev.revId = ?\n    GROUP BY\n      rgr.rgrId,\n      result.ckl,\n      review.detail,\n      review.comment\n    order by\n      substring(rgr.groupId from 3) + 0 asc\n    `\n    connection = await dbUtils.pool.getConnection()\n\n    // ASSET\n    const [resultGetAsset] = await connection.query(sqlGetAsset, [assetId])\n    xmlJs.CHECKLIST.ASSET.HOST_NAME = resultGetAsset[0].metadata.cklHostName ? resultGetAsset[0].metadata.cklHostName : resultGetAsset[0].name\n    xmlJs.CHECKLIST.ASSET.HOST_FQDN = resultGetAsset[0].fqdn\n    xmlJs.CHECKLIST.ASSET.HOST_IP = resultGetAsset[0].ip\n    xmlJs.CHECKLIST.ASSET.HOST_MAC = resultGetAsset[0].mac\n    xmlJs.CHECKLIST.ASSET.ASSET_TYPE = resultGetAsset[0].noncomputing ? 'Non-Computing' : 'Computing'\n    xmlJs.CHECKLIST.ASSET.ROLE = resultGetAsset[0].metadata.cklRole ?? 'None'\n    xmlJs.CHECKLIST.ASSET.TECH_AREA = resultGetAsset[0].metadata.cklTechArea ?? null\n    xmlJs.CHECKLIST.ASSET.WEB_OR_DATABASE = resultGetAsset[0].metadata.cklHostName ?  'true' : 'false'\n    xmlJs.CHECKLIST.ASSET.WEB_DB_SITE = resultGetAsset[0].metadata.cklWebDbSite ?? null\n    xmlJs.CHECKLIST.ASSET.WEB_DB_INSTANCE = resultGetAsset[0].metadata.cklWebDbInstance ?? null\n    \n    // CHECKLIST.STIGS.iSTIG.STIG_INFO.SI_DATA\n    const markings = []\n    for (const stigItem of stigs) {\n      const revisionStr = stigItem.revisionStr || 'latest'\n      revisionStrResolved = revisionStr\n      const benchmarkId = stigItem.benchmarkId\n      \n      let sqlGetBenchmarkId\n      if (revisionStr === 'latest') {\n        sqlGetBenchmarkId = `select\n          cr.benchmarkId, \n          s.title, \n          cr.revId, \n          cr.description, \n          cr.version, \n          cr.release, \n          cr.benchmarkDate,\n          cr.marking\n        from\n          current_rev cr \n          left join stig s on cr.benchmarkId = s.benchmarkId\n        where\n          cr.benchmarkId = ?`\n      }\n      else {\n        sqlGetBenchmarkId = `select\n          r.benchmarkId,\n          s.title,\n          r.description,\n          r.version,\n          r.release,\n          r.benchmarkDate,\n          r.marking\n        from \n          stig s \n          left join revision r on s.benchmarkId=r.benchmarkId\n        where\n          r.revId = ?`  \n      }\n      // Calculate revId\n      let resultGetBenchmarkId, revId\n      if (revisionStr === 'latest') {\n        ;[resultGetBenchmarkId] = await connection.query(sqlGetBenchmarkId, [benchmarkId])\n        revId = resultGetBenchmarkId[0].revId\n        revisionStrResolved = `V${resultGetBenchmarkId[0].version}R${resultGetBenchmarkId[0].release}`\n      }\n      else {\n        const {version, release} = dbUtils.parseRevisionStr(revisionStr)\n        revId =  `${benchmarkId}-${version}-${release}`\n        ;[resultGetBenchmarkId] = await connection.execute(sqlGetBenchmarkId, [revId])\n      }\n  \n      const stig = resultGetBenchmarkId[0]\n      // Set the marking\n      if (stig.marking) {\n        markings.push(stig.marking)\n      }\n      const siDataRefs = [\n        { SID_NAME: 'version', SID_DATA: stig.version },\n        { SID_NAME: 'classification' },\n        { SID_NAME: 'customname' },\n        { SID_NAME: 'stigid', SID_DATA: stig.benchmarkId },\n        { SID_NAME: 'description', SID_DATA: stig.description },\n        { SID_NAME: 'filename', SID_DATA: 'stig-manager-oss' },\n        { SID_NAME: 'releaseinfo', SID_DATA: `Release: ${stig.release} Benchmark Date: ${stig.benchmarkDate}`},\n        { SID_NAME: 'title', SID_DATA: stig.title },\n        { SID_NAME: 'uuid', SID_DATA: '391aad33-3cc3-4d9a-b5f7-0d7538b7b5a2' },\n        { SID_NAME: 'notice', SID_DATA: 'terms-of-use' },\n        { SID_NAME: 'source', }\n      ]\n      const iStigJs = {\n        STIG_INFO:\n          {\n            SI_DATA: []\n          },\n        VULN: []\n      }\n      const siDataArray = iStigJs.STIG_INFO.SI_DATA\n      for (const siDatum of siDataRefs) {\n        siDataArray.push(siDatum)\n      }\n  \n      // CHECKLIST.STIGS.iSTIG.STIG_INFO.VULN\n      const [resultGetChecklist] = await connection.query(sqlGetChecklist, [assetId, revId])\n  \n      const stigDataRef = [\n        ['Vuln_Num', 'groupId' ],\n        ['Severity',  'severity' ],\n        ['Weight',  'weight' ],\n        ['Group_Title',  'groupTitle' ],\n        ['Rule_ID',  'ruleId' ],\n        ['Rule_Ver',  'version' ],\n        ['Rule_Title',  'ruleTitle' ],\n        ['Vuln_Discuss',  'vulnDiscussion' ],\n        ['IA_Controls',  'iaControls' ],\n        ['Check_Content',  'checkContent' ],\n        ['Fix_Text',  'fixText' ],\n        ['False_Positives',  'falsePositives' ],\n        ['False_Negatives',  'falseNegatives' ],\n        ['Documentable', 'documentable' ],\n        ['Mitigations', 'mitigations' ],\n        ['Potential_Impact', 'potentialImpacts' ],\n        ['Third_Party_Tools', 'thirdPartyTools' ],\n        ['Mitigation_Control', 'mitigationControl' ],\n        ['Responsibility', 'responsibility' ],\n        ['Security_Override_Guidance', 'severityOverrideGuidance' ] \n        // STIGViewer bug requires using Security_Override_Guidance instead of Severity_Override_Guidance\n      ]\n  \n      // let vulnArray = xmlJs.CHECKLIST.STIGS.iSTIG.VULN\n      const vulnArray = iStigJs.VULN\n      for (const r of resultGetChecklist) {\n        const vulnObj = {\n          STIG_DATA: [],\n          STATUS: r.result || 'Not_Reviewed',\n          FINDING_DETAILS: r.detail,\n          COMMENTS: r.comment,\n          SEVERITY_OVERRIDE: null,\n          SEVERITY_JUSTIFICATION: null\n        }\n        for (const stigDatum of stigDataRef) {\n          vulnObj.STIG_DATA.push({\n            VULN_ATTRIBUTE: stigDatum[0],\n            ATTRIBUTE_DATA: r[stigDatum[1]]\n          })\n        }\n        // STIGRef\n        vulnObj.STIG_DATA.push({\n          VULN_ATTRIBUTE: 'STIGRef',\n          ATTRIBUTE_DATA: `${stig.title} :: Version ${stig.version}, Release: ${stig.release} Benchmark Date: ${stig.benchmarkDate}`\n        })\n        // CCI_REFs\n        if (r.ccis) {\n          const ccis = r.ccis.split(',')\n          for (const cci of ccis) {\n            vulnObj.STIG_DATA.push({\n              VULN_ATTRIBUTE: 'CCI_REF',\n              ATTRIBUTE_DATA: `CCI-${cci}`\n            })\n          }\n        }\n        vulnArray.push(vulnObj)        \n      }\n      xmlJs.CHECKLIST.STIGS.iSTIG.push(iStigJs)\n    }\n    // calculate the marking for this checklist\n    let marking = config.settings.setClassification === 'NONE' ? 'U' : config.settings.setClassification\n    if (marking === 'U' || marking === 'CUI') {\n      const sortedMarkings = markings.toSorted((a, b) => a.localeCompare(b)) // because CUI, FOUO, U sort alphabetically\n      marking = sortedMarkings[0] || 'U'\n    }\n    return ({assetName: resultGetAsset[0].name, xmlJs, revisionStrResolved, marking})\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n\n}\n\nexports.cklbFromAssetStigs = async function cklbFromAssetStigs (assetId, stigs) {\n  let connection\n  try {\n    let revisionStrResolved // Will hold specific revision string value, as opposed to \"latest\"\n    const cklb = {\n      title: '',\n      id: randomUUID(),\n      active: false,\n      mode: 1,\n      has_path: true,\n      target_data: {\n        target_type: '',\n        host_name: '',\n        ip_address: '',\n        mac_address: '',\n        fqdn: '',\n        comments: '',\n        role: '',\n        is_web_database: false,\n        technology_area: '',\n        web_db_site: '',\n        web_db_instance: ''\n      },\n      stigs: []\n    }\n\n    const sqlGetAsset = \"select name, fqdn, ip, mac, noncomputing, metadata from enabled_asset where assetId = ?\"\n    const sqlGetChecklist =`SELECT \n      rgr.groupId,\n      rgr.severity,\n      rgr.groupTitle,\n      rgr.ruleId,\n      rgr.title as \"ruleTitle\",\n      rgr.weight,\n      rgr.version,\n      rgr.vulnDiscussion,\n      rgr.iaControls,\n      rgr.falsePositives,\n      rgr.falseNegatives,\n      rgr.documentable,\n      rgr.mitigations,\n      rgr.potentialImpacts,\n      rgr.thirdPartyTools,\n      rgr.mitigationControl,\n      rgr.responsibility,\n      rgr.severityOverrideGuidance,\n      result.cklb as \"result\",\n      LEFT(review.detail,32767) as \"detail\",\n      LEFT(review.comment,32767) as \"comment\",\n      review.ts as \"createdAt\",\n      review.touchTs as \"updatedAt\",\n      cc.content as \"checkContent\",\n      ft.text as \"fixText\",\n      group_concat(rgrcc.cci ORDER BY rgrcc.cci) as \"ccis\"\n    FROM\n      revision rev \n      left join rev_group_rule_map rgr on rev.revId = rgr.revId \n      left join rule_version_check_digest rvcd on rgr.ruleId = rvcd.ruleId\n      left join severity_cat_map sc on rgr.severity = sc.severity \n      \n      left join rev_group_rule_cci_map rgrcc on rgr.rgrId = rgrcc.rgrId\n\n      left join check_content cc on rgr.checkDigest = cc.digest\n\n      left join fix_text ft on rgr.fixDigest = ft.digest\n\n      left join review on (rvcd.version = review.version and rvcd.checkDigest = review.checkDigest and review.assetId = ?)\n      left join result on review.resultId = result.resultId \n      left join status on review.statusId = status.statusId \n\n    WHERE\n      rev.revId = ?\n    GROUP BY\n      rgr.rgrId,\n      result.cklb,\n      review.reviewId\n    order by\n      substring(rgr.groupId from 3) + 0 asc\n    `\n    connection = await dbUtils.pool.getConnection()\n\n    // cklb.target_data\n    const [resultGetAsset] = await connection.query(sqlGetAsset, [assetId])\n    cklb.target_data.host_name = resultGetAsset[0].metadata.cklHostName ? resultGetAsset[0].metadata.cklHostName : resultGetAsset[0].name\n    cklb.target_data.fqdn = resultGetAsset[0].fqdn ?? ''\n    cklb.target_data.ip_address = resultGetAsset[0].ip ?? ''\n    cklb.target_data.mac_address = resultGetAsset[0].mac ?? ''\n    cklb.target_data.target_type = resultGetAsset[0].noncomputing ? 'Non-Computing' : 'Computing'\n    cklb.target_data.role = resultGetAsset[0].metadata.cklRole ?? 'None'\n    cklb.target_data.technology_area = resultGetAsset[0].metadata.cklTechArea ?? ''\n    cklb.target_data.is_web_database = !!resultGetAsset[0].metadata.cklHostName\n    cklb.target_data.web_db_site = resultGetAsset[0].metadata.cklWebDbSite ?? ''\n    cklb.target_data.web_db_instance = resultGetAsset[0].metadata.cklWebDbInstance ?? ''\n    \n    // cklb.stigs\n    const markings = []\n    for (const stigItem of stigs) {\n      const revisionStr = stigItem.revisionStr || 'latest'\n      revisionStrResolved = revisionStr\n      const benchmarkId = stigItem.benchmarkId\n      \n      let sqlGetBenchmarkId\n      if (revisionStr === 'latest') {\n        sqlGetBenchmarkId = `select\n          cr.benchmarkId, \n          s.title, \n          cr.revId, \n          cr.description, \n          cr.version, \n          cr.release, \n          cr.benchmarkDate,\n          cr.ruleCount,\n          cr.marking\n        from\n          current_rev cr \n          left join stig s on cr.benchmarkId = s.benchmarkId\n        where\n          cr.benchmarkId = ?`\n      }\n      else {\n        sqlGetBenchmarkId = `select\n          r.benchmarkId,\n          s.title,\n          r.description,\n          r.version,\n          r.release,\n          r.benchmarkDate,\n          r.ruleCount,\n          r.marking\n        from \n          stig s \n          left join revision r on s.benchmarkId=r.benchmarkId\n        where\n          r.revId = ?`  \n      }\n      // Calculate revId\n      let resultGetBenchmarkId, revId\n      if (revisionStr === 'latest') {\n        ;[resultGetBenchmarkId] = await connection.query(sqlGetBenchmarkId, [benchmarkId])\n        revId = resultGetBenchmarkId[0].revId\n        revisionStrResolved = `V${resultGetBenchmarkId[0].version}R${resultGetBenchmarkId[0].release}`\n      }\n      else {\n        const {version, release} = dbUtils.parseRevisionStr(revisionStr)\n        revId =  `${benchmarkId}-${version}-${release}`\n        ;[resultGetBenchmarkId] = await connection.execute(sqlGetBenchmarkId, [revId])\n      }\n  \n      const stig = resultGetBenchmarkId[0]\n      // Set the marking\n      if (stig.marking) {\n        markings.push(stig.marking)\n      }\n\n      const stigUuid = randomUUID()\n      const stigObj = {\n        stig_name: stig.title,\n        display_name: stig.title.replace(' Security Technical Implementation Guide', ''),\n        stig_id: stig.benchmarkId,\n        version: `${stig.version}`,\n        release_info: `Release: ${stig.release} Benchmark Date: ${stig.benchmarkDate}`,\n        uuid: stigUuid,\n        reference_identifier: '0000',\n        size: stig.ruleCount,\n        rules: []\n      }\n\n      // cklb.stigs[x].rules\n      const [resultGetChecklist] = await connection.query(sqlGetChecklist, [assetId, revId])  \n      for (const row of resultGetChecklist) {\n        const rule = {\n          uuid: randomUUID(),\n          stig_uuid: stigUuid,\n          target_key: null,\n          stig_ref: null,\n          group_id: row.groupId,\n          rule_id: row.ruleId.replace('_rule', ''),\n          rule_id_src: row.ruleId,\n          weight: row.weight,\n          classification: config.settings.setClassification,\n          severity: row.severity,\n          rule_version: row.version,\n          group_title: row.groupTitle,\n          rule_title: row.ruleTitle,\n          fix_text: row.fixText,\n          false_positives: row.falsePositives,\n          false_negatives: row.falseNegatives,\n          discussion: row.vulnDiscussion,\n          check_content: row.checkContent,\n          documentable: row.documentable,\n          mitigations: row.mitigations,\n          potential_impacts: row.potentialImpacts,\n          third_party_tools: row.thirdPartyTools,\n          mitigation_control: row.mitigationControl,\n          responsibility: row.responsibility,\n          security_override_guidance: row.severityOverrideGuidance,\n          ia_controls: row.iaControls,\n          check_content_ref: {\n            href: '',\n            name: 'M'\n          },\n          legacy_ids: [],\n          group_tree: [\n            {\n              id: row.groupId,\n              title: row.groupTitle,\n              description: '<GroupDescription></GroupDescription>'\n            }\n          ],\n          createdAt: row.createdAt,\n          updatedAt: row.updatedAt,\n          STIGUuid: stigUuid,\n          status: row.result || 'not_reviewed',\n          overrides: {},\n          comments: row.comment ?? '',\n          finding_details: row.detail ?? ''\n        }\n\n        // CCI_REFs\n        rule.ccis = row.ccis ? row.ccis.split(',').map( cci => `CCI-${cci}`) : []\n        stigObj.rules.push(rule)\n      }\n      cklb.stigs.push(stigObj)\n    }\n\n    // calculate the marking for this checklist\n    let marking = config.settings.setClassification === 'NONE' ? 'U' : config.settings.setClassification\n    if (marking === 'U' || marking === 'CUI') {\n      const sortedMarkings = markings.toSorted((a, b) => a.localeCompare(b)) // because CUI, FOUO, U sort alphabetically\n      marking = sortedMarkings[0] || 'U'\n    }\n\n    return ({assetName: resultGetAsset[0].name, cklb, revisionStrResolved, marking})\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\nexports.xccdfFromAssetStig = async function (assetId, benchmarkId, revisionStr = 'latest') {\n    // queries and query methods\n  const sqlGetAsset = \"select name, fqdn, ip, mac, noncomputing, metadata from enabled_asset where assetId = ?\"\n  const sqlGetChecklist =`SELECT \n    rgr.groupId,\n    rgr.groupTitle,\n    rgr.ruleId,\n    rgr.title as \"ruleTitle\",\n    rgr.severity,\n    rgr.weight,\n    rgr.version,\n    rgr.checkSystem,\n    cc.content as \"checkContent\",\n    result.api as \"result\",\n    review.ts,\n    LEFT(review.detail,32767) as \"detail\",\n    LEFT(review.comment,32767) as \"comment\",\n    review.resultEngine\n  FROM\n    revision rev \n    left join rev_group_rule_map rgr on rev.revId = rgr.revId \n    left join check_content cc on rgr.checkDigest = cc.digest\n    left join rule_version_check_digest rvcd on rgr.ruleId = rvcd.ruleId\n    left join review on (rvcd.version = review.version and rvcd.checkDigest = review.checkDigest and review.assetId = ?)\n\n    left join result on review.resultId = result.resultId \n    left join status on review.statusId = status.statusId \n  WHERE\n    rev.revId = ?\n  order by\n    substring(rgr.groupId from 3) + 0 asc\n  `\n  async function getBenchmarkRevision(connection, benchmarkId, revisionStr) {\n    let revisionStrResolved\n    // Benchmark, calculate revId\n    const sqlGetRevision = revisionStr === 'latest' ?\n      `select\n        cr.benchmarkId, \n        s.title, \n        cr.revId, \n        cr.description, \n        cr.version, \n        cr.release, \n        cr.benchmarkDate,\n        cr.status,\n        cr.statusDate,\n        cr.marking\n      from\n        current_rev cr \n        left join stig s on cr.benchmarkId = s.benchmarkId\n      where\n        cr.benchmarkId = ?`\n    :\n    `select\n        r.benchmarkId,\n        s.title,\n        r.revId,\n        r.description,\n        r.version,\n        r.release,\n        r.benchmarkDate,\n        r.status,\n        r.statusDate,\n        r.marking\n      from \n        stig s \n        left join revision r on s.benchmarkId=r.benchmarkId\n      where\n        r.revId = ?`  \n\n    let result\n    if (revisionStr === 'latest') {\n      ;[result] = await connection.query(sqlGetRevision, [benchmarkId])\n      revisionStrResolved = `V${result[0].version}R${result[0].release}`\n    }\n    else {\n      const {version, release} = dbUtils.parseRevisionStr(revisionStr)\n      const revId = `${benchmarkId}-${version}-${release}`\n      ;[result] = await connection.query(sqlGetRevision, [revId])\n      revisionStrResolved = revisionStr\n    }\n    result[0].revisionStr = revisionStrResolved\n    return result[0]\n  }\n\n  function prefixObjectProperties(prefix, obj) {\n    for (const k in obj)\n      {\n          if (typeof obj[k] == \"object\" && obj[k] !== null) {\n            prefixObjectProperties(prefix, obj[k])\n          }\n          if (!Array.isArray(obj)) {\n            obj[`${prefix}:${k}`] = obj[k]\n            delete obj[k] \n          }\n      }\n  }\n\n  function generateTargetFacts({metadata, ...assetFields}) {\n    const fact = []\n    for (const field in assetFields) {\n      if (assetFields[field]) {\n        fact.push({\n          '@_name': `tag:stig-manager@users.noreply.github.com,2020:asset:${field}`,\n          '@_type': 'string',\n          '#text': assetFields[field]\n        })  \n      }\n    }\n    for (const key in metadata) {\n      if (key.startsWith('urn:')) {\n        fact.push({\n          '@_name': key,\n          '@_type': 'string',\n          '#text': metadata[key] || ''\n        })\n      }\n      else {\n        fact.push({\n          '@_name': `tag:stig-manager@users.noreply.github.com,2020:asset:metadata:${encodeURI(key)}`,\n          '@_type': 'string',\n          '#text': metadata[key] || ''\n        })\n      }\n    }\n    return {\"cdf:fact\": fact}\n  }\n\n  // reuse a connection for multiple SELECT queries\n  const connection = await dbUtils.pool.getConnection()\n  // target\n  const [resultGetAsset] = await connection.query(sqlGetAsset, [assetId])\n  // benchmark\n  const revision = await getBenchmarkRevision(connection, benchmarkId, revisionStr)\n  // checklist\n  const [resultGetChecklist] = await connection.query(sqlGetChecklist, [assetId, revision.revId])\n  // release connection\n  await connection.release()\n\n  // scaffold xccdf object with cdf namespace on all base elements\n  const xmlJs = {\n    \"cdf:Benchmark\": {\n      \"@_xmlns:cdf\": \"http://checklists.nist.gov/xccdf/1.2\",\n      \"@_xmlns:dc\": \"http://purl.org/dc/elements/1.1/\",\n      \"@_xmlns:sm\": \"http://github.com/nuwcdivnpt/stig-manager\",\n      \"@_id\": `xccdf_mil.disa.stig_benchmark_${revision.benchmarkId}`,\n      \"cdf:status\": {\n        \"@_date\": revision.statusDate,\n        \"#text\": revision.status\n      },\n      \"cdf:title\": revision.title,\n      \"cdf:description\": revision.description,\n      \"cdf:platform\": {\n        \"@_idref\": \"cpe:2.3:a:disa:stig\"\n      },      \n      \"cdf:version\": revision.revisionStr,  \n      \"cdf:metadata\": {\n        \"dc:creator\": \"DISA\",\n        \"dc:publisher\": \"STIG Manager OSS\"\n      },\n      \"cdf:Group\": [],\n      \"cdf:TestResult\": {\n        \"@_id\": `xccdf_mil.navy.nuwcdivnpt.stig-manager_testresult_${revision.benchmarkId}`,\n        \"@_test-system\": `cpe:/a:nuwcdivnpt:stig-manager:${config.version}`,\n        \"@_end-time\": new Date().toISOString(),\n        \"@_version\": \"1.0\",\n        \"cdf:title\": \"\",\n        \"cdf:target\": resultGetAsset[0].name,\n        \"cdf:target-address\": resultGetAsset[0].ip,\n        \"cdf:target-facts\": generateTargetFacts(resultGetAsset[0]),\n        \"cdf:rule-result\": [],\n        \"cdf:score\": \"1.0\"\n      } \n    }\n  }  \n\n  // iterate through checklist query results\n  for (const r of resultGetChecklist) {\n    xmlJs[\"cdf:Benchmark\"][\"cdf:Group\"].push({\n      \"@_id\": `xccdf_mil.disa.stig_group_${r.groupId}`,\n      \"cdf:title\": r.groupTitle,\n      \"cdf:Rule\": {\n        \"@_id\": `xccdf_mil.disa.stig_rule_${r.ruleId}`,\n        \"@_weight\": r.weight,\n        \"@_severity\": r.severity || undefined,\n        \"cdf:title\": r.ruleTitle,\n        \"cdf:check\": {\n          \"@_system\": r.checkSystem,\n          \"cdf:check-content\": r.checkContent\n        }\n      }\n    })\n    if (r.resultEngine) {\n      prefixObjectProperties('sm', r.resultEngine)\n    }\n    xmlJs[\"cdf:Benchmark\"][\"cdf:TestResult\"][\"cdf:rule-result\"].push({\n      \"cdf:result\": r.result || \"notchecked\",\n      \"@_idref\": `xccdf_mil.disa.stig_rule_${r.ruleId}`,\n      \"@_time\": r.ts?.toISOString(),\n      \"cdf:check\": {\n        \"@_system\": r.checkSystem,\n        \"cdf:check-content\": {\n          \"sm:detail\": r.detail || undefined,\n          \"sm:comment\": r.comment || undefined,\n          \"sm:resultEngine\": r.resultEngine || undefined\n        }\n      }\n    })\n  }\n  let marking = config.settings.setClassification === 'NONE' ? 'U' : config.settings.setClassification\n  if (marking === 'U' || marking === 'CUI') {\n    marking = revision.marking || 'U' // if marking is not set, use U\n  }\n  return ({assetName: resultGetAsset[0].name, xmlJs, revisionStrResolved: revision.revisionStr, marking})\n}\n\nexports.createAssets = async function({ assets, collectionId, svcStatus = {} }) {\n  let insertedAssetIds = []\n\n  async function transactionFn(connection) {\n    await connection.query('DROP TEMPORARY TABLE IF EXISTS temp_assets')\n\n    // create temp table to hold incoming assets\n    const createTempTableSQL = `\n        CREATE TEMPORARY TABLE temp_assets (\n            tempId INT AUTO_INCREMENT PRIMARY KEY,\n            name VARCHAR(255),\n            fqdn VARCHAR(255),\n            ip VARCHAR(255),\n            mac VARCHAR(255),\n            description TEXT,\n            collectionId INT,\n            noncomputing TINYINT,\n            metadata JSON,\n            benchmarkIds JSON,\n            labelNames JSON,\n            assetId INT NULL\n        );`\n\n    await connection.query(createTempTableSQL)\n\n    const assetsJson = JSON.stringify(assets)\n\n    const insertTempAssetsSQL = `\n      INSERT INTO temp_assets (name, fqdn, ip, mac, description, collectionId, noncomputing, metadata, benchmarkIds, labelNames)\n      SELECT name, fqdn, ip, mac, description, collectionId, noncomputing, metadata, benchmarkIds, labelNames\n      FROM JSON_TABLE(?, '$[*]'\n          COLUMNS (\n              name VARCHAR(255) PATH '$.name',\n              fqdn VARCHAR(255) PATH '$.fqdn',\n              ip VARCHAR(255) PATH '$.ip',\n              mac VARCHAR(255) PATH '$.mac',\n              description TEXT PATH '$.description',\n              collectionId INT PATH '$.collectionId',\n              noncomputing TINYINT PATH '$.noncomputing',\n              metadata JSON PATH '$.metadata',\n              benchmarkIds JSON PATH '$.stigs',\n              labelNames JSON PATH '$.labelNames'\n          )\n      ) AS jt`\n\n    await connection.query(insertTempAssetsSQL, [assetsJson]);\n\n    // insert into asset table\n    const insertAssetsSQL = `\n        INSERT INTO asset (name, fqdn, ip, mac, description, collectionId, noncomputing, metadata)\n        SELECT name, fqdn, ip, mac, description, collectionId, noncomputing, metadata\n        FROM temp_assets;`\n    await connection.query(insertAssetsSQL)\n\n    // update temp table with create assets assetIds\n    const updateTempWithAssetIdsSQL = `\n        UPDATE temp_assets t\n        INNER JOIN enabled_asset a\n            ON a.name = t.name\n            AND a.collectionId = t.collectionId\n        SET t.assetId = a.assetId;`\n    await connection.query(updateTempWithAssetIdsSQL)\n\n\n    const insertStigsSQL = `\n        INSERT INTO stig_asset_map (benchmarkId, assetId)\n        SELECT jt.benchmarkId, t.assetId\n        FROM temp_assets t\n        INNER JOIN JSON_TABLE(t.benchmarkIds, '$[*]'\n            COLUMNS (benchmarkId VARCHAR(255) PATH '$')\n        ) AS jt\n        WHERE t.benchmarkIds IS NOT NULL;`\n\n    const [stigInsertResult] = await connection.query(insertStigsSQL)\n\n    const didInsertStigs = stigInsertResult.affectedRows > 0\n\n    // not sure abnout this left hoin ior not \n    const insertLabelsSQL = `\n        INSERT INTO collection_label_asset_map (assetId, clId)\n        SELECT t.assetId, cl.clId\n        FROM temp_assets t\n        INNER JOIN JSON_TABLE(t.labelNames, '$[*]'\n            COLUMNS (labelName VARCHAR(255) PATH '$')\n        ) AS labels\n        LEFT JOIN collection_label cl\n            ON cl.name = labels.labelName\n            AND cl.collectionId = t.collectionId\n        WHERE t.labelNames IS NOT NULL;`\n    await connection.query(insertLabelsSQL)\n\n    // get assetIds of newly created assets\n    const [newAssets] = await connection.query('SELECT assetId FROM temp_assets')\n    insertedAssetIds = newAssets.map(asset => asset.assetId)\n\n    // if assets with stig assignment inserted, update default rev and collection revision map\n    if (didInsertStigs) {\n        await dbUtils.pruneCollectionRevMap(connection)\n        await dbUtils.updateDefaultRev(connection, { collectionId: parseInt(collectionId) })\n    }\n  }\n  await dbUtils.retryOnDeadlock2({ transactionFn, statusObj: svcStatus })\n  return insertedAssetIds\n}\n\nexports.deleteAsset = async function(assetId, userId, svcStatus) {\n  let connection\n  try {\n    connection = await dbUtils.pool.getConnection()\n    async function transaction () {\n      await connection.query('START TRANSACTION')\n      const sqlDelete = `UPDATE asset SET state = \"disabled\", stateDate = NOW(), stateUserId = ? where assetId = ?`\n      await connection.query(sqlDelete, [userId, assetId])\n      // changes above might have affected need for records in collection_rev_map\n      await dbUtils.pruneCollectionRevMap(connection)\n      await dbUtils.updateDefaultRev(connection, {})\n      await connection.commit()\n    }\n    await dbUtils.retryOnDeadlock(transaction, svcStatus)\n    return true\n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }\n    throw err\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\nexports.deleteAssets = async function(assetIds, userId, svcStatus) {\n  let connection\n  try{\n    connection = await dbUtils.pool.getConnection()\n    async function transaction () {\n      await connection.query('START TRANSACTION')\n      const sqlDelete = `UPDATE asset SET state = \"disabled\", stateDate = NOW(), stateUserId = ? where assetId IN ?`\n      await connection.query(sqlDelete, [userId, [assetIds]])\n      // changes above might have affected need for records in collection_rev_map \n      await dbUtils.pruneCollectionRevMap(connection)\n      await dbUtils.updateDefaultRev(connection, {})\n      await connection.commit()\n    }\n    await dbUtils.retryOnDeadlock(transaction, svcStatus)\n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }\n    throw err\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\nexports.attachStigToAsset = async function ({assetId, benchmarkId, grant, svcStatus = {}}) {\n  let connection\n  try {\n    connection = await dbUtils.pool.getConnection()\n    async function transaction () {\n      await connection.query('START TRANSACTION')\n      const sqlInsert = `INSERT IGNORE INTO stig_asset_map (assetId, benchmarkId) VALUES (?, ?)`\n      const resultInsert = await connection.query(sqlInsert, [assetId, benchmarkId])\n      if (resultInsert[0].affectedRows != 0) {\n        // Inserted a new row, so update stats and default rev\n        await dbUtils.updateDefaultRev(connection, {\n          collectionId: grant.collectionId,\n          benchmarkId\n        })        \n        await dbUtils.updateStatsAssetStig(connection, {\n          assetId,\n          benchmarkId\n        })\n\n      }   \n      await connection.commit()  \n    }\n    await dbUtils.retryOnDeadlock(transaction, svcStatus)\n    return true        \n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }\n    throw (err)\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\nexports.removeStigFromAsset = async function ({assetId, benchmarkId, grant, svcStatus} ) {\n  let connection\n  try{\n    connection = await dbUtils.pool.getConnection()\n    async function transaction () {\n      connection.query('START TRANSACTION')\n      const sqlDelete = `DELETE FROM stig_asset_map where assetId = ? and benchmarkId = ?`\n      await connection.query(sqlDelete, [assetId, benchmarkId])\n      // changes above might have affected need for records in collection_rev_map\n      await dbUtils.pruneCollectionRevMap(connection)\n      await dbUtils.updateDefaultRev(connection, {})\n      await connection.commit()\n      return true\n    }\n    return dbUtils.retryOnDeadlock(transaction, svcStatus)\n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }\n    throw err\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\nexports.removeStigsFromAsset = async function (assetId, grant, svcStatus) {\n  let connection\n\n  try{\n    connection = await dbUtils.pool.getConnection()\n    async function transaction () {\n      await connection.query('START TRANSACTION')\n      const sqlDelete = `DELETE FROM stig_asset_map where assetId = ?`\n      await connection.query(sqlDelete, [assetId])\n      \n      // changes above might have affected need for records in collection_rev_map\n      await dbUtils.pruneCollectionRevMap(connection)\n      await dbUtils.updateDefaultRev(connection, {collectionId: grant.collectionId})\n      await connection.commit()\n    }\n    await dbUtils.retryOnDeadlock(transaction, svcStatus)\n    return true\n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }\n    throw err\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\nexports.getAsset = async function({assetId, projections, grant}) {\n  const rows = await _this.queryAssets({\n    projections, \n    filter: {assetId},\n    grant})\n  return (rows[0])\n}\n\nexports.doesAssetExist = async function (assetId) {\n  const sql = `SELECT assetId FROM enabled_asset WHERE assetId = ?`\n  const [rows] = await dbUtils.pool.query(sql, [assetId])\n  return rows.length > 0\n}\n\nexports.getAssets = async function({filter, projections, grant}) {\n return _this.queryAssets({\n    filter,\n    projections,\n    grant\n  })\n}\n\nexports.getStigsByAssetSlow = async function ({assetId, grant}) {\n  const ctes = []\n  const columns = [\n    'distinct sa.benchmarkId', \n    `concat('V', rev.version, 'R', rev.release) as revisionStr`, \n    `date_format(rev.benchmarkDateSql,'%Y-%m-%d') as revisionDate`,\n    'rev.ruleCount as ruleCount'\n  ]\n  const joins = [\n    'enabled_asset a',\n    'left join enabled_collection c on a.collectionId = c.collectionId',\n    'inner join stig_asset_map sa on a.assetId = sa.assetId',\n    'left join default_rev dr on (sa.benchmarkId = dr.benchmarkId and a.collectionId = dr.collectionId)',\n    'left join revision rev on dr.revId = rev.revId'\n  ]\n  if (grant.roleId === 1) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: grant.grantIds}))\n    joins.push('inner join cteAclEffective cae on sa.saId = cae.saId')\n  }\n\n  // PREDICATES\n  const predicates = {\n    statements: ['a.assetId = ?'],\n    binds: [assetId]\n  }\n  const orderBy = ['sa.benchmarkId']\n\n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, orderBy, format: true})\n  let [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\nexports.getStigsByAsset = async function ({assetId, grant}) {\n  const ctes = []\n  const columns = [\n    'distinct sa.benchmarkId', \n    `concat('V', rev.version, 'R', rev.release) as revisionStr`, \n    `date_format(rev.benchmarkDateSql,'%Y-%m-%d') as revisionDate`,\n    'rev.ruleCount as ruleCount'\n  ]\n  const joins = [\n    'enabled_asset a',\n    'left join enabled_collection c on a.collectionId = c.collectionId',\n    'inner join stig_asset_map sa on a.assetId = sa.assetId',\n    'left join default_rev dr on (sa.benchmarkId = dr.benchmarkId and a.collectionId = dr.collectionId)',\n    'left join revision rev on dr.revId = rev.revId'\n  ]\n  if (grant.roleId === 1) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: grant.grantIds}))\n    joins.push('inner join cteAclEffective cae on sa.saId = cae.saId')\n  }\n\n  // PREDICATES\n  const predicates = {\n    statements: ['a.assetId = ?'],\n    binds: [assetId]\n  }\n  const orderBy = ['sa.benchmarkId']\n\n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, orderBy, format: true})\n  let [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\nexports.getChecklistByAssetStig = async function(assetId, benchmarkId, revisionStr, format, projections = []) {\n  switch (format) {\n    case 'json':\n    case 'json-access': {\n      return _this.queryChecklist({\n        assetId,\n        benchmarkId,\n        revisionStr\n      }, projections)\n    }\n    case 'ckl': \n      return _this.cklFromAssetStigs(assetId, [{benchmarkId, revisionStr}])\n    case 'cklb':\n      return _this.cklbFromAssetStigs(assetId, [{benchmarkId, revisionStr}])\n    case 'xccdf':\n      return _this.xccdfFromAssetStig(assetId, benchmarkId, revisionStr)\n  }\n}\n\nexports.getChecklistByAsset = async function(assetId, benchmarks, format) {\n  switch (format) {\n    case 'ckl':\n      return _this.cklFromAssetStigs(assetId, benchmarks)\n    case 'cklb':\n      return _this.cklbFromAssetStigs(assetId, benchmarks)\n    }\n}\n\nexports.getAssetsByStig = async function({collectionId, benchmarkId, labels, grant}) {\n  const ctes = []\n  const columns = [\n    'DISTINCT CAST(a.assetId as char) as assetId',\n    'a.name',\n    'coalesce(any_value(cae.access), \"rw\") as access',\n    `coalesce(\n      (select\n        json_arrayagg(BIN_TO_UUID(cl.uuid,1))\n      from\n        collection_label_asset_map cla\n        left join collection_label cl on cla.clId = cl.clId\n      where\n        cla.assetId = a.assetId),\n      json_array()\n    ) as assetLabelIds`,\n    `coalesce(\n      (select\n        json_arrayagg(json_object(\n          'labelId', BIN_TO_UUID(cl.uuid,1),\n          'name', cl.name,\n          'color', cl.color\n        ))\n      from\n        collection_label_asset_map cla\n        left join collection_label cl on cla.clId = cl.clId\n      where\n        cla.assetId = a.assetId),\n      json_array()\n    ) as assetLabels`,\n    'CAST(a.collectionId as char) as collectionId'\n  ]\n  const joins = [\n    'enabled_collection c',\n    'inner join enabled_asset a on c.collectionId = a.collectionId',\n    'left join stig_asset_map sa on a.assetId = sa.assetId',\n  ]\n  ctes.push(dbUtils.cteAclEffective({grantIds: grant.grantIds}))\n  joins.push(`${grant.roleId === 1 ? 'inner' : 'left'} join cteAclEffective cae on sa.saId = cae.saId`)\n\n  // PREDICATES\n  const predicates = {\n    statements: [\n      'c.collectionId = ?',\n      'sa.benchmarkId = ?'\n    ],\n    binds: [collectionId, benchmarkId]\n  }\n  if (labels?.labelNames || labels?.labelIds || labels?.labelMatch) {\n    joins.push(\n      'left join collection_label_asset_map cla2 on a.assetId = cla2.assetId',\n      'left join collection_label cl2 on cla2.clId = cl2.clId'\n    )\n    const labelPredicates = []\n    if (labels.labelIds) {\n      labelPredicates.push('cl2.uuid IN ?')\n      const uuidBinds = labels.labelIds.map( uuid => dbUtils.uuidToSqlString(uuid))\n      predicates.binds.push([uuidBinds])\n    }\n    if (labels.labelNames) {\n      labelPredicates.push('cl2.name IN ?')\n      predicates.binds.push([labels.labelNames])\n    }\n    if (labels.labelMatch === 'null') {\n      labelPredicates.push('cl2.uuid IS NULL')\n    }\n    const labelPredicatesClause = `(${labelPredicates.join(' OR ')})`\n    predicates.statements.push(labelPredicatesClause)\n  }\n  const groupBy = ['a.assetId']\n  const orderBy = [ 'a.name' ]\n\n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, groupBy, orderBy, format: true})  \n  const [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\nexports.attachAssetsToStig = async function(collectionId, benchmarkId, assetIds, svcStatus = {}) {\n  let connection\n  try {\n    connection = await dbUtils.pool.getConnection()\n    async function transaction () {\n      await connection.query('START TRANSACTION')\n\n      let sqlDeleteBenchmarks = `\n      DELETE stig_asset_map FROM \n        stig_asset_map\n        left join enabled_asset a on stig_asset_map.assetId = a.assetId\n      WHERE\n        a.collectionId = ?\n        and stig_asset_map.benchmarkId = ?`\n      if (assetIds.length > 0) {\n        sqlDeleteBenchmarks += ' and stig_asset_map.assetId NOT IN ?'\n      }  \n      // DELETE from stig_asset_map, which will cascade into user_stig_aset_map\n      await connection.query( sqlDeleteBenchmarks, [ collectionId, benchmarkId, [assetIds] ] )\n      \n      // Push any bind values\n      let binds = []\n      assetIds.forEach( assetId => {\n        binds.push([benchmarkId, assetId])\n      })\n      if (binds.length > 0) {\n        // INSERT into stig_asset_map\n        let sqlInsertBenchmarks = `\n        INSERT IGNORE INTO \n          stig_asset_map (benchmarkId, assetId)\n        VALUES\n          ?`\n        await connection.query(sqlInsertBenchmarks, [ binds ])\n      }\n\n      // changes above might have affected need for records in collection_rev_map \n      await dbUtils.pruneCollectionRevMap(connection)\n\n      await dbUtils.updateDefaultRev(connection, {\n        collectionId: collectionId,\n        benchmarkId: benchmarkId\n      })\n      await dbUtils.updateStatsAssetStig( connection, {\n        collectionId: collectionId,\n        benchmarkId: benchmarkId\n      })\n\n  \n\n      // Commit the changes\n      await connection.commit()\n    }\n    return await dbUtils.retryOnDeadlock(transaction, svcStatus)\n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }\n    throw err\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\nexports.updateAsset = async function( {assetId, body, currentCollectionId, transferring, svcStatus = {}} ) {\n  let connection\n  try {\n    // Extract or initialize non-scalar properties to separate variables\n    let binds\n    let { stigs, labelNames, ...assetFields } = body\n\n    // Convert boolean scalar values to database values (true=1 or false=0)\n    if (assetFields.hasOwnProperty('noncomputing')) {\n      assetFields.noncomputing = assetFields.noncomputing ? 1 : 0\n    }\n    if (assetFields.hasOwnProperty('metadata')) {\n      assetFields.metadata = JSON.stringify(assetFields.metadata)\n    }\n\n    connection = await dbUtils.pool.getConnection()\n    connection.config.namedPlaceholders = true\n    async function transaction () {\n      await connection.query('START TRANSACTION')\n\n      // Process scalar properties\n      binds = { ...assetFields}\n      assetFields.collectionId ??=  currentCollectionId\n\n      if (Object.keys(binds).length > 0) {\n        // UPDATE into assets\n        let sqlUpdate =\n          `UPDATE\n              asset\n            SET\n              ?\n            WHERE\n              assetId = ?`\n        await connection.query(sqlUpdate, [assetFields, assetId])\n        if (transferring) {\n          await connection.query(\n            `DELETE FROM collection_grant_acl WHERE assetId = ?`,\n            [assetId]\n          )  \n          const sqlGetAssetLabels = `SELECT name, description, color FROM collection_label_asset_map inner join collection_label using (clId) WHERE assetId = ?`\n          const [assetLabels] = await connection.query(sqlGetAssetLabels, [assetId])\n          \n          const sqlDeleteLabels = `DELETE FROM collection_label_asset_map WHERE assetId = ?`\n          await connection.query(sqlDeleteLabels, [assetId])\n\n          if (assetLabels.length) {\n            const sqlGetCollectionLabels = `SELECT clId, name, description, color FROM collection_label WHERE collectionId = ?`\n            const [collectionLabels] = await connection.query(sqlGetCollectionLabels, [transferring.newCollectionId])\n            const collectionLabelNames = collectionLabels.reduce( (a,v) => {a[v.name] = v; return a}, {})\n            \n            for (const assetLabel of assetLabels) {\n              if (collectionLabelNames[assetLabel.name]) {\n                await connection.query(`INSERT into collection_label_asset_map (assetId, clId) VALUES (?,?)`, [assetId, collectionLabelNames[assetLabel.name].clId])\n              }\n              else {\n                const [resultInsert] = await connection.query(`INSERT INTO collection_label (collectionId, name, description, color, uuid) VALUES (?, ?, ?, ?, UUID_TO_BIN(UUID(),1))`, \n                [transferring.newCollectionId, assetLabel.name, assetLabel.description, assetLabel.color])\n                const clId = resultInsert.insertId\n                await connection.query(`INSERT into collection_label_asset_map (assetId, clId) VALUES (?,?)`, [assetId, clId])\n              }\n            } \n          }\n        }\n      }\n      if (stigs) {\n        let sqlDeleteBenchmarks = `\n          DELETE FROM \n            stig_asset_map\n          WHERE \n            assetId = ?`\n        if (stigs.length > 0) {\n          sqlDeleteBenchmarks += ` and benchmarkId NOT IN ?`\n        }\n        // DELETE from stig_asset_map, which will cascade into user_stig_aset_map\n        await connection.query(sqlDeleteBenchmarks, [ assetId, [stigs] ])\n        if (stigs.length > 0) {\n          // Map bind values\n          let stigAssetMapBinds = stigs.map( benchmarkId => [benchmarkId, assetId])\n          // INSERT into stig_asset_map\n          let sqlInsertBenchmarks = `\n            INSERT IGNORE INTO \n              stig_asset_map (benchmarkId, assetId)\n            VALUES\n              ?`\n          await connection.query(sqlInsertBenchmarks, [stigAssetMapBinds])\n        }\n      }\n  \n      // Process labelIds, spec requires for CREATE/REPLACE not for UPDATE\n      if (labelNames) {\n        let sqlDeleteLabels = `\n          DELETE FROM \n            collection_label_asset_map\n          WHERE \n            assetId = ?`\n        await connection.query(sqlDeleteLabels, [ assetId ])\n        if (labelNames.length > 0) {      \n          // INSERT into stig_asset_map\n          let sqlInsertLabels = `\n            INSERT INTO collection_label_asset_map (assetId, clId) \n              SELECT\n                ?,\n                clId\n              FROM\n                collection_label\n              WHERE\n                name IN (?) and collectionId = ?`\n          await connection.query(sqlInsertLabels, [assetId, labelNames, assetFields.collectionId])\n        }\n      }\n\n      if (stigs || transferring) {\n        await dbUtils.pruneCollectionRevMap(connection)\n        if (transferring) {\n          await dbUtils.updateDefaultRev(connection, {collectionIds: [transferring.oldCollectionId, transferring.newCollectionId]})\n        }\n        else {\n          await dbUtils.updateDefaultRev(connection, {collectionId: currentCollectionId})\n        }\n        await dbUtils.updateStatsAssetStig( connection, {assetId} ) \n      }\n      // Commit the changes\n      await connection.commit()\n    }\n    await dbUtils.retryOnDeadlock(transaction, svcStatus)\n    return assetId\n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }\n    throw err\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\nexports.getAssetMetadataKeys = async function ( assetId ) {\n  const sql = `\n    select\n      JSON_KEYS(metadata) as keyArray\n    from \n      enabled_asset\n    where \n      assetId = ?`\n  const [rows] = await dbUtils.pool.query(sql, [assetId])\n  return rows.length > 0 ? rows[0].keyArray : []\n}\n\nexports.getAssetMetadata = async function ( assetId ) {\n  const sql = `\n    select\n      metadata \n    from \n      enabled_asset\n    where \n      assetId = ?`\n  const [rows] = await dbUtils.pool.query(sql, [assetId])\n  return rows.length > 0 ? rows[0].metadata : {}\n}\n\nexports.patchAssetMetadata = async function ( assetId, metadata ) {\n  const sql = `\n    update\n      asset\n    set \n      metadata = JSON_MERGE_PATCH(metadata, ?)\n    where \n      assetId = ?`\n  await dbUtils.pool.query(sql, [JSON.stringify(metadata), assetId])\n  return true\n}\n\nexports.putAssetMetadata = async function ( assetId, metadata ) {\n  const sql = `\n    update\n      asset\n    set \n      metadata = ?\n    where \n      assetId = ?`\n  await dbUtils.pool.query(sql, [JSON.stringify(metadata), assetId])\n  return true\n}\n\nexports.getAssetMetadataValue = async function ( assetId, key ) {\n  const sql = `\n    select\n      JSON_EXTRACT(metadata, ?) as value\n    from \n      enabled_asset\n    where \n      assetId = ?`\n  const [rows] = await dbUtils.pool.query(sql, [`$.\"${key}\"`, assetId])\n  return rows.length > 0 ? rows[0].value : \"\"\n}\n\nexports.putAssetMetadataValue = async function ( assetId, key, value ) {\n  const sql = `\n    update\n      asset\n    set \n      metadata = JSON_SET(metadata, ?, ?)\n    where \n      assetId = ?`\n  const [rows] = await dbUtils.pool.query(sql, [`$.\"${key}\"`, value, assetId])\n  return rows.length > 0 ? rows[0].value : \"\"\n}\n\nexports.deleteAssetMetadataKey = async function ( assetId, key ) {\n  const sql = `\n    update\n      asset\n    set \n      metadata = JSON_REMOVE(metadata, ?)\n    where \n      assetId = ?`\n  const [rows] = await dbUtils.pool.query(sql, [`$.\"${key}\"`, assetId])\n  return rows.length > 0 ? rows[0].value : \"\"\n}"
  },
  {
    "path": "api/source/service/CollectionService.js",
    "content": "'use strict';\nconst dbUtils = require('./utils')\nconst config = require('../utils/config.js')\nconst MyController = require('../controllers/Collection')\nconst SmError = require('../utils/error.js')\n\nconst _this = this\n\nexports.queryCollection = async function ({collectionId, projections = [], elevate = false, grants = {}}) {\n  const groupBy = []\n  const orderBy = []\n  const ctes = []\n  const columns = [\n    'CAST(c.collectionId as char) as collectionId',\n    'c.name',\n    'c.description',\n    'c.settings',\n    'c.metadata'\n  ]\n  const joins = ['enabled_collection c']\n\n  let requireCteGrantees = false\n  let requireCteAcls = false\n  let requireCteAssets = false\n  let requireCteStigs = false\n  let requireCteLabels = ''\n\n  const predicates = {\n    statements: [],\n    binds: []\n  }\n\n  const requesterRole = elevate ? 4 : grants[collectionId].roleId\n  const requesterGrantIds = grants[collectionId]?.grantIds\n  predicates.statements.push('c.collectionId = ?')\n  predicates.binds.push( collectionId )\n\n  if (projections.includes('assets')) {\n    let sqlAssets = `(select coalesce(${dbUtils.jsonArrayAgg({\n      value: `json_object(\n      'assetId', CAST(assetId as char), \n      'name', name)`,\n      orderBy: 'name'\n      })}, json_array()) from\n      ${requesterRole === 1 ? 'cteAssets' : 'enabled_asset where collectionId = c.collectionId'}) as assets`\n      if (requesterRole === 1) {\n      requireCteAcls = true\n      requireCteAssets = true\n    }\n    columns.push(sqlAssets)\n  }\n\n  if (projections.includes('stigs')) {\n    if (requesterRole === 1) {\n      requireCteAcls = true\n      requireCteStigs = true\n      columns.push(`(select coalesce(json_arrayagg(json_object(\n      'benchmarkId', benchmarkId, \n      'revisionStr', revisionStr,\n      'benchmarkDate', benchmarkDate,\n      'revisionPinned', revisionPinned,\n      'ruleCount', ruleCount\n      )), json_array()) from cteStigs) as stigs`)\n    }\n    else {\n      columns.push(`(select coalesce(json_arrayagg(json_object(\n        'benchmarkId', cb.benchmarkId, \n        'revisionStr', revision.revisionStr,\n        'benchmarkDate', date_format(revision.benchmarkDateSql,'%Y-%m-%d'),\n        'revisionPinned', CASE WHEN dr.revisionPinned = 1 THEN CAST(true as json) ELSE CAST(false as json) END,\n        'ruleCount', revision.ruleCount\n        )), json_array())\n        from \n\t\t    (select distinct sa.benchmarkId from enabled_asset a\n        inner join stig_asset_map sa on a.assetId = sa.assetId\n        where a.collectionId = c.collectionId) cb\n        left join default_rev dr on (cb.benchmarkId=dr.benchmarkId and dr.collectionId = c.collectionId)\n        left join revision on dr.revId = revision.revId) as stigs`)\n    }\n  }\n\n  if (projections.includes('grants')) { \n    columns.push(`(select\n      coalesce(\n        (select json_arrayagg(grantJson) from\n          (select\n            json_object(\n              'grantId', cast(grantId as char),\n              'user', json_object(\n              'userId', CAST(user_data.userId as char),\n              'username', user_data.username,\n              'displayName', COALESCE(\n                JSON_UNQUOTE(JSON_EXTRACT(user_data.lastClaims, \"$.${config.oauth.claims.name}\")),\n                user_data.username)),\n              'roleId', roleId)\n            as grantJson\n          from\n            collection_grant inner join user_data using (userId) where collectionId = c.collectionId\n          UNION\n          select\n            json_object(\n              'grantId', cast(grantId as char),\n              'userGroup', json_object(\n                'userGroupId', CAST(user_group.userGroupId as char),\n                'name', user_group.name,\n                'description', user_group.description\n                ),\n              'roleId', roleId\n            ) as grantJson\n          from collection_grant inner join user_group using (userGroupId) where collectionId = c.collectionId\n        ) as grantJsons)\n      , json_array()\n      )\n    ) as \"grants\"`)\n  }\n\n  if (projections.includes('users')) {\n    requireCteGrantees = true\n    columns.push(`(select \n    json_arrayagg(json_object(\n    'user', json_object(\n      'userId', CAST(ud.userId as char),\n      'username', ud.username,\n      'displayName', COALESCE(\n      JSON_UNQUOTE(JSON_EXTRACT(ud.lastClaims, \"$.${config.oauth.claims.name}\")),\n      ud.username)),\n    'roleId', cgs.roleId,\n    'grantees', cgs.grantees))\n    from cteGrantees cgs \n    inner join user_data ud on cgs.userId = ud.userId\n    ) as users`)\n  }\n\n  if (projections.includes('labels')) {\n    if (requesterRole === 1) {\n      requireCteAcls = true\n      requireCteLabels = 'restricted'\n    }\n    else {\n      requireCteLabels = 'all'\n    }\n    columns.push(`(select\n      coalesce(json_arrayagg(json_object(\n        'labelId', labelId, \n        'name', name,\n        'description', description,\n        'color', color,\n        'uses', uses\n        )), json_array())\n      from\n        cteLabels) as labels`)\n  }\n\n  if (projections.includes('owners')) {\n    columns.push(`(select coalesce(json_arrayagg(grantJson),json_array()) from\n      (select user_data.username, json_object(\n        'userId', CAST(user_data.userId as char),\n        'username', user_data.username,\n        'displayName', JSON_UNQUOTE(JSON_EXTRACT(user_data.lastClaims, \"$.${config.oauth.claims.name}\"))\n        ) as grantJson\n      from\n        collection_grant inner join user_data using (userId) where collectionId = c.collectionId and roleId = 4\n      UNION\n      select user_group.name, json_object(\n        'userGroupId', CAST(user_group.userGroupId as char),\n        'name', user_group.name,\n        'description', user_group.description\n      ) as grantJson\n      from collection_grant inner join user_group using (userGroupId) where collectionId = c.collectionId and roleId = 4 order by username) o) as owners`)\n  }\n\n  if (projections.includes('statistics')) {\n    if (requesterRole === 1) {\n      requireCteGrantees = true\n      requireCteAcls = true\n      columns.push(`(select\n      json_object(\n      'created', DATE_FORMAT(c.created, '%Y-%m-%dT%TZ'),\n      'userCount', dt4.userCount,\n      'assetCount', dt4.assetCount,\n      'checklistCount', dt4.checklistCount\n      )\n      from \n        (SELECT\n        (select count(userId) from cteGrantees where collectionId = c.collectionId) as userCount,\n        (select count(distinct sa.assetId) from cteAclEffective cae left join stig_asset_map sa using (saId)) as assetCount,\n        (select count(saId) from cteAclEffective) as checklistCount) dt4\n      ) as statistics`)\n    }\n    else {\n      requireCteGrantees = true\n      columns.push(`(select\n        json_object(\n        'created', DATE_FORMAT(c.created, '%Y-%m-%dT%TZ'),\n        'userCount', dt4.userCount,\n        'assetCount', dt4.assetCount,\n        'checklistCount', dt4.checklistCount\n        )\n        from \n          (SELECT\n          (select count(userId) from cteGrantees where collectionId = c.collectionId) as userCount,\n          (select count(distinct a.assetId) from enabled_asset a where a.collectionId = c.collectionId) as assetCount,\n          (select count(saId) from enabled_asset a left join stig_asset_map sa using (assetId) where a.collectionId = c.collectionId) as checklistCount) dt4\n        ) as statistics`)\n\n    }\n  }\n\n  // setup ctes\n  if (requireCteGrantees) {\n    const cteGranteesParams = {collectionId: collectionId, returnCte: true}\n    ctes.push(dbUtils.sqlGrantees(cteGranteesParams))\n  }\n  if (requireCteAcls) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: requesterGrantIds, includeColumnCollectionId: false}))\n  }\n  if (requireCteAssets) {\n    ctes.push(`cteAssets as (select distinct a.assetId, a.name from \n    cteAclRules ar\n    inner join stig_asset_map sa using (saId)\n    left join enabled_asset a using (assetId)\n    order by a.name)`)\n  }\n  if (requireCteStigs) {\n    ctes.push(`cteStigs as (\n    select distinct\n      sa.benchmarkId,\n      revision.revisionStr,\n      date_format(revision.benchmarkDateSql,'%Y-%m-%d') as benchmarkDate,\n      CASE WHEN dr.revisionPinned = 1 THEN CAST(true as json) ELSE CAST(false as json) END as revisionPinned,\n      revision.ruleCount\n    from\n      cteAclRules ar\n      inner join stig_asset_map sa using (saId)\n      left join default_rev dr on (sa.benchmarkId=dr.benchmarkId and dr.collectionId = ${collectionId})\n      left join revision on dr.revId = revision.revId\n    order by sa.benchmarkId)`)\n  }\n  if (requireCteLabels) {\n    ctes.push(`cteLabels as (\n    select\n      BIN_TO_UUID(cl.uuid,1) labelId,\n      cl.name,\n      cl.description,\n      cl.color,\n      count(distinct cla.claId) as uses\n    from\n      collection_label cl\n      left join collection_label_asset_map cla on cla.clId = cl.clId\n      ${requireCteLabels === 'restricted' ? 'left join stig_asset_map sa on cla.assetId = sa.assetId' : ''}\n      ${requireCteLabels === 'restricted' ? 'inner join cteAclEffective cae on sa.saId = cae.saId' : ''}\n    where\n      cl.collectionId = ${collectionId}\n    group by\n      cl.clId)`)\n  }\n\n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, groupBy, orderBy, format: true})\n  const [rows] = await dbUtils.pool.query(sql)\n\n  return rows[0]  \n}\n\n/**\nGeneralized queries for collection(s).\n**/\nexports.queryCollections = async function ({projections = [], filter = {}, elevate = false, grants = {}, userId = ''}) {  \n    const collectionIdsGranted = Object.keys(grants)\n    if (!collectionIdsGranted.length && !elevate) {\n      return []\n    }\n\n    const ctes = []\n    const columns = [\n      'CAST(c.collectionId as char) as collectionId',\n      'c.name',\n      'c.description',\n      'c.settings',\n      'c.metadata'\n    ]\n    const joins = ['enabled_collection c']\n    const predicates = {\n      statements: [],\n      binds: []\n    }\n    const orderBy = ['c.name']\n\n    let requireCteGrantees = false\n    let requireCteAcls = false\n    let requesterGrantIds = []\n\n    if (!elevate) {\n      for (const collectionId in grants) {\n        requesterGrantIds.push(grants[collectionId].grantIds)\n      }\n      requesterGrantIds = requesterGrantIds.flat()\n    }\n\n    if (projections.includes('owners')) {\n      columns.push(`(select coalesce(json_arrayagg(grantJson),json_array()) from\n        (select json_object(\n          'userId', CAST(user_data.userId as char),\n          'username', user_data.username,\n          'displayName', JSON_UNQUOTE(JSON_EXTRACT(user_data.lastClaims, \"$.${config.oauth.claims.name}\"))\n          ) as grantJson\n        from\n          collection_grant inner join user_data using (userId) where collectionId = c.collectionId and roleId = 4\n        UNION\n        select json_object(\n          'userGroupId', CAST(user_group.userGroupId as char),\n          'name', user_group.name,\n          'description', user_group.description\n        ) as grantJson\n        from collection_grant inner join user_group using (userGroupId) where collectionId = c.collectionId and roleId = 4) o) as owners`)\n    }\n    if (projections.includes('statistics')) {\n      if (!elevate) {\n        requireCteGrantees = true\n        requireCteAcls = true\n        columns.push(`(select\n          json_object(\n          'created', DATE_FORMAT(c.created, '%Y-%m-%dT%TZ'),\n          'userCount', dt4.userCount,\n          'assetCount', case when dt4.roleId = 1 then dt4.assetGrantedCount else dt4.assetCount end,\n          'checklistCount', case when dt4.roleId = 1 then dt4.checklistGrantedCount else dt4.checklistCount end\n          )\n          from \n            (SELECT\n            (select roleId from cteGrantees where collectionId = c.collectionId and userId = ?) as roleId,\n            (select count(userId) from cteGrantees where collectionId = c.collectionId) as userCount,\n            (select count(distinct a.assetId) from enabled_asset a where a.collectionId = c.collectionId) as assetCount,\n            (select count(distinct sa.assetId) from cteAclEffective cae left join stig_asset_map sa using (saId) where cae.collectionId = c.collectionId) as assetGrantedCount,\n            (select count(sa.saId) from enabled_asset a left join stig_asset_map sa using (assetId) where a.collectionId = c.collectionId) as checklistCount,\n            (select count(saId) from cteAclEffective where collectionId = c.collectionId) as checklistGrantedCount\n          ) dt4\n        ) as statistics`)\n        predicates.binds.push(userId)\n      }\n      else {\n        requireCteGrantees = true\n        columns.push(`(select\n          json_object(\n          'created', DATE_FORMAT(c.created, '%Y-%m-%dT%TZ'),\n          'userCount', dt4.userCount,\n          'assetCount', dt4.assetCount,\n          'checklistCount', dt4.checklistCount\n          )\n          from \n            (SELECT\n            (select count(userId) from cteGrantees where collectionId = c.collectionId) as userCount,\n            (select count(distinct a.assetId) from enabled_asset a where a.collectionId = c.collectionId) as assetCount,\n            (select count(sa.saId) from enabled_asset a left join stig_asset_map sa using (assetId) where a.collectionId = c.collectionId) as checklistCount) dt4\n          ) as statistics`)\n      }\n    }\n    // This projection is not exposed in the OAS, only used by Operation.getAppData()\n    if (projections.includes('grants')) { \n      columns.push(`(select\n        coalesce(\n          (select json_arrayagg(grantJson) from\n            (select\n                json_object(\n                  'user', json_object(\n                  'userId', CAST(user_data.userId as char),\n                  'username', user_data.username,\n                  'displayName', COALESCE(\n                    JSON_UNQUOTE(JSON_EXTRACT(user_data.lastClaims, \"$.${config.oauth.claims.name}\")),\n                    user_data.username)),\n                  'roleId', roleId)\n                as grantJson\n            from\n              collection_grant inner join user_data using (userId) where collectionId = c.collectionId\n            UNION\n            select\n              json_object(\n                'userGroup', json_object(\n                  'userGroupId', CAST(user_group.userGroupId as char),\n                  'name', user_group.name,\n                  'description', user_group.description\n                  ),\n                'roleId', roleId\n              ) as grantJson\n            from collection_grant inner join user_group using (userGroupId) where collectionId = c.collectionId\n          ) as grantJsons)\n        , json_array()\n        )\n      ) as \"grants\"`)\n    }\n\n\n    if (!elevate) {\n      predicates.statements.push('c.collectionId IN (?)')\n      predicates.binds.push( collectionIdsGranted )\n    }\n    if ( filter.name ) {\n      let matchStr = '= ?'\n      if ( filter.nameMatch && filter.nameMatch !== 'exact') {\n        matchStr = 'LIKE ?'\n        switch (filter.nameMatch) {\n          case 'startsWith':\n            filter.name = `${filter.name}%`\n            break\n          case 'endsWith':\n            filter.name = `%${filter.name}`\n            break\n          case 'contains':\n            filter.name = `%${filter.name}%`\n            break\n        }\n      }\n      predicates.statements.push(`c.name ${matchStr}`)\n      predicates.binds.push( filter.name )\n    }\n    if ( filter.metadata ) {\n      for (const pair of filter.metadata) {\n        const [key, value] = pair.split(/:(.*)/s)\n        predicates.statements.push('JSON_CONTAINS(c.metadata, ?, ?)')\n        predicates.binds.push( `\"${value}\"`,  `$.${key}`)\n      }\n    }\n\n    if (requireCteGrantees) {\n      const cteGranteesParams = elevate ? {returnCte: true} : {collectionIds: collectionIdsGranted, returnCte: true}\n      ctes.push(dbUtils.sqlGrantees(cteGranteesParams))\n    }\n    if (requireCteAcls) {\n      ctes.push(dbUtils.cteAclEffective({grantIds: requesterGrantIds}))\n    }\n\n    const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, orderBy, format: true})\n    const [rows] = await dbUtils.pool.query(sql)\n    return rows  \n}\n\nexports.doesCollectionExist = async function (collectionId) {\n  const sql = `SELECT collectionId FROM enabled_collection WHERE collectionId = ?`\n  const [rows] = await dbUtils.pool.query(sql, [collectionId])\n  return rows.length > 0\n}\n\n\nexports.addOrUpdateCollection = async function(writeAction, collectionId, body, projection, userObject, svcStatus = {}) {\n  // CREATE: collectionId will be null\n  // REPLACE/UPDATE: collectionId is not null\n  let connection // available to try, catch, and finally blocks\n  try {\n    const {grants, labels, ...collectionFields} = body\n    // Stringify JSON values\n    collectionFields.metadata = JSON.stringify(collectionFields.metadata ?? {})\n    // Merge default settings with any provided settings\n\n    if( writeAction === dbUtils.WRITE_ACTION.CREATE || writeAction === dbUtils.WRITE_ACTION.REPLACE ) {\n      collectionFields.settings = JSON.stringify({...MyController.defaultSettings, ...collectionFields.settings})\n    }\n    else if(collectionFields.settings) {\n      collectionFields.settings = JSON.stringify(collectionFields.settings)\n    }\n  \n    // Connect to MySQL\n    connection = await dbUtils.pool.getConnection()\n    connection.config.namedPlaceholders = true\n    async function transaction () {\n      await connection.query('START TRANSACTION');\n\n      // Process scalar properties\n      if (writeAction === dbUtils.WRITE_ACTION.CREATE) {\n        // INSERT into collections\n        let sqlInsert =\n        `INSERT INTO\n            collection\n            (name, description, settings, metadata)\n          VALUES\n            (:name, :description, :settings, :metadata)`\n        let [rows] = await connection.execute(sqlInsert, collectionFields)\n        collectionId = rows.insertId\n      }\n      else if (writeAction === dbUtils.WRITE_ACTION.UPDATE || writeAction === dbUtils.WRITE_ACTION.REPLACE) {\n        if (Object.keys(collectionFields).length > 0) {\n          // UPDATE into collections\n          const sqlUpdate = `UPDATE collection SET ?  WHERE collectionId = ?`\n          await connection.query(sqlUpdate, [collectionFields, collectionId])\n        }\n      }\n      else {\n        throw new SmError.InternalError('Invalid writeAction')\n      }\n\n      // process grants\n      if (grants) {\n        if (grants.length) {\n          const grantsByIdType = grants.reduce((accumulator, currentValue) => {\n            accumulator[currentValue.userId ? 'userGrants' : 'userGroupGrants'].push(currentValue)\n            return accumulator\n          }, {userGrants:[], userGroupGrants:[]})\n\n          if (grantsByIdType.userGrants.length) {\n            await connection.query(\n              `DELETE FROM collection_grant WHERE collectionId = ? and userId NOT IN (?)`,\n              [collectionId, grantsByIdType.userGrants.map(i => i.userId)]\n            )\n            const sqlInsertUserGrants = `INSERT\n            INTO \n              collection_grant (collectionId, userId, roleId)\n            VALUES\n              ? as new \n            ON DUPLICATE KEY UPDATE \n              roleId = new.roleId`      \n            const binds = grantsByIdType.userGrants.map(i => [collectionId, i.userId, i.roleId])\n            await connection.query(sqlInsertUserGrants, [binds])\n          }\n          else {\n            await connection.query(`DELETE FROM collection_grant WHERE collectionId = ? and userId is not null`, [collectionId])\n          }\n\n          if (grantsByIdType.userGroupGrants.length) {\n            await connection.query(\n              `DELETE FROM collection_grant WHERE collectionId = ? and userGroupId NOT IN (?)`,\n              [collectionId, grantsByIdType.userGroupGrants.map(i => i.userGroupId)]\n            )\n            const sqlInsertGroupGrants = `INSERT \n            INTO \n              collection_grant (collectionId, userGroupId, roleId) \n            VALUES\n              ? as new\n            ON DUPLICATE KEY UPDATE \n              roleId = new.roleId`      \n            const binds = grantsByIdType.userGroupGrants.map(i => [collectionId, i.userGroupId, i.roleId])\n            await connection.query(sqlInsertGroupGrants, [binds])\n          }\n          else {\n            await connection.query(`DELETE FROM collection_grant WHERE collectionId = ? and userGroupId is not null`, [collectionId]) \n          }\n  \n        }\n        else if (writeAction !== dbUtils.WRITE_ACTION.CREATE) {\n          await connection.query(`DELETE FROM collection_grant WHERE collectionId = ?`, [collectionId])\n          await connection.query(`DELETE FROM collection_grant_group WHERE collectionId = ?`, [collectionId]) \n        }\n      }\n\n      // Process labels\n      if (labels && writeAction !== dbUtils.WRITE_ACTION.CREATE) {\n        // DELETE from collection_label\n        let sqlDeleteLabels = 'DELETE FROM collection_label where collectionId = ?'\n        await connection.execute(sqlDeleteLabels, [collectionId])\n      }\n      if (labels && labels.length > 0) {\n        // INSERT into collection_label\n        let sqlInsertLabels = `\n          INSERT INTO \n          collection_label (collectionId, name, description, color, uuid)\n          VALUES\n            ?`      \n        const binds = labels.map(i => [collectionId, i.name, i.description, i.color, {\n          toSqlString: function () {\n            return `UUID_TO_BIN(UUID(),1)`\n          }\n        }])\n        await connection.query(sqlInsertLabels, [binds])\n      }\n  \n      // Commit the changes\n      await connection.commit()\n    }\n    await dbUtils.retryOnDeadlock(transaction, svcStatus)\n  }\n  catch (err) {\n    await connection.rollback()\n    throw err\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n  let row = await _this.getCollection(collectionId, projection, true, userObject)\n  return row\n}\n\n/**\n * Create a Collection\n *\n * body CollectionAssign  (optional)\n * returns List\n **/\nexports.createCollection = async function(body, projection, userObject, svcStatus = {}) {\n  let row = await _this.addOrUpdateCollection(dbUtils.WRITE_ACTION.CREATE, null, body, projection, userObject, svcStatus)\n  return (row)\n}\n\n\n/**\n * Delete a Collection\n *\n * collectionId Integer A path parameter that identifies a Collection\n **/\nexports.deleteCollection = async function(collectionId, userId) {\n  const sqlDelete = `UPDATE collection SET state = \"disabled\", stateDate = NOW(), stateUserId = ? where collectionId = ?`\n  return dbUtils.pool.query(sqlDelete, [userId, collectionId])\n}\n\n\n/**\n * Return the Checklist for the supplied Collection and STIG \n *\n * collectionId Integer A path parameter that identifies a Collection\n * benchmarkId String A path parameter that identifies a STIG\n * revisionStr String A path parameter that identifies a STIG revision [ V{version_num}R{release_num} | 'latest' ]\n * returns CollectionChecklist\n **/\nexports.getChecklistByCollectionStig = async function (collectionId, benchmarkId, revisionStr, userObject ) {\n  const ctes = []\n  const groupBy = ['rgr.rgrId']\n  const orderBy = ['rgr.ruleId']\n\n  const columns = [\n    `rgr.ruleId\n    ,rgr.title as ruleTitle\n    ,rgr.severity\n    ,rgr.\\`version\\`\n    ,rgr.groupId\n    ,rgr.groupTitle\n    ,json_object(\n      'results', json_object(\n        'pass', sum(CASE WHEN r.resultId = 3 THEN 1 ELSE 0 END),\n        'fail', sum(CASE WHEN r.resultId = 4 THEN 1 ELSE 0 END),\n        'notapplicable', sum(CASE WHEN r.resultId = 2 THEN 1 ELSE 0 END),\n        'other', sum(CASE WHEN r.resultId is null OR (r.resultId != 2 AND r.resultId != 3 AND r.resultId != 4) THEN 1 ELSE 0 END)\n      ),\n      'statuses', json_object(\n        'saved', sum(CASE WHEN r.statusId = 0 THEN 1 ELSE 0 END),\n        'submitted', sum(CASE WHEN r.statusId = 1 THEN 1 ELSE 0 END),\n        'rejected', sum(CASE WHEN r.statusId = 2 THEN 1 ELSE 0 END),\n        'accepted', sum(CASE WHEN r.statusId = 3 THEN 1 ELSE 0 END)\n      )\n    ) as counts\n    ,json_object(\n      'ts', json_object(\n        'min', DATE_FORMAT(MIN(r.ts),'%Y-%m-%dT%H:%i:%sZ'),\n        'max', DATE_FORMAT(MAX(r.ts),'%Y-%m-%dT%H:%i:%sZ')\n      ),\n      'statusTs', json_object(\n        'min', DATE_FORMAT(MIN(r.statusTs),'%Y-%m-%dT%H:%i:%sZ'),\n        'max', DATE_FORMAT(MAX(r.statusTs),'%Y-%m-%dT%H:%i:%sZ')\n      ),\n      'touchTs', json_object(\n        'min', DATE_FORMAT(MIN(r.touchTs),'%Y-%m-%dT%H:%i:%sZ'),\n        'max', DATE_FORMAT(MAX(r.touchTs),'%Y-%m-%dT%H:%i:%sZ')\n      )\n    ) as timestamps`\n  ]\n\n  const joins = [\n    'enabled_asset a',\n    'left join stig_asset_map sa using (assetId)',\n    'left join current_rev rev using (benchmarkId)',\n    'left join rev_group_rule_map rgr using (revId)',\n    'left join rule_version_check_digest rvcd using (ruleId)',\n    'left join review r on (rvcd.version=r.version and rvcd.checkDigest=r.checkDigest and sa.assetId=r.assetId)'\n  ]\n\n  const predicates = {\n    statements: [\n      'a.collectionId = ?',\n      'rev.benchmarkId = ?',\n    ],\n    binds: [\n      collectionId,\n      benchmarkId\n    ]\n  }\n\n  // Non-current revision\n  if (revisionStr !== 'latest') {\n    joins.splice(2, 1, 'left join revision rev on sa.benchmarkId=rev.benchmarkId')\n    const {version, release} = dbUtils.parseRevisionStr(revisionStr)\n    predicates.statements.push('rev.version = ?', 'rev.release = ?')\n    predicates.binds.push(version, release)\n  }\n\n  // Access control\n  const grant = userObject.grants[collectionId]\n  if (grant.roleId === 1) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: grant.grantIds}))\n    joins.push('inner join cteAclEffective cae on sa.saId = cae.saId')\n  }\n\n  const sql = dbUtils.makeQueryString({\n    ctes,\n    columns,\n    joins,\n    predicates,\n    groupBy,\n    orderBy,\n    format: true\n  })\n\n  // Send query\n  const [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\n\n/**\n * Return a Collection\n *\n * collectionId Integer A path parameter that identifies a Collection\n * returns CollectionInfo\n **/\nexports.getCollection = async function(collectionId, projections, elevate, userObject) {\n  return _this.queryCollection({\n    collectionId,\n    projections,\n    elevate,\n    grants: userObject.grants\n  })\n}\n\n\nexports.getFindingsByCollection = async function( {collectionId, aggregator, benchmarkId, assetId, acceptedOnly, projections = [], grant} ) {\n  let columns, groupBy, orderBy\n  switch (aggregator) {\n    case 'ruleId':\n      columns = [\n        'rgr.ruleId',\n        'rgr.title',\n        'rgr.severity',\n        'count(distinct a.assetId) as assetCount'\n      ]\n      groupBy = [\n        'rgr.rgrId'\n      ]\n      orderBy = ['rgr.ruleId']\n      break\n    case 'groupId':\n      columns = [\n        'rgr.groupId',\n        'rgr.groupTitle as title',\n        'rgr.severity',\n        'count(distinct a.assetId) as assetCount'\n      ]\n      groupBy = [\n        'rgr.rgrId'\n      ]\n      orderBy = ['substring(rgr.groupId from 3) + 0']\n      break\n    case 'cci':\n      columns = [\n        'cci.cci',\n        'cci.definition',\n        'cci.apAcronym',\n        'count(distinct a.assetId) as assetCount'\n      ]\n      groupBy = [\n        'cci.cci'\n      ]\n      orderBy = ['cci.cci']\n      break\n  }\n  const ctes = []\n  const joins = [\n    'enabled_collection c',\n    'inner join enabled_asset a on (c.collectionId = a.collectionId)',\n    'inner join stig_asset_map sa on a.assetId = sa.assetId',\n    'left join default_rev dr on (sa.benchmarkId = dr.benchmarkId and c.collectionId = dr.collectionId)',\n    'left join rev_group_rule_map rgr on dr.revId = rgr.revId',\n    'left join rev_group_rule_cci_map rgrcc using (rgrId)',\n    'left join rule_version_check_digest rvcd on rgr.ruleId = rvcd.ruleId',\n    'inner join review rv on (rvcd.version = rv.version and rvcd.checkDigest = rv.checkDigest and a.assetId = rv.assetId and rv.resultId = 4)',\n    'inner join cci on rgrcc.cci = cci.cci',\n    'inner join cci_reference_map crm on cci.cci = crm.cci'\n  ]\n  if (grant.roleId === 1) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: grant.grantIds}))\n    joins.push('inner join cteAclEffective cae on sa.saId = cae.saId')\n  }\n\n  // Not exposed in API, used internally\n  if (projections.includes('rulesWithDiscussion')) {\n    columns.push(`cast(concat('[', group_concat(distinct json_object (\n      'ruleId', rgr.ruleId,\n      'title', rgr.title,\n      'severity', rgr.severity,\n      'vulnDiscussion', rgr.vulnDiscussion) order by rgr.ruleId), ']') as json) as \"rules\"`)\n  }\n  if (projections.includes('rules')) {\n    columns.push(`cast(concat('[', group_concat(distinct json_object (\n      'ruleId', rgr.ruleId,\n      'title', rgr.title,\n      'version', rgr.version,\n      'severity', rgr.severity) order by rgr.ruleId), ']') as json) as \"rules\"`)\n  }\n  if (projections.includes('groups')) {\n    columns.push(`cast(concat('[', group_concat(distinct json_object (\n      'groupId', rgr.groupId,\n      'title', rgr.groupTitle,\n      'severity', rgr.groupSeverity) order by rgr.groupId), ']') as json) as \"groups\"`)\n  }\n  if (projections.includes('assets')) {\n    columns.push(`cast(concat('[', group_concat(distinct json_object (\n      'assetId', CAST(a.assetId as char),\n      'name', a.name) order by a.name), ']') as json) as \"assets\"`)\n  }\n  if (projections.includes('stigs')) {\n    joins.push('left join revision on dr.revId = revision.revId')\n    columns.push(`cast(\n      concat('[', \n        coalesce (\n          group_concat(distinct \n            case when revision.benchmarkId is not null then \n              json_object(\n                'benchmarkId', revision.benchmarkId, \n                'revisionStr', revision.revisionStr, \n                'benchmarkDate', date_format(revision.benchmarkDateSql,'%Y-%m-%d'),\n                'revisionPinned', CASE WHEN dr.revisionPinned = 1 THEN CAST(true as json) ELSE CAST(false as json) END, \n                'ruleCount', revision.ruleCount)\n            else null end \n          order by revision.benchmarkId),\n          ''),\n      ']')\n    as json) as \"stigs\"`)\n\n    // columns.push(`cast( concat( '[', group_concat(distinct concat('\"',dr.benchmarkId,'\"')), ']' ) as json ) as \"stigs\"`)\n  }\n  if (projections.includes('ccis')) {\n    columns.push(`cast(concat('[',\n    coalesce(\n      group_concat(distinct\n      case when cci.cci is not null\n      then json_object(\n        'cci', cci.cci,\n        'definition', cci.definition,\n        'apAcronym', cci.apAcronym,\n        'control', crm.parentControl)\n      else null end order by cci.cci),\n      ''),\n    ']') as json) as \"ccis\"`)\n  }\n\n  const predicates = {\n    statements: [\n      'c.collectionId = ?'\n    ],\n    binds: [collectionId]\n  }\n  if (assetId) {\n    predicates.statements.push('a.assetId = ?')\n    predicates.binds.push( assetId )\n  }\n  if (acceptedOnly) {\n    predicates.statements.push('rv.statusId = ?')\n    predicates.binds.push( 3 )\n  }\n  if (benchmarkId) {\n    predicates.statements.push('dr.benchmarkId = ?')\n    predicates.binds.push( benchmarkId )\n  }\n  \n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, groupBy, orderBy, format: true})\n  const [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\nexports.getReviewAclByCollectionUser = async function (collectionId, userId, elevate, userObject) {\n  let rows = await _this.queryReviewAcl({collectionId, userId})\n  return (rows)\n}\nexports.getReviewAclByCollectionUserGroup = async function (collectionId, userGroupId, elevate, userObject) {\n  let rows = await _this.queryReviewAcl({collectionId, userGroupId})\n  return (rows)\n}\n\n\nexports.getStigsByCollection = async function({collectionId, labelIds, labelNames, labelMatch, grant, benchmarkId, projections}) {\n  const ctes = []\n  \n  const columns = [\n    'sa.benchmarkId',\n    'stig.title',\n    'revision.revisionStr',\n    `date_format(revision.benchmarkDateSql,'%Y-%m-%d') as benchmarkDate`,\n    'CASE WHEN dr.revisionPinned = 1 THEN CAST(true as json) ELSE CAST(false as json) END as revisionPinned',\n    'revision.ruleCount',\n    'count(sa.assetId) as assetCount'\n  ]\n\n  const groupBy = ['sa.benchmarkId', 'revision.revId', 'dr.revisionPinned', 'stig.benchmarkId']\n  const orderBy = ['sa.benchmarkId']\n\n  const joins = [\n    'enabled_collection c',\n    'left join enabled_asset a on c.collectionId = a.collectionId',\n    'inner join stig_asset_map sa on a.assetId = sa.assetId',\n    'left join default_rev dr on (sa.benchmarkId = dr.benchmarkId and c.collectionId = dr.collectionId)',\n    'left join revision on dr.revId = revision.revId',\n    'left join stig on revision.benchmarkId = stig.benchmarkId'\n  ]\n\n  // PREDICATES\n  const predicates = {\n    statements: [\n      'c.collectionId = ?'\n    ],\n    binds: [collectionId]\n  }\n  if (labelIds || labelNames || labelMatch) {\n    joins.push(\n      'left join collection_label_asset_map cla2 on a.assetId = cla2.assetId',\n      'left join collection_label cl2 on cla2.clId = cl2.clId'\n    )\n    const labelPredicates = []\n    if (labelIds) {\n      labelPredicates.push('cl2.uuid IN ?')\n      const uuidBinds = labelIds.map( uuid => dbUtils.uuidToSqlString(uuid))\n      predicates.binds.push([uuidBinds])\n    }\n    if (labelNames) {\n      labelPredicates.push('cl2.name IN ?')\n      predicates.binds.push([labelNames])\n    }\n    if (labelMatch === 'null') {\n      labelPredicates.push('cl2.uuid IS NULL')\n    }\n    const labelPredicatesClause = `(${labelPredicates.join(' OR ')})`\n    predicates.statements.push(labelPredicatesClause)\n  }\n  if (benchmarkId) {\n    predicates.statements.push('sa.benchmarkId = ?')\n    predicates.binds.push( benchmarkId )\n  }\n  if (projections?.includes('assets')) {\n    columns.push(`cast(concat('[', group_concat(distinct json_object (\n      'assetId', CAST(a.assetId as char),\n      'name', a.name) order by a.name), ']') as json) as \"assets\"`)\n  }\n\n  if (grant.roleId === 1) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: grant.grantIds}))\n    joins.push('inner join cteAclEffective cae on sa.saId = cae.saId')\n  }\n\n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, groupBy, orderBy, format: true})\n  const [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\n/**\n * Replace all properties of a Collection\n *\n * body CollectionAssign  (optional)\n * collectionId Integer A path parameter that identifies a Collection\n * returns CollectionInfo\n **/\nexports.replaceCollection = async function( collectionId, body, projection, userObject, svcStatus = {}) {\n  let row = await _this.addOrUpdateCollection(dbUtils.WRITE_ACTION.REPLACE, collectionId, body, projection, userObject, svcStatus)\n  return (row)\n}\n\n/**\n * Merge updates to a Collection\n *\n * body CollectionAssign  (optional)\n * collectionId Integer A path parameter that identifies a Collection\n * returns CollectionInfo\n **/\nexports.updateCollection = async function( collectionId, body, projection, userObject, svcStatus = {}) {\n  let row = await _this.addOrUpdateCollection(dbUtils.WRITE_ACTION.UPDATE, collectionId, body, projection, userObject, svcStatus)\n  return (row)\n}\n\n\nexports.getCollectionMetadataKeys = async function ( collectionId ) {\n  const binds = []\n  let sql = `\n    select\n      JSON_KEYS(metadata) as keyArray\n    from \n      enabled_collection\n    where \n      collectionId = ?`\n  binds.push(collectionId)\n  let [rows] = await dbUtils.pool.query(sql, binds)\n  return rows.length > 0 ? rows[0].keyArray : []\n}\n\nexports.getCollectionMetadata = async function ( collectionId ) {\n  const binds = []\n  let sql = `\n    select\n      metadata \n    from \n      enabled_collection\n    where \n      collectionId = ?`\n  binds.push(collectionId)\n  let [rows] = await dbUtils.pool.query(sql, binds)\n  return rows.length > 0 ? rows[0].metadata : {}\n}\n\nexports.patchCollectionMetadata = async function ( collectionId, metadata ) {\n  const binds = []\n  let sql = `\n    update\n      collection \n    set \n      metadata = JSON_MERGE_PATCH(metadata, ?)\n    where \n      collectionId = ?`\n  binds.push(JSON.stringify(metadata), collectionId)\n  await dbUtils.pool.query(sql, binds)\n  return true\n}\n\nexports.putCollectionMetadata = async function ( collectionId, metadata ) {\n  const binds = []\n  let sql = `\n    update\n      collection\n    set \n      metadata = ?\n    where \n      collectionId = ?`\n  binds.push(JSON.stringify(metadata), collectionId)\n  await dbUtils.pool.query(sql, binds)\n  return true\n}\n\nexports.getCollectionMetadataValue = async function ( collectionId, key ) {\n  const binds = []\n  let sql = `\n    select\n      JSON_EXTRACT(metadata, ?) as value\n    from \n      enabled_collection\n    where \n      collectionId = ?`\n  binds.push(`$.\"${key}\"`, collectionId)\n  let [rows] = await dbUtils.pool.query(sql, binds)\n  return rows.length > 0 ? rows[0].value : \"\"\n}\n\nexports.putCollectionMetadataValue = async function ( collectionId, key, value ) {\n  const binds = []\n  let sql = `\n    update\n      collection\n    set \n      metadata = JSON_SET(metadata, ?, ?)\n    where \n      collectionId = ?`\n  binds.push(`$.\"${key}\"`, value, collectionId)\n  let [rows] = await dbUtils.pool.query(sql, binds)\n  return rows.length > 0 ? rows[0].value : \"\"\n}\n\nexports.deleteCollectionMetadataKey = async function ( collectionId, key ) {\n  const binds = []\n  let sql = `\n    update\n      collection\n    set \n      metadata = JSON_REMOVE(metadata, ?)\n    where \n      collectionId = ?`\n  binds.push(`$.\"${key}\"`, collectionId)\n  let [rows] = await dbUtils.pool.query(sql, binds)\n  return rows.length > 0 ? rows[0].value : \"\"\n}\n\n/*\nAvailable only to level 3 or 4 users (\"Manage\" or \"Owner\")\nReturns number of history entries deleted.\nRetentionDate - Delete all review history entries prior to the specified date.\nAsset Id - if provided, only delete entries for that asset.\n*/\nexports.deleteReviewHistoryByCollection = async function (collectionId, retentionDate, assetId) {\n  let sql = `\n    DELETE rh \n    FROM review_history rh \n      INNER JOIN review r on rh.reviewId = r.reviewId\n      INNER JOIN enabled_asset a on r.assetId = a.assetId\n    WHERE a.collectionId = :collectionId\n      AND rh.touchTs < :retentionDate`\n\n  if(assetId) {\n    sql += ' AND a.assetId = :assetId'\n  }\n\n  let binds = {\n    collectionId: collectionId,\n    retentionDate: retentionDate,\n    assetId: assetId\n  }  \n\n  let [rows] = await dbUtils.pool.query(sql, binds)\n  let result = {\n    HistoryEntriesDeleted: rows.affectedRows\n  }\n  return (result)\n}\n\n/*\nGET /collections/{collectionId}/review-history\nAvailable to level 2 and higher users with a grant to the collection.\nReturns block of review history entries that fit criteria. Takes optional:\nStart Date\nEnd Date\n(If no dates provided, return all history. If only one date, return block from that date to current, or that date to oldest, as appropriate)\nAsset ID - only return history for this asset id\nRule ID - only return history for this rule id\nstatus- only return history with this status\nIf rule and asset id provided, return that intersection.\n*/\nexports.getReviewHistoryByCollection = async function (collectionId, startDate, endDate, assetId, ruleId, status) {\n\n  const columns = [\n    `CAST(innerQuery.assetId as char) as assetId,\n      json_arrayagg(\n        json_object(\n          'ruleId', innerQuery.ruleId,\n          'history', innerQuery.history\n        )\n      ) as reviewHistories\n    from\n      (select \n        a.assetId, \n        rv.ruleId, \n        json_arrayagg(\n          json_object(\n            'ts', DATE_FORMAT(rh.ts, '%Y-%m-%dT%TZ'),\n            'ruleId', rh.ruleId,\n            'result', result.api,\n            'detail', COALESCE(LEFT(rh.detail,32767), ''),\n            'comment', COALESCE(LEFT(rh.comment,32767), ''),\n            'autoResult', rh.autoResult = 1,\n            'status', JSON_OBJECT(\n              'label', status.api,\n              'text', rh.statusText,\n              'user', JSON_OBJECT(\n                'userId', CAST(rh.statusUserId as char),\n                'username', udStatus.username\n              ),\n              'ts', DATE_FORMAT(rh.statusTs, '%Y-%m-%dT%TZ')\n            ),        \n            'userId', CAST(rh.userId as char),\n            'username', ud.username,\n            'touchTs', DATE_FORMAT(rh.touchTs, '%Y-%m-%dT%TZ')\n    \n            )\n        ) as history`\n  ]\n\n  const joins = [\n    'review_history rh',\n\t\t'INNER JOIN review rv on rh.reviewId = rv.reviewId',\n\t\t'INNER JOIN user_data ud on rh.userId = ud.userId',\n    'left join user_data udStatus on udStatus.userId=rh.statusUserId',\n\t\t'INNER JOIN result on rh.resultId = result.resultId',\n\t\t'INNER JOIN status on rh.statusId = status.statusId',\n\t\t'inner join enabled_asset a on a.assetId = rv.assetId'\n  ]\n\n  let predicates = {\n    statements: ['rv.assetId = a.assetId',\n\t\t'a.collectionId = ?'],\n    binds: [collectionId] \n  }\n  let groupBy = []\n\n  if (startDate) {\n   predicates.binds.push(startDate)\n   predicates.statements.push('rh.touchTs >= ?')\n  }\n\n  if (endDate) {\n    predicates.binds.push(endDate)\n    predicates.statements.push('rh.touchTs <= ?')\n  }\n\n  if(ruleId) {\n    predicates.binds.push(ruleId)\n    predicates.statements.push('rv.ruleId = ?')\n  }\n\n  if(status) {\n    predicates. binds.push(dbUtils.REVIEW_STATUS_API[status])\n    predicates.statements.push('rh.statusId = ?')\n  }\n\n  if(assetId) {\n    predicates.binds.push(assetId)\n    predicates.statements.push('a.assetId = ?')\n  }\n  \n  groupBy.push('rv.ruleId', 'a.assetId ) innerQuery\\nGROUP BY\\n innerQuery.assetId')\n  let sql = dbUtils.makeQueryString({columns, joins, predicates,groupBy })\n  let [rows] = await dbUtils.pool.query(sql, predicates.binds)\n\n  return (rows)\n}\n\n/*\nGET /collections/{collectionId}/review-history/stats\nAvailable to level 2 and higher users with a grant to the collection.\nReturn some simple stats about the number/properties of history entries.\nUses same params as GET review-history, expecting stats to be scoped to whatever would be returned by that query.\nProjection: asset - Break out statistics by Asset in the specified collection\n*/\nexports.getReviewHistoryStatsByCollection = async function (collectionId, startDate, endDate, assetId, ruleId, status, projection) {\n\n  let binds = {\n    collectionId: collectionId\n  }\n\n  let sql = 'SELECT COUNT(*) as collectionHistoryEntryCount, MIN(rh.touchTs) as oldestHistoryEntryDate'\n  \n  // If there is a response and the request included the asset projection\n  if (projection?.includes('asset')) {\n    sql += `, coalesce(\n      (SELECT json_arrayagg(\n        json_object(\n          'assetId', CAST(assetId as char) ,\n          'historyEntryCount', historyEntryCount,\n          'oldestHistoryEntry', oldestHistoryEntry\n          )\n        )\n        FROM \n        (\n          SELECT a.assetId, COUNT(*) as historyEntryCount, MIN(rh.touchTs) as oldestHistoryEntry\n          FROM review_history rh\n            INNER JOIN review rv on rh.reviewId = rv.reviewId\n            INNER JOIN enabled_asset a on rv.assetId = a.assetId\n          WHERE a.collectionId = :collectionId\n          additionalPredicates\n          GROUP BY a.assetId\n        ) v\n      ), json_array()\n      ) as assetHistoryEntryCounts`\n  }\n\n  sql += `\n    FROM review_history rh\n      INNER JOIN review rv on rh.reviewId = rv.reviewId\n      INNER JOIN enabled_asset a on rv.assetId = a.assetId\n    WHERE a.collectionId = :collectionId\n    additionalPredicates\n  `\n\n  let additionalPredicates = \"\"\n\n  if (startDate) {\n    binds.startDate = startDate\n    additionalPredicates += \" AND rh.touchTs >= :startDate\"\n  }\n\n  if (endDate) {\n    binds.endDate = endDate\n    additionalPredicates += \" AND rh.touchTs <= :endDate\"\n  }\n\n  if(ruleId) {\n    binds.ruleId = ruleId\n    additionalPredicates += \" AND rv.ruleId = :ruleId\"\n  }\n\n  if(status) {\n    binds.statusId = dbUtils.REVIEW_STATUS_API[status]\n    additionalPredicates += ' AND rh.statusId = :statusId'\n  }\n  \n  if(assetId) {\n    binds.assetId = assetId\n    additionalPredicates += \" AND a.assetId = :assetId\"\n  }\n\n  sql = sql.replace(/additionalPredicates/g, additionalPredicates)\n\n  let [rows] = await dbUtils.pool.query(sql, binds)\n  return (rows[0])\n}\n\nexports.getCollectionSettings = async function ( collectionId ) {\n  let sql = `\n    select\n      JSON_MERGE_PATCH('${JSON.stringify(MyController.defaultSettings)}', settings) as settings\n    from \n      enabled_collection\n    where \n      collectionId = ?`\n  let [rows] = await dbUtils.pool.query(sql, [collectionId])\n  return rows.length > 0 ? rows[0].settings : undefined\n}\n\nexports.getCollectionLabels = async function (collectionId, grant) {\n  const ctes = []\n  const columns = [\n    'BIN_TO_UUID(cl.uuid,1) labelId',\n    'cl.name',\n    'cl.description',\n    'cl.color',\n    'count(distinct cla.claId) as uses'\n  ]\n  const joins = [\n    'collection_label cl', \n    'left join enabled_asset a on cl.collectionId = a.collectionId',\n    'left join stig_asset_map sa on a.assetId = sa.assetId',\n    'left join collection_label_asset_map cla on cla.clId = cl.clId and cla.assetId = a.assetId'\n  ]\n  // const groupBy = [\n  //   'cl.uuid',\n  //   'cl.name',\n  //   'cl.description',\n  //   'cl.color'\n  // ]\n  const groupBy = ['cl.clId']\n  const predicates = {\n    statements: ['cl.collectionId = ?'],\n    binds: [collectionId]\n  }\n  const orderBy = [\n    'cl.name'\n  ]\n  if (grant.roleId === 1) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: grant.grantIds}))\n    joins.push('inner join cteAclEffective cae on sa.saId = cae.saId')\n  }\n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, groupBy, orderBy, format: true})\n  const [rows] = await dbUtils.pool.query(sql)\n  return rows\n}\n\nexports.createCollectionLabel = async function (collectionId, label) {\n  let [resultInsert] = await dbUtils.pool.query(\n    `INSERT INTO collection_label \n    (collectionId, name, description, color, uuid)\n    VALUES (?, ?, ?, ?, UUID_TO_BIN(UUID(),1))`,\n  [collectionId, label.name, label.description, label.color])\n\n  const [resultGet] = await dbUtils.pool.query(\n    `SELECT BIN_TO_UUID(uuid,1) as uuid from collection_label where clId = ?`,\n    [resultInsert.insertId]\n  )\n  return resultGet[0].uuid\n}\n\nexports.createCollectionLabels = async function (collectionId, labels) {\n  const placeholders = labels.map(() => '(?, ?, ?, ?, UUID_TO_BIN(UUID(),1))').join(', ')\n  const values = []\n\n  for (const label of labels) {\n    values.push(collectionId, label.name, label.description, label.color)\n  }\n\n  const insertSql = `\n    INSERT INTO collection_label (collectionId, name, description, color, uuid)\n    VALUES ${placeholders}\n  `\n  await dbUtils.pool.query(insertSql, values)\n\n  return labels.map(label => label.name)\n}\n\nexports.getCollectionLabelsByName = async function (collectionId, labelNames, grant) {\n\n  const ctes = []\n  const columns = [\n    'BIN_TO_UUID(cl.uuid,1) labelId',\n    'cl.name',\n    'cl.description',\n    'cl.color',\n    'count(distinct cla.claId) as uses'\n  ]\n  const joins = [\n    'collection_label cl', \n    'left join enabled_asset a on cl.collectionId = a.collectionId',\n    'left join stig_asset_map sa on a.assetId = sa.assetId',\n    'left join collection_label_asset_map cla on cla.clId = cl.clId and cla.assetId = a.assetId'\n  ]\n \n  const namePlaceholders = labelNames.map(() => '?').join(', ')\n  const predicates = {\n    statements: [\n      'cl.collectionId = ?',\n      `cl.name IN (${namePlaceholders})`\n    ],\n    binds: [collectionId, ...labelNames]\n  }\n\n  const groupBy = ['cl.clId']\n  const orderBy = []\n  if (grant.roleId === 1) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: grant.grantIds}))\n    joins.push('inner join cteAclEffective cae on sa.saId = cae.saId')\n  }\n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, groupBy, orderBy, format: true})\n  const [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\nexports.getCollectionLabelById = async function (collectionId, labelId, grant) {\n  const ctes = []\n  const columns = [\n    'BIN_TO_UUID(cl.uuid,1) labelId',\n    'cl.name',\n    'cl.description',\n    'cl.color',\n    'count(distinct cla.claId) as uses'\n  ]\n  const joins = [\n    'collection_label cl', \n    'left join enabled_asset a on cl.collectionId = a.collectionId',\n    'left join stig_asset_map sa on a.assetId = sa.assetId',\n    'left join collection_label_asset_map cla on cla.clId = cl.clId and cla.assetId = a.assetId'\n  ]\n  const predicates = {\n    statements: [\n      'cl.collectionId = ?',\n      'cl.uuid = UUID_TO_BIN(?,1)'\n    ],\n    binds: [collectionId, labelId]\n  }\n  const groupBy = ['cl.clId']\n  const orderBy = []\n  if (grant.roleId === 1) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: grant.grantIds}))\n    joins.push('inner join cteAclEffective cae on sa.saId = cae.saId')\n  }\n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, groupBy, orderBy, format: true})\n  const [rows] = await dbUtils.pool.query(sql)\n  return (rows[0])\n}\n\nexports.patchCollectionLabelById = async function (collectionId, labelId, label) {\n  const [rows] = await dbUtils.pool.query(\n    `UPDATE\n      collection_label\n    SET\n      ?\n    WHERE\n      collectionId = ?\n      and uuid = UUID_TO_BIN(?,1)`,\n    [label, collectionId, labelId])\n  return rows.affectedRows\n}\n\nexports.deleteCollectionLabelById = async function (collectionId, labelId) {\n  const [rows] = await dbUtils.pool.query(\n    `DELETE FROM\n      collection_label\n    WHERE\n      collectionId = ?\n      and uuid = UUID_TO_BIN(?,1)`,\n    [collectionId, labelId])\n  return rows.affectedRows\n}\n\nexports.getAssetsByCollectionLabelId = async function (collectionId, labelId, grant) {\n  const ctes = []\n  const columns = [\n    'CAST(a.assetId as char) as assetId',\n    'a.name'\n  ]\n  const joins = [\n    'collection_label cl',\n    'left join collection_label_asset_map cla on cla.clId = cl.clId',\n    'inner join enabled_asset a on cla.assetId = a.assetId',\n  ]\n  const predicates = {\n    statements: [\n      'cl.collectionId = ?',\n      'cl.uuid = UUID_TO_BIN(?,1)'\n    ],\n    binds: [collectionId, labelId]\n  }\n  const groupBy = []\n  const orderBy = ['a.name']\n  if (grant.roleId === 1) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: grant.grantIds}))\n    joins.push(\n      'left join stig_asset_map sa on a.assetId = sa.assetId',\n      'inner join cteAclEffective cae on sa.saId = cae.saId'\n    )\n    groupBy.push('a.assetId')\n  }\n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, groupBy, orderBy, format: true})\n  const [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\nexports.putAssetsByCollectionLabelId = async function (collectionId, labelId, assetIds, svcStatus = {}) {\n  let connection\n  try {\n    connection = await dbUtils.pool.getConnection()\n    async function transaction() {\n      await connection.query('START TRANSACTION')\n\n      const sqlGetClId = `select clId from collection_label where uuid = UUID_TO_BIN(?,1)`\n      const [clIdRows] = await connection.query( sqlGetClId, [ labelId ] )\n      const clId = clIdRows[0].clId\n  \n      let sqlDelete = `\n      DELETE FROM \n        collection_label_asset_map\n      WHERE \n        clId = ?`\n      if (assetIds.length > 0) {\n        sqlDelete += ' and assetId NOT IN ?'\n      }  \n      await connection.query( sqlDelete, [ clId, [assetIds] ] )\n      // Push any bind values\n      const binds = []\n      for (const assetId of assetIds) {\n        binds.push([clId, assetId])\n      }\n      if (binds.length > 0) {\n        let sqlInsert = `\n        INSERT IGNORE INTO \n          collection_label_asset_map (clId, assetId)\n        VALUES\n          ?`\n        await connection.query(sqlInsert, [ binds ])\n      }\n      // Commit the changes\n      await connection.commit()\n    }\n    await dbUtils.retryOnDeadlock(transaction, svcStatus)\n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }\n    throw err\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\nexports.getUnreviewedAssetsByCollection = async function (params) {\n  return queryUnreviewedByCollection({ grouping: 'asset', ...params})\n}\n\nexports.getUnreviewedRulesByCollection = async function (params) {\n  return queryUnreviewedByCollection({ grouping: 'rule', ...params})\n}\n\nasync function queryUnreviewedByCollection ({\n  grouping,\n  collectionId,\n  benchmarkId,\n  assetId,\n  ruleId,\n  severities,\n  labelIds,\n  labelNames,\n  projections,\n  grant,\n  userObject\n}) {\n  let columns, groupBy, orderBy\n  let projectionMap = []\n  switch (grouping) {\n    case 'asset':\n      columns = [\n        'CAST(a.assetId as char) as assetId',\n        'a.name',\n        `coalesce(\n          (select\n            json_arrayagg(json_object(\n              'labelId', BIN_TO_UUID(cl2.uuid,1),\n              'name', cl2.name\n              ))\n          from\n            collection_label_asset_map cla2\n            left join collection_label cl2 on cla2.clId = cl2.clId\n          where\n            cla2.assetId = a.assetId),\n          json_array()) as labels`,\n        `json_arrayagg(json_object(\n          'result', result.api,\n          'ruleId', rgr.ruleId,\n          'groupId', rgr.groupId,\n          ${projections.includes('ruleTitle') ? \"'ruleTitle', rgr.title,\" : ''}\n          ${projections.includes('groupTitle') ? \"'groupTitle', rgr.title,\" : ''}\n          'severity', rgr.severity,\n          'benchmarkId', cr.benchmarkId\n        )) as unreviewed`       \n      ]\n      groupBy = [\n        'a.assetId',\n        'a.name'\n      ]\n      orderBy = [\n        'a.name'\n      ]\n      break\n    case 'rule':\n      projectionMap = projections.map( p => `${p === 'groupTitle' ? 'rgr.groupTitle' : 'rgr.title'}`)\n      columns = [\n        'rgr.ruleId',\n        'rgr.groupId',\n        'cr.benchmarkId',\n        'rgr.severity',\n        ...projectionMap,\n        `json_arrayagg(json_object(\n          'result', result.api,\n          'assetId', CAST(a.assetId as char),\n          'name', a.name,\n          'labels', coalesce(\n            (select\n              json_arrayagg(json_object(\n                'labelId', BIN_TO_UUID(cl2.uuid,1),\n                'name', cl2.name\n                ))\n            from\n              collection_label_asset_map cla2\n              left join collection_label cl2 on cla2.clId = cl2.clId\n            where\n              cla2.assetId = a.assetId),\n            json_array())\n        )) as unreviewed`\n      ]\n      groupBy = [\n        'rgr.ruleId',\n        'rgr.groupId',\n        'cr.benchmarkId',\n        'rgr.severity',\n        ...projectionMap\n      ]\n      orderBy = [\n        'rgr.ruleId'\n      ]\n  }\n  const ctes = []\n  const joins = [\n    'enabled_asset a',\n    'left join collection_label_asset_map cla on cla.assetId = a.assetId',\n    'left join collection_label cl on cla.clId = cl.clId',\n    'left join stig_asset_map sa on a.assetId = sa.assetId',\n    'left join current_rev cr on sa.benchmarkId = cr.benchmarkId',\n\t  'left join rev_group_rule_map rgr on cr.revId = rgr.revId',\n    'left join rule_version_check_digest rvcd on rgr.ruleId = rvcd.ruleId',\n\t  'left join review r on (a.assetId = r.assetId and rvcd.version = r.version and rvcd.checkDigest = r.checkDigest)',\n    'left join result on r.resultId = result.resultId'\n  ]\n  const predicates = {\n    statements: [\n      'a.collectionId = ?',\n      // '(cg.userId = ? AND CASE WHEN cg.roleId = 1 THEN usa.userId = cg.userId ELSE TRUE END)',\n      '(r.reviewId is null or r.resultId not in (2,3,4))',\n    ],\n    binds: [collectionId, userObject.userId]\n  }\n  if (assetId) {\n    predicates.statements.push('a.assetId = ?')\n    predicates.binds.push(assetId)\n  }\n  if (labelIds?.length) {\n    predicates.statements.push('cl.uuid IN ?')\n    const uuidBinds = labelIds.map( uuid => dbUtils.uuidToSqlString(uuid))\n    predicates.binds.push([uuidBinds])\n  }\n  if (labelNames?.length) {\n    predicates.statements.push('cl.name IN ?')\n    predicates.binds.push([labelNames])\n  }\n  if (benchmarkId) {\n    predicates.statements.push('cr.benchmarkId = ?')\n    predicates.binds.push(benchmarkId)\n  }\n  if (ruleId) {\n    predicates.statements.push('rgr.ruleId = ?')\n    predicates.binds.push(ruleId)\n  }\n  if (severities?.length) {\n    predicates.statements.push('rgr.severity IN ?')\n    predicates.binds.push([severities])\n  }\n  if (grant.roleId === 1) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: grant.grantIds}))\n    joins.push('inner join cteAclEffective cae on sa.saId = cae.saId')\n  }\n\n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, groupBy, orderBy, format: true})\n  let [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\nexports.writeStigPropsByCollectionStig = async function ({collectionId, benchmarkId, defaultRevisionStr, assetIds, svcStatus = {}}) {\n  let connection\n  try {\n    let version, release\n    if (defaultRevisionStr) {\n      if (defaultRevisionStr !== 'latest') {\n        ;({version, release} = dbUtils.parseRevisionStr(defaultRevisionStr))\n      }\n    }\n    connection = await dbUtils.pool.getConnection()\n    await dbUtils.retryOnDeadlock(transaction, svcStatus)\n  \n    async function transaction () {\n      await connection.query('START TRANSACTION')\n      if (defaultRevisionStr === 'latest' || assetIds?.length === 0) {\n        await connection.query('DELETE FROM collection_rev_map WHERE collectionId = ? and benchmarkId = ?', [collectionId, benchmarkId])\n      }\n      else if (defaultRevisionStr && defaultRevisionStr !== 'latest') {\n        const [revisions] = await connection.query('SELECT revId FROM revision WHERE benchmarkId = ? and `version` = ? and `release` = ?', [benchmarkId, version, release])\n        if (revisions[0]?.revId) {\n          await connection.query(`INSERT INTO collection_rev_map (collectionId, benchmarkId, revId)\n          VALUES (?, ?, ?) AS new ON DUPLICATE KEY UPDATE revId = new.revId`, [collectionId, benchmarkId, revisions[0].revId])\n        }\n      }  \n      if (assetIds) {\n        let sqlDeleteStigAsset = `\n        DELETE stig_asset_map FROM \n          stig_asset_map\n          left join enabled_asset a on stig_asset_map.assetId = a.assetId\n        WHERE\n          a.collectionId = ?\n          and stig_asset_map.benchmarkId = ?${assetIds.length > 0 ? ' and stig_asset_map.assetId NOT IN ?': ''}`\n        \n        // DELETE from stig_asset_map, which will cascade into user_stig_aset_map\n        await connection.query( sqlDeleteStigAsset, [ collectionId, benchmarkId, [assetIds] ] )\n        \n        if (assetIds.length) {\n          const binds = assetIds.map( assetId => [benchmarkId, assetId])\n          // INSERT into stig_asset_map\n          const sqlInsertBenchmarks = `INSERT IGNORE INTO stig_asset_map (benchmarkId, assetId) VALUES ?`\n          await connection.query(sqlInsertBenchmarks, [ binds ])\n        }\n      }\n      await dbUtils.updateDefaultRev(connection, {collectionId, benchmarkId})\n      await dbUtils.updateStatsAssetStig(connection, {collectionId, benchmarkId})\n      await connection.commit()\n    }  \n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }\n    throw ( err )\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\nexports.doesCollectionIncludeAssets = async function ({collectionId, assetIds}) {\n  try {\n    const sql = `select jt.assetId, a.collectionId\n    from \n    JSON_TABLE(\n      ?,\n      \"$[*]\"\n      COLUMNS(\n        assetId INT(11) PATH \"$\"\n      ) ) AS jt\n    left join enabled_asset a using (assetId)\n    where a.collectionId != ? or a.collectionId is null`\n\n    const [rows] = await dbUtils.pool.query(sql, [JSON.stringify(assetIds), collectionId])\n    return rows.length === 0\n  }\n  catch (e) {\n    return false\n  }\n}\n\nexports.doesCollectionIncludeStig = async function ({collectionId, benchmarkId}) {\n  try {\n    const [rows] = await dbUtils.pool.query(\n      `select distinct sam.benchmarkId from enabled_asset a inner join stig_asset_map sam using (assetId) where a.collectionId = ?`,\n      [collectionId]\n    )\n    return rows.some(i => i.benchmarkId === benchmarkId)\n  }\n  catch (e) {\n    return false\n  }\n}\n\nexports.cloneCollection = async function ({collectionId, userObject, name, description, options, svcStatus = {}, progressCb = () => {}}) {\n  let connection, progressJson\n  try {\n    const sql = {\n      cloneCollection: {\n        query: `INSERT INTO collection (name, description, settings, metadata, state) SELECT @name,@description,settings, metadata, \"cloning\" from enabled_collection WHERE collectionId = @srcCollectionId`,\n        startText: 'Creating core properties',\n        finishText: 'Creating core properties'\n      },\n      selectLastInsertId: {\n        query: 'SELECT last_insert_id() into @destCollectionId',\n        startText: 'Creating core properties',\n        finishText: 'Created core properties'\n      },\n      cloneGrants: {\n        query: `INSERT INTO collection_grant (collectionId, userId, userGroupId, roleId) SELECT @destCollectionId, userId, userGroupId, roleId FROM collection_grant where collectionId = @srcCollectionId`,\n        startText: 'Creating Grants',\n        finishText: 'Creating Grants'\n      },\n      dropGrantMap: {\n        query: `DROP TEMPORARY TABLE IF EXISTS t_grantid_map`,\n        startText: 'Creating Grants',\n        finishText: 'Creating Grants'\n      },\n      createGrantMap: {\n        query: `CREATE TEMPORARY TABLE t_grantid_map SELECT cg1.grantId as srcGrantId, cg2.grantId as destGrantId FROM collection_grant cg1 left join collection_grant cg2 on (cg1.collectionId = @srcCollectionId and (cg1.userId = cg2.userId or cg1.userGroupId = cg2.userGroupId) and cg1.roleId = cg2.roleId) WHERE cg2.collectionId = @destCollectionId`,\n        startText: 'Creating Grants',\n        finishText: 'Creating Grants'\n      },\n      insertOwnerGrant: {\n        query: `INSERT INTO collection_grant (collectionId, userId, roleId) VALUES (@destCollectionId, @userId, 4) ON DUPLICATE KEY UPDATE roleId = 4`,\n        startText: 'Creating Grants',\n        finishText: 'Created Grants'\n      },\n      cloneLabels: {\n        query: `INSERT INTO collection_label (collectionId, name, description, color, uuid) SELECT @destCollectionId,name,description,color,UUID_TO_BIN(UUID(),1) FROM collection_label where collectionId = @srcCollectionId`,\n        startText: 'Creating Labels',\n        finishText: 'Created Labels'\n      },\n      cloneAssets: {\n        query: `INSERT INTO asset (name, fqdn, collectionId, ip, mac, description, noncomputing, metadata) SELECT name,fqdn,@destCollectionId,ip,mac,description,noncomputing,metadata from enabled_asset where collectionId = @srcCollectionId`,\n        startText: 'Creating Assets',\n        finishText: 'Creating Assets'\n      },\n      dropAssetMap: {\n        query: `DROP TEMPORARY TABLE IF EXISTS t_assetid_map`,\n        startText: 'Creating Assets',\n        finishText: 'Creating Assets'\n      },\n      createAssetMap: {\n        query: `CREATE TEMPORARY TABLE t_assetid_map SELECT a1.assetId as srcAssetId, a2.assetId as destAssetId FROM enabled_asset a1 left join enabled_asset a2 on (a1.collectionId =  @srcCollectionId and a1.name = a2.name) WHERE a2.collectionId = @destCollectionId`,\n        startText: 'Creating Assets',\n        finishText: 'Created Assets'\n      },\n      dropLabelMap: {\n        query: `DROP TEMPORARY TABLE IF EXISTS t_clid_map`,\n        startText: 'Creating Asset/Label mappings',\n        finishText: 'Creating Asset/Label mappings'\n      },\n      createLabelMap: {\n        query: `CREATE TEMPORARY TABLE t_clid_map SELECT cl1.clId as srcClId, cl2.clId as destClId FROM collection_label cl1 left join collection_label cl2 on (cl1.collectionId = @srcCollectionId and cl1.name = cl2.name) WHERE cl2.collectionId = @destCollectionId`,\n        startText: 'Creating Asset/Label mappings',\n        finishText: 'Creating Asset/Label mappings'\n      },\n      cloneAssetLabels: {\n        query: `INSERT INTO collection_label_asset_map (assetId, clId) SELECT am.destAssetId,cm.destClId FROM collection_label_asset_map cla INNER JOIN t_clid_map cm on cla.clId = cm.srcClId INNER JOIN t_assetid_map am on cla.assetId = am.srcAssetId`,\n        startText: 'Creating Asset/Label mappings',\n        finishText: 'Created Asset/Label mappings'\n      },\n      cloneStigMappingsWithReviews: {\n        query: `INSERT INTO stig_asset_map (benchmarkId, assetId, minTs, maxTs, saved, savedResultEngine, submitted, submittedResultEngine, rejected, rejectedResultEngine, accepted, acceptedResultEngine, highCount, mediumCount, lowCount, notchecked, notcheckedResultEngine, notapplicable, notapplicableResultEngine, pass, passResultEngine, fail, failResultEngine, unknown, unknownResultEngine, error, errorResultEngine, notselected, notselectedResultEngine, informational, informationalResultEngine, fixed, fixedResultEngine, maxTouchTs, assessedHighCount, assessedMediumCount, assessedLowCount) SELECT benchmarkId, am.destAssetId, minTs, maxTs, saved, savedResultEngine, submitted, submittedResultEngine, rejected, rejectedResultEngine, accepted, acceptedResultEngine, highCount, mediumCount, lowCount, notchecked, notcheckedResultEngine, notapplicable, notapplicableResultEngine, pass, passResultEngine, fail, failResultEngine, unknown, unknownResultEngine, error, errorResultEngine, notselected, notselectedResultEngine, informational, informationalResultEngine, fixed, fixedResultEngine, maxTouchTs, assessedHighCount, assessedMediumCount, assessedLowCount FROM stig_asset_map sa INNER JOIN t_assetid_map am on sa.assetId = am.srcAssetId`,\n        startText: 'Creating Asset/STIG mappings with Metrics',\n        finishText: 'Created Asset/STIG mappings with Metrics'\n      },\n      cloneStigMappingsWithoutReviews: {\n        query: `INSERT INTO stig_asset_map (benchmarkId, assetId) SELECT benchmarkId, am.destAssetId FROM stig_asset_map sa INNER JOIN t_assetid_map am on sa.assetId = am.srcAssetId`,\n        startText: 'Creating Asset/STIG mappings',\n        finishText: 'Created Asset/STIG mappings'\n      },\n      cloneGrantAcls: {\n        query: `INSERT INTO collection_grant_acl (grantId, benchmarkId, assetId, clId, access)\n        SELECT\n          gm.destGrantId,\n          cg1.benchmarkId,\n          am.destAssetId,\n          cm.destClId,\n          cg1.access\n        FROM\n          collection_grant_acl cg1\n          inner join t_grantid_map gm on cg1.grantId = gm.srcGrantId\n          left join t_assetid_map am on cg1.assetId = am.srcAssetId \n          left join t_clid_map cm on cg1.clId = cm.srcClId`,\n          startText: 'Creating Collection Grant ACLs',\n          finishText: 'Created Collection Grant ACLs'\n      },\n      cloneRevisionsMatchSource: {\n        query: `INSERT INTO collection_rev_map (collectionId, benchmarkId, revId) SELECT @destCollectionId, benchmarkId, revId FROM collection_rev_map where collectionId = @srcCollectionId`,\n        startText: 'Creating Revision pins',\n        finishText: 'Creating Revision pins'\n      },\n      cloneRevisionsSourceDefaults: {\n        query: `INSERT INTO collection_rev_map (collectionId, benchmarkId, revId) SELECT @destCollectionId, benchmarkId, revId FROM default_rev where collectionId = @srcCollectionId`,\n        startText: 'Creating Revision pins',\n        finishText: 'Creating Revision pins'\n      },\n      insertDefaultRev: {\n        query: `INSERT INTO default_rev(collectionId, benchmarkId, revId, revisionPinned) SELECT collectionId, benchmarkId, revId, revisionPinned FROM v_default_rev WHERE collectionId = @destCollectionId`,\n        startText: 'Creating Revision pins',\n        finishText: 'Created Revision pins'\n      },\n\n      countReviewIds: {\n        query: `SELECT count(seq) as reviewCount from t_reviewId_list`,\n        startText: 'Creating Reviews',\n        finishText: 'Creating Reviews'\n      },\n      dropReviewIdList: {\n        query: `DROP TEMPORARY TABLE IF EXISTS t_reviewId_list`,\n        startText: 'Creating Reviews',\n        finishText: 'Creating Reviews'\n      },\n      createReviewIdList: {\n        query: `CREATE TEMPORARY TABLE t_reviewId_list (seq INT AUTO_INCREMENT PRIMARY KEY)\n      SELECT r.reviewId, am.destAssetId FROM enabled_asset a inner join t_assetid_map am on a.assetId = am.srcAssetId inner join review r on am.srcAssetId = r.assetId `,\n      startText: 'Creating Reviews',\n      finishText: 'Creating Reviews'\n      },\n      \n      cloneReviews: {\n        query: `INSERT INTO review (assetId, ruleId, resultId, detail, comment, autoResult, ts, userId, statusId, statusText, statusUserId, statusTs, metadata, resultEngine, version, checkDigest)\n        SELECT rl.destAssetId, r.ruleId, r.resultId, r.detail, r.comment, r.autoResult, r.ts, r.userId, r.statusId, r.statusText, r.statusUserId, r.statusTs, r.metadata, r.resultEngine, r.version, r.checkDigest\n        FROM\n        t_reviewId_list rl\n        left join review r using (reviewId)\n        WHERE\n        rl.seq >= ? and rl.seq <= ?`,\n        startText: 'Creating Reviews',\n        finishText: 'Created Reviews'\n      },\n\n      enableCollection: `UPDATE collection SET state = \"enabled\" WHERE collectionId = @destCollectionId`\n    }\n\n    connection = await dbUtils.pool.getConnection()\n    connection.config.namedPlaceholders = false\n    connection.query('set @srcCollectionId = ?, @userId = ?, @name = ?, @description = ?', [\n      parseInt(collectionId),\n      parseInt(userObject.userId),\n      name,\n      description\n    ])\n\n    const collectionQueries = ['cloneCollection', 'selectLastInsertId']\n    const reviewQueries = []\n\n    if (options.grants) {\n      collectionQueries.push('cloneGrants', 'dropGrantMap', 'createGrantMap')\n    }\n    collectionQueries.push('insertOwnerGrant')\n\n    if (options.labels) {\n      collectionQueries.push('cloneLabels')\n    }\n\n    if (options.assets) {\n      collectionQueries.push('cloneAssets', 'dropAssetMap', 'createAssetMap')\n      if (options.labels) {\n        collectionQueries.push('dropLabelMap', 'createLabelMap', 'cloneAssetLabels')\n      }\n      if (options.stigMappings !== 'none') {\n        collectionQueries.push(options.stigMappings === 'withReviews' ? 'cloneStigMappingsWithReviews' : 'cloneStigMappingsWithoutReviews')\n        if (options.grants) {\n          collectionQueries.push('cloneGrantAcls')\n          // collectionQueries.push('cloneRestrictedUserGroupGrants')\n        }\n        collectionQueries.push(options.pinRevisions === 'matchSource' ? 'cloneRevisionsMatchSource' : 'cloneRevisionsSourceDefaults')\n        collectionQueries.push('insertDefaultRev')\n      }\n      if (options.stigMappings === 'withReviews') {\n        reviewQueries.push('dropReviewIdList', 'createReviewIdList', 'cloneReviews')\n      }\n    }\n\n    async function transactionCollection () {\n      const stage = 'collection'\n      const stepCount = collectionQueries.length + 1\n      progressJson = {stage, stepCount, step: 0}\n\n      await connection.query('START TRANSACTION')\n\n      for (const query of collectionQueries) {\n        progressJson.step++\n        progressJson.stepName = query\n        progressJson.status = 'running'\n        progressJson.message = sql[query].startText\n        progressCb(progressJson) \n\n        await connection.query(sql[query].query)\n      }\n\n      progressJson.step++\n      progressJson.stepName = 'commit'\n      progressJson.status = 'running'\n      progressJson.message = 'Saving Collection'\n      progressCb(progressJson) \n\n      await connection.commit()\n\n      progressJson.status = 'finished'\n      progressJson.message = 'Saved Collection'\n      progressCb(progressJson) \n    }\n\n    async function transactionReviews () {\n      const stage = 'reviews'\n      const stepCount = reviewQueries.length + 1\n      progressJson = {stage, stepCount, step: 0}\n\n      await connection.query('START TRANSACTION')\n      for (const query of reviewQueries) {\n        progressJson.stepName = query\n        progressJson.step++\n        progressJson.message = sql[query].startText\n\n        if (query === 'cloneReviews') {\n          let offset = 1\n          const chunkSize = 10000\n\n          let [result] = await connection.query(sql.countReviewIds.query)\n\n          progressJson.status = 'running'\n          progressJson.reviewsTotal = result[0].reviewCount\n          progressJson.reviewsCopied = 0\n          progressCb(progressJson) \n\n          do {\n            [result] = await connection.query(sql[query].query, [offset, offset + chunkSize - 1])\n            if (result.affectedRows != 0) {\n              progressJson.reviewsCopied += result.affectedRows\n              progressCb(progressJson) \n            }\n            offset += chunkSize\n          } while (result.affectedRows != 0)\n        }\n        else {\n          progressJson.status = 'running'\n          progressCb(progressJson)\n          await connection.query(sql[query].query)\n        }\n      }\n      progressJson.step++\n      progressJson.stepName = 'commit'\n      progressJson.status = 'running'\n      progressCb(progressJson) \n\n      await connection.commit()\n\n      progressJson.status = 'finished'\n      progressCb(progressJson) \n    }\n\n    await dbUtils.retryOnDeadlock(transactionCollection, svcStatus)\n    await dbUtils.retryOnDeadlock(transactionReviews, svcStatus)\n    await connection.query(sql.enableCollection)\n    const [rows] = await connection.query(`SELECT @destCollectionId as destCollectionId`)\n    return rows[0]\n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }\n    progressJson.status = 'error'\n    if (err.message.match(/Duplicate entry .* for key 'collection.index[2|3]'/)) {\n      progressJson.message = 'The requested Collection name is unavailable'\n    }\n    else {\n      progressJson.message = 'Unhandled error'\n      progressJson.error = err\n      progressJson.stack = err?.stack\n    }\n    progressCb(progressJson)\n    return null\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\nexports.exportToCollection = async function ({srcCollectionId, dstCollectionId, assetStigArguments, userObject, svcStatus = {}, progressCb = () => {}}) {\n  let connection, progressJson\n  try {\n    const sql = {\n      dropArg: {\n        query: `drop temporary table if exists t_arg`,\n        runningText: 'Preparing data'\n      },\n      createArg: {\n        query: `create temporary table t_arg (\n          assetId INT,\n          assetName VARCHAR(255),\n          benchmarkId VARCHAR(255),\n          revisionStr VARCHAR(255),\n          UNIQUE INDEX (assetId, benchmarkId, revisionStr),\n          INDEX (assetName)\n        )\n        select * from\n        json_table(\n          @json, \n          \"$[*]\"\n          COLUMNS(\n          assetId INT path \"$.assetId\",\n            assetName VARCHAR(255) path \"$.assetName\",\n            nested path \"$.stigs[*]\" COLUMNS(\n              benchmarkId VARCHAR(255) path \"$.benchmarkId\",\n              revisionStr VARCHAR(255) path \"$.revisionStr\"\n            )\n          )\n        ) as arg`,\n        runningText: 'Preparing data'\n      },\n      dropCollectionSetting: {\n        query: `drop temporary table if exists t_collection_setting`,\n        runningText: 'Preparing data'\n      },\n      createCollectionSetting: {\n        query: `create temporary table t_collection_setting\n        SELECT \n          c.settings->>\"$.fields.detail.required\" as detailRequired,\n          c.settings->>\"$.fields.comment.required\" as commentRequired,\n          c.settings->>\"$.status.canAccept\" as canAccept,\n          c.settings->>\"$.status.resetCriteria\" as resetCriteria,\n          c.settings->>\"$.status.minAcceptGrant\" as minAcceptGrant,\n          c.settings->>\"$.history.maxReviews\" as historyMax\n        FROM\n          enabled_collection c\n        where\n          collectionId = @dstCollectionId`,\n          runningText: 'Preparing data'\n      },\n      dropSrcReviewId: {\n        query: `drop temporary table if exists t_src_reviewId`,\n        runningText: 'Preparing data'\n      },\n      createSrcReviewId: {\n        query: `create temporary table t_src_reviewId (seq INT AUTO_INCREMENT PRIMARY KEY, reviewId INT UNIQUE )\n        select\n          r.reviewId\n        from\n          t_arg\n          left join revision rev on (t_arg.benchmarkId collate utf8mb4_0900_as_cs = rev.benchmarkId and t_arg.revisionStr = rev.revisionStr)\n          left join rev_group_rule_map rgr on (rev.revId = rgr.revId)\n          left join rule_version_check_digest rvcd on rgr.ruleId = rvcd.ruleId\n          inner join review r on (rvcd.version = r.version and rvcd.checkDigest = r.checkDigest and t_arg.assetId = r.assetId)`,\n          runningText: 'Preparing data'\n      },\n      countSrcReviewId: {\n        query: `select count(*) as total from t_src_reviewId`,\n        runningText: 'Preparing data'\n      },\n      insertAsset: {\n        query: `INSERT into asset (name, fqdn, collectionId, ip, mac, description, noncomputing, metadata, state, stateDate, stateUserId)\n        SELECT\n          srcAsset.name,\n          srcAsset.fqdn,\n          @dstCollectionId,\n          srcAsset.ip,\n          srcAsset.mac,\n          srcAsset.description,\n          srcAsset.noncomputing,\n          srcAsset.metadata,\n          'enabled',\n          NOW(),\n          @userId\n        FROM\n          t_arg\n          left join enabled_asset srcAsset on t_arg.assetId = srcAsset.assetId\n          left join enabled_asset dstAsset on (t_arg.assetName = dstAsset.name and dstAsset.collectionId = @dstCollectionId)\n        WHERE\n          dstAsset.assetId is null\n        GROUP BY\n          t_arg.assetId`,\n        runningText: \"Preparing Assets\"\n      },\n      dropAssetIdMap: {\n        query: `drop temporary table if exists t_assetId_map`,\n        runningText: \"Preparing Assets\"\n      },\n      createAssetIdMap: {\n        query: `create temporary table t_assetId_map (\n          srcAssetId INT,\n          dstAssetId INT,\n          INDEX (srcAssetId),\n          INDEX (dstAssetId)\n        )\n        select\n          srcAsset.assetId as srcAssetId,\n          dstAsset.assetId as dstAssetId\n        from\n          t_arg\n          inner join enabled_asset srcAsset on (t_arg.assetId = srcAsset.assetId)\n          inner join enabled_asset dstAsset on (t_arg.assetName = dstAsset.name and dstAsset.collectionId = @dstCollectionId)\n        group by\n          srcAsset.assetId, dstAsset.assetId`,\n          runningText: \"Preparing Assets\"\n      },\n      insertStigAssetMap: {\n        query: `INSERT into stig_asset_map (assetId, benchmarkId)\n        select\n          a.assetId,\n          t_arg.benchmarkId\n        from\n          t_arg\n          left join enabled_asset a on (t_arg.assetName = a.name and a.collectionId = @dstCollectionId)\n          left join stig_asset_map sa on (t_arg.benchmarkId collate utf8mb4_0900_as_cs = sa.benchmarkId and a.assetId = sa.assetId)\n        where\n          sa.saId is null`,\n          runningText: \"Preparing Assets\"\n      },\n      selectStigAssetMap: {\n        query: `select\n          sa.saId\n        from\n          t_arg\n          left join enabled_asset a on (t_arg.assetName = a.name and a.collectionId = @dstCollectionId)\n          left join stig_asset_map sa on (t_arg.benchmarkId collate utf8mb4_0900_as_cs = sa.benchmarkId and a.assetId = sa.assetId)`\n      },\n      deleteDefaultRev: {\n        query: `DELETE FROM default_rev where collectionId = @dstCollectionId`,\n        runningText: \"Preparing Assets\"\n      },\n      insertDefaultRev: {\n        query: `INSERT INTO default_rev(collectionId, benchmarkId, revId, revisionPinned) SELECT collectionId, benchmarkId, revId, revisionPinned FROM v_default_rev where collectionId = @dstCollectionId`,\n        finishText: 'Created Asset/STIG maps',\n        runningText: \"Preparing Assets\"\n      },\n      dropIncomingReview: {\n        query: `drop temporary table if exists t_incoming_review`,\n        runningText: `Preparing reviews`,\n        finishText: `Preparing reviews`\n      },\n      createIncomingReview: {\n        query: `create temporary table t_incoming_review\n        select\n          dstReview.reviewId,\n          t_assetId_map.dstAssetId as assetId,\n          srcReview.version,\n          srcReview.checkDigest,\n          srcReview.ruleId,\n          srcReview.resultId,\n          srcReview.detail, \n          srcReview.comment, \n          srcReview.resultEngine, \n          srcReview.metadata,\n          UTC_TIMESTAMP() as ts,\n          @userId as userId,\n          CASE WHEN dstReview.reviewId is null or rStatusReset.reviewId is not null\n            THEN 0\n            ELSE dstReview.statusId\n          END as statusId,\t\n          CASE WHEN dstReview.reviewId is null\n            THEN ''\n            ELSE\n              CASE WHEN rStatusReset.reviewId is not null\n                THEN 'Status reset due to a Review change or Collection setting'\n                ELSE dstReview.statusText\n            END\n          END as statusText,\t\n          CASE WHEN dstReview.reviewId is null or rStatusReset.reviewId is not null\n            THEN UTC_TIMESTAMP()\n          ELSE dstReview.statusTs\n          END as statusTs,\t\n          CASE WHEN dstReview.reviewId is null or rStatusReset.reviewId is not null\n            THEN @userId\n          ELSE dstReview.statusUserId\n           END as statusUserId\t\n        from\n          t_src_reviewId\n          left join t_collection_setting on true\n          inner join review srcReview on (t_src_reviewId.reviewId = srcReview.reviewId)\n          left join t_assetId_map on (srcReview.assetId = t_assetId_map.srcAssetId)\n          left join review dstReview on (srcReview.version = dstReview.version and srcReview.checkDigest = dstReview.checkDigest and t_assetId_map.dstAssetId = dstReview.assetId) \n          left join review rChangedResult on (\n            dstReview.reviewId = rChangedResult.reviewId \n            and 0 != rChangedResult.statusId\n            and srcReview.resultId != rChangedResult.resultId\n          )\n          left join review rChangedAny on (\n            dstReview.reviewId  = rChangedAny.reviewId \n            and 0 != rChangedAny.statusId\n            and (srcReview.resultId != rChangedAny.resultId or srcReview.detail != rChangedAny.detail or srcReview.comment != rChangedAny.comment)\n          )\n          left join review rStatusReset on (\n            dstReview.reviewId = rStatusReset.reviewId and (\n              (t_collection_setting.resetCriteria = 'result' and rChangedResult.reviewId is not null)\n            or (t_collection_setting.resetCriteria = 'any' and rChangedAny.reviewId is not null)\n            or (t_collection_setting.detailRequired = 'always' and srcReview.detail = '')\n            or (t_collection_setting.commentRequired = 'always' and srcReview.comment = '')\n            or (t_collection_setting.detailRequired = 'findings' and srcReview.resultId = 4 and srcReview.detail = '')\n            or (t_collection_setting.commentRequired = 'findings' and srcReview.resultId = 4 and srcReview.comment = '')\n            )\n          )\n        where\n          t_src_reviewId.seq >= ? and t_src_reviewId.seq <= ?`,\n        runningText: `Preparing reviews`,\n        finishText: `Preparing reviews`\n      },\n      countIncomingReview: {\n        query: `select sum(reviewId is null) as inserted, sum(reviewId is not null) as updated from t_incoming_review`,\n        runningText: `Preparing reviews`,\n\n      },\n      pruneHistory: {\n        query: `with historyRecs AS (\n          select\n            rh.historyId,\n            ROW_NUMBER() OVER (PARTITION BY r.assetId, r.version, r.checkDigest ORDER BY rh.historyId DESC) as rowNum\n          from\n            review_history rh\n            inner join t_incoming_review r using (reviewId)\n          )\n        delete review_history\n        FROM \n           review_history\n           left join historyRecs on review_history.historyId = historyRecs.historyId \n        WHERE \n           historyRecs.rowNum > ((select historyMax from t_collection_setting) - 1)`,\n           runningText: `Preparing reviews`,\n           finishText: `Preparing reviews`\n      },\n      insertHistory: {\n        query: `INSERT INTO review_history (\n            reviewId,\n            ruleId,\n            resultId,\n            detail,\n            comment,\n            autoResult,\n            ts,\n            userId,\n            statusText,\n            statusUserId,\n            statusTs,\n            statusId,\n            touchTs,\n            resultEngine)\n          SELECT \n            r.reviewId,\n            r.ruleId,\n            r.resultId,\n            LEFT(r.detail,32767) as detail,\n            LEFT(r.comment,32767) as comment,\n            r.autoResult,\n            r.ts,\n            r.userId,\n            r.statusText,\n            r.statusUserId,\n            r.statusTs,\n            r.statusId,\n            r.touchTs,\n            r.resultEngine\n          FROM\n            review r\n            inner join t_incoming_review using (reviewId)`,\n          runningText: `Preparing reviews`,\n          finishText: `Prepared reviews`\n      },\n      upsertReview: {\n        query: `insert into review (reviewId, assetId, version, checkDigest, ruleId, resultId, detail, comment, resultEngine, metadata, ts, userId, statusId, statusText, statusTs, statusUserId)\n        select * from t_incoming_review as r\n        on duplicate key update\n          ruleId = r.ruleId,\n          resultId = r.resultId,\n          detail = r.detail,\n          comment = r.comment,\n          ts = r.ts,\n          userId = r.userId,\n          statusId = r.statusId,\n          statusText = r.statusText,\n          statusUserId = r.statusUserId,\n          statusTs = r.statusTs,\n          metadata = r.metadata,\n          resultEngine = r.resultEngine`\n      }\n    }\n    connection = await dbUtils.pool.getConnection()\n    connection.config.namedPlaceholders = false\n    connection.query('set @srcCollectionId = ?, @dstCollectionId = ?, @userId = ?, @json = ?',\n    [parseInt(srcCollectionId), parseInt(dstCollectionId), parseInt(userObject.userId), JSON.stringify(assetStigArguments)])\n    const prepQueries = ['dropArg', 'createArg', 'dropCollectionSetting', 'createCollectionSetting', 'dropSrcReviewId', 'createSrcReviewId']\n    const assetQueries = ['insertAsset', 'dropAssetIdMap', 'createAssetIdMap', 'insertStigAssetMap', 'deleteDefaultRev', 'insertDefaultRev']\n    const reviewExportQueries = ['pruneHistory', 'insertHistory', 'upsertReview']\n    const counts = {\n      assetsCreated: 0,\n      stigsMapped: 0,\n      reviewsInserted: 0,\n      reviewsUpdated: 0\n    }\n\n    async function transaction () {\n      progressJson = {\n        stage: 'prepare',\n        stepCount: prepQueries.length,\n        step: 0\n      }\n\n      await connection.query('START TRANSACTION')\n      for (const query of prepQueries) {\n        progressJson.step++\n        progressJson.stepName = query\n        progressJson.status = 'running'\n        progressJson.message = sql[query].runningText\n        progressCb(progressJson) \n        await connection.query(sql[query].query)\n      }\n\n      progressJson.stage = 'assets'\n      progressJson.stepCount = assetQueries.length\n      progressJson.step = 0\n      for (const query of assetQueries) {\n        progressJson.step++\n        progressJson.stepName = query\n        progressJson.status = 'running'\n        progressJson.message = sql[query].runningText\n        progressCb(progressJson)\n\n        const [result] = await connection.query(sql[query].query)\n        if (query === 'insertAsset') {\n          counts.assetsCreated = result.affectedRows\n        }\n        if (query === 'insertStigAssetMap') {\n          counts.stigsMapped = result.affectedRows\n        }\n      }\n\n      const [count] = await connection.query(sql.countSrcReviewId.query)\n      let offset = 1\n      const chunkSize = 10000\n      let result\n\n      progressJson = {\n        stage: 'reviews',\n        status: 'running',\n        reviewsTotal: count[0].total,\n        reviewsExported: 0\n      }\n      progressCb(progressJson)\n      do {\n        await connection.query(sql.dropIncomingReview.query)\n        ;[result] = await connection.query(sql.createIncomingReview.query, [offset, offset + chunkSize - 1])\n        if (result.affectedRows != 0) {\n          const [count] = await connection.query(sql.countIncomingReview.query)\n          counts.reviewsInserted += count[0].inserted\n          counts.reviewsUpdated += count[0].updated\n          for (const query of reviewExportQueries) {\n            await connection.query(sql[query].query)\n          }\n          progressJson.reviewsExported += result.affectedRows\n          progressCb(progressJson) \n        }\n        offset += chunkSize\n      } while (result.affectedRows != 0)\n\n      const [saIdResult]  = await connection.query(sql.selectStigAssetMap.query)\n      progressJson = {\n        stage: 'metrics',\n        status: 'running',\n        metricsTotal: saIdResult.length,\n        metricsUpdated: 0\n      }\n      progressCb(progressJson)\n      const increment = 1000\n      for (let i = 0; i < saIdResult.length; i+=increment) {\n        const saIds = saIdResult.slice(i, i + increment).map(row => row.saId)\n        await dbUtils.updateStatsAssetStig(connection, {saIds})\n        progressJson.metricsUpdated += saIds.length\n        progressCb(progressJson)\n      }\n\n      progressJson = {\n        stage: 'commit',\n        status: 'running'\n      }\n      progressCb(progressJson) \n      await connection.commit()\n\n      progressCb({\n        stage: 'result',\n        counts\n      }) \n    }\n    await dbUtils.retryOnDeadlock(transaction, svcStatus)\n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }\n    progressJson.status = 'error'\n    progressJson.message = 'Unhandled error'\n    progressJson.error = err\n    progressJson.stack = err?.stack\n    progressCb({progressJson})\n    return null\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\nexports.setGrantByCollection = async function ({collectionId, userId, userGroupId, roleId}) {\n\n  const sqlInsertGrant = \n  `INSERT INTO collection_grant (collectionId, ${userId ? 'userId' : 'userGroupId'}, roleId) VALUES (?, ?, ?) AS new ON DUPLICATE KEY UPDATE roleId = new.roleId`\n\n  const [response] = await dbUtils.pool.query(sqlInsertGrant, [collectionId, userId || userGroupId, roleId])\n  // resolving if we are inserting a new db record or updating an existing.\n  const httpStatus = (response.affectedRows === 1 && response.insertId !== 0) ? 201 : 200\n  return httpStatus\n}\n\nexports.getEffectiveAclByCollectionUser = async function ({collectionId, userId}) {\n  const sqlSelectEffectiveGrants = `\nwith cteGrantees as (\nselect \n\t  json_array(cg.grantId) as grantIds\n  from\n    collection_grant cg\n    inner join enabled_collection c on (cg.collectionId = c.collectionId)\n    left join user_data ud on cg.userId = ud.userId\nwhere\n\tcg.userId is not null\n    and cg.collectionId = ?\n    and cg.userId = ?\nunion \n  select\n    grantIds\n  from\n    (\n    select\n      ROW_NUMBER() OVER(PARTITION BY ugu.userId, cg.collectionId ORDER BY cg.roleId desc) as rn,\n      json_arrayagg(cg.grantId) OVER (PARTITION BY ugu.userId, cg.collectionId, cg.roleId) as grantIds\n    from \n      collection_grant cg\n      left join user_group_user_map ugu on cg.userGroupId = ugu.userGroupId\n      left join user_group ug on ugu.userGroupId = ug.userGroupId\n      left join collection_grant cgDirect on (cg.collectionId = cgDirect.collectionId and ugu.userId = cgDirect.userId)\n      inner join enabled_collection c on (cg.collectionId = c.collectionId)\n    where\n    cg.userGroupId is not null\n    and cgDirect.userId is null\n\tand cg.collectionId = ?\n    and ugu.userId = ?\n    ) dt\n  where\n    dt.rn = 1\n),\ncteAclRules as (select \n\tsa.saId,\n\tsa.assetId,\n\tsa.benchmarkId,\n    cga.grantId,\n\tcga.access,\n    json_object('assetId', cast(a.assetId as char), 'name', a.name) as asset,\n    json_object(\n\t\t'grantee', json_remove(json_object(\n\t\t\tCASE WHEN ud.userId is null THEN 'x' ELSE 'userId' END, CAST(ud.userId AS CHAR),\n\t\t\tCASE WHEN ud.userId is null THEN 'x' ELSE 'username' END, ud.username,\n\t\t\tCASE WHEN ug.userGroupId is null THEN 'x' ELSE 'userGroupId' END, CAST(ug.userGroupId AS CHAR),\n\t\t\tCASE WHEN ug.userGroupId is null THEN 'x' ELSE 'name' END, ug.name,\n            'roleId', cg.roleId\n\t\t\t), '$.x'),\n\t\t'aclRule', json_remove(json_object(\n\t\t\tCASE WHEN cga.benchmarkId is null THEN 'x' ELSE 'benchmarkId' END, cga.benchmarkId,\n\t\t\tCASE WHEN cga.assetId is null THEN 'x' ELSE 'asset' END, \n\t\t\tCASE WHEN cga.assetId is null THEN NULL ELSE json_object('assetId', cast(cga.assetId as char), 'name', a.name) END,\n\t\t\tCASE WHEN cga.clId is null THEN 'x' ELSE 'label' END,\n\t\t\tCASE WHEN cga.clId is null THEN NULL ELSE json_object('labelId', BIN_TO_UUID(cl.uuid,1), 'name', cl.name) END,\n\t\t\t'access', cga.access\n\t\t), '$.x')\n\t) as aclSource,\n\tcase when cga.benchmarkId is not null then 1 else 0 end +\n\t  case when cga.assetId is not null then 1 else 0 end +\n\t  case when cga.assetId is not null and cga.benchmarkId is not null then 1 else 0 end +\n\t  case when cga.clId is not null then 1 else 0 end as specificity\nfrom\n\tcollection_grant_acl cga\n    left join collection_grant cg on cga.grantId = cg.grantId\n    left join user_data ud on cg.userId = ud.userId\n    left join user_group ug on cg.userGroupId = ug.userGroupId\n\tleft join collection_label_asset_map cla on cga.clId = cla.clId\n    left join collection_label cl on cla.clId = cl.clId\n\tinner join stig_asset_map sa on (\n\t  case when cga.assetId is not null \n\t\tthen cga.assetId = sa.assetId \n\t\telse true\n\t  end and \n\t  case when cga.benchmarkId is not null \n\t\tthen cga.benchmarkId = sa.benchmarkId\n\t\telse true\n\t  end and\n\t  case when cga.clId is not null \n\t\tthen cla.assetId = sa.assetId\n\t\telse true\n\t  end)\n\tinner join enabled_asset a on sa.assetId = a.assetId and cg.collectionId = a.collectionId\nwhere\n\tcga.grantId in (\n\t\tselect /*+ NO_MERGE() */ jt.grantId from cteGrantees left join json_table (cteGrantees.grantIds, '$[*]' COLUMNS (grantId INT PATH '$')) jt on true\n\t)\n),\ncteAclRulesRanked as (\n    select /*+ NO_MERGE() */\n\t\tsaId,\n        access,\n        asset,\n        benchmarkId,\n        json_arrayagg(aclSource) over (partition by saId, access, specificity) as aclSources,\n        specificity,\n\t\trow_number() over (partition by saId order by specificity desc, access asc) as rn\n\tfrom \n\t\tcteAclRules)\nselect /*+ NO_MERGE() */ access, asset, benchmarkId, aclSources from cteAclRulesRanked where rn = 1 and access != 'none'`\n  const [response] = await dbUtils.pool.query(sqlSelectEffectiveGrants, [collectionId, userId, collectionId, userId])\n  return response\n}\n\nexports.setValidatedAcl = async function({validatedAcl, grantId, attributionUserId, svcStatus = {}}) {\n  const sqlDelete = `DELETE from collection_grant_acl WHERE grantId = ?`\n  const values = validatedAcl.map(i => [i.grantId, i.assetId, i.benchmarkId, i.clId, i.access, attributionUserId])\n  if (values.length) {\n    return dbUtils.retryOnDeadlock2({\n      transactionFn, \n      statusObj: svcStatus\n    })\n  }\n  else {\n    return dbUtils.pool.query(sqlDelete, [grantId])\n  }\n\n  async function transactionFn (connection) {  \n    const sqlInsert = `INSERT into collection_grant_acl (grantId, assetId, benchmarkId, clId, access, modifiedUserId) VALUES ?`\n    await connection.query(sqlDelete, [grantId])\n    await connection.query(sqlInsert, [values])\n  }\n}\n\nexports._reviewAclValidate = async function ({grantId, acl}) {\n  const sql = `\n  select\n    any_value(cg.grantId) as grantId,\n    group_concat(jt.itemNum) as itemNum,\n    case when count(jt.item) > 1 then json_arrayagg(jt.item) else any_value(jt.item) end as item,\n    jt.assetId,\n    jt.benchmarkId,\n    cl.clId,\n      group_concat(jt.access) as access,\n      group_concat(case when any_value(cg.roleId) != 1 and jt.access = 'none'\n        then 'roleId prohibits access:none'\n        else case when jt.assetId is not null and a.assetId is null\n          then 'asset not found in collection'\n          else case when jt.benchmarkId is not null and s.benchmarkId is null\n            then 'stig not installed'\n            else case when jt.labelId is not null and cl.clId is null\n              then 'label not found in collection'\n              else 'pass'\n            end\n          end\n        end\n      end) as validity,\n    count(jt.item) as dupCount\n  from\n    json_table(\n      ?,\n      \"$[*]\" COLUMNS (\n        itemNum FOR ORDINALITY,\n        item JSON PATH '$',\n        assetId INT PATH '$.assetId',\n        benchmarkId VARCHAR(255) PATH '$.benchmarkId',\n        labelId VARCHAR(255) PATH '$.labelId',\n        access VARCHAR(255) PATH '$.access'\n    )) jt\n    left join collection_grant cg on (cg.grantId = ?)\n    left join collection_label cl on cl.uuid = UUID_TO_BIN(jt.labelId,1) and cg.collectionId = cl.collectionId\n    left join enabled_asset a on jt.assetId = a.assetId and cg.collectionId = a.collectionId\n    left join stig s on jt.benchmarkId collate utf8mb4_0900_as_cs = s.benchmarkId\n  group by\n    jt.assetId, jt.benchmarkId, jt.labelId, cl.clId\n  order by\n    itemNum`\n    \n  const [rows] = await dbUtils.pool.query(sql, [JSON.stringify(acl), grantId])\n\n  const response = rows.reduce((a,v) => {\n    const disposition = v.validity === 'pass' ? 'pass' : 'fail'\n    if (disposition === 'fail') {\n      delete v.grantId\n      delete v.assetId\n      delete v.benchmarkId\n      delete v.clId\n      delete v.access\n      if (v.dupCount > 1) v.validity += ',duplicate resource definition'\n    }\n    delete v.dupCount\n    a[disposition].push(v)\n    return a\n  }, {pass:[], fail:[]})\n  return response\n}\n\nexports._getCollectionGrant = async function ({collectionId, grantId, grantIds, userId, userGroupId}) {\n  let sql = `select\n\tcase when user_data.userId\n  then json_object(\n    'grantId', cast(grantId as char),\n    'user', json_object(\n      'userId', CAST(user_data.userId as char),\n      'username', user_data.username,\n      'displayName', COALESCE(\n      JSON_UNQUOTE(JSON_EXTRACT(user_data.lastClaims, \"$.name\")),\n      user_data.username)),\n    'roleId', roleId)\n  else json_object(\n    'grantId', cast(grantId as char),\n    'userGroup', json_object(\n      'userGroupId', CAST(user_group.userGroupId as char),\n      'name', user_group.name,\n      'description', user_group.description\n      ),\n    'roleId', roleId) end as grantJson\n  from\n    collection_grant\n    left join user_data using (userId)\n    left join user_group using (userGroupId)\n    where collectionId = ?`\n  if (grantId) {\n    sql += ' and grantId = ?'\n  }\n  else if (grantIds) {\n    sql += ' and grantId IN (?)'\n  }\n  else if (userId) {\n    sql += ' and userId = ?'\n  }\n  else if (userGroupId) {\n    sql += ' and userGroupId = ?'\n  }\n  const [response] = await dbUtils.pool.query(sql, [collectionId, grantId || grantIds || userId || userGroupId])\n  const grants = response.map(row => row.grantJson)\n  return grants\n}\n\nexports.putGrantById = function ({grantId, grant, isRoleChange = false, svcStatus = {}}) {\n\n  const sqlUpdate = `UPDATE collection_grant SET userId = ?,userGroupId = ?,roleId = ? where grantId = ?`\n  const bindsUpdate = [grant.userId, grant.userGroupId, grant.roleId, grantId]\n\n  if (isRoleChange) {\n    // need a transaction\n    async function transactionFn (connection) {  \n      const sqlDelete = `DELETE from collection_grant_acl WHERE grantId = ? and access = 'none'`\n      await connection.query(sqlDelete, [grantId])\n      await connection.query(sqlUpdate, bindsUpdate)\n    }\n    \n    return dbUtils.retryOnDeadlock2({\n      transactionFn, \n      statusObj: svcStatus\n    })\n  \n  }\n  else {\n    return dbUtils.pool.query(sqlUpdate, bindsUpdate)\n  }\n}\n\nexports.deleteGrantById = async function (grantId) {\n  const sql = `DELETE from collection_grant WHERE grantId = ?`\n  return dbUtils.pool.query(sql, [grantId])\n}\n\nexports.postGrantsByCollection = async function (collectionId, grants) {\n  const binds = grants.map( g => [collectionId, g.userId, g.userGroupId, g.roleId])\n  const sql = `INSERT into collection_grant (collectionId, userId, userGroupId, roleId) VALUES ?`\n  const [result] = await dbUtils.pool.query(sql, [binds])\n  const grantIds = []\n  for (let x = 0; x < result.affectedRows; x++) {\n    grantIds.push(result.insertId + x)\n  }\n  return grantIds\n}\n\nexports._hasCollectionGrant = async function ({collectionId, userId}) {\n\n    const sql = `SELECT cg.grantId\n      FROM collection_grant cg \n      LEFT JOIN user_group ug ON cg.userGroupId = ug.userGroupId\n      LEFT JOIN user_data ud on cg.userID = ud.userId\n      LEFT JOIN user_group_user_map ugu ON ug.userGroupId = ugu.userGroupId\n      WHERE cg.collectionId = ? AND (ud.userId = ? OR ugu.userId = ?)`\n\n  const [response] = await dbUtils.pool.query(sql, [collectionId, userId, userId])\n  return !!response[0]\n}\n\nexports.queryReviewAcl = async function ({grantId, collectionId, userId, userGroupId}) {\n  const columns = [\n    `case when cg.roleId = 1 then 'none' else 'rw' end as defaultAccess`,\n    `case when count(cga.cgAclId) = 0\n      THEN json_array()\n      ELSE json_arrayagg(\n        json_remove(json_object(\n          CASE WHEN cga.benchmarkId is null THEN 'x' ELSE 'benchmarkId' END, cga.benchmarkId,\n          CASE WHEN cga.assetId is null THEN 'x' ELSE 'asset' END, \n          CASE WHEN cga.assetId is null THEN NULL ELSE json_object('assetId',cast(cga.assetId as char),'name',a.name) END,\n          CASE WHEN cga.clId is null THEN 'x' ELSE 'label' END,\n          CASE WHEN cga.clId is null THEN NULL ELSE json_object('labelId',BIN_TO_UUID(cl.uuid,1), 'name', cl.name, 'color', cl.color) END,\n          'access', cga.access\n        ), '$.x'))\n      END as acl`\n  ]\n  const joins = [\n    'collection_grant cg',\n    'inner join enabled_collection c on cg.collectionId = c.collectionId',\n    'left join collection_grant_acl cga on cg.grantId = cga.grantId',\n    'left join enabled_asset a on cga.assetId = a.assetId',\n    'left join collection_label cl on cga.clId = cl.clId'\n    ]\n\n    const predicates = {\n    statements: [],\n    binds: []\n  }\n\n  if (grantId) {\n    predicates.statements.push('cg.grantId = ?')\n    predicates.binds.push(grantId)\n  }\n  else if (userId && collectionId) {\n    predicates.statements.push('cg.userId = ?', 'cg.collectionId = ?')\n    predicates.binds.push(userId, collectionId)\n  }\n  else if (userGroupId && collectionId) {\n    predicates.statements.push('cg.userGroupId = ?', 'cg.collectionId = ?')\n    predicates.binds.push(userGroupId, collectionId)\n  }\n\n  const sql = dbUtils.makeQueryString({columns, joins, predicates, format: true})\n\n  const [rows] = await dbUtils.pool.query(sql)\n  return rows?.[0]\n}\n"
  },
  {
    "path": "api/source/service/JobService.js",
    "content": "const { randomUUID } = require('node:crypto')\nconst dbUtils = require('./utils')\nconst _this = this\n\nexports.queryJobs = async function ({ projections = [], filters = {} } = {}) {\n  const columns = [\n    'CAST(job.jobId AS CHAR) AS jobId',\n    'job.name',\n    'job.description',\n    `json_object(\n      'userId', CAST(ud_creator.userId as char),\n      'username', ud_creator.username) AS createdBy`,\n    'job.created',\n    `IF(ud_updater.userId IS NULL, NULL, json_object(\n      'userId', CAST(ud_updater.userId as char),\n      'username', ud_updater.username)) AS updatedBy`,\n    'job.updated',\n    `(select\n      IF(COUNT(jt.taskId), json_arrayagg(json_object('taskId', CAST(jt.taskId as char), 'name', t.name, 'description', t.description)), json_array())\n      from job_task_map jt left join task t ON jt.taskId = t.taskId where jt.jobId = job.jobId) AS tasks`,\n    `(select ifnull(COUNT(*), 0) from job_run jr where jr.jobId = job.jobId) AS runCount`,\n    `(SELECT ifnull(JSON_OBJECT(\n      'runId', BIN_TO_UUID(jr.runId, 1),\n      'created', DATE_FORMAT(jr.created,'%Y-%m-%dT%H:%i:%sZ'),\n      'updated', IF(jr.updated IS NULL, NULL, DATE_FORMAT(jr.updated,'%Y-%m-%dT%H:%i:%sZ')),\n      'state', CASE WHEN jr.state = 'running' AND jr.created < CURRENT_TIMESTAMP - INTERVAL gs.VARIABLE_VALUE SECOND THEN 'shutdown' ELSE jr.state END\n    ), null) FROM job_run jr left join performance_schema.global_status gs ON gs.VARIABLE_NAME = \"Uptime\" WHERE jr.jobId = job.jobId ORDER BY jr.jrId DESC LIMIT 1) AS lastRun`,\n  ]\n  const joins = new Set([\n    'job',\n    'LEFT JOIN user_data ud_creator ON ud_creator.userId = job.createdBy',\n    'LEFT JOIN user_data ud_updater ON ud_updater.userId = job.updatedBy'\n  ])\n  const groupBy = ['job.jobId']\n\n  const orderBy = ['job.jobId']\n\n  const eventValues = `\n  IF(e.event_type = 'ONE TIME',\n    JSON_OBJECT(\n      'eventId', e.event_name,\n      'type', 'once',\n      'starts', DATE_FORMAT(e.execute_at,'%Y-%m-%dT%H:%i:%sZ')\n    ),\n    JSON_OBJECT(\n      'eventId', e.event_name,\n      'type', 'recurring',\n      'interval', JSON_OBJECT('value', CAST(e.interval_value as char), 'field', LCASE(e.interval_field)),\n      'starts', DATE_FORMAT(e.starts,'%Y-%m-%dT%H:%i:%sZ'),\n      'ends', DATE_FORMAT(e.ends,'%Y-%m-%dT%H:%i:%sZ'),\n      'enabled', e.status = 'ENABLED'\n    )\n  )`\n  columns.push(`(select\n    ${eventValues} AS event\n  from\n    information_schema.events e\n  where\n    e.event_schema = database() \n    AND e.event_name LIKE CONCAT(\"job-\", job.jobId, \"-stigman\")\n    LIMIT 1\n  ) as event`)\n\n\n  const predicates = {\n    statements: [],\n    binds: []\n  }\n  if (filters.jobId) {\n    predicates.statements.push('job.jobId = ?')\n    predicates.binds.push(filters.jobId)\n  }\n\n  const sql = dbUtils.makeQueryString({ columns, joins, predicates, groupBy, orderBy, format: true })\n  let [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\nexports.getJobs = async ({ projections }) => {\n  return _this.queryJobs({ projections })\n}\n\nexports.getJob = async (jobId, { projections } = {}) => {\n  const jobs = await _this.queryJobs({ projections, filters: { jobId } })\n  return jobs[0]\n}\n\nexports.deleteJob = async (jobId) => {\n  const sql = 'select event_name from information_schema.events where event_schema = database() AND event_name LIKE CONCAT(\"job-\", ?, \"-%\")'\n  const [events] = await dbUtils.pool.query(sql, [jobId])\n  if (events.length) {\n    const eventNames = events.map(r => r.EVENT_NAME)\n    for (const eventName of eventNames) {\n      const sqlDropEvent = `DROP EVENT IF EXISTS ??`\n      await dbUtils.pool.query(sqlDropEvent, [eventName])\n    }\n  }\n  const [result] = await dbUtils.pool.query('DELETE FROM job WHERE jobId = ?', [jobId])\n  return result.affectedRows > 0\n}\n\nasync function createEventByJob(jobId, eventData) {\n  const eventName = getEventNameByJob(jobId)\n  if (eventData.type === 'once') {\n    const sqlCreateEvent = `\n      CREATE EVENT ?? \n      ON SCHEDULE AT ? \n      DO CALL run_job(?, null)\n    `\n    const params = [eventName, eventData.starts, jobId]\n    await dbUtils.pool.query(sqlCreateEvent, params)\n  } else if (eventData.type === 'recurring') {\n    const intervalFields = {\n      minute: 'MINUTE', hour: 'HOUR', day: 'DAY',\n      week: 'WEEK', month: 'MONTH'\n    }\n    const intervalSql = intervalFields[eventData.interval.field]\n    const enabledSql = eventData.enabled === false ? 'DISABLE' : 'ENABLE'\n    const endsSql = eventData.ends ? 'ENDS ?' : ''\n    const sqlCreateEvent = `\n      CREATE EVENT ??\n      ON SCHEDULE EVERY ? ${intervalSql} STARTS ? ${endsSql}\n      ${enabledSql}\n      DO CALL run_job(?, null)\n    `\n    const params = [eventName, eventData.interval.value, eventData.starts]\n    if (eventData.ends) params.push(eventData.ends)\n    params.push(jobId)\n    await dbUtils.pool.query(sqlCreateEvent, params)\n  }\n  return eventName\n}\n\nasync function dropEventByJob(jobId) {\n  const eventName = getEventNameByJob(jobId)\n  const sqlDropEvent = `DROP EVENT IF EXISTS ??`\n  return dbUtils.pool.query(sqlDropEvent, [eventName])\n}\n\nfunction getEventNameByJob(jobId) {\n  return `job-${jobId}-stigman`\n}\n\nexports.createJob = async ({ jobData, userId, svcStatus } = {}) => {\n  const { tasks, event, ...jobFields } = jobData\n  async function transactionFn(connection) {\n    const sqlInsertJob = `INSERT into job (name, description, createdBy) VALUES ?`\n    const values = [\n      [jobFields.name, jobFields.description, userId]\n    ]\n    const result = await connection.query(sqlInsertJob, [values])\n    const jobId = result[0].insertId\n\n    const sqlInsertTasks = `INSERT INTO job_task_map (jobId, taskId) VALUES ?`\n    const taskValues = tasks.map(t => [jobId, t])\n    if (taskValues.length) {\n      await connection.query(sqlInsertTasks, [taskValues])\n    }\n    return jobId\n  }\n  const jobId = await dbUtils.retryOnDeadlock2({\n    transactionFn,\n    statusObj: svcStatus\n  })\n\n  // Create events after committing the transaction\n  if (event) {\n    await createEventByJob(jobId, event)\n  }\n  return jobId\n}\n\nexports.patchJob = async ({jobId, jobData, userId, svcStatus = {}}) => {\n  const { tasks, event, ...jobFields } = jobData\n  async function transactionFn(connection) {\n    const sets = []\n    const binds = []\n    if (jobFields.name !== undefined) {\n      sets.push('name = ?')\n      binds.push(jobFields.name)\n    }\n    if (jobFields.description !== undefined) {\n      sets.push('description = ?')\n      binds.push(jobFields.description)\n    }\n    if (sets.length) {\n      sets.push('updatedBy = ?')\n      binds.push(userId)\n      binds.push(jobId)\n      const sqlUpdateJob = `UPDATE job SET ${sets.join(', ')}, updated = CURRENT_TIMESTAMP WHERE jobId = ?`\n      await connection.query(sqlUpdateJob, binds)\n    }\n    if (Array.isArray(tasks)) {\n      const sqlDeleteTasks = `DELETE FROM job_task_map WHERE jobId = ?`\n      await connection.query(sqlDeleteTasks, [jobId])\n      const sqlInsertTasks = `INSERT INTO job_task_map (jobId, taskId) VALUES ?`\n      const taskValues = tasks.map(t => [jobId, t])\n      if (taskValues.length) {\n        await connection.query(sqlInsertTasks, [taskValues])\n      }\n    }\n    return jobId\n  }\n  const updatedJobId = await dbUtils.retryOnDeadlock2({\n    transactionFn,\n    statusObj: svcStatus\n  })\n\n  if (event === null) {\n    await dropEventByJob(jobId)\n  } else if (event) {\n    await dropEventByJob(jobId)\n    await createEventByJob(jobId, event)\n  }\n  return updatedJobId\n}\n\nexports.getEventsByJob = async (jobId) => {\n  throw new Error('Not implemented')\n}\n\nexports.createEventByJob = async (jobId, eventData) => {\n  throw new Error('Not implemented')\n}\n\nexports.getRunById = async (runId) => {\n  const columns = [\n    `BIN_TO_UUID(jr.runId, 1) AS runId`,\n    `CASE WHEN jr.state = 'running' AND jr.created < CURRENT_TIMESTAMP - INTERVAL gs.VARIABLE_VALUE SECOND THEN 'shutdown' ELSE jr.state END AS state`,\n    'jr.created',\n    'jr.updated',\n    'CAST(jr.jobId AS CHAR) AS jobId'\n  ]\n  const joins = new Set([\n    'job_run jr',\n    'left join performance_schema.global_status gs ON gs.VARIABLE_NAME = \"Uptime\"'\n  ])\n  const predicates = {\n    statements: ['jr.runId = ?'],\n    binds: [dbUtils.uuidToSqlString(runId)]\n  }\n  const sql = dbUtils.makeQueryString({ columns, joins, predicates, format: true })\n  let [rows] = await dbUtils.pool.query(sql, [runId])\n  return (rows[0])\n}\n\nexports.getRunsByJob = async (jobId) => {\n  const columns = [\n    `BIN_TO_UUID(jr.runId, 1) AS runId`,\n    `CASE WHEN jr.state = 'running' AND jr.created < CURRENT_TIMESTAMP - INTERVAL gs.VARIABLE_VALUE SECOND THEN 'shutdown' ELSE jr.state END AS state`,\n    `jr.created`,\n    `jr.updated`,\n    `CAST(jr.jobId AS CHAR) AS jobId`\n  ]\n  const joins = new Set([\n    'job_run jr',\n    'left join performance_schema.global_status gs ON gs.VARIABLE_NAME = \"Uptime\"'\n  ])\n  const predicates = {\n    statements: ['jr.jobId = ?'],\n    binds: [jobId]\n  }\n  const orderBy = ['jr.created DESC']\n\n  const sql = dbUtils.makeQueryString({ columns, joins, predicates, orderBy, format: true })\n  let [rows] = await dbUtils.pool.query(sql, [jobId])\n  return (rows)\n}\n\nexports.runImmediateJob = async (jobId) => {\n  const runId = randomUUID()\n  const sql = `CREATE EVENT IF NOT EXISTS ??\n  ON SCHEDULE AT CURRENT_TIMESTAMP\n  DO CALL run_job(?,?)`\n  await dbUtils.pool.query(sql, [`job-${jobId}-${runId}`, jobId, runId])\n  return runId\n}\n\nexports.getOutputByRun = async (runId, {filters}) => {\n  const ctes = [\n    `Output AS (\n    SELECT\n      ROW_NUMBER() OVER (ORDER BY tout.seq ASC) as seq,\n      tout.ts,\n      tout.taskId,\n      t.name as task,\n      tout.type,\n      tout.message\n    FROM\n      task_output tout\n      left join task t ON tout.taskId = t.taskId\n    WHERE\n      runId = UUID_TO_BIN(?, 1))`\n  ]\n  const columns = [\n    'Output.seq',\n    'Output.ts',\n    'Output.taskId',\n    'Output.task',\n    'Output.type',\n    'Output.message'\n  ]\n\n  const joins = new Set(['Output'])\n  const predicates = {\n    statements: [],\n    binds: [runId]\n  }\n  if (filters?.afterSeq) {\n    predicates.statements.push('Output.seq > ?')\n    predicates.binds.push(filters.afterSeq)\n  }\n  const orderBy = ['Output.seq DESC']\n  const sql = dbUtils.makeQueryString({ ctes, columns, joins, predicates, orderBy, format: true })\n  let [rows] = await dbUtils.pool.query(sql, predicates.binds)\n  return (rows)\n}\n\nexports.getAllTasks = async () => {\n  const sql = `SELECT CAST(taskId AS CHAR(36)) AS taskId, name, description, command FROM task ORDER BY name`\n  let [rows] = await dbUtils.pool.query(sql)\n  return rows\n}\n\nexports.deleteRunById = async (runId) => {\n  const [result] = await dbUtils.pool.query('DELETE FROM job_run WHERE runId = UUID_TO_BIN(?,1)', [runId])\n  return result.affectedRows > 0\n}"
  },
  {
    "path": "api/source/service/MetricsService.js",
    "content": "const dbUtils = require('./utils')\n\nfunction genLabelPredicates ({labelNames, labelIds, labelMatch, collectionLabelTableAlias = 'cl'}) {\n  const clauses = []\n  const binds = []\n\n  if (labelNames) {\n    clauses.push(`${collectionLabelTableAlias}.name IN ?`)\n    binds.push([labelNames])\n  }\n  if (labelIds) {\n    const uuidBinds = labelIds.map( uuid => dbUtils.uuidToSqlString(uuid))\n    clauses.push(`${collectionLabelTableAlias}.uuid IN ?`)\n    binds.push([uuidBinds])\n  }\n  if (labelMatch === 'null') {\n    clauses.push(`${collectionLabelTableAlias}.uuid IS NULL`)\n  }\n  const statement = `(${clauses.join(' OR ')})`\n  return {statement, binds}\n}\n\nmodule.exports.queryMetrics = async function ({\n  collectionId,\n  filter = {},\n  grant,\n  aggregation = 'unagg',\n  style = 'detail',\n  returnType = 'json'\n}) {\n\n  const predicates = {\n    statements: [\n      'a.collectionId = ? '\n    ],\n    binds: [collectionId]\n  }\n  const ctes = []\n  const columns = returnType === 'csv' ? [...baseColsFlat[aggregation]] : [...baseCols[aggregation]]\n  const joins = [\n    'enabled_asset a',\n    'left join stig_asset_map sa on a.assetId = sa.assetId',\n    'left join default_rev dr on a.collectionId = dr.collectionId and sa.benchmarkId = dr.benchmarkId',\n    'left join revision rev on dr.revId = rev.revId',\n    'left join stig on rev.benchmarkId = stig.benchmarkId'\n  ]\n  if (grant.roleId === 1) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: grant.grantIds}))\n    joins.push('inner join cteAclEffective cae on sa.saId = cae.saId')\n  }\n  const groupBy = []\n  const orderBy = []\n\n  // FILTERS\n  if (filter.labelNames || filter.labelIds || filter.labelMatch) {\n    const {statement, binds} = genLabelPredicates({\n      labelNames: filter.labelNames,\n      labelIds: filter.labelIds,\n      labelMatch: filter.labelMatch,\n      collectionLabelTableAlias: 'clPred'\n    })\n    const innerQueryRaw = `select distinct assetId from enabled_asset left join collection_label_asset_map using (assetId)\n    left join collection_label clPred using(clId) where a.collectionId = ? and ${statement}`\n    const innerQueryFormatted = dbUtils.pool.format(innerQueryRaw, [collectionId, ...binds])\n    predicates.statements.push(`a.assetId IN (${innerQueryFormatted})`)\n  }\n  if (filter.assetIds) {\n    predicates.statements.push(\n      'a.assetId IN ?'\n    )\n    predicates.binds.push([filter.assetIds])\n  }\n  if (filter.benchmarkIds) {\n    predicates.statements.push(\n      'sa.benchmarkId IN ?'\n    )\n    predicates.binds.push([filter.benchmarkIds])\n  }\n\n  switch (aggregation) {\n    case 'asset':\n      predicates.statements.push('a.assetId IS NOT NULL')\n      groupBy.push('a.assetId')\n      orderBy.push('a.name')\n      break\n    case 'stig':\n      predicates.statements.push('sa.benchmarkId IS NOT NULL')\n      groupBy.push('rev.revId', 'dr.revisionPinned')\n      orderBy.push('rev.benchmarkId')\n      break\n    case 'collection':\n      joins.push(`left join enabled_collection c on a.collectionId = c.collectionId`)\n      groupBy.push('c.collectionId')\n      orderBy.push('c.name')\n      break\n    case 'label':\n      predicates.statements.push('a.assetId IS NOT NULL')\n      groupBy.push('cl.description', 'cl.color', 'cl.uuid', 'cl.name')\n      joins.push(\n        'left join collection_label_asset_map cla on a.assetId = cla.assetId',\n        'left join collection_label cl on cla.clId = cl.clId'\n      )\n      orderBy.push('cl.name')\n      break\n    case 'unagg':\n      predicates.statements.push('sa.benchmarkId IS NOT NULL')\n      break\n  }\n\n  if (style === 'detail') {\n    if (returnType === 'csv' && aggregation === 'unagg') {\n      columns.push(...colsMetricsDetail)\n    }\n    else if (returnType === 'csv') {\n      columns.push(...colsMetricsDetailAgg)\n    }\n    else {\n      columns.push( aggregation === 'unagg' ? sqlMetricsDetail : sqlMetricsDetailAgg)\n    }\n  }\n  else {\n    if (returnType === 'csv' && aggregation === 'unagg') {\n      columns.push(...colsMetricsSummary)\n    }\n    else if (returnType === 'csv') {\n      columns.push(...colsMetricsSummaryAgg)\n    }\n    else {\n      columns.push( aggregation === 'unagg' ? sqlMetricsSummary : sqlMetricsSummaryAgg)\n    }\n  }\n  const sql = dbUtils.makeQueryString({\n    ctes,\n    columns,\n    joins,\n    predicates,\n    groupBy,\n    orderBy,\n    format: true\n  })\n  \n  const [rows] = await dbUtils.pool.query(sql)\n  return (rows || [])\n}\n\nmodule.exports.queryMetaMetrics = async function ({\n  filter = {},\n  grants,\n  aggregation = 'meta',\n  style = 'detail',\n  returnType = 'json'\n}) {\n\n  const ctes = []\n  const columns = returnType === 'csv' ? [...baseColsFlat[aggregation]] : [...baseCols[aggregation]]\n  const joins = [\n    'enabled_asset a',\n    'left join stig_asset_map sa on a.assetId = sa.assetId',\n    'left join default_rev dr on a.collectionId = dr.collectionId and sa.benchmarkId = dr.benchmarkId',\n    'left join revision rev on dr.revId = rev.revId',\n    'left join stig on rev.benchmarkId = stig.benchmarkId'\n  ]\n  const predicates = {\n    statements: [],\n    binds: []\n  }\n  const groupBy = []\n  const orderBy = []\n\n  let grantedCollectionIds = []\n  let restrictedGrantIds = []\n  const restrictedCollectionIds = []\n  if (filter.collectionIds) {\n    for (const collectionId of filter.collectionIds) {\n      if (grants[collectionId]) {\n        grantedCollectionIds.push(collectionId)\n      }\n    }\n  }\n  else {\n    grantedCollectionIds = Object.keys(grants)\n  }\n  \n  for (const collectionId of grantedCollectionIds) {\n    if (grants[collectionId].roleId === 1) {\n      restrictedCollectionIds.push(collectionId)\n      restrictedGrantIds.push(grants[collectionId].grantIds)\n    }\n  }\n  restrictedGrantIds = restrictedGrantIds.flat()\n\n  if (grantedCollectionIds.length) {\n    predicates.statements.push('a.collectionId IN (?)')\n    predicates.binds.push(grantedCollectionIds)\n  }\n  else {\n    predicates.statements.push('false')\n  }\n  \n  if (restrictedCollectionIds.length) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: restrictedGrantIds}))\n    joins.push('left join cteAclEffective cae on sa.saId = cae.saId')\n    predicates.statements.push('case when a.collectionId IN (?) then cae.saId = sa.saId else true end')\n    predicates.binds.push(restrictedCollectionIds)\n  }\n\n  if (filter.benchmarkIds) {\n    predicates.statements.push('sa.benchmarkId IN ?')\n    predicates.binds.push([filter.benchmarkIds])\n  }\n  if (filter.revisionIds) {\n    predicates.statements.push('rev.revId IN ?')\n    predicates.binds.push([filter.revisionIds])\n  }\n\n  switch (aggregation) {\n    case 'meta':\n      predicates.statements.push('sa.benchmarkId IS NOT NULL')\n      break\n    case 'collection':\n      joins.push('left join enabled_collection c on a.collectionId = c.collectionId')\n      groupBy.push('c.collectionId')\n      orderBy.push('c.name')\n      break\n    case 'metaStig':\n      predicates.statements.push('sa.benchmarkId IS NOT NULL')\n      groupBy.push('rev.revId')\n      orderBy.push('rev.benchmarkId')\n      break\n  }\n  if (style === 'detail') {\n    if (returnType === 'csv') {\n      columns.push(...colsMetricsDetailAgg)\n    }\n    else {\n      columns.push(sqlMetricsDetailAgg)\n    }\n  }\n  else { //style: 'summary'\n    if (returnType === 'csv') {\n      columns.push(...colsMetricsSummaryAgg)\n    }\n    else {\n      columns.push(sqlMetricsSummaryAgg)\n    }\n  }\n  const sql = dbUtils.makeQueryString({\n    ctes,\n    columns,\n    joins,\n    predicates,\n    groupBy,\n    orderBy,\n    format: true\n  })\n\n  const [rows] = await dbUtils.pool.query(sql)\n  return (rows || [])\n}\n\nconst sqlMetricsDetail = `json_object(\n  'assessments', rev.ruleCount,\n  'assessmentsBySeverity', json_object(\n    'low', rev.lowCount,\n    'medium', rev.mediumCount,\n    'high', rev.highCount\n  ),\n  'assessed', sa.pass + sa.fail + sa.notapplicable,\n  'assessedBySeverity', json_object(\n    'low', sa.assessedLowCount,\n    'medium', sa.assessedMediumCount,\n    'high', sa.assessedHighCount\n  ),\n  'minTs', DATE_FORMAT(sa.minTs, '%Y-%m-%dT%H:%i:%sZ'),\n  'maxTs', DATE_FORMAT(sa.maxTs, '%Y-%m-%dT%H:%i:%sZ'),\n  'maxTouchTs', DATE_FORMAT(sa.maxTouchTs, '%Y-%m-%dT%H:%i:%sZ'),\n  'findings', json_object(\n    'low', sa.lowCount,\n    'medium', sa.mediumCount,\n    'high', sa.highCount\n  ),\n  'statuses', json_object(\n    'saved', json_object('total',sa.saved,'resultEngine',sa.savedResultEngine),\n    'submitted', json_object('total',sa.submitted,'resultEngine',sa.submittedResultEngine),\n    'rejected', json_object('total',sa.rejected,'resultEngine',sa.rejectedResultEngine),\n    'accepted', json_object('total',sa.accepted,'resultEngine',sa.acceptedResultEngine)\n  ),\n  'results', json_object(\n    'notchecked', json_object('total',sa.notchecked,'resultEngine',sa.notcheckedResultEngine),\n    'notapplicable', json_object('total',sa.notapplicable,'resultEngine',sa.notapplicableResultEngine),\n    'pass', json_object('total',sa.pass,'resultEngine',sa.passResultEngine),\n    'fail', json_object('total',sa.fail,'resultEngine',sa.failResultEngine),\n    'unknown', json_object('total',sa.unknown,'resultEngine',sa.unknownResultEngine),\n    'error', json_object('total',sa.error,'resultEngine',sa.errorResultEngine),\n    'notselected', json_object('total',sa.notselected,'resultEngine',sa.notselectedResultEngine),\n    'informational', json_object('total',sa.informational,'resultEngine',sa.informationalResultEngine),\n    'fixed', json_object('total',sa.fixed,'resultEngine',sa.fixedResultEngine)\n  )\n) as metrics`\nconst sqlMetricsDetailAgg = `json_object(\n  'assessments', coalesce(sum(rev.ruleCount),0),\n  'assessmentsBySeverity', json_object(\n    'low', coalesce(sum(rev.lowCount),0),\n    'medium', coalesce(sum(rev.mediumCount),0),\n    'high', coalesce(sum(rev.highCount),0)\n  ),  \n  'assessed', coalesce(sum(sa.pass + sa.fail + sa.notapplicable),0),\n  'assessedBySeverity', json_object(\n    'low', coalesce(sum(sa.assessedLowCount),0),\n    'medium', coalesce(sum(sa.assessedMediumCount),0),\n    'high', coalesce(sum(sa.assessedHighCount),0)\n  ),  \n  'minTs', DATE_FORMAT(MIN(sa.minTs), '%Y-%m-%dT%H:%i:%sZ'),\n  'maxTs', DATE_FORMAT(MAX(sa.maxTs), '%Y-%m-%dT%H:%i:%sZ'),\n  'maxTouchTs', DATE_FORMAT(MAX(sa.maxTouchTs), '%Y-%m-%dT%H:%i:%sZ'),\n  'findings', json_object(\n    'low', coalesce(sum(sa.lowCount),0),\n    'medium', coalesce(sum(sa.mediumCount),0),\n    'high', coalesce(sum(sa.highCount),0)\n  ),\n  'statuses', json_object(\n    'saved', json_object('total',coalesce(sum(sa.saved),0),'resultEngine',coalesce(sum(sa.savedResultEngine),0)),\n    'submitted', json_object('total',coalesce(sum(sa.submitted),0),'resultEngine',coalesce(sum(sa.submittedResultEngine),0)),\n    'rejected', json_object('total',coalesce(sum(sa.rejected),0),'resultEngine',coalesce(sum(sa.rejectedResultEngine),0)),\n    'accepted', json_object('total',coalesce(sum(sa.accepted),0),'resultEngine',coalesce(sum(sa.acceptedResultEngine),0))\n  ),\n  'results', json_object(\n    'notchecked', json_object('total',coalesce(sum(sa.notchecked),0),'resultEngine',coalesce(sum(sa.notcheckedResultEngine),0)),\n    'notapplicable', json_object('total',coalesce(sum(sa.notapplicable),0),'resultEngine',coalesce(sum(sa.notapplicableResultEngine),0)),\n    'pass', json_object('total',coalesce(sum(sa.pass),0),'resultEngine',coalesce(sum(sa.passResultEngine),0)),\n    'fail', json_object('total',coalesce(sum(sa.fail),0),'resultEngine',coalesce(sum(sa.failResultEngine),0)),\n    'unknown', json_object('total',coalesce(sum(sa.unknown),0),'resultEngine',coalesce(sum(sa.unknownResultEngine),0)),\n    'error', json_object('total',coalesce(sum(sa.error),0),'resultEngine',coalesce(sum(sa.errorResultEngine),0)),\n    'notselected', json_object('total',coalesce(sum(sa.notselected),0),'resultEngine',coalesce(sum(sa.notselectedResultEngine),0)),\n    'informational', json_object('total',coalesce(sum(sa.informational),0),'resultEngine',coalesce(sum(sa.informationalResultEngine),0)),\n    'fixed', json_object('total',coalesce(sum(sa.fixed),0),'resultEngine',coalesce(sum(sa.fixedResultEngine),0))\n  )\n) as metrics`\nconst sqlMetricsSummary = `json_object(\n  'assessments', rev.ruleCount,\n  'assessmentsBySeverity', json_object(\n    'low', rev.lowCount,\n    'medium', rev.mediumCount,\n    'high', rev.highCount\n  ),  \n  'assessed', sa.pass + sa.fail + sa.notapplicable,\n  'assessedBySeverity', json_object(\n    'low', sa.assessedLowCount,\n    'medium', sa.assessedMediumCount,\n    'high', sa.assessedHighCount\n  ),  \n  'minTs', DATE_FORMAT(sa.minTs, '%Y-%m-%dT%H:%i:%sZ'),\n  'maxTs', DATE_FORMAT(sa.maxTs, '%Y-%m-%dT%H:%i:%sZ'),\n  'maxTouchTs', DATE_FORMAT(sa.maxTouchTs, '%Y-%m-%dT%H:%i:%sZ'),\n  'results', json_object(\n    'pass', sa.pass,\n    'fail', sa.fail,\n    'notapplicable', sa.notapplicable,\n    'other', sa.notchecked + sa.unknown + sa.error + sa.notselected + sa.informational + sa.fixed\n  ),\n  'statuses', json_object(\n    'saved', sa.saved,\n    'submitted', sa.submitted,\n    'accepted', sa.accepted,\n    'rejected', sa.rejected\n  ),\n  'findings', json_object(\n    'low', sa.lowCount,\n    'medium', sa.mediumCount,\n    'high', sa.highCount\n  )\n) as metrics`\nconst sqlMetricsSummaryAgg = `json_object(\n  'assessments', coalesce(sum(rev.ruleCount),0),\n  'assessmentsBySeverity', json_object(\n    'low', coalesce(sum(rev.lowCount),0),\n    'medium', coalesce(sum(rev.mediumCount),0),\n    'high', coalesce(sum(rev.highCount),0)\n  ),    \n  'assessed', coalesce(sum(sa.pass + sa.fail + sa.notapplicable),0),\n  'assessedBySeverity', json_object(\n    'low', coalesce(sum(sa.assessedLowCount),0),\n    'medium', coalesce(sum(sa.assessedMediumCount),0),\n    'high', coalesce(sum(sa.assessedHighCount),0)\n  ),  \n  'minTs', DATE_FORMAT(MIN(sa.minTs), '%Y-%m-%dT%H:%i:%sZ'),\n  'maxTs', DATE_FORMAT(MAX(sa.maxTs), '%Y-%m-%dT%H:%i:%sZ'),\n  'maxTouchTs', DATE_FORMAT(MAX(sa.maxTouchTs), '%Y-%m-%dT%H:%i:%sZ'),\n  'results', json_object(\n    'pass', coalesce(sum(sa.pass),0),\n    'fail', coalesce(sum(sa.fail),0),\n    'notapplicable', coalesce(sum(sa.notapplicable),0),\n    'other', coalesce(sum(sa.notchecked + sa.unknown + sa.error + sa.notselected + sa.informational + sa.fixed),0)\n  ),\n  'statuses', json_object(\n    'saved', coalesce(sum(sa.saved),0),\n    'submitted', coalesce(sum(sa.submitted),0),\n    'accepted', coalesce(sum(sa.accepted),0),\n    'rejected', coalesce(sum(sa.rejected),0)\n  ),\n  'findings', json_object(\n    'low', coalesce(sum(sa.lowCount),0),\n    'medium', coalesce(sum(sa.mediumCount),0),\n    'high', coalesce(sum(sa.highCount),0)\n  )\n) as metrics`\nconst colsMetricsDetail = [\n  `rev.ruleCount as assessments`,\n  `rev.lowCount as assessmentsLow`,\n  `rev.mediumCount as assessmentsMedium`,\n  `rev.highCount as assessmentsHigh`,\n  `sa.pass + sa.fail + sa.notapplicable as assessed`,\n  `sa.assessedLowCount as assessedLow`,\n  `sa.assessedMediumCount as assessedMedium`,\n  `sa.assessedHighCount as assessedHigh`,  \n  `DATE_FORMAT(sa.minTs, '%Y-%m-%dT%H:%i:%sZ') as minTs`,\n  `DATE_FORMAT(sa.maxTs, '%Y-%m-%dT%H:%i:%sZ') as maxTs`,\n  `DATE_FORMAT(sa.maxTouchTs, '%Y-%m-%dT%H:%i:%sZ') as maxTouchTs`,\n  `sa.lowCount as findingsLow`,\n  `sa.mediumCount as findingsMedium`,\n  `sa.highCount as findingsHigh`,\n  `sa.saved`,\n  `sa.savedResultEngine`,\n  `sa.submitted`,\n  `sa.submittedResultEngine`,\n  `sa.accepted`,\n  `sa.acceptedResultEngine`,\n  `sa.rejected`,\n  `sa.rejectedResultEngine`,\n  `sa.pass`,\n  `sa.passResultEngine`,\n  `sa.fail`,\n  `sa.failResultEngine`,\n  `sa.notapplicable`,\n  `sa.notapplicableResultEngine`,\n  `sa.notchecked`,\n  `sa.notcheckedResultEngine`,\n  `sa.unknown`,\n  `sa.unknownResultEngine`,\n  `sa.error`,\n  `sa.errorResultEngine`,\n  `sa.notselected`,\n  `sa.notselectedResultEngine`,\n  `sa.informational`,\n  `sa.informationalResultEngine`,\n  `sa.fixed`,\n  `sa.fixedResultEngine`\n]\nconst colsMetricsDetailAgg = [\n  `coalesce(sum(rev.ruleCount),0) as assessments`,\n  `coalesce(sum(rev.lowCount),0) as assessmentsLow`,\n  `coalesce(sum(rev.mediumCount),0) as assessmentsMedium`,\n  `coalesce(sum(rev.highCount),0) as assessmentsHigh`,\n  `coalesce(sum(sa.pass + sa.fail + sa.notapplicable),0) as assessed`,\n  `coalesce(sum(sa.assessedLowCount),0) as assessedLow`,\n  `coalesce(sum(sa.assessedMediumCount),0) as assessedMedium`,\n  `coalesce(sum(sa.assessedHighCount),0) as assessedHigh`,  \n  `DATE_FORMAT(min(sa.minTs), '%Y-%m-%dT%H:%i:%sZ') as minTs`,\n  `DATE_FORMAT(max(sa.maxTs), '%Y-%m-%dT%H:%i:%sZ') as maxTs`,\n  `DATE_FORMAT(max(sa.maxTouchTs), '%Y-%m-%dT%H:%i:%sZ') as maxTouchTs`,\n  `coalesce(sum(sa.lowCount),0) as findingsLow`,\n  `coalesce(sum(sa.mediumCount),0) as findingsMedium`,\n  `coalesce(sum(sa.highCount),0) as findingsHigh`,\n  `coalesce(sum(sa.saved),0) as saved`,\n  `coalesce(sum(sa.savedResultEngine),0) as savedResultEngine`,\n  `coalesce(sum(sa.submitted),0) as submitted`,\n  `coalesce(sum(sa.submittedResultEngine),0) as submittedResultEngine`,\n  `coalesce(sum(sa.accepted),0) as accepted`,\n  `coalesce(sum(sa.acceptedResultEngine),0) as acceptedResultEngine`,\n  `coalesce(sum(sa.rejected),0) as rejected`,\n  `coalesce(sum(sa.rejectedResultEngine),0) as rejectedResultEngine`,\n  `coalesce(sum(sa.pass),0) as pass`,\n  `coalesce(sum(sa.passResultEngine),0) as passResultEngine`,\n  `coalesce(sum(sa.fail),0) as fail`,\n  `coalesce(sum(sa.failResultEngine),0) as failResultEngine`,\n  `coalesce(sum(sa.notapplicable),0) as notapplicable`,\n  `coalesce(sum(sa.notapplicableResultEngine),0) as notapplicableResultEngine`,\n  `coalesce(sum(sa.notchecked),0) as notchecked`,\n  `coalesce(sum(sa.notcheckedResultEngine),0) as notcheckedResultEngine`,\n  `coalesce(sum(sa.unknown),0) as unknown`,\n  `coalesce(sum(sa.unknownResultEngine),0) as unknownResultEngine`,\n  `coalesce(sum(sa.error),0) as error`,\n  `coalesce(sum(sa.errorResultEngine),0) as errorResultEngine`,\n  `coalesce(sum(sa.notselected),0) as notselected`,\n  `coalesce(sum(sa.notselectedResultEngine),0) as notselectedResultEngine`,\n  `coalesce(sum(sa.informational),0) as informational`,\n  `coalesce(sum(sa.informationalResultEngine),0) as informationalResultEngine`,\n  `coalesce(sum(sa.fixed),0) as fixed`,\n  `coalesce(sum(sa.fixedResultEngine),0) as fixedResultEngine`\n]\n\nconst colsMetricsSummary = [\n  'rev.ruleCount as \"assessments\"', \n  `rev.lowCount as assessmentsLow`,\n  `rev.mediumCount as assessmentsMedium`,\n  `rev.highCount as assessmentsHigh`,  \n  'sa.pass + sa.fail + sa.notapplicable as \"assessed\"', \n  'sa.assessedLowCount as \"assessedLow\"', \n  'sa.assessedMediumCount as \"assessedMedium\"', \n  'sa.assessedHighCount as \"assessedHigh\"',   \n  `DATE_FORMAT(sa.minTs, '%Y-%m-%dT%H:%i:%sZ') as minTs`,\n  `DATE_FORMAT(sa.maxTs, '%Y-%m-%dT%H:%i:%sZ') as maxTs`, \n  `DATE_FORMAT(sa.maxTouchTs, '%Y-%m-%dT%H:%i:%sZ') as maxTouchTs`, \n  'sa.lowCount as \"findingsLow\"', \n  'sa.mediumCount as \"findingsMedium\"', \n  'sa.highCount as \"findingsHigh\"', \n  'sa.pass as \"pass\"', \n  'sa.fail as \"fail\"', \n  'sa.notapplicable as \"notapplicable\"', \n  'sa.notchecked + sa.unknown + sa.error + sa.notselected + sa.informational + sa.fixed as \"other\"', \n  'sa.saved as \"saved\"', \n  'sa.submitted as \"submitted\"', \n  'sa.accepted as \"accepted\"', \n  'sa.rejected as \"rejected\"'\n]\nconst colsMetricsSummaryAgg = [\n  'coalesce(sum(rev.ruleCount),0) as \"assessments\"', \n  `coalesce(sum(rev.lowCount),0) as assessmentsLow`,\n  `coalesce(sum(rev.mediumCount),0) as assessmentsMedium`,\n  `coalesce(sum(rev.highCount),0) as assessmentsHigh`,\n  'coalesce(sum(sa.pass + sa.fail + sa.notapplicable),0) as \"assessed\"', \n  'coalesce(sum(sa.assessedLowCount),0) as \"assessedLow\"', \n  'coalesce(sum(sa.assessedMediumCount),0) as \"assessedMedium\"', \n  'coalesce(sum(sa.assessedHighCount),0) as \"assessedHigh\"',   \n  `DATE_FORMAT(MIN(sa.minTs), '%Y-%m-%dT%H:%i:%sZ') as minTs`, \n  `DATE_FORMAT(MAX(sa.maxTs), '%Y-%m-%dT%H:%i:%sZ') as maxTs`, \n  `DATE_FORMAT(MAX(sa.maxTouchTs), '%Y-%m-%dT%H:%i:%sZ') as maxTouchTs`, \n  'coalesce(sum(sa.lowCount),0) as \"findingsLow\"', \n  'coalesce(sum(sa.mediumCount),0) as \"findingsMedium\"', \n  'coalesce(sum(sa.highCount),0) as \"findingsHigh\"', \n  'coalesce(sum(sa.pass),0) as \"pass\"', \n  'coalesce(sum(sa.fail),0) as \"fail\"', \n  'coalesce(sum(sa.notapplicable),0) as \"notapplicable\"', \n  'coalesce(sum(sa.notchecked + sa.unknown + sa.error + sa.notselected + sa.informational + sa.fixed),0) as \"other\"', \n  'coalesce(sum(sa.saved),0) as \"saved\"', \n  'coalesce(sum(sa.submitted),0) as \"submitted\"', \n  'coalesce(sum(sa.accepted),0) as \"accepted\"', \n  'coalesce(sum(sa.rejected),0) as \"rejected\"'\n]\nconst sqlLabels = `coalesce(\n  (select\n    json_arrayagg(json_object(\n      'labelId', BIN_TO_UUID(cl2.uuid,1),\n      'name', cl2.name,\n      'color', cl2.color\n      ))\n  from\n    collection_label_asset_map cla2\n    left join collection_label cl2 on cla2.clId = cl2.clId\n  where\n    cla2.assetId = a.assetId),\n  json_array()) as labels`\nconst sqlLabelsFlat = `(\n  select  \n    group_concat(cl2.name)\n  from\n    collection_label_asset_map cla2\n    left join collection_label cl2 on cla2.clId = cl2.clId\n  where\n    cla2.assetId = a.assetId) as \"labels\"`\nconst baseCols = {\n  unagg: [\n    'cast(a.assetId as char) as assetId',\n    'a.name',\n    sqlLabels,\n    'rev.benchmarkId',\n    'stig.title',\n    'rev.marking',\n    'rev.revisionStr',\n    'CASE WHEN dr.revisionPinned = 1 THEN CAST(true as json) ELSE CAST(false as json) END as revisionPinned',\n    `DATE_FORMAT(rev.benchmarkDateSql, '%Y-%m-%d') as revisionDate`,\n\n  ],\n  asset: [\n    'cast(a.assetId as char) as assetId',\n    'a.name',\n    sqlLabels,\n    'a.ip',\n    'a.fqdn',\n    'a.mac',\n    'case when count(sa.benchmarkId) > 0 THEN json_arrayagg(sa.benchmarkId) ELSE json_array() END as benchmarkIds'\n  ],\n  collection: [\n    'cast(c.collectionId as char) as collectionId',\n    'c.name',\n    'count(distinct a.assetId) as assets',\n    'count(distinct sa.benchmarkId) as stigs',\n    'count(sa.saId) as checklists'\n  ],\n  stig: [\n    'rev.benchmarkId',\n    'stig.title',\n    'rev.marking',\n    'rev.revisionStr',\n    'CASE WHEN dr.revisionPinned = 1 THEN CAST(true as json) ELSE CAST(false as json) END as revisionPinned',\n    `DATE_FORMAT(rev.benchmarkDateSql, '%Y-%m-%d') as revisionDate`,\n    'count(distinct a.assetId) as assets',\n    'rev.ruleCount'\n  ],\n  label: [\n    'BIN_TO_UUID(cl.uuid,1) as labelId',\n    'cl.name',\n    'cl.color',\n    'cl.description',\n    'count(distinct a.assetId) as assets'\n  ],\n  meta: [\n    'count(distinct a.collectionId) as collections',\n    'count(distinct a.assetId) as assets',\n    'count(distinct sa.benchmarkId) as stigs',\n    'count(sa.saId) as checklists'\n  ],\n  metaStig: [\n    'rev.benchmarkId',\n    'stig.title',\n    'rev.marking',\n    'rev.revisionStr',\n    `DATE_FORMAT(rev.benchmarkDateSql, '%Y-%m-%d') as revisionDate`,\n    'count(distinct a.collectionId) as collections',\n    'count(distinct a.assetId) as assets',\n    'rev.ruleCount'\n  ]\n}\nconst baseColsFlat = {\n  unagg: [\n    'cast(a.assetId as char) as assetId',\n    'a.name',\n    sqlLabelsFlat,\n    'rev.benchmarkId',\n    'stig.title',\n    'rev.marking',\n    'rev.revisionStr',\n    'CASE WHEN dr.revisionPinned = 1 THEN CAST(true as json) ELSE CAST(false as json) END as revisionPinned',\n    `DATE_FORMAT(rev.benchmarkDateSql, '%Y-%m-%d') as revisionDate`,\n\n  ],\n  asset: [\n    'cast(a.assetId as char) as assetId',\n    'a.name',\n    sqlLabelsFlat,\n    'group_concat(sa.benchmarkId) as benchmarkIds'\n  ],\n  collection: [\n    'cast(c.collectionId as char) as collectionId',\n    'c.name',\n    'count(distinct a.assetId) as assets',\n    'count(sa.saId) as checklists'\n  ],\n  stig: [\n    'rev.benchmarkId',\n    'stig.title',\n    'rev.marking',\n    'rev.revisionStr',\n    'CASE WHEN dr.revisionPinned = 1 THEN CAST(true as json) ELSE CAST(false as json) END as revisionPinned',\n    `DATE_FORMAT(rev.benchmarkDateSql, '%Y-%m-%d') as revisionDate`,\n    'count(distinct a.assetId) as assets',\n    'rev.ruleCount'\n  ],\n  label: [\n    'BIN_TO_UUID(cl.uuid,1) as labelId',\n    'cl.name',\n    'count(distinct a.assetId) as assets'\n  ],\n  meta: [\n    'count(distinct a.collectionId) as collections',\n    'count(distinct a.assetId) as assets',\n    'count(distinct sa.benchmarkId) as stigs',\n    'count(sa.saId) as checklists'\n  ],\n  metaStig: [\n    'rev.benchmarkId',\n    'stig.title',\n    'rev.marking',\n    'rev.revisionStr',\n    `DATE_FORMAT(rev.benchmarkDateSql, '%Y-%m-%d') as revisionDate`,\n    'count(distinct a.collectionId) as collections',\n    'count(distinct a.assetId) as assets',\n    'rev.ruleCount'\n  ]\n}"
  },
  {
    "path": "api/source/service/OperationService.js",
    "content": "'use strict';\nconst dbUtils = require('./utils')\nconst config = require('../utils/config')\nconst logger = require('../utils/logger')\nconst BJSON = require('../utils/buffer-json')\nconst { Readable, Transform } = require(\"node:stream\")\nconst { pipeline } = require(\"node:stream/promises\")\nconst zlib = require(\"node:zlib\")\nconst klona = require('../utils/klona')\nconst os = require('node:os')\nconst Umzug = require('umzug')\nconst path = require('path')\n\n/**\n * Return version information\n *\n * returns ApiVersion\n **/\nexports.getConfiguration = async function() {\n  const sql = `SELECT * from config`\n  const [rows] = await dbUtils.pool.query(sql)\n  const config = {}\n  for (const row of rows) {\n    config[row.key] = row.value\n  }\n  return (config)\n}\n\nexports.setConfigurationItem = async function (key, value) {\n  const sql = 'INSERT INTO config (`key`, `value`) VALUES (?, ?) ON DUPLICATE KEY UPDATE value = VALUES(value)'\n  await dbUtils.pool.query(sql, [key, value])\n  return (true)\n}\n\n/**\n * getAppData - streams JSONL records to the response. The JSONL are either\n * data records from a MySQL table (always an array) or metadata records (always an object).\n * \n * @param {import('express').Response} res express response\n * @returns {undefined}\n * @example Abbreviated example of JSONL which is streamed to the response:\n *  {\"version\":\"1.4.13\",\"commit\":{\"branch\":\"na\",\"sha\":\"na\",\"tag\":\"na\",\"describe\":\"na\"},\"date\":\"2024-08-18T15:29:16.784Z\",\"lastMigration\":33}\\n\n    {\"tables\":[{\"table\":\"stig\",\"rowCount\":4}, ... ], \"totalRows\": 4}\\n\n    {\"table\":\"stig\",\"columns\":\"`benchmarkId`, `title`\",\"rowCount\":4}\\n\n    [\"RHEL_7_STIG_TEST\",\"Red Hat Enterprise Linux 7 Security Technical Implementation Guide\"]\\n\n    [\"VPN_SRG_TEST\",\"Virtual Private Network (VPN) Security Requirements Guide\"]\\n\n    [\"VPN_SRG_Rule-fingerprint-match-test\",\"Virtual Private Network (VPN) Security Requirements Guide - replaced\"]\\n\n    [\"Windows_10_STIG_TEST\",\"Windows 10 Security Technical Implementation Guide\"]\\n ...\n */\nexports.getAppData = async function (res, format) {\n  /** @type {string[]} tables to exclude from the appdata file */\n  const excludedTables = [\n    '_migrations', \n    'status', \n    'result',\n    'severity_cat_map', \n    'cci', \n    'cci_reference_map', \n    'config',\n    'job',\n    'job_run',\n    'job_task_map',\n    'task',\n    'task_output'\n  ]\n\n  let sink\n  if (format === 'gzip') {\n    /** @type {zlib.Gzip} transform stream to compress JSONL records and write to the response */\n    sink = zlib.createGzip()\n    sink.pipe(res)\n  }\n  else {\n    /** @type {http.ServerResponse} */\n    sink = res\n  }\n  sink.setMaxListeners(Infinity)\n\n\n  // Write metadata record {version, commit, date, lastMigration}\n  const {version, commit, lastMigration} = config\n  sink.write(JSON.stringify({version, commit, date: new Date(), lastMigration}) + '\\n')\n   \n  // Execute SQL to retrieve a list of tables and their non-generated columns. The query binds\n  // to the schema name and the excluded tables.\n  /** @type {Array.<Array.<{table:string, columns:string[]}>} */\n  const sql = `SELECT\n    TABLE_NAME as \\`table\\`,\n    cast(concat('[', group_concat(CONCAT('\"\\`',COLUMN_NAME,'\\`\"') order by COLUMN_NAME), ']') as json) as columns\n  FROM\n    INFORMATION_SCHEMA.COLUMNS \n  where\n    TABLE_SCHEMA=? \n    and TABLE_NAME IN (select TABLE_NAME FROM INFORMATION_SCHEMA.TABLES where TABLE_SCHEMA=? and TABLE_TYPE='BASE TABLE')\n    and TABLE_NAME not in (?)\n    and EXTRA NOT LIKE '% GENERATED'\n  group by\n    TABLE_NAME`\n  const [tableRows] = await dbUtils.pool.query(sql, [config.database.schema, config.database.schema, excludedTables])\n\n  /**\n   * @type {Object.<string, {columns:string, rowCount?:number}>} object pivoted from tableRows[]\n   * @example\n   * '{\n        \"asset\": {\n          \"columns\": \"`assetId`,`name`,`fqdn`, ... \"\n        },\n        \"check_content\": {\n          \"columns\": \"`ccId`,`content`\"\n        },\n        \"collection\": {\n          \"columns\": \"`collectionId`,`name`,`description`, ... \"\n        }\n      }'\n   */\n  const tableMetadata = tableRows.reduce((acc, value) => {\n    acc[value.table] = {columns:value.columns.join(',')}\n    return acc\n  }, {})\n\n\n  /** @type {string[]} */\n  const tableNames = Object.keys(tableMetadata)\n\n  /** @type {number} incremented by the row count of each table */\n  let totalRows = 0\n\n  /** @type {{table:string, rowCount:number}[]} */\n  let tables = []\n\n  // Select and handle the row count for each table. \n  for (const table of tableNames) {\n    const [row] = await dbUtils.pool.query(`select count(*) as cnt from ${table}`)\n    const rowCount = row[0].cnt\n    tableMetadata[table].rowCount = rowCount\n    tables.push({table, rowCount})\n    totalRows += rowCount\n  }\n\n  // Write metadata record {tables, totalRows}\n  sink.write(JSON.stringify({tables, totalRows}) + '\\n')\n\n  for (const table of tableNames) {\n    // create readable stream using the non-promise interface of dbUtils.pool.pool\n    // select all rows for non-generated columns in table\n    // perform custom type casting of fields to JS\n    /** @type {Readable} */\n    const queryStream = dbUtils.pool.pool.query({\n      sql: `select ${tableMetadata[table].columns} from ${table}`,\n      rowsAsArray: true,\n      typeCast: function (field, next) {\n         // BIT fields returned as boolean\n        if ((field.type === \"BIT\") && (field.length === 1)) {\n          let bytes = field.buffer() || [0]\n          return (bytes[0] === 1)\n        }\n         // Designated fields returned as original MySQL strings\n        if (field.type === 'JSON' || field.type === 'DATETIME' || field.type === 'DATE' || field.type === 'TIMESTAMP' || field.type === 'TIME' || field.type === 'YEAR') {\n          return (field.string(\"utf8\"))\n        }\n        return next()\n      }\n     }).stream()\n\n    // Write metadata record {table, columns, rowCount}\n    sink.write(JSON.stringify({table, ...tableMetadata[table]}) + '\\n')\n\n    /** @type {Transform} writes a JSONL data record for each tuple of row data*/\n    const bjson = new Transform({\n      objectMode: true,\n      transform: (data, encoding, cb) => {\n        // BSJON supports stringify() and parse() of Buffer values\n        cb(null, BJSON.stringify(data) + '\\n')\n      }\n    })\n\n    // pipeline writes data records [field, field, ...] to sink, ends without closing sink\n    await pipeline(queryStream, bjson, sink, { end: false })\n  }\n\n  // ending sink will also end the response\n  sink.end()\n}\n\nexports.getAppDataTables = async function () {\n  const sql = `SELECT\n    TABLE_NAME as name,\n    TABLE_ROWS as \\`rows\\`,\n    DATA_LENGTH as dataLength\n  FROM\n    information_schema.TABLES\n  WHERE\n    TABLE_SCHEMA=? and TABLE_TYPE='BASE TABLE'\n  ORDER BY\n    TABLE_NAME`\n  const [rows] = await dbUtils.pool.query(sql, [config.database.schema])\n  return (rows)\n}\n\n/**\n * replaceAppData - process a file created by getAppData() and execute SQL queries with progress messages\n * \n * @param {Buffer} buffer - buffer with file content\n * @param {function(Object)} progressCb - optional, argument is an object with progress status\n * @returns {Promise} promise\n */\nexports.replaceAppData = async function (buffer, contentType, progressCb = () => {}) {\n  /**\n   * ParseJSONLStream - Transform chunks of JSONL records into individual parsed AppData records (N:1).\n   * @extends Transform\n   */\n  \n  /** @type {boolean} needsMigrations - indicates if migrations are required */\n  let needsMigrations = false\n  class ParseJSONLStream extends Transform {\n    /**\n     * @param {Object} param\n     * @param {function(string):any} param.jsonParser - function for JSON parsing, default JSON.parse()\n     * @param {string} param.separator - character separating JSONL records, default '\\n'\n     */\n    constructor({jsonParser = JSON.parse, separator = '\\n'} = {}) {\n      super({objectMode: true})\n      Object.assign(this, {separator, jsonParser})\n  \n      /** @type {RegExp} RegExp for .split() that includes any trailing separator */\n      this.splitRegExp = new RegExp(`(?<=${separator})`)\n  \n      /** @type {string} holds incoming chunk prefaced by any partial record from previous transform */\n      this.buffer = '' \n    }\n\n    /**\n     * @param {Buffer} chunk - buffer from Gunzip that can span multiple JSONL records\n     * @param {string} encoding - usually 'utf8'\n     * @param {function()} cb - signals completion\n     */\n    _transform(chunk, encoding, cb) {\n      this.buffer += chunk.toString(encoding)\n      \n      /** @type {string[]} list of JSONL, last item might be truncated or partial */\n      const candidates = this.buffer.split(this.splitRegExp)\n      /** @type {number} index of last candidates[] item */\n      const lastIndex = candidates.length - 1\n\n      // clear buffer for the next _transform() or _flush()\n      this.buffer = ''\n  \n      /** index @type {number} */\n      /** candidate @type {string} */\n      for (const [index, candidate] of candidates.entries()) {\n        if (index === lastIndex && !candidate.endsWith(this.separator)) {\n          // this is the last candidate and there's no trailing separator\n          // initialize buffer for next _transform() or _flush()\n          this.buffer = candidate\n        }\n        else {\n          try {\n            // if parsable, write parsed value\n            this.push(this.jsonParser(candidate))\n          }\n          // swallow any parse error\n          catch {}\n        }\n      }\n      cb()\n    }\n    /** @param {function()} cb signals completion */\n    _flush(cb) {\n      try {\n        // if what's left in the buffer is parsable, write parsed value\n        if (this.buffer) this.push(this.jsonParser(this.buffer))\n      }\n      // swallow any parse error\n      catch {}\n      cb()\n    }\n  }\n\n  /**\n   * AppDataQueryStream - Transform AppData records into an SQL query object (N:1)\n   * @extends Transform\n   */\n  class AppDataQueryStream extends Transform {\n    /**\n     * @param {Object} param\n     * @param {number} param.maxValues - maximum number of values for an insert query.\n     * @param {function(Object): any} param.onTablesFn - called when record {tables, ...} is read\n     * @param {function(Object): any} param.onMigrationFn - called when record {..., lastMigration} is read\n     */\n    constructor({maxValues = 10000, onTablesFn = new Function(), onMigrationFn = async function () {}}) {\n      super({objectMode: true})\n      Object.assign(this, { maxValues, onTablesFn, onMigrationFn })\n      \n      /** @type {null|Object} the last metadata record encountered */\n      this.currentMetadata = null\n      \n      /** @type {Array} values for an insert query */\n      this.currentBinds = []\n    }\n\n    /**\n     * @param {Buffer} chunk a single AppData record\n     * @param {string} encoding usually 'utf8'\n     * @param {function()} cb signals completion\n     */\n    async _transform(chunk, encoding, cb) {\n      if (Array.isArray(chunk)) {\n        this.currentBinds.push(chunk)\n        if (this.currentBinds.length === this.maxValues || this.currentBinds.length === 0) {\n          this.push(this.formatCurrentQuery())\n          this.currentBinds = []\n        }\n      }\n      else if (chunk.lastMigration) {\n        try {\n          await this.onMigrationFn(chunk)\n        }\n        catch (e) {\n          cb(e)\n          return\n        }\n      }\n      else if (chunk.table){\n        if (this.currentMetadata) { \n          this.push(this.formatCurrentQuery())\n        }\n        this.currentMetadata = chunk\n        this.currentBinds = []\n        this.push(this.formatCurrentQuery())\n      }\n      else if (chunk.tables) {\n        try {\n          this.onTablesFn(chunk)\n        }\n        catch (e) {\n          cb(e)\n          return\n        }\n      }\n      else {\n        this.currentMetadata = null\n      }\n      cb()\n    }\n    \n    /** @param {function()} cb signals completion */\n    _flush(cb) {\n      this.push(this.formatCurrentQuery())\n      cb()\n    }\n\n    /** \n     * Creates an object with an SQL insert or truncate statement that operates\n     * on the current table and any current binds\n     * @returns {{table:string, sql:string, valueCount:number}} */\n    formatCurrentQuery() {\n      const sqlInsert = this.currentBinds.length\n        ? `insert into ${this.currentMetadata.table}(${this.currentMetadata.columns}) values ?`\n        : `truncate ${this.currentMetadata.table}`\n      return {\n        table: this.currentMetadata.table,\n        sql: dbUtils.pool.format(sqlInsert, [this.currentBinds]),\n        valueCount: this.currentBinds.length\n      }\n    }\n  }\n\n  /** \n   * @param {any} record expected to be AppData metadata {..., lastMigration}\n   * @returns {undefined}\n   * @throws {Error}\n   */\n  async function onMigrationFn(record) {\n    if (record.lastMigration === config.lastMigration) return\n    if (record.lastMigration > config.lastMigration) {\n      throw new Error(`API migration v${config.lastMigration} is less than the source migration v${record.lastMigration}`) \n    }\n    needsMigrations = true\n    await resetDatabase()\n    await migrateTo(record.lastMigration)\n  }\n\n  async function migrateTo(migration = config.lastMigration) {\n    const endMigration = migration.toString().padStart(4, '0') + '.js'\n    const umzug = new Umzug({\n      migrations: {\n        path: path.join(__dirname, './migrations'),\n        params: [dbUtils.pool]\n      },\n      storage: path.join(__dirname, './migrations/lib/umzug-mysql-storage'),\n      storageOptions: {\n        pool: dbUtils.pool\n      }\n    })\n    umzug.on('migrating', (name) => {\n      progressCb({migration: name, status: 'started'})\n    })\n    umzug.on('migrated', (name) => {\n      progressCb({migration: name, status: 'finished'})\n    })\n    await umzug.up({to: endMigration})\n  }\n\n  async function resetDatabase() {\n    const connection = await dbUtils.pool.getConnection()\n    const sql = `SELECT\n    table_name,\n    table_type\n      FROM\n        information_schema.TABLES\n      WHERE\n        TABLE_SCHEMA=?`\n    const [tables] = await connection.query(sql,[config.database.schema])\n    await connection.query('SET FOREIGN_KEY_CHECKS = 0')\n    for (const table of tables) {\n      const drop = `DROP ${table.TABLE_TYPE === 'BASE TABLE' ? 'TABLE' : 'VIEW'} ${table.TABLE_NAME}`\n      await connection.query(drop)\n      progressCb({sql: drop})\n    }\n    await connection.query('SET FOREIGN_KEY_CHECKS = 1')\n    await connection.release()\n  }\n\n  function createChunkedReadable(buffer, chunkSize = 64 * 1024) {\n    let offset = 0\n    return new Readable({\n      read() {\n        if (offset >= buffer.length) {\n          this.push(null) // No more data, signal end of stream\n        } \n        else {\n          const chunk = buffer.subarray(offset, offset + chunkSize)\n          this.push(chunk) // Push the next chunk\n          offset += chunkSize\n        }\n      }\n    })\n  }\n  \n  /** @type {import('mysql2/promise').PoolConnection} */\n  let connection\n  try {\n    connection = await dbUtils.pool.getConnection()\n    await connection.query('SET FOREIGN_KEY_CHECKS=0')\n    const jsonl = new ParseJSONLStream({jsonParser: BJSON.parse})\n    const queries = new AppDataQueryStream({maxValues: 10000, onTablesFn: progressCb, onMigrationFn})\n    if (contentType === 'application/gzip' || contentType === 'application/x-gzip') {\n      pipeline(Readable.from(buffer), zlib.createGunzip(), jsonl, queries)\n    }\n    else {\n      pipeline(createChunkedReadable(buffer, 10 * 1024 * 1024), jsonl, queries)\n    }\n    let seq = 0\n    for await (const data of queries) {\n      await connection.query(data.sql)\n      seq++\n      progressCb({seq, table: data.table, valueCount: data.valueCount})\n    }\n    if (needsMigrations) await migrateTo(config.lastMigration)\n    progressCb({status: 'success'})\n\n  }\n  catch (err) {\n    progressCb({status: 'fail', error: err.message})\n    return undefined\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.query('SET FOREIGN_KEY_CHECKS=1')\n      connection.release()\n    }\n  }\n}\n\nexports.getAppInfo = async function(options = {}) {\n  const { includeRowCounts } = options\n  const schema = 'stig-manager-appinfo-v1.1'\n  const sqlAnalyze = `ANALYZE TABLE collection, asset, review, review_history, user`\n  const sqlInfoSchema = `\n  SELECT\n    TABLE_NAME as tableName,\n    TABLE_ROWS as tableRows,\n    TABLE_COLLATION as tableCollation,\n    AVG_ROW_LENGTH as avgRowLength,\n    DATA_LENGTH as dataLength,\n    INDEX_LENGTH as indexLength,\n    AUTO_INCREMENT as autoIncrement,\n    CREATE_TIME as createTime,\n    UPDATE_TIME as updateTime\n  FROM\n    information_schema.TABLES\n  WHERE\n    TABLE_SCHEMA = ?\n    and TABLE_TYPE='BASE TABLE'\n  ORDER BY\n    TABLE_NAME`\n  const sqlCollectionAssetStigs = `\n  SELECT\n    CAST(sub.collectionId as char) as collectionId,\n    sum(case when sub.assetId is not null and sub.stigAssetCnt = 0 then 1 else 0 end) as range00,\n    sum(case when sub.stigAssetCnt >= 1 and sub.stigAssetCnt <= 5 then 1 else 0 end) as range01to05,\n    sum(case when sub.stigAssetCnt >= 6 and sub.stigAssetCnt <= 10 then 1 else 0 end) as range06to10,\n    sum(case when sub.stigAssetCnt >= 11 and sub.stigAssetCnt <= 15 then 1 else 0 end) as range11to15,\n    sum(case when sub.stigAssetCnt >= 16 then 1 else 0 end) as range16plus\n  FROM\n  (SELECT\n    c.collectionId,\n    c.name,\n    a.assetId,\n    COUNT(sa.assetId) as stigAssetCnt\n  FROM\n    collection c\n    LEFT JOIN asset a on a.collectionId = c.collectionId and a.state = \"enabled\"\n    LEFT JOIN stig_asset_map sa on sa.assetId = a.assetId \n  GROUP BY\n    c.collectionId,\n    c.name,\n    a.assetId) as sub\n  GROUP BY\n    sub.collectionId\n  ORDER BY\n    sub.collectionId\n  `\n  const sqlCountsByCollection = `\n  SELECT\n    cast(c.collectionId as char) as collectionId,\n    c.name,\n    c.state,\n    c.settings,\n\t  count(distinct if(a.state = \"enabled\", a.assetId, null)) as assets,\n    count(distinct if(a.state = \"disabled\", a.assetId, null)) as assetsDisabled,\n    count(distinct if(a.state = \"enabled\", sa.benchmarkId, null)) as uniqueStigs,\n    sum(if(a.state = \"enabled\" and sa.saId, 1, 0)) as stigAssignments,\n    sum(if(a.state = \"enabled\",rev.ruleCount,0)) as rules,\n    sum(if(a.state = \"enabled\", (sa.pass + sa.fail + sa.notapplicable + sa.notchecked + sa.notselected + sa.informational + sa.fixed + sa.unknown + sa.error), 0)) as reviews,\n    sum(if(a.state = \"disabled\", (sa.pass + sa.fail + sa.notapplicable + sa.notchecked + sa.notselected + sa.informational + sa.fixed + sa.unknown + sa.error), 0)) as reviewsDisabled\n  FROM\n    collection c\n    left join asset a on c.collectionId = a.collectionId\n    left join stig_asset_map sa on a.assetId = sa.assetId\n    left join default_rev dr on c.collectionId = dr.collectionId and sa.benchmarkId = dr.benchmarkId\n    left join revision rev on dr.revId = rev.revId\n  GROUP BY\n    c.collectionId\n  ORDER BY\n    c.collectionId\n  `\n  const sqlLabelCountsByCollection = `\n  SELECT\n    cast(c.collectionId as char) as collectionId,\n    count(distinct cl.clId) as collectionLabels,\n    count(distinct clam.assetId) as labeledAssets,\n    count(distinct clam.claId) as assetLabels\n  FROM\n    collection c\n    left join collection_label cl on cl.collectionId = c.collectionId\n    left join collection_label_asset_map clam on clam.clId = cl.clId\n    left join asset a on clam.assetId = a.assetId and a.state = \"enabled\"\n  GROUP BY\n    c.collectionId\n  `  \n  const sqlGrantsByCollection = `\n  with ctePerGrantee as (\n    select\n      cg.collectionId, \n      json_object(\n        'grantId', cg.grantId,\n        'grantee', json_object(\n          'userId', cg.userId,\n          'userGroupId', cg.userGroupId\n        ),\n        'ruleCounts', json_object(\n          'rw', SUM(CASE WHEN cga.access = 'rw' THEN 1 ELSE 0 END),\n          'r', SUM(CASE WHEN cga.access = 'r' THEN 1 ELSE 0 END),\n          'none', SUM(CASE WHEN cga.access = 'none' THEN 1 ELSE 0 END)\n        ), \n        'uniqueAssets', count(distinct if(a.state = 'enabled', sam.assetId, null)),\n        'uniqueAssetsDisabled', count(distinct if(a.state = 'disabled', sam.assetId, null)),\n        'uniqueStigs', count(distinct if(a.state = 'enabled', sam.benchmarkId, null)),\n        'uniqueStigsDisabled', count(distinct if(a.state = 'disabled', sam.benchmarkId, null)),\n        'role', \n          case when cg.roleId = 1 then 'restricted' else \n            case when cg.roleId = 2 then 'full' else\n              case when cg.roleId = 3 then 'manage' else\n                case when cg.roleId = 4 then 'owner'\n                end\n              end\n            end\n          end\n      ) as perGrantee\n    from \n      collection_grant cg\n      left join collection_grant_acl cga ON cg.grantId = cga.grantId\n      left join stig_asset_map sam on sam.assetId=cga.assetId and sam.benchmarkId=cga.benchmarkId\n      left join asset a on a.assetId = sam.assetId\n    group by\n      cg.grantId)\n    select \n      collectionId, \n      json_arrayagg(perGrantee) as grants\n    from \n      ctePerGrantee\n    group by \n      collectionId`\n  const sqlRoleCountsByCollection = `\n  SELECT \n    collectionId,\n    SUM(CASE WHEN roleId = 1 THEN 1 ELSE 0 END) AS restricted,\n    SUM(CASE WHEN roleId = 2 THEN 1 ELSE 0 END) AS full,\n    SUM(CASE WHEN roleId = 3 THEN 1 ELSE 0 END) AS manage,\n    SUM(CASE WHEN roleId = 4 THEN 1 ELSE 0 END) AS owner\n  FROM \n    collection_grant\n  GROUP BY \n    collectionId\n  ORDER BY \n    collectionId\n  `\n  const sqlUserInfo = `\n  select \n    ud.userId,\n    ud.username,\n    ud.created, \n    ud.lastAccess,\n    coalesce(\n      JSON_EXTRACT(ud.lastClaims, '$.${config.oauth.claims.privileges}'),\n      json_array()\n    ) as privileges,\n    json_object(\n\t\t  \"restricted\", sum(case when cg.roleId = 1 then 1 else 0 end),\n      \"full\", sum(case when cg.roleId = 2 then 1 else 0 end),\n\t\t  \"manage\", sum(case when cg.roleId = 3 then 1 else 0 end),\n      \"owner\", sum(case when cg.roleId = 4 then 1 else 0 end)\n\t  ) as roles\n  from \n    user_data ud\n    left join collection_grant cg using (userId)\n  group by\n\t  ud.userId\n  `\n\n  const sqlUserGroupInfo = `\n  select \n    ug.userGroupId,\n    ug.name,\n    count(distinct ugum.userId) as members,\n    ug.createdDate as created, \n    ug.modifiedDate, \n    json_object(\n        \"restricted\", count(distinct case when cg.roleId = 1 then cg.collectionId else null end),\n        \"full\", count(distinct case when cg.roleId = 2 then cg.collectionId else null end),\n        \"manage\", count(distinct case when cg.roleId = 3 then cg.collectionId else null end),\n        \"owner\", count(distinct case when cg.roleId = 4 then cg.collectionId else null end)\n    ) as roles\n  from \n    user_group ug\n    left join collection_grant cg on cg.userGroupId = ug.userGroupId\n\t  left join user_group_user_map ugum ON ugum.userGroupId = ug.userGroupId\n  group by\n\t  ug.userGroupId\n  `  \n  const sqlMySqlVersion = `SELECT VERSION() as version`\n\n  const mySqlVariablesOnly = [\n    'innodb_buffer_pool_size',\n    'innodb_buffer_pool_instances',\n    'innodb_log_buffer_size',\n    'innodb_log_file_size',\n    'innodb_redo_log_capacity',\n    'innodb_io_capacity',\n    'innodb_io_capacity_max',\n    'innodb_flush_sync',\n    'innodb_lock_wait_timeout',\n    'innodb_change_buffering',\n    'innodb_flush_log_at_trx_commit',\n    'innodb_doublewrite',\n    'tmp_table_size',\n    'max_heap_table_size',\n    'temptable_max_mmap',\n    'temptable_max_ram',\n    'key_buffer_size',\n    'sort_buffer_size',\n    'read_buffer_size',\n    'read_rnd_buffer_size',\n    'join_buffer_size',\n    'binlog_cache_size',\n    'max_connections',\n    'max_allowed_packet',\n    'thread_cache_size',\n    'table_open_cache',\n    'table_definition_cache',\n    'version',\n    'version_compile_machine',\n    'version_compile_os',\n    'long_query_time'\n  ]\n  const sqlMySqlVariablesValues = `\n  SELECT \n    variable_name,\n    variable_value as value\n    FROM \n    performance_schema.global_variables\n  WHERE \n    variable_name IN (${mySqlVariablesOnly.map(v => `'${v}'`).join(',')})\n    ORDER by variable_name\n  `\n  const mySqlStatusOnly = [\n  // Network\n  'Bytes_received',\n  'Bytes_sent',\n  // Handler operations\n  'Handler_commit',\n  'Handler_update',\n  'Handler_write',\n  // Buffer pool health (performance monitoring)\n  'Innodb_buffer_pool_bytes_data',\n  'Innodb_buffer_pool_pages_total',\n  'Innodb_buffer_pool_pages_free',\n  'Innodb_buffer_pool_pages_dirty',\n  'Innodb_buffer_pool_pages_flushed',\n  'Innodb_buffer_pool_read_requests',\n  'Innodb_buffer_pool_reads',\n  'Innodb_buffer_pool_wait_free',\n  // Redo log / Checkpoint (detect checkpoint thrashing)\n  'Innodb_redo_log_current_lsn',\n  'Innodb_redo_log_checkpoint_lsn',\n  'Innodb_redo_log_flushed_to_disk_lsn',\n  'Innodb_log_waits',\n  'Innodb_log_writes',\n  'Innodb_os_log_fsyncs',\n  // I/O operations\n  'Innodb_data_reads',\n  'Innodb_data_writes',\n  'Innodb_data_fsyncs',\n  'Innodb_pages_read',\n  'Innodb_pages_written',\n  'Innodb_pages_created',\n  // Row operations\n  'Innodb_rows_read',\n  'Innodb_rows_updated',\n  'Innodb_rows_inserted',\n  'Innodb_rows_deleted',\n  // Row locking\n  'Innodb_row_lock_waits',\n  'Innodb_row_lock_current_waits',\n  'Innodb_row_lock_time',\n  'Innodb_row_lock_time_avg',\n  'Innodb_row_lock_time_max',\n  // Temp tables\n  'Created_tmp_tables',\n  'Created_tmp_disk_tables',\n  'Created_tmp_files',\n  // Table cache\n  'Open_tables',\n  'Opened_tables',\n  'Table_open_cache_hits',\n  'Table_open_cache_misses',\n  'Table_open_cache_overflows',\n  // Connections/Threads\n  'Connections',\n  'Max_used_connections',\n  'Threads_connected',\n  'Threads_running',\n  'Threads_created',\n  'Threads_cached',\n  'Aborted_connects',\n  'Aborted_clients',\n  // Queries\n  'Queries',\n  'Slow_queries',\n  'Select_scan',\n  'Select_full_join',\n  'Select_full_range_join',\n  // Sorts\n  'Sort_merge_passes',\n  'Sort_scan',\n  'Sort_range',\n  'Sort_rows',\n  // Table locks\n  'Table_locks_immediate',\n  'Table_locks_waited',\n  // Server\n  'Uptime',\n  'Uptime_since_flush_status'\n  ]\n  const sqlMySqlStatusValues = `\n  SELECT \n    variable_name,\n    variable_value as value\n  FROM \n    performance_schema.global_status\n  WHERE \n    variable_name IN (\n        ${mySqlStatusOnly.map( v => `'${v}'`).join(',')}\n    )\n  ORDER by variable_name\n  `\n  await dbUtils.pool.query(sqlAnalyze)\n  const [schemaInfoArray] = await dbUtils.pool.query(sqlInfoSchema, [config.database.schema])\n  const tables = createObjectFromKeyValue(schemaInfoArray, \"tableName\")\n\n  const queries = [\n    dbUtils.pool.query(sqlCollectionAssetStigs),\n    dbUtils.pool.query(sqlCountsByCollection),\n    dbUtils.pool.query(sqlLabelCountsByCollection),\n    dbUtils.pool.query(sqlGrantsByCollection),\n    dbUtils.pool.query(sqlRoleCountsByCollection),\n    dbUtils.pool.query(sqlUserInfo),\n    dbUtils.pool.query(sqlUserGroupInfo),\n    dbUtils.pool.query(sqlMySqlVersion),\n    dbUtils.pool.query(sqlMySqlVariablesValues),\n    dbUtils.pool.query(sqlMySqlStatusValues)\n  ]\n\n  // Conditionally add row count queries\n  if (includeRowCounts) {\n    const rowCountQueries = []\n    for (const table in tables) {\n      rowCountQueries.push(dbUtils.pool.query(`SELECT \"${table}\" as tableName, count(*) as rowCount from ${table}`))\n    }\n    queries.push(Promise.all(rowCountQueries))\n  }\n\n  const results = await Promise.all(queries)\n  \n  let [\n    [assetStigByCollection],\n    [countsByCollection],\n    [labelCountsByCollection],\n    [grantsByCollection],\n    [roleCountsByCollection],\n    [userInfo],\n    [userGroupInfo],\n    [mySqlVersion],\n    [mySqlVariables],\n    [mySqlStatus],\n    rowCountResults\n  ] = results\n\n  // Set row counts from individual queries or use null when not counting\n  if (includeRowCounts) {\n    for (const result of rowCountResults) {\n      tables[result[0][0].tableName].rowCount = result[0][0].rowCount\n    }\n  } else {\n    // Use null to indicate exact row counts were not requested\n    for (const tableName in tables) {\n      tables[tableName].rowCount = null\n    }\n  }\n\n  // remove strings from user privileges array that are not meaningful to stigman\n  const stigmanPrivs = ['admin', 'create_collection']\n  for (const user of userInfo ) {\n    user.privileges = user.privileges.filter(v => stigmanPrivs.includes(v))\n  }\n\n  //count privilege assignments and break out by lastAccess time periods\n  const userPrivilegeCounts = breakOutPrivilegeUsage(userInfo)\n\n  //create working copy of operational stats\n  const requests = klona(logger.requestStats)\n\n  requests.operationIds = sortObjectByKeys(requests.operationIds)\n\n  // Create objects keyed by collectionId from arrays of objects\n  countsByCollection = createObjectFromKeyValue(countsByCollection, \"collectionId\")\n  labelCountsByCollection = createObjectFromKeyValue(labelCountsByCollection, \"collectionId\")\n  assetStigByCollection = createObjectFromKeyValue(assetStigByCollection, \"collectionId\")\n  grantsByCollection = createObjectFromKeyValue(grantsByCollection, \"collectionId\")\n  roleCountsByCollection = createObjectFromKeyValue(roleCountsByCollection, \"collectionId\")\n\n  // Bundle \"byCollection\" stats together by collectionId\n  for(const collectionId in countsByCollection) {\n    if (assetStigByCollection[collectionId]) {\n      countsByCollection[collectionId].assetStigRanges = assetStigByCollection[collectionId]\n    }\n    if (grantsByCollection[collectionId]) {\n      const grants = {}\n      \n      // For each ACL in the collection's array of ACLs\n      for (const grant of grantsByCollection[collectionId].grants) {\n          grants[grant.grantId] = grant\n          delete grant.grantId\n      }\n      \n      countsByCollection[collectionId].grants = grants\n    }\n    else {\n      countsByCollection[collectionId].grants = {}\n    }\n    if (roleCountsByCollection[collectionId]) {\n      countsByCollection[collectionId].roleCounts = roleCountsByCollection[collectionId]\n    }\n    else {\n      countsByCollection[collectionId].roleCounts = {\n        restricted: 0,\n        full: 0,\n        manage: 0,\n        owner: 0\n      }\n    }    \n    if (labelCountsByCollection[collectionId]) {\n      countsByCollection[collectionId].labelCounts = labelCountsByCollection[collectionId]\n    }\n  }\n\n  const returnObj = {\n    date: new Date().toISOString(),\n    schema,\n    version: config.version,\n    collections: countsByCollection,\n    requests,\n    users: {\n      userInfo: createObjectFromKeyValue(userInfo, \"userId\", null),\n      userPrivilegeCounts\n    },\n    groups: createObjectFromKeyValue(userGroupInfo, \"userGroupId\", null),\n    mysql: {\n      version: mySqlVersion[0].version,\n      tables,\n      variables: createObjectFromKeyValue(mySqlVariables, \"variable_name\", \"value\"),\n      status: createObjectFromKeyValue(mySqlStatus, \"variable_name\", \"value\")\n    },\n    nodejs: getNodeValues()\n  }\n  return returnObj\n\n  // Reduce an array of objects to a single object, using the value of one property as keys\n  // and either assigning the rest of the object or the value of a second property as the value.\n  function createObjectFromKeyValue(data, keyPropertyName, valuePropertyName = null, includeKey = false) {\n    return data.reduce((acc, item) => {\n      const { [keyPropertyName]: key, ...rest } = item\n      acc[key] = valuePropertyName ? item[valuePropertyName] : includeKey ? item : rest\n      return acc\n    }, {})\n  }\n\n  function sortObjectByKeys(obj) {\n    // Create a new object and add properties in sorted order\n    const sortedObj = {}\n    for (const key of Object.keys(obj).sort()) {\n      sortedObj[key] = obj[key]\n    }\n    return sortedObj\n  }\n\n  function breakOutPrivilegeUsage(userInfo) {\n    let privilegeCounts = {\n      overall: {none:0},\n      activeInLast30Days: {none:0},\n      activeInLast90Days: {none:0}\n    }\n    \n    // Calculate the timestamps for 30 and 90 days ago\n    const currentTime = Math.floor(Date.now() / 1000)\n    const thirtyDaysAgo = currentTime - (30 * 24 * 60 * 60)\n    const ninetyDaysAgo = currentTime - (90 * 24 * 60 * 60)\n    const updateCounts = (categoryCounts, userPrivs) => {\n      if (userPrivs.length === 0) {\n        categoryCounts.none++\n      }\n      for (const privilege of userPrivs) {\n        categoryCounts[privilege] = categoryCounts[privilege] ? categoryCounts[privilege] + 1 : 1\n      }\n    }\n\n    for (const user of userInfo) {\n      updateCounts(privilegeCounts.overall, user.privileges)\n      // Update counts for the last 30 and 90 days based on lastAccess\n      if (user.lastAccess >= ninetyDaysAgo) {\n        updateCounts(privilegeCounts.activeInLast90Days, user.privileges)\n      }\n      if (user.lastAccess >= thirtyDaysAgo) {\n        updateCounts(privilegeCounts.activeInLast30Days, user.privileges)\n      }\n    }\n    return privilegeCounts\n  }\n\n  function getNodeValues() {\n    const {environmentVariables, header, resourceUsage} = process.report.getReport()\n    \n    const environment = {}\n    for (const [key, value] of Object.entries(environmentVariables)) {\n      if (/^(NODE|STIGMAN)_/.test(key)) {\n        environment[key] = key === 'STIGMAN_DB_PASSWORD' ? '***' : value\n      }\n    }\n    const {platform, arch, nodejsVersion, cpus, osMachine, osName, osRelease} = header\n    for (let x = 0; x < cpus.length; x++) {\n      cpus[x] = {model: cpus[x].model, speed: cpus[x].speed}\n    }\n    const loadAverage = os.loadavg().join(', ')\n\n    const memory = process.memoryUsage()\n    memory.maxRss = resourceUsage.maxRss\n    return {\n      version: nodejsVersion.substring(1),\n      uptime: process.uptime(),\n      os: {\n        platform,\n        arch,\n        osMachine,\n        osName,\n        osRelease,\n        loadAverage\n      },\n      environment,\n      memory,\n      cpus\n    }\n  }\n}\n\n"
  },
  {
    "path": "api/source/service/ReviewService.js",
    "content": "'use strict';\nconst dbUtils = require('./utils')\n\nlet _this = this\n\nexports.postReviewBatch = async function ({\n  source, \n  assets, \n  rules,\n  action,\n  updateFilters,\n  dryRun,\n  collectionId, \n  userId,\n  grant,\n  svcStatus,\n  historyMaxReviews,\n  skipGrantCheck = false\n}) {\n  function cteReviewGen(obj) {\n    const cte = `SELECT\n    jtresult.resultId,\n    TRIM(jt.detail) as detail,\n    TRIM(jt.comment) as comment,\n    jt.resultEngine,\n    jt.metadata,\n    jtstatus.statusId,\n    jt.statusText\n    FROM\n    JSON_TABLE(\n      @review,\n      \"$\"\n      COLUMNS(\n      result VARCHAR(255) PATH \"$.result\",\n      detail MEDIUMTEXT PATH \"$.detail\" NULL ON EMPTY,\n      comment MEDIUMTEXT PATH \"$.comment\",\n      resultEngine JSON PATH \"$.resultEngine\" DEFAULT '0' ON EMPTY,\n      metadata JSON PATH \"$.metadata\",\n      statusLabel VARCHAR(255) PATH \"$.status.label\",\n      statusText VARCHAR(511) PATH \"$.status.text\"\n      )\n    ) as jt\n    left join result jtresult on (jtresult.api = jt.result)\n    left join status jtstatus on (jtstatus.api = jt.statusLabel)`\n    return `cteReview AS (${cte})`\n  }\n  \n  function cteAssetGen({assetIds = [], benchmarkIds = []}, roleId) {\n    let cte\n    if (assetIds?.length) {\n      const json = JSON.stringify(assetIds)\n      const sql = `select jtAssets.assetId\n    from\n      json_table(\n        ?,\n        '$[*]'\n        COLUMNS (assetId INT PATH '$') \n      ) as jtAssets`\n      cte = dbUtils.pool.format(sql,[json])\n    }\n    else if (benchmarkIds?.length) {\n      const sql = `select distinct assetId \n      from\n        enabled_asset a\n        left join stig_asset_map sa using (assetId)\n        ${roleId === 1 ? 'inner' : 'left'} join cteAclEffective cae on sa.saId = cae.saId\n      where\n        a.collectionId = @collectionId \n        and coalesce(cae.access, 'rw') = 'rw'\n        and sa.benchmarkId IN ?`\n      cte = dbUtils.pool.format(sql,[[benchmarkIds]])\n    }\n    return `cteAsset AS (${cte})`\n  }\n  \n  function cteRuleGen({ruleIds, benchmarkIds, collectionId}) {\n    let cte\n    if (ruleIds?.length) {\n      const json = JSON.stringify(ruleIds)\n      const sql = `select jtRules.ruleId\n    from\n      json_table(\n        ?,\n        '$[*]'\n        COLUMNS (ruleId VARCHAR(255) PATH '$') \n      ) as jtRules`\n      cte = dbUtils.pool.format(sql,[json])\n    }\n    else if (benchmarkIds?.length) {\n      const sql = `select rgr.ruleId from default_rev dr left join rev_group_rule_map rgr using (revId) where dr.benchmarkId IN ? and dr.collectionId = ?`\n      cte = dbUtils.pool.format(sql,[[benchmarkIds], collectionId])\n    }\n    return `cteRule AS (${cte})`\n  }\n  \n  function cteGrantGen(roleId) {\n    const cte = `select\n    distinct a.assetId,\n    rgr.ruleId \n  from \n    enabled_asset a\n    left join stig_asset_map sa using (assetId)\n    ${roleId === 1 ? 'inner' : 'left'} join cteAclEffective cae on sa.saId = cae.saId\n    left join revision rev on sa.benchmarkId = rev.benchmarkId\n    left join rev_group_rule_map rgr using (revId)\n  where \n    a.assetId IN (select assetId from cteAsset)\n    and rgr.ruleId IN (select ruleId from cteRule)\n    and coalesce(cae.access, 'rw') = 'rw'`\n    \n    return `cteGrant AS (${cte})`\n  }\n  \n  function cteCollectionSettingGen () {\n    const cte = `SELECT \n    c.settings->>\"$.fields.detail.required\" as detailRequired,\n    c.settings->>\"$.fields.comment.required\" as commentRequired,\n    c.settings->>\"$.status.canAccept\" as canAccept,\n    c.settings->>\"$.status.resetCriteria\" as resetCriteria,\n    c.settings->>\"$.status.minAcceptGrant\" as minAcceptGrant\n  FROM\n    enabled_collection c\n  where\n    collectionId = @collectionId`\n    return `cteCollectionSetting AS (${cte})`\n  }\n  \n  const mergeFilterOperators = {\n    contains: 'LIKE',\n    beginsWith: 'LIKE',\n    endsWith: 'LIKE',\n    equals: '=',\n    notequal: '!=',\n    greaterThan: '>',\n    lessThan: '<',\n  }\n  \n  function genFilter(filter) {\n    let {field, condition = 'equals', value} = filter\n    if (field === 'result') {\n      field = 'resultId'\n      value = dbUtils.REVIEW_RESULT_API[value]\n    }\n    if (field === 'status' || field === 'statusLabel') {\n      field = 'statusId'\n      value = dbUtils.REVIEW_STATUS_API[value]\n    }\n  \n    value = field === 'userId' || field === 'statusUserId' ? parseInt(value) : value\n  \n    const sqlOperator = mergeFilterOperators[condition]\n    const isDateValue =  (field === 'ts' || field === 'touchTs' || field === 'statusTs')\n    let sqlValue\n    if (isDateValue) {\n      sqlValue = dbUtils.pool.escape(new Date(value))\n    }\n    else if (condition === 'contains') {\n      sqlValue = dbUtils.pool.escape(`%${value}%`)\n    }\n    else if (condition === 'beginsWith') {\n      sqlValue = dbUtils.pool.escape(`${value}%`)\n    }\n    else if (condition === 'endsWith') {\n      sqlValue = dbUtils.pool.escape(`%${value}`)\n    }\n    else {\n      sqlValue = dbUtils.pool.escape(value)\n    }\n    return `review.${field} ${sqlOperator} ${sqlValue}`\n  }\n  \n  function cteCandidateGen ({skipGrantCheck = false, action, updateFilters}) {\n    let sqlFilterPredicates, sqlPredicates\n    if (updateFilters) {\n      sqlFilterPredicates = updateFilters.map( filter => genFilter(filter)).join(' AND ')\n    }\n  \n    if (action === 'insert') {\n      sqlPredicates = `review.reviewId is null`\n    }\n    else if (action === 'update') {\n      sqlPredicates = sqlFilterPredicates || 'review.reviewId is not null'\n    }\n    else if (action === 'merge') {\n      sqlPredicates = `${sqlFilterPredicates ? `review.reviewId is null OR (${sqlFilterPredicates})` : ''}`\n    }\n    const cte = `\n  select\n    ${!skipGrantCheck ? 'CASE WHEN cteGrant.assetId is not null then 1 else null end' : '1'} as granted,\n    review.reviewId,\n    cteAsset.assetId,\n    cteRule.ruleId,\n    rvcd.version,\n    rvcd.checkDigest,\n    \n    COALESCE(cteReview.resultId, review.resultId) as resultId,\n    COALESCE(cteReview.detail, review.detail, '') as detail,\n    COALESCE(cteReview.comment, review.comment, '') as comment,\n    COALESCE(cteReview.metadata, review.metadata, '{}') as metadata,\n    \n    CASE WHEN cteReview.resultEngine != 0 -- resultEngine present\n      THEN cteReview.resultEngine\n      ELSE\n      CASE WHEN cteReview.resultId is null or cteReview.resultId = review.resultId\n        THEN review.resultEngine\n        ELSE NULL\n      END\n    END as resultEngine,\n      \n    CASE WHEN cteReview.statusId is not null\n      THEN cteReview.statusId\n      ELSE\n        CASE WHEN review.reviewId is null\n            or (cteCollectionSetting.resetCriteria = 'result' and rChangedResult.reviewId is not null)\n            or (cteCollectionSetting.resetCriteria = 'any' and rChangedAny.reviewId is not null)\n          THEN 0\n          ELSE review.statusId\n        END\n    END as statusId,\n      \n    CASE WHEN cteReview.statusId is not null or review.reviewId is null\n      THEN cteReview.statusText\n      ELSE\n        CASE WHEN (cteCollectionSetting.resetCriteria = 'result' and rChangedResult.reviewId is not null)\n            or (cteCollectionSetting.resetCriteria = 'any' and rChangedAny.reviewId is not null)\n          THEN 'Review change triggered status update'\n          ELSE review.statusText\n        END\n    END as statusText,\n      \n    CASE WHEN cteReview.statusId is not null \n        or review.reviewId is null\n        or (cteCollectionSetting.resetCriteria = 'result' and rChangedResult.reviewId is not null)\n        or (cteCollectionSetting.resetCriteria = 'any' and rChangedAny.reviewId is not null)\n      THEN UTC_TIMESTAMP()\n      ELSE review.statusTs\n    END as statusTs,\n    \n    CASE WHEN cteReview.statusId is not null \n        or review.reviewId is null\n        or (cteCollectionSetting.resetCriteria = 'result' and rChangedResult.reviewId is not null)\n        or (cteCollectionSetting.resetCriteria = 'any' and rChangedAny.reviewId is not null)\n      THEN @userId\n      ELSE review.statusUserId\n    END as statusUserId,\n      \n    CASE WHEN cteReview.resultId is not null\n        or cteReview.detail is not null\n        or cteReview.comment is not null\n        or review.reviewId is null\n      THEN @userId\n      ELSE review.userId\n    END as userId,\n      \n    CASE WHEN cteReview.resultId is not null\n        or cteReview.detail is not null\n        or cteReview.comment is not null\n        or review.reviewId is null\n      THEN UTC_TIMESTAMP()\n      ELSE review.ts\n    END as ts\n  \n  from\n    cteAsset\n    CROSS JOIN cteRule\n    LEFT JOIN cteReview on true\n    ${!skipGrantCheck ? 'LEFT JOIN cteGrant on (cteAsset.assetId = cteGrant.assetId and cteRule.ruleId = cteGrant.ruleId)' : ''}\n    LEFT JOIN rule_version_check_digest rvcd on cteRule.ruleId = rvcd.ruleId\n    LEFT JOIN review on (cteAsset.assetId = review.assetId and rvcd.version = review.version and rvcd.checkDigest = review.checkDigest)\n    LEFT JOIN cteCollectionSetting on true\n    LEFT JOIN review rChangedResult on (\n      rChangedResult.reviewId = review.reviewId \n      and rChangedResult.statusId != 0\n      and rChangedResult.resultId != cteReview.resultId\n    )\n    LEFT JOIN review rChangedAny on (\n      rChangedAny.reviewId = review.reviewId \n      and rChangedAny.statusId != 0\n      and (rChangedAny.resultId != cteReview.resultId or rChangedAny.detail != cteReview.detail or rChangedAny.comment != cteReview.comment)\n    )\n    ${sqlPredicates ? `WHERE ${sqlPredicates}` : ''}\n    `\n    return `cteCandidate AS (${cte})`\n  }\n  \n  const cteReview = cteReviewGen()\n  const cteAsset = cteAssetGen(assets, grant.roleId)\n  if (rules.benchmarkIds) {\n    rules.collectionId = collectionId\n  }\n  const cteRule = cteRuleGen(rules)\n  let cteGrant\n  if (!skipGrantCheck) {\n    cteGrant = cteGrantGen(grant.roleId)\n  }\n  const cteCollectionSetting = cteCollectionSettingGen()\n  const cteCandidate = cteCandidateGen({skipGrantCheck, action, updateFilters})\n  const cteAclEffective = dbUtils.cteAclEffective({grantIds: grant.grantIds})\n  const sqlTempTable = `\nCREATE TEMPORARY TABLE IF NOT EXISTS validated_reviews (\n  INDEX idx_reviewId (reviewId),\n  INDEX id_error (error)\n)\nWITH\n${cteAclEffective},\n${cteReview},\n${cteAsset},\n${cteRule},\n${!skipGrantCheck ? `${cteGrant},` : ''}\n${cteCollectionSetting},\n${cteCandidate}\nselect\n  cteCandidate.reviewId, \n  cteCandidate.assetId, \n  cteCandidate.ruleId, \n  cteCandidate.version,\n  cteCandidate.checkDigest,\n  cteCandidate.resultId, \n  cteCandidate.detail, \n  cteCandidate.comment, \n  cteCandidate.resultEngine, \n  cteCandidate.metadata, \n  cteCandidate.statusId, \n  cteCandidate.statusText,\n  cteCandidate.statusUserId,\n  cteCandidate.statusTs,\n  cteCandidate.userId,\n  cteCandidate.ts,\n  CASE WHEN cteCandidate.granted IS NULL\n    THEN \n      'no grant for this asset/ruleId'\n    ELSE\n      CASE WHEN (cteCandidate.reviewId IS NULL AND cteCandidate.resultId IS NULL)\n        THEN \n          'cannot insert null result'\n        ELSE\n          CASE WHEN cteCandidate.statusId > 0 -- submitted, rejected, accepted\n            THEN\n              CASE WHEN (cteCandidate.resultId NOT IN (2,3,4))\n                THEN\n                  'status is not allowed for the result'\n                ELSE\n                  CASE WHEN (cteCollectionSetting.detailRequired = 'always' AND cteCandidate.detail = '')\n                    THEN \n                      'detail is empty and detail.required = always'\n                    ELSE\n                      CASE WHEN (cteCollectionSetting.commentRequired = 'always' AND cteCandidate.comment = '')\n                        THEN \n                          'comment is empty and comment.required = always'\n                        ELSE\n                          CASE WHEN cteCandidate.resultId = 4 -- fail\n                            THEN\n                              CASE WHEN (cteCollectionSetting.detailRequired = 'findings' AND cteCandidate.detail = '')\n                                THEN \n                                  'detail is empty and detail.required = findings'\n                                ELSE\n                                  CASE WHEN (cteCollectionSetting.commentRequired = 'findings' AND cteCandidate.comment = '')\n                                    THEN \n                                      'comment is empty and comment.required = findings '\n                                  END\n                              END\n                          END\n                      END\n                  END\n              END\n          END\n      END\n\tEND as error\nfrom\n  cteCandidate\n  LEFT JOIN cteCollectionSetting on true`\n  const sqlHistoryPrune = `\n  with historyRecs AS (\n    select\n      rh.historyId,\n      ROW_NUMBER() OVER (PARTITION BY r.assetId, r.version, r.checkDigest ORDER BY rh.historyId DESC) as rowNum\n    from\n      review_history rh\n      left join review r using (reviewId)\n    where\n      reviewId IN (SELECT reviewId from validated_reviews where error is null and reviewId is not null)\n  )\n  delete review_history\n  FROM \n     review_history\n     left join historyRecs on review_history.historyId = historyRecs.historyId \n  WHERE \n     historyRecs.rowNum > ? - 1\n  `\n  const sqlHistory = `  \n  INSERT INTO review_history (\n    reviewId,\n    ruleId,\n    resultId,\n    detail,\n    comment,\n    autoResult,\n    ts,\n    userId,\n    statusText,\n    statusUserId,\n    statusTs,\n    statusId,\n    touchTs,\n    resultEngine\n  ) SELECT \n      reviewId,\n      ruleId,\n      resultId,\n      LEFT(detail,32767) as detail,\n      LEFT(comment,32767) as comment,\n      autoResult,\n      ts,\n      userId,\n      statusText,\n      statusUserId,\n      statusTs,\n      statusId,\n      touchTs,\n      CASE WHEN resultEngine = 0 THEN NULL ELSE resultEngine END\n    FROM\n      review \n    WHERE\n      reviewId IN (SELECT reviewId from validated_reviews where error is null and reviewId is not null)\n    FOR UPDATE    \n  `\n  const sqlInsertReviews = `\n  insert into review (\n    assetId,\n    ruleId,\n    \\`version\\`,\n    checkDigest,\n    resultId,\n    resultEngine,\n    detail,\n    comment,\n    metadata,\n    statusId,\n    statusText,\n    statusUserId,\n    statusTs,\n    userId,\n    ts)\n  select \n    assetId,\n    ruleId,\n    \\`version\\`,\n    checkDigest,\n    resultId,\n    resultEngine,\n    detail,\n    comment,\n    metadata,\n    statusId,\n    statusText,\n    statusUserId,\n    statusTs,\n    userId,\n    ts\n  from\n    validated_reviews vr\n  where\n    error is null and reviewId is null \n  `\n  const sqlUpdateReviews = `\n  update\n    review r\n    inner join validated_reviews vr on (r.reviewId = vr.reviewId and vr.error is null)\n  set\n    r.resultId = vr.resultId,\n    r.resultEngine = vr.resultEngine,\n    r.detail = vr.detail,\n    r.comment = vr.comment,\n    r.metadata = vr.metadata,\n    r.statusId = vr.statusId,\n    r.statusText = vr.statusText,\n    r.statusUserId = vr.statusUserId,\n    r.statusTs = vr.statusTs,\n    r.userId = vr.userId,\n    r.ts = vr.ts\n  `\n\n  let connection\n  try {\n    connection = await dbUtils.pool.getConnection()\n    connection.config.namedPlaceholders = false\n\n    const sqlVariables = `set @collectionId = ?, @userId = ?, @review = ?`\n    await connection.query(sqlVariables, [parseInt(collectionId), parseInt(userId), JSON.stringify(source.review)])\n    await connection.query(sqlTempTable)\n    \n    let validationErrors = []\n    \n    let [counts] = await connection.query(`select\n    coalesce(sum(case when error is not null then 1 else 0 end),0) as failedValidations,\n    coalesce(sum(case when error is null and reviewId is null then 1 else 0 end),0) as inserts,\n    coalesce(sum(case when error is null and reviewId is not null then 1 else 0 end),0) as updates\n    from validated_reviews`)\n    if (counts[0].failedValidations) {\n      ;[validationErrors] = await connection.query('select CAST(assetId AS CHAR) as assetId, ruleId, error from validated_reviews where error is not null LIMIT 50')\n    }\n    async function transaction () {\n      await connection.query('START TRANSACTION')\n\n      if (counts[0].updates) {\n          await connection.query(sqlHistoryPrune, [ historyMaxReviews ])\n        if (historyMaxReviews !== 0) {\n          await connection.query(sqlHistory)\n        }\n        await connection.query(sqlUpdateReviews) \n      }\n      if (counts[0].inserts) {\n        await connection.query(sqlInsertReviews) \n      }\n      const statsParams = {\n        collectionId\n      }\n      if (assets.assetIds) {\n        statsParams.assetIds = assets.assetIds\n      }\n      else if (assets.benchmarkIds) {\n        statsParams.assetBenchmarkIds = assets.benchmarkIds\n      }\n      if (rules.ruleIds) {\n        statsParams.rules = rules.ruleIds\n      }\n      else if (rules.benchmarkIds) {\n        statsParams.benchmarkIds = rules.benchmarkIds\n      }\n      await dbUtils.updateStatsAssetStig(connection, statsParams)\n      await connection.commit()\n    }\n\n    if (!dryRun) {\n      await dbUtils.retryOnDeadlock(transaction, svcStatus)\n    }\n    if (dryRun) {\n      return {willInsert: counts[0].inserts, willUpdate: counts[0].updates, willFailValidation: counts[0].failedValidations, validationErrors}\n    }\n    return {inserted: counts[0].inserts, updated: counts[0].updates, failedValidation: counts[0].failedValidations, validationErrors}\n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }    \n    throw (err) ;\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.query('DROP TEMPORARY TABLE IF EXISTS validated_reviews')\n      await connection.release()\n    }\n  }\n}\n\n/**\nGeneralized queries for review(s).\n**/\nexports.getReviews = async function ({projections = [], filter = {}, grant}) {\n  const ctes = [dbUtils.cteAclEffective({grantIds: grant.grantIds})]\n  const hints = ['NO_MERGE(cae)']\n  const columns = [\n    'CAST(r.assetId as char) as assetId',\n    'a.name as \"assetName\"',\n    `coalesce(\n      (select\n        json_arrayagg(BIN_TO_UUID(cl.uuid,1))\n      from\n        collection_label_asset_map cla\n        left join collection_label cl on cla.clId = cl.clId\n      where\n        cla.assetId = r.assetId),\n      json_array()\n    ) as assetLabelIds`,\n    `coalesce(\n      (select\n        json_arrayagg(json_object(\n          'labelId', BIN_TO_UUID(cl.uuid,1),\n          'name', cl.name,\n          'color', cl.color\n        ))\n      from\n        collection_label_asset_map cla\n        left join collection_label cl on cla.clId = cl.clId\n      where\n        cla.assetId = r.assetId),\n      json_array()\n    ) as assetLabels`,\n    'r.ruleId',\n    `coalesce(cast(concat('[', group_concat(distinct concat('\"',rvcd2.ruleId,'\"')), ']') as json), json_array()) as ruleIds`,\n    'result.api as \"result\"',\n    'CASE WHEN r.resultEngine = 0 THEN NULL ELSE r.resultEngine END as resultEngine',\n    \"COALESCE(LEFT(r.detail,32767),'') as detail\",\n    \"COALESCE(LEFT(r.comment,32767),'') as comment\",\n    'r.autoResult',\n    'CAST(r.userId as char) as userId',\n    'ud.username',\n    \"DATE_FORMAT(r.ts, '%Y-%m-%dT%H:%i:%sZ') as ts\",\n    \"DATE_FORMAT(r.touchTs, '%Y-%m-%dT%H:%i:%sZ') as touchTs\",\n    `JSON_OBJECT(\n      'label', status.api,\n      'text', r.statusText,\n      'user', JSON_OBJECT(\n        'userId', CAST(r.statusUserId as char),\n        'username', udStatus.username\n      ),\n      'ts', DATE_FORMAT(r.statusTs, '%Y-%m-%dT%TZ')\n    ) as status`\n  ]\n  const groupBy = [\n    'r.reviewId',\n    'a.name',\n    'result.api',\n    'status.api',\n    'ud.username',\n    'udStatus.username',\n  ]\n  const joins = [\n    'review r',\n    'left join rule_version_check_digest rvcd on (r.version = rvcd.version and r.checkDigest = rvcd.checkDigest)',\n    'left join rule_version_check_digest rvcd2 on (r.version = rvcd2.version and r.checkDigest = rvcd2.checkDigest)',\n    'left join rev_group_rule_map rgr on rvcd.ruleId = rgr.ruleId',\n    'left join revision on rgr.revId = revision.revId',\n    'left join result on r.resultId = result.resultId',\n    'left join status on r.statusId = status.statusId',\n    'left join user_data ud on r.userId = ud.userId',\n    'left join user_data udStatus on r.statusUserId = udStatus.userId',\n    'left join enabled_asset a on r.assetId = a.assetId',\n    'left join default_rev dr on (rgr.revId = dr.revId and a.collectionId = dr.collectionId)',\n    'left join enabled_collection c on a.collectionId = c.collectionId',\n    'left join stig_asset_map sa on (r.assetId = sa.assetId and revision.benchmarkId = sa.benchmarkId)',\n  ]\n\n  if (grant.roleId === 1) {\n    joins.push('inner join cteAclEffective cae on sa.saId = cae.saId')\n    // newman tests will fail if we add the new column\n    columns.push('min(cae.access) as access')\n  }\n  else {\n    joins.push('left join cteAclEffective cae on sa.saId = cae.saId')\n    // newman tests will fail if we add the new column\n    columns.push(\"coalesce(min(cae.access), 'rw') as access\")\n  }\n\n  if (projections.includes('metadata')) {\n    columns.push(`r.metadata`)\n    groupBy.push(`r.metadata`)\n  }\n  if (projections.includes('stigs')) {\n    columns.push(`cast(\n      concat('[', \n        coalesce (\n          group_concat(distinct \n            case when sa.benchmarkId is not null then \n              json_object(\n                'benchmarkId', sa.benchmarkId, \n                'revisionStr', revision.revisionStr, \n                'benchmarkDate', date_format(revision.benchmarkDateSql,'%Y-%m-%d'),\n                'revisionPinned', CASE WHEN dr.revisionPinned = 1 THEN CAST(true as json) ELSE CAST(false as json) END, \n                'isDefault', case when revision.revId = dr.revId then cast(true as json) else cast(false as json) end,\n                'ruleCount', revision.ruleCount)\n            else null end \n          order by sa.benchmarkId),\n          ''),\n      ']')\n    as json) as \"stigs\"`)\n\n  }\n  if (projections.includes('rule')) {\n    columns.push(`json_object(\n        'ruleId' , rgr.ruleId,\n        'title' , rgr.title,\n        'version' , rgr.version,\n        'severity' , rgr.severity) as \"rule\"`\n    )\n    groupBy.push('rgr.severity','rgr.title','rgr.version','rgr.ruleId')\n  }\n  if (projections.includes('history')) {\n    // OVER clauses and subquery needed to order the json_arrayagg\n    columns.push(`\n    (select\n      coalesce(\n        (select json_arrayagg(\n              json_object(\n                'ts' , DATE_FORMAT(rh.ts, '%Y-%m-%dT%H:%i:%sZ'),\n                'ruleId', rh.ruleId,\n                'result', result.api,\n                'resultEngine', CASE WHEN rh.resultEngine = 0 THEN NULL ELSE rh.resultEngine END,\n                'detail', COALESCE(LEFT(rh.detail,32767),''),\n                'comment', COALESCE(LEFT(rh.comment,32767),''),\n                'autoResult', cast(rh.autoResult is true as json),\n                'userId', CAST(rh.userId as char),\n                'username', ud.username,\n                'status', JSON_OBJECT(\n                  'label', status.api,\n                  'text', rh.statusText,\n                  'user', JSON_OBJECT(\n                    'userId', CAST(rh.statusUserId as char),\n                    'username', udStatus.username\n                  ),\n                  'ts', DATE_FORMAT(rh.statusTs, '%Y-%m-%dT%TZ')\n                ),\n                'touchTs', DATE_FORMAT(rh.touchTs, '%Y-%m-%dT%TZ')\n              )\n            )\n          FROM\n            review_history rh\n            left join result on rh.resultId = result.resultId \n            left join status on rh.statusId = status.statusId \n            left join user_data ud on ud.userId=rh.userId\n            left join user_data udStatus on udStatus.userId=rh.statusUserId\n          where\n            rh.reviewId = r.reviewId),\n        json_array()\n      )\n    ) as \"history\"`)\n  }\n\n  const predicates = {\n    statements: [],\n    binds: []\n  }\n  \n  switch (filter.rules) {\n    case 'default-mapped':\n      predicates.statements.push(`dr.revId IS NOT NULL`)\n      predicates.statements.push(`sa.saId IS NOT NULL`)\n      break\n    case 'default':\n      predicates.statements.push(`dr.revId IS NOT NULL`)\n      break\n    case 'not-default-mapped':\n      predicates.statements.push(`dr.revId IS NULL`)\n      predicates.statements.push(`sa.saId IS NULL`)\n      break\n    case 'not-default':\n      predicates.statements.push(`dr.revId IS NULL`)\n      break\n    case 'not-mapped':\n      predicates.statements.push(`sa.saId IS NULL`)\n      break\n    case 'mapped':\n      predicates.statements.push(`sa.saId IS NOT NULL`)\n      break\n\n  }\n\n  if (filter.collectionId) {\n    predicates.statements.push('a.collectionId = ?')\n    predicates.binds.push(filter.collectionId)\n  }\n  if (filter.result) {\n    predicates.statements.push('result.api = ?')\n    predicates.binds.push(filter.result)\n  }\n  if (filter.status) {\n    predicates.statements.push('status.api = ?')\n    predicates.binds.push(filter.status)\n  }\n  if (filter.ruleId) {\n    predicates.statements.push('rvcd.ruleId = ?')\n    predicates.binds.push(filter.ruleId)\n  }\n  if (filter.groupId) {\n    predicates.statements.push(`rgr.groupId = ?`)\n    predicates.binds.push(filter.groupId)\n  }\n  if (filter.cci) {\n    predicates.statements.push(`rvcd.ruleId IN (\n      SELECT\n        distinct rgr.ruleId\n      FROM\n        rev_group_rule_cci_map rgrcc\n        left join rev_group_rule_map rgr using (rgrId)\n      WHERE\n        rgrcc.cci = ?\n      )` )\n      predicates.binds.push(filter.cci)\n  }\n  if (filter.userId) {\n    predicates.statements.push('r.userId = ?')\n    predicates.binds.push(filter.userId)\n  }\n  if (filter.assetId) {\n    predicates.statements.push('r.assetId = ?')\n    predicates.binds.push(filter.assetId)\n  }\n  if (filter.benchmarkId) {\n      predicates.statements.push(`revision.benchmarkId = ?`)\n      predicates.binds.push(filter.benchmarkId)\n  }\n  if ( filter.metadata ) {\n    for (const pair of filter.metadata) {\n      const [key, value] = pair.split(/:(.*)/s)\n      predicates.statements.push('JSON_CONTAINS(r.metadata, ?, ?)')\n      predicates.binds.push( `\"${value}\"`,  `$.${key}`)\n    }\n  }\n\n  const sql = dbUtils.makeQueryString({ctes, hints, columns, joins, predicates, groupBy, format: true})\n  const [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\nexports.exportReviews = async function (includeHistory = false) {\n  const columns = [\n    'CAST(r.assetId as char) as assetId',\n    'r.ruleId',\n    'result.api as \"result\"',\n    'CASE WHEN r.resultEngine = 0 THEN NULL ELSE r.resultEngine END as resultEngine',\n    'LEFT(r.detail,32767) as detail',\n    'LEFT(r.comment,32767) as comment',\n    'CAST(r.userId as char) as userId',\n    \"DATE_FORMAT(r.ts, '%Y-%m-%dT%H:%i:%sZ') as ts\",\n    \"DATE_FORMAT(r.touchTs, '%Y-%m-%dT%H:%i:%sZ') as touchTs\",\n    `JSON_OBJECT(\n      'label', status.api,\n      'text', r.statusText,\n      'userId', CAST(r.statusUserId as char),\n      'ts', DATE_FORMAT(r.statusTs, '%Y-%m-%dT%TZ')\n    ) as status`,\n    'r.metadata'\n  ]\n  const joins = [\n    'review r',\n    'inner join enabled_asset a on r.assetId = a.assetId',\n    'inner join enabled_collection c on c.collectionId = a.collectionId',\n    'left join result on r.resultId = result.resultId',\n    'left join status on r.statusId = status.statusId',\n  ]\n\n  let groupBy\n  if (includeHistory) {\n    columns.push(`\n    (select\n      coalesce(\n        (select json_arrayagg(\n              json_object(\n                'ts' , DATE_FORMAT(rh.ts, '%Y-%m-%dT%H:%i:%sZ'),\n                'ruleId', rh.ruleId,\n                'result', result.api,\n                'resultEngine', CASE WHEN rh.resultEngine = 0 THEN NULL ELSE rh.resultEngine END,\n                'detail', LEFT(rh.detail,32767),\n                'comment', LEFT(rh.comment,32767),\n                'userId', CAST(rh.userId as char),\n                'status', JSON_OBJECT(\n                  'label', status.api,\n                  'text', rh.statusText,\n                  'userId', CAST(rh.statusUserId as char),\n                  'ts', DATE_FORMAT(rh.statusTs, '%Y-%m-%dT%TZ')\n                ),\n                'touchTs', DATE_FORMAT(rh.touchTs, '%Y-%m-%dT%TZ')\n              )\n            )\n          FROM\n            review_history rh\n            left join result on rh.resultId = result.resultId \n            left join status on rh.statusId = status.statusId \n          where\n            rh.reviewId = r.reviewId),\n        json_array()\n      )\n    ) as \"history\"`)\n    groupBy = [\n      'r.assetId',\n      'r.ruleId',\n      'r.resultId',\n      'result.api',\n      'r.resultEngine',\n      'r.detail',\n      'r.comment',\n      'status.api',\n      'r.userId',\n      'r.ts',\n      'r.statusText',\n      'r.statusUserId',\n      'r.statusTs',\n      'r.metadata',\n      'r.reviewId',\n    ]\n  }\n\n  const sql = dbUtils.makeQueryString({columns, joins, groupBy})\n  let [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\n\n/**\n * Delete a Review\n *\n * reviewId Integer A path parameter that indentifies a Review\n * projection List Additional properties to include in the response.  (optional)\n * returns ReviewProjected\n **/\nexports.deleteReviewByAssetRule = async function({assetId, ruleId, projections, grant, svcStatus = {}}) {\n  let connection\n  try {\n    let binds = {\n      assetId,\n      ruleId\n    }\n\n    let rows = await _this.getReviews({projections, filter: binds, grant})\n\n    binds = [assetId, ruleId]\n    \n    connection = await dbUtils.pool.getConnection()\n    async function transaction () {\n      await connection.query('START TRANSACTION')\n      let sqlDelete = `DELETE review \n        FROM review\n        LEFT JOIN rule_version_check_digest rvcd\n        ON (rvcd.version = review.version and rvcd.checkDigest = review.checkDigest)\n        WHERE review.assetId = ? AND rvcd.ruleId = ?`\n      await connection.query(sqlDelete, binds)\n      await dbUtils.updateStatsAssetStig( connection, {ruleId, assetId})\n      await connection.commit()\n    }\n    await dbUtils.retryOnDeadlock(transaction, svcStatus)\n    return (rows[0])\n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }    \n    throw (err) ;\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n\n}\n\nexports.putReviewsByAsset = async function ({\n  collectionId, \n  assetId,\n  reviews,\n  userId,\n  grant,\n  svcStatus\n  }) {\n  let connection\n  const sqlCreateTableValidatedReview = `\nCREATE TEMPORARY TABLE IF NOT EXISTS tt_validated_review (\n  INDEX idx_reviewId (reviewId),\n  INDEX idx_error (error),\n  PRIMARY KEY (ruleId),\n  UNIQUE KEY (\\`version\\`, checkDigest)\n)\nREPLACE WITH ${dbUtils.cteAclEffective({grantIds: grant.grantIds})},\ncteCollectionSetting AS (\nSELECT \n  c.settings->>\"$.fields.detail.required\" AS detailRequired,\n  c.settings->>\"$.fields.comment.required\" AS commentRequired,\n  c.settings->>\"$.status.canAccept\" AS collectionCanAccept,\n  CASE WHEN c.settings->>\"$.status.canAccept\" = 'true' AND c.settings->>\"$.status.minAcceptGrant\" <= @roleId\n    THEN 'true'\n    ELSE 'false'\n  END AS userCanAccept,\n  c.settings->>\"$.status.resetCriteria\" AS resetCriteria,\n  c.settings->>\"$.history.maxReviews\" AS maxReviews\nFROM\n  enabled_collection c\nWHERE\n  c.collectionId = @collectionId\n),\ncteIncoming AS (\nSELECT\n  jt.ruleId,\n  result.resultId,\n  TRIM(jt.detail) as detail,\n  TRIM(jt.comment) as comment,\n  jt.resultEngine,\n  jt.metadata,\n  coalesce(statuslabel.statusId, statusraw.statusId) as statusId,\n  jt.statusText\nFROM\n  JSON_TABLE(\n    @reviews,\n    \"$[*]\"\n    COLUMNS(\n    ruleId VARCHAR(45) PATH \"$.ruleId\",\n    result VARCHAR(255) PATH \"$.result\",\n    detail MEDIUMTEXT PATH \"$.detail\" NULL ON EMPTY,\n    comment MEDIUMTEXT PATH \"$.comment\",\n    resultEngine JSON PATH \"$.resultEngine\",\n    metadata JSON PATH \"$.metadata\",\n    statusRaw VARCHAR(255) PATH \"$.status\",\n    statusLabel VARCHAR(255) PATH \"$.status.label\",\n    statusText VARCHAR(511) PATH \"$.status.text\"\n    )\n  ) AS jt\n  left join result on (jt.result = result.api)\n  left join \\`status\\` statusraw on (jt.statusRaw = statusraw.api)\n  left join \\`status\\` statuslabel on (jt.statusLabel = statuslabel.api)\n),\ncteGrant AS (\nselect\n  distinct rgr.ruleId \nfrom \n  enabled_asset a\n  left join stig_asset_map sa using (assetId)\n  ${grant.roleId === 1 ? 'inner' : 'left'} join cteAclEffective cae on sa.saId = cae.saId\n  left join revision rev on sa.benchmarkId = rev.benchmarkId\n  left join rev_group_rule_map rgr using (revId)\nwhere\n  a.assetId = @assetId\n  and a.collectionId = @collectionId\n  and coalesce(cae.access, 'rw') = 'rw'\n),\ncteCandidate AS (\nselect\n  CASE WHEN cteGrant.ruleId is not null then 1 else null end as granted,\n  review.reviewId,\n  @assetId as assetId,\n  cteIncoming.ruleId,\n  rvcd.version,\n  rvcd.checkDigest,\n  \n  COALESCE(cteIncoming.resultId, review.resultId) as resultId,\n  COALESCE(cteIncoming.detail, review.detail, '') as detail,\n  COALESCE(cteIncoming.comment, review.comment, '') as comment,\n  COALESCE(cteIncoming.metadata, review.metadata, '{}') as metadata,\n  \n  CASE WHEN cteIncoming.resultEngine != 0 -- resultEngine present\n    THEN cteIncoming.resultEngine\n    ELSE\n      CASE WHEN cteIncoming.resultId is null -- result absent, patch only\n        THEN review.resultEngine\n        ELSE NULL\n      END\n  END as resultEngine,\n  \n  CASE WHEN cteIncoming.statusId is not null\n    THEN cteIncoming.statusId\n    ELSE\n      CASE WHEN review.reviewId is null\n          or (rChangedResult.reviewId is not null and cteCollectionSetting.resetCriteria = 'result')\n          or (rChangedAny.reviewId is not null and cteCollectionSetting.resetCriteria = 'any')\n        THEN 0\n        ELSE review.statusId\n      END\n  END as statusId,\n  \n  CASE WHEN cteIncoming.statusId is not null or review.reviewId is null\n    THEN cteIncoming.statusText\n    ELSE\n      CASE WHEN (cteCollectionSetting.resetCriteria = 'result' and rChangedResult.reviewId is not null)\n          or (cteCollectionSetting.resetCriteria = 'any' and rChangedAny.reviewId is not null)\n        THEN 'Review change triggered status update'\n        ELSE review.statusText\n      END\n  END as statusText,\n  \n  CASE WHEN cteIncoming.statusId is not null -- request contains a status\n      or review.reviewId is null -- no existing review\n      or (cteCollectionSetting.resetCriteria = 'result' and rChangedResult.reviewId is not null) -- status meets criteria for resetting\n      or (cteCollectionSetting.resetCriteria = 'any' and rChangedAny.reviewId is not null) -- status meets criteria for resetting\n    THEN @utcTimestamp -- now\n    ELSE review.statusTs -- saved time\n  END as statusTs,\n  \n  CASE WHEN cteIncoming.statusId is not null -- request contains a status\n      or review.reviewId is null -- no existing review\n      or (cteCollectionSetting.resetCriteria = 'result' and rChangedResult.reviewId is not null) -- status meets criteria for resetting\n      or (cteCollectionSetting.resetCriteria = 'any' and rChangedAny.reviewId is not null) -- status meets criteria for resetting\n    THEN @userId -- this user\n    ELSE review.statusUserId -- saved user\n  END as statusUserId,\n  \n  CASE WHEN review.reviewId is null -- no existing review\n      or cteIncoming.resultId is not null -- patch request contains result\n      or cteIncoming.detail is not null -- patch request contains detail\n      or cteIncoming.comment is not null -- patch request contains comment\n    THEN @userId  -- this user\n    ELSE review.userId -- saved user\n  END as userId,\n\n  CASE WHEN review.reviewId is null -- no existing review\n      or cteIncoming.resultId is not null -- patch request contains result\n      or cteIncoming.detail is not null -- patch request contains detail\n      or cteIncoming.comment is not null -- patch request contains comment\n    THEN @utcTimestamp -- now\n    ELSE review.ts -- saved time\n  END as ts\nfrom\n  cteIncoming\n  LEFT JOIN cteGrant on cteIncoming.ruleId = cteGrant.ruleId\n  LEFT JOIN rule_version_check_digest rvcd on cteGrant.ruleId = rvcd.ruleId\n  LEFT JOIN review on (@assetId = review.assetId and rvcd.version = review.version and rvcd.checkDigest = review.checkDigest)\n  LEFT JOIN cteCollectionSetting on true\n  LEFT JOIN review rChangedResult on (\n  review.reviewId = rChangedResult.reviewId\n    and rChangedResult.statusId != 0\n    and cteIncoming.resultId != rChangedResult.resultId\n  )\n  LEFT JOIN review rChangedAny on (\n    review.reviewId = rChangedAny.reviewId\n    and rChangedAny.statusId != 0\n    and (rChangedAny.resultId != cteIncoming.resultId or rChangedAny.detail != cteIncoming.detail or rChangedAny.comment != cteIncoming.comment)\n  )\n)\nselect\n  CASE WHEN cteCandidate.granted IS NULL\n    THEN \n      'no grant for this asset/ruleId'\n    ELSE\n      CASE WHEN cteCandidate.statusId > 0 -- submitted, rejected, accepted\n        THEN\n          CASE WHEN (cteCollectionSetting.collectionCanAccept = 'false' and cteCandidate.statusId IN (2,3))\n            THEN\n              'status = accepted, rejected not allowed for this Collection'\n            ELSE\n              CASE WHEN (cteCollectionSetting.userCanAccept = 'false' and cteCandidate.statusId IN (2,3))\n                THEN\n                  'status = accepted, rejected not allowed for this User'\n                ELSE\n                  CASE WHEN (cteCandidate.resultId NOT IN (2,3,4))\n                    THEN\n                      'status is not allowed for the result'\n                    ELSE\n                      CASE WHEN (cteCollectionSetting.detailRequired = 'always' AND cteCandidate.detail = '')\n                        THEN \n                          'empty detail is not allowed for status = submitted, accepted, rejected'\n                        ELSE\n                          CASE WHEN (cteCollectionSetting.commentRequired = 'always' AND cteCandidate.comment = '')\n                            THEN \n                              'empty comment is not allowed for status = submitted, accepted, rejected'\n                            ELSE\n                              CASE WHEN cteCandidate.resultId = 4 -- fail\n                                THEN\n                                  CASE WHEN (cteCollectionSetting.detailRequired = 'findings' AND cteCandidate.detail = '')\n                                    THEN \n                                      'result = fail and empty detail not allowed for status = submitted, accepted, rejected'\n                                    ELSE\n                                      CASE WHEN (cteCollectionSetting.commentRequired = 'findings' AND cteCandidate.comment = '')\n                                        THEN \n                                          'result = fail and empty comment not allowed for status = submitted, accepted, rejected'\n                                      END\n                                  END\n                              END\n                          END\n                      END\n                  END\n              END\n          END\n      END\n  END as error,\n  cteCandidate.reviewId, \n  cteCandidate.assetId, \n  cteCandidate.ruleId, \n  cteCandidate.version,\n  cteCandidate.checkDigest,\n  cteCandidate.resultId, \n  cteCandidate.detail, \n  cteCandidate.comment, \n  cteCandidate.resultEngine, \n  cteCandidate.metadata, \n  cteCandidate.statusId, \n  cteCandidate.statusText,\n  cteCandidate.statusUserId,\n  cteCandidate.statusTs,\n  cteCandidate.userId,\n  cteCandidate.ts\nfrom\n  cteCandidate\n  LEFT JOIN cteCollectionSetting on true`\n  const sqlHistoryPrune = `\nwith historyRecs AS (\n  select\n    rh.historyId,\n    ROW_NUMBER() OVER (PARTITION BY r.assetId, r.version, r.checkDigest ORDER BY rh.historyId DESC) as rowNum\n  from\n    review_history rh\n    left join review r using (reviewId)\n  where\n    reviewId IN (SELECT reviewId from tt_validated_review where error is null and reviewId is not null)\n)\ndelete review_history\nFROM \n   review_history\n   left join historyRecs on review_history.historyId = historyRecs.historyId \nWHERE \n   historyRecs.rowNum > (select c.settings->>\"$.history.maxReviews\" FROM enabled_collection c where collectionId = @collectionId) - 1\n`\n  const sqlHistory = `  \nINSERT INTO review_history (\n  reviewId,\n  ruleId,\n  resultId,\n  detail,\n  comment,\n  autoResult,\n  ts,\n  userId,\n  statusText,\n  statusUserId,\n  statusTs,\n  statusId,\n  touchTs,\n  resultEngine\n) SELECT \n    reviewId,\n    ruleId,\n    resultId,\n    LEFT(detail,32767) as detail,\n    LEFT(comment,32767) as comment,\n    autoResult,\n    ts,\n    userId,\n    statusText,\n    statusUserId,\n    statusTs,\n    statusId,\n    touchTs,\n    CASE WHEN resultEngine = 0 THEN NULL ELSE resultEngine END\n  FROM\n    review \n  WHERE\n    reviewId IN (SELECT reviewId from tt_validated_review where error is null and reviewId is not null)\n  FOR UPDATE\n`\n  const sqlUpdateReviews = `\nupdate\n  review r\n  inner join tt_validated_review vr on (r.reviewId = vr.reviewId and vr.error is null)\nset\n  r.ruleId = vr.ruleId,\n  r.resultId = vr.resultId,\n  r.resultEngine = vr.resultEngine,\n  r.detail = vr.detail,\n  r.comment = vr.comment,\n  r.metadata = vr.metadata,\n  r.statusId = vr.statusId,\n  r.statusText = vr.statusText,\n  r.statusUserId = vr.statusUserId,\n  r.statusTs = vr.statusTs,\n  r.userId = vr.userId,\n  r.ts = vr.ts\n`\n  const sqlInsertReviews = `\ninsert into review (\n  assetId,\n  ruleId,\n  \\`version\\`,\n  checkDigest,\n  resultId,\n  resultEngine,\n  detail,\n  comment,\n  metadata,\n  statusId,\n  statusText,\n  statusUserId,\n  statusTs,\n  userId,\n  ts)\nselect \n  assetId,\n  ruleId,\n  \\`version\\`,\n  checkDigest,\n  resultId,\n  resultEngine,\n  detail,\n  comment,\n  metadata,\n  statusId,\n  statusText,\n  statusUserId,\n  statusTs,\n  userId,\n  ts\nfrom\n  tt_validated_review vr\nwhere\n  error is null and reviewId is null \n`\n  try {\n    connection = await dbUtils.pool.getConnection()\n    \n    const sqlSetVariables = `set @collectionId = ?, @assetId = ?, @userId = ?, @roleId = ?, @reviews = ?, @utcTimestamp = UTC_TIMESTAMP()`\n    await connection.query(sqlSetVariables, [parseInt(collectionId), parseInt(assetId), parseInt(userId), grant.roleId, JSON.stringify(reviews)])\n    const [settings] = await connection.query(`select c.settings->>\"$.history.maxReviews\" as maxReviews FROM enabled_collection c where collectionId = @collectionId`)\n    const historyMaxReviews = settings[0].maxReviews\n    await connection.query(sqlCreateTableValidatedReview)\n    let [counts] = await connection.query(`select\n    coalesce(sum(case when error is not null then 1 else 0 end),0) as failedValidations,\n    coalesce(sum(case when error is null and reviewId is null then 1 else 0 end),0) as inserts,\n    coalesce(sum(case when error is null and reviewId is not null then 1 else 0 end),0) as updates\n    from tt_validated_review`)\n    let validationErrors = []\n    if (counts[0].failedValidations) {\n      ;[validationErrors] = await connection.query('select ruleId, error as reason from tt_validated_review where error is not null LIMIT 50')\n    }\n\n    async function transaction () {\n      await connection.query('START TRANSACTION')\n      if (counts[0].updates) {\n          await connection.query(sqlHistoryPrune, [ historyMaxReviews ])\n        if (historyMaxReviews !== 0) {\n          await connection.query(sqlHistory)\n        }\n        await connection.query(sqlUpdateReviews) \n      }\n      if (counts[0].inserts) {\n        await connection.query(sqlInsertReviews) \n      }\n      await dbUtils.updateStatsAssetStig(connection, {assetId})\n      await connection.commit()\n    }\n    await dbUtils.retryOnDeadlock(transaction, svcStatus)\n\n    return {\n      rejected: validationErrors,\n      affected: {\n        updated: counts[0].updates,\n        inserted: counts[0].inserts\n      }\n    }\n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }    \n    throw err\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.query('DROP TEMPORARY TABLE IF EXISTS tt_validated_review')\n      await connection.release()\n    }\n  }\n}\n\n// Returns a Boolean\nexports.checkRuleByAssetUser = async function ({ruleId, assetId, collectionId, grant, checkWritable}) {\n  const binds = []\n  let sql = `with ${dbUtils.cteAclEffective({grantIds: grant.grantIds})}\n    select\n      rgr.ruleId \n    from \n      enabled_asset a\n      left join stig_asset_map sa using (assetId)\n      ${grant.roleId === 1 ? 'inner' : 'left'} join cteAclEffective cae on sa.saId = cae.saId\n      left join revision rev on sa.benchmarkId = rev.benchmarkId\n      left join rev_group_rule_map rgr using (revId)\n    where \n      a.assetId = ?\n      and rgr.ruleId = ?\n      ${checkWritable ? \"and coalesce(cae.access, 'rw') = 'rw'\" : ''}\n      ${collectionId ? \"and a.collectionId = ?\" : ''}`\n  binds.push(assetId, ruleId, collectionId)   \n  let [rows] = await dbUtils.pool.query(sql, binds)\n  return rows.length > 0\n}\n\nexports.getReviewMetadataKeys = async function ( assetId, ruleId ) {\n  const binds = []\n  let sql = `\n    select\n      JSON_KEYS(metadata) as keyArray\n    from \n      review r\n      left join rule_version_check_digest rvcd on (r.version = rvcd.version and r.checkDigest = rvcd.checkDigest)\n    where \n      r.assetId = ?\n      and rvcd.ruleId = ?`\n  binds.push(assetId, ruleId)\n  let [rows] = await dbUtils.pool.query(sql, binds)\n  return rows.length > 0 ? rows[0].keyArray : []\n}\n\nexports.getReviewMetadata = async function ( assetId, ruleId ) {\n    const binds = []\n    let sql = `\n      select\n        metadata \n      from \n        review r\n        left join rule_version_check_digest rvcd on (r.version = rvcd.version and r.checkDigest = rvcd.checkDigest)\n      where \n        r.assetId = ?\n        and rvcd.ruleId = ?`\n    binds.push(assetId, ruleId)\n    let [rows] = await dbUtils.pool.query(sql, binds)\n    return rows.length > 0 ? rows[0].metadata : {}\n}\n\nexports.patchReviewMetadata = async function ( assetId, ruleId, metadata ) {\n  const binds = []\n  let sql = `\n    update\n      review\n      left join rule_version_check_digest rvcd on (review.version = rvcd.version and review.checkDigest = rvcd.checkDigest)\n    set \n      review.metadata = JSON_MERGE_PATCH(metadata, ?)\n    where \n      review.assetId = ?\n      and rvcd.ruleId = ?`\n  binds.push(JSON.stringify(metadata), assetId, ruleId)\n  await dbUtils.pool.query(sql, binds)\n  return true\n}\n\nexports.putReviewMetadata = async function ( assetId, ruleId, metadata ) {\n  const binds = []\n  let sql = `\n    update\n      review\n      left join rule_version_check_digest rvcd on (review.version = rvcd.version and review.checkDigest = rvcd.checkDigest)\n    set \n      review.metadata = ?\n    where \n      review.assetId = ?\n      and rvcd.ruleId = ?`\n  binds.push(JSON.stringify(metadata), assetId, ruleId)\n  await dbUtils.pool.query(sql, binds)\n  return true\n}\n\nexports.getReviewMetadataValue = async function ( assetId, ruleId, key ) {\n  const binds = []\n  let sql = `\n    select\n      JSON_EXTRACT(metadata, ?) as value\n    from \n      review r\n      left join rule_version_check_digest rvcd on (r.version = rvcd.version and r.checkDigest = rvcd.checkDigest)\n    where \n      r.assetId = ?\n      and rvcd.ruleId = ?`\n  binds.push(`$.\"${key}\"`, assetId, ruleId)\n  let [rows] = await dbUtils.pool.query(sql, binds)\n  return rows.length > 0 ? rows[0].value : \"\"\n}\n\nexports.putReviewMetadataValue = async function ( assetId, ruleId, key, value ) {\n  const binds = []\n  let sql = `\n    update\n      review\n      left join rule_version_check_digest rvcd on (review.version = rvcd.version and review.checkDigest = rvcd.checkDigest)\n    set \n      review.metadata = JSON_SET(metadata, ?, ?)\n    where \n      review.assetId = ?\n      and rvcd.ruleId = ?`\n  binds.push(`$.\"${key}\"`, value, assetId, ruleId)\n  let [rows] = await dbUtils.pool.query(sql, binds)\n  return rows.length > 0 ? rows[0].value : \"\"\n}\n\nexports.deleteReviewMetadataKey = async function ( assetId, ruleId, key ) {\n  const binds = []\n  let sql = `\n    update\n      review\n      left join rule_version_check_digest rvcd on (review.version = rvcd.version and review.checkDigest = rvcd.checkDigest)\n    set \n      review.metadata = JSON_REMOVE(metadata, ?)\n    where \n      review.assetId = ?\n      and rvcd.ruleId = ?`\nbinds.push(`$.\"${key}\"`, assetId, ruleId)\n  let [rows] = await dbUtils.pool.query(sql, binds)\n  return rows.length > 0 ? rows[0].value : \"\"\n}"
  },
  {
    "path": "api/source/service/STIGService.js",
    "content": "'use strict';\nconst dbUtils = require('./utils')\nconst {createHash} = require('node:crypto')\n\nconst _this = this\n\nfunction cteStigCollection ({elevate = false, unrestrictedCollectionIds = [], hasRestrictions = true}) {\n  const columns = [\n    'sa.benchmarkId',\n    `cast(concat('[', group_concat(distinct concat('\"',a.collectionId,'\"')),']') as json) as collectionIds`\n  ]\n  const joins = [\n    'stig_asset_map sa',\n    'inner join enabled_asset a on a.assetId=sa.assetId',\n    'inner join enabled_collection c on c.collectionId=a.collectionId'\n  ]\n  const predicates = {\n    statements: [],\n    binds: []\n  }\n  const groupBy = ['sa.benchmarkId']\n\n  if (!elevate) {\n    const statements = []\n    if (hasRestrictions) {\n      joins.push('left join cteAclEffective cae on sa.saId = cae.saId')\n      statements.push('cae.saId is not null')\n    }\n    if (unrestrictedCollectionIds.length) {\n      statements.push('c.collectionId in (?)')\n      predicates.binds.push(unrestrictedCollectionIds)\n    }\n    if (statements.length) predicates.statements.push(statements.join(' OR '))\n  }\n\n  const sql = dbUtils.makeQueryString({columns, joins, predicates, groupBy, format: true})\n  return `cte_stig_collection as (${sql})`\n}\n\nfunction cteRevCollection({elevate = false, unrestrictedCollectionIds = [], hasRestrictions = true}) {\n  const columns = [\n    'r.revId',\n    `cast(concat('[', group_concat(distinct concat('\"',crm.collectionId,'\"')),']') as json) as collectionIds`\n  ]\n  const joins = [\n    'revision r',\n    'inner join collection_rev_map crm using (revId)'\n  ]\n  const predicates = {\n    statements: [],\n    binds: []\n  }\n  const groupBy = ['r.revId']\n  if (!elevate) {\n    const statements = []\n    if (hasRestrictions) {\n      joins.push('left join stig_asset_map sa on r.benchmarkId = sa.benchmarkId','left join cteAclEffective cae on sa.saId = cae.saId')\n      statements.push('cae.saId is not null')\n    }\n    if (unrestrictedCollectionIds.length) {\n      statements.push('crm.collectionId in (?)')\n      predicates.binds.push(unrestrictedCollectionIds)\n    }\n    if (statements.length) predicates.statements.push(statements.join(' OR '))\n  }\n\n  const sql = dbUtils.makeQueryString({columns, joins, predicates, groupBy, format: true})\n  return `cte_rev_collection as (${sql})`\n}\n\nfunction parseGrants (grants, elevate = false) {\n  const unrestrictedCollectionIds = []\n  let requireCteAcls = false\n  let requesterGrantIds = []\n  if (!elevate) {\n    for (const collectionId in grants) {\n      if (grants[collectionId].roleId === 1) {\n        requesterGrantIds.push(grants[collectionId].grantIds)\n      }\n      else {\n        unrestrictedCollectionIds.push(collectionId)\n      }\n    }\n    requesterGrantIds = requesterGrantIds.flat()\n    requireCteAcls = !!requesterGrantIds.length\n  }\n  return {unrestrictedCollectionIds, requesterGrantIds, requireCteAcls }\n}\n\n/**\nGeneralized queries for STIGs\n**/\nexports.queryStigs = async function ({filter, projections, grants, elevate = false}) {\n\n  const {\n    unrestrictedCollectionIds, \n    requesterGrantIds, \n    requireCteAcls\n  } = parseGrants(grants, elevate)\n\n  const ctes = []\n  if (requireCteAcls) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: requesterGrantIds}))\n  }\n  ctes.push(cteStigCollection({\n    elevate,\n    unrestrictedCollectionIds,\n    hasRestrictions: !!requesterGrantIds.length\n  }))\n\n  // cte_stig is used for the base query (no projections)\n  const cteStigColumns = [\n    'b.benchmarkId',\n    'b.title',\n    `cr.status`,\n    `cr.marking`, \n    `concat('V', cr.version, 'R', cr.release) as \"lastRevisionStr\"`,\n    `date_format(cr.benchmarkDateSql,'%Y-%m-%d') as \"lastRevisionDate\"`,\n    `cr.ruleCount`,\n    `coalesce(sc.collectionIds,json_array()) as collectionIds`,\n    `JSON_ARRAYAGG(concat('V',revision.version,'R',revision.release)) OVER (PARTITION BY b.benchmarkId ORDER BY revision.benchmarkDateSql DESC) as revisionStrs`,\n    `ROW_NUMBER() OVER (PARTITION BY b.benchmarkId ORDER BY revision.benchmarkDateSql ASC) as rownum`\n  ]\n  const cteStigJoins = [\n    'stig b',\n    'left join current_rev cr on b.benchmarkId = cr.benchmarkId',\n    'left join cte_stig_collection sc on b.benchmarkId = sc.benchmarkId',\n    'left join revision on b.benchmarkId = revision.benchmarkId',\n  ]\n\n  // PREDICATES\n  const cteStigPredicates = {\n    statements: [],\n    binds: []\n  }\n  if (filter.title) {\n    cteStigPredicates.statements.push(\"b.title LIKE CONCAT('%',?,'%')\")\n    cteStigPredicates.binds.push( filter.title )\n  }\n  if (filter.benchmarkId) {\n    cteStigPredicates.statements.push('b.benchmarkId = ?')\n    cteStigPredicates.binds.push( filter.benchmarkId )\n  }\n\n  // Main query columns, can be modified by projections\n  const columns = [\n    'benchmarkId',\n    'title',\n    '`status`',\n    'marking',\n    `lastRevisionStr`,\n    `lastRevisionDate`,\n    `ruleCount`,\n    `revisionStrs`,\n    `collectionIds`,\n  ]\n\n  if (projections.includes('revisions')) {\n    // add cte_rev_collection, add revision objects to cteStigColumns, add joins to cteStigJoins\n    ctes.push(cteRevCollection({\n      elevate,\n      unrestrictedCollectionIds,\n      hasRestrictions: !!requesterGrantIds.length\n    }))\n    cteStigColumns.push(`JSON_ARRAYAGG(\n      json_object(\n        \"benchmarkId\", revision.benchmarkId,\n        \"revisionStr\", concat('V',revision.version,'R',revision.release),\n        \"version\", cast(revision.version as char),\n        \"release\", revision.release,\n        \"benchmarkDate\", revision.benchmarkDateSql,\n        \"status\", revision.status,\n        \"statusDate\", revision.statusDate,\n        \"marking\", revision.marking,\n        \"ruleCount\", revision.ruleCount,\n        \"collectionIds\", coalesce(rc.collectionIds,json_array())\n      )) OVER (PARTITION BY b.benchmarkId ORDER BY revision.benchmarkDateSql DESC) as revisions`)\n    cteStigJoins.push('left join cte_rev_collection rc on revision.revId = rc.revId')\n    columns.push('revisions')\n  }\n\n  ctes.push(`cte_stig AS (${dbUtils.makeQueryString({columns:cteStigColumns, joins:cteStigJoins, predicates:cteStigPredicates, orderBy:['b.benchmarkId']})})`)\n\n  // CONSTRUCT MAIN QUERY\n  const joins = ['cte_stig']\n  const predicates = {\n    statements: ['rownum = 1'],\n    binds: cteStigPredicates.binds\n  }\n\n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, format: true})\n\n  const [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\n\n/**\nGeneralized queries for Groups\n**/\nexports.queryGroups = async function ( inProjection, inPredicates ) {\n  let columns = [\n    'rgr.groupId as \"groupId\"',\n    'rgr.groupTitle as \"title\"',\n  ]\n\n  const orderBy = ['substring(rgr.groupId from 3) + 0']\n  const groupBy = ['rgr.groupId', 'rgr.groupTitle']\n\n  let joins\n  let predicates = {\n    statements: [],\n    binds: []\n  }\n  \n  predicates.statements.push('r.benchmarkId = ?')\n  predicates.binds.push(inPredicates.benchmarkId)\n  \n  if (inPredicates.revisionStr != 'latest') {\n    joins = ['revision r']\n    const {version, release} = dbUtils.parseRevisionStr(inPredicates.revisionStr)\n    predicates.statements.push('r.version = ?')\n    predicates.binds.push(version)\n    predicates.statements.push('r.release = ?')\n    predicates.binds.push(release)\n  } else {\n    joins = ['current_rev r']\n  }\n  \n  joins.push('inner join rev_group_rule_map rgr on r.revId = rgr.revId')\n\n  if (inPredicates.groupId) {\n    predicates.statements.push('rgr.groupId = ?')\n    predicates.binds.push(inPredicates.groupId)\n  }\n\n  // PROJECTIONS\n  if (inProjection?.includes('rules')) {\n    columns.push(`json_arrayagg(json_object(\n      'ruleId', rgr.ruleId, \n      'version', rgr.version, \n      'title', rgr.title, \n      'severity', rgr.severity)) as \"rules\"`)\n  }\n\n  // // CONSTRUCT MAIN QUERY\n  const sql = dbUtils.makeQueryString({columns, joins, predicates, groupBy, orderBy})\n\n  const [rows] = await dbUtils.pool.query(sql, predicates.binds)\n  return (rows.length > 0 ? rows : null)\n}\n\n\n/**\nGeneralized queries for Rules associated with a STIG\nFor specific Rule, allow for projections with Check and Fixes\n**/\nexports.queryBenchmarkRules = async function ( benchmarkId, revisionStr, inProjection, inPredicates ) {\n  let columns = [\n    'rgr.ruleId',\n    'rgr.title',\n    'rgr.groupId',\n    'rgr.groupTitle',\n    'rgr.version',\n    'rgr.severity'\n  ]\n\n  let groupBy = [\n    'rgr.ruleId',\n    'rgr.title',\n    'rgr.groupId',\n    'rgr.groupTitle',\n    'rgr.version',\n    'rgr.severity',\n    'rgr.rgrId'\n  ]\n\n  const orderBy =  ['substring(rgr.ruleId from 4) + 0']\n\n  let joins\n  let predicates = {\n    statements: [],\n    binds: []\n  }\n  \n  // PREDICATES\n  predicates.statements.push('rev.benchmarkId = ?')\n  predicates.binds.push(benchmarkId)\n  \n  if (revisionStr != 'latest') {\n    joins = ['revision rev']\n    const {version, release} = dbUtils.parseRevisionStr(revisionStr)\n    predicates.statements.push('rev.version = ?')\n    predicates.binds.push(version)\n    predicates.statements.push('rev.release = ?')\n    predicates.binds.push(release)\n  } else {\n    joins = ['current_rev rev']\n  }\n  \n  if (inPredicates?.ruleId) {\n    predicates.statements.push('rgr.ruleId = ?')\n    predicates.binds.push(inPredicates.ruleId)\n  }\n\n  joins.push('left join rev_group_rule_map rgr using (revId)' )\n\n  // PROJECTIONS\n  if ( inProjection?.includes('detail') ) {\n    columns.push(`json_object(\n      'weight', rgr.weight,\n      'vulnDiscussion', rgr.vulnDiscussion,\n      'falsePositives', rgr.falsePositives,\n      'falseNegatives', rgr.falseNegatives,\n      'documentable', rgr.documentable,\n      'mitigations', rgr.mitigations,\n      'severityOverrideGuidance', rgr.severityOverrideGuidance,\n      'potentialImpacts', rgr.potentialImpacts,\n      'thirdPartyTools', rgr.thirdPartyTools,\n      'mitigationControl', rgr.mitigationControl,\n      'responsibility', rgr.responsibility\n    ) as detail`)\n    groupBy.push(\n      'rgr.version',\n      'rgr.weight',\n      'rgr.vulnDiscussion',\n      'rgr.falsePositives',\n      'rgr.falseNegatives',\n      'rgr.documentable',\n      'rgr.mitigations',\n      'rgr.severityOverrideGuidance',\n      'rgr.potentialImpacts',\n      'rgr.thirdPartyTools',\n      'rgr.mitigationControl',\n      'rgr.responsibility',\n      'rgr.iacontrols'\n    )\n  }\n\n  if ( inProjection?.includes('ccis') ) {\n    columns.push(`(select \n      coalesce\n      (\n        (select json_arrayagg(\n          json_object(\n            'cci', rgrcc.cci,\n            'apAcronym', cci.apAcronym,\n            'definition',  cci.definition,\n            'control', crm.parentControl\n          )\n        )\n        from\n          rev_group_rule_cci_map rgrcc\n          inner join cci cci using (cci)\n          left join cci_reference_map crm using (cci)\n        where\n          rgrcc.rgrId = rgr.rgrId\n        ), \n        json_array()\n      )\n    ) as \"ccis\"`)\n  }\n  if ( inProjection?.includes('check') ) {\n    joins.push('left join check_content cc on rgr.checkDigest = cc.digest' )\n    columns.push(`json_object(\n      'system', rgr.checkSystem,\n      'content', cc.content) as \\`check\\``)\n    }\n  if ( inProjection?.includes('fix') ) {\n    joins.push('left join fix_text ft on rgr.fixDigest = ft.digest' )\n    columns.push(`json_object(\n      'fixref', rgr.fixref,\n      'text', ft.text) as fix`)\n  }\n\n  // // CONSTRUCT MAIN QUERY\n  const sql = dbUtils.makeQueryString({columns, joins, predicates, groupBy, orderBy})\n\n  const [rows] = await dbUtils.pool.query(sql, predicates.binds)\n  return (rows)\n}\n\n\n/**\nGeneralized queries for a single Rule, optionally with Check and Fix\n**/\nexports.queryRules = async function ( ruleId, inProjection ) {\n  let columns = [\n    'rgr.ruleId',\n    'rgr.version',\n    'rgr.title',\n    'rgr.severity',\n    'rgr.groupId',\n    'rgr.groupTitle'\n  ]\n  \n  let groupBy = [\n    \"rgr.ruleId\", \n    \"rgr.version\",\n    \"rgr.title\",\n    \"rgr.severity\",\n    \"rgr.groupId\",\n    \"rgr.groupTitle\"\n  ]\n\n  const orderBy = ['substring(rgr.ruleId from 4) + 0']\n\n  let joins = [\n    'rev_group_rule_map rgr'\n  ]\n\n\n  let predicates = {\n    statements: [],\n    binds: []\n  }\n  \n  // PREDICATES\n  predicates.statements.push('rgr.ruleId = ?')\n  predicates.binds.push(ruleId)\n  \n\n  // PROJECTIONS\n  if ( inProjection?.includes('detail') ) {\n    columns.push(`json_object(\n      'weight', any_value(rgr.weight),\n      'vulnDiscussion', any_value(rgr.vulnDiscussion),\n      'falsePositives', any_value(rgr.falsePositives),\n      'falseNegatives', any_value(rgr.falseNegatives),\n      'documentable', any_value(rgr.documentable),\n      'mitigations', any_value(rgr.mitigations),\n      'severityOverrideGuidance', any_value(rgr.severityOverrideGuidance),\n      'potentialImpacts', any_value(rgr.potentialImpacts),\n      'thirdPartyTools', any_value(rgr.thirdPartyTools),\n      'mitigationControl', any_value(rgr.mitigationControl),\n      'responsibility', any_value(rgr.responsibility)\n    ) as detail`)\n  }\n\n  if ( inProjection?.includes('ccis') ) {\n    columns.push(`CASE WHEN count(rgrcc.cci) = 0\n    THEN json_array()\n    ELSE CAST(CONCAT('[', GROUP_CONCAT(distinct json_object('cci', rgrcc.cci,'apAcronym',cci.apAcronym,'definition',cci.definition,'control',crm.parentControl)), ']') as json)\n    END as ccis`)\n    joins.push(\n      'left join rev_group_rule_cci_map rgrcc using (rgrId)',\n      'inner join cci using (cci)',\n      'inner join cci_reference_map crm on cci.cci = crm.cci'\n    )\n  }\n\n  if ( inProjection?.includes('check') ) {\n    columns.push(`json_object('system', any_value(rgr.checkSystem),'content', any_value(cc.content)) as \\`check\\``)\n    joins.push('left join check_content cc on rgr.checkDigest = cc.digest')\n  }\n\n  if ( inProjection?.includes('fix') ) {\n    columns.push(`json_object('fixref', any_value(rgr.fixref),'text', any_value(ft.text)) as fix`)\n    joins.push('left join fix_text ft on rgr.fixDigest = ft.digest')\n  }\n  \n  if (inProjection?.includes('ruleIds')) {\n    columns.push(`cast(concat('[', group_concat(distinct '\"' , rvcd.ruleId , '\"'), ']') as json) as ruleIds`)\n    joins.push(\n      'left join rule_version_check_digest rvcd on (rgr.version = rvcd.version and rgr.checkDigest = rvcd.checkDigest)',\n    )\n  }\n    \n  if (inProjection?.includes('stigs')) {\n    columns.push(`cast(concat('[', group_concat(distinct json_object('benchmarkId',revision.benchmarkId,'revisionStr',revision.revisionStr)), ']') as json) as stigs`)\n    joins.push('left join revision on rgr.revId = revision.revId')\n  }\n  \n  // CONSTRUCT MAIN QUERY\n  const sql = dbUtils.makeQueryString({columns, joins, predicates, groupBy, orderBy, format: true})\n\n  const [rows] = await dbUtils.pool.query(sql)\n  return (rows[0])\n}\n\n\nexports.insertManualBenchmark = async function (b, clobber, svcStatus = {}) {\n\n  let connection\n  try {\n    const stats = {}\n    let totalstart = process.hrtime() \n\n    const {ddl, dml} = queriesFromBenchmarkData(b) // defined below\n\n    connection = await dbUtils.pool.getConnection()\n    connection.config.namedPlaceholders = true\n\n    // check if this revision exists\n    const [revision] = await connection.query('select revId from revision where `benchmarkId` = ? and `version` = ? and `release` = ?', [\n      dml.revision.binds.benchmarkId,\n      dml.revision.binds.version,\n      dml.revision.binds.release\n    ])\n    const gExistingRevision = revision?.[0]?.revId\n    if (gExistingRevision && !clobber) {\n      return {\n        benchmarkId: dml.revision.binds.benchmarkId,\n        revisionStr: `V${dml.revision.binds.version}R${dml.revision.binds.release}`,\n        marking: dml.revision.binds.marking,\n        action: 'preserved'\n      }\n    }\n\n    // create temporary tables outside the transaction\n    for (const tempTable of Object.keys(ddl)) {\n      await connection.query(ddl[tempTable].drop)\n      await connection.query(ddl[tempTable].create)\n    }\n\n    async function transaction() {\n      let result, hrstart, hrend, action = 'inserted'\n      await connection.query('START TRANSACTION')\n\n      // purge any exitsing records for this revision so we can replace\n      if (gExistingRevision) {\n        hrstart = process.hrtime()\n        await connection.query('DELETE FROM revision WHERE revId = ?', [gExistingRevision])\n        const cleanupDml = [\n          \"DELETE FROM check_content WHERE digest NOT IN (select checkDigest from rev_group_rule_map)\",\n          \"DELETE FROM fix_text WHERE digest NOT IN (select digest from rev_group_rule_map)\"\n        ]\n        for (const query of cleanupDml) {\n          await connection.query(query)\n        }\n        hrend = process.hrtime(hrstart)\n        stats.delRev = `${hrend[0]}s  ${hrend[1] / 1000000}ms`\n        action = 'replaced'\n      }\n\n      // insert new records for this revision\n      const queryOrder = [\n        'stig',\n        'revision',\n        'tempRuleCci',\n        'checkContent',\n        'fixText',\n        'revGroupRuleMap',\n        'revGroupRuleCciMap',\n        'ruleVersionCheckDigest'\n      ]\n\n      for (const query of queryOrder) {\n        hrstart = process.hrtime()\n        if (Array.isArray(dml[query].binds)) {\n          if (dml[query].binds.length === 0) { continue }\n          ;[result] = await connection.query(dml[query].sql, [dml[query].binds])\n        }\n        else {\n          ;[result] = await connection.query(dml[query].sql, dml[query].binds)\n        }\n        hrend = process.hrtime(hrstart)\n        stats[query] = `${result.affectedRows} in ${hrend[0]}s  ${hrend[1] / 1000000}ms`\n      }\n\n      // Update current_rev\n      hrstart = process.hrtime()\n      let sqlDeleteCurrentRev = 'DELETE from current_rev where benchmarkId = ?'\n      let sqlUpdateCurrentRev = `INSERT INTO current_rev (\n        revId,\n        benchmarkId,\n        \\`version\\`, \n        \\`release\\`, \n        benchmarkDate,\n        benchmarkDateSql,\n        status,\n        statusDate,\n        marking,\n        description,\n        active,\n        groupCount,\n        lowCount,\n        mediumCount,\n        highCount,\n        checkCount,\n        fixCount)\n        SELECT \n          revId,\n          benchmarkId,\n          \\`version\\`,\n          \\`release\\`,\n          benchmarkDate,\n          benchmarkDateSql,\n          status,\n          statusDate,\n          marking,\n          description,\n          active,\n          groupCount,\n          lowCount,\n          mediumCount,\n          highCount,\n          checkCount,\n          fixCount\n        FROM\n          v_current_rev\n        WHERE\n          v_current_rev.benchmarkId = ?`\n      await connection.query(sqlDeleteCurrentRev, [dml.stig.binds.benchmarkId])\n      await connection.query(sqlUpdateCurrentRev, [dml.stig.binds.benchmarkId])\n      hrend = process.hrtime(hrstart)\n      stats.current_rev = `${hrend[0]}s  ${hrend[1] / 1000000}ms`\n\n      // Stats\n      hrstart = process.hrtime()\n      await dbUtils.updateDefaultRev(connection, {\n        benchmarkId: dml.stig.binds.benchmarkId\n      })\n      await dbUtils.updateStatsAssetStig(connection, {\n        benchmarkId: dml.stig.binds.benchmarkId\n      })\n      hrend = process.hrtime(hrstart)\n      stats.statistics = `${hrend[0]}s  ${hrend[1] / 1000000}ms`\n\n      await connection.commit()\n      hrend = process.hrtime(totalstart)\n      stats.totalTime = `Completed in ${hrend[0]}s  ${hrend[1] / 1000000}ms`\n\n      return {\n        benchmarkId: dml.revision.binds.benchmarkId,\n        revisionStr: `V${dml.revision.binds.version}R${dml.revision.binds.release}`,\n        marking: dml.revision.binds.marking,\n        action\n      }\n    }\n    return await dbUtils.retryOnDeadlock(transaction, svcStatus)\n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }\n    throw err\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n\n}\n\nfunction queriesFromBenchmarkData(b) {\n  const tempFlag = true\n  const ddl = {\n    tempRuleCci: {\n      drop: 'drop table if exists temp_rule_cci',\n      create: `CREATE${tempFlag ? ' TEMPORARY' : ''} TABLE temp_rule_cci (\n        ruleId varchar(255) NOT NULL,\n        cci varchar(20))`\n    }\n  }\n  const dml = {\n    stig: {\n      sql: \"insert into stig (title, benchmarkId) VALUES (:title, :benchmarkId) as new on duplicate key update stig.title = new.title\"\n    },\n    revision: {\n      sql: `insert into revision (\nrevId, \nbenchmarkId, \n\\`version\\`, \n\\`release\\`, \nbenchmarkDate, \nbenchmarkDateSql, \nstatus, \nstatusDate,\nmarking, \ndescription,\ngroupCount,\ncheckCount,\nfixCount,\nlowCount,\nmediumCount,\nhighCount\n) VALUES (\n:revId, \n:benchmarkId, \n:version, \n:release, \n:benchmarkDate, \nSTR_TO_DATE(:benchmarkDateSql, '%Y-%m-%d'),\n:status, \n:statusDate,\n:marking,\n:description,\n:groupCount,\n:checkCount,\n:fixCount,\n:lowCount,\n:mediumCount,\n:highCount)`,\n    },\n    checkContent: {\n      sql: `insert ignore into check_content (content) VALUES ?`,\n      binds: []\n    },\n    fixText: {\n      sql: `insert ignore into fix_text (\\`text\\`) VALUES ?`,\n      binds: []\n    },\n    tempRuleCci: {\n      sql: `insert ignore into temp_rule_cci (ruleId, cci) VALUES ?`,\n      binds: []\n    },\n    revGroupRuleMap: {\n      sql: `INSERT INTO rev_group_rule_map (\n        revId,\n        groupId, groupTitle, groupSeverity,\n        ruleId, \\`version\\`, title, severity, weight, vulnDiscussion, \n        falsePositives, falseNegatives, documentable, mitigations, \n        severityOverrideGuidance, potentialImpacts, thirdPartyTools, mitigationControl,\n        responsibility, iaControls, checkSystem, checkDigest, fixref, fixDigest)\n        VALUES ?`,\n      binds: []\n    },\n    revGroupRuleCciMap: {\n      sql: `INSERT IGNORE INTO rev_group_rule_cci_map (rgrId, cci)\n        SELECT \n          rgr.rgrId,\n          tt.cci\n        FROM\n          rev_group_rule_map rgr\n          inner join temp_rule_cci tt using (ruleId)\n        WHERE \n          rgr.revId = :revId`\n    },\n    ruleVersionCheckDigest: {\n      sql: `INSERT INTO rule_version_check_digest (ruleId, \\`version\\`, checkDigest)\n      with currentRuleVersionCheckDigest as (\n      select\n        rgr.ruleId,\n        rgr.version,\n        rgr.checkDigest,\n        rev.benchmarkDateSql,\n        rev.revId,\n        ROW_NUMBER() OVER (PARTITION BY rgr.ruleId ORDER BY rev.benchmarkDateSql DESC) as rowNum\n      from\n        rev_group_rule_map rgr\n        left join revision rev using (revId)\n      where\n        rgr.checkDigest is not null\n        and rev.benchmarkId = ?\n      )\n      select\n        ruleId,\n        \\`version\\`,\n        checkDigest\n      from\n        currentRuleVersionCheckDigest crvcd \n      where\n        rowNum = 1\n      ON DUPLICATE KEY UPDATE\n        \\`version\\`=crvcd.version,\n        checkDigest=crvcd.checkDigest`,\n      binds: []\n    }\n  }\n\n  let { revision, ...benchmarkBinds } = b\n  // QUERY: stig\n  dml.stig.binds = benchmarkBinds\n  delete dml.stig.binds.scap\n\n  let { groups, ...revisionBinds } = revision\n  delete revisionBinds.revisionStr\n  revisionBinds.benchmarkId = benchmarkBinds.benchmarkId\n  revisionBinds.revId = `${revisionBinds.benchmarkId}-${revisionBinds.version}-${revisionBinds.release}`\n  revisionBinds.benchmarkDateSql = revisionBinds.benchmarkDate8601\n  delete revisionBinds.benchmarkDate8601\n  revisionBinds.lowCount = revisionBinds.mediumCount = revisionBinds.highCount = 0\n  // QUERY: revision\n  dml.revision.binds = revisionBinds\n\n  let ruleCount = 0\n  let checkCount = 0\n  let fixCount = 0\n  for (const group of groups) {\n    let { rules, ...groupBinds } = group\n\n    let groupSeverity\n    for (const rule of rules) {\n      ruleCount++\n      let { checks, fixes, idents, ...ruleBinds } = rule\n      // Group severity calculation\n      if (!groupSeverity) {\n        groupSeverity = ruleBinds.severity\n      }\n      else if (groupSeverity !== ruleBinds.severity) {\n        groupSeverity = 'mixed'\n      }\n      checkCount += checks.length\n      fixCount += fixes.length\n      const checkSystem = checks.map( check => check.system).join(',')\n      const checkContent = checks.map( check => check.content).join('\\n\\n-----AND-----\\n\\n')\n      const checkDigest = createHash('sha256').update(checkContent).digest()\n      const fixref = fixes.map( fix => fix.fixref).join(',')\n      const fixText = fixes.map( fix => fix.text).join('\\n\\n-----AND-----\\n\\n')\n      const fixDigest = createHash('sha256').update(fixText).digest()\n\n      // QUERY: checkContent\n      dml.checkContent.binds.push([checkContent])\n\n      // QUERY: fixText\n      dml.fixText.binds.push([fixText])\n      \n      // QUERY: revGroupRuleMap\n      dml.revGroupRuleMap.binds.push([\n        revisionBinds.revId,\n        groupBinds.groupId,\n        groupBinds.title,\n        ruleBinds.severity, // groupSeverity hack\n        ruleBinds.ruleId,\n        ruleBinds.version,\n        ruleBinds.title,\n        ruleBinds.severity,\n        ruleBinds.weight,\n        ruleBinds.vulnDiscussion,\n        ruleBinds.falsePositives,\n        ruleBinds.falseNegatives,\n        ruleBinds.documentable,\n        ruleBinds.mitigations,\n        ruleBinds.severityOverrideGuidance,\n        ruleBinds.potentialImpacts,\n        ruleBinds.thirdPartyTools,\n        ruleBinds.mitigationControl,\n        ruleBinds.responsibility,\n        ruleBinds.iaControls,\n        checkSystem,\n        checkDigest,\n        fixref,\n        fixDigest\n      ])\n      \n      for (const ident of idents) {\n        if (ident.system === 'http://iase.disa.mil/cci' || ident.system === 'http://cyber.mil/cci') {\n          dml.tempRuleCci.binds.push([\n            rule.ruleId,\n            ident.ident.replace('CCI-', '')])\n        }\n      }\n    }\n\n    // QUERY: rev_group_rule_cci_map\n    dml.revGroupRuleCciMap.binds = { revId: revisionBinds.revId }\n  }\n\n  dml.revision.binds.groupCount = groups.length\n  dml.revision.binds.checkCount = checkCount\n  dml.revision.binds.fixCount = fixCount\n\n  // add rule severity counts to the revision binds. groupRule[7] is the location of the severity value\n  dml.revision.binds = dml.revGroupRuleMap.binds.reduce((binds, groupRule) => {\n    const prop = `${groupRule[7]}Count`\n    binds[prop] = (binds[prop] ?? 0) + 1\n    return binds\n  }, dml.revision.binds)\n\n  // QUERY: ruleVersionCheckDigest\n  dml.ruleVersionCheckDigest.binds.push(benchmarkBinds.benchmarkId)\n\n  return {ddl, dml}\n}\n\n/**\n * Deletes the specified revision of a STIG\n *\n * benchmarkId String A path parameter that identifies a STIG\n * revisionStr String A path parameter that identifies a STIG revision [ V{version_num}R{release_num} | 'latest' ]\n * returns Revision\n **/\nexports.deleteRevisionByString = async function(benchmarkId, revisionStr, svcStatus = {}) {\n\n  let dmls = [\n    \"DELETE from collection_rev_map where revId = (SELECT revId FROM revision WHERE benchmarkId = :benchmarkId and `version` = :version and `release` = :release)\",\n    \"DELETE FROM revision WHERE benchmarkId = :benchmarkId and `version` = :version and `release` = :release\",\n    \"DELETE FROM check_content WHERE digest NOT IN (select checkDigest from rev_group_rule_map)\",\n    \"DELETE FROM fix_text WHERE digest NOT IN (select fixDigest from rev_group_rule_map)\",\n    \"DELETE FROM rule_version_check_digest WHERE ruleId NOT IN (select DISTINCT ruleId from rev_group_rule_map)\"\n]\n  let currentRevDmls = [\n    \"DELETE from current_rev where benchmarkId = :benchmarkId\",\n    `INSERT INTO current_rev (\n        revId,\n        benchmarkId,\n        \\`version\\`, \n        \\`release\\`, \n        benchmarkDate,\n        benchmarkDateSql,\n        status,\n        statusDate,\n        marking,\n        description,\n        active,\n        groupCount,\n        lowCount,\n        mediumCount,\n        highCount,\n        checkCount,\n        fixCount)\n      SELECT \n        revId,\n        benchmarkId,\n        \\`version\\`,\n        \\`release\\`,\n        benchmarkDate,\n        benchmarkDateSql,\n        status,\n        statusDate,\n        marking,\n        description,\n        active,\n        groupCount,\n        lowCount,\n        mediumCount,\n        highCount,\n        checkCount,\n        fixCount\n      FROM\n        v_current_rev\n      WHERE\n        v_current_rev.benchmarkId = :benchmarkId`,\n    \"DELETE FROM stig WHERE benchmarkId NOT IN (select benchmarkId FROM current_rev)\"\n  ]\n\n  let connection;\n  try {\n    const {version, release} = dbUtils.parseRevisionStr(revisionStr)\n    let binds = {\n      benchmarkId: benchmarkId,\n      version: version,\n      release: release,\n      revId: `${benchmarkId}-${version}-${release}`\n    }\n\n    connection = await dbUtils.pool.getConnection()\n    connection.config.namedPlaceholders = true\n    \n    async function transaction () {\n      await connection.query('START TRANSACTION')\n\n      // note if this is the current revision\n      const [crRows] = await connection.query('SELECT * FROM current_rev WHERE benchmarkId = :benchmarkId and `version` = :version and `release` = :release', binds)\n      const wasCurrentRev = !!crRows.length\n      // note if this revision is used to calculate stats\n      const [drRows] = await connection.query('SELECT collectionId FROM default_rev WHERE benchmarkId = :benchmarkId and revId = :revId', binds)\n      const wasDefaultRev = !!drRows.length\n\n      // re-materialize current_rev if we're deleting the current revision\n      if (wasCurrentRev) {\n        dmls = dmls.concat(currentRevDmls)\n      }\n  \n      for (const sql of dmls) {\n       await connection.query(sql, binds)\n      }\n\n      // re-calculate review statistics and repopulate default_rev from view if we've affected default_rev\n      if (wasDefaultRev) {\n        const collectionIds = drRows.map( row => row.collectionId)\n        await dbUtils.updateDefaultRev( connection, {collectionIds, benchmarkId})\n        await dbUtils.updateStatsAssetStig( connection, {collectionIds, benchmarkId})\n      }\n  \n      await connection.commit()\n    }\n    \n    await dbUtils.retryOnDeadlock(transaction, svcStatus)\n  }\n  catch(err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }\n    throw (err)\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\n\n/**\n * Deletes a STIG (*** and all revisions ***)\n *\n * benchmarkId String A path parameter that indentifies a STIG\n * returns STIG\n **/\nexports.deleteStigById = async function(benchmarkId, userObject, svcStatus = {}) {\n\n  let dmls = [\n    \"DELETE from stig where benchmarkId = :benchmarkId\",\n    \"DELETE from current_rev where benchmarkId = :benchmarkId\",\n    \"DELETE from collection_rev_map where benchmarkId = :benchmarkId\",\n    \"DELETE from default_rev where benchmarkId = :benchmarkId\",\n    \"DELETE FROM check_content WHERE digest NOT IN (select checkDigest from rev_group_rule_map)\",\n    \"DELETE FROM fix_text WHERE digest NOT IN (select fixDigest from rev_group_rule_map)\",\n    \"DELETE FROM rule_version_check_digest WHERE ruleId NOT IN (select DISTINCT ruleId from rev_group_rule_map)\"\n  ]\n\n  let connection;\n\n  try {\n    let rows = await _this.queryStigs({\n      filter: {benchmarkId},\n      projections: [], \n      grants: userObject.grants\n    })\n\n    let binds = {\n      benchmarkId: benchmarkId\n    }\n\n    connection = await dbUtils.pool.getConnection()\n    connection.config.namedPlaceholders = true\n    async function transaction () {\n      await connection.query('START TRANSACTION')\n\n      for (const sql of dmls) {\n        await connection.query(sql, binds)\n      }\n   \n      await dbUtils.updateStatsAssetStig( connection, {benchmarkId})\n   \n      await connection.commit()  \n    }\n    await dbUtils.retryOnDeadlock(transaction, svcStatus)\n    return (rows[0])\n  }\n  catch (err) {\n    if (typeof connection !== 'undefined') {\n      await connection.rollback()\n    }\n    throw (err)\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n}\n\n\n/**\n * Return data for the specified CCI\n *\n * cci String A path parameter that indentifies a CCI\n * returns List\n **/\nexports.getCci = async function(cci, inProjection, userObject) {\n  let columns = [\n    'c.cci', \n    'c.status', \n    'c.publishdate', \n    'c.contributor', \n    'c.type', \n    'c.definition'\n  ]\n\n  const orderBy = ['c.cci']\n\n  let joins = [\n    'cci c '\n  ]\n  \n  let predicates = {\n    statements: [],\n    binds: []\n  }\n  \n  // PREDICATES\n  predicates.statements.push('c.cci = ?')\n  predicates.binds.push(cci)\n\n  if ( inProjection?.includes('emassAp') ) {\n    columns.push(`case when c.apAcronym is null then null else json_object(\"apAcronym\", c.apAcronym, \"implementation\", c.implementation, \"assessmentProcedure\", c.assessmentProcedure) END  as \"emassAp\"`)\n  }\n\n  if ( inProjection?.includes('references') ) {\n    columns.push(`(select \n      coalesce\n      (\n        (\n          select json_arrayagg (json_object(\n            'creator', crm.creator,\n            'title', crm.title,\n            'version', crm.version,\n            'location', crm.location,\n            'indexDisa', crm.indexDisa,\n            'textRefNist', crm.textRefNist,\n            'parentControl', crm.parentControl\n          ))\n          from cci_reference_map crm\n          where crm.cci = c.cci\n        ), \n        json_array()\n      )\n    ) as \"references\"`)\n  }\n\n  if ( inProjection?.includes('stigs') ) {\n    columns.push(`(select \n      coalesce\n      (\n        (\n          select json_arrayagg(stig)\n          from\n          (\n            select distinct json_object(\n              'benchmarkId', rv.benchmarkId,\n              'revisionStr', concat('V', rv.version, 'R', rv.release)\n          ) as stig\n          from cci ci\n            left join rev_group_rule_cci_map rgrcc using (cci)\n            left join rev_group_rule_map rgr using (rgrId)\n            left join revision rv using (revId)\n          where ci.cci = c.cci and benchmarkId is not null\n          ) as agg), \n        json_array()\n      )\n    ) as \"stigs\"`)\n  }\n\n  const sql = dbUtils.makeQueryString({columns, joins, predicates, orderBy})\n\n  const [rows] = await dbUtils.pool.query(sql, predicates.binds)\n  return (rows[0])\n}\n\n\n/**\n * Return a list of CCIs from a STIG revision\n *\n * benchmarkId String A path parameter that indentifies a STIG\n * revisionStr String A path parameter that indentifies a STIG revision [ V{version_num}R{release_num} | 'latest' ]\n * returns List\n **/\nexports.getCcisByRevision = async function(benchmarkId, revisionStr, userObject) {\n  let columns = [\n    'c.cci',\n    'c.type',\n    `COALESCE((\n      SELECT JSON_ARRAYAGG(JSON_OBJECT(\n        \"creator\", crm.creator,\n        \"title\", crm.title,\n        \"version\", crm.version,\n        \"location\", crm.location,\n        \"indexDisa\", crm.indexDisa,\n        \"textRefNist\", crm.textRefNist,\n        \"parentControl\", crm.parentControl\n      ))\n      FROM cci_reference_map crm\n      WHERE crm.cci = c.cci\n    ), JSON_ARRAY()) AS \"references\"`\n  ]\n\n  const orderBy = ['c.cci']\n\n  let joins = []\n  let predicates = {\n    statements: [],\n    binds: []\n  }\n  \n  predicates.statements.push('r.benchmarkId = ?')\n  predicates.binds.push(benchmarkId)\n  \n  if (revisionStr != 'latest') {\n    joins = ['revision r']\n\n    const {version, release} = dbUtils.parseRevisionStr(revisionStr)\n    predicates.statements.push('r.version = ?')\n    predicates.binds.push(version)\n    predicates.statements.push('r.release = ?')\n    predicates.binds.push(release)\n  } \n  else {\n    joins = ['current_rev r']\n  }\n  \n  joins.push('LEFT JOIN rev_group_rule_map rgr using (revId)')\n  joins.push('INNER JOIN rev_group_rule_cci_map rgrcc using (rgrId)')\n  joins.push('INNER JOIN cci c using (cci)')\n  // joins.push('LEFT JOIN cci_reference_map crm using (cci)')\n\n  // CONSTRUCT MAIN QUERY\n  const sql = dbUtils.makeQueryString({columns, joins, predicates, orderBy})\n  \n  const [rows] = await dbUtils.pool.query(sql, predicates.binds)\n  return rows\n}\n\n\n/**\n * Return the rules, checks and fixes for a Group from a specified revision of a STIG.\n * None\n *\n * benchmarkId String A path parameter that indentifies a STIG\n * revisionStr String A path parameter that indentifies a STIG revision [ V{version_num}R{release_num} | 'latest' ]\n * groupId String A path parameter that indentifies a Group\n * returns GroupObj\n **/\nexports.getGroupByRevision = async function(benchmarkId, revisionStr, groupId, projection, userObject) {\n  const rows = await _this.queryGroups( projection, {\n    benchmarkId: benchmarkId,\n    revisionStr: revisionStr,\n    groupId: groupId\n  })\n  return (rows[0])\n}\n\n\n/**\n * Return the list of groups for the specified revision of a STIG.\n *\n * benchmarkId String A path parameter that indentifies a STIG\n * revisionStr String A path parameter that indentifies a STIG revision [ V{version_num}R{release_num} | 'latest' ]\n * returns List\n **/\nexports.getGroupsByRevision = async function(benchmarkId, revisionStr, projection, userObject) {\n  return _this.queryGroups( projection, {\n    benchmarkId: benchmarkId,\n    revisionStr: revisionStr\n  })\n}\n\n\n/**\n * Return metadata for the specified revision of a STIG\n *\n * benchmarkId String A path parameter that indentifies a STIG\n * revisionStr String A path parameter that indentifies a STIG revision [ V{version_num}R{release_num} | 'latest' ]\n * returns Revision\n **/\nexports.getRevisionByString = async function({benchmarkId, revisionStr, grants, elevate = false}) {\n  const {\n    unrestrictedCollectionIds, \n    requesterGrantIds, \n    requireCteAcls\n  } = parseGrants(grants, elevate)\n\n  const ctes = []\n  if (requireCteAcls) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: requesterGrantIds}))\n  }\n  ctes.push(cteRevCollection({\n    elevate,\n    unrestrictedCollectionIds,\n    hasRestrictions: !!requesterGrantIds.length\n  }))\n\n  const ro = dbUtils.parseRevisionStr(revisionStr)\n  const columns = [\n    `${ro.table_alias}.benchmarkId`,\n    `concat('V', ${ro.table_alias}.version, 'R', ${ro.table_alias}.release) as \"revisionStr\"`,\n    `cast(${ro.table_alias}.version as char) as version`,\n`    ${ro.table_alias}.release`,\n    `date_format(${ro.table_alias}.benchmarkDateSql,'%Y-%m-%d') as \"benchmarkDate\"`,\n    `${ro.table_alias}.status`,\n    `${ro.table_alias}.statusDate`,\n    `${ro.table_alias}.ruleCount`,\n    `coalesce(rc.collectionIds,json_array()) as collectionIds`\n  ]\n  const joins = [\n    `${ro.table} ${ro.table_alias}`,\n    `left join cte_rev_collection rc on ${ro.table_alias}.revId = rc.revId`\n  ]\n  const predicates = {\n    statements: [`${ro.table_alias}.benchmarkId = ?`],\n    binds: [benchmarkId]\n  }\n  if (ro.version) {\n    predicates.statements.push(\n      'r.version = ?',\n      'r.release = ? ')\n    predicates.binds.push(ro.version, ro.release)\n  }\n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, format: true})\n  const [rows] = await dbUtils.pool.query(sql)\n  return (rows[0])\n}\n\n\n/**\n * Return a list of revisions for the specified STIG\n *\n * benchmarkId String A path parameter that indentifies a STIG\n * returns List\n **/\nexports.getRevisionsByBenchmarkId = async function({benchmarkId, grants, userObject, elevate = false}) {\n  const {\n    unrestrictedCollectionIds, \n    requesterGrantIds, \n    requireCteAcls\n  } = parseGrants(grants, elevate)\n\n  const ctes = []\n  if (requireCteAcls) {\n    ctes.push(dbUtils.cteAclEffective({grantIds: requesterGrantIds}))\n  }\n  ctes.push(cteRevCollection({\n    elevate,\n    unrestrictedCollectionIds,\n    hasRestrictions: !!requesterGrantIds.length\n  }))\n\n  const columns = [\n    'r.benchmarkId',\n    `concat('V', r.version, 'R', r.release) as \"revisionStr\"`,\n    'CAST(r.version as char) as version',\n    'r.release',\n    `date_format(r.benchmarkDateSql,'%Y-%m-%d') as \"benchmarkDate\"`,\n    'r.status',\n    'r.statusDate',\n    'r.marking',\n    'r.ruleCount',\n    'coalesce(rc.collectionIds,json_array()) as collectionIds'\n  ]\n\n  const joins = [\n    'revision r',\n    'left join cte_rev_collection rc on r.revId = rc.revId'\n  ]\n  const predicates = {\n    statements: ['r.benchmarkId = ?'],\n    binds: [benchmarkId]\n  }\n  const orderBy = ['r.benchmarkDateSql desc']\n  \n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, orderBy, format: true})\n  const [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\n\n/**\n * Return the defintion and associated checks and fixes for the specified Rule\n *\n * ruleId String A path parameter that indentifies a Rule\n * returns Rule\n **/\nexports.getRuleByRuleId = async function(ruleId, projection, userObject) {\n  return _this.queryRules( ruleId, projection )\n}\n\n\n/**\n * Return rule data for the specified Rule in a revision of a STIG.\n *\n * benchmarkId String A path parameter that indentifies a STIG\n * revisionStr String A path parameter that indentifies a STIG revision [ V{version_num}R{release_num} | 'latest' ]\n * returns List\n **/\nexports.getRuleByRevision = async function(benchmarkId, revisionStr, ruleId, projection, userObject) {\n  const rows = await _this.queryBenchmarkRules( benchmarkId, revisionStr, projection, {\n    ruleId: ruleId\n  })\n  return (rows[0])\n}\n\n\n/**\n * Return rule data for the specified revision of a STIG.\n *\n * benchmarkId String A path parameter that indentifies a STIG\n * revisionStr String A path parameter that indentifies a STIG revision [ V{version_num}R{release_num} | 'latest' ]\n * returns List\n **/\nexports.getRulesByRevision = async function(benchmarkId, revisionStr, projection, userObject) {\n  return _this.queryBenchmarkRules( benchmarkId, revisionStr, projection, {} )\n}\n\n\n/**\n * Return a list of available STIGs\n *\n * title String A string found anywhere in a STIG title (optional)\n * returns List\n **/\nexports.getSTIGs = async function(title, projections, userObject, elevate) {\n  return _this.queryStigs({\n    filter: {title},\n    projections,\n    grants: userObject.grants,\n    elevate\n  })\n}\n\n\n/**\n * Return properties of the specified STIG\n *\n * benchmarkId String A path parameter that indentifies a STIG\n * returns STIG\n **/\nexports.getStigById = async function(benchmarkId, userObject, elevate) {\n  const rows = await _this.queryStigs({\n    filter: {benchmarkId},\n    projections: ['revisions'],\n    grants: userObject.grants,\n    elevate\n  })\n  return (rows[0])\n}\n\nexports.getRevisionStrsByBenchmarkId = async function (benchmarkId) {\n  const sql = `SELECT\n    concat('V', r.version, 'R', r.release) as \"revisionStr\"\n  FROM\n    revision r\n  WHERE\n    r.benchmarkId = ?`\n  const [rows] = await dbUtils.pool.query(sql, [benchmarkId])\n  return rows.map( row => row.revisionStr)\n}\n\nexports.getRevisionStrsByBenchmarkIds = async function (benchmarkIds) {\n  const sql = `SELECT\n    r.benchmarkId,\n    json_arrayagg(concat('V', r.version, 'R', r.release)) as \"revisionStrs\"\n  FROM\n    revision r\n  WHERE\n    r.benchmarkId IN ?\n  GROUP BY\n    r.benchmarkId`\n  const [rows] = await dbUtils.pool.query(sql, [[benchmarkIds]])\n  const returnObj = {}\n  for (const row of rows) {\n    returnObj[row.benchmarkId] = row.revisionStrs\n  }\n  return returnObj\n}\n\nexports.getHighestMarkingByRevisions = async function (stigRevisions) {\n  if (stigRevisions.length === 0) {\n    return 'U'\n  }\n  \n  const revisionCriteria = stigRevisions.map(() => {\n    return `(r.benchmarkId = ? AND r.revisionStr = ?)`\n  }).join(' OR ')\n  \n  const binds = []\n  for (const {benchmarkId, revisionStr} of stigRevisions) {\n    binds.push(benchmarkId, revisionStr)\n  }\n  \n  const sql = `\n    SELECT r.marking \n    FROM revision r \n    WHERE (${revisionCriteria}) AND r.marking IS NOT NULL\n    ORDER BY r.marking ASC\n    LIMIT 1\n  `\n  \n  const [rows] = await dbUtils.pool.query(sql, binds)\n  \n  if (rows.length === 0) {\n    return 'U'\n  }\n  \n  return rows[0].marking || 'U'\n}\n"
  },
  {
    "path": "api/source/service/UserService.js",
    "content": "'use strict';\nconst config = require('../utils/config');\nconst SmError = require('../utils/error');\nconst dbUtils = require('./utils')\n\nconst _this = this\n\n/**\nGeneralized queries for users\n**/\nexports.queryUsers = async function (inProjection, inPredicates, elevate, userObject) {\n  const ctes = []\n  let needsCollectionGrantees = false\n  const columns = [\n    'CAST(ud.userId as char) as userId',\n    'ud.username',\n    'ud.lastAccess',\n    `json_extract(\n      ud.lastClaims, ?\n    ) as email`,\n    `COALESCE(json_unquote(json_extract(\n      ud.lastClaims, ?\n    )), ud.username) as displayName`,\n    `json_object(\n      'create_collection', 'create_collection' member of(JSON_VALUE(ud.lastClaims, ? default '[]' on empty)),\n      'admin', 'admin' member of(JSON_VALUE(ud.lastClaims, ? default '[]' on empty))\n    ) as 'privileges'`,\n    'ud.status',\n    \"date_format(ud.statusDate, '%Y-%m-%dT%TZ') as statusDate\",\n    'CAST(ud.statusUser as char) as statusUser'\n  ]\n  const joins = new Set([\n    'user_data ud'\n  ])\n  const groupBy = ['ud.userId']\n\n  const orderBy = ['ud.username']\n\n  // PROJECTIONS\n  if (inProjection?.includes('collectionGrants')) {\n    needsCollectionGrantees = true\n    joins.add('left join cteGrantees cgs on ud.userId = cgs.userId')\n    joins.add('left join enabled_collection c on cgs.collectionId = c.collectionId')\n    columns.push(`case when count(cgs.collectionId) > 0\n    then \n      ${dbUtils.jsonArrayAggDistinct(`json_object(\n        'collection', json_object(\n          'collectionId', CAST(cgs.collectionId as char),\n          'name', c.name\n        ),\n        'roleId', cgs.roleId,\n        'grantees', cgs.grantees\n      )`)}\n    else json_array() \n    end as collectionGrants`)\n  }\n\n  if (inProjection?.includes('statistics')) {\n    needsCollectionGrantees = true\n    joins.add('left join cteGrantees cgs on ud.userId = cgs.userId')\n    columns.push(`json_object(\n        'created', date_format(ud.created, '%Y-%m-%dT%TZ'),\n        'collectionGrantCount', count(distinct cgs.collectionId),\n        'lastClaims', ud.lastClaims\n      ) as statistics`)\n    groupBy.push(\n      'ud.lastAccess',\n      'ud.lastClaims'\n    )\n  }\n  if (inProjection?.includes('userGroups')) {\n    joins.add('left join user_group_user_map ugu on ud.userId = ugu.userId')\n    joins.add('left join user_group ug on ugu.userGroupId = ug.userGroupId')\n    columns.push(`CASE WHEN COUNT(ugu.userGroupId) > 0\n    THEN cast(concat('[', group_concat( distinct JSON_OBJECT(\n      'userGroupId', cast(ugu.userGroupId as char),\n      'name', ug.name\n    )), ']') as json)\n    ELSE json_array()\n    END as userGroups`)\n  }\n\n  if(inProjection?.includes('webPreferences')) {\n    columns.push(`ud.webPreferences`)\n  }\n\n  // PREDICATES\n  let predicates = {\n    statements: [],\n    binds: [\n      `$.${config.oauth.claims.email}`,\n      `$.${config.oauth.claims.name}`,\n      `$.${config.oauth.claims.privileges}`,\n      `$.${config.oauth.claims.privileges}`\n    ]\n  }\n  if (inPredicates.userId) {\n    predicates.statements.push('ud.userId = ?')\n    predicates.binds.push(inPredicates.userId)\n  }\n  if ( inPredicates.username ) {\n    let matchStr = '= ?'\n    if ( inPredicates.usernameMatch && inPredicates.usernameMatch !== 'exact') {\n      matchStr = 'LIKE ?'\n      switch (inPredicates.usernameMatch) {\n        case 'startsWith':\n          inPredicates.username = `${inPredicates.username}%`\n          break\n        case 'endsWith':\n          inPredicates.username = `%${inPredicates.username}`\n          break\n        case 'contains':\n          inPredicates.username = `%${inPredicates.username}%`\n          break\n      }\n    }\n    predicates.statements.push(`ud.username ${matchStr}`)\n    predicates.binds.push(inPredicates.username)\n  }\n  \n  if (inPredicates.privilege) {\n    predicates.statements.push(\n      `JSON_CONTAINS(JSON_EXTRACT(ud.lastClaims, ?), ?) `\n    )\n    predicates.binds.push(`$.${config.oauth.claims.privileges}`, JSON.stringify([inPredicates.privilege]))\n  }\n  \n  if (inPredicates.status) {\n    predicates.statements.push('ud.status = ?')\n    predicates.binds.push(inPredicates.status)\n  }\n  \n  if (needsCollectionGrantees) {\n    ctes.push(dbUtils.sqlGrantees({userId: inPredicates.userId, username: inPredicates.username, returnCte: true}))\n  }\n\n  // CONSTRUCT MAIN QUERY\n  const sql = dbUtils.makeQueryString({ctes, columns, joins, predicates, groupBy, orderBy, format: true})\n  let [rows] = await dbUtils.pool.query(sql)\n  return (rows)\n}\n\nexports.addOrUpdateUser = async function (writeAction, userId, body, projection, elevate, userObject, svcStatus = {}) {\n  let connection \n  try {\n    // CREATE: userId will be null\n    // REPLACE/UPDATE: userId is not null\n\n    // Extract or initialize non-scalar properties to separate variables\n    let { collectionGrants, userGroups, ...userFields } = body\n\n    connection = await dbUtils.pool.getConnection()\n    connection.config.namedPlaceholders = true\n    async function transaction () {\n      await connection.query('START TRANSACTION');\n\n      // Process scalar properties\n      let binds\n      if (writeAction === dbUtils.WRITE_ACTION.CREATE) {\n        // INSERT into user_data\n        binds = {...userFields}\n        let sqlInsert =\n          `INSERT INTO\n              user_data\n              ( username, status )\n            VALUES\n              (:username, :status )`\n        let [result] = await connection.query(sqlInsert, binds)\n        userId = result.insertId\n      }\n      else if (writeAction === dbUtils.WRITE_ACTION.UPDATE || writeAction === dbUtils.WRITE_ACTION.REPLACE) {\n        binds = {\n          userId: userId,\n          values: userFields\n        }\n        if (Object.keys(binds.values).length > 0) {\n          let sqlUpdate =\n            `UPDATE\n                user_data\n              SET\n                :values\n              WHERE\n                userid = :userId`\n          await connection.query(sqlUpdate, binds)\n        }\n      }\n      else {\n        throw new Error('Invalid writeAction')\n      }\n  \n      // Process grants if present\n      if (collectionGrants) {\n        if ( writeAction !== dbUtils.WRITE_ACTION.CREATE ) {\n          // DELETE from collection_grant\n          const binds = [userId]\n          let sqlDeleteCollGrant = 'DELETE FROM collection_grant where userId = ?'\n          if (collectionGrants.length > 0) {\n            const collectionIds = collectionGrants.map(grant => grant.collectionId)\n            sqlDeleteCollGrant += ' and collectionId NOT IN (?)'\n            binds.push(collectionIds)\n          }\n          await connection.query(sqlDeleteCollGrant, binds)\n        }\n        if (collectionGrants.length > 0) {\n          let sqlInsertCollGrant = `\n            INSERT INTO \n              collection_grant (userId, collectionId, roleId)\n            VALUES\n              ? as new\n            ON DUPLICATE KEY UPDATE\n              roleId = new.roleId`      \n          binds = collectionGrants.map( grant => [userId, grant.collectionId, grant.roleId])\n          // INSERT into collection_grant\n          await connection.query(sqlInsertCollGrant, [binds] )\n        }\n      }\n      if (userGroups) {\n        if ( writeAction !== dbUtils.WRITE_ACTION.CREATE ) {\n          await connection.query('DELETE FROM user_group_user_map where userId = ?', [userId])\n        }\n        if (userGroups.length > 0) {\n          await connection.query(\n            `INSERT INTO user_group_user_map (userGroupId, userId) VALUES ?`, \n            [userGroups.map( userGroup => [userGroup, userId])]\n          )\n        }\n      }\n      // Commit the changes\n      await connection.commit()\n    }\n    await dbUtils.retryOnDeadlock(transaction, svcStatus)\n  }\n  catch (err) {\n    await connection.rollback()\n    throw err\n  }\n  finally {\n    if (typeof connection !== 'undefined') {\n      await connection.release()\n    }\n  }\n\n  // Fetch the new or updated User for the response\n  try {\n    let row = await _this.getUserByUserId(userId, projection, elevate, userObject)\n    return row\n  }\n  catch (err) {\n    throw ( {status: 500, message: err.message, stack: err.stack} )\n  }  \n}\n\n\n/**\n * Create a User\n *\n * body UserAssign \n * projection List Additional properties to include in the response.  (optional)\n * returns List\n **/\nexports.createUser = async function(body, projection, elevate, userObject, svcStatus = {}) {\n  let row = await _this.addOrUpdateUser(dbUtils.WRITE_ACTION.CREATE, null, body, projection, elevate, userObject, svcStatus)\n  return (row)\n}\n\n\n/**\n * Delete a User\n *\n * projection List Additional properties to include in the response.  (optional)\n * returns UserProjected\n **/\nexports.deleteUser = async function(userId, projection, elevate, userObject) {\n  try {\n    let row = await _this.queryUsers(projection, { userId: userId }, elevate, userObject)\n    let sqlDelete = `DELETE FROM user_data where userId = ?`\n    await dbUtils.pool.query(sqlDelete, [userId])\n    return (row[0])\n  }\n  catch (err) {\n    throw ( {status: 500, message: err.message, stack: err.stack} )\n  }\n}\n\n\n/**\n * Return a User\n *\n * userId Integer Selects a User\n * projection List Additional properties to include in the response.  (optional)\n * returns UserProjected\n **/\nexports.getUserByUserId = async function(userId, projection, elevate, userObject) {\n  try {\n    let rows = await _this.queryUsers( projection, {\n      userId: userId\n    }, elevate, userObject)\n    return (rows[0])\n  }\n  catch(err) {\n    throw ( {status: 500, message: err.message, stack: err.stack} )\n  }\n}\n\nexports.getUserByUsername = async function(username, projection, elevate, userObject) {\n  try {\n    let rows = await _this.queryUsers( projection, {\n      username: username\n    }, elevate, userObject)\n    return (rows[0])\n  }\n  catch(err) {\n    throw ( {status: 500, message: err.message, stack: err.stack} )\n  }\n}\n\nexports.getUsers = async function(username, usernameMatch, privilege, status, projection, elevate, userObject) {\n  try {\n    let rows = await _this.queryUsers( projection, {\n      username,\n      usernameMatch,\n      privilege,\n      status\n    }, elevate, userObject)\n    return (rows)\n  }\n  catch(err) {\n    throw ( {status: 500, message: err.message, stack: err.stack} )\n  }\n}\n\nexports.replaceUser = async function( userId, body, projection, elevate, userObject, svcStatus = {} ) {\n  const row = await _this.addOrUpdateUser(dbUtils.WRITE_ACTION.REPLACE, userId, body, projection, elevate, userObject, svcStatus)\n  return (row)\n}\n\nexports.updateUser = async function( userId, body, projection, elevate, userObject, svcStatus = {} ) {\n  if (body.status === 'unavailable' && (body.collectionGrants?.length || body.userGroups?.length)) {\n    throw new SmError.UserInconsistentError()\n  } \n  let row = await _this.addOrUpdateUser(dbUtils.WRITE_ACTION.UPDATE, userId, body, projection, elevate, userObject, svcStatus)\n  return (row)\n}\n\nexports.setUserData = async function (userObject, fields) {\n  if (userObject.userId) {\n    await dbUtils.pool.query(`UPDATE user_data SET ? WHERE userId = ?`, [fields, userObject.userId])\n    return userObject.userId\n  }\n  else {\n    const [result] = await dbUtils.pool.query(`INSERT INTO user_data SET ?`, [{username: userObject.username, ...fields}])\n    return result.insertId\n  }\n}\n\nexports.addOrUpdateUserGroup = async function ({userGroupId, userGroupFields, userIds, collectionGrants, createdUserId, modifiedUserId, svcStatus = {}}) {\n  // CREATE: userGroupId is falsey\n  // REPLACE/UPDATE: userGroupId is not falsey\n  const isUpdate = !!userGroupId\n\n  const sqlInsertUserGroup = `INSERT into user_group (name, description, createdUserId, modifiedUserId) VALUES (?,?,?,?)`\n  const sqlUpdateUserGroup = `UPDATE user_group SET ? WHERE userGroupId = ?`\n  const sqlInsertUserGroupUserMap = `INSERT into user_group_user_map (userGroupId, userId) VALUES ?`\n  const sqlDeleteUserGroupUserMap = `DELETE from user_group_user_map WHERE userGroupId = ?`\n\n  async function transactionFn (connection) {\n    if (Object.keys(userGroupFields).length) {\n      const sql = isUpdate ? sqlUpdateUserGroup : sqlInsertUserGroup\n      const binds = isUpdate ? [userGroupFields, userGroupId] : [userGroupFields.name, userGroupFields.description, createdUserId, modifiedUserId]\n      const [resultUserGroup] = await connection.query(sql, binds)\n      userGroupId = isUpdate ? userGroupId : resultUserGroup.insertId\n    }\n    if (userIds) {\n      if (isUpdate) {\n        await connection.query(sqlDeleteUserGroupUserMap, [userGroupId])\n      }\n      if (userIds.length) {\n        const binds = userIds.map( userId => [userGroupId, userId])\n        await connection.query(\n          sqlInsertUserGroupUserMap,\n          [binds]\n        ) \n      }\n    }\n    // Process grants if present\n    if (collectionGrants) {\n      if (isUpdate) {\n        // DELETE from collection_grant\n        const binds = [userGroupId]\n        let sqlDeleteCollGrant = 'DELETE FROM collection_grant where userGroupId = ?'\n        if (collectionGrants.length > 0) {\n          const collectionIds = collectionGrants.map(grant => grant.collectionId)\n          sqlDeleteCollGrant += ' and collectionId NOT IN (?)'\n          binds.push(collectionIds)\n        }\n        await connection.query(sqlDeleteCollGrant, binds)\n      }\n      if (collectionGrants.length > 0) {\n        let sqlInsertCollGrant = `\n          INSERT INTO \n            collection_grant (userGroupId, collectionId, roleId)\n          VALUES\n            ? as new\n          ON DUPLICATE KEY UPDATE\n            roleId = new.roleId`      \n        const binds = collectionGrants.map( grant => [userGroupId, grant.collectionId, grant.roleId])\n        // INSERT into collection_grant\n        await connection.query(sqlInsertCollGrant, [binds] )\n      }\n    }\n    return userGroupId\n  }\n\n  return dbUtils.retryOnDeadlock2({\n    transactionFn, \n    statusObj: svcStatus\n  })\n}\n\nexports.queryUserGroups = async function ({projections = [], filters = {}, elevate = false, userObject = {}}) {\n  // query components\n  const columns = [\n    'CAST(ug.userGroupId as char) as userGroupId',\n    'ug.name',\n    'ug.description'\n  ]\n  const joins = new Set([`user_group ug`])\n  const groupBy = new Set()\n  const orderBy = ['name']\n  const predicates = {\n    statements: [],\n    binds: []\n  }\n\n  // predicates\n  if (filters.userGroupId) {\n    predicates.statements.push('ug.userGroupId = ?')\n    predicates.binds.push(filters.userGroupId)\n  }\n\n  // projections\n  if (projections.includes('attributions')) {\n    joins.add('left join user_data udCreated on ug.createdUserId = udCreated.userId')\n    joins.add('left join user_data udModified on ug.modifiedUserId = udModified.userId')\n    columns.push(`json_object(\n      'created', json_object(\n        'userId', CAST(ug.createdUserId AS CHAR),\n        'username', udCreated.username,\n        'ts', DATE_FORMAT(ug.createdDate, '%Y-%m-%dT%H:%i:%sZ') \n        ),\n      'modified', json_object(\n        'userId', CAST(ug.modifiedUserId AS CHAR),\n        'username', udModified.username,\n        'ts', DATE_FORMAT(ug.modifiedDate, '%Y-%m-%dT%H:%i:%sZ')\n        )\n    ) as attributions`)\n  }\n  if (projections.includes('users')) {\n    joins.add('left join user_group_user_map ugu using (userGroupId)')\n    joins.add('left join user_data udUser on ugu.userId = udUser.userId')\n    groupBy.add('ug.userGroupId')\n    columns.push(`CASE WHEN count(ugu.userId)=0 \n    THEN json_array()\n    ELSE cast(concat('[', group_concat(distinct json_object(\n      'userId', cast(ugu.userId as char),\n      'username', udUser.username,\n      'displayName', COALESCE(json_unquote(json_extract(\n        udUser.lastClaims, '$.${config.oauth.claims.name}'\n      )), udUser.username)\n      )\n    ), ']') as json)\n    END as users`)\n  }\n  if (projections.includes('collections') || projections.includes('collectionGrants')) {\n    joins.add('left join collection_grant cgg using (userGroupId)')\n    joins.add('left join enabled_collection on cgg.collectionId = enabled_collection.collectionId')\n    groupBy.add('ug.userGroupId')\n    columns.push(`CASE WHEN count(cgg.collectionId)=0 \n    THEN json_array()\n    ELSE cast(concat('[', group_concat(distinct json_object(\n      'roleId', cgg.roleId,\n      'collection', json_object(\n        'collectionId', cast(cgg.collectionId as char),\n        'name', enabled_collection.name\n      ))\n    ), ']') as json)\n    END as collectionGrants`)\n  }\n  const sql = dbUtils.makeQueryString({columns, joins, predicates, groupBy, orderBy, format: true})\n  const [rows] = await dbUtils.pool.query(sql)\n  return rows\n}\n\nexports.deleteUserGroup = async function({userGroupId}) {\n    const sqlDeleteUserGroup = `DELETE from user_group WHERE userGroupId = ?`\n    await dbUtils.pool.query(sqlDeleteUserGroup, [userGroupId])\n    return userGroupId\n}\n\nexports.getUserObject = async function (username) {\n  const sql = `\n  select\n    userId,\n    username,\n    lastAccess,\n    lastClaims,\n    status,\n    (select\n      coalesce(json_objectagg(\n        dt2.collectionId, json_object(\n          'collectionId', dt2.collectionId,\n          'name', dt2.name,\n          'roleId', dt2.roleId, \n          'grantIds', dt2.grantIds)), json_object())\n    from   \n      (select \n        cg.collectionId,\n        c.name,\n        cg.roleId,\n        json_array(cg.grantId) as grantIds\n      from\n        collection_grant cg\n        inner join enabled_collection c on (cg.collectionId = c.collectionId)\n        left join user_data ud2 on cg.userId = ud2.userId\n      where\n        ud2.userId = ud.userId\n      union \n      select\n        collectionId,\n        name,\n        roleId,\n        grantIds\n      from\n        (select\n          ROW_NUMBER() OVER(PARTITION BY ugu.userId, cg.collectionId ORDER BY cg.roleId desc) as rn,\n          cg.collectionId,\n          c.name, \n          cg.roleId,\n          json_arrayagg(cg.grantId) OVER (PARTITION BY ugu.userId, cg.collectionId, cg.roleId) as grantIds\n        from \n          collection_grant cg\n          inner join enabled_collection c on (cg.collectionId = c.collectionId)\n          left join user_group_user_map ugu on cg.userGroupId = ugu.userGroupId\n          left join user_group ug on ugu.userGroupId = ug.userGroupId\n          left join user_data ud3 on ugu.userId = ud3.userId\n          left join collection_grant cgDirect on (cg.collectionId = cgDirect.collectionId and ugu.userId = cgDirect.userId)\n        where\n        cg.userGroupId is not null\n        and cgDirect.userId is null\n        and ud3.userId = ud.userId) dt\n    where\n      dt.rn = 1) dt2) as grants                               \n  from\n    user_data ud\n  where\n    ud.username = ?`\n  const [rows] = await dbUtils.pool.query(sql, [username])\n  return rows[0]\n}\n\nexports.getUserWebPreferences = async function (userId) {\n  const sql = `SELECT webPreferences FROM user_data WHERE userId = ?`\n  const [rows] = await dbUtils.pool.query(sql, [userId])\n  return rows[0]?.webPreferences\n}\n\nexports.patchUserWebPreferences = async function (userId, preferences) {\n  const sql = `UPDATE user_data SET webPreferences = JSON_MERGE_PATCH(webPreferences, ?) WHERE userId = ?`\n  await dbUtils.pool.query(sql, [JSON.stringify(preferences), userId])\n  return preferences\n}\n"
  },
  {
    "path": "api/source/service/migrations/0000.js",
    "content": "const Importer = require('./lib/mysql-import.js')\nconst logger = require('../../utils/logger')\nconst path = require('path')\nconst fs = require('fs')\n\nmodule.exports = {\n    up: async (pool) => {\n        const migrationName = path.basename(__filename, '.js')\n        try {\n            logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'up', name: migrationName })\n            const importer = new Importer(pool)\n            const dir = path.join(__dirname, 'sql', migrationName, 'up')\n            const files = await fs.promises.readdir(dir)\n            for (const file of files) {\n                logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, file })\n                await importer.import(path.join(dir, file))\n            }    \n        }\n        catch (e) {\n            logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message})\n            throw (e)\n        }\n    },\n    down: async(pool)=> {\n        try {\n            const migrationName = path.basename(__filename, '.js')\n            logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'down', name: migrationName })\n            const importer = new Importer(pool)\n            const dir = path.join(__dirname, 'sql', migrationName, 'down')\n            const files = await fs.promises.readdir(dir)\n            for (const file of files) {\n                logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, file })\n                await importer.import(path.join(dir, file))\n            }\n        }\n        catch (e) {\n            logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message})\n            throw (e)\n        }\n    }\n}"
  },
  {
    "path": "api/source/service/migrations/0001.js",
    "content": "const Importer = require('./lib/mysql-import.js')\nconst logger = require('../../utils/logger')\nconst path = require('path')\nconst fs = require('fs')\n\nmodule.exports = {\n    up: async (pool) => {\n        const migrationName = path.basename(__filename, '.js')\n        try {\n            logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'up', name: migrationName })\n            const importer = new Importer(pool)\n            const dir = path.join(__dirname, 'sql', migrationName, 'up')\n            const files = await fs.promises.readdir(dir)\n            for (const file of files) {\n                logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, file })\n                await importer.import(path.join(dir, file))\n            }    \n        }\n        catch (e) {\n            logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message})\n            throw (e)\n        }\n    },\n    down: async(pool)=> {\n        try {\n            const migrationName = path.basename(__filename, '.js')\n            logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'down', name: migrationName })\n            const importer = new Importer(pool)\n            const dir = path.join(__dirname, 'sql', migrationName, 'down')\n            const files = await fs.promises.readdir(dir)\n            for (const file of files) {\n                logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, file })\n                await importer.import(path.join(dir, file))\n            }\n        }\n        catch (e) {\n            logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message})\n            throw (e)\n        }\n    }\n}"
  },
  {
    "path": "api/source/service/migrations/0002.js",
    "content": "const Importer = require('./lib/mysql-import.js')\nconst logger = require('../../utils/logger')\nconst path = require('path')\nconst fs = require('fs')\n\nmodule.exports = {\n    up: async (pool) => {\n        const migrationName = path.basename(__filename, '.js')\n        try {\n            logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'up', name: migrationName })\n            const importer = new Importer(pool)\n            const dir = path.join(__dirname, 'sql', migrationName, 'up')\n            const files = await fs.promises.readdir(dir)\n            for (const file of files) {\n                logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, file })\n                await importer.import(path.join(dir, file))\n            }    \n        }\n        catch (e) {\n            logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message})\n            throw (e)\n        }\n    },\n    down: async(pool)=> {\n        try {\n            const migrationName = path.basename(__filename, '.js')\n            logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'down', name: migrationName })\n            const importer = new Importer(pool)\n            const dir = path.join(__dirname, 'sql', migrationName, 'down')\n            const files = await fs.promises.readdir(dir)\n            for (const file of files) {\n                logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, file })\n                await importer.import(path.join(dir, file))\n            }\n        }\n        catch (e) {\n            logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message})\n            throw (e)\n        }\n    }\n}"
  },
  {
    "path": "api/source/service/migrations/0003.js",
    "content": "const Importer = require('./lib/mysql-import.js')\nconst logger = require('../../utils/logger')\nconst path = require('path')\nconst fs = require('fs')\n\nmodule.exports = {\n    up: async (pool) => {\n        const migrationName = path.basename(__filename, '.js')\n        try {\n            logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'up', name: migrationName })\n            const importer = new Importer(pool)\n            const dir = path.join(__dirname, 'sql', migrationName, 'up')\n            const files = await fs.promises.readdir(dir)\n            for (const file of files) {\n                logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, file })\n                await importer.import(path.join(dir, file))\n            }    \n        }\n        catch (e) {\n            logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message})\n            throw (e)\n        }\n    },\n    down: async(pool)=> {\n        try {\n            const migrationName = path.basename(__filename, '.js')\n            logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'down', name: migrationName })\n            const importer = new Importer(pool)\n            const dir = path.join(__dirname, 'sql', migrationName, 'down')\n            const files = await fs.promises.readdir(dir)\n            for (const file of files) {\n                logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, file })\n                await importer.import(path.join(dir, file))\n            }\n        }\n        catch (e) {\n            logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message})\n            throw (e)\n        }\n    }\n}"
  },
  {
    "path": "api/source/service/migrations/0004.js",
    "content": "const Importer = require('./lib/mysql-import.js')\nconst logger = require('../../utils/logger')\nconst path = require('path')\nconst fs = require('fs')\n\nmodule.exports = {\n    up: async (pool) => {\n        const migrationName = path.basename(__filename, '.js')\n        try {\n            logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'up', name: migrationName })\n            const importer = new Importer(pool)\n            const dir = path.join(__dirname, 'sql', migrationName, 'up')\n            const files = await fs.promises.readdir(dir)\n            for (const file of files) {\n                logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, file })\n                await importer.import(path.join(dir, file))\n            }    \n        }\n        catch (e) {\n            logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message})\n            throw (e)\n        }\n    },\n    down: async(pool)=> {\n        try {\n            const migrationName = path.basename(__filename, '.js')\n            logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'down', name: migrationName })\n            const importer = new Importer(pool)\n            const dir = path.join(__dirname, 'sql', migrationName, 'down')\n            const files = await fs.promises.readdir(dir)\n            for (const file of files) {\n                logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, file })\n                await importer.import(path.join(dir, file))\n            }\n        }\n        catch (e) {\n            logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message})\n            throw (e)\n        }\n    }\n}"
  },
  {
    "path": "api/source/service/migrations/0005.js",
    "content": "const Importer = require('./lib/mysql-import.js')\nconst logger = require('../../utils/logger')\nconst path = require('path')\nconst fs = require('fs')\n\nmodule.exports = {\n    up: async (pool) => {\n        const migrationName = path.basename(__filename, '.js')\n        try {\n            logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'up', name: migrationName })\n            const importer = new Importer(pool)\n            const dir = path.join(__dirname, 'sql', migrationName, 'up')\n            const files = await fs.promises.readdir(dir)\n            for (const file of files) {\n                logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, file })\n                await importer.import(path.join(dir, file))\n            }    \n        }\n        catch (e) {\n            logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message})\n            throw (e)\n        }\n    },\n    down: async(pool)=> {\n        try {\n            const migrationName = path.basename(__filename, '.js')\n            logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'down', name: migrationName })\n            const importer = new Importer(pool)\n            const dir = path.join(__dirname, 'sql', migrationName, 'down')\n            const files = await fs.promises.readdir(dir)\n            for (const file of files) {\n                logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, file })\n                await importer.import(path.join(dir, file))\n            }\n        }\n        catch (e) {\n            logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message})\n            throw (e)\n        }\n    }\n}"
  },
  {
    "path": "api/source/service/migrations/0006.js",
    "content": "const Importer = require('./lib/mysql-import.js')\nconst logger = require('../../utils/logger')\nconst path = require('path')\nconst fs = require('fs')\n\nmodule.exports = {\n    up: async (pool) => {\n        const migrationName = path.basename(__filename, '.js')\n        try {\n            logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'up', name: migrationName })\n            const importer = new Importer(pool)\n            const dir = path.join(__dirname, 'sql', migrationName, 'up')\n            const files = await fs.promises.readdir(dir)\n            for (const file of files) {\n                logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, file })\n                await importer.import(path.join(dir, file))\n            }    \n        }\n        catch (e) {\n            logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message})\n            throw (e)\n        }\n    },\n    down: async(pool)=> {\n        try {\n            const migrationName = path.basename(__filename, '.js')\n            logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'down', name: migrationName })\n            const importer = new Importer(pool)\n            const dir = path.join(__dirname, 'sql', migrationName, 'down')\n            const files = await fs.promises.readdir(dir)\n            for (const file of files) {\n                logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, file })\n                await importer.import(path.join(dir, file))\n            }\n        }\n        catch (e) {\n            logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message})\n            throw (e)\n        }\n    }\n}"
  },
  {
    "path": "api/source/service/migrations/0007.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  'SET FOREIGN_KEY_CHECKS=0',\n  'ALTER TABLE stig MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_cs',\n  'ALTER TABLE stig_asset_map MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_cs',\n  'ALTER TABLE current_group_rule MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_cs',\n  'ALTER TABLE current_rev MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_cs',\n  'ALTER TABLE revision MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_cs',\n  'ALTER TABLE rule_oval_map MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_cs',\n  'ALTER TABLE stats_asset_stig MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_cs',\n  'SET FOREIGN_KEY_CHECKS=1'\n]\n\nconst downMigration = [\n  'SET FOREIGN_KEY_CHECKS=0',\n  'ALTER TABLE stig MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_ci',\n  'ALTER TABLE stig_asset_map MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_ci',\n  'ALTER TABLE current_group_rule MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_ci',\n  'ALTER TABLE current_rev MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_ci',\n  'ALTER TABLE revision MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_ci',\n  'ALTER TABLE rule_oval_map MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_ci',\n  'ALTER TABLE stats_asset_stig MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_ci',\n  'SET FOREIGN_KEY_CHECKS=1'\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0008.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  'ALTER TABLE asset MODIFY COLUMN name VARCHAR(255) NOT NULL',\n  'ALTER TABLE asset MODIFY COLUMN ip VARCHAR(255) NULL DEFAULT NULL',\n  'ALTER TABLE asset MODIFY COLUMN mac VARCHAR(255) NULL DEFAULT NULL'\n]\n\nconst downMigration = [\n  'ALTER TABLE asset MODIFY COLUMN name VARCHAR(45) NOT NULL',\n  'ALTER TABLE asset MODIFY COLUMN ip VARCHAR(45) NULL DEFAULT NULL',\n  'ALTER TABLE asset MODIFY COLUMN mac VARCHAR(17) NULL DEFAULT NULL'\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0009.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  'ALTER TABLE review ADD COLUMN metadata JSON NOT NULL DEFAULT (JSON_OBJECT())'\n]\n\nconst downMigration = [\n  'ALTER TABLE review DROP COLUMN metadata'\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0010.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `\n    ALTER TABLE stig_asset_map \n      ADD COLUMN minTs datetime DEFAULT NULL,\n      ADD COLUMN maxTs datetime DEFAULT NULL,\n      ADD COLUMN savedManual int DEFAULT NULL,\n      ADD COLUMN savedAuto int DEFAULT NULL,\n      ADD COLUMN submittedManual int DEFAULT NULL,\n      ADD COLUMN submittedAuto int DEFAULT NULL,\n      ADD COLUMN rejectedManual int DEFAULT NULL,\n      ADD COLUMN rejectedAuto int DEFAULT NULL,\n      ADD COLUMN acceptedManual int DEFAULT NULL,\n      ADD COLUMN acceptedAuto int DEFAULT NULL,\n      ADD COLUMN highCount int DEFAULT NULL,\n      ADD COLUMN mediumCount int DEFAULT NULL,\n      ADD COLUMN lowCount int DEFAULT NULL;\n  `,\n  `\n  UPDATE stig_asset_map sam\n\t  INNER JOIN stats_asset_stig sas ON sam.benchmarkId = sas.benchmarkId AND sam.assetId = sas.assetId\n  SET sam.minTs = sas.minTs\n\t  , sam.maxTs = sas.maxTs\n    , sam.savedManual = sas.savedManual\n    , sam.savedAuto = sas.savedAuto\n    , sam.submittedManual = sas.submittedManual\n    , sam.submittedAuto = sas.submittedAuto\n    , sam.rejectedManual = sas.rejectedManual\n    , sam.rejectedAuto = sas.rejectedAuto\n    , sam.acceptedManual = sas.acceptedManual\n    , sam.acceptedAuto = sas.acceptedAuto\n    , sam.highCount = sas.highCount\n    , sam.mediumCount = sas.mediumCount\n    , sam.lowCount = sas.lowCount\n  `,\n  `DROP TABLE stats_asset_stig`\n]\n\nconst downMigration = [\n  `\n    CREATE TABLE stats_asset_stig (\n      id int NOT NULL AUTO_INCREMENT,\n      assetId int DEFAULT NULL,\n      benchmarkId varchar(255) DEFAULT NULL,\n      minTs datetime DEFAULT NULL,\n      maxTs datetime DEFAULT NULL,\n      savedManual int DEFAULT NULL,\n      savedAuto int DEFAULT NULL,\n      submittedManual int DEFAULT NULL,\n      submittedAuto int DEFAULT NULL,\n      rejectedManual int DEFAULT NULL,\n      rejectedAuto int DEFAULT NULL,\n      acceptedManual int DEFAULT NULL,\n      acceptedAuto int DEFAULT NULL,\n      highCount int DEFAULT NULL,\n      mediumCount int DEFAULT NULL,\n      lowCount int DEFAULT NULL,\n      PRIMARY KEY (id),\n      UNIQUE KEY INDEX_2_2_C (assetId,benchmarkId),\n      KEY FK_STATS_ASSET_STIG_2 (benchmarkId),\n      CONSTRAINT FOREIGN KEY (assetId) REFERENCES asset (assetId) ON DELETE CASCADE ON UPDATE CASCADE\n    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n  `,\n  `ALTER TABLE stats_asset_stig MODIFY benchmarkId VARCHAR(255) COLLATE utf8mb4_0900_as_cs`,\n  `\n    INSERT INTO stats_asset_stig(benchmarkId, assetId, minTs, maxTs, savedManual, savedAuto, \n      submittedManual, submittedAuto, rejectedManual, rejectedAuto, acceptedManual, acceptedAuto, \n      highCount, mediumCount, lowCount)\n    SELECT benchmarkId, assetId, minTs, maxTs, savedManual, savedAuto, \n      submittedManual, submittedAuto, rejectedManual, rejectedAuto, acceptedManual, acceptedAuto, \n      highCount, mediumCount, lowCount\n    FROM stig_asset_map sam\n  `,\n  `\n    ALTER TABLE stig_asset_map \n      DROP COLUMN minTs,\n      DROP COLUMN maxTs,\n      DROP COLUMN savedManual,\n      DROP COLUMN savedAuto,\n      DROP COLUMN submittedManual,\n      DROP COLUMN submittedAuto,\n      DROP COLUMN rejectedManual,\n      DROP COLUMN rejectedAuto,\n      DROP COLUMN acceptedManual,\n      DROP COLUMN acceptedAuto,\n      DROP COLUMN highCount,\n      DROP COLUMN mediumCount,\n      DROP COLUMN lowCount;\n  `\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0011.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `ALTER TABLE review\n  CHANGE COLUMN \\`resultComment\\` \\`detail\\` MEDIUMTEXT DEFAULT NULL,\n  CHANGE COLUMN \\`actionComment\\` \\`comment\\` MEDIUMTEXT DEFAULT NULL,\n  CHANGE COLUMN \\`ts\\` \\`ts\\` DATETIME NOT NULL,\n  CHANGE COLUMN \\`rejecttext\\` \\`statusText\\` VARCHAR(255) DEFAULT NULL AFTER \\`statusId\\`,\n  CHANGE COLUMN \\`rejectUserId\\` \\`statusUserId\\` INT DEFAULT NULL AFTER \\`statusText\\`,\n  ADD COLUMN \\`statusTs\\` DATETIME DEFAULT NULL AFTER \\`statusUserId\\`,\n  ADD COLUMN \\`touchTs\\` DATETIME GENERATED ALWAYS AS (GREATEST(ts,statusTs)) STORED,\n  DROP COLUMN \\`actionId\\``,\n\n  `UPDATE review SET \n  statusText = CASE WHEN statusId = 2 THEN statusText ELSE NULL END,\n  statusUserId = userId,\n  statusTs = ts`,\n\n  `ALTER TABLE review_history\n  CHANGE COLUMN \\`resultComment\\` \\`detail\\` MEDIUMTEXT DEFAULT NULL,\n  CHANGE COLUMN \\`actionComment\\` \\`comment\\` MEDIUMTEXT DEFAULT NULL,\n  CHANGE COLUMN \\`rejecttext\\` \\`statusText\\` VARCHAR(255) DEFAULT NULL AFTER \\`statusId\\`,\n  CHANGE COLUMN \\`rejectUserId\\` \\`statusUserId\\` INT DEFAULT NULL AFTER \\`statusText\\`,\n  ADD COLUMN \\`statusTs\\` DATETIME DEFAULT NULL AFTER \\`statusUserId\\`,\n  ADD COLUMN \\`touchTs\\` DATETIME DEFAULT NULL,\n  DROP COLUMN \\`actionId\\``,\n\n  `UPDATE review_history SET \n  statusText = CASE WHEN statusId = 2 THEN statusText ELSE NULL END,\n  statusUserId = userId,\n  statusTs = ts,\n  touchTs = ts`,\n\n  'DROP TABLE IF EXISTS `action`',\n]\n\nconst downMigration = [\n  'ALTER TABLE `review` RENAME COLUMN `detail` TO `resultComment`',\n  'ALTER TABLE `review` RENAME COLUMN `comment` TO `actionComment`',\n  `CREATE TABLE action (\n    actionId int(11) NOT NULL,\n    api varchar(16) NOT NULL,\n    en varchar(64) NOT NULL,\n    PRIMARY KEY (actionId)\n  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci`,\n  \"INSERT INTO `action` VALUES (1,'remediate','Remediate'),(2,'mitigate','Mitigate'),(3,'exception','Exception')\",\n  'ALTER TABLE `review` ADD COLUMN `actionId` INT DEFAULT NULL',\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0012.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `ALTER TABLE collection DROP COLUMN workflow, ADD COLUMN settings JSON NOT NULL AFTER description`,\n  `update collection\n  set settings = JSON_OBJECT(\n    'fields', JSON_OBJECT(\n      'comment', JSON_OBJECT(\n        'enabled', COALESCE(JSON_UNQUOTE(JSON_EXTRACT(metadata->>'$.fieldSettings', '$.commentEnabled')), 'findings'),\n        'required', COALESCE(JSON_UNQUOTE(JSON_EXTRACT(metadata->>'$.fieldSettings', '$.commentRequired')), 'findings')\n      ),\n      'detail', JSON_OBJECT(\n        'enabled',  COALESCE(JSON_UNQUOTE(JSON_EXTRACT(metadata->>'$.fieldSettings', '$.detailEnabled')), 'always'),\n        'required', COALESCE(JSON_UNQUOTE(JSON_EXTRACT(metadata->>'$.fieldSettings', '$.detailRequired')), 'always')\n      )\n    ),\n    'status', JSON_OBJECT(\n      'canAccept', CAST(COALESCE(JSON_UNQUOTE(JSON_EXTRACT(metadata->>'$.statusSettings', '$.canAccept')), cast(true as json)) as json),\n      'minAcceptGrant', CAST(COALESCE(JSON_UNQUOTE(JSON_EXTRACT(metadata->>'$.statusSettings', '$.minGrant')), 3) as json),\n      'resetCriteria', COALESCE(JSON_UNQUOTE(JSON_EXTRACT(metadata->>'$.statusSettings', '$.resetCriteria')), 'result')\n    )   \n  )`,\n  `update collection set metadata = JSON_REMOVE(metadata, '$.fieldSettings', '$.statusSettings')`\n]\n\nconst downMigration = [\n  `update collection set metadata = JSON_INSERT(metadata, \n    '$.fieldSettings', CAST(\n      JSON_OBJECT(\n        'detailEnabled', JSON_EXTRACT(settings, '$.fields.detail.enabled'),\n        'detailRequired', JSON_EXTRACT(settings, '$.fields.detail.required'),\n        'commentEnabled', JSON_EXTRACT(settings, '$.fields.comment.enabled'),\n        'commentRequired', JSON_EXTRACT(settings, '$.fields.comment.required')\n      )\n    as char),\n    '$.statusSettings', CAST(\n      JSON_OBJECT(\n        'canAccept', JSON_EXTRACT(settings, '$.status.canAccept'),\n        'minGrant', JSON_EXTRACT(settings, '$.status.minAcceptGrant'),\n        'resetCriteria', JSON_EXTRACT(settings, '$.status.resetCriteria')\n      )\n    as char)\n  )`,\n  'ALTER TABLE `collection` DROP COLUMN settings, ADD COLUMN `workflow` VARCHAR(45) DEFAULT \"emass\"'\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0013.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `CREATE TABLE collection_label (\n    clId INT NOT NULL AUTO_INCREMENT,\n    collectionId INT NOT NULL,\n    name VARCHAR(36) NOT NULL,\n    description VARCHAR(45) NULL,\n    color VARCHAR(6) NOT NULL,\n    uuid BINARY(16) NOT NULL,\n    PRIMARY KEY (clId),\n    KEY index4 (uuid),\n    UNIQUE KEY colname (collectionId,name),\n    CONSTRAINT fk_collection_label_1\n      FOREIGN KEY (collectionId)\n      REFERENCES collection (collectionId)\n      ON DELETE CASCADE\n      ON UPDATE CASCADE\n  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci\n  `,\n  `CREATE TABLE collection_label_asset_map (\n    claId int NOT NULL AUTO_INCREMENT,\n    assetId int NOT NULL,\n    clId int NOT NULL,\n    PRIMARY KEY (claId),\n    KEY fk_collection_label_asset_map_2 (clId),\n    UNIQUE KEY index4 (assetId,clId),\n    CONSTRAINT fk_collection_label_asset_map_1 FOREIGN KEY (assetId) REFERENCES asset (assetId) ON DELETE CASCADE ON UPDATE CASCADE,\n    CONSTRAINT fk_collection_label_asset_map_2 FOREIGN KEY (clId) REFERENCES collection_label (clId) ON DELETE CASCADE ON UPDATE CASCADE\n  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci  \n  `\n]\n\nconst downMigration = [\n  `drop table collection_label_asset_map`,\n  `drop table collection_label`\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0014.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `ALTER TABLE review ADD COLUMN resultEngine JSON DEFAULT NULL, ALGORITHM=INSTANT`,\n  `ALTER TABLE review_history ADD COLUMN resultEngine JSON DEFAULT NULL, ALGORITHM=INSTANT`,\n  `UPDATE review SET resultEngine = JSON_OBJECT('type','scap','product','scc') WHERE autoResult = 1`,\n  `UPDATE review_history SET resultEngine = JSON_OBJECT('type','scap','product','scc') WHERE autoResult = 1`\n]\n\nconst downMigration = [\n  `ALTER TABLE review DROP COLUMN resultEngine`,\n  `ALTER TABLE review_history DROP COLUMN resultEngine`\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0015.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `UPDATE review SET resultEngine = NULL WHERE resultEngine = CAST('{\"product\":\"scc\",\"type\":\"scap\"}' as JSON)`,\n  `UPDATE review_history SET resultEngine = NULL WHERE resultEngine = CAST('{\"product\":\"scc\",\"type\":\"scap\"}' as JSON)`,\n\n  `ALTER TABLE review ADD COLUMN reProduct VARCHAR(255) GENERATED ALWAYS AS (resultEngine->>\"$.product\")`,\n  `ALTER TABLE review ADD INDEX idx_reProduct (reProduct)`,\n\n  `ALTER TABLE review ADD COLUMN reType VARCHAR(255) GENERATED ALWAYS AS (resultEngine->>\"$.type\")`,\n  `ALTER TABLE review ADD INDEX idx_reType (reType)`,\n\n  `ALTER TABLE review ADD COLUMN reAuthority VARCHAR(255) GENERATED ALWAYS AS (resultEngine->>\"$.overrides[0].authority\")`,\n  `ALTER TABLE review ADD INDEX idx_reAuthority (reAuthority)`,\n\n  `ALTER TABLE review_history ADD COLUMN reProduct VARCHAR(255) GENERATED ALWAYS AS (resultEngine->>\"$.product\")`,\n  `ALTER TABLE review_history ADD INDEX idx_reProduct (reProduct)`,\n\n  `ALTER TABLE review_history ADD COLUMN reType VARCHAR(255) GENERATED ALWAYS AS (resultEngine->>\"$.type\")`,\n  `ALTER TABLE review_history ADD INDEX idx_reType (reType)`,\n  \n  `ALTER TABLE review_history ADD COLUMN reAuthority VARCHAR(255) GENERATED ALWAYS AS (resultEngine->>\"$.overrides[0].authority\")`,\n  `ALTER TABLE review_history ADD INDEX idx_reAuthority (reAuthority)`\n]\n\nconst downMigration = [\n  'ALTER TABLE review DROP COLUMN reProduct',\n  'ALTER TABLE review DROP COLUMN reType',\n  'ALTER TABLE review DROP COLUMN reAuthority',\n  'ALTER TABLE review_history DROP COLUMN reProduct',\n  'ALTER TABLE review_history DROP COLUMN reType',\n  'ALTER TABLE review_history DROP COLUMN reAuthority'\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0016.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `\n  ALTER TABLE stig_asset_map \n  RENAME COLUMN savedManual TO saved,\n  RENAME COLUMN savedAuto TO savedResultEngine,\n  RENAME COLUMN submittedManual TO submitted,\n  RENAME COLUMN submittedAuto TO submittedResultEngine, \n  RENAME COLUMN rejectedManual to rejected,  \n  RENAME COLUMN rejectedAuto TO rejectedResultEngine,\n  RENAME COLUMN acceptedManual TO accepted,\n  RENAME COLUMN acceptedAuto TO acceptedResultEngine,\n \n  ADD COLUMN notchecked int,\n  ADD COLUMN notcheckedResultEngine int,\n  ADD COLUMN notapplicable int, \n  ADD COLUMN notapplicableResultEngine int, \n  ADD COLUMN pass int,\n  ADD COLUMN passResultEngine int,\n  ADD COLUMN fail int,\n  ADD COLUMN failResultEngine int,\n  ADD COLUMN unknown int,\n  ADD COLUMN unknownResultEngine int,\n  ADD COLUMN error int,\n  ADD COLUMN errorResultEngine int,\n  ADD COLUMN notselected int,\n  ADD COLUMN notselectedResultEngine int,\n  ADD COLUMN informational int,\n  ADD COLUMN informationalResultEngine int,\n  ADD COLUMN fixed int,  \n  ADD COLUMN fixedResultEngine int  \n  `,\n\n  `\n  with source as\n    ( select\n       sa.assetId,\n       sa.benchmarkId,\n       min(review.ts) as minTs,\n       max(review.ts) as maxTs,  \n       \n       sum(CASE WHEN review.statusId = 0 THEN 1 ELSE 0 END) as saved,\n       sum(CASE WHEN review.resultEngine is not null and review.statusId = 0 THEN 1 ELSE 0 END) as savedResultEngine,\n       sum(CASE WHEN review.statusId = 1 THEN 1 ELSE 0 END) as submitted,\n       sum(CASE WHEN review.resultEngine is not null and review.statusId = 1 THEN 1 ELSE 0 END) as submittedResultEngine,\n       sum(CASE WHEN review.statusId = 2 THEN 1 ELSE 0 END) as rejected,\n       sum(CASE WHEN review.resultEngine is not null and review.statusId = 2 THEN 1 ELSE 0 END) as rejectedResultEngine,\n       sum(CASE WHEN review.statusId = 3 THEN 1 ELSE 0 END) as accepted,\n       sum(CASE WHEN review.resultEngine is not null and review.statusId = 3 THEN 1 ELSE 0 END) as acceptedResultEngine,\n\n       sum(CASE WHEN review.resultId=4 and r.severity='high' THEN 1 ELSE 0 END) as highCount,\n       sum(CASE WHEN review.resultId=4 and r.severity='medium' THEN 1 ELSE 0 END) as mediumCount,\n       sum(CASE WHEN review.resultId=4 and r.severity='low' THEN 1 ELSE 0 END) as lowCount,\n       \n       sum(CASE WHEN review.resultId = 1 THEN 1 ELSE 0 END) as notchecked,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 1 THEN 1 ELSE 0 END) as notcheckedResultEngine,\n       sum(CASE WHEN review.resultId = 2 THEN 1 ELSE 0 END) as notapplicable,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 2 THEN 1 ELSE 0 END) as notapplicableResultEngine,\n       sum(CASE WHEN review.resultId = 3 THEN 1 ELSE 0 END) as pass,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 3 THEN 1 ELSE 0 END) as passResultEngine,\n       sum(CASE WHEN review.resultId = 4 THEN 1 ELSE 0 END) as fail,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 4 THEN 1 ELSE 0 END) as failResultEngine,\n       sum(CASE WHEN review.resultId = 5 THEN 1 ELSE 0 END) as unknown,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 5 THEN 1 ELSE 0 END) as unknownResultEngine,\n       sum(CASE WHEN review.resultId = 6 THEN 1 ELSE 0 END) as error,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 6 THEN 1 ELSE 0 END) as errorResultEngine,\n       sum(CASE WHEN review.resultId = 7 THEN 1 ELSE 0 END) as notselected,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 7 THEN 1 ELSE 0 END) as notselectedResultEngine,            \n       sum(CASE WHEN review.resultId = 8 THEN 1 ELSE 0 END) as informational,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 8 THEN 1 ELSE 0 END) as informationalResultEngine,\n       sum(CASE WHEN review.resultId = 9 THEN 1 ELSE 0 END) as fixed,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 9 THEN 1 ELSE 0 END) as fixedResultEngine\n       \n       from\n         asset a\n         left join stig_asset_map sa using (assetId)\n         left join current_group_rule cgr using (benchmarkId)\n         left join rule r using (ruleId)\n         left join review on (r.ruleId=review.ruleId and review.assetId=sa.assetId)\n    group by\n      sa.assetId,\n      sa.benchmarkId\n      )\n  update stig_asset_map sam\n    inner join source on sam.assetId = source.assetId and source.benchmarkId = sam.benchmarkId\n    set sam.minTs = source.minTs,\n        sam.maxTs = source.maxTs,\n        sam.saved = source.saved,\n        sam.savedResultEngine = source.savedResultEngine,\n        sam.submitted = source.submitted,\n        sam.submittedResultEngine = source.submittedResultEngine,\n        sam.rejected = source.rejected,\n        sam.rejectedResultEngine = source.rejectedResultEngine,\n        sam.accepted = source.accepted,\n        sam.acceptedResultEngine = source.acceptedResultEngine,\n        sam.highCount = source.highCount,\n        sam.mediumCount = source.mediumCount,\n        sam.lowCount = source.lowCount,\n        sam.notchecked = source.notchecked,\n        sam.notcheckedResultEngine = source.notcheckedResultEngine,\n        sam.notapplicable = source.notapplicable,\n        sam.notapplicableResultEngine = source.notapplicableResultEngine,\n        sam.pass = source.pass,\n        sam.passResultEngine = source.passResultEngine,\n        sam.fail = source.fail,\n        sam.failResultEngine = source.failResultEngine,\n        sam.unknown = source.unknown,\n        sam.unknownResultEngine = source.unknownResultEngine,\n        sam.error = source.error,\n        sam.errorResultEngine = source.errorResultEngine,\n        sam.notselected = source.notselected,\n        sam.notselectedResultEngine = source.notselectedResultEngine,\n        sam.informational = source.informational,\n        sam.informationalResultEngine = source.informationalResultEngine,\n        sam.fixed = source.fixed,\n        sam.fixedResultEngine = source.fixedResultEngine        \n    `\n\n]\n\n\n\nconst downMigration = [\n  `\n  ALTER TABLE stig_asset_map \n  RENAME COLUMN saved TO savedManual,\n  RENAME COLUMN savedResultEngine TO savedAuto,\n  RENAME COLUMN submitted TO submittedManual,\n  RENAME COLUMN submittedResultEngine TO submittedAuto, \n  RENAME COLUMN rejected to rejectedManual,  \n  RENAME COLUMN rejectedResultEngine TO rejectedAuto,\n  RENAME COLUMN accepted TO acceptedManual,\n  RENAME COLUMN acceptedResultEngine TO acceptedAuto,\n \n  DROP COLUMN notchecked ,\n  DROP COLUMN notcheckedResultEngine ,\n  DROP COLUMN notapplicable , \n  DROP COLUMN notapplicableResultEngine , \n  DROP COLUMN pass ,\n  DROP COLUMN passResultEngine ,\n  DROP COLUMN fail ,\n  DROP COLUMN failResultEngine ,\n  DROP COLUMN unknown ,\n  DROP COLUMN unknownResultEngine ,\n  DROP COLUMN error ,\n  DROP COLUMN errorResultEngine ,\n  DROP COLUMN notselected ,\n  DROP COLUMN notselectedResultEngine ,\n  DROP COLUMN informational ,\n  DROP COLUMN informationalResultEngine ,\n  DROP COLUMN fixed ,  \n  DROP COLUMN fixedResultEngine   \n `\n\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0017.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n\t`ALTER TABLE current_rev DROP COLUMN ovalCount`,  \n\t`ALTER TABLE revision DROP COLUMN ovalCount`,  \n`\nALTER VIEW v_current_rev AS\nselect \n\trr.revId AS revId,\n\trr.benchmarkId AS benchmarkId,\n\trr.version AS version,\n\trr.release AS \\`release\\`,\n\trr.benchmarkDate AS benchmarkDate,\n\trr.benchmarkDateSql AS benchmarkDateSql,\n\trr.status AS status,\n\trr.statusDate AS statusDate,\n\trr.description AS description,\n\trr.active AS active,\n\trr.groupCount AS groupCount,\n\trr.ruleCount AS ruleCount,\n\trr.checkCount AS checkCount,\n\trr.fixCount AS fixCount\n from (\n select \n\t r.revId AS revId,\n\t r.benchmarkId AS benchmarkId,\n\t r.version AS version,\n\t r.release AS \\`release\\`,\n\t r.benchmarkDate AS benchmarkDate,\n\t r.benchmarkDateSql AS benchmarkDateSql,\n\t r.status AS status,\n\t r.statusDate AS statusDate,\n\t r.description AS description,\n\t r.active AS active,\n\t r.groupCount AS groupCount,\n\t r.ruleCount AS ruleCount,\n\t r.checkCount AS checkCount,\n\t r.fixCount AS fixCount,\n\trow_number() OVER (\n\t\tPARTITION BY r.benchmarkId \n        ORDER BY \n\t\t\tFIELD(status, 'draft', 'accepted') desc,\n\t\t\t(r.version + 0) desc,\n\t\t\t(r.release + 0) desc )  AS rn \n    from \n\t\trevision r) rr where (rr.rn = 1);\n\n`,\n`DROP TABLE IF EXISTS review_reject_string_map`,\n`DROP TABLE IF EXISTS reject_string`,\n`DROP TABLE IF EXISTS rev_xml_map`,  \n`DROP TABLE IF EXISTS rule_oval_map`\n\n]\n\n\n\nconst downMigration = [\n  `\n  CREATE TABLE review_reject_string_map (\n    rrsId int(11) NOT NULL AUTO_INCREMENT,\n    assetId int(11) NOT NULL,\n    ruleId varchar(45) NOT NULL,\n    rejectId int(11) NOT NULL,\n    userId int(11) DEFAULT NULL,\n    PRIMARY KEY (rrsId),\n    UNIQUE KEY INDEX2 (assetId,ruleId,rejectId)\n  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci\n `,\n `\n CREATE TABLE reject_string (\n  rejectId int(11) NOT NULL AUTO_INCREMENT,\n  shortStr varchar(45) NOT NULL,\n  longStr longtext ,\n  PRIMARY KEY (rejectId)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci\n `,\n `\n CREATE TABLE rule_oval_map (\n  roId int(11) NOT NULL AUTO_INCREMENT,\n  ruleId varchar(255) NOT NULL,\n  ovalRef varchar(255) NOT NULL,\n  benchmarkId varchar(255) NOT NULL,\n  releaseInfo varchar(255) NOT NULL,\n  PRIMARY KEY (roId),\n  KEY index2 (ruleId),\n  KEY index3 (benchmarkId)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci\n `,\n `\n CREATE TABLE rev_xml_map (\n  rxId int(11) NOT NULL AUTO_INCREMENT,\n  revId varchar(255) NOT NULL,\n  xml blob,\n  PRIMARY KEY (rxId),\n  UNIQUE KEY uidx_rxm_revId (revId)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci\n `,\n `ALTER TABLE current_rev ADD COLUMN ovalCount int`,\n `ALTER TABLE revision ADD COLUMN ovalCount int`,\n `\n ALTER VIEW v_current_rev AS\nselect \n\trr.revId AS revId,\n\trr.benchmarkId AS benchmarkId,\n\trr.version AS version,\n\trr.release AS \\`release\\`,\n\trr.benchmarkDate AS benchmarkDate,\n\trr.benchmarkDateSql AS benchmarkDateSql,\n\trr.status AS status,\n\trr.statusDate AS statusDate,\n\trr.description AS description,\n\trr.active AS active,\n\trr.groupCount AS groupCount,\n\trr.ruleCount AS ruleCount,\n\trr.checkCount AS checkCount,\n\trr.fixCount AS fixCount\n from (\n select \n\t r.revId AS revId,\n\t r.benchmarkId AS benchmarkId,\n\t r.version AS version,\n\t r.release AS \\`release\\`,\n\t r.benchmarkDate AS benchmarkDate,\n\t r.benchmarkDateSql AS benchmarkDateSql,\n\t r.status AS status,\n\t r.statusDate AS statusDate,\n\t r.description AS description,\n\t r.active AS active,\n\t r.groupCount AS groupCount,\n\t r.ruleCount AS ruleCount,\n\t r.checkCount AS checkCount,\n\t r.fixCount AS fixCount,\n\t (select count(distinct ro.ruleId) from rule_oval_map ro where ro.ruleId IN (\n     SELECT rgr.ruleId from rev_group_map rg inner join rev_group_rule_map rgr on rg.rgId = rgr.rgId WHERE rg.revId = r.revId)) AS ovalCount,   \n\trow_number() OVER (\n\t\tPARTITION BY r.benchmarkId \n        ORDER BY \n\t\t\tFIELD(status, 'draft', 'accepted') desc,\n\t\t\t(r.version + 0) desc,\n\t\t\t(r.release + 0) desc )  AS rn \n    from \n\t\trevision r) rr where (rr.rn = 1)\n`\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0018.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `ALTER TABLE stig_asset_map ADD COLUMN maxTouchTs datetime`,\n  `with source as (\n    select\n      sa.assetId,\n      sa.benchmarkId,\n      max(review.touchTs) as maxTouchTs\n    from\n      asset a\n      left join stig_asset_map sa using (assetId)\n      left join current_group_rule cgr using (benchmarkId)\n      left join review on (cgr.ruleId=review.ruleId and review.assetId=sa.assetId)\n    group by\n      sa.assetId,\n      sa.benchmarkId)\n  update stig_asset_map sam\n    inner join source on sam.assetId = source.assetId and source.benchmarkId = sam.benchmarkId\n    set sam.maxTouchTs = source.maxTouchTs     \n    `\n  ]\n\n\n\nconst downMigration = [\n  `ALTER TABLE stig_asset_map DROP COLUMN maxTouchTs`\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0019.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `ALTER TABLE revision \n  ADD COLUMN lowCount INT NOT NULL DEFAULT 0,\n  ADD COLUMN mediumCount INT NOT NULL DEFAULT 0,\n  ADD COLUMN highCount INT NOT NULL DEFAULT 0,\n  CHANGE COLUMN ruleCount ruleCount INT GENERATED ALWAYS AS (highCount + mediumCount + lowCount) STORED`,\n\n  `update revision left join (select\n    rg.revId,\n      SUM(CASE WHEN r.severity = 'high' THEN 1 ELSE 0 END) as highCount,\n      SUM(CASE WHEN r.severity = 'medium' THEN 1 ELSE 0 END) as mediumCount,\n      SUM(CASE WHEN r.severity = 'low' THEN 1 ELSE 0 END) as lowCount\n  from\n    rev_group_map rg\n      left join rev_group_rule_map rgr on rg.rgId = rgr.rgId\n      left join rule r on rgr.ruleId = r.ruleId\n  group by\n    rg.revId) as sq on revision.revId = sq.revId\n  set\n    revision.lowCount = sq.lowCount,\n    revision.mediumCount = sq.mediumCount,\n    revision.highCount = sq.highCount`,\n\n  `ALTER TABLE current_rev \n  ADD COLUMN lowCount INT NOT NULL DEFAULT 0,\n  ADD COLUMN mediumCount INT NOT NULL DEFAULT 0,\n  ADD COLUMN highCount INT NOT NULL DEFAULT 0,\n  CHANGE COLUMN ruleCount ruleCount INT GENERATED ALWAYS AS (highCount + mediumCount + lowCount) STORED`,\n  \n  `ALTER VIEW v_current_rev AS\n  select\n  rr.revId AS revId,\n  rr.benchmarkId AS benchmarkId,\n  rr.\\`version\\` AS \\`version\\`,\n  rr.\\`release\\` AS \\`release\\`,\n  rr.benchmarkDate AS benchmarkDate,\n  rr.benchmarkDateSql AS benchmarkDateSql,\n  rr.status AS status,\n  rr.statusDate AS statusDate,\n  rr.description AS description,\n  rr.active AS active,\n  rr.groupCount AS groupCount,\n  rr.ruleCount AS ruleCount,\n  rr.lowCount AS lowCount,\n  rr.mediumCount AS mediumCount,\n  rr.highCount AS highCount,\n  rr.checkCount AS checkCount,\n  rr.fixCount AS fixCount from (select r.revId AS revId,\n  r.benchmarkId AS benchmarkId,\n  r.\\`version\\` AS \\`version\\`,\n  r.\\`release\\` AS \\`release\\`,\n  r.benchmarkDate AS benchmarkDate,\n  r.benchmarkDateSql AS benchmarkDateSql,\n  r.status AS status,\n  r.statusDate AS statusDate,\n  r.description AS description,\n  r.active AS active,\n  r.groupCount AS groupCount,\n  r.ruleCount AS ruleCount,\n  r.lowCount AS lowCount,\n  r.mediumCount AS mediumCount,\n  r.highCount AS highCount,\n  r.checkCount AS checkCount,\n  r.fixCount AS fixCount,\n  row_number() OVER (PARTITION BY r.benchmarkId ORDER BY field(r.status,\n  'draft',\n  'accepted') desc,\n  (r.\\`version\\` + 0) desc,\n  (r.\\`release\\` + 0) desc )  AS rn from revision r) rr where (rr.rn = 1)`,\n\n  `DELETE FROM current_rev`,\n  `INSERT INTO current_rev (\n    revId,\n    benchmarkId,\n    \\`version\\`, \n    \\`release\\`, \n    benchmarkDate,\n    benchmarkDateSql,\n    status,\n    statusDate,\n    description,\n    active,\n    groupCount,\n    lowCount,\n    mediumCount,\n    highCount,\n    checkCount,\n    fixCount)\n    SELECT \n      revId,\n      benchmarkId,\n      \\`version\\`,\n      \\`release\\`,\n      benchmarkDate,\n      benchmarkDateSql,\n      status,\n      statusDate,\n      description,\n      active,\n      groupCount,\n      lowCount,\n      mediumCount,\n      highCount,\n      checkCount,\n      fixCount\n    FROM\n      v_current_rev`,\n\n  `CREATE TABLE check_content (\n  ccId INT NOT NULL AUTO_INCREMENT,\n  digest BINARY(32) GENERATED ALWAYS AS (UNHEX(SHA2(content, 256))) STORED,\n  content TEXT NOT NULL,\n  PRIMARY KEY (ccId),\n  UNIQUE INDEX digest_UNIQUE (digest ASC) VISIBLE)`,\n\n  'INSERT INTO check_content (content) SELECT content from `check` c ON DUPLICATE KEY UPDATE content=c.content',\n\n  'ALTER TABLE `check` ADD COLUMN ccId INT DEFAULT NULL',\n\n  'ALTER TABLE rule ADD COLUMN ccId INT DEFAULT NULL',\n\n  'UPDATE `check` SET ccId = (SELECT ccId from check_content WHERE digest = UNHEX(SHA2(`check`.content, 256)))',\n\n  'ALTER TABLE `check` DROP COLUMN content',\n\n  'ALTER TABLE `check` ADD INDEX (ccId)',\n\n  `ALTER TABLE \\`check\\` ADD CONSTRAINT fk_check_1 FOREIGN KEY (ccId) REFERENCES check_content (ccId) ON DELETE RESTRICT ON UPDATE RESTRICT`,\n\n  'ALTER TABLE rule ADD INDEX (ccId)',\n\n  `ALTER TABLE rule ADD CONSTRAINT fk_rule_1 FOREIGN KEY (ccId) REFERENCES check_content (ccId) ON DELETE RESTRICT ON UPDATE RESTRICT`,\n]\n\nconst downMigration = [\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0020.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  // if absent here, the query UPDATE rev_group_rule_map runs very slowly\n  `ALTER TABLE rule DROP FOREIGN KEY fk_rule_1`,\n  `ALTER TABLE rule DROP COLUMN ccId, DROP INDEX ccId`,\n\n  // temp table for rule_fix\n  `drop table if exists temp_rule_fix`,\n  `create temporary table temp_rule_fix(\n\t  rgrId INT PRIMARY KEY,\n    fixref varchar(255),\n    text TEXT,\n    digest BINARY(32) GENERATED ALWAYS AS (UNHEX(SHA2(text, 256))) STORED)`,\n  `insert into temp_rule_fix(rgrId, fixref, text)\n    select \n      rgrf.rgrId,\n      group_concat(fix.fixId) as fixref,\n      group_concat(fix.text separator '\\n\\n-----AND-----\\n\\n') as text\n    from\n      rev_group_rule_fix_map rgrf\n      left join fix using (fixId)\n    group by rgrf.rgrId`,\n\n  // create and populate fix_text\n    `CREATE TABLE fix_text (\n        ftId INT NOT NULL AUTO_INCREMENT,\n        digest BINARY(32) GENERATED ALWAYS AS (UNHEX(SHA2(text, 256))) STORED,\n        text TEXT NOT NULL,\n        PRIMARY KEY (ftId),\n        UNIQUE INDEX digest_UNIQUE (digest ASC) VISIBLE)`,\n    `INSERT INTO fix_text (text) SELECT text from temp_rule_fix ON DUPLICATE KEY UPDATE text=temp_rule_fix.text`,\n\n  // temp table for rule_check\n    `drop table if exists temp_rule_check`,\n    `create temporary table temp_rule_check(\n      rgrId INT PRIMARY KEY,\n        \\`system\\` varchar(255),\n        content TEXT,\n        digest BINARY(32) GENERATED ALWAYS AS (UNHEX(SHA2(content, 256))) STORED)`,\n    `insert into temp_rule_check(rgrId, \\`system\\`, content)\n      select \n        rgrc.rgrId,\n        group_concat(rgrc.checkId) as \\`system\\`,\n        group_concat(cc.content separator '\\n\\n-----AND-----\\n\\n') as content\n      from\n        rev_group_rule_check_map rgrc\n        left join \\`check\\` using (checkId)\n        left join check_content cc using (ccId)\n      group by rgrc.rgrId`,\n        \n  // populate check_content with multi-check content only. Migration 0019 populated single-check content\n    `insert ignore into check_content(content) select content from temp_rule_check where \\`system\\` like '%,%'`,\n    \n  // update rev_group_rule_map\n    `ALTER TABLE rev_group_rule_map DROP COLUMN checks, DROP COLUMN fixes, DROP COLUMN ccis`,\n    `ALTER TABLE rev_group_rule_map\n      ADD COLUMN \\`revId\\` varchar(255) AFTER rgrId,\n      ADD COLUMN \\`groupId\\` varchar(45) AFTER revId,\n      ADD COLUMN \\`groupTitle\\` varchar(255) AFTER groupId,\n      ADD COLUMN \\`groupSeverity\\` varchar(45) AFTER groupTitle,\n      ADD COLUMN \\`version\\` varchar(45),\n      ADD COLUMN \\`title\\` varchar(1000),\n      ADD COLUMN \\`severity\\` varchar(45),\n      ADD COLUMN \\`weight\\` varchar(45),\n      ADD COLUMN \\`vulnDiscussion\\` text,\n      ADD COLUMN \\`falsePositives\\` text,\n      ADD COLUMN \\`falseNegatives\\` text,\n      ADD COLUMN \\`documentable\\` varchar(45) ,\n      ADD COLUMN \\`mitigations\\` text,\n      ADD COLUMN \\`severityOverrideGuidance\\` text,\n      ADD COLUMN \\`potentialImpacts\\` text,\n      ADD COLUMN \\`thirdPartyTools\\` text,\n      ADD COLUMN \\`mitigationControl\\` text,\n      ADD COLUMN \\`responsibility\\` varchar(255) ,\n      ADD COLUMN \\`iaControls\\` varchar(255),\n      ADD COLUMN \\`checkSystem\\` varchar (255),\n      ADD COLUMN \\`checkDigest\\` BINARY(32),\n      ADD COLUMN \\`fixref\\` varchar(255),\n      ADD COLUMN \\`fixDigest\\` BINARY(32)`,\n      \n    `UPDATE rev_group_rule_map rgr\n    LEFT JOIN rev_group_map rg using (rgId)\n    LEFT JOIN \\`group\\` g on rg.groupId = g.groupId\n    LEFT JOIN rule r using (ruleId) \n    LEFT JOIN temp_rule_check trc using (rgrId) \n    LEFT JOIN temp_rule_fix trf using (rgrId) \n    SET\n      rgr.revId = rg.revId,\n      rgr.groupId = rg.groupId,\n      rgr.groupTitle = g.title,\n      rgr.groupSeverity = g.severity,\n      rgr.\\`version\\` = r.\\`version\\`,\n      rgr.title = r.title,\n      rgr.severity = r.severity,\n      rgr.weight = r.weight,\n      rgr.vulnDiscussion = r.vulnDiscussion,\n      rgr.falsePositives = r.falsePositives,\n      rgr.falseNegatives = r.falseNegatives,\n      rgr.documentable = r.documentable,\n      rgr.mitigations = r.mitigations,\n      rgr.severityOverrideGuidance = r.severityOverrideGuidance,\n      rgr.potentialImpacts = r.potentialImpacts,\n      rgr.thirdPartyTools = r.thirdPartyTools,\n      rgr.mitigationControl = r.mitigationControl,\n      rgr.responsibility = r.responsibility,\n      rgr.iaControls = r.iaControls,\n      rgr.checkSystem = trc.system,\n      rgr.checkDigest = trc.digest,\n      rgr.fixref = trf.fixref,\n      rgr.fixDigest = trf.digest`,\n      `ALTER TABLE rev_group_rule_map DROP FOREIGN KEY FK_rev_group_rule_map_rule`,\n      `ALTER TABLE rev_group_rule_map DROP FOREIGN KEY FK_rev_group_rule_map_rev_group_map`,\n      `ALTER TABLE rev_group_rule_map DROP INDEX uidx_rgrm_rgId_ruleId`,\n      `ALTER TABLE rev_group_rule_map DROP COLUMN rgId`,\n      `ALTER TABLE rev_group_rule_map ADD INDEX index4 (checkDigest ASC) VISIBLE, ADD INDEX index5 (fixDigest ASC) VISIBLE`,\n      `ALTER TABLE rev_group_rule_map ADD UNIQUE INDEX rev_group_rule_UNIQUE (revId ASC, groupId ASC, ruleId ASC) VISIBLE`,\n      `ALTER TABLE rev_group_rule_map ADD CONSTRAINT fk_rev_group_rule_map_1 FOREIGN KEY (revId) REFERENCES revision (revId) ON DELETE CASCADE ON UPDATE CASCADE`,\n\n  // rev_group_rule_cci_map\n  `CREATE TABLE rev_group_rule_cci_map (\n    rgrccId INT NOT NULL AUTO_INCREMENT,\n    rgrId INT NOT NULL,\n    cci VARCHAR(20) NOT NULL,\n    PRIMARY KEY (rgrccId),\n    UNIQUE INDEX index2 (rgrId ASC, cci ASC) VISIBLE,\n    INDEX index3 (cci ASC) VISIBLE)`,\n  `INSERT INTO rev_group_rule_cci_map (rgrId, cci) \n  SELECT\n    rgrId,\n    rc.cci\n  FROM\n    rev_group_rule_map rgr\n      left join rule_cci_map rc using (ruleId)\n  WHERE\n    rc.cci is not null`,\n\n  // drop legacy tables\n  `DROP TABLE rev_group_map`,\n  `DROP TABLE \\`group\\``,\n  `DROP TABLE rule_cci_map`,\n  `DROP TABLE rule`,\n  `DROP table rev_group_rule_check_map`,\n  `DROP table rev_group_rule_fix_map`,\n  `DROP table \\`check\\``,\n  `DROP table fix`,\n  `DROP table poam_rar_entry`,\n\n  // VIEW for current_group_rule\n  `CREATE OR REPLACE VIEW v_current_group_rule AS\n  SELECT\n  cr.benchmarkId\n  ,rgr.groupId\n  ,rgr.groupTitle\n  ,rgr.groupSeverity\n  ,rgr.ruleId\n  ,rgr.\\`version\\`\n  ,rgr.title\n  ,rgr.severity\n  ,rgr.weight\n  ,rgr.vulnDiscussion\n  ,rgr.falsePositives\n  ,rgr.falseNegatives\n  ,rgr.documentable\n  ,rgr.mitigations\n  ,rgr.severityOverrideGuidance\n  ,rgr.potentialImpacts\n  ,rgr.thirdPartyTools\n  ,rgr.mitigationControl\n  ,rgr.responsibility\n  ,rgr.iaControls\n  ,rgr.checkSystem\n  ,rgr.checkDigest\n  ,rgr.fixref\n  ,rgr.fixDigest\n  from current_rev cr left join rev_group_rule_map rgr using(revId)`\n]\n\nconst downMigration = [\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    // await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0021.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `DELETE FROM current_rev`,\n  `INSERT INTO current_rev (\n    revId,\n    benchmarkId,\n    \\`version\\`, \n    \\`release\\`, \n    benchmarkDate,\n    benchmarkDateSql,\n    status,\n    statusDate,\n    description,\n    active,\n    groupCount,\n    lowCount,\n    mediumCount,\n    highCount,\n    checkCount,\n    fixCount)\n    SELECT \n      revId,\n      benchmarkId,\n      \\`version\\`,\n      \\`release\\`,\n      benchmarkDate,\n      benchmarkDateSql,\n      status,\n      statusDate,\n      description,\n      active,\n      groupCount,\n      lowCount,\n      mediumCount,\n      highCount,\n      checkCount,\n      fixCount\n    FROM\n      v_current_rev`\n]\n\nconst downMigration = [\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0022.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n\n  // table: rule_version_check_digest\n  `drop table if exists rule_version_check_digest`,\n\n  `CREATE TABLE rule_version_check_digest (\n    ruleId varchar(255) NOT NULL,\n    \\`version\\` varchar(45) NOT NULL,\n    checkDigest binary(32) NOT NULL,\n    PRIMARY KEY index1 (ruleId),\n    KEY index_vcd (\\`version\\`, checkDigest)\n  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci`,\n\n  `INSERT INTO rule_version_check_digest (ruleId, \\`version\\`, checkDigest)\n  with currentDigest as (\n  select\n    rgr.ruleId,\n    rgr.version,\n    rgr.checkDigest,\n    rev.benchmarkDateSql,\n    rev.revId,\n    ROW_NUMBER() OVER (PARTITION BY rgr.ruleId ORDER BY rev.benchmarkDateSql DESC) as rowNum\n  from\n    rev_group_rule_map rgr\n    left join revision rev using (revId)\n  where\n    rgr.checkDigest is not null\n  )\n  select\n    ruleId,\n    \\`version\\`,\n    checkDigest\n  from\n    currentDigest\n  where\n    rowNum = 1`,\n\n  // table: review_history\n  `ALTER TABLE review_history ADD COLUMN ruleId VARCHAR(45) DEFAULT NULL`,\n\n  // table: review\n  `ALTER TABLE review \n  ADD COLUMN \\`version\\` VARCHAR(45) NOT NULL AFTER reAuthority,\n  ADD COLUMN checkDigest BINARY(32) NOT NULL AFTER \\`version\\``,\n\n  // table: temp_current_reviews\n  `drop table if exists temp_current_reviews`,\n\n  `CREATE TABLE temp_current_reviews (\n  reviewId INT,\n  \\`version\\` VARCHAR(45) NOT NULL,\n  checkDigest BINARY(32) NOT NULL,\n  PRIMARY KEY (reviewId))`,\n\n  `INSERT INTO temp_current_reviews (reviewId, \\`version\\`, checkDigest)\n  WITH ordered_reviews AS (\n  SELECT r.reviewId,rvcd.version,rvcd.checkDigest,ROW_NUMBER() OVER (PARTITION BY r.assetId, rvcd.version, rvcd.checkDigest ORDER BY r.touchTs DESC) as rowNum\n  FROM review r INNER JOIN rule_version_check_digest rvcd using (ruleId))\n  ,active_reviews AS (SELECT reviewId, \\`version\\`, checkDigest from ordered_reviews where rowNum = 1)\n  SELECT reviewId, \\`version\\`, checkDigest from active_reviews`,\n\n  // update the reviews that are current\n  `UPDATE review r INNER JOIN temp_current_reviews t using (reviewId) SET r.version = t.version, r.checkDigest = t.checkDigest`,\n\n  // index the new columns\n  `ALTER TABLE review ADD INDEX idx_vcd (\\`version\\`, checkDigest)`,\n  `ALTER TABLE review ADD INDEX idx_asset_vcd (assetId, \\`version\\`, checkDigest)`,\n  `ALTER TABLE review DROP INDEX INDEX_ASSETID_RULEID`,\n\n  `drop table if exists temp_current_reviews`,\n\n  // recalculate metrics\n\n  `with source as\n  ( select\n     sa.assetId,\n     sa.benchmarkId,\n     min(review.ts) as minTs,\n     max(review.ts) as maxTs,  \n     max(review.touchTs) as maxTouchTs,  \n     \n     sum(CASE WHEN review.statusId = 0 THEN 1 ELSE 0 END) as saved,\n     sum(CASE WHEN review.resultEngine is not null and review.statusId = 0 THEN 1 ELSE 0 END) as savedResultEngine,\n     sum(CASE WHEN review.statusId = 1 THEN 1 ELSE 0 END) as submitted,\n     sum(CASE WHEN review.resultEngine is not null and review.statusId = 1 THEN 1 ELSE 0 END) as submittedResultEngine,\n     sum(CASE WHEN review.statusId = 2 THEN 1 ELSE 0 END) as rejected,\n     sum(CASE WHEN review.resultEngine is not null and review.statusId = 2 THEN 1 ELSE 0 END) as rejectedResultEngine,\n     sum(CASE WHEN review.statusId = 3 THEN 1 ELSE 0 END) as accepted,\n     sum(CASE WHEN review.resultEngine is not null and review.statusId = 3 THEN 1 ELSE 0 END) as acceptedResultEngine,\n\n     sum(CASE WHEN review.resultId=4 and cgr.severity='high' THEN 1 ELSE 0 END) as highCount,\n     sum(CASE WHEN review.resultId=4 and cgr.severity='medium' THEN 1 ELSE 0 END) as mediumCount,\n     sum(CASE WHEN review.resultId=4 and cgr.severity='low' THEN 1 ELSE 0 END) as lowCount,\n     \n     sum(CASE WHEN review.resultId = 1 THEN 1 ELSE 0 END) as notchecked,\n     sum(CASE WHEN review.resultEngine is not null and review.resultId = 1 THEN 1 ELSE 0 END) as notcheckedResultEngine,\n     sum(CASE WHEN review.resultId = 2 THEN 1 ELSE 0 END) as notapplicable,\n     sum(CASE WHEN review.resultEngine is not null and review.resultId = 2 THEN 1 ELSE 0 END) as notapplicableResultEngine,\n     sum(CASE WHEN review.resultId = 3 THEN 1 ELSE 0 END) as pass,\n     sum(CASE WHEN review.resultEngine is not null and review.resultId = 3 THEN 1 ELSE 0 END) as passResultEngine,\n     sum(CASE WHEN review.resultId = 4 THEN 1 ELSE 0 END) as fail,\n     sum(CASE WHEN review.resultEngine is not null and review.resultId = 4 THEN 1 ELSE 0 END) as failResultEngine,\n     sum(CASE WHEN review.resultId = 5 THEN 1 ELSE 0 END) as unknown,\n     sum(CASE WHEN review.resultEngine is not null and review.resultId = 5 THEN 1 ELSE 0 END) as unknownResultEngine,\n     sum(CASE WHEN review.resultId = 6 THEN 1 ELSE 0 END) as error,\n     sum(CASE WHEN review.resultEngine is not null and review.resultId = 6 THEN 1 ELSE 0 END) as errorResultEngine,\n     sum(CASE WHEN review.resultId = 7 THEN 1 ELSE 0 END) as notselected,\n     sum(CASE WHEN review.resultEngine is not null and review.resultId = 7 THEN 1 ELSE 0 END) as notselectedResultEngine,            \n     sum(CASE WHEN review.resultId = 8 THEN 1 ELSE 0 END) as informational,\n     sum(CASE WHEN review.resultEngine is not null and review.resultId = 8 THEN 1 ELSE 0 END) as informationalResultEngine,\n     sum(CASE WHEN review.resultId = 9 THEN 1 ELSE 0 END) as fixed,\n     sum(CASE WHEN review.resultEngine is not null and review.resultId = 9 THEN 1 ELSE 0 END) as fixedResultEngine\n     \n     from\n       asset a\n       left join stig_asset_map sa using (assetId)\n       left join v_current_group_rule cgr using (benchmarkId)\n       left join rule_version_check_digest rvcd using (ruleId)\n       left join review on (rvcd.version=review.version and rvcd.checkDigest=review.checkDigest and review.assetId=sa.assetId)\n  group by\n    sa.assetId,\n    sa.benchmarkId\n    )\nupdate stig_asset_map sam\n  inner join source on sam.assetId = source.assetId and source.benchmarkId = sam.benchmarkId\n  set sam.minTs = source.minTs,\n      sam.maxTs = source.maxTs,\n      sam.maxTouchTs = source.maxTouchTs,\n      sam.saved = source.saved,\n      sam.savedResultEngine = source.savedResultEngine,\n      sam.submitted = source.submitted,\n      sam.submittedResultEngine = source.submittedResultEngine,\n      sam.rejected = source.rejected,\n      sam.rejectedResultEngine = source.rejectedResultEngine,\n      sam.accepted = source.accepted,\n      sam.acceptedResultEngine = source.acceptedResultEngine,\n      sam.highCount = source.highCount,\n      sam.mediumCount = source.mediumCount,\n      sam.lowCount = source.lowCount,\n      sam.notchecked = source.notchecked,\n      sam.notcheckedResultEngine = source.notcheckedResultEngine,\n      sam.notapplicable = source.notapplicable,\n      sam.notapplicableResultEngine = source.notapplicableResultEngine,\n      sam.pass = source.pass,\n      sam.passResultEngine = source.passResultEngine,\n      sam.fail = source.fail,\n      sam.failResultEngine = source.failResultEngine,\n      sam.unknown = source.unknown,\n      sam.unknownResultEngine = source.unknownResultEngine,\n      sam.error = source.error,\n      sam.errorResultEngine = source.errorResultEngine,\n      sam.notselected = source.notselected,\n      sam.notselectedResultEngine = source.notselectedResultEngine,\n      sam.informational = source.informational,\n      sam.informationalResultEngine = source.informationalResultEngine,\n      sam.fixed = source.fixed,\n      sam.fixedResultEngine = source.fixedResultEngine`\n]\n\nconst downMigration = [\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0023.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n\n  // table: revision\n  `ALTER TABLE revision ADD COLUMN revisionStr VARCHAR(45) GENERATED ALWAYS AS (concat(\"V\", \\`version\\`, \"R\", \\`release\\`)) AFTER \\`release\\``,\n  `ALTER TABLE revision ADD INDEX idx_revision_benchmark_revisionStr (benchmarkId ASC, revisionStr ASC) VISIBLE`,\n\n  // table: collection_rev\n  `drop table if exists collection_rev_map`,\n  `CREATE TABLE collection_rev_map (\n    crId INT NOT NULL AUTO_INCREMENT,\n    collectionId INT NOT NULL,\n    benchmarkId VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_as_cs,\n    revId VARCHAR(255) NOT NULL,\n    PRIMARY KEY index1 (crId),\n    UNIQUE KEY index_collection_benchmark (collectionId, benchmarkId),\n    INDEX index_revId (revId),\n    CONSTRAINT fk_collection_rev_map_1 FOREIGN KEY (collectionId) REFERENCES collection (collectionId) ON DELETE CASCADE ON UPDATE CASCADE\n  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci`,\n\n  // view: default_rev\n  `DROP VIEW IF EXISTS v_default_rev`,\n  `CREATE VIEW v_default_rev AS\n  SELECT DISTINCT\n        a.collectionId AS collectionId,\n        sa.benchmarkId AS benchmarkId,\n        CASE WHEN crm.revId IS NOT NULL THEN crm.revId ELSE cr.revId END as revId,\n        CASE WHEN crm.revId IS NOT NULL THEN 1 ELSE 0 END as revisionPinned\n    FROM\n        asset a\n        INNER JOIN stig_asset_map sa ON a.assetId = sa.assetId\n        LEFT JOIN current_rev cr ON sa.benchmarkId = cr.benchmarkId\n        LEFT JOIN collection_rev_map crm ON (sa.benchmarkId = crm.benchmarkId AND a.collectionId = crm.collectionId)`,\n\n  // table: default_rev\n  `DROP TABLE IF EXISTS default_rev`,\n  `CREATE TABLE default_rev (\n    vdId int NOT NULL AUTO_INCREMENT,\n    collectionId int NOT NULL,\n    benchmarkId varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_as_cs NOT NULL,\n    revId varchar(255) NOT NULL,\n    revisionPinned TINYINT NOT NULL,\n    PRIMARY KEY (vdId),\n    UNIQUE KEY index2 (collectionId,benchmarkId),\n    KEY index3 (benchmarkId),\n    KEY index4 (revId),\n    CONSTRAINT fk_default_rev_2 FOREIGN KEY (collectionId) REFERENCES collection (collectionId) ON DELETE CASCADE ON UPDATE CASCADE\n  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci`,\n  `INSERT INTO default_rev(collectionId, benchmarkId, revId, revisionPinned)\n  SELECT collectionId, benchmarkId, revId, revisionPinned FROM v_default_rev`,\n\n  // view: v_latest_rev\n  `DROP VIEW IF EXISTS v_latest_rev`,\n  `CREATE VIEW v_latest_rev AS\n  select \n    rr.revId AS revId, \n    rr.benchmarkId AS benchmarkId,\n    concat('V',rr.version,'R',rr.release) as revisionStr\n  from \n    (\n      select \n        r.revId, \n        r.benchmarkId,\n        r.version,\n        r.release,\n        row_number() OVER (\n          PARTITION BY r.benchmarkId \n          ORDER BY \n            field(\n              r.status, 'draft', 'accepted'\n            ) desc, \n            (r.version + 0) desc, \n            (r.release + 0) desc\n        ) AS rn \n      from \n        revision r\n    ) rr \n  where \n    (rr.rn = 1)`,\n\n    `ALTER TABLE rev_group_rule_map\n    DROP INDEX index4 ,\n    ADD INDEX idx_version_check_digest (\\`version\\` ASC, checkDigest ASC) VISIBLE`\n]\n\nconst downMigration = [\n  `drop table if exists collection_rev_map`,\n  `DROP VIEW IF EXISTS v_default_rev`\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0024.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n\n  // table: collection\n  `ALTER TABLE collection \n  ADD COLUMN state ENUM('enabled','disabled','cloning') NOT NULL,\n  ADD COLUMN createdUserId INT NULL,\n  ADD COLUMN stateDate DATETIME NULL,\n  ADD COLUMN stateUserId INT NULL,\n  ADD COLUMN isEnabled TINYINT GENERATED ALWAYS AS (case when (state = 'enabled') then 1 else null end),\n  DROP INDEX index2,\n  ADD UNIQUE INDEX index2 (name ASC, isEnabled ASC) VISIBLE`,\n\n  // table: asset\n  `ALTER TABLE asset ADD COLUMN state ENUM('enabled','disabled') NOT NULL,\n  ADD COLUMN stateDate DATETIME NULL,\n  ADD COLUMN stateUserId INT NULL,\n  ADD COLUMN isEnabled TINYINT GENERATED ALWAYS AS (case when (state = 'enabled') then 1 else null end),\n  DROP INDEX INDEX_NAMECOLLECTION,\n  ADD UNIQUE INDEX INDEX_NAME_COLLECTION_ENABLED (name ASC, collectionId ASC, isEnabled ASC) VISIBLE`,\n\n  // procedure: deleteDisabledCollections\n  `DROP procedure IF EXISTS deleteDisabledCollections`\n]\n\nconst downMigration = [\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0025.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n\n  // table: collection\n  `ALTER TABLE collection \n  ADD COLUMN isCloning TINYINT GENERATED ALWAYS AS (case when (state = 'cloning') then 1 else null end),\n  ADD UNIQUE INDEX index3 (name ASC, isCloning ASC) VISIBLE`,\n\n  // procedure: deleteDisabledCollections\n  `DROP procedure IF EXISTS deleteDisabledCollections`\n]\n\nconst downMigration = [\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0026.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n\n  // table: collection\n  `ALTER TABLE collection \n  CHANGE COLUMN isCloning isNameUnavailable TINYINT GENERATED ALWAYS AS ((case when (state = _utf8mb4'cloning') or (state = _utf8mb4'enabled') then 1 else NULL end)) VIRTUAL ;`,\n]\n\nconst downMigration = [\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}"
  },
  {
    "path": "api/source/service/migrations/0027.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `ALTER TABLE result \n  ADD COLUMN cklb VARCHAR(32) NOT NULL AFTER ckl`,\n  `UPDATE result set cklb = 'not_reviewed' where resultId in (1, 5, 6, 7, 8)`,\n  `UPDATE result set cklb = 'not_applicable' where resultId = 2`,\n  `UPDATE result set cklb = 'not_a_finding' where resultId in (3, 9)`,\n  `UPDATE result set cklb = 'open' where resultId = 4`\n]\n\nconst downMigration = [\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n\n"
  },
  {
    "path": "api/source/service/migrations/0028.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  // table: review\n  `ALTER TABLE review MODIFY COLUMN statusText VARCHAR(512)`,\n\n  // table: review_history\n  `ALTER TABLE review_history MODIFY COLUMN statusText VARCHAR(512)`\n]\n\nconst downMigration = [\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n\n"
  },
  {
    "path": "api/source/service/migrations/0029.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `DROP VIEW IF EXISTS v_current_group_rule`,\n  `DROP TABLE IF EXISTS current_group_rule`\n]\n\nconst downMigration = [\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n\n"
  },
  {
    "path": "api/source/service/migrations/0032.js",
    "content": "const logger = require('../../utils/logger')\nconst path = require('node:path')\n\nconst migrationName = path.basename(__filename, '.js')\n\nconst upFn = async (pool, migrationName) => {\n  const [cols] = await pool.query('SHOW COLUMNS FROM stig_asset_map')\n  const colNames = cols.map(row => row.Field)\n  const colStatements = []\n  if (colNames.includes('resultEngines')) {\n    colStatements.push(`ALTER TABLE stig_asset_map DROP COLUMN resultEngines`)\n  }\n  if (colNames.includes('users')) {\n    colStatements.push(`ALTER TABLE stig_asset_map DROP COLUMN users`)\n  }\n  if (colNames.includes('statusUsers')) {\n    colStatements.push(`ALTER TABLE stig_asset_map DROP COLUMN statusUsers`)\n  }\n  for (const statement of colStatements) {\n    logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, statement })\n    await pool.query(statement)\n  }\n}\n\nmodule.exports = {\n  up: async pool => {\n    try {\n      logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'up', migrationName })\n      await upFn(pool, migrationName)\n      logger.writeInfo('mysql', 'migration', {status: 'finish', migrationName })\n    }\n    catch (e) {\n      logger.writeError('mysql', 'migration', {status: 'error', migrationName, message: e.message })\n      throw (e)\n    }\n  },\n  down: () => {}\n}\n\n"
  },
  {
    "path": "api/source/service/migrations/0033.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `UPDATE collection\n   SET settings = JSON_SET(settings, '$.history.maxReviews', 15)\n   WHERE JSON_EXTRACT(settings, '$.history.maxReviews') = -1\n      OR JSON_EXTRACT(settings, '$.history.maxReviews') > 15\n  `\n]\n\nconst downMigration = [\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n\n"
  },
  {
    "path": "api/source/service/migrations/0034.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `ALTER TABLE asset ADD INDEX idx_state (state ASC)`,\n  `ALTER TABLE collection ADD INDEX idx_state (state ASC)`\n]\n\nconst downMigration = [\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n\n"
  },
  {
    "path": "api/source/service/migrations/0035.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `ALTER TABLE review_history CHANGE COLUMN historyId historyId BIGINT UNSIGNED NOT NULL AUTO_INCREMENT`\n]\n\nconst downMigration = [\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n\n"
  },
  {
    "path": "api/source/service/migrations/0036.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `DROP TABLE IF EXISTS collection_grant_acl`,\n  `DROP TABLE IF EXISTS collection_grant_group_acl`,\n  `DROP TABLE IF EXISTS collection_grant_group`,\n  `DROP TABLE IF EXISTS user_group_user_map`,\n  `DROP TABLE IF EXISTS user_group`,\n\n  // table: user_group\n  `CREATE TABLE user_group (\n    userGroupId INT NOT NULL AUTO_INCREMENT,\n    name VARCHAR(255) NOT NULL,\n    description VARCHAR(255) NULL,\n    createdUserId INT NOT NULL,\n    createdDate DATETIME DEFAULT CURRENT_TIMESTAMP, \n    modifiedUserId INT NOT NULL,\n    modifiedDate DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP, \n    PRIMARY KEY (userGroupId),\n    UNIQUE INDEX idx_name (name ASC),\n    INDEX fk_user_group_1_idx (createdUserId ASC),\n    INDEX fk_user_group_2_idx (modifiedUserId ASC),\n    CONSTRAINT fk_user_group_1\n      FOREIGN KEY (createdUserId)\n      REFERENCES user_data (userId)\n      ON DELETE RESTRICT\n      ON UPDATE RESTRICT,\n    CONSTRAINT fk_user_group_2\n      FOREIGN KEY (modifiedUserId)\n      REFERENCES user_data (userId)\n      ON DELETE RESTRICT\n      ON UPDATE RESTRICT\n  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci`,\n\n  // table user_group_user_map\n  `CREATE TABLE user_group_user_map (\n    ugumId INT NOT NULL AUTO_INCREMENT,\n    userGroupId INT NOT NULL,\n    userId INT NOT NULL,\n    PRIMARY KEY (ugumId),\n    UNIQUE KEY INDEX_UG_USER (userGroupId,userId),\n    INDEX fk_user_group_map_2_idx (userId ASC) VISIBLE,\n    CONSTRAINT fk_user_group_map_1\n      FOREIGN KEY (userGroupId)\n      REFERENCES user_group (userGroupId)\n      ON DELETE CASCADE\n      ON UPDATE CASCADE,\n    CONSTRAINT fk_user_group_map_2\n      FOREIGN KEY (userId)\n      REFERENCES user_data (userId)\n      ON DELETE CASCADE\n      ON UPDATE CASCADE\n  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci`,\n\n  // table collection_grant\n  `ALTER TABLE collection_grant DROP FOREIGN KEY fk_collection_grant_1`,\n  `ALTER TABLE collection_grant RENAME COLUMN cgId TO grantId`,\n  `ALTER TABLE collection_grant ADD COLUMN userGroupId INT NULL AFTER userId, CHANGE COLUMN userId userId INT NULL`,\n  `ALTER TABLE collection_grant ADD UNIQUE INDEX INDEX_USER_GROUP (userGroupId ASC, collectionId ASC) VISIBLE`,\n  `ALTER TABLE collection_grant CHANGE COLUMN accessLevel roleId INT NOT NULL`,\n  `ALTER TABLE collection_grant ADD CONSTRAINT fk_collection_grant_1 FOREIGN KEY (userId) REFERENCES user_data (userId) ON DELETE CASCADE ON UPDATE CASCADE`,\n  `ALTER TABLE collection_grant ADD CONSTRAINT fk_collection_grant_3 FOREIGN KEY (userGroupId) REFERENCES user_group (userGroupId) ON DELETE CASCADE ON UPDATE CASCADE`,\n\n  // table collection_grant_acl\n  `CREATE TABLE collection_grant_acl (\n    cgAclId INT NOT NULL AUTO_INCREMENT,\n    grantId INT NOT NULL,\n    benchmarkId VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_as_cs NULL,\n    assetId INT NULL,\n    clId INT NULL,\n    access enum('none','r', 'rw') NOT NULL,\n    modifiedUserId int NULL,\n    modifiedDate datetime DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,\n    PRIMARY KEY (cgAclId),\n    KEY fk_collection_grant_acl_1 (grantId),\n    KEY fk_collection_grant_acl_2 (assetId, benchmarkId),\n    KEY fk_collection_grant_acl_3 (benchmarkId, assetId),\n    KEY fk_collection_grant_acl_4 (clId, benchmarkId),\n    CONSTRAINT fk_collection_grant_acl_1 FOREIGN KEY (grantId) REFERENCES collection_grant (grantId) ON DELETE CASCADE ON UPDATE CASCADE,\n    CONSTRAINT fk_collection_grant_acl_2 FOREIGN KEY (assetId) REFERENCES asset (assetId) ON DELETE CASCADE ON UPDATE CASCADE,\n    CONSTRAINT fk_collection_grant_acl_3 FOREIGN KEY (benchmarkId) REFERENCES stig (benchmarkId) ON DELETE CASCADE ON UPDATE CASCADE,\n    CONSTRAINT fk_collection_grant_acl_4 FOREIGN KEY (clId) REFERENCES collection_label (clId) ON DELETE CASCADE ON UPDATE CASCADE,\n    CONSTRAINT fk_collection_grant_acl_5 FOREIGN KEY (benchmarkId, assetId) REFERENCES stig_asset_map (benchmarkId, assetId) ON DELETE CASCADE ON UPDATE CASCADE\n  )`,\n\n  // initialize collection_grant_acl\n  `INSERT INTO collection_grant_acl (grantId, assetId, benchmarkId, access, modifiedUserId, modifiedDate) SELECT\n  cg.grantId,\n  sa.assetId,\n  sa.benchmarkId,\n  'rw',\n  null,\n  null \nFROM\n  user_stig_asset_map usa\n  left join stig_asset_map sa using (saId)\n  left join asset a on sa.assetId = a.assetId\n  left join collection_grant cg on (a.collectionId = cg.collectionId and usa.userId = cg.userId )\nWHERE\n  cg.roleId = 1`,\n\n  `DROP TABLE user_stig_asset_map`\n]\n\nconst downMigration = [\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0037.js",
    "content": "const logger = require('../../utils/logger')\nconst path = require('node:path')\n\nconst migrationName = path.basename(__filename, '.js')\n\nconst upFn = async (pool, migrationName) => {\n  const [cols] = await pool.query('SHOW COLUMNS FROM user_data')\n  const colNames = cols.map(row => row.Field)\n  const colStatements = []\n  if (!colNames.includes('status')) {\n    colStatements.push(`ALTER TABLE user_data ADD COLUMN status ENUM('available', 'unavailable') NOT NULL DEFAULT 'available' AFTER lastClaims`)\n    colStatements.push(`ALTER TABLE user_data ADD INDEX INDEX_status (status ASC)`)\n  }\n  if (!colNames.includes('statusDate')) {\n    colStatements.push(`ALTER TABLE user_data ADD COLUMN statusDate DATETIME NOT NULL DEFAULT (created) AFTER status`)\n  }\n  if (!colNames.includes('statusUser')) {\n    colStatements.push(`ALTER TABLE user_data ADD COLUMN statusUser INT NULL DEFAULT NULL AFTER statusDate`)\n  }\n  if (colStatements.length === 0) {\n    logger.writeInfo('mysql', 'migration', {status: 'skipped', name: migrationName })\n    return\n  }\n  for (const statement of colStatements) {\n    logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, statement })\n    await pool.query(statement)\n  }\n}\n\nmodule.exports = {\n  up: async pool => {\n    try {\n      logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'up', migrationName })\n      await upFn(pool, migrationName)\n      logger.writeInfo('mysql', 'migration', {status: 'finish', migrationName })\n    }\n    catch (e) {\n      logger.writeError('mysql', 'migration', {status: 'error', migrationName, message: e.message })\n      throw (e)\n    }\n  },\n  down: () => {}\n}\n"
  },
  {
    "path": "api/source/service/migrations/0038.js",
    "content": "const logger = require('../../utils/logger')\r\nconst path = require('node:path')\r\n\r\nconst migrationName = path.basename(__filename, '.js')\r\n\r\nconst upFn = async (pool, migrationName) => {\r\n  // Check if columns exist before adding them\r\n  const [cols] = await pool.query('SHOW COLUMNS FROM stig_asset_map')\r\n  const colNames = cols.map(row => row.Field)\r\n  \r\n  // Define statements for adding columns\r\n  const colStatements = []\r\n  if (!colNames.includes('assessedHighCount')) {\r\n    colStatements.push(`ALTER TABLE stig_asset_map ADD COLUMN assessedHighCount INT DEFAULT NULL`)\r\n  }\r\n  if (!colNames.includes('assessedMediumCount')) {\r\n    colStatements.push(`ALTER TABLE stig_asset_map ADD COLUMN assessedMediumCount INT DEFAULT NULL`)\r\n  }\r\n  if (!colNames.includes('assessedLowCount')) {\r\n    colStatements.push(`ALTER TABLE stig_asset_map ADD COLUMN assessedLowCount INT DEFAULT NULL`)\r\n  }\r\n  \r\n  // Execute column addition statements\r\n  for (const statement of colStatements) {\r\n    logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, statement })\r\n    await pool.query(statement)\r\n  }\r\n  \r\n  // Update the columns with calculated values\r\n  const updateStatement = `\r\n  UPDATE stig_asset_map sam\r\n   JOIN (\r\n     SELECT \r\n       sa.assetId,\r\n       sa.benchmarkId,\r\n       sum(CASE WHEN (review.resultId in (2,3,4)) and rgr.severity='high' THEN 1 ELSE 0 END) as assessedHighCount,\r\n       sum(CASE WHEN (review.resultId in (2,3,4)) and rgr.severity='medium' THEN 1 ELSE 0 END) as assessedMediumCount,\r\n       sum(CASE WHEN (review.resultId in (2,3,4)) and rgr.severity='low' THEN 1 ELSE 0 END) as assessedLowCount\r\n     FROM\r\n       asset a\r\n       left join stig_asset_map sa using (assetId)\r\n       left join default_rev dr on (sa.benchmarkId = dr.benchmarkId and a.collectionId = dr.collectionId)\r\n       left join rev_group_rule_map rgr on dr.revId = rgr.revId\r\n       left join rule_version_check_digest rvcd on rgr.ruleId = rvcd.ruleId\r\n       left join review on (rvcd.version=review.version and rvcd.checkDigest=review.checkDigest and review.assetId=sa.assetId)\r\n       inner join collection c on c.collectionId = a.collectionId \r\n     WHERE \r\n\t\t    a.state = \"enabled\"\r\n        and c.state = \"enabled\" \r\n     GROUP BY\r\n       sa.assetId,\r\n       sa.benchmarkId\r\n   ) src ON sam.assetId = src.assetId AND sam.benchmarkId = src.benchmarkId\r\n   SET \r\n     sam.assessedHighCount = src.assessedHighCount,\r\n     sam.assessedMediumCount = src.assessedMediumCount,\r\n     sam.assessedLowCount = src.assessedLowCount`\r\n  \r\n  logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, statement: updateStatement })\r\n  await pool.query(updateStatement)\r\n}\r\n  \r\n\r\nmodule.exports = {\r\n  up: async pool => {\r\n    try {\r\n      logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'up', migrationName })\r\n      await upFn(pool, migrationName)\r\n      logger.writeInfo('mysql', 'migration', {status: 'finish', migrationName })\r\n    }\r\n    catch (e) {\r\n      logger.writeError('mysql', 'migration', {status: 'error', migrationName, message: e.message })\r\n      throw (e)\r\n    }\r\n  },\r\n  down: () => {}\r\n}\r\n"
  },
  {
    "path": "api/source/service/migrations/0039.js",
    "content": "const logger = require('../../utils/logger')\nconst path = require('node:path')\n\nconst migrationName = path.basename(__filename, '.js')\n\nconst defaultImportOptions = {\n  autoStatus: 'saved',\n  unreviewed: 'commented',\n  unreviewedCommented: 'informational',\n  emptyDetail: 'replace',\n  emptyComment: 'ignore',\n  allowCustom: true\n}\n\nconst schemaEnums = {\n    autoStatus: [\"null\", 'saved', 'submitted', 'accepted'],\n    unreviewed: ['never', 'commented', 'always'],\n    unreviewedCommented: ['notchecked', 'informational'],\n    emptyDetail: ['ignore', 'import', 'replace'],\n    emptyComment: ['ignore', 'import', 'replace'],\n    allowCustom: [true, false]\n}\n\n\nconst isValidImportOptions = (options) => {\n  if (!options || typeof options !== 'object') return false\n\n  const allowedKeys = Object.keys(defaultImportOptions)\n\n  // contain only the allowed keys\n  const optionKeys = Object.keys(options)\n  if (optionKeys.length !== allowedKeys.length) return false\n  if (!optionKeys.every(key => allowedKeys.includes(key))) return false\n\n  // Each value must be valid for its key\n  for (const key of allowedKeys) {\n    const allowedValues = schemaEnums[key]\n    if (!allowedValues.includes(options[key])) return false\n  }\n\n  return true\n}\n\n\nconst upFn = async (pool, migrationName) => {\n\n  const connection = await pool.getConnection()\n  \n\n  const collectionsData = await connection.query(`SELECT c.collectionId, c.settings, c.metadata FROM collection c`)\n\n  const collections = collectionsData[0]\n\n  const updates = []\n\n  for(const { collectionId, metadata, } of collections) {\n    let importOptions = metadata?.importOptions\n    if (typeof importOptions === 'string') {\n      try {\n        importOptions = JSON.parse(importOptions)\n      } catch (e) {\n        importOptions = null // will be replaced with defaultImportOptions\n      }\n    }\n    const finalOptions = isValidImportOptions(importOptions) ? importOptions : defaultImportOptions\n    updates.push({\n      collectionId,\n      importOptions: finalOptions\n    })\n  }\n  \n  logger.writeInfo('mysql', 'migration', {\n    status: 'running',\n    name: migrationName,\n    updates: updates.length\n  })\n  // get connection\n\n\n  await connection.query(`SET @json = ?`, [JSON.stringify(updates)])\n\n  await connection.query(`UPDATE\n\tcollection c\n    LEFT JOIN \n    JSON_TABLE(@json, '$[*]' COLUMNS(\n\t\tcollectionId INT PATH '$.collectionId',\n\t\timportOptions JSON PATH '$.importOptions'\n\t)) as jt on c.collectionId = jt.collectionId\nSET\n\tc.settings = JSON_SET(c.settings, '$.importOptions', jt.importOptions),\n\tc.metadata = JSON_REMOVE(c.metadata, '$.importOptions')`)\n\n  await connection.release()\n}\n  \n\nmodule.exports = {\n  up: async pool => {\n    try {\n      logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'up', migrationName })\n      await upFn(pool, migrationName)\n      logger.writeInfo('mysql', 'migration', {status: 'finish', migrationName })\n    }\n    catch (e) {\n      logger.writeError('mysql', 'migration', {status: 'error', migrationName, message: e.message })\n      throw (e)\n    }\n  },\n  down: () => {}\n}\n"
  },
  {
    "path": "api/source/service/migrations/0040.js",
    "content": "const logger = require('../../utils/logger')\nconst path = require('node:path')\n\nconst migrationName = path.basename(__filename, '.js')\n\n\nconst upFn = async (pool, migrationName) => {\n  const connection = await pool.getConnection()\n\n  const [collectionsData] = await connection.query(`\n    SELECT collectionId, settings \n    FROM collection\n  `)\n\n  const updates = []\n\n  for (const { collectionId, settings } of collectionsData) {\n\n    const legacyValue = settings.importOptions.autoStatus\n\n    updates.push({\n      collectionId,\n      autoStatus: {\n        fail: legacyValue,\n        notapplicable: legacyValue,\n        pass: legacyValue\n      }\n    })\n  }\n\n  logger.writeInfo('mysql', 'migration', {\n    status: 'running',\n    name: migrationName,\n    updates: updates.length,\n    data: updates\n  })\n\n  await connection.query(`SET @json = ?`, [JSON.stringify(updates)])\n\n  const updateStatement = `\n    UPDATE collection c\n    LEFT JOIN \n      JSON_TABLE(@json, '$[*]' COLUMNS(\n        collectionId INT PATH '$.collectionId',\n        autoStatus JSON PATH '$.autoStatus'\n      )) as jt \n    ON c.collectionId = jt.collectionId\n    SET c.settings = JSON_SET(c.settings, '$.importOptions.autoStatus', jt.autoStatus)\n  `\n\n  logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, statement: updateStatement })\n\n  await connection.query(updateStatement)\n  await connection.release()\n}\n\nmodule.exports = {\n  up: async pool => {\n    try {\n      logger.writeInfo('mysql', 'migration', { status: 'start', direction: 'up', migrationName })\n      await upFn(pool, migrationName)\n      logger.writeInfo('mysql', 'migration', { status: 'finish', migrationName })\n    } catch (e) {\n      logger.writeError('mysql', 'migration', { status: 'error', migrationName, message: e.message })\n      throw e\n    }\n  },\n  down: () => {}\n}\n"
  },
  {
    "path": "api/source/service/migrations/0041.js",
    "content": "const logger = require('../../utils/logger')\nconst path = require('node:path')\n\nconst migrationName = path.basename(__filename, '.js')\n\nconst upFn = async (pool, migrationName) => {\n  const connection = await pool.getConnection()\n\n  // drop indexes that use virtual isEnabled column\n\n  // check if the indexes exist before dropping them\n  const [assetIndexExists] = await connection.query(`\n    SELECT COUNT(*) AS count FROM INFORMATION_SCHEMA.STATISTICS\n    WHERE TABLE_SCHEMA = DATABASE()\n      AND TABLE_NAME = 'asset'\n      AND INDEX_NAME = 'INDEX_NAME_COLLECTION_ENABLED'`)  \n  const [collectionIndexExists] = await connection.query(`\n    SELECT COUNT(*) AS count FROM INFORMATION_SCHEMA.STATISTICS\n    WHERE TABLE_SCHEMA = DATABASE()\n      AND TABLE_NAME = 'collection'\n      AND INDEX_NAME = 'index2'`) \n  // If the indexes exist, drop them\n  if( assetIndexExists[0].count > 0) {\n    const dropEnabledAssetIndex = `ALTER TABLE asset DROP INDEX INDEX_NAME_COLLECTION_ENABLED`\n    logger.writeInfo('mysql', 'migration', { status: 'running', name: migrationName, statement: dropEnabledAssetIndex })\n    await connection.query(dropEnabledAssetIndex)\n  }\n\n  if( collectionIndexExists[0].count > 0) {\n    const dropEnabledCollectionIndex = `ALTER TABLE collection DROP INDEX index2`\n    logger.writeInfo('mysql', 'migration', { status: 'running', name: migrationName, statement: dropEnabledCollectionIndex })\n    await connection.query(dropEnabledCollectionIndex)\n  }\n \n  // Drop old virtual isEnabled column on 'asset' if it exists\n  const [assetColumnsDrop] = await connection.query(`\n    SELECT COUNT(*) AS count FROM INFORMATION_SCHEMA.COLUMNS\n    WHERE TABLE_SCHEMA = DATABASE()\n      AND TABLE_NAME = 'asset'\n      AND COLUMN_NAME = 'isEnabled'`)\n  if (assetColumnsDrop[0].count > 0) {\n    const dropEnabledAssetColumn = `ALTER TABLE asset DROP COLUMN isEnabled`\n    logger.writeInfo('mysql', 'migration', { status: 'running', name: migrationName, statement: dropEnabledAssetColumn })\n    await connection.query(dropEnabledAssetColumn)\n  }\n\n  // Drop old virtual isEnabled column on 'collection' if it exists\n  const [collectionColumnsDrop] = await connection.query(`\n    SELECT COUNT(*) AS count FROM INFORMATION_SCHEMA.COLUMNS\n    WHERE TABLE_SCHEMA = DATABASE()\n      AND TABLE_NAME = 'collection'\n      AND COLUMN_NAME = 'isEnabled'`)\n  if (collectionColumnsDrop[0].count > 0) {\n    const dropEnabledCollectionColumn = `ALTER TABLE collection DROP COLUMN isEnabled`\n    logger.writeInfo('mysql', 'migration', { status: 'running', name: migrationName, statement: dropEnabledCollectionColumn })\n    await connection.query(dropEnabledCollectionColumn)\n  }\n\n\n  // Check if 'isEnabled' exists on 'asset'\n  const [assetColumns] = await connection.query(`\n  SELECT COUNT(*) AS count FROM INFORMATION_SCHEMA.COLUMNS\n  WHERE TABLE_SCHEMA = DATABASE()\n    AND TABLE_NAME = 'asset'\n    AND COLUMN_NAME = 'isEnabled'`)\n    \n  // If it does not exist, create the new stored column\n  if (assetColumns[0].count === 0) {\n    const createEnabledAssetColumn = `\n      ALTER TABLE asset ADD COLUMN isEnabled\n      TINYINT GENERATED ALWAYS AS (CASE WHEN state = 'enabled' THEN 1 ELSE NULL END) STORED`\n    logger.writeInfo('mysql', 'migration', { status: 'running', name: migrationName, statement: createEnabledAssetColumn })\n    await connection.query(createEnabledAssetColumn)\n  }\n\n  // Check if 'isEnabled' exists on 'collection'\n  const [collectionColumns] = await connection.query(`\n    SELECT COUNT(*) AS count FROM INFORMATION_SCHEMA.COLUMNS\n    WHERE TABLE_SCHEMA = DATABASE()\n      AND TABLE_NAME = 'collection'\n      AND COLUMN_NAME = 'isEnabled'`)\n  // If it does not exist, create the new stored column\n  if (collectionColumns[0].count === 0) {\n    const createEnabledCollectionColumn = `\n      ALTER TABLE collection ADD COLUMN isEnabled\n      TINYINT GENERATED ALWAYS AS (CASE WHEN state = 'enabled' THEN 1 ELSE NULL END) STORED`\n    logger.writeInfo('mysql', 'migration', { status: 'running', name: migrationName, statement: createEnabledCollectionColumn })\n    await connection.query(createEnabledCollectionColumn)\n  }\n\n  // recreate indexes for new stored isEnabled column\n  const [assetIndexes] = await connection.query(`\n  SELECT COUNT(*) AS count FROM INFORMATION_SCHEMA.STATISTICS\n  WHERE TABLE_SCHEMA = DATABASE()\n    AND TABLE_NAME = 'asset'\n    AND INDEX_NAME = 'INDEX_NAME_COLLECTION_ENABLED'`)\n    // If the index does not exist, create it\n  if (assetIndexes[0].count === 0) {\n    const createEnabledAssetIndex = `ALTER TABLE asset ADD UNIQUE INDEX INDEX_NAME_COLLECTION_ENABLED (name, collectionId, isEnabled)`\n    logger.writeInfo('mysql', 'migration', { status: 'running', name: migrationName, statement: createEnabledAssetIndex })\n    await connection.query(createEnabledAssetIndex)\n  }\n\n  \n  const [collectionIndexes] = await connection.query(`\n  SELECT COUNT(*) AS count FROM INFORMATION_SCHEMA.STATISTICS\n  WHERE TABLE_SCHEMA = DATABASE()\n    AND TABLE_NAME = 'collection'\n    AND INDEX_NAME = 'index2'`)\n  if (collectionIndexes[0].count === 0) {\n    const createEnabledCollectionIndex = `ALTER TABLE collection ADD UNIQUE INDEX index2 (name, isEnabled)`\n    logger.writeInfo('mysql', 'migration', { status: 'running', name: migrationName, statement: createEnabledCollectionIndex })\n    await connection.query(createEnabledCollectionIndex)\n  }\n\n  // create or replace new views\n  const createEnabledAssetView = `CREATE OR REPLACE VIEW enabled_asset AS SELECT * FROM asset WHERE state = 'enabled'`\n  const createEnabledCollectionView = `CREATE OR REPLACE VIEW enabled_collection AS SELECT * FROM collection WHERE state = 'enabled'`\n\n  logger.writeInfo('mysql', 'migration', { status: 'running', name: migrationName, statement: createEnabledAssetView })\n  await connection.query(createEnabledAssetView)\n\n  logger.writeInfo('mysql', 'migration', { status: 'running', name: migrationName, statement: createEnabledCollectionView })\n  await connection.query(createEnabledCollectionView)\n\n  await connection.release()\n}\n\nmodule.exports = {\n  up: async (pool) => {\n    try {\n      logger.writeInfo('mysql', 'migration', { status: 'start', direction: 'up', migrationName })\n      await upFn(pool, migrationName)\n      logger.writeInfo('mysql', 'migration', { status: 'finish', migrationName })\n    } catch (e) {\n      logger.writeError('mysql', 'migration', { status: 'error', migrationName, message: e.message })\n      throw e\n    }\n  },\n  down: () => {}\n}\n"
  },
  {
    "path": "api/source/service/migrations/0042.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `ALTER TABLE revision ADD COLUMN marking VARCHAR(10) DEFAULT NULL AFTER statusDate`,\n  `ALTER TABLE current_rev ADD COLUMN marking VARCHAR(10) DEFAULT NULL AFTER statusDate`,\n  `ALTER VIEW v_current_rev AS\n  select\n  rr.revId AS revId,\n  rr.benchmarkId AS benchmarkId,\n  rr.\\`version\\` AS \\`version\\`,\n  rr.\\`release\\` AS \\`release\\`,\n  rr.benchmarkDate AS benchmarkDate,\n  rr.benchmarkDateSql AS benchmarkDateSql,\n  rr.status AS status,\n  rr.statusDate AS statusDate,\n  rr.marking AS marking,\n  rr.description AS description,\n  rr.active AS active,\n  rr.groupCount AS groupCount,\n  rr.ruleCount AS ruleCount,\n  rr.lowCount AS lowCount,\n  rr.mediumCount AS mediumCount,\n  rr.highCount AS highCount,\n  rr.checkCount AS checkCount,\n  rr.fixCount AS fixCount from (select r.revId AS revId,\n  r.benchmarkId AS benchmarkId,\n  r.\\`version\\` AS \\`version\\`,\n  r.\\`release\\` AS \\`release\\`,\n  r.benchmarkDate AS benchmarkDate,\n  r.benchmarkDateSql AS benchmarkDateSql,\n  r.status AS status,\n  r.statusDate AS statusDate,\n  r.marking AS marking,\n  r.description AS description,\n  r.active AS active,\n  r.groupCount AS groupCount,\n  r.ruleCount AS ruleCount,\n  r.lowCount AS lowCount,\n  r.mediumCount AS mediumCount,\n  r.highCount AS highCount,\n  r.checkCount AS checkCount,\n  r.fixCount AS fixCount,\n  row_number() OVER (PARTITION BY r.benchmarkId ORDER BY field(r.status,\n  'draft',\n  'accepted') desc,\n  (r.\\`version\\` + 0) desc,\n  (r.\\`release\\` + 0) desc )  AS rn from revision r) rr where (rr.rn = 1)`\n]\n\nconst downMigration = [\n  `ALTER TABLE revision DROP COLUMN marking`,\n  `ALTER TABLE current_rev DROP COLUMN marking`\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0043.js",
    "content": "const logger = require('../../utils/logger')\nconst path = require('node:path')\n\nconst migrationName = path.basename(__filename, '.js')\n\nconst upFn = async (pool, migrationName) => {\n  const connection = await pool.getConnection()\n\n  // webPreferences column exists on user_data\n  const [cols] = await connection.query(`\n    SELECT COUNT(*) AS count FROM INFORMATION_SCHEMA.COLUMNS\n    WHERE TABLE_SCHEMA = DATABASE()\n      AND TABLE_NAME = 'user_data'\n      AND COLUMN_NAME = 'webPreferences'`)\n      \n  // If it does not exist, create the webPreferences column\n  if (cols[0].count === 0) {\n    const addWebPreferencesColumn = `\n      ALTER TABLE user_data ADD COLUMN webPreferences JSON NOT NULL DEFAULT ('{\"darkMode\": true, \"lastWhatsNew\": \"2000-01-01\"}')`\n    logger.writeInfo('mysql', 'migration', { status: 'running', name: migrationName, statement: addWebPreferencesColumn })\n    await connection.query(addWebPreferencesColumn)\n  }\n  \n  await connection.release()\n}\n\nmodule.exports = {\n  up: async (pool) => {\n    try {\n      logger.writeInfo('mysql', 'migration', { status: 'start', direction: 'up', migrationName })\n      await upFn(pool, migrationName)\n      logger.writeInfo('mysql', 'migration', { status: 'finish', migrationName })\n    } catch (e) {\n      logger.writeError('mysql', 'migration', { status: 'error', migrationName, message: e.message })\n      throw e\n    }\n  },\n  down: () => {}\n}"
  },
  {
    "path": "api/source/service/migrations/0044.js",
    "content": "const Importer = require('./lib/mysql-import.js')\nconst logger = require('../../utils/logger')\nconst path = require('path')\n\nconst migrationName = path.basename(__filename, '.js')\n\nconst upFn = async (pool, migrationName) => {\n  const connection = await pool.getConnection()\n\n  try {\n    // Truncate tables to remove all existing CCI data\n    const truncateCci = 'TRUNCATE TABLE `cci`'\n    logger.writeInfo('mysql', 'migration', { status: 'running', name: migrationName, statement: 'TRUNCATE cci' })\n    await connection.query(truncateCci)\n\n    const truncateCciRefMap = 'TRUNCATE TABLE `cci_reference_map`'\n    logger.writeInfo('mysql', 'migration', { status: 'running', name: migrationName, statement: 'TRUNCATE cci_reference_map' })\n    await connection.query(truncateCciRefMap)\n\n    // Import Rev 5 CCI data from the current directory\n    const sqlFile = path.join(__dirname, 'sql', 'current', '31-rev5-cci-data.sql')\n    logger.writeInfo('mysql', 'migration', { status: 'running', name: migrationName, file: '31-rev5-cci-data.sql' })\n    const importer = new Importer(pool)\n    await importer.import(sqlFile)\n\n  } finally {\n    await connection.release()\n  }\n}\n\nmodule.exports = {\n  up: async (pool) => {\n    try {\n      logger.writeInfo('mysql', 'migration', { status: 'start', direction: 'up', migrationName })\n      await upFn(pool, migrationName)\n      logger.writeInfo('mysql', 'migration', { status: 'finish', migrationName })\n    } catch (e) {\n      logger.writeError('mysql', 'migration', { status: 'error', migrationName, message: e.message })\n      throw e\n    }\n  },\n  down: () => {}\n}"
  },
  {
    "path": "api/source/service/migrations/0045.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `DROP TABLE IF EXISTS job_task_map`,\n  `DROP TABLE IF EXISTS task_output`,\n  `DROP TABLE IF EXISTS task`,\n  `DROP TABLE IF EXISTS job_run`,\n  `DROP TABLE IF EXISTS job`,\n  \n  // table to hold each maintenance task, its name and its stored procedure command\n  `CREATE TABLE task (\n    taskId INT NOT NULL AUTO_INCREMENT,\n    name VARCHAR(45) NOT NULL,\n    description VARCHAR(255) NULL,\n    command VARCHAR(255) NOT NULL,\n    PRIMARY KEY (taskId),\n    UNIQUE INDEX idx_task_name (name)\n  )`,\n  `INSERT INTO task (taskId, name, description, command) VALUES\n    (1, 'WipeDeletedObjects', 'Wipe deleted collections and assets and their associated reviews', 'delete_disabled()'),\n    (2, 'DeleteUnmappedReviews', 'Delete reviews that no longer match any rule in the system', 'delete_unmapped(\"system\")'),\n    (3, 'DeleteUnmappedAssetReviews', 'Delete reviews that no longer match an asset''s assigned rules', 'delete_unmapped(\"asset\")'),\n    (4, 'AnalyzeReviewTables', 'Analyze database tables for performance', 'analyze_tables(JSON_ARRAY(\"reviews\", \"review_history\"))')\n  `,\n\n  // table to hold each maintenance job, with its name, metadata user attributes\n  // users who have created or updated a job must exist in user_data table\n  `CREATE TABLE job (\n    jobId INT NOT NULL AUTO_INCREMENT,\n    name VARCHAR(45) NOT NULL,\n    description VARCHAR(255) NULL,\n    createdBy INT NULL,\n    updatedBy INT NULL,\n    created TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),\n    updated TIMESTAMP(3) NULL DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP(3),\n    PRIMARY KEY (jobId),\n    UNIQUE INDEX idx_job_name (name),\n    CONSTRAINT fk_job_updatedBy FOREIGN KEY (updatedBy) REFERENCES user_data(userId) ON DELETE RESTRICT,\n    CONSTRAINT fk_job_createdBy FOREIGN KEY (createdBy) REFERENCES user_data(userId) ON DELETE RESTRICT\n  )`,\n  // initial jobs with fixed jobIds for reference in code\n  `INSERT INTO job ( jobId, name, description, createdBy) VALUES\n    (1, 'Cleanup Database', 'Wipe deleted collections and assets and their associated reviews', null),\n    (2, 'Delete Unmapped Reviews', 'Delete reviews that no longer match any rule in the system', null),\n    (3, 'Delete Unmapped Asset Reviews', 'Delete reviews that no longer match an asset''s assigned rules', null)\n  `,\n  `ALTER TABLE job AUTO_INCREMENT = 100`,\n\n  // mapping jobs to tasks \n  // if a job or task is deleted, the mapping is deleted too\n  //  defines the execution order (via jtId insertion order)\n  `CREATE TABLE job_task_map (\n    jtId INT NOT NULL AUTO_INCREMENT,\n    jobId INT NOT NULL,\n    taskId INT NOT NULL,\n    created TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),\n    updated TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),\n    PRIMARY KEY (jtId),\n    CONSTRAINT fk_job_task_jobId FOREIGN KEY (jobId) REFERENCES job(jobId) ON DELETE CASCADE,\n    CONSTRAINT fk_job_task_taskId FOREIGN KEY (taskId) REFERENCES task(taskId) ON DELETE CASCADE\n  )`,\n  // pre map initial jobs to tasks\n  `INSERT INTO job_task_map (jtId, jobId, taskId) VALUES\n    (1, 1, 1),\n    (2, 1, 4),\n    (3, 2, 2),\n    (4, 2, 4),\n    (5, 3, 3),\n    (6, 3, 4)\n  `,\n  `ALTER TABLE job_task_map AUTO_INCREMENT = 1000`,\n\n  // table to hold each run of a job, its state and timestamps\n  `CREATE TABLE job_run (\n    jrId INT NOT NULL AUTO_INCREMENT,\n    jobId INT NOT NULL,\n    runId BINARY(16) NOT NULL,\n    state VARCHAR(255) NULL,\n    created TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),\n    updated TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),\n    PRIMARY KEY (jrId),\n    UNIQUE INDEX idx_job_run_runId (runId),\n    CONSTRAINT fk_job_run_jobId FOREIGN KEY (jobId) REFERENCES job(jobId) ON DELETE CASCADE\n  )`,\n\n  `DROP TABLE IF EXISTS task_output`,\n  // captures output from stored procedures \n  // runid must exist in job_run table\n  // taskid must match a task \n  `CREATE TABLE task_output (\n    seq INT NOT NULL AUTO_INCREMENT,\n    ts TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),\n    runId BINARY(16) NULL,\n    taskId INT NULL,\n    type VARCHAR(45) NOT NULL,\n    message VARCHAR(255) NOT NULL,\n    PRIMARY KEY (seq),\n    CONSTRAINT fk_task_output_runId FOREIGN KEY (runId) REFERENCES job_run(runId) ON DELETE CASCADE,\n    CONSTRAINT fk_task_output_taskId FOREIGN KEY (taskId) REFERENCES task(taskId) ON DELETE CASCADE\n  )`,\n\n  `DROP procedure IF EXISTS run_job`,\n  // takes in a jobId and optional runId\n  // cursor is a pointer that can iterate through rows for the parameter in_jobId, get all task names and commands mapped to that job in order of execution\n  // declare continue: : when the cursor has no more rows, set v_done to true\n  // declare exit: if any SQL exception occurs, log it and set the job run state to failed\n  // @runId is the binary(16) uuid for this job run it could be null so we can generate one\n  // @taskId is the current task being executed, null if no task is running\n  // INSERT INTO job_run = create new job run record with the runId\n  // OPEN curr == -- opening the cursor which contains all tasks info for this job\n  // FETCH curr -- pulls a single task from the cursor\n  // SET @sql = CONCAT('CALL ', v_currentCommand); -- create the sql to run the task's stored procedure command\n  // SET @taskId = NULL; -- clear the current task id and log task end\n  `CREATE PROCEDURE run_job(\n    IN in_jobId INT,\n    IN in_runIdStr VARCHAR(36)\n  )\n    main:BEGIN\n        DECLARE v_done INT DEFAULT FALSE;\n        DECLARE v_jrId INT;\n        DECLARE v_numTasks INT;\n        DECLARE v_currentTaskId INT;\n        DECLARE v_currentTaskName VARCHAR(255);\n        DECLARE v_currentCommand VARCHAR(255);\n        DECLARE v_currentTaskNum INT DEFAULT 0;\n        DECLARE v_param_string TEXT;\n        DECLARE cur CURSOR FOR\n          SELECT \n            jt.taskId,\n            t.name,\n            t.command\n          FROM\n            job_task_map jt\n            inner join task t on (jt.taskId = t.taskId)\n          WHERE \n            jobId = in_jobId \n          ORDER BY jtId ASC;\n        DECLARE CONTINUE HANDLER FOR NOT FOUND SET v_done = TRUE;\n        DECLARE EXIT HANDLER FOR SQLEXCEPTION\n        BEGIN\n          DECLARE err_code INT;\n          DECLARE err_msg TEXT;\n          GET STACKED DIAGNOSTICS CONDITION 1 err_code = MYSQL_ERRNO, err_msg = MESSAGE_TEXT;\n          CALL task_output('error', concat('code: ', err_code, ' message: ', err_msg));\n          UPDATE job_run SET state = 'failed' WHERE runId = @runId;\n        END;\n\n        -- setup runtime context (null if running outside a job)\n        IF in_runIdStr IS NOT NULL AND in_runIdStr REGEXP '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$' THEN\n          SET @runId = UUID_TO_BIN(in_runIdStr, 1);\n        ELSE\n          SET @runId = UUID_TO_BIN(UUID(), 1);\n        END IF;\n        SET @taskId = NULL;\n        INSERT INTO job_run(jobId, runId, state) VALUES (in_jobId, @runId, 'running');\n        CALL task_output('info', concat('run started for jobId ', in_jobId));\n\n        -- Get the number of tasks for the job\n        SELECT COUNT(*) INTO v_numTasks FROM job_task_map WHERE jobId = in_jobId;\n\n        IF v_numTasks = 0 THEN\n          CALL task_output('error', 'no tasks to run');\n          UPDATE job_run SET state = 'failed' WHERE runId = @runId AND state = 'running';\n          LEAVE main; -- No tasks to run, exit the procedure\n        END IF;\n\n        \n        OPEN cur;\n        read_loop: LOOP\n          FETCH cur INTO v_currentTaskId, v_currentTaskName, v_currentCommand;\n          IF v_done THEN\n            LEAVE read_loop;\n          END IF;\n          SET v_currentTaskNum = v_currentTaskNum + 1;\n\n          SET @sql = CONCAT('CALL ', v_currentCommand);\n          PREPARE stmt_run_job FROM @sql;\n          CALL task_output('info', concat('Beginning task ', v_currentTaskName, ' (', v_currentTaskNum, '/', v_numTasks, ')'));\n          SET @taskId = v_currentTaskId;\n          EXECUTE stmt_run_job;\n          DEALLOCATE PREPARE stmt_run_job;\n          SET @taskId = NULL;\n          CALL task_output('info', concat('Ended task ', v_currentTaskName, ' (', v_currentTaskNum, '/', v_numTasks, ')'));\n        END LOOP;\n        CLOSE cur;\n\n        -- === Post-task-loop logic ===\n        UPDATE job_run SET state = 'completed' WHERE runId = @runId AND state = 'running';\n        CALL task_output('info', concat('run completed for jobId ', in_jobId));\n\n    END`,\n\n  `DROP procedure IF EXISTS task_output`,\n  // write a message to the task_output table\n  // if in_message is null, set it to empty string\n  // insert into task_output = -- INSERT a row into task_output(runId, taskId, type, message) using: runId = @runId (set by run_job) taskId = @taskId (set around each task) type = in_type (e.g., 'info', 'error') message= in_message\n  `CREATE PROCEDURE task_output(\n    IN in_type VARCHAR(45),\n    IN in_message VARCHAR(255)\n  )\n    BEGIN\n      IF in_message IS NULL THEN SET in_message = ''; END IF;\n      insert into task_output (runId, taskId, type, message) values (@runId, @taskId, in_type, in_message);\n    END`,\n\n    // deleted disabled objects in batches, uses the variables to \"page\"? through deletes \n    // uses temporary tables to hold ids to delete\n  `DROP PROCEDURE IF EXISTS delete_disabled`,\n  `CREATE PROCEDURE delete_disabled()\n    BEGIN\n    DECLARE v_incrementValue INT DEFAULT 10000;\n    DECLARE v_curMinId BIGINT DEFAULT 1;\n    DECLARE v_curMaxId BIGINT DEFAULT v_incrementValue + 1;\n    DECLARE v_numCollectionIds INT;\n    DECLARE v_numAssetIds INT;\n    DECLARE v_numReviewIds INT;\n    DECLARE v_numHistoryIds INT;\n    DECLARE EXIT HANDLER FOR SQLEXCEPTION\n    BEGIN\n      DECLARE err_code INT;\n      DECLARE err_msg TEXT;\n      GET STACKED DIAGNOSTICS CONDITION 1 err_code = MYSQL_ERRNO, err_msg = MESSAGE_TEXT;\n      CALL task_output('error', concat('code: ', err_code, ' message: ', err_msg));\n      RESIGNAL;\n    END;\n\n    -- Runtime context is available via user variables (null if running outside a job)\n    CALL task_output('info','task started');\n\n    drop temporary table if exists t_collectionIds;\n    create temporary table t_collectionIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n      select collectionId from collection where isEnabled is null;\n    select max(seq) into v_numCollectionIds from t_collectionIds;\n    CALL task_output('info', concat('found ', ifnull(v_numCollectionIds, 0), ' collections to delete'));\n\n    drop temporary table if exists t_assetIds;\n    create temporary table t_assetIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n      select assetId from asset where isEnabled is null or collectionId in (select collectionId from t_collectionIds);\n    select max(seq) into v_numAssetIds from t_assetIds;\n    CALL task_output('info', concat('found ', ifnull(v_numAssetIds, 0), ' assets to delete'));\n\n    drop temporary table if exists t_reviewIds;\n    create temporary table t_reviewIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n      select reviewId from review where assetId in (select assetId from t_assetIds);\n    select max(seq) into v_numReviewIds from t_reviewIds;\n    CALL task_output('info', concat('found ', ifnull(v_numReviewIds, 0), ' reviews to delete'));\n\n    drop temporary table if exists t_historyIds;\n    create temporary table t_historyIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n      select historyId from review_history where reviewId in (select reviewId from t_reviewIds);\n    select max(seq) into v_numHistoryIds from t_historyIds;\n    CALL task_output('info', concat('found ', ifnull(v_numHistoryIds, 0), ' history records to delete'));\n\n    IF v_numHistoryIds > 0 THEN\n    CALL task_output('info', concat('deleting ', v_numHistoryIds, ' history records'));\n    REPEAT\n      delete from review_history where historyId IN (\n          select historyId from t_historyIds where seq >= v_curMinId and seq < v_curMaxId\n        );\n      SET v_curMinId = v_curMinId + v_incrementValue;\n      SET v_curMaxId = v_curMaxId + v_incrementValue;\n    UNTIL ROW_COUNT() = 0 END REPEAT;\n    END IF;\n    drop temporary table if exists t_historyIds;\n\n    SET v_curMinId = 1;\n    SET v_curMaxId = v_curMinId + v_incrementValue;\n    IF v_numReviewIds > 0 THEN\n      CALL task_output('info', concat('deleting ', v_numReviewIds, ' reviews'));\n      REPEAT\n        delete from review where reviewId IN (\n            select reviewId from t_reviewIds where seq >= v_curMinId and seq < v_curMaxId\n          );\n        SET v_curMinId = v_curMinId + v_incrementValue;\n        SET v_curMaxId = v_curMaxId + v_incrementValue;\n      UNTIL ROW_COUNT() = 0 END REPEAT;\n    END IF;\n    drop temporary table if exists t_reviewIds;\n\n    SET v_curMinId = 1;\n    SET v_curMaxId = v_curMinId + v_incrementValue;\n    IF v_numAssetIds > 0 THEN\n      CALL task_output('info', concat('deleting ', v_numAssetIds, ' assets'));\n      REPEAT\n        delete from asset where assetId IN (\n            select assetId from t_assetIds where seq >= v_curMinId and seq < v_curMaxId\n          );\n        SET v_curMinId = v_curMinId + v_incrementValue;\n        SET v_curMaxId = v_curMaxId + v_incrementValue;\n    UNTIL ROW_COUNT() = 0 END REPEAT;\n    END IF;\n    drop temporary table if exists t_assetIds;\n\n    SET v_curMinId = 1;\n    SET v_curMaxId = v_curMinId + v_incrementValue;\n    IF v_numCollectionIds > 0 THEN\n      CALL task_output('info', concat('deleting ', v_numCollectionIds, ' collections'));\n      REPEAT\n        delete from collection where collectionId IN (\n            select collectionId from t_collectionIds where seq >= v_curMinId and seq < v_curMaxId\n          );\n        SET v_curMinId = v_curMinId + v_incrementValue;\n        SET v_curMaxId = v_curMaxId + v_incrementValue;\n      UNTIL ROW_COUNT() = 0 END REPEAT;\n    END IF;\n    drop temporary table if exists t_collectionIds;\n\n    CALL task_output('info', 'task finished');\n    END`,\n\n  `DROP PROCEDURE IF EXISTS delete_unmapped`,\n  // deletes unmapped reviews in batches \n  // deletes by system and asset \n  // system is reviews that dont match a rule in rev_group_rule_map \n  // asset is reviews that dont match a rule assigned to the asset via rev_group_rule_map, revision, and stig_asset_map\n  // in_context is a param that is either 'system' or 'asset'\n  //  IF in_context = 'system' insert into t_reviewIds the reviewIds to delete\n  // IF v_numReviewIds > 0 THEN -- if there are reviews to delete, delete their history first, then the reviews\n  // IF v_numHistoryIds > 0 THEN -- if there are history records to delete, delete them first\n  // REPEAT delete from review_history where historyId IN ( select ... -- delete in batches until no more rows deleted(do while loop basically)\n  `CREATE PROCEDURE delete_unmapped(IN in_context VARCHAR(255))\n    BEGIN\n      DECLARE v_numReviewIds INT;\n      DECLARE v_numHistoryIds INT;\n      DECLARE v_incrementValue INT DEFAULT 10000;\n      DECLARE v_curMinId BIGINT DEFAULT 1;\n      DECLARE v_curMaxId BIGINT DEFAULT v_incrementValue + 1;\n\n      DECLARE EXIT HANDLER FOR SQLEXCEPTION\n      BEGIN\n        DECLARE err_code INT;\n        DECLARE err_msg TEXT;\n        GET STACKED DIAGNOSTICS CONDITION 1\n          err_code = MYSQL_ERRNO, err_msg = MESSAGE_TEXT;\n        CALL task_output('error',concat('code: ', err_code, ' message: ', err_msg));\n        RESIGNAL;\n      END;\n\n      -- Runtime context is available via user variables (null if running outside a job)\n      CALL task_output('info', 'task started');\n\n      drop temporary table if exists t_reviewIds;\n      create temporary table t_reviewIds (seq INT AUTO_INCREMENT PRIMARY KEY, reviewId INT);\n      -- Context-specific logic\n      IF in_context = 'system' THEN\n        INSERT into t_reviewIds (reviewId)\n        select r.reviewId from review r\n        left join rev_group_rule_map rgr on (r.version = rgr.version and r.checkDigest = rgr.checkDigest)\n        where rgr.rgrId is null;\n      ELSEIF in_context = 'asset' THEN\n        INSERT into t_reviewIds (reviewId)\n        select\n          r.reviewId\n        from\n          review r\n          left join rev_group_rule_map rgr on (r.version = rgr.version and r.checkDigest = rgr.checkDigest)\n          left join revision on (rgr.revId = revision.revId)\n          left join stig_asset_map sa on (r.assetId = sa.assetId and revision.benchmarkId = sa.benchmarkId)\n        group by\n          r.reviewId\n        having\n          count(sa.saId) = 0;\n      END IF;\n\n      select max(seq) into v_numReviewIds from t_reviewIds;\n      CALL task_output('info', concat('found ', ifnull(v_numReviewIds, 0), ' reviews to delete'));\n\n      IF v_numReviewIds > 0 THEN\n        drop temporary table if exists t_historyIds;\n        create temporary table t_historyIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n          select historyId from review_history where reviewId in (select reviewId from t_reviewIds);\n        select max(seq) into v_numHistoryIds from t_historyIds;\n        CALL task_output('info', concat('found ', ifnull(v_numHistoryIds, 0), ' history records to delete'));\n        IF v_numHistoryIds > 0 THEN\n          CALL task_output('info', concat('deleting ', v_numHistoryIds, ' history records'));\n          SET v_curMinId = 1;\n          SET v_curMaxId = v_curMinId + v_incrementValue;\n          REPEAT\n            delete from review_history where historyId IN (\n                select historyId from t_historyIds where seq >= v_curMinId and seq < v_curMaxId\n              );\n            SET v_curMinId = v_curMinId + v_incrementValue;\n            SET v_curMaxId = v_curMaxId + v_incrementValue;\n          UNTIL ROW_COUNT() = 0 END REPEAT;\n        END IF;\n        CALL task_output('info', concat('deleting ', v_numReviewIds, ' reviews'));\n        SET v_curMinId = 1;\n        SET v_curMaxId = v_curMinId + v_incrementValue;\n        REPEAT\n          delete from review where reviewId IN (\n              select reviewId from t_reviewIds where seq >= v_curMinId and seq < v_curMaxId\n            );\n          SET v_curMinId = v_curMinId + v_incrementValue;\n          SET v_curMaxId = v_curMaxId + v_incrementValue;\n        UNTIL ROW_COUNT() = 0 END REPEAT;\n      END IF;\n      CALL task_output('info', 'task finished');\n    END;`,\n\n  `DROP PROCEDURE IF EXISTS analyze_tables`,\n  // analyzes tables for performance\n  // in_tables is a json array of table names to analyze\n  `CREATE PROCEDURE analyze_tables (IN in_tables JSON)\n    BEGIN\n          DECLARE v_itemCount INT;\n          DECLARE v_currentCount INT;\n          DECLARE v_table VARCHAR(255);\n\n          DECLARE EXIT HANDLER FOR SQLEXCEPTION\n          BEGIN\n            DECLARE err_code INT;\n            DECLARE err_msg TEXT;\n            GET STACKED DIAGNOSTICS CONDITION 1\n              err_code = MYSQL_ERRNO, err_msg = MESSAGE_TEXT;\n              IF err_msg = NULL THEN \n          SET err_msg = '';\n              END IF;\n            CALL task_output('error',concat('code: ', err_code, ' message: ', err_msg));\n            RESIGNAL;\n          END;\n          \n          -- Runtime context is available via user variables (null if running outside a job)\n        CALL task_output('info', 'task started');\n\n        select JSON_LENGTH(in_tables) INTO v_itemCount;\n        SET v_currentCount = 0;\n        WHILE v_currentCount < v_itemCount DO\n          SET v_table = json_unquote(json_extract(in_tables, concat('$[', v_currentCount, ']')));\n          CALL task_output('info', concat('analyze table: ', v_table));\n          SET @sql = CONCAT('ANALYZE TABLE ', v_table);\n          PREPARE stmt_analyze_tables FROM @sql;\n          EXECUTE stmt_analyze_tables;\n          DEALLOCATE PREPARE stmt_analyze_tables;\n          SET v_currentCount = v_currentCount + 1;\n        END WHILE;\n        CALL task_output('info', 'task finished');\n\n    END`,\n\n  `DROP EVENT IF EXISTS \\`job-1-stigman\\``,\n  // default event schedule for job 1 created at migration time\n  `CREATE EVENT IF NOT EXISTS \\`job-1-stigman\\`\n    ON SCHEDULE EVERY 1 DAY\n    STARTS '2025-10-01 05:00:00'\n    DISABLE\n    DO\n      CALL run_job(1, NULL)`,\n]\n\nconst downMigration = [\n  `DROP TABLE IF EXISTS job_task_map`,\n  `DROP TABLE IF EXISTS task_output`,\n  `DROP TABLE IF EXISTS task`,\n  `DROP TABLE IF EXISTS job_run`,\n  `DROP TABLE IF EXISTS job`,\n  `DROP procedure IF EXISTS run_job`,\n  `DROP procedure IF EXISTS task_output`,\n  `DROP PROCEDURE IF EXISTS delete_disabled`,\n  `DROP PROCEDURE IF EXISTS delete_unmapped`,\n  `DROP PROCEDURE IF EXISTS analyze_tables`,\n  `DROP EVENT IF EXISTS \\`job-1-stigman\\``,\n]\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/0046.js",
    "content": "const MigrationHandler = require('./lib/MigrationHandler')\n\nconst upMigration = [\n  `DROP PROCEDURE IF EXISTS get_runtime`,\n\n  `DROP procedure IF EXISTS run_job`,\n  `CREATE PROCEDURE run_job(\n    IN in_jobId INT,\n    IN in_runIdStr VARCHAR(36)\n  )\n    main:BEGIN\n        DECLARE v_done INT DEFAULT FALSE;\n        DECLARE v_jrId INT;\n        DECLARE v_numTasks INT;\n        DECLARE v_currentTaskId INT;\n        DECLARE v_currentTaskName VARCHAR(255);\n        DECLARE v_currentCommand VARCHAR(255);\n        DECLARE v_currentTaskNum INT DEFAULT 0;\n        DECLARE v_param_string TEXT;\n        DECLARE cur CURSOR FOR\n          SELECT\n            jt.taskId,\n            t.name,\n            t.command\n          FROM\n            job_task_map jt\n            inner join task t on (jt.taskId = t.taskId)\n          WHERE\n            jobId = in_jobId\n          ORDER BY jtId ASC;\n        DECLARE CONTINUE HANDLER FOR NOT FOUND SET v_done = TRUE;\n        DECLARE EXIT HANDLER FOR SQLEXCEPTION\n        BEGIN\n          DECLARE err_code INT;\n          DECLARE err_msg TEXT;\n          GET STACKED DIAGNOSTICS CONDITION 1 err_code = MYSQL_ERRNO, err_msg = MESSAGE_TEXT;\n          CALL task_output('error', concat('code: ', err_code, ' message: ', err_msg));\n          UPDATE job_run SET state = 'failed' WHERE runId = @runId;\n        END;\n\n        -- setup runtime context (null if running outside a job)\n        IF in_runIdStr IS NOT NULL AND in_runIdStr REGEXP '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$' THEN\n          SET @runId = UUID_TO_BIN(in_runIdStr, 1);\n        ELSE\n          SET @runId = UUID_TO_BIN(UUID(), 1);\n        END IF;\n        SET @taskId = NULL;\n        INSERT INTO job_run(jobId, runId, state) VALUES (in_jobId, @runId, 'running');\n        CALL task_output('info', concat('run started for jobId ', in_jobId));\n\n        -- Get the number of tasks for the job\n        SELECT COUNT(*) INTO v_numTasks FROM job_task_map WHERE jobId = in_jobId;\n\n        IF v_numTasks = 0 THEN\n          CALL task_output('error', 'no tasks to run');\n          UPDATE job_run SET state = 'failed' WHERE runId = @runId AND state = 'running';\n          LEAVE main; -- No tasks to run, exit the procedure\n        END IF;\n\n\n        OPEN cur;\n        read_loop: LOOP\n          FETCH cur INTO v_currentTaskId, v_currentTaskName, v_currentCommand;\n          IF v_done THEN\n            LEAVE read_loop;\n          END IF;\n          SET v_currentTaskNum = v_currentTaskNum + 1;\n\n          SET @sql = CONCAT('CALL ', v_currentCommand);\n          PREPARE stmt_run_job FROM @sql;\n          CALL task_output('info', concat('Beginning task ', v_currentTaskName, ' (', v_currentTaskNum, '/', v_numTasks, ')'));\n          SET @taskId = v_currentTaskId;\n          EXECUTE stmt_run_job;\n          DEALLOCATE PREPARE stmt_run_job;\n          SET @taskId = NULL;\n          CALL task_output('info', concat('Ended task ', v_currentTaskName, ' (', v_currentTaskNum, '/', v_numTasks, ')'));\n        END LOOP;\n        CLOSE cur;\n\n        -- === Post-task-loop logic ===\n        UPDATE job_run SET state = 'completed' WHERE runId = @runId AND state = 'running';\n        CALL task_output('info', concat('run completed for jobId ', in_jobId));\n\n    END`,\n\n  `DROP procedure IF EXISTS task_output`,\n  `CREATE PROCEDURE task_output(\n    IN in_type VARCHAR(45),\n    IN in_message VARCHAR(255)\n  )\n    BEGIN\n      IF in_message IS NULL THEN SET in_message = ''; END IF;\n      insert into task_output (runId, taskId, type, message) values (@runId, @taskId, in_type, in_message);\n    END`,\n\n  `DROP PROCEDURE IF EXISTS delete_disabled`,\n  `CREATE PROCEDURE delete_disabled()\n    BEGIN\n    DECLARE v_incrementValue INT DEFAULT 10000;\n    DECLARE v_curMinId BIGINT DEFAULT 1;\n    DECLARE v_curMaxId BIGINT DEFAULT v_incrementValue + 1;\n    DECLARE v_numCollectionIds INT;\n    DECLARE v_numAssetIds INT;\n    DECLARE v_numReviewIds INT;\n    DECLARE v_numHistoryIds INT;\n    DECLARE EXIT HANDLER FOR SQLEXCEPTION\n    BEGIN\n      DECLARE err_code INT;\n      DECLARE err_msg TEXT;\n      GET STACKED DIAGNOSTICS CONDITION 1 err_code = MYSQL_ERRNO, err_msg = MESSAGE_TEXT;\n      CALL task_output('error', concat('code: ', err_code, ' message: ', err_msg));\n      RESIGNAL;\n    END;\n\n    -- Runtime context is available via user variables (null if running outside a job)\n    CALL task_output('info','task started');\n\n    drop temporary table if exists t_collectionIds;\n    create temporary table t_collectionIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n      select collectionId from collection where isEnabled is null;\n    select max(seq) into v_numCollectionIds from t_collectionIds;\n    CALL task_output('info', concat('found ', ifnull(v_numCollectionIds, 0), ' collections to delete'));\n\n    drop temporary table if exists t_assetIds;\n    create temporary table t_assetIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n      select assetId from asset where isEnabled is null or collectionId in (select collectionId from t_collectionIds);\n    select max(seq) into v_numAssetIds from t_assetIds;\n    CALL task_output('info', concat('found ', ifnull(v_numAssetIds, 0), ' assets to delete'));\n\n    drop temporary table if exists t_reviewIds;\n    create temporary table t_reviewIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n      select reviewId from review where assetId in (select assetId from t_assetIds);\n    select max(seq) into v_numReviewIds from t_reviewIds;\n    CALL task_output('info', concat('found ', ifnull(v_numReviewIds, 0), ' reviews to delete'));\n\n    drop temporary table if exists t_historyIds;\n    create temporary table t_historyIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n      select historyId from review_history where reviewId in (select reviewId from t_reviewIds);\n    select max(seq) into v_numHistoryIds from t_historyIds;\n    CALL task_output('info', concat('found ', ifnull(v_numHistoryIds, 0), ' history records to delete'));\n\n    IF v_numHistoryIds > 0 THEN\n    CALL task_output('info', concat('deleting ', v_numHistoryIds, ' history records'));\n    REPEAT\n      delete from review_history where historyId IN (\n          select historyId from t_historyIds where seq >= v_curMinId and seq < v_curMaxId\n        );\n      SET v_curMinId = v_curMinId + v_incrementValue;\n      SET v_curMaxId = v_curMaxId + v_incrementValue;\n    UNTIL ROW_COUNT() = 0 END REPEAT;\n    END IF;\n    drop temporary table if exists t_historyIds;\n\n    SET v_curMinId = 1;\n    SET v_curMaxId = v_curMinId + v_incrementValue;\n    IF v_numReviewIds > 0 THEN\n      CALL task_output('info', concat('deleting ', v_numReviewIds, ' reviews'));\n      REPEAT\n        delete from review where reviewId IN (\n            select reviewId from t_reviewIds where seq >= v_curMinId and seq < v_curMaxId\n          );\n        SET v_curMinId = v_curMinId + v_incrementValue;\n        SET v_curMaxId = v_curMaxId + v_incrementValue;\n      UNTIL ROW_COUNT() = 0 END REPEAT;\n    END IF;\n    drop temporary table if exists t_reviewIds;\n\n    SET v_curMinId = 1;\n    SET v_curMaxId = v_curMinId + v_incrementValue;\n    IF v_numAssetIds > 0 THEN\n      CALL task_output('info', concat('deleting ', v_numAssetIds, ' assets'));\n      REPEAT\n        delete from asset where assetId IN (\n            select assetId from t_assetIds where seq >= v_curMinId and seq < v_curMaxId\n          );\n        SET v_curMinId = v_curMinId + v_incrementValue;\n        SET v_curMaxId = v_curMaxId + v_incrementValue;\n    UNTIL ROW_COUNT() = 0 END REPEAT;\n    END IF;\n    drop temporary table if exists t_assetIds;\n\n    SET v_curMinId = 1;\n    SET v_curMaxId = v_curMinId + v_incrementValue;\n    IF v_numCollectionIds > 0 THEN\n      CALL task_output('info', concat('deleting ', v_numCollectionIds, ' collections'));\n      REPEAT\n        delete from collection where collectionId IN (\n            select collectionId from t_collectionIds where seq >= v_curMinId and seq < v_curMaxId\n          );\n        SET v_curMinId = v_curMinId + v_incrementValue;\n        SET v_curMaxId = v_curMaxId + v_incrementValue;\n      UNTIL ROW_COUNT() = 0 END REPEAT;\n    END IF;\n    drop temporary table if exists t_collectionIds;\n\n    CALL task_output('info', 'task finished');\n    END`,\n\n  `DROP PROCEDURE IF EXISTS delete_unmapped`,\n  `CREATE PROCEDURE delete_unmapped(IN in_context VARCHAR(255))\n    BEGIN\n      DECLARE v_numReviewIds INT;\n      DECLARE v_numHistoryIds INT;\n      DECLARE v_incrementValue INT DEFAULT 10000;\n      DECLARE v_curMinId BIGINT DEFAULT 1;\n      DECLARE v_curMaxId BIGINT DEFAULT v_incrementValue + 1;\n\n      DECLARE EXIT HANDLER FOR SQLEXCEPTION\n      BEGIN\n        DECLARE err_code INT;\n        DECLARE err_msg TEXT;\n        GET STACKED DIAGNOSTICS CONDITION 1\n          err_code = MYSQL_ERRNO, err_msg = MESSAGE_TEXT;\n        CALL task_output('error',concat('code: ', err_code, ' message: ', err_msg));\n        RESIGNAL;\n      END;\n\n      -- Runtime context is available via user variables (null if running outside a job)\n      CALL task_output('info', 'task started');\n\n      drop temporary table if exists t_reviewIds;\n      create temporary table t_reviewIds (seq INT AUTO_INCREMENT PRIMARY KEY, reviewId INT);\n      -- Context-specific logic\n      IF in_context = 'system' THEN\n        INSERT into t_reviewIds (reviewId)\n        select r.reviewId from review r\n        left join rev_group_rule_map rgr on (r.version = rgr.version and r.checkDigest = rgr.checkDigest)\n        where rgr.rgrId is null;\n      ELSEIF in_context = 'asset' THEN\n        INSERT into t_reviewIds (reviewId)\n        select\n          r.reviewId\n        from\n          review r\n          left join rev_group_rule_map rgr on (r.version = rgr.version and r.checkDigest = rgr.checkDigest)\n          left join revision on (rgr.revId = revision.revId)\n          left join stig_asset_map sa on (r.assetId = sa.assetId and revision.benchmarkId = sa.benchmarkId)\n        group by\n          r.reviewId\n        having\n          count(sa.saId) = 0;\n      END IF;\n\n      select max(seq) into v_numReviewIds from t_reviewIds;\n      CALL task_output('info', concat('found ', ifnull(v_numReviewIds, 0), ' reviews to delete'));\n\n      IF v_numReviewIds > 0 THEN\n        drop temporary table if exists t_historyIds;\n        create temporary table t_historyIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n          select historyId from review_history where reviewId in (select reviewId from t_reviewIds);\n        select max(seq) into v_numHistoryIds from t_historyIds;\n        CALL task_output('info', concat('found ', ifnull(v_numHistoryIds, 0), ' history records to delete'));\n        IF v_numHistoryIds > 0 THEN\n          CALL task_output('info', concat('deleting ', v_numHistoryIds, ' history records'));\n          SET v_curMinId = 1;\n          SET v_curMaxId = v_curMinId + v_incrementValue;\n          REPEAT\n            delete from review_history where historyId IN (\n                select historyId from t_historyIds where seq >= v_curMinId and seq < v_curMaxId\n              );\n            SET v_curMinId = v_curMinId + v_incrementValue;\n            SET v_curMaxId = v_curMaxId + v_incrementValue;\n          UNTIL ROW_COUNT() = 0 END REPEAT;\n        END IF;\n        CALL task_output('info', concat('deleting ', v_numReviewIds, ' reviews'));\n        SET v_curMinId = 1;\n        SET v_curMaxId = v_curMinId + v_incrementValue;\n        REPEAT\n          delete from review where reviewId IN (\n              select reviewId from t_reviewIds where seq >= v_curMinId and seq < v_curMaxId\n            );\n          SET v_curMinId = v_curMinId + v_incrementValue;\n          SET v_curMaxId = v_curMaxId + v_incrementValue;\n        UNTIL ROW_COUNT() = 0 END REPEAT;\n      END IF;\n      CALL task_output('info', 'task finished');\n    END;`,\n\n  `DROP PROCEDURE IF EXISTS analyze_tables`,\n  `CREATE PROCEDURE analyze_tables (IN in_tables JSON)\n    BEGIN\n          DECLARE v_itemCount INT;\n          DECLARE v_currentCount INT;\n          DECLARE v_table VARCHAR(255);\n\n          DECLARE EXIT HANDLER FOR SQLEXCEPTION\n          BEGIN\n            DECLARE err_code INT;\n            DECLARE err_msg TEXT;\n            GET STACKED DIAGNOSTICS CONDITION 1\n              err_code = MYSQL_ERRNO, err_msg = MESSAGE_TEXT;\n              IF err_msg = NULL THEN\n          SET err_msg = '';\n              END IF;\n            CALL task_output('error',concat('code: ', err_code, ' message: ', err_msg));\n            RESIGNAL;\n          END;\n\n          -- Runtime context is available via user variables (null if running outside a job)\n        CALL task_output('info', 'task started');\n\n        select JSON_LENGTH(in_tables) INTO v_itemCount;\n        SET v_currentCount = 0;\n        WHILE v_currentCount < v_itemCount DO\n          SET v_table = json_unquote(json_extract(in_tables, concat('$[', v_currentCount, ']')));\n          CALL task_output('info', concat('analyze table: ', v_table));\n          SET @sql = CONCAT('ANALYZE TABLE ', v_table);\n          PREPARE stmt_analyze_tables FROM @sql;\n          EXECUTE stmt_analyze_tables;\n          DEALLOCATE PREPARE stmt_analyze_tables;\n          SET v_currentCount = v_currentCount + 1;\n        END WHILE;\n        CALL task_output('info', 'task finished');\n\n    END`,\n]\n\nconst downMigration = []\n\nconst migrationHandler = new MigrationHandler(upMigration, downMigration)\nmodule.exports = {\n  up: async (pool) => {\n    await migrationHandler.up(pool, __filename)\n  },\n  down: async (pool) => {\n    await migrationHandler.down(pool, __filename)\n  }\n}\n"
  },
  {
    "path": "api/source/service/migrations/lib/MigrationHandler.js",
    "content": "\"use strict\";\n\nconst path = require('path')\nconst logger = require('../../../utils/logger')\n\nmodule.exports = class MigrationHandler {\n    constructor(upCommands = [], downCommands = []) {\n        this._upCommands = upCommands;\n        this._downCommands = downCommands;\n    }\n\n    async up(pool, filename) {\n        let connection\n        let migrationName = path.basename(filename, '.js')\n        try {\n          logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'up', name: migrationName })\n          connection = await pool.getConnection()\n          for (const statement of this._upCommands) {\n            logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, statement })\n            await connection.query(statement)\n          }\n        }\n        catch (e) {\n          logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message })\n          throw (e)\n        }\n        finally {\n          await connection.release()\n          logger.writeInfo('mysql', 'migration', {status: 'finish', name: migrationName })\n        }\n    }\n      \n    async down(pool, filename) {\n        let connection\n        let migrationName = path.basename(filename, '.js')\n        try {\n          logger.writeInfo('mysql', 'migration', {status: 'start', direction: 'down', name: migrationName })\n          connection = await pool.getConnection()\n          for (const statement of this._downCommands) {\n            logger.writeInfo('mysql', 'migration', {status: 'running', name: migrationName, statement })\n            await connection.query(statement)\n          }\n          await connection.release()\n        }\n        catch (e) {\n          logger.writeError('mysql', 'migration', {status: 'error', name: migrationName, message: e.message })\n          throw (e)\n        }\n        finally {\n          await connection.release()\n          logger.writeInfo('mysql', 'migration', {status: 'finish', name: migrationName })\n        }\n    }\n}\n"
  },
  {
    "path": "api/source/service/migrations/lib/mysql-import.js",
    "content": "/**\n * mysql-import - v4.0.24\n * Import .sql into a MySQL database with Node.\n * @author Rob Parham\n * @website https://github.com/pamblam/mysql-import#readme\n * @license MIT\n * \n * Modified to support mysql2 PromisePool\n * https://github.com/NUWCDIVNPT/stig-manager/api/source/service/migrations/lib/mysql-import.js\n **/\n\n'use strict';\n\nconst mysql = require('mysql2');\nconst fs = require('fs');\nconst path = require(\"path\");\n\n\n/**\n * mysql-import - Importer class\n * @version 4.0.24\n * https://github.com/Pamblam/mysql-import\n */\n\nclass Importer{\n\t\n\t/**\n\t * new Importer(pool)\n\t * @param pool - mysql2/promise pool\n\t */\n\tconstructor(pool){\n\t\tthis._connection_settings = pool;\n\t\tthis._pool = pool;\n\t\tthis._conn = null;\n\t\tthis._encoding = 'utf8';\n\t\tthis._imported = [];\n\t}\n\t\n\t/**\n\t * Get an array of the imported files\n\t * @returns {Array}\n\t */\n\tgetImported(){\n\t\treturn this._imported.slice(0);\n\t}\n\t\n\t/**\n\t * Set the encoding to be used for reading the dump files.\n\t * @param string - encoding type to be used.\n\t * @throws {Error} - if unsupported encoding type. \n\t * @returns {undefined}\n\t */\n\tsetEncoding(encoding){\n\t\tvar supported_encodings = [\n\t\t\t'utf8',\n\t\t\t'ucs2',\n\t\t\t'utf16le',\n\t\t\t'latin1',\n\t\t\t'ascii',\n\t\t\t'base64',\n\t\t\t'hex'\n\t\t];\n\t\tif(!supported_encodings.includes(encoding)){\n\t\t\tthrow new Error(\"Unsupported encoding: \"+encoding);\n\t\t}\n\t\tthis._encoding = encoding;\n\t}\n\t\n\t/**\n\t * Set or change the database to be used\n\t * @param string - database name\n\t * @returns {Promise}\n\t */\n\tuse(database){\n\t\treturn new Promise((resolve, reject)=>{\n\t\t\tif(!this._conn){\n\t\t\t\tthis._connection_settings.database = database;\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tthis._conn.changeUser({database}, err=>{\n\t\t\t\tif (err){\n\t\t\t\t\treject(err);\t\n\t\t\t\t}else{\n\t\t\t\t\tresolve();\n\t\t\t\t}\n\t\t\t});\n\t\t});\n\t}\n\t\n\t/**\n\t * Import (an) .sql file(s).\n\t * @param string|array input - files or paths to scan for .sql files\n\t * @returns {Promise}\n\t */\n\timport(...input){\n\t\treturn new Promise(async (resolve, reject)=>{\n\t\t\ttry{\n\t\t\t\tawait this._connect();\n\t\t\t\tvar files = await this._getSQLFilePaths(...input);\n\t\t\t\tvar error = null;\n\t\t\t\tawait slowLoop(files, (file, index, next)=>{\n\t\t\t\t\tif(error){\n\t\t\t\t\t\tnext();\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\tthis._importSingleFile(file).then(()=>{\n\t\t\t\t\t\tnext();\n\t\t\t\t\t}).catch(err=>{\n\t\t\t\t\t\terror = err;\n\t\t\t\t\t\tnext();\n\t\t\t\t\t});\n\t\t\t\t});\n\t\t\t\tif(error) throw error;\n\t\t\t\tawait this.disconnect();\n\t\t\t\tresolve();\n\t\t\t}catch(err){\n\t\t\t\treject(err);\n\t\t\t}\n\t\t});\n\t};\n\t\n\t/**\n\t * Disconnect mysql. This is done automatically, so shouldn't need to be manually called.\n\t * @param bool graceful - force close?\n\t * @returns {Promise}\n\t */\n\tasync disconnect(){\n\t\ttry {\n\t\t\tif (!this._conn) {\n\t\t\t\treturn\n\t\t\t}\n\t\t\tawait this._conn.release()\n\t\t\tthis._conn = null\n\t\t}\n\t\tcatch (e) {\n\t\t\tthrow (e)\n\t\t}\n\t}\n\t\n\t////////////////////////////////////////////////////////////////////////////\n\t// Private methods /////////////////////////////////////////////////////////\n\t////////////////////////////////////////////////////////////////////////////\n\t\n\t/**\n\t * Import a single .sql file into the database\n\t * @param {type} filepath\n\t * @returns {Promise}\n\t */\n\t_importSingleFile(filepath){\n\t\treturn new Promise((resolve, reject)=>{\n\t\t\tfs.readFile(filepath, this._encoding, (err, queriesString) => {\n\t\t\t\tif(err){\n\t\t\t\t\treject(err);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tvar queries = new queryParser(queriesString).queries;\n\t\t\t\tvar error = null;\n\t\t\t\tslowLoop(queries, (query, index, next)=>{\n\t\t\t\t\tif(error){\n\t\t\t\t\t\tnext();\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\tthis._conn.query(query)\n\t\t\t\t\t\t.catch(err => { error = err })\n\t\t\t\t\t\t.then(() => { next() })\t\n\t\t\t\t}).then(()=>{\n\t\t\t\t\tif(error){\n\t\t\t\t\t\treject(error);\n\t\t\t\t\t}else{\n\t\t\t\t\t\tthis._imported.push(filepath);\n\t\t\t\t\t\tresolve();\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t\t\n\t\t\t});\n\t\t});\n\t}\n\t\n\t/**\n\t * Connect to the mysql server\n\t * @returns {Promise}\n\t */\n\tasync _connect(){\n\t\ttry {\n\t\t\tif (this._conn) {\n\t\t\t\treturn (this._conn)\n\t\t\t}\n\t\t\tthis._conn = await this._pool.getConnection()\n\t\t}\n\t\tcatch (e) {\n\t\t\tthrow (e)\n\t\t}\n\t}\n\t\n\t/**\n\t * Check if a file exists\n\t * @param string filepath\n\t * @returns {Promise}\n\t */\n\t_fileExists(filepath){\n\t\treturn new Promise((resolve, reject)=>{\n\t\t\tfs.access(filepath, fs.constants.F_OK, err=>{\n\t\t\t\tif(err){\n\t\t\t\t\treject(err);\n\t\t\t\t}else{\n\t\t\t\t\tresolve();\n\t\t\t\t}\n\t\t\t});\n\t\t});\n\t}\n\n\t/**\n\t * Get filetype information\n\t * @param string filepath\n\t * @returns {Promise}\n\t */\n\t_statFile(filepath){\n\t\treturn new Promise((resolve, reject)=>{\n\t\t\tfs.lstat(filepath, (err, stat)=>{\n\t\t\t\tif(err){\n\t\t\t\t\treject(err);\n\t\t\t\t}else{\n\t\t\t\t\tresolve(stat);\n\t\t\t\t}\n\t\t\t});\n\t\t});\n\t}\n\t\n\t/**\n\t * Read contents of a directory\n\t * @param string filepath\n\t * @returns {Promise}\n\t */\n\t_readDir(filepath){\n\t\treturn new Promise((resolve, reject)=>{\n\t\t\tfs.readdir(filepath, (err, files)=>{\n\t\t\t\tif(err){\n\t\t\t\t\treject(err);\n\t\t\t\t}else{\n\t\t\t\t\tresolve(files);\n\t\t\t\t}\n\t\t\t});\n\t\t});\n\t}\n\n\t/**\n\t * Parses the input argument(s) for Importer.import into an array sql files.\n\t * @param strings|array paths\n\t * @returns {Promise}\n\t */\n\t_getSQLFilePaths(...paths){\n\t\treturn new Promise(async (resolve, reject)=>{\n\t\t\tvar full_paths = [];\n\t\t\tvar error = null;\n\t\t\tpaths = [].concat.apply([], paths); // flatten array of paths\n\t\t\tawait slowLoop(paths, async (filepath, index, next)=>{\n\t\t\t\tif(error){\n\t\t\t\t\tnext();\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\ttry{\n\t\t\t\t\tawait this._fileExists(filepath);\n\t\t\t\t\tvar stat = await this._statFile(filepath);\n\t\t\t\t\tif(stat.isFile()){\n\t\t\t\t\t\tif(filepath.toLowerCase().substring(filepath.length-4) === '.sql'){\n\t\t\t\t\t\t\tfull_paths.push(path.resolve(filepath));\n\t\t\t\t\t\t}\n\t\t\t\t\t\tnext();\n\t\t\t\t\t}else if(stat.isDirectory()){\n\t\t\t\t\t\tvar more_paths = await this._readDir(filepath);\n\t\t\t\t\t\tmore_paths = more_paths.map(p=>path.join(filepath, p));\n\t\t\t\t\t\tvar sql_files = await this._getSQLFilePaths(...more_paths);\n\t\t\t\t\t\tfull_paths.push(...sql_files);\n\t\t\t\t\t\tnext();\n\t\t\t\t\t}else{\n\t\t\t\t\t\tnext();\n\t\t\t\t\t}\n\t\t\t\t}catch(err){\n\t\t\t\t\terror = err;\n\t\t\t\t\tnext();\n\t\t\t\t}\n\t\t\t});\n\t\t\tif(error){\n\t\t\t\treject(error);\n\t\t\t}else{\n\t\t\t\tresolve(full_paths);\n\t\t\t}\n\t\t});\n\t}\n\t\n}\n\n/**\n * Build version number\n */\nImporter.version = '4.0.24';\n\nmodule.exports = Importer;\n\n/**\n * Execute the loopBody function once for each item in the items array, \n * waiting for the done function (which is passed into the loopBody function)\n * to be called before proceeding to the next item in the array.\n * @param {Array} items - The array of items to iterate through\n * @param {Function} loopBody - A function to execute on each item in the array.\n *\t\tThis function is passed 3 arguments - \n *\t\t\t1. The item in the current iteration,\n *\t\t\t2. The index of the item in the array,\n *\t\t\t3. A function to be called when the iteration may continue.\n * @returns {Promise} - A promise that is resolved when all the items in the \n *\t\tin the array have been iterated through.\n */\nfunction slowLoop(items, loopBody) {\n\treturn new Promise(f => {\n\t\tif(!items.length) return f();\n\t\tlet done = arguments[2] || f;\n\t\tlet idx = arguments[3] || 0;\n\t\tlet cb = items[idx + 1] ? () => slowLoop(items, loopBody, done, idx + 1) : done;\n\t\tloopBody(items[idx], idx, cb);\n\t});\n}\n\n\nclass queryParser{\n\t\n\tconstructor(queriesString){\n\t\t\n\t\t// Input string containing SQL queries\n\t\tthis.queriesString = queriesString.trim();\n\t\t\n\t\t// The quote type (' or \") if the parser \n\t\t// is currently inside of a quote, else false\n\t\tthis.quoteType = false;\n\t\t\n\t\t// An array of complete queries\n\t\tthis.queries = [];\n\t\t\n\t\t// An array of chars representing the substring\n\t\t// the is currently being parsed\n\t\tthis.buffer = [];\n\t\t\n\t\t// Is the current char escaped\n\t\tthis.escaped = false;\n\t\t\n\t\t// The string that denotes the end of a query\n\t\tthis.delimiter = ';';\n\t\t\n\t\t// Are we currently seeking new delimiter\n\t\tthis.seekingDelimiter = false;\n\n\t\t// Does the sql set change delimiter?\n\t\tthis.hasDelimiter = queriesString.toLowerCase().includes('delimiter ');\n\n\t\t// Iterate over each char in the string\n\t\tfor (let i = 0; i < this.queriesString.length; i++) {\n\t\t\tlet char = this.queriesString[i];\n\t\t\tthis.parseChar(char);\n\t\t}\n\t}\n\t\n\t// Parse the next char in the string\n\tparseChar(char){\n\t\tthis.checkEscapeChar();\n\t\tthis.buffer.push(char);\n\n\t\tif (this.hasDelimiter) {\n\t\t\tthis.checkNewDelimiter(char);\n\t\t}\n\n\t\tthis.checkQuote(char);\n\t\tthis.checkEndOfQuery();\n\t}\n\t\n\t// Check if the current char has been escaped\n\t// and update this.escaped\n\tcheckEscapeChar(){\n\t\tif(!this.buffer.length) return;\n\t\tif(this.buffer[this.buffer.length - 1] === \"\\\\\"){\n\t\t\tthis.escaped = !this.escaped;\n\t\t}else{\n\t\t\tthis.escaped = false;\n\t\t}\n\t}\n\t\n\t// Check to see if a new delimiter is being assigned\n\tcheckNewDelimiter(char){\n\t\tvar buffer_str = this.buffer.join('').toLowerCase().trim();\n\t\tif(buffer_str === 'delimiter' && !this.quoteType){\n\t\t\tthis.seekingDelimiter = true;\n\t\t\tthis.buffer = [];\n\t\t}else{\n\t\t\tvar isNewLine = char === \"\\n\" || char === \"\\r\";\n\t\t\tif(isNewLine && this.seekingDelimiter){\n\t\t\t\tthis.seekingDelimiter = false;\n\t\t\t\tthis.delimiter = this.buffer.join('').trim();\n\t\t\t\tthis.buffer = [];\n\t\t\t}\n\t\t}\n\t}\n\t\n\t// Check if the current char is a quote\n\tcheckQuote(char){\n\t\tvar isQuote = (char === '\"' || char === \"'\") && !this.escaped;\n\t\tif (isQuote && this.quoteType === char){\n\t\t\tthis.quoteType = false;\n\t\t}else if(isQuote && !this.quoteType){\n\t\t\tthis.quoteType = char;\n\t\t}\n\t}\n\t\n\t// Check if we're at the end of the query\n\tcheckEndOfQuery(){\n\t\tvar demiliterFound = false;\n\t\tif(!this.quoteType && this.buffer.length >= this.delimiter.length){\n\t\t\tdemiliterFound = this.buffer.slice(-this.delimiter.length).join('') === this.delimiter;\n\t\t}\n\n\t\tif (demiliterFound) {\n\t\t\t// trim the delimiter off the end\n\t\t\tthis.buffer.splice(-this.delimiter.length, this.delimiter.length);\n\t\t\tthis.queries.push(this.buffer.join('').trim());\n\t\t\tthis.buffer = [];\n\t\t}\n\t}\n}\n"
  },
  {
    "path": "api/source/service/migrations/lib/umzug-mysql-storage.js",
    "content": "module.exports = class MyStorage {\n  constructor(options) {\n    this.pool = options.pool\n    this.hasMigrationTable = false\n  }\n\n  async createMigrationTable () {\n    await  this.pool.query(`CREATE TABLE IF NOT EXISTS _migrations (\n      createdAt DATETIME DEFAULT CURRENT_TIMESTAMP, \n      updatedAt DATETIME ON UPDATE CURRENT_TIMESTAMP, \n      name VARCHAR(128) \n    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci`)\n    this.hasMigrationTable = true\n  }\n\n  async logMigration(migrationName) {\n    // This function logs a migration as executed.\n    // It will get called once a migration was\n    // executed successfully.\n    if (!this.hasMigrationTable) {\n      await this.createMigrationTable()\n    }\n    await this.pool.query('INSERT into _migrations (name) VALUES (?)', [migrationName])\n  }\n\n  async unlogMigration(migrationName) {\n    // This function removes a previously logged migration.\n    // It will get called once a migration has been reverted.\n    if (!this.hasMigrationTable) {\n      await this.createMigrationTable()\n    }\n    await this.pool.query('DELETE from _migrations WHERE name = ?', [migrationName])\n  }\n\n  async executed() {\n    // This function lists the names of the logged\n    // migrations. It will be used to calculate\n    // pending migrations. The result has to be an\n    // array with the names of the migration files.\n    if (!this.hasMigrationTable) {\n      await this.createMigrationTable()\n    }\n    let [rows] = await this.pool.query('SELECT name from _migrations')\n    return rows.map(r => r.name)\n  }\n}"
  },
  {
    "path": "api/source/service/migrations/sql/0000/up/10-stigman-schema.sql",
    "content": "-- MySQL dump 10.13-csmig  Distrib 8.0.18-csmig, for Linux (x86_64)\n--\n/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;\n/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;\n/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;\n/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;\n\n--\n-- Table structure for table `action`\n--\n\nDROP TABLE IF EXISTS `action`;\nCREATE TABLE `action` (\n  `actionId` int(11) NOT NULL AUTO_INCREMENT,\n  `api` varchar(16) NOT NULL,\n  `en` varchar(64) NOT NULL,\n  PRIMARY KEY (`actionId`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `asset`\n--\n\nDROP TABLE IF EXISTS `asset`;\nCREATE TABLE `asset` (\n  `assetId` int NOT NULL AUTO_INCREMENT,\n  `name` varchar(45) NOT NULL,\n  `collectionId` int NOT NULL,\n  `ip` varchar(45) DEFAULT NULL, \n  `description` varchar(255) DEFAULT NULL,\n  `noncomputing` bit(1) NOT NULL DEFAULT b'0',\n  `metadata` json NOT NULL,\n  PRIMARY KEY (`assetId`),\n  UNIQUE KEY `INDEX_NAMECOLLECTION` (`name`, `collectionId`),\n  KEY `INDEX_COMPUTING` (`noncomputing`),\n  KEY `INDEX_COLLECTIONID` (`collectionId`),\n  CONSTRAINT `FK_ASSET_2` FOREIGN KEY (`collectionId`) REFERENCES `collection` (`collectionId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `cci`\n--\n\nDROP TABLE IF EXISTS `cci`;\nCREATE TABLE `cci` (\n  `cci` varchar(20) NOT NULL,\n  `status` varchar(20) NOT NULL,\n  `publishdate` date NOT NULL,\n  `contributor` varchar(255) NOT NULL,\n  `type` varchar(20) NOT NULL,\n  `definition` text NOT NULL,\n  `apAcronym` varchar(20) DEFAULT NULL,\n  `implementation` text,\n  `assessmentProcedure` text,\n  PRIMARY KEY (`cci`),\n  KEY `ap` (`apAcronym`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `cci_reference_map`\n--\n\nDROP TABLE IF EXISTS `cci_reference_map`;\nCREATE TABLE `cci_reference_map` (\n  `cciRefId` int(11) NOT NULL AUTO_INCREMENT,\n  `cci` varchar(20) NOT NULL,\n  `creator` varchar(255) NOT NULL,\n  `title` varchar(255) NOT NULL,\n  `version` varchar(255) NOT NULL,\n  `location` varchar(255) NOT NULL,\n  `indexDisa` varchar(255) NOT NULL,\n  `textRefNist` varchar(255) NOT NULL,\n  `parentControl` varchar(255) NOT NULL,\n  PRIMARY KEY (`cciRefId`),\n  KEY `cci` (`cci`),\n  KEY `textRefNist` (`textRefNist`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `check`\n--\n\nDROP TABLE IF EXISTS `check`;\nCREATE TABLE `check` (\n  `checkId` varchar(255) NOT NULL,\n  `content` text,\n  PRIMARY KEY (`checkId`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `collection`\n--\n\nDROP TABLE IF EXISTS `collection`;\nCREATE TABLE `collection` (\n  `collectionId` int NOT NULL AUTO_INCREMENT,\n  `name` varchar(45) NOT NULL,\n  `workflow` varchar(45) NOT NULL,\n  `metadata` json NOT NULL,\n  PRIMARY KEY (`collectionId`),\n  UNIQUE KEY `index2` (`name`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `collection_grant`\n--\n\nDROP TABLE IF EXISTS `collection_grant`;\nCREATE TABLE `collection_grant` (\n  `cgId` int NOT NULL AUTO_INCREMENT,\n  `collectionId` int NOT NULL,\n  `userId` int NOT NULL,\n  `accessLevel` int NOT NULL,\n  PRIMARY KEY (`cgId`),\n  UNIQUE KEY `INDEX_USER` (`userId`,`collectionId`),\n  KEY `INDEX_COLLECTION` (`collectionId`,`accessLevel`),\n  CONSTRAINT `fk_collection_grant_1` FOREIGN KEY (`userId`) REFERENCES `user_data` (`userId`) ON DELETE CASCADE ON UPDATE CASCADE,\n  CONSTRAINT `fk_collection_grant_2` FOREIGN KEY (`collectionId`) REFERENCES `collection` (`collectionId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `current_group_rule`\n--\n\nDROP TABLE IF EXISTS `current_group_rule`;\nCREATE TABLE `current_group_rule` (\n  `cgrId` int(11) NOT NULL AUTO_INCREMENT,\n  `benchmarkId` varchar(255) NOT NULL,\n  `groupId` varchar(45) NOT NULL,\n  `ruleId` varchar(255) NOT NULL,\n  PRIMARY KEY (`cgrId`),\n  KEY `idx_benchmarkId` (`benchmarkId`),\n  KEY `idx_rule` (`ruleId`),\n  KEY `idx_group` (`groupId`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `current_rev`\n--\n\nDROP TABLE IF EXISTS `current_rev`;\nCREATE TABLE `current_rev` (\n  `revId` varchar(255) NOT NULL,\n  `benchmarkId` varchar(255) NOT NULL,\n  `version` int(11) NOT NULL,\n  `release` varchar(45) NOT NULL,\n  `benchmarkDate` varchar(45) DEFAULT NULL,\n  `benchmarkDateSql` date DEFAULT NULL,\n  `status` varchar(45) DEFAULT NULL,\n  `statusDate` varchar(45) DEFAULT NULL,\n  `description` varchar(4000) DEFAULT NULL,\n  `active` tinyint(4) DEFAULT NULL,\n  `groupCount` int(11) DEFAULT 0 NOT NULL,\n  `ruleCount` int(11) DEFAULT 0 NOT NULL,\n  `checkCount` int(11) DEFAULT 0 NOT NULL,\n  `fixCount` int(11) DEFAULT 0 NOT NULL,\n  `ovalCount` int(11) DEFAULT 0 NOT NULL,\n  PRIMARY KEY (`revId`),\n  UNIQUE KEY `index2` (`benchmarkId`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `fix`\n--\n\nDROP TABLE IF EXISTS `fix`;\nCREATE TABLE `fix` (\n  `fixId` varchar(45) NOT NULL,\n  `text` mediumtext,\n  PRIMARY KEY (`fixId`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `group`\n--\n\nDROP TABLE IF EXISTS `group`;\nCREATE TABLE `group` (\n  `groupId` varchar(45) NOT NULL,\n  `title` varchar(255) DEFAULT NULL,\n  `severity` varchar(45) DEFAULT NULL,\n  PRIMARY KEY (`groupId`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `config`\n--\n\nDROP TABLE IF EXISTS `config`;\nCREATE TABLE `config` (\n  `key` varchar(45) NOT NULL,\n  `value` varchar(255) NOT NULL,\n  PRIMARY KEY (`key`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `poam_rar_entry`\n--\n\nDROP TABLE IF EXISTS `poam_rar_entry`;\nCREATE TABLE `poam_rar_entry` (\n  `preId` int(11) NOT NULL AUTO_INCREMENT,\n  `collectionId` int(11) NOT NULL,\n  `groupId` varchar(45) NOT NULL,\n  `iacontrol` varchar(45) DEFAULT NULL,\n  `status` varchar(45) DEFAULT NULL,\n  `poc` varchar(255) DEFAULT NULL,\n  `resources` varchar(255) DEFAULT NULL,\n  `compdate` datetime DEFAULT NULL,\n  `milestone` longtext,\n  `poamComment` longtext,\n  `likelihood` varchar(50) DEFAULT NULL,\n  `mitdesc` longtext,\n  `residualRisk` int(11) DEFAULT NULL,\n  `recCorrAct` longtext,\n  `remdesc` longtext,\n  `rarComment` longtext,\n  PRIMARY KEY (`preId`),\n  UNIQUE KEY `unique_collectionId_groupId` (`collectionId`,`groupId`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `reject_string`\n--\n\nDROP TABLE IF EXISTS `reject_string`;\nCREATE TABLE `reject_string` (\n  `rejectId` int(11) NOT NULL AUTO_INCREMENT,\n  `shortStr` varchar(45) NOT NULL,\n  `longStr` longtext ,\n  PRIMARY KEY (`rejectId`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\nDROP TABLE IF EXISTS `result`;\nCREATE TABLE `result` (\n  `resultId` int(11) NOT NULL AUTO_INCREMENT,\n  `api` varchar(32) NOT NULL,\n  `ckl` varchar(32) NOT NULL,\n  `abbr` varchar(2) NOT NULL,\n  `en` varchar(64) NOT NULL,\n  PRIMARY KEY (`resultId`),\n  UNIQUE KEY `RESULT_API` (`api`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `rev_group_map`\n--\n\nDROP TABLE IF EXISTS `rev_group_map`;\nCREATE TABLE `rev_group_map` (\n  `rgId` int(11) NOT NULL AUTO_INCREMENT,\n  `revId` varchar(255) DEFAULT NULL,\n  `groupId` varchar(45) DEFAULT NULL,\n  `rules` JSON DEFAULT NULL,\n  PRIMARY KEY (`rgId`),\n  UNIQUE KEY `uidx_rgm_revId_groupId` (`revId`,`groupId`),\n  KEY `idx_rgm_groupId` (`groupId`),\n  CONSTRAINT `FK_rev_group_map_group` FOREIGN KEY (`groupId`) REFERENCES `group` (`groupId`),\n  CONSTRAINT `FK_rev_group_map_revision` FOREIGN KEY (`revId`) REFERENCES `revision` (`revId`) ON DELETE CASCADE ON UPDATE RESTRICT\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `rev_group_rule_check_map`\n--\n\nDROP TABLE IF EXISTS `rev_group_rule_check_map`;\nCREATE TABLE `rev_group_rule_check_map` (\n  `rgrcId` int(11) NOT NULL AUTO_INCREMENT,\n  `rgrId` int(11) NOT NULL,\n  `checkId` varchar(255) NOT NULL,\n  PRIMARY KEY (`rgrcId`),\n  UNIQUE KEY `uidx_rcm_ruleId_checkId` (`rgrId`,`checkId`),\n  KEY `idx_rcm_checkId` (`checkId`),\n  CONSTRAINT `FK_rev_group_rule_check_map_check` FOREIGN KEY (`checkId`) REFERENCES `check` (`checkId`),\n  CONSTRAINT `FK_rev_group_rule_check_map_rev_group_rule_map` FOREIGN KEY (`rgrId`) REFERENCES `rev_group_rule_map` (`rgrId`) ON DELETE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `rev_group_rule_fix_map`\n--\n\nDROP TABLE IF EXISTS `rev_group_rule_fix_map`;\nCREATE TABLE `rev_group_rule_fix_map` (\n  `rgrfId` int(11) NOT NULL AUTO_INCREMENT,\n  `rgrId` int(11) NOT NULL,\n  `fixId` varchar(255) NOT NULL,\n  PRIMARY KEY (`rgrfId`),\n  UNIQUE KEY `uidx_rfm_ruleId_fixId` (`rgrId`,`fixId`),\n  KEY `idx_rfm_fixId` (`fixId`),\n  CONSTRAINT `FK_rev_group_rule_fix_map_fix` FOREIGN KEY (`fixId`) REFERENCES `fix` (`fixId`),\n  CONSTRAINT `FK_rev_group_rule_fix_map_rev_group_rule_map` FOREIGN KEY (`rgrId`) REFERENCES `rev_group_rule_map` (`rgrId`) ON DELETE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `rev_group_rule_map`\n--\n\nDROP TABLE IF EXISTS `rev_group_rule_map`;\nCREATE TABLE `rev_group_rule_map` (\n  `rgrId` int(11) NOT NULL AUTO_INCREMENT,\n  `rgId` int(11) NOT NULL,\n  `ruleId` varchar(255) DEFAULT NULL,\n  `checks` JSON DEFAULT NULL,\n  `fixes` JSON DEFAULT NULL,\n  `ccis` JSON DEFAULT NULL,\n  PRIMARY KEY (`rgrId`),\n  UNIQUE KEY `uidx_rgrm_rgId_ruleId` (`rgId`,`ruleId`),\n  KEY `idx_rgrm_ruleId` (`ruleId`),\n  CONSTRAINT `FK_rev_group_rule_map_rev_group_map` FOREIGN KEY (`rgId`) REFERENCES `rev_group_map` (`rgId`) ON DELETE CASCADE ON UPDATE RESTRICT,\n  CONSTRAINT `FK_rev_group_rule_map_rule` FOREIGN KEY (`ruleId`) REFERENCES `rule` (`ruleId`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `rev_xml_map`\n--\n\nDROP TABLE IF EXISTS `rev_xml_map`;\nCREATE TABLE `rev_xml_map` (\n  `rxId` int(11) NOT NULL AUTO_INCREMENT,\n  `revId` varchar(255) NOT NULL,\n  `xml` blob,\n  PRIMARY KEY (`rxId`),\n  UNIQUE KEY `uidx_rxm_revId` (`revId`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `review`\n--\n\nDROP TABLE IF EXISTS `review`;\nCREATE TABLE `review` (\n  `reviewId` int(11) NOT NULL AUTO_INCREMENT,\n  `assetId` int(11) DEFAULT NULL,\n  `ruleId` varchar(45) DEFAULT NULL,\n  `resultId` int(11) DEFAULT NULL,\n  `resultComment` longtext ,\n  `actionId` int(11) DEFAULT NULL,\n  `actionComment` longtext ,\n  `autoResult` bit(1) DEFAULT 0,\n  `ts` datetime NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,\n  `userId` int(11) DEFAULT NULL,\n  `rejecttext` longtext ,\n  `rejectUserId` int(11) DEFAULT NULL,\n  `statusId` int(11) NOT NULL,\n  PRIMARY KEY (`reviewId`),\n  UNIQUE KEY `INDEX_ASSETID_RULEID` (`assetId`,`ruleId`),\n  KEY `INDEX_RESULTID` (`resultId`),\n  KEY `INDEX_RULEID` (`ruleId`),\n  KEY `INDEX_STATUSID` (`statusId`),\n  CONSTRAINT `FK_REVIEWS_1` FOREIGN KEY (`assetId`) REFERENCES `asset` (`assetId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `review_history`\n--\n\nDROP TABLE IF EXISTS `review_history`;\nCREATE TABLE `review_history` (\n  `historyId` int(11) NOT NULL AUTO_INCREMENT,\n  `reviewId` int(11) NOT NULL,\n  `resultId` int(11) NOT NULL,\n  `resultComment` longtext,\n  `actionId` int(11) DEFAULT NULL,\n  `actionComment` longtext,\n  `autoResult` bit(1) DEFAULT NULL,\n  `ts` datetime NOT NULL,\n  `userId` int(11) DEFAULT NULL,\n  `rejectText` longtext,\n  `rejectUserId` int(11) DEFAULT NULL,\n  `statusId` int(11) NOT NULL,\n  PRIMARY KEY (`historyId`),\n  KEY `index_reviewId` (`reviewId`),\n  CONSTRAINT `fk_review_history_1` FOREIGN KEY (`reviewId`) REFERENCES `review` (`reviewId`) ON DELETE CASCADE ON UPDATE RESTRICT\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `review_reject_string_map`\n--\n\nDROP TABLE IF EXISTS `review_reject_string_map`;\nCREATE TABLE `review_reject_string_map` (\n  `rrsId` int(11) NOT NULL AUTO_INCREMENT,\n  `assetId` int(11) NOT NULL,\n  `ruleId` varchar(45) NOT NULL,\n  `rejectId` int(11) NOT NULL,\n  `userId` int(11) DEFAULT NULL,\n  PRIMARY KEY (`rrsId`),\n  UNIQUE KEY `INDEX2` (`assetId`,`ruleId`,`rejectId`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `revision`\n--\n\nDROP TABLE IF EXISTS `revision`;\nCREATE TABLE `revision` (\n  `revId` varchar(255) NOT NULL,\n  `benchmarkId` varchar(255) NOT NULL,\n  `version` int(11) NOT NULL,\n  `release` varchar(45) NOT NULL,\n  `benchmarkDate` varchar(45) DEFAULT NULL,\n  `benchmarkDateSql` date DEFAULT NULL,\n  `status` varchar(45) DEFAULT NULL,\n  `statusDate` varchar(45) DEFAULT NULL,\n  `description` varchar(4000) DEFAULT NULL,\n  `active` tinyint(4) DEFAULT '1',\n  `groupCount` int(11) DEFAULT 0 NOT NULL,\n  `ruleCount` int(11) DEFAULT 0 NOT NULL,\n  `checkCount` int(11) DEFAULT 0 NOT NULL,\n  `fixCount` int(11) DEFAULT 0 NOT NULL,\n  `ovalCount` int(11) DEFAULT 0 NOT NULL,\n  PRIMARY KEY (`revId`),\n  UNIQUE KEY `uidx_revision_benchmarkId_version_release` (`benchmarkId`,`version`,`release`),\n  CONSTRAINT `FK_REVISION_1` FOREIGN KEY (`benchmarkId`) REFERENCES `stig` (`benchmarkId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `rule`\n--\n\nDROP TABLE IF EXISTS `rule`;\nCREATE TABLE `rule` (\n  `ruleId` varchar(255) NOT NULL,\n  `version` varchar(45) NOT NULL,\n  `title` varchar(1000) DEFAULT NULL,\n  `severity` varchar(45) DEFAULT NULL,\n  `weight` varchar(45) DEFAULT NULL,\n  `vulnDiscussion` text,\n  `falsePositives` text,\n  `falseNegatives` text,\n  `documentable` varchar(45) DEFAULT NULL,\n  `mitigations` text,\n  `severityOverrideGuidance` text,\n  `potentialImpacts` text,\n  `thirdPartyTools` text,\n  `mitigationControl` text,\n  `responsibility` varchar(255) DEFAULT NULL,\n  `iaControls` varchar(255) DEFAULT NULL,\n  PRIMARY KEY (`ruleId`),\n  KEY `idx_rule_severity` (`severity`),\n  KEY `idx_title` (`title`(100))\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `rule_cci_map`\n--\n\nDROP TABLE IF EXISTS `rule_cci_map`;\nCREATE TABLE `rule_cci_map` (\n  `rcId` int(11) NOT NULL AUTO_INCREMENT,\n  `ruleId` varchar(255) NOT NULL,\n  `cci` varchar(60) NOT NULL,\n  PRIMARY KEY (`rcId`),\n  UNIQUE KEY `rule_cci_unique` (`ruleId`,`cci`),\n  KEY `index_cci` (`cci`),\n  CONSTRAINT `FK_rule_cci_map_1` FOREIGN KEY (`ruleId`) REFERENCES `rule` (`ruleId`) ON DELETE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `rule_oval_map`\n--\n\nDROP TABLE IF EXISTS `rule_oval_map`;\nCREATE TABLE `rule_oval_map` (\n  `roId` int(11) NOT NULL AUTO_INCREMENT,\n  `ruleId` varchar(255) NOT NULL,\n  `ovalRef` varchar(255) NOT NULL,\n  `benchmarkId` varchar(255) NOT NULL,\n  `releaseInfo` varchar(255) NOT NULL,\n  PRIMARY KEY (`roId`),\n  KEY `index2` (`ruleId`),\n  KEY `index3` (`benchmarkId`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `severity_cat_map`\n--\n\nDROP TABLE IF EXISTS `severity_cat_map`;\nCREATE TABLE `severity_cat_map` (\n  `id` int(11) NOT NULL AUTO_INCREMENT,\n  `severity` varchar(45) NOT NULL,\n  `cat` int(11) NOT NULL,\n  `roman` varchar(45) NOT NULL,\n  PRIMARY KEY (`id`),\n  KEY `idx_scm_severity` (`severity`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `stats_asset_stig`\n--\n\nDROP TABLE IF EXISTS `stats_asset_stig`;\nCREATE TABLE `stats_asset_stig` (\n  `id` int(11) NOT NULL AUTO_INCREMENT,\n  `assetId` int(11) DEFAULT NULL,\n  `benchmarkId` varchar(255) DEFAULT NULL,\n  `minTs` datetime DEFAULT NULL,\n  `maxTs` datetime DEFAULT NULL,\n  `savedManual` int(11) DEFAULT NULL,\n  `savedAuto` int(11) DEFAULT NULL,\n  `submittedManual` int(11) DEFAULT NULL,\n  `submittedAuto` int(11) DEFAULT NULL,\n  `rejectedManual` int(11) DEFAULT NULL,\n  `rejectedAuto` int(11) DEFAULT NULL,\n  `acceptedManual` int(11) DEFAULT NULL,\n  `acceptedAuto` int(11) DEFAULT NULL,\n  `highCount` int(11) DEFAULT NULL,\n  `mediumCount` int(11) DEFAULT NULL,\n  `lowCount` int(11) DEFAULT NULL,\n  PRIMARY KEY (`id`),\n  UNIQUE KEY `INDEX_2_2_C` (`assetId`,`benchmarkId`),\n  KEY `FK_STATS_ASSET_STIG_2` (`benchmarkId`),\n  CONSTRAINT `FK_STATS_ASSET_STIG_1` FOREIGN KEY (`assetId`) REFERENCES `asset` (`assetId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `status`\n--\n\nDROP TABLE IF EXISTS `status`;\nCREATE TABLE `status` (\n  `statusId` int(11) NOT NULL,\n  `api` varchar(16) NOT NULL,\n  `en` varchar(16) NOT NULL,\n  PRIMARY KEY (`statusId`),\n  UNIQUE KEY `IDX_API` (`api`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `benchmark`\n--\n\nDROP TABLE IF EXISTS `stig`;\nCREATE TABLE `stig` (\n  `benchmarkId` varchar(255) NOT NULL,\n  `title` varchar(255) NOT NULL,\n  PRIMARY KEY (`benchmarkId`),\n  KEY `idx_benchmark_title` (`title`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `stig_asset_map`\n--\n\nDROP TABLE IF EXISTS `stig_asset_map`;\nCREATE TABLE `stig_asset_map` (\n  `saId` int(11) NOT NULL AUTO_INCREMENT,\n  `benchmarkId` varchar(255) NOT NULL,\n  `assetId` int(11) NOT NULL,\n  `userIds` JSON DEFAULT NULL,\n  PRIMARY KEY (`saId`),\n  UNIQUE KEY `IDX_BAID` (`benchmarkId`,`assetId`),\n  KEY `IDX_ASSETID` (`assetId`),\n  CONSTRAINT `FK_STIG_ASSET_MAP_1` FOREIGN KEY (`assetId`) REFERENCES `asset` (`assetId`) ON DELETE CASCADE ON UPDATE CASCADE,\n  CONSTRAINT `FK_STIG_ASSET_MAP_2` FOREIGN KEY (`benchmarkId`) REFERENCES `stig` (`benchmarkId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `user`\n--\n\nDROP TABLE IF EXISTS `user_data`;\nCREATE TABLE `user_data` (\n  `userId` int NOT NULL AUTO_INCREMENT,\n  `username` varchar(255) NOT NULL,\n  `display` varchar(255) NOT NULL,\n  `email` varchar(255) NOT NULL,\n  `globalAccess` bit(1) NOT NULL DEFAULT b'0',\n  `canCreateCollection` bit(1) NOT NULL DEFAULT b'0',\n  `canAdmin` bit(1) NOT NULL DEFAULT b'0',\n  `metadata` json NOT NULL,\n  `created` datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,\n  `lastAccess` int DEFAULT NULL,\n  `disabled` bit(1) NOT NULL DEFAULT b'0',\n  PRIMARY KEY (`userId`),\n  UNIQUE KEY `INDEX_username` (`username`),\n  KEY `INDEX_display` (`display`),\n  KEY `email` (`email`),\n  KEY `INDEX_globalAccess` (`globalAccess`),\n  KEY `INDEX_canAdmin` (`canAdmin`),\n  KEY `INDEX_canCreateCollection` (`canCreateCollection`)\n  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `user_stig_asset_map`\n--\n\nDROP TABLE IF EXISTS `user_stig_asset_map`;\nCREATE TABLE `user_stig_asset_map` (\n  `id` int NOT NULL AUTO_INCREMENT,\n  `userId` int NOT NULL,\n  `saId` int NOT NULL,\n  -- `benchmarkId` varchar(255) NOT NULL,\n  -- `assetId` int NOT NULL,\n  PRIMARY KEY (`id`),\n  -- UNIQUE KEY `usa_Unique` (`benchmarkId`,`assetId`,`userId`),\n  -- KEY `usa_sa` (`benchmarkId`,`assetId`),\n  -- KEY `usa_a` (`assetId`),\n  KEY `fk_user_stig_asset_map_2` (`userId`),\n  -- CONSTRAINT `fk_user_stig_asset_map_1` FOREIGN KEY (`benchmarkId`, `assetId`) REFERENCES `stig_asset_map` (`benchmarkId`, `assetId`) ON DELETE CASCADE ON UPDATE CASCADE,\n  CONSTRAINT `fk_user_stig_asset_map_1` FOREIGN KEY (`saId`) REFERENCES `stig_asset_map` (`saId`) ON DELETE CASCADE ON UPDATE CASCADE,\n  CONSTRAINT `fk_user_stig_asset_map_2` FOREIGN KEY (`userId`) REFERENCES `user_data` (`userId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Temporary view structure for view `v_current_rev`\n--\n\nDROP TABLE IF EXISTS `v_current_rev`;\n/*!50001 DROP VIEW IF EXISTS `v_current_rev`*/;\n/*!50001 CREATE VIEW `v_current_rev` AS SELECT \n 1 AS `revId`,\n 1 AS `benchmarkId`,\n 1 AS `version`,\n 1 AS `release`,\n 1 AS `benchmarkDate`,\n 1 AS `benchmarkDateSql`,\n 1 AS `status`,\n 1 AS `statusDate`,\n 1 AS `description`,\n 1 AS `active`,\n 1 AS `groupCount`,\n 1 AS `ruleCount`,\n 1 AS `checkCount`,\n 1 AS `fixCount`,\n 1 AS `ovalCount`*/;\n\n--\n-- Final view structure for view `v_current_rev`\n--\n\n/*!50001 DROP VIEW IF EXISTS `v_current_rev`*/;\n/*!50001 CREATE ALGORITHM=UNDEFINED */\n/*!50001 VIEW `v_current_rev` AS select `rr`.`revId` AS `revId`,`rr`.`benchmarkId` AS `benchmarkId`,`rr`.`version` AS `version`,`rr`.`release` AS `release`,`rr`.`benchmarkDate` AS `benchmarkDate`,`rr`.`benchmarkDateSql` AS `benchmarkDateSql`,`rr`.`status` AS `status`,`rr`.`statusDate` AS `statusDate`,`rr`.`description` AS `description`,`rr`.`active` AS `active`,`rr`.`groupCount` AS `groupCount`,`rr`.`ruleCount` AS `ruleCount`,`rr`.`checkCount` AS `checkCount`,`rr`.`fixCount` AS `fixCount`,`rr`.`ovalCount` AS `ovalCount` from (select `r`.`revId` AS `revId`,`r`.`benchmarkId` AS `benchmarkId`,`r`.`version` AS `version`,`r`.`release` AS `release`,`r`.`benchmarkDate` AS `benchmarkDate`,`r`.`benchmarkDateSql` AS `benchmarkDateSql`,`r`.`status` AS `status`,`r`.`statusDate` AS `statusDate`,`r`.`description` AS `description`,`r`.`active` AS `active`,`r`.`groupCount` AS `groupCount`,`r`.`ruleCount` AS `ruleCount`,`r`.`checkCount` AS `checkCount`,`r`.`fixCount` AS `fixCount`,(SELECT COUNT(roId) FROM rule_oval_map where benchmarkId = `r`.`benchmarkId`) AS `ovalCount`,row_number() OVER (PARTITION BY `r`.`benchmarkId` ORDER BY (`r`.`version` + 0) desc,(`r`.`release` + 0) desc )  AS `rn` from `revision` `r` where `r`.`status` = 'accepted') `rr` where (`rr`.`rn` = 1) */;\n\n/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;\n/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;\n/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;\n/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;\n\n-- Dump completed on 2020-05-05 21:54:37\n"
  },
  {
    "path": "api/source/service/migrations/sql/0000/up/31-stigman-static.sql",
    "content": "-- MySQL dump 10.13  Distrib 8.0.18, for Linux (x86_64)\n--\n/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;\n/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;\n/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;\n/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;\n\n--\n-- Dumping data for table `action`\n--\n\nLOCK TABLES `action` WRITE;\n/*!40000 ALTER TABLE `action` DISABLE KEYS */;\nINSERT INTO `action` VALUES (1,'remediate','Remediate'),(2,'mitigate','Mitigate'),(3,'exception','Exception');\n/*!40000 ALTER TABLE `action` ENABLE KEYS */;\nUNLOCK TABLES;\n\n--\n-- Dumping data for table `reject_string`\n--\n\nLOCK TABLES `reject_string` WRITE;\n/*!40000 ALTER TABLE `reject_string` DISABLE KEYS */;\nINSERT INTO `reject_string` VALUES (1,'Evaluation comment not specific.','The comment supporting the result of the evaluation does not contain enough specific information. Comments should mention the specific setting(s) or value(s) contained in the check text.'),(2,'Recommendation comment not specific.','The comment describing the recommended action is not specific.'),(3,'Documentation is not attached.','The review requires the submission of documentation for the result of the evaluation to be accepted.');\n/*!40000 ALTER TABLE `reject_string` ENABLE KEYS */;\nUNLOCK TABLES;\n\n--\n-- Dumping data for table `state`\n--\n\nLOCK TABLES `result` WRITE;\n/*!40000 ALTER TABLE `result` DISABLE KEYS */;\nINSERT INTO `result` VALUES (1,'notchecked','Not_Reviewed','NR','Not checked'),\n(2,'notapplicable','Not_Applicable','NA','Not Applicable'),\n(3,'pass','NotAFinding','NF','Not a Finding'),\n(4,'fail','Open','O','Open'),\n(5,'unknown','Not_Reviewed','U','Unknown'),\n(6,'error','Not_Reviewed','E','Error'),\n(7,'notselected','Not_Reviewed','NS','Not selected'),\n(8,'informational','Not_Reviewed','I','Informational'),\n(9,'fixed','NotAFinding','NF','Fixed');\n/*!40000 ALTER TABLE `result` ENABLE KEYS */;\nUNLOCK TABLES;\n\n--\n-- Dumping data for table `severity_cat_map`\n--\n\nLOCK TABLES `severity_cat_map` WRITE;\n/*!40000 ALTER TABLE `severity_cat_map` DISABLE KEYS */;\nINSERT INTO `severity_cat_map` VALUES (1,'high',1,'I'),(2,'medium',2,'II'),(3,'low',3,'III'),(4,'mixed',4,'IV');\n/*!40000 ALTER TABLE `severity_cat_map` ENABLE KEYS */;\nUNLOCK TABLES;\n\n--\n-- Dumping data for table `status`\n--\n\nLOCK TABLES `status` WRITE;\n/*!40000 ALTER TABLE `status` DISABLE KEYS */;\nINSERT INTO `status` VALUES (0,'saved','Saved'),\n(1,'submitted','Submitted'),\n(2,'rejected','Rejected'),\n(3,'accepted','Accepted');\n/*!40000 ALTER TABLE `status` ENABLE KEYS */;\nUNLOCK TABLES;\n\n/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;\n/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;\n/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;\n/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;\n\n-- Dump completed on 2020-05-13 14:47:04\n"
  },
  {
    "path": "api/source/service/migrations/sql/0000/up/32-cci-data.sql",
    "content": "-- MySQL dump 10.13-csmig  Distrib 8.0.18-csmig, for Linux (x86_64)\n--\n/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;\n/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;\n/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;\n/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;\n\n--\n-- Dumping data for table `cci`\n--\n\nLOCK TABLES `cci` WRITE;\n/*!40000 ALTER TABLE `cci` DISABLE KEYS */;\nINSERT INTO `cci` VALUES ('000001','draft','2009-05-13','DISA FSO','policy','The organization develops an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','AC-1.3','The organization being inspected/assessed develops and documents an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','The organization conducting the inspection/assessment obtains and examines the access control policy to ensure the organization being inspected/assessed develops and documents an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.'),\n('000002','draft','2009-09-14','DISA FSO','policy','The organization disseminates the access control policy to organization-defined personnel or roles.','AC-1.4','The organization being inspected/assessed disseminates via an information sharing capability to all personnel.  DoD has defined the personnel or roles as all personnel.','The organization conducting the inspection/assessment examines the access control policy via the organization\\'s information sharing capability to ensure the organization being inspected/assessed disseminates the policy to all personnel.  DoD has defined the personnel or roles as all personnel.'),\n('000003','draft','2009-09-14','DISA FSO','policy','The organization reviews and updates the access control policy in accordance with organization-defined frequency.','AC-1.7','The organization being inspected/assessed annually reviews and updates the access control policy.  The organization must maintain review and update activity as an audit trail.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed annually reviews and updates the access control policy.   DoD has defined the frequency as annually.'),\n('000004','draft','2009-05-13','DISA FSO','policy','The organization develops procedures to facilitate the implementation of the access control policy and associated access controls.','AC-1.5','The organization being inspected/assessed develops and documents procedures to facilitate the implementation of the access control policy and associated access controls.','The organization conducting the inspection/assessment obtains and examines the procedures to facilitate the implementation of the access control policy and associated access controls to ensure the organization being inspected/assessed develops and documents procedures to facilitate the implementation of the access control policy and associated access controls.'),\n('000005','draft','2009-09-14','DISA FSO','policy','The organization disseminates the procedures to facilitate access control policy and associated access controls to the organization-defined personnel or roles.','AC-1.6','The organization being inspected/assessed disseminates via an information sharing capability to all personnel  the procedures to facilitate access control policy and associated access controls.  DoD has defined the personnel or roles as all personnel.','The organization conducting the inspection/assessment examines the procedures to facilitate access control policy and associated access controls via the organization\\'s information sharing capability to ensure the organization being inspected/assessed disseminates the procedures to all personnel.  DoD has defined the personnel or roles as all personnel.'),\n('000006','draft','2009-09-14','DISA FSO','policy','The organization reviews and updates the access control procedures in accordance with organization-defined frequency.','AC-1.9','The organization being inspected/assessed annually reviews and updates the access control procedures.  The organization must maintain review and update activity as an audit trail.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed annually reviews and updates the access control procedures.   DoD has defined the frequency as annually.'),\n('000007','draft','2009-05-13','DISA FSO','policy','The organization manages information system accounts by identifying account types (i.e., individual, group, system, application, guest/anonymous, and temporary).',NULL,NULL,NULL),\n('000008','draft','2009-09-14','DISA FSO','policy','The organization establishes conditions for group membership.','AC-2.4','The organization being inspected/assessed documents conditions for adding accounts as members of groups.','The organization conducting the inspection/assessment obtains and examines the documented conditions for adding accounts as members of groups to ensure that the conditions are established.'),\n('000009','draft','2009-05-13','DISA FSO','policy','The organization manages information system accounts by identifying authorized users of the information system and specifying access privileges.',NULL,NULL,NULL),\n('000010','draft','2009-05-13','DISA FSO','policy','The organization requires approvals by organization-defined personnel or roles for requests to create information system accounts.','AC-2.11','The organization being inspected/assessed implements a process for the ISSM or ISSO to approve information system account requests.  The organization being inspected/assessed maintains an audit trail of approvals.  DoD has defined the personnel or roles as the ISSM or ISSO.','The organization conducting the inspection/assessment obtains and examines the audit trail of approvals to ensure that the  organization being inspected/assessed implements a process for the  ISSM or ISSO to approve information system account requests.  DoD has defined the personnel or roles as the ISSM or ISSO.'),\n('000011','draft','2009-05-13','DISA FSO','policy','The organization creates, enables, modifies, disables, and removes information system accounts in accordance with organization-defined procedures or conditions.','AC-2.13','The organization being inspected/assessed implements account maintenance processes to create, enable, modify, disable, and remove information system accounts in accordance with procedures or conditions defined in AC-2, 2121.  The organization being inspected/assessed maintains an audit trail of account maintenance activities.','The organization conducting the inspection/assessment obtains and examines the audit trail of account maintenance activities to ensure the organization being inspected/assessed implements account maintenance processes to create, enable, modify, disable, remove, and track information system accounts in accordance with procedures or conditions defined in AC-2, 2121.'),\n('000012','draft','2009-09-14','DISA FSO','policy','The organization reviews information system accounts for compliance with account management requirements per organization-defined frequency.','AC-2.22','The organization being inspected/assessed implements a process to review information system accounts for compliance with account management requirements at a minimum, annually.  The organization being inspected/assessed maintains an audit trail of reviews.  DoD has defined the frequency as at a minimum, annually.','The organization conducting the inspection/assessment obtains and examines the audit trail of reviews to ensure the organization being inspected/assessed implements a process to review information system accounts for compliance with account management requirements at a minimum, annually.\\nDoD has defined the frequency as at a minimum, annually.'),\n('000013','draft','2009-09-14','DISA FSO','policy','The organization manages information system accounts by notifying account managers when temporary accounts are no longer required and when information system users are terminated, transferred, or information system usage or need-to-know/need-to-share changes.',NULL,NULL,NULL),\n('000014','draft','2009-09-14','DISA FSO','policy','The organization manages information system accounts by granting access to the system based on a valid access authorization; intended system usage; and other attributes as required by the organization or associated missions/business functions.',NULL,NULL,NULL),\n('000015','draft','2009-05-13','DISA FSO','technical','The organization employs automated mechanisms to support the information system account management functions.','AC-2(1).1','The organization being inspected/assessed configures the information system to employ automated mechanisms to support the information system account management functions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 000015.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to employ automated mechanisms to support the information system account management functions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 000015.'),\n('000016','draft','2009-05-13','DISA FSO','technical','The information system automatically removes or disables temporary accounts after an organization-defined time period for each type of account.','AC-2(2).1','The organization being inspected/assessed configures the information system to  automatically remove or disable temporary accounts after  72 hours.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 000016.  DoD has defined the time period as 72 hours.  ','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically remove or disable temporary accounts after 72 hours.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 000016.  DoD has defined the time period as 72 hours.'),\n('000017','draft','2009-05-13','DISA FSO','technical','The information system automatically disables inactive accounts after an organization-defined time period.','AC-2(3).1','The organization being inspected/assessed configures the information system to disable inactive accounts after 35 days.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 000017.  DoD has defined the time period as 35 days.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to disable inactive accounts after 35 days.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 000017.  DoD has defined the time period as 35 days.'),\n('000018','draft','2009-05-13','DISA FSO','technical','The information system automatically audits account creation actions.','AC-2(4).1','The organization being inspected/assessed configures the information system to automatically audit account creation actions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 18.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically audit account creation actions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 18.'),\n('000019','draft','2009-09-14','DISA FSO','policy','The organization requires that users log out in accordance with the organization-defined time period of inactivity or description of when to log out.','AC-2(5).2','The organization being inspected/assessed documents in the user policies that users are required to log out at the end of the users standard work period unless otherwise defined in formal organizational policy and IAW conditions defined in AC-2 (5) CCI 2133.  DoD has defined the time period as at the end of the users standard work period unless otherwise defined in formal organizational policy.','The organization conducting the inspection/assessment obtains and examines the user policies to ensure that users are required to log out at the end of the users standard work period unless otherwise defined in formal organizational policy and IAW conditions defined in AC-2 (5) CCI 2133.  DoD has defined the time period as at the end of the users standard work period unless otherwise defined in formal organizational policy.'),\n('000020','draft','2009-09-14','DISA FSO','technical','The information system dynamically manages user privileges and associated access authorizations.',NULL,NULL,NULL),\n('000021','draft','2009-05-13','DISA FSO','technical','The information system enforces dual authorization for organization-defined privileged commands and/or other organization-defined actions.','AC-3(2).1','The organization being inspected/assessed configures the information system to enforce dual authorization for privileged commands defined in AC-3 (2), CCI 1408 and/or other actions defined in AC-3 (2), CCI 2152.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 21.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  enforce dual authorization for privileged commands defined in AC-3 (2), CCI 1408 and/or other actions defined in AC-3 (2), CCI 2152.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 21.'),\n('000022','draft','2009-05-13','DISA FSO','technical','The information system enforces one or more organization-defined nondiscretionary access control policies over an organization-defined set of users and resources.',NULL,NULL,NULL),\n('000023','draft','2009-11-03','DISA FSO','policy','The organization develops an organization-wide information security program plan that provides sufficient information about the program management controls and common controls (including specification of parameters for any assignment and selection operations either explicitly or by reference) to enable an implementation that is unambiguously compliant with the intent of the plan, and a determination of the risk to be incurred if the plan is implemented as intended.',NULL,NULL,NULL),\n('000024','draft','2009-09-14','DISA FSO','technical','The information system prevents access to organization-defined security-relevant information except during secure, non-operable system states.','AC-3(5).1','The organization being inspected/assessed configures the information system to prevent access to security-relevant information defined in AC-3 (5), CCI 1411 except during secure, non-operable system states.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 24.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  prevent access to security-relevant information defined in AC-3 (5), CCI 1411 except during secure, non-operable system states.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 24.'),\n('000025','draft','2009-09-14','DISA FSO','technical','The information system enforces information flow control using explicit security attributes on information, source, and destination objects as a basis for flow control decisions.',NULL,NULL,NULL),\n('000026','draft','2009-05-13','DISA FSO','technical','The information system uses protected processing domains to enforce organization-defined information flow control policies as a basis for flow control decisions.','AC-4(2).1','The organization being inspected/assessed configures the information system to use protected processing domains to enforce  information flow control policies defined in AC-4 (2), CCI 2191 as a basis for flow control decisions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 000026.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to use protected processing domains to enforce  information flow control policies defined in AC-4 (2), CCI 2191 as a basis for flow control decisions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 000026.'),\n('000027','draft','2009-05-13','DISA FSO','technical','The information system enforces dynamic information flow control based on organization-defined policies.','AC-4(3).1','The organization being inspected/assessed configures the information system to enforce dynamic information flow control based on policies defined in AC-4 (3), CCI 2192.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 27.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce dynamic information flow control based on policies defined in AC-4 (3), CCI 2192.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 27.'),\n('000028','draft','2009-05-13','DISA FSO','policy','The information system prevents encrypted information from bypassing content-checking mechanisms by employing organization-defined procedures or methods.','AC-4(4).1','The organization being inspected/assessed configures the information system to prevent encrypted information from bypassing content-checking mechanisms by employing procedures or methods defined in AC-4 (4), CCI 2193.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 28.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to prevent encrypted information from bypassing content-checking mechanisms by employing procedures or methods defined in AC-4 (4), CCI 2193.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 28.'),\n('000029','draft','2009-05-13','DISA FSO','technical','The information system enforces organization-defined limitations on the embedding of data types within other data types.','AC-4(5).1','The organization being inspected/assessed configures the information system to enforce  limitations defined in AC-4 (5), CCI 1415 on the embedding of data types within other data types.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 29.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  enforce  limitations defined in AC-4 (5), CCI 1415 on the embedding of data types within other data types.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 29.'),\n('000030','draft','2009-05-13','DISA FSO','technical','The information system enforces information flow control based on organization-defined metadata.','AC-4(6).1','The organization being inspected/assessed configures the information system to enforce information flow control based on  metadata defined in AC-4 (6), CCI 2194.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 30.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  enforce information flow control based on  metadata defined in AC-4 (6), CCI 2194.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 30.'),\n('000031','draft','2009-05-13','DISA FSO','technical','The information system enforces organization-defined one-way flows using hardware mechanisms.','AC-4(7).1','The organization being inspected/assessed configures the information system to enforce  one-way flows defined in AC-4 (7), CCI 1416 using hardware mechanisms.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 31.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  enforce  one-way flows defined in AC-4 (7), CCI 1416 using hardware mechanisms.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 31.'),\n('000032','draft','2009-09-14','DISA FSO','technical','The information system enforces information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows.','AC-4(8).1','The organization being inspected/assessed configures the information system to enforce information flow control using security policy filters defined in AC-4 (8), CCI 1417 as a basis for flow control decisions for all information flows.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 32.  DoD has defined the information flows as all information flows.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce information flow control using security policy filters defined in AC-4 (8), CCI 1417 as a basis for flow control decisions for all information flows.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 32.  DoD has defined the information flows as all information flows.'),\n('000033','draft','2009-05-13','DISA FSO','policy','The information system enforces the use of human review for organization-defined security policy filters when the system is not capable of making an information flow control decision.',NULL,NULL,NULL),\n('000034','draft','2009-05-13','DISA FSO','technical','The information system provides the capability for a privileged administrator to enable/disable organization-defined security policy filters under organization-defined conditions.','AC-4(10).1','The organization being inspected/assessed configures the information system to provide the capability for a privileged administrator to enable/disable security policy filters defined in AC-4 (10), CCI 1553 under conditions defined in AC-4 (10), CCI 2199.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 34.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  provide the capability for a privileged administrator to enable/disable security policy filters defined in AC-4 (10), CCI 1553 under conditions defined in AC-4 (10), CCI 2199.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 34.'),\n('000035','draft','2009-09-14','DISA FSO','technical','The information system provides the capability for privileged administrators to configure the organization-defined security policy filters to support different security policies.','AC-4(11).1','The organization being inspected/assessed configures the information system to  provide the capability for privileged administrators to configure the security policy filters defined in AC-4 (11), CCI  1554 to support different security policies.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 35.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  provide the capability for privileged administrators to configure the security policy filters defined in AC-4 (11), CCI  1554 to support different security policies.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 35.'),\n('000036','draft','2009-05-19','DISA FSO','policy','The organization separates organization-defined duties of individuals.','AC-5.1','The organization being inspected/assessed documents and implements processes to maintain separation of the duties defined in AC-5, CCI 2219 across different individuals within the organization.','The organization conducting the inspection/assessment obtains and examines the documented processes to ensure the organization being inspected/assessed maintains separation of the duties defined in AC-5, CCI 2219 across different individuals within the organization.'),\n('000037','draft','2009-09-14','DISA FSO','technical','The organization implements separation of duties through assigned information system access authorizations.',NULL,NULL,NULL),\n('000038','draft','2009-05-19','DISA FSO','policy','The organization explicitly authorizes access to organization-defined security functions and security-relevant information.',NULL,NULL,NULL),\n('000039','draft','2009-09-14','DISA FSO','policy','The organization requires that users of information system accounts or roles, with access to organization-defined security functions or security-relevant information, use non-privileged accounts, or roles, when accessing nonsecurity functions.','AC-6(2).1','The organization being inspected/assessed documents and implements a process to  require that users of information system accounts or roles, with access to any privileged security functions or security-relevant information, use non-privileged accounts, or roles, when accessing nonsecurity functions.  DoD has defined the security functions and security-relevant information as any privileged security functions or security-relevant information.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requires that users of information system accounts or roles, with access to any privileged security functions or security-relevant information, use non-privileged accounts, or roles, when accessing nonsecurity functions.  DoD has defined the security functions and security-relevant information as any privileged security functions or security-relevant information.'),\n('000040','draft','2009-09-14','DISA FSO','technical','The organization audits any use of privileged accounts, or roles, with access to organization-defined security functions or security-relevant information, when accessing other system functions.',NULL,NULL,NULL),\n('000041','draft','2009-05-19','DISA FSO','policy','The organization authorizes network access to organization-defined privileged commands only for organization-defined compelling operational needs.','AC-6(3).1','The organization being inspected/assessed  authorizes network access to privileged commands defined in AC-6 (3), CCI 1420 only for compelling operational needs defined in AC-6 (3), CCI 2224.','The organization conducting the inspection/assessment obtains and examines a sampling of network access authorizations to ensure the organization being inspected/assessed authorizes network access to privileged commands defined in AC-6 (3), CCI 1420 only for compelling operational needs defined in AC-6 (3), CCI 2224.'),\n('000042','draft','2009-05-19','DISA FSO','policy','The organization documents the rationale for authorized network access to organization-defined privileged commands in the security plan for the information system.','AC-6(3).2','The organization being inspected/assessed documents the rationale for authorized network access to privileged commands defined in AC-6 (3), CCI 1420 in the security plan for the information system.','The organization conducting the inspection/assessment obtains and examines the documented rationale to ensure the organization being inspected/assessed documents the rationale for authorized network access to privileged commands defined in AC-6 (3), CCI 1420 in the security plan for the information system.'),\n('000043','draft','2009-05-19','DISA FSO','policy','The organization defines the maximum number of consecutive invalid logon attempts to the information system by a user during an organization-defined time period.','AC-7.1','DoD has defined the maximum number as three.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the maximum number as three.'),\n('000044','draft','2009-09-14','DISA FSO','technical','The information system enforces the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.','AC-7.2','The organization being inspected/assessed configures the information system to limit invalid logon attempts by a user to three attempts during a 15 minute time period.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 44.  DoD has defined the maximum number as three.  DoD has defined the time period as 15 minutes.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to limit invalid logon attempts by a user to three attempts during a 15 minute time period.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 44.  DoD has defined the maximum number as three.  DoD has defined the time period as 15 minutes.'),\n('000045','draft','2009-09-14','DISA FSO','policy','The organization defines in the security plan, explicitly or by reference, the time period for lock out mode or delay period.',NULL,NULL,NULL),\n('000046','draft','2009-09-14','DISA FSO','policy','The organization selects either a lock out mode for the organization-defined time period or delays the next login prompt for the organization-defined delay period for information system responses to consecutive invalid access attempts.',NULL,NULL,NULL),\n('000047','draft','2009-09-14','DISA FSO','technical','The information system delays next login prompt according to the organization-defined delay algorithm, when the maximum number of unsuccessful attempts is exceeded, automatically locks the account/node for an organization-defined time period or locks the account/node until released by an Administrator IAW organizational policy.',NULL,NULL,NULL),\n('000048','draft','2009-05-19','DISA FSO','technical','The information system displays an organization-defined system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.','AC-8.1','The organization being inspected/assessed configures the information system to display the DoD Information Systems  Standard Consent Banner and User Agreement before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 48.  DoD has defined the use notification message or banner as the content of DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems  Standard Consent Banner and User Agreement,\\\" March 2013.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to display the DoD Information Systems  Standard Consent Banner and User Agreement before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 48.  DoD has defined the use notification message or banner as the content of DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems  Standard Consent Banner and User Agreement,\\\" March 2013.'),\n('000049','draft','2009-05-19','DISA FSO','policy','The organization defines a system use notification message or banner displayed before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: (i) users are accessing a U.S. Government information system; (ii) system usage may be monitored, recorded, and subject to audit; (iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and (iv) use of the system indicates consent to monitoring and recording.',NULL,NULL,NULL),\n('000050','draft','2009-09-14','DISA FSO','technical','The information system retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system.','AC-8.7','The organization being inspected/assessed configures the information system to  retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 50.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 50.'),\n('000051','draft','2009-05-19','DISA FSO','policy','The organization approves the information system use notification message before its use.',NULL,NULL,NULL),\n('000052','draft','2009-09-14','DISA FSO','technical','The information system notifies the user, upon successful logon (access) to the system, of the date and time of the last logon (access).','AC-9.1','The organization being inspected/assessed configures the information system to notify the user, upon successful logon (access) to the system, of the date and time of the last logon (access).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 52.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to notify the user, upon successful logon (access) to the system, of the date and time of the last logon (access).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 52.'),\n('000053','draft','2009-09-14','DISA FSO','technical','The information system notifies the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access.','AC-9(1).1','The organization being inspected/assessed configures the information system to notify the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 53.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to notify the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 53.'),\n('000054','draft','2009-05-19','DISA FSO','technical','The information system limits the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number of sessions.','AC-10.1','The organization being inspected/assessed configures the information system to limit the number of concurrent sessions for all accounts and/or account types to a number of sessions defined in AC-10, CCI 55.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 54.  DoD has defined the account types and/or accounts as all account types and/or accounts.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to limit the number of concurrent sessions for  all accounts and/or account types to a number of sessions defined in AC-10, CCI 55.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 54.  DoD has defined the account types and/or accounts as all account types and/or accounts.'),\n('000055','draft','2009-05-19','DISA FSO','policy','The organization defines the maximum number of concurrent sessions to be allowed for each organization-defined account and/or account type.','AC-10.2','The organization being inspected/assessed defines and documents the maximum number of concurrent sessions to be allowed for each organization-defined account and/or account type.  The maximum number of concurrent sessions should be defined based upon the systems operational environment and mission needs.  DoD has determined the maximum number is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented maximum number to ensure the organization being inspected/assessed  defines the maximum number of concurrent sessions to be allowed for each organization-defined account and/or account type.  DoD has determined the maximum number is not appropriate to define at the Enterprise level.'),\n('000056','draft','2009-09-14','DISA FSO','technical','The information system retains the session lock until the user reestablishes access using established identification and authentication procedures.','AC-11.3','The organization being inspected/assessed configures the information system to retain the session lock until the user reestablishes access using established identification and authentication procedures.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 56.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to retain the session lock until the user reestablishes access using established identification and authentication procedures.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 56.'),\n('000057','draft','2009-05-19','DISA FSO','technical','The information system initiates a session lock after the organization-defined time period of inactivity.',NULL,NULL,NULL),\n('000058','draft','2009-05-19','DISA FSO','technical','The information system provides the capability for users to directly initiate session lock mechanisms.','AC-11.1','The organization being inspected/assessed configures the information system to provide the capability for users to directly initiate session lock mechanisms.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 58.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide the capability for users to directly initiate session lock mechanisms.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 58.'),\n('000059','draft','2009-09-14','DISA FSO','policy','The organization defines the time period of inactivity after which the information system initiates a session lock.','AC-11.2','DoD has defined the time period as 15 minutes.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 15 minutes.'),\n('000060','draft','2009-05-19','DISA FSO','technical','The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.','AC-11(1).1','The organization being inspected/assessed configures the information system to conceal, via the session lock, information previously visible on the display with a publicly viewable image.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 60.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  conceal, via the session lock, information previously visible on the display with a publicly viewable image.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 60.'),\n('000061','draft','2009-09-14','DISA FSO','policy','The organization identifies and defines organization-defined user actions that can be performed on the information system without identification or authentication consistent with organizational missions/business functions.','AC-14.1','The organization being inspected/assessed identifies, defines, and documents user actions that can be performed on the information system without identification or authentication consistent with organizational missions/business functions.  DoD has determined the user actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented user actions to ensure the organization being inspected/assessed identifies and defines the user actions that can be performed on the information system without identification and authentication.   DoD has determined the user actions are not appropriate to define at the Enterprise level.'),\n('000062','draft','2009-05-19','DISA FSO','policy','The organization permits actions to be performed without identification and authentication only to the extent necessary to accomplish mission/business objectives.',NULL,NULL,NULL),\n('000063','draft','2009-09-14','DISA FSO','policy','The organization defines allowed methods of remote access to the information system.','AC-17.1','The organization being inspected/assessed defines and documents the allowed methods of remote access to the information system.  The methods should be defined IAW ports, protocols, and service requirements, as well as access control requirements for any STIGs applicable to the technology in use.  DoD has determined the allowed methods of remote access are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented methods to ensure the organization being inspected/assessed defines allowed methods of remote access to the information system.  DoD has determined the allowed methods of remote access are not appropriate to define at the Enterprise level.'),\n('000064','draft','2009-05-19','DISA FSO','policy','The organization establishes usage restrictions and implementation guidance for each allowed remote access method.',NULL,NULL,NULL),\n('000065','draft','2009-09-14','DISA FSO','policy','The organization authorizes remote access to the information system prior to allowing such connections.','AC-17.5','The organization being inspected/assessed authorizes remote access to the information system prior to allowing such connections.  The organization must maintain an audit trail of authorizations.','The organization conducting the inspection/assessment obtains and examines the audit trail of authorizations to ensure the organization being inspected/assessed authorizes remote access to the information system prior to allowing such connections.'),\n('000066','draft','2009-09-14','DISA FSO','technical','The organization enforces requirements for remote connections to the information system.',NULL,NULL,NULL),\n('000067','draft','2009-09-14','DISA FSO','technical','The information system monitors remote access methods.','AC-17(1).1','The organization being inspected/assessed configures the information system to monitor remote access methods.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 67.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to monitor remote access methods.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 67.'),\n('000068','draft','2009-09-14','DISA FSO','technical','The information system implements cryptographic mechanisms to protect the confidentiality of remote access sessions.','AC-17(2).1','The organization being inspected/assessed configures the information system to  implement cryptographic mechanisms to protect the confidentiality of remote access sessions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 68.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  implement cryptographic mechanisms to protect the confidentiality of remote access sessions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 68.'),\n('000069','draft','2009-05-19','DISA FSO','policy','The information system routes all remote accesses through an organization-defined number of managed network access control points.','AC-17(3).1','The organization being inspected/assessed configures the information system to route all remote accesses through the number  of managed network access control points defined in AC-17 (3), CCI 2315.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 69.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  route all remote accesses through the number  of managed network access control points defined in AC-17 (3), CCI 2315.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 69.'),\n('000070','draft','2009-05-19','DISA FSO','policy','The organization authorizes the execution of privileged commands via remote access only for organization-defined needs.','AC-17(4).1','The organization being inspected/assessed authorizes the execution of privileged commands via remote access only for needs defined in AC-17 (4), CCI 2317.  The organization being inspected/assessed maintains an audit trail of authorizations.','The organization conducting the inspection/assessment obtains and examines the audit trail of authorizations to ensure the organization being inspected/assessed authorizes the execution of privileged commands via remote access only for needs defined in AC-17 (4), CCI 2317.'),\n('000071','draft','2009-05-19','DISA FSO','technical','The organization monitors for unauthorized remote connections to the information system on an organization-defined frequency.',NULL,NULL,NULL),\n('000072','draft','2009-09-25','DISA FSO','policy','The organization ensures that users protect information about remote access mechanisms from unauthorized use and disclosure.','AC-17(6).1','The organization being inspected/assessed implements and documents a process to ensure that users protect information about remote access mechanisms from unauthorized use and disclosure.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure that the organization being inspected/assessed ensures that users protect information about remote access mechanisms from unauthorized use and disclosure.'),\n('000073','draft','2009-11-03','DISA FSO','policy','The organization develops an organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements.','PM-1.1','DoDI 8500.01 and the Knowledge Service meet the requirement for this CCI; individual organizations and system owners must provide documentation of common control implementation in their Security Plan.','DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.'),\n('000074','draft','2009-11-03','DISA FSO','policy','The organization develops an organization-wide information security program plan that is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.','PM-1.8','DoDI 8500.01 and the Knowledge Service meet the requirement for this CCI; individual organizations and system owners must provide documentation of common control implementation in their Security Plan.','DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.'),\n('000075','draft','2009-11-03','DISA FSO','policy','The organization reviews the organization-wide information security program plan on an organization-defined frequency.','PM-1.9','DoDI 8500.01 and the Knowledge Service meet the requirement for this CCI; individual organizations and system owners must provide documentation of common control implementation in their Security Plan.','DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.'),\n('000076','draft','2009-11-03','DISA FSO','policy','The organization defines the frequency with which to review the organization-wide information security program plan.','PM-1.10','DoD has defined the frequency as reviewed annually - updated as appropriate.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.'),\n('000077','draft','2009-11-03','DISA FSO','policy','The organization updates the plan to address organizational changes and problems identified during plan implementation or security control assessments.','PM-1.11','DoDI 8500.01 and the Knowledge Service meet the requirement for this CCI; individual organizations and system owners must provide documentation of common control implementation in their Security Plan.','DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.'),\n('000078','draft','2009-11-03','DISA FSO','policy','The organization appoints a senior information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.','PM-2.1','The Deputy DoD CIO for Cyber Security is the DoD Senior Information Security Officer (SISO), appointed in writing with the mission and resources to coordinate, develop, implement and maintain a DoD-wide information security program.','DoD organizations are automatically compliant with this CCI as they are covered by the appointment of the DoD SISO.'),\n('000079','draft','2009-09-14','DISA FSO','policy','The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant information employ organization-defined additional security measures.',NULL,NULL,NULL),\n('000080','draft','2009-11-03','DISA FSO','policy','The organization ensures that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement.','PM-3.1','The organization being inspected/assessed documents and implements a process to ensure that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement.'),\n('000081','draft','2009-11-03','DISA FSO','policy','The organization employs a business case/Exhibit 300/Exhibit 53 to record the resources required.','PM-3.2','The organization being inspected/assessed documents and implements a process to employ a business case/Exhibit 300/Exhibit 53 to record the resources required.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed employs a business case/Exhibit 300/Exhibit 53 to record the resources required.'),\n('000082','draft','2009-05-19','DISA FSO','policy','The organization establishes usage restrictions for organization-controlled mobile devices.','AC-19.1','The organization being inspected/assessed establishes and documents usage restrictions for organization controlled mobile devices.','The organization conducting the inspection/assessment obtains and examines the documented usage restrictions to ensure the organization being inspected/assessed  establishes usage restrictions for organization controlled mobile devices.'),\n('000083','draft','2009-05-19','DISA FSO','policy','The organization establishes implementation guidance for organization-controlled mobile devices.','AC-19.2','The organization being inspected/assessed establishes and documents  implementation guidance for organization controlled mobile devices.','The organization conducting the inspection/assessment obtains and examines the documented implementation guidance to ensure the organization being inspected/assessed establishes implementation guidance for organization controlled mobile devices.'),\n('000084','draft','2009-09-14','DISA FSO','policy','The organization authorizes connection of mobile devices to organizational information systems.','AC-19.5','The organization being inspected/assessed authorizes connection of mobile devices to organizational information systems.  The organization must maintain an audit trail of authorizations.','The organization conducting the inspection/assessment obtains and examines the audit trail of authorizations to ensure the organization being inspected/assessed authorizes connection of mobile devices to organizational information systems.'),\n('000085','draft','2009-05-19','DISA FSO','technical','The organization monitors for unauthorized connections of mobile devices to organizational information systems.',NULL,NULL,NULL),\n('000086','draft','2009-05-19','DISA FSO','technical','The organization enforces requirements for the connection of mobile devices to organizational information systems.',NULL,NULL,NULL),\n('000087','draft','2009-05-19','DISA FSO','technical','The organization disables information system functionality that provides the capability for automatic execution of code on mobile devices without user direction.',NULL,NULL,NULL),\n('000088','draft','2009-09-14','DISA FSO','policy','The organization issues specially configured mobile devices to individuals traveling to locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.',NULL,NULL,NULL),\n('000089','draft','2009-09-14','DISA FSO','policy','The organization applies organization-defined inspection and preventative measures to mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.',NULL,NULL,NULL),\n('000090','draft','2009-05-19','DISA FSO','policy','The organization restricts the use of writable, removable media in organizational information systems.',NULL,NULL,NULL),\n('000091','draft','2009-05-19','DISA FSO','policy','The organization prohibits the use of personally-owned, removable media in organizational information systems.',NULL,NULL,NULL),\n('000092','draft','2009-05-19','DISA FSO','policy','The organization prohibits the use of removable media in organizational information systems when the media has no identifiable owner.',NULL,NULL,NULL),\n('000093','draft','2009-09-14','DISA FSO','policy','The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to access the information system from the external information systems.','AC-20.1','The organization being inspected/assessed establishes and documents terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to access the information system from the external information systems.','The organization conducting the inspection/assessment obtains and examines the documented terms and conditions to ensure the organization being inspected/assessed establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to access the information system from the external information systems.'),\n('000094','draft','2009-05-19','DISA FSO','policy','The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to process organization-controlled information using the external information systems.',NULL,NULL,NULL),\n('000095','draft','2009-05-19','DISA FSO','policy','The organization prohibits authorized individuals from using an external information system to access the information system except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.',NULL,NULL,NULL),\n('000096','draft','2009-05-19','DISA FSO','policy','The organization prohibits authorized individuals from using an external information system to access the information system or to process, store, or transmit organization-controlled information except in situations where the organization has approved information system connection or processing agreements with the organizational entity hosting the external information system.',NULL,NULL,NULL),\n('000097','draft','2009-09-14','DISA FSO','policy','The organization restricts or prohibits the use of organization-controlled portable storage devices by authorized individuals on external information systems.','AC-20(2).1','The organization being inspected/assessed','The organization conducting the inspection/assessment obtains and examines'),\n('000098','draft','2009-05-19','DISA FSO','policy','The organization facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for organization-defined information circumstances where user discretion is required.','AC-21.1','The organization being inspected/assessed documents and implements a process to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for  information circumstances defined in AC-21, CCI 1470 where user discretion is required.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed determines whether access authorizations assigned to the sharing partner match the access restrictions on the information for  information circumstances defined in AC-21, CCI 1470 where user discretion is required.'),\n('000099','draft','2009-05-19','DISA FSO','policy','The information system enforces information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.','AC-21(1).1','The organization being inspected/assessed configures the information system to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 99.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 99.'),\n('000100','draft','2009-05-20','DISA FSO','policy','The organization develops and documents a security awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','AT-1.3','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.\\n\\n\\nComment:\\nDoDD 8570.01 will be updated with DoDD 8140 once signed.\\n\\nThe organization\\'s use of their higher command policy/procedures meets this requirement if more stringent.','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.\\n\\nComment:\\nThe organization\\'s use of their higher command policy/procedures meets this requirement if more stringent.'),\n('000101','draft','2009-05-20','DISA FSO','policy','The organization disseminates a security awareness and training policy to organization-defined personnel or roles.','AT-1.4','DoD disseminates DoDD 8570.01 organization-wide via the DoD Issuances website.\\nhttp://www.dtic.mil/whs/directives/corres/dir.html','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.'),\n('000102','draft','2009-05-20','DISA FSO','policy','The organization reviews and updates the current security awareness and training policy in accordance with organization-defined frequency.','AT-1.8','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.'),\n('000103','draft','2009-05-20','DISA FSO','policy','The organization develops and documents procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls.','AT-1.6','DoD develops and documents procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls within DoDD 8570.01.  DISA\\'s DoD IA awareness CBT is the DoD baseline standard.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.'),\n('000104','draft','2009-05-20','DISA FSO','policy','The organization disseminates security awareness and training procedures to organization-defined personnel or roles.','AT-1.7','DoD disseminates DoDD 8570.01 organization-wide via the DoD Issuances website.\\nhttp://www.dtic.mil/whs/directives/corres/dir.html\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.\\n\\nDoD has defined the roles as organizational personnel with security awareness and training responsibilities.','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.\\n\\nDoD has defined the roles as organizational personnel with security awareness and training responsibilities.'),\n('000105','draft','2009-05-20','DISA FSO','policy','The organization reviews and updates the current security awareness and training procedures in accordance with an organization-defined frequency.','AT-1.9','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.\\n\\nDoD has defined the frequency as annually.','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.\\n\\nDoD has defined the frequency as annually.'),\n('000106','draft','2009-09-14','DISA FSO','policy','The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors) as part of initial training for new users.','AT-2.2','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.  DISA\\'s DoD IA awareness CBT is the DoD baseline standard.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.  DISA\\'s DoD IA awareness CBT is the DoD baseline standard.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.'),\n('000107','draft','2009-05-20','DISA FSO','policy','The organization includes practical exercises in security awareness training that simulate actual cyber attacks.','AT-2(1).1','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.  DISA\\'s DoD IA awareness CBT is the DoD baseline standard.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.  DISA\\'s DoD IA awareness CBT is the DoD baseline standard.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.'),\n('000108','draft','2009-05-20','DISA FSO','policy','The organization provides role-based security training to personnel with assigned security roles and responsibilities before authorizing access to the information system or performing assigned duties.','AT-3.1','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures. DISA\\'s DoD IA awareness CBT for privileged users is the DoD baseline standard.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures. DISA\\'s DoD IA awareness CBT for privileged users is the DoD baseline standard.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.'),\n('000109','draft','2009-05-20','DISA FSO','policy','The organization provides role-based security training to personnel with assigned security roles and responsibilities when required by information system changes.','AT-3.2','Privileged user type Security-related education/training available through DISA IASE (e.g. VTE, Skill Soft, other professional sources)  meets the provision of this control. The organization being inspected/assessed may define specific requirements within the above listed sources for their personnel.','The organization conducting the inspection/assessment obtains and examines documented records (IAW AT-4) of their privileged users training.'),\n('000110','draft','2009-05-20','DISA FSO','policy','The organization provides refresher role-based security training to personnel with assigned security roles and responsibilities in accordance with organization-defined frequency.','AT-3.3','Privileged user type Security-related education/training available through DISA IASE (e.g. VTE, Skill Soft, other professional sources)  meets the provision of this control. The organization being inspected/assessed may define specific requirements within the above listed sources for their personnel.  ','The organization conducting the inspection/assessment obtains and examines documented records (IAW AT-4) of their privileged users training.  '),\n('000111','draft','2009-05-20','DISA FSO','policy','The organization defines a frequency for providing refresher role-based security training.','AT-3.4','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as annually.'),\n('000112','draft','2009-05-20','DISA FSO','policy','The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors) when required by information system changes.','AT-2.3','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.  DISA\\'s DoD IA awareness CBT is the DoD baseline standard.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.  DISA\\'s DoD IA awareness CBT is the DoD baseline standard.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.'),\n('000113','draft','2009-09-14','DISA FSO','policy','The organization documents individual information system security training activities, including basic security awareness training and specific information system security training.','AT-4.1','The organization being inspected/assessed identifies and documents training activities to include basic security awareness training (per AT-2) and role-based security related training (per AT-3) IAW DoD 8570.01M.','The organization conducting the inspection/assessment obtains and examines the security awareness training activities to ensure the organization being inspected/assessed documents training activities to include basic security awareness training (per AT-2) and role-based security related training (per AT-3) IAW DoD 8570.01M.'),\n('000114','draft','2009-09-14','DISA FSO','policy','The organization monitors individual information system security training activities, including basic security awareness training and specific information system security training.','AT-4.2','The organization being inspected/assessed maintains and monitors records identifying personnel who have received training and the date the training was received','The organization conducting the inspection/assessment obtains and examines records identifying personnel who have received training and the date the training was received'),\n('000115','draft','2009-09-14','DISA FSO','policy','The organization establishes contact with selected groups and associations within the security community to facilitate ongoing security education and training; to stay up to date with the latest recommended security practices, techniques, and technologies; and to share current security-related information including threats, vulnerabilities, and incidents.',NULL,NULL,NULL),\n('000116','draft','2009-09-14','DISA FSO','policy','The organization institutionalizes contact with selected groups and associations within the security community to facilitate ongoing security education and training; to stay up to date with the latest recommended security practices, techniques, and technologies; and to share current security-related information including threats, vulnerabilities, and incidents.',NULL,NULL,NULL),\n('000117','draft','2009-05-20','DISA FSO','policy','The organization develops and documents an audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','AU-1.3','The organization being inspected/assessed develops and documents an audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','The organization conducting the inspection/assessment obtains and examines the audit and accountability policy to ensure that the audit and accountability policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.'),\n('000118','draft','2009-05-20','DISA FSO','policy','The organization disseminates a formal, documented, audit and accountability policy to elements within the organization having associated audit and accountability roles and responsibilities.',NULL,NULL,NULL),\n('000119','draft','2009-05-20','DISA FSO','policy','The organization reviews and updates the audit and accountability policy on an organization-defined frequency.','AU-1.7','The organization being inspected/assessed reviews and updates the audit and accountability policy annually.  The organization must maintain an audit trail of reviews and updates.  Any changes or acceptance of the document without change must be captured in the audit trail.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the audit and accountability policy annually.   DoD has defined the frequency as annually.'),\n('000120','draft','2009-05-20','DISA FSO','policy','The organization develops and documents procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.','AU-1.5','The organization being inspected/assessed develops and documents procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.','The organization conducting the inspection/assessment obtains and examines the audit and accountability procedures to ensure that the procedures facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.'),\n('000121','draft','2009-05-20','DISA FSO','policy','The organization disseminates formal, documented, procedures to elements within the organization having associated audit and accountability roles and responsibilities.',NULL,NULL,NULL),\n('000122','draft','2009-05-20','DISA FSO','policy','The organization reviews and updates the audit and accountability procedures on an organization-defined frequency.','AU-1.9','The organization being inspected/assessed reviews and updates the audit and accountability procedures annually.  The organization must maintain an audit trail of reviews and updates.  Any changes or acceptance of the document without change must be captured in the audit trail.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the audit and accountability procedures annually.   DoD has defined the frequency as annually.'),\n('000123','draft','2009-09-15','DISA FSO','policy','The organization determines the information system must be capable of auditing an organization-defined list of auditable events.','AU-2.1','The organization being inspected/assessed determines whether the information system is capable of auditing:\\n\t- Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g. Classification levels),\\n\t- Successful and unsuccessful logon attempts,\\n\t- Privileged activities or other system level access,\\n\t- Starting and ending time for user access to the system,\\n\t- Concurrent logons from different workstations,\\n\t- Successful and unsuccessful accesses to objects,\\n\t- All program initiations,\\n\t- All direct access to the information system,\\n\t- All account creations, modifications, disabling, and terminations,\\n\t- All kernel module load, unload, and restart. The organization must document those auditable events that are not captured.\\n\\nDoD has defined the information system auditable events as successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g. classification levels). Successful and unsuccessful logon attempts, Privileged activities or other system level access, Starting and ending time for user access to the system, Concurrent logons from different workstations, Successful and unsuccessful accesses to objects, All program initiations, All direct access to the information system.  All account creations, modifications, disabling, and terminations. All kernel module load, unload, and restart.','The organization conducting the inspection/assessment obtains and examines the documentation of the auditable events to ensure the information system is capable of auditing the:\\n\t- Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g. Classification levels),\\n\t- Successful and unsuccessful logon attempts,\\n\t- Privileged activities or other system level access,\\n\t- Starting and ending time for user access to the system,\\n\t- Concurrent logons from different workstations,\\n\t- Successful and unsuccessful accesses to objects,\\n\t- All program initiations,\\n\t- All direct access to the information system,\\n\t- All account creations, modifications, disabling, and terminations,\\n\t- All kernel module load, unload, and restart.\\n\\n DoD has defined the information system auditable events as successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g. classification levels). Successful and unsuccessful logon attempts, Privileged activities or other system level access, Starting and ending time for user access to the system, Concurrent logons from different workstations, Successful and unsuccessful accesses to objects, All program initiations, All direct access to the information system.  All account creations, modifications, disabling, and terminations. All kernel module load, unload, and restart.'),\n('000124','draft','2009-09-15','DISA FSO','policy','The organization coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events.','AU-2.3','The organization being inspected/assessed documents and implements within the audit and accountability policy and procedures, a process to coordinate the additional auditable events.  The objective is to enhance mutual support and to help guide the selection of auditable events.\\n\\nThe organization must maintain artifacts of the coordination.','The organization conducting the inspection/assessment obtains and examines the audit and accountability policy and procedures as well as artifacts of the coordination to determine if coordination is necessary and if necessary, whether it has been performed.'),\n('000125','draft','2009-09-15','DISA FSO','policy','The organization provides a rationale for why the list of auditable events is deemed to be adequate to support after-the-fact investigations of security incidents.','AU-2.4','The organization being inspected/assessed documents in the audit and accountability policy the list of auditable system events, the organization provides clearly stated rationale for the selection of each system event.  The rationale will support any after-action investigations of security event.','The organization conducting the inspection/assessment obtains and examines the audit and accountability policy and procedures to ensure the organization being inspected/assess has defined the auditable system events, rationale for the selection, and that the organization has defined how the auditable events will support after-action investigations of security events.'),\n('000126','draft','2009-09-15','DISA FSO','policy','The organization determines that the organization-defined subset of the auditable events defined in AU-2 are to be audited within the information system.','AU-2.5','The organization conducting the inspection/assessment reviews the documented audit process as well as audit logs to ensure that the organization being inspected/assessed audits all auditable events defined in AU-2 (a) per occurrence.\\n\\nDoD has defined the actions as all auditable events defined in AU-2 (a) per occurrence.','The organization conducting the inspection/assessment reviews the documented audit process as well as audit logs to ensure that the organization being inspected/assessed audits all auditable events defined in AU-2 (a) per occurrence.\\n\\nDoD has defined the actions as all auditable events defined in AU-2 (a) per occurrence.'),\n('000127','draft','2009-05-20','DISA FSO','policy','The organization reviews and updates the list of organization-defined audited events on an organization-defined frequency.','AU-2(3).1','The organization being inspected/assessed will conduct reviews of the list of auditable events as defined in AU-2 (d), CCI 1485 annually or more frequently upon changes to situational awareness of threats or vulnerabilities.  The organization will generate and maintain an audit trail to document the completion of the review and update actions.  DoD has defined the frequency as annually or more frequently upon changes to situational awareness of threats or vulnerabilities.','The organization conducting the inspection/assessment reviews the audit trail showing reviews and updates to the list of audited events to ensure that the list is reviewed and updated  annually or more frequently upon changes to situational awareness of threats or vulnerabilities.  DoD has defined the frequency as annually or more frequently upon changes to situational awareness of threats or vulnerabilities.'),\n('000128','draft','2009-05-20','DISA FSO','policy','The organization includes execution of privileged functions in the list of events to be audited by the information system.',NULL,NULL,NULL),\n('000129','draft','2009-09-15','DISA FSO','policy','The organization defines in the auditable events that the information system must be capable of auditing based on a risk assessment and mission/business needs.',NULL,NULL,NULL),\n('000130','draft','2009-05-20','DISA FSO','technical','The information system generates audit records containing information that establishes what type of event occurred.','AU-3.1','The organization being inspected/assessed configures the information system to generate audit records containing information that establishes what type of event occurred    For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 130.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to generate audit records containing information that establishes what type of event occurred.  The organization conducting the inspection/assessment reviews the audit records generated to ensure that the records contain  information that establishes what type of event occurred.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 130.'),\n('000131','draft','2009-05-20','DISA FSO','technical','The information system generates audit records containing information that establishes when an event occurred.','AU-3.2','The organization being inspected/assessed configures the information system to generate audit records containing information that establishes when an event occurred    For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 131.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to generate audit records containing information that establishes when an event occurred.  The organization conducting the inspection/assessment reviews the audit records generated to ensure that the records contain  information that establishes when an event occurred.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 131.'),\n('000132','draft','2009-05-20','DISA FSO','technical','The information system generates audit records containing information that establishes where the event occurred.','AU-3.3','The organization being inspected/assessed configures the information system to generate audit records containing information that establishes where the event occurred    For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 132.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to generate audit records containing information that establishes where the event occurred.  The organization conducting the inspection/assessment reviews the audit records generated to ensure that the records contain  information that establishes where the event occurred.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 132.'),\n('000133','draft','2009-05-20','DISA FSO','technical','The information system generates audit records containing information that establishes the source of the event.','AU-3.4','The organization being inspected/assessed configures the information system to generate audit records containing information that establishes the source of the event.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 133.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to generate audit records containing information that establishes the source of the event.  The organization conducting the inspection/assessment reviews the audit records generated to ensure that the records contain  information that establishes the source of the event.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 133.'),\n('000134','draft','2009-05-20','DISA FSO','technical','The information system generates audit records containing information that establishes the outcome of the event.','AU-3.5','The organization being inspected/assessed configures the information system to generate audit records containing information that establishes the outcome of the event.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 134.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to generate audit records containing information that establishes the outcome of the event.  The organization conducting the inspection/assessment reviews the audit records generated to ensure that the records contain  information that establishes the outcome of the event.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 134.'),\n('000135','draft','2009-05-20','DISA FSO','technical','The information system generates audit records containing the organization-defined additional, more detailed information that is to be included in the audit records.','AU-3(1).1','The organization being inspected/assessed configures the information system to generate audit records containing the organization defined additional, more detailed information as defined in AU-3 (1), CCI 1488 that is to be included in the audit records.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 135.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to generate audit records containing the organization defined additional, more detailed information as defined in AU-3 (1), CCI 1488 that is to be included in the audit records.  The organization conducting the inspection/assessment reviews the audit records generated to ensure that the records contain organization defined additional, more detailed information that is to be included in the audit records.\\n\\n\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 135.'),\n('000136','draft','2009-05-20','DISA FSO','technical','The organization centrally manages the content of audit records generated by organization-defined information system components.',NULL,NULL,NULL),\n('000137','draft','2009-05-20','DISA FSO','policy','The organization allocates audit record storage capacity.',NULL,NULL,NULL),\n('000138','draft','2009-05-20','DISA FSO','technical','The organization configures auditing to reduce the likelihood of storage capacity being exceeded.',NULL,NULL,NULL),\n('000139','draft','2009-09-15','DISA FSO','technical','The information system alerts designated organization-defined personnel or roles in the event of an audit processing failure.','AU-5.1','The organization being inspected/assessed configures the information system to alert at a minimum, the SCA and ISSO in the event of an audit processing failure.   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 139.  DoD has defined the personnel or roles as at a minimum, the SCA and ISSO. ','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to alert at a minimum, the SCA and ISSO in the event of an audit processing failure.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 139.   DoD has defined the personnel or roles as at a minimum, the SCA and ISSO. '),\n('000140','draft','2009-05-20','DISA FSO','technical','The information system takes organization-defined actions upon audit failure (e.g., shut down information system, overwrite oldest audit records, stop generating audit records).','AU-5.3','The organization being inspected/assessed configures the information system to take actions as defined in AU-5, CCI 1490 upon audit failure.   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 140.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to take actions as defined in AU-5, CCI 1490 upon audit failure.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 140.'),\n('000141','draft','2009-11-03','DISA FSO','policy','The organization ensures that information security resources are available for expenditure as planned.','PM-3.3','The organization being inspected/assessed documents and implements a process to ensure that information security resources are available for expenditure as planned.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensure that information security resources are available for expenditure as planned.'),\n('000142','draft','2009-11-03','DISA FSO','policy','The organization implements a process for ensuring that plans of action and milestones for the security program and the associated organizational information systems are maintained.','PM-4.1','DoDI 8510.01 and the Knowledge Service meet the DoD requirements to maintain a process for plans of action and milestones for the security program.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01 and the Knowledge Service.','DoDI 8510.01 and the Knowledge Service meet the DoD requirements to maintain a process for plans of action and milestones for the security program.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01 and the Knowledge Service.'),\n('000143','draft','2009-05-20','DISA FSO','technical','The information system provides a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum audit record storage capacity.',NULL,NULL,NULL),\n('000144','draft','2009-05-20','DISA FSO','technical','The information system provides a real-time alert when organization-defined audit failure events occur.',NULL,NULL,NULL),\n('000145','draft','2009-05-20','DISA FSO','policy','The information system enforces configurable network communications traffic volume thresholds reflecting limits on auditing capacity by delaying or rejecting network traffic which exceeds the organization-defined thresholds.','AU-5(3).1','The organization being inspected/assessed configures the information system to delay network communications traffic exceeding the thresholds defined in AU-5 (3), CCI 1859.  DoD has defined the action to take as delay.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 145.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to delay network communications traffic exceeding the thresholds defined in AU-5 (3), CCI 1859.  DoD has defined the action to take as delay.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 145.'),\n('000146','draft','2009-05-20','DISA FSO','policy','The organization defines the percentage of maximum audit record storage capacity that when exceeded, a warning is provided.',NULL,NULL,NULL),\n('000147','draft','2009-05-22','DISA FSO','policy','The organization defines the audit failure events requiring real-time alerts.','AU-5(2).1','DoD has defined the audit failure events as all.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the audit failure events as all.'),\n('000148','draft','2009-05-22','DISA FSO','policy','The organization reviews and analyzes information system audit records on an organization-defined frequency for indications of organization-defined inappropriate or unusual activity.','AU-6.1','The organization being inspected/assessed documents and implements a process to review and analyze information system audit records every seven days or more frequently if required by an alarm event or anomaly for indications of activity defined in AU-6, CCI 1862.  The organization must maintain an audit trail of the reviews.  DoD has defined the frequency as every seven days or more frequently if required by an alarm event or anomaly.','The organization conducting the inspection/assessment obtains and examines the documented process for audit trail reviews as well as the audit trail showing the reviews to ensure the organization being inspected/assessed reviews and analyzes information system audit records every seven days or more frequently if required by an alarm event or anomaly for indications of activity defined in AU-6, CCI 1862.  DoD has defined the frequency as every seven days or more frequently if required by an alarm event or anomaly.'),\n('000149','draft','2009-05-22','DISA FSO','policy','The organization reports any findings to organization-defined personnel or roles for indications of organization-defined inappropriate or unusual activity.','AU-6.4','The organization being inspected/assessed documents and implements a process for reporting any findings of inappropriate or unusual activity as defined in AU-6, CCI 1862 to  at a minimum, the ISSO and ISSM.   DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.','The organization conducting the inspection/assessment obtains and examines the documented process for reporting findings as well as a sampling of historical reports to ensure the organization being inspected/assessed reports any findings of inappropriate or unusual activity as defined in AU-6, CCI 1862 to  at a minimum, the ISSO and ISSM.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.'),\n('000150','draft','2009-09-15','DISA FSO','policy','The organization adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk to organizational operations, organizational assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information.',NULL,NULL,NULL),\n('000151','draft','2009-09-15','DISA FSO','policy','The organization defines the frequency for the review and analysis of information system audit records for organization-defined inappropriate or unusual activity.','AU-6.2','DoD has defined the frequency as every seven days or more frequently if required by an alarm event or anomaly.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every seven days or more frequently if required by an alarm event or anomaly.'),\n('000152','draft','2009-05-22','DISA FSO','technical','The information system integrates audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.',NULL,NULL,NULL),\n('000153','draft','2009-05-22','DISA FSO','policy','The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.','AU-6(3).1','The organization being inspected/assessed documents and implements a process to analyze and correlate audit records across different repositories to gain organization-wide situational awareness.  The organization must maintain a record of the analysis.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of analysis to ensure the organization being inspected/assessed analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.'),\n('000154','draft','2009-05-22','DISA FSO','technical','The information system provides the capability to centrally review and analyze audit records from multiple components within the system.','AU-6(4).1','The organization being inspected/assessed configures the information system to provide a  capability to centrally review and analyze audit records from multiple components within the system.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 154.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to provide a  capability to centrally review and analyze audit records from multiple components within the system.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 154.'),\n('000155','draft','2009-09-15','DISA FSO','policy','The organization integrates analysis of audit records with analysis of vulnerability scanning information, performance data, and network monitoring information to further enhance the ability to identify inappropriate or unusual activity.',NULL,NULL,NULL),\n('000156','draft','2009-05-22','DISA FSO','technical','The information system provides an audit reduction capability.',NULL,NULL,NULL),\n('000157','draft','2009-05-22','DISA FSO','technical','The information system provides a report generation capability.',NULL,NULL,NULL),\n('000158','draft','2009-05-22','DISA FSO','technical','The information system provides the capability to process audit records for events of interest based on organization-defined audit fields within audit records.','AU-7(1).1','The organization being inspected/assessed must employ information systems that provide the capability to process audit records for events of interest based on audit fields within audit records defined in AU-7 (1), CCI 1883.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 158.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed employs information systems that  provides the capability to process audit records for events of interest based on audit fields within audit records as defined in AU-7 (1), CCI 1883.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 158.'),\n('000159','draft','2009-05-22','DISA FSO','technical','The information system uses internal system clocks to generate time stamps for audit records.','AU-8.1','The organization being inspected/assessed configures the information system to use internal system clocks to generate time stamps for audit records.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 159.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to use internal system clocks to generate time stamps for audit records.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 159.'),\n('000160','draft','2009-05-22','DISA FSO','technical','The information system synchronizes internal information system clocks on an organization-defined frequency with an organization-defined authoritative time source.',NULL,NULL,NULL),\n('000161','draft','2009-05-22','DISA FSO','policy','The organization defines the frequency for the synchronization of internal information system clocks.','AU-8(1).1','DoD has defined the frequency as every 24 hours for networked systems.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every 24 hours for networked systems.'),\n('000162','draft','2009-05-22','DISA FSO','technical','The information system protects audit information from unauthorized access.','AU-9.1','The organization being inspected/assessed configures the information system to disallow unauthorized access to audit information.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 162.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to disallow unauthorized access to audit information.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 162.'),\n('000163','draft','2009-05-22','DISA FSO','technical','The information system protects audit information from unauthorized modification.','AU-9.2','The organization being inspected/assessed configures the information system to disallow unauthorized modification of audit information.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 163.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to disallow unauthorized modification of audit information.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 163.'),\n('000164','draft','2009-05-22','DISA FSO','technical','The information system protects audit information from unauthorized deletion.','AU-9.3','The organization being inspected/assessed configures the information system to disallow unauthorized deletion of audit information.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 164.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to disallow unauthorized deletion of audit information.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 164.'),\n('000165','draft','2009-05-22','DISA FSO','policy','The information system writes audit records to hardware-enforced, write-once media.','AU-9(1).1','The organization being inspected/assessed configures the information system to write audit records to hardware-enforced, write-once media.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 165.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to write audit records to hardware-enforced, write-once media.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 165.'),\n('000166','draft','2009-05-22','DISA FSO','technical','The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.','AU-10.1','The organization being inspected/assessed configures the information system to protect against an individual falsely denying having performed actions to be covered by non-repudiation defined in DoDI 8520.02 and DoDI 8520.03.  DoDI 8520.02 and DoDI 8520.03 meet the DoD requirement to define the actions to be covered by non-repudiation.   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 166.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed  protects against an individual falsely denying having performed actions to be covered by non-repudiation defined in DoDI 8520.02 and DoDI 8520.03.  DoDI 8520.02 and DoDI 8520.03 meet the DoD requirement to define the actions to be covered by non-repudiation.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 166.'),\n('000167','draft','2009-05-22','DISA FSO','policy','The organization retains audit records for an organization-defined time period to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.','AU-11.1','The organization being inspected/assessed will take action to ensure it retains audit records for 5 years for SAMI; otherwise for at least 1 year to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.  DoD has defined the time period as 5 years for SAMI; otherwise for at least 1 year.','The organization conducting the inspection/assessment reviews the information system audit records and any other relevant documents or records to ensure the organization being inspected/assessed retains its audit records for 5 years for SAMI; otherwise for at least 1 year.  DoD has defined the time period as 5 years for SAMI; otherwise for at least 1 year.'),\n('000168','draft','2009-09-15','DISA FSO','policy','The organization defines the time period for retention of audit records, which is consistent with its records retention policy, to provide support for after-the-fact investigations of security incidents and meet regulatory and organizational information retention requirements.','AU-11.2','DoD has defined the time period as 5 years for SAMI; otherwise for at least 1 year.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 5 years for SAMI; otherwise for at least 1 year.'),\n('000169','draft','2009-05-22','DISA FSO','technical','The information system provides audit record generation capability for the auditable events defined in AU-2 a. at organization-defined information system components.','AU-12.1','The organization being inspected/assessed acquires or designs all information system and network components that provide audit record generation capability for the auditable events defined in AU-2 a.   DoD has defined the information system components as all information system and network components.','The organization conducting the inspection/assessment examines the information system to ensure that all information system and network components provide audit record generation capability for the auditable events defined in AU-2 a.  DoD has defined the information system components as all information system and network components.'),\n('000170','draft','2009-11-03','DISA FSO','policy','The organization implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.','PM-4.3','DoDI 8510.01 and the Knowledge Service meet the DoD requirements to maintain a process to document the remedial information security actions that mitigate risk to organizational operations and assets, individuals, other organizations, and the Nation.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01 and the Knowledge Service.','DoDI 8510.01 and the Knowledge Service meet the DoD requirements to maintain a process to document the remedial information security actions that mitigate risk to organizational operations and assets, individuals, other organizations, and the Nation.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01 and the Knowledge Service.'),\n('000171','draft','2009-09-15','DISA FSO','technical','The information system allows organization-defined personnel or roles to select which auditable events are to be audited by specific components of the information system.','AU-12.3','The organization being inspected/assessed configures the information system to ensure that only the ISSM or individuals appointed by the ISSM select which auditable events are to be audited by specific components of the  information system.  DoD has defined the personnel or roles as the ISSM or individuals appointed by the ISSM.','The organization conducting the inspection/assessment examines a sampling of information system components and confirms that the individuals capable of selecting auditable events are the ISSM or individuals appointed by the ISSM.  DoD has defined the personnel or roles as the ISSM or individuals appointed by the ISSM.'),\n('000172','draft','2009-09-15','DISA FSO','technical','The information system generates audit records for the events defined in AU-2 d. with the content defined in AU-3.','AU-12.5','The organization being inspected/assessed configures the information system to  generate audit records for the events defined in AU-2 d with the content defined in AU-3.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 172.','The organization conducting the inspection/assessment examines the information system to ensure that the system generates audit records for the events defined in AU-2 d with the content defined in AU-3.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 172.'),\n('000173','draft','2009-09-15','DISA FSO','policy','The organization defines the level of tolerance for relationship between time stamps of individual records in the audit trail that will be used for correlation.','AU-12(1).1','The organization being inspected/assessed will define and document their level of tolerance for variation in the time stamps applied to the audit data generated by the organization\\'s information systems.\\n\\nDoD has determined that the level of tolerance is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment reviews the organization\\'s audit and accountability policy and procedures addressing audit record generation and retention; information system audit configuration settings and associated documentation; information system audit records; and any other relevant documents or records.  The objective is to validate the organization has defined and documented its level of tolerance for variation in the time stamps applied to the audit data generated by the organization\\'s information systems.\\n\\nDoD has determined that the level of tolerance is not appropriate to define at the Enterprise level.'),\n('000174','draft','2009-05-22','DISA FSO','technical','The information system compiles audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail.','AU-12(1).2','The organization being inspected/assessed configures the information system to compile audit records from information system components defined in AU-12 (1), CCI 1577 into a system-wide (logical or physical) audit trail that is time-correlated to within the level of tolerance defined in AU-12 (1), CCI-000173 for relationship between time stamps of individual records in the audit trail.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 174.','The organization conducting the inspection/assessment examines the information system to ensure the information system is configured to compile audit records from information system components defined in AU-12 (1), CCI 1577 into a system-wide (logical or physical) audit trail that is time-correlated to within the level of tolerance  defined in AU-12 (1), CCI-000173 for relationship between time stamps of individual records in the audit trail.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 174.'),\n('000175','draft','2009-05-22','DISA FSO','policy','The organization manages information system authenticators for users and devices by verifying, as part of the initial authenticator distribution, the identity of the individual and/or device receiving the authenticator.',NULL,NULL,NULL),\n('000176','draft','2009-05-22','DISA FSO','policy','The organization manages information system authenticators by establishing initial authenticator content for authenticators defined by the organization.','IA-5.2','The organization being inspected/assessed defines and documents procedures for setting  initial authenticator content.','The organization conducting the inspection/assessment obtains and examines the documented procedures for setting initial authenticator content to ensure they have been defined.'),\n('000177','draft','2009-05-22','DISA FSO','policy','The organization manages information system authenticators for users and devices by establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators.',NULL,NULL,NULL),\n('000178','draft','2009-05-22','DISA FSO','policy','The organization manages information system authenticators for users and devices by changing default content of authenticators upon information system installation.',NULL,NULL,NULL),\n('000179','draft','2009-05-22','DISA FSO','policy','The organization manages information system authenticators by establishing minimum lifetime restrictions for authenticators.','IA-5.13','The organization being inspected/assessed defines and documents minimum lifetime restrictions for authenticators.','The organization conducting the inspection/assessment obtains and examines the documented minimum lifetime restrictions for authenticators to ensure they have been defined.'),\n('000180','draft','2009-05-22','DISA FSO','policy','The organization manages information system authenticators by establishing maximum lifetime restrictions for authenticators.','IA-5.14','Per IA-5, CCI 1610, DoD has established the maximum lifetime restrictions for authenticators as CAC - every 3 years, or 1 year from term of contract   Password: 60 days   Biometrics: every 3 years.','Per IA-5, CCI 1610, DoD has established the maximum lifetime restrictions for authenticators as CAC - every 3 years, or 1 year from term of contract   Password: 60 days   Biometrics: every 3 years.'),\n('000181','draft','2009-05-22','DISA FSO','policy','The organization manages information system authenticators by establishing reuse conditions for authenticators.','IA-5.15','The organization being inspected/assessed defines and documents the  reuse conditions for authenticators.','The organization conducting the inspection/assessment obtains and examines the documented reuse conditions for authenticators to ensure they have been defined.'),\n('000182','draft','2009-05-22','DISA FSO','policy','The organization manages information system authenticators by changing/refreshing authenticators in accordance with the organization-defined time period by authenticator type.','IA-5.16','The organization being inspected/assessed documents and implements procedures for  changing/refreshing authenticators in the following time periods:  CAC - every 3 years, or 1 year from term of contract   Password: 60 days   Biometrics: every 3 years.  DoD has defined the time period as CAC - every 3 years, or 1 year from term of contract   Password: 60 days   Biometrics: every 3 years.','The organization conducting the inspection/assessment obtains and examines the documented procedures for authenticator change/refresh to ensure the procedures are defined.   The organization conducting the inspection/assessment obtains and examines a sampling of authenticator age data to ensure that authenticators are changed or refreshed  in the following time periods:  CAC - every 3 years, or 1 year from term of contract   Password: 60 days   Biometrics: every 3 years.  DoD has defined the time period as CAC - every 3 years, or 1 year from term of contract   Password: 60 days   Biometrics: every 3 years.'),\n('000183','draft','2009-05-22','DISA FSO','policy','The organization manages information system authenticators by protecting authenticator content from unauthorized disclosure.','IA-5.19','The organization being inspected/assessed documents and implements procedures to protect authenticator content from unauthorized disclosure.','The organization conducting the inspection/assessment obtains and examines the documented procedures to protect  authenticator content from unauthorized disclosure to ensure the procedures are defined.'),\n('000184','draft','2009-05-22','DISA FSO','policy','The organization manages information system authenticators by requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators.',NULL,NULL,NULL),\n('000185','draft','2009-09-15','DISA FSO','technical','The information system, for PKI-based authentication, validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.','IA-5(2).1','The information system performing hardware token-based authentication must be configured to validate DoD-approved PKI credentials in accordance with RFC 5280.  The information system must be configured to perform a revocation check as part of the certificate validation process.  Revocation checking may be performed using certificate revocation lists (CRLs) published by the issuing PKI or Online Certificate Status Protocol (OCSP) services.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 185.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to validate DoD-approved PKI credentials in accordance with RFC 5280.  The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to perform a revocation check as part of the certificate validation process.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 185.'),\n('000186','draft','2009-09-15','DISA FSO','technical','The information system, for PKI-based authentication, enforces authorized access to the corresponding private key.','IA-5(2).2','Information systems must not have access to users private keys.  The cryptographic container in which the private keys are stored (e.g. smart card or software module) implements access controls and protections to ensure that only the authorized user can activate the private key.  DoD users agree to protect their PKI credentials in accordance with the DD-2842 agreement that is executed for each credential.  They are reminded of these responsibilities in annual IA training.   The private key identifying the information system must be stored in a cryptographic container that is FIPS 140-2 validated.  Only authorized information system operators should have access to activation data (e.g. password or PIN) for the private key.','The organization conducting the inspection/assessment examines the information system to ensure the information system does not contain any users private keys.  The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to store its own private key in a FIPS 140-2 validated cryptographic module.'),\n('000187','draft','2009-09-15','DISA FSO','technical','The information system, for PKI-based authentication, maps the authenticated identity to the account of the individual or group.','IA-5(2).3','The information system performing PKI-based authentication must be configured to map the authenticated PKI credential to a corresponding network or information system account or role in accordance with DoDI 8520.03.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 187.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to map authenticated PKI credentials to corresponding network or information system accounts or roles in accordance with DoDI 8520.03.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 187.'),\n('000188','draft','2009-09-15','DISA FSO','policy','The organization requires that the registration process to receive an organizational-defined type of authenticator be carried out in person before a designated registration authority with authorization by a designated organizational official (e.g., a supervisor).',NULL,NULL,NULL),\n('000189','draft','2009-09-15','DISA FSO','policy','The organization employs automated tools to determine if authenticators are sufficiently strong to resist attacks intended to discover or otherwise compromise the authenticators.',NULL,NULL,NULL),\n('000190','draft','2009-09-15','DISA FSO','policy','The organization requires vendors/manufacturers of information system components to provide unique authenticators or change default authenticators prior to delivery.',NULL,NULL,NULL),\n('000191','deprecated','2009-09-15','DISA FSO','policy','The organization enforces password complexity by the number of special characters used.',NULL,NULL,NULL),\n('000192','draft','2009-09-15','DISA FSO','technical','The information system enforces password complexity by the minimum number of upper case characters used.','IA-5(1).1','The organization being inspected/assessed configures the information system to enforce password complexity by the minimum number of upper case characters used.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 192.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce password complexity by the minimum number of upper case characters used.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 192.'),\n('000193','draft','2009-09-15','DISA FSO','technical','The information system enforces password complexity by the minimum number of lower case characters used.','IA-5(1).2','The organization being inspected/assessed configures the information system to enforce password complexity by the minimum number of lower case characters used.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 193.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce password complexity by the minimum number of lower case characters used.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 193.'),\n('000194','draft','2009-09-15','DISA FSO','technical','The information system enforces password complexity by the minimum number of numeric characters used.','IA-5(1).4','The organization being inspected/assessed configures the information system to enforce password complexity by the minimum number of numeric characters used.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 194.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce password complexity by the minimum number of numeric characters used.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 194.'),\n('000195','draft','2009-09-15','DISA FSO','technical','The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.','IA-5(1).10','The organization being inspected/assessed configures the information system to enforce that at least 50% of the minimum password length is changed.\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 195.\\nDoD has defined the minimum number of characters as 50% of the minimum password length.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce that at least 50% of the minimum password length is changed.\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 195.\\nDoD has defined the minimum number of characters as 50% of the minimum password length.'),\n('000196','draft','2009-09-15','DISA FSO','technical','The information system, for password-based authentication, stores only cryptographically-protected passwords.','IA-5(1).12','The organization being inspected/assessed configures the information system to store only encrypted representations of passwords.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 196.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to store only encrypted representations of passwords.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 196.'),\n('000197','draft','2009-09-15','DISA FSO','technical','The information system, for password-based authentication, transmits only cryptographically-protected passwords.','IA-5(1).13','The organization being inspected/assessed configures the information system to transmit only encrypted representations of passwords.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 197.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to transmit only encrypted representations of passwords.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 197.'),\n('000198','draft','2009-09-15','DISA FSO','technical','The information system enforces minimum password lifetime restrictions.','IA-5(1).14','The organization being inspected/assessed configures the information system to enforce minimum password lifetime restrictions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 198.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce minimum password lifetime restrictions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 198.'),\n('000199','draft','2009-09-15','DISA FSO','technical','The information system enforces maximum password lifetime restrictions.','IA-5(1).15','The organization being inspected/assessed configures the information system to enforce maximum password lifetime restrictions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 199.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce maximum password lifetime restrictions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 199.'),\n('000200','draft','2009-05-22','DISA FSO','technical','The information system prohibits password reuse for the organization-defined number of generations.','IA-5(1).18','The organization being inspected/assessed configures the information system to prohibit reuse for a minimum of 5 generations.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 200.  DoD has defined the number of generations as a minimum of 5.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to prohibit reuse for a minimum of 5 generations.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 200.  DoD has defined the number of generations as a minimum of 5.'),\n('000201','draft','2009-05-22','DISA FSO','policy','The organization protects authenticators commensurate with the security category of the information to which use of the authenticator permits access.','IA-5(6).1','The organization being inspected/assessed documents and implements procedures to protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.','The organization conducting the inspection/assessment obtains and examines the documented procedures to ensure the organization being inspected/assessed  protects authenticators commensurate with the security category of the information to which use of the authenticator permits access.'),\n('000202','draft','2009-05-22','DISA FSO','policy','The organization ensures unencrypted static authenticators are not embedded in access scripts.','IA-5(7).1','The organization being inspected/assessed documents and implements requirements that unencrypted static authenticators not be embedded in access scripts.','The organization conducting the inspection/assessment obtains and examines the requirements that unencrypted static authenticators not be embedded in access scripts to ensure the organization being inspected/assessed ensures unencrypted static authenticators are not embedded in access scripts.'),\n('000203','draft','2009-05-22','DISA FSO','policy','The organization ensures unencrypted static authenticators are not stored on function keys.','IA-5(7).2','The organization being inspected/assessed documents and implements requirements that unencrypted static authenticators not be stored on function keys.','The organization conducting the inspection/assessment obtains and examines the requirements that unencrypted static authenticators not be stored on function keys to ensure the organization being inspected/assessed  ensures unencrypted static authenticators are not stored on function keys.'),\n('000204','draft','2009-05-22','DISA FSO','policy','The organization defines the security safeguards required to manage the risk of compromise due to individuals having accounts on multiple information systems.','IA-5(8).1','DoD has defined the security safeguards as policies and user training including advising users not to use the same password for any of the following:  Domains of differing classification levels.  More than one domain of a classification level (e.g., internal agency network and Intelink).  More than one privilege level (e.g., user, administrator).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the security safeguards as policies and user training including advising users not to use the same password for any of the following:  Domains of differing classification levels.  More than one domain of a classification level (e.g., internal agency network and Intelink).  More than one privilege level (e.g., user, administrator).'),\n('000205','draft','2009-05-22','DISA FSO','technical','The information system enforces minimum password length.','IA-5(1).3','The organization being inspected/assessed configures the information system to enforce minimum password length.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 205.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce minimum password length.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 205.'),\n('000206','draft','2009-05-22','DISA FSO','technical','The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.','IA-6.1','The organization being inspected/assessed configures the information system to obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 206.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 206.'),\n('000207','draft','2009-11-03','DISA FSO','policy','The organization develops and maintains an inventory of its information systems.','PM-5.1','DITPR is the inventory for all DoD information systems.\\n\\nThe organization being inspected/assessed must register and maintain their information systems in DITPR.','DITPR is the inventory for all DoD information systems.\\n\\nThe organization conducting the inspection/assessment obtains and examines the inventory of information systems via DITPR to ensure the organization being inspected/assessed registers their information systems in DITPR.'),\n('000208','draft','2009-09-14','DISA FSO','policy','The organization determines normal time-of-day and duration usage for information system accounts.',NULL,NULL,NULL),\n('000209','draft','2009-11-03','DISA FSO','policy','The organization develops the results of information security measures of performance.','PM-6.1','The Federal Information Systems Management Act (FISMA) meets the DoD requirements for information security performance measures of performance.','The Federal Information Systems Management Act (FISMA) meets the DoD requirements for information security performance measures of performance.\\n\\nDoD organizations are automatically compliant with this CCI as they are covered at the DoD level by FISMA.'),\n('000210','draft','2009-11-03','DISA FSO','policy','The organization monitors the results of information security measures of performance.','PM-6.2','The Federal Information Systems Management Act (FISMA) meets the DoD requirements for information security performance measures of performance.','The Federal Information Systems Management Act (FISMA) meets the DoD requirements for information security performance measures of performance.\\n\\nDoD organizations are automatically compliant with this CCI as they are covered at the DoD level by FISMA.'),\n('000211','draft','2009-11-03','DISA FSO','policy','The organization reports on the results of information security measures of performance.','PM-6.3','The organization being inspected/assessed reports the results of information security measures of performance IAW FISMA reporting guidance.','The organization conducting the inspection/assessment obtains and examines FISMA reporting documentation.'),\n('000212','draft','2009-11-03','DISA FSO','policy','The organization develops an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.','PM-7.1','The GIG IA Architecture meets the DoD requirements for enterprise architecture.\\n\\nDoD components are automatically compliant with this CCI as they covered at the DoD level.','The GIG IA Architecture meets the DoD requirements for enterprise architecture.\\n\\nDoD components are automatically compliant with this CCI as they covered at the DoD level.'),\n('000213','draft','2009-09-14','DISA FSO','technical','The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.','AC-3.1','The organization being inspected/assessed configures the information system to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 213.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 213.'),\n('000214','draft','2009-09-14','DISA FSO','policy','The organization establishes a Discretionary Access Control (DAC) policy that limits propagation of access rights.',NULL,NULL,NULL),\n('000215','draft','2009-09-14','DISA FSO','policy','The organization establishes a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user.',NULL,NULL,NULL),\n('000216','draft','2009-11-03','DISA FSO','policy','The organization develops and documents a critical infrastructure and key resource protection plan that addresses information security issues.','PM-8.1','DoDD 3020.40 meets the DoD requirement for the development of a critical infrastructure and key resource protection plan.\\n\\nDoD components are automatically compliant with this CCI as they are covered by the DoD level, DoDD 3020.40.','DoDD 3020.40 meets the DoD requirement for the development of a critical infrastructure and key resource protection plan.\\n\\nDoD components are automatically compliant with this CCI as they are covered by the DoD level, DoDD 3020.40.'),\n('000217','draft','2009-09-24','DISA FSO','policy','The organization defines a time period after which inactive accounts are automatically disabled.','AC-2(3).2','DoD has defined the time period as 35 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 35 days.'),\n('000218','draft','2009-09-14','DISA FSO','technical','The information system, when transferring information between different security domains, identifies information flows by data type specification and usage.',NULL,NULL,NULL),\n('000219','draft','2009-09-14','DISA FSO','technical','The information system, when transferring information between different security domains, decomposes information into organization-defined policy-relevant subcomponents for submission to policy enforcement mechanisms.','AC-4(13).1','The organization being inspected/assessed configures the information system to decompose information into policy-relevant subcomponents defined in AC-4 (13), CCI 2202 for submission to policy enforcement mechanisms when transferring information between different security domains   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 219.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  decompose information into policy-relevant subcomponents defined in AC-4 (13), CCI 2202 for submission to policy enforcement mechanisms when transferring information between different security domains   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 219.'),\n('000221','draft','2009-09-14','DISA FSO','technical','The information system enforces security policies regarding information on interconnected systems.',NULL,NULL,NULL),\n('000223','draft','2009-09-14','DISA FSO','technical','The information system binds security attributes to information to facilitate information flow policy enforcement.',NULL,NULL,NULL),\n('000224','draft','2009-09-14','DISA FSO','technical','The information system tracks problems associated with the security attribute binding.',NULL,NULL,NULL),\n('000225','draft','2009-09-14','DISA FSO','policy','The organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.','AC-6.1','The organization being inspected/assessed documents and implements the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.','The organization conducting the inspection/assessment obtains and examines the documented processes to ensure that the organization being inspected/assessed implements the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.'),\n('000226','draft','2009-09-14','DISA FSO','technical','The information system provides the capability for a privileged administrator to configure organization-defined security policy filters to support different security policies.',NULL,NULL,NULL),\n('000227','draft','2009-11-03','DISA FSO','policy','The organization develops a comprehensive strategy to manage risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems.','PM-9.1','DoD Risk Management Framework meets the requirement for a comprehensive organizational risk strategy.\\n\\nDoD components are automatically compliant with this CCI because they are covered by the DoD Risk Management Framework (DoDI 8510.01).','DoD Risk Management Framework meets the requirement for a comprehensive organizational risk strategy.\\n\\nDoD components are automatically compliant with this CCI because they are covered by DoD Risk Management Framework (DoDI 8510.01).'),\n('000228','draft','2009-11-03','DISA FSO','policy','The organization implements a comprehensive strategy to manage risk to organization operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems consistently across the organization.','PM-9.2','DoD Risk Management Framework meets the requirement for a comprehensive organizational risk strategy.\\n\\nDoD components are automatically compliant with this CCI because they are covered by the DoD Risk Management Framework (DoDI 8510.01).','DoD Risk Management Framework meets the requirement for a comprehensive organizational risk strategy.\\n\\nDoD components are automatically compliant with this CCI because they are covered by DoD Risk Management Framework (DoDI 8510.01).'),\n('000229','draft','2009-11-03','DISA FSO','policy','The organization documents the security state of organizational information systems and the environments in which those systems operate through security authorization processes.','PM-10.1','DoDI 8510.01 meets the DoD requirement to manage the security authorization process.\\n\\nDoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.','DoDI 8510.01 meets the DoD requirement to manage the security authorization process.\\n\\nDoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.'),\n('000230','draft','2009-11-03','DISA FSO','policy','The organization tracks the security state of organizational information systems and the environments in which those systems operate through security authorization processes.','PM-10.2','DoDI 8510.01 meets the DoD requirement to manage the security authorization process.\\n\\nDoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.','DoDI 8510.01 meets the DoD requirement to manage the security authorization process.\\n\\nDoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.'),\n('000231','draft','2009-11-03','DISA FSO','policy','The organization reports the security state of organizational information systems and the environments in which those systems operate through security authorization processes.','PM-10.3','DoDI 8510.01 meets the DoD requirement to manage the security authorization process.\\n\\nDoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.','DoDI 8510.01 meets the DoD requirement to manage the security authorization process.\\n\\nDoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.'),\n('000232','draft','2009-09-14','DISA FSO','policy','The organization documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification and authentication.','AC-14.2','The organization being inspected/assessed  documents supporting rationale in the security plan for the actions defined in AC-14, CCI 61 to not require identification and authentication.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed documents the supporting rationale for the actions defined in AC-14, CCI 61 to not require identification and authentication.'),\n('000233','draft','2009-11-03','DISA FSO','policy','The organization designates individuals to fulfill specific roles and responsibilities within the organizational risk management process.','PM-10.4','DoDI 8510.01 meets the DoD requirement to  designate roles and responsibilities for the risk management process.\\n\\nDoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.','DoDI 8510.01 meets the DoD requirement to  designate roles and responsibilities for the risk management process.\\n\\nDoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.'),\n('000234','draft','2009-11-03','DISA FSO','policy','The organization fully integrates the security authorization processes into an organization-wide risk management program.','PM-10.5','DoDI 8510.01 meets the DoD requirement to fully integrate the security authorization process.\\n\\nDoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.','DoDI 8510.01 meets the DoD requirement to fully integrate the security authorization process.\\n\\nDoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01.'),\n('000235','draft','2009-11-04','DISA FSO','policy','The organization defines mission/business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.','PM-11.1','DoDI 8510.01 meets the DoD requirement to define mission/business processes.\\n\\nDoD components are automatically complaint with this CCI as they are covered at the DoD level, DoDI 8510.01.','DoDI 8510.01 meets the DoD requirement to define mission/business processes.\\n\\nDoD components are automatically complaint with this CCI as they are covered at the DoD level, DoDI 8510.01.'),\n('000236','draft','2009-11-04','DISA FSO','policy','The organization determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until an achievable set of protection needs are obtained.','PM-11.2','The organization being inspected/assessed determines information protection needs IAW CNSSI 1253 and as identified in RA-2.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the security categorization has been documented IAW CNSSI 1253.'),\n('000237','draft','2009-06-23','DISA FSO','policy','The organization manages information system accounts by specifically authorizing and monitoring the use of guest/anonymous accounts and temporary accounts.',NULL,NULL,NULL),\n('000238','draft','2009-09-15','DISA FSO','policy','The organization defines the frequency to review and update the current security assessment and authorization policy.','CA-1.7','DoD has defined the frequency as every 5 years.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as every 5 years.'),\n('000239','draft','2009-09-15','DISA FSO','policy','The organization develops and documents a security assessment and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','CA-1.3','DoDI 8510.01 meets the DoD requirement for security assessment authorization policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01.','DoDI 8510.01 meets the DoD requirement for security assessment authorization policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01.'),\n('000240','draft','2009-09-15','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles a security assessment and authorization policy.','CA-1.4','DoD disseminates DoDI 8510.01 organization-wide via the DoD Issuances website. http://www.dtic.mil/whs/directives/corres/ins1.html','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01.'),\n('000241','draft','2009-09-15','DISA FSO','policy','The organization reviews and updates the current security assessment and authorization policy in accordance with organization-defined frequency.','CA-1.8','DoDI 8510.01 meets the DoD requirement for security assessment authorization policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01.','DoDI 8510.01 meets the DoD requirement for security assessment authorization policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01.'),\n('000242','draft','2009-09-15','DISA FSO','policy','The organization develops and documents procedures to facilitate the implementation of the security assessment and authorization policy and associated security assessment and authorization controls.','CA-1.5','The organization being inspected/assessed develops and documents, IAW DoDI 8510.01, procedures to facilitate the implementation of the security assessment and authorization policy and associated security assessment and authorization controls.','The organization conducting the inspection/assessment obtains and examines the procedures to ensure the organization being inspected/assessed develops and documents procedures to facilitate the implementation of the security assessment and authorization policy and associated security assessment and authorization controls IAW DoDI 8510.01'),\n('000243','draft','2009-09-15','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the security assessment and authorization policy and associated security assessment and authorization controls.','CA-1.6','The organization being inspected/assessed will require all personnel to register at the DTIC website to receive update notifications to facilitate the implementation of the security assessment and authorization policy and associated security assessment and authorization controls.\\n\\nDoD has defined the personnel or roles as all personnel.','The organization conducting the inspection/assessment obtains and examines the AUP (Acceptable Use Policy), appointment orders, or written policy requiring that all personnel register at the DTIC website to receive update notifications.\\n\\nDoD has defined the personnel or roles as all personnel.'),\n('000244','draft','2009-09-15','DISA FSO','policy','The organization reviews and updates the current security assessment and authorization procedures in accordance with organization-defined frequency.','CA-1.9','The organization being inspected/assessed reviews and updates, IAW DoDI 8510.01,  the current security assessment and authorization procedures annually.\\n\\nThe organization must maintain an audit trail of review and update activity.\\n\\nDoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines the audit trail of review and update activity to ensure the organization being inspected/assessed reviews and updates, IAW DoDI 8510.01,  the current security assessment and authorization procedures annually.'),\n('000245','draft','2009-09-15','DISA FSO','policy','The organization develops a security assessment plan for the information system and its environment of operation.','CA-2.1','The organization being inspected/assessed will document these security assessment plan requirements as part of the DoD approved Security Plan.  Security plan templates are provided through eMASS and the Knowledge Service.  *Comment* The items required within this control are being split into the security plan and security assessment report to eliminate creation of an additional artifact.','The organization conducting the inspection/assessment obtains and examines the Security Plan to validate *security assessment blocks* are complete.'),\n('000246','draft','2009-09-15','DISA FSO','policy','The organization\\'s security assessment plan describes the security controls and control enhancements under assessment.','CA-2.2','The organization being inspected/assessed will ensure the Security Plan identifies the security controls and control enhancements under assessment.  *Comment* The items required within this control are being split into the security plan and security assessment report to eliminate creation of an additional artifact.','The organization conducting the inspection/assessment obtains the security assessment plan to verify the plan identifies the security controls and those control enhancements under assessment.'),\n('000247','draft','2009-09-15','DISA FSO','policy','The organization\\'s security assessment plan describes assessment procedures to be used to determine security control effectiveness.','CA-2.3','The implementation guidance and validation procedures posted on the Knowledge Service constitutes assessment procedures for DoD.\\n\\nIf organizations being inspected/assessed use assessment procedures other than those posted on the Knowledge Service, those procedures must be documented.\\n\\n*Comment*\\nThe items required within this CCI are being split into the security plan and security assessment report to eliminate creation of an additional artifact.','DoD components are automatically compliant with this CCI if using the implementation guidance and validation procedures on the Knowledge Service.\\n\\nIf the organization being inspected/assessed is using alternative implementation guidance and validation procedures, the organization conducting the inspection/assessment will obtain and examine those procedures.'),\n('000248','draft','2009-09-15','DISA FSO','policy','The organization\\'s security assessment plan describes assessment environment.','CA-2.4','The organization being inspected/assessed will provide a description of the authorization boundary in their Security Plan.  Authorization boundary can be described via one or more of the following: network diagrams, data flow diagrams, system design documents, or a list of information system components.  Authorization boundary as defined in CNSSI 4009.  *Comment* The items required within this control are being split into the security plan and security assessment report to eliminate creation of an additional artifact.','The organization conducting the inspection/assessment obtains and examines the organization\\'s authorization boundary.  Authorization boundary can be described via one or more of the following: network diagrams, data flow diagrams, system design documents, or a list of information system components.'),\n('000249','draft','2009-09-15','DISA FSO','policy','The organizations security assessment plan describes the assessment team.',NULL,NULL,NULL),\n('000250','draft','2009-09-15','DISA FSO','policy','The organization\\'s security assessment plan describes assessment roles and responsibilities.',NULL,NULL,NULL),\n('000251','draft','2009-09-15','DISA FSO','policy','The organization assesses, on an organization-defined frequency, the security controls in the information system and its environment of operation to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements.','CA-2.6','In accordance with DoD\\'s published guidance, the organization being inspected/assessed will utilize the implementation guidance and validation procedures published on the Knowledge Service to evaluate the implementation status of the applicable controls.  DoD has defined the frequency as annually for technical controls, annually for a portion of management and operational controls, such that all are reviewed in a 3 year period, except for those requiring more frequent review as defined in other site or overarching policy. (NOTE: Technical, Management and Operational is IAW NIST SP 800-53 Table 1-1).  *Comment* The items required within this control are being split into the security plan and security assessment report to eliminate creation of an additional artifact.','See CA-2 c  \\\"The organization conducting the inspection/assessment obtains and examines the security assessment report to verify that it includes the compliance/non-compliance status of all controls and specific deficiencies for all non-compliant controls.\\\"'),\n('000252','draft','2009-09-15','DISA FSO','policy','The organization defines the frequency on which the security controls in the information system and its environment of operation are assessed.','CA-2.7','DoD has defined the frequency as annually for technical controls, annually for a portion of management and operation controls such that all are reviewed in a 3 year period except for those requiring more frequent review as defined in other site or overarching policy. NOTE: Technical, Management and Operational is IAW NIST SP 800-53 Table 1-1.  *Comment* The items required within this control are being split into the security plan and security assessment report to eliminate creation of an additional artifact.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as annually for technical controls, annually for a portion of management and operation controls such that all are reviewed in a 3 year period except for those requiring more frequent review as defined in other site or overarching policy. NOTE: Technical, Management and Operational is IAW NIST SP 800-53 Table 1-1.'),\n('000253','draft','2009-09-15','DISA FSO','policy','The organization produces a security assessment report that documents the results of the assessment against the information system and its environment of operation.','CA-2.8','The organization being inspected/assessed will develop a SAR that includes the compliance/non-compliance status of all controls and specific deficiencies for all non-compliant controls using the template available on the Knowledge Service.  *Comment* The items required within this control are being split into the security plan and security assessment report to eliminate creation of an additional artifact.','The organization conducting the inspection/assessment obtains and examines the SAR to verify that it includes the compliance/non-compliance status of all controls and specific deficiencies for all non-compliant controls.'),\n('000254','draft','2009-09-15','DISA FSO','policy','The organization provides the results of the security control assessment against the information system and its environment of operation to organization-defined individuals or roles.','CA-2.9','The organization being inspected/assessed will provide the SAR to at a minimum, the ISSO and ISSM.  DoD has defined the individuals or roles as at a minimum, the ISSO and ISSM.  *Comment* The items required within this control are being split into the security plan and security assessment report to eliminate creation of an additional artifact.  ','The organization conducting the inspection/assessment interviews  at a minimum, the ISSO and ISSM to ensure the SAR has been received.  DoD has defined the individuals or roles as at a minimum, the ISSO and ISSM.  '),\n('000255','draft','2009-09-15','DISA FSO','policy','The organization employs assessors or assessment teams with an organization-defined level of independence to conduct security control assessments of organizational information systems.','CA-2(1).1','The organization being inspected/assessed will employ assessors and assessor teams with the level of independence defined in CA-2 (1), CCI 2064 to conduct security control assessments of organizational information systems.','The organization conducting the inspection/assessment obtains and examines  the level of independence defined in CA-2 (1), CCI 2064 to ensure that they, as the assessor, meet the required level of independence.'),\n('000256','draft','2009-09-15','DISA FSO','policy','The organization includes, as part of security control assessments announced or unannounced, one or more of the following: in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment; performance/load testing; and organization-defined other forms of security assessment on an organization-defined frequency.','CA-2(2).1','The organization being assessed/inspected must document how they will annually conduct tests and exercises of the implemented security controls in their security assessment plan. The tests and exercises may consist of activities such as in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment; performance/load testing; or other forms of security assessment defined in CA-2 (2), CCI 1582.  Vulnerability scans are not the same as penetration testing.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines the test and exercise plan documented in the security assessment plan as well as the results of one or more of the latest security assessments to ensure the organization being inspected/assessed is conducting the assessments required in their security assessment plan annually.  DoD has defined the frequency as annually.'),\n('000257','draft','2009-09-15','DISA FSO','policy','The organization authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements.','CA-3.1','The organization being inspected/assessed  will develop and certify, by appropriate signatures (e.g. AO, network managers), Interconnection Security Agreements (e.g., MOU, MOA, SLA) authorizing the connection of its information systems to other information systems.   Policy Note: Interconnection security agreements are required for systems connecting between enclaves that require the hosting enclave to enable PPS outside of their already established and approved business practices.  Connections can include both DoD enclaves or non DoD enclaves.','The organization conducting the inspection/assessment obtains and examines documentation of the Interconnection Security Agreements to include appropriate signatures.  Policy Note: Interconnection security agreements are required for systems connecting between enclaves that require the hosting enclave to enable PPS outside of their already established and approved business practices.  Connections can include both DoD enclaves or non DoD enclaves.'),\n('000258','draft','2009-09-15','DISA FSO','policy','The organization documents, for each interconnection, the interface characteristics.','CA-3.2','The organization being inspected/assessed will document the interface characteristics for each interconnection.  Use of external reporting databases for these characteristics when tied to the specific interconnection is acceptable (e.g., ports, protocols, and services).  Policy Note: Interconnection security agreements are required for systems connecting between enclaves that require the hosting enclave to enable PPS outside of their already established and approved business practices.  Connections can include both DoD enclaves or non DoD enclaves.','The organization conducting the inspection/assessment obtains and examines interconnection security agreement documentation.  Policy Note: Interconnection security agreements are required for systems connecting between enclaves that require the hosting enclave to enable PPS outside of their already established and approved business practices.  Connections can include both DoD enclaves or non DoD enclaves.'),\n('000259','draft','2009-09-15','DISA FSO','policy','The organization documents, for each interconnection, the security requirements.','CA-3.3','The organization being inspected/assessed will, for each interconnection, identify and document any additional security controls to be implemented to protect the confidentiality, integrity, and availability of the connected systems and the data passing between them.  Controls should be appropriate for the systems to be connected and the environment in which the interconnection will operate.  Policy Note: Interconnection security agreements are required for systems connecting between enclaves that require the hosting enclave to enable PPS outside of their already established and approved business practices.  Connections can include both DoD enclaves or non DoD enclaves.','The organization conducting the inspection/assessment obtains and examines interconnection security agreement documentation, specifically looking at any additional security controls identified for  implementation.  Policy Note: Interconnection security agreements are required for systems connecting between enclaves that require the hosting enclave to enable PPS outside of their already established and approved business practices.  Connections can include both DoD enclaves or non DoD enclaves.'),\n('000260','draft','2009-09-15','DISA FSO','policy','The organization documents, for each interconnection, the nature of the information communicated.','CA-3.4','The organization being inspected/assessed will document in the interconnection security agreement the type of information being transferred/transmitted.  Characteristics will include but are not limited to: classification, information type (e.g. PII, HIPAA, FOUO, financial data, etc.)     Policy Note: Interconnection security agreements are required for systems connecting between enclaves that require the hosting enclave to enable PPS outside of their already established and approved business practices.  Connections can include both DoD enclaves or non DoD enclaves.','The organization conducting the inspection/assessment obtains and examines the interconnection security agreement documentation, specifically to identify the type of information being transferred/transmitted.  Characteristics will include but are not limited to: classification, information type (e.g. PII, HIPAA, FOUO, financial data, etc.)     Policy Note: Interconnection security agreements are required for systems connecting between enclaves that require the hosting enclave to enable PPS outside of their already established and approved business practices.  Connections can include both DoD enclaves or non DoD enclaves.'),\n('000261','draft','2009-09-15','DISA FSO','policy','The organization monitors the information system connections on an ongoing basis to verify enforcement of security requirements.',NULL,NULL,NULL),\n('000262','draft','2009-09-15','DISA FSO','policy','The organization prohibits the direct connection of an organization-defined unclassified, national security system to an external network without the use of an organization-defined boundary protection device.','CA-3(1).1','The organization being inspected/assessed documents in its policy and procedures addressing information system connections, the organization will prohibit DoD has defined the unclassified, national security systems as all unclassified NSS from having a direct connection to an external network without the use of a boundary protection device defined in CA-3 (1), CCI 262.  DoD has defined the unclassified, national security systems as all unclassified NSS.','The organization conducting the inspection/assessment obtains and examines policy document prohibiting direct connection of all unclassified NSS to external networks without the use of a boundary protection device defined in CA-3 (1), CCI 262.  DoD has defined the unclassified, national security systems as all unclassified NSS.'),\n('000263','draft','2009-09-15','DISA FSO','policy','The organization prohibits the direct connection of a classified, national security system to an external network without the use of organization-defined boundary protection device.','CA-3(2).1','The organization being inspected/assessed does not connect any national security systems to an external network without the use of protection devices defined in CA-3 (2), CCI 2074.','The organization conducting the inspection/assessment obtains and examines network topology diagrams and examines the information system to ensure the organization being inspected/assessed does not connect any national security systems to an external network without the use of protection devices defined in CA-3 (2), CCI 2074.'),\n('000264','draft','2009-09-15','DISA FSO','policy','The organization develops a plan of action and milestones for the information system to document the organization^s planned remedial actions to correct weaknesses or deficiencies noted during the assessment of the security controls and to reduce or eliminate known vulnerabilities in the system.','CA-5.1','The organization being inspected/assessed will develop a security POA&M in accordance with DoDI 8510.01 Enclosure 6.  POA&M templates are available on the Knowledge Service.','The organization conducting the inspection/assessment obtains and examines the security POA&M for compliance with DoDI 8510.01.'),\n('000265','draft','2009-09-15','DISA FSO','policy','The organization defines the frequency with which to update the existing plan of action and milestones for the information system.','CA-5.2','DoD has defined the frequency as at least every 90 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as at least every 90 days.'),\n('000266','draft','2009-09-15','DISA FSO','policy','The organization updates, on an organization-defined frequency, the existing plan of action and milestones for the information system based on the findings from security controls assessments, security impact analyses, and continuous monitoring activities.','CA-5.3','The organization being inspected/assessed will update the POA&M at least every 90 days.  The updates are to be based upon the assessment of the identified vulnerabilities and weaknesses, prioritization of the vulnerabilities and weaknesses, progress being made in addressing and resolving the security weaknesses and vulnerabilities found in programs and systems, and continuous monitoring activities.  DoD has defined the frequency as at least every 90 days.','The organization conducting the inspection/assessment obtains and examines current POA&M. The objective is to validate the organization is providing updates to the POA&M at least every 90 days. Review of POA&M without change must be documented (i.e., adding review date to the POA&M header information).  DoD has defined the frequency as at least every 90 days.'),\n('000267','draft','2009-09-15','DISA FSO','policy','The organization employs automated mechanisms to help ensure the plan of action and milestones for the information system is accurate.','CA-5(1).1','The organization being inspected/assessed will identify and document the automated mechanisms in use to ensure the security POA&M is accurate.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000268','draft','2009-09-15','DISA FSO','policy','The organization employs automated mechanisms to help ensure the plan of action and milestones for the information system is up to date.','CA-5(1).2','The organization being inspected/assessed will identify and document the automated mechanisms in use to ensure the POA&M is up to date.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000269','draft','2009-09-15','DISA FSO','policy','The organization employs automated mechanisms to help ensure the plan of action and milestones for the information system is readily available.','CA-5(1).3','The organization being inspected/assessed will identify and document the automated mechanisms in use to ensure the POA&M is readily available.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000270','draft','2009-09-15','DISA FSO','policy','The organization assigns a senior-level executive or manager as the authorizing official for the information system.','CA-6.1','The organization being inspected/assessed will assign a senior-level executive or manager as the official role, and the responsibility, for authorizing the information system(s).  Assignment must be in writing and IAW with DoDI 8510.01 (i.e. Appointment memorandum).','The organization conducting the inspection/assessment obtains and examines the written appointment memorandum.'),\n('000271','draft','2009-09-15','DISA FSO','policy','The organization ensures the authorizing official authorizes the information system for processing before commencing operations.','CA-6.2','The organization being inspected/assessed will ensure that an authorization document (e.g. authorization to operate (ATO), interim authorization to operate (IATO)) has been issued by the authorizing official (AO) prior to placing the information system into an operational status.','The organization conducting the inspection/assessment obtains and examines the authorization document to ensure the information system is authorized prior to  being placed into operational status.'),\n('000272','draft','2009-09-15','DISA FSO','policy','The organization updates the security authorization on an organization-defined frequency.','CA-6.3','The organization being inspected/assessed updates the security authorization at least every three years, whenever there is a significant change to the system, or if there is a change to the environment in which the system operates.  DoD has defined the frequency as at least every three years, whenever there is a significant change to the system, or if there is a change to the environment in which the system operates.','The organization conducting the inspection/assessment obtains and examines the security authorization documentation to confirm the security authorization has been updated within the last three years, when there was a significant change to the system, or if there was a change to the environment in which the system operates.  DoD has defined the frequency as at least every three years, whenever there is a significant change to the system, or if there is a change to the environment in which the system operates.'),\n('000273','draft','2009-09-15','DISA FSO','policy','The organization defines the frequency with which to update the security authorization.','CA-6.4','DoD has defined the frequency as at least every three years, whenever there is a significant change to the system, or if there is a change to the environment in which the system operates.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as at least every three years, whenever there is a significant change to the system, or if there is a change to the environment in which the system operates.'),\n('000274','draft','2009-09-15','DISA FSO','policy','The organization develops a continuous monitoring strategy.','CA-7.1','Future DoD-wide CM guidance to be published','Future DoD-wide CM guidance to be published'),\n('000275','draft','2009-09-15','DISA FSO','policy','The organization implements a continuous monitoring program that includes a configuration management process for the information system.',NULL,NULL,NULL),\n('000276','draft','2009-09-15','DISA FSO','policy','The organization implements a continuous monitoring program that includes a configuration management process for the information system constituent components.',NULL,NULL,NULL),\n('000277','draft','2009-09-15','DISA FSO','policy','The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the information system.',NULL,NULL,NULL),\n('000278','draft','2009-09-15','DISA FSO','policy','The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the environment of operation.',NULL,NULL,NULL),\n('000279','draft','2009-09-15','DISA FSO','policy','The organization implements a continuous monitoring program that includes ongoing security control assessments in accordance with the organizational continuous monitoring strategy.','CA-7.5','Future DoD-wide CM guidance to be published','Future DoD-wide CM guidance to be published'),\n('000280','draft','2009-09-15','DISA FSO','policy','The organization implements a continuous monitoring program that includes reporting the security status of the organization and the information system to organization-defined personnel or roles on an organization-defined frequency.','CA-7.9','Future DoD-wide CM guidance to be published','Future DoD-wide CM guidance to be published'),\n('000281','draft','2009-09-15','DISA FSO','policy','The organization defines the frequency with which to report the security status of the organization and the information system to organization-defined personnel or roles.','CA-7.10','Future DoD-wide CM guidance to be published','Future DoD-wide CM guidance to be published'),\n('000282','draft','2009-09-15','DISA FSO','policy','The organization employs assessors or assessment teams with an organization-defined level of independence to monitor the security controls in the information system on an ongoing basis.','CA-7(1).1','Future DoD-wide CM guidance to be published','Future DoD-wide CM guidance to be published'),\n('000283','draft','2009-09-15','DISA FSO','policy','The organization plans announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.',NULL,NULL,NULL),\n('000284','draft','2009-09-15','DISA FSO','policy','The organization schedules announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.',NULL,NULL,NULL),\n('000285','draft','2009-09-15','DISA FSO','policy','The organization conducts announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures.',NULL,NULL,NULL),\n('000286','draft','2009-09-17','DISA FSO','policy','The organization defines a frequency with which to review and update the configuration management policies.','CM-1.7','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('000287','draft','2009-09-17','DISA FSO','policy','The organization develops and documents a configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','CM-1.3','The organization being inspected/assessed develops and documents a configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','The organization conducting the inspection/assessment obtains and examines the  configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.'),\n('000288','draft','2009-09-17','DISA FSO','policy','The organization disseminates formal, documented configuration management policy to elements within the organization having associated configuration management roles and responsibilities.',NULL,NULL,NULL),\n('000289','draft','2009-09-17','DISA FSO','policy','The organization reviews and updates, on an organization-defined frequency, the configuration management policy.','CM-1.8','The organization being inspected/assessed reviews and updates, annually, the configuration management policy.  The organization must document each occurrence of the reviews and update actions as an audit trail.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines documentation of occurrence of reviews and update actions for the configuration management policy to ensure annual review and necessary updates are occurring.   DoD has defined the frequency as annually.'),\n('000290','draft','2009-09-17','DISA FSO','policy','The organization develops and documents procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.','CM-1.5','The organization being inspected/assessed develops and documents procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.','The organization conducting the inspection/assessment obtains and examines the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.'),\n('000291','draft','2009-09-17','DISA FSO','policy','The organization disseminates formal, documented procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.',NULL,NULL,NULL),\n('000292','draft','2009-09-17','DISA FSO','policy','The organization reviews and updates, on an organization-defined frequency, the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.','CM-1.9','The organization being inspected/assessed reviews and updates, annually, the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.  The organization must document each occurrence of the reviews and update actions as an audit trail.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines documentation of occurrence of reviews and update actions for the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls to ensure annual review and necessary updates are occurring.   DoD has defined the frequency as annually.'),\n('000293','draft','2009-09-17','DISA FSO','policy','The organization develops a current baseline configuration of the information system.','CM-2.1','The organization being inspected/assessed develops and documents a current baseline configuration of the information system.','The organization conducting the inspection/assessment obtains and examines  the documented baseline configuration.'),\n('000294','draft','2009-09-17','DISA FSO','policy','The organization documents a baseline configuration of the information system.',NULL,NULL,NULL),\n('000295','draft','2009-09-17','DISA FSO','policy','The organization maintains, under configuration control, a current baseline configuration of the information system.','CM-2.2','The organization being inspected/assessed maintains a current baseline configuration of the information system.','The organization conducting the inspection/assessment obtains and examines the current baseline to ensure the current configuration matches the current documented baseline.'),\n('000296','draft','2009-09-17','DISA FSO','policy','The organization reviews and updates the baseline configuration of the information system at an organization-defined frequency.','CM-2(1).1','The organization being inspected/assessed reviews and updates the baseline configuration of the information system annually.  The organization must document each occurrence of the reviews and update actions as an audit trail.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines documentation of organizational reviews and update actions for the baseline configuration to ensure annual review and necessary updates are occurring.   DoD has defined the frequency as annually.'),\n('000297','draft','2009-09-17','DISA FSO','policy','The organization reviews and updates the baseline configuration of the information system when required due to organization-defined circumstances.','CM-2(1).3','The organization being inspected/assessed reviews and updates the baseline configuration of the information system when required due to baseline configuration changes or as events dictate  such as changes due to USCYBERCOM tactical orders/ directives or cyber attacks.  The organization must document each occurrence of the reviews and update actions as an audit trail.  DoD has defined the circumstances as baseline configuration changes or as events dictate  such as changes due to USCYBERCOM tactical orders/ directives or cyber attacks.','The organization conducting the inspection/assessment obtains and examines documentation of organizational reviews and update actions for the baseline configuration  of the information system when required due to baseline configuration changes or as events dictate  such as changes due to USCYBERCOM tactical orders/ directives or cyber attacks to ensure review and necessary updates are occurring.   DoD has defined the circumstances as baseline configuration changes or as events dictate  such as changes due to USCYBERCOM tactical orders/ directives or cyber attacks.'),\n('000298','draft','2009-09-17','DISA FSO','policy','The organization reviews and updates the baseline configuration of the information system as an integral part of information system component installations.','CM-2(1).5','The organization being inspected/assessed reviews and updates the baseline configuration of the information system as an integral part of information system component installations.  The organization must document each occurrence of the reviews and update actions as an audit trail.','The organization conducting the inspection/assessment obtains and examines documentation of organizational reviews and update actions for the baseline configuration  of the information system as an integral part of information system component installations to ensure review and necessary updates are occurring.'),\n('000299','draft','2009-09-17','DISA FSO','policy','The organization reviews and updates the baseline configuration of the information system as an integral part of information system component upgrades.','CM-2(1).6','The organization being inspected/assessed reviews and updates the baseline configuration of the information system as an integral part of information system component upgrades.  The organization must document each occurrence of the reviews and update actions as an audit trail.','The organization conducting the inspection/assessment obtains and examines documentation of organizational reviews and update actions for the baseline configuration  of the information system as an integral part of information system component upgrades to ensure review and necessary updates are occurring.'),\n('000300','draft','2009-09-17','DISA FSO','policy','The organization employs automated mechanisms to maintain a complete baseline configuration of the information system.','CM-2(2).1','The organization being inspected/assessed identifies, documents, and implements automated mechanisms used to maintain complete baseline configuration of the information system.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms used to maintain complete baseline configuration of the information system.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000301','draft','2009-09-17','DISA FSO','policy','The organization employs automated mechanisms to maintain an up-to-date baseline configuration of the information system.','CM-2(2).2','The organization being inspected/assessed identifies, documents, and implements automated mechanisms used to maintain an up-to-date baseline configuration of the information system.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms used to maintain an up-to-date baseline configuration of the information system.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000302','draft','2009-09-17','DISA FSO','policy','The organization employs automated mechanisms to maintain an accurate baseline configuration of the information system.','CM-2(2).3','The organization being inspected/assessed identifies, documents, and implements automated mechanisms used to maintain accurate baseline configuration of the information system.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms used to maintain accurate baseline configuration of the information system.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000303','draft','2009-09-17','DISA FSO','policy','The organization employs automated mechanisms to maintain a readily available baseline configuration of the information system.','CM-2(2).4','The organization being inspected/assessed identifies, documents, and implements automated mechanisms used to maintain readily available baseline configuration of the information system.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms used to maintain readily available baseline configuration of the information system.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000304','draft','2009-09-17','DISA FSO','policy','The organization retains organization-defined previous versions of baseline configurations of the information system to support rollback.','CM-2(3).1','The organization being inspected/assessed retains the previous approved baseline configuration of IS components for a minimum of 3 months and documents baseline configuration to support rollback.  The goal is to verify that the IS can roll back components to previous versions.  DoD has defined the previous versions as the previous approved baseline configuration of IS components for a minimum of 3 months.','The organization conducting the inspection/assessment obtains and examines the documentation of the previous version of the baseline configuration to determine if all IS components necessary for rollback are retained.  DoD has defined the previous versions as the previous approved baseline configuration of IS components for a minimum of 3 months.'),\n('000305','draft','2009-09-17','DISA FSO','policy','The organization develops a list of software programs not authorized to execute on the information system.',NULL,NULL,NULL),\n('000306','draft','2009-09-17','DISA FSO','policy','The organization maintains the list of software programs not authorized to execute on the information system.',NULL,NULL,NULL),\n('000307','draft','2009-09-17','DISA FSO','policy','The organization employs an allow-all, deny-by-exception authorization policy to identify software allowed to execute on the information system.',NULL,NULL,NULL),\n('000308','draft','2009-09-17','DISA FSO','policy','The organization develops the list of software programs authorized to execute on the information system.',NULL,NULL,NULL),\n('000309','draft','2009-09-17','DISA FSO','policy','The organization maintains the list of software programs authorized to execute on the information system.',NULL,NULL,NULL),\n('000310','draft','2009-09-17','DISA FSO','policy','The organization employs a deny-all, permit-by-exception authorization policy to identify software allowed to execute on the information system.',NULL,NULL,NULL),\n('000311','draft','2009-09-17','DISA FSO','policy','The organization maintains a baseline configuration for information system development environments that is managed separately from the operational baseline configuration.','CM-2(6).1','The organization being inspected/assessed establishes and maintains a development environment baseline configuration managed separately from the operational baseline configuration.','The organization conducting the inspection/assessment obtains and examines development environment baseline configuration documentation and ensures the organization is maintaining and managing a baseline configuration for the development environment separate from the operational baseline configuration.'),\n('000312','draft','2009-09-17','DISA FSO','policy','The organization maintains a baseline configuration for information system test environments that is managed separately from the operational baseline configuration.','CM-2(6).2','The organization being inspected/assessed establishes and maintains a test environment baseline configuration managed separately from the operational baseline configuration.','The organization conducting the inspection/assessment obtains and examines test environment baseline configuration documentation and ensures the organization is maintaining and managing a baseline configuration for the test environment separate from the operational baseline configuration.'),\n('000313','draft','2009-09-17','DISA FSO','policy','The organization determines the types of changes to the information system that are configuration controlled.','CM-3.1','The organization being inspected/assessed determines the types of changes to the information system that are to be configuration controlled.  This action will be implemented by the CCB as defined in CM-3, CCI 1586.','The organization conducting the inspection/assessment obtains and examines the configuration management policy and plan to ensure the organization identifies the types of changes to the information system that are configuration controlled.'),\n('000314','draft','2009-09-17','DISA FSO','policy','The organization approves or disapproves configuration-controlled changes to the information system, with explicit consideration for security impact analysis.','CM-3.2','The organization being inspected/assessed approves or disapproves configuration controlled changes to the information system with explicit consideration for security impact analysis.  The organization must maintain an audit trail of approval/disapproval of configuration  controlled changes.  This action will be implemented by the CCB as defined in CM-3, CCI 1586.','The organization conducting the inspection/assessment obtains and examines the audit trail of the approval/disapproval of configuration controlled changes to ensure a security impact analysis was conducted.'),\n('000315','draft','2009-09-17','DISA FSO','policy','The organization documents approved configuration-controlled changes to the system.',NULL,NULL,NULL),\n('000316','draft','2009-09-17','DISA FSO','policy','The organization retains records of configuration-controlled changes to the information system for an organization-defined time period.','CM-3.6','The organization being inspected/assessed retains records of all configuration-controlled changes to the information system, as a result of CM-3, CCI 1819, for a time period defined by the organization\\'s CCB.\\n\\nDoD has defined the time period as a time period defined by the organization\\'s CCB.','The organization conducting the inspection/assessment obtains and examines the records of all configuration-controlled changes to the information system to ensure the organization being inspected/assessed retains the records of all configuration controlled changes for a time period defined by the organization\\'s CCB.\\n\\nDoD has defined the time period as a time period defined by the organization\\'s CCB.'),\n('000317','draft','2009-09-17','DISA FSO','policy','The organization reviews records of configuration-controlled changes to the system.',NULL,NULL,NULL),\n('000318','draft','2009-09-17','DISA FSO','policy','The organization audits and reviews activities associated with configuration-controlled changes to the system.','CM-3.8','The organization being inspected/assessed audits and reviews activities associated with configuration-controlled changes to the information system.  The organization must maintain an audit trail to include review activities associated with configuration-controlled changes.','The organization conducting the inspection/assessment obtains and examines the audit trail documenting the review activities associated with configuration-controlled changes to the information system to ensure the organization being inspected/assessed audits and reviews activities associated with the changes.'),\n('000319','draft','2009-09-17','DISA FSO','policy','The organization coordinates and provides oversight for configuration change control activities through an organization-defined configuration change control element (e.g., committee, board) that convenes at the organization-defined frequency and/or for any organization-defined configuration change conditions.','CM-3.9','The organization being inspected/assessed  coordinates and provides oversight for configuration change control activities through a configuration control board (CCB) that convenes at a frequency determined by the CCB and/or for any configuration change conditions determined by the CCB.  DoD has defined the configuration change control element as a configuration control board.  DoD has defined the frequency as at a frequency determined by the CCB.  DoD has defined the configuration change conditions as configuration change conditions determined by the CCB.','The organization conducting the inspection/assessment obtains and examines the organization\\'s configuration management policy and plan; document/charter establishing the organization\\'s CCB; meeting minutes; information system change control records; and any other relevant documents or records.  The objective of the review is to validate the organization is coordinating and overseeing the configuration change control activities through a CCB.'),\n('000320','draft','2009-09-17','DISA FSO','policy','The organization defines the frequency with which to convene the configuration change control element.','CM-3.10','The organization being inspected/assessed defines within their CCB Charter, the frequency for configuration change control review.  DoD has defined the frequency as at a frequency determined by the CCB.','The organization conducting the inspection/assessment obtains and examines the CCB Charter to ensure the frequency for configuration change control review is defined.  DoD has defined the frequency as at a frequency determined by the CCB.'),\n('000321','draft','2009-09-17','DISA FSO','policy','The organization defines configuration change conditions that prompt the configuration change control element to convene.','CM-3.11','The organization being inspected/assessed defines within their CCB Charter, the configuration change conditions that prompt the configuration change control element to convene.  DoD has defined the configuration change conditions as configuration change conditions determined by the CCB.','The organization conducting the inspection/assessment obtains and examines the CCB Charter to ensure the configuration change conditions that prompt the configuration change control element to convene are defined.  DoD has defined the configuration change conditions as configuration change conditions determined by the CCB.'),\n('000322','draft','2009-09-17','DISA FSO','policy','The organization employs automated mechanisms to document proposed changes to the information system.','CM-3(1).1','The organization being inspected/assessed  documents and employs the automated mechanisms (e.g., Remedy, ticketing mechanism, etc.) to document proposed changes to the information system.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms to ensure that the identified system documents proposed changes.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000323','draft','2009-09-17','DISA FSO','policy','The organization employs automated mechanisms to notify organization-defined approval authorities of proposed changes to the information system and request change approval.','CM-3(1).2','The organization being inspected/assessed documents and employs the automated mechanisms (e.g., Remedy, ticketing mechanism, etc.) to notify designated approval authorities of proposed changes to the information system and request change approval.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms to ensure that the identified system notifies designated approval authorities of proposed changes to the information system and request change approval.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000324','draft','2009-09-17','DISA FSO','policy','The organization employs automated mechanisms to highlight proposed changes to the information system that have not been approved or disapproved by an organization-defined time period.','CM-3(1).4','The organization being inspected/assessed documents and employs the automated mechanisms (e.g., Remedy, ticketing mechanism, etc.) to highlight proposed changes to the information system that have not been approved or disapproved by 7 days.  DoD has defined the time period as 7 days.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms to ensure that the identified system highlights proposed changes to the information system that have not been approved or disapproved by 7 days.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.  DoD has defined the time period as 7 days.'),\n('000325','draft','2009-09-17','DISA FSO','policy','The organization employs automated mechanisms to prohibit changes to the information system until designated approvals are received.','CM-3(1).6','The organization being inspected/assessed documents and employs the automated mechanisms to prohibit changes to the information system until designated approvals are received.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms to ensure that the identified system prohibits changes.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000326','draft','2009-09-17','DISA FSO','policy','The organization employs automated mechanisms to document all changes to the information system.','CM-3(1).7','The organization being inspected/assessed documents and employs the automated mechanisms (e.g., Remedy, ticketing mechanism, etc.) to document all changes to the information system.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms to ensure that the identified system documents all changes.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000327','draft','2009-09-17','DISA FSO','policy','The organization tests changes to the information system before implementing the changes on the operational system.','CM-3(2).1','The organization being inspected/assessed documents and implements a process to test changes to the information system before implementing the changes on the operational system.  The organization must maintain an audit trail of testing activity.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of testing activity to ensure the organization being inspected/assessed tests changes to the information system before implementing the changes on the operational system.'),\n('000328','draft','2009-09-17','DISA FSO','policy','The organization validates changes to the information system before implementing the changes on the operational system.','CM-3(2).2','The organization being inspected/assessed documents and implements a process to validate changes to the information system before implementing the changes on the operational system.  The organization must maintain an audit trail of validation activity.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of validation activity to ensure the organization being inspected/assessed validates changes to the information system before implementing the changes on the operational system.'),\n('000329','draft','2009-09-17','DISA FSO','policy','The organization documents changes to the information system before implementing the changes on the operational system.','CM-3(2).3','The organization being inspected/assessed documents and implements a process to document changes to the information system before implementing the changes on the operational system.','The organization conducting the inspection/assessment obtains and examines the documented process as well as documentation of changes to the information system to ensure the organization has established, published, and is complying with the requirement to document all changes to be made to its operational information system(s) prior to their implementation.'),\n('000330','draft','2009-09-17','DISA FSO','policy','The organization employs automated mechanisms to implement changes to the current information system baseline.','CM-3(3).1','The organization being inspected/assessed documents and employs the automated mechanisms (e.g., software deployment tools) to implement changes to the current information system baseline.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms to ensure that the identified system implements changes to the current information system baseline.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000331','draft','2009-09-17','DISA FSO','policy','The organization deploys the updated information system baseline across the installed base.','CM-3(3).2','The organization being inspected/assessed documents and employs procedures for deploying the updated information system baseline across the installed base.  The information system must maintain an audit trail of automated baseline deployments.','The organization conducting the inspection/assessment obtains and examines the documented deployment procedures and a sampling of the audit trail of automated baseline deployments to ensure the organization being inspected/assessed is deploying the updated information system baseline across the installed base.'),\n('000332','draft','2009-09-17','DISA FSO','policy','The organization requires an information security representative to be a member of the organization-defined configuration change control element.','CM-3(4).1','The organization being inspected/assessed requires an information security representative to be a member of the configuration control board.  DoD has defined the configuration change control element as the configuration control board.','The organization conducting the inspection/assessment obtains and examines the membership list of the organization\\'s configuration control board to ensure an information security representative is a member of the organization\\'s configuration control board.'),\n('000333','draft','2009-09-18','DISA FSO','policy','The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.','CM-4.1','The organization being inspected/assessed  analyzes changes to the information system to determine potential security impacts prior to change implementation.  The organization must maintain records of analysis of changes to the information system.','The organization conducting the inspection/assessment obtains and examines the records of analyses to ensure the organization is conducting a security impact analysis of changes to the information system(s) prior to their implementation.'),\n('000334','draft','2009-09-18','DISA FSO','policy','The organization analyzes new software in a separate test environment before installation in an operational environment.',NULL,NULL,NULL),\n('000335','draft','2009-09-18','DISA FSO','policy','The organization, after the information system is changed, checks the security functions to verify the functions are implemented correctly.','CM-4(2).1','The organization being inspected/assessed documents and implements a process to verify in an operational environment, following changes to the information system, the security functions are implemented correctly.  The organization must maintain an audit trail of the verification of security functions.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of the verification of security functions to ensure the organization being inspected/assessed verifies in an operational environment, following changes to the information system, the security functions are implemented correctly.'),\n('000336','draft','2009-09-18','DISA FSO','policy','The organization, after the information system is changed, checks the security functions to verify the functions are operating as intended.','CM-4(2).2','The organization being inspected/assessed documents and implements a process to verify in an operational environment, following changes to the information system, the security functions are operating as intended.  The organization must maintain an audit trail of the verification of security functions.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of the verification of security functions to ensure the organization being inspected/assessed verifies in an operational environment, following changes to the information system, the security functions are operating as intended.'),\n('000337','draft','2009-09-18','DISA FSO','policy','The organization, after the information system is changed, checks the security functions to verify the functions are producing the desired outcome with regard to meeting the security requirements for the system.','CM-4(2).3','The organization being inspected/assessed documents and implements a process to verify in an operational environment, following changes to the information system, the security functions are producing the desired outcome with regard to meeting the security requirements for the system.  The organization must maintain an audit trail of the verification of security functions.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of the verification of security functions to ensure the organization being inspected/assessed verifies in an operational environment, following changes to the information system, the security functions are producing the desired outcome with regard to meeting the security requirements for the system.'),\n('000338','draft','2009-09-18','DISA FSO','policy','The organization defines physical access restrictions associated with changes to the information system.','CM-5.1','The organization being inspected/assessed defines and documents in the configuration management policy, physical access restrictions associated with changes to the information system.','The organization conducting the inspection/assessment obtains and examines  the configuration management policy to ensure the organization being inspected/assessed defines physical access restrictions associated with changes to the information system.'),\n('000339','draft','2009-09-18','DISA FSO','policy','The organization documents physical access restrictions associated with changes to the information system.','CM-5.2','The organization being inspected/assessed documents, in the configuration management policy, physical access restrictions associated with changes to the information system.','The organization conducting the inspection/assessment obtains and examines  the configuration management policy to ensure the organization being inspected/assessed documents physical access restrictions associated with changes to the information system.'),\n('000340','draft','2009-09-18','DISA FSO','policy','The organization approves physical access restrictions associated with changes to the information system.','CM-5.3','The organization being inspected/assessed documents and implements a process to approve physical access restrictions associated with changes to the information system.  The organization must maintain an audit trail of approvals.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of approvals to ensure the organization being inspected/assessed  approves physical access restrictions associated with changes to the information system.'),\n('000341','draft','2009-09-18','DISA FSO','policy','The organization enforces physical access restrictions associated with changes to the information system.','CM-5.4','The organization being inspected/assessed documents and implements a process to enforce physical access restrictions associated with changes to the information system.','The organization conducting the inspection/assessment the documented process to ensure the organization being inspected/assessed enforces physical access restrictions associated with changes to the information system as documented in the configuration management policy.'),\n('000342','draft','2009-09-18','DISA FSO','policy','The organization defines logical access restrictions associated with changes to the information system.','CM-5.5','The organization being inspected/assessed defines and documents in the configuration management policy, logical access restrictions associated with changes to the information system.','The organization conducting the inspection/assessment obtains and examines  the configuration management policy to ensure the organization being inspected/assessed defines logical access restrictions associated with changes to the information system.'),\n('000343','draft','2009-09-18','DISA FSO','policy','The organization documents logical access restrictions associated with changes to the information system.','CM-5.6','The organization being inspected/assessed documents, in the configuration management policy, logical access restrictions associated with changes to the information system.','The organization conducting the inspection/assessment obtains and examines  the configuration management policy to ensure the organization being inspected/assessed documents logical access restrictions associated with changes to the information system.'),\n('000344','draft','2009-09-18','DISA FSO','policy','The organization approves logical access restrictions associated with changes to the information system.','CM-5.7','The organization being inspected/assessed documents and implements a process to approve logical access restrictions associated with changes to the information system.  The organization must maintain an audit trail of approvals.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of approvals to ensure the organization being inspected/assessed  approves logical access restrictions associated with changes to the information system.'),\n('000345','draft','2009-09-18','DISA FSO','policy','The organization enforces logical access restrictions associated with changes to the information system.','CM-5.8','The organization being inspected/assessed documents and implements a process to enforce logical access restrictions associated with changes to the information system.  The information system must maintain an audit trail of logical access to the information system pertaining to information system changes.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the logical access audit trail to ensure the organization being inspected/assessed enforces logical access restrictions associated with changes to the information system as documented in the configuration management policy.'),\n('000346','draft','2009-09-18','DISA FSO','technical','The organization employs automated mechanisms to enforce access restrictions.',NULL,NULL,NULL),\n('000347','draft','2009-09-18','DISA FSO','technical','The organization employs automated mechanisms to support auditing of the enforcement actions.',NULL,NULL,NULL),\n('000348','draft','2009-09-18','DISA FSO','policy','The organization defines a frequency with which to conduct reviews of information system changes.','CM-5(2).1','DoD has defined the frequency as every 90 days or more frequently as the organization defines for high systems AND at least annually or more frequently as the organization defines for low and moderate systems.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as every 90 days or more frequently as the organization defines for high systems AND at least annually or more frequently as the organization defines for low and moderate systems.'),\n('000349','draft','2009-09-18','DISA FSO','policy','The organization reviews information system changes per organization-defined frequency to determine whether unauthorized changes have occurred.','CM-5(2).2','The organization being inspected/assessed documents in the configuration management policy and implements a process to review information system changes every 90 days or more frequently as the organization defines for high systems AND at least annually or more frequently as the organization defines for low and moderate systems to determine whether unauthorized changes have occurred.\\n\\nThe organization must maintain this review as an audit trail.\\n\\nDoD has defined the frequency as every 90 days or more frequently as the organization defines for high systems AND at least annually or more frequently as the organization defines for low and moderate systems.','The organization conducting the inspection/assessment obtains and examines the documented process for information system change review as well as the audit trail of reviews to ensure the organization being inspected/assessed reviews IS changes every 90 days or more frequently as the organization defines for high systems AND at least annually or more frequently as the organization defines for low and moderate systems to determine whether unauthorized changes have occurred.\\n\\nDoD has defined the frequency as every 90 days or more frequently as the organization defines for high systems AND at least annually or more frequently as the organization defines for low and moderate systems.'),\n('000350','draft','2009-09-18','DISA FSO','policy','The organization reviews information system changes upon organization-defined circumstances to determine whether unauthorized changes have occurred.','CM-5(2).3','The organization being inspected/assessed documents and implements a process to review the information system changes when there is an incident or when planned changes have been performed to determine whether unauthorized changes have occurred.\\n\\nThe organization must maintain this review as an audit trail.\\n\\nDoD has defined the circumstances as when there is an incident or when planned changes have been performed.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of reviews to ensure the organization being inspected/assessed reviews the information system changes when there is an incident or when planned changes have been performed to determine whether unauthorized changes have occurred.\\n\\nDoD has defined the circumstances as when there is an incident or when planned changes have been performed.'),\n('000351','draft','2009-09-18','DISA FSO','policy','The organization defines critical software programs that the information system will prevent from being installed if such software programs are not signed with a recognized and approved certificate.',NULL,NULL,NULL),\n('000352','draft','2009-09-18','DISA FSO','technical','The information system prevents the installation of organization-defined critical software programs that are not signed with a certificate that is recognized and approved by the organization.',NULL,NULL,NULL),\n('000353','draft','2009-09-18','DISA FSO','policy','The organization defines information system components requiring enforcement of a dual authorization for information system changes.','CM-5(4).1','The organization being inspected/assessed defines and documents information system components requiring enforcement of a dual authorization for information system changes.  DoD has determined to the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components requiring enforcement of a dual authorization for information system changes.\\n\\nDoD has determined to the information system components are not appropriate to define at the Enterprise level.'),\n('000354','draft','2009-09-18','DISA FSO','policy','The organization enforces dual authorization for changes to organization-defined information system components.','CM-5(4).2','The organization being inspected/assessed documents and implements a process to enforce dual authorization for changes to information system components defined in CM-5 (4), CCI 353.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed enforces dual authorization for changes to information system components defined in CM-5 (4), CCI 353.'),\n('000355','draft','2009-09-18','DISA FSO','policy','The organization limits information system developer/integrator privileges to change hardware components directly within a production environment.',NULL,NULL,NULL),\n('000356','draft','2009-09-18','DISA FSO','policy','The organization limits information system developer/integrator privileges to change software components directly within a production environment.',NULL,NULL,NULL),\n('000357','draft','2009-09-18','DISA FSO','policy','The organization limits information system developer/integrator privileges to change firmware components directly within a production environment.',NULL,NULL,NULL),\n('000358','draft','2009-09-18','DISA FSO','policy','The organization limits information system developer/integrator privileges to change system information directly within a production environment.',NULL,NULL,NULL),\n('000359','draft','2009-09-18','DISA FSO','policy','The organization defines the frequency to review information system developer/integrator privileges.',NULL,NULL,NULL),\n('000360','draft','2009-09-18','DISA FSO','policy','The organization defines the frequency to reevaluate information system developer/integrator privileges.',NULL,NULL,NULL),\n('000361','draft','2009-09-18','DISA FSO','policy','The organization reviews information system developer/integrator privileges per organization-defined frequency.',NULL,NULL,NULL),\n('000362','draft','2009-09-18','DISA FSO','policy','The organization reevaluates information system developer/integrator privileges per organization-defined frequency.',NULL,NULL,NULL),\n('000363','draft','2009-09-18','DISA FSO','policy','The organization defines security configuration checklists to be used to establish and document configuration settings for the information system technology products employed.','CM-6.1','DoD has defined the security configuration checklists as DoD security configuration or implementation guidance (e.g. STIGs,  SRGs, NSA configuration guides, CTOs, DTMs etc.).  The organization being inspected/assessed documents in the security plan, the configuration guidance (e.g. STIGs, SRGs, NSA configuration guides, CTOs, DTMs etc.) which apply to their information system components.','DoD has defined the security configuration checklists as DoD security configuration or implementation guidance (e.g. STIGs,  SRGs, NSA configuration guides, CTOs, DTMs etc.).   The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed has documented the configuration guidance  which apply to their information system components.  The organization conducting the inspection/assessment reviews the list of documented guidance to ensure that all applicable guidance is identified given the information system components within the authorization boundary.'),\n('000364','draft','2009-09-18','DISA FSO','policy','The organization establishes configuration settings for information technology products employed within the information system using organization-defined security configuration checklists.','CM-6.2','DoD security configuration or implementation guidance (e.g. STIGs, SRGs, NSA configuration guides, CTOs, DTMs etc.) meet the DoD requirement for establishing configuration settings.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level security configuration or implementation guidance (e.g. STIGs, SRGs, NSA configuration guides, CTOs, DTMs etc.).','DoD security configuration or implementation guidance (e.g. STIGs, SRGs, NSA configuration guides, CTOs, DTMs etc.) meet the DoD requirement for establishing configuration settings.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level security configuration or implementation guidance (e.g. STIGs, SRGs,  NSA configuration guides, CTOs, DTMs etc.).'),\n('000365','draft','2009-09-18','DISA FSO','policy','The organization documents configuration settings for information technology products employed within the information system using organization-defined security configuration checklists that reflect the most restrictive mode consistent with operational requirements.','CM-6.3','DoD security configuration or implementation guidance (e.g. STIGs, SRGs,  NSA configuration guides, CTOs, DTMs etc.) meet the DoD requirement for documenting configuration settings.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level security configuration or implementation guidance (e.g. STIGs,  SRGs, NSA configuration guides, CTOs, DTMs etc.).','DoD security configuration or implementation guidance (e.g. STIGs,  SRGs, NSA configuration guides, CTOs, DTMs etc.) meet the DoD requirement for documenting configuration settings.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level security configuration or implementation guidance (e.g. STIGs,  SRGs, NSA configuration guides, CTOs, DTMs etc.).'),\n('000366','draft','2009-09-18','DISA FSO','policy','The organization implements the security configuration settings.','CM-6.5','The organization being inspected/assessed must develop and document a process for implementing  DoD security configuration or implementation guidance (e.g. STIGs,  NSA configuration guides, CTOs, DTMs etc.).  DoD has defined the security configuration checklists as DoD security configuration or implementation guidance (e.g. STIGs,  NSA configuration guides, CTOs, DTMs etc.).','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed implements   DoD security configuration or implementation guidance (e.g. STIGs,  NSA configuration guides, CTOs, DTMs etc.).  The organization conducting the inspection/assessment tests a sampling of information system components to ensure they comply with the required settings.  DoD has defined the security configuration checklists as DoD security configuration or implementation guidance (e.g. STIGs,  NSA configuration guides, CTOs, DTMs etc.).  '),\n('000367','draft','2009-09-18','DISA FSO','policy','The organization identifies any deviations from the established configuration settings for organization-defined information system components based on organization-defined operational requirements.','CM-6.6','The organization being inspected/assessed documents in the security plan and POA&M, if applicable, the information system components as defined in CM-6, CCI 1755 which deviate from configuration settings, and which settings as defined in CM-6, CCI 1756.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed has documented deviations from configuration settings for information system components.'),\n('000368','draft','2009-09-18','DISA FSO','policy','The organization documents any deviations from the established configuration settings for organization-defined information system components based on organization-defined operational requirements.','CM-6.7','The organization being inspected/assessed documents in the security plan and POA&M, if applicable, all configurable information system components which deviate from configuration settings, and which settings as defined in CM-6, CCI 1756.\\n\\nDoD has defined the information system components as all configurable information system components.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed has documented deviations from configuration settings for information system components.'),\n('000369','draft','2009-09-18','DISA FSO','policy','The organization approves any deviations from the established configuration settings for organization-defined information system components based on organization-defined operational requirements.','CM-6.8','The organization being inspected/assessed manages and approves changes to the security plan documenting deviations IAW CM-3, CCI 314.  The organization must maintain an audit trail of approved changes to the security plan.','The organization conducting the inspection/assessment obtains and examines the security plan and the audit trail of approved changes to ensure the deviations are approved IAW CM-3, CCI 314.'),\n('000370','draft','2009-09-18','DISA FSO','policy','The organization employs automated mechanisms to centrally manage configuration settings for organization-defined information system components.','CM-6(1).1','The organization being inspected/assessed identifies, documents in the configuration management policy, and implements automated mechanisms to centrally manage configuration settings.','The organization conducting the inspection/assessment obtains and examines the configuration management policy to ensure the organization being inspected/assessed identifies automated mechanisms to centrally manage configuration settings.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000371','draft','2009-09-18','DISA FSO','policy','The organization employs automated mechanisms to centrally apply configuration settings for organization-defined information system components.','CM-6(1).2','The organization being inspected/assessed identifies, documents in the configuration management policy, and implements automated mechanisms to centrally apply configuration settings.','The organization conducting the inspection/assessment obtains and examines the configuration management policy to ensure the organization being inspected/assessed identifies automated mechanisms to centrally apply configuration settings.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000372','draft','2009-09-18','DISA FSO','policy','The organization employs automated mechanisms to centrally verify configuration settings for organization-defined information system components.','CM-6(1).3','The organization being inspected/assessed identifies, documents in the configuration management policy, and implements automated mechanisms to centrally verify configuration settings.','The organization conducting the inspection/assessment obtains and examines the configuration management policy to ensure the organization being inspected/assessed identifies automated mechanisms to centrally verify configuration settings.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('000373','draft','2009-09-18','DISA FSO','policy','The organization defines configuration settings for which unauthorized changes are responded to by automated mechanisms.',NULL,NULL,NULL),\n('000374','draft','2009-09-18','DISA FSO','technical','The organization employs automated mechanisms to respond to unauthorized changes to organization-defined configuration settings.',NULL,NULL,NULL),\n('000375','draft','2009-09-18','DISA FSO','policy','The organization incorporates detection of unauthorized, security-relevant configuration changes into the organizations incident response capability.',NULL,NULL,NULL),\n('000376','draft','2009-09-18','DISA FSO','policy','The organization ensures unauthorized, security-relevant configuration changes detected are monitored.',NULL,NULL,NULL),\n('000377','draft','2009-09-18','DISA FSO','policy','The organization ensures unauthorized, security-relevant configuration changes detected are corrected.',NULL,NULL,NULL),\n('000378','draft','2009-09-18','DISA FSO','policy','The organization ensures unauthorized, security-relevant configuration changes detected are available for historical purposes.',NULL,NULL,NULL),\n('000379','draft','2009-09-18','DISA FSO','policy','The information system (including modifications to the baseline configuration) demonstrates conformance to security configuration guidance (i.e., security checklists) prior to being introduced into a production environment.',NULL,NULL,NULL),\n('000380','draft','2009-09-18','DISA FSO','policy','The organization defines prohibited or restricted functions, ports, protocols, and/or services for the information system.','CM-7.2','DoD has defined the information system prohibited or restricted functions, ports, protocols, and/or services as IAW DoDI 8551.01.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information system prohibited or restricted functions, ports, protocols, and/or services as IAW DoDI 8551.01.'),\n('000381','draft','2009-09-18','DISA FSO','technical','The organization configures the information system to provide only essential capabilities.','CM-7.1','The organization being inspected/assessed documents in the security plan, essential capabilities which the information system must provide.  The organization being inspected/assessed configures the information system to provide only those documented essential capabilities.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed has identified essential capabilities.  The organization conducting the inspection/assessment inspects the information system to ensure that it provides only those documented essential capabilities.'),\n('000382','draft','2009-09-18','DISA FSO','technical','The organization configures the information system to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services.','CM-7.3','The organization being inspected/assessed configures the information system to prohibit or restrict the use of functions, ports, protocols, and/or services IAW DoDI 8551.01.  DoD has defined the information system prohibited or restricted functions, ports, protocols, and/or services as IAW DoDI 8551.01.','The organization conducting the inspection/assessment inspects the information system to ensure the organization being inspected/assessed prohibits or restricts the use of functions, ports, protocols, and/or services IAW DoDI 8551.01.  DoD has defined the information system prohibited or restricted functions, ports, protocols, and/or services as IAW DoDI 8551.01.'),\n('000383','draft','2009-09-18','DISA FSO','policy','The organization defines the frequency of information system reviews to identify and eliminate unnecessary functions, ports, protocols and/or services.',NULL,NULL,NULL),\n('000384','draft','2009-09-18','DISA FSO','policy','The organization reviews the information system per organization-defined frequency to identify unnecessary and nonsecure functions, ports, protocols, and services.','CM-7(1).1','The organization being inspected/assessed documents and implements a process to review the information system every 30 days to identify unnecessary and nonsecure functions, ports, protocols, and services.  The organization must maintain an audit trail of the reviews.  DoD has defined the frequency as every 30 days.','The organization conducting the inspection/assessment obtains and examines the documented process and audit trail of reviews to ensure the organization being inspected/assessed reviews the information system every 30 days to identify unnecessary and nonsecure functions, ports, protocols, and services.   DoD has defined the frequency as every 30 days.'),\n('000385','draft','2009-09-18','DISA FSO','policy','The organization reviews the information system per organization-defined frequency to eliminate unnecessary functions, ports, protocols, and/or services.',NULL,NULL,NULL),\n('000386','draft','2009-09-18','DISA FSO','technical','The organization employs automated mechanisms to prevent program execution on the information system in accordance with the organization-defined specifications.',NULL,NULL,NULL),\n('000387','draft','2009-09-18','DISA FSO','policy','The organization defines registration requirements for functions, ports, protocols, and services.','CM-7(3).1','DoD has defined the registration requirements as IAW DoDI 8551.01.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the registration requirements as IAW DoDI 8551.01.'),\n('000388','draft','2009-09-18','DISA FSO','policy','The organization ensures compliance with organization-defined registration requirements for functions, ports, protocols, and services.','CM-7(3).2','The organization being inspected/assessed implements DoDI 8551.01.  DoD has defined the registration requirements as IAW DoDI 8551.01.','The organization conducting the inspection/assessment obtains and examines a documented listing of ports, protocols, and services in use, and reviews a sampling of those ports, protocols, and services to ensure the organization being inspected/assessed is compliant with DoDI 8551.01.  DoD has defined the registration requirements as IAW DoDI 8551.01.'),\n('000389','draft','2009-09-18','DISA FSO','policy','The organization develops an inventory of information system components that accurately reflects the current information system.','CM-8.1','The organization being inspected/assessed documents inventory of information system components that accurately reflects the current information system.','The organization conducting the inspection/assessment obtains and examines the documented inventory and examines a sampling of information system components  to ensure inventory accurately reflects the current information system.'),\n('000390','draft','2009-09-18','DISA FSO','policy','The organization documents an inventory of information system components that accurately reflects the current information system.',NULL,NULL,NULL),\n('000391','draft','2009-09-18','DISA FSO','policy','The organization maintains an inventory of information system components that accurately reflects the current information system.',NULL,NULL,NULL),\n('000392','draft','2009-09-18','DISA FSO','policy','The organization develops an inventory of information system components that includes all components within the authorization boundary of the information system.','CM-8.2','The organization being inspected/assessed documents inventory of information system components that includes all components within the authorization boundary of the information system.','The organization conducting the inspection/assessment obtains and examines the documented inventory and examines a sampling of information system components  to ensure inventory includes all components within the authorization boundary of the information system.'),\n('000393','draft','2009-09-18','DISA FSO','policy','The organization documents an inventory of information system components that includes all components within the authorization boundary of the information system.',NULL,NULL,NULL),\n('000394','draft','2009-09-18','DISA FSO','policy','The organization maintains an inventory of information system components that is consistent with the authorization boundary of the information system.',NULL,NULL,NULL),\n('000395','draft','2009-09-18','DISA FSO','policy','The organization develops an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.','CM-8.3','The organization being inspected/assessed documents inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.','The organization conducting the inspection/assessment obtains and examines the documented inventory and examines a sampling of information system components  to ensure inventory is at the level of granularity deemed necessary for tracking and reporting.'),\n('000396','draft','2009-09-18','DISA FSO','policy','The organization documents an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.',NULL,NULL,NULL),\n('000397','draft','2009-09-18','DISA FSO','policy','The organization maintains an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting.',NULL,NULL,NULL),\n('000398','draft','2009-09-18','DISA FSO','policy','The organization defines information deemed necessary to achieve effective information system component accountability.','CM-8.4','DoD has defined the information as hardware inventory specifications (manufacturer, type, model, serial number, physical location), software license information, information system/component owner, and for a networked component/device, the machine name.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information as hardware inventory specifications (manufacturer, type, model, serial number, physical location), software license information, information system/component owner, and for a networked component/device, the machine name.'),\n('000399','draft','2009-09-18','DISA FSO','policy','The organization develops an inventory of information system components that includes organization-defined information deemed necessary to achieve effective information system component accountability.','CM-8.5','The organization being inspected/assessed documents inventory of information system components that includes organization defined information deemed necessary to achieve effective information system component accountability.','The organization conducting the inspection/assessment obtains and examines the documented inventory and examines a sampling of information system components  to ensure inventory includes organization defined information deemed necessary to achieve effective information system component accountability.'),\n('000400','draft','2009-09-18','DISA FSO','policy','The organization documents an inventory of information system components that includes organization-defined information deemed necessary to achieve effective information system component accountability.',NULL,NULL,NULL),\n('000401','draft','2009-09-18','DISA FSO','policy','The organization maintains an inventory of information system components that includes organization-defined information deemed necessary to achieve effective property accountability.',NULL,NULL,NULL),\n('000402','draft','2009-09-18','DISA FSO','policy','The organization develops an inventory of information system components that is available for review by designated organizational officials.',NULL,NULL,NULL),\n('000403','draft','2009-09-18','DISA FSO','policy','The organization documents an inventory of information system components that is available for review by designated organizational officials.',NULL,NULL,NULL),\n('000404','draft','2009-09-18','DISA FSO','policy','The organization maintains an inventory of information system components that is available for review by designated organizational officials.',NULL,NULL,NULL),\n('000405','draft','2009-09-18','DISA FSO','policy','The organization develops an inventory of information system components that is available for audit by designated organizational officials.',NULL,NULL,NULL),\n('000406','draft','2009-09-18','DISA FSO','policy','The organization documents an inventory of information system components that is available for audit by designated organizational officials.',NULL,NULL,NULL),\n('000407','draft','2009-09-18','DISA FSO','policy','The organization maintains an inventory of information system components that is available for audit by designated organizational officials.',NULL,NULL,NULL),\n('000408','draft','2009-09-18','DISA FSO','policy','The organization updates the inventory of information system components as an integral part of component installations.','CM-8(1).1','The organization being inspected/assessed documents and implements a process to update the inventory of information system components as an integral part of component installations.  The organization must maintain an audit trail of updates.  The audit trail may be recorded within the inventory itself.','The organization conducting the inspection/assessment obtains and examines the documented process for updates as well as the audit trail of updates and the log of changes to the information system to ensure the organization being inspected/assessed updates the inventory of information system components as an integral part of component installations.'),\n('000409','draft','2009-09-18','DISA FSO','policy','The organization updates the inventory of information system components as an integral part of component removals.','CM-8(1).2','The organization being inspected/assessed documents and implements a process to update the inventory of information system components as an integral part of component removals.  The organization must maintain an audit trail of updates.  The audit trail may be recorded within the inventory itself.','The organization conducting the inspection/assessment obtains and examines the documented process for updates as well as the audit trail of updates and the log of changes to the information system to ensure the organization being inspected/assessed updates the inventory of information system components as an integral part of component removals.'),\n('000410','draft','2009-09-18','DISA FSO','policy','The organization updates the inventory of information system components as an integral part of information system updates.','CM-8(1).3','The organization being inspected/assessed documents and implements a process to update the inventory of information system components as an integral part of information system updates.  The organization must maintain an audit trail of updates.  The audit trail may be recorded within the inventory itself.','The organization conducting the inspection/assessment obtains and examines the documented process for updates as well as the audit trail of updates and the log of changes to the information system to ensure the organization being inspected/assessed updates the inventory of information system components as an integral part of information system updates.'),\n('000411','draft','2009-09-18','DISA FSO','policy','The organization employs automated mechanisms to help maintain an up-to-date inventory of information system components.','CM-8(2).1','The organization being inspected/assessed documents and implements automated mechanisms to help maintain an up-to-date inventory of information system components.  An automated mechanism implemented IAW CM-2 (2) satisfies the requirements of this CCI if the automated mechanism maintains an up-to-date inventory.','The organization conducting the inspection/assessment obtains and examines the documentation identifying the automated mechanism used to help maintain an up-to-date inventory of information system components and examines the mechanism to ensure the organization being inspected/assessed employs automated mechanisms to help maintain an up-to-date inventory of information system components.'),\n('000412','draft','2009-09-18','DISA FSO','policy','The organization employs automated mechanisms to help maintain a complete inventory of information system components.','CM-8(2).2','The organization being inspected/assessed documents and implements automated mechanisms to help maintain a complete inventory of information system components.  An automated mechanism implemented IAW CM-2 (2) satisfies the requirements of this CCI if the automated mechanism maintains a complete inventory.','The organization conducting the inspection/assessment obtains and examines the documentation identifying the automated mechanism used to help maintain a complete inventory of information system components and examines the mechanism to ensure the organization being inspected/assessed employs automated mechanisms to help maintain a complete inventory of information system components.'),\n('000413','draft','2009-09-18','DISA FSO','policy','The organization employs automated mechanisms to help maintain an accurate inventory of information system components.','CM-8(2).3','The organization being inspected/assessed documents and implements automated mechanisms to help maintain an accurate inventory of information system components.  An automated mechanism implemented IAW CM-2 (2) satisfies the requirements of this CCI if the automated mechanism maintains an accurate inventory.','The organization conducting the inspection/assessment obtains and examines the documentation identifying the automated mechanism used to help maintain an accurate inventory of information system components and examines the mechanism to ensure the organization being inspected/assessed employs automated mechanisms to help maintain an accurate inventory of information system components.'),\n('000414','draft','2009-09-18','DISA FSO','policy','The organization employs automated mechanisms to help maintain a readily available inventory of information system components.','CM-8(2).4','The organization being inspected/assessed documents and implements automated mechanisms to help maintain a readily available inventory of information system components.  An automated mechanism implemented IAW CM-2 (2) satisfies the requirements of this CCI if the automated mechanism maintains a readily available inventory.','The organization conducting the inspection/assessment obtains and examines the documentation identifying the automated mechanism used to help maintain a readily available inventory of information system components and examines the mechanism to ensure the organization being inspected/assessed employs automated mechanisms to help maintain a readily available inventory of information system components.'),\n('000415','draft','2009-09-18','DISA FSO','policy','The organization defines the frequency of employing automated mechanisms to detect the presence of unauthorized hardware, software, and firmware components within the information system.','CM-8(3).1','DoD has defined the frequency as continuously.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as continuously.'),\n('000416','draft','2009-09-18','DISA FSO','policy','The organization employs automated mechanisms, per organization-defined frequency, to detect the presence of unauthorized hardware, software, and firmware components within the information system.','CM-8(3).2','The organization being inspected/assessed documents and implements automated mechanisms to detect the presence of unauthorized hardware, software, and firmware components within the information system continuously.  DoD has defined the frequency as continuously.','The organization conducting the inspection/assessment obtains and examines the documentation identifying the automated mechanisms and examines the implemented automated mechanisms to ensure the organization being inspected/assessed employs automated mechanisms, continuously, to detect the presence of unauthorized hardware, software, and firmware components within the information system.   DoD has defined the frequency as continuously.'),\n('000417','draft','2009-09-18','DISA FSO','technical','The organization disables network access by unauthorized components/devices or notifies designated organizational officials.',NULL,NULL,NULL),\n('000418','draft','2009-09-18','DISA FSO','policy','The organization includes, in the information system component inventory information, a means for identifying by name, position, and/or role, individuals responsible/accountable for administering those components.','CM-8(4).1','The organization being inspected/assessed documents within their information system component inventory, the name and position or role of individuals responsible/accountable for administering those components or a means of identifying those individuals.','The organization conducting the inspection/assessment obtains and examines  the information system component inventory to verify that the organization being inspected/assessed identifies within their inventory, the name and position or role of individuals responsible/accountable for administering those components or a means of identifying those individuals.'),\n('000419','draft','2009-09-18','DISA FSO','policy','The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system component inventories.','CM-8(5).1','The organization being inspected/assessed verifies that all components within the authorization boundary of the information system are not duplicated in other information system inventories.','The organization conducting the inspection/assessment obtains and examines the inventory list of the authorized information system and verifies that all components identified during the inspection are not duplicated in other information system inventories.'),\n('000420','draft','2009-09-18','DISA FSO','policy','The organization includes assessed component configurations and any approved deviations to current deployed configurations in the information system component inventory.','CM-8(6).1','The organization being inspected/assessed will institute procedures to ensure assessed component configurations, and any approved deviations to current deployed configurations, are included in the information system component inventory.','The organization conducting the inspection/assessment obtains and examines  the organization\\'s configuration management policy and plan; procedures addressing information system component inventory; information system design documentation; information system inventory records; information system component installation records; and any other relevant documents or records.  The purpose of the reviews is to validate the organization is including assessed component configurations, and any approved deviations to deployed configurations, in the information system component\\'s inventory.'),\n('000421','draft','2009-09-18','DISA FSO','policy','The organization develops a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.','CM-9.1','The organization being inspected/assessed will  develop and document  a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.','The organization conducting the inspection/assessment obtains and examines the configuration management plan to verify that it addresses and documents roles, responsibilities, and configuration management processes and procedures'),\n('000422','draft','2009-09-18','DISA FSO','policy','The organization documents a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.',NULL,NULL,NULL),\n('000423','draft','2009-09-18','DISA FSO','policy','The organization implements a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.','CM-9.2','The organization being inspected/assessed will  implement a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.','The organization conducting the inspection/assessment obtains and examines the configuration management plan as well as evidence of implementation (e.g., completed change requests, meeting minutes, and other relevant documents) to ensure the organization being inspected/assessed implements a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures.'),\n('000424','draft','2009-09-18','DISA FSO','policy','The organization develops a configuration management plan for the information system that defines the configuration items for the information system.','CM-9.7','The organization being inspected/assessed will develop and document a configuration management plan for the information system that defines the configuration items.','The organization conducting the inspection/assessment obtains and examines  the configuration management plan to ensure it defines and documents the configuration items for the information system.'),\n('000425','draft','2009-09-18','DISA FSO','policy','The organization documents a configuration management plan for the information system that defines the configuration items for the information system.',NULL,NULL,NULL),\n('000426','draft','2009-09-18','DISA FSO','policy','The organization implements a configuration management plan for the information system that defines the configuration items for the information system.','CM-9.8','The organization being inspected/assessed will implement a configuration management plan for the information system that defines the configuration items.','The organization conducting the inspection/assessment obtains and examines the configuration management plan to ensure the organization being inspected/assessed implements a configuration management plan for the information system that defines the configuration items.'),\n('000427','draft','2009-09-18','DISA FSO','policy','The organization develops a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.',NULL,NULL,NULL),\n('000428','draft','2009-09-18','DISA FSO','policy','The organization documents a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.',NULL,NULL,NULL),\n('000429','draft','2009-09-18','DISA FSO','policy','The organization implements a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management.',NULL,NULL,NULL),\n('000430','draft','2009-09-18','DISA FSO','policy','The organization develops a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.',NULL,NULL,NULL),\n('000431','draft','2009-09-18','DISA FSO','policy','The organization documents a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.',NULL,NULL,NULL),\n('000432','draft','2009-09-18','DISA FSO','policy','The organization implements a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle.',NULL,NULL,NULL),\n('000433','draft','2009-09-18','DISA FSO','policy','The organization develops a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.',NULL,NULL,NULL),\n('000434','draft','2009-09-18','DISA FSO','policy','The organization documents a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.',NULL,NULL,NULL),\n('000435','draft','2009-09-18','DISA FSO','policy','The organization implements a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.',NULL,NULL,NULL),\n('000436','draft','2009-09-18','DISA FSO','policy','The organization assigns responsibility for developing the configuration management process to organizational personnel that are not directly involved in information system development.','CM-9(1).1','The organization being inspected/assessed will assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in information system development.','The organization conducting the inspection/assessment obtains and examines documentation of stakeholder role assignments to verify that the personnel assigned CM roles are not assigned roles for information system development.'),\n('000437','draft','2009-09-18','DISA FSO','policy','The organization defines the frequency with which to review and update the current contingency planning policy.','CP-1.7','DoD has defined the frequency as every 5 years.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every 5 years.'),\n('000438','draft','2009-09-18','DISA FSO','policy','The organization develops and documents a contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','CP-1.1','DoDI 8500.01 and NIST SP 800-34 meet the DoD requirements for contingency planning policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01 and NIST SP 800-34.','DoDI 8500.01 and NIST SP 800-34 meet the DoD requirements for contingency planning policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01 and NIST SP 800-34.'),\n('000439','draft','2009-09-18','DISA FSO','policy','The organization disseminates a contingency planning policy to organization-defined personnel or roles.','CP-1.2','DoD disseminates DoDI 8500.01 organization-wide via the DoD Issuances website. http://www.dtic.mil/whs/directives/corres/dir.html   NIST disseminates NIST SP 800-34 via http://csrc.nist.gov/publications/PubsSPs.html','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01  and NIST SP 800-34.'),\n('000440','draft','2009-09-18','DISA FSO','policy','The organization reviews and updates the current contingency planning policy in accordance with an organization-defined frequency.','CP-1.8','DoDI 8500.01 and NIST SP 800-34 meet the DoD requirements for contingency planning policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01 and NIST SP 800-34.','DoDI 8500.01 and NIST SP 800-34 meet the DoD requirements for contingency planning policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01 and NIST SP 800-34.'),\n('000441','draft','2009-09-18','DISA FSO','policy','The organization develops and documents procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls.','CP-1.4','DoDI 8500.01 and NIST SP 800-34 meet the DoD requirements for contingency planning policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01 and NIST SP 800-34.','DoDI 8500.01 and NIST SP 800-34 meet the DoD requirements for contingency planning policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01 and NIST SP 800-34.'),\n('000443','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that identifies essential missions.','CP-2.1','The organization being inspected/assessed must clearly and accurately document essential missions for its information system(s).  Impact of loss of  essential mission functions must be defined using CNSSI 1253.','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents essential missions for its information system(s).'),\n('000444','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that identifies essential business functions.','CP-2.2','The organization being inspected/assessed must clearly and accurately document essential business functions for its information system(s).  Impact of loss of  essential business functions must be defined using CNSSI 1253.','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents essential business functions for its information system(s).'),\n('000445','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that identifies associated contingency requirements.','CP-2.3','The organization being inspected/assessed must clearly and accurately document associated contingency requirements for its information system(s).','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents associated contingency requirements for its information system(s).'),\n('000446','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that provides recovery objectives.','CP-2.4','The organization being inspected/assessed must clearly and accurately document recovery objectives for its information system(s).','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents recovery objectives for its information system(s).'),\n('000447','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that provides restoration priorities.','CP-2.5','The organization being inspected/assessed must clearly and accurately document restoration priorities for its information system(s).','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents restoration priorities for its information system(s).'),\n('000448','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that provides metrics.','CP-2.6','The organization being inspected/assessed must clearly and accurately document metrics for its information system(s).','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents metrics for its information system(s).'),\n('000449','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that addresses contingency roles, responsibilities, assigned individuals with contact information.','CP-2.7','The organization being inspected/assessed must clearly and accurately document contingency roles, responsibilities, assigned individuals with contact information for its information system(s).','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents contingency roles, responsibilities, assigned individuals with contact information for its information system(s).'),\n('000450','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system disruption.','CP-2.8','The organization being inspected/assessed must clearly and accurately document maintaining essential missions despite an information system disruption for its information system(s).','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents maintaining essential missions despite an information system disruption for its information system(s).'),\n('000451','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system disruption.','CP-2.9','The organization being inspected/assessed must clearly and accurately document maintaining business functions despite an information system disruption for its information system(s).','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents maintaining business functions despite an information system disruption for its information system(s).'),\n('000452','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system compromise.','CP-2.10','The organization being inspected/assessed must clearly and accurately document maintaining essential missions despite an information system compromise for its information system(s).','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents maintaining essential missions despite an information system compromise for its information system(s).'),\n('000453','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system compromise.','CP-2.11','The organization being inspected/assessed must clearly and accurately document maintaining business functions despite an information system compromise for its information system(s).','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents maintaining business functions despite an information system compromise for its information system(s).'),\n('000454','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system failure.','CP-2.12','The organization being inspected/assessed must clearly and accurately document maintaining essential missions despite an information system failure for its information system(s).','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents maintaining essential missions despite an information system failure for its information system(s).'),\n('000455','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system failure.','CP-2.13','The organization being inspected/assessed must clearly and accurately document maintaining business functions despite an information system failure for its information system(s).','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents maintaining business functions despite an information system failure for its information system(s).'),\n('000456','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented.','CP-2.14','The organization being inspected/assessed must clearly and accurately document eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented for its information system(s).','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented for its information system(s).'),\n('000457','draft','2009-09-18','DISA FSO','policy','The organization develops a contingency plan for the information system that is reviewed and approved by organization-defined personnel or roles.','CP-2.15','The organization being inspected/assessed reviews and approves the contingency plan by at a minimum, the ISSM and ISSO.  The organization must maintain an audit trail of the review and approval activity.  DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.','The organization conducting the inspection/assessment obtains and examines the audit trail to ensure the contingency plan has been reviewed and approved by at a minimum, the ISSM and ISSO.  DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.'),\n('000458','draft','2009-09-18','DISA FSO','policy','The organization defines a list of key contingency personnel (identified by name and/or by role) and organizational elements designated to receive copies of the contingency plan.','CP-2.17','DoD has defined the list as all stakeholders identified in the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the list as all stakeholders identified in the contingency plan.'),\n('000459','draft','2009-09-18','DISA FSO','policy','The organization distributes copies of the contingency plan to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements.','CP-2.18','The organization being inspected/assessed ensures the contingency plan is disseminated to all stakeholders identified in the contingency plan via an information sharing capability.\\n\\nDoD has defined the list as all stakeholders identified in the contingency plan.','The organization conducting the inspection/assessment obtains and examines the contingency plan via the inspected organization\\'s information sharing capability (e.g. portal, intranet, email, etc.) to ensure it has been disseminated.   '),\n('000460','draft','2009-09-18','DISA FSO','policy','The organization coordinates contingency planning activities with incident handling activities.','CP-2.19','The organization being inspected/assessed will coordinate the contingency plan and incident response plan (IR-8) to ensure they do not contradict each other\\'s objectives or result in duplicate efforts/activities.','The organization conducting the inspection/assessment obtains and examines the contingency plan and the incident response plan (IR-8) to ensure they do not contradict each other\\'s objectives or result in duplicate efforts/activities.'),\n('000461','draft','2009-09-18','DISA FSO','policy','The organization defines the frequency with which to review the contingency plan for the information system.','CP-2.20','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('000462','draft','2009-09-18','DISA FSO','policy','The organization reviews the contingency plan for the information system in accordance with organization-defined frequency.','CP-2.21','The organization being inspected/assessed annually reviews the contingency plan.  The organization must maintain an audit trail of annual reviews.','The organization conducting the inspection/assessment obtains and examines the audit trail to ensure the contingency plan is reviewed annually.'),\n('000463','draft','2009-09-18','DISA FSO','policy','The organization updates the contingency plan to address changes to the organization.','CP-2.22','The organization being inspected/assessed must clearly and accurately update the contingency plan to address organizational changes.  The organization must document the update activities as an audit trail.','The organization conducting the inspection/assessment obtains and examines the contingency plan and audit trail to ensure the organization clearly and accurately updates the contingency plan to address organizational changes.'),\n('000464','draft','2009-09-18','DISA FSO','policy','The organization updates the contingency plan to address changes to the information system.','CP-2.23','The organization being inspected/assessed must clearly and accurately update the contingency plan to address changes to the information system.  The organization must document the update activities as an audit trail.','The organization conducting the inspection/assessment obtains and examines the contingency plan and audit trail to ensure the organization clearly and accurately updates the contingency plan to address information system changes.'),\n('000465','draft','2009-09-18','DISA FSO','policy','The organization updates the contingency plan to address changes to the environment of operation.','CP-2.24','The organization being inspected/assessed must clearly and accurately revise the contingency plan to address changes to the environment of operation.  The organization must document the update activities as an audit trail.','The organization conducting the inspection/assessment obtains and examines the contingency plan and audit trail to ensure the organization clearly and accurately revises the contingency plan to address changes to the environment of operation.'),\n('000466','draft','2009-09-18','DISA FSO','policy','The organization updates the contingency plan to address problems encountered during contingency plan implementation, execution, or testing.','CP-2.25','The organization being inspected/assessed must clearly and accurately revise the contingency plan to address  problems encountered during contingency plan implementation, execution, or testing.  The organization must document the update activities as an audit trail.','The organization conducting the inspection/assessment obtains and examines the contingency plan and audit trail to ensure the organization clearly and accurately revises the contingency plan to address problems encountered during contingency plan implementation, execution, or testing.'),\n('000468','draft','2009-09-18','DISA FSO','policy','The organization communicates contingency plan changes to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements.','CP-2.26','The organization being inspected/assessed communicates contingency plan changes to  all stakeholders identified in the contingency plan.   DoD has defined the list as all stakeholders identified in the contingency plan.  ','The organization conducting the inspection/assessment examines the contingency plan via the inspected organization\\'s information sharing capability (e.g. portal, intranet, email, etc.) to ensure the most current version has been communicated.'),\n('000469','draft','2009-09-18','DISA FSO','policy','The organization coordinates contingency plan development with organizational elements responsible for related plans.','CP-2(1).1','The organization being inspected/assessed coordinates the development of its contingency plan with other organizational elements responsible for related plans.  The organization documents any applicable agreements with responsible internal or external entities.  For external entities the agreements could entail MOUs, MOAs, SLAs or contracts.','The organization conducting the inspection/assessment obtains and examines documentation of agreements with entities responsible for the contingency or related plans to ensure there is evidence of coordination of those plans.'),\n('000470','draft','2009-09-18','DISA FSO','policy','The organization conducts capacity planning so that necessary capacity for information processing exists during contingency operations.','CP-2(2).1','The organization being inspected/assessed must conduct and document capacity planning to ensure that necessary capacity for information processing exists during contingency operations.','The organization conducting the inspection/assessment obtains and examines the documented capacity planning to ensure  that the organization has performed capacity planning.'),\n('000471','draft','2009-09-18','DISA FSO','policy','The organization conducts capacity planning so that necessary capacity for telecommunications exists during contingency operations.','CP-2(2).2','The organization being inspected/assessed must conduct and document capacity planning to ensure that necessary capacity for telecommunications exists during contingency operations.','The organization conducting the inspection/assessment obtains and examines the documented capacity planning to ensure  that the organization has performed capacity planning.'),\n('000472','draft','2009-09-18','DISA FSO','policy','The organization conducts capacity planning so that necessary capacity for environmental support exists during contingency operations.','CP-2(2).3','The organization being inspected/assessed must conduct and document capacity planning to ensure that necessary capacity for environmental support exists during contingency operations.','The organization conducting the inspection/assessment obtains and examines the documented capacity planning to ensure  that the organization has performed capacity planning.'),\n('000473','draft','2009-09-18','DISA FSO','policy','The organization defines the time period for planning the resumption of essential missions as a result of contingency plan activation.','CP-2(3).1','DoD has defined the time period as 1 hour (Availability High) 12 hours (Availability Moderate)  as defined in the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 1 hour (Availability High )  12 hours (Availability Moderate)  as defined in the contingency plan.'),\n('000474','draft','2009-09-18','DISA FSO','policy','The organization defines the time period for planning the resumption of essential business functions as a result of contingency plan activation.','CP-2(3).2','DoD has defined the time period as 1 hour (Availability High) 12 hours (Availability Moderate) as defined in the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 1 hour (Availability High)  12 hours (Availability Moderate) as defined in the contingency plan.'),\n('000475','draft','2009-09-18','DISA FSO','policy','The organization plans for the resumption of essential missions within the organization-defined time period of contingency plan activation.','CP-2(3).3','The organization being inspected/assessed shall document within their contingency plan, procedures for resumption of essential missions within 1 hour (Availability High)  12 hours (Availability Moderate)  as defined in the contingency plan.','The organization conducting the inspection/assessment obtains the contingency plan to ensure it contains procedures for resumption of essential missions within 1 hour (Availability High)  12 hours (Availability Moderate)  as defined in the contingency plan.'),\n('000476','draft','2009-09-18','DISA FSO','policy','The organization plans for the resumption of essential business functions within the organization-defined time period of contingency plan activation.','CP-2(3).4','The organization being inspected/assessed shall document within their contingency plan, procedures for resumption of essential business functions within 1 hour (Availability High)  12 hours (Availability Moderate)  as defined in the contingency plan.','The organization conducting the inspection/assessment obtains the contingency plan to ensure it contains procedures for resumption of essential business functions within 1 hour (Availability High)  12 hours (Availability Moderate)  as defined in the contingency plan.'),\n('000477','draft','2009-09-18','DISA FSO','policy','The organization defines the time period for planning the resumption of all missions as a result of contingency plan activation.','CP-2(4).1','DoD has defined the time period as 1 hour (Availability High ) 1-5 days (Availability Moderate)  5-30 days (Availability Low)  as defined in the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 1 hour (Availability High ) 1-5 days (Availability Moderate) 5-30 days (Availability Low)  as defined in the contingency plan.'),\n('000478','draft','2009-09-18','DISA FSO','policy','The organization defines the time period for planning the resumption of all business functions as a result of contingency plan activation.','CP-2(4).2','DoD has defined the time period as 1 hour (Availability High ) 1-5 days (Availability Moderate) 5-30 days (Availability Low)  as defined in the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 1 hour (Availability High ) 1-5 days (Availability Moderate) 5-30 days (Availability Low)  as defined in the contingency plan.'),\n('000479','draft','2009-09-18','DISA FSO','policy','The organization plans for the resumption of all missions within an organization-defined time period of contingency plan activation.','CP-2(4).3','The organization being inspected/assessed shall document within their contingency plan, procedures for full resumption of affected missions within 1 hour (Availability High )  1-5 days (Availability Moderate)  5-30 days (Availability Low)  as defined in the contingency plan.','The organization conducting the inspection/assessment obtains the contingency plan to ensure it contains procedures for full resumption of affected missions within 1 hour (Availability High )  1-5 days (Availability Moderate)  5-30 days (Availability Low)  as defined in the contingency plan.'),\n('000480','draft','2009-09-18','DISA FSO','policy','The organization plans for the resumption of all business functions within an organization-defined time period of contingency plan activation.','CP-2(4).4','The organization being inspected/assessed shall document within their contingency plan, procedures for full resumption of affected business functions within 1 hour (Availability High)  1-5 days (Availability Moderate)  5-30 days (Availability Low)  as defined in the contingency plan.','The organization conducting the inspection/assessment obtains the contingency plan to ensure it contains procedures for full resumption of affected business functions within 1 hour (Availability High)  1-5 days (Availability Moderate)  5-30 days (Availability Low)  as defined in the contingency plan.'),\n('000481','draft','2009-09-18','DISA FSO','policy','The organization plans for the continuance of essential missions with little or no loss of operational continuity.','CP-2(5).1','The organization being inspected/assessed plans for the continuance of essential missions with little or no loss of operational continuity IAW CP-2a.','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents maintaining essential missions despite an information system disruption for its information system(s).'),\n('000482','draft','2009-09-18','DISA FSO','policy','The organization plans for the continuance of essential business functions with little or no loss of operational continuity.','CP-2(5).2','The organization being inspected/assessed plans for the continuance of essential business functions with little or no loss of operational continuity IAW CP-2a.','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it  clearly and accurately documents maintaining essential business functions despite an information system disruption for its information system(s).'),\n('000483','draft','2009-09-18','DISA FSO','policy','The organization plans for the transfer of essential missions to alternate processing and/or storage sites with little or no loss of operational continuity.','CP-2(6).1','The organization being inspected/assessed documents within their continuity plan, a process to transfer essential missions to alternate processing and/or storage sites with little or no loss of operational continuity.','The organization conducting the inspection/assessment obtains and examines the continuity plan to ensure the organization being inspected/assessed documents a process to transfer essential missions to alternate processing and/or storage sites with little or no loss of operational continuity.'),\n('000484','draft','2009-09-18','DISA FSO','policy','The organization plans for the transfer of essential business functions to alternate processing and/or storage sites with little or no loss of operational continuity.','CP-2(6).2','The organization being inspected/assessed documents within their continuity plan, a process to transfer essential business functions to alternate processing and/or storage sites with little or no loss of operational continuity.','The organization conducting the inspection/assessment obtains and examines the continuity plan to ensure the organization being inspected/assessed documents a process to transfer essential business functions to alternate processing and/or storage sites with little or no loss of operational continuity.'),\n('000485','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency of refresher contingency training to information system users.','CP-3.4','DoD has defined the frequency as at least annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at least annually'),\n('000486','draft','2009-09-21','DISA FSO','policy','The organization provides contingency training to information system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming a contingency role or responsibility.','CP-3.1','The organization being inspected/assessed provides initial contingency training to personnel with contingency roles and responsibilities IAW CP-2, CCI 449  at a maximum, 10 working days of assuming a contingency role or responsibility.\\n\\nThe organization will maintain documentation of the training activity dates, location, and personnel for audit trail purposes and future reference (e.g., scheduling refresher training, etc.).\\n\\nDoD has defined the time period as at a maximum, 10 working days.','The organization conducting the inspection/assessment obtains and examines the list of contingency personnel and documentation of initial contingency training for the purpose of ensuring that all personnel with contingency roles and responsibilities have received initial contingency training  at a maximum, 10 working days of assuming a contingency role or responsibility.  DoD has defined the time period as at a maximum, 10 working days. '),\n('000487','draft','2009-09-21','DISA FSO','policy','The organization provides refresher contingency training to information system users consistent with assigned roles and responsibilities in accordance with organization-defined frequency.','CP-3.5','The organization being inspected/assessed provides refresher contingency training to personnel with contingency roles and responsibilities IAW CP-2, CCI 449 at least annually.  The organization will maintain documentation of the training activity dates, location, and personnel for audit trail purposes and future reference (e.g., scheduling refresher training, etc.).  DoD has defined the frequency as at least annually.','The organization conducting the inspection/assessment obtains and examines the list of contingency personnel and documentation of refresher contingency training for the purpose of ensuring that all personnel with contingency roles and responsibilities have received refresher contingency training at least annually.  DoD has defined the frequency as at least annually.'),\n('000488','draft','2009-09-21','DISA FSO','policy','The organization incorporates simulated events into contingency training to facilitate effective response by personnel in crisis situations.','CP-3(1).1','The organization being inspected/assessed will include simulated events into contingency training to facilitate effective response by personnel in crisis situations.','The organization conducting the inspection/assessment obtains and examines contingency training materials to ensure that simulated events have been included.'),\n('000489','draft','2009-09-21','DISA FSO','policy','The organization employs automated mechanisms to provide a more thorough and realistic contingency training environment.','CP-3(2).1','The organization being inspected/assessed employs an automated mechanism such as scenario-based interactive online training/CBT  providing a realistic contingency training environment.','The organization conducting the inspection/assessment obtains and examines the automated mechanism such as scenario-based interactive online training/CBT  to verify that it provides a realistic contingency training environment.'),\n('000490','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency with which to test the contingency plan for the information system.','CP-4.1','DoD has defined the frequency as at least annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at least annually.'),\n('000491','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency to exercise the contingency plan for the information system.',NULL,NULL,NULL),\n('000492','draft','2009-09-21','DISA FSO','policy','The organization defines contingency plan tests to be conducted for the information system.','CP-4.2','The organization being inspected/assessed defines and documents contingency plan tests to be conducted for the information system.  DoD has determined the contingency plan tests are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented contingency plan tests to ensure the organization being inspected/assessed defines contingency plan tests to be conducted for the information system.  DoD has determined the contingency plan tests are not appropriate to define at the Enterprise level.'),\n('000493','draft','2009-09-21','DISA FSO','policy','The organization defines contingency plan exercises to be conducted for the information system.',NULL,NULL,NULL),\n('000494','draft','2009-09-21','DISA FSO','policy','The organization tests the contingency plan for the information system in accordance with organization-defined frequency using organization-defined tests to determine the effectiveness of the plan and the organizational readiness to execute the plan.','CP-4.3','The organization being inspected/assessed conduct tests defined in CP-4, 492 at least annually to determine the effectiveness of the plan and the organizational readiness to execute the plan.  The organization must maintain a record of test results.  DoD has defined the frequency as at least annually.','The organization conducting  the inspection/assessment obtains and examines the record of test results to ensure the organization being inspected/assessed conduct tests defined in CP-4, 492 at least annually to determine the effectiveness of the plan and the organizational readiness to execute the plan.  DoD has defined the frequency as at least annually.'),\n('000495','draft','2009-09-21','DISA FSO','policy','The organization exercises the contingency plan using organization-defined exercises in accordance with organization-defined frequency.',NULL,NULL,NULL),\n('000496','draft','2009-09-21','DISA FSO','policy','The organization reviews the contingency plan test results.','CP-4.4','The organization being inspected/assessed will review the contingency plan test results.  The organization must maintain an audit trail of issues identified during the reviews of the contingency plan test results.','The organization conducting the inspection/assessment obtains and examines the audit trail of issues identified during the reviews of the contingency plan test results to ensure the organization being inspected/assessed reviews the contingency plan test results.'),\n('000497','draft','2009-09-21','DISA FSO','policy','The organization initiates corrective actions, if needed, after reviewing the contingency plan test results.','CP-4.5','The organization being inspected/assessed identifies and documents any corrective actions required after reviewing the contingency plan test results.  The organization initiates corrective actions and tracks those actions within the POA&M.','The organization conducting the inspection/assessment obtains and examines the contingency plan test results as well as any documented corrective actions required and ensures the corrective actions are being implemented and tracked within the POA&M.'),\n('000498','draft','2009-09-21','DISA FSO','policy','The organization coordinates contingency plan testing with organizational elements responsible for related plans.','CP-4(1).1','The organization being inspected/assessed coordinates the testing of its contingency plan with other organizational elements responsible for related plans.  The organization documents any applicable agreements with responsible internal or external entities.  For external entities the agreements could entail MOUs, MOAs, SLAs or contracts.','The organization conducting the inspection/assessment obtains and examines documentation of agreements with entities responsible for the contingency or related plans to ensure there is evidence of coordination of those tests.'),\n('000499','draft','2009-09-21','DISA FSO','policy','The organization coordinates contingency plan exercises with organizational elements responsible for related plans.',NULL,NULL,NULL),\n('000500','draft','2009-09-21','DISA FSO','policy','The organization tests the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and available resources.','CP-4(2).1','The organization being inspected/assessed will include personnel expected to implement the contingency plan at the alternate site in the testing at the alternate site to familiarize   contingency personnel with the facility and available resources.  The organization must maintain a record of personnel who participated in the contingency plan testing at the alternate site.','The organization conducting the inspection/assessment obtains and examines the record of personnel who participated in the contingency plan testing at the alternate site to ensure the organization being inspected/assessed tests the contingency plan at the alternate processing site to familiarize personnel expected to implement the contingency plan at the alternate site with the facility and available resources.'),\n('000501','draft','2009-09-21','DISA FSO','policy','The organization exercises the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and available resources and to evaluate the site^s capabilities to support contingency operations.',NULL,NULL,NULL),\n('000502','draft','2009-09-21','DISA FSO','policy','The organization employs automated mechanisms to more thoroughly and effectively test the contingency plan.','CP-4(3).1','The organization being inspected/assessed will identify and employ automated mechanisms to thoroughly test the contingency plan, for example by providing more complete coverage of contingency issues, selecting more realistic test scenarios and environments, and more effectively stressing the information system and supported missions.','The organization conducting the inspection/assessment obtains and examines the identified automated mechanisms in use to thoroughly test the contingency plan.'),\n('000503','draft','2009-09-21','DISA FSO','policy','The organization employs automated mechanisms to more thoroughly and effectively exercise the contingency plan by providing more complete coverage of contingency issues, selecting more realistic exercise scenarios and environments, and more effectively stressing the information and supported missions.',NULL,NULL,NULL),\n('000504','draft','2009-09-21','DISA FSO','policy','The organization includes a full recovery and reconstitution of the information system to a known state as part of contingency plan testing.','CP-4(4).1','The organization being inspected/assessed demonstrates full recovery and reconstitution of its information system to a known state as part of its contingency plan testing.   The organization documents full recovery and reconstitution as part of its contingency plan testing results.','The organization conducting the inspection/assessment obtains and examines the full recovery and reconstitution procedures and contingency plan testing results to ensure all tests were performed IAW CP-2, CCIs 446 and 447.'),\n('000505','draft','2009-09-21','DISA FSO','policy','The organization establishes an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information.','CP-6.1','The organization being inspected/assessed establishes an alternate storage site and documents relevant information within the contingency plan.','The organization conducting the inspection/assessment obtains and examines the contingency plan to confirm the organization has established an alternate storage site.'),\n('000506','draft','2009-09-21','DISA FSO','policy','The organization initiates necessary alternate storage site agreements to permit the storage and recovery of information system backup information.',NULL,NULL,NULL),\n('000507','draft','2009-09-21','DISA FSO','policy','The organization identifies an alternate storage site that is separated from the primary storage site to reduce susceptibility to the same threats.','CP-6(1).1','The organization being inspected/assessed identifies and documents within the contingency plan an alternate storage site not susceptible to the same threats that exist at the primary storage site.  The organization must document threats in the risk management strategy IAW PM-9, CCI 000227.','The organization conducting the inspection/assessment obtains and examines the risk management strategy and the contingency plan to ensure the organization identifies an alternate storage site that is separated from the primary storage site so as not to be susceptible to the same threats identified at the primary site.'),\n('000508','draft','2009-09-21','DISA FSO','policy','The organization configures the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.','CP-6(2).1','The organization being inspected/assessed configures the alternate storage site to facilitate recovery operations IAW CP-2, CCIs 446 and 447.','The organization conducting the inspection/assessment obtains and examines the contingency plan and conducts a walk-through of the alternate storage site to ensure the organization\\'s documented recovery time and recovery point objectives have been met.'),\n('000509','draft','2009-09-21','DISA FSO','policy','The organization identifies potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster.','CP-6(3).1','The organization being inspected/assessed must identify and document in the contingency plan potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster.','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure the organization has documented  potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster.'),\n('000510','draft','2009-09-21','DISA FSO','policy','The organization defines the time period consistent with recovery time and recovery point objectives for essential missions/business functions to permit the transfer and resumption of organization-defined information system operations at an alternate processing site when the primary processing capabilities are unavailable.','CP-7.1','DoD has defined the time period as 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan'),\n('000511','draft','2009-09-21','DISA FSO','policy','The organization defines the time period for achieving the recovery time objectives for business functions within which processing must be resumed at the alternate processing site.',NULL,NULL,NULL),\n('000512','draft','2009-09-21','DISA FSO','policy','The organization establishes an alternate processing site.',NULL,NULL,NULL),\n('000513','draft','2009-09-21','DISA FSO','policy','The organization establishes an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined information system operations for essential missions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.','CP-7.2','The organization being inspected/assessed  documents and gains approval for alternate processing site agreements that permit the transfer and resumption of information system operations for essential missions within 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan.','The organization conducting the inspection/assessment obtains and examines the approved alternate processing site agreements to ensure the organization has alternate processing site support that will permit the transfer and resumption of information system operations for essential missions within 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan.'),\n('000514','draft','2009-09-21','DISA FSO','policy','The organization establishes an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined information system operations for essential business functions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.','CP-7.3','The organization being inspected/assessed  documents and gains approval for alternate processing site agreements that permit the transfer and resumption of information system operations for business functions within 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan.','The organization conducting the inspection/assessment obtains and examines the approved alternate processing site agreements to ensure the organization has alternate processing site support that will permit the transfer and resumption of information system operations for business functions within 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan.'),\n('000515','draft','2009-09-21','DISA FSO','policy','The organization ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption.','CP-7.5','The organization being inspected/assessed maintains an inventory of equipment and supplies required to transfer and resume operations, or engages contract support that meets required timelines to  support 1 hour (Availability High) 12 hours (Availability Moderate) as defined in the contingency plan.','The organization conducting the inspection/assessment obtains and examines:\\n1. Inventory of equipment and supplies or,\\n2. Contract documentation\\nto ensure the organization has the equipment and supply resources necessary, or provisions to obtain the resources to transfer and resume operations at the alternate processing site within 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan.'),\n('000516','draft','2009-09-21','DISA FSO','policy','The organization identifies an alternate processing site that is separated from the primary processing site to reduce susceptibility to the same threats.','CP-7(1).1','The organization being inspected/assessed identifies and documents within the contingency plan an alternate processing site not susceptible to the same threats that exist at the primary processing site.  The organization must document threats in the risk management strategy IAW PM-9, CCI 000227.','The organization conducting the inspection/assessment obtains and examines the risk management strategy and the contingency plan to ensure the organization identifies an alternate processing site that is separated from the primary processing site so as not to be susceptible to the same threats identified at the primary site.'),\n('000517','draft','2009-09-21','DISA FSO','policy','The organization identifies potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster.','CP-7(2).1','The organization being inspected/assessed must identify and document in the contingency plan potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster.','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure the organization has documented  potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster.'),\n('000518','draft','2009-09-21','DISA FSO','policy','The organization develops alternate processing site agreements that contain priority-of-service provisions in accordance with the organizational availability requirements (including recovery time objectives).','CP-7(3).1','The organization being inspected/assessed  documents and gains approval for alternate processing site agreements that contain priority-of-service provisions in accordance with CP-2, CCI 447 (including recovery time objectives).','The organization conducting the inspection/assessment obtains and examines the approved alternate processing site agreements to ensure they contain priority-of-service provisions in accordance with CP-2, CCI 447 for alternate processing site support (including recovery time objectives).'),\n('000519','draft','2009-09-21','DISA FSO','policy','The organization prepares the alternate processing site so that it is ready to be used as the operational site supporting essential missions.','CP-7(4).1','The organization being inspected/assessed prepares the alternate processing site so that it is ready to be used as the operational site supporting essential missions IAW CP-2, CCI 443.','The organization conducting the inspection/assessment obtains and examines the contingency plan and conducts a walk-through of the alternate processing site to ensure it is ready to be used as the operational site supporting essential missions.'),\n('000520','draft','2009-09-21','DISA FSO','policy','The organization prepares the alternate processing site so that it is ready to be used as the operational site supporting essential business functions.','CP-7(4).2','The organization being inspected/assessed prepares the alternate processing site so that it is ready to be used as the operational site supporting business functions IAW CP-2, CCI 444.','The organization conducting the inspection/assessment obtains and examines the contingency plan and conducts a walk-through of the alternate processing site to ensure it is ready to be used as the operational site supporting business functions.'),\n('000521','draft','2009-09-21','DISA FSO','policy','The organization ensures that the alternate processing site provides information security safeguards equivalent to that of the primary site.','CP-7.6','The organization being inspected/assessed documents the information security safeguards that are in place at both the primary and alternate sites and evidence that the alternate site was approved based on an assessment that security is equivalent at the alternate site.','The organization conducting the inspection/assessment obtains and examines the documentation of the primary/alternate site information security safeguards that are in place as well as evidence that the alternate site was approved based on an assessment that security is equivalent at the alternate site.'),\n('000522','draft','2009-09-21','DISA FSO','policy','The organization defines the time period within which to permit the resumption of organization-defined information system operations for essential missions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.','CP-8.1','DoD has defined the time period as 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan.'),\n('000523','draft','2009-09-21','DISA FSO','policy','The organization defines the time period within which to permit the resumption of organization-defined information system operations for essential business functions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.','CP-8.2','DoD has defined the time period as 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan.'),\n('000524','draft','2009-09-21','DISA FSO','policy','The organization establishes alternate telecommunication services including necessary agreements to permit the resumption of organization-defined information system operations for essential missions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.','CP-8.3','The organization being inspected/assessed  documents and gains approval for alternate telecommunications service agreements that permit the resumption of telecommunications services for essential missions IAW DoDI 8100.04.  DoD has defined the time period as  1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan.','The organization conducting the inspection/assessment obtains and examines the approved alternate telecommunications service agreements to ensure they permit the resumption of telecommunications services for essential mission IAW DoDI 8100.04.  DoD has defined the time period as  1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan.'),\n('000525','draft','2009-09-21','DISA FSO','policy','The organization establishes alternate telecommunication services including necessary agreements to permit the resumption of organization-defined information system operations for essential business functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.','CP-8.4','The organization being inspected/assessed documents and gains approval for alternate telecommunications service agreements that permit the resumption of telecommunications services for business functions IAW DoDI 8100.04.  DoD has defined the time period as  1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan.','The organization conducting the inspection/assessment obtains and examines the approved alternate telecommunications service agreements to ensure they permit the resumption of telecommunications services for business functions IAW DoDI 8100.04.  DoD has defined the time period as 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan.'),\n('000526','draft','2009-09-21','DISA FSO','policy','The organization develops primary telecommunications service agreements that contain priority-of-service provisions in accordance with the organization^s availability requirements (including recovery time objectives).','CP-8(1).1','The organization being inspected/assessed  documents and gains approval for primary telecommunications service agreements that contain priority-of-service provisions IAW DoDI 8100.04  (including recovery time objectives).','The organization conducting the inspection/assessment obtains and examines the approved primary telecommunications service agreements to ensure they contain priority-of-service provisions IAW DoDI 8100.04  (including recovery time objectives).'),\n('000527','draft','2009-09-21','DISA FSO','policy','The organization develops alternate telecommunications service agreements that contain priority-of-service provisions in accordance with the organization^s availability requirements (including recovery time objectives).','CP-8(1).2','The organization being inspected/assessed  documents and gains approval for alternate telecommunications service agreements that contain priority-of-service provisions IAW DoDI 8100.04  (including recovery time objectives).','The organization conducting the inspection/assessment obtains and examines the approved alternate telecommunications service agreements to ensure they contain priority-of-service provisions IAW DoDI 8100.04  (including recovery time objectives).'),\n('000528','draft','2009-09-21','DISA FSO','policy','The organization requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary telecommunications services are provided by a common carrier.','CP-8(1).3','The organization being inspected/assessed identifies and documents within the contingency plan any telecommunications services used for national security emergency preparedness. If the primary telecommunications services are provided by a common carrier, the organization formally requests Telecommunications Service Priority IAW the DHS Telecommunications Service Priority Process http://www.dhs.gov/telecommunications-service-priority-tsp. If the primary telecommunications services are provided by a mid-tier provider instead of a common carrier (for example, DISA) the organization must insure that their provider formally requests Telecommunications Service Priority on their behalf.','The organization conducting the inspection/assessment obtains and examines the contingency plan, the telecommunication service agreement, and any existing formal requests for Telecommunications Service Priority.\\n\\nThe purpose of the review is to ensure the organization or the mid-tier provider has requested Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness where the primary telecommunications services are provided by a common carrier.'),\n('000529','draft','2009-09-21','DISA FSO','policy','The organization requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the alternate telecommunications services are provided by a common carrier.','CP-8(1).4','The organization being inspected/assessed identifies and documents within the contingency plan telecommunications services used for national security emergency preparedness in the event the alternate telecommunications services are provided by a common carrier.  For each service, the organization formally requests Telecommunications Service Priority, IAW the DHS Telecommunications Service Priority Process http://tsp.ncs.gov/request.html.','The organization conducting the inspection/assessment obtains and examines the contingency plan, the telecommunication service agreement, and any existing formal requests for Telecommunications Service Priority.  The purpose of the review is to ensure the organization has requested Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event the alternate telecommunications services are provided by a common carrier.'),\n('000530','draft','2009-09-21','DISA FSO','policy','The organization obtains alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.','CP-8(2).1','The organization being inspected/assessed obtains alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services IAW DoDI 8100.04.','The organization conducting the inspection/assessment obtains and examines agreements with their service providers to ensure that a single point of failure is not shared.'),\n('000531','draft','2009-09-21','DISA FSO','policy','The organization obtains alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.','CP-8(3).1','The organization being inspected/assessed obtains alternate telecommunications services from providers that are separated from primary service providers so as not to be susceptible to the same hazards IAW DoDI 8100.04.','The organization conducting the inspection/assessment obtains and examines agreements with alternate service providers to ensure they are not susceptible to the same hazards as the primary service provider.'),\n('000532','draft','2009-09-21','DISA FSO','policy','The organization requires primary telecommunications service providers to have contingency plans.','CP-8(4).1','The organization being inspected/assessed includes in their primary telecommunications service provider agreements requirements for the primary service provider to have contingency plans.','The organization conducting the inspection/assessment obtains and examines the primary telecommunications service provider agreements to ensure the organization requires the primary service provider to have contingency plans.'),\n('000533','draft','2009-09-21','DISA FSO','policy','The organization requires alternate telecommunications service providers to have contingency plans.','CP-8(4).2','The organization being inspected/assessed includes in their alternate telecommunications service provider agreements requirements for the alternate service provider to have contingency plans.','The organization conducting the inspection/assessment obtains and examines the alternate telecommunications service provider agreements to ensure the organization requires the alternate service provider to have contingency plans.'),\n('000534','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency of conducting user-level information backups to support recovery time objectives and recovery point objectives.','CP-9.1','DoD has defined the frequency as at least weekly as defined in the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at least weekly as defined in the contingency plan.'),\n('000535','draft','2009-09-21','DISA FSO','policy','The organization conducts backups of user-level information contained in the information system per organization-defined frequency that is consistent with recovery time and recovery point objectives.','CP-9.2','The organization being inspected/assessed must identify user level information within the backup strategy and configure the system to perform backups at least weekly as defined in the contingency plan.','The organization conducting the inspection/assessment obtains and reviews the backup strategy, and examines a sample of systems to ensure they are configured to perform back ups at least weekly as defined in the contingency plan.'),\n('000536','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency of conducting system-level information backups to support recovery time objectives and recovery point objectives.','CP-9.3','DoD has defined the frequency as at least weekly and as required by system baseline configuration changes in accordance with the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at least weekly and as required by system baseline configuration changes in accordance with the contingency plan.'),\n('000537','draft','2009-09-21','DISA FSO','policy','The organization conducts backups of system-level information contained in the information system per organization-defined frequency that is consistent with recovery time and recovery point objectives.','CP-9.4','The organization being inspected/assessed must identify system-level information within the backup strategy and configure the system to perform backups at least weekly and as required by system baseline configuration changes in accordance with the contingency plan.','The organization conducting the inspection/assessment obtains and reviews the backup strategy, and examines a sample of systems to ensure they are configured to perform back ups at least weekly and as required by system baseline configuration changes in accordance with the contingency plan.'),\n('000538','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency of conducting information system documentation backups, including security-related documentation, to support recovery time objectives and recovery point objectives.','CP-9.5','DoD has defined the frequency as when created or received, when updated, and as required by system baseline configuration changes in accordance with the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as when created or received, when updated, and as required by system baseline configuration changes in accordance with the contingency plan.'),\n('000539','draft','2009-09-21','DISA FSO','policy','The organization conducts backups of information system documentation, including security-related documentation, per an organization-defined frequency that is consistent with recovery time and recovery point objectives.','CP-9.6','The organization being inspected/assessed conducts backups of information system documentation including security-related documentation when created or received, when updated, and as required by system baseline configuration changes in accordance with the contingency plan.','The organization conducting the inspection/assessment obtains and examines the latest version of the information system  documentation including security-related documentation to verify it is the same version as contained in backups.'),\n('000540','draft','2009-09-21','DISA FSO','policy','The organization protects the confidentiality, integrity, and availability of backup information at storage locations.','CP-9.7','The organization being inspected/assessed will protect the confidentiality, integrity, and availability of backup information at the storage location IAW the system security plan.','The organization conducting the inspection/assessment obtains and examines the system security plan and ensures backup information at the storage location is protected IAW the system security plan.'),\n('000541','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency with which to test backup information to verify media reliability and information integrity.','CP-9(1).1','DoD has defined the frequency as at least monthly in accordance with contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at least monthly in accordance with contingency plan.'),\n('000542','draft','2009-09-21','DISA FSO','policy','The organization tests backup information per an organization-defined frequency to verify media reliability and information integrity.','CP-9(1).2','The organization being inspected/assessed tests and logs backup information at least monthly in accordance with contingency plan to verify media reliability and information integrity.','The organization conducting the inspection/assessment obtains and examines the backup plan and verifies that the organization has tested and logged backup information.'),\n('000543','draft','2009-09-21','DISA FSO','policy','The organization uses a sample of backup information in the restoration of selected information system functions as part of contingency plan testing.','CP-9(2).1','The organization being inspected/assessed restores a sample of backup information as part of the restoration of selected information system functions during contingency plan testing.  Organizations must identify a sample of backup information in the contingency plan test results.','The organization conducting the inspection/assessment obtains and examines the contingency plan test results to verify that the sample of backup information was restored as part of the restoration of selected information system functions.'),\n('000544','draft','2009-09-21','DISA FSO','policy','The organization stores backup copies of the operating system in a separate facility or in a fire-rated container that is not colocated with the operational system.',NULL,NULL,NULL),\n('000545','draft','2009-09-21','DISA FSO','policy','The organization stores backup copies of critical information system software in a separate facility or in a fire-rated container that is not colocated with the operational system.',NULL,NULL,NULL),\n('000546','draft','2009-09-21','DISA FSO','policy','The organization stores backup copies of the information system inventory (including hardware, software, and firmware components) in a separate facility or in a fire-rated container that is not colocated with the operational system.',NULL,NULL,NULL),\n('000547','draft','2009-09-21','DISA FSO','policy','The organization defines the time period and transfer rate of the information system backup information to the alternate storage site consistent with the recovery time and recovery point objectives.','CP-9(5).1','DoD has defined the time period as Continuously (Availability High )  24 hours (Availability Moderate)  7 days (Availability Low)  as defined in the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as Continuously (Availability High )  24 hours (Availability Moderate)  7 days (Availability Low)  as defined in the contingency plan.'),\n('000548','draft','2009-09-21','DISA FSO','policy','The organization transfers information system backup information to the alternate storage site in accordance with the organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives.','CP-9(5).2','The organization being inspected/assessed performs the transfer of  information system backup information to the alternate site Continuously (Availability High)  24 hours (Availability Moderate)  7 days (Availability Low)  as defined in the contingency plan.','The organization conducting the inspection/assessment obtains and examines the contingency plan and related logs to ensure the organization transfers information system backup information to the alternate site Continuously (Availability High)  24 hours (Availability Moderate) 7 days (Availability Low)  as defined in the contingency plan.'),\n('000549','draft','2009-09-21','DISA FSO','policy','The organization maintains a redundant secondary information system that is not collocated with the primary system.','CP-9(6).1','The organization being inspected/assessed establishes and maintains a redundant, secondary backup system that is not co-located with the primary system.','The organization conducting the inspection/assessment determines if the organization is maintaining a redundant, secondary backup system that is not co-located with the primary system.'),\n('000550','draft','2009-09-21','DISA FSO','policy','The organization provides for the recovery and reconstitution of the information system to a known state after a disruption.','CP-10.1','The organization being inspected/assessed provides automated mechanisms or manual procedures, or a combination of the two, for the recovery and reconstitution of its information system to a known state after a disruption.  The organization must identify the selected method in the contingency plan.','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it identifies the recovery and reconstitution method for its information system to a known state after a disruption.'),\n('000551','draft','2009-09-21','DISA FSO','policy','The organization provides for the recovery and reconstitution of the information system to a known state after a compromise.','CP-10.2','The organization being inspected/assessed provides automated mechanisms or manual procedures, or a combination of the two, for the recovery and reconstitution of its information system to a known state after a compromise.  The organization must identify the selected method in the contingency plan.','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it identifies the recovery and reconstitution method for its information system to a known state after a compromise.'),\n('000552','draft','2009-09-21','DISA FSO','policy','The organization provides for the recovery and reconstitution of the information system to a known state after a failure.','CP-10.3','The organization being inspected/assessed provides automated mechanisms or manual procedures, or a combination of the two, for the recovery and reconstitution of its information system to a known state after a failure.  The organization must identify the selected method in the contingency plan.','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it identifies the recovery and reconstitution method for its information system to a known state after a failure.'),\n('000553','draft','2009-09-21','DISA FSO','policy','The information system implements transaction recovery for systems that are transaction-based.','CP-10(2).1','The organization being inspected/assessed identifies, documents, and implements transaction recovery capability for systems that are transaction-based.   The organization must document transaction recovery results as part of contingency plan testing.','The organization conducting the inspection/assessment obtains and examines the contingency plan test results to verify transaction recovery.'),\n('000554','draft','2009-09-21','DISA FSO','policy','The organization defines in the security plan, explicitly or by reference, the circumstances that can inhibit recovery and reconstitution of the information system to a known state.',NULL,NULL,NULL),\n('000555','draft','2009-09-21','DISA FSO','policy','The organization provides compensating security controls for organization-defined circumstances that can inhibit recovery and reconstitution of the information system to a known state.',NULL,NULL,NULL),\n('000556','draft','2009-09-21','DISA FSO','policy','The organization defines restoration time periods within which to restore information system components from configuration-controlled and integrity-protected information representing a known, operational state for the components.','CP-10(4).1','DoD has defined the time period as  1 hour (Availability High )  24 hours (Availability Moderate)  1 - 5 days (Availability Low)  as defined in the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as  1 hour (Availability High )  24 hours (Availability Moderate)  1 - 5 days (Availability Low)  as defined in the contingency plan.'),\n('000557','draft','2009-09-21','DISA FSO','policy','The organization provides the capability to restore information system components within organization-defined restoration time periods from configuration-controlled and integrity-protected information representing a known, operational state for the components.','CP-10(4).2','The organization being inspected/assessed exercises the capability to restore information system components from configuration-controlled and integrity-protected information representing a secure, operational state for the components within the defined time period during contingency plan testing: 1 hour (Availability High ) 24 hours (Availability Moderate) 1 - 5 days (Availability Low)  as defined in the contingency plan.','The organization conducting the inspection/assessment obtains and examines contingency plan test results to verify the organization exercises the capability to restore information system components from configuration-controlled and integrity-protected information representing a secure, operational state for the components, and that restoration occurred within the defined time period: 1 hour (Availability High ) 24 hours (Availability Moderate) 1 - 5 days (Availability Low)  as defined in the contingency plan.'),\n('000558','draft','2009-09-21','DISA FSO','policy','The organization defines the real-time or near-real-time failover capability to be provided for the information system.','SI-13(5).1','The organization being inspected/assessed defines and documents the real-time or near-real-time failover capability to be provided for the information system.  DoD has determined the failover capability is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented failover capability to ensure the organization being inspected/assessed  defines the real-time or near-real-time failover capability to be provided for the information system.  DoD has determined the failover capability is not appropriate to define at the Enterprise level.'),\n('000559','draft','2009-09-21','DISA FSO','policy','The organization provides real-time or near-real-time organization-defined failover capability for the information system.','SI-13(5).2','The organization being inspected/assessed designs the information system to provide real-time or near-real-time  failover capability defined in SI-13 (5), CCI 558  for the information system.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed provides real-time or near-real-time  failover capability defined in SI-13 (5), CCI 558  for the information system.'),\n('000560','draft','2009-09-21','DISA FSO','policy','The organization protects backup and restoration hardware.','CP-10(6).1','The organization being inspected/assessed implements and documents policies and back up procedures designed to protect its backup and restoration hardware.','The organization conducting the inspection/assessment obtains and examines documentation of protection measures to ensure the organization is actively protecting backup and restoration hardware.'),\n('000561','draft','2009-09-21','DISA FSO','policy','The organization protects backup and restoration firmware.','CP-10(6).2','The organization being inspected/assessed implements and documents policies and back up procedures designed to protect its backup and restoration firmware.','The organization conducting the inspection/assessment obtains and examines documentation of protection measures to ensure the organization is actively protecting backup and restoration firmware.'),\n('000562','draft','2009-09-21','DISA FSO','policy','The organization protects backup and restoration software.','CP-10(6).3','The organization being inspected/assessed implements and documents policies and back up procedures designed to protect its backup and restoration software.','The organization conducting the inspection/assessment obtains and examines documentation of protection measures to ensure the organization is actively protecting backup and restoration software.'),\n('000563','draft','2009-09-21','DISA FSO','policy','The organization develops and documents a security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','PL-1.3','DoDI 8510.01 meets the requirements for  a security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.','DoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.'),\n('000564','draft','2009-09-21','DISA FSO','policy','The organization disseminates a security planning policy to organization-defined personnel or roles.','PL-1.4','DoD disseminates DoDI 8510.01 via the DoD Issuances website (http://www.dtic.mil/whs/directives/corres/dir.html) to organizational personnel with planning responsibilities or information security responsibilities.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.\\n\\nDoD has defined the roles as organizational personnel with planning responsibilities or information security responsibilities.','DoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.\\n\\nDoD has defined the roles as organizational personnel with planning responsibilities or information security responsibilities.'),\n('000565','deprecated','2009-09-21','DISA FSO','policy','The organization reviews/updates, per organization-defined frequency, a formal, documented security planning policy.',NULL,NULL,NULL),\n('000566','draft','2009-09-21','DISA FSO','policy','The organization develops and documents procedures to facilitate the implementation of the security planning policy and associated security planning controls.','PL-1.5','DoDI 8510.01 meets the requirements for developing and documenting procedures to facilitate the implementation of the security planning policy and associated security planning controls.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.','DoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.'),\n('000567','draft','2009-09-21','DISA FSO','policy','The organization disseminates security planning procedures to organization-defined personnel or roles.','PL-1.8','DoD disseminates DoDI 8510.01 via the DoD Issuances website (http://www.dtic.mil/whs/directives/corres/dir.html) to organizational personnel with planning responsibilities or information security responsibilities.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.\\n\\nDoD has defined the roles as organizational personnel with planning responsibilities or information security responsibilities.','DoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.\\n\\nDoD has defined the roles as organizational personnel with planning responsibilities or information security responsibilities.'),\n('000568','draft','2009-09-21','DISA FSO','policy','The organization reviews and updates the current security planning procedures in accordance with organization-defined frequency.','PL-1.9','DoDI 8510.01 meets the requirements for a security planning policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.','DoDI 8510.01 meets the requirements for a security planning policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.'),\n('000570','draft','2009-09-21','DISA FSO','policy','The organization develops a security plan for the information system that is consistent with the organization^s enterprise architecture; explicitly defines the authorization boundary for the system; describes the operational context of the information system in terms of mission and business processes; provides the security category and impact level of the information system, including supporting rationale; describes the operational environment for the information system; describes relationships with, or connections to, other information systems; provides an overview of the security requirements for the system; and describes the security controls in place or planned for meeting those requirements, including a rationale for the tailoring and supplemental decisions.',NULL,NULL,NULL),\n('000571','draft','2009-09-21','DISA FSO','policy','The organization^s security plan for the information system is reviewed and approved by the authorizing official or designated representative prior to plan implementation.','PL-2.10','The organization being inspected/assessed obtains security plan approval by the authorizing official or designated representative prior to plan implementation.','The organization conducting the inspection/assessment obtains and examines the security plan approval to ensure the organization being inspected/assessed obtains security plan approval by the authorizing official or designated representative prior to plan implementation.'),\n('000572','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency for reviewing the security plan for the information system.','PL-2.15','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('000573','draft','2009-09-21','DISA FSO','policy','The organization reviews the security plan for the information system in accordance with organization-defined frequency.','PL-2.16','The information system owner as part of the annual security control review will also review the security plan annually.  Documentation of security plan reviews is required as an audit trail.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines the audit records of security plan reviews to verify the security plan has been reviewed annually.  DoD has defined the frequency as annually.'),\n('000574','draft','2009-09-21','DISA FSO','policy','The organization updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments.','PL-2.17','The information system owner will update the security plan  as necessary to address changes to information system/environment of operation or problems identified during plan implementation or security control assessments.  Documentation of security plan updates are required as an audit trail.','The organization conducting the inspection/assessment obtains and examines the audit records of security plan updates to verify the security plan is current.  The purpose of the reviews is to validate the organization is updating the Information System (IS) security plan to address changes to the IS, its environment of operation, or problems identified during plan implementation or security control assessments.'),\n('000576','draft','2009-09-21','DISA FSO','policy','The organization develops a security Concept of Operations (CONOPS) for the information system containing, at a minimum: the purpose of the system; a description of the system architecture; the security authorization schedule; and the security categorization and associated factors considered in determining the categorization.',NULL,NULL,NULL),\n('000577','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency with which to review and update the security CONOPS.','PL-7.2','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('000578','draft','2009-09-21','DISA FSO','policy','The organization reviews and updates the security CONOPS in accordance with organization-defined frequency.','PL-7.3','The organization being inspected/assessed reviews and updates the security CONOPS annually.  The organization must maintain an audit trail of reviews and updates.   DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the security CONOPS annually.  DoD has defined the frequency as annually.'),\n('000580','draft','2009-09-21','DISA FSO','policy','The organization develops a functional architecture for the information system that identifies and maintains external interfaces.',NULL,NULL,NULL),\n('000581','draft','2009-09-21','DISA FSO','policy','The organization develops a functional architecture for the information system that identifies and maintains the information being exchanged across the interfaces.',NULL,NULL,NULL),\n('000582','draft','2009-09-21','DISA FSO','policy','The organization develops a functional architecture for the information system that identifies and maintains the protection mechanisms associated with each interface.',NULL,NULL,NULL),\n('000583','draft','2009-09-21','DISA FSO','policy','The organization develops a functional architecture for the information system that identifies and maintains user roles.',NULL,NULL,NULL),\n('000584','draft','2009-09-21','DISA FSO','policy','The organization develops a functional architecture for the information system that identifies and maintains the access privileges assigned to each role.',NULL,NULL,NULL),\n('000585','draft','2009-09-21','DISA FSO','policy','The organization develops a functional architecture for the information system that identifies and maintains unique security requirements.',NULL,NULL,NULL),\n('000586','draft','2009-09-21','DISA FSO','policy','The organization develops a functional architecture for the information system that identifies and maintains types of information processed by the information system.',NULL,NULL,NULL),\n('000587','draft','2009-09-21','DISA FSO','policy','The organization develops a functional architecture for the information system that identifies and maintains types of information stored by the information system.',NULL,NULL,NULL),\n('000588','draft','2009-09-21','DISA FSO','policy','The organization develops a functional architecture for the information system that identifies and maintains types of information transmitted by the information system.',NULL,NULL,NULL),\n('000589','draft','2009-09-21','DISA FSO','policy','The organization develops a functional architecture for the information system that identifies and maintains any specific protection needs in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.',NULL,NULL,NULL),\n('000590','draft','2009-09-21','DISA FSO','policy','The organization develops a functional architecture for the information system that identifies and maintains restoration priority of information.',NULL,NULL,NULL),\n('000591','draft','2009-09-21','DISA FSO','policy','The organization develops a functional architecture for the information system that identifies and maintains restoration priority of information system services.',NULL,NULL,NULL),\n('000592','draft','2009-09-21','DISA FSO','policy','The organization establishes the rules describing the responsibilities and expected behavior, with regard to information and information system usage, for individuals requiring access to the information system.','PL-4.1','The organization being inspected/assessed must develop and document rules that describe information system user responsibilities and expected behavior with regard to information and information system usage, acceptable use policy (AUP).  Organizations should reference Joint Ethics Regulations (DoD 5500.7-R) when developing this policy.','The organization conducting the inspection/assessment obtains and examines the organization\\'s AUP to ensure  the organization has clearly defined and established rules describing information system user responsibilities and expected behavior with regard to information and information system usage.'),\n('000593','draft','2009-09-21','DISA FSO','policy','The organization receives a signed acknowledgment from individuals requiring access to the information system, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system.','PL-4.3','The organization being inspected/assessed will  obtain  signed acknowledgment (paper or electronic signature) from individuals indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system.','The organization conducting the inspection/assessment obtains a list of individuals with active accounts and validates the existence of signed acknowledgements (paper or electronic signature) of the organizational AUP associated with a sampling of individuals selected from the list.'),\n('000594','draft','2009-09-21','DISA FSO','policy','The organization includes in the rules of behavior explicit restrictions on the use of social media/networking sites.','PL-4(1).1','The organization being inspected/assessed includes in the rules of behavior, IAW DoDI 8550.01, explicit restrictions on the use of social media/networking sites.','The organization conducting the inspection/assessment obtains and examines the rules of behavior to ensure the organization being inspected/assessed includes explicit restrictions on the use of social media/networking sites IAW DoDI 8550.01.'),\n('000595','draft','2009-09-21','DISA FSO','policy','The organization includes in the rules of behavior explicit restrictions on posting organizational information on public websites.','PL-4(1).2','The organization being inspected/assessed includes in the rules of behavior, IAW DoDI 8550.01, explicit restrictions on posting organizational information on public websites.','The organization conducting the inspection/assessment obtains and examines the rules of behavior to ensure the organization being inspected/assessed includes explicit restrictions on posting organizational information on public websites IAW DoDI 8550.01.'),\n('000596','draft','2009-09-21','DISA FSO','policy','The organization includes in the rules of behavior, explicit restrictions on sharing information system account information.',NULL,NULL,NULL),\n('000597','draft','2009-09-21','DISA FSO','policy','The organization conducts a privacy impact assessment on the information system in accordance with OMB policy.',NULL,NULL,NULL),\n('000598','draft','2009-09-21','DISA FSO','policy','The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational operations (i.e., mission, functions, image, and reputation).',NULL,NULL,NULL),\n('000599','draft','2009-09-21','DISA FSO','policy','The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational assets.',NULL,NULL,NULL),\n('000600','draft','2009-09-21','DISA FSO','policy','The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational individuals.',NULL,NULL,NULL),\n('000601','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency with which to review and update the current system and services acquisition policy.','SA-1.7','DoD has defined the frequency as every 5 years.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every 5 years.'),\n('000602','draft','2009-09-21','DISA FSO','policy','The organization develops and documents a system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','SA-1.4','DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.','DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.'),\n('000603','draft','2009-09-21','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles a system and services acquisition policy.','SA-1.3','DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.','DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.'),\n('000604','draft','2009-09-21','DISA FSO','policy','The organization reviews and updates the current system and services acquisition policy in accordance with organization-defined frequency.','SA-1.8','DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.','DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.'),\n('000605','draft','2009-09-21','DISA FSO','policy','The organization develops and documents procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls.','SA-1.5','DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.','DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.'),\n('000606','draft','2009-09-21','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls.','SA-1.6','DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.','DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.'),\n('000607','draft','2009-09-21','DISA FSO','policy','The organization reviews and updates the current system and services acquisition procedures in accordance with organization-defined frequency.','SA-1.9','DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.','DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1.'),\n('000608','draft','2009-09-21','DISA FSO','policy','The organization includes a determination of information security requirements for the information system in mission process planning.',NULL,NULL,NULL),\n('000609','draft','2009-09-21','DISA FSO','policy','The organization includes a determination of information security requirements for the information system in business process planning.',NULL,NULL,NULL),\n('000610','draft','2009-09-21','DISA FSO','policy','The organization determines the resources required to protect the information system or information system service as part of its capital planning and investment control process.','SA-2.2','The organization being inspected/assessed determines the resources (funding, staffing, etc.) required for the cybersecurity requirements to protect the information system or information system service as part of its planning, programming, and budget  process (PPBE).','The organization conducting the inspection/assessment obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has determined the resources required for cybersecurity requirements to protect the information system or information system service.'),\n('000611','draft','2009-09-21','DISA FSO','policy','The organization documents the resources required to protect the information system or information system service as part of its capital planning and investment control process.','SA-2.3','The organization being inspected/assessed documents the resources (funding, staffing, etc.) required for the cybersecurity requirements to protect the information system or information system service as part of its planning, programming, and budget  process (PPBE).','The organization conducting the inspection/assessment obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has documented the resources required for cybersecurity requirements to protect the information system or information system service.'),\n('000612','draft','2009-09-21','DISA FSO','policy','The organization allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process.','SA-2.4','The organization being inspected/assessed allocates the resources (funding, staffing, etc.) required for the cybersecurity requirements to protect the information system or information system service  as part of its planning, programming, and budget  process (PPBE).','The organization conducting the inspection/assessment obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has allocated the resources required for cybersecurity requirements to protect the information system or information system service.'),\n('000613','draft','2009-09-21','DISA FSO','policy','The organization establishes a discrete line item for information security in organizational programming documentation.','SA-2.5','The organization being inspected/assessed identifies and establishes an individual line item for cybersecurity requirements to protect the information system  as part of the planning, programming, and budget  process (PPBE).','The organization conducting the inspection/assessment obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has identified and established an individual line item for cybersecurity requirements to protect the information system.'),\n('000614','draft','2009-09-21','DISA FSO','policy','The organization establishes a discrete line item for information security in organizational budgeting documentation.','SA-2.6','The organization being inspected/assessed identifies and establishes an individual line item for cybersecurity requirements to protect the information system  as part of the planning, programming, and budget  process (PPBE).','The organization conducting the inspection/assessment obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has identified and established an individual line item for cybersecurity requirements to protect the information system.'),\n('000615','draft','2009-09-21','DISA FSO','policy','The organization manages the information system using an organization-defined system development life cycle that incorporates information security considerations.','SA-3.1','The organization being inspected/assessed documents and implements a process  to manage the information system using the system development life cycle defined in SA-3, CCI 3092 that incorporates information security considerations IAW DoDI 8580.1.','The organization conducting the inspection/assessment obtains and examines the documented process and artifacts of the system development life cycle process to ensure the organization being inspected/assessed manages the information system using the system development life cycle defined in SA-3, CCI 3092 that incorporates information security considerations IAW DoDI 8580.1.'),\n('000616','draft','2009-09-21','DISA FSO','policy','The organization defines and documents information system security roles and responsibilities throughout the system development life cycle.','SA-3.3','The organization being inspected/assessed defines and documents information system security roles and responsibilities throughout the system development life cycle IAW DoDI 8580.1.','The organization conducting the inspection/assessment obtains and examines the information system security roles and responsibilities to ensure the organization being inspected/assessed defines and documents information system security roles and responsibilities throughout the system development life cycle IAW DoDI 8580.1.'),\n('000617','draft','2009-09-21','DISA FSO','policy','The organization documents information system security roles and responsibilities throughout the system development life cycle.',NULL,NULL,NULL),\n('000618','draft','2009-09-21','DISA FSO','policy','The organization identifies individuals having information system security roles and responsibilities.','SA-3.4','The organization being inspected/assessed identifies and documents individuals having information system security roles and responsibilities.','The organization conducting the inspection/assessment obtains and examines the documented individuals having information system security roles and responsibilities to ensure the organization being inspected/assessed identifies individuals having information system security roles and responsibilities.'),\n('000619','draft','2009-09-21','DISA FSO','policy','The organization includes security functional requirements/specifications, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.',NULL,NULL,NULL),\n('000620','draft','2009-09-21','DISA FSO','policy','The organization includes security-related documentation requirements, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.',NULL,NULL,NULL),\n('000621','draft','2009-09-21','DISA FSO','policy','The organization includes developmental and evaluation-related assurance requirements, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.',NULL,NULL,NULL),\n('000623','draft','2009-09-21','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to provide a description of the functional properties of the security controls to be employed.','SA-4(1).1','DoDI 8510.01 system categorization meets the DoD requirement for providing a description of the functional properties of the security controls to be employed.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01.','DoDI 8510.01 system categorization meets the DoD requirement for providing a description of the functional properties of the security controls to be employed.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01.'),\n('000624','draft','2009-09-21','DISA FSO','policy','The organization requires in acquisition documents that vendors/contractors provide information describing the design details of the security controls to be employed within the information system, information system components, or information system services (including functional interfaces among control components) in sufficient detail to permit analysis and testing of the controls.',NULL,NULL,NULL),\n('000625','draft','2009-09-21','DISA FSO','policy','The organization requires in acquisition documents that vendors/contractors provide information describing the implementation details of the security controls to be employed within the information system, information system components, or information system services (including functional interfaces among control components) in sufficient detail to permit analysis and testing of the controls.',NULL,NULL,NULL),\n('000626','draft','2009-09-21','DISA FSO','policy','The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development process employs state-of-the-practice software and security engineering methods.',NULL,NULL,NULL),\n('000627','draft','2009-09-21','DISA FSO','policy','The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development process employs quality control processes.',NULL,NULL,NULL),\n('000628','draft','2009-09-21','DISA FSO','policy','The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development processes employ validation techniques.',NULL,NULL,NULL),\n('000629','draft','2009-09-21','DISA FSO','policy','The organization ensures each information system component acquired is explicitly assigned to an information system, and that the owner of the system acknowledges this assignment.',NULL,NULL,NULL),\n('000630','draft','2009-09-21','DISA FSO','policy','The organization requires in acquisition documents, that information system components are delivered in a secure, documented configuration, and that the secure configuration is the default configuration for any software reinstalls or upgrades.',NULL,NULL,NULL),\n('000631','draft','2009-09-21','DISA FSO','policy','The organization employs only government off-the-shelf (GOTS) or commercial off-the-shelf (COTS) information assurance (IA) and IA-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted.','SA-4(6).1','The organization being inspected/assessed must identify and use NSA-approved encryption technologies to protect classified information when the networks or transmission medium used to transmit the information are at a lower classification level than the information being transmitted.','The organization conducting the inspection/assessment examines and verifies identified encryption technologies in use by the organization being inspected/assessed are NSA-approved.'),\n('000632','deprecated','2009-09-21','DISA FSO','policy','The organization employs only commercial off-the-shelf (COTS) information assurance (IA) and IA-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted.',NULL,NULL,NULL),\n('000633','draft','2009-09-21','DISA FSO','policy','The organization ensures that government off-the-shelf (GOTS) or commercial-off-the-shelf(COTS) information assurance (IA) and IA-enabled information technology products have been evaluated and/or validated by the NSA or in accordance with NSA-approved procedures.','SA-4(6).2','The organization being inspected/assessed must identify and use NSA-approved encryption technologies to protect classified information when the networks or transmission medium used to transmit the information are at a lower classification level than the information being transmitted.','The organization conducting the inspection/assessment examines and verifies identified encryption technologies in use by the organization being inspected/assessed are NSA-approved.'),\n('000634','draft','2009-09-21','DISA FSO','policy','The organization limits the use of commercially provided information assurance (IA) and IA-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance Partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists.','SA-4(7).1','The organization being inspected/assessed, when using commercially provided IA and IA-enabled IT products uses only products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists.','The organization conducting the inspection/assessment obtains and examines the hardware and software lists to ensure the organization being inspected/assessed, when using commercially provided IA and IA-enabled IT products uses only products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists.'),\n('000635','draft','2009-09-21','DISA FSO','policy','The organization requires, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated.','SA-4(7).2','The organization being inspected/assessed, when using commercially provided IA or IA enabled IT products for which there is no NIAP-approved protection profile, relies on FIPS-validated cryptographic modules.','The organization conducting the inspection/assessment obtains and examines the hardware and software lists to ensure the organization being inspected/assessed, when using commercially provided IA or IA enabled IT products for which there is no NIAP-approved protection profile, relies on FIPS-validated cryptographic modules.'),\n('000636','draft','2009-09-21','DISA FSO','policy','The organization obtains administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.',NULL,NULL,NULL),\n('000637','draft','2009-09-21','DISA FSO','policy','The organization protects, as required, administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.',NULL,NULL,NULL),\n('000638','draft','2009-09-21','DISA FSO','policy','The organization makes available to authorized personnel administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.',NULL,NULL,NULL),\n('000639','draft','2009-09-21','DISA FSO','policy','The organization obtains user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.',NULL,NULL,NULL),\n('000640','draft','2009-09-21','DISA FSO','policy','The organization protects, as required, user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.',NULL,NULL,NULL),\n('000641','draft','2009-09-21','DISA FSO','policy','The organization makes available to authorized personnel user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system.',NULL,NULL,NULL),\n('000642','draft','2009-09-21','DISA FSO','policy','The organization documents attempts to obtain information system, system component, or information system service documentation when such documentation is either unavailable or nonexistent.','SA-5.11','The organization being inspected/assessed documents attempts to obtain information system, system component, or information system service documentation when such documentation is either unavailable or nonexistent.','The organization conducting the inspection/assessment obtains and examines the documented attempts to ensure the organization being inspected/assessed documents attempts to obtain information system, system component, or information system service documentation when such documentation is either unavailable or nonexistent.'),\n('000643','draft','2009-09-21','DISA FSO','policy','The organization obtains vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system with sufficient detail to permit analysis and testing.',NULL,NULL,NULL),\n('000644','draft','2009-09-21','DISA FSO','policy','The organization protects, as required, vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system.',NULL,NULL,NULL),\n('000645','draft','2009-09-21','DISA FSO','policy','The organization makes available to authorized personnel vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system with sufficient detail to permit analysis and testing.',NULL,NULL,NULL),\n('000646','draft','2009-09-21','DISA FSO','policy','The organization obtains vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system with sufficient detail to permit analysis and testing.',NULL,NULL,NULL),\n('000647','draft','2009-09-21','DISA FSO','policy','The organization obtains vendor/manufacturer documentation that describes the high-level design of the information system in terms of subsystems and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.',NULL,NULL,NULL),\n('000648','draft','2009-09-21','DISA FSO','policy','The organization protects, as required, vendor/manufacturer documentation that describes the high-level design of the information system in terms of subsystems and implementation details of the security controls employed within the system.',NULL,NULL,NULL),\n('000650','draft','2009-09-21','DISA FSO','policy','The organization obtains vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.',NULL,NULL,NULL),\n('000651','draft','2009-09-21','DISA FSO','policy','The organization protects, as required, vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system.',NULL,NULL,NULL),\n('000653','draft','2009-09-21','DISA FSO','policy','The organization obtains the source code for the information system to permit analysis and testing.',NULL,NULL,NULL),\n('000654','draft','2009-09-21','DISA FSO','policy','The organization protects, as required, the source code for the information system to permit analysis and testing.',NULL,NULL,NULL),\n('000655','draft','2009-09-21','DISA FSO','policy','The organization uses software and associated documentation in accordance with contract agreements and copyright laws.',NULL,NULL,NULL),\n('000656','draft','2009-09-21','DISA FSO','policy','The organization employs tracking systems for software and associated documentation protected by quantity licenses to control copying and distribution.',NULL,NULL,NULL),\n('000657','draft','2009-09-21','DISA FSO','policy','The organization controls the use of peer-to-peer file sharing technology to ensure this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.',NULL,NULL,NULL),\n('000658','draft','2009-09-21','DISA FSO','policy','The organization documents the use of peer-to-peer file sharing technology to ensure this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.',NULL,NULL,NULL),\n('000659','draft','2009-09-21','DISA FSO','policy','The organization prohibits the use of binary executable code from sources with limited or no warranty without accompanying source code.',NULL,NULL,NULL),\n('000660','draft','2009-09-21','DISA FSO','policy','The organization prohibits the use of machine executable code from sources with limited or no warranty without accompanying source code.',NULL,NULL,NULL),\n('000661','draft','2009-09-21','DISA FSO','policy','The organization provides exceptions to the source code requirement only when no alternative solutions are available to support compelling mission/operational requirements.',NULL,NULL,NULL),\n('000662','draft','2009-09-21','DISA FSO','policy','The organization obtains express written consent of the authorizing official for exceptions to the source code requirement.',NULL,NULL,NULL),\n('000663','draft','2009-09-21','DISA FSO','technical','The organization (or information system) enforces explicit rules governing the installation of software by users.',NULL,NULL,NULL),\n('000664','draft','2009-09-21','DISA FSO','policy','The organization applies information system security engineering principles in the specification of the information system.','SA-8.1','The organization managing the acquisition/development of the information system (e.g. PM) applies and documents system security engineering (SSE) principles as part of the overall systems engineering process IAW DoDD 5000.01 and DoDI 5000.02.  The primary source of general and DoD-specific guidance on SSE can be found in the NIST SP 800-160 - Systems Security Engineering, currently in draft form, and can be found here: http://csrc.nist.gov/publications/PubsSPs.html. Additional guidance can be found in the Defense Acquisition Guidebook (DAG) Chapters 4 and 13, found here: https://dag.dau.mil/.\\n\\n\\nThis CCI does not apply to COTS products.\\n\\nThe organization managing the acquisition/development of the information system must ensure that the system requirements documents reflect the  system security engineering principles that can be applied to information systems in development, systems undergoing major upgrades and to the extent feasible systems in sustainment.  Security engineering principles include:\\n 1. Developing layered protections;\\n 2. Establishing sound security policy, architecture, and controls as the foundation for design;\\n 3. Incorporating security requirements into all phases of the system development life cycle;\\n 4. Delineating physical and logical security boundaries;\\n 5. Ensuring that system developers are trained on how to design and build secure software;\\n 6. Tailoring security controls and protections to meet system-specific requirements and operational needs;\\n 7. Performing threat modeling to identify use cases, threat agents, attack vectors, and attack patterns as well as compensating controls and design patterns needed to mitigate risk.','The organization conducting the inspection/assessment obtains and examines the system requirements documents to ensure that the organization being inspected/assessed applies information system security engineering principles in the specification of the information system.'),\n('000665','draft','2009-09-21','DISA FSO','policy','The organization applies information system security engineering principles in the design of the information system.','SA-8.2','The organization managing the acquisition/development of the information system (e.g. PM) applies and documents system security engineering (SSE) principles as part of the overall systems engineering process IAW DoDD 5000.01 and DoDI 5000.02.  The primary source of general and DoD-specific guidance on SSE can be found in the NIST SP 800-160 - Systems Security Engineering, currently in draft form, and can be found here: http://csrc.nist.gov/publications/PubsSPs.html. Additional guidance can be found in the Defense Acquisition Guidebook (DAG) Chapters 4 and 13, found here: https://dag.dau.mil/.\\n\\n\\nThis CCI does not apply to COTS products.\\n\\nThe organization managing the acquisition/development of the information system must ensure that the design documents reflect the system security engineering principles that  can be applied to information systems in development, systems undergoing major upgrades and to the extent feasible systems in sustainment.  Security engineering principles include:\\n 1. Developing layered protections;\\n 2. Establishing sound security policy, architecture, and controls as the foundation for design;\\n 3. Incorporating security requirements into all phases of the system development life cycle;\\n 4. Delineating physical and logical security boundaries;\\n 5. Ensuring that system developers are trained on how to design and build secure software;\\n 6. Tailoring security controls and protections to meet system-specific requirements and operational needs;\\n 7. Performing threat modeling to identify use cases, threat agents, attack vectors, and attack patterns as well as compensating controls and design patterns needed to mitigate risk.','The organization conducting the inspection/assessment obtains and examines the design documents to ensure that the organization being inspected/assessed applies information system security engineering principles in the design of the information system.'),\n('000666','draft','2009-09-21','DISA FSO','policy','The organization applies information system security engineering principles in the development of the information system.','SA-8.3','The organization managing the acquisition/development of the information system (e.g. PM) applies and documents system security engineering (SSE) principles as part of the overall systems engineering process IAW DoDD 5000.01 and DoDI 5000.02.  The primary source of general and DoD-specific guidance on SSE can be found in the NIST SP 800-160 - Systems Security Engineering, currently in draft form, and can be found here: http://csrc.nist.gov/publications/PubsSPs.html. Additional guidance can be found in the Defense Acquisition Guidebook (DAG) Chapters 4 and 13, found here: https://dag.dau.mil/.\\n\\n\\nThis CCI does not apply to COTS products.\\n\\nThe organization managing the acquisition/development of the information system must ensure that the development procedures reflect the system security engineering principles that can be applied to information systems in development, systems undergoing major upgrades and to the extent feasible systems in sustainment.  Security engineering principles include:\\n 1. Developing layered protections;\\n 2. Establishing sound security policy, architecture, and controls as the foundation for design;\\n 3. Incorporating security requirements into all phases of the system development life cycle;\\n 4. Delineating physical and logical security boundaries;\\n 5. Ensuring that system developers are trained on how to design and build secure software;\\n 6. Tailoring security controls and protections to meet system-specific requirements and operational needs;\\n 7. Performing threat modeling to identify use cases, threat agents, attack vectors, and attack patterns as well as compensating controls and design patterns needed to mitigate risk.\\n\\nExamples of development procedures that should reflect SSE principles are configuration management plans, code review procedures, and coding style guides.  Configuration management plans should be IAW CM-9, CCI 001790.','The organization conducting the inspection/assessment obtains and examines the system development procedures (e.g. configuration management plans, code review procedures, and coding style guides) to ensure that the organization being inspected/assessed applies information system security engineering principles in the development of the information system.'),\n('000667','draft','2009-09-21','DISA FSO','policy','The organization applies information system security engineering principles in the implementation of the information system.','SA-8.4','The organization managing the acquisition/development of the information system (e.g. PM) applies and documents system security engineering (SSE) principles as part of the overall systems engineering process IAW DoDD 5000.01 and DoDI 5000.02.  The primary source of general and DoD-specific guidance on SSE can be found in the NIST SP 800-160 - Systems Security Engineering, currently in draft form, and can be found here: http://csrc.nist.gov/publications/PubsSPs.html. Additional guidance can be found in the Defense Acquisition Guidebook (DAG) Chapters 4 and 13, found here: https://dag.dau.mil/.\\n\\n\\nThis CCI does not apply to COTS products.\\n\\nThe organization managing the acquisition/development of the information system must employ the procedures identified in SA-8, CCI, 000666 during the implementation of the information system.  The system owner must maintain an audit trail of the activities conducted IAW SA-8, CCI 000666.  An example of artifacts is CCB minutes, code review results, and source code analysis results.','The organization conducting the inspection/assessment obtains and examines the audit trail artifacts that were created during the implementation of SA-8, CCI 000666 to ensure that the organization being inspected/assessed applies information system security engineering principles in the implementation of the information system and that changes are made IAW the configuration management plan (CM-9, CCI 001790).'),\n('000668','draft','2009-09-21','DISA FSO','policy','The organization applies information system security engineering principles in the modification of the information system.','SA-8.5','The organization managing the acquisition/development of the information system (e.g. PM) applies and documents system security engineering (SSE) principles as part of the overall systems engineering process IAW DoDD 5000.01 and DoDI 5000.02.  The primary source of general and DoD-specific guidance on SSE can be found in the NIST SP 800-160 - Systems Security Engineering, currently in draft form, and can be found here: http://csrc.nist.gov/publications/PubsSPs.html. Additional guidance can be found in the Defense Acquisition Guidebook (DAG) Chapters 4 and 13, found here: https://dag.dau.mil/.\\n\\n\\nThis CCI does not apply to COTS products.\\n\\nThe organization managing the acquisition/development of the information system must employ the procedures identified in SA-8, CCI, 000666 during the modification of the information system.  The system owner must maintain an audit trail of the activities conducted IAW SA-8, CCI 000666.  An example of artifacts is CCB minutes, code review results, and source code analysis results.','The organization conducting the inspection/assessment obtains and examines the audit trail artifacts that were created during the modification of SA-8, CCI 000666 to ensure that the organization being inspected/assessed applies information system security engineering principles in the modification of the information system and that changes are made IAW the configuration management plan (CM-9, CCI 001790).'),\n('000669','draft','2009-09-21','DISA FSO','policy','The organization requires that providers of external information system services comply with organizational information security requirements.','SA-9.1','The organization being inspected/assessed documents within contracts/agreements, requirements that providers of external information system services comply with any organization-specific information security requirements.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that providers of external information system services comply with any organization-specific information security requirements.'),\n('000670','draft','2009-09-21','DISA FSO','policy','The organization requires that providers of external information system services employ organization-defined security controls in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.','SA-9.2','The organization being inspected/assessed documents within contracts/agreements, the\\nrequirement that providers of external information system services employ security controls defined in CNSSI 1253.\\n\\nDoD has defined the security controls as security controls defined by CNSSI 1253.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that providers of external information system services employ security controls defined in CNSSI 1253.\\n\\nDoD has defined the security controls as security controls defined by CNSSI 1253.'),\n('000671','draft','2009-09-21','DISA FSO','policy','The organization defines government oversight with regard to external information system services.','SA-9.4','The organization being inspected/assessed must define in the official documentation governing the provision of the external IT services (e.g. contract, MOU, MOA, SLA, etc.) the government oversight to be conducted on  external information system services and service provider.','The organization conducting the inspection/assessment obtains and examines the official documentation governing the provision of the external IT services (e.g. contract, MOU, MOA, SLA, etc.) to confirm the organization has clearly defined the government oversight to be conducted on external information system services and service providers.'),\n('000672','draft','2009-09-21','DISA FSO','policy','The organization documents government oversight with regard to external information system services.','SA-9.5','The organization being inspected/assessed must establish in the official documentation governing the provision of the external IT services (e.g. contract, MOU, MOA, SLA, etc.) the government oversight to be conducted on  external information system services and service provider.','The organization conducting the inspection/assessment obtains and examines the official documentation governing the provision of the external IT services (e.g. contract, MOU, MOA, SLA, etc.) to confirm the organization has clearly established the government oversight to be conducted on external information system services and service providers.'),\n('000673','draft','2009-09-21','DISA FSO','policy','The organization defines user roles and responsibilities with regard to external information system services.','SA-9.6','The organization being inspected/assessed must define in the official documentation governing the provision of the external IT services (e.g. contract, MOU, MOA, SLA, etc.) the roles and responsibilities of all types of users of the external information system services.','The organization conducting the inspection/assessment obtains and examines the official documentation governing the provision of the external IT services (e.g. contract, MOU, MOA, SLA, etc.) to confirm the organization has clearly defined the roles and responsibilities of all types of users of the external information system services.'),\n('000674','draft','2009-09-21','DISA FSO','policy','The organization documents user roles and responsibilities with regard to external information system services.','SA-9.7','The organization being inspected/assessed must establish in the official documentation governing the provision of the external IT services (e.g. contract, MOU, MOA, SLA, etc.) the roles and responsibilities of all types of users of the external information system services.','The organization conducting the inspection/assessment obtains and examines the official documentation governing the provision of the external IT services (e.g. contract, MOU, MOA, SLA, etc.) to confirm the organization has clearly established the roles and responsibilities of all types of users of the external information system services.'),\n('000675','draft','2009-09-21','DISA FSO','policy','The organization monitors security control compliance by external service providers.',NULL,NULL,NULL),\n('000676','draft','2009-09-21','DISA FSO','policy','The organization conducts an organizational assessment of risk prior to the acquisition of dedicated information security services.',NULL,NULL,NULL),\n('000677','draft','2009-09-21','DISA FSO','policy','The organization conducts an organizational assessment of risk prior to the outsourcing of dedicated information security services.',NULL,NULL,NULL),\n('000678','draft','2009-09-21','DISA FSO','policy','The organization defines the senior organizational official designated to approve acquisition of dedicated information security services.',NULL,NULL,NULL),\n('000679','draft','2009-09-21','DISA FSO','policy','The organization defines the senior organizational official designated to approve outsourcing of dedicated information security services.',NULL,NULL,NULL),\n('000680','draft','2009-09-21','DISA FSO','policy','The organization ensures the acquisition of dedicated information security services is approved by an organization-designated senior organizational official.',NULL,NULL,NULL),\n('000681','draft','2009-09-21','DISA FSO','policy','The organization ensures the outsourcing of dedicated information security services is approved by an organization-designated senior organizational official.',NULL,NULL,NULL),\n('000682','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers to perform configuration management during information system design.',NULL,NULL,NULL),\n('000683','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers to perform configuration management during information system development.',NULL,NULL,NULL),\n('000684','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers to perform configuration management during information system implementation.',NULL,NULL,NULL),\n('000685','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers to perform configuration management during information system operation.',NULL,NULL,NULL),\n('000686','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators to perform configuration management during information system design.',NULL,NULL,NULL),\n('000687','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators to perform configuration management during information system development.',NULL,NULL,NULL),\n('000688','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators to perform configuration management during information system implementation.',NULL,NULL,NULL),\n('000689','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators to perform configuration management during information system operation.',NULL,NULL,NULL),\n('000690','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers to manage and control changes to the information system during design.',NULL,NULL,NULL),\n('000691','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators to manage and control changes to the information system during design.',NULL,NULL,NULL),\n('000692','draft','2009-09-22','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to implement only organization-approved changes to the system, component, or service.','SA-10.6','The organization being inspected/assessed requires within contracts/agreements that the developer of the information system, system component, or information system service implement only organization-approved changes to the system, component, or service throughout its life cycle.','The organization conducting the inspection/assessment obtains and examines contracts/agreements between the organization and the IS developer to confirm the organization has established in its acquisition contracts/agreements the requirement that the IS developer implement only organization-approved changes to the system, component, or service throughout its life cycle.'),\n('000693','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators to implement only organization-approved changes.',NULL,NULL,NULL),\n('000694','draft','2009-09-22','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to document approved changes to the system, component, or service.','SA-10.7','The organization being inspected/assessed requires within contracts/agreements that the  developer of the information system, system component, or information system service document approved changes to the system, component, or service.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service document approved changes to the system, component, or service.'),\n('000695','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators to document approved changes to the information system.',NULL,NULL,NULL),\n('000696','draft','2009-09-22','DISA FSO','policy','The organization requires that information system developers track security flaws and flaw resolution.',NULL,NULL,NULL),\n('000697','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators to track security flaws and flaw resolution.',NULL,NULL,NULL),\n('000698','draft','2009-09-22','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to enable integrity verification of software and firmware components.','SA-10(1).1','The organization being inspected/assessed requires within contracts/agreements that the developer of the information system, system component, or information system service enable integrity verification of software and firmware components.\\n\\nThe organization being inspected/assessed requires the developer to enable integrity verification of software and firmware that may include:\\n1. Stipulating and monitoring logical delivery of products and services, requiring downloading from approved, verification-enhanced sites;\\n2. Encrypting elements (software, software patches, etc.) and supply chain process data in transit (motion) and at rest throughout delivery;\\n3. Requiring suppliers to provide their elements secure by default, so that additional configuration is required to make the element insecure;\\n4. Implementing software designs using programming languages and tools that reduce the likelihood of weaknesses;\\n5. Implementing cryptographic hash verification; and\\n6. Establishing performance and sub-element baseline for the system and system elements to help detect unauthorized tampering/modification during repairs/refurbishing.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service enable integrity verification of software and firmware components.'),\n('000699','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators to provide an integrity check of software to facilitate organizational verification of software integrity after delivery.',NULL,NULL,NULL),\n('000700','draft','2009-09-22','DISA FSO','policy','The organization provides an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.','SA-10(2).1','The organization being inspected/assessed, in the absence of a dedicated software developer configuration management team, establishes an alternate configuration management process that is staffed with appropriate key organizational personnel.','The organization conducting the inspection/assessment obtains and examines the Configuration Control Board (CCB) charter  to determine if the organization, in the absence of a dedicated software developer configuration management team, has established an alternate configuration management process that is staffed with key organizational personnel.'),\n('000701','draft','2009-09-22','DISA FSO','policy','The organization provides an alternative configuration management process with organizational personnel in the absence of a dedicated integrator configuration management team.',NULL,NULL,NULL),\n('000702','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers, in consultation with associated security personnel (including security engineers), to create a security test and evaluation plan.',NULL,NULL,NULL),\n('000703','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers, in consultation with associated security personnel (including security engineers), to implement a security test and evaluation plan.',NULL,NULL,NULL),\n('000704','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to create a security test and evaluation plan.',NULL,NULL,NULL),\n('000705','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to implement a security test and evaluation plan.',NULL,NULL,NULL),\n('000706','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers, in consultation with associated security personnel (including security engineers), to implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process.',NULL,NULL,NULL),\n('000707','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process.',NULL,NULL,NULL),\n('000708','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers, in consultation with associated security personnel (including security engineers), to document the results of the security testing/evaluation processes.',NULL,NULL,NULL),\n('000709','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers, in consultation with associated security personnel (including security engineers), to document the results of the security flaw remediation processes.',NULL,NULL,NULL),\n('000710','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to document the results of the security testing/evaluation processes.',NULL,NULL,NULL),\n('000711','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to document the results of the security flaw remediation processes.',NULL,NULL,NULL),\n('000712','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers to employ code analysis tools to examine software for common flaws and document the results of the analysis.',NULL,NULL,NULL),\n('000713','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators to employ code analysis tools to examine software for common flaws and document the results of the analysis.',NULL,NULL,NULL),\n('000714','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers to perform a vulnerability analysis to document vulnerabilities.',NULL,NULL,NULL),\n('000715','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers to perform a vulnerability analysis to document exploitation potential.',NULL,NULL,NULL),\n('000716','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers to perform a vulnerability analysis to document risk mitigations.',NULL,NULL,NULL),\n('000717','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators to perform a vulnerability analysis to document vulnerabilities.',NULL,NULL,NULL),\n('000718','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators to perform a vulnerability analysis to document exploitation potential.',NULL,NULL,NULL),\n('000719','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators perform a vulnerability analysis to document risk mitigations.',NULL,NULL,NULL),\n('000720','draft','2009-09-22','DISA FSO','policy','The organization requires information system developers implement the security test and evaluation plan under the witness of an independent verification and validation agent.',NULL,NULL,NULL),\n('000721','draft','2009-09-22','DISA FSO','policy','The organization requires information system integrators to implement the security test and evaluation plan under the witness of an independent verification and validation agent.',NULL,NULL,NULL),\n('000722','draft','2009-09-22','DISA FSO','policy','The organization defines the security safeguards to employ to protect against supply chain threats to the information system, system component, or information system service.','SA-12.1','DoD has defined the requirements to protect against supply chain threats in DoDI 5200.44, \\\"Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN).\\\"','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the requirements to protect against supply chain threats in DoDI 5200.44, \\\"Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN).\\\"'),\n('000723','draft','2009-09-22','DISA FSO','policy','The organization protects against supply chain threats to the information system, system component, or information system service by employing organization-defined security safeguards as part of a comprehensive, defense-in-breadth information security strategy.','SA-12.2','The organization being inspected/assessed must identify and document in the Security Plan whether the system is a covered system IAW DoDI 5200.44.  If it is a covered system, the organization must implement the requirements below:\\n1. Conduct a criticality analysis to identify mission critical functions and critical components and reduce the vulnerability of such functions and components through secure system design;\\n2. Request threat analysis of suppliers of critical components from the TSN focal point and manage access to and control of threat analysis products containing U.S. person information;\\n3. Engage TSN focal points for guidance on managing identified risk using DoD Components and Enterprise risk management resources; and\\n4. Apply TSN best practices, processes, techniques, and procurement tools prior to the acquisition of critical components or their integration into applicable systems, at any point in the system lifecycle. Such tools and practices include contract requirements and the SCRM key practices Guide.','The organization conducting the inspection/assessment obtains and examines the Security Plan for the system to determine whether the system is a covered system IAW DoDI 5200.44.\\n\\nIf it is a covered system, the organization conducting the inspection/assessment obtains and examines documentation of compliance with DoDI 5200.44, to ensure the organization being inspected/assessed has:\\n1. Conducted a criticality analysis to identify mission critical functions and critical components and reduced the vulnerability of such functions and components through secure system design;\\n2. Requested threat analysis of suppliers of critical components from the TSN focal point and managed access to and control of threat analysis products containing U.S. person information;\\n3. Engaged TSN focal points for guidance on managing identified risk using DoD Components and Enterprise risk management resources; and\\n4. Applied TSN best practices, processes, techniques, and procurement tools prior to the acquisition of critical components or their integration into applicable systems, at any point in the system lifecycle. Such tools and practices include contract requirements and the SCRM key practices Guide.'),\n('000724','draft','2009-09-22','DISA FSO','policy','The organization purchases all anticipated information system components and spares in the initial acquisition.',NULL,NULL,NULL),\n('000725','draft','2009-09-22','DISA FSO','policy','The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system hardware.',NULL,NULL,NULL),\n('000726','draft','2009-09-22','DISA FSO','policy','The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system software.',NULL,NULL,NULL),\n('000727','draft','2009-09-22','DISA FSO','policy','The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system firmware.',NULL,NULL,NULL),\n('000728','draft','2009-09-22','DISA FSO','policy','The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system services.',NULL,NULL,NULL),\n('000729','draft','2009-09-22','DISA FSO','policy','The organization uses trusted shipping for information systems.',NULL,NULL,NULL),\n('000730','draft','2009-09-22','DISA FSO','policy','The organization uses trusted shipping for information system components.',NULL,NULL,NULL),\n('000731','draft','2009-09-22','DISA FSO','policy','The organization uses trusted shipping for information technology products.',NULL,NULL,NULL),\n('000732','draft','2009-09-22','DISA FSO','policy','The organization uses trusted warehousing for information systems.',NULL,NULL,NULL),\n('000733','draft','2009-09-22','DISA FSO','policy','The organization uses trusted warehousing for information system components.',NULL,NULL,NULL),\n('000734','draft','2009-09-22','DISA FSO','policy','The organization uses trusted warehousing for information technology products.',NULL,NULL,NULL),\n('000735','draft','2009-09-22','DISA FSO','policy','The organization employs a diverse set of suppliers for information systems.',NULL,NULL,NULL),\n('000736','draft','2009-09-22','DISA FSO','policy','The organization employs a diverse set of suppliers for information system components.',NULL,NULL,NULL),\n('000737','draft','2009-09-22','DISA FSO','policy','The organization employs a diverse set of suppliers for information technology products.',NULL,NULL,NULL),\n('000738','draft','2009-09-22','DISA FSO','policy','The organization employs a diverse set of suppliers for information system services.',NULL,NULL,NULL),\n('000739','draft','2009-09-22','DISA FSO','policy','The organization employs standard configurations for information systems.',NULL,NULL,NULL),\n('000740','draft','2009-09-22','DISA FSO','policy','The organization employs standard configurations for information system components.',NULL,NULL,NULL),\n('000741','draft','2009-09-22','DISA FSO','policy','The organization employs standard configurations for information technology products.',NULL,NULL,NULL),\n('000742','draft','2009-09-22','DISA FSO','policy','The organization minimizes the time between purchase decisions and delivery of information systems.',NULL,NULL,NULL),\n('000743','draft','2009-09-22','DISA FSO','policy','The organization minimizes the time between purchase decisions and delivery of information system components.',NULL,NULL,NULL),\n('000744','draft','2009-09-22','DISA FSO','policy','The organization minimizes the time between purchase decisions and delivery of information technology products.',NULL,NULL,NULL),\n('000745','draft','2009-09-22','DISA FSO','policy','The organization employs independent analysis and penetration testing against delivered information systems.',NULL,NULL,NULL),\n('000746','draft','2009-09-22','DISA FSO','policy','The organization employs independent analysis and penetration testing against delivered information system components.',NULL,NULL,NULL),\n('000747','draft','2009-09-22','DISA FSO','policy','The organization employs independent analysis and penetration testing against delivered information technology products.',NULL,NULL,NULL),\n('000748','draft','2009-09-22','DISA FSO','policy','The organization defines level of trustworthiness for the information system.',NULL,NULL,NULL),\n('000749','draft','2009-09-22','DISA FSO','policy','The organization requires that the information system meets the organization-defined level of trustworthiness.',NULL,NULL,NULL),\n('000750','draft','2009-09-22','DISA FSO','policy','The organization defines the list of critical information system components that require re-implementation.',NULL,NULL,NULL),\n('000751','draft','2009-09-22','DISA FSO','policy','The organization determines the organization-defined list of critical information system components that require re-implementation.',NULL,NULL,NULL),\n('000752','draft','2009-09-22','DISA FSO','policy','The organization re-implements organization-defined critical information system components.',NULL,NULL,NULL),\n('000753','draft','2009-09-22','DISA FSO','policy','The organization identifies information system components for which alternative sourcing is not viable.',NULL,NULL,NULL),\n('000754','draft','2009-09-22','DISA FSO','policy','The organization defines measures to be employed to prevent critical security controls for information system components from being compromised.',NULL,NULL,NULL),\n('000755','draft','2009-09-22','DISA FSO','policy','The organization employs organization-defined measures to ensure critical security controls for the information system components are not compromised.',NULL,NULL,NULL),\n('000756','draft','2009-09-17','DISA FSO','policy','The organization develops an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','IA-1.2','DoD developed DoDI 8520.02 and DoDI 8520.03 as the identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 8520.02 and DoDI 8520.03.','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8520.02 and DoDI 8520.03.'),\n('000757','draft','2009-09-17','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','IA-1.3','DoD disseminates the DoDI 8520.02 and DoDI 8520.03 via the DoD Issuances website (http://www.dtic.mil/whs/directives/corres/dir.html) to the ISSO and ISSM and others as the local organization deems appropriate as an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 8520.02 and DoDI 8520.03.\\n\\nDoD has defined the personnel or roles to be recipients of the identification and authentication policy and the procedures as the ISSO and ISSM and others as the local organization deems appropriate.','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8520.02 and DoDI 8520.03.\\n\\nDoD has defined the personnel or roles to be recipients of the identification and authentication policy and the procedures as the ISSO and ISSM and others as the local organization deems appropriate.'),\n('000758','draft','2009-09-17','DISA FSO','policy','The organization reviews and updates identification and authentication policy in accordance with the organization-defined frequency.','IA-1.6','DoD reviews and updates identification and authentication policy (DoDI 8520.02 and DoDI 8520.03) annually.\\n\\nDoD Components are automatically compliant  with this CCI because they are covered at the DoD level policies, DoDI 8520.02 and DoDI 8520.03.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8520.02 and DoDI 8520.03.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.'),\n('000759','draft','2009-09-17','DISA FSO','policy','The organization defines a frequency for reviewing and updating the identification and authentication policy.','IA-1.7','DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.'),\n('000760','draft','2009-09-17','DISA FSO','policy','The organization develops procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.','IA-1.4','DoD develops within DoDI 8520.02 and DoDI 8520.03, procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8520.02 and DoDI 8520.03.','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8520.02 and DoDI 8520.03.'),\n('000761','draft','2009-09-17','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.','IA-1.5','DoD disseminates the DoDI 8520.02 and DoDI 8520.03 to the ISSO and ISSM and others as the local organization deems appropriate via the DoD Issuances website (http://www.dtic.mil/whs/directives/corres/dir.html).  DoDI 8520.02 and DoDI 8520.03 are procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.\\n\\nDoD Components are automatically compliant  with this CCI because they are covered by the DoD level policies, DoDI 8520.02 and DoDI 8520.03.','DoD Components are automatically compliant  with this CCI because they are covered by the DoD level policy, DoDI 8520.02 and DoDI 8520.03.\\n\\nDoD has defined the personnel or roles to be recipients of the identification and authentication policy and the procedures as the ISSO and ISSM and others as the local organization deems appropriate.'),\n('000762','draft','2009-09-17','DISA FSO','policy','The organization reviews and updates identification and authentication procedures in accordance with the organization-defined frequency.','IA-1.8','DoD reviews and updates identification and authentication procedures (DoDI 8520.02 and DoDI 8520.03) annually.\\n\\nThe organization being inspected/assessed is automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 8520.02 and DoDI 8520.03.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 8520.02 and DoDI 8520.03.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.'),\n('000763','draft','2009-09-17','DISA FSO','policy','The organization defines a frequency for reviewing and updating the identification and authentication procedures.','IA-1.9','DoD has defined the frequency as review annually - update as appropriate.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as review annually - update as appropriate.'),\n('000764','draft','2009-09-17','DISA FSO','technical','The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).','IA-2.1','The organization being inspected/assessed configures the information system to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 764.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 764.'),\n('000765','draft','2009-09-17','DISA FSO','technical','The information system implements multifactor authentication for network access to privileged accounts.','IA-2(1).1','The organization being inspected/assessed configures the information system to implement multifactor authentication for network access to privileged accounts.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 765.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement multifactor authentication for network access to privileged accounts.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 765.'),\n('000766','draft','2009-09-17','DISA FSO','technical','The information system implements multifactor authentication for network access to non-privileged accounts.','IA-2(2).1','The organization being inspected/assessed configures the information system to implement multifactor authentication for network access to non-privileged accounts.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 766.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement multifactor authentication for network access to non-privileged accounts.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 766.'),\n('000767','draft','2009-09-17','DISA FSO','technical','The information system implements multifactor authentication for local access to privileged accounts.','IA-2(3).1','The organization being inspected/assessed configures the information system to implement multifactor authentication for local access to privileged accounts.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 767.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement multifactor authentication for local access to privileged accounts.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 767.'),\n('000768','draft','2009-09-17','DISA FSO','technical','The information system implements multifactor authentication for local access to non-privileged accounts.','IA-2(4).1','The organization being inspected/assessed configures the information system to  implement multifactor authentication for local access to non-privileged accounts.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 768.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement multifactor authentication for local access to non-privileged accounts.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 768.'),\n('000769','draft','2009-09-17','DISA FSO','policy','The organization allows the use of group authenticators only when used in conjunction with an individual/unique authenticator.',NULL,NULL,NULL),\n('000770','draft','2009-09-17','DISA FSO','policy','The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.','IA-2(5).1','The organization being inspected/assessed requires individuals or configures the information system to require individuals to be authenticated with an individual authenticator when a group authenticator is employed.   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 770.','The organization conducting the inspection/assessment obtains and examines standard operating procedures or system documentation to ensure the organization being inspected/assessed requires individuals  to be authenticated with an individual authenticator when a group authenticator is employed.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 770.'),\n('000771','draft','2009-09-17','DISA FSO','technical','The information system uses multifactor authentication for network access to privileged accounts where one of the factors is provided by a device separate from the information system being accessed.',NULL,NULL,NULL),\n('000772','draft','2009-09-17','DISA FSO','technical','The information system uses multifactor authentication for network access to non-privileged accounts where one of the factors is provided by a device separate from the information system being accessed.',NULL,NULL,NULL),\n('000773','draft','2009-09-17','DISA FSO','policy','The organization defines replay-resistant authentication mechanisms to be used for network access to privileged accounts.',NULL,NULL,NULL),\n('000774','draft','2009-09-17','DISA FSO','technical','The information system uses organization-defined replay-resistant authentication mechanisms for network access to privileged accounts.',NULL,NULL,NULL),\n('000775','draft','2009-09-17','DISA FSO','policy','The organization defines replay-resistant authentication mechanisms to be used for network access to non-privileged accounts.',NULL,NULL,NULL),\n('000776','draft','2009-09-17','DISA FSO','technical','The information system uses organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts.',NULL,NULL,NULL),\n('000777','draft','2009-09-17','DISA FSO','policy','The organization defines a list of specific and/or types of devices for which identification and authentication is required before establishing a connection to the information system.','IA-3.1','DoD has defined the value as all mobile devices and network connected endpoint devices (including but not limited to: workstations, printers, servers (outside a datacenter), VoIP Phones, VTC CODECs).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the value as all mobile devices and network connected endpoint devices (including but not limited to: workstations, printers, servers (outside a datacenter), VoIP Phones, VTC CODECs). '),\n('000778','draft','2009-09-17','DISA FSO','technical','The information system uniquely identifies an organization-defined list of specific and/or types of devices before establishing a local, remote, or network connection.','IA-3.2','The organization being inspected/assessed configures the network infrastructure to identify all mobile devices and network connected endpoint devices (including but not limited to: workstations, printers, servers (outside a datacenter), VoIP Phones, VTC CODECs) before establishing a local, remote, network connection.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 778.  DoD has defined the value as all mobile devices and network connected endpoint devices (including but not limited to: workstations, printers, servers (outside a datacenter), VoIP Phones, VTC CODECs).  ','The organization conducting the inspection/assessment examine a sampling of the network infrastructure device configurations to ensure devices connecting to the infrastructure are uniquely identified.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 778.'),\n('000779','draft','2009-09-17','DISA FSO','technical','The information system authenticates devices before establishing remote network connections using bidirectional authentication between devices that is cryptographically based.',NULL,NULL,NULL),\n('000780','draft','2009-09-17','DISA FSO','technical','The information system authenticates devices before establishing wireless network connections using bidirectional authentication between devices that is cryptographically based.',NULL,NULL,NULL),\n('000781','draft','2009-09-17','DISA FSO','technical','The information system authenticates devices before establishing network connections using bidirectional authentication between devices that is cryptographically based.',NULL,NULL,NULL),\n('000782','draft','2009-09-17','DISA FSO','policy','The organization standardizes, with regard to dynamic address allocation, Dynamic Host Control Protocol (DHCP) lease information and the time assigned to DHCP-enabled devices.',NULL,NULL,NULL),\n('000783','draft','2009-09-17','DISA FSO','technical','The organization audits lease information when assigned to a device.','IA-3(3).5','The organization being inspected/assessed configures the information system to record lease information in the audit log.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 783.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to record lease information in the audit log and examine the audit records to ensure the records have captured the appropriate information.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 783.'),\n('000784','draft','2009-09-17','DISA FSO','policy','The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a user identifier.',NULL,NULL,NULL),\n('000785','draft','2009-09-17','DISA FSO','policy','The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a device identifier.',NULL,NULL,NULL),\n('000786','draft','2009-09-17','DISA FSO','policy','The organization manages information system identifiers for users and devices by selecting an identifier that uniquely identifies an individual.',NULL,NULL,NULL),\n('000787','draft','2009-09-17','DISA FSO','policy','The organization manages information system identifiers for users and devices by selecting an identifier that uniquely identifies a device.',NULL,NULL,NULL),\n('000788','draft','2009-09-17','DISA FSO','policy','The organization manages information system identifiers for users and devices by assigning the user identifier to the intended party.',NULL,NULL,NULL),\n('000789','draft','2009-09-17','DISA FSO','policy','The organization manages information system identifiers for users and devices by assigning the device identifier to the intended device.',NULL,NULL,NULL),\n('000790','draft','2009-09-17','DISA FSO','policy','The organization defines a time period for which the reuse of user identifiers is prohibited.',NULL,NULL,NULL),\n('000791','draft','2009-09-17','DISA FSO','policy','The organization defines a time period for which the reuse of device identifiers is prohibited.',NULL,NULL,NULL),\n('000792','draft','2009-09-17','DISA FSO','policy','The organization manages information system identifiers for users and devices by preventing reuse of user identifiers for an organization-defined time period.',NULL,NULL,NULL),\n('000793','draft','2009-09-17','DISA FSO','policy','The organization manages information system identifiers for users and devices by preventing reuse of device identifiers for an organization-defined time period.',NULL,NULL,NULL),\n('000794','draft','2009-09-17','DISA FSO','policy','The organization defines a time period of inactivity after which the identifier is disabled.','IA-4.7','DoD has defined the time period as 35 days of inactivity.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 35 days of inactivity.'),\n('000795','draft','2009-09-17','DISA FSO','policy','The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity.','IA-4.8','The organization being inspected/assessed configures the information system to disable identifiers after 35 days of inactivity.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI  795.   DoD has defined the time period as 35 days of inactivity.','The organization conducting the inspection/assessment examines the information system configuration to ensure that identifiers are disabled after 35 days of inactivity.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 795.  DoD has defined the time period as 35 days of inactivity.'),\n('000796','draft','2009-09-17','DISA FSO','policy','The organization prohibits the use of information system account identifiers that are the same as public identifiers for individual electronic mail accounts.','IA-4(1).1','The organization being inspected/assessed documents and implements a process to prohibit the use of information system account identifiers that are the same as public identifiers for individual electronic mail accounts.','The organization conducting the inspection/assessment obtains and examines documented process to ensure the organization being inspected/assessed prohibits the use of information system account identifiers that are the same as public identifiers for individual electronic mail accounts.'),\n('000797','draft','2009-09-17','DISA FSO','policy','The organization requires that registration to receive a user ID and password include authorization by a supervisor.',NULL,NULL,NULL),\n('000798','draft','2009-09-17','DISA FSO','policy','The organization requires that registration to receive a user ID and password be done in person before a designated registration authority.',NULL,NULL,NULL),\n('000799','draft','2009-09-17','DISA FSO','policy','The organization requires multiple forms of certification of individual identification, such as documentary evidence or a combination of documents and biometrics, be presented to the registration authority.','IA-4(3).1','The organization being inspected/assessed documents and implements a process to require multiple forms of certification of individual identification, such as documentary evidence or a combination of documents and biometrics be presented to the registration authority.','The organization conducting the inspection/assessment obtains and examines the documented process and interviews  personnel with identifier management responsibilities to ensure the organization being inspected/assessed  requires multiple forms of certification of individual identification, such as documentary evidence or a combination of documents and biometrics be presented to the registration authority.'),\n('000800','draft','2009-09-17','DISA FSO','policy','The organization defines characteristics for identifying individual status.','IA-4(4).1','DoD has defined the characteristics as contractor or government employee and by nationality. User identifiers will follow the same format as DoD user e-mail addresses (john.smith.ctr@army.mil or john.smith.uk@army.mil);  - DoD user e-mail display names (e.g., John Smith, Contractor <john.smith.ctr@army.mil> or John Smith, United Kingdom <john.smith.uk@army.mil>);  and  - automated signature blocks (e.g., John Smith, Contractor,  J-6K, Joint Staff or John Doe, Australia, LNO, Combatant Command). Contractors who are also foreign nationals are identified as both, e.g., john.smith.ctr.uk@army.mil','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the characteristics as contractor or government employee and by nationality. User identifiers will follow the same format as DoD user e-mail addresses (john.smith.ctr@army.mil or john.smith.uk@army.mil);  - DoD user e-mail display names (e.g., John Smith, Contractor <john.smith.ctr@army.mil> or John Smith, United Kingdom <john.smith.uk@army.mil>);  and  - automated signature blocks (e.g., John Smith, Contractor,  J-6K, Joint Staff or John Doe, Australia, LNO, Combatant Command). Contractors who are also foreign nationals are identified as both, e.g., john.smith.ctr.uk@army.mil'),\n('000801','draft','2009-09-17','DISA FSO','policy','The organization manages individual identifiers by uniquely identifying each individual by organization-defined characteristics identifying individual status.',NULL,NULL,NULL),\n('000802','draft','2009-09-17','DISA FSO','technical','The information system dynamically manages identifiers, attributes, and associated access authorizations.',NULL,NULL,NULL),\n('000803','draft','2009-09-17','DISA FSO','technical','The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.','IA-7.1','The organization being inspected/assessed configures the information system to implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 803.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 803.'),\n('000804','draft','2009-09-17','DISA FSO','technical','The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users).','IA-8.1','The organization being inspected/assessed configures the information system to uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 804.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 804.'),\n('000805','draft','2009-09-17','DISA FSO','policy','The organization develops and documents an incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','IR-1.3','CJCSI 6510.01F \\\"Information Assurance and Support to Computer Network Defense,\\\"   CJCSM 6510.01B, \\\"Cyber Incident Handling Program,\\\" DoDD O-8530.1, and DoDI O-8530.2 meet the DoD requirements for incident response policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD O-8530.1, and DoDI O-8530.2.','CJCSI 6510.01F \\\"Information Assurance and Support to Computer Network Defense,\\\"   CJCSM 6510.01B, \\\"Cyber Incident Handling Program,\\\" DoDD O-8530.1, and DoDI O-8530.2 meet the DoD requirements for incident response policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD O-8530.1, and DoDI O-8530.2.'),\n('000806','draft','2009-09-17','DISA FSO','policy','The organization disseminates an incident response policy to organization-defined personnel or roles.','IR-1.4','DoD disseminates via http://www.dtic.mil/cjcs_directives/,  CJCSI 6510.01F \\\"Information Assurance and Support to Computer Network Defense,\\\"   CJCSM 6510.01B, \\\"Cyber Incident Handling Program,\\\" DoDD O-8530.1, and DoDI O-8530.2 to all personnel identified as stakeholders in the incident response process, as well as the ISSM and ISSO.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD O-8530.1, and DoDI O-8530.2.','CJCSI 6510.01F \\\"Information Assurance and Support to Computer Network Defense,\\\"   CJCSM 6510.01B, \\\"Cyber Incident Handling Program,\\\" DoDD O-8530.1, and DoDI O-8530.2 meet the DoD requirements for incident response policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD O-8530.1, and DoDI O-8530.2.'),\n('000807','draft','2009-09-17','DISA FSO','policy','The organization reviews and updates the current incident response policy in accordance with organization-defined frequency.','IR-1.7','CJCSI 6510.01F \\\"Information Assurance and Support to Computer Network Defense,\\\"   CJCSM 6510.01B, \\\"Cyber Incident Handling Program,\\\" DoDD O-8530.1, and DoDI O-8530.2 meet the DoD requirements for incident response policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD O-8530.1, and DoDI O-8530.2.','CJCSI 6510.01F \\\"Information Assurance and Support to Computer Network Defense,\\\"   CJCSM 6510.01B, \\\"Cyber Incident Handling Program,\\\" DoDD O-8530.1, and DoDI O-8530.2 meet the DoD requirements for incident response policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD O-8530.1, and DoDI O-8530.2.'),\n('000808','draft','2009-09-17','DISA FSO','policy','The organization defines the frequency with which to review and update the current incident response policy.','IR-1.8','DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of issuance.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of issuance.'),\n('000809','draft','2009-09-17','DISA FSO','policy','The organization develops and documents procedures to facilitate the implementation of the incident response policy and associated incident response controls.','IR-1.6','CJCSI 6510.01F \\\"Information Assurance and Support to Computer Network Defense,\\\"   CJCSM 6510.01B, \\\"Cyber Incident Handling Program,\\\" DoDD O-8530.1, and DoDI O-8530.2 meets the DoD requirements for incident response policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD O-8530.1, and DoDI O-8530.2.','CJCSI 6510.01F \\\"Information Assurance and Support to Computer Network Defense,\\\"   CJCSM 6510.01B, \\\"Cyber Incident Handling Program,\\\" DoDD O-8530.1, and DoDI O-8530.2 meet the DoD requirements for incident response policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD O-8530.1, and DoDI O-8530.2.'),\n('000810','draft','2009-09-17','DISA FSO','policy','The organization disseminates incident response procedures to organization-defined personnel or roles.','IR-1.5','DoD disseminates via http://www.dtic.mil/cjcs_directives/,  CJCSI 6510.01F \\\"Information Assurance and Support to Computer Network Defense,\\\"   CJCSM 6510.01B, \\\"Cyber Incident Handling Program,\\\" DoDD O-8530.1, and DoDI O-8530.2 to all personnel identified as stakeholders in the incident response process, as well as the ISSM and ISSO.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD O-8530.1, and DoDI O-8530.2.\\n\\nDoD has defined the roles as all personnel identified as stakeholders in the incident response process, as well as the ISSM and ISSO.','CJCSI 6510.01F \\\"Information Assurance and Support to Computer Network Defense,\\\"   CJCSM 6510.01B, \\\"Cyber Incident Handling Program,\\\" DoDD O-8530.1, and DoDI O-8530.2 meet the DoD requirements for incident response policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD O-8530.1, and DoDI O-8530.2.\\n\\nDoD has defined the roles as all personnel identified as stakeholders in the incident response process, as well as the ISSM and ISSO.'),\n('000811','draft','2009-09-17','DISA FSO','policy','The organization reviews and updates the current incident response procedures in accordance with organization-defined frequency.','IR-1.9','DoD (in conjunction with Joint Staff for CJCSIs) reviews and updates current incident response procedures (CJCSI 6510.01F, CJCSM 6510.01B, DoDD O-8530.1, and DoDI O-8530.2) annually.\\n\\nDoD Components are automatically compliant  with this CCI because they are covered at the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD O-8530.1, and DoDI O-8530.2.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.','CJCSI 6510.01F \\\"Information Assurance and Support to Computer Network Defense,\\\"   CJCSM 6510.01B, \\\"Cyber Incident Handling Program,\\\" DoDD O-8530.1, and DoDI O-8530.2 meet the DoD requirements for incident response policy and procedures.\\n\\nDoD Components are automatically compliant  with this CCI because they are covered at the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD O-8530.1, and DoDI O-8530.2.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.'),\n('000812','draft','2009-09-17','DISA FSO','policy','The organization defines the frequency with which to review and update the current incident response procedures.','IR-1.10','DoD has defined the frequency as reviewed annually - updated as appropriate.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.'),\n('000813','draft','2009-09-17','DISA FSO','policy','The organization provides incident response training to information system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming an incident response role or responsibility.','IR-2.1','The organization being inspected/assessed documents and implement a process to provide incident response training to information system users consistent with assigned roles and responsibilities within 30 working days of assuming an incident response role or responsibility.  The organization must maintain a record of training.  DoD has defined the time period as 30 working days.','The organization conducting the inspection/assessment obtains and examines the documented process as well as training records for a sampling of information system users to ensure the organization being inspected/assessed provides incident response training to information system users consistent with assigned roles and responsibilities within 30 working days of assuming an incident response role or responsibility.  DoD has defined the time period as 30 working days.'),\n('000814','draft','2009-09-17','DISA FSO','policy','The organization provides incident response training in accordance with organization-defined frequency.','IR-2.3','The organization being inspected/assessed documents and implements a process to provide incident response training to information system users, other than general users, consistent with assigned roles and responsibilities annually.  For general users, DoD components are automatically compliant with the requirement based on DoDD 8570.01 requirements for IA awareness training.  The organization must maintain a record of training.  DoD has defined the frequency as annually. ','The organization conducting the inspection/assessment obtains and examines the documented process as well as training records for a sampling of information system users to ensure the organization being inspected/assessed provides incident response training to information system users, other than general users, consistent with assigned roles and responsibilities annually.  For general users, DoD components are automatically compliant with the requirement based on DoDD 8570.01 requirements for IA awareness training.  DoD has defined the frequency as annually.'),\n('000815','draft','2009-09-17','DISA FSO','policy','The organization defines a frequency for incident response training.','IR-2.4','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('000816','draft','2009-09-17','DISA FSO','policy','The organization incorporates simulated events into incident response training to facilitate effective response by personnel in crisis situations.','IR-2(1).1','The organization being inspected/assessed will document a process to include simulated events into incident response training to facilitate effective response by personnel in crisis situations.  The process to include simulated events shall be documented IAW CJCSI 6510.01F, CJCSM 6510.01B, DoDD O-8530.1, and DoDI O-8530.2.  The organization must maintain a record of incident response training to include simulated events.','The organization conducting the inspection/assessment obtains and examines incident response training materials and a record of training events to ensure that simulated events have been included.'),\n('000817','draft','2009-09-17','DISA FSO','policy','The organization employs automated mechanisms to provide a more thorough and realistic incident response training environment.','IR-2(2).1','The organization being inspected/assessed employs an automated mechanism such as scenario-based interactive online training/CBT  providing a realistic incident response training environment.','The organization conducting the inspection/assessment obtains and examines the automated mechanism such as scenario-based interactive online training/CBT  to verify that it provides a realistic incident response training environment.'),\n('000818','draft','2009-09-17','DISA FSO','policy','The organization tests the incident response capability for the information system on an organization-defined frequency using organization-defined tests to determine the incident response effectiveness.','IR-3.1','The organization being inspected/assessed documents and implements a process to test its incident response capability for the information system at least every six months for high availability and at least annually for low/med availability using tests and as defined in the incident response plan.  The organization must maintain a record of test results.  DoD has defined the frequency as at least every six months for high availability and at least annually for low/med availability.  DoD has defined the tests as tests as defined in the incident response plan.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of test results to ensure the organization being inspected/assessed tests its incident response capability for the information system at least every six months for high availability and at least annually for low/med availability using tests and as defined in the incident response plan.  DoD has defined the frequency as at least every six months for high availability and at least annually for low/med availability.  DoD has defined the tests as tests as defined in the incident response plan.'),\n('000819','draft','2009-09-17','DISA FSO','policy','The organization defines a frequency for incident response tests.','IR-3.2','DoD has defined the frequency as at least every six months for high availability and at least annually for low/med availability.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at least every six months for high availability and at least annually for low/med availability.'),\n('000820','draft','2009-09-17','DISA FSO','policy','The organization defines tests for incident response.','IR-3.3','DoD has defined the tests as tests as defined in the incident response plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the tests as tests  as defined in the incident response plan.'),\n('000821','draft','2009-09-17','DISA FSO','policy','The organization employs automated mechanisms to more thoroughly and effectively test the incident response capability.','IR-3(1).1','The organization being inspected/assessed will identify and employ automated mechanisms to test the incident response capability for the information system.','The organization conducting the inspection/assessment obtains and examines the identified automated mechanisms in use to test the incident response capability for the information system.'),\n('000822','draft','2009-09-18','DISA FSO','policy','The organization implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery.','IR-4.1','The organization being inspected/assessed must have a documented and certified CNDSP and documented procedures for information system users and site security personnel to handle incidents until they are transferred to the responsibility of the CNDSP.  ','The organization conducting the inspection/assessment obtains and examines the documentation identifying the CNDSP leveraged as well as the documented procedures for incident handling to ensure that there is a certified CNDSP in use and that there are procedures implemented to handle incidents  until they are transferred to the responsibility of the CNDSP.  '),\n('000823','draft','2009-09-18','DISA FSO','policy','The organization coordinates incident handling activities with contingency planning activities.','IR-4.2','The organization being inspected/assessed will coordinate the incident response plan (IR-8) and contingency plan (CP-2) to ensure they allow for an effective transfer of information system activity and maintain confidentiality and integrity of the contingency assets.','The organization conducting the inspection/assessment obtains and examines the incident response plan (IR-8) and contingency plan (CP-2) to ensure they allow for an effective transfer of information system activity and maintain confidentiality and integrity of the contingency assets.'),\n('000824','draft','2009-09-18','DISA FSO','policy','The organization incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises.','IR-4.3','The organization being inspected/assessed will conduct after action reviews from incidents to identify lessons learned and will incorporate them into procedures, training, and testing/exercises.  The organization must maintain records of after action reviews.','The organization conducting the inspection/assessment obtains and examines after action reports or meeting minutes to identify actionable lessons learned to verify that lessons learned are incorporated into the plan as changes are necessary.'),\n('000825','draft','2009-09-18','DISA FSO','policy','The organization employs automated mechanisms to support the incident handling process.','IR-4(1).1','The organization being inspected/assessed will document within their incident handling plan, procedures to leverage the Joint Incident Management System (JIMS).  For the DoD, JIMS is the automated mechanism.','The organization conducting the inspection/assessment obtains and examines the incident handling plan to ensure that there are procedures identified to leverage the JIMS.'),\n('000826','draft','2009-09-18','DISA FSO','policy','The organization includes dynamic reconfiguration of organization-defined information system components as part of the incident response capability.','IR-4(2).1','The organization being inspected/assessed  will ensure that their incident response plan includes procedures for dynamic reconfiguration of information system components defined in IR-4 (2), CCI 2781 as part of the incident response capability IAW CM-3.\\n\\nDynamic reconfiguration bypasses the organization\\'s standard CCB process and may include, for example, changes to router rules, access control lists, intrusion detection/prevention systems, firewalls, etc.  Organizations will have procedures to examine dynamic reconfiguration changes at the earliest opportunity IAW CCB.','The organization conducting the inspection/assessment obtains and examines the incident response plan and verifies it has procedures addressing dynamic reconfiguration of information system components defined in IR-4 (2), CCI 2781 as part of the incident response capability IAW CM-3.'),\n('000827','draft','2009-09-18','DISA FSO','policy','The organization defines and identifies classes of incidents for which organization-defined actions are to be taken to ensure continuation of organizational mission and business functions.','IR-4(3).1','CJCSM 6510.01B has already identified DoD\\'s classes of incidents.\\n\\nDoD Components are automatically compliant with this CCI because DoD has defined the classes of incidents as classes of incidents defined in CJCSM 6510.01B Appendix A- Enclosure B.','CJCSM 6510.01B has already identified DoD\\'s classes of incidents.  The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the classes of incidents as classes of incidents defined in CJCSM 6510.01B Appendix A- Enclosure B.6510.01M'),\n('000828','draft','2009-09-18','DISA FSO','policy','The organization defines and identifies actions to take in response to organization-defined classes of incidents to ensure continuation of organizational missions and business functions.','IR-4(3).2','CJCSM 6510.01B has already identified DoD\\'s actions to take in response to classes of incidents.\\n\\nDoD Components are automatically compliant with this CCI because DoD has defined the actions as actions defined in CJCSM 6510.01B.','CJCSM 6510.01B has already identified DoD\\'s actions to take in response to classes of incidents.  The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the actions as actions defined in CJCSM 6510.01B.'),\n('000829','draft','2009-09-18','DISA FSO','policy','The organization correlates incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.','IR-4(4).1','The organization being inspected/assessed defines procedures to examine incident information gathered and the actual actions taken by both the individuals affected and the incident response personnel.  These procedures shall be defined IAW CJCSM 6510.01B.  The end goal is to achieve a top level perspective of the effectiveness of the incident response and awareness.  ','The organization conducting the inspection/assessment obtains and examines proof of the analysis (such as minutes from an incident response after action meeting or other similar activity) to ensure that incident information is being examined and correlated.  '),\n('000830','draft','2009-09-18','DISA FSO','policy','The organization defines security violations that, if detected, initiate a configurable capability to automatically disable the information system.','IR-4(5).1','The organization being inspected/assessed defines and document a list of security violations that upon occurrence initiate an automated action to disable or shutdown the information system.  Violations may be identified by specific activity or by class/type of activity.  DoD has determined the security violations are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the list of documented security violations to ensure the organization has clearly identified those violations that initiate an automated disabling or shut down of the information system.   DoD has determined the security violations are not appropriate to define at the Enterprise level.'),\n('000831','draft','2009-09-18','DISA FSO','technical','The organization implements a configurable capability to automatically disable the information system if organization-defined security violations are detected.','IR-4(5).2','The organization being inspected/assessed will clearly identify, document, and implement a configurable automated mechanism (or mechanisms) that utilizes the list of security violations identified in IR-4 (5), CCI 000830 to disable or shutdown the information system.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 831. ','The organization conducting the inspection/assessment examines the information system to ensure an automated mechanism is configured to disable or shutdown the information system based on the identified security violations (IR-4 (5), CCI 000830).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 831.'),\n('000832','draft','2009-09-18','DISA FSO','policy','The organization tracks and documents information system security incidents.','IR-5.1','The organization being inspected/assessed will document within their incident handling plan, procedures to leverage the Joint Incident Management System (JIMS).  For the DoD, JIMS is the automated mechanism. ','The organization conducting the inspection/assessment obtains and examines the incident handling plan to ensure that there are procedures identified to leverage the JIMS.'),\n('000833','draft','2009-09-18','DISA FSO','policy','The organization employs automated mechanisms to assist in the tracking of security incidents.','IR-5(1).1','The organization being inspected/assessed will document within their incident handling plan, procedures to leverage the Joint Incident Management System (JIMS).  For the DoD, JIMS is the automated mechanism. ','The organization conducting the inspection/assessment obtains and examines the incident handling plan to ensure that there are procedures identified to leverage the JIMS.'),\n('000834','draft','2009-09-18','DISA FSO','policy','The organization defines a time period for personnel to report suspected security incidents to the organizational incident response capability.','IR-6.1','DoD has defined the time period as the timeframes specified by CJCSM 6510.01B (Table C-A-1) unless the data owner provides more restrictive guidance.  If organizations decide to be more restrictive than the guidance in the CJCSM, then they should address the more restrictive response time requirements in their incident response plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the time period as the timeframes specified by CJCSM 6510.01B (Table C-A-1) unless the data owner provides more restrictive guidance.  The organization conducting the inspection/assessment obtains and examines the incident response plan to determine if more stringent response time requirements have been identified.'),\n('000835','draft','2009-09-18','DISA FSO','policy','The organization requires personnel to report suspected security incidents to the organizational incident response capability within the organization-defined time period.','IR-6.2','The organization being inspected/assessed documents within the user agreement the requirement for all system users to report suspected security incidents to the organizational incident response capability within the timeframes specified by CJCSM 6510.01B (Table C-A-1) unless the data owner provides more restrictive guidance.  DoD has defined the time period as the timeframes specified by CJCSM 6510.01B (Table C-A-1) unless the data owner provides more restrictive guidance.','The organization conducting the inspection/assessment obtains and examines the user agreement to ensure users are required to report suspected security incidents to the organizational incident response capability within the timeframes specified by CJCSM 6510.01B (Table C-A-1) unless the data owner provides more restrictive guidance.  DoD has defined the time period as the timeframes specified by CJCSM 6510.01B (Table C-A-1)  unless the data owner provides more restrictive guidance.'),\n('000836','draft','2009-09-18','DISA FSO','policy','The organization reports security incident information to organization-defined authorities.','IR-6.3','The organization being inspected/assessed documents and implements a process to report to the appropriate CIRT/CERT (such as US-CERT, DoD CERT, IC CERT). Any security incidents IAW the incident response plan (IR-8).  Reporting shall be conducted IAW CJCSM 6510.01B.\\n\\nDoD has defined the authorities as the appropriate CIRT/CERT (such as US-CERT, DoD CERT, IC CERT).','The organization conducting the inspection/assessment obtains and examines a sample of previous security incidents to ensure the incidents were reported to the appropriate CIRT/CERT (such as US-CERT, DoD CERT, IC CERT). Any security incidents IAW the incident response plan (IR-8).  Reporting shall be conducted IAW CJCSM 6510.01B.\\n\\nDoD has defined the authorities as the appropriate CIRT/CERT (such as US-CERT, DoD CERT, IC CERT).'),\n('000837','draft','2009-09-18','DISA FSO','policy','The organization employs automated mechanisms to assist in the reporting of security incidents.','IR-6(1).1','The organization being inspected/assessed will document within their incident handling plan, procedures to leverage the Joint Incident Management System (JIMS).  For the DoD, JIMS is the automated mechanism. ','The organization conducting the inspection/assessment obtains and examines the incident handling plan to ensure that there are procedures identified to leverage the JIMS. '),\n('000838','draft','2009-09-18','DISA FSO','policy','The organization reports information system vulnerabilities associated with reported security incidents to organization-defined personnel or roles.','IR-6(2).1','The organization being inspected/assessed documents and implements a process to report to personnel defined in IR-6 (2), CCI 2792  information system vulnerabilities associated with reported security incident IAW the incident response plan (IR-8).  Reporting shall be conducted IAW CJCSM 6510.01B.  ','The organization conducting the inspection/assessment obtains and examines a sample of previous security incidents to ensure the associated vulnerabilities were reported to personnel defined in IR-6 (2), CCI 2792 IAW the incident response plan (IR-8).  Reporting shall be conducted IAW CJCSM 6510.01B.'),\n('000839','draft','2009-09-18','DISA FSO','policy','The organization provides an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the information system for the handling and reporting of security incidents.','IR-7.1','The organization being inspected/assessed will establish an incident response support service, analogous to an IT help desk, to provide advice and assistance to users for handling and reporting of security incidents.  ','The organization conducting the inspection/assessment will interview organizational users to determine awareness of incident response support services and quality of assistance of those services when used.  If interviewing organizational users is not feasible, then review users manuals/documentation to ensures it identifies an incident response support service to contact.'),\n('000840','draft','2009-09-18','DISA FSO','policy','The organization employs automated mechanisms to increase the availability of incident response-related information and support.','IR-7(1).1','The organization being inspected/assessed will implement an automated intra-organization incident response information sharing capability to provide the following incident related information and support, for example:\\n1. SOP for incident reporting\\n2. Incident handling FAQ\\n3. Current incident activity awareness information\\n4. Incident response contact information\\n5. Incident report submission','The organization conducting the inspection/assessment obtains and examines the incident response information sharing capability to validate the information sharing capability is available to organizational users.'),\n('000841','draft','2009-09-18','DISA FSO','policy','The organization establishes a direct, cooperative relationship between its incident response capability and external providers of information system protection capability.','IR-7(2).1','The organization being inspected/assessed must establish a formal agreement with a computer network defense service provider (CNDSP).  ','The organization conducting the inspection/assessment obtains and examines the formal agreement document between the organization and CNDSP to validate it is current and valid.'),\n('000842','draft','2009-09-18','DISA FSO','policy','The organization identifies organizational incident response team members to the external providers.','IR-7(2).2','The organization being inspected/assessed must provide and update the list of internal incident response team members as necessary throughout the lifecycle of the CNDSP agreement, in conjunction with the CNDSP agreement.','The organization conducting the inspection/assessment obtains and examines the list of internal incident response team members to validate it is accurate and current.  Interviews with CNDSP personnel and organizational incident response team members may also be conducted.'),\n('000843','draft','2009-09-18','DISA FSO','policy','The organization develops an incident response plan that provides the organization with a roadmap for implementing its incident response capability; describes the structure and organization of the incident response capability; provides a high-level approach for how the incident response capability fits into the overall organization; meets the unique requirements of the organization, which relate to mission, size, structure, and functions; defines reportable incidents; provides metrics for measuring the incident response capability within the organization; and defines the resources and management support needed to effectively maintain and mature an incident response capability.',NULL,NULL,NULL),\n('000844','draft','2009-09-18','DISA FSO','policy','The organization develops an incident response plan that is reviewed and approved by organization-defined personnel or roles.','IR-8.10','The organization being inspected/assessed will have an incident response plan signed and approved by at a minimum, the ISSM and ISSO.  DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.','The organization conducting the inspection/assessment obtains and examines the incident response plan to validate it has been properly signed by  at a minimum, the ISSM and ISSO.  DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.'),\n('000845','draft','2009-09-18','DISA FSO','policy','The organization defines incident response personnel (identified by name and/or by role) and organizational elements to whom copies of the incident response plan are distributed.','IR-8.11','DoD has defined the list as all stakeholders identified in the incident response plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the list as all stakeholders identified in the incident response plan.'),\n('000846','draft','2009-09-18','DISA FSO','policy','The organization distributes copies of the incident response plan to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.','IR-8.12','The organization being inspected/assessed makes available to all stakeholders identified in the incident response plan via organizationally approved information sharing mechanism.  DoD has defined the list as all stakeholders identified in the incident response plan.','The organization conducting the inspection/assessment obtains and examines organizationally approved information sharing mechanism to validate all stakeholders identified in the incident response plan have adequate access to the incident response plan.  DoD has defined the list as all stakeholders identified in the incident response plan.'),\n('000847','draft','2009-09-18','DISA FSO','policy','The organization defines the frequency for reviewing the incident response plan.','IR-8.13','DoD has defined the frequency as at least annually (incorporating lessons learned from past incidents).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at least annually (incorporating lessons learned from past incidents).'),\n('000848','draft','2009-09-18','DISA FSO','policy','The organization reviews the incident response plan on an organization-defined frequency.','IR-8.14','The organization being inspected/assessed will conduct reviews of its incident response plan at least annually.  DoD has defined the frequency as at least annually (incorporating lessons learned from past incidents).','The organization conducting the inspection/assessment obtains and examines the incident response plan to validate it is current and  has been reviewed within the last year.  DoD has defined the frequency as at least annually (incorporating lessons learned from past incidents).  '),\n('000849','draft','2009-09-18','DISA FSO','policy','The organization updates the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing.','IR-8.15','The organization being inspected/assessed must update the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing and incorporate lessons learned from past incidents (IR-4a).  The organization must document the update actions as an audit trail.','The organization conducting the inspection/assessment obtains and examines documentation of the update actions for the incident response plan to ensure the organization is updating the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing and incorporating lessons learned from past incidents (IR-4a).'),\n('000850','draft','2009-09-18','DISA FSO','policy','The organization communicates incident response plan changes to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.','IR-8.16','The organization being inspected/assessed communicates incident response plan changes to all stakeholders identified in the incident response plan, not later than 30 days after the change is made.  DoD has defined the incident response personnel as all stakeholders identified in the incident response plan, not later than 30 days after the change is made.','The organization conducting the inspection/assessment examines the incident response plan via the inspected organization\\'s information sharing capability (e.g. portal, intranet, email, etc.) to ensure it has been communicated to all stakeholders identified in the incident response plan, not later than 30 days after the change is made.  DoD has defined the incident response personnel as all stakeholders identified in the incident response plan, not later than 30 days after the change is made.'),\n('000851','draft','2009-09-18','DISA FSO','policy','The organization defines the frequency with which to review and update the current system maintenance policy.','MA-1.7','DoD has defined the frequency as every 5 years.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every 5 years.'),\n('000852','draft','2009-09-18','DISA FSO','policy','The organization develops and documents a system maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','MA-1.3','The organization being inspected/assessed develops and documents a system maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','The organization conducting the inspection/assessment obtains and examines the documented maintenance policy to ensure the organization being inspected/assessed develops and documents  a system maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.'),\n('000853','draft','2009-09-18','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles a system maintenance policy.','MA-1.4','The organization being inspected/assessed ensures the maintenance policy is disseminated to the  SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.\\n\\nDoD has defined the personnel or roles as the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.','The organization conducting the inspection/assessment obtains and examines the maintenance policy via the inspected organization\\'s information sharing capability (e.g. portal, intranet, email, etc.) to ensure it has been disseminated to the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.\\n\\nDoD has defined the personnel or roles as the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.'),\n('000854','draft','2009-09-18','DISA FSO','policy','The organization reviews and updates the current system maintenance policy in accordance with organization-defined frequency.','MA-1.8','The organization being inspected/assessed  reviews the current system maintenance policy every 5 years and revises as necessary to comply with DoD regulations.\\n\\nThe organization must document each occurrence of the reviews and update actions as an audit trail.\\n\\nDoD has defined the frequency as every 5 years.','The organization conducting the inspection/assessment obtains and examines documentation of occurrence of reviews and update actions for the maintenance policy to ensure  review is occurring every 5 years and updates are made as necessary.\\n\\nDoD has defined the frequency as every 5 years.'),\n('000855','draft','2009-09-18','DISA FSO','policy','The organization develops and documents procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls.','MA-1.5','The organization being inspected/assessed documents the maintenance procedures within the Security Plan.  The maintenance procedures shall be developed IAW maintenance policy provided in DoDI 8500.01..','The organization conducting the inspection/assessment obtains and examines the Security Plan to ensure maintenance procedures are documented and are developed IAW maintenance policy provided in DoDI 8500.01..'),\n('000856','draft','2009-09-18','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls.','MA-1.6','The organization being inspected/assessed ensures the maintenance procedures are disseminated to the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system via an information sharing capability.  DoD has defined the personnel or roles as the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.','The organization conducting the inspection/assessment examines the maintenance procedures via the inspected organization\\'s information sharing capability (e.g. portal, intranet, email, etc.) to ensure it has been disseminated to the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.  DoD has defined the personnel or roles as the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.'),\n('000857','draft','2009-09-18','DISA FSO','policy','The organization reviews and updates the current system maintenance procedures in accordance with organization-defined frequency.','MA-1.9','The organization being inspected/assessed reviews the current system maintenance procedures annually and revises as needed to comply with DoD regulations.  The organization must document each occurrence of the reviews and update actions as an audit trail.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines documentation of occurrence of reviews and update actions for the maintenance procedures to ensure annual review and necessary updates are occurring.   DoD has defined the frequency as annually.'),\n('000858','draft','2009-09-18','DISA FSO','policy','The organization schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.',NULL,NULL,NULL),\n('000859','draft','2009-09-18','DISA FSO','policy','The organization approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location.','MA-2.9','The organization being inspected/assessed approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location.  The organization must maintain records of all approvals and monitoring activities.','The organization conducting the inspection/assessment obtains and examines records of all approvals and monitoring activities to ensure the organization being inspected/assessed approves and monitors all maintenance activities whether performed on site or remotely and whether the equipment is serviced on site or removed to another location.'),\n('000860','draft','2009-09-18','DISA FSO','policy','The organization requires that organization-defined personnel or roles explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs.','MA-2.10','The organization being inspected/assessed documents within their risk management strategy personnel or roles defined in MA-2, CCI 2874 who must explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs.  The organization must maintain written records of approval for the removal of the information system or system components from organizational facilities for off-site maintenance or repairs.','The organization conducting the inspection/assessment obtains and examines:\\n1. the organization\\'s risk management strategy to ensure the personnel or roles defined in MA-2, CCI 2874 have been designated to approve the removal of the information system or system components;\\n2. and written records of approval for the removal of the information system or system components from organizational facilities for off-site maintenance or repairs to ensure the removal is explicitly approved.'),\n('000861','draft','2009-09-18','DISA FSO','policy','The organization sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs.','MA-2.12','The organization being inspected/assessed sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs IAW DoDM 5200.01-V3  for classified media and DoDM 5200.01-V4 for unclassified media.  The organization must maintain written records of media sanitization.','The organization conducting the inspection/assessment obtains and examines written records of media sanitization to ensure the organization sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs.'),\n('000862','draft','2009-09-18','DISA FSO','policy','The organization checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions.','MA-2.13','The organization being inspected/assessed identifies and documents the impacted security controls and takes steps to verify that the controls are still functioning properly following maintenance or repair actions.','The organization conducting the inspection/assessment obtains and examines documented evidence of the verification of security controls following maintenance and repair actions to ensure that the organization being inspected/assessed checks all potentially impacted security controls to verify that they are still functioning properly.'),\n('000863','draft','2009-09-18','DISA FSO','policy','The organization maintains maintenance records for the information system that include the date and time of maintenance, the name of the individual performing the maintenance, the name of escort, if necessary, a description of the maintenance performed, and a list of equipment removed or replaced (including identification numbers, if applicable).',NULL,NULL,NULL),\n('000864','draft','2009-09-18','DISA FSO','policy','The organization employs automated mechanisms to schedule, conduct, and document maintenance and repairs as required.',NULL,NULL,NULL),\n('000865','draft','2009-09-18','DISA FSO','policy','The organization approves information system maintenance tools.','MA-3.1','The organization being inspected/assessed documents the approved maintenance tools within the Security Plan.','The organization conducting the inspection/assessment:\\n1. obtains and examines the Security Plan to ensure the list of approved maintenance tools is documented;\\n2. ensures only the approved maintenance tools are used within the system.'),\n('000866','draft','2009-09-18','DISA FSO','policy','The organization controls information system maintenance tools.','MA-3.2','The organization being inspected/assessed controls information system maintenance tools that are approved IAW MA-3, CCI 865.','The organization conducting the inspection/assessment:\\n1. obtains and examines the Security Plan to identify the list of approved maintenance tools;\\n2. ensures the organization being inspected/assessed controls the approved information system maintenance tools.'),\n('000867','draft','2009-09-18','DISA FSO','policy','The organization monitors information system maintenance tools.','MA-3.3','The organization being inspected/assessed develops and implements procedures to monitor the use of the approved information system maintenance tools IAW MA-3, CCI 865.   Records of monitoring activity must be maintained.','The organization conducting the inspection/assessment obtains and examines:\\n1. the Security Plan to identify the list of approved maintenance tools; and\\n2. documented procedures to identify how the use of maintenance tools is monitored; and 3. reviews evidence that the monitoring is conducted IAW the documented procedures.'),\n('000868','draft','2009-09-18','DISA FSO','policy','The organization maintains, on an ongoing basis, information system maintenance tools.',NULL,NULL,NULL),\n('000869','draft','2009-09-18','DISA FSO','policy','The organization inspects the maintenance tools carried into a facility by maintenance personnel for improper or unauthorized modifications.','MA-3(1).1','The organization being inspected/assessed documents the procedures for and implements inspections of the maintenances tools carried into a facility by maintenance personnel for improper or unauthorized modifications.  Records of inspection must be maintained.','The organization conducting the inspection/assessment obtains and examines procedures for, and records of inspection of the maintenance tools carried into a facility by maintenance personnel  to ensure the tools are inspected for improper or unauthorized modifications.'),\n('000870','draft','2009-09-18','DISA FSO','policy','The organization checks media containing diagnostic and test programs for malicious code before the media are used in the information system.','MA-3(2).1','The organization being inspected/assessed:\\n1. documents and implements procedures to check all media containing diagnostic and test programs for malicious code before the media are used in the information system; and\\n2. Runs an automated tool set to check all media containing diagnostic and test programs for malicious code before the media are used in the information system.\\nThe organization must maintain configuration files for the automated tool set and audit logs of the tool set used to check media.','The organization conducting the inspection/assessment obtains and examines the procedures for checking all diagnostic and test media for malicious code, and a sampling of configuration files and audit logs of the tool set used to check media.  The purpose of the review is to ensure the organization being inspected/assessed checks all media containing diagnostic and test programs for malicious code before the media are used in the information system.'),\n('000871','draft','2009-09-18','DISA FSO','policy','The organization prevents the unauthorized removal of maintenance equipment containing organizational information by: (a) verifying that there is no organizational information contained on the equipment; (b) sanitizing or destroying the equipment; (c) retaining the equipment within the facility; or (d) obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility.','MA-3(3).1','The organization being inspected/assessed documents and implements a process to take one of the following actions before authorizing removal of information equipment from the facility:\\n1. verify there is no organizational information contained on maintenance equipment;\\n2. Sanitize or destroy the equipment;\\n3. Retain the equipment within the facility; or\\n4. Obtain an exemption from personnel or roles defined in MA-3 (3), CCI 2882 explicitly authorizing removal of the equipment from the facility.\\nThe organization must maintain a record of maintenance equipment removal and actions taken.','The organization conducting the inspection/assessment obtains and examines the documented process and record of maintenance equipment removal to ensure  the organization being inspected/assessed takes one of the four actions listed in the implementation guidance.'),\n('000872','draft','2009-09-18','DISA FSO','policy','The organization employs automated mechanisms to restrict the use of maintenance tools to authorized personnel only.',NULL,NULL,NULL),\n('000873','draft','2009-09-18','DISA FSO','policy','The organization approves nonlocal maintenance and diagnostic activities.','MA-4.1','The organization being inspected/assessed documents the procedures for approving non-local maintenance and diagnostic activities within the Security Plan.  The organization must maintain records of approved non-local maintenance and diagnostic activities.','The organization conducting the inspection/assessment obtains and examines:\\n1. the Security Plan to ensure the procedures for approving non-local maintenance and diagnostic activities are documented; and\\n2. records approving non-local maintenance and diagnostic activities.'),\n('000874','draft','2009-09-18','DISA FSO','policy','The organization monitors nonlocal maintenance and diagnostic activities.','MA-4.2','The organization being inspected/assessed develops and implements procedures to monitor non-local maintenance and diagnostic activities.   Records of monitoring activity must be maintained.','The organization conducting the inspection/assessment obtains and examines:\\n1.  the Security Plan to identify the authorized non-local maintenance and diagnostic activities; and\\n2. documented procedures to identify how the use of non-local maintenance and diagnostic activities are monitored; and\\n3. reviews evidence that the monitoring is conducted IAW the documented procedures.'),\n('000875','draft','2009-09-18','DISA FSO','policy','The organization controls non-local maintenance and diagnostic activities.',NULL,NULL,NULL),\n('000876','draft','2009-09-18','DISA FSO','policy','The organization allows the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the information system.','MA-4.3','The organization being inspected/assessed:\\n1. documents within the Security Plan the non-local maintenance and diagnostic tools that are allowed; and\\n2. allows the use of non-local maintenance and diagnostic tools IAW the tools identified in the Security Plan and MA-4, CCI 873.','The organization conducting the inspection/assessment obtains and examines:\\n1. the Security Plan to ensure non-local maintenance and diagnostic tools have been identified; and\\n2. maintenance records to ensure only those tools allowed are used IAW MA-4, CCI 873.'),\n('000877','draft','2009-09-18','DISA FSO','technical','The organization employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.','MA-4.4','The organization being inspected/assessed configures the information system to employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 877.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 877.'),\n('000878','draft','2009-09-18','DISA FSO','policy','The organization maintains records for nonlocal maintenance and diagnostic activities.','MA-4.5','The organization being inspected/assessed maintains records of authorized non-local maintenance and diagnostic activities.','The organization conducting the inspection/assessment obtains records of authorized non-local maintenance and diagnostic activities, and examines a sampling to verify the organization is maintaining records for all non-local maintenance and diagnostic activities.'),\n('000879','draft','2009-09-18','DISA FSO','technical','The organization terminates sessions and network connections when nonlocal maintenance is completed.','MA-4.6','The organization being inspected/assessed terminates session and network connections when non-local maintenance is completed.  The organization must retain audit logs of session and network connections termination for non-local maintenance.','The organization conducting the inspection/assessment obtains and examines audit logs of session and network connections termination for non-local maintenance to ensure session and network connections are terminated when non-local maintenance is completed.'),\n('000880','draft','2009-09-18','DISA FSO','technical','The organization audits non-local maintenance and diagnostic sessions.',NULL,NULL,NULL),\n('000881','draft','2009-09-18','DISA FSO','policy','The organization documents, in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections.','MA-4(2).1','The organization being inspected/assessed documents within the Security Plan the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections.','The organization conducting the inspection/assessment obtains and examines the Security Plan to ensure the plan identifies the establishment and use of non-local maintenance and diagnostic connections.'),\n('000882','draft','2009-09-18','DISA FSO','policy','The organization requires that nonlocal maintenance and diagnostic services be performed from an information system that implements a security capability comparable to the capability implemented on the system being serviced.','MA-4(3).1','The organization being inspected/assessed  clearly defines in its contracts and/or service level agreements the requirement that any IS used to conduct non-local maintenance and diagnostic services will have a security level at least as high as the security level implemented on the IS being serviced.  Alternatively, the organization being inspected/assessed complies with MA-4 (3) CCIs 883 and 1631.','The organization conducting the inspection/assessment obtains and examines contracts and/or service level agreements for all non-local maintenance and diagnostic services  to ensure that any IS used for those services is required to have security level at least as high as the security level implemented on the IS being serviced.   Alternatively, the organization conducting the inspection/assessment ensures the organization being inspected/assessed complies with  MA-4 (3) CCIs 883 and 1631.'),\n('000883','draft','2009-09-18','DISA FSO','policy','The organization removes the component to be serviced from the information system and prior to nonlocal maintenance or diagnostic services, sanitizes the component (with regard to organizational information) before removal from organizational facilities.','MA-4(3).2','The organization being inspected/assessed  removes the component to be serviced from the information system and prior to non-local maintenance or diagnostic services, sanitizes the component (with regard to organizational information) before removal from organizational facilities.  Alternatively, the organization being inspected/assessed complies with MA-4 (3) CCI 882.','The organization conducting the inspection/assessment obtains and examines maintenance procedures for all non-local maintenance and diagnostic services  to ensure that the organization being inspected/assessed sanitizes components before removal from organizational facilities.  Alternatively, the organization conducting the inspection/assessment ensures the organization being inspected/assessed complies with  MA-4 (3) CCI 882.'),\n('000884','draft','2009-09-18','DISA FSO','technical','The organization protects nonlocal maintenance sessions by employing organization-defined authenticators that are replay resistant.','MA-4(4).1','The organization being inspected/assessed configures the information system to protect nonlocal maintenance sessions by employing authenticators defined in MA-4 (4), CCI 2887 that are replay resistant.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 884.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to protect nonlocal maintenance sessions by employing authenticators defined in MA-4 (4), CCI 2887 that are replay resistant.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 884.'),\n('000885','draft','2009-09-18','DISA FSO','policy','The organization requires that maintenance personnel notify organization-defined personnel when non-local maintenance is planned (i.e., date/time).',NULL,NULL,NULL),\n('000886','draft','2009-09-18','DISA FSO','policy','The organization defines the personnel or roles to be notified of the date and time of planned nonlocal maintenance.','MA-4(5).3','DoD has defined the personnel or roles as the user base which could be impacted by the maintenance event.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as the user base which could be impacted by the maintenance event.'),\n('000887','draft','2009-09-18','DISA FSO','policy','The organization requires the approval of each nonlocal maintenance session by organization-defined personnel or roles.','MA-4(5).1','The organization being inspected/assessed defines within their maintenance procedures a process for the ISSO to approve the non-local maintenance.  Written approval must be maintained.  DoD has defined the personnel or roles as the ISSO.','The organization conducting the inspection/assessment obtains and examines the maintenance procedures and historical approvals to ensure that the ISSO approves the non-local maintenance.  DoD has defined the personnel or roles as the ISSO.'),\n('000888','draft','2009-09-18','DISA FSO','technical','The organization employs cryptographic mechanisms to protect the integrity and confidentiality of non-local maintenance and diagnostic communications.',NULL,NULL,NULL),\n('000889','draft','2009-09-18','DISA FSO','policy','The organization employs remote disconnect verification at the termination of non-local maintenance and diagnostic sessions.',NULL,NULL,NULL),\n('000890','draft','2009-09-18','DISA FSO','policy','The organization establishes a process for maintenance personnel authorization.','MA-5.1','The organization being inspected/assessed  clearly defines, documents, and establishes a process for the authorization of maintenance personnel.','The organization conducting the inspection/assessment obtains and examines  procedures addressing maintenance personnel to ensure that the organization being inspected/assessed has established processes for the authorization of maintenance personnel.'),\n('000891','draft','2009-09-18','DISA FSO','policy','The organization maintains a list of authorized maintenance organizations or personnel.','MA-5.2','The organization being inspected/assessed maintains a current list of authorized maintenance organizations or personnel.','The organization conducting the inspection/assessment obtains and examines the current list of authorized maintenance organizations or personnel to ensure the organization being inspected/assessed is maintaining the list.'),\n('000892','draft','2009-09-18','DISA FSO','policy','The organization ensures that personnel performing maintenance on the information system have required access authorizations or designates organizational personnel with required access authorizations and technical competence deemed necessary to supervise information system maintenance.',NULL,NULL,NULL),\n('000893','draft','2009-09-18','DISA FSO','policy','The organization implements procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens.','MA-5(1).1','The organization being inspected/assessed documents and implements procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. Citizens in the procedures documented IAW MA-5, CCI 890.','The organization conducting the inspection/assessment obtains and examines the procedures identified in MA-5, CCI 890 to ensure it includes specific procedures for maintenance personnel that lack appropriate security clearances or are not U.S. citizens.'),\n('000894','draft','2009-09-18','DISA FSO','policy','The organization requires maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals to be escorted and supervised during the performance of maintenance and diagnostic activities on the information system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified.','MA-5(1).2','The organization being inspected/assessed  requires maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals to be escorted and supervised during the performance of maintenance and diagnostic activities on the information system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified.  The organization must maintain records of maintenance personnel who access the system including information on escorts.','The organization conducting the inspection/assessment obtains and examines the  records of maintenance personnel who access the system to ensure the organization being inspected/assessed requires maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals to be escorted and supervised during the performance of maintenance and diagnostic activities on the information system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified.'),\n('000895','draft','2009-09-18','DISA FSO','policy','The organization requires that, prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the information system be sanitized and all nonvolatile storage media be removed or physically disconnected from the system and secured.','MA-5(1).3','The organization being inspected/assessed documents and implements a process to sanitize, remove, or physically disconnect all nonvolatile storage media from the system prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed sanitizes, removes, or physically disconnects all nonvolatile storage media from the system prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals.'),\n('000896','draft','2009-09-18','DISA FSO','policy','The organization requires that in the event an information system component cannot be sanitized, the procedures contained in the security plan for the system be enforced.',NULL,NULL,NULL),\n('000897','draft','2009-09-18','DISA FSO','policy','The organization ensures that personnel performing maintenance and diagnostic activities on an information system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for all compartments of information on the system.','MA-5(2).1','The organization being inspected/assessed documents and implements a process to ensure that personnel performing maintenance and diagnostic activities on an information system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for all compartments of information on the system.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures that personnel performing maintenance and diagnostic activities on an information system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for all compartments of information on the system.'),\n('000898','draft','2009-09-18','DISA FSO','policy','The organization ensures that personnel performing maintenance and diagnostic activities on an information system processing, storing, or transmitting classified information are U.S. citizens.','MA-5(3).1','The organization being inspected/assessed documents and implements a process to ensure that personnel performing maintenance and diagnostic activities on an information system processing, storing, or transmitting classified information are U.S. citizens.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  ensures that personnel performing maintenance and diagnostic activities on an information system processing, storing, or transmitting classified information are U.S. citizens.'),\n('000899','draft','2009-09-18','DISA FSO','policy','The organization ensures that cleared foreign nationals (i.e., foreign nationals with appropriate security clearances) are used to conduct maintenance and diagnostic activities on classified information systems only when the systems are jointly owned and operated by the United States and foreign allied governments, or owned and operated solely by foreign allied governments.','MA-5(4).1','The organization being inspected/assessed documents and implements a process to ensure that cleared foreign nationals (i.e., foreign nationals with appropriate security clearances), are used to conduct maintenance and diagnostic activities on classified information systems only when the systems are jointly owned and operated by the United States and foreign allied governments, or owned and operated solely by foreign allied governments.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  ensures that cleared foreign nationals (i.e., foreign nationals with appropriate security clearances), are used to conduct maintenance and diagnostic activities on classified information systems only when the systems are jointly owned and operated by the United States and foreign allied governments, or owned and operated solely by foreign allied governments.'),\n('000900','draft','2009-09-18','DISA FSO','policy','The organization ensures that approvals, consents, and detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified information systems are fully documented within Memoranda of Agreements.','MA-5(4).2','The organization being inspected/assessed documents and implements a process to  ensure that approvals, consents, and detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified information systems are fully documented within  Memorandum of Agreements.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  ensures that approvals, consents, and detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified information systems are fully documented within  Memorandum of Agreements.'),\n('000901','draft','2009-09-18','DISA FSO','policy','The organization defines a list of security-critical information system components and/or key information technology components for which it will obtain maintenance support and/or spare parts.',NULL,NULL,NULL),\n('000902','draft','2009-09-18','DISA FSO','policy','The organization defines a time period for obtaining maintenance support and/or spare parts for security-critical information system components and/or key information technology components.',NULL,NULL,NULL),\n('000903','draft','2009-09-18','DISA FSO','policy','The organization obtains maintenance support and/or spare parts for organization-defined information system components within an organization-defined time period of failure.','MA-6.1','The organization being inspected/assessed obtains maintenance support and/or spare parts for information system components defined in MA-6, CCI 2896 within 24 hours (Low and Moderate Availability) or immediately upon failure for (High Availability).   DoD has defined the time period as within 24 hours (Low and Moderate Availability) or immediately upon failure for (High Availability). ','The organization conducting the inspection/assessment obtains evidence that maintenance support is available for information system components defined in MA-6, CCI 2896 and that the support will be provided within 24 hours (Low and Moderate Availability) or immediately upon failure for (High Availability).   Evidence can include maintenance support contracts, inventories of spare parts, etc.  DoD has defined the time period as within 24 hours (Low and Moderate Availability) or immediately upon failure for (High Availability). '),\n('000904','draft','2009-09-21','DISA FSO','policy','The organization develops and documents a physical and environmental protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','PE-1.3','DoDI 5200.08 and DoD 5200.08-R meet the requirement for Physical and Environmental Policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.08 and DoD 5200.08-R.','DoDI 5200.08 and DoD 5200.08-R meet the requirement for Physical and Environmental Policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.08 and DoD 5200.08-R.'),\n('000905','draft','2009-09-21','DISA FSO','policy','The organization disseminates a physical and environmental protection policy to organization-defined personnel or roles.','PE-1.4','DoD disseminates DoDI 5200.08 and DoD 5200.08-R  organization-wide via the DoD Issuances website.\\nhttp://www.dtic.mil/whs/directives/corres/dir.html\\n\\nDoD has defined the personnel or roles as organizational personnel with physical and environmental protection responsibilities.','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 5200.08 and DoD 5200.08-R\\n\\nDoD has defined the personnel or roles as organizational personnel with physical and environmental protection responsibilities.'),\n('000906','draft','2009-09-21','DISA FSO','policy','The organization reviews and updates the current physical and environmental protection policy in accordance with organization-defined frequency.','PE-1.7','DoDI 5200.08 and DoD 5200.08-R meet the requirement for Physical and Environmental Policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.08 and DoD 5200.08-R.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.','DoDI 5200.08 and DoD 5200.08-R meet the requirement for Physical and Environmental Policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.08 and DoD 5200.08-R.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.'),\n('000907','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency with which to review and update the physical and environmental protection policy.','PE-1.8','DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.'),\n('000908','draft','2009-09-21','DISA FSO','policy','The organization develops and documents procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls.','PE-1.5','DoDI 5200.08 and DoD 5200.08-R meet the requirement for Physical and Environmental Policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.08 and DoD 5200.08-R.','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.08 and DoD 5200.08-R.'),\n('000909','draft','2009-09-21','DISA FSO','policy','The organization disseminates physical and environmental protection procedures to organization-defined personnel or roles.','PE-1.6','DoD disseminates DoDI 5200.08 and DoD 5200.08-R  organization-wide via the DoD Issuances website.\\nhttp://www.dtic.mil/whs/directives/corres/dir.html\\n\\nDoD has defined the personnel or roles as organizational personnel with physical and environmental protection responsibilities.','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 5200.08 and DoD 5200.08-R\\n\\nDoD has defined the personnel or roles as organizational personnel with physical and environmental protection responsibilities.'),\n('000910','draft','2009-09-21','DISA FSO','policy','The organization reviews and updates the current physical and environmental protection procedures in accordance with organization-defined frequency.','PE-1.9','DoDI 5200.08 and DoD 5200.08-R meet the requirement for Physical and Environmental Policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.08 and DoD 5200.08-R.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.08 and DoD 5200.08-R.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.'),\n('000911','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency with which to review and update the physical and environmental protection procedures.','PE-1.10','DoD has defined the frequency as reviewed annually - updated as appropriate.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.'),\n('000912','draft','2009-09-21','DISA FSO','policy','The organization develops a list of individuals with authorized access to the facility where the information system resides.','PE-2.1','The organization being inspected/assessed will develop and maintain a list of personnel with authorized access to the facilities where information systems reside.  The organization will also take action to identify and officially designate its publicly accessible areas where access authorization is not required.','The organization conducting the inspection/assessment obtains and examines the list of personnel with authorized access to facilities where information systems reside to ensure it is current within every 90 days.  The review process should also determine if the organization has identified and officially designated its publicly accessible areas where access authorization is not required.  DoD has defined the frequency as every 90 days.'),\n('000913','draft','2009-09-21','DISA FSO','policy','The organization issues authorization credentials for facility access.','PE-2.4','The organization being inspected/assessed utilizes the list of personnel with authorized access (IAW PE-2, CCI-000912) and issues credentials accordingly.  The organization must document the credential issuing activity as an audit trail.','The organization conducting the inspection/assessment obtains and examines documentation of credential issuing activities to ensure credentials are issued to personnel with authorized access.'),\n('000914','draft','2009-09-21','DISA FSO','policy','The organization reviews the access list detailing authorized facility access by individuals in accordance with organization-defined frequency.','PE-2.5','The organization being inspected/assessed will review the access list and authorization credentials every 90 days and document these review and approval actions as an audit trail.   DoD has defined the frequency as every 90 days.','The organization conducting the inspection/assessment obtains and examines the audit records of the review actions to ensure that reviews are conducted every 90 days.   DoD has defined the frequency as every 90 days.'),\n('000915','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency with which to review the access list detailing authorized facility access by individuals.','PE-2.6','DoD has defined the frequency as every 90 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as every 90 days.'),\n('000916','draft','2009-09-21','DISA FSO','policy','The organization authorizes physical access to the facility where the information system resides based on position or role.','PE-2(1).1','The organization being inspected/assessed must:\\n1. Develop and document a list of roles or positions that have access to the facility where the information system resides.\\n2. Identify and document personnel assigned to those roles.\\n3. Authorize and document access to the facility to personnel in identified roles','The organization conducting the inspection/assessment obtains and examines:\\n1. The list of roles or positions that have access to the facility where the information system resides.\\n2. The list of personnel assigned to those roles\\nRecommended:\\n3. Access logs to verify access to the facility was authorized based on the appropriate roles and positions'),\n('000917','draft','2009-09-21','DISA FSO','policy','The organization requires two forms of identification from an organization-defined list of acceptable forms of identification for visitor access to the facility where the information system resides.','PE-2(2).1','The organization being inspected/assessed will only grant access to the facility with two organization approved government issued forms of identification defined in PE-2 (2), CCI 2912.  This requirement must be documented within the organization\\'s physical security policy.  The organization must maintain access control documentation as an auditable event per AU-2, CCI 000123.','The organization conducting the inspection/assessment obtains and examines the inspected organization\\'s physical security policy for requirements and implementation guidance to have two forms of identification defined in PE-2 (2), CCI 2912 and physical access control logs or records; and any other relevant documents or records to validate compliance.'),\n('000918','draft','2009-09-21','DISA FSO','policy','The organization restricts physical access to the facility containing an information system that processes classified information to authorized personnel with appropriate clearances and access authorizations.',NULL,NULL,NULL),\n('000919','draft','2009-09-21','DISA FSO','policy','The organization enforces physical access authorizations at organization-defined entry/exit points to the facility where the information system resides.','PE-3.1','The organization being inspected/assessed will implement physical access authorizations at entry/exit points defined in PE-3, CCI 2915 and secure those physical access points (i.e. doors and/or windows) that are not intended for normal access.','The organization conducting the inspection/assessment performs a physical inspection of facility entry/exit points defined in PE-3, CCI 2915 to ensure that either physical access authorization controls are in place for those access points considered normal access points or are properly secured.  Physical access points that are not documented or are not secured would be a failure of this control.'),\n('000920','draft','2009-09-21','DISA FSO','policy','The organization verifies individual access authorizations before granting access to the facility.','PE-3.3','The organization being inspected/assessed verifies and grants access to facilities based upon individual access authorizations.','The organization conducting the inspection/assessment obtains and examines the access authorization list of personnel that have access to the facility (per access list implemented through PE-2, CCI 000912) where the information system resides. Inspect selected facilities to confirm the inspected organization is granting access at all physical access points to only authorized personnel.'),\n('000921','draft','2009-09-21','DISA FSO','policy','The organization controls ingress/egress to the facility where the information system resides using one or more organization-defined physical access control systems/devices or guards.','PE-3.4','The organization being inspected/assessed will control ingress/egress to the facility using the physical access control devices and/or guards defined in PE-3, CCI 2916.','The organization conducting the inspection/assessment obtains and examines the list of physical access control devices and/or guards in use defined in PE-3, CCI 2916  and conducts random inspections of entry points.  The purpose is to determine whether the organization is using those physical access devices and/or guards to control entry of personnel into the facility hosting the information system.'),\n('000922','draft','2009-09-21','DISA FSO','policy','The organization controls access to areas officially designated as publicly accessible in accordance with the organization^s assessment of risk.',NULL,NULL,NULL),\n('000923','draft','2009-09-21','DISA FSO','policy','The organization secures keys, combinations, and other physical access devices.','PE-3.14','The organization being inspected/assessed will secure as appropriate (in safes or secure containers) items used for physical access control such as keys, combinations, portable locks, etc.  Fixed access control devices such as card readers, installed locks, key pads, etc. should be protected from tampering.','The organization conducting the inspection/assessment conducts physical inspections and interviews physical security/safety personnel to validate the organization has taken the proper precautions, and established the proper procedures to ensure it has adequately secured its keys, combinations, and other physical devices.'),\n('000924','draft','2009-09-21','DISA FSO','policy','The organization inventories organization-defined physical access devices on an organization-defined frequency.','PE-3.15','The organization being inspected/assessed conducts and documents an inventory of minimally keys or any other physical token used to gain access annually.  Inventory documents must be retained for at least one year beyond the completion of the next inventory.  DoD has defined the frequency as annually.  DoD has defined the physical access devices as minimally keys or any other physical token used to gain access.','The organization conducting the inspection/assessment obtains and examines the records of inventory of minimally keys or any other physical token used to gain access to ensure the inventory is being conducted annually.\\n\\nDoD has defined the frequency as annually.\\n\\nDoD has defined the physical access devices as minimally keys or any other physical token used to gain access.'),\n('000925','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency for conducting inventories of organization-defined physical access devices.','PE-3.16','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as annually.'),\n('000926','draft','2009-09-21','DISA FSO','policy','The organization changes combinations and keys in accordance with organization-defined frequency and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.','PE-3.18','The organization being inspected/assessed will document each occurrence of these change actions, with the reason for the action, as an audit trail for future reference.  DoD has defined the frequency as required by security relevant events.','The organization conducting the inspection/assessment obtains and examines documentation of these change actions to validate the organization is changing its keys and combinations upon occurrence of security relevant events and when keys are lost, combinations are compromised, or individuals are transferred or terminated.  DoD has defined the frequency as required by security relevant events.'),\n('000927','draft','2009-09-21','DISA FSO','policy','The organization defines a frequency for changing combinations and keys.','PE-3.19','DoD has defined the frequency as required by security relevant event.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as required by security relevant event.'),\n('000928','draft','2009-09-21','DISA FSO','policy','The organization enforces physical access authorizations to the information system in addition to the physical access controls for the facility where the information system resides at organization-defined physical spaces containing one or more components of the information system.','PE-3(1).1','The organization being inspected/assessed will provide documentation of additional physical access authorizations for the facility/facilities at physical spaces containing one or more components of the information system defined in PE-3 (1), CCI 2926.  The organization will ensure that these controls are separate from, and independent of, the physical access controls established for the facility.','The organization conducting the inspection/assessment obtains and examines the documented list of additional physical access authorizations for the facility/facilities at physical spaces containing one or more components of the information system.  The objective of the examination is to determine if the organization is enforcing additional physical access authorizations to areas of the facility at physical spaces containing one or more components of the information system defined in PE-3 (1), CCI 2926.  These controls are independent of the physical access controls established for the facility.'),\n('000929','draft','2009-09-21','DISA FSO','policy','The organization performs security checks in accordance with organization-defined frequency at the physical boundary of the facility or information system for unauthorized exfiltration of information or removal of information system components.','PE-3(2).1','The organization being inspected/assessed documents and implements procedures to perform security checks at the physical boundary of the facility or information system  at a minimum, annually.  The organization must maintain an audit trail of security checks at the physical boundary.  DoD has defined the frequency as at a minimum, annually.','The organization conducting the inspection/assessment obtains and examines the documented procedures as well as the audit trail of security checks at the physical boundary to ensure the organization being inspected/assessed performs security checks at the physical boundary of the facility or information system  at a minimum, annually.\\n\\nDoD has defined the frequency as at a minimum, annually.'),\n('000930','draft','2009-09-21','DISA FSO','policy','The organization employs guards and/or alarms to monitor every physical access point to the facility where the information system resides 24 hours per day, 7 days per week.','PE-3(3).1','The organization being inspected/assessed employs guards and/or alarms to monitor every physical access point to the facility where the information system resides 24 hours per day, 7 days per week.  The organization must create and maintain a list of guards or alarms for every physical access point to the facility where the information system resides 24 hours per day, 7 days per week.','The organization conducting the inspection/assessment obtains the list of guards or alarms for every physical access point to the facility where the information system resides and visually verifies a sampling of access points to ensure the appropriate guard or alarm to monitor is in place 24 hours per day, 7 days per week.'),\n('000931','draft','2009-09-21','DISA FSO','policy','The organization uses lockable physical casings to protect organization-defined information system components from unauthorized physical access.','PE-3(4).1','The organization being inspected/assessed will  deploy and install lockable physical casings designed to protect organization-defined information system components from unauthorized physical access.','The organization conducting the inspection/assessment performs a sample inspection of the lockable physical casings.  The objective of the reviews is to validate the organization is using lockable physical casings to protect organization-defined information system components from unauthorized physical access.'),\n('000932','draft','2009-09-21','DISA FSO','policy','The organization defines information system components to be protected from unauthorized physical access using lockable physical casings.','PE-3(4).2','The organization being inspected/assessed defines and documents information system components to be protected from unauthorized physical access using lockable physical casings.\\n\\nDoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines  information system components to be protected from unauthorized physical access using lockable physical casings.\\n\\nDoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('000933','draft','2009-09-21','DISA FSO','policy','The organization employs organization-defined security safeguards to deter and/or prevent physical tampering or alteration of organization-defined hardware components within the information system.','PE-3(5).1','The organization being inspected/assessed employs security safeguards defined in PE-3 (5), CCI 2928 to deter and or prevent physical tampering or alteration of hardware components defined in PE-3 (5), CCI 2929 within the information system.','The organization conducting the inspection/assessment inspects the information system to ensure the organization being inspected/assessed  employs security safeguards defined in PE-3 (5), CCI 2928 to deter and or prevent physical tampering or alteration of hardware components defined in PE-3 (5), CCI 2929 within the information system.'),\n('000934','draft','2009-09-21','DISA FSO','policy','The organization employs a penetration testing process that includes unannounced attempts to bypass or circumvent security controls associated with physical access points to the facility on an organization-defined frequency.','PE-3(6).1','The organization being inspected/assessed executes a penetration testing process annually, that includes unannounced attempts, as defined in its physical security assessment plan for testing effectiveness of security controls in place for physical access points to the facility.  Results of all penetration testing will be documented as an audit trail.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines the inspected organization\\'s physical security assessment plan and reviews documented results to ensure annual penetration testing of physical access points occurred.  DoD has defined the frequency as annually.'),\n('000935','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency of unannounced attempts to be included in a penetration testing process to bypass or circumvent security controls associated with physical access points to the facility.','PE-3(6).2','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as annually.'),\n('000936','draft','2009-09-21','DISA FSO','policy','The organization controls physical access to organization-defined information system distribution and transmission lines within organizational facilities using organization-defined security safeguards.','PE-4.1','The organization being inspected/assessed  controls physical access to information system distribution and transmission lines defined in PE-4, CCI 2930 within organizational facilities using security safeguards defined in PE-4, CCI 2931.','The organization conducting the inspection/assessment inspects the information system distribution and transmission lines defined in PE-4, CCI 2930 to ensure the security safeguards defined in PE-4, CCI 2931 are in place.'),\n('000937','draft','2009-09-21','DISA FSO','policy','The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.','PE-5.1','The organization being inspected/assessed will identify, document, and execute any additional access controls required for output devices above and beyond physical access controls already in place for the facility IAW DoD 5200.08-R and DoD 5200.01-M (Volumes 1-4).','The organization conducting the inspection/assessment obtains and examines the list of additional access controls for output devices.  Physical inspection is required to ensure these access controls are properly implemented.'),\n('000938','draft','2009-09-21','DISA FSO','policy','The organization monitors physical access to the information system to detect and respond to physical security incidents.',NULL,NULL,NULL),\n('000939','draft','2009-09-21','DISA FSO','policy','The organization reviews physical access logs in accordance with organization-defined frequency.','PE-6.4','The organization being inspected/assessed will review physical access logs every 30 days.  The organization must document each occurrence the physical access log review, with results of any necessary incident analysis and action taken, as an audit trail for future reference.  DoD has defined the frequency as every 30 days.','The organization conducting the inspection/assessment obtains and examines the inspected organization\\'s physical access logs or records; physical access incident reports; and any other relevant documents or records.  The purpose of the reviews is to determine if the organization is conducting reviews of the physical access logs every 30 days.  DoD has defined the frequency as every 30 days.'),\n('000940','draft','2009-09-21','DISA FSO','policy','The organization defines a frequency for reviewing physical access logs.','PE-6.5','DoD has defined the frequency as every 30 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as every 30 days.'),\n('000941','draft','2009-09-21','DISA FSO','policy','The organization coordinates results of reviews and investigations with the organization^s incident response capability.','PE-6.6','The organization being inspected/assessed will coordinate the results of reviews and investigations of physical security incidents with the organization\\'s incident response capability (for physical security incidents).','The organization conducting the inspection/assessment obtains and examines documentation of physical security incidents to ensure coordination  with the inspected organization\\'s incident response capability occurred.'),\n('000942','draft','2009-09-21','DISA FSO','policy','The organization monitors physical intrusion alarms and surveillance equipment.','PE-6(1).1','The organization being inspected/assessed will actively monitor physical intrusion alarms and surveillance equipment.','The organization conducting the inspection/assessment will observe and interview security personnel conducting monitoring activities to validate the organization is actively monitoring all physical intrusion alarms and surveillance equipment.'),\n('000943','draft','2009-09-21','DISA FSO','policy','The organization employs automated mechanisms to recognize potential intrusions and initiate designated response actions.',NULL,NULL,NULL),\n('000944','draft','2009-09-21','DISA FSO','policy','The organization controls physical access to the information system by authenticating visitors before authorizing access to the facility where the information system resides other than areas designated as publicly accessible.',NULL,NULL,NULL),\n('000945','draft','2009-09-21','DISA FSO','policy','The organization escorts visitors and monitors visitor activity, when required.',NULL,NULL,NULL),\n('000946','draft','2009-09-21','DISA FSO','policy','The organization requires two forms of identification for visitor access to the facility.',NULL,NULL,NULL),\n('000947','draft','2009-09-21','DISA FSO','policy','The organization maintains visitor access records to the facility where the information system resides for an organization-defined time period.','PE-8.1','The organization being inspected/assessed must maintain visitor access records for their facilities for at least one year.  DoD has defined the time period as at least one year.','The organization conducting the inspection/assessment obtains and examines visitor access records to determine if the organization is maintaining visitor access records to the facility where the information system resides for at least one year.  DoD has defined the time period as at least one year.'),\n('000948','draft','2009-09-21','DISA FSO','policy','The organization reviews visitor access records in accordance with organization-defined frequency.','PE-8.3','The organization being inspected/assessed conducts reviews of visitor access records every 30 days and must establish and maintain a documented audit trail within the authorization lifecycle.  DoD has defined the frequency as every 30 days.','The organization conducting the inspection/assessment obtains and examines the audit documentation of visitor access record review to ensure the inspected organization is conducting reviews every 30 days.   DoD has defined the frequency as every 30 days.'),\n('000949','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency with which to review the visitor access records for the facility where the information system resides.','PE-8.4','DoD has defined the frequency as every 30 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as every 30 days.'),\n('000950','draft','2009-09-21','DISA FSO','policy','The organization employs automated mechanisms to facilitate the maintenance and review of access records.','PE-8(1).1','The organization being inspected/assessed will identify, document, and employ automated mechanisms to facilitate the maintenance and review of access records.','The organization conducting the inspection/assessment:\\n1. obtains documentation identifying the automated mechanism in use by the inspected organization to facilitate the maintenance and review of access records\\n2. Observes the use of the automated mechanism by the inspected organization'),\n('000951','draft','2009-09-21','DISA FSO','policy','The organization maintains a record of all physical access, both visitor and authorized individuals.',NULL,NULL,NULL),\n('000952','draft','2009-09-21','DISA FSO','policy','The organization protects power equipment and power cabling for the information system from damage and destruction.','PE-9.1','The organization being inspected/assessed provides a list of protective measures in place to prevent damage and/or destruction of power equipment and power cabling for their information system environment, IAW CP-2 (1), CCI 469.','The organization conducting the inspection/assessment obtains and examines the list of protective measures.  Physical inspection of power equipment and power cabling will be done to ensure identified protective measures are in place.'),\n('000953','draft','2009-09-21','DISA FSO','policy','The organization employs redundant and parallel power cabling paths.',NULL,NULL,NULL),\n('000954','draft','2009-09-21','DISA FSO','policy','The organization employs automatic voltage controls for organization-defined critical information system components.','PE-9(2).1','The organization being inspected/assessed  employs automatic voltage controls for all IT Components Critical to Execution of Missions.   Automatic voltage controls are devices intended to eliminate voltage fluctuations (e.g., spikes).  This controls apply to voltage controls for mission critical IT Components and not for facilities.  DoD has defined the list of critical information system components as all IT Components Critical to Execution of Missions.','The organization conducting the inspection/assessment obtains the documentation of the all mission critical IT Components required to have automatic voltage controls mechanisms devices in place (IAW PE-9 (2), CCI 955) and does a visual inspection of at least a sample of the above list to ensure automatic voltage control mechanisms are in place.  DoD has defined the list of critical information system components as all IT Components Critical to Execution of Missions.'),\n('000955','draft','2009-09-21','DISA FSO','policy','The organization defines critical information system components that require automatic voltage controls.','PE-9(2).2','The organization being inspected/assessed must document all IT Components Critical to Execution of Missions.  DoD has defined the list of critical information system components as all IT Components Critical to Execution of Missions.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the list of critical information system components as all IT Components Critical to Execution of Missions.'),\n('000956','draft','2009-09-21','DISA FSO','policy','The organization provides the capability of shutting off power to the information system or individual system components in emergency situations.','PE-10.1','This control does not apply to individual workstations, laptops, printers, etc.  This control only applies to facilities containing concentrations of information system resources (e.g., datacenters, server rooms, mainframe computer rooms).  The organization being inspected/assessed will establish and document the capability to shut off the power to facilities or areas within facilities containing concentrations of information system resources (e.g., datacenters, server rooms, mainframe computer rooms) in emergency situations.','The organization conducting the inspection/assessment obtains and examines documentation of the capability to shut off the power to facilities or areas within facilities containing concentrations of information system resources (e.g., datacenters, server rooms, mainframe computer rooms) in emergency situations.  The purpose is to validate the organization has provided the capability of shutting off power in emergency situations.'),\n('000957','draft','2009-09-21','DISA FSO','policy','The organization places emergency shutoff switches or devices in an organization-defined location by information system or system component to facilitate safe and easy access for personnel.','PE-10.2','This control does not apply to individual workstations, laptops, printers, etc.  This control only applies to facilities containing concentrations of information system resources (e.g., datacenters, server rooms, mainframe computer rooms).  The organization being inspected/assessed places emergency shutoff switches or devices near more than one egress point of the IT area and ensure it is labeled and protected by a cover to prevent accidental shut-off to facilitate safe and easy access for personnel.  DoD has defined the location as near more than one egress point of the IT area and ensure it is labeled and protected by a cover to prevent accidental shut-off.','The organization conducting the inspection/assessment will physically inspect emergency shutoff switches or devices for placement to validate the organization has installed the emergency shutoff switches or devices near more than one egress point of the IT area and ensure it is labeled and protected by a cover to prevent accidental shut-off to facilitate safe and easy access for personnel.  DoD has defined the location as near more than one egress point of the IT area and ensure it is labeled and protected by a cover to prevent accidental shut-off.'),\n('000958','draft','2009-09-21','DISA FSO','policy','The organization defines a location for emergency shutoff switches or devices by information system or system component.','PE-10.3','DoD has defined the location as near more than one egress point of the IT area and ensures it is labeled and protected by a cover to prevent accidental shut-off.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the location as near more than one egress point of the IT area and ensures it is labeled and protected by a cover to prevent accidental shut-off.'),\n('000959','draft','2009-09-21','DISA FSO','policy','The organization protects emergency power shutoff capability from unauthorized activation.','PE-10.4','The organization being inspected/assessed will protect emergency power shutoff capability.   DoD has defined the location as near more than one egress point of the IT area and ensures it is labeled and protected by a cover to prevent accidental shut-off.','The organization conducting the inspection/assessment will ensure that the inspected organization has protected emergency power shutoff capability.  DoD has defined the location as near more than one egress point of the IT area and ensures it is labeled and protected by a cover to prevent accidental shut-off.'),\n('000960','draft','2009-09-21','DISA FSO','policy','The organization provides a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system in the event of a primary power source loss.',NULL,NULL,NULL),\n('000961','draft','2009-09-21','DISA FSO','policy','The organization provides a long-term alternate power supply for the information system that is capable of maintaining minimally required operational capability in the event of an extended loss of the primary power source.','PE-11(1).1','The organization being inspected/assessed will:\\n1. implement alternate power supply capable of supporting minimal operational capability over the long term.\\n2. Provide a list of physical IT assets within the boundary of the information system that require a long term alternate power supply.  This list may come from the inspected organization\\'s security plan, continuity plan, or other documentation.','The organization conducting the inspection/assessment obtains and examines the list of physical IT assets within the boundary of the information system that require a long term alternate power supply.  Physically inspect a sample from the list to ensure that long term power supply capability  supporting minimal operational capability has been provided.'),\n('000962','draft','2009-09-21','DISA FSO','policy','The organization provides a long-term alternate power supply for the information system that is self-contained and not reliant on external power generation.',NULL,NULL,NULL),\n('000963','draft','2009-09-21','DISA FSO','policy','The organization employs and maintains automatic emergency lighting for the information system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.','PE-12.1','The organization being inspected/assessed must install and maintain automatic emergency lighting for the information system that activates in the event of a power outage or disruption and covers emergency exits and evacuation routes within the facility in compliance with established OSHA requirements.','The organization conducting the inspection/assessment conducts visual inspections and interviews physical security personnel to validate the organization is in compliance with established OSHA requirements by employing and maintaining emergency lighting for the information system, the emergency lighting activates in the event of a power outage or disruption, and it covers emergency exits and evacuation routes within the facility'),\n('000964','draft','2009-09-21','DISA FSO','policy','The organization provides emergency lighting for all areas within the facility supporting essential missions and business functions.',NULL,NULL,NULL),\n('000965','draft','2009-09-21','DISA FSO','policy','The organization employs and maintains fire suppression and detection devices/systems for the information system that are supported by an independent energy source.','PE-13.1','The organization being inspected/assessed must implement and maintain fire suppression and detection devices/systems for the information system that are supported by an independent energy source.  An independent energy source is some source other than the primary energy source for that facility.  Examples include sprinkler systems, hand held fire extinguishers, fixed fire hoses, and smoke detectors.','The organization conducting the inspection/assessment will conduct visual observation and interview organizational personnel with responsibilities for fire detection and suppression devices/systems. The purpose of the reviews and interviews is to validate the fire suppression and detection devices/systems for the information system are supported by an independent energy source.'),\n('000966','draft','2009-09-21','DISA FSO','policy','The organization employs fire detection devices/systems for the information system that activate automatically and notify the organization and emergency responders in the event of a fire.',NULL,NULL,NULL),\n('000967','draft','2009-09-21','DISA FSO','policy','The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation to the organization and emergency responders.',NULL,NULL,NULL),\n('000968','draft','2009-09-21','DISA FSO','policy','The organization employs an automatic fire suppression capability for the information system when the facility is not staffed on a continuous basis.','PE-13(3).1','The organization being inspected/assessed must implement and maintain an automatic fire suppression capability that is fully operational when the facility is not staffed on a continuous basis.','The organization conducting the inspection/assessment conducts visual inspections and interviews physical security/safety personnel to validate the organization has installed and implemented an automatic fire suppression capability which is operational during those times the facility is not staffed.'),\n('000969','draft','2009-09-21','DISA FSO','policy','The organization ensures that the facility undergoes, on an organization-defined frequency, fire marshal inspections and promptly resolves identified deficiencies.',NULL,NULL,NULL),\n('000970','draft','2009-09-21','DISA FSO','policy','The organization defines a frequency for fire marshal inspections.',NULL,NULL,NULL),\n('000971','draft','2009-09-21','DISA FSO','policy','The organization maintains temperature and humidity levels within the facility where the information system resides at organization-defined acceptable levels.','PE-14.1','Humidity controls are not required for general office areas where information system components may be in use and are only required where there are concentrations of information systems such as server farms, mainframes, etc.  The organization being inspected/assessed must maintain temperature and where applicable humidity levels of for commercial grade information systems: 64.4  80.6 degrees F;  45%  60% Relative Humidity;  Dew Point 41.9   59F; measured at the air intake inlet of the IT equipment casing; for other systems, levels within manufacturer specifications.  DoD has defined the acceptable levels as for commercial grade information systems: 64.4  80.6 degrees F;  45%  60% Relative Humidity;  Dew Point 41.9   59F; measured at the air intake inlet of the IT equipment casing; for other systems, levels within manufacturer specifications.','The organization conducting the inspection/assessment reviews temperature and humidity controls to validate that they are set within DoD specified guidelines.  DoD has defined the acceptable levels as for commercial grade information systems: 64.4  80.6 degrees F;  45%  60% Relative Humidity;  Dew Point 41.9   59F; measured at the air intake inlet of the IT equipment casing; for other systems, levels within manufacturer specifications.'),\n('000972','draft','2009-09-21','DISA FSO','policy','The organization defines acceptable temperature and humidity levels to be maintained within the facility where the information system resides.','PE-14.2','DoD has defined the acceptable levels as for commercial grade information systems: 64.4  80.6 degrees F;  45%  60% Relative Humidity;  Dew Point 41.9   59F; measured at the air intake inlet of the IT equipment casing; for other systems, levels within manufacturer specifications.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the acceptable levels as for commercial grade information systems: 64.4  80.6 degrees F;  45%  60% Relative Humidity;  Dew Point 41.9   59F; measured at the air intake inlet of the IT equipment casing; for other systems, levels within manufacturer specifications.'),\n('000973','draft','2009-09-21','DISA FSO','policy','The organization monitors temperature and humidity levels in accordance with organization-defined frequency.','PE-14.3','The organization being inspected/assessed will maintain an independent monitor device for temperature and humidity levels not located in the immediate vicinity of the controller continuously unless manufacturer specifications allow for a wide enough tolerance that control is not required.  Records of monitoring must be maintained as an audit trail within the authorization lifecycle.  DoD has defined the frequency as continuously unless manufacturer specifications allow for a wide enough tolerance that control is not required.','The organization conducting the inspection/assessment will visually observe the inspected organization\\'s independent monitoring device, obtain and examine audit logs, and interview physical security/safety personnel to validate the inspected organization monitors temperature and humidity levels continuously unless manufacturer specifications allow for a wide enough tolerance that control is not required.  DoD has defined the frequency as continuously unless manufacturer specifications allow for a wide enough tolerance that control is not required.'),\n('000974','draft','2009-09-21','DISA FSO','policy','The organization defines a frequency for monitoring temperature and humidity levels.','PE-14.4','DoD has defined the frequency as  continuously unless manufacturer specifications allow for a wide enough tolerance that control is not required.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as continuously unless manufacturer specifications allow for a wide enough tolerance that control is not required.'),\n('000975','draft','2009-09-21','DISA FSO','policy','The organization employs automatic temperature and humidity controls in the facility to prevent fluctuations potentially harmful to the information system.','PE-14(1).1','Humidity controls are not required for general office areas where information system components may be in use and are only required where there are concentrations of information systems such as server farms, mainframes, etc.  The organization being inspected/assessed must implement and maintain automatic temperature and humidity controls in the facility designed to prevent temperature and humidity fluctuations that would be potentially harmful to the information system.','The organization conducting the inspection/assessment conducts visual inspections and interviews personnel responsible for maintaining automatic temperature and humidity controls to validate the organization is employing automatic temperature and humidity  controls for the information system to prevent fluctuations potentially harmful to the information system.'),\n('000976','draft','2009-09-21','DISA FSO','policy','The organization employs temperature and humidity monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment.','PE-14(2).1','Humidity controls are not required for general office areas where information system components may be in use and are only required where there are concentrations of information systems such as server farms, mainframes, etc.  The organization being inspected/assessed must implement and maintain automatic temperature and humidity controls in the facility and provides an alarm or notification of changes to either of these environmental conditions that are potentially harmful to personnel or equipment.','The organization conducting the inspection/assessment conducts visual inspections and interviews personnel responsible for maintaining automatic temperature and humidity controls to validate the inspected organization is employing automatic temperature and humidity  controls that provide an alarm or notification of changes potentially harmful to personnel or equipment.'),\n('000977','draft','2009-09-21','DISA FSO','policy','The organization protects the information system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible.','PE-15.1','The organization being inspected/assessed must provide master shutoff valves that are accessible to protect the information system from damage resulting from water leakage.','The organization conducting the inspection/assessment will inspect the master shutoff valves to ensure they are installed and accessible.'),\n('000978','draft','2009-09-21','DISA FSO','policy','The organization protects the information system from damage resulting from water leakage by providing master shutoff or isolation valves that are working properly.','PE-15.2','The organization being inspected/assessed will ensure that master shutoff valves are working properly and have been inspected by the appropriate organization (e.g., fire marshal, department of public works).','The organization conducting the inspection/assessment will visually inspect master shutoff valve inspection documentation (e.g., inspection form, tag attached to valve).'),\n('000979','draft','2009-09-21','DISA FSO','policy','Key personnel have knowledge of the master water shutoff or isolation valves.','PE-15.3','The organization being inspected/assessed  will identify and document key personnel and will provide training on the location and procedures for use of master shutoff valves.','The organization conducting the inspection/assessment obtains and examines list of key personnel with knowledge of location and activation procedures for master shutoff valves and any other relevant documents or records.  Interview key personnel from the list to determine if identified key personnel within the organization have knowledge of the master shutoff valves.'),\n('000980','draft','2009-09-21','DISA FSO','policy','The organization employs mechanisms that, without the need for manual intervention, protect the information system from water damage in the event of a water leak.',NULL,NULL,NULL),\n('000981','draft','2009-09-21','DISA FSO','policy','The organization authorizes organization-defined types of information system components entering and exiting the facility.','PE-16.1','The organization being inspected/assessed authorizes and maintains authorization records of all system components entering and exiting the facility.  DoD has defined the types of information system components as all system components.','The organization conducting the inspection/assessment obtains and examines records authorizing all system components entering and exiting the facility.  DoD has defined the types of information system components as all system components.'),\n('000982','draft','2009-09-21','DISA FSO','policy','The organization monitors organization-defined types of information system components entering and exiting the facility.','PE-16.2','The organization being inspected/assessed  monitors all system components entering and exiting the facility.  DoD has defined the types of information system components as all system components.','The organization conducting the inspection/assessment obtains and examines records monitoring all system components entering and exiting the facility.  DoD has defined the types of information system components as all system components.'),\n('000983','draft','2009-09-21','DISA FSO','policy','The organization controls organization-defined types of information system components entering and exiting the facility.','PE-16.3','The organization being inspected/assessed:\\n1. Documents in their physical and environmental protection plan (PE-1) controls for all system components entering and exiting the facility.\\n2. Implements documented controls for system components entering and exiting the facility.   DoD has defined the types of information system components as all system components.','The organization conducting the inspection/assessment obtains and examines the physical and environmental protection plan to determine if controls have been documented for all system components entering and exiting the facility and visually inspects the controls (e.g., logs, scans, etc.) to ensure implementation.  DoD has defined the types of information system components as all system components.'),\n('000984','draft','2009-09-21','DISA FSO','policy','The organization maintains records of information system components entering and exiting the facility.','PE-16.4','The organization being inspected/assessed will maintain records of all information system components entering and exiting the facility.  If the organization is following General Records Schedule (GRS) 18, Section 12 they are automatically compliant.','The organization conducting the inspection/assessment obtains and examines records of physical entry and exit events to the facility.  The purpose of the reviews is to ensure the organization is maintaining detailed and accurate records of information system components that enter and exit the facility.  If the organization is following GRS 18, Section 12 they are automatically compliant.'),\n('000985','draft','2009-09-21','DISA FSO','policy','The organization employs organization-defined security controls at alternate work sites.','PE-17.1','The organization being inspected/assessed  implements security controls defined in PE-17, CCI 2975 at alternate work sites.  Alternate work sites are further defined in the definitions associated with this implementation guide.  Organizational telework policies should be used to address alternate work sites that are private residences.  Comment: For classified information see DoD 5200.01  Vol 3 Manual','The organization conducting the inspection/assessment obtains and examines the alternate work site policy of the organization being inspected/assessed to ensure the organization implements security controls defined in PE-17, CCI 2975 at alternate work sites.'),\n('000986','draft','2009-09-21','DISA FSO','policy','The organization defines management, operational, and technical information system security controls to be employed at alternate work sites.',NULL,NULL,NULL),\n('000987','draft','2009-09-21','DISA FSO','policy','The organization assesses as feasible, the effectiveness of security controls at alternate work sites.','PE-17.3','The organization being inspected/assessed  must implement procedures to assess, when feasible, the effectiveness of the documented alternate work site security controls.  The organization must document results of conducted assessments as part of an audit trail.   Alternate work sites are further defined in the definitions associated with this implementation guide.','The organization conducting the inspection/assessment obtains and examines:\\n1. The procedures for assessing the effectiveness of alternate work site security controls.\\n2. The audit records of assessments they have conducted of security controls effectiveness for alternate work sites.'),\n('000988','draft','2009-09-21','DISA FSO','policy','The organization provides a means for employees to communicate with information security personnel in case of security incidents or problems.','PE-17.4','The organization being inspected/assessed must disseminate current contact information for appropriate security personnel to all employees; for example, telephone or e-mail.','The organization conducting the inspection/assessment obtains and examines contact information for appropriate security personnel to ensure its accuracy and dissemination.'),\n('000989','draft','2009-09-21','DISA FSO','policy','The organization positions information system components within the facility to minimize potential damage from organization-defined physical and environmental hazards.','PE-18.1','The organization being inspected/assessed  positions information system components within the facility to minimize potential damage from physical and environmental hazards defined in PE-18, CCI 2976 specific to the location of the information system as documented in PE-1, CCI 000904.','The organization conducting the inspection/assessment reviews the physical and environmental protection policy developed in PE-1, CCI 000904 to validate that the systems have been positioned according to the environmental policy.'),\n('000990','draft','2009-09-21','DISA FSO','policy','The organization positions information system components within the facility to minimize potential damage from environmental hazards.',NULL,NULL,NULL),\n('000991','draft','2009-09-21','DISA FSO','policy','The organization positions information system components within the facility to minimize the opportunity for unauthorized access.','PE-18.2','The organization being inspected/assessed  positions information system components within the facility to minimize the opportunity for unauthorized access specific to the location of the information system as documented in PE-1, CCI 00904.','The organization conducting the inspection/assessment reviews the physical and environmental protection policy developed in PE-1, CCI 000904 to validate that the systems have been positioned according to the environmental policy.'),\n('000992','draft','2009-09-21','DISA FSO','policy','The organization plans the location or site of the facility where the information system resides with regard to physical and environmental hazards, and for existing facilities, considers the physical and environmental hazards in its risk mitigation strategy.',NULL,NULL,NULL),\n('000993','draft','2009-09-21','DISA FSO','policy','The organization protects the information system from information leakage due to electromagnetic signals emanations.','PE-19.1','The organization being inspected/assessed will obtain a TEMPEST countermeasure review and implement the required countermeasures in order to protect  the information system from information leakage due to electromagnetic signals emanations.','The organization conducting the inspection/assessment obtains and examines the TEMPEST countermeasures review and inspects the information system to ensure those countermeasures have been implemented.'),\n('000994','draft','2009-09-21','DISA FSO','policy','The organization ensures that information system components, associated data communications, and networks are protected in accordance with national emissions and TEMPEST policies and procedures based on the security category or classification of the information.','PE-19(1).1','The organization being inspected/assessed will obtain a TEMPEST countermeasure review and implement the required countermeasures in order to protect  the information system from information leakage due to electromagnetic signals emanations.','The organization conducting the inspection/assessment obtains and examines the TEMPEST countermeasures review and inspects the information system to ensure those countermeasures have been implemented.'),\n('000995','draft','2009-09-21','DISA FSO','policy','The organization develops and documents a media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','MP-1.1','DoDI 5200.01 and DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4.','DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4  meet the DoD requirements for media protection policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4.'),\n('000996','draft','2009-09-21','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles a media protection policy.','MP-1.2','DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures and is disseminated to all users via http://www.dtic.mil/whs/directives/corres/ins1.html.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4.','DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4  meet the DoD requirements for media protection policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and DoDM 5200.01 Vol. 1-4.'),\n('000997','draft','2009-09-21','DISA FSO','policy','The organization reviews and updates the current media protection policy in accordance with organization-defined frequency.','MP-1.6','DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4.','DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4.'),\n('000998','draft','2009-09-21','DISA FSO','policy','The organization defines a frequency for reviewing and updating the current media protection policy.','MP-1.7','DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.'),\n('000999','draft','2009-09-21','DISA FSO','policy','The organization develops and documents procedures to facilitate the implementation of the media protection policy and associated media protection controls.','MP-1.4','DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4.','DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and DoDM 5200.01 Vol. 1-4.'),\n('001000','draft','2009-09-21','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the media protection policy and associated media protection controls.','MP-1.5','DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures and is disseminated to all users via http://www.dtic.mil/whs/directives/corres/ins1.html.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4.','DoDI 5200.01 and DoDM 5200.01 Vol. 1-4  meet the DoD requirements for media protection policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4.'),\n('001001','draft','2009-09-21','DISA FSO','policy','The organization reviews and updates the current media protection procedures in accordance with organization-defined frequency.','MP-1.8','DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4.','DoDI 5200.01 and DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and  DoDM 5200.01 Vol. 1-4.'),\n('001002','draft','2009-09-21','DISA FSO','policy','The organization defines a frequency for reviewing and updating the current media protection procedures.','MP-1.9','DoD has defined the frequency as reviewed annually as appropriate.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually as appropriate.'),\n('001003','draft','2009-09-21','DISA FSO','policy','The organization restricts access to organization-defined types of digital and/or non-digital media to organization-defined personnel or roles.','MP-2.1','The organization being inspected/assessed restricts access to all types of digital and/or non-digital media containing information not cleared for public release to the personnel or roles defined in MP-2, CCI 1005.  DoD has defined the types of digital and non-digital media as  all types of digital and/or non-digital media containing information not cleared for public release.','The organization conducting the inspection/assessment interviews organizational personnel with information system media protection responsibilities to ensure the organization being inspected/assessed restricts access to all types of digital and/or non-digital media containing information not cleared for public release to the personnel or roles defined in MP-2, CCI 1005.  DoD has defined the types of digital and non-digital media as  all types of digital and/or non-digital media containing information not cleared for public release.  '),\n('001004','draft','2009-09-21','DISA FSO','policy','The organization defines types of digital and/or non-digital media for which the organization restricts access.','MP-2.2','DoD has defined the types of digital and non-digital media as  all types of digital and/or non-digital media containing information not cleared for public release.  ','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the types of digital and non-digital media as  all types of digital and/or non-digital media containing information not cleared for public release.   '),\n('001005','draft','2009-09-21','DISA FSO','policy','The organization defines personnel or roles from which to restrict access to organization-defined types of digital and/or non-digital media.','MP-2.3','The organization being inspected/assessed will define and document personnel or roles to restrict access to media IAW DoD 5200.01-M, CTO 10-133, and CTO 08-001.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level, but personnel must be identified IAW DoD 5200.01-M, CTO 10-133, and CTO 08-001.','The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to restrict access to media to ensure the access is granted IAW DoD 5200.01-M, CTO 10-133, and CTO 08-001.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level, but personnel must be identified IAW DoD 5200.01-M, CTO 10-133, and CTO 08-001.'),\n('001006','draft','2009-09-21','DISA FSO','policy','The organization defines security measures for restricting access to media.',NULL,NULL,NULL),\n('001007','draft','2009-09-21','DISA FSO','policy','The organization employs automated mechanisms to restrict access to media storage areas.','MP-4(2).1','The organization being inspected/assessed implements automated mechanisms to restrict access to media storage areas.','The organization conducting the inspection/assessment examines the information system\\'s environment to ensure the organization being inspected/assessed implements automated mechanisms to restrict access to media storage areas.'),\n('001008','draft','2009-09-21','DISA FSO','policy','The organization employs automated mechanisms to audit access attempts and access granted to media storage areas.','MP-4(2).2','The organization being inspected/assessed implements automated mechanisms to audit access attempts and access granted to media storage areas.','The organization conducting the inspection/assessment examines the information system\\'s environment to ensure the organization being inspected/assessed implements automated mechanisms to audit access attempts and access granted to media storage areas.'),\n('001009','draft','2009-09-21','DISA FSO','technical','The information system uses cryptographic mechanisms to protect and restrict access to information on portable digital media.',NULL,NULL,NULL),\n('001010','draft','2009-09-21','DISA FSO','policy','The organization marks information system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information.','MP-3.1','The organization being inspected/assessed marks information system media and information system output IAW DoDM 5200.01 Vol. 1-4.','The organization conducting the inspection/assessment obtains a sampling of  information system media and information system output to verify that it is marked in compliance with DoDM 5200.01 Vol. 1-4.'),\n('001011','draft','2009-09-21','DISA FSO','policy','The organization exempts organization-defined types of information system media from marking as long as the media remain within organization-defined controlled areas.','MP-3.2','All information system media must be marked in all areas IAW DoDM 5200.01 Vol. 1-4.','The organization conducting the inspection/assessment examines information system media to ensure it is marked IAW DoDM 5200.01 Vol. 1-4.'),\n('001012','draft','2009-09-21','DISA FSO','policy','The organization defines types of information system media to exempt from marking as long as the media remain within organization-defined controlled areas.','MP-3.3','DoD has defined the list of information system media as nothing unless otherwise exempted by DoDI 5200.01 and DoDM 5200.01 Vol 1-4.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the list of information system media as nothing unless otherwise exempted by DoDI 5200.01 and DoDM 5200.01 Vol 1-4'),\n('001013','draft','2009-09-21','DISA FSO','policy','The organization defines controlled areas where organization-defined types of information system media are exempt from being marked.','MP-3.4','DoD has defined the controlled areas as all areas unless otherwise exempted by DoDI 5200.01 and DoDM 5200.01 Vol 1-4','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the controlled areas as  all areas unless otherwise exempted by DoDI 5200.01 and DoDM 5200.01 Vol 1-4'),\n('001014','draft','2009-09-21','DISA FSO','policy','The organization physically controls and securely stores organization-defined types of digital and/or non-digital media within organization-defined controlled areas.','MP-4.1','The organization being inspected/assessed physically controls and securely stores all digital and non-digital media containing sensitive, controlled, and/or classified information within areas approved for processing or storing data IAW the sensitivity and/or classification level of the information contained on/within the media.  DoD has defined the digital and non-digital media types as all digital and non-digital media containing sensitive, controlled, and/or classified information.  DoD has defined the controlled areas as areas approved for processing or storing data IAW the sensitivity and/or classification level of the information contained on/within the media.','The organization conducting the inspection/assessment obtains and examines the list of all digital and non-digital media containing sensitive, controlled, and/or classified information within areas approved for processing or storing data IAW the sensitivity and/or classification level of the information contained on/within the media to ensure that physical controls are in place and that it is securely stored as defined in PE-3.  DoD has defined the digital and non-digital media types as all digital and non-digital media containing sensitive, controlled, and/or classified information.  DoD has defined the controlled areas as areas approved for processing or storing data IAW the sensitivity and/or classification level of the information contained on/within the media.'),\n('001015','draft','2009-09-21','DISA FSO','policy','The organization defines types of digital and/or non-digital media to physically control and securely store within organization-defined controlled areas.','MP-4.2','DoD has defined the digital and non-digital media types as all digital and non-digital media containing sensitive, controlled, and/or classified information.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the digital and non-digital media types as all digital and non-digital media containing sensitive, controlled, and/or classified information.'),\n('001016','draft','2009-09-21','DISA FSO','policy','The organization defines controlled areas where organization-defined types of digital and/or non-digital media are physically controlled and securely stored.','MP-4.3','DoD has defined the controlled areas as areas approved for processing or storing data IAW the sensitivity and/or classification level of the information contained on/within the media.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the controlled areas as areas approved for processing or storing data IAW the sensitivity and/or classification level of the information contained on/within the media.'),\n('001017','draft','2009-09-21','DISA FSO','policy','The organization defines security measures for securing media storage.',NULL,NULL,NULL),\n('001018','draft','2009-09-21','DISA FSO','policy','The organization protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.','MP-4.4','The organization being inspected/assessed protects information system media IAW DoDM 5200.01 M Vol. 1-4.','The organization conducting the inspection/assessment obtains and examines the list of media and verifies it is being stored and protected IAW DoDM 5200.01 M Vol. 1-4.'),\n('001019','draft','2009-09-21','DISA FSO','technical','The organization employs cryptographic mechanisms to protect information in storage.',NULL,NULL,NULL),\n('001020','draft','2009-09-21','DISA FSO','policy','The organization protects and controls organization-defined types of information system media during transport outside of controlled areas using organization-defined security safeguards.','MP-5.1','The organization being inspected/assessed protects and controls information system media during transport outside of controlled areas using security measures defined in DoDM 5200.01 M Vol. 1-4 and DoDD 5015.2.','The organization conducting the inspection/assessment obtains and examines the organization\\'s records management policy or process to ensure appropriate protection of information according to its classification or designation during transport outside of controlled areas, IAW security measures defined in DoDM 5200.01 M Vol. 1-4 and DoDD 5015.2.'),\n('001021','draft','2009-09-21','DISA FSO','policy','The organization defines types of information system media protected and controlled during transport outside of controlled areas.','MP-5.2','DoD has defined the types of information system media as all digital and non-digital media containing sensitive, controlled, and/or classified information.','DoD has defined the types of information system media as all digital and non-digital media containing sensitive, controlled, and/or classified information.  The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.'),\n('001022','draft','2009-09-21','DISA FSO','policy','The organization defines security safeguards to be used to protect and control organization-defined types of information system media during transport outside of controlled areas.','MP-5.3','DoD has defined the security safeguards as DoDI 5200.1R and other organizationally defined security safeguards.','DoD has defined the security safeguards as DoDI 5200.1R and other organizationally defined security safeguards.  The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.'),\n('001023','draft','2009-09-21','DISA FSO','policy','The organization maintains accountability for information system media during transport outside of controlled areas.','MP-5.4','The organization being inspected/assessed ensures the organization defined security measures (MP-2) includes method of accountability for information system media during transport outside of controlled areas, IAW DoDM 5200.01 M Vol. 1-4 and DoDD 5015.2.','The organization conducting the inspection/assessment obtains and examines the list of organization defined security measures (MP-2) to ensure method of accountability for information system media during transport outside of controlled areas has been identified.'),\n('001024','draft','2009-09-21','DISA FSO','policy','The organization restricts the activities associated with the transport of information system media to authorized personnel.','MP-5.6','The organization being inspected/assessed ensures the organization defined security measures (MP-2) includes a requirement to develop and maintain a list of personnel authorized to transport information system media outside of controlled areas, IAW DoDM 5200.01 M Vol. 1-4 and DoDD 5015.2.  Develop and maintain the list of personnel authorized to transport information system media outside of controlled areas.','The organization conducting the inspection/assessment obtains and examines the list of personnel authorized to transport information system media outside of  controlled areas.  Organizational personnel with information system media transport responsibilities and security management personnel are to be interviewed. The purpose of the reviews and reviews is to determine if the organization has established restrictions associated with the transport of information system media to authorized personnel only.'),\n('001025','draft','2009-09-21','DISA FSO','policy','The organization documents activities associated with the transport of information system media.','MP-5.5','The organization being inspected/assessed documents activities associated with the transport of information system media.','The organization conducting the inspection/assessment obtains and examines the documented activities to ensure the organization being inspected/assessed documents activities associated with the transport of information system media.'),\n('001026','draft','2009-09-21','DISA FSO','policy','The organization employs an identified custodian during transport of information system media outside of controlled areas.','MP-5(3).1','The organization being inspected/assessed identifies and documents a custodian that is at all times responsible for the transport of the all information system media, from pick-up to final delivery and receipt acknowledgement.','The organization conducting the inspection/assessment obtains and examines documentation identifying the custodian that is at all times responsible for the transport of the all information system media, from pick-up to final delivery and receipt acknowledgement.'),\n('001027','draft','2009-09-21','DISA FSO','policy','The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.','MP-5(4).1','The organization being inspected/assessed shall document within their Security Plan, and implement, FIPS 140-2 or other NSA approved cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.','The organization conducting the inspection/assessment obtains and examines the Security Plan to ensure the organization being inspected has identified FIPS 140-2 or other NSA approved cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.'),\n('001028','draft','2009-09-21','DISA FSO','policy','The organization sanitizes organization-defined information system media prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures in accordance with applicable federal and organizational standards and policies.','MP-6.1','The organization being inspected/assessed sanitizes all media prior to disposal, release out of organizational control, or release for reuse IAW DoDM 5200.01 Vol. 1-4 using techniques and procedures IAW NIST SP 800-88.  DoD has defined the sanitization techniques as techniques and procedures IAW NIST SP 800-88.  DoD has defined the information system media as all media.','The organization conducting the inspection/assessment obtains and examines media sanitization records, audit records, any other relevant documents or records, and sanitization tools to ensure sanitization is in compliance with DoDM 5200.01 Vol. 1-4 and uses techniques and procedures IAW NIST SP 800-88.  The objective of the review is to verify the organization is sanitizing its digital and non-digital information system media prior to disposal, release for reuse, or release out of the organizational control.  DoD has defined the sanitization techniques as techniques and procedures IAW NIST SP 800-88.  DoD has defined the information system media as all media.'),\n('001029','draft','2009-09-21','DISA FSO','policy','The organization tracks, documents, and verifies media sanitization and disposal actions.',NULL,NULL,NULL),\n('001030','draft','2009-09-21','DISA FSO','policy','The organization tests sanitization equipment and procedures in accordance with the organization-defined frequency to verify that the intended sanitization is being achieved.','MP-6(2).1','The organization being inspected/assessed shall document plans to implement their sanitization equipment and procedures every 180 days to verify correct performance.  DoD has defined the frequency as every 180 days.','The organization conducting the inspection/assessment obtains and examines documented test plans and evidence of past tests to ensure that tests are conducted every 180 days to verify correct performance of sanitization equipment and procedures.  DoD has defined the frequency as every 180 days.'),\n('001031','draft','2009-09-21','DISA FSO','policy','The organization defines a frequency for testing sanitization equipment and procedures to verify that the intended sanitization is being achieved.','MP-6(2).2','DoD has defined the frequency as every 180 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every 180 days.'),\n('001032','draft','2009-09-21','DISA FSO','policy','The organization applies nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the information system in accordance with organization-defined circumstances requiring sanitization of portable storage devices.','MP-6(3).1','The organization being inspected/assessed documents and implements plans to apply nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the information system when such devices are first purchased from the manufacturer or vendor prior to initial use, when being considered for reuse, or when the organization loses a positive chain of custody for the device. Media obtained from unknown sources shall not be sanitized and reused.  Portable storage devices include but are not limited to thumb drives, flash drives, and external storage devices.  DoD has defined the circumstances as when such devices are first purchased from the manufacturer or vendor prior to initial use, when being considered for reuse, or when the organization loses a positive chain of custody for the device. Media obtained from unknown sources shall not be sanitized and reused.','The organization conducting the inspection/assessment obtains and examines  media sanitization records, audit records, and any other relevant documents or records.   The objective of the reviews is to confirm the organization is in compliance with the list of defined circumstances requiring the sanitization of portable storage devices prior to connecting such devices to the information system.'),\n('001033','draft','2009-09-21','DISA FSO','policy','The organization defines circumstances requiring sanitization of portable storage devices prior to connecting such devices to the information system.','MP-6(3).2','DoD has defined the list circumstances as when such devices are first purchased from the manufacturer or vendor prior to initial use, when being considered for reuse, or when the organization loses a positive chain of custody for the device. Media obtained from unknown sources shall not be sanitized and reused.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the circumstances as when such devices are first purchased from the manufacturer or vendor prior to initial use, when being considered for reuse, or when the organization loses a positive chain of custody for the device. Media obtained from unknown sources shall not be sanitized and reused.'),\n('001034','draft','2009-09-21','DISA FSO','policy','The organization sanitizes information system media containing Controlled Unclassified Information (CUI) or other sensitive information in accordance with applicable organizational and/or federal standards and policies.',NULL,NULL,NULL),\n('001035','draft','2009-09-21','DISA FSO','policy','The organization sanitizes information system media containing classified information in accordance with NSA standards and policies.',NULL,NULL,NULL),\n('001036','draft','2009-09-21','DISA FSO','policy','The organization destroys information system media that cannot be sanitized.',NULL,NULL,NULL),\n('001037','draft','2009-09-21','DISA FSO','policy','The organization develops and documents a risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','RA-1.3','NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts  NIST SP 800-30 as the DoD risk assessment policy.','NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts  NIST SP 800-30 as the DoD risk assessment policy.'),\n('001038','draft','2009-09-21','DISA FSO','policy','The organization disseminates a risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to organization-defined personnel or roles.','RA-1.4','NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures and is disseminated via the NIST publications site: http://csrc.nist.gov/publications/PubsSPs.html\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts  NIST SP 800-30 as the DoD risk assessment policy.','NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts  NIST SP 800-30 as the DoD risk assessment policy.'),\n('001039','draft','2009-09-21','DISA FSO','policy','The organization reviews and updates the current risk assessment policy in accordance with organization-defined frequency.','RA-1.7','NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts  NIST SP 800-30 as the DoD risk assessment policy.','NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts  NIST SP 800-30 as the DoD risk assessment policy.'),\n('001040','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency with which to review and update the current risk assessment policy.','RA-1.8','DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.'),\n('001041','draft','2009-09-21','DISA FSO','policy','The organization develops and documents procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls.','RA-1.5','NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts  NIST SP 800-30 as the DoD risk assessment policy.','NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts  NIST SP 800-30 as the DoD risk assessment policy.'),\n('001042','draft','2009-09-21','DISA FSO','policy','The organization disseminates risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls to organization-defined personnel or roles.','RA-1.6','NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures and is disseminated via the NIST publications site: http://csrc.nist.gov/publications/PubsSPs.html\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts  NIST SP 800-30 as the DoD risk assessment policy.','NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts  NIST SP 800-30 as the DoD risk assessment policy.'),\n('001043','draft','2009-09-21','DISA FSO','policy','The organization reviews and updates the current risk assessment procedures in accordance with organization-defined frequency.','RA-1.9','NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts  NIST SP 800-30 as the DoD risk assessment policy.','NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts  NIST SP 800-30 as the DoD risk assessment policy.'),\n('001044','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency with which to review and update the current risk assessment procedures.','RA-1.10','DoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts  NIST SP 800-30 as the DoD risk assessment policy.','DoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts  NIST SP 800-30 as the DoD risk assessment policy.\\n\\nDoD has defined the frequency as annually - updated as appropriate.'),\n('001045','draft','2009-09-21','DISA FSO','policy','The organization categorizes information and the information system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.','RA-2.1','The organization being inspected/assessed documents and implements a process to categorize information and the information system in accordance with CNSSI 1253 and applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.  ','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed categorizes information and the information system in accordance with CNSSI 1253 and applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.  '),\n('001046','draft','2009-09-21','DISA FSO','policy','The organization documents the security categorization results (including supporting rationale) in the security plan for the information system.','RA-2.2','The organization being inspected/assessed documents the security categorization results (including supporting rationale) in the security plan for the information system IAW CNSSI 1253.   ','The organization conducting the inspection/assessment obtains and examines the documented security categorization results to ensure the organization being inspected/assessed documents the security categorization results (including supporting rationale) in the security plan for the information system IAW CNSSI 1253.'),\n('001047','draft','2009-09-21','DISA FSO','policy','The organization ensures the security categorization decision is reviewed and approved by the authorizing official or authorizing official designated representative.','RA-2.3','The organization being inspected/assessed documents and implements a process IAW CNSSI 1253 to ensure the security categorization decision is reviewed and approved by the authorizing official or authorizing official designated representative.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures the security categorization decision is reviewed and approved by the authorizing official or authorizing official designated representative.'),\n('001048','draft','2009-09-21','DISA FSO','policy','The organization conducts an assessment of risk of the information system and the information it processes, stores, or transmits that includes the likelihood and magnitude of harm from the unauthorized access, use, disclosure, disruption, modification, or destruction.','RA-3.1','The organization being inspected/assessed conducts an assessment of risk of the information system and the information it processes, stores, or transmits that includes the likelihood and magnitude of harm from the unauthorized access, use, disclosure, disruption, modification, or destruction.  The organization must maintain an audit trail  of assessments.','The organization conducting the inspection/assessment obtains and examines the audit trail of assessments to ensure the organization being inspected/assessed conducts an assessment of risk of the information system and the information it processes, stores, or transmits that includes the likelihood and magnitude of harm from the unauthorized access, use, disclosure, disruption, modification, or destruction.'),\n('001049','draft','2009-09-21','DISA FSO','policy','The organization documents risk assessment results in the organization-defined document.','RA-3.2','The organization being inspected/assessed documents risk assessment results in the risk assessment report.  DoD has defined the document as a risk assessment report.','The organization conducting the inspection/assessment obtains and examines the risk assessment report to ensure the organization being inspected/assessed documents risk assessment results in the risk assessment report.  DoD has defined the document as a risk assessment report.'),\n('001050','draft','2009-09-21','DISA FSO','policy','The organization reviews risk assessment results on an organization-defined frequency.','RA-3.4','The organization being inspected/assessed  reviews risk assessment results upon re-accreditation.   The organization must maintain a record of reviews.  DoD has defined the frequency as upon re-accreditation. ','The organization conducting the inspection/assessment obtains and examines the record of reviews to ensure the organization being inspected/assessed reviews risk assessment results upon re-accreditation.  DoD has defined the frequency as upon re-accreditation.  '),\n('001051','draft','2009-09-21','DISA FSO','policy','The organization defines a frequency for reviewing risk assessment results.','RA-3.5','DoD has defined the frequency as upon re-accreditation. ','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as upon re-accreditation. '),\n('001052','draft','2009-09-21','DISA FSO','policy','The organization updates the risk assessment on an organization-defined frequency or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.','RA-3.8','The organization being inspected/assessed updates the risk assessment upon re-accreditation or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.\\n\\nDoD has defined the frequency as upon re-accreditation.','The organization conducting the inspection/assessment obtains and examines historical versions of the risk assessment as well as records of changes to the system to ensure the organization being inspected/assessed updates the risk assessment upon re-accreditation or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.  DoD has defined the frequency as upon re-accreditation. '),\n('001053','draft','2009-09-21','DISA FSO','policy','The organization defines a frequency for updating the risk assessment.','RA-3.9','DoD has defined the frequency as upon re-accreditation. ','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as upon re-accreditation. '),\n('001054','draft','2009-09-21','DISA FSO','policy','The organization scans for vulnerabilities in the information system and hosted applications on an organization-defined frequency.','RA-5.1','The organization being inspected/assessed will define, document, and implement procedures for vulnerability scans of the information system and hosted applications; and scan for vulnerabilities  in the information system and hosted applications every 30 days or as directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).  This control is not targeted at security control compliance scanning.  DoD has defined the frequency as every 30 days or as directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).','The organization conducting the inspection/assessment obtains and examines the organization\\'s vulnerability scanning procedures and results for the 90 days preceding the inspection/assessment.  If the system in question has not been operational for more than 90 days the organization will provide all available scan(s).'),\n('001055','draft','2009-09-21','DISA FSO','policy','The organization defines a frequency for scanning for vulnerabilities in the information system and hosted applications.','RA-5.2','DoD has defined the frequency as every 30 days or as directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every 30 days or as directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).'),\n('001056','draft','2009-09-21','DISA FSO','policy','The organization scans for vulnerabilities in the information system and hosted applications when new vulnerabilities potentially affecting the system/applications are identified and reported.','RA-5.3','The organization being inspected/assessed will conduct vulnerability scans of the information system and hosted applications when new vulnerabilities potentially affecting the system/applications are identified and reported via authoritative sources (e.g., IAVM, CTO, DTM, STIG, product vendor).','The organization conducting the inspection/assessment obtains and examines the organization\\'s vulnerability scanning procedures and results in order to validate the organization conducts vulnerability scans of its Information System (IS) and hosted  applications when new vulnerabilities potentially affecting the IS and/or applications are identified and reported.'),\n('001057','draft','2009-09-21','DISA FSO','policy','The organization employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: enumerating platforms, software flaws, and improper configurations; formatting checklists and test procedures; and measuring vulnerability impact.','RA-5.6','The organization being inspected/assessed employs the DoD Enterprise scanning tool.','The organization conducting the inspection/assessment obtains and examines the software list or vulnerability scanning procedures to ensure the organization being inspected/assessed employs the DoD Enterprise scanning tool.'),\n('001058','draft','2009-09-21','DISA FSO','policy','The organization analyzes vulnerability scan reports and results from security control assessments.','RA-5.7','The organization being inspected/assessed analyzes vulnerability scan reports and security control assessment results with the intent of identifying legitimate vulnerabilities and the relationship between vulnerabilities and security controls.','The organization conducting the inspection/assessment will interview organizational personnel with security control assessment and vulnerability scanning responsibilities.  The purpose of the reviews and interviews is to validate the organization is conducting an analysis of the vulnerability scan reports and results from the security control assessments.'),\n('001059','draft','2009-09-21','DISA FSO','policy','The organization remediates legitimate vulnerabilities in organization-defined response times in accordance with an organizational assessment risk.','RA-5.8','The organization being inspected/assessed takes corrective actions as appropriate on legitimate vulnerabilities identified in RA-5, CCI 001058 IAW an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).  Audit records of actions must be maintained IAW applicable DoD, CYBERCOM, and/or component policies.  DoD has defined the response times as IAW an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).','The organization conducting the inspection/assessment obtains and examines audit records to validate the organization is taking action to remediate legitimate vulnerabilities within the required response times (IAW an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).  The organization conducting the inspection/assessment may conduct independent vulnerability scans to compare those scan results with audit records of remediation actions.  DoD has defined the response times as IAW an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).'),\n('001060','draft','2009-09-21','DISA FSO','policy','The organization defines response times for remediating legitimate vulnerabilities in accordance with an organization assessment of risk.','RA-5.9','DoD has defined the response times as IAW an authoritative source (e.g. IAVM, CTOs, DTMs).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the response times as IAW an authoritative source (e.g. IAVM, CTOs, DTMs).'),\n('001061','draft','2009-09-21','DISA FSO','policy','The organization shares information obtained from the vulnerability scanning process and security control assessments with organization-defined personnel or roles to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).','RA-5.10','The organization being inspected/assessed documents and implements a process to share information obtained from the vulnerability scanning process and security control assessments with at a minimum, the ISSM and ISSO to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed shares information obtained from the vulnerability scanning process and security control assessments with at a minimum, the ISSM and ISSO to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.'),\n('001062','draft','2009-09-21','DISA FSO','policy','The organization employs vulnerability scanning tools that include the capability to readily update the information system vulnerabilities to be scanned.','RA-5(1).1','The organization being inspected/assessed will employ scanning tools that maintain currency with industry standard information system vulnerabilities to ensure that scanning activities are conducted with the most up to date list of known vulnerabilities to include USCYBERCOM issued IAVMs.\\n\\nDoD has provided an enterprise scanning tool that fully meets this requirement.  Organizations that choose not to use the enterprise scanning tool must identify which scanning tool they are using and ensure that it meets these requirements.','The organization conducting the inspection/assessment will:\\n1. If the inspected organization is using the DoD provided enterprise scanning tool, compliance with this control is complete.\\n2. Validate the identified tool in use by the inspected organization is able to maintain current up to date information system vulnerability data.'),\n('001063','draft','2009-09-21','DISA FSO','policy','The organization updates the information system vulnerabilities scanned on an organization-defined frequency, prior to a new scan, and/or when new vulnerabilities are identified and reported.','RA-5(2).1','The organization being inspected/assessed will update the list of information system vulnerabilities scanned for prior to running scans.  The organization must maintain a record of scans including the list of vulnerabilities scanned for.  DoD has defined the frequency as prior to running scans.','The organization conducting the inspection/assessment obtains and examines the record of scans to ensure the latest most up to date scanning policies are present.'),\n('001064','draft','2009-09-21','DISA FSO','policy','The organization defines a frequency for updating the information system vulnerabilities scanned.','RA-5(2).2','DoD has defined the frequency as prior to running scans.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as prior to running scans.'),\n('001065','draft','2009-09-21','DISA FSO','policy','The organization employs vulnerability scanning procedures that can demonstrate the breadth of coverage (i.e., information system components scanned).',NULL,NULL,NULL),\n('001066','draft','2009-09-21','DISA FSO','policy','The organization determines what information about the information system is discoverable by adversaries.','RA-5(4).1','If the organization being inspected/assessed is conducting vulnerability scans IAW base control RA-5, they are compliant with this CCI.','The organization conducting the inspection/assessment will review results of validation of base control RA-5, if the inspected organization is compliant with the requirements of RA-5, they are compliant with this CCI.'),\n('001067','draft','2009-09-21','DISA FSO','technical','The information system implements privileged access authorization to organization-identified information system components for selected organization-defined vulnerability scanning activities.','RA-5(5).1','The organization being inspected/assessed configures the information system to implement privileged access authorization to all information systems and infrastructure components for selected vulnerability scanning activities defined in RA-5 (5), CCI 2906.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1067.  DoD has defined the information system components as all information systems and infrastructure components.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement privileged access authorization to all information systems and infrastructure components for selected vulnerability scanning activities defined in RA-5 (5), CCI 2906.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1067.  DoD has defined the information system components as all information systems and infrastructure components.'),\n('001068','draft','2009-09-21','DISA FSO','policy','The organization employs automated mechanisms to compare the results of vulnerability scans over time to determine trends in information system vulnerabilities.','RA-5(6).1','The organization being inspected/assessed must configure and implement automated mechanisms which provide the capability to compare the results of vulnerability scans over time to determine trends in information system vulnerabilities.','The organization conducting the inspection/assessment validates the organization is employing automated mechanisms to compare the results of vulnerability scans over time to determine trends in information system vulnerabilities.'),\n('001069','draft','2009-09-21','DISA FSO','technical','The organization employs automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials in accordance with the organization-defined frequency.',NULL,NULL,NULL),\n('001070','draft','2009-09-21','DISA FSO','policy','The organization defines a frequency for employing automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials.',NULL,NULL,NULL),\n('001071','draft','2009-09-21','DISA FSO','policy','The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.','RA-5(8).1','The organization being inspected/assessed reviews audit logs and determines if the identified vulnerability has been previously exploited within the information system.  Any findings must be documented and acted upon IAW IR-1.','The organization conducting the inspection/assessment obtains and examines the audit trail to determine if the organization has documented any previously identified exploited vulnerabilities.'),\n('001072','draft','2009-09-21','DISA FSO','policy','The organization employs an independent penetration agent or penetration team to conduct a vulnerability analysis on the information system.',NULL,NULL,NULL),\n('001073','draft','2009-09-21','DISA FSO','policy','The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system based on the vulnerability analysis to determine the exploitability of identified vulnerabilities.',NULL,NULL,NULL),\n('001074','draft','2009-09-21','DISA FSO','policy','The organization develops a system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','SC-1.3','DoDI 8523.01 \\\"Communications Security (COMSEC)\\\" meets the DoD requirement for developing a system and communications protection policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8523.01.','DoDI 8523.01 \\\"Communications Security (COMSEC)\\\" meets the DoD requirement for developing a system and communications protection policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8523.01.'),\n('001075','draft','2009-09-21','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles the system and communications protection policy.','SC-1.4','DoDI 8523.01 \\\"Communications Security (COMSEC)\\\" meets the DoD requirement for disseminating the system and communications protection policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8523.01.','DoDI 8523.01 \\\"Communications Security (COMSEC)\\\" meets the DoD requirement for disseminating the system and communications protection policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8523.01.'),\n('001076','draft','2009-09-21','DISA FSO','policy','The organization reviews and updates the system and communications protection policy in accordance with organization-defined frequency.','SC-1.7','DoDI 8523.01 \\\"Communications Security (COMSEC)\\\" meets the DoD requirement for reviewing and updating the system and communications protection policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8523.01.','DoDI 8523.01 \\\"Communications Security (COMSEC)\\\" meets the DoD requirement for reviewing and updating the system and communications protection policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8523.01.'),\n('001077','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency for reviewing and updating the system and communications protection policy.','SC-1.8','DoD has defined the frequency as every 5 years.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every 5 years.'),\n('001078','draft','2009-09-21','DISA FSO','policy','The organization develops system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.','SC-1.5','DoDI 8523.01 \\\"Communications Security (COMSEC)\\\" meets the DoD requirement for developing system and communications protection procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8523.01.','DoDI 8523.01 \\\"Communications Security (COMSEC)\\\" meets the DoD requirement for developing system and communications protection procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8523.01.'),\n('001079','draft','2009-09-21','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.','SC-1.6','DoDI 8523.01 \\\"Communications Security (COMSEC)\\\" meets the DoD requirement for disseminating the procedures to facilitate the implementation of the system and communications protection policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8523.01.','DoDI 8523.01 \\\"Communications Security (COMSEC)\\\" meets the DoD requirement for disseminating the procedures to facilitate the implementation of the system and communications protection policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8523.01.'),\n('001080','draft','2009-09-21','DISA FSO','policy','The organization reviews and updates the system and communications protection procedures in accordance with organization-defined frequency.','SC-1.9','DoDI 8523.01 \\\"Communications Security (COMSEC)\\\"meets the DoD requirement for reviewing and updating the system and communications protection procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8523.01.','DoDI 8523.01 \\\"Communications Security (COMSEC)\\\"meets the DoD requirement for reviewing and updating the system and communications protection procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8523.01.'),\n('001081','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency of system and communications protection procedure reviews and updates.','SC-1.10','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('001082','draft','2009-09-21','DISA FSO','technical','The information system separates user functionality (including user interface services) from information system management functionality.','SC-2.1','The organization being inspected/assessed configures the information system to separate user functionality (including user interface services) from information system management functionality.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1082.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to separate user functionality (including user interface services) from information system management functionality.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1082.'),\n('001083','draft','2009-09-21','DISA FSO','technical','The information system prevents the presentation of information system management-related functionality at an interface for non-privileged users.','SC-2(1).1','The organization being inspected/assessed configures the information system to prevent the presentation of information system management-related functionality at an interface for non-privileged users.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1083.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to prevent the presentation of information system management-related functionality at an interface for non-privileged users.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1083.'),\n('001084','draft','2009-09-21','DISA FSO','technical','The information system isolates security functions from nonsecurity functions.','SC-3.1','The organization being inspected/assessed configures the information system to isolate security functions from nonsecurity functions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1084.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to isolate security functions from nonsecurity functions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1084.'),\n('001085','draft','2009-09-21','DISA FSO','technical','The information system utilizes underlying hardware separation mechanisms to implement security function isolation.','SC-3(1).1','The organization being inspected/assessed configures the information system to utilize underlying hardware separation mechanisms to implement security function isolation.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1085.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to utilize underlying hardware separation mechanisms to implement security function isolation.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1085.'),\n('001086','draft','2009-09-21','DISA FSO','technical','The information system isolates security functions enforcing access and information flow control from both nonsecurity functions and from other security functions.','SC-3(2).1','The organization being inspected/assessed configures the information system to  isolate security functions enforcing access and information flow control from both nonsecurity functions and from other security functions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1086.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  isolate security functions enforcing access and information flow control from both nonsecurity functions and from other security functions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1086.'),\n('001087','draft','2009-09-21','DISA FSO','technical','The organization implements an information system isolation boundary to minimize the number of nonsecurity functions included within the boundary containing security functions.',NULL,NULL,NULL),\n('001088','draft','2009-09-21','DISA FSO','policy','The organization implements security functions as largely independent modules that avoid unnecessary interactions between modules.',NULL,NULL,NULL),\n('001089','draft','2009-09-21','DISA FSO','technical','The organization implements security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.','SC-3(5).1','The organization being inspected/assessed configures the information system to implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1089.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1089.'),\n('001090','draft','2009-09-21','DISA FSO','technical','The information system prevents unauthorized and unintended information transfer via shared system resources.','SC-4.1','The organization being inspected/assessed configures the information system to  prevent unauthorized and unintended information transfer via shared system resources.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1090.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  prevent unauthorized and unintended information transfer via shared system resources.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1090.'),\n('001091','draft','2009-09-21','DISA FSO','technical','The information system does not share resources that are used to interface with systems operating at different security levels.',NULL,NULL,NULL),\n('001092','draft','2009-09-21','DISA FSO','technical','The information system protects against or limits the effects of the organization-defined or referenced types of denial of service attacks.',NULL,NULL,NULL),\n('001093','draft','2009-09-21','DISA FSO','policy','The organization defines the types of denial of service attacks (or provides references to sources of current denial of service attacks) that can be addressed by the information system.','SC-5.1','The organization being inspected/assessed defines and documents the types of denial of service attacks (or provides references to sources of current denial of service attacks) that can be addressed by the information system.  DoD has determined the types of denial of service attacks are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented types of denial of service attacks to ensure the organization being inspected/assessed defines the types of denial of service attacks (or provides references to sources of current denial of service attacks) that can be addressed by the information system.  DoD has determined the types of denial of service attacks are not appropriate to define at the Enterprise level.'),\n('001094','draft','2009-09-21','DISA FSO','technical','The information system restricts the ability of individuals to launch organization-defined denial of service attacks against other information systems.','SC-5(1).1','The organization being inspected/assessed configures the information system to restrict the ability of individuals to launch denial of service attacks defined in SC-5 (1), CCI 2387 against other information systems.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1094.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  restrict the ability of individuals to launch denial of service attacks defined in SC-5 (1), CCI 2387 against other information systems.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1094.'),\n('001095','draft','2009-09-21','DISA FSO','technical','The information system manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.','SC-5(2).1','The organization being inspected/assessed configures the information system to manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1095.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1095.'),\n('001096','draft','2009-09-21','DISA FSO','technical','The information system limits the use of resources by priority.',NULL,NULL,NULL),\n('001097','draft','2009-09-21','DISA FSO','policy','The information system monitors and controls communications at the external boundary of the information system and at key internal boundaries within the system.','SC-7.1','The organization being inspected/assessed documents and implements processes to monitor and control communications at the external boundary of the system and at key internal boundaries within the system.  The organization must maintain an audit trail of monitoring activities.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of monitoring activities to ensure the organization being inspected/assessed  monitors and controls communications at the external boundary of the system and at key internal boundaries within the system.'),\n('001098','draft','2009-09-21','DISA FSO','policy','The information system connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.','SC-7.3','The organization being inspected/assessed designs the information system to enforce requirements that components connect to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.','The organization conducting the inspection/assessment obtains and examines network topology diagrams, architecture documentation, or any other documentation identifying component connectivity to ensure the organization being inspected/assessed   connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.'),\n('001099','draft','2009-09-21','DISA FSO','policy','The organization physically allocates publicly accessible information system components to separate subnetworks with separate physical network interfaces.',NULL,NULL,NULL),\n('001100','draft','2009-09-21','DISA FSO','technical','The information system prevents public access into the organization\\'s internal networks except as appropriately mediated by managed interfaces employing boundary protection devices.',NULL,NULL,NULL),\n('001101','draft','2009-09-21','DISA FSO','policy','The organization limits the number of external network connections to the information system.','SC-7(3).1','The organization being inspected/assessed documents and implements information system access control mechanisms to limit the number of external connections to the information system.','The organization conducting the inspection/assessment obtains and examines the documented access control mechanisms to ensure that the organization being inspected/assessed limits the number of external network connections to the information system.'),\n('001102','draft','2009-09-21','DISA FSO','policy','The organization implements a managed interface for each external telecommunication service.','SC-7(4).1','The organization being inspected/assessed designs the information system to have a managed interface for each telecommunication service.','The organization conducting the inspection/assessment obtains and examines network topology diagrams, architecture documentation, or any other documentation identifying system interfaces to ensure the organization being inspected/assessed implements a managed interface for each external telecommunication service.'),\n('001103','draft','2009-09-21','DISA FSO','policy','The organization establishes a traffic flow policy for each managed interface for each external telecommunication service.','SC-7(4).2','The organization being inspected/assessed defines and documents a traffic flow policy for each managed interface for each external telecommunication service.','The organization conducting the inspection/assessment obtains and examines the documented traffic flow policy to ensure the organization being inspected/assessed establishes a traffic flow policy for each managed interface for each external telecommunication service.'),\n('001104','draft','2009-09-21','DISA FSO','policy','The organization employs security controls as needed to protect the confidentiality and integrity of the information being transmitted.',NULL,NULL,NULL),\n('001105','draft','2009-09-21','DISA FSO','policy','The organization documents each exception to the traffic flow policy with a supporting mission/business need and duration of that need for each external telecommunication service.','SC-7(4).4','The organization being inspected/assessed documents each exception to the traffic flow policy with a supporting mission/business need and duration of that need for each external telecommunication service.','The organization conducting the inspection/assessment obtains and examines the documented exceptions to the traffic flow policy to ensure the organization being inspected/assessed identifies each exception with supporting mission/business need and duration of that need for each external telecommunication service.'),\n('001106','draft','2009-09-21','DISA FSO','policy','The organization reviews exceptions to the traffic flow policy on an organization-defined frequency for each external telecommunication service.','SC-7(4).5','The organization being inspected/assessed implements a process to review exceptions to the traffic flow policy every 180 days for each external telecommunication service.  The organization must maintain an audit trail of reviews.  DoD has defined the frequency as every 180 days.','The organization conducting the inspection/assessment obtains and examines the audit trail of reviews to ensure the organization being inspected/assessed reviews exceptions to the traffic flow policy every 180 days for each external telecommunication service.  DoD has defined the frequency as every 180 days.'),\n('001107','draft','2009-09-21','DISA FSO','policy','The organization defines a frequency for the review of exceptions to the traffic flow policy for each external telecommunication service.','SC-7(4).6','DoD has defined the frequency as every 180 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every 180 days.'),\n('001108','draft','2009-09-21','DISA FSO','policy','The organization removes traffic flow policy exceptions that are no longer supported by an explicit mission/business need for each external telecommunication service.','SC-7(4).7','The organization being inspected/assessed documents and implements a process to remove traffic flow policy exceptions that are no longer supported by an explicit mission/business need for each external telecommunication service.','The organization conducting the inspection/assessment obtains and examines the documented process as well as a sampling of existing exceptions to ensure the organization being inspected/assessed removes traffic flow policy exceptions that are no longer supported by an explicit mission/business need for each external telecommunication service.'),\n('001109','draft','2009-09-21','DISA FSO','technical','The information system at managed interfaces denies network communications traffic by default and allows network communications traffic by exception (i.e., deny all, permit by exception).','SC-7(5).1','The organization being inspected/assessed configures the information system to deny network communications traffic at managed interfaces by default and allows network communications traffic by exception (i.e., deny all, permit by exception).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1109.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  deny network communications traffic at managed interfaces by default and allows network communications traffic by exception (i.e., deny all, permit by exception).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1109.'),\n('001110','draft','2009-09-21','DISA FSO','policy','The organization prevents the unauthorized release of information outside of the information system boundary or any unauthorized communication through the information system boundary when there is an operational failure of the boundary protection mechanisms.',NULL,NULL,NULL),\n('001111','draft','2009-09-21','DISA FSO','technical','The information system prevents remote devices that have established a non-remote connection with the system from communicating outside of that communications path with resources in external networks.',NULL,NULL,NULL),\n('001112','draft','2009-09-21','DISA FSO','policy','The information system routes organization-defined internal communications traffic to organization-defined external networks through authenticated proxy servers at managed interfaces.','SC-7(8).1','The organization being inspected/assessed configures the information system to route  protocols as designated by PPSM guidance (e.g. HTTPS, HTTP, FTP, SNMP) to any network external to the authorization boundary through authenticated proxy servers at managed interfaces.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1112.  DoD has defined the internal communications traffic as protocols as designated by PPSM guidance (e.g. HTTPS, HTTP, FTP, SNMP).  DoD has defined the external networks as any network external to the authorization boundary.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to route  protocols as designated by PPSM guidance (e.g. HTTPS, HTTP, FTP, SNMP) to any network external to the authorization boundary through authenticated proxy servers at managed interfaces.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1112.  DoD has defined the internal communications traffic as protocols as designated by PPSM guidance (e.g. HTTPS, HTTP, FTP, SNMP).  DoD has defined the external networks as any network external to the authorization boundary.'),\n('001113','draft','2009-09-21','DISA FSO','policy','The organization defines the internal communications traffic to be routed to external networks.','SC-7(8).2','DoD has defined the internal communications traffic as protocols as designated by PPSM guidance (e.g. HTTPS, HTTP, FTP, SNMP).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the internal communications traffic as protocols as designated by PPSM guidance (e.g. HTTPS, HTTP, FTP, SNMP).'),\n('001114','draft','2009-09-21','DISA FSO','policy','The organization defines the external networks to which organization-defined internal communications traffic should be routed.','SC-7(8).3','DoD has defined the external networks as any network external to the authorization boundary.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the external networks as any network external to the authorization boundary.'),\n('001115','draft','2009-09-21','DISA FSO','technical','The information system, at managed interfaces, denies network traffic and audits internal users (or malicious code) posing a threat to external information systems.',NULL,NULL,NULL),\n('001116','draft','2009-09-21','DISA FSO','policy','The organization prevents the unauthorized exfiltration of information across managed interfaces.','SC-7(10).1','The organization being inspected/assessed documents and implements mechanisms to prevent  the unauthorized exfiltration of information across managed interfaces.','The organization conducting the inspection/assessment obtains and examines the documented mechanisms to ensure the organization being inspected/assessed prevents the unauthorized exfiltration of information across managed interfaces.'),\n('001117','draft','2009-09-21','DISA FSO','technical','The information system checks incoming communications to ensure the communications are coming from an authorized source and routed to an authorized destination.',NULL,NULL,NULL),\n('001118','draft','2009-09-21','DISA FSO','technical','The information system implements host-based boundary protection mechanisms for servers, workstations, and mobile devices.',NULL,NULL,NULL),\n('001119','draft','2009-09-21','DISA FSO','policy','The organization isolates organization-defined information security tools, mechanisms, and support components from other internal information system components by implementing physically separate subnetworks with managed interfaces to other components of the system.','SC-7(13).1','The organization being inspected/assessed designs the information system to isolate key information security tools, mechanisms, and support components such as, but not limited to PKI, Patching infrastructure, HBSS, CND Tools, Special Purpose Gateway, vulnerability tracking systems, honeypots, internet access points (IAPs); network element and data center administrative/management traffic; Demilitarized Zones (DMZs), Server farms/computing centers,  centralized audit log servers etc. from other internal information system components by implementing physically separate subnetworks with managed interfaces to other components of the system.  DoD has defined the  key information security tools, mechanisms, and support components as key information security tools, mechanisms, and support components such as, but not limited to PKI, Patching infrastructure, HBSS, CND Tools, Special Purpose Gateway, vulnerability tracking systems, honeypots, internet access points (IAPs); network element and data center administrative/management traffic; Demilitarized Zones (DMZs), Server farms/computing centers,  centralized audit log servers etc.  ','The organization conducting the inspection/assessment obtains and examines network topology diagrams, architecture documentation, or any other documentation identifying component partitioning to ensure the organization being inspected/assessed isolates key information security tools, mechanisms, and support components such as, but not limited to PKI, Patching infrastructure, HBSS, CND Tools, Special Purpose Gateway, vulnerability tracking systems, honeypots, internet access points (IAPs); network element and data center administrative/management traffic; Demilitarized Zones (DMZs), Server farms/computing centers,  centralized audit log servers etc. from other internal information system components by implementing physically separate subnetworks with managed interfaces to other components of the system.  DoD has defined the  key information security tools, mechanisms, and support components as key information security tools, mechanisms, and support components such as, but not limited to PKI, Patching infrastructure, HBSS, CND Tools, Special Purpose Gateway, vulnerability tracking systems, honeypots, internet access points (IAPs); network element and data center administrative/management traffic; Demilitarized Zones (DMZs), Server farms/computing centers,  centralized audit log servers etc.'),\n('001120','draft','2009-09-21','DISA FSO','policy','The organization defines key information security tools, mechanisms, and support components to be isolated.','SC-7(13).2','DoD has defined the  key information security tools, mechanisms, and support components as key information security tools, mechanisms, and support components such as, but not limited to PKI, Patching infrastructure, HBSS, CND Tools, Special Purpose Gateway, vulnerability tracking systems, honeypots, internet access points (IAPs); network element and data center administrative/management traffic; Demilitarized Zones (DMZs), Server farms/computing centers,  centralized audit log servers etc.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the  key information security tools, mechanisms, and support components as key information security tools, mechanisms, and support components such as, but not limited to PKI, Patching infrastructure, HBSS, CND Tools, Special Purpose Gateway, vulnerability tracking systems, honeypots, internet access points (IAPs); network element and data center administrative/management traffic; Demilitarized Zones (DMZs), Server farms/computing centers,  centralized audit log servers etc.'),\n('001121','draft','2009-09-21','DISA FSO','policy','The organization protects against unauthorized physical connections at organization-defined managed interfaces.','SC-7(14).1','The organization being inspected/assessed documents and implements mechanisms to protect against unauthorized physical connections at internet access points, enclave LAN to WAN, cross domain solutions, and any DoD Approved Alternate Gateways.  DoD has defined the managed interfaces as internet access points, enclave LAN to WAN, cross domain solutions, and any DoD Approved Alternate Gateways.','The organization conducting the inspection/assessment obtains and examines the documented mechanisms to ensure the organization being inspected/assessed protects against unauthorized physical connections at internet access points, enclave LAN to WAN, cross domain solutions, and any DoD Approved Alternate Gateways.\\n\\nDoD has defined the managed interfaces as internet access points, enclave LAN to WAN, cross domain solutions, and any DoD Approved Alternate Gateways.'),\n('001122','draft','2009-09-21','DISA FSO','policy','The organization defines the managed interfaces where boundary protections against unauthorized physical connections are to be implemented.','SC-7(14).2','DoD has defined the managed interfaces as internet access points, enclave LAN to WAN, cross domain solutions, and any DoD Approved Alternate Gateways.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the managed interfaces as internet access points, enclave LAN to WAN, cross domain solutions, and any DoD Approved Alternate Gateways.'),\n('001123','draft','2009-09-21','DISA FSO','policy','The information system routes all networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.','SC-7(15).1','The organization being inspected/assessed designs the information system to route all networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.','The organization conducting the inspection/assessment obtains and examines network topology diagrams, architecture documentation, or any other documentation identifying network data flow to ensure the organization being inspected/assessed routes all networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.'),\n('001124','draft','2009-09-21','DISA FSO','technical','The information system prevents discovery of specific system components composing a managed interface.','SC-7(16).1','The organization being inspected/assessed configures the information system to prevent discovery of specific system components composing a managed interface.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1124.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to prevent discovery of specific system components composing a managed interface.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1124.'),\n('001125','draft','2009-09-21','DISA FSO','technical','The information system enforces adherence to protocol format.','SC-7(17).1','The organization being inspected/assessed configures the information system to enforce adherence to protocol format.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1125.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce adherence to protocol format.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1125.'),\n('001126','draft','2009-09-21','DISA FSO','technical','The information system fails securely in the event of an operational failure of a boundary protection device.','SC-7(18).1','The organization being inspected/assessed configures the information system to  fail securely in the event of an operational failure of a boundary protection device.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1126.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  fail securely in the event of an operational failure of a boundary protection device.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1126.'),\n('001127','draft','2009-09-21','DISA FSO','technical','The information system protects the integrity of transmitted information.',NULL,NULL,NULL),\n('001128','draft','2009-09-21','DISA FSO','technical','The organization employs cryptographic mechanisms to recognize changes to information during transmission unless otherwise protected by alternative physical measures.',NULL,NULL,NULL),\n('001129','draft','2009-09-21','DISA FSO','technical','The information system maintains the integrity of information during aggregation, packaging, and transformation in preparation for transmission.',NULL,NULL,NULL),\n('001130','draft','2009-09-21','DISA FSO','technical','The information system protects the confidentiality of transmitted information.',NULL,NULL,NULL),\n('001131','draft','2009-09-21','DISA FSO','technical','The organization employs cryptographic mechanisms to prevent unauthorized disclosure of information during transmission unless otherwise protected by alternative physical measures.',NULL,NULL,NULL),\n('001132','draft','2009-09-21','DISA FSO','technical','The information system maintains the confidentiality of information during aggregation, packaging, and transformation in preparation for transmission.',NULL,NULL,NULL),\n('001133','draft','2009-09-21','DISA FSO','technical','The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.','SC-10.1','The organization being inspected/assessed configures the information system to terminate the network connection associated with a communications session at the end of the session or after 10 minutes in band management and 15 minutes for user sessions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1133.  DoD has defined the time period as 10 minutes in band management and 15 minutes for user sessions.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to terminate the network connection associated with a communications session at the end of the session or after 10 minutes in band management and 15 minutes for user sessions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1133.  DoD has defined the time period as 10 minutes in band management and 15 minutes for user sessions.'),\n('001134','draft','2009-09-21','DISA FSO','policy','The organization defines the time period of inactivity after which the information system terminates a network connection associated with a communications session.','SC-10.2','DoD has defined the time period as 10 minutes in band management and 15 minutes for user sessions.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 10 minutes in band management and 15 minutes for user sessions.'),\n('001135','draft','2009-09-21','DISA FSO','policy','The information system establishes a trusted communications path between the user and organization-defined security functions within the information system.','SC-11.1','The organization being inspected/assessed designs and configures the information system to establish a trusted communications path between the user and providers of authentication, reauthentication, and all privileged commands (administration, monitoring, and controlling) within the information system.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1135.  DoD has defined the security functions as providers of authentication, reauthentication, and all privileged commands (administration, monitoring, and controlling).','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to establish a trusted communications path between the user and providers of authentication, reauthentication, and all privileged commands (administration, monitoring, and controlling) within the information system.  Additionally, the organization conducting the inspection/assessment obtains and examines network topology diagrams, architecture documentation, or any other documentation identifying data flow to ensure the organization being inspected/assessed establishes a trusted communications path between the user and providers of authentication, reauthentication, and all privileged commands (administration, monitoring, and controlling) within the information system.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1135.  DoD has defined the security functions as providers of authentication, reauthentication, and all privileged commands (administration, monitoring, and controlling).'),\n('001136','draft','2009-09-21','DISA FSO','policy','The organization defines security functions include information system authentication and reauthentication.',NULL,NULL,NULL),\n('001137','draft','2009-09-21','DISA FSO','policy','The organization establishes cryptographic keys for required cryptography employed within the information system.',NULL,NULL,NULL),\n('001138','draft','2009-09-21','DISA FSO','policy','The organization manages cryptographic keys for required cryptography employed within the information system.',NULL,NULL,NULL),\n('001139','draft','2009-09-21','DISA FSO','policy','The organization maintains availability of information in the event of the loss of cryptographic keys by users.','SC-12(1).1','The organization being inspected/assessed documents and implements a process to maintain availability of information in the event of the loss of cryptographic keys by users.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed maintains availability of information in the event of the loss of cryptographic keys by users.'),\n('001140','draft','2009-09-21','DISA FSO','technical','The organization produces, controls, and distributes symmetric cryptographic keys using NIST-approved or NSA-approved key management technology and processes.',NULL,NULL,NULL),\n('001141','draft','2009-09-21','DISA FSO','technical','The organization produces, controls, and distributes symmetric and asymmetric cryptographic keys using NSA-approved key management technology and processes.',NULL,NULL,NULL),\n('001142','draft','2009-09-21','DISA FSO','technical','The organization produces, controls, and distributes asymmetric cryptographic keys using approved PKI Class 3 certificates or prepositioned keying material.',NULL,NULL,NULL),\n('001143','draft','2009-09-21','DISA FSO','technical','The organization produces, controls, and distributes asymmetric cryptographic keys using approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user\\'s private key.',NULL,NULL,NULL),\n('001144','draft','2009-09-21','DISA FSO','technical','The information system implements required cryptographic protections using cryptographic modules that comply with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.',NULL,NULL,NULL),\n('001145','draft','2009-09-21','DISA FSO','technical','The organization employs, at a minimum, FIPS-validated cryptography to protect unclassified information.',NULL,NULL,NULL),\n('001146','draft','2009-09-21','DISA FSO','technical','The organization employs NSA-approved cryptography to protect classified information.',NULL,NULL,NULL),\n('001147','draft','2009-09-21','DISA FSO','technical','The organization employs, at a minimum, FIPS-validated cryptography to protect information when such information must be separated from individuals who have the necessary clearances yet lack the necessary access approvals.',NULL,NULL,NULL),\n('001148','draft','2009-09-21','DISA FSO','technical','The organization employs FIPS-validated or NSA-approved cryptography to implement digital signatures.',NULL,NULL,NULL),\n('001149','draft','2009-09-21','DISA FSO','technical','The information system protects the integrity and availability of publicly available information and applications.',NULL,NULL,NULL),\n('001150','draft','2009-09-21','DISA FSO','technical','The information system prohibits remote activation of collaborative computing devices, excluding the organization-defined exceptions where remote activation is to be allowed.','SC-15.1','The organization being inspected/assessed configures the information system to prohibit remote activation of collaborative computing devices excluding dedicated VTC suites located in approved VTC locations that are centrally managed.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1150.  DoD has defined the exceptions as dedicated VTC suites located in approved VTC locations that are centrally managed.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to prohibit remote activation of collaborative computing devices excluding dedicated VTC suites located in approved VTC locations that are centrally managed.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1150.  DoD has defined the exceptions as dedicated VTC suites located in approved VTC locations that are centrally managed.'),\n('001151','draft','2009-09-21','DISA FSO','policy','The organization defines exceptions to the prohibition of collaborative computing devices where remote activation is to be allowed.','SC-15.2','DoD has defined the exceptions as dedicated VTC suites located in approved VTC locations that are centrally managed.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the exceptions as dedicated VTC suites located in approved VTC locations that are centrally managed.'),\n('001152','draft','2009-09-21','DISA FSO','technical','The information system provides an explicit indication of use to users physically present at collaborative computing devices.','SC-15.3','The organization being inspected/assessed configures the information system to provide an explicit indication of use to users physically present at collaborative computing devices.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1152.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  provide an explicit indication of use to users physically present at collaborative computing devices.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1152.'),\n('001153','draft','2009-09-21','DISA FSO','technical','The information system provides physical disconnect of collaborative computing devices in a manner that supports ease of use.','SC-15(1).1','The organization being inspected/assessed provides a means of physical disconnect of collaborative computing devices in a manner that supports ease of use.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1153.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed provides a means of physical disconnect of collaborative computing devices in a manner that supports ease of use.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1153.'),\n('001154','draft','2009-09-21','DISA FSO','technical','The information system or supporting environment blocks both inbound and outbound traffic between instant messaging clients that are independently configured by end users and external service providers.',NULL,NULL,NULL),\n('001155','draft','2009-09-21','DISA FSO','policy','The organization disables or removes collaborative computing devices from organization-defined information systems or information system components in organization-defined secure work areas.','SC-15(3).1','The organization being inspected/assessed implements a process to disable or remove  any device used that may incorporate camera, microphone, or smart board capability in secure work areas defined in SC-15 (3), CCI 1156.  DoD has defined information systems or information system components as any device used that may incorporate camera, microphone, or smart board capability.','The organization conducting the inspection/assessment obtains and examines the organization defined secure work area to ensure that any device that may incorporate   camera, microphone, or smart board capability has been disabled or removed.  DoD has defined information systems or information system components as any device used that may incorporate camera, microphone, or smart board capability.'),\n('001156','draft','2009-09-21','DISA FSO','policy','The organization defines secure work areas where collaborative computing devices are to be disabled or removed.','SC-15(3).2','The organization being inspected/assessed defines and documents secure work areas where collaborative computing devices are to be disabled or removed.  DoD has determined the secure work areas are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented secure work areas to ensure the organization being inspected/assessed  defines secure work areas where collaborative computing devices are to be disabled or removed.  DoD has determined the secure work areas are not appropriate to define at the Enterprise level.'),\n('001157','draft','2009-09-21','DISA FSO','policy','The information system associates organization-defined security attributes with information exchanged between information systems.','SC-16.1','The organization being inspected/assessed implements association of security attributes defined in SC-16, CCI 2454 with information exchanged between information systems.','The organization conducting the inspection/assessment examines the information system to ensure it associates security attributes defined in SC-16, CCI 2454 with information exchanged between information systems.'),\n('001158','draft','2009-09-21','DISA FSO','technical','The information system validates the integrity of transmitted security attributes.','SC-16(1).1','The organization being inspected/assessed configures the information system to validate the integrity of transmitted security attributes.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1158.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  validate the integrity of transmitted security attributes.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1158.'),\n('001159','draft','2009-09-21','DISA FSO','policy','The organization issues public key certificates under an organization-defined certificate policy or obtains public key certificates from an approved service provider.','SC-17.1','The organization being inspected/assessed configures the information system to issue public key certificates under DoDI 8520.02, \\\"Public Key Infrastructure (PKI) and Public Key (PK) Enabling\\\" or obtains public key certificates from an approved service provider.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1159.  DoD has defined the certificate policy as DoDI 8520.02, \\\"Public Key Infrastructure (PKI) and Public Key (PK) Enabling.\\\"','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  issue public key certificates under DoDI 8520.02, \\\"Public Key Infrastructure (PKI) and Public Key (PK) Enabling\\\" or obtains public key certificates from an approved service provider.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1159.  DoD has defined the certificate policy as DoDI 8520.02, \\\"Public Key Infrastructure (PKI) and Public Key (PK) Enabling.\\\"'),\n('001160','draft','2009-09-21','DISA FSO','policy','The organization defines acceptable and unacceptable mobile code and mobile code technologies.','SC-18.1','The organization being inspected/assessed defines and documents acceptable and unacceptable mobile code and mobile code technologies IAW the Protection Profile for Web Browsers  and Application SRG.\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must define IAW the STIG/SRG guidance that pertains to CCI 1160.','The organization conducting the inspection/assessment obtains and examines the documented acceptable and unacceptable mobile code and mobile code technologies to ensure the organization being inspected/assessed defines acceptable and unacceptable mobile code and mobile code technologies  IAW the Protection Profile for Web Browsers  and Application SRG.\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has defined acceptable and unacceptable mobile code and mobile code technologies IAW the applicable STIGs and SRGs pertaining to CCI 1160.'),\n('001161','draft','2009-09-21','DISA FSO','policy','The organization establishes usage restrictions for acceptable mobile code and mobile code technologies.','SC-18.2','The organization being inspected/assessed documents usage restrictions  for acceptable mobile code and mobile code technologies  IAW the Protection Profile for Web Browsers  and Application SRG.\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must establish IAW the STIG/SRG guidance that pertains to CCI 1161.','The organization conducting the inspection/assessment obtains and examines the documented usage restrictions to ensure the organization being inspected/assessed establishes usage restrictions  for acceptable mobile code and mobile code technologies  IAW the Protection Profile for Web Browsers  and Application SRG.\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has established usage restrictions IAW the applicable STIGs and SRGs pertaining to CCI 1161.'),\n('001162','draft','2009-09-21','DISA FSO','policy','The organization establishes implementation guidance for acceptable mobile code and mobile code technologies.','SC-18.3','The Protection Profile for Web Browsers and Application SRG\\nmeet the DoD requirement to establish implementation guidance for acceptable mobile code and mobile code technologies.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the Protection Profile for Web Browsers and Application SRG.','The Protection Profile for Web Browsers and Application SRG\\nmeet the DoD requirement to establish implementation guidance for acceptable mobile code and mobile code technologies.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the Protection Profile for Web Browsers and Application SRG.'),\n('001163','draft','2009-09-21','DISA FSO','policy','The organization authorizes the use of mobile code within the information system.','SC-18.4','The organization being inspected/assessed documents mobile code which is authorized for use within the information system.','The organization conducting the inspection/assessment obtains and examines the documented list of mobile code which is authorized for use within the information system and examines the information system to ensure that all used mobile code is authorized.'),\n('001164','draft','2009-09-21','DISA FSO','policy','The organization monitors the use of mobile code within the information system.','SC-18.5','The organization being inspected/assessed documents and implements a process to monitor the use of mobile code within the information system.','The organization conducting the inspection/assessment obtains and examines the documented process as well as any artifacts applicable to monitoring of mobile code  to ensure the organization being inspected/assessed monitors the use of mobile code within the information system.'),\n('001165','draft','2009-09-21','DISA FSO','policy','The organization controls the use of mobile code within the information system.','SC-18.6','The organization being inspected/assessed documents and implements a process to control the use of mobile code within the information system.','The organization conducting the inspection/assessment obtains and examines the documented process and examines the information system to ensure the organization being inspected/assessed controls the use of mobile code within the information system.'),\n('001166','draft','2009-09-21','DISA FSO','technical','The information system identifies organization-defined unacceptable mobile code.','SC-18(1).1','The organization being inspected/assessed configures the information system to identify  unacceptable mobile code defined in SC-18 (1), CCI 2458.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1166.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  identify  unacceptable mobile code defined in SC-18 (1), CCI 2458.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1166.'),\n('001167','draft','2009-09-21','DISA FSO','policy','The organization ensures the development of mobile code to be deployed in information systems meets organization-defined mobile code requirements.','SC-18(2).1','The organization being inspected/assessed documents and implements a process to develop mobile code IAW the requirements defined in CCI 1168.  ','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed develops mobile code IAW the requirements defined in CCI 1168.'),\n('001168','draft','2009-09-21','DISA FSO','policy','The organization defines requirements for the acquisition, development, and use of mobile code.','SC-18(2).2','The organization being inspected/assessed defines and documents requirements for the acquisition, development, and use of mobile code. The requirements must result in the acquisition and development of mobile code which complies with the Protection Profile for Web Browsers  and Application SRG.\\nDoD has determined the requirements are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented requirements to ensure the organization being inspected/assessed defines requirements for the acquisition, development, and use of mobile code.\\nDoD has determined the requirements are not appropriate to define at the Enterprise level.'),\n('001169','draft','2009-09-21','DISA FSO','technical','The information system prevents the download of organization-defined unacceptable mobile code.','SC-18(3).1','The organization being inspected/assessed configures the information system to prevent the download of unacceptable mobile code defined in CCI 2459.\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1169.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to prevent the download of unacceptable mobile code defined in CCI 2459.\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1169.'),\n('001170','draft','2009-09-21','DISA FSO','technical','The information system prevents the automatic execution of mobile code in organization-defined software applications.','SC-18(4).1','The organization being inspected/assessed configures the information system to prevent the automatic execution of unacceptable mobile code in software applications defined in CCI 1171.\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1170.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to prevent the automatic execution of unacceptable mobile code in software applications defined in CCI 1171.\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1170.'),\n('001171','draft','2009-09-21','DISA FSO','policy','The organization defines software applications in which automatic mobile code execution is to be prohibited.','SC-18(4).2','DoD has defined the software applications in which automatic mobile code execution is to be prohibited as the software applications defined in the Protection Profile for Web Browsers and Application SRG.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\nDoD has defined the software applications in which automatic mobile code execution is to be prohibited as the software applications defined in the Protection Profile for Web Browsers and Application SRG.'),\n('001172','draft','2009-09-21','DISA FSO','policy','The organization defines actions to be enforced by the information system before executing mobile code.','SC-18(4).3','DoD has defined the actions as the user be prompted.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the actions as the user be prompted.'),\n('001173','draft','2009-09-21','DISA FSO','policy','The organization establishes usage restrictions for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.','SC-19.1','The organization being inspected/assessed establishes and documents usage restrictions for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.','The organization conducting the inspection/assessment obtains and examines the documented usage restrictions to ensure the organization being inspected/assessed establishes usage restrictions for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.'),\n('001174','draft','2009-09-21','DISA FSO','policy','The organization establishes implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.','SC-19.2','The Voice and Video over Internet Protocol (V-VoIP) STIG meets the DoD requirement for establishing implementation guidance for Voice over Internet Protocol (VoIP) technologies.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy,  V-VoIP STIG.','The V-VoIP STIG meets the DoD requirement for establishing implementation guidance for Voice over Internet Protocol (VoIP) technologies.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy,  V-VoIP STIG.'),\n('001175','draft','2009-09-21','DISA FSO','policy','The organization authorizes the use of VoIP within the information system.','SC-19.3','The organization being inspected/assessed authorizes any appropriate usage of VoIP  within the information system and documents those authorizations.','The organization conducting the inspection/assessment obtains and examines the documented authorizations and *insert language* to ensure the organization being inspected/assessed authorizes any appropriate usage of VoIP  within the information system and documents those authorizations.'),\n('001176','draft','2009-09-21','DISA FSO','policy','The organization monitors the use of VoIP within the information system.','SC-19.4','The organization being inspected/assessed documents and implements a process to monitor the use of VoIP within the information system.  The organization must maintain an audit trail of monitoring.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trial of monitoring to ensure the organization being inspected/assessed  monitors the use of VoIP within the information system.'),\n('001177','draft','2009-09-21','DISA FSO','policy','The organization controls the use of VoIP within the information system.','SC-19.5','The organization being inspected/assessed designs the information system to control the use of VoIP within the information system','The organization conducting the inspection/assessment obtains and examines network topology diagrams, architecture documentation, or any other documentation identifying the use of VoIP to ensure the organization being inspected/assessed  controls the use of VoIP within the information system.'),\n('001178','draft','2009-09-21','DISA FSO','technical','The information system provides additional data origin authentication artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.','SC-20.1','The organization being inspected/assessed configures the authoritative name server software for external queries to enable DNSSEC and creates resource records with digital signatures (RRSig) for each A record.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that determines the  name server software configuration files and pertains to CCI 1178.','The organization conducting the inspection/assessment:\\n1. inspects the configuration files for the presence of DNSSEC records for each A record hosted in a zone;\\n2. utilizes DNSSEC diagnostic tools, such as dig; and\\n3. performs queries which will exercise the data flow path for authoritative name resolution services.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs that determine the  name server software configuration files and pertain to CCI 1178.'),\n('001179','draft','2009-09-21','DISA FSO','technical','The information system, when operating as part of a distributed, hierarchical namespace, provides the means to indicate the security status of child zones.','SC-20.3','The organization being inspected/assessed configures the authoritative name server software to enable DNSSEC and creates delegation signer (DS) resource records for each child zone and place those records in the parent zone.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that determines the  name server software configuration files and pertains to CCI 1179.','The organization conducting the inspection/assessment inspect the configuration files for the presence of Delegation Signer (DS) Records for any child domains.  Note:  This is only applicable for zones with child domains.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs that determine the  name server software configuration files and pertain to CCI 1179.'),\n('001180','draft','2009-09-21','DISA FSO','technical','The information system performs data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources when requested by client systems.',NULL,NULL,NULL),\n('001181','draft','2009-09-21','DISA FSO','technical','The information system performs data origin authentication and data integrity verification on all resolution responses received whether or not local client systems explicitly request this service.',NULL,NULL,NULL),\n('001182','draft','2009-09-21','DISA FSO','policy','The information systems that collectively provide name/address resolution service for an organization are fault-tolerant.','SC-22.1','The organization being inspected/assessed implements a name service resolution architecture consisting of primary and secondary servers.  The organization must document the architecture in the site security plan.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1182.','The organization conducting the inspection/assessment reviews the sites implementation documentation of the name resolution servers and verifies primary and alternate services are available.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1182.'),\n('001183','draft','2009-09-21','DISA FSO','policy','The information systems that collectively provide name/address resolution service for an organization implement internal/external role separation.','SC-22.2','The organization being inspected/assessed implements a name service resolution architecture where recursive and authoritative server software is not installed on the same information system.  The organization must document the architecture in the site security plan.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1183.','The organization conducting the inspection/assessment reviews the sites implementation documentation of the name resolution servers and verifies authoritative and recursive services are not hosted on the same information system.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1183.'),\n('001184','draft','2009-09-21','DISA FSO','technical','The information system protects the authenticity of communications sessions.','SC-23.1','The organization being inspected/assessed configures the information system to protect the authenticity of communications sessions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1184.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to protect the authenticity of communications sessions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1184.'),\n('001185','draft','2009-09-21','DISA FSO','technical','The information system invalidates session identifiers upon user logout or other session termination.','SC-23(1).1','The organization being inspected/assessed configures the information system to  invalidate session identifiers upon user logout or other session termination.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1185.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  invalidate session identifiers upon user logout or other session termination.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1185.'),\n('001186','draft','2009-09-21','DISA FSO','technical','The information system provides a readily observable logout capability whenever authentication is used to gain access to web pages.',NULL,NULL,NULL),\n('001187','draft','2009-09-21','DISA FSO','technical','The information system generates a unique session identifier for each session.',NULL,NULL,NULL),\n('001188','draft','2009-09-21','DISA FSO','technical','The information system generates unique session identifiers for each session with organization-defined randomness requirements.','SC-23(3).1','The organization being inspected/assessed configures the information system to  generate unique session identifiers  for each session with randomness requirements defined in SC-23 (3), CCI 1189.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1188.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  generate unique session identifiers  for each session with randomness requirements defined in SC-23 (3), CCI 1189.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1188.'),\n('001189','draft','2009-09-21','DISA FSO','policy','The organization defines randomness requirements for generating unique session identifiers.','SC-23(3).2','The organization being inspected/assessed defines and documents randomness requirements for generating unique session identifiers.  DoD has determined the randomness requirements are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented randomness requirements to ensure the organization being inspected/assessed defines randomness requirements for generating unique session identifiers.  DoD has determined the randomness requirements are not appropriate to define at the Enterprise level.'),\n('001190','draft','2009-09-21','DISA FSO','technical','The information system fails to an organization-defined known-state for organization-defined types of failures.','SC-24.1','The organization being inspected/assessed configures the information system to fail to a secure state for failures during system initialization, shutdown, and aborts.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1190.  DoD has defined the known state as secure state.  DoD has defined the types of failures as failures during system initialization, shutdown, and aborts.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  fail to a secure state for failures during system initialization, shutdown, and aborts.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1190.  DoD has defined the known state as secure state.  DoD has defined the types of failures as failures during system initialization, shutdown, and aborts.'),\n('001191','draft','2009-09-21','DISA FSO','policy','The organization defines the known states the information system should fail to in the event of an organization-defined system failure.','SC-24.2','DoD has defined the known state as secure state.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the known state as secure state.'),\n('001192','draft','2009-09-21','DISA FSO','policy','The organization defines types of failures for which the information system should fail to an organization-defined known state.','SC-24.3','DoD has defined the types of failures as failures during system initialization, shutdown, and aborts.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the types of failures as failures during system initialization, shutdown, and aborts.'),\n('001193','draft','2009-09-21','DISA FSO','policy','The organization defines system state information that should be preserved in the event of a system failure.','SC-24.4','DoD has defined system state information as information necessary to determine cause of failure and to return to operations with least disruption to mission/ business processes.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined system state information as information necessary to determine cause of failure and to return to operations with least disruption to mission/ business processes.'),\n('001194','draft','2009-09-21','DISA FSO','policy','The information system employs organization-defined information system components with minimal functionality and information storage.','SC-25.1','The organization being inspected/assessed employs information system components defined in SC-25, CCI 2471 with minimal functionality and information storage.','The organization conducting the inspection/assessment obtains and examines the hardware list to ensure the organization being inspected/assessed employs information system components defined in SC-25, CCI 2471 with minimal functionality and information storage.'),\n('001195','draft','2009-09-21','DISA FSO','policy','The information system includes components specifically designed to be the target of malicious attacks for the purpose of detecting, deflecting, and analyzing such attacks.','SC-26.1','The organization being inspected/assessed designs the information system to include decoy components specifically designed to be the target of malicious attacks for the purpose of detecting, deflecting, and analyzing such attacks.','The organization conducting the inspection/assessment obtains and examines the network topology diagrams, architecture documentation, or any other documentation identifying decoy components to be attacked to ensure the organization being inspected/assessed includes components specifically designed to be the target of malicious attacks for the purpose of detecting, deflecting, and analyzing such attacks.'),\n('001196','draft','2009-09-21','DISA FSO','policy','The information system includes components that proactively seek to identify malicious websites and/or web-based malicious code.','SC-35.1','The organization being inspected/assessed includes components in the information system that proactively seek to identify malicious websites and/or web-based malicious code.','The organization conducting the inspection/assessment obtains and examines the software list to ensure the organization being inspected/assessed includes components in the information system that proactively seek to identify malicious websites and/or web-based malicious code.'),\n('001197','draft','2009-09-21','DISA FSO','policy','The information system includes organization-defined platform-independent applications.','SC-27.1','The organization being inspected/assessed includes platform-independent applications defined in SC-27, CCI 1198.','The organization conducting the inspection/assessment obtains and examines the software list to ensure the organization being inspected/assessed includes platform-independent applications defined in SC-27, CCI 1198.'),\n('001198','draft','2009-09-21','DISA FSO','policy','The organization defines applications that are platform independent.','SC-27.2','The organization being inspected/assessed defines and documents applications that are platform independent.  DoD has determined the applications are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented applications to ensure the organization being inspected/assessed defines applications that are platform independent.  DoD has determined the applications are not appropriate to define at the Enterprise level.'),\n('001199','draft','2009-09-21','DISA FSO','technical','The information system protects the confidentiality and/or integrity of organization-defined information at rest.','SC-28.1','The organization being inspected/assessed configures the information system to protect the confidentiality and/or integrity of organization-defined information at rest.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1199.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to protect the confidentiality and/or integrity of organization-defined information at rest.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1199.'),\n('001200','draft','2009-09-21','DISA FSO','technical','The organization employs cryptographic mechanisms to prevent unauthorized disclosure of information at rest unless otherwise protected by alternative physical measures.',NULL,NULL,NULL),\n('001201','draft','2009-09-21','DISA FSO','policy','The organization employs a diverse set of information technologies for organization-defined information system components in the implementation of the information system.','SC-29.1','The organization being inspected/assessed designs the information system to employ a diverse set of information technologies for information system components defined in SC-29, CCI 2480 in the implementation of the information system.','The organization conducting the inspection/assessment obtains and examines the hardware and software lists to ensure the organization being inspected/assessed  employs a diverse set of information technologies for information system components defined in SC-29, CCI 2480 in the implementation of the information system.'),\n('001202','draft','2009-09-21','DISA FSO','policy','The organization employs virtualization techniques to present information system components as other types of components, or components with differing configurations.',NULL,NULL,NULL),\n('001203','draft','2009-09-21','DISA FSO','policy','The organization employs virtualization techniques to support the deployment of a diversity of operating systems that are changed on an organization-defined frequency.','SC-29(1).1','The organization being inspected/assessed designs the information system to employ  virtualization techniques to support the deployment of a diversity of operating systems that are changed on the frequency defined in SC-29 (1), CCI 1204.','The organization conducting the inspection/assessment obtains and examines the hardware and software lists to ensure the organization being inspected/assessed employs virtualization techniques to support the deployment of a diversity of operating systems that are changed on the frequency defined in SC-29 (1), CCI 1204.'),\n('001204','draft','2009-09-21','DISA FSO','policy','The organization defines the frequency of changes to operating systems and applications to support a diversity of deployments.','SC-29(1).2','The organization being inspected/assessed defines and documents the  frequency of changes to operating systems and applications to support a diversity of deployments.  DoD has determined the frequency is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed defines the frequency of changes to operating systems and applications to support a diversity of deployments.  DoD has determined the frequency is not appropriate to define at the Enterprise level.'),\n('001205','draft','2009-09-21','DISA FSO','policy','The organization employs randomness in the implementation of the virtualization techniques.',NULL,NULL,NULL),\n('001206','draft','2009-09-21','DISA FSO','policy','The organization requires that information system developers/integrators perform a covert channel analysis to identify those aspects of system communication that are potential avenues for covert storage and timing channels.',NULL,NULL,NULL),\n('001207','draft','2009-09-21','DISA FSO','policy','The organization tests a subset of the identified covert channels to determine which channels are exploitable.','SC-31(1).1','The organization being inspected/assessed tests a subset of the identified covert channels to determine which channels are exploitable.  The organization must maintain an audit trail of testing.','The organization conducting the inspection/assessment obtains and examines the test results to ensure the organization being inspected/assessed tests a subset of the identified covert channels to determine which channels are exploitable.'),\n('001208','draft','2009-09-21','DISA FSO','policy','The organization partitions the information system into components residing in separate physical domains (or environments) as deemed necessary.',NULL,NULL,NULL),\n('001209','draft','2009-09-21','DISA FSO','technical','The information system protects the integrity of information during the processes of data aggregation, packaging, and transformation in preparation for transmission.',NULL,NULL,NULL),\n('001210','draft','2009-09-21','DISA FSO','technical','The information system, at organization-defined information system components, loads and executes the operating environment from hardware-enforced, read-only media.','SC-34.2','The organization being inspected/assessed configures the information system to load and execute the operating environment from hardware-enforced, read-only media at information system components defined in SC-34, CCI 1212.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1210.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to load and execute the operating environment from hardware-enforced, read-only media at information system components defined in SC-34, CCI 1212.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1210.'),\n('001211','draft','2009-09-21','DISA FSO','technical','The information system, at organization-defined information system components, loads and executes organization-defined applications from hardware-enforced, read-only media.','SC-34.3','The organization being inspected/assessed configures the information system to load and execute applications defined in SC-34, CCI  1213 from hardware-enforced, read-only media at information system components defined in SC-34, CCI 1212.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1211.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to load and execute applications defined in SC-34, CCI  1213 from hardware-enforced, read-only media at information system components defined in SC-34, CCI 1212.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1211.'),\n('001212','draft','2009-09-21','DISA FSO','policy','The organization defines information system components on which the operating environment and organization-defined applications are loaded and executed from hardware-enforced, read-only media.','SC-34.1','The organization being inspected/assessed defines and documents  information system components for which the operating environment and organization-defined applications are loaded and executed from hardware-enforced, read-only media.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines information system components for which the operating environment and organization-defined applications are loaded and executed from hardware-enforced, read-only media.   DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('001213','draft','2009-09-21','DISA FSO','policy','The organization defines applications that will be loaded and executed from hardware-enforced, read-only media.','SC-34.4','The organization being inspected/assessed defines and documents applications that will be loaded and executed from hardware-enforced, read-only media.  DoD has determined the applications are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented applications to ensure the organization being inspected/assessed defines applications that will be loaded and executed from hardware-enforced, read-only media.  DoD has determined the applications are not appropriate to define at the Enterprise level.'),\n('001214','draft','2009-09-21','DISA FSO','policy','The organization employs organization-defined information system components with no writeable storage that are persistent across component restart or power on/off.','SC-34(1).1','The organization being inspected/assessed designs the information system to employ  information system components defined in SC-34 (1), CCI 1215 with no writeable storage that are persistent across component restart or power on/off.','The organization conducting the inspection/assessment obtains and examines the hardware list to ensure the organization being inspected/assessed employs information system components defined in SC-34 (1), CCI 1215 with no writeable storage that are persistent across component restart or power on/off.'),\n('001215','draft','2009-09-21','DISA FSO','policy','The organization defines the information system components to be employed with no writeable storage.','SC-34(1).2','The organization being inspected/assessed defines and documents  the information system components to be employed with no writeable storage.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components to be employed with no writeable storage.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('001216','draft','2009-09-21','DISA FSO','policy','The organization protects the integrity of information prior to storage on read-only media.','SC-34(2).1','The organization being inspected/assessed documents and implements mechanisms to protect the integrity of the information prior to storage on read-only media.','The organization conducting the inspection/assessment obtains and examines the documented mechanisms to ensure the organization being inspected/assessed protects the integrity of the information prior to storage on read-only media.'),\n('001217','draft','2009-09-22','DISA FSO','policy','The organization develops and documents a system and information integrity policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','SI-1.2','Documenting and implementing the Risk Management Framework (RMF) for DoD IT (DoDI 8510.01) meets the DoD requirement for a system and information integrity policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, Risk Management Framework (RMF) for DoD IT (DoDI 8510.01).','Documenting and implementing the Risk Management Framework (RMF) for DoD IT (DoDI 8510.01) meets the DoD requirement for a system and information integrity policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, Risk Management Framework (RMF) for DoD IT (DoDI 8510.01).'),\n('001218','draft','2009-09-22','DISA FSO','policy','The organization disseminates the system and information integrity policy to organization-defined personnel or roles.','SI-1.3','DoD disseminates DoDI 8510.01 via the DoD Issuances website (http://www.dtic.mil/whs/directives/corres/dir.html) that meets the DoD requirement for a system and information integrity policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, Risk Management Framework (RMF) for DoD IT (DoDI 8510.01).','Documenting and implementing the Risk Management Framework (RMF) for DoD IT (DoDI 8510.01) meets the DoD requirement for a system and information integrity policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, Risk Management Framework (RMF) for DoD IT (DoDI 8510.01).'),\n('001219','draft','2009-09-22','DISA FSO','policy','The organization reviews and updates system and information integrity policy in accordance with organization-defined frequency.','SI-1.6','Documenting and implementing the Risk Management Framework (RMF) for DoD IT (DoDI 8510.01) meets the DoD requirement for a system and information integrity policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, Risk Management Framework (RMF) for DoD IT (DoDI 8510.01).','Documenting and implementing the Risk Management Framework (RMF) for DoD IT (DoDI 8510.01) meets the DoD requirement for a system and information integrity policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, Risk Management Framework (RMF) for DoD IT (DoDI 8510.01).'),\n('001220','draft','2009-09-22','DISA FSO','policy','The organization develops and documents procedures to facilitate the implementation of the system and information integrity policy and associated system integrity controls.','SI-1.4','Documenting and implementing the Risk Management Framework (RMF) for DoD IT (DoDI 8510.01) meets the DoD requirement for a system and information integrity procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, Risk Management Framework (RMF) for DoD IT (DoDI 8510.01).','Documenting and implementing the Risk Management Framework (RMF) for DoD IT (DoDI 8510.01) meets the DoD requirement for a system and information integrity procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, Risk Management Framework (RMF) for DoD IT (DoDI 8510.01) .'),\n('001221','draft','2009-09-22','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the system and information integrity policy and associated system integrity controls.','SI-1.5','DoD disseminates DoDI 8510.01 via the DoD Issuances website (http://www.dtic.mil/whs/directives/corres/dir.html) that meets the DoD requirement for a system and information integrity policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, Risk Management Framework (RMF) for DoD IT (DoDI 8510.01).','Documenting and implementing the Risk Management Framework (RMF) for DoD IT (DoDI 8510.01) meets the DoD requirement for a system and information integrity procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, Risk Management Framework (RMF) for DoD IT (DoDI 8510.01).'),\n('001222','draft','2009-09-22','DISA FSO','policy','The organization reviews and updates system and information integrity procedures in accordance with organization-defined frequency.','SI-1.8','Documenting and implementing the Risk Management Framework (RMF) for DoD IT (DoDI 8510.01) meets the DoD requirement for a system and information integrity procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, Risk Management Framework (RMF) for DoD IT (DoDI 8510.01).','Documenting and implementing the Risk Management Framework (RMF) for DoD IT (DoDI 8510.01) meets the DoD requirement for a system and information integrity procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, Risk Management Framework (RMF) for DoD IT (DoDI 8510.01).'),\n('001223','draft','2009-09-22','DISA FSO','policy','The organization defines the frequency of system and information integrity policy reviews and updates.','SI-1.7','DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10.'),\n('001224','draft','2009-09-22','DISA FSO','policy','The organization defines the frequency of system and information integrity procedure reviews and updates.','SI-1.9','DoD has defined the frequency as reviewed annually - updated as appropriate.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.'),\n('001225','draft','2009-09-22','DISA FSO','policy','The organization identifies information system flaws.','SI-2.1','The organization being inspected/assessed documents and implements a process to identify information system flaws.  The process shall include  review of the system through automated scans and manual checks to determine the existence of flaws such as IAVM, CVE, or other resources.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed identifies information system flaws.'),\n('001226','draft','2009-09-22','DISA FSO','policy','The organization reports information system flaws.','SI-2.2','The organization being inspected/assessed reports information system flaws according to DoD Cybersecurity policy and organizational roles and responsibilities.  The organization must report information system flaws in their POA&M.','The organization conducting the inspection/assessment obtains and examines the authorization package, verifies the POA&M is up to date and includes recently identified information system flaws, and verifies that the organization has notified appropriate personnel as defined by DoD Cybersecurity policy and organizational roles and responsibilities.'),\n('001227','draft','2009-09-22','DISA FSO','policy','The organization corrects information system flaws.','SI-2.3','The organization being inspected/assessed corrects information system flaws within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).\\n\\nThe organization documents the corrections on their POA&M.\\n\\nDoD has defined the time period as within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).','The organization conducting the inspection/assessment obtains and examines the information system POA&M and examines the information system to ensure the organization being inspected/assessed corrects information system flaws.'),\n('001228','draft','2009-09-22','DISA FSO','policy','The organization tests software updates related to flaw remediation for effectiveness before installation.','SI-2.4','The organization being inspected/assessed documents and implements a process to test  software updates related to flaw remediation for effectiveness before installation.  If the software update is being provided by a vendor who has documented the effectiveness of the update in fixing the affected IAVM/CVE, further testing by the organization may not be required.','The organization conducting the inspection/assessment obtains and examines the documented process and test results to ensure the organization being inspected/assessed tests software updates related to flaw remediation for effectiveness before installation.'),\n('001229','draft','2009-09-22','DISA FSO','policy','The organization tests software updates related to flaw remediation for potential side effects before installation.','SI-2.5','The organization being inspected/assessed documents and implements a process for regression testing IAW CM-4 to identify any potential side effects before installation of software updates.','The organization conducting the inspection/assessment obtains and examines the documented process and test results to ensure the organization being inspected/assessed tests software updates related to flaw remediation for potential side effects before installation.'),\n('001230','draft','2009-09-22','DISA FSO','policy','The organization incorporates flaw remediation into the organizational configuration management process.','SI-2.12','The organization being inspected/assessed documents within their configuration management plan, flaw remediation processes.','The organization conducting the inspection/assessment obtains and examines the configuration management plan to ensure that it incorporates flaw remediation.'),\n('001231','draft','2009-09-22','DISA FSO','policy','The organization centrally manages the flaw remediation process.','SI-2(1).1','The organization being inspected/assessed documents and implements a process to centrally manage the flaw remediation process.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  centrally manages the flaw remediation process.'),\n('001232','draft','2009-09-22','DISA FSO','technical','The organization installs software updates automatically.',NULL,NULL,NULL),\n('001233','draft','2009-09-22','DISA FSO','technical','The organization employs automated mechanisms on an organization-defined frequency to determine the state of information system components with regard to flaw remediation.','SI-2(2).1','The organization being inspected/assessed configures the information system to employ automated mechanisms continuously with HBSS; 30 days for any additional internal network scans not covered by HBSS; annually for external scans by (Computer Network Defense Service Provider) CNDSP to determine the state of information system components with regard to flaw remediation.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1233.  DoD has defined the frequency as continuously with HBSS; 30 days for any additional internal network scans not covered by HBSS; annually for external scans by (Computer Network Defense Service Provider) CNDSP.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to employ automated mechanisms  continuously with HBSS; 30 days for any additional internal network scans not covered by HBSS; annually for external scans by (Computer Network Defense Service Provider) CNDSP to determine the state of information system components with regard to flaw remediation.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1233.  DoD has defined the frequency as continuously with HBSS; 30 days for any additional internal network scans not covered by HBSS; annually for external scans by (Computer Network Defense Service Provider) CNDSP.'),\n('001234','draft','2009-09-22','DISA FSO','policy','The organization defines a frequency for employing automated mechanisms to determine the state of information system components with regard to flaw remediation.','SI-2(2).2','DoD has defined the frequency as continuously with HBSS; 30 days for any additional internal network scans not covered by HBSS; annually for external scans by (Computer Network Defense Service Provider) CNDSP.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as continuously with HBSS; 30 days for any additional internal network scans not covered by HBSS; annually for external scans by (Computer Network Defense Service Provider) CNDSP.'),\n('001235','draft','2009-09-22','DISA FSO','policy','The organization measures the time between flaw identification and flaw remediation.','SI-2(3).1','The organization being inspected/assessed documents and implements a process to measure the time between flaw identification and flaw remediation.  The organization must maintain an audit trail of flaw identification and flaw remediation.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of flaw identification and flaw remediation to ensure the organization being inspected/assessed measures the time between flaw identification and flaw remediation.'),\n('001236','draft','2009-09-22','DISA FSO','policy','The organization defines benchmarks for the time taken to apply corrective actions after flaw identification.','SI-2(3).2','DoD has defined the benchmarks as within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the benchmarks as within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).'),\n('001237','draft','2009-09-22','DISA FSO','technical','The organization employs automated patch management tools to facilitate flaw remediation to organization-defined information system components.',NULL,NULL,NULL),\n('001238','draft','2009-09-22','DISA FSO','policy','The organization defines information system components for which automated patch management tools are to be employed to facilitate flaw remediation.',NULL,NULL,NULL),\n('001239','draft','2009-09-22','DISA FSO','technical','The organization employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means or inserted through the exploitation of information system vulnerabilities.',NULL,NULL,NULL),\n('001240','draft','2009-09-22','DISA FSO','technical','The organization updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures.','SI-3.5','The organization being inspected/assessed configures the information system to update malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1240.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to update malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1240.'),\n('001241','draft','2009-09-22','DISA FSO','technical','The organization configures malicious code protection mechanisms to perform periodic scans of the information system on an organization-defined frequency.','SI-3.8','The organization being inspected/assessed configures malicious code protection mechanisms to perform periodic scans of the information system on every 7 days.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1241.  DoD has defined the frequency as every 7 days.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures malicious code protection mechanisms to perform periodic scans of the information system on every 7 days.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1241.  DoD has defined the frequency as every 7 days.'),\n('001242','draft','2009-09-22','DISA FSO','technical','The organization configures malicious code protection mechanisms to perform real-time scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy.','SI-3.9','The organization being inspected/assessed configures malicious code protection mechanisms to perform real-time scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1242.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures malicious code protection mechanisms to perform real-time scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1242.'),\n('001243','draft','2009-09-22','DISA FSO','technical','The organization configures malicious code protection mechanisms to perform organization-defined action(s) in response to malicious code detection.','SI-3.10','The organization being inspected/assessed configures malicious code protection mechanisms to perform block and quarantine malicious code and then send an alert to the administrator immediately in near real-time in response to malicious code detection.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1243.  DoD has defined the actions as block and quarantine malicious code and then send an alert to the administrator immediately in near real-time.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures malicious code protection mechanisms to perform block and quarantine malicious code and then send an alert to the administrator immediately in near real-time in response to malicious code detection.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1243.   DoD has defined the actions as block and quarantine malicious code and then send an alert to the administrator immediately in near real-time.'),\n('001244','draft','2009-09-22','DISA FSO','policy','The organization defines one or more actions to perform in response to malicious code detection, such as blocking malicious code, quarantining malicious code, or sending alerts to administrators.','SI-3.11','DoD has defined the actions as block and quarantine malicious code and then send an alert to the administrator immediately in near real-time.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the actions as block and quarantine malicious code and then send an alert to the administrator immediately in near real-time.'),\n('001245','draft','2009-09-22','DISA FSO','policy','The organization addresses the receipt of false positives during malicious code detection and eradication, and the resulting potential impact on the availability of the information system.','SI-3.12','The organization being inspected/assessed configures the information system to address the receipt of false positives during malicious code detection and eradication, and the resulting potential impact on the availability of the information system.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1245.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to address the receipt of false positives during malicious code detection and eradication, and the resulting potential impact on the availability of the information system.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1245.'),\n('001246','draft','2009-09-22','DISA FSO','policy','The organization centrally manages malicious code protection mechanisms.','SI-3(1).1','The organization being inspected/assessed documents and implements a process to centrally manage malicious code protection mechanisms.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed centrally manages malicious code protection mechanisms.'),\n('001247','draft','2009-09-22','DISA FSO','technical','The information system automatically updates malicious code protection mechanisms.','SI-3(2).1','The organization being inspected/assessed configures the information system to  automatically update malicious code protection mechanisms.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1247.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically update malicious code protection mechanisms.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1247.'),\n('001248','draft','2009-09-22','DISA FSO','technical','The information system prevents non-privileged users from circumventing malicious code protection capabilities.',NULL,NULL,NULL),\n('001249','draft','2009-09-22','DISA FSO','technical','The information system updates malicious code protection mechanisms only when directed by a privileged user.','SI-3(4).1','The organization being inspected/assessed configures the information system to update malicious code protection mechanisms only when directed by a privileged user.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1249.  This control enhancement may be appropriate for situations where for reasons of security or operational continuity, updates are only applied when selected/approved by designated organizational personnel.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  update malicious code protection mechanisms only when directed by a privileged user.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1249.'),\n('001250','draft','2009-09-22','DISA FSO','technical','The organization does not allow users to introduce removable media into the information system.',NULL,NULL,NULL),\n('001251','draft','2009-09-22','DISA FSO','policy','The organization tests malicious code protection mechanisms on an organization-defined frequency by introducing a known benign, non-spreading test case into the information system.','SI-3(6).1','The organization being inspected/assessed documents and implement a process to test malicious code protection mechanisms twice annually or when substantial changes are made to the malicious code protection mechanisms by introducing a known benign, non-spreading test case into the information system.  DoD has defined the frequency as twice annually or when substantial changes are made to the malicious code protection mechanisms.','The organization conducting the inspection/assessment obtains and examines the documented process and test results to ensure the organization being inspected/assessed tests malicious code protection mechanisms twice annually or when substantial changes are made to the malicious code protection mechanisms by introducing a known benign, non-spreading test case into the information system.  DoD has defined the frequency as twice annually or when substantial changes are made to the malicious code protection mechanisms.'),\n('001252','draft','2009-09-22','DISA FSO','policy','The organization monitors events on the information system in accordance with organization-defined monitoring objectives and detects information system attacks.',NULL,NULL,NULL),\n('001253','draft','2009-09-22','DISA FSO','policy','The organization defines the objectives of monitoring for attacks and indicators of potential attacks on the information system.','SI-4.1','DoD has defined the monitoring objectives as sensor placement and monitoring requirements within CJCSI 6510.01F.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the monitoring objectives as sensor placement and monitoring requirements within CJCSI 6510.01F.'),\n('001254','draft','2009-09-22','DISA FSO','policy','The organization identifies unauthorized use of the information system.',NULL,NULL,NULL),\n('001255','draft','2009-09-22','DISA FSO','policy','The organization deploys monitoring devices strategically within the information system to collect organization-determined essential information.','SI-4.8','The organization being inspected/assessed documents and implements a process to  deploy monitoring devices strategically within the information system to collect organization determined essential information.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  deploys monitoring devices strategically within the information system to collect organization determined essential information.'),\n('001256','draft','2009-09-22','DISA FSO','policy','The organization deploys monitoring devices at ad hoc locations within the system to track specific types of transactions of interest to the organization.','SI-4.9','The organization being inspected/assessed documents and implements a process to  deploy monitoring devices at ad hoc locations within the system to track specific types of transactions of interest to the organization.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  deploys monitoring devices at ad hoc locations within the system to track specific types of transactions of interest to the organization.'),\n('001257','draft','2009-09-22','DISA FSO','policy','The organization heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information.','SI-4.13','The organization being inspected/assessed documents and implements a process to  heighten the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information.'),\n('001258','draft','2009-09-22','DISA FSO','policy','The organization obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations.','SI-4.14','The organization being inspected/assessed  obtains and documents legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations.','The organization conducting the inspection/assessment obtains and examines the documented legal opinion to ensure the organization being inspected/assessed obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations.'),\n('001259','draft','2009-09-22','DISA FSO','technical','The organization interconnects and configures individual intrusion detection tools into a systemwide intrusion detection system using common protocols.',NULL,NULL,NULL),\n('001260','draft','2009-09-22','DISA FSO','policy','The organization employs automated tools to support near real-time analysis of events.','SI-4(2).1','The organization being inspected/assessed documents and implements automated tools to support near real-time analysis of events.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated tools to ensure the organization being inspected/assessed employs automated tools to support near real-time analysis of events.  The organization being inspected/assessed may be required to demonstrate use of their automated tools.'),\n('001261','draft','2009-09-22','DISA FSO','policy','The organization employs automated tools to integrate intrusion detection tools into access control and flow control mechanisms for rapid response to attacks by enabling reconfiguration of these mechanisms in support of attack isolation and elimination.',NULL,NULL,NULL),\n('001262','draft','2009-09-22','DISA FSO','technical','The information system monitors inbound and outbound communications for unusual or unauthorized activities or conditions.',NULL,NULL,NULL),\n('001263','draft','2009-09-22','DISA FSO','technical','The information system provides near real-time alerts when any of the organization-defined list of compromise or potential compromise indicators occurs.',NULL,NULL,NULL),\n('001264','draft','2009-09-22','DISA FSO','policy','The organization defines indicators of compromise or potential compromise to the security of the information system which will result in information system alerts being provided to organization-defined personnel or roles.','SI-4(5).1','DoD has defined the compromise indicators as real time intrusion detection and when there are threats identified by authoritative sources (e.g. CTOs) and IAW incident categories I, II, IV, & VII  within CJCSM 6510.01B.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the compromise indicators as real time intrusion detection and when there are threats identified by authoritative sources (e.g. CTOs) and IAW incident categories I, II, IV, & VII  within CJCSM 6510.01B.'),\n('001265','draft','2009-09-22','DISA FSO','technical','The information system prevents non-privileged users from circumventing intrusion detection and prevention capabilities.',NULL,NULL,NULL),\n('001266','draft','2009-09-22','DISA FSO','technical','The information system notifies an organization-defined list of incident response personnel (identified by name and/or by role) of detected suspicious events.','SI-4(7).1','The organization being inspected/assessed configures the information system to notify incident response personnel defined in the incident response plan of detected suspicious events.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1266.  DoD has defined the incident response personnel as incident response personnel defined in the incident response plan.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to notify incident response personnel defined in the incident response plan of detected suspicious events.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1266.  DoD has defined the incident response personnel as incident response personnel defined in the incident response plan.'),\n('001267','draft','2009-09-22','DISA FSO','policy','The organization defines a list of incident response personnel (identified by name and/or by role) to be notified of detected suspicious events.','SI-4(7).2','DoD has defined the incident response personnel as incident response personnel defined in the incident response plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the incident response personnel as incident response personnel defined in the incident response plan.'),\n('001268','draft','2009-09-22','DISA FSO','policy','The organization defines a list of least-disruptive actions to be taken by the information system to terminate suspicious events.','SI-4(7).3','The organization being inspected/assessed defines and documents a list of least-disruptive actions to be taken by the information system to terminate suspicious events.  DoD has determined the least-disruptive actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented list of least-disruptive actions to ensure the organization being inspected/assessed  defines a list of least-disruptive actions to be taken by the information system to terminate suspicious events.  DoD has determined the least-disruptive actions are not appropriate to define at the Enterprise level.'),\n('001269','draft','2009-09-22','DISA FSO','technical','The organization protects information obtained from intrusion monitoring tools from unauthorized access, modification, and deletion.',NULL,NULL,NULL),\n('001270','draft','2009-09-22','DISA FSO','policy','The organization tests intrusion monitoring tools at an organization-defined frequency.','SI-4(9).1','The organization being inspected/assessed documents and implements a process to test intrusion monitoring tools every 30 days.  The organization must maintain an audit trail of test results.  DoD has defined the frequency as every 30 days.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of test results to ensure the organization being inspected/assessed tests intrusion monitoring tools every 30 days.  DoD has defined the frequency as every 30 days.'),\n('001271','draft','2009-09-22','DISA FSO','policy','The organization defines the frequency for testing intrusion monitoring tools.','SI-4(9).2','DoD has defined the frequency as every 30 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every 30 days.'),\n('001272','draft','2009-09-22','DISA FSO','technical','The organization makes provisions so encrypted traffic is visible to information system monitoring tools.',NULL,NULL,NULL),\n('001273','draft','2009-09-22','DISA FSO','policy','The organization analyzes outbound communications traffic at the external boundary of the information system to discover anomalies.','SI-4(11).1','The organization being inspected/assessed documents and implements a process to analyze outbound communications traffic at the external boundary of the information system to discover anomalies.  The organization must maintain a record of any discovered anomalies.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of any discovered anomalies to ensure the organization being inspected/assessed analyzes outbound communications traffic at the external boundary of the information system to discover anomalies.'),\n('001274','draft','2009-09-22','DISA FSO','policy','The organization employs automated mechanisms to alert security personnel of organization-defined inappropriate or unusual activities with security implications.','SI-4(12).1','The organization being inspected/assessed documents and implements automated mechanisms to alert security personnel when there are threats identified by authoritative sources (e.g. CTOs) and IAW  with CJCSM 6510.01B.  For automated alert mechanisms that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1274.  DoD has defined the activities that trigger alerts as when there are threats identified by authoritative sources (e.g. CTOs) and IAW  with CJCSM 6510.01B.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms used to alert security personnel when there are threats identified by authoritative sources (e.g. CTOs) and IAW  with CJCSM 6510.01B.  For automated alert mechanisms that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1274.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.  DoD has defined the activities that trigger alerts as when there are threats identified by authoritative sources (e.g. CTOs) and IAW  with CJCSM 6510.01B.'),\n('001275','draft','2009-09-22','DISA FSO','policy','The organization defines the activities which will trigger alerts to security personnel of inappropriate or unusual activities.','SI-4(12).2','DoD has defined the activities that trigger alerts as when there are threats identified by authoritative sources (e.g. CTOs) and IAW  with CJCSM 6510.01B.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the activities that trigger alerts as when there are threats identified by authoritative sources (e.g. CTOs) and IAW  with CJCSM 6510.01B.'),\n('001276','draft','2009-09-22','DISA FSO','policy','The organization analyzes communications traffic/event patterns for the information system.','SI-4(13).1','The organization being inspected/assessed documents and implements a process to analyze communications traffic/event patterns for the information system.  The organization must maintain a record of the analysis.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of analysis to ensure the organization being inspected/assessed analyzes communications traffic/event patterns for the information system.'),\n('001277','draft','2009-09-22','DISA FSO','policy','The organization develops profiles representing common traffic patterns and/or events.','SI-4(13).2','The organization being inspected/assessed develops and documents profiles representing common traffic patterns and/or events.','The organization conducting the inspection/assessment obtains and examines the documented profiles to ensure the organization being inspected/assessed develops profiles representing common traffic patterns and/or events.'),\n('001278','draft','2009-09-22','DISA FSO','policy','The organization uses the traffic/event profiles in tuning system monitoring devices to reduce the number of false positives to an organization-defined measure of false positives and the number of false negatives to an organization-defined measure of false negatives.',NULL,NULL,NULL),\n('001279','draft','2009-09-22','DISA FSO','policy','The organization defines the respective measurements to which the organization must tune system monitoring devices to reduce the number of false positives.',NULL,NULL,NULL),\n('001280','draft','2009-09-22','DISA FSO','policy','The organization defines the respective measurements to which the organization must tune system monitoring devices to reduce the number of false negatives.',NULL,NULL,NULL),\n('001281','draft','2009-09-22','DISA FSO','policy','The organization employs a wireless intrusion detection system.',NULL,NULL,NULL),\n('001282','draft','2009-09-22','DISA FSO','policy','The organization employs an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.','SI-4(15).1','The organization being inspected/assessed documents and implements an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified  intrusion detection system to ensure the organization being inspected/assessed employs an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.  The organization being inspected/assessed may be required to demonstrate use of the  intrusion detection system.'),\n('001283','draft','2009-09-22','DISA FSO','policy','The organization correlates information from monitoring tools employed throughout the information system.','SI-4(16).1','The organization being inspected/assessed documents and implements a process to correlate information from monitoring tools employed throughout the information system.','The organization conducting the inspection/assessment obtains and examines the documented process and the correlated results to ensure the organization being inspected/assessed correlates information from monitoring tools employed throughout the information system.'),\n('001284','draft','2009-09-22','DISA FSO','policy','The organization correlates information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.','SI-4(17).1','The organization being inspected/assessed documents and implements a process to correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.','The organization conducting the inspection/assessment obtains and examines the documented process and the correlated results to ensure the organization being inspected/assessed correlates information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.'),\n('001285','draft','2009-09-22','DISA FSO','policy','The organization receives information system security alerts, advisories, and directives from organization-defined external organizations on an ongoing basis.','SI-5.1','The organization being inspected/assessed receives information system security alerts, advisories, and directives from at a minimum, USCYBERCOM on an ongoing basis.  DoD has defined the external organizations as at a minimum, USCYBERCOM.','The organization conducting the inspection/assessment obtains and examines alerts, advisories, and directives received by the organization being inspected/assessed to ensure they receive information system security alerts, advisories, and directives from at a minimum, USCYBERCOM on an ongoing basis.  DoD has defined the external organizations as at a minimum, USCYBERCOM.'),\n('001286','draft','2009-09-22','DISA FSO','policy','The organization generates internal security alerts, advisories, and directives as deemed necessary.','SI-5.3','The organization being inspected/assessed documents and implements a process to generate internal security alerts, advisories, and directives as deemed necessary.','The organization conducting the inspection/assessment obtains and examines documented process as well as the generated internal security alerts, advisories, and directives to ensure the organization being inspected/assessed generates internal security alerts, advisories, and directives as deemed necessary.'),\n('001287','draft','2009-09-22','DISA FSO','policy','The organization disseminates security alerts, advisories, and directives to organization-defined personnel or roles, organization-defined elements within the organization, and/or organization-defined external organizations.','SI-5.4','The organization being inspected/assessed disseminates security alerts, advisories, and directives to the ISSO and ISSM and/or external organizations defined in SI-5, CCI 2694.  DoD has defined the personnel or roles as the ISSO and ISSM.','The organization conducting the inspection/assessment obtains and examines any applicable artifacts showing dissemination of security alerts, advisories, and directives to ensure the organization being inspected/assessed disseminates security alerts, advisories, and directives to the ISSO and ISSM and/or external organizations defined in SI-5, CCI 2694.  DoD has defined the personnel or roles as the ISSO and ISSM.'),\n('001288','draft','2009-09-22','DISA FSO','policy','The organization defines the personnel or roles to whom the organization will disseminate security alerts, advisories, and directives.','SI-5.5','DoD has defined the personnel or roles as the ISSO and ISSM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as the ISSO and ISSM.'),\n('001289','draft','2009-09-22','DISA FSO','policy','The organization implements security directives in accordance with established time frames, or notifies the issuing organization of the degree of noncompliance.','SI-5.8','The organization being inspected/assessed implements security directives in accordance with established time frames, or notifies the issuing organization of the degree of noncompliance.','The organization conducting the inspection/assessment examines the information system and obtains and examines records of compliance and/or non-compliance reporting  to ensure that security directives have been implemented in accordance with established time frames, or notifies the issuing organization of the degree of noncompliance.'),\n('001290','draft','2009-09-22','DISA FSO','policy','The organization employs automated mechanisms to make security alert and advisory information available throughout the organization.','SI-5(1).1','The organization being inspected/assessed documents and implements automated mechanisms to make security alert and advisory information available throughout the organization.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms to ensure the organization being inspected/assessed  employs automated mechanisms to make security alert and advisory information available throughout the organization.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('001291','draft','2009-09-22','DISA FSO','technical','The information system verifies the correct operation of security functions in accordance with organization-defined conditions and in accordance with organization-defined frequency (if periodic verification).',NULL,NULL,NULL),\n('001292','draft','2009-09-22','DISA FSO','policy','The organization defines the appropriate conditions, including the system transitional states if applicable, for verifying the correct operation of security functions.',NULL,NULL,NULL),\n('001293','draft','2009-09-22','DISA FSO','policy','The organization defines the information system responses and alternative action(s) to anomalies discovered during security function verification.',NULL,NULL,NULL),\n('001294','draft','2009-09-22','DISA FSO','technical','The information system notifies organization-defined personnel or roles of failed security verification tests.','SI-6.6','The organization being inspected/assessed configures the information system to notify the ISSO and ISSM of failed security verification tests.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1294.  DoD has defined the personnel or roles as the ISSO and ISSM.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  notify the ISSO and ISSM of failed security verification tests.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1294.  DoD has defined the personnel or roles as the ISSO and ISSM.'),\n('001295','draft','2009-09-22','DISA FSO','technical','The information system implements automated mechanisms to support the management of distributed security testing.','SI-6(2).1','The organization being inspected/assessed configures the information system to implement automated mechanisms to support the management of distributed security testing.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1295.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement automated mechanisms to support the management of distributed security testing.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1295.'),\n('001296','draft','2009-09-22','DISA FSO','policy','The organization reports the results of security function verification to organization-defined personnel or roles.','SI-6(3).1','The organization being inspected/assessed documents and implements a process to report the result of security function verification to at a minimum, the ISSO and ISSM.  The organization must maintain an audit trail of reporting.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of reporting to ensure the organization being inspected/assessed reports the result of security function verification to at a minimum, the ISSO and ISSM.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.'),\n('001297','draft','2009-09-22','DISA FSO','technical','The information system detects unauthorized changes to software and information.',NULL,NULL,NULL),\n('001298','draft','2009-09-22','DISA FSO','policy','The organization reassesses the integrity of software and information by performing, on an organization-defined frequency, integrity scans of the information system.',NULL,NULL,NULL),\n('001299','draft','2009-09-22','DISA FSO','policy','The organization defines the frequency of integrity scans to be performed on the information system.',NULL,NULL,NULL),\n('001300','draft','2009-09-22','DISA FSO','policy','The organization employs automated tools that provide notification to organization-defined personnel or roles upon discovering discrepancies during integrity verification.','SI-7(2).1','The organization being inspected/assessed documents and implements automated tools that provide notification to at a minimum, the ISSO and ISSM upon discovering discrepancies during integrity verification.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated tools to ensure the organization being inspected/assessed employs automated tools that provide notification to at a minimum, the ISSO and ISSM upon discovering discrepancies during integrity verification.  The organization being inspected/assessed may be required to demonstrate use of their identified automated tools.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.'),\n('001301','draft','2009-09-22','DISA FSO','policy','The organization employs centrally managed integrity verification tools.','SI-7(3).1','The organization being inspected/assessed documents and implements centrally managed integrity verification tools.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified centrally managed integrity verification tools to ensure the organization being inspected/assessed employs centrally managed integrity verification tools.  The organization being inspected/assessed may be required to demonstrate use of their identified integrity verification tools.'),\n('001302','draft','2009-09-22','DISA FSO','policy','The organization requires use of tamper-evident packaging for organization-defined information system components during organization-defined conditions.',NULL,NULL,NULL),\n('001303','draft','2009-09-22','DISA FSO','policy','The organization defines information system components that require tamper-evident packaging.',NULL,NULL,NULL),\n('001304','draft','2009-09-22','DISA FSO','policy','The organization defines conditions (i.e., transportation from vendor to operational site, during operation, both) under which tamper-evident packaging must be used for organization-defined information system components.',NULL,NULL,NULL),\n('001305','draft','2009-09-22','DISA FSO','technical','The organization employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means.',NULL,NULL,NULL),\n('001306','draft','2009-09-22','DISA FSO','policy','The organization updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.','SI-8.3','The organization being inspected/assessed documents and implements a process to update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.','The organization conducting the inspection/assessment obtains and examines the documented process and examines the spam protection mechanisms to ensure the organization being inspected/assessed updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.'),\n('001307','draft','2009-09-22','DISA FSO','policy','The organization centrally manages spam protection mechanisms.','SI-8(1).1','The organization being inspected/assessed documents and implements a process to centrally manage spam protection mechanisms.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed centrally manages spam protection mechanisms.'),\n('001308','draft','2009-09-22','DISA FSO','technical','The information system automatically updates spam protection mechanisms.','SI-8(2).1','The organization being inspected/assessed configures the information system to automatically update spam protection mechanisms.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1308.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically update spam protection mechanisms.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1308.'),\n('001309','draft','2009-09-22','DISA FSO','policy','The organization restricts the capability to input information to the information system to authorized personnel.',NULL,NULL,NULL),\n('001310','draft','2009-09-22','DISA FSO','technical','The information system checks the validity of organization-defined inputs.','SI-10.1','The organization being inspected/assessed configures the information system to check the validity of all inputs except those identified specifically by the organization.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1310.  DoD has defined the information inputs as all inputs except those identified specifically by the organization.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  check the validity of all inputs except those identified specifically by the organization.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1310.  DoD has defined the information inputs as all inputs except those identified specifically by the organization.'),\n('001311','draft','2009-09-22','DISA FSO','technical','The information system identifies potentially security-relevant error conditions.',NULL,NULL,NULL),\n('001312','draft','2009-09-22','DISA FSO','technical','The information system generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.','SI-11.1','The organization being inspected/assessed configures the information system to generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1312.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1312.'),\n('001313','draft','2009-09-22','DISA FSO','policy','The organization defines sensitive or potentially harmful information that should not be contained in error logs and administrative messages.',NULL,NULL,NULL),\n('001314','draft','2009-09-22','DISA FSO','technical','The information system reveals error messages only to organization-defined personnel or roles.','SI-11.2','The organization being inspected/assessed configures the information system to reveal error messages only to the ISSO, ISSM, and SCA.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1314.  DoD has defined the personnel or roles as the ISSO, ISSM, and SCA.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  reveal error messages only to the ISSO, ISSM, and SCA.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1314.  DoD has defined the personnel or roles as the ISSO, ISSM, and SCA.'),\n('001315','draft','2009-09-22','DISA FSO','policy','The organization handles information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.','SI-12.1','The organization being inspected/assessed identifies and documents federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements which apply to the information within the information system.  The organization documents and implements a process to handle information IAW those documented federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.','The organization conducting the inspection/assessment obtains and examines the documented list of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements which apply to the information within the information system, as well as the documented process for information handling to ensure the organization being inspected/assessed handles information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.'),\n('001316','draft','2009-09-22','DISA FSO','policy','The organization protects the information system from harm by considering mean time to failure rates for an organization-defined list of information system components in specific environments of operation.',NULL,NULL,NULL),\n('001317','draft','2009-09-22','DISA FSO','policy','The organization defines a list of information system components for which mean time to failure rates should be considered to protect the information system from harm.',NULL,NULL,NULL),\n('001318','draft','2009-09-22','DISA FSO','policy','The organization provides substitute information system components.','SI-13.3','The organization being inspected/assessed documents and implements a process to provide substitute information system components.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides substitute information system components.'),\n('001319','draft','2009-09-22','DISA FSO','policy','The organization takes information system components out of service by transferring component responsibilities to a substitute component no later than an organization-defined fraction or percentage of mean time to failure (MTTF).','SI-13(1).1','The organization being inspected/assessed documents and implements a process to take the information system components out of service by transferring component responsibilities to a substitute component no later than a fraction or percentage of mean time to failure defined in SI-13 (1), CCI 1320.  The organization must maintain a log of component substitution.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the log of component substitution to ensure the organization being inspected/assessed  takes the information system components out of service by transferring component responsibilities to a substitute component no later than a fraction or percentage of mean time to failure defined in SI-13 (1), CCI 1320.'),\n('001320','draft','2009-09-22','DISA FSO','policy','The organization defines the maximum fraction or percentage of mean time to failure (MTTF) used to determine when information system components are taken out of service by transferring component responsibilities to substitute components.','SI-13(1).2','The organization being inspected/assessed defines and documents the maximum fraction or percentage of mean time to failure used to determine when information system components are taken out of service by transferring component responsibilities to substitute components.  DoD has determined the fraction or percentage is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented fraction or percentage to ensure the organization being inspected/assessed defines the maximum fraction or percentage of mean time to failure used to determine when information system components are taken out of service by transferring component responsibilities to substitute components.  DoD has determined the fraction or percentage is not appropriate to define at the Enterprise level.'),\n('001321','draft','2009-09-22','DISA FSO','policy','The organization does not allow a process to execute without supervision for more than an organization-defined time period.','SI-7(16).1','The organization being inspected/assessed does not allow a process to execute without supervision for more than the time period defined in SI-7 (16), CCI 1322.','The organization conducting the inspection/assessment obtains and examines any applicable evidence of process supervision to ensure the organization being inspected/assessed does not allow a process to execute without supervision for more than the time period defined in SI-7 (16), CCI 1322.'),\n('001322','draft','2009-09-22','DISA FSO','policy','The organization defines a time period that is the longest a process is allowed to execute without supervision.','SI-7(16).2','The organization being inspected/assessed defines and documents a time period that is the most a process is allowed to execute without supervision.  DoD has determined the time period is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented time period to ensure the organization being inspected/assessed defines a time period that is the most a process is allowed to execute without supervision.  DoD has determined the time period is not appropriate to define at the Enterprise level.'),\n('001323','draft','2009-09-22','DISA FSO','policy','The organization manually initiates a transfer between active and standby information system components in accordance with organization-defined frequency if the mean time to failure (MTTF) exceeds an organization-defined time period.',NULL,NULL,NULL),\n('001324','draft','2009-09-22','DISA FSO','policy','The organization defines the minimum frequency at which the organization manually initiates a transfer between active and standby information system components if the mean time to failure (MTTF) exceeds the organization-defined time period.','SI-13(3).1','The organization being inspected/assessed defines and documents the minimum frequency at which the organization manually initiates a transfer between active and standby information system components if the mean time to failure exceeds the organization-defined time period.  DoD has determined the frequency is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed defines the  minimum frequency at which the organization manually initiates a transfer between active and standby information system components if the mean time to failure exceeds the organization-defined time period.  DoD has determined the frequency is not appropriate to define at the Enterprise level.'),\n('001325','draft','2009-09-22','DISA FSO','policy','The organization defines a time period that the mean time to failure (MTTF) must exceed before the organization manually initiates a transfer between active and standby information system components.','SI-13(3).2','The organization being inspected/assessed defines and documents a time period that the mean time to failure must exceed before the organization manually initiates a transfer between active and standby information system components.  The time period should be based on organizational need to maintain readiness of standby components.  DoD has determined the time period is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented time period to ensure the organization being inspected/assessed defines a time period that the mean time to failure must exceed before the organization manually initiates a transfer between active and standby information system components.  DoD has determined the time period is not appropriate to define at the Enterprise level.'),\n('001326','draft','2009-09-22','DISA FSO','policy','The organization, if information system component failures are detected, ensures standby components are successfully and transparently installed within an organization-defined time period.','SI-13(4).1','The organization being inspected/assessed documents and implements a process to transparently install standby components within a time period defined in SI-13 (4), CCI 1327 if information system component failures are detected.  The organization must maintain a log of standby component installation to include time periods.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the log of standby component installation to ensure the organization being inspected/assessed transparently installs standby components within a time period defined in SI-13 (4), CCI 1327 if information system component failures are detected.'),\n('001327','draft','2009-09-22','DISA FSO','policy','The organization defines a time period for a standby information system component to be successfully and transparently installed for the information system component that has failed.','SI-13(4).2','The organization being inspected/assessed defines and documents a time period for a standby information system component to be successfully and transparently installed for the information system component that has failed\\n\\nDoD has determined the time period is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented time period to ensure the organization being inspected/assessed defines a time period for a standby information system component to be successfully and transparently installed for the information system component that has failed.  DoD has determined the time period is not appropriate to define at the Enterprise level.'),\n('001328','draft','2009-09-22','DISA FSO','technical','The organization, if an information system component failure is detected, activates an organization-defined alarm and/or automatically shuts down the information system.','SI-13(4).3','The organization being inspected/assessed configures the information system to activate an alarm defined in SI-13( 4), CCI 1329 and/or automatically shuts down the information system if an information system component failure is detected.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1328.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to activate an alarm defined in SI-13( 4), CCI 1329 and/or automatically shuts down the information system if an information system component failure is detected.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1328.'),\n('001329','draft','2009-09-22','DISA FSO','policy','The organization defines the alarm to be activated when an information system component failure is detected.','SI-13(4).4','The organization being inspected/assessed defines and documents the alarm to be activated when an information system component failure is detected.  DoD has determined the alarm is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented alarm to ensure the organization being inspected/assessed defines the alarm to be activated when an information system component failure is detected.  DoD has determined the alarm is not appropriate to define at the Enterprise level.'),\n('001330','draft','2009-09-22','DISA FSO','policy','The organization prohibits the use of unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official.','AC-19(4).1','The organization being inspected/assessed documents and implements a process to prohibit the use of unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed prohibits the use of unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official.'),\n('001331','draft','2009-09-22','DISA FSO','policy','The organization prohibits connection of unclassified mobile devices to classified information systems.','AC-19(4).2','The organization being inspected/assessed documents and implements a process to prohibit connection of unclassified mobile devices to classified information systems.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed prohibits connection of unclassified mobile devices to classified information systems.'),\n('001332','draft','2009-09-22','DISA FSO','policy','The organization requires approval from the authorizing official for the connection of unclassified mobile devices to unclassified information systems.','AC-19(4).3','The organization being inspected/assessed documents and implements a process to require approval from the authorizing official for the connection of unclassified mobile devices to unclassified information systems.  The organization must maintain an audit trail of approvals.','The organization conducting the inspection/assessment obtains and examines the documented process and the audit trail of approvals to ensure the organization being inspected/assessed requires approval from the authorizing official for the connection of unclassified mobile devices to unclassified information systems.'),\n('001333','draft','2009-09-22','DISA FSO','policy','The organization prohibits use of internal or external modems or wireless interfaces within unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information.','AC-19(4).4','The organization being inspected/assessed documents and implements a process to prohibit use of internal or external modems or wireless interfaces within unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed prohibits use of internal or external modems or wireless interfaces within unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information.'),\n('001334','draft','2009-09-22','DISA FSO','policy','The organization requires that unclassified mobile devices used in facilities containing information systems processing, storing, or transmitting classified information and the information stored on those devices be subject to random reviews and inspections by organization-defined security officials.','AC-19(4).5','The organization being inspected/assessed documents and implements a process to require that unclassified mobile devices used in facilities containing information systems processing, storing, or transmitting classified information and the information stored on those devices are subject to random reviews and inspections by the ISSM/ISSO.  DoD has defined the security officials as the ISSM/ISSO.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requires that unclassified mobile devices used in facilities containing information systems processing, storing, or transmitting classified information and the information stored on those devices are subject to random reviews and inspections by the ISSM/ISSO.   DoD has defined the security officials as the ISSM/ISSO.'),\n('001335','draft','2009-09-22','DISA FSO','policy','The organization defines security officials to perform reviews and inspections of unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information.','AC-19(4).6','DoD has defined the security officials as the ISSM/ISSO.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the security officials as the ISSM/ISSO.'),\n('001336','draft','2009-09-22','DISA FSO','policy','The organization retains individual training records for an organization-defined time period.','AT-4.3','The organization being inspected/assessed will maintain records training records for at least 5 years or 5 years after completion of a specific training program.   DoD has defined the frequency as at least 5 years or 5 years after completion of a specific training program.','The organization conducting the inspection/assessment obtains and examines training records to ensure records have been maintained for at least 5 years or 5 years after completion of a specific training program.   DoD has defined the frequency as at least 5 years or 5 years after completion of a specific training program.'),\n('001337','draft','2009-09-22','DISA FSO','policy','The organization defines a time period for retaining individual training records.','AT-4.4','DoD has defined the frequency as at least 5 years or 5 years after completion of a specific training program.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as at least 5 years or 5 years after completion of a specific training program.'),\n('001338','draft','2009-09-22','DISA FSO','technical','The information system associates the identity of the information producer with the information.',NULL,NULL,NULL),\n('001339','draft','2009-09-22','DISA FSO','technical','The information system validates the binding of the information producer\\'s identity to the information.',NULL,NULL,NULL),\n('001340','draft','2009-09-22','DISA FSO','technical','The information system maintains reviewer/releaser identity and credentials within the established chain of custody for all information reviewed or released.','AU-10(3).1','The organization being inspected/assessed configures the information system to maintain reviewer/releaser identity and credentials within the established chain of custody for all information reviewed or released.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1340.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to maintain reviewer/releaser identity and credentials within the established chain of custody for all information reviewed or released.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1340.'),\n('001341','draft','2009-09-22','DISA FSO','technical','The information system validates the binding of the information reviewer identity to the information at the transfer or release points prior to release/transfer between organization-defined security domains.','AU-10(4).1','The organization being inspected/assessed configures the information system to validate the binding of the information reviewers identity at the transfer or release points between security domains defined in AU-10 (4), CCI 1907.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to validate the binding of the information reviewers identity at the transfer or release points between security domains defined in AU-10 (4), CCI 1907.'),\n('001342','deprecated','2009-09-22','DISA FSO','technical','The organization employs either FIPS-validated or NSA-approved cryptography to implement digital signatures.',NULL,NULL,NULL),\n('001343','draft','2009-09-22','DISA FSO','technical','The information system invokes a system shutdown in the event of an audit failure, unless an alternative audit capability exists.',NULL,NULL,NULL),\n('001344','draft','2009-09-22','DISA FSO','policy','The organization specifies the permitted actions for each authorized information system process, role, and/or user in the audit and accountability policy.',NULL,NULL,NULL),\n('001345','deprecated','2009-09-22','DISA FSO','technical','The organization employs automated mechanisms to alert security personnel of any organization-defined inappropriate or unusual activities with security implications.',NULL,NULL,NULL),\n('001346','draft','2009-09-22','DISA FSO','policy','The organization defines a list of inappropriate or unusual activities with security implications that are to result in alerts to security personnel.',NULL,NULL,NULL),\n('001347','draft','2009-09-22','DISA FSO','policy','The organization performs, in a physically dedicated information system, full-text analysis of privileged functions executed.',NULL,NULL,NULL),\n('001348','draft','2009-09-22','DISA FSO','technical','The information system backs up audit records on an organization-defined frequency onto a different system or system component than the system or component being audited.','AU-9(2).1','The organization being inspected/assessed configures the information system to back up audit records at least every seven days.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1348.  DoD has defined the frequency as every seven days.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to back up audit records at least every seven days.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1348.  DoD has defined the frequency as every seven days.'),\n('001349','draft','2009-09-22','DISA FSO','policy','The organization defines a frequency for backing up system audit records onto a different system or system component than the system or component being audited.','AU-9(2).2','DoD has defined the frequency as every seven days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every seven days.'),\n('001350','draft','2009-09-22','DISA FSO','technical','The information system implements cryptographic mechanisms to protect the integrity of audit information.','AU-9(3).1','The organization being inspected/assessed configures the information system to implement cryptographic mechanisms to protect the integrity of audit information.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1350.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to implement cryptographic mechanisms to protect the integrity of audit information.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1350.'),\n('001351','draft','2009-09-22','DISA FSO','policy','The organization authorizes access to management of audit functionality to only an organization-defined subset of privileged users.','AU-9(4).2','The organization being inspected/assessed authorizes access to the management of audit functionality to only  the subset of privileged users defined in AU-9 (4), CCI 1894.','The organization conducting the inspection/assessment obtains and examines the documentation of access authorizations for the management of audit functionality to ensure only the subset of privileged users defined in AU-9 (4), CCI 1894 have been granted access authorization.'),\n('001352','draft','2009-09-22','DISA FSO','technical','The organization protects the audit records of non-local accesses to privileged accounts and the execution of privileged functions.',NULL,NULL,NULL),\n('001353','draft','2009-09-22','DISA FSO','technical','The information system produces a system-wide (logical or physical) audit trail composed of audit records in a standardized format.','AU-12(2).1','The organization being inspected/assessed configures the information system to produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1353.','The organization conducting the inspection/assessment examines the information system to ensure the information system is configured to produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1353.'),\n('001354','draft','2009-09-22','DISA FSO','policy','The organization manages information system accounts by deactivating temporary accounts that are no longer required.',NULL,NULL,NULL),\n('001355','draft','2009-09-22','DISA FSO','policy','The organization manages information system accounts by deactivating accounts of terminated or transferred users.',NULL,NULL,NULL),\n('001356','draft','2009-09-22','DISA FSO','technical','The organization monitors for atypical usage of information system accounts.',NULL,NULL,NULL),\n('001357','draft','2009-09-22','DISA FSO','policy','The organization reports atypical usage to designated organizational officials.',NULL,NULL,NULL),\n('001358','draft','2009-09-22','DISA FSO','policy','The organization establishes privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles.','AC-2(7).1','The organization being inspected/assessed documents and implements a process to establish privileged user accounts in accordance with a role-based access scheme that organizes allowed information system  access and privileges into roles.','The organization conducting the inspection/assessment obtains and examines documented processes for privileged user account creation to ensure the organization being inspected/assessed establishes privileged user accounts in accordance with a role-based access scheme that organizes allowed information system  access and privileges into roles.'),\n('001359','draft','2009-09-22','DISA FSO','policy','The organization tracks privileged role assignments.',NULL,NULL,NULL),\n('001360','draft','2009-09-22','DISA FSO','policy','The organization monitors privileged role assignments.','AC-2(7).3','The organization being inspected/assessed implements a process to monitor privileged role assignments.  The organization must maintain an audit trail of monitoring.','The organization conducting the inspection/assessment obtains and examines the audit trail of monitoring to ensure the organization being inspected/assessed  monitors privileged role assignments.'),\n('001361','draft','2009-09-24','DISA FSO','policy','The organization defines a time period after which temporary accounts are automatically terminated.','AC-2(2).2','DoD has defined the time period as 72 hours.  The time period of 72 hours applies to  temporary user accounts.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 72 hours.  The time period of 72 hours applies to temporary user accounts.'),\n('001362','draft','2009-09-22','DISA FSO','technical','The information system enforces a Discretionary Access Control (DAC) policy that allows users to specify and control sharing by named individuals or groups of individuals, or by both.',NULL,NULL,NULL),\n('001363','draft','2009-09-22','DISA FSO','policy','The organization establishes a Discretionary Access Control (DAC) policy that allows users to specify and control sharing by named individuals or groups of individuals, or by both.',NULL,NULL,NULL),\n('001365','draft','2009-09-24','DISA FSO','policy','The organization defines a time period after which emergency accounts are automatically terminated.','AC-2(2).3','DoD has defined the time period as never.  The time period of never applies to emergency admin accounts.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as never.  The time period of never applies to emergency admin accounts.'),\n('001366','draft','2009-09-22','DISA FSO','policy','The organization defines user information to be encrypted or stored off-line in a secure location.',NULL,NULL,NULL),\n('001367','draft','2009-09-22','DISA FSO','policy','The organization defines system information to be encrypted or stored off-line in a secure location.',NULL,NULL,NULL),\n('001368','draft','2009-09-22','DISA FSO','technical','The information system enforces approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.','AC-4.1','The organization being inspected/assessed configures the information system to  enforce approved authorizations for controlling the flow of information within the system based on information flow control policies defined in AC-4, CCI 1548.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1368.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  enforce approved authorizations for controlling the flow of information within the system based on information flow control policies defined in AC-4, CCI 1548.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1368.'),\n('001371','draft','2009-09-22','DISA FSO','policy','The organization defines information security policy filters requiring fully enumerated formats which are to be implemented when transferring information between different security domains.','AC-4(14).1','The organization being inspected/assessed defines and documents information security policy filters requiring fully enumerated formats which are to be implemented when transferring information between different security domains.   DoD has determined the information security policy filters are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information security policy filters to ensure the organization being inspected/assessed defines. information security policy filters requiring fully enumerated formats which are to be implemented when transferring information between different security domains.   DoD has determined the frequency is not appropriate to define at the Enterprise level.'),\n('001372','draft','2009-09-22','DISA FSO','technical','The information system, when transferring information between different security domains, implements organization-defined security policy filters requiring fully enumerated formats that restrict data structure and content.','AC-4(14).2','The organization being inspected/assessed configures the information system to implement  security policy filters defined in AC-4 (14), CCI 1371 requiring fully enumerated formats that restrict data structure and content.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1372.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement  security policy filters defined in AC-4 (14), CCI 1371 requiring fully enumerated formats that restrict data structure and content.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1372.'),\n('001373','draft','2009-09-22','DISA FSO','technical','The information system, when transferring information between different security domains, examines the information for the presence of organization-defined unsanctioned information.','AC-4(15).1','The organization being inspected/assessed configures the information system to examine the information for the presence of unsanctioned information defined in AC-4 (15), CCI 2203 when transferring information between different security domains.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1373.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to examine the information for the presence of unsanctioned information defined in AC-4 (15), CCI 2203 when transferring information between different security domains.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1373.'),\n('001374','draft','2009-09-22','DISA FSO','technical','The information system, when transferring information between different security domains, prohibits the transfer of organization-defined unsanctioned information in accordance with the organization-defined security policy.','AC-4(15).2','The organization being inspected/assessed configures the information system to prohibit the transfer of unsanctioned information defined in AC-4 (15), CCI 2203 in accordance with the security policy defined in AC-4 (15), CCI 2204.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1374.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  prohibit the transfer of unsanctioned information defined in AC-4 (15), CCI 2203 in accordance with the security policy defined in AC-4 (15), CCI 2204.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1374.'),\n('001376','draft','2009-09-22','DISA FSO','technical','The information system uniquely identifies source domains for information transfer.',NULL,NULL,NULL),\n('001377','draft','2009-09-22','DISA FSO','technical','The information system uniquely authenticates source domains for information transfer.',NULL,NULL,NULL),\n('001380','draft','2009-09-22','DISA FSO','policy','The organization documents separation of duties of individuals.','AC-5.3','The organization being inspected/assessed documents separation of duties of individuals.','The organization conducting the inspection/assessment obtains and examines the documented separation of duties to ensure the organization being inspected/assessed documents separation of duties of individuals.'),\n('001382','draft','2009-09-22','DISA FSO','policy','The organization defines the number of consecutive, unsuccessful login attempts to the mobile device.',NULL,NULL,NULL),\n('001383','draft','2009-09-22','DISA FSO','technical','The information system provides additional protection for mobile devices accessed via login by purging information from the device after an organization-defined number of consecutive, unsuccessful login attempts to the mobile device.',NULL,NULL,NULL),\n('001384','draft','2009-09-22','DISA FSO','technical','The information system, for publicly accessible systems, displays system use information organization-defined conditions before granting further access.','AC-8.8','The organization being inspected/assessed configures the information system to display the content of DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems - Standard Consent Banner and User Agreement,\\\" March 2013  before granting further access for publicly accessible systems   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1384.  DoD has defined the conditions as the content of DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems - Standard Consent Banner and User Agreement,\\\" March 2013.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  display the content of DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems - Standard Consent Banner and User Agreement,\\\" March 2013 before granting further access for publicly accessible systems   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1384.  DoD has defined the conditions as the content of DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems - Standard Consent Banner and User Agreement,\\\" March 2013.'),\n('001385','draft','2009-09-22','DISA FSO','technical','The information system, for publicly accessible systems, displays references, if any, to monitoring that are consistent with privacy accommodations for such systems that generally prohibit those activities.','AC-8.10','The organization being inspected/assessed configures the information system to display references, if any, to monitoring that are consistent with privacy accommodations for such systems that generally prohibit those activities for publicly accessible systems.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1385.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to display references, if any, to monitoring that are consistent with privacy accommodations for such systems that generally prohibit those activities for publicly accessible systems.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1385.'),\n('001386','draft','2009-09-22','DISA FSO','technical','The information system, for publicly accessible systems, displays references, if any, to recording that are consistent with privacy accommodations for such systems that generally prohibit those activities.','AC-8.11','The organization being inspected/assessed configures the information system to display references, if any, to recording that are consistent with privacy accommodations for such systems that generally prohibit those activities  for publicly accessible systems.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1386.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to display references, if any, to recording that are consistent with privacy accommodations for such systems that generally prohibit those activities  for publicly accessible systems.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1386.'),\n('001387','draft','2009-09-22','DISA FSO','technical','The information system, for publicly accessible systems, displays references, if any, to auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities.','AC-8.12','The organization being inspected/assessed configures the information system to display references, if any, to auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities for publicly accessible systems.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1387.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to display references, if any, to auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities for publicly accessible systems.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1387.'),\n('001388','draft','2009-09-22','DISA FSO','technical','The information system, for publicly accessible systems, includes a description of the authorized uses of the system.','AC-8.13','The organization being inspected/assessed configures the information system to include a description of the authorized uses of the system for publicly accessible systems.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1388.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  include a description of the authorized uses of the system for publicly accessible systems.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1388.'),\n('001389','draft','2009-09-22','DISA FSO','policy','The organization defines the time period that the information system notifies the user of the number of successful logon/access attempts.','AC-9(2).1','DoD has determined this CCI is not applicable because this option is not selected.','DoD has determined this CCI is not applicable because this option is not selected.'),\n('001390','draft','2009-09-22','DISA FSO','policy','The organization defines the time period that the information system notifies the user of the number of unsuccessful logon/access attempts.','AC-9(2).2','DoD has defined the time period as the time since the last successful login (for  unsuccessful logon/access attempts).  ','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as the time since the last successful login (for  unsuccessful logon/access attempts).  '),\n('001391','draft','2009-09-22','DISA FSO','technical','The information system notifies the user of the number of successful logins/accesses that occur during the organization-defined time period.','AC-9(2).3','DoD has determined this CCI is not applicable because this option is not selected.','DoD has determined this CCI is not applicable because this option is not selected.'),\n('001392','draft','2009-09-22','DISA FSO','technical','The information system notifies the user of the number of unsuccessful login/access attempts that occur during organization-defined time period.','AC-9(2).4','The organization being inspected/assessed configures the information system to notify the user of the number of unsuccessful login/access attempts that occur during the time period defined in AC-9 (2), CCI 1389.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1392.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to notify the user of the number of unsuccessful login/access attempts that occur during the time period defined in AC-9 (2), CCI 1389.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1392.'),\n('001393','draft','2009-09-22','DISA FSO','policy','The organization defines the security-related characteristics/parameters of the user^s account which, when changed, will result in a notification being provided to the user during the organization-defined time period.','AC-9(3).1','DoD has defined the security-related characteristics/parameters as access and/or privilege parameters.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the security-related characteristics/parameters as access and/or privilege parameters.'),\n('001394','draft','2009-09-22','DISA FSO','policy','The organization defines the time period during which organization-defined security-related changes to the user^s account are to be tracked.','AC-9(3).2','DoD has defined the time period as since last successful login.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as since last successful login.'),\n('001395','draft','2009-09-22','DISA FSO','technical','The information system notifies the user of changes to organization-defined security-related characteristics/parameters of the user^s account that occur during the organization-defined time period.','AC-9(3).3','The organization being inspected/assessed configures the information system to notify the user of changes to access and/or privilege parameters that occur since last successful login.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1395.  DoD has defined the time period as since last successful login.  DoD has defined the security-related characteristics/parameters as access and/or privilege parameters.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to notify the user of changes to access and/or privilege parameters that occur since last successful login.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1395.  DoD has defined the time period as since last successful login.  DoD has defined the security-related characteristics/parameters as access and/or privilege parameters.'),\n('001396','draft','2009-09-22','DISA FSO','policy','The organization defines security attributes for which the information system supports and maintains the bindings for information in storage.',NULL,NULL,NULL),\n('001397','draft','2009-09-22','DISA FSO','policy','The organization defines security attributes for which the information system supports and maintains the bindings for information in process.',NULL,NULL,NULL),\n('001398','draft','2009-09-22','DISA FSO','policy','The organization defines security attributes for which the information system supports and maintains the bindings for information in transmission.',NULL,NULL,NULL),\n('001399','draft','2009-09-22','DISA FSO','technical','The information system supports and maintains the binding of organization-defined security attributes to information in storage.',NULL,NULL,NULL),\n('001400','draft','2009-09-22','DISA FSO','technical','The information system supports and maintains the binding of organization-defined security attributes to information in process.',NULL,NULL,NULL),\n('001401','draft','2009-09-22','DISA FSO','technical','The information system supports and maintains the binding of organization-defined security attributes to information in transmission.',NULL,NULL,NULL),\n('001402','draft','2009-09-22','DISA FSO','policy','The organization monitors for unauthorized remote access to the information system.',NULL,NULL,NULL),\n('001403','draft','2009-09-24','DISA FSO','technical','The information system automatically audits account modification actions.','AC-2(4).2','The organization being inspected/assessed configures the information system to automatically audit account modification actions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1403.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically audit account modification actions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1403.'),\n('001404','draft','2009-09-24','DISA FSO','technical','The information system automatically audits account disabling actions.','AC-2(4).3','The organization being inspected/assessed configures the information system to automatically audit account disabling actions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1404.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically audit account disabling actions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1404.'),\n('001405','draft','2009-09-24','DISA FSO','technical','The information system automatically audits account removal actions.','AC-2(4).4','The organization being inspected/assessed configures the information system to automatically audit account removal actions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1405.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically audit account removal actions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1405.'),\n('001406','draft','2009-09-24','DISA FSO','policy','The organization defines a time period of expected inactivity when users are required to log out.','AC-2(5).3','DoD has defined the time period as at the end of the users standard work period unless otherwise defined in formal organizational policy.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as at the end of the users standard work period unless otherwise defined in formal organizational policy.'),\n('001407','draft','2009-09-24','DISA FSO','policy','The organization administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles.','AC-2(7).2','The organization being inspected/assessed documents and implements a process to administer privileged user accounts in accordance with a role-based access scheme that organizes allowed information system  access and privileges into roles.','The organization conducting the inspection/assessment obtains and examines documented processes for privileged user account creation to ensure the organization being inspected/assessed administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system  access and privileges into roles.'),\n('001408','draft','2009-09-24','DISA FSO','policy','The organization defines privileged commands for which dual authorization is to be enforced.','AC-3(2).2','The organization being inspected/assessed defines and documents  privileged commands for which dual authorization is to be enforced.  DoD has determined the other actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented privileged commands to ensure they have been defined.   DoD has determined the other actions are not appropriate to define at the Enterprise level.'),\n('001409','draft','2009-09-24','DISA FSO','policy','The organization defines nondiscretionary access control policies to be enforced over the organization-defined set of users and resources, where the rule set for each policy specifies access control information employed by the policy rule set (e.g., position, nationality, age, project, time of day) and required relationships among the access control information to permit access.',NULL,NULL,NULL),\n('001410','draft','2009-09-24','DISA FSO','policy','The organization defines the set of users and resources over which the information system is to enforce nondiscretionary access control policies.',NULL,NULL,NULL),\n('001411','draft','2009-09-24','DISA FSO','policy','The organization defines security-relevant information to which the information system prevents access except during secure, non-operable system states.','AC-3(5).2','The organization being inspected/assessed defines and documents security-relevant information to which the information system prevents access except during secure, nonoperable system states.  At a minimum, the security-relevant information shall include installing and updating crypto keys.  DoD has determined the security-relevant information is not appropriate to define at the Enterprise level, but at a minimum, installing and updating crypto keys.','The organization conducting the inspection/assessment obtains and examines the documented security-relevant information to ensure it has been defined and at a minimum, includes installing and updating crypto keys.  DoD has determined the security-relevant information is not appropriate to define at the Enterprise level, but at a minimum, installing and updating crypto keys.'),\n('001412','draft','2009-09-24','DISA FSO','policy','The organization encrypts or stores off-line, in a secure location, organization-defined user information.',NULL,NULL,NULL),\n('001413','draft','2009-09-24','DISA FSO','policy','The organization encrypts or stores off-line, in a secure location, organization-defined system information.',NULL,NULL,NULL),\n('001414','draft','2009-09-24','DISA FSO','technical','The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.','AC-4.2','The organization being inspected/assessed configures the information system to  enforce approved authorizations for controlling the flow of information between interconnected systems based on information flow control policies defined in AC-4, CCI 1549.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1414.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  enforce approved authorizations for controlling the flow of information between interconnected systems based on information flow control policies defined in AC-4, CCI 1549.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1414.'),\n('001415','draft','2009-09-24','DISA FSO','policy','The organization defines limitations for the embedding of data types within other data types.','AC-4(5).2','The organization being inspected/assessed defines and documents the  limitations of the embedding of data types within other data types.  DoD has determined the limitations are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented limitations to ensure the organization being inspected/assessed defines the limitations of the embedding of data types within other data types.  DoD has determined the limitations are not appropriate to define at the Enterprise level.'),\n('001416','draft','2009-09-24','DISA FSO','policy','The organization defines one-way information flows to be enforced by the information system.','AC-4(7).2','The organization being inspected/assessed defines and documents one-way information flows to be enforced by the information system.  DoD has determined the one-way information flow is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented one-way information flows to ensure the organization being inspected/assessed  defines one-way information flows to be enforced by the information system.   DoD has determined the one-way information flow is not appropriate to define at the Enterprise level.'),\n('001417','draft','2009-09-24','DISA FSO','policy','The organization defines security policy filters to be enforced by the information system and used as a basis for flow control decisions.','AC-4(8).2','The organization being inspected/assessed defines and documents security policy filters to be enforced by the information system and used as a basis for flow control decisions.  DoD has determined the security policy filters are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security policy filters to ensure the organization being inspected/assessed defines security policy filters to be enforced by the information system and used as a basis for flow control decisions.  DoD has determined the security policy filters are not appropriate to define at the Enterprise level.'),\n('001418','draft','2009-09-24','DISA FSO','policy','The organization defines security policy filters for which the information system enforces the use of human review.',NULL,NULL,NULL),\n('001419','draft','2009-09-25','DISA FSO','policy','The organization defines the security functions or security-relevant information to which users of information system accounts, or roles, have access.','AC-6(2).2','DoD has defined the security functions and security-relevant information as any privileged security functions or security-relevant information.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the security functions and security-relevant information as any privileged security functions or security-relevant information.'),\n('001420','draft','2009-09-25','DISA FSO','policy','The organization defines the privileged commands to which network access is to be authorized only for organization-defined compelling operational needs.','AC-6(3).3','The organization being inspected/assessed defines and documents the privileged commands to which network access is to be authorized only for organization-defined compelling operational needs.  DoD has determined the privileged commands are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented privileged commands to ensure the organization being inspected/assessed defines the privileged commands to which network access is to be authorized only for organization-defined compelling operational needs.  DoD has determined the privileged commands are not appropriate to define at the Enterprise level.'),\n('001421','draft','2009-09-25','DISA FSO','policy','The organization limits authorization to super user accounts on the information system to designated system administration personnel.',NULL,NULL,NULL),\n('001422','draft','2009-09-25','DISA FSO','policy','The organization prohibits privileged access to the information system by non-organizational users.','AC-6(6).1','The organization being inspected/assessed implements as a step in the access authorization process, a check to prohibit privileged access to the information system by non-organizational users.','The organization conducting the inspection/assessment obtains and examines the access authorization process as well as a sampling of information system access agreements to ensure that the organization being inspected/assessed prohibits privileged access to the information system by non-organizational users.'),\n('001423','draft','2009-09-25','DISA FSO','policy','The organization defines the time period in which the organization-defined maximum number of consecutive invalid logon attempts occur.','AC-7.3','DoD has defined the time period as 15 minutes.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the time period as 15 minutes.'),\n('001424','draft','2009-09-25','DISA FSO','technical','The information system dynamically associates security attributes with organization-defined subjects in accordance with organization-defined security policies as information is created and combined.','AC-16(1).1','The organization being inspected/assessed configures the information system to dynamically associates security attributes with the subjects defined in AC-16 (1), CCI 2274 in accordance with the security policies defined in AC-16 (1), CCI 2273 as information is created and combined.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1424.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  dynamically associates security attributes with the subjects defined in AC-16 (1), CCI 2274 in accordance with the security policies defined in AC-16 (1), CCI 2273 as information is created and combined.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1424.'),\n('001425','draft','2009-09-25','DISA FSO','technical','The information system provides authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated security attributes.','AC-16(2).1','The organization being inspected/assessed configures the information system to provide authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated security attributes.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1425.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  provides authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated security attributes.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1425.'),\n('001426','draft','2009-09-25','DISA FSO','technical','The information system maintains the binding of security attributes to information with sufficient assurance that the information--attribute association can be used as the basis for automated policy actions.',NULL,NULL,NULL),\n('001427','draft','2009-09-25','DISA FSO','technical','The information system allows authorized users to associate security attributes with information.',NULL,NULL,NULL),\n('001428','draft','2009-09-25','DISA FSO','technical','The information system displays security attributes in human-readable form on each object that the system transmits to output devices to identify organization-identified special dissemination, handling, or distribution instructions using organization-identified human-readable, standard naming conventions.','AC-16(5).1','The organization being inspected/assessed configures the information system to display security attributes in human readable form on each object that the system transmits to output devices to identify special dissemination, handling, or distribution instructions defined in AC-16 (5), CCI 1429 using human readable, standard naming conventions defined in AC-16 (5), CCI 1430.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1428.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  display security attributes in human readable form on each object that the system transmits to output devices to identify special dissemination, handling, or distribution instructions defined in AC-16 (5), CCI 1429 using human readable, standard naming conventions defined in AC-16 (5), CCI 1430.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1428.'),\n('001429','draft','2009-09-25','DISA FSO','policy','The organization identifies special dissemination, handling, or distribution instructions for identifying security attributes on output.','AC-16(5).2','DoD has defined the instructions as for instructions relating to classification,  special dissemination, handling, or distribution instructions IAW DODI 5200.1R; for SCI and SAP, IAW Controlled Access Program Coordination Office (CAPCO) register.  For all other instructions, not appropriate to define at the Enterprise level.  The organization being inspected/assessed defines and documents special dissemination, handling, or distribution instructions not relating to classification, for identifying security attributes on output.','DoD has defined the instructions as for instructions relating to classification,  special dissemination, handling, or distribution instructions IAW DODI 5200.1R; for SCI and SAP, IAW Controlled Access Program Coordination Office (CAPCO) register.  For all other instructions, not appropriate to define at the Enterprise level.  The organization conducting the inspection/assessment obtains and examines the documented instructions not relating to classification to ensure the organization being inspected/assessed  identifies special dissemination, handling, or distribution instructions for identifying security attributes on output.'),\n('001430','draft','2009-09-25','DISA FSO','policy','The organization identifies human-readable, standard naming conventions for identifying security attributes on output.','AC-16(5).3','DoD has defined the human readable, standard naming conventions for security attributes relating to classification as human readable, standard naming conventions IAW DODI 5200.1R; for TS SCI, IAW Controlled Access Program Coordination Office (CAPCO) register. For all other security attributes, not appropriate to define at the Enterprise level.  The organization  being inspected/assessed defines and documents all other security attributes not relating to classification.','DoD has defined the human readable, standard naming conventions for security attributes relating to classification as human readable, standard naming conventions IAW DODI 5200.1R; for TS SCI, IAW Controlled Access Program Coordination Office (CAPCO) register. For all other security attributes, not appropriate to define at the Enterprise level.  The organization conducting the inspection/assessment obtains and examines the documented security attributes not relating to classification to ensure the organization being inspected/assessed identifies human readable, standard naming conventions for identifying security attributes on output.'),\n('001431','draft','2009-09-25','DISA FSO','policy','The organization defines a frequency for monitoring for unauthorized remote connections to the information system.',NULL,NULL,NULL),\n('001432','draft','2009-09-25','DISA FSO','policy','The organization takes appropriate action if an unauthorized remote connection to the information system is discovered.',NULL,NULL,NULL),\n('001433','draft','2009-09-25','DISA FSO','policy','The organization defines a list of security functions and security-relevant information that for remote access sessions have organization-defined security measures employed and are audited.',NULL,NULL,NULL),\n('001434','draft','2009-09-25','DISA FSO','policy','The organization defines additional security measures to be employed when an organization-defined list of security functions and security-relevant information is accessed remotely.',NULL,NULL,NULL),\n('001435','draft','2009-09-25','DISA FSO','policy','The organization defines networking protocols within the information system deemed to be nonsecure.',NULL,NULL,NULL),\n('001436','draft','2009-09-25','DISA FSO','technical','The organization disables organization-defined networking protocols within the information system deemed to be nonsecure except for explicitly identified components in support of specific operational requirements.',NULL,NULL,NULL),\n('001437','draft','2009-09-25','DISA FSO','policy','The organization documents the rationale for the execution of privileged commands and access to security-relevant information in the security plan for the information system.',NULL,NULL,NULL),\n('001438','draft','2009-09-25','DISA FSO','policy','The organization establishes usage restrictions for wireless access.','AC-18.1','The organization being inspected/assessed establishes and documents  usage restrictions for wireless access.','The organization conducting the inspection/assessment obtains and examines documented usage restrictions to ensure the organization being inspected/assessed establishes usage restrictions for wireless access.'),\n('001439','draft','2009-09-25','DISA FSO','policy','The organization establishes implementation guidance for wireless access.','AC-18.2','The organization being inspected/assessed establishes and documents implementation guidance for wireless access.','The organization conducting the inspection/assessment obtains and examines the documented  implementation guidance to ensure the organization being inspected/assessed establishes implementation guidance for wireless access.'),\n('001440','draft','2009-09-25','DISA FSO','policy','The organization monitors for unauthorized wireless access to the information system.',NULL,NULL,NULL),\n('001441','draft','2009-09-25','DISA FSO','policy','The organization authorizes wireless access to the information system prior to allowing such connections.','AC-18.4','The organization being inspected/assessed authorizes wireless access to the information system prior to allowing such connections.  The organization must maintain an audit trail of authorizations.','The organization conducting the inspection/assessment obtains and examines the audit trail of authorizations to ensure the organization being inspected/assessed authorizes wireless access to the information system prior to allowing such connections.'),\n('001442','draft','2009-09-25','DISA FSO','policy','The organization enforces requirements for wireless connections to the information system.',NULL,NULL,NULL),\n('001443','draft','2009-09-25','DISA FSO','technical','The information system protects wireless access to the system using authentication of users and/or devices.','AC-18(1).1','The organization being inspected/assessed configures the information system to protect wireless access to the system using authentication of users and/or devices.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1443.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to protect wireless access to the system using authentication of users and/or devices.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1443.'),\n('001444','draft','2009-09-25','DISA FSO','technical','The information system protects wireless access to the system using encryption.','AC-18(1).2','The organization being inspected/assessed configures the information system to protect wireless access to the system using encryption.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1444.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to protect wireless access to the system using encryption.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1444.'),\n('001445','draft','2009-09-25','DISA FSO','policy','The organization monitors for unauthorized wireless connections to the information system on an organization-defined frequency.',NULL,NULL,NULL),\n('001446','draft','2009-09-25','DISA FSO','policy','The organization scans for unauthorized wireless access points on an organization-defined frequency.',NULL,NULL,NULL),\n('001447','draft','2009-09-25','DISA FSO','policy','The organization defines a frequency of monitoring for unauthorized wireless connections to information system, including scans for unauthorized wireless access points.',NULL,NULL,NULL),\n('001448','draft','2009-09-25','DISA FSO','policy','The organization takes appropriate action if an unauthorized wireless connection is discovered.',NULL,NULL,NULL),\n('001449','draft','2009-09-25','DISA FSO','policy','The organization disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment.','AC-18(3).1','The organization being inspected/assessed documents and implements a process to disable wireless networking capabilities internally embedded within information system components prior to issuance and deployment when not intended for use.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment.  The organization conducting the inspection/assessment obtains and examines a sampling of information systems to ensure that any internally embedded wireless networking capabilities are disabled unless a documented need exists.'),\n('001450','draft','2009-09-25','DISA FSO','policy','The organization does not allow users to independently configure wireless networking capabilities.',NULL,NULL,NULL),\n('001451','draft','2009-09-25','DISA FSO','policy','The organization selects radio antennas and calibrates transmission power levels to reduce the probability that usable signals can be received outside of organization-controlled boundaries.','AC-18(5).1','The organization being inspected/assessed documents and implements a process to select radio antennas and calibrate transmission power levels to reduce the probability that usable signals can be received outside of organization-controlled boundaries.','The organization conducting the inspection/assessment obtains and examines the documentation from radio antenna installation to ensure that the organization being inspected/assessed selects radio antennas and calibrates transmission power levels to reduce the probability that usable signals can be received outside of organization-controlled boundaries.'),\n('001452','draft','2009-05-25','DISA FSO','technical','The information system enforces the organization-defined time period during which the limit of consecutive invalid access attempts by a user is counted.',NULL,NULL,NULL),\n('001453','draft','2009-09-29','DISA FSO','technical','The information system implements cryptographic mechanisms to protect the integrity of remote access sessions.','AC-17(2).2','The organization being inspected/assessed configures the information system to  implement cryptographic mechanisms to protect the integrity of remote access sessions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1453.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  implement cryptographic mechanisms to protect the integrity of remote access sessions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1453.'),\n('001454','draft','2009-09-29','DISA FSO','technical','The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant information are audited.',NULL,NULL,NULL),\n('001455','draft','2009-09-29','DISA FSO','policy','The organization explicitly identifies components needed in support of specific operational requirements.',NULL,NULL,NULL),\n('001456','draft','2009-09-29','DISA FSO','policy','The organization defines locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.',NULL,NULL,NULL),\n('001457','draft','2009-09-29','DISA FSO','policy','The organization defines inspection and preventative measures to be applied on mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.',NULL,NULL,NULL),\n('001458','draft','2009-09-29','DISA FSO','policy','The organization requires that if classified information is found on mobile devices, the incident handling policy be followed.','AC-19(4).7','The organization being inspected/assessed documents and implements a process to  require that if classified information is found on mobile devices, the incident handling policy is followed.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requires that if classified information is found on mobile devices, the incident handling policy is followed.'),\n('001459','draft','2009-09-29','DISA FSO','policy','The organization defines information system components that provide audit record generation capability.','AU-12.2','DoD has defined the information system components as all information system and network components.','DoD has defined the information system components as all information system and network components.'),\n('001460','draft','2009-09-29','DISA FSO','policy','The organization monitors organization-defined open source information and/or information sites per organization-defined frequency for evidence of unauthorized exfiltration or disclosure of organizational information.','AU-13.1','The organization being inspected/assessed documents and implements a process to monitor open source information and/or information sites defined in AU-13, CCI 1915 for evidence of unauthorized exfiltration or disclosure of organizational information on a  frequency defined in AU-13, CCI 1461.  The organization must maintain an audit trail of monitoring activity.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of monitoring activity to ensure the organization being inspected/assessed monitors open source information and/or information sites defined in AU-13, CCI 1915 for evidence of unauthorized exfiltration or disclosure of organizational information on a  frequency defined in AU-13, CCI 1461.'),\n('001461','draft','2009-09-29','DISA FSO','policy','The organization defines a frequency for monitoring open source information and/or information sites for evidence of unauthorized exfiltration or disclosure of organizational information.','AU-13.2','The organization being inspected/assessed defines and documents the frequency for monitoring open source information and/or information sites for evidence of unauthorized exfiltration or disclosure of organizational information.\\n\\nDoD has determined that the frequency should be defined at the Component level, not appropriate to define at the Enterprise level. Note:  The value in this control may not be used to deny reciprocal acceptance of a C&A (A&A) package.','The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed defines  the  frequency for monitoring open source information and/or information sites for evidence of unauthorized exfiltration or disclosure of organizational information.\\n\\nDoD has determined that the frequency should be defined at the Component level, not appropriate to define at the Enterprise level. Note:  The value in this control may not be used to deny reciprocal acceptance of a C&A (A&A) package.'),\n('001462','draft','2009-09-29','DISA FSO','technical','The information system provides the capability for authorized users to capture/record and log content related to a user session.','AU-14(2).1','The organization being inspected/assessed configures the information system to provide the capability for authorized users to capture/record and log content related to a user session.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1462.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide the capability for authorized users to capture/record and log content related to a user session.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1462.'),\n('001463','draft','2009-09-29','DISA FSO','technical','The information system provides the capability to remotely view/hear all content related to an established user session in real time.',NULL,NULL,NULL),\n('001464','draft','2009-09-29','DISA FSO','technical','The information system initiates session audits at system start-up.','AU-14(1).1','The organization being inspected/assessed configures the information system to initiate session audits at system start-up.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1464.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to initiate session audits at system start-up.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1464.'),\n('001465','draft','2009-09-29','DISA FSO','policy','The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to store organization-controlled information using the external information systems.',NULL,NULL,NULL),\n('001466','draft','2009-09-29','DISA FSO','policy','The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to transmit organization-controlled information using the external information systems.',NULL,NULL,NULL),\n('001467','draft','2009-09-29','DISA FSO','policy','The organization prohibits authorized individuals from using an external information system to process organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.',NULL,NULL,NULL),\n('001468','draft','2009-09-29','DISA FSO','policy','The organization prohibits authorized individuals from using an external information system to store organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.',NULL,NULL,NULL),\n('001469','draft','2009-09-29','DISA FSO','policy','The organization prohibits authorized individuals from using an external information system to transmit organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.',NULL,NULL,NULL),\n('001470','draft','2009-09-29','DISA FSO','policy','The organization defines information sharing circumstances where user discretion is required.','AC-21.2','The organization being inspected/assessed defines and documents information sharing circumstances where user discretion is required.  DoD has determined the information sharing circumstances are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information sharing circumstances to ensure the organization being inspected/assessed defines information sharing circumstances where user discretion is required.   DoD has determined the information sharing circumstances are not appropriate to define at the Enterprise level.'),\n('001471','draft','2009-09-29','DISA FSO','policy','The organization employs organization-defined automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.','AC-21.3','The organization being inspected/assessed implements the process defined in AC-21, CCI 1472 to assist users in making information sharing/collaboration decisions.','The organization conducting the inspection/assessment obtains and examines the documented process defined per AC-21, CCI 1472 to ensure the organization being inspected/assessed assists users in making information sharing/collaboration decisions.'),\n('001472','draft','2009-09-29','DISA FSO','policy','The organization defines the automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.','AC-21.4','The organization being inspected/assessed defines and documents the automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.  DoD has determined the automated mechanisms or manual processes are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented automated mechanisms to ensure the organization being inspected/assessed defines the automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.  DoD has determined the automated mechanisms or manual processes are not appropriate to define at the Enterprise level.'),\n('001473','draft','2009-09-29','DISA FSO','policy','The organization designates individuals authorized to post information onto a publicly accessible information system.','AC-22.1','The organization being inspected/assessed identifies and documents individuals authorized to post information onto a publicly accessible information system.','The organization conducting the inspection/assessment obtains and examines the list of individuals to ensure the organization being inspected/assessed  designates individuals authorized to post information onto a publicly accessible information system.'),\n('001474','draft','2009-09-29','DISA FSO','policy','The organization trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information.','AC-22.2','The organization being inspected/assessed documents and implements a process to train  authorized individuals to ensure that publicly accessible information does not contain nonpublic information.  The organization must maintain an audit trail of the training conducted.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of the training conducted to ensure the organization being inspected/assessed trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information.'),\n('001475','draft','2009-09-29','DISA FSO','policy','The organization reviews the proposed content of information prior to posting onto the publicly accessible information system to ensure that nonpublic information is not included.','AC-22.3','The organization being inspected/assessed','The organization conducting the inspection/assessment obtains and examines'),\n('001476','draft','2009-09-29','DISA FSO','policy','The organization reviews the content on the publicly accessible information system for nonpublic information on an organization-defined frequency.','AC-22.4','The organization being inspected/assessed documents and implements a process to review the content on the publicly accessible information system for nonpublic information on an organization-defined frequency.  The organization must maintain an audit trail of reviews.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of reviews to ensure the organization being inspected/assessed reviews the content on the publicly accessible information system for nonpublic information on an organization-defined frequency.'),\n('001477','draft','2009-09-29','DISA FSO','policy','The organization defines a frequency for reviewing the content on the publicly accessible information system for nonpublic information.','AC-22.5','DoD has defined the frequency as every 90 days or as new information is posted.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every 90 days or as new information is posted.'),\n('001478','draft','2009-09-29','DISA FSO','policy','The organization removes nonpublic information from the publicly accessible information system, if discovered.','AC-22.6','The organization being inspected/assessed documents and implements a process to remove nonpublic information from the publicly accessible information system, if discovered.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed removes nonpublic information from the publicly accessible information system, if discovered.'),\n('001479','draft','2009-09-29','DISA FSO','policy','The organization provides refresher security awareness training to all information system users (including managers, senior executives, and contractors) in accordance with the organization-defined frequency.','AT-2.4','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.  DISA\\'s DoD IA awareness CBT is the DoD baseline standard.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.','DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.  DISA\\'s DoD IA awareness CBT is the DoD baseline standard.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.'),\n('001480','draft','2009-09-29','DISA FSO','policy','The organization defines the frequency for providing refresher security awareness training to all information system users (including managers, senior executives, and contractors).','AT-2.1','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level (DoDD 8570.01).   DoD has defined the frequency as annually.'),\n('001481','draft','2009-09-29','DISA FSO','policy','The organization provides organization-defined personnel or roles with initial training in the employment and operation of environmental controls.','AT-3(1).1','The organization being inspected/assessed:\\n1. Identifies and documents environmental controls that require training.\\n2. Identifies the personnel defined in AT-3 (1), CCI 2050\\n3. Ensures designated personnel receive this training.\\n4. Maintains and monitors records of personnel who have received this training.','The organization conducting the inspection/assessment obtains and examines:\\n1. Documentation of environmental controls that require training.\\n2. Documented list of personnel defined in AT-3 (1), CCI 2050\\n3. Ensures identified personnel have received the initial training.'),\n('001482','draft','2009-09-29','DISA FSO','policy','The organization provides organization-defined personnel or roles with refresher training in the employment and operation of environmental controls in accordance with the organization-defined frequency.','AT-3(1).2','The organization being inspected/assessed:\\n1. Identifies and documents environmental controls that require training.\\n2. Identifies the personnel defined in AT-3 (1), CCI 2050\\n3. Ensures designated personnel receive this training annually\\n4. Maintains and monitors records of personnel who have received this training.\\n\\nDoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines:\\n1. Documentation of environmental controls that require training.\\n2. Documented list of personnel defined in AT-3 (1), CCI 2050\\n3. Ensures identified personnel have received training annually.\\n\\nDoD has defined the frequency as annually.'),\n('001483','draft','2009-09-29','DISA FSO','policy','The organization defines a frequency for providing employees with refresher training in the employment and operation of environmental controls.','AT-3(1).3','DoD has defined the frequency as annual.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as annual.'),\n('001484','draft','2009-09-29','DISA FSO','policy','The organization defines frequency of (or situation requiring) auditing for each identified event.','AU-2.6','DoD has defined the frequency as all auditable events defined in AU-2 (a) per occurrence.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as all auditable events defined in AU-2 (a) per occurrence.'),\n('001485','draft','2009-09-29','DISA FSO','policy','The organization defines the events which are to be audited on the information system on an organization-defined frequency of (or situation requiring) auditing for each identified event.','AU-2.7','The organization being inspected/assessed defines and documents events which are to be audited on the information system.  Events should be selected from the events the information system is capable of auditing as defined in AU-2 (a) and should be based on ongoing risk assessments of current threat information and environment.\\n\\nDoD has determined that the events are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines\\nthe documented list of events which are to be audited on the information system to ensure those events have been defined.\\n\\nDoD has determined that the events are not appropriate to define at the Enterprise level.'),\n('001486','draft','2009-09-29','DISA FSO','policy','The organization defines a frequency for reviewing and updating the list of organization-defined auditable events.','AU-2(3).2','DoD has defined the frequency as annually or more frequently upon changes to situational awareness of threats or vulnerabilities.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually or more frequently upon changes to situational awareness of threats or vulnerabilities.'),\n('001487','draft','2009-09-29','DISA FSO','technical','The information system generates audit records containing information that establishes the identity of any individuals or subjects associated with the event.','AU-3.6','The organization being inspected/assessed configures the information system to generate audit records containing information that establishes the identity of any individuals or subjects associated with the event.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1487.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to generate audit records containing information that establishes the identity of any individuals or subjects associated with the event.  The organization conducting the inspection/assessment reviews the audit records generated to ensure that the records contain  information that establishes the identity of any individuals or subjects associated with the event.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1487.'),\n('001488','draft','2009-09-29','DISA FSO','policy','The organization defines additional, more detailed information to be included in the audit records.','AU-3(1).2','The organization being inspected/assessed defines and documents additional, more detailed information to be included in the audit records.  The additional information must include at a minimum, full-text recording of privileged commands or the individual identities of group account users.  The additional information must provide sufficient detail to reconstruct events to determine cause of compromise and magnitude of damage, malfunction, or security violation.\\n\\nDoD has determined that additional, more detailed information must include, at a minimum, full-text recording of privileged commands or the individual identities of group account users.   DoD has determined that all additional, more detailed information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented list of additional more detailed information to be included in the audit records to ensure that:\\n1. The list is defined; and\\n2. The list includes full-text recording of privileged commands or the individual identities of group account users.\\n\\nDoD has determined that additional, more detailed information must include, at a minimum, full-text recording of privileged commands or the individual identities of group account users.   DoD has determined that it is not appropriate to define at the Enterprise level.'),\n('001489','draft','2009-09-29','DISA FSO','policy','The organization defines information system components for which generated audit records are centrally managed by the organization.',NULL,NULL,NULL),\n('001490','draft','2009-09-29','DISA FSO','policy','The organization defines actions to be taken by the information system upon audit failure (e.g., shut down information system, overwrite oldest audit records, stop generating audit records).','AU-5.4','The organization being inspected/assessed will define and document actions to be taken by the information system upon audit failure.  The organization shall consider trade-offs between the needs for system availability and audit integrity when defining the actions.  Unless availability is an overriding concern, the default action should be to shut down the information system.  DoD has determined that the actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented actions to ensure the organization being inspected/assessed has defined the actions to be taken by the information system upon audit failure.  DoD has determined that the actions are not appropriate to define at the Enterprise level.'),\n('001491','draft','2009-09-29','DISA FSO','policy','The organization correlates information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.','AU-6(6).1','The organization being inspected/assessed will document and implement a process to correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.','The organization conducting the inspection/assessment obtains and examines the documented process and correlated results to ensure the organization being inspected/assessed correlates information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.'),\n('001492','draft','2009-09-29','DISA FSO','policy','The organization defines an authoritative time source for the synchronization of internal information system clocks.','AU-8(1).2','DoD has defined the authoritative time source as an authoritative time server  which is synchronized with redundant United States Naval Observatory (USNO) time servers as designated for the appropriate DoD network (NIPRNet / SIPRNet) and/or the Global Positioning System (GPS).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the authoritative time source as an authoritative time server  which is synchronized with redundant United States Naval Observatory (USNO) time servers as designated for the appropriate DoD network (NIPRNet / SIPRNet) and/or the Global Positioning System (GPS).'),\n('001493','draft','2009-09-29','DISA FSO','technical','The information system protects audit tools from unauthorized access.','AU-9.4','The organization being inspected/assessed configures the information system to disallow unauthorized access to audit tools.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1493.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to disallow unauthorized access to audit tools.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1493.'),\n('001494','draft','2009-09-29','DISA FSO','technical','The information system protects audit tools from unauthorized modification.','AU-9.5','The organization being inspected/assessed configures the information system to disallow unauthorized modification of audit tools.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1494.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to disallow unauthorized modification of audit tools.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1494.'),\n('001495','draft','2009-09-29','DISA FSO','technical','The information system protects audit tools from unauthorized deletion.','AU-9.6','The organization being inspected/assessed configures the information system to disallow unauthorized deletion of audit tools.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1495.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to disallow unauthorized deletion of audit tools.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1495.'),\n('001496','draft','2009-09-29','DISA FSO','technical','The information system implements cryptographic mechanisms to protect the integrity of audit tools.','AU-9(3).2','The organization being inspected/assessed configures the information system to implement cryptographic mechanisms to protect the integrity of audit tools.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1496.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to implement cryptographic mechanisms to protect the integrity of audit tools.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1496.'),\n('001497','draft','2009-09-29','DISA FSO','policy','The organization defines a frequency for the reviews and updates to the baseline configuration of the information system.','CM-2(1).2','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('001498','draft','2009-09-29','DISA FSO','policy','The organization defines a time period after which proposed changes to the information system that have not been approved or disapproved are highlighted.','CM-3(1).5','DoD has defined the time period as 7 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 7 days.'),\n('001499','draft','2009-09-29','DISA FSO','technical','The organization limits privileges to change software resident within software libraries.','CM-5(6).1','The organization being inspected/assessed documents and implements a process to limit privileges to accounts authorized to change software resident within software libraries.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1499.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed limits privileges to change software resident within software libraries.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1499.'),\n('001500','draft','2009-09-29','DISA FSO','technical','The information system automatically implements organization-defined safeguards and countermeasures if security functions (or mechanisms) are changed inappropriately.',NULL,NULL,NULL),\n('001501','draft','2009-09-29','DISA FSO','policy','The organization defines safeguards and countermeasures to be employed by the information system if security functions (or mechanisms) are changed inappropriately.',NULL,NULL,NULL),\n('001502','draft','2009-09-29','DISA FSO','policy','The organization monitors changes to the configuration settings in accordance with organizational policies and procedures.','CM-6.11','The organization being inspected/assessed develops and documents a process for monitoring changes to the configuration settings in accordance with organizational policies and procedures.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed monitors changes to the configuration settings in accordance with organizational policies and procedures.'),\n('001503','draft','2009-09-29','DISA FSO','policy','The organization controls changes to the configuration settings in accordance with organizational policies and procedures.','CM-6.12','The organization being inspected/assessed develops and documents a process for controlling changes to the configuration settings in accordance with organizational policies and procedures.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed controls changes to the configuration settings in accordance with organizational policies and procedures.'),\n('001504','draft','2009-11-02','DISA FSO','policy','The organization develops and documents a personnel security policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','PS-1.3','DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.','DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.'),\n('001505','draft','2009-11-02','DISA FSO','policy','The organization disseminates a personnel security policy to organization-defined personnel or roles.','PS-1.4','DoD disseminates DoD 5200.2-R via the DoD Issuance site: http://www.dtic.mil/whs/directives/corres/pub1.html to meet the DoD requirements for personnel security policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.','DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.'),\n('001506','draft','2009-11-02','DISA FSO','policy','The organization reviews and updates the current personnel security policy in accordance with organization-defined frequency.','PS-1.7','DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.','DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.'),\n('001507','draft','2009-11-02','DISA FSO','policy','The organization defines the frequency with which to review and update the current personnel security policy.','PS-1.8','DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.'),\n('001508','draft','2009-11-02','DISA FSO','policy','The organization defines the frequency with which to review and update the current personnel security procedures.','PS-1.10','DoD has defined the frequency as reviewed annually - updated as appropriate.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.'),\n('001509','draft','2009-11-02','DISA FSO','policy','The organization develops and documents procedures to facilitate the implementation of the personnel security policy and associated personnel security controls.','PS-1.6','DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.','DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.'),\n('001510','draft','2009-11-02','DISA FSO','policy','The organization disseminates personnel security procedures to organization-defined personnel or roles.','PS-1.5','DoD disseminates DoD 5200.2-R via the DoD Issuance site: http://www.dtic.mil/whs/directives/corres/pub1.html to meet the DoD requirements for personnel security policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.','DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.'),\n('001511','draft','2009-11-02','DISA FSO','policy','The organization reviews and updates the current personnel security procedures in accordance with organization-defined frequency.','PS-1.9','DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.','DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.'),\n('001512','draft','2009-11-02','DISA FSO','policy','The organization assigns a risk designation to all organizational positions.','PS-2.1','The organization being inspected/assessed will designate and document all organizational positions, to include government and contract positions, with the appropriate ADP/IT level designation, IAW DoD 5200.2-R.','The organization conducting the inspection/assessment obtains and examines documentation of the ADP/IT level designations.'),\n('001513','draft','2009-11-02','DISA FSO','policy','The organization establishes screening criteria for individuals filling organizational positions.','PS-2.2','DoD 5200.2-R meets the DoD requirements for establishing screening criteria for individuals filling organizational positions.\\n\\nDoD organizations are automatically compliant with this CCI as they are covered at the DoD level by DoD 5200.2-R.','DoD 5200.2-R meets the DoD requirements for establishing screening criteria for individuals filling organizational positions.\\n\\nDoD organizations are automatically compliant with this CCI as they are covered at the DoD level by DoD 5200.2-R.'),\n('001514','draft','2009-11-02','DISA FSO','policy','The organization reviews and updates position risk designations in accordance with organization-defined frequency.','PS-2.3','The organization being inspected/assessed reviews position risk designations annually and revises designations as required based on the reviews.  Records of these reviews must be maintained as an audit trail.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment reviews the audit records of the position designation reviews to ensure reviews are done annually.  DoD has defined the frequency as annually.'),\n('001515','draft','2009-11-02','DISA FSO','policy','The organization defines the frequency with which to review and update position risk designations.','PS-2.4','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('001516','draft','2009-11-02','DISA FSO','policy','The organization screens individuals prior to authorizing access to the information system.','PS-3.1','The organization being inspected/assessed will screen all government and contract personnel to ensure they meet the appropriate ADP/IT level designation requirements IAW DoD 5200.2-R prior to authorizing access to the information system.','The organization conducting the inspection/assessment obtains and examines the information system access list (AC-2) and compares a sampling of authorized users to manning documents (PS-2) to ensure access was granted appropriately IAW ADP/IT level designation requirements within DoD 5200.2-R.'),\n('001517','draft','2009-11-02','DISA FSO','policy','The organization rescreens individuals with authorized access to the information system according to organization-defined conditions requiring rescreening, and where rescreening is so indicated, on the organization-defined frequency of such rescreening.','PS-3.2','The information system owner will rescreen individuals according to system owner defined list of conditions requiring rescreening (CCI-001518) individuals for access to the information system and frequency (CCI - 001519) of such rescreening.  Rescreening actions will be maintained as an audit trail (AU-2).','The organization conducting the inspection/assessment obtains and examines audit records of rescreening actions to ensure the system owner is rescreening individuals according to a system owner-defined list of conditions requiring rescreening and, where re-screening is so indicated, based on the system owner-defined frequency of such rescreening.'),\n('001518','draft','2009-11-02','DISA FSO','policy','The organization defines the conditions requiring rescreening of individuals with authorized access to the information system.','PS-3.3','The information system owner will develop and document the list of conditions requiring  rescreening individuals for access to the information system.  DoD has determined the list of conditions is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documentation of conditions requiring rescreening of individuals for access to the information system.  DoD has determined the list of conditions is not appropriate to define at the Enterprise level.'),\n('001519','draft','2009-11-02','DISA FSO','policy','The organization defines the frequency for rescreening individuals with authorized access to the information system when organization-defined conditions requiring rescreening are met.','PS-3.4','The information system owner will define and document the required frequency of rescreening for access to the information system.  DoD has determined the frequency is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documentation defining the required frequency for rescreening individuals for access to the system.  DoD has determined the frequency is not appropriate to define at the Enterprise level.'),\n('001520','draft','2009-11-02','DISA FSO','policy','The organization ensures that individuals accessing an information system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.','PS-3(1).1','The organization being inspected/assessed ensures that individuals accessing an information system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.','The organization conducting the inspection/assessment obtains and examines security clearance data for all individuals using the classified information system and the system account list (AC-2) and compares lists to ensure all personnel accessing the system are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.'),\n('001521','draft','2009-11-02','DISA FSO','policy','The organization ensures that individuals accessing an information system processing, storing, or transmitting types of classified information which require formal indoctrination, are formally indoctrinated for all of the relevant types of information to which they have access on the system.','PS-3(2).1','The organization being inspected/assessed ensures that individuals accessing an information system processing, storing, or transmitting types of classified information (e.g. Special Access Programs (SAP), Restricted Data (RD), and Sensitive Compartmented Information (SCI)) which require formal indoctrination, is formally indoctrinated for all of the relevant types of information to which they have access on the system.','The organization conducting the inspection/assessment obtains and examines security clearance data for all individuals using the classified information system and the system account list (AC-2) and compares lists to ensure all personnel accessing the system are formally indoctrinated for all of the relevant types of information to which they have access on the system.'),\n('001522','draft','2009-11-02','DISA FSO','policy','The organization, upon termination of individual employment, disables information system access within an organization-defined time period.','PS-4.1','The organization being inspected/assessed   upon termination of  individual employment, terminates information system access immediately and IAW organization security policy and procedures.  The organization must retain an audit trail of account termination actions (AU-2).  DoD has defined the time period as immediately.','The organization conducting the inspection/assessment obtains and examines organizational security policy and procedures documentation and audit records of account termination actions to ensure account termination actions are conducted immediately and IAW organizational security policy and procedures.  DoD has defined the time period as immediately.'),\n('001523','draft','2009-11-02','DISA FSO','policy','The organization, upon termination of individual employment, conducts exit interviews that include a discussion of organization-defined information security topics.','PS-4.4','The organization being inspected/assessed, conducts exit interviews that include a discussion of information security topics defined in PS-4, CCI 3024 upon termination of individual employment IAW organization security policy and procedures.  The organization must retain an audit trail of conducted exit interviews (AU-2)','The organization conducting the inspection/assessment obtains and examines documentation of departed personnel and the audit trail of conducted exit interviews to ensure all departed personnel had exit interviews conducted that include a discussion of information security topics defined in PS-4, CCI 3024.'),\n('001524','draft','2009-11-02','DISA FSO','policy','The organization, upon termination of individual employment, retrieves all security-related organizational information system-related property.','PS-4.6','The organization being inspected/assessed  upon termination of individual employment retrieves all security-related organizational information systems-related property IAW organization security policy and procedures.  The organization must retain an audit trail of all retrieved security-related organizational information systems-related property (AU-2).','The organization conducting the inspection/assessment obtains and examines appropriate organization security-related organizational information systems-related property documentation/logs and compares to audit trail of all retrieved security-related organizational information systems-related property (AU-2) to ensure all property has been retrieved.'),\n('001525','draft','2009-11-02','DISA FSO','policy','The organization, upon termination of individual employment, retains access to organizational information formerly controlled by the terminated individual.','PS-4.7','The organization being inspected/assessed  upon termination of individual employment retains access to organizational information formerly controlled by terminated individual IAW organization security policy and procedures.   Organizational information formerly controlled by terminated individuals generally refers to online work-product including email files.','The organization conducting the inspection/assessment interviews appropriate IT and security personnel to validate the organization has procedures in place which, upon termination of individual\\'s employment, will ensure it retains access to organizational information formerly controlled by the terminated individual.'),\n('001526','draft','2009-11-02','DISA FSO','policy','The organization, upon termination of individual employment, retains access to organizational information systems formerly controlled by the terminated individual.','PS-4.8','The organization being inspected/assessed  upon termination of individual employment retains access to organizational information systems formerly controlled by terminated individual IAW organization security policy and procedures.   Organizational information systems formerly controlled by terminated individuals generally refers to issued hardware (e.g. laptops, BlackBerrys, PEDs, removable media, etc.)','The organization conducting the inspection/assessment interviews appropriate IT and security personnel to validate the organization has procedures in place which, upon termination of individual\\'s employment, will ensure it retains access to organizational information systems formerly controlled by the terminated individual.'),\n('001527','draft','2009-11-03','DISA FSO','policy','The organization reviews and confirms the ongoing operational need for current logical and physical access authorizations to information systems/facilities when individuals are reassigned or transferred to other positions within the organization.','PS-5.1','The organization being inspected/assessed   reviews and confirms ongoing operational need for logical and physical access authorizations to information systems/facilities when individuals are reassigned or transferred to other positions within the organization.  The organization must maintain an audit trail of reviews.','The organization conducting the inspection/assessment obtains and examines the audit trail of reviews to ensure that the organization has confirmed the ongoing operational need for logical and physical access authorizations to information systems/facilities when individuals are reassigned or transferred to other positions within the organization.'),\n('001528','draft','2009-11-03','DISA FSO','policy','The organization initiates organization-defined transfer or reassignment actions within an organization-defined time period following the formal personnel transfer action.','PS-5.2','The organization being inspected/assessed initiates transfer or reassignment actions to ensure all system accesses no longer required are removed and actions to ensure all system accesses required due to the individual\\'s new position are granted immediately when personnel are reassigned or transferred to other positions.  DoD defines transfer or reassignment actions as actions to ensure all system accesses no longer required are removed.  DoD defines the time period as immediately.','The organization conducting the inspection/assessment obtains and examines appropriate organization security-related organizational physical and logical access documentation/logs and compares to transferred personnel documentation to ensure appropriate logical and physical access have been revoked for previous positions and granted for new positions immediately.   DoD defines the time period as immediately.'),\n('001529','draft','2009-11-03','DISA FSO','policy','The organization defines transfer or reassignment actions to initiate within an organization-defined time period following the formal personnel transfer action.','PS-5.3','DoD defines transfer or reassignment actions as actions to ensure all system accesses no longer required are removed.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD defines transfer or reassignment actions as actions to ensure all system accesses no longer required are removed.'),\n('001530','draft','2009-11-03','DISA FSO','policy','The organization defines the time period within which the organization initiates organization-defined transfer or reassignment actions following the formal personnel transfer action.','PS-5.4','DoD defines the time period as immediately.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD defines the time period as immediately.'),\n('001531','draft','2009-11-03','DISA FSO','policy','The organization ensures that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access.','PS-6.4','The organization being inspected/assessed will ensure all individuals have appropriate access agreements in place prior to being granted access to information and information systems.  DD Form 2875 is the accepted DoD methodology of requesting and granting of access to information and information systems.','The organization conducting the inspection/assessment obtains a list of organizational individuals with active accounts and validates the existence of signed DD Form 2875 (paper or electronic) associated with a sampling of individuals selected from the list.'),\n('001532','draft','2009-11-03','DISA FSO','policy','The organization reviews and updates access agreements for organizational information systems in accordance with organization-defined frequency.','PS-6.2','The organization being inspected/assessed reviews/updates the access agreements annually of employees who have signed access agreements.  The purpose of this review/update is to ensure access agreements are current and departed employees no longer have access agreements.  The organization must maintain an audit trail of the review and update activity for review.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines the audit trail to ensure review/update occurred annually and departed employees no longer have valid access agreements.'),\n('001533','draft','2009-11-03','DISA FSO','policy','The organization defines the frequency with which to review and update access agreements for organizational information systems.','PS-6.3','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('001534','draft','2009-11-03','DISA FSO','policy','The organization ensures that access to information with special protection measures is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties.',NULL,NULL,NULL),\n('001535','draft','2009-11-03','DISA FSO','policy','The organization ensures that access to information with special protection measures is granted only to individuals who satisfy associated personnel security criteria.',NULL,NULL,NULL),\n('001536','draft','2009-11-03','DISA FSO','policy','The organization ensures that access to classified information requiring special protection is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties.','PS-6(2).1','The organization being inspected/assessed will grant access to classified information requiring special protection only to individuals who have a valid access authorization that is demonstrated by assigned official government duties.  DD Form 2875 is the accepted DoD methodology of requesting and granting of access to information and information systems.','The organization conducting the inspection/assessment obtains a list of organizational individuals with active accounts and validates the existence of signed DD Form 2875 (paper or electronic) associated with individuals requiring access to classified information with special protection.'),\n('001537','draft','2009-11-03','DISA FSO','policy','The organization ensures that access to classified information requiring special protection is granted only to individuals who satisfy associated personnel security criteria.','PS-6(2).2','The organization being inspected/assessed ensures all authorized access to classified information requiring special protection  is granted only to those individuals who have satisfied the associated personnel security criteria.  DD Form 2875 is the accepted DoD methodology of requesting and granting of access to information and information systems.','The organization conducting the inspection/assessment reviews access agreements; access authorizations; personnel security criteria; along with other relevant documents or records to ensure the organization has granted authorized access to classified information requiring special protection  only to those individuals who have satisfied the associated personnel security criteria.'),\n('001538','draft','2009-11-03','DISA FSO','policy','The organization ensures that access to classified information requiring special protection is granted only to individuals who have read, understood, and signed a nondisclosure agreement.','PS-6(2).3','The organization being inspected/assessed grants access to classified information  requiring special protection only to individuals who have read, understood, and signed a nondisclosure agreement.','The organization conducting the inspection/assessment obtains and examines the access roster and requests the signed nondisclosure agreements of a sampling of individuals to validate the organization requires all access to classified information requiring special protection is granted only to individuals who have a signed nondisclosure agreement.'),\n('001539','draft','2009-11-03','DISA FSO','policy','The organization establishes personnel security requirements including security roles and responsibilities for third-party providers.','PS-7.1','DoD 5220.22-M, DoD 5220.22-R, DoD 5200.2-R, DoD 8570.01-M and DoDI 3020.41 meet the DoD personnel security requirements including security roles and responsibilities for third-party providers.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoD 5220.22-M, DoD 5220.22-R, DoD 5200.2-R, DoD 8570.01-M and DoDI 3020.41.','DoD 5220.22-M, DoD 5220.22-R, DoD 5200.2-R, DoD 8570.01-M and DoDI 3020.41 meet the DoD personnel security requirements including security roles and responsibilities for third-party providers.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoD 5220.22-M, DoD 5220.22-R, DoD 5200.2-R, DoD 8570.01-M and DoDI 3020.41.'),\n('001540','draft','2009-11-03','DISA FSO','policy','The organization documents personnel security requirements for third-party providers.','PS-7.3','The organization being inspected/assessed documents personnel security requirements for third-party providers.','The organization conducting the inspection/assessment obtains and examines the personnel security requirements to ensure the organization being inspected/assessed documents personnel security requirements for third-party providers.'),\n('001541','draft','2009-11-03','DISA FSO','policy','The organization monitors third-party provider compliance with personnel security requirements.','PS-7.7','The organization being inspected/assessed monitors third-party provider compliance with personnel security requirements.  The organization must maintain an audit trail of monitoring activity.','The organization conducting the inspection/assessment obtains and examines the audit trail of monitoring activity to ensure the organization being inspected/assessed monitors third-party provider compliance with personnel security requirements.'),\n('001542','draft','2009-11-03','DISA FSO','policy','The organization employs a formal sanctions process for individuals failing to comply with established information security policies and procedures.','PS-8.1','The organization being inspected/assessed will develop formal procedures within the organizational security policy to employ formal sanctions for personnel failing to comply with established information security policies and procedures.','The organization conducting the inspection/assessment obtains and examines the organizational security policy to ensure it addresses formal procedures for sanctions and interviews security personnel to validate the organization employs a formal sanctions process for personnel failing to comply with established information security policies and procedures.'),\n('001543','draft','2009-11-03','DISA FSO','policy','The organization disseminates the most recent information security program plan to appropriate entities in the organization that includes roles, responsibilities, management commitment, coordination among organizational entities, and compliance.',NULL,NULL,NULL),\n('001544','draft','2009-11-30','DISA FSO','policy','The organization manages information system authenticators by ensuring that authenticators have sufficient strength of mechanism for their intended use.','IA-5.3','The organization being inspected/assessed documents and implements authenticator strength mechanisms sufficient for the intended use of the authenticators.','The organization conducting the inspection/assessment obtains and examines documented authenticator strength mechanisms to ensure that they are defined and that the mechanisms have sufficient strength for the intended use of the authenticators.'),\n('001545','draft','2010-05-11','DISA FSO','policy','The organization defines a frequency for reviewing and updating the access control policy.','AC-1.8','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('001546','draft','2010-05-11','DISA FSO','policy','The organization defines a frequency for reviewing and updating the access control procedures.','AC-1.10','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('001547','draft','2010-05-11','DISA FSO','policy','The organization defines the frequency on which it will review information system accounts for compliance with account management requirements.','AC-2.23','DoD has defined the frequency as at a minimum, annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at a minimum, annually.'),\n('001548','draft','2010-05-11','DISA FSO','policy','The organization defines the information flow control policies for controlling the flow of information within the system.','AC-4.3','The organization being inspected/assessed defines and documents the information flow control policies for controlling the flow of information within the system.  DoD has determined the information flow control policies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information flow control policies to ensure the organization being inspected/assessed  defines the information flow control policies for controlling the flow of information within the system.  DoD has determined the information flow control policies are not appropriate to define at the Enterprise level.'),\n('001549','draft','2010-05-11','DISA FSO','policy','The organization defines the information flow control policies for controlling the flow of information between interconnected systems.','AC-4.4','The organization being inspected/assessed defines and documents the information flow control policies for controlling the flow of information between interconnected systems.  DoD has determined the information flow control policies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information flow control policies to ensure the organization being inspected/assessed  defines the information flow control policies for controlling the flow of information between interconnected systems.  DoD has determined the information flow control policies are not appropriate to define at the Enterprise level.'),\n('001550','draft','2010-05-11','DISA FSO','policy','The organization defines approved authorizations for controlling the flow of information within the system.','AC-4.5','The organization being inspected/assessed defines and documents approved authorizations for controlling the flow of information within the system.','The organization conducting the inspection/assessment obtains and examines the documented approved authorizations to ensure the organization being inspected/assessed defines  approved authorizations for controlling the flow of information within the system.'),\n('001551','draft','2010-05-11','DISA FSO','policy','The organization defines approved authorizations for controlling the flow of information between interconnected systems.','AC-4.6','The organization being inspected/assessed defines and documents approved authorizations for controlling the flow of information between interconnected systems.','The organization conducting the inspection/assessment obtains and examines the documented approved authorizations to ensure the organization being inspected/assessed defines  approved authorizations for controlling the flow of information between interconnected systems.'),\n('001552','draft','2010-05-11','DISA FSO','policy','The organization defines policy that allows or disallows information flows based on changing conditions or operational considerations.',NULL,NULL,NULL),\n('001553','draft','2010-05-11','DISA FSO','policy','The organization defines the security policy filters that privileged administrators have the capability to enable/disable.','AC-4(10).2','The organization being inspected/assessed defines and documents the  security policy filters that privileged administrators have the capability to enable/disable.  DoD has determined the security policy filters are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security policy filters to ensure the organization being inspected/assessed defines the security policy filters that privileged administrators have the capability to enable/disable.  DoD has determined the security policy filters are not appropriate to define at the Enterprise level.'),\n('001554','draft','2010-05-11','DISA FSO','policy','The organization defines the security policy filters that privileged administrators have the capability to configure.','AC-4(11).2','The organization being inspected/assessed defines and documents the  security policy filters that privileged administrators have the capability to configure.   DoD has determined the security policy filters are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security policy filters to ensure the organization being inspected/assessed defines the security policy filters that privileged administrators have the capability to configure.  DoD has determined the security policy filters are not appropriate to define at the Enterprise level.'),\n('001555','draft','2010-05-11','DISA FSO','technical','The information system uniquely identifies destination domains for information transfer.',NULL,NULL,NULL),\n('001556','draft','2010-05-11','DISA FSO','technical','The information system uniquely authenticates destination domains for information transfer.',NULL,NULL,NULL),\n('001557','draft','2010-05-11','DISA FSO','technical','The information system tracks problems associated with the information transfer.',NULL,NULL,NULL),\n('001558','draft','2010-05-11','DISA FSO','policy','The organization defines the security functions (deployed in hardware, software, and firmware) for which access must be explicitly authorized.','AC-6(1).1','DoD has defined the security functions as all functions not publicly accessible.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the security functions as  all functions not publicly accessible.'),\n('001559','draft','2010-05-11','DISA FSO','policy','The organization identifies the individuals authorized to change the value of associated security attributes.','AC-16(2).2','The organization being inspected/assessed identifies and documents the individuals authorized to change the value of associated security attributes.','The organization conducting the inspection/assessment obtains and examines the documented individuals to ensure the organization being inspected/assessed identifies the individuals authorized to change the value of associated security attributes.'),\n('001560','draft','2010-05-11','DISA FSO','policy','The organization identifies individuals (or processes acting on behalf of individuals) authorized to associate organization-defined security attributes with organization-defined objects.','AC-16(4).1','The organization being inspected/assessed identifies and documents individuals (or processes acting on behalf of individuals) authorized to associate security attributes defined in AC-16 (4), CCI 2288 with objects defined in AC-16 (4), CCI 2287.','The organization conducting the inspection/assessment obtains and examines the documented individuals to ensure the organization being inspected/assessed identifies individuals (or processes acting on behalf of individuals) authorized to associate security attributes defined in AC-16 (4), CCI 2288 with objects defined in AC-16 (4), CCI 2287.'),\n('001561','draft','2010-05-11','DISA FSO','policy','The organization defines managed access control points for remote access to the information system.','AC-17(3).2','The organization being inspected/assessed defines and documents managed access control points for remote access to the information system.','The organization conducting the inspection/assessment obtains and examines the documented managed access points to ensure the organization being inspected/assessed defines managed access control points for remote access to the information system.'),\n('001562','draft','2010-05-11','DISA FSO','policy','The organization defines the appropriate action(s) to be taken if an unauthorized remote connection is discovered.',NULL,NULL,NULL),\n('001563','draft','2010-05-11','DISA FSO','policy','The organization defines the appropriate action(s) to be taken if an unauthorized wireless connection is discovered.',NULL,NULL,NULL),\n('001564','draft','2010-05-11','DISA FSO','policy','The organization defines the frequency of security awareness and training policy reviews and updates.','AT-1.5','DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.'),\n('001565','draft','2010-05-11','DISA FSO','policy','The organization defines the frequency of security awareness and training procedure reviews and updates.','AT-1.10','DoD has defined the frequency as reviewed annually - updated as appropriate.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.'),\n('001566','draft','2010-05-11','DISA FSO','policy','The organization provides organization-defined personnel or roles with initial training in the employment and operation of physical security controls.','AT-3(2).1','The organization being inspected/assessed:\\n1. Identifies and documents physical security controls that require training.\\n2. Identifies the personnel defined in AT-3 (2), CCI 2051\\n3. Ensures designated personnel receive this training.\\n4. Maintains and monitors records of personnel who have received this training.','The organization conducting the inspection/assessment obtains and examines:\\n1. Documentation of physical security controls that require training.\\n2. Documented list of personnel defined in AT-3 (2), CCI 2051\\n3. Ensures identified personnel have received the initial training.'),\n('001567','draft','2010-05-11','DISA FSO','policy','The organization provides organization-defined personnel or roles with refresher training in the employment and operation of physical security controls in accordance with the organization-defined frequency.','AT-3(2).2','The organization being inspected/assessed:\\n1. Identifies and documents physical security controls that require training.\\n2. Identifies personnel defined in AT-3 (2), CCI 2051\\n3. Ensures designated personnel receive this training annually\\n4. Maintains and monitors records of personnel who have received this training.\\n\\nDoD has defined the frequency as annual.','The organization conducting the inspection/assessment obtains and examines:\\n1. Documentation of physical security controls that require training.\\n2. Documented list of personnel defined in AT-3 (2), CCI 2051\\n3. Ensures identified personnel have received training annually.\\n\\nDoD has defined the frequency as annual.'),\n('001568','draft','2010-05-11','DISA FSO','policy','The organization defines a frequency for providing employees with refresher training in the employment and operation of physical security controls.','AT-3(2).3','DoD has defined the frequency as annual.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the frequency as annual.'),\n('001569','draft','2010-05-11','DISA FSO','policy','The organization defines the frequency on which it will review and update the audit and accountability policy.','AU-1.8','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('001570','draft','2010-05-11','DISA FSO','policy','The organization defines the frequency on which it will review and update the audit and accountability procedures.','AU-1.10','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('001571','draft','2010-05-11','DISA FSO','policy','The organization defines the information system auditable events.','AU-2.2','DoD has defined the information system auditable events as successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g. classification levels). Successful and unsuccessful logon attempts, Privileged activities or other system level access, Starting and ending time for user access to the system, Concurrent logons from different workstations, Successful and unsuccessful accesses to objects, All program initiations, All direct access to the information system.  All account creations, modifications, disabling, and terminations. All kernel module load, unload, and restart.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information system auditable events as successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g. classification levels). Successful and unsuccessful logon attempts, Privileged activities or other system level access, Starting and ending time for user access to the system, Concurrent logons from different workstations, Successful and unsuccessful accesses to objects, All program initiations, All direct access to the information system.  All account creations, modifications, disabling, and terminations. All kernel module load, unload, and restart.'),\n('001572','draft','2010-05-11','DISA FSO','policy','The organization defines the personnel or roles to be alerted in the event of an audit processing failure.','AU-5.2','The organization being inspected/assessed defines and documents any personnel or roles, in addition to the SCA and ISSO, who shall be alerted in the event of audit processing failure.  If there are no additional personnel or roles, the organization must also document that.  DoD has defined the personnel or roles as at a minimum, the SCA and ISSO.','The organization conducting the inspection/assessment obtains and examines the documented list of personnel or roles who should be alerted in the event of audit processing failure to ensure the organization being inspected/assessed has either defined additional personnel or roles, or identified that there are no additional personnel or roles.   DoD has defined the personnel or roles as at a minimum, the SCA and ISSO.'),\n('001573','draft','2010-05-11','DISA FSO','policy','The organization defines whether to reject or delay network traffic that exceeds organization-defined thresholds.','AU-5(3).2','DoD has defined the action to take as delay.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the action to take as delay.'),\n('001574','draft','2010-05-11','DISA FSO','technical','The information system rejects or delays, as defined by the organization, network traffic which exceed the organization-defined thresholds.','AU-5(3).3','The organization being inspected/assessed configures the information system to delay network communications traffic exceeding the thresholds defined in AU-5 (3), CCI 1859.  DoD has defined the action to take as delay.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1574.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to delay network communications traffic exceeding the thresholds defined in AU-5 (3), CCI 1859.  DoD has defined the action to take as delay.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1574.'),\n('001575','draft','2010-05-11','DISA FSO','policy','The organization defines the system or system component for storing audit records that is a different system or system component than the system or component being audited.','AU-9(2).3','The organization being inspected/assessed defines and documents a system or storage media that will be used to store information system audit data different and separate from the system or media generating the audit data.','The organization conducting the inspection/assessment obtains and examines  the information system or media documentation addressing the storage of backups of information system audit records; information system audit records; and any other relevant documents or records.  The purpose of the reviews is to ensure the organization has defined and documented a system or storage media different from the system or media being audited.'),\n('001576','deprecated','2010-05-11','DISA FSO','technical','The information system produces a system-wide (logical or physical) audit trail of information system audit records.',NULL,NULL,NULL),\n('001577','draft','2010-05-11','DISA FSO','policy','The organization defines the information system components from which audit records are to be compiled into the system-wide audit trail.','AU-12(1).3','The organization being inspected/assessed will define and document the information system components from which audit records are to be compiled into the system-wide audit trail.  The organization will periodically update this list to ensure it is current.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the system-wide audit trail documentation to ensure the organization being inspected/assessed maintains a current list of information system components.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('001578','draft','2010-05-11','DISA FSO','policy','The organization defines the frequency to review and update the current security assessment and authorization procedures.','CA-1.10','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('001579','draft','2010-05-11','DISA FSO','policy','The organization conducts security control assessments using organization-defined forms of testing in accordance with organization-defined frequency and assessment techniques.',NULL,NULL,NULL),\n('001580','draft','2010-05-11','DISA FSO','policy','The organization identifies connections to external information systems (i.e., information systems outside of the authorization boundary).',NULL,NULL,NULL),\n('001581','draft','2010-05-11','DISA FSO','policy','The organization defines personnel or roles to whom the security status of the organization and the information system should be reported.','CA-7.11','Future DoD-wide CM guidance to be published','Future DoD-wide CM guidance to be published'),\n('001582','draft','2010-05-11','DISA FSO','policy','The organization defines other forms of security assessments other than in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment; and performance/load testing that should be included as part of security control assessments.','CA-2(2).2','The organization being inspected/assessed defines and documents other forms of security assessments other than in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment and performance/load testing that should be included as part of security control assessments.  DoD has determined the other forms of security assessments are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented other forms of security assessments to ensure the organization being inspected/assessed defines other forms of security assessments other than in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment and performance/load testing that should be included as part of security control assessments.  DoD has determined the other forms of security assessments are not appropriate to define at the Enterprise level.'),\n('001583','draft','2010-05-11','DISA FSO','policy','The organization selects announced or unannounced assessments for each form of security control assessment.','CA-2(2).3','The organization being inspected/assessed  selects and documents whether announced or unannounced assessments are required for each form of security control assessment that was selected as part of CA-2 (2), CCI 2064.  DoD has determined the announced or unannounced nature of the assessments is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented list of security control assessment techniques defined in CA-2 (2), CCI 2064 and verifies that the security assessment plan defines whether the assessment is announced or unannounced.'),\n('001584','draft','2010-05-11','DISA FSO','policy','The organization defines the frequency with which to review and update configuration management procedures.','CM-1.10','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('001585','draft','2010-05-12','DISA FSO','policy','The organization defines the circumstances that require reviews and updates to the baseline configuration of the information system.','CM-2(1).4','DoD has defined the circumstances as baseline configuration changes or as events dictate  such as changes due to USCYBERCOM tactical orders/ directives or cyber attacks.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the circumstances as baseline configuration changes or as events dictate  such as changes due to USCYBERCOM tactical orders/ directives or cyber attacks.'),\n('001586','draft','2010-05-12','DISA FSO','policy','The organization defines the configuration change control element (e.g., committee, board) responsible for coordinating and providing oversight for configuration change control activities.','CM-3.12','DoD has defined the configuration change control element as a configuration control board (CCB).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the configuration change control element as a configuration control board (CCB).'),\n('001587','draft','2010-05-12','DISA FSO','policy','The organization, when analyzing new software in a separate test environment, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.',NULL,NULL,NULL),\n('001588','draft','2010-05-12','DISA FSO','policy','The organization-defined security configuration checklists reflect the most restrictive mode consistent with operational requirements.','CM-6.4','DoD security configuration or implementation guidance (e.g. STIGs, SRGs,  NSA configuration guides, CTOs, DTMs etc.) meet the DoD requirement for ensuring security configuration checklists reflect the most restrictive mode consistent with operational requirements.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level security configuration or implementation guidance (e.g. STIGs,  SRGs, NSA configuration guides, CTOs, DTMs etc.).','DoD security configuration or implementation guidance (e.g. STIGs,  SRGs, NSA configuration guides, CTOs, DTMs etc.) meet the DoD requirement for ensuring security configuration checklists reflect the most restrictive mode consistent with operational requirements.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level security configuration or implementation guidance (e.g. STIGs, SRGs, NSA configuration guides, CTOs, DTMs etc.).'),\n('001589','draft','2010-05-12','DISA FSO','technical','The organization incorporates detection of unauthorized, security-relevant configuration changes into the organization’s incident response capability to ensure they are tracked.',NULL,NULL,NULL),\n('001590','deprecated','2010-05-12','DISA FSO','policy','The organization develops a list of software programs authorized to execute on the information system.',NULL,NULL,NULL),\n('001591','deprecated','2010-05-12','DISA FSO','policy','The organization develops a list of software programs not authorized to execute on the information system.',NULL,NULL,NULL),\n('001592','draft','2010-05-12','DISA FSO','policy','The organization defines the rules authorizing the terms and conditions of software program usage on the information system.','CM-7(2).1','The organization being inspected/assessed defines and documents their rules for approval of software program usage.  For network capable software programs, the organization being inspected/assessed complies with DoDI 8551.  DoD has determined that the rules authorizing the terms and conditions of software program usage on the information system are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the rules as well as the software list to ensure that all network capable software programs are DoDI 8551 compliant and that the rules authorizing the use of all other programs are defined.  DoD has determined that the rules authorizing the terms and conditions of software program usage on the information system are not appropriate to define at the Enterprise level'),\n('001593','deprecated','2010-05-12','DISA FSO','policy','The organization maintains a list of software programs authorized to execute on the information system.',NULL,NULL,NULL),\n('001594','deprecated','2010-05-12','DISA FSO','policy','The organization maintains a list of software programs not authorized to execute on the information system.',NULL,NULL,NULL),\n('001595','draft','2010-05-12','DISA FSO','policy','The organization maintains rules authorizing the terms and conditions of software program usage on the information system.',NULL,NULL,NULL),\n('001596','draft','2010-05-12','DISA FSO','policy','The organization defines the frequency with which to review and update the current contingency planning procedures.','CP-1.9','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('001597','draft','2010-05-12','DISA FSO','policy','The organization disseminates contingency planning procedures to organization-defined personnel or roles.','CP-1.5','DoD disseminates DoDI 8500.01 organization-wide via the DoD Issuances website. http://www.dtic.mil/whs/directives/corres/dir.html   NIST disseminates NIST SP 800-34 via http://csrc.nist.gov/publications/PubsSPs.html','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01  and NIST SP 800-34.'),\n('001598','draft','2010-05-12','DISA FSO','policy','The organization reviews and updates the current contingency planning procedures in accordance with the organization-defined frequency.','CP-1.10','DoDI 8500.01 and NIST SP 800-34 meet the DoD requirements for contingency planning policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01 and NIST SP 800-34.','DoDI 8500.01 and NIST SP 800-34 meet the DoD requirements for contingency planning policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01 and NIST SP 800-34.'),\n('001599','draft','2010-05-12','DISA FSO','policy','The organization sustains operational continuity of essential missions until full information system restoration at primary processing and/or storage sites.','CP-2(5).3','The organization being inspected/assessed develops and documents procedures within the contingency plan to sustain operational continuity of essential missions until full information system restoration at primary processing and/or storage sites.','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it documents procedures to sustain operational continuity of essential missions until full information system restoration at primary processing and/or storage sites.'),\n('001600','draft','2010-05-12','DISA FSO','policy','The organization sustains operational continuity of essential business functions until full information system restoration at primary processing and/or storage sites.','CP-2(5).4','The organization being inspected/assessed develops and documents procedures within the contingency plan to sustain operational continuity of essential business functions until full information system restoration at primary processing and/or storage sites.','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure it documents procedures to sustain operational continuity of essential business functions until full information system restoration at primary processing and/or storage sites.'),\n('001601','draft','2010-05-12','DISA FSO','policy','The organization sustains operational continuity of essential missions at alternate processing and/or storage sites until information system restoration at primary processing and/or storage sites.','CP-2(6).3','The organization being inspected/assessed documents within their continuity plan a process for continuation of essential missions at alternate processing and/or storage sites until information system restoration at primary processing and/or storage sites.','The organization conducting the inspection/assessment obtains and examines the continuity plan to ensure the organization being inspected/assessed documents a process for continuation of essential missions at alternate processing and/or storage sites until information system restoration at primary processing and/or storage sites.'),\n('001602','draft','2010-05-12','DISA FSO','policy','The organization sustains operational continuity of essential business functions at alternate processing and/or storage sites until information system restoration at primary processing and/or storage sites.','CP-2(6).4','The organization being inspected/assessed documents within their continuity plan a process for continuation of essential business functions at alternate processing and/or storage sites until information system restoration at primary processing and/or storage sites.','The organization conducting the inspection/assessment obtains and examines the continuity plan to ensure the organization being inspected/assessed documents a process for continuation of essential business functions at alternate processing and/or storage sites until information system restoration at primary processing and/or storage sites.'),\n('001603','draft','2010-05-12','DISA FSO','policy','The contingency plan identifies the primary storage site hazards.',NULL,NULL,NULL),\n('001604','draft','2010-05-12','DISA FSO','policy','The organization outlines explicit mitigation actions for organization identified accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster.','CP-6(3).2','The organization being inspected/assessed must identify and document in the contingency plan explicit mitigation actions for  accessibility problems identified in CP-6 (3), CCI 509 to the alternate storage site in the event of an area-wide disruption or disaster.','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure the organization has documented explicit mitigation actions for  accessibility problems identified in CP-6 (3), CCI 509 to the alternate storage site in the event of an area-wide disruption or disaster.'),\n('001605','draft','2010-05-12','DISA FSO','policy','The contingency plan identifies the primary processing site hazards.',NULL,NULL,NULL),\n('001606','draft','2010-05-12','DISA FSO','policy','The organization outlines explicit mitigation actions for organization-identified potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster.','CP-7(2).2','The organization being inspected/assessed must identify and document in the contingency plan explicit mitigation actions for  accessibility problems identified in CP-7 (2), CCI 517 to the alternate processing site in the event of an area-wide disruption or disaster.','The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure the organization has documented explicit mitigation actions for accessibility problems identified in CP-7 (2), CCI 517 to the alternate processing site in the event of an area-wide disruption or disaster.'),\n('001607','draft','2010-05-12','DISA FSO','policy','The organization establishes alternate telecommunications services to support the information system.',NULL,NULL,NULL),\n('001608','draft','2010-05-12','DISA FSO','policy','The organization identifies the primary provider\\'s telecommunications service hazards.',NULL,NULL,NULL),\n('001609','draft','2010-05-12','DISA FSO','policy','The organization can activate the redundant secondary information system that is not collocated with the primary system without loss of information or disruption to operations.','CP-9(6).2','The organization being inspected/assessed establishes a service level agreement which will provide for redundant secondary system support that is not co-located with the primary system, and has configured the system so that it can be activated to accomplish system backups without a loss of information or operational disruption.','The organization conducting the inspection/assessment determines if the organization has established a service level agreement for a redundant secondary system support that is not co-located with the primary system, and has configured the system so it can be activated to accomplish system backups without a loss of information or operational disruption.'),\n('001610','draft','2010-05-12','DISA FSO','policy','The organization defines the time period (by authenticator type) for changing/refreshing authenticators.','IA-5.17','DoD has defined the time period as CAC - every 3 years, or 1 year from term of contract   Password: 60 days   Biometrics: every 3 years.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as CAC - every 3 years, or 1 year from term of contract   Password: 60 days   Biometrics: every 3 years.'),\n('001611','draft','2010-05-12','DISA FSO','policy','The organization defines the minimum number of special characters for password complexity enforcement.','IA-5(1).5','DoD has defined the  minimum number of special characters for password complexity enforcement as one special character.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the  minimum number of special characters for password complexity enforcement as one special character.'),\n('001612','draft','2010-05-12','DISA FSO','policy','The organization defines the minimum number of upper case characters for password complexity enforcement.','IA-5(1).6','DoD has defined the minimum number of upper case characters for password complexity enforcement as one upper-case character.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the minimum number of upper case characters for password complexity enforcement as one upper-case character.'),\n('001613','draft','2010-05-12','DISA FSO','policy','The organization defines the minimum number of lower case characters for password complexity enforcement.','IA-5(1).7','DoD has defined the minimum number of lower case characters for password complexity enforcement as one lower-case character.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the minimum number of lower case characters for password complexity enforcement as one lower-case character.'),\n('001614','draft','2010-05-12','DISA FSO','policy','The organization defines the minimum number of numeric characters for password complexity enforcement.','IA-5(1).8','DoD has defined the minimum number of numeric characters for password complexity enforcement as one numeric character.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the minimum number of numeric characters for password complexity enforcement as one numeric character.'),\n('001615','draft','2010-05-12','DISA FSO','policy','The organization defines the minimum number of characters that are changed when new passwords are created.','IA-5(1).11','DoD has defined the minimum number of characters as 50% of the minimum password length.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\nDoD has defined the minimum number of characters as 50% of the minimum password length.'),\n('001616','draft','2010-05-12','DISA FSO','policy','The organization defines minimum password lifetime restrictions.','IA-5(1).16','DoD has defined the minimum password lifetime restrictions as 24 hours.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the minimum password lifetime restrictions as 24 hours.'),\n('001617','draft','2010-05-12','DISA FSO','policy','The organization defines maximum password lifetime restrictions.','IA-5(1).17','DoD has defined the maximum password lifetime restrictions as 60 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the maximum password lifetime restrictions as 60 days.'),\n('001618','draft','2010-05-12','DISA FSO','policy','The organization defines the number of generations for which password reuse is prohibited.','IA-5(1).19','DoD has defined the number of generations as a minimum of 5.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the number of generations as a minimum of 5.'),\n('001619','draft','2010-05-12','DISA FSO','technical','The information system enforces password complexity by the minimum number of special characters used.','IA-5(1).9','The organization being inspected/assessed configures the information system to enforce password complexity by the minimum number of special characters used.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1619.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce password complexity by the minimum number of special characters used.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1619.'),\n('001620','draft','2010-05-12','DISA FSO','policy','The organization defines the types of and/or specific authenticators for which the registration process must be carried out in person before a designated registration authority with authorization by a designated organizational official (e.g., a supervisor).',NULL,NULL,NULL),\n('001621','draft','2010-05-12','DISA FSO','policy','The organization implements organization-defined security safeguards to manage the risk of compromise due to individuals having accounts on multiple information systems.','IA-5(8).2','The organization being inspected/assessed documents and implements policies and user training including advising users not to use the same password for any of the following:  Domains of differing classification levels.  More than one domain of a classification level (e.g., internal agency network and Intelink).  More than one privilege level (e.g., user, administrator).','The organization conducting the inspection/assessment obtains and examines the documented policies as well as training records to ensure that the organization being inspected/assessed implements policies and training advising users not to use the same password for any of the following:  Domains of differing classification levels.  More than one domain of a classification level (e.g., internal agency network and Intelink).  More than one privilege level (e.g., user, administrator).'),\n('001622','draft','2010-05-12','DISA FSO','policy','The organization identifies personnel with incident response roles and responsibilities with respect to the information system.',NULL,NULL,NULL),\n('001623','draft','2010-05-12','DISA FSO','policy','The incident response training material addresses the procedures and activities necessary to fulfill identified organizational incident response roles and responsibilities.',NULL,NULL,NULL),\n('001624','draft','2010-05-12','DISA FSO','policy','The organization documents the results of incident response tests.','IR-3.4','The organization being inspected/assessed will document the results of incident response tests.','The organization conducting the inspection/assessment obtains and examines:\\n1. the organization\\'s incident response plan to identify organization\\'s testing schedule and,\\n2. results of previous incident response tests to ensure the organization is documenting the results IAW their incident response plan.'),\n('001625','draft','2010-05-12','DISA FSO','policy','The organization implements the resulting incident handling activity changes to incident response procedures, training, and testing/exercises accordingly.','IR-4.4','The organization being inspected/assessed will  follow the latest incident response plan (IR-8) that has been revised (based on IR-4, CCI-000824) and disseminated.  ','The organization conducting the inspection/assessment obtains and examines  recent changes to the incident response plan (based on IR-4, CCI 000824) to verify that they have been disseminated and reviews the most recent after action report to ensure that changes have been followed.  '),\n('001626','draft','2010-05-12','DISA FSO','policy','The organization employs automated mechanisms to assist in the collection of security incident information.','IR-5(1).2','The organization being inspected/assessed will document within their incident handling plan, procedures to leverage the Joint Incident Management System (JIMS).  For the DoD, JIMS is the automated mechanism. ','The organization conducting the inspection/assessment obtains and examines the incident handling plan to ensure that there are procedures identified to leverage the JIMS.'),\n('001627','draft','2010-05-12','DISA FSO','policy','The organization employs automated mechanisms to assist in the analysis of security incident information.','IR-5(1).3','The organization being inspected/assessed will document within their incident handling plan, procedures to leverage the Joint Incident Management System (JIMS).  For the DoD, JIMS is the automated mechanism. ','The organization conducting the inspection/assessment obtains and examines the incident handling plan to ensure that there are procedures identified to leverage the JIMS. '),\n('001628','draft','2010-05-12','DISA FSO','policy','The organization defines a frequency with which to review and update the current system maintenance procedures.','MA-1.10','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('001629','draft','2010-05-12','DISA FSO','policy','The organization employs automated mechanisms to produce up-to-date, accurate, complete, and available records of all maintenance and repair actions needed, in process, and complete.',NULL,NULL,NULL),\n('001630','draft','2010-05-12','DISA FSO','policy','Designated organizational personnel review the maintenance records of the non-local maintenance and diagnostic sessions.',NULL,NULL,NULL),\n('001631','draft','2010-05-12','DISA FSO','policy','The organization, before removal from organizational facilities, and after the service is performed, inspects and sanitizes the component (with regard to potentially malicious software) before reconnecting the component to the information system.','MA-4(3).3','The organization being inspected/assessed  sanitizes and inspects serviced components prior to reusing them on any information system.  Alternatively, the organization being inspected/assessed complies with MA-4 (3) CCI 882.','The organization conducting the inspection/assessment obtains and examines maintenance procedures for all non-local maintenance and diagnostic services  to ensure that the organization being inspected/assessed sanitizes and inspects serviced components prior to reusing them on any information system.  Alternatively, the organization conducting the inspection/assessment ensures the organization being inspected/assessed complies with  MA-4 (3) CCI 882.'),\n('001632','draft','2010-05-12','DISA FSO','technical','The organization protects nonlocal maintenance sessions by separating the maintenance session from other network sessions with the information system by either physically separated communications paths or logically separated communications paths based upon encryption.','MA-4(4).3','The organization being inspected/assessed configures the information system to protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the information system by either physically separated communications paths or logically separated communications paths based upon encryption.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1632.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the information system by either physically separated communications paths or logically separated communications paths based upon encryption.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1632.'),\n('001633','draft','2010-05-12','DISA FSO','policy','The organization defines removable media types and information output requiring marking.',NULL,NULL,NULL),\n('001634','draft','2010-05-12','DISA FSO','policy','The organization identifies authorized personnel with appropriate clearances and access authorizations for gaining physical access to the facility containing an information system that processes classified information.',NULL,NULL,NULL),\n('001635','draft','2010-05-12','DISA FSO','policy','The organization removes individuals from the facility access list when access is no longer required.','PE-2.7','The organization being inspected/assessed will  remove personnel from the authorized access list who no longer have approved access and revoke their credentials, as identified in actions per PE-2, CCI 914.  The organization must document each removal and revocation action as an audit trail.','The organization conducting the inspection/assessment obtains and examines the review and approval actions documentation to ensure that personnel no longer requiring access have been removed from the authorized access list and their credentials have been revoked.'),\n('001636','draft','2010-05-12','DISA FSO','policy','The organization defines the frequency with which to review and update the current security planning policy.','PL-1.6','DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.'),\n('001637','draft','2010-05-12','DISA FSO','policy','The organization reviews and updates the current security planning policy in accordance with organization-defined frequency.','PL-1.7','DoDI 8510.01 meets the requirements for a security planning policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.\\n\\nDoD has defined the frequency as every 5 years.','DoDI 8510.01 meets the requirements for a security planning policy.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01.\\n\\nDoD has defined the frequency as every 5 years.'),\n('001638','draft','2010-05-12','DISA FSO','policy','The organization defines the frequency with which to review and update the current security planning procedures.','PL-1.10','DoD has defined the frequency as reviewed annually - updated as appropriate.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate.'),\n('001639','draft','2010-05-12','DISA FSO','policy','The organization makes readily available to individuals requiring access to the information system the rules that describe their responsibilities and expected behavior with regard to information and information system usage.','PL-4.2','The organization being inspected/assessed must disseminate to all information system users, via an information sharing capability, rules that describe information system user responsibilities and expected behavior with regard to information and information system usage, acceptable use policy (AUP).  Organizations should disseminate the rules by providing to users and requiring signature of acceptance.','The organization conducting the inspection/assessment obtains and examines rules that describe information system user responsibilities via the inspected organization\\'s information sharing capability (e.g. portal, intranet, email, etc.) to ensure it has been disseminated.'),\n('001640','draft','2010-05-12','DISA FSO','policy','The organization updates the critical infrastructure and key resources protection plan that addresses information security issues.','PM-8.2','DoDD 3020.40 meets the DoD requirement for the development of a critical infrastructure and key resource protection plan.\\n\\nDoD components are automatically compliant with this CCI as they are covered by the DoD level, DoDD 3020.40.','DoDD 3020.40 meets the DoD requirement for the development of a critical infrastructure and key resource protection plan.\\n\\nDoD components are automatically compliant with this CCI as they are covered by the DoD level, DoDD 3020.40.'),\n('001641','draft','2010-05-12','DISA FSO','policy','The organization defines the process for conducting random vulnerability scans on the information system and hosted applications.','RA-5.4','DoD has defined the requirement for vulnerability scanning periodicity of every 30 days.  If the organization being inspected/assessed has determined a requirement for random scanning they must document that process.  DoD has defined the frequency as every 30 days or as directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).','The organization conducting the inspection/assessment obtains and examines random vulnerability process documentation (if applicable) to validate the organization has clearly defined and documented a process for conducting random vulnerability scans on the information system and hosted applications.  If the organization being inspected/assessed has determined they have no requirement for random scanning, there is no requirement for a process.'),\n('001642','draft','2010-05-12','DISA FSO','policy','The organization defines the organizational document in which risk assessment results are documented (e.g., security plan, risk assessment report).','RA-3.3','DoD has defined the document as a risk assessment report.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the document as a risk assessment report.'),\n('001643','draft','2010-05-12','DISA FSO','policy','The organization scans for vulnerabilities in the information system and hosted applications in accordance with the organization-defined process for random scans.','RA-5.5','The organization being inspected/assessed will conduct random vulnerability scans every 30 days or as directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).\\n\\nThe organization will document the vulnerability scans as an audit trail for future reference.  The audit trail must be maintained IAW DoD, CYBERCOM, or component policies.\\n\\nDoD has defined the frequency as every 30 days or as directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).\\n.','The organization conducting the inspection/assessment obtains and examines\\nthe vulnerability scanning results every 30 days or as directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs) to verify compliance with the organization being inspected/assessed random vulnerability scanning process.\\n\\nDoD has defined the frequency as every 30 days or as directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).'),\n('001644','draft','2010-05-12','DISA FSO','policy','The organization employs vulnerability scanning procedures that can demonstrate the depth of coverage (i.e., vulnerabilities checked).',NULL,NULL,NULL),\n('001645','draft','2010-05-12','DISA FSO','policy','The organization identifies the information system components to which privileged access is authorized for selected organization-defined vulnerability scanning activities.','RA-5(5).2','DoD has defined the information system components as all information systems and infrastructure components.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information system components as all information systems and infrastructure components.'),\n('001646','draft','2010-05-12','DISA FSO','policy','The organization defines the frequency with which to review and update the current system and services acquisition procedures.','SA-1.10','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.');\nINSERT INTO `cci` VALUES ('001647','draft','2010-05-12','DISA FSO','policy','The organization requires the use of a FIPS-validated, cryptographic module for a technology product that relies on cryptographic functionality to enforce its security policy when no U.S. Government Protection Profile exists for such a specific technology type.',NULL,NULL,NULL),\n('001648','draft','2010-05-12','DISA FSO','policy','The organization makes available to authorized personnel the source code for the information system to permit analysis and testing.',NULL,NULL,NULL),\n('001649','draft','2010-05-12','DISA FSO','policy','The organization identifies and documents (as appropriate) explicit rules to be enforced when governing the installation of software by users.',NULL,NULL,NULL),\n('001650','draft','2010-05-12','DISA FSO','policy','The organization requires the information system developers to manage and control changes to the information system during development.',NULL,NULL,NULL),\n('001651','draft','2010-05-12','DISA FSO','policy','The organization requires the information system integrators to manage and control changes to the information system during development.',NULL,NULL,NULL),\n('001652','draft','2010-05-12','DISA FSO','policy','The organization requires the information system developers to manage and control changes to the information system during implementation.',NULL,NULL,NULL),\n('001653','draft','2010-05-12','DISA FSO','policy','The organization requires the information system integrators to manage and control changes to the information system during implementation.',NULL,NULL,NULL),\n('001654','draft','2010-05-12','DISA FSO','policy','The organization requires the information system developers to manage and control changes to the information system during modification.',NULL,NULL,NULL),\n('001655','draft','2010-05-12','DISA FSO','policy','The organization requires the information system integrators to manage and control changes to the information system during modification.',NULL,NULL,NULL),\n('001656','draft','2010-05-12','DISA FSO','policy','The organization defines the security functions of the information system to be isolated from nonsecurity functions.',NULL,NULL,NULL),\n('001657','draft','2010-05-12','DISA FSO','policy','The organization defines the external boundary of the information system.',NULL,NULL,NULL),\n('001658','draft','2010-05-12','DISA FSO','policy','The organization defines key internal boundaries of the information system.',NULL,NULL,NULL),\n('001659','draft','2010-05-12','DISA FSO','policy','The organization defines the mediation necessary for public access to the organization\\'s internal networks.',NULL,NULL,NULL),\n('001660','draft','2010-05-12','DISA FSO','policy','The organization defines the measures to protect against unauthorized physical connections across boundary protections implemented at organization-defined managed interfaces.',NULL,NULL,NULL),\n('001661','draft','2010-05-12','DISA FSO','policy','The organization defines the security functions, to minimally include information system authentication and re-authentication, within the information system to be included in a trusted communications path.','SC-11.2','DoD has defined the security functions as providers of authentication, reauthentication, and all privileged commands (administration, monitoring, and controlling).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the security functions as providers of authentication, reauthentication, and all privileged commands (administration, monitoring, and controlling).'),\n('001662','draft','2010-05-12','DISA FSO','technical','The information system takes organization-defined corrective action when organization-defined unacceptable mobile code is identified.','SC-18(1).2','The organization being inspected/assessed configures the information system to take  corrective actions defined in SC-18 (1), CCI  2457 when unacceptable mobile code defined in SC-18 (1), CCI 2458 is identified.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1662.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to take  corrective actions defined in SC-18 (1), CCI  2457 when unacceptable mobile code defined in SC-18 (1), CCI 2458 is identified.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1662.'),\n('001663','draft','2010-05-12','DISA FSO','technical','The information system, when operating as part of a distributed, hierarchical namespace, provides the means to enable verification of a chain of trust among parent and child domains (if the child supports secure resolution services).','SC-20.4','The organization being inspected/assessed installs and utilizes software capable of validating the chain of trust (Examples of software include dig, dnsviz, dnssec-debugger, dnssec validator for Mozilla, etc.).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1663.','The organization conducting the inspection/assessment utilizes DNSSEC diagnostic tools, such as dig,  and performs queries which will exercise the data flow path for authoritative name resolution services where parent and child domains exist.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs that pertains to CCI 1663.'),\n('001664','draft','2010-05-12','DISA FSO','technical','The information system recognizes only session identifiers that are system-generated.','SC-23(3).3','The organization being inspected/assessed configures the information system to recognize only session identifiers that are system-generated.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1664.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to recognize only session identifiers that are system-generated.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1664.'),\n('001665','draft','2010-05-12','DISA FSO','technical','The information system preserves organization-defined system state information in the event of a system failure.','SC-24.5','The organization being inspected/assessed configures the information system to  preserve  information necessary to determine cause of failure and to return to operations with least disruption to mission/ business processes in the event of a system failure.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1665.  DoD has defined system state information as information necessary to determine cause of failure and to return to operations with least disruption to mission/ business processes.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to preserve  information necessary to determine cause of failure and to return to operations with least disruption to mission/ business processes in the event of a system failure.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1665.  DoD has defined system state information as information necessary to determine cause of failure and to return to operations with least disruption to mission/ business processes.'),\n('001666','draft','2010-05-12','DISA FSO','policy','The organization employs cryptographic mechanisms to prevent unauthorized modification of information at rest unless otherwise protected by alternative physical measures.',NULL,NULL,NULL),\n('001667','draft','2010-05-12','DISA FSO','policy','The organization compares the time measured between flaw identification and flaw remediation with organization-defined benchmarks.',NULL,NULL,NULL),\n('001668','draft','2010-05-12','DISA FSO','technical','The organization employs malicious code protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means or inserted through the exploitation of information system vulnerabilities.',NULL,NULL,NULL),\n('001669','draft','2010-05-12','DISA FSO','policy','The organization defines the frequency of testing malicious code protection mechanisms.','SI-3(6).2','DoD has defined the frequency as twice annually or when substantial changes are made to the malicious code protection mechanisms.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as twice annually or when substantial changes are made to the malicious code protection mechanisms.'),\n('001670','draft','2010-05-12','DISA FSO','technical','The information system takes organization-defined least-disruptive actions to terminate suspicious events.','SI-4(7).4','The organization being inspected/assessed configures the information system to take least-disruptive actions defined in SI-4 (7), CCI 1268 to terminate suspicious events.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1670.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to take least-disruptive actions defined in SI-4 (7), CCI 1268 to terminate suspicious events.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1670.'),\n('001671','draft','2010-05-12','DISA FSO','policy','The organization analyzes outbound communications traffic at selected organization-defined interior points within the system (e.g., subnetworks, subsystems) to discover anomalies.','SI-4(11).2','The organization being inspected/assessed documents and implements a process to analyze outbound communications traffic at selected interior points defined in SI-4 (11), CCI 2668 within the system (e.g., subnetworks, subsystems) to discover anomalies.  The organization must maintain a record of any discovered anomalies.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of any discovered anomalies to ensure the organization being inspected/assessed analyzes outbound communications traffic at selected interior points defined in SI-4 (11), CCI 2668 within the system (e.g., subnetworks, subsystems) to discover anomalies.'),\n('001672','draft','2010-05-12','DISA FSO','technical','The organization employs a wireless intrusion detection system to identify rogue wireless devices.',NULL,NULL,NULL),\n('001673','draft','2010-05-12','DISA FSO','policy','The organization employs a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system.','SI-4(14).1','The organization being inspected/assessed documents and implements a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified wireless intrusion detection system and the system hardware/software list to ensure the organization being inspected/assessed employs a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system.  The organization being inspected/assessed may be required to demonstrate use of the wireless intrusion detection system.'),\n('001674','draft','2010-05-12','DISA FSO','technical','The information system responds to security function anomalies in accordance with organization-defined responses and alternative action(s).',NULL,NULL,NULL),\n('001675','draft','2010-05-12','DISA FSO','policy','The organization defines the personnel or roles that are to receive reports on the results of security function verification.','SI-6(3).2','DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level   DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.'),\n('001676','draft','2010-05-12','DISA FSO','policy','The organization defines, for periodic security function verification, the frequency of the verifications.',NULL,NULL,NULL),\n('001677','draft','2010-05-12','DISA FSO','technical','The organization employs spam protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means.',NULL,NULL,NULL),\n('001678','draft','2010-05-12','DISA FSO','policy','The organization retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.','SI-12.2','The organization being inspected/assessed identifies and documents federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements which apply to the information within the information system.  The organization documents and implements a process to retain information IAW those documented federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.','The organization conducting the inspection/assessment obtains and examines the documented list of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements which apply to the information within the information system, as well as the documented process for information retention to ensure the organization being inspected/assessed  retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.'),\n('001679','draft','2010-05-12','DISA FSO','policy','The organization provides a mechanism to exchange active and standby roles of the components.',NULL,NULL,NULL),\n('001680','draft','2010-06-09','DISA FSO','policy','The organization develops an organization-wide information security program plan that includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','PM-1.4','DoDI 8500.01 and the Knowledge Service meet the requirement for this CCI; individual organizations and system owners must provide documentation of common control implementation in their Security Plan.','DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.'),\n('001681','deprecated','2011-04-26','DISA FSO','policy','The organization defines the frequency at which each form of security control assessment should be conducted.',NULL,NULL,NULL),\n('001682','draft','2011-05-03','DISA FSO','technical','The information system automatically removes or disables emergency accounts after an organization-defined time period for each type of account.','AC-2(2).4','The organization being inspected/assessed configures the information system to never automatically remove or disable emergency accounts.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1682.  DoD has defined the time period as never.  ','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to never automatically remove or disable emergency accounts.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1682.  DoD has defined the time period as never.'),\n('001683','draft','2011-05-03','DISA FSO','technical','The information system notifies organization-defined personnel or roles for account creation actions.','AC-2(4).5','The organization being inspected/assessed configures the information system to notify the system administrator and ISSO  for account creation actions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1683.  DoD has defined the personnel or roles as the system administrator and ISSO.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  notify the system administrator and ISSO  for account creation actions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1683.  DoD has defined the personnel or roles as the system administrator and ISSO.'),\n('001684','draft','2011-05-03','DISA FSO','technical','The information system notifies organization-defined personnel or roles for account modification actions.','AC-2(4).6','The organization being inspected/assessed configures the information system to notify the system administrator and ISSO  for account modification actions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1684.  DoD has defined the personnel or roles as the system administrator and ISSO.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  notify the system administrator and ISSO  for account modification actions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1684.  DoD has defined the personnel or roles as the system administrator and ISSO.'),\n('001685','draft','2011-05-03','DISA FSO','technical','The information system notifies organization-defined personnel or roles for account disabling actions.','AC-2(4).7','The organization being inspected/assessed configures the information system to notify the system administrator and ISSO for account disabling actions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1685.  DoD has defined the personnel or roles as the system administrator and ISSO.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  notify the system administrator and ISSO for account disabling actions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1685.  DoD has defined the personnel or roles as the system administrator and ISSO.'),\n('001686','draft','2011-05-03','DISA FSO','technical','The information system notifies organization-defined personnel or roles for account removal actions.','AC-2(4).8','The organization being inspected/assessed configures the information system to notify the system administrator and ISSO for account removal actions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1686.  DoD has defined the personnel or roles as the system administrator and ISSO.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  notify the system administrator and ISSO for account removal actions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1686.  DoD has defined the personnel or roles as the system administrator and ISSO.'),\n('001687','draft','2011-05-03','DISA FSO','policy','The organization ensures the use of mobile code to be deployed in information systems meets organization-defined mobile code requirements.','SC-18(2).3','The organization being inspected/assessed documents and implements a process to use mobile code IAW the requirements defined in CCI 1168.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed uses mobile code IAW the requirements defined in CCI 1168.'),\n('001688','draft','2011-05-03','DISA FSO','policy','The organization ensures the acquisition of mobile code to be deployed in information systems meets organization-defined mobile code requirements.','SC-18(2).4','The organization being inspected/assessed documents and implements a process to acquire mobile code IAW the requirements defined in CCI 1168.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed acquire mobile code IAW the requirements defined in CCI 1168.'),\n('001689','draft','2011-05-27','DISA FSO','policy','The organization, if an information system component failure is detected, automatically shuts down the information system.',NULL,NULL,NULL),\n('001690','draft','2011-10-07','DISA FSO','policy','The organization protects, as required, vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system.',NULL,NULL,NULL),\n('001691','draft','2011-10-07','DISA FSO','policy','The organization makes available to authorized personnel vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system with sufficient detail to permit analysis and testing.',NULL,NULL,NULL),\n('001692','draft','2011-10-07','DISA FSO','policy','The organization makes available to authorized personnel vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.',NULL,NULL,NULL),\n('001693','draft','2011-10-07','DISA FSO','technical','The information system enforces a Discretionary Access Control (DAC) policy that limits propagation of access rights.',NULL,NULL,NULL),\n('001694','draft','2011-10-07','DISA FSO','technical','The information system enforces a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user.',NULL,NULL,NULL),\n('001695','draft','2011-10-07','DISA FSO','technical','The information system prevents the execution of organization-defined unacceptable mobile code.','SC-18(3).2','The organization being inspected/assessed configures the information system to prevent the execution of unacceptable mobile code defined in CCI 2459.\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1695.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to prevent the execution of unacceptable mobile code defined in CCI 2459.\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1695.'),\n('001726','draft','2013-02-28','DISA FSO','policy','The organization uses software in accordance with contract agreements.','CM-10.1','The organization being inspected/assessed  uses software in accordance with contract agreements.','The organization conducting the inspection/assessment obtains and examines a sampling of contract agreements and supporting evidence concerning the usage of software to ensure compliance with the contract agreements.'),\n('001727','draft','2013-02-28','DISA FSO','policy','The organization uses software documentation in accordance with contract agreements.','CM-10.2','The organization being inspected/assessed uses software documentation in accordance with contract agreements.','The organization conducting the inspection/assessment obtains and examines a sampling of contract agreements associated with software documentation and supporting evidence concerning the usage of software documentation to ensure compliance with contract agreements.'),\n('001728','draft','2013-02-28','DISA FSO','policy','The organization uses software in accordance with copyright laws.','CM-10.3','The organization being inspected/assessed uses software in accordance with copyright laws.','The organization conducting the inspection/assessment obtains and examines supporting evidence concerning the usage of software  to ensure compliance with copyright laws.'),\n('001729','draft','2013-02-28','DISA FSO','policy','The organization uses software documentation in accordance with copyright laws.','CM-10.4','The organization being inspected/assessed uses software documentation in accordance with copyright laws.','The organization conducting the inspection/assessment obtains and examines supporting evidence concerning the usage of software documentation to ensure compliance with copyright laws.'),\n('001730','draft','2013-02-28','DISA FSO','policy','The organization tracks the use of software protected by quantity licenses to control copying of the software.','CM-10.5','The organization being inspected/assessed  tracks the use of software protected by quantity licenses to control copying of the software.  Software license tracking can be accomplished by manual methods (e.g., simple spreadsheets) or automated methods (e.g., specialized tracking applications) depending on organizational needs.','The organization conducting the inspection/assessment obtains and examines the tracking records to ensure the organization being inspected/assessed tracks the use of software protected by quantity licenses to control copying of the software.'),\n('001731','draft','2013-02-28','DISA FSO','policy','The organization tracks the use of software documentation protected by quantity licenses to control distribution of the software documentation.','CM-10.6','The organization being inspected/assessed  tracks the use of software documentation protected by quantity licenses to control distribution of the software documentation.  Software license tracking can be accomplished by manual methods (e.g., simple spreadsheets) or automated methods (e.g., specialized tracking applications) depending on organizational needs.','The organization conducting the inspection/assessment obtains and examines the tracking records to ensure the organization being inspected/assessed tracks the use of software documentation protected by quantity licenses to control distribution of the software documentation.'),\n('001732','draft','2013-02-28','DISA FSO','policy','The organization controls the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.','CM-10.9','The organization being inspected/assessed reviews and authorizes in order to control the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.  The organization must maintain an audit trail of peer-to-peer file sharing technology reviews and authorizations.','The organization conducting the inspection/assessment obtains and examines the audit trail of peer-to-peer file sharing technology reviews and authorizations to ensure the organization being inspected/assessed controls the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.'),\n('001733','draft','2013-02-28','DISA FSO','policy','The organization documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.','CM-10.10','The organization being inspected/assessed  documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.','The organization conducting the inspection/assessment obtains and examines the documentation for the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.'),\n('001734','draft','2013-02-28','DISA FSO','policy','The organization defines the restrictions to be followed on the use of open source software.','CM-10(1).1','DoD has defined the restrictions as IAW DoD Memorandum \\\"Clarifying Guidance Regarding Open Source Software (OSS)\\\" 16 Oct 2009 (http://dodcio.defense.gov/Home/Issuances/DoDCIOMemorandums.aspx).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the restrictions as IAW DoD Memorandum \\\"Clarifying Guidance Regarding Open Source Software (OSS)\\\" 16 Oct 2009 (http://dodcio.defense.gov/Home/Issuances/DoDCIOMemorandums.aspx).'),\n('001735','draft','2013-02-28','DISA FSO','policy','The organization establishes organization-defined restrictions on the use of open source software.','CM-10(1).2','DoD Memorandum \\\"Clarifying Guidance Regarding Open Source Software (OSS)\\\" 16 Oct 2009 (http://dodcio.defense.gov/Home/Issuances/DoDCIOMemorandums.aspx) meets the DoD requirement for establishing restrictions on the use of open source software.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD Memorandum \\\"Clarifying Guidance Regarding Open Source Software (OSS).\\\"','DoD Memorandum \\\"Clarifying Guidance Regarding Open Source Software (OSS)\\\" 16 Oct 2009 (http://dodcio.defense.gov/Home/Issuances/DoDCIOMemorandums.aspx) meets the DoD requirement for establishing restrictions on the use of open source software.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD Memorandum \\\"Clarifying Guidance Regarding Open Source Software (OSS).\\\"'),\n('001736','draft','2013-02-28','DISA FSO','policy','The organization defines the previous versions of the baseline configuration of the information system required to support rollback.','CM-2(3).2','DoD has defined the previous versions as the previous approved baseline configuration of IS components for a minimum of 3 month.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the previous versions as the previous approved baseline configuration of IS components for a minimum of 3 month.'),\n('001737','draft','2013-02-28','DISA FSO','policy','The organization defines the information systems, system components, or devices that are to have organization-defined configurations applied when located in areas of significant risk.','CM-2(7).1','The organization being inspected/assessed defines and documents, in the configuration management policy, the information systems, system components, or devices that are to have configurations defined in CM-2 (7), CCI 1738 applied when located in areas of significant risk.  DoD has determined that this value is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the configuration management policy to ensure the organization being inspected/assessed defines the information systems, system components, or devices that are to have configurations defined in CM-2 (7), CCI 1738 applied when located in areas of significant risk.  DoD has determined that this value is not appropriate to define at the Enterprise level.'),\n('001738','draft','2013-02-28','DISA FSO','policy','The organization defines the security configurations to be implemented on information systems, system components, or devices when they are located in areas of significant risk.','CM-2(7).2','The organization being inspected/assessed defines and documents, in the configuration management policy, the security configurations to be implemented on information systems, system components, or devices when they are located in areas of significant risk.  DoD has determined that this value is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the configuration management policy to ensure the organization being inspected/assessed defines the security configurations to be implemented on information systems, system components, or devices when they are located in areas of significant risk.  DoD has determined that this value is not appropriate to define at the Enterprise level.'),\n('001739','draft','2013-02-28','DISA FSO','policy','The organization issues organization-defined information systems, system components, or devices with organization-defined configurations to individuals traveling to locations the organization deems to be of significant risk.','CM-2(7).3','The organization being inspected/assessed issues information systems, system components, or devices as defined in CM-2 (7) CCI 1737 with configurations as defined in CM-2 (7) CCI 1738 to individuals traveling to locations the organization deems to be of significant risk.','The organization conducting the inspection/assessment interviews organizational personnel with configuration management responsibilities to ensure that  individuals traveling to locations that the organization deems to be of significant risk are issued information systems, system components, or devices as defined in CM-2 (7) CCI 1737 with configurations as defined in CM-2 (7) CCI 1738.'),\n('001740','draft','2013-02-28','DISA FSO','policy','The organization reviews proposed configuration-controlled changes to the information system.','CM-3.3','The organization being inspected/assessed conducts reviews of records documenting the proposed configuration controlled changes to each information system.  The organization will maintain an audit trail of each proposed configuration controlled change.  This action will be implemented by the CCB as defined in CM-3, CCI 1586.','The organization conducting the inspection/assessment obtains and examines the audit trail of a sampling of proposed configuration controlled changes to ensure the reviews are being conducted.'),\n('001741','draft','2013-02-28','DISA FSO','policy','The organization documents configuration change decisions associated with the information system.','CM-3.4','The organization being inspected/assessed documents configuration change decisions associated with the information system.  The organization must maintain an audit trail of configuration change decisions.  This action will be implemented by the CCB as defined in CM-3, CCI 1586.','The organization conducting the inspection/assessment obtains and examines the audit trail documenting configuration change decisions associated with the information system to ensure the organization being inspected/assessed has documented their decisions.'),\n('001742','draft','2013-02-28','DISA FSO','policy','The organization defines the approval authorities to be notified when proposed changes to the information system are received.','CM-3(1).3','DoD has defined the approval authorities as the configuration control board (CCB).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the approval authorities as the configuration control board (CCB).'),\n('001743','draft','2013-02-28','DISA FSO','policy','The organization defines the security responses to be automatically implemented by the information system if baseline configurations are changed in an unauthorized manner.','CM-3(5).1','The organization being inspected/assessed defines and documents, in the configuration management policy, the security responses to be automatically implemented by the information system if baseline configurations are changed in an unauthorized manner.  DoD has determined that the value is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the configuration management policy to ensure the organization being inspected/assessed defines the security responses to be automatically implemented by the information system if baseline configurations are changed in an unauthorized manner.  DoD has determined that the value is not appropriate to define at the Enterprise level.'),\n('001744','draft','2013-02-28','DISA FSO','technical','The information system implements organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.','CM-3(5).2','The organization being inspected/assessed implements security responses, as defined in CM-3 (5), CCI 1743, automatically if baseline configurations are changed in an unauthorized manner.  The information system must maintain an audit trail of automatic security responses to unauthorized changes in baseline configurations.','The organization conducting the inspection/assessment obtains and examines the audit trail to ensure the organization being inspected/assessed implements security responses, as defined in CM-3 (5), CCI 1743, automatically if baseline configurations are changed in an unauthorized manner.'),\n('001745','draft','2013-02-28','DISA FSO','policy','The organization defines the security safeguards that are to be provided by the cryptographic mechanisms which are employed by the organization.','CM-3(6).1','DoD has defined the security safeguards as all security safeguards.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the security safeguards as all security safeguards.'),\n('001746','draft','2013-02-28','DISA FSO','policy','The organization ensures that cryptographic mechanisms used to provide organization-defined security safeguards are under configuration management.','CM-3(6).2','The organization being inspected/assessed  ensures that cryptographic mechanisms used to provide all security safeguards are under configuration management.  DoD has defined the security safeguards as all security safeguards.','The organization conducting the inspection/assessment obtains and examines the configuration management policy to ensure that cryptographic mechanisms used to provide all security safeguards are documented in the policy.  DoD has defined the security safeguards as all security safeguards.'),\n('001747','draft','2013-02-28','DISA FSO','policy','The organization defines critical software components the information system will prevent from being installed without verification the component has been digitally signed using a certificate that is recognized and approved by the organization.','CM-5(3).1','DoD has defined the software components as any software components when the vendor provides digitally signed products.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the software components as any software components when the vendor provides digitally signed products.'),\n('001748','draft','2013-02-28','DISA FSO','policy','The organization defines critical firmware components the information system will prevent from being installed without verification the component has been digitally signed using a certificate that is recognized and approved by the organization.','CM-5(3).2','DoD has defined the critical firmware components as any firmware components when the vendor provides digitally signed products.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the critical firmware components as any firmware components when the vendor provides digitally signed products.'),\n('001749','draft','2013-02-28','DISA FSO','technical','The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.','CM-5(3).3','The organization being inspected/assessed documents and implements a process to prevent the installation of software onto any software components when the vendor provides digitally signed products without verification that software has been digitally signed using a certificate and approved by the organization.\\n\\nDoD has defined the software components as any software components when the vendor provides digitally signed products.','The organization conducting the inspection/assessment obtains and examines the documented process for preventing the installation of software onto any software components when the vendor provides digitally signed products without verification that software has been digitally signed using a certificate and approved by the organization.\\n\\nThe organization conducting the inspection/assessment reviews software on a sampling of the defined components to ensure that only software digitally signed by a defined CA is installed.\\n\\nDoD has defined the software components as any software components when the vendor provides digitally signed products.'),\n('001750','draft','2013-02-28','DISA FSO','technical','The information system prevents the installation of organization-defined firmware components without verification the firmware component has been digitally signed using a certificate that is recognized and approved by the organization.','CM-5(3).4','The organization being inspected/assessed documents and implements a process to prevent the installation of firmware onto  any firmware components when the vendor provides digitally signed products without verification that firmware has been digitally signed using a certificate and approved by the organization.\\n\\nDoD has defined the critical firmware components as any firmware components when the vendor provides digitally signed products.','The organization conducting the inspection/assessment obtains and examines the documented process for preventing the installation of firmware onto  any firmware components when the vendor provides digitally signed products without verification that firmware has been digitally signed using a certificate and approved by the organization.\\n\\nThe organization conducting the inspection/assessment reviews firmware on a sampling of the defined components to ensure that only firmware digitally signed by a defined CA is installed.'),\n('001751','draft','2013-02-28','DISA FSO','policy','The organization defines system-level information requiring enforcement of a dual authorization for information system changes.','CM-5(4).3','The organization being inspected/assessed defines and documents system-level information requiring enforcement of a dual authorization for information system changes.\\n\\nDoD has determined to the information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented system-level information to ensure the organization being inspected/assessed defines the system-level information requiring enforcement of a dual authorization for information system changes.\\n\\nDoD has determined to the information is not appropriate to define at the Enterprise level.'),\n('001752','draft','2013-02-28','DISA FSO','policy','The organization enforces dual authorization for changes to organization-defined system-level information.','CM-5(4).4','The organization being inspected/assessed documents and implements a process to enforce dual authorization for changes to system-level information defined in CM-5 (4), CCI 1751.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed enforces dual authorization for changes to system-level information defined in CM-5 (4), CCI 1751.'),\n('001753','draft','2013-02-28','DISA FSO','policy','The organization limits privileges to change information system components within a production or operational environment.','CM-5(5).1','The organization being inspected/assessed documents and implements a process to limit privileges to change information system components within a production or operational environment.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed limits privileges to change information system components within a production or operational environment.'),\n('001754','draft','2013-02-28','DISA FSO','policy','The organization limits privileges to change system-related information within a production or operational environment.','CM-5(5).2','The organization being inspected/assessed documents and implements a process to limit privileges to change system-related information within a production or operational environment.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed limits privileges to change system-related information within a production or operational environment.'),\n('001755','draft','2013-02-28','DISA FSO','policy','The organization defines the information system components for which any deviation from the established configuration settings are to be identified, documented, and approved.','CM-6.9','DoD has defined the information system components as all configurable information system components.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the information system components as all configurable information system components.'),\n('001756','draft','2013-02-28','DISA FSO','policy','The organization defines the operational requirements on which the configuration settings for the organization-defined information system components are to be based.','CM-6.10','The organization being inspected/assessed must define and document in the system security plan, the requirements which may deviate from the approved configuration settings on the information system components defined in CM-6, CCI 1755.  DoD has determined that it is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the system security plan to ensure the organization being inspected/assessed defines   the requirements which may deviate from the approved configuration settings on the information system components defined in CM-6, CCI 1755.   DoD has determined that it is not appropriate to define at the Enterprise level.'),\n('001757','draft','2013-02-28','DISA FSO','policy','The organization defines the security safeguards the organization is to employ when responding to unauthorized changes to the organization-defined configuration settings.','CM-6(2).1','The organization being inspected/assessed must define and document in the configuration management policy, the security safeguards the organization is to employ when responding to unauthorized changes to the configuration settings defined in CM-6 (2), CCI 1758.  DoD has determined that it is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the configuration management policy to ensure the organization being inspected/assessed defines the security safeguards the organization is to employ when responding to unauthorized changes to the configuration settings defined in CM-6 (2), CCI 1758.  DoD has determined that it is not appropriate to define at the Enterprise level.'),\n('001758','draft','2013-02-28','DISA FSO','policy','The organization defines configuration settings for which the organization will employ organization-defined security safeguards in response to unauthorized changes.','CM-6(2).2','The organization being inspected/assessed must define and document in the configuration management policy, the configuration settings for which the organization will employ security safeguards defined in CM-6 (2), CCI 1757 in response to unauthorized changes.  DoD has defined the configuration settings as security related configuration settings   defined at the program/system level.','The organization conducting the inspection/assessment obtains and examines the configuration management policy to ensure the organization being inspected/assessed defines the configuration settings for which the organization will employ security safeguards CM-6 (2), CCI 1757 in response to unauthorized changes.  DoD has defined the configuration settings as security related configuration settings   defined at the program/system level. '),\n('001759','draft','2013-02-28','DISA FSO','policy','The organization employs organization-defined security safeguards to respond to unauthorized changes to organization-defined configuration settings.','CM-6(2).3','The organization being inspected/assessed documents and implements security safeguards defined in CM-6 (2), CCI 1757 to respond to unauthorized changes to security related configuration settings  defined at the program/system level.  The organization must maintain an audit trail of security safeguard implementation.  DoD has defined the configuration settings as security related configuration settings  defined at the program/system level. ','The organization conducting the inspection/assessment obtains and examines the documented process and the audit trail of security safeguard implementation to ensure the organization being inspected/assessed implements security safeguards defined in CM-6 (2), CCI 1757 to respond to unauthorized changes to security related configuration settings  defined at the program/system level.   DoD has defined the configuration settings as security related configuration settings  defined at the program/system level. '),\n('001760','draft','2013-02-28','DISA FSO','policy','The organization defines the frequency of information system reviews to identify unnecessary and/or nonsecure functions, ports, protocols, and services.','CM-7(1).2','DoD has defined the frequency as every 30 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every 30 days.'),\n('001761','draft','2013-02-28','DISA FSO','policy','The organization defines the functions, ports, protocols, and services within the information system that are to be disabled when deemed unnecessary and/or nonsecure.','CM-7(1).3','The organization being inspected/assessed must define and document in the system security plan, the functions, ports, protocols and services within the information system that are to be disabled when deemed unnecessary.  DoD has determined that it is not appropriate to define unnecessary functions, ports, protocols and service at the Enterprise level.  Nonsecure functions, ports, protocols and services are defined in DoDI 8551.01.','The organization conducting the inspection/assessment obtains and examines the system security plan to ensure the organization being inspected/assessed defines the functions, ports, protocols and services within the information system that are to be disabled when deemed unnecessary.  DoD has determined that it is not appropriate to define unnecessary functions, ports, protocols and service at the Enterprise level.  Nonsecure functions, ports, protocols and services are defined in DoDI 8551.01.'),\n('001762','draft','2013-02-28','DISA FSO','technical','The organization disables organization-defined functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure.','CM-7(1).4','The organization being inspected/assessed must disable functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure as defined in CM-7 (1), CCI 1761.','The organization conducting the inspection/assessment inspects the information system to ensure the organization being inspected/assessed disables functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure as defined in CM-7 (1), CCI 1761.'),\n('001763','draft','2013-02-28','DISA FSO','policy','The organization defines the policies regarding software program usage and restrictions.','CM-7(2).2','The organization being inspected/assessed defines and documents their rules for approval of software program usage.  For network capable software programs, the organization being inspected/assessed complies with DoDI 8551.  DoD has determined that the rules authorizing the terms and conditions of software program usage on the information system are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the rules as well as the software list to ensure that all network capable software programs are DoDI 8551 compliant and that the rules authorizing the use of all other programs are defined.  DoD has determined that the rules authorizing the terms and conditions of software program usage on the information system are not appropriate to define at the Enterprise level.'),\n('001764','draft','2013-02-28','DISA FSO','technical','The information system prevents program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage.','CM-7(2).3','The organization being inspected/assessed configures the information system to prevent the execution of programs not authorized in accordance with CM-7 (2) CCIs 1592 and 1763.','The organization conducting the inspection/assessment examines the information systems to ensure the systems are configured to prevent the execution of programs not authorized in accordance with CM-7 (2) CCIs 1592 and 1763.'),\n('001765','draft','2013-02-28','DISA FSO','policy','The organization defines the software programs not authorized to execute on the information system.','CM-7(4).1','The organization being inspected/assessed must define and document software programs not authorized to execute on the information system.  For network capable software, the organization-defined list must include all software programs as defined IAW DoDI 8551.01.  DoD has determined that a comprehensive list of unauthorized software programs is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented list of software programs not authorized to execute to ensure that list is defined.  The organization conducting the inspection/assessment reviews the list to ensure that any network capable software is included IAW DoDI 8551.01.  DoD has determined that a comprehensive list of unauthorized software programs is not appropriate to define at the Enterprise level.'),\n('001766','draft','2013-02-28','DISA FSO','policy','The organization identifies the organization-defined software programs not authorized to execute on the information system.','CM-7(4).2','The organization being inspected/assessed must define and document software programs not authorized to execute on the information system.  For network capable software, the organization-defined list must include all software programs as defined IAW DoDI 8551.01.','The organization conducting the inspection/assessment obtains and examines the documented list of software programs not authorized to execute to ensure that list is defined.  The organization conducting the inspection/assessment reviews the list to ensure that any network capable software is included IAW DoDI 8551.01.'),\n('001767','draft','2013-02-28','DISA FSO','technical','The organization employs an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the information system.','CM-7(4).3','Within the DoD, this control cannot be implemented.','Within the DoD, this control cannot be implemented.'),\n('001768','draft','2013-02-28','DISA FSO','policy','The organization defines the frequency on which it will review and update the list of unauthorized software programs.','CM-7(4).4','DoD has defined the frequency as monthly.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as monthly.'),\n('001769','deprecated','2013-02-28','DISA FSO','policy','The organization defines the frequency on which it will update the list of unauthorized software programs.',NULL,NULL,NULL),\n('001770','draft','2013-02-28','DISA FSO','policy','The organization reviews and updates the list of unauthorized software programs per organization-defined frequency.','CM-7(4).5','The organization being inspected/assessed documents and implements a process to review and update the list of unauthorized software programs monthly.   The organization must maintain an audit trail of the review and update activity.  DoD has defined the frequency as monthly.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of reviews and updates to ensure that the organization being inspected/assessed reviews and updates the list of unauthorized software programs monthly.   DoD has defined the frequency as monthly.'),\n('001771','deprecated','2013-02-28','DISA FSO','policy','The organization updates the list of unauthorized software programs per organization-defined frequency.',NULL,NULL,NULL),\n('001772','draft','2013-02-28','DISA FSO','policy','The organization defines the software programs authorized to execute on the information system.','CM-7(5).1','The organization being inspected/assessed must define and document software programs that are authorized to execute on the information system.\\n\\nDoD has determined that a comprehensive list of unauthorized software programs is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented list of software programs that are authorized to execute to ensure that list is defined.\\n\\nDoD has determined that a comprehensive list of unauthorized software programs is not appropriate to define at the Enterprise level.'),\n('001773','draft','2013-02-28','DISA FSO','policy','The organization identifies the organization-defined software programs authorized to execute on the information system.','CM-7(5).2','The organization being inspected/assessed must define and document software programs that are authorized to execute on the information system.','The organization conducting the inspection/assessment obtains and examines the documented list of software programs that are authorized to execute to ensure that list is defined.'),\n('001774','draft','2013-02-28','DISA FSO','technical','The organization employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information system.','CM-7(5).3','The organization being inspected/assessed configures the information system to deny-all and only permit by exception the execution of authorized software programs on the information system.','The organization conducting the inspection/assessment examines the information system to ensure that it is configured to deny-all and only permit by exception the execution of authorized software programs on the information system.'),\n('001775','draft','2013-02-28','DISA FSO','policy','The organization defines the frequency on which it will review and update the list of authorized software programs.','CM-7(5).4','DoD has defined the frequency as monthly.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as monthly.'),\n('001776','deprecated','2013-02-28','DISA FSO','policy','The organization defines the frequency on which it will update the list of authorized software programs.',NULL,NULL,NULL),\n('001777','draft','2013-02-28','DISA FSO','policy','The organization reviews and updates the list of authorized software programs per organization-defined frequency.','CM-7(5).5','The organization being inspected/assessed documents and implements a process to review and update the list of authorized software programs monthly.   The organization must maintain an audit trail of the review and update activity.  DoD has defined the frequency as monthly.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of reviews and updates to ensure that the organization being inspected/assessed reviews and updates the list of authorized software programs monthly.   DoD has defined the frequency as monthly.'),\n('001778','deprecated','2013-02-28','DISA FSO','policy','The organization updates the list of authorized software programs per organization-defined frequency.',NULL,NULL,NULL),\n('001779','draft','2013-02-28','DISA FSO','policy','The organization defines the frequency on which the information system component inventory is to be reviewed and updated.','CM-8.6','DoD has defined the frequency as at a minimum, annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as at a minimum, annually.'),\n('001780','draft','2013-02-28','DISA FSO','policy','The organization reviews and updates the information system component inventory per organization-defined frequency.','CM-8.7','The organization being inspected/assessed documents and implements a process to review and update the information system component inventory at a minimum, annually.\\n\\nThe organization must maintain an audit trail of review and update activity.\\n\\nDoD has defined the frequency as at a minimum, annually.','The organization conducting the inspection/assessment obtains and examines the documented process for reviews and updates as well as the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the information system component inventory  at a minimum, annually.\\n\\nDoD has defined the frequency as at a minimum, annually.'),\n('001781','deprecated','2013-03-01','DISA FSO','policy','The organization defines the frequency on which the information system component inventory is to be updated.',NULL,NULL,NULL),\n('001782','deprecated','2013-03-01','DISA FSO','policy','The organization updates the information system component inventory per organization-defined frequency.',NULL,NULL,NULL),\n('001783','draft','2013-03-01','DISA FSO','policy','The organization defines the personnel or roles to be notified when unauthorized hardware, software, and firmware components are detected within the information system.','CM-8(3).3','The organization being inspected/assessed defines and documents any personnel or roles, in addition to the ISSO or ISSM, to be notified when unauthorized hardware, software, and firmware components are detected within the information system.  If there are no additional personnel or roles, the organization must also document that.  DoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate.','The organization conducting the inspection/assessment obtains and examines the documented list of personnel or roles to be notified when unauthorized hardware, software, and firmware components are detected within the information system to ensure the organization being inspected/assessed has either defined additional personnel or roles, or identified that there are no additional personnel or roles.   DoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate.'),\n('001784','draft','2013-03-01','DISA FSO','policy','When unauthorized hardware, software, and firmware components are detected within the information system, the organization takes action to disable network access by such components, isolates the components, and/or notifies organization-defined personnel or roles.','CM-8(3).4','The organization being inspected/assessed documents and implements a process to take action to disable network access by unauthorized software, hardware, and firmware components,  isolate the components, and/or notify the ISSO and ISSM and others as the local organization deems appropriate.  The organization must maintain an audit trail of actions taken upon detection of unauthorized software, hardware, and firmware components.  DoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate.','The organization conducting the inspection/assessment obtains and examines the documented process and audit trail for taking action upon detection of unauthorized components to ensure the organization being inspected/assessed takes action to disable network access by unauthorized software, hardware, and firmware components,  isolate the components, and/or notify the ISSO and ISSM and others as the local organization deems appropriate.  DoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate.'),\n('001785','draft','2013-03-01','DISA FSO','policy','The organization provides a centralized repository for the inventory of information system components.','CM-8(7).1','The organization being inspected/assessed documents and implements a centralized repository for the inventory of information system components.','The organization conducting the inspection/assessment obtains and examines the documentation of a centralized repository to ensure the organization being inspected/assessed provides a centralized repository for the inventory of information system components.'),\n('001786','draft','2013-03-01','DISA FSO','policy','The organization employs automated mechanisms to support tracking of information system components by geographic location.','CM-8(8).1','The organization being inspected/assessed documents and implements automated mechanisms to support tracking of information system components by geographic location.','The organization conducting the inspection/assessment obtains and examines the documentation of the automated mechanisms to ensure the organization being inspected/assessed employs automated mechanisms to support tracking of information system components by geographic location.'),\n('001787','draft','2013-03-01','DISA FSO','policy','The organization defines the acquired information system components that are to be assigned to an information system.','CM-8(9).1','The organization being inspected/assessed defines and documents the acquired information system components that are to be assigned to an information system.\\n\\nAt no lower than the AO level, the organization must define and document the criteria for or types of information system components where assignment must be tracked. For example, all information system components that collect, store, or process information and are not themselves simply a storage media.\\n\\nDoD has determined that the acquired information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documentation of acquired information system components to ensure the organization being inspected/assessed defines the acquired information system components that are to be assigned to an information system.  DoD has determined that the acquired information system components are not appropriate to define at the Enterprise level.'),\n('001788','draft','2013-03-01','DISA FSO','policy','The organization assigns organization-defined acquired information system components to an information system.','CM-8(9).2','The organization being inspected/assessed  assigns and documents the assignment of acquired information system components, as defined in CM-8 (9), CCI 1787, to an information system.','The organization conducting the inspection/assessment obtains and examines the documentation pertaining to the acquisition of information system components to ensure the organization being inspected/assessed assigns acquired information system components, as defined in CM-8 (9), CCI 1787, to an information system.'),\n('001789','draft','2013-03-01','DISA FSO','policy','The organization receives an acknowledgement from the information system owner of the assignment of the acquired information system components to an information system.','CM-8(9).3','The organization being inspected/assessed documents and implements a process to ensure the organization receives an acknowledgement from the information system owner of the assignment of the acquired information system components to an information system.  The organization must maintain an audit trail of the acknowledgements.','The organization conducting the inspection/assessment obtains and examines the documented process and audit trail of acknowledgements to ensure the organization being inspected/assessed receives an acknowledgement from the information system owner of the assignment of the acquired information system components to an information system.'),\n('001790','draft','2013-03-01','DISA FSO','policy','The organization develops a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.','CM-9.3','The organization being inspected/assessed will develop and document a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.','The organization conducting the inspection/assessment obtains and examines the configuration management plan to verify it establishes and documents a process for identifying configuration items throughout the system development life cycle.'),\n('001791','draft','2013-03-01','DISA FSO','policy','The organization documents a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.',NULL,NULL,NULL),\n('001792','draft','2013-03-01','DISA FSO','policy','The organization implements a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.','CM-9.4','The organization being inspected/assessed will implement a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.','The organization conducting the inspection/assessment obtains and examines the configuration management plan as well as evidence of implementation (e.g., completed change requests, meeting minutes, and other relevant documents) to ensure the organization being inspected/assessed implements a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.  Checks should include verification that items being processed for CM are the items identified and that identified configuration items have not been changed without going through the documented process.'),\n('001793','draft','2013-03-01','DISA FSO','policy','The organization develops a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.','CM-9.5','The organization being inspected/assessed will develop and document a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.','The organization conducting the inspection/assessment obtains and examines the configuration management plan to ensure it establishes and documents a process for managing the configuration of the configuration items.'),\n('001794','draft','2013-03-01','DISA FSO','policy','The organization documents a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.',NULL,NULL,NULL),\n('001795','draft','2013-03-01','DISA FSO','policy','The organization implements a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.','CM-9.6','The organization being inspected/assessed will implement a configuration management plan that has a process for controlling changes to configuration items.','The organization conducting the inspection/assessment obtains and examines the configuration management plan as well as evidence of implementation (e.g., completed change requests, meeting minutes, and other relevant documents) to ensure the organization being inspected/assessed implements a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.'),\n('001796','draft','2013-03-01','DISA FSO','policy','The organization develops a configuration management plan for the information system that places the configuration items under configuration management.','CM-9.9','The organization being inspected/assessed will develop and document a configuration management plan for the information system that places the configuration items under configuration management.','The organization conducting the inspection/assessment obtains and examines the configuration management plan to ensure the organization being inspected/assessed documents that configuration items are placed under configuration management.'),\n('001797','draft','2013-03-01','DISA FSO','policy','The organization documents a configuration management plan for the information system that places the configuration items under configuration management.',NULL,NULL,NULL),\n('001798','draft','2013-03-01','DISA FSO','policy','The organization implements a configuration management plan for the information system that places the configuration items under configuration management.','CM-9.10','The organization being inspected/assessed will implement a configuration management plan for the information system that places the configuration items under configuration management.','The organization conducting the inspection/assessment obtains and examines the configuration management plan as well as evidence of implementation (e.g., completed change requests, meeting minutes, and other relevant documents) to ensure the organization being inspected/assessed implements a configuration management plan  for the information system and that configuration items identified are under configuration management.'),\n('001799','draft','2013-03-01','DISA FSO','policy','The organization develops and documents a configuration management plan for the information system that protects the configuration management plan from unauthorized disclosure and modification.','CM-9.11','The organization being inspected/assessed must develop and document a plan to protect the configuration management plan from unauthorized disclosure and modification.  Measures must include marking, labeling, and handling to prevent improper disclosure.  The organization being inspected/assessed must ensure that all changes to the CM plan are approved.','The organization conducting the inspection/assessment obtains and examines the configuration management plan to verify that it identifies the protection measures.'),\n('001800','deprecated','2013-03-01','DISA FSO','policy','The organization documents a configuration management plan for the information system that protects the configuration management plan from unauthorized disclosure and modification.',NULL,NULL,NULL),\n('001801','draft','2013-03-01','DISA FSO','policy','The organization implements a configuration management plan for the information system that protects the configuration management plan from unauthorized disclosure and modification.','CM-9.12','The organization being inspected/assessed must implement a plan to protect the configuration management plan from unauthorized disclosure and modification.  Measures must include marking, labeling, and handling to prevent improper disclosure.  The organization being inspected/assessed must ensure that all changes to the CM plan are approved.','The organization conducting the inspection/assessment obtains and examines the configuration management plan to verify that the identified protection measures are implemented.'),\n('001802','draft','2013-03-01','DISA FSO','policy','The organization tracks the use of software documentation protected by quantity licenses to control copying of the software documentation.','CM-10.7','The organization being inspected/assessed  tracks the use of software documentation protected by quantity licenses to control copying of the software documentation.  Software license tracking can be accomplished by manual methods (e.g., simple spreadsheets) or automated methods (e.g., specialized tracking applications) depending on organizational needs.','The organization conducting the inspection/assessment obtains and examines the tracking records to ensure the organization being inspected/assessed tracks the use of software documentation protected by quantity licenses to control copying of the software documentation.'),\n('001803','draft','2013-03-01','DISA FSO','policy','The organization tracks the use of software protected by quantity licenses to control distribution of the software.','CM-10.8','The organization being inspected/assessed  tracks the use of software protected by quantity licenses to control distribution of the software.  Software license tracking can be accomplished by manual methods (e.g., simple spreadsheets) or automated methods (e.g., specialized tracking applications) depending on organizational needs.','The organization conducting the inspection/assessment obtains and examines the tracking records to ensure the organization being inspected/assessed tracks the use of software protected by quantity licenses to control distribution of the software.'),\n('001804','draft','2013-03-01','DISA FSO','policy','The organization defines the policies for governing the installation of software by users.','CM-11.1','The organization being inspected/assessed must define policies governing the installation of software by users.  DoD has determined the policies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines policies governing the installation of software by users (e.g., user agreements, CM plan, etc.) to ensure the organization being inspected/assessed defines the policies for governing the installation of software by users.  DoD has determined the policies are not appropriate to define at the Enterprise level.'),\n('001805','draft','2013-03-01','DISA FSO','policy','The organization establishes organization-defined policies governing the installation of software by users.','CM-11.2','The organization being inspected/assessed documents their policies governing the installation of software by users (e.g., user agreements, CM plan, etc.).','The organization conducting the inspection/assessment obtains and examines documented policies  governing the installation of software by users (e.g., user agreements, CM plan, etc.) to ensure the organization being inspected/assessed establishes policies governing the installation of software by users.'),\n('001806','draft','2013-03-01','DISA FSO','policy','The organization defines methods to be employed to enforce the software installation policies.','CM-11.3','The organization being inspected/assessed must define and document the methods employed to enforce the software installation policies.  DoD has determined the policies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines documentation of the methods employed to ensure the organization being inspected/assessed defines methods to be employed to enforce the software installation policies.  DoD has determined the policies are not appropriate to define at the Enterprise level.'),\n('001807','draft','2013-03-01','DISA FSO','policy','The organization enforces software installation policies through organization-defined methods.','CM-11.4','The organization being inspected/assessed must enforce software installation policies as defined in CM-11, CCI 1804 through methods defined in CM-11, CCI 1806.','The organization conducting the inspection/assessment obtains and examines software installation policies defined in CM-11, CCI 1804 and inspects the methods defined in CM-11, CCI 1806 to verify they are properly implemented.'),\n('001808','draft','2013-03-01','DISA FSO','policy','The organization defines the frequency on which it will monitor software installation policy compliance.','CM-11.5','DoD has defined the frequency as at least monthly.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at least monthly.'),\n('001809','draft','2013-03-01','DISA FSO','policy','The organization monitors software installation policy compliance per an organization-defined frequency.','CM-11.6','The organization being inspected/assessed must monitor software installation policy compliance at least monthly.  The organization must maintain audit trails of monitoring activity.  DoD has defined the frequency as at least monthly.','The organization conducting the inspection/assessment obtains and examines the audit trails of monitoring activities to ensure the organization being inspected/assessed  monitors software installation policy compliance at least monthly.  DoD has defined the frequency as at least monthly.'),\n('001810','draft','2013-03-01','DISA FSO','policy','The organization defines the personnel or roles to be notified when unauthorized software is detected.','CM-11(1).1','The organization being inspected/assessed must define and document the personnel or roles to be notified when unauthorized software is detected.  DoD has defined the personnel or roles that must be notified when unauthorized software is detected as the ISSO and ISSM and others as the local organization deems appropriate.','The organization conducting the inspection/assessment obtains and examines the documentation of the personnel or roles to be notified when unauthorized software is detected to ensure that ISSO and ISSM and others as the local organization deems appropriate are defined.  DoD has defined the personnel or roles that must be notified when unauthorized software is detected as the ISSO and ISSM and others as the local organization deems appropriate.'),\n('001811','draft','2013-03-01','DISA FSO','technical','The information system alerts organization-defined personnel or roles when the unauthorized installation of software is detected.','CM-11(1).2','The organization being inspected/assessed must configure the information system to alert ISSO and ISSM and others as the local organization deems appropriate when the unauthorized installation of software is detected.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1811.  DoD has defined the personnel or roles that must be notified when unauthorized software is detected as the ISSO and ISSM and others as the local organization deems appropriate.','The organization conducting the inspection/assessment obtains and examines the configuration of the automated mechanism or evidence that alerts are occurring when unauthorized software is installed to ensure the information system alerts the ISSO and ISSM and others as the local organization deems appropriate when the unauthorized installation of software is detected.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1811.\\n\\nDoD has defined the personnel or roles that must be notified when unauthorized software is detected as the ISSO and ISSM and others as the local organization deems appropriate.'),\n('001812','draft','2013-03-01','DISA FSO','technical','The information system prohibits user installation of software without explicit privileged status.','CM-11(2).1','The organization being inspected/assessed must configure the information system to prevent the installation of software by non-privileged users.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1812.','The organization conducting the inspection/assessment obtains and examines the configuration of the information system components to ensure that installation of  software without explicit privileged status is prohibited.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1812.'),\n('001813','draft','2013-03-01','DISA FSO','technical','The information system enforces access restrictions.','CM-5(1).1','The organization being inspected/assessed documents and implements a process to enforce access restrictions provided by the information system.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the configuration of the information system to ensure access restrictions are implemented.'),\n('001814','draft','2013-03-01','DISA FSO','technical','The Information system supports auditing of the enforcement actions.','CM-5(1).2','The organization being inspected/assessed leverages only information systems which support auditing of enforcement actions.','The organization conducting the inspection/assessment reviews vendor documentation to ensure the information system supports auditing of the enforcement actions.  If vendor documentation is not available, the organization conducting the inspection/assessment tests the information system for the capability.'),\n('001815','draft','2013-03-01','DISA FSO','policy','The organization defines the security safeguards to be applied to devices when they return from areas of significant risk.','CM-2(7).4','The organization being inspected/assessed defines and documents, in the configuration management policy, the security safeguards to be applied to devices when they return from areas of significant risk.  DoD has determined that this value is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the configuration management policy to ensure the organization being inspected/assessed defines the security safeguards to be applied to devices when they return from areas of significant risk.  DoD has determined that this value is not appropriate to define at the Enterprise level.'),\n('001816','draft','2013-03-01','DISA FSO','policy','The organization applies organization-defined security safeguards to devices when individuals return from areas of significant risk.','CM-2(7).5','The organization being inspected/assessed applies security safeguards as defined in CM-2 (7) CCI 1815 to devices when individuals return from areas of significant risk.','The organization conducting the inspection/assessment interviews organizational personnel with configuration management responsibilities to ensure that when individuals return from areas of significant risk, security safeguards as defined in CM-2 (7) CCI 1815 are applied to devices as defined in CM-2 (7) CCI 1737.'),\n('001817','draft','2013-03-01','DISA FSO','policy','The organization, when analyzing changes to the information system, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.','CM-4(1).1','The organization being inspected/assessed documents within their process for analyzing changes to the information system, methods for identifying security impacts due to flaws, weaknesses, incompatibility, or intentional malice.  The organization implements the documented process and must maintain a record of analysis.','The organization conducting the inspection/assessment obtains and examines the documented process and record of analysis to ensure the organization being inspected/assessed, when analyzing changes to the information system, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.'),\n('001818','draft','2013-03-01','DISA FSO','policy','The organization analyzes changes to the information system in a separate test environment before installation in an operational environment.','CM-4(1).2','The organization being inspected/assessed documents and employs a policy to analyze changes to the information system in a separate test environment before installation in an operational environment, looking for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.  The organization must maintain records of analysis of changes to the information system.','The organization conducting the inspection/assessment obtains and examines the documented policy for analyzing changes as well as records of analysis to ensure the organization being inspected/assessed analyzes changes to the information system in a separate test environment before installation in an operational environment, looking for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.'),\n('001819','draft','2013-03-01','DISA FSO','policy','The organization implements approved configuration-controlled changes to the information system.','CM-3.5','The organization being inspected/assessed implements approved configuration-controlled changes to the information system.  The organization must maintain an audit trail of the implementation of approved configuration-controlled changes.','The organization conducting the inspection/assessment obtains and examines the audit trail documenting the implementation of approved configuration-controlled changes to the information system to ensure the organization being inspected/assessed has implemented the approved changes.'),\n('001820','deprecated','2013-03-01','DISA FSO','policy','The organization documents a configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.',NULL,NULL,NULL),\n('001821','draft','2013-03-01','DISA FSO','policy','The organization defines the organizational personnel or roles to whom the configuration management policy is to be disseminated.','CM-1.1',' DoD has defined the organizational personnel or roles as all stakeholders in the configuration management process.',' The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the organizational personnel or roles as all stakeholders in the configuration management process.'),\n('001822','draft','2013-03-01','DISA FSO','policy','The organization disseminates the configuration management policy to organization-defined personnel or roles.','CM-1.4','The organization being inspected/assessed disseminates a configuration management policy via an information sharing capability (e.g. portal, intranet, email, etc.) to  all stakeholders in the configuration management process.\\n\\nDoD has defined the organizational personnel or roles as all stakeholders in the configuration management process.','The organization conducting the inspection/assessment obtains and examines the configuration management policy via the inspected organization\\'s information sharing capability (e.g. portal, intranet, email, etc.) to ensure it has been disseminated.'),\n('001823','deprecated','2013-03-01','DISA FSO','policy','The organization documents the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.',NULL,NULL,NULL),\n('001824','draft','2013-03-01','DISA FSO','policy','The organization defines the organizational personnel or roles to whom the configuration management procedures are to be disseminated.','CM-1.2',' DoD has defined the organizational personnel or roles as all stakeholders in the configuration management process.',' The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the organizational personnel or roles as all stakeholders in the configuration management process.'),\n('001825','draft','2013-03-01','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.','CM-1.6','The organization being inspected/assessed disseminates the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls via an information sharing capability (e.g. portal, intranet, email, etc.) to all stakeholders in the configuration management process.\\n\\nDoD has defined the organizational personnel or roles as all stakeholders in the configuration management process.','The organization conducting the inspection/assessment obtains and examines the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls via the inspected organization\\'s information sharing capability (e.g. portal, intranet, email, etc.) to ensure it has been disseminated.'),\n('001826','draft','2013-03-05','DISA FSO','policy','The organization defines the circumstances upon which the organization reviews the information system changes to determine whether unauthorized changes have occurred.','CM-5(2).4','DoD has defined the circumstances as when there is an incident or when planned changes have been performed.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the circumstances as when there is an incident or when planned changes have been performed.'),\n('001827','draft','2013-03-05','DISA FSO','policy','The organization defines the frequency with which to review information system privileges.','CM-5(5).3','DoD has defined the frequency as every 90 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every 90 days.'),\n('001828','draft','2013-03-05','DISA FSO','policy','The organization defines the frequency with which to reevaluate information system privileges.','CM-5(5).4','DoD has defined the frequency as every 90 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every 90 days.'),\n('001829','draft','2013-03-05','DISA FSO','policy','The organization reviews information system privileges per an organization-defined frequency.','CM-5(5).5','The organization being inspected/assessed reviews information system privileges every 90 days.  The organization must maintain the reviews as an audit trail.  DoD has defined the frequency as every 90 days.','The organization conducting the inspection/assessment obtains and examines the audit trail of reviews to ensure the organization being inspected/assessed reviews information system privileges every 90 days .  DoD has defined the frequency as every 90 days.'),\n('001830','draft','2013-03-05','DISA FSO','policy','The organization reevaluates information system privileges per an organization-defined frequency.','CM-5(5).6','The organization being inspected/assessed  reevaluates information system privileges every 90 days .  The organization must maintain the reevaluations as an audit trail.  DoD has defined the frequency as every 90 days.','The organization conducting the inspection/assessment obtains and examines the audit trail of reviews to ensure the organization being inspected/assessed reevaluates information system privileges every 90 days.  DoD has defined the frequency as every 90 days.'),\n('001831','deprecated','2013-03-14','DISA FSO','policy','The organization documents an audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.',NULL,NULL,NULL),\n('001832','draft','2013-03-14','DISA FSO','policy','The organization disseminates the audit and accountability policy to organization-defined personnel or roles.','AU-1.4','The organization being inspected/assessed disseminates, via an information sharing capability, to  the ISSO and ISSM and others as the local organization deems appropriate an audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.\\n\\nDoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate.','The organization conducting the inspection/assessment obtains and examines the audit and accountability procedures via the inspected organization\\'s information sharing capability (e.g. portal, intranet, email, etc.) to ensure it has been disseminated.'),\n('001833','deprecated','2013-03-14','DISA FSO','policy','The organization documents procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.',NULL,NULL,NULL),\n('001834','draft','2013-03-14','DISA FSO','policy','The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.','AU-1.6','The organization being inspected/assessed disseminates, via an information sharing capability, to the ISSO and ISSM and others as the local organization deems appropriate audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.\\n\\nDoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate.','The organization conducting the inspection/assessment obtains and examines the audit and accountability procedures via the inspected organization\\'s information sharing capability (e.g. portal, intranet, email, etc.) to ensure it has been disseminated.'),\n('001835','deprecated','2013-03-14','DISA FSO','policy','The organization defines the frequency on which it will review the audit and accountability policy.',NULL,NULL,NULL),\n('001836','deprecated','2013-03-14','DISA FSO','policy','The organization defines the frequency on which it will update the audit and accountability policy.',NULL,NULL,NULL),\n('001837','deprecated','2013-03-14','DISA FSO','policy','The organization reviews the audit and accountability policy on an organization-defined frequency.',NULL,NULL,NULL),\n('001838','deprecated','2013-03-14','DISA FSO','policy','The organization updates the audit and accountability policy on an organization-defined frequency.',NULL,NULL,NULL),\n('001839','deprecated','2013-03-14','DISA FSO','policy','The organization defines the frequency on which it will review the audit and accountability procedures.',NULL,NULL,NULL),\n('001840','deprecated','2013-03-14','DISA FSO','policy','The organization defines the frequency on which it will update the audit and accountability procedures.',NULL,NULL,NULL),\n('001841','deprecated','2013-03-14','DISA FSO','policy','The organization reviews the audit and accountability procedures on an organization-defined frequency.',NULL,NULL,NULL),\n('001842','deprecated','2013-03-14','DISA FSO','policy','The organization updates the audit and accountability procedures on an organization-defined frequency.',NULL,NULL,NULL),\n('001843','deprecated','2013-03-14','DISA FSO','policy','The organization defines a frequency for updating the list of organization-defined auditable events.',NULL,NULL,NULL),\n('001844','draft','2013-03-14','DISA FSO','technical','The information system provides centralized management and configuration of the content to be captured in audit records generated by organization-defined information system components.','AU-3(2).1','The organization being inspected/assessed configures the information system to provide centralized management and configuration of the content to be captured in audit records generated by all information system and network components.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1844.  DoD has defined the information system components as all information system and network components.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to  provide centralized management and configuration of the content to be captured in audit records generated by  all information system and network components.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1844.  DoD has defined the information system components as all information system and network components.'),\n('001845','deprecated','2013-03-14','DISA FSO','technical','The information system provides centralized configuration of the content to be captured in audit records generated by organization-defined information system components.',NULL,NULL,NULL),\n('001846','draft','2013-03-14','DISA FSO','policy','The organization defines information system components that will generate the audit records which are to be captured for centralized management of the content.','AU-3(2).2','DoD has defined the information system components as all information system and network components.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information system components as all information system and network components.'),\n('001847','draft','2013-03-14','DISA FSO','policy','The organization defines information system components that will generate the audit records which are to be captured for centralized configuration of the content.','AU-3(2).3','DoD has defined the information system components as all information system and network components.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information system components as all information system and network components.'),\n('001848','draft','2013-03-14','DISA FSO','policy','The organization defines the audit record storage requirements.','AU-4.1','The organization being inspected/assessed defines and documents the required audit record storage capacity.  DoD has determined the audit record storage requirements are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented audit record storage requirements to ensure the organization being inspected/assessed has defined those requirements.  DoD has determined the audit record storage requirements are not appropriate to define at the Enterprise level.'),\n('001849','draft','2013-03-14','DISA FSO','policy','The organization allocates audit record storage capacity in accordance with organization-defined audit record storage requirements.','AU-4.2','The organization being inspected/assessed allocates, and configures the information system to allocate audit record storage capacity as defined in AU-4, CCI 1848.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1849.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to allocate audit record storage capacity as defined in AU-4, CCI 1848.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1849.'),\n('001850','draft','2013-03-14','DISA FSO','policy','The organization defines the frequency on which the information system off-loads audit records onto a different system or media than the system being audited.','AU-4(1).1','DoD has defined the frequency as at a minimum, real-time for interconnected systems and weekly for stand-alone systems.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at a minimum, real-time for interconnected systems and weekly for stand-alone systems.'),\n('001851','draft','2013-03-14','DISA FSO','technical','The information system off-loads audit records per organization-defined frequency onto a different system or media than the system being audited.','AU-4(1).2','The organization being inspected/assessed configures the information system to off-load audit records at a minimum, in real-time for interconnected systems and weekly for stand-alone systems onto a different system or media than the system being audited.  DoD has defined the frequency as at a minimum, real-time for interconnected systems and weekly for stand-alone systems.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1851.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to off-load audit records at a minimum, in real-time for interconnected systems and weekly for stand-alone systems onto a different system or media than the system being audited.  DoD has defined the frequency as at a minimum, real-time for interconnected systems and weekly for stand-alone systems.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1851.'),\n('001852','draft','2013-03-14','DISA FSO','policy','The organization defines the personnel, roles and/or locations to receive a warning when allocated audit record storage volume reaches a defined percentage of maximum audit records storage capacity.','AU-5(1).1','The organization being inspected/assessed defines and documents any personnel or roles, in addition to the ISSO/PMO and ISSM, who shall receive a warning when allocated audit record storage volume reaches a defined percentage of maximum audit records storage capacity.  If there are no additional personnel or roles, the organization must also document that.\\n\\nDoD has defined the personnel or roles as at a minimum, the ISSO/PMO and ISSM.','The organization conducting the inspection/assessment obtains and examines the documented list of personnel or roles who should receive a warning when allocated audit record storage volume reaches a defined percentage of maximum audit records storage capacity to ensure the organization being inspected/assessed has either defined additional personnel or roles, or identified that there are no additional personnel or roles beyond the ISSO/PMO and ISSM.\\n\\nDoD has defined the personnel or roles as at a minimum, the ISSO/PMO and ISSM.'),\n('001853','draft','2013-03-14','DISA FSO','policy','The organization defines the time period within which organization-defined personnel, roles, and/or locations are to receive warnings when allocated audit record storage volume reaches an organization-defined percentage of maximum audit records storage capacity.','AU-5(1).2','DoD has defined the time period as immediate.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as immediate.'),\n('001854','draft','2013-03-14','DISA FSO','policy','The organization defines the percentage of maximum audit record storage capacity that is to be reached, at which time the information system will provide a warning to organization-defined personnel, roles, and/or locations.','AU-5(1).3','DoD has defined the percentage as 75 percent.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the percentage as 75 percent.'),\n('001855','draft','2013-03-14','DISA FSO','technical','The information system provides a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit record storage volume reaches an organization-defined percentage of repository maximum audit record storage capacity.','AU-5(1).4','The organization being inspected/assessed configures the information system to immediately provide  a warning to personnel, roles, and/or locations defined in AU-5 (1), CCI 1852 when allocated audit record storage volume reaches 75 percent of repository maximum audit record storage capacity.   DoD has defined the time period as immediate.  DoD has defined the percentage as 75 percent.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1855.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to immediately provide a warning to personnel, roles, and/or locations defined in AU-5 (1), CCI 1852 when allocated audit record storage volume reaches 75 percent of repository maximum audit record storage capacity.   DoD has defined the time period as immediate.  DoD has defined the percentage as 75 percent.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1855.'),\n('001856','draft','2013-03-14','DISA FSO','policy','The organization defines the real-time period within which the information system is to provide an alert when organization-defined audit failure events occur.','AU-5(2).2','DoD has defined the real-time period as immediate.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the real-time period as immediate.'),\n('001857','draft','2013-03-14','DISA FSO','policy','The organization defines the personnel, roles, and/or locations to receive alerts when organization-defined audit failure events occur.','AU-5(2).3','The organization being inspected/assessed defines and documents any personnel or roles, in addition to the SCA and ISSO, who shall receive alerts when all audit failure events occur.  If there are no additional personnel or roles, the organization must also document that.  DoD has defined the personnel or roles as at a minimum, the SCA and ISSO.  DoD has defined the audit failure events as all.','The organization conducting the inspection/assessment obtains and examines the documented list of personnel or roles who should receive alerts when all audit failure events occur to ensure the organization being inspected/assessed has either defined additional personnel or roles, or identified that there are no additional personnel or roles.  DoD has defined the audit failure events as all.'),\n('001858','draft','2013-03-14','DISA FSO','technical','The information system provides a real-time alert in an organization-defined real-time period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.','AU-5(2).4','The organization being inspected/assessed configures the information system to immediately provide a real-time alert to personnel, roles, and/or locations defined in AU-5 (2), CCI 1857 when all audit failure events requiring real-time alerts occur.  DoD has defined the real-time period as immediate.  DoD has defined the audit failure events as all.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1858.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configured the information system to immediately provide a real-time alert to personnel, roles, and/or locations defined in AU-5 (2), CCI 1857 when all audit failure events requiring real-time alerts occur.  DoD has defined the real-time period as immediate.  DoD has defined the audit failure events as all.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1858.'),\n('001859','draft','2013-03-14','DISA FSO','policy','The organization defines the network communication traffic volume thresholds reflecting limits on auditing capacity, specifying when the information system will reject or delay network traffic that exceed those thresholds.','AU-5(3).4','The organization being inspected/assessed defines and documents the network communication traffic volume thresholds reflecting limits on auditing capacity, specifying when the information system will reject or delay network traffic that exceed those thresholds.','The organization conducting the inspection/assessment obtains and examines the documented network communication traffic volume thresholds to ensure they have been defined.'),\n('001860','draft','2013-03-14','DISA FSO','policy','The organization defines the audit failures which, should they occur, will invoke an organization-defined system mode.','AU-5(4).1','DoD has defined the audit failures as all.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the audit failures as all.'),\n('001861','draft','2013-03-14','DISA FSO','technical','The information system invokes an organization-defined system mode, in the event of organization-defined audit failures, unless an alternate audit capability exists.','AU-5(4).2','The organization being inspected/assessed configures the information system to invoke the system mode defined in AU-5 (4), CCI 2907 in the event all audit failures, unless an alternate audit capability exists.  DoD has defined the audit failures as all.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1861. ','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed  invokes the system mode defined in AU-5 (4), CCI 2907 in the event all audit failures, unless an alternate audit capability exists.\\n\\nDoD has defined the audit failures as all.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1861'),\n('001862','draft','2013-03-15','DISA FSO','policy','The organization defines the types of inappropriate or unusual activity to be reviewed and analyzed in the audit records.','AU-6.3','The organization being inspected/assessed defines and documents the  types of inappropriate or unusual activity to be reviewed and analyzed in the audit records.  DoD has determined that the types of inappropriate or unusual activity are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented types of inappropriate or unusual activity to ensure they have been defined.  DoD has determined that the types of inappropriate or unusual activity are not appropriate to define at the Enterprise level.'),\n('001863','draft','2013-03-15','DISA FSO','policy','The organization defines the personnel or roles to receive the reports of organization-defined inappropriate or unusual activity.','AU-6.5','The organization being inspected/assessed defines and documents any personnel or roles, in addition to the ISSO and ISSM, who shall receive the reports of inappropriate or unusual activity defined in AU-6, CCI 1862.  If there are no additional personnel or roles, the organization must also document that.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.','The organization conducting the inspection/assessment obtains and examines the documented list of personnel or roles who should receive the reports of inappropriate or unusual activity defined in AU-6, CCI 1862 to ensure the organization being inspected/assessed has either defined additional personnel or roles, or identified that there are no additional personnel or roles.'),\n('001864','draft','2013-03-15','DISA FSO','policy','The organization employs automated mechanisms to integrate audit review and analysis to support organizational processes for investigation of and response to suspicious activities.','AU-6(1).1','The organization being inspected/assessed identifies and implements automated mechanisms to integrate audit review and analysis.   The goal is to support organizational investigation of and response to suspicious activities.','The organization conducting the inspection/assessment obtains and examines documentation identifying automated mechanisms to integrate audit review and analysis to ensure such mechanisms have been identified.  The organization conducting the inspection/assessment examines the identified automated mechanisms to ensure they have been implemented.'),\n('001865','draft','2013-03-15','DISA FSO','policy','The organization employs automated mechanisms to integrate reporting processes to support organizational investigation of and response to suspicious activities.','AU-6(1).2','The organization being inspected/assessed identifies and implements automated mechanisms to integrate reporting processes (e.g., centralized log analysis tools).  The goal is to support organizational investigation of and response to suspicious activities.','The organization conducting the inspection/assessment obtains and examines documentation identifying automated mechanisms to integrate reporting processes to ensure such mechanisms have been identified.  The organization conducting the inspection/assessment examines the identified automated mechanisms to ensure they have been implemented.'),\n('001866','draft','2013-03-15','DISA FSO','policy','The organization defines the data/information to be collected from other sources to enhance its ability to identify inappropriate or unusual activity.','AU-6(5).1','The organization being inspected/assessed defines and documents the data/information to be collected from other sources to enhance its ability to identify inappropriate or unusual activity.  If no additional data/information is to be collected, that should also be documented.  DoD has determined that the data/information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines documented data/information from other sources to ensure the information has been defined.  DoD has determined that the data/information is not appropriate to define at the Enterprise level.'),\n('001867','draft','2013-03-15','DISA FSO','policy','The organization integrates analysis of audit records with analysis of vulnerability scanning information, performance data, information system monitoring information, and/or organization-defined data/information collected from other sources to further enhance its ability to identify inappropriate or unusual activity.','AU-6(5).2','The organization being inspected/assessed documents and implements a process to integrate the analysis of audit records with the data/information defined in AU-6 (5), CCI 1866 (if any) to further enhance its ability to identify inappropriate or unusual activity.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed integrates the analysis of audit records with the data/information defined in AU-6 (5), CCI 1866 (if any) to further enhance its ability to identify inappropriate or unusual activity.'),\n('001868','draft','2013-03-15','DISA FSO','policy','The organization specifies the permitted actions for each information system process, role, and/or user associated with the review and analysis of audit information.','AU-6(7).1','The organization being inspected/assessed specifies and documents the permitted actions for each information system process, role, and/or user associated with the review and analysis of audit information.','The organization conducting the inspection/assessment obtains and examines the documented permitted actions to ensure the organization being inspected/assessed specifies the permitted actions for each information system process, role, and/or user associated with the review and analysis of audit information.'),\n('001869','draft','2013-03-15','DISA FSO','policy','The organization specifies the permitted actions for each information system process, role, and/or user associated with the reporting of audit information.','AU-6(7).2','The organization being inspected/assessed specifies and documents the permitted actions for each information system process, role, and/or user associated with the reporting of audit information.','The organization conducting the inspection/assessment obtains and examines the documented permitted actions to ensure the organization being inspected/assessed specifies the permitted actions for each information system process, role, and/or user associated with the reporting of audit information.'),\n('001870','draft','2013-03-15','DISA FSO','policy','The organization performs a full-text analysis of audited privileged commands in a physically-distinct component or subsystem of the information system, or other information system that is dedicated to that analysis.','AU-6(8).1','The organization being inspected/assessed documents and implements a process to perform a full-text analysis of audited privileged commands in a physically-distinct component or subsystem of the information system, or other information system that is dedicated to that analysis.','The organization conducting the inspection/assessment obtains and examines the documented process and supporting records (e.g., analysis results) to ensure the organization being inspected/assessed performs a full-text analysis of audited privileged commands in a physically-distinct component or subsystem of the information system, or other information system that is dedicated to that analysis.'),\n('001871','draft','2013-03-15','DISA FSO','policy','The organization correlates information from non-technical sources with audit information to enhance organization-wide situational awareness.','AU-6(9).1','The organization being inspected/assessed documents and implements a process to correlate information from non-technical sources with audit information to enhance organization-wide situational awareness.','The organization conducting the inspection/assessment obtains and examines the documented process and supporting records to ensure the organization being inspected/assessed correlates information from non-technical sources with audit information to enhance organization-wide situational awareness.'),\n('001872','draft','2013-03-15','DISA FSO','policy','The organization adjusts the level of audit review and analysis within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.','AU-6(10).1','The organization being inspected/assessed documents and implements a process for adjusting the level of audit review within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information (e.g., INFOCON).','The organization conducting the inspection/assessment obtains and examines the documented process and supporting records to ensure the organization being inspected/assessed adjusts the level of audit review within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.'),\n('001873','deprecated','2013-03-15','DISA FSO','policy','The organization adjusts the level of audit analysis within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.',NULL,NULL,NULL),\n('001874','draft','2013-03-15','DISA FSO','policy','The organization adjusts the level of audit reporting within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.','AU-6(10).2','The organization being inspected/assessed documents and implements a process for adjusting the level of audit reporting within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information (e.g., INFOCON).','The organization conducting the inspection/assessment obtains and examines the documented process and supporting records to ensure the organization being inspected/assessed adjusts the level of audit reporting within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.'),\n('001875','draft','2013-03-15','DISA FSO','technical','The information system provides an audit reduction capability that supports on-demand audit review and analysis.','AU-7.1','The organization being inspected/assessed must employ information systems that provide an audit reduction capability that support on-demand audit review and analysis (either natively or through the use of third-party tools).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1875.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed employs information systems that provide an audit reduction capability that support on-demand audit review and analysis (either natively or through the use of third-party tools).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1875.'),\n('001876','draft','2013-03-15','DISA FSO','technical','The information system provides an audit reduction capability that supports on-demand reporting requirements.','AU-7.2','The organization being inspected/assessed must employ information systems that provide an audit reduction capability that support on-demand reporting requirements (either natively or through the use of third-party tools).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1876.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed employs information systems that provide an audit reduction capability that supports on-demand reporting requirements (either natively or through the use of third-party tools).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1876.'),\n('001877','draft','2013-03-15','DISA FSO','technical','The information system provides an audit reduction capability that supports after-the-fact investigations of security incidents.','AU-7.3','The organization being inspected/assessed must employ information systems that provide an audit reduction capability that support after-the-fact investigations of security incidents (either natively or through the use of third-party tools).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1877.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed employs information systems that provide an audit reduction capability that supports after-the-fact investigations of security incidents (either natively or through the use of third-party tools).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1877.'),\n('001878','draft','2013-03-15','DISA FSO','technical','The information system provides a report generation capability that supports on-demand audit review and analysis.','AU-7.4','The organization being inspected/assessed must employ information systems that provide a report generation capability that support on-demand audit review and analysis (either natively or through the use of third-party tools).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1878.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed employs information systems that provide a report generation capability that supports on-demand audit review and analysis (either natively or through the use of third-party tools).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1878.'),\n('001879','draft','2013-03-15','DISA FSO','technical','The information system provides a report generation capability that supports on-demand reporting requirements.','AU-7.5','The organization being inspected/assessed must employ information systems that provide a report generation capability that support on-demand reporting requirements (either natively or through the use of third-party tools).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1879.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed employs information systems that provide a report generation capability that supports on-demand reporting requirements (either natively or through the use of third-party tools).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1879.'),\n('001880','draft','2013-03-15','DISA FSO','technical','The information system provides a report generation capability that supports after-the-fact investigations of security incidents.','AU-7.6','The organization being inspected/assessed must employ information systems that provide a report generation capability that support after-the-fact investigations of security incidents (either natively or through the use of third-party tools).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1880.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed employs information systems that provide a report generation capability that supports after-the-fact investigations of security incidents (either natively or through the use of third-party tools).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1880.'),\n('001881','draft','2013-03-15','DISA FSO','technical','The information system provides an audit reduction capability that does not alter original content or time ordering of audit records.','AU-7.7','The organization being inspected/assessed must ensure that the audit reduction capability does not alter the original audit records.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1881.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed employs an audit reduction capability that does not alter original audit records.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1881.'),\n('001882','draft','2013-03-15','DISA FSO','technical','The information system provides a report generation capability that does not alter original content or time ordering of audit records.','AU-7.8','The organization being inspected/assessed must ensure that the report generation capability does not alter the original audit records.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1882.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed employs a report generation capability that does not alter original audit records.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1882.'),\n('001883','draft','2013-03-15','DISA FSO','policy','The organization defines the audit fields within audit records to be processed for events of interest by the information system.','AU-7(1).2','The organization being inspected/assessed must define and document  the audit fields within audit records to be processed for events of interest by the information system.  DoD has determined that the audit fields are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented audit fields to ensure the organization being inspected/assessed defines the audit fields within audit records to be processed for events of interest by the information system.   DoD has determined that the audit fields are not appropriate to define at the Enterprise level.'),\n('001884','draft','2013-03-15','DISA FSO','policy','The organization defines the audit fields within audit records to be sorted for events of interest by the information system.','AU-7(2).1','The organization being inspected/assessed must define and document the audit fields within audit records to be sorted for events of interest by the information system.  DoD has determined that the audit fields are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented audit fields to ensure the organization being inspected/assessed defines the audit fields within audit records to be sorted for events of interest by the information system.  DoD has determined that the audit fields are not appropriate to define at the Enterprise level.'),\n('001885','draft','2013-03-15','DISA FSO','policy','The organization defines the audit fields within audit records to be searched for events of interest by the information system.','AU-7(2).2','The organization being inspected/assessed must define and document the audit fields within audit records to be searched for events of interest by the information system.  DoD has determined that the audit fields are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented audit fields to ensure the organization being inspected/assessed defines the audit fields within audit records to be searched for events of interest by the information system.   DoD has determined that the audit fields are not appropriate to define at the Enterprise level.'),\n('001886','draft','2013-03-15','DISA FSO','technical','The information system provides the capability to sort audit records for events of interest based on the content of organization-defined audit fields within audit records.','AU-7(2).3','The organization being inspected/assessed must employ information systems that provide the capability to sort audit records for events of interest based on the content of audit fields within audit records as defined in AU-7 (2), CCI 1884.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1886.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed employs information systems that provide the capability to sort audit records for events of interest based on the content of audit fields within audit records as defined in AU-7 (2), CCI 1884.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1886.'),\n('001887','draft','2013-03-15','DISA FSO','technical','The information system provides the capability to search audit records for events of interest based on the content of organization-defined audit fields within audit records.','AU-7(2).4','The organization being inspected/assessed must employ information systems that provide the capability to search audit records for events of interest based on the content of audit fields within audit records as defined in AU-7 (2), CCI 1885.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1887.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed employs information systems that provide the capability to search audit records for events of interest based on the content of audit fields within audit records as defined in AU-7 (2), CCI 1885.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1887.'),\n('001888','draft','2013-03-15','DISA FSO','policy','The organization defines the granularity of time measurement for time stamps generated for audit records.','AU-8.2','DoD has defined the granularity of time measurement as one second.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the granularity of time measurement as one second.'),\n('001889','draft','2013-03-15','DISA FSO','technical','The information system records time stamps for audit records that meet organization-defined granularity of time measurement.','AU-8.3','The organization being inspected/assessed configures the information system to generate time in the time stamps for audit records that meets one second granularity of time measurement.  DoD has defined the granularity of time measurement as one second.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1889.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to generate time in the time stamps for audit records that meets one second granularity of time measurement.  DoD has defined the granularity of time measurement as one second.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1889.'),\n('001890','draft','2013-03-15','DISA FSO','technical','The information system records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).','AU-8.4','The organization being inspected/assessed configures the information system to generate  time stamps for audit records that contain time zones or time offsets that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1890.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to generate  time stamps for audit records that contain time zones or time offsets that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1890.'),\n('001891','draft','2013-03-15','DISA FSO','technical','The information system compares internal information system clocks on an organization-defined frequency with an organization-defined authoritative time source.','AU-8(1).3','The organization being inspected/assessed configures the information system to synchronize internal information system clocks every 24 hours for networked systems with an authoritative time server which is synchronized with redundant United States Naval Observatory (USNO) time servers as designated for the appropriate DoD network (NIPRNet / SIPRNet) and/or the Global Positioning System (GPS) when the time difference is greater than the difference defined in AU-8 (1), CCI 1892.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1891.\\n\\nDoD has defined the frequency as every 24 hours for networked systems.\\n\\nDoD has defined the authoritative time source as an authoritative time server  which is synchronized with redundant United States Naval Observatory (USNO) time servers as designated for the appropriate DoD network (NIPRNet / SIPRNet) and/or the Global Positioning System (GPS).','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to synchronize internal information system clocks every 24 hours for networked systems with an authoritative time server which is synchronized with redundant United States Naval Observatory (USNO) time servers as designated for the appropriate DoD network (NIPRNet / SIPRNet) and/or the Global Positioning System (GPS) when the time difference is greater than the difference defined in AU-8 (1), CCI 1892.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1891.\\n\\nDoD has defined the frequency as every 24 hours for networked systems.\\n\\nDoD has defined the authoritative time source as an authoritative time server  which is synchronized with redundant United States Naval Observatory (USNO) time servers as designated for the appropriate DoD network (NIPRNet / SIPRNet) and/or the Global Positioning System (GPS).'),\n('001892','draft','2013-03-15','DISA FSO','policy','The organization defines the time difference which, when exceeded, will require the information system to synchronize the internal information system clocks to the organization-defined authoritative time source.','AU-8(1).4','The organization being inspected/assessed defines and documents the time difference, which, when exceeded, will require the information system to synchronize the internal information system clocks.\\n\\nDoD has determined the time difference is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented time difference to ensure the organization being inspected/assessed defines the time difference which, when exceeded, will require the information system to synchronize the internal information system clocks.\\n\\nDoD has determined the time difference is not appropriate to define at the Enterprise level.'),\n('001893','draft','2013-03-15','DISA FSO','technical','The information system identifies a secondary authoritative time source that is located in a different geographic region than the primary authoritative time source.','AU-8(2).1','The organization being inspected/assessed configures the information system to use a secondary authoritative time source that is located in a different geographic region than the primary authoritative time source.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1893.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed uses a secondary authoritative time source that is located in a different geographic region than the primary authoritative time source.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1893.'),\n('001894','draft','2013-03-15','DISA FSO','policy','The organization defines the subset of privileged users who will be authorized access to the management of audit functionality.','AU-9(4).1','The organization being inspected/assessed defines and documents the subset of privileged users to be authorized access to the management of audit functionality.  DoD has determined the subset of privileged users is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented subset of privileged users to be authorized access to the management of audit functionality, to ensure the organization being inspected/assessed defines and documents the subset of privileged users to be authorized access to the management of audit functionality.  DoD has determined the subset of privileged users is not appropriate to define at the Enterprise level.'),\n('001895','draft','2013-03-15','DISA FSO','policy','The organization defines the audit information requiring dual authorization for movement or deletion actions.','AU-9(5).1','The organization being inspected/assessed defines and documents the audit information requiring dual authorization for movement or deletion actions.  DoD has determined the audit information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the definition of audit information requiring dual authorization for movement or deletion actions, to ensure the organization being inspected/assessed defines and documents the audit information requiring dual authorization for movement or deletion actions.  DoD has determined the audit information is not appropriate to define at the Enterprise level.'),\n('001896','draft','2013-03-15','DISA FSO','technical','The organization enforces dual authorization for movement and/or deletion of organization-defined audit information.','AU-9(5).2','The organization being inspected/assessed configures the information system to enforce dual authorization for movement and/or deletion of audit information defined in AU-9 (5), CCI 1895.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1896.','The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to enforce dual authorization for movement and/or deletion of audit information defined in AU-9 (5), CCI 1895.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1896.'),\n('001897','draft','2013-03-15','DISA FSO','policy','The organization defines the subset of privileged users who will be authorized read-only access to audit information.','AU-9(6).1','The organization being inspected/assessed defines and documents the subset of privileged users who will be authorized read-only access to audit information.  DoD has determined that the subset of privileged users is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the subset of privileged users who will be authorized read-only access to audit information, to ensure the organization being inspected/assessed defines and documents subset of privileged users who will be authorized read-only access to audit information.  DoD has determined that the subset of privileged users is not appropriate to define at the Enterprise level.'),\n('001898','draft','2013-03-15','DISA FSO','policy','The organization authorizes read-only access to audit information to an organization-defined subset of privileged users.','AU-9(6).2','The organization being inspected/assessed authorizes read only access to audit information to only the subset of privileged users defined in AU-9 (6), CCI 1897.','The organization conducting the inspection/assessment obtains and examines the documentation of read only access authorizations for audit information to ensure only the subset of privileged users defined in AU-9 (6), CCI 1897 have been granted access authorization.'),\n('001899','draft','2013-03-15','DISA FSO','policy','The organization defines the actions to be covered by non-repudiation.','AU-10.2','DoD has defined the actions to be covered by non-repudiation as actions defined by DoDI 8520.02 and DoDI 8520.03. ','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the actions to be covered by non-repudiation as actions defined by DoDI 8520.02 and DoDI 8520.03.   '),\n('001900','draft','2013-03-15','DISA FSO','policy','The organization defines the strength of binding to be applied to the binding of the identity of the information producer with the information.','AU-10(1).1','The organization being inspected/assessed  defines and documents the strength of binding and where within the information system it has been implemented, to be applied to the binding of the identity of the information producer with the information.  DoD has determined that the strength of binding is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented strength of binding to ensure the organization being inspected/assessed defines the strength of binding and where within the information system it has been implemented, to be applied to the binding of the identity of the information producer with the information.  DoD has determined that the strength of binding is not appropriate to define at the Enterprise level.'),\n('001901','draft','2013-03-15','DISA FSO','technical','The information system binds the identity of the information producer with the information to an organization-defined strength of binding.','AU-10(1).2','The organization being inspected/assessed configures the information system to bind the identify  of the information producer with the information with the strength of binding defined in AU-10 (1) CCI 1900.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1901.','The organization conducting the inspection/assessment examines the information system to ensure the producer identity is bound to the information with the strength of binding defined in AU-10 (1) CCI 1900.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1901.'),\n('001902','draft','2013-03-15','DISA FSO','technical','The information system provides the means for authorized individuals to determine the identity of the producer of the information.','AU-10(1).3','The organization being inspected/assessed configures the information system to provide a means for authorized individuals to determine the identity of the producer of the information.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1902.','The organization conducting the inspection/assessment examines the information system to ensure authorized individuals are able to determine the identity of the producer of the information.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1902.'),\n('001903','draft','2013-03-15','DISA FSO','policy','The organization defines the frequency on which the information system is to validate the binding of the information producer identity to the information.','AU-10(2).1','DoD has defined the frequency as according to the tool\\'s capability frequency, but at a minimum, upon first access or hourly in cases of continued access.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as according to the tool\\'s capability frequency, but at a minimum, upon first access or hourly in cases of continued access.'),\n('001904','draft','2013-03-15','DISA FSO','technical','The information system validates the binding of the information producer identity to the information at an organization-defined frequency.','AU-10(2).2','The organization being inspected/assessed configures the information system to validate the binding of the information producer identity to the information according to the tool\\'s capability frequency, but at a minimum, upon first access or hourly in cases of continued access.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1904.  DoD has defined the frequency as according to the tool\\'s capability frequency, but at a minimum, upon first access or hourly in cases of continued access.','The organization conducting the inspection/assessment examines the information system to ensure the information system is configured to validate the binding of the information producer identity to the information according to the tool\\'s capability frequency, but at a minimum, upon first access or hourly in cases of continued access.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1904.  DoD has defined the frequency as according to the tool\\'s capability frequency, but at a minimum, upon first access or hourly in cases of continued access.'),\n('001905','draft','2013-03-15','DISA FSO','policy','The organization defines the actions to be performed in the event of an error when validating the binding of the information producer identity to the information.','AU-10(2).3','The organization being inspected/assessed defines and documents the actions to be performed in the event of an error when validating the binding of the information producer identity to the information.  The organization should consider the system\\'s environment and impact of the errors when defining the actions.  Examples of actions include automated notification to administrators, halt system process or read action   DoD has determined the actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented actions to ensure the organization being inspected/assessed defines the actions to be performed in the event of an error when validating the binding of the information producer identity to the information.  DoD has determined the actions are not appropriate to define at the Enterprise level.'),\n('001906','draft','2013-03-15','DISA FSO','technical','The information system performs organization-defined actions in the event of an error when validating the binding of the information producer identity to the information.','AU-10(2).4','The organization being inspected/assessed configures the information system to perform the actions defined in AU-10 (2), CCI 1905 in the event of an error when validating the binding of the information producer identity to the information.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1906.','The organization conducting the inspection/assessment examines the information system to ensure the information system is configured to perform the actions defined in AU-10 (2), CCI 1905 in the event of an error when validating the binding of the information producer identity to the information.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1906.'),\n('001907','draft','2013-03-15','DISA FSO','policy','The organization defines the security domains which will require the information system validate the binding of the information reviewer identity to the information at the transfer or release points prior to release/transfer.','AU-10(4).2','The organization being inspected/assessed defines and documents the security domains  which require the information system validate the binding of the information reviewer identity to the information at the transfer or release points prior to release/transfer.  DoD has determined the security domains are not appropriate to define at the Enterprise level.  Note: Security domain as defined by CNSSI 4009.','The organization conducting the inspection/assessment obtains and examines the documented security domains to ensure the organization being inspected/assessed defines the security domains which require the information system validate the binding of the information reviewer identity to the information at the transfer or release points prior to release/transfer.  DoD has determined the security domains are not appropriate to define at the Enterprise level.'),\n('001908','draft','2013-03-15','DISA FSO','policy','The organization defines the action the information system is to perform in the event of an information reviewer identity binding validation error.','AU-10(4).3','The organization being inspected/assessed defines and documents the actions the information system is to perform in the event of a information reviewer identity binding validation error.  At a minimum, the actions must include alerting the data/information owner of a validation error on a reviewers identity.\\n\\nDoD has determined that all actions are not appropriate to define at the Enterprise level.    At a minimum, the actions must include alerting the data/information owner of a validation error on a reviewers identity.','The organization conducting the inspection/assessment obtains and examines the documented actions to ensure the organization being inspected/assessed defines the actions the information system is to perform in the event of a information reviewer identity binding validation error.  At a minimum, the actions must include alerting the data/information owner of a validation error on a reviewers identity.\\n\\nDoD has determined that all actions are not appropriate to define at the Enterprise level.    At a minimum, the actions must include alerting the data/information owner of a validation error on a reviewers identity.'),\n('001909','draft','2013-03-15','DISA FSO','technical','The information system performs organization-defined actions in the event of an information reviewer identity binding validation error.','AU-10(4).4','The organization being inspected/assessed configures the information system to perform actions defined in AU-10 (4), CCI 1908 in the event of an information reviewer identity binding validation error.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1909.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to perform actions defined in AU-10 (4), CCI 1908 in the event of an information reviewer identity binding validation error.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1909.'),\n('001910','draft','2013-03-15','DISA FSO','policy','The organization defines the personnel or roles allowed to select which auditable events are to be audited by specific components of the information system.','AU-12.4','DoD has defined the personnel or roles as the ISSM or individuals appointed by the ISSM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as the ISSM or individuals appointed by the ISSM.'),\n('001911','draft','2013-03-15','DISA FSO','policy','The organization defines the selectable event criteria to be used as the basis for changes to the auditing to be performed on organization-defined information system components, by organization-defined individuals or roles, within organization-defined time thresholds.','AU-12(3).1','The organization being inspected/assessed defines and documents the selectable event criteria for which changed auditing is to be performed.  DoD has determined the selectable event criteria is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented selectable event criteria to ensure the organization being inspected/assessed defines the selectable event criteria for which changed auditing is to be performed.  DoD has determined the selectable event criteria is not appropriate to define at the Enterprise level.'),\n('001912','draft','2013-03-15','DISA FSO','policy','The organization defines the time thresholds for organization-defined individuals or roles to change the auditing to be performed based on organization-defined selectable event criteria.','AU-12(3).2','The organization being inspected/assessed defines and documents the time thresholds for individuals or roles to change the auditing to be performed on information system components based on selectable event criteria defined in AU-12 (3), CCI 1911 occurs.  DoD has determined the time thresholds are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented time thresholds to ensure the organization being inspected/assessed defines  the time thresholds for individuals or roles to change the auditing to be performed on information system components based on selectable event criteria defined in AU-12 (3), CCI 1911 occurs.  DoD has determined the time thresholds are not appropriate to define at the Enterprise level.'),\n('001913','draft','2013-03-15','DISA FSO','policy','The organization defines the individuals or roles that are to be provided the capability to change the auditing to be performed based on organization-defined selectable event criteria, within organization-defined time thresholds.','AU-12(3).3','The organization being inspected/assessed defines and documents the individuals or roles that are to be provided the capability to change the auditing to be performed based on the selectable event criteria defined in AU-12 (3), CCI 1911, within the time thresholds defined in AU-12 (3), CCI 1912.  DoD has determined that the individuals or roles are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented individuals or roles to ensure the organization being inspected/assessed defines the individuals or roles that are to be provided the capability to change the auditing to be performed  based on the selectable event criteria defined in AU-12 (3), CCI 1911, within the time thresholds defined in AU-12 (3), CCI 1912.  DoD has determined that the individuals or roles are not appropriate to define at the Enterprise level.'),\n('001914','draft','2013-03-15','DISA FSO','technical','The information system provides the capability for organization-defined individuals or roles to change the auditing to be performed on organization-defined information system components based on organization-defined selectable event criteria within organization-defined time thresholds.','AU-12(3).4','The organization being inspected/assessed configures the information system to provide the capability for  individuals or roles defined in AU-12 (3), CCI 1913 to change the auditing to be performed on information system components defined in AU-12 (3), CCI 2047 based on selectable event criteria defined in AU-12 (3), CCI 1911 within time thresholds defined in AU-12 (3), CCI 1912.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1914.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide the capability for  individuals or roles defined in AU-12 (3), CCI 1913 to change the auditing to be performed on information system components defined in AU-12 (3), CCI 2047 based on selectable event criteria defined in AU-12 (3), CCI 1911 within time thresholds defined in AU-12 (3), CCI 1912.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1914.'),\n('001915','draft','2013-03-15','DISA FSO','policy','The organization defines the open source information and/or information sites to be monitored for evidence of unauthorized exfiltration or disclosure of organizational information.','AU-13.3','The organization being inspected/assessed defines and documents the open source information and/or information sites to be monitored for evidence of unauthorized exfiltration or disclosure of organizational information.\\n\\nDoD has determined that open source information and/or information sites should be defined at the Component level, not appropriate to define at the Enterprise level. Note:  The value in this control may not be used to deny reciprocal acceptance of a C&A (A&A) package.','The organization conducting the inspection/assessment obtains and examines the documented open source information and/or information sites to ensure the organization being inspected/assessed defines  the open source information and/or information sites to be monitored for evidence of unauthorized exfiltration or disclosure of organizational information.\\n\\nDoD has determined that open source information and/or information sites should be defined at the Component level, not appropriate to define at the Enterprise level. Note:  The value in this control may not be used to deny reciprocal acceptance of a C&A (A&A) package.'),\n('001916','draft','2013-03-15','DISA FSO','policy','The organization employs automated mechanisms to determine if organizational information has been disclosed in an unauthorized manner.','AU-13(1).1','The organization being inspected/assessed documents and employs an automated mechanism to determine if organizational information has been disclosed in an unauthorized manner.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms to ensure that the identified system determines if organizational information has been disclosed in an unauthorized manner.  The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.'),\n('001917','draft','2013-03-15','DISA FSO','policy','The organization defines the frequency for reviewing the open source information sites being monitored.','AU-13(2).1','The organization being inspected/assessed defines and documents the frequency for reviewing the open source information sites being monitored.\\n\\nDoD has determined that the frequency should be defined at the Component level, not appropriate to define at the Enterprise level. Note:  The value in this control may not be used to deny reciprocal acceptance of a C&A (A&A) package.','The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed defines the frequency for reviewing the open source information sites being monitored.\\n\\nDoD has determined that the frequency should be defined at the Component level, not appropriate to define at the Enterprise level. Note:  The value in this control may not be used to deny reciprocal acceptance of a C&A (A&A) package.'),\n('001918','draft','2013-03-15','DISA FSO','policy','The organization reviews the open source information sites being monitored per organization-defined frequency.','AU-13(2).2','The organization being inspected/assessed documents and implements a process to review the open source information sites being monitored per the frequency defined in AU-13 (2), CCI 1917.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed reviews the open source information sites being monitored per the frequency defined in AU-13 (2), CCI 1917.'),\n('001919','draft','2013-03-15','DISA FSO','technical','The information system provides the capability for authorized users to select a user session to capture/record or view/hear.','AU-14.1','The organization being inspected/assessed configures the information system to provide the capability for authorized users to select a user session to capture/record or view/hear.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1919.','The organization conducting the inspection/assessments examines the information system to ensure the organization being inspected/assessed configures the information system to provide the capability for authorized users to select a user session to capture/record or view/hear.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1919.'),\n('001920','draft','2013-03-15','DISA FSO','technical','The information system provides the capability for authorized users to remotely view/hear all content related to an established user session in real time.','AU-14(3).1','The organization being inspected/assessed configures the information system to provide the capability for authorized users to remotely view/hear all content related to an established user session in real time.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1920.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide the capability for authorized users to remotely view/hear all content related to an established user session in real time.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1920.'),\n('001921','draft','2013-03-15','DISA FSO','policy','The organization defines the alternative audit functionality to be provided in the event of a failure in the primary audit capability.','AU-15.1','The organization being inspected/assessed will define and document the alternative audit functionality to be provided in the event of a failure in the primary audit capability.  The organization shall consider trade-offs between the needs for system availability and audit integrity when defining the actions.  Unless availability is an overriding concern, the default action should be to shut down the information system.  DoD has determined that the actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented alternative audit functionality to ensure the organization being inspected/assessed has defined the alternative audit functionality to be provided in the event of a failure in the primary audit capability.   DoD has determined that the actions are not appropriate to define at the Enterprise level.'),\n('001922','draft','2013-03-15','DISA FSO','policy','The organization provides an alternative audit capability in the event of a failure in primary audit capability that provides organization-defined alternative audit functionality.','AU-15.2','The organization being inspected/assessed configures the information system to implement an alternative audit capability in the event of a failure in primary audit capability that provides the alternative audit functionality defined in AU-15, CCI 1921.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1922.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement an alternative audit capability in the event of a failure in primary audit capability that provides the alternative audit functionality defined in AU-15, CCI 1921.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1922.'),\n('001923','draft','2013-03-15','DISA FSO','policy','The organization defines the audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries.','AU-16.1','The organization being inspected/assessed defines and documents the audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries.  DoD has determined the methods are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented audit information to ensure the organization being inspected/assessed defines the audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries.  DoD has determined the methods are not appropriate to define at the Enterprise level.'),\n('001924','draft','2013-03-15','DISA FSO','policy','The organization defines the methods to be employed when coordinating audit information among external organizations when audit information is transmitted across organizational boundaries.','AU-16.2','The organization being inspected/assessed defines and documents the methods to be employed when coordinating audit information among external organizations when audit information is transmitted across organizational boundaries.  DoD has determined the methods are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented methods to ensure the organization being inspected/assessed defines the methods to be employed when coordinating audit information among external organizations when audit information is transmitted across organizational boundaries.  DoD has determined the methods are not appropriate to define at the Enterprise level.'),\n('001925','draft','2013-03-15','DISA FSO','policy','The organization employs organization-defined methods for coordinating organization-defined audit information among external organizations when audit information is transmitted across organizational boundaries.','AU-16.3','The organization being inspected/assessed documents and implements a process to employ the methods defined in AU-16, CCI 1924 for coordinating audit information defined in AU-16, CCI 1923 among external organizations when audit information is transmitted across organizational boundaries.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed employs a process to employ the methods defined in AU-16, CCI 1924 for coordinating audit information defined in AU-16, CCI 1923 among external organizations when audit information is transmitted across organizational boundaries.'),\n('001926','draft','2013-03-15','DISA FSO','policy','The organization requires that the identity of individuals be preserved in cross-organizational audit trails.','AU-16(1).1','The organization being inspected/assessed implements a process to ensure that the identity of individuals be preserved in cross organizational audit trails.','The organization conducting the inspection/assessment obtains and examines a sampling of cross organizational audit trails to ensure that the identify of individuals conducting audited actions is preserved.'),\n('001927','draft','2013-03-15','DISA FSO','policy','The organization defines the organizations that will be provided cross-organizational audit information.','AU-16(2).1','The organization being inspected/assessed defines and documents the organizations that will be provided cross-organizational audit information.  DoD has determined the cross-organizational sharing agreements are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented organizations to ensure the organization being inspected/assessed defines the organizations that will be provided cross-organizational audit information.  DoD has determined the cross-organizational sharing agreements are not appropriate to define at the Enterprise level.'),\n('001928','draft','2013-03-15','DISA FSO','policy','The organization defines the cross-organizational sharing agreements to be established with organization-defined organizations authorized to be provided cross-organizational sharing of audit information.','AU-16(2).2','The organization being inspected/assessed defines and documents the cross-organizational sharing agreements to be established with organizations defined in AU-16 (2), CCI 1927 authorized to be provided cross-organizational sharing of audit information.  DoD has determined the cross-organizational sharing agreements are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented sharing agreements to ensure the organization being inspected/assessed defines the cross-organizational sharing agreements to be established with organizations defined in AU-16 (2), CCI 1927 authorized to be provided cross-organizational sharing of audit information.  DoD has determined the cross-organizational sharing agreements are not appropriate to define at the Enterprise level.'),\n('001929','draft','2013-03-15','DISA FSO','policy','The organization provides cross-organizational audit information to organization-defined organizations based on organization-defined cross organizational sharing agreements.','AU-16(2).3','The organization being inspected/assessed provides cross-organizational audit information to organizations defined in AU-16 (2), CCI 1927 based on cross organizational sharing agreements defined in AU-16 (2), CCI  1928.','The organization conducting the inspection/assessment obtains and examines the audit information that provides cross-organizational audit information  to organizations defined in AU-16 (2), CCI 1927 based on cross organizational sharing agreements defined in AU-16 (2), CCI  1928.'),\n('001930','draft','2013-04-08','DISA FSO','policy','The organization defines the organizational personnel or roles to whom the audit and accountability policy is to be disseminated.','AU-1.1','The organization being inspected/assessed defines and documents any personnel or roles, in addition to the ISSO or ISSM, to whom the audit and accountability policy is to be disseminated.  If there are no additional personnel or roles, the organization must also document that.  DoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate.','The organization conducting the inspection/assessment obtains and examines the documented list of personnel or roles to whom the audit and accountability policy is to be disseminated to ensure the organization being inspected/assessed has either defined additional personnel or roles, or identified that there are no additional personnel or roles.   DoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate.'),\n('001931','draft','2013-04-08','DISA FSO','policy','The organization defines the organizational personnel or roles to whom the audit and accountability procedures are to be disseminated.','AU-1.2','The organization being inspected/assessed defines and documents any personnel or roles, in addition to the ISSO or ISSM, to whom the audit and accountability procedures are to be disseminated.  If there are no additional personnel or roles, the organization must also document that.  DoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate.','The organization conducting the inspection/assessment obtains and examines the documented list of personnel or roles to whom the audit and accountability procedures are to be disseminated to ensure the organization being inspected/assessed has either defined additional personnel or roles, or identified that there are no additional personnel or roles.   DoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate.'),\n('001932','draft','2013-05-03','DISA FSO','policy','The organization documents an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.',NULL,NULL,NULL),\n('001933','draft','2013-05-03','DISA FSO','policy','The organization defines the personnel or roles to be recipients of the identification and authentication policy and the procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.','IA-1.1','DoD has defined the roles to be recipients of the identification and authentication policy and the procedures as the ISSO and ISSM and others as the local organization deems appropriate.\\n\\nDoDI 8520.02 and DoDI 8520.03 meet the DoD requirement for Identification and Authentication policy and procedures.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 8520.02 and DoDI 8520.03.','DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8520.02 and DoDI 8520.03.\\n\\nDoD has defined the roles to be recipients of the identification and authentication policy and the procedures as the ISSO and ISSM and others as the local organization deems appropriate.'),\n('001934','draft','2013-05-03','DISA FSO','policy','The organization documents procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.',NULL,NULL,NULL),\n('001935','draft','2013-05-03','DISA FSO','policy','The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access to privileged accounts.','IA-2(6).1','For the strength of mechanism requirements DoD has defined requirements as DoD PKI or a technology approved by their Authorizing Official, FIPS 140-2, NIAP Certification, or NSA approval.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  For the strength of mechanism requirements DoD has defined requirements as DoD PKI or a technology approved by their Authorizing Official, FIPS 140-2, NIAP Certification, or NSA approval.'),\n('001936','draft','2013-05-03','DISA FSO','technical','The information system implements multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.','IA-2(6).2','The organization being inspected/assessed configures the information system to implement multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1936.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1936.'),\n('001937','draft','2013-05-03','DISA FSO','technical','The device used in the information system implementation of multifactor authentication for network access to privileged accounts meets organization-defined strength of mechanism requirements.','IA-2(6).3','The organization being inspected/assessed will use DoD PKI or a technology approved by their Authorizing Official that meet Federal standards for authentication such as FIPS 140-2, NIAP Certification, or NSA approval.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1937.','The organization conducting the inspection/assessment obtains and examines the device used to ensure that the device implemented for multifactor authentication for network access to privileged accounts meets Federal standards for authentication such as FIPS 140-2, NIAP Certification, or NSA approval.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1937.'),\n('001938','draft','2013-05-03','DISA FSO','policy','The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access to non-privileged accounts.','IA-2(7).1','For the strength of mechanism requirements DoD has defined requirements as DoD PKI or a technology approved by their Authorizing Official, FIPS 140-2, NIAP Certification, or NSA approval.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  For the strength of mechanism requirements DoD has defined requirements as DoD PKI or a technology approved by their Authorizing Official, FIPS 140-2, NIAP Certification, or NSA approval.'),\n('001939','draft','2013-05-03','DISA FSO','technical','The information system implements multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.','IA-2(7).2','The organization being inspected/assessed configures the information system to implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1939.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1939,'),\n('001940','draft','2013-05-03','DISA FSO','technical','The device used in the information system implementation of multifactor authentication for network access to non-privileged accounts meets organization-defined strength of mechanism requirements.','IA-2(7).3','The organization being inspected/assessed will use DoD PKI or a technology approved by their Authorizing Official that meet Federal standards for authentication such as FIPS 140-2, NIAP Certification, or NSA approval.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1940.','The organization conducting the inspection/assessment obtains and examines the device used to ensure that the device implemented for multifactor authentication for network access to non-privileged accounts meets Federal standards for authentication such as FIPS 140-2, NIAP Certification, or NSA approval.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1940.'),\n('001941','draft','2013-05-03','DISA FSO','technical','The information system implements replay-resistant authentication mechanisms for network access to privileged accounts.','IA-2(8).1','The organization being inspected/assessed configures the information system to implement replay-resistant authentication mechanisms for network access to privileged accounts.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1941.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement replay-resistant authentication mechanisms for network access to privileged accounts.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1941.'),\n('001942','draft','2013-05-03','DISA FSO','technical','The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts.','IA-2(9).1','The organization being inspected/assessed configures the information system to  implement replay-resistant authentication mechanisms for network access to non-privileged accounts.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1942.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement replay-resistant authentication mechanisms for network access to non-privileged accounts.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1942.'),\n('001943','draft','2013-05-03','DISA FSO','policy','The organization defines the information system accounts for which single sign-on capability will be provided.','IA-2(10).1','The organization being inspected/assessed defines and documents any accounts for which a single sign-on capability is provided.  For single sign-on providers (creator/maintainer of the single sign-on user accounts) this will be a list of accounts or groups that are authorized to use single sign-on capability.  For single sign-on services this will be a per provider list of accounts or groups authorized to use the service.  DoD has determined the system services are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented list of system accounts to ensure the organization being inspected/assessed defines any accounts for which a single sign-on capability is provided.  DoD has determined the system services are not appropriate to define at the Enterprise level.'),\n('001944','draft','2013-05-03','DISA FSO','policy','The organization defines the information system services for which single sign-on capability will be provided.','IA-2(10).2','The organization being inspected/assessed defines and documents any services (e.g., websites) for which a single sign-on capability is provided.  DoD has determined the system services are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented system services to ensure the organization being inspected/assessed defines any services (e.g., websites) for which a single sign-on capability is provided.   DoD has determined the system services are not appropriate to define at the Enterprise level.'),\n('001945','draft','2013-05-03','DISA FSO','technical','The information system provides a single sign-on capability for an organization-defined list of information system accounts.','IA-2(10).3','The organization being inspected/assessed configures the information system to  provide a single sign-on capability for the list of information system accounts defined in IA-2 (10), CCI 1943.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1945.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  provide a single sign-on capability for the list of information system accounts  defined in IA-2 (10), CCI 1943.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1945.'),\n('001946','draft','2013-05-03','DISA FSO','technical','The information system provides a single sign-on capability for an organization-defined list of information system services.','IA-2(10).4','The organization being inspected/assessed configures the information system to  provide a single sign-on capability for the list of information system services defined in IA-2 (10), CCI 1944.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1946.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  provide a single sign-on capability for the list of information system services defined in IA-2 (10), CCI 1944.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1946.'),\n('001947','draft','2013-05-03','DISA FSO','policy','The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access and is to provide one factor of a multifactor authentication for remote access to privileged accounts.','IA-2(11).1','For the strength of mechanism requirements DoD has defined requirements as DoD PKI or a technology approved by their Authorizing Official, FIPS 140-2, NIAP Certification, or NSA approval.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  For the strength of mechanism requirements DoD has defined requirements as DoD PKI or a technology approved by their Authorizing Official, FIPS 140-2, NIAP Certification, or NSA approval.'),\n('001948','draft','2013-05-03','DISA FSO','technical','The information system implements multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.','IA-2(11).2','The organization being inspected/assessed configures the information system to  implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1948.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1948.'),\n('001949','draft','2013-05-03','DISA FSO','technical','The device used in the information system implementation of multifactor authentication for remote access to privileged accounts meets organization-defined strength of mechanism requirements.','IA-2(11).3','The organization being inspected/assessed will use DoD PKI or a technology approved by their Authorizing Official that meet Federal standards for authentication such as FIPS 140-2, NIAP Certification, or NSA approval.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1949.','The organization conducting the inspection/assessment obtains and examines the device used to ensure that the device implemented for multifactor authentication for remote access to privileged accounts meets Federal standards for authentication such as FIPS 140-2, NIAP Certification, or NSA approval.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1949.'),\n('001950','draft','2013-05-03','DISA FSO','policy','The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access and is to provide one factor of a multifactor authentication for remote access to non-privileged accounts.','IA-2(11).4','For the strength of mechanism requirements DoD has defined requirements as DoD PKI or a technology approved by their Authorizing Official, FIPS 140-2, NIAP Certification, or NSA approval.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  For the strength of mechanism requirements DoD has defined requirements as DoD PKI or a technology approved by their Authorizing Official, FIPS 140-2, NIAP Certification, or NSA approval.'),\n('001951','draft','2013-05-03','DISA FSO','technical','The information system implements multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.','IA-2(11).5','The organization being inspected/assessed configures the information system to  implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1951.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1951.'),\n('001952','draft','2013-05-03','DISA FSO','technical','The device used in the information system implementation of multifactor authentication for remote access to non-privileged accounts meets organization-defined strength of mechanism requirements.','IA-2(11).6','The organization being inspected/assessed will use DoD PKI or a technology approved by their Authorizing Official that meet Federal standards for authentication such as FIPS 140-2, NIAP Certification, or NSA approval.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1952.','The organization conducting the inspection/assessment obtains and examines the device used to ensure that the device implemented for multifactor authentication for remote access to non-privileged accounts meets Federal standards for authentication such as FIPS 140-2, NIAP Certification, or NSA approval.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1952.'),\n('001953','draft','2013-05-03','DISA FSO','technical','The information system accepts Personal Identity Verification (PIV) credentials.','IA-2(12).1','The organization being inspected/assessed configures the information system to accept PIV/CAC authentication.  This control enhancement applies to organizations implementing logical access control systems (LACS) and physical access control systems (PACS).   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1953','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to accept PIV/CAC authentication.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1953.'),\n('001954','draft','2013-05-03','DISA FSO','technical','The information system electronically verifies Personal Identity Verification (PIV) credentials.','IA-2(12).2','The organization being inspected/assessed configures the information system to verify PIV/CAC authentication.  This control enhancement applies to organizations implementing logical access control systems (LACS) and physical access control systems (PACS).   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1954.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to verify PIV/CAC authentication.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1954.'),\n('001955','draft','2013-05-03','DISA FSO','policy','The organization defines the out-of-band authentication to be implemented by the information system under organization-defined conditions.','IA-2(13).1','The organization being inspected/assessed defines and documents the out-of-band authentication to be implemented by the information system under organization-defined conditions.  DoD has determined the out-of-band authentication is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented out-of-band authentication to ensure the organization being inspected/assessed defines the out-of-band authentication to be implemented by the information system under organization-defined conditions.  DoD has determined the out-of-band authentication is not appropriate to define at the Enterprise level.'),\n('001956','draft','2013-05-03','DISA FSO','policy','The organization defines the conditions for which the information system implements organization-defined out-of-band authentication.','IA-2(13).2','The organization being inspected/assessed defines and documents the conditions for which the information system implements organization-defined out-of-band authentication.  DoD has determined the conditions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented conditions to ensure the organization being inspected/assessed defines  the conditions for which the information system implements organization-defined out-of-band authentication.  DoD has determined the conditions are not appropriate to define at the Enterprise level.'),\n('001957','draft','2013-05-03','DISA FSO','technical','The information system implements organization-defined out-of-band authentication under organization-defined conditions.','IA-2(13).3','The organization being inspected/assessed configures the information system to implement out-of-band authentication defined in IA-2 (13), CCI 1955 under conditions defined in IA-2 (13), CCI 1956.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1957.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement out-of-band authentication defined in IA-2 (13), CCI 1955 under conditions defined in IA-2 (13), CCI 1956.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1957.'),\n('001958','draft','2013-05-03','DISA FSO','technical','The information system authenticates an organization-defined list of specific and/or types of devices before establishing a local, remote, or network connection.','IA-3.3','The organization being inspected/assessed configures the network infrastructure to authenticate all mobiles devices and network connected endpoint devices (including but not limited to: workstations, printers, servers (outside a datacenter), VoIP Phones, VTC CODECs) before establishing a local, remote, network connection.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1958.  DoD has defined the value as all mobile devices and network connected endpoint devices (including but not limited to: workstations, printers, servers (outside a datacenter), VoIP Phones, VTC CODECs).  ','The organization conducting the inspection/assessment examine a sampling of the network infrastructure device configurations to ensure devices connecting to the infrastructure are uniquely authenticated.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1958.'),\n('001959','draft','2013-05-03','DISA FSO','policy','The organization defines the specific devices and/or type of devices the information system is to authenticate before establishing a connection.','IA-3(1).1','DoD has defined the value as all network connected endpoint devices (including but not limited to: workstations, printers, servers (outside a datacenter), VoIP Phones, VTC CODECs).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the value as all network connected endpoint devices (including but not limited to: workstations, printers, servers (outside a datacenter), VoIP Phones, VTC CODECs).'),\n('001960','draft','2013-05-03','DISA FSO','policy','The organization defines the lease information to be assigned to devices.','IA-3(3).1','The organization being inspected/assessed defines and documents the lease information to be assigned to devices.  DoD has determined the lease information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented lease information assigned to devices.   DoD has determined the lease information is not appropriate to define at the Enterprise level.'),\n('001961','draft','2013-05-03','DISA FSO','policy','The organization defines the lease duration to be assigned to devices.','IA-3(3).2','The organization being inspected/assessed defines and documents the lease duration to be assigned to devices.  DoD has determined the lease duration is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented lease duration to ensure the organization being inspected/assessed defines the lease duration to be assigned to devices.  DoD has determined the lease duration is not appropriate to define at the Enterprise level'),\n('001962','draft','2013-05-03','DISA FSO','technical','The organization standardizes dynamic address allocation lease information assigned to devices in accordance with organization-defined lease information.','IA-3(3).3','The organization being inspected/assessed configures the information system to grant leases containing organization defined lease information.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1962.','The organization conducting the inspection/assessment examines the information system granting the lease to ensure the organization configures the information system to implement dynamic address allocation in accordance with CCI  1961.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1962.'),\n('001963','draft','2013-05-03','DISA FSO','technical','The organization standardizes dynamic address allocation lease duration assigned to devices in accordance with organization-defined lease duration.','IA-3(3).4','The organization being inspected/assessed configures the information system to grant the leases assigned to devices in accordance with organization-defined lease duration.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1963.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to grant the leases assigned to devices in accordance with organization-defined lease duration.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1963.'),\n('001964','deprecated','2013-05-03','DISA FSO','policy','The organization defines the configuration management process that is to handle the device identification procedures.',NULL,NULL,NULL),\n('001965','draft','2013-05-03','DISA FSO','policy','The organization defines the configuration management process that is to handle the device authentication procedures.','IA-3(4).1','The organization being inspected/assessed defines and documents the configuration management process that is to handle the device authentication procedures.  DoD has determined the configuration management process is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented configuration management process to ensure the organization being inspected/assessed defines the configuration management process that is to handle the device authentication procedures.  DoD has determined the configuration management process is not appropriate to define at the Enterprise level.'),\n('001966','draft','2013-05-03','DISA FSO','policy','The organization ensures that device identification based on attestation is handled by the organization-defined configuration management process.','IA-3(4).2','The organization being inspected/assessed ensures that device identification based on attestation is handled by the configuration management process defined in IA-3 (4), CCI 1968.','The organization conducting the inspection/assessment obtains and examines the documented configuration management process to ensure the organization being inspected/assessed has device identification based on attestation handled via the configuration management process.'),\n('001967','draft','2013-05-03','DISA FSO','technical','The information system authenticates organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.','IA-3(1).2','The organization being inspected/assessed configures the information system to use cryptographically based bidirectional authentication.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1967.','The organization conducting the inspection/assessment  examine a sampling of the network infrastructure device configurations to ensure devices connecting to the infrastructure use cryptographically based bidirectional authentication.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1967.'),\n('001968','draft','2013-05-03','DISA FSO','policy','The organization defines the configuration management process that is to handle the device identification procedures.','IA-3(4).3','The organization being inspected/assessed defines and documents the configuration management process that is to handle the device identification procedures.  DoD has determined the configuration management process is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented configuration management process to ensure the organization being inspected/assessed defines the configuration management process that is to handle the device identification procedures.  DoD has determined the configuration management process is not appropriate to define at the Enterprise level.'),\n('001969','draft','2013-05-03','DISA FSO','policy','The organization ensures that device authentication based on attestation is handled by the organization-defined configuration management process.','IA-3(4).4','The organization being inspected/assessed ensures that device authentication based on attestation is handled by the configuration management process defined in IA-3 (4), CCI 1965.','The organization conducting the inspection/assessment obtains and examines the documented configuration management process to ensure the organization being inspected/assessed has device authentication based on attestation handled via the configuration management process.'),\n('001970','draft','2013-05-03','DISA FSO','policy','The organization defines the personnel or roles that authorize the assignment of individual, group, role, and device identifiers.','IA-4.1','DoD has defined the personnel or roles as the ISSM or ISSO.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the personnel or roles as the ISSM or ISSO.'),\n('001971','draft','2013-05-03','DISA FSO','policy','The organization manages information system identifiers by receiving authorization from organization-defined personnel or roles to assign an individual, group, role, or device identifier.','IA-4.2','The organization being inspected/assessed implements a process to manage information system identifiers by receiving authorization from  the ISSM or ISSO  to assign an individual, group, role or device identifier.\\n\\nDoD has defined the personnel or roles as the ISSM or ISSO.','The organization conducting the inspection/assessment obtains and examines documentation and system configuration information to ensure the organization being inspected/assessed manages information system identifiers by receiving authorization from  the ISSM or ISSO to assign an individual, group, role or device identifier.\\n\\nDoD has defined the personnel or roles as the ISSM or ISSO.'),\n('001972','draft','2013-05-03','DISA FSO','policy','The organization manages information system identifiers by selecting an identifier that identifies an individual, group, role, or device.','IA-4.3','The organization being inspected/assessed implements a process to manage information system identifiers by selecting an identifier that identifies an individual, group, role, or device.','The organization conducting the inspection/assessment obtains and examines documentation or system configuration information to ensure the organization being inspected/assessed manages information system identifiers by selecting an identifier that identifies an individual, group, role, or device.'),\n('001973','draft','2013-05-03','DISA FSO','policy','The organization manages information system identifiers by assigning the identifier to the intended individual, group, role, or device.','IA-4.4','The organization being inspected/assessed implements a process to manage information system identifiers by assigning the identifier to the intended individual, group, role, or device.','The organization conducting the inspection/assessment obtains and examines documentation or system configuration information to ensure the organization being inspected/assessed manages information system identifiers by assigning the identifier to the intended individual, group, role, or device.'),\n('001974','draft','2013-05-03','DISA FSO','policy','The organization defines the time period for which the reuse of identifiers is prohibited.','IA-4.5','DoD has defined the time period as 1 year for user identifiers (DoD is not going to specify value for device identifier).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 1 year for user identifiers (DoD is not going to specify value for device identifier).'),\n('001975','draft','2013-05-03','DISA FSO','policy','The organization manages information system identifiers by preventing reuse of identifiers for an organization-defined time period.','IA-4.6','The organization being inspected/assessed implements a process for information system identifiers to prevent reuse of identifiers for 1 year for user identifiers (DoD is not going to specify value for device identifier).  DoD has defined the time period as 1 year for user identifiers (DoD is not going to specify value for device identifier).','The organization conducting the inspection/assessment obtains and examines documentation or system configuration information  to ensure the organization being inspected/assessed prevents the reuse of identifiers for 1 year for user identifiers (DoD is not going to specify value for device identifier).  DoD has defined the time period as 1 year for user identifiers (DoD is not going to specify value for device identifier).'),\n('001976','draft','2013-05-03','DISA FSO','technical','The information system dynamically manages identifiers.','IA-4(5).1','The organization being inspected/assessed configures the information system to dynamically manage identifiers.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1976.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to dynamically manage identifiers.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1976.'),\n('001977','draft','2013-05-03','DISA FSO','policy','The organization defines the external organizations with which it will coordinate for cross-management of identifiers.','IA-4(6).1','DoD has defined the external organizations as any external organization that shares cross-organizational identifiers.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the external organizations as any external organization that shares cross-organizational identifiers.'),\n('001978','draft','2013-05-03','DISA FSO','policy','The organization coordinates with organization-defined external organizations for cross-organization management of identifiers.','IA-4(6).2','The organization being inspected/assessed documents and implements a process to coordinate with any external organization that shares cross-organizational identifiers.  DoD has defined the external organizations as any external organization that shares cross-organizational identifiers.','The organization conducting the inspection/assessment obtains and examines the documentation (e.g., Service Level Agreements (SLAs), Memorandum of Understanding (MOU), Memorandum of Agreement (MOA),  contracts, etc.) to ensure the organization being inspected/assessed implements a process to coordinate with any external organization that shares cross-organizational identifiers.  DoD has defined the external organizations as any external organization that shares cross-organizational identifiers.'),\n('001979','draft','2013-05-03','DISA FSO','policy','The organization requires the registration process to receive an individual identifier be conducted in person before a designated registration authority.','IA-4(7).1','The organization being inspected/assessed documents and implements a process to require the registration process to receive an individual identifier be conducted in person before a designated registration authority.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  requires the registration process to receive an individual identifier be conducted in person before a designated registration authority.'),\n('001980','draft','2013-05-03','DISA FSO','policy','The organization manages information system authenticators by verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator.','IA-5.1','The organization being inspected/assessed defines and documents procedures for the secure distribution of authenticators.  The process shall include verification of the identify of the individual, group, role, or device receiving the authenticator.','The organization conducting the inspection/assessment obtains and examines the documented procedures for the secure distribution of authenticators to ensure they have been defined and that they include a method to verify the identify of the individual, group, role, or device receiving the authenticator.'),\n('001981','draft','2013-05-03','DISA FSO','policy','The organization manages information system authenticators by establishing administrative procedures for initial authenticator distribution.','IA-5.4','The organization being inspected/assessed defines and documents procedures for the secure distribution of authenticators.','The organization conducting the inspection/assessment obtains and examines the documented procedures for the secure distribution of authenticators to ensure they have been defined.'),\n('001982','draft','2013-05-03','DISA FSO','policy','The organization manages information system authenticators by establishing administrative procedures for lost/compromised authenticators.','IA-5.5','The organization being inspected/assessed defines and documents procedures for lost/compromised authenticators.','The organization conducting the inspection/assessment obtains and examines the documented procedures for lost/compromised authenticators to ensure they have been defined.'),\n('001983','draft','2013-05-03','DISA FSO','policy','The organization manages information system authenticators by establishing administrative procedures for damaged authenticators.','IA-5.6','The organization being inspected/assessed defines and documents procedures for the secure disposal of damaged authenticators.','The organization conducting the inspection/assessment obtains and examines the documented procedures for the secure disposal of damaged authenticators to ensure they have been defined.'),\n('001984','draft','2013-05-03','DISA FSO','policy','The organization manages information system authenticators by establishing administrative procedures for revoking authenticators.','IA-5.7','The organization being inspected/assessed defines and documents procedures for  revoking authenticators.','The organization conducting the inspection/assessment obtains and examines the documented procedures for revoking authenticators to ensure the procedures are defined.'),\n('001985','draft','2013-05-03','DISA FSO','policy','The organization manages information system authenticators by implementing administrative procedures for initial authenticator distribution.','IA-5.8','The organization being inspected/assessed implements administrative procedures for initial authenticator distribution as documented in IA-5, CCIs 1980 & 1981.','The organization conducting the inspection/assessment obtains and examines records of initial authenticator distribution and interviews individuals responsible for authenticator distribution to ensure that the organization being inspected/assessed implements the process as defined in IA-5,  CCIs 1980 & 1981.'),\n('001986','draft','2013-05-03','DISA FSO','policy','The organization manages information system authenticators by implementing administrative procedures for lost/compromised authenticators.','IA-5.9','The organization being inspected/assessed implements administrative procedures for the response to lost/compromised authenticators as documented in IA-5, CCI 1982.','The organization conducting the inspection/assessment obtains and examines documented procedures for the response to lost/compromised authenticators to ensure that the organization being inspected/assessed implements the process as defined in IA-5,  CCI 1982.'),\n('001987','draft','2013-05-03','DISA FSO','policy','The organization manages information system authenticators by implementing administrative procedures for damaged authenticators.','IA-5.10','The organization being inspected/assessed implements administrative procedures for the response to damaged authenticators as documented in IA-5, CCI 1983.','The organization conducting the inspection/assessment obtains and examines documented procedures for the response to damaged authenticators to ensure that the organization being inspected/assessed implements the process as defined in IA-5,  CCI 1983.'),\n('001988','draft','2013-05-03','DISA FSO','policy','The organization manages information system authenticators by implementing administrative procedures for revoking authenticators.','IA-5(5).1','The organization being inspected/assessed documents and enforces a requirement for developers/installers of information system components to provide unique authenticators or change default authenticators prior to delivery/installation.','The organization conducting the inspection/assessment obtains and examines the documented requirements placed upon developers/installers of information system components to ensure that there is a documented requirement to provide unique authenticators or change default authenticators prior to delivery/installation.'),\n('001989','draft','2013-05-03','DISA FSO','policy','The organization manages information system authenticators by changing default content of authenticators prior to information system installation.','IA-5.12','The organization being inspected/assessed documents and implements a procedures to change default authenticators prior to information system installation.','The organization conducting the inspection/assessment obtains and examines the documented procedures to change default authenticators to ensure the procedures are defined.  The organization conducting the inspection/assessment obtains and examines a sampling of authenticator age data for default accounts to ensure that default authenticators are changed prior to installation.'),\n('001990','draft','2013-05-03','DISA FSO','policy','The organization manages information system authenticators by changing authenticators for group/role accounts when membership to those accounts changes.','IA-5.22','The organization being inspected/assessed documents and implements procedures for changing authenticators for group/role accounts when membership to those accounts changes.','The organization conducting the inspection/assessment obtains and examines the documented procedures for group/role authenticator change to ensure the procedures are defined and applied when membership to those accounts changes.  The organization conducting the inspection/assessment obtains and examines a sampling of authenticator age data and documentation of personnel role changes to ensure that group/role authenticators are changed when membership changes.'),\n('001991','draft','2013-05-03','DISA FSO','technical','The information system, for PKI-based authentication, implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.','IA-5(2).4','The information system must be configured to locally cache revocation data to support path discovery and validation in case of inability to access revocation information via the network.  The information system may meet this requirement by locally caching certificate revocation lists (CRLs), Online Certificate Status Protocol (OCSP) responses, or a combination thereof.  Cached revocation data must include revocation information from all PKIs serving known or anticipated users of the information system.  Cached data must be refreshed with a frequency shorter than the life of the data (e.g. if a CRL is valid for 7 days, a new CRL must be retrieved and cached more frequently than every 7 days) to ensure that cached data is valid and not expired.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1991.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to locally cache revocation data (CRLs and/or OCSP responses) to support path discovery and validation in case of inability to access revocation information via the network.  The organization conducting the inspection/assessment examines the information system to ensure that revocation data is cached for all PKIs serving known or anticipated users of the information system.  The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured a process for the information system to refresh cached revocation data prior to the datas expiration.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1991.'),\n('001992','draft','2013-05-03','DISA FSO','policy','The organization defines the personnel or roles responsible for authorizing the organization^s registration authority accountable for the authenticator registration process.','IA-5(3).1','The DoD PKI Registration Authority (RA)  Local Registration Authority (LRA) Certification Practice Statement (CPS) defines the nomination process for DoD PKI RAs.  The NSS PKI DoD Registration Practice Statement (RPS) defines the nomination process for NSS PKI RAs for DoD.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD PKI RA-LRA CPS and NSS PKI DoD RPS.','The DoD PKI RALRA CPS defines the nomination process for DoD PKI RAs.  The NSS PKI DoD RPS defines the nomination process for NSS PKI RAs for DoD.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD PKI RA-LRA CPS and NSS PKI DoD RPS.'),\n('001993','draft','2013-05-03','DISA FSO','policy','The organization defines the registration authority accountable for the authenticator registration process.','IA-5(3).2','The DoD PKI Certificate Policy (CP) defines the role and responsibilities of a DoD PKI Registration Authority (RA).  The NSS PKI CP defines the role and responsibilities of an NSS PKI RA.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD PKI CP and NSS PKI CP.','The DoD PKI CP defines the role and responsibilities of a DoD PKI Registration Authority (RA).  The NSS PKI CP defines the role and responsibilities of an NSS PKI RA.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD PKI CP and NSS PKI CP.'),\n('001994','draft','2013-05-03','DISA FSO','policy','The organization defines the types of and/or specific authenticators that are subject to the authenticator registration process.','IA-5(3).3','The DoD PKI Certificate Policy (CP) defines DoD PKI subscribers (entities identified as the subject of PKI certificates) and the authentication requirements for issuance of credentials to subscribers.  The NSS PKI CP defines NSS PKI subscribers and the authentication requirements for issuance of credentials to subscribers.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD PKI CP and NSS PKI CP.','The DoD PKI CP defines DoD PKI subscribers and the authentication requirements for issuance of credentials to subscribers.  The NSS PKI CP defines NSS PKI subscribers and the authentication requirements for issuance of credentials to subscribers.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD PKI CP and NSS PKI CP.'),\n('001995','draft','2013-05-03','DISA FSO','policy','The organization requires that the registration process, to receive organization-defined types of and/or specific authenticators, be conducted in person, or by a trusted third-party, before an organization-defined registration authority with authorization by organization-defined personnel or roles.','IA-5(3).4','The DoD PKI Certificate Policy (CP) requires in-person authentication of DoD PKI applicants in accordance with each Certificate Management Authoritys (CMAs) Certification Practice Statement (CPS) prior to issuance of credentials.  The NSS PKI CP requires in-person authentication of NSS PKI applicants by a Registration Authority (RA) or Trusted Agent (TA) prior to issuance of credentials.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD PKI CP and NSS PKI CP.','The DoD PKI CP requires in-person authentication of DoD PKI applicants in accordance with each CMAs CPS prior to issuance of credentials.  The NSS PKI CP requires in-person authentication of NSS PKI applicants by an RA or TA prior to issuance of credentials.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD PKI CP and NSS PKI CP.'),\n('001996','draft','2013-05-03','DISA FSO','policy','The organization defines the requirements required by the automated tools to determine if password authenticators are sufficiently strong.','IA-5(4).1','DoD has defined the requirements as the complexity as identified in IA-5 (1) Part A.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the requirements as the complexity as identified in IA-5 (1) Part A.'),\n('001997','draft','2013-05-03','DISA FSO','policy','The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy organization-defined requirements.','IA-5(4).2','The organization being inspected/assessed implements automated tools to check passwords strength per the complexity requirements defined in IA-5 (1) Part A.','The organization conducting the inspection/assessment examines the automated tools and inspects the configuration of the automated tools to ensure that they are implemented to check password strength per the complexity requirements defined in IA-5 (1) Part A.'),\n('001998','draft','2013-05-03','DISA FSO','policy','The organization requires developers/installers of information system components to provide unique authenticators or change default authenticators prior to delivery/installation.','IA-5.11','The organization being inspected/assessed implements administrative procedures for revoking authenticators as documented in IA-5, CCI 1984.','The organization conducting the inspection/assessment obtains and examines documented procedures for revoking authenticators to ensure that the organization being inspected/assessed implements the process as defined in IA-5,  CCI 1984.'),\n('001999','draft','2013-05-03','DISA FSO','policy','The organization defines the external organizations to be coordinated with for cross-organization management of credentials.','IA-5(9).2','DoD has defined the external organizations as any external organization that shares cross-organizational identifiers.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the external organizations as any external organization that shares cross-organizational identifiers.'),\n('002000','draft','2013-05-03','DISA FSO','policy','The organization coordinates with organization-defined external organizations for cross-organization management of credentials.','IA-5(9).1','The organization being inspected/assessed documents and implements a process to coordinate with external organizations defined in IA-5 (9), CCI 1999 for cross-organization management of credentials.  The organization maintains records of coordination.','The organization conducting the inspection/assessment obtains and examines the documented process and a sampling of coordination records to ensure the organization being inspected/assessed coordinates with external organizations defined in IA-5 (9), CCI 1999 for cross-organization management of credentials.'),\n('002001','draft','2013-05-03','DISA FSO','technical','The information system dynamically provisions identities.','IA-5(10).1','The organization being inspected/assessed configures the information system to dynamically provision identities.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2001.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to dynamically provision identities.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2001.'),\n('002002','draft','2013-05-03','DISA FSO','policy','The organization defines the token quality requirements to be employed by the information system mechanisms for token-based authentication.','IA-5(11).1','DoDI 8520.03 defines types of authentication credentials that are acceptable for authentication to different systems based on the systems information sensitivity levels and the users access environments.  The definitions for credential strengths D, E and H found in DoDI 8520.03 Enclosure 3, Section 3 specifically deal with acceptable types of hardware PKI credentials.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD-level policy, DoDI 8520.03.','DoDI 8520.03 defines types of authentication credentials that are acceptable for authentication to different systems based on the systems information sensitivity levels and the users access environments.  The definitions for credential strengths D, E and H found in DoDI 8520.03 Enclosure 3, Section 3 specifically deal with acceptable types of hardware PKI credentials.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD-level policy, DoDI 8520.03.'),\n('002003','draft','2013-05-03','DISA FSO','technical','The information system, for token-based authentication, employs mechanisms that satisfy organization-defined token quality requirements.','IA-5(11).2','The information system performing hardware token-based authentication must be configured to accept only DoD-approved PKI credentials in accordance with DoDI 8520.02 and DoDI 8520.03.  For unclassified systems, DoD-approved PKI credentials include DoD PKI credentials, External Certification Authority (ECA) PKI credentials, and DoD-approved external PKI credentials.  For SIPRNet, DoD-approved PKI credentials include DoD PKI credentials and NSS PKI credentials.  If the information system accepts DoD-approved external PKI credentials, the information system must be configured to accept only certificates at approved assurance levels, as represented by the Certificate Policy Object Identifiers (OIDs) asserted in the certificate.  The current list of DoD-approved external PKIs and acceptable Object Identifiers (OIDs) for each approved external PKI is available at http://iase.disa.mil/pki-pke/interoperability.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to accept only DoD-approved PKI credentials in accordance with (IAW) DoDI 8520.02 and DoDI 8520.03. If the information system accepts DoD-approved external PKI credentials, the organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to accept only DoD-approved external PKI credentials that assert an approved Certificate Policy OID and reject credentials issued off of DoD-approved external PKIs that do not assert an approved OID.'),\n('002004','draft','2013-05-03','DISA FSO','policy','The organization defines the biometric quality requirements to be employed by the information system mechanisms for biometric-based authentication.','IA-5(12).1','The organization being inspected/assessed defines and documents quality requirements to be employed by the information system mechanisms.  Quality requirements shall include minimum requirements for accurate identification.  NIST has draft documentation for biometrics available at http://csrc.nist.gov/publications/PubsSPs.html.  DoD has determined the biometric quality requirements are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines documented requirements to ensure they have been defined and include minimum requirements for accurate identification.  DoD has determined the biometric quality requirements are not appropriate to define at the Enterprise level.'),\n('002005','draft','2013-05-03','DISA FSO','technical','The information system, for biometric-based authentication, employs mechanisms that satisfy organization-defined biometric quality requirements.','IA-5(12).2','The organization being inspected/assessed configures the information system to employ mechanisms that satisfy biometric quality requirements as defined in IA-5 (12), CCI 2004 for biometric-based authentication.   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2005.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to employ mechanisms that satisfy biometric quality requirements as defined in IA-5 (12), CCI 2004 for biometric-based authentication.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2005.'),\n('002006','draft','2013-05-03','DISA FSO','policy','The organization defines the time period after which the use of cached authenticators is prohibited.','IA-5(13).1','The organization being inspected/assessed defines and documents the time period after which the use of cached authenticators are prohibited.  DoD has determined the time period is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented time period to ensure it has been defined.  DoD has determined the time period is not appropriate to define at the Enterprise level.'),\n('002007','draft','2013-05-03','DISA FSO','technical','The information system prohibits the use of cached authenticators after an organization-defined time period.','IA-5(13).2','The organization being inspected/assessed configures the information system to prohibit the use of cached authenticators after an organization defined time period.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2007.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to prohibit the use of cached authenticators after an organization defined time period.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2007.'),\n('002008','draft','2013-05-03','DISA FSO','policy','The organization, for PKI-based authentication, employs a deliberate organization-wide methodology for managing the content of PKI trust stores installed across all platforms including networks, operating systems, browsers, and applications.','IA-5(14).1','DoD trust store management requirements are defined in information system components applicable STIGs and SRGs.  All information systems are required to undergo a STIG compliance review as part of their certification and accreditation process prior to being granted an authority to operate.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD-level STIGs and SRGs.','DoD trust store management requirements are defined in information system components applicable STIGs and SRGs.  All information systems are required to undergo a STIG compliance review as part of their certification and accreditation process prior to being granted an authority to operate.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD-level STIGs and SRGs.'),\n('002009','draft','2013-05-03','DISA FSO','technical','The information system accepts Personal Identity Verification (PIV) credentials from other federal agencies.','IA-8(1).1','The information system performing hardware token-based authentication must be configured to accept DoD-approved external PKI PIV credentials to authenticate federal agency users in accordance with DoDI 8520.02 and DoDI 8520.03.  The information system must be configured to accept only certificates at approved assurance levels, as represented by the Certificate Policy Object Identifiers (OIDs) asserted in the certificate.  The current list of DoD-approved external PKIs and acceptable Object Identifiers (OIDs) for each approved external PKI is available at http://iase.disa.mil/pki-pke/interoperability.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2009.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to accept DoD-approved external PKI PIV credentials in accordance with DoDI 8520.02 and DoDI 8520.03.  The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to accept only DoD-approved external PKI PIV credentials that assert an approved Certificate Policy OID and reject credentials issued off of DoD-approved external PKIs that do not assert an approved OID.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2009.'),\n('002010','draft','2013-05-03','DISA FSO','technical','The information system electronically verifies Personal Identity Verification (PIV) credentials from other federal agencies.','IA-8(1).2','The information system performing hardware token-based authentication must be configured to validate DoD-approved external PKI PIV credentials to authenticate federal agency users in accordance with RFC 5280.  The information system must be configured to perform a revocation check as part of the certificate validation process.  Revocation checking may be performed using certificate revocation lists (CRLs) published by the issuing PKI or Online Certificate Status Protocol (OCSP) services.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI  2010.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to validate DoD-approved external PKI PIV credentials in accordance with RFC 5280.  The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to perform a revocation check as part of the certificate validation process.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2010.'),\n('002011','draft','2013-05-03','DISA FSO','technical','The information system accepts FICAM-approved third-party credentials.','IA-8(2).1','The organization being inspected/assessed configures the information system to accept Federal Identity,  Credential, and Access Management (FICAM)-approved third-party credentials.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2011.  FICAM Guidance is available at http://www.idmanagement.gov.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to accept FICAM-approved third-party credentials   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2011.'),\n('002012','draft','2013-05-03','DISA FSO','policy','The organization defines the information systems which will employ only FICAM-approved information system components.','IA-8(3).1','The organization being inspected/assessed defines and documents the information systems which will employ only Federal Identity, Credential, and Access Management (FICAM)-approved information system components.  DoD has determined the information systems are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information systems to ensure they have been defined.  DoD has determined the information systems are not appropriate to define at the Enterprise level.'),\n('002013','draft','2013-05-03','DISA FSO','policy','The organization employs only FICAM-approved information system components in organization-defined information systems to accept third-party credentials.','IA-8(3).2','The organization being inspected/assessed employs only Federal Identity,  Credential, and Access Management (FICAM)-approved information system components to accept third-party credentials in information systems defined in IA-8 (3), CCI 2012.  FICAM Guidance is available at http://www.idmanagement.gov.','The organization conducting the inspection/assessment obtains and examines the list of information system components in use to ensure the organization being inspected/assessed uses only FICAM-approved components in information systems defined in IA-8 (3), CCI 2012.'),\n('002014','draft','2013-05-03','DISA FSO','technical','The information system conforms to FICAM-issued profiles.','IA-8(4).1','The organization being inspected/assessed configures the information system to conform to Federal Identity, Credential, and Access Management (FICAM)-issued profiles.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2014.  FICAM Guidance is available at http://www.idmanagement.gov.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to conform to FICAM-issued profiles.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2014.'),\n('002015','draft','2013-05-03','DISA FSO','technical','The information system accepts Personal Identity Verification-I (PIV-I) credentials.','IA-8(5).1','The information system performing hardware token-based authentication must be configured to accept DoD-approved external PKI PIV-I credentials in accordance with DoDI 8520.02, DoDI 8520.03, and DoD CIO Memorandum Department of Defense Requirements for Accepting Non-Federally Issued Identity Credentials dated 24 January 2013.  The information system must be configured to accept only certificates at approved assurance levels, as represented by the Certificate Policy Object Identifiers (OIDs) asserted in the certificate.  The current list of DoD-approved external PKIs and acceptable Object Identifiers (OIDs) for each approved external PKI is available at http://iase.disa.mil/pki-pke/interoperability.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2015.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to accept DoD-approved external PKI PIV-I credentials in accordance with DoDI 8520.02, DoDI 8520.03, and DoD CIO Memorandum Department of Defense Requirements for Accepting Non-Federally Issued Identity Credentials dated 24 January 2013.  The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to accept only DoD-approved external PKI PIV-I credentials that assert an approved Certificate Policy OID and reject credentials issued off of DoD-approved external PKIs that do not assert an approved OID.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2015.'),\n('002016','draft','2013-05-03','DISA FSO','technical','The information system electronically verifies Personal Identity Verification-I (PIV-I) credentials.','IA-8(5).2','The information system performing hardware token-based authentication must be configured to validate DoD-approved external PKI PIV-I credentials in accordance with RFC 5280.  The information system must be configured to perform a revocation check as part of the certificate validation process.  Revocation checking may be performed using certificate revocation lists (CRLs) published by the issuing PKI or Online Certificate Status Protocol (OCSP) services.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2016.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to validate DoD-approved external PKI PIV-I credentials in accordance with RFC 5280.  The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed has configured the information system to perform a revocation check as part of the certificate validation process.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2016.'),\n('002017','draft','2013-05-03','DISA FSO','policy','The organization defines the information system services requiring identification.','IA-9.1','The organization being inspected/assessed defines and documents the  information system services requiring identification.  DoD has determined the information system services are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system services to ensure they have been defined.  DoD has determined the information system services are not appropriate to define at the Enterprise level.'),\n('002018','draft','2013-05-03','DISA FSO','policy','The organization defines the information system services requiring authentication.','IA-9.2','The organization being inspected/assessed defines and documents the  information system services requiring authentication.  DoD has determined the information system services are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system services to ensure they have been defined.  DoD has determined the information system services are not appropriate to define at the Enterprise level.'),\n('002019','draft','2013-05-03','DISA FSO','policy','The organization defines the security safeguards to be used when identifying information system services.','IA-9.3','The organization being inspected/assessed defines and documents the security safeguards to be used when identifying information system services.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure they have been defined and offers sufficient security.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002020','draft','2013-05-03','DISA FSO','policy','The organization defines the security safeguards to be used when authenticating information system services.','IA-9.4','The organization being inspected/assessed defines and documents the security safeguards to be used when authenticating information system services.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure they have been defined and offers sufficient security.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002021','draft','2013-05-03','DISA FSO','policy','The organization identifies organization-defined information system services using organization-defined security safeguards.','IA-9.5','The organization being inspected/assessed documents and implements a process to identify information system services defined in IA-9, CCIs 2017 & 2018 using security safeguards defined in IA-9, CCIs 2019-2020.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed identifies information system services defined in IA-9, CCIs 2017 & 2018 using security safeguards defined in IA-9, CCIs 2019-2020.'),\n('002022','draft','2013-05-03','DISA FSO','policy','The organization authenticates organization-defined information system services using organization-defined security safeguards.','IA-9.6','The organization being inspected/assessed documents and implements a process to authenticate information system services defined in IA-9, CCIs 2017 & 2018 using security safeguards defined in IA-9, CCIs 2019-2020.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed authenticates information system services defined in IA-9, CCIs 2017 & 2018 using security safeguards defined in IA-9, CCIs 2019-2020.'),\n('002023','draft','2013-05-03','DISA FSO','policy','The organization ensures that service providers receive identification information.','IA-9(1).1','The organization being inspected/assessed implements a process to ensure that service providers receive identification information.','The organization conducting the inspection/assessment reviews the process to ensure that service providers receive identification information to ensure the process is effectively implemented.'),\n('002024','draft','2013-05-03','DISA FSO','policy','The organization ensures that service providers validate identification information.','IA-9(1).2','The organization being inspected/assessed implements a process to ensure that service providers validate identification information.','The organization conducting the inspection/assessment reviews the process to ensure that service providers validate identification information to ensure the process is effectively implemented.'),\n('002025','draft','2013-05-03','DISA FSO','policy','The organization ensures that service providers transmit identification information.','IA-9(1).3','The organization being inspected/assessed implements a process to ensure that service providers transmit identification information.','The organization conducting the inspection/assessment reviews the process to ensure that service providers transmit identification information to ensure the process is effectively implemented.'),\n('002026','draft','2013-05-03','DISA FSO','policy','The organization ensures that service providers receive authentication information.','IA-9(1).4','The organization being inspected/assessed implements a process to ensure that service providers receive authentication information.','The organization conducting the inspection/assessment reviews the process to ensure that service providers receive authentication information to ensure the process is effectively implemented.'),\n('002027','draft','2013-05-03','DISA FSO','policy','The organization ensures that service providers validate authentication information.','IA-9(1).5','The organization being inspected/assessed implements a process to ensure that service providers validate authentication information.','The organization conducting the inspection/assessment reviews the process to ensure that service providers validate authentication information to ensure the process is effectively implemented. .'),\n('002028','draft','2013-05-03','DISA FSO','policy','The organization ensures that service providers transmit authentication information.','IA-9(1).6','The organization being inspected/assessed implements a process to ensure that service providers transmit authentication information.','The organization conducting the inspection/assessment reviews the process to ensure that service providers transmit authentication information to ensure the process is effectively implemented.'),\n('002029','draft','2013-05-03','DISA FSO','policy','The organization defines the services between which identification decisions are to be transmitted.','IA-9(2).1','The organization being inspected/assessed defines and documents  the services between which identification decisions are to be transmitted.  DoD has determined the services are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented services to ensure they have been defined.  DoD has determined the services are not appropriate to define at the Enterprise level.'),\n('002030','draft','2013-05-03','DISA FSO','policy','The organization defines the services between which authentication decisions are to be transmitted.','IA-9(2).2','The organization being inspected/assessed defines and documents  the services between which authentication decisions are to be transmitted.  DoD has determined the services are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented services to ensure they have been defined.  DoD has determined the services are not appropriate to define at the Enterprise level.'),\n('002031','draft','2013-05-03','DISA FSO','policy','The organization ensures that identification decisions are transmitted between organization-defined services consistent with organizational policies.','IA-9(2).3','The organization being inspected/assessed implements a process to ensure that identification decisions are transmitted between services defined in IA-9 (2), CCI 2029 consistent with organizational policies.','The organization conducting the inspection/assessment reviews the process to ensure the organization being inspected/assessed implements policies for transmitting identification decisions between services defined in IA-9 (2), CCI 2029.'),\n('002032','draft','2013-05-03','DISA FSO','policy','The organization ensures that authentication decisions are transmitted between organization-defined services consistent with organizational policies.','IA-9(2).4','The organization being inspected/assessed implements a process to ensure that authentication decisions are transmitted between services defined in IA-9 (2), CCI 2030 consistent with organizational policies.','The organization conducting the inspection/assessment reviews the process to ensure the organization being inspected/assessed implements policies for transmitting authentication decisions between services defined in IA-9 (2), CCI 2030.'),\n('002033','draft','2013-05-03','DISA FSO','policy','The organization defines the specific circumstances or situations when individuals accessing an information system employ organization-defined supplemental authentication techniques or mechanisms.','IA-10.1','The organization being inspected/assessed defines and documents the specific circumstances or situations when individuals accessing an information system employ organization-defined supplemental authentication techniques or mechanisms.  DoD has determined the circumstances or situations are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented circumstances or situations to ensure they have been defined.  DoD has determined the circumstances or situations are not appropriate to define at the Enterprise level.'),\n('002034','draft','2013-05-03','DISA FSO','policy','The organization defines the supplemental authentication techniques or mechanisms to be employed in specific organization-defined circumstances or situations by individuals accessing the information system.','IA-10.2','The organization being inspected/assessed defines and documents the supplemental authentication techniques or mechanisms to be employed in specific organization-defined circumstances or situations by individuals accessing the information system.  DoD has determined the supplemental authentication techniques or mechanisms are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented supplemental authentication techniques or mechanisms to ensure they have been defined.   DoD has determined the supplemental authentication techniques or mechanisms are not appropriate to define at the Enterprise level.'),\n('002035','draft','2013-05-03','DISA FSO','policy','The organization requires that individuals accessing the information system employ organization-defined supplemental authentication techniques or mechanisms under specific organization-defined circumstances or situations.','IA-10.3','The organization being inspected/assessed implements a process to require that individuals accessing the information system employ supplemental authentication techniques or mechanisms defined in IA-10, CCI 2034 under specific circumstances or situations defined in IA-10, CCI 2033.','The organization conducting the inspection/assessment reviews the process to ensure the organization being inspected/assessed requires that individuals accessing the information system employ supplemental authentication techniques or mechanisms defined in IA-10, CCI 2034 under specific circumstances or situations defined in IA-10, CCI 2033.'),\n('002036','draft','2013-05-03','DISA FSO','policy','The organization defines the circumstances or situations under which users will be required to reauthenticate.','IA-11.1','The organization being inspected/assessed defines and documents the circumstances or situations when users will be required to reauthenticate.  DoD has determined the circumstances or situations are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented circumstances or situations to ensure they have been defined.  DoD has determined the circumstances or situations are not appropriate to define at the Enterprise level.'),\n('002037','draft','2013-05-03','DISA FSO','policy','The organization defines the circumstances or situations under which devices will be required to reauthenticate.','IA-11.2','The organization being inspected/assessed defines and documents the circumstances or situations when devices will be required to reauthenticate.  DoD has determined the circumstances or situations are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented circumstances or situations to ensure they have been defined.  DoD has determined the circumstances or situations are not appropriate to define at the Enterprise level.'),\n('002038','draft','2013-05-03','DISA FSO','technical','The organization requires users to reauthenticate upon organization-defined circumstances or situations requiring reauthentication.','IA-11.3','The organization being inspected/assessed implements a process to require users to reauthenticate when circumstances or situations requiring reauthentication as defined in IA-11, CCI 2036.','The organization conducting the inspection/assessment reviews the process to ensure the organization being inspected/assessed requires users to reauthenticate when circumstances or situations requiring reauthentication as defined in IA-11, CCI 2036.'),\n('002039','draft','2013-05-03','DISA FSO','technical','The organization requires devices to reauthenticate upon organization-defined circumstances or situations requiring reauthentication.','IA-11.4','The organization being inspected/assessed implements a process to require devices to reauthenticate when circumstances or situations requiring reauthentication as defined in IA-11, CCI 2037.','The organization conducting the inspection/assessment reviews the process to ensure the organization being inspected/assessed requires devices to reauthenticate when circumstances or situations requiring reauthentication as defined in IA-11, CCI 2037.'),\n('002040','draft','2013-05-03','DISA FSO','policy','The organization requires that the registration process to receive an individual identifier includes supervisor authorization.','IA-4(2).1','The organization being inspected/assessed documents and implements a process that requires supervisor authorization to assign individual identifiers.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requires supervisor authorization to assign individual identifiers.'),\n('002041','draft','2013-05-03','DISA FSO','technical','The information system allows the use of a temporary password for system logons with an immediate change to a permanent password.','IA-5(1).20','The organization being inspected/assessed configures the information system to  allow the use of a temporary password for system logons with an immediate change to a permanent password.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2041.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to allow the use of a temporary password for system logons with an immediate change to a permanent password.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2041.'),\n('002042','draft','2013-05-03','DISA FSO','policy','The organization manages information system authenticators by protecting authenticator content from unauthorized modification.','IA-5.18','The organization being inspected/assessed configures the information system to manage information system authenticators by protecting authenticator content from unauthorized modification.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2042.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  manage information system authenticators by protecting authenticator content from unauthorized modification.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2042.'),\n('002043','draft','2013-05-03','DISA FSO','policy','The organization uses only FICAM-approved path discovery and validation products and services.','IA-5(15).1','The organization being inspected/assessed uses only Federal Identity,  Credential, and Access Management (FICAM)-approved path discovery and validation products and services.  FICAM Guidance is available at http://www.idmanagement.gov.','The organization conducting the inspection/assessment obtains and examines the list of path discovery and validation products and services in use to ensure the organization being inspected/assessed uses only FICAM-approved path discovery and validation products and services.'),\n('002044','draft','2013-05-29','DISA FSO','policy','The organization defines measures to be employed to ensure that long-term audit records generated by the information system can be retrieved.','AU-11(1).1','The organization being inspected/assessed defines and documents measures to be employed to ensure that long-term audit records generated by the information system can be retrieved.  DoD has determined that the measures are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented measures to ensure the organization being inspected/assessed defines measures to be employed to ensure that long-term audit records generated by the information system can be retrieved.  DoD has determined that the measures are not appropriate to define at the Enterprise level.'),\n('002045','draft','2013-05-29','DISA FSO','policy','The organization employs organization-defined measures to ensure that long-term audit records generated by the information system can be retrieved.','AU-11(1).2','The organization being inspected/assessed employs the measures defined in AU-11 (1), CCI 2044 to ensure that long-term audit records generated by the information system can be retrieved.','The organization conducting the inspection/assessment obtains and examines the documented measures to ensure the organization being inspected/assessed employs the measures defined in AU-11 (1), CCI 2044 to ensure that long-term audit records generated by the information system can be retrieved.'),\n('002046','draft','2013-05-29','DISA FSO','technical','The information system synchronizes the internal system clocks to the authoritative time source when the time difference is greater than the organization-defined time period.','AU-8(1).5','The organization being inspected/assessed configures the information system to synchronize the internal system clocks to the authoritative time source when the time difference is greater than the time period defined in AU-8 (1), CCI 1892.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2046.','The organization conducting the inspection/assessment examines the information system to ensure the system synchronizes the internal system clocks to the authoritative time source when the time difference is greater than the time period defined in AU-8 (1), CCI 1892.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2046.'),\n('002047','draft','2013-05-29','DISA FSO','policy','The organization defines the information system components on which the auditing that is to be performed can be changed by organization-defined individuals or roles.','AU-12(3).5','The organization being inspected/assessed defines and documents the information system components on which the auditing that is to be performed can be changed by individuals or roles defined in AU-12 (3), CCI 1913.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed has defined the information system components on which the auditing that is to be performed can be changed by the individuals or roles defined in AU-12 (3), CCI 1913.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002048','draft','2013-06-05','DISA FSO','policy','The organization defines the personnel or roles to whom the security awareness and training policy is disseminated.','AT-1.1','DoD has defined the roles as organizational personnel with security awareness and training responsibilities.\\n\\nDoD disseminates DoDD 8570.01 organization-wide via the DoD Issuances website.\\nhttp://www.dtic.mil/whs/directives/corres/dir.html','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the roles as organizational personnel with security awareness and training responsibilities.'),\n('002049','draft','2013-06-05','DISA FSO','policy','The organization defines the personnel or roles to whom the security awareness and training procedures are disseminated.','AT-1.2','DoD has defined the roles as organizational personnel with security awareness and training responsibilities.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the roles as organizational personnel with security awareness and training responsibilities.'),\n('002050','draft','2013-06-05','DISA FSO','policy','The organization defines the personnel or roles to whom initial and refresher training in the employment and operation of environmental controls is to be provided.','AT-3(1).4','The organization being inspected/assessed defines and documents the personnel or roles to whom initial and refresher training in the employment and operation of environmental controls is to be provided.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles to whom initial and refresher training in the employment and operation of environmental controls is to be provided.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.'),\n('002051','draft','2013-06-05','DISA FSO','policy','The organization defines the personnel or roles to whom initial and refresher training in the employment and operation of physical security controls is to be provided.','AT-3(2).4','The organization being inspected/assessed defines and documents the personnel or roles to  whom initial and refresher training in the employment and operation of physical security controls is to be provided.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles to  whom initial and refresher training in the employment and operation of physical security controls is to be provided.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.'),\n('002052','draft','2013-06-05','DISA FSO','policy','The organization includes practical exercises in security training that reinforce training objectives.','AT-3(3).1','The organization being inspected/assessed includes practical exercises in security training that reinforce training objectives.','The organization conducting the inspection/assessment obtains and examines the security training materials to ensure the organization being inspected/assessed includes practical exercises in security training that reinforce training objectives.'),\n('002053','draft','2013-06-05','DISA FSO','policy','The organization provides training to its personnel on organization-defined indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems.','AT-3(4).1','The organization being inspected/assessed provides training to its personnel on  indicators of malicious code defined in AT-3 (4), CCI 2054 to recognize suspicious communications and anomalous behavior in organizational information systems.','The organization conducting the inspection/assessment obtains and examines the training materials and indicators of malicious code defined in AT-3 (4), CCI 2054 to ensure the organization being inspected/assessed provides users with the means to recognize suspicious communications and anomalous behavior in organizational information systems.'),\n('002054','draft','2013-06-05','DISA FSO','policy','The organization defines indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems.','AT-3(4).2','The organization being inspected/assessed defines and documents indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems.  DoD has determined the indicators are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented indicators to ensure the organization being inspected/assessed defines indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems.  DoD has determined the indicators are not appropriate to define at the Enterprise level.'),\n('002055','draft','2013-06-05','DISA FSO','policy','The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.','AT-2(2).1','The IA Awareness CBT, \\\"Cyber Awareness Challenge,\\\" and Virtual Training Environment (VTE) Courses: \\\"Introduction to Insider Threat\\\" and \\\"Monitoring for Insider Threat\\\" available on the IASE website meet the DoD requirement to include security awareness training on recognizing and reporting potential indicators of insider threat.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level training available on the IASE website.','The IA Awareness CBT, \\\"Cyber Awareness Challenge,\\\" and Virtual Training Environment (VTE) Courses: \\\"Introduction to Insider Threat\\\" and \\\"Monitoring for Insider Threat\\\" available on the IASE website meet the DoD requirement to include security awareness training on recognizing and reporting potential indicators of insider threat.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level training available on the IASE website.'),\n('002056','draft','2013-06-11','DISA FSO','policy','The organization defines the time period the records of configuration-controlled changes are to be retained.','CM-3.7','DoD has defined the time period as a time period defined by the organization\\'s CCB.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the time period as a time period defined by the organization\\'s CCB.'),\n('002057','draft','2013-06-11','DISA FSO','policy','The organization defines the personnel to be notified when approved changes to the information system are completed.','CM-3(1).8','The organization being inspected/assessed defines and documents the personnel to be notified when approved changes to the information system are completed, which must include, at a minimum, the CCB.  DoD has defined the personnel as at a minimum, the CCB.','The organization conducting the inspection/assessment obtains and examines the documented personnel to ensure the organization being inspected/assessed defines  the personnel to be notified when approved changes to the information system are completed, which must include, at a minimum, the CCB.  DoD has defined the personnel as at a minimum, the CCB.'),\n('002058','draft','2013-06-11','DISA FSO','policy','The organization employs automated mechanisms to notify organization-defined personnel when approved changes to the information system are completed.','CM-3(1).9','The organization being inspected/assessed notifies  at a minimum, the CCB when approved changes to the information system are completed.  The organization must maintain an audit trail of notifications of completed changes to the information system.  DoD has defined the personnel as at a minimum, the CCB.','The organization conducting the inspection/assessment obtains and examines the audit trail of notifications of completed changes to the information system to ensure the organization being inspected/assessed notifies at a minimum, the CCB when approved changes to the information system are completed.  DoD has defined the personnel as at a minimum, the CCB. '),\n('002059','draft','2013-06-11','DISA FSO','policy','The organization defines the information system components for which the organization will employ automated mechanisms to centrally manage, apply, and verify configuration settings.','CM-6(1).4','The organization being inspected/assessed defines and documents the  information system components for which the organization will employ automated mechanisms to centrally manage, apply, and verify configuration settings.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examine the documented  information system components to ensure the organization being inspected/assessed defines the information system components for which the organization will employ automated mechanisms to centrally manage, apply, and verify configuration settings.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002060','deprecated','2013-06-21','DISA FSO','policy','The organization develops and documents a security assessment and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.',NULL,NULL,NULL),\n('002061','draft','2013-06-21','DISA FSO','policy','The organization defines the personnel or roles to whom security assessment and authorization policy is to be disseminated.','CA-1.1','DoD has defined the personnel or roles as all personnel.  DoD disseminates DoDI 8510.01 organization-wide via the DoD Issuances website. http://www.dtic.mil/whs/directives/corres/ins1.html','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as all personnel.'),\n('002062','draft','2013-06-21','DISA FSO','policy','The organization defines the personnel or roles to whom the security assessment and authorization procedures are to be disseminated.','CA-1.2','DoD has defined the personnel or roles as all personnel.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as all personnel.'),\n('002063','draft','2013-06-21','DISA FSO','policy','The organization defines the level of independence for assessors or assessment teams to conduct security control assessments of organizational information systems.','CA-2(1).2','The organization being inspected/assessed defines and documents the level of independence for assessors or assessment teams to conduct security control assessments of organizational information systems.  DoD has determined the level of independence is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented level of independence to ensure the organization being inspected/assessed defines the level of independence for assessors or assessment teams to conduct security control assessments of organizational information systems.  DoD has determined the level of independence is not appropriate to define at the Enterprise level.'),\n('002064','draft','2013-06-21','DISA FSO','policy','The organization selects one or more security assessment techniques to be conducted.','CA-2(2).4','The organization being inspected/assessed selects and documents one or more security assessment techniques to be conducted.  Techniques include in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment and performance/load testing, as well as any other techniques identified in CA-2 (2), CCI 1582.  DoD has determined the other forms of security assessments are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the selected list of assessment techniques that are to be conducted to ensure the selections have been documented.'),\n('002065','draft','2013-06-21','DISA FSO','policy','The organization defines the frequency at which to conduct security control assessments.','CA-2(2).5','DoD has defined the frequency as at least annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at least annually.'),\n('002066','draft','2013-06-21','DISA FSO','policy','The organization accepts the results of an assessment of the organization-defined information system performed by an organization-defined external organization when the assessment meets organization-defined requirements.','CA-2(3).1','The organization being inspected/assessed accepts the results of an assessment of the information system defined in CA-2 (3), CCI 2067 performed by external organization defined in CA-2 (3), CCI  2068 when the assessment meets requirements defined in CA-2 (3), CCI 2069.  The organization must maintain records of acceptance or rejection of external organization assessment results.','The organization conducting the inspection/assessment obtains and examines a sampling of records of acceptance or rejection of external organization assessment results to ensure the organization being inspected/assessed accepts the results of an assessment of the information system defined in CA-2 (3), CCI 2067 performed by external organization defined in CA-2 (3), CCI  2068 when the assessment meets requirements defined in CA-2 (3), CCI 2069.'),\n('002067','draft','2013-06-21','DISA FSO','policy','The organization defines the information systems for which they will accept the results of an assessment performed by an external organization.','CA-2(3).2','The organization being inspected/assessed defines and documents the information systems for which they will accept the results of an assessment performed by an external organization.   DoD has determined the information systems are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information systems to ensure the organization being inspected/assessed  defines the information systems for which they will accept the results of an assessment performed by an external organization.   DoD has determined the information systems are not appropriate to define at the Enterprise level.'),\n('002068','draft','2013-06-21','DISA FSO','policy','The organization defines the external organizations from which assessment results for organization-defined information systems will be accepted.','CA-2(3).3','The organization being inspected/assessed defines and documents the external organizations from which assessment results for organization-defined information systems will be accepted.  DoD has determined the external organizations are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented external organizations to ensure the organization being inspected/assessed defines the external organizations from which assessment results for organization-defined information systems will be accepted.  DoD has determined the external organizations are not appropriate to define at the Enterprise level.'),\n('002069','draft','2013-06-21','DISA FSO','policy','The organization defines the requirements the assessments for organization-defined information systems from organization-defined external organizations must meet.','CA-2(3).4','The organization being inspected/assessed defines and documents the requirements the assessments  for organization-defined information systems from organization-defined external organizations must meet.  DoD has determined the requirements are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examine the documented requirements to ensure the organization being inspected/assessed defines  the requirements the assessments  for organization-defined information systems from organization-defined external organizations must meet.  DoD has determined the requirements are not appropriate to define at the Enterprise level.'),\n('002070','draft','2013-06-21','DISA FSO','policy','The organization^s security assessment plan describes the assessment team, and assessment roles and responsibilities.','CA-2.5','The organization being inspected/assessed lists their assessment team members and their associated assessment roles and responsibilities in the security assessment plan.','The organization conducting the inspection/assessment obtains and examines the security assessment plan to ensure the organization being inspected/assessed lists their assessment team members and their associated assessment roles and responsibilities in the security assessment plan.'),\n('002071','draft','2013-06-21','DISA FSO','policy','The organization defines the individuals or roles to whom the results of the security control assessment are to be provided.','CA-2.10','DoD has defined the individuals or roles as at a minimum, the ISSO and ISSM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the individuals or roles as at a minimum, the ISSO and ISSM.'),\n('002072','draft','2013-06-21','DISA FSP','policy','The organization defines the unclassified, national security systems that are prohibited from directly connecting to an external network without the use of an organization-defined boundary protection device.','CA-3(1).2','DoD has defined the unclassified, national security systems as all unclassified NSS.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the unclassified, national security systems as all unclassified NSS.'),\n('002073','draft','2013-06-21','DISA FSO','policy','The organization defines the boundary protection device to be used to connect organization-defined unclassified, national security systems to an external network.','CA-3(1).3','The organization being inspected/assessed defines and documents the boundary protection device to be used  to connect organization-defined unclassified, national security systems to an external network.  DoD has determined the boundary protection device is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented boundary protection device to ensure the organization being inspected/assessed defines the boundary protection device to be used  to connect organization-defined unclassified, national security systems to an external network.  DoD has determined the boundary protection device is not appropriate to define at the Enterprise level.'),\n('002074','draft','2013-06-21','DISA FSO','policy','The organization defines the boundary protection device to be used for the direct connection of classified, national security system to an external network.','CA-3(2).2','The organization being inspected/assessed defines and documents the  boundary protection device to be used for the direct connection of classified, national security system to an external network.\\n\\nDoD has determined the boundary protection device is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented boundary protection device to ensure the organization being inspected/assessed defines the boundary protection device to be used for the direct connection of classified, national security system to an external network.\\n\\nDoD has determined the boundary protection device is not appropriate to define at the Enterprise level.'),\n('002075','draft','2013-06-21','DISA FSO','policy','The organization prohibits the direct connection of an organization-defined unclassified, non-national security system to an external network without the use of organization-defined boundary protection device.','CA-3(3).1','The organization being inspected/assessed does not connect any national security systems to an external network without the use of protection devices defined in CA-3 (3), CCI 2077.','The organization conducting the inspection/assessment obtains and examines network topology diagrams and examines the information system to ensure the organization being inspected/assessed does not connect any national security systems to an external network without the use of protection devices defined in CA-3 (3), CCI 2077.'),\n('002076','draft','2013-06-21','DISA FSO','policy','The organization defines the unclassified, non-national security system that is prohibited from directly connecting to an external network without the use of an organization-defined boundary protection device.','CA-3(3).2','The organization being inspected/assessed defines and documents the unclassified, non-national security system that is prohibited from directly connecting to an external network without the use of an organization-defined boundary protection device.  DoD has determined the unclassified, non-national security system is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented unclassified, non-national security system to ensure the organization being inspected/assessed defines the unclassified, non-national security system that is prohibited from directly connecting to an external network without the use of an organization-defined boundary protection device.  DoD has determined the unclassified, non-national security system is not appropriate to define at the Enterprise level.'),\n('002077','draft','2013-06-21','DISA FSO','policy','The organization defines the boundary protection device to be used to directly connect an organization-defined unclassified, non-national security system to an external network.','CA-3(3).3','The organization being inspected/assessed  defines and documents the boundary protection device to be used to directly connect an organization-defined unclassified, non-national security system to an external network.  DoD has determined the boundary protection device is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented boundary protection device to ensure the organization being inspected/assessed defines the boundary protection device to be used to directly connect an organization-defined unclassified, non-national security system to an external network.   DoD has determined the boundary protection device is not appropriate to define at the Enterprise level.'),\n('002078','draft','2013-06-21','DISA FSO','policy','The organization prohibits the direct connection of an organization-defined information system to a public network.','CA-3(4).1','The organization being inspected/assessed does not connect any information system defined in CA-3 (4), CCI 2079 to a public network.','The organization conducting the inspection/assessment obtains and examines network topology diagrams and examines the information system to ensure the organization being inspected/assessed does not connect any information system defined in CA-3 (4), CCI 2079 to a public network.'),\n('002079','draft','2013-06-21','DISA FSO','policy','The organization defines the information system that is prohibited from directly connecting to a public network.','CA-3(4).2','The organization being inspected/assessed defines and documents the information system that is prohibited from directly connecting to a public network.  DoD has determined the information system is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system to ensure the organization being inspected/assessed defines the information system that is prohibited from directly connecting to a public network.  DoD has determined the information system is not appropriate to define at the Enterprise level.'),\n('002080','draft','2013-06-21','DISA FSO','policy','The organization employs either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing organization-defined information systems to connect to external information systems.','CA-3(5).1','The organization being inspected/assessed configures the information system to employ  a deny-all, permit by exception policy for allowing any systems requiring external connectivity to connect to external information systems.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2080.  DoD has defined the information systems as any systems requiring external connectivity.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to employ a deny-all, permit by exception policy for allowing any systems requiring external connectivity to connect to external information systems.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2080.  DoD has defined the information systems as any systems requiring external connectivity.'),\n('002081','draft','2013-06-21','DISA FSO','policy','The organization defines the information systems that employ either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing connections to external information systems.','CA-3(5).2','DoD has defined the information systems as any systems requiring external connectivity.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information systems as any systems requiring external connectivity.'),\n('002082','draft','2013-06-21','DISA FSO','policy','The organization selects either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing organization-defined information systems to connect to external information systems.','CA-3(5).3','The organization being inspected/assessed selects deny-all, permit by exception policy for allowing any systems requiring external connectivity to connect to external information systems.  DoD has defined the information systems as any systems requiring external connectivity.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed selects deny-all, permit by exception policy for allowing any systems requiring external connectivity to connect to external information systems.  DoD has defined the information systems as any systems requiring external connectivity.'),\n('002083','draft','2013-06-21','DISA FSO','policy','The organization reviews and updates Interconnection Security Agreements on an organization-defined frequency.','CA-3.5','The organization being inspected/assessed reviews and updates Interconnection Security Agreements at least annually.  The organization must maintain an audit trail of reviews and updates.  DoD has defined the frequency as at least annually.','The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates Interconnection Security Agreements at least annually.  DoD has defined the frequency as at least annually.'),\n('002084','draft','2013-06-21','DISA FSO','policy','The organization defines the frequency at which reviews and updates to the Interconnection Security Agreements must be conducted.','CA-3.6','DoD has defined the frequency as at least annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at least annually.'),\n('002085','draft','2013-06-21','DISA FSO','policy','The organization defines the level of independence the assessors or assessment teams must have to monitor the security controls in the information system on an ongoing basis.','CA-7(1).2','Future DoD-wide CM guidance to be published','Future DoD-wide CM guidance to be published'),\n('002086','draft','2013-06-21','DISA FSO','policy','The organization employs trend analyses to determine if security control implementations, the frequency of continuous monitoring activities, and/or the types of activities used in the continuous monitoring process need to be modified based on empirical data.','CA-7(3).1','Future DoD-wide CM guidance to be published','Future DoD-wide CM guidance to be published'),\n('002087','draft','2013-06-21','DISA FSO','policy','The organization establishes and defines the metrics to be monitored for the continuous monitoring program.','CA-7.2','Future DoD-wide CM guidance to be published','Future DoD-wide CM guidance to be published'),\n('002088','draft','2013-06-21','DISA FSO','policy','The organization establishes and defines the frequencies for continuous monitoring.','CA-7.3','Future DoD-wide CM guidance to be published','Future DoD-wide CM guidance to be published'),\n('002089','draft','2013-06-21','DISA FSO','policy','The organization establishes and defines the frequencies for assessments supporting continuous monitoring.','CA-7.4','Future DoD-wide CM guidance to be published','Future DoD-wide CM guidance to be published'),\n('002090','draft','2013-06-21','DISA FSO','policy','The organization implements a continuous monitoring program that includes ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy.','CA-7.6','Future DoD-wide CM guidance to be published','Future DoD-wide CM guidance to be published'),\n('002091','draft','2013-06-21','DISA FSO','policy','The organization implements a continuous monitoring program that includes correlation and analysis of security-related information generated by assessments and monitoring.','CA-7.7','Future DoD-wide CM guidance to be published','Future DoD-wide CM guidance to be published'),\n('002092','draft','2013-06-21','DISA FSO','policy','The organization implements a continuous monitoring program that includes response actions to address results of the analysis of security-related information.','CA-7.8','Future DoD-wide CM guidance to be published','Future DoD-wide CM guidance to be published'),\n('002093','draft','2013-06-21','DISA  FSO','policy','The organization conducts penetration testing in accordance with organization-defined frequency on organization-defined information systems or system components.','CA-8.1','The organization being inspected/assessed documents and implements a process to conduct penetration testing in accordance with the frequency defined in CA-8, CCI 2094  on information systems or system components defined in CA-8, CCI 2095.  The organization must maintain a record of penetration test results.','The organization conducting the inspection/assessment obtains and examines the documented process as well as a sampling of the penetration test results to ensure the organization being inspected/assessed conducts penetration testing in accordance with the frequency defined in CA-8, CCI 2094  on information systems or system components defined in CA-8, CCI 2095.'),\n('002094','draft','2013-06-21','DISA FSO','policy','The organization defines the frequency for conducting penetration testing on organization-defined information systems or system components.','CA-8.2','The organization being inspected/assessed defines and documents the frequency for conducting penetration testing on organization-defined information systems or system components.  DoD has determined the frequency is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed  defines the frequency for conducting penetration testing on organization-defined information systems or system components.  DoD has determined the frequency is not appropriate to define at the Enterprise level.'),\n('002095','draft','2013-06-21','DISA FSO','policy','The organization defines the information systems or system components on which penetration testing will be conducted.','CA-8.3','The organization being inspected/assessed defines and documents the information systems or system components on which penetration testing will be conducted.  DoD has determined the information systems or system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information systems or system components to ensure the organization being inspected/assessed defines the information systems or system components on which penetration testing will be conducted.  DoD has determined the information systems or system components are not appropriate to define at the Enterprise level.'),\n('002096','draft','2013-06-21','DISA FSO','policy','The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system or system components.','CA-8(1).1','The organization being inspected/assessed employs an independent penetration agent or penetration team to perform penetration testing on the information system or system components.  The organization must maintain a record of penetration test results.','The organization conducting the inspection/assessment obtains and examines a sampling of the penetration test results to ensure the organization being inspected/assessed employs an independent penetration agent or penetration team to perform penetration testing on the information system or system components.'),\n('002097','draft','2013-06-21','DISA FSP','policy','The organization defines red team exercises to simulate attempts by adversaries to compromise organizational information systems.','CA-8(2).1','The organization being inspected/assessed defines and documents  red team exercises to simulate attempts by adversaries to compromise organizational information systems.  DoD has determined the red team exercises are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented red team exercises to ensure the organization being inspected/assessed defines red team exercises to simulate attempts by adversaries to compromise organizational information systems.  DoD has determined the red team exercises are not appropriate to define at the Enterprise level.'),\n('002098','draft','2013-06-21','DISA FSO','policy','The organization defines rules of engagement for red team exercises to simulate attempts by adversaries to compromise organizational information systems.','CA-8(2).2','The organization being inspected/assessed defines and documents rules of engagement for red team exercise to simulate attempts by adversaries to compromise organizational information systems.  DoD has determined the rules of engagement are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented rules of engagement to ensure the organization being inspected/assessed defines the rules of engagement for red team exercise to simulate attempts by adversaries to compromise organizational information systems.  DoD has determined the rules of engagement are not appropriate to define at the Enterprise level.'),\n('002099','draft','2013-06-21','DISA FSO','policy','The organization employs organization-defined red team exercises to simulate attempts by adversaries to compromise organizational information systems in accordance with organization-defined rules of engagement.','CA-8(2).3','The organization being inspected/assessed employs red team exercises defined in CA-8 (2), CCI  2097 to simulate attempts by adversaries to compromise organizational information systems in accordance with rules of engagement defined in CA-8 (2), CCI 2098.  The organization must maintain a record of red team exercises and results.','The organization conducting the inspection/assessment obtains and examines the record of red team exercises and results to ensure the organization being inspected/assessed employs red team exercises defined in CA-8 (2), CCI  2097 to simulate attempts by adversaries to compromise organizational information systems in accordance with rules of engagement defined in CA-8 (2), CCI 2098.'),\n('002100','draft','2013-06-21','DISA FSO','policy','The information system performs security compliance checks on constituent components prior to the establishment of the internal connection.','CA-9(1).1','The organization being inspected/assessed documents and implements a process to perform security compliance checks on constituent components prior to the establishment of the internal connection.  The organization must maintain a record of security compliance checks.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of security compliance checks to ensure the organization being inspected/assessed performs security compliance checks on constituent components prior to the establishment of the internal connection.'),\n('002101','draft','2013-06-21','DISA FSO','policy','The organization authorizes internal connections of organization-defined information system components or classes of components to the information system.','CA-9.1','The organization being inspected/assessed authorizes internal connections of  information system components defined in CA-9, CCI 2102 or classes of components to the information system.  The organization must maintain an audit trail of authorizations.','The organization conducting the inspection/assessment obtains and examines the audit trail of authorizations to ensure the organization being inspected/assessed  authorizes internal connections of  information system components defined in CA-9, CCI 2102 or classes of components to the information system.'),\n('002102','draft','2013-06-21','DISA FSO','policy','The organization defines the information system components or classes of components that are authorized internal connections to the information system.','CA-9.2','The organization being inspected/assessed defines and documents the information system components or classes of components that that are authorized internal connections to the information system.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the  documented information system components to ensure the organization being inspected/assessed defines the information system components or classes of components that that are authorized internal connections to the information system.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002103','draft','2013-06-21','DISA FSO','policy','The organization documents, for each internal connection, the interface characteristics.','CA-9.3','The organization being inspected/assessed  documents, for each internal connection, the interface characteristics.','The organization conducting the inspection/assessment obtains and examines the documented interface characteristics as well as the network topology to ensure the organization being inspected/assessed documents, for each internal connection, the interface characteristics.'),\n('002104','draft','2013-06-21','DISA FSO','policy','The organization documents, for each internal connection, the security requirements.','CA-9.4','The organization being inspected/assessed documents, for each internal connection, the security requirements.','The organization conducting the inspection/assessment obtains and examines the documented security requirements as well as the network topology to ensure the organization being inspected/assessed documents, for each internal connection, the security requirements.'),\n('002105','draft','2013-06-21','DISA FSO','policy','The organization documents, for each internal connection, the nature of the information communicated.','CA-9.5','The organization being inspected/assessed documents, for each internal connection, the nature of the information communicated.','The organization conducting the inspection/assessment obtains and examines the documented nature of information communication as well as the network topology to ensure the organization being inspected/assessed documents, for each internal connection, the nature of the information communicated.'),\n('002106','draft','2013-06-24','DISA FSO','policy','The organization documents the access control policy.',NULL,NULL,NULL),\n('002107','draft','2013-06-24','DISA FSO','policy','The organization defines the personnel or roles to be recipients of the access control policy necessary to facilitate the implementation of the access control policy and associated access controls.','AC-1.1','DoD has defined the personnel or roles as all personnel.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as all personnel.'),\n('002108','draft','2013-06-24','DISA FSO','policy','The organization defines the personnel or roles to be recipients of the procedures necessary to facilitate the implementation of the access control policy and associated access controls.','AC-1.2','DoD has defined the personnel or roles as all personnel.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as all personnel.'),\n('002109','draft','2013-06-24','DISA FSO','policy','The organization documents procedures to facilitate the implementation of the access control policy and associated access controls.',NULL,NULL,NULL),\n('002110','draft','2013-06-24','DISA FSO','policy','The organization defines the information system account types that support the organizational missions/business functions.','AC-2.1','The organization being inspected/assessed defines and documents the information system account types that support the organizational missions/business functions.  DoD has determined the information system account types are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system account types to ensure the organization being inspected/assessed defines the information system account types that support the organizational missions/business functions.  DoD has determined the information system account types are not appropriate to define at the Enterprise level.'),\n('002111','draft','2013-06-24','DISA FSO','policy','The organization identifies and selects the organization-defined information system account types of information system accounts which support organizational missions/business functions.','AC-2.2','The account types are defined per AC-2, CCI  2110.','The account types are defined per AC-2, CCI  2110.'),\n('002112','draft','2013-06-24','DISA FSO','policy','The organization assigns account managers for information system accounts.','AC-2.3','The organization being inspected/assessed documents personnel responsible for the management of system accounts.','The organization conducting the inspection/assessment obtains and examines the documented appointment of management personnel to ensure that the organization being inspected/assessed has documented personnel responsible for the management of system accounts.'),\n('002113','draft','2013-06-24','DISA FSO','policy','The organization establishes conditions for role membership.','AC-2.5','The organization being inspected/assessed documents conditions for adding accounts as members of roles.','The organization conducting the inspection/assessment obtains and examines the documented conditions for adding accounts as members of roles to ensure that the conditions are established.'),\n('002114','deprecated','2013-06-24','DISA FSO','policy','The organization specifies authorized users of the information system for each account.',NULL,NULL,NULL),\n('002115','draft','2013-06-24','DISA FSO','policy','The organization specifies authorized users of the information system.','AC-2.6','The organization being inspected/assessed documents authorized users of the information system.','The organization conducting the inspection/assessment obtains and examines the documented list of authorized users for a sampling of information system accounts to ensure that the authorized users are specified.'),\n('002116','draft','2013-06-24','DISA FSO','policy','The organization specifies authorized group membership on the information system.','AC-2.7','The organization being inspected/assessed documents authorized group membership on the information system.','The organization conducting the inspection/assessment obtains and examines the documented list of authorized groups for a sampling of information system accounts to ensure that the authorized groups are specified.'),\n('002117','draft','2013-06-24','DISA FSO','policy','The organization specifies authorized role membership on the information system.','AC-2.8','The organization being inspected/assessed documents authorized role membership on the information system.','The organization conducting the inspection/assessment obtains and examines the documented list of authorized roles for a sampling of information system accounts to ensure that the authorized roles are specified'),\n('002118','draft','2013-06-24','DISA FSO','policy','The organization specifies access authorizations (i.e., privileges) for each account on the information system.','AC-2.9','The organization being inspected/assessed documents  access authorizations (i.e., privileges) for each account on the information system.','The organization conducting the inspection/assessment obtains and examines the documented list of access authorizations for a sampling of information system accounts to ensure that the access authorizations are specified.'),\n('002119','draft','2013-06-24','DISA FSO','policy','The organization specifies other attributes for each account on the information system.','AC-2.10','The organization being inspected/assessed documents other attributes for each account on the information system.','The organization conducting the inspection/assessment obtains and examines the documented list of other attributes for a sampling of information system accounts to ensure that other attributes are specified.'),\n('002120','draft','2013-06-24','DISA FSO','policy','The organization defines the personnel or roles authorized to approve the creation of information system accounts.','AC-2.12','DoD has defined the personnel or roles as the ISSM or ISSO.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as the ISSM or ISSO.'),\n('002121','draft','2013-06-24','DISA FSO','policy','The organization defines the procedures or conditions to be employed when creating, enabling, modifying, disabling, and removing information system accounts.','AC-2.14','The organization being inspected/assessed defines and documents the procedures or conditions to be employed when creating, enabling, modifying, disabling, and removing information system accounts.   DoD has determined the procedures or conditions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented procedures or conditions to ensure the organization being inspected/assessed defines the procedures or conditions to be employed when creating, enabling, modifying, disabling, and removing information system accounts.   DoD has determined the procedures or conditions are not appropriate to define at the Enterprise level.'),\n('002122','draft','2013-06-24','DISA FSO','policy','The organization monitors the use of information system accounts.','AC-2.15','The organization being inspected/assessed implements a process to monitor the use of information system accounts.','The organization conducting the inspection/assessment obtains and examines the audit trail to ensure that the organization being inspected/assessed implements a process to monitor the use of information system accounts.'),\n('002123','draft','2013-06-24','DISA FSO','policy','The organization notifies account managers when accounts are no longer required.','AC-2.16','The organization being inspected/assessed implements a process to notify account managers when accounts are no longer required.  The organization being inspected/assessed maintains an audit trail of notifications.','The organization conducting the inspection/assessment obtains and examines the audit trail of notifications to ensure the organization being inspected/assessed implements a process to notify account managers when accounts are no longer required.'),\n('002124','draft','2013-06-24','DISA FSO','policy','The organization notifies account managers when users are terminated or transferred.','AC-2.17','The organization being inspected/assessed implements a process to notify account managers when users are terminated or transferred.  The organization being inspected/assessed maintains an audit trail of notifications.','The organization conducting the inspection/assessment obtains and examines the audit trail of notifications to ensure the organization being inspected/assessed implements a process to notify account managers when users are terminated or transferred.'),\n('002125','draft','2013-06-24','DISA FSO','policy','The organization notifies account managers when individual information system usage or need-to-know changes.','AC-2.18','The organization being inspected/assessed implements a process to notify account managers when individual information system usage or need-to-know changes.  The organization being inspected/assessed maintains an audit trail of notifications.','The organization conducting the inspection/assessment obtains and examines the audit trail of notifications to ensure the organization being inspected/assessed implements a process to notify account managers when individual information system usage or need-to-know changes.'),\n('002126','draft','2013-06-24','DISA FSO','policy','The organization authorizes access to the information system based on a valid access authorization.','AC-2.19','The organization being inspected/assessed authorizes access to the information system based on the access authorization process.  The organization being inspected/assessed maintains an audit trail of approved access.','The organization conducting the inspection/assessment obtains and examines the audit trail of approved access to ensure the organization being inspected/assessed authorizes access to the information system based on the access authorization process.'),\n('002127','draft','2013-06-24','DISA FSO','policy','The organization authorizes access to the information system based on intended system usage.','AC-2.20','The organization being inspected/assessed authorizes access to the information system based on intended system usage.  The organization being inspected/assessed maintains an audit trail of approved access.','The organization conducting the inspection/assessment obtains and examines the audit trail of approved access to ensure the organization being inspected/assessed authorizes access to the information system based on intended system usage.'),\n('002128','draft','2013-06-24','DISA FSO','policy','The organization authorizes access to the information system based on other attributes as required by the organization or associated missions/business functions.','AC-2.21','The organization being inspected/assessed authorizes access to the information system based on other attributes as required by the organization or associated missions/business functions.  The organization being inspected/assessed maintains an audit trail of approved access.','The organization conducting the inspection/assessment obtains and examines the audit trail of approved access to ensure the organization being inspected/assessed authorizes access to the information system based on other attributes as required by the organization or associated missions/business functions.'),\n('002129','draft','2013-06-24','DISA FSO','policy','The organization establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.','AC-2.24','The organization being inspected/assessed includes in the account management procedures a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.','The organization conducting the inspection/assessment obtains and examines the account management procedures to ensure the organization being inspected/assessed includes in the account management procedures a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.'),\n('002130','draft','2013-06-24','DISA FSO','technical','The information system automatically audits account enabling actions.','AC-2(4).9','The organization being inspected/assessed configures the information system to automatically audit account enabling actions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2130.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically audit account enabling actions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2130.'),\n('002131','draft','2013-06-24','DISA FSO','policy','The organization defines the personnel or roles to be notified on account creation, modification, enabling, disabling, and removal actions.','AC-2(4).10','DoD has defined the personnel or roles as the system administrator and ISSO.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as the system administrator and ISSO.'),\n('002132','draft','2013-06-24','DISA FSO','technical','The information system notifies organization-defined personnel or roles for account enabling actions.','AC-2(4).11','The organization being inspected/assessed configures the information system to notify the system administrator and ISSO for account enabling actions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2132.  DoD has defined the personnel or roles as the system administrator and ISSO.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to notify the system administrator and ISSO for account enabling actions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2132.  DoD has defined the personnel or roles as the system administrator and ISSO.'),\n('002133','draft','2013-06-24','DISA FSO ','policy','The organization defines other conditions when users are required to log out.','AC-2(5).1','The organization being inspected/assessed defines and documents the other conditions when users are required to log out.  DoD has determined the conditions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented conditions to ensure they have been defined.  DoD has determined the conditions are not appropriate to define at the Enterprise level.'),\n('002134','draft','2013-06-24','DISA FSO','policy','The organization defines a list of dynamic privilege management capabilities to be implemented by the information system.','AC-2(6).1','The organization being inspected/assessed defines and documents a list of dynamic privilege management capabilities to be implemented by the information system.  DoD has determined the list is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented list to ensure the dynamic privilege management capabilities have been defined.  DoD has determined the list is not appropriate to define at the Enterprise level.'),\n('002135','draft','2013-06-24','DISA FSO','technical','The information system implements the organization-defined list of dynamic privilege management capabilities.','AC-2(6).2','The organization being inspected/assessed configures the information system to implement the list of dynamic privilege management capabilities defined in AC-2 (6), CCI 2134.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2135.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement the list of dynamic privilege management capabilities defined in AC-2 (6), CCI 2134.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2135.'),\n('002136','draft','2013-06-24','DISA FSO','policy','The organization defines the actions to be taken when privileged role assignments are no longer appropriate.','AC-2(7).4','DoD has defined the actions as disables (or revokes) privileged user account.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the actions as disables (or revokes) privileged user account.'),\n('002137','draft','2013-06-24','DISA FSO','policy','The organization takes organization-defined actions when privileged role assignments are no longer appropriate.','AC-2(7).5','The organization being inspected/assessed documents and implements a process to disable (or revoke) the privileged user account when privileged role assignments are no longer appropriate.  The organization must maintain an audit trail of the actions taken.  DoD has defined the actions as disables (or revokes) privileged user account.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of actions taken to ensure the organization being inspected/assessed disables (or revokes) the privileged user account when privileged role assignments are no longer appropriate.\\nDoD has defined the actions as disables (or revokes) privileged user account.'),\n('002138','draft','2013-06-24','DISA FSO','policy','The organization defines the information system accounts that can be dynamically created.','AC-2(8).1','The organization being inspected/assessed defines and documents the information system accounts that can be dynamically created.  DoD has determined the information system accounts are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system accounts to ensure they have been defined.  DoD has determined the information system accounts are not appropriate to define at the Enterprise level.'),\n('002139','draft','2013-06-24','DISA FSO','technical','The information system creates organization-defined information system accounts dynamically.','AC-2(8).2','The organization being inspected/assessed configures the information system to dynamically create information system accounts defined in AC-2 (8), CCI 2138.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2139.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to dynamically create information system accounts defined in AC-2 (8), CCI 2138.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2139.'),\n('002140','draft','2013-06-24','DISA FSO ','policy','The organization defines the conditions for establishing shared/group accounts.','AC-2(9).1','The organization being inspected/assessed defines and documents the conditions for establishing shared/group accounts.  DoD has determined the conditions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented conditions to ensure they have been defined.  DoD has determined the conditions are not appropriate to define at the Enterprise level.'),\n('002141','draft','2013-06-24','DISA FSO','policy','The organization only permits the use of shared/group accounts that meet organization-defined conditions for establishing shared/group accounts.','AC-2(9).2','The organization being inspected/assessed only permits the use of shared/group accounts that meet the conditions for establishing shared/group accounts defined in AC-2 (9), CCI 2140.','The organization conducting the inspection/assessment examines the shared/group accounts to ensure the organization being inspected/assessed only permits the use of shared/group accounts that meet the conditions for establishing shared/group accounts defined in AC-2 (9), CCI 2140.'),\n('002142','draft','2013-06-24','DISA FSO','technical','The information system terminates shared/group account credentials when members leave the group.','AC-2(10).1','The organization being inspected/assessed configures the information system to terminate shared/group account credentials when members leave the group.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2142.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to terminate shared/group account credentials when members leave the group.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2142.'),\n('002143','draft','2013-06-24','DISA FSO','policy','The organization defines the circumstances and/or usage conditions that are to be enforced for organization-defined information system accounts.','AC-2(11).1','The organization being inspected/assessed defines and documents the circumstances and/or usage conditions that are to be enforced for organization-defined information system accounts.  DoD has determined the circumstances and/or usage conditions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented circumstances and/or usage conditions to ensure they have been defined.  DoD has determined the circumstances and/or usage conditions are not appropriate to define at the Enterprise level.'),\n('002144','draft','2013-06-24','DISA FSO ','policy','The organization defines the information system accounts that are to be subject to the enforcement of organization-defined circumstances and/or usage conditions.','AC-2(11).2','The organization being inspected/assessed defines and documents the  information system accounts that are to be subject to the enforcement of organization-defined circumstances and/or usage conditions.  DoD has determined the information system accounts are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system accounts to ensure they have been defined.  DoD has determined the information system accounts are not appropriate to define at the Enterprise level.'),\n('002145','draft','2013-06-24','DISA FSO','technical','The information system enforces organization-defined circumstances and/or usage conditions for organization-defined information system accounts.','AC-2(11).3','The organization being inspected/assessed configures the information system to enforce the circumstances and/or usage conditions defined in AC-2 (11), CCI 2143 for information system accounts defined in AC-2 (11), CCI 2144.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2145.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce the circumstances and/or usage conditions defined in AC-2 (11), CCI 2143 for information system accounts defined in AC-2 (11), CCI 2144.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2145.'),\n('002146','draft','2013-06-24','DISA FSO','policy','The organization defines atypical usage for which the information system accounts are to be monitored.','AC-2(12).1','The organization being inspected/assessed defines and documents atypical usage for which the information system accounts are to be monitored.  DoD has determined atypical usage is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented atypical usage to ensure it has been defined.  DoD has determined atypical usage is not appropriate to define at the Enterprise level.'),\n('002147','draft','2013-06-24','DISA FSO','policy','The organization monitors information system accounts for organization-defined atypical use.','AC-2(12).2','The organization being inspected/assessed monitors information system accounts for atypical use defined in AC-2 (12), CCI 2146.  The organization must maintain an audit trail of monitoring.','The organization conducting the inspection/assessment obtains and examines the audit trail of monitoring to ensure the organization being inspected/assessed monitors information system accounts for atypical use defined in AC-2 (12), CCI 2146.'),\n('002148','draft','2013-06-24','DISA FSO','policy','The organization defines the personnel or roles to whom atypical usage of information system accounts are to be reported.','AC-2(12).3','DoD has defined the personnel or roles as at a minimum, the ISSO.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\nDoD has defined the personnel or roles as at a minimum, the ISSO.'),\n('002149','draft','2013-06-24','DISA FSO','policy','The organization reports atypical usage of information system accounts to organization-defined personnel or roles.','AC-2(12).4','The organization being inspected/assessed documents and implements a process to report atypical usage defined in AC-2 (12), CCI 2146 of information system accounts to at a minimum, the ISSO.\\nThe organization must maintain an audit trail of reporting.\\nDoD has defined the personnel or roles as at a minimum, the ISSO.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of reporting to ensure the organization being inspected/assessed reports atypical usage defined in AC-2 (12), CCI 2146 of information system accounts to at a minimum, the ISSO.\\nDoD has defined the personnel or roles as at a minimum, the ISSO.'),\n('002150','draft','2013-06-24','DISA FSO','policy','The organization defines the time period within which the accounts of users posing a significant risk are to be disabled after discovery of the risk.','AC-2(13).1','DoD has defined the time period as 30 minutes unless otherwise defined in formal organizational policy.  ','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 30 minutes unless otherwise defined in formal organizational policy.  '),\n('002151','draft','2013-06-24','DISA FSO','policy','The organization disables accounts of users posing a significant risk within an organization-defined time period of discovery of the risk.','AC-2(13).2','The organization being inspected/assessed documents and implements a process to disable accounts of users posing a significant risk within 30 minutes unless otherwise defined in formal organizational policy.   DoD has defined the time period as 30 minutes unless otherwise defined in formal organizational policy.  ','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed disables accounts of users posing a significant risk within 30 minutes unless otherwise defined in formal organizational policy.  DoD has defined the time period as 30 minutes unless otherwise defined in formal organizational policy.  '),\n('002152','draft','2013-06-24','DISA FSO','policy','The organization defines other actions necessary for which dual authorization is to be enforced.','AC-3(2).3','The organization being inspected/assessed defines and documents the other actions necessary for which dual authorization is to be enforced.  DoD has determined the other actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented actions to ensure they have been defined.   DoD has determined the other actions are not appropriate to define at the Enterprise level.'),\n('002153','draft','2013-06-24','DISA FSO','policy','The organization defines the mandatory access control policies that are to be enforced over all subjects and objects.','AC-3(3).1','The organization being inspected/assessed defines and documents  the mandatory access control policies that are to be enforced over all subjects and objects.  DoD has determined the mandatory access control policies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented mandatory access control policies to ensure they have been defined.  DoD has determined the mandatory access control policies are not appropriate to define at the Enterprise level.'),\n('002154','draft','2013-06-24','DISA FSO','policy','The mandatory access control policy specifies that the policy is uniformly enforced across all subjects and objects within the boundary of the information system.','AC-3(3).2','The organization being inspected/assessed configures the information system to uniformly enforce the mandatory access control policies defined in AC-3 (3), CCI 2153 across all subjects and objects within the boundary of the information system   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2154.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to uniformly enforce the mandatory access control policies defined in AC-3 (3), CCI 2153 across all subjects and objects within the boundary of the information system   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2154.'),\n('002155','draft','2013-06-24','DISA FSO','policy','The mandatory access control policy specifies that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects.','AC-3(3).3','The organization being inspected/assessed configures the information system to enforce the mandatory access control policies defined in AC-3 (3), CCI 2153 which specifies that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects.   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2155.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce the mandatory access control policies defined in AC-3 (3), CCI 2153 which specifies that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2155.'),\n('002156','draft','2013-06-24','DISA FSO','policy','The mandatory access control policy specifies that a subject that has been granted access to information is constrained from granting its privileges to other subjects.','AC-3(3).4','The organization being inspected/assessed configures the information system to enforce the mandatory access control policies defined in AC-3 (3), CCI 2153 which specifies that a subject that has been granted access to information is constrained from granting its privileges to other subjects.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2156.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce the mandatory access control policies defined in AC-3 (3), CCI 2153  which specifies that a subject that has been granted access to information is constrained from granting its privileges to other subjects.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2156.'),\n('002157','draft','2013-06-24','DISA FSO','policy','The mandatory access control policy specifies that a subject that has been granted access to information is constrained from changing one or more security attributes on subjects, objects, the information system, or information system components.','AC-3(3).5','The organization being inspected/assessed configures the information system to enforce the mandatory access control policies defined in AC-3 (3), CCI 2153  which specifies that a subject that has been granted access to information is constrained from changing one or more security attributes on subjects, objects, the information system, or information system components.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2157.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce the mandatory access control policies defined in AC-3 (3), CCI 2153 which specifies that a subject that has been granted access to information is constrained from changing one or more security attributes on subjects, objects, the information system, or information system components.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2157.'),\n('002158','draft','2013-06-24','DISA FSO','policy','The mandatory access control policy specifies that a subject that has been granted access to information is constrained from choosing the security attributes to be associated with newly created or modified objects.','AC-3(3).6','The organization being inspected/assessed configures the information system to enforce the mandatory access control policies defined in AC-3 (3), CCI 2153  which specifies that a subject that has been granted access to information is constrained from choosing the security attributes to be associated with newly created or modified objects.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2158.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce the mandatory access control policies defined in AC-3 (3), CCI 2153  which specifies that a subject that has been granted access to information is constrained from choosing the security attributes to be associated with newly created or modified objects.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2158.'),\n('002159','draft','2013-06-24','DISA FSO ','policy','The mandatory access control policy specifies that a subject that has been granted access to information is constrained from choosing the attribute values to be associated with newly created or modified objects.','AC-3(3).7','The organization being inspected/assessed configures the information system to enforce the mandatory access control policies defined in AC-3 (3), CCI 2153 which specifies that a subject that has been granted access to information is constrained from choosing the attribute values to be associated with newly created or modified objects.   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2159.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce the mandatory access control policies defined in AC-3 (3), CCI 2153 which specifies that a subject that has been granted access to information is constrained from choosing the attribute values to be associated with newly created or modified objects.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2159.'),\n('002160','draft','2013-06-24','DISA FSO','policy','The mandatory access control policy specifies that a subject that has been granted access to information is constrained from changing the rules governing access control.','AC-3(3).8','The organization being inspected/assessed configures the information system to enforce the mandatory access control policies defined in AC-3 (3), CCI 2153  which specifies that a subject that has been granted access to information is constrained from changing the rules governing access control.   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2160.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce the mandatory access control policies defined in AC-3 (3), CCI 2153  which specifies that a subject that has been granted access to information is constrained from changing the rules governing access control.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2160.'),\n('002161','draft','2013-06-24','DISA FSO','policy','The organization defines subjects which may explicitly be granted organization-defined privileges such that they are not limited by some or all of the mandatory access control constraints.','AC-3(3).9','The organization being inspected/assessed defines and documents subjects which may explicitly be granted organization-defined privileges such that they are not limited by some or all of the mandatory access control constraints.  DoD has determined that the subjects are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented subjects to ensure they have been defined.  DoD has determined that the subjects are not appropriate to define at the Enterprise level.'),\n('002162','draft','2013-06-24','DISA FSO','policy','The organization defines the privileges that may explicitly be granted to organization-defined subjects such that they are not limited by some or all of the mandatory access control constraints.','AC-3(3).10','The organization being inspected/assessed defines and documents the  privileges that may explicitly be granted to organization-defined subjects such that they are not limited by some or all of the mandatory access control constraints.  DoD has determined the privileges are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented privileges to ensure they have been defined.  DoD has determined the privileges are not appropriate to define at the Enterprise level.'),\n('002163','draft','2013-06-24','DISA FSO','policy','The organization defines the discretionary access control policies the information system is to enforce over subjects and objects.','AC-3(4).1','The organization being inspected/assessed defines and documents the discretionary access control policies the information system is to enforce over subjects and objects.  DoD has determined that the discretionary access control policies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented access control policies to ensure they have been defined.  DoD has determined that the discretionary access control policies are not appropriate to define at the Enterprise level.'),\n('002164','draft','2013-06-24','DISA FSO','policy','The organization specifies in the discretionary access control policies that a subject that has been granted access to information can do one or more of the following: pass the information to any other subjects or objects; grant its privileges to other subjects; change security attributes on subjects, objects, the information system, or the information system^s components; choose the security attributes to be associated with newly created or revised objects; and/or change the rules governing access control.','AC-3(4).2','The organization being inspected/assessed documents the discretionary access control policies that a subject which has been granted access to information can do one or more of the following: pass the information to any other subjects or objects; grant its privileges to other subjects; change security attributes on subjects, objects, the information system, or the information systems components; choose the security attributes to be associated with newly created or revised objects; and/or change the rules governing access control.','The organization conducting the inspection/assessment obtains and examines the documented discretionary access control policies to ensure the organization being inspected/assessed specifies that a subject which has been granted access to information can do one or more of the following: pass the information to any other subjects or objects; grant its privileges to other subjects; change security attributes on subjects, objects, the information system, or the information systems components; choose the security attributes to be associated with newly created or revised objects; and/or change the rules governing access control.'),\n('002165','draft','2013-06-24','DISA FSO','technical','The information system enforces organization-defined discretionary access control policies over defined subjects and objects.','AC-3(4).3','The organization being inspected/assessed configures the information system to  enforce the discretionary access control policies defined in AC-3 (4), CCI 2163 over defined subjects and objects.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2165.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce the discretionary access control policies defined in AC-3 (4), CCI 2163 over defined subjects and objects.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2165.'),\n('002166','draft','2013-06-24','DISA FSO','policy','The organization defines the role-based access control policies the information system is to enforce over all subjects and objects.','AC-3(7).1','The organization being inspected/assessed defines and documents the role-based access control policies the information system is to enforce over all subjects and objects.','The organization conducting the inspection/assessment obtains and examines the documented role-based access control policies to ensure the organization being inspected/assessed defines the role-based access control policies the information system is to enforce over all subjects and objects.'),\n('002167','draft','2013-06-24','DISA FSO ','policy','The organization defines the subjects over which the information system will enforce a role-based access control policy.','AC-3(7).2','The organization being inspected/assessed defines and documents the subjects over which the information system will enforce a role-based access control policy.','The organization conducting the inspection/assessment obtains and examines the documented subjects to ensure the organization being inspected/assessed defines the subjects over which the information system will enforce a role-based access control policy.'),\n('002168','draft','2013-06-24','DISA FSO','policy','The organization defines the objects over which the information system will enforce a role-based access control policy.','AC-3(7).3','The organization being inspected/assessed defines and documents the objects over which the information system will enforce a role-based access control policy.','The organization conducting the inspection/assessment obtains and examines the documented objects to ensure the organization being inspected/assessed defines the objects over which the information system will enforce a role-based access control policy.'),\n('002169','draft','2013-06-24','DISA FSO','technical','The information system enforces a role-based access control policy over defined subjects and objects.','AC-3(7).4','The organization being inspected/assessed configures the information system to enforce a roles-based access control policy over defined subjects and objects.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2169.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  enforce a roles-based access control policy over defined subjects and objects.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2169.'),\n('002170','draft','2013-06-24','DISA FSO','policy','The information system controls access based upon organization-defined roles and users authorized to assume such roles.','AC-3(7).5','The organization being inspected/assessed configures the information system to control access based upon the roles and users defined in AC-3 (7), CCIs 2173 and 2174 authorized to assume such roles.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2170.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  control access based upon the roles and users defined in AC-3 (7), CCIs 2173 and 2174 authorized to assume such roles.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2170.'),\n('002171','deprecated','2013-06-24','DISA FSO','technical','The information system enforces a role-based access control policy over organization-defined subjects.',NULL,NULL,NULL),\n('002172','deprecated','2013-06-24','DISA FSO ','technical','The information system enforces a role-based access control policy over organization-defined objects.',NULL,NULL,NULL),\n('002173','draft','2013-06-24','DISA FSO','policy','The organization defines the roles for which the information system will control access based upon the organization-defined role-based access control policy.','AC-3(7).6','The organization being inspected/assessed defines and documents the  roles the information system will control access based upon the organization-defined role-based access control policy.  DoD has determined the roles are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented roles to ensure the organization being inspected/assessed defines  the  roles the information system will control access based upon the organization-defined role-based access control policy.   DoD has determined the roles are not appropriate to define at the Enterprise level.'),\n('002174','draft','2013-06-24','DISA FSO','policy','The organization defines the users for which the information system will control access based upon the organization-defined role-based access control policy.','AC-3(7).7','The organization being inspected/assessed defines and documents the users the information system will control access based upon the organization-defined role-based access control policy.  DoD has determined the users are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented roles to ensure the organization being inspected/assessed defines  the users the information system will control access based upon the organization-defined role-based access control policy.  DoD has determined the users are not appropriate to define at the Enterprise level.'),\n('002175','deprecated','2013-06-24','DISA FSO','technical','The information system controls access based upon organization-defined roles authorized to assume such roles, employing the organization-defined role-based access control policy.',NULL,NULL,NULL),\n('002176','deprecated','2013-06-24','DISA FSO','technical','The information system controls access based upon organization-defined users authorized to assume such roles, employing the organization-defined role-based access control policy.',NULL,NULL,NULL),\n('002177','draft','2013-06-24','DISA FSO','policy','The organization defines the rules which will govern the timing of revocation of access authorizations.','AC-3(8).1','The organization being inspected/assessed defines and documents the rules which will govern the timing of revocation of access authorizations.  DoD has determined the rules are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented rules to ensure the organization being inspected/assessed defines the rules which will govern the timing of revocation of access authorizations.   DoD has determined the rules are not appropriate to define at the Enterprise level.'),\n('002178','draft','2013-06-24','DISA FSO','technical','The information system enforces the revocation of access authorizations resulting from changes to the security attributes of subjects based on organization-defined rules governing the timing of revocations of access authorizations.','AC-3(8).2','The organization being inspected/assessed configures the information system to enforce the revocation of access authorizations resulting from changes to the security attributes of subjects based on the rules defined in AC-3 (8), CCI 2177 governing the timing of revocations of access authorizations.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2178.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce the revocation of access authorizations resulting from changes to the security attributes of subjects based on the rules defined in AC-3 (8), CCI 2177 governing the timing of revocations of access authorizations.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2178.'),\n('002179','draft','2013-06-24','DISA FSO','technical','The information system enforces the revocation of access authorizations resulting from changes to the security attributes of objects based on organization-defined rules governing the timing of revocations of access authorizations.','AC-3(8).3','The organization being inspected/assessed configures the information system to enforce the revocation of access authorizations resulting from changes to the security attributes of objects based on the rules defined in AC-3 (8), CCI 2177 governing the timing of revocations of access authorizations.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2179.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce the revocation of access authorizations resulting from changes to the security attributes of objects based on the rules defined in AC-3 (8), CCI 2177 governing the timing of revocations of access authorizations.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2179.'),\n('002180','draft','2013-06-24','DISA FSO','policy','The organization defines the security safeguards the organization-defined information system or system component is to provide to protect information released outside the established system boundary.','AC-3(9).1','The organization being inspected/assessed defines and documents the security safeguards the organization-defined information system or system component is to provide to protect  information released outside the established system boundary.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines the security safeguards the organization-defined information system or system component is to provide to protect  information released outside the established system boundary.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002181','draft','2013-06-24','DISA FSO','policy','The organization defines information systems or system components that are to provide organization-defined security safeguards to protect information received outside the established system boundary.','AC-3(9).2','The organization being inspected/assessed defines and documents the  information systems or system components that are to provide organization-defined security safeguards to protect information received outside the established system boundary.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information systems or system components to ensure the organization being inspected/assessed  defines the information systems or system components that are to provide organization-defined security safeguards to protect information received outside the established system boundary.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002182','draft','2013-06-24','DISA FSO','policy','The information system does not release information outside of the established system boundary unless the receiving organization-defined information system or system component provides organization-defined security safeguards.','AC-3(9).3','The organization being inspected/assessed configures the information system to not release information outside of the established system boundary unless the receiving  information system or system component defined in AC-3 (9), CCI 2181 provides security safeguards defined in AC-3 (9), CCI 2180.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2182.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  not release information outside of the established system boundary unless the receiving information system or system component defined in AC-3 (9), CCI 2181 provides security safeguards defined in AC-3 (9), CCI 2180.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2182.'),\n('002183','draft','2013-06-24','DISA FSO ','policy','The organization defines the security safeguards to be used to validate the appropriateness of the information designated for release.','AC-3(9).4','The organization being inspected/assessed defines and documents the security safeguards to be used to validate the appropriateness of the information designated for release.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines the security safeguards to be used to validate the appropriateness of the information designated for release.   DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002184','draft','2013-06-24','DISA FSO','policy','The information system does not release information outside of the established system boundary unless organization-defined security safeguards are used to validate the appropriateness of the information designated for release.','AC-3(9).5','The organization being inspected/assessed configures the information system to not release information outside of the established system boundary unless security safeguards defined in AC-3 (9), CCI 2183 are used to validate the appropriateness of the information designated for release.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2184.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to not release information outside of the established system boundary unless security safeguards defined in AC-3 (9), CCI 2183 are used to validate the appropriateness of the information designated for release.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2184.'),\n('002185','draft','2013-06-24','DISA FSO','policy','The organization defines the conditions on which it will employ an audited override of automated access control mechanisms.','AC-3(10).1','The organization being inspected/assessed defines and documents the conditions in which it will employ an audited override of automated access control mechanisms.  DoD has determined the conditions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented conditions to ensure the organization being inspected/assessed defines the conditions in which it will employ an audited override of automated access control mechanisms.  DoD has determined the conditions are not appropriate to define at the Enterprise level.'),\n('002186','draft','2013-06-24','DISA FSO','technical','The organization employs an audited override of automated access control mechanisms under organization-defined conditions.','AC-3(10).2','The organization being inspected/assessed configures the information system to employ an audited override of automated access control mechanisms under conditions defined in AC-3 (10), CCI 2185.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2186.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to employ an audited override of automated access control mechanisms under conditions defined in AC-3 (10), CCI 2185.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2186.'),\n('002187','draft','2013-06-24','DISA FSO','policy','The organization defines the security attributes to be used to enforce organization-defined information flow control policies.','AC-4(1).1','The organization being inspected/assessed defines and documents the security attributes to be used to enforce organization-defined information flow control policies.  DoD has determined the security attributes are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security attributes to ensure the organization being inspected/assessed defines the security attributes to be used to enforce organization-defined information flow control policies.  DoD has determined the security attributes are not appropriate to define at the Enterprise level.'),\n('002188','draft','2013-06-24','DISA FSO','policy','The organization defines the information, source, and destination objects with which the organization-defined security attributes are to be associated.','AC-4(1).2','The organization being inspected/assessed defines and documents the information, source and destination objects with which the organization-defined security attributes are to be associated.  DoD has determined the information, source and destination objects are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information, source, and destination objects to ensure the organization being inspected/assessed defines the information, source and destination objects with which the organization-defined security attributes are to be associated.  DoD has determined the information, source and destination objects are not appropriate to define at the Enterprise level.'),\n('002189','draft','2013-06-24','DISA FSO','policy','The organization defines the information flow control policies to be enforced for flow control decisions.','AC-4(1).3','The organization being inspected/assessed defines and documents the information flow control policies to be enforced for flow control decisions.  DoD has determined the information flow control policies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information flow control policies to ensure the organization being inspected/assessed defines the information flow control policies to be enforced for flow control decisions.   DoD has determined the information flow control policies are not appropriate to define at the Enterprise level.'),\n('002190','draft','2013-06-24','DISA FSO','technical','The information system uses organization-defined security attributes associated with organization-defined information, source, and destination objects to enforce organization-defined information flow control policies as a basis for flow control decisions.','AC-4(1).4','The organization being inspected/assessed configures the information system to use the  security attributes defined in AC-4 (1), CCI  287 associated with the information, source, and destination objects defined in AC-4 (1), CCI 2188  to enforce information flow control policies defined in AC-4 (1), CCI 2189 as a basis for flow control decisions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2190.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to use the  security attributes defined in AC-4 (1), CCI  287 associated with the information, source, and destination objects defined in AC-4 (1), CCI 2188  to enforce information flow control policies defined in AC-4 (1), CCI 2189 as a basis for flow control decisions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2190.'),\n('002191','draft','2013-06-24','DISA FSO','policy','The organization defines the information flow control policies to be enforced by the information system using protected processing domains.','AC-4(2).2','The organization being inspected/assessed defines and documents the information flow control policies to be enforced by the information system using protected processing domains.  DoD has determined the information flow control policies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the information flow control policies to ensure the organization being inspected/assessed  defines the information flow control policies to be enforced by the information system using protected processing domains.   DoD has determined the information flow control policies are not appropriate to define at the Enterprise level.'),\n('002192','draft','2013-06-24','DISA FSO','policy','The organization defines the policies the information system is to enforce to achieve dynamic information flow control.','AC-4(3).2','The organization being inspected/assessed defines and documents  the policies the information system is to enforce to achieve dynamic information flow control.  The policies shall address dynamic reconfiguration of data flow based upon predefined rules.  DoD has determined the policies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented policies to ensure the organization being inspected/assessed defines the policies the information system is to enforce to achieve dynamic information flow control.   DoD has determined the policies are not appropriate to define at the Enterprise level'),\n('002193','draft','2013-06-24','DISA FSO','policy','The organization defines procedures or methods to be employed by the information system to prevent encrypted information from bypassing content-checking mechanisms, such as decrypting the information, blocking the flow of the encrypted information, and/or terminating communications sessions attempting to pass encrypted information.','AC-4(4).2','The organization being inspected/assessed selects or defines, and documents the mechanism to prevent encrypted information from bypassing content-checking mechanisms, such as decrypting the information, blocking the flow of the encrypted information, and/or terminating communications sessions attempting to pass encrypted information.  Alternatively, the organization may define their own procedure or method.  DoD has determined the procedures or methods are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented mechanism to ensure the organization being inspected/assessed selects or defines the mechanism to prevent encrypted information from bypassing content-checking mechanisms.  DoD has determined the procedures or methods are not appropriate to define at the Enterprise level.'),\n('002194','draft','2013-06-24','DISA FSO','policy','The organization defines the metadata the information system uses to enforce information flow control.','AC-4(6).2','The organization being inspected/assessed defines and documents  the metadata the information system uses to enforce information flow control.  DoD has determined the metadata is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented metadata to ensure the organization being inspected/assessed defines the metadata the information system uses to enforce information flow control.  DoD has determined the metadata is not appropriate to define at the Enterprise level.'),\n('002195','draft','2013-06-24','DISA FSO','policy','The organization defines the information flows against which the organization-defined security policy filters are to be enforced.','AC-4(8).3','DoD has defined the information flows as all information flows.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information flows as all information flows.'),\n('002196','draft','2013-06-24','DISA FSO','policy','The organization defines the information flows for which the information system will enforce the use of human reviews under organization-defined conditions.','AC-4(9).1','The organization being inspected/assessed defines and documents the information flows  for which the information system will enforce the use of human reviews under organization-defined conditions.   DoD has determined the information flows are not appropriate to define at the Enterprise level','The organization conducting the inspection/assessment obtains and examines the documented information flows to ensure the organization being inspected/assessed defines the information flows  for which the information system will enforce the use of human reviews under organization-defined conditions.   DoD has determined the information flows are not appropriate to define at the Enterprise level.'),\n('002197','draft','2013-06-24','DISA FSO','policy','The organization defines the conditions which will require the use of human reviews of organization-defined information flows.','AC-4(9).2','The organization being inspected/assessed defines and documents the conditions which will require the use of human reviews of organization-defined information flows.   DoD has determined the conditions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented conditions to ensure the organization being inspected/assessed defines the conditions which will require the use of human reviews of organization-defined information flows.   DoD has determined the conditions are not appropriate to define at the Enterprise level.'),\n('002198','draft','2013-06-24','DISA FSO','technical','The information system enforces the use of human reviews for organization-defined information flows under organization-defined conditions.','AC-4(9).3','The organization being inspected/assessed configures the information system to enforce the use of human reviews for information flows defined in AC-4 (9), CCI 2196 under conditions defined in AC-4 (9), CCI 2197.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2198.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce the use of human reviews for information flows defined in AC-4 (9), CCI 2196 under conditions defined in AC-4 (9), CCI 2197.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2198.'),\n('002199','draft','2013-06-24','DISA FSO','policy','The organization defines the conditions under which the information system provides the capability for privileged administrators to enable/disable organization-defined security policy filters.','AC-4(10).3','The organization being inspected/assessed defines and documents the conditions under which the information system provides the capability for privileged administrators to enable/disable organization-defined security policy filters.   DoD has determined the conditions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented conditions to ensure the organization being inspected/assessed defines the conditions under which the information system provides the capability for privileged administrators to enable/disable organization-defined security policy filters.   DoD has determined the conditions are not appropriate to define at the Enterprise level.'),\n('002200','draft','2013-06-24','DISA FSO','policy','The organization defines the data type identifiers to be used to validate data being transferred between different security domains.','AC-4(12).1','The organization being inspected/assessed defines and documents the data type identifiers to be used to validate data being transferred between different security domains.  DoD has determined the data type identifiers are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented data type identifiers to ensure the organization being inspected/assessed defines  the data type identifiers to be used to validate data being transferred between different security domains.  DoD has determined the data type identifiers are not appropriate to define at the Enterprise level.'),\n('002201','draft','2013-06-24','DISA FSO','technical','The information system, when transferring information between different security domains, uses organization-defined data type identifiers to validate data essential for information flow decisions.','AC-4(12).2','The organization being inspected/assessed configures the information system to use data type identifiers defined in AC-4 (12), CCI 2200 to validate data essential for information flow decisions when transferring information between different security domains.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2201.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to use data type identifiers defined in AC-4 (12), CCI 2200 to validate data essential for information flow decisions when transferring information between different security domains.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2201.'),\n('002202','draft','2013-06-24','DISA FSO','policy','The organization defines the policy-relevant subcomponents into which information being transferred between different security domains is to be decomposed for submission to policy enforcement mechanisms.','AC-4(13).2','The organization being inspected/assessed defines and documents the policy relevant subcomponents into which information being transferred between different security domains is to be decomposed into for submission to policy enforcement mechanisms.  DoD has determined the policy-relevant subcomponents are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented policy-relevant subcomponents to ensure the organization being inspected/assessed defines the policy relevant subcomponents into which information being transferred between different security domains is to be decomposed into for submission to policy enforcement mechanisms.  DoD has determined the policy-relevant subcomponents are not appropriate to define at the Enterprise level.'),\n('002203','draft','2013-06-24','DISA FSO ','policy','The organization defines the unsanctioned information the information system is to examine when transferring information between different security domains.','AC-4(15).3','The organization being inspected/assessed defines and documents the unsanctioned information for which the information system is to examine when transferring information between different security domains.  DoD has determined the unsanctioned information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented unsanctioned information to ensure the organization being inspected/assessed defines the unsanctioned information for which the information system is to examine when transferring information between different security domains.  DoD has determined the unsanctioned information is not appropriate to define at the Enterprise level.'),\n('002204','draft','2013-06-24','DISA FSO ','policy','The organization defines a security policy which prohibits the transfer of unsanctioned information between different security domains.','AC-4(15).4','The organization being inspected/assessed defines and documents  security policy which prohibits the transfer of unsanctioned information between different security domains.  DoD has determined the security policy is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security policy to ensure the organization being inspected/assessed defines security policy which prohibits the transfer of unsanctioned information between different security domains.  DoD has determined the security policy is not appropriate to define at the Enterprise level.'),\n('002205','draft','2013-06-24','DISA FSO ','technical','The information system uniquely identifies and authenticates source by organization, system, application, and/or individual for information transfer.','AC-4(17).1','The organization being inspected/assessed configures the information system to uniquely identify and authenticate source by organization, system, application, and/or individual for information transfer.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2205.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to uniquely identify and authenticate source by organization, system, application, and/or individual for information transfer.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2205.'),\n('002206','deprecated','2013-06-24','DISA FSO ','technical','The information system uniquely authenticates source by organization, system, application, and/or individual for information transfer.',NULL,NULL,NULL),\n('002207','draft','2013-06-24','DISA FSO ','technical','The information system uniquely identifies and authenticates destination by organization, system, application, and/or individual for information transfer.','AC-4(17).2','The organization being inspected/assessed configures the information system to uniquely and authenticate identify destination by organization, system, application, and/or individual for information transfer.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2207.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to uniquely identify and authenticate destination by organization, system, application, and/or individual for information transfer.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2207.'),\n('002208','deprecated','2013-06-24','DISA FSO ','technical','The information system uniquely authenticates destination by organization, system, application, and/or individual for information transfer.',NULL,NULL,NULL),\n('002209','draft','2013-06-24','DISA FSO ','policy','The organization defines the techniques to be used to bind security attributes to information.','AC-4(18).1','The organization being inspected/assessed defines and documents the techniques to be used to bind security attributes to information.  DoD has determined the techniques are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented techniques to ensure the organization being inspected/assessed defines the techniques to be used to bind security attributes to information.  DoD has determined the techniques are not appropriate to define at the Enterprise level'),\n('002210','draft','2013-06-24','DISA FSO ','technical','The information system binds security attributes to information using organization-defined binding techniques to facilitate information flow policy enforcement.','AC-4(18).2','The organization being inspected/assessed configures the information system to bind security attributes to information using  binding techniques defined in AC-4 (18), CCI 2209 to facilitate information flow policy enforcement.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2210.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  bind security attributes to information using  binding techniques defined in AC-4 (18), CCI 2209 to facilitate information flow policy enforcement.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2210.'),\n('002211','draft','2013-06-24','DISA FSO ','technical','The information system, when transferring information between different security domains, applies the same security policy filtering to metadata as it applies to data payloads.','AC-4(19).1','The organization being inspected/assessed configures the information system to apply the same security policy filtering to metadata as it applies to data payloads when transferring information between different security domains.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2211.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to apply the same security policy filtering to metadata as it applies to data payloads when transferring information between different security domains.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2211.'),\n('002212','draft','2013-06-24','DISA FSO ','policy','The organization defines the solutions in approved configurations to be employed to control the flow of organization-defined information across security domains.','AC-4(20).1','The organization being inspected/assessed defines and documents the solutions in approved configurations to be employed to control the flow of information defined in AC-4 (20), CCI 2213 across security domains.   DoD has determined the solutions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented solutions to ensure the organization being inspected/assessed defines the solutions in approved configurations to be employed to control the flow of information defined in AC-4 (20), CCI 2213 across security domains.  DoD has determined the solutions are not appropriate to define at the Enterprise level.'),\n('002213','draft','2013-06-24','DISA FSO','policy','The organization defines the information to be subjected to flow control across security domains.','AC-4(20).2','The organization being inspected/assessed defines and documents the information to be subjected to flow control across security domains.   DoD has determined the information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information to ensure the organization being inspected/assessed defines  the information to be subjected to flow control across security domains.  DoD has determined the information is not appropriate to define at the Enterprise level.'),\n('002214','draft','2013-06-24','DISA FSO ','policy','The organization employs organization-defined solutions in approved configurations to control the flow of organization-defined information across security domains.','AC-4(20).3','The organization being inspected/assessed documents and implements solutions defined in AC-4 (20), CCI 2212 in approved configurations to control the flow of  information defined in AC-4 (20), CCI 2213 across security domains.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed employs solutions defined in AC-4 (20), CCI 2212 in approved configurations to control the flow of  information defined in AC-4 (20), CCI 2213 across security domains.'),\n('002215','draft','2013-06-24','DISA FSO','policy','The organization defines the mechanisms and/or techniques to be used to logically or physically separate information flows.','AC-4(21).1','The organization being inspected/assessed defines and documents the mechanisms and/or techniques to be used to logically or physically separate information flows.  DoD has determined the mechanisms are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented mechanisms to ensure the organization being inspected/assessed defines the mechanisms and/or techniques to be used to logically or physically separate information flows.  DoD has determined the mechanisms are not appropriate to define at the Enterprise level.'),\n('002216','draft','2013-06-24','DISA FSO','policy','The organization defines the types of information required to accomplish logical or physical separation of information flows.','AC-4(21).2','The organization being inspected/assessed defines and documents the types of information required to accomplish logical or physical separation of information flows.  DoD has determined the types of information are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented types of information to ensure the organization being inspected/assessed defines the types of information required to accomplish logical or physical separation of information flows.  DoD has determined the types of information are not appropriate to define at the Enterprise level.'),\n('002217','draft','2013-06-24','DISA FSO','policy','The information system separates information flows logically or physically using organization-defined mechanisms and/or techniques to accomplish organization-defined required separations by types of information.','AC-4(21).3','The organization being inspected/assessed configures the information system to separate information flows logically or physically using mechanisms and/or techniques defined in AC-4 (21), CCI 2215 to accomplish required separations by types of information defined in AC-4 (21), CCI 2216.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2217.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to separate information flows logically or physically using mechanisms and/or techniques defined in AC-4 (21), CCI 2215 to accomplish required separations by types of information defined in AC-4 (21), CCI 2216.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2217.'),\n('002218','draft','2013-06-24','DISA FSO','technical','The information system provides access from a single device to computing platforms, applications, or data residing on multiple different security domains, while preventing any information flow between the different security domains.','AC-4(22).1','The organization being inspected/assessed configures the information system to provide access from a single device to computing platforms, applications, or data residing on multiple different security domains, while preventing any information flow between the different security domains.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2218.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  provide access from a single device to computing platforms, applications, or data residing on multiple different security domains, while preventing any information flow between the different security domains.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2218.'),\n('002219','draft','2013-06-24','DISA FSO','policy','The organization defines the duties of individuals that are to be separated.','AC-5.2','The organization being inspected/assessed defines and documents the duties of individuals that are to be separated.  DoD has determined the duties are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented duties to ensure the organization being inspected/assessed  defines the duties of individuals that are to be separated.  DoD has determined the duties are not appropriate to define at the Enterprise level.'),\n('002220','draft','2013-06-24','DISA FSO','policy','The organization defines information system access authorizations to support separation of duties.','AC-5.4','The organization being inspected/assessed defines and documents the information system access authorizations to support separation of duties.','The organization conducting the inspection/assessment obtains and examines the documented  information system access authorizations to ensure the organization being inspected/assessed defines information system access authorizations to support separation of duties.'),\n('002221','draft','2013-06-24','DISA FSO','policy','The organization defines the security-relevant information for which access must be explicitly authorized.','AC-6(1).2','DoD has defined the security-relevant information as all security-relevant information not publicly available.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the security-relevant information as all security-relevant information not publicly available.'),\n('002222','draft','2013-06-24','DISA FSO','policy','The organization explicitly authorizes access to organization-defined security functions.','AC-6(1).3','The organization being inspected/assessed documents and implements a process to explicitly authorize access to all functions not publicly accessible.  Explicit authorization can be in the form of an acceptable use policy signed by the user at the time of access being granted.  DoD has defined the security functions as all functions not publicly accessible.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed explicitly authorizes access to all functions not publicly accessible.  DoD has defined the security functions as all functions not publicly accessible.'),\n('002223','draft','2013-06-24','DISA FSO','policy','The organization explicitly authorizes access to organization-defined security-relevant information.','AC-6(1).4','The organization being inspected/assessed documents and implements a process to explicitly authorize access to  all security-relevant information not publicly available.  Explicit authorization can be in the form of an acceptable use policy signed by the user at the time of access being granted.  DoD has defined the security-relevant information as all security-relevant information not publicly available.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed explicitly authorizes access to  all security-relevant information not publicly available.   DoD has defined the security-relevant information as all security-relevant information not publicly available.'),\n('002224','draft','2013-06-24','DISA FSO','policy','The organization defines the compelling operational needs that must be met in order to be authorized network access to organization-defined privileged commands.','AC-6(3).4','The organization being inspected/assessed defines and documents the compelling operational needs that must be met in order to be authorized network access to organization-defined privileged commands.  DoD has determined the compelling operational needs are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented compelling operational needs to ensure the organization being inspected/assessed defines the  compelling operational needs that must be met in order to be authorized network access to organization-defined privileged commands.  DoD has determined the compelling operational needs are not appropriate to define at the Enterprise level.'),\n('002225','draft','2013-06-24','DISA FSO ','policy','The information system provides separate processing domains to enable finer-grained allocation of user privileges.','AC-6(4).1','The organization being inspected/assessed configures the information system to provide separate processing domains to enable finer-grained allocation of user privileges.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2225.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide separate processing domains to enable finer-grained allocation of user privileges.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2225.'),\n('002226','draft','2013-06-24','DISA FSO','policy','The organization defines the personnel or roles to whom privileged accounts are to be restricted on the information system.','AC-6(5).1','The organization being inspected/assessed defines and documents the personnel or roles to whom privileged accounts are to  be restricted on the information system.  DoD has determined the personnel and roles are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles to whom privileged accounts are to  be restricted on the information system.   DoD has determined the personnel and roles are not appropriate to define at the Enterprise level.'),\n('002227','draft','2013-06-24','DISA FSO','policy','The organization restricts privileged accounts on the information system to organization-defined personnel or roles.','AC-6(5).2','The organization being inspected/assessed implements a process to only provide privileged accounts on the information system to personnel or roles defined in AC-6 (5), CCI 2226.','The organization conducting the inspection/assessment obtains and examines  a sampling of information system access authorizations to ensure the organization being inspected/assessed implements a process to only provide privileged accounts on the information system to personnel or roles defined in AC-6 (5), CCI 2226.'),\n('002228','draft','2013-06-24','DISA FSO','policy','The organization defines the frequency on which it conducts reviews of the privileges assigned to organization-defined roles or classes of users.','AC-6(7).1','DoD has defined the frequency as at a minimum, annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at a minimum, annually.'),\n('002229','draft','2013-06-24','DISA FSO','policy','The organization defines the roles or classes of users that are to have their privileges reviewed on an organization-defined frequency.','AC-6(7).2','DoD has defined the roles or classes of users as all users.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the roles or classes of users as all users.'),\n('002230','draft','2013-06-24','DISA FSO','policy','The organization reviews the privileges assigned to organization-defined roles or classes of users on an organization-defined frequency to validate the need for such privileges.','AC-6(7).3','The organization being inspected/assessed documents and implements a process to review the privileges assigned to all users at a minimum, annually to validate the need for such privileges.  The organization must maintain an audit trail of reviews.  DoD has defined the roles or classes of users as all users.  DoD has defined the frequency as at a minimum, annually.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of reviews to ensure the organization being inspected/assessed reviews the privileges assigned to all users at a minimum, annually. to validate the need for such privileges.  DoD has defined the roles or classes of users as all users.  DoD has defined the frequency as at a minimum, annually.'),\n('002231','draft','2013-06-24','DISA FSO','policy','The organization reassigns or removes privileges, if necessary, to correctly reflect organizational mission/business needs.','AC-19(5).1','The organization being inspected/assessed documents and implements a process for full-device encryption or container encryption to protect the integrity of information on mobile devices defined in AC-19 (5), CCI 2329.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed employs full-device encryption or container encryption to protect the integrity of information on mobile devices defined in AC-19 (5), CCI 2329.'),\n('002232','draft','2013-06-24','DISA FSO','policy','The organization defines software that is restricted from executing at a higher privilege than users executing the software.','AC-6(8).1','DoD has defined the software as any software except software explicitly documented.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the software as any software except software explicitly documented.'),\n('002233','draft','2013-06-24','DISA FSO','technical','The information system prevents organization-defined software from executing at higher privilege levels than users executing the software.','AC-6(8).2','The organization being inspected/assessed configures the information system to any software except software explicitly documented from executing at higher privilege levels than users executing the software.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2233.  DoD has defined the software as any software except software explicitly documented.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to prevent any software except software explicitly documented from executing at higher privilege levels than users executing the software.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2233.  DoD has defined the software as any software except software explicitly documented.'),\n('002234','draft','2013-06-24','DISA FSO','technical','The information system audits the execution of privileged functions.','AC-6(9).1','The organization being inspected/assessed configures the information system to audit the execution of privileged functions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2234.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to audit the execution of privileged functions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2234.'),\n('002235','draft','2013-06-24','DISA FSO','technical','The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.','AC-6(10).1','The organization being inspected/assessed configures the information system to prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2235.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2235.'),\n('002236','draft','2013-06-24','DISA FSO','policy','The organization defines the time period the information system will automatically lock the account or node when the maximum number of unsuccessful logon attempts is exceeded.','AC-7.4','DoD has defined the time period as until released by an administrator.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as until released by an administrator.'),\n('002237','draft','2013-06-24','DISA FSO','policy','The organization defines the delay algorithm to be employed by the information system to delay the next logon prompt when the maximum number of unsuccessful logon attempts is exceeded.','AC-7.5','DoD has defined the delay algorithm as a minimum of 5 seconds.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the delay algorithm as a minimum of 5 seconds.'),\n('002238','draft','2013-06-24','DISA  FSO','technical','The information system automatically locks the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.','AC-7.6','The organization being inspected/assessed configures the information system to automatically lock the account or node until the locked account is released by an administrator and delays the next login prompt for a minimum of 5 seconds when the maximum number of unsuccessful attempts is exceeded.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2238.  DoD has defined the delay algorithm as a minimum of 5 seconds.  DoD has defined the time period as until released by an administrator.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically lock the account or node until the locked account is released by an administrator and delays the next login prompt for a minimum of 5 seconds when the maximum number of unsuccessful attempts is exceeded.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2238.  DoD has defined the delay algorithm as a minimum of 5 seconds.  DoD has defined the time period as until released by an administrator.'),\n('002239','draft','2013-06-24','DISA FSO','policy','The organization defines the mobile devices that are to be purged/wiped by the information system after an organization-defined number of consecutive, unsuccessful device logon attempts.','AC-7(2).1','The organization being inspected/assessed defines and documents the mobile devices that are to be purged/wiped by the information system after an organization-defined number of consecutive, unsuccessful device logon attempts.  Mobile devices may be defined in terms of manufacturer and model name.  DoD has determined the mobile devices are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented mobile devices to ensure the organization being inspected/assessed defines the mobile devices that are to be purged/wiped by the information system after an organization-defined number of consecutive, unsuccessful device logon attempts.   DoD has determined the mobile devices are not appropriate to define at the Enterprise level.'),\n('002240','draft','2013-06-24','DISA FSO','policy','The organization defines the purging/wiping requirements/techniques to be used by the information system on organization-defined mobile devices after an organization-defined number of consecutive, unsuccessful device logon attempts.','AC-7(2).2','DoD has defined the purging/wiping requirements/techniques as requirements and techniques identified in NIST SP 800-88, \\\"Guidelines for Media Sanitization.\\\"','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the purging/wiping requirements/techniques as requirements and techniques identified in NIST SP 800-88, \\\"Guidelines for Media Sanitization.\\\"'),\n('002241','draft','2013-06-24','DISA FSO','policy','The organization defines the number of consecutive, unsuccessful device logon attempts after which the information system will purge/wipe organization-defined mobile devices.','AC-7(2).3','DoD has defined the number as 10.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the number as 10.'),\n('002242','draft','2013-06-24','DISA FSO','technical','The information system purges/wipes information from organization-defined mobile devices based on organization-defined purging/wiping requirements/techniques after an organization-defined number of consecutive, unsuccessful device logon attempts.','AC-7(2).4','The organization being inspected/assessed configures the information system to  purge/wipe information from mobile devices defined in AC-7 (2), CCI 2239 based on requirements and techniques identified in NIST SP 800-88, \\\"Guidelines for Media Sanitization\\\" after 10 consecutive, unsuccessful device logon attempts.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the  STIG/SRG guidance that pertains to CCI 2242.  DoD has defined the number as 10.  DoD has defined the purging/wiping requirements/techniques as requirements and techniques identified in NIST SP 800-88, \\\"Guidelines for Media Sanitization.\\\"','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to purge/wipe information from mobile devices defined in AC-7 (2), CCI 2239 based on requirements and techniques identified in NIST SP 800-88, \\\"Guidelines for Media Sanitization\\\" after 10 consecutive, unsuccessful device logon attempts.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2242.  DoD has defined the number as 10.  DoD has defined the purging/wiping requirements/techniques as requirements and techniques identified in NIST SP 800-88, \\\"Guidelines for Media Sanitization.\\\"'),\n('002243','draft','2013-06-24','DISA FSO','policy','The organization-defined information system use notification message or banner is to state that users are accessing a U.S. Government information system.','AC-8.3','DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems  Standard Consent Banner and User Agreement,\\\" March 2013 meets the DoD requirements the information system use notification message or banner.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DTM 08-060.','DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems  Standard Consent Banner and User Agreement,\\\" March 2013 meets the DoD requirements the information system use notification message or banner.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DTM 08-060.'),\n('002244','draft','2013-06-24','DISA FSO','policy','The organization-defined information system use notification message or banner is to state that information system usage may be monitored, recorded, and subject to audit.','AC-8.4','DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems  Standard Consent Banner and User Agreement,\\\" March 2013 meets the DoD requirements the information system use notification message or banner.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DTM 08-060.','DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems  Standard Consent Banner and User Agreement,\\\" March 2013 meets the DoD requirements the information system use notification message or banner.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DTM 08-060.'),\n('002245','draft','2013-06-24','DISA FSO','policy','The organization-defined information system use notification message or banner is to state that unauthorized use of the information system is prohibited and subject to criminal and civil penalties.','AC-8.5','DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems  Standard Consent Banner and User Agreement,\\\" March 2013 meets the DoD requirements the information system use notification message or banner.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DTM 08-060.','DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems  Standard Consent Banner and User Agreement,\\\" March 2013 meets the DoD requirements the information system use notification message or banner.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DTM 08-060.'),\n('002246','draft','2013-06-24','DISA FSO','policy','The organization-defined information system use notification message or banner is to state that use of the information system indicates consent to monitoring and recording.','AC-8.6','DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems  Standard Consent Banner and User Agreement,\\\" March 2013 meets the DoD requirements the information system use notification message or banner.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DTM 08-060.','DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems  Standard Consent Banner and User Agreement,\\\" March 2013 meets the DoD requirements the information system use notification message or banner.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DTM 08-060.'),\n('002247','draft','2013-06-24','DISA FSO','policy','The organization defines the use notification message or banner the information system displays to users before granting access to the system.','AC-8.2','DoD has defined the use notification message or banner as the content of DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems  Standard Consent Banner and User Agreement,\\\" March 2013.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the use notification message or banner as the content of DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems  Standard Consent Banner and User Agreement,\\\" March 2013.'),\n('002248','draft','2013-06-24','DISA FSO','policy','The organization defines the conditions of use which are to be displayed to users of the information system before granting further access.','AC-8.9','DoD has defined the conditions as the content of DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems  Standard Consent Banner and User Agreement,\\\" March 2013.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the conditions as the content of DTM 08-060, \\\"Policy on Use of Department of Defense (DoD) Information Systems  Standard Consent Banner and User Agreement,\\\" March 2013.'),\n('002249','draft','2013-06-24','DISA FSO','policy','The organization defines the information, in addition to the date and time of the last logon (access), to be included in the notification to the user upon successful logon (access).','AC-9(4).1','The organization being inspected/assessed defines and documents the information, in addition to the date and time of the last logon (access) to be included in the notification to the user upon successful logon (access).  DoD has determined the information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information to ensure the organization being inspected/assessed defines  the information, in addition to the date and time of the last logon (access) to be included in the notification to the user upon successful logon (access).  DoD has determined the information is not appropriate to define at the Enterprise level.'),\n('002250','draft','2013-06-24','DISA FSO','technical','The information system notifies the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).','AC-9(4).2','The organization being inspected/assessed configures the information system to notify the user, upon successful logon (access), of the information defined in AC-9 (4), CCI 2249 to be included in addition to the date and time of the last logon (access).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2250. ','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to notify the user, upon successful logon (access), of the information defined in AC-9 (4), CCI 2249 to be included in addition to the date and time of the last logon (access).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2250.'),\n('002251','deprecated','2013-06-24','DISA FSO','technical','The information system notifies the user, upon successful logon (access), of the date and time of the last logon (access).',NULL,NULL,NULL),\n('002252','draft','2013-06-24','DISA FSO','policy','The organization defines the accounts and/or account types for which the information system will limit the number of concurrent sessions.','AC-10.3','DoD has defined the account types and/or accounts as all account types and/or accounts.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the account types and/or accounts as all account types and/or accounts.'),\n('002253','deprecated','2013-06-24','DISA FSO','policy','The organization defines the account types for which the information system will limit the number of concurrent sessions.',NULL,NULL,NULL),\n('002254','deprecated','2013-06-24','DISA FSO','policy','The organization defines the conditions or trigger events requiring session disconnect to be employed by the information system when automatically terminating a user session.',NULL,NULL,NULL),\n('002255','deprecated','2013-06-24','DISA FSO','policy','The organization defines the user actions that can be performed on the information system without identification and authentication.',NULL,NULL,NULL),\n('002256','draft','2013-06-24','DISA FSO','policy','The organization defines security attributes having organization-defined types of security attribute values which are associated with information in storage.','AC-16.1','The organization being inspected/assessed defines and documents the  security attributes having organization-defined types of security attribute values which are associated with information in storage.   DoD has determined the security attributes are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security attributes to ensure the organization being inspected/assessed defines security attributes having organization-defined types of security attribute values which are associated with information in storage.   DoD has determined the security attributes are not appropriate to define at the Enterprise level.'),\n('002257','draft','2013-06-24','DISA FSO','policy','The organization defines security attributes having organization-defined types of security attribute values which are associated with information in process.','AC-16.2','The organization being inspected/assessed defines and documents the  security attributes having organization-defined types of security attribute values which are associated with information in process.   DoD has determined the security attributes are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security attributes to ensure the organization being inspected/assessed defines security attributes having organization-defined types of security attribute values process.   DoD has determined the security attributes are not appropriate to define at the Enterprise level.'),\n('002258','draft','2013-06-24','DISA FSO','policy','The organization defines security attributes, having organization-defined types of security attribute values, which are associated with information in transmission.','AC-16.3','The organization being inspected/assessed defines and documents the  security attributes having organization-defined types of security attribute values which are associated with information in transmission.   DoD has determined the security attributes are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security attributes to ensure the organization being inspected/assessed defines security attributes having organization-defined types of security attribute values which are associated with information in transmission.   DoD has determined the security attributes are not appropriate to define at the Enterprise level.'),\n('002259','draft','2013-06-24','DISA FSO','policy','The organization defines security attribute values associated with organization-defined types of security attributes for information in storage.','AC-16.4','The organization being inspected/assessed defines and documents the  security attributes values associated with organization-defined types of security attributes for information in storage.  DoD has determined the security attribute values are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security attribute values to ensure the organization being inspected/assessed defines security attribute values associated with organization-defined types of security attributes for information in storage.  DoD has determined the security attribute values are not appropriate to define at the Enterprise level.'),\n('002260','draft','2013-06-24','DISA FSO','policy','The organization defines security attribute values associated with organization-defined types of security attributes for information in process.','AC-16.5','The organization being inspected/assessed defines and documents the  security attributes values associated with organization-defined types of security attributes for information in process.  DoD has determined the security attribute values are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security attribute values to ensure the organization being inspected/assessed defines security attribute values associated with organization-defined types of security attributes for information in process.  DoD has determined the security attribute values are not appropriate to define at the Enterprise level.'),\n('002261','draft','2013-06-24','DISA FSO','policy','The organization defines security attribute values associated with organization-defined types of security attributes for information in transmission.','AC-16.6','The organization being inspected/assessed defines and documents the  security attributes values associated with organization-defined types of security attributes for information in transmission.  DoD has determined the security attribute values are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security attribute values to ensure the organization being inspected/assessed defines security attribute values associated with organization-defined types of security attributes for information in transmission.  DoD has determined the security attribute values are not appropriate to define at the Enterprise level.'),\n('002262','draft','2013-06-24','DISA FSO','technical','The organization provides the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in storage.','AC-16.7','The organization being inspected/assessed configures the information system to provide the means to associate types of security attributes in defined in AC-16, CCI 2256 having  security attribute values defined in AC-16, CCI 2259 with information in storage.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2262.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide the means to associate types of security attributes in defined in AC-16, CCI 2256 having  security attribute values defined in AC-16, CCI 2259 with information in storage.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2262.'),\n('002263','draft','2013-06-24','DISA FSO','technical','The organization provides the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in process.','AC-16.8','The organization being inspected/assessed configures the information system to provide the means to associate types of security attributes in defined in AC-16, CCI 2257 having  security attribute values defined in AC-16, CCI 2260 with information in process.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2263.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide the means to associate types of security attributes in defined in AC-16, CCI 2257 having  security attribute values defined in AC-16, CCI 2260 with information in process.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2263.'),\n('002264','draft','2013-06-24','DISA FSO','technical','The organization provides the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission.','AC-16.9','The organization being inspected/assessed configures the information system to provide the means to associate types of security attributes in defined in AC-16, CCI 2258 having  security attribute values defined in AC-16, CCI 2261 with information in transmission.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2264.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide the means to associate types of security attributes in defined in AC-16, CCI 2258 having  security attribute values defined in AC-16, CCI 2261 with information in transmission.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2264.'),\n('002265','draft','2013-06-24','DISA FSO','policy','The organization ensures that the security attribute associations are made with the information.','AC-16.10','The organization being inspected/assessed documents and implements a process to ensure that the security attribute associations are made with the information.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures that the security attribute associations are made with the information.'),\n('002266','draft','2013-06-24','DISA FSO','policy','The organization ensures that the security attribute associations are retained with the information.','AC-16.11','The organization being inspected/assessed documents and implements a process to ensure that the security attribute associations are retained with the information.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures that the security attribute associations are retained with the information.'),\n('002267','draft','2013-06-24','DISA FSO','policy','The organization defines the security attributes that are permitted for organization-defined information systems.','AC-16.12','DoD has defined the security attributes as the security attributes defined in AC-16, CCIs 2256-2258.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the security attributes as the security attributes defined in AC-16, CCIs 2256-2258.'),\n('002268','draft','2013-06-24','DISA FSO','policy','The organization defines the information systems for which permitted organization-defined attributes are to be established.','AC-16.13','DoD has defined the information systems as all information systems.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information systems as all information systems.'),\n('002269','draft','2013-06-24','DISA FSO','policy','The organization establishes the permitted organization-defined security attributes for organization-defined information systems.','AC-16.14','The organization being inspected/assessed establishes and documents the permitted security attributes for all information systems as a subset of the security attributes defined in AC-16, CCI 2267.  DoD has defined the information systems as all information systems.','The organization conducting the inspection/assessment obtains and examines the documented list of permitted security attributes to ensure the organization being inspected/assessed has established the list of  permitted security attributes for all information systems as a subset of the security attributes defined in AC-16, CCI 2267.  DoD has defined the information systems as all information systems.'),\n('002270','draft','2013-06-24','DISA FSO','policy','The organization defines the values or ranges permitted for each of the established security attributes.','AC-16.15','DoD has defined the values or ranges as the values defined in AC-16, CCIs 2259-2261.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the values or ranges as the values defined in AC-16, CCIs 2259-2261.'),\n('002271','draft','2013-06-24','DISA FSO','policy','The organization determines the permitted organization-defined values or ranges for each of the established security attributes.','AC-16.16','The organization being inspected/assessed establishes and documents the permitted values or ranges for each of the established security attributes as a subset of the values or ranges defined in AC-16, CCI 2270.','The organization conducting the inspection/assessment obtains and examines the documented permitted values or ranges to ensure the organization being inspected/assessed has established the permitted values or ranges for each of the established security attributes as a subset of the values or ranges defined in AC-16, CCI 2270.'),\n('002272','draft','2013-06-24','DISA FSO','technical','The information system dynamically associates security attributes with organization-defined objects in accordance with organization-defined security policies as information is created and combined.','AC-16(1).2','The organization being inspected/assessed configures the information system to dynamically associates security attributes with the objects defined in AC-16 (1), CCI 2275 in accordance with the security policies defined in AC-16 (1), CCI 2273 as information is created and combined.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2272.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  dynamically associates security attributes with the objects defined in AC-16 (1), CCI 2275 in accordance with the security policies defined in AC-16 (1), CCI 2273 as information is created and combined.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2272.'),\n('002273','draft','2013-06-24','DISA FSO','policy','The organization defines the security policies the information system is to adhere to when dynamically associating security attributes with organization-defined subjects and objects.','AC-16(1).3','The organization being inspected/assessed defines and documents the security policies the information system is to adhere to when dynamically associating security attributes with organization-defined subjects and objects.  DoD has determined the security policies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security policies to ensure the organization being inspected/assessed defines the security policies the information system is to adhere to when dynamically associating security attributes with organization-defined subjects and objects.  DoD has determined the security policies are not appropriate to define at the Enterprise level.'),\n('002274','draft','2013-06-24','DISA FSO','policy','The organization defines the subjects with which the information system is to dynamically associate security attributes as information is created and combined.','AC-16(1).4','The organization being inspected/assessed defines and documents the subjects the information system is to dynamically associate security attributes to as information is created and combined.  DoD has determined the subjects are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented objects to ensure the organization being inspected/assessed defines the subjects the information system is to dynamically associate security attributes to as information is created and combined.  DoD has determined the subjects are not appropriate to define at the Enterprise level.'),\n('002275','draft','2013-06-24','DISA FSO','policy','The organization defines the objects with which the information system is to dynamically associate security attributes as information is created and combined.','AC-16(1).5','The organization being inspected/assessed defines and documents the objects the information system is to dynamically associate security attributes to as information is created and combined.  DoD has determined the objects are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented objects to ensure the organization being inspected/assessed defines the objects the information system is to dynamically associate security attributes to as information is created and combined.  DoD has determined the objects are not appropriate to define at the Enterprise level.'),\n('002276','draft','2013-06-24','DISA FSO','policy','The organization identifies the individuals authorized to define the value of associated security attributes.','AC-16(2).3','The organization being inspected/assessed identifies and documents the individuals authorized to define the value of associated security attributes.','The organization conducting the inspection/assessment obtains and examines the documented individuals to ensure the organization being inspected/assessed identifies the individuals authorized to define the value of associated security attributes.'),\n('002277','draft','2013-06-24','DISA FSO','technical','The information system provides authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated security attributes.','AC-16(2).4','The organization being inspected/assessed configures the information system to provide authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated security attributes.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2277.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated security attributes.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2277.'),\n('002278','draft','2013-06-24','DISA FSO','policy','The organization defines security attributes for which the association and integrity to organization-defined subjects and objects is maintained by the information system.','AC-16(3).1','he organization being inspected/assessed defines and documents the security attributes for which the association and integrity  to organization-defined subjects and objects is maintained by the information system   DoD has determined the security attributes are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security attributes to ensure the organization being inspected/assessed defines the security attributes for which the association and integrity  to organization-defined subjects and objects is maintained by the information system.  DoD has determined the security attributes are not appropriate to define at the Enterprise level.'),\n('002279','draft','2013-06-24','DISA FSO','policy','The organization defines subjects for which the association and integrity of organization-defined security attributes is maintained by the information system.','AC-16(3).2','The organization being inspected/assessed defines and documents the  subjects for which the association and integrity of organization-defined security attributes is maintained by the information system.  DoD has determined the subjects are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented subjects to ensure the organization being inspected/assessed defines the subjects for which the association and integrity of organization-defined security attributes is maintained by the information system.  DoD has determined the subjects are not appropriate to define at the Enterprise level.'),\n('002280','draft','2013-06-24','DISA FSO','policy','The organization defines objects for which the association and integrity of organization-defined security attributes is maintained by the information system.','AC-16(3).3','The organization being inspected/assessed defines and documents the  objects for which the association and integrity of organization-defined security attributes is maintained by the information system.  DoD has determined the objects are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented subjects to ensure the organization being inspected/assessed defines the objects for which the association and integrity of organization-defined security attributes is maintained by the information system.  DoD has determined the objects are not appropriate to define at the Enterprise level.'),\n('002281','draft','2013-06-24','DISA FSO','technical','The information system maintains the association of organization-defined security attributes to organization-defined subjects.','AC-16(3).4','The organization being inspected/assessed configures the information system to maintain the association of the security attributes defined in AC-16 (3), CCI 2278 to subjects defined in AC-16 (3), CCI 2279.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2281.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  maintain the association of the security attributes defined in AC-16 (3), CCI 2278 to subjects defined in AC-16 (3), CCI 2280   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2281.'),\n('002282','draft','2013-06-24','DISA FSO','technical','The information system maintains the association of organization-defined security attributes to organization-defined objects.','AC-16(3).5','The organization being inspected/assessed configures the information system to maintain the association of the security attributes defined in AC-16 (3), CCI 2278 to objects defined in AC-16 (3), CCI 2280.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2282.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to   maintain the association of the security attributes defined in AC-16 (3), CCI 2278 to objects defined in AC-16 (3), CCI 2280   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2282.'),\n('002283','draft','2013-06-24','DISA FSO','technical','The information system maintains the integrity of organization-defined security attributes associated with organization-defined subjects.','AC-16(3).6','The organization being inspected/assessed configures the information system to maintain the integrity of the security attributes defined in AC-16 (3), CCI 2278 to subjects defined in AC-16 (3), CCI 2279.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2283.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  maintain the integrity of the security attributes defined in AC-16 (3), CCI 2278 to subjects defined in AC-16 (3), CCI 2279.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2283.'),\n('002284','draft','2013-06-24','DISA FSO','technical','The information system maintains the integrity of organization-defined security attributes associated with organization-defined objects.','AC-16(3).7','The organization being inspected/assessed configures the information system to maintain the integrity of the security attributes defined in AC-16 (3), CCI  2278 to objects defined in AC-16 (3), CCI 2280.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2284.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information to maintain the integrity of the security attributes defined in AC-16 (3), CCI  2278 to objects defined in AC-16 (3), CCI 2280.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2284.'),\n('002285','draft','2013-06-24','DISA FSO','policy','The organization identifies individuals (or processes acting on behalf of individuals) authorized to associate organization-defined security attributes with organization-defined subjects.','AC-16(4).2','The organization being inspected/assessed identifies and documents individuals (or processes acting on behalf of individuals) authorized to associate security attributes defined in AC-16 (4), CCI 2288 with subjects defined in AC-16 (4), CCI 2286.','The organization conducting the inspection/assessment obtains and examines the documented individuals to ensure the organization being inspected/assessed identifies individuals (or processes acting on behalf of individuals) authorized to associate security attributes defined in AC-16 (4), CCI 2288 with subjects defined in AC-16 (4), CCI 2286.'),\n('002286','draft','2013-06-24','DISA FSO','policy','The organization defines the subjects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).','AC-16(4).3','The organization being inspected/assessed defines and documents the subjects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).  DoD has defined the subjects as not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented objects to ensure the organization being inspected/assessed defines  the  subjects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).  DoD has defined the subjects as not appropriate to define at the Enterprise level.'),\n('002287','draft','2013-06-24','DISA FSO','policy','The organization defines the objects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).','AC-16(4).4','The organization being inspected/assessed defines and documents the objects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).  DoD has defined the objects as not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented objects to ensure the organization being inspected/assessed defines  the  objects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).  DoD has defined the objects as not appropriate to define at the Enterprise level.'),\n('002288','draft','2013-06-24','DISA FSO','policy','The organization defines the security attributes authorized individuals (or processes acting on behalf of individuals) are permitted to associate with organization-defined subjects and objects.','AC-16(4).5','The organization being inspected/assessed defines and documents the security attributes authorized individuals (or processes acting on behalf of individuals) are permitted to associate with organization-defined subjects and objects.  DoD has defined the security attributes as not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security attributes to ensure the organization being inspected/assessed defines  the security attributes authorized individuals (or processes acting on behalf of individuals) are permitted to associate with organization-defined subjects and objects.  DoD has defined the security attributes as not appropriate to define at the Enterprise level.'),\n('002289','draft','2013-06-24','DISA FSO','technical','The information system supports the association of organization-defined security attributes with organization-defined subjects by authorized individuals (or processes acting on behalf of individuals).','AC-16(4).6','The organization being inspected/assessed configures the information system to support the association of security attributes defined in AC-16 (4), CCI 2288 with the subjects defined in AC-16 (4), CCI 2286 by authorized individuals (or processes acting on behalf of individuals).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2289.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  support the association of security attributes defined in AC-16 (4), CCI 2288 with the subjects defined in AC-16 (4), CCI 2286 by authorized individuals (or processes acting on behalf of individuals).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2289.'),\n('002290','draft','2013-06-24','DISA FSO','technical','The information system supports the association of organization-defined security attributes with organization-defined objects by authorized individuals (or processes acting on behalf of individuals).','AC-16(4).7','The organization being inspected/assessed configures the information system to support the association of security attributes defined in AC-16 (4), CCI 2288 with the objects defined in AC-16 (4), CCI 2287 by authorized individuals (or processes acting on behalf of individuals).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2290.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to support the association of security attributes defined in AC-16 (4), CCI 2288 with the objects defined in AC-16 (4), CCI 2287 by authorized individuals (or processes acting on behalf of individuals).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2290.'),\n('002291','draft','2013-06-24','DISA FSO','policy','The organization defines the security policies to be followed by personnel when associating organization-defined security attributes with organization-defined subjects and objects.','AC-16(6).1','The organization being inspected/assessed defines and documents the security policies to be followed  by personnel when associating organization-defined security attributes with organization-defined subjects and objects.  DoD has determined the security policies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security policies to ensure the organization being inspected/assessed defines the security policies to be followed  by personnel when associating organization-defined security attributes with organization-defined subjects and objects.  DoD has determined the security policies are not appropriate to define at the Enterprise level.'),\n('002292','draft','2013-06-24','DISA FSO','policy','The organization defines the security attributes which are to be associated with organization-defined subjects and objects.','AC-16(6).2','The organization being inspected/assessed defines and documents the  security attributes which are to be associated with organization-defined subjects and objects.  DoD has determined the security attributes are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security attributes to ensure the organization being inspected/assessed defines the security attributes which are to be associated with organization-defined subjects and objects.  DoD has determined the security attributes are not appropriate to define at the Enterprise level.'),\n('002293','draft','2013-06-24','DISA FSO','policy','The organization defines the subjects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies.','AC-16(6).3','The organization being inspected/assessed defines and documents the subjects to be associated, and that association maintained,  with organization-defined security attributes in accordance with organization-defined security policies.   DoD has determined the subjects are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented subjects to ensure the organization being inspected/assessed defines the subjects to be associated, and that association maintained,  with organization-defined security attributes in accordance with organization-defined security policies.  DoD has determined the subjects are not appropriate to define at the Enterprise level.'),\n('002294','draft','2013-06-24','DISA FSO','policy','The organization defines the objects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies.','AC-16(6).4','The organization being inspected/assessed defines and documents the  objects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies.  DoD has determined the objects are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented objects to ensure the organization being inspected/assessed defines the objects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies.  DoD has determined the objects are not appropriate to define at the Enterprise level.'),\n('002295','draft','2013-06-24','DISA FSO','policy','The organization allows personnel to associate organization-defined security attributes with organization-defined subjects in accordance with organization-defined security policies.','AC-16(6).5','The organization being inspected/assessed  documents and implements a process  requiring personnel to associate security attributes defined in AC-16 (6), CCI 2292 with subjects defined in AC-16 (6), CCI 2293 in accordance with  security policies defined in AC-16 (6), CCI 2291.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requires personnel to associate security attributes defined in AC-16 (6), CCI 2292 with subjects defined in AC-16 (6), CCI 2293 in accordance with  security policies defined in AC-16 (6), CCI 2291.'),\n('002296','draft','2013-06-24','DISA FSO','policy','The organization allows personnel to associate organization-defined security attributes with organization-defined objects in accordance with organization-defined security policies.','AC-16(6).6','The organization being inspected/assessed  documents and implements a process  requiring personnel to associate security attributes defined in AC-16 (6), CCI 2292 with objects defined in AC-16 (6), CCI 2294 in accordance with security policies defined in AC-16 (6), CCI 2291.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requires personnel to associate security attributes defined in AC-16 (6), CCI 2292 with objects defined in AC-16 (6), CCI 2294 in accordance with security policies defined in AC-16 (6), CCI 2291.'),\n('002297','draft','2013-06-24','DISA FSO','policy','The organization allows personnel to maintain the association of organization-defined security attributes with organization-defined subjects in accordance with organization-defined security policies.','AC-16(6).7','The organization being inspected/assessed  documents and implements a process  requiring personnel to maintain the association of security attributes defined in AC-16 (6), CCI 2292 with subjects defined in AC-16 (6), CCI 2293 in accordance with  security policies defined in AC-16 (6), CCI 2291.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requires personnel to maintain the association of security attributes defined in AC-16 (6), CCI 2292 with subjects defined in AC-16 (6), CCI 2293 in accordance with  security policies defined in AC-16 (6), CCI 2291.'),\n('002298','draft','2013-06-24','DISA FSO','policy','The organization allows personnel to maintain the association of organization-defined security attributes with organization-defined objects in accordance with organization-defined security policies.','AC-16(6).8','The organization being inspected/assessed  documents and implements a process  requiring personnel to  maintain the association of security attributes defined in AC-16 (6), CCI 2292 with objects defined in AC-16 (6), CCI 2294 in accordance with  security policies defined in AC-16 (6), CCI 2291.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requires personnel to  maintain the association of security attributes defined in AC-16 (6), CCI 2292 with objects defined in AC-16 (6), CCI 2294 in accordance with  security policies defined in AC-16 (6), CCI 2291.'),\n('002299','draft','2013-06-24','DISA FSO','policy','The organization provides a consistent interpretation of security attributes transmitted between distributed information system components.','AC-16(7).1','The organization being inspected/assessed documents and implements a process to provide a consistent interpretation of security attributes transmitted between distributed information system components.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  provides a consistent interpretation of security attributes transmitted between distributed information system components.'),\n('002300','draft','2013-06-24','DISA FSO','policy','The organization defines the techniques or technologies to be implemented when associating security attributes with information.','AC-16(8).1','The organization being inspected/assessed defines and documents the techniques or technologies to be implemented when associating security attributes with information.   DoD has determined the technique or technologies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented techniques and technologies to ensure the organization being inspected/assessed defines the techniques or technologies to be implemented when associating security attributes with information.   DoD has determined the technique or technologies are not appropriate to define at the Enterprise level.'),\n('002301','draft','2013-06-24','DISA FSO','policy','The organization defines the level of assurance to be provided when implementing organization-defined techniques or technologies in associating security attributes to information.','AC-16(8).2','The organization being inspected/assessed defines and documents the level of assurance to be provided when implementing organization-defined techniques or technologies in associating security attributes to information.  DoD has determined the level of assurance is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented level of assurance to ensure the organization being inspected/assessed defines the level of assurance to be provided when implementing organization-defined techniques or technologies in associating security attributes to information.  DoD has determined the level of assurance is not appropriate to define at the Enterprise level.'),\n('002302','draft','2013-06-24','DISA FSO','technical','The information system implements organization-defined techniques or technologies with an organization-defined level of assurance in associating security attributes to information.','AC-16(8).3','The organization being inspected/assessed configures the information system to implement the techniques or technologies defined in AC-16 (8), CCI 2300 with the level of assurance defined in AC-16 (8), CCI 2301 in associating security attributes to information.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2302.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement the techniques or technologies defined in AC-16 (8), CCI 2300 with the level of assurance defined in AC-16 (8), CCI 2301 in associating security attributes to information.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2302.'),\n('002303','draft','2013-06-24','DISA FSO ','policy','The organization defines the techniques or procedures to be employed to validate re-grading mechanisms.','AC-16(9).1','The organization being inspected/assessed defines and documents the techniques or procedures to be employed to validate re-grading mechanisms.  DoD has determined the techniques or procedures are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented techniques or procedures to ensure the organization being inspected/assessed defines the techniques or procedures to be employed to validate re-grading mechanisms.  DoD has determined the techniques or procedures are not appropriate to define at the Enterprise level.'),\n('002304','draft','2013-06-24','DISA FSO','policy','The organization ensures security attributes associated with information are reassigned only via re-grading mechanisms validated using organization-defined techniques or procedures.','AC-16(9).2','The organization being inspected/assessed documents and implements a process to ensure security attributes associated with information are reassigned only via re-grading mechanisms validated using techniques or procedures defined in AC-16 (9), CCI 2303.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures security attributes associated with information are reassigned only via re-grading mechanisms validated  using techniques or procedures defined in AC-16 (9), CCI 2303.'),\n('002305','draft','2013-06-24','DISA FSO','policy','The organization identifies individuals authorized to define or change the type and value of security attributes available for association with subjects and objects.','AC-16(10).1','The organization being inspected/assessed identifies and documents individuals authorized to define or change the type and value of security attributes available for association with subjects and objects.','The organization conducting the inspection/assessment obtains and examines the documented individuals to ensure the organization being inspected/assessed identifies individuals authorized to define or change the type and value of security attributes available for association with subjects and objects.'),\n('002306','draft','2013-06-24','DISA FSO','technical','The information system provides authorized individuals the capability to define or change the type of security attributes available for association with subjects.','AC-16(10).2','The organization being inspected/assessed configures the information system to provide authorized individuals the capability to define or change the type of security attributes available for association with subjects.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2306.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide authorized individuals the capability to define or change the type of security attributes available for association with subjects.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2306.'),\n('002307','draft','2013-06-24','DISA FSO','technical','The information system provides authorized individuals the capability to define or change the value of security attributes available for association with subjects.','AC-16(10).3','The organization being inspected/assessed configures the information system to provide authorized individuals the capability to define or change the value of security attributes available for association with subjects.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2307.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide authorized individuals the capability to define or change the value of security attributes available for association with subjects.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2307.'),\n('002308','draft','2013-06-24','DISA FSO','technical','The information system provides authorized individuals the capability to define or change the type of security attributes available for association with objects.','AC-16(10).4','The organization being inspected/assessed configures the information system to provide authorized individuals the capability to define or change the type of security attributes available for association with objects.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2308.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide authorized individuals the capability to define or change the type of security attributes available for association with objects.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2308.'),\n('002309','draft','2013-06-24','DISA FSO','technical','The information system provides authorized individuals the capability to define or change the value of security attributes available for association with objects.','AC-16(10).5','The organization being inspected/assessed configures the information system to provide authorized individuals the capability to define or change the value of security attributes available for association with objects.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2309.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide authorized individuals the capability to define or change the value of security attributes available for association with objects.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2309.'),\n('002310','draft','2013-06-24','DISA FSO','policy','The organization establishes and documents usage restrictions for each type of remote access allowed.','AC-17.2','The organization being inspected/assessed establishes and documents usage restrictions for each type of remote access allowed.','The organization conducting the inspection/assessment obtains and examines the documented usage restrictions to ensure the organization being inspected/assessed  establishes and documents usage restrictions for each type of remote access allowed.'),\n('002311','draft','2013-06-24','DISA FSO','policy','The organization establishes and documents configuration/connection requirements for each type of remote access allowed.','AC-17.3','The organization being inspected/assessed establishes and documents configuration/connection requirements for each type of remote access allowed.','The organization conducting the inspection/assessment obtains and examines the documented requirements to ensure the organization being inspected/assessed  establishes and documents configuration/connection requirements for each type of remote access allowed.'),\n('002312','draft','2013-06-24','DISA FSO','policy','The organization establishes and documents implementation guidance for each type of remote access allowed.','AC-17.4','The organization being inspected/assessed establishes and documents implementation guidance for each type of remote access allowed.','The organization conducting the inspection/assessment obtains and examines the documented implementation guidance to ensure the organization being inspected/assessed establishes and documents implementation guidance for each type of remote access allowed.'),\n('002313','deprecated','2013-06-24','DISA FSO','technical','The information system controls remote access methods.',NULL,NULL,NULL),\n('002314','draft','2013-06-24','DISA FSO','technical','The information system controls remote access methods.','AC-17(1).2','The organization being inspected/assessed configures the information system to control remote access methods.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2314.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to control remote access methods.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2314.'),\n('002315','draft','2013-06-24','DISA FSO','policy','The organization defines the number of managed network access control points through which the information system routes all remote access.','AC-17(3).3','The organization being inspected/assessed defines and documents the number of managed network access control points through which the information system routes all remote access.  DoD has determined the number is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented number to ensure the organization being inspected/assessed defines the number of managed network access control points through which the information system routes all remote access.   DoD has determined the number is not appropriate to define at the Enterprise level.'),\n('002316','draft','2013-06-24','DISA FSO','policy','The organization authorizes access to security-relevant information via remote access only for organization-defined needs.','AC-17(4).2','The organization being inspected/assessed authorizes the access to security-relevant information via remote access only for needs defined in AC-17 (4), CCI 2318.  The organization being inspected/assessed maintains an audit trail of authorizations.','The organization conducting the inspection/assessment obtains and examines the audit trail of authorizations to ensure the organization being inspected/assessed authorizes the access to security-relevant information via remote access only for needs defined in AC-17 (4), CCI 2318.'),\n('002317','draft','2013-06-24','DISA FSO','policy','The organization defines the operational needs for when the execution of privileged commands via remote access is to be authorized.','AC-17(4).3','The organization being inspected/assessed defines and documents the operational needs when the execution of privileged commands via remote access is to be authorized.  DoD has determined the operational needs are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented operational needs to ensure the organization being inspected/assessed defines the operational needs when the execution of privileged commands via remote access is to be authorized.  DoD has determined the operational needs are not appropriate to define at the Enterprise level.'),\n('002318','draft','2013-06-24','DISA FSO','policy','The organization defines the operational needs for when access to security-relevant information via remote access is to be authorized.','AC-17(4).4','The organization being inspected/assessed defines and documents the operational needs when access to security-relevant information via remote access is to be authorized.  DoD has determined the operational needs are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented operational needs to ensure the organization being inspected/assessed defines the operational needs when access to security-relevant information via remote access is to be authorized.  DoD has determined the operational needs are not appropriate to define at the Enterprise level.'),\n('002319','draft','2013-06-24','DISA FSO','policy','The organization documents in the security plan for the information system the rationale for authorization of the execution of privilege commands via remote access.','AC-17(4).5','The organization being inspected/assessed documents in the security plan for the information system the rationale for authorization of the execution of privilege commands via remote access.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed documents in the security plan for the information system the rationale for authorization of the execution of privilege commands via remote access.'),\n('002320','draft','2013-06-24','DISA FSO','policy','The organization documents in the security plan for the information system the rationale for authorization of access to security-relevant information via remote access.','AC-17(4).6','The organization being inspected/assessed documents in the security plan for the information system the rationale for authorization of access to security-relevant information via remote access.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed documents in the security plan for the information system the rationale for authorization of access to security-relevant information via remote access.'),\n('002321','draft','2013-06-24','DISA FSO','policy','The organization defines the time period within which it disconnects or disables remote access to the information system.','AC-17(9).1','DoD has defined the time period as immediately.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as immediately.'),\n('002322','draft','2013-06-24','DISA FSO','technical','The organization provides the capability to expeditiously disconnect or disable remote access to the information system within the organization-defined time period.','AC-17(9).2','The organization being inspected/assessed configures the information system to provide the capability to expeditiously disconnect or disable remote access to the information system immediately.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2322.  DoD has defined the time period as immediately.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  provide the capability to expeditiously disconnect or disable remote access to the information system immediately.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2322.  DoD has defined the time period as immediately.'),\n('002323','draft','2013-06-24','DISA FSO','policy','The organization establishes configuration/connection requirements for wireless access.','AC-18.3','The organization being inspected/assessed  establishes and documents configuration/connection requirements for wireless access.','The organization conducting the inspection/assessment obtains and examines the documented configuration/connection requirements to ensure the organization being inspected/assessed establishes configuration/connection requirements for wireless access.'),\n('002324','draft','2013-06-24','DISA FSO','policy','The organization identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities.','AC-18(4).1','The organization being inspected/assessed identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities.  The organization must maintain an audit trail of authorizations.','The organization conducting the inspection/assessment obtains and examines the audit trail of authorizations to ensure the organization being inspected/assessed identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities.'),\n('002325','draft','2013-06-24','DISA FSO','policy','The organization establishes configuration requirements for organization-controlled mobile devices.','AC-19.3','DoD is automatically compliant with this CCI because existing STIGs establish configuration requirements for approved mobile devices.','DoD is automatically compliant with this CCI because existing STIGs establish configuration requirements for approved mobile devices.'),\n('002326','draft','2013-06-24','DISA FSO','policy','The organization establishes connection requirements for organization-controlled mobile devices.','AC-19.4','The organization being inspected/assessed establishes and documents  connection requirements for organization controlled mobile devices.','The organization conducting the inspection/assessment obtains and examines the documented connection requirements to ensure the organization being inspected/assessed establishes connection requirements for organization controlled mobile devices.'),\n('002327','draft','2013-06-24','DISA FSO','policy','The organization defines the security policies which restrict the connection of classified mobile devices to classified information systems.','AC-19(4).8','The organization being inspected/assessed defines and documents the security policies which restrict the connection of classified mobile devices to classified information systems.   DoD has determined the security policies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security policies to ensure the organization being inspected/assessed defines the security policies which restrict the connection of classified mobile devices to classified information systems.  DoD has determined the security policies are not appropriate to define at the Enterprise level.'),\n('002328','draft','2013-06-24','DISA FSO','policy','The organization restricts the connection of classified mobile devices to classified information systems in accordance with organization-defined security policies.','AC-19(4).9','The organization being inspected/assessed documents and implements a process to restrict the connection of classified mobile devices to classified information systems in accordance with the security policies defined in AC-19 (4), CCI 2327.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed restricts the connection of classified mobile devices to classified information systems in accordance with the security policies defined in AC-19 (4), CCI 2327.'),\n('002329','draft','2013-06-24','DISA FSO','policy','The organization defines the mobile devices that are to employ full-device or container encryption to protect the confidentiality and integrity of the information on the device.','AC-19(5).2','The organization being inspected/assessed defines and documents the mobile devices that are to employ full-device or container encryption to protect the confidentiality and integrity of the information on device.  DoD has determined the mobile devices are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented mobile devices to ensure the organization being inspected/assessed  defines  the mobile devices that are to employ full-device or container encryption to protect the confidentiality and integrity of the information on device.  DoD has determined the mobile devices are not appropriate to define at the Enterprise level.'),\n('002330','draft','2013-06-24','DISA FSO','policy','The organization employs full-device encryption or container encryption to protect the confidentiality of information on organization-defined mobile devices.','AC-19(5).3','The organization being inspected/assessed documents and implements a process for full-device encryption or container encryption to protect the confidentiality of information on  mobile devices defined in AC-19 (5), CCI 2329.   ','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed employs full-device encryption or container encryption to protect the confidentiality of information on mobile devices defined in AC-19 (5), CCI 2329.'),\n('002331','draft','2013-06-24','DISA FSO','policy','The organization employs full-device encryption or container encryption to protect the integrity of information on organization-defined mobile devices.','AC-6(7).4','The organization being inspected/assessed documents and implements a process to reassign or remove privileges, if necessary, to correctly reflect organizational mission/business needs.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed reassigns or removes privileges, if necessary, to correctly reflect organizational mission/business needs.'),\n('002332','draft','2013-06-24','DISA FSO','policy','The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to process, store, or transmit organization-controlled information using the external information systems.','AC-20.2','The organization being inspected/assessed establishes and documents the terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to process, store or transmit organization-controlled information using the external information systems.','The organization conducting the inspection/assessment obtains and examines the documented terms and conditions to ensure the organization being inspected/assessed establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to process, store or transmit organization-controlled information using the external information systems.'),\n('002333','draft','2013-06-24','DISA FSO','policy','The organization permits authorized individuals to use an external information system to access the information system only when the organization verifies the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.','AC-20(1).1','The organization being inspected/assessed documents and implements a process to permit authorized individuals to use an external information system to access the information system only when the organization verifies the implementation of required security controls on the external system as specified in the organizations information security policy and security plan.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed permits authorized individuals to use an external information system to access the information system only when the organization verifies the implementation of required security controls on the external system as specified in the organizations information security policy and security plan.'),\n('002334','draft','2013-06-24','DISA FSO','policy','The organization permits authorized individuals to use an external information system to process organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.','AC-20(1).2','The organization being inspected/assessed documents and implements a process to permit authorized individuals to use an external information system to process organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organizations information security policy and security plan.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed permits authorized individuals to use an external information system to process organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organizations information security policy and security plan.'),\n('002335','draft','2013-06-24','DISA FSO','policy','The organization permits authorized individuals to use an external information system to store organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.','AC-20(1).3','The organization being inspected/assessed documents and implements a process to permit authorized individuals to use an external information system to store organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organizations information security policy and security plan.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed permits authorized individuals to use an external information system to store organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organizations information security policy and security plan.'),\n('002336','draft','2013-06-24','DISA FSO','policy','The organization permits authorized individuals to use an external information system to transmit organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization^s information security policy and security plan.','AC-20(1).4','The organization being inspected/assessed documents and implements a process to permit authorized individuals to use an external information system to transmit organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organizations information security policy and security plan.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed permits authorized individuals to use an external information system to transmit organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organizations information security policy and security plan.'),\n('002337','draft','2013-06-24','DISA FSO','policy','The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization retains approved information system connection or processing agreements with the organizational entity hosting the external information system.','AC-20(1).5','The organization being inspected/assessed documents and implements a process to permit  authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization retains approved information system connection or processing agreements with the organizational entity hosting the external information system.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed permits  authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization retains approved information system connection or processing agreements with the organizational entity hosting the external information system.'),\n('002338','draft','2013-06-24','DISA FSO','policy','The organization restricts or prohibits the use of non-organizationally owned information systems, system components, or devices to process, store, or transmit organizational information.','AC-20(3).1','The organization being inspected/assessed documents and implements a process to  restrict or prohibit the use of non-organizationally owned information systems, system components, or devices to process, store, or transmit organizational information.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed restricts or prohibits the use of non-organizationally owned information systems, system components, or devices to process, store, or transmit organizational information.'),\n('002339','draft','2013-06-24','DISA FSO','policy','The organization defines the network accessible storage devices that are to be prohibited from being used in external information systems.','AC-20(4).1','The organization being inspected/assessed defines and documents the network accessible storage devices that are to be prohibited from being used in external information systems.  DoD has determined the network accessible storage devices are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented network accessible storage devices to ensure the organization being inspected/assessed defines the network accessible storage devices that are to be prohibited from being used in external information systems.  DoD has determined the network accessible storage devices are not appropriate to define at the Enterprise level.'),\n('002340','draft','2013-06-24','DISA FSO','policy','The organization prohibits the use of organization-defined network accessible storage devices in external information systems.','AC-20(4).2','The organization being inspected/assessed documents and implements a process to prohibit the use of  network accessible storage devices defined in AC-20 (4), CCI 2339 in external information systems.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed prohibits the use of  network accessible storage devices defined in AC-20 (4), CCI 2339 in external information systems.'),\n('002341','draft','2013-06-25','DISA FSO','policy','The organization defines the information sharing restrictions to be enforced by the information system for information search and retrieval services.','AC-21(2).1','The organization being inspected/assessed defines and documents the information sharing restrictions to be enforced by the information system for information search and retrieval services.  DoD has determined the information sharing restrictions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information sharing restrictions to ensure the organization being inspected/assessed  defines the information sharing restrictions to be enforced by the information system for information search and retrieval services.  DoD has determined the information sharing restrictions are not appropriate to define at the Enterprise level.'),\n('002342','draft','2013-06-25','DISA FSO','technical','The information system implements information search and retrieval services that enforce organization-defined information sharing restrictions.','AC-21(2).2','The organization being inspected/assessed configures the information system to configure the information system to implement information search and retrieval services that enforce information sharing restrictions defined in AC-21 (2), CCI 2341.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2342.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement information search and retrieval services that enforce information sharing restrictions defined in AC-21 (2), CCI 2341.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2342.'),\n('002343','draft','2013-06-25','DISA FSO','policy','The organization defines the data mining prevention techniques to be employed to adequately protect organization-defined data storage objects against data mining.','AC-23.1','The organization being inspected/assessed defines and documents the data mining prevention techniques to be employed to adequately protect organization-defined data storage objects against data mining.  DoD has determined the data mining prevention techniques are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented data mining prevention techniques to ensure the organization being inspected/assessed  defines the data mining prevention techniques to be employed to adequately protect organization-defined data storage objects against data mining.  DoD has determined the data mining prevention techniques are not appropriate to define at the Enterprise level.'),\n('002344','draft','2013-06-25','DISA FSO','policy','The organization defines the data mining detection techniques to be employed to adequately detect data mining attempts against organization-defined data storage objects.','AC-23.2','The organization being inspected/assessed defines and documents the data mining detection techniques to be employed to adequately detect data mining attempts against organization-defined data storage objects.  DoD has determined the data mining detection techniques are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented data mining detection techniques to ensure the organization being inspected/assessed  defines the data mining detection techniques to be employed to adequately detect data mining attempts against organization-defined data storage objects.  DoD has determined the data mining detection techniques are not appropriate to define at the Enterprise level.'),\n('002345','draft','2013-06-25','DISA FSO','policy','The organization defines the data storage objects that are to be protected against data mining attempts.','AC-23.3','The organization being inspected/assessed defines and documents the data storage objects that are to be protected against data mining attempts.  DoD has determined the data storage objects are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented data storage objects to ensure the organization being inspected/assessed  defines the data storage objects that are to be protected against data mining attempts.   DoD has determined the data storage objects are not appropriate to define at the Enterprise level.'),\n('002346','draft','2013-06-25','DISA FSO','technical','The organization employs organization-defined data mining prevention techniques for organization-defined data storage objects to adequately protect against data mining.','AC-23.4','The organization being inspected/assessed configures the information system to employ data mining prevention techniques defined in AC-23, CCI 2343 for data storage objects defined in AC-23, CCI 2345 to adequately detect data mining attempts.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2346.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to employ data mining prevention techniques defined in AC-23, CCI 2343 for data storage objects defined in AC-23, CCI 2345 to adequately detect data mining attempts.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2346.'),\n('002347','draft','2013-06-25','DISA FSO','technical','The organization employs organization-defined data mining detection techniques for organization-defined data storage objects to adequately detect data mining attempts.','AC-23.5','The organization being inspected/assessed configures the information system to employ data mining detection techniques defined in AC-23, CCI 2344  for data storage objects defined in AC-23, CCI 2345 to adequately detect data mining attempts.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2347.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to employ data mining detection techniques defined in AC-23, CCI 2344  for data storage objects defined in AC-23, CCI 2345 to adequately detect data mining attempts.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2347.'),\n('002348','draft','2013-06-25','DISA FSO','policy','The organization defines the access control decisions that are to be applied to each access request prior to access enforcement.','AC-24.1','The organization being inspected/assessed defines and documents the access control decisions that are to be applied to each access request prior to access enforcement.   DoD has determined the access control decisions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented access control decisions to ensure the organization being inspected/assessed defines  the access control decisions that are to be applied to each access request prior to access enforcement.   DoD has determined the access control decisions are not appropriate to define at the Enterprise level.'),\n('002349','draft','2013-06-25','DISA FSO','policy','The organization establishes procedures to ensure organization-defined access control decisions are applied to each access request prior to access enforcement.','AC-24.2','The organization being inspected/assessed establishes and documents procedures to ensure access control decisions defined in AC-24, CCI 2348 are applied to each access request prior to access enforcement.','The organization conducting the inspection/assessment obtains and examines the documented procedures to ensure the organization being inspected/assessed establishes procedures to ensure access control decisions defined in AC-24, CCI 2348 are applied to each access request prior to access enforcement.'),\n('002350','draft','2013-06-25','DISA FSO','policy','The organization defines the access authorization information that is to be transmitted using organization-defined security safeguards to organization-defined information systems that enforce access control decisions.','AC-24(1).1','The organization being inspected/assessed defines and documents the access authorization information that is to be transmitted using organization-defined security safeguards to organization-defined information systems that enforce access control decisions.  DoD has determined the access authorization information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented access authorization information to ensure the organization being inspected/assessed defines  the access authorization information that is to be transmitted using organization-defined security safeguards to organization-defined information systems that enforce access control decisions.  DoD has determined the access authorization information is not appropriate to define at the Enterprise level.'),\n('002351','draft','2013-06-25','DISA FSO','policy','The organization defines the security safeguards to be employed when transmitting organization-defined access authorization information to organization-defined information systems that enforce access control decisions.','AC-24(1).2','The organization being inspected/assessed defines and documents the security safeguards to be employed when transmitting organization-defined access authorization information to organization-defined information systems that enforce access control decisions.   DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines the security safeguards to be employed when transmitting organization-defined access authorization information to organization-defined information systems that enforce access control decisions.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002352','draft','2013-06-25','DISA FSO','policy','The organization defines the information systems that are to be recipients of organization-defined access authorization information using organization-defined security safeguards.','AC-24(1).3','The organization being inspected/assessed defines and documents the information systems that are to be recipients of organization-defined access authorization information using organization-defined security safeguards.  DoD has determined the information systems are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information systems to ensure the organization being inspected/assessed defines the information systems that are to be recipients of organization-defined access authorization information using organization-defined security safeguards.  DoD has determined the information systems are not appropriate to define at the Enterprise level.'),\n('002353','draft','2013-06-25','DISA FSO','technical','The information system transmits organization-defined access authorization information using organization-defined security safeguards to organization-defined information systems which enforce access control decisions.','AC-24(1).4','The organization being inspected/assessed configures the information system to transmit access authorization information defined in AC-24 (1), CCI 2350 using security safeguards defined in AC-24 (1), CCI 2351 to information systems defined in AC-24 (1), CCI 2352 which enforce access control decisions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2353.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to transmit access authorization information defined in AC-24 (1), CCI 2350 using security safeguards defined in AC-24 (1), CCI 2351 to information systems defined in AC-24 (1), CCI 2352 which enforce access control decisions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2353.'),\n('002354','draft','2013-06-25','DISA FSO','policy','The organization defines the security attributes, not to include the identity of the user or process acting on behalf of the user, to be used as the basis for enforcing access control decisions.','AC-24(2).1','The organization being inspected/assessed defines and documents the security attributes, not to include the identity of the user or process acting on behalf of the user, to be used as the basis for enforcing access control decisions.  DoD has determined the security attributes are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security attributes to ensure the organization being inspected/assessed defines the security attributes, not to include the identity of the user or process acting on behalf of the user, to be used as the basis for enforcing access control decisions.  DoD has determined the security attributes are not appropriate to define at the Enterprise level.'),\n('002355','draft','2013-06-25','DISA FSO','technical','The information system enforces access control decisions based on organization-defined security attributes that do not include the identity of the user or process acting on behalf of the user.','AC-24(2).2','The organization being inspected/assessed configures the information system to enforce access control decisions based on security attributes defined in AC-24 (2), CCI 2354 that do not include the identity of the user or process acting on behalf of the user.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2355.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce access control decisions based on  security attributes defined in AC-24 (2), CCI 2354 that do not include the identity of the user or process acting on behalf of the user.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2355.'),\n('002356','draft','2013-06-25','DISA FSO','policy','The organization defines the access control policies to be implemented by the information system^s reference monitor.','AC-25.1','The organization being inspected/assessed defines and documents the access control policies to be implemented by the information system\\'s reference monitor.  DoD has determined the access control policies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented access control policies to ensure the organization being inspected/assessed  defines the access control policies to be implemented by the information system\\'s reference monitor.   DoD has determined the access control policies are not appropriate to define at the Enterprise level.'),\n('002357','draft','2013-06-25','DISA FSO','technical','The information system implements a reference monitor for organization-defined access control policies that is tamperproof.','AC-25.2','The organization being inspected/assessed configures the information system to implement a reference monitor for access control policies defined in AC-25, CCI 2356 that is tamperproof.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2357.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement a reference monitor for access control policies defined in AC-25, CCI 2356 that is tamperproof.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2357.'),\n('002358','draft','2013-06-25','DISA FSO','technical','The information system implements a reference monitor for organization-defined access control policies that is always invoked.','AC-25.3','The organization being inspected/assessed configures the information system to implement a reference monitor for access control policies defined in AC-25, CCI 2356 that is always invoked.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2358.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  implement a reference monitor for access control policies defined in AC-25, CCI 2356 that is always invoked.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2358.'),\n('002359','draft','2013-06-25','DISA FSO','technical','The information system implements a reference monitor for organization-defined access control policies that is small enough to be subject to analysis and testing, the completeness of which can be assured.','AC-25.4','The organization being inspected/assessed configures the information system to implement a reference monitor for access control policies defined in AC-25, CCI 2356 that is small enough to be subject to analysis and testing, the completeness of which can be assured.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2359.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement a reference monitor for access control policies defined in AC-25, CCI 2356 that is small enough to be subject to analysis and testing, the completeness of which can be assured.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2359.'),\n('002360','draft','2013-06-26','DISA FSO','policy','The organization defines the conditions or trigger events requiring session disconnect to be employed by the information system when automatically terminating a user session.','AC-12.1','The organization being inspected/assessed defines and documents the conditions or trigger events requiring session disconnect to be employed by the information system when automatically terminating a user session.   DoD has determined the conditions or trigger events are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented conditions or trigger events to ensure the organization being inspected/assessed defines the conditions or trigger events requiring session disconnect to be employed by the information system when automatically terminating a user session.   DoD has determined the conditions or trigger events are not appropriate to define at the Enterprise level.'),\n('002361','draft','2013-06-26','DISA FSO','technical','The information system automatically terminates a user session after organization-defined conditions or trigger events requiring session disconnect.','AC-12.2','The organization being inspected/assessed configures the information system to automatically terminate a user session after conditions or trigger events requiring session disconnect, as defined in AC-12, CCI 2360.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2361.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically terminate a user session after conditions or trigger events requiring session disconnect, as defined in AC-12, CCI 2360.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2361.'),\n('002362','draft','2013-06-26','DISA FSO','policy','The organization defines the resources requiring information system authentication in order to gain access.','AC-12(1).1','DoD has defined the resources as all.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the resources as all.'),\n('002363','draft','2013-06-26','DISA FSO','technical','The information system provides a logout capability for user-initiated communications sessions whenever authentication is used to gain access to organization-defined information resources.','AC-12(1).2','The organization being inspected/assessed configures the information system to provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to all information resources.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2363.  DoD has defined the resources as all.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to all  information resources.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2363.  DoD has defined the resources as all.'),\n('002364','draft','2013-06-26','DISA FSO','technical','The information system displays an explicit logout message to users indicating the reliable termination of authenticated communications sessions.','AC-12(1).3','The organization being inspected/assessed configures the information system to display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2364.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2364.'),\n('002365','draft','2013-06-26','DISA FSO','policy','The organization manages information system authenticators by requiring individuals to take specific security safeguards to protect authenticators.','IA-5.20','The organization being inspected/assessed documents within user agreements that individuals shall safeguard authenticators.','The organization conducting the inspection/assessment obtains and examines the user agreements of the organization being inspected/assessed to ensure that there are requirements for individuals to safeguard authenticators.'),\n('002366','draft','2013-06-26','DISA FSO','policy','The organization manages information system authenticators by having devices implement specific security safeguards to protect authenticators.','IA-5.21','The organization being inspected/assessed configures the information system to manage information system authenticators by having devices implement, specific security safeguards to protect authenticators.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2366.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  manage information system authenticators by having devices implement, specific security safeguards to protect authenticators.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2366.'),\n('002367','draft','2013-06-26','DISA FSO','policy','The organization ensures unencrypted static authenticators are not embedded in applications.','IA-5(7).3','The organization being inspected/assessed documents and implements requirements that  static authenticators are not embedded in applications.','The organization conducting the inspection/assessment obtains and examines the requirements that  static authenticators are not embedded in applications to ensure the organization being inspected/assessed  ensures unencrypted static authenticators are not embedded in applications.'),\n('002368','draft','2013-07-01','DISA FSO','policy','The organization defines the personnel or roles to whom the risk assessment policy is disseminated.','RA-1.1','DoD has defined the roles as at a minimum, the ISSM and ISSO.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.'),\n('002369','draft','2013-07-01','DISA FSO','policy','The organization defines the personnel or roles to whom the risk assessment procedures are disseminated.','RA-1.2','DoD has defined the roles as at a minimum, the ISSM and ISSO.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.'),\n('002370','draft','2013-07-01','DISA FSO','policy','The organization disseminates risk assessment results to organization-defined personnel or roles.','RA-3.6','The organization being inspected/assessed documents and implements a process to disseminates risk assessment results to the ISSM, ISSO, AO, and PM.  DoD has defined the personnel or roles as the ISSM, ISSO, AO, and PM.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed disseminates the risk assessment results to the ISSM, ISSO, AO, and PM.  DoD has defined the personnel or roles as the ISSM, ISSO, AO, and PM.'),\n('002371','draft','2013-07-01','DISA FSO','policy','The organization defines the personnel or roles to whom the risk assessment results will be disseminated.','RA-3.7','DoD has defined the personnel or roles as the ISSM, ISSO, AO, and PM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as the ISSM, ISSO, AO, and PM.'),\n('002372','draft','2013-07-01','DISA FSO','policy','The organization correlates the output from vulnerability scanning tools to determine the presence of multi-vulnerability/multi-hop attack vectors.','RA-5(10).1','The organization being inspected/assessed documents and implements a process to correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability/multi-hop attack vectors.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed correlates the output from vulnerability scanning tools to determine the presence of multi-vulnerability/ multi-hop attack vectors.'),\n('002373','draft','2013-07-01','DISA FSO','policy','The organization employs vulnerability scanning procedures that can identify the breadth and depth of coverage (i.e., information system components scanned and vulnerabilities checked).','RA-5(3).1','The organization being inspected/assessed employs the DoD Enterprise scanning tool.','The organization conducting the inspection/assessment obtains and examines the software list or vulnerability scanning procedures to ensure the organization being inspected/assessed employs the DoD Enterprise scanning tool.'),\n('002374','draft','2013-07-01','DISA FSO','policy','The organization defines the corrective actions when information about the information system is discoverable by adversaries.','RA-5(4).2','The organization being inspected/assessed defines and documents the corrective actions when information about the information system is discoverable by adversaries.  DoD has determined the corrective actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented corrective actions to ensure the organization being inspected/assessed  defines the corrective actions when information about the information system is discoverable by adversaries.  DoD has determined the corrective actions are not appropriate to define at the Enterprise level.'),\n('002375','draft','2013-07-02','DISA FSO','policy','The organization takes organization-defined corrective actions when information about the information system is discoverable by adversaries.','RA-5(4).3','The organization being inspected/assessed documents and implements a process to take the corrective actions defined in RA-5 (4), CCI 2374 when information about the information system is discoverable by adversaries.  The organization must maintain a record of actions taken.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of actions taken to ensure the organization being inspected/assessed takes the corrective actions defined in RA-5 (4), CCI 2374 when information about the information system is discoverable by adversaries.'),\n('002376','draft','2013-07-02','DISA FSO','policy','The organization defines the personnel or roles with whom the information obtained from the vulnerability scanning process and security control assessments will be shared.','RA-5.11','DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.'),\n('002377','draft','2013-07-02','DISA FSO','policy','The organization documents the system and communications protection policy.',NULL,NULL,NULL),\n('002378','draft','2013-07-02','DISA FSO','policy','The organization defines the personnel or roles to be recipients of the system and communications protection policy.','SC-1.1','The organization being inspected/assessed defines and documents personnel or roles to be recipients of the system and communications protection policy.  The personnel or roles must include at a minimum, the ISSM/ISSO.  DoD has defined the personnel or roles as at a minimum, the ISSO/ISSM.','The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles to be recipients of the system and communications protection policy. The personnel or roles must include at a minimum, the ISSM/ISSO.   DoD has defined the personnel or roles as at a minimum, the ISSO/ISSM.'),\n('002379','draft','2013-07-02','DISA FSO','policy','The organization documents procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.',NULL,NULL,NULL),\n('002380','draft','2013-07-02','DISA FSO','policy','The organization defines the personnel or roles to be recipients of the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.','SC-1.2','The organization being inspected/assessed defines and documents personnel or roles to be recipients of the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.  The personnel or roles must include at a minimum, the ISSM/ISSO.  DoD has defined the personnel or roles as at a minimum, the ISSO/ISSM.','The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles to be recipients of the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls. The personnel or roles must include at a minimum, the ISSM/ISSO.   DoD has defined the personnel or roles as at a minimum, the ISSO/ISSM.'),\n('002381','draft','2013-07-02','DISA FSO','technical','The organization minimizes the number of nonsecurity functions included within the isolation boundary containing security functions.','SC-3(3).1','The organization being inspected/assessed configures the information system to minimize the number of nonsecurity functions included within the isolation boundary containing security functions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2381.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to minimize the number of nonsecurity functions included within the isolation boundary containing security functions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2381.'),\n('002382','draft','2013-07-02','DISA FSO','technical','The organization implements security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules.','SC-3(4).1','The organization being inspected/assessed configures the information system to implement security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2382.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  implement security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2382.'),\n('002383','draft','2013-07-02','DISA FSO','policy','The organization defines the procedures to be employed to prevent unauthorized information transfer via shared resources when system processing explicitly switches between different information classification levels or security categories.','SC-4(2).1','The organization being inspected/assessed defines and documents the procedures to be employed to prevent the unauthorized information transfer via shared resources when system processing explicitly switches between different information classification levels or security categories.  DoD has determined the procedures are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented procedures to ensure the organization being inspected/assessed defines the procedures to be employed to prevent the unauthorized information transfer via shared resources when system processing explicitly switches between different information classification levels or security categories.  DoD has determined the procedures are not appropriate to define at the Enterprise level.'),\n('002384','draft','2013-07-02','DISA FSO','technical','The information system prevents unauthorized information transfer via shared resources in accordance with organization-defined procedures when system processing explicitly switches between different information classification levels or security categories.','SC-4(2).2','The organization being inspected/assessed configures the information system to prevent unauthorized information transfer via shared resources in accordance with procedures defined in SC-4 (2), CCI 2383 when system processing explicitly switches between different information classification levels or security categories.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2384.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to prevent unauthorized information transfer via shared resources in accordance with procedures defined in SC-4 (2), CCI 2383 when system processing explicitly switches between different information classification levels or security categories.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2384.'),\n('002385','draft','2013-07-02','DISA FSO','technical','The information system protects against or limits the effects of organization-defined types of denial of service attacks by employing organization-defined security safeguards.','SC-5.2','The organization being inspected/assessed configures the information system to protect against or limits the effects of types of denial of service attacks defined in SC-5, CCI 1093 by employing security safeguards defined in SC-5, CCI 2386.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2385.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to protect against or limits the effects of types of denial of service attacks defined in SC-5, CCI 1093 by employing security safeguards defined in SC-5, CCI 2386.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2385.'),\n('002386','draft','2013-07-02','DISA FSO','policy','The organization defines the security safeguards to be employed to protect the information system against, or limit the effects of, denial of service attacks.','SC-5.3','The organization being inspected/assessed defines and documents the security safeguards to be employed to protect the information system against, or limit the effects of, denial of service attacks.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines the security safeguards to be employed to protect the information system against, or limit the effects of, denial of service attacks.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002387','draft','2013-07-02','DISA FSO','policy','The organization defines the denial of service attacks against other information systems that the information system is to restrict the ability of individuals to launch.','SC-5(1).2','The organization being inspected/assessed defines and documents  the denial of service attacks against other information systems the information system is to restrict the ability of individuals to launch.  DoD has determined the denial of service attacks as not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented denial of service attacks to ensure the organization being inspected/assessed defines the denial of service attacks against other information systems the information system is to restrict the ability of individuals to launch.  DoD has determined the denial of service attacks as not appropriate to define at the Enterprise level.'),\n('002388','draft','2013-07-02','DISA FSO','policy','The organization defines a list of monitoring tools to be employed to detect indicators of denial of service attacks against the information system.','SC-5(3).1','The organization being inspected/assessed defines and documents a list of monitoring tools to be employed to detect indicators of denial of service attacks against the information system.  DoD has determined the monitoring tools are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented monitoring tools to ensure the organization being inspected/assessed defines a list of monitoring tools to be employed to detect indicators of denial of service attacks against the information system.  DoD has determined the monitoring tools are not appropriate to define at the Enterprise level.'),\n('002389','draft','2013-07-02','DISA FSO','policy','The organization employs an organization-defined list of monitoring tools to detect indicators of denial of service attacks against the information system.','SC-5(3).2','The organization being inspected/assessed implements the monitoring tools defined in SC-5 (3), CCI 2388 to detect indicators of denial of service attacks against the information system.','The organization conducting the inspection/assessment obtains and examines the list of monitoring tools as defined in SC-5 (3), CCI 2388 and a sampling of monitoring results to ensure the organization being inspected/assessed employs organization-defined list of monitoring tools to detect indicators of denial of service attacks against the information system.'),\n('002390','draft','2013-07-02','DISA FSO','policy','The organization defines the information system resources to be monitored to determine if sufficient resources exist to prevent effective denial of service attacks.','SC-5(3).3','The organization being inspected/assessed defines and documents the information system resources to be monitored to determine if sufficient resources exist to prevent effective denial of service attacks.  DoD has determined the information system resources are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system resources to ensure the organization being inspected/assessed  defines the information system resources to be monitored to determine if sufficient resources exist to prevent effective denial of service attacks.  DoD has determined the information system resources are not appropriate to define at the Enterprise level.'),\n('002391','draft','2013-07-02','DISA FSO','policy','The organization monitors organization-defined information system resources to determine if sufficient resources exist to prevent effective denial of service attacks.','SC-5(3).4','The organization being inspected/assessed monitors information system resources defined in SC-5 (3), CCI 2390 to determine if sufficient resources exist to prevent effective denial of service attacks.','The organization conducting the inspection/assessment obtains and examines the documented monitoring procedures and any available artifacts from the monitoring process to ensure the organization being inspected/assessed monitors information system resources defined in SC-5 (3), CCI 2390 to determine if sufficient resources exist to prevent effective denial of service attacks.'),\n('002392','draft','2013-07-02','DISA FSO','policy','The organization defines the resources to be allocated to protect the availability of information system resources.','SC-6.1','The organization being inspected/assessed defines and documents the resources to be allocated to protect the availability of information system resources.  DoD has determined the resources are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented resources to ensure the organization being inspected/assessed defines the resources to be allocated to protect the availability of information system resources.  DoD has determined the resources are not appropriate to define at the Enterprise level.'),\n('002393','draft','2013-07-02','DISA FSO','policy','The organization defines the security safeguards to be employed to protect the availability of information system resources.','SC-6.2','The organization being inspected/assessed defines and documents security safeguards to be employed to protect the availability of information system resources.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines the security safeguards to be employed to protect the availability of information system resources.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002394','draft','2013-07-02','DISA FSO','technical','The information system protects the availability of resources by allocating organization-defined resources based on priority, quota, and/or organization-defined security safeguards.','SC-6.3','The organization being inspected/assessed configures the information system to  protect the availability of resources by allocating  resources defined in SC-6, CCI 2392 based on priority, quota, and/or security safeguards defined in SC-6, CCI 2393.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2394.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to protect the availability of resources by allocating  resources defined in SC-6, CCI 2392 based on priority, quota, and/or security safeguards defined in SC-6, CCI 2393.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2394.'),\n('002395','draft','2013-07-02','DISA FSO','policy','The information system implements subnetworks for publicly accessible system components that are physically and/or logically separated from internal organizational networks.','SC-7.2','The organization being inspected/assessed designs the information system to leverage subnetworks so that publicly accessible system components are physically and/or logically separated from internal organizational networks.','The organization conducting the inspection/assessment obtains and examines network topology diagrams, architecture documentation, or any other documentation identifying component partitioning to ensure the organization being inspected/assessed implements subnetworks for publicly accessible system components that are physically and/or logically separated from internal organizational networks.'),\n('002396','draft','2013-07-02','DISA FSO','policy','The organization protects the confidentiality and integrity of the information being transmitted across each interface for each external telecommunication service.','SC-7(4).3','The organization being inspected/assessed documents and implements mechanisms to protect the confidentiality and integrity of the information being transmitted across each interface for each external telecommunication service.','The organization conducting the inspection/assessment obtains and examines the documented mechanisms to ensure the organization being inspected/assessed protects the confidentiality and integrity of the information being transmitted across each interface for each external telecommunication service.'),\n('002397','draft','2013-07-02','DISA FSO','technical','The information system, in conjunction with a remote device, prevents the device from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks.','SC-7(7).1','The organization being inspected/assessed configures the information system to prevent the device from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2397.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to prevent the device from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2397.'),\n('002398','draft','2013-07-02','DISA FSO','policy','The information system detects outgoing communications traffic posing a threat to external information systems.','SC-7(9).1','The organization being inspected/assessed configures the information system to detect outgoing communications traffic posing a threat to external information systems.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2398.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to detect outgoing communications traffic posing a threat to external information systems.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2398.'),\n('002399','draft','2013-07-02','DISA FSO','policy','The information system denies outgoing communications traffic posing a threat to external information systems.','SC-7(9).2','The organization being inspected/assessed configures the information system to deny outgoing communications traffic posing a threat to external information systems.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2399.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to deny outgoing communications traffic posing a threat to external information systems.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2399.'),\n('002400','draft','2013-07-02','DISA FSO','technical','The information system audits the identity of internal users associated with denied outgoing communications traffic posing a threat to external information systems.','SC-7(9).3','The organization being inspected/assessed configures the information system to audit the identity of internal users associated with denied outgoing communications traffic posing a threat to external information systems.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2400.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to audit the identity of internal users associated with denied outgoing communications traffic posing a threat to external information systems.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2400.'),\n('002401','draft','2013-07-02','DISA FSO','policy','The organization defines the authorized sources from which the information system will allow incoming communications.','SC-7(11).1','The organization being inspected/assessed defines and documents the  authorized sources from which the information system will allow incoming communications.  DoD has determined the authorized sources are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented authorized sources to ensure the organization being inspected/assessed  defines the authorized sources from which the information system will allow incoming communications.  DoD has determined the authorized sources are not appropriate to define at the Enterprise level.'),\n('002402','draft','2013-07-02','DISA FSO','policy','The organization defines the authorized destinations for routing inbound communications.','SC-7(11).2','The organization being inspected/assessed defines and documents the authorized destinations for routing inbound communications.  DoD has determined the authorized destinations are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented authorized destinations to ensure the organization being inspected/assessed  defines the authorized destinations for routing inbound communications.  DoD has determined the authorized destinations are not appropriate to define at the Enterprise level.'),\n('002403','draft','2013-07-02','DISA FSO','technical','The information system only allows incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.','SC-7(11).3','The organization being inspected/assessed configures the information system to allow incoming communications from  authorized sources defined in SC-7 (11), CCI 2401 routed to authorized destinations defined in SC-7 (11), CCI 2402.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2403.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to allow incoming communications from  authorized sources defined in SC-7 (11), CCI 2401 routed to authorized destinations defined in SC-7 (11), CCI 2402.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2403.'),\n('002404','draft','2013-07-02','DISA FSO','policy','The organization defines the host-based boundary protection mechanisms that are to be implemented at organization-defined information system components.','SC-7(12).1','DoD has defined the information system components as McAfee Host Intrusion Prevention (HIPS).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information system components as McAfee Host Intrusion Prevention (HIPS).'),\n('002405','draft','2013-07-02','DISA FSO','policy','The organization defines the information system components at which organization-defined host-based boundary protection mechanisms will be implemented.','SC-7(12).2','DoD has defined the information system components as all information system components.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information system components as all information system components.'),\n('002406','draft','2013-07-02','DISA FSO','policy','The organization implements organization-defined host-based boundary protection mechanisms at organization-defined information system components.','SC-7(12).3','The organization being inspected/assessed implements McAfee Host Intrusion Prevention (HIPS) on all information system components.  DoD has defined the host-based boundary protection mechanisms as McAfee Host Intrusion Prevention (HIPS).  DoD has defined the information system components as all information system components.','The organization conducting the inspection/assessment examines a sampling of information system components to ensure the organization being inspected/assessed implements McAfee Host Intrusion Prevention (HIPS) on all information system components.  DoD has defined the host-based boundary protection mechanisms as McAfee Host Intrusion Prevention (HIPS).  DoD has defined the information system components as all information system components.'),\n('002407','draft','2013-07-02','DISA FSO','policy','The organization defines the managed interfaces at which the organization protects against unauthorized physical connections.','SC-7(14).3','DoD has defined the managed interfaces as internet access points, enclave LAN to WAN, cross domain solutions, and any DoD Approved Alternate Gateways.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the managed interfaces as internet access points, enclave LAN to WAN, cross domain solutions, and any DoD Approved Alternate Gateways.'),\n('002408','draft','2013-07-02','DISA FSO','policy','The organization defines the independently configured communication clients, which are configured by end users and external service providers, between which the information system will block both inbound and outbound communications traffic.','SC-7(19).1','The organization being inspected/assessed defines and documents the independently configured communication clients, which are configured by end users and external service providers, between which the information system will block both inbound and outbound communications traffic.  DoD has determined the communication clients are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented communication clients to ensure the organization being inspected/assessed defines the independently configured communication clients, which are configured by end users and external service providers, between which the information system will block both inbound and outbound communications traffic.  DoD has determined the communication clients are not appropriate to define at the Enterprise level.'),\n('002409','draft','2013-07-02','DISA FSO','technical','The information system blocks both inbound and outbound communications traffic between organization-defined communication clients that are independently configured by end users and external service providers.','SC-7(19).2','The organization being inspected/assessed configures the information system to  block both inbound and outbound communications traffic between communication clients defined in SC-7 (19), CCI 2408 that are independently configured by end users and external service providers.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2409.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to block both inbound and outbound communications traffic between communication clients defined in SC-7 (19), CCI 2408 that are independently configured by end users and external service providers.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2409.'),\n('002410','draft','2013-07-02','DISA FSO','policy','The organization defines information system components that are to be dynamically isolated/segregated from other components of the information system.','SC-7(20).1','The organization being inspected/assessed defines and documents  information system components that are to be dynamically isolated/segregated from other components of the information system.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines information system components that are to be dynamically isolated/segregated from other components of the information system.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002411','draft','2013-07-02','DISA FSO','technical','The information system provides the capability to dynamically isolate/segregate organization-defined information system components from other components of the system.','SC-7(20).2','The organization being inspected/assessed configures the information system to provide the capability to dynamically isolate/segregate  information system components defined in SC-7 (20), CCI 2410 from other components of the system.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2411.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  provide the capability to dynamically isolate/segregate  information system components defined in SC-7 (20), CCI 2410 from other components of the system.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2411.'),\n('002412','deprecated','2013-07-02','DISA FSO','policy','The organization defines the information system components supporting organization-defined missions and/or business functions that are to be separated using boundary protection mechanisms.',NULL,NULL,NULL),\n('002413','draft','2013-07-02','DISA FSO','policy','The organization defines the information system components supporting organization-defined missions and/or business functions that are to be separated using boundary protection mechanisms.','SC-7(21).1','The organization being inspected/assessed defines and documents  the information system components supporting organization-defined missions and/or business functions that are to be separated using boundary protection mechanisms.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components supporting organization-defined missions and/or business functions that are to be separated using boundary protection mechanisms.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002414','draft','2013-07-02','DISA FSO','policy','The organization defines the missions and/or business functions for which boundary protection mechanisms will be employed to separate the supporting organization-defined information system components.','SC-7(21).2','The organization being inspected/assessed defines and documents  the missions and/or business functions for which boundary protection mechanisms will be employed to separate the supporting organization-defined information system components.  DoD has determined the missions and/or business functions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented missions and/or business functions to ensure the organization being inspected/assessed defines the missions and/or business functions for which boundary protection mechanisms will be employed to separate the supporting organization-defined information system components.  DoD has determined the missions and/or business functions are not appropriate to define at the Enterprise level.'),\n('002415','draft','2013-07-02','DISA FSO','policy','The organization employs boundary protection mechanisms to separate organization-defined information system components supporting organization-defined missions and/or business functions.','SC-7(21).3','The organization being inspected/assessed designs the information system to employ boundary protection mechanisms to separate  information system components defined in SC-7 (21), CCI 2413 supporting missions and/or business functions defined in SC-7 (21), CCI 2414.','The organization conducting the inspection/assessment obtains and examines network topology diagrams, architecture documentation, or any other documentation identifying component partitioning to ensure the organization being inspected/assessed  employs boundary protection mechanisms to separate  information system components defined in SC-7 (21), CCI 2413 supporting missions and/or business functions defined in SC-7 (21), CCI 2414.'),\n('002416','draft','2013-07-02','DISA FSO','policy','The information system implements separate network addresses (i.e., different subnets) to connect to systems in different security domains.','SC-7(22).1','The organization being inspected/assessed designs the information system to implement separate network addresses (i.e., different subnets) to connect to systems in different security domains.','The organization conducting the inspection/assessment obtains and examines network topology diagrams, architecture documentation, or any other documentation identifying component partitioning to ensure the organization being inspected/assessed  implements separate network addresses (i.e., different subnets) to connect to systems in different security domains.'),\n('002417','draft','2013-07-02','DISA FSO','technical','The information system disables feedback to senders on protocol format validation failure.','SC-7(23).1','The organization being inspected/assessed configures the information system to disable feedback to senders on protocol format validation failure   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2417.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to disable feedback to senders on protocol format validation failure   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2417.'),\n('002418','draft','2013-07-02','DISA FSO','policy','The information system protects the confidentiality and/or integrity of transmitted information.','SC-8.1','The organization being inspected/assessed configures the information system to protect the confidentiality and/or integrity of transmitted information.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2418.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to protect the confidentiality and/or integrity of transmitted information.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2418.'),\n('002419','draft','2013-07-02','DISA FSO','policy','The organization defines the alternative physical safeguards to be employed when cryptographic mechanisms are not implemented to protect information during transmission.','SC-8(1).1','DoD has defined the alternative physical safeguards as Protected Distribution System (PDS).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the alternative physical safeguards as Protected Distribution System (PDS).'),\n('002420','draft','2013-07-02','DISA FSO','technical','The information system maintains the confidentiality and/or integrity of information during preparation for transmission.','SC-8(2).1','The organization being inspected/assessed configures the information system to maintain the confidentiality and integrity of information during preparation for transmission.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2420.  DoD has defined the selection as both confidentiality and integrity.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to maintain the confidentiality and integrity of information during preparation for transmission.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2420.'),\n('002421','draft','2013-07-02','DISA FSO','technical','The information system implements cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by organization-defined alternative physical safeguards.','SC-8(1).2','The organization being inspected/assessed configures the information system to  implement cryptographic mechanisms to prevent unauthorized disclosure of information and detect changes to information during transmission unless otherwise protected by Protected Distribution System (PDS).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2421.  DoD has defined the selection as both prevention of unauthorized disclosure and detection of changes to information.  DoD has defined the alternative physical safeguards as Protected Distribution System (PDS).','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement cryptographic mechanisms to prevent unauthorized disclosure of information and detect changes to information during transmission unless otherwise protected by Protected Distribution System (PDS).   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2421.  DoD has defined the alternative physical safeguards as Protected Distribution System (PDS).'),\n('002422','draft','2013-07-02','DISA FSO','technical','The information system maintains the confidentiality and/or integrity of information during reception.','SC-8(2).2','The organization being inspected/assessed configures the information system to maintain the confidentiality and integrity of information during reception.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2422.  DoD has defined the selection as both confidentiality and integrity.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to maintain the confidentiality and integrity of information during reception.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2422.'),\n('002423','draft','2013-07-02','DISA FSO','technical','The information system implements cryptographic mechanisms to protect message externals (e.g., message headers and routing information) unless otherwise protected by organization-defined alternative physical safeguards.','SC-8(3).1','The organization being inspected/assessed configures the information system to implement cryptographic mechanisms to protect message externals (e.g., message headers and routing information) unless otherwise protected by Protected Distribution System (PDS).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2423.  DoD has defined the alternative physical safeguards as Protected Distribution System (PDS).','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement cryptographic mechanisms to protect message externals (e.g., message headers and routing information) unless otherwise protected by Protected Distribution System (PDS).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2423.  DoD has defined the alternative physical safeguards as Protected Distribution System (PDS).'),\n('002424','draft','2013-07-02','DISA FSO','policy','The organization defines the alternative physical safeguards to be employed when cryptographic mechanisms are not implemented by the information system.','SC-8(4).1','DoD has defined the alternative physical safeguards as Protected Distribution System (PDS).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the alternative physical safeguards as Protected Distribution System (PDS).'),\n('002425','draft','2013-07-02','DISA FSO','technical','The information system implements cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by organization-defined alternative physical safeguards.','SC-8(4).2','The organization being inspected/assessed configures the information system to  implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by Protected Distribution System (PDS).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2426.  DoD has defined the alternative physical safeguards as Protected Distribution System (PDS).','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by Protected Distribution System (PDS).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2426.  DoD has defined the alternative physical safeguards as Protected Distribution System (PDS).'),\n('002426','draft','2013-07-02','DISA FSO','technical','The information system provides a trusted communications path that is logically isolated and distinguishable from other paths.','SC-11(1).1','The organization being inspected/assessed configures the information system to provide a trusted communications path that is logically isolated and distinguishable from other paths.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2426.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide a trusted communications path that is logically isolated and distinguishable from other paths.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2426.'),\n('002427','draft','2013-07-02','DISA FSO','policy','The organization defines the alternative physical safeguards to be employed to protect message externals (e.g., message headers and routing information) when cryptographic mechanisms are not implemented.','SC-8(3).2','DoD has defined the alternative physical safeguards as Protected Distribution System (PDS).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the alternative physical safeguards as Protected Distribution System (PDS).'),\n('002428','draft','2013-07-02','DISA FSO','policy','The organization defines the requirements for cryptographic key generation to be employed within the information system.','SC-12.1','DoD has defined the requirements for key generation as requirements for key generation defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the requirements for key generation as requirements for key generation defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002429','draft','2013-07-02','DISA FSO','policy','The organization defines the requirements for cryptographic key distribution to be employed within the information system.','SC-12.2','DoD has defined the requirements for key distribution as  requirements for key distribution defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the requirements for key distribution as  requirements for key distribution defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002430','draft','2013-07-02','DISA FSO','policy','The organization defines the requirements for cryptographic key storage to be employed within the information system.','SC-12.3','DoD has defined the requirements for key storage as  requirements for key storage defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the requirements for key storage as  requirements for key storage defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002431','draft','2013-07-02','DISA FSO','policy','The organization defines the requirements for cryptographic key access to be employed within the information system.','SC-12.4','DoD has defined the requirements for key access as  requirements for key access defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.   DoD has defined the requirements for key access as  requirements for key access defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002432','draft','2013-07-02','DISA FSO','policy','The organization defines the requirements for cryptographic key destruction to be employed within the information system.','SC-12.5','DoD has defined the requirements for key destruction as  requirements for key destruction defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the requirements for key destruction as  requirements for key destruction defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002433','draft','2013-07-02','DISA FSO','policy','The organization establishes cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key generation.','SC-12.6','The organization being inspected/assessed documents and implements a process to establish  cryptographic keys for required cryptography employed within the information system in accordance with requirements for key generation  defined in  DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key generation as  requirements for key generation defined in  DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed establishes cryptographic keys for required cryptography employed within the information system in accordance with requirements for key generation defined in  DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key generation as  requirements for key generation  defined in  DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002434','draft','2013-07-02','DISA FSO','policy','The organization establishes cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key distribution.','SC-12.7','The organization being inspected/assessed documents and implements a process to establish  cryptographic keys for required cryptography employed within the information system in accordance with requirements for key distribution defined in  DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key distribution as requirements for key distribution defined in  DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed establishes cryptographic keys for required cryptography employed within the information system in accordance with requirements for key distribution defined in  DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key distribution as requirements for key distribution defined in  DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002435','draft','2013-07-02','DISA FSO','policy','The organization establishes cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key storage.','SC-12.8','The organization being inspected/assessed documents and implements a process to establish  cryptographic keys for required cryptography employed within the information system in accordance with requirements for key storage defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key storage as  requirements for key storage defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed establishes cryptographic keys for required cryptography employed within the information system in accordance with requirements for key storage defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key storage as  requirements for key storage defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002436','draft','2013-07-02','DISA FSO','policy','The organization establishes cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key access.','SC-12.9','The organization being inspected/assessed documents and implements a process to establish  cryptographic keys for required cryptography employed within the information system in accordance with requirements for key access defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key access as  requirements for key access defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed establishes cryptographic keys for required cryptography employed within the information system in accordance with requirements for key access defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key access as  requirements for key access defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002437','draft','2013-07-02','DISA FSO','policy','The organization establishes cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key destruction.','SC-12.10','The organization being inspected/assessed documents and implements a process to establish  cryptographic keys for required cryptography employed within the information system in accordance with requirements for key destruction defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key destruction as requirements for key destruction defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed establishes cryptographic keys for required cryptography employed within the information system in accordance with requirements for key destruction defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key destruction as requirements for key destruction defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002438','draft','2013-07-02','DISA FSO','policy','The organization manages cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key generation.','SC-12.11','The organization being inspected/assessed documents and implements a process to manage cryptographic keys for required cryptography employed within the information system in accordance with requirements for key destruction defined DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key generation as requirements for key destruction defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed manages cryptographic keys for required cryptography employed within the information system in accordance with  requirements for key destruction defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key generation as requirements for key destruction defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002439','draft','2013-07-02','DISA FSO','policy','The organization manages cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key distribution.','SC-12.12','The organization being inspected/assessed documents and implements a process to manage cryptographic keys for required cryptography employed within the information system in accordance with requirements for key distribution defined in  DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key distribution as requirements for key distribution defined in  DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed manages cryptographic keys for required cryptography employed within the information system in accordance with  requirements for key distribution defined in  DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key distribution as requirements for key distribution defined in  DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002440','draft','2013-07-02','DISA FSO','policy','The organization manages cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key storage.','SC-12.13','The organization being inspected/assessed documents and implements a process to manage cryptographic keys for required cryptography employed within the information system in accordance with requirements for key storage defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key storage as  requirements for key storage defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed manages cryptographic keys for required cryptography employed within the information system in accordance with requirements for key storage defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key storage as  requirements for key storage defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002441','draft','2013-07-02','DISA FSO','policy','The organization manages cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key access.','SC-12.14','The organization being inspected/assessed documents and implements a process to manage cryptographic keys for required cryptography employed within the information system in accordance with requirements for key access defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key access as  requirements for key access defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed manages cryptographic keys for required cryptography employed within the information system in accordance with requirements for key access defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key access as  requirements for key access defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002442','draft','2013-07-02','DISA FSO','policy','The organization manages cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key destruction.','SC-12.15','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed manages cryptographic keys for required cryptography employed within the information system in accordance with  requirements for key destruction defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key destruction as requirements for key destruction defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"','The organization being inspected/assessed documents and implements a process to manage cryptographic keys for required cryptography employed within the information system in accordance with requirements for key destruction defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"   DoD has defined the requirements for key destruction as requirements for key destruction defined in DoDI 8520.02 \\\"Public Key Infrastructure and Public Key Enabling\\\" and DoDI 8520.03 \\\"Identity Authentication for Information Systems.\\\"'),\n('002443','draft','2013-07-02','DISA FSO','policy','The organization produces symmetric cryptographic keys using NIST FIPS-compliant or NSA-approved key management technology and processes.','SC-12(2).1','The organization being inspected/assessed documents and implements a process to produce symmetric cryptographic keys using NIST FIPS-compliant or NSA-approved key management technology and processes.  An example process would be implementation of Key Management Infrastructure (KMI).  DoD requires a minimum of NIST approved cryptography for unclassified systems.  Classified systems require NSA approved cryptography.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed produces appropriate symmetric cryptographic keys using NIST FIPS-compliant or NSA-approved key management technology and processes.'),\n('002444','draft','2013-07-02','DISA FSO','policy','The organization controls symmetric cryptographic keys using NIST FIPS-compliant or NSA-approved key management technology and processes.','SC-12(2).2','The organization being inspected/assessed documents and implements a process to control symmetric cryptographic keys using NIST FIPS-compliant or NSA-approved key management technology and processes.  An example process would be implementation of Key Management Infrastructure (KMI).  DoD requires a minimum of NIST approved cryptography for unclassified systems.  Classified systems require NSA approved cryptography.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  controls appropriate symmetric cryptographic keys using NIST FIPS-compliant or NSA-approved key management technology and processes.'),\n('002445','draft','2013-07-02','DISA FSO','policy','The organization distributes symmetric cryptographic keys using NIST FIPS-compliant or NSA-approved key management technology and processes.','SC-12(2).3','The organization being inspected/assessed documents and implements a process to distribute symmetric cryptographic keys using NIST FIPS-compliant or NSA-approved key management technology and processes.  DoD requires a minimum of NIST approved cryptography for unclassified systems.  Classified systems require NSA approved cryptography.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed distributes appropriate symmetric cryptographic keys using NIST FIPS-compliant or NSA-approved key management technology and processes.'),\n('002446','draft','2013-07-02','DISA FSO','policy','The organization produces asymmetric cryptographic keys using: NSA-approved key management technology and processes; approved PKI Class 3 certificates or prepositioned keying material; or approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user^s private key.','SC-12(3).1','The organization being inspected/assessed implements a process to produce asymmetric cryptographic keys using: NSA-approved key management technology and processes; approved PKI medium certificates or prepositioned keying material; or, approved PKI medium or FORTEZZA certificates and hardware security tokens that protect the user\\'s private key.','The organization conducting the inspection/assessment obtains and examines any applicable evidence of asymmetric cryptographic key production to ensure the organization being inspected/assessed  produces asymmetric cryptographic keys using: NSA-approved key management technology and processes; approved PKI medium certificates or prepositioned keying material; or, approved PKI medium or FORTEZZA certificates and hardware security tokens that protect the user\\'s private key.'),\n('002447','draft','2013-07-02','DISA FSO','policy','The organization controls asymmetric cryptographic keys using: NSA-approved key management technology and processes; approved PKI Class 3 certificates or prepositioned keying material; or approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user^s private key.','SC-12(3).2','The organization being inspected/assessed implements a process to control asymmetric cryptographic keys using: NSA-approved key management technology and processes; approved PKI medium certificates or prepositioned keying material; or, approved PKI medium or FORTEZZA certificates and hardware security tokens that protect the user\\'s private key.','The organization conducting the inspection/assessment obtains and examines any applicable evidence of asymmetric cryptographic key control to ensure the organization being inspected/assessed  controls asymmetric cryptographic keys using: NSA-approved key management technology and processes; approved PKI medium certificates or prepositioned keying material; or, approved PKI medium or FORTEZZA certificates and hardware security tokens that protect the user\\'s private key.'),\n('002448','draft','2013-07-02','DISA FSO','policy','The organization distributes asymmetric cryptographic keys using: NSA-approved key management technology and processes; approved PKI Class 3 certificates or prepositioned keying material; or approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user^s private key.','SC-12(3).3','The organization being inspected/assessed implements a process to distribute asymmetric cryptographic keys using: NSA-approved key management technology and processes; approved PKI medium certificates or prepositioned keying material; or, approved PKI medium or FORTEZZA certificates and hardware security tokens that protect the user\\'s private key.','The organization conducting the inspection/assessment obtains and examines any applicable evidence of asymmetric cryptographic key distribution to ensure the organization being inspected/assessed  distributes asymmetric cryptographic keys using: NSA-approved key management technology and processes; approved PKI medium certificates or prepositioned keying material; or, approved PKI medium or FORTEZZA certificates and hardware security tokens that protect the user\\'s private key.'),\n('002449','draft','2013-07-02','DISA FSO','policy','The organization defines the cryptographic uses, and type of cryptography required for each use, to be implemented by the information system.','SC-13.1','DoD has defined the cryptographic uses and type of cryptography required for each use as protection of classified information: NSA-approved cryptography; provision of digital signatures and hashing: FIPS-validated cryptography.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the cryptographic uses and type of cryptography required for each use as protection of classified information: NSA-approved cryptography; provision of digital signatures and hashing: FIPS-validated cryptography.'),\n('002450','draft','2013-07-02','DISA FSO','technical','The information system implements organization-defined cryptographic uses and type of cryptography required for each use in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.','SC-13.2','The organization being inspected/assessed configures the information system to implement, for, protection of classified information: NSA-approved cryptography; for provision of digital signatures and hashing: FIPS-validated cryptography in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2450.  DoD has defined the cryptographic uses and type of cryptography required for each use as protection of classified information: NSA-approved cryptography; provision of digital signatures and hashing: FIPS-validated cryptography.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement, for, protection of classified information: NSA-approved cryptography; for provision of digital signatures and hashing: FIPS-validated cryptography in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2450.  DoD has defined the cryptographic uses and type of cryptography required for each use as protection of classified information: NSA-approved cryptography; provision of digital signatures and hashing: FIPS-validated cryptography.'),\n('002451','draft','2013-07-02','DISA FSO','policy','The organization defines the information systems or information system components from which collaborative computing devices in organization-defined secure work areas are to be disabled or removed.','SC-15(3).3','DoD has defined information systems or information system components as any device used that may incorporate camera, microphone, or smart board capability.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined information systems or information system components as any device used that may incorporate camera, microphone, or smart board capability.'),\n('002452','draft','2013-07-02','DISA FSO','policy','The organization defines the online meetings and teleconferences for which the information system provides an explicit indication of current participants.','SC-15(4).1','DoD has defined the online meetings and teleconferences as all VTC and all IP based online meetings and conferences (excludes audio only teleconferences using traditional telephony).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the online meetings and teleconferences as all VTC and all IP based online meetings and conferences (excludes audio only teleconferences using traditional telephony).'),\n('002453','draft','2013-07-02','DISA FSO','technical','The information system provides an explicit indication of current participants in organization-defined online meetings and teleconferences.','SC-15(4).2','The organization being inspected/assessed configures the information system to provide an explicit indication of current participants in all VTC and all IP based online meetings and conferences (excludes audio only teleconferences using traditional telephony).  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2453.  DoD has defined the online meetings and teleconferences as all VTC and all IP based online meetings and conferences (excludes audio only teleconferences using traditional telephony).','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  provide an explicit indication of current participants in all VTC and all IP based online meetings and conferences (excludes audio only teleconferences using traditional telephony).  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2453.  DoD has defined the online meetings and teleconferences as all VTC and all IP based online meetings and conferences (excludes audio only teleconferences using traditional telephony).'),\n('002454','draft','2013-07-02','DISA FSO','policy','The organization defines the security attributes the information system is to associate with the information being exchanged between information systems and between information system components.','SC-16.2','The organization being inspected/assessed defines and documents the security attributes the information system is to associate with the information being exchanged between information systems and between information system components.  DoD has determined the security attributes are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security attributes to ensure the organization being inspected/assessed defines the security attributes the information system is to associate with the information being exchanged between information systems and between information system components.  DoD has determined the security attributes are not appropriate to define at the Enterprise level.'),\n('002455','draft','2013-07-02','DISA FSO','technical','The information system associates organization-defined security attributes with information exchanged between information system components.','SC-16.3','The organization being inspected/assessed configures the information system to associate the security attributes defined in SC-16, CCI  2454 with information exchanged between information system components.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2455.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to associate the security attributes defined in SC-16, CCI  2454 with information exchanged between information system components.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2455.'),\n('002456','draft','2013-07-02','DISA FSO','policy','The organization defines the certificate policy employed to issue public key certificates.','SC-17.2','DoD has defined the certificate policy as DoDI 8520.02, \\\"Public Key Infrastructure (PKI) and Public Key (PK) Enabling.\\\"','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the certificate policy as DoDI 8520.02, \\\"Public Key Infrastructure (PKI) and Public Key (PK) Enabling.'),\n('002457','draft','2013-07-02','DISA FSO','policy','The organization defines the corrective actions to be taken when organization-defined unacceptable mobile code is identified.','SC-18(1).3','DoD has defined the corrective actions to be taken when organization-defined unacceptable mobile code is identified as the corrective actions defined in the Protection Profile for Web Browsers and Application SRG.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\nDoD has defined the corrective actions to be taken when organization-defined unacceptable mobile code is identified as the corrective actions defined in the Protection Profile for Web Browsers and Application SRG.'),\n('002458','draft','2013-07-02','DISA FSO','policy','The organization defines what constitutes unacceptable mobile code for its information systems.','SC-18(1).4','The organization being inspected/assessed defines and documents unacceptable mobile code IAW the Protection Profile for Web Browsers  and Application SRG.\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must define IAW the STIG/SRG guidance that pertains to CCI 2458.\\nDoD has determined the unacceptable mobile code is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented acceptable and unacceptable mobile code and mobile code technologies to ensure the organization being inspected/assessed defines unacceptable mobile code IAW the Protection Profile for Web Browsers  and Application SRG.\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has defined unacceptable mobile code IAW the applicable STIGs and SRGs pertaining to CCI 2458.\\nDoD has determined the unacceptable mobile code is not appropriate to define at the Enterprise level.'),\n('002459','draft','2013-07-02','DISA FSO','policy','The organization defines the unacceptable mobile code of which the information system is to prevent download and execution.','SC-18(3).3','The organization being inspected/assessed defines and documents unacceptable mobile code of which the information system is to prevent download and execution IAW the Protection Profile for Web Browsers  and Application SRG.\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must define IAW the STIG/SRG guidance that pertains to CCI 2459.\\nDoD has determined the unacceptable mobile code is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented unacceptable mobile code to ensure the organization being inspected/assessed defines unacceptable mobile code of which the information system is to prevent download and execution IAW the Protection Profile for Web Browsers  and Application SRG.\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has defined unacceptable mobile code IAW the applicable STIGs and SRGs pertaining to CCI 2459.\\nDoD has determined the unacceptable mobile code is not appropriate to define at the Enterprise level.'),\n('002460','draft','2013-07-02','DISA FSO','technical','The information system enforces organization-defined actions prior to executing mobile code.','SC-18(4).4','The organization being inspected/assessed configures the information system to prompt the user prior to executing the code.\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2460.\\nDoD has defined the actions as the user be prompted.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  prompt the user prior to executing the code.\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2460.\\nDoD has defined the actions as the user be prompted.'),\n('002461','draft','2013-07-02','DISA FSO','policy','The organization allows execution of permitted mobile code only in confined virtual machine environments.','SC-18(5).1','The organization being inspected/assessed documents within the system and communications protection policy and implements mechanisms to allow the execution of permitted mobile code only in confined virtual machine environments.\\n\\nUnacceptable mobile code is defined in SC-18 (3).','The organization conducting the inspection/assessment obtains and examines the system and communications protection policy and inspects the information systems to ensure the organization being inspected/assessed implements mechanisms to allow the execution of permitted mobile code only in confined virtual machine environments.'),\n('002462','draft','2013-07-02','DISA FSO','technical','The information system provides additional data integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.','SC-20.2','The organization being inspected/assessed configures the  authoritative name server software for external queries to enable DNSSEC and creates resource records with digital signatures (RRSig) for each A record.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that determines the  name server software configuration files and pertains to CCI 2462.','The organization conducting the inspection/assessment:\\n1. inspects the configuration files for the presence of DNSSEC records for each A record hosted in a zone;\\n2. utilizes DNSSEC diagnostic tools, such as dig; and\\n3. performs queries which will exercise the data flow path for authoritative name resolution services.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs that determine the  name server software configuration files and pertain to CCI 2462.'),\n('002463','draft','2013-07-02','DISA FSO','technical','The information system provides data origin artifacts for internal name/address resolution queries.','SC-20(2).1','The organization being inspected/assessed configures the authoritative name server software for internal queries to enable DNSSEC and creates resource records with digital signatures (RRSig) for each A record.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that determines the  name server software configuration files and pertains to CCI 2463.','The organization conducting the inspection/assessment:\\n1. inspects the configuration files for the presence of DNSSEC records for each A record hosted in a zone;\\n2. utilizes DNSSEC diagnostic tools, such as dig; and\\n3. performs queries which will exercise the data flow path for authoritative name resolution services.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs that determine the  name server software configuration files and pertain to CCI 2463.'),\n('002464','draft','2013-07-02','DISA FSO','technical','The information system provides data integrity protection artifacts for internal name/address resolution queries.','SC-20(2).2','The organization being inspected/assessed configures the authoritative name server software for internal software to enable DNSSEC and creates resource records with digital signatures(RRSig) for each A record.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that determines the  name server software configuration files and pertains to CCI 2464.','The organization conducting the inspection/assessment:\\n1. inspects the configuration files for the presence of DNSSEC records for each A record hosted in a zone;\\n2. utilizes DNSSEC diagnostic tools, such as dig; and\\n3. performs queries which will exercise the data flow path for authoritative name resolution services.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs that determine the  name server software configuration files and pertain to CCI 2464.'),\n('002465','draft','2013-07-02','DISA FSO','technical','The information system requests data origin authentication verification on the name/address resolution responses the system receives from authoritative sources.','SC-21.1','The organization being inspected/assessed configures the:\\n1. recursive/caching name server software  to enable DNSSEC;\\n2. software to enable DNSSEC validation; and\\n3. software to establish a secure entry point trust anchor by installing key signing keys in the software configuration of trusted keys.   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that determines the  name server software configuration files and pertains to CCI 2465.','The organization conducting the inspection/assessment utilizes DNSSEC diagnostic tools, such as dig, and performs queries which will exercise the data flow path for recursive name resolution services.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs that determine the  name server software configuration files and pertain to CCI 2465.'),\n('002466','draft','2013-07-02','DISA FSO','technical','The information system requests data integrity verification on the name/address resolution responses the system receives from authoritative sources.','SC-21.2','The organization being inspected/assessed configures the:\\n1. recursive/caching name server software  to enable DNSSEC;\\n2. software to enable DNSSEC validation; and\\n3. software to establish a secure entry point trust anchor by installing key signing keys in the software configuration of trusted keys.   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that determines the  name server software configuration files and pertains to CCI 2466.','The organization conducting the inspection/assessment utilizes DNSSEC diagnostic tools, such as dig, and performs queries which will exercise the data flow path for recursive name resolution services.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs that determine the  name server software configuration files and pertain to CCI 2466.'),\n('002467','draft','2013-07-02','DISA FSO','technical','The information system performs data integrity verification on the name/address resolution responses the system receives from authoritative sources.','SC-21.3','The organization being inspected/assessed configures the:\\n1. recursive/caching name server software  to enable DNSSEC;\\n2. software to enable DNSSEC validation; and\\n3. software to establish a secure entry point trust anchor by installing key signing keys in the software configuration of trusted keys.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that determines the  name server software configuration files and pertains to CCI 2467.','The organization conducting the inspection/assessment utilizes DNSSEC diagnostic tools, such as dig, and performs queries which will exercise the data flow path for recursive name resolution services.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs that determine the  name server software configuration files and pertain to CCI 2467.'),\n('002468','draft','2013-07-02','DISA FSO','technical','The information system performs data origin verification authentication on the name/address resolution responses the system receives from authoritative sources.','SC-21.4','The organization being inspected/assessed configures the:\\n1. recursive/caching name server software  to enable DNSSEC;\\n2. software to enable DNSSEC validation; and\\n3. software to establish a secure entry point trust anchor by installing key signing keys in the software configuration of trusted keys.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that determines the  name server software configuration files and pertains to CCI 2468.','The organization conducting the inspection/assessment utilizes DNSSEC diagnostic tools, such as dig, and performs queries which will exercise the data flow path for recursive name resolution services.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs that determine the  name server software configuration files and pertain to CCI 2468.'),\n('002469','draft','2013-07-02','DISA FSO','policy','The organization defines the certificate authorities the information system will allow to be used on the information system.','SC-23(5).1','DoD has defined the certificate authorities as DoD PKI established certificate authorities.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the certificate authorities as DoD PKI established certificate authorities.'),\n('002470','draft','2013-07-02','DISA FSO','technical','The information system only allows the use of organization-defined certificate authorities for verification of the establishment of protected sessions.','SC-23(5).2','The organization being inspected/assessed configures the information system to allow the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2470.  DoD has defined the certificate authorities as DoD PKI established certificate authorities.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to allow the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2470.  DoD has defined the certificate authorities as DoD PKI established certificate authorities.'),\n('002471','draft','2013-07-02','DISA FSO','policy','The organization defines the information system components, with minimal functionality and information storage, to be employed.','SC-25.2','The organization being inspected/assessed defines and documents the information system components, with minimal functionality and information storage, to be employed.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components, with minimal functionality and information storage, to be employed.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002472','draft','2013-07-02','DISA FSO','policy','The organization defines the information at rest that is to be protected by the information system.','SC-28.2','The organization being inspected/assessed defines and documents  the information at rest that is to be protected by the information system which must include, at a minimum, PII and classified information.  DoD has determined the information at rest is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information at rest to ensure the organization being inspected/assessed defines and documents  the information at rest that is to be protected by the information system which must include, at a minimum, PII and classified information.   DoD has determined the information at rest is not appropriate to define at the Enterprise level.'),\n('002473','draft','2013-07-02','DISA FSO','policy','The organization defines the information at rest for which cryptographic mechanisms will be implemented.','SC-28(1).1','The organization being inspected/assessed defines and documents  the information at rest that is to be protected by the information system which must include, at a minimum, PII and classified information.  DoD has determined the information at rest is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information at rest to ensure the organization being inspected/assessed defines and documents  the information at rest that is to be protected by the information system which must include, at a minimum, PII and classified information.   DoD has determined the information at rest is not appropriate to define at the Enterprise level.'),\n('002474','draft','2013-07-02','DISA FSO','policy','The organization defines the information system components which require the implementation of cryptographic mechanisms to prevent unauthorized disclosure and modification of organization-defined information at rest.','SC-28(1).2','DoD has defined the information system components as any information system components storing data defined in SC-28 (1), 2473.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information system components as any information system components storing data defined in SC-28 (1), 2473.'),\n('002475','draft','2013-07-02','DISA FSO','technical','The information system implements cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined information system components.','SC-28(1).3','The organization being inspected/assessed configures the information system to implement cryptographic mechanisms to prevent unauthorized modification of information at rest defined in SC-28 (1), CCI 2473 on any information system components storing data defined in SC-28 (1), 2473.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2475.  DoD has defined the information system components as any information system components storing data defined in SC-28 (1), 2473.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement cryptographic mechanisms to prevent unauthorized modification of information at rest defined in SC-28 (1), CCI 2473 on any information system components storing data defined in SC-28 (1), 2473.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2475.  DoD has defined the information system components as any information system components storing data defined in SC-28 (1), 2473.'),\n('002476','draft','2013-07-02','DISA FSO','technical','The information system implements cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined information system components.','SC-28(1).4','The organization being inspected/assessed configures the information system to  implement cryptographic mechanisms to prevent unauthorized disclosure of information at rest defined in SC-28 (1), CCI 2473 on any information system components storing data defined in SC-28 (1), 2473.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2476.  DoD has defined the information system components as any information system components storing data defined in SC-28 (1), 2473.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement cryptographic mechanisms to prevent unauthorized disclosure of information at rest defined in SC-28 (1), CCI 2473 on any information system components storing data defined in SC-28 (1), 2473.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2476.  DoD has defined the information system components as any information system components storing data defined in SC-28 (1), 2473.'),\n('002477','draft','2013-07-02','DISA FSO','policy','The organization defines the information at rest to be removed from online storage and stored in an off-line secure location.','SC-28(2).1','The organization being inspected/assessed defines and documents the information at rest to be removed from on-line storage and stored in an off-line secure location.  DoD has determined the information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information to ensure the organization being inspected/assessed defines the information at rest to be removed from on-line storage and stored in an off-line secure location.  DoD has determined the information is not appropriate to define at the Enterprise level.'),\n('002478','draft','2013-07-02','DISA FSO','policy','The organization removes organization-defined information at rest from online storage.','SC-28(2).2','The organization being inspected/assessed documents and implements a process to remove information at rest defined in SC-28 (2), CCI 2477 from online storage.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed removes information at rest defined in SC-28 (2), CCI 2477 from online storage.  Additionally, the organization conducting the inspection/assessment examines the information system to ensure that information defined in SC-28 (2), CCI 2477 is not stored on the information system.'),\n('002479','draft','2013-07-02','DISA FSO','policy','The organization stores organization-defined information at rest in an off-line secure location.','SC-28(2).3','The organization being inspected/assessed documents and implements a process to store information at rest defined in SC-28 (2), CCI 2477  in an off-line secure location.','The organization conducting the inspection/assessment obtains and examines the documented process and off-line storage records to ensure the organization being inspected/assessed stores information at rest defined in SC-28 (2), CCI 2477  in an off-line secure location.'),\n('002480','draft','2013-07-02','DISA FSO','policy','The organization defines the information system components for which a diverse set of information technologies are to be employed.','SC-29.2','The organization being inspected/assessed defines and documents the information system components for which a diverse set of information technologies are to be employed.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed  defines the information system components for which a diverse set of information technologies are to be employed.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002481','draft','2013-07-02','DISA FSP','policy','The organization employs virtualization techniques to support the deployment of a diversity of applications that are changed per organization-defined frequency.','SC-29(1).3','The organization being inspected/assessed designs the information system to employ virtualization techniques to support the deployment of a diversity of applications that are changed per the frequency defined in SC-29 (1), CCI 1204.','The organization conducting the inspection/assessment obtains and examines the hardware and software lists to ensure the organization being inspected/assessed employs virtualization techniques to support the deployment of a diversity of applications that are changed per the frequency defined in SC-29 (1), CCI 1204.'),\n('002482','draft','2013-07-02','DISA FSO','policy','The organization defines the concealment and misdirection techniques employed for organization-defined information systems to confuse and mislead adversaries.','SC-30.1','The organization being inspected/assessed defines and documents the concealment and misdirection techniques employed for organization-defined information systems to confuse and mislead adversaries.  DoD has determined the concealment and misdirection techniques are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented concealment and misdirection techniques to ensure the organization being inspected/assessed   defines the concealment and misdirection techniques employed for organization-defined information systems to confuse and mislead adversaries..\\nDoD has determined the concealment and misdirection techniques are not appropriate to define at the Enterprise level.'),\n('002483','draft','2013-07-02','DISA FSO','policy','The organization defines the information systems for which organization-defined concealment and misdirection techniques are to be employed.','SC-30.2','The organization being inspected/assessed defines and documents the information systems for which organization-defined concealment and misdirection techniques are to be employed.  DoD has determined the information systems are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information systems to ensure the organization being inspected/assessed  defines the information systems for which organization-defined concealment and misdirection techniques are to be employed.  DoD has determined the information systems are not appropriate to define at the Enterprise level.'),\n('002484','draft','2013-07-02','DISA FSO','policy','The organization defines the time periods at which it will employ organization-defined concealment and misdirection techniques on organization-defined information systems.','SC-30.3','The organization being inspected/assessed defines and documents the time periods at which it will employ organization-defined concealment and misdirection techniques on organization-defined information systems.  DoD has determined the time periods are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented time periods to ensure the organization being inspected/assessed defines the time periods at which it will employ organization-defined concealment and misdirection techniques on organization-defined information systems.  DoD has determined the time periods are not appropriate to define at the Enterprise level.'),\n('002485','draft','2013-07-02','DISA FSO','policy','The organization employs organization-defined concealment and misdirection techniques for organization-defined information systems at organization-defined time periods to confuse and mislead adversaries.','SC-30.4','The organization being inspected/assessed designs the information system to employ  concealment and misdirection techniques defined in SC-30, CCI 2482 for information systems defined in SC-30, 2483  at  time periods defined in SC-30, CCI  2484 to confuse and mislead adversaries.','The organization conducting the inspection/assessment obtains and examines network topology diagrams, architecture documentation, or any other documentation identifying concealment and misdirection techniques to ensure the organization being inspected/assessed employs concealment and misdirection techniques defined in SC-30, CCI 2482 for information systems defined in SC-30, 2483  at  time periods defined in SC-30, CCI  2484 to confuse and mislead adversaries.'),\n('002486','draft','2013-07-02','DISA FSO','policy','The organization defines the techniques to be employed to introduce randomness into organizational operations and assets.','SC-30(2).1','The organization being inspected/assessed defines and documents the techniques to be employed to introduce randomness into organizational operations and assets.  DoD has determined the techniques are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented techniques to ensure the organization being inspected/assessed defines the techniques to be employed to introduce randomness into organizational operations and assets.   DoD has determined the techniques are not appropriate to define at the Enterprise level.'),\n('002487','draft','2013-07-02','DISA FSO','policy','The organization employs organization-defined techniques to introduce randomness into organizational operations.','SC-30(2).2','The organization being inspected/assessed employs techniques defined in SC-30 (2), CCI 2486 to introduce randomness into organizational operations.','The organization conducting the inspection/assessment obtains and examines any applicable evidence of techniques used to introduce randomness to ensure the organization being inspected/assessed employs techniques defined in SC-30 (2), CCI 2486 to introduce randomness into organizational operations.'),\n('002488','draft','2013-07-02','DISA FSO','policy','The organization employs organization-defined techniques to introduce randomness into organizational assets.','SC-30(2).3','The organization being inspected/assessed employs techniques defined in SC-30 (2), CCI 2486 to introduce randomness into organizational assets.','The organization conducting the inspection/assessment obtains and examines any applicable evidence of techniques used to introduce randomness to ensure the organization being inspected/assessed employs techniques defined in SC-30 (2), CCI 2486 to introduce randomness into organizational assets.'),\n('002489','draft','2013-07-02','DISA FSO','policy','The organization defines the processing and/or storage locations to be changed at random intervals or at an organization-defined frequency.','SC-30(3).1','The organization being inspected/assessed defines and documents the processing and/or storage locations to be changed at random intervals or at an organization-defined frequency.  DoD has determined the processing and/or storage sites are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented processing and/or storage sites to ensure the organization being inspected/assessed defines the processing and/or storage locations to be changed at random intervals or at an organization-defined frequency.  DoD has determined the processing and/or storage sites are not appropriate to define at the Enterprise level.'),\n('002490','draft','2013-07-02','DISA FSO','policy','The organization defines the frequency at which it changes the location of organization-defined processing and/or storage.','SC-30(3).2','The organization being inspected/assessed defines and documents the frequency at which it changes the location of organization-defined processing and/or storage.  The frequency can be defined as random time intervals.  DoD has determined the frequency is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed defines  the frequency at which it changes the location of organization-defined processing and/or storage.  DoD has determined the frequency is not appropriate to define at the Enterprise level.'),\n('002491','deprecated','2013-07-02','DISA FSO','policy','The organization changes the location of organization-defined processing and/or storage at an organization-defined time frequency or at random time intervals.',NULL,NULL,NULL),\n('002492','draft','2013-07-02','DISA FSO','policy','The organization changes the location of organization-defined processing and/or storage at an organization-defined time frequency or at random time intervals.','SC-30(3).3','The organization being inspected/assessed documents and implements a process to change the location of the processing and/or storage defined in SC-30 (3), CCI 2489 at the time frequency defined in SC-30 (3), CCI 2490 or at random time intervals.  The organization must maintain an audit trail of changes.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of changes to ensure the organization being inspected/assessed changes the  location of the processing and/or storage defined in SC-30 (3), CCI 2489 at the time frequency defined in SC-30 (3), CCI 2490 or at random time intervals.'),\n('002493','draft','2013-07-02','DISA FSO','policy','The organization defines the information system components in which it will employ realistic but misleading information regarding its security state or posture.','SC-30(4).1','The organization being inspected/assessed defines and documents the information system components in which it will employ realistic but misleading information regarding its security state or posture.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components in which it will employ realistic but misleading information regarding its security state or posture.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002494','draft','2013-07-02','DISA FSO','policy','The organization employs realistic, but misleading, information in organization-defined information system components with regard to its security state or posture.','SC-30(4).2','The organization being inspected/assessed employs realistic, but misleading, information in information system components defined in SC-30 (4), CCI 2493 with regard to its security state or posture.','The organization conducting the inspection/assessment obtains and examines any applicable evidence of methods to employ misinformation to ensure the organization being inspected/assessed employs realistic, but misleading, information in information system components defined in SC-30 (4), CCI 2493 with regard to its security state or posture.'),\n('002495','draft','2013-07-02','DISA FSO','policy','The organization defines the techniques to be employed to hide or conceal organization-defined information system components.','SC-30(5).1','The organization being inspected/assessed defines and documents the techniques to be employed to hide or conceal organization-defined information system components.  DoD has determined the techniques are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented techniques to ensure the organization being inspected/assessed  defines the techniques to be employed to hide or conceal organization-defined information system components.  DoD has determined the techniques are not appropriate to define at the Enterprise level.'),\n('002496','draft','2013-07-02','DISA FSO','policy','The organization defines the information system components to be hidden or concealed.','SC-30(5).2','The organization being inspected/assessed defines and documents the information system components to be hidden or concealed.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components to be hidden or concealed.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002497','draft','2013-07-02','DISA FSO','policy','The organization employs organization-defined techniques to hide or conceal organization-defined information system components.','SC-30(5).3','The organization being inspected/assessed employs techniques defined in SC-30 (5), CCI  2495 to hide or conceal information system components defined in SC-30 (5), CCI 2496.','The organization conducting the inspection/assessment obtains and examines any applicable evidence of techniques to conceal information to ensure the organization being inspected/assessed employs techniques defined in SC-30 (5), CCI  2495 to hide or conceal information system components defined in SC-30 (5), CCI 2496.'),\n('002498','draft','2013-07-02','DISA FSO','policy','The organization performs a covert channel analysis to identify those aspects of communications within the information system that are potential avenues for covert storage and/or timing channels.','SC-31.1','The organization being inspected/assessed performs a covert channel analysis to identify those aspects of communications within the information system that are potential avenues for covert storage and/or timing channels.  The organization must maintain an audit trail of analyses.','The organization conducting the inspection/assessment obtains and examines the results of the analysis to ensure the organization being inspected/assessed  performs a covert channel analysis to identify those aspects of communications within the information system that are potential avenues for covert storage and/or timing channels.'),\n('002499','draft','2013-07-02','DISA FSO','policy','The organization estimates the maximum bandwidth of the covert storage and timing channels.','SC-31.2','The organization being inspected/assessed  implements a process to estimate the maximum bandwidth of the covert storage and timing channels.','The organization conducting the inspection/assessment obtains and examines the estimate to ensure the organization being inspected/assessed  estimates the maximum bandwidth of the covert storage and timing channels.'),\n('002500','draft','2013-07-02','DISA FSO','policy','The organization defines the maximum bandwidth values to which covert storage and/or timing channels are to be reduced.','SC-31(2).1','The organization being inspected/assessed defines and documents the maximum bandwidth values to which covert storage and/or timing channels are to be reduced.  DoD has determined the maximum bandwidth values are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented maximum bandwidth values to ensure the organization being inspected/assessed defines the maximum bandwidth values to which covert storage and/or timing channels are to be reduced.  DoD has determined the maximum bandwidth values are not appropriate to define at the Enterprise level.'),\n('002501','draft','2013-07-02','DISA FSO','policy','The organization reduces the maximum bandwidth for identified covert storage and/or timing channels to organization-defined values.','SC-31(2).2','The organization being inspected/assessed reduces the maximum bandwidth for identified covert storage and/or timing channels to values defined in SC-31 (2), CCI 2500.','The organization conducting the inspection/assessment obtains and examines any applicable evidence of bandwidth reduction to ensure the organization being inspected/assessed reduces the maximum bandwidth for identified covert storage and/or timing channels to values defined in SC-31 (2), CCI 2500.'),\n('002502','draft','2013-07-02','DISA FSO','policy','The organization defines the subset of identified covert channels in the operational environment of the information system that are to have the bandwidth measured.','SC-31(3).1','The organization being inspected/assessed defines and documents the subset of identified covert channels in the operational environment of the information system that are to have the bandwidth measured.  DoD has determined the subset is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented subset of identified covert channels to ensure the organization being inspected/assessed defines the subset of identified covert channels in the operational environment of the information system that are to have the bandwidth measured.  DoD has determined the subset is not appropriate to define at the Enterprise level.'),\n('002503','draft','2013-07-02','DISA FSO','policy','The organization measures the bandwidth of an organization-defined subset of identified covert channels in the operational environment of the information system.','SC-31(3).2','The organization being inspected/assessed measures the bandwidth of a subset of identified covert channels defined in SC-31 (3), CCI 2502 in the operational environment of the information system.','The organization conducting the inspection/assessment obtains and examines any applicable evidence of measurements to ensure the organization being inspected/assessed measures the bandwidth of a subset of identified covert channels defined in SC-31 (3), CCI 2502 in the operational environment of the information system.'),\n('002504','draft','2013-07-02','DISA FSO','policy','The organization defines the information system components into which the information system is partitioned.','SC-32.1','The organization being inspected/assessed defines and documents the information system components into which the information system is partitioned.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed defines the information system components into which the information system is partitioned.   DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002505','draft','2013-07-02','DISA FSO','policy','The organization defines the circumstances under which the information system components are to be physically separated to support partitioning.','SC-32.2','The organization being inspected/assessed defines and documents the circumstances under which the information system components are to be physically separated to support partitioning.  DoD has determined the circumstances are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented circumstances to ensure the organization being inspected/assessed  defines the circumstances under which the information system components are to be physically separated to support partitioning.  DoD has determined the circumstances are not appropriate to define at the Enterprise level.'),\n('002506','draft','2013-07-02','DISA FSO','policy','The organization partitions the information system into organization-defined information system components residing in separate physical domains or environments based on organization-defined circumstances for physical separation of components.','SC-32.3','The organization being inspected/assessed designs the information system to partition  components defined in SC-32, CCI 2504 residing in separate physical domains or environments based on  circumstances defined in SC-32, CCI 2505 for physical separation of components.','The organization conducting the inspection/assessment obtains and examines network topology diagrams, architecture documentation, or any other documentation identifying component partitioning to ensure the organization being inspected/assessed  partitions components defined in SC-32, CCI 2504 residing in separate physical domains or environments based on  circumstances defined in SC-32, CCI 2505 for physical separation of components.'),\n('002507','draft','2013-07-02','DISA FSO','policy','The organization controls read-only media after information has been recorded onto the media.','SC-34(2).2','The organization being inspected/assessed documents and implements mechanisms to control the read-only media after information has been recorded onto the media.','The organization conducting the inspection/assessment obtains and examines the documented mechanisms to ensure the organization being inspected/assessed controls the read-only media after information has been recorded onto the media.'),\n('002508','draft','2013-07-02','DISA FSO','policy','The organization defines the information system firmware components for which hardware-based, write-protect is employed.','SC-34(3).1','The organization being inspected/assessed defines and documents the information system firmware components for which hardware-based, write-protect is employed.  DoD has determined the information system firmware components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system firmware components to ensure the organization being inspected/assessed defines the information system firmware components for which hardware-based, write-protect is employed.  DoD has determined the information system firmware components are not appropriate to define at the Enterprise level.'),\n('002509','draft','2013-07-02','DISA FSO','policy','The organization employs hardware-based, write-protect for organization-defined information system firmware components.','SC-34(3).2','The organization being inspected/assessed employs hardware-based, write-protect for  information system firmware components defined in SC-34 (3), CCI 2508.','The organization conducting the inspection/assessment obtains and examines any applicable evidence of hardware-based, write-protect to ensure the organization being inspected/assessed employs hardware-based, write-protect for  information system firmware components defined in SC-34 (3), CCI 2508.'),\n('002510','draft','2013-07-02','DISA FSO','policy','The organization defines the individuals authorized to manually disable hardware-based, write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.','SC-34(3).3','The organization being inspected/assessed defines and documents the individuals authorized to manually disable hardware-based, write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.  DoD has determined the individuals are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented authorized individuals to ensure the organization being inspected/assessed defines the individuals authorized to manually disable hardware-based, write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.  DoD has determined the individuals are not appropriate to define at the Enterprise level.'),\n('002511','draft','2013-07-02','DISA FSO','policy','The organization implements specific procedures for organization-defined authorized individuals to manually disable hardware-based, write-protect for firmware modifications.','SC-34(3).4','The organization being inspected/assessed documents and implements specific procedures for authorized individuals defined in SC-34 (3), CCI 2510 to manually disable hardware-based, write-protect for firmware modifications.','The organization conducting the inspection/assessment  obtains and examines the documented procedures and a sampling of the information system components defined in SC-34 (3), CCI 2508 to ensure the organization being inspected/assessed  implements specific procedures for authorized individuals defined in SC-34 (3), CCI 2510 to manually disable hardware-based, write-protect for firmware modifications.'),\n('002512','draft','2013-07-02','DISA FSO','policy','The organization implements specific procedures for organization-defined authorized individuals to manually re-enable hardware write-protect prior to returning to operational mode.','SC-34(3).5','The organization being inspected/assessed documents and implements specific procedures for authorized individuals defined in SC-34 (3), CCI 2510 to manually re-enable the write-protect prior to returning to operational mode.','The organization conducting the inspection/assessment obtains and examines the documented procedures and a sampling of the information system components defined in SC-34 (3), CCI 2508 to ensure the organization being inspected/assessed  implements specific procedures for authorized individuals defined in SC-34 (3), CCI 2510 to manually re-enable the write-protect prior to returning to operational mode.'),\n('002513','draft','2013-07-02','DISA FSO','policy','The organization defines the processing that is to be distributed across multiple physical locations.','SC-36.1','The organization being inspected/assessed defines and documents the processing that is to be distributed across multiple physical locations.  DoD has determined the processing is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented processing to ensure the organization being inspected/assessed defines the processing that is to be distributed across multiple physical locations.  DoD has determined the processing is not appropriate to define at the Enterprise level.'),\n('002514','draft','2013-07-02','DISA FSO','policy','The organization defines the storage that is to be distributed across multiple physical locations.','SC-36.2','The organization being inspected/assessed defines and documents the storage that is to be distributed across multiple physical locations.  DoD has determined the storage is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented storage to ensure the organization being inspected/assessed defines the storage that is to be distributed across multiple physical locations.  DoD has determined the storage is not appropriate to define at the Enterprise level.'),\n('002515','draft','2013-07-02','DISA FSO','policy','The organization distributes organization-defined processing across multiple physical locations.','SC-36.3','The organization being inspected/assessed distributes processing defined in SC-36, CCI 2513 across multiple physical locations.','The organization conducting the inspection/assessment obtains and examines hardware lists and other applicable artifacts to ensure the organization being inspected/assessed distributes processing defined in SC-36, CCI 2513 across multiple physical locations.'),\n('002516','draft','2013-07-02','DISA FSO','policy','The organization distributes organization-defined storage across multiple physical locations.','SC-36.4','The organization being inspected/assessed  distributes storage defined in SC-36, CCI 2514 across multiple physical locations.','The organization conducting the inspection/assessment obtains and examines hardware lists and other applicable artifacts to ensure the organization being inspected/assessed distributes storage defined in SC-36, CCI 2514 across multiple physical locations.'),\n('002517','draft','2013-07-02','DISA FSO','policy','The organization defines the distributed processing components that are to be polled to identify potential faults, errors, or compromises.','SC-36(1).1','The organization being inspected/assessed defines and documents the distributed processing components that are to be polled to identify potential faults, errors, or compromises.  DoD has determined the distributed processing components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented distributed processing components to ensure the organization being inspected/assessed defines the distributed processing components that are to be polled to identify potential faults, errors, or compromises.  DoD has determined the distributed processing components are not appropriate to define at the Enterprise level.'),\n('002518','draft','2013-07-02','DISA FSO','policy','The organization defines the distributed storage components that are to be polled to identify potential faults, errors, or compromises.','SC-36(1).2','The organization being inspected/assessed defines and documents the distributed storage components that are to be polled to identify potential faults, errors, or compromises.  DoD has determined the distributed storage components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented distributed storage components to ensure the organization being inspected/assessed defines the distributed storage components that are to be polled to identify potential faults, errors, or compromises.  DoD has determined the distributed storage components are not appropriate to define at the Enterprise level.'),\n('002519','draft','2013-07-02','DISA FSO','policy','The organization employs polling techniques to identify potential faults, errors, or compromises to organization-defined distributed processing components.','SC-36(1).3','The organization being inspected/assessed designs and configures the information system to employ polling techniques to identify potential faults, errors, or compromises to distributed processing components defined in SC-36 (1), CCI 2517.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2519.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to employ polling techniques to identify potential faults, errors, or compromises to distributed processing components defined in SC-36 (1), CCI 2517.  If there is no applicable STIG for the polling technique in use, the organization conducting the inspection/assessment obtains and examines system design documents to ensure the organization being inspected/assessed  employs polling techniques to identify potential faults, errors, or compromises to distributed processing components defined in SC-36 (1), CCI 2517.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2519.'),\n('002520','draft','2013-07-02','DISA FSO','policy','The organization employs polling techniques to identify potential faults, errors, or compromises to organization-defined distributed storage components.','SC-36(1).4','The organization being inspected/assessed designs and configures the information system to employ polling techniques to identify potential faults, errors, or compromises to distributed storage components defined in SC-36 (1), CCI 2518.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2520.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to employ polling techniques to identify potential faults, errors, or compromises to distributed storage components defined in SC-36 (1), CCI 2518.  If there is no applicable STIG for the polling technique in use, the organization conducting the inspection/assessment obtains and examines system design documents to ensure the organization being inspected/assessed employs polling techniques to identify potential faults, errors, or compromises to distributed storage components defined in SC-36 (1), CCI 2518.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2520.'),\n('002521','draft','2013-07-02','DISA FSO','policy','The organization defines the out-of-band channels to be employed for the physical delivery or electronic transmission of organization-defined information, information system components, or devices.','SC-37.1','The organization being inspected/assessed defines and documents the out-of-band channels to be employed for the physical delivery or electronic transmission of organization-defined information, information system components, or devices.  DoD has determined the out-of-band channels are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented out-of-band channels to ensure the organization being inspected/assessed defines the out-of-band channels to be employed for the physical delivery or electronic transmission of organization-defined information, information system components, or devices.  DoD has determined the out-of-band channels are not appropriate to define at the Enterprise level.'),\n('002522','draft','2013-07-02','DISA FSO','policy','The organization defines the information, information system components, or devices that are to be electronically transmitted or physically delivered via organization-defined out-of-band channels.','SC-37.2','The organization being inspected/assessed   defines and documents the information, information system components or devices that are to be electronically transmitted or physically delivered via organization-defined out-of-band channels.  DoD has determined the information, information system components, or devices are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information, information system components or devices to ensure the organization being inspected/assessed  defines  the information, information system components or devices that are to be electronically transmitted or physically delivered via organization-defined out-of-band channels.  DoD has determined the information, information system components, or devices are not appropriate to define at the Enterprise level.'),\n('002523','draft','2013-07-02','DISA FSO','policy','The organization defines the individuals or information systems authorized to be recipients of organization-defined information, information system components, or devices to be delivered by employing organization-defined out-of-band channels for electronic transmission or physical delivery.','SC-37.3','The organization being inspected/assessed defines and documents the individuals or information systems authorized to be recipients of organization-defined information, information system components, or devices to be delivered by employing organization-defined out-of-band channels for electronic transmission or physical delivery.\\n\\nDoD has determined the individuals or information systems are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information, information system components, or devices to ensure the organization being inspected/assessed  defines the individuals or information systems authorized to be recipients of organization-defined information, information system components, or devices to be delivered by employing organization-defined out-of-band channels for electronic transmission or physical delivery.  DoD has determined the individuals or information systems are not appropriate to define at the Enterprise level.'),\n('002524','draft','2013-07-02','DISA FSO','policy','The organization employs organization-defined out-of-band channels for the electronic transmission or physical delivery of organization-defined information, information system components, or devices to organization-defined individuals or information systems.','SC-37.4','The organization being inspected/assessed employs out-of-band channels defined in SC-37, CCI 2521 for the electronic transmission or physical delivery of information, information system components, or devices defined in SC-37, CCI 2522 to individuals or information systems defined in SC-37, CCI 2523.','The organization conducting the inspection/assessment obtains and examines any applicable evidence of out-of-band channels to ensure the organization being inspected/assessed employs out-of-band channels defined in SC-37, CCI 2521 for the electronic transmission or physical delivery of information, information system components, or devices defined in SC-37, CCI 2522 to individuals or information systems defined in SC-37, CCI 2523.'),\n('002525','draft','2013-07-02','DISA FSO','policy','The organization defines the security safeguards to be employed to ensure only organization-defined individuals or information systems receive organization-defined information, information system components, or devices.','SC-37(1).2','The organization being inspected/assessed defines and documents the security safeguards to be employed to ensure only organization-defined individuals or information systems receive organization-defined information, information system components or devices.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examine the documented security safeguards to ensure the organization being inspected/assessed defines the security safeguards to be employed to ensure only organization-defined individuals or information systems receive organization-defined information, information system components or devices.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002526','draft','2013-07-02','DISA FSO','policy','The organization defines the information, information system components, or devices which are to be received only by organization-defined individuals or information systems.','SC-37(1).3','The organization being inspected/assessed defines and documents the information, information system components or devices which are to be received only by organization-defined individuals or information systems.  DoD has determined the information, information system components or devices are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information, information system components or devices to ensure the organization being inspected/assessed defines the information, information system components or devices which are to be received only by organization-defined individuals or information systems.  DoD has determined the information, information system components or devices are not appropriate to define at the Enterprise level.'),\n('002527','draft','2013-07-02','DISA FSO','policy','The organization employs organization-defined security safeguards to ensure only organization-defined individuals or information systems receive the organization-defined information, information system components, or devices.','SC-37(1).4','The organization being inspected/assessed implements security safeguards defined in SC-37 (1), CCI 2525 to ensure only individuals or information systems defined in SC-37 (1), CCI 2523 receive the information, information system components, or devices defined in SC-37 (1), CCI 2526.  The organization must maintain an audit trail of security safeguard implementation.','The organization conducting the inspection/assessment obtains and examines the audit trail of security safeguard implementation to ensure the organization being inspected/assessed employs security safeguards defined in SC-37 (1), CCI 2525 to ensure only individuals or information systems defined in SC-37 (1), CCI 2523 receive the information, information system components, or devices defined in SC-37 (1), CCI 2526.'),\n('002528','draft','2013-07-02','DISA FSO','policy','The organization defines the operations security safeguards to be employed to protect key organizational information throughout the system development life cycle.','SC-38.1','The organization being inspected/assessed defines and documents the operations security safeguards to be employed to protect key organizational information throughout the system development life cycle.  DoD has determined the operations security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented operations security safeguards to ensure the organization being inspected/assessed defines the operations security safeguards to be employed to protect key organizational information throughout the system development life cycle.  DoD has determined the operations security safeguards are not appropriate to define at the Enterprise level.'),\n('002529','draft','2013-07-02','DISA FSO','policy','The organization employs organization-defined operations security safeguards to protect key organizational information throughout the system development life cycle.','SC-38.2','The organization being inspected/assessed implements operations security safeguards defined in SC-38, CCI 2528 to protect key organizational information throughout the system development life cycle.  The organization must maintain an audit trail of security safeguard implementation.','The organization conducting the inspection/assessment obtains and examines the audit trail of security safeguard implementation to ensure the organization being inspected/assessed employs operations security safeguards defined in SC-38, CCI 2528 to protect key organizational information throughout the system development life cycle.'),\n('002530','draft','2013-07-02','DISA FSO','technical','The information system maintains a separate execution domain for each executing process.','SC-39.1','The organization being inspected/assessed configures the information system to maintain a separate execution domain for each executing process.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2530.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to maintain a separate execution domain for each executing process.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2530.'),\n('002531','draft','2013-07-02','DISA FSO','technical','The information system implements underlying hardware separation mechanisms to facilitate process separation.','SC-39(1).1','The organization being inspected/assessed configures the information system to  implement underlying hardware separation mechanisms to facilitate process separation.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2531.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  implement underlying hardware separation mechanisms to facilitate process separation.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2531.'),\n('002532','draft','2013-07-02','DISA FSO','policy','The organization defines the multi-threaded processing in which a separate execution domain is maintained by the information system for each thread.','SC-39(2).1','The organization being inspected/assessed defines and documents the multi-threaded processing in which a separate execution domain is maintained by the information system for each thread.  DoD has determined the multi-threaded processing is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented multi-thread processing to ensure the organization being inspected/assessed defines the multi-threaded processing in which a separate execution domain is maintained by the information system for each thread.  DoD has determined the multi-threaded processing is not appropriate to define at the Enterprise level.'),\n('002533','draft','2013-07-02','DISA FSO','technical','The information system maintains a separate execution domain for each thread in organization-defined multi-threaded processing.','SC-39(2).2','The organization being inspected/assessed configures the information system to maintain a separate execution domain for each thread in  multi-threaded processing defined in SC-39 (2), CCI 2532.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2533.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to maintain a separate execution domain for each thread in  multi-threaded processing defined in SC-39 (2), CCI 2532.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2533.'),\n('002534','draft','2013-07-02','DISA FSO','policy','The organization defines types of signal parameter attacks or references to sources for such attacks from which the information system protects organization-defined wireless links.','SC-40.1','The organization being inspected/assessed defines and documents the types of signal parameter attacks or references to sources for such attacks from which the information system protects organization-defined wireless links.   DoD has determined the signal parameter attacks or references to sources for such attacks are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented signal parameter attacks or references to sources for such attacks to ensure the organization being inspected/assessed defines types of signal parameter attacks or references to sources for such attacks from which the information system protects organization-defined wireless links.  DoD has determined the signal parameter attacks or references to sources for such attacks are not appropriate to define at the Enterprise level.'),\n('002535','draft','2013-07-02','DISA FSO','policy','The organization defines the external and internal wireless links the information system is to protect from organization-defined types of signal parameter attacks or references to sources for such attacks.','SC-40.2','DoD has defined the wireless links as all non-COTS wireless links.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the wireless links as all non-COTS wireless links.'),\n('002536','draft','2013-07-02','DISA FSO','technical','The information system protects organization-defined external and internal wireless links from organization-defined types of signal parameter attacks or references to sources for such attacks.','SC-40.3','The organization being inspected/assessed designs the information system to protect all non-COTS wireless links from types of signal parameter attacks or references to sources for such attacks defined in SC-40, CCI 2534.  DoD has defined the wireless links as all non-COTS wireless links.','The organization conducting the inspection/assessment obtains and examines design documentation for wireless links to ensure the organization being inspected/assessed protects all non-COTS wireless links from types of signal parameter attacks or references to sources for such attacks defined in SC-40, CCI 2534.  DoD has defined the wireless links as all non-COTS wireless links.'),\n('002537','draft','2013-07-02','DISA FSO','policy','The organization defines the level of protection against the effects of intentional electromagnetic interference to be achieved by implemented cryptographic mechanisms.','SC-40(1).1','The organization being inspected/assessed defines and documents the level of protection against the effects of intentional electromagnetic interference to be achieved by implemented cryptographic mechanisms.  DoD has determined the level of protection is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented level of protection to ensure the organization being inspected/assessed defines the level of protection against the effects of intentional electromagnetic interference to be achieved by implemented cryptographic mechanisms.  DoD has determined the level of protection is not appropriate to define at the Enterprise level.'),\n('002538','draft','2013-07-02','DISA FSO','technical','The information system implements cryptographic mechanisms that achieve an organization-defined level of protection against the effects of intentional electromagnetic interference.','SC-40(1).2','The organization being inspected/assessed configures the information system to implement cryptographic mechanisms that achieve level of protection defined in SC-40 (1), CCI 2537 against the effects of intentional electromagnetic interference.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2538.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement cryptographic mechanisms that achieve level of protection defined in SC-40 (1), CCI 2537 against the effects of intentional electromagnetic interference.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2538.'),\n('002539','draft','2013-07-02','DISA FSO','policy','The organization defines the level of reduction the information system is to implement to reduce the detection potential of wireless links.','SC-40(2).1','The organization being inspected/assessed defines and documents the level of reduction the information system is to implement to reduce the detection potential of wireless links.  DoD has determined the level of reduction is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented level of reduction to ensure the organization being inspected/assessed defines the level of reduction the information system is to implement to reduce the detection potential of wireless links.  DoD has determined the level of reduction is not appropriate to define at the Enterprise level.'),\n('002540','draft','2013-07-02','DISA FSO','technical','The information system implements cryptographic mechanisms to reduce the detection potential of wireless links to an organization-defined level of reduction.','SC-40(2).2','The organization being inspected/assessed configures the information system to implement cryptographic mechanisms to reduce the detection potential of wireless links to the level of reduction defined in SC-40 (2), CCI 2539.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2540.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement cryptographic mechanisms to reduce the detection potential of wireless links to the level of reduction defined in SC-40 (2), CCI 2539.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2540.'),\n('002541','draft','2013-07-02','DISA FSO','technical','The information system implements cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.','SC-40(3).1','The organization being inspected/assessed configures the information system to implement cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2541.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2541.'),\n('002542','draft','2013-07-02','DISA FSO','policy','The organization defines the wireless transmitters that are to have cryptographic mechanisms implemented by the information system to prevent the identification of the wireless transmitters.','SC-40(4).1','The organization being inspected/assessed defines and documents the wireless transmitters that are to have cryptographic mechanisms implemented by the information system to prevent the identification of the wireless transmitters.  DoD has determined the wireless transmitters are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented wireless transmitters to ensure the organization being inspected/assessed defines the wireless transmitters that are to have cryptographic mechanisms implemented by the information system to prevent the identification of the wireless transmitters.  DoD has determined the wireless transmitters are not appropriate to define at the Enterprise level.'),\n('002543','draft','2013-07-02','DISA FSO','technical','The information system implements cryptographic mechanisms to prevent the identification of organization-defined wireless transmitters by using the transmitter signal parameters.','SC-40(4).2','The organization being inspected/assessed configures the information system to implement cryptographic mechanisms to prevent the identification of wireless transmitters defined in SC-40 (4), CCI 2542 by using the transmitter signal parameters.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2543.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement cryptographic mechanisms to prevent the identification of wireless transmitters defined in SC-40 (4), CCI 2542 by using the transmitter signal parameters.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2543.'),\n('002544','draft','2013-07-02','DISA FSO','policy','The organization defines the information systems or information system components on which organization-defined connection ports or input/output devices are to be physically disabled or removed.','SC-41.1','The organization being inspected/assessed defines and documents the information systems or information system components on which organization-defined connection ports or input/output devices are to be physically disabled or removed.  DoD has determined the information systems or information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information systems or information system components to ensure the organization being inspected/assessed defines the information systems or information system components on which organization-defined connection ports or input/output devices are to be physically disabled or removed.  DoD has determined the information systems or information system components are not appropriate to define at the Enterprise level.'),\n('002545','draft','2013-07-02','DISA FSO','policy','The organization defines the connection ports or input/output devices that are to be physically disabled or removed from organization-defined information systems or information system components.','SC-41.2','The organization being inspected/assessed defines and documents the connection ports or input/output devices that are to be physically disabled or removed from organization-defined information systems or information system components.  DoD has determined the connection ports or input/output devices are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented connection ports or input/output devices to ensure the organization being inspected/assessed defines the connection ports or input/output devices that are to be physically disabled or removed from organization-defined information systems or information system components.   DoD has determined the connection ports or input/output devices are not appropriate to define at the Enterprise level.'),\n('002546','draft','2013-07-02','DISA FSO','technical','The organization physically disables or removes organization-defined connection ports or input/output devices on organization-defined information systems or information system components.','SC-41.3','The organization being inspected/assessed physically disables or removes connection ports or input/output devices defined in SC-41, CCI 2545 on information systems or information system components defined in SC-41, CCI 2544.','The organization conducting the inspection/assessment examines a sampling of devices to ensure the organization being inspected/assessed physically disables or removes connection ports or input/output devices defined in SC-41, CCI 2545 on information systems or information system components defined in SC-41, CCI 2544.'),\n('002547','draft','2013-07-02','DISA FSO','policy','The organization defines the exceptions where remote activation of sensors is allowed.','SC-42.1','The organization being inspected/assessed defines and documents the exceptions where remote activation of sensors is allowed.  DoD has determined the exceptions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented exceptions to ensure the organization being inspected/assessed defines the exceptions where remote activation of sensors is allowed.  DoD has determined the exceptions are not appropriate to define at the Enterprise level.'),\n('002548','draft','2013-07-02','DISA FSO','technical','The information system prohibits the remote activation of environmental sensing capabilities except for the organization-defined exceptions where remote activation of sensors is allowed.','SC-42.2','The organization being inspected/assessed configures the information system to prohibit the remote activation of environmental sensing capabilities except for the exceptions defined in SC-42, CCI 2547 where remote activation of sensors is allowed.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2548.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  prohibit the remote activation of environmental sensing capabilities except for the exceptions defined in SC-42, CCI 2547 where remote activation of sensors is allowed.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2548.'),\n('002549','draft','2013-07-02','DISA FSO','policy','The organization defines the class of users to receive explicit indication of sensor use.','SC-42.3','DoD has defined the class of users all users unless documented by exception.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the class of users all users unless documented by exception.'),\n('002550','draft','2013-07-02','DISA FSO','technical','The information system provides an explicit indication of sensor use to the organization-defined class of users.','SC-42.4','The organization being inspected/assessed configures the information system to provide an explicit indication of sensor use to all users unless documented by exception.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2550.  DoD has defined the class of users all users unless documented by exception.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide an explicit indication of sensor use to all users unless documented by exception.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2550.  DoD has defined the class of users all users unless documented by exception.'),\n('002551','draft','2013-07-02','DISA FSO','policy','The organization defines the sensors to be configured so that collected data or information is reported only to authorized individuals or roles.','SC-42(1).1','The organization being inspected/assessed defines and documents the sensors to be configured so that collected data or information is reported only to authorized individuals or roles.  DoD has determined the sensors are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented sensors to ensure the organization being inspected/assessed defines the sensors to be configured so that collected data or information is reported only to authorized individuals or roles.  DoD has determined the sensors are not appropriate to define at the Enterprise level.'),\n('002552','draft','2013-07-02','DISA FSO','policy','The organization ensures that the information system is configured so that data or information collected by the organization-defined sensors is only reported to authorized individuals or roles.','SC-42(1).2','The organization being inspected/assessed documents and implements a process to ensure that the information system is configured so that data or information collected by the sensors defined in SC-42 (1), CCI 2551 is only reported to authorized individuals or roles.','The organization conducting the inspection/assessed obtains and examines the documented process as well as a sampling of devices to ensure the organization being inspected/assessed configures the information system so that data or information collected by the sensors defined in SC-42 (1), CCI 2551 is only reported to authorized individuals or roles.'),\n('002553','draft','2013-07-02','DISA FSO','policy','The organization defines the measures to be employed to ensure data or information collected by organization-defined sensors is used only for authorized purposes.','SC-42(2).1','The organization being inspected/assessed defines and documents the measures to be employed to ensure data or information collected by sensors defined in SC-42 (2), CCI 2554 is used only for authorized purposes.  DoD has determined the measures are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented measures to ensure the organization being inspected/assessed defines the measures to be employed to ensure data or information collected by sensors defined in SC-42 (2), CCI 2554 is used only for authorized purposes.  DoD has determined the measures are not appropriate to define at the Enterprise level.'),\n('002554','draft','2013-07-02','DISA FSO','policy','The organization defines the sensors that are to collect data or information for authorized purposes.','SC-42(2).2','The organization being inspected/assessed defines and documents the sensors that are to collect data or information for authorized purposes.  DoD has determined the sensors are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented sensors to ensure the organization being inspected/assessed defines the sensors that are to collect data or information for authorized purposes.  DoD has determined the sensors are not appropriate to define at the Enterprise level.'),\n('002555','draft','2013-07-02','DISA FSO','policy','The organization employs organization-defined measures, so that data or information collected by organization-defined sensors is only used for authorized purposes.','SC-42(2).3','The organization being inspected/assessed  employs measures defined in SC-42 (2), CCI 2553 so that data or information collected by sensors defined in SC-42 (2), CCI 2554 is only used for authorized purposes.','The organization conducting the inspection/assessment ensures the measures defined in SC-42 (2), CCI 2553  are employed so that data or information collected by sensors defined in SC-42 (2), CCI 2554 is only used for authorized purposes.'),\n('002556','draft','2013-07-02','DISA FSO','policy','The organization defines the environmental sensing capabilities prohibited on devices used in organization-defined facilities, areas, or systems.','SC-42(3).1','DoD has defined the environmental sensing capabilities as environmental sensing capabilities such as the recording audio or imagery (still or video) or transmitting information (i.e., cell phones, two way radios).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\nDoD has defined the environmental sensing capabilities as environmental sensing capabilities such as the recording audio or imagery (still or video) or transmitting information (i.e., cell phones, two way radios).'),\n('002557','draft','2013-07-02','DISA FSO','policy','The organization defines the facilities, areas, or systems where devices processing organization-defined environmental sensing capabilities are prohibited.','SC-42(3).2','DoD has defined the facilities, areas, and systems as spaces where Classified information is stored, processed, displayed, or discussed.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the facilities, areas, and systems as spaces where Classified information is stored, processed, displayed, or discussed.'),\n('002558','draft','2013-07-02','DISA FSO','policy','The organization prohibits the use of devices possessing organization-defined environmental sensing capabilities in organization-defined facilities, areas, or systems.','SC-42(3).3','The organization being inspected/assessed documents and implements a process to prohibit the use of devices possessing  environmental sensing capabilities such as the recording audio or imagery (still or video) or transmitting information (i.e., cell phones, two way radios) in  spaces where Classified information is stored, processed, displayed, or discussed.\\nDoD has defined the environmental sensing capabilities as environmental sensing capabilities such as the recording audio or imagery (still or video) or transmitting information (i.e., cell phones, two way radios).\\nDoD has defined the facilities, areas, and systems as spaces where Classified information is stored, processed, displayed, or discussed.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed prohibits the use of devices possessing environmental sensing capabilities such as the recording audio or imagery (still or video) or transmitting information (i.e., cell phones, two way radios) in spaces where Classified information is stored, processed, displayed, or discussed.\\nDoD has defined the environmental sensing capabilities as environmental sensing capabilities such as the recording audio or imagery (still or video) or transmitting information (i.e., cell phones, two way radios).\\nDoD has defined the facilities, areas, and systems as spaces where Classified information is stored, processed, displayed, or discussed.'),\n('002559','draft','2013-07-02','DISA FSO','policy','The organization defines the information system components for which usage restrictions and implementation guidance are to be established.','SC-43.1','DoD has defined the information system components as all information system components (through the use of an acceptable use agreement).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information system components as all information system components (through the use of an acceptable use agreement).'),\n('002560','draft','2013-07-02','DISA FSO','policy','The organization establishes usage restrictions and implementation guidance for organization-defined information system components based on the potential to cause damage to the information system if used maliciously.','SC-43.2','The organization being inspected/assessed develops and implements usage restrictions and implementation guidance for all information system components (through the use of an acceptable use agreement).  DoD has defined the information system components as all information system components (through the use of an acceptable use agreement). ','The organization conducting the  inspection/assessment obtains and examines implementation guidance and usage restrictions  and verifies that the organization has implemented them for all information system components (through the use of an acceptable use agreement).   DoD has defined the information system components as all information system components (through the use of an acceptable use agreement).   '),\n('002561','draft','2013-07-02','DISA FSO','policy','The organization authorizes the use of organization-defined information system components which have the potential to cause damage to the information system if used maliciously.','SC-43.3','The organization being inspected/assessed documents and implements a process to authorize the use of all information system components (through the use of an acceptable use agreement) which have the potential to cause damage to the information system if used maliciously.  The organization must maintain an audit trail of authorizations.  DoD has defined the information system components as all information system components (through the use of an acceptable use agreement). ','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of authorizations to ensure the organization being inspected/assessed authorizes the use of all information system components (through the use of an acceptable use agreement) which have the potential to cause damage to the information system if used maliciously.  DoD has defined the information system components as all information system components (through the use of an acceptable use agreement). '),\n('002562','draft','2013-07-02','DISA FSO','policy','The organization monitors the use of organization-defined information system components which have the potential to cause damage to the information system if used maliciously.','SC-43.4','The organization being inspected/assessed documents and implements a process to monitor the use of all information system components (through the use of an acceptable use agreement) which have the potential to cause damage to the information system if used maliciously.  The organization must maintain an audit trail of monitoring.   DoD has defined the information system components as all information system components (through the use of an acceptable use agreement). ','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of monitoring to ensure the organization being inspected/assessed monitors the use of  all information system components (through the use of an acceptable use agreement).  DoD has defined the information system components as all information system components (through the use of an acceptable use agreement). '),\n('002563','draft','2013-07-02','DISA FSO','policy','The organization controls the use of organization-defined information system components which have the potential to cause damage to the information system if used maliciously.','SC-43.5','The organization being inspected/assessed documents and implements a process to control the use of all information system components (through the use of an acceptable use agreement) which have the potential to cause damage to the information system if used maliciously.  DoD has defined the information system components as all information system components (through the use of an acceptable use agreement).  ','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed controls the use of all information system components (through the use of an acceptable use agreement).   DoD has defined the information system components as all information system components (through the use of an acceptable use agreement). '),\n('002564','draft','2013-07-02','DISA FSO','policy','The organization defines the information system, system component, or location where a detonation chamber (i.e., dynamic execution environments) capability is employed.','SC-44.1','The organization being inspected/assessed defines and documents the information system, system components, or location where a detonation chamber (i.e., dynamic execution environments) capability is employed.   DoD has determined the defines the information system, system components, or location are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system, system components, or location to ensure the organization being inspected/assessed defines the information system, system components, or location where a detonation chamber (i.e., dynamic execution environments) capability is employed.  DoD has determined the defines the information system, system components, or location are not appropriate to define at the Enterprise level.'),\n('002565','draft','2013-07-02','DISA FSO','policy','The organization employs a detonation chamber (i.e., dynamic execution environments) capability within an organization-defined information system, system component, or location.','SC-44.2','The organization being inspected/assessed implements a detonation chamber (i.e., dynamic execution environments, sandbox) capability within an information system, system component, or location defined in SC-44, CCI 2564.  The organization must maintain an audit trail of detonation chamber implementation.','The organization conducting the inspection/assessment obtains and examines the documented detonation chamber to ensure the organization being inspected/assessed employs a detonation chamber (i.e., dynamic execution environments, sandbox) capability within an  information system, system component, or location defined in SC-44, CCI 2564.'),\n('002566','draft','2013-07-09','DISA FSO','policy','The organization defines personnel or roles to whom a documented media protection policy and procedures will be disseminated.','MP-1.3','DoD has defined the personnel or roles as all users.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as all users.'),\n('002567','draft','2013-07-09','DISA FSO','policy','The organization reviews and approves media sanitization.','MP-6(1).1','The organization being inspected/assessed documents and implements a process for reviewing and approving media sanitization.  The process must include procedures for reviewing and approving sanitization actions.  The organization must maintain a record of media sanitization actions.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of media sanitization actions to ensure the organization being inspected/assessed reviews and approves media sanitization actions.'),\n('002568','draft','2013-07-09','DISA FSO','policy','The organization tracks and documents media sanitization.','MP-6(1).2','The organization being inspected/assessed documents and implements a process for tracking media sanitization.  The process must include procedures for tracking sanitization actions.  The organization must maintain a record of media sanitization actions.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of media sanitization actions to ensure the organization being inspected/assessed tracks and documents media sanitization actions.'),\n('002569','draft','2013-07-09','DISA FSO','policy','The organization verifies media sanitization.','MP-6(1).3','The organization being inspected/assessed documents and implements a process for media sanitization.  The process must include procedures for verification of sanitization actions.  The organization must maintain a record of media sanitization actions including verification information.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of media sanitization actions to ensure the organization being inspected/assessed verifies media sanitization actions.'),\n('002570','draft','2013-07-09','DISA FSO','policy','The organization reviews and approves media disposal actions.','MP-6(1).4','The organization being inspected/assessed documents and implements a process for reviewing and approving media disposal.  The process must include procedures for reviewing and approving disposal actions.  The organization must maintain a record of media disposal actions.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of media disposal actions to ensure the organization being inspected/assessed reviews and approves media disposal actions.'),\n('002571','draft','2013-07-09','DISA FSO','policy','The organization tracks and documents media disposal actions.','MP-6(1).5','The organization being inspected/assessed documents and implements a process for tracking media disposal.  The process must include procedures for tracking disposal actions.  The organization must maintain a record of media disposal actions.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of media disposal actions to ensure the organization being inspected/assessed tracks and documents media disposal actions.'),\n('002572','draft','2013-07-09','DISA FSO','policy','The organization verifies media disposal actions.','MP-6(1).6','The organization being inspected/assessed documents and implements a process for media disposal.  The process must include procedures for verification of disposal actions.  The organization must maintain a record of media disposal actions including verification information.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of media disposal actions to ensure the organization being inspected/assessed verifies media disposal actions.'),\n('002573','draft','2013-07-09','DISA FSO','policy','The organization enforces dual authorization for the sanitization of organization-defined information system media.','MP-6(7).1','The organization being inspected/assessed documents and implements a process for dual authorization for the sanitization of information system media defined in MP-6 (7), CCI 2574.  The organization must maintain a record of sanitization actions for media defined in MP-6 (7), CCI 2574.','The organization conducting the inspection/assessment obtains and examines the documented process as well as a sampling of records of sanitization actions to ensure the organization being inspected/assessed enforces dual authorization for the sanitization of information system media defined in MP-6 (7), CCI 2574.'),\n('002574','draft','2013-07-09','DISA FSO','policy','The organization defines the information system media that dual authorization is enforced for sanitization.','MP-6(7).2','The organization being inspected/assessed defines and documents the information system media that dual authorization should be enforced for sanitization.  DoD has determined the information system media is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system media to ensure the organization being inspected/assessed defines the information system media that dual authorization should be enforced for sanitization.  DoD has determined the information system media is not appropriate to define at the Enterprise level.'),\n('002575','draft','2013-07-09','DISA FSO','policy','The organization defines information systems, system components, or devices from which information is to be purged/wiped, either remotely or under the organization-defined conditions.','MP-6(8).1','The organization being inspected/assessed defines and documents information systems, system components, or devices that information should be purged/wiped either remotely or under the organization-defined conditions.  DoD has determined the information systems, system components, or devices are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information systems, system components, or devices to ensure the organization being inspected/assessed defines  information systems, system components, or devices that information should be purged/wiped either remotely or under the organization-defined conditions.  DoD has determined the information systems, system components, or devices are not appropriate to define at the Enterprise level.'),\n('002576','draft','2013-07-09','DISA FSO','policy','The organization defines conditions under which information from organization-defined information systems, system components, or devices should be purged/wiped.','MP-6(8).2','The organization being inspected/assessed defines and documents conditions in which information from organization-defined information systems, system components, or devices should be purged/wiped.  DoD has determined the conditions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented conditions to ensure the organization being inspected/assessed defines  conditions in which information from organization-defined information systems, system components, or devices should be purged/wiped.  DoD has determined the conditions are not appropriate to define at the Enterprise level.'),\n('002577','draft','2013-07-09','DISA FSO','policy','The organization provides the capability to purge/wipe information from organization-defined information systems, system components, or devices either remotely or under organization-defined conditions.','MP-6(8).3','The organization being inspected/assessed documents and implements a process to purge /wipe information from information systems, system components, or devices defined in MP-6 (8), CCI 2575 either remotely or under  conditions defined in MP-6 (8), CCI 2576.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides the capability to purge /wipe information from information systems, system components, or devices defined in MP-6 (8), CCI 2575 either remotely or under  conditions defined in MP-6 (8), CCI 2576.'),\n('002578','draft','2013-07-09','DISA FSO','policy','The organization defines information system media to sanitize prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures in accordance with applicable federal and organizational standards and policies.','MP-6.2','DoD has defined the information system media as all media.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information system media as all media.'),\n('002579','draft','2013-07-09','DISA FSO','policy','The organization defines the sanitization techniques and procedures to be used to sanitize organization-defined information system media prior to disposal, release out of organizational control, or release for reuse in accordance with applicable federal and organization standards and policies.','MP-6.3','DoD has defined the sanitization techniques as techniques and procedures IAW NIST SP 800-88.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the sanitization techniques as techniques and procedures IAW NIST SP 800-88.'),\n('002580','draft','2013-07-09','DISA FSO','policy','The organization employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.','MP-6.4','The organization being inspected/assessed implements sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.  The organization must maintain an audit trail of sanitization actions.','The organization conducting the inspection/assessment obtains and examines the audit trail of sanitization actions to ensure the organization being inspected/assessed implements sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.'),\n('002581','draft','2013-07-09','DISA FSO','policy','The organization defines the types of information system media to restrict or prohibit on organization-defined information systems or system components using organization-defined security safeguards.','MP-7.1','The organization being inspected/assessed defines and documents the types of information system media to restrict or prohibit on organization-defined information systems or system components using organization-defined security safeguards.  DoD has determined the types of information system media are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented type of information system media to ensure the organization being inspected/assessed defines the types of information system media to restrict or prohibit on organization-defined information systems or system components using organization-defined security safeguards.  DoD has determined the types of information system media are not appropriate to define at the Enterprise level.'),\n('002582','draft','2013-07-09','DISA FSO','policy','The organization defines the information systems or system components on which to restrict or prohibit the use of organization-defined types of information system media using organization-defined security safeguards.','MP-7.2','The organization being inspected/assessed defines and documents the information systems or system components to restrict or prohibit the use of organization-defined types of information system media using organization-defined security safeguards.  DoD has determined the information systems or system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information systems or system components to ensure the organization being inspected/assessed defines  the information systems or system components to restrict or prohibit the use of organization-defined types of information system media using organization-defined security safeguards.  DoD has determined the information systems or system components are not appropriate to define at the Enterprise level.'),\n('002583','draft','2013-07-09','DISA FSO','policy','The organization defines the security safeguards to use for restricting or prohibiting the use of organization-defined types of information system media on organization-defined information systems or system components.','MP-7.3','The organization being inspected/assessed defines and documents the security safeguards to use for restricting or prohibiting the use of organization-defined types of information system media on organization-defined information systems or system components.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines the security safeguards to use for restricting or prohibiting the use of organization-defined types of information system media on organization-defined information systems or system components.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002584','draft','2013-07-09','DISA FSO','policy','The organization restricts or prohibits the use of organization-defined types of information system media on organization-defined information systems or system components using organization-defined security safeguards.','MP-7.4','The organization being inspected/assessed documents and enforces controls for the use of media defined in MP-7, CCI 2581 on systems defined in MP-7, CCI 2582 using security safeguards defined in MP-7, CCI 2583.','The organization conducting the inspection/assessment obtains and examines the documented controls and examines information system procedures associated with the use of media to ensure the organization being inspected/assessed documents and enforces controls for the use of media defined in MP-7, CCI 2581 on systems defined in MP-7, CCI 2582 using security safeguards defined in MP-7, CCI 2583.'),\n('002585','draft','2013-07-09','DISA FSO','policy','The organization prohibits the use of portable storage devices in organizational information systems when such devices have no identifiable owner.','MP-7(1).1','The organization being inspected/assessed does not use portable storage devices in  organization information systems when such devices have no identifiable owner.','The organization conducting the inspection/assessment examines a sampling of portable storage devices used in the information system to ensure that the devices have an identifiable owner.'),\n('002586','draft','2013-07-09','DISA FSO','policy','The organization prohibits the use of sanitization-resistant media in organizational information systems.','MP-7(2).1','The organization being inspected/assessed does not use sanitization-resistant media in organizational information systems.','The organization conducting the inspection/assessment examines a sampling of media used in the information system to ensure sanitization-resistant media is not used.'),\n('002587','draft','2013-07-09','DISA FSO','policy','The organization documents information system media downgrading actions.','MP-8(1).1','The organization being inspected/assessed documents information system media downgrading actions.','The organization conducting the inspection/assessment obtains and examines the documented  information system media downgrading actions to ensure the organization being inspected/assessed documents information system media downgrading actions.'),\n('002588','draft','2013-07-09','DISA FSO','policy','The organization employs organization-defined tests of downgrading equipment in accordance with organization-defined frequency.','MP-8(2).1','The organization being inspected/assessed implements tests defined in MP-8 (2), CCI 2590 at a minimum annually to verify correct performance of equipment.  The organization must maintain a record of tests.  DoD has defined the frequency as at a minimum annually.','The organization conducting the inspection/assessment obtains and examines the record of tests to ensure the organization being inspected/assessed implements tests defined in MP-8 (2), CCI 2590 at a minimum annually to verify correct performance of equipment.  DoD has defined the frequency as at a minimum annually. '),\n('002589','draft','2013-07-09','DISA FSO','policy','The organization employs procedures to verify correct performance of organization-defined tests of downgrading equipment in accordance with organization-defined frequency.','MP-8(2).2','The organization being inspected/assessed implements tests defined in MP-8 (2), CCI 2590 at a minimum annually to verify correct performance of procedures.  The organization must maintain a record of tests.  DoD has defined the frequency as at a minimum annually.','The organization conducting the inspection/assessment obtains and examines the record of tests to ensure the organization being inspected/assessed implements tests defined in MP-8 (2), CCI 2590 at a minimum annually to verify correct performance of procedures.  DoD has defined the frequency as at a minimum annually.  '),\n('002590','draft','2013-07-09','DISA FSO','policy','The organization defines tests to employ for downgrading equipment.','MP-8(2).3','The organization being inspected/assessed defines and documents tests to employ for downgrading equipment.  DoD has determined the tests are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented tests to ensure the organization being inspected/assessed defines tests to employ for downgrading equipment.  DoD has determined the tests are not appropriate to define at the Enterprise level.'),\n('002591','draft','2013-07-09','DISA FSO','policy','The organization defines the frequency with which to employ tests of downgrading equipment and procedures to verify correct performance.','MP-8(2).4','DoD has defined the frequency as at a minimum annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at a minimum annually.'),\n('002592','draft','2013-07-09','DISA FSO','policy','The organization defines Controlled Unclassified Information (CUI).','MP-8(3).1','DoD has defined the Controlled Unclassified Information (CUI) as any Controlled Unclassified Information (CUI).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the Controlled Unclassified Information (CUI) as any Controlled Unclassified Information (CUI).'),\n('002593','draft','2013-07-09','DISA FSO','policy','The organization downgrades information system media containing organization-defined Controlled Unclassified Information (CUI) prior to public release in accordance with applicable federal and organizational standards and policies.','MP-8(3).2','The organization being inspected/assessed implements a process to downgrade information system media containing any Controlled Unclassified Information (CUI) prior to public release in accordance with applicable federal and organizational standards and policies.  The organization must maintain a record of public release of media and a record of information system media downgrade.  DoD has defined the Controlled Unclassified Information (CUI) as any Controlled Unclassified Information (CUI).','The organization conducting the inspection/assessment obtains and examines the record of public release of media as well as records of information system media downgrade to ensure the organization being inspected/assessed implements a process to downgrade information system media containing any Controlled Unclassified Information (CUI) prior to public release in accordance with applicable federal and organizational standards and policies.  DoD has defined the Controlled Unclassified Information (CUI) as any Controlled Unclassified Information (CUI).'),\n('002594','draft','2013-07-09','DISA FSO','policy','The organization downgrades information system media containing classified information prior to release to individuals without required access authorizations in accordance with NSA standards and policies.','MP-8(4).1','The organization being inspected/assessed implements a process to downgrade information system media containing classified information prior to release to individuals without required access authorizations in accordance with NSA standards and policies.  The organization must maintain a record of release of media containing classified information and a record of information system media downgrade.','The organization conducting the inspection/assessment obtains and examines the record of release of media containing classified information as well as records of information system media downgrade to ensure the organization being inspected/assessed implements a process to downgrade information system media containing classified information prior to release to individuals without required access authorizations in accordance with NSA standards and policies.'),\n('002595','deprecated','2013-07-09','DISA FSO','policy','The organization establishes an organization-defined information system media downgrading process that includes employing downgrading mechanisms with organization-defined strength and integrity.',NULL,NULL,NULL),\n('002596','draft','2013-07-09','DISA FSO','policy','The organization establishes and defines an information system media downgrading process that includes employing downgrading mechanisms with organization-defined strength and integrity.','MP-8.1','The organization being inspected/assessed defines and documents an information system media downgrading process that includes employing downgrading mechanisms with organization-defined strength and integrity.   DoD has determined the information system media downgrading process is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system media downgrading process to ensure the organization being inspected/assessed defines  an information system media downgrading process that includes employing downgrading mechanisms with organization-defined strength and integrity.   DoD has determined the information system media downgrading process is not appropriate to define at the Enterprise level.'),\n('002597','draft','2013-07-09','DISA FSO','policy','The organization defines strength and integrity for downgrading mechanisms to establish an organization-defined information system media downgrading process.','MP-8.2','The organization being inspected/assessed defines and documents strength and integrity for downgrading mechanisms to establish an organization-defined information system media downgrading process.  DoD has determined the strength and integrity are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented strength and integrity to ensure the organization being inspected/assessed defines strength and integrity for downgrading mechanisms to establish an organization-defined information system media downgrading process.  DoD has determined the strength and integrity are not appropriate to define at the Enterprise level.'),\n('002598','draft','2013-07-09','DISA FSO','policy','The organization ensures that the information system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information.','MP-8.3','The organization being inspected/assessed includes within the process defined in MP-8, CCI 2596, processes which are commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information.','The organization conducting the inspection/assessment obtains and examines the documented process defined in MP-8, CCI 2596 to ensure it is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information.'),\n('002599','draft','2013-07-09','DISA FSO','policy','The organization defines and identifies the information system media requiring downgrading.','MP-8.4','The organization being inspected/assessed defines, identifies, and documents the information system media requiring downgrading.  DoD has determined the information system media is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system media to ensure the organization being inspected/assessed defines and identifies the information system media requiring downgrading.  DoD has determined the information system media is not appropriate to define at the Enterprise level.'),\n('002600','draft','2013-07-09','DISA FSO','policy','The organization downgrades the identified information system media using the established process.','MP-8.5','The organization being inspected/assessed implements the process defined in MP-8, CCI 2596 to downgrade media defined in MP-8, CCI 2599.  The organization must maintain a record of downgrade activities.','The organization conducting the inspection/assessment obtains and examines the record of downgrade activities to ensure the organization being inspected/assessed implements the process defined in MP-8, CCI 2596 to downgrade media defined in MP-8, CCI 2599.'),\n('002601','draft','2013-07-11','DISA FSO','policy','The organization defines the personnel or roles to whom the system and information integrity policy and procedures are to be disseminated.','SI-1.1','DoD has defined the personnel or roles as all appointed information assurance personnel.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the personnel or roles as all appointed information assurance personnel.'),\n('002602','draft','2013-07-11','DISA FSO','policy','The organization tests firmware updates related to flaw remediation for effectiveness before installation.','SI-2.6','The organization being inspected/assessed documents and implements a process to test  firmware updates related to flaw remediation for effectiveness before installation.  If the firmware update is being provided by a vendor who has documented the effectiveness of the update in fixing the affected IAVM/CVE, further testing by the organization may not be required.','The organization conducting the inspection/assessment obtains and examines the documented process and test results to ensure the organization being inspected/assessed tests firmware updates related to flaw remediation for effectiveness before installation.'),\n('002603','draft','2013-07-11','DISA FSO','policy','The organization tests firmware updates related to flaw remediation for potential side effects before installation.','SI-2.7','The organization being inspected/assessed documents and implements a process for regression testing IAW CM-4 to identify any potential side effects before installation of software updates.','The organization conducting the inspection/assessment obtains and examines the documented process and test results to ensure the organization being inspected/assessed tests firmware updates related to flaw remediation for potential side effects before installation.'),\n('002604','draft','2013-07-11','DISA FSO','policy','The organization defines the time period following the release of updates within which security-related software updates are to be installed.','SI-2.8','DoD has defined the time period as 30 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the time period as 30 days'),\n('002605','draft','2013-07-11','DISA FSO','technical','The organization installs security-relevant software updates within an organization-defined time period of the release of the updates.','SI-2.9','The organization being inspected/assessed configures the information system to install security-relevant software updates within 30 days of the release of the updates\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2605.\\nDoD has defined the time period as 30 days.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  install security-relevant software updates within 30 days of the release of the updates.\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2605.\\nDoD has defined the time period as 30 days.'),\n('002606','draft','2013-07-11','DISA FSO','policy','The organization defines the time period following the release of updates within which security-related firmware updates are to be installed.','SI-2.10','DoD has defined the time period as 30 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the time period as 30 days'),\n('002607','draft','2013-07-11','DISA FSO','technical','The organization installs security-relevant firmware updates within an organization-defined time period of the release of the updates.','SI-2.11','The organization being inspected/assessed configures the information system to install security-relevant firmware updates within 30 days of the release of the updates.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2607.\\n\\nDoD has defined the time period as 30 days.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  install security-relevant firmware updates within 30 days of the release of the updates.\\n\\nFor information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2607.\\n\\nDoD has defined the time period as 30 days.'),\n('002608','draft','2013-07-11','DISA FSO','policy','The organization establishes organization-defined benchmarks for the time taken to apply corrective actions after flaw identification.','SI-2(3).3','The organization being inspected/assessed  implements benchmarks for the time taken to apply corrective actions after flaw identification IAW the period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).\\n\\nDoD has defined the benchmarks as within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).','The organization conducting the inspection/assessment obtains and examines records of corrective actions taken to ensure the organization being inspected/assessed  implements benchmarks for the time taken to apply corrective actions after flaw identification IAW the period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).\\n\\nDoD has defined the benchmarks as within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).'),\n('002609','draft','2013-07-11','DISA FSO','policy','The organization defines the information system components on which organization-defined security-relevant software updates will be automatically installed.','SI-2(5).1','The organization being inspected/assessed defines and documents the information system components on which organization-defined security-relevant software updates will be automatically installed.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components on which organization-defined security-relevant software updates will be automatically installed.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002610','draft','2013-07-11','DISA FSO','policy','The organization defines the information system components on which organization-defined security-relevant firmware updates will be automatically installed.','SI-2(5).2','The organization being inspected/assessed defines and documents the information system components on which organization-defined security-relevant firmware updates will be automatically installed.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components on which organization-defined security-relevant firmware updates will be automatically installed.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002611','draft','2013-07-11','DISA FSO','policy','The organization defines the security-relevant software updates to be automatically installed on organization-defined information system components.','SI-2(5).3','The organization being inspected/assessed defines and documents the security-relevant software updates to be automatically installed on organization-defined information system components.  DoD has determined the security-relevant software updates are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security-relevant software updates to ensure the organization being inspected/assessed defines the security-relevant software updates to be automatically installed on organization-defined information system components.  DoD has determined the security-relevant software updates are not appropriate to define at the Enterprise level.'),\n('002612','draft','2013-07-11','DISA FSO','policy','The organization defines the security-relevant firmware updates to be automatically installed on organization-defined information system components.','SI-2(5).4','The organization being inspected/assessed defines and documents  the security-relevant firmware updates to be automatically installed on organization-defined information system components.  DoD has determined the security-relevant firmware updates are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security-relevant firmware updates to ensure the organization being inspected/assessed  defines the security-relevant firmware updates to be automatically installed on organization-defined information system components.  DoD has determined the security-relevant firmware updates are not appropriate to define at the Enterprise level.'),\n('002613','draft','2013-07-11','DISA FSO','technical','The organization installs organization-defined security-relevant software updates automatically to organization-defined information system components.','SI-2(5).5','The organization being inspected/assessed configures the information system to install security-relevant software updates defined in SI-2 (5), CCI 2611 automatically to information system components defined in SI-2 (5), CCI 2609.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2613.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to install security-relevant software updates defined in SI-2 (5), CCI 2611 automatically to information system components defined in SI-2 (5), CCI 2609.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2613.'),\n('002614','draft','2013-07-11','DISA FSO','technical','The organization installs organization-defined security-relevant firmware updates automatically to organization-defined information system components.','SI-2(5).6','The organization being inspected/assessed configures the information system to install security-relevant firmware updates defined in SI-2 (5), CCI 2612 automatically to information system components defined in SI-2 (5), CCI 2610.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2614.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to install security-relevant firmware updates defined in SI-2 (5), CCI 2612 automatically to information system components defined in SI-2 (5), CCI 2610.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2614.'),\n('002615','draft','2013-07-11','DISA FSO','policy','The organization defines the software components to be removed (e.g., previous versions) after updated versions have been installed.','SI-2(6).1','DoD has defined the software components as all upgraded/replaced software components that are no longer required for operation.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the software components as all upgraded/replaced software components that are no longer required for operation.'),\n('002616','draft','2013-07-11','DISA FSO','policy','The organization defines the firmware components to be removed (e.g., previous versions) after updated versions have been installed.','SI-2(6).2','DoD has defined the firmware components as all upgraded/replaced firmware components that are no longer required for operation.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the firmware components as all upgraded/replaced firmware components that are no longer required for operation.'),\n('002617','draft','2013-07-11','DISA FSO','technical','The organization removes organization-defined software components (e.g., previous versions) after updated versions have been installed.','SI-2(6).3','The organization being inspected/assessed configures the information system to remove all upgraded/replaced software components that are no longer required for operation (e.g., previous versions) after updated versions have been installed.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2617.  DoD has defined the software components as all upgraded/replaced software components that are no longer required for operation.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to remove all upgraded/replaced software components that are no longer required for operation (e.g., previous versions) after updated versions have been installed.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2617.  DoD has defined the software components as all upgraded/replaced software components that are no longer required for operation.'),\n('002618','draft','2013-07-11','DISA FSO','technical','The organization removes organization-defined firmware components (e.g., previous versions) after updated versions have been installed.','SI-2(6).4','The organization being inspected/assessed configures the information system to remove all upgraded/replaced firmware components that are no longer required for operation e.g., previous versions) after updated versions have been installed.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2618.  DoD has defined the firmware components as all upgraded/replaced firmware components that are no longer required for operation.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to remove all upgraded/replaced firmware components that are no longer required for operation (e.g., previous versions) after updated versions have been installed.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2618.  DoD has defined the firmware components as all upgraded/replaced firmware components that are no longer required for operation.'),\n('002619','draft','2013-07-11','DISA FSO','policy','The organization employs malicious code protection mechanisms at information system entry points to detect malicious code.','SI-3.1','The organization being inspected/assessed identifies and documents the information system entry points and implements malicious code protection mechanisms at those entry points to detect malicious code.  Information system entry and exit points include, for example, firewalls, electronic mail servers, web servers, proxy servers, remote-access servers, workstations, notebook computers, and mobile devices. Malicious code protection mechanisms include, for example, anti-virus signature definitions and reputation-based technologies.','The organization conducting the inspection/assessment examines the information system architecture as well as the organization\\'s documentation of information system entry points and verifies that malicious code protection mechanisms are implemented.'),\n('002620','draft','2013-07-11','DISA FSO','policy','The organization employs malicious code protection mechanisms at information system exit points to detect malicious code.','SI-3.2','The organization being inspected/assessed identifies and documents the information system exit points and implements malicious code protection mechanisms at those exit points to detect malicious code.  Information system entry and exit points include, for example, firewalls, electronic mail servers, web servers, proxy servers, remote-access servers, workstations, notebook computers, and mobile devices. Malicious code protection mechanisms include, for example, anti-virus signature definitions and reputation-based technologies.','The organization conducting the inspection/assessment examines the information system architecture as well as the organization\\'s documentation of information system exit points and verifies that malicious code protection mechanisms are implemented.'),\n('002621','draft','2013-07-11','DISA FSO','policy','The organization employs malicious code protection mechanisms at information system entry points to eradicate malicious code.','SI-3.3','The organization being inspected/assessed configures the malicious code protection mechanisms identified in SI-3, CCI 2619 to  eradicate malicious code.','The organization conducting the inspection/assessment examines the information system architecture as well as the organization\\'s documentation of information system entry points and verifies that malicious code protection mechanisms are implemented to eradicate malicious code.'),\n('002622','draft','2013-07-11','DISA FSO','policy','The organization employs malicious code protection mechanisms at information system exit points to eradicate malicious code.','SI-3.4','The organization being inspected/assessed configures the malicious code protection mechanisms identified in SI-3, CCI 2620 to  eradicate malicious code.','The organization conducting the inspection/assessment examines the information system architecture as well as the organization\\'s documentation of information system exit points and verifies that malicious code protection mechanisms are implemented to eradicate malicious code.'),\n('002623','draft','2013-07-11','DISA FSO','policy','The organization defines the frequency for performing periodic scans of the information system for malicious code.','SI-3.6','DoD has defined the frequency as every 7 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as every 7 days.'),\n('002624','draft','2013-07-11','DISA FSO','policy','The organization configures malicious code protection mechanisms to perform real-time scans of files from external sources at network entry/exit points as the files are downloaded, opened, or executed in accordance with organizational security policy.','SI-3.7','The organization being inspected/assessed configures the malicious code protection mechanisms to perform real-time scans of files from external sources at network entry/exit points as the files are downloaded, opened, or executed in accordance with organizational security policy.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2624.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures malicious code protection mechanisms to perform real-time scans of files from external sources at network entry/exit points as the files are downloaded, opened, or executed in accordance with organizational security policy.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2624.'),\n('002625','draft','2013-07-11','DISA FSO','policy','The organization, when testing malicious code protection mechanisms, verifies the detection of the test case occurs.','SI-3(6).3','The organization being inspected/assessed  verifies the detection of the test case occurs when testing malicious code protection mechanisms.  The organization must maintain an audit trail of test cases and successful or failed detection.','The organization conducting the inspection/assessment obtains and examines the audit trail of test cases and successful or failed detection to ensure the organization being inspected/assessed verifies the detection of the test case occurs when testing malicious code protection mechanisms.'),\n('002626','draft','2013-07-11','DISA FSO','policy','The organization, when testing malicious code protection mechanisms, verifies the incident reporting of the test case occurs.','SI-3(6).4','The organization being inspected/assessed verifies the incident reporting of the test case occurs when testing malicious code protection mechanisms.  The organization must maintain an audit trail of test cases and success or failure.','The organization conducting the inspection/assessment obtains and examines the audit trail of test cases and success or failure to ensure the organization being inspected/assessed verifies the incident reporting of the test case occurs when testing malicious code protection mechanisms.'),\n('002627','draft','2013-07-11','DISA FSO','technical','The information system implements nonsignature-based malicious code detection mechanisms.','SI-3(7).1','The organization being inspected/assessed configures the information system to implement nonsignature-based malicious code detection mechanisms.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2627.  Nonsignature-based detection mechanisms include, for example, the use of heuristics to detect, analyze, and describe the characteristics or behavior of malicious code and to provide safeguards against malicious code for which signatures do not yet exist or for which existing signatures may not be effective.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement nonsignature-based malicious code detection mechanisms.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2627.'),\n('002628','draft','2013-07-11','DISA FSO','policy','The organization defines the unauthorized operating system commands that are to be detected through the kernel application programming interface by organization-defined information system hardware components.','SI-3(8).1','The organization being inspected/assessed defines and documents the unauthorized operating system commands that are to be detected through the kernel application programming interface by organization-defined information system hardware components.  DoD has determined the unauthorized operating system commands are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented unauthorized operating system commands to ensure the organization being inspected/assessed defines the unauthorized operating system commands that are to be detected through the kernel application programming interface by organization-defined information system hardware components.  DoD has determined the unauthorized operating system commands are not appropriate to define at the Enterprise level.'),\n('002629','draft','2013-07-11','DISA FSO','policy','The organization defines the information system hardware components that are to detect organization-defined unauthorized operating system commands through the kernel programming application interface.','SI-3(8).2','The organization being inspected/assessed defines and documents the information system hardware components that are to detect organization-defined unauthorized operating system commands through the kernel application interface.  DoD has determined the information system hardware components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system hardware components to ensure the organization being inspected/assessed defines the information system hardware components that are to detect organization-defined unauthorized operating system commands through the kernel application interface.  DoD has determined the information system hardware components are not appropriate to define at the Enterprise level.'),\n('002630','draft','2013-07-11','DISA FSO','technical','The information system detects organization-defined unauthorized operating system commands through the kernel application programming interface at organization-defined information system hardware components.','SI-3(8).3','The organization being inspected/assessed configures the information system to detect unauthorized operating system commands defined in SI-3 (8), CCI 2628 through the kernel application programming interface at information system hardware components defined in SI-3 (8), CCI 2629.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2630.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to detect unauthorized operating system commands defined in SI-3 (8), CCI 2628 through the kernel application programming interface at information system hardware components defined in SI-3 (8), CCI 2629.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2630.'),\n('002631','draft','2013-07-11','DISA FSO','technical','The information system issues a warning, audits the command execution, or prevents the execution of the command when organization-defined unauthorized operating system commands are detected.','SI-3(8).4','The organization being inspected/assessed configures the information system to issue a warning, audits the command execution, or prevents the execution of the command when unauthorized operating system commands defined in SI-3 (8), CCI 2628 are detected.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2631.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to issue a warning, audits the command execution, or prevents the execution of the command when unauthorized operating system commands defined in SI-3 (8), CCI 2628 are detected.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2631.'),\n('002632','draft','2013-07-11','DISA FSO','policy','The organization defines the remote commands that are to be authenticated using organization-defined safeguards for malicious code protection.','SI-3(9).1','The organization being inspected/assessed defines and documents the remote commands that are to be authenticated using organization-defined safeguards  for malicious code protection.  DoD has determined the remote commands are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented remote commands to ensure the organization being inspected/assessed defines the remote commands that are to be authenticated using organization-defined safeguards  for malicious code protection.  DoD has determined the remote commands are not appropriate to define at the Enterprise level.'),\n('002633','draft','2013-07-11','DISA FSO','policy','The organization defines the security safeguards to be implemented to authenticate organization-defined remote commands for malicious code protection.','SI-3(9).2','The organization being inspected/assessed defines and documents the security safeguards to be implemented to authenticate organization-defined remote commands for malicious code protection.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed  defines the security safeguards to be implemented to authenticate organization-defined remote commands for malicious code protection.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002634','draft','2013-07-11','DISA FSO','policy','The organization defines the tools to be employed to analyze the characteristics and behavior of malicious code.','SI-3(10).1','The organization being inspected/assessed defines and documents the tools to be employed to analyze the characteristics and  behavior of malicious code.  DoD has determined the tools are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented tools to ensure the organization being inspected/assessed defines the tools to be employed to analyze the characteristics and  behavior of malicious code.  DoD has determined the tools are not appropriate to define at the Enterprise level.'),\n('002635','draft','2013-07-11','DISA FSO','policy','The organization defines the techniques to be employed to analyze the characteristics and behavior of malicious code.','SI-3(10).2','The organization being inspected/assessed defines and documents the techniques to be employed to analyze the characteristics and  behavior of malicious code.  DoD has determined the techniques are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented techniques to ensure the organization being inspected/assessed defines the techniques to be employed to analyze the characteristics and  behavior of malicious code.  DoD has determined the techniques are not appropriate to define at the Enterprise level.'),\n('002636','draft','2013-07-11','DISA FSO','policy','The organization employs organization-defined tools to analyze the characteristics and behavior of malicious code.','SI-3(10).3','The organization being inspected/assessed documents and implements tools defined in SI-3 (10), CCI 2634 to analyze the characteristics and behavior of malicious code.','The organization conducting the inspection/assessment obtains and examines the documented tools to ensure the organization being inspected/assessed employs tools defined in SI-3 (10), CCI 2634 to analyze the characteristics and behavior of malicious code.'),\n('002637','draft','2013-07-11','DISA FSO','technical','The information system implements organization-defined security safeguards to authenticate organization-defined remote commands for malicious code protection.','SI-3(9).3','The organization being inspected/assessed configures the information system to implement security safeguards defined in SI-3 (9), CCI 2633 to authenticate remote commands for malicious code protection defined in SI-3 (9), CCI 2632.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2637.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement security safeguards defined in SI-3 (9), CCI 2633 to authenticate remote commands for malicious code protection defined in SI-3 (9), CCI 2632.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2637.'),\n('002638','draft','2013-07-11','DISA FSO','policy','The organization employs organization-defined techniques to analyze the characteristics and behavior of malicious code.','SI-3(10).4','The organization being inspected/assessed documents and implements techniques defined in SI-3 (10), CCI 2635 to analyze the characteristics and behavior of malicious code.','The organization conducting the inspection/assessment obtains and examines the documented techniques to ensure the organization being inspected/assessed employs techniques defined in SI-3 (10), CCI 2635 to analyze the characteristics and behavior of malicious code.'),\n('002639','draft','2013-07-11','DISA FSO','policy','The organization incorporates the results from malicious code analysis into organizational incident response processes.','SI-3(10).5','The organization being inspected/assessed incorporates the results from malicious code analysis into organizational incident response processes.','The organization conducting the inspection/assessment obtains and examines the organizational incident response processes to ensure the organization being inspected/assessed  incorporates the results from malicious code analysis into organizational incident response processes.'),\n('002640','draft','2013-07-11','DISA FSO','policy','The organization incorporates the results from malicious code analysis into organizational flaw remediation processes.','SI-3(10).6','The organization being inspected/assessed incorporates the results from malicious code analysis into organizational flaw remediation processes.','The organization conducting the inspection/assessment obtains and examines the flaw remediation processes to ensure the organization being inspected/assessed  incorporates the results from malicious code analysis into organizational flaw remediation processes.'),\n('002641','draft','2013-07-11','DISA FSO','policy','The organization monitors the information system to detect attacks and indicators of potential attacks in accordance with organization-defined monitoring objectives.','SI-4.2','The organization being inspected/assessed documents and implements a process to monitor the information system to detect attacks and indicators of potential attacks in accordance with sensor placement and monitoring requirements within CJCSI 6510.01F.  The organization must maintain an audit trail of monitoring.  DoD has defined the monitoring objectives as sensor placement and monitoring requirements within CJCSI 6510.01F.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of monitoring to ensure the organization being inspected/assessed monitors the information system to detect attacks and indicators of potential attacks in accordance with sensor placement and monitoring requirements within CJCSI 6510.01F.'),\n('002642','draft','2013-07-11','DISA FSO','policy','The organization monitors the information system to detect unauthorized local connections.','SI-4.3','The organization being inspected/assessed documents and implements a process to monitor the information system to detect unauthorized local connections.  The organization must maintain an audit trail of monitoring.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of monitoring to ensure the organization being inspected/assessed monitors the information system to detect unauthorized local connections.'),\n('002643','draft','2013-07-11','DISA FSO','policy','The organization monitors the information system to detect unauthorized network connections.','SI-4.4','The organization being inspected/assessed documents and implements a process to monitor the information system to detect unauthorized network connections.  The organization must maintain an audit trail of monitoring.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of monitoring to ensure the organization being inspected/assessed monitors the information system to detect unauthorized network connections.'),\n('002644','draft','2013-07-11','DISA FSO','policy','The organization monitors the information system to detect unauthorized remote connections.','SI-4.5','The organization being inspected/assessed documents and implements a process to monitor  information system to detect unauthorized remote connections.  The organization must maintain an audit trail of monitoring.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of monitoring to ensure the organization being inspected/assessed monitors the information system to detect unauthorized remote connections.'),\n('002645','draft','2013-07-11','DISA FSO','policy','The organization defines the techniques and methods to be used to identify unauthorized use of the information system.','SI-4.6','The organization being inspected/assessed defines and documents the techniques and methods to be used to identify unauthorized use of the information system.  DoD has determined the techniques and methods are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented techniques to ensure the organization being inspected/assessed  defines the techniques and methods to be used to identify unauthorized use of the information system.  DoD has determined the techniques and methods are not appropriate to define at the Enterprise level.'),\n('002646','draft','2013-07-11','DISA FSO','policy','The organization identifies unauthorized use of the information system through organization-defined techniques and methods.','SI-4.7','The organization being inspected/assessed identifies unauthorized use of the information system through techniques and methods defined in SI-4, CCI 2645.  The organization must maintain an audit trail of identified instances of unauthorized use.','The organization conducting the inspection/assessment obtains and examines the audit trail of identified instances of unauthorized use to ensure the organization being inspected/assessed identifies unauthorized use of the information system through techniques and methods defined in SI-4, CCI 2645.'),\n('002647','draft','2013-07-11','DISA FSO','policy','The organization protects information obtained from intrusion-monitoring tools from unauthorized access.','SI-4.10','The organization being inspected/assessed  documents and implements a process to protect information obtained from intrusion-monitoring tools from unauthorized access.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  protects information obtained from intrusion-monitoring tools from unauthorized access.'),\n('002648','draft','2013-07-11','DISA FSO','policy','The organization protects information obtained from intrusion-monitoring tools from unauthorized modification.','SI-4.11','The organization being inspected/assessed  documents and implements a process to protect information obtained from intrusion-monitoring tools from unauthorized modification.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  protects information obtained from intrusion-monitoring tools from unauthorized modification.'),\n('002649','draft','2013-07-11','DISA FSO','policy','The organization protects information obtained from intrusion-monitoring tools from unauthorized deletion.','SI-4.12','The organization being inspected/assessed  documents and implements a process to protect information obtained from intrusion-monitoring tools from unauthorized deletion.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  protects information obtained from intrusion-monitoring tools from unauthorized deletion.'),\n('002650','draft','2013-07-11','DISA FSO','policy','The organization defines the information system monitoring information that is to be provided the organization-defined personnel or roles.','SI-4.15','The organization being inspected/assessed defines and documents the information system monitoring information that is to be provided the organization-defined personnel or roles.  DoD has determined the information system monitoring information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system monitoring information to ensure the organization being inspected/assessed defines  the information system monitoring information that is to be provided the organization-defined personnel or roles.   DoD has determined the information system monitoring information is not appropriate to define at the Enterprise level.'),\n('002651','draft','2013-07-11','DISA FSO','policy','The organization defines the personnel or roles that are to be provided organization-defined information system monitoring information.','SI-4.16','The organization being inspected/assessed defines and documents the personnel or roles that are to be provided organization-defined information system monitoring information.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed  defines the personnel or roles that are to be provided organization-defined information system monitoring information.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.'),\n('002652','draft','2013-07-11','DISA FSO','policy','The organization defines the frequency at which the organization will provide the organization-defined information system monitoring information to organization-defined personnel or roles.','SI-4.17','The organization being inspected/assessed defines and documents the frequency at which the organization will provide the organization-defined information system monitoring information to organization-defined personnel or roles   DoD has determined the frequency is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed defines  the frequency at which the organization will provide the organization-defined information system monitoring information to organization-defined personnel or roles.  DoD has determined the frequency is not appropriate to define at the Enterprise level.'),\n('002653','deprecated','2013-07-11','DISA FSO','policy','The organization provides organization-defined information system monitoring information to organization-defined personnel or roles as needed or per organization-defined frequency.',NULL,NULL,NULL),\n('002654','draft','2013-07-11','DISA FSO','policy','The organization provides organization-defined information system monitoring information to organization-defined personnel or roles as needed or per organization-defined frequency.','SI-4.18','The organization being inspected/assessed provides information system monitoring information defined in SI-4, CCI 2650 to personnel or roles defined in SI-4, CCI 2651 as needed or per the frequency defined in SI-4, CCI 2652.  The organization must maintain an audit trail of when information is provided.','The organization conducting the inspection/assessment obtains and examines the audit trail of when information is provided to ensure the organization being inspected/assessed provides information system monitoring information defined in SI-4, CCI 2650 to personnel or roles defined in SI-4, CCI 2651 as needed or per the frequency defined in SI-4, CCI 2652.'),\n('002655','draft','2013-07-11','DISA FSO','policy','The organization connects individual intrusion detection tools into an information system-wide intrusion detection system.','SI-4(1).1','The organization being inspected/assessed connects individual intrusion detection tools into an information system-wide intrusion detection system.','The organization conducting the inspection/assessment examines the information system-wide intrusion detection system architecture and individuals tools to ensure the organization being inspected/assessed connects individual intrusion detection tools into an information system-wide intrusion detection system.'),\n('002656','draft','2013-07-11','DISA FSO','technical','The organization configures individual intrusion detection tools into an information system-wide intrusion detection system.','SI-4(1).2','The organization being inspected/assessed configures individual intrusion detection tools into an information system-wide intrusion detection system.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2656.','The organization conducting the inspection/assessment examines the information system-wide intrusion detection system to ensure the organization being inspected/assessed configures individual intrusion detection tools into an information system-wide intrusion detection system.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2656.'),\n('002657','draft','2013-07-11','DISA FSO','policy','The organization employs automated tools to integrate intrusion detection tools into access control mechanisms for rapid response to attacks by enabling reconfiguration of these mechanisms in support of attack isolation and elimination.','SI-4(3).1','The organization being inspected/assessed documents and implements automated tools to integrate intrusion detection tools into access control mechanisms for rapid response to attacks by enabling reconfiguration of these mechanisms in support of attack isolation and elimination.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated tools to ensure the organization being inspected/assessed  employs automated tools to integrate intrusion detection tools into access control mechanisms for rapid response to attacks by enabling reconfiguration of these mechanisms in support of attack isolation and elimination.  The organization being inspected/assessed may be required to demonstrate use of their automated tools.'),\n('002658','draft','2013-07-11','DISA FSO','policy','The organization employs automated tools to integrate intrusion detection tools into flow control mechanisms for rapid response to attacks by enabling reconfiguration of these mechanisms in support of attack isolation and elimination.','SI-4(3).2','The organization being inspected/assessed documents and implements automated tools to integrate intrusion detection tools into flow control mechanisms for rapid response to attacks by enabling reconfiguration of these mechanisms in support of attack isolation and elimination.','The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated tools to ensure the organization being inspected/assessed  employs automated tools to integrate intrusion detection tools into flow control mechanisms for rapid response to attacks by enabling reconfiguration of these mechanisms in support of attack isolation and elimination.  The organization being inspected/assessed may be required to demonstrate use of their automated tools.'),\n('002659','draft','2013-07-11','DISA FSO','policy','The organization defines the frequency on which it will monitor inbound communications for unusual or unauthorized activities or conditions.','SI-4(4).1','DoD has defined the frequency as continuously.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as continuously.'),\n('002660','draft','2013-07-11','DISA FSO','policy','The organization defines the frequency on which it will monitor outbound communications for unusual or unauthorized activities or conditions.','SI-4(4).2','DoD has defined the frequency as continuously.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as continuously.'),\n('002661','draft','2013-07-11','DISA FSO','technical','The information system monitors inbound communications traffic per organization-defined frequency for unusual or unauthorized activities or conditions.','SI-4(4).3','The organization being inspected/assessed configures the information system to monitor inbound communications traffic continuously for unusual or unauthorized activities or conditions.  DoD has defined the frequency as continuously.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to monitor inbound communications traffic continuously for unusual or unauthorized activities or conditions.  DoD has defined the frequency as continuously.'),\n('002662','draft','2013-07-11','DISA FSO','technical','The information system monitors outbound communications traffic per organization-defined frequency for unusual or unauthorized activities or conditions.','SI-4(4).4','The organization being inspected/assessed configures the information system to monitor  outbound communications traffic continuously for unusual or unauthorized activities or conditions.  DoD has defined the frequency as continuously.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to monitor outbound communications traffic continuously for unusual or unauthorized activities or conditions.  DoD has defined the frequency as continuously.'),\n('002663','draft','2013-07-11','DISA FSO','policy','The organization defines the personnel or roles to receive information system alerts when organization-defined indicators of compromise or potential compromise occur.','SI-4(5).2','DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO. ','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.  '),\n('002664','draft','2013-07-11','DISA FSO','technical','The information system alerts organization-defined personnel or roles when organization-defined compromise indicators reflect the occurrence of a compromise or a potential compromise.','SI-4(5).3','The organization being inspected/assessed configures the information system to alert at a minimum, the ISSM and ISSO when real time intrusion detection and when there are threats identified by authoritative sources (e.g. CTOs) and IAW incident categories I, II, IV, & VII  within CJCSM 6510.01B reflect the occurrence of a compromise or a potential compromise.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2664.  DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.   DoD has defined the compromise indicators as real time intrusion detection and when there are threats identified by authoritative sources (e.g. CTOs) and IAW incident categories I, II, IV, & VII  within CJCSM 6510.01B.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  alert at a minimum, the ISSM and ISSO when real time intrusion detection and when there are threats identified by authoritative sources (e.g. CTOs) and IAW incident categories I, II, IV, & VII  within CJCSM 6510.01B reflect the occurrence of a compromise or a potential compromise.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2664.  DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.   DoD has defined the compromise indicators as real time intrusion detection and when there are threats identified by authoritative sources (e.g. CTOs) and IAW incident categories I, II, IV, & VII  within CJCSM 6510.01B.'),\n('002665','draft','2013-07-11','DISA FSO','policy','The organization defines the encrypted communications traffic that is to be visible to organization-defined information system monitoring tools.','SI-4(10).1','The organization being inspected/assessed defines and documents the encrypted communications traffic that are to be visible to organization-defined information system monitoring tools.  DoD has determined the encrypted traffic is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented encrypted traffic to ensure the organization being inspected/assessed  defines the encrypted communications traffic that are to be visible to organization-defined information system monitoring tools.  DoD has determined the encrypted traffic is not appropriate to define at the Enterprise level.'),\n('002666','draft','2013-07-11','DISA FSO','policy','The organization defines the information system monitoring tools that will have visibility into organization-defined encrypted communications traffic.','SI-4(10).2','The organization being inspected/assessed defines and documents  the information system monitoring tools that will have visibility into organization-defined encrypted communications traffic.  DoD has determined the information system monitoring tools are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system monitoring tools to ensure the organization being inspected/assessed  defines the information system monitoring tools that will have visibility into organization-defined encrypted communications traffic.  DoD has determined the information system monitoring tools are not appropriate to define at the Enterprise level.'),\n('002667','draft','2013-07-11','DISA FSO','policy','The organization makes provisions so that organization-defined encrypted communications traffic is visible to organization-defined information system monitoring tools.','SI-4(10).3','The organization being inspected/assessed makes provisions so that encrypted communications traffic defined in SI-4 (10), CCI 2665 is visible to information system monitoring tools defined in SI-4 (10), CCI 2666.','The organization conducting the inspection/assessment examines the information system architecture to verify that the encrypted communications traffic is visible to  information system monitoring tools defined in SI-4 (10), CCI 2666.'),\n('002668','draft','2013-07-11','DISA FSO','policy','The organization defines the interior points within the information system (e.g., subnetworks, subsystems) where outbound communications will be analyzed to discover anomalies.','SI-4(11).3','The organization being inspected/assessed defines and documents the interior points within the information system (e.g., subnetworks, subsystems) where outbound communications will be analyzed to discover anomalies.  DoD has determined the interior points are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented interior points to ensure the organization being inspected/assessed defines the interior points within the information system (e.g., subnetworks, subsystems) where outbound communications will be analyzed to discover anomalies.  DoD has determined the interior points are not appropriate to define at the Enterprise level.'),\n('002669','draft','2013-07-11','DISA FSO','policy','The organization uses the traffic/event profiles in tuning system-monitoring devices to reduce the number of false positives and false negatives.','SI-4(13).3','The organization being inspected/assessed documents and implements a process to use the traffic/event profiles in tuning system-monitoring devices to reduce the number of false positives and false negatives.  The organization must maintain an audit log of tuning events.','The organization conducting the inspection/assessment obtains and examines the documented process as well as audit logs of tuning events to ensure the organization being inspected/assessed uses the traffic/event profiles in tuning system-monitoring devices to reduce the number of false positives and false negatives.'),\n('002670','draft','2013-07-11','DISA FSO','policy','The organization defines the interior points within the system (e.g., subsystems, subnetworks) where outbound communications will be analyzed to detect covert exfiltration of information.','SI-4(18).1','The organization being inspected/assessed defines and documents the interior points within the system (e.g., subsystems, subnetworks) where outbound communications will be analyzed to detect covert exfiltration of information.  DoD has determined the interior points are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented interior points to ensure the organization being inspected/assessed defines the interior points within the system (e.g., subsystems, subnetworks) where outbound communications will be analyzed to detect covert exfiltration of information.  DoD has determined the interior points are not appropriate to define at the Enterprise level.'),\n('002671','draft','2013-07-11','','policy','The organization analyzes outbound communications traffic at the external boundary of the information system (i.e., system perimeter) to detect covert exfiltration of information.','SI-4(18).2','The organization being inspected/assessed documents and implements a process to analyze outbound communications traffic at the external boundary of the information system (i.e., system perimeter) to detect covert exfiltration of information.  The organization must maintain a record of the analysis.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of analysis to ensure the organization being inspected/assessed  analyzes outbound communications traffic at the external boundary of the information system (i.e., system perimeter) to detect covert exfiltration of information.'),\n('002672','draft','2013-07-11','DISA FSO','policy','The organization analyzes outbound communications traffic at organization-defined interior points within the system (e.g., subsystems, subnetworks) to detect covert exfiltration of information.','SI-4(18).3','The organization being inspected/assessed documents and implements a process to analyze outbound communications traffic at interior points defined in SI-4 (18), CCI 2670 within the system (e.g., subsystems, subnetworks) to detect covert exfiltration of information.  The organization must maintain a record of the analysis.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of analysis to ensure the organization being inspected/assessed analyzes outbound communications traffic at interior points defined in SI-4 (18), CCI 2670 within the system (e.g., subsystems, subnetworks) to detect covert exfiltration of information.'),\n('002673','draft','2013-07-11','DISA FSO','policy','The organization defines the additional monitoring to be implemented for individuals identified as posing an increased level of risk.','SI-4(19).1','The organization being inspected/assessed defines and documents the additional monitoring to be implemented for individuals identified as posing an increased level of risk.  DoD has determined the additional monitoring is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented additional monitoring to ensure the organization being inspected/assessed defines the additional monitoring to be implemented for individuals identified as posing an increased level of risk.  DoD has determined the additional monitoring is not appropriate to define at the Enterprise level.'),\n('002674','draft','2013-07-11','DISA FSO','policy','The organization defines the sources that may be used to identify individuals who pose an increased level of risk.','SI-4(19).2','The organization being inspected/assessed defines and documents the sources that may be used to identify individuals who pose an increased level of risk.  DoD has determined the sources are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented sources to ensure the organization being inspected/assessed defines the sources that may be used to identify individuals who pose an increased level of risk.  DoD has determined the sources are not appropriate to define at the Enterprise level.'),\n('002675','draft','2013-07-11','DISA FSO','policy','The organization implements organization-defined additional monitoring of individuals who have been identified by organization-defined sources as posing an increased level of risk.','SI-4(19).3','The organization being inspected/assessed implements additional monitoring defined in SI-4 (19), CCI 2673 of individuals who have been identified by  sources defined in SI-4 (19), CCI 2674 as posing an increased level of risk.  The organization must maintain an audit trail of additional monitoring.','The organization conducting the inspection/assessment obtains and examines the audit trail of additional monitoring to ensure the organization being inspected/assessed implements additional monitoring defined in SI-4 (19), CCI 2673 of individuals who have been identified by  sources defined in SI-4 (19), CCI 2674 as posing an increased level of risk.'),\n('002676','draft','2013-07-11','DISA FSO','policy','The organization defines additional monitoring to be implemented for privileged users.','SI-4(20).1','The organization being inspected/assessed defines and documents additional monitoring to be implemented for privileged users.  DoD has determined the additional monitoring is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented additional monitoring to ensure the organization being inspected/assessed defines additional monitoring to be implemented for privileged users.  DoD has determined the additional monitoring is not appropriate to define at the Enterprise level.'),\n('002677','draft','2013-07-11','DISA FSO','policy','The organization implements organization-defined additional monitoring of privileged users.','SI-4(20).2','The organization being inspected/assessed  implements additional monitoring defined in SI-4 (20), CCI 2676 of privileged users.  The organization must maintain an audit trail of additional monitoring.','The organization conducting the inspection/assessment obtains and examines the audit trail of additional monitoring to ensure the organization being inspected/assessed implements additional monitoring defined in SI-4 (20), CCI 2676 of privileged users.'),\n('002678','draft','2013-07-11','DISA FSO','policy','The organization defines additional monitoring to be implemented for individuals during an organization-defined probationary period.','SI-4(21).1','The organization being inspected/assessed defines and documents additional monitoring to be implemented for individuals during an organization-defined probationary period.  DoD has determined the additional monitoring is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented additional monitoring to ensure the organization being inspected/assessed defines additional monitoring to be implemented for individuals during an organization-defined probationary period.  DoD has determined the additional monitoring is not appropriate to define at the Enterprise level.'),\n('002679','draft','2013-07-11','DISA FSO','policy','The organization defines the probationary period during which additional monitoring will be implemented for individuals.','SI-4(21).2','The organization defines and documents the probationary period during which additional monitoring will be implemented for individuals.  DoD has determined the probationary period is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented probationary period to ensure the organization being inspected/assessed defines the probationary period during which additional monitoring will be implemented for individuals.  DoD has determined the probationary period is not appropriate to define at the Enterprise level.'),\n('002680','draft','2013-07-11','DISA FSO','policy','The organization implements organization-defined additional monitoring of individuals during an organization-defined probationary period.','SI-4(21).3','The organization being inspected/assessed implements additional monitoring defined in SI-4 (21), CCI 2678 of individuals during the probationary period defined in SI-4 (21), CCI 2679.  The organization must maintain an audit trail of additional monitoring.','The organization conducting the inspection/assessment obtains and examines the audit trail of additional monitoring to ensure the organization being inspected/assessed implements additional monitoring defined in SI-4 (21), CCI 2678 of individuals during the probationary period defined in SI-4 (21), CCI 2679.'),\n('002681','draft','2013-07-11','DISA FSO','policy','The organization defines the authorization or approval process for network services.','SI-4(22).1','DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.'),\n('002682','draft','2013-07-11','DISA FSO','policy','The organization defines the personnel or roles to be alerted when unauthorized or unapproved network services are detected.','SI-4(22).2','DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.'),\n('002683','draft','2013-07-11','DISA FSO','policy','The information system detects network services that have not been authorized or approved by the organization-defined authorization or approval processes.','SI-4(22).3','The organization being inspected/assessed documents and implements a process to detect network services that have not been authorized or approved by at a minimum, the ISSO and ISSM.  For network service detection mechanisms that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2683.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.','The organization conducting the inspection/assessment obtains and examines the documented process, and examines the implemented detection mechanisms to ensure the organization being inspected/assessed implements a process to detect network services that have not been authorized or approved by  at a minimum, the ISSO and ISSM.\\nFor network service detection mechanisms that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2683.\\nDoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.'),\n('002684','draft','2013-07-11','DISA FSO','technical','The information system audits and/or alerts organization-defined personnel when unauthorized network services are detected.','SI-4(22).4','The organization being inspected/assessed configures the information system to audit and/or alert  at a minimum, the ISSO and ISSM when unauthorized network services are detected.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2684.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to audit and/or alert at a minimum, the ISSO and ISSM when unauthorized network services are detected.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2684.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.'),\n('002685','draft','2013-07-11','DISA FSO','policy','The organization defines the host-based monitoring mechanisms to be implemented at organization-defined information system components.','SI-4(23).1','DoD has defined the host-based monitoring mechanisms as HBSS.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the host-based monitoring mechanisms as HBSS.'),\n('002686','draft','2013-07-11','DISA FSO','policy','The organization defines the information system components at which organization-defined host-based monitoring mechanisms are to be implemented.','SI-4(23).2','DoD has defined the information system components as all components.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information system components as all components.'),\n('002687','draft','2013-07-11','DISA FSO','policy','The organization implements organization-defined host-based monitoring mechanisms at organization-defined information system components.','SI-4(23).3','The organization being inspected/assessed documents and implements HBSS at all  components.   DoD has defined the host-based monitoring mechanisms as HBSS.  DoD has defined the information system components as all components.','The organization conducting the inspection/assessment obtains and examines documentation of the use of HBSS to ensure the organization being inspected/assessed  implements HBSS at all components.  The organization being inspected/assessed may be required to demonstrate use of HBSS.   DoD has defined the host-based monitoring mechanisms as HBSS.  DoD has defined the information system components as all components.'),\n('002688','draft','2013-07-11','DISA FSO','technical','The information system discovers indicators of compromise.','SI-4(24).1','The organization being inspected/assessed configures the information system to discover indicators of compromise.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2688.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to discover indicators of compromise.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2688.'),\n('002689','draft','2013-07-11','DISA FSO','technical','The information system collects indicators of compromise.','SI-4(24).2','The organization being inspected/assessed configures the information system to collect indicators of compromise.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2689.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to collect indicators of compromise.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2689.'),\n('002690','draft','2013-07-11','DISA FSO','technical','The information system distributes indicators of compromise.','SI-4(24).3','The organization being inspected/assessed configures the information system to distribute indicators of compromise.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2690.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to distribute indicators of compromise.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2690.'),\n('002691','draft','2013-07-11','DISA FSO','technical','The information system uses indicators of compromise.','SI-4(24).4','The organization being inspected/assessed configures the information system to use indicators of compromise to react to known indicators and prevent future exploitation of them.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2691.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to use indicators of compromise to react to known indicators and prevent future exploitation of them.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2691.'),\n('002692','draft','2013-07-11','DISA FSO','policy','The organization defines the external organizations from which it receives information system security alerts, advisories, and directives.','SI-5.2','DoD has defined the external organizations as at a minimum, USCYBERCOM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the external organizations as at a minimum, USCYBERCOM.'),\n('002693','draft','2013-07-11','DISA FSO','policy','The organization defines the elements within the organization to whom the organization will disseminate security alerts, advisories, and directives.','SI-5.6','DoD has determined the elements are not applicable as elements are not selected as recipients of security alerts, advisories and directives.','DoD has determined the elements are not applicable as elements are not selected as recipients of security alerts, advisories and directives.'),\n('002694','draft','2013-07-11','DISA FSO','policy','The organization defines the external organizations to which the organization will disseminate security alerts, advisories, and directives.','SI-5.7','DoD has defined the external organizations as CNDSP Tier 1 for vetting. The CNDSP Tier 1 will pass the information to the accredited Tier 2 CNDSPs.  Tier 2 CNDSPs are responsible for ensuring all Tier 3 entities receive the information.  Tier 3 organizations will ensure all local Op Centers/LAN shops receive information (i.e. Component IT System and Security Personnel) (e.g. ISSM, ISSOs, and system administrators).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the external organizations as CNDSP Tier 1 for vetting. The CNDSP Tier 1 will pass the information to the accredited Tier 2 CNDSPs.  Tier 2 CNDSPs are responsible for ensuring all Tier 3 entities receive the information.  Tier 3 organizations will ensure all local Op Centers/LAN shops receive information (i.e. Component IT System and Security Personnel) (e.g. ISSM, ISSOs, and system administrators).'),\n('002695','draft','2013-07-11','DISA FSO','policy','The organization defines the security functions that require verification of correct operation.','SI-6.1','The organization being inspected/assessed defines and documents the security functions that require verification of correct operation.  DoD has determined the security functions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security functions to ensure the organization being inspected/assessed defines the security functions that require verification of correct operation.  DoD has determined the security functions are not appropriate to define at the Enterprise level.'),\n('002696','draft','2013-07-11','DISA FSO','technical','The information system verifies correct operation of organization-defined security functions.','SI-6.2','The organization being inspected/assessed configures the information system to verify correct operation of security functions defined in SI-6, CCI 2695.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2696.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  verify correct operation of security functions defined in SI-6, CCI 2695.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2696.'),\n('002697','draft','2013-07-11','DISA FSO','policy','The organization defines the frequency at which it will verify correct operation of organization-defined security functions.','SI-6.3','DoD has defined the frequency as 30 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as 30 days.'),\n('002698','draft','2013-07-11','DISA FSO','policy','The organization defines the system transitional states when the information system will verify correct operation of organization-defined security functions.','SI-6.4','DoD has defined the system transitional states as upon system startup, and/or restart, upon command by user with appropriate privileges.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the system transitional states as upon system startup, and/or restart, upon command by user with appropriate privileges.'),\n('002699','draft','2013-07-11','DISA FSO','technical','The information system performs verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.','SI-6.5','The organization being inspected/assessed configures the information system to perform verification of the correct operation of  security functions defined in SI-6, CCI 1294: when the system is in a transitional state defined in SI-6, CCI 2698; upon command by a user with appropriate privileges; and/or 30 days.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2699.  DoD has defined the frequency as 30 days.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to perform verification of the correct operation of  security functions defined in SI-6, CCI 1294: when the system is in a transitional state defined in SI-6, CCI 2698; upon command by a user with appropriate privileges; and/or 30 days.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2699.  DoD has defined the frequency as 30 days.'),\n('002700','draft','2013-07-11','DISA FSO','policy','The organization defines the personnel or roles to be notified when security verification tests fail.','SI-6.7','DoD has defined the personnel or roles as the ISSO and ISSM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as the ISSO and ISSM.'),\n('002701','draft','2013-07-11','DISA FSO','policy','The organization defines alternative action(s) to be taken when the information system discovers anomalies in the operation of organization-defined security functions.','SI-6.8','DoD has defined the alternative action(s) as notifies system administrator.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the alternative action(s) as notifies system administrator.'),\n('002702','draft','2013-07-11','DISA FSO','technical','The information system shuts the information system down, restarts the information system, and/or initiates organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.','SI-6.9','The organization being inspected/assessed configures the information system to shut the information system down, restarts the information system, and/or notifies system administrator when anomalies in the operation of the security functions defined in SI-6, CCI 2695 are discovered.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2702.  DoD has defined the alternative action(s) as notifies system administrator.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  shut the information system down, restarts the information system, and/or notifies system administrator when anomalies in the operation of the security functions defined in SI-6, CCI 2695 are discovered.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2702.  DoD has defined the alternative action(s) as notifies system administrator.'),\n('002703','draft','2013-07-11','DISA FSO','policy','The organization defines the software, firmware, and information which will be subjected to integrity verification tools to detect unauthorized changes.','SI-7.1','The organization being inspected/assessed defines and documents the software, firmware, and information which will be subjected to integrity verification tools to detect unauthorized changes.  DoD has determined the software, firmware, and information are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented software, firmware, and information to ensure the organization being inspected/assessed defines the software, firmware, and information which will be subjected to integrity verification tools to detect unauthorized changes.  DoD has determined the software, firmware, and information are not appropriate to define at the Enterprise level.'),\n('002704','draft','2013-07-11','DISA FSO','policy','The organization employs integrity verification tools to detect unauthorized changes to organization-defined software, firmware, and information.','SI-7.2','The organization being inspected/assessed designs the information system to employ integrity verification tools to detect unauthorized changes to software, firmware, and information defined in SI-7, CCI 2703.','The organization conducting the inspection/assessment obtains and examines the hardware/software lists and any other documentation applicable to integrity verification tools to ensure the organization being inspected/assessed employs  integrity verification tools to detect unauthorized changes to software, firmware, and information defined in SI-7, CCI 2703.'),\n('002705','draft','2013-07-11','DISA FSO','policy','The organization defines the software on which integrity checks will be performed.','SI-7(1).1','The organization being inspected/assessed defines and documents the software on which integrity checks will be performed.  DoD has determined the software is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented software to ensure the organization being inspected/assessed  defines the firmware on which integrity checks will be performed.  DoD has determined the software is not appropriate to define at the Enterprise level.'),\n('002706','draft','2013-07-11','DISA FSO','policy','The organization defines the firmware on which integrity checks will be performed.','SI-7(1).2','The organization being inspected/assessed defines and documents the firmware on which integrity checks will be performed.  DoD has determined the firmware is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented firmware to ensure the organization being inspected/assessed  defines the firmware on which integrity checks will be performed.  DoD has determined the firmware is not appropriate to define at the Enterprise level.'),\n('002707','draft','2013-07-11','DISA FSO','policy','The organization defines the information on which integrity checks will be performed.','SI-7(1).3','The organization being inspected/assessed defines and documents the information on which integrity checks will be performed.  DoD has determined the information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information to ensure the organization being inspected/assessed  defines the information on which integrity checks will be performed.  DoD has determined the information is not appropriate to define at the Enterprise level.'),\n('002708','draft','2013-07-11','DISA FSO','policy','The organization defines the transitional state or security-relevant events when the information system will perform integrity checks on software, firmware, and information.','SI-7(1).4','The organization being inspected/assessed defines and documents the transitional state or security-relevant events when the information system will perform integrity checks on software, firmware and information.  DoD has determined the transitional state or security-relevant events are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented transitional state or security-relevant event to ensure the organization being inspected/assessed defines the transitional state or security-relevant events when the information system will perform integrity checks on software, firmware and information.  DoD has determined the transitional state or security-relevant events are not appropriate to define at the Enterprise level.'),\n('002709','draft','2013-07-11','DISA FSO','policy','The organization defines the frequency at which it will perform integrity checks of software, firmware, and information.','SI-7(1).5','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('002710','draft','2013-07-11','DISA FSO','technical','The information system performs an integrity check of organization-defined software at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.','SI-7(1).6','The organization being inspected/assessed configures the information system to perform an integrity check of software defined in SI-7 (1), CCI 2705 at startup, at transitional states  or security-relevant events defined in SI-7 (1), CCI 2708, or annually.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2710.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to perform an integrity check of software defined in SI-7 (1), CCI 2705 at startup, at transitional states  or security-relevant events defined in SI-7 (1), CCI 2708, or annually.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2710.  DoD has defined the frequency as annually.'),\n('002711','draft','2013-07-11','DISA FSO','technical','The information system performs an integrity check of organization-defined firmware at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.','SI-7(1).7','The organization being inspected/assessed configures the information system to perform an integrity check of firmware defined in SI-7 (1), CCI 2706 at startup, at transitional states  or security-relevant events defined in SI-7 (1), CCI 2708, or annually.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2711.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to perform an integrity check of firmware defined in SI-7 (1), CCI 2706 at startup, at transitional states  or security-relevant events defined in SI-7 (1), CCI 2708, or annually.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2711.  DoD has defined the frequency as annually.'),\n('002712','draft','2013-07-11','DISA FSO','technical','The information system performs an integrity check of organization-defined information at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.','SI-7(1).8','The organization being inspected/assessed configures the information system to perform an integrity check of information defined in SI-7 (1), CCI 2707 at startup, at transitional states  or security-relevant events defined in SI-7 (1), CCI 2708, or annually.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2712.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to perform an integrity check of information defined in SI-7 (1), CCI 2707 at startup, at transitional states  or security-relevant events defined in SI-7 (1), CCI 2708, or annually.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2712.  DoD has defined the frequency as annually.'),\n('002713','draft','2013-07-11','DISA FSO','policy','The organization defines the personnel or roles to be notified when discrepancies are discovered during integrity verification.','SI-7(2).2','DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.'),\n('002714','draft','2013-07-11','DISA FSO','policy','The organization defines the security safeguards that are to be employed when integrity violations are discovered.','SI-7(5).1','The organization being inspected/assessed defines and documents the security safeguards that are to be employed when integrity violations are discovered.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines  the security safeguards that are to be employed when integrity violations are discovered.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002715','draft','2013-07-11','DISA FSO','technical','The information system automatically shuts the information system down, restarts the information system, and/or implements organization-defined security safeguards when integrity violations are discovered.','SI-7(5).2','The organization being inspected/assessed configures the information system to automatically shut the information system down, restart the information system, and/or implement security safeguards defined in SI-7 (5), CCI 2714 when integrity violations are discovered.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2715.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically shut the information system down, restart the information system, and/or implement security safeguards defined in SI-7 (5), CCI 2714 when integrity violations are discovered.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2715.'),\n('002716','draft','2013-07-11','DISA FSO','technical','The information system implements cryptographic mechanisms to detect unauthorized changes to software.','SI-7(6).1','The organization being inspected/assessed configures the information system to implement FIPS-approved cryptographic mechanisms to detect unauthorized changes to software.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2716.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement FIPS-approved cryptographic mechanisms to detect unauthorized changes to software.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2716.'),\n('002717','draft','2013-07-11','DISA FSO','technical','The information system implements cryptographic mechanisms to detect unauthorized changes to firmware.','SI-7(6).2','The organization being inspected/assessed configures the information system to implement FIPS-approved cryptographic mechanisms to detect unauthorized changes to firmware.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2717.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement FIPS-approved cryptographic mechanisms to detect unauthorized changes to firmware.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2717.'),\n('002718','draft','2013-07-11','DISA FSO','technical','The information system implements cryptographic mechanisms to detect unauthorized changes to information.','SI-7(6).3','The organization being inspected/assessed configures the information system to implement FIPS-approved cryptographic mechanisms to detect unauthorized changes to information.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2718.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement FIPS-approved cryptographic mechanisms to detect unauthorized changes to information.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2718.'),\n('002719','draft','2013-07-11','DISA FSO','policy','The organization defines the unauthorized security-relevant changes to the information system that are to be incorporated into the organizational incident response capability.','SI-7(7).1','The organization being inspected/assessed defines and documents the unauthorized security-relevant changes to the information system that are to be incorporated into the organizational incident response capability.  DoD has determined the security-relevant changes to the information are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security-relevant changes to the information to ensure the organization being inspected/assessed defines the unauthorized security-relevant changes to the information system that are to be incorporated into the organizational incident response capability.  DoD has determined the security-relevant changes to the information are not appropriate to define at the Enterprise level.'),\n('002720','draft','2013-07-11','DISA FSO','policy','The organization incorporates the detection of unauthorized organization-defined security-relevant changes to the information system into the organizational incident response capability.','SI-7(7).2','The organization being inspected/assessed  incorporates the detection of unauthorized security-relevant changes to the information system defined in SI-7 (7), CCI 2719 into the organizational incident response capability.','The organization conducting the inspection/assessment examines the organizational incident response capability to ensure the organization being inspected/assessed incorporates the detection of unauthorized security-relevant changes to the information system defined in SI-7 (7), CCI 2719.'),\n('002721','draft','2013-07-11','DISA FSO','policy','The organization defines the personnel or roles that are to be alerted by the information system when it detects a potential integrity violation.','SI-7(8).1','DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.'),\n('002722','draft','2013-07-11','DISA FSO','policy','The organization defines other actions that can be taken when the information system detects a potential integrity violation.','SI-7(8).2','The organization being inspected/assessed defines and documents other actions that can be taken when the  information system detects a potential integrity violation.  DoD has determined the other actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented other actions to ensure the organization being inspected/assessed defines other actions that can be taken when the  information system detects a potential integrity violation.  DoD has determined the other actions are not appropriate to define at the Enterprise level.'),\n('002723','draft','2013-07-11','DISA FSO','technical','The information system, upon detection of a potential integrity violation, provides the capability to audit the event.','SI-7(8).3','The organization being inspected/assessed configures the information system to provide the capability to audit the event upon detection of a potential integrity violation.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2723.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  provide the capability to audit the event upon detection of a potential integrity violation.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2723.'),\n('002724','draft','2013-07-11','DISA FSO','technical','The information system, upon detection of a potential integrity violation, initiates one or more of the following actions: generates an audit record; alerts the current user; alerts organization-defined personnel or roles; and/or organization-defined other actions.','SI-7(8).4','The organization being inspected/assessed configures the information system to initiate one or more of following actions: generates an audit record; alerts current user; alerts at a minimum, the ISSO and ISSM; and/or other actions defined in SI-7 (8), CCI  2722 upon detection of a potential integrity violation.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2724.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  initiate one or more of following actions: generates an audit record; alerts current user; alerts at a minimum, the ISSO and ISSM; and/or other actions defined in SI-7 (8), CCI  2722 upon detection of a potential integrity violation.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2724.  DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.'),\n('002725','draft','2013-07-11','DISA FSO','policy','The organization defines the devices which will have the integrity of the boot process verified.','SI-7(9).1','DoD has defined the devices as all devices capable of verification of the boot process.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the devices as all devices capable of verification of the boot process.'),\n('002726','draft','2013-07-11','DISA FSO','technical','The information system verifies the integrity of the boot process of organization-defined devices.','SI-7(9).2','The organization being inspected/assessed configures the information system to verify the integrity of the boot process of all devices capable of verification of the boot process.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2726.   DoD has defined the devices as all devices capable of verification of the boot process.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to verify the integrity of the boot process of all devices capable of verification of the boot process.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2726.  DoD has defined the devices as all devices capable of verification of the boot process.'),\n('002727','draft','2013-07-11','DISA FSO','policy','The organization defines the security safeguards to be implemented to protect the integrity of the boot firmware in organization-defined devices.','SI-7(10).1','The organization being inspected/assessed defines and documents the security safeguards to be implemented to protect the integrity of the boot firmware in organization-defined devices.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed  defines the security safeguards to be implemented to protect the integrity of the boot firmware in organization-defined devices.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002728','draft','2013-07-11','DISA FSO','policy','The organization defines the devices on which organization-defined security safeguards will be implemented to protect the integrity of the boot firmware.','SI-7(10).2','The organization being inspected/assessed defines and documents the devices on which organization-defined security safeguards will be implemented to protect the integrity of the boot firmware.  DoD has determined the devices are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented devices to ensure the organization being inspected/assessed  defines the devices on which organization-defined security safeguards will be implemented to protect the integrity of the boot firmware.  DoD has determined the devices are not appropriate to define at the Enterprise level.'),\n('002729','draft','2013-07-11','DISA FSO','technical','The information system implements organization-defined security safeguards to protect the integrity of boot firmware in organization-defined devices.','SI-7(10).3','The organization being inspected/assessed configures the information system to implement security safeguards defined in SI-7 (10), CCI 2727 to protect the integrity of boot firmware in devices defined in SI-7 (10), CCI 2728.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2729.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  implement security safeguards defined in SI-7 (10), CCI 2727 to protect the integrity of boot firmware in devices defined in SI-7 (10), CCI 2728.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2729.'),\n('002730','draft','2013-07-11','DISA FSO','policy','The organization defines the user-installed software that is to be executed in a confined physical or virtual machine environment with limited privileges.','SI-7(11).1','The organization being inspected/assessed defines and documents the user-installed software that is to be executed in a confined physical or virtual machine environment with limited privileges.  DoD has determined the user-installed software is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented user-installed software to ensure the organization being inspected/assessed defines the user-installed software that is to be executed in a confined physical or virtual machine environment with limited privileges.  DoD has determined the user-installed software is not appropriate to define at the Enterprise level.'),\n('002731','draft','2013-07-11','DISA FSO','policy','The organization requires that organization-defined user-installed software execute in a confined physical or virtual machine environment with limited privileges.','SI-7(11).2','The organization being inspected/assessed requires that user-installed software defined in SI-7 (11), CCI 2730 execute in a confined physical or virtual machine environment with limited privileges.','The organization conducting the inspection/assessment examines the information system to ensure that software defined in SI-7 (11), CCI 2730 executes in a confined physical or virtual machine environment with limited privileges.'),\n('002732','draft','2013-07-11','DISA FSO','policy','The organization defines the user-installed software that is to have its integrity verified prior to execution.','SI-7(12).1','DoD has defined the user-installed software as all user installed software (NOTE: the key is the term \\\"user installed.\\\").','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the user-installed software as all user installed software (NOTE: the key is the term \\\"user installed.\\\").'),\n('002733','draft','2013-07-11','DISA FSO','policy','The organization requires that the integrity of organization-defined user-installed software be verified prior to execution.','SI-7(12).2','The organization being inspected/assessed requires that the integrity of all user installed software (NOTE: the key is the term \\\"user installed.\\\") be verified prior to execution.  DoD has defined the user-installed software as all user installed software (NOTE: the key is the term \\\"user installed.\\\").','The organization conducting the inspection/assessment examines the information system to ensure that all user installed software (NOTE: the key is the term \\\"user installed.\\\") is verified prior to execution.  DoD has defined the user-installed software as all user installed software (NOTE: the key is the term \\\"user installed.\\\").'),\n('002734','draft','2013-07-11','DISA FSO','policy','The organization defines the personnel or roles which have the authority to explicitly approve binary or machine-executable code.','SI-7(13).1','DoD has defined has personnel or roles as the ISSO or ISSM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined has personnel or roles as the ISSO or ISSM.'),\n('002735','draft','2013-07-11','DISA FSO','policy','The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only in confined physical or virtual machine environments.','SI-7(13).2','The organization being inspected/assessed allows execution of binary or machine-executable code obtained from sources without vendor support or with no warranty and without the provision of source code only in confined physical or virtual machine environments.','The organization conducting the inspection/assessment obtains and examines the software list and examines the information system to ensure the organization being inspected/assessed allows execution of binary or machine-executable code obtained from sources without vendor support or with no warranty and without the provision of source code only in confined physical or virtual machine environments.'),\n('002736','draft','2013-07-11','DISA FSO','policy','The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only with the explicit approval of organization-defined personnel or roles.','SI-7(13).3','The organization being inspected/assessed allows execution of binary or machine-executable code obtained from sources without vendor support or with no warranty and without the provision of source code only with the explicit approval of the ISSO or ISSM.  DoD has defined has personnel or roles as the ISSO or ISSM.','The organization conducting the inspection/assessment obtains and examines the software list and examines the information system to ensure the organization being inspected/assessed allows execution of binary or machine-executable code obtained from sources without vendor support or with no warranty and without the provision of source code only with the explicit approval of the ISSO or ISSM.   DoD has defined has personnel or roles as the ISSO or ISSM.'),\n('002737','draft','2013-07-11','DISA FSO','policy','The organization prohibits the use of binary or machine-executable code from sources with limited or no warranty and without the provision of source code.','SI-7(14).1','The organization being inspected/assessed prohibits the use of binary or machine-executable code obtained from sources without vendor support or with no warranty and without the provision of source code.','The organization conducting the inspection/assessment obtains and examines the software list and examines the information system to ensure the organization being inspected/assessed prohibits the use of binary or machine-executable code obtained from sources without vendor support or with no warranty and without the provision of source code.'),\n('002738','draft','2013-07-11','DISA FSO','policy','The organization provides exceptions to the source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official.','SI-7(14).2','The organization being inspected/assessed documents and provides exceptions to the  source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official.','The organization conducting the inspection/assessment obtains and examines the documented exceptions to the source code requirement to ensure the organization being inspected/assessed provides justification and approval of the authorizing official for all exceptions to the source code requirement.'),\n('002739','draft','2013-07-11','DISA FSO','policy','The organization defines the software or firmware components on which cryptographic mechanisms are to be implemented to support authentication prior to installation.','SI-7(15).1','DoD has defined the software or firmware components as all software and firmware from vendors/sources that provide cryptographic mechanisms to enable the validation of code authenticity and integrity.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the software or firmware components as all software and firmware from vendors/sources that provide cryptographic mechanisms to enable the validation of code authenticity and integrity.'),\n('002740','draft','2013-07-11','DISA FSO','technical','The information system implements cryptographic mechanisms to authenticate organization-defined software or firmware components prior to installation.','SI-7(15).2','The organization being inspected/assessed configures the information system to implement cryptographic mechanisms to authenticate   all software and firmware from vendors/sources that provide cryptographic mechanisms to enable the validation of code authenticity and integrity prior to installation.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2740.  DoD has defined the software or firmware components as all software and firmware from vendors/sources that provide cryptographic mechanisms to enable the validation of code authenticity and integrity.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  implement cryptographic mechanisms to authenticate all software and firmware from vendors/sources that provide cryptographic mechanisms to enable the validation of code authenticity and integrity prior to installation.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2740.  DoD has defined the software or firmware components as all software and firmware from vendors/sources that provide cryptographic mechanisms to enable the validation of code authenticity and integrity.'),\n('002741','draft','2013-07-11','DISA FSO','policy','The organization employs spam protection mechanisms at information system entry points to detect and take action on unsolicited messages.','SI-8.1','The organization being inspected/assessed implements spam protection mechanisms at information system entry points to detect and take action on unsolicited messages.','The organization conducting the inspection/assessment obtains and examines the hardware/software list to ensure the organization being inspected/assessed  implements spam protection mechanisms at information system entry points to detect and take action on unsolicited messages.  The organization may be required to demonstrate the use of the identified spam protection mechanisms.'),\n('002742','draft','2013-07-11','DISA FSO','policy','The organization employs spam protection mechanisms at information system exit points to detect and take action on unsolicited messages.','SI-8.2','The organization being inspected/assessed implements spam protection mechanisms at information system exit points to detect and take action on unsolicited messages.','The organization conducting the inspection/assessment obtains and examines the hardware/software list to ensure the organization being inspected/assessed  implements spam protection mechanisms at information system exit points to detect and take action on unsolicited messages.  The organization may be required to demonstrate the use of the identified spam protection mechanisms.'),\n('002743','draft','2013-07-11','DISA FSO','technical','The information system implements spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.','SI-8(3).1','The organization being inspected/assessed configures the information system to implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2743.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2743.'),\n('002744','draft','2013-07-11','DISA FSO','policy','The organization defines the inputs on which the information system is to conduct validity checks.','SI-10.2','The organization being inspected/assessed defines and documents specific inputs which do not require validity checks.  DoD has defined the information inputs as all inputs except those identified specifically by the organization.','The organization conducting the DoD has defined the information inputs as all inputs except those identified specifically by the organization.'),\n('002745','draft','2013-07-11','DISA FSO','policy','The organization defines the inputs for which the information system provides a manual override capability for input validation.','SI-10(1).1','The organization being inspected/assessed defines and documents the inputs for which the information system provides a manual override capability for input validation.  DoD has determined the inputs are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented inputs to ensure the organization being inspected/assessed defines the inputs for which the information system provides a manual override capability for input validation.  DoD has determined the inputs are not appropriate to define at the Enterprise level.'),\n('002746','draft','2013-07-11','DISA FSO','technical','The information system provides a manual override capability for input validation of organization-defined inputs.','SI-10(1).2','The organization being inspected/assessed configures the information system to provide a manual override capability for input validation of inputs defined in SI-10 (1), CCI 2745.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2746.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide a manual override capability for input validation of inputs defined in SI-10 (1), CCI 2745.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2746.'),\n('002747','draft','2013-07-11','DISA FSO','policy','The organization defines the individuals who have the authorization to use the manual override capability for input validation.','SI-10(1).3','The organization being inspected/assessed defines and documents the authorized individuals who have the capability to use the manual override capability for input validation.  DoD has determined the authorized individuals are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented authorized individuals to ensure the organization being inspected/assessed defines the authorized individuals who have the capability to use the manual override capability for input validation.  DoD has determined the authorized individuals are not appropriate to define at the Enterprise level.'),\n('002748','draft','2013-07-11','DISA FSO','technical','The information system restricts the use of the manual override capability to only organization-defined authorized individuals.','SI-10(1).4','The organization being inspected/assessed configures the information system to restrict the use of the manual override capability to only the authorized individuals defined in SI-10 (1), CCI 2747.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2748.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to restrict the use of the manual override capability to only the authorized individuals defined in SI-10 (1), CCI 2747.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2748.'),\n('002749','draft','2013-07-11','DISA FSO','technical','The information system audits the use of the manual override capability.','SI-10(1).5','The organization being inspected/assessed configures the information system to audit the use of the manual override capability.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2749.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to audit the use of the manual override capability.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2749.'),\n('002750','draft','2013-07-11','DISA FSO','policy','The organization defines the time period within which input validation errors are to be reviewed.','SI-10(2).1','The organization being inspected/assessed defines and documents the time period within which input validation errors are reviewed.  DoD has determined the time period is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented time period to ensure the organization being inspected/assessed  defines the time period within which input validation errors are reviewed.  DoD has determined the time period is not appropriate to define at the Enterprise level.'),\n('002751','draft','2013-07-11','DISA FSO','policy','The organization defines the time period within which input validation errors are to be resolved.','SI-10(2).2','The organization being inspected/assessed defines and documents the time period within which input validation errors are resolved.  DoD has determined the time period is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented time period to ensure the organization being inspected/assessed  defines the time period within which input validation errors are resolved.  DoD has determined the time period is not appropriate to define at the Enterprise level.'),\n('002752','draft','2013-07-11','DISA FSO','policy','The organization ensures that input validation errors are reviewed within an organization-defined time period.','SI-10(2).3','The organization being inspected/assessed documents and implements a process to review input validation errors within the time period defined in SI-10 (2), CCI 2750.  The organization must maintain records of review.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the records of review to ensure the organization being inspected/assessed reviews input validation errors within the time period defined in SI-10 (2), CCI 2750.'),\n('002753','draft','2013-07-11','DISA FSO','policy','The organization ensures that input validation errors are resolved within an organization-defined time period.','SI-10(2).4','The organization being inspected/assessed documents and implements a process to resolve input validation errors within the time period defined in SI-10 (2), CCI 2751.  The organization must maintain records of resolution.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the records of resolution to ensure the organization being inspected/assessed resolves input validation errors within the time period defined in SI-10 (2), CCI 2751.'),\n('002754','draft','2013-07-11','DISA FSO','policy','The information system behaves in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.','SI-10(3).1','The organization being inspected/assessed documents proper behavior that reflects organizational and system objectives for when invalid inputs are received.  The organization being inspected/assessed configures the information system to behave in the documented manner when invalid inputs are received.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2754.','The organization conducting the inspection/assessment obtains and examines the documented behavior to ensure the organization being inspected/assessed documents proper behavior that reflects organizational and system objectives for when invalid inputs are received.  The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to behave in the documented manner when invalid inputs are received.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2754.'),\n('002755','draft','2013-07-11','DISA FSO','policy','The organization accounts for timing interactions among information system components in determining appropriate responses for invalid inputs.','SI-10(4).1','The organization being inspected/assessed designs the information system to account for timing interactions among information system components in determining appropriate responses for invalid inputs.','The organization conducting the inspection/assessment obtains and examines system design artifacts to ensure the organization being inspected/assessed  accounts for timing interactions among information system components in determining appropriate responses for invalid inputs.'),\n('002756','draft','2013-07-11','DISA FSO','policy','The organization defines the trusted sources to which the usage of information inputs will be restricted (e.g., whitelisting).','SI-10(5).1','The organization being inspected/assessed defines and documents the trusted sources to which the usage of information inputs will be restricted (e.g., whitelisting).  DoD has determined the trusted sources are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented trusted sources to ensure the organization being inspected/assessed defines the trusted sources to which the usage of information inputs will be restricted (e.g., whitelisting).  DoD has determined the trusted sources are not appropriate to define at the Enterprise level.'),\n('002757','draft','2013-07-11','DISA FSO','policy','The organization defines the acceptable formats to which information inputs are restricted.','SI-10(5).2','The organization being inspected/assessed defines and documents the acceptable formats to which information inputs are restricted.  DoD has determined the acceptable formats are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented acceptable formats to ensure the organization being inspected/assessed defines the acceptable formats to which information inputs are restricted.  DoD has determined the acceptable formats are not appropriate to define at the Enterprise level.'),\n('002758','draft','2013-07-11','DISA FSO','policy','The organization restricts the use of information inputs to organization-defined trusted sources and/or organization-defined formats.','SI-10(5).3','The organization being inspected/assessed designs the information system to restrict the use of information inputs to trusted sources defined in SI-10 (5), CCI 2756 and/or formats defined in SI-10 (5), CCI 2757.','The organization conducting the inspection/assessment obtains and examines system design artifacts to ensure the organization being inspected/assessed restricts the use of information inputs to trusted sources defined in SI-10 (5), CCI 2756 and/or formats defined in SI-10 (5), CCI 2757.'),\n('002759','draft','2013-07-11','DISA FSO','policy','The organization defines the personnel or roles to whom error messages are to be revealed.','SI-11.3','DoD has defined the personnel or roles as the ISSO, ISSM, and SCA.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as the ISSO, ISSM, and SCA.'),\n('002760','draft','2013-07-11','DISA FSO','policy','The organization determines mean time to failure (MTTF) for organization-defined information system components in specific environments of operation.','SI-13.1','The organization being inspected/assessed determines through testing or research and documents the mean time to failure (MTTF) for any component within a system requiring high availability in specific environments of operation.  DoD has defined the system components as any component within a system requiring high availability.','The organization conducting the inspection/assessment obtains and examines documented mean time to failure (MTTF) to ensure the organization being inspected/assessed has determined the mean time to failure (MTTF) for any component within a system requiring high availability in specific environments of operation.  DoD has defined the system components as any component within a system requiring high availability.'),\n('002761','draft','2013-07-11','DISA FSO','policy','The organization defines the system components in specific environments of operation for which the mean time to failure (MTTF) is to be determined.','SI-13.2','DoD has defined the system components as any component within a system requiring high availability.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the system components as any component within a system requiring high availability.'),\n('002762','draft','2013-07-11','DISA FSO','policy','The organization defines the mean time to failure (MTTF) substitution criteria to be employed as a means to determine the need to exchange active and standby components.','SI-13.4','The organization being inspected/assessed defines and documents the  mean time to failure substitution criteria to be employed as a means to determine the need to exchange active and standby components.  DoD has determined the mean time to failure is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented mean time to failure to ensure the organization being inspected/assessed defines the mean time to failure substitution criteria to be employed as a means to determine the need to exchange active and standby components.  DoD has determined the mean time to failure is not appropriate to define at the Enterprise level.'),\n('002763','draft','2013-07-11','DISA FSO','policy','The organization provides a means to exchange active and standby components in accordance with the organization-defined mean time to failure (MTTF) substitution criteria.','SI-13.5','The organization being inspected/assessed documents and implements a process to exchange active and standby components in accordance with the mean time to failure substitution criteria defined in SI-13, CCI 2762.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  provides a means to exchange active and standby components in accordance with the mean time to failure substitution criteria defined in SI-13, CCI 2762.'),\n('002764','draft','2013-07-11','DISA FSO','policy','The organization defines non-persistent information system components and services to be implemented.','SI-14.1','The organization being inspected/assessed defines and documents non-persistent information system components and services to be implemented.  DoD has determined the information system components and services are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components and services to ensure the organization being inspected/assessed defines  non-persistent information system components and services to be implemented.   DoD has determined the information system components and services are not appropriate to define at the Enterprise level.'),\n('002765','draft','2013-07-11','DISA FSO','policy','The organization defines the frequency at which it will terminate organization-defined non-persistent information system components and services.','SI-14.2','The organization being inspected/assessed defines and documents the frequency at which it will terminate organization-defined non-persistent information system components and services.  DoD has determined the frequency is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed defines the frequency at which it will terminate organization-defined non-persistent information system components and services.  DoD has determined the frequency is not appropriate to define at the Enterprise level.'),\n('002766','draft','2013-07-11','DISA FSO','policy','The organization implements organization-defined non-persistence information system components and services that are initiated in a known state.','SI-14.3','The organization being inspected/assessed designs the information system to implement  non-persistence information system components and services defined in SI-14, CCI 2764 that are initiated in a known state.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed  implements non-persistence information system components and services defined in SI-14, CCI 2764 that are initiated in a known state.'),\n('002767','draft','2013-07-11','DISA FSO','policy','The organization implements organization-defined non-persistence information system components and services that are terminated upon end of session of use and/or periodically at an organization-defined frequency.','SI-14.4','The organization being inspected/assessed designs the information system to implement  non-persistence information system components and services defined in SI-14, CCI 2764 that are terminated upon end of session of use and/or periodically at the frequency defined in SI-14, CCI 2765.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed  implements non-persistence information system components and services defined in SI-14, CCI 2764 that are terminated upon end of session of use and/or periodically at the frequency defined in SI-14, CCI 2765.'),\n('002768','draft','2013-07-11','DISA FSO','policy','The organization defines the trusted sources from which it obtains software and data employed during the refreshing of non-persistent information system components and services.','SI-14(1).1','The organization being inspected/assessed defines and documents the trusted sources from which it obtains software and data employed during the refreshing of non-persistent information system component and service.  DoD has determined the trusted sources are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented trusted sources to ensure the organization being inspected/assessed defines the trusted sources from which it obtains software and data employed during the refreshing of non-persistent information system component and service.  DoD has determined the trusted sources are not appropriate to define at the Enterprise level.'),\n('002769','draft','2013-07-11','DISA FSO','policy','The organization ensures that software and data employed during non-persistent information system component and service refreshes are obtained from organization-defined trusted sources.','SI-14(1).2','The organization being inspected/assessed documents and implements a process to obtain software and data used during non-persistent information system component and service refreshes from trusted sources defined in SI-14 (1), CCI 2768.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures that software and data used during non-persistent information system component and service refreshes from trusted sources defined in SI-14 (1), CCI 2768.'),\n('002770','draft','2013-07-11','DISA FSO','policy','The organization defines the software programs and/or applications from which the information system is to validate the information output to ensure the information is consistent with expected content.','SI-15.1','The organization being inspected/assessed defines and documents the software programs and/or applications from which the information system is to validate the information output to ensure the information is consistent with expected content.  DoD has determined the software programs  and/or applications are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented software programs and/or applications to ensure the organization being inspected/assessed defines the software programs and/or applications from which the information system is to validate the information output to ensure the information is consistent with expected content.  DoD has determined the software programs  and/or applications are not appropriate to define at the Enterprise level.'),\n('002771','draft','2013-07-11','DISA FSO','technical','The information system validates information output from organization-defined software programs and/or applications to ensure that the information is consistent with the expected content.','SI-15.2','The organization being inspected/assessed configures the information system to validate information output from software programs and/or applications defined in SI-15, CCI 2770 to ensure that the information is consistent with the expected content.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2771.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to validate information output from software programs and/or applications defined in SI-15, CCI 2770 to ensure that the information is consistent with the expected content.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2771.'),\n('002772','deprecated','2013-07-11','DISA FSO','policy','The organization defines the security safeguards to be implemented to protect the information system^s memory from unauthorized code execution.',NULL,NULL,NULL),\n('002773','draft','2013-07-11','DISA FSO','policy','The organization defines the fail-safe procedures to be implemented by the information system when organization-defined failure conditions occur.','SI-17.1','The organization being inspected/assessed defines and documents the fail-safe procedures to be implemented by the information system when organization-defined failure conditions occur.  DoD has determined the fail-safe procedures are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented fail-safe procedures to ensure the organization being inspected/assessed defines the fail-safe procedures to be implemented by the information system when organization-defined failure conditions occur.  DoD has determined the fail-safe procedures are not appropriate to define at the Enterprise level.'),\n('002774','draft','2013-07-11','DISA FSO','policy','The organization defines the failure conditions which, when they occur, will result in the information system implementing organization-defined fail-safe procedures.','SI-17.2','The organization being inspected/assessed defines and documents the failure conditions which, when they occur, will result in the information system implementing organization-defined fail-safe procedures.  DoD has determined the failure conditions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented failure conditions to ensure the organization being inspected/assessed defines the failure conditions which, when they occur, will result in the information system implementing organization-defined fail-safe procedures.  DoD has determined the failure conditions are not appropriate to define at the Enterprise level.'),\n('002775','draft','2013-07-11','DISA FSO','technical','The information system implements organization-defined fail-safe procedures when organization-defined failure conditions occur.','SI-17.3','The organization being inspected/assessed configures the information system to implement  fail-safe procedures defined in SI-17, CCI 2773 when failure conditions defined in SI-17, CCI  2774 occur.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2775.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement  fail-safe procedures defined in SI-17, CCI 2773 when failure conditions defined in SI-17, CCI  2774 occur.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2775.'),\n('002776','draft','2013-07-12','DISA FSO','policy','The organization defines the personnel or roles to whom the incident response policy is disseminated.','IR-1.1','DoD has defined the roles as all personnel identified as stakeholders in the incident response process, as well as the ISSM and ISSO.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the roles as all personnel identified as stakeholders in the incident response process, as well as the ISSM and ISSO.'),\n('002777','draft','2013-07-12','DISA FSO','policy','The organization defines the personnel or roles to whom the incident response procedures are disseminated.','IR-1.2','DoD has defined the roles as all personnel identified as stakeholders in the incident response process, as well as the ISSM and ISSO.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the roles as all personnel identified as stakeholders in the incident response process, as well as the ISSM and ISSO.'),\n('002778','draft','2013-07-12','DISA FSO','policy','The organization defines the time period in which information system users who assume an incident response role or responsibility receive incident response training.','IR-2.2','DoD has defined the time period as 30 working days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 30 working days.'),\n('002779','draft','2013-07-12','DISA FSO','policy','The organization provides incident response training to information system users consistent with assigned roles and responsibilities when required by information system changes.','IR-2.5','The organization being inspected/assessed documents and implements a process to provide incident response training to information system users, other than general users, consistent with assigned roles and responsibilities when required by information system changes.  For general users, DoD components are automatically compliant with the requirement based on DoDD 8570.01 requirements for IA awareness training.  The organization must maintain a record of training.','The organization conducting the inspection/assessment obtains and examines the documented process as well as training records for a sampling of information system users to ensure the organization being inspected/assessed provides incident response training to information system users, other than general users, consistent with assigned roles and responsibilities when required by information system changes.  For general users, DoD components are automatically compliant with the requirement based on DoDD 8570.01 requirements for IA awareness training. '),\n('002780','draft','2013-07-12','DISA FSO','policy','The organization coordinates incident response testing with organizational elements responsible for related plans.','IR-3(2).1','The organization being inspected/assessed documents within their incident response testing plan, the necessary support from all responsible organizational elements for incident response testing.','The organization conducting the inspection/assessment obtains and examines the incident response testing plan to ensure the organization being inspected/assessed coordinates incident response testing with organizational elements responsible for related plans.'),\n('002781','draft','2013-07-12','DISA FSO','policy','The organization defines the information system components for dynamic reconfiguration as part of the incident response capability.','IR-4(2).2','The organization being inspected/assessed defines and documents the information system components for dynamic reconfiguration as part of the incident response capability.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components for dynamic reconfiguration as part of the incident response capability.'),\n('002782','draft','2013-07-12','DISA FSO','policy','The organization implements an incident handling capability for insider threats.','IR-4(6).1','The organization being inspected/assessed documents within their incident response plan and implements plans to respond to incidents related to insider threats.','The organization conducting the inspection/assessment obtains and examines the incident response plan as well as a sampling of incident after action reports to ensure the organization being inspected/assessed  implements incident handling capability for insider threats.'),\n('002783','draft','2013-07-12','DISA FSO','policy','The organization coordinates an incident handling capability for insider threats across organization-defined components or elements of the organization.','IR-4(7).1','The organization being inspected/assessed documents within their incident response plan, the responsibilities of each element of the organization defined in IR-4 (7), CCI 2784.','The organization conducting the inspection/assessment obtains and examines the incident response plan to ensure the organization being inspected/assessed coordinates incident handling capability for insider threats across components or elements of the organization defined in IR-4 (7), CCI 2784.'),\n('002784','draft','2013-07-12','DISA FSO','policy','The organization defines components or elements of the organization across which an incident handling capability for insider threats will be coordinated.','IR-4(7).2','The organization being inspected/assessed defines and documents components or elements of the organization in which incident handling capability for insider threats will be coordinated.  DoD has determined the components or elements are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented components or elements to ensure the organization being inspected/assessed defines components or elements of the organization in which incident handling capability for insider threats will be coordinated.  DoD has determined the components or elements are not appropriate to define at the Enterprise level.'),\n('002785','draft','2013-07-12','DISA FSO','policy','The organization coordinates with organization-defined external organizations to correlate and share organization-defined incident information to achieve a cross-organization perspective on incident awareness and more effective incident responses.','IR-4(8).1','The organization being inspected/assessed coordinates with external organizations defined in IR-4 (8), CCI 2786 to correlate and share incident information defined in IR-4 (8), CCI 2787 to achieve a cross-organization perspective on incident awareness and more effective incident responses.','The organization conducting the inspection/assessment obtains and examines reports, meeting minutes, or other evidence that the organization being inspected/assessed is coordinating with external organizations defined in IR-4 (8), CCI 2786 to correlate and share incident information defined in IR-4 (8), CCI 2787 to achieve a cross-organization perspective on incident awareness and more effective incident responses.'),\n('002786','draft','2013-07-12','DISA FSO','policy','The organization defines external organizations with which to correlate and share organization-defined incident information.','IR-4(8).2','The organization being inspected/assessed defines and documents  external organizations with whom they will correlate and share organization-defined incident information.\\n\\nDoD has determined the external organizations are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented external organizations to ensure the organization being inspected/assessed defines external organizations to correlate and share organization-defined incident information.\\n\\nDoD has determined the external organizations are not appropriate to define at the Enterprise level.'),\n('002787','draft','2013-07-12','DISA FSO','policy','The organization defines incident information to correlate and share with organization-defined external organizations.','IR-4(8).3','The organization being inspected/assessed defines and documents what incident information will be correlated and shared with each  external organization defined in IR-4 (8), CCI 2786.\\n\\nDoD has determined the incident information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented incident information to ensure the organization being inspected/assessed defines what incident information will be correlated and shared with each external organization defined in IR-4 (8), CCI 2786.\\n\\nDoD has determined the incident information is not appropriate to define at the Enterprise level.'),\n('002788','draft','2013-07-12','DISA FSO','policy','The organization employs organization-defined dynamic response capabilities to effectively respond to security incidents.','IR-4(9).1','The organization being inspected/assessed implements at a minimum, the appropriate CIRT/CERT (such as US-CERT, DoD CERT, IC CERT) to effectively respond to security incidents.  DoD has defined the dynamic response capabilities as at a minimum, the appropriate CIRT/CERT (such as US-CERT, DoD CERT, IC CERT). ','The organization conducting the inspection/assessment obtains and examines incident response logs to ensure that they reflect the use of at a minimum, the appropriate CIRT/CERT (such as US-CERT, DoD CERT, IC CERT).  DoD has defined the dynamic response capabilities as at a minimum, the appropriate CIRT/CERT (such as US-CERT, DoD CERT, IC CERT).  '),\n('002789','draft','2013-07-12','DISA FSO','policy','The organization defines dynamic response capabilities to effectively respond to security incidents.','IR-4(9).2','DoD has defined the dynamic response capabilities as at a minimum, the appropriate CIRT/CERT (such as US-CERT, DoD CERT, IC CERT).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the dynamic response capabilities as at a minimum, the appropriate CIRT/CERT (such as US-CERT, DoD CERT, IC CERT).'),\n('002790','draft','2013-07-12','DISA FSO','policy','The organization coordinates incident handling activities involving supply chain events with other organizations involved in the supply chain.','IR-4(10).1','The organization being inspected/assessed  documents and implements a process to coordinate incident handling activities involving supply chain events with other organizations involved in the supply chain.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed coordinates incident handling activities involving supply chain events with other organizations involved in the supply chain.'),\n('002791','draft','2013-07-12','DISA FSO','policy','The organization defines authorities to whom security incident information is reported.','IR-6.4','DoD has defined the authorities as the appropriate CIRT/CERT (such as US-CERT, DoD CERT, IC CERT).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the authorities as the appropriate CIRT/CERT (such as US-CERT, DoD CERT, IC CERT).'),\n('002792','draft','2013-07-12','DISA FSO','policy','The organization defines personnel or roles to whom information system vulnerabilities associated with reported security incident information are reported.','IR-6(2).2','The organization being inspected/assessed defines and documents personnel or roles to whom information system vulnerabilities associated with reported security incident information are reported.  The personnel shall be identified IAW CJCSM 6510.01B.  DoD has determined the personnel are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented personnel to ensure the organization being inspected/assessed defines  personnel or roles to whom information system vulnerabilities associated with reported security incident information are reported  IAW CJCSM 6510.01B.'),\n('002793','draft','2013-07-12','DISA FSO','policy','The organization provides security incident information to other organizations involved in the supply chain for information systems or information system components related to the incident.','IR-6(3).1','The organization being inspected/assessed documents and implement a process to provide security incident information to other organizations involved in the supply chain for information systems or information system components related to the incident.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides security incident information to other organizations involved in the supply chain for information systems or information system components related to the incident.'),\n('002794','draft','2013-07-12','DISA FSO','policy','The organization develops an incident response plan.','IR-8.1','The organization being inspected/assessed develops and documents an incident response plan.','The organization conducting the inspection/assessment obtains and examines the documented incident response plan to ensure the organization being inspected/assessed develops an incident response plan.'),\n('002795','draft','2013-07-12','DISA FSO','policy','The organization^s incident response plan provides the organization with a roadmap for implementing its incident response capability.','IR-8.2','The organization being inspected/assessed defines and documents within their incident response plan, a roadmap for implementing its incident response capability.','The organization conducting the inspection/assessment obtains and examines the incident response plan to ensure the organization being inspected/assessed provides within their plan, a roadmap for implementing its incident response capability.'),\n('002796','draft','2013-07-12','DISA FSO','policy','The organization^s incident response plan describes the structure and organization of the incident response capability.','IR-8.3','The organization being inspected/assessed defines and documents within their incident response plan, the structure and organization of the incident response capability.','The organization conducting the inspection/assessment obtains and examines the incident response plan to ensure the organization being inspected/assessed describes within their plan, the structure and organization of the incident response capability.'),\n('002797','draft','2013-07-12','DISA FSO','policy','The organization^s incident response plan provides a high-level approach for how the incident response capability fits into the overall organization.','IR-8.4','The organization being inspected/assessed defines and documents within their incident response plan, a high-level approach for how the incident response capability fits into the overall organization.','The organization conducting the inspection/assessment obtains and examines the incident response plan to ensure the organization being inspected/assessed provides within their plan, a high-level approach for how the incident response capability fits into the overall organization.'),\n('002798','draft','2013-07-12','DISA FSO','policy','The organization^s incident response plan meets the unique requirements of the organization, which relate to mission, size, structure, and functions.','IR-8.5','The organization being inspected/assessed will ensure their incident response plan meets the unique requirements of the organization, which relate to mission, size, structure, and functions.','The organization conducting the inspection/assessment obtains and examines the incident response plan to ensure it meets the unique requirements of the organization being inspected/assessed, which relate to mission, size, structure, and functions.'),\n('002799','draft','2013-07-12','DISA FSO','policy','The organization^s incident response plan defines reportable incidents.','IR-8.6','The organization being inspected/assessed defines and document within their incident response plan, reportable incidents IAW CJCSM 6510.01B Table B-A-2. ','The organization conducting the inspection/assessment obtains and examines the incident response plan to ensure the organization being inspected/assessed defines   reportable incidents IAW CJCSM 6510.01B Table B-A-2. '),\n('002800','draft','2013-07-12','DISA FSO','policy','The organization^s incident response plan provides metrics for measuring the incident response capability within the organization.','IR-8.7','The organization being inspected/assessed defines and documents within their incident response plan, metrics for measuring the incident response capability within the organization IAW CJCSM 6510.01B, Enclosure A.','The organization conducting the inspection/assessment obtains and examines the incident response plan to ensure the organization being inspected/assessed defines metrics for measuring the incident response capability within the organization IAW CJCSM 6510.01B, Enclosure A.'),\n('002801','draft','2013-07-12','DISA FSO','policy','The organization^s incident response plan defines the resources and management support needed to effectively maintain and mature an incident response capability.','IR-8.8','The organization being inspected/assessed defines and documents within their  incident response plan, the resources and management support needed to effectively maintain and mature an incident response capability.','The organization conducting the inspection/assessment obtains and examines the incident response plan to ensure the organization being inspected/assessed defines within their plan, the resources and management support needed to effectively maintain and mature an incident response capability.'),\n('002802','draft','2013-07-12','DISA FSO','policy','The organization defines personnel or roles to review and approve the incident response plan.','IR-8.9','DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.'),\n('002803','draft','2013-07-12','DISA FSO','policy','The organization defines incident response personnel (identified by name and/or by role) and organizational elements to whom incident response plan changes will be communicated.','IR-8.17','DoD has defined the incident response personnel as all stakeholders identified in the incident response plan, not later than 30 days after the change is made.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the incident response personnel as all stakeholders identified in the incident response plan, not later than 30 days after the change is made.'),\n('002804','draft','2013-07-12','DISA FSO','policy','The organization protects the incident response plan from unauthorized disclosure and modification.','IR-8.18','The organization being inspected/assessed protects the incident response plan from unauthorized disclosure and modification.','The organization conducting the inspection/assessment obtains and examines artifacts which identify how the incident response plan is protected to ensure the organization being inspected/assessed protects the incident response plan from unauthorized disclosure and modification.'),\n('002805','draft','2013-07-12','DISA FSO','policy','The organization responds to information spills by identifying the specific information involved in the information system contamination.','IR-9.1','The organization being inspected/assessed documents within their incident response plan, a process to identify the specific information involved in the information system contamination.   ','The organization conducting the inspection/assessment obtains and examines the incident response plan as well as after action reports of incidents to ensure that specific information involved in the  information system contamination is identified.'),\n('002806','draft','2013-07-12','DISA FSO','policy','The organization responds to information spills by alerting organization-defined personnel or roles of the information spill using a method of communication not associated with the spill.','IR-9.2','The organization being inspected/assessed documents within their incident response plan, a process to alert at a minimum, the Originating Classification Authority (OCA), the information owner/originator, the ISSM, the activity security manager, and the responsible computer incident response center of the information spill using a method of communication not associated with the spill.\\n\\nDoD has defined the personnel or roles as at a minimum, the OCA, the information owner/originator, the ISSM, the activity security manager, and the responsible computer incident response center.','The organization conducting the inspection/assessment obtains and examines the incident response plan as well as after action reports of incidents to ensure that at a minimum, the OCA, the information owner/originator, the ISSM, the activity security manager, and the responsible computer incident response center were alerted of the information spill using a method of communication not associated with the spill.\\n\\nDoD has defined the personnel or roles as at a minimum, the OCA, the information owner/originator, the ISSM, the activity security\\nmanager, and the responsible computer incident response center.'),\n('002807','draft','2013-07-12','DISA FSO','policy','The organization defines personnel or roles to be alerted of information spills using a method of communication not associated with the spill.','IR-9.3','DoD has defined the personnel or roles as at a minimum, the OCA, the information owner/originator, the ISSM, the activity security manager, and the responsible computer incident response center.  ','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the OCA, the information owner/originator, the ISSM, the activity security manager, and the responsible computer incident response center.  '),\n('002808','draft','2013-07-12','DISA FSO','policy','The organization responds to information spills by isolating the contaminated information system or system component.','IR-9.4','The organization being inspected/assessed documents within their incident response plan, a process to  isolate the contaminated information system or system component.   ','The organization conducting the inspection/assessment obtains and examines the incident response plan as well as after action reports of incidents to ensure that the organization being inspected/assessed isolates contaminated information system or system component.'),\n('002809','draft','2013-07-12','DISA FSO','policy','The organization responds to information spills by eradicating the information from the contaminated information system or component.','IR-9.5','The organization being inspected/assessed documents within their incident response plan, a process to eradicate the information from the contaminated information system or component.   ','The organization conducting the inspection/assessment obtains and examines the incident response plan as well as after action reports of incidents to ensure that the organization being inspected/assessed  eradicates the information from the contaminated information system or component.'),\n('002810','draft','2013-07-12','DISA FSO','policy','The organization responds to information spills by identifying other information systems or system components that may have been subsequently contaminated.','IR-9.6','The organization being inspected/assessed documents within their incident response plan, a process to identify other information systems or system components that may have been subsequently contaminated.   ','The organization conducting the inspection/assessment obtains and examines the incident response plan as well as after action reports of incidents to ensure that the organization being inspected/assessed  identifies other information systems or system components that may have been subsequently contaminated.'),\n('002811','draft','2013-07-12','DISA FSO','policy','The organization responds to information spills by performing other organization-defined actions.','IR-9.7','The organization being inspected/assessed documents within their incident response plan, processes to perform actions defined in IR-9, CCI 2812.  ','The organization conducting the inspection/assessment obtains and examines the incident response plan as well as after action reports of incidents to ensure that the organization being inspected/assessed   performs actions defined in IR-9, CCI 2812.'),\n('002812','draft','2013-07-12','DISA FSO','policy','The organization defines other actions required to respond to information spills.','IR-9.8','The organization being inspected/assessed\\ndefines and documents additional actions to be taken in response to spillage incidents. The actions must include the following:\\n1)consider the information system as classified at the same level as the spilled information until the appropriate remediation processes have been executed and verified;\\n2) Include the investigative team members and questions identified in CNSS Instruction 1001 in investigation of the incident;\\n3) Protect information regarding the incident from disclosure.\\n\\nDoD has determined the actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented additional actions to ensure the organization being inspected/assessed defines other actions required to respond to information spills.  DoD has determined the actions are not appropriate to define at the Enterprise level'),\n('002813','draft','2013-07-12','DISA FSO','policy','The organization assigns organization-defined personnel or roles with responsibility for responding to information spills.','IR-9(1).1','The organization being inspected/assessed appoints personnel or roles defined in IR-9 (1), CCI 2815 as having the responsibility for responding to information spills.  ','The organization conducting the inspection/assessment obtains and examines appointment letters to ensure the organization being inspected/assessed appoints personnel or roles defined in IR-9 (1), CCI 2815 as having the responsibility for responding to information spills.  '),\n('002814','deprecated','2013-07-12','DISA FSO','policy','The organization assigns organization-defined personnel or roles with responsibility for responding to information spills.',NULL,NULL,NULL),\n('002815','draft','2013-07-12','DISA FSO','policy','The organization defines personnel or roles to whom responsibility for responding to information spills will be assigned.','IR-9(1).2','The organization being inspected/assessed defines and documents personnel or roles to whom responsibility for responding to information spills will be assigned. The personnel must include the ISSO and ISSM.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines personnel or roles to whom responsibility for responding to information spills will be assigned, which must include the ISSO and ISSM.   DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.'),\n('002816','draft','2013-07-12','DISA FSO','policy','The organization provides information spillage response training according to an organization-defined frequency.','IR-9(2).1','The organization being inspected/assessed  documents and implements a process to provide information spillage response training annually.  The organization must maintain a record of training.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the training records for a sampling of incident response personnel to ensure the organization being inspected/assessed provides information spillage response training annually.  DoD has defined the frequency as annually.'),\n('002817','draft','2013-07-12','DISA FSO','policy','The organization defines the frequency with which to provide information spillage response training.','IR-9(2).2','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('002818','draft','2013-07-12','DISA FSO','policy','The organization implements organization-defined procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.','IR-9(3).1','The organization being inspected/assessed implements procedures defined in IR-9 (3), CCI 2819  to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.','The organization conducting the inspection/assessment obtains and examines the documented procedures defined in IR-9 (3), CCI 2819 as well as after action reports of incidents to ensure the organization being inspected/assessed implements procedures defined in IR-9 (3), CCI 2819  to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.'),\n('002819','draft','2013-07-12','DISA FSO','policy','The organization defines procedures to implement to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.','IR-9(3).2','The organization being inspected/assessed defines and documents procedures to implement to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.  DoD has determined the procedures are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented procedures to ensure the organization being inspected/assessed defines procedures to implement to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.  DoD has determined the procedures are not appropriate to define at the Enterprise level.'),\n('002820','draft','2013-07-12','DISA FSO','policy','The organization employs organization-defined security safeguards for personnel exposed to information not within assigned access authorizations.','IR-9(4).1','The organization being inspected/assessed documents and implements a process to employ security safeguards defined in IR-9 (4), CCI 2821 for personnel exposed to information not within assigned access authorizations.  ','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed employs security safeguards defined in IR-9 (4), CCI 2821 for personnel exposed to information not within assigned access authorizations.  '),\n('002821','draft','2013-07-12','DISA FSO','policy','The organization defines security safeguards to employ for personnel exposed to information not within assigned access authorizations.','IR-9(4).2','The organization being inspected/assessed defines and documents security safeguards to employ for personnel exposed to information not within assigned access authorizations.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines security safeguards to employ for personnel exposed to information not within assigned access authorizations.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002822','draft','2013-07-12','DISA FSO','policy','The organization establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel.','IR-10.1','The organization being inspected/assessed establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel.  The organization appoints team members and defines and documents roles and responsibilities for each member.','The organization conducting the inspection/assessment obtains and examines appointments to the integrated team as well as the documented roles and responsibilities to ensure the organization being inspected/assessed establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel.'),\n('002823','draft','2013-07-12','DISA FSO','policy','The organization defines the security safeguards to be implemented to protect the information system^s memory from unauthorized code execution.','SI-16.1','The organization being inspected/assessed defines and documents the security safeguards to be implemented to protect the information system\\'s memory from unauthorized code execution.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines the security safeguards to be implemented to protect the information system\\'s memory from unauthorized code execution.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002824','draft','2013-07-12','DISA FSO','technical','The information system implements organization-defined security safeguards to protect its memory from unauthorized code execution.','SI-16.2','The organization being inspected/assessed configures the information system to implement  security safeguards defined in SI-16, CCI 2823 to protect its memory from unauthorized code execution.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2824.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement  security safeguards defined in SI-16, CCI 2823 to protect its memory from unauthorized code execution.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2824.'),\n('002825','draft','2013-07-20','DISA FSO','policy','The organization defines personnel or roles to whom the contingency planning policy is to be disseminated.','CP-1.3','DoD has defined the personnel or roles as all stakeholders identified in the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as all stakeholders identified in the contingency plan.'),\n('002826','draft','2013-07-20','DISA FSO','policy','The organization defines personnel or roles to whom the contingency planning procedures are disseminated.','CP-1.6','DoD has defined the personnel or roles as all stakeholders identified in the contingency plan.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as all stakeholders identified in the contingency plan.'),\n('002827','draft','2013-07-20','DISA FSO','policy','The organization coordinates its contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.','CP-2(7).1','The organization being inspected/assessed implements service level agreements and/or memorandums of agreement with external service providers necessary for the conduct of contingency plans to ensure that contingency requirements can be satisfied.','The organization conducting the inspection/assessment obtains and examines service level agreements and/or memorandums of agreement with external service providers to ensure the organization being inspected/assessed coordinates with those providers.'),\n('002828','draft','2013-07-20','DISA FSO','policy','The organization identifies critical information system assets supporting essential missions.','CP-2(8).1','The organization being inspected/assessed identifies and documents critical information system assets supporting essential missions.','The organization conducting the inspection/assessment obtains and examines the documented list of critical information system assets supporting essential missions to ensure the organization being inspected/assessed identifies those assets.'),\n('002829','draft','2013-07-20','DISA FSO','policy','The organization identifies critical information system assets supporting essential business functions.','CP-2(8).2','The organization being inspected/assessed identifies and documents critical information system assets supporting essential business functions.','The organization conducting the inspection/assessment obtains and examines the documented list of critical information system assets supporting essential business functions to ensure the organization being inspected/assessed identifies those assets.'),\n('002830','draft','2013-07-20','DISA FSO','policy','The organization defines the personnel or roles who review and approve the contingency plan for the information system.','CP-2.16','DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.'),\n('002831','draft','2013-07-20','DISA FSO','policy','The organization defines a list of key contingency personnel (identified by name and/or by role) and organizational elements to whom contingency plan changes are to be communicated.','CP-2.27','DoD has defined the list as all stakeholders identified in the contingency plan','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the list as all stakeholders identified in the contingency plan'),\n('002832','draft','2013-07-20','DISA FSO','policy','The organization protects the contingency plan from unauthorized disclosure and modification.','CP-2.28','The organization being inspected/assessed documents and implements a process to protect the contingency plan from unauthorized disclosure and modification.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed protects the contingency plan from unauthorized disclosure and modification.'),\n('002833','draft','2013-07-20','DISA FSO','policy','The organization defines the time period that contingency training is to be provided to information system users consistent with assigned roles and responsibilities within assuming a contingency role or responsibility.','CP-3.2','DoD has defined the time period as at a maximum, 10 working days. ','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as at a maximum, 10 working days. '),\n('002834','draft','2013-07-20','DISA FSO','policy','The organization provides contingency training to information system users consistent with assigned roles and responsibilities when required by information system changes.','CP-3.3','The organization being inspected/assessed will update contingency training materials when required by information system changes and provide that training to  personnel with contingency roles and responsibilities IAW CP-2, CCI 449.  The organization will maintain documentation of the training activity dates, location, and personnel for audit trail purposes and future reference (e.g., scheduling refresher training, etc.).','The organization conducting the inspection/assessment obtains and examines training materials and documentation of training activities to determine whether the materials are accurate in consideration of the state of the information system and content of the contingency plan.  The organization ensures that training is provided to users consistent with assigned roles and responsibilities.'),\n('002835','draft','2013-07-20','DISA FSO','policy','The organization tests the contingency plan at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations.','CP-4(2).2','The organization being inspected/assessed will perform contingency plan testing at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations.  The organization must maintain a record of test results.','The organization conducting the inspection/assessment obtains and examines the test results to ensure the organization being inspected/assessed tests the contingency plan at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations.'),\n('002836','draft','2013-07-20','DISA FSO','policy','The organization ensures that the alternate storage site provides information security safeguards equivalent to that of the primary site.','CP-6.2','The organization being inspected/assessed documents the information security safeguards that are in place at both the primary and alternate sites and evidence that the alternate site was approved based on an assessment that security is equivalent at the alternate site.','The organization conducting the inspection/assessment obtains and examines the documentation of the primary/alternate site information security safeguards that are in place as well as evidence that the alternate site was approved based on an assessment that security is equivalent at the alternate site.'),\n('002837','draft','2013-07-20','DISA FSO','policy','The organization plans for circumstances that preclude returning to the primary processing site.','CP-7(6).1','The organization being inspected/assessed documents a process to be followed in the event of circumstances that preclude returning to the primary processing site.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed plans for circumstances that preclude returning to the primary processing site.'),\n('002838','draft','2013-07-20','DISA FSO','policy','The organization prepares for circumstances that preclude returning to the primary processing site.','CP-7(6).2','The organization being inspected/assessed makes the resources available necessary to implement the plan documented IAW CP-7 (6), CCI 2837.','The organization conducting the inspection/assessment obtains and examines system resource lists or agreements with external support providers to ensure the organization being inspected/assessed prepares for circumstances that preclude returning to the primary processing site.'),\n('002839','draft','2013-07-20','DISA FSO','policy','The organization defines information system operations that are permitted to transfer and resume at an alternate processing site for essential missions/business functions when the primary processing capabilities are unavailable.','CP-7.4','The organization being inspected/assessed defines and documents information system operations that are permitted to transfer and resume at an alternate processing sites for essential missions/business functions when the primary processing capabilities are unavailable.  DoD has determined the information system operations are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system operations to ensure the organization being inspected/assessed defines information system operations that are permitted to transfer and resume at an alternate processing sites for essential missions/business functions when the primary processing capabilities are unavailable.  DoD has determined the information system operations are not appropriate to define at the Enterprise level.'),\n('002840','draft','2013-07-20','DISA FSO','policy','The organization defines the information system operations to be resumed for essential missions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.','CP-8.5','The organization being inspected/assessed defines and documents the information system operations to be resumed for essential missions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.  DoD has determined the information system operations are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system operations to ensure the organization being inspected/assessed defines the information system operations to be resumed for essential missions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.  DoD has determined the information system operations are not appropriate to define at the Enterprise level.'),\n('002841','draft','2013-07-20','DISA FSO','policy','The organization defines the information system operations to be resumed for essential business functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.','CP-8.6','The organization being inspected/assessed defines and documents the information system operations to be resumed for essential business functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.  DoD has determined the information system operations are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system operations to ensure the organization being inspected/assessed defines the information system operations to be resumed for essential business functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.  DoD has determined the information system operations are not appropriate to define at the Enterprise level.'),\n('002842','draft','2013-07-20','DISA FSO','policy','The organization reviews provider contingency plans to ensure that the plans meet organizational contingency requirements.','CP-8(4).3','The organization being inspected/assessed obtains and examines provider contingency plans to ensure the plans meet organizational contingency requirements.  The organization must maintain an audit trail of reviews.','The organization conducting the inspection/assessment obtains and examines the audit trail of reviews to ensure the organization being inspected/assessed reviews provider contingency plans to ensure that the plans meet organizational contingency requirements.'),\n('002843','draft','2013-07-20','DISA FSO','policy','The organization defines the frequency with which to obtain evidence of contingency testing by providers.','CP-8(4).4','DoD has defined the frequency as at least annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at least annually.'),\n('002844','draft','2013-07-20','DISA FSO','policy','The organization defines the frequency with which to obtain evidence of contingency training by providers.','CP-8(4).5','DoD has defined the frequency as at least annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at least annually.'),\n('002845','draft','2013-07-20','DISA FSO','policy','The organization obtains evidence of contingency testing by providers in accordance with organization-defined frequency.','CP-8(4).6','The organization being inspected/assessed obtains and maintains evidence of contingency testing by providers to ensure that the training is tested at least annually.   DoD has defined the frequency as at least annually.','The organization conducting the inspection/assessment obtains and examines the evidence of contingency testing to ensure that the organization being inspected/assessed obtains evidence that contingency testing is conducted by providers at least annually.   DoD has defined the frequency as at least annually.'),\n('002846','draft','2013-07-20','DISA FSO','policy','The organization obtains evidence of contingency training by providers in accordance with organization-defined frequency.','CP-8(4).7','The organization being inspected/assessed obtains and maintains evidence of contingency training by providers to ensure that the training is provided at least annually.   DoD has defined the frequency as at least annually.','The organization conducting the inspection/assessment obtains and examines the evidence of contingency training to ensure that the organization being inspected/assessed obtains evidence that contingency training is conducted by providers at least annually.   DoD has defined the frequency as at least annually.'),\n('002847','draft','2013-07-20','DISA FSO','policy','The organization defines the frequency with which to test alternate telecommunication services.','CP-8(5).1','DoD has defined the frequency as at least annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level   DoD has defined the frequency as at least annually.'),\n('002848','draft','2013-07-20','DISA FSO','policy','The organization tests alternate telecommunication services per organization-defined frequency.','CP-8(5).2','The organization being inspected/assessed documents and implements a process to test alternate telecommunication services at least annually.  The organization must maintain a record of tests.  DoD has defined the frequency as at least annually.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of tests to ensure the organization being inspected/assessed tests alternate telecommunication services at least annually.  DoD has defined the frequency as at least annually.'),\n('002849','draft','2013-07-20','DISA FSO','policy','The organization defines critical information system software and other security-related information, of which backup copies must be stored in a separate facility or in a fire-rated container.','CP-9(3).1','The organization being inspected/assessed defines and documents critical information system software and other security-related information which backup copies must be stored in a separate facility or in a fire-rated container.  DoD has determined the critical information system software and other security-related information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented critical information system software and other security-related information to ensure the organization being inspected/assessed defines critical information system software and other security-related information which backup copies must be stored in a separate facility or in a fire-rated container.  DoD has determined the critical information system software and other security-related information is not appropriate to define at the Enterprise level.'),\n('002850','draft','2013-07-20','DISA FSO','policy','The organization stores backup copies of organization-defined critical information system software and other security-related information in a separate facility or in a fire-rated container that is not collocated with the operational system.','CP-9(3).2','The organization being inspected/assessed stores backup copies of critical information system software and other security-related information defined in CP-9 (3), CCI 2849 in a separate facility or in a fire-rated container that is not collocated with the operational system.  The organization must maintain a record of where software is stored.','The organization conducting the inspection/assessment obtains and examines the record of where software is stored to ensure the organization being inspected/assessed stores backup copies of critical information system software and other security-related information defined in CP-9 (3), CCI 2849 in a separate facility or in a fire-rated container that is not collocated with the operational system.'),\n('002851','draft','2013-07-20','DISA FSO','policy','The organization defines the backup information that requires dual authorization for deletion or destruction.','CP-9(7).1','The organization being inspected/assessed defines and documents the backup information that requires dual authorization for deletion or destruction.  DoD has determined the backup information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented backup information to ensure the organization being inspected/assessed defines the backup information that requires dual authorization for deletion or destruction.  DoD has determined the backup information is not appropriate to define at the Enterprise level.'),\n('002852','draft','2013-07-20','DISA FSO','policy','The organization enforces dual authorization for the deletion or destruction of organization-defined backup information.','CP-9(7).2','The organization being inspected/assessed documents and implements a process for dual authorization for the deletion or destruction of  backup information defined in CP-9 (7), CCI 2851.  The organization must maintain a record of deletion or destruction of information defined in CP-9 (7), CCI 2851.','The organization conducting the inspection/assessment obtains and examines the documented process and record of deletion and destruction to ensure the organization being inspected/assessed enforces dual authorization for the deletion or destruction of  backup information defined in CP-9 (7), CCI 2851.'),\n('002853','draft','2013-07-20','DISA FSO','technical','The information system provides the capability to employ organization-defined alternative communications protocols in support of maintaining continuity of operations.','CP-11.1','The organization being inspected/assessed configures the information system to provide the capability to employ alternative communications protocols defined in CP-11, CCI 2854 in support of maintaining continuity of operations.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2853.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to provide the capability to employ alternative communications protocols defined in CP-11, CCI 2854 in support of maintaining continuity of operations.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2853.'),\n('002854','draft','2013-07-20','DISA FSO','policy','The organization defines the alternative communications protocols the information system must be capable of providing in support of maintaining continuity of operations.','CP-11.2','The organization being inspected/assessed defines and documents the alternative communications protocols the information systems must be capable of providing in support of maintaining continuity of operations.  DoD has determined the alternative communications protocols are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented alternative communications protocols to ensure the organization being inspected/assessed defines the alternative communications protocols the information systems must be capable of providing in support of maintaining continuity of operations.  DoD has determined the alternative communications protocols are not appropriate to define at the Enterprise level.'),\n('002855','draft','2013-07-20','DISA FSO','technical','The information system, when organization-defined conditions are detected, enters a safe mode of operation with organization-defined restrictions of safe mode of operation.','CP-12.1','The organization being inspected/assessed configures the information system to enter a safe mode of operation with restrictions of safe mode of operation defined in CP-12, CCI 2857 when conditions defined in CP-12, CCI 2856 are detected.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2855.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enter a safe mode of operation with restrictions of safe mode of operation defined in CP-12, CCI 2857 when conditions defined in CP-12, CCI 2856 are detected.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2855.'),\n('002856','draft','2013-07-20','DISA FSO','policy','The organization defines the conditions that, when detected, the information system enters a safe mode of operation with organization-defined restrictions of safe mode of operation.','CP-12.2','The organization being inspected/assessed defines and documents the conditions, that when detected, the information system enters a safe mode of operation with organization-defined restrictions of safe mode of operation.  DoD has determined the conditions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented conditions to ensure the organization being inspected/assessed defines  the conditions, that when detected, the information system enters a safe mode of operation with organization-defined restrictions of safe mode of operation.  DoD has determined the conditions are not appropriate to define at the Enterprise level.'),\n('002857','draft','2013-07-20','DISA FSO','policy','The organization defines the restrictions of the safe mode of operation that the information system will enter when organization-defined conditions are detected.','CP-12.3','The organization being inspected/assessed defines and documents the restrictions of safe mode of operation that the information system will enter when organization-defined conditions are detected.  DoD has determined the restrictions on safe mode of operation are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented restrictions to ensure the organization being inspected/assessed defines  the restrictions of safe mode of operation that the information system will enter when organization-defined conditions are detected.  DoD has determined the restrictions on safe mode of operation are not appropriate to define at the Enterprise level.'),\n('002858','draft','2013-07-20','DISA FSO','policy','The organization employs organization-defined alternative or supplemental security mechanisms for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised.','CP-13.1','The organization being inspected/assessed documents and implement a process to employ alternative or supplemental security mechanisms defined in CP-13, CCI 2859 for satisfying security functions defined in CP-13, CCI 2860 when the primary means of implementing the security function is unavailable or compromised.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed employs alternative or supplemental security mechanisms defined in CP-13, CCI 2859 for satisfying security functions defined in CP-13, CCI 2860 when the primary means of implementing the security function is unavailable or compromised.'),\n('002859','draft','2013-07-20','DISA FSO','policy','The organization defines the alternative or supplemental security mechanisms that will be employed for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised.','CP-13.2','The organization being inspected/assessed defines and documents the alternative or supplemental security mechanisms that will be employed for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised.  DoD has determined the alternative or supplemental security mechanisms are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented alternative or supplemental security mechanisms to ensure the organization being inspected/assessed defines the alternative or supplemental security mechanisms that will be employed for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised.  DoD has determined the alternative or supplemental security mechanisms are not appropriate to define at the Enterprise level.'),\n('002860','draft','2013-07-20','DISA FSO','policy','The organization defines the security functions that must be satisfied when the primary means of implementing the security function is unavailable or compromised.','CP-13.3','The organization being inspected/assessed defines and documents the security functions  that must be satisfied when the primary means of implementing the security function is unavailable or compromised.  DoD has determined the security functions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security functions to ensure the organization being inspected/assessed defines the security functions  that must be satisfied when the primary means of implementing the security function is unavailable or compromised.  DoD has determined the security functions are not appropriate to define at the Enterprise level.'),\n('002861','draft','2013-07-22','DISA FSO','policy','The organization defines the personnel or roles to whom a system maintenance policy is disseminated.','MA-1.1','DoD has defined the personnel or roles as the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.'),\n('002862','draft','2013-07-22','DISA FSO','policy','The organization defines the personnel or roles to whom system maintenance procedures are to be disseminated.','MA-1.2','DoD has defined the personnel or roles as the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as the SCA, ISSO, and maintenance personnel as needed by role in maintaining the system.'),\n('002863','draft','2013-07-22','DISA FSO','policy','The organization employs automated mechanisms to schedule, conduct, and document repairs.','MA-2(2).1','The organization being inspected/assessed documents and implements automated mechanisms to schedule, conduct, and document repairs.','The organization conducting the inspection/assessment obtains and examines the documentation of automated mechanisms to ensure the organization being inspected/assessed employs automated mechanisms to schedule, conduct, and document repairs.'),\n('002864','draft','2013-07-22','DISA FSO','policy','The organization produces up-to date, accurate, and complete records of all maintenance requested, scheduled, in process, and completed.','MA-2(2).3','The organization being inspected/assessed produces and maintains up-to date, accurate, and complete records of all maintenance requested, scheduled, in process, and completed.','The organization conducting the inspection/assessment obtains and examines the records of maintenance to ensure the organization being inspected/assessed  produces up-to date, accurate, and complete records of all maintenance requested, scheduled, in process, and completed.'),\n('002865','draft','2013-07-22','DISA FSO','policy','The organization produces up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed.','MA-2(2).4','The organization being inspected/assessed produces and maintains up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed.','The organization conducting the inspection/assessment obtains and examines the records of repair actions to ensure the organization being inspected/assessed  produces up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed.'),\n('002866','draft','2013-07-22','DISA FSO','policy','The organization schedules maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-2.1','The organization being inspected/assessed schedules maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.  The organization must maintain a record of maintenance.','The organization conducting the inspection/assessment obtains and examines the record of maintenance to ensure the organization being inspected/assessed schedules maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('002867','draft','2013-07-22','DISA FSO','policy','The organization performs maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-2.2','The organization being inspected/assessed  implements a process to perform maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.  The organization must maintain a record of maintenance procedures followed.','The organization conducting the inspection/assessment obtains and examines  the record of maintenance procedures followed to ensure the organization being inspected/assessed performs maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('002868','draft','2013-07-22','DISA FSO','policy','The organization documents maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-2.3','The organization being inspected/assessed documents maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','The organization conducting the inspection/assessment obtains and examines documentation of maintenance to ensure the organization being inspected/assessed documents maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('002869','draft','2013-07-22','DISA FSO','policy','The organization reviews records of maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-2.4','The organization being inspected/assessed documents and implements a process to review records of maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.  The organization must maintain a record of reviews.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews records of maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('002870','draft','2013-07-22','DISA FSO','policy','The organization schedules repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-2.5','The organization being inspected/assessed schedules repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.  The organization must maintain a record of repairs.','The organization conducting the inspection/assessment obtains and examines the record of repairs to ensure the organization being inspected/assessed schedules repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('002871','draft','2013-07-22','DISA FSO','policy','The organization performs repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-2.6','The organization being inspected/assessed  implements a process to perform repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.  The organization must maintain a record of repair procedures followed.','The organization conducting the inspection/assessment obtains and examines  the record of repair procedures followed to ensure the organization being inspected/assessed performs repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('002872','draft','2013-07-22','DISA FSO','policy','The organization documents repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-2.7','The organization being inspected/assessed documents repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','The organization conducting the inspection/assessment obtains and examines documentation of repairs to ensure the organization being inspected/assessed documents repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('002873','draft','2013-07-22','DISA FSO','policy','The organization reviews records of repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-2.8','The organization being inspected/assessed documents and implements a process to review records of repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.  The organization must maintain a record of reviews.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews records of repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('002874','draft','2013-07-22','DISA FSO','policy','The organization defines the personnel or roles who can explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs.','MA-2.11','The organization being inspected/assessed defines and documents the personnel or roles who can explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles who can explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.'),\n('002875','draft','2013-07-22','DISA FSO','policy','The organization includes organization-defined maintenance-related information in organizational maintenance records.','MA-2.14','The organization being inspected/assessed includes maintenance-related information defined in MA-2, CCI 2876 in organizational maintenance records.','The organization conducting the inspection/assessment obtains and examines maintenance records to ensure they include maintenance-related information defined in MA-2, CCI 2876.'),\n('002876','draft','2013-07-22','DISA FSO','policy','The organization defines the maintenance-related information to include in organizational maintenance records.','MA-2.15','The organization being inspected/assessed defines and documents the maintenance-related information to include in organizational maintenance records.  DoD has determined the maintenance-related information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented maintenance-related information to ensure the organization being inspected/assessed defines the maintenance-related information to include in organizational maintenance records.  DoD has determined the maintenance-related information is not appropriate to define at the Enterprise level.'),\n('002877','deprecated','2013-07-22','DISA FSO','policy','The organization prevents the unauthorized removal of maintenance equipment containing organizational information by verifying that there is no organizational information contained on the equipment.',NULL,NULL,NULL),\n('002878','deprecated','2013-07-22','DISA FSO','policy','The organization prevents the unauthorized removal of maintenance equipment containing organizational information by sanitizing or destroying the equipment.',NULL,NULL,NULL),\n('002879','deprecated','2013-07-22','DISA FSO','policy','The organization prevents the unauthorized removal of maintenance equipment containing organizational information by retaining the equipment within the facility.',NULL,NULL,NULL),\n('002880','deprecated','2013-07-22','DISA FSO','policy','The organization prevents the unauthorized removal of maintenance equipment containing organizational information by retaining the equipment within the facility.',NULL,NULL,NULL),\n('002881','deprecated','2013-07-22','DISA FSO','policy','The organization prevents the unauthorized removal of maintenance equipment containing organizational information by obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility.',NULL,NULL,NULL),\n('002882','draft','2013-07-22','DISA FSO','policy','The organization defines the personnel or roles who can provide an exemption that explicitly authorizes removal of equipment from the facility.','MA-3(3).2','The organization being inspected/assessed defines and documents the personnel or roles who can provide an exemption that explicitly authorizes removal of equipment from the facility.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles who can provide an exemption that explicitly authorizes removal of equipment from the facility.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.'),\n('002883','draft','2013-07-22','DISA FSO','technical','The information system restricts the use of maintenance tools to authorized personnel only.','MA-3(4).1','The organization being inspected/assessed configures the information system to restrict the use of maintenance tools to authorized personnel only.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2883.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to restrict the use of maintenance tools to authorized personnel only.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2883.'),\n('002884','draft','2013-07-22','DISA FSO','technical','The organization audits nonlocal maintenance and diagnostic sessions^ organization-defined audit events.','MA-4(1).1','The organization being inspected/assessed configures the information system to audit nonlocal maintenance and diagnostic sessions\\' organization-defined audit events.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2884.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to audit nonlocal maintenance and diagnostic sessions\\' organization-defined audit events.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2884.'),\n('002885','draft','2013-07-22','DISA FSO','policy','The organization defines the nonlocal maintenance and diagnostic session audit events to audit.','MA-4(1).2','The organization being inspected/assessed defines and documents the nonlocal maintenance and diagnostic session audit events to audit.  DoD has determined the audit events are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented audit events to ensure the organization being inspected/assessed defines  the nonlocal maintenance and diagnostic session audit events to audit.  DoD has determined the audit events are not appropriate to define at the Enterprise level.'),\n('002886','draft','2013-07-22','DISA FSO','policy','The organization reviews the records of the nonlocal maintenance and diagnostic sessions.','MA-4(1).3','The organization being inspected/assessed documents and implements a process to review the records of the nonlocal maintenance and diagnostic sessions.  The organization must maintain a record of reviews.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews the records of the nonlocal maintenance and diagnostic sessions.'),\n('002887','draft','2013-07-22','DISA FSO','policy','The organization defines the authenticators that are replay resistant which will be employed to protect nonlocal maintenance sessions.','MA-4(4).2','The organization being inspected/assessed defines and documents the authenticators that are replay resistant which will be employed to protect nonlocal maintenance sessions.  DoD has determined the authenticators are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented authenticators to ensure the organization being inspected/assessed defines the authenticators that are replay resistant which will be employed to protect nonlocal maintenance sessions.  DoD has determined the authenticators are not appropriate to define at the Enterprise level.'),\n('002888','draft','2013-07-22','DISA FSO','policy','The organization defines the personnel or roles authorized to approve each nonlocal maintenance session.',NULL,NULL,NULL),\n('002889','draft','2013-07-22','DISA FSO','policy','The organization notifies organization-defined personnel or roles of the date and time of planned nonlocal maintenance.','MA-4(5).4','The organization being inspected/assessed documents and implements a process to notify the user base which could be impacted by the maintenance event  of the date and time of planned nonlocal maintenance.  DoD has defined the personnel or roles as the user base which could be impacted by the maintenance event.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed notifies the user base which could be impacted by the maintenance event  of the date and time of planned nonlocal maintenance.  DoD has defined the personnel or roles as the user base which could be impacted by the maintenance event.'),\n('002890','draft','2013-07-22','DISA FSO','technical','The information system implements cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.','MA-4(6).1','The organization being inspected/assessed configures the information system to  implement cryptographic mechanisms to protect the integrity  of nonlocal maintenance and diagnostic communications.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2890.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2890.'),\n('002891','draft','2013-07-22','DISA FSO','technical','The information system implements remote disconnect verification at the termination of nonlocal maintenance and diagnostic sessions.','MA-4(7).1','The organization being inspected/assessed configures the information system to implement remote disconnect verification at the termination of nonlocal maintenance and diagnostic sessions.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2891.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement remote disconnect verification at the termination of nonlocal maintenance and diagnostic sessions.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2891.'),\n('002892','draft','2013-07-22','DISA FSO','policy','The organization develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.','MA-5(1).4','The organization being inspected/assessed documents and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.'),\n('002893','draft','2013-07-22','DISA FSO','policy','The organization ensures that non-escorted personnel performing maintenance activities not directly associated with the information system but in the physical proximity of the system, have required access authorization.','MA-5(5).1','The organization being inspected/assessed documents and implements a process to  ensure that non-escorted personnel performing maintenance activities not directly associated with the information system but in the physical proximity of the system, have required access authorization.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures that non-escorted personnel performing maintenance activities not directly associated with the information system but in the physical proximity of the system, have required access authorization.'),\n('002894','draft','2013-07-22','DISA FSO','policy','The organization ensures that non-escorted personnel performing maintenance on the information system have required access authorizations.','MA-5.3','The organization being inspected/assessed documents and implements a process to ensure that non-escorted personnel performing maintenance on the information system have required access authorizations.  The organization must maintain a record of personnel performing maintenance on the information system.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of personnel performing maintenance on the information system to ensure the organization being inspected/assessed ensures that non-escorted personnel performing maintenance on the information system have required access authorizations.'),\n('002895','draft','2013-07-22','DISA FSO','policy','The organization designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.','MA-5.4','The organization being inspected/assessed defines and documents organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.','The organization conducting the inspection/assessment obtains and examines documented organizational personnel to ensure the organization being inspected/assessed designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.'),\n('002896','draft','2013-07-22','DISA FSO','policy','The organization defines the information system components for which it obtains maintenance support and/or spare parts.','MA-6.2','The organization being inspected/assessed  defines and documents the information system components for which it obtains maintenance support and/or spare parts.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components for which it obtains maintenance support and/or spare parts.   DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002897','draft','2013-07-22','DISA FSO','policy','The organization defines a time period for obtaining maintenance support and/or spare parts for organization-defined information system components after a failure.','MA-6.3','DoD has defined the time period as within 24 hours (Low and Moderate Availability) or immediately upon failure for (High Availability).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as within 24 hours (Low and Moderate Availability) or immediately upon failure for (High Availability).'),\n('002898','draft','2013-07-22','DISA FSO','policy','The organization performs preventive maintenance on organization-defined information system components at organization-defined time intervals.','MA-6(1).1','The organization being inspected/assessed performs preventive maintenance on information system components defined in MA-6 (1), CCI 2899 at time intervals defined in MA-6 (1), CCI 2900.  The organization must maintain schedules and records of preventive maintenance.','The organization conducting the inspection/assessment obtains and examines schedules and records of preventive maintenance to ensure the organization being inspected/assessed performs preventive maintenance on information system components defined in MA-6 (1), CCI 2899 at time intervals defined in MA-6 (1), CCI 2900.'),\n('002899','draft','2013-07-22','DISA FSO','policy','The organization defines information system components on which to perform preventive maintenance.','MA-6(1).2','The organization being inspected/assessed defines and documents information system components on which to perform preventive maintenance.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines information system components on which to perform preventive maintenance.   DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002900','draft','2013-07-22','DISA FSO','policy','The organization defines time intervals at which to perform preventive maintenance on organization-defined information system components.','MA-6(1).3','The organization being inspected/assessed defines and documents time intervals to perform preventive maintenance on organization-defined information system components.  Time periods must be determined based on methods of determining what preventive (or other) failure management policies to apply include, for example, original equipment manufacturer (OEM) recommendations, statistical failure records, requirements of codes, legislation, or regulations within a jurisdiction, expert opinion, maintenance that has already been conducted on similar equipment, or measured values and performance indications.   DoD has determined the time intervals are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented time intervals to ensure the organization being inspected/assessed defines time intervals to perform preventive maintenance on organization-defined information system components.  DoD has determined the time intervals are not appropriate to define at the Enterprise level.'),\n('002901','draft','2013-07-22','DISA FSO','policy','The organization performs predictive maintenance on organization-defined information system components at organization-defined intervals.','MA-6(2).1','The organization being inspected/assessed performs predictive maintenance on information system components defined in MA-6 (2), CCI 2902 at time intervals defined in MA-6 (2), CCI 2903.  The organization must maintain schedules and records of predictive maintenance.','The organization conducting the inspection/assessment obtains and examines schedules and records of predictive maintenance to ensure the organization being inspected/assessed performs predictive maintenance on information system components defined in MA-6 (2), CCI 2902 at time intervals defined in MA-6 (2), CCI 2903.'),\n('002902','draft','2013-07-22','DISA FSO','policy','The organization defines information system components on which to perform predictive maintenance.','MA-6(2).2','The organization being inspected/assessed defines and documents information system components on which to perform predictive maintenance.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines information system components on which to perform predictive maintenance.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('002903','draft','2013-07-22','DISA FSO','policy','The organization defines time intervals at which to perform predictive maintenance on organization-defined information system components.','MA-6(2).3','The organization being inspected/assessed defines and documents time intervals to perform predictive maintenance on organization-defined information system components.  DoD has determined the time intervals are not appropriate to define at the Enterprise level','The organization conducting the inspection/assessment obtains and examines the documented time intervals to ensure the organization being inspected/assessed defines time intervals to perform predictive maintenance on organization-defined information system components.  DoD has determined the time intervals are not appropriate to define at the Enterprise level.');\nINSERT INTO `cci` VALUES ('002904','draft','2013-07-22','DISA FSO','policy','The organization employs automated mechanisms to transfer predictive maintenance data to a computerized maintenance management system.','MA-6(3).1','The organization being inspected/assessed documents and implements automated mechanisms to transfer predictive maintenance data to a computerized maintenance management system.','The organization conducting the inspection/assessment obtains and examines documentation of automated mechanisms to ensure the organization being inspected/assessed employs automated mechanisms to transfer predictive maintenance data to a computerized maintenance management system.'),\n('002905','draft','2013-08-12','DISA FSO','policy','The organization employs automated mechanisms to schedule, conduct, and document maintenance.','MA-2(2).2','The organization being inspected/assessed documents and implements automated mechanisms to schedule, conduct, and document maintenance.','The organization conducting the inspection/assessment obtains and examines the documentation of automated mechanisms to ensure the organization being inspected/assessed employs automated mechanisms to schedule, conduct, and document maintenance.'),\n('002906','draft','2013-08-13','DISA FSO','policy','The organization defines the vulnerability scanning activities in which the information system implements privileged access authorization to organization-identified information system components.','RA-5(5).3','The organization being inspected/assessed defines and documents the vulnerability scanning activities in which the information system implements privileged access authorization to organization-identified information system components.  DoD has determined the vulnerability scanning activities are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented vulnerability scanning activities to ensure the organization being inspected/assessed defines the vulnerability scanning activities in which the information system implements privileged access authorization to organization-identified information system components.  DoD has determined the vulnerability scanning activities are not appropriate to define at the Enterprise level.'),\n('002907','draft','2013-08-22','DISA FSO','policy','The organization defines the system mode to be invoked, such as a full system shutdown, a partial system shutdown, or a degraded operational mode with limited mission/business functionality available, in the event of organization-defined audit failures.','AU-5(4).3','The organization being inspected/assessed defines and documents the system mode to be invoked.  Possible examples of system modes include a full system shutdown, a partial system shutdown, or a degraded operational mode with limited mission/business functionality available.','The organization conducting the inspection/assessment obtains and examines the documented system mode to ensure the organization being inspected/assessed defines  the system mode to be invoked.'),\n('002908','draft','2013-08-27','DISA FSO','policy','The organization defines the personnel or roles to whom a physical and environmental protection policy is disseminated.','PE-1.1','DoD has defined the roles as organizational personnel with physical and environmental protection responsibilities.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the roles as organizational personnel with physical and environmental protection responsibilities.'),\n('002909','draft','2013-08-27','DISA FSO','policy','The organization defines the personnel or roles to whom the physical and environmental protection procedures are disseminated.','PE-1.2','DoD has defined the roles as organizational personnel with physical and environmental protection responsibilities.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the roles as organizational personnel with physical and environmental protection responsibilities.'),\n('002910','draft','2013-08-27','DISA FSO','policy','The organization approves a list of individuals with authorized access to the facility where the information system resides.','PE-2.2','The organization being inspected/assessed  formally approves a list of individuals currently authorized to access the facility where the information system resides.','The organization conducting the inspection/assessment obtains and examines the list of individuals currently authorized to access the facility where the information system resides and ensures it is formally approved.'),\n('002911','draft','2013-08-27','DISA FSO','policy','The organization maintains a list of individuals with authorized access to the facility where the information system resides.','PE-2.3','The organization being inspected/assessed  maintains a list of individuals currently authorized to access the facility where the information system resides.','The organization conducting the inspection/assessment obtains and examines the list of individuals to ensure the organization being inspected/assessed maintains a list of individuals currently authorized to access the facility where the information system resides.'),\n('002912','draft','2013-08-27','DISA FSO','policy','The organization defines a list of acceptable forms of identification for visitor access to the facility where the information system resides.','PE-2(2).2','The organization being inspected/assessed defines and documents a list of acceptable forms of identification for visitor access to the facility where the information system resides.  DoD has determined the list of acceptable forms of identification are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented a list of acceptable forms of identification to ensure the organization being inspected/assessed defines a list of acceptable forms of identification for visitor access to the facility where the information system resides.  DoD has determined the list of acceptable forms of identification are not appropriate to define at the Enterprise level.'),\n('002913','draft','2013-08-27','DISA FSO','policy','The organization restricts unescorted access to the facility where the information system resides to personnel with one or more of the following: security clearances for all information contained within the system; formal access authorizations for all information contained within the system; need for access to all information contained within the system; organization-defined credentials.','PE-2(3).1','The organization being inspected/assessed defines and documents the requirements that must be met before unescorted access to the facility where the information system resides will be granted.  These requirements will be selected from: security clearances for all information contained within the system; formal access authorizations for all information contained within the system; need for access to all information contained within the system; credentials defined in PE-2 (3), CCI 2914.  This requirement must be documented within the organization\\'s physical security policy.','The organization conducting the inspection/assessment obtains and examines the physical security policy to ensure the organization being inspected/assessed has selected one or more of the physical security requirements that must be met before unescorted access to the facility where the information system resides is granted'),\n('002914','draft','2013-08-27','DISA FSO','policy','The organization defines the credentials required for personnel to have unescorted access to the facility where the information system resides.','PE-2(3).2','The organization being inspected/assessed defines and documents the credentials required for personnel to have unescorted access to the facility where the information system resides.  DoD has determined the credentials are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented credentials to ensure the organization being inspected/assessed defines  the credentials required for personnel to have unescorted access to the facility where the information system resides.  DoD has determined the credentials are not appropriate to define at the Enterprise level.'),\n('002915','draft','2013-08-27','DISA FSO','policy','The organization defines the entry/exit points to the facility where the information system resides.','PE-3.2','The organization being inspected/assessed defines and documents the entry/exit points to the facility where the information system resides.  DoD has determined the entry/exit points are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented entry/exit points and inspects the facility to ensure that all entry/exit points are documented.  DoD has determined the entry/exit points are not appropriate to define at the Enterprise level.'),\n('002916','draft','2013-08-27','DISA FSO','policy','The organization defines the physical access control systems/devices or guards that control ingress/egress to the facility where the information system resides.','PE-3.5','The organization being inspected/assessed defines and documents the physical access control systems/devices or guards that control ingress/egress to the facility.  DoD has determined the physical access control systems/devices are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented physical access control systems/devices to ensure the organization being inspected/assessed defines the physical access control systems/devices or guards that control ingress/egress to the facility.  DoD has determined the physical access control systems/devices are not appropriate to define at the Enterprise level.'),\n('002917','draft','2013-08-27','DISA FSO','policy','The organization maintains physical access audit logs for organization-defined entry/exit points to the facility where the information system resides.','PE-3.6','The organization being inspected/assessed maintains physical access audit logs for entry/exit points defined in PE-3, CCI 2918.','The organization conducting the inspection/assessment obtains and examines the physical access audit logs and compares the logged entry with known access to those entry points to ensure the organization being inspected/assessed maintains physical access audit logs for entry/exit points defined in PE-3, CCI 2918.  Instances of access that will be compared with the audit logs include, at a minimum, access as part of the inspection/assessment. Comparison of other entry/exit events required elsewhere in system documentation that would have occurred before the inspection/assessment such as daily checks and scheduled maintenance are strongly encouraged and help to establish a history of compliance/non-compliance.'),\n('002918','draft','2013-08-27','DISA FSO','policy','The organization defines entry/exit points to the facility where the information system resides that require physical access audit logs be maintained.','PE-3.7','The organization being inspected/assessed defines and documents entry/exit points that require physical access audit logs be maintained.  DoD has determined the entry/exit points are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented entry/exit points to ensure the organization being inspected/assessed defines entry/exit points that require physical access audit logs be maintained.  DoD has determined the entry/exit points are not appropriate to define at the Enterprise level.'),\n('002919','draft','2013-08-27','DISA FSO','policy','The organization provides organization-defined security safeguards to control access to areas within the facility where the information system resides officially designated as publicly accessible.','PE-3.8','The organization being inspected/assessed provides security safeguards defined in PE-3, CCI 2920 to control access to areas within the facility officially designated as publicly accessible.   The organization must document which areas are officially designated as publicly accessible.','The organization conducting the inspection/assessment obtains and examines the documentation of areas officially designated as publicly accessible to ensure the organization being inspected/assessed provides security safeguards defined in PE-3, CCI 2920 to control access to areas within the facility officially designated as publicly accessible.'),\n('002920','draft','2013-08-27','DISA FSO','policy','The organization defines security safeguards to control access to areas within the facility where the information system resides officially designated as publicly accessible.','PE-3.9','The organization being inspected/assessed defines and documents security safeguards to control access to areas within the facility officially designated as publicly accessible.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines security safeguards to control access to areas within the facility officially designated as publicly accessible.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002921','draft','2013-08-27','DISA FSO','policy','The organization escorts visitors in the facility where the information system resides during organization-defined circumstances requiring visitor escorts.','PE-3.10','The organization being inspected/assessed   documents and implements a process to escort visitors during circumstances defined in PE-3, CCI 2922 requiring visitor escorts.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed escorts visitors during circumstances defined in PE-3, CCI 2922 requiring visitor escorts.'),\n('002922','draft','2013-08-27','DISA FSO','policy','The organization defines circumstances requiring visitor escorts in the facility where the information system resides.','PE-3.11','The organization being inspected/assessed defines and documents circumstances requiring visitor escorts.  DoD has determined the circumstances are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented circumstances to ensure the organization being inspected/assessed defines circumstances requiring visitor escorts.  DoD has determined the circumstances are not appropriate to define at the Enterprise level.'),\n('002923','draft','2013-08-27','DISA FSO','policy','The organization monitors visitor activity in the facility where the information system resides during organization-defined circumstances requiring visitor monitoring.','PE-3.12','The organization being inspected/assessed documents and implements a process to monitor visitor activity during circumstances defined in PE-3, CCI 2924 requiring visitor monitoring.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed monitors visitor activity during circumstances defined in PE-3, CCI 2924 requiring visitor monitoring.'),\n('002924','draft','2013-08-27','DISA FSO','policy','The organization defines circumstances requiring visitor monitoring in the facility where the information system resides.','PE-3.13','The organization being inspected/assessed defines and documents circumstances requiring visitor monitoring.  DoD has determined the circumstances are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented circumstances to ensure the organization being inspected/assessed defines circumstances requiring visitor monitoring.  DoD has determined the circumstances are not appropriate to define at the Enterprise level.'),\n('002925','draft','2013-08-27','DISA FSO','policy','The organization defines the physical access devices to inventory.','PE-3.17','DoD has defined the physical access devices as minimally keys or any other physical token used to gain access.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the physical access devices as minimally keys or any other physical token used to gain access.'),\n('002926','draft','2013-08-27','DISA FSO','policy','The organization defines the physical spaces containing one or more components of the information system that require physical access authorizations and controls at the facility where the information system resides.','PE-3(1).2','The organization being inspected/assessed defines and documents the physical spaces containing one or more components of the information system that require physical access authorizations  and controls at the facility.  DoD has determined the physical spaces are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented physical spaces to ensure the organization being inspected/assessed defines the physical spaces containing one or more components of the information system that require physical access authorizations  and controls at the facility.  DoD has determined the physical spaces are not appropriate to define at the Enterprise level.'),\n('002927','draft','2013-08-27','DISA FSO','policy','The organization defines the frequency with which to perform security checks at the physical boundary of the facility or information system for unauthorized exfiltration of information or removal of information system components.','PE-3(2).2','DoD has defined the frequency as at a minimum, annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as at a minimum, annually.'),\n('002928','draft','2013-08-27','DISA FSO','policy','The organization defines security safeguards to detect and prevent physical tampering or alteration of organization-defined hardware components within the information system.','PE-3(5).2','The organization being inspected/assessed defines and documents security safeguards to detect and prevent physical tampering or alteration of organization-defined hardware components within the information system.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines security safeguards to detect and prevent physical tampering or alteration of organization-defined hardware components within the information system.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002929','draft','2013-08-27','DISA FSO','policy','The organization defines hardware components within the information system for which to employ organization-defined security safeguards to detect and prevent physical tampering or alteration.','PE-3(5).3','The organization being inspected/assessed defines and documents hardware components within the information system to employ organization-defined security safeguards to detect and prevent physical tampering or alteration.  DoD has determined the hardware components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented hardware components to ensure the organization being inspected/assessed  defines hardware components within the information system to employ organization-defined security safeguards to detect and prevent physical tampering or alteration.  DoD has determined the hardware components are not appropriate to define at the Enterprise level.'),\n('002930','draft','2013-08-27','DISA FSO','policy','The organization defines information system distribution and transmission lines within organizational facilities to control physical access to using organization-defined security safeguards.','PE-4.2','The organization being inspected/assessed defines and documents information system distribution and transmission lines within organizational facilities to control physical access using organization-defined security safeguards.  If transmission lines carry classified information, a protected distribution system (PDS) must be used to transmit unencrypted classified information through an area of lesser classification or control.  For additional information, see NSTISSI No. 7003.  DoD has determined the information system distribution and transmission lines are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system distribution and transmission lines to ensure the organization being inspected/assessed defines information system distribution and transmission lines within organizational facilities to control physical access using organization-defined security safeguards.  DoD has determined the information system distribution and transmission lines are not appropriate to define at the Enterprise level.'),\n('002931','draft','2013-08-27','DISA FSO','policy','The organization defines security safeguards to control physical access to organization-defined information system distribution and transmission lines within organizational facilities.','PE-4.3','The organization being inspected/assessed defines and documents security safeguards to control physical access to organization-defined information system distribution and transmission lines within organizational facilities.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines security safeguards to control physical access to organization-defined information system distribution and transmission lines within organizational facilities.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('002932','draft','2013-08-27','DISA FSO','policy','The organization controls physical access to output from organization-defined output devices.','PE-5(1).1','The organization being inspected/assessed  documents and implements a process to control physical access to output from output devices defined in PE-5 (1), CCI 2933.','The organization conducting the inspection/assessment obtains and examines the documented process and inspects the physical access controls surrounding a sampling of output devices to ensure the organization being inspected/assessed controls physical access to output from output devices defined in PE-5 (1), CCI 2933.'),\n('002933','draft','2013-08-27','DISA FSO','policy','The organization defines output devices for which physical access to output is controlled.','PE-5(1).2','The organization being inspected/assessed defines and documents output devices for which physical access to output is controlled.  DoD has determined the output devices are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented output devices to ensure the organization being inspected/assessed defines output devices for which physical access to output is controlled.  DoD has determined the output devices are not appropriate to define at the Enterprise level.'),\n('002934','draft','2013-08-27','DISA FSO','policy','The organization ensures that only authorized individuals receive output from organization-defined output devices.','PE-5(1).3','The organization being inspected/assessed documents and implements a process to ensure that only authorized individuals receive output from the output device defined in PE-5 (1), CCI 2933.','The organization conducting the inspection/assessment obtains and examines the documented process and inspects the physical access controls surrounding a sampling of output devices to ensure the organization being inspected/assessed ensures that only authorized individuals receive output from the output device defined in PE-5 (1), CCI 2933.'),\n('002935','draft','2013-08-27','DISA FSO','policy','The information system controls physical access to output from organization-defined output devices.','PE-5(2).1','The organization being inspected/assessed configures the information system to control physical access to output from output devices  defined in PE-5 (1), CCI 2933.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2935.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to control physical access to output from output devices  defined in PE-5 (1), CCI 2933.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2935.'),\n('002936','draft','2013-08-27','DISA FSO','policy','The information system links individual identity to receipt of output from organization-defined output devices.','PE-5(2).2','The organization being inspected/assessed configures the information system to link individual identity to receipt of the output from the output device defined in PE-5 (1), CCI 2933.   For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2936.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to link individual identity to receipt of the output from the output device defined in PE-5 (1), CCI 2933.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2936.'),\n('002937','draft','2013-08-27','DISA FSO','policy','The organization marks organization-defined information system output devices indicating the appropriate security marking of the information permitted to be output from the device.','PE-5(3).1','The organization being inspected/assessed marks all devices if the organizational facility contains classified information indicating the appropriate security marking of the information permitted to be output from the device.  DoD has defined the information system output devices as all devices if the organizational facility contains classified information.','The organization conducting the inspection/assessment inspects a sampling of information system components to ensure the organization being inspected/assessed marks all devices if the organizational facility contains classified information indicating the appropriate security marking of the information permitted to be output from the device.  DoD has defined the information system output devices as all devices if the organizational facility contains classified information.'),\n('002938','draft','2013-08-27','DISA FSO','policy','The organization defines the information system output devices marked indicating the appropriate security marking of the information permitted to be output from the device.','PE-5(3).2','DoD has defined the information system output devices as all devices if the organizational facility contains classified information.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the information system output devices as all devices if the organizational facility contains classified information.'),\n('002939','draft','2013-08-27','DISA FSO','policy','The organization monitors physical access to the facility where the information system resides to detect and respond to physical security incidents.','PE-6.1','The organization being inspected/assessed will implement monitoring procedures to ensure physical access intrusion alarms and surveillance equipment are actively monitored to detect and respond to all physical access security incidents.','The organization conducting the inspection/assessment obtains and examines the inspected organization\\'s monitoring procedures addressing physical access monitoring. Organizational personnel with physical access monitoring responsibilities are to be interviewed. The objective of the reviews and interviews is to validate the organization is actively monitoring its physical access intrusion alarms and surveillance equipment to detect and respond to all physical access security incidents.'),\n('002940','draft','2013-08-27','DISA FSO','policy','The organization reviews physical access logs upon occurrence of organization-defined events or potential indications of events.','PE-6.2','The organization being inspected/assessed documents and implements a process to review physical access logs upon occurrence of  events or potential indications of events defined in PE-6, CCI 2941.  The organization must maintain records of reviews.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the records of reviews to ensure the organization being inspected/assessed reviews physical access logs upon occurrence of  events or potential indications of events defined in PE-6, CCI 2941.'),\n('002941','draft','2013-08-27','DISA FSO','policy','The organization defines events or potential indications of events requiring review of physical access logs.','PE-6.3','The organization being inspected/assessed defines and documents events or potential indications of events requiring review of physical access logs.  DoD has determined the events or potential indications of events are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented events or potential indications of events to ensure the organization being inspected/assessed defines events or potential indications of events requiring review of physical access logs.  DoD has determined the events or potential indications of events are not appropriate to define at the Enterprise level.'),\n('002942','draft','2013-08-27','DISA FSO','policy','The organization employs automated mechanisms to recognize organization-defined classes/types of intrusions.','PE-6(2).1','The organization being inspected/assessed implements automated mechanisms to recognize classes/types of intrusions defined in PE-6 (2), CCI 2943.','The organization conducting the inspection/assessment obtains and examines hardware/software lists and/or any other documentation showing the use of automated intrusion detection systems to ensure the organization being inspected/assessed implements automated mechanisms to recognize classes/types of intrusions defined in PE-6 (2), CCI 2943.'),\n('002943','draft','2013-08-27','DISA FSO','policy','The organization defines classes/types of intrusions to recognize using automated mechanisms.','PE-6(2).2','The organization being inspected/assessed defines and documents classes/types of intrusions to recognize using automated mechanisms.  DoD has determined the classes/types of intrusions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented classes/types of intrusion to ensure the organization being inspected/assessed defines classes/types of intrusions to recognize using automated mechanisms.  DoD has determined the classes/types of intrusions are not appropriate to define at the Enterprise level.'),\n('002944','draft','2013-08-27','DISA FSO','policy','The organization employs automated mechanisms to initiate organization-defined response actions to organization-defined classes/types of intrusions.','PE-6(2).3','The organization being inspected/assessed implements automated mechanisms to initiate response actions defined in PE-6 (2), CCI 2945  to classes/types of intrusions defined in PE-6 (2), CCI 2943.','The organization conducting the inspection/assessment obtains and examines hardware/software lists and/or any other documentation showing the use of automated intrusion detection systems to ensure the organization being inspected/assessed implements automated mechanisms to initiate response actions defined in PE-6 (2), CCI 2945  to classes/types of intrusions defined in PE-6 (2), CCI 2943.'),\n('002945','draft','2013-08-27','DISA FSO','policy','The organization defines response actions to initiate when organization-defined classes/types of intrusions are recognized.','PE-6(2).4','The organization being inspected/assessed defines and documents response actions to initiate when organization-defined classes/types of intrusions are recognized.  DoD has determined the response actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented response actions to ensure the organization being inspected/assessed defines response actions to initiate when organization-defined classes/types of intrusions are recognized.  DoD has determined the response actions are not appropriate to define at the Enterprise level.'),\n('002946','draft','2013-08-27','DISA FSO','policy','The organization employs video surveillance of organization-defined operational areas.','PE-6(3).1','The organization being inspected/assessed documents and implements video surveillance of operational areas defined in PE-6 (3), CCI 2947.','The organization conducting the inspection/assessment obtains and examines the documentation of video surveillance a sampling of recorded video surveillance to ensure the organization being inspected/assessed employs video surveillance of operational areas defined in PE-6 (3), CCI 2947.'),\n('002947','draft','2013-08-27','DISA FSO','policy','The organization defines the operational areas in which to employ video surveillance.','PE-6(3).2','The organization being inspected/assessed defines and documents the operational areas to employ video surveillance.  DoD has determined the operational areas are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented operational areas to ensure the organization being inspected/assessed defines the operational areas to employ video surveillance.  DoD has determined the operational areas are not appropriate to define at the Enterprise level.'),\n('002948','draft','2013-08-27','DISA FSO','policy','The organization retains video surveillance recordings for an organization-defined time period.','PE-6(3).3','The organization being inspected/assessed documents and implements a process to  retain video surveillance recordings for at a minimum 90 days.  DoD has defined the time period as at a minimum 90 days.','The organization conducting the inspection/assessment obtains and examines the documented process and a sampling of recordings from within 90 days to ensure the organization being inspected/assessed retains video surveillance recordings for at a minimum 90 days.  DoD has defined the time period as at a minimum 90 days.'),\n('002949','draft','2013-08-27','DISA FSO','policy','The organization defines the time period to retain video surveillance recordings.','PE-6(3).4','DoD has defined the time period as at a minimum 90 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as at a minimum 90 days.'),\n('002950','draft','2013-08-27','DISA FSO','policy','The organization monitors physical access to the information system in addition to the physical access monitoring of the facility as organization-defined physical spaces containing one or more components of the information system.','PE-6(4).1','The organization being inspected/assessed documents and implements a process to monitor physical access to the information system in addition to the physical access monitoring of the facility as physical spaces containing one or more components of the information system defined in PE-6 (4), CCI 2951.  The organization must maintain records of monitoring.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the records of monitoring to ensure the organization being inspected/assessed monitors physical access to the information system in addition to the physical access monitoring of the facility as physical spaces containing one or more components of the information system defined in PE-6 (4), CCI 2951.'),\n('002951','draft','2013-08-27','DISA FSO','policy','The organization defines physical spaces containing one or more components of the information system in which physical access is monitored.','PE-6(4).2','The organization being inspected/assessed defines and documents physical spaces containing one or more components of the information system in which physical access is monitored.  DoD has determined the physical spaces are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented physical spaces to ensure the organization being inspected/assessed defines  physical spaces containing one or more components of the information system in which physical access is monitored.  DoD has determined the physical spaces are not appropriate to define at the Enterprise level.'),\n('002952','draft','2013-08-27','DISA FSO','policy','The organization defines the time period to maintain visitor access records to the facility where the information system resides.','PE-8.2','DoD has defined the time period as at least one year.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as at least one year.'),\n('002953','draft','2013-08-27','DISA FSO','policy','The organization employs redundant power cabling paths that are physically separated by an organization-defined distance.','PE-9(1).1','The organization being inspected/assessed employs redundant power cabling paths that are physically separated by the distance defined in PE-9 (1), CCI 2954.','The organization conducting the inspection/assessment obtains and examines cabling diagrams or, if unavailable, inspects power cabling configuration to ensure the organization being inspected/assessed employs redundant power cabling paths that are physically separated by the distance defined in PE-9 (1), CCI 2954.'),\n('002954','draft','2013-08-27','DISA FSO','policy','The organization defines the distance by which to physically separate redundant power cabling paths.','PE-9(1).2','The organization being inspected/assessed defines and documents the distance to physically separate redundant power cabling paths.  DoD has determined the distance is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented distance to ensure the organization being inspected/assessed defines  the distance to physically separate redundant power cabling paths.  DoD has determined the distance is not appropriate to define at the Enterprise level.'),\n('002955','draft','2013-08-29','DISA FSO','policy','The organization provides a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system and/or transition of the information system to long-term alternate power in the event of a primary power source loss.','PE-11.1','The organization being inspected/assessed implements an uninterruptible power supply with sufficient capacity to support orderly shutdown of the system or transition the system to long-term alternate power in the event of a primary power source loss.','The organization conducting the inspection/assessment obtains and examines documentation identifying the capacity of the implemented uninterruptible power supply, documentation identifying the power requirements of the system, and documentation identifying the contingency plan in the event of primary power source loss to ensure the organization being inspected/assessed provides uninterruptible power supply with sufficient capacity to support orderly shutdown of the system or transition the system to long-term alternate power in the event of a primary power source loss.'),\n('002956','draft','2013-08-29','DISA FSO','policy','The organization provides a long-term alternate power supply for the information system that is self-contained.','PE-11(2).1','The organization being inspected/assessed implements a long-term alternate power supply for the information system that is self-contained.','The organization conducting the inspection/assessment obtains and examines documentation identifying the implemented alternate power supply to ensure the organization being inspected/assessed implements a long-term alternate power supply for the information system that is self-contained.'),\n('002957','draft','2013-08-29','DISA FSO','policy','The organization provides a long-term alternate power supply for the information system that is not reliant on external power generation.','PE-11(2).2','The organization being inspected/assessed implements a long-term alternate power supply for the information system that is not reliant on external power generation.','The organization conducting the inspection/assessment obtains and examines documentation identifying the implemented alternate power supply to ensure the organization being inspected/assessed implements a  long-term alternate power supply for the information system that is not reliant on external power generation.'),\n('002958','draft','2013-08-29','DISA FSO','policy','The organization provides a long-term alternate power supply for the information system that is capable of maintaining minimally required operational capability or full operational capability in the event of an extended loss of the primary power source.','PE-11(2).3','The organization being inspected/assessed implements a long-term alternate power supply for the information system that is capable of maintaining minimally required operational capability or full operational capability in the event of an extended loss of the primary power source.','The organization conducting the inspection/assessment obtains and examines documentation identifying the implemented alternate power supply to ensure the organization being inspected/assessed implements a long-term alternate power supply for the information system that is capable of maintaining minimally required operational capability or full operational capability in the event of an extended loss of the primary power source.'),\n('002959','draft','2013-08-29','DISA FSO','policy','The organization provides emergency lighting for all areas within the facility supporting essential missions.','PE-12(1).1','The organization being inspected/assessed implements emergency lighting for all areas within the facility supporting essential missions.','The organization conducting the inspection/assessment inspects areas within the facility supporting essential missions to ensure emergency lighting is implemented.'),\n('002960','draft','2013-08-29','DISA FSO','policy','The organization provides emergency lighting for all areas within the facility supporting essential business functions.','PE-12(1).2','The organization being inspected/assessed implements emergency lighting for all areas within the facility supporting essential business functions.','The organization conducting the inspection/assessment inspects areas within the facility supporting essential business functions to ensure emergency lighting is implemented.'),\n('002961','draft','2013-08-29','DISA FSO','policy','The organization employs fire detection devices/systems for the information system that activate automatically.','PE-13(1).1','The organization being inspected/assessed documents and implements fire detection devices/systems for the information system that activate automatically.','The organization conducting the inspection/assessment obtains and examines the documented evidence of fire detection devices/systems to ensure the organization being inspected/assessed employs fire detection devices/systems for the information system that activate automatically.'),\n('002962','draft','2013-08-29','DISA FSO','policy','The organization employs fire detection devices/systems for the information system that automatically activate to notify organization-defined personnel or roles and organization-defined emergency responders in the event of a fire.','PE-13(1).2','The organization being inspected/assessed documents and implements fire detection devices/systems for the information system that automatically activate to notify personnel or roles defined in PE-13 (1), CCI 2963 and emergency responders defined in PE-13 (1), CCI 2964 in the event of a fire.','The organization conducting the inspection/assessment obtains and examines the documented evidence of fire detection devices/systems to ensure the organization being inspected/assessed employs fire detection devices/systems for the information system that automatically activate to notify personnel or roles defined in PE-13 (1), CCI 2963 and emergency responders defined in PE-13 (1), CCI 2964 in the event of a fire.'),\n('002963','draft','2013-08-29','DISA FSO','policy','The organization defines the personnel or roles to be notified in the event of a fire.','PE-13(1).3','The organization being inspected/assessed defines and documents the personnel or roles to be notified in the event of a fire.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles to be notified in the event of a fire.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.'),\n('002964','draft','2013-08-29','DISA FSO','policy','The organization defines the emergency responders to be notified in the event of a fire.','PE-13(1).4','The organization being inspected/assessed defines and documents the emergency responders to be notified in the event of a fire.  DoD has determined the emergency responders are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented emergency responders to ensure the organization being inspected/assessed defines the emergency responders to be notified in the event of a fire.  DoD has determined the emergency responders are not appropriate to define at the Enterprise level.'),\n('002965','draft','2013-08-29','DISA FSO','policy','The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation to organization-defined personnel or roles and organization-defined emergency responders.','PE-13(2).1','The organization being inspected/assessed documents and implements fire suppression devices/systems for the information system that provide automatic notification of any activation to organization-defined personnel or roles and organization defined emergency responders.','The organization conducting the inspection/assessment obtains and examines the documented evidence of fire detection devices/systems to ensure the organization being inspected/assessed employs fire suppression devices/systems for the information system that provide automatic notification of any activation to organization-defined personnel or roles and organization defined emergency responders.'),\n('002966','draft','2013-08-29','DISA FSO','policy','The organization defines the personnel or roles to be automatically notified of any activation of fire suppression devices/systems for the information system.','PE-13(2).2','The organization being inspected/assessed defines and documents the personnel or roles to be automatically notified of any activation of fire suppression devices/systems for the information system.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles to be automatically notified of any activation of fire suppression devices/systems for the information system.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.'),\n('002967','draft','2013-08-29','DISA FSO','policy','The organization defines the emergency responders to be automatically notified of any activation of fire suppression devices/systems for the information system.','PE-13(2).3','The organization being inspected/assessed defines and documents the emergency responders to be automatically notified of any activation of fire suppression devices/systems for the information system.  DoD has determined the emergency responders are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented emergency responders to ensure the organization being inspected/assessed defines the emergency responders to be automatically notified of any activation of fire suppression devices/systems for the information system.  DoD has determined the emergency responders are not appropriate to define at the Enterprise level.'),\n('002968','draft','2013-08-29','DISA FSO','policy','The organization ensures that the facility undergoes, on an organization-defined frequency, fire protection inspections by authorized and qualified inspectors.','PE-13(4).1','The organization being inspected/assessed implements a process to undergo fire protection inspections by authorized and qualified inspectors annually.  The organization must maintain a record of inspections.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines the record of inspections to ensure the organization being inspected/assessed implements a process to undergo fire protection inspections by authorized and qualified inspectors annually.   DoD has defined the frequency as annually.'),\n('002969','draft','2013-08-29','DISA FSO','policy','The organization defines a frequency with which the facility undergoes fire protection inspections.','PE-13(4).2','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('002970','draft','2013-08-29','DISA FSO','policy','The organization resolves deficiencies identified during facility fire protection inspections within an organization-defined time period.','PE-13(4).3','The organization being inspected/assessed resolves deficiencies identified during facility fire protection inspections within 60 days.  DoD has defined the time period as 60 days.','The organization conducting the inspection/assessment obtains and examines past facility fire protection inspection reports and inspects the facility to ensure all deficiencies identified are resolved in 60 days.  DoD has defined the time period as 60 days.'),\n('002971','draft','2013-08-29','DISA FSO','policy','The organization defines the time period within which to resolve deficiencies identified during facility fire protection inspections.','PE-13(4).4','DoD has defined the time period as 60 days.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as 60 days.'),\n('002972','draft','2013-08-29','DISA FSO','policy','The organization employs automated mechanisms to detect the presence of water in the vicinity of the information system and alerts organization-defined personnel or roles.','PE-15(1).1','The organization being inspected/assessed documents and implements automated mechanisms to detect the presence of water in the vicinity of the information system and alerts personnel or roles defined in PE-15 (1), CCI 2973.','The organization conducting the inspection/assessment obtains and examines documentation identifying water detection mechanisms to ensure the organization being inspected/assessed  implements automated mechanisms to detect the presence of water in the vicinity of the information system and alerts personnel or roles defined in PE-15 (1), CCI 2973.'),\n('002973','draft','2013-08-29','DISA FSO','policy','The organization defines the personnel or roles to be alerted when automated mechanisms detect the presence of water in the vicinity of the information system.','PE-15(1).2','The organization being inspected/assessed defines and documents the personnel or roles to be alerted when automated mechanisms detect the presence of water in the vicinity of the information system.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles to be alerted when automated mechanisms detect the presence of water in the vicinity of the information system.  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.'),\n('002974','draft','2013-08-29','DISA FSO','policy','The organization defines types of information system components to authorize, monitor, and control entering and exiting the facility and to maintain records.','PE-16.5','DoD has defined the types of information system components as all system components.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the types of information system components as all system components.'),\n('002975','draft','2013-08-29','DISA FSO','policy','The organization defines security controls to employ at alternate work sites.','PE-17.2','The organization being inspected/assessed defines and documents security controls to employ at alternate work sites, which must include all applicable building and safety codes for the information system\\'s environment   DoD has determined the security controls are not appropriate to define at the Enterprise level, but must include all applicable building and safety codes for the information system\\'s environment.','The organization conducting the inspection/assessment obtains and examines the documented security controls to ensure the organization being inspected/assessed defines security controls to employ at alternate work sites, which must include all applicable building and safety codes for the information system\\'s environment.  DoD has determined the security controls are not appropriate to define at the Enterprise level,  but must include all applicable building and safety codes for the information system\\'s environment.'),\n('002976','draft','2013-08-29','DISA FSO','policy','The organization defines physical and environmental hazards that could cause potential damage to information system components within the facility.','PE-18.3','The organization being inspected/assessed defines and documents physical and environmental hazards that could cause potential damage to information system components within the facility.  DoD has determined the physical and environmental hazards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented physical and environmental hazards to ensure the organization being inspected/assessed defines physical and environmental hazards that could cause potential damage to information system components within the facility.  DoD has determined the physical and environmental hazards are not appropriate to define at the Enterprise level.'),\n('002977','draft','2013-08-29','DISA FSO','policy','The organization plans the location or site of the facility where the information system resides with regard to physical and environmental hazards.','PE-18(1).1','The organization being inspected/assessed  plans the location or site of the facility where the information system resides with regard to physical and environmental hazards.  The organization must document the rationale for planning the location or site of the facility.','The organization conducting the inspection/assessment obtains and examines the documented rationale to ensure the organization being inspected/assessed plans the location or site of the facility where the information system resides with regard to physical and environmental hazards.'),\n('002978','draft','2013-08-29','DISA FSO','policy','The organization considers the physical and environmental hazards in its risk mitigation strategy for existing facilities.','PE-18(1).2','The organization being inspected/assessed considers the physical and environmental hazards in its risk mitigation strategy for existing facilities.  The organization must document the risk assessment.','The organization conducting the inspection/assessment obtains and examines the physical and environmental risk assessment to ensure the organization being inspected/assessed considers the physical and environmental hazards in its risk mitigation strategy for existing facilities.'),\n('002979','draft','2013-08-29','DISA FSO','policy','The organization employs organization-defined asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.','PE-20.1','The organization being inspected/assessed implements asset location technologies defined in PE-20, CCI 2980 to track and monitor the location and movement of assets defined in PE-20, CCI 2981 within controlled areas defined in PE-20, CCI 2982.','The organization conducting the inspection/assessment obtains and examines documentation reflecting asset location technologies in use to ensure the organization being inspected/assessed implements asset location technologies defined in PE-20, CCI 2980 to track and monitor the location and movement of assets defined in PE-20, CCI 2981 within controlled areas defined in PE-20, CCI 2982.'),\n('002980','draft','2013-08-29','DISA FSO','policy','The organization defines asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.','PE-20.2','The organization being inspected/assessed defines and documents asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.  DoD has determined the asset location technologies are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented asset location technologies to ensure the organization being inspected/assessed defines asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.  DoD has determined the asset location technologies are not appropriate to define at the Enterprise level.'),\n('002981','draft','2013-08-29','DISA FSO','policy','The organization defines the assets within the organization-defined controlled areas which are to be tracked and monitored for their location and movement.','PE-20.3','The organization being inspected/assessed defines and documents the assets within the organization-defined controlled areas which are to be tracked and monitored for their location and movement.   DoD has determined the assets are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented assets to ensure the organization being inspected/assessed defines the assets within the organization-defined controlled areas which are to be tracked and monitored for their location and movement.   DoD has determined the assets are not appropriate to define at the Enterprise level.'),\n('002982','draft','2013-08-29','DISA FSO','policy','The organization defines controlled areas where the location and movement of organization-defined assets are tracked and monitored.','PE-20.4','The organization being inspected/assessed defines and documents controlled areas that the location and movement of organization-defined assets are tracked and monitored.  DoD has determined the controlled areas are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented controlled areas to ensure the organization being inspected/assessed defines  controlled areas that the location and movement of organization-defined assets are tracked and monitored.  DoD has determined the controlled areas are not appropriate to define at the Enterprise level.'),\n('002983','draft','2013-08-29','DISA FSO','policy','The organization ensures that asset location technologies are employed in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance.','PE-20.5','The organization being inspected/assessed identifies and documents any  federal laws, Executive Orders, directives, regulations, policies, standards,  and guidance applicable to the asset location technologies in use. In particular, the organization identifies any requirements to protect the privacy of personnel transporting assets being tracked. The organization  documents a process to meet the applicable requirements in their documentation of asset tracking technologies (PE-20, CCI 2980).','The organization conducting the inspection/assessment obtains and examines the documented list of any federal laws, Executive Orders, directives, regulations, policies, standards, and guidance applicable to the asset location technologies in use, as well as the documentation of asset tracking technologies per PE-20, CCI 2980, to ensure that the organization being inspected/assessed identifies any requirements (particularly privacy requirements) applicable to the asset tracking methodologies in use, and to  ensure that the organization implements a process to meet those identified requirements.'),\n('002984','draft','2013-08-29','DISA FSO','policy','The organization develops an organization-wide information security program plan that reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical).','PM-1.5','DoDI 8500.01 and the Knowledge Service meet the requirement for this CCI; individual organizations and system owners must provide documentation of common control implementation in their Security Plan.','DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.'),\n('002985','draft','2013-08-29','DISA FSO','policy','The organization disseminates an organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements.','PM-1.2','DoD disseminates DoDI 8500.01 organization-wide via the DoD Issuances website (http://www.dtic.mil/whs/directives/corres/dir.html) and the Knowledge Service is available via: https://rmfks.osd.mil.\\n\\nDoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.','DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.'),\n('002986','draft','2013-08-29','DISA FSO','policy','The organization disseminates an organization-wide information security program plan that includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','PM-1.3','DoD disseminates DoDI 8500.01 organization-wide via the DoD Issuances website (http://www.dtic.mil/whs/directives/corres/dir.html) and the Knowledge Service is available via: https://rmfks.osd.mil.\\n\\nDoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.','DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.'),\n('002987','draft','2013-08-29','DISA FSO','policy','The organization disseminates an organization-wide information security program plan that reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical).','PM-1.6','DoD disseminates DoDI 8500.01 organization-wide via the DoD Issuances website (http://www.dtic.mil/whs/directives/corres/dir.html) and the Knowledge Service is available via: https://rmfks.osd.mil.\\n\\nDoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.','DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.'),\n('002988','draft','2013-08-29','DISA FSO','policy','The organization disseminates an organization-wide information security program plan that is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.','PM-1.7','DoD disseminates DoDI 8500.01 organization-wide via the DoD Issuances website (http://www.dtic.mil/whs/directives/corres/dir.html) and the Knowledge Service is available via: https://rmfks.osd.mil.\\n\\nDoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.','DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.'),\n('002989','draft','2013-08-29','DISA FSO','policy','The organization protects the information security program plan from unauthorized disclosure.','PM-1.12','DoD documents and implements methods to protect the information security program plan from unauthorized disclosure by marking, labeling, and handling to prevent unauthorized disclosure.  DoD ensures that all changes to the information security program plan are approved.','DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.'),\n('002990','draft','2013-08-29','DISA FSO','policy','The organization protects the information security program plan from unauthorized modification.','PM-1.13','DoD documents and implements methods to protect the information security program plan from unauthorized disclosure by marking, labeling, and handling to prevent unauthorized modification.  DoD ensures that all changes to the information security program plan are approved.','DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service.  If the organization or system owner is utilizing common controls they must be documented  in their Security Plan.'),\n('002991','draft','2013-08-29','DISA FSO','policy','The organization implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems are developed.','PM-4.2','DoDI 8510.01 and the Knowledge Service meet the DoD requirements to develop a process for plans of action and milestones for the security program.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01 and the Knowledge Service.','DoDI 8510.01 and the Knowledge Service meet the DoD requirements to develop a process for plans of action and milestones for the security program.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01 and the Knowledge Service.'),\n('002992','draft','2013-08-29','DISA FSO','policy','The organization implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems are reported in accordance with OMB FISMA reporting requirements.','PM-4.4','DoDI 8510.01 and the Knowledge Service meet the DoD requirements to implement a process ensuring that the plans of action and milestones for the security program  are reported in accordance with OMB FISMA reporting requirements.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01 and the Knowledge Service.','DoDI 8510.01 and the Knowledge Service meet the DoD requirements to implement a process ensuring that the plans of action and milestones for the security program  are reported in accordance with OMB FISMA reporting requirements.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8510.01 and the Knowledge Service.'),\n('002993','draft','2013-08-29','DISA FSO','policy','The organization reviews plans of action and milestones for the security program and associated organization information systems for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.','PM-4.5','The organization being inspected/assessed documents and implements a process to review plans of action and milestones for the security program and associated organization information systems for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.  The organization must maintain a record of reviews.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews plans of action and milestones for the security program and associated organization information systems for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.'),\n('002994','draft','2013-08-29','DISA FSO','policy','The organization reviews and updates the risk management strategy in accordance with organization-defined frequency or as required, to address organizational changes.','PM-9.3','DoD Risk Management Framework meets the requirement for a comprehensive organizational risk strategy.\\n\\nDoD components are automatically compliant with this CCI because they are covered by the DoD Risk Management Framework (DoDI 8510.01).','DoD Risk Management Framework meets the requirement for a comprehensive organizational risk strategy.\\n\\nDoD components are automatically compliant with this CCI because they are covered by DoD Risk Management Framework (DoDI 8510.01).'),\n('002995','draft','2013-08-29','DISA FSO','policy','The organization defines the frequency with which to review and update the risk management strategy to address organizational changes.','PM-9.4','DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.'),\n('002996','draft','2013-08-29','DISA FSO','policy','The organization implements an insider threat program that includes a cross-discipline insider threat incident handling team.','PM-12.1','The organization being inspected/assessed  documents and implements an insider threat program that includes a cross-discipline insider threat incident handling team.','The organization conducting the inspection/assessment obtains and examines the documented insider threat program to ensure the organization being inspected/assessed implements an insider threat program that includes a cross-discipline insider threat incident handling team.'),\n('002997','draft','2013-08-29','DISA FSO','policy','The organization establishes an information security workforce development and improvement program.','PM-13.1','DoD 8570.01-M, \\\"Information Assurance Workforce Improvement Program\\\" meets the DoD requirement to  establish an information security workforce development and improvement program.\\n\\nDoD components are automatically complaint with this CCI as they are covered at the DoD level, DoDI 8570.01-M.','DoD 8570.01-M meets the DoD requirement to  establish an information security workforce development and improvement program.\\n\\nDoD components are automatically complaint with this CCI as they are covered at the DoD level, DoDI 8570.01-M.'),\n('002998','draft','2013-08-29','DISA FSO','policy','The organization implements a process for ensuring that organizational plans for conducting security testing activities associated with organizational information systems are developed.','PM-14.1','The organization being inspected/assessed documents and implements a process for ensuring that organizational plans for conducting security testing activities associated with organizational information systems are developed.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  implements a process for ensuring that organizational plans for conducting security testing activities associated with organizational information systems are developed.'),\n('002999','draft','2013-08-29','DISA FSO','policy','The organization implements a process for ensuring that organizational plans for conducting security testing activities associated with organizational information systems are maintained.','PM-14.2','The organization being inspected/assessed documents and implements a process for ensuring that organizational plans for conducting security testing activities associated with organizational information systems are maintained.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed   implements a process for ensuring that organizational plans for conducting security testing activities associated with organizational information systems are maintained.'),\n('003000','draft','2013-08-29','DISA FSO','policy','The organization implements a process for ensuring that organizational plans for conducting security training activities associated with organizational information systems are developed.','PM-14.3','The organization being inspected/assessed documents and implements a process for ensuring that organizational plans for conducting security training activities associated with organizational information systems are developed.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed implements a process for ensuring that organizational plans for conducting security training activities associated with organizational information systems are developed.'),\n('003001','draft','2013-08-29','DISA FSO','policy','The organization implements a process for ensuring that organizational plans for conducting security training activities associated with organizational information systems are maintained.','PM-14.4','The organization being inspected/assessed documents and implements a process for ensuring that organizational plans for conducting security training activities associated with organizational information systems are maintained.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed   implements a process for ensuring that organizational plans for conducting security training activities associated with organizational information systems are maintained.'),\n('003002','draft','2013-08-29','DISA FSO','policy','The organization implements a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational information systems are developed.','PM-14.5','The organization being inspected/assessed documents and implements a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational information systems are developed.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  implements a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational information systems are developed.'),\n('003003','draft','2013-08-29','DISA FSO','policy','The organization implements a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational information systems are maintained.','PM-14.6','The organization being inspected/assessed documents and implements a process for conducting security monitoring activities associated with organizational information systems are maintained.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed   implements a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational information systems are maintained.'),\n('003004','draft','2013-08-29','DISA FSO','policy','The organization implements a process for ensuring that organizational plans for conducting security testing associated with organizational information systems continue to be executed in a timely manner.','PM-14.7','The organization being inspected/assessed documents and implements a process for ensuring that organizational plans for conducting security testing associated with organizational information systems continue to be executed in a timely manner.  The organization must maintain records of execution.','The organization conducting the inspection/assessment obtains and examines the documented process as well as records of execution to ensure the organization being inspected/assessed   implements a process for ensuring that organizational plans for conducting security testing associated with organizational information systems continue to be executed in a timely manner.'),\n('003005','draft','2013-08-29','DISA FSO','policy','The organization implements a process for ensuring that organizational plans for conducting security training associated with organizational information systems continue to be executed in a timely manner.','PM-14.8','The organization being inspected/assessed documents and implements a process for ensuring that organizational plans for conducting security training associated with organizational information systems continue to be executed in a timely manner.  The organization must maintain records of execution.','The organization conducting the inspection/assessment obtains and examines the documented process  as well as the records of execution to ensure the organization being inspected/assessed  implements a process for ensuring that organizational plans for conducting security training associated with organizational information systems continue to be executed in a timely manner.'),\n('003006','draft','2013-08-29','DISA FSO','policy','The organization implements a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational information systems continue to be executed in a timely manner.','PM-14.9','The organization being inspected/assessed documents and implements a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational information systems continue to be executed in a timely manner.  The organization must maintain records of execution.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the records of execution to ensure the organization being inspected/assessed  implements a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational information systems continue to be executed in a timely manner.'),\n('003007','draft','2013-08-29','DISA FSO','policy','The organization reviews testing plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.','PM-14.10','The organization being inspected/assessed documents and implements a process to review testing plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.   The organization must maintain a record of reviews.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews testing plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.'),\n('003008','draft','2013-08-29','DISA FSO','policy','The organization reviews training plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.','PM-14.11','The organization being inspected/assessed reviews training plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.   The organization must maintain a record of reviews.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews training plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.'),\n('003009','draft','2013-08-29','DISA FSO','policy','The organization reviews monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.','PM-14.12','The organization being inspected/assessed reviews monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.   The organization must maintain a record of reviews.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.'),\n('003010','draft','2013-08-29','DISA FSO','policy','The organization establishes and institutionalizes contact with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel.','PM-15.1','The organization being inspected/assessed establishes and institutionalizes contact with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel.','The organization conducting the inspection/assessment obtains and examines artifacts showing contact to ensure the organization being inspected/assessed establishes and institutionalizes contact with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel.'),\n('003011','draft','2013-08-29','DISA FSO','policy','The organization establishes and institutionalizes contact with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies.','PM-15.2','The organization being inspected/assessed establishes and institutionalizes contact with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies.','The organization conducting the inspection/assessment obtains and examines artifacts showing contact to ensure the organization being inspected/assessed establishes and institutionalizes contact with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies.'),\n('003012','draft','2013-08-29','DISA FSO','policy','The organization establishes and institutionalizes contact with selected groups and associations within the security community to share current security-related information including threats, vulnerabilities, and incidents.','PM-15.3','The organization being inspected/assessed establishes and institutionalizes contact with selected groups and associations within the security community to share current security-related information including threats, vulnerabilities, and incidents.','The organization conducting the inspection/assessment obtains and examines artifacts showing contact to ensure the organization being inspected/assessed establishes and institutionalizes contact with selected groups and associations within the security community to share current security-related information including threats, vulnerabilities, and incidents.'),\n('003013','draft','2013-08-29','DISA FSO','policy','The organization implements a threat awareness program that includes a cross-organization information-sharing capability.','PM-16.1','The organization being inspected/assessed documents and implements a threat awareness program that includes a cross-organization information-sharing capability.','The organization conducting the inspection/assessment obtains and examines the documented threat awareness program to ensure the organization being inspected/assessed implements a threat awareness program that includes a cross-organization information-sharing capability.'),\n('003014','draft','2013-08-30','DISA FSO','technical','The information system enforces organization-defined mandatory access control policies over all subjects and objects.','AC-3(3).11','The organization being inspected/assessed configures the information system to enforce  mandatory access control policies defined in AC-3 (3), CCI 2153 over all subjects and objects.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 3014.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce  mandatory access control policies defined in AC-3 (3), CCI 2153 over all subjects and objects.  For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 3014.'),\n('003015','draft','2013-08-30','DISA FSO','policy','The mandatory access control policy specifies that organization-defined subjects may explicitly be granted organization-defined privileges such that they are not limited by some or all of the mandatory access control constraints.','AC-3(3).12','The organization being inspected/assessed configures the information system to explicitly grant privileges defined in AC-3 (3), CCI 2162 such that they are not limited by some or all of the mandatory access control constraints.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 3015.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to  explicitly grant privileges defined in AC-3 (3), CCI 2162 such that they are not limited by some or all of the mandatory access control constraints.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 3015.'),\n('003016','draft','2013-09-12','DISA FSO','policy','The organization, upon termination of individual employment, notifies organization-defined personnel or roles within an organization-defined time period.','PS-4.9','The organization being inspected/assessed notifies at a minimum, the ISSO and personnel responsible for revoking credentials immediately or within 24 hours upon termination of individual employment.  The organization must maintain records of termination notification.   DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for revoking credentials.  DoD has defined the time period as immediately or within 24 hours.','The organization conducting the inspection/assessment obtains and examines records of termination notification to ensure the organization being inspected/assessed notifies at a minimum, the ISSO and personnel responsible for revoking credentials immediately or within 24 hours upon termination of individual employment.  DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for revoking credentials.  DoD has defined the time period as immediately or within 24 hours.'),\n('003017','draft','2013-09-12','DISA FSO','policy','The organization defines the personnel or roles to whom a personnel security policy is disseminated.','PS-1.1','DoD has defined the roles as organizational personnel with access control responsibilities.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the roles as organizational personnel with access control responsibilities.'),\n('003018','draft','2013-09-12','DISA FSO','policy','The organization defines the personnel or roles to whom the personnel security procedures are disseminated.','PS-1.2','DoD has defined the roles as organizational personnel with access control responsibilities.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the roles as organizational personnel with access control responsibilities.'),\n('003019','draft','2013-09-12','DISA FSO','policy','The organization ensures that individuals accessing an information system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties.','PS-3(3).1','The organization being inspected/assessed documents and implements a process to ensure that individuals accessing an information system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties.','The organization conducting the inspection/assessment obtains and examines the documented process and a sampling of access authorizations to ensure individuals accessing an information system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties.'),\n('003020','draft','2013-09-12','DISA FSO','policy','The organization ensures that individuals accessing an information system processing, storing, or transmitting information requiring special protection satisfy organization-defined additional personnel screening criteria.','PS-3(3).2','The organization being inspected/assessed documents and implements a process to ensure that individuals accessing an information system processing, storing, or transmitting information requiring special protection satisfy additional personnel screening criteria defined in PS-3 (3), CCI 3021.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed implements a process to ensure that individuals accessing an information system processing, storing, or transmitting information requiring special protection satisfy additional personnel screening criteria defined in PS-3 (3), CCI 3021.'),\n('003021','draft','2013-09-12','DISA FSO','policy','The organization defines additional personnel screening criteria that individuals accessing an information system processing, storing, or transmitting information requiring protection must satisfy.','PS-3(3).3','The organization being inspected/assessed defines and documents additional personnel screening criteria that individuals accessing an information system processing, storing, or transmitting information requiring protection must satisfy.   DoD has determined the additional personnel screening criteria is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented additional personnel screening criteria to ensure the organization being inspected/assessed defines additional personnel screening criteria that individuals accessing an information system processing, storing, or transmitting information requiring protection must satisfy.  DoD has determined the additional personnel screening criteria is not appropriate to define at the Enterprise level.'),\n('003022','draft','2013-09-12','DISA FSO','policy','The organization defines the time period within which to disable information system access upon termination of individual employment.','PS-4.2','DoD has defined the time period as immediately.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as immediately.'),\n('003023','draft','2013-09-12','DISA FSO','policy','The organization, upon termination of individual employment, terminates/revokes any authenticators/credentials associated with the individual.','PS-4.3','The organization being inspected/assessed documents and implements a process to terminate/revoke any authenticators/credentials associated with the individual upon termination of individual employment.  The organization must maintain records of termination/revocation of any authenticators/credentials.','The organization conducting the inspection/assessment obtains and examines the documented process as well as a sampling of records of termination/revocation of any authenticators/credentials to ensure the organization being inspected/assessed terminates/revokes any authenticators/credentials associated with the individual upon termination of individual employment.'),\n('003024','draft','2013-09-12','DISA FSO','policy','The organization defines information security topics to be discussed while conducting exit interviews.','PS-4.5','The organization being inspected/assessed defines and documents information security topics to be discussed while conducting exit interviews.  DoD has determined the information security topics are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information security topics to ensure the organization being inspected/assessed defines information security topics to be discussed while conducting exit interviews.  DoD has determined the information security topics are not appropriate to define at the Enterprise level.'),\n('003025','draft','2013-09-12','DISA FSO','policy','The organization defines personnel or roles to notify upon termination of individual employment.','PS-4.10','DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for revoking credentials.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for revoking credentials.'),\n('003026','draft','2013-09-12','DISA FSO','policy','The organization defines the time period within which to notify organization-defined personnel or roles upon termination of individual employment.','PS-4.11','DoD has defined the time period as immediately or within 24 hours.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as immediately or within 24 hours.'),\n('003027','draft','2013-09-12','DISA FSO','policy','The organization notifies terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information.','PS-4(1).1','The organization being inspected/assessed notifies terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information.  The organization must maintain a record of notifications of post-employment requirements.','The organization conducting the inspection/assessment obtains and examines  the record of notifications of post-employment requirements to ensure the organization being inspected/assessed notifies terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information.'),\n('003028','draft','2013-09-12','DISA FSO','policy','The organization requires terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.','PS-4(1).2','The organization being inspected/assessed documents within their personnel security procedures the requirement for terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.','The organization conducting the inspection/assessment obtains and examines the personnel security procedures and a sampling of signed acknowledgments of post-employment requirements to ensure the organization being inspected/assessed requires terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.'),\n('003029','draft','2013-09-12','DISA FSO','policy','The organization employs automated mechanisms to notify organization-defined personnel or roles upon termination of an individual.','PS-4(2).1','The organization being inspected/assessed implements automated mechanisms to notify  at a minimum, the ISSO and personnel responsible for revoking credentials upon termination of an individual.   DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for revoking credentials.','The organization conducting the inspection/assessment examines the configuration of the automated mechanism and any records of notification sent to ensure the organization being inspected/assessed implements automated mechanisms to notify  at a minimum, the ISSO and personnel responsible for revoking credentials upon termination of an individual.   DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for revoking credentials.'),\n('003030','draft','2013-09-12','DISA FSO','policy','The organization defines the personnel or roles to be notified by automated mechanism upon termination of an individual.','PS-4(2).2','DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for revoking credentials.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for revoking credentials.'),\n('003031','draft','2013-09-12','DISA FSO','policy','The organization modifies access authorization as needed to correspond with any changes in operational need due to reassignment or transfer.','PS-5.5','The organization being inspected/assessed documents and implements a process to modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer.','The organization conducting the inspection/assessment obtains and examines the documented process and a sampling of accounts of users recently transferred or reassigned to ensure the organization being inspected/assessed modifies access authorization as needed to correspond with any changes in operational need due to reassignment or transfer.'),\n('003032','draft','2013-09-12','DISA FSO','policy','The organization notifies organization-defined personnel or roles within an organization-defined time period when individuals are transferred or reassigned to other positions within the organization.','PS-5.6','The organization being inspected/assessed notifies at a minimum, the ISSO and personnel responsible for transferring credentials within 24 hours when individuals are transferred or reassigned to other positions within the organization.  The organization must maintain records of transfer/reassignment notifications.   DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for transferring credentials.  DoD has defined the time period as within 24 hours.','The organization conducting the inspection/assessment obtains and examines records of transfer/reassignment notifications to ensure the organization being inspected/assessed notifies at a minimum, the ISSO and personnel responsible for transferring credentials  within 24 hours when individuals are transferred or reassigned to other positions within the organization.  DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for transferring credentials.  DoD has defined the time period as within 24 hours.'),\n('003033','draft','2013-09-12','DISA FSO','policy','The organization defines personnel or roles to be notified when individuals are transferred or reassigned to other positions within the organization.','PS-5.7','DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for transferring credentials.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for transferring credentials.'),\n('003034','draft','2013-09-12','DISA FSO','policy','The organization defines the time period within which organization-defined personnel or roles are to be notified when individuals are transferred or reassigned to other positions within the organization.','PS-5.8','DoD has defined the time period as immediately.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as immediately.'),\n('003035','draft','2013-09-12','DISA FSO','policy','The organization develops and documents access agreements for organizational information systems.','PS-6.1','The organization being inspected/assessed develops and documents access agreements for organizational information systems.','The organization conducting the inspection/assessment obtains and examines the documented access agreements to ensure the organization being inspected/assessed develops and documents access agreements for organizational information systems.'),\n('003036','draft','2013-09-12','DISA FSO','policy','The organization ensures that individuals requiring access to organizational information and information systems re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency.','PS-6.5','The organization being inspected/assessed requires that individuals re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or when there is a change to the user\\'s level of access.\\n\\nDoD has defined the frequency as when there is a change to the user\\'s level of access.','The organization conducting the inspection/assessment obtains and examines a sampling of re-signed access agreements to ensure the organization being inspected/assessed requires that individuals re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or when there is a change to the user\\'s level of access.\\n\\nDoD has defined the frequency as when there is a change to the user\\'s level of access.'),\n('003037','draft','2013-09-12','DISA FSO','policy','The organization defines the frequency for individuals requiring access to organization information and information systems to re-sign access agreements.','PS-6.6','DoD has defined the frequency as when there is a change to the user\\'s level of access.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as when there is a change to the user\\'s level of access.'),\n('003038','draft','2013-09-12','DISA FSO','policy','The organization notifies individuals of applicable, legally binding post-employment requirements for protection of organizational information.','PS-6(3).1','The organization being inspected/assessed notifies individuals of applicable, legally binding post-employment requirements for protection of organizational information.  The organization must maintain records of notifications of post-employment requirements for protection of organizational information.','The organization conducting the inspection/assessment obtains and examines the records of notifications of post-employment requirements for protection of organizational information to ensure the organization being inspected/assessed notifies individuals of applicable, legally binding post-employment requirements for protection of organizational information.'),\n('003039','draft','2013-09-12','DISA FSO','policy','The organization requires individuals to sign an acknowledgement of legally binding post-employment requirements for protection of organizational information, if applicable, as part of granting initial access to covered information.','PS-6(3).2','The organization being inspected/assessed documents and implements a process to require individuals to sign an acknowledgement of legally binding post-employment requirements for protection of organizational information, if applicable, as part of granting initial access to covered information.','The organization conducting the inspection/assessment obtains and examines the documented process and a sampling of signed acknowledgements to ensure the organization being inspected/assessed requires individuals to sign an acknowledgement of legally binding post-employment requirements for protection of organizational information, if applicable, as part of granting initial access to covered information.'),\n('003040','draft','2013-09-12','DISA FSO','policy','The organization requires third-party providers to comply with personnel security policies and procedures established by the organization.','PS-7.2','The organization being inspected/assessed documents and implements a process to require third-party providers to comply with personnel security policies and procedures established by the organization.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requires third-party providers to comply with personnel security policies and procedures established by the organization.'),\n('003041','draft','2013-09-12','DISA FSO','policy','The organization requires third-party providers to notify organization-defined personnel or roles of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within an organization-defined time period.','PS-7.4','The organization being inspected/assessed documents and implements a process to require third-party providers to notify at a minimum, the ISSO and personnel responsible for transferring credentials of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges immediately.   DoD has defined the personnel or roles as  at a minimum, the ISSO and personnel responsible for transferring credentials.  DoD has defined the time period as immediately.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requires third-party providers to notify  at a minimum, the ISSO and personnel responsible for transferring credentials of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges immediately.   DoD has defined the personnel or roles as  at a minimum, the ISSO and personnel responsible for transferring credentials.  DoD has defined the time period as immediately.'),\n('003042','draft','2013-09-12','DISA FSO','policy','The organization defines personnel or roles whom third-party providers are to notify when third-party personnel who possess organizational credentials and /or badges or who have information system privileges are transferred or terminated.','PS-7.5','DoD has defined the personnel or roles as  at a minimum, the ISSO and personnel responsible for transferring credentials.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as  at a minimum, the ISSO and personnel responsible for transferring credentials.'),\n('003043','draft','2013-09-12','DISA FSO','policy','The organization defines the time period for third-party providers to notify organization-defined personnel or roles when third-party personnel who possess organizational credentials and /or badges or who have information system privileges are transferred or terminated.','PS-7.6','DoD has defined the time period as immediately.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as immediately.'),\n('003044','draft','2013-09-12','DISA FSO','policy','The organization notifies organization-defined personnel or roles within an organization-defined time period when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.','PS-8.3','The organization being inspected/assessed  notifies at a minimum, the ISSO immediately when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.  The organization must maintain records of notifications of employee sanctions.  DoD has defined the personnel or roles as at a minimum, the ISSO.   DoD has defined the time period as immediately.','The organization conducting the inspection/assessment obtains and examines the records of notifications of employee sanctions to ensure the organization being inspected/assessed notifies at a minimum, the ISSO immediately when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.  DoD has defined the personnel or roles as at a minimum, the ISSO.   DoD has defined the time period as immediately.'),\n('003045','draft','2013-09-12','DISA FSO','policy','The organization defines personnel or roles who are to be notified when a formal employee sanctions process is initiated.','PS-8.4','DoD has defined the personnel or roles as at a minimum, the ISSO.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSO.'),\n('003046','draft','2013-09-12','DISA FSO','policy','The organization defines the time period within which to notify organization-defined personnel or roles when a formal employee sanctions process is initiated.','PS-8.2','DoD has defined the time period as immediately.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the time period as immediately.'),\n('003047','draft','2013-09-23','DISA FSO','policy','The organization defines the personnel or roles to whom a security planning policy is disseminated.','PL-1.1','DoD has defined the roles as all organizational personnel with planning responsibilities or information security responsibilities.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the roles as all personnel  organizational personnel with planning responsibilities or information security responsibilities.'),\n('003048','draft','2013-09-23','DISA FSO','policy','The organization defines the personnel or roles to whom the security planning procedures are disseminated.','PL-1.2','DoD has defined the roles as all organizational personnel with planning responsibilities or information security responsibilities.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the roles as all organizational personnel with planning responsibilities or information security responsibilities.'),\n('003049','draft','2013-09-23','DISA FSO','policy','The organization develops a security plan for the information system.','PL-2.1','The organization being inspected/assessed develops and documents a security plan for the information system.','The organization conducting the inspection/assessment obtains and examines the documented security plan to ensure the organization being inspected/assessed  develops a security plan for the information system.'),\n('003050','draft','2013-09-23','DISA FSO','policy','The organization^s security plan for the information system is consistent with the organization^s enterprise architecture.','PL-2.2','The organization being inspected/assessed defines a security plan for the information system which is consistent with the organization\\'s enterprise architecture.','The organization conducting the inspection/assessment obtains and examines the security plan and the enterprise architecture to ensure the organization\\'s security plan for the information system is consistent with the organization\\'s enterprise architecture.'),\n('003051','draft','2013-09-23','DISA FSO','policy','The organization^s security plan for the information system explicitly defines the authorization boundary for the system.','PL-2.3','The organization being inspected/assessed explicitly defines within the security plan the authorization boundary for the system.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed explicitly defines within the security plan the authorization boundary for the system.'),\n('003052','draft','2013-09-23','DISA FSO','policy','The organization^s security plan for the information system describes the operational context of the information system in terms of missions and business processes.','PL-2.4','The organization being inspected/assessed  describes within the security plan the operational context of the information system in terms of missions and business processes.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed describes within the security plan the operational context of the information system in terms of missions and business processes.'),\n('003053','draft','2013-09-23','DISA FSO','policy','The organization^s security plan for the information system provides the security categorization of the information system, including supporting rationale.','PL-2.5','The organization being inspected/assessed defines within the security plan the security categorization of the information system including supporting rationale.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed defines within the security plan the security categorization of the information system including supporting rationale.'),\n('003054','draft','2013-09-23','DISA FSO','policy','The organization^s security plan for the information system describes the operational environment for the information system and relationships with, or connections to, other information systems.','PL-2.6','The organization being inspected/assessed describes within the security plan the operational environment for the information system and relationships with or connections to other information systems.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed describes within the security plan the operational environment for the information system and relationships with or connections to other information systems.'),\n('003055','draft','2013-09-23','DISA FSO','policy','The organization^s security plan for the information system provides an overview of the security requirements for the system.','PL-2.7','The organization being inspected/assessed documents within the security plan, an overview of the security requirements for the system.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed their security plan for the information system provides an overview of the security requirements for the system'),\n('003056','draft','2013-09-23','DISA FSO','policy','The organization^s security plan for the information system identifies any relevant overlays, if applicable.','PL-2.8','The organization being inspected/assessed identifies within the security plan any relevant overlays, if applicable.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed identifies within the security plan any relevant overlays, if applicable.'),\n('003057','draft','2013-09-23','DISA FSO','policy','The organization^s security plan for the information system describes the security controls in place or planned for meeting those requirements, including a rationale for the tailoring decisions.','PL-2.9','The organization being inspected/assessed describes within the security plan the security controls in place or planned for meeting those requirements including a rationale for the tailoring and supplementation decisions.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed describes within the security plan the security controls in place or planned for meeting those requirements including a rationale for the tailoring and supplementation decisions.'),\n('003058','deprecated','2013-09-23','DISA FSO','policy','The organization distributes copies of the security plan to organization-defined personnel or roles.',NULL,NULL,NULL),\n('003059','draft','2013-09-23','DISA FSO','policy','The organization distributes copies of the security plan to organization-defined personnel or roles.','PL-2.11','The organization being inspected/assessed distributes copies of the security plan to, at a minimum, the ISSO, ISSM and SCA via the organization\\'s information sharing portal.  DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA.','The organization conducting the inspection/assessment obtains and examines the security plan via the organization\\'s information sharing portal to ensure the organization being inspected/assessed distributes copies of the security plan to  at a minimum, the ISSO, ISSM and SCA via the organization\\'s information sharing portal.  DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA.'),\n('003060','draft','2013-09-23','DISA FSO','policy','The organization defines the personnel or roles to whom copies of the security plan are distributed.','PL-2.12','DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA.'),\n('003061','draft','2013-09-23','DISA FSO','policy','The organization communicates subsequent changes to the security plan to organization-defined personnel or roles.','PL-2.13','The organization being inspected/assessed distributes changes to the security plan to, at a minimum, the ISSO, ISSM and SCA via the organization\\'s information sharing portal.   DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA.','The organization conducting the inspection/assessment examines the organization\\'s information sharing portal to ensure at a minimum, the ISSO, ISSM and SCA have been provided changes to the security plan.  DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA.'),\n('003062','draft','2013-09-23','DISA FSO','policy','The organization defines the personnel or roles to whom changes to the security plan are communicated.','PL-2.14','DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA.'),\n('003063','draft','2013-09-23','DISA FSO','policy','The organization protects the security plan from unauthorized disclosure.','PL-2.18','The organization being inspected/assessed documents and implements a process to protect the security plan from unauthorized disclosure.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  protects the security plan from unauthorized disclosure.'),\n('003064','draft','2013-09-23','DISA FSO','policy','The organization protects the security plan from unauthorized modification.','PL-2.19','The organization being inspected/assessed documents and implements a process to protect the security plan from unauthorized modification.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  protects the security plan from unauthorized modification.'),\n('003065','draft','2013-09-23','DISA FSO','policy','The organization plans and coordinates security-related activities affecting the information system with organization-defined individuals or groups before conducting such activities in order to reduce the impact on other organizational entities.','PL-2(3).1','The organization being inspected/assessed defines and documents within the security plan, the planning and coordination of security-related activities affecting the information system with individuals or groups defined in PL-2 (3), CCI 3067 before conducting such activities in order to reduce the impact on other organizational entities.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed plans and coordinates of security-related activities affecting the information system with individuals or groups defined in PL-2 (3), CCI 3067 before conducting such activities in order to reduce the impact on other organizational entities.'),\n('003066','deprecated','2013-09-23','DISA FSO','policy','The organization defines the individuals or groups with whom security-related activities are planned and coordinated.',NULL,NULL,NULL),\n('003067','draft','2013-09-23','DISA FSO','policy','The organization defines the individuals or groups with whom security-related activities are planned and coordinated.','PL-2(3).2','The organization being inspected/assessed defines and documents the individuals or groups with whom security-related activities are planned and coordinated.  DoD has determined the individuals or groups are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented individuals or groups to ensure the organization being inspected/assessed defines the individuals or groups with whom security-related activities are planned and coordinated.  DoD has determined the individuals or groups are not appropriate to define at the Enterprise level.'),\n('003068','draft','2013-09-23','DISA FSO','policy','The organization reviews and updates the rules of behavior in accordance with organization-defined frequency.','PL-4.4','The organization being inspected/assessed reviews and updates the rules of behavior annually.  The organization must maintain an audit trail of reviews and updates.  DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the rules of behavior annually.  DoD has defined the frequency as annually.'),\n('003069','draft','2013-09-23','DISA FSO','policy','The organization defines the frequency with which to review and update the rules of behavior.','PL-4.5','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('003070','draft','2013-09-23','DISA FSO','policy','The organization requires individuals who have signed a previous version of the rules of behavior to read and resign when the rules of behavior are revised/updated.','PL-4.6','The organization being inspected/assessed documents and implements a process to require individuals who have signed a previous version of the rules of behavior to read and resign when the rules of behavior are revised/updated.  The signed acknowledgment portion of this control may be satisfied by the security awareness training and role-based security training programs conducted by organizations if such training includes rules of behavior.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requires individuals who have signed a previous version of the rules of behavior to read and resign when the rules of behavior are revised/updated.'),\n('003071','draft','2013-09-23','DISA FSO','policy','The organization develops a security Concept of Operations (CONOPS) for the information system containing, at a minimum, how the organization intends to operate the system from the perspective of information security.','PL-7.1','The organization being inspected/assessed develops and documents a security Concept of Operations (CONOPS) for the information system containing at a minimum, how the organization intends to operate the system from the perspective of information security.','The organization conducting the inspection/assessment obtains and examines the security CONOPS to ensure the organization being inspected/assessed  develops a security CONOPS for the information system containing at a minimum, how the organization intends to operate the system from the perspective of information security.'),\n('003072','draft','2013-09-23','DISA FSO','policy','The organization develops an information security architecture for the information system.','PL-8.1','The organization being inspected/assessed develops and documents an information security architecture for the information system.','The organization conducting the inspection/assessment obtains and examines the documented  information security architecture to ensure the organization being inspected/assessed develops an information security architecture for the information system.'),\n('003073','draft','2013-09-23','DISA FSO','policy','The organization^s information security architecture for the information system describes the overall philosophy, requirements, and approach to be taken with regard to protecting the confidentiality, integrity, and availability of organizational information.','PL-8.2','The organization being inspected/assessed describes within the information security architecture for the information system, the overall philosophy, requirements, and approach to be taken with regard to protecting the confidentiality, integrity, and availability of organizational information.','The organization conducting the inspection/assessment obtains and examines the information security architecture to ensure the organization being inspected/assessed describes within the information security architecture for the information system, the overall philosophy, requirements, and approach to be taken with regard to protecting the confidentiality, integrity, and availability of organizational information.'),\n('003074','draft','2013-09-23','DISA FSO','policy','The organization^s information security architecture for the information system describes how the information security architecture is integrated into and supports the enterprise architecture.','PL-8.3','The organization being inspected/assessed describes within the  information security architecture for the information system, how the information security architecture is integrated into and supports the enterprise architecture.','The organization conducting the inspection/assessment obtains and examines the information security architecture to ensure the organization being inspected/assessed describes within the  information security architecture for the information system, how the information security architecture is integrated into and supports the enterprise architecture.'),\n('003075','draft','2013-09-23','DISA FSO','policy','The organization^s information security architecture for the information system describes any information security assumptions about, and dependencies on, external services.','PL-8.4','The organization being inspected/assessed describes within the information security architecture for the information system, any information security assumptions about, and dependencies on, external services.','The organization conducting the inspection/assessment obtains and examines the information security architecture to ensure the organization being inspected/assessed describes within the information security architecture for the information system, any information security assumptions about, and dependencies on, external services.'),\n('003076','draft','2013-09-23','DISA FSO','policy','The organization reviews and updates the information security architecture in accordance with organization-defined frequency to reflect updates in the enterprise architecture.','PL-8.5','The organization being inspected/assessed reviews and updates the information security architecture annually to reflect updates in the enterprise architecture.  The organization must maintain an audit trail of reviews and updates.   DoD has defined the frequency as annually.','The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the information security architecture annually to reflect updates in the enterprise architecture.  DoD has defined the frequency as annually.'),\n('003077','draft','2013-09-23','DISA FSO','policy','The organization defines the frequency with which to review and update the information system architecture.','PL-8.6','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as annually.'),\n('003078','draft','2013-09-23','DISA FSO','policy','The organization ensures that planned information security architecture changes are reflected in the security plan.','PL-8.7','The organization being inspected/assessed includes planned information security architecture changes in the security plan.','The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed includes planned information security architecture changes in the security plan.'),\n('003079','draft','2013-09-23','DISA FSO','policy','The organization ensures that planned information security architecture changes are reflected in the security Concept of Operations (CONOPS).','PL-8.8','The organization being inspected/assessed includes planned information security architecture changes in the security Concept of Operations (CONOPS).','The organization conducting the inspection/assessment obtains and examines security CONOPS to ensure the organization being inspected/assessed includes planned information security architecture changes in the security CONOPS.'),\n('003080','draft','2013-09-23','DISA FSO','policy','The organization ensures that planned information security architecture changes are reflected in organizational procurements/acquisitions.','PL-8.9','The organization being inspected/assessed includes planned information security architecture changes in organizational procurements/acquisitions.','The organization conducting the inspection/assessment obtains and examines a sampling of procurement materials to ensure the organization being inspected/assessed includes planned information security architecture changes in organizational procurements/acquisitions.'),\n('003081','draft','2013-09-23','DISA FSO','policy','The organization designs its security architecture using a defense-in-depth approach that allocates organization-defined security safeguards to organization-defined locations.','PL-8(1).1','The organization being inspected/assessed designs and documents its security architecture using a defense-in-depth approach that allocates security safeguards defined in PL-8 (1), CCI 3083 to locations defined in PL-8 (1), CCI 3085.','The organization conducting the inspection/assessment obtains and examines the security architecture to ensure the organization being inspected/assessed designs  its security architecture using a defense-in-depth approach that allocates security safeguards defined in PL-8 (1), CCI 3083 to locations defined in PL-8 (1), CCI 3085.'),\n('003082','draft','2013-09-23','DISA FSO','policy','The organization designs its security architecture using a defense-in-depth approach that allocates organization-defined security safeguards to organization-defined architectural layers.','PL-8(1).2','The organization being inspected/assessed designs and documents its security architecture using a defense-in-depth approach that allocates security safeguards defined in PL-8 (1), CCI 3084 to architectural layers defined in PL-8 (1), CCI 3086.','The organization conducting the inspection/assessment obtains and examines the security architecture to ensure the organization being inspected/assessed designs its security architecture using a defense-in-depth approach that allocates security safeguards defined in PL-8 (1), CCI 3084 to architectural layers defined in PL-8 (1), CCI 3086.'),\n('003083','draft','2013-09-23','DISA FSO','policy','The organization defines the security safeguards to be allocated to organization-defined locations.','PL-8(1).3','The organization being inspected/assessed defines and documents the security safeguards to be allocated to organization-defined locations.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines the security safeguards to be allocated to organization-defined locations.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('003084','draft','2013-09-23','DISA FSO','policy','The organization defines the security safeguards to be allocated to organization-defined architectural layers.','PL-8(1).4','The organization being inspected/assessed defines and documents the security safeguards to be allocated to organization-defined architectural layers.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines the security safeguards to be allocated to organization-defined architectural layers.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('003085','draft','2013-09-23','DISA FSO','policy','The organization defines the locations to which it allocates organization-defined security safeguards in the security architecture.','PL-8(1).5','The organization being inspected/assessed defines and documents the locations to which it allocates organization-defined security safeguards in the security architecture.  DoD has determined the locations are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented locations to ensure the organization being inspected/assessed defines  the locations to which it allocates organization-defined security safeguards in the security architecture.   DoD has determined the locations are not appropriate to define at the Enterprise level.'),\n('003086','draft','2013-09-23','DISA FSO','policy','The organization defines the architectural layers to which it allocates organization-defined security safeguards in the security architecture.','PL-8(1).6','The organization being inspected/assessed defines and documents the architectural layers to which it allocates organization-defined security safeguards in the security architecture.  DoD has determined the architectural layers are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented architectural layers to ensure the organization being inspected/assessed defines the architectural layers to which it allocates organization-defined security safeguards in the security architecture.  DoD has determined the architectural layers are not appropriate to define at the Enterprise level.'),\n('003087','draft','2013-09-23','DISA FSO','policy','The organization designs its security architecture using a defense-in-depth approach that ensures that the allocated security safeguards operate in a coordinated and mutually reinforcing manner.','PL-8(1).7','The organization being inspected/assessed designs and documents its security architecture using a defense-in-depth approach that ensures that the allocated security safeguards operate in a coordinated and mutually reinforcing manner.','The organization conducting the inspection/assessment obtains and examines security architecture to ensure the organization being inspected/assessed designs its security architecture using a defense-in-depth approach that ensures that the allocated security safeguards operate in a coordinated and mutually reinforcing manner.'),\n('003088','draft','2013-09-23','DISA FSO','policy','The organization requires that organization-defined security safeguards allocated to organization-defined locations and architectural layers be obtained from different suppliers.','PL-8(2).1','The organization being inspected/assessed obtains from different suppliers security safeguards defined in PL-8 (1), CCIs 3083 and 3084 allocated to locations and architectural layers defined in PL-8 (1) CCIs 3085 and 3086.','The organization conducting the inspection/assessment obtains and examines procurement records to ensure that different suppliers are used to procure security safeguards defined in PL-8 (1), CCIs 3083 and 3084 allocated to locations and architectural layers defined in PL-8 (1) CCIs 3085 and 3086.'),\n('003089','draft','2013-09-23','DISA FSO','policy','The organization defines the personnel or roles to whom the system and services acquisition policy is disseminated.','SA-1.1','DoD has defined the personnel or roles as all personnel.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as all personnel.'),\n('003090','draft','2013-09-23','DISA FSO','policy','The organization defines the personnel or roles to whom procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are disseminated.','SA-1.2','DoD has defined the personnel or roles as all personnel.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as all personnel.'),\n('003091','draft','2013-09-23','DISA FSO','policy','The organization determines information security requirements for the information system or information system service in mission/business process planning.','SA-2.1','The organization being inspected/assessed determines and documents information security requirements for the information system or information system service in mission/business process planning.','The organization conducting the inspection/assessment obtains and examines the documented information security requirements to ensure the organization being inspected/assessed determines information security requirements for the information system or information system service in mission/business process planning.'),\n('003092','draft','2013-09-23','DISA FSO','policy','The organization defines a system development life cycle that is used to manage the information system.','SA-3.2','The organization being inspected/assessed defines and documents a system development life cycle that is used to manage the information system.   DoD has determined the system development life cycle is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented system development life cycle to ensure the organization being inspected/assessed defines a system development life cycle that is used to manage the information system.   DoD has determined the system development life cycle is not appropriate to define at the Enterprise level.'),\n('003093','draft','2013-09-23','DISA FSO','policy','The organization integrates the organizational information security risk management process into system development life cycle activities.','SA-3.5','The organization being inspected/assessed documents and implements a process to  integrate the organizational information security risk management process into system development life cycle activities.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed integrates the organizational information security risk management process into system development life cycle activities.'),\n('003094','draft','2013-09-23','DISA FSO','policy','The organization includes the security functional requirements, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.','SA-4.1','The organization being inspected/assessed documents within contracts/agreements for the information system, system component, or information system service,   the security functional requirements, explicitly or by reference, IAW DoDI 8580.1.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed includes the security functional requirements, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs including DoDI 8580.1.'),\n('003095','draft','2013-09-23','DISA FSO','policy','The organization includes the security strength requirements, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.','SA-4.2','The organization being inspected/assessed documents within contracts/agreements for the information system, system component, or information system service,  the security strength requirements, explicitly or by reference, IAW DoDI 8580.1.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed includes the security strength requirements, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs  including DoDI 8580.1.'),\n('003096','draft','2013-09-23','DISA FSO','policy','The organization includes the security assurance requirements, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.','SA-4.3','The organization being inspected/assessed documents within contracts/agreements for the information system, system component, or information system service,  the security assurance requirements, explicitly or by reference, IAW DoDI 8580.1.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed includes the security assurance requirements, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs  including DoDI 8580.1.'),\n('003097','draft','2013-09-23','DISA FSO','policy','The organization includes the security-related documentation requirements, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.','SA-4.4','The organization being inspected/assessed documents within contracts/agreements for the information system, system component, or information system service,  the security-related documentation requirements, explicitly or by reference.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed includes the security-related documentation requirements, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.'),\n('003098','draft','2013-09-23','DISA FSO','policy','The organization includes requirements for protecting security-related documentation, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.','SA-4.5','The organization being inspected/assessed documents within contracts/agreements for the information system, system component, or information system service,  requirements for protecting security-related documentation, explicitly or by reference.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed includes requirements for protecting security-related documentation, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.'),\n('003099','draft','2013-09-23','DISA FSO','policy','The organization includes description of the information system development environment and environment in which the system is intended to operate, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.','SA-4.6','The organization being inspected/assessed documents within contracts/agreements for the information system, system component, or information system service,  a description of the information system development environment and environment in which the system is intended to operate, explicitly or by reference.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed  includes a description of the information system development environment and environment in which the system is intended to operate, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.'),\n('003100','draft','2013-09-23','DISA FSO','policy','The organization includes acceptance criteria, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.','SA-4.7','The organization being inspected/assessed documents within contracts/agreements for the information system, system component, or information system service,  acceptance criteria, explicitly or by reference.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements  to ensure the organization being inspected/assessed includes acceptance criteria, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.'),\n('003101','draft','2013-09-23','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to provide design information for the security controls to be employed that includes security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics, and/or organization-defined design information at an organization-defined level of detail.','SA-4(2).1','The organization being inspected/assessed defines and documents in contracts/agreements, the design information for the security controls that the developer will employ in the information system to include security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics and/or design/information defined in SA-4 (2), CCI 3103 at the level of detail defined in SA-4 (2), CCI 3105.','The organization  conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires the developer of the information system, system component, or information system service to provide design information for the security controls to be employed that includes security-relevant external system interfaces, high-level design, low-level design, source code and/or hardware schematics and/or design/information defined in SA-4 (2), CCI 3103 at the level of detail defined in SA-4 (2), CCI 3105.'),\n('003102','draft','2013-09-23','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to provide implementation information for the security controls to be employed that includes security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics, and/or organization-defined implementation information at an organization-defined level of detail.','SA-4(2).2','The organization being inspected/assessed defines and documents in contracts/agreements, the implementation information for the security controls that the developer will employ in the information system to include security-relevant external system interfaces, high-level design, low-level design, source code and/or hardware schematics and/or implementation information defined in SA-4 (2), CCI 3104 at the level of detail defined in SA-4 (2), CCI 3106.','The organization  conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires the developer of the information system, system component, or information system service to provide implementation information for the security controls to be employed that includes security-relevant external system interfaces, high-level design, low-level design, source code and/or hardware schematics and/or implementation information defined in SA-4 (2), CCI 3104 at the level of detail defined in SA-4 (2), CCI 3106.'),\n('003103','draft','2013-09-23','DISA FSO','policy','The organization defines the design information that the developer of the information system, system component, or information system service is required to provide for the security controls to be employed.','SA-4(2).3','The organization being inspected/assessed defines and documents the design information that the developer of the information system, system component, or information system service is required to provide for the security controls to be employed.  DoD has determined the design information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented design information to ensure the organization being inspected/assessed defines the design information that the developer of the information system, system component, or information system service is required to provide for the security controls to be employed.  DoD has determined the design information is not appropriate to define at the Enterprise level.'),\n('003104','draft','2013-09-23','DISA FSO','policy','The organization defines the implementation information that the developer of the information system, system component, or information system service is required to provide for the security controls to be employed.','SA-4(2).4','The organization being inspected/assessed defines and documents the implementation information that the developer of the information system, system component, or information system service is required to provide for the security controls to be employed.  DoD has determined the implementation information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented implementation information to ensure the organization being inspected/assessed defines the implementation information that the developer of the information system, system component, or information system service is required to provide for the security controls to be employed.  DoD has determined the implementation information is not appropriate to define at the Enterprise level.'),\n('003105','draft','2013-09-23','DISA FSO','policy','The organization defines the level of detail for the design information of the security controls that is required to be provided by the developer of the information system, system component, or information system services.','SA-4(2).5','The organization being inspected/assessed defines and documents the level of detail the design information of the security controls is required to be provided by the developer of the information system, system component, or information system services.  DoD has determined the level of detail is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented level of detail to ensure the organization being inspected/assessed defines  the level of detail the design information of the security controls is required to be provided by the developer of the information system, system component, or information system services.  DoD has determined the level of detail is not appropriate to define at the Enterprise level.'),\n('003106','draft','2013-09-23','DISA FSO','policy','The organization defines the level of detail for the implementation information of the security controls that is required to be provided by the developer of the information system, system component, or information system services.','SA-4(2).6','The organization being inspected/assessed defines and documents the level of detail the implementation information of the security controls is required to be provided by the developer of the information system, system component, or information system services.  DoD has determined the level of detail is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented level of detail to ensure the organization being inspected/assessed defines  the level of detail the implementation information of the security controls is required to be provided by the developer of the information system, system component, or information system services.  DoD has determined the level of detail is not appropriate to define at the Enterprise level.'),\n('003107','draft','2013-09-23','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to demonstrate the use of a system development life cycle that includes organization-defined state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes.','SA-4(3).1','The organization being inspected/assessed defines and documents within  contracts/agreements, a requirement for the developer to demonstrate the use of a system development life cycle that includes the state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes defined in SA-4 (3), CCI 3108.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires the developer of the information system, system component, or information system service to demonstrate the use of a system development life cycle that includes the state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes defined in SA-4 (3), CCI 3108.'),\n('003108','draft','2013-09-23','DISA FSO','policy','The organization defines the state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes that the developer of the information system, system component, or information system service is required to include when demonstrating the use of a system development life cycle.','SA-4(3).2','The organization being inspected/assessed defines and documents within contracts/agreements, the requirement for the developer to provide information regarding the state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed defines the state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes  that the developer of the information system, system component, or information system service needs to include when demonstrating the use of a system development life cycle.'),\n('003109','draft','2013-09-23','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to deliver the system, component, or service with organization-defined security configurations implemented.','SA-4(5).1','The organization being inspected/assessed documents within contracts/agreements, requirements that the developer of the information system, system component, or information system service to deliver the system, component, or service with security configurations identified by the applicable requirements from DoDI 8510.01 and STIGs/SRGs.\\n\\nDoD has defined the security configurations as security configurations identified by the applicable requirements from DoDI 8510.01 and STIGs/SRGs.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires he developer of the information system, system component, or information system service to deliver the system, component, or service with security configurations identified by the applicable requirements from DoDI 8510.01 and STIGs/SRGs.\\n\\nDoD has defined the security configurations as security configurations identified by the applicable requirements from DoDI 8510.01 and STIGs/SRGs.'),\n('003110','draft','2013-09-23','DISA FSO','policy','The organization defines the security configurations required to be implemented when the developer delivers the information system, system component, or information system service.','SA-4(5).2','DoD has defined the security configurations as security configurations identified by the applicable requirements from DoDI 8510.01 and STIGs/SRGs.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the security configurations as security configurations identified by the applicable requirements from DoDI 8510.01 and STIGs/SRGs.'),\n('003111','draft','2013-09-23','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to use the organization-defined security configurations as the default for any subsequent system, component, or service reinstallation or upgrade.','SA-4(5).3','The organization being inspected/assessed documents within contracts/agreements, requirements that the developer of the information system, system component, or information system service to use the applicable requirements from DoDI 8510.01 and STIGs/SRGs as the default for any subsequent system, component, or service reinstallation or upgrade.\\n\\nDoD has defined the security configurations as security configurations identified by the applicable requirements from DoDI 8510.01 and STIGs/SRGs.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires the developer of the information system, system component, or information system service to use the applicable requirements from DoDI 8510.01 and STIGs/SRGs as the default for any subsequent system, component, or service reinstallation or upgrade.\\n\\nDoD has defined the security configurations as security configurations identified by the applicable requirements from DoDI 8510.01 and STIGs/SRGs.'),\n('003112','draft','2013-09-23','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to produce a plan for the continuous monitoring of security control effectiveness that contains an organization-defined level of detail.','SA-4(8).1','The organization being inspected/assessed documents within contracts/agreements, the requirement that the developer of the information system, system component, or information system service produce a plan for the continuous monitoring of security control effectiveness that contains the level of detail defined in SA-4 (8), CCI 3113.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service produce a plan for the continuous monitoring of security control effectiveness that contains the level of detail defined in SA-4 (8), CCI 3113.'),\n('003113','draft','2013-09-23','DISA FSO','policy','The organization defines the level of detail to be contained in the plan for the continuous monitoring of security control effectiveness that the developer of the information system, system component, or information system services is required to produce.','SA-4(8).2','The organization being inspected/assessed defines and documents the level of detail to be contained in the plan for the continuous monitoring of security control effectiveness that the developer of the information system, system component, or information system services is required to produce.  DoD has determined the level of detail is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented level of detail to ensure the organization being inspected/assessed defines  the level of detail to be contained in the plan for the continuous monitoring of security control effectiveness that the developer of the information system, system component, or information system services is required to produce.  DoD has determined the level of detail is not appropriate to define at the Enterprise level.'),\n('003114','draft','2013-09-23','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.','SA-4(9).1','The organization being inspected/assessed documents within contracts/agreements, the requirement that the developer of the information system, system component, or information system service identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.\\n\\nPorts identified shall be assessed and planned for in light of DISA\\'s PPSM requirements.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.'),\n('003115','deprecated','2013-09-23','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.',NULL,NULL,NULL),\n('003116','draft','2013-09-23','DISA FSO','policy','The organization employs only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational information systems.','SA-4(10).1','The organization being inspected/assessed employs DoD approved PKI tokens for identity verification.','The organization conducting the inspection/assessment examines the information system to ensure DoD approved PKI tokens are implemented for identity verification.'),\n('003117','draft','2013-09-23','DISA FSO','policy','The organization centrally manages organization-defined security controls and related processes.','PL-9.1','DoDI 8500.01, DoDI 8510.01, and CNSSI 1253 meet the DoD requirements for centrally managing security controls and related processes.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01 and CNSSI 1253.','DoDI 8500.01, DoDI 8510.01, and CNSSI 1253 meet the DoD requirements for centrally managing security controls and related processes.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01 and CNSSI 1253.'),\n('003118','draft','2013-09-23','DISA FSO','policy','The organization defines security controls and related processes to be centrally managed.','PL-9.2','DoD has defined the security controls and related processes to be centrally managed as CNSSI 1253, DoDI 8510.01, and DoDI 8500.01.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the security controls and related processes to be centrally managed as CNSSI 1253, DoDI 8510.01, and DoDI 8500.01.'),\n('003119','draft','2013-09-23','DISA FSO','policy','The organization employs a technical surveillance countermeasures survey at organization-defined locations on an organization-defined frequency or when organization-defined events or indicators occur.','RA-6.1','The organization being inspected/assessed documents and implements a process to employ a technical surveillance countermeasures survey at locations defined in RA-6, CCI 3120 on a frequency defined in RA-6, CCI 3121 or when events or indicators defined in RA-6, CCI 3122 occur.  The organization must maintain a record of surveys.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of surveys to ensure the organization being inspected/assessed employs a technical surveillance countermeasures survey at locations defined in RA-6, CCI 3120 on a frequency defined in RA-6, CCI 3121 or when events or indicators defined in RA-6, CCI 3122 occur.'),\n('003120','draft','2013-09-23','DISA FSO','policy','The organization defines the locations where technical surveillance countermeasures surveys are to be employed.','RA-6.2','The organization being inspected/assessed defines and documents the locations where technical surveillance countermeasures surveys are to be employed.  DoD has determined the locations are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented locations to ensure the organization being inspected/assessed defines  the locations where technical surveillance countermeasures surveys are to be employed.  DoD has determined the locations are not appropriate to define at the Enterprise level.'),\n('003121','draft','2013-09-23','DISA FSO','policy','The organization defines the frequency on which to employ technical surveillance countermeasures surveys.','RA-6.3','The organization being inspected/assessed defines and documents the frequency on which to employ technical surveillance countermeasures surveys.  DoD has determined the frequency is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed defines  the frequency on which to employ technical surveillance countermeasures surveys.  DoD has determined the frequency is not appropriate to define at the Enterprise level.'),\n('003122','draft','2013-09-23','DISA FSO','policy','The organization defines the events or indicators upon which technical surveillance countermeasures surveys are to be employed.','RA-6.4','The organization being inspected/assessed defines and documents the events or indicators upon which technical surveillance countermeasures surveys are to be employed.  DoD has determined the events or indicators are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented events or indicators to ensure the organization being inspected/assessed defines the events or indicators upon which technical surveillance countermeasures surveys are to be employed.  DoD has determined the events or indicators are not appropriate to define at the Enterprise level.'),\n('003123','draft','2013-09-24','DISA FSO','technical','The information system implements cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.','MA-4(6).2','The organization being inspected/assessed configures the information system to  implement cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.  For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 3123.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.   For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 3123.'),\n('003124','draft','2013-09-30','DISA FSO','policy','The organization obtains administrator documentation for the information system, system component, or information system service that describes secure configuration of the system, component, or service.','SA-5.1','The organization being inspected/assessed documents within contracts/agreements, requirements that the developer provide administrator documentation for the information system, system component or information system service that describe  secure configuration of the system, component, or service.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer provide administrator documentation for the information system, system component or information system service that describe  secure configuration of the system, component, or service.'),\n('003125','draft','2013-09-30','DISA FSO','policy','The organization obtains administrator documentation for the information system, system component, or information system service that describes secure installation of the system, component, or service.','SA-5.2','The organization being inspected/assessed documents within contracts/agreements, requirements that the developer provide administrator documentation for the information system, system component or information system service that describe  secure installation of the system, component, or service.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer provide administrator documentation for the information system, system component or information system service that describe  secure installation of the system, component, or service.'),\n('003126','draft','2013-09-30','DISA FSO','policy','The organization obtains administrator documentation for the information system, system component, or information system service that describes secure operation of the system, component, or service.','SA-5.3','The organization being inspected/assessed documents within contracts/agreements, requirements that the developer provide administrator documentation for the information system, system component or information system service that describe  secure  operation of the system, component, or service.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer provide administrator documentation for the information system, system component or information system service that describe  secure  operation of the system, component, or service.'),\n('003127','draft','2013-09-30','DISA FSO','policy','The organization obtains administrator documentation for the information system, system component, or information system services that describes effective use and maintenance of security functions/mechanisms.','SA-5.4','The organization being inspected/assessed documents within contracts/agreements, requirements that the developer provide administrator documentation for the information system, system component or information system service that describe effective use and maintenance of security functions/mechanisms.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer provide administrator documentation for the information system, system component or information system service that describe effective use and maintenance of security functions/mechanisms.'),\n('003128','draft','2013-09-30','DISA FSO','policy','The organization obtains administrator documentation for the information system, system component, or information system service that describes known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.','SA-5.5','The organization being inspected/assessed documents within contracts/agreements, requirements that the developer provide administrator documentation for the information system, system component or information system service that describe known vulnerabilities regarding configuration and use of administrative (i.e. privileged) functions.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer provide administrator documentation for the information system, system component or information system service that describe known vulnerabilities regarding configuration and use of administrative (i.e. privileged) functions.'),\n('003129','draft','2013-09-30','DISA FSO','policy','The organization obtains user documentation for the information system, system component, or information system service that describes user-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms.','SA-5.6','The organization being inspected/assessed documents within contracts/agreements, requirements that the developer provide user documentation for the information system, system component or information system service that describes user-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer provide user documentation for the information system, system component or information system service that describes user-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms.'),\n('003130','draft','2013-09-30','DISA FSO','policy','The organization obtains user documentation for the information system, system component, or information system service that describes methods for user interaction which enables individuals to use the system, component, or service in a more secure manner.','SA-5.7','The organization being inspected/assessed documents within contracts/agreements, requirements that the developer provide user documentation for the information system, system component or information system service that describes methods for user interaction which enables individuals to use the system, component, or service in a more secure manner.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer provide user documentation for the information system, system component or information system service that describes methods for user interaction which enables individuals to use the system, component, or service in a more secure manner.'),\n('003131','draft','2013-09-30','DISA FSO','policy','The organization obtains user documentation for the information system, system component, or information system service that describes user responsibilities in maintaining the security of the system, component, or service.','SA-5.8','The organization being inspected/assessed documents within contracts/agreements, requirements that the developer provide user documentation for the information system, system component or information system service that describes user responsibilities in maintaining the security of the system, component, or service.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer provide user documentation for the information system, system component or information system service that describes user responsibilities in maintaining the security of the system, component, or service.'),\n('003132','draft','2013-09-30','DISA FSO','policy','The organization takes organization-defined actions in response to attempts to obtain either unavailable or nonexistent documentation for the information system, system component, or information system service.','SA-5.9','The organization being inspected/assessed takes actions defined in SA-5, CCI 3133 in response to attempts to obtain either unavailable or  nonexistent documentation for information system, system component, or information system service.\\n\\nThe organization must maintain a record of actions taken.\\n\\nDoD has determined the actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the record of actions taken to ensure the organization being inspected/assessed takes actions defined in SA-5, CCI 3133 in response to attempts to obtain either unavailable or  nonexistent documentation for information system, system component, or information system service.\\n\\nDoD has determined the actions are not appropriate to define at the Enterprise level.'),\n('003133','draft','2013-09-30','DISA FSO','policy','The organization defines actions to be taken in response to attempts to obtain either unavailable or nonexistent documentation for the information system, system component, or information system service.','SA-5.10','The organization being inspected/assessed defines and documents actions to be taken in response to attempts to obtain either unavailable or  nonexistent documentation for information system, system component, or information system service.\\n\\nDoD has determined the actions are not appropriate to define at the Enterprise level.','The organization conducting inspection/assessment obtains and examines the documented actions to ensure the organization being inspected/assessed defines action to be taken in response to attempts to obtain either unavailable or  nonexistent documentation for information system, system component, or information system service.\\n\\nDoD has determined the actions are not appropriate to define at the Enterprise level.'),\n('003134','draft','2013-09-30','DISA FSO','policy','The organization protects information system, system component, or information system service documentation as required, in accordance with the risk management strategy.','SA-5.12','The organization being inspected/assessed documents and implements processes to store and handle information system, system component, or information system service documentation  as required, in accordance with the risk management strategy.','The organization conducting the inspection/assessment obtains and examines the documented processes to ensure the organization being inspected/assessed stores and handles information system, system component, or information system service documentation  as required, in accordance with the risk management strategy.'),\n('003135','draft','2013-09-30','DISA FSO','policy','The organization distributes information system, system component, or information system service documentation to organization-defined personnel or roles.','SA-5.13','The organization being inspected/assessed distributes information system, system component, or information system service documentation to at a minimum, the ISSO, ISSM, and SCA, via an information sharing capability.  DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM, and SCA.','The organization conducting the inspection/assessment obtains and examines the information system, system component, or information system service documentation via the organization\\'s information sharing capability to ensure the organization being inspected/assessed distributes information system, system component, or information system service documentation to at a minimum, the ISSO, ISSM, and SCA.  DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM, and SCA.'),\n('003136','draft','2013-09-30','DISA FSO','policy','The organization defines the personnel or roles to whom information system, system component, or information system service documentation is to be distributed.','SA-5.14','DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM, and SCA.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM, and SCA.'),\n('003137','draft','2013-09-30','DISA FSO','policy','The organization defines security controls that providers of external information system services employ in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.','SA-9.3','DoD has defined the security controls as security controls defined by CNSSI 1253.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the security controls as security controls defined by CNSSI 1253.'),\n('003138','draft','2013-09-30','DISA FSO','policy','The organization employs organization-defined processes, methods, and techniques to monitor security control compliance by external service providers on an ongoing basis.','SA-9.8','The organization being inspected/assessed  implements the processes, methods, and techniques defined in SA-9, CCI 3139  to monitor security control compliance by external service providers on an ongoing basis.  The organization must maintain records of monitoring.','The organization conducting the inspection/assessment obtains and examines the records of monitoring to ensure the organization being inspected/assessed implements the processes, methods, and techniques defined in SA-9, CCI 3139  to monitor security control compliance by external service providers on an ongoing basis.'),\n('003139','draft','2013-09-30','DISA FSO','policy','The organization defines processes, methods, and techniques to employ to monitor security control compliance by external service providers on an ongoing basis.','SA-9.9','The organization being inspected/assessed defines and documents processes, methods, and techniques to employ to monitor security control compliance by external service providers on an ongoing basis.  DoD has determined the processes, methods, and techniques are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented  processes, methods, and techniques to ensure the organization being inspected/assessed defines processes, methods, and techniques to employ to monitor security control compliance by external service providers on an ongoing basis.'),\n('003140','draft','2013-09-30','DISA FSO','policy','The organization conducts an organizational assessment of risk prior to the acquisition or outsourcing of dedicated information security services.','SA-9(1).1','The organization being inspected/assessed documents and implements a process to conduct an organizational assessment of risk prior to the acquisition or outsourcing of dedicated information security services.  The organization must maintain a record of risk assessment.','The organization conducting the inspection/assessment obtains and examines a  list of acquired or outsourced information security services and the record of risk assessment to ensure the organization being inspected/assessed conducts an organizational assessment of risk prior to the acquisition or outsourcing of dedicated information security services.'),\n('003141','draft','2013-09-30','DISA FSO','policy','The organization ensures that the acquisition or outsourcing of dedicated information security services is approved by organization-defined personnel or roles.','SA-9(1).2','The organization being inspected/assessed  ensures that the acquisition or outsourcing of dedicated information security services is approved by the DoD Component CIO or their delegate(s).  The organization must maintain a record of approvals.  DoD has defined the personnel or roles the DoD Component CIO or their delegate(s).','The organization conducting the inspection/assessment obtains and examines a list of acquired or outsourced information security services as well as the record of approvals to ensure the organization being inspected/assessed ensures that the acquisition or outsourcing of dedicated information security services is approved by the DoD Component CIO or their delegate(s).  DoD has defined the personnel or roles the DoD Component CIO or their delegate(s).'),\n('003142','draft','2013-09-30','DISA FSO','policy','The organization defines the personnel or roles authorized to approve the acquisition or outsourcing of dedicated information security services.','SA-9(1).3','DoD has defined the personnel or roles the DoD Component CIO or their delegate(s).','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles the DoD Component CIO or their delegate(s).'),\n('003143','draft','2013-09-30','DISA FSO','policy','The organization requires providers of organization-defined external information system services to identify the functions, ports, protocols, and other services required for the use of such services.','SA-9(2).1','The organization being inspected/assessed documents within contracts/agreements, the requirement that providers of all external information system services identify the functions, ports, protocols, and other services required for the use of such services.\\n\\nDoD has defined the external information system services as all external information system services.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that providers of all external information system services identify the functions, ports, protocols, and other services required for the use of such services.\\n\\nDoD has defined the external information system services as all external information system services.'),\n('003144','draft','2013-09-30','DISA FSO','policy','The organization defines the external information system services for which the providers are required to identify the functions, ports, protocols, and other services required for the use of such services.','SA-9(2).2','DoD has defined the external information system services as all external information system services.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the external information system services as all external information system services.'),\n('003145','draft','2013-09-30','DISA FSO','policy','The organization establishes trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.','SA-9(3).1','The organization being inspected/assessed establishes trust relationships with external service providers based on security requirements, properties, factors, or conditions defining acceptable trust relationship defined in SA-9 (3), CCI 3148.','The organization conducting the inspection/assessment obtains and examines a list of trust relationships with external service providers to ensure those relationships are established based on security requirements, properties, factors, or conditions defining acceptable trust relationship defined in SA-9 (3), CCI 3148.'),\n('003146','draft','2013-09-30','DISA FSO','policy','The organization documents trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.','SA-9(3).2','The organization being inspected/assessed documents trust relationships with external service providers based on security requirements, properties, factors, or conditions defining acceptable trust relationships defined in SA-9 (3), CCI 3148.','The organization conducting the inspection/assessment obtains and examines the list of trust relationship with external service providers to ensure it is documented.'),\n('003147','draft','2013-09-30','DISA FSO','policy','The organization maintains trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.','SA-9(3).3','The organization being inspected/assessed maintains trust relationships with external service providers based on security requirements, properties, factors, or conditions defining acceptable trust relationships defined in SA-9 (3), CCI 3148.','The organization conducting the inspection/assessment obtains and examines a list of trust relationships with external service providers to ensure those relationships are maintained based on security requirements, properties, factors, or conditions defining acceptable trust relationship defined in SA-9 (3), CCI 3148.'),\n('003148','draft','2013-09-30','DISA FSO','policy','The organization defines security requirements, properties, factors, or conditions defining acceptable trust relationships with external service providers.','SA-9(3).4','The organization being inspected/assessed defines and documents security requirements, properties, factors, or conditions defining acceptable trust relationships with external service providers.  DoD has determined the security requirements, properties, factors, or conditions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security requirements, properties, factors, or conditions to ensure the organization being inspected/assessed defines  security requirements, properties, factors, or conditions defining acceptable trust relationships with external service providers.  DoD has determined the security requirements, properties, factors, or conditions are not appropriate to define at the Enterprise level.'),\n('003149','draft','2013-09-30','DISA FSO','policy','The organization employs organization-defined security safeguards to ensure that the interests of organization-defined external service providers are consistent with and reflect organizational interests.','SA-9(4).1','The organization being inspected/assessed employs the security safeguards defined in SA-9 (4), CCI 3150 to ensure that the interests of all external service providers from whom services are solicited are consistent with and reflect organizational interests.  The organization must maintain records of safeguard review.  DoD has defined the external service providers as all external service providers from whom services are solicited.','The organization conducting the inspection/assessment obtains and examines a list of external service providers as well as records of safeguard review to ensure the organization being inspected/assessed employs the security safeguards defined in SA-9 (4), CCI 3150 to ensure that the interests of all external service providers from whom services are solicited are consistent with and reflect organizational interests.  DoD has defined the external service providers as all external service providers from whom services are solicited.'),\n('003150','draft','2013-09-30','DISA FSO','policy','The organization defines security safeguards to employ to ensure that the interests of organization-defined external service providers are consistent with and reflect organizational interests.','SA-9(4).2','The organization being inspected/assessed defines and documents security safeguards to employ to ensure that the interests of organization-defined external service providers are consistent with and reflect organizational interests.  DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed  defines security safeguards to employ to ensure that the interests of organization-defined external service providers are consistent with and reflect organizational interests. DoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('003151','draft','2013-09-30','DISA FSO','policy','The organization defines external service providers whose interests are consistent with and reflect organizational interests.','SA-9(4).3','DoD has defined the external service providers as all external service providers from whom services are solicited.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the external service providers as all external service providers from whom services are solicited.'),\n('003152','draft','2013-09-30','DISA FSO','policy','The organization restricts the location of information processing, information/data, and/or information system services to organization-defined locations based on organization-defined requirements or conditions.','SA-9(5).1','The organization being inspected/assessed  restricts the location of information processing, information/data, and/or information system services to locations defined in SA-9 (5), CCI 3153 based on requirements or conditions defined in SA-9 (5), CCI 3154.','The organization conducting the inspection/assessment obtains and examines a list of locations of information processing, information/data, and/or information system services to ensure the organization being inspected/assessed restricts the location of information processing, information/data, and/or information system services to locations defined in SA-9 (5), CCI 3153 based on requirements or conditions defined in SA-9 (5), CCI 3154.'),\n('003153','draft','2013-09-30','DISA FSO','policy','The organization defines the locations for which to restrict information processing, information/data, and/or information system services based on organization-defined requirements or conditions.','SA-9(5).2','The organization being inspected/assessed defines and documents the locations to restrict information processing, information/data, and/or information system services based on organization-defined requirements or conditions.\\n\\nDefinitions should take into account regulatory guidelines in place to protect the data being stored or processed.\\n\\nDoD has determined the location is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented locations to ensure the organization being inspected/assessed defines  the locations to restrict information processing, information/data, and/or information system services based on organization-defined requirements or conditions.  DoD has determined the location is not appropriate to define at the Enterprise level.'),\n('003154','draft','2013-09-30','DISA FSO','policy','The organization defines the requirements or conditions on which to base restricting the location of information processing, information/data, and/or information system services to organization-defined locations.','SA-9(5).3','The organization being inspected/assessed defines and documents the requirements or conditions on which to base restricting the location of information processing, information/data, and/or information system services to organization-defined locations.\\n\\nDefinitions should take into account regulatory guidelines in place to protect the data being stored or processed.\\n\\nDoD has determined the requirements or conditions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented requirements or conditions to ensure the organization being inspected/assessed defines the requirements or conditions on which to base restricting the location of information processing, information/data, and/or information system services to organization-defined locations.  DoD has determined the requirements or conditions are not appropriate to define at the Enterprise level.'),\n('003155','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to perform configuration management during system, component, or service design, development, implementation and/or operation.','SA-10.1','The organization being inspected/assessed requires within contracts/agreements that the developer of the information system, system component, or information system service perform configuration management during system, component or service design, development, implementation and/or operation. The configuration management process applies to:\\n1. Documentation developed or used in the lifecycle, including requirements and interface specifications;\\n2. Elements including design libraries;\\n3. Tools including design tools and test tools;\\n4. Technical data including test data; and\\n5. Information on element and system lifecycle processes','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires the developer of the information system, system component, or information system service perform configuration management during system, component or service design, development, implementation and/or operation.'),\n('003156','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to document the integrity of changes to organization-defined configuration items under configuration management.','SA-10.2','The organization being inspected/assessed requires within contracts/agreements that the developer  of the information system, system component, or information system service document the integrity of changes to configuration items under configuration management defined in SA-10, CCI 3159.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer  of the information system, system component, or information system service document the integrity of changes to configuration items under configuration management defined in SA-10, CCI 3159.'),\n('003157','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to manage the integrity of changes to organization-defined configuration items under configuration management.','SA-10.3','The organization being inspected/assessed requires within contracts/agreements the requirement that the developer of the information system, system component, or information system service manage the integrity of changes to  configuration items under configuration management defined in SA-10, CCI 3159.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service manage the integrity of changes to configuration items under configuration management defined in SA-10, CCI 3159.'),\n('003158','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to control the integrity of changes to organization-defined configuration items under configuration management.','SA-10.4','The organization being inspected/assessed requires within contracts/agreements that the developer of the information system, system component, or information system service control the integrity of changes to configuration items under configuration management defined in SA-10, CCI 3159.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service control the integrity of changes to configuration items under configuration management defined in SA-10, CCI 3159.'),\n('003159','draft','2013-09-30','DISA FSO','policy','The organization defines the configuration items under configuration management that require the integrity of changes to be documented, managed and controlled.','SA-10.5','The organization being inspected/assessed defines and documents the configuration items under configuration management that require the integrity of changes to be documented, managed and controlled.  DoD has determined the configuration items are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented configuration items to ensure the organization being inspected/assessed defines the configuration items under configuration management that require the integrity of changes to be documented, managed and controlled.  DoD has determined the configuration items are not appropriate to define at the Enterprise level.'),\n('003160','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to document the potential security impacts of approved changes to the system, component, or service.','SA-10.8','The organization being inspected/assessed requires within contracts/agreements that the developer of the information system, system component, or information system service document the potential security impacts of approved changes to the system, component, or service.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service document the potential security impacts of approved changes to the system, component, or service.'),\n('003161','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to track security flaws within the system, component, or service.','SA-10.9','The organization being inspected/assessed requires within contracts/agreements that the developer of the information system, system component, or information system service track security flaws within the system, component, or service.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service track security flaws within the system, component, or service.'),\n('003162','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to track flaw resolution within the system, component, or service.','SA-10.10','The organization being inspected/assessed requires within contracts/agreements that the developer of the information system, system component, or information system service track flaw resolution within the system, component, or service.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service track flaw resolution within the system, component, or service.'),\n('003163','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to report findings of security flaws and flaw resolution within the system, component, or service to organization-defined personnel.','SA-10.11','The organization being inspected/assessed requires within contracts/agreements that the developer of the information system, system component, or information system service report security flaws and flaw resolution within the system, component, or service findings to at a minimum, the ISSO and ISSM.\\n\\nDoD has defined the personnel as at a minimum, the ISSO and ISSM.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service report security flaws and flaw resolution within the system, component, or service findings to at a minimum, the ISSO and ISSM.\\n\\n DoD has defined the personnel as at a minimum, the ISSO and ISSM.'),\n('003164','draft','2013-09-30','DISA FSO','policy','The organization defines the personnel to whom security flaw findings and flaw resolution within the system, component, or service are reported.','SA-10.12','DoD has defined the personnel as at a minimum, the ISSO and ISSM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel as at a minimum, the ISSO and ISSM.'),\n('003165','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to enable integrity verification of hardware components.','SA-10(3).1','The organization being inspected/assessed documents within contracts/agreements, the requirement that the developer of the information system, system component, or information system service enable integrity verification of hardware components.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service enable integrity verification of hardware components.'),\n('003166','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions.','SA-10(4).1','The organization being inspected/assessed documents within contracts/agreements the requirement that the developer of the information system, system component, or information system service employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions.'),\n('003167','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to employ tools for comparing newly generated versions of software/firmware source code with previous versions.','SA-10(4).2','The organization being inspected/assessed documents within contracts/agreements the requirement that the  developer of the information system, system component, or information system service employ tools for comparing newly generated versions of software/firmware source code with previous versions.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements  to ensure the organization being inspected/assessed requires that the  developer of the information system, system component, or information system service employ tools for comparing newly generated versions of software/firmware source code with previous versions.'),\n('003168','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to employ tools for comparing newly generated versions of object code with previous versions.','SA-10(4).3','The organization being inspected/assessed documents within contracts/agreements the requirement that the  developer of the information system, system component, or information system service employ tools for comparing newly generated versions of object code with previous versions.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the  developer of the information system, system component, or information system service employ tools for comparing newly generated versions of object code with previous versions.'),\n('003169','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to maintain the integrity of the mapping between the master build data (hardware drawings and software/firmware code) describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.','SA-10(5).1','The organization being inspected/assessed documents within contracts/agreements, the requirement that the developer of the information system, system component, or information system service maintain the integrity of the mapping between the master build data (hardware drawings and software/firmware code) describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service maintain the integrity of the mapping between the master build data (hardware drawings and software/firmware code) describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.'),\n('003170','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.','SA-10(6).1','The organization being inspected/assessed documents within contracts/agreements, the requirement that the developer of the information system, system component, or information system service execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.'),\n('003171','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to create a security assessment plan.','SA-11.1','The organization being inspected/assessed requires that the developer create and document a security assessment plan that includes:\\n1. The types of analyses, testing, evaluation, and reviews of software and firmware components;\\n2. The degree of rigor to be applied; and\\n3. The types of artifacts produced during those processes.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  create a security assessment plan.'),\n('003172','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to implement a security assessment plan.','SA-11.2','The organization being inspected/assessed requires that the developer implement the security assessment plan developed in SA-11, CCI 003171.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  implement a security assessment plan.'),\n('003173','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to perform unit, integration, system, and/or regression testing/evaluation at an organization-defined depth and coverage.','SA-11.3','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the developer of the information system, system component, or information system service perform unit, integration, system, and/or regression testing/evaluation at depth and coverage defined in SA-11, CCI 3174.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service perform unit, integration, system, and/or regression testing/evaluation at depth and coverage defined in SA-11, CCI 3174.'),\n('003174','draft','2013-09-30','DISA FSO','policy','The organization defines the depth and coverage at which to perform unit, integration, system, and/or regression testing/evaluation.','SA-11.4','The organization being inspected/assessed defines and documents the depth and coverage  to perform unit, integration, system, and/or regression testing/evaluation. Examples of approaches or tool types that could be required are:\\n1. Approaches such as static analyses, dynamic analyses, binary analysis, or a hybrid of the three approaches; and\\n2. Tools such as web-based application scanners, static analysis tools, binary analyzers.\\n\\nDoD has determined the depth and coverage are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented depth and coverage to ensure the organization being inspected/assessed defines the depth and coverage  to perform unit, integration, system, and/or regression testing/evaluation.  DoD has determined the depth and coverage are not appropriate to define at the Enterprise level.'),\n('003175','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to produce evidence of the execution of the security assessment plan.','SA-11.5','The organization being inspected/assessed requires the developer to produce and provide evidence of the execution of the security assessment plan.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service produce evidence of the execution of the security assessment plan.'),\n('003176','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to produce the results of the security testing/evaluation.','SA-11.6','The organization being inspected/assessed requires the developer to produce and provide results of the security testing/evaluation.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service produce the results of the security testing/evaluation.'),\n('003177','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to implement a verifiable flaw remediation process.','SA-11.7','The organization being inspected/assessed requires the developer to implement a verifiable flaw remediation process.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service implement a verifiable flaw remediation process.'),\n('003178','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to correct flaws identified during security testing/evaluation.','SA-11.8','The organization being inspected/assessed requires the developer to correct flaws identified during security testing/evaluation and to document and provide evidence that the flaws were corrected.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service correct flaws identified during security testing/evaluation and provide evidence.'),\n('003179','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to employ static code analysis tools to identify common flaws.','SA-11(1).1','The organization being inspected/assessed includes the requirement within contracts/agreements that the developer of the information system, system component, or information system service employ static code analysis tools to identify common flaws.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service employ static code analysis tools to identify common flaws.'),\n('003180','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to document the results of static code analysis.','SA-11(1).2','The organization being inspected/assessed requires that the developer of the information system, system component, or information system service document the type of static code analysis that was performed and the results (including defects).','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service document the results of static code analysis.'),\n('003181','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to perform threat and vulnerability analysis.','SA-11(2).1','The organization being inspected/assessed requires the developer to document and perform threat and vulnerability analysis to ensure that design or implementation changes, and resulting vulnerabilities, are accounted for early in the life cycle.\\n\\nThreat analysis may be performed through the use of open source threat information. Vulnerability analyses should be informed by system design documentation and may include static analyses, dynamic analyses, simulations, and penetration testing. The developer must document the type of vulnerability analysis that was performed, the results (including defects) and any follow on actions.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  perform threat and vulnerability analysis.'),\n('003182','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to perform testing/evaluation of the as-built system, component, or service subsequent to threat and vulnerability analysis.','SA-11(2).2','The organization being inspected/assessed requires within contracts/agreements that the developer the information system, system component, or information system service perform testing/evaluation of the as-built system, component, or service based on threat and vulnerability analysis.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  perform testing/evaluation of the as-built system, component, or service subsequent to threat and vulnerability analysis.'),\n('003183','draft','2013-09-30','DISA FSO','policy','The organization requires an independent agent satisfying organization-defined independence criteria to verify the correct implementation of the developer security assessment plan.','SA-11(3).1','The organization being inspected/assessed requires within contracts/agreements that an independent agent satisfying independence criteria defined in SA-11 (3), CCI 3185 verify the correct implementation of the developer security assessment plan.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that an independent agent satisfying independence criteria defined in SA-11 (3), CCI 3185 verify the correct implementation of the developer security assessment plan.'),\n('003184','draft','2013-09-30','DISA FSO','policy','The organization requires an independent agent satisfying organization-defined independence criteria to verify the evidence produced during security testing/evaluation.','SA-11(3).2','The organization being inspected/assessed requires within contracts/agreements that an independent agent satisfying independence criteria defined in SA-11 (3), CCI 3185 verify the evidence produced during security testing/evaluation.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that an independent agent satisfying independence criteria defined in SA-11 (3), CCI 3185 verify the evidence produced during security testing/evaluation.'),\n('003185','draft','2013-09-30','DISA FSO','policy','The organization defines the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer security assessment plan and the evidence produced during security testing/evaluation.','SA-11(3).3','The organization being inspected/assessed defines and documents the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer security assessment plan and the evidence produced during security testing/evaluation.  DoD has determined the independence criteria is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented independence criteria to ensure the organization being inspected/assessed defines the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer security assessment plan and the evidence produced during security testing/evaluation.  DoD has determined the independence criteria is not appropriate to define at the Enterprise level.'),\n('003186','draft','2013-09-30','DISA FSO','policy','The organization ensures that the independent agent either is provided with sufficient information to complete the verification process or has been granted the authority to obtain such information.','SA-11(3).4','The organization being inspected/assessed provides the independent agent with  sufficient information and access/authority to complete the verification process.  The organization must maintain a record of information provided.','The organization conducting the inspection/assessment obtains and examines the record of information provided to ensure the organization being inspected/assessed provides the independent agent with  sufficient information and access/authority to complete the verification process.'),\n('003187','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to perform a manual code review of organization-defined specific code using organization-defined processes, procedures, and/or techniques.','SA-11(4).1','The organization being inspected/assessed requires within contracts/agreements that the developer of the information system, system component, or information system service perform a manual code review of specific code defined in SA-11 (4), CCI 3188 using processes, procedures, and/or techniques defined in SA-11 (4), CCI 3189.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that  the developer of the information system, system component, or information system service perform a manual code review of specific code defined in SA-11 (4), CCI 3188 using processes, procedures, and/or techniques defined in SA-11 (4), CCI 3189.'),\n('003188','draft','2013-09-30','DISA FSO','policy','The organization defines the specific code for which the developer of the information system, system component, or information system service is required to perform a manual code review using organization-defined process, procedures, and/or techniques.','SA-11(4).2','The organization being inspected/assessed defines and documents the specific code that requires the developer of the information system, system component, or information system service to perform a manual code review against using organization-defined process, procedures, and/or techniques.\\n\\nThe defined code shall include:\\n1. random samples; and\\n2. critical software and firmware components of information systems.\\n\\nDoD has determined the specific code is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented specific code to ensure the organization being inspected/assessed defines  the specific code that requires the developer of the information system, system component, or information system service to perform a manual code review against using organization-defined process, procedures, and/or techniques.  DoD has determined the specific code is not appropriate to define at the Enterprise level.'),\n('003189','draft','2013-09-30','DISA FSO','policy','The organization defines the processes, procedures, and/or techniques to be used by the developer of the information system, system component, or information system service to perform a manual code review of organization-defined specific code.','SA-11(4).3','The organization being inspected/assessed requires in contracts/agreements that the developer define and document the processes, procedures, and/or techniques to be used to perform a manual code review of organization-defined specific code.\\n\\nManual code reviews identify weaknesses which are generally unavailable to more automated analytic tools and techniques such as static or dynamic analysis. Manual code reviews should be performed in conjunction with automated testing, such as static or dynamic analysis, to provide greater levels of analysis.\\n\\nDoD has determined the processes, procedures, and/or techniques are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented  processes, procedures, and/or techniques to ensure the organization being inspected/assessed defines the processes, procedures, and/or techniques to be used by the developer of the information system, system component, or information system service to perform a manual code review of organization-defined specific code.  DoD has determined the processes, procedures, and/or techniques are not appropriate to define at the Enterprise level.'),\n('003190','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to perform penetration testing at an organization-defined breadth/depth and with organization-defined constraints.','SA-11(5).1','The organization being inspected/assessed requires within contracts/agreements that the developer of the information system, system component, or information system service perform penetration testing at a breadth/depth defined in SA-11 (5), CCI 3191 and with constraints defined in SA-11 (5), CCI 3192.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that  the developer of the information system, system component, or information system service perform penetration testing at a breadth/depth defined in SA-11 (5), CCI 3191 and with constraints defined in SA-11 (5), CCI 3192.'),\n('003191','draft','2013-09-30','DISA FSO','policy','The organization defines the breadth/depth at which the developer of the information system, system component, or information system service is required to perform penetration testing.','SA-11(5).2','The organization being inspected/assessed defines and documents the breadth/depth the developer of the information system, system component, or information system service is required to perform penetration testing.  DoD has determined the breadth/depth are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented breadth/depth to ensure the organization being inspected/assessed defines the breadth/depth the developer of the information system, system component, or information system service is required to perform penetration testing.  DoD has determined the constraints are not appropriate to define at the Enterprise level.'),\n('003192','draft','2013-09-30','DISA FSO','policy','The organization defines the constraints on penetration testing performed by the developer of the information system, system component, or information system service.','SA-11(5).3','The organization being inspected/assessed defines and documents the constraints on penetration testing performed by developer of the information system, system component, or information system service.\\n\\nPenetration testing should use all available information technology product documentation (e.g., product/system design specifications, source code, and administrator/operator manuals) and can include, for example, white, gray, or black box testing to attempt circumventing security features of the information technology product or system. Penetration testing should be performed:\\n1. by skilled security professionals working in controlled environments to simulate and execute adversary actions; and\\n2. in conjunction with automated and manual code reviews to provide greater levels of analysis than would ordinarily be possible.\\n\\nDoD has determined the constraints are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented constraints to ensure the organization being inspected/assessed defines the constraints on penetration testing performed by developer of the information system, system component, or information system service.  DoD has determined the constraints are not appropriate to define at the Enterprise level.'),\n('003193','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to perform attack surface reviews.','SA-11(6).1','The organization being inspected/assessed requires within contracts/agreements that the developer perform and document attack surface reviews to uncover any accessible areas where weaknesses or deficiencies in the design and functionality of information systems (including the hardware, software, and firmware components) provide opportunities for adversaries to exploit vulnerabilities.\\n\\nAttack surface reviews may include:\\n1. Analyzing both design and implementation changes to information systems;\\n2. Testing the system with debug options off, or making the debug capabilities inaccessible to unauthorized users;\\n3. Mitigating attack vectors generated as a result of the changes. Correction of identified flaws includes, for example, deprecation of unsafe functions; and\\n4. Using configuration documents that describe how to configure OTS elements to limit their functionality or increase their security. These include DISA Security Technical Implementation Guides (STIGs) and NSA Security configuration guides. Perform this as early in the lifecycle as possible, so that unnecessary or dangerous functionality is not depended upon or does not go unnoticed.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that  the developer of the information system, system component, or information system service perform and document attack surface reviews.'),\n('003194','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to verify that the scope of security testing/evaluation provides complete coverage of required security controls at an organization-defined depth of testing/evaluation.','SA-11(7).1','The organization being inspected/assessed requires within contracts/agreements that the developer of the information system, system component, or information system service verify that the scope of security testing/evaluation provides complete coverage of required security controls at the depth of testing/evaluation defined in SA-11 (7), CCI 3195.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that  the developer of the information system, system component, or information system service verify that the scope of security testing/evaluation provides complete coverage of required security controls at the depth of testing/evaluation defined in SA-11 (7), CCI 3195.'),\n('003195','draft','2013-09-30','DISA FSO','policy','The organization defines the depth of testing/evaluation to which the developer of the information system, system component, or information system service is required to verify that the scope of security testing/evaluation provides complete coverage of the required security controls.','SA-11(7).2','The organization being inspected/assessed defines and documents the depth of testing/evaluation to which the developer of the information system, system component, or information system service is required to verify that the scope of security testing/evaluation provides complete coverage of the required security controls.\\n\\n The developer can accomplish scope verification through a variety of analytic techniques that provide an increasing level of assurance corresponding to the degree of formality of the analysis. High levels of assurance can be provided by the use of formal modeling and analysis techniques including theorem provers, model checkers, and correlation between control implementation and corresponding test cases.\\n\\nDoD has determined the depth of testing/evaluation is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented depth of testing/evaluation to ensure the organization being inspected/assessed defines the depth of testing/evaluation to which the developer of the information system, system component, or information system service is required to verify that the scope of security testing/evaluation provides complete coverage of the required security controls.  DoD has determined the depth of testing/evaluation is not appropriate to define at the Enterprise level.'),\n('003196','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to employ dynamic code analysis tools to identify common flaws.','SA-11(8).1','The organization being inspected/assessed requires within contracts/agreements that the developer of the information system, system component, or information system service employ dynamic code analysis tools to identify common flaws.\\n\\nDynamic code analysis tools include fuzz testing, using simulation, and white and black box testing. Dynamic code analysis should be performed in conjunction with static code analysis to provide greater levels of analysis.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that  the developer of the information system, system component, or information system service employ dynamic code analysis tools to identify common flaws.'),\n('003197','draft','2013-09-30','DISA FSO ','policy','The organization requires the developer of the information system, system component, or information system service to document the results of the dynamic code analysis.','SA-11(8).2','The organization being inspected/assessed requires that the developer of the information system, system component, or information system service document the type of dynamic analysis that was performed and the results (including defects).','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that  the developer of the information system, system component, or information system service document the results of the dynamic code analysis.'),\n('003198','draft','2013-09-30','DISA FSO','policy','The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.','SA-12(1).1','The organization being inspected/assessed implements IAW the DoDI 5200.44 \\\"Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN) tailored acquisition strategies, contract tools, and procurement methods defined in SA-12 (1), CCI 3199 as a means to mitigate supply chain risk.\\n\\nThe organization being inspected/assessed must maintain documentation tracing the strategies, tools, and methods implemented to the organization-defined strategies, tools, and methods.','The organization conducting the inspection/assessment obtains and examines documentation tracing the strategies, tools, and methods implemented to the organization-defined strategies, tools, and methods to ensure that the tailored acquisition strategies, contract tools, and procurement methods identified in SA-12 (1), CCI 3199 have been implemented.'),\n('003199','draft','2013-09-30','DISA FSO','policy','The organization defines tailored acquisition strategies, contract tools, and procurement methods to employ for the purchase of the information system, system component, or information system service from suppliers.','SA-12(1).2','The organization being inspected/assessed defines and documents  the tailored acquisition strategies, contract tools, and procurement methods IAW DoDI 5200.44, \\\"Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN).\\\"  Examples include:\\n1. Transferring a portion of the risk to the developer or supplier through the use of contract language and incentives;\\n2. Using contract language that requires the implementation of SCRM throughout the system lifecycle in applicable contracts and other acquisition and assistance instruments (grants, cooperative agreements, Cooperative Research and Development Agreements (CRADAs),and other transactions) examples include:\\na. Language outlined in the Defense Acquisition Guidebook section 13.13. Contracting;\\nb. Language requiring the use of protected mechanisms to deliver elements and data about elements, processes, and delivery mechanisms;\\nc. Language that articulates that requirements flow down supply chain tiers to sub-prime suppliers.\\n3. Incentives for suppliers that:\\na. Implement required security safeguards and SCRM best practices;\\nb. Promote transparency into their organizational processes and security practices;\\nc. Provide additional vetting of the processes and security practices of subordinate suppliers, critical information system components, and services; and\\nd. Implement contract to reduce SC risk down the contract stack.\\n4. Gaining insight into supplier security practices;\\n5. Using contract language and incentives to enable more robust risk management later in the lifecycle;\\n6. Using a centralized intermediary or Blind Buy approaches to acquire element(s) to hide actual usage locations from an untrustworthy supplier or adversary;\\n7. Exercise the authorities provided in section 806 of the 2011 NDAA, through  Public Law 111-383 referenced in the Defense Federal Acquisition Regulation Supplement (DFAR); interim rule part 252.239-7018 Supply Chain Risk.\\n\\nDoD has determined the tailored acquisition strategies, contract tools, and procurement methods are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documentation containing the tailored acquisition strategies, contract tools, and procurement methods to ensure they have been defined IAW DoDI 5200.44, \\\"Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN).\\\"\\n\\nDoD has determined the tailored acquisition strategies, contract tools, and procurement methods are not appropriate to define at the Enterprise level.'),\n('003200','draft','2013-09-30','DISA FSO','policy','The organization conducts a supplier review prior to entering into a contractual agreement to acquire the information system, system component, or information system service.','SA-12(2).1','The organization being inspected/assessed documents and implements a process to conduct a supplier review prior to entering into a contractual agreement to acquire the information system, system component, or information system service.  Examples of items that can be considered in the  review are the suppliers:\\n1. Organization and process certifications;\\n2. Security policies, procedures, and activities across the lifecycle;\\n3. Supply chain and the criteria and methodology for selecting/managing their suppliers/service providers;\\n4. Financials to determine if the supplier is financially stable;\\n5. Foreign Ownership, Control, and Influence;\\n6. Past performance and any documented supply chain incidents;\\n7. Business relationships; and\\n8. Maturity of business processes.\\n\\nThe organization must maintain a record of supplier review.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of supplier review to ensure the organization being inspected/assessed documents and implements a process to conduct a supplier review prior to entering into a contractual agreement to acquire the information system, system component, or information system service.'),\n('003201','draft','2013-09-30','DISA FSO','policy','The organization employs organization-defined security safeguards to limit harm from potential adversaries identifying and targeting the organizational supply chain.','SA-12(5).1','The organization being inspected/assessed employs security safeguards defined in SA-12 (5), CCI 3202 to limit harm from potential adversaries identifying and targeting the organizational supply chain.\\n\\nThe organization must maintain a record of security safeguards employed.','The organization conducting the inspection/assessment obtains and examines the record of security safeguards supplied to ensure the organization being inspected/assessed employs security safeguards defined in SA-12 (5), CCI 3202 to limit harm from potential adversaries identifying and targeting the organizational supply chain.'),\n('003202','draft','2013-09-30','DISA FSO','policy','The organization defines security safeguards to employ to limit harm from potential adversaries identifying and targeting the organizational supply chain.','SA-12(5).2','The organization being inspected/assessed defines and documents security safeguards to employ to limit harm from potential adversaries identifying and targeting the organizational supply chain  IAW DoDI 5200.44.\\n\\nExamples of security safeguards that the organization should consider implementing to limit the harm from potential adversaries targeting the organizational supply chain, are:\\n1. Using trusted physical delivery mechanisms that do not permit access to the element during delivery (ship via a protected carrier, use cleared/official couriers, or a diplomatic pouch);\\n2. Using trusted electronic delivery of products and services (require downloading from approved, verification-enhanced sites);\\n3. Avoiding the purchase of custom configurations, where feasible;\\n4. Using procurement carve outs (i.e., exclusions to commitments or obligations), where feasible;\\n5. Using defensive design approaches;\\n6. Employing system OPSEC principles;\\n7. Employing a diverse set of suppliers;\\n8. Employing approved vendor lists with standing reputations in industry;\\n9. Using a centralized intermediary and Blind Buy approaches to acquire element(s) to hide actual usage locations from an untrustworthy supplier or adversary Employing inventory management policies and processes;\\n10. Using flexible agreements during each acquisition and procurement phase so that it is possible to meet emerging needs or requirements to address supply chain risk without requiring complete revision or re-competition of an acquisition or procurement;\\n11. Using international, national, commercial or government standards to increase potential supply base;\\n12. Limiting the disclosure of information that can become publicly available; and\\n13. Minimizing the time between purchase decisions and required delivery.\\nOrganizations should reference the SCRM Key Practices and Implementation Guide for DoD for additional guidance.\\n\\nDoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The conducting the inspection/assessment obtains and examines the documented security safeguards to ensure they have been defined IAW DoDI 5200.44.\\n\\nDoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('003203','draft','2013-09-30','DISA FSO','policy','The organization conducts an assessment of the information system, system component, or information system service prior to selection, acceptance, or update.','SA-12(7).1','The organization being inspected/assessed or an independent, third-party entity must perform and document assessments that may include static analyses, dynamic analyses, simulations, white, gray, and black box testing, fuzz testing, penetration testing, and ensure that components or services are genuine (e.g., using tags, cryptographic hash verifications, or digital signatures).  Where possible, testing should employ threat profiles based on the threats that the system is likely to face in the operational environment.','The organization conducting the inspection/assessment obtains and examines documented assessment(s) that were conducted by the organization prior to selection, acceptance, or update to ensure that the organization being inspected/assessed is assessing information systems, system components, or information system services prior to selection, acceptance, or update.'),\n('003204','deprecated','2013-09-30','DISA FSO','policy','The organization conducts an assessment of the information system, system component, or information system service prior to selection, acceptance, or update.',NULL,NULL,NULL),\n('003205','draft','2013-09-30','DISA FSO','policy','The organization uses all-source intelligence analysis of suppliers and potential suppliers of the information system, system component, or information system service.','SA-12(8).1','The organization being inspected/assessed documents and implements a process IAW DoDI 5200.44 to use all-source intelligence analysis of suppliers and potential suppliers of the information system, system component, or information system service.\\n\\nAll-source intelligence of suppliers that the organization may use includes:\\n1. Defense Intelligence Agency (DIA) Threat Assessment Center (TAC), the enterprise focal point for supplier threat assessments for the DoD acquisition community risks;\\n2. Other U.S. Government resources including:\\na. Government Industry Data Exchange Program (GIDEP)  Database where government and industry can record issues with suppliers, including counterfeits; and\\nb. System for Award Management (SAM)  Database of companies that are barred from doing business with the US Government.\\n3. Open source and commercial research.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed implements a process IAW DoDI 5200.44 to use all-source intelligence analysis of suppliers and potential suppliers of the information system, system component, or information system service.'),\n('003206','draft','2013-09-30','DISA FSO','policy','The organization employs organization-defined Operations Security (OPSEC) safeguards in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service.','SA-12(9).1','The organization being inspected/assessed implements Operations Security (OPSEC) safeguards defined in SA-12 (9), CCI 3206 to protect supply chain-related information for the information system, system component, or information system service.','The organization conducting the inspection/assessment obtains and examines any applicable artifacts showing the use of OPSEC safeguards to ensure the organization being inspected/assessed implements OPSEC safeguards defined in SA-12 (9), CCI 3206 to protect supply chain-related information for the information system, system component, or information system service.\\n\\nDoD has determined the OPSEC safeguards are not appropriate to define at the Enterprise level.'),\n('003207','deprecated','2013-09-30','DISA FSO','policy','The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.',NULL,NULL,NULL),\n('003208','deprecated','2013-09-30','DISA FSO','policy','The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.',NULL,NULL,NULL),\n('003209','deprecated','2013-09-30','DISA FSO','policy','The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers.',NULL,NULL,NULL),\n('003210','draft','2013-09-30','DISA FSO','policy','The organization defines the Operations Security (OPSEC) safeguards to be employed in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service.','SA-12(9).2','The organization being inspected/assessed defines and documents  Operations Security (OPSEC) safeguards IAW DoDD 5205.02E, DoD Manual 5205.02, and DoDI 5200.44.\\n\\nOPSEC safeguards may include:\\n1. Limiting the disclosure of information needed to design, develop, test, produce, deliver, and support the element  for example, supplier identities, supplier processes, potential suppliers, security requirements, design specifications, testing and evaluation result, and system/component configurations, including the use of direct shipping, blind buys, etc.;\\n2. Extending supply chain awareness, education, and training for suppliers, intermediate users, and end users;\\n3. Extending the range of OPSEC tactics, techniques, and procedures to potential suppliers, contracted suppliers, or sub-prime contractor tier of suppliers; and\\n4. Using centralized support and maintenance services to minimize direct interactions between end users and original suppliers.\\n\\nDoD has determined the OPSEC safeguards are not appropriate to define at the Enterprise level.','The organization being inspected/assessed obtains and examines the documented OPSEC safeguards to ensure they have been defined IAW DoDD 5205.02E, DoD Manual 5205.02, and DoDI 5200.44.\\n\\nDoD has determined the OPSEC safeguards are not appropriate to define at the Enterprise level.'),\n('003211','deprecated','2013-09-30','DISA FSO','policy','The organization defines the Operations Security (OPSEC) safeguards to be employed in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service.',NULL,NULL,NULL),\n('003212','draft','2013-09-30','DISA FSO','policy','The organization employs organization-defined security safeguards to validate that the information system or system component received is genuine and has not been altered.','SA-12(10).1','The organization being inspected/assessed employs security safeguards to validate that the information system or system component received is genuine and has not been altered defined in SA-12 (10), CCI 3213. The organization must maintain a record of information system validation.  The record must identify what safeguards are applied.\\n\\nDoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the record of information system validation to ensure the organization being inspected/assessed employs security safeguards defined in SA-12 (10), CCI 3213 to validate that the information system or system component received is genuine and has not been altered.\\n\\nDoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('003213','draft','2013-09-30','DISA FSO','policy','The organization defines the security safeguards to be employed to validate that the information system or system component received is genuine and has not been altered.','SA-12(10).2','The organization being inspected/assessed defines and documents security safeguards to validate that the information system or system component received is genuine and has not been altered IAW DoDI 5200.44.\\n\\nSecurity safeguards may:\\n1. Examine for:\\na. Evidence of unauthorized tampering/modification, intentional bugging/subversion, or harmful features;\\nb. Indicators of weaknesses such as unexpected size/dimensions, substandard workmanship, mismatched serial number or bar code, altered/ unexpected/ counterfeit trademarks or markings, or XRF (x-ray fluorescence); and\\nc. Newly manufactured (not refurbished) elements and for valid licensing (including support agreements).\\n2. Include:\\na. Acceptance testing;\\nb. Anti-tamper mechanisms (tamper-resistant and tamper-evident packaging, anti-tamper fence);\\nc. Contact angle analysis and chemical surface analysis;\\nd. Encryption (in motion and at rest);\\ne. Watermarking mechanisms;\\nf. Optical/nanotechnology tagging;\\ng. Side-channel analysis;\\nh. Performance and sub-element baseline; and\\ni. Difficult-to-forge marks (such as digital signatures and hologram tags).\\n\\nDoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards  to ensure they have been defined IAW DoDI 5200.44.\\n\\nDoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('003214','draft','2013-09-30','DISA FSO','policy','The organization employs organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing of organization-defined supply chain elements, processes, and actors associated with the information system, system component, or information system service.','SA-12(11).1','The organization being inspected/assessed documents and implements processes to employ organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing of supply chain elements, processes and actors defined in SA-12 (11), CCI 3215 associated with the information system, system component, or information system service.\\n\\nPenetration testing/analysis should be performed:\\n1. On potential system elements before accepting the system;\\n2. As a realistic simulation of the active adversarys known adversary tactics, techniques, procedures (TTPs), and tools; and\\n3. Throughout the lifecycle on physical and logical systems, elements, and processes.','The organization conducting the inspection/assessment obtains and examines the documented processes to ensure the organization being inspected/assessed employs organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing of supply chain elements, processes and actors defined in SA-12 (11), CCI 3215 associated with the information system, system component, or information system service.'),\n('003215','draft','2013-09-30','DISA FSO','policy','The organization defines the supply chain elements, processes, and actors associated with the information system, system component, or information system service for organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing.','SA-12(11).2','The organization being inspected/assessed defines and documents the supply chain elements, processes, and actors associated with the information system, system component, or information system service for organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing.\\n\\nPenetration testing should be performed throughout the lifecycle on physical and logical systems, elements, and processes including:\\n1. Hardware, software, and firmware development processes;\\n2. Shipping/handling procedures;\\n3. Personnel and physical security programs;\\n4. Configuration management tools/measures to maintain provenance; and\\n5. Any other programs, processes, or procedures associated with the production/distribution of supply chain elements.\\n\\nThe elements, processes, and actors must be defined IAW DoDI 5200.44.\\n\\nDoD has determined the elements, processes, and actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented supply chain elements, processes, and actors to ensure the organization being inspected/assessed defines  the supply chain elements, processes, and actors associated with the information system, system component, or information system service for organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing IAW DoDI 5200.44.   DoD has determined the elements, processes, and actions are not appropriate to define at the Enterprise level.'),\n('003216','draft','2013-09-30','DISA FSO','policy','The organization establishes inter-organizational agreements with entities involved in the supply chain for the information system, system component, or information system service.','SA-12(12).1','The organization being inspected/assessed establishes and documents inter-organizational agreements with entities involved in the supply chain for the information system, system component, or information system service.','The organization conducting the inspection/assessment obtains and examines the documented inter-organizational agreements to ensure the organization being inspected/assessed establishes inter-organizational agreements with entities involved in the supply chain for the information system, system component, or information system service.'),\n('003217','draft','2013-09-30','DISA FSO','policy','The organization establishes inter-organizational procedures with entities involved in the supply chain for the information system, system component, or information system service.','SA-12(12).2','The organization being inspected/assessed establishes and documents inter-organizational procedures with entities involved in the supply chain for the information system, system component, or information system service.','The organization conducting the inspection/assessment obtains and examines the documented inter-organizational procedures to ensure the organization being inspected/assessed establishes inter-organizational procedures with entities involved in the supply chain for the information system, system component, or information system service.'),\n('003218','draft','2013-09-30','DISA FSO','policy','The organization employs organization-defined security safeguards to ensure an adequate supply of organization-defined critical information system components.','SA-12(13).1','The organization being inspected/assessed documents and implements a process to employ security safeguards defined in SA-12 (13), CCI  3219 to ensure an adequate supply of critical information system components defined in SA-12 (13), CCI 3220.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed employs security safeguards defined by SA-12 (13), CCI 3219 to ensure an adequate supply of critical information system components defined in SA-12 (13), CCI 3220.'),\n('003219','draft','2013-09-30','DISA FSO','policy','The organization defines the security safeguards to be employed to ensure an adequate supply of organization-defined critical information system components.','SA-12(13).2','The organization being inspected/assessed defines and documents the security safeguards to be employed to ensure an adequate supply of organization-defined critical information system components.\\n\\nThe organization should employ security safeguards for critical materials, production, assembly, testing, packaging, delivery, and sustainment objects and determine what will be needed and when, and how quickly, for system and system element replacements. Safeguards include:\\n1. Storing critical element spares near or with systems so that they can be rapidly replaced;\\n2. Stockpiling of spare components to ensure operation during mission-critical times;\\n3. Using multiple delivery paths and suppliers;\\n4. Having a variety of vetted delivery paths;\\n5. Using trusted and cleared contacts and shipping via a protected carrier (such as using cleared/official couriers, or a diplomatic pouch);\\n6. Proactively manage the life cycle of their products through Diminishing Manufacturing Sources and Material Shortages (DMSMS). This may involve advance purchase and inventory of spare parts while they are widely available and verifiable.\\n\\n DoD has determined the security safeguards are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines the security safeguards to be employed to ensure an adequate supply of organization-defined critical information system components.\\n\\nDoD has determined the security safeguards are not appropriate to define at the Enterprise level.'),\n('003220','draft','2013-09-30','DISA FSO','policy','The organization defines the critical information system components for which organization-defined security safeguards are employed to ensure adequate supply.','SA-12(13).3','The organization being inspected/assessed defines and documents the critical information system components for which organization-defined security safeguards are employed to ensure adequate supply.  DoD has determined the critical information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented critical information system components to ensure the organization being inspected/assessed defines the critical information system components for which organization-defined security safeguards are employed to ensure adequate supply.  DoD has determined the critical information system components are not appropriate to define at the Enterprise level.'),\n('003221','draft','2013-09-30','DISA FSO','policy','The organization establishes unique identification of organization-defined supply chain elements, processes, and actors for the information system, system component, or information system service.','SA-12(14).1','The organization being inspected/assessed establishes and documents unique identification of supply chain elements, processes, and actors defined in SA-12 (14), CCI 3223.','The organization conducting the inspection/assessment obtains and examines the documented unique identification of supply chain elements, processes, and actors to ensure the organization being inspected/assessed establishes unique identification of supply chain elements, processes, and actors defined in SA-12 (14), CCI 3223 for the information system, system component, or information system service.'),\n('003222','draft','2013-09-30','DISA FSO','policy','The organization retains unique identification of organization-defined supply chain elements, processes, and actors for the information system, system component, or information system service.','SA-12(14).2','The organization being inspected/assessed retains previous versions of the unique identification of supply chain elements, processes, and actors documented IAW SA-12 (14), CCI 3221.','The organization conducting the inspection/assessment obtains and examines previous versions of the identification of supply chain elements, processes, and actors documented IAW SA-12 (14), CCI 3221 to ensure the organization being inspected/assessed retains unique identification of supply chain elements, processes, and actors.'),\n('003223','draft','2013-09-30','DISA FSO','policy','The organization defines the supply chain elements, processes, and actors for the information system, system component, or information system service to establish and retain unique identification.','SA-12(14).3','The organization being inspected/assessed defines and documents the supply chain elements, processes, and actors for the information system, system component, or information system service to establish and retain unique identification. The elements, processes, and actors must be defined IAW DoDI 5200.44.\\n\\nThe organization should consider employing:\\n1. Procedures for proposing, evaluating, and justifying relevant changes to system/component provenance for their impact on components, processes, systems, missions, and exposure to supply chain risks;\\n2. Procedures for allocating responsibilities for the creation, maintenance, and monitoring of provenance are documented;\\n3. Methods for tracking relevant purchasing, shipping, receiving, or transfer activities, including records of reviewer signatures for comparison;\\n4. Processes for transferring provenance responsibility for systems or components between organizations across physical and logical boundaries including any approvals required;\\n5. Procedures for tracking and documenting chain of custody of the system or component (Labeling (using serial numbers) and tagging (using radio-frequency identification [RFID] tags); and\\n6. Security reviews for evaluating and vetting key personnel employed by acquirers or suppliers in any capacity (full-time employee, part-time employee, consultant, contractor, subcontractor, vendor, agent, etc.)\\n\\nDoD has determined the elements, processes, and actors are not appropriate to define at the Enterprise level.','The organization  conducting the inspection/assessment obtains and examines the documented elements, processes, and actors to ensure the organization being inspected/assessed defines the supply chain elements, processes, and actors for the information system, system component, or information system service to establish and retain unique identification IAW DoDI 5200.44.   DoD has determined the elements, processes, and actors are not appropriate to define at the Enterprise level.'),\n('003224','draft','2013-09-30','DISA FSO','policy','The organization establishes a process to address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements.','SA-12(15).1','The organization being inspected/assessed documents and implements a process to address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements.\\n\\nThe organization being inspected/assessed will perform follow-on actions to address the weaknesses and deficiencies identified during assessments of supply chain (SC) elements (e.g., penetration testing, audits, verification/validation activities).  Follow on actions may include:\\n1. Performing failure or forensic analysis on elements and processes to determine the cause of failure. Isolate and diagnose the elements of the component that are not performing properly and assess the origin and mechanisms of the failure. Assess the impact of the failure, ways to detect failures, and mitigating actions (including ways to detect failures and preventing future occurrences);\\n2. Initiate a plan to remediate vulnerabilities immediately upon detection which include:\\na. Identifying the weakness associated with the vulnerability;\\nb. Determining the root cause and context; and\\nc. Remediating the vulnerability, depending on the likelihood of its exploitation and the severity of its consequences.\\n3. Coordinating SC incident management activities with other organizations to ensure consistent and effective management of SC risk incidents; and\\n4. Following established procedures for reporting incidents. If no procedure has been established, determine what information should flow in and out, to who, and in what circumstances;\\n5. Establishing and maintain SC risk incident reporting connectivity to local, regional, and national incident management processes where established (e.g., IAVA, CERT/CC, US CERT, FBI, FISMA reporting), and possibly intelligence processes.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed establishes a process to address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements.'),\n('003225','draft','2013-09-30','DISA FSO','policy','The organization describes the trustworthiness required in the organization-defined information system, information system component, or information system service supporting its critical missions/business functions.','SA-13.1','The organization being inspected/assessed documents within its security plan the trustworthiness required in the information system, information system component, or information system service defined in SA-13, CCI 3226 supporting its critical missions/business functions.','The organization  conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed documents within its security plan the trustworthiness required in the information system, information system component, or information system service defined in SA-13, CCI 3226 supporting its critical missions/business functions.'),\n('003226','draft','2013-09-30','DISA FSO','policy','The organization defines the information system, information system component, or information system service supporting its critical missions/business functions in which the trustworthiness must be described.','SA-13.2','The organization being inspected/assessed defines and documents the information system, information system component, or information system service supporting its critical missions/business functions in which the  trustworthiness must be described.  DoD has determined the information system, information system component, or information system service is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented  information system, information system component, or information system service to ensure the organization being inspected/assessed defines  the information system, information system component, or information system service supporting its critical missions/business functions in which the  trustworthiness must be described.   DoD has determined the information system, information system component, or information system service is not appropriate to define at the Enterprise level.'),\n('003227','draft','2013-09-30','DISA FSO','policy','The organization implements an organization-defined assurance overlay to achieve trustworthiness required to support its critical missions/business functions.','SA-13.3','The organization being inspected/assessed implements an assurance overlay defined in SA-13, CCI 3228 to achieve trustworthiness required to support its critical missions/business functions.','The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed implements an assurance overlay defined in SA-13, CCI 3228 to achieve trustworthiness required to support its critical missions/business functions.'),\n('003228','draft','2013-09-30','DISA FSO','policy','The organization defines an assurance overlay to be implemented to achieve trustworthiness required to support its critical missions/business functions.','SA-13.4','The organization being inspected/assessed defines and documents an assurance overlay to be implemented to achieve trustworthiness required to support its critical missions/business functions.  DoD has determined the assurance overlay is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented assurance overlay to ensure the organization being inspected/assessed defines an assurance overlay to be implemented to achieve trustworthiness required to support its critical missions/business functions.  DoD has determined the assurance overlay is not appropriate to define at the Enterprise level.'),\n('003229','draft','2013-09-30','DISA FSO','policy','The organization identifies critical information system components by performing a criticality analysis for organization-defined information systems, information system components, or information system services at organization-defined decision points in the system development life cycle.','SA-14.1','The organization being inspected/assessed identifies and documents critical information system components by performing a criticality analysis for information systems, information system components, or information system services IAW DoDI 5200.44.  Information systems include all DoD Information Technology.\\n\\nCriticality analysis is the primary method by which a program identifies mission-critical functions and associated components. Criticality analysis includes the following iterative steps:\\n1. Identify and group mission threads.\\n2. Decompose the mission threads into their mission-critical functions and assign them criticality levels.\\n3. Map the mission-critical functions to the system architecture and identify the defined system components (hardware, software, and firmware) that implement those functions (i.e., components that are critical to the mission effectiveness of the system or an interfaced network).\\n4. Allocate criticality levels to those components that have been defined.\\n\\nCriticality levels are determined by assessing the relative impact on the systems ability to complete its mission if the function and associated component fails. Level I is total mission failure, Level II is significant/unacceptable degradation, Level III is partial/acceptable, and Level IV is negligible.\\n\\nOnce the program has identified critical components through the criticality analysis, the program systems engineers and SSEs can use the results along with the vulnerability assessment and threat assessment to determine the risk.\\n\\nThe organization should reference the Defense Acquisition Guidebook (DAG) Chapter 13 for more information.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed identifies critical information system components by performing a criticality analysis for information systems, information system components, or information system services IAW DoDI 5200.44.'),\n('003230','draft','2013-09-30','DISA FSO','policy','The organization identifies critical information system functions by performing a criticality analysis for organization-defined information systems, information system components, or information system services at organization-defined decision points in the system development life cycle.','SA-14.2','The organization being inspected/assessed identifies and documents  critical information system functions by performing a criticality analysis for information systems, information system components, or information system services IAW DoDI 5200.44.\\n\\nCriticality analysis is the primary method by which a program identifies mission-critical functions and associated components. Criticality analysis includes the following iterative steps:\\n1. Identify and group mission threads.\\n2. Decompose the mission threads into their mission-critical functions and assign them criticality levels.\\n3. Map the mission-critical functions to the system architecture and identify the defined system components (hardware, software, and firmware) that implement those functions (i.e., components that are critical to the mission effectiveness of the system or an interfaced network).\\n4. Allocate criticality levels to those components that have been defined.\\n\\nCriticality levels are determined by assessing the relative impact on the systems ability to complete its mission if the function and associated component fails. Level I is total mission failure, Level II is significant/unacceptable degradation, Level III is partial/acceptable, and Level IV is negligible.\\n\\nOnce the program has identified critical functions through the criticality analysis, the program systems engineers and SSEs can use the results along with the vulnerability assessment and threat assessment to determine the risk.\\n\\nThe organization should reference the Defense Acquisition Guidebook (DAG) Chapter 13 for more information.','The organization conducting the inspection/assessment obtains and examines the documented information system functions to ensure the organization being inspected/assessed identifies critical information system functions by performing a criticality analysis for information systems, information system components, or information system services IAW DoDI 5200.44.'),\n('003231','draft','2013-09-30','DISA FSO','policy','The organization defines the information systems, information system components, or information system services for which the organization identifies critical information system components and functions for criticality analysis.','SA-14.3','The organization being inspected/assessed defines and documents the information systems, information system components, or information system services for which the organization identifies critical information system components and functions for criticality analysis IAW DoDI 5200.44.\\n\\nThe organization should perform Criticality Analysis to identify and prioritize mission-critical functions and critical components in accordance with the DoDI 5200.44. The criticality analysis allows a program to focus attention (and resources) on the system capabilities, mission-critical functions that matter most. Mission-critical functions are those functions of the system that, if corrupted or disabled, would likely lead to mission failure or degradation. Mission-critical components are primarily the elements of the system (hardware, software, and firmware) that implement critical functions; however, system components that perform defensive functions to protect inherently critical components and other components with unmediated access to inherently critical components, may themselves be mission critical.\\n\\nDoD has determined the decision points are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information systems, information system components, or information system services to ensure they have been defined IAW DoDI 5200.44.\\n\\nDoD has determined the information systems, information system components, or information system services are not appropriate to define at the Enterprise level.'),\n('003232','draft','2013-09-30','DISA FSO','policy','The organization defines the decision points in the system development life cycle at which to perform a criticality analysis to identify critical information system components and functions for organization-defined information systems, information system components, or information system services.','SA-14.4','The organization being inspected/assessed defines and documents  the decision points in the system development life cycle at which to perform a criticality analysis to identify critical information system components and functions for organization-defined information systems, information system components , or information system services IAW DoDI 5200.44 and DoDI 5000.2.\\n\\nCriticality analysis is an iterative process that should be performed whenever an architecture or design is being developed or modified and executed across the acquisition lifecycle, building on growing maturity and updated information,  in preparation for acquisition milestone reviews, and at other points in the acquisition lifecycle as defined by the DoDI 5000.2.\\n\\nA DoD program needs to perform criticality analysis throughout the acquisition life cycle. As a minimum, DoD programs need to perform / update a criticality analysis, along with the threat assessment, vulnerability assessment, risk assessment, cost-benefit trade-off and countermeasure selection, before each technical review.\\n\\nDoD has determined the decision points are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented decision points to ensure they have been defined IAW DoDI 5200.44 and DoDI 5000.2.\\n\\n\\nDoD has determined the decision points are not appropriate to define at the Enterprise level.'),\n('003233','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to follow a documented development process.','SA-15.1','The organization being inspected/assessed requires within contracts/agreements that the developer of the information system, system component, or information system service to follow a documented development process.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires  that the developer of the information system, system component, or information system service to follow a documented development process.'),\n('003234','draft','2013-09-30','DISA FSO','policy','The documented information system, system component, or information system service development process explicitly addresses security requirements.','SA-15.2','The organization being inspected/assessed requires within contracts/agreements that the developer  of the information system, system component, or information system service explicitly addresses security requirements.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer  of the information system, system component, or information system service explicitly addresses security requirements.'),\n('003235','draft','2013-09-30','DISA FSO','policy','The documented information system, system component, or information system service development process identifies the standards used in the development process.','SA-15.3','The organization being inspected/assessed requires within contracts/agreements that the developer  of the information system, system component, or information system service  identifies the standards used in the development process,   for example, programming languages and computer-aided design (CAD) systems.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer  of the information system, system component, or information system service  identifies the standards used in the development process.'),\n('003236','draft','2013-09-30','DISA FSO','policy','The documented information system, system component, or information system service development process identifies the tools used in the development process.','SA-15.4','The organization being inspected/assessed requires within contracts/agreements that the developer  of the information system, system component, or information system service  identifies the tools used in the development process,  for example, programming languages and computer-aided design (CAD) systems.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer  of the information system, system component, or information system service  identifies the tools used in the development process.'),\n('003237','draft','2013-09-30','DISA FSO','policy','The documented information system, system component, or information system service development process documents the specific tool options and tool configurations used in the development process.','SA-15.5','The organization being inspected/assessed requires within contracts/agreements that the developer  of the information system, system component, or information system service documents the specific tool options and tool configurations used in the development process.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer  of the information system, system component, or information system service documents the specific tool options and tool configurations used in the development process.'),\n('003238','draft','2013-09-30','DISA FSO','policy','The documented information system, system component, or information system service development process documents changes to the process and/or tools used in development.','SA-15.6','The organization being inspected/assessed requires within contracts/agreements that the developer  of the information system, system component, or information system service documents changes to the process and/or tools used in development.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer  of the information system, system component, or information system service documents changes to the process and/or tools used in development.'),\n('003239','draft','2013-09-30','DISA FSO','policy','The documented information system, system component, or information system service development process manages changes to the process and/or tools used in development.','SA-15.7','The organization being inspected/assessed requires within contracts/agreements that the developer  of the information system, system component, or information system service document a process to manage changes to the process and/or tools used in development.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer  of the information system, system component, or information system service document a process to manage changes to the process and/or tools used in development.'),\n('003240','draft','2013-09-30','DISA FSO','policy','The documented information system, system component, or information system service development process ensures the integrity of changes to the process and/or tools used in development.','SA-15.8','The organization being inspected/assessed requires within contracts/agreements that the developer  of the information system, system component, or information system service document the integrity of changes to the process and/or tools used in development.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer  of the information system, system component, or information system service document the integrity of changes to the process and/or tools used in development.'),\n('003241','draft','2013-09-30','DISA FSO','policy','The organization reviews the development process in accordance with organization-defined frequency to determine if the development process selected and employed can satisfy organization-defined security requirements.','SA-15.9','The organization being inspected/assessed documents and implements a process to review the development process before first use and annually thereafter to determine if the development process selected and employed can satisfy the security requirements defined in SA-15, CCI 3246.  Reviews of development processes can include, for example, the use of capability maturity model integration (CMMI) to determine the potential effectiveness of such processes.\\n\\nThe organization must maintain a record of reviews.\\n\\nDoD has defined the frequency as before first use and annually thereafter.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews the development process before first use and annually thereafter to determine if the development process selected and employed can satisfy the security requirements defined in SA-15, CCI 3246.  DoD has defined the frequency as before first use and annually thereafter.'),\n('003242','draft','2013-09-30','DISA FSO','policy','The organization reviews the development standards in accordance with organization-defined frequency to determine if the development standards selected and employed can satisfy organization-defined security requirements.','SA-15.10','The organization being inspected/assessed documents and implements a process to review the development standards before first use and annually thereafter to determine if the development standards selected and employed can satisfy the security requirements defined in SA-15, CCI 3246.  The organization must maintain a record of reviews.  DoD has defined the frequency as before first use and annually thereafter.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews the development standards before first use and annually thereafter to determine if the development standards selected and employed can satisfy the security requirements defined in SA-15, CCI 3246.  DoD has defined the frequency as before first use and annually thereafter.'),\n('003243','draft','2013-09-30','DISA FSO','policy','The organization reviews the development tools in accordance with organization-defined frequency to determine if the development tools selected and employed can satisfy organization-defined security requirements.','SA-15.11','The organization being inspected/assessed documents and implements a process to review the development tools before first use and annually thereafter to determine if the development tools selected and employed can satisfy the security requirements defined in SA-15, CCI 3246.  The organization must maintain a record of reviews.  DoD has defined the frequency as before first use and annually thereafter.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews the development tools before first use and annually thereafter to determine if the development tools selected and employed can satisfy the security requirements defined in SA-15, CCI 3246.  DoD has defined the frequency as before first use and annually thereafter.'),\n('003244','draft','2013-09-30','DISA FSO','policy','The organization reviews the development tool options/configurations in accordance with organization-defined frequency to determine if the development tool options/configurations selected and employed can satisfy organization-defined security requirements.','SA-15.12','The organization being inspected/assessed documents and implements a process to review the development tool options/configurations before first use and annually thereafter to determine if the development tool options/configurations selected and employed can satisfy the security requirements defined in SA-15, CCI 3246.  The organization must maintain a record of reviews.  DoD has defined the frequency as before first use and annually thereafter.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews the development tool options/configurations before first use and annually thereafter to determine if the development tool options/configurations selected and employed can satisfy the security requirements defined in SA-15, CCI 3246.  DoD has defined the frequency as before first use and annually thereafter.'),\n('003245','draft','2013-09-30','DISA FSO','policy','The organization defines the frequency on which to review the development process, standards, tools, and tool options/configurations to determine if the process, standards, tools, and tool options/configurations selected and employed can satisfy organization-defined security requirements.','SA-15.13','DoD has defined the frequency as before first use and annually thereafter.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the frequency as before first use and annually thereafter.'),\n('003246','draft','2013-09-30','DISA FSO','policy','The organization defines the security requirements that must be satisfied by conducting a review of the development process, standards, tools, and tool options/configurations.','SA-15.14','The organization being inspected/assessed defines and documents the security requirements that must be satisfied by conducting a review of the development process, standards, tools, and tool options/configurations.  DoD has determined the security requirements are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented security requirements to ensure the organization being inspected/assessed defines the security requirements that must be satisfied by conducting a review of the development process, standards, tools, and tool options/configurations.  DoD has determined the security requirements are not appropriate to define at the Enterprise level.'),\n('003247','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to define quality metrics at the beginning of the development process.','SA-15(1).1','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the developer of the information system, system component, or information system service define quality metrics at the beginning of the development process.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service define quality metrics at the beginning of the development process.'),\n('003248','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to provide evidence of meeting the quality metrics in accordance with organization-defined frequency, organization-defined program review milestones and/or upon delivery.','SA-15(1).2','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the developer of the information system, system component, or information system service provide evidence of meeting the quality metrics in accordance with the frequency defined in SA-15 (1), CCI 3249, at a minimum, program review milestones IAW DoD Memorandum \\\"Document Streamlining - Program Protection Plan (PPP)\\\" and/or upon delivery.\\n\\nDoD has defined the program review milestones as at a minimum, program review milestones IAW DoD Memorandum \\\"Document Streamlining - Program Protection Plan (PPP).\\\"','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service provide evidence of meeting the quality metrics in accordance with the frequency defined in SA-15 (1), CCI 3249, at a minimum, program review milestones IAW DoD Memorandum \\\"Document Streamlining - Program Protection Plan (PPP)\\\" and/or upon delivery.\\n\\nDoD has defined the program review milestones as at a minimum, program review milestones IAW DoD Memorandum \\\"Document Streamlining - Program Protection Plan (PPP).\\\"'),\n('003249','draft','2013-09-30','DISA FSO','policy','The organization defines the frequency on which the developer of the information system, system component, or information system service is required to provide evidence of meeting the quality metrics.','SA-15(1).3','The organization being inspected/assessed defines and documents the frequency that is required by the developer of the information system, system component, or information system service to provide evidence of meeting the quality metrics.  DoD has determined the frequency is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed defines the frequency that is required by the developer of the information system, system component, or information system service to provide evidence of meeting the quality metrics.  DoD has determined the frequency is not appropriate to define at the Enterprise level.'),\n('003250','draft','2013-09-30','DISA FSO','policy','The organization defines the program review milestones at which the developer of the information system, system component, or information system service is required to provide evidence of meeting the quality metrics.','SA-15(1).4','DoD has defined the program review milestones as at a minimum, program review milestones IAW DoD Memorandum \\\"Document Streamlining - Program Protection Plan (PPP).\\\"','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the program review milestones as at a minimum, program review milestones IAW DoD Memorandum \\\"Document Streamlining - Program Protection Plan (PPP).\\\"'),\n('003251','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to select a security tracking tool for use during the development process.','SA-15(2).1','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the developer of the information system, system component, or information system service  select a security tracking tool for use during the development process.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  select a security tracking tool for use during the development process.'),\n('003252','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to employ a security tracking tool for use during the development process.','SA-15(2).2','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the developer of the information system, system component, or information system service employ a security tracking tool for use during the development process.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service employ a security tracking tool for use during the development process.'),\n('003253','draft','2013-09-30','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to perform a criticality analysis at an organization-defined breadth/depth and at organization-defined decision points in the system development life cycle.','SA-15(3).1','The organization being inspected/assessed requires within contracts/agreements that the developer of the information system, system component, or information system service perform a criticality analysis at the breadth/depth IAW DoDI 5200.44.\\n\\nThe organization should develop Request for Proposals (RFPs) and other contract language that require contractors to perform Criticality Analyses (CAs) periodically.  Developer input into criticality analysis provides detailed design documentation for information system components (e.g., functional specifications, high-level designs, low-level designs, and source code/hardware schematics). Criticality Analysis should be conducted in accordance with the DoDI 5200.44 and the DoDI 5000.2.\\n\\nOnce the program has identified critical functions through the criticality analysis, the program systems engineers and SSEs can use the results along with the vulnerability assessment and threat assessment to determine the risk.\\n\\nThe organization should reference the Defense Acquisition Guidebook (DAG) Chapter 13 for more information.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service perform a criticality analysis at the breadth/depth IAW DoDI 5200.44.'),\n('003254','draft','2013-09-30','DISA FSO','policy','The organization defines the breadth/depth at which the developer of the information system, system component, or information system service is required to perform a criticality analysis.','SA-15(3).2','The organization being inspected/assessed defines and documents the breadth/depth the developer of the information system, system component, or information system service is required to perform a criticality analysis IAW DoDI 5200.44.\\n\\nThe criticality analysis allows a program to focus attention (and resources) on the system capabilities, mission-critical functions that matter most. Mission-critical functions are those functions of the system that, if corrupted or disabled, would likely lead to mission failure or degradation. Mission-critical components are primarily the elements of the system (hardware, software, and firmware) that implement critical functions; however, system components that perform defensive functions to protect inherently critical components and other components with unmediated access to inherently critical components, may themselves be mission critical.\\n\\nCriticality analysis is the primary method by which a program identifies mission-critical functions and associated components. Criticality analysis includes the following iterative steps:\\n1. Identify and group mission threads.\\n2. Decompose the mission threads into their mission-critical functions and assign them criticality levels.\\n3. Map the mission-critical functions to the system architecture and identify the defined system components (hardware, software, and firmware) that implement those functions (i.e., components that are critical to the mission effectiveness of the system or an interfaced network).\\n4. Allocate criticality levels to those components that have been defined.\\n\\nCriticality levels are determined by assessing the relative impact on the systems ability to complete its mission if the function and associated component fails. Level I is total mission failure, Level II is significant/unacceptable degradation, Level III is partial/acceptable, and Level IV is negligible.\\n\\nThe organization should reference the Defense Acquisition Guidebook (DAG) Chapter 13 for more information.\\n\\nDoD has determined the breadth/depth are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented breadth/depth to ensure the organization being inspected/assessed defines the breadth/depth the developer of the information system, system component, or information system service is required to perform a criticality analysis IAW DoDI 5200.44.\\n\\nDoD has determined the breadth/depth are not appropriate to define at the Enterprise level.'),\n('003255','draft','2013-09-30','DISA FSO','policy','The organization defines decision points in the system development life cycle at which the developer of the information system, system component, or information system service is required to perform a criticality analysis.','SA-15(3).3','The organization being inspected/assessed defines and documents decision points in the system development life cycle the developer of the information system, system component, or information system service is required to perform a criticality analysis IAW DoDI 5200.44 and DoDI 5000.2.\\n\\nCriticality analysis is an iterative process that should be performed whenever an architecture or design is being developed or modified and executed across the acquisition lifecycle, building on growing maturity and updated information.\\n\\nCriticality analysis is performed throughout the acquisition life cycle.  As a minimum, the developer should support the performing and update a criticality analysis, along with the threat assessment, vulnerability assessment, risk assessment, cost-benefit trade-off and countermeasure selection, before each technical review.','The organization conducting the inspection/assessment obtains and examines the documented decision points to ensure the organization being inspected/assessed defines  decision points in the system development life cycle the developer of the information system, system component, or information system service is required to perform a criticality analysis IAW DoDI 5200.44 and DoDI 5000.2.\\n\\nDoD has determined the decision points are not appropriate to define at the Enterprise level.'),\n('003256','draft','2013-09-30','DISA FSO','policy','The organization requires that developers perform threat modeling for the information system at an organization-defined breadth/depth.','SA-15(4).1','The organization being inspected/assessed requires within contracts/agreements that the developers perform threat modeling for the information system at the breadth/depth defined in SA-15 (4), CCI 3258.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developers perform threat modeling for the information system at the breadth/depth defined in SA-15 (4), CCI 3258.'),\n('003257','draft','2013-09-30','DISA FSO','policy','The organization requires that developers perform a vulnerability analysis for the information system at an organization-defined breadth/depth.','SA-15(4).2','The organization being inspected/assessed requires within contracts/agreements that the developers perform a vulnerability analysis for the information system at the breadth/depth defined in SA-15 (4), CCI 3259  to inform design or implementation changes and resulting vulnerabilities are accounted for during development . Vulnerability analysis should consider a review of system design and may include static analyses, dynamic analyses, simulations, and penetration testing. The developer should document the type of vulnerability analysis that was performed, the results (including defects) and any follow on actions.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developers perform a vulnerability analysis for the information system at the breadth/depth defined in SA-15 (4), CCI 3259.'),\n('003258','draft','2013-09-30','DISA FSO','policy','The organization defines the breadth/depth at which threat modeling for the information system must be performed by developers.','SA-15(4).3','The organization being inspected/assessed requires within contracts/agreements that the developers perform threat modeling for the information system at the breadth/depth defined in SA-15 (4), CCI 3258.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developers perform threat modeling for the information system at the breadth/depth defined in SA-15 (4), CCI 3258.'),\n('003259','draft','2013-09-30','DISA FSO','policy','The organization defines the breadth/depth at which vulnerability analysis for the information system must be performed by developers.','SA-15(4).4','The organization being inspected/assessed requires within contracts/agreements that the developers perform a vulnerability analysis for the information system at the breadth/depth defined in SA-15 (4), CCI 3259  to inform design or implementation changes and resulting vulnerabilities are accounted for during development . Vulnerability analysis should consider a review of system design and may include static analyses, dynamic analyses, simulations, and penetration testing. The developer should document the type of vulnerability analysis that was performed, the results (including defects) and any follow on actions.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developers perform a vulnerability analysis for the information system at the breadth/depth defined in SA-15 (4), CCI 3259.'),\n('003260','draft','2013-09-30','DISA FSO','policy','Threat modeling performed by the developer for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.','SA-15(4).5','The organization being inspected/assessed requires within contracts/agreements  that the developer\\'s threat modeling include the use of  information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels defined in SA-15 (4), CCI 3262.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed  documents within their contracts/agreements, their requirement that the developer\\'s threat modeling include the use of  information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels defined in SA-15 (4), CCI 3262.'),\n('003261','draft','2013-09-30','DISA FSO','policy','Vulnerability analysis performed by the developer for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.','SA-15(4).6','The organization being inspected/assessed requires within contracts/agreements that the developer\\'s vulnerability analysis include the use of  information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels defined in SA-15 (4), CCI 3263. Vulnerability analysis should consider a review of system design and may include static analyses, dynamic analyses, simulations, and penetration testing. The developer should document the type of vulnerability analysis that was performed, the results (including defects) and any follow on actions.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed  documents within their contracts/agreements, their requirement that the developer\\'s vulnerability analysis include the use of  information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels defined in SA-15 (4), CCI 3263.'),\n('003262','draft','2013-09-30','DISA FSO','policy','The organization defines information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform threat modeling for the information system by the developer.','SA-15(4).7','The organization being inspected/assessed defines and documents information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform threat modeling for the information system by the developer.  DoD has determined the information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information to ensure the organization being inspected/assessed defines  information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform threat modeling for the information system by the developer.  DoD has determined the information is not appropriate to define at the Enterprise level.'),\n('003263','draft','2013-09-30','DISA FSO','policy','The organization defines information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform a vulnerability analysis for the information system by the developer.','SA-15(4).8','The organization being inspected/assessed defines and documents information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform a vulnerability analysis for the information system by the developer.  DoD has determined the information is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information to ensure the organization being inspected/assessed defines information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform a vulnerability analysis for the information system by the developer.  DoD has determined the information is not appropriate to define at the Enterprise level.'),\n('003264','draft','2013-09-30','DISA FSO','policy','The organization requires the threat modeling performed by the developers employ organization-defined tools and methods.','SA-15(4).9','The organization being inspected/assessed requires within contracts/agreements that the threat modeling performed by the developers employ the tools and methods defined in SA-15 (4), CCI 3266.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the threat modeling performed by the developers employ the tools and methods defined in SA-15 (4), CCI 3266.'),\n('003265','draft','2013-09-30','DISA FSO','policy','The organization requires the vulnerability analysis performed by the developers employ organization-defined tools and methods.','SA-15(4).10','The organization being inspected/assessed requires within contracts/agreements that the vulnerability analysis performed by the developers employ the tools and methods defined in SA-15 (4), CCI 3267.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the vulnerability analysis performed by the developers employ the tools and methods defined in SA-15 (4), CCI 3267.'),\n('003266','draft','2013-09-30','DISA FSO','policy','The organization defines tools and methods to be employed to perform threat modeling for the information system by the developer.','SA-15(4).11','The organization being inspected/assessed defines and documents tools and methods to be employed to perform threat modeling for the information system by the developer.  DoD has determined the tools and methods are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented tools and methods to ensure the organization being inspected/assessed defines tools and methods to be employed to perform threat modeling for the information system by the developer.  DoD has determined the tools and methods are not appropriate to define at the Enterprise level.'),\n('003267','draft','2013-09-30','DISA FSO','policy','The organization defines tools and methods to be employed to perform a vulnerability analysis for the information system by the developer.','SA-15(4).12','The organization being inspected/assessed defines and documents tools and methods to be employed to perform a vulnerability analysis for the information system by the developer.  DoD has determined the tools and methods are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented tools and methods to ensure the organization being inspected/assessed defines tools and methods to be employed to perform a vulnerability analysis for the information system by the developer.  DoD has determined the tools and methods are not appropriate to define at the Enterprise level.'),\n('003268','draft','2013-09-30','DISA FSO','policy','The organization requires that developers performing threat modeling for the information system produce evidence that meets organization-defined acceptance criteria.','SA-15(4).13','The organization being inspected/assessed requires within contracts/agreements that the developers performing threat modeling for the information system produces evidence that meet the acceptance criteria defined in SA-15 (4), CCI 3270.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developers performing threat modeling for the information system produces evidence that meet the acceptance criteria defined in SA-15 (4), CCI 3270.'),\n('003269','draft','2013-09-30','DISA FSO','policy','The organization requires that developers performing vulnerability analysis for the information system produce evidence that meets organization-defined acceptance criteria.','SA-15(4).14','The organization being inspected/assessed requires within contracts/agreements that the developers performing vulnerability analysis for the information system produces evidence that meet the acceptance criteria defined in SA-15 (4), CCI 3271.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the vulnerability analysis performed by the developers performing vulnerability analysis for the information system produces evidence that meet the acceptance criteria defined in SA-15 (4), CCI 3271.'),\n('003270','draft','2013-09-30','DISA FSO','policy','The organization defines the acceptance criteria that must be met when threat modeling of the information system is performed by the developer.','SA-15(4).15','The organization being inspected/assessed defines and documents the acceptance criteria that must be met when threat modeling of the information system is performed by the developer.  DoD has determined the acceptance criteria is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented acceptance criteria to ensure the organization being inspected/assessed defines the acceptance criteria that must be met when threat modeling of the information system is performed by the developer.  DoD has determined the acceptance criteria is not appropriate to define at the Enterprise level.'),\n('003271','draft','2013-10-03','DISA FSO','policy','The organization defines the acceptance criteria that must be met when vulnerability analysis of the information system is performed by the developer.','SA-15(4).16','The organization being inspected/assessed defines and documents the acceptance criteria that must be met when vulnerability analysis of the information system is performed by the developer.  DoD has determined the acceptance criteria is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented acceptance criteria to ensure the organization being inspected/assessed defines the acceptance criteria that must be met when vulnerability analysis of the information system is performed by the developer.   DoD has determined the acceptance criteria is not appropriate to define at the Enterprise level.'),\n('003272','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to reduce attack surfaces to organization-defined thresholds.','SA-15(5).1','The organization being inspected/assessed requires the developer to perform attack surface reduction activities to reduce risk to organizations by giving attackers less opportunity to exploit weaknesses or vulnerabilities.\\n\\nAttack surface reduction may include:\\n1. Testing and delivering the system with debug options off, or making the debug capabilities inaccessible to unauthorized users;\\n2. Applying the principle of least privilege;\\n3. Applying the principle of least functionality (i.e., restricting ports, protocols, functions, and services), deprecating unsafe functions, and eliminating application programming interfaces (APIs) that are vulnerable to cyber attacks; and\\n4. Employing layered defenses.\\n5. Using trusted physical delivery mechanisms that do not permit access to the element during delivery (ship via a protected carrier, use cleared/official couriers, or a diplomatic pouch);\\n6. Using trusted logical delivery of products and services (require downloading from approved, verification-enhanced sites);\\n7. Avoiding the purchase of custom configurations;\\n8. Using procurement carve outs (i.e., exclusions to commitments or obligations);\\n9. Using defensive design approaches;\\n10. Minimizing the time between purchase decisions and required delivery;\\n11. Employing a diverse set of suppliers;\\n12. Employing approved vendor lists with standing reputations in industry;\\n13. Diversifying and disperse how the product is acquired (e.g. Spot Markets); and\\n14. Employing inventory management policies and processes.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service reduce attack surfaces to thresholds defined in SA-15 (5), CCI 3273.'),\n('003273','draft','2013-10-03','DISA FSO','policy','The organization defines the thresholds to which the developer of the information system, system component, or information system service is required to reduce attack surfaces.','SA-15(5).2','The organization being inspected/assessed defines and documents the thresholds that the developer of the information system, system component, or information system service is required to reduce attack surfaces.  DoD has determined the thresholds are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented thresholds to ensure the organization being inspected/assessed defines  the thresholds that the developer of the information system, system component, or information system service is required to reduce attack surfaces.  DoD has determined the thresholds are not appropriate to define at the Enterprise level.'),\n('003274','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to implement an explicit process to continuously improve the development process.','SA-15(6).1','The organization being inspected/assessed documents within contracts/agreements, the requirement that the  developer of the information system, system component, or information system service  implement an explicit process to continuously improve the development process.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  implement an explicit process to continuously improve the development process.'),\n('003275','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system services to perform an automated vulnerability analysis using organization-defined tools.','SA-15(7).1','The organization being inspected/assessed requires within contracts/agreements that the  developer of the information system, system component, or information system service perform an automated vulnerability analysis using the tools defined in SA-15 (7), CCI 3276.\\n\\nThe organization should require the developer to perform automated vulnerability analysis which may include dynamic analyses, static analyses, and regression testing tools. Automated testing should be performed in conjunction with manual testing to provide greater levels of analysis.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service perform an automated vulnerability analysis using the tools defined in SA-15 (7), CCI 3276.'),\n('003276','draft','2013-10-03','DISA FSO','policy','The organization defines the tools the developer of the information system, system component, or information system services uses to perform an automated vulnerability analysis.','SA-15(7).2','The organization being inspected/assessed defines and documents the tools the developer of the information system, system component, or information system services uses to perform an automated vulnerability analysis.  DoD has determined the tools are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented tools to ensure the organization being inspected/assessed defines  the tools the developer of the information system, system component, or information system services uses to perform an automated vulnerability analysis.  DoD has determined the tools are not appropriate to define at the Enterprise level.'),\n('003277','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system services to determine the exploitation potential for discovered vulnerabilities.','SA-15(7).3','The organization being inspected/assessed requires within contracts/agreements that the  developer of the information system, system component, or information system service determine the exploitation potential for discovered vulnerabilities.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  determine the exploitation potential for discovered vulnerabilities.'),\n('003278','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system services to determine potential risk mitigations for delivered vulnerabilities.','SA-15(7).4','The organization being inspected/assessed requires within contracts/agreements that the  developer of the information system, system component, or information system service determine potential risk mitigations for delivered vulnerabilities.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  determine potential risk mitigations for delivered vulnerabilities.'),\n('003279','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system services to deliver the outputs of the tools and results of the vulnerability analysis to organization-defined personnel or roles.','SA-15(7).5','The organization being inspected/assessed requires within contracts/agreements that the  developer of the information system, system component, or information system service deliver the outputs of the tools and results of the vulnerability analysis to  the ISSO, ISSM, and PM.\\n\\nDoD has defined the personnel or roles as the ISSO, ISSM, and PM.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  deliver the outputs of the tools and results of the vulnerability analysis to  the ISSO, ISSM, and PM.\\n\\nDoD has defined the personnel or roles as the ISSO, ISSM, and PM.'),\n('003280','draft','2013-10-03','DISA FSO','policy','The organization defines the personnel or roles to whom the outputs of the tools and results of the vulnerability analysis are delivered.','SA-15(7).6','DoD has defined the personnel or roles as the ISSO, ISSM, and PM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as the ISSO, ISSM, and PM.'),\n('003281','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to use threat modeling from similar systems, components, or services to inform the current development process.','SA-15(8).1','The organization being inspected/assessed requires within contracts/agreements that the  developer of the information system, system component, or information system service use threat modeling from similar systems, components, or services to inform the current development process.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  use threat modeling from similar systems, components, or services to inform the current development process.'),\n('003282','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to use vulnerability analysis from similar systems, components, or services to inform the current development process.','SA-15(8).2','The organization being inspected/assessed requires within contracts/agreements that the  developer of the information system, system component, or information system service use vulnerability analysis from similar systems, components, or services to inform the current development process and potential design or implementation issues.  Authoritative vulnerability information is available from a variety of public and private sector sources including, for example, the National Vulnerability Database and the Government/Industry Data Exchange Program (GIDEP).','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service use vulnerability analysis from similar systems, components, or services to inform the current development process.'),\n('003283','draft','2013-10-03','DISA FSO','policy','The organization approves the use of live data in development environments for the information system, system component, or information system service.','SA-15(9).1','The organization being inspected/assessed documents and implements a process to approve the use of live data in development environments for the information system, system component, or information system service.  The organization must maintain a record of approvals.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of approvals to ensure the organization being inspected/assessed approves the use of live data in development environments for the information system, system component, or information system service.'),\n('003284','draft','2013-10-03','DISA FSO','policy','The organization approves the use of live data in test environments for the information system, system component, or information system service.','SA-15(9).2','The organization being inspected/assessed documents and implements a process to approve the use of live data in test environments for the information system, system component, or information system service.  The organization must maintain a record of approvals.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of approvals to ensure the organization being inspected/assessed approves the use of live data in test environments for the information system, system component, or information system service.'),\n('003285','draft','2013-10-03','DISA FSO','policy','The organization documents the use of live data in development environments for the information system, system component, or information system service.','SA-15(9).3','The organization being inspected/assessed documents the use of live data in development environments for the information system, system component, or information system service.','The organization conducting the inspection/assessment obtains and examines the documented use of live data in test environments to ensure the organization being inspected/assessed documents the use of live data in development environments for the information system, system component, or information system service.'),\n('003286','draft','2013-10-03','DISA FSO','policy','The organization documents the use of live data in test environments for the information system, system component, or information system service.','SA-15(9).4','The organization being inspected/assessed documents the use of live data in test environments for the information system, system component, or information system service.','The organization conducting the inspection/assessment obtains and examines the documented use of live data in test environments to ensure the organization being inspected/assessed documents the use of live data in test environments for the information system, system component, or information system service.'),\n('003287','draft','2013-10-03','DISA FSO','policy','The organization controls the use of live data in development environments for the information system, system component, or information system service.','SA-15(9).5','The organization being inspected/assessed documents and implements a process to control the use of live data in development environments for the information system, system component, or information system service.  The Enclave Test and Development STIG identifies requirements for test and development environments.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed controls the use of live data in development environments for the information system, system component, or information system service.'),\n('003288','draft','2013-10-03','DISA FSO','policy','The organization controls the use of live data in test environments for the information system, system component, or information system service.','SA-15(9).6','The organization being inspected/assessed documents and implements a process to control the use of live data in test environments for the information system, system component, or information system service.  The Enclave Test and Development STIG identifies requirements for test and development environments.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed controls the use of live data in test environments for the information system, system component, or information system service.'),\n('003289','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to provide an incident response plan.','SA-15(10).1','The organization being inspected/assessed documents within contracts/agreements, the requirement that the  developer of the information system, system component, or information system service provide an incident response plan.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service provide an incident response plan.'),\n('003290','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security review.','SA-15(11).1','The organization being inspected/assessed documents within contracts/agreements, the requirement that the  developer of the information system, system component, or information system service be released or delivered together with the corresponding evidence supporting the final security review.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  be released or delivered together with the corresponding evidence supporting the final security review.'),\n('003291','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to provide organization-defined training on the correct use and operation of the implemented security functions, controls, and/or mechanisms.','SA-16.1','The organization being inspected/assessed documents within contracts/agreements, the requirement that the  developer of the information system, system component, or information system service provide training defined in SA-16, CCI 3292 on the correct use and operation of the implemented security functions, controls, and/or mechanisms.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service provide training defined in SA-16, CCI 3292 on the correct use and operation of the implemented security functions, controls, and/or mechanisms.'),\n('003292','draft','2013-10-03','DISA FSO','policy','The organization defines the training the developer of the information system, system component, or information system service is required to provide on the correct use and operation of the implemented security functions, controls, and/or mechanisms.','SA-16.2','The organization being inspected/assessed defines and documents the training the developer of the information system, system component, or information system service is required to provide on the correct use and operation of the implemented security functions, controls, and/or mechanisms.  DoD has determined the training is not appropriate to define at the Enterprise level.','The organization  conducting the inspection/assessment obtains and examines the documented training to ensure the organization being inspected/assessed defines the training the developer of the information system, system component, or information system service is required to provide on the correct use and operation of the implemented security functions, controls, and/or mechanisms.  DoD has determined the training is not appropriate to define at the Enterprise level.'),\n('003293','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to produce a design specification and security architecture.','SA-17.1','The organization being inspected/assessed documents within contracts/agreements, the requirement that the  developer of the information system, system component, or information system service  produce a design specification and security architecture.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  produce a design specification and security architecture.'),\n('003294','draft','2013-10-03','DISA FSO','policy','The design specification and security architecture is consistent with and supportive of the organization^s security architecture which is established within and is an integrated part of the organization^s enterprise architecture.','SA-17.2','The organization being inspected/assessed documents within contracts/agreements, the requirement that the developer produce a design specification and security architecture that is consistent with and supportive of the organization\\'s security architecture which is established within and is interrogated part of the organization\\'s enterprise architecture.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer produce a design specification and security architecture that is consistent with and supportive of the organization\\'s security architecture which is established within and is interrogated part of the organization\\'s enterprise architecture.'),\n('003295','draft','2013-10-03','DISA FSO','policy','The design specification and security architecture accurately and completely describes the required security functionality.','SA-17.3','The organization being inspected/assessed documents within contracts/agreements, the requirement that the developer produce a design specification and security architecture that accurately and completely describes the required security functionality.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer produce a design specification and security architecture that accurately and completely describes the required security functionality.'),\n('003296','draft','2013-10-03','DISA FSO','policy','The design specification and security architecture accurately and completely describes the allocation of security controls among physical and logical components.','SA-17.4','The organization being inspected/assessed documents within contracts/agreements, the requirement that the developer produce a design specification and security architecture  that accurately and completely describes the allocation of security controls among physical and logical components.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer produce a design specification and security architecture that accurately and completely describes the allocation of security controls among physical and logical components.'),\n('003297','draft','2013-10-03','DISA FSO','policy','The design specification and security architecture expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection.','SA-17.5','The organization being inspected/assessed documents within contracts/agreements, the requirement that the developer produce a design specification and security architecture  that expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer produce a design specification and security architecture that expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection.'),\n('003298','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system to produce, as an integral part of the development process, a formal policy model describing the organization-defined elements of organizational security policy to be enforced.','SA-17(1).1','The organization being inspected/assessed documents within contracts/agreements,, the requirement that the  developer of the information system, system component, or information system service produce, as an integral part of the development process, a formal policy model describing the  elements of organizational security policy defined in SA-17 (1), CCI 3299 to be enforced.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  produce, as an integral part of the development process, a formal policy model describing the  elements of organizational security policy defined in SA-17 (1), CCI 3299 to be enforced.'),\n('003299','draft','2013-10-03','DISA FSO','policy','The organization defines the elements of organization security policy to be described in the formal policy model for enforcement on the information system, system component, or information system service.','SA-17(1).2','The organization being inspected/assessed defines and documents the elements of organization security policy to be described in the formal policy model for enforcement on the information system, system component, or information system service.  DoD has determined the elements are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented elements to ensure the organization being inspected/assessed defines  the elements of organization security policy to be described in the formal policy model for enforcement on the information system, system component, or information system service.  DoD has determined the elements are not appropriate to define at the Enterprise level.'),\n('003300','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented.','SA-17(1).3','The organization being inspected/assessed documents within contracts/agreements, the requirement that the  developer of the information system, system component, or information system service prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements o ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented.'),\n('003301','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to define security-relevant hardware.','SA-17(2).1','The organization being inspected/assessed documents within contracts/agreements, the requirement that the  developer of the information system, system component, or information system service define security-relevant software.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service define security-relevant software.'),\n('003302','deprecated','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to define security-relevant hardware.',NULL,NULL,NULL),\n('003303','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to define security-relevant software.','SA-17(2).2','The organization being inspected/assessed documents within contracts/agreements, the requirement that the  developer of the information system, system component, or information system service define security-relevant software.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service define security-relevant software.'),\n('003304','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to define security-relevant firmware.','SA-17(2).3','The organization being inspected/assessed documents within contracts/agreements, the requirement that the  developer of the information system, system component, or information system service  define security-relevant firmware.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  define security-relevant firmware.'),\n('003305','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to provide a rationale that the definition for security-relevant hardware is complete.','SA-17(2).4','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service provide a rationale that the definition for security-relevant hardware is complete.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service provide a rationale that the definition for security-relevant hardware is complete.'),\n('003306','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to provide a rationale that the definition for security-relevant software is complete.','SA-17(2).5','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service provide a rationale that the definition for security-relevant software is complete.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service provide a rationale that the definition for security-relevant software is complete.'),\n('003307','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to provide a rationale that the definition for security-relevant firmware is complete.','SA-17(2).6','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service provide a rationale that the definition for security-relevant firmware is complete.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service provide a rationale that the definition for security-relevant firmware is complete.'),\n('003308','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects.','SA-17(3).1','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects.'),\n('003309','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant software in terms of exceptions, error messages, and effects.','SA-17(3).2','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant software in terms of exceptions, error messages, and effects.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant software in terms of exceptions, error messages, and effects.'),\n('003310','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.','SA-17(3).3','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.'),\n('003311','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to show via proof to the extent feasible with additional informal demonstration as necessary, that the formal top-level specification is consistent with the formal policy model.','SA-17(3).4','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service show via proof to the extent feasible with additional informal demonstration as necessary, that the formal top-level specification is consistent with the formal policy model.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show via proof to the extent feasible with additional informal demonstration as necessary, that the formal top-level specification is consistent with the formal policy model.'),\n('003312','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant hardware.','SA-17(3).5','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant hardware.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant hardware.'),\n('003313','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant software.','SA-17(3).6','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant software.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant software.'),\n('003314','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant firmware.','SA-17(3).7','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service  show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant firmware.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant firmware.'),\n('003315','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to show that the formal top-level specification is an accurate description of the implemented security-relevant hardware.','SA-17(3).8','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service show that the formal top-level specification is an accurate description of the implemented security-relevant hardware.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show that the formal top-level specification is an accurate description of the implemented security-relevant hardware.'),\n('003316','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to show that the formal top-level specification is an accurate description of the implemented security-relevant software.','SA-17(3).9','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service  show that the formal top-level specification is an accurate description of the implemented security-relevant software.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  show that the formal top-level specification is an accurate description of the implemented security-relevant software.'),\n('003317','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to show that the formal top-level specification is an accurate description of the implemented security-relevant firmware.','SA-17(3).10','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service show that the formal top-level specification is an accurate description of the implemented security-relevant firmware.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show that the formal top-level specification is an accurate description of the implemented security-relevant firmware.'),\n('003318','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to describe the security-relevant hardware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant hardware.','SA-17(3).11','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service describe the security-relevant firmware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant hardware.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  describe the security-relevant firmware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant hardware.'),\n('003319','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to describe the security-relevant software mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant software.','SA-17(3).12','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service describe the security-relevant software mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant software.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  describe the security-relevant software mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant software.'),\n('003320','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to describe the security-relevant firmware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant firmware.','SA-17(3).13','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service describe the security-relevant firmware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant firmware.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  describe the security-relevant firmware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant firmware.'),\n('003321','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects.','SA-17(4).1','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects.'),\n('003322','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant software in terms of exceptions, error messages, and effects.','SA-17(4).2','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.'),\n('003323','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.','SA-17(4).3','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.'),\n('003324','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to show via informal demonstration or convincing argument with formal methods as feasible that the descriptive top-level specification is consistent with the formal policy model.','SA-17(4).4','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service  show via informal demonstration or convincing argument with formal methods as feasible that the descriptive top-level specification is consistent with the formal policy model.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  show via informal demonstration or convincing argument with formal methods as feasible that the descriptive top-level specification is consistent with the formal policy model.'),\n('003325','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant hardware.','SA-17(4).5','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant hardware.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant hardware.'),\n('003326','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant software.','SA-17(4).6','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant software.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant software.'),\n('003327','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant firmware.','SA-17(4).7','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant firmware.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant firmware.'),\n('003328','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware.','SA-17(4).8','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service  show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware.'),\n('003329','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant software.','SA-17(4).9','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service  show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant software.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant software.'),\n('003330','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant firmware.','SA-17(4).10','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant firmware.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant firmware.'),\n('003331','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to describe the security-relevant hardware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant hardware.','SA-17(4).11','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service describe the security-relevant hardware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant hardware.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service describe the security-relevant hardware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant hardware.'),\n('003332','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to describe the security-relevant software mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant software.','SA-17(4).12','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service  describe the security-relevant software mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant software.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  describe the security-relevant software mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant software.'),\n('003333','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to describe the security-relevant firmware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant firmware.','SA-17(4).13','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service describe the security-relevant firmware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant firmware.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service describe the security-relevant firmware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant firmware.'),\n('003334','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to design and structure the security-relevant hardware to use a complete, conceptually simple protection mechanism with precisely defined semantics.','SA-17(5).1','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service design and structure the security-relevant hardware to use a complete, conceptually simple protection mechanism with precisely defined semantics.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service design and structure the security-relevant hardware to use a complete, conceptually simple protection mechanism with precisely defined semantics.'),\n('003335','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to design and structure the security-relevant software to use a complete, conceptually simple protection mechanism with precisely defined semantics.','SA-17(5).2','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service design and structure the security-relevant software to use a complete, conceptually simple protection mechanism with precisely defined semantics.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service design and structure the security-relevant software to use a complete, conceptually simple protection mechanism with precisely defined semantics.'),\n('003336','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to design and structure the security-relevant firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics.','SA-17(5).3','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service design and structure the security-relevant firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service design and structure the security-relevant firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics.'),\n('003337','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to internally structure the security-relevant hardware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.','SA-17(5).4','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service internally structure the security-relevant hardware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service internally structure the security-relevant hardware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.'),\n('003338','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to internally structure the security-relevant software with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.','SA-17(5).5','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service  internally structure the security-relevant software with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service internally structure the security-relevant software with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.'),\n('003339','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service to internally structure the security-relevant firmware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.','SA-17(5).6','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service internally structure the security-relevant firmware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  internally structure the security-relevant firmware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.'),\n('003340','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, component, or information system service to structure security-relevant hardware to facilitate testing.','SA-17(6).1','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service structure security-relevant hardware to facilitate testing.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service structure security-relevant hardware to facilitate testing.'),\n('003341','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, component, or information system service to structure security-relevant software to facilitate testing.','SA-17(6).2','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service structure security-relevant software to facilitate testing.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service structure security-relevant software to facilitate testing.'),\n('003342','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, component, or information system service to structure security-relevant firmware to facilitate testing.','SA-17(6).3','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service structure security-relevant firmware to facilitate testing.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service   structure security-relevant firmware to facilitate testing.'),\n('003343','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, component, or information system service to structure security-relevant hardware to facilitate controlling access with least privilege.','SA-17(7).1','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service structure security-relevant hardware to facilitate controlling access with least privilege.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service structure security-relevant hardware to facilitate controlling access with least privilege.'),\n('003344','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, component, or information system service to structure security-relevant software to facilitate controlling access with least privilege.','SA-17(7).2','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service structure security-relevant software to facilitate controlling access with least privilege.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service structure security-relevant software to facilitate controlling access with least privilege.'),\n('003345','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, component, or information system service to structure security-relevant firmware to facilitate controlling access with least privilege.','SA-17(7).3','The organization being inspected/assessed documents within the contracts/agreements, the requirement that the  developer of the information system, system component, or information system service  structure security-relevant firmware to facilitate controlling access with least privilege.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service  structure security-relevant firmware to facilitate controlling access with least privilege.'),\n('003346','draft','2013-10-03','DISA FSO','policy','The organization implements a tamper protection program for the information system, system component, or information system service.','SA-18.1','The organization being inspected/assessed documents and implements a tamper protection program for the information system, system component, or information system service.','The organization conducting the inspection/assessment obtains and examines the documented tamper protection program to ensure the organization being inspected/assessed implements a tamper protection program for the information system, system component, or information system service.'),\n('003347','draft','2013-10-03','DISA FSO','policy','The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including design.','SA-18(1).1','The organization being inspected/assessed documents and implements a process to employ anti-tamper technologies and techniques during multiple phases in the system development life cycle including design.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including design.'),\n('003348','draft','2013-10-03','DISA FSO','policy','The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including development.','SA-18(1).2','The organization being inspected/assessed documents and implements a process to employ anti-tamper technologies and techniques during multiple phases in the system development life cycle including development.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including development.'),\n('003349','draft','2013-10-03','DISA FSO','policy','The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including integration.','SA-18(1).3','The organization being inspected/assessed documents and implements a process to employ anti-tamper technologies and techniques during multiple phases in the system development life cycle including integration.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including integration.'),\n('003350','draft','2013-10-03','DISA FSO','policy','The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including operations.','SA-18(1).4','The organization being inspected/assessed documents and implements a process to employ anti-tamper technologies and techniques during multiple phases in the system development life cycle including operations.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including operations.'),\n('003351','draft','2013-10-03','DISA FSO','policy','The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including maintenance.','SA-18(1).5','The organization being inspected/assessed documents and implements a process to employ anti-tamper technologies and techniques during multiple phases in the system development life cycle including maintenance.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including maintenance.'),\n('003352','draft','2013-10-03','DISA FSO','policy','The organization inspects organization-defined information systems, system components, or devices at random, at an organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.','SA-18(2).1','The organization being inspected/assessed documents and implements a process to inspect information systems, system components, or devices defined in SA-18 (2), CCI 3353 at random, at a frequency defined in SA-18 (2), CCI 3354, and/or upon indications of need for inspection defined in SA-18 (2), CCI 3355 to detect tampering.  The organization must maintain a record of inspections.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of inspections to ensure the organization being inspected/assessed inspects information systems, system components, or devices defined in SA-18 (2), CCI 3353 at random, at a frequency defined in SA-18 (2), CCI 3354, and/or upon indications of need for inspection defined in SA-18 (2), CCI 3355 to detect tampering.'),\n('003353','draft','2013-10-03','DISA FSO','policy','The organization defines the information systems, system components, or devices to inspect at random, at an organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.','SA-18(2).2','The organization being inspected/assessed defines and documents the information systems, system components, or devices to inspect at random, at organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.   DoD has determined the  information systems, system components, or devices are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information systems, system components, or devices to ensure the organization being inspected/assessed  defines  the information systems, system components, or devices to inspect at random, at organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.  DoD has determined the  information systems, system components, or devices are not appropriate to define at the Enterprise level.'),\n('003354','draft','2013-10-03','DISA FSO','policy','The organization defines the frequency on which to inspect organization-defined information systems, system components, or devices to detect tampering.','SA-18(2).3','The organization being inspected/assessed defines and documents the frequency to inspect organization-defined information systems, system, components, or devices to detect tampering.  DoD has determined the frequency is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed defines the frequency to inspect organization-defined information systems, system, components, or devices to detect tampering.  DoD has determined the frequency is not appropriate to define at the Enterprise level.'),\n('003355','draft','2013-10-03','DISA FSO','policy','The organization defines indications of need for inspection to detect tampering during inspections of organization-defined information systems, system components, or devices.','SA-18(2).4','The organization being inspected/assessed defines and documents indications of need for inspection to detect tampering during inspections of organization-defined information systems, system components, or devices.  DoD has determined the indications are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented indications to ensure the organization being inspected/assessed defines indications of need for inspection to detect tampering during inspections of organization-defined information systems, system components, or devices.   DoD has determined the indications are not appropriate to define at the Enterprise level.'),\n('003356','draft','2013-10-03','DISA FSO','policy','The organization develops an anti-counterfeit policy that includes the means to detect counterfeit components from entering the information system.','SA-19.1','The organization being inspected/assessed develops and documents an anti-counterfeit policy that include the means to detect counterfeit components from entering the information system.','The organization conducting the inspection/assessment obtains and examines the documented  anti-counterfeit policy to ensure the organization being inspected/assessed develops an anti-counterfeit policy that include the means to detect counterfeit components from entering the information system.'),\n('003357','draft','2013-10-03','DISA FSO','policy','The organization develops an anti-counterfeit policy that includes the means to prevent counterfeit components from entering the information system.','SA-19.2','The organization being inspected/assessed develops and documents an anti-counterfeit policy that include the means to prevent counterfeit components from entering the information system.','The organization conducting the inspection/assessment obtains and examines the documented  anti-counterfeit policy to ensure the organization being inspected/assessed develops an anti-counterfeit policy that include the means to prevent counterfeit components from entering the information system.'),\n('003358','draft','2013-10-03','DISA FSO','policy','The organization develops anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system.','SA-19.3','The organization being inspected/assessed develops and documents anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system.','The organization conducting the inspection/assessment obtains and examines the documented  anti-counterfeit procedures to ensure the organization being inspected/assessed develops anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system.'),\n('003359','draft','2013-10-03','DISA FSO','policy','The organization develops anti-counterfeit procedures that include the means to prevent counterfeit components from entering the information system.','SA-19.4','The organization being inspected/assessed develops and documents anti-counterfeit procedures that include the means to prevent counterfeit components from entering the information system.','The organization conducting the inspection/assessment obtains and examines the documented  anti-counterfeit procedures to ensure the organization being inspected/assessed develops anti-counterfeit procedures that include the means to prevent counterfeit components from entering the information system.'),\n('003360','draft','2013-10-03','DISA FSO','policy','The organization implements an anti-counterfeit policy that includes the means to detect counterfeit components from entering the information system.','SA-19.5','The organization being inspected/assessed implements the policy defined in SA-19, CCIs 3356 that include the means to detect counterfeit components from entering the information system.','The organization conducting the inspection/assessment obtains and examines the policy defined in SA-19, CCIs 3356 and any artifacts applicable to counterfeit components to ensure the organization being inspected/assessed implements the policy defined in SA-19, CCIs 3356 that include the means to detect counterfeit components from entering the information system.'),\n('003361','draft','2013-10-03','DISA FSO','policy','The organization implements an anti-counterfeit policy that includes the means to prevent counterfeit components from entering the information system.','SA-19.6','The organization being inspected/assessed implements the policy defined in SA-19, CCIs 3357 that include the means to prevent counterfeit components from entering the information system.','The organization conducting the inspection/assessment obtains and examines the policy defined in SA-19, CCIs 3357 and any artifacts applicable to counterfeit components to ensure the organization being inspected/assessed implements the policy defined in SA-19, CCIs 3357 that include the means to detect counterfeit components from entering the information system.'),\n('003362','draft','2013-10-03','DISA FSO','policy','The organization implements anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system.','SA-19.7','The organization being inspected/assessed implements the procedures defined in SA-19, CCIs 3358 that include the means to detect counterfeit components from entering the information system.','The organization conducting the inspection/assessment obtains and examines the procedures defined in SA-19, CCIs 3358 and any artifacts applicable to counterfeit components to ensure the organization being inspected/assessed implements the procedures defined in SA-19, CCIs 3358 that include the means to detect counterfeit components from entering the information system.'),\n('003363','draft','2013-10-03','DISA FSO','policy','The organization implements anti-counterfeit procedures that include the means to prevent counterfeit components from entering the information system.','SA-19.8','The organization being inspected/assessed implements the procedures defined in SA-19, CCIs 3359 that include the means to prevent counterfeit components from entering the information system.','The organization conducting the inspection/assessment obtains and examines the procedures defined in SA-19, CCIs 3359 and any artifacts applicable to counterfeit components to ensure the organization being inspected/assessed implements the procedures defined in SA-19, CCIs 3359 that include the means to prevent counterfeit components from entering the information system.'),\n('003364','draft','2013-10-03','DISA FSO','policy','The organization reports counterfeit information system components to the source of the counterfeit component, organization-defined external reporting organizations, and/or organization-defined personnel or roles.','SA-19.9','The organization being inspected/assessed documents and implements a process to report counterfeit information system components to source of counterfeit component, at a minimum, USCYBERCOM. And/or at a minimum, the ISSO, ISSM, and PM.  The organization must maintain a record of reporting.  DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM, and PM.  DoD has defined the external reporting organizations as at a minimum, USCYBERCOM.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reporting to ensure the organization being inspected/assessed reports counterfeit information system components to source of counterfeit component, at a minimum, USCYBERCOM. And/or at a minimum, the ISSO, ISSM, and PM.'),\n('003365','draft','2013-10-03','DISA FSO','policy','The organization defines the external reporting organizations to which counterfeit information system components are to be reported.','SA-19.10','DoD has defined the external reporting organizations as at a minimum, USCYBERCOM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the external reporting organizations as at a minimum, USCYBERCOM'),\n('003366','draft','2013-10-03','DISA FSO','policy','The organization defines the personnel or roles to whom counterfeit information system components are to be reported.','SA-19.11','DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM, and PM.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM, and PM.'),\n('003367','draft','2013-10-03','DISA FSO','policy','The organization trains organization-defined personnel or roles to detect counterfeit information system components (including hardware, software, and firmware).','SA-19(1).1','The organization being inspected/assessed documents and implements a process to train   personnel or roles defined in SA-19 (1), CCI 3368 to detect counterfeit information system components (including hardware, software, and firmware).  The organization must maintain a record of training.','The organization conducting the inspection/assessment obtains and examines the documented process, the list of personnel responsible for detecting counterfeit information system components, as well as the record of training to ensure the organization being inspected/assessed trains   personnel or roles defined in SA-19 (1), CCI 3368 to detect counterfeit information system components (including hardware, software, and firmware).'),\n('003368','draft','2013-10-03','DISA FSO','policy','The organization defines the personnel or roles to be trained to detect counterfeit information system components (including hardware, software, and firmware).','SA-19(1).2','The organization being inspected/assessed defines and documents the personnel or roles to be trained to detect counterfeit information system components (including hardware, software, and firmware).  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles to be trained to detect counterfeit information system components (including hardware, software, and firmware).  DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.'),\n('003369','draft','2013-10-03','DISA FSO','policy','The organization maintains configuration control over organization-defined information system components awaiting service/repair.','SA-19(2).1','The organization being inspected/assessed documents and implements a process to maintain configuration control over information system components defined in SA-19 (2), CCI 3370 awaiting service/repair.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed maintains configuration control l over information system components defined in SA-19 (2), CCI 3370 awaiting service/repair.'),\n('003370','draft','2013-10-03','DISA FSO','policy','The organization defines the information system components awaiting service/repair over which configuration control must be maintained.','SA-19(2).2','The organization being inspected/assessed defines and documents the information system components awaiting service/repair in which configuration control must be maintained.  DoD has determined the information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components awaiting service/repair in which configuration control must be maintained.  DoD has determined the information system components are not appropriate to define at the Enterprise level.'),\n('003371','draft','2013-10-03','DISA FSO','policy','The organization maintains configuration control over serviced/repaired components awaiting return to service.','SA-19(2).3','The organization being inspected/assessed documents and implements a process to maintain configuration control over serviced/repaired components awaiting return to service.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed maintains configuration control over serviced/repaired components awaiting return to service.'),\n('003372','draft','2013-10-03','DISA FSO','policy','The organization defines the support from external providers to be provided for unsupported information system components.','SA-22(1).1','The organization being inspected/assessed defines and documents the support from external providers to be provided for unsupported information system components.  DoD has determined the support from external providers is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented support to ensure the organization being inspected/assessed defines the support from external providers to be provided for unsupported information system components.  DoD has determined the support from external providers is not appropriate to define at the Enterprise level.'),\n('003373','draft','2013-10-03','DISA FSO','policy','The organization provides in-house support and/or organization-defined support from external providers for unsupported information system components.','SA-22(1).2','The organization being inspected/assessed documents and implements a process to provide in-house support and/or support from external providers defined in SA-22 (1), CCI 3372 for unsupported information system components.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides in-house support and/or support from external providers defined in SA-22 (1), CCI 3372 for unsupported information system components.'),\n('003374','draft','2013-10-03','DISA FSO','policy','The organization documents approval for the continued use of unsupported system components required to satisfy mission/business needs.','SA-22.2','The organization being inspected/assessed documents approval for the continued use of unsupported system components required to satisfy mission/business needs.','The organization conducting the inspection/assessment obtains and examines the hardware and software lists as well as the documented approvals to ensure the organization being inspected/assessed documents approval for the continued use of unsupported system components required to satisfy mission/business needs.'),\n('003375','draft','2013-10-03','DISA FSO','policy','The organization provides justification for the continued use of unsupported system components required to satisfy mission/business needs.','SA-22.3','The organization being inspected/assessed documents justification for the continued use of unsupported system components required to satisfy mission/business needs.','The organization conducting the inspection/assessment obtains and examines the documented justification as well as the hardware and software lists to ensure the organization being inspected/assessed provides justification for the continued use of unsupported system components required to satisfy mission/business needs.'),\n('003376','draft','2013-10-03','DISA FSO','policy','The organization replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer.','SA-22.1','The organization being inspected/assessed documents and implements a process to replace information system components when support for the components is no longer available from the developer, vendor, or manufacturer.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the hardware and software lists to ensure the organization being inspected/assessed replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer.'),\n('003377','draft','2013-10-03','DISA FSO','policy','The organization defines the actions the developer of the information system, system component, or information system service must take to ensure the required screening criteria are satisfied.','SA-21(1).1','The organization being inspected/assessed defines and documents the actions the developer of the information system, system component, or information system service must take to ensure the required screening criteria are satisfied.  DoD has determined the actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented actions to ensure the organization being inspected/assessed defines  the actions the developer of the information system, system component, or information system service must take to ensure the required screening criteria are satisfied.  DoD has determined the actions are not appropriate to define at the Enterprise level.'),\n('003378','draft','2013-10-03','DISA FSO','policy','The organization defines the actions the developer of the information system, system component, or information system service must take to ensure the required access authorizations are satisfied.','SA-21(1).2','The organization being inspected/assessed defines and documents the actions the developer of the information system, system component, or information system service must take to ensure the required access authorizations are satisfied.  DoD has determined the actions are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented actions to ensure the organization being inspected/assessed defines  the actions the developer of the information system, system component, or information system service must take to ensure the required access authorizations are satisfied.  DoD has determined the actions are not appropriate to define at the Enterprise level.'),\n('003379','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service take organization-defined actions to ensure the required screening criteria are satisfied.','SA-21(1).3','The organization being inspected/assessed documents within the contracts/agreements the requirement that the developer of information system, system component, or information system service take actions defined in SA-21 (1), CCI 3377 to ensure the required screening criteria are satisfied.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of information system, system component, or information system service  take actions defined in SA-21 (1), CCI 3377 to ensure the required screening criteria are satisfied.'),\n('003380','draft','2013-10-03','DISA FSO','policy','The organization requires the developer of the information system, system component, or information system service take organization-defined actions to ensure the required access authorizations are satisfied.','SA-21(1).4','The organization being inspected/assessed documents within the contracts/agreements the requirement that the developer of information system, system component, or information system service  take actions defined in SA-21 (1), CCI 3378 to ensure the required access authorizations are satisfied.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of information system, system component, or information system service take actions defined in SA-21 (1), CCI 3378 to ensure the required access authorizations are satisfied.'),\n('003381','draft','2013-10-03','DISA FSO','policy','The organization defines additional personnel screening criteria that must be satisfied by the developer of an organization-defined information system, system component, or information system service.','SA-21.4','The organization being inspected/assessed defines and documents additional personnel screening criteria that must be satisfied by the developer of organization-defined information system, system component, or information system service.\\n\\nDoD has determined the additional personnel screening criteria is not appropriate to define at the Enterprise level.\\n\\nThe organization should ensure that the developer is trustworthy by performing a review of the developer that may include:\\n1. Organization and process certifications;\\n2. Security policies, procedures, and activities across the lifecycle;\\n3. Supply chain and how suppliers select/manage their suppliers/service providers;\\n4. Financials to determine if the supplier is financially stable;\\n5. Foreign Ownership, Control,  and Influence;\\n6. Past performance and vulnerabilities;\\n7. Business relationships;\\n8. Maturity of business processes; and\\n9. Developer screening practices that may include::\\na. Evaluating and vetting key personnel through security reviews (including clearance, satisfactory background checks, citizenship, and nationality) by acquirers or suppliers in any capacity (full-time employee, part-time employee, consultant, contractor, subcontractor, vendor, agent, etc.);\\nb. Reevaluating personnel through security reviews and assessments on a periodic basis or upon occurrence of specific significant events.','The organization conducting the inspection/assessment obtains and examines the documented additional personnel screening criteria to ensure the organization being inspected/assessed defines additional personnel screening criteria that must be satisfied by the developer of organization-defined information system, system component, or information system service.  DoD has determined the additional personnel screening criteria is not appropriate to define at the Enterprise level.'),\n('003382','draft','2013-10-03','DISA FSO','policy','The organization requires that the developer of an organization-defined information system, system component, or information system service satisfy organization-defined additional personnel screening criteria.','SA-21.5','The organization being inspected/assessed requires within contracts that the developer of information system, system component, or information system service defined in SA-21, CCI 3384 satisfy additional personnel screening criteria defined in SA-21, CCI 3381.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of information system, system component, or information system service defined in SA-21, CCI 3384 satisfy additional personnel screening criteria defined in SA-21, CCI 3381.'),\n('003383','draft','2013-10-03','DISA FSO','policy','The organization defines the official government duties to be assigned to the developer of an organization-defined information system, system component, or information system service.','SA-21.2','The organization being inspected/assessed defines and documents the official government duties to be assigned to the developer of organization-defined information system, system component, or information system service.  DoD has determined the official government duties are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented official government duties to ensure the organization being inspected/assessed defines the official government duties to be assigned to the developer of organization-defined information system, system component, or information system service.  DoD has determined the official government duties are not appropriate to define at the Enterprise level.'),\n('003384','draft','2013-10-03','DISA FSO','policy','The organization defines the information system, system component, or information system service which requires the information system developer to have appropriate access authorizations and satisfy additional personnel screening criteria.','SA-21.1','The organization being inspected/assessed defines and documents the information system, system component, or information system service which require the information system developer to have appropriate access authorizations and satisfy additional personnel screening criteria.   DoD has determined the information system, system component, or information system service is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information system, system component, or information system service to ensure the organization being inspected/assessed defines the information system, system component, or information system service which require the information system developer to have appropriate access authorizations and satisfy additional personnel screening criteria.   DoD has determined the information system, system component, or information system service is not appropriate to define at the Enterprise level.'),\n('003385','draft','2013-10-03','DISA FSO','policy','The organization requires that the developer of an organization-defined information system, system component, or information system service have appropriate access authorizations as determined by assigned organization-defined official government duties.','SA-21.3','The organization being inspected/assessed requires within contracts that the developer of information system, system component, or information system service defined in SA-21, CCI 3384  have appropriate access authorizations as determined by assigned official government duties defined in SA-21, CCI 3383.','The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of information system, system component, or information system service defined in SA-21, CCI 3384  have appropriate access authorizations as determined by assigned official government duties defined in SA-21, CCI 3383.'),\n('003386','draft','2013-10-03','DISA FSO','policy','The organization defines the critical information system components to re-implement or custom develop.','SA-20.1','The organization being inspected/assessed defines and documents the critical information system components to re-implement or custom develop.  DoD has determined the critical information system components are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented  critical information system components to ensure the organization being inspected/assessed defines the critical information system components to re-implement or custom develop.  DoD has determined the critical information system components are not appropriate to define at the Enterprise level.'),\n('003387','draft','2013-10-03','DISA FSO','policy','The organization re-implements or custom develops organization-defined critical information system components.','SA-20.2','The organization being inspected/assessed re-implements or custom develops critical information system components defined in SA-20, CCI 3386.','The organization conducting the inspection/assessment obtains and examines hardware and software lists to ensure that no commercial off-the-shelf components are used as  critical information system components defined in SA-20, CCI 3386.'),\n('003388','draft','2013-10-03','DISA FSO','policy','The organization defines the frequency on which to scan for counterfeit information system components.','SA-19(4).1','The organization being inspected/assessed defines and documents the frequency to scan for counterfeit information system components.  DoD has determined the frequency is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed defines  the frequency to scan for counterfeit information system components.  DoD has determined the frequency is not appropriate to define at the Enterprise level.'),\n('003389','draft','2013-10-03','DISA FSO','policy','The organization scans for counterfeit information system components in accordance with organization-defined frequency.','SA-19(4).2','The organization being inspected/assessed documents and implements a process to scan for counterfeit information system components in accordance with the frequency defined in SA-19 (4), CCI 3388.  The organization must maintain a record of scans.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of scans to ensure the organization being inspected/assessed scans for counterfeit information system components in accordance with the frequency defined in SA-19 (4), CCI 3388.'),\n('003390','draft','2013-10-03','DISA FSO','policy','The organization defines the techniques and methods used to dispose of information system components.','SA-19(3).1','DoD has defined the techniques and methods as defined IAW DoD Manual 5200.01.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.  DoD has defined the techniques and methods as defined IAW DoD Manual 5200.01.'),\n('003391','draft','2013-10-03','DISA FSO','policy','The organization disposes of information system components using organization-defined techniques and methods.','SA-19(3).2','The organization being inspected/assessed documents and implements a process to dispose of information system components using techniques and methods defined IAW DoD Manual 5200.01.   The organization must maintain a record of disposal.  DoD has defined the techniques and methods as defined IAW DoD Manual 5200.01.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of disposal to ensure the organization being inspected/assessed disposes of information system components using techniques and methods defined IAW DoD Manual 5200.01.  DoD has defined the techniques and methods as defined IAW DoD Manual 5200.01.'),\n('003392','draft','2013-11-07','DISA FSO','policy','The organization determines and documents the legal authority that permits the collection of personally identifiable information (PII), either generally or in support of a specific program or information system need.','AP-1.1','The organization being inspected/assessed  identifies and documents in applicable privacy notices and privacy impact assessment, the legal authority applicable to the information system permitting the collection of PII IAW 5 USC 552a, DoDD 5400.11, DoD 5400.11-R, and DoDD 5400.16.','The organization conducting the inspection/assessment obtains and examines the applicable privacy documentation to ensure the organization being inspected/assessed has documented the legal authority that permits the collection of PII, and that such collection is related to, and compatible with, the purpose and scope of the authority described in the privacy documentation.'),\n('003393','draft','2013-11-07','DISA FSO','policy','The organization determines and documents the legal authority that permits the use of personally identifiable information (PII), either generally or in support of a specific program or information system need.','AP-1.2','The organization being inspected/assessed  identifies and documents in applicable privacy notices and privacy impact assessment, the legal authority applicable to the information system permitting the collection of PII IAW 5 USC 552a, DoDD 5400.11, DoD 5400.11-R, and DoDD 5400.16.','The organization conducting the inspection/assessment obtains and examines the applicable privacy documentation to ensure the organization being inspected/assessed has documented the legal authority that permits the use of PII, and that such use is related to, and compatible with, the purpose and scope of the authority described in the privacy documentation.'),\n('003394','draft','2013-11-07','DISA FSO','policy','The organization determines and documents the legal authority that permits the maintenance of personally identifiable information (PII), either generally or in support of a specific program or information system need.','AP-1.3','The organization being inspected/assessed  identifies and documents in applicable privacy notices and privacy impact assessment, the legal authority applicable to the information system permitting the collection of PII IAW 5 USC 552a, DoDD 5400.11, DoD 5400.11-R, and DoDD 5400.16.','The organization conducting the inspection/assessment obtains and examines the applicable privacy documentation to ensure the organization being inspected/assessed has documented the legal authority that permits the maintenance of PII, and that such maintenance is related to, and compatible with, the purpose and scope of the authority described in the privacy documentation.'),\n('003395','draft','2013-11-07','DISA FSO','policy','The organization determines and documents the legal authority that permits the sharing of personally identifiable information (PII), either generally or in support of a specific program or information system need.','AP-1.4','The organization being inspected/assessed  identifies and documents in applicable privacy notices and privacy impact assessment, the legal authority applicable to the information system permitting the collection of PII IAW 5 USC 552a, DoDD 5400.11, DoD 5400.11-R, and DoDD 5400.16.','The organization conducting the inspection/assessment obtains and examines the applicable privacy documentation to ensure the organization being inspected/assessed has documented the legal authority that permits the dissemination or sharing of PII, and that such dissemination or sharing is related to, and compatible with, the purpose and scope of the authority described in the privacy documentation.'),\n('003396','draft','2013-11-07','DISA FSO','policy','The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is collected.','AP-2.1','The organization being inspected/assessed  ensures the PII collected by the specific program or information system is related to, and compatible with, the purpose and scope of the authority described in the privacy documentation, for example, but not limited to, the Privacy Act system of records notice (SORN) or Privacy Impact Assessment (PIA).   The privacy documentation shall be IAW 5 USC 552a, DoDD 5400.11, DoD 5400.11-R, Section 208 of the E-Gov Act of 2002 (Public Law 107-347) and DoDI 5400.16.','The organization conducting the inspection/assessment obtains and examines the applicable privacy notices and privacy impact assessment to ensure the organization being inspected/assessed describes, in its privacy notices, the purpose(s) for which PII is collected.'),\n('003397','draft','2013-11-07','DISA FSO','policy','The organization appoints a Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO) accountable for developing, implementing, and maintaining an organization-wide governance and privacy program to ensure compliance with all applicable laws and regulations regarding the collection, use, maintenance, sharing, and disposal of personally identifiable information (PII) by programs and information systems.','AR-1.1','The Senior Agency Official for Privacy (SAOP) is appointed at the DoD enterprise level.   The SAOP is accountable for developing, implementing and maintaining the DoD-enterprise level governance and privacy program, which can be augmented with a Component level guidance and privacy program.\\n\\n\\nThe Component Senior Official for Privacy is accountable for developing, implementing and maintaining the Component level governance and privacy program.\\n\\nThe organization being inspected/assessed appoints and documents a Component Senior Official for privacy.','The organization conducting the inspection/assessment obtains and examines the applicable privacy documentation to ensure the organization being inspected/assessed has document the appointment of component Senior Official for privacy.'),\n('003398','draft','2013-11-07','DISA FSO','policy','The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is used.','AP-2.2','The organization being inspected/assessed  ensures the PII collected by the specific program or information system is related to, and compatible with, the purpose and scope of the authority described in the privacy documentation, for example, but not limited to, the Privacy Act system of records notice (SORN) or Privacy Impact Assessment (PIA).   The privacy documentation shall be IAW 5 USC 552a, DoDD 5400.11, DoD 5400.11-R, Section 208 of the E-Gov Act of 2002 (Public Law 107-347) and DoDI 5400.16.','The organization conducting the inspection/assessment obtains and examines the applicable privacy notices and privacy impact assessment to ensure the organization being inspected/assessed describes, in its privacy notices, the purpose(s) for which PII is used.'),\n('003399','draft','2013-11-07','DISA FSO','policy','The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is maintained.','AP-2.3','The organization being inspected/assessed  ensures the PII collected by the specific program or information system is related to, and compatible with, the purpose and scope of the authority described in the privacy documentation, for example, but not limited to, the Privacy Act system of records notice (SORN) or Privacy Impact Assessment (PIA).   The privacy documentation shall be IAW 5 USC 552a, DoDD 5400.11, DoD 5400.11-R, Section 208 of the E-Gov Act of 2002 (Public Law 107-347) and DoDI 5400.16.','The organization conducting the inspection/assessment obtains and examines the applicable privacy notices and privacy impact assessment to ensure the organization being inspected/assessed describes, in its privacy notices, the purpose(s) for which PII is maintained.'),\n('003400','draft','2013-11-07','DISA FSO','policy','The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is shared.','AP-2.4','The organization being inspected/assessed  ensures the PII collected by the specific program or information system is related to, and compatible with, the purpose and scope of the authority described in the privacy documentation, for example, but not limited to, the Privacy Act system of records notice (SORN) or Privacy Impact Assessment (PIA).   The privacy documentation shall be IAW 5 USC 552a, DoDD 5400.11, DoD 5400.11-R, Section 208 of the E-Gov Act of 2002 (Public Law 107-347) and DoDI 5400.16.','The organization conducting the inspection/assessment obtains and examines the applicable privacy notices and privacy impact assessment to ensure the organization being inspected/assessed describes, in its privacy notices, the purpose(s) for which PII is shared.'),\n('003401','draft','2013-11-07','DISA FSO','policy','The organization monitors federal privacy laws and policy for changes that affect the privacy program.','AR-1.2','The organization being inspected/assessed documents and implements a repeatable business process by which it  monitors federal privacy laws and policy for changes that affect the privacy program.','The organization conducting the inspection/assessment obtains and examines the applicable privacy documentation to ensure the organization being inspected/assessed has a documented repeatable business process by which it  monitors federal privacy laws and policy for changes that affect the privacy program.'),\n('003402','draft','2013-11-07','DISA FSO','policy','The organization defines the allocation of budget resources sufficient to implement and operate the organization-wide privacy program.','AR-1.3','The organization being inspected/assessed defines and documents the allocation of budget resources sufficient to implement and operate the organization-wide privacy program.\\n\\nDoD has determined the allocation of budget resources is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented allocation to ensure the organization being inspected/assessed defines the allocation of budget resources sufficient to implement and operate the organization-wide privacy program.\\n\\nDoD has determined the allocation of budget resources is not appropriate to define at the Enterprise level.'),\n('003403','draft','2013-11-07','DISA FSO','policy','The organization defines the allocation of staffing resources sufficient to implement and operate the organization-wide privacy program.','AR-1.4','The organization being inspected/assessed defines and documents  the allocation of staffing resources sufficient to implement and operate the organization-wide privacy program.\\n\\nDoD has determined the allocation of staffing resources is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented allocation to ensure the organization being inspected/assessed defines the allocation of staffing resources sufficient to implement and operate the organization-wide privacy program.\\n\\nDoD has determined the allocation of staffing resources is not appropriate to define at the Enterprise level.'),\n('003404','draft','2013-11-07','DISA FSO','policy','The organization allocates sufficient organization-defined budget resources to implement and operate the organization-wide privacy program.','AR-1.5','The organization being inspected/assessed documents and implements a process for the allocation of sufficient organization-defined budget resources to implement and operate the organization-wide privacy program.','The organization conducting the inspection/assessment obtains and examines the applicable privacy documentation to ensure the organization being inspected/assessed has documents which demonstrate  allocation of sufficient organization-defined budget resources to implement and operate the organization-wide privacy program.'),\n('003405','draft','2013-11-07','DISA FSO','policy','The organization allocates sufficient organization-defined staffing resources to implement and operate the organization-wide privacy program.','AR-1.6','The organization being inspected/assessed documents and implements a process for the allocation of sufficient organization-defined staffing resources to implement and operate the organization-wide privacy program.','The organization conducting the inspection/assessment obtains and examines the applicable privacy documentation to ensure the organization being inspected/assessed has documents which demonstrate  allocation of sufficient organization-defined staffing resources to implement and operate the organization-wide privacy program.'),\n('003406','draft','2013-11-07','DISA FSO','policy','The organization develops a strategic organizational privacy plan for implementing applicable privacy controls, policies, and procedures.','AR-1.7','The organization being inspected/assessed documents and implements a strategic organizational privacy plan for implementing applicable privacy controls, policies, and procedures.\\n\\nThe DoD has determined that this CCI is not applicable until the policy is issued.','The organization conducting the inspection/assessment obtains and examines the applicable privacy documentation to ensure the organization being inspected/assessed has documents which demonstrate a strategic organizational privacy plan for implementing applicable privacy controls, policies, and procedures.\\n\\nThe DoD has determined that this CCI is not applicable until the policy is issued.'),\n('003407','draft','2013-11-07','DISA FSO','policy','The organization develops operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).','AR-1.8','The organization being inspected/assessed documents and implements operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving PII.','The organization conducting the inspection/assessment obtains and examines the applicable privacy documentation to ensure the organization being inspected/assessed has documents which demonstrate operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving PII.'),\n('003408','draft','2013-11-07','DISA FSO','policy','The organization disseminates operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).','AR-1.9','The organization being inspected/assessed disseminates via an information sharing capability, operational privacy policies and procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving PII.','The organization conducting the inspection/assessment obtains and examines the  operational privacy policies and procedures via the organization\\'s information sharing capability to ensure the organization being inspected/assessed  disseminates operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving PII and procedures which implement these policies.'),\n('003409','draft','2013-11-07','DISA FSO','policy','The organization implements operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).','AR-1.10','The organization being inspected/assessed documents and implements operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving PII.','The organization conducting the inspection/assessment obtains and examines the operational privacy policies  to ensure the organization being inspected/assessed  implements operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving PII.'),\n('003410','draft','2013-11-07','DISA FSO','policy','The organization develops operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).','AR-1.11','The organization being inspected/assessed defines and documents operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving PII.','The organization conducting the inspection/assessment obtains and examines the documented operational privacy procedures to ensure the organization being inspected/assessed develops operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving PII.'),\n('003411','draft','2013-11-07','DISA FSO','policy','The organization disseminates operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).','AR-1.12','The organization being inspected/assessed disseminates via an information sharing capability, the operational privacy procedures which implement the applicable privacy and security controls for programs, information systems, or technologies involving PII.','The organization conducting the inspection/assessment obtains and examines via the organization\\'s information sharing capability the operational privacy procedures to ensure it has been disseminated.'),\n('003412','draft','2013-11-07','DISA FSO','policy','The organization implements operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).','AR-1.13','The organization being inspected/assessed documents and implements operational privacy procedures which implement the applicable privacy and security controls for programs, information systems, or technologies involving PII.','The organization conducting the inspection/assessment obtains and examines the operational privacy procedures to ensure the organization being inspected/assessed  implements operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving PII.'),\n('003413','draft','2013-11-07','DISA FSO','policy','The organization defines the frequency, minimally biennially, on which the privacy plan, policies, and procedures are to be updated.','AR-1.14','DoD has defined the frequency as at a minimum, biennially.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as at a minimum, biennially.'),\n('003414','draft','2013-11-07','DISA FSO','policy','The organization updates the privacy plan per organization-defined frequency.','AR-1.15','The organization being inspected/assessed updates the privacy plan at a minimum, biennially.\\n\\nThe organization must maintain records of updates.\\n\\nDoD has defined the frequency as at a minimum, biennially.','The organization conducting the inspection/assessment obtains and examines records of updates to ensure the organization being inspected/assessed updates the privacy plan at a minimum, biennially.\\n\\nDoD has defined the frequency as at a minimum, biennially.'),\n('003415','draft','2013-11-07','DISA FSO','policy','The organization updates the privacy policies per organization-defined frequency.','AR-1.16','The organization being inspected/assessed updates the privacy policies at a minimum, biennially.\\n\\nThe organization must maintain records of updates.\\n\\nDoD has defined the frequency as at a minimum, biennially.','The organization conducting the inspection/assessment obtains and examines records of updates to ensure the organization being inspected/assessed updates the privacy policies at a minimum, biennially.\\n\\nDoD has defined the frequency as at a minimum, biennially.'),\n('003416','draft','2013-11-07','DISA FSO','policy','The organization updates the privacy procedures per organization-defined frequency.','AR-1.17','The organization being inspected/assessed updates privacy procedures at a minimum, biennially.\\n\\nThe organization must maintain records of updates.\\n\\nDoD has defined the frequency as at a minimum, biennially.','The organization conducting the inspection/assessment obtains and examines records of updates to ensure the organization being inspected/assessed updates privacy procedures at a minimum, biennially.\\n\\nDoD has defined the frequency as at a minimum, biennially.'),\n('003417','draft','2013-11-07','DISA FSO','policy','The organization documents a privacy risk management process which assesses the privacy risk to individuals.','AR-2.1','The organization being inspected/assessed documents a privacy risk management process which assesses the privacy risk to individuals.','The organization conducting the inspection/assessment obtains and examines the documented privacy risk management process which assesses the privacy risk to individuals.'),\n('003418','draft','2013-11-07','DISA FSO','policy','The organization implements a privacy risk management process which assesses the privacy risk to individuals.','AR-2.2','The organization being inspected/assessed  implements a privacy risk management process which assesses the privacy risk to individuals.','The organization conducting the inspection/assessment obtains and examines the documents which implement a privacy risk management process which assesses the privacy risk to individuals.'),\n('003419','draft','2013-11-07','DISA FSO','policy','The organization^s privacy risk management process assesses the privacy risk to individuals resulting from the collection of personally identifiable information (PII).','AR-2.3','The organization being inspected/assessed documents a privacy risk management process which assesses the privacy risk to individuals resulting from the collection of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)','The organization conducting the inspection/assessment obtains and examines the documented privacy risk management process which assesses the privacy risk to individuals resulting from the collection of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)'),\n('003420','draft','2013-11-07','DISA FSO','policy','The organization^s privacy risk management process assesses the privacy risk to individuals resulting from the sharing of personally identifiable information (PII).','AR-2.4','The organization being inspected/assessed documents a privacy risk management process which assesses the privacy risk to individuals resulting from t sharing of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)','The organization conducting the inspection/assessment obtains and examines the documented privacy risk management process which assesses the privacy risk to individuals resulting from the sharing of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)'),\n('003421','draft','2013-11-07','DISA FSO','policy','The organization^s privacy risk management process assesses the privacy risk to individuals resulting from the storing of personally identifiable information (PII).','AR-2.5','The organization being inspected/assessed documents a privacy risk management process which assesses the privacy risk to individuals resulting from the storing of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)','The organization conducting the inspection/assessment obtains and examines the documented privacy risk management process which assesses the privacy risk to individuals resulting from the storing of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)'),\n('003422','draft','2013-11-07','DISA FSO','policy','The organization^s privacy risk management process assesses the privacy risk to individuals resulting from the transmitting of personally identifiable information (PII).','AR-2.6','The organization being inspected/assessed documents a privacy risk management process which assesses the privacy risk to individuals resulting from the transmitting of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)','The organization conducting the inspection/assessment obtains and examines the documented privacy risk management process which assesses the privacy risk to individuals resulting from the transmitting of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)'),\n('003423','draft','2013-11-07','DISA FSO','policy','The organization^s privacy risk management process assesses the privacy risk to individuals resulting from the use of personally identifiable information (PII).','AR-2.7','The organization being inspected/assessed documents a privacy risk management process which assesses the privacy risk to individuals resulting from the use of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)','The organization conducting the inspection/assessment obtains and examines the documented privacy risk management process which assesses the privacy risk to individuals resulting from the use of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)'),\n('003424','draft','2013-11-07','DISA FSO','policy','The organization^s privacy risk management process assesses the privacy risk to individuals resulting from the disposal of personally identifiable information (PII).','AR-2.8','The organization being inspected/assessed documents a privacy risk management process which assesses the privacy risk to individuals resulting from the disposal of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)','The organization conducting the inspection/assessment obtains and examines the documented privacy risk management process which assesses the privacy risk to individuals resulting from the disposal of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)'),\n('003425','draft','2013-11-07','DISA FSO','policy','The organization conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.','AR-2.9','The organization being inspected/assessed documents and implements a process to conduct Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.\\n\\nOnly applies to non national security systems.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.'),\n('003426','draft','2013-11-07','DISA FSO','policy','The organization establishes privacy roles for contractors.','AR-3.1','The organization being inspected/assessed establishes and documents privacy roles for contractors.','The organization conducting the inspection/assessment obtains and examines the documented privacy roles for contractors.'),\n('003427','draft','2013-11-07','DISA FSO','policy','The organization establishes privacy responsibilities for contractors.','AR-3.2','The organization being inspected/assessed establishes and documents privacy responsibilities for contractors.','The organization conducting the inspection/assessment obtains and examines the documented privacy responsibilities for contractors.'),\n('003428','draft','2013-11-07','DISA FSO','policy','The organization establishes access requirements for contractors.','AR-3.3','The organization being inspected/assessed establishes and documents access requirements for contractors.','The organization conducting the inspection/assessment obtains and examines the access requirements for contractors.'),\n('003429','draft','2013-11-07','DISA FSO','policy','The organization establishes privacy roles for service providers.','AR-3.4','The organization being inspected/assessed establishes and documents privacy roles for service providers.','The organization conducting the inspection/assessment obtains and examines the privacy roles established for service providers.'),\n('003430','draft','2013-11-07','DISA FSO','policy','The organization establishes privacy responsibilities for service providers.','AR-3.5','The organization being inspected/assessed  establishes and documents privacy responsibilities for service providers.','The organization conducting the inspection/assessment obtains and examines the privacy responsibilities established for service providers.'),\n('003431','draft','2013-11-07','DISA FSO','policy','The organization establishes access requirements for service providers.','AR-3.6','The organization being inspected/assessed  establishes and documents access requirements  for service providers.','The organization conducting the inspection/assessment obtains and examines the access requirements established for service providers.'),\n('003432','draft','2013-11-07','DISA FSO','policy','The organization includes privacy requirements in contracts.','AR-3.7','The organization being inspected/assessed includes the privacy requirements from Federal Acquisition Regulation Subpart 24.1, 48 CFR Part 24 and Part 39.105, and DoDD 5400.11 in contracts.','The organization conducting the inspection/assessment obtains and examines a representative sample and business procedures which ensure all contracts include the privacy requirements from Federal Acquisition Regulation Subpart 24.1, 48 CFR Part 24 and Part 39.105, and DoDD 5400.11.'),\n('003433','draft','2013-11-07','DISA FSO','policy','The organization includes privacy requirements in other acquisition-related documents.','AR-3.8','The organization being inspected/assessed includes the privacy requirements from Federal Acquisition Regulation Subpart 24.1, 48 CFR Part 24 and Part 39.105, and DoDD 5400.11 in other acquisition-related documents.','The organization conducting the inspection/assessment obtains and examines the business procedures and a representative sample of the documents to demonstrate all  other acquisition-related documents applicable to the information system include the privacy requirements from Federal Acquisition Regulation Subpart 24.1, 48 CFR Part 24 and Part 39.105, and DoDD 5400.11.'),\n('003434','deprecated','2013-11-07','DISA FSO','policy','The organization defines the frequency for monitoring privacy controls and internal privacy policy to ensure effective implementation.','AR-4.1','DoD has defined the frequency as upon a change in the privacy, security or authorization posture of the system and not to exceed every three years.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as upon a change in the privacy, security or authorization posture of the system and not to exceed every three years.'),\n('003435','draft','2013-11-07','DISA FSO','policy','The organization defines the frequency for auditing privacy controls and internal privacy policy to ensure effective implementation.','AR-4.2','DoD has defined the frequency as every three years or as required by major system change.\\n\\nDoD has defined the frequency as upon a change in the privacy, security or authorization posture of the system and not to exceed every three years.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as every three years or as required by major system change.\\n\\nDoD has defined the frequency as upon a change in the privacy, security or authorization posture of the system and not to exceed every three years.'),\n('003436','draft','2013-11-07','DISA FSO','policy','The organization monitors privacy controls, per organization-defined frequency, to ensure effective implementation.','AR-4.3','The organization being inspected/assessed documents and implements a process to monitor privacy controls to ensure effective implementation.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed monitors privacy controls to ensure effective implementation.'),\n('003437','draft','2013-11-07','DISA FSO','policy','The organization monitors internal privacy policy to ensure effective implementation.','AR-4.4','The organization being inspected/assessed documents and implements a process to monitor internal privacy policy to ensure effective implementation.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed monitors internal privacy policy to ensure effective implementation.'),\n('003438','draft','2013-11-07','DISA FSO','policy','The organization audits privacy controls, per organization-defined frequency, to ensure effective implementation.','AR-4.5','The organization being inspected/assessed documents and implements a process to audit  privacy controls, every three years or as required by major system change, to ensure effective implementation.\\n\\nThe organization must maintain an audit trail.\\n\\nDoD has defined the frequency as every three years or as required by major system change.\\n\\nDoD has defined the frequency as upon a change in the privacy, security or authorization posture of the system and not to exceed every three years.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail to ensure the organization being inspected/assessed audits privacy controls, every three years or as required by major system change, to ensure effective implementation.\\n\\nDoD has defined the frequency as every three years or as required by major system change.\\n\\nDoD has defined the frequency as upon a change in the privacy, security or authorization posture of the system and not to exceed every three years.'),\n('003439','draft','2013-11-07','DISA FSO','policy','The organization audits internal privacy policy, per organization-defined frequency, to ensure effective implementation.','AR-4.6','The organization being inspected/assessed documents and implements a process to audit  privacy controls, every three years or as required by major system change, to ensure effective implementation.\\n\\nThe organization must maintain an audit trail.\\n\\nDoD has defined the frequency as every three years or as required by major system change.\\n\\nDoD has defined the frequency as upon a change in the privacy, security or authorization posture of the system and not to exceed every three years.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail to ensure the organization being inspected/assessed audits privacy controls, every three years or as required by major system change, to ensure effective implementation.\\n\\nDoD has defined the frequency as every three years or as required by major system change.\\n\\nDoD has defined the frequency as upon a change in the privacy, security or authorization posture of the system and not to exceed every three years.'),\n('003440','draft','2013-11-07','DISA FSO','policy','The organization develops a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.','AR-5.1','The organization being inspected/assessed documents whether the IASE PII Training provides personnel with the information necessary to understand their roles and responsibilities, or if additional organization-specific training is required.  If organization-specific training is required, the organization being inspected/assessed defines and documents  the unique privacy needs which must be addressed by training.','The organization conducting the inspection/assessment obtains and examines the documented evidence of a review as to whether the IASE provided PII training provides personnel with the information necessary to understand their roles and responsibilities.  If the documented review indicates that organization-specific training is necessary, then the organization conducting the inspection/assessment obtains and examines documentation identifying the unique privacy needs which must be addressed by training to ensure they are identified.'),\n('003441','draft','2013-11-07','DISA FSO','policy','The organization implements a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.','AR-5.2','If the organization being inspected/assessed identifies IAW AR-5, CCI 3440 that IASE provided PII training meets the needs of the organization then the organization is automatically compliant.  Otherwise, the organization being inspected/assessed documents and implements a  comprehensive training and awareness strategy  aimed at ensuring that personnel understand privacy responsibilities and procedures.','The organization conducting the inspection/assessment obtains and examines the documented results of the review conducted IAW AR-5, CCI 3440.  If the review indicates that IASE provided PII training meets the needs of the organization then the organization is automatically compliant.  Otherwise, the organization conducting the inspection/assessment obtains and examines the documented training and awareness strategy to ensure that it implements training aimed at ensuring that personnel understand privacy responsibilities and procedures.'),\n('003442','draft','2013-11-07','DISA FSO','policy','The organization updates a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.','AR-5.3','If the organization being inspected/assessed identifies IAW AR-5, CCI 3440 that IASE provided PII training meets the needs of the organization then the organization is automatically compliant.  Otherwise, the organization being inspected/assessed documents and implements  a process to update the comprehensive training and awareness strategy.','The organization conducting the inspection/assessment obtains and examines the documented results of the review conducted IAW AR-5, CCI 3440.  If the review indicates that IASE provided PII training meets the needs of the organization then the organization is automatically compliant.  Otherwise, the organization conducting the inspection/assessment obtains and examines the documented update process for the training and awareness strategy to ensure that the organization being inspected/assessed updates the strategy.'),\n('003443','draft','2013-11-07','DISA FSO','policy','The organization defines the frequency, minimally annually, for administering its basic privacy training.','AR-5.4','The organization being inspected/assessed documents whether the IASE PII Training provides personnel with the information necessary to understand their roles and responsibilities, or if additional organization-specific training is required.  If organization-specific training is required, the organization being inspected/assessed defines and documents  the unique privacy needs which must be addressed by training.','The organization conducting the inspection/assessment obtains and examines the documented evidence of a review as to whether the IASE provided PII training provides personnel with the information necessary to understand their roles and responsibilities.  If the documented review indicates that organization-specific training is necessary, then the organization conducting the inspection/assessment obtains and examines documentation identifying the unique privacy needs which must be addressed by training to ensure they are identified.'),\n('003444','draft','2013-11-07','DISA FSO','policy','The organization defines the frequency, minimally annually, for administering the targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII.','AR-5.5','If the organization being inspected/assessed identifies IAW AR-5, CCI 3440 that IASE provided PII training meets the needs of the organization then the organization is automatically compliant.  Otherwise, the organization being inspected/assessed documents and implements a  comprehensive training and awareness strategy  aimed at ensuring that personnel understand privacy responsibilities and procedures.','The organization conducting the inspection/assessment obtains and examines the documented results of the review conducted IAW AR-5, CCI 3440.  If the review indicates that IASE provided PII training meets the needs of the organization then the organization is automatically compliant.  Otherwise, the organization conducting the inspection/assessment obtains and examines the documented training and awareness strategy to ensure that it implements training aimed at ensuring that personnel understand privacy responsibilities and procedures.'),\n('003445','draft','2013-11-07','DISA FSO','policy','The organization administers basic privacy training per the organization-defined frequency.','AR-5.6','If the organization being inspected/assessed identifies IAW AR-5, CCI 3440 that IASE provided PII training meets the needs of the organization then the organization is automatically compliant.  Otherwise, the organization being inspected/assessed documents and implements  a process to update the comprehensive training and awareness strategy.','The organization conducting the inspection/assessment obtains and examines the documented results of the review conducted IAW AR-5, CCI 3440.  If the review indicates that IASE provided PII training meets the needs of the organization then the organization is automatically compliant.  Otherwise, the organization conducting the inspection/assessment obtains and examines the documented update process for the training and awareness strategy to ensure that the organization being inspected/assessed updates the strategy.'),\n('003446','draft','2013-11-07','DISA FSO','policy','The organization administers, per organization-defined frequency, targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII.','AR-5.7','The organization follows its strategy and plan for administering targeted, role-based privacy training.','The organization conducting the inspection/assessment reviews evidence of the organization being inspected providing annual targeted, role-based privacy training.   DoD Components that have determined and documented adequate justification that DoD-wide privacy training and awareness activities provide evidence to demonstrate its personnel are taking this training annually.'),\n('003447','draft','2013-11-07','DISA FSO','policy','The organization defines the frequency, minimally annually, on which personnel certify acceptance of responsibilities for privacy requirements.','AR-5.8','DoD has defined the frequency as annually.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as annually.'),\n('003448','draft','2013-11-07','DISA FSO','policy','The organization ensures personnel certify (manually or electronically) acceptance of responsibilities for privacy requirements per organization-defined frequency.','AR-5.9','The organization being inspected/assessed must ensure that personnel certify (manually or electronically) acceptance of responsibilities for privacy requirements at least annually. This can be achieved either through inclusion of these requirements within and annually recertifying their existing AUP, or via a separate acceptance method.','The organization conducting the inspection/assessment obtains and examines the documented results of the review conducted IAW AR-5, CCI 3440.  If the review indicates that IASE provided PII training meets the needs of the organization then the organization is automatically compliant.  Otherwise, the organization conducting the inspection/assessment obtains and examines the documented certification process as well as a representative sample of employee certification records to ensure that the organization being inspected/assessed ensures personnel certify (manually or electronically) acceptance of responsibilities for privacy requirements per organization-defined frequency.'),\n('003449','draft','2013-11-07','DISA FSO','policy','The organization develops reports for the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.','AR-6.1','The organization being inspected/assessed documents and implements a process to provide all input required by Defense Privacy and Civil Liberties Office (DPLCO), DA&M and/or the OCIO to support the reporting OMB, Congress and the other oversight bodies.','The organization conducting the inspection/assessment obtains and examines the documented process as well as reports generated to ensure the organization being inspected/assessed provides all input required by Defense Privacy and Civil Liberties Office (DPLCO), DA&M and/or the OCIO to support the reporting OMB, Congress and the other oversight bodies.'),\n('003450','draft','2013-11-07','DISA FSO','policy','The organization disseminates reports to the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.','AR-6.2','Only designated officials, such as the Senior Agency Official for Privacy (SAOP), respond to external reporting requirements on behalf of the DoD. The Defense Civil Liberties and Privacy Office (DPCLO) meets the requirement to disseminate reports to the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.\\n\\nDoD Components are automatically compliant with this control because they are covered by the DPCLO and the action is performed by the DA&M and/or OCIO.','The DPCLO meets the requirement to disseminate reports to the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.\\n\\nDoD Components are automatically compliant with this control because they are covered by the DPCLO and the action is performed by the DA&M and/or OCIO.'),\n('003451','draft','2013-11-07','DISA FSO','policy','The organization updates reports for the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.','AR-6.3','The organization being inspected/assessed provides the necessary inputs to external privacy reports as mandated by the DPCLO and OCIO to ensure the organization being inspected/assessed  updates reports for the OMB, Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.','The organization conducting the inspection/assessment  reviews evidence of contributions of updated inputs to external privacy reports as mandated by the DPCLO and OCIO to ensure the organization being inspected/assessed  updates reports for the OMB, Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.'),\n('003452','draft','2013-11-07','DISA FSO','policy','The organization develops reports for senior management and other personnel with responsibility for monitoring privacy program progress and compliance.','AR-6.4','The organization being inspected/assessed provides the necessary inputs to support DoD\\'s internal privacy reporting requirements.  For example, DoD Components are required to report to the Defense Privacy Office the status and metrics for internal periodic Privacy Act System of Records Notices (SORN) reviews.  DoD 5400.11-R, sections C8.1-3 establish policy for DoD Component compliance DPCLO requirements for DoD Privacy Reports.','The organization conducting the inspection/assessment  reviews evidence of contributions to internal privacy reports as mandated by the DPLCO and OCIO to ensure the organization being inspected/assessed develops reports for senior management and other personnel with responsibility for monitoring privacy program progress and compliance.'),\n('003453','draft','2013-11-07','DISA FSO','policy','The organization disseminates reports to senior management and other personnel with responsibility for monitoring privacy program progress and compliance.','AR-6.5','The organization being inspected/assessed provides the necessary inputs to support DoD\\'s internal privacy reports to the appropriate personnel in a timely manner.','The organization conducting the inspection/assessment  reviews evidence of contributions to internal privacy reports as mandated by the DPCLO and OCIO to ensure the organization being inspected/assessed disseminates reports to senior management and other personnel with responsibility for monitoring privacy program progress and compliance.'),\n('003454','draft','2013-11-07','DISA FSO','policy','The organization updates reports for senior management and other personnel with responsibility for monitoring privacy program progress and compliance.','AR-6.6','The organization being inspected/assessed provides the necessary inputs to support any required updates to DoD\\'s internal privacy reports.','The organization conducting the inspection/assessment  reviews evidence of contributions of updated inputs to internal privacy reports as mandated by the DPCLO and OCIO to ensure the organization being inspected/assessed updates reports for senior management and other personnel with responsibility for monitoring privacy program progress and compliance.'),\n('003455','draft','2013-11-07','DISA FSO','policy','The organization designs information systems to support privacy by automating privacy controls.','AR-7.1','To the extent feasible, when designing information systems, the organization being inspected/assessed employs technologies and system capabilities that automate privacy controls on the collection, use, retention, and disclosure of personally identifiable information (PII).\\n\\nFor example, when sharing records between systems, design the system to only share PII data fields within a record that are relevant to the purpose of sharing rather than sending the entire record (which may contain PII data fields that are not relevant to the purpose for sharing).  Privacy requirements and controls should be identified during the concept and requirements development phases of system design, and design decisions should be documented in appropriate system artifacts throughout (e.g. system design documents, system security plans, interconnection security agreements, and Privacy Impact Assessments).  By building privacy controls into system design and development, DoD Components mitigate privacy risks to PII, thereby reducing the likelihood of information system breaches and other privacy-related incidents. DoD Components also plan for and conduct periodic reviews of systems to determine the need for updates to maintain compliance with the Privacy Act as well as the DoD\\'s and DoD Component\\'s privacy policies. Regardless of whether automated privacy controls are employed, DoD Components regularly monitor information system use and sharing of PII to ensure that the use/sharing is consistent with the authorized purposes identified in the Privacy Act and/or in the public notice of organizations (e.g. System of Records Notices), or in a manner compatible with those purposes.','The organization conducting the inspection/assessment :\\n1. reviews policies and procedures that govern the organization\\'s systems engineering lifecycle to ensure privacy requirements are included in the process.,\\n2. obtains and examines system design documents and examines the information system to ensure it includes automated privacy controls,\\n3. examines plans for periodic reviews to ensure they are commensurate with the privacy risks identified for the system and that they are occurring based on the planned frequency; and\\n4. when available, examines results of reviews and associated action plans to address findings to ensure they are being addressed.'),\n('003456','draft','2013-11-07','DISA FSO','policy','The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the date of each disclosure of a record.','AR-8.1','The organization being inspected/assessed documents and implements a process, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, to include the date of each disclosure of a record.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the date of each disclosure of a record.'),\n('003457','draft','2013-11-07','DISA FSO','policy','The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the nature of each disclosure of a record.','AR-8.2','The organization being inspected/assessed documents and implements a process, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, to include the nature of each disclosure of a record.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the nature of each disclosure of a record.'),\n('003458','draft','2013-11-07','DISA FSO','policy','The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the purpose of each disclosure of a record.','AR-8.3','The organization being inspected/assessed documents and implements a process as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, to include the purpose of each disclosure of a record.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the purpose of each disclosure of a record.'),\n('003459','draft','2013-11-07','DISA FSO','policy','The organization keeps an accurate accounting of disclosures of Privacy Act information held in each system of records under its control.','AR-8.4','The organization being inspected/assessed documents and implements a process to keep an accurate accounting of disclosures of Privacy Act information held in each system of records under its control.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  keeps an accurate accounting of disclosures of Privacy Act information held in each system of records under its control.'),\n('003460','draft','2013-11-07','DISA FSO','policy','The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the name and address of the person or agency to which the disclosure was made.','AR-8.5','The organization being inspected/assessed documents and implements a process, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, to include the name and address of the person or agency to which the disclosure was made.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the name and address of the person or agency to which the disclosure was made.'),\n('003461','draft','2013-11-07','DISA FSO','policy','The organization retains the accounting of disclosures for the life of the record or five years after the disclosure is made, whichever is longer.','AR-8.6','The organization being inspected/assessed documents and implements a process to retain the accounting of disclosures for the life of the record or five years after the disclosure is made, whichever is longer.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  retains the accounting of disclosures for the life of the record or five years after the disclosure is made, whichever is longer.'),\n('003462','draft','2013-11-07','DISA FSO','policy','The organization makes the accounting of disclosures available to the person named in the record upon request.','AR-8.7','The organization being inspected/assessed documents and implements a process to  make the accounting of disclosures available to the person named in the record upon request.\\n\\nNOTE: The system of the record might have an exemption that prevents the accounting of disclosures to the person named in the record. This must be spelled out in the SORN.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed makes the accounting of disclosures available to the person named in the record upon request.\\n\\nNOTE: The system of the record might have an exemption that prevents the accounting of disclosures to the person named in the record. This must be spelled out in the SORN.'),\n('003463','draft','2013-11-07','DISA FSO','policy','The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the accuracy of that information.','DI-1.1','The organization being inspected/assessed documents and implements a process to confirm to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual\\'s rights, benefits, and privileges under Federal programs.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed confirms to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual\\'s rights, benefits, and privileges under Federal programs.'),\n('003464','draft','2013-11-07','DISA FSO','policy','The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the relevancy of that information.','DI-1.2','The organization being inspected/assessed documents and implements a process to confirm to the greatest extent practicable upon collection or creation of PII, the relevancy of that information collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual\\'s rights, benefits, and privileges under Federal programs','The organization being inspected/assessed documents and implements a process to confirm to the greatest extent practicable upon collection or creation of PII, the relevancy of that information collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual\\'s rights, benefits, and privileges under Federal programs'),\n('003465','draft','2013-11-07','DISA FSO','policy','The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the timeliness of that information.','DI-1.3','The organization being inspected/assessed documents and implements a process to confirm to the greatest extent practicable upon collection or creation of PII, the timeliness of that information collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual\\'s rights, benefits, and privileges under Federal programs','The organization being inspected/assessed documents and implements a process to confirm to the greatest extent practicable upon collection or creation of PII, the timeliness of that information collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual\\'s rights, benefits, and privileges under Federal programs'),\n('003466','draft','2013-11-07','DISA FSO','policy','The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the completeness of that information.','DI-1.4','The organization being inspected/assessed documents and implements a process to confirm to the greatest extent practicable upon collection or creation of PII, the completeness of that information collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual\\'s rights, benefits, and privileges under Federal programs.','The organization being inspected/assessed documents and implements a process to confirm to the greatest extent practicable upon collection or creation of PII, the completeness of that information collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual\\'s rights, benefits, and privileges under Federal programs.'),\n('003467','draft','2013-11-07','DISA FSO','policy','The organization collects personally identifiable information (PII) directly from the individual to the greatest extent practicable.','DI-1.5','The organization being inspected/assessed documents and implements a process to collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual\\'s rights, benefits, and privileges under Federal programs.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed collects information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual\\'s rights, benefits, and privileges under Federal programs.'),\n('003468','draft','2013-11-07','DISA FSO','policy','The organization defines the frequency on which it will check for, and correct as necessary, inaccurate or outdated personally identifiable information (PII) used by its programs or systems.','DI-1.6','DoD has defined the frequency as when changes warrant corrections.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as when changes warrant corrections.'),\n('003469','draft','2013-11-07','DISA FSO','policy','The organization checks for, and corrects as necessary, any inaccurate or outdated personally identifiable information (PII) used by its programs or systems on an organization-defined frequency.','DI-1.7','The organization being inspected/assessed documents and implements a process to checks for, and correct as necessary, any inaccurate or outdated PII used by its programs or systems when changes warrant corrections.\\n\\nDoD has defined the frequency as when changes warrant corrections.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  checks for, and corrects as necessary, any inaccurate or outdated PII used by its programs or systems when changes warrant corrections.\\n\\nDoD has defined the frequency as when changes warrant corrections.'),\n('003470','draft','2013-11-07','DISA FSO','policy','The organization issues guidelines ensuring the quality of disseminated Privacy Act information.','DI-1.8','The organization being inspected/assessed defines and issues PII quality assurance guidelines IAW DoD 5400.11-R to ensure accuracy, relevance, timeliness, and completion of PII prior to its dissemination.  Quality guidelines are tailored as necessary for specific programs or systems.','The organization conducting the inspection/assessment  reviews the PII quality guidelines for the organization being inspected/assessed against documentation for the program or system to ensure quality thresholds are being met.'),\n('003471','draft','2013-11-07','DISA FSO','policy','The organization issues guidelines ensuring the utility of disseminated Privacy Act information.','DI-1.9','The organization being inspected/assessed defines and issues PII utility guidelines IAW DoD 5400.11-R.  Utility guidelines are tailored as necessary for specific programs or systems.  Utility of information covered under the Privacy Act is strictly limited to an authorized purpose and need-to-know.  When evaluating options for greater PII utility, consult with the DoD Component\\'s privacy office.','The organization conducting the inspection/assessment  reviews the PII utility guidelines for the organization being inspected/assessed against documentation for the program or system to ensure utility thresholds are being met and that PII is not shared other than as allowed by policy or notice.'),\n('003472','draft','2013-11-07','DISA FSO','policy','The organization issues guidelines ensuring the objectivity of disseminated Privacy Act information.','DI-1.10','The organization being inspected/assessed defines and issues PII objectivity guidelines IAW DoD 5400.11-R.  Objectivity guidelines are tailored as necessary for specific programs or systems.','The organization conducting the inspection/assessment  reviews the PII objectivity guidelines for the organization being inspected/assessed against documentation for the program or system to ensure objectivity thresholds are being met.'),\n('003473','draft','2013-11-07','DISA FSO','policy','The organization issues guidelines ensuring the integrity of disseminated Privacy Act information.','DI-1.11','The organization being inspected/assessed defines and issues PII integrity guidelines IAW DoD 5400.11-R.  Integrity guidelines are tailored as necessary for specific programs or systems.','The organization conducting the inspection/assessment  reviews the PII integrity guidelines for the organization being inspected/assessed against documentation for the program or system to ensure integrity thresholds are being met.'),\n('003474','draft','2013-11-07','DISA FSO','policy','The organization issues guidelines maximizing the quality of disseminated Privacy Act information.','DI-1.12','The organization being inspected/assessed defines and issues PII quality guidelines IAW DoD 5400.11-R.  Quality guidelines are tailored as necessary for specific programs or systems.','The organization conducting the inspection/assessment  reviews the PII quality guidelines for the organization being inspected/assessed against documentation for the program or system to ensure quality thresholds are being met.'),\n('003475','draft','2013-11-07','DISA FSO','policy','The organization issues guidelines maximizing the utility of disseminated Privacy Act information.','DI-1.13','The organization being inspected/assessed defines and issues PII utility guidelines IAW DoD 5400.11-R.  Utility guidelines are tailored as necessary for specific programs or systems.  Utility of information covered under the Privacy Act is strictly limited to an authorized purpose and need-to-know.  When evaluating options for greater PII utility, consult with the DoD Component\\'s privacy office.','The organization conducting the inspection/assessment  reviews the PII utility guidelines for the organization being inspected/assessed against documentation for the program or system to ensure utility thresholds are being met and that PII is not shared other than as allowed by policy or notice.'),\n('003476','draft','2013-11-07','DISA FSO','policy','The organization issues guidelines maximizing the objectivity of disseminated Privacy Act information.','DI-1.14','The organization being inspected/assessed defines and issues PII objectivity guidelines IAW DoD 5400.11-R.  Objectivity guidelines are tailored as necessary for specific programs or systems.','The organization conducting the inspection/assessment  reviews the PII objectivity guidelines for the organization being inspected/assessed against documentation for the program or system to ensure objectivity thresholds are being met.'),\n('003477','draft','2013-11-07','DISA FSO','policy','The organization issues guidelines maximizing the integrity of disseminated Privacy Act information.','DI-1.15','The organization being inspected/assessed defines and issues PII integrity guidelines IAW DoD 5400.11-R.  Integrity guidelines are tailored as necessary for specific programs or systems.','The organization conducting the inspection/assessment  reviews the PII integrity guidelines for the organization being inspected/assessed against documentation for the program or system to ensure integrity thresholds are being met.'),\n('003478','draft','2013-11-07','DISA FSO','policy','The organization requests the individual or individual^s authorized representative validate personally identifiable information (PII) during the collection process.','DI-1(1).1','The organization being inspected/assessed documents and implements a process to request the individual or individual\\'s authorized representative validate PII during the collection process.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requests the individual or individual\\'s authorized representative validate PII during the collection process.'),\n('003479','draft','2013-11-07','DISA FSO','policy','The organization defines the frequency on which it will request the individual, or individual^s authorized representative, revalidate that personally identifiable information (PII) collected is still accurate.','DI-1(2).1','The organization being inspected/assessed defines and documents the frequency on which it  will request the individual, or individual\\'s authorized representative, revalidate that PII collected is still accurate.  The frequency should be as often as is necessary to ensure the PII is accurate, relevant, timely, and complete; commensurate with the impact of the determination to an individual\\'s rights, benefits, or privileges as determined by the system owner in consultation with the organization\\'s privacy office.\\n\\nDoD has determined the frequency is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed defines and documents the frequency on which it will request the individual, or individual\\'s authorized representative, revalidate that PII collected is still accurate.\\n\\nDoD has determined the frequency is not appropriate to define at the Enterprise level.'),\n('003480','draft','2013-11-07','DISA FSO','policy','On an organization-defined frequency, the organization requests the individual, or individual^s authorized representative, revalidate that personally identifiable information (PII) collected is still accurate.','DI-1(2).2','The organization being inspected/assessed documents and implements a process to request the individual, or individual\\'s authorized representative, revalidate that PII collected is still accurate, as frequently as is necessary to ensure the PII is accurate, relevant, timely, and complete; commensurate with the impact of the determination to an individual\\'s rights, benefits, or privileges as determined by the system owner in consultation with the organization\\'s privacy office.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requests the individual, or individual\\'s authorized representative, revalidate that PII collected is still accurate. as frequently as is necessary to ensure the PII is accurate, relevant, timely, and complete; commensurate with the impact of the determination to an individual\\'s rights, benefits, or privileges as determined by the system owner in consultation with the organization\\'s privacy office.'),\n('003481','draft','2013-11-07','DISA FSO','policy','The organization documents processes to ensure the integrity of personally identifiable information (PII) through existing security controls.','DI-2.1','The organization being inspected/assessed documents and implements the necessary security controls to protect the integrity of PII it maintains.  Selection of security controls should be documented in relevant security documentation.\\n\\nNOTE: This applies to the security control for systems involved in computer matching agreements.','The organization conducting the inspection/assessment obtains and examines  system documentation that discusses the selection of security controls and their relevance to privacy and confirms controls are in place for systems that maintain PII.\\n\\nNOTE: This applies to the security control for systems involved in computer matching agreements.'),\n('003482','draft','2013-11-07','DISA FSO','policy','The organization, when appropriate, establishes a Data Integrity Board.','DI-2.2','The Defense Privacy and Civil Liberties Office (DPCLO) is responsible for meeting the requirements to establish a Data Integrity Board.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DPCLO.','The DPCLO is responsible for meeting the requirements to establish a Data Integrity Board.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DPCLO.'),\n('003483','draft','2013-11-07','DISA FSO','policy','The organization^s Data Integrity Board oversees the organizational Computer Matching Agreements.','DI-2.3','The Defense Privacy and Civil Liberties Office (DPCLO) is responsible for the Data Integrity Board overseeing the organizational Computer Matching Agreements.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DPCLO.','The DPCLO is responsible for the Data Integrity Board overseeing the organizational Computer Matching Agreements.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DPCLO.'),\n('003484','draft','2013-11-07','DISA FSO','policy','The organization^s Data Integrity Board ensures the Computer Matching Agreements comply with the computer matching provisions of the Privacy Act.','DI-2.4','The Defense Privacy and Civil Liberties Office (DPCLO) is responsible for the Data Integrity Board ensuring the Computer Matching Agreements comply with the computer matching provisions of the Privacy Act.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DPCLO.','The DPCLO is responsible for the Data Integrity Board ensuring the Computer Matching Agreements comply with the computer matching provisions of the Privacy Act.\\n\\nDoD Components are automatically compliant with this CCI because they are covered by the DPCLO.'),\n('003485','draft','2013-11-07','DISA FSO','policy','The organization publishes Computer Matching Agreements on its public website.','DI-2(1).1','The Defense Privacy and Civil Liberties Office (DPCLO) is responsible for publishing Computer Matching Agreements on its public website.\\n\\nDoD Components are automatically compliant with this control because they are covered by the DPCLO.','The Defense Privacy and Civil Liberties Office (DPCLO) is responsible for publishing Computer Matching Agreements on its public website.\\n\\nDoD Components are automatically compliant with this control because they are covered by the DPCLO.'),\n('003486','draft','2013-11-08','DISA FSO','policy','The organization identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection.','DM-1.1','The organization being inspected/assessed documents and implements a process to identify the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection.'),\n('003487','draft','2013-11-08','DISA FSO','policy','The organization limits the collection and retention of personally identifiable information (PII) to the minimum elements identified for the purposes described in the published privacy notice.','DM-1.2','The organization being inspected/assessed documents and implements a process to limit the collection and retention of PII to the minimum elements identified for the purposes described in the published SORN and Privacy Act Statement.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed limits the collection and retention of PII to the minimum elements identified for the purposes described in the published SORN and Privacy Act Statement.'),\n('003488','draft','2013-11-08','DISA FSO','policy','The organization limits the collection and retention of personally identifiable information (PII) to the minimum elements identified for the purposes which the individual has provided consent.','DM-1.3','The organization being inspected/assessed documents and implements a process to limit the collection and retention of PII to the minimum elements identified for the purposes which the individual has provided consent.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed limits the collection and retention of PII to the minimum elements identified for the purposes which the individual has provided consent.'),\n('003489','draft','2013-11-08','DISA FSO','policy','The organization defines the frequency, minimally annually, for conducting reviews of its personally identifiable information (PII) holdings.','DM-1.4','DoD has defines the frequency as annually as part of the agency\\'s report under FISMA.','DoD has defines the frequency as annually as part of the agency\\'s report under FISMA.'),\n('003490','draft','2013-11-08','DISA FSO','policy','The organization conducts an initial evaluation of personally identifiable information (PII) holdings.','DM-1.5','The organization being inspected/assessed documents and implements a process to conduct an initial evaluation of PII holdings.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed conducts an initial evaluation of PII holdings'),\n('003491','draft','2013-11-08','DISA FSO','policy','The organization establishes a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure that only PII identified in the notice is collected and retained.','DM-1.6','The organization being inspected/assessed  establishes and documents a schedule for regularly reviewing the PII holdings at least annually as part of the agency\\'s report under FISMA to ensure that only PII identified in the notice is collected and retained.\\n\\nDoD has defined the frequency as at least annually as part of the agency\\'s report under FISMA.','The organization conducting the inspection/assessment obtains and examines the documented schedule to ensure the organization being inspected/assessed establishes a schedule for regularly reviewing the PII holdings at least annually as part of the agency\\'s report under FISMA to ensure that only PII identified in the notice is collected and retained.\\n\\nDoD has defined the frequency as at least annually as part of the agency\\'s report under FISMA.'),\n('003492','draft','2013-11-08','DISA FSO','policy','The organization follows a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure that only PII identified in the notice is collected and retained.','DM-1.7','The organization being inspected/assessed documents and implements a process to follow a schedule for regularly reviewing the PII holdings per the frequency defined in DM-1, CCI 3489 to ensure that only PII identified in the notice is collected and retained.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed follows a schedule for regularly reviewing the PII holdings  per the frequency defined in DM-1, CCI 3489 to ensure that only PII identified in the notice is collected and retained.'),\n('003493','draft','2013-11-08','DISA FSO','policy','The organization establishes a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure the PII continues to be necessary to accomplish the legally authorized purpose.','DM-1.8','The organization being inspected/assessed establishes and documents a schedule for regularly reviewing the PII holdings  per the frequency defined in DM-1, CCI 3489 to ensure the PII continues to be necessary to accomplish the legally authorized purpose.','The organization conducting the inspection/assessment obtains and examines the documented schedule to ensure the organization being inspected/assessed establishes a schedule for regularly reviewing the PII holdings  per the frequency defined in DM-1, CCI 3489 to ensure the PII continues to be necessary to accomplish the legally authorized purpose.'),\n('003494','draft','2013-11-08','DISA FSO','policy','The organization follows a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure the PII continues to be necessary to accomplish the legally authorized purpose.','DM-1.9','The organization being inspected/assessed documents and implements a process to follow a schedule for regularly reviewing the PII holdings  per the frequency defined in DM-1, CCI 3489 to ensure the PII continues to be necessary to accomplish the legally authorized purpose.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed follows a schedule for regularly reviewing the PII holdings  per the frequency defined in DM-1, CCI 3489 to ensure the PII continues to be necessary to accomplish the legally authorized purpose.'),\n('003495','draft','2013-11-08','DISA FSO','policy','The organization, where feasible and within the limits of technology, locates and removes/redacts specified personally identifiable information (PII).','DM-1(1).1','The organization being inspected/assessed documents and implements a process to locate and remove/redact specified PII, where feasible and within the limits of technology.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed where feasible and within the limits of technology, locates and removes/redacts specified PII.'),\n('003496','draft','2013-11-08','DISA FSO','policy','The organization, where feasible and within the limits of technology, uses anonymization and de-identification techniques to permit use of the retained Privacy Act information while reducing its sensitivity and reducing the risk resulting from disclosure.','DM-1(1).2','The organization being inspected/assessed documents and implements a process to use anonymization and de-identification techniques, where feasible and within the limits of technology, to permit use of the retained Privacy Act information while reducing its sensitivity and reducing the risk resulting from disclosure.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed, where feasible and within the limits of technology, uses anonymization and de-identification techniques to permit use of the retained Privacy Act information while reducing its sensitivity and reducing the risk resulting from disclosure.'),\n('003497','draft','2013-11-08','DISA FSO','policy','The organization defines the time period for retaining each collection of personally identifiable information (PII) that is required to fulfill the purpose(s) identified in the published privacy notice or required by law.','DM-2.1','The organization being inspected/assessed must define and document the time period IAW the NARA-approved Records Schedule and the Privacy Act System of Records Notice.\\n\\nDoD has determined the time period is not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented time period to ensure the organization being inspected/assessed define and document the time period IAW the NARA-approved Records Schedule and the Privacy Act System of Records Notice.\\n\\nDoD has determined the time period is not appropriate to define at the Enterprise level.'),\n('003498','draft','2013-11-08','DISA FSO','policy','The organization retains each collection of personally identifiable information (PII) for the organization-defined time period to fulfill the purpose(s) identified in the published privacy notice or as required by law.','DM-2.2','The organization being inspected/assessed documents and implements a process to retain each collection of PII for the time period defined DM-2, CCI 3497 to fulfill the purpose(s) identified in the published SORN and Privacy Act Statement or as required by law.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed retains each collection of PII for the time period defined in DM-2, CCI 3497 to fulfill the purpose(s) identified in the published SORN and Privacy Act Statement or as required by law.'),\n('003499','draft','2013-11-08','DISA FSO','policy','The organization disposes of, destroys, erases, and/or anonymizes the personally identifiable information (PII), regardless of the method of storage, in accordance with a NARA-approved record retention schedule.','DM-2.3','The organization being inspected/assessed documents and implements a process to dispose of, destroy, erase, and/or anonymize the PII, regardless of the method of storage, in accordance with a NARA-approved record retention schedule.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed disposes of, destroys, erases, and/or anonymizes the PII, regardless of the method of storage, in accordance with a NARA-approved record retention schedule.'),\n('003500','draft','2013-11-08','DISA FSO','policy','The organization disposes of, destroys, erases, and/or anonymizes the personally identifiable information (PII), regardless of the method of storage, in a manner that prevents loss, theft, misuse, or unauthorized access.','DM-2.4','The organization being inspected/assessed documents and implements a process to dispose of, destroy, erase, and/or anonymize the PII, regardless of the method of storage, in a manner that prevents loss, theft, misuse, or unauthorized access.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed disposes of, destroys, erases, and/or anonymizes the PII, regardless of the method of storage, in a manner that prevents loss, theft, misuse, or unauthorized access.'),\n('003501','draft','2013-11-08','DISA FSO','policy','The organization defines the techniques or methods to be employed to ensure the secure deletion or destruction of personally identifiable information (PII) (including originals, copies, and archived records).','DM-2.5','DoD has defined the techniques or methods as techniques and methods IAW DoD 5400.11-R.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the techniques or methods as techniques and methods IAW DoD 5400.11-R.'),\n('003502','draft','2013-11-08','DISA FSO','policy','The organization uses organization-defined techniques or methods to ensure secure deletion or destruction of personally identifiable information (PII) (including originals, copies, and archived records).','DM-2.6','The organization being inspected/assessed documents and implements a process to use techniques and methods IAW DoD 5400.11-R to ensure secure deletion or destruction of PII (including originals, copies, and archived records).\\n\\nDoD has defined the techniques or methods as techniques and methods IAW DoD 5400.11-R.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed uses techniques and methods IAW DoD 5400.11-R to ensure secure deletion or destruction of PII (including originals, copies, and archived records).\\n\\nDoD has defined the techniques or methods as techniques and methods IAW DoD 5400.11-R.'),\n('003503','draft','2013-11-08','DISA FSO','policy','The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is collected, created, or updated.','DM-2(1).1','The organization being inspected/assessed documents and implements a process to configure, where feasible, its information systems to record the date PII is collected, created, or updated.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed configures, where feasible, its information systems to record the date PII is collected, created, or updated.'),\n('003504','deprecated','2013-11-08','DISA FSO','policy','The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is created.',NULL,NULL,NULL),\n('003505','deprecated','2013-11-08','DISA FSO','policy','The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is updated.',NULL,NULL,NULL),\n('003506','draft','2013-11-08','DISA FSO','policy','The organization, where feasible, configures its information systems to record when personally identifiable information (PII) is to be deleted or archived under an approved record retention schedule.','DM-2(1).2','The organization being inspected/assessed documents and implements a process to configure, where feasible, its information systems to record when PII is to be deleted or archived under a NARA-approved record retention schedule.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed, where feasible, configures its information systems to record when PII is to be deleted or archived under a NARA-approved record retention schedule.'),\n('003507','draft','2013-11-08','DISA FSO','policy','The organization develops policies that minimize the use of personally identifiable information (PII) for testing.','DM-3.1','The organization being inspected/assessed develops and documents policies that minimize the use of PII for testing.','The organization conducting the inspection/assessment obtains and examines the documented policies to ensure the organization being inspected/assessed develops policies that minimize the use of PII for testing.'),\n('003508','draft','2013-11-08','DISA FSO','policy','The organization develops policies that minimize the use of personally identifiable information (PII) for training.','DM-3.2','The organization being inspected/assessed develops and documents policies that minimize the use of PII for training.','The organization conducting the inspection/assessment obtains and examines the documented policies to ensure the organization being inspected/assessed develops policies that minimize the use of PII for training.'),\n('003509','draft','2013-11-08','DISA FSO','policy','The organization develops policies that minimize the use of personally identifiable information (PII) for research.','DM-3.3','The organization being inspected/assessed develops and documents policies that minimize the use of PII for research.','The organization conducting the inspection/assessment obtains and examines the documented policies to ensure the organization being inspected/assessed develops policies that minimize the use of PII for research.'),\n('003510','draft','2013-11-08','DISA FSO','policy','The organization develops procedures that minimize the use of personally identifiable information (PII) for testing.','DM-3.4','The organization being inspected/assessed develops and documents procedures that minimize the use of PII for testing.','The organization conducting the inspection/assessment obtains and examines the documented procedures to ensure the organization being inspected/assessed develops procedures that minimize the use of PII for testing.'),\n('003511','draft','2013-11-08','DISA FSO','policy','The organization develops procedures that minimize the use of personally identifiable information (PII) for training.','DM-3.5','The organization being inspected/assessed develops and documents procedures that minimize the use of PII for training.','The organization conducting the inspection/assessment obtains and examines the documented procedures to ensure the organization being inspected/assessed develops procedures that minimize the use of PII for training.'),\n('003512','draft','2013-11-08','DISA FSO','policy','The organization develops procedures that minimize the use of personally identifiable information (PII) for research.','DM-3.6','The organization being inspected/assessed develops and documents procedures that minimize the use of PII for research.','The organization conducting the inspection/assessment obtains and examines the documented procedures to ensure the organization being inspected/assessed develops procedures that minimize the use of PII for research.'),\n('003513','draft','2013-11-08','DISA FSO','policy','The organization implements controls to protect personally identifiable information (PII) used for testing.','DM-3.7','The organization being inspected/assessed will complete a Privacy Impact Assessment (PIA) for any information system that uses PII for testing and implement the identified controls.','The organization conducting the inspection/assessment obtains and examines the PIA for all information systems using PII for testing to ensure the PIA is completed and approved.  The organization conducting the inspection/assessment inspects the information system to ensure the organization being inspected/assessed has properly implemented the controls identified in the PIA to protect PII.'),\n('003514','draft','2013-11-08','DISA FSO','policy','The organization implements controls to protect personally identifiable information (PII) used for training.','DM-3.8','The organization being inspected/assessed will complete a Privacy Impact Assessment (PIA) for any information system that uses PII for training and implement the identified controls.','The organization conducting the inspection/assessment obtains and examines the PIA for all information systems using PII for training to ensure the PIA is completed and approved.  The organization conducting the inspection/assessment inspects the information system to ensure the organization being inspected/assessed has properly implemented the controls identified in the PIA to protect PII.'),\n('003515','draft','2013-11-08','DISA FSO','policy','The organization implements controls to protect personally identifiable information (PII) used for research.','DM-3.9','The organization being inspected/assessed will complete a Privacy Impact Assessment (PIA) for any information system that uses PII for research and implement the identified controls.','The organization conducting the inspection/assessment obtains and examines the PIA for all information systems using PII for research to ensure the PIA is completed and approved.  The organization conducting the inspection/assessment inspects the information system to ensure the organization being inspected/assessed has properly implemented the controls identified in the PIA to protect PII.'),\n('003516','draft','2013-11-08','DISA FSO','policy','The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for research.','DM-3(1).1','The organization being inspected/assessed documents and implements\\ntechniques (such as de-identification or anonymization) to minimize the risk\\nto privacy of using PII for research.  Where such techniques aren\\'t feasible due to the parameters of the research, the organization will document the justification for not implementing such techniques.','The organization conducting the inspection/assessment obtains and examines the documented techniques to minimize the risk to privacy of using PII for research and verifies that these techniques are being used\\nor that the justifications for not using them are documented.'),\n('003517','draft','2013-11-08','DISA FSO','policy','The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for testing.','DM-3(1).2','The organization being inspected/assessed documents and implements\\ntechniques (such as de-identification or anonymization) to minimize the risk\\nto privacy of using PII for testing.  Where such techniques aren\\'t feasible due to the parameters of the testing, the organization will document the justification for not implementing such techniques.','The organization conducting the inspection/assessment obtains and examines the documented techniques to minimize the risk to privacy of using PII for testing and verifies that these techniques are being used\\nor that the justifications for not using them are documented.'),\n('003518','draft','2013-11-08','DISA FSO','policy','The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for training.','DM-3(1).3','The organization being inspected/assessed documents and implements\\ntechniques (such as de-identification or anonymization) to minimize the risk\\nto privacy of using PII for training.  Where such techniques aren\\'t feasible due to the parameters of the training, the organization will document the justification\\nfor not implementing such training.','The organization conducting the inspection/assessment obtains and examines the documented techniques to minimize the risk to privacy of using PII for training and verifies that these techniques are being used\\nor that the justifications for not using them are documented.'),\n('003519','draft','2013-11-08','DISA FSO','policy','The organization provides means, where feasible and appropriate, for individuals to authorize the collection of personally identifiable information (PII) prior to its collection.','IP-1.1','The organization being inspected/assessed documents and implements a procedure for individuals to authorize the collection of personally identifiable\\ninformation (PII) prior to its collection.  Minimally, where individual\\nauthorization is not feasible or appropriate, the organization will notify\\nusers that PII is being collected.','The organization conducting the inspection/assessment obtains and examines the documented procedure as well as a sampling of artifacts related to the authorization of collection of PII to ensure the organization being inspected/assessed provides means, where feasible and appropriate, for individuals to authorize the collection of PII prior to its collection.  Where authorization is not feasible or appropriate, the organization conducting the inspection/assessment ensures that the organization notifies users that PII is being collected.'),\n('003520','draft','2013-11-08','DISA FSO','policy','The organization provides means, where feasible and appropriate, for individuals to authorize the use of personally identifiable information (PII) prior to its collection.','IP-1.2','The organization being inspected/assessed documents and implements a procedure for individuals to authorize the use of personally identifiable\\ninformation (PII) prior to its collection.  Minimally, where individual\\nauthorization is not feasible or appropriate, the organization will notify\\nusers that PII is being used.','The organization conducting the inspection/assessment obtains and examines the documented procedure as well as a sampling of artifacts related to the authorization of the use of PII to ensure the organization being inspected/assessed provides means, where feasible and appropriate, for individuals to authorize the use of PII prior to its collection.  Where authorization is not feasible or appropriate, the organization conducting the inspection/assessment ensures that the organization notifies users that PII is being used.'),\n('003521','draft','2013-11-08','DISA FSO','policy','The organization provides means, where feasible and appropriate, for individuals to authorize the maintaining of personally identifiable information (PII) prior to its collection.','IP-1.3','The organization being inspected/assessed documents and implements a procedure for individuals to authorize the maintaining of personally identifiable\\ninformation (PII) prior to its collection.  Minimally, where individual\\nauthorization is not feasible or appropriate, the organization will notify\\nusers that PII is being maintained.','The organization conducting the inspection/assessment obtains and examines the documented procedure as well as a sampling of artifacts related to the authorization of the maintaining of PII to ensure the organization being inspected/assessed provides means, where feasible and appropriate, for individuals to authorize the maintaining of PII prior to its collection.  Where authorization is not feasible or appropriate, the organization conducting the inspection/assessment ensures that the organization notifies users that PII is being maintained.'),\n('003522','draft','2013-11-08','','policy','The organization provides means, where feasible and appropriate, for individuals to authorize sharing of personally identifiable information (PII) prior to its collection.','IP-1.4','The organization being inspected/assessed documents and implements a procedure for individuals to authorize the sharing of personally identifiable\\ninformation (PII) prior to its collection.  Minimally, where individual\\nauthorization is not feasible or appropriate, the organization will notify\\nusers that PII is being shared.','The organization conducting the inspection/assessment obtains and examines the documented procedure as well as a sampling of artifacts related to the authorization of the sharing of PII to ensure the organization being inspected/assessed provides means, where feasible and appropriate, for individuals to authorize the sharing of PII prior to its collection.  Where authorization is not feasible or appropriate, the organization conducting the inspection/assessment ensures that the organization notifies users that PII is being shared.'),\n('003523','draft','2013-11-08','DISA FSO','policy','The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the collection of personally identifiable information (PII).','IP-1.5','The organization being inspected/assessed documents and implements a procedure for individuals to understand the consequences of decisions to approve or decline the authorization of the collection of PII.','The organization conducting the inspection/assessment obtains and examines the documented procedure to ensure the organization being inspected/assessed provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the collection of PII.'),\n('003524','draft','2013-11-08','DISA FSO','policy','The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the use of personally identifiable information (PII).','IP-1.6','The organization being inspected/assessed documents and implements a procedure for individuals to understand the consequences of decisions to approve or decline the authorization of the use of PII.','The organization conducting the inspection/assessment obtains and examines the documented procedure to ensure the organization being inspected/assessed provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the use of PII.'),\n('003525','draft','2013-11-08','DISA FSO','policy','The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the dissemination of personally identifiable information (PII).','IP-1.7','The organization being inspected/assessed documents and implements a procedure for individuals to understand the consequences of decisions to approve or decline the authorization of the dissemination of PII.','The organization conducting the inspection/assessment obtains and examines the documented procedure to ensure the organization being inspected/assessed provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the dissemination of PII.'),\n('003526','draft','2013-11-08','DISA FSO','policy','The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the retention of personally identifiable information (PII).','IP-1.8','The organization being inspected/assessed documents and implements a procedure for individuals to understand the consequences of decisions to approve or decline the authorization of the retention of PII.','The organization conducting the inspection/assessment obtains and examines the documented procedure to ensure the organization being inspected/assessed provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the retention of PII.'),\n('003527','draft','2013-11-08','DISA FSO','policy','The organization obtains consent, where feasible and appropriate, from individuals prior to any new uses or disclosure of previously collected personally identifiable information (PII).','IP-1.9','The organization being inspected/assessed documents and implements a process to obtain consent, where feasible and appropriate, from individuals prior to any new uses or disclosure of previously collected PII.   Minimally, where consent is not feasible or appropriate, the organization will notify users of new uses or disclosure of previously collected PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed obtains consent, where feasible and appropriate, from individuals prior to any new uses or disclosure of previously collected PII. Where consent is not feasible or appropriate, the organization conducting the inspection/assessment ensures that the organization notifies users of new uses or disclosure of previously collected PII.'),\n('003528','draft','2013-11-08','DISA FSO','policy','The organization ensures that individuals are aware of all uses of personally identifiable information (PII) not initially described in the public notice that was in effect at the time the organization collected the PII.','IP-1.10','The organization being inspected/assessed documents and implements a process to ensure that individuals are aware of all uses of PII not initially described in the SORN and Privacy Act Statement that was in effect at the time the organization collected the PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures that individuals are aware of all uses of PII not initially described in the SORN and Privacy Act Statement that was in effect at the time the organization collected the PII.'),\n('003529','draft','2013-11-08','DISA FSO','policy','The organization ensures that individuals, where feasible, consent to all uses of personally identifiable information (PII) not initially described in the public notice that was in effect at the time the organization collected the PII.','IP-1.11','The organization being inspected/assessed documents and implements a process to ensure that individuals, where feasible, consent to all uses of PII not initially described in the SORN and Privacy Act Statement that was in effect at the time the organization collected the PII. Minimally, where consent is not feasible or appropriate, the organization will notify users of all uses of PII not initially described in the SORN and Privacy Act Statement that was in effect at the time the organization collected the PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures that individuals, where feasible, consent to all uses of PII not initially described in the SORN and Privacy Act Statement that was in effect at the time the organization collected the PII. Where consent is not feasible or appropriate, the organization conducting the inspection/assessment ensures that the organization notifies users of  PII not initially described in the SORN and Privacy Act Statement that was in effect at the time the organization collected the PII.'),\n('003530','draft','2013-11-08','DISA FSO','policy','The organization implements mechanisms to support itemized or tiered consent for specific uses of personally identifiable information (PII) data.','IP-1(1).1','The organization implements mechanisms to support itemized or tiered consent for specific uses of PII data.','The organization conducting the inspection/assessment obtains and examines documentation of the itemized or tiered consent methods used by the organization to ensure the organization being inspected/assessed provides individuals, where feasible, consent to each tier of use requested.'),\n('003531','draft','2013-11-08','DISA FSO','policy','The organization provides individuals the ability to have access to their personally identifiable information (PII) maintained in its system(s) of records.','IP-2.1','The organization being inspected/assessed provides for public access to records in systems of records IAW the SORN. PII not included in the Privacy Act System of Records may be accessed through a Freedom of Information Act Request. At a minimum the organization shall provide access to an individuals own PII IAW both DoDD 5400.11 and DoD 5400.11-R.','The organization conducting the inspection/assessment obtains and examines documentation of how the organization provides an individual with access to his own PII to ensure the organization being inspected/assessed provides individuals access to his own PII IAW DoDD 5400.11 and DoD 5400.11-R.'),\n('003532','draft','2013-11-08','DISA FSO','policy','The organization publishes rules and regulations governing how individuals may request access to records maintained in a Privacy Act system of records.','IP-2.2','The organization being inspected/assessed provides for public access to records in systems of records IAW the SORN. PII not included in the Privacy Act System of Records may be accessed through a Freedom of Information Act Request. At a minimum the organization shall provide access to an individuals own PII IAW both DoDD 5400.11 and DoD 5400.11-R.','The organization conducting the inspection/assessment obtains and examines documentation of how the organization provides an individual with access to his own PII to ensure the organization being inspected/assessed provides individuals access to his own PII IAW DoDD 5400.11 and DoD 5400.11-R.'),\n('003533','deprecated','2013-11-08','DISA FSO','policy','The organization publishes regulations governing how individuals may request access to records maintained in a Privacy Act system of records.','IP-2.3','The organization being inspected/assessed provides for public access to records in systems of records IAW the SORN. PII not included in the Privacy Act System of Records may be accessed through a Freedom of Information Act Request. At a minimum the organization shall provide access to an individuals own PII IAW both DoDD 5400.11 and DoD 5400.11-R.','The organization conducting the inspection/assessment obtains and examines documentation of how the organization provides an individual with access to his own PII to ensure the organization being inspected/assessed provides individuals access to his own PII IAW DoDD 5400.11 and DoD 5400.11-R.'),\n('003534','draft','2013-11-08','DISA FSO','policy','The organization publishes access procedures for Privacy Act systems of records in System of Records Notices (SORNs).','IP-2.4','The organization being inspected/assessed provides for public access to records in systems of records IAW the SORN. PII not included in the Privacy Act System of Records may be accessed through a Freedom of Information Act Request. At a minimum the organization shall provide access to an individuals own PII IAW both DoDD 5400.11 and DoD 5400.11-R.','The organization conducting the inspection/assessment obtains and examines documentation of how the organization provides an individual with access to his own PII to ensure the organization being inspected/assessed provides individuals access to his own PII IAW DoDD 5400.11 and DoD 5400.11-R.'),\n('003535','draft','2013-11-08','DISA FSO','policy','The organization adheres to Privacy Act requirements for the proper processing of Privacy Act requests.','IP-2.5','The organization being inspected/assessed provides for public access to records in systems of records IAW the SORN. PII not included in the Privacy Act System of Records may be accessed through a Freedom of Information Act Request. At a minimum the organization shall provide access to an individuals own PII IAW both DoDD 5400.11 and DoD 5400.11-R.','The organization conducting the inspection/assessment obtains and examines documentation of how the organization provides an individual with access to his own PII to ensure the organization being inspected/assessed provides individuals access to his own PII IAW DoDD 5400.11 and DoD 5400.11-R.'),\n('003536','draft','2013-11-08','DISA FSO','policy','The organization adheres to OMB policies and guidance for the proper processing of Privacy Act requests.','IP-2.6','The organization being inspected/assessed provides for public access to records in systems of records IAW the SORN. PII not included in the Privacy Act System of Records may be accessed through a Freedom of Information Act Request. At a minimum the organization shall provide access to an individuals own PII IAW both DoDD 5400.11 and DoD 5400.11-R.','The organization conducting the inspection/assessment obtains and examines documentation of how the organization provides an individual with access to his own PII to ensure the organization being inspected/assessed provides individuals access to his own PII IAW DoDD 5400.11 and DoD 5400.11-R.'),\n('003537','draft','2013-11-08','DISA FSO','policy','The organization provides a process for individuals to have inaccurate personally identifiable information (PII) maintained by the organization corrected or amended, as appropriate.','IP-3.1','The organization being inspected/assessed documents and implements a process IAW  DoDD 5400.11 and DoD 5400.11-R for individuals to have inaccurate PII maintained by the organization corrected or amended, as appropriate.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides a process IAW  DoDD 5400.11 and DoD 5400.11-R for individuals to have inaccurate PII maintained by the organization corrected or amended, as appropriate.'),\n('003538','draft','2013-11-08','DISA FSO','policy','The organization establishes a process for disseminating corrections or amendments of the personally identifiable information (PII) to other authorized users of the PII, such as external information-sharing partners.','IP-3.2','The organization being inspected/assessed establishes and documents a process IAW  DoDD 5400.11 and DoD 5400.11-R for disseminating corrections or amendments of the PII to other authorized users of the PII, such as external information-sharing partners.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed establishes a process IAW  DoDD 5400.11 and DoD 5400.11-R for disseminating corrections or amendments of the PII to other authorized users of the PII, such as external information-sharing partners.'),\n('003539','draft','2013-11-08','DISA FSO','policy','The organization establishes a process, where feasible and appropriate, to notify affected individuals that their personally identifiable information (PII) information has been corrected or amended.','IP-3.3','The organization being inspected/assessed establishes and documents a process IAW  DoDD 5400.11 and DoD 5400.11-R where feasible and appropriate, to notify affected individuals that their PII information has been corrected or amended.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  establishes a process IAW  DoDD 5400.11 and DoD 5400.11-R, where feasible and appropriate, to notify affected individuals that their PII information has been corrected or amended.'),\n('003540','draft','2013-11-08','DISA FSO','policy','The organization implements a process for receiving complaints, concerns, or questions from individuals about the organizational privacy practices.','IP-4.1','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and for receiving privacy-related complaints, grievances, concerns, or questions from individuals','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  implements a process IAW DoD 5400.11-R and OMB Memorandum M-08-09 for receiving complaints, grievances, concerns, or questions from individuals about: (1) organizational privacy process and procedural issues (consent, collection, and appropriate notice); (2) redress issues (non-Privacy Act inquiries seeking resolution of difficulties or concerns about privacy matters);  (3) operational issues (inquiries regarding Privacy Act matters not including Privacy Act requests for access and/or corrections); and (4) a complaint or grievance against the organization or one of its employees concerning any right granted by DoD 5400.11-R.'),\n('003541','draft','2013-11-08','DISA FSO','policy','The organization implements a process for responding to complaints, concerns, or questions from individuals about the organizational privacy practices.','IP-4.2','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and for responding to privacy-related complaints, grievances, concerns, or questions from individuals','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  implements a process IAW DoD 5400.11-R and OMB Memorandum M-08-09 for processing complaints, grievances, concerns, or questions from individuals about: (1) organizational privacy process and procedural issues (consent, collection, and appropriate notice); (2) redress issues (non-Privacy Act inquiries seeking resolution of difficulties or concerns about privacy matters);  (3) operational issues (inquiries regarding Privacy Act matters not including Privacy Act requests for access and/or corrections); and (4) a complaint or grievance against the organization or one of its employees concerning any right granted by DoD 5400.11-R.'),\n('003542','draft','2013-11-08','DISA FSO','policy','The organization defines the time period within which it must respond to complaints, concerns, or questions from individuals about the organizational privacy practices.','IP-4(1).1','DoD has defined the time period as 30 days within receipt of the initial complaint.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the time period as 30 days within receipt of the initial complaint.'),\n('003543','draft','2013-11-08','DISA FSO','policy','The organization responds to complaints, concerns, or questions from individuals about the organizational privacy practices within the organization-defined time period.','IP-4(1).2','The organization being inspected/assessed documents and implements a process to respond to complaints, concerns, or questions from individuals about the organizational privacy practices within 30 days within receipt of the initial complaint.\\n\\nDoD has defined the time period as 30 days within receipt of the initial complaint.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed responds to complaints, concerns, or questions from individuals about the organizational privacy practices within 30 days within receipt of the initial complaint.\\n\\nDoD has defined the time period as 30 days within receipt of the initial complaint.'),\n('003544','draft','2013-11-08','DISA FSO','policy','The organization defines the frequency on which it will update the inventory that contains a listing of all programs and information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).','SE-1.1','DoD has defined the frequency as within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs.'),\n('003545','draft','2013-11-08','DISA FSO','policy','The organization establishes an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII).','SE-1.2','The organization being inspected/assessed establishes and documents an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing PII.','The organization conducting the inspection/assessment obtains and examines the documented inventory to ensure the organization being inspected/assessed  establishes an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing PII.'),\n('003546','draft','2013-11-08','DISA FSO','policy','The organization establishes an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).','SE-1.3','The organization being inspected/assessed establishes and documents an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing PII.','The organization conducting the inspection/assessment obtains and examines the documented inventory to ensure the organization being inspected/assessed  establishes an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing PII.'),\n('003547','draft','2013-11-08','DISA FSO','policy','The organization maintains an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII).','SE-1.4','The organization being inspected/assessed documents and implements a process to maintain an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed maintains an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing PII.'),\n('003548','draft','2013-11-08','DISA FSO','policy','The organization maintains an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).','SE-1.5','The organization being inspected/assessed documents and implements a process to maintain an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed maintains an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing PII.'),\n('003549','draft','2013-11-08','DISA FSO','policy','The organization updates, per organization-defined frequency, an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII).','SE-1.6','The organization being inspected/assessed documents and implements a process to update, within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs, an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing PII.\\n\\nThe organization must maintain an audit trail of updates.\\n\\nDoD has defined the frequency as within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of updates to ensure the organization being inspected/assessed updates, within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs, an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing PII.\\n\\nDoD has defined the frequency as within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs.'),\n('003550','draft','2013-11-08','DISA FSO','policy','The organization updates, per organization-defined frequency, an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).','SE-1.7','The organization being inspected/assessed documents and implements a process to update, within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs, an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing PII.\\n\\nThe organization must maintain an audit trail of updates.\\n\\nDoD has defined the frequency as within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of updates to ensure the organization being inspected/assessed updates, within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs, an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing PII.\\n\\nDoD has defined the frequency as within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs.'),\n('003551','draft','2013-11-08','DISA FSO','policy','The organization defines the frequency for providing each update of the personally identifiable information (PII) inventory to the CIO or information security official.','SE-1.8','DoD has defined the frequency as within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs.','The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.\\n\\nDoD has defined the frequency as within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs.'),\n('003552','draft','2013-11-08','DISA FSO','policy','The organization provides each update of the personally identifiable information (PII) inventory to the CIO or information security official, per organization-defined frequency, to support the establishment of information security requirements for all new or modified information systems containing PII.','SE-1.9','The organization being inspected/assessed documents and implements a process to provide each update of the PII inventory to the CIO or information security official, within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs, to support the establishment of information security requirements for all new or modified information systems containing PII.\\n\\nDoD has defined the frequency as within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides each update of the PII inventory to the CIO or information security official, within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs, to support the establishment of information security requirements for all new or modified information systems containing PII.\\n\\nDoD has defined the frequency as within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs.'),\n('003553','draft','2013-11-08','DISA FSO','policy','The organization develops a Privacy Incident Response Plan.','SE-2.1','The organization being inspected/assessed develops and documents a Privacy Incident Response Plan. The revision of DoD 5400.11-R into a manual provides DoD-enterprise-level guidance on breach reporting. Components may decide to augment this with their own incident response plan. The privacy incident response plan  may be included as a part of the organization\\'s existing response plan.','The organization conducting the inspection/assessment obtains and examines the documented Privacy Incident Response Plan to ensure the organization being inspected/assessed develops a Privacy Incident Response Plan.'),\n('003554','draft','2013-11-08','DISA FSO','policy','The organization implements a Privacy Incident Response Plan.','SE-2.2','The organization being inspected/assessed  implements a Privacy Incident Response Plan.  The revision of DoD 5400.11-R into a manual provides DoD-enterprise-level guidance on breach reporting. Components may decide to augment this with their own incident response plan.','The organization conducting the inspection/assessment obtains and examines the documented Privacy Incident Response Plan to ensure the organization being inspected/assessed implements a Privacy Incident Response Plan.'),\n('003555','draft','2013-11-08','DISA FSO','policy','The organization provides an organized and effective response to privacy incidents in accordance with the organizational Privacy Incident Response Plan.','SE-2.3','The organization being inspected/assessed documents and implements a process to provides an organized and effective response to privacy incidents in accordance with the organizational Privacy Incident Response Plan. The revision of DoD 5400.11-R into a manual provides DoD-enterprise-level guidance on breach reporting. Components may decide to augment this with their own incident response plan. The privacy incident response plan, which may be included as a part of your existing response plan.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides an organized and effective response to privacy incidents in accordance with the organizational Privacy Incident Response Plan.'),\n('003556','draft','2013-11-08','DISA FSO','policy','The organization provides effective notice to the public regarding its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII).','TR-1.1','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and DoDI 5400.16 to provide effective notice to the public regarding its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII).','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides effective notice to the public IAW DoD 5400.11-R and DoDI 5400.16 regarding its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII).'),\n('003557','draft','2013-11-08','DISA FSO','policy','The organization provides effective notice to individuals regarding its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII).','TR-1.2','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and DoDI 5400.16 to provide effective information to individuals regarding its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of PII.  The process may include use of the SORN, PIA, or through the Privacy Act Statement on forms used to collect PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  provides effective notice IAW DoD 5400.11-R and DoDI 5400.16 to individuals regarding its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of PII.'),\n('003558','draft','2013-11-08','DISA FSO','policy','The organization provides effective notice to the public regarding its authority for collecting personally identifiable information (PII).','TR-1.3','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and DoDI 5400.16 to provide effective notice to the public regarding its authority for collecting PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  provides effective notice IAW DoD 5400.11-R and DoDI 5400.16 to the public regarding its authority for collecting PII.'),\n('003559','draft','2013-11-08','DISA FSO','policy','The organization provides effective notice to individuals regarding its authority for collecting personally identifiable information (PII).','TR-1.4','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and DoDI 5400.16 to provide effective notice to individuals regarding its authority for collecting PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides effective notice IAWIAW DoD 5400.11-R and DoDI 5400.16 to individuals regarding its authority for collecting PII.'),\n('003560','draft','2013-11-08','DISA FSO','policy','The organization provides effective notice to the public regarding the choices, if any, individuals may have regarding how the organization uses personally identifiable information (PII).','TR-1.5','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and DoDI 5400.16 to provide effective notice to the public regarding the choices, if any, individuals may have regarding how the organization uses PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  provides effective notice IAW DoD 5400.11-R and DoDI 5400.16 to the public regarding the choices, if any, individuals may have regarding how the organization uses PII.'),\n('003561','draft','2013-11-08','DISA FSO','policy','The organization provides effective notice to individuals regarding the choices, if any, individuals may have regarding how the organization uses personally identifiable information (PII).','TR-1.6','The organization being inspected/assessed documents and implements a process to provide IAW DoD 5400.11-R and DoDI 5400.16 effective notice to individuals regarding the choices, if any, individuals may have regarding how the organization uses PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides effective notice IAW DoD 5400.11-R and DoDI 5400.16 to individuals regarding the choices, if any, individuals may have regarding how the organization uses PII.'),\n('003562','draft','2013-11-08','DISA FSO','policy','The organization provides effective notice to the public regarding the consequences of exercising or not exercising the choices regarding how the organization uses personally identifiable information (PII).','TR-1.7','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and DoDI 5400.16 to provide effective notice to the public regarding the consequences of exercising or not exercising the choices regarding how the organization uses PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides effective notice IAW DoD 5400.11-R and DoDI 5400.16 to the public regarding the consequences of exercising or not exercising the choices regarding how the organization uses PII.'),\n('003563','draft','2013-11-08','DISA FSO','policy','The organization provides effective notice to individuals regarding the consequences of exercising or not exercising the choices regarding how the organization uses personally identifiable information (PII).','TR-1.8','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and DoDI 5400.16 to provide effective notice to individuals regarding the consequences of exercising or not exercising the choices regarding how the organization uses PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides effective notice IAW DoD 5400.11-R and DoDI 5400.16 to individuals regarding the consequences of exercising or not exercising the choices regarding how the organization uses PII.'),\n('003564','draft','2013-11-08','DISA FSO','policy','The organization provides effective notice to the public regarding the ability of individuals to access personally identifiable information (PII).','TR-1.9','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and DoDI 5400.16 to provide effective notice to the public regarding the ability to access PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides effective notice IAW DoD 5400.11-R and DoDI 5400.16 to the public regarding the ability to access PII.'),\n('003565','draft','2013-11-08','DISA FSO','policy','The organization provides effective notice to individuals regarding the ability to access personally identifiable information (PII).','TR-1.10','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and DoDI 5400.16 to provide effective notice to individuals regarding the ability to access PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides effective notice IAW DoD 5400.11-R and DoDI 5400.16 to individuals regarding the ability to access PII.'),\n('003566','draft','2013-11-08','DISA FSO','policy','The organization provides effective notice to the public regarding the ability to have personally identifiable information (PII) amended or corrected if necessary.','TR-1.11','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and DoDI 5400.16 to provide effective notice to the public regarding the ability to have PII amended or corrected if necessary.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides effective notice IAW DoD 5400.11-R and DoDI 5400.16 to the public regarding the ability to have PII amended or corrected if necessary.'),\n('003567','draft','2013-11-08','DISA FSO','policy','The organization provides effective notice to individuals regarding the ability to have personally identifiable information (PII) amended or corrected if necessary.','TR-1.12','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and DoDI 5400.16 to provide effective notice to individuals regarding the ability to have PII amended or corrected if necessary.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides effective notice IAW DoD 5400.11-R and DoDI 5400.16 to individuals regarding the ability to have PII amended or corrected if necessary.'),\n('003568','draft','2013-11-08','DISA FSO','policy','The organization describes the personally identifiable information (PII) the organization collects.','TR-1.13','The organization being inspected/assessed describes and documents IAW DoD 5400.11-R and DoDI 5400.16 the PII the organization collects.','The organization conducting the inspection/assessment obtains and examines the documented description to ensure the organization being inspected/assessed  describes the PII the organization collects IAW DoD 5400.11-R and DoDI 5400.16'),\n('003569','draft','2013-11-08','DISA FSO','policy','The organization describes the purpose(s) for which it collects the personally identifiable information (PII).','TR-1.14','The organization being inspected/assessed describes and documents IAW DoD 5400.11-R and DoDI 5400.16 the purpose(s) for which it collects the PII information.','The organization conducting the inspection/assessment obtains and examines the documented description to ensure the organization being inspected/assessed describes the purpose(s) for which it collects the PII information IAW DoD 5400.11-R and DoDI 5400.16'),\n('003570','draft','2013-11-08','DISA FSO','policy','The organization describes how the organization uses personally identifiable information (PII) internally.','TR-1.15','The organization being inspected/assessed describes and documents IAW DoD 5400.11-R and DoDI 5400.16 how the organization uses PII internally.','The organization conducting the inspection/assessment obtains and examines the documented description to ensure the organization being inspected/assessed describes how the organization uses PII internally IAW DoD 5400.11-R and DoDI 5400.16'),\n('003571','draft','2013-11-08','DISA FSO','policy','The organization describes whether the organization shares personally identifiable information (PII) with external entities.','TR-1.16','The organization being inspected/assessed describes and documents IAW DoD 5400.11-R and DoDI 5400.16 whether the organization shares PII with external entities.','The organization conducting the inspection/assessment obtains and examines the documented description to ensure the organization being inspected/assessed describes whether the organization shares PII with external entities IAW DoD 5400.11-R and DoDI 5400.16.'),\n('003572','draft','2013-11-08','DISA FSO','policy','The organization describes the categories of those external entities with whom personally identifiable information (PII) is shared.','TR-1.17','The organization being inspected/assessed describes and documents IAW DoD 5400.11-R and DoDI 5400.16 the categories of those external entities with whom PII is shared.','The organization conducting the inspection/assessment obtains and examines the documented description to ensure the organization being inspected/assessed describes the categories of those external entities with whom PII is shared IAW DoD 5400.11-R and DoDI 5400.16'),\n('003573','draft','2013-11-08','DISA FSO','policy','The organization describes the purposes for sharing personally identifiable information (PII) with external entities.','TR-1.18','The organization being inspected/assessed describes and documents IAW DoD 5400.11-R and DoDI 5400.16 the purposes for sharing PII with external entities.','The organization conducting the inspection/assessment obtains and examines the documented description to ensure the organization being inspected/assessed  describes the purposes for sharing PII with external entities IAW DoD 5400.11-R and DoDI 5400.16'),\n('003574','draft','2013-11-08','DISA FSO','policy','The organization describes whether individuals have the ability to consent to specific uses or sharing of personally identifiable information (PII).','TR-1.19','The organization being inspected/assessed describes and documents IAW DoD 5400.11-R and DoDI 5400.16 whether individuals have the ability to consent to specific uses or sharing of PII.','The organization conducting the inspection/assessment obtains and examines the documented description to ensure the organization being inspected/assessed describes whether individuals have the ability to consent to specific uses or sharing of PII IAW DoD 5400.11-R and DoDI 5400.16'),\n('003575','draft','2013-11-08','DISA FSO','policy','The organization describes how individuals may exercise their consent regarding specific uses or sharing of personally identifiable information (PII).','TR-1.20','The organization being inspected/assessed describes and documents IAW DoD 5400.11-R and DoDI 5400.16 how individuals may exercise their consent regarding specific uses or sharing of PII.','The organization conducting the inspection/assessment obtains and examines the documented description to ensure the organization being inspected/assessed describes how individuals may exercise their consent regarding specific uses or sharing of PII IAW DoD 5400.11-R and DoDI 5400.16.'),\n('003576','draft','2013-11-08','DISA FSO','policy','The organization describes how individuals may obtain access to personally identifiable information (PII).','TR-1.21','The organization being inspected/assessed describes and documents IAW DoD 5400.11-R and DoDI 5400.16 how individuals may obtain access to PII.','The organization being inspected/assessed obtains and examines the documented description to ensure the organization being inspected/assessed describes how individuals may obtain access to PII IAW DoD 5400.11-R and DoDI 5400.16.'),\n('003577','draft','2013-11-08','DISA FSO','policy','The organization describes how the personally identifiable information (PII) will be protected.','TR-1.22','The organization being inspected/assessed describes and documents IAW DoD 5400.11-R and DoDI 5400.16 how the PII will be protected.','The organization conducting the inspection/assessment obtains and examines the documented description to ensure the organization being inspected/assessed describes how the PII will be protected IAW DoD 5400.11-R and DoDI 5400.16.'),\n('003578','draft','2013-11-08','DISA FSO','policy','The organization revises its public notices to reflect changes in practice or policy that affect personally identifiable information (PII), before or as soon as practicable after the change.','TR-1.23','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and DoDI 5400.16 to revise its public notices to reflect changes in practice or policy that affect PII, before or as soon as practicable after the change.\\n\\nThe organization must maintain an audit trail of revisions.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of revisions to ensure the organization being inspected/assessed revises its public notices, IAW DoD 5400.11-R and DoDI 5400.16, to reflect changes in practice or policy that affect PII, before or as soon as practicable after the change.'),\n('003579','draft','2013-11-08','DISA FSO','policy','The organization revises its public notices to reflect changes in practice or policy that impact privacy, before or as soon as practicable after the change.','TR-1.24','The organization being inspected/assessed documents and implements a process IAW DoD 5400.11-R and DoDI 5400.16 to revise its public notices to reflect changes in practice or policy that impact privacy, before or as soon as practicable after the change.\\n\\nThe organization must maintain an audit trail of revisions.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of revisions to ensure the organization being inspected/assessed revises its public notices IAW DoD 5400.11-R and DoDI 5400.16 to reflect changes in practice or policy that impact privacy, before or as soon as practicable after the change.'),\n('003580','draft','2013-11-08','DISA FSO','policy','The organization provides real-time notice and/or layered notice when it collects personally identifiable information (PII).','TR-1(1).1','The organization being inspected/assessed documents and implements a process to provide real-time notice and/or layered notice when it collects PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides real-time notice and/or layered notice when it collects PII.'),\n('003581','draft','2013-11-08','DISA FSO','policy','The organization publishes System of Records Notices (SORNs) in the Federal Register, subject to required oversight processes, for systems containing personally identifiable information (PII).','TR-2.1','The organization being inspected/assessed documents and implements a process IAW DoDD 5400.11 and DoD 5400.11-R to publish System of Records Notices (SORNs) in the Federal Register, subject to required oversight processes, for systems containing PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  publishes IAW DoDD 5400.11 and DoD 5400.11-R System of Records Notices (SORNs) in the Federal Register, subject to required oversight processes, for systems containing PII.'),\n('003582','draft','2013-11-08','DISA FSO','policy','The organization keeps System of Records Notices (SORNs) current.','TR-2.2','The organization being inspected/assessed documents and implements a process IAW DoDD 5400.11 and DoD 5400.11-R to review System of Records Notices (SORNs) every two years and to updated as necessary to keep current.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed keeps System of Records Notices (SORNs) current IAW DoDD 5400.11 and DoD 5400.11-R by reviewing the SORNs every two years and updating as necessary.'),\n('003583','draft','2013-11-08','DISA FSO','policy','The organization includes Privacy Act Statements on its forms that collect personally identifiable information (PII), or on separate forms that can be retained by individuals, to provide additional formal notice to individuals from whom the information is being collected.','TR-2.3','The organization being inspected/assesse documents and implements a process IAW DoDD 5400.11 and DoD 5400.11-R to include Privacy Act Statements on its forms that collect PII, or on separate forms that can be retained by individuals, to provide additional formal notice to individuals from whom the information is being collected.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed, IAW DoDD 5400.11 and DoD 5400.11-R, includes Privacy Act Statements on its forms that collect PII, or on separate forms that can be retained by individuals, to provide additional formal notice to individuals from whom the information is being collected.'),\n('003584','draft','2013-11-08','DISA FSO','policy','The organization publishes System of Records Notices (SORNs) on its public website.','TR-2(1).1','The organization being inspected/assessed documents and implements a process IAW DoDD 5400.11 and DoD 5400.11-R to publish their Component level System of Records Notices (SORNs) on its public website.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed publishes their Component level System of Records Notices (SORNs) on its public websites IAW DoDD 5400.11 and DoD 5400.11-R.'),\n('003585','draft','2013-11-08','DISA FSO','policy','The organization ensures the public has access to information about its privacy activities.','TR-3.1','DoDD 5400.11, DoD 5400.11-R, DoDI 5400.16, publication of both Privacy Impact Assessments and System of Records Notices, as well as, if published, Service or DoD Component level privacy regulations, meet this control\\'s requirement to make public information about the organizations\\' privacy activities.\\n\\nThe organization being inspected/assessed documents any Service or Component level privacy regulations it has published.','DoDD 5400.11, DoD 5400.11-R, DoDI 5400.16, publication of both Privacy Impact Assessments and System of Records Notices, as well as, if published, Service or DoD Component level privacy regulations, meet this control\\'s to make publicly accessible information about the organizations\\' privacy activities.\\n\\nThe organization conducting the inspection/assessment obtains and examines the published Service or Component level privacy regulations to ensure the organization being inspected/assessed, has made those regulations public.'),\n('003586','draft','2013-11-08','DISA FSO','policy','The organization ensures the public is able to communicate with its Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO).','TR-3.2','If the DoD Component has identified a Chief Privacy Officer, the DoD Component shall provide a phone number and e-mail address on its web site to enable the public to communicate with its Chief Privacy Officer.  If the DoD Component is serviced by another DoD Component\\'s Chief Privacy Officer, the DoD Component will provide a phone number and e-mail address for that Officer.\\n\\nThe organization being inspected/assessed documents the web site on which it has published a phone number and e-mail address on its web site to enable the public to communicate with its Chief Privacy Officer.','The organization conducting the inspection/assessment obtains and examines the documented web site to ensure the organization being inspected/assessed, has provided a phone number and e-mail address that permits the public to communicate with its Chief Privacy Officer.'),\n('003587','draft','2013-11-08','DISA FSO','policy','The organization ensures its privacy practices are publicly available through organizational websites or otherwise.','TR-3.3','If the DoD Component has a Component level Privacy regulation, the DoD Component shall provide public access to that regulation on the Component\\'s web site.\\n\\nThe organization being inspected/assessed documents the web site on which it has published its Component level privacy regulation.','If the DoD Component has a Component level Privacy regulation, the DoD Component shall provide public access to that regulation on the Component\\'s web site.\\n\\nThe organization conducting the inspection/assessment obtains and examines the documented web site to ensure the organization being inspected/assessed, has provided public access to the Component level privacy regulation.'),\n('003588','draft','2013-11-08','DISA FSO','policy','The organization uses personally identifiable information (PII) internally only for the authorized purpose(s) identified in the Privacy Act and/or in public notices.','UL-1.1','The organization being inspected/assessed documents and implements a process to use personally identifiable information (PII) internally only for the authorized purpose(s) identified in the Privacy Act and/or in public notices.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed uses personally identifiable information (PII) internally only for the authorized purpose(s) identified in the Privacy Act and/or in public notices.'),\n('003589','draft','2013-11-08','DISA FSO','policy','The organization shares personally identifiable information (PII) externally, only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes.','UL-2.1','The organization being inspected/assessed documents and implements a process to share IAW DoDD 5400.11 and DoD 5400.11-R, PII externally, only for the authorized purposes  or for a purpose that is compatible with those purposes. Planned use of PII must be identified and documented as an authorized purposes in the corresponding SORN, PIA, security plan, or other system-specific document.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed shares IAW DoD 5400.11, PII externally, only for the authorized purposes  or for a purpose that is compatible with those purposes. Planned use of PII must be identified and documented as an authorized purposes in the corresponding SORN, PIA, security plan, or other system-specific document.'),\n('003590','draft','2013-11-08','DISA FSO','policy','The organization, where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically describe the personally identifiable information (PII) covered.','UL-2.2','The organization being inspected/assessed documents and implements a process IAW DoDD 5400.11 and DoD 5400.11-R to enter into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, where appropriate, with third parties that specifically describe the PII covered.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed, IAW DoDD 5400.11 and DoD 5400.11-R, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, where appropriate, with third parties that specifically describe the PII covered.'),\n('003591','draft','2013-11-08','DISA FSO','policy','The organization, where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically enumerate the purposes for which the personally identifiable information (PII) may be used.','UL-2.3','The organization being inspected/assessed documents and implements a process IAW DoDD 5400.11 and DoD 5400.11-R to enter into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, where appropriate, with third parties that specifically enumerate the purposes for which the PII may be used.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed, IAW DoDD 5400.11 and DoD 5400.11-R, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, where appropriate, with third parties that specifically enumerate the purposes for which the PII may be used.'),\n('003592','draft','2013-11-08','DISA FSO','policy','The organization monitors its staff on the authorized sharing of personally identifiable information (PII) with third parties.','UL-2.4','The organization being inspected/assessed documents and implements a process IAW DoDD 5400.11 and DoD 5400.11-R to monitor its staff on the authorized sharing of PII with third parties.\\n\\nThe organization must maintain an audit trail of monitoring.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of monitoring to ensure the organization being inspected/assessed monitors its staff, IAW DoDD 5400.11 and DoD 5400.11-R, on the authorized sharing of PII with third parties.'),\n('003593','draft','2013-11-08','DISA FSO','policy','The organization audits its staff on the authorized sharing of personally identifiable information (PII) with third parties.','UL-2.5','The organization being inspected/assessed documents and implements a process IAW DoDD 5400.11 and DoD 5400.11-R, to audit its staff on the authorized sharing of PII with third parties.\\n\\nThe organization must maintain records of audits.','The organization conducting the inspection/assessment obtains and examines the documented process as well as the records of audits to ensure the organization being inspected/assessed audits its staff, IAW DoDD 5400.11 and DoD 5400.11-R, on the authorized sharing of PII with third parties.'),\n('003594','draft','2013-11-08','DISA FSO','policy','The organization trains its staff on the authorized sharing of personally identifiable information (PII) with third parties.','UL-2.6','The organization being inspected/assessed documents and implements a process IAW DoDD 5400.11 and DoD 5400.11-R to train its staff on the authorized sharing of PII with third parties.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  trains its staff, IAW DoDD 5400.11 and DoD 5400.11-R, on the authorized sharing of PII with third parties.'),\n('003595','draft','2013-11-08','DISA FSO','policy','The organization trains its staff on the consequences of unauthorized use or sharing of personally identifiable information (PII).','UL-2.7','The organization being inspected/assessed documents and implements a process IAW DoDD 5400.11 and DoD 5400.11-R to train its staff on the consequences of unauthorized use or sharing of PII.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed  trains its staff, IAW DoDD 5400.11 and DoD 5400.11-R, on the consequences of unauthorized use or sharing of PII.'),\n('003596','draft','2013-11-08','DISA FSO','policy','The organization evaluates any proposed new instances of sharing personally identifiable information (PII) with third parties to assess whether the sharing is authorized.','UL-2.8','The organization being inspected/assessed documents and implements a process IAW DoDD 5400.11 and DoD 5400.11-R to evaluate any proposed new instances of sharing PII with third parties to assess whether the sharing is authorized.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed evaluates IAW DoDD 5400.11 and DoD 5400.11-R any proposed new instances of sharing PII with third parties to assess whether the sharing is authorized.'),\n('003597','draft','2013-11-08','DISA FSO','policy','The organization evaluates any proposed new instances of sharing personally identifiable information (PII) with third parties to assess whether additional or new public notice is required.','UL-2.9','The organization being inspected/assessed documents and implements a process IAW DoDD 5400.11 and DoD 5400.11-R to evaluate any proposed new instances of sharing PII with third parties to assess whether additional or new public notice is required.','The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed evaluates IAW DoDD 5400.11 and DoD 5400.11-R any proposed new instances of sharing PII with third parties to assess whether additional or new public notice is required.'),\n('003599','draft','2016-06-07','DISA FSO','policy','The organization defines the individuals or information systems to be the only recipients of organization-defined information, information system components, or devices, by employing organization-defined security safeguards.','SC-37(1).1','The organization being inspected/assessed defines and documents the individuals or information systems that are the only recipients of organization-defined information, information system components, or devices, and employed organization-defined security safeguards. DoD has determined the individuals or information systems are not appropriate to define at the Enterprise level.','The organization conducting the inspection/assessment obtains and examines the documented information, information system components, or devices to ensure the organization being inspected/assessed defines the individuals or information systems authorized to be recipients of organization-defined information, information system components, or devices, and has employed organization-defined security safeguards. DoD has determined the individuals or information systems are not appropriate to define at the Enterprise level.');\n/*!40000 ALTER TABLE `cci` ENABLE KEYS */;\nUNLOCK TABLES;\n\n--\n-- Dumping data for table `cci_reference_map`\n--\n\nLOCK TABLES `cci_reference_map` WRITE;\n/*!40000 ALTER TABLE `cci_reference_map` DISABLE KEYS */;\nINSERT INTO `cci_reference_map` VALUES (21392,'001545','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 b 1','AC-1b.1.','AC-1'),\n(21393,'001546','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 b 2','AC-1b.2.','AC-1'),\n(21394,'000001','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 1','AC-1a.1.','AC-1'),\n(21395,'000004','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 2','AC-1a.2.','AC-1'),\n(21396,'000002','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 1','AC-1a.1.','AC-1'),\n(21397,'000003','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 b 1','AC-1b.1.','AC-1'),\n(21398,'000005','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 2','AC-1a.2.','AC-1'),\n(21399,'000006','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 b 2','AC-1b.2.','AC-1'),\n(21400,'001547','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 j','AC-2j.','AC-2'),\n(21401,'000008','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 c','AC-2c.','AC-2'),\n(21402,'000010','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 e','AC-2e.','AC-2'),\n(21403,'000011','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 f','AC-2f.','AC-2'),\n(21404,'000012','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 j','AC-2j.','AC-2'),\n(21405,'000015','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (1)','AC-2 (1)','AC-2 (1)'),\n(21406,'000016','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (2)','AC-2 (2)','AC-2 (2)'),\n(21407,'000017','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (3)','AC-2 (3)','AC-2 (3)'),\n(21408,'000018','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2 (4)','AC-2 (4)'),\n(21409,'000019','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (5)','AC-2 (5)','AC-2 (5)'),\n(21410,'001361','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (2)','AC-2 (2)','AC-2 (2)'),\n(21411,'001365','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (2)','AC-2 (2)','AC-2 (2)'),\n(21412,'000217','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (3)','AC-2 (3)','AC-2 (3)'),\n(21413,'001403','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2 (4)','AC-2 (4)'),\n(21414,'001404','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2 (4)','AC-2 (4)'),\n(21415,'001405','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2 (4)','AC-2 (4)'),\n(21416,'001406','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (5)','AC-2 (5)','AC-2 (5)'),\n(21417,'001407','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (7) (a)','AC-2 (7)(a)','AC-2 (7)'),\n(21418,'001358','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (7) (a)','AC-2 (7)(a)','AC-2 (7)'),\n(21419,'001360','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (7) (b)','AC-2 (7)(b)','AC-2 (7)'),\n(21420,'001682','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (2)','AC-2 (2)','AC-2 (2)'),\n(21421,'001683','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2 (4)','AC-2 (4)'),\n(21422,'001684','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2 (4)','AC-2 (4)'),\n(21423,'001685','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2 (4)','AC-2 (4)'),\n(21424,'001686','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2 (4)','AC-2 (4)'),\n(21425,'001548','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4','AC-4','AC-4'),\n(21426,'001549','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4','AC-4','AC-4'),\n(21427,'001550','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4','AC-4','AC-4'),\n(21428,'001551','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4','AC-4','AC-4'),\n(21429,'001553','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (10)','AC-4 (10)','AC-4 (10)'),\n(21430,'001554','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (11)','AC-4 (11)','AC-4 (11)'),\n(21431,'000026','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (2)','AC-4 (2)','AC-4 (2)'),\n(21432,'000027','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (3)','AC-4 (3)','AC-4 (3)'),\n(21433,'000028','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (4)','AC-4 (4)','AC-4 (4)'),\n(21434,'000029','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (5)','AC-4 (5)','AC-4 (5)'),\n(21435,'000030','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (6)','AC-4 (6)','AC-4 (6)'),\n(21436,'000031','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (7)','AC-4 (7)','AC-4 (7)'),\n(21437,'000032','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (8)','AC-4 (8)','AC-4 (8)'),\n(21438,'000034','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (10)','AC-4 (10)','AC-4 (10)'),\n(21439,'000035','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (11)','AC-4 (11)','AC-4 (11)'),\n(21440,'000219','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (13)','AC-4 (13)','AC-4 (13)'),\n(21441,'001414','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4','AC-4','AC-4'),\n(21442,'001415','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (5)','AC-4 (5)','AC-4 (5)'),\n(21443,'001416','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (7)','AC-4 (7)','AC-4 (7)'),\n(21444,'001417','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (8)','AC-4 (8)','AC-4 (8)'),\n(21445,'001368','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4','AC-4','AC-4'),\n(21446,'001371','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (14)','AC-4 (14)','AC-4 (14)'),\n(21447,'001372','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (14)','AC-4 (14)','AC-4 (14)'),\n(21448,'001373','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (15)','AC-4 (15)','AC-4 (15)'),\n(21449,'001374','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (15)','AC-4 (15)','AC-4 (15)'),\n(21450,'001558','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (1)','AC-6 (1)','AC-6 (1)'),\n(21451,'000039','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (2)','AC-6 (2)','AC-6 (2)'),\n(21452,'000041','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (3)','AC-6 (3)','AC-6 (3)'),\n(21453,'000042','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (3)','AC-6 (3)','AC-6 (3)'),\n(21454,'000225','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6','AC-6','AC-6'),\n(21455,'001419','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (2)','AC-6 (2)','AC-6 (2)'),\n(21456,'001420','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (3)','AC-6 (3)','AC-6 (3)'),\n(21457,'001422','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (6)','AC-6 (6)','AC-6 (6)'),\n(21458,'001559','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (2)','AC-16 (2)','AC-16 (2)'),\n(21459,'001560','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16 (4)','AC-16 (4)'),\n(21460,'001424','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (1)','AC-16 (1)','AC-16 (1)'),\n(21461,'001425','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (2)','AC-16 (2)','AC-16 (2)'),\n(21462,'001428','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (5)','AC-16 (5)','AC-16 (5)'),\n(21463,'001429','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (5)','AC-16 (5)','AC-16 (5)'),\n(21464,'001430','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (5)','AC-16 (5)','AC-16 (5)'),\n(21465,'001561','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (3)','AC-17 (3)','AC-17 (3)'),\n(21466,'000063','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 a','AC-17a.','AC-17'),\n(21467,'000065','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 b','AC-17b.','AC-17'),\n(21468,'000067','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (1)','AC-17 (1)','AC-17 (1)'),\n(21469,'000068','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (2)','AC-17 (2)','AC-17 (2)'),\n(21470,'000069','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (3)','AC-17 (3)','AC-17 (3)'),\n(21471,'000070','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (4) (a)','AC-17 (4)(a)','AC-17 (4)'),\n(21472,'000072','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (6)','AC-17 (6)','AC-17 (6)'),\n(21473,'001453','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (2)','AC-17 (2)','AC-17 (2)'),\n(21474,'001438','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 a','AC-18a.','AC-18'),\n(21475,'001439','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 a','AC-18a.','AC-18'),\n(21476,'001441','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 b','AC-18b.','AC-18'),\n(21477,'001443','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 (1)','AC-18 (1)','AC-18 (1)'),\n(21478,'001444','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 (1)','AC-18 (1)','AC-18 (1)'),\n(21479,'001449','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 (3)','AC-18 (3)','AC-18 (3)'),\n(21480,'001451','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 (5)','AC-18 (5)','AC-18 (5)'),\n(21481,'001564','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 b 1','AT-1b.1.','AT-1'),\n(21482,'001565','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 b 2','AT-1b.2.','AT-1'),\n(21483,'000100','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 a 1','AT-1a.1.','AT-1'),\n(21484,'000101','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 a 1','AT-1a.1.','AT-1'),\n(21485,'000102','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 b 1','AT-1b.1.','AT-1'),\n(21486,'000103','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 a 2','AT-1a.2.','AT-1'),\n(21487,'000104','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 a 2','AT-1a.2.','AT-1'),\n(21488,'000105','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 b 2','AT-1b.2.','AT-1'),\n(21489,'001566','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (2)','AT-3 (2)','AT-3 (2)'),\n(21490,'001567','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (2)','AT-3 (2)','AT-3 (2)'),\n(21491,'001568','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (2)','AT-3 (2)','AT-3 (2)'),\n(21492,'000108','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 a','AT-3a.','AT-3'),\n(21493,'000109','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 b','AT-3b.','AT-3'),\n(21494,'000110','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 c','AT-3c.','AT-3'),\n(21495,'000111','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 c','AT-3c.','AT-3'),\n(21496,'001481','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (1)','AT-3 (1)','AT-3 (1)'),\n(21497,'001482','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (1)','AT-3 (1)','AT-3 (1)'),\n(21498,'001483','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (1)','AT-3 (1)','AT-3 (1)'),\n(21499,'001569','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b 1','AU-1b.1.','AU-1'),\n(21500,'001570','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b 2','AU-1b.2.','AU-1'),\n(21501,'000117','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 1','AU-1a.1.','AU-1'),\n(21502,'000119','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b 1','AU-1b.1.','AU-1'),\n(21503,'000120','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 2','AU-1a.2.','AU-1'),\n(21504,'000122','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b 2','AU-1b.2.','AU-1'),\n(21505,'001571','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 a','AU-2a.','AU-2'),\n(21506,'000123','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 a','AU-2a.','AU-2'),\n(21507,'000124','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 b','AU-2b.','AU-2'),\n(21508,'000125','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 c','AU-2c.','AU-2'),\n(21509,'000126','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 d','AU-2d.','AU-2'),\n(21510,'000127','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 (3)','AU-2 (3)','AU-2 (3)'),\n(21511,'001484','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 d','AU-2d.','AU-2'),\n(21512,'001485','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 d','AU-2d.','AU-2'),\n(21513,'001486','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 (3)','AU-2 (3)','AU-2 (3)'),\n(21514,'001572','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 a','AU-5a.','AU-5'),\n(21515,'001573','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (3)','AU-5 (3)','AU-5 (3)'),\n(21516,'000139','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 a','AU-5a.','AU-5'),\n(21517,'000140','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 b','AU-5b.','AU-5'),\n(21518,'000145','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (3)','AU-5 (3)','AU-5 (3)'),\n(21519,'000147','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (2)','AU-5 (2)','AU-5 (2)'),\n(21520,'001490','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 b','AU-5b.','AU-5'),\n(21521,'001575','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (2)','AU-9 (2)','AU-9 (2)'),\n(21522,'000162','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9','AU-9','AU-9'),\n(21523,'000163','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9','AU-9','AU-9'),\n(21524,'000164','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9','AU-9','AU-9'),\n(21525,'000165','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (1)','AU-9 (1)','AU-9 (1)'),\n(21526,'001348','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (2)','AU-9 (2)','AU-9 (2)'),\n(21527,'001349','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (2)','AU-9 (2)','AU-9 (2)'),\n(21528,'001350','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (3)','AU-9 (3)','AU-9 (3)'),\n(21529,'001351','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (4)','AU-9 (4)','AU-9 (4)'),\n(21530,'001493','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9','AU-9','AU-9'),\n(21531,'001494','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9','AU-9','AU-9'),\n(21532,'001495','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9','AU-9','AU-9'),\n(21533,'001496','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (3)','AU-9 (3)','AU-9 (3)'),\n(21534,'001576','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (1)','AU-12 (1)','AU-12 (1)'),\n(21535,'001577','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (1)','AU-12 (1)','AU-12 (1)'),\n(21536,'000169','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 a','AU-12a.','AU-12'),\n(21537,'000171','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 b','AU-12b.','AU-12'),\n(21538,'000172','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 c','AU-12c.','AU-12'),\n(21539,'000173','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (1)','AU-12 (1)','AU-12 (1)'),\n(21540,'000174','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (1)','AU-12 (1)','AU-12 (1)'),\n(21541,'001459','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 a','AU-12a.','AU-12'),\n(21542,'001353','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (2)','AU-12 (2)','AU-12 (2)'),\n(21543,'001578','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 b 2','CA-1b.2.','CA-1'),\n(21544,'000238','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 b 1','CA-1b.1.','CA-1'),\n(21545,'000239','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 1','CA-1a.1.','CA-1'),\n(21546,'000240','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 1','CA-1a.1.','CA-1'),\n(21547,'000240','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 1','CA-1a.1.','CA-1'),\n(21548,'000241','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 b 1','CA-1b.1.','CA-1'),\n(21549,'000242','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 2','CA-1a.2.','CA-1'),\n(21550,'000243','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 2','CA-1a.2.','CA-1'),\n(21551,'000244','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 b 2','CA-1b.2.','CA-1'),\n(21552,'000245','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 a','CA-2a.','CA-2'),\n(21553,'000246','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 a 1','CA-2a.1.','CA-2'),\n(21554,'000247','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 a 2','CA-2a.2.','CA-2'),\n(21555,'000248','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 a 3','CA-2a.3.','CA-2'),\n(21556,'000251','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 b','CA-2b.','CA-2'),\n(21557,'000252','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 b','CA-2b.','CA-2'),\n(21558,'000253','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 c','CA-2c.','CA-2'),\n(21559,'000254','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 d','CA-2d.','CA-2'),\n(21560,'000255','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (1)','CA-2 (1)','CA-2 (1)'),\n(21561,'000256','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (2)','CA-2 (2)','CA-2 (2)'),\n(21562,'000257','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 a','CA-3a.','CA-3'),\n(21563,'000258','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 b','CA-3b.','CA-3'),\n(21564,'000259','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 b','CA-3b.','CA-3'),\n(21565,'000260','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 b','CA-3b.','CA-3'),\n(21566,'000262','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (1)','CA-3 (1)','CA-3 (1)'),\n(21567,'000263','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (2)','CA-3 (2)','CA-3 (2)'),\n(21568,'001581','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 g','CA-7g.','CA-7'),\n(21569,'001582','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (2)','CA-2 (2)','CA-2 (2)'),\n(21570,'001583','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (2)','CA-2 (2)','CA-2 (2)'),\n(21571,'000274','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-7','CA-7','CA-7'),\n(21572,'000279','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 c','CA-7c.','CA-7'),\n(21573,'000280','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 g','CA-7g.','CA-7'),\n(21574,'000281','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 g','CA-7g.','CA-7'),\n(21575,'000282','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 (1)','CA-7 (1)','CA-7 (1)'),\n(21576,'001681','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (2)','CA-2 (2)','CA-2 (2)'),\n(21577,'001584','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 b 2','CM-1b.2.','CM-1'),\n(21578,'000286','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 b 1','CM-1b.1.','CM-1'),\n(21579,'000287','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 1','CM-1a.1.','CM-1'),\n(21580,'000289','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 b 1','CM-1b.1.','CM-1'),\n(21581,'000290','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 2','CM-1a.2.','CM-1'),\n(21582,'000292','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 b 2','CM-1b.2.','CM-1'),\n(21583,'001585','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (1) (b)','CM-2 (1)(b)','CM-2 (1)'),\n(21584,'000293','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2','CM-2','CM-2'),\n(21585,'000294','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2','CM-2','CM-2'),\n(21586,'000295','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2','CM-2','CM-2'),\n(21587,'000296','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (1) (a)','CM-2 (1)(a)','CM-2 (1)'),\n(21588,'000297','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (1) (b)','CM-2 (1)(b)','CM-2 (1)'),\n(21589,'000298','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (1) (c)','CM-2 (1)(c)','CM-2 (1)'),\n(21590,'000299','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (1) (c)','CM-2 (1)(c)','CM-2 (1)'),\n(21591,'000300','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (2)','CM-2 (2)','CM-2 (2)'),\n(21592,'000301','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (2)','CM-2 (2)','CM-2 (2)'),\n(21593,'000302','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (2)','CM-2 (2)','CM-2 (2)'),\n(21594,'000303','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (2)','CM-2 (2)','CM-2 (2)'),\n(21595,'000304','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (3)','CM-2 (3)','CM-2 (3)'),\n(21596,'000311','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (6)','CM-2 (6)','CM-2 (6)'),\n(21597,'000312','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (6)','CM-2 (6)','CM-2 (6)'),\n(21598,'001497','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (1) (a)','CM-2 (1)(a)','CM-2 (1)'),\n(21599,'001586','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 g','CM-3g.','CM-3'),\n(21600,'001586','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (4)','CM-3 (4)','CM-3 (4)'),\n(21601,'000313','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 a','CM-3a.','CM-3'),\n(21602,'000314','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 b','CM-3b.','CM-3'),\n(21603,'000316','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 e','CM-3e.','CM-3'),\n(21604,'000318','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 f','CM-3f.','CM-3'),\n(21605,'000319','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 g','CM-3g.','CM-3'),\n(21606,'000320','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 g','CM-3g.','CM-3'),\n(21607,'000321','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 g','CM-3g.','CM-3'),\n(21608,'000322','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (a)','CM-3 (1)(a)','CM-3 (1)'),\n(21609,'000323','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (b)','CM-3 (1)(b)','CM-3 (1)'),\n(21610,'000324','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (c)','CM-3 (1)(c)','CM-3 (1)'),\n(21611,'000325','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (d)','CM-3 (1)(d)','CM-3 (1)'),\n(21612,'000326','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (e)','CM-3 (1)(e)','CM-3 (1)'),\n(21613,'000327','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (2)','CM-3 (2)','CM-3 (2)'),\n(21614,'000328','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (2)','CM-3 (2)','CM-3 (2)'),\n(21615,'000329','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (2)','CM-3 (2)','CM-3 (2)'),\n(21616,'000330','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (3)','CM-3 (3)','CM-3 (3)'),\n(21617,'000331','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (3)','CM-3 (3)','CM-3 (3)'),\n(21618,'000332','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (4)','CM-3 (4)','CM-3 (4)'),\n(21619,'001498','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (c)','CM-3 (1)(c)','CM-3 (1)'),\n(21620,'000333','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-4','CM-4','CM-4'),\n(21621,'000335','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-4 (2)','CM-4 (2)','CM-4 (2)'),\n(21622,'000336','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-4 (2)','CM-4 (2)','CM-4 (2)'),\n(21623,'000337','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-4 (2)','CM-4 (2)','CM-4 (2)'),\n(21624,'001588','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 a','CM-6a.','CM-6'),\n(21625,'000363','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 a','CM-6a.','CM-6'),\n(21626,'000364','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 a','CM-6a.','CM-6'),\n(21627,'000365','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 a','CM-6a.','CM-6'),\n(21628,'000366','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 b','CM-6b.','CM-6'),\n(21629,'000367','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 c','CM-6c.','CM-6'),\n(21630,'000368','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 c','CM-6c.','CM-6'),\n(21631,'000369','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 c','CM-6c.','CM-6'),\n(21632,'000370','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (1)','CM-6 (1)','CM-6 (1)'),\n(21633,'000371','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (1)','CM-6 (1)','CM-6 (1)'),\n(21634,'000372','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (1)','CM-6 (1)','CM-6 (1)'),\n(21635,'001502','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 d','CM-6d.','CM-6'),\n(21636,'001503','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 d','CM-6d.','CM-6'),\n(21637,'001592','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (2)','CM-7 (2)','CM-7 (2)'),\n(21638,'000380','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 b','CM-7b.','CM-7'),\n(21639,'000381','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 a','CM-7a.','CM-7'),\n(21640,'000382','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 b','CM-7b.','CM-7'),\n(21641,'000384','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (1) (a)','CM-7 (1)(a)','CM-7 (1)'),\n(21642,'000387','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (3)','CM-7 (3)','CM-7 (3)'),\n(21643,'000388','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (3)','CM-7 (3)','CM-7 (3)'),\n(21644,'001596','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 b 2','CP-1b.2.','CP-1'),\n(21645,'001597','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 a 2','CP-1a.2.','CP-1'),\n(21646,'001598','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 b 2','CP-1b.2.','CP-1'),\n(21647,'000437','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 b 1','CP-1b.1.','CP-1'),\n(21648,'000438','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 a 1','CP-1a.1.','CP-1'),\n(21649,'000439','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 a 1','CP-1a.1.','CP-1'),\n(21650,'000440','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 b 1','CP-1b.1.','CP-1'),\n(21651,'000441','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 a 2','CP-1a.2.','CP-1'),\n(21652,'001599','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (5)','CP-2 (5)','CP-2 (5)'),\n(21653,'001600','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (5)','CP-2 (5)','CP-2 (5)'),\n(21654,'001601','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (6)','CP-2 (6)','CP-2 (6)'),\n(21655,'001602','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (6)','CP-2 (6)','CP-2 (6)'),\n(21656,'000443','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 1','CP-2a.1.','CP-2'),\n(21657,'000444','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 1','CP-2a.1.','CP-2'),\n(21658,'000445','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 1','CP-2a.1.','CP-2'),\n(21659,'000446','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 2','CP-2a.2.','CP-2'),\n(21660,'000447','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 2','CP-2a.2.','CP-2'),\n(21661,'000448','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 2','CP-2a.2.','CP-2'),\n(21662,'000449','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 3','CP-2a.3.','CP-2'),\n(21663,'000450','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 4','CP-2a.4.','CP-2'),\n(21664,'000451','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 4','CP-2a.4.','CP-2'),\n(21665,'000452','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 4','CP-2a.4.','CP-2'),\n(21666,'000453','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 4','CP-2a.4.','CP-2'),\n(21667,'000454','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 4','CP-2a.4.','CP-2'),\n(21668,'000455','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 4','CP-2a.4.','CP-2'),\n(21669,'000456','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 5','CP-2a.5.','CP-2'),\n(21670,'000457','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 6','CP-2a.6.','CP-2'),\n(21671,'000458','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 b','CP-2b.','CP-2'),\n(21672,'000459','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 b','CP-2b.','CP-2'),\n(21673,'000460','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 c','CP-2c.','CP-2'),\n(21674,'000461','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 d','CP-2d.','CP-2'),\n(21675,'000462','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 d','CP-2d.','CP-2'),\n(21676,'000463','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 e','CP-2e.','CP-2'),\n(21677,'000464','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 e','CP-2e.','CP-2'),\n(21678,'000465','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 e','CP-2e.','CP-2'),\n(21679,'000466','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 e','CP-2e.','CP-2'),\n(21680,'000468','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 f','CP-2f.','CP-2'),\n(21681,'000469','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (1)','CP-2 (1)','CP-2 (1)'),\n(21682,'000470','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (2)','CP-2 (2)','CP-2 (2)'),\n(21683,'000471','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (2)','CP-2 (2)','CP-2 (2)'),\n(21684,'000472','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (2)','CP-2 (2)','CP-2 (2)'),\n(21685,'000473','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (3)','CP-2 (3)','CP-2 (3)'),\n(21686,'000474','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (3)','CP-2 (3)','CP-2 (3)'),\n(21687,'000475','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (3)','CP-2 (3)','CP-2 (3)'),\n(21688,'000476','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (3)','CP-2 (3)','CP-2 (3)'),\n(21689,'000477','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (4)','CP-2 (4)','CP-2 (4)'),\n(21690,'000478','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (4)','CP-2 (4)','CP-2 (4)'),\n(21691,'000479','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (4)','CP-2 (4)','CP-2 (4)'),\n(21692,'000480','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (4)','CP-2 (4)','CP-2 (4)'),\n(21693,'000481','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (5)','CP-2 (5)','CP-2 (5)'),\n(21694,'000482','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (5)','CP-2 (5)','CP-2 (5)'),\n(21695,'000483','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (6)','CP-2 (6)','CP-2 (6)'),\n(21696,'000484','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (6)','CP-2 (6)','CP-2 (6)'),\n(21697,'001604','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-6 (3)','CP-6 (3)','CP-6 (3)'),\n(21698,'000505','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-6 a','CP-6a.','CP-6'),\n(21699,'000507','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-6 (1)','CP-6 (1)','CP-6 (1)'),\n(21700,'000508','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-6 (2)','CP-6 (2)','CP-6 (2)'),\n(21701,'000509','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-6 (3)','CP-6 (3)','CP-6 (3)'),\n(21702,'001606','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (2)','CP-7 (2)','CP-7 (2)'),\n(21703,'000510','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 a','CP-7a.','CP-7'),\n(21704,'000513','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 a','CP-7a.','CP-7'),\n(21705,'000514','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 a','CP-7a.','CP-7'),\n(21706,'000515','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 b','CP-7b.','CP-7'),\n(21707,'000516','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (1)','CP-7 (1)','CP-7 (1)'),\n(21708,'000517','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (2)','CP-7 (2)','CP-7 (2)'),\n(21709,'000518','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (3)','CP-7 (3)','CP-7 (3)'),\n(21710,'000519','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (4)','CP-7 (4)','CP-7 (4)'),\n(21711,'000520','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (4)','CP-7 (4)','CP-7 (4)'),\n(21712,'000521','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 c','CP-7c.','CP-7'),\n(21713,'000522','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8','CP-8','CP-8'),\n(21714,'000523','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8','CP-8','CP-8'),\n(21715,'000524','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8','CP-8','CP-8'),\n(21716,'000525','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8','CP-8','CP-8'),\n(21717,'000526','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (1) (a)','CP-8 (1)(a)','CP-8 (1)'),\n(21718,'000527','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (1) (a)','CP-8 (1)(a)','CP-8 (1)'),\n(21719,'000528','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (1) (b)','CP-8 (1)(b)','CP-8 (1)'),\n(21720,'000529','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (1) (b)','CP-8 (1)(b)','CP-8 (1)'),\n(21721,'000530','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (2)','CP-8 (2)','CP-8 (2)'),\n(21722,'000531','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (3)','CP-8 (3)','CP-8 (3)'),\n(21723,'000532','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (4) (a)','CP-8 (4)(a)','CP-8 (4)'),\n(21724,'000533','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (4) (a)','CP-8 (4)(a)','CP-8 (4)'),\n(21725,'001609','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (6)','CP-9 (6)','CP-9 (6)'),\n(21726,'000534','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (a)','CP-9(a)','CP-9'),\n(21727,'000535','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (a)','CP-9(a)','CP-9'),\n(21728,'000536','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (b)','CP-9(b)','CP-9'),\n(21729,'000537','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (b)','CP-9(b)','CP-9'),\n(21730,'000538','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (c)  ','CP-9(c)','CP-9'),\n(21731,'000539','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (c)  ','CP-9(c)','CP-9'),\n(21732,'000540','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (d)','CP-9(d)','CP-9'),\n(21733,'000541','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (1)','CP-9 (1)','CP-9 (1)'),\n(21734,'000542','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (1)','CP-9 (1)','CP-9 (1)'),\n(21735,'000543','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (2)','CP-9 (2)','CP-9 (2)'),\n(21736,'000547','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (5)','CP-9 (5)','CP-9 (5)'),\n(21737,'000548','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (5)','CP-9 (5)','CP-9 (5)'),\n(21738,'000549','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (6)','CP-9 (6)','CP-9 (6)'),\n(21739,'001610','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 g','IA-5g.','IA-5'),\n(21740,'001611','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (a)','IA-5 (1)(a)','IA-5 (1)'),\n(21741,'001612','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (a)','IA-5 (1)(a)','IA-5 (1)'),\n(21742,'001613','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (a)','IA-5 (1)(a)','IA-5 (1)'),\n(21743,'001614','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (a)','IA-5 (1)(a)','IA-5 (1)'),\n(21744,'001615','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (b)','IA-5 (1)(b)','IA-5 (1)'),\n(21745,'001616','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (d)','IA-5 (1)(d)','IA-5 (1)'),\n(21746,'001617','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (d)','IA-5 (1)(d)','IA-5 (1)'),\n(21747,'001618','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (e)','IA-5 (1)(e)','IA-5 (1)'),\n(21748,'001619','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (a)','IA-5 (1)(a)','IA-5 (1)'),\n(21749,'001621','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (8)','IA-5 (8)','IA-5 (8)'),\n(21750,'000176','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 b','IA-5b.','IA-5'),\n(21751,'000179','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 f','IA-5f.','IA-5'),\n(21752,'000180','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 f','IA-5f.','IA-5'),\n(21753,'000181','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 f','IA-5f.','IA-5'),\n(21754,'000182','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 g','IA-5g.','IA-5'),\n(21755,'000183','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 h','IA-5h.','IA-5'),\n(21756,'000184','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 i','IA-5i.','IA-5'),\n(21757,'000185','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (2) (a)','IA-5 (2)(a)','IA-5 (2)'),\n(21758,'000186','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (2) (b)','IA-5 (2)(b)','IA-5 (2)'),\n(21759,'000187','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (2) (c)','IA-5 (2)(c)','IA-5 (2)'),\n(21760,'000201','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (6)','IA-5 (6)','IA-5 (6)'),\n(21761,'000202','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (7)','IA-5 (7)','IA-5 (7)'),\n(21762,'000204','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (8)','IA-5 (8)','IA-5 (8)'),\n(21763,'000192','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (a)','IA-5 (1)(a)','IA-5 (1)'),\n(21764,'000193','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (a)','IA-5 (1)(a)','IA-5 (1)'),\n(21765,'000194','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (a)','IA-5 (1)(a)','IA-5 (1)'),\n(21766,'000195','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (b)','IA-5 (1)(b)','IA-5 (1)'),\n(21767,'000196','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (c)','IA-5 (1)(c)','IA-5 (1)'),\n(21768,'000197','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (c)','IA-5 (1)(c)','IA-5 (1)'),\n(21769,'000198','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (d)','IA-5 (1)(d)','IA-5 (1)'),\n(21770,'000199','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (d)','IA-5 (1)(d)','IA-5 (1)'),\n(21771,'000200','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (e)','IA-5 (1)(e)','IA-5 (1)'),\n(21772,'000203','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (7)','IA-5 (7)','IA-5 (7)'),\n(21773,'000205','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (a)','IA-5 (1)(a)','IA-5 (1)'),\n(21774,'001544','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 c','IA-5c.','IA-5'),\n(21775,'000813','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 a','IR-2a.','IR-2'),\n(21776,'000814','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 c','IR-2c.','IR-2'),\n(21777,'000815','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 c','IR-2c.','IR-2'),\n(21778,'000816','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 (1)','IR-2 (1)','IR-2 (1)'),\n(21779,'000817','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 (2)','IR-2 (2)','IR-2 (2)'),\n(21780,'001624','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-3','IR-3','IR-3'),\n(21781,'000818','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-3','IR-3','IR-3'),\n(21782,'000819','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-3','IR-3','IR-3'),\n(21783,'000820','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-3','IR-3','IR-3'),\n(21784,'000821','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (1)','IR-3 (1)','IR-3 (1)'),\n(21785,'001625','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 c','IR-4c.','IR-4'),\n(21786,'000822','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 a','IR-4a.','IR-4'),\n(21787,'000823','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 b','IR-4b.','IR-4'),\n(21788,'000824','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 c','IR-4c.','IR-4'),\n(21789,'000825','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (1)','IR-4 (1)','IR-4 (1)'),\n(21790,'000826','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (2)','IR-4 (2)','IR-4 (2)'),\n(21791,'000827','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (3)','IR-4 (3)','IR-4 (3)'),\n(21792,'000828','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (3)','IR-4 (3)','IR-4 (3)'),\n(21793,'000829','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (4)','IR-4 (4)','IR-4 (4)'),\n(21794,'000830','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (5)','IR-4 (5)','IR-4 (5)'),\n(21795,'000831','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (5)','IR-4 (5)','IR-4 (5)'),\n(21796,'001626','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-5 (1)','IR-5 (1)','IR-5 (1)'),\n(21797,'001627','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-5 (1)','IR-5 (1)','IR-5 (1)'),\n(21798,'000832','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-5','IR-5','IR-5'),\n(21799,'000833','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-5 (1)','IR-5 (1)','IR-5 (1)'),\n(21800,'001628','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 b 2','MA-1b.2.','MA-1'),\n(21801,'000854','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 b 1','MA-1b.1.','MA-1'),\n(21802,'000855','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 a 2','MA-1a.2.','MA-1'),\n(21803,'000856','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 a 2','MA-1a.2.','MA-1'),\n(21804,'000857','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 b 2','MA-1b.2.','MA-1'),\n(21805,'000851','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 b 1','MA-1b.1.','MA-1'),\n(21806,'000852','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 a 1','MA-1a.1.','MA-1'),\n(21807,'000853','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 a 1','MA-1a.1.','MA-1'),\n(21808,'000859','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 b','MA-2b.','MA-2'),\n(21809,'000860','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 c','MA-2c.','MA-2'),\n(21810,'000861','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 d','MA-2d.','MA-2'),\n(21811,'000862','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 e','MA-2e.','MA-2'),\n(21812,'001631','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (3) (b)','MA-4 (3)(b)','MA-4 (3)'),\n(21813,'001632','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (4) (b)','MA-4 (4)(b)','MA-4 (4)'),\n(21814,'000873','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 a','MA-4a.','MA-4'),\n(21815,'000874','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 a','MA-4a.','MA-4'),\n(21816,'000876','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 b','MA-4b.','MA-4'),\n(21817,'000877','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 c','MA-4c.','MA-4'),\n(21818,'000878','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 d','MA-4d.','MA-4'),\n(21819,'000879','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 e','MA-4e.','MA-4'),\n(21820,'000881','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (2)','MA-4 (2)','MA-4 (2)'),\n(21821,'000882','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (3) (a)','MA-4 (3)(a)','MA-4 (3)'),\n(21822,'000883','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (3) (b)','MA-4 (3)(b)','MA-4 (3)'),\n(21823,'000884','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (4) (a)','MA-4 (4)(a)','MA-4 (4)'),\n(21824,'000886','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (5) (b)','MA-4 (5)(b)','MA-4 (5)'),\n(21825,'000887','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (5) (a)','MA-4 (5)(a)','MA-4 (5)'),\n(21826,'001010','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-3 a','MP-3a.','MP-3'),\n(21827,'001011','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-3 b','MP-3b.','MP-3'),\n(21828,'001012','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-3 b','MP-3b.','MP-3'),\n(21829,'001013','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-3 b','MP-3b.','MP-3'),\n(21830,'001635','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 d','PE-2d.','PE-2'),\n(21831,'000912','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 a','PE-2a.','PE-2'),\n(21832,'000913','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 b','PE-2b.','PE-2'),\n(21833,'000914','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 c','PE-2c.','PE-2'),\n(21834,'000915','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 c','PE-2c.','PE-2'),\n(21835,'000916','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 (1)','PE-2 (1)','PE-2 (1)'),\n(21836,'000917','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 (2)','PE-2 (2)','PE-2 (2)'),\n(21837,'001636','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 b 1','PL-1b.1.','PL-1'),\n(21838,'001637','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 b 1','PL-1b.1.','PL-1'),\n(21839,'001638','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 b 2','PL-1b.2.','PL-1'),\n(21840,'000563','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 a 1','PL-1a.1.','PL-1'),\n(21841,'000564','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 a 1','PL-1a.1.','PL-1'),\n(21842,'000566','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 a 2','PL-1a.2.','PL-1'),\n(21843,'000567','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 a 2','PL-1a.2.','PL-1'),\n(21844,'000568','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 b 2','PL-1b.2.','PL-1'),\n(21845,'001639','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 a','PL-4a.','PL-4'),\n(21846,'000592','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 a','PL-4a.','PL-4'),\n(21847,'000593','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 b','PL-4b.','PL-4'),\n(21848,'000594','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 (1)','PL-4 (1)','PL-4 (1)'),\n(21849,'000595','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 (1)','PL-4 (1)','PL-4 (1)'),\n(21850,'001640','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-8','PM-8','PM-8'),\n(21851,'000216','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-8','PM-8','PM-8'),\n(21852,'001641','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 a','RA-5a.','RA-5'),\n(21853,'001643','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 a','RA-5a.','RA-5'),\n(21854,'001645','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (5)','RA-5 (5)','RA-5 (5)'),\n(21855,'001054','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 a','RA-5a.','RA-5'),\n(21856,'001055','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 a','RA-5a.','RA-5'),\n(21857,'001056','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 a','RA-5a.','RA-5'),\n(21858,'001057','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 b','RA-5b.','RA-5'),\n(21859,'001058','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 c','RA-5c.','RA-5'),\n(21860,'001059','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 d','RA-5d.','RA-5'),\n(21861,'001060','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 d','RA-5d.','RA-5'),\n(21862,'001061','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 e','RA-5e.','RA-5'),\n(21863,'001062','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (1)','RA-5 (1)','RA-5 (1)'),\n(21864,'001063','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (2)','RA-5 (2)','RA-5 (2)'),\n(21865,'001064','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (2)','RA-5 (2)','RA-5 (2)'),\n(21866,'001066','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (4)','RA-5 (4)','RA-5 (4)'),\n(21867,'001067','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (5)','RA-5 (5)','RA-5 (5)'),\n(21868,'001068','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (6)','RA-5 (6)','RA-5 (6)'),\n(21869,'001071','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (8)','RA-5 (8)','RA-5 (8)'),\n(21870,'001642','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 b','RA-3b.','RA-3'),\n(21871,'001048','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 a','RA-3a.','RA-3'),\n(21872,'001049','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 b','RA-3b.','RA-3'),\n(21873,'001050','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 c','RA-3c.','RA-3'),\n(21874,'001051','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 c','RA-3c.','RA-3'),\n(21875,'001052','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 e','RA-3e.','RA-3'),\n(21876,'001053','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 e','RA-3e.','RA-3'),\n(21877,'000610','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 b','SA-2b.','SA-2'),\n(21878,'000611','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 b','SA-2b.','SA-2'),\n(21879,'000612','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 b','SA-2b.','SA-2'),\n(21880,'000613','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 c','SA-2c.','SA-2'),\n(21881,'000614','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 c','SA-2c.','SA-2'),\n(21882,'000623','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (1)','SA-4 (1)','SA-4 (1)'),\n(21883,'000631','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (6) (a)','SA-4 (6)(a)','SA-4 (6)'),\n(21884,'000633','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (6) (b)','SA-4 (6)(b)','SA-4 (6)'),\n(21885,'000634','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (7) (a)','SA-4 (7)(a)','SA-4 (7)'),\n(21886,'000635','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (7) (b)','SA-4 (7)(b)','SA-4 (7)'),\n(21887,'000642','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 c','SA-5c.','SA-5'),\n(21888,'000692','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 c','SA-10c.','SA-10'),\n(21889,'000694','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 d','SA-10d.','SA-10'),\n(21890,'000698','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (1)','SA-10 (1)','SA-10 (1)'),\n(21891,'000700','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (2)','SA-10 (2)','SA-10 (2)'),\n(21892,'001084','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-3','SC-3','SC-3'),\n(21893,'001085','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-3 (1)','SC-3 (1)','SC-3 (1)'),\n(21894,'001086','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-3 (2)','SC-3 (2)','SC-3 (2)'),\n(21895,'001089','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-3 (5)','SC-3 (5)','SC-3 (5)'),\n(21896,'001097','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 a','SC-7a.','SC-7'),\n(21897,'001098','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 c','SC-7c.','SC-7'),\n(21898,'001101','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (3)','SC-7 (3)','SC-7 (3)'),\n(21899,'001102','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (a)','SC-7 (4)(a)','SC-7 (4)'),\n(21900,'001103','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (b)','SC-7 (4)(b)','SC-7 (4)'),\n(21901,'001105','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (d)','SC-7 (4)(d)','SC-7 (4)'),\n(21902,'001106','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (e)','SC-7 (4)(e)','SC-7 (4)'),\n(21903,'001107','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (e)','SC-7 (4)(e)','SC-7 (4)'),\n(21904,'001108','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (e)','SC-7 (4)(e)','SC-7 (4)'),\n(21905,'001109','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (5)','SC-7 (5)','SC-7 (5)'),\n(21906,'001112','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (8)','SC-7 (8)','SC-7 (8)'),\n(21907,'001113','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (8)','SC-7 (8)','SC-7 (8)'),\n(21908,'001114','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (8)','SC-7 (8)','SC-7 (8)'),\n(21909,'001116','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (10)','SC-7 (10)','SC-7 (10)'),\n(21910,'001119','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (13)','SC-7 (13)','SC-7 (13)'),\n(21911,'001120','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (13)','SC-7 (13)','SC-7 (13)'),\n(21912,'001121','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (14)','SC-7 (14)','SC-7 (14)'),\n(21913,'001122','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (14)','SC-7 (14)','SC-7 (14)'),\n(21914,'001123','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (15)','SC-7 (15)','SC-7 (15)'),\n(21915,'001124','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (16)','SC-7 (16)','SC-7 (16)'),\n(21916,'001125','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (17)','SC-7 (17)','SC-7 (17)'),\n(21917,'001126','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (18)','SC-7 (18)','SC-7 (18)'),\n(21918,'001661','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-11','SC-11','SC-11'),\n(21919,'001135','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-11','SC-11','SC-11'),\n(21920,'001662','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (1)','SC-18 (1)','SC-18 (1)'),\n(21921,'001162','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 b','SC-18b.','SC-18'),\n(21922,'001163','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 c','SC-18c.','SC-18'),\n(21923,'001164','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 c','SC-18c.','SC-18'),\n(21924,'001165','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 c','SC-18c.','SC-18'),\n(21925,'001166','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (1)','SC-18 (1)','SC-18 (1)'),\n(21926,'001167','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (2)','SC-18 (2)','SC-18 (2)'),\n(21927,'001168','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (2)','SC-18 (2)','SC-18 (2)'),\n(21928,'001169','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (3)','SC-18 (3)','SC-18 (3)'),\n(21929,'001170','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (4)','SC-18 (4)','SC-18 (4)'),\n(21930,'001171','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (4)','SC-18 (4)','SC-18 (4)'),\n(21931,'001172','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (4)','SC-18 (4)','SC-18 (4)'),\n(21932,'001160','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 a','SC-18a.','SC-18'),\n(21933,'001161','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 b','SC-18b.','SC-18'),\n(21934,'001687','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (2)','SC-18 (2)','SC-18 (2)'),\n(21935,'001688','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (2)','SC-18 (2)','SC-18 (2)'),\n(21936,'001695','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (3)','SC-18 (3)','SC-18 (3)'),\n(21937,'001663','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-20 b','SC-20b.','SC-20'),\n(21938,'001178','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-20 a','SC-20a.','SC-20'),\n(21939,'001179','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-20 b','SC-20b.','SC-20'),\n(21940,'001664','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-23 (3)','SC-23 (3)','SC-23 (3)'),\n(21941,'001184','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-23','SC-23','SC-23'),\n(21942,'001185','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-23 (1)','SC-23 (1)','SC-23 (1)'),\n(21943,'001188','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-23 (3)','SC-23 (3)','SC-23 (3)'),\n(21944,'001189','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-23 (3)','SC-23 (3)','SC-23 (3)'),\n(21945,'001665','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-24','SC-24','SC-24'),\n(21946,'001190','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-24','SC-24','SC-24'),\n(21947,'001191','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-24','SC-24','SC-24'),\n(21948,'001192','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-24','SC-24','SC-24'),\n(21949,'001193','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-24','SC-24','SC-24'),\n(21950,'001199','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-28','SC-28','SC-28'),\n(21951,'001225','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 a','SI-2a.','SI-2'),\n(21952,'001226','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 a','SI-2a.','SI-2'),\n(21953,'001227','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 a','SI-2a.','SI-2'),\n(21954,'001228','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 b','SI-2b.','SI-2'),\n(21955,'001229','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 b','SI-2b.','SI-2'),\n(21956,'001230','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 d','SI-2d.','SI-2'),\n(21957,'001231','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (1)','SI-2 (1)','SI-2 (1)'),\n(21958,'001233','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (2)','SI-2 (2)','SI-2 (2)'),\n(21959,'001234','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (2)','SI-2 (2)','SI-2 (2)'),\n(21960,'001235','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (3) (a)','SI-2 (3)(a)','SI-2 (3)'),\n(21961,'001236','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (3) (b)','SI-2 (3)(b)','SI-2 (3)'),\n(21962,'001669','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (6) (a)','SI-3 (6)(a)','SI-3 (6)'),\n(21963,'001240','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 b','SI-3b.','SI-3'),\n(21964,'001241','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 c 1','SI-3c.1.','SI-3'),\n(21965,'001242','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 c 1','SI-3c.1.','SI-3'),\n(21966,'001243','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 c 2','SI-3c.2.','SI-3'),\n(21967,'001244','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 c 2','SI-3c.2.','SI-3'),\n(21968,'001245','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 d','SI-3d.','SI-3'),\n(21969,'001246','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (1)','SI-3 (1)','SI-3 (1)'),\n(21970,'001247','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (2)','SI-3 (2)','SI-3 (2)'),\n(21971,'001249','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (4)','SI-3 (4)','SI-3 (4)'),\n(21972,'001251','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (6) (a)','SI-3 (6)(a)','SI-3 (6)'),\n(21973,'001670','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (7)','SI-4 (7)','SI-4 (7)'),\n(21974,'001671','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (11)','SI-4 (11)','SI-4 (11)'),\n(21975,'001673','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (14)','SI-4 (14)','SI-4 (14)'),\n(21976,'001253','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 a 1','SI-4a.1.','SI-4'),\n(21977,'001255','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 c','SI-4c.','SI-4'),\n(21978,'001256','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 c','SI-4c.','SI-4'),\n(21979,'001257','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 e','SI-4e.','SI-4'),\n(21980,'001258','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 f','SI-4f.','SI-4'),\n(21981,'001260','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (2)','SI-4 (2)','SI-4 (2)'),\n(21982,'001264','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (5)','SI-4 (5)','SI-4 (5)'),\n(21983,'001266','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (7)','SI-4 (7)','SI-4 (7)'),\n(21984,'001267','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (7)','SI-4 (7)','SI-4 (7)'),\n(21985,'001268','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (7)','SI-4 (7)','SI-4 (7)'),\n(21986,'001270','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (9)','SI-4 (9)','SI-4 (9)'),\n(21987,'001271','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (9)','SI-4 (9)','SI-4 (9)'),\n(21988,'001273','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (11)','SI-4 (11)','SI-4 (11)'),\n(21989,'001274','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (12)','SI-4 (12)','SI-4 (12)'),\n(21990,'001275','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (12)','SI-4 (12)','SI-4 (12)'),\n(21991,'001276','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (13) (a)','SI-4 (13)(a)','SI-4 (13)'),\n(21992,'001277','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (13) (b)','SI-4 (13)(b)','SI-4 (13)'),\n(21993,'001282','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (15)','SI-4 (15)','SI-4 (15)'),\n(21994,'001283','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (16)','SI-4 (16)','SI-4 (16)'),\n(21995,'001284','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (17)','SI-4 (17)','SI-4 (17)'),\n(21996,'001675','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 (3)','SI-6 (3)','SI-6 (3)'),\n(21997,'001294','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 c','SI-6c.','SI-6'),\n(21998,'001295','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 (2)','SI-6 (2)','SI-6 (2)'),\n(21999,'001296','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 (3)','SI-6 (3)','SI-6 (3)'),\n(22000,'001306','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-8 b','SI-8b.','SI-8'),\n(22001,'001307','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-8 (1)','SI-8 (1)','SI-8 (1)'),\n(22002,'001308','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-8 (2)','SI-8 (2)','SI-8 (2)'),\n(22003,'001678','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-12','SI-12','SI-12'),\n(22004,'001315','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-12','SI-12','SI-12'),\n(22005,'001318','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 b','SI-13b.','SI-13'),\n(22006,'001319','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (1)','SI-13 (1)','SI-13 (1)'),\n(22007,'001320','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (1)','SI-13 (1)','SI-13 (1)'),\n(22008,'001321','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (16)','SI-7 (16)','SI-7 (16)'),\n(22009,'001322','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (16)','SI-7 (16)','SI-7 (16)'),\n(22010,'001323','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (3)','SI-13 (3)','SI-13 (3)'),\n(22011,'001324','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (3)','SI-13 (3)','SI-13 (3)'),\n(22012,'001325','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (3)','SI-13 (3)','SI-13 (3)'),\n(22013,'001326','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (4) (a)','SI-13 (4)(a)','SI-13 (4)'),\n(22014,'001327','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (4) (a)','SI-13 (4)(a)','SI-13 (4)'),\n(22015,'001328','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (4) (b)','SI-13 (4)(b)','SI-13 (4)'),\n(22016,'001329','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (4) (b)','SI-13 (4)(b)','SI-13 (4)'),\n(22017,'001680','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 2','PM-1a.2.','PM-1'),\n(22018,'000073','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 1','PM-1a.1.','PM-1'),\n(22019,'000074','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 4','PM-1a.4.','PM-1'),\n(22020,'000075','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 b','PM-1b.','PM-1'),\n(22021,'000076','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 b','PM-1b.','PM-1'),\n(22022,'000077','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 c','PM-1c.','PM-1'),\n(22023,'000021','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (2)','AC-3 (2)','AC-3 (2)'),\n(22024,'000024','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (5)','AC-3 (5)','AC-3 (5)'),\n(22025,'000213','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3','AC-3','AC-3'),\n(22026,'001408','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (2)','AC-3 (2)','AC-3 (2)'),\n(22027,'001411','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (5)','AC-3 (5)','AC-3 (5)'),\n(22028,'000036','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-5 a','AC-5a.','AC-5'),\n(22029,'001380','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-5 b','AC-5b.','AC-5'),\n(22030,'000043','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-7','AC-7','AC-7'),\n(22031,'000044','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 a','AC-7a.','AC-7'),\n(22032,'001423','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-7','AC-7','AC-7'),\n(22033,'000048','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 a','AC-8a.','AC-8'),\n(22034,'000050','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 b','AC-8b.','AC-8'),\n(22035,'001384','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 c 1','AC-8c.1.','AC-8'),\n(22036,'001385','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 c 2','AC-8c.2.','AC-8'),\n(22037,'001386','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 c 2','AC-8c.2.','AC-8'),\n(22038,'001387','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 c 2','AC-8c.2.','AC-8'),\n(22039,'001388','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 c 3','AC-8c.3.','AC-8'),\n(22040,'000052','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-9','AC-9','AC-9'),\n(22041,'000053','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (1)','AC-9 (1)','AC-9 (1)'),\n(22042,'001389','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (2)','AC-9 (2)','AC-9 (2)'),\n(22043,'001390','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (2)','AC-9 (2)','AC-9 (2)'),\n(22044,'001391','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (2)','AC-9 (2)','AC-9 (2)'),\n(22045,'001392','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (2)','AC-9 (2)','AC-9 (2)'),\n(22046,'001393','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (3)','AC-9 (3)','AC-9 (3)'),\n(22047,'001394','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (3)','AC-9 (3)','AC-9 (3)'),\n(22048,'001395','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (3)','AC-9 (3)','AC-9 (3)'),\n(22049,'000054','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-10','AC-10','AC-10'),\n(22050,'000055','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-10','AC-10','AC-10'),\n(22051,'000056','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-11 b','AC-11b.','AC-11'),\n(22052,'000057','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-11 a','AC-11a.','AC-11'),\n(22053,'000058','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-11 a','AC-11a.','AC-11'),\n(22054,'000059','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-11 a','AC-11a.','AC-11'),\n(22055,'000060','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-11 (1)','AC-11 (1)','AC-11 (1)'),\n(22056,'000061','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-14 a','AC-14a.','AC-14'),\n(22057,'000232','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-14 b','AC-14b.','AC-14'),\n(22058,'000264','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-5 a','CA-5a.','CA-5'),\n(22059,'000265','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-5 b','CA-5b.','CA-5'),\n(22060,'000266','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-5 b','CA-5b.','CA-5'),\n(22061,'000267','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-5 (1)','CA-5 (1)','CA-5 (1)'),\n(22062,'000268','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-5 (1)','CA-5 (1)','CA-5 (1)'),\n(22063,'000269','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-5 (1)','CA-5 (1)','CA-5 (1)'),\n(22064,'000270','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-6 a','CA-6a.','CA-6'),\n(22065,'000271','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-6 b','CA-6b.','CA-6'),\n(22066,'000272','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-6 c','CA-6c.','CA-6'),\n(22067,'000273','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-6 c','CA-6c.','CA-6'),\n(22068,'000082','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 a','AC-19a.','AC-19'),\n(22069,'000083','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 a','AC-19a.','AC-19'),\n(22070,'000084','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 b','AC-19b.','AC-19'),\n(22071,'001458','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (b) (4)','AC-19 (4)(b)(4)','AC-19 (4)'),\n(22072,'001330','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (a)','AC-19 (4)(a)','AC-19 (4)'),\n(22073,'001331','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (b) (1)','AC-19 (4)(b)(1)','AC-19 (4)'),\n(22074,'001332','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (b) (2)','AC-19 (4)(b)(2)','AC-19 (4)'),\n(22075,'001333','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (b) (3)','AC-19 (4)(b)(3)','AC-19 (4)'),\n(22076,'001334','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (b) (4)','AC-19 (4)(b)(4)','AC-19 (4)'),\n(22077,'001335','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (b) (4)','AC-19 (4)(b)(4)','AC-19 (4)'),\n(22078,'000093','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 a','AC-20a.','AC-20'),\n(22079,'000097','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (2)','AC-20 (2)','AC-20 (2)'),\n(22080,'000098','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-21 a','AC-21a.','AC-21'),\n(22081,'000099','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-21 (1)','AC-21 (1)','AC-21 (1)'),\n(22082,'001470','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-21 a','AC-21a.','AC-21'),\n(22083,'001471','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-21 b','AC-21b.','AC-21'),\n(22084,'001472','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-21 b','AC-21b.','AC-21'),\n(22085,'000106','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 a','AT-2a.','AT-2'),\n(22086,'000107','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 (1)','AT-2 (1)','AT-2 (1)'),\n(22087,'000112','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 b','AT-2b.','AT-2'),\n(22088,'001479','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 c','AT-2c.','AT-2'),\n(22089,'001480','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-2','AT-2','AT-2'),\n(22090,'000113','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-4 a','AT-4a.','AT-4'),\n(22091,'000114','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-4 a','AT-4a.','AT-4'),\n(22092,'001336','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-4 b','AT-4b.','AT-4'),\n(22093,'001337','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-4 b','AT-4b.','AT-4'),\n(22094,'000130','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-3','AU-3','AU-3'),\n(22095,'000131','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-3','AU-3','AU-3'),\n(22096,'000132','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-3','AU-3','AU-3'),\n(22097,'000133','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-3','AU-3','AU-3'),\n(22098,'000134','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-3','AU-3','AU-3'),\n(22099,'000135','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 (1)','AU-3 (1)','AU-3 (1)'),\n(22100,'001487','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-3','AU-3','AU-3'),\n(22101,'001488','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 (1)','AU-3 (1)','AU-3 (1)'),\n(22102,'000148','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 a','AU-6a.','AU-6'),\n(22103,'000149','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 b','AU-6b.','AU-6'),\n(22104,'000151','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 a','AU-6a.','AU-6'),\n(22105,'000153','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (3)','AU-6 (3)','AU-6 (3)'),\n(22106,'000154','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (4)','AU-6 (4)','AU-6 (4)'),\n(22107,'001491','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (6)','AU-6 (6)','AU-6 (6)'),\n(22108,'000158','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 (1)','AU-7 (1)','AU-7 (1)'),\n(22109,'000159','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-8 a','AU-8a.','AU-8'),\n(22110,'000161','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-8 (1) (a)','AU-8 (1)(a)','AU-8 (1)'),\n(22111,'001492','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-8 (1) (a)','AU-8 (1)(a)','AU-8 (1)'),\n(22112,'000166','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-10','AU-10','AU-10'),\n(22113,'001340','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (3)','AU-10 (3)','AU-10 (3)'),\n(22114,'001341','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (4) (a)','AU-10 (4)(a)','AU-10 (4)'),\n(22115,'000167','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-11','AU-11','AU-11'),\n(22116,'000168','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-11','AU-11','AU-11'),\n(22117,'000206','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-6','IA-6','IA-6'),\n(22118,'000209','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-6','PM-6','PM-6'),\n(22119,'000210','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-6','PM-6','PM-6'),\n(22120,'000211','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-6','PM-6','PM-6'),\n(22121,'000212','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-7','PM-7','PM-7'),\n(22122,'000078','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-2','PM-2','PM-2'),\n(22123,'000080','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-3 a','PM-3a.','PM-3'),\n(22124,'000081','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-3 b','PM-3b.','PM-3'),\n(22125,'000141','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-3 c','PM-3c.','PM-3'),\n(22126,'000142','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 1','PM-4a.1.','PM-4'),\n(22127,'000170','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 2','PM-4a.2.','PM-4'),\n(22128,'000207','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-5','PM-5','PM-5'),\n(22129,'000227','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-9 a','PM-9a.','PM-9'),\n(22130,'000228','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-9 b','PM-9b.','PM-9'),\n(22131,'000229','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-10 a','PM-10a.','PM-10'),\n(22132,'000230','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-10 a','PM-10a.','PM-10'),\n(22133,'000231','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-10 a','PM-10a.','PM-10'),\n(22134,'000233','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-10 b','PM-10b.','PM-10'),\n(22135,'000234','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-10 c','PM-10c.','PM-10'),\n(22136,'000235','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-11 a','PM-11a.','PM-11'),\n(22137,'000236','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-11 b','PM-11b.','PM-11'),\n(22138,'001460','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-13','AU-13','AU-13'),\n(22139,'001461','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-13','AU-13','AU-13'),\n(22140,'000338','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5','CM-5','CM-5'),\n(22141,'000339','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5','CM-5','CM-5'),\n(22142,'000340','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5','CM-5','CM-5'),\n(22143,'000341','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5','CM-5','CM-5'),\n(22144,'000342','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5','CM-5','CM-5'),\n(22145,'000343','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5','CM-5','CM-5'),\n(22146,'000344','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5','CM-5','CM-5'),\n(22147,'000345','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5','CM-5','CM-5'),\n(22148,'000348','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (2)','CM-5 (2)','CM-5 (2)'),\n(22149,'000349','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (2)','CM-5 (2)','CM-5 (2)'),\n(22150,'000350','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (2)','CM-5 (2)','CM-5 (2)'),\n(22151,'000353','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (4)','CM-5 (4)','CM-5 (4)'),\n(22152,'000354','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (4)','CM-5 (4)','CM-5 (4)'),\n(22153,'001499','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (6)','CM-5 (6)','CM-5 (6)'),\n(22154,'000389','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 1','CM-8a.1.','CM-8'),\n(22155,'000390','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 1','CM-8a.1.','CM-8'),\n(22156,'000392','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 2','CM-8a.2.','CM-8'),\n(22157,'000393','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 2','CM-8a.2.','CM-8'),\n(22158,'000395','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 3','CM-8a.3.','CM-8'),\n(22159,'000396','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 3','CM-8a.3.','CM-8'),\n(22160,'000398','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 4','CM-8a.4.','CM-8'),\n(22161,'000399','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 4','CM-8a.4.','CM-8'),\n(22162,'000400','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 4','CM-8a.4.','CM-8'),\n(22163,'000408','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (1)','CM-8 (1)','CM-8 (1)'),\n(22164,'000409','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (1)','CM-8 (1)','CM-8 (1)'),\n(22165,'000410','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (1)','CM-8 (1)','CM-8 (1)'),\n(22166,'000411','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (2)','CM-8 (2)','CM-8 (2)'),\n(22167,'000412','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (2)','CM-8 (2)','CM-8 (2)'),\n(22168,'000413','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (2)','CM-8 (2)','CM-8 (2)'),\n(22169,'000414','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (2)','CM-8 (2)','CM-8 (2)'),\n(22170,'000415','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (3) (a)','CM-8 (3)(a)','CM-8 (3)'),\n(22171,'000416','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (3) (a)','CM-8 (3)(a)','CM-8 (3)'),\n(22172,'000418','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (4)','CM-8 (4)','CM-8 (4)'),\n(22173,'000419','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (5)','CM-8 (5)','CM-8 (5)'),\n(22174,'000420','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (6)','CM-8 (6)','CM-8 (6)'),\n(22175,'000421','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 a','CM-9a.','CM-9'),\n(22176,'000422','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 a','CM-9a.','CM-9'),\n(22177,'000423','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 a','CM-9a.','CM-9'),\n(22178,'000424','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 c','CM-9c.','CM-9'),\n(22179,'000425','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 c','CM-9c.','CM-9'),\n(22180,'000426','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 c','CM-9c.','CM-9'),\n(22181,'000436','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 (1)','CM-9 (1)','CM-9 (1)'),\n(22182,'000485','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 c','CP-3c.','CP-3'),\n(22183,'000486','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 a','CP-3a.','CP-3'),\n(22184,'000487','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 c','CP-3c.','CP-3'),\n(22185,'000488','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 (1)','CP-3 (1)','CP-3 (1)'),\n(22186,'000489','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 (2)','CP-3 (2)','CP-3 (2)'),\n(22187,'000490','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 a','CP-4a.','CP-4'),\n(22188,'000492','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 a','CP-4a.','CP-4'),\n(22189,'000494','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 a','CP-4a.','CP-4'),\n(22190,'000496','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 b','CP-4b.','CP-4'),\n(22191,'000497','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 c','CP-4c.','CP-4'),\n(22192,'000498','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 (1)','CP-4 (1)','CP-4 (1)'),\n(22193,'000500','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 (2) (a)','CP-4 (2)(a)','CP-4 (2)'),\n(22194,'000502','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 (3)','CP-4 (3)','CP-4 (3)'),\n(22195,'000504','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 (4)4','CP-4 (4)4.','CP-4 (4)'),\n(22196,'000968','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (3)','PE-13 (3)','PE-13 (3)'),\n(22197,'000965','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-13','PE-13','PE-13'),\n(22198,'000971','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-14 a','PE-14a.','PE-14'),\n(22199,'000972','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-14 a','PE-14a.','PE-14'),\n(22200,'000973','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-14 b','PE-14b.','PE-14'),\n(22201,'000974','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-14 b','PE-14b.','PE-14'),\n(22202,'000975','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-14 (1)','PE-14 (1)','PE-14 (1)'),\n(22203,'000976','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-14 (2)','PE-14 (2)','PE-14 (2)'),\n(22204,'000977','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-15','PE-15','PE-15'),\n(22205,'000978','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-15','PE-15','PE-15'),\n(22206,'000979','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-15','PE-15','PE-15'),\n(22207,'001182','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-22','SC-22','SC-22'),\n(22208,'001183','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-22','SC-22','SC-22'),\n(22209,'001173','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-19 a','SC-19a.','SC-19'),\n(22210,'001174','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-19 a','SC-19a.','SC-19'),\n(22211,'001175','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-19 b','SC-19b.','SC-19'),\n(22212,'001176','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-19 b','SC-19b.','SC-19'),\n(22213,'001177','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-19 b','SC-19b.','SC-19'),\n(22214,'000550','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-10','CP-10','CP-10'),\n(22215,'000551','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-10','CP-10','CP-10'),\n(22216,'000552','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-10','CP-10','CP-10'),\n(22217,'000553','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-10 (2)','CP-10 (2)','CP-10 (2)'),\n(22218,'000556','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-10 (4)','CP-10 (4)','CP-10 (4)'),\n(22219,'000557','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-10 (4)','CP-10 (4)','CP-10 (4)'),\n(22220,'000558','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (5)','SI-13 (5)','SI-13 (5)'),\n(22221,'000559','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (5)','SI-13 (5)','SI-13 (5)'),\n(22222,'000560','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-10 (6)','CP-10 (6)','CP-10 (6)'),\n(22223,'000561','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-10 (6)','CP-10 (6)','CP-10 (6)'),\n(22224,'000562','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-10 (6)','CP-10 (6)','CP-10 (6)'),\n(22225,'000571','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 9','PL-2a.9.','PL-2'),\n(22226,'000572','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 c','PL-2c.','PL-2'),\n(22227,'000573','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 c','PL-2c.','PL-2'),\n(22228,'000574','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 d','PL-2d.','PL-2'),\n(22229,'000577','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-7 b','PL-7b.','PL-7'),\n(22230,'000578','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-7 b','PL-7b.','PL-7'),\n(22231,'001646','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 b 2','SA-1b.2.','SA-1'),\n(22232,'000601','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 b 1','SA-1b.1.','SA-1'),\n(22233,'000602','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 a 1','SA-1a.1.','SA-1'),\n(22234,'000603','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 a 1','SA-1a.1.','SA-1'),\n(22235,'000604','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 b 1','SA-1b.1.','SA-1'),\n(22236,'000605','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 a 2','SA-1a.2.','SA-1'),\n(22237,'000606','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 a 2','SA-1a.2.','SA-1'),\n(22238,'000607','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 b 2','SA-1b.2.','SA-1'),\n(22239,'000615','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 a','SA-3a.','SA-3'),\n(22240,'000616','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 b','SA-3b.','SA-3'),\n(22241,'000618','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 c','SA-3c.','SA-3'),\n(22242,'000664','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n(22243,'000665','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n(22244,'000666','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n(22245,'000667','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n(22246,'000668','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n(22247,'000669','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 a','SA-9a.','SA-9'),\n(22248,'000670','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 a','SA-9a.','SA-9'),\n(22249,'000671','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 b','SA-9b.','SA-9'),\n(22250,'000672','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 b','SA-9b.','SA-9'),\n(22251,'000673','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 b','SA-9b.','SA-9'),\n(22252,'000674','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 b','SA-9b.','SA-9'),\n(22253,'000722','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12','SA-12','SA-12'),\n(22254,'000723','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12','SA-12','SA-12'),\n(22255,'000756','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 a 1','IA-1a.1.','IA-1'),\n(22256,'000757','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 a 1','IA-1a.1.','IA-1'),\n(22257,'000758','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 b 1','IA-1b.1.','IA-1'),\n(22258,'000759','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 b 1','IA-1b.1.','IA-1'),\n(22259,'000760','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 a 2','IA-1a.2.','IA-1'),\n(22260,'000761','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 a 2','IA-1a.2.','IA-1'),\n(22261,'000762','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 b 2','IA-1b.2.','IA-1'),\n(22262,'000763','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 b 2','IA-1b.2.','IA-1'),\n(22263,'000764','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2','IA-2','IA-2'),\n(22264,'000765','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (1)','IA-2 (1)','IA-2 (1)'),\n(22265,'000766','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (2)','IA-2 (2)','IA-2 (2)'),\n(22266,'000767','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (3)','IA-2 (3)','IA-2 (3)'),\n(22267,'000768','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (4)','IA-2 (4)','IA-2 (4)'),\n(22268,'000770','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (5)','IA-2 (5)','IA-2 (5)'),\n(22269,'000777','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3','IA-3','IA-3'),\n(22270,'000778','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3','IA-3','IA-3'),\n(22271,'000783','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (3) (b)','IA-3 (3)(b)','IA-3 (3)'),\n(22272,'000794','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 e','IA-4e.','IA-4'),\n(22273,'000795','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 e','IA-4e.','IA-4'),\n(22274,'000796','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (1)','IA-4 (1)','IA-4 (1)'),\n(22275,'000799','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (3)','IA-4 (3)','IA-4 (3)'),\n(22276,'000800','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (4)','IA-4 (4)','IA-4 (4)'),\n(22277,'000801','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (4)','IA-4 (4)','IA-4 (4)'),\n(22278,'000803','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-7','IA-7','IA-7'),\n(22279,'000804','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-8','IA-8','IA-8'),\n(22280,'000805','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 a 1','IR-1a.1.','IR-1'),\n(22281,'000806','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 a 1','IR-1a.1.','IR-1'),\n(22282,'000807','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 b 1','IR-1b.1.','IR-1'),\n(22283,'000808','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 b 1','IR-1b.1.','IR-1'),\n(22284,'000809','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 a 2','IR-1a.2.','IR-1'),\n(22285,'000810','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 a 2','IR-1a.2.','IR-1'),\n(22286,'000811','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 b 2','IR-1b.2.','IR-1'),\n(22287,'000812','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 b 2','IR-1b.2.','IR-1'),\n(22288,'000834','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 a','IR-6a.','IR-6'),\n(22289,'000835','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 a','IR-6a.','IR-6'),\n(22290,'000836','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 b','IR-6b.','IR-6'),\n(22291,'000837','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 (1)','IR-6 (1)','IR-6 (1)'),\n(22292,'000838','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 (2)','IR-6 (2)','IR-6 (2)'),\n(22293,'000839','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-7','IR-7','IR-7'),\n(22294,'000840','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-7 (1)','IR-7 (1)','IR-7 (1)'),\n(22295,'000841','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-7 (2) (a)','IR-7 (2)(a)','IR-7 (2)'),\n(22296,'000842','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-7 (2) (b)','IR-7 (2)(b)','IR-7 (2)'),\n(22297,'000844','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 8','IR-8a.8.','IR-8'),\n(22298,'000845','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 b','IR-8b.','IR-8'),\n(22299,'000846','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 b','IR-8b.','IR-8'),\n(22300,'000847','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 c','IR-8c.','IR-8'),\n(22301,'000848','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 c','IR-8c.','IR-8'),\n(22302,'000849','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 d','IR-8d.','IR-8'),\n(22303,'000850','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 e','IR-8e.','IR-8'),\n(22304,'000865','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-3','MA-3','MA-3'),\n(22305,'000866','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-3','MA-3','MA-3'),\n(22306,'000867','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-3','MA-3','MA-3'),\n(22307,'000869','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (1)','MA-3 (1)','MA-3 (1)'),\n(22308,'000870','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (2)','MA-3 (2)','MA-3 (2)'),\n(22309,'000871','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (3)','MA-3 (3)','MA-3 (3)'),\n(22310,'000890','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 a','MA-5a.','MA-5'),\n(22311,'000891','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 a','MA-5a.','MA-5'),\n(22312,'000893','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (1) (a)','MA-5 (1)(a)','MA-5 (1)'),\n(22313,'000894','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (1) (a) (1)','MA-5 (1)(a)(1)','MA-5 (1)'),\n(22314,'000895','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (1) (a) (2)','MA-5 (1)(a)(2)','MA-5 (1)'),\n(22315,'000897','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (2)','MA-5 (2)','MA-5 (2)'),\n(22316,'000898','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (3)','MA-5 (3)','MA-5 (3)'),\n(22317,'000899','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (4) (a)','MA-5 (4)(a)','MA-5 (4)'),\n(22318,'000900','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (4) (b)','MA-5 (4)(b)','MA-5 (4)'),\n(22319,'000903','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-6','MA-6','MA-6'),\n(22320,'000904','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 a 1','PE-1a.1.','PE-1'),\n(22321,'000905','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 a 1','PE-1a.1.','PE-1'),\n(22322,'000906','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 b 1','PE-1b.1.','PE-1'),\n(22323,'000907','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 b 1','PE-1b.1.','PE-1'),\n(22324,'000908','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 a 2','PE-1a.2.','PE-1'),\n(22325,'000909','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 a 2','PE-1a.2.','PE-1'),\n(22326,'000910','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 b 2','PE-1b.2.','PE-1'),\n(22327,'000911','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 b 2','PE-1b.2.','PE-1'),\n(22328,'000919','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 a','PE-3a.','PE-3'),\n(22329,'000920','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 a 1','PE-3a.1.','PE-3'),\n(22330,'000921','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 a 2','PE-3a.2.','PE-3'),\n(22331,'000923','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 e','PE-3e.','PE-3'),\n(22332,'000924','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 f','PE-3f.','PE-3'),\n(22333,'000925','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 f','PE-3f.','PE-3'),\n(22334,'000926','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 g','PE-3g.','PE-3'),\n(22335,'000927','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 g','PE-3g.','PE-3'),\n(22336,'000928','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (1)','PE-3 (1)','PE-3 (1)'),\n(22337,'000929','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (2)','PE-3 (2)','PE-3 (2)'),\n(22338,'000930','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (3)','PE-3 (3)','PE-3 (3)'),\n(22339,'000931','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (4)','PE-3 (4)','PE-3 (4)'),\n(22340,'000932','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (4)','PE-3 (4)','PE-3 (4)'),\n(22341,'000933','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (5)','PE-3 (5)','PE-3 (5)'),\n(22342,'000934','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (6)','PE-3 (6)','PE-3 (6)'),\n(22343,'000935','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (6)','PE-3 (6)','PE-3 (6)'),\n(22344,'000936','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-4','PE-4','PE-4'),\n(22345,'000937','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-5','PE-5','PE-5'),\n(22346,'000939','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 b','PE-6b.','PE-6'),\n(22347,'000940','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 b','PE-6b.','PE-6'),\n(22348,'000941','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 c','PE-6c.','PE-6'),\n(22349,'000942','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (1)','PE-6 (1)','PE-6 (1)'),\n(22350,'000947','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 a','PE-8a.','PE-8'),\n(22351,'000948','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 b','PE-8b.','PE-8'),\n(22352,'000949','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 b','PE-8b.','PE-8'),\n(22353,'000950','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 (1)','PE-8 (1)','PE-8 (1)'),\n(22354,'000952','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-9','PE-9','PE-9'),\n(22355,'000954','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-9 (2)','PE-9 (2)','PE-9 (2)'),\n(22356,'000955','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-9 (2)','PE-9 (2)','PE-9 (2)'),\n(22357,'000956','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-10 a','PE-10a.','PE-10'),\n(22358,'000957','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-10 b','PE-10b.','PE-10'),\n(22359,'000958','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-10 b','PE-10b.','PE-10'),\n(22360,'000959','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-10 c','PE-10c.','PE-10'),\n(22361,'000961','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-11 (1)','PE-11 (1)','PE-11 (1)'),\n(22362,'000963','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-12','PE-12','PE-12'),\n(22363,'000981','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-16','PE-16','PE-16'),\n(22364,'000982','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-16','PE-16','PE-16'),\n(22365,'000983','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-16','PE-16','PE-16'),\n(22366,'000984','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-16','PE-16','PE-16'),\n(22367,'000985','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-17 a','PE-17a.','PE-17'),\n(22368,'000987','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-17 b','PE-17b.','PE-17'),\n(22369,'000988','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-17 c','PE-17c.','PE-17'),\n(22370,'000989','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-18','PE-18','PE-18'),\n(22371,'000991','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-18','PE-18','PE-18'),\n(22372,'000993','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-19','PE-19','PE-19'),\n(22373,'000994','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-19 (1)','PE-19 (1)','PE-19 (1)'),\n(22374,'000995','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 a 1','MP-1a.1.','MP-1'),\n(22375,'000996','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 a 1','MP-1a.1.','MP-1'),\n(22376,'000997','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 b 1','MP-1b.1.','MP-1'),\n(22377,'000998','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 b 1','MP-1b.1.','MP-1'),\n(22378,'000999','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 a 2','MP-1a.2.','MP-1'),\n(22379,'001000','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 a 2','MP-1a.2.','MP-1'),\n(22380,'001001','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 b 2','MP-1b.2.','MP-1'),\n(22381,'001002','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 b 2','MP-1b.2.','MP-1'),\n(22382,'001003','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-2','MP-2','MP-2'),\n(22383,'001004','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-2','MP-2','MP-2'),\n(22384,'001005','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-2','MP-2','MP-2'),\n(22385,'001007','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 (2)','MP-4 (2)','MP-4 (2)'),\n(22386,'001008','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 (2)','MP-4 (2)','MP-4 (2)'),\n(22387,'001014','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 a','MP-4a.','MP-4'),\n(22388,'001015','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 a','MP-4a.','MP-4'),\n(22389,'001016','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 a','MP-4a.','MP-4'),\n(22390,'001018','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 b','MP-4b.','MP-4'),\n(22391,'001020','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 a','MP-5a.','MP-5'),\n(22392,'001021','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 a','MP-5a.','MP-5'),\n(22393,'001022','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 a','MP-5a.','MP-5'),\n(22394,'001023','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 b','MP-5b.','MP-5'),\n(22395,'001024','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 d','MP-5d.','MP-5'),\n(22396,'001025','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 c','MP-5c.','MP-5'),\n(22397,'001026','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 (3)','MP-5 (3)','MP-5 (3)'),\n(22398,'001027','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 (4)','MP-5 (4)','MP-5 (4)'),\n(22399,'001028','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 a','MP-6a.','MP-6'),\n(22400,'001030','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (2)','MP-6 (2)','MP-6 (2)'),\n(22401,'001031','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (2)','MP-6 (2)','MP-6 (2)'),\n(22402,'001032','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (3)','MP-6 (3)','MP-6 (3)'),\n(22403,'001033','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (3)','MP-6 (3)','MP-6 (3)'),\n(22404,'001037','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 a 1','RA-1a.1.','RA-1'),\n(22405,'001038','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 a 1','RA-1a.1.','RA-1'),\n(22406,'001039','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 b 1','RA-1b.1.','RA-1'),\n(22407,'001040','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 b 1','RA-1b.1.','RA-1'),\n(22408,'001041','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 a 2','RA-1a.2.','RA-1'),\n(22409,'001042','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 a 2','RA-1a.2.','RA-1'),\n(22410,'001043','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 b 2','RA-1b.2.','RA-1'),\n(22411,'001044','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 b 2','RA-1b.2.','RA-1'),\n(22412,'001045','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-2 a','RA-2a.','RA-2'),\n(22413,'001046','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-2 b','RA-2b.','RA-2'),\n(22414,'001047','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-2 c','RA-2c.','RA-2'),\n(22415,'001074','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 1','SC-1a.1.','SC-1'),\n(22416,'001075','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 1','SC-1a.1.','SC-1'),\n(22417,'001076','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 b 1','SC-1b.1.','SC-1'),\n(22418,'001077','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 b 1','SC-1b.1.','SC-1'),\n(22419,'001078','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 2','SC-1a.2.','SC-1'),\n(22420,'001079','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 2','SC-1a.2.','SC-1'),\n(22421,'001080','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 b 2','SC-1b.2.','SC-1'),\n(22422,'001081','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 b 2','SC-1b.2.','SC-1'),\n(22423,'001082','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-2','SC-2','SC-2'),\n(22424,'001083','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-2 (1)','SC-2 (1)','SC-2 (1)'),\n(22425,'001090','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-4','SC-4','SC-4'),\n(22426,'001093','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-5','SC-5','SC-5'),\n(22427,'001094','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 (1)','SC-5 (1)','SC-5 (1)'),\n(22428,'001095','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 (2)','SC-5 (2)','SC-5 (2)'),\n(22429,'001133','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-10','SC-10','SC-10'),\n(22430,'001134','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-10','SC-10','SC-10'),\n(22431,'001139','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (1)','SC-12 (1)','SC-12 (1)'),\n(22432,'001150','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 a','SC-15a.','SC-15'),\n(22433,'001151','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 a','SC-15a.','SC-15'),\n(22434,'001152','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 b','SC-15b.','SC-15'),\n(22435,'001153','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 (1)','SC-15 (1)','SC-15 (1)'),\n(22436,'001155','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 (3)','SC-15 (3)','SC-15 (3)'),\n(22437,'001156','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 (3)','SC-15 (3)','SC-15 (3)'),\n(22438,'001157','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-16','SC-16','SC-16'),\n(22439,'001158','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-16 (1)','SC-16 (1)','SC-16 (1)'),\n(22440,'001159','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-17','SC-17','SC-17'),\n(22441,'001194','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-25','SC-25','SC-25'),\n(22442,'001195','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-26','SC-26','SC-26'),\n(22443,'001196','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-35','SC-35','SC-35'),\n(22444,'001197','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-27','SC-27','SC-27'),\n(22445,'001198','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-27','SC-27','SC-27'),\n(22446,'001201','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-29','SC-29','SC-29'),\n(22447,'001203','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-29 (1)','SC-29 (1)','SC-29 (1)'),\n(22448,'001204','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-29 (1)','SC-29 (1)','SC-29 (1)'),\n(22449,'001207','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-31 (1)','SC-31 (1)','SC-31 (1)'),\n(22450,'001210','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 a','SC-34a.','SC-34'),\n(22451,'001211','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 b','SC-34b.','SC-34'),\n(22452,'001212','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-34','SC-34','SC-34'),\n(22453,'001213','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 b','SC-34b.','SC-34'),\n(22454,'001214','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 (1)','SC-34 (1)','SC-34 (1)'),\n(22455,'001215','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 (1)','SC-34 (1)','SC-34 (1)'),\n(22456,'001216','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 (2)','SC-34 (2)','SC-34 (2)'),\n(22457,'001217','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 a 1','SI-1a.1.','SI-1'),\n(22458,'001218','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 a 1','SI-1a.1.','SI-1'),\n(22459,'001219','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 b 1','SI-1b.1.','SI-1'),\n(22460,'001220','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 a 2','SI-1a.2.','SI-1'),\n(22461,'001221','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 a 2','SI-1a.2.','SI-1'),\n(22462,'001222','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 b 2','SI-1b.2.','SI-1'),\n(22463,'001223','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 b 1','SI-1b.1.','SI-1'),\n(22464,'001224','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 b 2','SI-1b.2.','SI-1'),\n(22465,'001285','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 a','SI-5a.','SI-5'),\n(22466,'001286','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 b','SI-5b.','SI-5'),\n(22467,'001287','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 c','SI-5c.','SI-5'),\n(22468,'001288','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 c','SI-5c.','SI-5'),\n(22469,'001289','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 d','SI-5d.','SI-5'),\n(22470,'001290','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 (1)','SI-5 (1)','SI-5 (1)'),\n(22471,'001300','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (2)','SI-7 (2)','SI-7 (2)'),\n(22472,'001301','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (3)','SI-7 (3)','SI-7 (3)'),\n(22473,'001310','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10','SI-10','SI-10'),\n(22474,'001312','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-11 a','SI-11a.','SI-11'),\n(22475,'001314','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-11 b','SI-11b.','SI-11'),\n(22476,'001462','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-14 (2)','AU-14 (2)','AU-14 (2)'),\n(22477,'001464','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-14 (1)','AU-14 (1)','AU-14 (1)'),\n(22478,'001473','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-22 a','AC-22a.','AC-22'),\n(22479,'001474','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-22 b','AC-22b.','AC-22'),\n(22480,'001475','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-22 c','AC-22c.','AC-22'),\n(22481,'001476','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-22 d','AC-22d.','AC-22'),\n(22482,'001477','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-22 d','AC-22d.','AC-22'),\n(22483,'001478','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-22 d','AC-22d.','AC-22'),\n(22484,'001504','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 a 1','PS-1a.1.','PS-1'),\n(22485,'001505','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 a 1','PS-1a.1.','PS-1'),\n(22486,'001506','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 b 2','PS-1b.2.','PS-1'),\n(22487,'001507','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 b 1','PS-1b.1.','PS-1'),\n(22488,'001508','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 b 2','PS-1b.2.','PS-1'),\n(22489,'001509','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 a 2','PS-1a.2.','PS-1'),\n(22490,'001510','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 a 2','PS-1a.2.','PS-1'),\n(22491,'001511','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 b 2','PS-1b.2.','PS-1'),\n(22492,'001512','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-2 a','PS-2a.','PS-2'),\n(22493,'001513','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-2 b','PS-2b.','PS-2'),\n(22494,'001514','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-2 c','PS-2c.','PS-2'),\n(22495,'001515','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-2 c','PS-2c.','PS-2'),\n(22496,'001516','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 a','PS-3a.','PS-3'),\n(22497,'001517','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 b','PS-3b.','PS-3'),\n(22498,'001518','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 b','PS-3b.','PS-3'),\n(22499,'001519','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 b','PS-3b.','PS-3'),\n(22500,'001520','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 (1)','PS-3 (1)','PS-3 (1)'),\n(22501,'001521','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 (2)','PS-3 (2)','PS-3 (2)'),\n(22502,'001522','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 a','PS-4a.','PS-4'),\n(22503,'001523','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 c','PS-4c.','PS-4'),\n(22504,'001524','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 d','PS-4d.','PS-4'),\n(22505,'001525','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 e','PS-4e.','PS-4'),\n(22506,'001526','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 e','PS-4e.','PS-4'),\n(22507,'001527','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 a','PS-5a.','PS-5'),\n(22508,'001528','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 b','PS-5b.','PS-5'),\n(22509,'001529','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 b','PS-5b.','PS-5'),\n(22510,'001530','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 b','PS-5b.','PS-5'),\n(22511,'001531','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 c 1','PS-6c.1.','PS-6'),\n(22512,'001532','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 b','PS-6b.','PS-6'),\n(22513,'001533','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 b','PS-6b.','PS-6'),\n(22514,'001536','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 (2) (a)','PS-6 (2)(a)','PS-6 (2)'),\n(22515,'001537','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 (2) (b)','PS-6 (2)(b)','PS-6 (2)'),\n(22516,'001538','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 (2) (c)','PS-6 (2)(c)','PS-6 (2)'),\n(22517,'001539','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 a','PS-7a.','PS-7'),\n(22518,'001540','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 c','PS-7c.','PS-7'),\n(22519,'001541','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 e','PS-7e.','PS-7'),\n(22520,'001542','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-8 a','PS-8a.','PS-8'),\n(22521,'002106','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 1','AC-1a.1.','AC-1'),\n(22522,'002107','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 1','AC-1a.1.','AC-1'),\n(22523,'002108','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 1','AC-1a.1.','AC-1'),\n(22524,'002109','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 2','AC-1a.2.','AC-1'),\n(22525,'002110','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 a','AC-2a.','AC-2'),\n(22526,'002111','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 a','AC-2a.','AC-2'),\n(22527,'002112','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 b','AC-2b.','AC-2'),\n(22528,'002113','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 c','AC-2c.','AC-2'),\n(22529,'002114','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 d','AC-2d.','AC-2'),\n(22530,'002115','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 d','AC-2d.','AC-2'),\n(22531,'002116','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 d','AC-2d.','AC-2'),\n(22532,'002117','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 d','AC-2d.','AC-2'),\n(22533,'002118','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 d','AC-2d.','AC-2'),\n(22534,'002119','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 d','AC-2d.','AC-2'),\n(22535,'002120','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 e','AC-2e.','AC-2'),\n(22536,'002121','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 f','AC-2f.','AC-2'),\n(22537,'002122','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 g','AC-2g.','AC-2'),\n(22538,'002123','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 h 1','AC-2h.1.','AC-2'),\n(22539,'002124','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 h 2','AC-2h.2.','AC-2'),\n(22540,'002125','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 h 3','AC-2h.3.','AC-2'),\n(22541,'002126','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 i 1 ','AC-2i.1 .','AC-2'),\n(22542,'002127','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 i 2 ','AC-2i.2 .','AC-2'),\n(22543,'002128','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 i 3 ','AC-2i.3 .','AC-2'),\n(22544,'002129','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 k','AC-2k.','AC-2'),\n(22545,'002130','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2 (4)','AC-2 (4)'),\n(22546,'002131','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2 (4)','AC-2 (4)'),\n(22547,'002132','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2 (4)','AC-2 (4)'),\n(22548,'002133','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (5)','AC-2 (5)','AC-2 (5)'),\n(22549,'002134','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (6)','AC-2 (6)','AC-2 (6)'),\n(22550,'002135','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (6)','AC-2 (6)','AC-2 (6)'),\n(22551,'002136','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (7) (c)','AC-2 (7)(c)','AC-2 (7)'),\n(22552,'002137','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (7) (c)','AC-2 (7)(c)','AC-2 (7)'),\n(22553,'002138','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (8)','AC-2 (8)','AC-2 (8)'),\n(22554,'002139','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (8)','AC-2 (8)','AC-2 (8)'),\n(22555,'002140','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (9)','AC-2 (9)','AC-2 (9)'),\n(22556,'002141','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (9)','AC-2 (9)','AC-2 (9)'),\n(22557,'002142','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (10)','AC-2 (10)','AC-2 (10)'),\n(22558,'002143','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (11)','AC-2 (11)','AC-2 (11)'),\n(22559,'002144','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (11)','AC-2 (11)','AC-2 (11)'),\n(22560,'002145','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (11)','AC-2 (11)','AC-2 (11)'),\n(22561,'002146','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (12) (a)','AC-2 (12)(a)','AC-2 (12)'),\n(22562,'002147','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (12) (a)','AC-2 (12)(a)','AC-2 (12)'),\n(22563,'002148','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (12) (b)','AC-2 (12)(b)','AC-2 (12)'),\n(22564,'002149','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (12) (b)','AC-2 (12)(b)','AC-2 (12)'),\n(22565,'002150','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (13)','AC-2 (13)','AC-2 (13)'),\n(22566,'002151','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (13)','AC-2 (13)','AC-2 (13)'),\n(22567,'002152','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (2)','AC-3 (2)','AC-3 (2)'),\n(22568,'002153','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3)','AC-3 (3)','AC-3 (3)'),\n(22569,'002154','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (a)','AC-3 (3)(a)','AC-3 (3)'),\n(22570,'002155','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (b) (1)','AC-3 (3)(b)(1)','AC-3 (3)'),\n(22571,'002156','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (b) (2)','AC-3 (3)(b)(2)','AC-3 (3)'),\n(22572,'002157','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (b) (3)','AC-3 (3)(b)(3)','AC-3 (3)'),\n(22573,'002158','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (b) (4)','AC-3 (3)(b)(4)','AC-3 (3)'),\n(22574,'002159','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (b) (4)','AC-3 (3)(b)(4)','AC-3 (3)'),\n(22575,'002160','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (b) (5)','AC-3 (3)(b)(5)','AC-3 (3)'),\n(22576,'002161','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (c)','AC-3 (3)(c)','AC-3 (3)'),\n(22577,'002162','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (c)','AC-3 (3)(c)','AC-3 (3)'),\n(22578,'002163','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (4)','AC-3 (4)','AC-3 (4)'),\n(22579,'002164','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (4) ','AC-3 (4)','AC-3 (4)'),\n(22580,'002165','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (4)','AC-3 (4)','AC-3 (4)'),\n(22581,'002166','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3 (7)','AC-3 (7)'),\n(22582,'002167','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3 (7)','AC-3 (7)'),\n(22583,'002168','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3 (7)','AC-3 (7)'),\n(22584,'002169','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3 (7)','AC-3 (7)'),\n(22585,'002170','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3 (7)','AC-3 (7)'),\n(22586,'002171','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3 (7)','AC-3 (7)'),\n(22587,'002172','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3 (7)','AC-3 (7)'),\n(22588,'002173','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3 (7)','AC-3 (7)'),\n(22589,'002174','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3 (7)','AC-3 (7)'),\n(22590,'002175','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3 (7)','AC-3 (7)'),\n(22591,'002176','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3 (7)','AC-3 (7)'),\n(22592,'002177','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (8)','AC-3 (8)','AC-3 (8)'),\n(22593,'002178','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (8)','AC-3 (8)','AC-3 (8)'),\n(22594,'002179','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (8)','AC-3 (8)','AC-3 (8)'),\n(22595,'002180','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (9) (a)','AC-3 (9)(a)','AC-3 (9)'),\n(22596,'002181','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (9) (a)','AC-3 (9)(a)','AC-3 (9)'),\n(22597,'002182','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (9) (a)','AC-3 (9)(a)','AC-3 (9)'),\n(22598,'002183','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (9) (b)','AC-3 (9)(b)','AC-3 (9)'),\n(22599,'002184','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (9) (b)','AC-3 (9)(b)','AC-3 (9)'),\n(22600,'002185','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (10)','AC-3 (10)','AC-3 (10)'),\n(22601,'002186','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (10)','AC-3 (10)','AC-3 (10)'),\n(22602,'003014','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3)','AC-3 (3)','AC-3 (3)'),\n(22603,'003015','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (c)','AC-3 (3)(c)','AC-3 (3)'),\n(22604,'002187','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (1)','AC-4 (1)','AC-4 (1)'),\n(22605,'002188','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (1)','AC-4 (1)','AC-4 (1)'),\n(22606,'002189','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (1)','AC-4 (1)','AC-4 (1)'),\n(22607,'002190','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (1)','AC-4 (1)','AC-4 (1)'),\n(22608,'002191','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (2)','AC-4 (2)','AC-4 (2)'),\n(22609,'002192','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (3)','AC-4 (3)','AC-4 (3)'),\n(22610,'002193','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (4)','AC-4 (4)','AC-4 (4)'),\n(22611,'002194','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (6)','AC-4 (6)','AC-4 (6)'),\n(22612,'002195','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (8)','AC-4 (8)','AC-4 (8)'),\n(22613,'002196','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (9)','AC-4 (9)','AC-4 (9)'),\n(22614,'002197','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (9)','AC-4 (9)','AC-4 (9)'),\n(22615,'002198','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (9)','AC-4 (9)','AC-4 (9)'),\n(22616,'002199','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (10)','AC-4 (10)','AC-4 (10)'),\n(22617,'002200','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (12)','AC-4 (12)','AC-4 (12)'),\n(22618,'002201','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (12)','AC-4 (12)','AC-4 (12)'),\n(22619,'002202','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (13)','AC-4 (13)','AC-4 (13)'),\n(22620,'002203','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (15)','AC-4 (15)','AC-4 (15)'),\n(22621,'002204','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (15)','AC-4 (15)','AC-4 (15)'),\n(22622,'002205','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (17)','AC-4 (17)','AC-4 (17)'),\n(22623,'002206','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (17)','AC-4 (17)','AC-4 (17)'),\n(22624,'002207','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (17)','AC-4 (17)','AC-4 (17)'),\n(22625,'002208','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (17)','AC-4 (17)','AC-4 (17)'),\n(22626,'002209','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (18)','AC-4 (18)','AC-4 (18)'),\n(22627,'002210','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (18)','AC-4 (18)','AC-4 (18)'),\n(22628,'002211','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (19)','AC-4 (19)','AC-4 (19)'),\n(22629,'002212','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (20)','AC-4 (20)','AC-4 (20)'),\n(22630,'002213','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (20)','AC-4 (20)','AC-4 (20)'),\n(22631,'002214','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (20)','AC-4 (20)','AC-4 (20)'),\n(22632,'002215','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (21)','AC-4 (21)','AC-4 (21)'),\n(22633,'002216','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (21)','AC-4 (21)','AC-4 (21)'),\n(22634,'002217','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (21)','AC-4 (21)','AC-4 (21)'),\n(22635,'002218','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (22)','AC-4 (22)','AC-4 (22)'),\n(22636,'002219','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-5 a','AC-5a.','AC-5'),\n(22637,'002220','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-5 c','AC-5c.','AC-5'),\n(22638,'002221','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (1)','AC-6 (1)','AC-6 (1)'),\n(22639,'002222','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (1)','AC-6 (1)','AC-6 (1)'),\n(22640,'002223','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (1)','AC-6 (1)','AC-6 (1)'),\n(22641,'002224','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (3)','AC-6 (3)','AC-6 (3)'),\n(22642,'002225','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (4)','AC-6 (4)','AC-6 (4)'),\n(22643,'002226','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (5)','AC-6 (5)','AC-6 (5)'),\n(22644,'002227','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (5)','AC-6 (5)','AC-6 (5)'),\n(22645,'002228','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (7) (a)','AC-6 (7)(a)','AC-6 (7)'),\n(22646,'002229','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (7) (a)','AC-6 (7)(a)','AC-6 (7)'),\n(22647,'002230','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (7) (a)','AC-6 (7)(a)','AC-6 (7)'),\n(22648,'002231','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (7) (b)','AC-6 (7)(b)','AC-6 (7)'),\n(22649,'002232','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (8)','AC-6 (8)','AC-6 (8)'),\n(22650,'002233','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (8)','AC-6 (8)','AC-6 (8)'),\n(22651,'002234','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (9)','AC-6 (9)','AC-6 (9)'),\n(22652,'002235','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (10)','AC-6 (10)','AC-6 (10)'),\n(22653,'002236','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 b','AC-7b.','AC-7'),\n(22654,'002237','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 b','AC-7b.','AC-7'),\n(22655,'002238','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 b','AC-7b.','AC-7'),\n(22656,'002239','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 (2)','AC-7 (2)','AC-7 (2)'),\n(22657,'002240','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 (2)','AC-7 (2)','AC-7 (2)'),\n(22658,'002241','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 (2)','AC-7 (2)','AC-7 (2)'),\n(22659,'002242','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 (2)','AC-7 (2)','AC-7 (2)'),\n(22660,'002243','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 a 1','AC-8a.1.','AC-8'),\n(22661,'002244','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 a 2','AC-8a.2.','AC-8'),\n(22662,'002245','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 a 3','AC-8a.3.','AC-8'),\n(22663,'002246','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 a 4','AC-8a.4.','AC-8'),\n(22664,'002247','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 a','AC-8a.','AC-8'),\n(22665,'002248','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 c 1','AC-8c.1.','AC-8'),\n(22666,'002249','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (4)','AC-9 (4)','AC-9 (4)'),\n(22667,'002250','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (4)','AC-9 (4)','AC-9 (4)'),\n(22668,'002251','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (4)','AC-9 (4)','AC-9 (4)'),\n(22669,'002252','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-10','AC-10','AC-10'),\n(22670,'002253','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-10','AC-10','AC-10'),\n(22671,'002255','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-14 a','AC-14a.','AC-14'),\n(22672,'002256','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a.','AC-16'),\n(22673,'002257','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a.','AC-16'),\n(22674,'002258','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a.','AC-16'),\n(22675,'002259','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a.','AC-16'),\n(22676,'002260','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a.','AC-16'),\n(22677,'002261','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a.','AC-16'),\n(22678,'002262','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a.','AC-16'),\n(22679,'002263','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a.','AC-16'),\n(22680,'002264','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a.','AC-16'),\n(22681,'002265','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 b','AC-16b.','AC-16'),\n(22682,'002266','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 b','AC-16b.','AC-16'),\n(22683,'002267','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 c','AC-16c.','AC-16'),\n(22684,'002268','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 c','AC-16c.','AC-16'),\n(22685,'002269','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 c','AC-16c.','AC-16'),\n(22686,'002270','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 d','AC-16d.','AC-16'),\n(22687,'002271','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 d','AC-16d.','AC-16'),\n(22688,'002272','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (1)','AC-16 (1)','AC-16 (1)'),\n(22689,'002273','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (1)','AC-16 (1)','AC-16 (1)'),\n(22690,'002274','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (1)','AC-16 (1)','AC-16 (1)'),\n(22691,'002275','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (1)','AC-16 (1)','AC-16 (1)'),\n(22692,'002276','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (2)','AC-16 (2)','AC-16 (2)'),\n(22693,'002277','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (2)','AC-16 (2)','AC-16 (2)'),\n(22694,'002278','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16 (3)','AC-16 (3)'),\n(22695,'002279','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16 (3)','AC-16 (3)'),\n(22696,'002280','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16 (3)','AC-16 (3)'),\n(22697,'002281','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16 (3)','AC-16 (3)'),\n(22698,'002282','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16 (3)','AC-16 (3)'),\n(22699,'002283','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16 (3)','AC-16 (3)'),\n(22700,'002284','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16 (3)','AC-16 (3)'),\n(22701,'002285','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16 (4)','AC-16 (4)'),\n(22702,'002286','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16 (4)','AC-16 (4)'),\n(22703,'002287','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16 (4)','AC-16 (4)'),\n(22704,'002288','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16 (4)','AC-16 (4)'),\n(22705,'002289','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16 (4)','AC-16 (4)'),\n(22706,'002290','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16 (4)','AC-16 (4)'),\n(22707,'002291','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16 (6)','AC-16 (6)'),\n(22708,'002292','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16 (6)','AC-16 (6)'),\n(22709,'002293','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16 (6)','AC-16 (6)'),\n(22710,'002294','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16 (6)','AC-16 (6)'),\n(22711,'002295','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16 (6)','AC-16 (6)'),\n(22712,'002296','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16 (6)','AC-16 (6)'),\n(22713,'002297','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16 (6)','AC-16 (6)'),\n(22714,'002298','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16 (6)','AC-16 (6)'),\n(22715,'002299','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (7)','AC-16 (7)','AC-16 (7)'),\n(22716,'002300','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (8)','AC-16 (8)','AC-16 (8)'),\n(22717,'002301','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (8)','AC-16 (8)','AC-16 (8)'),\n(22718,'002302','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (8)','AC-16 (8)','AC-16 (8)'),\n(22719,'002303','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (9)','AC-16 (9)','AC-16 (9)'),\n(22720,'002304','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (9)','AC-16 (9)','AC-16 (9)'),\n(22721,'002305','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (10)','AC-16 (10)','AC-16 (10)'),\n(22722,'002306','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (10)','AC-16 (10)','AC-16 (10)'),\n(22723,'002307','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (10)','AC-16 (10)','AC-16 (10)'),\n(22724,'002308','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (10)','AC-16 (10)','AC-16 (10)'),\n(22725,'002309','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (10)','AC-16 (10)','AC-16 (10)'),\n(22726,'002310','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 a','AC-17a.','AC-17'),\n(22727,'002311','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 a','AC-17a.','AC-17'),\n(22728,'002312','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 a','AC-17a.','AC-17'),\n(22729,'002313','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (1)','AC-17 (1)','AC-17 (1)'),\n(22730,'002314','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (1)','AC-17 (1)','AC-17 (1)'),\n(22731,'002315','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (3)','AC-17 (3)','AC-17 (3)'),\n(22732,'002316','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (4) (a)','AC-17 (4)(a)','AC-17 (4)'),\n(22733,'002317','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (4) (a)','AC-17 (4)(a)','AC-17 (4)'),\n(22734,'002318','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (4) (a)','AC-17 (4)(a)','AC-17 (4)'),\n(22735,'002319','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (4) (b)','AC-17 (4)(b)','AC-17 (4)'),\n(22736,'002320','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (4) (b)','AC-17 (4)(b)','AC-17 (4)'),\n(22737,'002321','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (9)','AC-17 (9)','AC-17 (9)'),\n(22738,'002322','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (9)','AC-17 (9)','AC-17 (9)'),\n(22739,'002323','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 a','AC-18a.','AC-18'),\n(22740,'002324','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 (4)','AC-18 (4)','AC-18 (4)'),\n(22741,'002325','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 a','AC-19a.','AC-19'),\n(22742,'002326','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 a','AC-19a.','AC-19'),\n(22743,'002327','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (c)','AC-19 (4)(c)','AC-19 (4)'),\n(22744,'002328','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (c)','AC-19 (4)(c)','AC-19 (4)'),\n(22745,'002329','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (5)','AC-19 (5)','AC-19 (5)'),\n(22746,'002330','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (5)','AC-19 (5)','AC-19 (5)'),\n(22747,'002331','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (5)','AC-19 (5)','AC-19 (5)'),\n(22748,'002332','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 b','AC-20b.','AC-20'),\n(22749,'002333','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (1) (a)','AC-20 (1)(a)','AC-20 (1)'),\n(22750,'002334','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (1) (a)','AC-20 (1)(a)','AC-20 (1)'),\n(22751,'002335','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (1) (a)','AC-20 (1)(a)','AC-20 (1)'),\n(22752,'002336','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (1) (a)','AC-20 (1)(a)','AC-20 (1)'),\n(22753,'002337','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (1) (b)','AC-20 (1)(b)','AC-20 (1)'),\n(22754,'002338','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (3)','AC-20 (3)','AC-20 (3)'),\n(22755,'002339','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (4)','AC-20 (4)','AC-20 (4)'),\n(22756,'002340','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (4)','AC-20 (4)','AC-20 (4)'),\n(22757,'002341','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-21 (2)','AC-21 (2)','AC-21 (2)'),\n(22758,'002342','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-21 (2)','AC-21 (2)','AC-21 (2)'),\n(22759,'002343','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-23','AC-23','AC-23'),\n(22760,'002344','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-23','AC-23','AC-23'),\n(22761,'002345','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-23','AC-23','AC-23'),\n(22762,'002346','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-23','AC-23','AC-23'),\n(22763,'002347','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-23','AC-23','AC-23'),\n(22764,'002348','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-24','AC-24','AC-24'),\n(22765,'002349','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-24','AC-24','AC-24'),\n(22766,'002350','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-24 (1)','AC-24 (1)','AC-24 (1)'),\n(22767,'002351','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-24 (1)','AC-24 (1)','AC-24 (1)'),\n(22768,'002352','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-24 (1)','AC-24 (1)','AC-24 (1)'),\n(22769,'002353','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-24 (1)','AC-24 (1)','AC-24 (1)'),\n(22770,'002354','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-24 (2)','AC-24 (2)','AC-24 (2)'),\n(22771,'002355','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-24 (2)','AC-24 (2)','AC-24 (2)'),\n(22772,'002356','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-25','AC-25','AC-25'),\n(22773,'002357','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-25','AC-25','AC-25'),\n(22774,'002358','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-25','AC-25','AC-25'),\n(22775,'002359','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-25','AC-25','AC-25'),\n(22776,'002048','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 a 1','AT-1a.1.','AT-1'),\n(22777,'002049','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 a 2','AT-1a.2.','AT-1'),\n(22778,'002055','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 (2)','AT-2 (2)','AT-2 (2)'),\n(22779,'002050','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (1)','AT-3 (1)','AT-3 (1)'),\n(22780,'002051','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (2)','AT-3 (2)','AT-3 (2)'),\n(22781,'002052','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (3)','AT-3 (3)','AT-3 (3)'),\n(22782,'002053','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (4)','AT-3 (4)','AT-3 (4)'),\n(22783,'002054','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (4)','AT-3 (4)','AT-3 (4)'),\n(22784,'001831','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 1','AU-1a.1.','AU-1'),\n(22785,'001832','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 1','AU-1a.1.','AU-1'),\n(22786,'001833','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 2','AU-1a.2.','AU-1'),\n(22787,'001834','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 2','AU-1a.2.','AU-1'),\n(22788,'001835','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b 1','AU-1b.1.','AU-1'),\n(22789,'001836','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b 1','AU-1b.1.','AU-1'),\n(22790,'001837','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b 1','AU-1b.1.','AU-1'),\n(22791,'001838','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b 1','AU-1b.1.','AU-1'),\n(22792,'001839','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b 2','AU-1b.2.','AU-1'),\n(22793,'001840','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b 2','AU-1b.2.','AU-1'),\n(22794,'001841','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b 2','AU-1b.2.','AU-1'),\n(22795,'001842','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b 2','AU-1b.2.','AU-1'),\n(22796,'001930','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 1','AU-1a.1.','AU-1'),\n(22797,'001931','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 2','AU-1a.2.','AU-1'),\n(22798,'001843','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 (3)','AU-2 (3)','AU-2 (3)'),\n(22799,'001844','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 (2)','AU-3 (2)','AU-3 (2)'),\n(22800,'001845','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 (2)','AU-3 (2)','AU-3 (2)'),\n(22801,'001846','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 (2)','AU-3 (2)','AU-3 (2)'),\n(22802,'001847','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 (2)','AU-3 (2)','AU-3 (2)'),\n(22803,'001848','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-4','AU-4','AU-4'),\n(22804,'001849','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-4','AU-4','AU-4'),\n(22805,'001850','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-4 (1)','AU-4 (1)','AU-4 (1)'),\n(22806,'001851','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-4 (1)','AU-4 (1)','AU-4 (1)'),\n(22807,'001852','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (1)','AU-5 (1)','AU-5 (1)'),\n(22808,'001853','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (1)','AU-5 (1)','AU-5 (1)'),\n(22809,'001854','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (1)','AU-5 (1)','AU-5 (1)'),\n(22810,'001855','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (1)','AU-5 (1)','AU-5 (1)'),\n(22811,'001856','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (2)','AU-5 (2)','AU-5 (2)'),\n(22812,'001857','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (2)','AU-5 (2)','AU-5 (2)'),\n(22813,'001858','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (2)','AU-5 (2)','AU-5 (2)'),\n(22814,'001859','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (3)','AU-5 (3)','AU-5 (3)'),\n(22815,'001860','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (4)','AU-5 (4)','AU-5 (4)'),\n(22816,'001861','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (4)','AU-5 (4)','AU-5 (4)'),\n(22817,'002907','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (4)','AU-5 (4)','AU-5 (4)'),\n(22818,'001862','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 a','AU-6a.','AU-6'),\n(22819,'001863','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 b','AU-6b.','AU-6'),\n(22820,'001864','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (1)','AU-6 (1)','AU-6 (1)'),\n(22821,'001865','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (1)','AU-6 (1)','AU-6 (1)'),\n(22822,'001866','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (5)','AU-6 (5)','AU-6 (5)'),\n(22823,'001867','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (5)','AU-6 (5)','AU-6 (5)'),\n(22824,'001868','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (7)','AU-6 (7)','AU-6 (7)'),\n(22825,'001869','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (7)','AU-6 (7)','AU-6 (7)'),\n(22826,'001870','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (8)','AU-6 (8)','AU-6 (8)'),\n(22827,'001871','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (9)','AU-6 (9)','AU-6 (9)'),\n(22828,'001872','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (10)','AU-6 (10)','AU-6 (10)'),\n(22829,'001873','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (10)','AU-6 (10)','AU-6 (10)'),\n(22830,'001874','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (10)','AU-6 (10)','AU-6 (10)'),\n(22831,'001875','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a.','AU-7'),\n(22832,'001876','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a.','AU-7'),\n(22833,'001877','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a.','AU-7'),\n(22834,'001878','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a.','AU-7'),\n(22835,'001879','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a.','AU-7'),\n(22836,'001880','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a.','AU-7'),\n(22837,'001881','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 b','AU-7b.','AU-7'),\n(22838,'001882','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 b','AU-7b.','AU-7'),\n(22839,'001883','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 (1)','AU-7 (1)','AU-7 (1)'),\n(22840,'001884','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 (2)','AU-7 (2)','AU-7 (2)'),\n(22841,'001885','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 (2)','AU-7 (2)','AU-7 (2)'),\n(22842,'001886','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 (2)','AU-7 (2)','AU-7 (2)'),\n(22843,'001887','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 (2)','AU-7 (2)','AU-7 (2)'),\n(22844,'001888','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-8 b','AU-8b.','AU-8'),\n(22845,'001889','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-8 b','AU-8b.','AU-8'),\n(22846,'001890','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-8 b','AU-8b.','AU-8'),\n(22847,'001891','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-8 (1) (a)','AU-8 (1)(a)','AU-8 (1)'),\n(22848,'001892','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-8 (1) (b)','AU-8 (1)(b)','AU-8 (1)'),\n(22849,'001893','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-8 (2)','AU-8 (2)','AU-8 (2)'),\n(22850,'002046','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-8 (1) (b)','AU-8 (1)(b)','AU-8 (1)'),\n(22851,'001894','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (4)','AU-9 (4)','AU-9 (4)'),\n(22852,'001895','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (5)','AU-9 (5)','AU-9 (5)'),\n(22853,'001896','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (5)','AU-9 (5)','AU-9 (5)'),\n(22854,'001897','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (6)','AU-9 (6)','AU-9 (6)'),\n(22855,'001898','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (6)','AU-9 (6)','AU-9 (6)'),\n(22856,'001899','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-10','AU-10','AU-10'),\n(22857,'001900','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (1) (a)','AU-10 (1)(a)','AU-10 (1)'),\n(22858,'001901','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (1) (a)','AU-10 (1)(a)','AU-10 (1)'),\n(22859,'001902','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (1) (b)','AU-10 (1)(b)','AU-10 (1)'),\n(22860,'001903','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (2) (a)','AU-10 (2)(a)','AU-10 (2)'),\n(22861,'001904','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (2) (a)','AU-10 (2)(a)','AU-10 (2)'),\n(22862,'001905','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (2) (b)','AU-10 (2)(b)','AU-10 (2)'),\n(22863,'001906','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (2) (b)','AU-10 (2)(b)','AU-10 (2)'),\n(22864,'001907','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (4) (a)','AU-10 (4)(a)','AU-10 (4)'),\n(22865,'001908','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (4) (b)','AU-10 (4)(b)','AU-10 (4)'),\n(22866,'001909','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (4) (b)','AU-10 (4)(b)','AU-10 (4)'),\n(22867,'002044','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-11 (1)','AU-11 (1)','AU-11 (1)'),\n(22868,'002045','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-11 (1)','AU-11 (1)','AU-11 (1)'),\n(22869,'001910','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 b','AU-12b.','AU-12'),\n(22870,'001911','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (3)','AU-12 (3)','AU-12 (3)'),\n(22871,'001912','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (3)','AU-12 (3)','AU-12 (3)'),\n(22872,'001913','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (3)','AU-12 (3)','AU-12 (3)'),\n(22873,'001914','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (3)','AU-12 (3)','AU-12 (3)'),\n(22874,'002047','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (3)','AU-12 (3)','AU-12 (3)'),\n(22875,'001915','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-13','AU-13','AU-13'),\n(22876,'001916','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 (1)','AU-13 (1)','AU-13 (1)'),\n(22877,'001917','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 (2)','AU-13 (2)','AU-13 (2)'),\n(22878,'001918','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 (2)','AU-13 (2)','AU-13 (2)'),\n(22879,'001919','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-14','AU-14','AU-14'),\n(22880,'001920','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-14 (3)','AU-14 (3)','AU-14 (3)'),\n(22881,'001921','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-15','AU-15','AU-15'),\n(22882,'001922','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-15','AU-15','AU-15'),\n(22883,'001923','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-16','AU-16','AU-16'),\n(22884,'001924','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-16','AU-16','AU-16'),\n(22885,'001925','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-16','AU-16','AU-16'),\n(22886,'001926','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-16 (1)','AU-16 (1)','AU-16 (1)'),\n(22887,'001927','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-16 (2)','AU-16 (2)','AU-16 (2)'),\n(22888,'001928','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-16 (2)','AU-16 (2)','AU-16 (2)'),\n(22889,'001929','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AU-16 (2)','AU-16 (2)','AU-16 (2)'),\n(22890,'002060','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 1','CA-1a.1.','CA-1'),\n(22891,'002061','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 1','CA-1a.1.','CA-1'),\n(22892,'002062','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 2','CA-1a.2.','CA-1'),\n(22893,'002063','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (1)','CA-2 (1)','CA-2 (1)'),\n(22894,'002064','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (2)','CA-2 (2)','CA-2 (2)'),\n(22895,'002065','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (2)','CA-2 (2)','CA-2 (2)'),\n(22896,'002066','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (3)','CA-2 (3)','CA-2 (3)'),\n(22897,'002067','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (3)','CA-2 (3)','CA-2 (3)'),\n(22898,'002068','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (3)','CA-2 (3)','CA-2 (3)'),\n(22899,'002069','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (3)','CA-2 (3)','CA-2 (3)'),\n(22900,'002070','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 a 3','CA-2a.3.','CA-2'),\n(22901,'002071','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 d','CA-2d.','CA-2'),\n(22902,'002072','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (1)','CA-3 (1)','CA-3 (1)'),\n(22903,'002073','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (1)','CA-3 (1)','CA-3 (1)'),\n(22904,'002074','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (2)','CA-3 (2)','CA-3 (2)'),\n(22905,'002075','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (3)','CA-3 (3)','CA-3 (3)'),\n(22906,'002076','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (3)','CA-3 (3)','CA-3 (3)'),\n(22907,'002077','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (3)','CA-3 (3)','CA-3 (3)'),\n(22908,'002078','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (4)','CA-3 (4)','CA-3 (4)'),\n(22909,'002079','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (4)','CA-3 (4)','CA-3 (4)'),\n(22910,'002080','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (5)','CA-3 (5)','CA-3 (5)'),\n(22911,'002081','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (5)','CA-3 (5)','CA-3 (5)'),\n(22912,'002082','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (5)','CA-3 (5)','CA-3 (5)'),\n(22913,'002083','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 c','CA-3c.','CA-3'),\n(22914,'002084','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 c','CA-3c.','CA-3'),\n(22915,'002085','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 (1)','CA-7 (1)','CA-7 (1)'),\n(22916,'002086','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 (3)','CA-7 (3)','CA-7 (3)'),\n(22917,'002087','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 a','CA-7a.','CA-7'),\n(22918,'002088','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 b','CA-7b.','CA-7'),\n(22919,'002089','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 b','CA-7b.','CA-7'),\n(22920,'002090','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 d','CA-7d.','CA-7'),\n(22921,'002091','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 e','CA-7e.','CA-7'),\n(22922,'002092','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 f','CA-7f.','CA-7'),\n(22923,'002093','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-8','CA-8','CA-8'),\n(22924,'002094','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-8','CA-8','CA-8'),\n(22925,'002095','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-8','CA-8','CA-8'),\n(22926,'002096','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-8 (1)','CA-8 (1)','CA-8 (1)'),\n(22927,'002097','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-8 (2)','CA-8 (2)','CA-8 (2)'),\n(22928,'002098','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-8 (2)','CA-8 (2)','CA-8 (2)'),\n(22929,'002099','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-8 (2)','CA-8 (2)','CA-8 (2)'),\n(22930,'002100','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (1)','CA-9 (1)','CA-9 (1)'),\n(22931,'002101','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (a)','CA-9(a)','CA-9'),\n(22932,'002102','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (a)','CA-9(a)','CA-9'),\n(22933,'002103','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (b)','CA-9(b)','CA-9'),\n(22934,'002104','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (b)','CA-9(b)','CA-9'),\n(22935,'002105','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (b)','CA-9(b)','CA-9'),\n(22936,'001820','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 1','CM-1a.1.','CM-1'),\n(22937,'001821','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 1','CM-1a.1.','CM-1'),\n(22938,'001822','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 1','CM-1a.1.','CM-1'),\n(22939,'001823','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 2','CM-1a.2.','CM-1'),\n(22940,'001824','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 2','CM-1a.2.','CM-1'),\n(22941,'001825','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 2','CM-1a.2.','CM-1'),\n(22942,'001736','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (3)','CM-2 (3)','CM-2 (3)'),\n(22943,'001737','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (7) (a)','CM-2 (7)(a)','CM-2 (7)'),\n(22944,'001738','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (7) (a)','CM-2 (7)(a)','CM-2 (7)'),\n(22945,'001739','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (7) (a)','CM-2 (7)(a)','CM-2 (7)'),\n(22946,'001815','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (7) (b)','CM-2 (7)(b)','CM-2 (7)'),\n(22947,'001816','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (7) (b)','CM-2 (7)(b)','CM-2 (7)'),\n(22948,'001740','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 b','CM-3b.','CM-3'),\n(22949,'001741','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 c','CM-3c.','CM-3'),\n(22950,'001742','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (b)','CM-3 (1)(b)','CM-3 (1)'),\n(22951,'001743','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (5)','CM-3 (5)','CM-3 (5)'),\n(22952,'001744','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (5)','CM-3 (5)','CM-3 (5)'),\n(22953,'001745','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (6)','CM-3 (6)','CM-3 (6)'),\n(22954,'001746','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (6)','CM-3 (6)','CM-3 (6)'),\n(22955,'001819','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 d','CM-3d.','CM-3'),\n(22956,'002056','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 e','CM-3e.','CM-3'),\n(22957,'002057','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (f)','CM-3 (1)(f)','CM-3 (1)'),\n(22958,'002058','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (f)','CM-3 (1)(f)','CM-3 (1)'),\n(22959,'001817','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-4 (1)','CM-4 (1)','CM-4 (1)'),\n(22960,'001818','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-4 (1)','CM-4 (1)','CM-4 (1)'),\n(22961,'001747','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (3)','CM-5 (3)','CM-5 (3)'),\n(22962,'001748','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (3)','CM-5 (3)','CM-5 (3)'),\n(22963,'001749','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (3)','CM-5 (3)','CM-5 (3)'),\n(22964,'001750','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (3)','CM-5 (3)','CM-5 (3)'),\n(22965,'001751','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (4)','CM-5 (4)','CM-5 (4)'),\n(22966,'001752','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (4)','CM-5 (4)','CM-5 (4)'),\n(22967,'001753','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (5) (a)','CM-5 (5)(a)','CM-5 (5)'),\n(22968,'001754','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (5) (a)','CM-5 (5)(a)','CM-5 (5)'),\n(22969,'001813','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (1)','CM-5 (1)','CM-5 (1)'),\n(22970,'001814','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (1)','CM-5 (1)','CM-5 (1)'),\n(22971,'001826','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (2)','CM-5 (2)','CM-5 (2)'),\n(22972,'001827','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (5) (b)','CM-5 (5)(b)','CM-5 (5)'),\n(22973,'001828','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (5) (b)','CM-5 (5)(b)','CM-5 (5)'),\n(22974,'001829','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (5) (b)','CM-5 (5)(b)','CM-5 (5)'),\n(22975,'001830','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (5) (b)','CM-5 (5)(b)','CM-5 (5)'),\n(22976,'001755','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 c','CM-6c.','CM-6'),\n(22977,'001756','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 c','CM-6c.','CM-6'),\n(22978,'001757','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (2)','CM-6 (2)','CM-6 (2)'),\n(22979,'001758','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (2)','CM-6 (2)','CM-6 (2)'),\n(22980,'001759','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (2)','CM-6 (2)','CM-6 (2)'),\n(22981,'002059','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (1)','CM-6 (1)','CM-6 (1)'),\n(22982,'001760','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (1) (a)','CM-7 (1)(a)','CM-7 (1)'),\n(22983,'001761','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (1) (b)','CM-7 (1)(b)','CM-7 (1)'),\n(22984,'001762','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (1) (b)','CM-7 (1)(b)','CM-7 (1)'),\n(22985,'001763','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (2)','CM-7 (2)','CM-7 (2)'),\n(22986,'001764','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (2)','CM-7 (2)','CM-7 (2)'),\n(22987,'001765','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (4) (a)','CM-7 (4)(a)','CM-7 (4)'),\n(22988,'001766','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (4) (a)','CM-7 (4)(a)','CM-7 (4)'),\n(22989,'001767','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (4) (b)','CM-7 (4)(b)','CM-7 (4)'),\n(22990,'001768','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (4) (c)','CM-7 (4)(c)','CM-7 (4)'),\n(22991,'001769','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (4) (c)','CM-7 (4)(c)','CM-7 (4)'),\n(22992,'001770','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (4) (c)','CM-7 (4)(c)','CM-7 (4)'),\n(22993,'001771','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (4) (c)','CM-7 (4)(c)','CM-7 (4)'),\n(22994,'001772','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (5) (a)','CM-7 (5)(a)','CM-7 (5)'),\n(22995,'001773','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (5) (a)','CM-7 (5)(a)','CM-7 (5)'),\n(22996,'001774','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (5) (b)','CM-7 (5)(b)','CM-7 (5)'),\n(22997,'001775','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (5) (c)','CM-7 (5)(c)','CM-7 (5)'),\n(22998,'001776','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (5) (c)','CM-7 (5)(c)','CM-7 (5)'),\n(22999,'001777','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (5) (c)','CM-7 (5)(c)','CM-7 (5)'),\n(23000,'001778','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (5) (c)','CM-7 (5)(c)','CM-7 (5)'),\n(23001,'001779','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 b','CM-8b.','CM-8'),\n(23002,'001780','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 b','CM-8b.','CM-8'),\n(23003,'001781','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 b','CM-8b.','CM-8'),\n(23004,'001782','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 b','CM-8b.','CM-8'),\n(23005,'001783','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (3) (b)','CM-8 (3)(b)','CM-8 (3)'),\n(23006,'001784','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (3) (b)','CM-8 (3)(b)','CM-8 (3)'),\n(23007,'001785','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (7)','CM-8 (7)','CM-8 (7)'),\n(23008,'001786','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (8)','CM-8 (8)','CM-8 (8)'),\n(23009,'001787','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (9) (a)','CM-8 (9)(a)','CM-8 (9)'),\n(23010,'001788','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (9) (a)','CM-8 (9)(a)','CM-8 (9)'),\n(23011,'001789','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (9) (b)','CM-8 (9)(b)','CM-8 (9)'),\n(23012,'001790','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 b','CM-9b.','CM-9'),\n(23013,'001791','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 b','CM-9b.','CM-9'),\n(23014,'001792','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 b','CM-9b.','CM-9'),\n(23015,'001793','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 b','CM-9b.','CM-9'),\n(23016,'001794','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 b','CM-9b.','CM-9'),\n(23017,'001795','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 b','CM-9b.','CM-9'),\n(23018,'001796','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 c','CM-9c.','CM-9'),\n(23019,'001797','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 c','CM-9c.','CM-9'),\n(23020,'001798','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 c','CM-9c.','CM-9'),\n(23021,'001799','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 d','CM-9d.','CM-9'),\n(23022,'001800','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 d','CM-9d.','CM-9'),\n(23023,'001801','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 d','CM-9d.','CM-9'),\n(23024,'001726','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 a','CM-10a.','CM-10'),\n(23025,'001727','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 a','CM-10a.','CM-10'),\n(23026,'001728','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 a','CM-10a.','CM-10'),\n(23027,'001729','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 a','CM-10a.','CM-10'),\n(23028,'001730','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 b','CM-10b.','CM-10'),\n(23029,'001731','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 b','CM-10b.','CM-10'),\n(23030,'001732','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 c','CM-10c.','CM-10'),\n(23031,'001733','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 c','CM-10c.','CM-10'),\n(23032,'001734','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 (1)','CM-10 (1)','CM-10 (1)'),\n(23033,'001735','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 (1)','CM-10 (1)','CM-10 (1)'),\n(23034,'001802','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 b','CM-10b.','CM-10'),\n(23035,'001803','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 b','CM-10b.','CM-10'),\n(23036,'001804','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 a','CM-11a.','CM-11'),\n(23037,'001805','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 a','CM-11a.','CM-11'),\n(23038,'001806','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 b','CM-11b.','CM-11'),\n(23039,'001807','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 b','CM-11b.','CM-11'),\n(23040,'001808','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 c','CM-11c.','CM-11'),\n(23041,'001809','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 c','CM-11c.','CM-11'),\n(23042,'001810','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 (1)','CM-11 (1)','CM-11 (1)'),\n(23043,'001811','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 (1)','CM-11 (1)','CM-11 (1)'),\n(23044,'001812','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 (2)','CM-11 (2)','CM-11 (2)'),\n(23045,'002825','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 a 1','CP-1a.1.','CP-1'),\n(23046,'002826','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 a 2','CP-1a.2.','CP-1'),\n(23047,'002827','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (7)','CP-2 (7)','CP-2 (7)'),\n(23048,'002828','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (8)','CP-2 (8)','CP-2 (8)'),\n(23049,'002829','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (8)','CP-2 (8)','CP-2 (8)'),\n(23050,'002830','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 6','CP-2a.6.','CP-2'),\n(23051,'002831','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 f','CP-2f.','CP-2'),\n(23052,'002832','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 g','CP-2g.','CP-2'),\n(23053,'002833','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 a','CP-3a.','CP-3'),\n(23054,'002834','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 b','CP-3b.','CP-3'),\n(23055,'002835','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 (2) (b)','CP-4 (2)(b)','CP-4 (2)'),\n(23056,'002836','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-6 b','CP-6b.','CP-6'),\n(23057,'002837','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (6)','CP-7 (6)','CP-7 (6)'),\n(23058,'002838','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (6)','CP-7 (6)','CP-7 (6)'),\n(23059,'002839','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 a','CP-7a.','CP-7'),\n(23060,'002840','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8','CP-8','CP-8'),\n(23061,'002841','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8','CP-8','CP-8'),\n(23062,'002842','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (4) (b)','CP-8 (4)(b)','CP-8 (4)'),\n(23063,'002843','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (4) (c)  ','CP-8 (4)(c)','CP-8 (4)'),\n(23064,'002844','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (4) (c)  ','CP-8 (4)(c)','CP-8 (4)'),\n(23065,'002845','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (4) (c)  ','CP-8 (4)(c)','CP-8 (4)'),\n(23066,'002846','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (4) (c)  ','CP-8 (4)(c)','CP-8 (4)'),\n(23067,'002847','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (5)','CP-8 (5)','CP-8 (5)'),\n(23068,'002848','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (5)','CP-8 (5)','CP-8 (5)'),\n(23069,'002849','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (3)','CP-9 (3)','CP-9 (3)'),\n(23070,'002850','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (3)','CP-9 (3)','CP-9 (3)'),\n(23071,'002851','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (7)','CP-9 (7)','CP-9 (7)'),\n(23072,'002852','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (7)','CP-9 (7)','CP-9 (7)'),\n(23073,'002853','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-11','CP-11','CP-11'),\n(23074,'002854','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-11','CP-11','CP-11'),\n(23075,'002855','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-12','CP-12','CP-12'),\n(23076,'002856','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-12','CP-12','CP-12'),\n(23077,'002857','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-12','CP-12','CP-12'),\n(23078,'002858','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-13','CP-13','CP-13'),\n(23079,'002859','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-13','CP-13','CP-13'),\n(23080,'002860','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','CP-13','CP-13','CP-13'),\n(23081,'001932','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 a 1','IA-1a.1.','IA-1'),\n(23082,'001933','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 a 1','IA-1a.1.','IA-1'),\n(23083,'001934','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 a 2','IA-1a.2.','IA-1'),\n(23084,'001935','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (6)','IA-2 (6)','IA-2 (6)'),\n(23085,'001936','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (6)','IA-2 (6)','IA-2 (6)'),\n(23086,'001937','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (6)','IA-2 (6)','IA-2 (6)'),\n(23087,'001938','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (7)','IA-2 (7)','IA-2 (7)'),\n(23088,'001939','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (7)','IA-2 (7)','IA-2 (7)'),\n(23089,'001940','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (7)','IA-2 (7)','IA-2 (7)'),\n(23090,'001941','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (8)','IA-2 (8)','IA-2 (8)'),\n(23091,'001942','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (9)','IA-2 (9)','IA-2 (9)'),\n(23092,'001943','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (10)','IA-2 (10)','IA-2 (10)'),\n(23093,'001944','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (10)','IA-2 (10)','IA-2 (10)'),\n(23094,'001945','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (10)','IA-2 (10)','IA-2 (10)'),\n(23095,'001946','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (10)','IA-2 (10)','IA-2 (10)'),\n(23096,'001947','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (11)','IA-2 (11)','IA-2 (11)'),\n(23097,'001948','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (11)','IA-2 (11)','IA-2 (11)'),\n(23098,'001949','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (11)','IA-2 (11)','IA-2 (11)'),\n(23099,'001950','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (11)','IA-2 (11)','IA-2 (11)'),\n(23100,'001951','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (11)','IA-2 (11)','IA-2 (11)'),\n(23101,'001952','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (11)','IA-2 (11)','IA-2 (11)'),\n(23102,'001953','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (12)','IA-2 (12)','IA-2 (12)'),\n(23103,'001954','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (12)','IA-2 (12)','IA-2 (12)'),\n(23104,'001955','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (13)','IA-2 (13)','IA-2 (13)'),\n(23105,'001956','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (13)','IA-2 (13)','IA-2 (13)'),\n(23106,'001957','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (13)','IA-2 (13)','IA-2 (13)'),\n(23107,'001958','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3','IA-3','IA-3'),\n(23108,'001959','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (1)','IA-3 (1)','IA-3 (1)'),\n(23109,'001960','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (3) (a)','IA-3 (3)(a)','IA-3 (3)'),\n(23110,'001961','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (3) (a)','IA-3 (3)(a)','IA-3 (3)'),\n(23111,'001962','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (3) (a)','IA-3 (3)(a)','IA-3 (3)'),\n(23112,'001963','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (3) (a)','IA-3 (3)(a)','IA-3 (3)'),\n(23113,'001964','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (4)','IA-3 (4)','IA-3 (4)'),\n(23114,'001965','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (4)','IA-3 (4)','IA-3 (4)'),\n(23115,'001966','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (4)','IA-3 (4)','IA-3 (4)'),\n(23116,'001967','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (1)','IA-3 (1)','IA-3 (1)'),\n(23117,'001968','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (4)','IA-3 (4)','IA-3 (4)'),\n(23118,'001969','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (4)','IA-3 (4)','IA-3 (4)'),\n(23119,'001970','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 a','IA-4a.','IA-4'),\n(23120,'001971','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 a','IA-4a.','IA-4'),\n(23121,'001972','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 b','IA-4b.','IA-4'),\n(23122,'001973','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 c','IA-4c.','IA-4'),\n(23123,'001974','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 d','IA-4d.','IA-4'),\n(23124,'001975','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 d','IA-4d.','IA-4'),\n(23125,'001976','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (5)','IA-4 (5)','IA-4 (5)'),\n(23126,'001977','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (6)','IA-4 (6)','IA-4 (6)'),\n(23127,'001978','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (6)','IA-4 (6)','IA-4 (6)'),\n(23128,'001979','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (7)','IA-4 (7)','IA-4 (7)'),\n(23129,'002040','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (2)','IA-4 (2)','IA-4 (2)'),\n(23130,'001980','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 a','IA-5a.','IA-5'),\n(23131,'001981','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 d','IA-5d.','IA-5'),\n(23132,'001982','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 d','IA-5d.','IA-5'),\n(23133,'001983','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 d','IA-5d.','IA-5'),\n(23134,'001984','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 d','IA-5d.','IA-5'),\n(23135,'001985','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 d','IA-5d.','IA-5'),\n(23136,'001986','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 d','IA-5d.','IA-5'),\n(23137,'001987','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 d','IA-5d.','IA-5'),\n(23138,'001988','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 d','IA-5d.','IA-5'),\n(23139,'001989','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 e','IA-5e.','IA-5'),\n(23140,'001990','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 j','IA-5j.','IA-5'),\n(23141,'001991','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (2) (d)','IA-5 (2)(d)','IA-5 (2)'),\n(23142,'001992','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (3)','IA-5 (3)','IA-5 (3)'),\n(23143,'001993','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (3)','IA-5 (3)','IA-5 (3)'),\n(23144,'001994','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (3)','IA-5 (3)','IA-5 (3)'),\n(23145,'001995','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (3)','IA-5 (3)','IA-5 (3)'),\n(23146,'001996','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (4)','IA-5 (4)','IA-5 (4)'),\n(23147,'001997','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (4)','IA-5 (4)','IA-5 (4)'),\n(23148,'001998','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (5)','IA-5 (5)','IA-5 (5)'),\n(23149,'001999','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (9)','IA-5 (9)','IA-5 (9)'),\n(23150,'002000','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (9)','IA-5 (9)','IA-5 (9)'),\n(23151,'002001','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (10)','IA-5 (10)','IA-5 (10)'),\n(23152,'002002','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (11)','IA-5 (11)','IA-5 (11)'),\n(23153,'002003','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (11)','IA-5 (11)','IA-5 (11)'),\n(23154,'002004','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (12)','IA-5 (12)','IA-5 (12)'),\n(23155,'002005','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (12)','IA-5 (12)','IA-5 (12)'),\n(23156,'002006','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (13)','IA-5 (13)','IA-5 (13)'),\n(23157,'002007','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (13)','IA-5 (13)','IA-5 (13)'),\n(23158,'002008','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (14)','IA-5 (14)','IA-5 (14)'),\n(23159,'002041','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (f)','IA-5 (1)(f)','IA-5 (1)'),\n(23160,'002042','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 h','IA-5h.','IA-5'),\n(23161,'002043','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (15)','IA-5 (15)','IA-5 (15)'),\n(23162,'002365','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 i','IA-5i.','IA-5'),\n(23163,'002366','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 i','IA-5i.','IA-5'),\n(23164,'002367','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (7)','IA-5 (7)','IA-5 (7)'),\n(23165,'002009','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (1)','IA-8 (1)','IA-8 (1)'),\n(23166,'002010','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (1)','IA-8 (1)','IA-8 (1)'),\n(23167,'002011','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (2)','IA-8 (2)','IA-8 (2)'),\n(23168,'002012','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (3)','IA-8 (3)','IA-8 (3)'),\n(23169,'002013','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (3)','IA-8 (3)','IA-8 (3)'),\n(23170,'002014','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (4)','IA-8 (4)','IA-8 (4)'),\n(23171,'002015','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (5)','IA-8 (5)','IA-8 (5)'),\n(23172,'002016','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (5)','IA-8 (5)','IA-8 (5)'),\n(23173,'002017','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9','IA-9','IA-9'),\n(23174,'002018','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9','IA-9','IA-9'),\n(23175,'002019','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9','IA-9','IA-9'),\n(23176,'002020','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9','IA-9','IA-9'),\n(23177,'002021','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9','IA-9','IA-9'),\n(23178,'002022','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9','IA-9','IA-9'),\n(23179,'002023','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9 (1)','IA-9 (1)','IA-9 (1)'),\n(23180,'002024','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9 (1)','IA-9 (1)','IA-9 (1)'),\n(23181,'002025','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9 (1)','IA-9 (1)','IA-9 (1)'),\n(23182,'002026','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9 (1)','IA-9 (1)','IA-9 (1)'),\n(23183,'002027','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9 (1)','IA-9 (1)','IA-9 (1)'),\n(23184,'002028','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9 (1)','IA-9 (1)','IA-9 (1)'),\n(23185,'002029','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9 (2)','IA-9 (2)','IA-9 (2)'),\n(23186,'002030','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9 (2)','IA-9 (2)','IA-9 (2)'),\n(23187,'002031','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9 (2)','IA-9 (2)','IA-9 (2)'),\n(23188,'002032','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-9 (2)','IA-9 (2)','IA-9 (2)'),\n(23189,'002033','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-10','IA-10','IA-10'),\n(23190,'002034','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-10','IA-10','IA-10'),\n(23191,'002035','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-10','IA-10','IA-10'),\n(23192,'002036','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-11','IA-11','IA-11'),\n(23193,'002037','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-11','IA-11','IA-11'),\n(23194,'002038','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-11','IA-11','IA-11'),\n(23195,'002039','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IA-11','IA-11','IA-11'),\n(23196,'002776','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 a 1','IR-1a.1.','IR-1'),\n(23197,'002777','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 a 2','IR-1a.2.','IR-1'),\n(23198,'002778','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 a','IR-2a.','IR-2'),\n(23199,'002779','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 b','IR-2b.','IR-2'),\n(23200,'002780','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (2)','IR-3 (2)','IR-3 (2)'),\n(23201,'002781','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (2)','IR-4 (2)','IR-4 (2)'),\n(23202,'002782','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (6)','IR-4 (6)','IR-4 (6)'),\n(23203,'002783','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (7)','IR-4 (7)','IR-4 (7)'),\n(23204,'002784','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (7)','IR-4 (7)','IR-4 (7)'),\n(23205,'002785','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (8)','IR-4 (8)','IR-4 (8)'),\n(23206,'002786','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (8)','IR-4 (8)','IR-4 (8)'),\n(23207,'002787','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (8)','IR-4 (8)','IR-4 (8)'),\n(23208,'002788','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (9)','IR-4 (9)','IR-4 (9)'),\n(23209,'002789','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (9)','IR-4 (9)','IR-4 (9)'),\n(23210,'002790','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (10)','IR-4 (10)','IR-4 (10)'),\n(23211,'002791','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 b','IR-6b.','IR-6'),\n(23212,'002792','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 (2)','IR-6 (2)','IR-6 (2)'),\n(23213,'002793','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 (3)','IR-6 (3)','IR-6 (3)'),\n(23214,'002794','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a','IR-8a.','IR-8'),\n(23215,'002795','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 1','IR-8a.1.','IR-8'),\n(23216,'002796','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 2','IR-8a.2.','IR-8'),\n(23217,'002797','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 3','IR-8a.3.','IR-8'),\n(23218,'002798','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 4','IR-8a.4.','IR-8'),\n(23219,'002799','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 5','IR-8a.5.','IR-8'),\n(23220,'002800','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 6','IR-8a.6.','IR-8'),\n(23221,'002801','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 7','IR-8a.7.','IR-8'),\n(23222,'002802','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 8','IR-8a.8.','IR-8'),\n(23223,'002803','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 e','IR-8e.','IR-8'),\n(23224,'002804','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 f','IR-8f.','IR-8'),\n(23225,'002805','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 a','IR-9a.','IR-9'),\n(23226,'002806','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 b','IR-9b.','IR-9'),\n(23227,'002807','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 b','IR-9b.','IR-9'),\n(23228,'002808','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 c','IR-9c.','IR-9'),\n(23229,'002809','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 d','IR-9d.','IR-9'),\n(23230,'002810','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 e','IR-9e.','IR-9'),\n(23231,'002811','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 f','IR-9f.','IR-9'),\n(23232,'002812','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 f','IR-9f.','IR-9'),\n(23233,'002813','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (1)','IR-9 (1)','IR-9 (1)'),\n(23234,'002814','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (1)','IR-9 (1)','IR-9 (1)'),\n(23235,'002815','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (1)','IR-9 (1)','IR-9 (1)'),\n(23236,'002816','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (2)','IR-9 (2)','IR-9 (2)'),\n(23237,'002817','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (2)','IR-9 (2)','IR-9 (2)'),\n(23238,'002818','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (3)','IR-9 (3)','IR-9 (3)'),\n(23239,'002819','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (3)','IR-9 (3)','IR-9 (3)'),\n(23240,'002820','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (4)','IR-9 (4)','IR-9 (4)'),\n(23241,'002821','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (4)','IR-9 (4)','IR-9 (4)'),\n(23242,'002822','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IR-10','IR-10','IR-10'),\n(23243,'002861','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 a 1','MA-1a.1.','MA-1'),\n(23244,'002862','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 a 2','MA-1a.2.','MA-1'),\n(23245,'002863','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 (2) (a)','MA-2 (2)(a)','MA-2 (2)'),\n(23246,'002864','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 (2) (b)','MA-2 (2)(b)','MA-2 (2)'),\n(23247,'002865','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 (2) (b)','MA-2 (2)(b)','MA-2 (2)'),\n(23248,'002866','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a.','MA-2'),\n(23249,'002867','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a ','MA-2a..','MA-2'),\n(23250,'002868','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a.','MA-2'),\n(23251,'002869','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a.','MA-2'),\n(23252,'002870','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a.','MA-2'),\n(23253,'002871','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a.','MA-2'),\n(23254,'002872','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a.','MA-2'),\n(23255,'002873','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a.','MA-2'),\n(23256,'002874','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 c','MA-2c.','MA-2'),\n(23257,'002875','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 f','MA-2f.','MA-2'),\n(23258,'002876','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 f','MA-2f.','MA-2'),\n(23259,'002905','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 (2) (a)','MA-2 (2)(a)','MA-2 (2)'),\n(23260,'002877','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (3) (a)','MA-3 (3)(a)','MA-3 (3)'),\n(23261,'002878','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (3) (b)','MA-3 (3)(b)','MA-3 (3)'),\n(23262,'002879','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (3) (c)','MA-3 (3)(c)','MA-3 (3)'),\n(23263,'002880','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (3) (c)','MA-3 (3)(c)','MA-3 (3)'),\n(23264,'002881','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (3) (d)','MA-3 (3)(d)','MA-3 (3)'),\n(23265,'002882','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (3) (d)','MA-3 (3)(d)','MA-3 (3)'),\n(23266,'002883','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (4)','MA-3 (4)','MA-3 (4)'),\n(23267,'002884','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (1) (a)','MA-4 (1)(a)','MA-4 (1)'),\n(23268,'002885','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (1) (a)','MA-4 (1)(a)','MA-4 (1)'),\n(23269,'002886','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (1) (b)','MA-4 (1)(b)','MA-4 (1)'),\n(23270,'002887','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (4) (a)','MA-4 (4)(a)','MA-4 (4)'),\n(23271,'002888','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (5) (a)','MA-4 (5)(a)','MA-4 (5)'),\n(23272,'002889','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (5) (b)','MA-4 (5)(b)','MA-4 (5)'),\n(23273,'002890','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (6)','MA-4 (6)','MA-4 (6)'),\n(23274,'002891','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (7)','MA-4 (7)','MA-4 (7)'),\n(23275,'003123','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (6)','MA-4 (6)','MA-4 (6)'),\n(23276,'002892','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (1) (b)','MA-5 (1)(b)','MA-5 (1)'),\n(23277,'002893','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (5)','MA-5 (5)','MA-5 (5)'),\n(23278,'002894','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 b','MA-5b.','MA-5'),\n(23279,'002895','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 c','MA-5c.','MA-5'),\n(23280,'002896','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-6','MA-6','MA-6'),\n(23281,'002897','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-6','MA-6','MA-6'),\n(23282,'002898','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (1)','MA-6 (1)','MA-6 (1)'),\n(23283,'002899','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (1)','MA-6 (1)','MA-6 (1)'),\n(23284,'002900','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (1)','MA-6 (1)','MA-6 (1)'),\n(23285,'002901','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (2)','MA-6 (2)','MA-6 (2)'),\n(23286,'002902','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (2)','MA-6 (2)','MA-6 (2)'),\n(23287,'002903','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (2)','MA-6 (2)','MA-6 (2)'),\n(23288,'002904','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (3)','MA-6 (3)','MA-6 (3)'),\n(23289,'002566','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 a 1','MP-1a.1.','MP-1'),\n(23290,'002567','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (1)','MP-6 (1)','MP-6 (1)'),\n(23291,'002568','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (1)','MP-6 (1)','MP-6 (1)'),\n(23292,'002569','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (1)','MP-6 (1)','MP-6 (1)'),\n(23293,'002570','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (1)','MP-6 (1)','MP-6 (1)'),\n(23294,'002571','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (1)','MP-6 (1)','MP-6 (1)'),\n(23295,'002572','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (1)','MP-6 (1)','MP-6 (1)'),\n(23296,'002573','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (7)','MP-6 (7)','MP-6 (7)'),\n(23297,'002574','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (7)','MP-6 (7)','MP-6 (7)'),\n(23298,'002575','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (8)','MP-6 (8)','MP-6 (8)'),\n(23299,'002576','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (8)','MP-6 (8)','MP-6 (8)'),\n(23300,'002577','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (8)','MP-6 (8)','MP-6 (8)'),\n(23301,'002578','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 a','MP-6a.','MP-6'),\n(23302,'002579','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 a','MP-6a.','MP-6'),\n(23303,'002580','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 b','MP-6b.','MP-6'),\n(23304,'002581','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-7','MP-7','MP-7'),\n(23305,'002582','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-7','MP-7','MP-7'),\n(23306,'002583','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-7','MP-7','MP-7'),\n(23307,'002584','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-7','MP-7','MP-7'),\n(23308,'002585','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-7 (1)','MP-7 (1)','MP-7 (1)'),\n(23309,'002586','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-7 (2)','MP-7 (2)','MP-7 (2)'),\n(23310,'002587','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 (1)','MP-8 (1)','MP-8 (1)'),\n(23311,'002588','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 (2)','MP-8 (2)','MP-8 (2)'),\n(23312,'002589','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 (2)','MP-8 (2)','MP-8 (2)'),\n(23313,'002590','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 (2)','MP-8 (2)','MP-8 (2)'),\n(23314,'002591','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 (2)','MP-8 (2)','MP-8 (2)'),\n(23315,'002592','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 (3)','MP-8 (3)','MP-8 (3)'),\n(23316,'002593','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 (3)','MP-8 (3)','MP-8 (3)'),\n(23317,'002594','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 (4)','MP-8 (4)','MP-8 (4)'),\n(23318,'002595','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 a','MP-8a.','MP-8'),\n(23319,'002596','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 a','MP-8a.','MP-8'),\n(23320,'002597','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 a','MP-8a.','MP-8'),\n(23321,'002598','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 b','MP-8b.','MP-8'),\n(23322,'002599','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 c','MP-8c.','MP-8'),\n(23323,'002600','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 d','MP-8d.','MP-8'),\n(23324,'002908','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 a 1','PE-1a.1.','PE-1'),\n(23325,'002909','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 a 2','PE-1a.2.','PE-1'),\n(23326,'002910','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 a','PE-2a.','PE-2'),\n(23327,'002911','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 a','PE-2a.','PE-2'),\n(23328,'002912','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 (2)','PE-2 (2)','PE-2 (2)'),\n(23329,'002913','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 (3)','PE-2 (3)','PE-2 (3)'),\n(23330,'002914','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 (3)','PE-2 (3)','PE-2 (3)'),\n(23331,'002915','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 a','PE-3a.','PE-3'),\n(23332,'002916','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 a 2','PE-3a.2.','PE-3'),\n(23333,'002917','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 b','PE-3b.','PE-3'),\n(23334,'002918','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 b','PE-3b.','PE-3'),\n(23335,'002919','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 c','PE-3c.','PE-3'),\n(23336,'002920','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 c','PE-3c.','PE-3'),\n(23337,'002921','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 d','PE-3d.','PE-3'),\n(23338,'002922','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 d','PE-3d.','PE-3'),\n(23339,'002923','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 d','PE-3d.','PE-3'),\n(23340,'002924','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 d','PE-3d.','PE-3'),\n(23341,'002925','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 f','PE-3f.','PE-3'),\n(23342,'002926','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (1)','PE-3 (1)','PE-3 (1)'),\n(23343,'002927','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (2)','PE-3 (2)','PE-3 (2)'),\n(23344,'002928','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (5)','PE-3 (5)','PE-3 (5)'),\n(23345,'002929','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (5)','PE-3 (5)','PE-3 (5)'),\n(23346,'002930','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-4','PE-4','PE-4'),\n(23347,'002931','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-4','PE-4','PE-4'),\n(23348,'002932','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-5 (1) (a)','PE-5 (1)(a)','PE-5 (1)'),\n(23349,'002933','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-5 (1) (a)','PE-5 (1)(a)','PE-5 (1)'),\n(23350,'002934','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-5 (1) (b)','PE-5 (1)(b)','PE-5 (1)'),\n(23351,'002935','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-5 (2) (a)','PE-5 (2)(a)','PE-5 (2)'),\n(23352,'002936','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-5 (2) (b)','PE-5 (2)(b)','PE-5 (2)'),\n(23353,'002937','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-5 (3)','PE-5 (3)','PE-5 (3)'),\n(23354,'002938','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-5 (3)','PE-5 (3)','PE-5 (3)'),\n(23355,'002939','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 a','PE-6a.','PE-6'),\n(23356,'002940','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 b','PE-6b.','PE-6'),\n(23357,'002941','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 b','PE-6b.','PE-6'),\n(23358,'002942','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (2)','PE-6 (2)','PE-6 (2)'),\n(23359,'002943','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (2)','PE-6 (2)','PE-6 (2)'),\n(23360,'002944','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (2)','PE-6 (2)','PE-6 (2)'),\n(23361,'002945','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (2)','PE-6 (2)','PE-6 (2)'),\n(23362,'002946','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (3)','PE-6 (3)','PE-6 (3)'),\n(23363,'002947','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (3)','PE-6 (3)','PE-6 (3)'),\n(23364,'002948','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (3)','PE-6 (3)','PE-6 (3)'),\n(23365,'002949','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (3)','PE-6 (3)','PE-6 (3)'),\n(23366,'002950','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (4)','PE-6 (4)','PE-6 (4)'),\n(23367,'002951','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (4)','PE-6 (4)','PE-6 (4)'),\n(23368,'002952','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 a','PE-8a.','PE-8'),\n(23369,'002953','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-9 (1)','PE-9 (1)','PE-9 (1)'),\n(23370,'002954','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-9 (1)','PE-9 (1)','PE-9 (1)'),\n(23371,'002955','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-11','PE-11','PE-11'),\n(23372,'002956','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-11 (2) (a)','PE-11 (2)(a)','PE-11 (2)'),\n(23373,'002957','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-11 (2) (b)','PE-11 (2)(b)','PE-11 (2)'),\n(23374,'002958','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-11 (2) (c)','PE-11 (2)(c)','PE-11 (2)'),\n(23375,'002959','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-12 (1)','PE-12 (1)','PE-12 (1)'),\n(23376,'002960','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-12 (1)','PE-12 (1)','PE-12 (1)'),\n(23377,'002961','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (1)','PE-13 (1)','PE-13 (1)'),\n(23378,'002962','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (1)','PE-13 (1)','PE-13 (1)'),\n(23379,'002963','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (1)','PE-13 (1)','PE-13 (1)'),\n(23380,'002964','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (1)','PE-13 (1)','PE-13 (1)'),\n(23381,'002965','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (2)','PE-13 (2)','PE-13 (2)'),\n(23382,'002966','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (2)','PE-13 (2)','PE-13 (2)'),\n(23383,'002967','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (2)','PE-13 (2)','PE-13 (2)'),\n(23384,'002968','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (4)','PE-13 (4)','PE-13 (4)'),\n(23385,'002969','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (4)','PE-13 (4)','PE-13 (4)'),\n(23386,'002970','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (4)','PE-13 (4)','PE-13 (4)'),\n(23387,'002971','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (4)','PE-13 (4)','PE-13 (4)'),\n(23388,'002972','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-15 (1)','PE-15 (1)','PE-15 (1)'),\n(23389,'002973','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-15 (1)','PE-15 (1)','PE-15 (1)'),\n(23390,'002974','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-16','PE-16','PE-16'),\n(23391,'002975','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-17 a','PE-17a.','PE-17'),\n(23392,'002976','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-18','PE-18','PE-18'),\n(23393,'002977','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-18 (1)','PE-18 (1)','PE-18 (1)'),\n(23394,'002978','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-18 (1)','PE-18 (1)','PE-18 (1)'),\n(23395,'003047','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 a 1','PL-1a.1.','PL-1'),\n(23396,'003048','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 a 2','PL-1a.2.','PL-1'),\n(23397,'003049','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a','PL-2a.','PL-2'),\n(23398,'003050','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 1','PL-2a.1.','PL-2'),\n(23399,'003051','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 2','PL-2a.2.','PL-2'),\n(23400,'003052','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 3','PL-2a.3.','PL-2'),\n(23401,'003053','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 4','PL-2a.4.','PL-2'),\n(23402,'003054','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 5','PL-2a.5.','PL-2'),\n(23403,'003055','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 6','PL-2a.6.','PL-2'),\n(23404,'003056','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 7','PL-2a.7.','PL-2'),\n(23405,'003057','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 8','PL-2a.8.','PL-2'),\n(23406,'003058','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 b','PL-2b.','PL-2'),\n(23407,'003059','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 b','PL-2b.','PL-2'),\n(23408,'003060','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 b','PL-2b.','PL-2'),\n(23409,'003061','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 b','PL-2b.','PL-2'),\n(23410,'003062','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 b','PL-2b.','PL-2'),\n(23411,'003063','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 e','PL-2e.','PL-2'),\n(23412,'003064','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 e','PL-2e.','PL-2'),\n(23413,'003065','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 (3)','PL-2 (3)','PL-2 (3)'),\n(23414,'003066','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 (3)','PL-2 (3)','PL-2 (3)'),\n(23415,'003067','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 (3)','PL-2 (3)','PL-2 (3)'),\n(23416,'003068','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 c','PL-4c.','PL-4'),\n(23417,'003069','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 c','PL-4c.','PL-4'),\n(23418,'003070','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 d','PL-4d.','PL-4'),\n(23419,'003071','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-7 a','PL-7a.','PL-7'),\n(23420,'003072','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 a','PL-8a.','PL-8'),\n(23421,'003073','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 a 1','PL-8a.1.','PL-8'),\n(23422,'003074','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 a 2','PL-8a.2.','PL-8'),\n(23423,'003075','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 a 3','PL-8a.3.','PL-8'),\n(23424,'003076','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 b','PL-8b.','PL-8'),\n(23425,'003077','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 b','PL-8b.','PL-8'),\n(23426,'003078','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 c','PL-8c.','PL-8'),\n(23427,'003079','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 c','PL-8c.','PL-8'),\n(23428,'003080','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 c','PL-8c.','PL-8'),\n(23429,'003081','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8 (1)(a)','PL-8 (1)'),\n(23430,'003082','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8 (1)(a)','PL-8 (1)'),\n(23431,'003083','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8 (1)(a)','PL-8 (1)'),\n(23432,'003084','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8 (1)(a)','PL-8 (1)'),\n(23433,'003085','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8 (1)(a)','PL-8 (1)'),\n(23434,'003086','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8 (1)(a)','PL-8 (1)'),\n(23435,'003087','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (b)','PL-8 (1)(b)','PL-8 (1)'),\n(23436,'003088','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (2)','PL-8 (2)','PL-8 (2)'),\n(23437,'003017','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 a 1','PS-1a.1.','PS-1'),\n(23438,'003018','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 a 2','PS-1a.2.','PS-1'),\n(23439,'003019','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 (3) (a)','PS-3 (3)(a)','PS-3 (3)'),\n(23440,'003020','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 (3) (b)','PS-3 (3)(b)','PS-3 (3)'),\n(23441,'003021','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 (3) (b)','PS-3 (3)(b)','PS-3 (3)'),\n(23442,'003016','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 f','PS-4f.','PS-4'),\n(23443,'003022','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 a','PS-4a.','PS-4'),\n(23444,'003023','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 b','PS-4b.','PS-4'),\n(23445,'003024','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 c','PS-4c.','PS-4'),\n(23446,'003025','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 f','PS-4f.','PS-4'),\n(23447,'003026','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 f','PS-4f.','PS-4'),\n(23448,'003027','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 (1) (a)','PS-4 (1)(a)','PS-4 (1)'),\n(23449,'003028','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 (1) (b)','PS-4 (1)(b)','PS-4 (1)'),\n(23450,'003029','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 (2)','PS-4 (2)','PS-4 (2)'),\n(23451,'003030','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 (2)','PS-4 (2)','PS-4 (2)'),\n(23452,'003031','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 c','PS-5c.','PS-5'),\n(23453,'003032','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 d','PS-5d.','PS-5'),\n(23454,'003033','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 d','PS-5d.','PS-5'),\n(23455,'003034','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 d','PS-5d.','PS-5'),\n(23456,'003035','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 a','PS-6a.','PS-6'),\n(23457,'003036','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 c 2','PS-6c.2.','PS-6'),\n(23458,'003037','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 c 2','PS-6c.2.','PS-6'),\n(23459,'003038','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 (3) (a)','PS-6 (3)(a)','PS-6 (3)'),\n(23460,'003039','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 (3) (b)','PS-6 (3)(b)','PS-6 (3)'),\n(23461,'003040','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 b','PS-7b.','PS-7'),\n(23462,'003041','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 d','PS-7d.','PS-7'),\n(23463,'003042','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 d','PS-7d.','PS-7'),\n(23464,'003043','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 d','PS-7d.','PS-7'),\n(23465,'003044','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-8 b','PS-8b.','PS-8'),\n(23466,'003045','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-8 b','PS-8b.','PS-8'),\n(23467,'003046','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PS-8 b','PS-8b.','PS-8'),\n(23468,'002368','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 a 1','RA-1a.1.','RA-1'),\n(23469,'002369','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 a 2','RA-1a.2.','RA-1'),\n(23470,'002370','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 d','RA-3d.','RA-3'),\n(23471,'002371','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 d','RA-3d.','RA-3'),\n(23472,'002372','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (10)','RA-5 (10)','RA-5 (10)'),\n(23473,'002373','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (3)','RA-5 (3)','RA-5 (3)'),\n(23474,'002374','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (4)','RA-5 (4)','RA-5 (4)'),\n(23475,'002375','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (4)','RA-5 (4)','RA-5 (4)'),\n(23476,'002376','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 e','RA-5e.','RA-5'),\n(23477,'002906','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (5)','RA-5 (5)','RA-5 (5)'),\n(23478,'003119','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-6','RA-6','RA-6'),\n(23479,'003120','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-6','RA-6','RA-6'),\n(23480,'003121','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-6','RA-6','RA-6'),\n(23481,'003122','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','RA-6','RA-6','RA-6'),\n(23482,'003089','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 a 1','SA-1a.1.','SA-1'),\n(23483,'003090','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 a 2','SA-1a.2.','SA-1'),\n(23484,'003091','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 a ','SA-2a..','SA-2'),\n(23485,'003092','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 a','SA-3a.','SA-3'),\n(23486,'003093','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 d','SA-3d.','SA-3'),\n(23487,'003094','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 a','SA-4a.','SA-4'),\n(23488,'003095','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 b','SA-4b.','SA-4'),\n(23489,'003096','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 c','SA-4c.','SA-4'),\n(23490,'003097','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 d','SA-4d.','SA-4'),\n(23491,'003098','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 e','SA-4e.','SA-4'),\n(23492,'003099','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 f','SA-4f.','SA-4'),\n(23493,'003100','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 g','SA-4g.','SA-4'),\n(23494,'003101','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (2)','SA-4 (2)','SA-4 (2)'),\n(23495,'003102','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (2)','SA-4 (2)','SA-4 (2)'),\n(23496,'003103','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (2)','SA-4 (2)','SA-4 (2)'),\n(23497,'003104','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (2)','SA-4 (2)','SA-4 (2)'),\n(23498,'003105','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (2)','SA-4 (2)','SA-4 (2)'),\n(23499,'003106','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (2)','SA-4 (2)','SA-4 (2)'),\n(23500,'003107','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (3)','SA-4 (3)','SA-4 (3)'),\n(23501,'003108','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (3)','SA-4 (3)','SA-4 (3)'),\n(23502,'003109','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (5) (a)','SA-4 (5)(a)','SA-4 (5)'),\n(23503,'003110','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (5) (a)','SA-4 (5)(a)','SA-4 (5)'),\n(23504,'003111','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (5) (b)','SA-4 (5)(b)','SA-4 (5)'),\n(23505,'003112','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (8)','SA-4 (8)','SA-4 (8)'),\n(23506,'003113','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (8)','SA-4 (8)','SA-4 (8)'),\n(23507,'003114','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (9)','SA-4 (9)','SA-4 (9)'),\n(23508,'003115','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (9)','SA-4 (9)','SA-4 (9)'),\n(23509,'003116','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (10)','SA-4 (10)','SA-4 (10)'),\n(23510,'003124','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 a 1','SA-5a.1.','SA-5'),\n(23511,'003125','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 a 1','SA-5a.1.','SA-5'),\n(23512,'003126','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 a 1','SA-5a.1.','SA-5'),\n(23513,'003127','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 a 2','SA-5a.2.','SA-5'),\n(23514,'003128','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 a 3','SA-5a.3.','SA-5'),\n(23515,'003129','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 b 1','SA-5b.1.','SA-5'),\n(23516,'003130','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 b 2','SA-5b.2.','SA-5'),\n(23517,'003131','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 b 3','SA-5b.3.','SA-5'),\n(23518,'003132','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 c','SA-5c.','SA-5'),\n(23519,'003133','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 c','SA-5c.','SA-5'),\n(23520,'003134','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 d','SA-5d.','SA-5'),\n(23521,'003135','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 e','SA-5e.','SA-5'),\n(23522,'003136','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 e','SA-5e.','SA-5'),\n(23523,'003137','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 a','SA-9a.','SA-9'),\n(23524,'003138','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 c','SA-9c.','SA-9'),\n(23525,'003139','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 c','SA-9c.','SA-9'),\n(23526,'003140','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9  (1) (a)','SA-9(1)(a)','SA-9'),\n(23527,'003141','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (1) (b)','SA-9 (1)(b)','SA-9 (1)'),\n(23528,'003142','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (1) (b)','SA-9 (1)(b)','SA-9 (1)'),\n(23529,'003143','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (2)','SA-9 (2)','SA-9 (2)'),\n(23530,'003144','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (2)','SA-9 (2)','SA-9 (2)'),\n(23531,'003145','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (3)','SA-9 (3)','SA-9 (3)'),\n(23532,'003146','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (3)','SA-9 (3)','SA-9 (3)'),\n(23533,'003147','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (3)','SA-9 (3)','SA-9 (3)'),\n(23534,'003148','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (3)','SA-9 (3)','SA-9 (3)'),\n(23535,'003149','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (4)','SA-9 (4)','SA-9 (4)'),\n(23536,'003150','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (4)','SA-9 (4)','SA-9 (4)'),\n(23537,'003151','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (4)','SA-9 (4)','SA-9 (4)'),\n(23538,'003152','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (5)','SA-9 (5)','SA-9 (5)'),\n(23539,'003153','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (5)','SA-9 (5)','SA-9 (5)'),\n(23540,'003154','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (5)','SA-9 (5)','SA-9 (5)'),\n(23541,'003155','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 a','SA-10a.','SA-10'),\n(23542,'003156','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 b','SA-10b.','SA-10'),\n(23543,'003157','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 b','SA-10b.','SA-10'),\n(23544,'003158','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 b','SA-10b.','SA-10'),\n(23545,'003159','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 b','SA-10b.','SA-10'),\n(23546,'003160','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 d','SA-10d.','SA-10'),\n(23547,'003161','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 e','SA-10e.','SA-10'),\n(23548,'003162','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 e','SA-10e.','SA-10'),\n(23549,'003163','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 e','SA-10e.','SA-10'),\n(23550,'003164','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 e','SA-10e.','SA-10'),\n(23551,'003165','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (3)','SA-10 (3)','SA-10 (3)'),\n(23552,'003166','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (4)','SA-10 (4)','SA-10 (4)'),\n(23553,'003167','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (4)','SA-10 (4)','SA-10 (4)'),\n(23554,'003168','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (4)','SA-10 (4)','SA-10 (4)'),\n(23555,'003169','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (5)','SA-10 (5)','SA-10 (5)'),\n(23556,'003170','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (6)','SA-10 (6)','SA-10 (6)'),\n(23557,'003171','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 a','SA-11a.','SA-11'),\n(23558,'003172','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 a','SA-11a.','SA-11'),\n(23559,'003173','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 b','SA-11b.','SA-11'),\n(23560,'003174','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 b','SA-11b.','SA-11'),\n(23561,'003175','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 c','SA-11c.','SA-11'),\n(23562,'003176','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 c','SA-11c.','SA-11'),\n(23563,'003177','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 d','SA-11d.','SA-11'),\n(23564,'003178','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 e','SA-11e.','SA-11'),\n(23565,'003179','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (1)','SA-11 (1)','SA-11 (1)'),\n(23566,'003180','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (1)','SA-11 (1)','SA-11 (1)'),\n(23567,'003181','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (2)','SA-11 (2)','SA-11 (2)'),\n(23568,'003182','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (2)','SA-11 (2)','SA-11 (2)'),\n(23569,'003183','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (3) (a)','SA-11 (3)(a)','SA-11 (3)'),\n(23570,'003184','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (3) (a)','SA-11 (3)(a)','SA-11 (3)'),\n(23571,'003185','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (3) (a)','SA-11 (3)(a)','SA-11 (3)'),\n(23572,'003186','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (3) (b)','SA-11 (3)(b)','SA-11 (3)'),\n(23573,'003187','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (4)','SA-11 (4)','SA-11 (4)'),\n(23574,'003188','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (4)','SA-11 (4)','SA-11 (4)'),\n(23575,'003189','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (4)','SA-11 (4)','SA-11 (4)'),\n(23576,'003190','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (5)','SA-11 (5)','SA-11 (5)'),\n(23577,'003191','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (5)','SA-11 (5)','SA-11 (5)'),\n(23578,'003192','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (5)','SA-11 (5)','SA-11 (5)'),\n(23579,'003193','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (6)','SA-11 (6)','SA-11 (6)'),\n(23580,'003194','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (7)','SA-11 (7)','SA-11 (7)'),\n(23581,'003195','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (7)','SA-11 (7)','SA-11 (7)'),\n(23582,'003196','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (8)','SA-11 (8)','SA-11 (8)'),\n(23583,'003197','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (8)','SA-11 (8)','SA-11 (8)'),\n(23584,'003198','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (1)','SA-12 (1)','SA-12 (1)'),\n(23585,'003199','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (1)','SA-12 (1)','SA-12 (1)'),\n(23586,'003200','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (2)','SA-12 (2)','SA-12 (2)'),\n(23587,'003201','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (5)','SA-12 (5)','SA-12 (5)'),\n(23588,'003202','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (5)','SA-12 (5)','SA-12 (5)'),\n(23589,'003203','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (7)','SA-12 (7)','SA-12 (7)'),\n(23590,'003204','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (7)','SA-12 (7)','SA-12 (7)'),\n(23591,'003205','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (8)','SA-12 (8)','SA-12 (8)'),\n(23592,'003206','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (9)','SA-12 (9)','SA-12 (9)'),\n(23593,'003207','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (1)','SA-12 (1)','SA-12 (1)'),\n(23594,'003208','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (1)','SA-12 (1)','SA-12 (1)'),\n(23595,'003209','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (1)','SA-12 (1)','SA-12 (1)'),\n(23596,'003210','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (9)','SA-12 (9)','SA-12 (9)'),\n(23597,'003211','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (9)','SA-12 (9)','SA-12 (9)'),\n(23598,'003212','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (10)','SA-12 (10)','SA-12 (10)'),\n(23599,'003213','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (10)','SA-12 (10)','SA-12 (10)'),\n(23600,'003214','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (11)','SA-12 (11)','SA-12 (11)'),\n(23601,'003215','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (11)','SA-12 (11)','SA-12 (11)'),\n(23602,'003216','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (12)','SA-12 (12)','SA-12 (12)'),\n(23603,'003217','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (12)','SA-12 (12)','SA-12 (12)'),\n(23604,'003218','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (13)','SA-12 (13)','SA-12 (13)'),\n(23605,'003219','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (13)','SA-12 (13)','SA-12 (13)'),\n(23606,'003220','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (13)','SA-12 (13)','SA-12 (13)'),\n(23607,'003221','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (14)','SA-12 (14)','SA-12 (14)'),\n(23608,'003222','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (14)','SA-12 (14)','SA-12 (14)'),\n(23609,'003223','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (14)','SA-12 (14)','SA-12 (14)'),\n(23610,'003224','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-12 (15)','SA-12 (15)','SA-12 (15)'),\n(23611,'003225','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-13 a','SA-13a.','SA-13'),\n(23612,'003226','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-13 a','SA-13a.','SA-13'),\n(23613,'003227','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-13 b','SA-13b.','SA-13'),\n(23614,'003228','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-13 b','SA-13b.','SA-13'),\n(23615,'003229','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-14','SA-14','SA-14'),\n(23616,'003230','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-14','SA-14','SA-14'),\n(23617,'003231','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-14','SA-14','SA-14'),\n(23618,'003232','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-14','SA-14','SA-14'),\n(23619,'003233','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15','SA-15','SA-15'),\n(23620,'003234','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 1','SA-15a.1.','SA-15'),\n(23621,'003235','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 2','SA-15a.2.','SA-15'),\n(23622,'003236','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 2','SA-15a.2.','SA-15'),\n(23623,'003237','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 3','SA-15a.3.','SA-15'),\n(23624,'003238','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 4','SA-15a.4.','SA-15'),\n(23625,'003239','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 4','SA-15a.4.','SA-15'),\n(23626,'003240','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 4','SA-15a.4.','SA-15'),\n(23627,'003241','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b.','SA-15'),\n(23628,'003242','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b.','SA-15'),\n(23629,'003243','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b.','SA-15'),\n(23630,'003244','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b.','SA-15'),\n(23631,'003245','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b.','SA-15'),\n(23632,'003246','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b.','SA-15'),\n(23633,'003247','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (1) (a)','SA-15 (1)(a)','SA-15 (1)'),\n(23634,'003248','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (1) (b)','SA-15 (1)(b)','SA-15 (1)'),\n(23635,'003249','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (1) (b)','SA-15 (1)(b)','SA-15 (1)'),\n(23636,'003250','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (1) (b)','SA-15 (1)(b)','SA-15 (1)'),\n(23637,'003251','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (2)','SA-15 (2)','SA-15 (2)'),\n(23638,'003252','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (2)','SA-15 (2)','SA-15 (2)'),\n(23639,'003253','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (3)','SA-15 (3)','SA-15 (3)'),\n(23640,'003254','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (3)','SA-15 (3)','SA-15 (3)'),\n(23641,'003255','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (3)','SA-15 (3)','SA-15 (3)'),\n(23642,'003256','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4)','SA-15 (4)','SA-15 (4)'),\n(23643,'003257','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4)','SA-15 (4)','SA-15 (4)'),\n(23644,'003258','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4)','SA-15 (4)','SA-15 (4)'),\n(23645,'003259','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4)','SA-15 (4)','SA-15 (4)'),\n(23646,'003260','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4) (a)','SA-15 (4)(a)','SA-15 (4)'),\n(23647,'003261','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4) (a)','SA-15 (4)(a)','SA-15 (4)'),\n(23648,'003262','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4) (a)','SA-15 (4)(a)','SA-15 (4)'),\n(23649,'003263','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4) (a)','SA-15 (4)(a)','SA-15 (4)'),\n(23650,'003264','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4) (b)','SA-15 (4)(b)','SA-15 (4)'),\n(23651,'003265','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4) (b)','SA-15 (4)(b)','SA-15 (4)'),\n(23652,'003266','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4) (b)','SA-15 (4)(b)','SA-15 (4)'),\n(23653,'003267','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4) (b)','SA-15 (4)(b)','SA-15 (4)'),\n(23654,'003268','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4) (c)','SA-15 (4)(c)','SA-15 (4)'),\n(23655,'003269','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4) (c)','SA-15 (4)(c)','SA-15 (4)'),\n(23656,'003270','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4) (c)','SA-15 (4)(c)','SA-15 (4)'),\n(23657,'003271','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (4) (c)','SA-15 (4)(c)','SA-15 (4)'),\n(23658,'003272','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (5)','SA-15 (5)','SA-15 (5)'),\n(23659,'003273','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (5)','SA-15 (5)','SA-15 (5)'),\n(23660,'003274','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (6)','SA-15 (6)','SA-15 (6)'),\n(23661,'003275','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (a)','SA-15 (7)(a)','SA-15 (7)'),\n(23662,'003276','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (a)','SA-15 (7)(a)','SA-15 (7)'),\n(23663,'003277','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (b)','SA-15 (7)(b)','SA-15 (7)'),\n(23664,'003278','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (c)','SA-15 (7)(c)','SA-15 (7)'),\n(23665,'003279','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (d)','SA-15 (7)(d)','SA-15 (7)'),\n(23666,'003280','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (d)','SA-15 (7)(d)','SA-15 (7)'),\n(23667,'003281','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (8)','SA-15 (8)','SA-15 (8)'),\n(23668,'003282','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (8)','SA-15 (8)','SA-15 (8)'),\n(23669,'003283','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (9)','SA-15 (9)','SA-15 (9)'),\n(23670,'003284','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (9)','SA-15 (9)','SA-15 (9)'),\n(23671,'003285','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (9)','SA-15 (9)','SA-15 (9)'),\n(23672,'003286','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (9)','SA-15 (9)','SA-15 (9)'),\n(23673,'003287','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (9)','SA-15 (9)','SA-15 (9)'),\n(23674,'003288','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (9)','SA-15 (9)','SA-15 (9)'),\n(23675,'003289','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (10)','SA-15 (10)','SA-15 (10)'),\n(23676,'003290','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (11)','SA-15 (11)','SA-15 (11)'),\n(23677,'003291','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-16','SA-16','SA-16'),\n(23678,'003292','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-16','SA-16','SA-16'),\n(23679,'003293','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17','SA-17','SA-17'),\n(23680,'003294','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 a','SA-17a.','SA-17'),\n(23681,'003295','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 b','SA-17b.','SA-17'),\n(23682,'003296','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 b','SA-17b.','SA-17'),\n(23683,'003297','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 c','SA-17c.','SA-17'),\n(23684,'003298','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (1) (a)','SA-17 (1)(a)','SA-17 (1)'),\n(23685,'003299','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (1) (a)','SA-17 (1)(a)','SA-17 (1)'),\n(23686,'003300','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (1) (b)','SA-17 (1)(b)','SA-17 (1)'),\n(23687,'003301','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (2) (a)','SA-17 (2)(a)','SA-17 (2)'),\n(23688,'003302','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (2) (a)','SA-17 (2)(a)','SA-17 (2)'),\n(23689,'003303','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (2) (a)','SA-17 (2)(a)','SA-17 (2)'),\n(23690,'003304','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (2) (a)','SA-17 (2)(a)','SA-17 (2)'),\n(23691,'003305','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (2) (a)','SA-17 (2)(a)','SA-17 (2)'),\n(23692,'003306','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (2) (b)','SA-17 (2)(b)','SA-17 (2)'),\n(23693,'003307','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (2) (b)','SA-17 (2)(b)','SA-17 (2)'),\n(23694,'003308','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (a)','SA-17 (3)(a)','SA-17 (3)'),\n(23695,'003309','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (a)','SA-17 (3)(a)','SA-17 (3)'),\n(23696,'003310','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (a)','SA-17 (3)(a)','SA-17 (3)'),\n(23697,'003311','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (b)','SA-17 (3)(b)','SA-17 (3)'),\n(23698,'003312','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (c)','SA-17 (3)(c)','SA-17 (3)'),\n(23699,'003313','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (c)','SA-17 (3)(c)','SA-17 (3)'),\n(23700,'003314','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (c)','SA-17 (3)(c)','SA-17 (3)'),\n(23701,'003315','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (d)','SA-17 (3)(d)','SA-17 (3)'),\n(23702,'003316','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (d)','SA-17 (3)(d)','SA-17 (3)'),\n(23703,'003317','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (d)','SA-17 (3)(d)','SA-17 (3)'),\n(23704,'003318','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (e)','SA-17 (3)(e)','SA-17 (3)'),\n(23705,'003319','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (e)','SA-17 (3)(e)','SA-17 (3)'),\n(23706,'003320','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (e)','SA-17 (3)(e)','SA-17 (3)'),\n(23707,'003321','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (a)','SA-17 (4)(a)','SA-17 (4)'),\n(23708,'003322','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (a)','SA-17 (4)(a)','SA-17 (4)'),\n(23709,'003323','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (a)','SA-17 (4)(a)','SA-17 (4)'),\n(23710,'003324','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (b)','SA-17 (4)(b)','SA-17 (4)'),\n(23711,'003325','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (c)','SA-17 (4)(c)','SA-17 (4)'),\n(23712,'003326','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (c)','SA-17 (4)(c)','SA-17 (4)'),\n(23713,'003327','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (c)','SA-17 (4)(c)','SA-17 (4)'),\n(23714,'003328','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (d)','SA-17 (4)(d)','SA-17 (4)'),\n(23715,'003329','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (d)','SA-17 (4)(d)','SA-17 (4)'),\n(23716,'003330','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (d)','SA-17 (4)(d)','SA-17 (4)'),\n(23717,'003331','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (e)','SA-17 (4)(e)','SA-17 (4)'),\n(23718,'003332','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (e)','SA-17 (4)(e)','SA-17 (4)'),\n(23719,'003333','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (e)','SA-17 (4)(e)','SA-17 (4)'),\n(23720,'003334','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (5) (a)','SA-17 (5)(a)','SA-17 (5)'),\n(23721,'003335','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (5) (a)','SA-17 (5)(a)','SA-17 (5)'),\n(23722,'003336','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (5) (a)','SA-17 (5)(a)','SA-17 (5)'),\n(23723,'003337','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (5) (b)','SA-17 (5)(b)','SA-17 (5)'),\n(23724,'003338','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (5) (b)','SA-17 (5)(b)','SA-17 (5)'),\n(23725,'003339','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (5) (b)','SA-17 (5)(b)','SA-17 (5)'),\n(23726,'003340','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (6)','SA-17 (6)','SA-17 (6)'),\n(23727,'003341','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (6)','SA-17 (6)','SA-17 (6)'),\n(23728,'003342','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (6)','SA-17 (6)','SA-17 (6)'),\n(23729,'003343','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (7)','SA-17 (7)','SA-17 (7)'),\n(23730,'003344','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (7)','SA-17 (7)','SA-17 (7)'),\n(23731,'003345','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (7)','SA-17 (7)','SA-17 (7)'),\n(23732,'003346','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-18','SA-18','SA-18'),\n(23733,'003347','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-18 (1)','SA-18 (1)','SA-18 (1)'),\n(23734,'003348','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-18 (1)','SA-18 (1)','SA-18 (1)'),\n(23735,'003349','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-18 (1)','SA-18 (1)','SA-18 (1)'),\n(23736,'003350','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-18 (1)','SA-18 (1)','SA-18 (1)'),\n(23737,'003351','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-18 (1)','SA-18 (1)','SA-18 (1)'),\n(23738,'003352','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-18 (2)','SA-18 (2)','SA-18 (2)'),\n(23739,'003353','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-18 (2)','SA-18 (2)','SA-18 (2)'),\n(23740,'003354','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-18 (2)','SA-18 (2)','SA-18 (2)'),\n(23741,'003355','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-18 (2)','SA-18 (2)','SA-18 (2)'),\n(23742,'003356','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 a','SA-19a.','SA-19'),\n(23743,'003357','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 a','SA-19a.','SA-19'),\n(23744,'003358','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 a','SA-19a.','SA-19'),\n(23745,'003359','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 a','SA-19a.','SA-19'),\n(23746,'003360','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 a','SA-19a.','SA-19'),\n(23747,'003361','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 a','SA-19a.','SA-19'),\n(23748,'003362','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 a','SA-19a.','SA-19'),\n(23749,'003363','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 a','SA-19a.','SA-19'),\n(23750,'003364','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 b','SA-19b.','SA-19'),\n(23751,'003365','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 b','SA-19b.','SA-19'),\n(23752,'003366','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 b','SA-19b.','SA-19'),\n(23753,'003367','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 (1)','SA-19 (1)','SA-19 (1)'),\n(23754,'003368','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 (1)','SA-19 (1)','SA-19 (1)'),\n(23755,'003369','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 (2)','SA-19 (2)','SA-19 (2)'),\n(23756,'003370','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 (2)','SA-19 (2)','SA-19 (2)'),\n(23757,'003371','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 (2)','SA-19 (2)','SA-19 (2)'),\n(23758,'003388','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 (4)','SA-19 (4)','SA-19 (4)'),\n(23759,'003389','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 (4)','SA-19 (4)','SA-19 (4)'),\n(23760,'003390','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 (3)','SA-19 (3)','SA-19 (3)'),\n(23761,'003391','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-19 (3)','SA-19 (3)','SA-19 (3)'),\n(23762,'003386','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-20','SA-20','SA-20'),\n(23763,'003387','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-20','SA-20','SA-20'),\n(23764,'003377','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-21 (1)','SA-21 (1)','SA-21 (1)'),\n(23765,'003378','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-21 (1)','SA-21 (1)','SA-21 (1)'),\n(23766,'003379','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-21 (1)','SA-21 (1)','SA-21 (1)'),\n(23767,'003380','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-21 (1)','SA-21 (1)','SA-21 (1)'),\n(23768,'003381','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-21 b','SA-21b.','SA-21'),\n(23769,'003382','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-21 b','SA-21b.','SA-21'),\n(23770,'003383','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-21 a','SA-21a.','SA-21'),\n(23771,'003384','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-21  ','SA-21','SA-21'),\n(23772,'003385','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-21 a','SA-21a.','SA-21'),\n(23773,'002377','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 1','SC-1a.1.','SC-1'),\n(23774,'002378','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 1','SC-1a.1.','SC-1'),\n(23775,'002379','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 2','SC-1a.2.','SC-1'),\n(23776,'002380','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 2','SC-1a.2.','SC-1'),\n(23777,'002381','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-3 (3)','SC-3 (3)','SC-3 (3)'),\n(23778,'002382','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-3 (4)','SC-3 (4)','SC-3 (4)'),\n(23779,'002383','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-4 (2)','SC-4 (2)','SC-4 (2)'),\n(23780,'002384','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-4 (2)','SC-4 (2)','SC-4 (2)'),\n(23781,'002385','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-5','SC-5','SC-5'),\n(23782,'002386','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-5','SC-5','SC-5'),\n(23783,'002387','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 (1)','SC-5 (1)','SC-5 (1)'),\n(23784,'002388','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 (3) (a)','SC-5 (3)(a)','SC-5 (3)'),\n(23785,'002389','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 (3) (a)','SC-5 (3)(a)','SC-5 (3)'),\n(23786,'002390','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 (3) (b)','SC-5 (3)(b)','SC-5 (3)'),\n(23787,'002391','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 (3) (b)','SC-5 (3)(b)','SC-5 (3)'),\n(23788,'002392','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-6','SC-6','SC-6'),\n(23789,'002393','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-6','SC-6','SC-6'),\n(23790,'002394','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-6','SC-6','SC-6'),\n(23791,'002395','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 b','SC-7b.','SC-7'),\n(23792,'002396','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (c)','SC-7 (4)(c)','SC-7 (4)'),\n(23793,'002397','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (7)','SC-7 (7)','SC-7 (7)'),\n(23794,'002398','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (9) (a)','SC-7 (9)(a)','SC-7 (9)'),\n(23795,'002399','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (9) (a)','SC-7 (9)(a)','SC-7 (9)'),\n(23796,'002400','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (9) (b)','SC-7 (9)(b)','SC-7 (9)'),\n(23797,'002401','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (11)','SC-7 (11)','SC-7 (11)'),\n(23798,'002402','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (11)','SC-7 (11)','SC-7 (11)'),\n(23799,'002403','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (11)','SC-7 (11)','SC-7 (11)'),\n(23800,'002404','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (12)','SC-7 (12)','SC-7 (12)'),\n(23801,'002405','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (12)','SC-7 (12)','SC-7 (12)'),\n(23802,'002406','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (12)','SC-7 (12)','SC-7 (12)'),\n(23803,'002407','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (14)','SC-7 (14)','SC-7 (14)'),\n(23804,'002408','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (19)','SC-7 (19)','SC-7 (19)'),\n(23805,'002409','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (19)','SC-7 (19)','SC-7 (19)'),\n(23806,'002410','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (20)','SC-7 (20)','SC-7 (20)'),\n(23807,'002411','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (20)','SC-7 (20)','SC-7 (20)'),\n(23808,'002412','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (21)','SC-7 (21)','SC-7 (21)'),\n(23809,'002413','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (21)','SC-7 (21)','SC-7 (21)'),\n(23810,'002414','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (21)','SC-7 (21)','SC-7 (21)'),\n(23811,'002415','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (21)','SC-7 (21)','SC-7 (21)'),\n(23812,'002416','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (22)','SC-7 (22)','SC-7 (22)'),\n(23813,'002417','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (23)','SC-7 (23)','SC-7 (23)'),\n(23814,'002418','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-8','SC-8','SC-8'),\n(23815,'002419','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (1)','SC-8 (1)','SC-8 (1)'),\n(23816,'002420','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (2)','SC-8 (2)','SC-8 (2)'),\n(23817,'002421','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (1)','SC-8 (1)','SC-8 (1)'),\n(23818,'002422','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (2)','SC-8 (2)','SC-8 (2)'),\n(23819,'002423','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (3)','SC-8 (3)','SC-8 (3)'),\n(23820,'002424','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (4)','SC-8 (4)','SC-8 (4)'),\n(23821,'002425','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (4)','SC-8 (4)','SC-8 (4)'),\n(23822,'002427','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (3)','SC-8 (3)','SC-8 (3)'),\n(23823,'002426','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-11 (1)','SC-11 (1)','SC-11 (1)'),\n(23824,'002428','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23825,'002429','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23826,'002430','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23827,'002431','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23828,'002432','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23829,'002433','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23830,'002434','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23831,'002435','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23832,'002436','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23833,'002437','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23834,'002438','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23835,'002439','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23836,'002440','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23837,'002441','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23838,'002442','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n(23839,'002443','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (2)','SC-12 (2)','SC-12 (2)'),\n(23840,'002444','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (2)','SC-12 (2)','SC-12 (2)'),\n(23841,'002445','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (2)','SC-12 (2)','SC-12 (2)'),\n(23842,'002446','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (3)','SC-12 (3)','SC-12 (3)'),\n(23843,'002447','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (3)','SC-12 (3)','SC-12 (3)'),\n(23844,'002448','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (3)','SC-12 (3)','SC-12 (3)'),\n(23845,'002449','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-13','SC-13','SC-13'),\n(23846,'002450','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-13','SC-13','SC-13'),\n(23847,'002451','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 (3)','SC-15 (3)','SC-15 (3)'),\n(23848,'002452','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 (4)','SC-15 (4)','SC-15 (4)'),\n(23849,'002453','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 (4)','SC-15 (4)','SC-15 (4)'),\n(23850,'002454','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-16','SC-16','SC-16'),\n(23851,'002455','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-16','SC-16','SC-16'),\n(23852,'002456','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-17','SC-17','SC-17'),\n(23853,'002457','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (1)','SC-18 (1)','SC-18 (1)'),\n(23854,'002458','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (1)','SC-18 (1)','SC-18 (1)'),\n(23855,'002459','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (3)','SC-18 (3)','SC-18 (3)'),\n(23856,'002460','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (4)','SC-18 (4)','SC-18 (4)'),\n(23857,'002461','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (5)','SC-18 (5)','SC-18 (5)'),\n(23858,'002462','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-20 a','SC-20a.','SC-20'),\n(23859,'002463','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-20 (2)','SC-20 (2)','SC-20 (2)'),\n(23860,'002464','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-20 (2)','SC-20 (2)','SC-20 (2)'),\n(23861,'002465','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-21','SC-21','SC-21'),\n(23862,'002466','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-21','SC-21','SC-21'),\n(23863,'002467','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-21','SC-21','SC-21'),\n(23864,'002468','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-21','SC-21','SC-21'),\n(23865,'002469','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-23 (5)','SC-23 (5)','SC-23 (5)'),\n(23866,'002470','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-23 (5)','SC-23 (5)','SC-23 (5)'),\n(23867,'002471','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-25','SC-25','SC-25'),\n(23868,'002472','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-28','SC-28','SC-28'),\n(23869,'002473','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (1)','SC-28 (1)','SC-28 (1)'),\n(23870,'002474','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (1)','SC-28 (1)','SC-28 (1)'),\n(23871,'002475','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (1)','SC-28 (1)','SC-28 (1)'),\n(23872,'002476','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (1)','SC-28 (1)','SC-28 (1)'),\n(23873,'002477','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (2)','SC-28 (2)','SC-28 (2)'),\n(23874,'002478','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (2)','SC-28 (2)','SC-28 (2)'),\n(23875,'002479','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (2)','SC-28 (2)','SC-28 (2)'),\n(23876,'002480','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-29','SC-29','SC-29'),\n(23877,'002481','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-29 (1)','SC-29 (1)','SC-29 (1)'),\n(23878,'002482','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30','SC-30','SC-30'),\n(23879,'002483','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30','SC-30','SC-30'),\n(23880,'002484','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30','SC-30','SC-30'),\n(23881,'002485','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30','SC-30','SC-30'),\n(23882,'002486','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (2)','SC-30 (2)','SC-30 (2)'),\n(23883,'002487','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (2)','SC-30 (2)','SC-30 (2)'),\n(23884,'002488','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (2)','SC-30 (2)','SC-30 (2)'),\n(23885,'002489','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (3)','SC-30 (3)','SC-30 (3)'),\n(23886,'002490','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (3)','SC-30 (3)','SC-30 (3)'),\n(23887,'002491','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (3)','SC-30 (3)','SC-30 (3)'),\n(23888,'002492','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (3)','SC-30 (3)','SC-30 (3)'),\n(23889,'002493','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (4)','SC-30 (4)','SC-30 (4)'),\n(23890,'002494','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (4)','SC-30 (4)','SC-30 (4)'),\n(23891,'002495','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (5)','SC-30 (5)','SC-30 (5)'),\n(23892,'002496','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (5)','SC-30 (5)','SC-30 (5)'),\n(23893,'002497','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (5)','SC-30 (5)','SC-30 (5)'),\n(23894,'002498','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-31 a','SC-31a.','SC-31'),\n(23895,'002499','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-31 b','SC-31b.','SC-31'),\n(23896,'002500','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-31 (2)','SC-31 (2)','SC-31 (2)'),\n(23897,'002501','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-31 (2)','SC-31 (2)','SC-31 (2)'),\n(23898,'002502','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-31 (3)','SC-31 (3)','SC-31 (3)'),\n(23899,'002503','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-31 (3)','SC-31 (3)','SC-31 (3)'),\n(23900,'002504','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-32','SC-32','SC-32'),\n(23901,'002505','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-32','SC-32','SC-32'),\n(23902,'002506','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-32','SC-32','SC-32'),\n(23903,'002507','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 (2)','SC-34 (2)','SC-34 (2)'),\n(23904,'002508','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 (3) (a)','SC-34 (3)(a)','SC-34 (3)'),\n(23905,'002509','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 (3) (a)','SC-34 (3)(a)','SC-34 (3)'),\n(23906,'002510','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 (3) (b)','SC-34 (3)(b)','SC-34 (3)'),\n(23907,'002511','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 (3) (b)','SC-34 (3)(b)','SC-34 (3)'),\n(23908,'002512','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 (3) (b)','SC-34 (3)(b)','SC-34 (3)'),\n(23909,'002513','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-36','SC-36','SC-36'),\n(23910,'002514','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-36','SC-36','SC-36'),\n(23911,'002515','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-36','SC-36','SC-36'),\n(23912,'002516','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-36','SC-36','SC-36'),\n(23913,'002517','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-36 (1)','SC-36 (1)','SC-36 (1)'),\n(23914,'002518','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-36 (1)','SC-36 (1)','SC-36 (1)'),\n(23915,'002519','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-36 (1)','SC-36 (1)','SC-36 (1)'),\n(23916,'002520','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-36 (1)','SC-36 (1)','SC-36 (1)'),\n(23917,'002521','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-37','SC-37','SC-37'),\n(23918,'002522','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-37','SC-37','SC-37'),\n(23919,'002523','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-37','SC-37','SC-37'),\n(23920,'002524','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-37','SC-37','SC-37'),\n(23921,'002525','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-37 (1)','SC-37 (1)','SC-37 (1)'),\n(23922,'002526','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-37 (1)','SC-37 (1)','SC-37 (1)'),\n(23923,'002527','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-37 (1)','SC-37 (1)','SC-37 (1)'),\n(23924,'003599','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-37 (1)','SC-37 (1)','SC-37 (1)'),\n(23925,'002528','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-38','SC-38','SC-38'),\n(23926,'002529','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-38','SC-38','SC-38'),\n(23927,'002530','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-39','SC-39','SC-39'),\n(23928,'002531','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-39 (1)','SC-39 (1)','SC-39 (1)'),\n(23929,'002532','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-39 (2)','SC-39 (2)','SC-39 (2)'),\n(23930,'002533','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-39 (2)','SC-39 (2)','SC-39 (2)'),\n(23931,'002534','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-40','SC-40','SC-40'),\n(23932,'002535','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-40','SC-40','SC-40'),\n(23933,'002536','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-40','SC-40','SC-40'),\n(23934,'002537','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-40 (1)','SC-40 (1)','SC-40 (1)'),\n(23935,'002538','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-40 (1)','SC-40 (1)','SC-40 (1)'),\n(23936,'002539','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-40 (2)','SC-40 (2)','SC-40 (2)'),\n(23937,'002540','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-40 (2)','SC-40 (2)','SC-40 (2)'),\n(23938,'002541','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-40 (3)','SC-40 (3)','SC-40 (3)'),\n(23939,'002542','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-40 (4)','SC-40 (4)','SC-40 (4)'),\n(23940,'002543','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-40 (4)','SC-40 (4)','SC-40 (4)'),\n(23941,'002544','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-41','SC-41','SC-41'),\n(23942,'002545','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-41','SC-41','SC-41'),\n(23943,'002546','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-41','SC-41','SC-41'),\n(23944,'002547','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 a','SC-42a.','SC-42'),\n(23945,'002548','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 a','SC-42a.','SC-42'),\n(23946,'002549','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 b','SC-42b.','SC-42'),\n(23947,'002550','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 b','SC-42b.','SC-42'),\n(23948,'002551','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (1)','SC-42 (1)','SC-42 (1)'),\n(23949,'002552','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (1)','SC-42 (1)','SC-42 (1)'),\n(23950,'002553','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (2)','SC-42 (2)','SC-42 (2)'),\n(23951,'002554','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (2)','SC-42 (2)','SC-42 (2)'),\n(23952,'002555','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (2)','SC-42 (2)','SC-42 (2)'),\n(23953,'002556','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (3)','SC-42 (3)','SC-42 (3)'),\n(23954,'002557','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (3)','SC-42 (3)','SC-42 (3)'),\n(23955,'002558','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (3)','SC-42 (3)','SC-42 (3)'),\n(23956,'002559','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-43 a','SC-43a.','SC-43'),\n(23957,'002560','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-43 a','SC-43a.','SC-43'),\n(23958,'002561','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-43 b','SC-43b.','SC-43'),\n(23959,'002562','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-43 b','SC-43b.','SC-43'),\n(23960,'002563','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-43 b','SC-43b.','SC-43'),\n(23961,'002564','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-44','SC-44','SC-44'),\n(23962,'002565','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SC-44','SC-44','SC-44'),\n(23963,'002601','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 a','SI-1a.','SI-1'),\n(23964,'002602','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 b','SI-2b.','SI-2'),\n(23965,'002603','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 b','SI-2b.','SI-2'),\n(23966,'002604','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 c','SI-2c.','SI-2'),\n(23967,'002605','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 c','SI-2c.','SI-2'),\n(23968,'002606','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 c','SI-2c.','SI-2'),\n(23969,'002607','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 c','SI-2c.','SI-2'),\n(23970,'002608','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (3) (b)','SI-2 (3)(b)','SI-2 (3)'),\n(23971,'002609','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (5)','SI-2 (5)','SI-2 (5)'),\n(23972,'002610','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (5)','SI-2 (5)','SI-2 (5)'),\n(23973,'002611','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (5)','SI-2 (5)','SI-2 (5)'),\n(23974,'002612','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (5)','SI-2 (5)','SI-2 (5)'),\n(23975,'002613','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (5)','SI-2 (5)','SI-2 (5)'),\n(23976,'002614','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (5)','SI-2 (5)','SI-2 (5)'),\n(23977,'002615','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (6)','SI-2 (6)','SI-2 (6)'),\n(23978,'002616','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (6)','SI-2 (6)','SI-2 (6)'),\n(23979,'002617','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (6)','SI-2 (6)','SI-2 (6)'),\n(23980,'002618','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (6)','SI-2 (6)','SI-2 (6)'),\n(23981,'002619','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 a','SI-3a.','SI-3'),\n(23982,'002620','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 a','SI-3a.','SI-3'),\n(23983,'002621','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 a','SI-3a.','SI-3'),\n(23984,'002622','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 a','SI-3a.','SI-3'),\n(23985,'002623','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 c 1','SI-3c.1.','SI-3'),\n(23986,'002624','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 c 1','SI-3c.1.','SI-3'),\n(23987,'002625','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (6) (b)','SI-3 (6)(b)','SI-3 (6)'),\n(23988,'002626','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (6) (b)','SI-3 (6)(b)','SI-3 (6)'),\n(23989,'002627','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (7)','SI-3 (7)','SI-3 (7)'),\n(23990,'002628','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (8)','SI-3 (8)','SI-3 (8)'),\n(23991,'002629','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (8)','SI-3 (8)','SI-3 (8)'),\n(23992,'002630','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (8)','SI-3 (8)','SI-3 (8)'),\n(23993,'002631','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (8)','SI-3 (8)','SI-3 (8)'),\n(23994,'002632','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (9)','SI-3 (9)','SI-3 (9)'),\n(23995,'002633','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (9)','SI-3 (9)','SI-3 (9)'),\n(23996,'002634','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (10) (a)','SI-3 (10)(a)','SI-3 (10)'),\n(23997,'002635','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (10) (a)','SI-3 (10)(a)','SI-3 (10)'),\n(23998,'002636','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (10) (a)','SI-3 (10)(a)','SI-3 (10)'),\n(23999,'002637','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (9)','SI-3 (9)','SI-3 (9)'),\n(24000,'002638','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (10) (a)','SI-3 (10)(a)','SI-3 (10)'),\n(24001,'002639','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (10) (b)','SI-3 (10)(b)','SI-3 (10)'),\n(24002,'002640','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (10) (b)','SI-3 (10)(b)','SI-3 (10)'),\n(24003,'002641','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 a 1','SI-4a.1.','SI-4'),\n(24004,'002642','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 a 2','SI-4a.2.','SI-4'),\n(24005,'002643','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 a 2','SI-4a.2.','SI-4'),\n(24006,'002644','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 a 2','SI-4a.2.','SI-4'),\n(24007,'002645','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 b','SI-4b.','SI-4'),\n(24008,'002646','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 b','SI-4b.','SI-4'),\n(24009,'002647','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 d','SI-4d.','SI-4'),\n(24010,'002648','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 d','SI-4d.','SI-4'),\n(24011,'002649','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 d','SI-4d.','SI-4'),\n(24012,'002650','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 g','SI-4g.','SI-4'),\n(24013,'002651','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 g','SI-4g.','SI-4'),\n(24014,'002652','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 g','SI-4g.','SI-4'),\n(24015,'002653','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4','SI-4','SI-4'),\n(24016,'002654','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 g','SI-4g.','SI-4'),\n(24017,'002655','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (1)','SI-4 (1)','SI-4 (1)'),\n(24018,'002656','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (1)','SI-4 (1)','SI-4 (1)'),\n(24019,'002657','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (3)','SI-4 (3)','SI-4 (3)'),\n(24020,'002658','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (3)','SI-4 (3)','SI-4 (3)'),\n(24021,'002659','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (4)','SI-4 (4)','SI-4 (4)'),\n(24022,'002660','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (4)','SI-4 (4)','SI-4 (4)'),\n(24023,'002661','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (4)','SI-4 (4)','SI-4 (4)'),\n(24024,'002662','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (4)','SI-4 (4)','SI-4 (4)'),\n(24025,'002663','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (5)','SI-4 (5)','SI-4 (5)'),\n(24026,'002664','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (5)','SI-4 (5)','SI-4 (5)'),\n(24027,'002665','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (10)','SI-4 (10)','SI-4 (10)'),\n(24028,'002666','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (10)','SI-4 (10)','SI-4 (10)'),\n(24029,'002667','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (10)','SI-4 (10)','SI-4 (10)'),\n(24030,'002668','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (11)','SI-4 (11)','SI-4 (11)'),\n(24031,'002669','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (13) (c)','SI-4 (13)(c)','SI-4 (13)'),\n(24032,'002670','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (18)','SI-4 (18)','SI-4 (18)'),\n(24033,'002671','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (18)','SI-4 (18)','SI-4 (18)'),\n(24034,'002672','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (18)','SI-4 (18)','SI-4 (18)'),\n(24035,'002673','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (19)','SI-4 (19)','SI-4 (19)'),\n(24036,'002674','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (19)','SI-4 (19)','SI-4 (19)'),\n(24037,'002675','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (19)','SI-4 (19)','SI-4 (19)'),\n(24038,'002676','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (20)','SI-4 (20)','SI-4 (20)'),\n(24039,'002677','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (20)','SI-4 (20)','SI-4 (20)'),\n(24040,'002678','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (21)','SI-4 (21)','SI-4 (21)'),\n(24041,'002679','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (21)','SI-4 (21)','SI-4 (21)'),\n(24042,'002680','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (21)','SI-4 (21)','SI-4 (21)'),\n(24043,'002681','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (22)','SI-4 (22)','SI-4 (22)'),\n(24044,'002682','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (22)','SI-4 (22)','SI-4 (22)'),\n(24045,'002683','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (22)','SI-4 (22)','SI-4 (22)'),\n(24046,'002684','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (22)','SI-4 (22)','SI-4 (22)'),\n(24047,'002685','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (23)','SI-4 (23)','SI-4 (23)'),\n(24048,'002686','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (23)','SI-4 (23)','SI-4 (23)'),\n(24049,'002687','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (23)','SI-4 (23)','SI-4 (23)'),\n(24050,'002688','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (24)','SI-4 (24)','SI-4 (24)'),\n(24051,'002689','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (24)','SI-4 (24)','SI-4 (24)'),\n(24052,'002690','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (24)','SI-4 (24)','SI-4 (24)'),\n(24053,'002691','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (24)','SI-4 (24)','SI-4 (24)'),\n(24054,'002692','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 a','SI-5a.','SI-5'),\n(24055,'002693','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 c','SI-5c.','SI-5'),\n(24056,'002694','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 c','SI-5c.','SI-5'),\n(24057,'002695','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 a','SI-6a.','SI-6'),\n(24058,'002696','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 a','SI-6a.','SI-6'),\n(24059,'002697','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 b','SI-6b.','SI-6'),\n(24060,'002698','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 b','SI-6b.','SI-6'),\n(24061,'002699','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 b','SI-6b.','SI-6'),\n(24062,'002700','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 c','SI-6c.','SI-6'),\n(24063,'002701','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 d','SI-6d.','SI-6'),\n(24064,'002702','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 d','SI-6d.','SI-6'),\n(24065,'002703','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7','SI-7','SI-7'),\n(24066,'002704','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7','SI-7','SI-7'),\n(24067,'002705','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7 (1)','SI-7 (1)'),\n(24068,'002706','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7 (1)','SI-7 (1)'),\n(24069,'002707','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7 (1)','SI-7 (1)'),\n(24070,'002708','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7 (1)','SI-7 (1)'),\n(24071,'002709','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7 (1)','SI-7 (1)'),\n(24072,'002710','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7 (1)','SI-7 (1)'),\n(24073,'002711','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7 (1)','SI-7 (1)'),\n(24074,'002712','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7 (1)','SI-7 (1)'),\n(24075,'002713','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (2)','SI-7 (2)','SI-7 (2)'),\n(24076,'002714','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (5)','SI-7 (5)','SI-7 (5)'),\n(24077,'002715','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (5)','SI-7 (5)','SI-7 (5)'),\n(24078,'002716','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (6)','SI-7 (6)','SI-7 (6)'),\n(24079,'002717','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (6)','SI-7 (6)','SI-7 (6)'),\n(24080,'002718','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (6)','SI-7 (6)','SI-7 (6)'),\n(24081,'002719','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (7)','SI-7 (7)','SI-7 (7)'),\n(24082,'002720','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (7)','SI-7 (7)','SI-7 (7)'),\n(24083,'002721','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (8)','SI-7 (8)','SI-7 (8)'),\n(24084,'002722','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (8)','SI-7 (8)','SI-7 (8)'),\n(24085,'002723','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (8)','SI-7 (8)','SI-7 (8)'),\n(24086,'002724','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (8)','SI-7 (8)','SI-7 (8)'),\n(24087,'002725','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (9)','SI-7 (9)','SI-7 (9)'),\n(24088,'002726','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (9)','SI-7 (9)','SI-7 (9)'),\n(24089,'002727','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (10)','SI-7 (10)','SI-7 (10)'),\n(24090,'002728','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (10)','SI-7 (10)','SI-7 (10)'),\n(24091,'002729','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (10)','SI-7 (10)','SI-7 (10)'),\n(24092,'002730','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (11)','SI-7 (11)','SI-7 (11)'),\n(24093,'002731','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (11)','SI-7 (11)','SI-7 (11)'),\n(24094,'002732','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (12)','SI-7 (12)','SI-7 (12)'),\n(24095,'002733','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (12)','SI-7 (12)','SI-7 (12)'),\n(24096,'002734','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (13)','SI-7 (13)','SI-7 (13)'),\n(24097,'002735','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (13)','SI-7 (13)','SI-7 (13)'),\n(24098,'002736','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (13)','SI-7 (13)','SI-7 (13)'),\n(24099,'002737','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (14) (a)','SI-7 (14)(a)','SI-7 (14)'),\n(24100,'002738','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (14) (b)','SI-7 (14)(b)','SI-7 (14)'),\n(24101,'002739','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (15)','SI-7 (15)','SI-7 (15)'),\n(24102,'002740','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (15)','SI-7 (15)','SI-7 (15)'),\n(24103,'002741','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-8 a','SI-8a.','SI-8'),\n(24104,'002742','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-8 a','SI-8a.','SI-8'),\n(24105,'002743','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-8 (3)','SI-8 (3)','SI-8 (3)'),\n(24106,'002744','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10','SI-10','SI-10'),\n(24107,'002745','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (1) (a)','SI-10 (1)(a)','SI-10 (1)'),\n(24108,'002746','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (1) (a)','SI-10 (1)(a)','SI-10 (1)'),\n(24109,'002747','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (1) (b)','SI-10 (1)(b)','SI-10 (1)'),\n(24110,'002748','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (1) (b)','SI-10 (1)(b)','SI-10 (1)'),\n(24111,'002749','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (1) (c)','SI-10 (1)(c)','SI-10 (1)'),\n(24112,'002750','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (2)','SI-10 (2)','SI-10 (2)'),\n(24113,'002751','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (2)','SI-10 (2)','SI-10 (2)'),\n(24114,'002752','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (2)','SI-10 (2)','SI-10 (2)'),\n(24115,'002753','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (2)','SI-10 (2)','SI-10 (2)'),\n(24116,'002754','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (3)','SI-10 (3)','SI-10 (3)'),\n(24117,'002755','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (4)','SI-10 (4)','SI-10 (4)'),\n(24118,'002756','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (5)','SI-10 (5)','SI-10 (5)'),\n(24119,'002757','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (5)','SI-10 (5)','SI-10 (5)'),\n(24120,'002758','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (5)','SI-10 (5)','SI-10 (5)'),\n(24121,'002759','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-11 b','SI-11b.','SI-11'),\n(24122,'002760','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 a','SI-13a.','SI-13'),\n(24123,'002761','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 a','SI-13a.','SI-13'),\n(24124,'002762','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 b','SI-13b.','SI-13'),\n(24125,'002763','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 b','SI-13b.','SI-13'),\n(24126,'002764','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-14','SI-14','SI-14'),\n(24127,'002765','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-14','SI-14','SI-14'),\n(24128,'002766','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-14','SI-14','SI-14'),\n(24129,'002767','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-14','SI-14','SI-14'),\n(24130,'002768','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-14 (1)','SI-14 (1)','SI-14 (1)'),\n(24131,'002769','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-14 (1)','SI-14 (1)','SI-14 (1)'),\n(24132,'002770','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-15','SI-15','SI-15'),\n(24133,'002771','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-15','SI-15','SI-15'),\n(24134,'002772','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-15','SI-15','SI-15'),\n(24135,'002984','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 3','PM-1a.3.','PM-1'),\n(24136,'002985','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 1','PM-1a.1.','PM-1'),\n(24137,'002986','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 2','PM-1a.2.','PM-1'),\n(24138,'002987','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 3','PM-1a.3.','PM-1'),\n(24139,'002988','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 4','PM-1a.4.','PM-1'),\n(24140,'002989','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 d','PM-1d.','PM-1'),\n(24141,'002990','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 d','PM-1d.','PM-1'),\n(24142,'002991','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 1','PM-4a.1.','PM-4'),\n(24143,'002992','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 3','PM-4a.3.','PM-4'),\n(24144,'002993','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 b','PM-4b.','PM-4'),\n(24145,'002994','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-9 c','PM-9c.','PM-9'),\n(24146,'002995','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-9 c','PM-9c.','PM-9'),\n(24147,'002996','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-12','PM-12','PM-12'),\n(24148,'002997','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-13','PM-13','PM-13'),\n(24149,'002998','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a.1.','PM-14'),\n(24150,'002999','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a.1.','PM-14'),\n(24151,'003000','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a.1.','PM-14'),\n(24152,'003001','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a.1.','PM-14'),\n(24153,'003002','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a.1.','PM-14'),\n(24154,'003003','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a.1.','PM-14'),\n(24155,'003004','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 2','PM-14a.2.','PM-14'),\n(24156,'003005','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 2','PM-14a.2.','PM-14'),\n(24157,'003006','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 2','PM-14a.2.','PM-14'),\n(24158,'003007','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 b','PM-14b.','PM-14'),\n(24159,'003008','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 b','PM-14b.','PM-14'),\n(24160,'003009','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 b','PM-14b.','PM-14'),\n(24161,'003010','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-15 a','PM-15a.','PM-15'),\n(24162,'003011','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-15 b','PM-15b.','PM-15'),\n(24163,'003012','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-15 c','PM-15c.','PM-15'),\n(24164,'003013','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PM-16','PM-16','PM-16'),\n(24165,'003392','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AP-1','AP-1','AP-1'),\n(24166,'003393','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AP-1','AP-1','AP-1'),\n(24167,'003394','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AP-1','AP-1','AP-1'),\n(24168,'003395','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AP-1','AP-1','AP-1'),\n(24169,'003396','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AP-2','AP-2','AP-2'),\n(24170,'003398','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AP-2','AP-2','AP-2'),\n(24171,'003399','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AP-2','AP-2','AP-2'),\n(24172,'003400','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AP-2','AP-2','AP-2'),\n(24173,'003397','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 a','AR-1a.','AR-1'),\n(24174,'003401','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 b','AR-1b.','AR-1'),\n(24175,'003402','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 c','AR-1c.','AR-1'),\n(24176,'003403','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 c','AR-1c.','AR-1'),\n(24177,'003404','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 c','AR-1c.','AR-1'),\n(24178,'003405','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 c','AR-1c.','AR-1'),\n(24179,'003406','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 d','AR-1d.','AR-1'),\n(24180,'003407','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 e','AR-1e.','AR-1'),\n(24181,'003408','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 e','AR-1e.','AR-1'),\n(24182,'003409','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 e','AR-1e.','AR-1'),\n(24183,'003410','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 e','AR-1e.','AR-1'),\n(24184,'003411','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 e','AR-1e.','AR-1'),\n(24185,'003412','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 e','AR-1e.','AR-1'),\n(24186,'003413','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 f','AR-1f.','AR-1'),\n(24187,'003414','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 f','AR-1f.','AR-1'),\n(24188,'003415','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 f','AR-1f.','AR-1'),\n(24189,'003416','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-1 f','AR-1f.','AR-1'),\n(24190,'003417','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-2 a','AR-2a.','AR-2'),\n(24191,'003418','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-2 a','AR-2a.','AR-2'),\n(24192,'003419','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-2 a','AR-2a.','AR-2'),\n(24193,'003420','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-2 a','AR-2a.','AR-2'),\n(24194,'003421','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-2 a','AR-2a.','AR-2'),\n(24195,'003422','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-2 a','AR-2a.','AR-2'),\n(24196,'003423','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-2 a','AR-2a.','AR-2'),\n(24197,'003424','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-2 a','AR-2a.','AR-2'),\n(24198,'003425','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-2 b','AR-2b.','AR-2'),\n(24199,'003426','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-3 a','AR-3a.','AR-3'),\n(24200,'003427','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-3 a','AR-3a.','AR-3'),\n(24201,'003428','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-3 a','AR-3a.','AR-3'),\n(24202,'003429','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-3 a','AR-3a.','AR-3'),\n(24203,'003430','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-3 a','AR-3a.','AR-3'),\n(24204,'003431','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-3 a','AR-3a.','AR-3'),\n(24205,'003432','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-3 b','AR-3b.','AR-3'),\n(24206,'003433','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-3 b','AR-3b.','AR-3'),\n(24207,'003434','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-4','AR-4','AR-4'),\n(24208,'003435','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-4','AR-4','AR-4'),\n(24209,'003436','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-4','AR-4','AR-4'),\n(24210,'003437','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-4','AR-4','AR-4'),\n(24211,'003438','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-4','AR-4','AR-4'),\n(24212,'003439','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-4','AR-4','AR-4'),\n(24213,'003440','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-5 a','AR-5a.','AR-5'),\n(24214,'003441','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-5 a','AR-5a.','AR-5'),\n(24215,'003442','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-5 a','AR-5a.','AR-5'),\n(24216,'003443','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-5 b','AR-5b.','AR-5'),\n(24217,'003444','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-5 b','AR-5b.','AR-5'),\n(24218,'003445','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-5 b','AR-5b.','AR-5'),\n(24219,'003446','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-5 b','AR-5b.','AR-5'),\n(24220,'003447','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-5 c','AR-5c.','AR-5'),\n(24221,'003448','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-5 c','AR-5c.','AR-5'),\n(24222,'003449','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-6','AR-6','AR-6'),\n(24223,'003450','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-6','AR-6','AR-6'),\n(24224,'003451','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-6','AR-6','AR-6'),\n(24225,'003452','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-6','AR-6','AR-6'),\n(24226,'003453','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-6','AR-6','AR-6'),\n(24227,'003454','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-6','AR-6','AR-6'),\n(24228,'003455','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-7','AR-7','AR-7'),\n(24229,'003456','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-8 a (1)','AR-8a(1)','AR-8'),\n(24230,'003457','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-8 a (1)','AR-8a(1)','AR-8'),\n(24231,'003458','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-8 a (1)','AR-8a(1)','AR-8'),\n(24232,'003459','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-8 a (1)','AR-8a(1)','AR-8'),\n(24233,'003460','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-8 a (2)','AR-8a(2)','AR-8'),\n(24234,'003461','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-8 b','AR-8b.','AR-8'),\n(24235,'003462','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AR-8 c','AR-8c.','AR-8'),\n(24236,'003463','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 a','DI-1a.','DI-1'),\n(24237,'003464','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 a','DI-1a.','DI-1'),\n(24238,'003465','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 a','DI-1a.','DI-1'),\n(24239,'003466','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 a','DI-1a.','DI-1'),\n(24240,'003467','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 b','DI-1b.','DI-1'),\n(24241,'003468','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 c','DI-1c.','DI-1'),\n(24242,'003469','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 c','DI-1c.','DI-1'),\n(24243,'003470','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 d','DI-1d.','DI-1'),\n(24244,'003471','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 d','DI-1d.','DI-1'),\n(24245,'003472','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 d','DI-1d.','DI-1'),\n(24246,'003473','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 d','DI-1d.','DI-1'),\n(24247,'003474','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 d','DI-1d.','DI-1'),\n(24248,'003475','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 d','DI-1d.','DI-1'),\n(24249,'003476','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 d','DI-1d.','DI-1'),\n(24250,'003477','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 d','DI-1d.','DI-1'),\n(24251,'003478','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 (1)','DI-1 (1)','DI-1 (1)'),\n(24252,'003479','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 (2)','DI-1 (2)','DI-1 (2)'),\n(24253,'003480','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-1 (2)','DI-1 (2)','DI-1 (2)'),\n(24254,'003481','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-2 a','DI-2a.','DI-2'),\n(24255,'003482','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-2 b','DI-2b.','DI-2'),\n(24256,'003483','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-2 b','DI-2b.','DI-2'),\n(24257,'003484','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-2 b','DI-2b.','DI-2'),\n(24258,'003485','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DI-2 (1)','DI-2 (1)','DI-2 (1)'),\n(24259,'003486','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-1 a','DM-1a.','DM-1'),\n(24260,'003487','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-1 b','DM-1b.','DM-1'),\n(24261,'003488','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-1 b','DM-1b.','DM-1'),\n(24262,'003489','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-1 c','DM-1c.','DM-1'),\n(24263,'003490','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-1 c','DM-1c.','DM-1'),\n(24264,'003491','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-1 c','DM-1c.','DM-1'),\n(24265,'003492','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-1 c','DM-1c.','DM-1'),\n(24266,'003493','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-1 c','DM-1c.','DM-1'),\n(24267,'003494','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-1 c','DM-1c.','DM-1'),\n(24268,'003495','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-1 (1)','DM-1 (1)','DM-1 (1)'),\n(24269,'003496','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-1 (1)','DM-1 (1)','DM-1 (1)'),\n(24270,'003497','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-2 a','DM-2a.','DM-2'),\n(24271,'003498','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-2 a','DM-2a.','DM-2'),\n(24272,'003499','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-2 b','DM-2b.','DM-2'),\n(24273,'003500','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-2 b','DM-2b.','DM-2'),\n(24274,'003501','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-2 c','DM-2c.','DM-2'),\n(24275,'003502','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-2 c','DM-2c.','DM-2'),\n(24276,'003503','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-2 (1)','DM-2 (1)','DM-2 (1)'),\n(24277,'003504','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-2 (1)','DM-2 (1)','DM-2 (1)'),\n(24278,'003505','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-2 (1)','DM-2 (1)','DM-2 (1)'),\n(24279,'003506','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-2 (1)','DM-2 (1)','DM-2 (1)'),\n(24280,'003507','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-3 a','DM-3a.','DM-3'),\n(24281,'003508','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-3 a','DM-3a.','DM-3'),\n(24282,'003509','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-3 a','DM-3a.','DM-3'),\n(24283,'003510','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-3 a','DM-3a.','DM-3'),\n(24284,'003511','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-3 a','DM-3a.','DM-3'),\n(24285,'003512','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-3 a','DM-3a.','DM-3'),\n(24286,'003513','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-3 b','DM-3b.','DM-3'),\n(24287,'003514','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-3 b','DM-3b.','DM-3'),\n(24288,'003515','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-3 b','DM-3b.','DM-3'),\n(24289,'003516','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-3 (1)','DM-3 (1)','DM-3 (1)'),\n(24290,'003517','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-3 (1)','DM-3 (1)','DM-3 (1)'),\n(24291,'003518','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','DM-3 (1)','DM-3 (1)','DM-3 (1)'),\n(24292,'003519','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-1 a','IP-1a.','IP-1'),\n(24293,'003520','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-1 a','IP-1a.','IP-1'),\n(24294,'003521','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-1 a','IP-1a.','IP-1'),\n(24295,'003522','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-1 a','IP-1a.','IP-1'),\n(24296,'003523','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-1 b','IP-1b.','IP-1'),\n(24297,'003524','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-1 b','IP-1b.','IP-1'),\n(24298,'003525','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-1 b','IP-1b.','IP-1'),\n(24299,'003526','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-1 b','IP-1b.','IP-1'),\n(24300,'003527','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-1 c','IP-1c.','IP-1'),\n(24301,'003528','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-1 d','IP-1d.','IP-1'),\n(24302,'003529','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-1 d','IP-1d.','IP-1'),\n(24303,'003530','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-1 (1)','IP-1 (1)','IP-1 (1)'),\n(24304,'003531','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-2 a','IP-2a.','IP-2'),\n(24305,'003532','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-2 b','IP-2b.','IP-2'),\n(24306,'003533','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-2 b','IP-2b.','IP-2'),\n(24307,'003534','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-2 c','IP-2c.','IP-2'),\n(24308,'003535','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-2 d','IP-2d.','IP-2'),\n(24309,'003536','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-2 d','IP-2d.','IP-2'),\n(24310,'003537','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-3 a','IP-3a.','IP-3'),\n(24311,'003538','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-3 b','IP-3b.','IP-3'),\n(24312,'003539','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-3 b','IP-3b.','IP-3'),\n(24313,'003540','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-4','IP-4','IP-4'),\n(24314,'003541','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-4','IP-4','IP-4'),\n(24315,'003542','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-4 (1)','IP-4 (1)','IP-4 (1)'),\n(24316,'003543','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','IP-4 (1)','IP-4 (1)','IP-4 (1)'),\n(24317,'003544','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SE-1 a','SE-1a.','SE-1'),\n(24318,'003545','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SE-1 a','SE-1a.','SE-1'),\n(24319,'003546','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SE-1 a','SE-1a.','SE-1'),\n(24320,'003547','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SE-1 a','SE-1a.','SE-1'),\n(24321,'003548','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SE-1 a','SE-1a.','SE-1'),\n(24322,'003549','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SE-1 a','SE-1a.','SE-1'),\n(24323,'003550','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SE-1 a','SE-1a.','SE-1'),\n(24324,'003551','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SE-1 b','SE-1b.','SE-1'),\n(24325,'003552','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SE-1 b','SE-1b.','SE-1'),\n(24326,'003553','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SE-2 a','SE-2a.','SE-2'),\n(24327,'003554','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SE-2 a','SE-2a.','SE-2'),\n(24328,'003555','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SE-2 b','SE-2b.','SE-2'),\n(24329,'003556','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 a','TR-1a.','TR-1'),\n(24330,'003557','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 a','TR-1a.','TR-1'),\n(24331,'003558','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 a','TR-1a.','TR-1'),\n(24332,'003559','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 a','TR-1a.','TR-1'),\n(24333,'003560','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 a','TR-1a.','TR-1'),\n(24334,'003561','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 a','TR-1a.','TR-1'),\n(24335,'003562','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 a','TR-1a.','TR-1'),\n(24336,'003563','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 a','TR-1a.','TR-1'),\n(24337,'003564','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 a','TR-1a.','TR-1'),\n(24338,'003565','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 a','TR-1a.','TR-1'),\n(24339,'003566','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 a','TR-1a.','TR-1'),\n(24340,'003567','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 a','TR-1a.','TR-1'),\n(24341,'003568','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 b','TR-1b.','TR-1'),\n(24342,'003569','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 b','TR-1b.','TR-1'),\n(24343,'003570','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 b','TR-1b.','TR-1'),\n(24344,'003571','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 b','TR-1b.','TR-1'),\n(24345,'003572','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 b','TR-1b.','TR-1'),\n(24346,'003573','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 b','TR-1b.','TR-1'),\n(24347,'003574','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 b','TR-1b.','TR-1'),\n(24348,'003575','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 b','TR-1b.','TR-1'),\n(24349,'003576','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 b','TR-1b.','TR-1'),\n(24350,'003577','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 b','TR-1b.','TR-1'),\n(24351,'003578','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 c','TR-1c.','TR-1'),\n(24352,'003579','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 c','TR-1c.','TR-1'),\n(24353,'003580','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-1 (1)','TR-1 (1)','TR-1 (1)'),\n(24354,'003581','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-2 a','TR-2a.','TR-2'),\n(24355,'003582','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-2 b','TR-2b.','TR-2'),\n(24356,'003583','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-2 c','TR-2c.','TR-2'),\n(24357,'003584','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-2 (1)','TR-2 (1)','TR-2 (1)'),\n(24358,'003585','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-3 a','TR-3a.','TR-3'),\n(24359,'003586','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-3 a','TR-3a.','TR-3'),\n(24360,'003587','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','TR-3 b','TR-3b.','TR-3'),\n(24361,'003588','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','UL-1','UL-1','UL-1'),\n(24362,'003589','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','UL-2 a','UL-2a.','UL-2'),\n(24363,'003590','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','UL-2 b','UL-2b.','UL-2'),\n(24364,'003591','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','UL-2 b','UL-2b.','UL-2'),\n(24365,'003592','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','UL-2 c','UL-2c.','UL-2'),\n(24366,'003593','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','UL-2 c','UL-2c.','UL-2'),\n(24367,'003594','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','UL-2 c','UL-2c.','UL-2'),\n(24368,'003595','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','UL-2 c','UL-2c.','UL-2'),\n(24369,'003596','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','UL-2 d','UL-2d.','UL-2'),\n(24370,'003597','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','UL-2 d','UL-2d.','UL-2'),\n(24371,'002254','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-12','AC-12','AC-12'),\n(24372,'002360','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-12','AC-12','AC-12'),\n(24373,'002361','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-12','AC-12','AC-12'),\n(24374,'002362','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-12 (1)','AC-12 (1)','AC-12 (1)'),\n(24375,'002363','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-12 (1)','AC-12 (1)','AC-12 (1)'),\n(24376,'002364','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','AC-12 (1)','AC-12 (1)','AC-12 (1)'),\n(24377,'002979','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-20 a','PE-20a.','PE-20'),\n(24378,'002980','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-20 a','PE-20a.','PE-20'),\n(24379,'002981','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-20 a','PE-20a.','PE-20'),\n(24380,'002982','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-20 a','PE-20a.','PE-20'),\n(24381,'002983','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PE-20 b','PE-20b.','PE-20'),\n(24382,'003372','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-22 (1)','SA-22 (1)','SA-22 (1)'),\n(24383,'003373','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-22 (1)','SA-22 (1)','SA-22 (1)'),\n(24384,'003374','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-22 b','SA-22b.','SA-22'),\n(24385,'003375','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-22 b','SA-22b.','SA-22'),\n(24386,'003376','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SA-22 a','SA-22a.','SA-22'),\n(24387,'002773','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-17','SI-17','SI-17'),\n(24388,'002774','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-17','SI-17','SI-17'),\n(24389,'002775','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-17','SI-17','SI-17'),\n(24390,'002823','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-16','SI-16','SI-16'),\n(24391,'002824','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','SI-16','SI-16','SI-16'),\n(24392,'003117','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-9','PL-9','PL-9'),\n(24393,'003118','NIST','NIST SP 800-53 Revision 4','4','http://csrc.nist.gov/publications/PubsSPs.html','PL-9','PL-9','PL-9');\n/*!40000 ALTER TABLE `cci_reference_map` ENABLE KEYS */;\nUNLOCK TABLES;\n\n/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;\n/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;\n/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;\n/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;\n\n-- Dump completed on 2020-05-20 20:35:08\n"
  },
  {
    "path": "api/source/service/migrations/sql/0001/down/10-collection-created.sql",
    "content": "ALTER TABLE `collection` \nDROP COLUMN `created`;\n"
  },
  {
    "path": "api/source/service/migrations/sql/0001/up/10-collection-created.sql",
    "content": "ALTER TABLE `collection` \nADD COLUMN `created` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP AFTER `metadata`;\n"
  },
  {
    "path": "api/source/service/migrations/sql/0002/down/10-collection-description.sql",
    "content": "ALTER TABLE `collection` \nDROP COLUMN `description`;"
  },
  {
    "path": "api/source/service/migrations/sql/0002/up/10-collection-description.sql",
    "content": "ALTER TABLE `collection` \nADD COLUMN `description` VARCHAR(255) NULL AFTER `name`;"
  },
  {
    "path": "api/source/service/migrations/sql/0003/up/10-asset-mac-fqdn.sql",
    "content": "ALTER TABLE `asset` \nADD COLUMN `mac` VARCHAR(17) NULL AFTER `ip`;\nALTER TABLE `asset` \nADD COLUMN `fqdn` VARCHAR(255) NULL AFTER `name`;"
  },
  {
    "path": "api/source/service/migrations/sql/0004/up/10-user-data.sql",
    "content": "ALTER TABLE `user_data` \nDROP COLUMN `display`,\nDROP COLUMN `email`,\nDROP COLUMN `globalAccess`,\nDROP COLUMN `canCreateCollection`,\nDROP COLUMN `canAdmin`,\nDROP COLUMN `metadata`,\nDROP COLUMN `disabled`;\n\nALTER TABLE `user_data` ADD COLUMN `lastClaims` json DEFAULT ('{}');\n"
  },
  {
    "path": "api/source/service/migrations/sql/0005/down/10-v-current-rev.sql",
    "content": "ALTER VIEW `v_current_rev` AS\nselect \n`rr`.`revId` AS `revId`,`rr`.`benchmarkId` AS `benchmarkId`,`rr`.`version` AS `version`,`rr`.`release` AS `release`,`rr`.`benchmarkDate` AS `benchmarkDate`,`rr`.`benchmarkDateSql` AS `benchmarkDateSql`,`rr`.`status` AS `status`,`rr`.`statusDate` AS `statusDate`,`rr`.`description` AS `description`,`rr`.`active` AS `active`,`rr`.`groupCount` AS `groupCount`,`rr`.`ruleCount` AS `ruleCount`,`rr`.`checkCount` AS `checkCount`,`rr`.`fixCount` AS `fixCount`,`rr`.`ovalCount` AS `ovalCount` from (select `r`.`revId` AS `revId`,`r`.`benchmarkId` AS `benchmarkId`,`r`.`version` AS `version`,`r`.`release` AS `release`,`r`.`benchmarkDate` AS `benchmarkDate`,`r`.`benchmarkDateSql` AS `benchmarkDateSql`,`r`.`status` AS `status`,`r`.`statusDate` AS `statusDate`,`r`.`description` AS `description`,`r`.`active` AS `active`,`r`.`groupCount` AS `groupCount`,`r`.`ruleCount` AS `ruleCount`,`r`.`checkCount` AS `checkCount`,`r`.`fixCount` AS `fixCount`,(select count(`rule_oval_map`.`roId`) from `rule_oval_map` where (`rule_oval_map`.`benchmarkId` = `r`.`benchmarkId`)) AS `ovalCount`,row_number() OVER (PARTITION BY `r`.`benchmarkId` ORDER BY (`r`.`version` + 0) desc,(`r`.`release` + 0) desc )  AS `rn` from `revision` `r` where (`r`.`status` = 'accepted')) `rr` where (`rr`.`rn` = 1);\nDELETE from current_rev;\nINSERT INTO current_rev (\n      revId,\n      benchmarkId,\n      `version`, \n      `release`, \n      benchmarkDate,\n      benchmarkDateSql,\n      status,\n      statusDate,\n      description,\n      active,\n      groupCount,\n      ruleCount,\n      checkCount,\n      fixCount,\n      ovalCount)\n      SELECT \n        revId,\n        benchmarkId,\n        `version`,\n        `release`,\n        benchmarkDate,\n        benchmarkDateSql,\n        status,\n        statusDate,\n        description,\n        active,\n        groupCount,\n        ruleCount,\n        checkCount,\n        fixCount,\n        ovalCount\n      FROM\n        v_current_rev;\nDELETE FROM current_group_rule;\nINSERT INTO current_group_rule (groupId, ruleId, benchmarkId)\n      SELECT rg.groupId,\n        rgr.ruleId,\n        cr.benchmarkId\n      from\n        current_rev cr\n        left join rev_group_map rg on rg.revId=cr.revId\n        left join rev_group_rule_map rgr on rgr.rgId=rg.rgId\n      order by\n        rg.groupId,rgr.ruleId,cr.benchmarkId;\n"
  },
  {
    "path": "api/source/service/migrations/sql/0005/up/10-v-current-rev.sql",
    "content": "ALTER VIEW `v_current_rev` AS\nselect \n\t`rr`.`revId` AS `revId`,\n\t`rr`.`benchmarkId` AS `benchmarkId`,\n\t`rr`.`version` AS `version`,\n\t`rr`.`release` AS `release`,\n\t`rr`.`benchmarkDate` AS `benchmarkDate`,\n\t`rr`.`benchmarkDateSql` AS `benchmarkDateSql`,\n\t`rr`.`status` AS `status`,\n\t`rr`.`statusDate` AS `statusDate`,\n\t`rr`.`description` AS `description`,\n\t`rr`.`active` AS `active`,\n\t`rr`.`groupCount` AS `groupCount`,\n\t`rr`.`ruleCount` AS `ruleCount`,\n\t`rr`.`checkCount` AS `checkCount`,\n\t`rr`.`fixCount` AS `fixCount`,\n\t`rr`.`ovalCount` AS `ovalCount`\n from (\n select \n\t `r`.`revId` AS `revId`,\n\t `r`.`benchmarkId` AS `benchmarkId`,\n\t `r`.`version` AS `version`,\n\t `r`.`release` AS `release`,\n\t `r`.`benchmarkDate` AS `benchmarkDate`,\n\t `r`.`benchmarkDateSql` AS `benchmarkDateSql`,\n\t `r`.`status` AS `status`,\n\t `r`.`statusDate` AS `statusDate`,\n\t `r`.`description` AS `description`,\n\t `r`.`active` AS `active`,\n\t `r`.`groupCount` AS `groupCount`,\n\t `r`.`ruleCount` AS `ruleCount`,\n\t `r`.`checkCount` AS `checkCount`,\n\t `r`.`fixCount` AS `fixCount`,\n\t (select count(`rule_oval_map`.`roId`) from `rule_oval_map` where (`rule_oval_map`.`benchmarkId` = `r`.`benchmarkId`)) AS `ovalCount`,\n\trow_number() OVER (\n\t\tPARTITION BY `r`.`benchmarkId` \n        ORDER BY \n\t\t\tFIELD(status, 'draft', 'accepted') desc,\n\t\t\t(`r`.`version` + 0) desc,\n\t\t\t(`r`.`release` + 0) desc )  AS `rn` \n    from \n\t\t`revision` `r`) `rr` where (`rr`.`rn` = 1);\n\nDELETE from current_rev;\nINSERT INTO current_rev (\n      revId,\n      benchmarkId,\n      `version`, \n      `release`, \n      benchmarkDate,\n      benchmarkDateSql,\n      status,\n      statusDate,\n      description,\n      active,\n      groupCount,\n      ruleCount,\n      checkCount,\n      fixCount,\n      ovalCount)\n      SELECT \n        revId,\n        benchmarkId,\n        `version`,\n        `release`,\n        benchmarkDate,\n        benchmarkDateSql,\n        status,\n        statusDate,\n        description,\n        active,\n        groupCount,\n        ruleCount,\n        checkCount,\n        fixCount,\n        ovalCount\n      FROM\n        v_current_rev;\nDELETE FROM current_group_rule;\nINSERT INTO current_group_rule (groupId, ruleId, benchmarkId)\n      SELECT rg.groupId,\n        rgr.ruleId,\n        cr.benchmarkId\n      from\n        current_rev cr\n        left join rev_group_map rg on rg.revId=cr.revId\n        left join rev_group_rule_map rgr on rgr.rgId=rg.rgId\n      order by\n        rg.groupId,rgr.ruleId,cr.benchmarkId;\n"
  },
  {
    "path": "api/source/service/migrations/sql/0006/up/10-v-current-rev.sql",
    "content": "ALTER VIEW `v_current_rev` AS\nselect \n\t`rr`.`revId` AS `revId`,\n\t`rr`.`benchmarkId` AS `benchmarkId`,\n\t`rr`.`version` AS `version`,\n\t`rr`.`release` AS `release`,\n\t`rr`.`benchmarkDate` AS `benchmarkDate`,\n\t`rr`.`benchmarkDateSql` AS `benchmarkDateSql`,\n\t`rr`.`status` AS `status`,\n\t`rr`.`statusDate` AS `statusDate`,\n\t`rr`.`description` AS `description`,\n\t`rr`.`active` AS `active`,\n\t`rr`.`groupCount` AS `groupCount`,\n\t`rr`.`ruleCount` AS `ruleCount`,\n\t`rr`.`checkCount` AS `checkCount`,\n\t`rr`.`fixCount` AS `fixCount`,\n\t`rr`.`ovalCount` AS `ovalCount`\n from (\n select \n\t `r`.`revId` AS `revId`,\n\t `r`.`benchmarkId` AS `benchmarkId`,\n\t `r`.`version` AS `version`,\n\t `r`.`release` AS `release`,\n\t `r`.`benchmarkDate` AS `benchmarkDate`,\n\t `r`.`benchmarkDateSql` AS `benchmarkDateSql`,\n\t `r`.`status` AS `status`,\n\t `r`.`statusDate` AS `statusDate`,\n\t `r`.`description` AS `description`,\n\t `r`.`active` AS `active`,\n\t `r`.`groupCount` AS `groupCount`,\n\t `r`.`ruleCount` AS `ruleCount`,\n\t `r`.`checkCount` AS `checkCount`,\n\t `r`.`fixCount` AS `fixCount`,\n\t (select count(distinct `ro`.`ruleId`) from `rule_oval_map` `ro` where `ro`.`ruleId` IN (\n     SELECT `rgr`.`ruleId` from `rev_group_map` `rg` inner join `rev_group_rule_map` `rgr` on `rg`.`rgId` = `rgr`.`rgId` WHERE `rg`.`revId` = `r`.`revId`)) AS `ovalCount`,\n\trow_number() OVER (\n\t\tPARTITION BY `r`.`benchmarkId` \n        ORDER BY \n\t\t\tFIELD(status, 'draft', 'accepted') desc,\n\t\t\t(`r`.`version` + 0) desc,\n\t\t\t(`r`.`release` + 0) desc )  AS `rn` \n    from \n\t\t`revision` `r`) `rr` where (`rr`.`rn` = 1);\n\nDELETE from current_rev;\nINSERT INTO current_rev (\n      revId,\n      benchmarkId,\n      `version`, \n      `release`, \n      benchmarkDate,\n      benchmarkDateSql,\n      status,\n      statusDate,\n      description,\n      active,\n      groupCount,\n      ruleCount,\n      checkCount,\n      fixCount,\n      ovalCount)\n      SELECT \n        revId,\n        benchmarkId,\n        `version`,\n        `release`,\n        benchmarkDate,\n        benchmarkDateSql,\n        status,\n        statusDate,\n        description,\n        active,\n        groupCount,\n        ruleCount,\n        checkCount,\n        fixCount,\n        ovalCount\n      FROM\n        v_current_rev;\nDELETE FROM current_group_rule;\nINSERT INTO current_group_rule (groupId, ruleId, benchmarkId)\n      SELECT rg.groupId,\n        rgr.ruleId,\n        cr.benchmarkId\n      from\n        current_rev cr\n        left join rev_group_map rg on rg.revId=cr.revId\n        left join rev_group_rule_map rgr on rgr.rgId=rg.rgId\n      order by\n        rg.groupId,rgr.ruleId,cr.benchmarkId;\n"
  },
  {
    "path": "api/source/service/migrations/sql/current/10-stigman-tables.sql",
    "content": "-- MySQL dump 10.13  Distrib 8.0.44, for Linux (x86_64)\n--\n-- Host: 127.0.0.1    Database: stigman\n-- ------------------------------------------------------\n-- Server version\t8.0.44\n\n/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;\n/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;\n/*!40103 SET TIME_ZONE='+00:00' */;\n/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;\n/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;\n/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;\n/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;\n\n--\n-- Table structure for table `_migrations`\n--\n\nDROP TABLE IF EXISTS `_migrations`;\nCREATE TABLE `_migrations` (\n  `createdAt` datetime DEFAULT CURRENT_TIMESTAMP,\n  `updatedAt` datetime DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,\n  `name` varchar(128) DEFAULT NULL\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `asset`\n--\n\nDROP TABLE IF EXISTS `asset`;\nCREATE TABLE `asset` (\n  `assetId` int NOT NULL AUTO_INCREMENT,\n  `name` varchar(255) NOT NULL,\n  `fqdn` varchar(255) DEFAULT NULL,\n  `collectionId` int NOT NULL,\n  `ip` varchar(255) DEFAULT NULL,\n  `mac` varchar(255) DEFAULT NULL,\n  `description` varchar(255) DEFAULT NULL,\n  `noncomputing` bit(1) NOT NULL DEFAULT b'0',\n  `metadata` json NOT NULL,\n  `state` enum('enabled','disabled') NOT NULL,\n  `stateDate` datetime DEFAULT NULL,\n  `stateUserId` int DEFAULT NULL,\n  `isEnabled` tinyint GENERATED ALWAYS AS ((case when (`state` = _utf8mb4'enabled') then 1 else NULL end)) STORED,\n  PRIMARY KEY (`assetId`),\n  UNIQUE KEY `INDEX_NAME_COLLECTION_ENABLED` (`name`,`collectionId`,`isEnabled`),\n  KEY `INDEX_COMPUTING` (`noncomputing`),\n  KEY `INDEX_COLLECTIONID` (`collectionId`),\n  KEY `idx_state` (`state`),\n  CONSTRAINT `FK_ASSET_2` FOREIGN KEY (`collectionId`) REFERENCES `collection` (`collectionId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `cci`\n--\n\nDROP TABLE IF EXISTS `cci`;\nCREATE TABLE `cci` (\n  `cci` varchar(20) NOT NULL,\n  `status` varchar(20) NOT NULL,\n  `publishdate` date NOT NULL,\n  `contributor` varchar(255) NOT NULL,\n  `type` varchar(20) NOT NULL,\n  `definition` text NOT NULL,\n  `apAcronym` varchar(20) DEFAULT NULL,\n  `implementation` text,\n  `assessmentProcedure` text,\n  PRIMARY KEY (`cci`),\n  KEY `ap` (`apAcronym`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `cci_reference_map`\n--\n\nDROP TABLE IF EXISTS `cci_reference_map`;\nCREATE TABLE `cci_reference_map` (\n  `cciRefId` int NOT NULL AUTO_INCREMENT,\n  `cci` varchar(20) NOT NULL,\n  `creator` varchar(255) NOT NULL,\n  `title` varchar(255) NOT NULL,\n  `version` varchar(255) NOT NULL,\n  `location` varchar(255) NOT NULL,\n  `indexDisa` varchar(255) NOT NULL,\n  `textRefNist` varchar(255) NOT NULL,\n  `parentControl` varchar(255) NOT NULL,\n  PRIMARY KEY (`cciRefId`),\n  KEY `cci` (`cci`),\n  KEY `textRefNist` (`textRefNist`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `check_content`\n--\n\nDROP TABLE IF EXISTS `check_content`;\nCREATE TABLE `check_content` (\n  `ccId` int NOT NULL AUTO_INCREMENT,\n  `digest` binary(32) GENERATED ALWAYS AS (unhex(sha2(`content`,256))) STORED,\n  `content` text NOT NULL,\n  PRIMARY KEY (`ccId`),\n  UNIQUE KEY `digest_UNIQUE` (`digest`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `collection`\n--\n\nDROP TABLE IF EXISTS `collection`;\nCREATE TABLE `collection` (\n  `collectionId` int NOT NULL AUTO_INCREMENT,\n  `name` varchar(45) NOT NULL,\n  `description` varchar(255) DEFAULT NULL,\n  `settings` json NOT NULL,\n  `metadata` json NOT NULL,\n  `created` datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,\n  `state` enum('enabled','disabled','cloning') NOT NULL,\n  `createdUserId` int DEFAULT NULL,\n  `stateDate` datetime DEFAULT NULL,\n  `stateUserId` int DEFAULT NULL,\n  `isNameUnavailable` tinyint GENERATED ALWAYS AS ((case when ((`state` = _utf8mb4'cloning') or (`state` = _utf8mb4'enabled')) then 1 else NULL end)) VIRTUAL,\n  `isEnabled` tinyint GENERATED ALWAYS AS ((case when (`state` = _utf8mb4'enabled') then 1 else NULL end)) STORED,\n  PRIMARY KEY (`collectionId`),\n  UNIQUE KEY `index2` (`name`,`isEnabled`),\n  UNIQUE KEY `index3` (`name`,`isNameUnavailable`),\n  KEY `idx_state` (`state`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `collection_grant`\n--\n\nDROP TABLE IF EXISTS `collection_grant`;\nCREATE TABLE `collection_grant` (\n  `grantId` int NOT NULL AUTO_INCREMENT,\n  `collectionId` int NOT NULL,\n  `userId` int DEFAULT NULL,\n  `userGroupId` int DEFAULT NULL,\n  `roleId` int NOT NULL,\n  PRIMARY KEY (`grantId`),\n  UNIQUE KEY `INDEX_USER` (`userId`,`collectionId`),\n  UNIQUE KEY `INDEX_USER_GROUP` (`userGroupId`,`collectionId`),\n  KEY `INDEX_COLLECTION` (`collectionId`,`roleId`),\n  CONSTRAINT `fk_collection_grant_1` FOREIGN KEY (`userId`) REFERENCES `user_data` (`userId`) ON DELETE CASCADE ON UPDATE CASCADE,\n  CONSTRAINT `fk_collection_grant_2` FOREIGN KEY (`collectionId`) REFERENCES `collection` (`collectionId`) ON DELETE CASCADE ON UPDATE CASCADE,\n  CONSTRAINT `fk_collection_grant_3` FOREIGN KEY (`userGroupId`) REFERENCES `user_group` (`userGroupId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `collection_grant_acl`\n--\n\nDROP TABLE IF EXISTS `collection_grant_acl`;\nCREATE TABLE `collection_grant_acl` (\n  `cgAclId` int NOT NULL AUTO_INCREMENT,\n  `grantId` int NOT NULL,\n  `benchmarkId` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_as_cs DEFAULT NULL,\n  `assetId` int DEFAULT NULL,\n  `clId` int DEFAULT NULL,\n  `access` enum('none','r','rw') NOT NULL,\n  `modifiedUserId` int DEFAULT NULL,\n  `modifiedDate` datetime DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,\n  PRIMARY KEY (`cgAclId`),\n  KEY `fk_collection_grant_acl_1` (`grantId`),\n  KEY `fk_collection_grant_acl_2` (`assetId`,`benchmarkId`),\n  KEY `fk_collection_grant_acl_3` (`benchmarkId`,`assetId`),\n  KEY `fk_collection_grant_acl_4` (`clId`,`benchmarkId`),\n  CONSTRAINT `fk_collection_grant_acl_1` FOREIGN KEY (`grantId`) REFERENCES `collection_grant` (`grantId`) ON DELETE CASCADE ON UPDATE CASCADE,\n  CONSTRAINT `fk_collection_grant_acl_2` FOREIGN KEY (`assetId`) REFERENCES `asset` (`assetId`) ON DELETE CASCADE ON UPDATE CASCADE,\n  CONSTRAINT `fk_collection_grant_acl_3` FOREIGN KEY (`benchmarkId`) REFERENCES `stig` (`benchmarkId`) ON DELETE CASCADE ON UPDATE CASCADE,\n  CONSTRAINT `fk_collection_grant_acl_4` FOREIGN KEY (`clId`) REFERENCES `collection_label` (`clId`) ON DELETE CASCADE ON UPDATE CASCADE,\n  CONSTRAINT `fk_collection_grant_acl_5` FOREIGN KEY (`benchmarkId`, `assetId`) REFERENCES `stig_asset_map` (`benchmarkId`, `assetId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `collection_label`\n--\n\nDROP TABLE IF EXISTS `collection_label`;\nCREATE TABLE `collection_label` (\n  `clId` int NOT NULL AUTO_INCREMENT,\n  `collectionId` int NOT NULL,\n  `name` varchar(36) NOT NULL,\n  `description` varchar(45) DEFAULT NULL,\n  `color` varchar(6) NOT NULL,\n  `uuid` binary(16) NOT NULL,\n  PRIMARY KEY (`clId`),\n  UNIQUE KEY `colname` (`collectionId`,`name`),\n  KEY `index4` (`uuid`),\n  CONSTRAINT `fk_collection_label_1` FOREIGN KEY (`collectionId`) REFERENCES `collection` (`collectionId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `collection_label_asset_map`\n--\n\nDROP TABLE IF EXISTS `collection_label_asset_map`;\nCREATE TABLE `collection_label_asset_map` (\n  `claId` int NOT NULL AUTO_INCREMENT,\n  `assetId` int NOT NULL,\n  `clId` int NOT NULL,\n  PRIMARY KEY (`claId`),\n  UNIQUE KEY `index4` (`assetId`,`clId`),\n  KEY `fk_collection_label_asset_map_2` (`clId`),\n  CONSTRAINT `fk_collection_label_asset_map_1` FOREIGN KEY (`assetId`) REFERENCES `asset` (`assetId`) ON DELETE CASCADE ON UPDATE CASCADE,\n  CONSTRAINT `fk_collection_label_asset_map_2` FOREIGN KEY (`clId`) REFERENCES `collection_label` (`clId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `collection_rev_map`\n--\n\nDROP TABLE IF EXISTS `collection_rev_map`;\nCREATE TABLE `collection_rev_map` (\n  `crId` int NOT NULL AUTO_INCREMENT,\n  `collectionId` int NOT NULL,\n  `benchmarkId` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_as_cs DEFAULT NULL,\n  `revId` varchar(255) NOT NULL,\n  PRIMARY KEY (`crId`),\n  UNIQUE KEY `index_collection_benchmark` (`collectionId`,`benchmarkId`),\n  KEY `index_revId` (`revId`),\n  CONSTRAINT `fk_collection_rev_map_1` FOREIGN KEY (`collectionId`) REFERENCES `collection` (`collectionId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `config`\n--\n\nDROP TABLE IF EXISTS `config`;\nCREATE TABLE `config` (\n  `key` varchar(45) NOT NULL,\n  `value` varchar(255) NOT NULL,\n  PRIMARY KEY (`key`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `current_rev`\n--\n\nDROP TABLE IF EXISTS `current_rev`;\nCREATE TABLE `current_rev` (\n  `revId` varchar(255) NOT NULL,\n  `benchmarkId` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_as_cs DEFAULT NULL,\n  `version` int NOT NULL,\n  `release` varchar(45) NOT NULL,\n  `benchmarkDate` varchar(45) DEFAULT NULL,\n  `benchmarkDateSql` date DEFAULT NULL,\n  `status` varchar(45) DEFAULT NULL,\n  `statusDate` varchar(45) DEFAULT NULL,\n  `marking` varchar(10) DEFAULT NULL,\n  `description` varchar(4000) DEFAULT NULL,\n  `active` tinyint DEFAULT NULL,\n  `groupCount` int NOT NULL DEFAULT '0',\n  `ruleCount` int GENERATED ALWAYS AS (((`highCount` + `mediumCount`) + `lowCount`)) STORED,\n  `checkCount` int NOT NULL DEFAULT '0',\n  `fixCount` int NOT NULL DEFAULT '0',\n  `lowCount` int NOT NULL DEFAULT '0',\n  `mediumCount` int NOT NULL DEFAULT '0',\n  `highCount` int NOT NULL DEFAULT '0',\n  PRIMARY KEY (`revId`),\n  UNIQUE KEY `index2` (`benchmarkId`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `default_rev`\n--\n\nDROP TABLE IF EXISTS `default_rev`;\nCREATE TABLE `default_rev` (\n  `vdId` int NOT NULL AUTO_INCREMENT,\n  `collectionId` int NOT NULL,\n  `benchmarkId` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_as_cs NOT NULL,\n  `revId` varchar(255) NOT NULL,\n  `revisionPinned` tinyint NOT NULL,\n  PRIMARY KEY (`vdId`),\n  UNIQUE KEY `index2` (`collectionId`,`benchmarkId`),\n  KEY `index3` (`benchmarkId`),\n  KEY `index4` (`revId`),\n  CONSTRAINT `fk_default_rev_2` FOREIGN KEY (`collectionId`) REFERENCES `collection` (`collectionId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Temporary view structure for view `enabled_asset`\n--\n\nDROP TABLE IF EXISTS `enabled_asset`;\n/*!50001 DROP VIEW IF EXISTS `enabled_asset`*/;\n/*!50001 CREATE VIEW `enabled_asset` AS SELECT \n 1 AS `assetId`,\n 1 AS `name`,\n 1 AS `fqdn`,\n 1 AS `collectionId`,\n 1 AS `ip`,\n 1 AS `mac`,\n 1 AS `description`,\n 1 AS `noncomputing`,\n 1 AS `metadata`,\n 1 AS `state`,\n 1 AS `stateDate`,\n 1 AS `stateUserId`,\n 1 AS `isEnabled`*/;\n\n--\n-- Temporary view structure for view `enabled_collection`\n--\n\nDROP TABLE IF EXISTS `enabled_collection`;\n/*!50001 DROP VIEW IF EXISTS `enabled_collection`*/;\n/*!50001 CREATE VIEW `enabled_collection` AS SELECT \n 1 AS `collectionId`,\n 1 AS `name`,\n 1 AS `description`,\n 1 AS `settings`,\n 1 AS `metadata`,\n 1 AS `created`,\n 1 AS `state`,\n 1 AS `createdUserId`,\n 1 AS `stateDate`,\n 1 AS `stateUserId`,\n 1 AS `isNameUnavailable`,\n 1 AS `isEnabled`*/;\n\n--\n-- Table structure for table `fix_text`\n--\n\nDROP TABLE IF EXISTS `fix_text`;\nCREATE TABLE `fix_text` (\n  `ftId` int NOT NULL AUTO_INCREMENT,\n  `digest` binary(32) GENERATED ALWAYS AS (unhex(sha2(`text`,256))) STORED,\n  `text` text NOT NULL,\n  PRIMARY KEY (`ftId`),\n  UNIQUE KEY `digest_UNIQUE` (`digest`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `job`\n--\n\nDROP TABLE IF EXISTS `job`;\nCREATE TABLE `job` (\n  `jobId` int NOT NULL AUTO_INCREMENT,\n  `name` varchar(45) NOT NULL,\n  `description` varchar(255) DEFAULT NULL,\n  `createdBy` int DEFAULT NULL,\n  `updatedBy` int DEFAULT NULL,\n  `created` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),\n  `updated` timestamp(3) NULL DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP(3),\n  PRIMARY KEY (`jobId`),\n  UNIQUE KEY `idx_job_name` (`name`),\n  KEY `fk_job_updatedBy` (`updatedBy`),\n  KEY `fk_job_createdBy` (`createdBy`),\n  CONSTRAINT `fk_job_createdBy` FOREIGN KEY (`createdBy`) REFERENCES `user_data` (`userId`) ON DELETE RESTRICT,\n  CONSTRAINT `fk_job_updatedBy` FOREIGN KEY (`updatedBy`) REFERENCES `user_data` (`userId`) ON DELETE RESTRICT\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `job_run`\n--\n\nDROP TABLE IF EXISTS `job_run`;\nCREATE TABLE `job_run` (\n  `jrId` int NOT NULL AUTO_INCREMENT,\n  `jobId` int NOT NULL,\n  `runId` binary(16) NOT NULL,\n  `state` varchar(255) DEFAULT NULL,\n  `created` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),\n  `updated` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),\n  PRIMARY KEY (`jrId`),\n  UNIQUE KEY `idx_job_run_runId` (`runId`),\n  KEY `fk_job_run_jobId` (`jobId`),\n  CONSTRAINT `fk_job_run_jobId` FOREIGN KEY (`jobId`) REFERENCES `job` (`jobId`) ON DELETE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `job_task_map`\n--\n\nDROP TABLE IF EXISTS `job_task_map`;\nCREATE TABLE `job_task_map` (\n  `jtId` int NOT NULL AUTO_INCREMENT,\n  `jobId` int NOT NULL,\n  `taskId` int NOT NULL,\n  `created` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),\n  `updated` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),\n  PRIMARY KEY (`jtId`),\n  KEY `fk_job_task_jobId` (`jobId`),\n  KEY `fk_job_task_taskId` (`taskId`),\n  CONSTRAINT `fk_job_task_jobId` FOREIGN KEY (`jobId`) REFERENCES `job` (`jobId`) ON DELETE CASCADE,\n  CONSTRAINT `fk_job_task_taskId` FOREIGN KEY (`taskId`) REFERENCES `task` (`taskId`) ON DELETE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `result`\n--\n\nDROP TABLE IF EXISTS `result`;\nCREATE TABLE `result` (\n  `resultId` int NOT NULL AUTO_INCREMENT,\n  `api` varchar(32) NOT NULL,\n  `ckl` varchar(32) NOT NULL,\n  `cklb` varchar(32) NOT NULL,\n  `abbr` varchar(2) NOT NULL,\n  `en` varchar(64) NOT NULL,\n  PRIMARY KEY (`resultId`),\n  UNIQUE KEY `RESULT_API` (`api`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `rev_group_rule_cci_map`\n--\n\nDROP TABLE IF EXISTS `rev_group_rule_cci_map`;\nCREATE TABLE `rev_group_rule_cci_map` (\n  `rgrccId` int NOT NULL AUTO_INCREMENT,\n  `rgrId` int NOT NULL,\n  `cci` varchar(20) NOT NULL,\n  PRIMARY KEY (`rgrccId`),\n  UNIQUE KEY `index2` (`rgrId`,`cci`),\n  KEY `index3` (`cci`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `rev_group_rule_map`\n--\n\nDROP TABLE IF EXISTS `rev_group_rule_map`;\nCREATE TABLE `rev_group_rule_map` (\n  `rgrId` int NOT NULL AUTO_INCREMENT,\n  `revId` varchar(255) DEFAULT NULL,\n  `groupId` varchar(45) DEFAULT NULL,\n  `groupTitle` varchar(255) DEFAULT NULL,\n  `groupSeverity` varchar(45) DEFAULT NULL,\n  `ruleId` varchar(255) DEFAULT NULL,\n  `version` varchar(45) DEFAULT NULL,\n  `title` varchar(1000) DEFAULT NULL,\n  `severity` varchar(45) DEFAULT NULL,\n  `weight` varchar(45) DEFAULT NULL,\n  `vulnDiscussion` text,\n  `falsePositives` text,\n  `falseNegatives` text,\n  `documentable` varchar(45) DEFAULT NULL,\n  `mitigations` text,\n  `severityOverrideGuidance` text,\n  `potentialImpacts` text,\n  `thirdPartyTools` text,\n  `mitigationControl` text,\n  `responsibility` varchar(255) DEFAULT NULL,\n  `iaControls` varchar(255) DEFAULT NULL,\n  `checkSystem` varchar(255) DEFAULT NULL,\n  `checkDigest` binary(32) DEFAULT NULL,\n  `fixref` varchar(255) DEFAULT NULL,\n  `fixDigest` binary(32) DEFAULT NULL,\n  PRIMARY KEY (`rgrId`),\n  UNIQUE KEY `rev_group_rule_UNIQUE` (`revId`,`groupId`,`ruleId`),\n  KEY `idx_rgrm_ruleId` (`ruleId`),\n  KEY `index5` (`fixDigest`),\n  KEY `idx_version_check_digest` (`version`,`checkDigest`),\n  CONSTRAINT `fk_rev_group_rule_map_1` FOREIGN KEY (`revId`) REFERENCES `revision` (`revId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `review`\n--\n\nDROP TABLE IF EXISTS `review`;\nCREATE TABLE `review` (\n  `reviewId` int NOT NULL AUTO_INCREMENT,\n  `assetId` int DEFAULT NULL,\n  `ruleId` varchar(45) DEFAULT NULL,\n  `resultId` int DEFAULT NULL,\n  `detail` mediumtext,\n  `comment` mediumtext,\n  `autoResult` bit(1) DEFAULT b'0',\n  `ts` datetime NOT NULL,\n  `userId` int DEFAULT NULL,\n  `statusId` int NOT NULL,\n  `statusText` varchar(512) DEFAULT NULL,\n  `statusUserId` int DEFAULT NULL,\n  `statusTs` datetime DEFAULT NULL,\n  `metadata` json NOT NULL DEFAULT (json_object()),\n  `touchTs` datetime GENERATED ALWAYS AS (greatest(`ts`,`statusTs`)) STORED,\n  `resultEngine` json DEFAULT NULL,\n  `reProduct` varchar(255) GENERATED ALWAYS AS (json_unquote(json_extract(`resultEngine`,_utf8mb4'$.product'))) VIRTUAL,\n  `reType` varchar(255) GENERATED ALWAYS AS (json_unquote(json_extract(`resultEngine`,_utf8mb4'$.type'))) VIRTUAL,\n  `reAuthority` varchar(255) GENERATED ALWAYS AS (json_unquote(json_extract(`resultEngine`,_utf8mb4'$.overrides[0].authority'))) VIRTUAL,\n  `version` varchar(45) NOT NULL,\n  `checkDigest` binary(32) NOT NULL,\n  PRIMARY KEY (`reviewId`),\n  KEY `INDEX_RESULTID` (`resultId`),\n  KEY `INDEX_RULEID` (`ruleId`),\n  KEY `INDEX_STATUSID` (`statusId`),\n  KEY `idx_vcd` (`version`,`checkDigest`),\n  KEY `idx_asset_vcd` (`assetId`,`version`,`checkDigest`),\n  KEY `idx_reProduct` (`reProduct`),\n  KEY `idx_reType` (`reType`),\n  KEY `idx_reAuthority` (`reAuthority`),\n  CONSTRAINT `FK_REVIEWS_1` FOREIGN KEY (`assetId`) REFERENCES `asset` (`assetId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `review_history`\n--\n\nDROP TABLE IF EXISTS `review_history`;\nCREATE TABLE `review_history` (\n  `historyId` bigint unsigned NOT NULL AUTO_INCREMENT,\n  `reviewId` int NOT NULL,\n  `resultId` int NOT NULL,\n  `detail` mediumtext,\n  `comment` mediumtext,\n  `autoResult` bit(1) DEFAULT NULL,\n  `ts` datetime NOT NULL,\n  `userId` int DEFAULT NULL,\n  `statusId` int NOT NULL,\n  `statusText` varchar(512) DEFAULT NULL,\n  `statusUserId` int DEFAULT NULL,\n  `statusTs` datetime DEFAULT NULL,\n  `touchTs` datetime DEFAULT NULL,\n  `resultEngine` json DEFAULT NULL,\n  `reProduct` varchar(255) GENERATED ALWAYS AS (json_unquote(json_extract(`resultEngine`,_utf8mb4'$.product'))) VIRTUAL,\n  `reType` varchar(255) GENERATED ALWAYS AS (json_unquote(json_extract(`resultEngine`,_utf8mb4'$.type'))) VIRTUAL,\n  `reAuthority` varchar(255) GENERATED ALWAYS AS (json_unquote(json_extract(`resultEngine`,_utf8mb4'$.overrides[0].authority'))) VIRTUAL,\n  `ruleId` varchar(45) DEFAULT NULL,\n  PRIMARY KEY (`historyId`),\n  KEY `index_reviewId` (`reviewId`),\n  KEY `idx_reProduct` (`reProduct`),\n  KEY `idx_reType` (`reType`),\n  KEY `idx_reAuthority` (`reAuthority`),\n  CONSTRAINT `fk_review_history_1` FOREIGN KEY (`reviewId`) REFERENCES `review` (`reviewId`) ON DELETE CASCADE ON UPDATE RESTRICT\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `revision`\n--\n\nDROP TABLE IF EXISTS `revision`;\nCREATE TABLE `revision` (\n  `revId` varchar(255) NOT NULL,\n  `benchmarkId` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_as_cs DEFAULT NULL,\n  `version` int NOT NULL,\n  `release` varchar(45) NOT NULL,\n  `revisionStr` varchar(45) GENERATED ALWAYS AS (concat(_utf8mb4'V',`version`,_utf8mb4'R',`release`)) VIRTUAL,\n  `benchmarkDate` varchar(45) DEFAULT NULL,\n  `benchmarkDateSql` date DEFAULT NULL,\n  `status` varchar(45) DEFAULT NULL,\n  `statusDate` varchar(45) DEFAULT NULL,\n  `marking` varchar(10) DEFAULT NULL,\n  `description` varchar(4000) DEFAULT NULL,\n  `active` tinyint DEFAULT '1',\n  `groupCount` int NOT NULL DEFAULT '0',\n  `ruleCount` int GENERATED ALWAYS AS (((`highCount` + `mediumCount`) + `lowCount`)) STORED,\n  `checkCount` int NOT NULL DEFAULT '0',\n  `fixCount` int NOT NULL DEFAULT '0',\n  `lowCount` int NOT NULL DEFAULT '0',\n  `mediumCount` int NOT NULL DEFAULT '0',\n  `highCount` int NOT NULL DEFAULT '0',\n  PRIMARY KEY (`revId`),\n  UNIQUE KEY `uidx_revision_benchmarkId_version_release` (`benchmarkId`,`version`,`release`),\n  KEY `idx_revision_benchmark_revisionStr` (`benchmarkId`,`revisionStr`),\n  CONSTRAINT `FK_REVISION_1` FOREIGN KEY (`benchmarkId`) REFERENCES `stig` (`benchmarkId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `rule_version_check_digest`\n--\n\nDROP TABLE IF EXISTS `rule_version_check_digest`;\nCREATE TABLE `rule_version_check_digest` (\n  `ruleId` varchar(255) NOT NULL,\n  `version` varchar(45) NOT NULL,\n  `checkDigest` binary(32) NOT NULL,\n  PRIMARY KEY (`ruleId`),\n  KEY `index_vcd` (`version`,`checkDigest`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `severity_cat_map`\n--\n\nDROP TABLE IF EXISTS `severity_cat_map`;\nCREATE TABLE `severity_cat_map` (\n  `id` int NOT NULL AUTO_INCREMENT,\n  `severity` varchar(45) NOT NULL,\n  `cat` int NOT NULL,\n  `roman` varchar(45) NOT NULL,\n  PRIMARY KEY (`id`),\n  KEY `idx_scm_severity` (`severity`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `status`\n--\n\nDROP TABLE IF EXISTS `status`;\nCREATE TABLE `status` (\n  `statusId` int NOT NULL,\n  `api` varchar(16) NOT NULL,\n  `en` varchar(16) NOT NULL,\n  PRIMARY KEY (`statusId`),\n  UNIQUE KEY `IDX_API` (`api`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `stig`\n--\n\nDROP TABLE IF EXISTS `stig`;\nCREATE TABLE `stig` (\n  `benchmarkId` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_as_cs NOT NULL,\n  `title` varchar(255) NOT NULL,\n  PRIMARY KEY (`benchmarkId`),\n  KEY `idx_benchmark_title` (`title`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `stig_asset_map`\n--\n\nDROP TABLE IF EXISTS `stig_asset_map`;\nCREATE TABLE `stig_asset_map` (\n  `saId` int NOT NULL AUTO_INCREMENT,\n  `benchmarkId` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_as_cs DEFAULT NULL,\n  `assetId` int NOT NULL,\n  `userIds` json DEFAULT NULL,\n  `minTs` datetime DEFAULT NULL,\n  `maxTs` datetime DEFAULT NULL,\n  `saved` int DEFAULT NULL,\n  `savedResultEngine` int DEFAULT NULL,\n  `submitted` int DEFAULT NULL,\n  `submittedResultEngine` int DEFAULT NULL,\n  `rejected` int DEFAULT NULL,\n  `rejectedResultEngine` int DEFAULT NULL,\n  `accepted` int DEFAULT NULL,\n  `acceptedResultEngine` int DEFAULT NULL,\n  `highCount` int DEFAULT NULL,\n  `mediumCount` int DEFAULT NULL,\n  `lowCount` int DEFAULT NULL,\n  `notchecked` int DEFAULT NULL,\n  `notcheckedResultEngine` int DEFAULT NULL,\n  `notapplicable` int DEFAULT NULL,\n  `notapplicableResultEngine` int DEFAULT NULL,\n  `pass` int DEFAULT NULL,\n  `passResultEngine` int DEFAULT NULL,\n  `fail` int DEFAULT NULL,\n  `failResultEngine` int DEFAULT NULL,\n  `unknown` int DEFAULT NULL,\n  `unknownResultEngine` int DEFAULT NULL,\n  `error` int DEFAULT NULL,\n  `errorResultEngine` int DEFAULT NULL,\n  `notselected` int DEFAULT NULL,\n  `notselectedResultEngine` int DEFAULT NULL,\n  `informational` int DEFAULT NULL,\n  `informationalResultEngine` int DEFAULT NULL,\n  `fixed` int DEFAULT NULL,\n  `fixedResultEngine` int DEFAULT NULL,\n  `maxTouchTs` datetime DEFAULT NULL,\n  `assessedHighCount` int DEFAULT NULL,\n  `assessedMediumCount` int DEFAULT NULL,\n  `assessedLowCount` int DEFAULT NULL,\n  PRIMARY KEY (`saId`),\n  UNIQUE KEY `IDX_BAID` (`benchmarkId`,`assetId`),\n  KEY `IDX_ASSETID` (`assetId`),\n  CONSTRAINT `FK_STIG_ASSET_MAP_1` FOREIGN KEY (`assetId`) REFERENCES `asset` (`assetId`) ON DELETE CASCADE ON UPDATE CASCADE,\n  CONSTRAINT `FK_STIG_ASSET_MAP_2` FOREIGN KEY (`benchmarkId`) REFERENCES `stig` (`benchmarkId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `task`\n--\n\nDROP TABLE IF EXISTS `task`;\nCREATE TABLE `task` (\n  `taskId` int NOT NULL AUTO_INCREMENT,\n  `name` varchar(45) NOT NULL,\n  `description` varchar(255) DEFAULT NULL,\n  `command` varchar(255) NOT NULL,\n  PRIMARY KEY (`taskId`),\n  UNIQUE KEY `idx_task_name` (`name`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `task_output`\n--\n\nDROP TABLE IF EXISTS `task_output`;\nCREATE TABLE `task_output` (\n  `seq` int NOT NULL AUTO_INCREMENT,\n  `ts` timestamp(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),\n  `runId` binary(16) DEFAULT NULL,\n  `taskId` int DEFAULT NULL,\n  `type` varchar(45) NOT NULL,\n  `message` varchar(255) NOT NULL,\n  PRIMARY KEY (`seq`),\n  KEY `fk_task_output_runId` (`runId`),\n  KEY `fk_task_output_taskId` (`taskId`),\n  CONSTRAINT `fk_task_output_runId` FOREIGN KEY (`runId`) REFERENCES `job_run` (`runId`) ON DELETE CASCADE,\n  CONSTRAINT `fk_task_output_taskId` FOREIGN KEY (`taskId`) REFERENCES `task` (`taskId`) ON DELETE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `user_data`\n--\n\nDROP TABLE IF EXISTS `user_data`;\nCREATE TABLE `user_data` (\n  `userId` int NOT NULL AUTO_INCREMENT,\n  `username` varchar(255) NOT NULL,\n  `created` datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,\n  `lastAccess` int DEFAULT NULL,\n  `lastClaims` json DEFAULT (_utf8mb4'{}'),\n  `status` enum('available','unavailable') NOT NULL DEFAULT 'available',\n  `statusDate` datetime NOT NULL DEFAULT (`created`),\n  `statusUser` int DEFAULT NULL,\n  `webPreferences` json NOT NULL DEFAULT (_utf8mb4'{\"darkMode\": true, \"lastWhatsNew\": \"2000-01-01\"}'),\n  PRIMARY KEY (`userId`),\n  UNIQUE KEY `INDEX_username` (`username`),\n  KEY `INDEX_status` (`status`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `user_group`\n--\n\nDROP TABLE IF EXISTS `user_group`;\nCREATE TABLE `user_group` (\n  `userGroupId` int NOT NULL AUTO_INCREMENT,\n  `name` varchar(255) NOT NULL,\n  `description` varchar(255) DEFAULT NULL,\n  `createdUserId` int NOT NULL,\n  `createdDate` datetime DEFAULT CURRENT_TIMESTAMP,\n  `modifiedUserId` int NOT NULL,\n  `modifiedDate` datetime DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,\n  PRIMARY KEY (`userGroupId`),\n  UNIQUE KEY `idx_name` (`name`),\n  KEY `fk_user_group_1_idx` (`createdUserId`),\n  KEY `fk_user_group_2_idx` (`modifiedUserId`),\n  CONSTRAINT `fk_user_group_1` FOREIGN KEY (`createdUserId`) REFERENCES `user_data` (`userId`) ON DELETE RESTRICT ON UPDATE RESTRICT,\n  CONSTRAINT `fk_user_group_2` FOREIGN KEY (`modifiedUserId`) REFERENCES `user_data` (`userId`) ON DELETE RESTRICT ON UPDATE RESTRICT\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Table structure for table `user_group_user_map`\n--\n\nDROP TABLE IF EXISTS `user_group_user_map`;\nCREATE TABLE `user_group_user_map` (\n  `ugumId` int NOT NULL AUTO_INCREMENT,\n  `userGroupId` int NOT NULL,\n  `userId` int NOT NULL,\n  PRIMARY KEY (`ugumId`),\n  UNIQUE KEY `INDEX_UG_USER` (`userGroupId`,`userId`),\n  KEY `fk_user_group_map_2_idx` (`userId`),\n  CONSTRAINT `fk_user_group_map_1` FOREIGN KEY (`userGroupId`) REFERENCES `user_group` (`userGroupId`) ON DELETE CASCADE ON UPDATE CASCADE,\n  CONSTRAINT `fk_user_group_map_2` FOREIGN KEY (`userId`) REFERENCES `user_data` (`userId`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;\n\n--\n-- Temporary view structure for view `v_current_rev`\n--\n\nDROP TABLE IF EXISTS `v_current_rev`;\n/*!50001 DROP VIEW IF EXISTS `v_current_rev`*/;\n/*!50001 CREATE VIEW `v_current_rev` AS SELECT \n 1 AS `revId`,\n 1 AS `benchmarkId`,\n 1 AS `version`,\n 1 AS `release`,\n 1 AS `benchmarkDate`,\n 1 AS `benchmarkDateSql`,\n 1 AS `status`,\n 1 AS `statusDate`,\n 1 AS `marking`,\n 1 AS `description`,\n 1 AS `active`,\n 1 AS `groupCount`,\n 1 AS `ruleCount`,\n 1 AS `lowCount`,\n 1 AS `mediumCount`,\n 1 AS `highCount`,\n 1 AS `checkCount`,\n 1 AS `fixCount`*/;\n\n--\n-- Temporary view structure for view `v_default_rev`\n--\n\nDROP TABLE IF EXISTS `v_default_rev`;\n/*!50001 DROP VIEW IF EXISTS `v_default_rev`*/;\n/*!50001 CREATE VIEW `v_default_rev` AS SELECT \n 1 AS `collectionId`,\n 1 AS `benchmarkId`,\n 1 AS `revId`,\n 1 AS `revisionPinned`*/;\n\n--\n-- Temporary view structure for view `v_latest_rev`\n--\n\nDROP TABLE IF EXISTS `v_latest_rev`;\n/*!50001 DROP VIEW IF EXISTS `v_latest_rev`*/;\n/*!50001 CREATE VIEW `v_latest_rev` AS SELECT \n 1 AS `revId`,\n 1 AS `benchmarkId`,\n 1 AS `revisionStr`*/;\n\n--\n-- Dumping events for database 'stigman'\n--\n/*!50106 SET @save_time_zone= @@TIME_ZONE */ ;\n/*!50106 DROP EVENT IF EXISTS `job-1-stigman` */;\nDELIMITER $\n/*!50003 SET @saved_col_connection = @@collation_connection */ $\n/*!50003 SET collation_connection  = utf8mb4_0900_ai_ci */ $\n/*!50003 SET @saved_sql_mode       = @@sql_mode */ $\n/*!50003 SET sql_mode              = 'IGNORE_SPACE,ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION' */ $\n/*!50003 SET @saved_time_zone      = @@time_zone */ $\n/*!50003 SET time_zone             = 'SYSTEM' */ $\n/*!50106 CREATE*/ /*!50117 */ /*!50106 EVENT `job-1-stigman` ON SCHEDULE EVERY 1 DAY STARTS '2025-10-01 05:00:00' ON COMPLETION NOT PRESERVE DISABLE DO CALL run_job(1, NULL) */ $\n/*!50003 SET time_zone             = @saved_time_zone */ $\n/*!50003 SET sql_mode              = @saved_sql_mode */ $\n/*!50003 SET collation_connection  = @saved_col_connection */ $\nDELIMITER ;\n/*!50106 SET TIME_ZONE= @save_time_zone */ ;\n\n--\n-- Dumping routines for database 'stigman'\n--\n/*!50003 DROP PROCEDURE IF EXISTS `analyze_tables` */;\n/*!50003 SET @saved_col_connection = @@collation_connection */ ;\n/*!50003 SET collation_connection  = utf8mb4_0900_ai_ci */ ;\n/*!50003 SET @saved_sql_mode       = @@sql_mode */ ;\n/*!50003 SET sql_mode              = 'IGNORE_SPACE,ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION' */ ;\nDELIMITER $\nCREATE PROCEDURE `analyze_tables`(IN in_tables JSON)\nBEGIN\n          DECLARE v_itemCount INT;\n          DECLARE v_currentCount INT;\n          DECLARE v_table VARCHAR(255);\n\n          DECLARE EXIT HANDLER FOR SQLEXCEPTION\n          BEGIN\n            DECLARE err_code INT;\n            DECLARE err_msg TEXT;\n            GET STACKED DIAGNOSTICS CONDITION 1\n              err_code = MYSQL_ERRNO, err_msg = MESSAGE_TEXT;\n              IF err_msg = NULL THEN\n          SET err_msg = '';\n              END IF;\n            CALL task_output('error',concat('code: ', err_code, ' message: ', err_msg));\n            RESIGNAL;\n          END;\n\n          -- Runtime context is available via user variables (null if running outside a job)\n        CALL task_output('info', 'task started');\n\n        select JSON_LENGTH(in_tables) INTO v_itemCount;\n        SET v_currentCount = 0;\n        WHILE v_currentCount < v_itemCount DO\n          SET v_table = json_unquote(json_extract(in_tables, concat('$[', v_currentCount, ']')));\n          CALL task_output('info', concat('analyze table: ', v_table));\n          SET @sql = CONCAT('ANALYZE TABLE ', v_table);\n          PREPARE stmt_analyze_tables FROM @sql;\n          EXECUTE stmt_analyze_tables;\n          DEALLOCATE PREPARE stmt_analyze_tables;\n          SET v_currentCount = v_currentCount + 1;\n        END WHILE;\n        CALL task_output('info', 'task finished');\n\n    END $\nDELIMITER ;\n/*!50003 SET sql_mode              = @saved_sql_mode */ ;\n/*!50003 SET collation_connection  = @saved_col_connection */ ;\n/*!50003 DROP PROCEDURE IF EXISTS `delete_disabled` */;\n/*!50003 SET @saved_col_connection = @@collation_connection */ ;\n/*!50003 SET collation_connection  = utf8mb4_0900_ai_ci */ ;\n/*!50003 SET @saved_sql_mode       = @@sql_mode */ ;\n/*!50003 SET sql_mode              = 'IGNORE_SPACE,ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION' */ ;\nDELIMITER $\nCREATE PROCEDURE `delete_disabled`()\nBEGIN\n    DECLARE v_incrementValue INT DEFAULT 10000;\n    DECLARE v_curMinId BIGINT DEFAULT 1;\n    DECLARE v_curMaxId BIGINT DEFAULT v_incrementValue + 1;\n    DECLARE v_numCollectionIds INT;\n    DECLARE v_numAssetIds INT;\n    DECLARE v_numReviewIds INT;\n    DECLARE v_numHistoryIds INT;\n    DECLARE EXIT HANDLER FOR SQLEXCEPTION\n    BEGIN\n      DECLARE err_code INT;\n      DECLARE err_msg TEXT;\n      GET STACKED DIAGNOSTICS CONDITION 1 err_code = MYSQL_ERRNO, err_msg = MESSAGE_TEXT;\n      CALL task_output('error', concat('code: ', err_code, ' message: ', err_msg));\n      RESIGNAL;\n    END;\n\n    -- Runtime context is available via user variables (null if running outside a job)\n    CALL task_output('info','task started');\n\n    drop temporary table if exists t_collectionIds;\n    create temporary table t_collectionIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n      select collectionId from collection where isEnabled is null;\n    select max(seq) into v_numCollectionIds from t_collectionIds;\n    CALL task_output('info', concat('found ', ifnull(v_numCollectionIds, 0), ' collections to delete'));\n\n    drop temporary table if exists t_assetIds;\n    create temporary table t_assetIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n      select assetId from asset where isEnabled is null or collectionId in (select collectionId from t_collectionIds);\n    select max(seq) into v_numAssetIds from t_assetIds;\n    CALL task_output('info', concat('found ', ifnull(v_numAssetIds, 0), ' assets to delete'));\n\n    drop temporary table if exists t_reviewIds;\n    create temporary table t_reviewIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n      select reviewId from review where assetId in (select assetId from t_assetIds);\n    select max(seq) into v_numReviewIds from t_reviewIds;\n    CALL task_output('info', concat('found ', ifnull(v_numReviewIds, 0), ' reviews to delete'));\n\n    drop temporary table if exists t_historyIds;\n    create temporary table t_historyIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n      select historyId from review_history where reviewId in (select reviewId from t_reviewIds);\n    select max(seq) into v_numHistoryIds from t_historyIds;\n    CALL task_output('info', concat('found ', ifnull(v_numHistoryIds, 0), ' history records to delete'));\n\n    IF v_numHistoryIds > 0 THEN\n    CALL task_output('info', concat('deleting ', v_numHistoryIds, ' history records'));\n    REPEAT\n      delete from review_history where historyId IN (\n          select historyId from t_historyIds where seq >= v_curMinId and seq < v_curMaxId\n        );\n      SET v_curMinId = v_curMinId + v_incrementValue;\n      SET v_curMaxId = v_curMaxId + v_incrementValue;\n    UNTIL ROW_COUNT() = 0 END REPEAT;\n    END IF;\n    drop temporary table if exists t_historyIds;\n\n    SET v_curMinId = 1;\n    SET v_curMaxId = v_curMinId + v_incrementValue;\n    IF v_numReviewIds > 0 THEN\n      CALL task_output('info', concat('deleting ', v_numReviewIds, ' reviews'));\n      REPEAT\n        delete from review where reviewId IN (\n            select reviewId from t_reviewIds where seq >= v_curMinId and seq < v_curMaxId\n          );\n        SET v_curMinId = v_curMinId + v_incrementValue;\n        SET v_curMaxId = v_curMaxId + v_incrementValue;\n      UNTIL ROW_COUNT() = 0 END REPEAT;\n    END IF;\n    drop temporary table if exists t_reviewIds;\n\n    SET v_curMinId = 1;\n    SET v_curMaxId = v_curMinId + v_incrementValue;\n    IF v_numAssetIds > 0 THEN\n      CALL task_output('info', concat('deleting ', v_numAssetIds, ' assets'));\n      REPEAT\n        delete from asset where assetId IN (\n            select assetId from t_assetIds where seq >= v_curMinId and seq < v_curMaxId\n          );\n        SET v_curMinId = v_curMinId + v_incrementValue;\n        SET v_curMaxId = v_curMaxId + v_incrementValue;\n    UNTIL ROW_COUNT() = 0 END REPEAT;\n    END IF;\n    drop temporary table if exists t_assetIds;\n\n    SET v_curMinId = 1;\n    SET v_curMaxId = v_curMinId + v_incrementValue;\n    IF v_numCollectionIds > 0 THEN\n      CALL task_output('info', concat('deleting ', v_numCollectionIds, ' collections'));\n      REPEAT\n        delete from collection where collectionId IN (\n            select collectionId from t_collectionIds where seq >= v_curMinId and seq < v_curMaxId\n          );\n        SET v_curMinId = v_curMinId + v_incrementValue;\n        SET v_curMaxId = v_curMaxId + v_incrementValue;\n      UNTIL ROW_COUNT() = 0 END REPEAT;\n    END IF;\n    drop temporary table if exists t_collectionIds;\n\n    CALL task_output('info', 'task finished');\n    END $\nDELIMITER ;\n/*!50003 SET sql_mode              = @saved_sql_mode */ ;\n/*!50003 SET collation_connection  = @saved_col_connection */ ;\n/*!50003 DROP PROCEDURE IF EXISTS `delete_unmapped` */;\n/*!50003 SET @saved_col_connection = @@collation_connection */ ;\n/*!50003 SET collation_connection  = utf8mb4_0900_ai_ci */ ;\n/*!50003 SET @saved_sql_mode       = @@sql_mode */ ;\n/*!50003 SET sql_mode              = 'IGNORE_SPACE,ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION' */ ;\nDELIMITER $\nCREATE PROCEDURE `delete_unmapped`(IN in_context VARCHAR(255))\nBEGIN\n      DECLARE v_numReviewIds INT;\n      DECLARE v_numHistoryIds INT;\n      DECLARE v_incrementValue INT DEFAULT 10000;\n      DECLARE v_curMinId BIGINT DEFAULT 1;\n      DECLARE v_curMaxId BIGINT DEFAULT v_incrementValue + 1;\n\n      DECLARE EXIT HANDLER FOR SQLEXCEPTION\n      BEGIN\n        DECLARE err_code INT;\n        DECLARE err_msg TEXT;\n        GET STACKED DIAGNOSTICS CONDITION 1\n          err_code = MYSQL_ERRNO, err_msg = MESSAGE_TEXT;\n        CALL task_output('error',concat('code: ', err_code, ' message: ', err_msg));\n        RESIGNAL;\n      END;\n\n      -- Runtime context is available via user variables (null if running outside a job)\n      CALL task_output('info', 'task started');\n\n      drop temporary table if exists t_reviewIds;\n      create temporary table t_reviewIds (seq INT AUTO_INCREMENT PRIMARY KEY, reviewId INT);\n      -- Context-specific logic\n      IF in_context = 'system' THEN\n        INSERT into t_reviewIds (reviewId)\n        select r.reviewId from review r\n        left join rev_group_rule_map rgr on (r.version = rgr.version and r.checkDigest = rgr.checkDigest)\n        where rgr.rgrId is null;\n      ELSEIF in_context = 'asset' THEN\n        INSERT into t_reviewIds (reviewId)\n        select\n          r.reviewId\n        from\n          review r\n          left join rev_group_rule_map rgr on (r.version = rgr.version and r.checkDigest = rgr.checkDigest)\n          left join revision on (rgr.revId = revision.revId)\n          left join stig_asset_map sa on (r.assetId = sa.assetId and revision.benchmarkId = sa.benchmarkId)\n        group by\n          r.reviewId\n        having\n          count(sa.saId) = 0;\n      END IF;\n\n      select max(seq) into v_numReviewIds from t_reviewIds;\n      CALL task_output('info', concat('found ', ifnull(v_numReviewIds, 0), ' reviews to delete'));\n\n      IF v_numReviewIds > 0 THEN\n        drop temporary table if exists t_historyIds;\n        create temporary table t_historyIds (seq INT AUTO_INCREMENT PRIMARY KEY)\n          select historyId from review_history where reviewId in (select reviewId from t_reviewIds);\n        select max(seq) into v_numHistoryIds from t_historyIds;\n        CALL task_output('info', concat('found ', ifnull(v_numHistoryIds, 0), ' history records to delete'));\n        IF v_numHistoryIds > 0 THEN\n          CALL task_output('info', concat('deleting ', v_numHistoryIds, ' history records'));\n          SET v_curMinId = 1;\n          SET v_curMaxId = v_curMinId + v_incrementValue;\n          REPEAT\n            delete from review_history where historyId IN (\n                select historyId from t_historyIds where seq >= v_curMinId and seq < v_curMaxId\n              );\n            SET v_curMinId = v_curMinId + v_incrementValue;\n            SET v_curMaxId = v_curMaxId + v_incrementValue;\n          UNTIL ROW_COUNT() = 0 END REPEAT;\n        END IF;\n        CALL task_output('info', concat('deleting ', v_numReviewIds, ' reviews'));\n        SET v_curMinId = 1;\n        SET v_curMaxId = v_curMinId + v_incrementValue;\n        REPEAT\n          delete from review where reviewId IN (\n              select reviewId from t_reviewIds where seq >= v_curMinId and seq < v_curMaxId\n            );\n          SET v_curMinId = v_curMinId + v_incrementValue;\n          SET v_curMaxId = v_curMaxId + v_incrementValue;\n        UNTIL ROW_COUNT() = 0 END REPEAT;\n      END IF;\n      CALL task_output('info', 'task finished');\n    END $\nDELIMITER ;\n/*!50003 SET sql_mode              = @saved_sql_mode */ ;\n/*!50003 SET collation_connection  = @saved_col_connection */ ;\n/*!50003 DROP PROCEDURE IF EXISTS `run_job` */;\n/*!50003 SET @saved_col_connection = @@collation_connection */ ;\n/*!50003 SET collation_connection  = utf8mb4_0900_ai_ci */ ;\n/*!50003 SET @saved_sql_mode       = @@sql_mode */ ;\n/*!50003 SET sql_mode              = 'IGNORE_SPACE,ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION' */ ;\nDELIMITER $\nCREATE PROCEDURE `run_job`(\n    IN in_jobId INT,\n    IN in_runIdStr VARCHAR(36)\n  )\nmain:BEGIN\n        DECLARE v_done INT DEFAULT FALSE;\n        DECLARE v_jrId INT;\n        DECLARE v_numTasks INT;\n        DECLARE v_currentTaskId INT;\n        DECLARE v_currentTaskName VARCHAR(255);\n        DECLARE v_currentCommand VARCHAR(255);\n        DECLARE v_currentTaskNum INT DEFAULT 0;\n        DECLARE v_param_string TEXT;\n        DECLARE cur CURSOR FOR\n          SELECT\n            jt.taskId,\n            t.name,\n            t.command\n          FROM\n            job_task_map jt\n            inner join task t on (jt.taskId = t.taskId)\n          WHERE\n            jobId = in_jobId\n          ORDER BY jtId ASC;\n        DECLARE CONTINUE HANDLER FOR NOT FOUND SET v_done = TRUE;\n        DECLARE EXIT HANDLER FOR SQLEXCEPTION\n        BEGIN\n          DECLARE err_code INT;\n          DECLARE err_msg TEXT;\n          GET STACKED DIAGNOSTICS CONDITION 1 err_code = MYSQL_ERRNO, err_msg = MESSAGE_TEXT;\n          CALL task_output('error', concat('code: ', err_code, ' message: ', err_msg));\n          UPDATE job_run SET state = 'failed' WHERE runId = @runId;\n        END;\n\n        -- setup runtime context (null if running outside a job)\n        IF in_runIdStr IS NOT NULL AND in_runIdStr REGEXP '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$' THEN\n          SET @runId = UUID_TO_BIN(in_runIdStr, 1);\n        ELSE\n          SET @runId = UUID_TO_BIN(UUID(), 1);\n        END IF;\n        SET @taskId = NULL;\n        INSERT INTO job_run(jobId, runId, state) VALUES (in_jobId, @runId, 'running');\n        CALL task_output('info', concat('run started for jobId ', in_jobId));\n\n        -- Get the number of tasks for the job\n        SELECT COUNT(*) INTO v_numTasks FROM job_task_map WHERE jobId = in_jobId;\n\n        IF v_numTasks = 0 THEN\n          CALL task_output('error', 'no tasks to run');\n          UPDATE job_run SET state = 'failed' WHERE runId = @runId AND state = 'running';\n          LEAVE main; -- No tasks to run, exit the procedure\n        END IF;\n\n\n        OPEN cur;\n        read_loop: LOOP\n          FETCH cur INTO v_currentTaskId, v_currentTaskName, v_currentCommand;\n          IF v_done THEN\n            LEAVE read_loop;\n          END IF;\n          SET v_currentTaskNum = v_currentTaskNum + 1;\n\n          SET @sql = CONCAT('CALL ', v_currentCommand);\n          PREPARE stmt_run_job FROM @sql;\n          CALL task_output('info', concat('Beginning task ', v_currentTaskName, ' (', v_currentTaskNum, '/', v_numTasks, ')'));\n          SET @taskId = v_currentTaskId;\n          EXECUTE stmt_run_job;\n          DEALLOCATE PREPARE stmt_run_job;\n          SET @taskId = NULL;\n          CALL task_output('info', concat('Ended task ', v_currentTaskName, ' (', v_currentTaskNum, '/', v_numTasks, ')'));\n        END LOOP;\n        CLOSE cur;\n\n        -- === Post-task-loop logic ===\n        UPDATE job_run SET state = 'completed' WHERE runId = @runId AND state = 'running';\n        CALL task_output('info', concat('run completed for jobId ', in_jobId));\n\n    END $\nDELIMITER ;\n/*!50003 SET sql_mode              = @saved_sql_mode */ ;\n/*!50003 SET collation_connection  = @saved_col_connection */ ;\n/*!50003 DROP PROCEDURE IF EXISTS `task_output` */;\n/*!50003 SET @saved_col_connection = @@collation_connection */ ;\n/*!50003 SET collation_connection  = utf8mb4_0900_ai_ci */ ;\n/*!50003 SET @saved_sql_mode       = @@sql_mode */ ;\n/*!50003 SET sql_mode              = 'IGNORE_SPACE,ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION' */ ;\nDELIMITER $\nCREATE PROCEDURE `task_output`(\n    IN in_type VARCHAR(45),\n    IN in_message VARCHAR(255)\n  )\nBEGIN\n      IF in_message IS NULL THEN SET in_message = ''; END IF;\n      insert into task_output (runId, taskId, type, message) values (@runId, @taskId, in_type, in_message);\n    END $\nDELIMITER ;\n/*!50003 SET sql_mode              = @saved_sql_mode */ ;\n/*!50003 SET collation_connection  = @saved_col_connection */ ;\n\n--\n-- Final view structure for view `enabled_asset`\n--\n\n/*!50001 DROP VIEW IF EXISTS `enabled_asset`*/;\n/*!50001 SET @saved_col_connection     = @@collation_connection */;\n/*!50001 SET collation_connection      = utf8mb4_0900_ai_ci */;\n/*!50001 CREATE ALGORITHM=UNDEFINED */\n/*!50001 VIEW `enabled_asset` AS select `asset`.`assetId` AS `assetId`,`asset`.`name` AS `name`,`asset`.`fqdn` AS `fqdn`,`asset`.`collectionId` AS `collectionId`,`asset`.`ip` AS `ip`,`asset`.`mac` AS `mac`,`asset`.`description` AS `description`,`asset`.`noncomputing` AS `noncomputing`,`asset`.`metadata` AS `metadata`,`asset`.`state` AS `state`,`asset`.`stateDate` AS `stateDate`,`asset`.`stateUserId` AS `stateUserId`,`asset`.`isEnabled` AS `isEnabled` from `asset` where (`asset`.`state` = 'enabled') */;\n/*!50001 SET collation_connection      = @saved_col_connection */;\n\n--\n-- Final view structure for view `enabled_collection`\n--\n\n/*!50001 DROP VIEW IF EXISTS `enabled_collection`*/;\n/*!50001 SET @saved_col_connection     = @@collation_connection */;\n/*!50001 SET collation_connection      = utf8mb4_0900_ai_ci */;\n/*!50001 CREATE ALGORITHM=UNDEFINED */\n/*!50001 VIEW `enabled_collection` AS select `collection`.`collectionId` AS `collectionId`,`collection`.`name` AS `name`,`collection`.`description` AS `description`,`collection`.`settings` AS `settings`,`collection`.`metadata` AS `metadata`,`collection`.`created` AS `created`,`collection`.`state` AS `state`,`collection`.`createdUserId` AS `createdUserId`,`collection`.`stateDate` AS `stateDate`,`collection`.`stateUserId` AS `stateUserId`,`collection`.`isNameUnavailable` AS `isNameUnavailable`,`collection`.`isEnabled` AS `isEnabled` from `collection` where (`collection`.`state` = 'enabled') */;\n/*!50001 SET collation_connection      = @saved_col_connection */;\n\n--\n-- Final view structure for view `v_current_rev`\n--\n\n/*!50001 DROP VIEW IF EXISTS `v_current_rev`*/;\n/*!50001 SET @saved_col_connection     = @@collation_connection */;\n/*!50001 SET collation_connection      = utf8mb4_0900_ai_ci */;\n/*!50001 CREATE ALGORITHM=UNDEFINED */\n/*!50001 VIEW `v_current_rev` AS select `rr`.`revId` AS `revId`,`rr`.`benchmarkId` AS `benchmarkId`,`rr`.`version` AS `version`,`rr`.`release` AS `release`,`rr`.`benchmarkDate` AS `benchmarkDate`,`rr`.`benchmarkDateSql` AS `benchmarkDateSql`,`rr`.`status` AS `status`,`rr`.`statusDate` AS `statusDate`,`rr`.`marking` AS `marking`,`rr`.`description` AS `description`,`rr`.`active` AS `active`,`rr`.`groupCount` AS `groupCount`,`rr`.`ruleCount` AS `ruleCount`,`rr`.`lowCount` AS `lowCount`,`rr`.`mediumCount` AS `mediumCount`,`rr`.`highCount` AS `highCount`,`rr`.`checkCount` AS `checkCount`,`rr`.`fixCount` AS `fixCount` from (select `r`.`revId` AS `revId`,`r`.`benchmarkId` AS `benchmarkId`,`r`.`version` AS `version`,`r`.`release` AS `release`,`r`.`benchmarkDate` AS `benchmarkDate`,`r`.`benchmarkDateSql` AS `benchmarkDateSql`,`r`.`status` AS `status`,`r`.`statusDate` AS `statusDate`,`r`.`marking` AS `marking`,`r`.`description` AS `description`,`r`.`active` AS `active`,`r`.`groupCount` AS `groupCount`,`r`.`ruleCount` AS `ruleCount`,`r`.`lowCount` AS `lowCount`,`r`.`mediumCount` AS `mediumCount`,`r`.`highCount` AS `highCount`,`r`.`checkCount` AS `checkCount`,`r`.`fixCount` AS `fixCount`,row_number() OVER (PARTITION BY `r`.`benchmarkId` ORDER BY field(`r`.`status`,'draft','accepted') desc,(`r`.`version` + 0) desc,(`r`.`release` + 0) desc )  AS `rn` from `revision` `r`) `rr` where (`rr`.`rn` = 1) */;\n/*!50001 SET collation_connection      = @saved_col_connection */;\n\n--\n-- Final view structure for view `v_default_rev`\n--\n\n/*!50001 DROP VIEW IF EXISTS `v_default_rev`*/;\n/*!50001 SET @saved_col_connection     = @@collation_connection */;\n/*!50001 SET collation_connection      = utf8mb4_0900_ai_ci */;\n/*!50001 CREATE ALGORITHM=UNDEFINED */\n/*!50001 VIEW `v_default_rev` AS select distinct `a`.`collectionId` AS `collectionId`,`sa`.`benchmarkId` AS `benchmarkId`,(case when (`crm`.`revId` is not null) then `crm`.`revId` else `cr`.`revId` end) AS `revId`,(case when (`crm`.`revId` is not null) then 1 else 0 end) AS `revisionPinned` from (((`asset` `a` join `stig_asset_map` `sa` on((`a`.`assetId` = `sa`.`assetId`))) left join `current_rev` `cr` on((`sa`.`benchmarkId` = `cr`.`benchmarkId`))) left join `collection_rev_map` `crm` on(((`sa`.`benchmarkId` = `crm`.`benchmarkId`) and (`a`.`collectionId` = `crm`.`collectionId`)))) */;\n/*!50001 SET collation_connection      = @saved_col_connection */;\n\n--\n-- Final view structure for view `v_latest_rev`\n--\n\n/*!50001 DROP VIEW IF EXISTS `v_latest_rev`*/;\n/*!50001 SET @saved_col_connection     = @@collation_connection */;\n/*!50001 SET collation_connection      = utf8mb4_0900_ai_ci */;\n/*!50001 CREATE ALGORITHM=UNDEFINED */\n/*!50001 VIEW `v_latest_rev` AS select `rr`.`revId` AS `revId`,`rr`.`benchmarkId` AS `benchmarkId`,concat('V',`rr`.`version`,'R',`rr`.`release`) AS `revisionStr` from (select `r`.`revId` AS `revId`,`r`.`benchmarkId` AS `benchmarkId`,`r`.`version` AS `version`,`r`.`release` AS `release`,row_number() OVER (PARTITION BY `r`.`benchmarkId` ORDER BY field(`r`.`status`,'draft','accepted') desc,(`r`.`version` + 0) desc,(`r`.`release` + 0) desc )  AS `rn` from `revision` `r`) `rr` where (`rr`.`rn` = 1) */;\n/*!50001 SET collation_connection      = @saved_col_connection */;\n/*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;\n\n/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;\n/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;\n/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;\n/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;\n/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;\n\n-- Dump completed on 2026-03-09 22:40:40\n"
  },
  {
    "path": "api/source/service/migrations/sql/current/20-stigman-static.sql",
    "content": "-- MySQL dump 10.13  Distrib 8.0.44, for Linux (x86_64)\n--\n-- Host: 127.0.0.1    Database: stigman\n-- ------------------------------------------------------\n-- Server version\t8.0.44\n\n/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;\n/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;\n/*!40103 SET TIME_ZONE='+00:00' */;\n/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;\n/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;\n/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;\n/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;\n\n--\n-- Dumping data for table `result`\n--\n\nLOCK TABLES `result` WRITE;\n/*!40000 ALTER TABLE `result` DISABLE KEYS */;\nINSERT INTO `result` VALUES (1,'notchecked','Not_Reviewed','not_reviewed','NR','Not checked'),(2,'notapplicable','Not_Applicable','not_applicable','NA','Not Applicable'),(3,'pass','NotAFinding','not_a_finding','NF','Not a Finding'),(4,'fail','Open','open','O','Open'),(5,'unknown','Not_Reviewed','not_reviewed','U','Unknown'),(6,'error','Not_Reviewed','not_reviewed','E','Error'),(7,'notselected','Not_Reviewed','not_reviewed','NS','Not selected'),(8,'informational','Not_Reviewed','not_reviewed','I','Informational'),(9,'fixed','NotAFinding','not_a_finding','NF','Fixed');\n/*!40000 ALTER TABLE `result` ENABLE KEYS */;\nUNLOCK TABLES;\n\n--\n-- Dumping data for table `status`\n--\n\nLOCK TABLES `status` WRITE;\n/*!40000 ALTER TABLE `status` DISABLE KEYS */;\nINSERT INTO `status` VALUES (0,'saved','Saved'),(1,'submitted','Submitted'),(2,'rejected','Rejected'),(3,'accepted','Accepted');\n/*!40000 ALTER TABLE `status` ENABLE KEYS */;\nUNLOCK TABLES;\n\n--\n-- Dumping data for table `_migrations`\n--\n\nLOCK TABLES `_migrations` WRITE;\n/*!40000 ALTER TABLE `_migrations` DISABLE KEYS */;\nINSERT INTO `_migrations` VALUES ('2023-03-09 16:11:04',NULL,'0000.js'),('2023-03-09 16:11:04',NULL,'0001.js'),('2023-03-09 16:11:04',NULL,'0002.js'),('2023-03-09 16:11:04',NULL,'0003.js'),('2023-03-09 16:11:04',NULL,'0004.js'),('2023-03-09 16:11:04',NULL,'0005.js'),('2023-03-09 16:11:04',NULL,'0006.js'),('2023-03-09 16:11:05',NULL,'0007.js'),('2023-03-09 16:11:06',NULL,'0008.js'),('2023-03-09 16:11:06',NULL,'0009.js'),('2023-03-09 16:11:06',NULL,'0010.js'),('2023-03-09 16:11:07',NULL,'0011.js'),('2023-03-09 16:11:07',NULL,'0012.js'),('2023-03-09 16:11:07',NULL,'0013.js'),('2023-03-09 16:11:07',NULL,'0014.js'),('2023-03-09 16:11:07',NULL,'0015.js'),('2023-03-09 16:11:08',NULL,'0016.js'),('2023-03-09 16:11:08',NULL,'0017.js'),('2023-03-09 16:11:08',NULL,'0018.js'),('2023-03-09 16:11:09',NULL,'0019.js'),('2023-03-09 16:11:10',NULL,'0020.js'),('2023-04-11 14:14:58',NULL,'0021.js'),('2023-04-26 13:06:02',NULL,'0022.js'),('2023-07-18 14:50:40',NULL,'0023.js'),('2023-09-05 14:19:13',NULL,'0024.js'),('2023-09-05 14:19:14',NULL,'0025.js'),('2023-09-05 14:19:14',NULL,'0026.js'),('2023-09-05 14:19:14',NULL,'0027.js'),('2024-03-26 12:40:20',NULL,'0028.js'),('2024-05-14 21:39:38',NULL,'0029.js'),('2024-05-14 21:40:06',NULL,'0031.js'),('2024-07-24 14:40:24',NULL,'0032.js'),('2025-02-05 17:47:29',NULL,'0033.js'),('2025-02-05 17:47:29',NULL,'0034.js'),('2025-02-05 17:48:18',NULL,'0035.js'),('2025-02-05 17:48:18',NULL,'0036.js'),('2025-05-13 22:25:35',NULL,'0037.js'),('2025-05-13 22:25:45',NULL,'0038.js'),('2025-05-13 22:25:45',NULL,'0039.js'),('2025-05-13 22:25:45',NULL,'0040.js'),('2025-10-04 20:54:44',NULL,'0041.js'),('2025-10-04 20:54:44',NULL,'0042.js'),('2025-10-04 20:54:44',NULL,'0043.js'),('2025-10-04 20:54:45',NULL,'0044.js'),('2025-10-04 20:54:45',NULL,'0045.js'),('2026-03-09 22:40:20',NULL,'0046.js');\n/*!40000 ALTER TABLE `_migrations` ENABLE KEYS */;\nUNLOCK TABLES;\n\n--\n-- Dumping data for table `task`\n--\n\nLOCK TABLES `task` WRITE;\n/*!40000 ALTER TABLE `task` DISABLE KEYS */;\nINSERT INTO `task` VALUES (1,'WipeDeletedObjects','Wipe deleted collections and assets and their associated reviews','delete_disabled()'),(2,'DeleteUnmappedReviews','Delete reviews that no longer match any rule in the system','delete_unmapped(\\\"system\\\")'),(3,'DeleteUnmappedAssetReviews','Delete reviews that no longer match an asset\\'s assigned rules','delete_unmapped(\\\"asset\\\")'),(4,'AnalyzeReviewTables','Analyze database tables for performance','analyze_tables(JSON_ARRAY(\\\"reviews\\\", \\\"review_history\\\"))');\n/*!40000 ALTER TABLE `task` ENABLE KEYS */;\nUNLOCK TABLES;\n\n--\n-- Dumping data for table `job`\n--\n\nLOCK TABLES `job` WRITE;\n/*!40000 ALTER TABLE `job` DISABLE KEYS */;\nINSERT INTO `job` VALUES (1,'Cleanup Database','Wipe deleted collections and assets and their associated reviews',NULL,NULL,'2025-10-04 20:54:45.057',NULL),(2,'Delete Unmapped Reviews','Delete reviews that no longer match any rule in the system',NULL,NULL,'2025-10-04 20:54:45.057',NULL),(3,'Delete Unmapped Asset Reviews','Delete reviews that no longer match an asset\\'s assigned rules',NULL,NULL,'2025-10-04 20:54:45.057',NULL);\n/*!40000 ALTER TABLE `job` ENABLE KEYS */;\nUNLOCK TABLES;\n\n--\n-- Dumping data for table `job_task_map`\n--\n\nLOCK TABLES `job_task_map` WRITE;\n/*!40000 ALTER TABLE `job_task_map` DISABLE KEYS */;\nINSERT INTO `job_task_map` VALUES (1,1,1,'2025-10-04 20:54:45.079','2025-10-04 20:54:45.079'),(2,1,4,'2025-10-04 20:54:45.079','2025-10-04 20:54:45.079'),(3,2,2,'2025-10-04 20:54:45.079','2025-10-04 20:54:45.079'),(4,2,4,'2025-10-04 20:54:45.079','2025-10-04 20:54:45.079'),(5,3,3,'2025-10-04 20:54:45.079','2025-10-04 20:54:45.079'),(6,3,4,'2025-10-04 20:54:45.079','2025-10-04 20:54:45.079');\n/*!40000 ALTER TABLE `job_task_map` ENABLE KEYS */;\nUNLOCK TABLES;\n/*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;\n\n/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;\n/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;\n/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;\n/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;\n/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;\n\n-- Dump completed on 2026-03-09 22:40:40\nALTER TABLE job AUTO_INCREMENT=100;\nALTER TABLE job_task_map AUTO_INCREMENT=1000;\n"
  },
  {
    "path": "api/source/service/migrations/sql/current/31-rev5-cci-data.sql",
    "content": "--\n/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;\n/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;\n/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;\n/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;\n\n--\n-- Data for table `cci`\n--\n\nLOCK TABLES `cci` WRITE;\n/*!40000 ALTER TABLE `cci` DISABLE KEYS */;\nINSERT INTO `cci` VALUES ('000002','draft','2009-09-14','DISA FSO','policy','Disseminate the organization-level; mission/business process-level; and/or system-level access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to organization-defined personnel or roles.','AC-01a.','N/A','Determine if: - an access control policy is developed and documented. - the access control policy is disseminated to [AC-01_ODP[01]; personnel or roles to whom the access control policy is to be disseminated is/are defined].'),\n('000003','draft','2009-09-14','DISA FSO','policy','Review and update the current access control policy on an organization-defined frequency.','AC-01c.01','N/A','Determine if: - the current access control policy is reviewed and updated [AC-01_ODP[05]; the frequency at which the current access control policy is reviewed and updated is defined]. - the current access control policy is reviewed and updated following [AC-01_ODP[06]; events that would require the current access control policy to be reviewed and updated are defined].'),\n('000005','draft','2009-09-14','DISA FSO','policy','Disseminate procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and associated access controls to the organization-defined personnel or roles.','AC-01a.02','N/A','Determine if: - access control procedures to facilitate the implementation of the access control policy and associated controls are developed and documented. - the access control procedures are disseminated to [AC-01_ODP[02]; personnel or roles to whom the access control procedures are to be disseminated is/are defined].'),\n('000006','draft','2009-09-14','DISA FSO','policy','Review and update the current access control procedures on an organization-defined frequency.','AC-01c.02','N/A','Determine if: - the current access control procedures are reviewed and updated [AC-01_ODP[07]; the frequency at which the current access control procedures are reviewed and updated is defined;]. - the current access control procedures are reviewed and updated following [AC-01_ODP[08]; events that would require procedures to be reviewed and updated are defined].'),\n('000010','draft','2009-05-13','DISA FSO','policy','Require approvals by organization-defined personnel or roles for requests to create accounts.','AC-02e.','N/A','Determine if approvals are required by [AC-02_ODP[03]; personnel or roles required to approve requests to create accounts is/are defined] for requests to create accounts.'),\n('000011','draft','2009-05-13','DISA FSO','policy','Create, enable, modify, disable, and remove system accounts in accordance with organization-defined procedures.','AC-02f.','N/A','Determine if: - accounts are created in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are enabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are modified in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are disabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are removed in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined].'),\n('000012','draft','2009-09-14','DISA FSO','policy','Review accounts for compliance with account management requirements per organization-defined frequency.','AC-02j.','N/A','Determine if accounts are reviewed for compliance with account management requirements [AC-02_ODP[10]; the frequency of account review is defined].'),\n('000015','draft','2009-05-13','DISA FSO','technical','Support the management of system accounts using organization-defined automated mechanisms.','AC-02(01)','N/A','Determine if the management of system accounts is supported using [AC-02(01)_ODP; automated mechanisms used to support the management of system accounts are defined].'),\n('000016','draft','2009-05-13','DISA FSO','technical','Automatically remove or disable temporary and emergency accounts after an organization-defined time-period for each type of account.','AC-02(02)','N/A','Determine if temporary and emergency accounts are automatically [AC-02(02)_ODP[01]; one of the following PARAMETER VALUES is selected: {remove; disable}] after [AC-02(02)_ODP[02]; the time period after which to automatically remove or disable temporary or emergency accounts is defined].'),\n('000017','draft','2009-05-13','DISA FSO','technical','Disable accounts when the accounts have been inactive for the organization-defined time-period.','AC-02(03)(d)','N/A','Determine if accounts are disabled within [AC-02(03)_ODP[01]; time period within which to disable accounts is defined] when the accounts have been inactive for [AC-02(03)_ODP[02]; time period for account inactivity before disabling is defined].'),\n('000018','draft','2009-05-13','DISA FSO','technical','Automatically audit account creation actions.','AC-02(04)','N/A','Determine if: - account creation is automatically audited. - account modification is automatically audited. - account enabling is automatically audited. - account disabling is automatically audited. - account removal actions are automatically audited.'),\n('000019','draft','2009-09-14','DISA FSO','policy','Require that users log out in accordance with the organization-defined time-period of expected inactivity or description of when to log out.','AC-02(05)','N/A','Determine if users are required to log out when [AC-02(05)_ODP; the time period of expected inactivity or description of when to log out is defined].'),\n('000021','draft','2009-05-13','DISA FSO','technical','Enforce dual authorization for organization-defined privileged commands and/or other organization-defined actions.','AC-03(02)','N/A','Determine if dual authorization is enforced for [AC-03(02)_ODP; privileged commands and/or other actions requiring dual authorization are defined].'),\n('000024','draft','2009-09-14','DISA FSO','technical','Prevent access to organization-defined security-relevant information except during secure, non-operable system states.','AC-03(05)','N/A','Determine if access to [AC-03(05)_ODP; security-relevant information to which access is prevented except during secure, non-operable system states is defined] is prevented except during secure, non-operable system states.'),\n('000026','draft','2009-05-13','DISA FSO','technical','Use protected processing domains to enforce organization-defined information flow control policies as a basis for flow control decisions.','AC-04(02)','N/A','Determine if protected processing domains are used to enforce [AC-04(02)_ODP; information flow control policies to be enforced by use of protected processing domains are defined] as a basis for flow control decisions.'),\n('000027','draft','2009-05-13','DISA FSO','technical','Enforce organization-defined information flow control policies.','AC-04(03)','N/A','Determine if [AC-04(03)_ODP; information flow control policies to be enforced are defined] are enforced.'),\n('000028','draft','2009-05-13','DISA FSO','policy','Prevent encrypted information from bypassing organization-defined flow control mechanisms by employing organization-defined procedures or methods.','AC-04(04)','N/A','Determine if encrypted information is prevented from bypassing [AC-04(04)_ODP[01]; information flow control mechanisms that encrypted information is prevented from bypassing are defined] by [AC-04(04)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {decrypting the information; blocking the flow of the encrypted information; terminating communications sessions attempting to pass encrypted information; [AC-04(04)_ODP[03]; the organization-defined procedure or method used to prevent encrypted information from bypassing information flow control mechanisms is defined (if selected)]].'),\n('000029','draft','2009-05-13','DISA FSO','technical','Enforce organization-defined limitations on embedding data types within other data types.','AC-04(05)','N/A','Determine if [AC-04(05)_ODP; limitations on embedding data types within other data types are defined] are enforced on embedding data types within other data types.'),\n('000030','draft','2009-05-13','DISA FSO','technical','Enforce information flow control based on organization-defined metadata.','AC-04(06)','N/A','Determine if information flow control enforcement is based on [AC-04(06)_ODP; metadata on which to base enforcement of information flow control is defined].'),\n('000031','draft','2009-05-13','DISA FSO','technical','Enforce one-way information flows using hardware-based flow control mechanisms.','AC-04(07)','N/A','Determine if one-way information flows are enforced through hardware-based flow control mechanisms.'),\n('000032','draft','2009-09-14','DISA FSO','technical','Enforce information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows.','AC-04(08)(a)','N/A','Determine if: - information flow control is enforced using [AC-04(08)_ODP[01]; security policy filters to be used as a basis for enforcing information flow control are defined] as a basis for flow control decisions for [AC-04(08)_ODP[03]; information flows for which information flow control is enforced by security filters are defined]. - information flow control is enforced using [AC-04(08)_ODP[02]; privacy policy filters to be used as a basis for enforcing information flow control are defined] as a basis for flow control decisions for [AC-04(08)_ODP[04]; information flows for which information flow control is enforced by privacy filters are defined].'),\n('000034','draft','2009-05-13','DISA FSO','technical','Provide the capability for privileged administrators to enable and disable organization-defined security or privacy filters under organization-defined conditions.','AC-04(10)','N/A','Determine if: - capability is provided for privileged administrators to enable and disable [AC-04(10)_ODP[01]; security policy filters that privileged administrators have the capability to enable and disable are defined] under [AC-04(10)_ODP[03]; conditions under which privileged administrators have the capability to enable and disable security policy filters are defined]. - capability is provided for privileged administrators to enable and disable [AC-04(10)_ODP[02]; privacy policy filters that privileged administrators have the capability to enable and disable are defined] under [AC-04(10)_ODP[04]; conditions under which privileged administrators have the capability to enable and disable privacy policy filters are defined].'),\n('000035','draft','2009-09-14','DISA FSO','technical','Provide the capability for privileged administrators to configure the organization-defined security or privacy policy filters to support different security or privacy policies.','AC-04(11)','N/A','Determine if: - capability is provided for privileged administrators to configure [AC-04(11)_ODP[01]; security policy filters that privileged administrators have the capability to configure to support different security and privacy policies are defined] to support different security or privacy policies. - capability is provided for privileged administrators to configure [AC-04(11)_ODP[02]; privacy policy filters that privileged administrators have the capability to configure to support different security and privacy policies are defined] to support different security or privacy policies.'),\n('000039','draft','2009-09-14','DISA FSO','policy','Require that users of system accounts, or roles, with access to organization-defined security functions or security-relevant information, use non-privileged accounts or roles, when accessing nonsecurity functions.','AC-06(02)','N/A','Determine if users of system accounts (or roles) with access to [AC-06(02)_ODP; security functions or security-relevant information, the access to which requires users to use non-privileged accounts to access non-security functions, are defined] are required to use non-privileged accounts or roles when accessing non-security functions.'),\n('000041','draft','2009-05-19','DISA FSO','policy','Authorize network access to organization-defined privileged commands only for organization-defined compelling operational needs.','AC-06(03)','N/A','Determine if: - network access to [AC-06(03)_ODP[01]; privileged commands to which network access is to be authorized only for compelling operational needs are defined] is authorized only for [AC-06(03)_ODP[02]; compelling operational needs necessitating network access to privileged commands are defined]. - the rationale for authorizing network access to privileged commands is documented in the security plan for the system.'),\n('000042','draft','2009-05-19','DISA FSO','policy','Document the rationale for authorized network access to organization-defined privileged commands in the security plan for the system.','AC-06(03)','N/A','Determine if: - network access to [AC-06(03)_ODP[01]; privileged commands to which network access is to be authorized only for compelling operational needs are defined] is authorized only for [AC-06(03)_ODP[02]; compelling operational needs necessitating network access to privileged commands are defined]. - the rationale for authorizing network access to privileged commands is documented in the security plan for the system.'),\n('000043','draft','2009-05-19','DISA FSO','policy','Defines the maximum number of consecutive invalid logon attempts to the information system by a user during an organization-defined time period.','AC-07a.','N/A','Determine if a limit of [AC-07_ODP[01]; the number of consecutive invalid logon attempts by a user allowed during a time period is defined] consecutive invalid logon attempts by a user during [AC-07_ODP[02]; the time period to which the number of consecutive invalid logon attempts by a user is limited is defined] is enforced.'),\n('000044','draft','2009-09-14','DISA FSO','technical','Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.','AC-07a.','N/A','Determine if a limit of [AC-07_ODP[01]; the number of consecutive invalid logon attempts by a user allowed during a time period is defined] consecutive invalid logon attempts by a user during [AC-07_ODP[02]; the time period to which the number of consecutive invalid logon attempts by a user is limited is defined] is enforced.'),\n('000048','draft','2009-05-19','DISA FSO','technical','Display an organization-defined system use notification message or banner to users before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidelines.','AC-08a.','N/A','Determine if [AC-08_ODP[01]; system use notification message or banner to be displayed by the system to users before granting access to the system is defined] is displayed to users before granting access to the system that provides privacy and security notices consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('000050','draft','2009-09-14','DISA FSO','technical','Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system.','AC-08b.','N/A','Determine if the notification message or banner is retained on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system.'),\n('000052','draft','2009-09-14','DISA FSO','technical','Notify the user, upon successful logon (access) to the system, of the date and time of the last logon (access).','AC-09','N/A','Determine if the user is notified, upon successful logon to the system, of the date and time of the last logon.'),\n('000053','draft','2009-09-14','DISA FSO','technical','Notify the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access.','AC-09(01)','N/A','Determine if the user is notified, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.'),\n('000054','draft','2009-05-19','DISA FSO','technical','Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.','AC-10','N/A','Determine if the number of concurrent sessions for each [AC-10_ODP[01]; accounts and/or account types for which to limit the number of concurrent sessions is defined] is limited to [AC-10_ODP[02]; the number of concurrent sessions to be allowed for each account and/or account type is defined].'),\n('000055','draft','2009-05-19','DISA FSO','policy','Defines the maximum number of concurrent sessions to be allowed for each organization-defined account and/or account type.','AC-10','N/A','Determine if the number of concurrent sessions for each [AC-10_ODP[01]; accounts and/or account types for which to limit the number of concurrent sessions is defined] is limited to [AC-10_ODP[02]; the number of concurrent sessions to be allowed for each account and/or account type is defined].'),\n('000056','draft','2009-09-14','DISA FSO','technical','Retain the device lock until the user reestablishes access using established identification and authentication procedures.','AC-11b.','N/A','Determine if device lock is retained until the user re-establishes access using established identification and authentication procedures.'),\n('000057','draft','2009-05-19','DISA FSO','technical','Prevent further access to the system by initiating a device lock after organization-defined time period of inactivity; and/or requiring the user to initiate a device lock before leaving the system unattended.','AC-11a.','N/A','Determine if further access to the system is prevented by [AC-11_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {initiating a device lock after [AC-11_ODP[02]; time period of inactivity after which a device lock is initiated is defined (if selected)] of inactivity; requiring the user to initiate a device lock before leaving the system unattended}].'),\n('000059','draft','2009-09-14','DISA FSO','policy','Defines the time-period of inactivity after which the system initiates a device lock.','AC-11a.','N/A','Determine if further access to the system is prevented by [AC-11_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {initiating a device lock after [AC-11_ODP[02]; time period of inactivity after which a device lock is initiated is defined (if selected)] of inactivity; requiring the user to initiate a device lock before leaving the system unattended}].'),\n('000060','draft','2009-05-19','DISA FSO','technical','Conceal, via the device lock, information previously visible on the display with a publicly viewable image.','AC-11(01)','N/A','Determine if information previously visible on the display is concealed, via device lock, with a publicly viewable image.'),\n('000061','draft','2009-09-14','DISA FSO','policy','Identify organization-defined user actions that can be performed on the system without identification or authentication consistent with organizational missions/business functions.','AC-14a.','N/A','Determine if [AC-14_ODP; user actions that can be performed on the system without identification or authentication are defined] that can be performed on the system without identification or authentication consistent with organizational mission and business functions are identified.'),\n('000065','draft','2009-09-14','DISA FSO','policy','Authorize remote access to the system prior to allowing such connections.','AC-17b.','N/A','Determine if each type of remote access to the system is authorized prior to allowing such connections.'),\n('000067','draft','2009-09-14','DISA FSO','technical','Employ automated mechanisms to monitor remote access methods.','AC-17(01)','N/A','Determine if: - automated mechanisms are employed to monitor remote access methods. - automated mechanisms are employed to control remote access methods.'),\n('000068','draft','2009-09-14','DISA FSO','technical','Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.','AC-17(02)','N/A','Determine if cryptographic mechanisms are implemented to protect the confidentiality and integrity of remote access sessions.'),\n('000069','draft','2009-05-19','DISA FSO','policy','Route all remote accesses through authorized and managed network access control points.','AC-17(03)','N/A','Determine if remote accesses are routed through authorized and managed network access control points.'),\n('000070','draft','2009-05-19','DISA FSO','policy','Authorize the execution of privileged commands via remote access only in a format that provides assessable evidence for organization-defined needs.','AC-17(04)(a)','N/A','Determine if: - the execution of privileged commands via remote access is authorized only in a format that provides assessable evidence. - access to security-relevant information via remote access is authorized only in a format that provides assessable evidence. - the execution of privileged commands via remote access is authorized only for the following needs: [AC-17(04)_ODP[01]; needs requiring execution of privileged commands via remote access are defined]. - access to security-relevant information via remote access is authorized only for the following needs: [AC-17(04)_ODP[02]; needs requiring access to security-relevant information via remote access are defined].'),\n('000072','draft','2009-09-25','DISA FSO','policy','Protect information about remote access mechanisms from unauthorized use and disclosure.','AC-17(06)','N/A','Determine if information about remote access mechanisms is protected from unauthorized use and disclosure.'),\n('000073','draft','2009-11-03','DISA FSO','policy','Develop an organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements.','PM-01a.01','N/A','Determine if: - the information security program plan provides an overview of the requirements for the security program. - the information security program plan provides a description of the security program management controls in place or planned for meeting those requirements. - the information security program plan provides a description of the common controls in place or planned for meeting those requirements.'),\n('000074','draft','2009-11-03','DISA FSO','policy','Develop an organization-wide information security program plan that is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.','PM-01a.04','N/A','Determine if the information security program plan is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.'),\n('000075','draft','2009-11-03','DISA FSO','policy','Review and update the organization-wide information security program plan on an organization-defined frequency.','PM-01b.','N/A','Determine if: - the information security program plan is reviewed and updated [PM-01_ODP[01]; the frequency at which to review and update the organization-wide information security program plan is defined]. - the information security program plan is reviewed and updated following [PM-01_ODP[02]; events that trigger the review and update of the organization-wide information security program plan are defined].'),\n('000076','draft','2009-11-03','DISA FSO','policy','Defines the frequency with which to review and update the organization-wide information security program plan.','PM-01b.','N/A','Determine if: - the information security program plan is reviewed and updated [PM-01_ODP[01]; the frequency at which to review and update the organization-wide information security program plan is defined]. - the information security program plan is reviewed and updated following [PM-01_ODP[02]; events that trigger the review and update of the organization-wide information security program plan are defined].'),\n('000078','draft','2009-11-03','DISA FSO','policy','Appoint a Senior Information Security Officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.','PM-02','N/A','Determine if: - a senior agency information security officer is appointed. - the senior agency information security officer is provided with the mission and resources to coordinate an organization-wide information security program. - the senior agency information security officer is provided with the mission and resources to develop an organization-wide information security program. - the senior agency information security officer is provided with the mission and resources to implement an organization-wide information security program. - the senior agency information security officer is provided with the mission and resources to maintain an organization-wide information security program.'),\n('000080','draft','2009-11-03','DISA FSO','policy','Include the resources needed to implement the information security programs in capital planning and investment requests and document all exceptions to this requirement.','PM-03a.','N/A','Determine if: - the resources needed to implement the information security program are included in capital planning and investment requests, and all exceptions are documented. - the resources needed to implement the privacy program are included in capital planning and investment requests, and all exceptions are documented.'),\n('000083','draft','2009-05-19','DISA FSO','policy','Establish implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas.','AC-19a.','N/A','Determine if: - configuration requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area. - connection requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area. - implementation guidance is established for organization-controlled mobile devices, including when such devices are outside of the controlled area.'),\n('000084','draft','2009-09-14','DISA FSO','policy','Authorize connection of mobile devices to organizational systems.','AC-19b.','N/A','Determine if the connection of mobile devices to organizational systems is authorized.'),\n('000093','draft','2009-09-14','DISA FSO','policy','Establish organization-defined terms and conditions, and/or identify organization-defined controls asserted to be implemented on external systems, consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from the external systems.','AC-20a.01','N/A','Determine if [AC-20_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {establish [AC-20_ODP[02]; terms and conditions consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems are defined (if selected)]; identify [AC-20_ODP[03]; controls asserted to be implemented on external systems consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems are defined (if selected)]}]]] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from external systems (if applicable).'),\n('000097','draft','2009-09-14','DISA FSO','policy','Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using organization-defined restrictions.','AC-20(02)','N/A','Determine if the use of organization-controlled portable storage devices by authorized individuals is restricted on external systems using [AC-20(02)_ODP; restrictions on the use of organization-controlled portable storage devices by authorized individuals on external systems are defined].'),\n('000098','draft','2009-05-19','DISA FSO','policy','Enable authorized users to determine whether access authorizations assigned to the sharing partner match the information''s access and use restrictions for organization-defined information sharing circumstances where user discretion is required.','AC-21a.','N/A','Determine if authorized users are enabled to determine whether access authorizations assigned to a sharing partner match the information''s access and use restrictions for [AC-21_ODP[01]; information-sharing circumstances where user discretion is required to determine whether access authorizations assigned to a sharing partner match the information''s access and use restrictions are defined].'),\n('000099','draft','2009-05-19','DISA FSO','policy','Employ organization-defined automated mechanisms to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.','AC-21(01)','N/A','Determine if [AC-21(01)_ODP; automated mechanisms employed to enforce information-sharing decisions by authorized users are defined] are employed to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.'),\n('000100','draft','2009-05-20','DISA FSO','policy','Develop and document an organization level, mission/business process-level, or system-level awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','AT-01a.01(a)','N/A','Determine if: - the [AT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] awareness and training policy addresses purpose. - the [AT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] awareness and training policy addresses scope. - the [AT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] awareness and training policy addresses roles. - the [AT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] awareness and training policy addresses responsibilities. - the [AT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] awareness and training policy addresses management commitment. - the [AT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] awareness and training policy addresses coordination among organizational entities. - the [AT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level} awareness and training policy addresses compliance.'),\n('000101','draft','2009-05-20','DISA FSO','policy','Disseminate an organization level, mission/business process-level, or system-level awareness and training policy to organization-defined personnel or roles.','AT-01a.','N/A','Determine if: - an awareness and training policy is developed and documented. - the awareness and training policy is disseminated to [AT-01_ODP[01]; personnel or roles to whom the awareness and training policy is to be disseminated is/are defined].'),\n('000102','draft','2009-05-20','DISA FSO','policy','Review and update the current security awareness and training policy in accordance with organization-defined frequency.','AT-01c.01','N/A','Determine if: - the current awareness and training policy is reviewed and updated [AT-01_ODP[05]; the frequency at which the current awareness and training policy is reviewed and updated is defined]. - the current awareness and training policy is reviewed and updated following [AT-01_ODP[06]; events that would require the current awareness and training policy to be reviewed and updated are defined].'),\n('000103','draft','2009-05-20','DISA FSO','policy','Develop and document procedures to facilitate the implementation of the awareness and training policy and associated awareness and training controls.','AT-01a.02','N/A','Determine if: - awareness and training procedures to facilitate the implementation of the awareness and training policy and associated access controls are developed and documented. - the awareness and training procedures are disseminated to [AT-01_ODP[02]; personnel or roles to whom the awareness and training procedures are to be disseminated is/are defined].'),\n('000104','draft','2009-05-20','DISA FSO','policy','Disseminate organization-level; mission/business process-level; or system-level awareness and training procedures to organization-defined personnel or roles.','AT-01a.02','N/A','Determine if: - awareness and training procedures to facilitate the implementation of the awareness and training policy and associated access controls are developed and documented. - the awareness and training procedures are disseminated to [AT-01_ODP[02]; personnel or roles to whom the awareness and training procedures are to be disseminated is/are defined].'),\n('000105','draft','2009-05-20','DISA FSO','policy','Review and update the current security awareness and training procedures in accordance with an organization-defined frequency.','AT-01c.02','N/A','Determine if: - the current awareness and training procedures are reviewed and updated [AT-01_ODP[07]; the frequency at which the current awareness and training procedures are reviewed and updated is defined]. - the current awareness and training procedures are reviewed and updated following [AT-01_ODP[08]; events that would require procedures to be reviewed and updated are defined].'),\n('000106','draft','2009-09-14','DISA FSO','policy','Provide basic security literacy training to system users (including managers, senior executives, and contractors) as part of initial training for new users.','AT-02a.01','N/A','Determine if: - security literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users. - privacy literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users. - security literacy training is provided to system users (including managers, senior executives, and contractors) [AT-02_ODP[01]; the frequency at which to provide security literacy training to system users (including managers, senior executives, and contractors) after initial training is defined] thereafter. - privacy literacy training is provided to system users (including managers, senior executives, and contractors) [AT-02_ODP[02]; the frequency at which to provide privacy literacy training to system users (including managers, senior executives, and contractors) after initial training is defined] thereafter.'),\n('000107','draft','2009-05-20','DISA FSO','policy','Provide practical exercises in literacy training that simulate events and incidents.','AT-02(01)','N/A','Determine if practical exercises in literacy training that simulate events and incidents are provided.'),\n('000108','draft','2009-05-20','DISA FSO','policy','Provide role-based security training to personnel with organization-defined roles and responsibilities before authorizing access to the system, information, or performing assigned duties.','AT-03a.01','N/A','Determine if: - role-based security training is provided to [AT-03_ODP[01]; roles and responsibilities for role-based security training are defined] before authorizing access to the system, information, or performing assigned duties. - role-based privacy training is provided to [AT-03_ODP[02]; roles and responsibilities for role-based privacy training are defined] before authorizing access to the system, information, or performing assigned duties. - role-based security training is provided to [AT-03_ODP[01]; roles and responsibilities for role-based security training are defined] [AT-03_ODP[03]; the frequency at which to provide role-based security and privacy training to assigned personnel after initial training is defined] thereafter. - role-based privacy training is provided to [AT-03_ODP[02]; roles and responsibilities for role-based privacy training are defined] [AT-03_ODP[03]; the frequency at which to provide role-based security and privacy training to assigned personnel after initial training is defined] thereafter.'),\n('000109','draft','2009-05-20','DISA FSO','policy','Provide role-based security training to personnel with organization-defined roles and responsibilities when required by system changes.','AT-03a.02','N/A','Determine if: - role-based security training is provided to personnel with assigned security roles and responsibilities when required by system changes. - role-based privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes.'),\n('000112','draft','2009-05-20','DISA FSO','policy','Provide basic security awareness training to system users (including managers, senior executives, and contractors) when required by system changes or following organization-defined events.','AT-02a.02','N/A','Determine if: - security literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [AT-02_ODP[03]; events that require security literacy training for system users are defined]. - privacy literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [AT-02_ODP[04]; events that require privacy literacy training for system users are defined].'),\n('000113','draft','2009-09-14','DISA FSO','policy','Document individual security training activities, including security awareness training and specific system security training.','AT-04a.','N/A','Determine if: - information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented. - information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are monitored.'),\n('000114','draft','2009-09-14','DISA FSO','policy','Monitor individual information security training activities, including security awareness training and specific security training.','AT-04a.','N/A','Determine if: - information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented. - information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are monitored.'),\n('000117','draft','2009-05-20','DISA FSO','policy','Develop and document an organization-level; mission/business process-level; and/or system-level audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','AU-01a.01(a)','N/A','Determine if: - the [AU-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the audit and accountability policy addresses purpose. - the [AU-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the audit and accountability policy addresses scope. - the [AU-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the audit and accountability policy addresses roles. - the [AU-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the audit and accountability policy addresses responsibilities. - the [AU-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the audit and accountability policy addresses management commitment. - the [AU-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the audit and accountability policy addresses coordination among organizational entities. - the [AU-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the audit and accountability policy addresses compliance.'),\n('000119','draft','2009-05-20','DISA FSO','policy','Review and update the current audit and accountability policy on an organization-defined frequency.','AU-01c.01','N/A','Determine if: - the current audit and accountability policy is reviewed and updated [AU-01_ODP[05]; the frequency at which the current audit and accountability policy is reviewed and updated is defined]. - the current audit and accountability policy is reviewed and updated following [AU-01_ODP[06]; events that would require the current audit and accountability policy to be reviewed and updated are defined.]'),\n('000120','draft','2009-05-20','DISA FSO','policy','Develop and document procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.','AU-01a.02','N/A','Determine if: - audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls are developed and documented. - the audit and accountability procedures are disseminated to [AU-01_ODP[02]; personnel or roles to whom the audit and accountability procedures are to be disseminated is/are defined].'),\n('000122','draft','2009-05-20','DISA FSO','policy','Review and update the current audit and accountability procedures on an organization-defined frequency.','AU-01c.02','N/A','Determine if: - the current audit and accountability procedures are reviewed and updated [AU-01_ODP[07]; the frequency at which the current audit and accountability procedures are reviewed and updated is defined]. - the current audit and accountability procedures are reviewed and updated following [AU-01_ODP[08]; events that would require audit and accountability procedures to be reviewed and updated are defined].'),\n('000123','draft','2009-09-15','DISA FSO','policy','Identify the organization-defined event types that the system is capable of logging in support of the audit function.','AU-02a.','N/A','Determine if [AU-02_ODP[01]; the event types that the system is capable of logging in support of the audit function are defined] that the system is capable of logging are identified in support of the audit logging function.'),\n('000124','draft','2009-09-15','DISA FSO','policy','Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged.','AU-02b.','N/A','Determine if the event logging function is coordinated with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged.'),\n('000125','draft','2009-09-15','DISA FSO','policy','Provide a rationale for why the event types selected for logging are deemed to be adequate for support after-the-fact investigations of incidents.','AU-02d.','N/A','Determine if a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents.'),\n('000126','draft','2009-09-15','DISA FSO','policy','Specify the organization-defined event types (subset of the event types defined in AU-2a) along with the frequency of (or situation requiring logging for each identified event type.','AU-02c.','N/A','Determine if: - [AU-02_ODP[02]; the event types (subset of AU-02_ODP[01]) for logging within the system are defined] are specified for logging within the system. - the specified event types are logged within the system [AU-02_ODP[03]; the frequency or situation requiring logging for each specified event type is defined].'),\n('000130','draft','2009-05-20','DISA FSO','technical','Ensure that audit records contain information that establishes what type of event occurred.','AU-03a.','N/A','Determine if audit records contain information that establishes what type of event occurred.'),\n('000131','draft','2009-05-20','DISA FSO','technical','Ensure that audit records containing information that establishes when the event occurred.','AU-03b.','N/A','Determine if audit records contain information that establishes when the event occurred.'),\n('000132','draft','2009-05-20','DISA FSO','technical','Ensure that audit records containing information that establishes where the event occurred.','AU-03c.','N/A','Determine if audit records contain information that establishes where the event occurred.'),\n('000133','draft','2009-05-20','DISA FSO','technical','Ensure that audit records containing information that establishes the source of the event.','AU-03d.','N/A','Determine if audit records contain information that establishes the source of the event.'),\n('000134','draft','2009-05-20','DISA FSO','technical','Ensure that audit records containing information that establishes the outcome of the event.','AU-03e.','N/A','Determine if audit records contain information that establishes the outcome of the event.'),\n('000135','draft','2009-05-20','DISA FSO','technical','Generate audit records containing the organization-defined additional information that is to be included in the audit records.','AU-03(01)','N/A','Determine if generated audit records contain the following [AU-03(01)_ODP; additional information to be included in audit records is defined].'),\n('000139','draft','2009-09-15','DISA FSO','technical','Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.','AU-05a.','N/A','Determine if [AU-05_ODP[01]; personnel or roles receiving audit logging process failure alerts are defined] are alerted in the event of an audit logging process failure within [AU-05_ODP[02]; time period for personnel or roles receiving audit logging process failure alerts is defined].'),\n('000140','draft','2009-05-20','DISA FSO','technical','Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.','AU-05b.','N/A','Determine if [AU-05_ODP[03]; additional actions to be taken in the event of an audit logging process failure are defined] are taken in the event of an audit logging process failure.'),\n('000141','draft','2009-11-03','DISA FSO','policy','Make available for expenditure, the planned information security resources.','PM-03c.','N/A','Determine if: - information security resources are made available for expenditure as planned. - privacy resources are made available for expenditure as planned.'),\n('000142','draft','2009-11-03','DISA FSO','policy','Implement a process to ensure that plans of action and milestones for the information security program and the associated organizational systems are maintained.','PM-04a.01','N/A','Determine if: - a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained.'),\n('000145','draft','2009-05-20','DISA FSO','policy','Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity by delaying or rejecting network traffic above those organization-defined thresholds.','AU-05(03)','N/A','Determine if: - configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity are enforced. - network traffic is [AU-05(03)_ODP; one or more of the following PARAMETER VALUES is/are selected: {reject; delay}] if network traffic volume is above configured thresholds.'),\n('000147','draft','2009-05-22','DISA FSO','policy','Defines the audit logging failure events requiring real-time alerts.','AU-05(02)','N/A','Determine if an alert is provided within [AU-05(02)_ODP[01]; real-time period requiring alerts when audit failure events (defined in AU-05(02)_ODP[03]) occur is defined] to [AU-05(02)_ODP[02]; personnel, roles, and/or locations to be alerted in real time when audit failure events (defined in AU-05(02)_ODP[03]) occur is/are defined] when [AU-05(02)_ODP[03]; audit logging failure events requiring real-time alerts are defined] occur.'),\n('000148','draft','2009-05-22','DISA FSO','policy','Review and analyze system audit records on an organization-defined frequency for indications of organization-defined inappropriate or unusual activity.','AU-06a.','N/A','Determine if system audit records are reviewed and analyzed [AU-06_ODP[01]; frequency at which system audit records are reviewed and analyzed is defined] for indications of [AU-06_ODP[02]; inappropriate or unusual activity is defined] and the potential impact of the inappropriate or unusual activity.'),\n('000149','draft','2009-05-22','DISA FSO','policy','Report any findings to organization-defined personnel or roles for indications of organization-defined inappropriate or unusual activity.','AU-06b.','N/A','Determine if findings are reported to [AU-06_ODP[03]; personnel or roles to receive findings from reviews and analyses of system records is/are defined].'),\n('000151','draft','2009-09-15','DISA FSO','policy','Defines the frequency for the review and analysis of system audit records for organization-defined inappropriate or unusual activity.','AU-06a.','N/A','Determine if system audit records are reviewed and analyzed [AU-06_ODP[01]; frequency at which system audit records are reviewed and analyzed is defined] for indications of [AU-06_ODP[02]; inappropriate or unusual activity is defined] and the potential impact of the inappropriate or unusual activity.'),\n('000153','draft','2009-05-22','DISA FSO','policy','Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.','AU-06(03)','N/A','Determine if audit records across different repositories are analyzed and correlated to gain organization-wide situational awareness.'),\n('000154','draft','2009-05-22','DISA FSO','technical','Provide the capability to centrally review and analyze audit records from multiple components within the system.','AU-06(04)','N/A','Determine if: - the capability to centrally review and analyze audit records from multiple components within the system is provided. - the capability to centrally review and analyze audit records from multiple components within the system is implemented.'),\n('000158','draft','2009-05-22','DISA FSO','technical','Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.','AU-07(01)','N/A','Determine if: - the capability to process, sort, and search audit records for events of interest based on [AU-07(01)_ODP; fields within audit records that can be processed, sorted, or searched are defined] are provided. - the capability to process, sort, and search audit records for events of interest based on [AU-07(01)_ODP; fields within audit records that can be processed, sorted, or searched are defined] are implemented.'),\n('000159','draft','2009-05-22','DISA FSO','technical','Use internal system clocks to generate time stamps for audit records.','AU-08a.','N/A','Determine if internal system clocks are used to generate timestamps for audit records.'),\n('000162','draft','2009-05-22','DISA FSO','technical','Protect audit information from unauthorized access.','AU-09a.','N/A','Determine if audit information and audit logging tools are protected from unauthorized access, modification, and deletion.'),\n('000163','draft','2009-05-22','DISA FSO','technical','Protect audit information from unauthorized modification.','AU-09a.','N/A','Determine if audit information and audit logging tools are protected from unauthorized access, modification, and deletion.'),\n('000164','draft','2009-05-22','DISA FSO','technical','Protect audit information from unauthorized deletion.','AU-09a.','N/A','Determine if audit information and audit logging tools are protected from unauthorized access, modification, and deletion.'),\n('000165','draft','2009-05-22','DISA FSO','policy','Write audit records to hardware-enforced, write-once media.','AU-09(01)','N/A','Determine if audit trails are written to hardware-enforced, write-once media.'),\n('000166','draft','2009-05-22','DISA FSO','technical','Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.','AU-10','N/A','Determine if irrefutable evidence is provided that an individual (or process acting on behalf of an individual) has performed [AU-10_ODP; actions to be covered by non-repudiation are defined].'),\n('000167','draft','2009-05-22','DISA FSO','policy','Retain audit records for an organization-defined time period to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.','AU-11','N/A','Determine if audit records are retained for [AU-11_ODP; a time period to retain audit records that is consistent with the records retention policy is defined] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.'),\n('000168','draft','2009-09-15','DISA FSO','policy','Defines the time period for retention of audit records, which is consistent with its records retention policy, to provide support for after-the-fact investigations of incidents and meet regulatory and organizational information retention requirements.','AU-11','N/A','Determine if audit records are retained for [AU-11_ODP; a time period to retain audit records that is consistent with the records retention policy is defined] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.'),\n('000169','draft','2009-05-22','DISA FSO','technical','Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a on organization-defined information system components.','AU-12a.','N/A','Determine if audit record generation capability for the event types the system is capable of auditing (defined in AU-02_ODP[01]) is provided by [AU-12_ODP[01]; system components that provide an audit record generation capability for the events types (defined in AU-02_ODP[02]) are defined].'),\n('000170','draft','2009-11-03','DISA FSO','policy','Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.','PM-04a.02','N/A','Determine if: - a process to ensure that plans of action and milestones for the information security program and associated organizational systems document remedial information security risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document remedial privacy risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document remedial supply chain risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation.'),\n('000171','draft','2009-09-15','DISA FSO','technical','Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.','AU-12b.','N/A','Determine if [AU-12_ODP[02]; personnel or roles allowed to select the event types that are to be logged by specific components of the system is/are defined] is/are allowed to select the event types that are to be logged by specific components of the system.'),\n('000172','draft','2009-09-15','DISA FSO','technical','Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.','AU-12c.','N/A','Determine if audit records for the event types defined in AU-02_ODP[02] that include the audit record content defined in AU-03 are generated.'),\n('000173','draft','2009-09-15','DISA FSO','policy','Defines the level of tolerance for relationship between time stamps of individual records in the audit trail that will be used for correlation.','AU-12(01)','N/A','Determine if audit records from [AU-12(01)_ODP[01]; system components from which audit records are to be compiled into a system-wide (logical or physical) audit trail are defined] are compiled into a system-wide (logical or physical) audit trail that is time-correlated to within [AU-12(01)_ODP[02]; level of tolerance for the relationship between timestamps of individual records in the audit trail is defined].'),\n('000174','draft','2009-05-22','DISA FSO','technical','Compile audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail.','AU-12(01)','N/A','Determine if audit records from [AU-12(01)_ODP[01]; system components from which audit records are to be compiled into a system-wide (logical or physical) audit trail are defined] are compiled into a system-wide (logical or physical) audit trail that is time-correlated to within [AU-12(01)_ODP[02]; level of tolerance for the relationship between timestamps of individual records in the audit trail is defined].'),\n('000176','draft','2009-05-22','DISA FSO','policy','Manage system authenticators by establishing initial authenticator content for authenticators issued by the organization.','IA-05b.','N/A','Determine if system authenticators are managed through the establishment of initial authenticator content for any authenticators issued by the organization.'),\n('000182','draft','2009-05-22','DISA FSO','policy','Manage system authenticators by changing or refreshing authenticators in accordance with the organization-defined time period by authenticator type or when organization-defined events occur.','IA-05f.','N/A','Determine if system authenticators are managed through the change or refreshment of authenticators [IA-05_ODP[01]; a time period for changing or refreshing authenticators by authenticator type is defined] or when [IA-05_ODP[02]; events that trigger the change or refreshment of authenticators are defined] occur.'),\n('000183','draft','2009-05-22','DISA FSO','policy','Manage system authenticators by protecting authenticator content from unauthorized disclosure.','IA-05g.','N/A','Determine if system authenticators are managed through the protection of authenticator content from unauthorized disclosure and modification.'),\n('000184','draft','2009-05-22','DISA FSO','policy','Manage system authenticators by requiring individuals to take, and having devices implement, specific security controls to protect authenticators.','IA-05h.','N/A','Determine if: - system authenticators are managed through the requirement for individuals to take specific controls to protect authenticators. - system authenticators are managed through the requirement for devices to implement specific controls to protect authenticators.'),\n('000185','draft','2009-09-15','DISA FSO','technical','For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.','IA-05(02)(b)(01)','N/A','Determine if when public key infrastructure (PKI) is used, certificates are validated by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information.'),\n('000186','draft','2009-09-15','DISA FSO','technical','For public key-based authentication, enforce authorized access to the corresponding private key.','IA-05(02)(a)(01)','N/A','Determine if authorized access to the corresponding private key is enforced for public key-based authentication.'),\n('000187','draft','2009-09-15','DISA FSO','technical','For public key-based authentication, map the authenticated identity to the account of the individual or group.','IA-05(02)(a)(02)','N/A','Determine if the authenticated identity is mapped to the account of the individual or group for public key-based authentication.'),\n('000197','draft','2009-09-15','DISA FSO','technical','For password-based authentication, transmit passwords only over cryptographically-protected channels.','IA-05(01)(c)','N/A','Determine if for password-based authentication, passwords are only transmitted over cryptographically protected channels.'),\n('000201','draft','2009-05-22','DISA FSO','policy','Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.','IA-05(06)','N/A','Determine if authenticators are protected commensurate with the security category of the information to which use of the authenticator permits access.'),\n('000204','draft','2009-05-22','DISA FSO','policy','Defines the security controls required to manage the risk of compromise due to individuals having accounts on multiple systems.','IA-05(08)','N/A','Determine if [IA-05(08)_ODP; security controls implemented to manage the risk of compromise due to individuals having accounts on multiple systems are defined] are implemented to manage the risk of compromise due to individuals having accounts on multiple systems.'),\n('000206','draft','2009-05-22','DISA FSO','technical','Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.','IA-06','N/A','Determine if the feedback of authentication information is obscured during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.'),\n('000209','draft','2009-11-03','DISA FSO','policy','Develop the results of information security measures of performance.','PM-06','N/A','Determine if: - information security measures of performance are developed. - information security measures of performance are monitored. - the results of information security measures of performance are reported. - privacy measures of performance are developed. - privacy measures of performance are monitored. - the results of privacy measures of performance are reported.'),\n('000210','draft','2009-11-03','DISA FSO','policy','Monitor the results of information security measures of performance.','PM-06','N/A','Determine if: - information security measures of performance are developed. - information security measures of performance are monitored. - the results of information security measures of performance are reported. - privacy measures of performance are developed. - privacy measures of performance are monitored. - the results of privacy measures of performance are reported.'),\n('000211','draft','2009-11-03','DISA FSO','policy','Report on the results of information security measures of performance.','PM-06','N/A','Determine if: - information security measures of performance are developed. - information security measures of performance are monitored. - the results of information security measures of performance are reported. - privacy measures of performance are developed. - privacy measures of performance are monitored. - the results of privacy measures of performance are reported.'),\n('000212','draft','2009-11-03','DISA FSO','policy','Develop an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.','PM-07','N/A','Determine if: - an enterprise architecture is developed with consideration for information security. - an enterprise architecture is maintained with consideration for information security. - an enterprise architecture is developed with consideration for privacy. - an enterprise architecture is maintained with consideration for privacy. - an enterprise architecture is developed with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation. - an enterprise architecture is maintained with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.'),\n('000213','draft','2009-09-14','DISA FSO','technical','Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.','AC-03','N/A','Determine if approved authorizations for logical access to information and system resources are enforced in accordance with applicable access control policies.'),\n('000216','draft','2009-11-03','DISA FSO','policy','Address information security issues in the development and documentation of a critical infrastructure and key resources protection plan.','PM-08','N/A','Determine if: - information security issues are addressed in the development of a critical infrastructure and key resources protection plan. - information security issues are addressed in the documentation of a critical infrastructure and key resources protection plan. - information security issues are addressed in the update of a critical infrastructure and key resources protection plan. - privacy issues are addressed in the development of a critical infrastructure and key resources protection plan. - privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan. - privacy issues are addressed in the update of a critical infrastructure and key resources protection plan.'),\n('000217','draft','2009-09-24','DISA FSO','policy','Defines a time period after which inactive accounts are automatically disabled.',NULL,'N/A',NULL),\n('000219','draft','2009-09-14','DISA FSO','technical','When transferring information between different security domains, decompose information into organization-defined policy-relevant subcomponents for submission to policy enforcement mechanisms.','AC-04(13)','N/A','Determine if when transferring information between different security domains, information is decomposed into [AC-04(13)_ODP; policy-relevant subcomponents into which to decompose information for submission to policy enforcement mechanisms are defined] for submission to policy enforcement mechanisms.'),\n('000225','draft','2009-09-14','DISA FSO','policy','Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned organizational tasks.','AC-06','N/A','Determine if the principle of least privilege is employed, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.'),\n('000227','draft','2009-11-03','DISA FSO','policy','Develop a comprehensive strategy to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems.','PM-09a.01','N/A','Determine if a comprehensive strategy is developed to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems.'),\n('000228','draft','2009-11-03','DISA FSO','policy','Implement the risk management strategy consistently across the organization.','PM-09b.','N/A','Determine if the risk management strategy is implemented consistently across the organization.'),\n('000232','draft','2009-09-14','DISA FSO','policy','Document and provide supporting rationale in the security plan for the system, user actions not requiring identification and authentication.','AC-14b.','N/A','Determine if: - user actions not requiring identification or authentication are documented in the security plan for the system. - a rationale for user actions not requiring identification or authentication is provided in the security plan for the system.'),\n('000233','draft','2009-11-03','DISA FSO','policy','Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process.','PM-10b.','N/A','Determine if individuals are designated to fulfill specific roles and responsibilities within the organizational risk management process.'),\n('000234','draft','2009-11-03','DISA FSO','policy','Integrate the authorization processes into an organization-wide risk management program.','PM-10c.','N/A','Determine if the authorization processes are integrated into an organization-wide risk management program.'),\n('000235','draft','2009-11-04','DISA FSO','policy','Define organizational mission and business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.','PM-11a.','N/A','Determine if: - organizational mission and business processes are defined with consideration for information security. - organizational mission and business processes are defined with consideration for privacy. - organizational mission and business processes are defined with consideration for the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.'),\n('000236','draft','2009-11-04','DISA FSO','policy','Determine information protection needs arising from the defined mission and business processes.','PM-11b.','N/A','Determine if: - information protection needs arising from the defined mission and business processes are determined. - personally identifiable information processing needs arising from the defined mission and business processes are determined.'),\n('000238','draft','2009-09-15','DISA FSO','policy','Defines the frequency to review and update the current assessment, authorization, and monitoring policy.','CA-01c.01','N/A','Determine if: - the current assessment, authorization, and monitoring policy is reviewed and updated [CA-01_ODP[05]; the frequency at which the current assessment, authorization, and monitoring policy is reviewed and updated is defined]. - the current assessment, authorization, and monitoring policy is reviewed and updated following [CA-01_ODP[06]; events that would require the current assessment, authorization, and monitoring policy to be reviewed and updated are defined].'),\n('000239','draft','2009-09-15','DISA FSO','policy','Develop and document an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','CA-01a.01(a)','N/A','Determine if: - the [CA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] assessment, authorization, and monitoring policy addresses purpose. - the [CA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] assessment, authorization, and monitoring policy addresses scope. - the [CA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level};] assessment, authorization, and monitoring policy addresses roles. - the [CA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] assessment, authorization, and monitoring policy addresses responsibilities. - the [CA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] assessment, authorization, and monitoring policy addresses management commitment. - the [CA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] assessment, authorization, and monitoring policy addresses coordination among organizational entities. - the [CA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] assessment, authorization, and monitoring policy addresses compliance.'),\n('000240','draft','2009-09-15','DISA FSO','policy','Disseminates to organization-defined personnel or roles an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy.','CA-01a.','N/A','Determine if: - an assessment, authorization, and monitoring policy is developed and documented. - the assessment, authorization, and monitoring policy is disseminated to [CA-01_ODP[01]; personnel or roles to whom the assessment, authorization, and monitoring policy is to be disseminated is/are defined].'),\n('000241','draft','2009-09-15','DISA FSO','policy','Review and update the current assessment, authorization, and monitoring policy on an organization-defined frequency.','CA-01c.01','N/A','Determine if: - the current assessment, authorization, and monitoring policy is reviewed and updated [CA-01_ODP[05]; the frequency at which the current assessment, authorization, and monitoring policy is reviewed and updated is defined]. - the current assessment, authorization, and monitoring policy is reviewed and updated following [CA-01_ODP[06]; events that would require the current assessment, authorization, and monitoring policy to be reviewed and updated are defined].'),\n('000242','draft','2009-09-15','DISA FSO','policy','Develop and document procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls.','CA-01a.02','N/A','Determine if: - assessment, authorization, and monitoring procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls are developed and documented. - the assessment, authorization, and monitoring procedures are disseminated to [CA-01_ODP[02]; personnel or roles to whom the assessment, authorization, and monitoring procedures are to be disseminated is/are defined].'),\n('000243','draft','2009-09-15','DISA FSO','policy','Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls.','CA-01a.02','N/A','Determine if: - assessment, authorization, and monitoring procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls are developed and documented. - the assessment, authorization, and monitoring procedures are disseminated to [CA-01_ODP[02]; personnel or roles to whom the assessment, authorization, and monitoring procedures are to be disseminated is/are defined].'),\n('000244','draft','2009-09-15','DISA FSO','policy','Review and update the current assessment, authorization, and monitoring procedures on an organization-defined frequency.','CA-01c.02','N/A','Determine if: - the current assessment, authorization, and monitoring procedures are reviewed and updated [CA-01_ODP[07]; the frequency at which the current assessment, authorization, and monitoring procedures are reviewed and updated is defined]. - the current assessment, authorization, and monitoring procedures are reviewed and updated following [CA-01_ODP[08]; events that would require assessment, authorization, and monitoring procedures to be reviewed and updated are defined].'),\n('000246','draft','2009-09-15','DISA FSO','policy','Develop a control assessment plan that describes the scope of the assessment including controls and control enhancements under assessment.','CA-02b.01','N/A','Determine if a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment.'),\n('000247','draft','2009-09-15','DISA FSO','policy','Develop a control assessment plan that describes the scope of the assessment including assessment procedures to be used to determine control effectiveness.','CA-02b.02','N/A','Determine if a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness.'),\n('000248','draft','2009-09-15','DISA FSO','policy','Develop a control assessment plan that describes the scope of the assessment including assessment environment.','CA-02b.03','N/A','Determine if: - a control assessment plan is developed that describes the scope of the assessment, including the assessment environment. - a control assessment plan is developed that describes the scope of the assessment, including the assessment team. - a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities.'),\n('000251','draft','2009-09-15','DISA FSO','policy','Assess the controls in the systems and its environment of operation on an organization-defined frequency, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements.','CA-02d.','N/A','Determine if: - controls are assessed in the system and its environment of operation [CA-02_ODP[01]; the frequency at which to assess controls in the system and its environment of operation is defined] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements. - controls are assessed in the system and its environment of operation [CA-02_ODP[01]; the frequency at which to assess controls in the system and its environment of operation is defined] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established privacy requirements.'),\n('000252','draft','2009-09-15','DISA FSO','policy','Defines the frequency on which the security controls in the system and its environment of operation are assessed.','CA-02d.','N/A','Determine if: - controls are assessed in the system and its environment of operation [CA-02_ODP[01]; the frequency at which to assess controls in the system and its environment of operation is defined] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements. - controls are assessed in the system and its environment of operation [CA-02_ODP[01]; the frequency at which to assess controls in the system and its environment of operation is defined] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established privacy requirements.'),\n('000253','draft','2009-09-15','DISA FSO','policy','Produce a control assessment report that document the results of the assessment.',NULL,'N/A',NULL),\n('000254','draft','2009-09-15','DISA FSO','policy','Provide the results of the control assessment to organization-defined individuals or roles.','CA-02f.','N/A','Determine if the results of the control assessment are provided to [CA-02_ODP[02]; individuals or roles to whom control assessment results are to be provided are defined].'),\n('000255','draft','2009-09-15','DISA FSO','policy','Employ independent assessors or assessment teams to conduct control assessments.','CA-02(01)','N/A','Determine if independent assessors or assessment teams are employed to conduct control assessments.'),\n('000256','draft','2009-09-15','DISA FSO','policy','Include as part of the control assessments, announced or unannounced, on an organization-defined frequency, in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; and/or organization-defined other forms of assessment.','CA-02(02)','N/A','Determine if [CA-02(02)_ODP[01]; frequency at which to include specialized assessments as part of the control assessment is defined] [CA-02(02)_ODP[02]; one of the following PARAMETER VALUES is selected: {announced; unannounced}] [CA-02(02)_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [CA-02(02)_ODP[04]; other forms of assessment are defined (if selected)]}] are included as part of control assessments.'),\n('000258','draft','2009-09-15','DISA FSO','policy','Document, as part of each exchange agreement, the interface characteristics.','CA-03b.','N/A','Determine if: - the interface characteristics are documented as part of each exchange agreement. - security requirements are documented as part of each exchange agreement. - privacy requirements are documented as part of each exchange agreement. - controls are documented as part of each exchange agreement. - responsibilities for each system are documented as part of each exchange agreement. - the impact level of the information communicated is documented as part of each exchange agreement.'),\n('000259','draft','2009-09-15','DISA FSO','policy','Document, as part of each exchange agreement, the security requirements, controls and responsibilities for each system, and the impact level of the information communicated.','CA-03b.','N/A','Determine if: - the interface characteristics are documented as part of each exchange agreement. - security requirements are documented as part of each exchange agreement. - privacy requirements are documented as part of each exchange agreement. - controls are documented as part of each exchange agreement. - responsibilities for each system are documented as part of each exchange agreement. - the impact level of the information communicated is documented as part of each exchange agreement.'),\n('000264','draft','2009-09-15','DISA FSO','policy','Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system.','CA-05a.','N/A','Determine if a plan of action and milestones for the system is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system.'),\n('000265','draft','2009-09-15','DISA FSO','policy','Defines the frequency with which to update the existing plan of action and milestones for the system.','CA-05b.','N/A','Determine if existing plan of action and milestones are updated [CA-05_ODP; the frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities is defined] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.'),\n('000266','draft','2009-09-15','DISA FSO','policy','Update, on an organization-defined frequency, the existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.','CA-05b.','N/A','Determine if existing plan of action and milestones are updated [CA-05_ODP; the frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities is defined] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.'),\n('000267','draft','2009-09-15','DISA FSO','policy','Ensure the accuracy of the plan of action and milestones for the system using organization-defined automated mechanisms.','CA-05(01)','N/A','Determine if [CA-05(01)_ODP; automated mechanisms used to ensure the accuracy, currency, and availability of the plan of action and milestones for the system are defined] are used to ensure the accuracy, currency, and availability of the plan of action and milestones for the system.'),\n('000268','draft','2009-09-15','DISA FSO','policy','Ensure the currency of the plan of action and milestones for the system using organization-defined automated mechanisms.','CA-05(01)','N/A','Determine if [CA-05(01)_ODP; automated mechanisms used to ensure the accuracy, currency, and availability of the plan of action and milestones for the system are defined] are used to ensure the accuracy, currency, and availability of the plan of action and milestones for the system.'),\n('000269','draft','2009-09-15','DISA FSO','policy','Ensure the availability of the plan of action and milestones for the system using organization-defined automated mechanisms.','CA-05(01)','N/A','Determine if [CA-05(01)_ODP; automated mechanisms used to ensure the accuracy, currency, and availability of the plan of action and milestones for the system are defined] are used to ensure the accuracy, currency, and availability of the plan of action and milestones for the system.'),\n('000270','draft','2009-09-15','DISA FSO','policy','Assign a senior official as the authorizing official for the system.','CA-06a.','N/A','Determine if a senior official is assigned as the authorizing official for the system.'),\n('000271','draft','2009-09-15','DISA FSO','policy','Ensure the authorizing official for the system authorizes the system to operate before commencing operations.','CA-06c.02','N/A','Determine if before commencing operations, the authorizing official for the system authorizes the system to operate.'),\n('000272','draft','2009-09-15','DISA FSO','policy','Update the authorization on an organization-defined frequency.','CA-06e.','N/A','Determine if the authorizations are updated [CA-06_ODP; frequency at which to update the authorizations is defined].'),\n('000273','draft','2009-09-15','DISA FSO','policy','Defines the frequency with which to update the authorizations.','CA-06e.','N/A','Determine if the authorizations are updated [CA-06_ODP; frequency at which to update the authorizations is defined].'),\n('000274','draft','2009-09-15','DISA FSO','policy','Develop a continuous monitoring strategy.','CA-07','N/A','Determine if: - a system-level continuous monitoring strategy is developed. - system-level continuous monitoring is implemented in accordance with the organization-level continuous monitoring strategy.'),\n('000279','draft','2009-09-15','DISA FSO','policy','Implement ongoing control assessments in accordance with the continuous monitoring strategy.','CA-07c.','N/A','Determine if system-level continuous monitoring includes ongoing control assessments in accordance with the continuous monitoring strategy.'),\n('000280','draft','2009-09-15','DISA FSO','policy','Implement a continuous monitoring program that includes reporting the security status to organization-defined personnel or roles on an organization-defined frequency.','CA-07g.','N/A','Determine if: - system-level continuous monitoring includes reporting the security status of the system to [CA-07_ODP[04]; personnel or roles to whom the security status of the system is reported are defined] [CA-07_ODP[05]; frequency at which the security status of the system is reported is defined]. - system-level continuous monitoring includes reporting the privacy status of the system to [CA-07_ODP[06]; personnel or roles to whom the privacy status of the system is reported are defined] [CA-07_ODP[07]; frequency at which the privacy status of the system is reported is defined].'),\n('000281','draft','2009-09-15','DISA FSO','policy','Defines the frequency with which to report the security status to organization-defined personnel or roles.','CA-07g.','N/A','Determine if: - system-level continuous monitoring includes reporting the security status of the system to [CA-07_ODP[04]; personnel or roles to whom the security status of the system is reported are defined] [CA-07_ODP[05]; frequency at which the security status of the system is reported is defined]. - system-level continuous monitoring includes reporting the privacy status of the system to [CA-07_ODP[06]; personnel or roles to whom the privacy status of the system is reported are defined] [CA-07_ODP[07]; frequency at which the privacy status of the system is reported is defined].'),\n('000282','draft','2009-09-15','DISA FSO','policy','Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.','CA-07(01)','N/A','Determine if independent assessors or assessment teams are employed to monitor the controls in the system on an ongoing basis.'),\n('000286','draft','2009-09-17','DISA FSO','policy','Defines the frequency with which to review and update the configuration management policies.','CM-01c.01','N/A','Determine if: - the current configuration management policy is reviewed and updated [CM-01_ODP[05]; the frequency at which the current configuration management policy is reviewed and updated is defined]. - the current configuration management policy is reviewed and updated following [CM-01_ODP[06]; events that would require the current configuration management policy to be reviewed and updated are defined].'),\n('000287','draft','2009-09-17','DISA FSO','policy','Develop and document an organization-level; mission/business process-level; and/or system-level configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','CM-01a.01(a)','N/A','Determine if: - the [CM-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the configuration management policy addresses purpose. - the [CM-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the configuration management policy addresses scope. - the [CM-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the configuration management policy addresses roles. - the [CM-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the configuration management policy addresses responsibilities. - the [CM-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the configuration management policy addresses management commitment. - the [CM-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the configuration management policy addresses coordination among organizational entities. - the [CM-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the configuration management policy addresses compliance.'),\n('000289','draft','2009-09-17','DISA FSO','policy','Review and update, on an organization-defined frequency, the configuration management policy.','CM-01c.01','N/A','Determine if: - the current configuration management policy is reviewed and updated [CM-01_ODP[05]; the frequency at which the current configuration management policy is reviewed and updated is defined]. - the current configuration management policy is reviewed and updated following [CM-01_ODP[06]; events that would require the current configuration management policy to be reviewed and updated are defined].'),\n('000290','draft','2009-09-17','DISA FSO','policy','Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and the associated configuration management controls.','CM-01a.02','N/A','Determine if: - configuration management procedures to facilitate the implementation of the configuration management policy and associated configuration management controls are developed and documented. - the configuration management procedures are disseminated to [CM-01_ODP[02]; personnel or roles to whom the configuration management procedures are to be disseminated is/are defined].'),\n('000292','draft','2009-09-17','DISA FSO','policy','Review and update, on an organization-defined frequency, the procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and associated configuration management controls.','CM-01a.02','N/A','Determine if: - configuration management procedures to facilitate the implementation of the configuration management policy and associated configuration management controls are developed and documented. - the configuration management procedures are disseminated to [CM-01_ODP[02]; personnel or roles to whom the configuration management procedures are to be disseminated is/are defined].'),\n('000295','draft','2009-09-17','DISA FSO','policy','Maintain, under configuration control, a current baseline configuration of the system.','CM-02a.','N/A','Determine if: - a current baseline configuration of the system is developed and documented. - a current baseline configuration of the system is maintained under configuration control.'),\n('000296','draft','2009-09-17','DISA FSO','policy','Review and update the baseline configuration of the system on an organization-defined frequency.','CM-02b.01','N/A','Determine if the baseline configuration of the system is reviewed and updated [CM-02_ODP[01]; the frequency of baseline configuration review and update is defined].'),\n('000297','draft','2009-09-17','DISA FSO','policy','Review and update the baseline configuration of the system when required due to organization-defined circumstances.','CM-02b.02','N/A','Determine if the baseline configuration of the system is reviewed and updated when required due to [CM-02_ODP[02]; the circumstances requiring baseline configuration review and update are defined].'),\n('000300','draft','2009-09-17','DISA FSO','policy','Maintain complete configuration of the system using organization-defined automated mechanisms.','CM-02(02)','N/A','Determine if: - the currency of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the completeness of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the accuracy of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the availability of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined].'),\n('000301','draft','2009-09-17','DISA FSO','policy','Maintain current configuration of the system using organization-defined automated mechanisms.','CM-02(02)','N/A','Determine if: - the currency of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the completeness of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the accuracy of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the availability of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined].'),\n('000302','draft','2009-09-17','DISA FSO','policy','Maintain accurate configuration of the system using organization-defined automated mechanisms.','CM-02(02)','N/A','Determine if: - the currency of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the completeness of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the accuracy of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the availability of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined].'),\n('000303','draft','2009-09-17','DISA FSO','policy','Maintain available configuration of the system using organization-defined automated mechanisms.','CM-02(02)','N/A','Determine if: - the currency of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the completeness of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the accuracy of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the availability of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined].'),\n('000304','draft','2009-09-17','DISA FSO','policy','Retain organization-defined number of previous versions of baseline configurations of the system to support rollback.','CM-02(03)','N/A','Determine if [CM-02(03)_ODP; the number of previous baseline configuration versions to be retained is defined] of previous baseline configuration version(s) of the system is/are retained to support rollback.'),\n('000311','draft','2009-09-17','DISA FSO','policy','Maintain a baseline configuration for system development environments that is managed separately from the operational baseline configuration.','CM-02(06)','N/A','Determine if: - a baseline configuration for system development environments that is managed separately from the operational baseline configuration is maintained. - a baseline configuration for test environments that is managed separately from the operational baseline configuration is maintained.'),\n('000312','draft','2009-09-17','DISA FSO','policy','Maintain a baseline configuration for system test environments that is managed separately from the operational baseline configuration.','CM-02(06)','N/A','Determine if: - a baseline configuration for system development environments that is managed separately from the operational baseline configuration is maintained. - a baseline configuration for test environments that is managed separately from the operational baseline configuration is maintained.'),\n('000313','draft','2009-09-17','DISA FSO','policy','Determine and document the types of changes to the system that are configuration-controlled.','CM-03a.','N/A','Determine if the types of changes to the system that are configuration-controlled are determined and documented.'),\n('000314','draft','2009-09-17','DISA FSO','policy','Approve or disapprove configuration-controlled changes to the system, with explicit consideration for security impact analyses.','CM-03b.','N/A','Determine if: - proposed configuration-controlled changes to the system are reviewed. - proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security and privacy impact analyses.'),\n('000316','draft','2009-09-17','DISA FSO','policy','Retain records of configuration-controlled changes to the system for an organization-defined time period.','CM-03e.','N/A','Determine if records of configuration-controlled changes to the system are retained for [CM-03_ODP[01]; the time period to retain records of configuration-controlled changes is defined].'),\n('000318','draft','2009-09-17','DISA FSO','policy','Monitor and review activities associated with configuration-controlled changes to the system.','CM-03f.','N/A','Determine if: - activities associated with configuration-controlled changes to the system are monitored. - activities associated with configuration-controlled changes to the system are reviewed.'),\n('000319','draft','2009-09-17','DISA FSO','policy','Coordinate and provides oversight for configuration change control activities through an organization-defined configuration change control element that convenes at the organization-defined frequency, and/or for any organization-defined configuration change conditions.','CM-03g.','N/A','Determine if: - configuration change control activities are coordinated and overseen by [CM-03_ODP[02]; the configuration change control element responsible for coordinating and overseeing change control activities is defined]. - the configuration control element convenes [CM-03_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[CM-03_ODP[04]; the frequency at which the configuration control element convenes is defined (if selected)]; when [CM-03_ODP[05]; configuration change conditions that prompt the configuration control element to convene are defined (if selected)]}]].'),\n('000320','draft','2009-09-17','DISA FSO','policy','Defines the frequency with which to convene the configuration change control element.','CM-03g.','N/A','Determine if: - configuration change control activities are coordinated and overseen by [CM-03_ODP[02]; the configuration change control element responsible for coordinating and overseeing change control activities is defined]. - the configuration control element convenes [CM-03_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[CM-03_ODP[04]; the frequency at which the configuration control element convenes is defined (if selected)]; when [CM-03_ODP[05]; configuration change conditions that prompt the configuration control element to convene are defined (if selected)]}]].'),\n('000321','draft','2009-09-17','DISA FSO','policy','Defines configuration change conditions that prompt the configuration change control element to convene.','CM-03g.','N/A','Determine if: - configuration change control activities are coordinated and overseen by [CM-03_ODP[02]; the configuration change control element responsible for coordinating and overseeing change control activities is defined]. - the configuration control element convenes [CM-03_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[CM-03_ODP[04]; the frequency at which the configuration control element convenes is defined (if selected)]; when [CM-03_ODP[05]; configuration change conditions that prompt the configuration control element to convene are defined (if selected)]}]].'),\n('000322','draft','2009-09-17','DISA FSO','policy','Use organization-defined automated mechanisms to document proposed changes to the system.','CM-03(01)(a)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to document proposed changes to the system.'),\n('000323','draft','2009-09-17','DISA FSO','policy','Use organization-defined automated mechanisms to notify organization-defined approval authorities of proposed changes to the system and request change approval.','CM-03(01)(b)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to notify [CM-03(01)_ODP[02]; approval authorities to be notified of and request approval for proposed changes to the system are defined] of proposed changes to the system and request change approval.'),\n('000324','draft','2009-09-17','DISA FSO','policy','Use organization-defined automated mechanisms to highlight proposed changes to the system that have not been approved or disapproved by an organization-defined time period.','CM-03(01)(c)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to highlight proposed changes to the system that have not been approved or disapproved within [CM-03(01)_ODP[03]l the time period after which to highlight changes that have not been approved or disapproved is defined].'),\n('000325','draft','2009-09-17','DISA FSO','policy','Use organization-defined automated mechanisms to prohibit changes to the system until designated approvals are received.','CM-03(01)(d)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to prohibit changes to the system until designated approvals are received.'),\n('000326','draft','2009-09-17','DISA FSO','policy','Use organization-defined automated mechanisms to document all changes to the system.','CM-03(01)(e)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to document all changes to the system.'),\n('000327','draft','2009-09-17','DISA FSO','policy','Tests changes to the system before finalizing the implementation of the changes.','CM-03(02)','N/A','Determine if: - changes to the system are tested before finalizing the implementation of the changes. - changes to the system are validated before finalizing the implementation of the changes. - changes to the system are documented before finalizing the implementation of the changes.'),\n('000328','draft','2009-09-17','DISA FSO','policy','Validate changes to the system before finalizing the implementation of the changes.','CM-03(02)','N/A','Determine if: - changes to the system are tested before finalizing the implementation of the changes. - changes to the system are validated before finalizing the implementation of the changes. - changes to the system are documented before finalizing the implementation of the changes.'),\n('000329','draft','2009-09-17','DISA FSO','policy','Document changes to the system before finalizing the implementation of the changes.','CM-03(02)','N/A','Determine if: - changes to the system are tested before finalizing the implementation of the changes. - changes to the system are validated before finalizing the implementation of the changes. - changes to the system are documented before finalizing the implementation of the changes.'),\n('000330','draft','2009-09-17','DISA FSO','policy','Implement changes to the current system baseline using organization-defined automated mechanisms.','CM-03(03)','N/A','Determine if: - changes to the current system baseline are implemented using [CM-03(03)_ODP; mechanisms used to automate the implementation of changes and deployment of the updated baseline across the installed base are defined]. - the updated baseline is deployed across the installed base using [CM-03(03)_ODP; mechanisms used to automate the implementation of changes and deployment of the updated baseline across the installed base are defined].'),\n('000331','draft','2009-09-17','DISA FSO','policy','Deploy the updated system baseline across the installed base using organization-defined automated mechanism.','CM-03(03)','N/A','Determine if: - changes to the current system baseline are implemented using [CM-03(03)_ODP; mechanisms used to automate the implementation of changes and deployment of the updated baseline across the installed base are defined]. - the updated baseline is deployed across the installed base using [CM-03(03)_ODP; mechanisms used to automate the implementation of changes and deployment of the updated baseline across the installed base are defined].'),\n('000332','draft','2009-09-17','DISA FSO','policy','Require an organization-defined security representative to be a member of the organization-defined configuration change control element.','CM-03(04)','N/A','Determine if: - [CM-03(04)_ODP[01]; security representatives required to be members of the change control element are defined] are required to be members of the [CM-03(04)_ODP[03]; the configuration change control element of which the security and privacy representatives are to be members is defined]. - [CM-03(04)_ODP[02]; privacy representatives required to be members of the change control element are defined] are required to be members of the [CM-03(04)_ODP[03]; the configuration change control element of which the security and privacy representatives are to be members is defined].'),\n('000333','draft','2009-09-18','DISA FSO','policy','Analyze changes to the system to determine potential security impacts prior to change implementation.','CM-04','N/A','Determine if: - changes to the system are analyzed to determine potential security impacts prior to change implementation. - changes to the system are analyzed to determine potential privacy impacts prior to change implementation.'),\n('000335','draft','2009-09-18','DISA FSO','policy','After system changes, verify that the impacted controls are implemented correctly, meeting the security requirements for the system.','CM-04(02)','N/A','Determine if: - the impacted controls are implemented correctly with regard to meeting the security requirements for the system after system changes. - the impacted controls are implemented correctly with regard to meeting the privacy requirements for the system after system changes. - the impacted controls are operating as intended with regard to meeting the security requirements for the system after system changes. - the impacted controls are operating as intended with regard to meeting the privacy requirements for the system after system changes. - the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system after system changes. - the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system after system changes.'),\n('000336','draft','2009-09-18','DISA FSO','policy','After system changes, verify that the impacted controls are operating as intended, meeting the security requirements for the system.','CM-04(02)','N/A','Determine if: - the impacted controls are implemented correctly with regard to meeting the security requirements for the system after system changes. - the impacted controls are implemented correctly with regard to meeting the privacy requirements for the system after system changes. - the impacted controls are operating as intended with regard to meeting the security requirements for the system after system changes. - the impacted controls are operating as intended with regard to meeting the privacy requirements for the system after system changes. - the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system after system changes. - the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system after system changes.'),\n('000337','draft','2009-09-18','DISA FSO','policy','After system changes, verify that the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system.','CM-04(02)','N/A','Determine if: - the impacted controls are implemented correctly with regard to meeting the security requirements for the system after system changes. - the impacted controls are implemented correctly with regard to meeting the privacy requirements for the system after system changes. - the impacted controls are operating as intended with regard to meeting the security requirements for the system after system changes. - the impacted controls are operating as intended with regard to meeting the privacy requirements for the system after system changes. - the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system after system changes. - the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system after system changes.'),\n('000340','draft','2009-09-18','DISA FSO','policy','Approve physical access restrictions associated with changes to the system.','CM-05','N/A','Determine if: - physical access restrictions associated with changes to the system are defined and documented. - physical access restrictions associated with changes to the system are approved. - physical access restrictions associated with changes to the system are enforced. - logical access restrictions associated with changes to the system are defined and documented. - logical access restrictions associated with changes to the system are approved. - logical access restrictions associated with changes to the system are enforced.'),\n('000341','draft','2009-09-18','DISA FSO','policy','Enforce physical access restrictions associated with changes to the system.','CM-05','N/A','Determine if: - physical access restrictions associated with changes to the system are defined and documented. - physical access restrictions associated with changes to the system are approved. - physical access restrictions associated with changes to the system are enforced. - logical access restrictions associated with changes to the system are defined and documented. - logical access restrictions associated with changes to the system are approved. - logical access restrictions associated with changes to the system are enforced.'),\n('000344','draft','2009-09-18','DISA FSO','policy','Approve logical access restrictions associated with changes to the system.','CM-05','N/A','Determine if: - physical access restrictions associated with changes to the system are defined and documented. - physical access restrictions associated with changes to the system are approved. - physical access restrictions associated with changes to the system are enforced. - logical access restrictions associated with changes to the system are defined and documented. - logical access restrictions associated with changes to the system are approved. - logical access restrictions associated with changes to the system are enforced.'),\n('000345','draft','2009-09-18','DISA FSO','policy','Enforce logical access restrictions associated with changes to the system.','CM-05','N/A','Determine if: - physical access restrictions associated with changes to the system are defined and documented. - physical access restrictions associated with changes to the system are approved. - physical access restrictions associated with changes to the system are enforced. - logical access restrictions associated with changes to the system are defined and documented. - logical access restrictions associated with changes to the system are approved. - logical access restrictions associated with changes to the system are enforced.'),\n('000353','draft','2009-09-18','DISA FSO','policy','Defines system components requiring enforcement of a dual authorization for system changes.','CM-05(04)','N/A','Determine if: - dual authorization for implementing changes to [CM-05(04)_ODP[01]; system components requiring dual authorization for changes are defined] is enforced. - dual authorization for implementing changes to [CM-05(04)_ODP[02]; system-level information requiring dual authorization for changes is defined] is enforced.'),\n('000354','draft','2009-09-18','DISA FSO','policy','Enforce dual authorization for implementing changes to organization-defined system components.','CM-05(04)','N/A','Determine if: - dual authorization for implementing changes to [CM-05(04)_ODP[01]; system components requiring dual authorization for changes are defined] is enforced. - dual authorization for implementing changes to [CM-05(04)_ODP[02]; system-level information requiring dual authorization for changes is defined] is enforced.'),\n('000366','draft','2009-09-18','DISA FSO','policy','Implement the security configuration settings.','CM-06b.','N/A','Determine if the configuration settings documented in CM-06a are implemented.'),\n('000367','draft','2009-09-18','DISA FSO','policy','Identify any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.','CM-06c.','N/A','Determine if: - any deviations from established configuration settings for [CM-06_ODP[02]; system components for which approval of deviations is needed are defined] are identified and documented based on [CM-06_ODP[03]; operational requirements necessitating approval of deviations are defined]. - any deviations from established configuration settings for [CM-06_ODP[02]; system components for which approval of deviations is needed are defined] are approved.'),\n('000368','draft','2009-09-18','DISA FSO','policy','Document any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.','CM-06c.','N/A','Determine if: - any deviations from established configuration settings for [CM-06_ODP[02]; system components for which approval of deviations is needed are defined] are identified and documented based on [CM-06_ODP[03]; operational requirements necessitating approval of deviations are defined]. - any deviations from established configuration settings for [CM-06_ODP[02]; system components for which approval of deviations is needed are defined] are approved.'),\n('000369','draft','2009-09-18','DISA FSO','policy','Approve any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.','CM-06c.','N/A','Determine if: - any deviations from established configuration settings for [CM-06_ODP[02]; system components for which approval of deviations is needed are defined] are identified and documented based on [CM-06_ODP[03]; operational requirements necessitating approval of deviations are defined]. - any deviations from established configuration settings for [CM-06_ODP[02]; system components for which approval of deviations is needed are defined] are approved.'),\n('000370','draft','2009-09-18','DISA FSO','policy','Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.','CM-06(01)','N/A','Determine if: - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are managed using [CM-06(01)_ODP[02]; automated mechanisms to manage configuration settings are defined]. - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are applied using [CM-06(01)_ODP[03]; automated mechanisms to apply configuration settings are defined]. - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are verified using [CM-06(01)_ODP[04]; automated mechanisms to verify configuration settings are defined].'),\n('000371','draft','2009-09-18','DISA FSO','policy','Apply configuration settings for organization-defined system components using organization-defined automated mechanisms.','CM-06(01)','N/A','Determine if: - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are managed using [CM-06(01)_ODP[02]; automated mechanisms to manage configuration settings are defined]. - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are applied using [CM-06(01)_ODP[03]; automated mechanisms to apply configuration settings are defined]. - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are verified using [CM-06(01)_ODP[04]; automated mechanisms to verify configuration settings are defined].'),\n('000372','draft','2009-09-18','DISA FSO','policy','Verify configuration settings for organization-defined system components using organization-defined automated mechanisms.','CM-06(01)','N/A','Determine if: - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are managed using [CM-06(01)_ODP[02]; automated mechanisms to manage configuration settings are defined]. - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are applied using [CM-06(01)_ODP[03]; automated mechanisms to apply configuration settings are defined]. - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are verified using [CM-06(01)_ODP[04]; automated mechanisms to verify configuration settings are defined].'),\n('000380','draft','2009-09-18','DISA FSO','policy','Defines prohibited or restricted functions, system ports, protocols, software and/or services for the system.','CM-07b.','N/A','Determine if: - the use of [CM-07_ODP[02]; functions to be prohibited or restricted are defined] is prohibited or restricted. - the use of [CM-07_ODP[03]; ports to be prohibited or restricted are defined] is prohibited or restricted. - the use of [CM-07_ODP[04]; protocols to be prohibited or restricted are defined] is prohibited or restricted. - the use of [CM-07_ODP[05]; software to be prohibited or restricted is defined] is prohibited or restricted. - the use of [CM-07_ODP[06]; services to be prohibited or restricted are defined] is prohibited or restricted.'),\n('000381','draft','2009-09-18','DISA FSO','technical','Configure the system to provide only organization-defined mission essential capabilities.','CM-07a.','N/A','Determine if the system is configured to provide only [CM-07_ODP[01]; mission-essential capabilities for the system are defined].'),\n('000382','draft','2009-09-18','DISA FSO','technical','Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.','CM-07b.','N/A','Determine if: - the use of [CM-07_ODP[02]; functions to be prohibited or restricted are defined] is prohibited or restricted. - the use of [CM-07_ODP[03]; ports to be prohibited or restricted are defined] is prohibited or restricted. - the use of [CM-07_ODP[04]; protocols to be prohibited or restricted are defined] is prohibited or restricted. - the use of [CM-07_ODP[05]; software to be prohibited or restricted is defined] is prohibited or restricted. - the use of [CM-07_ODP[06]; services to be prohibited or restricted are defined] is prohibited or restricted.'),\n('000384','draft','2009-09-18','DISA FSO','policy','Review the system per organization-defined frequency to identify unnecessary and nonsecure functions, ports, protocols, software, and services.','CM-07(01)(a)','N/A','Determine if the system is reviewed [CM-07(01)_ODP[01]; the frequency at which to review the system to identify unnecessary and/or non-secure functions, ports, protocols, software, and/or services is defined] to identify unnecessary and/or non-secure functions, ports, protocols, software, and services.'),\n('000387','draft','2009-09-18','DISA FSO','policy','Defines registration requirements for functions, ports, protocols, and services.','CM-07(03)','N/A','Determine if [CM-07(03)_ODP; registration requirements for functions, ports, protocols, and services are defined] are complied with.'),\n('000388','draft','2009-09-18','DISA FSO','policy','Ensure compliance with organization-defined registration requirements for functions, ports, protocols, and services.','CM-07(03)','N/A','Determine if [CM-07(03)_ODP; registration requirements for functions, ports, protocols, and services are defined] are complied with.'),\n('000398','draft','2009-09-18','DISA FSO','policy','Defines information deemed necessary to achieve effective system component accountability.','CM-08a.05','N/A','Determine if an inventory of system components that includes [CM-08_ODP[01]; information deemed necessary to achieve effective system component accountability is defined] is developed and documented.'),\n('000408','draft','2009-09-18','DISA FSO','policy','Update the inventory of system components as part of component installations.','CM-08(01)','N/A','Determine if: - the inventory of system components is updated as part of component installations. - the inventory of system components is updated as part of component removals. - the inventory of system components is updated as part of system updates.'),\n('000409','draft','2009-09-18','DISA FSO','policy','Update the inventory of system components as part of component removals.','CM-08(01)','N/A','Determine if: - the inventory of system components is updated as part of component installations. - the inventory of system components is updated as part of component removals. - the inventory of system components is updated as part of system updates.'),\n('000410','draft','2009-09-18','DISA FSO','policy','Update the inventory of system components as part of system updates.','CM-08(01)','N/A','Determine if: - the inventory of system components is updated as part of component installations. - the inventory of system components is updated as part of component removals. - the inventory of system components is updated as part of system updates.'),\n('000411','draft','2009-09-18','DISA FSO','policy','Maintain the currency of the inventory of system components using organization-defined automated mechanisms.','CM-08(02)','N/A','Determine if: - [CM-08(02)_ODP[01]; automated mechanisms used to maintain the currency of the system component inventory are defined] are used to maintain the currency of the system component inventory. - [CM-08(02)_ODP[02]; automated mechanisms used to maintain the completeness of the system component inventory are defined] are used to maintain the completeness of the system component inventory. - [CM-08(02)_ODP[03]; automated mechanisms used to maintain the accuracy of the system component inventory are defined] are used to maintain the accuracy of the system component inventory. - [CM-08(02)_ODP[04]; automated mechanisms used to maintain the availability of the system component inventory are defined] are used to maintain the availability of the system component inventory.'),\n('000412','draft','2009-09-18','DISA FSO','policy','Maintain the completeness of the inventory of system components using organization-defined automated mechanisms.','CM-08(02)','N/A','Determine if: - [CM-08(02)_ODP[01]; automated mechanisms used to maintain the currency of the system component inventory are defined] are used to maintain the currency of the system component inventory. - [CM-08(02)_ODP[02]; automated mechanisms used to maintain the completeness of the system component inventory are defined] are used to maintain the completeness of the system component inventory. - [CM-08(02)_ODP[03]; automated mechanisms used to maintain the accuracy of the system component inventory are defined] are used to maintain the accuracy of the system component inventory. - [CM-08(02)_ODP[04]; automated mechanisms used to maintain the availability of the system component inventory are defined] are used to maintain the availability of the system component inventory.'),\n('000413','draft','2009-09-18','DISA FSO','policy','Maintain the accuracy of the inventory of system components using organization-defined automated mechanisms.','CM-08(02)','N/A','Determine if: - [CM-08(02)_ODP[01]; automated mechanisms used to maintain the currency of the system component inventory are defined] are used to maintain the currency of the system component inventory. - [CM-08(02)_ODP[02]; automated mechanisms used to maintain the completeness of the system component inventory are defined] are used to maintain the completeness of the system component inventory. - [CM-08(02)_ODP[03]; automated mechanisms used to maintain the accuracy of the system component inventory are defined] are used to maintain the accuracy of the system component inventory. - [CM-08(02)_ODP[04]; automated mechanisms used to maintain the availability of the system component inventory are defined] are used to maintain the availability of the system component inventory.'),\n('000414','draft','2009-09-18','DISA FSO','policy','Maintain the availability of the inventory of system components using organization-defined automated mechanisms.','CM-08(02)','N/A','Determine if: - [CM-08(02)_ODP[01]; automated mechanisms used to maintain the currency of the system component inventory are defined] are used to maintain the currency of the system component inventory. - [CM-08(02)_ODP[02]; automated mechanisms used to maintain the completeness of the system component inventory are defined] are used to maintain the completeness of the system component inventory. - [CM-08(02)_ODP[03]; automated mechanisms used to maintain the accuracy of the system component inventory are defined] are used to maintain the accuracy of the system component inventory. - [CM-08(02)_ODP[04]; automated mechanisms used to maintain the availability of the system component inventory are defined] are used to maintain the availability of the system component inventory.'),\n('000415','draft','2009-09-18','DISA FSO','policy','Defines the frequency of employing automated mechanisms to detect the presence of unauthorized hardware, software, and firmware components within the system.','CM-08(03)(a)','N/A','Determine if: - the presence of unauthorized hardware within the system is detected using [CM-08(03)_ODP[01]; automated mechanisms used to detect the presence of unauthorized hardware within the system are defined] [CM-08(03)_ODP[04]; frequency at which automated mechanisms are used to detect the presence of unauthorized system components within the system is defined]. - the presence of unauthorized software within the system is detected using [CM-08(03)_ODP[02]; automated mechanisms used to detect the presence of unauthorized software within the system are defined] [CM-08(03)_ODP[04]; frequency at which automated mechanisms are used to detect the presence of unauthorized system components within the system is defined;]. - the presence of unauthorized firmware within the system is detected using [CM-08(03)_ODP[03]; automated mechanisms used to detect the presence of unauthorized firmware within the system are defined] [CM-08(03)_ODP[04]; frequency at which automated mechanisms are used to detect the presence of unauthorized system components within the system is defined].'),\n('000416','draft','2009-09-18','DISA FSO','policy','Detect the presence of unauthorized hardware, software, and firmware components within the system using organization-defined automated mechanisms, on an organization-defined frequency.','CM-08(03)(a)','N/A','Determine if: - the presence of unauthorized hardware within the system is detected using [CM-08(03)_ODP[01]; automated mechanisms used to detect the presence of unauthorized hardware within the system are defined] [CM-08(03)_ODP[04]; frequency at which automated mechanisms are used to detect the presence of unauthorized system components within the system is defined]. - the presence of unauthorized software within the system is detected using [CM-08(03)_ODP[02]; automated mechanisms used to detect the presence of unauthorized software within the system are defined] [CM-08(03)_ODP[04]; frequency at which automated mechanisms are used to detect the presence of unauthorized system components within the system is defined;]. - the presence of unauthorized firmware within the system is detected using [CM-08(03)_ODP[03]; automated mechanisms used to detect the presence of unauthorized firmware within the system are defined] [CM-08(03)_ODP[04]; frequency at which automated mechanisms are used to detect the presence of unauthorized system components within the system is defined].'),\n('000418','draft','2009-09-18','DISA FSO','policy','Include in the system component inventory information, a means for identifying by name, position, and/or role, individuals responsible and accountable for administering those components.','CM-08(04)','N/A','Determine if individuals responsible and accountable for administering system components are identified by [CM-08(04)_ODP; one or more of the following PARAMETER VALUES is/are selected: {name; position; role}] in the system component inventory.'),\n('000420','draft','2009-09-18','DISA FSO','policy','Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.','CM-08(06)','N/A','Determine if: - assessed component configurations are included in the system component inventory. - any approved deviations to current deployed configurations are included in the system component inventory.'),\n('000423','draft','2009-09-18','DISA FSO','policy','Implement a configuration management plan for the system that addresses roles, responsibilities, and configuration management processes and procedures.','CM-09a.','N/A','Determine if: - the configuration management plan addresses roles. - the configuration management plan addresses responsibilities. - the configuration management plan addresses configuration management processes and procedures.'),\n('000426','draft','2009-09-18','DISA FSO','policy','Implement a configuration management plan for the system that defines the configuration items for the system.','CM-09c.','N/A','Determine if: - the configuration management plan defines the configuration items for the system. - the configuration management plan places the configuration items under configuration management.'),\n('000436','draft','2009-09-18','DISA FSO','policy','Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.','CM-09(01)','N/A','Determine if the responsibility for developing the configuration management process is assigned to organizational personnel who are not directly involved in system development.'),\n('000437','draft','2009-09-18','DISA FSO','policy','Defines the frequency with which to review and update the current contingency planning policy.','CP-01c.01','N/A','Determine if: - the current contingency planning policy is reviewed and updated [CP-01_ODP[05]; the frequency at which the current contingency planning policy is reviewed and updated is defined]. - the current contingency planning policy is reviewed and updated following [CP-01_ODP[06]; events that would require the current contingency planning policy to be reviewed and updated are defined].'),\n('000438','draft','2009-09-18','DISA FSO','policy','Develop and document an organizational-level; mission/business process-level; and/or system-level contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','CP-01a.01(a)','N/A','Determine if: - the [CP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] contingency planning policy addresses purpose. - the [CP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] contingency planning policy addresses scope. - the [CP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] contingency planning policy addresses roles. - the [CP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] contingency planning policy addresses responsibilities. - the [CP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] contingency planning policy addresses management commitment. - the [CP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] contingency planning policy addresses coordination among organizational entities. - the [CP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] contingency planning policy addresses compliance.'),\n('000439','draft','2009-09-18','DISA FSO','policy','Disseminate an organizational-level; mission/business process-level; and/or system-level contingency planning policy to organization-defined personnel or roles.','CP-01a.','N/A','Determine if: - a contingency planning policy is developed and documented. - the contingency planning policy is disseminated to [CP-01_ODP[01]; personnel or roles to whom the contingency planning policy is to be disseminated is/are defined].'),\n('000440','draft','2009-09-18','DISA FSO','policy','Review and update the current contingency planning policy in accordance with an organization-defined frequency.','CP-01c.01','N/A','Determine if: - the current contingency planning policy is reviewed and updated [CP-01_ODP[05]; the frequency at which the current contingency planning policy is reviewed and updated is defined]. - the current contingency planning policy is reviewed and updated following [CP-01_ODP[06]; events that would require the current contingency planning policy to be reviewed and updated are defined].'),\n('000441','draft','2009-09-18','DISA FSO','policy','Develop and document procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls.','CP-01a.02','N/A','Determine if: - contingency planning procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls are developed and documented. - the contingency planning procedures are disseminated to [CP-01_ODP[02]; personnel or roles to whom the contingency planning procedures are to be disseminated is/are defined].'),\n('000443','draft','2009-09-18','DISA FSO','policy','Develop a contingency plan for the system that identifies essential missions.','CP-02a.01','N/A','Determine if a contingency plan for the system is developed that identifies essential mission and business functions and associated contingency requirements.'),\n('000444','draft','2009-09-18','DISA FSO','policy','Develop a contingency plan for the system that identifies essential business functions.','CP-02a.01','N/A','Determine if a contingency plan for the system is developed that identifies essential mission and business functions and associated contingency requirements.'),\n('000445','draft','2009-09-18','DISA FSO','policy','Develop a contingency plan for the system that identifies associated contingency requirements.','CP-02a.01','N/A','Determine if a contingency plan for the system is developed that identifies essential mission and business functions and associated contingency requirements.'),\n('000446','draft','2009-09-18','DISA FSO','policy','Develop a contingency plan for the system that provides recovery objectives.','CP-02a.02','N/A','Determine if: - a contingency plan for the system is developed that provides recovery objectives. - a contingency plan for the system is developed that provides restoration priorities. - a contingency plan for the system is developed that provides metrics.'),\n('000447','draft','2009-09-18','DISA FSO','policy','Develop a contingency plan for the system that provides restoration priorities.','CP-02a.02','N/A','Determine if: - a contingency plan for the system is developed that provides recovery objectives. - a contingency plan for the system is developed that provides restoration priorities. - a contingency plan for the system is developed that provides metrics.'),\n('000448','draft','2009-09-18','DISA FSO','policy','Develop a contingency plan for the system that provides metrics.','CP-02a.02','N/A','Determine if: - a contingency plan for the system is developed that provides recovery objectives. - a contingency plan for the system is developed that provides restoration priorities. - a contingency plan for the system is developed that provides metrics.'),\n('000449','draft','2009-09-18','DISA FSO','policy','Develop a contingency plan for the system that addresses contingency roles, responsibilities, assigned individuals with contact information.','CP-02a.03','N/A','Determine if: - a contingency plan for the system is developed that addresses contingency roles. - a contingency plan for the system is developed that addresses contingency responsibilities. - a contingency plan for the system is developed that addresses assigned individuals with contact information.'),\n('000456','draft','2009-09-18','DISA FSO','policy','Develop a contingency plan for the system that addresses eventual, full system restoration without deterioration of the controls originally planned and implemented.','CP-02a.05','N/A','Determine if a contingency plan for the system is developed that addresses eventual, full-system restoration without deterioration of the controls originally planned and implemented.'),\n('000457','draft','2009-09-18','DISA FSO','policy','Develop a contingency plan for the system that is reviewed and approved by organization-defined personnel or roles.','CP-02a.07','N/A','Determine if: - a contingency plan for the system is developed that is reviewed by [CP-02_ODP[01]; personnel or roles to review a contingency plan is/are defined]. - a contingency plan for the system is developed that is approved by [CP-02_ODP[02]; personnel or roles to approve a contingency plan is/are defined].'),\n('000458','draft','2009-09-18','DISA FSO','policy','Defines the key contingency personnel (identified by name and/or by role) and organizational elements designated to receive copies of the contingency plan.','CP-02b.','N/A','Determine if: - copies of the contingency plan are distributed to [CP-02_ODP[03]; key contingency personnel (identified by name and/or by role) to whom copies of the contingency plan are distributed are defined]. - copies of the contingency plan are distributed to [CP-02_ODP[04]; key contingency organizational elements to which copies of the contingency plan are distributed are defined].'),\n('000459','draft','2009-09-18','DISA FSO','policy','Distributes copies of the contingency plan to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements.','CP-02b.','N/A','Determine if: - copies of the contingency plan are distributed to [CP-02_ODP[03]; key contingency personnel (identified by name and/or by role) to whom copies of the contingency plan are distributed are defined]. - copies of the contingency plan are distributed to [CP-02_ODP[04]; key contingency organizational elements to which copies of the contingency plan are distributed are defined].'),\n('000460','draft','2009-09-18','DISA FSO','policy','Coordinate contingency planning activities with incident handling activities.','CP-02c.','N/A','Determine if contingency planning activities are coordinated with incident handling activities.'),\n('000461','draft','2009-09-18','DISA FSO','policy','Defines the frequency with which to review the contingency plan for the system.','CP-02d.','N/A','Determine if the contingency plan for the system is reviewed [CP-02_ODP[05]; frequency of contingency plan review is defined].'),\n('000462','draft','2009-09-18','DISA FSO','policy','Reviews the contingency plan for the system in accordance with organization-defined frequency.','CP-02d.','N/A','Determine if the contingency plan for the system is reviewed [CP-02_ODP[05]; frequency of contingency plan review is defined].'),\n('000463','draft','2009-09-18','DISA FSO','policy','Updates the contingency plan to address changes to the organization.','CP-02e.','N/A','Determine if: - the contingency plan is updated to address changes to the organization, system, or environment of operation. - the contingency plan is updated to address problems encountered during contingency plan implementation, execution, or testing.'),\n('000464','draft','2009-09-18','DISA FSO','policy','Updates the contingency plan to address changes to the system.','CP-02e.','N/A','Determine if: - the contingency plan is updated to address changes to the organization, system, or environment of operation. - the contingency plan is updated to address problems encountered during contingency plan implementation, execution, or testing.'),\n('000465','draft','2009-09-18','DISA FSO','policy','Updates the contingency plan to address changes to the environment of operation.','CP-02e.','N/A','Determine if: - the contingency plan is updated to address changes to the organization, system, or environment of operation. - the contingency plan is updated to address problems encountered during contingency plan implementation, execution, or testing.'),\n('000466','draft','2009-09-18','DISA FSO','policy','Updates the contingency plan to address problems encountered during contingency plan implementation, execution, or testing.','CP-02e.','N/A','Determine if: - the contingency plan is updated to address changes to the organization, system, or environment of operation. - the contingency plan is updated to address problems encountered during contingency plan implementation, execution, or testing.'),\n('000468','draft','2009-09-18','DISA FSO','policy','Communicates contingency plan changes to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements.','CP-02f.','N/A','Determine if: - contingency plan changes are communicated to [CP-02_ODP[06]; key contingency personnel (identified by name and/or by role) to communicate changes to are defined]. - contingency plan changes are communicated to [CP-02_ODP[07]; key contingency organizational elements to communicate changes to are defined].'),\n('000469','draft','2009-09-18','DISA FSO','policy','Coordinate contingency plan development with organizational elements responsible for related plans.','CP-02(01)','N/A','Determine if contingency plan development is coordinated with organizational elements responsible for related plans.'),\n('000470','draft','2009-09-18','DISA FSO','policy','Conduct capacity planning so that necessary capacity for information processing exists during contingency operations.','CP-02(02)','N/A','Determine if: - capacity planning is conducted so that the necessary capacity exists during contingency operations for information processing. - capacity planning is conducted so that the necessary capacity exists during contingency operations for telecommunications. - capacity planning is conducted so that the necessary capacity exists during contingency operations for environmental support.'),\n('000471','draft','2009-09-18','DISA FSO','policy','Conduct capacity planning so that necessary capacity for telecommunications exists during contingency operations.','CP-02(02)','N/A','Determine if: - capacity planning is conducted so that the necessary capacity exists during contingency operations for information processing. - capacity planning is conducted so that the necessary capacity exists during contingency operations for telecommunications. - capacity planning is conducted so that the necessary capacity exists during contingency operations for environmental support.'),\n('000472','draft','2009-09-18','DISA FSO','policy','Conduct capacity planning so that necessary capacity for environmental support exists during contingency operations.','CP-02(02)','N/A','Determine if: - capacity planning is conducted so that the necessary capacity exists during contingency operations for information processing. - capacity planning is conducted so that the necessary capacity exists during contingency operations for telecommunications. - capacity planning is conducted so that the necessary capacity exists during contingency operations for environmental support.'),\n('000473','draft','2009-09-18','DISA FSO','policy','Defines the time period for planning the resumption of essential missions as a result of contingency plan activation.','CP-02(03)','N/A','Determine if the resumption of [CP-02(03)_ODP[01]; one of the following PARAMETER VALUES is selected: {all; essential}] mission and business functions are planned for within [CP-02(03)_ODP[02]; the contingency plan activation time period within which to resume mission and business functions is defined] of contingency plan activation.'),\n('000474','draft','2009-09-18','DISA FSO','policy','Defines the time period for planning the resumption of essential business functions as a result of contingency plan activation.','CP-02(03)','N/A','Determine if the resumption of [CP-02(03)_ODP[01]; one of the following PARAMETER VALUES is selected: {all; essential}] mission and business functions are planned for within [CP-02(03)_ODP[02]; the contingency plan activation time period within which to resume mission and business functions is defined] of contingency plan activation.'),\n('000475','draft','2009-09-18','DISA FSO','policy','Plan for the resumption of all or essential mission functions within the organization-defined time period of contingency plan activation.','CP-02(03)','N/A','Determine if the resumption of [CP-02(03)_ODP[01]; one of the following PARAMETER VALUES is selected: {all; essential}] mission and business functions are planned for within [CP-02(03)_ODP[02]; the contingency plan activation time period within which to resume mission and business functions is defined] of contingency plan activation.'),\n('000476','draft','2009-09-18','DISA FSO','policy','Plan for the resumption of all or essential business functions within the organization-defined time period of contingency plan activation.','CP-02(03)','N/A','Determine if the resumption of [CP-02(03)_ODP[01]; one of the following PARAMETER VALUES is selected: {all; essential}] mission and business functions are planned for within [CP-02(03)_ODP[02]; the contingency plan activation time period within which to resume mission and business functions is defined] of contingency plan activation.'),\n('000481','draft','2009-09-18','DISA FSO','policy','Plan for the continuance of all or essential missions with little or no loss of operational continuity.','CP-02(05)','N/A','Determine if: - the continuance of [CP-02(05)_ODP; one of the following PARAMETER VALUES is selected: {all; essential}] mission and business functions with minimal or no loss of operational continuity is planned for. - continuity is sustained until full system restoration at primary processing and/or storage sites.'),\n('000482','draft','2009-09-18','DISA FSO','policy','Plan for the continuance of all or essential business functions with little or no loss of operational continuity.','CP-02(05)','N/A','Determine if: - the continuance of [CP-02(05)_ODP; one of the following PARAMETER VALUES is selected: {all; essential}] mission and business functions with minimal or no loss of operational continuity is planned for. - continuity is sustained until full system restoration at primary processing and/or storage sites.'),\n('000483','draft','2009-09-18','DISA FSO','policy','Plan for the transfer of all or essential mission functions to alternate processing and/or storage sites with minimal or no loss of operational continuity.','CP-02(06)','N/A','Determine if: - the transfer of [CP-02(06)_ODP; one of the following PARAMETER VALUES is selected: {all; essential}] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity is planned for. - operational continuity is sustained until full system restoration at primary processing and/or storage sites.'),\n('000484','draft','2009-09-18','DISA FSO','policy','Plan for the transfer of all or essential business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity.','CP-02(06)','N/A','Determine if: - the transfer of [CP-02(06)_ODP; one of the following PARAMETER VALUES is selected: {all; essential}] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity is planned for. - operational continuity is sustained until full system restoration at primary processing and/or storage sites.'),\n('000485','draft','2009-09-21','DISA FSO','policy','Defines the frequency of contingency training to system users.','CP-03a.03','N/A','Determine if contingency training is provided to system users consistent with assigned roles and responsibilities [CP-03_ODP[02]; frequency at which to provide training to system users with a contingency role or responsibility is defined] thereafter.'),\n('000486','draft','2009-09-21','DISA FSO','policy','Provide contingency training to system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming a contingency role or responsibility.','CP-03a.01','N/A','Determine if contingency training is provided to system users consistent with assigned roles and responsibilities within [CP-03_ODP[01]; the time period within which to provide contingency training after assuming a contingency role or responsibility is defined] of assuming a contingency role or responsibility.'),\n('000487','draft','2009-09-21','DISA FSO','policy','Provide contingency training to system users consistent with assigned roles and responsibilities in accordance with organization-defined frequency.','CP-03a.03','N/A','Determine if contingency training is provided to system users consistent with assigned roles and responsibilities [CP-03_ODP[02]; frequency at which to provide training to system users with a contingency role or responsibility is defined] thereafter.'),\n('000488','draft','2009-09-21','DISA FSO','policy','Incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations.','CP-03(01)','N/A','Determine if simulated events are incorporated into contingency training to facilitate effective response by personnel in crisis situations.'),\n('000489','draft','2009-09-21','DISA FSO','policy','Employ mechanisms used in operations to provide a more thorough and realistic contingency training environment.','CP-03(02)','N/A','Determine if mechanisms used in operations are employed to provide a more thorough and realistic contingency training environment.'),\n('000490','draft','2009-09-21','DISA FSO','policy','Defines the frequency with which to test the contingency plan for the system.','CP-04a.','N/A','Determine if: - the contingency plan for the system is tested [CP-04_ODP[01]; frequency of testing the contingency plan for the system is defined]. - [CP-04_ODP[02]; tests for determining the effectiveness of the contingency plan are defined] are used to determine the effectiveness of the plan. - [CP-04_ODP[03]; tests for determining readiness to execute the contingency plan are defined] are used to determine the readiness to execute the plan.'),\n('000492','draft','2009-09-21','DISA FSO','policy','Defines the contingency plan tests to be conducted for the system.','CP-04a.','N/A','Determine if: - the contingency plan for the system is tested [CP-04_ODP[01]; frequency of testing the contingency plan for the system is defined]. - [CP-04_ODP[02]; tests for determining the effectiveness of the contingency plan are defined] are used to determine the effectiveness of the plan. - [CP-04_ODP[03]; tests for determining readiness to execute the contingency plan are defined] are used to determine the readiness to execute the plan.'),\n('000494','draft','2009-09-21','DISA FSO','policy','Test the contingency plan for the system in accordance with organization-defined frequency using organization-defined tests to determine the effectiveness of the plan and the organizational readiness to execute the plan.','CP-04a.','N/A','Determine if: - the contingency plan for the system is tested [CP-04_ODP[01]; frequency of testing the contingency plan for the system is defined]. - [CP-04_ODP[02]; tests for determining the effectiveness of the contingency plan are defined] are used to determine the effectiveness of the plan. - [CP-04_ODP[03]; tests for determining readiness to execute the contingency plan are defined] are used to determine the readiness to execute the plan.'),\n('000496','draft','2009-09-21','DISA FSO','policy','Review the contingency plan test results.','CP-04b.','N/A','Determine if the contingency plan test results are reviewed.'),\n('000497','draft','2009-09-21','DISA FSO','policy','Initiate corrective actions, if needed, after reviewing the contingency plan test results.','CP-04c.','N/A','Determine if corrective actions are initiated, if needed.'),\n('000498','draft','2009-09-21','DISA FSO','policy','Coordinate contingency plan testing with organizational elements responsible for related plans.','CP-04(01)','N/A','Determine if contingency plan testing is coordinated with organizational elements responsible for related plans.'),\n('000500','draft','2009-09-21','DISA FSO','policy','Test the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and available resources.','CP-04(02)(a)','N/A','Determine if the contingency plan is tested at the alternate processing site to familiarize contingency personnel with the facility and available resources.'),\n('000502','draft','2009-09-21','DISA FSO','policy','Test the contingency plan using organization-defined automated mechanisms.','CP-04(03)','N/A','Determine if the contingency plan is tested using [CP-04(03)_ODP; automated mechanisms for contingency plan testing are defined].'),\n('000504','draft','2009-09-21','DISA FSO','policy','Include a full recovery and reconstitution of the system to a known state as part of contingency plan testing.','CP-04(04)','N/A','Determine if: - a full recovery of the system to a known state is included as part of contingency plan testing. - a full reconstitution of the system to a known state is included as part of contingency plan testing.'),\n('000505','draft','2009-09-21','DISA FSO','policy','Establish an alternate storage site, including necessary agreements to permit the storage of system backup information.','CP-06a.','N/A','Determine if: - an alternate storage site is established. - establishment of the alternate storage site includes necessary agreements to permit the storage and retrieval of system backup information.'),\n('000507','draft','2009-09-21','DISA FSO','policy','Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats.','CP-06(01)','N/A','Determine if an alternate storage site that is sufficiently separated from the primary storage site is identified to reduce susceptibility to the same threats.'),\n('000508','draft','2009-09-21','DISA FSO','policy','Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.','CP-06(02)','N/A','Determine if: - the alternate storage site is configured to facilitate recovery operations in accordance with recovery time objectives. - the alternate storage site is configured to facilitate recovery operations in accordance with recovery point objectives.'),\n('000509','draft','2009-09-21','DISA FSO','policy','Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster.','CP-06(03)','N/A','Determine if: - potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster are identified. - explicit mitigation actions to address identified accessibility problems are outlined.'),\n('000510','draft','2009-09-21','DISA FSO','policy','Defines the time-period consistent with recovery time and recovery point objectives for essential missions/business functions to permit the transfer and resumption of organization-defined system operations at an alternate processing site when the primary processing capabilities are unavailable.','CP-07a.','N/A','Determine if an alternate processing site, including necessary agreements to permit the transfer and resumption of [CP-07_ODP[01]; system operations for essential mission and business functions are defined] for essential mission and business functions, is established within [CP-07_ODP[02]; time period consistent with recovery time and recovery point objectives is defined] when the primary processing capabilities are unavailable.'),\n('000513','draft','2009-09-21','DISA FSO','policy','Establish an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined system operations for essential mission functions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.','CP-07a.','N/A','Determine if an alternate processing site, including necessary agreements to permit the transfer and resumption of [CP-07_ODP[01]; system operations for essential mission and business functions are defined] for essential mission and business functions, is established within [CP-07_ODP[02]; time period consistent with recovery time and recovery point objectives is defined] when the primary processing capabilities are unavailable.'),\n('000514','draft','2009-09-21','DISA FSO','policy','Establish an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined system operations for essential business functions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable.','CP-07a.','N/A','Determine if an alternate processing site, including necessary agreements to permit the transfer and resumption of [CP-07_ODP[01]; system operations for essential mission and business functions are defined] for essential mission and business functions, is established within [CP-07_ODP[02]; time period consistent with recovery time and recovery point objectives is defined] when the primary processing capabilities are unavailable.'),\n('000515','draft','2009-09-21','DISA FSO','policy','Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption.','CP-07b.','N/A','Determine if: - the equipment and supplies required to transfer operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within [CP-07_ODP[02]; time period consistent with recovery time and recovery point objectives is defined] for transfer. - the equipment and supplies required to resume operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within [CP-07_ODP[02]; time period consistent with recovery time and recovery point objectives is defined] for resumption.'),\n('000516','draft','2009-09-21','DISA FSO','policy','Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats.','CP-07(01)','N/A','Determine if an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats is identified.'),\n('000517','draft','2009-09-21','DISA FSO','policy','Identify potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster.','CP-07(02)','N/A','Determine if: - potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster are identified. - explicit mitigation actions to address identified accessibility problems are outlined.'),\n('000518','draft','2009-09-21','DISA FSO','policy','Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).','CP-07(03)','N/A','Determine if alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed.'),\n('000519','draft','2009-09-21','DISA FSO','policy','Prepare the alternate processing site so that the site can serve as the operational site supporting essential missions.','CP-07(04)','N/A','Determine if the alternate processing site is prepared so that the site can serve as the operational site supporting essential mission and business functions.'),\n('000520','draft','2009-09-21','DISA FSO','policy','Prepare the alternate processing site so that the site can serve as the operational site supporting essential business functions.','CP-07(04)','N/A','Determine if the alternate processing site is prepared so that the site can serve as the operational site supporting essential mission and business functions.'),\n('000521','draft','2009-09-21','DISA FSO','policy','Provide controls at the alternate processing site that are equivalent to those at the primary site.','CP-07c.','N/A','Determine if controls provided at the alternate processing site are equivalent to those at the primary site.'),\n('000522','draft','2009-09-21','DISA FSO','policy','Defines the time-period within which to permit the resumption of organization-defined system operations for essential mission functions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.','CP-08','N/A','Determine if alternate telecommunications services, including necessary agreements to permit the resumption of [CP-08_ODP[01]; system operations to be resumed for essential mission and business functions are defined], are established for essential mission and business functions within [CP-08_ODP[02]; time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable is defined] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.'),\n('000523','draft','2009-09-21','DISA FSO','policy','Defines the time-period within which to permit the resumption of organization-defined system operations for essential business functions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.','CP-08','N/A','Determine if alternate telecommunications services, including necessary agreements to permit the resumption of [CP-08_ODP[01]; system operations to be resumed for essential mission and business functions are defined], are established for essential mission and business functions within [CP-08_ODP[02]; time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable is defined] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.'),\n('000524','draft','2009-09-21','DISA FSO','policy','Establish alternate telecommunication services, including necessary agreements to permit the resumption of organization-defined system operations for essential mission functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.','CP-08','N/A','Determine if alternate telecommunications services, including necessary agreements to permit the resumption of [CP-08_ODP[01]; system operations to be resumed for essential mission and business functions are defined], are established for essential mission and business functions within [CP-08_ODP[02]; time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable is defined] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.'),\n('000525','draft','2009-09-21','DISA FSO','policy','Establish alternate telecommunication services, including necessary agreements to permit the resumption of organization-defined system operations for essential business functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.','CP-08','N/A','Determine if alternate telecommunications services, including necessary agreements to permit the resumption of [CP-08_ODP[01]; system operations to be resumed for essential mission and business functions are defined], are established for essential mission and business functions within [CP-08_ODP[02]; time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable is defined] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.'),\n('000526','draft','2009-09-21','DISA FSO','policy','Develop primary telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).','CP-08(01)(a)','N/A','Determine if: - primary telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed. - alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed.'),\n('000527','draft','2009-09-21','DISA FSO','policy','Develop alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).','CP-08(01)(a)','N/A','Determine if: - primary telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed. - alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed.'),\n('000530','draft','2009-09-21','DISA FSO','policy','Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.','CP-08(02)','N/A','Determine if alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services are obtained.'),\n('000531','draft','2009-09-21','DISA FSO','policy','Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.','CP-08(03)','N/A','Determine if alternate telecommunications services from providers that are separated from primary service providers are obtained to reduce susceptibility to the same threats.'),\n('000532','draft','2009-09-21','DISA FSO','policy','Require primary telecommunications service providers to have contingency plans.','CP-08(04)(a)','N/A','Determine if: - primary telecommunications service providers are required to have contingency plans. - alternate telecommunications service providers are required to have contingency plans.'),\n('000533','draft','2009-09-21','DISA FSO','policy','Require alternate telecommunications service providers to have contingency plans.','CP-08(04)(a)','N/A','Determine if: - primary telecommunications service providers are required to have contingency plans. - alternate telecommunications service providers are required to have contingency plans.'),\n('000534','draft','2009-09-21','DISA FSO','policy','Defines the frequency of conducting user-level information backups to support recovery time objectives and recovery point objectives.','CP-09a.','N/A','Determine if backups of user-level information contained in [CP-09_ODP[01]; system components for which to conduct backups of user-level information is defined] are conducted [CP-09_ODP[02]; frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives is defined].'),\n('000535','draft','2009-09-21','DISA FSO','policy','Conduct backups of user-level information contained in organization-defined system components per organization-defined frequency that is consistent with recovery time and recovery point objectives.','CP-09a.','N/A','Determine if backups of user-level information contained in [CP-09_ODP[01]; system components for which to conduct backups of user-level information is defined] are conducted [CP-09_ODP[02]; frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives is defined].'),\n('000536','draft','2009-09-21','DISA FSO','policy','Defines the frequency of conducting system-level information backups to support recovery time objectives and recovery point objectives.','CP-09b.','N/A','Determine if backups of system-level information contained in the system are conducted [CP-09_ODP[03]; frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives is defined].'),\n('000537','draft','2009-09-21','DISA FSO','policy','Conduct backups of system-level information contained in the system per organization-defined frequency that is consistent with recovery time and recovery point objectives.','CP-09b.','N/A','Determine if backups of system-level information contained in the system are conducted [CP-09_ODP[03]; frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives is defined].'),\n('000538','draft','2009-09-21','DISA FSO','policy','Defines the frequency of conducting system documentation backups, including security-related documentation, to support recovery time objectives and recovery point objectives.','CP-09c.','N/A','Determine if backups of system documentation, including security- and privacy-related documentation are conducted [CP-09_ODP[04]; frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives is defined].'),\n('000539','draft','2009-09-21','DISA FSO','policy','Conduct backups of system documentation, including security-related documentation, per an organization-defined frequency that is consistent with recovery time and recovery point objectives.','CP-09c.','N/A','Determine if backups of system documentation, including security- and privacy-related documentation are conducted [CP-09_ODP[04]; frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives is defined].'),\n('000541','draft','2009-09-21','DISA FSO','policy','Defines the frequency with which to test backup information to verify media reliability and information integrity.','CP-09(01)','N/A','Determine if: - backup information is tested [CP-09(01)_ODP[01]; frequency at which to test backup information for media reliability is defined] to verify media reliability. - backup information is tested [CP-09(01)_ODP[02]; frequency at which to test backup information for information integrity is defined] to verify information integrity.'),\n('000542','draft','2009-09-21','DISA FSO','policy','Test backup information per an organization-defined frequency to verify media reliability and information integrity.','CP-09(01)','N/A','Determine if: - backup information is tested [CP-09(01)_ODP[01]; frequency at which to test backup information for media reliability is defined] to verify media reliability. - backup information is tested [CP-09(01)_ODP[02]; frequency at which to test backup information for information integrity is defined] to verify information integrity.'),\n('000543','draft','2009-09-21','DISA FSO','policy','Use a sample of backup information in the restoration of selected system functions as part of contingency plan testing.','CP-09(02)','N/A','Determine if a sample of backup information in the restoration of selected system functions is used as part of contingency plan testing.'),\n('000547','draft','2009-09-21','DISA FSO','policy','Defines the time-period and transfer rate of the system backup information to the alternate storage site consistent with the recovery time and recovery point objectives.','CP-09(05)','N/A','Determine if: - system backup information is transferred to the alternate storage site for [CP-09(05)_ODP[01]; time period consistent with recovery time and recovery point objectives is defined]. - system backup information is transferred to the alternate storage site [CP-09(05)_ODP[02]; transfer rate consistent with recovery time and recovery point objectives is defined].'),\n('000548','draft','2009-09-21','DISA FSO','policy','Transfer system backup information to the alternate storage site in accordance with the organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives.','CP-09(05)','N/A','Determine if: - system backup information is transferred to the alternate storage site for [CP-09(05)_ODP[01]; time period consistent with recovery time and recovery point objectives is defined]. - system backup information is transferred to the alternate storage site [CP-09(05)_ODP[02]; transfer rate consistent with recovery time and recovery point objectives is defined].'),\n('000549','draft','2009-09-21','DISA FSO','policy','Maintain a redundant secondary system that is not collocated with the primary system.','CP-09(06)','N/A','Determine if: - system backup is conducted by maintaining a redundant secondary system that is not collocated with the primary system. - system backup is conducted by maintaining a redundant secondary system that can be activated without loss of information or disruption to operations.'),\n('000553','draft','2009-09-21','DISA FSO','policy','Implement transaction recovery for systems that are transaction-based.','CP-10(02)','N/A','Determine if transaction recovery is implemented for systems that are transaction-based.'),\n('000556','draft','2009-09-21','DISA FSO','policy','Defines restoration time periods within which to restore system components from configuration-controlled and integrity-protected information representing a known, operational state for the components.','CP-10(04)','N/A','Determine if the capability to restore system components within [CP-10(04)_ODP; restoration time period within which to restore system components to a known, operational state is defined] from configuration-controlled and integrity-protected information representing a known, operational state for the components is provided.'),\n('000557','draft','2009-09-21','DISA FSO','policy','Provide the capability to restore information system components within organization-defined restoration time periods from configuration-controlled and integrity-protected information representing a known, operational state for the components.','CP-10(04)','N/A','Determine if the capability to restore system components within [CP-10(04)_ODP; restoration time period within which to restore system components to a known, operational state is defined] from configuration-controlled and integrity-protected information representing a known, operational state for the components is provided.'),\n('000558','draft','2009-09-21','DISA FSO','policy','Defines the real-time or near-real-time failover capability to be provided for the system.','SI-13(05)','N/A','Determine if [SI-13(05)_ODP[01]; one of the following PARAMETER VALUES is selected: {real-time; near real-time}] [SI-13(05)_ODP[02]; a failover capability for the system has been defined] is provided for the system.'),\n('000559','draft','2009-09-21','DISA FSO','policy','Provide real-time or near-real-time organization-defined failover capability for the system.','SI-13(05)','N/A','Determine if [SI-13(05)_ODP[01]; one of the following PARAMETER VALUES is selected: {real-time; near real-time}] [SI-13(05)_ODP[02]; a failover capability for the system has been defined] is provided for the system.'),\n('000563','draft','2009-09-21','DISA FSO','policy','Develop and document an organization-level; mission/business process-level; and or system-level planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','PL-01a.01(a)','N/A','Determine if: - the [PL-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] planning policy addresses purpose. - the [PL-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] planning policy addresses scope. - the [PL-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] planning policy addresses roles. - the [PL-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] planning policy addresses responsibilities. - the [PL-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] planning policy addresses management commitment. - the [PL-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] planning policy addresses coordination among organizational entities. - the [PL-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] planning policy addresses compliance.'),\n('000564','draft','2009-09-21','DISA FSO','policy','Disseminate an organization-level; mission/business process-level; and or system-level planning policy to organization-defined personnel or roles.','PL-01a.','N/A','Determine if: - a planning policy is developed and documented. - the planning policy is disseminated to [PL-01_ODP[01]; personnel or roles to whom the planning policy is to be disseminated is/are defined].'),\n('000566','draft','2009-09-21','DISA FSO','policy','Develop and document procedures to facilitate the implementation of the planning policy and associated planning controls.','PL-01a.02','N/A','Determine if: - planning procedures to facilitate the implementation of the planning policy and associated planning controls are developed and documented. - the planning procedures are disseminated to [PL-01_ODP[02]; personnel or roles to whom the planning procedures are to be disseminated is/are defined].'),\n('000567','draft','2009-09-21','DISA FSO','policy','Disseminates planning procedures to organization-defined personnel or roles.','PL-01a.02','N/A','Determine if: - planning procedures to facilitate the implementation of the planning policy and associated planning controls are developed and documented. - the planning procedures are disseminated to [PL-01_ODP[02]; personnel or roles to whom the planning procedures are to be disseminated is/are defined].'),\n('000568','draft','2009-09-21','DISA FSO','policy','Review and update the current planning procedures in accordance with organization-defined frequency.','PL-01c.02','N/A','Determine if: - the current planning procedures are reviewed and updated [PL-01_ODP[07]; the frequency with which the current planning procedures are reviewed and updated is defined]. - the current planning procedures are reviewed and updated following [PL-01_ODP[08]; events that would require procedures to be reviewed and updated are defined].'),\n('000571','draft','2009-09-21','DISA FSO','policy','Develop security and privacy plans for the system that are reviewed and approved by the authorizing official or designated representative prior to plan implementation.','PL-02a.15','N/A','Determine if: - a security plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation. - a privacy plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation.'),\n('000572','draft','2009-09-21','DISA FSO','policy','Defines the frequency for reviewing the plans for the system.','PL-02c.','N/A','Determine if plans are reviewed [PL-02_ODP[03]; frequency to review system security and privacy plans is defined].'),\n('000573','draft','2009-09-21','DISA FSO','policy','Review the plans in accordance with organization-defined frequency.','PL-02c.','N/A','Determine if plans are reviewed [PL-02_ODP[03]; frequency to review system security and privacy plans is defined].'),\n('000574','draft','2009-09-21','DISA FSO','policy','Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments.','PL-02d.','N/A','Determine if: - plans are updated to address changes to the system and environment of operations. - plans are updated to address problems identified during the plan implementation. - plans are updated to address problems identified during control assessments.'),\n('000577','draft','2009-09-21','DISA FSO','policy','Defines the frequency with which to review and update the CONOPS.','PL-07b.','N/A','Determine if the CONOPS is reviewed and updated [PL-07_ODP; frequency for review and update of the Concept of Operations (CONOPS) is defined].'),\n('000578','draft','2009-09-21','DISA FSO','policy','Review and update the CONOPS in accordance with organization-defined frequency.','PL-07b.','N/A','Determine if the CONOPS is reviewed and updated [PL-07_ODP; frequency for review and update of the Concept of Operations (CONOPS) is defined].'),\n('000592','draft','2009-09-21','DISA FSO','policy','Establish the rules that describe their responsibilities and expected behavior, for information and system usage, for individuals requiring access to the system.','PL-04a.','N/A','Determine if: - rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are established for individuals requiring access to the system. - rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are provided to individuals requiring access to the system.'),\n('000593','draft','2009-09-21','DISA FSO','policy','Receive a documented acknowledgement from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system.','PL-04b.','N/A','Determine if before authorizing access to information and the system, a documented acknowledgement from such individuals indicating that they have read, understand, and agree to abide by the rules of behavior is received.'),\n('000594','draft','2009-09-21','DISA FSO','policy','Include in the rules of behavior, restrictions on the use of social media, social networking sites, and external sites/applications.','PL-04(01)(a)','N/A','Determine if the rules of behavior include restrictions on the use of social media, social networking sites, and external sites/applications.'),\n('000595','draft','2009-09-21','DISA FSO','policy','Include in the rules of behavior, restrictions on posting organizational information on public websites.','PL-04(01)(b)','N/A','Determine if the rules of behavior include restrictions on posting organizational information on public websites.'),\n('000601','draft','2009-09-21','DISA FSO','policy','Defines the frequency with which to review and update the current system and services acquisition policy.','SA-01c.01','N/A','Determine if: - the system and services acquisition policy is reviewed and updated [SA-01_ODP[05]; the frequency at which the current system and services acquisition policy is reviewed and updated is defined]. - the current system and services acquisition policy is reviewed and updated following [SA-01_ODP[06]; events that would require the current system and services acquisition policy to be reviewed and updated are defined].'),\n('000602','draft','2009-09-21','DISA FSO','policy','Develop and document an organization-level; mission/business process-level; and/or system-level system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','SA-01a.01(a)','N/A','Determine if: - the [SA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] system and services acquisition policy addresses purpose. - the [SA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] system and services acquisition policy addresses scope. - the [SA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] system and services acquisition policy addresses roles. - the [SA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] system and services acquisition policy addresses responsibilities. - the [SA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] system and services acquisition policy addresses management commitment. - the [SA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] system and services acquisition policy addresses coordination among organizational entities. - the [SA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] system and services acquisition policy addresses compliance.'),\n('000603','draft','2009-09-21','DISA FSO','policy','Disseminate to organization-defined personnel or roles an organization-level; mission/business process-level; and/or system-level system and services acquisition policy.','SA-01a.','N/A','Determine if: - a system and services acquisition policy is developed and documented. - the system and services acquisition policy is disseminated to [SA-01_ODP[01]; personnel or roles to whom the system and services acquisition policy is to be disseminated is/are defined].'),\n('000604','draft','2009-09-21','DISA FSO','policy','Review and update the current system and services acquisition policy in accordance with organization-defined frequency.','SA-01c.01','N/A','Determine if: - the system and services acquisition policy is reviewed and updated [SA-01_ODP[05]; the frequency at which the current system and services acquisition policy is reviewed and updated is defined]. - the current system and services acquisition policy is reviewed and updated following [SA-01_ODP[06]; events that would require the current system and services acquisition policy to be reviewed and updated are defined].'),\n('000605','draft','2009-09-21','DISA FSO','policy','Develop and document procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls.','SA-01a.02','N/A','Determine if: - system and services acquisition procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are developed and documented. - the system and services acquisition procedures are disseminated to [SA-01_ODP[02]; personnel or roles to whom the system and services acquisition procedures are to be disseminated is/are defined].'),\n('000606','draft','2009-09-21','DISA FSO','policy','Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls.','SA-01a.02','N/A','Determine if: - system and services acquisition procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are developed and documented. - the system and services acquisition procedures are disseminated to [SA-01_ODP[02]; personnel or roles to whom the system and services acquisition procedures are to be disseminated is/are defined].'),\n('000607','draft','2009-09-21','DISA FSO','policy','Review and update the current system and services acquisition procedures in accordance with organization-defined frequency.','SA-01c.02','N/A','Determine if: - the current system and services acquisition procedures are reviewed and updated [SA-01_ODP[07]; the frequency at which the current system and services acquisition procedures are reviewed and updated is defined]. - the current system and services acquisition procedures are reviewed and updated following [SA-01_ODP[08]; events that would require the system and services acquisition procedures to be reviewed and updated are defined].'),\n('000610','draft','2009-09-21','DISA FSO','policy','Determine the resources required to protect the system or system service as part of the organizational capital planning and investment control process.','SA-02b.','N/A','Determine if: - the resources required to protect the system or system service are determined and documented as part of the organizational capital planning and investment control process. - the resources required to protect the system or system service are allocated as part of the organizational capital planning and investment control process.'),\n('000611','draft','2009-09-21','DISA FSO','policy','Document the resources required to protect the system or system service as part of the organizational capital planning and investment control process.','SA-02b.','N/A','Determine if: - the resources required to protect the system or system service are determined and documented as part of the organizational capital planning and investment control process. - the resources required to protect the system or system service are allocated as part of the organizational capital planning and investment control process.'),\n('000612','draft','2009-09-21','DISA FSO','policy','Allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process.','SA-02b.','N/A','Determine if: - the resources required to protect the system or system service are determined and documented as part of the organizational capital planning and investment control process. - the resources required to protect the system or system service are allocated as part of the organizational capital planning and investment control process.'),\n('000613','draft','2009-09-21','DISA FSO','policy','Establish a discrete line item for information security in organizational programming documentation.','SA-02c.','N/A','Determine if: - a discrete line item for information security is established in organizational programming and budgeting documentation. - a discrete line item for privacy is established in organizational programming and budgeting documentation.'),\n('000614','draft','2009-09-21','DISA FSO','policy','Establish a discrete line item for information security in organizational budgeting documentation.','SA-02c.','N/A','Determine if: - a discrete line item for information security is established in organizational programming and budgeting documentation. - a discrete line item for privacy is established in organizational programming and budgeting documentation.'),\n('000615','draft','2009-09-21','DISA FSO','policy','Manage the system using an organization-defined system development life cycle that incorporates information security considerations.','SA-03a.','N/A','Determine if: - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates information security considerations. - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates privacy considerations.'),\n('000616','draft','2009-09-21','DISA FSO','policy','Define and document information system security roles and responsibilities throughout the system development life cycle.','SA-03b.','N/A','Determine if: - information security roles and responsibilities are defined and documented throughout the system development life cycle. - privacy roles and responsibilities are defined and documented throughout the system development life cycle.'),\n('000618','draft','2009-09-21','DISA FSO','policy','Identify individuals having information system security roles and responsibilities.','SA-03c.','N/A','Determine if: - individuals with information security roles and responsibilities are identified. - individuals with privacy roles and responsibilities are identified.'),\n('000623','draft','2009-09-21','DISA FSO','policy','Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be implemented.','SA-04(01)','N/A','Determine if the developer of the system, system component, or system service is required to provide a description of the functional properties of the controls to be implemented.'),\n('000631','draft','2009-09-21','DISA FSO','policy','Employ only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted.','SA-04(06)(a)','N/A','Determine if only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted are employed.'),\n('000633','draft','2009-09-21','DISA FSO','policy','Ensure that government off-the-shelf or commercial-off-the-shelf information assurance and information assurance-enabled information technology products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.','SA-04(06)(b)','N/A','Determine if these products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.'),\n('000634','draft','2009-09-21','DISA FSO','policy','Limit the use of commercially provided information assurance and information assurance-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists.','SA-04(07)(a)','N/A','Determine if the use of commercially provided information assurance and information assurance-enabled information technology products is limited to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists.'),\n('000635','draft','2009-09-21','DISA FSO','policy','Require, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated or NSA-approved.','SA-04(07)(b)','N/A','Determine if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that cryptographic module is required to be FIPS-validated or NSA-approved.'),\n('000642','draft','2009-09-21','DISA FSO','policy','Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent.','SA-05c.','N/A','Determine if: - attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent is documented. - after attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent, [SA-05_ODP[01]; actions to take when system, system component, or system service documentation is either unavailable or nonexistent are defined] are taken in response.'),\n('000664','draft','2009-09-21','DISA FSO','policy','Apply organization-defined systems security and privacy engineering principles in the specification of the system and system components.','SA-08','N/A','Determine if: - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the development of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the modification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the development of the system and system components.  - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the modification of the system and system components.'),\n('000665','draft','2009-09-21','DISA FSO','policy','Apply organization-defined systems security and privacy engineering principles in the design of the system and system components.','SA-08','N/A','Determine if: - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the development of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the modification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the development of the system and system components.  - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the modification of the system and system components.'),\n('000666','draft','2009-09-21','DISA FSO','policy','Apply organization-defined systems security and privacy engineering principles in the development of the system and system components.','SA-08','N/A','Determine if: - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the development of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the modification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the development of the system and system components.  - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the modification of the system and system components.'),\n('000667','draft','2009-09-21','DISA FSO','policy','Apply organization-defined systems security and privacy engineering principles in the implementation of the system and system components.','SA-08','N/A','Determine if: - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the development of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the modification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the development of the system and system components.  - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the modification of the system and system components.'),\n('000668','draft','2009-09-21','DISA FSO','policy','Apply organization-defined systems security and privacy engineering principles in the modification of the system and system components.','SA-08','N/A','Determine if: - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the development of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the modification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the development of the system and system components.  - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the modification of the system and system components.'),\n('000669','draft','2009-09-21','DISA FSO','policy','Require that providers of external system services comply with organizational security requirements.',NULL,'N/A',NULL),\n('000692','draft','2009-09-22','DISA FSO','policy','Require the developer of the system, system component, or system service to implement only organization-approved changes to the system, component, or service.','SA-10c.','N/A','Determine if the developer of the system, system component, or system service is required to implement only organization-approved changes to the system, component, or service.'),\n('000694','draft','2009-09-22','DISA FSO','policy','Require the developer of the system, system component, or system service to document approved changes to the system, component, or service.','SA-10d.','N/A','Determine if: - the developer of the system, system component, or system service is required to document approved changes to the system, component, or service. - the developer of the system, system component, or system service is required to document the potential security impacts of approved changes. - the developer of the system, system component, or system service is required to document the potential privacy impacts of approved changes.'),\n('000698','draft','2009-09-22','DISA FSO','policy','Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.','SA-10(01)','N/A','Determine if the developer of the system, system component, or system service is required to enable integrity verification of software and firmware components.'),\n('000700','draft','2009-09-22','DISA FSO','policy','Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.','SA-10(02)','N/A','Determine if an alternate configuration management process has been provided using organizational personnel in the absence of a dedicated developer configuration management team.'),\n('000757','draft','2009-09-17','DISA FSO','policy','Disseminate an organization-level; mission/business process-level; and/or system-level identification and authentication policy to organization-defined personnel.','IA-01a.','N/A','Determine if: - an identification and authentication policy is developed and documented. - the identification and authentication policy is disseminated to [IA-01_ODP[01]; personnel or roles to whom the identification and authentication policy is to be disseminated are defined].'),\n('000758','draft','2009-09-17','DISA FSO','policy','Review and update the current identification and authentication policy in accordance with the organization-defined frequency.','IA-01c.01','N/A','Determine if: - the current identification and authentication policy is reviewed and updated [IA-01_ODP[05]; the frequency at which the current identification and authentication policy is reviewed and updated is defined]. - the current identification and authentication policy is reviewed and updated following [IA-01_ODP[06]; events that would require the current identification and authentication policy to be reviewed and updated are defined].'),\n('000759','draft','2009-09-17','DISA FSO','policy','Defines a frequency for reviewing and updating the identification and authentication policy.','IA-01c.01','N/A','Determine if: - the current identification and authentication policy is reviewed and updated [IA-01_ODP[05]; the frequency at which the current identification and authentication policy is reviewed and updated is defined]. - the current identification and authentication policy is reviewed and updated following [IA-01_ODP[06]; events that would require the current identification and authentication policy to be reviewed and updated are defined].'),\n('000762','draft','2009-09-17','DISA FSO','policy','Review and update the current identification and authentication procedures in accordance with the organization-defined frequency.','IA-01c.02','N/A','Determine if: - the current identification and authentication procedures are reviewed and updated [IA-01_ODP[07]; the frequency at which the current identification and authentication procedures are reviewed and updated is defined]. - the current identification and authentication procedures are reviewed and updated following [IA-01_ODP[08]; events that would require identification and authentication procedures to be reviewed and updated are defined].'),\n('000763','draft','2009-09-17','DISA FSO','policy','Defines a frequency for reviewing and updating the identification and authentication procedures.','IA-01c.02','N/A','Determine if: - the current identification and authentication procedures are reviewed and updated [IA-01_ODP[07]; the frequency at which the current identification and authentication procedures are reviewed and updated is defined]. - the current identification and authentication procedures are reviewed and updated following [IA-01_ODP[08]; events that would require identification and authentication procedures to be reviewed and updated are defined].'),\n('000764','draft','2009-09-17','DISA FSO','technical','Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.','IA-02','N/A','Determine if: - organizational users are uniquely identified and authenticated. - the unique identification of authenticated organizational users is associated with processes acting on behalf of those users.'),\n('000765','draft','2009-09-17','DISA FSO','technical','Implement multifactor authentication for access to privileged accounts.','IA-02(01)','N/A','Determine if multi-factor authentication is implemented for access to privileged accounts.'),\n('000766','draft','2009-09-17','DISA FSO','technical','Implement multifactor authentication for access to non-privileged accounts.','IA-02(02)','N/A','Determine if multi-factor authentication for access to non-privileged accounts is implemented.'),\n('000777','draft','2009-09-17','DISA FSO','policy','Defines devices and/or types of devices for which identification and authentication is required before establishing a connection.','IA-03','N/A','Determine if [IA-03_ODP[01]; devices and/or types of devices to be uniquely identified and authenticated before establishing a connection are defined] are uniquely identified and authenticated before establishing a [IA-03_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {local; remote; network}] connection.'),\n('000778','draft','2009-09-17','DISA FSO','technical','Uniquely identify organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.','IA-03','N/A','Determine if [IA-03_ODP[01]; devices and/or types of devices to be uniquely identified and authenticated before establishing a connection are defined] are uniquely identified and authenticated before establishing a [IA-03_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {local; remote; network}] connection.'),\n('000783','draft','2009-09-17','DISA FSO','technical','Audit lease information when assigned to a device.','IA-03(03)(b)','N/A','Determine if lease information is audited when assigned to a device.'),\n('000796','draft','2009-09-17','DISA FSO','policy','Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.','IA-04(01)','N/A','Determine if the use of system account identifiers that are the same as public identifiers is prohibited for individual accounts.'),\n('000800','draft','2009-09-17','DISA FSO','policy','Defines characteristics for identifying individual status.','IA-04(04)','N/A','Determine if individual identifiers are managed by uniquely identifying each individual as [IA-04(04)_ODP; characteristics used to identify individual status is defined].'),\n('000801','draft','2009-09-17','DISA FSO','policy','Manage individual identifiers by uniquely identifying each individual as organization-defined characteristics identifying individual status.','IA-04(04)','N/A','Determine if individual identifiers are managed by uniquely identifying each individual as [IA-04(04)_ODP; characteristics used to identify individual status is defined].'),\n('000803','draft','2009-09-17','DISA FSO','technical','Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.','IA-07','N/A','Determine if mechanisms for authentication to a cryptographic module are implemented that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.'),\n('000804','draft','2009-09-17','DISA FSO','technical','Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.','IA-08','N/A','Determine if non-organizational users or processes acting on behalf of non-organizational users are uniquely identified and authenticated.'),\n('000805','draft','2009-09-17','DISA FSO','policy','Develop and document an organization-level; mission/business process-level; and/or system-level incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','IR-01a.01(a)','N/A','Determine if: - the [IR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] incident response policy addresses purpose. - the [IR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] incident response policy addresses scope. - the [IR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] incident response policy addresses roles. - the [IR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] incident response policy addresses responsibilities. - the [IR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] incident response policy addresses management commitment. - the [IR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] incident response policy addresses coordination among organizational entities. - the [IR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] incident response policy addresses compliance.'),\n('000806','draft','2009-09-17','DISA FSO','policy','Disseminate an organization-level; mission/business process-level; and/or system-level incident response policy to organization-defined personnel or roles.','IR-01a.','N/A','Determine if: - an incident response policy is developed and documented. - the incident response policy is disseminated to [IR-01_ODP[01]; personnel or roles to whom the incident response policy is to be disseminated is/are defined].'),\n('000807','draft','2009-09-17','DISA FSO','policy','Review and update the current incident response policy in accordance with organization-defined frequency.','IR-01c.01','N/A','Determine if:  - the current incident response policy is reviewed and updated [IR-01_ODP[05]; the frequency at which the current incident response policy is reviewed and updated is defined]. - the current incident response policy is reviewed and updated following [IR-01_ODP[06]; events that would require the current incident response policy to be reviewed and updated are defined].'),\n('000808','draft','2009-09-17','DISA FSO','policy','Defines the frequency with which to review and update the current incident response policy.','IR-01c.01','N/A','Determine if:  - the current incident response policy is reviewed and updated [IR-01_ODP[05]; the frequency at which the current incident response policy is reviewed and updated is defined]. - the current incident response policy is reviewed and updated following [IR-01_ODP[06]; events that would require the current incident response policy to be reviewed and updated are defined].'),\n('000809','draft','2009-09-17','DISA FSO','policy','Develop and document procedures to facilitate the implementation of incident response policy and associated incident response controls.','IR-01a.02','N/A','Determine if: - incident response procedures to facilitate the implementation of the incident response policy and associated incident response controls are developed and documented. - the incident response procedures are disseminated to [IR-01_ODP[02]; personnel or roles to whom the incident response procedures are to be disseminated is/are defined].'),\n('000810','draft','2009-09-17','DISA FSO','policy','Disseminate the incident response procedures to organization-defined personnel or roles.','IR-01a.02','N/A','Determine if: - incident response procedures to facilitate the implementation of the incident response policy and associated incident response controls are developed and documented. - the incident response procedures are disseminated to [IR-01_ODP[02]; personnel or roles to whom the incident response procedures are to be disseminated is/are defined].'),\n('000811','draft','2009-09-17','DISA FSO','policy','Review and update the current incident response procedures in accordance with organization-defined frequency.','IR-01c.02','N/A','Determine if: - the current incident response procedures are reviewed and updated [IR-01_ODP[07]; the frequency at which the current incident response procedures are reviewed and updated is defined]. - the current incident response procedures are reviewed and updated following [IR-01_ODP[08]; events that would require the incident response procedures to be reviewed and updated are defined].'),\n('000812','draft','2009-09-17','DISA FSO','policy','Defines the frequency with which to review and update the current incident response procedures.','IR-01c.02','N/A','Determine if: - the current incident response procedures are reviewed and updated [IR-01_ODP[07]; the frequency at which the current incident response procedures are reviewed and updated is defined]. - the current incident response procedures are reviewed and updated following [IR-01_ODP[08]; events that would require the incident response procedures to be reviewed and updated are defined].'),\n('000813','draft','2009-09-17','DISA FSO','policy','Provide incident response training to system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming an incident response role or responsibility.','IR-02a.01','N/A','Determine if incident response training is provided to system users consistent with assigned roles and responsibilities within [IR-02_ODP[01]; a time period within which incident response training is to be provided to system users assuming an incident response role or responsibility is defined] of assuming an incident response role or responsibility or acquiring system access.'),\n('000814','draft','2009-09-17','DISA FSO','policy','Provide incident response training in accordance with organization-defined frequency.','IR-02a.03','N/A','Determine if incident response training is provided to system users consistent with assigned roles and responsibilities [IR-02_ODP[02]; frequency at which to provide incident response training to users is defined] thereafter.'),\n('000815','draft','2009-09-17','DISA FSO','policy','Defines a frequency for incident response training.',NULL,'N/A',NULL),\n('000816','draft','2009-09-17','DISA FSO','policy','Incorporate simulated events into incident response training to facilitate effective response by personnel in crisis situations.','IR-02(01)','N/A','Determine if simulated events are incorporated into incident response training to facilitate the required response by personnel in crisis situations.'),\n('000817','draft','2009-09-17','DISA FSO','policy','Provide an incident response training environment using organization-defined automated mechanisms.','IR-02(02)','N/A','Determine if an incident response training environment is provided using [IR-02(02)_ODP; automated mechanisms used in an incident response training environment are defined].'),\n('000818','draft','2009-09-17','DISA FSO','policy','Test the effectiveness of the incident response capability for the system on an organization-defined frequency using organization-defined tests.','IR-03','N/A','Determine if the effectiveness of the incident response capability for the system is tested [IR-03_ODP[01]; frequency at which to test the effectiveness of the incident response capability for the system is defined] using [IR-03_ODP[02]; tests used to test the effectiveness of the incident response capability for the system are defined].'),\n('000819','draft','2009-09-17','DISA FSO','policy','Defines a frequency for incident response tests.','IR-03','N/A','Determine if the effectiveness of the incident response capability for the system is tested [IR-03_ODP[01]; frequency at which to test the effectiveness of the incident response capability for the system is defined] using [IR-03_ODP[02]; tests used to test the effectiveness of the incident response capability for the system are defined].'),\n('000820','draft','2009-09-17','DISA FSO','policy','Defines tests for incident response.','IR-03','N/A','Determine if the effectiveness of the incident response capability for the system is tested [IR-03_ODP[01]; frequency at which to test the effectiveness of the incident response capability for the system is defined] using [IR-03_ODP[02]; tests used to test the effectiveness of the incident response capability for the system are defined].'),\n('000821','draft','2009-09-17','DISA FSO','policy','Test the incident response capability using organization-defined automated mechanisms.','IR-03(01)','N/A','Determine if the incident response capability is tested using [IR-03(01)_ODP; automated mechanisms used to test the incident response capability are defined].'),\n('000822','draft','2009-09-18','DISA FSO','policy','Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.','IR-04a.','N/A','Determine if: - an incident handling capability for incidents is implemented that is consistent with the incident response plan. - the incident handling capability for incidents includes preparation. - the incident handling capability for incidents includes detection and analysis. - the incident handling capability for incidents includes containment. - the incident handling capability for incidents includes eradication. - the incident handling capability for incidents includes recovery.'),\n('000823','draft','2009-09-18','DISA FSO','policy','Coordinate incident handling activities with contingency planning activities.','IR-04b.','N/A','Determine if incident handling activities are coordinated with contingency planning activities.'),\n('000825','draft','2009-09-18','DISA FSO','policy','Support the incident handling process using organization-defined automated mechanisms.','IR-04(01)','N/A','Determine if the incident handling process is supported using [IR-04(01)_ODP; automated mechanisms used to support the incident handling process are defined].'),\n('000826','draft','2009-09-18','DISA FSO','policy','Include organization-defined types of dynamic reconfiguration for organization-defined system components as part of the incident response capability.','IR-04(02)','N/A','Determine if [IR-04(02)_ODP[01]; types of dynamic reconfiguration for system components are defined] for [IR-04(02)_ODP[02]; system components that require dynamic reconfiguration are defined] are included as part of the incident response capability.'),\n('000827','draft','2009-09-18','DISA FSO','policy','Identify organization-defined classes of incidents for which organization-defined actions are to be taken to ensure continuation of organizational mission and business functions.','IR-04(03)','N/A','Determine if: - [IR-04(03)_ODP[01]; classes of incidents requiring an organization-defined action (defined in IR-04(03)_ODP[02]) to be taken are defined] are identified. - [IR-04(03)_ODP[02]; actions to be taken in response to organization-defined classes of incidents are defined] are taken in response to those incidents (defined in IR-04(03)_ODP[01]) to ensure the continuation of organizational mission and business functions.'),\n('000828','draft','2009-09-18','DISA FSO','policy','Identify actions to take in response to organization-defined classes of incidents to ensure continuation of organizational missions and business functions.','IR-04(03)','N/A','Determine if: - [IR-04(03)_ODP[01]; classes of incidents requiring an organization-defined action (defined in IR-04(03)_ODP[02]) to be taken are defined] are identified. - [IR-04(03)_ODP[02]; actions to be taken in response to organization-defined classes of incidents are defined] are taken in response to those incidents (defined in IR-04(03)_ODP[01]) to ensure the continuation of organizational mission and business functions.'),\n('000829','draft','2009-09-18','DISA FSO','policy','Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.','IR-04(04)','N/A','Determine if incident information and individual incident responses are correlated to achieve an organization-wide perspective on incident awareness and response.'),\n('000830','draft','2009-09-18','DISA FSO','policy','Defines security violations that, if detected, initiate a configurable capability to automatically disable the system.','IR-04(05)','N/A','Determine if a configurable capability is implemented to automatically disable the system if [IR-04(05)_ODP; security violations that automatically disable a system are defined] are detected.'),\n('000831','draft','2009-09-18','DISA FSO','technical','Implement a configurable capability to automatically disable the system if organization-defined security violations are detected.','IR-04(05)','N/A','Determine if a configurable capability is implemented to automatically disable the system if [IR-04(05)_ODP; security violations that automatically disable a system are defined] are detected.'),\n('000832','draft','2009-09-18','DISA FSO','policy','Track and document incidents.','IR-05','N/A','Determine if: - incidents are tracked. - incidents are documented.'),\n('000834','draft','2009-09-18','DISA FSO','policy','Defines a time period for personnel to report suspected incidents to the organizational incident response capability.','IR-06a.','N/A','Determine if personnel is/are required to report suspected incidents to the organizational incident response capability within [IR-06_ODP[01]; time period for personnel to report suspected incidents to the organizational incident response capability is defined].'),\n('000835','draft','2009-09-18','DISA FSO','policy','Require personnel to report suspected incidents to the organizational incident response capability within the organization-defined time period.','IR-06a.','N/A','Determine if personnel is/are required to report suspected incidents to the organizational incident response capability within [IR-06_ODP[01]; time period for personnel to report suspected incidents to the organizational incident response capability is defined].'),\n('000836','draft','2009-09-18','DISA FSO','policy','Report incident information to organization-defined authorities.','IR-06b.','N/A','Determine if incident information is reported to [IR-06_ODP[02]; authorities to whom incident information is to be reported are defined].'),\n('000837','draft','2009-09-18','DISA FSO','policy','Report incidents using organization-defined automated mechanisms.','IR-06(01)','N/A','Determine if incidents are reported using [IR-06(01)_ODP; automated mechanisms used for reporting incidents are defined].'),\n('000838','draft','2009-09-18','DISA FSO','policy','Report system vulnerabilities associated with reported incidents to organization-defined personnel or roles.','IR-06(02)','N/A','Determine if system vulnerabilities associated with reported incidents are reported to [IR-06(02)_ODP; personnel or roles to whom system vulnerabilities associated with reported incidents are reported to is/are defined].'),\n('000839','draft','2009-09-18','DISA FSO','policy','Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.','IR-07','N/A','Determine if: - an incident response support resource, integral to the organizational incident response capability, is provided. - the incident response support resource offers advice and assistance to users of the system for the response and reporting of incidents.'),\n('000841','draft','2009-09-18','DISA FSO','policy','Establish a direct, cooperative relationship between its incident response capability and external providers of system protection capability.','IR-07(02)(a)','N/A','Determine if a direct, cooperative relationship is established between its incident response capability and external providers of the system protection capability.'),\n('000842','draft','2009-09-18','DISA FSO','policy','Identify organizational incident response team members to the external providers.','IR-07(02)(b)','N/A','Determine if organizational incident response team members are identified to the external providers.'),\n('000844','draft','2009-09-18','DISA FSO','policy','Develop an incident response plan that is reviewed and approved by organization-defined personnel or roles on an organization-defined frequency.','IR-08a.09','N/A','Determine if an incident response plan is developed that is reviewed and approved by [IR-08_ODP[01]; personnel or roles that review and approve the incident response plan is/are identified] [IR-08_ODP[02]; the frequency at which to review and approve the incident response plan is defined].'),\n('000845','draft','2009-09-18','DISA FSO','policy','Defines incident response personnel (identified by name and/or by role) and organizational elements to whom copies of the incident response plan are distributed.','IR-08b.','N/A','Determine if: - copies of the incident response plan are distributed to [IR-08_ODP[04]; incident response personnel (identified by name and/or by role) to whom copies of the incident response plan are to be distributed is/are defined]. - copies of the incident response plan are distributed to [IR-08_ODP[05]; organizational elements to which copies of the incident response plan are to be distributed are defined].'),\n('000846','draft','2009-09-18','DISA FSO','policy','Distributes copies of the incident response plan to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.','IR-08b.','N/A','Determine if: - copies of the incident response plan are distributed to [IR-08_ODP[04]; incident response personnel (identified by name and/or by role) to whom copies of the incident response plan are to be distributed is/are defined]. - copies of the incident response plan are distributed to [IR-08_ODP[05]; organizational elements to which copies of the incident response plan are to be distributed are defined].'),\n('000849','draft','2009-09-18','DISA FSO','policy','Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing.','IR-08c.','N/A','Determine if the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing.'),\n('000850','draft','2009-09-18','DISA FSO','policy','Communicate incident response plan changes to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.','IR-08d.','N/A','Determine if: - incident response plan changes are communicated to [IR-08_ODP[06]; incident response personnel (identified by name and/or by role) to whom changes to the incident response plan is/are communicated are defined]. - incident response plan changes are communicated to [IR-08_ODP[07]; organizational elements to which changes to the incident response plan are communicated are defined].'),\n('000851','draft','2009-09-18','DISA FSO','policy','Defines the frequency with which to review and update the current system maintenance policy.','MA-01c.01','N/A','Determine if: - the current maintenance policy is reviewed and updated [MA-01_ODP[05]; the frequency with which the current maintenance policy is reviewed and updated is defined]. - the current maintenance policy is reviewed and updated following [MA-01_ODP[06]; events that would require the current maintenance policy to be reviewed and updated are defined].'),\n('000852','draft','2009-09-18','DISA FSO','policy','Develop and document an organization-level; mission/business process-level; and/or system-level maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','MA-01a.01(a)','N/A','Determine if: - the [MA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] maintenance policy addresses purpose. - the [MA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] maintenance policy addresses scope. - the [MA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] maintenance policy addresses roles. - the [MA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] maintenance policy addresses responsibilities. - the [MA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] maintenance policy addresses management commitment. - the [MA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] maintenance policy addresses coordination among organizational entities. - the [MA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] maintenance policy addresses compliance.'),\n('000853','draft','2009-09-18','DISA FSO','policy','Disseminate an organization-level; mission/business process-level; and/or system-level maintenance policy to organization-defined personnel or roles.','MA-01a.','N/A','Determine if: - a maintenance policy is developed and documented. - the maintenance policy is disseminated to [MA-01_ODP[01]; personnel or roles to whom the maintenance policy is to be disseminated is/are defined].'),\n('000854','draft','2009-09-18','DISA FSO','policy','Review and update the current maintenance policy in accordance with organization-defined frequency.','MA-01c.01','N/A','Determine if: - the current maintenance policy is reviewed and updated [MA-01_ODP[05]; the frequency with which the current maintenance policy is reviewed and updated is defined]. - the current maintenance policy is reviewed and updated following [MA-01_ODP[06]; events that would require the current maintenance policy to be reviewed and updated are defined].'),\n('000855','draft','2009-09-18','DISA FSO','policy','Develop and document procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls.','MA-01a.02','N/A','Determine if: - maintenance procedures to facilitate the implementation of the maintenance policy and associated maintenance controls are developed and documented. - Determine if the maintenance procedures are disseminated to [MA-01_ODP[02]; personnel or roles to whom the maintenance procedures are to be disseminated is/are defined].'),\n('000856','draft','2009-09-18','DISA FSO','policy','Disseminate procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls to organization-defined personnel or roles.','MA-01a.02','N/A','Determine if: - maintenance procedures to facilitate the implementation of the maintenance policy and associated maintenance controls are developed and documented. - Determine if the maintenance procedures are disseminated to [MA-01_ODP[02]; personnel or roles to whom the maintenance procedures are to be disseminated is/are defined].'),\n('000857','draft','2009-09-18','DISA FSO','policy','Review and update the current maintenance procedures in accordance with organization-defined frequency.','MA-01c.02','N/A','Determine if: - the current maintenance procedures are reviewed and updated [MA-01_ODP[07]; the frequency with which the current maintenance procedures are reviewed and updated is defined]. - the current maintenance procedures are reviewed and updated following [MA-01_ODP[08]; events that would require the maintenance procedures to be reviewed and updated are defined].'),\n('000860','draft','2009-09-18','DISA FSO','policy','Require that organization-defines personnel or roles explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement.','MA-02c.','N/A','Determine if [MA-02_ODP[01]; personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs is/are defined] is/are required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement.'),\n('000861','draft','2009-09-18','DISA FSO','policy','Sanitize equipment to remove organization-defined information from associated media prior to removal from organizational facilities for off-site maintenance, repairs or replacement.','MA-02d.','N/A','Determine if equipment is sanitized to remove [MA-02_ODP[02]; information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement is defined] from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement.'),\n('000862','draft','2009-09-18','DISA FSO','policy','Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair or replacement actions.','MA-02e.','N/A','Determine if all potentially impacted controls are checked to verify that the controls are still functioning properly following maintenance, repair, or replacement actions.'),\n('000865','draft','2009-09-18','DISA FSO','policy','Approve the use of system maintenance tools.',NULL,'N/A',NULL),\n('000866','draft','2009-09-18','DISA FSO','policy','Control the use of system maintenance tools.',NULL,'N/A',NULL),\n('000867','draft','2009-09-18','DISA FSO','policy','Monitor the use of system maintenance tools.','MA-03a.','N/A','Determine if: - the use of system maintenance tools is approved. - the use of system maintenance tools is controlled. - the use of system maintenance tools is monitored.'),\n('000869','draft','2009-09-18','DISA FSO','policy','Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.','MA-03(01)','N/A','Determine if maintenance tools used by maintenance personnel are inspected for improper or unauthorized modifications.'),\n('000870','draft','2009-09-18','DISA FSO','policy','Check media containing diagnostic and test programs for malicious code before the media are used in the system.','MA-03(02)','N/A','Determine if media containing diagnostic and test programs are checked for malicious code before the media are used in the system.'),\n('000871','draft','2009-09-18','DISA FSO','policy','Prevent the unauthorized removal of maintenance equipment containing organizational information by: (a) verifying that there is no organizational information contained on the equipment; (b) sanitizing or destroying the equipment; (c) retaining the equipment within the facility; or (d) obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility.','MA-03(03)(a)','N/A','Determine if the removal of maintenance equipment containing organizational information is prevented by verifying that there is no organizational information contained on the equipment.'),\n('000873','draft','2009-09-18','DISA FSO','policy','Approve nonlocal maintenance and diagnostic activities.','MA-04a.','N/A','Determine if: - nonlocal maintenance and diagnostic activities are approved. - nonlocal maintenance and diagnostic activities are monitored.'),\n('000874','draft','2009-09-18','DISA FSO','policy','Monitor nonlocal maintenance and diagnostic activities.','MA-04a.','N/A','Determine if: - nonlocal maintenance and diagnostic activities are approved. - nonlocal maintenance and diagnostic activities are monitored.'),\n('000876','draft','2009-09-18','DISA FSO','policy','Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system.','MA-04b.','N/A','Determine if: - the use of nonlocal maintenance and diagnostic tools are allowed only as consistent with organizational policy. - the use of nonlocal maintenance and diagnostic tools are documented in the security plan for the system.'),\n('000877','draft','2009-09-18','DISA FSO','technical','Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.','MA-04c.','N/A','Determine if strong authentication is employed in the establishment of nonlocal maintenance and diagnostic sessions.'),\n('000878','draft','2009-09-18','DISA FSO','policy','Maintain records for nonlocal maintenance and diagnostic activities.','MA-04d.','N/A','Determine if records for nonlocal maintenance and diagnostic activities are maintained.'),\n('000882','draft','2009-09-18','DISA FSO','policy','Require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced.','MA-04(03)(a)','N/A','Determine if: - nonlocal maintenance services are required to be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced. - nonlocal diagnostic services are required to be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced.'),\n('000883','draft','2009-09-18','DISA FSO','policy','Remove the component to be serviced from the system prior to nonlocal maintenance or diagnostic services; sanitize the component (for organizational information).','MA-04(03)(b)','N/A','Determine if: - the component to be serviced is removed from the system prior to nonlocal maintenance or diagnostic services. - the component to be serviced is sanitized (for organizational information). - the component is inspected and sanitized (for potentially malicious software) after the service is performed and before reconnecting the component to the system.'),\n('000884','draft','2009-09-18','DISA FSO','technical','Protect nonlocal maintenance sessions by employing organization-defined authenticators that are replay resistant.','MA-04(04)(a)','N/A','Determine if nonlocal maintenance sessions are protected by employing [MA-04(04)_ODP; authenticators that are replay resistant are defined].'),\n('000886','draft','2009-09-18','DISA FSO','policy','Defines the personnel or roles to be notified of the date and time of planned nonlocal maintenance.','MA-04(05)(b)','N/A','Determine if [MA-04(05)_ODP[02]; personnel and roles to be notified of the date and time of planned nonlocal maintenance is/are defined] is/are notified of the date and time of planned nonlocal maintenance.'),\n('000887','draft','2009-09-18','DISA FSO','policy','Require the approval of each nonlocal maintenance session by organization-defined personnel or roles.','MA-04(05)(a)','N/A','Determine if the approval of each nonlocal maintenance session is required by [MA-04(05)_ODP[01]; personnel or roles required to approve each nonlocal maintenance session is/are defined].'),\n('000890','draft','2009-09-18','DISA FSO','policy','Establish a process for maintenance personnel authorization.','MA-05a.','N/A','Determine if: - a process for maintenance personnel authorization is established. - a list of authorized maintenance organizations or personnel is maintained.'),\n('000891','draft','2009-09-18','DISA FSO','policy','Maintain a list of authorized maintenance organizations or personnel.','MA-05a.','N/A','Determine if: - a process for maintenance personnel authorization is established. - a list of authorized maintenance organizations or personnel is maintained.'),\n('000893','draft','2009-09-18','DISA FSO','policy','Implement procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens.',NULL,'N/A',NULL),\n('000894','draft','2009-09-18','DISA FSO','policy','Requires maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals to be escorted and supervised during the performance of maintenance and diagnostic activities on the system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified.','MA-05(01)(a)(01)','N/A','Determine if procedures for the use of maintenance personnel who lack appropriate security clearances or are not U.S. citizens are implemented and include approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified escorting and supervising maintenance personnel without the needed access authorization during the performance of maintenance and diagnostic activities.'),\n('000895','draft','2009-09-18','DISA FSO','policy','Require that, prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the system be sanitized and all nonvolatile storage media be removed or physically disconnected from the system and secured.','MA-05(01)(a)(02)','N/A','Determine if procedures for the use of maintenance personnel who lack appropriate security clearances or are not U.S. citizens are implemented and include all volatile information storage components within the system being sanitized and all non-volatile storage media being removed or physically disconnected from the system and secured prior to initiating maintenance or diagnostic activities.'),\n('000897','draft','2009-09-18','DISA FSO','policy','Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for all compartments of information on the system.','MA-05(02)','N/A','Determine if: - personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess security clearances for at least the highest classification level and for compartments of information on the system. - personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess formal access approvals for at least the highest classification level and for compartments of information on the system.'),\n('000898','draft','2009-09-18','DISA FSO','policy','Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information are U.S. citizens.','MA-05(03)','N/A','Determine if personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information are U.S. citizens.'),\n('000899','draft','2009-09-18','DISA FSO','policy','Ensure that cleared foreign nationals with appropriate security clearances are used to conduct maintenance and diagnostic activities on classified systems only when the systems are jointly owned and operated by the United States and foreign allied governments, or owned and operated solely by foreign allied governments.','MA-05(04)(a)','N/A','Determine if foreign nationals with appropriate security clearances are used to conduct maintenance and diagnostic activities on classified systems only when the systems are jointly owned and operated by the United States and foreign allied governments or owned and operated solely by foreign allied governments.'),\n('000900','draft','2009-09-18','DISA FSO','policy','Ensure that that approvals, consents, and detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements.','MA-05(04)(b)','N/A','Determine if: - approvals regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements. - consents regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements. - detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements.'),\n('000903','draft','2009-09-18','DISA FSO','policy','Obtain maintenance support and/or spare parts for organization-defined system components within an organization-defined time period of failure.','MA-06','N/A','Determine if maintenance support and/or spare parts are obtained for [MA-06_ODP[01]; system components for which maintenance support and/or spare parts are obtained are defined] within [MA-06_ODP[02]; time period within which maintenance support and/or spare parts are to be obtained after a failure are defined] of failure.'),\n('000904','draft','2009-09-21','DISA FSO','policy','Develop and document an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','PE-01a.01(a)','N/A','Determine if: - the [PE-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] physical and environmental protection policy addresses purpose. - the [PE-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] physical and environmental protection policy addresses scope. - the [PE-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] physical and environmental protection policy addresses roles. - the [PE-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] physical and environmental protection policy addresses responsibilities. - the [PE-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] physical and environmental protection policy addresses management commitment. - the [PE-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] physical and environmental protection policy addresses coordination among organizational entities. - the [PE-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] physical and environmental protection policy addresses compliance.'),\n('000905','draft','2009-09-21','DISA FSO','policy','Disseminate a physical and environmental protection policy to organization-defined personnel or roles.','PE-01a.','N/A','Determine if: - a physical and environmental protection policy is developed and documented. - the physical and environmental protection policy is disseminated to [PE-01_ODP[01]; personnel or roles to whom the physical and environmental protection policy is to be disseminated is/are defined].'),\n('000906','draft','2009-09-21','DISA FSO','policy','Review and update the current physical and environmental protection policy in accordance with organization-defined frequency.','PE-01c.01','N/A','Determine if: - the current physical and environmental protection policy is reviewed and updated [PE-01_ODP[05]; the frequency at which the current physical and environmental protection policy is reviewed and updated is defined]. - the current physical and environmental protection policy is reviewed and updated following [PE-01_ODP[06]; events that would require the current physical and environmental protection policy to be reviewed and updated are defined].'),\n('000907','draft','2009-09-21','DISA FSO','policy','Defines the frequency with which to review and update the physical and environmental protection policy.','PE-01c.01','N/A','Determine if: - the current physical and environmental protection policy is reviewed and updated [PE-01_ODP[05]; the frequency at which the current physical and environmental protection policy is reviewed and updated is defined]. - the current physical and environmental protection policy is reviewed and updated following [PE-01_ODP[06]; events that would require the current physical and environmental protection policy to be reviewed and updated are defined].'),\n('000908','draft','2009-09-21','DISA FSO','policy','Develop and document procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls.','PE-01a.02','N/A','Determine if: - physical and environmental protection procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls are developed and documented. - the physical and environmental protection procedures are disseminated to [PE-01_ODP[02]; personnel or roles to whom the physical and environmental protection procedures are to be disseminated is/are defined].'),\n('000909','draft','2009-09-21','DISA FSO','policy','Disseminate physical and environmental protection procedures to organization-defined personnel or roles.','PE-01a.02','N/A','Determine if: - physical and environmental protection procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls are developed and documented. - the physical and environmental protection procedures are disseminated to [PE-01_ODP[02]; personnel or roles to whom the physical and environmental protection procedures are to be disseminated is/are defined].'),\n('000910','draft','2009-09-21','DISA FSO','policy','Review and update the current physical and environmental protection procedures in accordance with organization-defined frequency.','PE-01c.02','N/A','Determine if: - the current physical and environmental protection procedures are reviewed and updated [PE-01_ODP[07]; the frequency at which the current physical and environmental protection procedures are reviewed and updated is defined]. - the current physical and environmental protection procedures are reviewed and updated following [PE-01_ODP[08]; events that would require the physical and environmental protection procedures to be reviewed and updated are defined].'),\n('000911','draft','2009-09-21','DISA FSO','policy','Defines the frequency with which to review and update the physical and environmental protection procedures.','PE-01c.02','N/A','Determine if: - the current physical and environmental protection procedures are reviewed and updated [PE-01_ODP[07]; the frequency at which the current physical and environmental protection procedures are reviewed and updated is defined]. - the current physical and environmental protection procedures are reviewed and updated following [PE-01_ODP[08]; events that would require the physical and environmental protection procedures to be reviewed and updated are defined].'),\n('000912','draft','2009-09-21','DISA FSO','policy','Develop a list of individuals with authorized access to the facility where the system resides.','PE-02a.','N/A','Determine if: - a list of individuals with authorized access to the facility where the system resides has been developed. - the list of individuals with authorized access to the facility where the system resides has been approved. - the list of individuals with authorized access to the facility where the system resides has been maintained.'),\n('000913','draft','2009-09-21','DISA FSO','policy','Issue authorization credentials for facility access.','PE-02b.','N/A','Determine if authorization credentials are issued for facility access.'),\n('000914','draft','2009-09-21','DISA FSO','policy','Review the access list detailing authorized facility access by individuals in accordance with organization-defined frequency.','PE-02c.','N/A','Determine if the access list detailing authorized facility access by individuals is reviewed [PE-02_ODP; frequency at which to review the access list detailing authorized facility access by individuals is defined].'),\n('000915','draft','2009-09-21','DISA FSO','policy','Defines the frequency with which to review the access list detailing authorized facility access by individuals.','PE-02c.','N/A','Determine if the access list detailing authorized facility access by individuals is reviewed [PE-02_ODP; frequency at which to review the access list detailing authorized facility access by individuals is defined].'),\n('000916','draft','2009-09-21','DISA FSO','policy','Authorize physical access to the facility where the system resides based on position or role.','PE-02(01)','N/A','Determine if physical access to the facility where the system resides is authorized based on position or role.'),\n('000917','draft','2009-09-21','DISA FSO','policy','Require two forms of identification from an organization-defined list of acceptable forms of identification for visitor access to the facility where the system resides.','PE-02(02)','N/A','Determine if two forms of identification are required from [PE-02(02)_ODP; a list of acceptable forms of identification for visitor access to the facility where the system resides is defined] for visitor access to the facility where the system resides.'),\n('000920','draft','2009-09-21','DISA FSO','policy','Verify individual access authorizations before granting access to the facility.','PE-03a.01','N/A','Determine if physical access authorizations are enforced at [PE-03_ODP[01]; entry and exit points to the facility in which the system resides are defined] by verifying individual access authorizations before granting access to the facility.'),\n('000923','draft','2009-09-21','DISA FSO','policy','Secure keys, combinations, and other physical access devices.','PE-03e.','N/A','Determine if: - keys are secured. - combinations are secured. - other physical access devices are secured.'),\n('000924','draft','2009-09-21','DISA FSO','policy','Inventory organization-defined physical access devices on an organization-defined frequency.','PE-03f.','N/A','Determine if [PE-03_ODP[07]; physical access devices to be inventoried are defined] are inventoried [PE-03_ODP[08]; frequency at which to inventory physical access devices is defined].'),\n('000925','draft','2009-09-21','DISA FSO','policy','Defines the frequency for conducting inventories of organization-defined physical access devices.','PE-03f.','N/A','Determine if [PE-03_ODP[07]; physical access devices to be inventoried are defined] are inventoried [PE-03_ODP[08]; frequency at which to inventory physical access devices is defined].'),\n('000926','draft','2009-09-21','DISA FSO','policy','Change combinations and keys in accordance with organization-defined frequency and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.','PE-03g.','N/A','Determine if: - combinations are changed [PE-03_ODP[09]; frequency at which to change combinations is defined], when combinations are compromised, or when individuals possessing the combinations are transferred or terminated. - keys are changed [PE-03_ODP[10]; frequency at which to change keys is defined], when keys are lost, or when individuals possessing the keys are transferred or terminated.'),\n('000927','draft','2009-09-21','DISA FSO','policy','Defines a frequency for changing combinations and keys.','PE-03g.','N/A','Determine if: - combinations are changed [PE-03_ODP[09]; frequency at which to change combinations is defined], when combinations are compromised, or when individuals possessing the combinations are transferred or terminated. - keys are changed [PE-03_ODP[10]; frequency at which to change keys is defined], when keys are lost, or when individuals possessing the keys are transferred or terminated.'),\n('000928','draft','2009-09-21','DISA FSO','policy','Enforce physical access authorizations to the system in addition to the physical access controls for the facility where the system resides at organization-defined physical spaces containing one or more components of the system.','PE-03(01)','N/A','Determine if: - physical access authorizations to the system are enforced. - physical access controls are enforced for the facility at [PE-03(01)_ODP; physical spaces containing one or more components of the system are defined].'),\n('000929','draft','2009-09-21','DISA FSO','policy','Perform security checks in accordance with organization-defined frequency at the physical boundary of the facility or system for unauthorized exfiltration of information or removal of system components.','PE-03(02)','N/A','Determine if security checks are performed [PE-03(02)_ODP; the frequency at which to perform security checks at the physical perimeter of the facility or system for exfiltration of information or removal of system components is defined] at the physical perimeter of the facility or system for exfiltration of information or removal of system components.'),\n('000930','draft','2009-09-21','DISA FSO','policy','Employ guards to control every physical access point to the facility where the system resides 24 hours per day, 7 days per week.','PE-03(03)','N/A','Determine if guards are employed to control [PE-03(03)_ODP; physical access points to the facility where the system resides are defined] to the facility where the system resides 24 hours per day, 7 days per week.'),\n('000931','draft','2009-09-21','DISA FSO','policy','Use lockable physical casings to protect organization-defined system components from unauthorized physical access.','PE-03(04)','N/A','Determine if lockable physical casings are used to protect [PE-03(04)_ODP; system components to be protected from unauthorized physical access are defined] from unauthorized access.'),\n('000932','draft','2009-09-21','DISA FSO','policy','Defines system components to be protected from unauthorized physical access using lockable physical casings.','PE-03(04)','N/A','Determine if lockable physical casings are used to protect [PE-03(04)_ODP; system components to be protected from unauthorized physical access are defined] from unauthorized access.'),\n('000933','draft','2009-09-21','DISA FSO','policy','Employ organization-defined anti-tamper technologies to deter and/or prevent physical tampering or alteration of organization-defined hardware components within the system.','PE-03(05)','N/A','Determine if [PE-03(05)_ODP[01]; anti-tamper technologies to be employed are defined] are employed to [PE-03(05)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {detect; prevent}] physical tampering or alteration of [PE-03(05)_ODP[03]; hardware components to be protected from physical tampering or alteration are defined] within the system.'),\n('000936','draft','2009-09-21','DISA FSO','policy','Control physical access to organization-defined system distribution and transmission lines within organizational facilities using organization-defined security controls.','PE-04','N/A','Determine if physical access to [PE-04_ODP[01]; system distribution and transmission lines requiring physical access controls are defined] within organizational facilities is controlled using [PE-04_ODP[02]; security controls to be implemented to control physical access to system distribution and transmission lines within the organizational facility are defined].'),\n('000937','draft','2009-09-21','DISA FSO','policy','Control physical access to output from organization-defined output devices to prevent unauthorized individuals from obtaining the output.','PE-05','N/A','Determine if physical access to output from [PE-05_ODP; output devices that require physical access control to output are defined] is controlled to prevent unauthorized individuals from obtaining the output.'),\n('000939','draft','2009-09-21','DISA FSO','policy','Review physical access logs in accordance with organization-defined frequency.','PE-06b.','N/A','Determine if: - physical access logs are reviewed [PE-06_ODP[01]; the frequency at which to review physical access logs is defined]. - physical access logs are reviewed upon occurrence of [PE-06_ODP[02]; events or potential indication of events requiring physical access logs to be reviewed are defined].'),\n('000940','draft','2009-09-21','DISA FSO','policy','Defines a frequency for reviewing physical access logs.','PE-06b.','N/A','Determine if: - physical access logs are reviewed [PE-06_ODP[01]; the frequency at which to review physical access logs is defined]. - physical access logs are reviewed upon occurrence of [PE-06_ODP[02]; events or potential indication of events requiring physical access logs to be reviewed are defined].'),\n('000941','draft','2009-09-21','DISA FSO','policy','Coordinate results of reviews and investigations with the organization''s incident response capability.','PE-06c.','N/A','Determine if: - results of reviews are coordinated with organizational incident response capabilities. - results of investigations are coordinated with organizational incident response capabilities.'),\n('000942','draft','2009-09-21','DISA FSO','policy','Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment.','PE-06(01)','N/A','Determine if: - physical access to the facility where the system resides is monitored using physical intrusion alarms. - physical access to the facility where the system resides is monitored using physical surveillance equipment.'),\n('000947','draft','2009-09-21','DISA FSO','policy','Maintain visitor access records to the facility where the system resides for an organization-defined time period.','PE-08a.','N/A','Determine if visitor access records for the facility where the system resides are maintained for [PE-08_ODP[01]; time period for which to maintain visitor access records for the facility where the system resides is defined].'),\n('000948','draft','2009-09-21','DISA FSO','policy','Review visitor access records in accordance with organization-defined frequency.','PE-08b.','N/A','Determine if visitor access records are reviewed [PE-08_ODP[02]; the frequency at which to review visitor access records is defined].'),\n('000949','draft','2009-09-21','DISA FSO','policy','Defines the frequency with which to review the visitor access records for the facility where the system resides.','PE-08b.','N/A','Determine if visitor access records are reviewed [PE-08_ODP[02]; the frequency at which to review visitor access records is defined].'),\n('000950','draft','2009-09-21','DISA FSO','policy','Maintain and review visitor access records using organization-defined automated mechanisms.','PE-08(01)','N/A','Determine if: - visitor access records are maintained using [PE-08(01)_ODP[01]; automated mechanisms used to maintain visitor access records are defined]. - visitor access records are reviewed using [PE-08(01)_ODP[02]; automated mechanisms used to review visitor access records are defined].'),\n('000952','draft','2009-09-21','DISA FSO','policy','Protect power equipment and power cabling for the system from damage and destruction.','PE-09','N/A','Determine if: - power equipment for the system is protected from damage and destruction. - power cabling for the system is protected from damage and destruction.'),\n('000954','draft','2009-09-21','DISA FSO','policy','Employ automatic voltage controls for organization-defined critical system components.','PE-09(02)','N/A','Determine if automatic voltage controls for [PE-09(02)_ODP; the critical system components that require automatic voltage controls are defined] are employed.'),\n('000955','draft','2009-09-21','DISA FSO','policy','Defines critical system components that require automatic voltage controls.','PE-09(02)','N/A','Determine if automatic voltage controls for [PE-09(02)_ODP; the critical system components that require automatic voltage controls are defined] are employed.'),\n('000956','draft','2009-09-21','DISA FSO','policy','Provides the capability of shutting off power to the organization-defined system or individual system components in emergency situations.','PE-10a.','N/A','Determine if the capability to shut off power to [PE-10_ODP[01]; system or individual system components that require the capability to shut off power in emergency situations is/are defined] in emergency situations is provided.'),\n('000957','draft','2009-09-21','DISA FSO','policy','Place emergency shutoff switches or devices in an organization-defined location by system or system component to facilitate access for authorized personnel.','PE-10b.','N/A','Determine if emergency shutoff switches or devices are placed in [PE-10_ODP[02]; location of emergency shutoff switches or devices by system or system component is defined] to facilitate access for authorized personnel.'),\n('000958','draft','2009-09-21','DISA FSO','policy','Defines a location for emergency shutoff switches or devices by system or system component.','PE-10b.','N/A','Determine if emergency shutoff switches or devices are placed in [PE-10_ODP[02]; location of emergency shutoff switches or devices by system or system component is defined] to facilitate access for authorized personnel.'),\n('000959','draft','2009-09-21','DISA FSO','policy','Protect emergency power shutoff capability from unauthorized activation.','PE-10c.','N/A','Determine if the emergency power shutoff capability is protected from unauthorized activation.'),\n('000961','draft','2009-09-21','DISA FSO','policy','Provide an alternate power supply for the system that is activated manually or automatically and that can maintain minimally required operational capability in the event of an extended loss of the primary power source.','PE-11(01)','N/A','Determine if: - an alternate power supply provided for the system is activated [PE-11(01)_ODP; one of the following PARAMETER VALUES is selected: {manually; automatically}]. - the alternate power supply provided for the system can maintain minimally required operational capability in the event of an extended loss of the primary power source.'),\n('000963','draft','2009-09-21','DISA FSO','policy','Employ and maintains automatic emergency lighting for the information system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.','PE-12','N/A','Determine if: - automatic emergency lighting that activates in the event of a power outage or disruption is employed for the system. - automatic emergency lighting that activates in the event of a power outage or disruption is maintained for the system. - automatic emergency lighting for the system covers emergency exits within the facility. - automatic emergency lighting for the system covers evacuation routes within the facility.'),\n('000965','draft','2009-09-21','DISA FSO','policy','Employ and maintain fire detection and suppression systems that are supported by an independent energy source.','PE-13','N/A','Determine if: - fire detection systems are employed. - employed fire detection systems are supported by an independent energy source. - employed fire detection systems are maintained. - fire suppression systems are employed. - employed fire suppression systems are supported by an independent energy source. - employed fire suppression systems are maintained.'),\n('000968','draft','2009-09-21','DISA FSO','policy','Employ an automatic fire suppression capability for the system when the facility is not staffed on a continuous basis.','PE-13(02)(b)','N/A','Determine if an automatic fire suppression capability is employed when the facility is not staffed on a continuous basis.'),\n('000971','draft','2009-09-21','DISA FSO','policy','Maintain temperature; humidity; pressure; radiation; and/or organization-defined environmental control levels within the facility where the system resides at organization-defined acceptable levels.','PE-14a.','N/A','Determine if [PE-14_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {temperature; humidity; pressure; radiation; [PE-14_ODP[02]; environmental control(s) for which to maintain a specified level in the facility where the system resides are defined (if selected)]}] levels are maintained at [PE-14_ODP[03]; acceptable levels for environmental controls are defined] within the facility where the system resides.'),\n('000972','draft','2009-09-21','DISA FSO','policy','Defines acceptable temperature, humidity, pressure, radiation, and/or organization-defined environmental control levels to be maintained within the facility where the system resides.','PE-14a.','N/A','Determine if [PE-14_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {temperature; humidity; pressure; radiation; [PE-14_ODP[02]; environmental control(s) for which to maintain a specified level in the facility where the system resides are defined (if selected)]}] levels are maintained at [PE-14_ODP[03]; acceptable levels for environmental controls are defined] within the facility where the system resides.'),\n('000973','draft','2009-09-21','DISA FSO','policy','Monitor environmental control levels in accordance with organization-defined frequency.','PE-14b.','N/A','Determine if environmental control levels are monitored [PE-14_ODP[04]; frequency at which to monitor environmental control levels is defined].'),\n('000974','draft','2009-09-21','DISA FSO','policy','Defines a frequency for monitoring environmental control levels.','PE-14b.','N/A','Determine if environmental control levels are monitored [PE-14_ODP[04]; frequency at which to monitor environmental control levels is defined].'),\n('000975','draft','2009-09-21','DISA FSO','policy','Employ organization-defined automatic environmental controls in the facility to prevent fluctuations potentially harmful to the system.','PE-14(01)','N/A','Determine if [PE-14(01)_ODP; automatic environmental controls to prevent fluctuations that are potentially harmful to the system are defined] are employed in the facility to prevent fluctuations that are potentially harmful to the system.'),\n('000976','draft','2009-09-21','DISA FSO','policy','Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to organization-defined personnel or roles.','PE-14(02)','N/A','Determine if: - environmental control monitoring is employed. - the environmental control monitoring capability provides an alarm or notification to [PE-14(02)_ODP; personnel or roles to be notified by environmental control monitoring when environmental changes are potentially harmful to personnel or equipment is/are defined] when changes are potentially harmful to personnel or equipment.'),\n('000977','draft','2009-09-21','DISA FSO','policy','Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible.','PE-15','N/A','Determine if: - the system is protected from damage resulting from water leakage by providing master shutoff or isolation valves. - the master shutoff or isolation valves are accessible. - the master shutoff or isolation valves are working properly. - the master shutoff or isolation valves are known to key personnel.'),\n('000978','draft','2009-09-21','DISA FSO','policy','Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are working properly.','PE-15','N/A','Determine if: - the system is protected from damage resulting from water leakage by providing master shutoff or isolation valves. - the master shutoff or isolation valves are accessible. - the master shutoff or isolation valves are working properly. - the master shutoff or isolation valves are known to key personnel.'),\n('000979','draft','2009-09-21','DISA FSO','policy','Key personnel have knowledge of the master water shutoff or isolation valves.','PE-15','N/A','Determine if: - the system is protected from damage resulting from water leakage by providing master shutoff or isolation valves. - the master shutoff or isolation valves are accessible. - the master shutoff or isolation valves are working properly. - the master shutoff or isolation valves are known to key personnel.'),\n('000981','draft','2009-09-21','DISA FSO','policy','Authorize organization-defined types of system components entering and exiting the facility.','PE-16a.','N/A','Determine if: - [PE-16_ODP[01]; types of system components to be authorized and controlled when entering the facility are defined] are authorized when entering the facility. - [PE-16_ODP[01]; types of system components to be authorized and controlled when entering the facility are defined] are controlled when entering the facility. - [PE-16_ODP[02]; types of system components to be authorized and controlled when exiting the facility are defined] are authorized when exiting the facility. - [PE-16_ODP[02]; types of system components to be authorized and controlled when exiting the facility are defined] are controlled when exiting the facility.'),\n('000983','draft','2009-09-21','DISA FSO','policy','Control organization-defined types of system components entering and exiting the facility.','PE-16a.','N/A','Determine if: - [PE-16_ODP[01]; types of system components to be authorized and controlled when entering the facility are defined] are authorized when entering the facility. - [PE-16_ODP[01]; types of system components to be authorized and controlled when entering the facility are defined] are controlled when entering the facility. - [PE-16_ODP[02]; types of system components to be authorized and controlled when exiting the facility are defined] are authorized when exiting the facility. - [PE-16_ODP[02]; types of system components to be authorized and controlled when exiting the facility are defined] are controlled when exiting the facility.'),\n('000984','draft','2009-09-21','DISA FSO','policy','Maintain records of system components.','PE-16b.','N/A','Determine if records of the system components are maintained.'),\n('000985','draft','2009-09-21','DISA FSO','policy','Employ organization-defined controls at alternate work sites.','PE-17b.','N/A','Determine if [PE-17_ODP[02]; controls to be employed at alternate work sites are defined] are employed at alternate work sites.'),\n('000987','draft','2009-09-21','DISA FSO','policy','Assess as feasible, the effectiveness of controls at alternate work sites.','PE-17c.','N/A','Determine if the effectiveness of controls at alternate work sites is assessed.'),\n('000988','draft','2009-09-21','DISA FSO','policy','Provide a means for employees to communicate with information security personnel in case of incidents.','PE-17d.','N/A','Determine if a means for employees to communicate with information security and privacy personnel in case of incidents is provided.'),\n('000989','draft','2009-09-21','DISA FSO','policy','Position system components within the facility to minimize potential damage from organization-defined physical and environmental hazards.','PE-18','N/A','Determine if system components are positioned within the facility to minimize potential damage from [PE-18_ODP; physical and environmental hazards that could result in potential damage to system components within the facility are defined] and to minimize the opportunity for unauthorized access.'),\n('000991','draft','2009-09-21','DISA FSO','policy','Position system components within the facility to minimize the opportunity for unauthorized access.','PE-18','N/A','Determine if system components are positioned within the facility to minimize potential damage from [PE-18_ODP; physical and environmental hazards that could result in potential damage to system components within the facility are defined] and to minimize the opportunity for unauthorized access.'),\n('000993','draft','2009-09-21','DISA FSO','policy','Protect the system from information leakage due to electromagnetic signals emanations.','PE-19','N/A','Determine if the system is protected from information leakage due to electromagnetic signal emanations.'),\n('000995','draft','2009-09-21','DISA FSO','policy','Develop and document an organization-level; mission/business process-level; and/or system-level media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','MP-01a.01(a)','N/A','Determine if: - the [MP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] media protection policy addresses purpose. - the [MP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] media protection policy addresses scope. - the [MP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] media protection policy addresses roles. - the [MP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] media protection policy addresses responsibilities. - the [MP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] media protection policy addresses management commitment. - the [MP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] media protection policy addresses coordination among organizational entities. - the [MP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] media protection policy compliance.'),\n('000996','draft','2009-09-21','DISA FSO','policy','Disseminates a media protection policy to organization-defined personnel or roles.','MP-01a.','N/A','Determine if: - a media protection policy is developed and documented. - the media protection policy is disseminated to [MP-01_ODP[01]; personnel or roles to whom the media protection policy is to be disseminated is/are defined].'),\n('000997','draft','2009-09-21','DISA FSO','policy','Review and update the current media protection policy in accordance with organization-defined frequency.','MP-01c.01','N/A','Determine if: - the current media protection policy is reviewed and updated [MP-01_ODP[05]; the frequency with which the current media protection policy is reviewed and updated is defined]. - the current media protection policy is reviewed and updated following [MP-01_ODP[06]; events that would require the current media protection policy to be reviewed and updated are defined].'),\n('000998','draft','2009-09-21','DISA FSO','policy','Defines a frequency for reviewing and updating the current media protection policy.','MP-01c.01','N/A','Determine if: - the current media protection policy is reviewed and updated [MP-01_ODP[05]; the frequency with which the current media protection policy is reviewed and updated is defined]. - the current media protection policy is reviewed and updated following [MP-01_ODP[06]; events that would require the current media protection policy to be reviewed and updated are defined].'),\n('000999','draft','2009-09-21','DISA FSO','policy','Develop and document procedures to facilitate the implementation of the media protection policy and associated media protection controls.','MP-01a.02','N/A','Determine if: - media protection procedures to facilitate the implementation of the media protection policy and associated media protection controls are developed and documented. - the media protection procedures are disseminated to [MP-01_ODP[02]; personnel or roles to whom the media protection procedures are to be disseminated is/are defined].'),\n('001000','draft','2009-09-21','DISA FSO','policy','Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the media protection policy and associated media protection controls.','MP-01a.02','N/A','Determine if: - media protection procedures to facilitate the implementation of the media protection policy and associated media protection controls are developed and documented. - the media protection procedures are disseminated to [MP-01_ODP[02]; personnel or roles to whom the media protection procedures are to be disseminated is/are defined].'),\n('001001','draft','2009-09-21','DISA FSO','policy','Review and update the current media protection procedures in accordance with organization-defined frequency.','MP-01c.02','N/A','Determine if: - the current media protection procedures are reviewed and updated [MP-01_ODP[07]; the frequency with which the current media protection procedures are reviewed and updated is defined]. - the current media protection procedures are reviewed and updated following [MP-01_ODP[08]; events that would require media protection procedures to be reviewed and updated are defined].'),\n('001002','draft','2009-09-21','DISA FSO','policy','Defines a frequency for reviewing and updating the current media protection procedures.','MP-01c.02','N/A','Determine if: - the current media protection procedures are reviewed and updated [MP-01_ODP[07]; the frequency with which the current media protection procedures are reviewed and updated is defined]. - the current media protection procedures are reviewed and updated following [MP-01_ODP[08]; events that would require media protection procedures to be reviewed and updated are defined].'),\n('001003','draft','2009-09-21','DISA FSO','policy','Restrict access to organization-defined types of digital and/or non-digital media to organization-defined personnel or roles.','MP-02','N/A','Determine if: - access to [MP-02_ODP[01]; types of digital media to which access is restricted are defined] is restricted to [MP-02_ODP[02]; personnel or roles authorized to access digital media is/are defined]. - access to [MP-02_ODP[03]; types of non-digital media to which access is restricted are defined] is restricted to [MP-02_ODP[04]; personnel or roles authorized to access non-digital media is/are defined].'),\n('001004','draft','2009-09-21','DISA FSO','policy','Defines types of digital and/or non-digital media for which the organization restricts access.','MP-02','N/A','Determine if: - access to [MP-02_ODP[01]; types of digital media to which access is restricted are defined] is restricted to [MP-02_ODP[02]; personnel or roles authorized to access digital media is/are defined]. - access to [MP-02_ODP[03]; types of non-digital media to which access is restricted are defined] is restricted to [MP-02_ODP[04]; personnel or roles authorized to access non-digital media is/are defined].'),\n('001005','draft','2009-09-21','DISA FSO','policy','Defines personnel or roles from which to restrict access to organization-defined types of digital and/or non-digital media.','MP-02','N/A','Determine if: - access to [MP-02_ODP[01]; types of digital media to which access is restricted are defined] is restricted to [MP-02_ODP[02]; personnel or roles authorized to access digital media is/are defined]. - access to [MP-02_ODP[03]; types of non-digital media to which access is restricted are defined] is restricted to [MP-02_ODP[04]; personnel or roles authorized to access non-digital media is/are defined].'),\n('001007','draft','2009-09-21','DISA FSO','policy','Restrict access to media storage areas using organization-defined automated mechanisms.','MP-04(02)','N/A','Determine if: - access to media storage areas is restricted using [MP-04(02)_ODP[01]; automated mechanisms to restrict access to media storage areas are defined]. - access attempts to media storage areas are logged using [MP-04(02)_ODP[02]; automated mechanisms to log access attempts to media storage areas are defined]. - access granted to media storage areas is logged using [MP-04(02)_ODP[03]; automated mechanisms to log access granted to media storage areas are defined].'),\n('001008','draft','2009-09-21','DISA FSO','policy','Log access attempts and access granted using organization-defined automated mechanisms.','MP-04(02)','N/A','Determine if: - access to media storage areas is restricted using [MP-04(02)_ODP[01]; automated mechanisms to restrict access to media storage areas are defined]. - access attempts to media storage areas are logged using [MP-04(02)_ODP[02]; automated mechanisms to log access attempts to media storage areas are defined]. - access granted to media storage areas is logged using [MP-04(02)_ODP[03]; automated mechanisms to log access granted to media storage areas are defined].'),\n('001010','draft','2009-09-21','DISA FSO','policy','Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information.','MP-03a.','N/A','Determine if system media is marked to indicate distribution limitations, handling caveats, and applicable security markings (if any) of the information.'),\n('001011','draft','2009-09-21','DISA FSO','policy','Exempt organization-defined types of system media from marking as long as the media remain within organization-defined controlled areas.','MP-03b.','N/A','Determine if [MP-03_ODP[01]; types of system media exempt from marking when remaining in controlled areas are defined] remain within [MP-03_ODP[02]; controlled areas where media is exempt from marking are defined].'),\n('001012','draft','2009-09-21','DISA FSO','policy','Defines types of system media to exempt from marking as long as the media remain within organization-defined controlled areas.','MP-03b.','N/A','Determine if [MP-03_ODP[01]; types of system media exempt from marking when remaining in controlled areas are defined] remain within [MP-03_ODP[02]; controlled areas where media is exempt from marking are defined].'),\n('001013','draft','2009-09-21','DISA FSO','policy','Defines controlled areas where organization-defined types of system media are exempt from being marked.','MP-03b.','N/A','Determine if [MP-03_ODP[01]; types of system media exempt from marking when remaining in controlled areas are defined] remain within [MP-03_ODP[02]; controlled areas where media is exempt from marking are defined].'),\n('001015','draft','2009-09-21','DISA FSO','policy','Defines types of digital and/or non-digital media to physically control and securely store within organization-defined controlled areas.','MP-04a.','N/A','Determine if: - [MP-04_ODP[01]; types of digital media to be physically controlled are defined (if selected)] are physically controlled. - [MP-04_ODP[02]; types of non-digital media to be physically controlled are defined (if selected)] are physically controlled. - [MP-04_ODP[03]; types of digital media to be securely stored are defined (if selected)] are securely stored within [MP-04_ODP[05]; controlled areas within which to securely store digital media are defined]. - [MP-04_ODP[04]; types of non-digital media to be securely stored are defined (if selected)] are securely stored within [MP-04_ODP[06]; controlled areas within which to securely store non-digital media are defined].'),\n('001016','draft','2009-09-21','DISA FSO','policy','Defines controlled areas where organization-defined types of digital and/or non-digital media are physically controlled and securely stored.','MP-04a.','N/A','Determine if: - [MP-04_ODP[01]; types of digital media to be physically controlled are defined (if selected)] are physically controlled. - [MP-04_ODP[02]; types of non-digital media to be physically controlled are defined (if selected)] are physically controlled. - [MP-04_ODP[03]; types of digital media to be securely stored are defined (if selected)] are securely stored within [MP-04_ODP[05]; controlled areas within which to securely store digital media are defined]. - [MP-04_ODP[04]; types of non-digital media to be securely stored are defined (if selected)] are securely stored within [MP-04_ODP[06]; controlled areas within which to securely store non-digital media are defined].'),\n('001021','draft','2009-09-21','DISA FSO','policy','Defines types of system media protected and controlled during transport outside of controlled areas.','MP-05a.','N/A','Determine if: - [MP-05_ODP[01]; types of system media to protect and control during transport outside of controlled areas are defined] are protected during transport outside of controlled areas using [MP-05_ODP[02]; controls used to protect system media outside of controlled areas are defined]. - [MP-05_ODP[01]; types of system media to protect and control during transport outside of controlled areas are defined] are controlled during transport outside of controlled areas using [MP-05_ODP[03]; controls used to control system media outside of controlled areas are defined].'),\n('001022','draft','2009-09-21','DISA FSO','policy','Defines controls to be used to protect and control organization-defined types of system media during transport outside of controlled areas.','MP-05a.','N/A','Determine if: - [MP-05_ODP[01]; types of system media to protect and control during transport outside of controlled areas are defined] are protected during transport outside of controlled areas using [MP-05_ODP[02]; controls used to protect system media outside of controlled areas are defined]. - [MP-05_ODP[01]; types of system media to protect and control during transport outside of controlled areas are defined] are controlled during transport outside of controlled areas using [MP-05_ODP[03]; controls used to control system media outside of controlled areas are defined].'),\n('001023','draft','2009-09-21','DISA FSO','policy','Maintain accountability for system media during transport outside of controlled areas.','MP-05b.','N/A','Determine if accountability for system media is maintained during transport outside of controlled areas.'),\n('001024','draft','2009-09-21','DISA FSO','policy','Restrict the activities associated with the transport of system media to authorized personnel.','MP-05d.','N/A','Determine if: - personnel authorized to conduct media transport activities is/are identified. - activities associated with the transport of system media are restricted to identified authorized personnel.'),\n('001025','draft','2009-09-21','DISA FSO','policy','Document activities associated with the transport of system media.','MP-05c.','N/A','Determine if activities associated with the transport of system media are documented.'),\n('001026','draft','2009-09-21','DISA FSO','policy','Employ an identified custodian during transport of system media outside of controlled areas.','MP-05(03)','N/A','Determine if: - a custodian to transport system media outside of controlled areas is identified. - the identified custodian is employed during the transport of system media outside of controlled areas.'),\n('001028','draft','2009-09-21','DISA FSO','policy','Sanitize organization-defined system media prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures.','MP-06a.','N/A','Determine if: - [MP-06_ODP[01]; system media to be sanitized prior to disposal is defined] is sanitized using [MP-06_ODP[04]; sanitization techniques and procedures to be used for sanitization prior to disposal are defined] prior to disposal. - [MP-06_ODP[02]; system media to be sanitized prior to release from organizational control is defined] is sanitized using [MP-06_ODP[05]; sanitization techniques and procedures to be used for sanitization prior to release from organizational control are defined] prior to release from organizational control. - [MP-06_ODP[03]; system media to be sanitized prior to release for reuse is defined] is sanitized using [MP-06_ODP[06]; sanitization techniques and procedures to be used for sanitization prior to release for reuse are defined] prior to release for reuse.'),\n('001031','draft','2009-09-21','DISA FSO','policy','Defines a frequency for testing sanitization equipment and procedures to ensure that the intended sanitization is being achieved.','MP-06(02)','N/A','Determine if: - sanitization equipment is tested [MP-06(02)_ODP[01]; frequency with which to test sanitization equipment is defined] to ensure that the intended sanitization is being achieved. - sanitization procedures are tested [MP-06(02)_ODP[02]; frequency with which to test sanitization procedures is defined] to ensure that the intended sanitization is being achieved.'),\n('001032','draft','2009-09-21','DISA FSO','policy','Apply nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the system in accordance with organization-defined circumstances requiring sanitization of portable storage devices.','MP-06(03)','N/A','Determine if non-destructive sanitization techniques are applied to portable storage devices prior to connecting such devices to the system under [MP-06(03)_ODP; circumstances requiring sanitization of portable storage devices are defined].'),\n('001033','draft','2009-09-21','DISA FSO','policy','Defines circumstances requiring sanitization of portable storage devices prior to connecting such devices to the system.','MP-06(03)','N/A','Determine if non-destructive sanitization techniques are applied to portable storage devices prior to connecting such devices to the system under [MP-06(03)_ODP; circumstances requiring sanitization of portable storage devices are defined].'),\n('001037','draft','2009-09-21','DISA FSO','policy','Develop and document an organization-level; mission/business process-level; system-level risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','RA-01a.01(a)','N/A','Determine if: - the [RA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] risk assessment policy addresses purpose. - the [RA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] risk assessment policy addresses scope. - the [RA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] risk assessment policy addresses roles. - the [RA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] risk assessment policy addresses responsibilities. - the [RA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] risk assessment policy addresses management commitment. - the [RA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] risk assessment policy addresses coordination among organizational entities. - the [RA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] risk assessment policy addresses compliance.'),\n('001038','draft','2009-09-21','DISA FSO','policy','Disseminate an organization-level; mission/business process-level; system-level risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to organization-defined personnel or roles.','RA-01a.','N/A','Determine if: - a risk assessment policy is developed and documented. - the risk assessment policy is disseminated to [RA-01_ODP[01; personnel or roles to whom the risk assessment policy is to be disseminated is/are defined].'),\n('001039','draft','2009-09-21','DISA FSO','policy','Review and update the current risk assessment policy in accordance with organization-defined frequency.','RA-01c.01','N/A','Determine if: - the current risk assessment policy is reviewed and updated [RA-01_ODP[05]; the frequency at which the current risk assessment policy is reviewed and updated is defined]. - the current risk assessment policy is reviewed and updated following [RA-01_ODP[06]; events that would require the current risk assessment policy to be reviewed and updated are defined].'),\n('001040','draft','2009-09-21','DISA FSO','policy','Defines the frequency with which to review and update the current risk assessment policy.','RA-01c.01','N/A','Determine if: - the current risk assessment policy is reviewed and updated [RA-01_ODP[05]; the frequency at which the current risk assessment policy is reviewed and updated is defined]. - the current risk assessment policy is reviewed and updated following [RA-01_ODP[06]; events that would require the current risk assessment policy to be reviewed and updated are defined].'),\n('001041','draft','2009-09-21','DISA FSO','policy','Develop and document procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls.','RA-01a.02','N/A','Determine if: - risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls are developed and documented. - the risk assessment procedures are disseminated to [RA-01_ODP[02]; personnel or roles to whom the risk assessment procedures are to be disseminated is/are defined].'),\n('001042','draft','2009-09-21','DISA FSO','policy','Disseminate risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls to organization-defined personnel or roles.','RA-01a.02','N/A','Determine if: - risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls are developed and documented. - the risk assessment procedures are disseminated to [RA-01_ODP[02]; personnel or roles to whom the risk assessment procedures are to be disseminated is/are defined].'),\n('001043','draft','2009-09-21','DISA FSO','policy','Review and update the current risk assessment procedures in accordance with organization-defined frequency.','RA-01c.02','N/A','Determine if: - the current risk assessment procedures are reviewed and updated [RA-01_ODP[07]; the frequency at which the current risk assessment procedures are reviewed and updated is defined]. - the current risk assessment procedures are reviewed and updated following [RA-01_ODP[08]; events that would require risk assessment procedures to be reviewed and updated are defined].'),\n('001044','draft','2009-09-21','DISA FSO','policy','Defines the frequency with which to review and update the current risk assessment procedures.','RA-01c.02','N/A','Determine if: - the current risk assessment procedures are reviewed and updated [RA-01_ODP[07]; the frequency at which the current risk assessment procedures are reviewed and updated is defined]. - the current risk assessment procedures are reviewed and updated following [RA-01_ODP[08]; events that would require risk assessment procedures to be reviewed and updated are defined].'),\n('001046','draft','2009-09-21','DISA FSO','policy','Document the security categorization results including supporting rationale in the security plan for the system.','RA-02b.','N/A','Determine if the security categorization results, including supporting rationale, are documented in the security plan for the system.'),\n('001047','draft','2009-09-21','DISA FSO','policy','Verify the security categorization decision is reviewed and approved by the authorizing official or authorizing official designated representative.','RA-02c.','N/A','Determine if the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.'),\n('001048','draft','2009-09-21','DISA FSO','policy','Conduct a risk assessment, including determining the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information.','RA-03a.02','N/A','Determine if a risk assessment is conducted to determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system; the information it processes, stores, or transmits; and any related information.'),\n('001049','draft','2009-09-21','DISA FSO','policy','Document risk assessment results in the organization-defined document.','RA-03c.','N/A','Determine if risk assessment results are documented in [RA-03_ODP[01]; one of the following PARAMETER VALUES is selected: {security and privacy plans; risk assessment report; [RA-03_ODP[02]; a document in which risk assessment results are to be documented (if not documented in the security and privacy plans or risk assessment report) is defined (if selected)]}].'),\n('001050','draft','2009-09-21','DISA FSO','policy','Review risk assessment results on an organization-defined frequency.','RA-03d.','N/A','Determine if risk assessment results are reviewed [RA-03_ODP[03]; the frequency to review risk assessment results is defined].'),\n('001051','draft','2009-09-21','DISA FSO','policy','Defines a frequency for reviewing risk assessment results.','RA-03d.','N/A','Determine if risk assessment results are reviewed [RA-03_ODP[03]; the frequency to review risk assessment results is defined].'),\n('001052','draft','2009-09-21','DISA FSO','policy','Update the risk assessment on an organization-defined frequency or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.','RA-03f.','N/A','Determine if the risk assessment is updated [RA-03_ODP[05]; the frequency to update the risk assessment is defined] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.'),\n('001053','draft','2009-09-21','DISA FSO','policy','Defines a frequency for updating the risk assessment.','RA-03f.','N/A','Determine if the risk assessment is updated [RA-03_ODP[05]; the frequency to update the risk assessment is defined] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.'),\n('001054','draft','2009-09-21','DISA FSO','policy','Monitor and scan for vulnerabilities in the system and hosted applications on an organization-defined frequency and/or randomly in accordance with organization-defined process.','RA-05a.','N/A','Determine if: - systems and hosted applications are monitored for vulnerabilities [RA-05_ODP[01]; frequency for monitoring systems and hosted applications for vulnerabilities is defined] and when new vulnerabilities potentially affecting the system are identified and reported. - systems and hosted applications are scanned for vulnerabilities [RA-05_ODP[02]; frequency for scanning systems and hosted applications for vulnerabilities is defined] and when new vulnerabilities potentially affecting the system are identified and reported.'),\n('001055','draft','2009-09-21','DISA FSO','policy','Defines a frequency for scanning for vulnerabilities in the system and hosted applications, and/or randomly in accordance with organization-defined process.','RA-05a.','N/A','Determine if: - systems and hosted applications are monitored for vulnerabilities [RA-05_ODP[01]; frequency for monitoring systems and hosted applications for vulnerabilities is defined] and when new vulnerabilities potentially affecting the system are identified and reported. - systems and hosted applications are scanned for vulnerabilities [RA-05_ODP[02]; frequency for scanning systems and hosted applications for vulnerabilities is defined] and when new vulnerabilities potentially affecting the system are identified and reported.'),\n('001056','draft','2009-09-21','DISA FSO','policy','Monitor and scan for vulnerabilities in the system and hosted applications when new vulnerabilities potentially affecting the system/applications are identified and reported.','RA-05a.','N/A','Determine if: - systems and hosted applications are monitored for vulnerabilities [RA-05_ODP[01]; frequency for monitoring systems and hosted applications for vulnerabilities is defined] and when new vulnerabilities potentially affecting the system are identified and reported. - systems and hosted applications are scanned for vulnerabilities [RA-05_ODP[02]; frequency for scanning systems and hosted applications for vulnerabilities is defined] and when new vulnerabilities potentially affecting the system are identified and reported.'),\n('001057','draft','2009-09-21','DISA FSO','policy','Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: enumerating platforms, software flaws, and improper configurations.','RA-05b.01','N/A','Determine if vulnerability monitoring tools and techniques are employed to automate parts of the vulnerability management process by using standards for enumerating platforms, software flaws, and improper configurations.'),\n('001058','draft','2009-09-21','DISA FSO','policy','Analyze vulnerability scan reports and results from vulnerability monitoring.','RA-05c.','N/A','Determine if vulnerability scan reports and results from vulnerability monitoring are analyzed.'),\n('001059','draft','2009-09-21','DISA FSO','policy','Remediate legitimate vulnerabilities in organization-defined response times in accordance with an organizational assessment risk.','RA-05d.','N/A','Determine if legitimate vulnerabilities are remediated [RA-05_ODP[03]; response times to remediate legitimate vulnerabilities in accordance with an organizational assessment of risk are defined] in accordance with an organizational assessment of risk.'),\n('001060','draft','2009-09-21','DISA FSO','policy','Defines response times for remediating legitimate vulnerabilities in accordance with an organization assessment of risk.','RA-05d.','N/A','Determine if legitimate vulnerabilities are remediated [RA-05_ODP[03]; response times to remediate legitimate vulnerabilities in accordance with an organizational assessment of risk are defined] in accordance with an organizational assessment of risk.'),\n('001061','draft','2009-09-21','DISA FSO','policy','Share information obtained from the vulnerability monitoring process and control assessments with organization-defined personnel or roles to help eliminate similar vulnerabilities in other systems.','RA-05e.','N/A','Determine if information obtained from the vulnerability monitoring process and control assessments is shared with [RA-05_ODP[04]; personnel or roles with whom information obtained from the vulnerability scanning process and control assessments is to be shared] to help eliminate similar vulnerabilities in other systems.'),\n('001063','draft','2009-09-21','DISA FSO','policy','Update the system vulnerabilities scanned on an organization-defined frequency, prior to a new scan, and/or when new vulnerabilities are identified and reported.','RA-05(02)','N/A','Determine if the system vulnerabilities to be scanned are updated [RA-05(02)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {[RA-05(02)_ODP[02]; the frequency for updating the system vulnerabilities to be scanned is defined (if selected)]; prior to a new scan; when new vulnerabilities are identified and reported}].'),\n('001064','draft','2009-09-21','DISA FSO','policy','Defines a frequency for updating the system vulnerabilities scanned.','RA-05(02)','N/A','Determine if the system vulnerabilities to be scanned are updated [RA-05(02)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {[RA-05(02)_ODP[02]; the frequency for updating the system vulnerabilities to be scanned is defined (if selected)]; prior to a new scan; when new vulnerabilities are identified and reported}].'),\n('001066','draft','2009-09-21','DISA FSO','policy','Determine information about the system that is discoverable.','RA-05(04)','N/A','Determine if: - information about the system is discoverable. - [RA-05(04)_ODP; corrective actions to be taken if information about the system is discoverable are defined] are taken when information about the system is confirmed as discoverable.'),\n('001067','draft','2009-09-21','DISA FSO','technical','Implement privileged access authorization to organization-identified system components for organization-defined vulnerability scanning activities.','RA-05(05)','N/A','Determine if privileged access authorization is implemented to [RA-05(05)_ODP[01]; system components to which privileged access is authorized for selected vulnerability scanning activities are defined] for [RA-05(05)_ODP[02]; vulnerability scanning activities selected for privileged access authorization to system components are defined].'),\n('001068','draft','2009-09-21','DISA FSO','policy','Compare the results of multiple vulnerability scans using organization-defined automated mechanisms.','RA-05(06)','N/A','Determine if the results of multiple vulnerability scans are compared using [RA-05(06)_ODP; automated mechanisms to compare the results of multiple vulnerability scans are defined].'),\n('001071','draft','2009-09-21','DISA FSO','policy','Review historic audit logs to determine if a vulnerability identified in the organization-defined system has been previously exploited within an organization-defined time period.','RA-05(08)','N/A','Determine if historic audit logs are reviewed to determine if a vulnerability identified in a [RA-05(08)_ODP[01]; a system whose historic audit logs are to be reviewed is defined] has been previously exploited within [RA-05(08)_ODP[02]; a time period for a potential previous exploit of a system is defined].'),\n('001075','draft','2009-09-21','DISA FSO','policy','Disseminates to organization-defined personnel or roles the organization-level; mission/business process-level; and/or system-level system and communications protection policy.','SC-01a.','N/A','Determine if: - a system and communications protection policy is developed and documented. - the system and communications protection policy is disseminated to [SC-01_ODP[01]; personnel or roles to whom the system and communications protection policy is to be disseminated is/are defined].'),\n('001076','draft','2009-09-21','DISA FSO','policy','Review and update the current system and communications protection policy in accordance with organization-defined frequency.','SC-01c.01','N/A','Determine if: - the current system and communications protection policy is reviewed and updated [SC-01_ODP[05]; the frequency at which the current system and communications protection policy is reviewed and updated is defined]. - the current system and communications protection policy is reviewed and updated following [SC-01_ODP[06]; events that would require the current system and communications protection policy to be reviewed and updated are defined].'),\n('001077','draft','2009-09-21','DISA FSO','policy','Defines the frequency for reviewing and updating the current system and communications protection policy.','SC-01c.01','N/A','Determine if: - the current system and communications protection policy is reviewed and updated [SC-01_ODP[05]; the frequency at which the current system and communications protection policy is reviewed and updated is defined]. - the current system and communications protection policy is reviewed and updated following [SC-01_ODP[06]; events that would require the current system and communications protection policy to be reviewed and updated are defined].'),\n('001079','draft','2009-09-21','DISA FSO','policy','Disseminates to organization-defined personnel or roles the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.','SC-01a.02','N/A','Determine if: - system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls are developed and documented. - the system and communications protection procedures are disseminated to [SC-01_ODP[02]; personnel or roles to whom the system and communications protection procedures are to be disseminated is/are defined].'),\n('001080','draft','2009-09-21','DISA FSO','policy','Review and update the current system and communications protection procedures in accordance with organization-defined frequency.','SC-01c.02','N/A','Determine if: - the current system and communications protection procedures are reviewed and updated [SC-01_ODP[07]; the frequency at which the current system and communications protection procedures are reviewed and updated is defined]. - the current system and communications protection procedures are reviewed and updated following [SC-01_ODP[08]; events that would require the system and communications protection procedures to be reviewed and updated are defined].'),\n('001081','draft','2009-09-21','DISA FSO','policy','Defines the frequency for reviewing and updating the current system and communications protection procedures.','SC-01c.02','N/A','Determine if: - the current system and communications protection procedures are reviewed and updated [SC-01_ODP[07]; the frequency at which the current system and communications protection procedures are reviewed and updated is defined]. - the current system and communications protection procedures are reviewed and updated following [SC-01_ODP[08]; events that would require the system and communications protection procedures to be reviewed and updated are defined].'),\n('001082','draft','2009-09-21','DISA FSO','technical','Separate user functionality, including user interface services, from system management functionality.','SC-02','N/A','Determine if user functionality, including user interface services, is separated from system management functionality.'),\n('001083','draft','2009-09-21','DISA FSO','technical','Prevent the presentation of system management functionality at an interface for non-privileged users.','SC-02(01)','N/A','Determine if the presentation of system management functionality is prevented at interfaces to non-privileged users.'),\n('001084','draft','2009-09-21','DISA FSO','technical','Isolate security functions from nonsecurity functions.','SC-03','N/A','Determine if security functions are isolated from non-security functions.'),\n('001085','draft','2009-09-21','DISA FSO','technical','Employ hardware separation mechanisms to implement security function isolation.','SC-03(01)','N/A','Determine if hardware separation mechanisms are employed to implement security function isolation.'),\n('001086','draft','2009-09-21','DISA FSO','technical','Isolate security functions enforcing access and information flow control from both nonsecurity functions and from other security functions.','SC-03(02)','N/A','Determine if: - security functions enforcing access control are isolated from non-security functions. - security functions enforcing access control are isolated from other security functions. - security functions enforcing information flow control are isolated from non-security functions. - security functions enforcing information flow control are isolated from other security functions.'),\n('001089','draft','2009-09-21','DISA FSO','technical','Implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.','SC-03(05)','N/A','Determine if security functions are implemented as a layered structure, minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.'),\n('001090','draft','2009-09-21','DISA FSO','technical','Prevent unauthorized and unintended information transfer via shared system resources.','SC-04','N/A','Determine if: - unauthorized information transfer via shared system resources is prevented. - unintended information transfer via shared system resources is prevented.'),\n('001093','draft','2009-09-21','DISA FSO','policy','Defines the types of denial-of-service events for protecting against or limiting the effects of the denial-of-service events.','SC-05a.','N/A','Determine if the effects of [SC-05_ODP[01]; types of denial-of-service events to be protected against or limited are defined] are [SC-05_ODP[02]; one of the following PARAMETER VALUES is selected: {protect against; limit}].'),\n('001094','draft','2009-09-21','DISA FSO','technical','Restrict the ability of individuals to launch organization-defined denial of service attacks against other systems.','SC-05(01)','N/A','Determine if the ability of individuals to launch [SC-05(01)_ODP; denial-of-service attacks for which to restrict the ability of individuals to launch are defined] against other systems is restricted.'),\n('001095','draft','2009-09-21','DISA FSO','technical','Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service attacks.','SC-05(02)','N/A','Determine if capacity, bandwidth, or other redundancies to limit the effects of information flooding denial-of-service attacks are managed.'),\n('001097','draft','2009-09-21','DISA FSO','policy','Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.','SC-07a.','N/A','Determine if: - communications at external managed interfaces to the system are monitored. - communications at external managed interfaces to the system are controlled. - communications at key internal managed interfaces within the system are monitored. - communications at key internal managed interfaces within the system are controlled.'),\n('001098','draft','2009-09-21','DISA FSO','policy','Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.','SC-07c.','N/A','Determine if external networks or systems are only connected to through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.'),\n('001101','draft','2009-09-21','DISA FSO','policy','Limit the number of external network connections to the system.','SC-07(03)','N/A','Determine if the number of external network connections to the system is limited.'),\n('001102','draft','2009-09-21','DISA FSO','policy','Implement a managed interface for each external telecommunication service.','SC-07(04)(a)','N/A','Determine if a managed interface is implemented for each external telecommunication service.'),\n('001103','draft','2009-09-21','DISA FSO','policy','Establish a traffic flow policy for each managed interface for each external telecommunication service.','SC-07(04)(b)','N/A','Determine if a traffic flow policy is established for each managed interface.'),\n('001105','draft','2009-09-21','DISA FSO','policy','Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need.','SC-07(04)(d)','N/A','Determine if each exception to the traffic flow policy is documented with a supporting mission or business need and duration of that need.'),\n('001106','draft','2009-09-21','DISA FSO','policy','Review exceptions to the traffic flow policy on an organization-defined frequency for each external telecommunication service.','SC-07(04)(e)','N/A','Determine if: - exceptions to the traffic flow policy are reviewed [SC-07(04)_ODP; the frequency at which to review exceptions to traffic flow policy is defined]. - exceptions to the traffic flow policy that are no longer supported by an explicit mission or business need are removed.'),\n('001107','draft','2009-09-21','DISA FSO','policy','Defines a frequency for the review of exceptions to the traffic flow policy for each external telecommunication service.','SC-07(04)(e)','N/A','Determine if: - exceptions to the traffic flow policy are reviewed [SC-07(04)_ODP; the frequency at which to review exceptions to traffic flow policy is defined]. - exceptions to the traffic flow policy that are no longer supported by an explicit mission or business need are removed.'),\n('001108','draft','2009-09-21','DISA FSO','policy','Remove traffic flow policy exceptions that are no longer supported by an explicit mission or business need for each external telecommunication service.','SC-07(04)(e)','N/A','Determine if: - exceptions to the traffic flow policy are reviewed [SC-07(04)_ODP; the frequency at which to review exceptions to traffic flow policy is defined]. - exceptions to the traffic flow policy that are no longer supported by an explicit mission or business need are removed.'),\n('001109','draft','2009-09-21','DISA FSO','technical','Deny network communications traffic by default and allow network communications traffic by exception at managed interfaces; and/or for organization-defined systems.','SC-07(05)','N/A','Determine if: - network communications traffic is denied by default [SC-07(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {at managed interfaces; for [SC-07(05)_ODP[02]; systems for which network communications traffic is denied by default and network communications traffic is allowed by exception are defined (if selected)]}]. - network communications traffic is allowed by exception [SC-07(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {at managed interfaces; for [SC-07(05)_ODP[02]; systems for which network communications traffic is denied by default and network communications traffic is allowed by exception are defined (if selected)]}].'),\n('001112','draft','2009-09-21','DISA FSO','policy','Route organization-defined internal communications traffic to organization-defined external networks through authenticated proxy servers at managed interfaces.','SC-07(08)','N/A','Determine if [SC-07(08)_ODP[01]; internal communications traffic to be routed to external networks is defined] is routed to [SC-07(08)_ODP[02]; external networks to which internal communications traffic is to be routed are defined] through authenticated proxy servers at managed interfaces.'),\n('001113','draft','2009-09-21','DISA FSO','policy','Defines the internal communications traffic to be routed to external networks.','SC-07(08)','N/A','Determine if [SC-07(08)_ODP[01]; internal communications traffic to be routed to external networks is defined] is routed to [SC-07(08)_ODP[02]; external networks to which internal communications traffic is to be routed are defined] through authenticated proxy servers at managed interfaces.'),\n('001114','draft','2009-09-21','DISA FSO','policy','Defines the external networks to which organization-defined internal communications traffic should be routed.','SC-07(08)','N/A','Determine if [SC-07(08)_ODP[01]; internal communications traffic to be routed to external networks is defined] is routed to [SC-07(08)_ODP[02]; external networks to which internal communications traffic is to be routed are defined] through authenticated proxy servers at managed interfaces.'),\n('001116','draft','2009-09-21','DISA FSO','policy','Prevent the exfiltration of information.','SC-07(10)(a)','N/A','Determine if the exfiltration of information is prevented.'),\n('001119','draft','2009-09-21','DISA FSO','policy','Isolate organization-defined information security tools, mechanisms, and support components from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.','SC-07(13)','N/A','Determine if [SC-07(13)_ODP; information security tools, mechanisms, and support components to be isolated from other internal system components are defined] are isolated from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.'),\n('001120','draft','2009-09-21','DISA FSO','policy','Defines the information security tools, mechanisms, and support components to be isolated.','SC-07(13)','N/A','Determine if [SC-07(13)_ODP; information security tools, mechanisms, and support components to be isolated from other internal system components are defined] are isolated from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.'),\n('001121','draft','2009-09-21','DISA FSO','policy','Protect against unauthorized physical connections at organization-defined managed interfaces.','SC-07(14)','N/A','Determine if [SC-07(14)_ODP; managed interfaces to be protected against unauthorized physical connections are defined] are protected against unauthorized physical connections.'),\n('001123','draft','2009-09-21','DISA FSO','policy','Route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.','SC-07(15)','N/A','Determine if: - networked, privileged accesses are routed through a dedicated, managed interface for purposes of access control. - networked, privileged accesses are routed through a dedicated, managed interface for purposes of auditing.'),\n('001124','draft','2009-09-21','DISA FSO','technical','Prevent discovery of specific system components that represent a managed interface.','SC-07(16)','N/A','Determine if the discovery of specific system components that represent a managed interface is prevented.'),\n('001125','draft','2009-09-21','DISA FSO','technical','Enforce adherence to protocol formats.','SC-07(17)','N/A','Determine if adherence to protocol formats is enforced.'),\n('001126','draft','2009-09-21','DISA FSO','technical','Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device.','SC-07(18)','N/A','Determine if systems are prevented from entering unsecure states in the event of an operational failure of a boundary protection device.'),\n('001133','draft','2009-09-21','DISA FSO','technical','Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.','SC-10','N/A','Determine if the network connection associated with a communication session is terminated at the end of the session or after [SC-10_ODP; a time period of inactivity after which the system terminates a network connection associated with a communication session is defined] of inactivity.'),\n('001134','draft','2009-09-21','DISA FSO','policy','Defines the time period of inactivity after which the system terminates a network connection associated with a communications session.','SC-10','N/A','Determine if the network connection associated with a communication session is terminated at the end of the session or after [SC-10_ODP; a time period of inactivity after which the system terminates a network connection associated with a communication session is defined] of inactivity.'),\n('001135','draft','2009-09-21','DISA FSO','policy','Provide a physically or logically isolated trusted communication path for communication between the user and the trusted components of the system.','SC-11a.','N/A','Determine if a [SC-11_ODP[01]; one of the following PARAMETER VALUES is selected: {physically; logically}] isolated trusted communication path is provided for communications between the user and the trusted components of the system.'),\n('001139','draft','2009-09-21','DISA FSO','policy','Maintain availability of information in the event of the loss of cryptographic keys by users.','SC-12(01)','N/A','Determine if information availability is maintained in the event of the loss of cryptographic keys by users.'),\n('001150','draft','2009-09-21','DISA FSO','technical','Prohibit remote activation of collaborative computing devices and applications, excluding the organization-defined exceptions where remote activation is to be allowed.','SC-15a.','N/A','Determine if remote activation of collaborative computing devices and applications is prohibited except [SC-15_ODP; exceptions where remote activation is to be allowed are defined].'),\n('001151','draft','2009-09-21','DISA FSO','policy','Defines exceptions to the prohibition of collaborative computing devices where remote activation is to be allowed.','SC-15a.','N/A','Determine if remote activation of collaborative computing devices and applications is prohibited except [SC-15_ODP; exceptions where remote activation is to be allowed are defined].'),\n('001152','draft','2009-09-21','DISA FSO','technical','Provide an explicit indication of use to users physically present at collaborative computing devices.','SC-15b.','N/A','Determine if an explicit indication of use is provided to users physically present at the devices.'),\n('001153','draft','2009-09-21','DISA FSO','technical','Provide physical or logical disconnect of collaborative computing devices in a manner that supports ease of use.','SC-15(01)','N/A','Determine if the [SC-15(01)_ODP; one or more of the following PARAMETER VALUES is/are selected: {physical; logical}] disconnect of collaborative computing devices is/are provided in a manner that supports ease of use.'),\n('001155','draft','2009-09-21','DISA FSO','policy','Disable or remove collaborative computing devices and applications from organization-defined systems or system components in organization-defined secure work areas.','SC-15(03)','N/A','Determine if collaborative computing devices and applications are disabled or removed from [SC-15(03)_ODP[01]; systems or system components from which collaborative computing devices are to be disabled or removed are defined] in [SC-15(03)_ODP[02]; secure work areas where collaborative computing devices are to be disabled or removed from systems or system components are defined].'),\n('001156','draft','2009-09-21','DISA FSO','policy','Defines secure work areas where collaborative computing devices and applications are to be disabled or removed.','SC-15(03)','N/A','Determine if collaborative computing devices and applications are disabled or removed from [SC-15(03)_ODP[01]; systems or system components from which collaborative computing devices are to be disabled or removed are defined] in [SC-15(03)_ODP[02]; secure work areas where collaborative computing devices are to be disabled or removed from systems or system components are defined].'),\n('001157','draft','2009-09-21','DISA FSO','policy','Associate organization-defined security attributes with information exchanged between systems.','SC-16','N/A','Determine if: - [SC-16_ODP[01]; security attributes to be associated with information exchanged are defined] are associated with information exchanged between systems. - [SC-16_ODP[01]; security attributes to be associated with information exchanged are defined] are associated with information exchanged between system components. - [SC-16_ODP[02]; privacy attributes to be associated with information exchanged are defined] are associated with information exchanged between systems. - [SC-16_ODP[02]; privacy attributes to be associated with information exchanged are defined] are associated with information exchanged between system components.'),\n('001158','draft','2009-09-21','DISA FSO','technical','Verify the integrity of transmitted security attributes.','SC-16(01)','N/A','Determine if: - the integrity of transmitted security attributes is verified. - the integrity of transmitted privacy attributes is verified.'),\n('001159','draft','2009-09-21','DISA FSO','policy','Issue public key certificates under an organization-defined certificate policy or obtain public key certificates from an approved service provider.','SC-17a.','N/A','Determine if public key certificates are issued under [SC-17_ODP; a certificate policy for issuing public key certificates is defined], or public key certificates are obtained from an approved service provider.'),\n('001160','draft','2009-09-21','DISA FSO','policy','Defines acceptable and unacceptable mobile code and mobile code technologies.','SC-18a.','N/A','Determine if: - acceptable mobile code is defined. - unacceptable mobile code is defined. - acceptable mobile code technologies are defined. - unacceptable mobile code technologies are defined.'),\n('001163','draft','2009-09-21','DISA FSO','policy','Authorize the use of mobile code within the system.','SC-18b.','N/A','Determine if: - the use of mobile code is authorized within the system. - the use of mobile code is monitored within the system. - the use of mobile code is controlled within the system.'),\n('001164','draft','2009-09-21','DISA FSO','policy','Monitor the use of mobile code within the system.','SC-18b.','N/A','Determine if: - the use of mobile code is authorized within the system. - the use of mobile code is monitored within the system. - the use of mobile code is controlled within the system.'),\n('001165','draft','2009-09-21','DISA FSO','policy','Control the use of mobile code within the system.','SC-18b.','N/A','Determine if: - the use of mobile code is authorized within the system. - the use of mobile code is monitored within the system. - the use of mobile code is controlled within the system.'),\n('001166','draft','2009-09-21','DISA FSO','technical','Identify organization-defined unacceptable mobile code.','SC-18(01)','N/A','Determine if: - [SC-18(01)_ODP[01]; unacceptable mobile code to be identified is defined] is identified. - [SC-18(01)_ODP[02]; corrective actions to be taken when unacceptable mobile code is identified are defined] are taken if unacceptable mobile code is identified.'),\n('001167','draft','2009-09-21','DISA FSO','policy','Verify that the development of mobile code to be deployed in information systems meets organization-defined mobile code requirements.','SC-18(02)','N/A','Determine if: - the acquisition of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined]. - the development of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined]. - the use of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined].'),\n('001168','draft','2009-09-21','DISA FSO','policy','Defines mobile code requirements for the acquisition, development, and use of mobile code.','SC-18(02)','N/A','Determine if: - the acquisition of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined]. - the development of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined]. - the use of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined].'),\n('001169','draft','2009-09-21','DISA FSO','technical','Prevent the download of organization-defined unacceptable mobile code.','SC-18(03)','N/A','Determine if: - the download of [SC-18(03)_ODP; unacceptable mobile code to be prevented from downloading and executing is defined] is prevented. - the execution of [SC-18(03)_ODP; unacceptable mobile code to be prevented from downloading and executing is defined] is prevented.'),\n('001170','draft','2009-09-21','DISA FSO','technical','Prevents the automatic execution of mobile code in organization-defined software applications.','SC-18(04)','N/A','Determine if: - the automatic execution of mobile code in [SC-18(04)_ODP[01]; software applications in which the automatic execution of mobile code is to be prevented are defined] is prevented. - [SC-18(04)_ODP[02]; actions to be enforced by the system prior to executing mobile code are defined] are enforced prior to executing mobile code.'),\n('001171','draft','2009-09-21','DISA FSO','policy','Defines software applications in which automatic mobile code execution is to be prohibited.','SC-18(04)','N/A','Determine if: - the automatic execution of mobile code in [SC-18(04)_ODP[01]; software applications in which the automatic execution of mobile code is to be prevented are defined] is prevented. - [SC-18(04)_ODP[02]; actions to be enforced by the system prior to executing mobile code are defined] are enforced prior to executing mobile code.'),\n('001172','draft','2009-09-21','DISA FSO','policy','Defines actions to be enforced before executing mobile code.','SC-18(04)','N/A','Determine if: - the automatic execution of mobile code in [SC-18(04)_ODP[01]; software applications in which the automatic execution of mobile code is to be prevented are defined] is prevented. - [SC-18(04)_ODP[02]; actions to be enforced by the system prior to executing mobile code are defined] are enforced prior to executing mobile code.'),\n('001178','draft','2009-09-21','DISA FSO','technical','Provide additional data origin authentication artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.','SC-20a.','N/A','Determine if: - additional data origin authentication is provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries. - integrity verification artifacts are provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries.'),\n('001179','draft','2009-09-21','DISA FSO','technical','Provides the means to indicate the security status of child zones, when operating as part of a distributed, hierarchical namespace.','SC-20b.','N/A','Determine if: - the means to indicate the security status of child zones (and if the child supports secure resolution services) is provided when operating as part of a distributed, hierarchical namespace. - the means to enable verification of a chain of trust among parent and child domains when operating as part of a distributed, hierarchical namespace is provided.'),\n('001182','draft','2009-09-21','DISA FSO','policy','Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant.','SC-22','N/A','Determine if: - the systems that collectively provide name/address resolution services for an organization are fault-tolerant. - the systems that collectively provide name/address resolution services for an organization implement internal role separation.  - the systems that collectively provide name/address resolution services for an organization implement external role separation.'),\n('001183','draft','2009-09-21','DISA FSO','policy','Ensure the systems that collectively provide name/address resolution service for an organization implement internal/external role separation.','SC-22','N/A','Determine if: - the systems that collectively provide name/address resolution services for an organization are fault-tolerant. - the systems that collectively provide name/address resolution services for an organization implement internal role separation.  - the systems that collectively provide name/address resolution services for an organization implement external role separation.'),\n('001184','draft','2009-09-21','DISA FSO','technical','Protect the authenticity of communications sessions.','SC-23','N/A','Determine if the authenticity of communication sessions is protected.'),\n('001185','draft','2009-09-21','DISA FSO','technical','Invalidate session identifiers upon user logout or other session termination.','SC-23(01)','N/A','Determine if session identifiers are invalidated upon user logout or other session termination.'),\n('001188','draft','2009-09-21','DISA FSO','technical','Generate a unique session identifier for each session with organization-defined randomness requirements.','SC-23(03)','N/A','Determine if: - a unique session identifier is generated for each session with [SC-23(03)_ODP; randomness requirements for generating a unique session identifier for each session are defined]. - only system-generated session identifiers are recognized.'),\n('001189','draft','2009-09-21','DISA FSO','policy','Defines randomness requirements for generating unique session identifiers.','SC-23(03)','N/A','Determine if: - a unique session identifier is generated for each session with [SC-23(03)_ODP; randomness requirements for generating a unique session identifier for each session are defined]. - only system-generated session identifiers are recognized.'),\n('001190','draft','2009-09-21','DISA FSO','technical','Fail to an organization-defined known-system state for the list of organization-defined types of system failures on organization-defined system components on the indicated components while preserving organization-defined system state information in failure.','SC-24','N/A','Determine if [SC-24_ODP[01]; types of system failures for which the system components fail to a known state are defined] fail to a [SC-24_ODP[02]; known system state to which system components fail in the event of a system failure is defined] while preserving [SC-24_ODP[03]; system state information to be preserved in the event of a system failure is defined] in failure.'),\n('001191','draft','2009-09-21','DISA FSO','policy','Defines the known system state the system should fail to in the event of an organization-defined system failure.','SC-24','N/A','Determine if [SC-24_ODP[01]; types of system failures for which the system components fail to a known state are defined] fail to a [SC-24_ODP[02]; known system state to which system components fail in the event of a system failure is defined] while preserving [SC-24_ODP[03]; system state information to be preserved in the event of a system failure is defined] in failure.'),\n('001192','draft','2009-09-21','DISA FSO','policy','Defines types of system failures for which should fail to an organization-defined known system state.','SC-24','N/A','Determine if [SC-24_ODP[01]; types of system failures for which the system components fail to a known state are defined] fail to a [SC-24_ODP[02]; known system state to which system components fail in the event of a system failure is defined] while preserving [SC-24_ODP[03]; system state information to be preserved in the event of a system failure is defined] in failure.'),\n('001193','draft','2009-09-21','DISA FSO','policy','Defines system state information that should be preserved in the event of a system failure.','SC-24','N/A','Determine if [SC-24_ODP[01]; types of system failures for which the system components fail to a known state are defined] fail to a [SC-24_ODP[02]; known system state to which system components fail in the event of a system failure is defined] while preserving [SC-24_ODP[03]; system state information to be preserved in the event of a system failure is defined] in failure.'),\n('001194','draft','2009-09-21','DISA FSO','policy','Employ minimal functionality and information storage on organization-defined information system components.','SC-25','N/A','Determine if: - minimal functionality for [SC-25_ODP; system components to be employed with minimal functionality and information storage are defined] is employed. - minimal information storage on [SC-25_ODP; system components to be employed with minimal functionality and information storage are defined] is allocated.'),\n('001195','draft','2009-09-21','DISA FSO','policy','Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.','SC-26','N/A','Determine if: - components within organizational systems specifically designed to be the target of malicious attacks are included to detect such attacks. - components within organizational systems specifically designed to be the target of malicious attacks are included to deflect such attacks. - components within organizational systems specifically designed to be the target of malicious attacks are included to analyze such attacks.'),\n('001196','draft','2009-09-21','DISA FSO','policy','Include system components that proactively seek to identify network-based malicious code or malicious websites.','SC-35','N/A','Determine if system components that proactively seek to identify network-based malicious code or malicious websites are included.'),\n('001197','draft','2009-09-21','DISA FSO','policy','Include within organizational systems organization-defined platform-independent applications.','SC-27','N/A','Determine if [SC-27_ODP; platform-independent applications to be included within organizational systems are defined] are included within organizational systems.'),\n('001198','draft','2009-09-21','DISA FSO','policy','Defines applications that are platform independent.','SC-27','N/A','Determine if [SC-27_ODP; platform-independent applications to be included within organizational systems are defined] are included within organizational systems.'),\n('001199','draft','2009-09-21','DISA FSO','technical','Protects the confidentiality and/or integrity of organization-defined information at rest.','SC-28','N/A','Determine if the [SC-28_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {confidentiality; integrity}] of [SC-28_ODP[02]; information at rest requiring protection is defined] is/are protected.'),\n('001201','draft','2009-09-21','DISA FSO','policy','Employ a diverse set of information technologies for organization-defined system components in the implementation of the system.','SC-29','N/A','Determine if a diverse set of information technologies is employed for [SC-29_ODP; system components requiring a diverse set of information technologies to be employed in the implementation of the system are defined] in the implementation of the system.'),\n('001203','draft','2009-09-21','DISA FSO','policy','Employ virtualization techniques to support the deployment of a diversity of operating systems that are changed on an organization-defined frequency.','SC-29(01)','N/A','Determine if virtualization techniques are employed to support the deployment of a diverse range of operating systems and applications that are changed [SC-29(01)_ODP; the frequency at which to change the diversity of operating systems and applications deployed using virtualization techniques is defined].'),\n('001204','draft','2009-09-21','DISA FSO','policy','Defines the frequency of changes to operating systems and applications to support a diversity of deployments.','SC-29(01)','N/A','Determine if virtualization techniques are employed to support the deployment of a diverse range of operating systems and applications that are changed [SC-29(01)_ODP; the frequency at which to change the diversity of operating systems and applications deployed using virtualization techniques is defined].'),\n('001207','draft','2009-09-21','DISA FSO','policy','Test a subset of the identified covert channels to determine which channels are exploitable.','SC-31(01)','N/A','Determine if a subset of the identified covert channels is tested to determine the channels that are exploitable.'),\n('001210','draft','2009-09-21','DISA FSO','technical','For organization-defined system components, load and execute the operating environment from hardware-enforced, read-only media.','SC-34a.','N/A','Determine if the operating environment for [SC-34_ODP[01]; system components for which the operating environment and applications are to be loaded and executed from hardware-enforced, read-only media are defined] is loaded and executed from hardware-enforced, read-only media.'),\n('001211','draft','2009-09-21','DISA FSO','technical','For organization-defined system components, load and execute organization-defined applications from hardware-enforced, read-only media.','SC-34b.','N/A','Determine if [SC-34_ODP[02]; applications to be loaded and executed from hardware-enforced, read-only media are defined] for [SC-34_ODP[01]; system components for which the operating environment and applications are to be loaded and executed from hardware-enforced, read-only media are defined] are loaded and executed from hardware-enforced, read-only media.'),\n('001212','draft','2009-09-21','DISA FSO','policy','Defines system components on which the operating environment and organization-defined applications are loaded and executed from hardware-enforced, read-only media.',NULL,'N/A',NULL),\n('001213','draft','2009-09-21','DISA FSO','policy','Defines applications that will be loaded and executed from hardware-enforced, read-only media.','SC-34b.','N/A','Determine if [SC-34_ODP[02]; applications to be loaded and executed from hardware-enforced, read-only media are defined] for [SC-34_ODP[01]; system components for which the operating environment and applications are to be loaded and executed from hardware-enforced, read-only media are defined] are loaded and executed from hardware-enforced, read-only media.'),\n('001214','draft','2009-09-21','DISA FSO','policy','Employ organization-defined system components with no writeable storage that is persistent across component restart or power on/off.','SC-34(01)','N/A','Determine if [SC-34(01)_ODP; system components to be employed with no writeable storage are defined] are employed with no writeable storage that is persistent across component restart or power on/off.'),\n('001215','draft','2009-09-21','DISA FSO','policy','Defines the system components to be employed with no writeable storage.','SC-34(01)','N/A','Determine if [SC-34(01)_ODP; system components to be employed with no writeable storage are defined] are employed with no writeable storage that is persistent across component restart or power on/off.'),\n('001216','draft','2009-09-21','DISA FSO','policy','Protect the integrity of information prior to storage on read-only media.','SC-34(02)','N/A','Determine if: - the integrity of information is protected prior to storage on read-only media. - the media is controlled after such information has been recorded onto the media.'),\n('001217','draft','2009-09-22','DISA FSO','policy','Develop and document an organization-level; mission/business process-level; and/or system level system and information integrity policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','SC-34(02)','N/A','Determine if: - the integrity of information is protected prior to storage on read-only media. - the media is controlled after such information has been recorded onto the media.'),\n('001218','draft','2009-09-22','DISA FSO','policy','Disseminate an organization-level; mission/business process-level; and/or system level system and information integrity policy to organization-defined personnel or roles.','SI-01a.','N/A','Determine if: - a system and information integrity policy is developed and documented. - the system and information integrity policy is disseminated to [SI-01_ODP[01]; personnel or roles to whom the system and information integrity policy is to be disseminated is/are defined].'),\n('001219','draft','2009-09-22','DISA FSO','policy','Review and update the current system and information integrity policy in accordance with organization-defined frequency.','SI-01c.01','N/A','Determine if: - the current system and information integrity policy is reviewed and updated [SI-01_ODP[05]; the frequency at which the current system and information integrity policy is reviewed and updated is defined]. - the current system and information integrity policy is reviewed and updated following [SI-01_ODP[06]; events that would require the current system and information integrity policy to be reviewed and updated are defined].'),\n('001220','draft','2009-09-22','DISA FSO','policy','Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system level system and information integrity policy and associated system integrity controls.','SI-01a.02','N/A','Determine if: - system and information integrity procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls are developed and documented. - the system and information integrity procedures are disseminated to [SI-01_ODP[02]; personnel or roles to whom the system and information integrity procedures are to be disseminated is/are defined].'),\n('001221','draft','2009-09-22','DISA FSO','policy','Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls.','SI-01a.02','N/A','Determine if: - system and information integrity procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls are developed and documented. - the system and information integrity procedures are disseminated to [SI-01_ODP[02]; personnel or roles to whom the system and information integrity procedures are to be disseminated is/are defined].'),\n('001222','draft','2009-09-22','DISA FSO','policy','Review and update the current system and information integrity procedures in accordance with organization-defined frequency.','SI-01c.02','N/A','Determine if: - the current system and information integrity procedures are reviewed and updated [SI-01_ODP[07]; the frequency at which the current system and information integrity procedures are reviewed and updated is defined]. - the current system and information integrity procedures are reviewed and updated following [SI-01_ODP[08]; events that would require the system and information integrity procedures to be reviewed and updated are defined].'),\n('001223','draft','2009-09-22','DISA FSO','policy','Defines the frequency for reviewing and updating the current system and information integrity policy.','SI-01c.01','N/A','Determine if: - the current system and information integrity policy is reviewed and updated [SI-01_ODP[05]; the frequency at which the current system and information integrity policy is reviewed and updated is defined]. - the current system and information integrity policy is reviewed and updated following [SI-01_ODP[06]; events that would require the current system and information integrity policy to be reviewed and updated are defined].'),\n('001224','draft','2009-09-22','DISA FSO','policy','Defines the frequency for reviewing and updating the current system and information integrity procedures.','SI-01c.02','N/A','Determine if: - the current system and information integrity procedures are reviewed and updated [SI-01_ODP[07]; the frequency at which the current system and information integrity procedures are reviewed and updated is defined]. - the current system and information integrity procedures are reviewed and updated following [SI-01_ODP[08]; events that would require the system and information integrity procedures to be reviewed and updated are defined].'),\n('001225','draft','2009-09-22','DISA FSO','policy','Identify system flaws.','SI-02a.','N/A','Determine if: - system flaws are identified. - system flaws are reported.  - system flaws are corrected.'),\n('001226','draft','2009-09-22','DISA FSO','policy','Report system flaws.','SI-02a.','N/A','Determine if: - system flaws are identified. - system flaws are reported.  - system flaws are corrected.'),\n('001227','draft','2009-09-22','DISA FSO','policy','Correct system flaws.','SI-02a.','N/A','Determine if: - system flaws are identified. - system flaws are reported.  - system flaws are corrected.'),\n('001228','draft','2009-09-22','DISA FSO','policy','Test software updates related to flaw remediation for effectiveness before installation.','SI-02b.','N/A','Determine if: - software updates related to flaw remediation are tested for effectiveness before installation. - software updates related to flaw remediation are tested for potential side effects before installation. - firmware updates related to flaw remediation are tested for effectiveness before installation. - firmware updates related to flaw remediation are tested for potential side effects before installation.'),\n('001229','draft','2009-09-22','DISA FSO','policy','Test software updates related to flaw remediation for potential side effects before installation.','SI-02b.','N/A','Determine if: - software updates related to flaw remediation are tested for effectiveness before installation. - software updates related to flaw remediation are tested for potential side effects before installation. - firmware updates related to flaw remediation are tested for effectiveness before installation. - firmware updates related to flaw remediation are tested for potential side effects before installation.'),\n('001230','draft','2009-09-22','DISA FSO','policy','Incorporate flaw remediation into the organizational configuration management process.','SI-02d.','N/A','Determine if flaw remediation is incorporated into the organizational configuration management process.'),\n('001235','draft','2009-09-22','DISA FSO','policy','Measure the time between flaw identification and flaw remediation.','SI-02(03)(a)','N/A','Determine if the time between flaw identification and flaw remediation is measured.'),\n('001236','draft','2009-09-22','DISA FSO','policy','Defines benchmarks for the time taken to apply corrective actions after flaw identification.','SI-02(03)(b)','N/A','Determine if [SI-02(03)_ODP; the benchmarks for taking corrective actions are defined] for taking corrective actions have been established.'),\n('001241','draft','2009-09-22','DISA FSO','technical','Configure malicious code protection mechanisms to perform periodic scans of the system on an organization-defined frequency.','SI-03c.01','N/A','Determine if: - malicious code protection mechanisms are configured to perform periodic scans of the system [SI-03_ODP[02]; the frequency at which malicious code protection mechanisms perform scans is defined]. - malicious code protection mechanisms are configured to perform real-time scans of files from external sources at [SI-03_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {endpoint; network entry and exit points}] as the files are downloaded, opened, or executed in accordance with organizational policy.'),\n('001243','draft','2009-09-22','DISA FSO','technical','Configure malicious code protection mechanisms to block malicious code; quarantine malicious code; and/or take organization-defined action(s) in response to malicious code detection.','SI-03c.02','N/A','Determine if: - malicious code protection mechanisms are configured to [SI-03_ODP[04]; one or more of the following PARAMETER VALUES is/are selected: {block malicious code; quarantine malicious code; take [SI-03_ODP[05]; action to be taken in response to malicious code detection are defined (if selected)}] in response to malicious code detection. - malicious code protection mechanisms are configured to send alerts to [SI-03_ODP[06]; personnel or roles to be alerted when malicious code is detected is/are defined] in response to malicious code detection.'),\n('001244','draft','2009-09-22','DISA FSO','policy','Defines one or more actions to perform in response to malicious code detection, such as blocking malicious code, quarantining malicious code, or sending alerts to administrators.','SI-03c.02','N/A','Determine if: - malicious code protection mechanisms are configured to [SI-03_ODP[04]; one or more of the following PARAMETER VALUES is/are selected: {block malicious code; quarantine malicious code; take [SI-03_ODP[05]; action to be taken in response to malicious code detection are defined (if selected)}] in response to malicious code detection. - malicious code protection mechanisms are configured to send alerts to [SI-03_ODP[06]; personnel or roles to be alerted when malicious code is detected is/are defined] in response to malicious code detection.'),\n('001245','draft','2009-09-22','DISA FSO','policy','Address the receipt of false positives during malicious code detection and eradication, and the resulting potential impact on the availability of the system.','SI-03d.','N/A','Determine if the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system are addressed.'),\n('001249','draft','2009-09-22','DISA FSO','technical','Update malicious code protection mechanisms only when directed by a privileged user.','SI-03(04)','N/A','Determine if malicious code protection mechanisms are updated only when directed by a privileged user.'),\n('001251','draft','2009-09-22','DISA FSO','policy','Test malicious code protection mechanisms on an organization-defined frequency by introducing a known benign code into the system.','SI-03(06)(a)','N/A','Determine if malicious code protection mechanisms are tested [SI-03(06)_ODP; the frequency at which to test malicious code protection mechanisms is defined] by introducing known benign code into the system.'),\n('001253','draft','2009-09-22','DISA FSO','policy','Defines the objectives of monitoring for attacks and indicators of potential attacks on the system.','SI-04a.01','N/A','Determine if the system is monitored to detect attacks and indicators of potential attacks in accordance with [SI-04_ODP[01]; monitoring objectives to detect attacks and indicators of potential attacks on the system are defined].'),\n('001255','draft','2009-09-22','DISA FSO','policy','Invoke internal monitoring capabilities or deploy monitoring devices strategically within the system to collect organization-determined essential information.','SI-04c.01','N/A','Determine if internal monitoring capabilities are invoked or monitoring devices are deployed strategically within the system to collect organization-determined essential information.'),\n('001256','draft','2009-09-22','DISA FSO','policy','Invoke internal monitoring capabilities or deploy monitoring devices at ad hoc locations within the system to track specific types of transactions of interest to the organization.','SI-04c.02','N/A','Determine if internal monitoring capabilities are invoked or monitoring devices are deployed at ad hoc locations within the system to track specific types of transactions of interest to the organization.'),\n('001257','draft','2009-09-22','DISA FSO','policy','Adjust the level of system monitoring activity when there is a change in increased risk to organizational operations and assets, individuals, other organizations, or the Nation.','SI-04e.','N/A','Determine if the level of system monitoring activity is adjusted when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation.'),\n('001258','draft','2009-09-22','DISA FSO','policy','Obtain legal opinion with regard to system monitoring activities.','SI-04f.','N/A','Determine if a legal opinion regarding system monitoring activities is obtained.'),\n('001260','draft','2009-09-22','DISA FSO','policy','Employ automated tools to support near real-time analysis of events.','SI-04(02)','N/A','Determine if automated tools and mechanisms are employed to support a near real-time analysis of events.'),\n('001264','draft','2009-09-22','DISA FSO','policy','Defines the indicators of compromise or potential compromise which will result in system alerts being provided to organization-defined personnel or roles.','SI-04(05)','N/A','Determine if [SI-04(05)_ODP[01]; personnel or roles to be alerted when indications of compromise or potential compromise occur is/are defined] are alerted when system-generated [SI-04(05)_ODP[02]; compromise indicators are defined] occur.'),\n('001266','draft','2009-09-22','DISA FSO','technical','Notify an organization-defined incident response personnel (identified by name and/or by role) of detected suspicious events.','SI-04(07)(a)','N/A','Determine if [SI-04(07)_ODP[01]; incident response personnel (identified by name and/or by role) to be notified of detected suspicious events is/are defined] are notified of detected suspicious events.'),\n('001267','draft','2009-09-22','DISA FSO','policy','Defines incident response personnel (identified by name and/or by role) to be notified of detected suspicious events.','SI-04(07)(a)','N/A','Determine if [SI-04(07)_ODP[01]; incident response personnel (identified by name and/or by role) to be notified of detected suspicious events is/are defined] are notified of detected suspicious events.'),\n('001268','draft','2009-09-22','DISA FSO','policy','Defines the least-disruptive actions to be taken by system to terminate suspicious events.','SI-04(07)(b)','N/A','Determine if [SI-04(07)_ODP[02]; least-disruptive actions to terminate suspicious events are defined] are taken upon the detection of suspicious events.'),\n('001270','draft','2009-09-22','DISA FSO','policy','Test intrusion monitoring tools at an organization-defined frequency.','SI-04(09)','N/A','Determine if intrusion-monitoring tools and mechanisms are tested [SI-04(09)_ODP; a frequency at which to test intrusion-monitoring tools and mechanisms is defined].'),\n('001271','draft','2009-09-22','DISA FSO','policy','Defines the frequency for testing intrusion monitoring tools.','SI-04(09)','N/A','Determine if intrusion-monitoring tools and mechanisms are tested [SI-04(09)_ODP; a frequency at which to test intrusion-monitoring tools and mechanisms is defined].'),\n('001273','draft','2009-09-22','DISA FSO','policy','Analyze outbound communications traffic at the external interfaces to the system to discover anomalies.','SI-04(11)','N/A','Determine if: - outbound communications traffic at the external interfaces to the system is analyzed to discover anomalies. - outbound communications traffic at [SI-04(11)_ODP; interior points within the system where communications traffic is to be analyzed are defined] is analyzed to discover anomalies. '),\n('001274','draft','2009-09-22','DISA FSO','policy','Alert organization-defined personnel or roles using organization-defined automated mechanisms when inappropriate or unusual activities with security or privacy implications.','SI-04(12)','N/A','Determine if [SI-04(12)_ODP[01]; personnel or roles to be alerted when indications of inappropriate or unusual activity with security or privacy implications occur is/are defined] is/are alerted using [SI-04(12)_ODP[02]; automated mechanisms used to alert personnel or roles are defined] when [SI-04(12)_ODP[03]; activities that trigger alerts to personnel or are defined] indicate inappropriate or unusual activities with security or privacy implications.'),\n('001275','draft','2009-09-22','DISA FSO','policy','Defines the activities which will trigger alerts to security personnel of inappropriate or unusual activities.','SI-04(12)','N/A','Determine if [SI-04(12)_ODP[01]; personnel or roles to be alerted when indications of inappropriate or unusual activity with security or privacy implications occur is/are defined] is/are alerted using [SI-04(12)_ODP[02]; automated mechanisms used to alert personnel or roles are defined] when [SI-04(12)_ODP[03]; activities that trigger alerts to personnel or are defined] indicate inappropriate or unusual activities with security or privacy implications.'),\n('001276','draft','2009-09-22','DISA FSO','policy','Analyze communications traffic and event patterns for the system.','SI-04(13)(a)','N/A','Determine if: - communications traffic for the system is analyzed. - event patterns for the system are analyzed.'),\n('001277','draft','2009-09-22','DISA FSO','policy','Develop profiles representing common traffic and event patterns.','SI-04(13)(b)','N/A','Determine if: - profiles representing common traffic are developed. - profiles representing event patterns are developed.'),\n('001282','draft','2009-09-22','DISA FSO','policy','Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.','SI-04(15)','N/A','Determine if an intrusion detection system is employed to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.'),\n('001283','draft','2009-09-22','DISA FSO','policy','Correlate information from monitoring tools employed throughout the system.','SI-04(16)','N/A','Determine if information from monitoring tools and mechanisms employed throughout the system is correlated.'),\n('001284','draft','2009-09-22','DISA FSO','policy','Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.','SI-04(17)','N/A','Determine if information from monitoring physical, cyber, and supply chain activities are correlated to achieve integrated, organization-wide situational awareness.'),\n('001285','draft','2009-09-22','DISA FSO','policy','Receive system security alerts, advisories, and directives from organization-defined external organizations on an ongoing basis.','SI-05a.','N/A','Determine if system security alerts, advisories, and directives are received from [SI-05_ODP[01]; external organizations from whom system security alerts, advisories, and directives are to be received on an ongoing basis are defined] on an ongoing basis.'),\n('001286','draft','2009-09-22','DISA FSO','policy','Generate internal security alerts, advisories, and directives as deemed necessary.','SI-05b.','N/A','Determine if internal security alerts, advisories, and directives are generated as deemed necessary.'),\n('001287','draft','2009-09-22','DISA FSO','policy','Disseminate security alerts, advisories, and directives to organization-defined personnel or roles, organization-defined elements within the organization, and/or organization-defined external organizations.','SI-05c.','N/A','Determine if security alerts, advisories, and directives are disseminated to [SI-05_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[SI-05_ODP[03]; personnel or roles to whom security alerts, advisories, and directives are to be disseminated is/are defined (if selected)]; [SI-05_ODP[04]; elements within the organization to whom security alerts, advisories, and directives are to be disseminated are defined (if selected)]; [SI-05_ODP[05]; external organizations to whom security alerts, advisories, and directives are to be disseminated are defined (if selected)]}].'),\n('001288','draft','2009-09-22','DISA FSO','policy','Defines the personnel or roles to whom the organization will disseminate security alerts, advisories, and directives.','SI-05c.','N/A','Determine if security alerts, advisories, and directives are disseminated to [SI-05_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[SI-05_ODP[03]; personnel or roles to whom security alerts, advisories, and directives are to be disseminated is/are defined (if selected)]; [SI-05_ODP[04]; elements within the organization to whom security alerts, advisories, and directives are to be disseminated are defined (if selected)]; [SI-05_ODP[05]; external organizations to whom security alerts, advisories, and directives are to be disseminated are defined (if selected)]}].'),\n('001289','draft','2009-09-22','DISA FSO','policy','Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.','SI-05d.','N/A','Determine if security directives are implemented in accordance with established time frames or if the issuing organization is notified of the degree of noncompliance.'),\n('001290','draft','2009-09-22','DISA FSO','policy','Broadcast security alert and advisory information throughout the organization using organization-defined automated mechanisms.','SI-05(01)','N/A','Determine if [SI-05(01)_ODP; automated mechanisms used to broadcast security alert and advisory information throughout the organization are defined] are used to broadcast security alert and advisory information throughout the organization.'),\n('001294','draft','2009-09-22','DISA FSO','technical','Alert organization-defined personnel or roles of failed security verification tests.','SI-06c.','N/A','Determine if: - [SI-06_ODP[06]; personnel or roles to be alerted of failed security and privacy verification tests is/are defined] is/are alerted to failed security verification tests. - [SI-06_ODP[06]; personnel or roles to be alerted of failed security and privacy verification tests is/are defined] is/are alerted to failed privacy verification tests.'),\n('001295','draft','2009-09-22','DISA FSO','technical','Implement automated mechanisms to support the management of distributed security function testing.','SI-06(02)','N/A','Determine if: - automated mechanisms are implemented to support the management of distributed security function testing. - automated mechanisms are implemented to support the management of distributed privacy function testing.'),\n('001296','draft','2009-09-22','DISA FSO','policy','Report the results of security function verification to organization-defined personnel or roles.','SI-06(03)','N/A','Determine if: - the results of security function verification are reported to [SI-06(03)_ODP; personnel or roles designated to receive the results of security and privacy function verification is/are defined]. - the results of privacy function verification are reported to [SI-06(03)_ODP; personnel or roles designated to receive the results of security and privacy function verification is/are defined].'),\n('001300','draft','2009-09-22','DISA FSO','policy','Employ automated tools that provide notification to organization-defined personnel or roles upon discovering discrepancies during integrity verification.','SI-07(02)','N/A','Determine if automated tools that provide notification to [SI-07(02)_ODP; personnel or roles to whom notification is to be provided upon discovering discrepancies during integrity verification is/are defined] upon discovering discrepancies during integrity verification are employed.'),\n('001301','draft','2009-09-22','DISA FSO','policy','Employ centrally managed integrity verification tools.','SI-07(03)','N/A','Determine if centrally managed integrity verification tools are employed.'),\n('001308','draft','2009-09-22','DISA FSO','technical','Automatically update spam protection mechanisms on an organization-defined frequency.','SI-08(02)','N/A','Determine if spam protection mechanisms are automatically updated [SI-08(02)_ODP; the frequency at which to automatically update spam protection mechanisms is defined].'),\n('001310','draft','2009-09-22','DISA FSO','technical','Checks the validity of organization-defined information inputs to the system.','SI-10','N/A','Determine if the validity of the [SI-10_ODP; information inputs to the system requiring validity checks are defined] is checked.'),\n('001312','draft','2009-09-22','DISA FSO','technical','Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited.','SI-11a.','N/A','Determine if error messages that provide the information necessary for corrective actions are generated without revealing information that could be exploited.'),\n('001314','draft','2009-09-22','DISA FSO','technical','Reveal error messages only to organization-defined personnel or roles.','SI-11b.','N/A','Determine if error messages are revealed only to [SI-11_ODP; personnel or roles to whom error messages are to be revealed is/are defined].'),\n('001315','draft','2009-09-22','DISA FSO','policy','Manage information within the system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.','SI-12','N/A','Determine if: - information within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements. - information within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements. - information output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements. - information output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.'),\n('001318','draft','2009-09-22','DISA FSO','policy','Provide substitute system components.','SI-13b.','N/A','Determine if substitute system components and a means to exchange active and standby components are provided in accordance with [SI-13_ODP[02]; mean time to failure (MTTF) substitution criteria to be used as a means to exchange active and standby components are defined].'),\n('001319','draft','2009-09-22','DISA FSO','policy','Take system components out of service by transferring component responsibilities to a substitute component no later than an organization-defined fraction or percentage of mean time to failure (MTTF).','SI-13(01)','N/A','Determine if system components are taken out of service by transferring component responsibilities to substitute components no later than [SI-13(01)_ODP; the fraction or percentage of mean time to failure within which to transfer the responsibilities of a system component to a substitute component is defined] of mean time to failure.'),\n('001320','draft','2009-09-22','DISA FSO','policy','Defines the maximum fraction or percentage of mean time to failure (MTTF) used to determine when system components are taken out of service by transferring component responsibilities to substitute components.','SI-13(01)','N/A','Determine if system components are taken out of service by transferring component responsibilities to substitute components no later than [SI-13(01)_ODP; the fraction or percentage of mean time to failure within which to transfer the responsibilities of a system component to a substitute component is defined] of mean time to failure.'),\n('001321','draft','2009-09-22','DISA FSO','policy','Prohibit processes from executing without supervision for more than an organization-defined time period.','SI-07(16)','N/A','Determine if processes are prohibited from executing without supervision for more than [SI-07(16)_ODP; the maximum time period permitted for processes to execute without supervision is defined].'),\n('001322','draft','2009-09-22','DISA FSO','policy','Defines a time period that is the longest a process is allowed to execute without supervision.','SI-07(16)','N/A','Determine if processes are prohibited from executing without supervision for more than [SI-07(16)_ODP; the maximum time period permitted for processes to execute without supervision is defined].'),\n('001323','draft','2009-09-22','DISA FSO','policy','Manually initiate transfers between active and standby system components when the use of the active component reaches an organization-defined percentage of the mean time to failure.','SI-13(03)','N/A','Determine if transfers are initiated manually between active and standby system components when the use of the active component reaches [SI-13(03)_ODP; the percentage of the mean time to failure for transfers to be manually initiated is defined] of the mean time to failure.'),\n('001326','draft','2009-09-22','DISA FSO','policy','If system component failures are detected, ensure standby components are successfully and transparently installed within an organization-defined time period.','SI-13(04)(a)','N/A','Determine if the standby components are successfully and transparently installed within [SI-13(04)_ODP[01]; time period for standby components to be installed is defined] if system component failures are detected.'),\n('001327','draft','2009-09-22','DISA FSO','policy','Defines a time period for a standby system component to be successfully and transparently installed for the system component that has failed.','SI-13(04)(a)','N/A','Determine if the standby components are successfully and transparently installed within [SI-13(04)_ODP[01]; time period for standby components to be installed is defined] if system component failures are detected.'),\n('001328','draft','2009-09-22','DISA FSO','technical','If system component failures are detected, activate an organization-defined alarm, automatically shut down the system, and/or organization-defined action.','SI-13(04)(b)','N/A','Determine if [SI-13(04)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {activate [SI-13(04)_ODP[03]; alarm to be activated when system component failures are detected is defined (if selected)]; automatically shut down the system; [SI-13(04)_ODP[04]; action to be taken when system component failures are detected is defined (if selected)]}] are performed if system component failures are detected.'),\n('001329','draft','2009-09-22','DISA FSO','policy','Defines the alarm to be activated when a system component failure is detected.','SI-13(04)(b)','N/A','Determine if [SI-13(04)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {activate [SI-13(04)_ODP[03]; alarm to be activated when system component failures are detected is defined (if selected)]; automatically shut down the system; [SI-13(04)_ODP[04]; action to be taken when system component failures are detected is defined (if selected)]}] are performed if system component failures are detected.'),\n('001330','draft','2009-09-22','DISA FSO','policy','Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official.','AC-19(04)(a)','N/A','Determine if the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information is prohibited unless specifically permitted by the authorizing official.'),\n('001331','draft','2009-09-22','DISA FSO','policy','Prohibit the connection of unclassified mobile devices to classified systems.','AC-19(04)(b)(01)','N/A','Determine if prohibition of the connection of unclassified mobile devices to classified systems is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information.'),\n('001332','draft','2009-09-22','DISA FSO','policy','Connection of unclassified mobile devices to unclassified systems requires approval from the authorizing official.','AC-19(04)(b)(02)','N/A','Determine if approval by the authorizing official for the connection of unclassified mobile devices to unclassified systems is enforced on individuals permitted to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information.'),\n('001333','draft','2009-09-22','DISA FSO','policy','Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited.','AC-19(04)(b)(03)','N/A','Determine if prohibition of the use of internal or external modems or wireless interfaces within unclassified mobile devices is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information.'),\n('001334','draft','2009-09-22','DISA FSO','policy','Require unclassified mobile devices used in facilities containing systems processing, storing, or transmitting classified information and the information stored on those devices be subject to random reviews and inspections by organization-defined security officials.','AC-19(04)(b)(04)','N/A','Determine if: - random review and inspection of unclassified mobile devices and the information stored on those devices by [AC-19(04)_ODP[01]; security officials responsible for the review and inspection of unclassified mobile devices and the information stored on those devices are defined] are enforced. - following of the incident handling policy is enforced if classified information is found during a random review and inspection of unclassified mobile devices.'),\n('001335','draft','2009-09-22','DISA FSO','policy','Defines security officials to perform reviews and inspections of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information.','AC-19(04)(b)(04)','N/A','Determine if: - random review and inspection of unclassified mobile devices and the information stored on those devices by [AC-19(04)_ODP[01]; security officials responsible for the review and inspection of unclassified mobile devices and the information stored on those devices are defined] are enforced. - following of the incident handling policy is enforced if classified information is found during a random review and inspection of unclassified mobile devices.'),\n('001336','draft','2009-09-22','DISA FSO','policy','Retain individual training records for an organization-defined time-period.','AT-04b.','N/A','Determine if individual training records are retained for [AT-04_ODP; time period for retaining individual training records is defined].'),\n('001337','draft','2009-09-22','DISA FSO','policy','Defines the time period for retaining individual training records.','AT-04b.','N/A','Determine if individual training records are retained for [AT-04_ODP; time period for retaining individual training records is defined].'),\n('001340','draft','2009-09-22','DISA FSO','technical','Maintain reviewer or releaser identity and credentials within the established chain of custody for all information reviewed or released.','AU-10(03)','N/A','Determine if reviewer or releaser credentials are maintained within the established chain of custody for information reviewed or released.'),\n('001341','draft','2009-09-22','DISA FSO','technical','Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between organization-defined security domains.','AU-10(04)(a)','N/A','Determine if the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between [AU-10(04)_ODP[01]; security domains for which the binding of the information reviewer identity to the information is to be validated at transfer or release are defined].'),\n('001348','draft','2009-09-22','DISA FSO','technical','Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component than the system or component being audited.','AU-09(02)','N/A','Determine if audit records are stored [AU-09(02)_ODP; the frequency of storing audit records in a repository is defined] in a repository that is part of a physically different system or system component than the system or component being audited.'),\n('001349','draft','2009-09-22','DISA FSO','policy','Defines a frequency for storing audit records in a repository that is part of a physically different system or system component than the system or component being audited.','AU-09(02)','N/A','Determine if audit records are stored [AU-09(02)_ODP; the frequency of storing audit records in a repository is defined] in a repository that is part of a physically different system or system component than the system or component being audited.'),\n('001350','draft','2009-09-22','DISA FSO','technical','Implement cryptographic mechanisms to protect the integrity of audit information.','AU-09(03)','N/A','Determine if cryptographic mechanisms to protect the integrity of audit information and audit tools are implemented.'),\n('001351','draft','2009-09-22','DISA FSO','policy','Authorize access to management of audit logging functionality to only an organization-defined subset of privileged users or roles.','AU-09(04)','N/A','Determine if access to management of audit logging functionality is authorized only to [AU-09(04)_ODP; a subset of privileged users or roles authorized to access management of audit logging functionality is defined].'),\n('001353','draft','2009-09-22','DISA FSO','technical','Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.','AU-12(02)','N/A','Determine if a system-wide (logical or physical) audit trail composed of audit records is produced in a standardized format.'),\n('001358','draft','2009-09-22','DISA FSO','policy','Establish privileged user accounts in accordance with a role-based access scheme; or an attribute-based access scheme.','AC-02(07)(a)','N/A','Determine if privileged user accounts are established and administered in accordance with [AC-02(07)_ODP; one of the following PARAMETER VALUES is selected: {a role-based access scheme; an attribute-based access scheme}].'),\n('001360','draft','2009-09-22','DISA FSO','policy','Monitor privileged role assignments.','AC-02(07)(b)','N/A','Determine if privileged role or attribute assignments are monitored.'),\n('001361','draft','2009-09-24','DISA FSO','policy','Defines a time period after which temporary accounts are automatically terminated.','AC-02(02)','N/A','Determine if temporary and emergency accounts are automatically [AC-02(02)_ODP[01]; one of the following PARAMETER VALUES is selected: {remove; disable}] after [AC-02(02)_ODP[02]; the time period after which to automatically remove or disable temporary or emergency accounts is defined].'),\n('001365','draft','2009-09-24','DISA FSO','policy','Defines a time period after which emergency accounts are automatically terminated.','AC-02(02)','N/A','Determine if temporary and emergency accounts are automatically [AC-02(02)_ODP[01]; one of the following PARAMETER VALUES is selected: {remove; disable}] after [AC-02(02)_ODP[02]; the time period after which to automatically remove or disable temporary or emergency accounts is defined].'),\n('001368','draft','2009-09-22','DISA FSO','technical','Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.','AC-04','N/A','Determine if approved authorizations are enforced for controlling the flow of information within the system and between connected systems based on [AC-04_ODP; information flow control policies within the system and between connected systems are defined].'),\n('001371','draft','2009-09-22','DISA FSO','policy','Defines security or privacy policy filters requiring fully enumerated formats which are to be implemented when transferring information between different security domains.','AC-04(14)','N/A','Determine if: - when transferring information between different security domains, implemented [AC-04(14)_ODP[01]; security policy filters to be implemented that require fully enumerated formats restricting data structure and content have been defined] require fully enumerated formats that restrict data structure and content. - when transferring information between different security domains, implemented [AC-04(14)_ODP[02]; privacy policy filters to be implemented that require fully enumerated formats restricting data structure and content are defined] require fully enumerated formats that restrict data structure and content.'),\n('001372','draft','2009-09-22','DISA FSO','technical','When transferring information between different security domains, implement organization-defined security or privacy policy filters requiring fully enumerated formats that restrict data structure and content.','AC-04(14)','N/A','Determine if: - when transferring information between different security domains, implemented [AC-04(14)_ODP[01]; security policy filters to be implemented that require fully enumerated formats restricting data structure and content have been defined] require fully enumerated formats that restrict data structure and content. - when transferring information between different security domains, implemented [AC-04(14)_ODP[02]; privacy policy filters to be implemented that require fully enumerated formats restricting data structure and content are defined] require fully enumerated formats that restrict data structure and content.'),\n('001373','draft','2009-09-22','DISA FSO','technical','When transferring information between different security domains, examine the information for the presence of organization-defined unsanctioned information.','AC-04(15)','N/A','Determine if: - when transferring information between different security domains, information is examined for the presence of [AC-04(15)_ODP[01]; unsanctioned information to be detected is defined]. - when transferring information between different security domains, transfer of [AC-04(15)_ODP[01]; unsanctioned information to be detected is defined] is prohibited in accordance with the [AC-04(15)_ODP[02]; security policy that requires the transfer of unsanctioned information between different security domains to be prohibited is defined (if selected)]. - when transferring information between different security domains, transfer of [AC-04(15)_ODP[01]; unsanctioned information to be detected is defined] is prohibited in accordance with the [AC-04(15)_ODP[03]; privacy policy that requires the transfer of organization-defined unsanctioned information between different security domains to be prohibited is defined (if selected)].'),\n('001374','draft','2009-09-22','DISA FSO','technical','When transferring information between different security domains, prohibit the transfer of such information in accordance with the organization-defined security or privacy policy.','AC-04(15)','N/A','Determine if: - when transferring information between different security domains, information is examined for the presence of [AC-04(15)_ODP[01]; unsanctioned information to be detected is defined]. - when transferring information between different security domains, transfer of [AC-04(15)_ODP[01]; unsanctioned information to be detected is defined] is prohibited in accordance with the [AC-04(15)_ODP[02]; security policy that requires the transfer of unsanctioned information between different security domains to be prohibited is defined (if selected)]. - when transferring information between different security domains, transfer of [AC-04(15)_ODP[01]; unsanctioned information to be detected is defined] is prohibited in accordance with the [AC-04(15)_ODP[03]; privacy policy that requires the transfer of organization-defined unsanctioned information between different security domains to be prohibited is defined (if selected)].'),\n('001384','draft','2009-09-22','DISA FSO','technical','For publicly accessible systems, display system use information with organization-defined conditions before granting further access to the publicly accessible system.','AC-08c.01','N/A','Determine if for publicly accessible systems, system use information [AC-08_ODP[02]; conditions for system use to be displayed by the system before granting further access are defined] is displayed before granting further access to the publicly accessible system.'),\n('001385','draft','2009-09-22','DISA FSO','technical','For publicly accessible systems, displays references, if any, to monitoring that are consistent with privacy accommodations for such systems that generally prohibit those activities.','AC-08c.02','N/A','Determine if for publicly accessible systems, any references to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities are displayed.'),\n('001386','draft','2009-09-22','DISA FSO','technical','For publicly accessible systems, displays references, if any, to recording that are consistent with privacy accommodations for such systems that generally prohibit those activities.','AC-08c.02','N/A','Determine if for publicly accessible systems, any references to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities are displayed.'),\n('001387','draft','2009-09-22','DISA FSO','technical','For publicly accessible systems, displays references, if any, to auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities.','AC-08c.02','N/A','Determine if for publicly accessible systems, any references to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities are displayed.'),\n('001388','draft','2009-09-22','DISA FSO','technical','For publicly accessible systems, includes a description of the authorized uses of the system.','AC-08c.03','N/A','Determine if for publicly accessible systems, a description of the authorized uses of the system is included.'),\n('001389','draft','2009-09-22','DISA FSO','policy','Defines the time period that the system notifies the user of the number of successful logon/access attempts.','AC-09(02)','N/A','Determine if the user is notified, upon successful logon, of the number of [AC-09(02)_ODP[01]; one of the following PARAMETER VALUES is selected: {successful logons; unsuccessful logon attempts; both}] during [AC-09(02)_ODP[02]; the time period for which the system notifies the user of the number of successful logons, unsuccessful logon attempts, or both is defined].'),\n('001390','draft','2009-09-22','DISA FSO','policy','Defines the time period that the system notifies the user of the number of unsuccessful logon/access attempts.','AC-09(02)','N/A','Determine if the user is notified, upon successful logon, of the number of [AC-09(02)_ODP[01]; one of the following PARAMETER VALUES is selected: {successful logons; unsuccessful logon attempts; both}] during [AC-09(02)_ODP[02]; the time period for which the system notifies the user of the number of successful logons, unsuccessful logon attempts, or both is defined].'),\n('001391','draft','2009-09-22','DISA FSO','technical','Notify the user, upon successful logon, of the number of successful logons/accesses during the organization-defined time period.','AC-09(02)','N/A','Determine if the user is notified, upon successful logon, of the number of [AC-09(02)_ODP[01]; one of the following PARAMETER VALUES is selected: {successful logons; unsuccessful logon attempts; both}] during [AC-09(02)_ODP[02]; the time period for which the system notifies the user of the number of successful logons, unsuccessful logon attempts, or both is defined].'),\n('001392','draft','2009-09-22','DISA FSO','technical','Notify the user, upon successful logon, of the number of unsuccessful logon/access attempts during the organization-defined time period.','AC-09(02)','N/A','Determine if the user is notified, upon successful logon, of the number of [AC-09(02)_ODP[01]; one of the following PARAMETER VALUES is selected: {successful logons; unsuccessful logon attempts; both}] during [AC-09(02)_ODP[02]; the time period for which the system notifies the user of the number of successful logons, unsuccessful logon attempts, or both is defined].'),\n('001393','draft','2009-09-22','DISA FSO','policy','Defines the security-related characteristics/parameters of the user''s account which, when changed, will result in a notification being provided to the user during the organization-defined time period.','AC-09(03)','N/A','Determine if the user is notified, upon successful logon, of changes to [AC-09(03)_ODP[01]; changes to security-related characteristics or parameters of the user''s account that require notification are defined] during [AC-09(03)_ODP[02]; the time period for which the system notifies the user of changes to security-related characteristics or parameters of the user''s account is defined].'),\n('001394','draft','2009-09-22','DISA FSO','policy','Defines the time period during which organization-defined security-related changes to the user''s account are to be tracked.','AC-09(03)','N/A','Determine if the user is notified, upon successful logon, of changes to [AC-09(03)_ODP[01]; changes to security-related characteristics or parameters of the user''s account that require notification are defined] during [AC-09(03)_ODP[02]; the time period for which the system notifies the user of changes to security-related characteristics or parameters of the user''s account is defined].'),\n('001395','draft','2009-09-22','DISA FSO','technical','Notify the user, upon successful logon, of changes to organization-defined security-related characteristics/parameters of the user''s account during the organization-defined time-period.','AC-09(03)','N/A','Determine if the user is notified, upon successful logon, of changes to [AC-09(03)_ODP[01]; changes to security-related characteristics or parameters of the user''s account that require notification are defined] during [AC-09(03)_ODP[02]; the time period for which the system notifies the user of changes to security-related characteristics or parameters of the user''s account is defined].'),\n('001403','draft','2009-09-24','DISA FSO','technical','Automatically audit account modification actions.','AC-02(04)','N/A','Determine if: - account creation is automatically audited. - account modification is automatically audited. - account enabling is automatically audited. - account disabling is automatically audited. - account removal actions are automatically audited.'),\n('001404','draft','2009-09-24','DISA FSO','technical','Automatically audit account disabling actions.','AC-02(04)','N/A','Determine if: - account creation is automatically audited. - account modification is automatically audited. - account enabling is automatically audited. - account disabling is automatically audited. - account removal actions are automatically audited.'),\n('001405','draft','2009-09-24','DISA FSO','technical','Automatically audit account removal actions.','AC-02(04)','N/A','Determine if: - account creation is automatically audited. - account modification is automatically audited. - account enabling is automatically audited. - account disabling is automatically audited. - account removal actions are automatically audited.'),\n('001406','draft','2009-09-24','DISA FSO','policy','Defines a time period of expected inactivity when users are required to log out.','AC-02(05)','N/A','Determine if users are required to log out when [AC-02(05)_ODP; the time period of expected inactivity or description of when to log out is defined].'),\n('001407','draft','2009-09-24','DISA FSO','policy','Administer privileged user accounts in accordance with a role-based access scheme; or an attribute-based access scheme.','AC-02(07)(a)','N/A','Determine if privileged user accounts are established and administered in accordance with [AC-02(07)_ODP; one of the following PARAMETER VALUES is selected: {a role-based access scheme; an attribute-based access scheme}].'),\n('001408','draft','2009-09-24','DISA FSO','policy','Defines privileged commands for which dual authorization is to be enforced.','AC-03(02)','N/A','Determine if dual authorization is enforced for [AC-03(02)_ODP; privileged commands and/or other actions requiring dual authorization are defined].'),\n('001411','draft','2009-09-24','DISA FSO','policy','Defines security-relevant information to which the system prevents access except during secure, non-operable system states.','AC-03(05)','N/A','Determine if access to [AC-03(05)_ODP; security-relevant information to which access is prevented except during secure, non-operable system states is defined] is prevented except during secure, non-operable system states.'),\n('001414','draft','2009-09-24','DISA FSO','technical','Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.','AC-04','N/A','Determine if approved authorizations are enforced for controlling the flow of information within the system and between connected systems based on [AC-04_ODP; information flow control policies within the system and between connected systems are defined].'),\n('001415','draft','2009-09-24','DISA FSO','policy','Defines limitations for the embedding of data types within other data types.','AC-04(05)','N/A','Determine if [AC-04(05)_ODP; limitations on embedding data types within other data types are defined] are enforced on embedding data types within other data types.'),\n('001417','draft','2009-09-24','DISA FSO','policy','Defines security policy filters to be enforced and used as a basis for flow control decisions.','AC-04(08)(a)','N/A','Determine if: - information flow control is enforced using [AC-04(08)_ODP[01]; security policy filters to be used as a basis for enforcing information flow control are defined] as a basis for flow control decisions for [AC-04(08)_ODP[03]; information flows for which information flow control is enforced by security filters are defined]. - information flow control is enforced using [AC-04(08)_ODP[02]; privacy policy filters to be used as a basis for enforcing information flow control are defined] as a basis for flow control decisions for [AC-04(08)_ODP[04]; information flows for which information flow control is enforced by privacy filters are defined].'),\n('001419','draft','2009-09-25','DISA FSO','policy','Defines the security functions or security-relevant information to which users of system accounts, or roles, have access.','AC-06(02)','N/A','Determine if users of system accounts (or roles) with access to [AC-06(02)_ODP; security functions or security-relevant information, the access to which requires users to use non-privileged accounts to access non-security functions, are defined] are required to use non-privileged accounts or roles when accessing non-security functions.'),\n('001420','draft','2009-09-25','DISA FSO','policy','Defines the privileged commands to which network access is to be authorized only for organization-defined compelling operational needs.','AC-06(03)','N/A','Determine if: - network access to [AC-06(03)_ODP[01]; privileged commands to which network access is to be authorized only for compelling operational needs are defined] is authorized only for [AC-06(03)_ODP[02]; compelling operational needs necessitating network access to privileged commands are defined]. - the rationale for authorizing network access to privileged commands is documented in the security plan for the system.'),\n('001422','draft','2009-09-25','DISA FSO','policy','Prohibit privileged access to the system by non-organizational users.','AC-06(06)','N/A','Determine if privileged access to the system by non-organizational users is prohibited.'),\n('001423','draft','2009-09-25','DISA FSO','policy','Defines the time period in which the organization-defined maximum number of consecutive invalid logon attempts occur.','AC-07a.','N/A','Determine if a limit of [AC-07_ODP[01]; the number of consecutive invalid logon attempts by a user allowed during a time period is defined] consecutive invalid logon attempts by a user during [AC-07_ODP[02]; the time period to which the number of consecutive invalid logon attempts by a user is limited is defined] is enforced.'),\n('001424','draft','2009-09-25','DISA FSO','technical','Dynamically associate security attributes with organization-defined subjects in accordance with organization-defined security policies as information is created and combined.',NULL,'N/A',NULL),\n('001425','draft','2009-09-25','DISA FSO','technical','Provides authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated security attributes.',NULL,'N/A',NULL),\n('001428','draft','2009-09-25','DISA FSO','technical','Display security attributes in human-readable form on each object that the system transmits to output devices to identify organization-identified special dissemination, handling, or distribution instructions using organization-identified human-readable, standard naming conventions.','AC-16(04)','N/A','Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[01]; security attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[05]; subjects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[02]; security attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[06]; objects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[03]; privacy attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[07]; subjects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[04]; privacy attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[08]; objects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined].'),\n('001429','draft','2009-09-25','DISA FSO','policy','Identify special dissemination, handling, or distribution instructions for identifying security attributes on output.','AC-16(05)','N/A','Determine if: - security attributes are displayed in human-readable form on each object that the system transmits to output devices to identify [AC-16(05)_ODP[01]; special dissemination, handling, or distribution instructions to be used for each object that the system transmits to output devices are defined] using [AC-16(05)_ODP[02]; human-readable, standard naming conventions for the security and privacy attributes to be displayed in human-readable form on each object that the system transmits to output devices are defined]. - privacy attributes are displayed in human-readable form on each object that the system transmits to output devices to identify [AC-16(05)_ODP[01]; special dissemination, handling, or distribution instructions to be used for each object that the system transmits to output devices are defined] using [AC-16(05)_ODP[02]; human-readable, standard naming conventions for the security and privacy attributes to be displayed in human-readable form on each object that the system transmits to output devices are defined].'),\n('001430','draft','2009-09-25','DISA FSO','policy','Identify human-readable, standard naming conventions for identifying security attributes on output.','AC-16(05)','N/A','Determine if: - security attributes are displayed in human-readable form on each object that the system transmits to output devices to identify [AC-16(05)_ODP[01]; special dissemination, handling, or distribution instructions to be used for each object that the system transmits to output devices are defined] using [AC-16(05)_ODP[02]; human-readable, standard naming conventions for the security and privacy attributes to be displayed in human-readable form on each object that the system transmits to output devices are defined]. - privacy attributes are displayed in human-readable form on each object that the system transmits to output devices to identify [AC-16(05)_ODP[01]; special dissemination, handling, or distribution instructions to be used for each object that the system transmits to output devices are defined] using [AC-16(05)_ODP[02]; human-readable, standard naming conventions for the security and privacy attributes to be displayed in human-readable form on each object that the system transmits to output devices are defined].'),\n('001439','draft','2009-09-25','DISA FSO','policy','Establish implementation guidance for wireless access.','AC-18a.','N/A','Determine if: - configuration requirements are established for each type of wireless access. - connection requirements are established for each type of wireless access. - implementation guidance is established for each type of wireless access.'),\n('001441','draft','2009-09-25','DISA FSO','policy','Authorize each type of wireless access to the system prior to allowing such connections.','AC-18b.','N/A','Determine if each type of wireless access to the system is authorized prior to allowing such connections.'),\n('001443','draft','2009-09-25','DISA FSO','technical','Protect wireless access to the system using authentication of users and/or devices.','AC-18(01)','N/A','Determine if: - wireless access to the system is protected using authentication of [AC-18(01)_ODP; one or more of the following PARAMETER VALUES is/are selected: {users; devices}]. - wireless access to the system is protected using encryption.'),\n('001444','draft','2009-09-25','DISA FSO','technical','Protect wireless access to the system using encryption.','AC-18(01)','N/A','Determine if: - wireless access to the system is protected using authentication of [AC-18(01)_ODP; one or more of the following PARAMETER VALUES is/are selected: {users; devices}]. - wireless access to the system is protected using encryption.'),\n('001449','draft','2009-09-25','DISA FSO','policy','Disable, when not intended for use, wireless networking capabilities internally embedded within system components prior to issuance and deployment.','AC-18(03)','N/A','Determine if when not intended for use, wireless networking capabilities embedded within system components are disabled prior to issuance and deployment.'),\n('001451','draft','2009-09-25','DISA FSO','policy','Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.','AC-18(05)','N/A','Determine if: - radio antennas are selected to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries. - transmission power levels are calibrated to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.'),\n('001453','draft','2009-09-29','DISA FSO','technical','Implement cryptographic mechanisms to protect the integrity of remote access sessions.','AC-17(02)','N/A','Determine if cryptographic mechanisms are implemented to protect the confidentiality and integrity of remote access sessions.'),\n('001458','draft','2009-09-29','DISA FSO','policy','If classified information is found on mobile devices, the incident handling policy is to be followed.','AC-19(04)(b)(04)','N/A','Determine if: - random review and inspection of unclassified mobile devices and the information stored on those devices by [AC-19(04)_ODP[01]; security officials responsible for the review and inspection of unclassified mobile devices and the information stored on those devices are defined] are enforced. - following of the incident handling policy is enforced if classified information is found during a random review and inspection of unclassified mobile devices.'),\n('001459','draft','2009-09-29','DISA FSO','policy','Defines system components that provide audit record generation capability.','AU-12a.','N/A','Determine if audit record generation capability for the event types the system is capable of auditing (defined in AU-02_ODP[01]) is provided by [AU-12_ODP[01]; system components that provide an audit record generation capability for the events types (defined in AU-02_ODP[02]) are defined].'),\n('001460','draft','2009-09-29','DISA FSO','policy','Monitor organization-defined open source information and/or information sites per organization-defined frequency for evidence of unauthorized disclosure of organizational information.','AU-13a.','N/A','Determine if [AU-13_ODP[01]; open-source information and/or information sites to be monitored for evidence of unauthorized disclosure of organizational information is/are defined] is/are monitored [AU-13_ODP[02]; the frequency with which open-source information and/or information sites are monitored for evidence of unauthorized disclosure of organizational information is defined] for evidence of unauthorized disclosure of organizational information.'),\n('001461','draft','2009-09-29','DISA FSO','policy','Defines a frequency for monitoring open source information and/or information sites for evidence of unauthorized exfiltration or disclosure of organizational information.','AU-13a.','N/A','Determine if [AU-13_ODP[01]; open-source information and/or information sites to be monitored for evidence of unauthorized disclosure of organizational information is/are defined] is/are monitored [AU-13_ODP[02]; the frequency with which open-source information and/or information sites are monitored for evidence of unauthorized disclosure of organizational information is defined] for evidence of unauthorized disclosure of organizational information.'),\n('001464','draft','2009-09-29','DISA FSO','technical','Initiates session audits automatically at system start-up.','AU-14(01)','N/A','Determine if session audits are initiated automatically at system start-up.'),\n('001470','draft','2009-09-29','DISA FSO','policy','Defines information sharing circumstances where user discretion is required.','AC-21a.','N/A','Determine if authorized users are enabled to determine whether access authorizations assigned to a sharing partner match the information''s access and use restrictions for [AC-21_ODP[01]; information-sharing circumstances where user discretion is required to determine whether access authorizations assigned to a sharing partner match the information''s access and use restrictions are defined].'),\n('001471','draft','2009-09-29','DISA FSO','policy','Employ organization-defined automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.','AC-21b.','N/A','Determine if [AC-21_ODP[02]; automated mechanisms or manual processes that assist users in making information-sharing and collaboration decisions are defined] are employed to assist users in making information-sharing and collaboration decisions.'),\n('001472','draft','2009-09-29','DISA FSO','policy','Defines the automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.','AC-21b.','N/A','Determine if [AC-21_ODP[02]; automated mechanisms or manual processes that assist users in making information-sharing and collaboration decisions are defined] are employed to assist users in making information-sharing and collaboration decisions.'),\n('001473','draft','2009-09-29','DISA FSO','policy','Designate individuals authorized to post information onto a publicly accessible system.','AC-22a.','N/A','Determine if designated individuals are authorized to make information publicly accessible.'),\n('001474','draft','2009-09-29','DISA FSO','policy','Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information.','AC-22b.','N/A','Determine if authorized individuals are trained to ensure that publicly accessible information does not contain non-public information.'),\n('001475','draft','2009-09-29','DISA FSO','policy','Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included.','AC-22c.','N/A','Determine if the proposed content of information is reviewed prior to posting onto the publicly accessible system to ensure that non-public information is not included.'),\n('001476','draft','2009-09-29','DISA FSO','policy','Review the content on the publicly accessible system for nonpublic information on an organization-defined frequency.','AC-22d.','N/A','Determine if: - the content on the publicly accessible system is reviewed for non-public information [AC-22_ODP; the frequency at which to review the content on the publicly accessible system for non-public information is defined]. - non-public information is removed from the publicly accessible system, if discovered.'),\n('001477','draft','2009-09-29','DISA FSO','policy','Defines a frequency for reviewing the content on the publicly accessible system for nonpublic information.','AC-22d.','N/A','Determine if: - the content on the publicly accessible system is reviewed for non-public information [AC-22_ODP; the frequency at which to review the content on the publicly accessible system for non-public information is defined]. - non-public information is removed from the publicly accessible system, if discovered.'),\n('001478','draft','2009-09-29','DISA FSO','policy','Remove nonpublic information from the publicly accessible system, if discovered.','AC-22d.','N/A','Determine if: - the content on the publicly accessible system is reviewed for non-public information [AC-22_ODP; the frequency at which to review the content on the publicly accessible system for non-public information is defined]. - non-public information is removed from the publicly accessible system, if discovered.'),\n('001481','draft','2009-09-29','DISA FSO','policy','Provide organization-defined personnel or roles with initial training in the employment and operation of environmental controls.','AT-03(01)','N/A','Determine if [AT-03(01)_ODP[01]; personnel or roles to be provided with initial and refresher training in the employment and operation of environmental controls are defined] are provided with initial and refresher training [AT-03(01)_ODP[02]; the frequency at which to provide refresher training in the employment and operation of environmental controls is defined] in the employment and operation of environmental controls.'),\n('001482','draft','2009-09-29','DISA FSO','policy','Provide organization-defined personnel or roles with refresher training in the employment and operation of environmental controls in accordance with the organization-defined frequency.','AT-03(01)','N/A','Determine if [AT-03(01)_ODP[01]; personnel or roles to be provided with initial and refresher training in the employment and operation of environmental controls are defined] are provided with initial and refresher training [AT-03(01)_ODP[02]; the frequency at which to provide refresher training in the employment and operation of environmental controls is defined] in the employment and operation of environmental controls.'),\n('001483','draft','2009-09-29','DISA FSO','policy','Defines a frequency for providing employees with refresher training in the employment and operation of environmental controls.','AT-03(01)','N/A','Determine if [AT-03(01)_ODP[01]; personnel or roles to be provided with initial and refresher training in the employment and operation of environmental controls are defined] are provided with initial and refresher training [AT-03(01)_ODP[02]; the frequency at which to provide refresher training in the employment and operation of environmental controls is defined] in the employment and operation of environmental controls.'),\n('001484','draft','2009-09-29','DISA FSO','policy','Defines the frequency of (or situation requiring) logging for each identified event.','AU-02c.','N/A','Determine if: - [AU-02_ODP[02]; the event types (subset of AU-02_ODP[01]) for logging within the system are defined] are specified for logging within the system. - the specified event types are logged within the system [AU-02_ODP[03]; the frequency or situation requiring logging for each specified event type is defined].'),\n('001485','draft','2009-09-29','DISA FSO','policy','Defines the event types for logging within the system.','AU-02c.','N/A','Determine if: - [AU-02_ODP[02]; the event types (subset of AU-02_ODP[01]) for logging within the system are defined] are specified for logging within the system. - the specified event types are logged within the system [AU-02_ODP[03]; the frequency or situation requiring logging for each specified event type is defined].'),\n('001487','draft','2009-09-29','DISA FSO','technical','Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.','AU-03f.','N/A','Determine if audit records contain information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.'),\n('001488','draft','2009-09-29','DISA FSO','policy','Defines the additional information to be included in the audit records.','AU-03(01)','N/A','Determine if generated audit records contain the following [AU-03(01)_ODP; additional information to be included in audit records is defined].'),\n('001490','draft','2009-09-29','DISA FSO','policy','Defines the actions to be taken by the system upon audit failure, including shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.','AU-05b.','N/A','Determine if [AU-05_ODP[03]; additional actions to be taken in the event of an audit logging process failure are defined] are taken in the event of an audit logging process failure.'),\n('001491','draft','2009-09-29','DISA FSO','policy','Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.','AU-06(06)','N/A','Determine if information from audit records is correlated with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.'),\n('001493','draft','2009-09-29','DISA FSO','technical','Protect audit tools from unauthorized access.','AU-09a.','N/A','Determine if audit information and audit logging tools are protected from unauthorized access, modification, and deletion.'),\n('001494','draft','2009-09-29','DISA FSO','technical','Protect audit tools from unauthorized modification.','AU-09a.','N/A','Determine if audit information and audit logging tools are protected from unauthorized access, modification, and deletion.'),\n('001495','draft','2009-09-29','DISA FSO','technical','Protect audit tools from unauthorized deletion.','AU-09a.','N/A','Determine if audit information and audit logging tools are protected from unauthorized access, modification, and deletion.'),\n('001496','draft','2009-09-29','DISA FSO','technical','Implement cryptographic mechanisms to protect the integrity of audit tools.','AU-09(03)','N/A','Determine if cryptographic mechanisms to protect the integrity of audit information and audit tools are implemented.'),\n('001497','draft','2009-09-29','DISA FSO','policy','Defines a frequency for the review and update to the baseline configuration of the system.','CM-02b.01','N/A','Determine if the baseline configuration of the system is reviewed and updated [CM-02_ODP[01]; the frequency of baseline configuration review and update is defined].'),\n('001498','draft','2009-09-29','DISA FSO','policy','Defines a time period after which proposed changes to the system that have not been approved or disapproved are highlighted.','CM-03(01)(c)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to highlight proposed changes to the system that have not been approved or disapproved within [CM-03(01)_ODP[03]l the time period after which to highlight changes that have not been approved or disapproved is defined].'),\n('001499','draft','2009-09-29','DISA FSO','technical','Limit privileges to change software resident within software libraries.','CM-05(06)','N/A','Determine if privileges to change software resident within software libraries are limited.'),\n('001504','draft','2009-11-02','DISA FSO','policy','Develop and document an organization-level; mission/business process-level; and/or system-level personnel security policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','PS-01a.01(a)','N/A','Determine if: - the [PS-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personnel security policy addresses purpose. - the [PS-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personnel security policy addresses scope. - the [PS-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personnel security policy addresses roles. - the [PS-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personnel security policy addresses responsibilities. - the [PS-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personnel security policy addresses management commitment. - the [PS-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personnel security policy addresses coordination among organizational entities. - the [PS-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personnel security policy addresses compliance.'),\n('001505','draft','2009-11-02','DISA FSO','policy','Disseminate an organization-level; mission/business process-level; and/or system-level personnel security policy to organization-defined personnel or roles.','PS-01a.','N/A','Determine if: - a personnel security policy is developed and documented. - the personnel security policy is disseminated to [PS-01_ODP[01]; personnel or roles to whom the personnel security policy is to be disseminated is/are defined].'),\n('001506','draft','2009-11-02','DISA FSO','policy','Review and update the current personnel security policy in accordance with organization-defined frequency.','PS-01c.01','N/A','Determine if: - the current personnel security policy is reviewed and updated [PS-01_ODP[05]; the frequency at which the current personnel security policy is reviewed and updated is defined]. - the current personnel security policy is reviewed and updated following [PS-01_ODP[06]; events that would require the current personnel security policy to be reviewed and updated are defined].'),\n('001507','draft','2009-11-02','DISA FSO','policy','Defines the frequency with which to review and update the current personnel security policy.','PS-01c.01','N/A','Determine if: - the current personnel security policy is reviewed and updated [PS-01_ODP[05]; the frequency at which the current personnel security policy is reviewed and updated is defined]. - the current personnel security policy is reviewed and updated following [PS-01_ODP[06]; events that would require the current personnel security policy to be reviewed and updated are defined].'),\n('001508','draft','2009-11-02','DISA FSO','policy','Defines the frequency with which to review and update the current personnel security procedures.','PS-01c.02','N/A','Determine if: - the current personnel security procedures are reviewed and updated [PS-01_ODP[07]; the frequency at which the current personnel security procedures are reviewed and updated is defined]. - the current personnel security procedures are reviewed and updated following [PS-01_ODP[08]; events that would require the personnel security procedures to be reviewed and updated are defined].'),\n('001509','draft','2009-11-02','DISA FSO','policy','Develop and document procedures to facilitate the implementation of the personnel security policy and associated personnel security controls.','PS-01a.02','N/A','Determine if: - Determine if personnel security procedures to facilitate the implementation of the personnel security policy and associated personnel security controls are developed and documented. - the personnel security procedures are disseminated to [PS-01_ODP[02]; personnel or roles to whom the personnel security procedures are to be disseminated is/are defined].'),\n('001510','draft','2009-11-02','DISA FSO','policy','Disseminate personnel security procedures to organization-defined personnel or roles.','PS-01a.02','N/A','Determine if: - Determine if personnel security procedures to facilitate the implementation of the personnel security policy and associated personnel security controls are developed and documented. - the personnel security procedures are disseminated to [PS-01_ODP[02]; personnel or roles to whom the personnel security procedures are to be disseminated is/are defined].'),\n('001511','draft','2009-11-02','DISA FSO','policy','Review and update the current personnel security procedures in accordance with organization-defined frequency.',NULL,'N/A',NULL),\n('001512','draft','2009-11-02','DISA FSO','policy','Assign a risk designation to all organizational positions.','PS-02a.','N/A','Determine if a risk designation is assigned to all organizational positions.'),\n('001513','draft','2009-11-02','DISA FSO','policy','Establish screening criteria for individuals filling organizational positions.','PS-02b.','N/A','Determine if screening criteria are established for individuals filling organizational positions.'),\n('001514','draft','2009-11-02','DISA FSO','policy','Review and update position risk designations in accordance with organization-defined frequency.','PS-02c.','N/A','Determine if position risk designations are reviewed and updated [PS-02_ODP; the frequency at which to review and update position risk designations is defined].'),\n('001515','draft','2009-11-02','DISA FSO','policy','Defines the frequency with which to review and update position risk designations.','PS-02c.','N/A','Determine if position risk designations are reviewed and updated [PS-02_ODP; the frequency at which to review and update position risk designations is defined].'),\n('001516','draft','2009-11-02','DISA FSO','policy','Screen individuals prior to authorizing access to the system.','PS-03a.','N/A','Determine if individuals are screened prior to authorizing access to the system.'),\n('001517','draft','2009-11-02','DISA FSO','policy','Rescreen individuals with authorized access to the system in accordance with organization-defined conditions requiring rescreening, and where rescreening is so indicated, on the organization-defined frequency of rescreening.','PS-03b.','N/A','Determine if: - individuals are rescreened in accordance with [PS-03_ODP[01]; conditions requiring rescreening of individuals are defined]. - where rescreening is so indicated, individuals are rescreened [PS-03_ODP[02]; the frequency of rescreening individuals where it is so indicated is defined].'),\n('001518','draft','2009-11-02','DISA FSO','policy','Defines the conditions requiring rescreening of individuals with authorized access to the system.','PS-03b.','N/A','Determine if: - individuals are rescreened in accordance with [PS-03_ODP[01]; conditions requiring rescreening of individuals are defined]. - where rescreening is so indicated, individuals are rescreened [PS-03_ODP[02]; the frequency of rescreening individuals where it is so indicated is defined].'),\n('001519','draft','2009-11-02','DISA FSO','policy','Defines the frequency for rescreening individuals with authorized access to the information system when organization-defined conditions requiring rescreening are met.','PS-03b.','N/A','Determine if: - individuals are rescreened in accordance with [PS-03_ODP[01]; conditions requiring rescreening of individuals are defined]. - where rescreening is so indicated, individuals are rescreened [PS-03_ODP[02]; the frequency of rescreening individuals where it is so indicated is defined].'),\n('001520','draft','2009-11-02','DISA FSO','policy','Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.','PS-03(01)','N/A','Determine if: - individuals accessing a system processing, storing, or transmitting classified information are cleared. - individuals accessing a system processing, storing, or transmitting classified information are indoctrinated to the highest classification level of the information to which they have access on the system.'),\n('001521','draft','2009-11-02','DISA FSO','policy','Verify that individuals accessing a system processing, storing, or transmitting types of classified information which require formal indoctrination, are formally indoctrinated for all of the relevant types of information to which they have access on the system.','PS-03(02)','N/A','Determine if individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination are formally indoctrinated for all of the relevant types of information to which they have access on the system.'),\n('001522','draft','2009-11-02','DISA FSO','policy','Upon termination of individual employment, disable system access within an organization-defined time period.','PS-04a.','N/A','Determine if upon termination of individual employment, system access is disabled within [PS-04_ODP[01]; a time period within which to disable system access is defined].'),\n('001523','draft','2009-11-02','DISA FSO','policy','Upon termination of individual employment, conduct exit interviews that include a discussion of organization-defined information security topics.','PS-04c.','N/A','Determine if upon termination of individual employment, exit interviews that include a discussion of [PS-04_ODP[02]; information security topics to be discussed when conducting exit interviews are defined] are conducted.'),\n('001524','draft','2009-11-02','DISA FSO','policy','Upon termination of individual employment, retrieve all security-related organizational system-related property.','PS-04d.','N/A','Determine if upon termination of individual employment, all security-related organizational system-related property is retrieved.'),\n('001525','draft','2009-11-02','DISA FSO','policy','Upon termination of individual employment, retain access to organizational information formerly controlled by the terminated individual.','PS-04e.','N/A','Determine if upon termination of individual employment, access to organizational information and systems formerly controlled by the terminated individual are retained.'),\n('001526','draft','2009-11-02','DISA FSO','policy','Upon termination of individual employment, retain access to organizational systems formerly controlled by the terminated individual.','PS-04e.','N/A','Determine if upon termination of individual employment, access to organizational information and systems formerly controlled by the terminated individual are retained.'),\n('001527','draft','2009-11-03','DISA FSO','policy','Review and confirm the ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization.','PS-05a.','N/A','Determine if the ongoing operational need for current logical and physical access authorizations to systems and facilities are reviewed and confirmed when individuals are reassigned or transferred to other positions within the organization.'),\n('001528','draft','2009-11-03','DISA FSO','policy','Initiate organization-defined transfer or reassignment actions within an organization-defined time period following the formal personnel transfer action.','PS-05b.','N/A','Determine if [PS-05_ODP[01]; transfer or reassignment actions to be initiated following transfer or reassignment are defined] are initiated within [PS-05_ODP[02]; the time period within which transfer or reassignment actions must occur following transfer or reassignment is defined].'),\n('001529','draft','2009-11-03','DISA FSO','policy','Defines transfer or reassignment actions to initiate within an organization-defined time period following the formal personnel transfer action.','PS-05b.','N/A','Determine if [PS-05_ODP[01]; transfer or reassignment actions to be initiated following transfer or reassignment are defined] are initiated within [PS-05_ODP[02]; the time period within which transfer or reassignment actions must occur following transfer or reassignment is defined].'),\n('001530','draft','2009-11-03','DISA FSO','policy','Defines the time period within which the organization initiates organization-defined transfer or reassignment actions following the formal personnel transfer action.','PS-05b.','N/A','Determine if [PS-05_ODP[01]; transfer or reassignment actions to be initiated following transfer or reassignment are defined] are initiated within [PS-05_ODP[02]; the time period within which transfer or reassignment actions must occur following transfer or reassignment is defined].'),\n('001532','draft','2009-11-03','DISA FSO','policy','Review and update the access agreements for organizational systems in accordance with organization-defined frequency.','PS-06b.','N/A','Determine if the access agreements are reviewed and updated [PS-06_ODP[01]; the frequency at which to review and update access agreements is defined].'),\n('001533','draft','2009-11-03','DISA FSO','policy','Defines the frequency with which to review and update access agreements for organizational systems.','PS-06b.','N/A','Determine if the access agreements are reviewed and updated [PS-06_ODP[01]; the frequency at which to review and update access agreements is defined].'),\n('001536','draft','2009-11-03','DISA FSO','policy','Verify that access to classified information requiring special protection is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties.','PS-06(02)(a)','N/A','Determine if access to classified information requiring special protection is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties.'),\n('001537','draft','2009-11-03','DISA FSO','policy','Verify that access to classified information requiring special protection is granted only to individuals who satisfy associated personnel security criteria.','PS-06(02)(b)','N/A','Determine if access to classified information requiring special protection is granted only to individuals who satisfy associated personnel security criteria.'),\n('001538','draft','2009-11-03','DISA FSO','policy','Verify that access to classified information requiring special protection is granted only to individuals who have read, understood, and signed a nondisclosure agreement.','PS-06(02)(c)','N/A','Determine if access to classified information requiring special protection is granted only to individuals who have read, understood, and signed a non-disclosure agreement.'),\n('001539','draft','2009-11-03','DISA FSO','policy','Establish personnel security requirements including security roles and responsibilities for external providers.','PS-07a.','N/A','Determine if personnel security requirements are established, including security roles and responsibilities for external providers.'),\n('001540','draft','2009-11-03','DISA FSO','policy','Document personnel security requirements.','PS-07c.','N/A','Determine if personnel security requirements are documented.'),\n('001541','draft','2009-11-03','DISA FSO','policy','Monitor provider compliance with personnel security requirements.','PS-07e.','N/A','Determine if provider compliance with personnel security requirements is monitored.'),\n('001544','draft','2009-11-30','DISA FSO','policy','Manage system authenticators by ensuring that authenticators have sufficient strength of mechanism for their intended use.','IA-05c.','N/A','Determine if system authenticators are managed to ensure that authenticators have sufficient strength of mechanism for their intended use.'),\n('001545','draft','2010-05-11','DISA FSO','policy','Defines a frequency for reviewing and updating the access control policy.','AC-01c.01','N/A','Determine if: - the current access control policy is reviewed and updated [AC-01_ODP[05]; the frequency at which the current access control policy is reviewed and updated is defined]. - the current access control policy is reviewed and updated following [AC-01_ODP[06]; events that would require the current access control policy to be reviewed and updated are defined].'),\n('001546','draft','2010-05-11','DISA FSO','policy','Defines a frequency for reviewing and updating the access control procedures.','AC-01c.02','N/A','Determine if: - the current access control procedures are reviewed and updated [AC-01_ODP[07]; the frequency at which the current access control procedures are reviewed and updated is defined;]. - the current access control procedures are reviewed and updated following [AC-01_ODP[08]; events that would require procedures to be reviewed and updated are defined].'),\n('001547','draft','2010-05-11','DISA FSO','policy','Defines the frequency on which it will review information system accounts for compliance with account management requirements.','AC-02j.','N/A','Determine if accounts are reviewed for compliance with account management requirements [AC-02_ODP[10]; the frequency of account review is defined].'),\n('001548','draft','2010-05-11','DISA FSO','policy','Defines the information flow control policies for controlling the flow of information within the system.','AC-04','N/A','Determine if approved authorizations are enforced for controlling the flow of information within the system and between connected systems based on [AC-04_ODP; information flow control policies within the system and between connected systems are defined].'),\n('001549','draft','2010-05-11','DISA FSO','policy','Defines the information flow control policies for controlling the flow of information between interconnected systems.','AC-04','N/A','Determine if approved authorizations are enforced for controlling the flow of information within the system and between connected systems based on [AC-04_ODP; information flow control policies within the system and between connected systems are defined].'),\n('001553','draft','2010-05-11','DISA FSO','policy','Defines security or privacy policy filters that privileged administrators have the capability to enable and disable.','AC-04(10)','N/A','Determine if: - capability is provided for privileged administrators to enable and disable [AC-04(10)_ODP[01]; security policy filters that privileged administrators have the capability to enable and disable are defined] under [AC-04(10)_ODP[03]; conditions under which privileged administrators have the capability to enable and disable security policy filters are defined]. - capability is provided for privileged administrators to enable and disable [AC-04(10)_ODP[02]; privacy policy filters that privileged administrators have the capability to enable and disable are defined] under [AC-04(10)_ODP[04]; conditions under which privileged administrators have the capability to enable and disable privacy policy filters are defined].'),\n('001554','draft','2010-05-11','DISA FSO','policy','Defines the security or privacy policy filters that privileged administrators have the capability to configure.','AC-04(11)','N/A','Determine if: - capability is provided for privileged administrators to configure [AC-04(11)_ODP[01]; security policy filters that privileged administrators have the capability to configure to support different security and privacy policies are defined] to support different security or privacy policies. - capability is provided for privileged administrators to configure [AC-04(11)_ODP[02]; privacy policy filters that privileged administrators have the capability to configure to support different security and privacy policies are defined] to support different security or privacy policies.'),\n('001558','draft','2010-05-11','DISA FSO','policy','Defines the security functions (deployed in hardware, software, and firmware) for which access must be authorized.','AC-06(01)(a)','N/A','Determine if: - access is authorized for [AC-06(01)_ODP[01]; individuals and roles with authorized access to security functions and security-relevant information are defined] to [AC-06(01)_ODP[02]; security functions (deployed in hardware) for authorized access are defined]. - access is authorized for [AC-06(01)_ODP[01]; individuals and roles with authorized access to security functions and security-relevant information are defined] to [AC-06(01)_ODP[03]; security functions (deployed in software) for authorized access are defined]. - access is authorized for [AC-06(01)_ODP[01]; individuals and roles with authorized access to security functions and security-relevant information are defined] to [AC-06(01)_ODP[04]; security functions (deployed in firmware) for authorized access are defined].'),\n('001564','draft','2010-05-11','DISA FSO','policy','Defines the frequency of security awareness and training policy reviews and updates.','AT-01c.01','N/A','Determine if: - the current awareness and training policy is reviewed and updated [AT-01_ODP[05]; the frequency at which the current awareness and training policy is reviewed and updated is defined]. - the current awareness and training policy is reviewed and updated following [AT-01_ODP[06]; events that would require the current awareness and training policy to be reviewed and updated are defined].'),\n('001565','draft','2010-05-11','DISA FSO','policy','Defines the frequency of security awareness and training procedure reviews and updates.','AT-01c.02','N/A','Determine if: - the current awareness and training procedures are reviewed and updated [AT-01_ODP[07]; the frequency at which the current awareness and training procedures are reviewed and updated is defined]. - the current awareness and training procedures are reviewed and updated following [AT-01_ODP[08]; events that would require procedures to be reviewed and updated are defined].'),\n('001566','draft','2010-05-11','DISA FSO','policy','Provide organization-defined personnel or roles with initial training in the employment and operation of physical security controls.','AT-03(02)','N/A','Determine if [AT-03(02)_ODP[01]; personnel or roles to be provided with initial and refresher training in the employment and operation of physical security controls is/are defined] is/are provided with initial and refresher training [AT-03(02)_ODP[02]; the frequency at which to provide refresher training in the employment and operation of physical security controls is defined] in the employment and operation of physical security controls.'),\n('001567','draft','2010-05-11','DISA FSO','policy','Provide organization-defined personnel or roles with refresher training, thereafter, in the employment and operation of physical security controls in accordance with the organization-defined frequency.','AT-03(02)','N/A','Determine if [AT-03(02)_ODP[01]; personnel or roles to be provided with initial and refresher training in the employment and operation of physical security controls is/are defined] is/are provided with initial and refresher training [AT-03(02)_ODP[02]; the frequency at which to provide refresher training in the employment and operation of physical security controls is defined] in the employment and operation of physical security controls.'),\n('001568','draft','2010-05-11','DISA FSO','policy','Defines a frequency for providing employees with refresher training in the employment and operation of physical security controls.','AT-03(02)','N/A','Determine if [AT-03(02)_ODP[01]; personnel or roles to be provided with initial and refresher training in the employment and operation of physical security controls is/are defined] is/are provided with initial and refresher training [AT-03(02)_ODP[02]; the frequency at which to provide refresher training in the employment and operation of physical security controls is defined] in the employment and operation of physical security controls.'),\n('001569','draft','2010-05-11','DISA FSO','policy','Defines the frequency on which the current audit and accountability policy will be reviewed and updated.','AU-01c.01','N/A','Determine if: - the current audit and accountability policy is reviewed and updated [AU-01_ODP[05]; the frequency at which the current audit and accountability policy is reviewed and updated is defined]. - the current audit and accountability policy is reviewed and updated following [AU-01_ODP[06]; events that would require the current audit and accountability policy to be reviewed and updated are defined.]'),\n('001570','draft','2010-05-11','DISA FSO','policy','Defines the frequency on which the current audit and accountability procedures will be reviewed and updated.','AU-01c.02','N/A','Determine if: - the current audit and accountability procedures are reviewed and updated [AU-01_ODP[07]; the frequency at which the current audit and accountability procedures are reviewed and updated is defined]. - the current audit and accountability procedures are reviewed and updated following [AU-01_ODP[08]; events that would require audit and accountability procedures to be reviewed and updated are defined].'),\n('001571','draft','2010-05-11','DISA FSO','policy','Defines the event types that the system is capable of logging in support of the audit function.','AU-02a.','N/A','Determine if [AU-02_ODP[01]; the event types that the system is capable of logging in support of the audit function are defined] that the system is capable of logging are identified in support of the audit logging function.'),\n('001572','draft','2010-05-11','DISA FSO','policy','Defines the personnel or roles to be alerted in the event of an audit logging process failure.','AU-05a.','N/A','Determine if [AU-05_ODP[01]; personnel or roles receiving audit logging process failure alerts are defined] are alerted in the event of an audit logging process failure within [AU-05_ODP[02]; time period for personnel or roles receiving audit logging process failure alerts is defined].'),\n('001573','draft','2010-05-11','DISA FSO','policy','Defines whether to reject or delay network traffic that exceeds organization-defined thresholds.','AU-05(03)','N/A','Determine if: - configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity are enforced. - network traffic is [AU-05(03)_ODP; one or more of the following PARAMETER VALUES is/are selected: {reject; delay}] if network traffic volume is above configured thresholds.'),\n('001577','draft','2010-05-11','DISA FSO','policy','Defines the system components from which audit records are to be compiled into the system-wide audit trail.','AU-12(01)','N/A','Determine if audit records from [AU-12(01)_ODP[01]; system components from which audit records are to be compiled into a system-wide (logical or physical) audit trail are defined] are compiled into a system-wide (logical or physical) audit trail that is time-correlated to within [AU-12(01)_ODP[02]; level of tolerance for the relationship between timestamps of individual records in the audit trail is defined].'),\n('001578','draft','2010-05-11','DISA FSO','policy','Defines the frequency to review and update the current assessment, authorization, and monitoring procedures.','CA-01c.02','N/A','Determine if: - the current assessment, authorization, and monitoring procedures are reviewed and updated [CA-01_ODP[07]; the frequency at which the current assessment, authorization, and monitoring procedures are reviewed and updated is defined]. - the current assessment, authorization, and monitoring procedures are reviewed and updated following [CA-01_ODP[08]; events that would require assessment, authorization, and monitoring procedures to be reviewed and updated are defined].'),\n('001582','draft','2010-05-11','DISA FSO','policy','Defines other forms of control assessments other than in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment that should be included as part of the control assessments.','CA-02(02)','N/A','Determine if [CA-02(02)_ODP[01]; frequency at which to include specialized assessments as part of the control assessment is defined] [CA-02(02)_ODP[02]; one of the following PARAMETER VALUES is selected: {announced; unannounced}] [CA-02(02)_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [CA-02(02)_ODP[04]; other forms of assessment are defined (if selected)]}] are included as part of control assessments.'),\n('001584','draft','2010-05-11','DISA FSO','policy','Defines the frequency with which to review and update configuration management procedures.','CM-01c.02','N/A','Determine if: - the current configuration management procedures are reviewed and updated [CM-01_ODP[07]; the frequency at which the current configuration management procedures are reviewed and updated is defined]. - the current configuration management procedures are reviewed and updated following [CM-01_ODP[08]; events that would require configuration management procedures to be reviewed and updated are defined].'),\n('001585','draft','2010-05-12','DISA FSO','policy','Defines the circumstances that require reviews and updates to the baseline configuration of the system.','CM-02b.02','N/A','Determine if the baseline configuration of the system is reviewed and updated when required due to [CM-02_ODP[02]; the circumstances requiring baseline configuration review and update are defined].'),\n('001586','draft','2010-05-12','DISA FSO','policy','Defines the configuration change control element responsible for coordinating and providing oversight for configuration change control activities.','CM-03g.','N/A','Determine if: - configuration change control activities are coordinated and overseen by [CM-03_ODP[02]; the configuration change control element responsible for coordinating and overseeing change control activities is defined]. - the configuration control element convenes [CM-03_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[CM-03_ODP[04]; the frequency at which the configuration control element convenes is defined (if selected)]; when [CM-03_ODP[05]; configuration change conditions that prompt the configuration control element to convene are defined (if selected)]}]].'),\n('001592','draft','2010-05-12','DISA FSO','policy','Defines the rules authorizing the terms and conditions of software program usage on the system.','CM-07(02)','N/A','Determine if program execution is prevented in accordance with [CM-07(02)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {[CM-07(02)_ODP[02]; policies, rules of behavior, and/or access agreements regarding software program usage and restrictions are defined (if selected)]; rules authorizing the terms and conditions of software program usage}].'),\n('001596','draft','2010-05-12','DISA FSO','policy','Defines the frequency with which to review and update the current contingency planning procedures.','CP-01c.02','N/A','Determine if: - the current contingency planning procedures are reviewed and updated [CP-01_ODP[07]; the frequency at which the current contingency planning procedures are reviewed and updated is defined]. - the current contingency planning procedures are reviewed and updated following [CP-01_ODP[08]; events that would require procedures to be reviewed and updated are defined].'),\n('001597','draft','2010-05-12','DISA FSO','policy','Disseminate contingency planning procedures to organization-defined personnel or roles.','CP-01a.02','N/A','Determine if: - contingency planning procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls are developed and documented. - the contingency planning procedures are disseminated to [CP-01_ODP[02]; personnel or roles to whom the contingency planning procedures are to be disseminated is/are defined].'),\n('001598','draft','2010-05-12','DISA FSO','policy','Review and update the current contingency planning procedures in accordance with the organization-defined frequency.','CP-01c.02','N/A','Determine if: - the current contingency planning procedures are reviewed and updated [CP-01_ODP[07]; the frequency at which the current contingency planning procedures are reviewed and updated is defined]. - the current contingency planning procedures are reviewed and updated following [CP-01_ODP[08]; events that would require procedures to be reviewed and updated are defined].'),\n('001599','draft','2010-05-12','DISA FSO','policy','Sustain operational continuity of essential missions until full system restoration at primary processing and/or storage sites.','CP-02(05)','N/A','Determine if: - the continuance of [CP-02(05)_ODP; one of the following PARAMETER VALUES is selected: {all; essential}] mission and business functions with minimal or no loss of operational continuity is planned for. - continuity is sustained until full system restoration at primary processing and/or storage sites.'),\n('001600','draft','2010-05-12','DISA FSO','policy','Sustains operational continuity of essential business functions until full system restoration at primary processing and/or storage sites.','CP-02(05)','N/A','Determine if: - the continuance of [CP-02(05)_ODP; one of the following PARAMETER VALUES is selected: {all; essential}] mission and business functions with minimal or no loss of operational continuity is planned for. - continuity is sustained until full system restoration at primary processing and/or storage sites.'),\n('001601','draft','2010-05-12','DISA FSO','policy','Sustain operational continuity of essential mission functions at alternate processing and/or storage sites until system restoration to primary processing and/or storage sites.','CP-02(06)','N/A','Determine if: - the transfer of [CP-02(06)_ODP; one of the following PARAMETER VALUES is selected: {all; essential}] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity is planned for. - operational continuity is sustained until full system restoration at primary processing and/or storage sites.'),\n('001602','draft','2010-05-12','DISA FSO','policy','Sustain operational continuity of essential business functions at alternate processing and/or storage sites until system restoration at primary processing and/or storage sites.','CP-02(06)','N/A','Determine if: - the transfer of [CP-02(06)_ODP; one of the following PARAMETER VALUES is selected: {all; essential}] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity is planned for. - operational continuity is sustained until full system restoration at primary processing and/or storage sites.'),\n('001604','draft','2010-05-12','DISA FSO','policy','Outline explicit mitigation actions for potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster.','CP-06(03)','N/A','Determine if: - potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster are identified. - explicit mitigation actions to address identified accessibility problems are outlined.'),\n('001606','draft','2010-05-12','DISA FSO','policy','Identify potential accessibility problems to outline explicit mitigation actions.','CP-07(02)','N/A','Determine if: - potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster are identified. - explicit mitigation actions to address identified accessibility problems are outlined.'),\n('001609','draft','2010-05-12','DISA FSO','policy','Activate the redundant secondary system that is not collocated with the primary system without loss of information or disruption to operations.','CP-09(06)','N/A','Determine if: - system backup is conducted by maintaining a redundant secondary system that is not collocated with the primary system. - system backup is conducted by maintaining a redundant secondary system that can be activated without loss of information or disruption to operations.'),\n('001610','draft','2010-05-12','DISA FSO','policy','Defines the time-period (by authenticator type) for changing/refreshing authenticators.','IA-05f.','N/A','Determine if system authenticators are managed through the change or refreshment of authenticators [IA-05_ODP[01]; a time period for changing or refreshing authenticators by authenticator type is defined] or when [IA-05_ODP[02]; events that trigger the change or refreshment of authenticators are defined] occur.'),\n('001621','draft','2010-05-12','DISA FSO','policy','Implement organization-defined security controls to manage the risk of compromise due to individuals having accounts on multiple systems.','IA-05(08)','N/A','Determine if [IA-05(08)_ODP; security controls implemented to manage the risk of compromise due to individuals having accounts on multiple systems are defined] are implemented to manage the risk of compromise due to individuals having accounts on multiple systems.'),\n('001625','draft','2010-05-12','DISA FSO','policy','Implement the resulting incident handling activity changes to incident response procedures, training, and testing accordingly.','IR-04c.','N/A','Determine if: - lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training, and testing. - the changes resulting from the incorporated lessons learned are implemented accordingly.'),\n('001628','draft','2010-05-12','DISA FSO','policy','Defines a frequency with which to review and update the current maintenance procedures.','MA-01c.02','N/A','Determine if: - the current maintenance procedures are reviewed and updated [MA-01_ODP[07]; the frequency with which the current maintenance procedures are reviewed and updated is defined]. - the current maintenance procedures are reviewed and updated following [MA-01_ODP[08]; events that would require the maintenance procedures to be reviewed and updated are defined].'),\n('001631','draft','2010-05-12','DISA FSO','policy','After the service is performed, inspect and sanitize the component (for potentially malicious software) before reconnecting the component to the system.','MA-04(03)(b)','N/A','Determine if: - the component to be serviced is removed from the system prior to nonlocal maintenance or diagnostic services. - the component to be serviced is sanitized (for organizational information). - the component is inspected and sanitized (for potentially malicious software) after the service is performed and before reconnecting the component to the system.'),\n('001632','draft','2010-05-12','DISA FSO','technical','Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by either physically separated communications paths or logically separated communications paths based upon encryption.','MA-04(04)(b)(01)','N/A','Determine if nonlocal maintenance sessions are protected by separating maintenance sessions from other network sessions with the system by physically separated communication paths.'),\n('001635','draft','2010-05-12','DISA FSO','policy','Remove individuals from the facility access list when access is no longer required.','PE-02d.','N/A','Determine if individuals are removed from the facility access list when access is no longer required.'),\n('001636','draft','2010-05-12','DISA FSO','policy','Defines the frequency with which to review and update the current planning policy.','PL-01c.01','N/A','Determine if: - the current planning policy is reviewed and updated [PL-01_ODP[05]; the frequency with which the current planning policy is reviewed and updated is defined]. - the current planning policy is reviewed and updated following [PL-01_ODP[06]; events that would require the current planning policy to be reviewed and updated are defined].'),\n('001637','draft','2010-05-12','DISA FSO','policy','Review and update the current planning policy in accordance with organization-defined frequency.','PL-01c.01','N/A','Determine if: - the current planning policy is reviewed and updated [PL-01_ODP[05]; the frequency with which the current planning policy is reviewed and updated is defined]. - the current planning policy is reviewed and updated following [PL-01_ODP[06]; events that would require the current planning policy to be reviewed and updated are defined].'),\n('001638','draft','2010-05-12','DISA FSO','policy','Defines the frequency with which to review and update the current planning procedures.','PL-01c.02','N/A','Determine if: - the current planning procedures are reviewed and updated [PL-01_ODP[07]; the frequency with which the current planning procedures are reviewed and updated is defined]. - the current planning procedures are reviewed and updated following [PL-01_ODP[08]; events that would require procedures to be reviewed and updated are defined].'),\n('001640','draft','2010-05-12','DISA FSO','policy','Address information security issues in the updating of a critical infrastructure and key resources protection plan.','PM-08','N/A','Determine if: - information security issues are addressed in the development of a critical infrastructure and key resources protection plan. - information security issues are addressed in the documentation of a critical infrastructure and key resources protection plan. - information security issues are addressed in the update of a critical infrastructure and key resources protection plan. - privacy issues are addressed in the development of a critical infrastructure and key resources protection plan. - privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan. - privacy issues are addressed in the update of a critical infrastructure and key resources protection plan.'),\n('001641','draft','2010-05-12','DISA FSO','policy','Defines the process for conducting random vulnerability scans on the system and hosted applications.','RA-05a.','N/A','Determine if: - systems and hosted applications are monitored for vulnerabilities [RA-05_ODP[01]; frequency for monitoring systems and hosted applications for vulnerabilities is defined] and when new vulnerabilities potentially affecting the system are identified and reported. - systems and hosted applications are scanned for vulnerabilities [RA-05_ODP[02]; frequency for scanning systems and hosted applications for vulnerabilities is defined] and when new vulnerabilities potentially affecting the system are identified and reported.'),\n('001642','draft','2010-05-12','DISA FSO','policy','Defines the organizational document in which risk assessment results are documented (e.g., security plan, privacy plan; risk assessment report).',NULL,'N/A',NULL),\n('001643','draft','2010-05-12','DISA FSO','policy','Monitor and scan for vulnerabilities in the system and hosted applications in accordance with the organization-defined process for random scans.','RA-05a.','N/A','Determine if: - systems and hosted applications are monitored for vulnerabilities [RA-05_ODP[01]; frequency for monitoring systems and hosted applications for vulnerabilities is defined] and when new vulnerabilities potentially affecting the system are identified and reported. - systems and hosted applications are scanned for vulnerabilities [RA-05_ODP[02]; frequency for scanning systems and hosted applications for vulnerabilities is defined] and when new vulnerabilities potentially affecting the system are identified and reported.'),\n('001645','draft','2010-05-12','DISA FSO','policy','The organization identifies the information system components to which privileged access is authorized for selected organization-defined vulnerability scanning activities.','RA-05(05)','N/A','Determine if privileged access authorization is implemented to [RA-05(05)_ODP[01]; system components to which privileged access is authorized for selected vulnerability scanning activities are defined] for [RA-05(05)_ODP[02]; vulnerability scanning activities selected for privileged access authorization to system components are defined].'),\n('001646','draft','2010-05-12','DISA FSO','policy','Defines the frequency with which to review and update the current system and services acquisition procedures.','SA-01c.02','N/A','Determine if: - the current system and services acquisition procedures are reviewed and updated [SA-01_ODP[07]; the frequency at which the current system and services acquisition procedures are reviewed and updated is defined]. - the current system and services acquisition procedures are reviewed and updated following [SA-01_ODP[08]; events that would require the system and services acquisition procedures to be reviewed and updated are defined].'),\n('001661','draft','2010-05-12','DISA FSO','policy','Defines the security functions, to at a minimum, include system authentication and re-authentication, for permitting users to invoke the trusted communications path.','SC-11b.','N/A','Determine if users are permitted to invoke the trusted communication path for communications between the user and the [SC-11_ODP[02]; security functions of the system are defined] of the system, including authentication and re-authentication, at a minimum.'),\n('001662','draft','2010-05-12','DISA FSO','technical','Take organization-defined corrective action when organization-defined unacceptable mobile code is identified.','SC-18(01)','N/A','Determine if: - [SC-18(01)_ODP[01]; unacceptable mobile code to be identified is defined] is identified. - [SC-18(01)_ODP[02]; corrective actions to be taken when unacceptable mobile code is identified are defined] are taken if unacceptable mobile code is identified.'),\n('001663','draft','2010-05-12','DISA FSO','technical','The information system, when operating as part of a distributed, hierarchical namespace, provides the means to enable verification of a chain of trust among parent and child domains (if the child supports secure resolution services).','SC-20b.','N/A','Determine if: - the means to indicate the security status of child zones (and if the child supports secure resolution services) is provided when operating as part of a distributed, hierarchical namespace. - the means to enable verification of a chain of trust among parent and child domains when operating as part of a distributed, hierarchical namespace is provided.'),\n('001664','draft','2010-05-12','DISA FSO','technical','Recognize only session identifiers that are system-generated.','SC-23(03)','N/A','Determine if: - a unique session identifier is generated for each session with [SC-23(03)_ODP; randomness requirements for generating a unique session identifier for each session are defined]. - only system-generated session identifiers are recognized.'),\n('001665','draft','2010-05-12','DISA FSO','technical','Preserve organization-defined system state information in the event of a system failure.','SC-24','N/A','Determine if [SC-24_ODP[01]; types of system failures for which the system components fail to a known state are defined] fail to a [SC-24_ODP[02]; known system state to which system components fail in the event of a system failure is defined] while preserving [SC-24_ODP[03]; system state information to be preserved in the event of a system failure is defined] in failure.'),\n('001669','draft','2010-05-12','DISA FSO','policy','Defines the frequency of testing malicious code protection mechanisms.','SI-03(06)(a)','N/A','Determine if malicious code protection mechanisms are tested [SI-03(06)_ODP; the frequency at which to test malicious code protection mechanisms is defined] by introducing known benign code into the system.'),\n('001670','draft','2010-05-12','DISA FSO','technical','Take organization-defined least-disruptive actions to terminate suspicious events.','SI-04(07)(b)','N/A','Determine if [SI-04(07)_ODP[02]; least-disruptive actions to terminate suspicious events are defined] are taken upon the detection of suspicious events.'),\n('001671','draft','2010-05-12','DISA FSO','policy','Analyze outbound communications traffic at selected organization-defined interior points within the system to discover anomalies.','SI-04(11)','N/A','Determine if: - outbound communications traffic at the external interfaces to the system is analyzed to discover anomalies. - outbound communications traffic at [SI-04(11)_ODP; interior points within the system where communications traffic is to be analyzed are defined] is analyzed to discover anomalies. '),\n('001673','draft','2010-05-12','DISA FSO','policy','Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.','SI-04(14)','N/A','Determine if: - a wireless intrusion detection system is employed to identify rogue wireless devices. - a wireless intrusion detection system is employed to detect attack attempts on the system. - a wireless intrusion detection system is employed to detect potential compromises or breaches to the system.'),\n('001675','draft','2010-05-12','DISA FSO','policy','Defines the personnel or roles that are to receive reports on the results of security function verification.','SI-06(03)','N/A','Determine if: - the results of security function verification are reported to [SI-06(03)_ODP; personnel or roles designated to receive the results of security and privacy function verification is/are defined]. - the results of privacy function verification are reported to [SI-06(03)_ODP; personnel or roles designated to receive the results of security and privacy function verification is/are defined].'),\n('001678','draft','2010-05-12','DISA FSO','policy','Retain information within the system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.','SI-12','N/A','Determine if: - information within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements. - information within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements. - information output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements. - information output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.'),\n('001680','draft','2010-06-09','DISA FSO','policy','Develop an organization-wide information security program plan that includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','PM-01a.02','N/A','Determine if: - the information security program plan includes the identification and assignment of roles. - the information security program plan includes the identification and assignment of responsibilities. - the information security program plan addresses management commitment. - the information security program plan addresses coordination among organizational entities. - the information security program plan addresses compliance.'),\n('001682','draft','2011-05-03','DISA FSO','technical','Automatically remove or disable emergency accounts after an organization-defined time period for each type of account.','AC-02(02)','N/A','Determine if temporary and emergency accounts are automatically [AC-02(02)_ODP[01]; one of the following PARAMETER VALUES is selected: {remove; disable}] after [AC-02(02)_ODP[02]; the time period after which to automatically remove or disable temporary or emergency accounts is defined].'),\n('001687','draft','2011-05-03','DISA FSO','policy','Verify that the use of mobile code deployed in system meets organization-defined mobile code requirements.','SC-18(02)','N/A','Determine if: - the acquisition of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined]. - the development of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined]. - the use of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined].'),\n('001688','draft','2011-05-03','DISA FSO','policy','Verify the acquisition of mobile code deployed in the system meets organization-defined mobile code requirements.','SC-18(02)','N/A','Determine if: - the acquisition of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined]. - the development of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined]. - the use of mobile code to be deployed in the system meets [SC-18(02)_ODP; mobile code requirements for the acquisition, development, and use of mobile code to be deployed in the system are defined].'),\n('001695','draft','2011-10-07','DISA FSO','technical','Prevent the execution of organization-defined unacceptable mobile code.','SC-18(03)','N/A','Determine if: - the download of [SC-18(03)_ODP; unacceptable mobile code to be prevented from downloading and executing is defined] is prevented. - the execution of [SC-18(03)_ODP; unacceptable mobile code to be prevented from downloading and executing is defined] is prevented.'),\n('001726','draft','2013-02-28','DISA FSO','policy','Use software in accordance with contract agreements.','CM-10a.','N/A','Determine if software and associated documentation are used in accordance with contract agreements and copyright laws.'),\n('001727','draft','2013-02-28','DISA FSO','policy','Use software documentation in accordance with contract agreements.','CM-10a.','N/A','Determine if software and associated documentation are used in accordance with contract agreements and copyright laws.'),\n('001728','draft','2013-02-28','DISA FSO','policy','Use software in accordance with copyright laws.','CM-10a.','N/A','Determine if software and associated documentation are used in accordance with contract agreements and copyright laws.'),\n('001729','draft','2013-02-28','DISA FSO','policy','Use software documentation in accordance with copyright laws.','CM-10a.','N/A','Determine if software and associated documentation are used in accordance with contract agreements and copyright laws.'),\n('001730','draft','2013-02-28','DISA FSO','policy','Track the use of software protected by quantity licenses to control copying of the software.','CM-10b.','N/A','Determine if the use of software and associated documentation protected by quantity licenses is tracked to control copying and distribution.'),\n('001731','draft','2013-02-28','DISA FSO','policy','Track the use of software documentation protected by quantity licenses to control distribution of the software documentation.','CM-10b.','N/A','Determine if the use of software and associated documentation protected by quantity licenses is tracked to control copying and distribution.'),\n('001732','draft','2013-02-28','DISA FSO','policy','Control the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.','CM-10c.','N/A','Determine if the use of peer-to-peer file sharing technology is controlled and documented to ensure that peer-to-peer file sharing is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.'),\n('001733','draft','2013-02-28','DISA FSO','policy','Document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.','CM-10c.','N/A','Determine if the use of peer-to-peer file sharing technology is controlled and documented to ensure that peer-to-peer file sharing is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.'),\n('001734','draft','2013-02-28','DISA FSO','policy','Defines the restrictions to be followed on the use of open source software.','CM-10(01)','N/A','Determine if [CM-10(01)_ODP; restrictions on the use of open-source software are defined] are established for the use of open-source software.'),\n('001735','draft','2013-02-28','DISA FSO','policy','Establish organization-defined restrictions on the use of open source software.','CM-10(01)','N/A','Determine if [CM-10(01)_ODP; restrictions on the use of open-source software are defined] are established for the use of open-source software.'),\n('001736','draft','2013-02-28','DISA FSO','policy','Defines the number of previous versions of the baseline configuration of the system required to support rollback.','CM-02(03)','N/A','Determine if [CM-02(03)_ODP; the number of previous baseline configuration versions to be retained is defined] of previous baseline configuration version(s) of the system is/are retained to support rollback.'),\n('001737','draft','2013-02-28','DISA FSO','policy','Defines the systems or system components that are to have organization-defined configurations applied when located in areas of significant risk.','CM-02(07)(a)','N/A','Determine if [CM-02(07)_ODP[01]; the systems or system components to be issued when individuals travel to high-risk areas are defined] with [CM-02(07)_ODP[02]; configurations for systems or system components to be issued when individuals travel to high-risk areas are defined] are issued to individuals traveling to locations that the organization deems to be of significant risk.'),\n('001738','draft','2013-02-28','DISA FSO','policy','Defines the configurations to be implemented on systems and system components when they are located in areas of significant risk.','CM-02(07)(a)','N/A','Determine if [CM-02(07)_ODP[01]; the systems or system components to be issued when individuals travel to high-risk areas are defined] with [CM-02(07)_ODP[02]; configurations for systems or system components to be issued when individuals travel to high-risk areas are defined] are issued to individuals traveling to locations that the organization deems to be of significant risk.'),\n('001739','draft','2013-02-28','DISA FSO','policy','Issue organization-defined systems or system components with organization-defined configurations to individuals traveling to locations the organization deems to be of significant risk.','CM-02(07)(a)','N/A','Determine if [CM-02(07)_ODP[01]; the systems or system components to be issued when individuals travel to high-risk areas are defined] with [CM-02(07)_ODP[02]; configurations for systems or system components to be issued when individuals travel to high-risk areas are defined] are issued to individuals traveling to locations that the organization deems to be of significant risk.'),\n('001740','draft','2013-02-28','DISA FSO','policy','Review proposed configuration-controlled changes to the system.','CM-03b.','N/A','Determine if: - proposed configuration-controlled changes to the system are reviewed. - proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security and privacy impact analyses.'),\n('001741','draft','2013-02-28','DISA FSO','policy','Document configuration change decisions associated with the system.','CM-03c.','N/A','Determine if configuration change decisions associated with the system are documented.'),\n('001742','draft','2013-02-28','DISA FSO','policy','Defines the approval authorities to be notified when proposed changes to the system are received.','CM-03(01)(b)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to notify [CM-03(01)_ODP[02]; approval authorities to be notified of and request approval for proposed changes to the system are defined] of proposed changes to the system and request change approval.'),\n('001743','draft','2013-02-28','DISA FSO','policy','Defines the security responses to be automatically implemented if baseline configurations are changed in an unauthorized manner.','CM-03(05)','N/A','Determine if [CM-03(05)_ODP; security responses to be automatically implemented are defined] are automatically implemented if baseline configurations are changed in an unauthorized manner.'),\n('001744','draft','2013-02-28','DISA FSO','technical','Implement organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.','CM-03(05)','N/A','Determine if [CM-03(05)_ODP; security responses to be automatically implemented are defined] are automatically implemented if baseline configurations are changed in an unauthorized manner.'),\n('001745','draft','2013-02-28','DISA FSO','policy','Defines the controls that are to be provided by the cryptographic mechanisms are under configuration management.','CM-03(06)','N/A','Determine if cryptographic mechanisms used to provide [CM-03(06)_ODP; controls provided by cryptographic mechanisms that are to be under configuration management are defined] are under configuration management.'),\n('001746','draft','2013-02-28','DISA FSO','policy','Ensure that cryptographic mechanisms used to provide organization-defined control are under configuration management.','CM-03(06)','N/A','Determine if cryptographic mechanisms used to provide [CM-03(06)_ODP; controls provided by cryptographic mechanisms that are to be under configuration management are defined] are under configuration management.'),\n('001751','draft','2013-02-28','DISA FSO','policy','Defines system-level information requiring enforcement of a dual authorization for system changes.','CM-05(04)','N/A','Determine if: - dual authorization for implementing changes to [CM-05(04)_ODP[01]; system components requiring dual authorization for changes are defined] is enforced. - dual authorization for implementing changes to [CM-05(04)_ODP[02]; system-level information requiring dual authorization for changes is defined] is enforced.'),\n('001752','draft','2013-02-28','DISA FSO','policy','Enforce dual authorization for implementing changes to organization-defined system-level information.','CM-05(04)','N/A','Determine if: - dual authorization for implementing changes to [CM-05(04)_ODP[01]; system components requiring dual authorization for changes are defined] is enforced. - dual authorization for implementing changes to [CM-05(04)_ODP[02]; system-level information requiring dual authorization for changes is defined] is enforced.'),\n('001753','draft','2013-02-28','DISA FSO','policy','Limit privileges to change system components within a production or operational environment.','CM-05(05)(a)','N/A','Determine if: - privileges to change system components within a production or operational environment are limited. - privileges to change system-related information within a production or operational environment are limited.'),\n('001754','draft','2013-02-28','DISA FSO','policy','Limit privileges to change system-related information within a production or operational environment.','CM-05(05)(a)','N/A','Determine if: - privileges to change system components within a production or operational environment are limited. - privileges to change system-related information within a production or operational environment are limited.'),\n('001755','draft','2013-02-28','DISA FSO','policy','Defines the system components for which any deviation from the established configuration settings are to be identified, documented, and approved.','CM-06c.','N/A','Determine if: - any deviations from established configuration settings for [CM-06_ODP[02]; system components for which approval of deviations is needed are defined] are identified and documented based on [CM-06_ODP[03]; operational requirements necessitating approval of deviations are defined]. - any deviations from established configuration settings for [CM-06_ODP[02]; system components for which approval of deviations is needed are defined] are approved.'),\n('001756','draft','2013-02-28','DISA FSO','policy','Defines the operational requirements on which the configuration settings for the organization-defined system components are to be based.','CM-06c.','N/A','Determine if: - any deviations from established configuration settings for [CM-06_ODP[02]; system components for which approval of deviations is needed are defined] are identified and documented based on [CM-06_ODP[03]; operational requirements necessitating approval of deviations are defined]. - any deviations from established configuration settings for [CM-06_ODP[02]; system components for which approval of deviations is needed are defined] are approved.'),\n('001757','draft','2013-02-28','DISA FSO','policy','Defines the actions to employ when responding to unauthorized changes to the organization-defined configuration settings.','CM-06(02)','N/A','Determine if [CM-06(02)_ODP[01]; actions to be taken upon an unauthorized change are defined] are taken in response to unauthorized changes to [CM-06(02)_ODP[02]; configuration settings requiring action upon an unauthorized change are defined].'),\n('001758','draft','2013-02-28','DISA FSO','policy','Defines the configuration settings for which to employ organization-defined actions in response to unauthorized changes.','CM-06(02)','N/A','Determine if [CM-06(02)_ODP[01]; actions to be taken upon an unauthorized change are defined] are taken in response to unauthorized changes to [CM-06(02)_ODP[02]; configuration settings requiring action upon an unauthorized change are defined].'),\n('001759','draft','2013-02-28','DISA FSO','policy','Take organization-defined actions in response to unauthorized changes to organization-defined configuration settings.','CM-06(02)','N/A','Determine if [CM-06(02)_ODP[01]; actions to be taken upon an unauthorized change are defined] are taken in response to unauthorized changes to [CM-06(02)_ODP[02]; configuration settings requiring action upon an unauthorized change are defined].'),\n('001760','draft','2013-02-28','DISA FSO','policy','Defines the frequency of system reviews to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services.','CM-07(01)(a)','N/A','Determine if the system is reviewed [CM-07(01)_ODP[01]; the frequency at which to review the system to identify unnecessary and/or non-secure functions, ports, protocols, software, and/or services is defined] to identify unnecessary and/or non-secure functions, ports, protocols, software, and services.'),\n('001761','draft','2013-02-28','DISA FSO','policy','Defines the functions, ports, protocols, software, and services within the information system that are to be disabled or removed when deemed unnecessary and/or nonsecure.','CM-07(01)(b)','N/A','Determine if: - [CM-07(01)_ODP[02]; functions to be disabled or removed when deemed unnecessary or non-secure are defined] deemed to be unnecessary and/or non-secure are disabled or removed. - [CM-07(01)_ODP[03]; ports to be disabled or removed when deemed unnecessary or non-secure are defined] deemed to be unnecessary and/or non-secure are disabled or removed. - [CM-07(01)_ODP[04]; protocols to be disabled or removed when deemed unnecessary or non-secure are defined] deemed to be unnecessary and/or non-secure are disabled or removed. - [CM-07(01)_ODP[05]; software to be disabled or removed when deemed unnecessary or non-secure is defined] deemed to be unnecessary and/or non-secure is disabled or removed. - [CM-07(01)_ODP[06]; services to be disabled or removed when deemed unnecessary or non-secure are defined] deemed to be unnecessary and/or non-secure are disabled or removed.'),\n('001762','draft','2013-02-28','DISA FSO','technical','Disable or remove organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure.','CM-07(01)(b)','N/A','Determine if: - [CM-07(01)_ODP[02]; functions to be disabled or removed when deemed unnecessary or non-secure are defined] deemed to be unnecessary and/or non-secure are disabled or removed. - [CM-07(01)_ODP[03]; ports to be disabled or removed when deemed unnecessary or non-secure are defined] deemed to be unnecessary and/or non-secure are disabled or removed. - [CM-07(01)_ODP[04]; protocols to be disabled or removed when deemed unnecessary or non-secure are defined] deemed to be unnecessary and/or non-secure are disabled or removed. - [CM-07(01)_ODP[05]; software to be disabled or removed when deemed unnecessary or non-secure is defined] deemed to be unnecessary and/or non-secure is disabled or removed. - [CM-07(01)_ODP[06]; services to be disabled or removed when deemed unnecessary or non-secure are defined] deemed to be unnecessary and/or non-secure are disabled or removed.'),\n('001763','draft','2013-02-28','DISA FSO','policy','Defines the policies regarding software program usage and restrictions.','CM-07(02)','N/A','Determine if program execution is prevented in accordance with [CM-07(02)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {[CM-07(02)_ODP[02]; policies, rules of behavior, and/or access agreements regarding software program usage and restrictions are defined (if selected)]; rules authorizing the terms and conditions of software program usage}].'),\n('001764','draft','2013-02-28','DISA FSO','technical','Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.','CM-07(02)','N/A','Determine if program execution is prevented in accordance with [CM-07(02)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {[CM-07(02)_ODP[02]; policies, rules of behavior, and/or access agreements regarding software program usage and restrictions are defined (if selected)]; rules authorizing the terms and conditions of software program usage}].'),\n('001765','draft','2013-02-28','DISA FSO','policy','Defines the software programs not authorized to execute on the system.','CM-07(04)(a)','N/A','Determine if [CM-07(04)_ODP[01]; software programs not authorized to execute on the system are defined] are identified.'),\n('001766','draft','2013-02-28','DISA FSO','policy','Identify the organization-defined software programs not authorized to execute on the system.','CM-07(04)(a)','N/A','Determine if [CM-07(04)_ODP[01]; software programs not authorized to execute on the system are defined] are identified.'),\n('001767','draft','2013-02-28','DISA FSO','technical','Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system.','CM-07(04)(b)','N/A','Determine if an allow-all, deny-by-exception policy is employed to prohibit the execution of unauthorized software programs on the system.'),\n('001768','draft','2013-02-28','DISA FSO','policy','Defines the frequency on which the list of unauthorized software programs will be reviewed and updated.','CM-07(04)(c)','N/A','Determine if the list of unauthorized software programs is reviewed and updated [CM-07(04)_ODP[02]; frequency at which to review and update the list of unauthorized software programs is defined].'),\n('001770','draft','2013-02-28','DISA FSO','policy','Review and update the list of unauthorized software programs per organization-defined frequency.','CM-07(04)(c)','N/A','Determine if the list of unauthorized software programs is reviewed and updated [CM-07(04)_ODP[02]; frequency at which to review and update the list of unauthorized software programs is defined].'),\n('001772','draft','2013-02-28','DISA FSO','policy','Defines the software programs authorized to execute on the system.','CM-07(05)(a)','N/A','Determine if [CM-07(05)_ODP[01]; software programs authorized to execute on the system are defined] are identified.'),\n('001773','draft','2013-02-28','DISA FSO','policy','Identify the organization-defined software programs authorized to execute on the system.','CM-07(05)(a)','N/A','Determine if [CM-07(05)_ODP[01]; software programs authorized to execute on the system are defined] are identified.'),\n('001774','draft','2013-02-28','DISA FSO','technical','Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system.','CM-07(05)(b)','N/A','Determine if a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system is employed.'),\n('001775','draft','2013-02-28','DISA FSO','policy','Defines the frequency on which the list of authorized software programs will be reviewed and updated.','CM-07(05)(c)','N/A','Determine if the list of authorized software programs is reviewed and updated [CM-07(05)_ODP[02]; frequency at which to review and update the list of authorized software programs is defined].'),\n('001777','draft','2013-02-28','DISA FSO','policy','Review and update the list of authorized software programs per organization-defined frequency.','CM-07(05)(c)','N/A','Determine if the list of authorized software programs is reviewed and updated [CM-07(05)_ODP[02]; frequency at which to review and update the list of authorized software programs is defined].'),\n('001779','draft','2013-02-28','DISA FSO','policy','Defines the frequency on which the system component inventory is to be reviewed and updated.','CM-08b.','N/A','Determine if the system component inventory is reviewed and updated [CM-08_ODP[02]; frequency at which to review and update the system component inventory is defined].'),\n('001780','draft','2013-02-28','DISA FSO','policy','Review and update the system component inventory per organization-defined frequency.','CM-08b.','N/A','Determine if the system component inventory is reviewed and updated [CM-08_ODP[02]; frequency at which to review and update the system component inventory is defined].'),\n('001783','draft','2013-03-01','DISA FSO','policy','Defines the personnel or roles to be notified when unauthorized hardware, software, and firmware components are detected within the system.','CM-08(03)(b)','N/A','Determine if: - [CM-08(03)_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {disable network access by unauthorized components; isolate unauthorized components; notify [CM-08(03)_ODP[06]; personnel or roles to be notified when unauthorized components are detected is/are defined (if selected)]}] are taken when unauthorized hardware is detected. - [CM-08(03)_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {disable network access by unauthorized components; isolate unauthorized components; notify [CM-08(03)_ODP[06]; personnel or roles to be notified when unauthorized components are detected is/are defined (if selected)]}] are taken when unauthorized software is detected. - [CM-08(03)_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {disable network access by unauthorized components; isolate unauthorized components; notify [CM-08(03)_ODP[06]; personnel or roles to be notified when unauthorized components are detected is/are defined (if selected)]}] are taken when unauthorized software is detected.'),\n('001784','draft','2013-03-01','DISA FSO','policy','When unauthorized hardware, software, and firmware components are detected within the system, the organization takes action to disable network access by such components, isolates the components, and/or notifies organization-defined personnel or roles.','CM-08(03)(b)','N/A','Determine if: - [CM-08(03)_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {disable network access by unauthorized components; isolate unauthorized components; notify [CM-08(03)_ODP[06]; personnel or roles to be notified when unauthorized components are detected is/are defined (if selected)]}] are taken when unauthorized hardware is detected. - [CM-08(03)_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {disable network access by unauthorized components; isolate unauthorized components; notify [CM-08(03)_ODP[06]; personnel or roles to be notified when unauthorized components are detected is/are defined (if selected)]}] are taken when unauthorized software is detected. - [CM-08(03)_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {disable network access by unauthorized components; isolate unauthorized components; notify [CM-08(03)_ODP[06]; personnel or roles to be notified when unauthorized components are detected is/are defined (if selected)]}] are taken when unauthorized software is detected.'),\n('001785','draft','2013-03-01','DISA FSO','policy','Provide a centralized repository for the inventory of system components.','CM-08(07)','N/A','Determine if a centralized repository for the system component inventory is provided.'),\n('001786','draft','2013-03-01','DISA FSO','policy','Support the tracking of system components by geographic location using organization-defined automated mechanisms.','CM-08(08)','N/A','Determine if [CM-08(08)_ODP; automated mechanisms for tracking components are defined] are used to support the tracking of system components by geographic location.'),\n('001788','draft','2013-03-01','DISA FSO','policy','Assign system components to a system.','CM-08(09)(a)','N/A','Determine if system components are assigned to a system.'),\n('001789','draft','2013-03-01','DISA FSO','policy','Receive an acknowledgement from organization-defined personnel or roles of the acquired system components to a system.','CM-08(09)(b)','N/A','Determine if an acknowledgement of the component assignment is received from [CM-08(09)_ODP; personnel or roles from which to receive an acknowledgement is/are defined].'),\n('001792','draft','2013-03-01','DISA FSO','policy','Implement a configuration management plan for the system that establishes a process for identifying configuration items throughout the system development life cycle.','CM-09b.','N/A','Determine if: - the configuration management plan establishes a process for identifying configuration items throughout the system development life cycle. - the configuration management plan establishes a process for managing the configuration of the configuration items.'),\n('001795','draft','2013-03-01','DISA FSO','policy','Implement a configuration management plan for the system that establishes a process for managing the configuration of the configuration items.','CM-09b.','N/A','Determine if: - the configuration management plan establishes a process for identifying configuration items throughout the system development life cycle. - the configuration management plan establishes a process for managing the configuration of the configuration items.'),\n('001798','draft','2013-03-01','DISA FSO','policy','Implement a configuration management plan for the system that places the configuration items under configuration management.','CM-09c.','N/A','Determine if: - the configuration management plan defines the configuration items for the system. - the configuration management plan places the configuration items under configuration management.'),\n('001799','draft','2013-03-01','DISA FSO','policy','Develop and document a configuration management plan for the system that protects the configuration management plan from unauthorized disclosure and modification.','CM-09e.','N/A','Determine if: - the configuration management plan is protected from unauthorized disclosure. - the configuration management plan is protected from unauthorized modification.'),\n('001801','draft','2013-03-01','DISA FSO','policy','Implement a configuration management plan for the system that protects the configuration management plan from unauthorized disclosure and modification.','CM-09e.','N/A','Determine if: - the configuration management plan is protected from unauthorized disclosure. - the configuration management plan is protected from unauthorized modification.'),\n('001802','draft','2013-03-01','DISA FSO','policy','Track the use of software documentation protected by quantity licenses to control copying of the software documentation.','CM-10b.','N/A','Determine if the use of software and associated documentation protected by quantity licenses is tracked to control copying and distribution.'),\n('001803','draft','2013-03-01','DISA FSO','policy','Track the use of software protected by quantity licenses to control distribution of the software.','CM-10b.','N/A','Determine if the use of software and associated documentation protected by quantity licenses is tracked to control copying and distribution.'),\n('001804','draft','2013-03-01','DISA FSO','policy','Defines the policies for governing the installation of software by users.','CM-11a.','N/A','Determine if [CM-11_ODP[01]; policies governing the installation of software by users are defined] governing the installation of software by users are established.'),\n('001805','draft','2013-03-01','DISA FSO','policy','Establish organization-defined policies governing the installation of software by users.','CM-11a.','N/A','Determine if [CM-11_ODP[01]; policies governing the installation of software by users are defined] governing the installation of software by users are established.'),\n('001806','draft','2013-03-01','DISA FSO','policy','Defines methods to be employed to enforce the software installation policies.','CM-11b.','N/A','Determine if software installation policies are enforced through [CM-11_ODP[02]; methods used to enforce software installation policies are defined].'),\n('001807','draft','2013-03-01','DISA FSO','policy','Enforce software installation policies through organization-defined methods.','CM-11b.','N/A','Determine if software installation policies are enforced through [CM-11_ODP[02]; methods used to enforce software installation policies are defined].'),\n('001808','draft','2013-03-01','DISA FSO','policy','Defines the frequency on which it will monitor software installation policy compliance.','CM-11c.','N/A','Determine if compliance with [CM-11_ODP[01]; policies governing the installation of software by users are defined] is monitored [CM-11_ODP[03]; frequency with which to monitor compliance is defined].'),\n('001809','draft','2013-03-01','DISA FSO','policy','Monitor software installation policy compliance per an organization-defined frequency.','CM-11c.','N/A','Determine if compliance with [CM-11_ODP[01]; policies governing the installation of software by users are defined] is monitored [CM-11_ODP[03]; frequency with which to monitor compliance is defined].'),\n('001813','draft','2013-03-01','DISA FSO','technical','Enforce access restrictions using organization-defined mechanisms.','CM-05(01)(a)','N/A','Determine if access restrictions for change are enforced using [CM-05(01)_ODP; mechanisms used to automate the enforcement of access restrictions are defined].'),\n('001815','draft','2013-03-01','DISA FSO','policy','Defines the controls to be applied to devices when individuals return from areas of significant risk.','CM-02(07)(b)','N/A','Determine if [CM-02(07)_ODP[03]; the controls to be applied when the individuals return from travel are defined] are applied to the systems or system components when the individuals return from travel.'),\n('001816','draft','2013-03-01','DISA FSO','policy','Apply organization-defined controls to the systems or components when the individuals return from travel.','CM-02(07)(b)','N/A','Determine if [CM-02(07)_ODP[03]; the controls to be applied when the individuals return from travel are defined] are applied to the systems or system components when the individuals return from travel.'),\n('001817','draft','2013-03-01','DISA FSO','policy','When analyzing changes to the system, looks for privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice.','CM-04(01)','N/A','Determine if: - changes to the system are analyzed in a separate test environment before implementation in an operational environment. - changes to the system are analyzed for security impacts due to flaws. - changes to the system are analyzed for privacy impacts due to flaws. - changes to the system are analyzed for security impacts due to weaknesses. - changes to the system are analyzed for privacy impacts due to weaknesses. - changes to the system are analyzed for privacy impacts due to incompatibility. - changes to the system are analyzed for privacy impacts due to incompatibility. - changes to the system are analyzed for security impacts due to intentional malice. - changes to the system are analyzed for privacy impacts due to intentional malice.'),\n('001818','draft','2013-03-01','DISA FSO','policy','Analyze changes to the system in a separate test environment before installation in an operational environment.','CM-04(01)','N/A','Determine if: - changes to the system are analyzed in a separate test environment before implementation in an operational environment. - changes to the system are analyzed for security impacts due to flaws. - changes to the system are analyzed for privacy impacts due to flaws. - changes to the system are analyzed for security impacts due to weaknesses. - changes to the system are analyzed for privacy impacts due to weaknesses. - changes to the system are analyzed for privacy impacts due to incompatibility. - changes to the system are analyzed for privacy impacts due to incompatibility. - changes to the system are analyzed for security impacts due to intentional malice. - changes to the system are analyzed for privacy impacts due to intentional malice.'),\n('001819','draft','2013-03-01','DISA FSO','policy','Implement approved configuration-controlled changes to the system.','CM-03d.','N/A','Determine if approved configuration-controlled changes to the system are implemented.'),\n('001821','draft','2013-03-01','DISA FSO','policy','Defines the organizational personnel or roles to whom the organization-level; mission/business process-level; and/or system-level configuration management policy is to be disseminated.','CM-01a.','N/A','Determine if: - a configuration management policy is developed and documented. - the configuration management policy is disseminated to [CM-01_ODP[01]; personnel or roles to whom the configuration management policy is to be disseminated is/are defined].'),\n('001822','draft','2013-03-01','DISA FSO','policy','Disseminate the organization-level; mission/business process-level; and/or system-level configuration management policy to organization-defined personnel or roles.','CM-01a.','N/A','Determine if: - a configuration management policy is developed and documented. - the configuration management policy is disseminated to [CM-01_ODP[01]; personnel or roles to whom the configuration management policy is to be disseminated is/are defined].'),\n('001824','draft','2013-03-01','DISA FSO','policy','Defines the organizational personnel or roles to whom the organization-level; mission/business process-level; and/or system-level configuration management procedures are to be disseminated.','CM-01a.02','N/A','Determine if: - configuration management procedures to facilitate the implementation of the configuration management policy and associated configuration management controls are developed and documented. - the configuration management procedures are disseminated to [CM-01_ODP[02]; personnel or roles to whom the configuration management procedures are to be disseminated is/are defined].'),\n('001825','draft','2013-03-01','DISA FSO','policy','Disseminate to organization-defined personnel or roles the procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and associated configuration management controls.','CM-01a.02','N/A','Determine if: - configuration management procedures to facilitate the implementation of the configuration management policy and associated configuration management controls are developed and documented. - the configuration management procedures are disseminated to [CM-01_ODP[02]; personnel or roles to whom the configuration management procedures are to be disseminated is/are defined].'),\n('001832','draft','2013-03-14','DISA FSO','policy','Disseminate the organization-level; mission/business process-level; and/or system-level audit and accountability policy to organization-defined personnel or roles.','AU-01a.','N/A','Determine if: - an audit and accountability policy is developed and documented. - the audit and accountability policy is disseminated to [AU-01_ODP[01]; personnel or roles to whom the audit and accountability policy is to be disseminated is/are defined].'),\n('001834','draft','2013-03-14','DISA FSO','policy','Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.','AU-01a.02','N/A','Determine if: - audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls are developed and documented. - the audit and accountability procedures are disseminated to [AU-01_ODP[02]; personnel or roles to whom the audit and accountability procedures are to be disseminated is/are defined].'),\n('001848','draft','2013-03-14','DISA FSO','policy','Defines the audit log retention requirements for allocating audit log storage capacity.','AU-04','N/A','Determine if audit log storage capacity is allocated to accommodate [AU-04_ODP; audit log retention requirements are defined].'),\n('001849','draft','2013-03-14','DISA FSO','technical','Allocate audit log storage capacity to accommodate organization-defined audit log retention requirements.','AU-04','N/A','Determine if audit log storage capacity is allocated to accommodate [AU-04_ODP; audit log retention requirements are defined].'),\n('001850','draft','2013-03-14','DISA FSO','policy','Defines the frequency to off-load audit records onto a different system or media than the system being audited.','AU-04(01)','N/A','Determine if audit logs are transferred [AU-04(01)_ODP; the frequency of audit logs transferred to a different system, system component, or media other than the system or system component conducting the logging is defined] to a different system, system component, or media other than the system or system component conducting the logging.'),\n('001851','draft','2013-03-14','DISA FSO','technical','Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.','AU-04(01)','N/A','Determine if audit logs are transferred [AU-04(01)_ODP; the frequency of audit logs transferred to a different system, system component, or media other than the system or system component conducting the logging is defined] to a different system, system component, or media other than the system or system component conducting the logging.'),\n('001852','draft','2013-03-14','DISA FSO','policy','Defines the personnel, roles and/or locations to receive a warning when allocated audit log storage volume reaches a defined percentage of maximum audit log storage capacity.','AU-05(01)','N/A','Determine if a warning is provided to [AU-05(01)_ODP[01]; personnel, roles, and/or locations to be warned when allocated audit log storage volume reaches a percentage of repository maximum audit log storage capacity] within [AU-05(01)_ODP[02]; time period for defined personnel, roles, and/or locations to be warned when allocated audit log storage volume reaches a percentage of repository maximum audit log storage capacity is defined] when allocated audit log storage volume reaches [AU-05(01)_ODP[03]; percentage of repository maximum audit log storage capacity is defined] of repository maximum audit log storage capacity.'),\n('001853','draft','2013-03-14','DISA FSO','policy','Defines the time period within which organization-defined personnel, roles, and/or locations are to receive warnings when allocated audit log storage volume reaches an organization-defined percentage of maximum audit log storage capacity.','AU-05(01)','N/A','Determine if a warning is provided to [AU-05(01)_ODP[01]; personnel, roles, and/or locations to be warned when allocated audit log storage volume reaches a percentage of repository maximum audit log storage capacity] within [AU-05(01)_ODP[02]; time period for defined personnel, roles, and/or locations to be warned when allocated audit log storage volume reaches a percentage of repository maximum audit log storage capacity is defined] when allocated audit log storage volume reaches [AU-05(01)_ODP[03]; percentage of repository maximum audit log storage capacity is defined] of repository maximum audit log storage capacity.'),\n('001854','draft','2013-03-14','DISA FSO','policy','Defines the percentage of maximum audit log storage capacity that is to be reached, at which time the system will provide a warning to organization-defined personnel, roles, and/or locations.','AU-05(01)','N/A','Determine if a warning is provided to [AU-05(01)_ODP[01]; personnel, roles, and/or locations to be warned when allocated audit log storage volume reaches a percentage of repository maximum audit log storage capacity] within [AU-05(01)_ODP[02]; time period for defined personnel, roles, and/or locations to be warned when allocated audit log storage volume reaches a percentage of repository maximum audit log storage capacity is defined] when allocated audit log storage volume reaches [AU-05(01)_ODP[03]; percentage of repository maximum audit log storage capacity is defined] of repository maximum audit log storage capacity.'),\n('001855','draft','2013-03-14','DISA FSO','technical','Provide a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit log storage volume reaches an organization-defined percentage of repository maximum audit log storage capacity.','AU-05(01)','N/A','Determine if a warning is provided to [AU-05(01)_ODP[01]; personnel, roles, and/or locations to be warned when allocated audit log storage volume reaches a percentage of repository maximum audit log storage capacity] within [AU-05(01)_ODP[02]; time period for defined personnel, roles, and/or locations to be warned when allocated audit log storage volume reaches a percentage of repository maximum audit log storage capacity is defined] when allocated audit log storage volume reaches [AU-05(01)_ODP[03]; percentage of repository maximum audit log storage capacity is defined] of repository maximum audit log storage capacity.'),\n('001856','draft','2013-03-14','DISA FSO','policy','Defines the real-time period in which to provide an alert when organization-defined audit failure events occur.','AU-05(02)','N/A','Determine if an alert is provided within [AU-05(02)_ODP[01]; real-time period requiring alerts when audit failure events (defined in AU-05(02)_ODP[03]) occur is defined] to [AU-05(02)_ODP[02]; personnel, roles, and/or locations to be alerted in real time when audit failure events (defined in AU-05(02)_ODP[03]) occur is/are defined] when [AU-05(02)_ODP[03]; audit logging failure events requiring real-time alerts are defined] occur.'),\n('001857','draft','2013-03-14','DISA FSO','policy','Defines the personnel, roles, and/or locations to receive alerts when organization-defined audit failure events occur.','AU-05(02)','N/A','Determine if an alert is provided within [AU-05(02)_ODP[01]; real-time period requiring alerts when audit failure events (defined in AU-05(02)_ODP[03]) occur is defined] to [AU-05(02)_ODP[02]; personnel, roles, and/or locations to be alerted in real time when audit failure events (defined in AU-05(02)_ODP[03]) occur is/are defined] when [AU-05(02)_ODP[03]; audit logging failure events requiring real-time alerts are defined] occur.'),\n('001858','draft','2013-03-14','DISA FSO','technical','Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.','AU-05(02)','N/A','Determine if an alert is provided within [AU-05(02)_ODP[01]; real-time period requiring alerts when audit failure events (defined in AU-05(02)_ODP[03]) occur is defined] to [AU-05(02)_ODP[02]; personnel, roles, and/or locations to be alerted in real time when audit failure events (defined in AU-05(02)_ODP[03]) occur is/are defined] when [AU-05(02)_ODP[03]; audit logging failure events requiring real-time alerts are defined] occur.'),\n('001859','draft','2013-03-14','DISA FSO','policy','Defines the network communication traffic volume thresholds reflecting limits on auditing capacity, specifying when the information system will reject or delay network traffic that exceed those thresholds.','AU-05(03)','N/A','Determine if: - configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity are enforced. - network traffic is [AU-05(03)_ODP; one or more of the following PARAMETER VALUES is/are selected: {reject; delay}] if network traffic volume is above configured thresholds.'),\n('001860','draft','2013-03-14','DISA FSO','policy','Defines the audit logging failures which, should they occur, will invoke an organization-defined system mode.','AU-05(04)','N/A','Determine if [AU-05(04)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {full system shutdown; partial system shutdown; degraded operational mode with limited mission or business functionality available}] is/are invoked in the event of [AU-05(04)_ODP[02]; audit logging failures that trigger a change in operational mode are defined], unless an alternate audit logging capability exists.'),\n('001861','draft','2013-03-14','DISA FSO','technical','Invoke a full system shutdown, partial system shutdown, or degraded operational mode with limited mission or business functionality available in the event of organization-defined audit logging failures, unless an alternate audit logging capability exists.','AU-05(04)','N/A','Determine if [AU-05(04)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {full system shutdown; partial system shutdown; degraded operational mode with limited mission or business functionality available}] is/are invoked in the event of [AU-05(04)_ODP[02]; audit logging failures that trigger a change in operational mode are defined], unless an alternate audit logging capability exists.'),\n('001862','draft','2013-03-15','DISA FSO','policy','Defines the types of inappropriate or unusual activity to be reviewed and analyzed in the audit records.','AU-06a.','N/A','Determine if system audit records are reviewed and analyzed [AU-06_ODP[01]; frequency at which system audit records are reviewed and analyzed is defined] for indications of [AU-06_ODP[02]; inappropriate or unusual activity is defined] and the potential impact of the inappropriate or unusual activity.'),\n('001863','draft','2013-03-15','DISA FSO','policy','Defines the personnel or roles to receive the reports of organization-defined inappropriate or unusual activity.','AU-06b.','N/A','Determine if findings are reported to [AU-06_ODP[03]; personnel or roles to receive findings from reviews and analyses of system records is/are defined].'),\n('001864','draft','2013-03-15','DISA FSO','policy','Integrate audit review and analysis using organization-defined automated mechanisms.','AU-06(01)','N/A','Determine if audit record review, analysis, and reporting processes are integrated using [AU-06(01)_ODP; automated mechanisms used for integrating audit record review, analysis, and reporting processes are defined].'),\n('001865','draft','2013-03-15','DISA FSO','policy','Integrate reporting processes using organization-defined automated mechanisms.','AU-06(01)','N/A','Determine if audit record review, analysis, and reporting processes are integrated using [AU-06(01)_ODP; automated mechanisms used for integrating audit record review, analysis, and reporting processes are defined].'),\n('001866','draft','2013-03-15','DISA FSO','policy','Defines the data/information to be collected from other sources to enhance its ability to identify inappropriate or unusual activity.','AU-06(05)','N/A','Determine if analysis of audit records is integrated with analysis of [AU-06(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {vulnerability scanning information; performance data; system monitoring information; [AU-06(05)_ODP[02]; data/information collected from other sources to be analyzed is defined (if selected)}]] to further enhance the ability to identify inappropriate or unusual activity.'),\n('001867','draft','2013-03-15','DISA FSO','policy','Integrate analysis of audit records with analysis of vulnerability scanning information, performance data, system monitoring information, and/or organization-defined data/information collected from other sources to further enhance the ability to identify inappropriate or unusual activity.','AU-06(05)','N/A','Determine if analysis of audit records is integrated with analysis of [AU-06(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {vulnerability scanning information; performance data; system monitoring information; [AU-06(05)_ODP[02]; data/information collected from other sources to be analyzed is defined (if selected)}]] to further enhance the ability to identify inappropriate or unusual activity.'),\n('001868','draft','2013-03-15','DISA FSO','policy','Specify the permitted actions for each information system process, role, and/or user associated with the review and analysis of audit information.','AU-06(07)','N/A','Determine if the permitted actions for each [AU-06(07)_ODP; one or more of the following PARAMETER VALUES is/are selected: {system process; role; user}] associated with the review, analysis, and reporting of audit record information are specified.'),\n('001869','draft','2013-03-15','DISA FSO','policy','Specify the permitted actions for each information system process, role, and/or user associated with the reporting of audit information.','AU-06(07)','N/A','Determine if the permitted actions for each [AU-06(07)_ODP; one or more of the following PARAMETER VALUES is/are selected: {system process; role; user}] associated with the review, analysis, and reporting of audit record information are specified.'),\n('001870','draft','2013-03-15','DISA FSO','policy','Perform a full-text analysis of logged privileged commands in a physically-distinct component or subsystem of the system, or other system that is dedicated to that analysis.','AU-06(08)','N/A','Determine if a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system or other system that is dedicated to that analysis is performed.'),\n('001871','draft','2013-03-15','DISA FSO','policy','Correlate information from non-technical sources with audit record information to enhance organization-wide situational awareness.','AU-06(09)','N/A','Determine if information from non-technical sources is correlated with audit record information to enhance organization-wide situational awareness.'),\n('001875','draft','2013-03-15','DISA FSO','technical','Provide an audit reduction capability that supports on-demand audit review and analysis.','AU-07a.','N/A','Determine if: - an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents. - if an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents.'),\n('001876','draft','2013-03-15','DISA FSO','technical','Provide an audit reduction capability that supports on-demand reporting requirements.','AU-07a.','N/A','Determine if: - an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents. - if an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents.'),\n('001877','draft','2013-03-15','DISA FSO','technical','Provide an audit reduction capability that supports after-the-fact investigations of incidents.','AU-07a.','N/A','Determine if: - an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents. - if an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents.'),\n('001878','draft','2013-03-15','DISA FSO','technical','Provide a report generation capability that supports on-demand audit review and analysis.','AU-07a.','N/A','Determine if: - an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents. - if an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents.'),\n('001879','draft','2013-03-15','DISA FSO','policy','Provide a report generation capability that supports on-demand reporting requirements.','AU-07a.','N/A','Determine if: - an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents. - if an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents.'),\n('001880','draft','2013-03-15','DISA FSO','technical','Provide a report generation capability that supports after-the-fact investigations of security incidents.','AU-07a.','N/A','Determine if: - an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents. - if an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents.'),\n('001881','draft','2013-03-15','DISA FSO','technical','Provide an audit reduction capability that does not alter original content or time ordering of audit records.','AU-07b.','N/A','Determine if: - an audit record reduction and report generation capability is provided that does not alter the original content or time ordering of audit records. - an audit record reduction and report generation capability is implemented that does not alter the original content or time ordering of audit records.'),\n('001882','draft','2013-03-15','DISA FSO','technical','Provide a report generation capability that does not alter original content or time ordering of audit records.','AU-07b.','N/A','Determine if: - an audit record reduction and report generation capability is provided that does not alter the original content or time ordering of audit records. - an audit record reduction and report generation capability is implemented that does not alter the original content or time ordering of audit records.'),\n('001883','draft','2013-03-15','DISA FSO','policy','Defines the audit fields within audit records to be processed, sorted, and searched for events of interest by the system.','AU-07(01)','N/A','Determine if: - the capability to process, sort, and search audit records for events of interest based on [AU-07(01)_ODP; fields within audit records that can be processed, sorted, or searched are defined] are provided. - the capability to process, sort, and search audit records for events of interest based on [AU-07(01)_ODP; fields within audit records that can be processed, sorted, or searched are defined] are implemented.'),\n('001888','draft','2013-03-15','DISA FSO','policy','Defines the granularity of time measurement for time stamps generated for audit records.','AU-08b.','N/A','Determine if timestamps are recorded for audit records that meet [AU-08_ODP; granularity of time measurement for audit record timestamps is defined] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or include the local time offset as part of the timestamp.'),\n('001889','draft','2013-03-15','DISA FSO','technical','Record time stamps for audit records that meet organization-defined granularity of time measurement.','AU-08b.','N/A','Determine if timestamps are recorded for audit records that meet [AU-08_ODP; granularity of time measurement for audit record timestamps is defined] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or include the local time offset as part of the timestamp.'),\n('001890','draft','2013-03-15','DISA FSO','technical','Record time stamps for audit records that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.','AU-08b.','N/A','Determine if timestamps are recorded for audit records that meet [AU-08_ODP; granularity of time measurement for audit record timestamps is defined] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or include the local time offset as part of the timestamp.'),\n('001894','draft','2013-03-15','DISA FSO','policy','Defines the subset of privileged users who will be authorized access to the management of audit functionality.','AU-09(04)','N/A','Determine if access to management of audit logging functionality is authorized only to [AU-09(04)_ODP; a subset of privileged users or roles authorized to access management of audit logging functionality is defined].'),\n('001895','draft','2013-03-15','DISA FSO','policy','Defines the audit information requiring dual authorization for movement or deletion actions.','AU-09(05)','N/A','Determine if dual authorization is enforced for the [AU-09(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {movement; deletion}] of [AU-09(05)_ODP[02]; audit information for which dual authorization is to be enforced is defined].'),\n('001896','draft','2013-03-15','DISA FSO','technical','Enforce dual authorization for movement and/or deletion of organization-defined audit information.','AU-09(05)','N/A','Determine if dual authorization is enforced for the [AU-09(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {movement; deletion}] of [AU-09(05)_ODP[02]; audit information for which dual authorization is to be enforced is defined].'),\n('001897','draft','2013-03-15','DISA FSO','policy','Defines the subset of privileged users or roles who will be authorized read-only access to audit information.','AU-09(06)','N/A','Determine if read-only access to audit information is authorized to [AU-09(06)_ODP; a subset of privileged users or roles with authorized read-only access to audit information is defined].'),\n('001898','draft','2013-03-15','DISA FSO','policy','Authorize read-only access to audit information to an organization-defined subset of privileged users or roles.','AU-09(06)','N/A','Determine if read-only access to audit information is authorized to [AU-09(06)_ODP; a subset of privileged users or roles with authorized read-only access to audit information is defined].'),\n('001899','draft','2013-03-15','DISA FSO','policy','Defines the actions to be covered by non-repudiation.','AU-10','N/A','Determine if irrefutable evidence is provided that an individual (or process acting on behalf of an individual) has performed [AU-10_ODP; actions to be covered by non-repudiation are defined].'),\n('001900','draft','2013-03-15','DISA FSO','policy','Defines the strength of binding to be applied to the binding of the identity of the information producer with the information.','AU-10(01)(a)','N/A','Determine if the identity of the information producer is bound with the information to [AU-10(01)_ODP; the strength of binding between the identity of the information producer and the information is defined].'),\n('001901','draft','2013-03-15','DISA FSO','technical','Bind the identity of the information producer with the information to an organization-defined strength of binding.','AU-10(01)(a)','N/A','Determine if the identity of the information producer is bound with the information to [AU-10(01)_ODP; the strength of binding between the identity of the information producer and the information is defined].'),\n('001902','draft','2013-03-15','DISA FSO','technical','Provide the means for authorized individuals to determine the identity of the producer of the information.','AU-10(01)(b)','N/A','Determine if the means for authorized individuals to determine the identity of the producer of the information is provided.'),\n('001903','draft','2013-03-15','DISA FSO','policy','Defines the frequency on which the system is to validate the binding of the information producer identity to the information.','AU-10(02)(a)','N/A','Determine if the binding of the information producer identity to the information is validated at [AU-10(02)_ODP[01]; the frequency at which to validate the binding of the information producer identity to the information is defined].'),\n('001904','draft','2013-03-15','DISA FSO','technical','Validate the binding of the information producer identity to the information at an organization-defined frequency.','AU-10(02)(a)','N/A','Determine if the binding of the information producer identity to the information is validated at [AU-10(02)_ODP[01]; the frequency at which to validate the binding of the information producer identity to the information is defined].'),\n('001905','draft','2013-03-15','DISA FSO','policy','Defines the actions to be performed in the event of an error when validating the binding of the information producer identity to the information.','AU-10(02)(b)','N/A','Determine if [AU-10(02)_ODP[02]; the actions to be performed in the event of a validation error are defined] in the event of a validation error are performed.'),\n('001906','draft','2013-03-15','DISA FSO','technical','Perform organization-defined actions in the event of an error when validating the binding of the information producer identity to the information.','AU-10(02)(b)','N/A','Determine if [AU-10(02)_ODP[02]; the actions to be performed in the event of a validation error are defined] in the event of a validation error are performed.'),\n('001907','draft','2013-03-15','DISA FSO','policy','Defines the security domains which will require the system validate the binding of the information reviewer identity to the information at the transfer or release points prior to release/transfer.','AU-10(04)(a)','N/A','Determine if the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between [AU-10(04)_ODP[01]; security domains for which the binding of the information reviewer identity to the information is to be validated at transfer or release are defined].'),\n('001908','draft','2013-03-15','DISA FSO','policy','Defines the action the system is to perform in the event of an information reviewer identity binding validation error.',NULL,'N/A',NULL),\n('001909','draft','2013-03-15','DISA FSO','technical','Perform organization-defined actions in the event of an information reviewer identity binding validation error.','AU-10(04)(b)','N/A','Determine if [AU-10(04)_ODP[02]; actions to be performed in the event of a validation error are defined] are performed in the event of a validation error.'),\n('001910','draft','2013-03-15','DISA FSO','policy','Defines the personnel or roles allowed to select which event types are to be logged by specific components of the system.','AU-12b.','N/A','Determine if [AU-12_ODP[02]; personnel or roles allowed to select the event types that are to be logged by specific components of the system is/are defined] is/are allowed to select the event types that are to be logged by specific components of the system.'),\n('001911','draft','2013-03-15','DISA FSO','policy','Defines the selectable event criteria to be used as the basis for changes to the auditing to be performed on organization-defined system components, by organization-defined individuals or roles, within organization-defined time thresholds.','AU-12(03)','N/A','Determine if: - the capability for [AU-12(03)_ODP[01]; individuals or roles authorized to change the logging on system components are defined] to change the logging to be performed on [AU-12(03)_ODP[02]; system components on which logging is to be performed are defined] based on [AU-12(03)_ODP[03]; selectable event criteria with which change logging is to be performed are defined] within [AU-12(03)_ODP[04]; time thresholds in which logging actions are to change is defined] is provided. - the capability for [AU-12(03)_ODP[01]; individuals or roles authorized to change the logging on system components are defined] to change the logging to be performed on [AU-12(03)_ODP[02]; system components on which logging is to be performed are defined] based on [AU-12(03)_ODP[03]; selectable event criteria with which change logging is to be performed are defined] within [AU-12(03)_ODP[04]; time thresholds in which logging actions are to change is defined] is implemented.'),\n('001912','draft','2013-03-15','DISA FSO','policy','Defines the time thresholds for organization-defined individuals or roles to change the auditing to be performed based on organization-defined selectable event criteria.','AU-12(03)','N/A','Determine if: - the capability for [AU-12(03)_ODP[01]; individuals or roles authorized to change the logging on system components are defined] to change the logging to be performed on [AU-12(03)_ODP[02]; system components on which logging is to be performed are defined] based on [AU-12(03)_ODP[03]; selectable event criteria with which change logging is to be performed are defined] within [AU-12(03)_ODP[04]; time thresholds in which logging actions are to change is defined] is provided. - the capability for [AU-12(03)_ODP[01]; individuals or roles authorized to change the logging on system components are defined] to change the logging to be performed on [AU-12(03)_ODP[02]; system components on which logging is to be performed are defined] based on [AU-12(03)_ODP[03]; selectable event criteria with which change logging is to be performed are defined] within [AU-12(03)_ODP[04]; time thresholds in which logging actions are to change is defined] is implemented.'),\n('001913','draft','2013-03-15','DISA FSO','policy','Defines the individuals or roles that are to be provided the capability to change the auditing to be performed based on organization-defined selectable event criteria, within organization-defined time thresholds.','AU-12(03)','N/A','Determine if: - the capability for [AU-12(03)_ODP[01]; individuals or roles authorized to change the logging on system components are defined] to change the logging to be performed on [AU-12(03)_ODP[02]; system components on which logging is to be performed are defined] based on [AU-12(03)_ODP[03]; selectable event criteria with which change logging is to be performed are defined] within [AU-12(03)_ODP[04]; time thresholds in which logging actions are to change is defined] is provided. - the capability for [AU-12(03)_ODP[01]; individuals or roles authorized to change the logging on system components are defined] to change the logging to be performed on [AU-12(03)_ODP[02]; system components on which logging is to be performed are defined] based on [AU-12(03)_ODP[03]; selectable event criteria with which change logging is to be performed are defined] within [AU-12(03)_ODP[04]; time thresholds in which logging actions are to change is defined] is implemented.'),\n('001914','draft','2013-03-15','DISA FSO','technical','Provide the capability for organization-defined individuals or roles to change the logging to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds.','AU-12(03)','N/A','Determine if: - the capability for [AU-12(03)_ODP[01]; individuals or roles authorized to change the logging on system components are defined] to change the logging to be performed on [AU-12(03)_ODP[02]; system components on which logging is to be performed are defined] based on [AU-12(03)_ODP[03]; selectable event criteria with which change logging is to be performed are defined] within [AU-12(03)_ODP[04]; time thresholds in which logging actions are to change is defined] is provided. - the capability for [AU-12(03)_ODP[01]; individuals or roles authorized to change the logging on system components are defined] to change the logging to be performed on [AU-12(03)_ODP[02]; system components on which logging is to be performed are defined] based on [AU-12(03)_ODP[03]; selectable event criteria with which change logging is to be performed are defined] within [AU-12(03)_ODP[04]; time thresholds in which logging actions are to change is defined] is implemented.'),\n('001915','draft','2013-03-15','DISA FSO','policy','Defines the open source information and/or information sites to be monitored for evidence of unauthorized exfiltration or disclosure of organizational information.',NULL,'N/A',NULL),\n('001917','draft','2013-03-15','DISA FSO','policy','Defines the frequency for reviewing the open source information sites being monitored.','AU-13(02)','N/A','Determine if the list of open-source information sites being monitored is reviewed [AU-13(02)_ODP; the frequency at which to review the open-source information sites being monitored is defined].'),\n('001918','draft','2013-03-15','DISA FSO','policy','Review the open source information sites being monitored per organization-defined frequency.','AU-13(02)','N/A','Determine if the list of open-source information sites being monitored is reviewed [AU-13(02)_ODP; the frequency at which to review the open-source information sites being monitored is defined].'),\n('001919','draft','2013-03-15','DISA FSO','technical','Provide the capability for organization-defined users or roles to select a user session to record; view; hear; or log the content of a user session under organization-defined circumstances.','AU-14a.','N/A','Determine if: - [AU-14_ODP[01]; users or roles who can audit the content of a user session are defined] are provided with the capability to [AU-14_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {record; view; hear; log}] the content of a user session under [AU-14_ODP[03]; circumstances under which the content of a user session can be audited are defined]. - the capability for [AU-14_ODP[01]; users or roles who can audit the content of a user session are defined] to [AU-14_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {record; view; hear; log}] the content of a user session under [AU-14_ODP[03]; circumstances under which the content of a user session can be audited are defined] is implemented.'),\n('001920','draft','2013-03-15','DISA FSO','technical','Provide the capability for authorized users to remotely view and hear content related to an established user session in real time.','AU-14(03)','N/A','Determine if: - the capability for authorized users to remotely view and hear content related to an established user session in real time is provided. - the capability for authorized users to remotely view and hear content related to an established user session in real time is implemented.'),\n('001923','draft','2013-03-15','DISA FSO','policy','Defines the audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries.','AU-16','N/A','Determine if [AU-16_ODP[01]; methods for coordinating audit information among external organizations when audit information is transmitted across organizational boundaries are defined] for coordinating [AU-16_ODP[02]; audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries is defined] among external organizations when audit information is transmitted across organizational boundaries are employed.'),\n('001924','draft','2013-03-15','DISA FSO','policy','Defines the methods to be employed when coordinating audit information among external organizations when audit information is transmitted across organizational boundaries.','AU-16','N/A','Determine if [AU-16_ODP[01]; methods for coordinating audit information among external organizations when audit information is transmitted across organizational boundaries are defined] for coordinating [AU-16_ODP[02]; audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries is defined] among external organizations when audit information is transmitted across organizational boundaries are employed.'),\n('001925','draft','2013-03-15','DISA FSO','policy','Employ organization-defined methods for coordinating organization-defined audit information among external organizations when audit information is transmitted across organizational boundaries.','AU-16','N/A','Determine if [AU-16_ODP[01]; methods for coordinating audit information among external organizations when audit information is transmitted across organizational boundaries are defined] for coordinating [AU-16_ODP[02]; audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries is defined] among external organizations when audit information is transmitted across organizational boundaries are employed.'),\n('001926','draft','2013-03-15','DISA FSO','policy','Preserve the identity of individuals in cross-organizational audit trails.','AU-16(01)','N/A','Determine if the identity of individuals in cross-organizational audit trails is preserved.'),\n('001927','draft','2013-03-15','DISA FSO','policy','Defines the organizations that will be provided cross-organizational audit information.','AU-16(02)','N/A','Determine if cross-organizational audit information is provided to [AU-16(02)_ODP[01]; organizations with which cross-organizational audit information is to be shared are defined] based on [AU-16(02)_ODP[02]; cross-organizational sharing agreements to be used when providing cross-organizational audit information to organizations are defined].'),\n('001928','draft','2013-03-15','DISA FSO','policy','Defines the cross-organizational sharing agreements to be established with organization-defined organizations authorized to be provided cross-organizational sharing of audit information.','AU-16(02)','N/A','Determine if cross-organizational audit information is provided to [AU-16(02)_ODP[01]; organizations with which cross-organizational audit information is to be shared are defined] based on [AU-16(02)_ODP[02]; cross-organizational sharing agreements to be used when providing cross-organizational audit information to organizations are defined].'),\n('001929','draft','2013-03-15','DISA FSO','policy','Provide cross-organizational audit information to organization-defined organizations based on organization-defined cross organizational sharing agreements.','AU-16(02)','N/A','Determine if cross-organizational audit information is provided to [AU-16(02)_ODP[01]; organizations with which cross-organizational audit information is to be shared are defined] based on [AU-16(02)_ODP[02]; cross-organizational sharing agreements to be used when providing cross-organizational audit information to organizations are defined].'),\n('001930','draft','2013-04-08','DISA FSO','policy','Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level audit and accountability policy is to be disseminated.','AU-01a.','N/A','Determine if: - an audit and accountability policy is developed and documented. - the audit and accountability policy is disseminated to [AU-01_ODP[01]; personnel or roles to whom the audit and accountability policy is to be disseminated is/are defined].'),\n('001931','draft','2013-04-08','DISA FSO','policy','Defines the personnel or roles to whom the audit and accountability procedures are to be disseminated.','AU-01a.02','N/A','Determine if: - audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls are developed and documented. - the audit and accountability procedures are disseminated to [AU-01_ODP[02]; personnel or roles to whom the audit and accountability procedures are to be disseminated is/are defined].'),\n('001941','draft','2013-05-03','DISA FSO','technical','Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.','IA-02(08)','N/A','Determine if replay-resistant authentication mechanisms for access to [IA-02(08)_ODP; one or more of the following PARAMETER VALUES is/are selected: {privileged accounts; non-privileged accounts}] are implemented.'),\n('001943','draft','2013-05-03','DISA FSO','policy','Defines the system accounts for which single sign-on capability will be provided.','IA-02(10)','N/A','Determine if a single sign-on capability is provided for [IA-02(10)_ODP; system accounts and services for which a single sign-on capability must be provided are defined].'),\n('001944','draft','2013-05-03','DISA FSO','policy','Defines the system services for which single sign-on capability will be provided.','IA-02(10)','N/A','Determine if a single sign-on capability is provided for [IA-02(10)_ODP; system accounts and services for which a single sign-on capability must be provided are defined].'),\n('001945','draft','2013-05-03','DISA FSO','technical','Provide a single sign-on capability for organization-defined system accounts.','IA-02(10)','N/A','Determine if a single sign-on capability is provided for [IA-02(10)_ODP; system accounts and services for which a single sign-on capability must be provided are defined].'),\n('001946','draft','2013-05-03','DISA FSO','technical','Provide a single sign-on capability for organization-defined system services.','IA-02(10)','N/A','Determine if a single sign-on capability is provided for [IA-02(10)_ODP; system accounts and services for which a single sign-on capability must be provided are defined].'),\n('001953','draft','2013-05-03','DISA FSO','technical','Accept Personal Identity Verification-compliant credentials.','IA-02(12)','N/A','Determine if Personal Identity Verification-compliant credentials are accepted and electronically verified.'),\n('001954','draft','2013-05-03','DISA FSO','technical','Electronically verify Personal Identity Verification-compliant credentials.','IA-02(12)','N/A','Determine if Personal Identity Verification-compliant credentials are accepted and electronically verified.'),\n('001955','draft','2013-05-03','DISA FSO','policy','Defines the out-of-band authentication to be implemented under organization-defined conditions.','IA-02(13)','N/A','Determine if [IA-02(13)_ODP[01]; out-of-band authentication mechanisms to be implemented are defined] mechanisms are implemented under [IA-02(13)_ODP[02]; conditions under which out-of-band authentication is to be implemented are defined].'),\n('001956','draft','2013-05-03','DISA FSO','policy','Defines the conditions for implementing organization-defined out-of-band authentication.','IA-02(13)','N/A','Determine if [IA-02(13)_ODP[01]; out-of-band authentication mechanisms to be implemented are defined] mechanisms are implemented under [IA-02(13)_ODP[02]; conditions under which out-of-band authentication is to be implemented are defined].'),\n('001957','draft','2013-05-03','DISA FSO','technical','Implement organization-defined out-of-band authentication mechanisms under organization-defined conditions.','IA-02(13)','N/A','Determine if [IA-02(13)_ODP[01]; out-of-band authentication mechanisms to be implemented are defined] mechanisms are implemented under [IA-02(13)_ODP[02]; conditions under which out-of-band authentication is to be implemented are defined].'),\n('001958','draft','2013-05-03','DISA FSO','technical','Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.','IA-03','N/A','Determine if [IA-03_ODP[01]; devices and/or types of devices to be uniquely identified and authenticated before establishing a connection are defined] are uniquely identified and authenticated before establishing a [IA-03_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {local; remote; network}] connection.'),\n('001959','draft','2013-05-03','DISA FSO','policy','Defines the devices and/or types of devices the system is to authenticate before establishing a connection.','IA-03(01)','N/A','Determine if [IA-03(01)_ODP[01]; devices and/or types of devices requiring use of cryptographically based, bidirectional authentication to authenticate before establishing one or more connections are defined] are authenticated before establishing [IA-03(01)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {local; remote; network}] connection using bidirectional authentication that is cryptographically based.'),\n('001960','draft','2013-05-03','DISA FSO','policy','Defines the lease information to be assigned to devices.','IA-03(03)(a)','N/A','Determine if: - dynamic address allocation lease information assigned to devices where addresses are allocated dynamically are standardized in accordance with [IA-03(03)_ODP[01]; lease information to be employed to standardize dynamic address allocation for devices is defined]. - dynamic address allocation lease duration assigned to devices where addresses are allocated dynamically are standardized in accordance with [IA-03(03)_ODP[02]; lease duration to be employed to standardize dynamic address allocation for devices is defined].'),\n('001961','draft','2013-05-03','DISA FSO','policy','Defines the lease duration to be assigned to devices.','IA-03(03)(a)','N/A','Determine if: - dynamic address allocation lease information assigned to devices where addresses are allocated dynamically are standardized in accordance with [IA-03(03)_ODP[01]; lease information to be employed to standardize dynamic address allocation for devices is defined]. - dynamic address allocation lease duration assigned to devices where addresses are allocated dynamically are standardized in accordance with [IA-03(03)_ODP[02]; lease duration to be employed to standardize dynamic address allocation for devices is defined].'),\n('001962','draft','2013-05-03','DISA FSO','technical','Where addresses are allocated dynamically, standardize dynamic address allocation lease information assigned to devices in accordance with organization-defined lease information.','IA-03(03)(a)','N/A','Determine if: - dynamic address allocation lease information assigned to devices where addresses are allocated dynamically are standardized in accordance with [IA-03(03)_ODP[01]; lease information to be employed to standardize dynamic address allocation for devices is defined]. - dynamic address allocation lease duration assigned to devices where addresses are allocated dynamically are standardized in accordance with [IA-03(03)_ODP[02]; lease duration to be employed to standardize dynamic address allocation for devices is defined].'),\n('001963','draft','2013-05-03','DISA FSO','technical','Where addresses are allocated dynamically, standardize dynamic address allocation lease duration assigned to devices in accordance with organization-defined lease duration.','IA-03(03)(a)','N/A','Determine if: - dynamic address allocation lease information assigned to devices where addresses are allocated dynamically are standardized in accordance with [IA-03(03)_ODP[01]; lease information to be employed to standardize dynamic address allocation for devices is defined]. - dynamic address allocation lease duration assigned to devices where addresses are allocated dynamically are standardized in accordance with [IA-03(03)_ODP[02]; lease duration to be employed to standardize dynamic address allocation for devices is defined].'),\n('001965','draft','2013-05-03','DISA FSO','policy','Defines the configuration management process that is to handle the device authentication procedures.','IA-03(04)','N/A','Determine if device identification and authentication are handled based on attestation by [IA-03(04)_ODP; configuration management process to be employed to handle device identification and authentication based on attestation is defined].'),\n('001966','draft','2013-05-03','DISA FSO','policy','Handle device identification based on attestation is handled by the organization-defined configuration management process.','IA-03(04)','N/A','Determine if device identification and authentication are handled based on attestation by [IA-03(04)_ODP; configuration management process to be employed to handle device identification and authentication based on attestation is defined].'),\n('001967','draft','2013-05-03','DISA FSO','technical','Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.','IA-03(01)','N/A','Determine if [IA-03(01)_ODP[01]; devices and/or types of devices requiring use of cryptographically based, bidirectional authentication to authenticate before establishing one or more connections are defined] are authenticated before establishing [IA-03(01)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {local; remote; network}] connection using bidirectional authentication that is cryptographically based.'),\n('001968','draft','2013-05-03','DISA FSO','policy','Defines the configuration management process that is to handle the device identification procedures.','IA-03(04)','N/A','Determine if device identification and authentication are handled based on attestation by [IA-03(04)_ODP; configuration management process to be employed to handle device identification and authentication based on attestation is defined].'),\n('001969','draft','2013-05-03','DISA FSO','policy','Handle device authentication based on attestation is handled by the organization-defined configuration management process.','IA-03(04)','N/A','Determine if device identification and authentication are handled based on attestation by [IA-03(04)_ODP; configuration management process to be employed to handle device identification and authentication based on attestation is defined].'),\n('001970','draft','2013-05-03','DISA FSO','policy','Defines the personnel or roles that authorize the assignment of individual, group, role, and device identifiers.','IA-04a.','N/A','Determine if system identifiers are managed by receiving authorization from [IA-04_ODP[01]; personnel or roles from whom authorization must be received to assign an identifier are defined] to assign to an individual, group, role, or device identifier.'),\n('001971','draft','2013-05-03','DISA FSO','policy','Manage system identifiers by receiving authorization from organization-defined personnel or roles to assign an individual, group, role, or device identifier.','IA-04a.','N/A','Determine if system identifiers are managed by receiving authorization from [IA-04_ODP[01]; personnel or roles from whom authorization must be received to assign an identifier are defined] to assign to an individual, group, role, or device identifier.'),\n('001972','draft','2013-05-03','DISA FSO','policy','Manage system identifiers by selecting an identifier that identifies an individual, group, role, or device.','IA-04b.','N/A','Determine if system identifiers are managed by selecting an identifier that identifies an individual, group, role, service, or device.'),\n('001973','draft','2013-05-03','DISA FSO','policy','Manage system identifiers by assigning the identifier to the intended individual, group, role, or device.','IA-04c.','N/A','Determine if system identifiers are managed by assigning the identifier to the intended individual, group, role, service, or device.'),\n('001974','draft','2013-05-03','DISA FSO','policy','Defines the time period for which the reuse of identifiers is prohibited.','IA-04d.','N/A','Determine if system identifiers are managed by preventing reuse of identifiers for [IA-04_ODP[02]; a time period for preventing reuse of identifiers is defined].'),\n('001975','draft','2013-05-03','DISA FSO','policy','Manage system identifiers by preventing reuse of identifiers for an organization-defined time period.','IA-04d.','N/A','Determine if system identifiers are managed by preventing reuse of identifiers for [IA-04_ODP[02]; a time period for preventing reuse of identifiers is defined].'),\n('001976','draft','2013-05-03','DISA FSO','technical','Manage individual identifiers dynamically in accordance with organization-defined identifier policy.','IA-04(05)','N/A','Determine if individual identifiers are dynamically managed in accordance with [IA-04(05)_ODP; a dynamic identifier policy for managing individual identifiers is defined].'),\n('001977','draft','2013-05-03','DISA FSO','policy','Defines the external organizations with which it will coordinate for cross-management of identifiers.','IA-04(06)','N/A','Determine if cross-organization management of identifiers is coordinated with [IA-04(06)_ODP; external organizations with whom to coordinate the cross-organization management of identifiers are defined].'),\n('001978','draft','2013-05-03','DISA FSO','policy','Coordinate with organization-defined external organizations for cross-organization management of identifiers.','IA-04(06)','N/A','Determine if cross-organization management of identifiers is coordinated with [IA-04(06)_ODP; external organizations with whom to coordinate the cross-organization management of identifiers are defined].'),\n('001980','draft','2013-05-03','DISA FSO','policy','Manage system authenticators by verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator.','IA-05a.','N/A','Determine if system authenticators are managed through the verification of the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution.'),\n('001981','draft','2013-05-03','DISA FSO','policy','Manage system authenticators by establishing administrative procedures for initial authenticator distribution.','IA-05d.','N/A','Determine if system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators.'),\n('001984','draft','2013-05-03','DISA FSO','policy','Manage system authenticators by establishing administrative procedures for revoking authenticators.','IA-05d.','N/A','Determine if system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators.'),\n('001985','draft','2013-05-03','DISA FSO','policy','Manage system authenticators by implementing administrative procedures for initial authenticator distribution.','IA-05d.','N/A','Determine if system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators.'),\n('001988','draft','2013-05-03','DISA FSO','policy','Manage system authenticators by implementing administrative procedures for revoking authenticators.','IA-05d.','N/A','Determine if system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators.'),\n('001990','draft','2013-05-03','DISA FSO','policy','Manage system authenticators by changing authenticators for group or role accounts when membership to those accounts changes.','IA-05i.','N/A','Determine if system authenticators are managed through the change of authenticators for group or role accounts when membership to those accounts changes.'),\n('001998','draft','2013-05-03','DISA FSO','policy','Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and installation.','IA-05(05)','N/A','Determine if developers and installers of system components are required to provide unique authenticators or change default authenticators prior to delivery and installation.'),\n('002001','draft','2013-05-03','DISA FSO','technical','Bind identities and authenticators dynamically using organization-defined binding rules.','IA-05(10)','N/A','Determine if identities and authenticators are dynamically bound using [IA-05(10)_ODP; rules for dynamically binding identities and authenticators are defined].'),\n('002004','draft','2013-05-03','DISA FSO','policy','Defines the biometric quality requirements to be employed by the mechanisms for biometric-based authentication.','IA-05(12)','N/A','Determine if mechanisms that satisfy [IA-05(12)_ODP; biometric quality requirements for biometric-based authentication are defined] are employed for biometric-based authentication.'),\n('002005','draft','2013-05-03','DISA FSO','technical','For biometric-based authentication, employ mechanisms that satisfy organization-defined biometric quality requirements.','IA-05(12)','N/A','Determine if mechanisms that satisfy [IA-05(12)_ODP; biometric quality requirements for biometric-based authentication are defined] are employed for biometric-based authentication.'),\n('002006','draft','2013-05-03','DISA FSO','policy','Defines the time period after which the use of cached authenticators is prohibited.','IA-05(13)','N/A','Determine if the use of cached authenticators is prohibited after [IA-05(13)_ODP; the time period after which the use of cached authenticators is prohibited is defined].'),\n('002007','draft','2013-05-03','DISA FSO','technical','Prohibit the use of cached authenticators after an organization-defined time period.','IA-05(13)','N/A','Determine if the use of cached authenticators is prohibited after [IA-05(13)_ODP; the time period after which the use of cached authenticators is prohibited is defined].'),\n('002008','draft','2013-05-03','DISA FSO','policy','For PKI-based authentication, employs an organization-wide methodology for managing the content of PKI trust stores installed across all platforms including networks, operating systems, browsers, and applications.','IA-05(14)','N/A','Determine if an organization-wide methodology for managing the content of PKI trust stores is employed across all platforms, including networks, operating systems, browsers, and applications for PKI-based authentication.'),\n('002009','draft','2013-05-03','DISA FSO','technical','Accept Personal Identity Verification-compliant credentials from other federal agencies.','IA-08(01)','N/A','Determine if: - Personal Identity Verification-compliant credentials from other federal agencies are accepted. - Personal Identity Verification-compliant credentials from other federal agencies are electronically verified.'),\n('002010','draft','2013-05-03','DISA FSO','technical','Electronically verify Personal Identity Verification-compliant credentials from other federal agencies.','IA-08(01)','N/A','Determine if: - Personal Identity Verification-compliant credentials from other federal agencies are accepted. - Personal Identity Verification-compliant credentials from other federal agencies are electronically verified.'),\n('002015','draft','2013-05-03','DISA FSO','technical','Accept federated or PKI credentials that meet organization-defined policy.',NULL,'N/A',NULL),\n('002016','draft','2013-05-03','DISA FSO','technical','Verify federated PKI credentials that meet organization-defined policy.',NULL,'N/A',NULL),\n('002018','draft','2013-05-03','DISA FSO','policy','Defines the system services and applications requiring authentication.','IA-09','N/A','Determine if [IA-09_ODP; system services and applications to be uniquely identified and authenticated are defined] are uniquely identified and authenticated before establishing communications with devices, users, or other services or applications.'),\n('002021','draft','2013-05-03','DISA FSO','policy','Uniquely identify organization-defined system services and applications before establishing communications with devices, users, or other services or applications.','IA-09','N/A','Determine if [IA-09_ODP; system services and applications to be uniquely identified and authenticated are defined] are uniquely identified and authenticated before establishing communications with devices, users, or other services or applications.'),\n('002022','draft','2013-05-03','DISA FSO','policy','Uniquely authenticate organization-defined system services and applications before establishing communications with devices, users, or other services or applications.','IA-09','N/A','Determine if [IA-09_ODP; system services and applications to be uniquely identified and authenticated are defined] are uniquely identified and authenticated before establishing communications with devices, users, or other services or applications.'),\n('002033','draft','2013-05-03','DISA FSO','policy','Defines the specific circumstances or situations when individuals accessing the system employ organization-defined supplemental authentication techniques or mechanisms.','IA-10','N/A','Determine if individuals accessing the system are required to employ [IA-10_ODP[01]; supplemental authentication techniques or mechanisms to be employed when accessing the system under specific circumstances or situations are defined] under specific [IA-10_ODP[02]; circumstances or situations that require individuals accessing the system to employ supplemental authentication techniques or mechanisms are defined].'),\n('002034','draft','2013-05-03','DISA FSO','policy','Defines the supplemental authentication techniques or mechanisms to be employed in specific organization-defined circumstances or situations by individuals accessing the system.','IA-10','N/A','Determine if individuals accessing the system are required to employ [IA-10_ODP[01]; supplemental authentication techniques or mechanisms to be employed when accessing the system under specific circumstances or situations are defined] under specific [IA-10_ODP[02]; circumstances or situations that require individuals accessing the system to employ supplemental authentication techniques or mechanisms are defined].'),\n('002035','draft','2013-05-03','DISA FSO','policy','Require individuals accessing the system employ organization-defined supplemental authentication techniques or mechanisms under specific organization-defined circumstances or situations.','IA-10','N/A','Determine if individuals accessing the system are required to employ [IA-10_ODP[01]; supplemental authentication techniques or mechanisms to be employed when accessing the system under specific circumstances or situations are defined] under specific [IA-10_ODP[02]; circumstances or situations that require individuals accessing the system to employ supplemental authentication techniques or mechanisms are defined].'),\n('002036','draft','2013-05-03','DISA FSO','policy','Defines the circumstances or situations under which users will be required to reauthenticate.','IA-11','N/A','Determine if users are required to re-authenticate when [IA-11_ODP; circumstances or situations requiring re-authentication are defined].'),\n('002038','draft','2013-05-03','DISA FSO','technical','The organization requires users to reauthenticate upon organization-defined circumstances or situations requiring reauthentication.',NULL,'N/A',NULL),\n('002042','draft','2013-05-03','DISA FSO','policy','Manage system authenticators by protecting authenticator content from unauthorized modification.','IA-05g.','N/A','Determine if system authenticators are managed through the protection of authenticator content from unauthorized disclosure and modification.'),\n('002044','draft','2013-05-29','DISA FSO','policy','Defines measures to be employed to ensure that long-term audit records generated by the system can be retrieved.','AU-11(01)','N/A','Determine if [AU-11(01)_ODP; measures to be employed to ensure that long-term audit records generated by the system can be retrieved are defined] are employed to ensure that long-term audit records generated by the system can be retrieved.'),\n('002045','draft','2013-05-29','DISA FSO','policy','Employ organization-defined measures to ensure that long-term audit records generated by the information system can be retrieved.','AU-11(01)','N/A','Determine if [AU-11(01)_ODP; measures to be employed to ensure that long-term audit records generated by the system can be retrieved are defined] are employed to ensure that long-term audit records generated by the system can be retrieved.'),\n('002047','draft','2013-05-29','DISA FSO','policy','Defines the system components on which the auditing that is to be performed can be changed by organization-defined individuals or roles.','AU-12(03)','N/A','Determine if: - the capability for [AU-12(03)_ODP[01]; individuals or roles authorized to change the logging on system components are defined] to change the logging to be performed on [AU-12(03)_ODP[02]; system components on which logging is to be performed are defined] based on [AU-12(03)_ODP[03]; selectable event criteria with which change logging is to be performed are defined] within [AU-12(03)_ODP[04]; time thresholds in which logging actions are to change is defined] is provided. - the capability for [AU-12(03)_ODP[01]; individuals or roles authorized to change the logging on system components are defined] to change the logging to be performed on [AU-12(03)_ODP[02]; system components on which logging is to be performed are defined] based on [AU-12(03)_ODP[03]; selectable event criteria with which change logging is to be performed are defined] within [AU-12(03)_ODP[04]; time thresholds in which logging actions are to change is defined] is implemented.'),\n('002048','draft','2013-06-05','DISA FSO','policy','Defines the personnel or roles to whom the awareness and training policy is disseminated.','AT-01a.','N/A','Determine if: - an awareness and training policy is developed and documented. - the awareness and training policy is disseminated to [AT-01_ODP[01]; personnel or roles to whom the awareness and training policy is to be disseminated is/are defined].'),\n('002049','draft','2013-06-05','DISA FSO','policy','Defines the personnel or roles to whom the organization-level; mission/business process-level; system-level awareness and training procedures are disseminated.','AT-01a.02','N/A','Determine if: - awareness and training procedures to facilitate the implementation of the awareness and training policy and associated access controls are developed and documented. - the awareness and training procedures are disseminated to [AT-01_ODP[02]; personnel or roles to whom the awareness and training procedures are to be disseminated is/are defined].'),\n('002050','draft','2013-06-05','DISA FSO','policy','Defines the personnel or roles to whom initial and refresher training in the employment and operation of environmental controls is to be provided.','AT-03(01)','N/A','Determine if [AT-03(01)_ODP[01]; personnel or roles to be provided with initial and refresher training in the employment and operation of environmental controls are defined] are provided with initial and refresher training [AT-03(01)_ODP[02]; the frequency at which to provide refresher training in the employment and operation of environmental controls is defined] in the employment and operation of environmental controls.'),\n('002051','draft','2013-06-05','DISA FSO','policy','Defines the personnel or roles to whom initial and refresher training in the employment and operation of physical security controls is to be provided.','AT-03(02)','N/A','Determine if [AT-03(02)_ODP[01]; personnel or roles to be provided with initial and refresher training in the employment and operation of physical security controls is/are defined] is/are provided with initial and refresher training [AT-03(02)_ODP[02]; the frequency at which to provide refresher training in the employment and operation of physical security controls is defined] in the employment and operation of physical security controls.'),\n('002052','draft','2013-06-05','DISA FSO','policy','Provide practical exercises in security training that reinforce training objectives.','AT-03(03)','N/A','Determine if: - practical exercises in security training that reinforce training objectives are provided. - practical exercises in privacy training that reinforce training objectives are provided.'),\n('002055','draft','2013-06-05','DISA FSO','policy','Provide literacy training on recognizing and reporting potential indicators of insider threat.','AT-02(02)','N/A','Determine if: - literacy training on recognizing potential indicators of insider threat is provided. - literacy training on reporting potential indicators of insider threat is provided.'),\n('002056','draft','2013-06-11','DISA FSO','policy','Defines the time period the records of configuration-controlled changes are to be retained.','CM-03d.','N/A','Determine if approved configuration-controlled changes to the system are implemented.'),\n('002057','draft','2013-06-11','DISA FSO','policy','Defines the personnel to be notified when approved changes to the system are completed.','CM-03(01)(f)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to notify [CM-03(01)_ODP[04]; personnel to be notified when approved changes are complete is/are defined] when approved changes to the system are completed.'),\n('002058','draft','2013-06-11','DISA FSO','policy','Employ automated mechanisms to notify organization-defined personnel when approved changes to the system are completed.','CM-03(01)(f)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to notify [CM-03(01)_ODP[04]; personnel to be notified when approved changes are complete is/are defined] when approved changes to the system are completed.'),\n('002059','draft','2013-06-11','DISA FSO','policy','Defines the system components for which the organization will employ automated mechanisms to centrally manage, apply, and verify configuration settings.','CM-06(01)','N/A','Determine if: - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are managed using [CM-06(01)_ODP[02]; automated mechanisms to manage configuration settings are defined]. - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are applied using [CM-06(01)_ODP[03]; automated mechanisms to apply configuration settings are defined]. - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are verified using [CM-06(01)_ODP[04]; automated mechanisms to verify configuration settings are defined].'),\n('002061','draft','2013-06-21','DISA FSO','policy','Defines the personnel or roles to whom the organization-level; mission/business process; system-level assessment, authorization, and monitoring policy is to be disseminated.','CA-01a.','N/A','Determine if: - an assessment, authorization, and monitoring policy is developed and documented. - the assessment, authorization, and monitoring policy is disseminated to [CA-01_ODP[01]; personnel or roles to whom the assessment, authorization, and monitoring policy is to be disseminated is/are defined].'),\n('002062','draft','2013-06-21','DISA FSO','policy','Defines the personnel or roles to whom the assessment, authorization, monitoring procedures are to be disseminated.','CA-01a.02','N/A','Determine if: - assessment, authorization, and monitoring procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls are developed and documented. - the assessment, authorization, and monitoring procedures are disseminated to [CA-01_ODP[02]; personnel or roles to whom the assessment, authorization, and monitoring procedures are to be disseminated is/are defined].'),\n('002065','draft','2013-06-21','DISA FSO','policy','Defines the frequency at which to conduct control assessments.','CA-02(02)','N/A','Determine if [CA-02(02)_ODP[01]; frequency at which to include specialized assessments as part of the control assessment is defined] [CA-02(02)_ODP[02]; one of the following PARAMETER VALUES is selected: {announced; unannounced}] [CA-02(02)_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [CA-02(02)_ODP[04]; other forms of assessment are defined (if selected)]}] are included as part of control assessments.'),\n('002066','draft','2013-06-21','DISA FSO','policy','Leverage the results of control assessments of the organization-defined system performed by an organization-defined external organization when the assessment meets organization-defined requirements.','CA-02(03)','N/A','Determine if the results of control assessments performed by [CA-02(03)_ODP[01]; external organizations from which the results of control assessments are leveraged are defined] on [CA-02(03)_ODP[02]; system on which a control assessment was performed by an external organization is defined] are leveraged when the assessment meets [CA-02(03)_ODP[03]; requirements to be met by the control assessment performed by an external organization on the system are defined].'),\n('002067','draft','2013-06-21','DISA FSO','policy','Defines the system for which the results of control assessments will be leveraged.',NULL,'N/A',NULL),\n('002068','draft','2013-06-21','DISA FSO','policy','Defines the external organizations from which control assessment results for organization-defined systems will be accepted.','CA-02(03)','N/A','Determine if the results of control assessments performed by [CA-02(03)_ODP[01]; external organizations from which the results of control assessments are leveraged are defined] on [CA-02(03)_ODP[02]; system on which a control assessment was performed by an external organization is defined] are leveraged when the assessment meets [CA-02(03)_ODP[03]; requirements to be met by the control assessment performed by an external organization on the system are defined].'),\n('002069','draft','2013-06-21','DISA FSO','policy','Defines the requirements the control assessments for organization-defined systems from organization-defined external organizations must meet.','CA-02(03)','N/A','Determine if the results of control assessments performed by [CA-02(03)_ODP[01]; external organizations from which the results of control assessments are leveraged are defined] on [CA-02(03)_ODP[02]; system on which a control assessment was performed by an external organization is defined] are leveraged when the assessment meets [CA-02(03)_ODP[03]; requirements to be met by the control assessment performed by an external organization on the system are defined].'),\n('002070','draft','2013-06-21','DISA FSO','policy','Develop a control assessment plan that describes the scope of the assessment including assessment team, and assessment roles and responsibilities.','CA-02b.03','N/A','Determine if: - a control assessment plan is developed that describes the scope of the assessment, including the assessment environment. - a control assessment plan is developed that describes the scope of the assessment, including the assessment team. - a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities.'),\n('002071','draft','2013-06-21','DISA FSO','policy','Defines the individuals or roles to whom the results of the control assessment are to be provided.','CA-02f.','N/A','Determine if the results of the control assessment are provided to [CA-02_ODP[02]; individuals or roles to whom control assessment results are to be provided are defined].'),\n('002083','draft','2013-06-21','DISA FSO','policy','Review and update the agreements on an organization-defined frequency.','CA-03c.','N/A','Determine if agreements are reviewed and updated [CA-03_ODP[03]; the frequency at which to review and update agreements is defined].'),\n('002084','draft','2013-06-21','DISA FSO','policy','Defines the frequency at which reviews and updates to the agreements must be conducted.','CA-03c.','N/A','Determine if agreements are reviewed and updated [CA-03_ODP[03]; the frequency at which to review and update agreements is defined].'),\n('002086','draft','2013-06-21','DISA FSO','policy','Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data.','CA-07(03)','N/A','Determine if: - trend analysis is employed to determine if control implementations used in the continuous monitoring process need to be modified based on empirical data. - trend analysis is employed to determine if the frequency of continuous monitoring activities used in the continuous monitoring process needs to be modified based on empirical data. - trend analysis is employed to determine if the types of activities used in the continuous monitoring process need to be modified based on empirical data.'),\n('002087','draft','2013-06-21','DISA FSO','policy','Establish organization-defined system-level metrics to be monitored.','CA-07a.','N/A','Determine if system-level continuous monitoring includes establishment of the following system-level metrics to be monitored: [CA-07_ODP[01]; system-level metrics to be monitored are defined].'),\n('002088','draft','2013-06-21','DISA FSO','policy','Establish organization-defined frequencies for monitoring.','CA-07b.','N/A','Determine if: - system-level continuous monitoring includes established [CA-07_ODP[02]; frequencies at which to monitor control effectiveness are defined] for monitoring. - system-level continuous monitoring includes established [CA-07_ODP[03]; frequencies at which to assess control effectiveness are defined] for assessment of control effectiveness.'),\n('002090','draft','2013-06-21','DISA FSO','policy','Implement ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy.','CA-07d.','N/A','Determine if system-level continuous monitoring includes ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy.'),\n('002091','draft','2013-06-21','DISA FSO','policy','Implement a continuous monitoring program that includes correlation and analysis of information generated by assessments and monitoring.','CA-07e.','N/A','Determine if system-level continuous monitoring includes correlation and analysis of information generated by control assessments and monitoring.'),\n('002092','draft','2013-06-21','DISA FSO','policy','Implement a continuous monitoring program that includes response actions to address results of the analysis of control assessment and monitoring information.','CA-07f.','N/A','Determine if system-level continuous monitoring includes response actions to address the results of the analysis of control assessment and monitoring information.'),\n('002093','draft','2013-06-21','DISA  FSO','policy','Conduct penetration testing in accordance with organization-defined frequency on organization-defined systems or system components.','CA-08','N/A','Determine if penetration testing is conducted [CA-08_ODP[01]; frequency at which to conduct penetration testing on systems or system components is defined] on [CA-08_ODP[02]; systems or system components on which penetration testing is to be conducted are defined].'),\n('002094','draft','2013-06-21','DISA FSO','policy','Defines the frequency for conducting penetration testing on organization-defined systems or system components.','CA-08','N/A','Determine if penetration testing is conducted [CA-08_ODP[01]; frequency at which to conduct penetration testing on systems or system components is defined] on [CA-08_ODP[02]; systems or system components on which penetration testing is to be conducted are defined].'),\n('002095','draft','2013-06-21','DISA FSO','policy','Defines the systems or system components on which penetration testing will be conducted.','CA-08','N/A','Determine if penetration testing is conducted [CA-08_ODP[01]; frequency at which to conduct penetration testing on systems or system components is defined] on [CA-08_ODP[02]; systems or system components on which penetration testing is to be conducted are defined].'),\n('002096','draft','2013-06-21','DISA FSO','policy','Employ an independent penetration agent or penetration team to perform penetration testing on the system or system components.','CA-08(01)','N/A','Determine if an independent penetration testing agent or team is employed to perform penetration testing on the system or system components.'),\n('002097','draft','2013-06-21','DISA FSP','policy','Defines red team exercises to simulate attempts by adversaries to compromise organizational systems.','CA-08(02)','N/A','Determine if [CA-08(02)_ODP; red team exercises to simulate attempts by adversaries to compromise organizational systems are defined] are employed to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement.'),\n('002099','draft','2013-06-21','DISA FSO','policy','Employ organization-defined red team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement.','CA-08(02)','N/A','Determine if [CA-08(02)_ODP; red team exercises to simulate attempts by adversaries to compromise organizational systems are defined] are employed to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement.'),\n('002100','draft','2013-06-21','DISA FSO','policy','Perform security compliance checks on constituent components prior to the establishment of the internal connection.','CA-09(01)','N/A','Determine if: - security compliance checks are performed on constituent system components prior to the establishment of the internal connection. - privacy compliance checks are performed on constituent system components prior to the establishment of the internal connection.'),\n('002101','draft','2013-06-21','DISA FSO','policy','Authorizes internal connections of organization-defined system components or classes of components to the system.','CA-09a.','N/A','Determine if internal connections of [CA-09_ODP[01]; system components or classes of components requiring internal connections to the system are defined] to the system are authorized.'),\n('002102','draft','2013-06-21','DISA FSO','policy','Defines the system components or classes of components that are authorized internal connections to the system.','CA-09a.','N/A','Determine if internal connections of [CA-09_ODP[01]; system components or classes of components requiring internal connections to the system are defined] to the system are authorized.'),\n('002103','draft','2013-06-21','DISA FSO','policy','Document, for each internal connection, the interface characteristics.','CA-09b.','N/A','Determine if: - for each internal connection, the interface characteristics are documented. - for each internal connection, the security requirements are documented. - for each internal connection, the privacy requirements are documented. - for each internal connection, the nature of the information communicated is documented.'),\n('002104','draft','2013-06-21','DISA FSO','policy','Document, for each internal connection, the security requirements.','CA-09b.','N/A','Determine if: - for each internal connection, the interface characteristics are documented. - for each internal connection, the security requirements are documented. - for each internal connection, the privacy requirements are documented. - for each internal connection, the nature of the information communicated is documented.'),\n('002105','draft','2013-06-21','DISA FSO','policy','Document, for each internal connection, the nature of the information communicated.','CA-09b.','N/A','Determine if: - for each internal connection, the interface characteristics are documented. - for each internal connection, the security requirements are documented. - for each internal connection, the privacy requirements are documented. - for each internal connection, the nature of the information communicated is documented.'),\n('002107','draft','2013-06-24','DISA FSO','policy','Defines the personnel or roles to be recipients of the organization-level; mission/business process-level; and/or system-level access control policy necessary to facilitate the implementation of the access control policy and associated access controls.','AC-01a.','N/A','Determine if: - an access control policy is developed and documented. - the access control policy is disseminated to [AC-01_ODP[01]; personnel or roles to whom the access control policy is to be disseminated is/are defined].'),\n('002108','draft','2013-06-24','DISA FSO','policy','Defines the personnel or roles to be recipients of the procedures necessary to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and associated access controls.','AC-01a.02','N/A','Determine if: - access control procedures to facilitate the implementation of the access control policy and associated controls are developed and documented. - the access control procedures are disseminated to [AC-01_ODP[02]; personnel or roles to whom the access control procedures are to be disseminated is/are defined].'),\n('002112','draft','2013-06-24','DISA FSO','policy','Assign account managers.','AC-02b.','N/A','Determine if account managers are assigned.'),\n('002115','draft','2013-06-24','DISA FSO','policy','Specify authorized users of the system.','AC-02d.01','N/A','Determine if authorized users of the system are specified.'),\n('002116','draft','2013-06-24','DISA FSO','policy','Specify authorized users of the group.','AC-02d.02','N/A','Determine if group and role membership are specified.'),\n('002117','draft','2013-06-24','DISA FSO','policy','Specify authorized users of the role membership.','AC-02d.02','N/A','Determine if group and role membership are specified.'),\n('002118','draft','2013-06-24','DISA FSO','policy','Specify authorized access authorizations (i.e., privileges) for each account.','AC-02d.03','N/A','Determine if: - access authorizations (i.e., privileges) are specified for each account. - [AC-02_ODP[02]; attributes (as required) for each account are defined] are specified for each account. '),\n('002119','draft','2013-06-24','DISA FSO','policy','Specify organization-attributes (as required) for each account on the system.','AC-02d.03','N/A','Determine if: - access authorizations (i.e., privileges) are specified for each account. - [AC-02_ODP[02]; attributes (as required) for each account are defined] are specified for each account. '),\n('002120','draft','2013-06-24','DISA FSO','policy','Defines the personnel or roles authorized to approve the creation of accounts.','AC-02e.','N/A','Determine if approvals are required by [AC-02_ODP[03]; personnel or roles required to approve requests to create accounts is/are defined] for requests to create accounts.'),\n('002121','draft','2013-06-24','DISA FSO','policy','Defines the procedures to be employed when creating, enabling, modifying, disabling, and removing information system accounts.','AC-02f.','N/A','Determine if: - accounts are created in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are enabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are modified in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are disabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are removed in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined].'),\n('002122','draft','2013-06-24','DISA FSO','policy','Monitor the use of accounts.','AC-02g.','N/A','Determine if the use of accounts is monitored.'),\n('002123','draft','2013-06-24','DISA FSO','policy','Notify account managers and organization-defined personnel or roles within an organization-defined time-period when accounts are no longer required.','AC-02h.01','N/A','Determine if account managers and [AC-02_ODP[05]; personnel or roles to be notified is/are defined] are notified within [AC-02_ODP[06]; time period within which to notify account managers when accounts are no longer required is defined] when accounts are no longer required.'),\n('002124','draft','2013-06-24','DISA FSO','policy','Notify account managers and organization-defined personnel or roles within an organization-defined time-period when users are terminated or transferred.','AC-02h.02','N/A','Determine if account managers and [AC-02_ODP[05]; personnel or roles to be notified is/are defined] are notified within [AC-02_ODP[07]; time period within which to notify account managers when users are terminated or transferred is defined] when users are terminated or transferred.'),\n('002125','draft','2013-06-24','DISA FSO','policy','Notify account managers and organization-defined personnel or roles within an organization-defined time-period when system usage or need-to-know changes for an individual.','AC-02h.03','N/A','Determine if account managers and [AC-02_ODP[05]; personnel or roles to be notified is/are defined] are notified within [AC-02_ODP[08]; time period within which to notify account managers when system usage or the need to know changes for an individual is defined] when system usage or the need to know changes for an individual.'),\n('002126','draft','2013-06-24','DISA FSO','policy','Authorize access to the system based on a valid access authorization.','AC-02i.01','N/A','Determine if access to the system is authorized based on a valid access authorization.'),\n('002127','draft','2013-06-24','DISA FSO','policy','Authorize access to the system based on intended system usage.','AC-02i.02','N/A','Determine if access to the system is authorized based on intended system usage.'),\n('002128','draft','2013-06-24','DISA FSO','policy','Authorize access to the system based on organization-defined attributes (as required).','AC-02i.03','N/A','Determine if access to the system is authorized based on [AC-02_ODP[09]; attributes needed to authorize system access (as required) are defined].'),\n('002129','draft','2013-06-24','DISA FSO','policy','Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group.','AC-02k.','N/A','Determine if: - a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group. - a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group.'),\n('002130','draft','2013-06-24','DISA FSO','technical','Automatically audit account enabling actions.','AC-02(04)','N/A','Determine if: - account creation is automatically audited. - account modification is automatically audited. - account enabling is automatically audited. - account disabling is automatically audited. - account removal actions are automatically audited.'),\n('002133','draft','2013-06-24','DISA FSO ','policy','Defines other conditions when users are required to log out.','AC-02(05)','N/A','Determine if users are required to log out when [AC-02(05)_ODP; the time period of expected inactivity or description of when to log out is defined].'),\n('002134','draft','2013-06-24','DISA FSO','policy','Defines a list of dynamic privilege management capabilities to be implemented.','AC-02(06)','N/A','Determine if [AC-02(06)_ODP; dynamic privilege management capabilities are defined] are implemented.'),\n('002135','draft','2013-06-24','DISA FSO','technical','Implement the organization-defined list of dynamic privilege management capabilities.','AC-02(06)','N/A','Determine if [AC-02(06)_ODP; dynamic privilege management capabilities are defined] are implemented.'),\n('002137','draft','2013-06-24','DISA FSO','policy','Revoke access when privileged role or attribute assignments are no longer appropriate.','AC-02(07)(d)','N/A','Determine if access is revoked when privileged role or attribute assignments are no longer appropriate.'),\n('002138','draft','2013-06-24','DISA FSO','policy','Defines the system accounts that can be dynamically created.','AC-02(08)','N/A','Determine if: - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are created dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are activated dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are managed dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are deactivated dynamically.'),\n('002139','draft','2013-06-24','DISA FSO','technical','Create organization-defined system accounts dynamically.','AC-02(08)','N/A','Determine if: - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are created dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are activated dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are managed dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are deactivated dynamically.'),\n('002140','draft','2013-06-24','DISA FSO ','policy','Defines the conditions for establishing shared/group accounts.','AC-02(09)','N/A','Determine if the use of shared and group accounts is only permitted if [AC-02(09)_ODP; conditions for establishing shared and group accounts are defined] are met.'),\n('002141','draft','2013-06-24','DISA FSO','policy','Only permit the use of shared and group accounts that meet organization-defined conditions for establishing shared and group accounts.','AC-02(09)','N/A','Determine if the use of shared and group accounts is only permitted if [AC-02(09)_ODP; conditions for establishing shared and group accounts are defined] are met.'),\n('002143','draft','2013-06-24','DISA FSO','policy','Defines the circumstances and/or usage conditions that are to be enforced for organization-defined information system accounts.','AC-02(11)','N/A','Determine if [AC-02(11)_ODP[01]; circumstances and/or usage conditions to be enforced for system accounts are defined] for [AC-02(11)_ODP[02]; system accounts subject to enforcement of circumstances and/or usage conditions are defined] are enforced.'),\n('002144','draft','2013-06-24','DISA FSO ','policy','Defines the system accounts that are to be subject to the enforcement of organization-defined circumstances and/or usage conditions.','AC-02(11)','N/A','Determine if [AC-02(11)_ODP[01]; circumstances and/or usage conditions to be enforced for system accounts are defined] for [AC-02(11)_ODP[02]; system accounts subject to enforcement of circumstances and/or usage conditions are defined] are enforced.'),\n('002145','draft','2013-06-24','DISA FSO','technical','Enforce organization-defined circumstances and/or usage conditions for organization-defined system accounts.','AC-02(11)','N/A','Determine if [AC-02(11)_ODP[01]; circumstances and/or usage conditions to be enforced for system accounts are defined] for [AC-02(11)_ODP[02]; system accounts subject to enforcement of circumstances and/or usage conditions are defined] are enforced.'),\n('002146','draft','2013-06-24','DISA FSO','policy','Defines atypical usage for which the system accounts are to be monitored.','AC-02(12)(a)','N/A','Determine if system accounts are monitored for [AC-02(12)_ODP[01]; atypical usage for which to monitor system accounts is defined].'),\n('002147','draft','2013-06-24','DISA FSO','policy','Monitor system accounts for organization-defined atypical usage.','AC-02(12)(a)','N/A','Determine if system accounts are monitored for [AC-02(12)_ODP[01]; atypical usage for which to monitor system accounts is defined].'),\n('002148','draft','2013-06-24','DISA FSO','policy','Defines the personnel or roles to whom atypical usage of system accounts are to be reported.','AC-02(12)(b)','N/A','Determine if atypical usage of system accounts is reported to [AC-02(12)_ODP[02]; personnel or roles to report atypical usage is/are defined].'),\n('002149','draft','2013-06-24','DISA FSO','policy','Report atypical usage of system accounts to organization-defined personnel or roles.','AC-02(12)(b)','N/A','Determine if atypical usage of system accounts is reported to [AC-02(12)_ODP[02]; personnel or roles to report atypical usage is/are defined].'),\n('002150','draft','2013-06-24','DISA FSO','policy','Defines the time period within which the accounts of users posing a significant risk are to be disabled after discovery of the risk.','AC-02(13)','N/A','Determine if accounts of individuals are disabled within [AC-02(13)_ODP[01]; time period within which to disable accounts of individuals who are discovered to pose significant risk is defined] of discovery of [AC-02(13)_ODP[02]; significant risks leading to disabling accounts are defined].'),\n('002151','draft','2013-06-24','DISA FSO','policy','Disable accounts of individuals within an organization-defined time-period of discovery of organization-defined significant risk.','AC-02(13)','N/A','Determine if accounts of individuals are disabled within [AC-02(13)_ODP[01]; time period within which to disable accounts of individuals who are discovered to pose significant risk is defined] of discovery of [AC-02(13)_ODP[02]; significant risks leading to disabling accounts are defined].'),\n('002152','draft','2013-06-24','DISA FSO','policy','Defines other actions necessary for which dual authorization is to be enforced.','AC-03(02)','N/A','Determine if dual authorization is enforced for [AC-03(02)_ODP; privileged commands and/or other actions requiring dual authorization are defined].'),\n('002153','draft','2013-06-24','DISA FSO','policy','Defines the mandatory access control policies that are to be enforced over all subjects and objects.','AC-03(03)','N/A','Determine if: - [AC-03(03)_ODP[01]; mandatory access control policy enforced over the set of covered subjects is defined] is enforced over the set of covered subjects specified in the policy. - [AC-03(03)_ODP[02]; mandatory access control policy enforced over the set of covered objects is defined] is enforced over the set of covered objects specified in the policy.'),\n('002154','draft','2013-06-24','DISA FSO','policy','Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy is uniformly enforced across the covered subjects and objects within the system.','AC-03(03)(a)','N/A','Determine if: - [AC-03(03)_ODP[01]; mandatory access control policy enforced over the set of covered subjects is defined] is uniformly enforced across the covered subjects within the system. - [AC-03(03)_ODP[02]; mandatory access control policy enforced over the set of covered objects is defined] is uniformly enforced across the covered objects within the system.'),\n('002155','draft','2013-06-24','DISA FSO','policy','Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects.','AC-03(03)(b)(01)','N/A','Determine if [AC-03(03)_ODP[01]; mandatory access control policy enforced over the set of covered subjects is defined] and [AC-03(03)_ODP[02]; mandatory access control policy enforced over the set of covered objects is defined] specifying that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects are enforced.'),\n('002156','draft','2013-06-24','DISA FSO','policy','Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from granting its privileges to other subjects.','AC-03(03)(b)(02)','N/A','Determine if [AC-03(03)_ODP[01]; mandatory access control policy enforced over the set of covered subjects is defined] and [AC-03(03)_ODP[02]; mandatory access control policy enforced over the set of covered objects is defined] specifying that a subject that has been granted access to information is constrained from granting its privileges to other subjects are enforced.'),\n('002157','draft','2013-06-24','DISA FSO','policy','Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from changing one or more security attributes on subjects, objects, the system, or system components.','AC-03(03)(b)(03)','N/A','Determine if [AC-03(03)_ODP[01]; mandatory access control policy enforced over the set of covered subjects is defined] and [AC-03(03)_ODP[02]; mandatory access control policy enforced over the set of covered objects is defined] specifying that a subject that has been granted access to information is constrained from changing one of more security attributes (specified by the policy) on subjects, objects, the system, or system components are enforced.'),\n('002158','draft','2013-06-24','DISA FSO','policy','Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from choosing the security attributes to be associated with newly created or modified objects.','AC-03(03)(b)(04)','N/A','Determine if [AC-03(03)_ODP[01]; mandatory access control policy enforced over the set of covered subjects is defined] and [AC-03(03)_ODP[02]; mandatory access control policy enforced over the set of covered objects is defined] specifying that a subject that has been granted access to information is constrained from choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects are enforced.'),\n('002159','draft','2013-06-24','DISA FSO ','policy','Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from choosing the attribute values to be associated with newly created or modified objects.','AC-03(03)(b)(04)','N/A','Determine if [AC-03(03)_ODP[01]; mandatory access control policy enforced over the set of covered subjects is defined] and [AC-03(03)_ODP[02]; mandatory access control policy enforced over the set of covered objects is defined] specifying that a subject that has been granted access to information is constrained from choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects are enforced.'),\n('002160','draft','2013-06-24','DISA FSO','policy','Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from changing the rules governing access control.','AC-03(03)(b)(05)','N/A','Determine if [AC-03(03)_ODP[01]; mandatory access control policy enforced over the set of covered subjects is defined] and [AC-03(03)_ODP[02]; mandatory access control policy enforced over the set of covered objects is defined] specifying that a subject that has been granted access to information is constrained from changing the rules governing access control are enforced.'),\n('002161','draft','2013-06-24','DISA FSO','policy','Defines subjects which may explicitly be granted organization-defined privileges such that they are not limited by any of the mandatory access control constraints.','AC-03(03)(c)','N/A','Determine if [AC-03(03)_ODP[01]; mandatory access control policy enforced over the set of covered subjects is defined] and [AC-03(03)_ODP[02]; mandatory access control policy enforced over the set of covered objects is defined] specifying that [AC-03(03)_ODP[03]; subjects to be explicitly granted privileges are defined] may explicitly be granted [AC-03(03)_ODP[04]; privileges to be explicitly granted to subjects are defined] such that they are not limited by any defined subset (or all) of the above constraints are enforced.'),\n('002162','draft','2013-06-24','DISA FSO','policy','Defines the privileges that may explicitly be granted to organization-defined subjects such that they are not limited by any of the mandatory access control constraints.','AC-03(04)','N/A','Determine if: - [AC-03(04)_ODP[01]; discretionary access control policy enforced over the set of covered subjects is defined] is enforced over the set of covered subjects specified in the policy. - [AC-03(04)_ODP[02]; discretionary access control policy enforced over the set of covered objects is defined] is enforced over the set of covered objects specified in the policy.'),\n('002163','draft','2013-06-24','DISA FSO','policy','Defines the discretionary access control policies the information system is to enforce over subjects and objects.',NULL,'N/A',NULL),\n('002164','draft','2013-06-24','DISA FSO','policy','Enforce organization-defined discretionary access control policy that over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: pass the information to any other subjects or objects; grant its privileges to other subjects; change security attributes on subjects, objects, the system, or the system''s components; choose the security attributes to be associated with newly created or revised objects; and/or change the rules governing access control.',NULL,'N/A',NULL),\n('002165','draft','2013-06-24','DISA FSO','technical','Enforce organization-defined discretionary access control policies over defined subjects and objects.',NULL,'N/A',NULL),\n('002166','draft','2013-06-24','DISA FSO','policy','Defines the role-based access control policies to enforce over all subjects and objects.','AC-03(07)','N/A','Determine if: - a role-based access control policy is enforced over defined subjects. - a role-based access control policy is enforced over defined objects. - access is controlled based on [AC-03(07)_ODP[01]; roles upon which to base control of access are defined] and [AC-03(07)_ODP[02]; users authorized to assume roles (defined in AC-03(07)_ODP[01]) are defined.]'),\n('002169','draft','2013-06-24','DISA FSO','technical','Enforce a role-based access control policy over defined subjects and objects based upon organization-defined roles and users authorized to assume such roles.','AC-03(07)','N/A','Determine if: - a role-based access control policy is enforced over defined subjects. - a role-based access control policy is enforced over defined objects. - access is controlled based on [AC-03(07)_ODP[01]; roles upon which to base control of access are defined] and [AC-03(07)_ODP[02]; users authorized to assume roles (defined in AC-03(07)_ODP[01]) are defined.]'),\n('002170','draft','2013-06-24','DISA FSO','policy','Control access based upon organization-defined roles and users authorized to assume such roles.','AC-03(07)','N/A','Determine if: - a role-based access control policy is enforced over defined subjects. - a role-based access control policy is enforced over defined objects. - access is controlled based on [AC-03(07)_ODP[01]; roles upon which to base control of access are defined] and [AC-03(07)_ODP[02]; users authorized to assume roles (defined in AC-03(07)_ODP[01]) are defined.]'),\n('002173','draft','2013-06-24','DISA FSO','policy','Defines the roles authorized to control access based upon the role-based access control policy.','AC-03(07)','N/A','Determine if: - a role-based access control policy is enforced over defined subjects. - a role-based access control policy is enforced over defined objects. - access is controlled based on [AC-03(07)_ODP[01]; roles upon which to base control of access are defined] and [AC-03(07)_ODP[02]; users authorized to assume roles (defined in AC-03(07)_ODP[01]) are defined.]'),\n('002174','draft','2013-06-24','DISA FSO','policy','Defines the users authorized to control access based upon the role-based access control policy.','AC-03(07)','N/A','Determine if: - a role-based access control policy is enforced over defined subjects. - a role-based access control policy is enforced over defined objects. - access is controlled based on [AC-03(07)_ODP[01]; roles upon which to base control of access are defined] and [AC-03(07)_ODP[02]; users authorized to assume roles (defined in AC-03(07)_ODP[01]) are defined.]'),\n('002177','draft','2013-06-24','DISA FSO','policy','Defines the rules governing the timing of revocation of access authorizations.','AC-03(08)','N/A','Determine if: - revocation of access authorizations is enforced, resulting from changes to the security attributes of subjects based on [AC-03(08)_ODP; rules governing the timing of revocations of access authorizations are defined]. - revocation of access authorizations is enforced resulting from changes to the security attributes of objects based on [AC-03(08)_ODP; rules governing the timing of revocations of access authorizations are defined].'),\n('002178','draft','2013-06-24','DISA FSO','technical','Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects based on organization-defined rules governing the timing of revocations of access authorizations.','AC-03(08)','N/A','Determine if: - revocation of access authorizations is enforced, resulting from changes to the security attributes of subjects based on [AC-03(08)_ODP; rules governing the timing of revocations of access authorizations are defined]. - revocation of access authorizations is enforced resulting from changes to the security attributes of objects based on [AC-03(08)_ODP; rules governing the timing of revocations of access authorizations are defined].'),\n('002179','draft','2013-06-24','DISA FSO','technical','Enforce the revocation of access authorizations resulting from changes to the security attributes of objects based on organization-defined rules governing the timing of revocations of access authorizations.','AC-03(08)','N/A','Determine if: - revocation of access authorizations is enforced, resulting from changes to the security attributes of subjects based on [AC-03(08)_ODP; rules governing the timing of revocations of access authorizations are defined]. - revocation of access authorizations is enforced resulting from changes to the security attributes of objects based on [AC-03(08)_ODP; rules governing the timing of revocations of access authorizations are defined].'),\n('002180','draft','2013-06-24','DISA FSO','policy','Defines the controls the organization-defined system or system component is to provide to protect information released outside the established system boundary.','AC-03(09)(a)','N/A','Determine if information is released outside of the system only if the receiving [AC-03(09)_ODP[01]; the outside system or system component to which to release information is defined] provides [AC-03(09)_ODP[02]; controls to be provided by the outside system or system component (defined in AC-03(09)_ODP[01]) are defined].'),\n('002181','draft','2013-06-24','DISA FSO','policy','Defines system or system components that are to provide organization-defined controls to protect information received outside the established system boundary.','AC-03(09)(a)','N/A','Determine if information is released outside of the system only if the receiving [AC-03(09)_ODP[01]; the outside system or system component to which to release information is defined] provides [AC-03(09)_ODP[02]; controls to be provided by the outside system or system component (defined in AC-03(09)_ODP[01]) are defined].'),\n('002182','draft','2013-06-24','DISA FSO','policy','Release information outside of the established system boundary only if organization-defined system or system components provides organization-defined controls.','AC-03(09)(a)','N/A','Determine if information is released outside of the system only if the receiving [AC-03(09)_ODP[01]; the outside system or system component to which to release information is defined] provides [AC-03(09)_ODP[02]; controls to be provided by the outside system or system component (defined in AC-03(09)_ODP[01]) are defined].'),\n('002183','draft','2013-06-24','DISA FSO ','policy','Defines the controls to be used to validate the appropriateness of the information designated for release.','AC-03(09)(b)','N/A','Determine if information is released outside of the system only if [AC-03(09)_ODP[03]; controls used to validate appropriateness of information to be released are defined] are used to validate the appropriateness of the information designated for release.'),\n('002184','draft','2013-06-24','DISA FSO','policy','Release information outside of the established system boundary only if organization-defined controls are used to validate the appropriateness of the information designated for release.','AC-03(09)(b)','N/A','Determine if information is released outside of the system only if [AC-03(09)_ODP[03]; controls used to validate appropriateness of information to be released are defined] are used to validate the appropriateness of the information designated for release.'),\n('002185','draft','2013-06-24','DISA FSO','policy','Defines the conditions on which it will employ an audited override of automated access control mechanisms.','AC-03(10)','N/A','Determine if an audited override of automated access control mechanisms is employed under [AC-03(10)_ODP[01]; conditions under which to employ an audited override of automated access control mechanisms are defined] by [AC-03(10)_ODP[02]; roles allowed to employ an audited override of automated access control mechanisms are defined].'),\n('002186','draft','2013-06-24','DISA FSO','technical','Employ an audited override of automated access control mechanisms under organization-defined conditions by organization-defined roles.','AC-03(10)','N/A','Determine if an audited override of automated access control mechanisms is employed under [AC-03(10)_ODP[01]; conditions under which to employ an audited override of automated access control mechanisms are defined] by [AC-03(10)_ODP[02]; roles allowed to employ an audited override of automated access control mechanisms are defined].'),\n('002187','draft','2013-06-24','DISA FSO','policy','Defines the security attributes to be used to enforce organization-defined information flow control policies.','AC-04(01)','N/A','Determine if: - [AC-04(01)_ODP[01]; security attributes to be associated with information, source, and destination objects are defined] associated with [AC-04(01)_ODP[03]; information objects to be associated with information security attributes are defined], [AC-04(01)_ODP[05]; source objects to be associated with information security attributes are defined], and [AC-04(01)_ODP[07]; destination objects to be associated with information security attributes are defined] are used to enforce [AC-04(01)_ODP[09]; information flow control policies as a basis for enforcement of flow control decisions are defined] as a basis for flow control decisions. - [AC-04(01)_ODP[02]; privacy attributes to be associated with information, source, and destination objects are defined] associated with [AC-04(01)_ODP[04]; information objects to be associated with privacy attributes are defined], [AC-04(01)_ODP[06]; source objects to be associated with privacy attributes are defined], and [AC-04(01)_ODP[08]; destination objects to be associated with privacy attributes are defined] are used to enforce [AC-04(01)_ODP[09]; information flow control policies as a basis for enforcement of flow control decisions are defined] as a basis for flow control decisions.'),\n('002188','draft','2013-06-24','DISA FSO','policy','Defines the information, source, and destination objects with which the organization-defined security attributes are to be associated.','AC-04(01)','N/A','Determine if: - [AC-04(01)_ODP[01]; security attributes to be associated with information, source, and destination objects are defined] associated with [AC-04(01)_ODP[03]; information objects to be associated with information security attributes are defined], [AC-04(01)_ODP[05]; source objects to be associated with information security attributes are defined], and [AC-04(01)_ODP[07]; destination objects to be associated with information security attributes are defined] are used to enforce [AC-04(01)_ODP[09]; information flow control policies as a basis for enforcement of flow control decisions are defined] as a basis for flow control decisions. - [AC-04(01)_ODP[02]; privacy attributes to be associated with information, source, and destination objects are defined] associated with [AC-04(01)_ODP[04]; information objects to be associated with privacy attributes are defined], [AC-04(01)_ODP[06]; source objects to be associated with privacy attributes are defined], and [AC-04(01)_ODP[08]; destination objects to be associated with privacy attributes are defined] are used to enforce [AC-04(01)_ODP[09]; information flow control policies as a basis for enforcement of flow control decisions are defined] as a basis for flow control decisions.'),\n('002189','draft','2013-06-24','DISA FSO','policy','Defines the information flow control policies to be enforced for flow control decisions.','AC-04(01)','N/A','Determine if: - [AC-04(01)_ODP[01]; security attributes to be associated with information, source, and destination objects are defined] associated with [AC-04(01)_ODP[03]; information objects to be associated with information security attributes are defined], [AC-04(01)_ODP[05]; source objects to be associated with information security attributes are defined], and [AC-04(01)_ODP[07]; destination objects to be associated with information security attributes are defined] are used to enforce [AC-04(01)_ODP[09]; information flow control policies as a basis for enforcement of flow control decisions are defined] as a basis for flow control decisions. - [AC-04(01)_ODP[02]; privacy attributes to be associated with information, source, and destination objects are defined] associated with [AC-04(01)_ODP[04]; information objects to be associated with privacy attributes are defined], [AC-04(01)_ODP[06]; source objects to be associated with privacy attributes are defined], and [AC-04(01)_ODP[08]; destination objects to be associated with privacy attributes are defined] are used to enforce [AC-04(01)_ODP[09]; information flow control policies as a basis for enforcement of flow control decisions are defined] as a basis for flow control decisions.'),\n('002190','draft','2013-06-24','DISA FSO','technical','Use organization-defined security attributes associated with organization-defined information, source, and destination objects to enforce organization-defined information flow control policies as a basis for flow control decisions.','AC-04(01)','N/A','Determine if: - [AC-04(01)_ODP[01]; security attributes to be associated with information, source, and destination objects are defined] associated with [AC-04(01)_ODP[03]; information objects to be associated with information security attributes are defined], [AC-04(01)_ODP[05]; source objects to be associated with information security attributes are defined], and [AC-04(01)_ODP[07]; destination objects to be associated with information security attributes are defined] are used to enforce [AC-04(01)_ODP[09]; information flow control policies as a basis for enforcement of flow control decisions are defined] as a basis for flow control decisions. - [AC-04(01)_ODP[02]; privacy attributes to be associated with information, source, and destination objects are defined] associated with [AC-04(01)_ODP[04]; information objects to be associated with privacy attributes are defined], [AC-04(01)_ODP[06]; source objects to be associated with privacy attributes are defined], and [AC-04(01)_ODP[08]; destination objects to be associated with privacy attributes are defined] are used to enforce [AC-04(01)_ODP[09]; information flow control policies as a basis for enforcement of flow control decisions are defined] as a basis for flow control decisions.'),\n('002191','draft','2013-06-24','DISA FSO','policy','Defines the information flow control policies to be enforced by the information system using protected processing domains.','AC-04(02)','N/A','Determine if protected processing domains are used to enforce [AC-04(02)_ODP; information flow control policies to be enforced by use of protected processing domains are defined] as a basis for flow control decisions.'),\n('002192','draft','2013-06-24','DISA FSO','policy','Defines the policies to enforce dynamic information flow control.','AC-04(03)','N/A','Determine if [AC-04(03)_ODP; information flow control policies to be enforced are defined] are enforced.'),\n('002193','draft','2013-06-24','DISA FSO','policy','Defines procedures or methods to be employed to prevent encrypted information from bypassing flow control mechanisms, such as decrypting the information, blocking the flow of the encrypted information, and/or terminating communications sessions attempting to pass encrypted information.','AC-04(04)','N/A','Determine if encrypted information is prevented from bypassing [AC-04(04)_ODP[01]; information flow control mechanisms that encrypted information is prevented from bypassing are defined] by [AC-04(04)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {decrypting the information; blocking the flow of the encrypted information; terminating communications sessions attempting to pass encrypted information; [AC-04(04)_ODP[03]; the organization-defined procedure or method used to prevent encrypted information from bypassing information flow control mechanisms is defined (if selected)]].'),\n('002194','draft','2013-06-24','DISA FSO','policy','Defines the metadata the information system uses to enforce information flow control.','AC-04(06)','N/A','Determine if information flow control enforcement is based on [AC-04(06)_ODP; metadata on which to base enforcement of information flow control is defined].'),\n('002195','draft','2013-06-24','DISA FSO','policy','Defines the information flows against which the organization-defined security or privacy policy filters are to be enforced.','AC-04(08)(a)','N/A','Determine if: - information flow control is enforced using [AC-04(08)_ODP[01]; security policy filters to be used as a basis for enforcing information flow control are defined] as a basis for flow control decisions for [AC-04(08)_ODP[03]; information flows for which information flow control is enforced by security filters are defined]. - information flow control is enforced using [AC-04(08)_ODP[02]; privacy policy filters to be used as a basis for enforcing information flow control are defined] as a basis for flow control decisions for [AC-04(08)_ODP[04]; information flows for which information flow control is enforced by privacy filters are defined].'),\n('002196','draft','2013-06-24','DISA FSO','policy','Defines the information flows for which will enforce the use of human reviews under organization-defined conditions.','AC-04(09)','N/A','Determine if human reviews are used for [AC-04(09)_ODP[01]; information flows requiring the use of human reviews are defined] under [AC-04(09)_ODP[02]; conditions under which the use of human reviews for information flows are to be enforced are defined].'),\n('002197','draft','2013-06-24','DISA FSO','policy','Defines the conditions which will require the use of human reviews of organization-defined information flows.','AC-04(09)','N/A','Determine if human reviews are used for [AC-04(09)_ODP[01]; information flows requiring the use of human reviews are defined] under [AC-04(09)_ODP[02]; conditions under which the use of human reviews for information flows are to be enforced are defined].'),\n('002198','draft','2013-06-24','DISA FSO','policy','Enforce the use of human reviews for organization-defined information flows under organization-defined conditions.','AC-04(09)','N/A','Determine if human reviews are used for [AC-04(09)_ODP[01]; information flows requiring the use of human reviews are defined] under [AC-04(09)_ODP[02]; conditions under which the use of human reviews for information flows are to be enforced are defined].'),\n('002199','draft','2013-06-24','DISA FSO','policy','Defines the conditions that provides the capability for privileged administrators to enable and disable organization-defined security policy filters.','AC-04(10)','N/A','Determine if: - capability is provided for privileged administrators to enable and disable [AC-04(10)_ODP[01]; security policy filters that privileged administrators have the capability to enable and disable are defined] under [AC-04(10)_ODP[03]; conditions under which privileged administrators have the capability to enable and disable security policy filters are defined]. - capability is provided for privileged administrators to enable and disable [AC-04(10)_ODP[02]; privacy policy filters that privileged administrators have the capability to enable and disable are defined] under [AC-04(10)_ODP[04]; conditions under which privileged administrators have the capability to enable and disable privacy policy filters are defined].'),\n('002200','draft','2013-06-24','DISA FSO','policy','Defines the data type identifiers to be used to validate data being transferred between different security domains.','AC-04(12)','N/A','Determine if when transferring information between different security domains, [AC-04(12)_ODP; data type identifiers to be used to validate data essential for information flow decisions are defined] are used to validate data essential for information flow decisions.'),\n('002201','draft','2013-06-24','DISA FSO','technical','When transferring information between different security domains, use organization-defined data type identifiers to validate data essential for information flow decisions.','AC-04(12)','N/A','Determine if when transferring information between different security domains, [AC-04(12)_ODP; data type identifiers to be used to validate data essential for information flow decisions are defined] are used to validate data essential for information flow decisions.'),\n('002202','draft','2013-06-24','DISA FSO','policy','Defines the policy-relevant subcomponents into which information being transferred between different security domains is to be decomposed for submission to policy enforcement mechanisms.','AC-04(13)','N/A','Determine if when transferring information between different security domains, information is decomposed into [AC-04(13)_ODP; policy-relevant subcomponents into which to decompose information for submission to policy enforcement mechanisms are defined] for submission to policy enforcement mechanisms.'),\n('002203','draft','2013-06-24','DISA FSO ','policy','Defines the unsanctioned information when transferring information between different security domains.','AC-04(15)','N/A','Determine if: - when transferring information between different security domains, information is examined for the presence of [AC-04(15)_ODP[01]; unsanctioned information to be detected is defined]. - when transferring information between different security domains, transfer of [AC-04(15)_ODP[01]; unsanctioned information to be detected is defined] is prohibited in accordance with the [AC-04(15)_ODP[02]; security policy that requires the transfer of unsanctioned information between different security domains to be prohibited is defined (if selected)]. - when transferring information between different security domains, transfer of [AC-04(15)_ODP[01]; unsanctioned information to be detected is defined] is prohibited in accordance with the [AC-04(15)_ODP[03]; privacy policy that requires the transfer of organization-defined unsanctioned information between different security domains to be prohibited is defined (if selected)].'),\n('002204','draft','2013-06-24','DISA FSO ','policy','Defines the security or privacy policy which prohibits the transfer of unsanctioned information between different security domains.','AC-04(15)','N/A','Determine if: - when transferring information between different security domains, information is examined for the presence of [AC-04(15)_ODP[01]; unsanctioned information to be detected is defined]. - when transferring information between different security domains, transfer of [AC-04(15)_ODP[01]; unsanctioned information to be detected is defined] is prohibited in accordance with the [AC-04(15)_ODP[02]; security policy that requires the transfer of unsanctioned information between different security domains to be prohibited is defined (if selected)]. - when transferring information between different security domains, transfer of [AC-04(15)_ODP[01]; unsanctioned information to be detected is defined] is prohibited in accordance with the [AC-04(15)_ODP[03]; privacy policy that requires the transfer of organization-defined unsanctioned information between different security domains to be prohibited is defined (if selected)].'),\n('002205','draft','2013-06-24','DISA FSO ','technical','Uniquely identify and authenticate source by organization, system, application, service, and/or individual for information transfer.','AC-04(17)','N/A','Determine if source and destination points are uniquely identified and authenticated by [AC-04(17)_ODP; one or more of the following PARAMETER VALUES is/are selected: {organization, system, application, service, individual}] for information transfer.'),\n('002207','draft','2013-06-24','DISA FSO ','technical','Uniquely identify and authenticate destination points by organization, system, application, service, and/or individual for information transfer.','AC-04(17)','N/A','Determine if source and destination points are uniquely identified and authenticated by [AC-04(17)_ODP; one or more of the following PARAMETER VALUES is/are selected: {organization, system, application, service, individual}] for information transfer.'),\n('002211','draft','2013-06-24','DISA FSO ','technical','When transferring information between different security domains, implement organization-defined security or privacy filters on metadata.','AC-04(19)','N/A','Determine if: - when transferring information between different security domains, [AC-04(19)_ODP[01]; security policy filters to be implemented on metadata are defined (if selected)] are implemented on metadata. - when transferring information between different security domains, [AC-04(19)_ODP[02]; privacy policy filters to be implemented on metadata are defined (if selected)] are implemented on metadata.'),\n('002212','draft','2013-06-24','DISA FSO ','policy','Defines the solutions in approved configurations to be employed to control the flow of organization-defined information across security domains.','AC-04(20)','N/A','Determine if [AC-04(20)_ODP[01]; solutions in approved configurations to control the flow of information across security domains are defined] are employed to control the flow of [AC-04(20)_ODP[02]; information to be controlled when it flows across security domains is defined] across security domains.'),\n('002213','draft','2013-06-24','DISA FSO','policy','Defines the information to be subjected to flow control across security domains.','AC-04(20)','N/A','Determine if [AC-04(20)_ODP[01]; solutions in approved configurations to control the flow of information across security domains are defined] are employed to control the flow of [AC-04(20)_ODP[02]; information to be controlled when it flows across security domains is defined] across security domains.'),\n('002214','draft','2013-06-24','DISA FSO ','policy','Employ organization-defined solutions in approved configurations to control the flow of organization-defined information across security domains.','AC-04(20)','N/A','Determine if [AC-04(20)_ODP[01]; solutions in approved configurations to control the flow of information across security domains are defined] are employed to control the flow of [AC-04(20)_ODP[02]; information to be controlled when it flows across security domains is defined] across security domains.'),\n('002215','draft','2013-06-24','DISA FSO','policy','Defines the mechanisms and/or techniques to be used to logically or physically separate information flows.','AC-04(21)','N/A','Determine if: - information flows are separated logically using [AC-04(21)_ODP[01]; mechanisms and/or techniques used to logically separate information flows are defined (if selected)] to accomplish [AC-04(21)_ODP[03]; required separations by types of information are defined]. - information flows are separated physically using [AC-04(21)_ODP[02]; mechanisms and/or techniques used to physically separate information flows are defined (if selected)] to accomplish [AC-04(21)_ODP[03]; required separations by types of information are defined].'),\n('002216','draft','2013-06-24','DISA FSO','policy','Defines the types of information required to accomplish logical or physical separation of information flows.','AC-04(21)','N/A','Determine if: - information flows are separated logically using [AC-04(21)_ODP[01]; mechanisms and/or techniques used to logically separate information flows are defined (if selected)] to accomplish [AC-04(21)_ODP[03]; required separations by types of information are defined]. - information flows are separated physically using [AC-04(21)_ODP[02]; mechanisms and/or techniques used to physically separate information flows are defined (if selected)] to accomplish [AC-04(21)_ODP[03]; required separations by types of information are defined].'),\n('002217','draft','2013-06-24','DISA FSO','policy','Separate information flows logically or physically using organization-defined mechanisms and/or techniques to accomplish organization-defined required separations by types of information.','AC-04(21)','N/A','Determine if: - information flows are separated logically using [AC-04(21)_ODP[01]; mechanisms and/or techniques used to logically separate information flows are defined (if selected)] to accomplish [AC-04(21)_ODP[03]; required separations by types of information are defined]. - information flows are separated physically using [AC-04(21)_ODP[02]; mechanisms and/or techniques used to physically separate information flows are defined (if selected)] to accomplish [AC-04(21)_ODP[03]; required separations by types of information are defined].'),\n('002218','draft','2013-06-24','DISA FSO','technical','Provide access from a single device to computing platforms, applications, or data residing on multiple different security domains, while preventing any information flow between the different security domains.','AC-04(22)','N/A','Determine if access is provided from a single device to computing platforms, applications, or data that reside in multiple different security domains while preventing information flow between the different security domains.'),\n('002219','draft','2013-06-24','DISA FSO','policy','Defines the duties of individuals requiring separation.','AC-05a.','N/A','Determine if [AC-05_ODP; duties of individuals requiring separation are defined] are identified and documented.'),\n('002220','draft','2013-06-24','DISA FSO','policy','Define system access authorizations to support separation of duties.','AC-05a.','N/A','Determine if [AC-05_ODP; duties of individuals requiring separation are defined] are identified and documented.'),\n('002221','draft','2013-06-24','DISA FSO','policy','Defines the security-relevant information for which access must be explicitly authorized.','AC-06(01)(b)','N/A','Determine if access is authorized for [AC-06(01)_ODP[01]; individuals and roles with authorized access to security functions and security-relevant information are defined] to [AC-06(01)_ODP[05]; security-relevant information for authorized access is defined].'),\n('002222','draft','2013-06-24','DISA FSO','policy','Authorize access for organization-defined individuals or roles to organization-defined security functions (deployed in hardware, software, and firmware).','AC-06(01)(a)','N/A','Determine if: - access is authorized for [AC-06(01)_ODP[01]; individuals and roles with authorized access to security functions and security-relevant information are defined] to [AC-06(01)_ODP[02]; security functions (deployed in hardware) for authorized access are defined]. - access is authorized for [AC-06(01)_ODP[01]; individuals and roles with authorized access to security functions and security-relevant information are defined] to [AC-06(01)_ODP[03]; security functions (deployed in software) for authorized access are defined]. - access is authorized for [AC-06(01)_ODP[01]; individuals and roles with authorized access to security functions and security-relevant information are defined] to [AC-06(01)_ODP[04]; security functions (deployed in firmware) for authorized access are defined].'),\n('002223','draft','2013-06-24','DISA FSO','policy','Authorize access for organization-defined individuals or roles to organization-defined security-relevant information.','AC-06(01)(b)','N/A','Determine if access is authorized for [AC-06(01)_ODP[01]; individuals and roles with authorized access to security functions and security-relevant information are defined] to [AC-06(01)_ODP[05]; security-relevant information for authorized access is defined].'),\n('002224','draft','2013-06-24','DISA FSO','policy','Defines the compelling operational needs that must be met in order to be authorized network access to organization-defined privileged commands.','AC-06(03)','N/A','Determine if: - network access to [AC-06(03)_ODP[01]; privileged commands to which network access is to be authorized only for compelling operational needs are defined] is authorized only for [AC-06(03)_ODP[02]; compelling operational needs necessitating network access to privileged commands are defined]. - the rationale for authorizing network access to privileged commands is documented in the security plan for the system.'),\n('002225','draft','2013-06-24','DISA FSO ','policy','Provide separate processing domains to enable finer-grained allocation of user privileges.','AC-06(04)','N/A','Determine if separate processing domains are provided to enable finer-grain allocation of user privileges.'),\n('002226','draft','2013-06-24','DISA FSO','policy','Defines the personnel or roles to whom privileged accounts are to be restricted on the information system.','AC-06(05)','N/A','Determine if privileged accounts on the system are restricted to [AC-06(05)_ODP; personnel or roles to which privileged accounts on the system are to be restricted is/are defined].'),\n('002227','draft','2013-06-24','DISA FSO','policy','Restrict privileged accounts on the system to organization-defined personnel or roles.','AC-06(05)','N/A','Determine if privileged accounts on the system are restricted to [AC-06(05)_ODP; personnel or roles to which privileged accounts on the system are to be restricted is/are defined].'),\n('002228','draft','2013-06-24','DISA FSO','policy','Defines the frequency on which it conducts reviews of the privileges assigned to organization-defined roles or classes of users.','AC-06(07)(a)','N/A','Determine if privileges assigned to [AC-06(07)_ODP[02]; roles or classes of users to which privileges are assigned are defined] are reviewed [AC-06(07)_ODP[01]; the frequency at which to review the privileges assigned to roles or classes of users is defined] to validate the need for such privileges.'),\n('002229','draft','2013-06-24','DISA FSO','policy','Defines the roles or classes of users that are to have their privileges reviewed on an organization-defined frequency.','AC-06(07)(a)','N/A','Determine if privileges assigned to [AC-06(07)_ODP[02]; roles or classes of users to which privileges are assigned are defined] are reviewed [AC-06(07)_ODP[01]; the frequency at which to review the privileges assigned to roles or classes of users is defined] to validate the need for such privileges.'),\n('002230','draft','2013-06-24','DISA FSO','policy','Review, on an organization-defined frequency, the privileges assigned to organization-defined roles or classes of users to validate the need for such privileges.','AC-06(07)(a)','N/A','Determine if privileges assigned to [AC-06(07)_ODP[02]; roles or classes of users to which privileges are assigned are defined] are reviewed [AC-06(07)_ODP[01]; the frequency at which to review the privileges assigned to roles or classes of users is defined] to validate the need for such privileges.'),\n('002231','draft','2013-06-24','DISA FSO','policy','Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.','AC-06(07)(b)','N/A','Determine if privileges are reassigned or removed, if necessary, to correctly reflect organizational mission and business needs.'),\n('002232','draft','2013-06-24','DISA FSO','policy','Defines the software that is prevented from executing at a higher privilege than users executing the software.','AC-06(08)','N/A','Determine if [AC-06(08)_ODP; software to be prevented from executing at higher privilege levels than users executing the software is defined] is prevented from executing at higher privilege levels than users executing the software.'),\n('002233','draft','2013-06-24','DISA FSO','technical','Prevent the organization-defined software from executing at higher privilege levels than users executing the software.','AC-06(08)','N/A','Determine if [AC-06(08)_ODP; software to be prevented from executing at higher privilege levels than users executing the software is defined] is prevented from executing at higher privilege levels than users executing the software.'),\n('002234','draft','2013-06-24','DISA FSO','technical','Log the execution of privileged functions.','AC-06(09)','N/A','Determine if the execution of privileged functions is logged.'),\n('002235','draft','2013-06-24','DISA FSO','technical','Prevent non-privileged users from executing privileged functions.','AC-06(10)','N/A','Determine if non-privileged users are prevented from executing privileged functions.'),\n('002236','draft','2013-06-24','DISA FSO','policy','Defines the time period the information system will automatically lock the account or node when the maximum number of unsuccessful logon attempts is exceeded.','AC-07b.','N/A','Determine if automatically [AC-07_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {lock the account or node for [AC-07_ODP[04]; time period for an account or node to be locked is defined (if selected);]; lock the account or node until released by an administrator; delay next logon prompt per [AC-07_ODP[05]; delay algorithm for the next logon prompt is defined (if selected)]; notify system administrator; take other [AC-07_ODP[06]; other action to be taken when the maximum number of unsuccessful attempts is exceeded is defined (if selected)]]]] when the maximum number of unsuccessful attempts is exceeded.'),\n('002237','draft','2013-06-24','DISA FSO','policy','Defines the delay algorithm to delay the next logon prompt when the maximum number of unsuccessful logon attempts is exceeded.','AC-07b.','N/A','Determine if automatically [AC-07_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {lock the account or node for [AC-07_ODP[04]; time period for an account or node to be locked is defined (if selected);]; lock the account or node until released by an administrator; delay next logon prompt per [AC-07_ODP[05]; delay algorithm for the next logon prompt is defined (if selected)]; notify system administrator; take other [AC-07_ODP[06]; other action to be taken when the maximum number of unsuccessful attempts is exceeded is defined (if selected)]]]] when the maximum number of unsuccessful attempts is exceeded.'),\n('002238','draft','2013-06-24','DISA  FSO','technical','Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.','AC-07b.','N/A','Determine if automatically [AC-07_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {lock the account or node for [AC-07_ODP[04]; time period for an account or node to be locked is defined (if selected);]; lock the account or node until released by an administrator; delay next logon prompt per [AC-07_ODP[05]; delay algorithm for the next logon prompt is defined (if selected)]; notify system administrator; take other [AC-07_ODP[06]; other action to be taken when the maximum number of unsuccessful attempts is exceeded is defined (if selected)]]]] when the maximum number of unsuccessful attempts is exceeded.'),\n('002239','draft','2013-06-24','DISA FSO','policy','Defines the mobile devices that are to be purged or wiped after an organization-defined number of consecutive, unsuccessful device logon attempts.','AC-07(02)','N/A','Determine if information is purged or wiped from [AC-07(02)_ODP[01]; mobile devices to be purged or wiped of information are defined] based on [AC-07(02)_ODP[02]; purging or wiping requirements and techniques to be used when mobile devices are purged or wiped of information are defined] after [AC-07(02)_ODP[03]; the number of consecutive, unsuccessful logon attempts before the information is purged or wiped from mobile devices is defined] consecutive, unsuccessful device logon attempts.'),\n('002240','draft','2013-06-24','DISA FSO','policy','Defines the purging or wiping requirements and techniques to be used on organization-defined mobile devices after an organization-defined number of consecutive, unsuccessful device logon attempts.','AC-07(02)','N/A','Determine if information is purged or wiped from [AC-07(02)_ODP[01]; mobile devices to be purged or wiped of information are defined] based on [AC-07(02)_ODP[02]; purging or wiping requirements and techniques to be used when mobile devices are purged or wiped of information are defined] after [AC-07(02)_ODP[03]; the number of consecutive, unsuccessful logon attempts before the information is purged or wiped from mobile devices is defined] consecutive, unsuccessful device logon attempts.'),\n('002241','draft','2013-06-24','DISA FSO','policy','Defines the number of consecutive, unsuccessful device logon attempts after which the organization-defined mobile devices will be purged or wiped.','AC-07(02)','N/A','Determine if information is purged or wiped from [AC-07(02)_ODP[01]; mobile devices to be purged or wiped of information are defined] based on [AC-07(02)_ODP[02]; purging or wiping requirements and techniques to be used when mobile devices are purged or wiped of information are defined] after [AC-07(02)_ODP[03]; the number of consecutive, unsuccessful logon attempts before the information is purged or wiped from mobile devices is defined] consecutive, unsuccessful device logon attempts.'),\n('002242','draft','2013-06-24','DISA FSO','technical','Purge or wipe information from organization-defined mobile devices based on organization-defined purging or wiping requirements and techniques after an organization-defined number of consecutive, unsuccessful device logon attempts.','AC-07(02)','N/A','Determine if information is purged or wiped from [AC-07(02)_ODP[01]; mobile devices to be purged or wiped of information are defined] based on [AC-07(02)_ODP[02]; purging or wiping requirements and techniques to be used when mobile devices are purged or wiped of information are defined] after [AC-07(02)_ODP[03]; the number of consecutive, unsuccessful logon attempts before the information is purged or wiped from mobile devices is defined] consecutive, unsuccessful device logon attempts.'),\n('002243','draft','2013-06-24','DISA FSO','policy','Organization-defined system use notification message or banner is to state that users are accessing a U.S. Government system.','AC-08a.01','N/A','Determine if the system use notification states that users are accessing a U.S. Government system.'),\n('002244','draft','2013-06-24','DISA FSO','policy','Organization-defined system use notification message or banner is to state that system usage may be monitored, recorded, and subject to audit.','AC-08a.02','N/A','Determine if the system use notification states that system usage may be monitored, recorded, and subject to audit.'),\n('002245','draft','2013-06-24','DISA FSO','policy','Organization-defined system use notification message or banner is to state that unauthorized use of the system is prohibited and subject to criminal and civil penalties.','AC-08a.03','N/A','Determine if the system use notification states that unauthorized use of the system is prohibited and subject to criminal and civil penalties.'),\n('002246','draft','2013-06-24','DISA FSO','policy','Organization-defined system use notification message or banner is to state that use of the system indicates consent to monitoring and recording.','AC-08a.04','N/A','Determine if the system use notification states that use of the system indicates consent to monitoring and recording.'),\n('002247','draft','2013-06-24','DISA FSO','policy','Defines the use notification message or banner the system displays to users before granting access to the system.','AC-08a.','N/A','Determine if [AC-08_ODP[01]; system use notification message or banner to be displayed by the system to users before granting access to the system is defined] is displayed to users before granting access to the system that provides privacy and security notices consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('002248','draft','2013-06-24','DISA FSO','policy','Defines the conditions of use which are to be displayed to users of the system before granting further access.','AC-08c.01','N/A','Determine if for publicly accessible systems, system use information [AC-08_ODP[02]; conditions for system use to be displayed by the system before granting further access are defined] is displayed before granting further access to the publicly accessible system.'),\n('002249','draft','2013-06-24','DISA FSO','policy','Defines the additional information to be included in the notification to the user upon successful logon.','AC-09(04)','N/A','Determine if the user is notified, upon successful logon, of [AC-09(04)_ODP; additional information about which to notify the user is defined].'),\n('002250','draft','2013-06-24','DISA FSO','technical','Notify the user, upon successful logon, of the following additional information: organization-defined additional information.','AC-09(04)','N/A','Determine if the user is notified, upon successful logon, of [AC-09(04)_ODP; additional information about which to notify the user is defined].'),\n('002252','draft','2013-06-24','DISA FSO','policy','Defines the accounts and/or account types for which will limit the number of concurrent sessions.','AC-10','N/A','Determine if the number of concurrent sessions for each [AC-10_ODP[01]; accounts and/or account types for which to limit the number of concurrent sessions is defined] is limited to [AC-10_ODP[02]; the number of concurrent sessions to be allowed for each account and/or account type is defined].'),\n('002256','draft','2013-06-24','DISA FSO','policy','Defines security attributes having organization-defined types of security attribute values which are associated with information in storage.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('002257','draft','2013-06-24','DISA FSO','policy','Defines security attributes having organization-defined types of security attribute values which are associated with information in process.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('002258','draft','2013-06-24','DISA FSO','policy','Defines security attributes, having organization-defined types of security attribute values, which are associated with information in transmission.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('002259','draft','2013-06-24','DISA FSO','policy','Defines security attribute values associated with organization-defined types of security attributes for information in storage.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('002260','draft','2013-06-24','DISA FSO','policy','Defines security attribute values associated with organization-defined types of security attributes for information in process.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('002261','draft','2013-06-24','DISA FSO','policy','Defines security attribute values associated with organization-defined types of security attributes for information in transmission.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('002262','draft','2013-06-24','DISA FSO','technical','Provide the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in storage.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('002263','draft','2013-06-24','DISA FSO','technical','Provide the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in process.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('002264','draft','2013-06-24','DISA FSO','technical','Provide the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('002265','draft','2013-06-24','DISA FSO','policy','Ensure that the attribute associations are made and retained with the information.','AC-16b.','N/A','Determine if: - attribute associations are made. - attribute associations are retained with the information.'),\n('002266','draft','2013-06-24','DISA FSO','policy','Ensure that the security attribute associations are retained with the information.','AC-16b.','N/A','Determine if: - attribute associations are made. - attribute associations are retained with the information.'),\n('002267','draft','2013-06-24','DISA FSO','policy','Defines the security attributes that are permitted for organization-defined systems.','AC-16c.','N/A','Determine if: - the following permitted security attributes are established from the attributes defined in AC-16_ODP[01] for [AC-16_ODP[05]; systems for which permitted security attributes are to be established are defined]: [AC-16_ODP[07]; security attributes defined as part of AC-16a that are permitted for systems are defined]. - the following permitted privacy attributes are established from the attributes defined in AC-16_ODP[02] for [AC-16_ODP[06]; systems for which permitted privacy attributes are to be established are defined]: [AC-16_ODP[08]; privacy attributes defined as part of AC-16a that are permitted for systems are defined].'),\n('002268','draft','2013-06-24','DISA FSO','policy','Defines the systems for which permitted organization-defined attributes are to be established.','AC-16c.','N/A','Determine if: - the following permitted security attributes are established from the attributes defined in AC-16_ODP[01] for [AC-16_ODP[05]; systems for which permitted security attributes are to be established are defined]: [AC-16_ODP[07]; security attributes defined as part of AC-16a that are permitted for systems are defined]. - the following permitted privacy attributes are established from the attributes defined in AC-16_ODP[02] for [AC-16_ODP[06]; systems for which permitted privacy attributes are to be established are defined]: [AC-16_ODP[08]; privacy attributes defined as part of AC-16a that are permitted for systems are defined].'),\n('002269','draft','2013-06-24','DISA FSO','policy','Establish the following permitted organization-defined security attributes in AC-16a for organization-defined systems.','AC-16c.','N/A','Determine if: - the following permitted security attributes are established from the attributes defined in AC-16_ODP[01] for [AC-16_ODP[05]; systems for which permitted security attributes are to be established are defined]: [AC-16_ODP[07]; security attributes defined as part of AC-16a that are permitted for systems are defined]. - the following permitted privacy attributes are established from the attributes defined in AC-16_ODP[02] for [AC-16_ODP[06]; systems for which permitted privacy attributes are to be established are defined]: [AC-16_ODP[08]; privacy attributes defined as part of AC-16a that are permitted for systems are defined].'),\n('002270','draft','2013-06-24','DISA FSO','policy','Defines the attribute values or ranges permitted for each of the established security attributes.','AC-16d.','N/A','Determine if the following permitted attribute values or ranges for each of the established attributes are determined: [AC-16_ODP[09]; attribute values or ranges for established attributes are defined].'),\n('002271','draft','2013-06-24','DISA FSO','policy','Determine organization-defined attribute values or ranges for each of the established attributes.','AC-16d.','N/A','Determine if the following permitted attribute values or ranges for each of the established attributes are determined: [AC-16_ODP[09]; attribute values or ranges for established attributes are defined].'),\n('002272','draft','2013-06-24','DISA FSO','technical','Dynamically associate security attributes with organization-defined objects in accordance with organization-defined security policies as information is created and combined.',NULL,'N/A',NULL),\n('002273','draft','2013-06-24','DISA FSO','policy','Defines the security policies to adhere to when dynamically associating security attributes with organization-defined subjects and objects.',NULL,'N/A',NULL),\n('002274','draft','2013-06-24','DISA FSO','policy','Defines the subjects with which the system is to dynamically associate security attributes as information is created and combined.',NULL,'N/A',NULL),\n('002275','draft','2013-06-24','DISA FSO','policy','Defines the objects with which the system is to dynamically associate security attributes as information is created and combined.',NULL,'N/A',NULL),\n('002277','draft','2013-06-24','DISA FSO','technical','Provides authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated security attributes.','AC-16(02)','N/A','Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated security attributes. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated privacy attributes.'),\n('002278','draft','2013-06-24','DISA FSO','policy','Defines the security attributes for which the association and integrity to organization-defined subjects and objects is maintained.','AC-16(03)','N/A','Determine if: - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[03]; subjects requiring the association and integrity of security attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[04]; objects requiring the association and integrity of security attributes to such objects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[05]; subjects requiring the association and integrity of privacy attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[06]; objects requiring the association and integrity of privacy attributes to such objects to be maintained are defined] is maintained.'),\n('002279','draft','2013-06-24','DISA FSO','policy','Defines the subjects for which the association and integrity of organization-defined security attributes is maintained.','AC-16(03)','N/A','Determine if: - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[03]; subjects requiring the association and integrity of security attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[04]; objects requiring the association and integrity of security attributes to such objects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[05]; subjects requiring the association and integrity of privacy attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[06]; objects requiring the association and integrity of privacy attributes to such objects to be maintained are defined] is maintained.'),\n('002280','draft','2013-06-24','DISA FSO','policy','Defines the objects for which the association and integrity of organization-defined security attributes is maintained.','AC-16(03)','N/A','Determine if: - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[03]; subjects requiring the association and integrity of security attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[04]; objects requiring the association and integrity of security attributes to such objects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[05]; subjects requiring the association and integrity of privacy attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[06]; objects requiring the association and integrity of privacy attributes to such objects to be maintained are defined] is maintained.'),\n('002281','draft','2013-06-24','DISA FSO','technical','Maintain the association of organization-defined security attributes to organization-defined subjects.','AC-16(03)','N/A','Determine if: - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[03]; subjects requiring the association and integrity of security attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[04]; objects requiring the association and integrity of security attributes to such objects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[05]; subjects requiring the association and integrity of privacy attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[06]; objects requiring the association and integrity of privacy attributes to such objects to be maintained are defined] is maintained.'),\n('002282','draft','2013-06-24','DISA FSO','technical','Maintain the association of organization-defined security attributes to organization-defined objects.','AC-16(03)','N/A','Determine if: - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[03]; subjects requiring the association and integrity of security attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[04]; objects requiring the association and integrity of security attributes to such objects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[05]; subjects requiring the association and integrity of privacy attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[06]; objects requiring the association and integrity of privacy attributes to such objects to be maintained are defined] is maintained.'),\n('002283','draft','2013-06-24','DISA FSO','technical','Maintain the integrity of organization-defined security attributes associated with organization-defined subjects.','AC-16(03)','N/A','Determine if: - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[03]; subjects requiring the association and integrity of security attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[04]; objects requiring the association and integrity of security attributes to such objects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[05]; subjects requiring the association and integrity of privacy attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[06]; objects requiring the association and integrity of privacy attributes to such objects to be maintained are defined] is maintained.'),\n('002284','draft','2013-06-24','DISA FSO','technical','Maintain the integrity of organization-defined security attributes associated with organization-defined objects.','AC-16(03)','N/A','Determine if: - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[03]; subjects requiring the association and integrity of security attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[04]; objects requiring the association and integrity of security attributes to such objects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[05]; subjects requiring the association and integrity of privacy attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[06]; objects requiring the association and integrity of privacy attributes to such objects to be maintained are defined] is maintained.'),\n('002286','draft','2013-06-24','DISA FSO','policy','Defines the subjects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).','AC-16(04)','N/A','Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[01]; security attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[05]; subjects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[02]; security attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[06]; objects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[03]; privacy attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[07]; subjects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[04]; privacy attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[08]; objects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined].'),\n('002287','draft','2013-06-24','DISA FSO','policy','Defines the objects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals).','AC-16(04)','N/A','Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[01]; security attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[05]; subjects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[02]; security attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[06]; objects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[03]; privacy attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[07]; subjects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[04]; privacy attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[08]; objects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined].'),\n('002288','draft','2013-06-24','DISA FSO','policy','Defines the security attributes authorized individuals (or processes acting on behalf of individuals) are permitted to associate with organization-defined subjects and objects.','AC-16(04)','N/A','Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[01]; security attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[05]; subjects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[02]; security attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[06]; objects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[03]; privacy attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[07]; subjects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[04]; privacy attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[08]; objects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined].'),\n('002289','draft','2013-06-24','DISA FSO','technical','Provide the capability to associate organization-defined security attributes with organization-defined subjects by authorized individuals (or processes acting on behalf of individuals).','AC-16(04)','N/A','Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[01]; security attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[05]; subjects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[02]; security attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[06]; objects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[03]; privacy attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[07]; subjects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[04]; privacy attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[08]; objects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined].'),\n('002290','draft','2013-06-24','DISA FSO','technical','Provide the capability to associate organization-defined security attributes with organization-defined objects by authorized individuals (or processes acting on behalf of individuals).','AC-16(04)','N/A','Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[01]; security attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[05]; subjects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[02]; security attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[06]; objects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[03]; privacy attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[07]; subjects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[04]; privacy attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[08]; objects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined].'),\n('002291','draft','2013-06-24','DISA FSO','policy','Defines the security policies to be followed by personnel when associating organization-defined security attributes with organization-defined subjects and objects.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('002292','draft','2013-06-24','DISA FSO','policy','Defines the security attributes which are to be associated with organization-defined subjects and objects.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('002293','draft','2013-06-24','DISA FSO','policy','Defines the subjects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('002294','draft','2013-06-24','DISA FSO','policy','Defines the objects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('002295','draft','2013-06-24','DISA FSO','policy','Require personnel to associate organization-defined security attributes with organization-defined subjects in accordance with organization-defined security policies.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('002296','draft','2013-06-24','DISA FSO','policy','Require personnel to associate organization-defined security attributes with organization-defined objects in accordance with organization-defined security policies.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('002297','draft','2013-06-24','DISA FSO','policy','Require personnel to maintain the association of organization-defined security attributes with organization-defined subjects in accordance with organization-defined security policies.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('002298','draft','2013-06-24','DISA FSO','policy','Require personnel to maintain the association of organization-defined security attributes with organization-defined objects in accordance with organization-defined security policies.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('002299','draft','2013-06-24','DISA FSO','policy','Provide a consistent interpretation of security attributes transmitted between distributed system components.','AC-16(07)','N/A','Determine if: - a consistent interpretation of security attributes transmitted between distributed system components is provided. - Determine if a consistent interpretation of privacy attributes transmitted between distributed system components is provided.'),\n('002300','draft','2013-06-24','DISA FSO','policy','Defines the techniques and technologies to be implemented when associating security attributes with information.','AC-16(08)','N/A','Determine if: - [AC-16(08)_ODP[01]; techniques and technologies to be implemented in associating security attributes to information are defined] are implemented in associating security attributes to information. - [AC-16(08)_ODP[02]; techniques and technologies to be implemented in associating privacy attributes to information are defined] are implemented in associating privacy attributes to information.'),\n('002301','draft','2013-06-24','DISA FSO','policy','Defines the level of assurance to be provided when implementing organization-defined techniques and technologies in associating security attributes to information.','AC-16(08)','N/A','Determine if: - [AC-16(08)_ODP[01]; techniques and technologies to be implemented in associating security attributes to information are defined] are implemented in associating security attributes to information. - [AC-16(08)_ODP[02]; techniques and technologies to be implemented in associating privacy attributes to information are defined] are implemented in associating privacy attributes to information.'),\n('002302','draft','2013-06-24','DISA FSO','technical','Implement organization-defined techniques and technologies with an organization-defined level of assurance in associating security attributes to information.','AC-16(08)','N/A','Determine if: - [AC-16(08)_ODP[01]; techniques and technologies to be implemented in associating security attributes to information are defined] are implemented in associating security attributes to information. - [AC-16(08)_ODP[02]; techniques and technologies to be implemented in associating privacy attributes to information are defined] are implemented in associating privacy attributes to information.'),\n('002303','draft','2013-06-24','DISA FSO ','policy','Defines the techniques or procedures to be employed to validate re-grading mechanisms.','AC-16(09)','N/A','Determine if: - security attributes associated with information are changed only via regrading mechanisms validated using [AC-16(09)_ODP[01]; techniques or procedures used to validate regrading mechanisms for security attributes are defined]. - privacy attributes associated with information are changed only via regrading mechanisms validated using [AC-16(09)_ODP[02]; techniques or procedures used to validate regrading mechanisms for privacy attributes are defined].'),\n('002304','draft','2013-06-24','DISA FSO','policy','Change security attributes associated with information are reassigned only via re-grading mechanisms validated using organization-defined techniques or procedures.','AC-16(09)','N/A','Determine if: - security attributes associated with information are changed only via regrading mechanisms validated using [AC-16(09)_ODP[01]; techniques or procedures used to validate regrading mechanisms for security attributes are defined]. - privacy attributes associated with information are changed only via regrading mechanisms validated using [AC-16(09)_ODP[02]; techniques or procedures used to validate regrading mechanisms for privacy attributes are defined].'),\n('002306','draft','2013-06-24','DISA FSO','technical','Provide authorized individuals the capability to define or change the type of security attributes available for association with subjects.','AC-16(10)','N/A','Determine if: - authorized individuals are provided with the capability to define or change the type and value of security attributes available for association with subjects and objects. - authorized individuals are provided with the capability to define or change the type and value of privacy attributes available for association with subjects and objects.'),\n('002307','draft','2013-06-24','DISA FSO','technical','Provide authorized individuals the capability to define or change the value of security attributes available for association with subjects.','AC-16(10)','N/A','Determine if: - authorized individuals are provided with the capability to define or change the type and value of security attributes available for association with subjects and objects. - authorized individuals are provided with the capability to define or change the type and value of privacy attributes available for association with subjects and objects.'),\n('002308','draft','2013-06-24','DISA FSO','technical','Provide authorized individuals the capability to define or change the type of security attributes available for association with objects.','AC-16(10)','N/A','Determine if: - authorized individuals are provided with the capability to define or change the type and value of security attributes available for association with subjects and objects. - authorized individuals are provided with the capability to define or change the type and value of privacy attributes available for association with subjects and objects.'),\n('002309','draft','2013-06-24','DISA FSO','technical','Provide authorized individuals the capability to define or change the value of security attributes available for association with objects.','AC-16(10)','N/A','Determine if: - authorized individuals are provided with the capability to define or change the type and value of security attributes available for association with subjects and objects. - authorized individuals are provided with the capability to define or change the type and value of privacy attributes available for association with subjects and objects.'),\n('002310','draft','2013-06-24','DISA FSO','policy','Establish and document usage restrictions for each type of remote access allowed.','AC-17a.','N/A','Determine if: - usage restrictions are established and documented for each type of remote access allowed. - configuration/connection requirements are established and documented for each type of remote access allowed. - implementation guidance is established and documented for each type of remote access allowed.'),\n('002311','draft','2013-06-24','DISA FSO','policy','Establish and document configuration/connection requirements for each type of remote access allowed.','AC-17a.','N/A','Determine if: - usage restrictions are established and documented for each type of remote access allowed. - configuration/connection requirements are established and documented for each type of remote access allowed. - implementation guidance is established and documented for each type of remote access allowed.'),\n('002312','draft','2013-06-24','DISA FSO','policy','Establish and document implementation guidance for each type of remote access allowed.','AC-17a.','N/A','Determine if: - usage restrictions are established and documented for each type of remote access allowed. - configuration/connection requirements are established and documented for each type of remote access allowed. - implementation guidance is established and documented for each type of remote access allowed.'),\n('002314','draft','2013-06-24','DISA FSO','technical','Employ automated mechanisms to control remote access methods.','AC-17(01)','N/A','Determine if: - automated mechanisms are employed to monitor remote access methods. - automated mechanisms are employed to control remote access methods.'),\n('002316','draft','2013-06-24','DISA FSO','policy','Authorize access to security-relevant information via remote access only in a format that provides assessable evidence for organization-defined needs.','AC-17(04)(a)','N/A','Determine if: - the execution of privileged commands via remote access is authorized only in a format that provides assessable evidence. - access to security-relevant information via remote access is authorized only in a format that provides assessable evidence. - the execution of privileged commands via remote access is authorized only for the following needs: [AC-17(04)_ODP[01]; needs requiring execution of privileged commands via remote access are defined]. - access to security-relevant information via remote access is authorized only for the following needs: [AC-17(04)_ODP[02]; needs requiring access to security-relevant information via remote access are defined].'),\n('002317','draft','2013-06-24','DISA FSO','policy','Defines the needs for when the execution of privileged commands via remote access is to be authorized.','AC-17(04)(a)','N/A','Determine if: - the execution of privileged commands via remote access is authorized only in a format that provides assessable evidence. - access to security-relevant information via remote access is authorized only in a format that provides assessable evidence. - the execution of privileged commands via remote access is authorized only for the following needs: [AC-17(04)_ODP[01]; needs requiring execution of privileged commands via remote access are defined]. - access to security-relevant information via remote access is authorized only for the following needs: [AC-17(04)_ODP[02]; needs requiring access to security-relevant information via remote access are defined].'),\n('002318','draft','2013-06-24','DISA FSO','policy','Defines the needs for when access to security-relevant information via remote access is to be authorized.','AC-17(04)(a)','N/A','Determine if: - the execution of privileged commands via remote access is authorized only in a format that provides assessable evidence. - access to security-relevant information via remote access is authorized only in a format that provides assessable evidence. - the execution of privileged commands via remote access is authorized only for the following needs: [AC-17(04)_ODP[01]; needs requiring execution of privileged commands via remote access are defined]. - access to security-relevant information via remote access is authorized only for the following needs: [AC-17(04)_ODP[02]; needs requiring access to security-relevant information via remote access are defined].'),\n('002319','draft','2013-06-24','DISA FSO','policy','Document the rationale for authorization of the execution of privilege commands via remote access.','AC-17(04)(b)','N/A','Determine if the rationale for remote access is documented in the security plan for the system.'),\n('002320','draft','2013-06-24','DISA FSO','policy','Document the rationale for authorization of access to security-relevant information via remote access.','AC-17(04)(b)','N/A','Determine if the rationale for remote access is documented in the security plan for the system.'),\n('002321','draft','2013-06-24','DISA FSO','policy','Defines the time-period within which it disconnects or disables remote access to the system.','AC-17(09)','N/A','Determine if the capability to disconnect or disable remote access to the system within [AC-17(09)_ODP; the time period within which to disconnect or disable remote access to the system is defined] is provided.'),\n('002322','draft','2013-06-24','DISA FSO','technical','Provide the capability to disconnect or disable remote access to the system within the organization-defined time period.','AC-17(09)','N/A','Determine if the capability to disconnect or disable remote access to the system within [AC-17(09)_ODP; the time period within which to disconnect or disable remote access to the system is defined] is provided.'),\n('002323','draft','2013-06-24','DISA FSO','policy','Establish configuration requirements and connection requirements for wireless access.','AC-18a.','N/A','Determine if: - configuration requirements are established for each type of wireless access. - connection requirements are established for each type of wireless access. - implementation guidance is established for each type of wireless access.'),\n('002324','draft','2013-06-24','DISA FSO','policy','Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.','AC-18(04)','N/A','Determine if: - users allowed to independently configure wireless networking capabilities are identified. - users allowed to independently configure wireless networking capabilities are explicitly authorized.'),\n('002325','draft','2013-06-24','DISA FSO','policy','Establish configuration requirements for organization-controlled mobile devices, to include when such devices are outside of controlled areas.','AC-19a.','N/A','Determine if: - configuration requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area. - connection requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area. - implementation guidance is established for organization-controlled mobile devices, including when such devices are outside of the controlled area.'),\n('002326','draft','2013-06-24','DISA FSO','policy','Establish connection requirements for organization-controlled mobile devices, to include when such devices are outside of controlled areas.','AC-19a.','N/A','Determine if: - configuration requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area. - connection requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area. - implementation guidance is established for organization-controlled mobile devices, including when such devices are outside of the controlled area.'),\n('002327','draft','2013-06-24','DISA FSO','policy','Defines the security policies which restrict the connection of classified mobile devices to classified systems.','AC-19(04)(c)','N/A','Determine if the connection of classified mobile devices to classified systems is restricted in accordance with [AC-19(04)_ODP[02]; security policies restricting the connection of classified mobile devices to classified systems are defined].'),\n('002328','draft','2013-06-24','DISA FSO','policy','Restrict the connection of classified mobile devices to classified systems in accordance with organization-defined security policies.','AC-19(04)(c)','N/A','Determine if the connection of classified mobile devices to classified systems is restricted in accordance with [AC-19(04)_ODP[02]; security policies restricting the connection of classified mobile devices to classified systems are defined].'),\n('002329','draft','2013-06-24','DISA FSO','policy','Defines the mobile devices that are to employ full-device or container encryption to protect the confidentiality and integrity of the information on the device.','AC-19(05)','N/A','Determine if [AC-19(05)_ODP[01]; one of the following PARAMETER VALUES is selected: {full-device encryption; container-based encryption}] is employed to protect the confidentiality and integrity of information on [AC-19(05)_ODP[02]; mobile devices on which to employ encryption are defined].'),\n('002330','draft','2013-06-24','DISA FSO','policy','Employ full-device encryption or container encryption to protect the confidentiality of information on organization-defined mobile devices.','AC-19(05)','N/A','Determine if [AC-19(05)_ODP[01]; one of the following PARAMETER VALUES is selected: {full-device encryption; container-based encryption}] is employed to protect the confidentiality and integrity of information on [AC-19(05)_ODP[02]; mobile devices on which to employ encryption are defined].'),\n('002331','draft','2013-06-24','DISA FSO','policy','Employ full-device encryption or container encryption to protect the integrity of information on organization-defined mobile devices.','AC-19(05)','N/A','Determine if [AC-19(05)_ODP[01]; one of the following PARAMETER VALUES is selected: {full-device encryption; container-based encryption}] is employed to protect the confidentiality and integrity of information on [AC-19(05)_ODP[02]; mobile devices on which to employ encryption are defined].'),\n('002332','draft','2013-06-24','DISA FSO','policy','Establish organization-defined terms and conditions, and/or identify organization-defined controls asserted to be implemented on external systems, consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using the external systems.','AC-20a.02','N/A','Determine if [AC-20_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {establish [AC-20_ODP[02]; terms and conditions consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems are defined (if selected)]; identify [AC-20_ODP[03]; controls asserted to be implemented on external systems consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems are defined (if selected)]}]]] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using external systems (if applicable).'),\n('002337','draft','2013-06-24','DISA FSO','policy','Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after the system retains approved system connection or processing agreements with the organizational entity hosting the external system.','AC-20(01)(b)','N/A','Determine if authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after retention of approved system connection or processing agreements with the organizational entity hosting the external system (if applicable).'),\n('002338','draft','2013-06-24','DISA FSO','policy','Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using organization-defined restrictions.','AC-20(03)','N/A','Determine if the use of non-organizationally owned systems or system components to process, store, or transmit organizational information is restricted using [AC-20(03)_ODP; restrictions on the use of non-organizationally owned systems or system components to process, store, or transmit organizational information are defined].'),\n('002339','draft','2013-06-24','DISA FSO','policy','Defines the network accessible storage devices that are to be prohibited from being used in external systems.','AC-20(04)','N/A','Determine if the use of [AC-20(04)_ODP; network-accessible storage devices prohibited from use in external systems are defined] is prohibited in external systems.'),\n('002340','draft','2013-06-24','DISA FSO','policy','Prohibit the use of organization-defined network accessible storage devices in external systems.','AC-20(04)','N/A','Determine if the use of [AC-20(04)_ODP; network-accessible storage devices prohibited from use in external systems are defined] is prohibited in external systems.'),\n('002341','draft','2013-06-25','DISA FSO','policy','Defines the information sharing restrictions to be enforced when implementing information search and retrieval services.','AC-21(02)','N/A','Determine if information search and retrieval services that enforce [AC-21(02)_ODP; information-sharing restrictions to be enforced by information search and retrieval services are defined] are implemented.'),\n('002342','draft','2013-06-25','DISA FSO','technical','Implement information search and retrieval services that enforce organization-defined information sharing restrictions.','AC-21(02)','N/A','Determine if information search and retrieval services that enforce [AC-21(02)_ODP; information-sharing restrictions to be enforced by information search and retrieval services are defined] are implemented.'),\n('002343','draft','2013-06-25','DISA FSO','policy','Defines the data mining prevention techniques to be employed to protect organization-defined data storage objects against data mining.','AC-23','N/A','Determine if [AC-23_ODP[01]; data mining prevention and detection techniques are defined] are employed for [AC-23_ODP[02]; data storage objects to be protected against unauthorized data mining are defined] to detect and protect against unauthorized data mining.'),\n('002344','draft','2013-06-25','DISA FSO','policy','Defines the data mining detection techniques to be employed to detect data mining attempts against organization-defined data storage objects.','AC-23','N/A','Determine if [AC-23_ODP[01]; data mining prevention and detection techniques are defined] are employed for [AC-23_ODP[02]; data storage objects to be protected against unauthorized data mining are defined] to detect and protect against unauthorized data mining.'),\n('002345','draft','2013-06-25','DISA FSO','policy','Defines the data storage objects that are to be protected against data mining attempts.','AC-23','N/A','Determine if [AC-23_ODP[01]; data mining prevention and detection techniques are defined] are employed for [AC-23_ODP[02]; data storage objects to be protected against unauthorized data mining are defined] to detect and protect against unauthorized data mining.'),\n('002346','draft','2013-06-25','DISA FSO','technical','Employ organization-defined data mining prevention techniques for organization-defined data storage objects to protect against unauthorized data mining.','AC-23','N/A','Determine if [AC-23_ODP[01]; data mining prevention and detection techniques are defined] are employed for [AC-23_ODP[02]; data storage objects to be protected against unauthorized data mining are defined] to detect and protect against unauthorized data mining.'),\n('002347','draft','2013-06-25','DISA FSO','technical','Employ organization-defined data mining detection techniques for organization-defined data storage objects to detect data mining attempts.','AC-23','N/A','Determine if [AC-23_ODP[01]; data mining prevention and detection techniques are defined] are employed for [AC-23_ODP[02]; data storage objects to be protected against unauthorized data mining are defined] to detect and protect against unauthorized data mining.'),\n('002348','draft','2013-06-25','DISA FSO','policy','Defines the access control decisions that are to be applied to each access request prior to access enforcement.','AC-24','N/A','Determine if [AC-24_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {establish procedures; implement mechanisms}] are taken to ensure that [AC-24_ODP[02]; access control decisions applied to each access request prior to access enforcement are defined] are applied to each access request prior to access enforcement.'),\n('002349','draft','2013-06-25','DISA FSO','policy','Establish procedures or implement mechanisms to ensure organization-defined access control decisions are applied to each access request prior to access enforcement.','AC-24','N/A','Determine if [AC-24_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {establish procedures; implement mechanisms}] are taken to ensure that [AC-24_ODP[02]; access control decisions applied to each access request prior to access enforcement are defined] are applied to each access request prior to access enforcement.'),\n('002350','draft','2013-06-25','DISA FSO','policy','Defines the access authorization information that is to be transmitted using organization-defined security safeguards to organization-defined systems that enforce access control decisions.','AC-24(01)','N/A','Determine if [AC-24(01)_ODP[01]; access authorization information transmitted to systems that enforce access control decisions is defined] is transmitted using [AC-24(01)_ODP[02]; controls to be used when authorization information is transmitted to systems that enforce access control decisions are defined] to [AC-24(01)_ODP[03]; systems that enforce access control decisions are defined] that enforce access control decisions.'),\n('002351','draft','2013-06-25','DISA FSO','policy','Defines the controls to be employed when transmitting organization-defined access authorization information to organization-defined systems that enforce access control decisions.','AC-24(01)','N/A','Determine if [AC-24(01)_ODP[01]; access authorization information transmitted to systems that enforce access control decisions is defined] is transmitted using [AC-24(01)_ODP[02]; controls to be used when authorization information is transmitted to systems that enforce access control decisions are defined] to [AC-24(01)_ODP[03]; systems that enforce access control decisions are defined] that enforce access control decisions.'),\n('002352','draft','2013-06-25','DISA FSO','policy','Defines the systems that are to be recipients of organization-defined access authorization information using organization-defined security safeguards.','AC-24(01)','N/A','Determine if [AC-24(01)_ODP[01]; access authorization information transmitted to systems that enforce access control decisions is defined] is transmitted using [AC-24(01)_ODP[02]; controls to be used when authorization information is transmitted to systems that enforce access control decisions are defined] to [AC-24(01)_ODP[03]; systems that enforce access control decisions are defined] that enforce access control decisions.'),\n('002353','draft','2013-06-25','DISA FSO','technical','Transmit organization-defined access authorization information using organization-defined controls to organization-defined systems that enforce access control decisions.','AC-24(01)','N/A','Determine if [AC-24(01)_ODP[01]; access authorization information transmitted to systems that enforce access control decisions is defined] is transmitted using [AC-24(01)_ODP[02]; controls to be used when authorization information is transmitted to systems that enforce access control decisions are defined] to [AC-24(01)_ODP[03]; systems that enforce access control decisions are defined] that enforce access control decisions.'),\n('002354','draft','2013-06-25','DISA FSO','policy','Defines the security attributes, not to include the identity of the user or process acting on behalf of the user, to be used as the basis for enforcing access control decisions.','AC-24(02)','N/A','Determine if: - access control decisions are enforced based on [AC-24(02)_ODP[01]; security attributes that do not include the identity of the user or process acting on behalf of the user are defined (if selected)] that do not include the identity of the user or process acting on behalf of the user (if selected). - access control decisions are enforced based on [AC-24(02)_ODP[02]; privacy attributes that do not include the identity of the user or process acting on behalf of the user are defined (if selected)] that do not include the identity of the user or process acting on behalf of the user (if selected).'),\n('002355','draft','2013-06-25','DISA FSO','technical','Enforce access control decisions based on organization-defined security or privacy attributes that do not include the identity of the user or process acting on behalf of the user.','AC-24(02)','N/A','Determine if: - access control decisions are enforced based on [AC-24(02)_ODP[01]; security attributes that do not include the identity of the user or process acting on behalf of the user are defined (if selected)] that do not include the identity of the user or process acting on behalf of the user (if selected). - access control decisions are enforced based on [AC-24(02)_ODP[02]; privacy attributes that do not include the identity of the user or process acting on behalf of the user are defined (if selected)] that do not include the identity of the user or process acting on behalf of the user (if selected).'),\n('002356','draft','2013-06-25','DISA FSO','policy','Defines the access control policies to be implemented by the reference monitor.','AC-25','N/A','Determine if a reference monitor is implemented for [AC-25_ODP; access control policies for which a reference monitor is implemented are defined] that is tamper-proof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.'),\n('002357','draft','2013-06-25','DISA FSO','technical','Implement a reference monitor for organization-defined access control policies that is tamperproof.','AC-25','N/A','Determine if a reference monitor is implemented for [AC-25_ODP; access control policies for which a reference monitor is implemented are defined] that is tamper-proof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.'),\n('002358','draft','2013-06-25','DISA FSO','technical','Implement a reference monitor for organization-defined access control policies that is always invoked.','AC-25','N/A','Determine if a reference monitor is implemented for [AC-25_ODP; access control policies for which a reference monitor is implemented are defined] that is tamper-proof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.'),\n('002359','draft','2013-06-25','DISA FSO','technical','Implement a reference monitor for organization-defined access control policies that is small enough to be subject to analysis and testing, the completeness of which can be assured.','AC-25','N/A','Determine if a reference monitor is implemented for [AC-25_ODP; access control policies for which a reference monitor is implemented are defined] that is tamper-proof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.'),\n('002360','draft','2013-06-26','DISA FSO','policy','Defines the conditions or trigger events requiring session disconnect when automatically terminating a user session.','AC-12','N/A','Determine if a user session is automatically terminated after [AC-12_ODP; conditions or trigger events requiring session disconnect are defined].'),\n('002361','draft','2013-06-26','DISA FSO','technical','Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.','AC-12','N/A','Determine if a user session is automatically terminated after [AC-12_ODP; conditions or trigger events requiring session disconnect are defined].'),\n('002362','draft','2013-06-26','DISA FSO','policy','Defines the information resources requiring authentication in order to gain access.','AC-12(01)','N/A','Determine if a logout capability is provided for user-initiated communications sessions whenever authentication is used to gain access to [AC-12(01)_ODP; information resources for which a logout capability for user-initiated communications sessions is required are defined].'),\n('002363','draft','2013-06-26','DISA FSO','technical','Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to organization-defined information resources.','AC-12(01)','N/A','Determine if a logout capability is provided for user-initiated communications sessions whenever authentication is used to gain access to [AC-12(01)_ODP; information resources for which a logout capability for user-initiated communications sessions is required are defined].'),\n('002364','draft','2013-06-26','DISA FSO','technical','Display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.','AC-12(02)','N/A','Determine if an explicit logout message is displayed to users indicating the termination of authenticated communication sessions.'),\n('002368','draft','2013-07-01','DISA FSO','policy','Defines the personnel or roles to whom the organization-level; mission/business process-level; system-level risk assessment policy is disseminated.','RA-01a.','N/A','Determine if: - a risk assessment policy is developed and documented. - the risk assessment policy is disseminated to [RA-01_ODP[01; personnel or roles to whom the risk assessment policy is to be disseminated is/are defined].'),\n('002369','draft','2013-07-01','DISA FSO','policy','Defines the personnel or roles to whom the risk assessment procedures are disseminated.','RA-01a.02','N/A','Determine if: - risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls are developed and documented. - the risk assessment procedures are disseminated to [RA-01_ODP[02]; personnel or roles to whom the risk assessment procedures are to be disseminated is/are defined].'),\n('002370','draft','2013-07-01','DISA FSO','policy','Disseminate risk assessment results to organization-defined personnel or roles.','RA-03e.','N/A','Determine if risk assessment results are disseminated to [RA-03_ODP[04]; personnel or roles to whom risk assessment results are to be disseminated is/are defined].'),\n('002371','draft','2013-07-01','DISA FSO','policy','Defines the personnel or roles to whom the risk assessment results will be disseminated.','RA-03e.','N/A','Determine if risk assessment results are disseminated to [RA-03_ODP[04]; personnel or roles to whom risk assessment results are to be disseminated is/are defined].'),\n('002372','draft','2013-07-01','DISA FSO','policy','Correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability and multi-hop attack vectors.','RA-05(10)','N/A','Determine if the output from vulnerability scanning tools is correlated to determine the presence of multi-vulnerability and multi-hop attack vectors.'),\n('002373','draft','2013-07-01','DISA FSO','policy','Define the breadth and depth of vulnerability scanning coverage (i.e., information system components scanned and vulnerabilities checked).','RA-05(03)','N/A','Determine if the breadth and depth of vulnerability scanning coverage are defined.'),\n('002374','draft','2013-07-01','DISA FSO','policy','Defines the corrective actions if unintended information about the system is discovered.','RA-05(04)','N/A','Determine if: - information about the system is discoverable. - [RA-05(04)_ODP; corrective actions to be taken if information about the system is discoverable are defined] are taken when information about the system is confirmed as discoverable.'),\n('002375','draft','2013-07-02','DISA FSO','policy','Take organization-defined corrective actions if information about the system is discovered.','RA-05(04)','N/A','Determine if: - information about the system is discoverable. - [RA-05(04)_ODP; corrective actions to be taken if information about the system is discoverable are defined] are taken when information about the system is confirmed as discoverable.'),\n('002376','draft','2013-07-02','DISA FSO','policy','Defines the personnel or roles with whom the information obtained from the vulnerability monitoring process and control assessments will be shared.','RA-05e.','N/A','Determine if information obtained from the vulnerability monitoring process and control assessments is shared with [RA-05_ODP[04]; personnel or roles with whom information obtained from the vulnerability scanning process and control assessments is to be shared] to help eliminate similar vulnerabilities in other systems.'),\n('002378','draft','2013-07-02','DISA FSO','policy','Defines the personnel or roles to be recipients of the organization-level; mission/business process-level; and/or system-level system and communications protection policy.','SC-01a.','N/A','Determine if: - a system and communications protection policy is developed and documented. - the system and communications protection policy is disseminated to [SC-01_ODP[01]; personnel or roles to whom the system and communications protection policy is to be disseminated is/are defined].'),\n('002380','draft','2013-07-02','DISA FSO','policy','Defines the personnel or roles to be recipients of the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.','SC-01a.02','N/A','Determine if: - system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls are developed and documented. - the system and communications protection procedures are disseminated to [SC-01_ODP[02]; personnel or roles to whom the system and communications protection procedures are to be disseminated is/are defined].'),\n('002381','draft','2013-07-02','DISA FSO','technical','Minimize the number of nonsecurity functions included within the isolation boundary containing security functions.','SC-03(03)','N/A','Determine if the number of non-security functions included within the isolation boundary containing security functions is minimized.'),\n('002382','draft','2013-07-02','DISA FSO','technical','Implement security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules.','SC-03(04)','N/A','Determine if: - security functions are implemented as largely independent modules that maximize internal cohesiveness within modules. - security functions are implemented as largely independent modules that minimize coupling between modules.'),\n('002383','draft','2013-07-02','DISA FSO','policy','Defines the procedures to be employed to prevent unauthorized information transfer via shared resources when system processing explicitly switches between different information classification levels or security categories.','SC-04(02)','N/A','Determine if unauthorized information transfer via shared resources is prevented in accordance with [SC-04(02)_ODP; procedures to prevent unauthorized information transfer via shared resources are defined] when system processing explicitly switches between different information classification levels or security categories.'),\n('002384','draft','2013-07-02','DISA FSO','technical','Prevent unauthorized information transfer via shared resources in accordance with organization-defined procedures when system processing explicitly switches between different information classification levels or security categories.','SC-04(02)','N/A','Determine if unauthorized information transfer via shared resources is prevented in accordance with [SC-04(02)_ODP; procedures to prevent unauthorized information transfer via shared resources are defined] when system processing explicitly switches between different information classification levels or security categories.'),\n('002385','draft','2013-07-02','DISA FSO','technical','Protect against or limit the effects of organization-defined types of denial-of-service events.','SC-05a.','N/A','Determine if the effects of [SC-05_ODP[01]; types of denial-of-service events to be protected against or limited are defined] are [SC-05_ODP[02]; one of the following PARAMETER VALUES is selected: {protect against; limit}].'),\n('002387','draft','2013-07-02','DISA FSO','policy','Defines the denial of service attacks against other systems that the system is to restrict the ability of individuals to launch.','SC-05(01)','N/A','Determine if the ability of individuals to launch [SC-05(01)_ODP; denial-of-service attacks for which to restrict the ability of individuals to launch are defined] against other systems is restricted.'),\n('002388','draft','2013-07-02','DISA FSO','policy','Defines the monitoring tools to be employed to detect indicators of denial-of-service attacks against the system.',NULL,'N/A',NULL),\n('002389','draft','2013-07-02','DISA FSO','policy','Employ organization-defined monitoring tools to detect indicators of denial-of-service attacks against, or launched from, the system.',NULL,'N/A',NULL),\n('002390','draft','2013-07-02','DISA FSO','policy','Defines the system resources to be monitored to determine if sufficient resources exist to prevent effective denial-of-service attacks.',NULL,'N/A',NULL),\n('002391','draft','2013-07-02','DISA FSO','policy','Monitor organization-defined system resources to determine if sufficient resources exist to prevent effective denial-of-service attacks.',NULL,'N/A',NULL),\n('002392','draft','2013-07-02','DISA FSO','policy','Defines the resources to be allocated to protect the availability of system resources.','SC-06','N/A','Determine if the availability of resources is protected by allocating [SC-06_ODP[01]; resources to be allocated to protect the availability of resources are defined] by [SC-06_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {priority; quota; [SC-06_ODP[03]; controls to protect the availability of resources are defined (if selected)]}].'),\n('002393','draft','2013-07-02','DISA FSO','policy','Defines the controls to be employed to protect the availability of system resources.','SC-06','N/A','Determine if the availability of resources is protected by allocating [SC-06_ODP[01]; resources to be allocated to protect the availability of resources are defined] by [SC-06_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {priority; quota; [SC-06_ODP[03]; controls to protect the availability of resources are defined (if selected)]}].'),\n('002394','draft','2013-07-02','DISA FSO','technical','Protect the availability of resources by allocating organization-defined resources based on priority, quota, and/or organization-defined controls.','SC-06','N/A','Determine if the availability of resources is protected by allocating [SC-06_ODP[01]; resources to be allocated to protect the availability of resources are defined] by [SC-06_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {priority; quota; [SC-06_ODP[03]; controls to protect the availability of resources are defined (if selected)]}].'),\n('002395','draft','2013-07-02','DISA FSO','policy','Implement subnetworks for publicly accessible system components that are physically and/or logically separated from internal organizational networks.','SC-07b.','N/A','Determine if subnetworks for publicly accessible system components are [SC-07_ODP; one of the following PARAMETER VALUES is selected: {physically; logically}] separated from internal organizational networks.'),\n('002396','draft','2013-07-02','DISA FSO','policy','Protect the confidentiality and integrity of the information being transmitted across each interface for each external telecommunication service.','SC-07(04)(c)','N/A','Determine if: - the confidentiality of the information being transmitted across each interface is protected. - the integrity of the information being transmitted across each interface is protected.'),\n('002397','draft','2013-07-02','DISA FSO','technical','Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using organization-defined safeguards.','SC-07(07)','N/A','Determine if split tunneling is prevented for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [SC-07(07)_ODP; safeguards to securely provision split tunneling are defined].'),\n('002398','draft','2013-07-02','DISA FSO','policy','Detect outgoing communications traffic posing a threat to external systems.','SC-07(09)(a)','N/A','Determine if: - outgoing communications traffic posing a threat to external systems is detected. - outgoing communications traffic posing a threat to external systems is denied. '),\n('002399','draft','2013-07-02','DISA FSO','policy','Deny outgoing communications traffic posing a threat to external systems.','SC-07(09)(a)','N/A','Determine if: - outgoing communications traffic posing a threat to external systems is detected. - outgoing communications traffic posing a threat to external systems is denied. '),\n('002400','draft','2013-07-02','DISA FSO','technical','Audit the identity of internal users associated with denied outgoing communications traffic posing a threat to external systems.','SC-07(09)(b)','N/A','Determine if the identity of internal users associated with denied communications is audited.'),\n('002401','draft','2013-07-02','DISA FSO','policy','Defines the authorized sources from which the system will allow incoming communications.','SC-07(11)','N/A','Determine if only incoming communications from [SC-07(11)_ODP[01]; authorized sources of incoming communications to be routed are defined] are allowed to be routed to [SC-07(11)_ODP[02]; authorized destinations to which incoming communications from authorized sources may be routed are defined].'),\n('002402','draft','2013-07-02','DISA FSO','policy','Defines the authorized destinations for routing inbound communications.','SC-07(11)','N/A','Determine if only incoming communications from [SC-07(11)_ODP[01]; authorized sources of incoming communications to be routed are defined] are allowed to be routed to [SC-07(11)_ODP[02]; authorized destinations to which incoming communications from authorized sources may be routed are defined].'),\n('002403','draft','2013-07-02','DISA FSO','technical','Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.','SC-07(11)','N/A','Determine if only incoming communications from [SC-07(11)_ODP[01]; authorized sources of incoming communications to be routed are defined] are allowed to be routed to [SC-07(11)_ODP[02]; authorized destinations to which incoming communications from authorized sources may be routed are defined].'),\n('002404','draft','2013-07-02','DISA FSO','policy','Defines the host-based boundary protection mechanisms that are to be implemented at organization-defined system components.','SC-07(12)','N/A','Determine if [SC-07(12)_ODP[01]; host-based boundary protection mechanisms to be implemented are defined] are implemented at [SC-07(12)_ODP[02]; system components where host-based boundary protection mechanisms are to be implemented are defined].'),\n('002405','draft','2013-07-02','DISA FSO','policy','Defines the system components at which organization-defined host-based boundary protection mechanisms will be implemented.','SC-07(12)','N/A','Determine if [SC-07(12)_ODP[01]; host-based boundary protection mechanisms to be implemented are defined] are implemented at [SC-07(12)_ODP[02]; system components where host-based boundary protection mechanisms are to be implemented are defined].'),\n('002406','draft','2013-07-02','DISA FSO','policy','Implement organization-defined host-based boundary protection mechanisms at organization-defined system components.','SC-07(12)','N/A','Determine if [SC-07(12)_ODP[01]; host-based boundary protection mechanisms to be implemented are defined] are implemented at [SC-07(12)_ODP[02]; system components where host-based boundary protection mechanisms are to be implemented are defined].'),\n('002407','draft','2013-07-02','DISA FSO','policy','Defines the managed interfaces at which protect against unauthorized physical connections.','SC-07(14)','N/A','Determine if [SC-07(14)_ODP; managed interfaces to be protected against unauthorized physical connections are defined] are protected against unauthorized physical connections.'),\n('002408','draft','2013-07-02','DISA FSO','policy','Defines the communication clients that are independently configured by end users and external service providers which will block both inbound and outbound communications traffic.','SC-07(19)','N/A','Determine if: - inbound communications traffic is blocked between [SC-07(19)_ODP; communication clients that are independently configured by end users and external service providers are defined] that are independently configured by end users and external service providers. - outbound communications traffic is blocked between [SC-07(19)_ODP; communication clients that are independently configured by end users and external service providers are defined] that are independently configured by end users and external service providers.'),\n('002409','draft','2013-07-02','DISA FSO','technical','Block inbound and outbound communications traffic between organization-defined communication clients that are independently configured by end users and external service providers.','SC-07(19)','N/A','Determine if: - inbound communications traffic is blocked between [SC-07(19)_ODP; communication clients that are independently configured by end users and external service providers are defined] that are independently configured by end users and external service providers. - outbound communications traffic is blocked between [SC-07(19)_ODP; communication clients that are independently configured by end users and external service providers are defined] that are independently configured by end users and external service providers.'),\n('002410','draft','2013-07-02','DISA FSO','policy','Defines system components that are to be dynamically isolated from other system components.','SC-07(20)','N/A','Determine if the capability to dynamically isolate [SC-07(20)_ODP; system components to be dynamically isolated from other system components are defined] from other system components is provided.'),\n('002411','draft','2013-07-02','DISA FSO','technical','Provide the capability to dynamically isolate organization-defined system components from other system components.','SC-07(20)','N/A','Determine if the capability to dynamically isolate [SC-07(20)_ODP; system components to be dynamically isolated from other system components are defined] from other system components is provided.'),\n('002413','draft','2013-07-02','DISA FSO','policy','Defines the system components supporting organization-defined missions and/or business functions that are to be isolated using boundary protection mechanisms.','SC-07(21)','N/A','Determine if boundary protection mechanisms are employed to isolate [SC-07(21)_ODP[01]; system components to be isolated by boundary protection mechanisms are defined] supporting [SC-07(21)_ODP[02]; missions and/or business functions to be supported by system components isolated by boundary protection mechanisms are defined].'),\n('002414','draft','2013-07-02','DISA FSO','policy','Defines the missions and/or business functions for which boundary protection mechanisms will be employed to isolate the supporting organization-defined system components.','SC-07(21)','N/A','Determine if boundary protection mechanisms are employed to isolate [SC-07(21)_ODP[01]; system components to be isolated by boundary protection mechanisms are defined] supporting [SC-07(21)_ODP[02]; missions and/or business functions to be supported by system components isolated by boundary protection mechanisms are defined].'),\n('002415','draft','2013-07-02','DISA FSO','policy','Employ boundary protection mechanisms to isolate organization-defined system components supporting organization-defined missions and/or business functions.','SC-07(21)','N/A','Determine if boundary protection mechanisms are employed to isolate [SC-07(21)_ODP[01]; system components to be isolated by boundary protection mechanisms are defined] supporting [SC-07(21)_ODP[02]; missions and/or business functions to be supported by system components isolated by boundary protection mechanisms are defined].'),\n('002416','draft','2013-07-02','DISA FSO','policy','Implement separate network addresses to connect to systems in different security domains.','SC-07(22)','N/A','Determine if separate network addresses are implemented to connect to systems in different security domains.'),\n('002417','draft','2013-07-02','DISA FSO','technical','Disable feedback to senders on protocol format validation failure.','SC-07(23)','N/A','Determine if feedback to senders is disabled on protocol format validation failure.'),\n('002418','draft','2013-07-02','DISA FSO','policy','Protect the confidentiality and/or integrity of transmitted information.','SC-08','N/A','Determine if the [SC-08_ODP; one or more of the following PARAMETER VALUES is/are selected: {confidentiality; integrity}] of transmitted information is/are protected.'),\n('002420','draft','2013-07-02','DISA FSO','technical','Maintain the confidentiality and/or integrity of information during preparation for transmission.','SC-08(02)','N/A','Determine if: - information [SC-08(02)_ODP; one or more of the following PARAMETER VALUES is/are selected: {confidentiality; integrity}] is/are maintained during preparation for transmission. - information [SC-08(02)_ODP; one or more of the following PARAMETER VALUES is/are selected: {confidentiality; integrity}] is/are maintained during reception.'),\n('002421','draft','2013-07-02','DISA FSO','technical','Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.','SC-08(01)','N/A','Determine if cryptographic mechanisms are implemented to [SC-08(01)_ODP; one or more of the following PARAMETER VALUES is/are selected: {prevent unauthorized disclosure of information; detect changes to information}] during transmission.'),\n('002422','draft','2013-07-02','DISA FSO','technical','Maintain the confidentiality and/or integrity of information during reception.','SC-08(02)','N/A','Determine if: - information [SC-08(02)_ODP; one or more of the following PARAMETER VALUES is/are selected: {confidentiality; integrity}] is/are maintained during preparation for transmission. - information [SC-08(02)_ODP; one or more of the following PARAMETER VALUES is/are selected: {confidentiality; integrity}] is/are maintained during reception.'),\n('002423','draft','2013-07-02','DISA FSO','technical','Implement cryptographic mechanisms to protect message externals unless otherwise protected by organization-defined alternative physical controls.','SC-08(03)','N/A','Determine if cryptographic mechanisms are implemented to protect message externals unless otherwise protected by [SC-08(03)_ODP; alternative physical controls to protect message externals are defined].'),\n('002424','draft','2013-07-02','DISA FSO','policy','Defines the alternative physical controls to be employed when cryptographic mechanisms to conceal or randomize communication patterns are not implemented.','SC-08(04)','N/A','Determine if cryptographic mechanisms are implemented to conceal or randomize communication patterns unless otherwise protected by [SC-08(04)_ODP; alternative physical controls to protect against unauthorized disclosure of communication patterns are defined].'),\n('002425','draft','2013-07-02','DISA FSO','technical','Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by organization-defined alternative physical controls.','SC-08(04)','N/A','Determine if cryptographic mechanisms are implemented to conceal or randomize communication patterns unless otherwise protected by [SC-08(04)_ODP; alternative physical controls to protect against unauthorized disclosure of communication patterns are defined].'),\n('002426','draft','2013-07-02','DISA FSO','technical','Provide a trusted communications path that is irrefutably distinguishable from other communications paths.','SC-11(01)(a)','N/A','Determine if a trusted communication path that is irrefutably distinguishable from other communication paths is provided.'),\n('002427','draft','2013-07-02','DISA FSO','policy','Defines the alternative physical controls to be employed to protect message externals when cryptographic mechanisms are not implemented.','SC-08(03)','N/A','Determine if cryptographic mechanisms are implemented to protect message externals unless otherwise protected by [SC-08(03)_ODP; alternative physical controls to protect message externals are defined].'),\n('002428','draft','2013-07-02','DISA FSO','policy','Defines the requirements for cryptographic key generation to be employed within the system.','SC-12','N/A','Determine if: - cryptographic keys are established when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined]. - cryptographic keys are managed when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined].'),\n('002429','draft','2013-07-02','DISA FSO','policy','Defines the requirements for cryptographic key distribution to be employed within the system.','SC-12','N/A','Determine if: - cryptographic keys are established when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined]. - cryptographic keys are managed when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined].'),\n('002430','draft','2013-07-02','DISA FSO','policy','Defines the requirements for cryptographic key storage to be employed within the system.','SC-12','N/A','Determine if: - cryptographic keys are established when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined]. - cryptographic keys are managed when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined].'),\n('002431','draft','2013-07-02','DISA FSO','policy','Defines the requirements for cryptographic key access to be employed within the system.','SC-12','N/A','Determine if: - cryptographic keys are established when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined]. - cryptographic keys are managed when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined].'),\n('002432','draft','2013-07-02','DISA FSO','policy','Defines the requirements for cryptographic key destruction to be employed within the system.','SC-12','N/A','Determine if: - cryptographic keys are established when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined]. - cryptographic keys are managed when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined].'),\n('002433','draft','2013-07-02','DISA FSO','policy','Establish cryptographic keys when cryptography is employed within the system in accordance with organization-defined requirements for key generation.','SC-12','N/A','Determine if: - cryptographic keys are established when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined]. - cryptographic keys are managed when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined].'),\n('002434','draft','2013-07-02','DISA FSO','policy','Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key distribution.','SC-12','N/A','Determine if: - cryptographic keys are established when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined]. - cryptographic keys are managed when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined].'),\n('002435','draft','2013-07-02','DISA FSO','policy','Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key storage.','SC-12','N/A','Determine if: - cryptographic keys are established when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined]. - cryptographic keys are managed when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined].'),\n('002436','draft','2013-07-02','DISA FSO','policy','Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key access.','SC-12','N/A','Determine if: - cryptographic keys are established when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined]. - cryptographic keys are managed when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined].'),\n('002437','draft','2013-07-02','DISA FSO','policy','Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key destruction.','SC-12','N/A','Determine if: - cryptographic keys are established when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined]. - cryptographic keys are managed when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined].'),\n('002438','draft','2013-07-02','DISA FSO','policy','Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key generation.','SC-12','N/A','Determine if: - cryptographic keys are established when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined]. - cryptographic keys are managed when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined].'),\n('002439','draft','2013-07-02','DISA FSO','policy','Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key distribution.',NULL,'N/A',NULL),\n('002440','draft','2013-07-02','DISA FSO','policy','Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key storage.','SC-12','N/A','Determine if: - cryptographic keys are established when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined]. - cryptographic keys are managed when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined].'),\n('002441','draft','2013-07-02','DISA FSO','policy','Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key access.','SC-12','N/A','Determine if: - cryptographic keys are established when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined]. - cryptographic keys are managed when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined].'),\n('002442','draft','2013-07-02','DISA FSO','policy','Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key destruction.','SC-12','N/A','Determine if: - cryptographic keys are established when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined]. - cryptographic keys are managed when cryptography is employed within the system in accordance with [SC-12_ODP; requirements for key generation, distribution, storage, access, and destruction are defined].'),\n('002443','draft','2013-07-02','DISA FSO','policy','Produce symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes.','SC-12(02)','N/A','Determine if: - symmetric cryptographic keys are produced using [SC-12(02)_ODP; one of the following PARAMETER VALUES is selected: {NIST FIPS-validated; NSA-approved}] key management technology and processes. - symmetric cryptographic keys are controlled using [SC-12(02)_ODP; one of the following PARAMETER VALUES is selected: {NIST FIPS-validated; NSA-approved}] key management technology and processes. - symmetric cryptographic keys are distributed using [SC-12(02)_ODP; one of the following PARAMETER VALUES is selected: {NIST FIPS-validated; NSA-approved}] key management technology and processes.'),\n('002444','draft','2013-07-02','DISA FSO','policy','Control symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes.','SC-12(02)','N/A','Determine if: - symmetric cryptographic keys are produced using [SC-12(02)_ODP; one of the following PARAMETER VALUES is selected: {NIST FIPS-validated; NSA-approved}] key management technology and processes. - symmetric cryptographic keys are controlled using [SC-12(02)_ODP; one of the following PARAMETER VALUES is selected: {NIST FIPS-validated; NSA-approved}] key management technology and processes. - symmetric cryptographic keys are distributed using [SC-12(02)_ODP; one of the following PARAMETER VALUES is selected: {NIST FIPS-validated; NSA-approved}] key management technology and processes.'),\n('002445','draft','2013-07-02','DISA FSO','policy','Distribute symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes.','SC-12(02)','N/A','Determine if: - symmetric cryptographic keys are produced using [SC-12(02)_ODP; one of the following PARAMETER VALUES is selected: {NIST FIPS-validated; NSA-approved}] key management technology and processes. - symmetric cryptographic keys are controlled using [SC-12(02)_ODP; one of the following PARAMETER VALUES is selected: {NIST FIPS-validated; NSA-approved}] key management technology and processes. - symmetric cryptographic keys are distributed using [SC-12(02)_ODP; one of the following PARAMETER VALUES is selected: {NIST FIPS-validated; NSA-approved}] key management technology and processes.'),\n('002446','draft','2013-07-02','DISA FSO','policy','Produce asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; or certificates issued in accordance with organization-defined requirements.','SC-12(03)','N/A','Determine if: - asymmetric cryptographic keys are produced using [SC-12(03)_ODP; one of the following PARAMETER VALUES is selected: {NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; certificates issued in accordance with organization-defined requirements}]. - asymmetric cryptographic keys are controlled using [SC-12(03)_ODP; one of the following PARAMETER VALUES is selected: {NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; certificates issued in accordance with organization-defined requirements}]. - asymmetric cryptographic keys are distributed using [SC-12(03)_ODP; one of the following PARAMETER VALUES is selected: {NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; certificates issued in accordance with organization-defined requirements}].'),\n('002447','draft','2013-07-02','DISA FSO','policy','Control asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; or certificates issued in accordance with organization-defined requirements.','SC-12(03)','N/A','Determine if: - asymmetric cryptographic keys are produced using [SC-12(03)_ODP; one of the following PARAMETER VALUES is selected: {NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; certificates issued in accordance with organization-defined requirements}]. - asymmetric cryptographic keys are controlled using [SC-12(03)_ODP; one of the following PARAMETER VALUES is selected: {NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; certificates issued in accordance with organization-defined requirements}]. - asymmetric cryptographic keys are distributed using [SC-12(03)_ODP; one of the following PARAMETER VALUES is selected: {NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; certificates issued in accordance with organization-defined requirements}].'),\n('002448','draft','2013-07-02','DISA FSO','policy','Distribute asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; or certificates issued in accordance with organization-defined requirements.','SC-12(03)','N/A','Determine if: - asymmetric cryptographic keys are produced using [SC-12(03)_ODP; one of the following PARAMETER VALUES is selected: {NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; certificates issued in accordance with organization-defined requirements}]. - asymmetric cryptographic keys are controlled using [SC-12(03)_ODP; one of the following PARAMETER VALUES is selected: {NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; certificates issued in accordance with organization-defined requirements}]. - asymmetric cryptographic keys are distributed using [SC-12(03)_ODP; one of the following PARAMETER VALUES is selected: {NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; certificates issued in accordance with organization-defined requirements}].'),\n('002449','draft','2013-07-02','DISA FSO','policy','Defines the cryptographic uses, and type of cryptography required for each use, to be implemented by the system.',NULL,'N/A',NULL),\n('002450','draft','2013-07-02','DISA FSO','technical','Implement organization-defined types of cryptography for each specified cryptography use.','SC-13a.','N/A','Determine if [SC-13_ODP[01]; cryptographic uses are defined] are identified.'),\n('002451','draft','2013-07-02','DISA FSO','policy','Defines the systems or system components from which collaborative computing devices and applications in organization-defined secure work areas are to be disabled or removed.','SC-15(03)','N/A','Determine if collaborative computing devices and applications are disabled or removed from [SC-15(03)_ODP[01]; systems or system components from which collaborative computing devices are to be disabled or removed are defined] in [SC-15(03)_ODP[02]; secure work areas where collaborative computing devices are to be disabled or removed from systems or system components are defined].'),\n('002452','draft','2013-07-02','DISA FSO','policy','Defines the online meetings and teleconferences for which the system provides an explicit indication of current participants.','SC-15(04)','N/A','Determine if an explicit indication of current participants in [SC-15(04)_ODP; online meetings and teleconferences for which an explicit indication of current participants is to be provided are defined] is provided.'),\n('002453','draft','2013-07-02','DISA FSO','technical','Provide an explicit indication of current participants in organization-defined online meetings and teleconferences.',NULL,'N/A',NULL),\n('002454','draft','2013-07-02','DISA FSO','policy','Defines the security attributes to associate with the information being exchanged between systems and between system components.','SC-16','N/A','Determine if: - [SC-16_ODP[01]; security attributes to be associated with information exchanged are defined] are associated with information exchanged between systems. - [SC-16_ODP[01]; security attributes to be associated with information exchanged are defined] are associated with information exchanged between system components. - [SC-16_ODP[02]; privacy attributes to be associated with information exchanged are defined] are associated with information exchanged between systems. - [SC-16_ODP[02]; privacy attributes to be associated with information exchanged are defined] are associated with information exchanged between system components.'),\n('002455','draft','2013-07-02','DISA FSO','technical','Associate organization-defined security attributes with information exchanged between system components.','SC-16','N/A','Determine if: - [SC-16_ODP[01]; security attributes to be associated with information exchanged are defined] are associated with information exchanged between systems. - [SC-16_ODP[01]; security attributes to be associated with information exchanged are defined] are associated with information exchanged between system components. - [SC-16_ODP[02]; privacy attributes to be associated with information exchanged are defined] are associated with information exchanged between systems. - [SC-16_ODP[02]; privacy attributes to be associated with information exchanged are defined] are associated with information exchanged between system components.'),\n('002456','draft','2013-07-02','DISA FSO','policy','Defines the certificate policy employed to issue public key certificates.','SC-15(04)','N/A','Determine if an explicit indication of current participants in [SC-15(04)_ODP; online meetings and teleconferences for which an explicit indication of current participants is to be provided are defined] is provided.'),\n('002457','draft','2013-07-02','DISA FSO','policy','Defines the corrective actions to be taken when organization-defined unacceptable mobile code is identified.','SC-18(01)','N/A','Determine if: - [SC-18(01)_ODP[01]; unacceptable mobile code to be identified is defined] is identified. - [SC-18(01)_ODP[02]; corrective actions to be taken when unacceptable mobile code is identified are defined] are taken if unacceptable mobile code is identified.'),\n('002458','draft','2013-07-02','DISA FSO','policy','Defines what constitutes unacceptable mobile code by using corrective actions.','SC-18(01)','N/A','Determine if: - [SC-18(01)_ODP[01]; unacceptable mobile code to be identified is defined] is identified. - [SC-18(01)_ODP[02]; corrective actions to be taken when unacceptable mobile code is identified are defined] are taken if unacceptable mobile code is identified.'),\n('002459','draft','2013-07-02','DISA FSO','policy','Defines the unacceptable mobile code to prevent download and execution.','SC-18(03)','N/A','Determine if: - the download of [SC-18(03)_ODP; unacceptable mobile code to be prevented from downloading and executing is defined] is prevented. - the execution of [SC-18(03)_ODP; unacceptable mobile code to be prevented from downloading and executing is defined] is prevented.'),\n('002460','draft','2013-07-02','DISA FSO','technical','Enforce organization-defined actions prior to executing mobile code.','SC-18(04)','N/A','Determine if: - the automatic execution of mobile code in [SC-18(04)_ODP[01]; software applications in which the automatic execution of mobile code is to be prevented are defined] is prevented. - [SC-18(04)_ODP[02]; actions to be enforced by the system prior to executing mobile code are defined] are enforced prior to executing mobile code.'),\n('002461','draft','2013-07-02','DISA FSO','policy','Allow execution of permitted mobile code only in confined virtual machine environments.','SC-18(05)','N/A','Determine if execution of permitted mobile code is allowed only in confined virtual machine environments.'),\n('002462','draft','2013-07-02','DISA FSO','technical','Provide additional data integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.','SC-20a.','N/A','Determine if: - additional data origin authentication is provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries. - integrity verification artifacts are provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries.'),\n('002463','draft','2013-07-02','DISA FSO','technical','Provide data origin artifacts for internal name/address resolution queries.','SC-20(02)','N/A','Determine if: - data origin artifacts are provided for internal name/address resolution queries. - integrity protection artifacts are provided for internal name/address resolution queries.'),\n('002464','draft','2013-07-02','DISA FSO','technical','Provide data integrity protection artifacts for internal name/address resolution queries.','SC-20(02)','N/A','Determine if: - data origin artifacts are provided for internal name/address resolution queries. - integrity protection artifacts are provided for internal name/address resolution queries.'),\n('002465','draft','2013-07-02','DISA FSO','technical','Request data origin authentication verification on the name/address resolution responses the system receives from authoritative sources.','SC-21','N/A','Determine if: - data origin authentication is requested for the name/address resolution responses that the system receives from authoritative sources. - data origin authentication is performed on the name/address resolution responses that the system receives from authoritative sources. - data integrity verification is requested for the name/address resolution responses that the system receives from authoritative sources. - data integrity verification is performed on the name/address resolution responses that the system receives from authoritative sources.'),\n('002466','draft','2013-07-02','DISA FSO','technical','Request data integrity verification on the name/address resolution responses the system receives from authoritative sources.','SC-21','N/A','Determine if: - data origin authentication is requested for the name/address resolution responses that the system receives from authoritative sources. - data origin authentication is performed on the name/address resolution responses that the system receives from authoritative sources. - data integrity verification is requested for the name/address resolution responses that the system receives from authoritative sources. - data integrity verification is performed on the name/address resolution responses that the system receives from authoritative sources.'),\n('002467','draft','2013-07-02','DISA FSO','technical','Perform data integrity verification on the name/address resolution responses the system receives from authoritative sources.','SC-21','N/A','Determine if: - data origin authentication is requested for the name/address resolution responses that the system receives from authoritative sources. - data origin authentication is performed on the name/address resolution responses that the system receives from authoritative sources. - data integrity verification is requested for the name/address resolution responses that the system receives from authoritative sources. - data integrity verification is performed on the name/address resolution responses that the system receives from authoritative sources.'),\n('002468','draft','2013-07-02','DISA FSO','technical','Perform data origin verification authentication on the name/address resolution responses the system receives from authoritative sources.','SC-21','N/A','Determine if: - data origin authentication is requested for the name/address resolution responses that the system receives from authoritative sources. - data origin authentication is performed on the name/address resolution responses that the system receives from authoritative sources. - data integrity verification is requested for the name/address resolution responses that the system receives from authoritative sources. - data integrity verification is performed on the name/address resolution responses that the system receives from authoritative sources.'),\n('002469','draft','2013-07-02','DISA FSO','policy','Defines the certificate authorities allowed to be used for verification of the establishment of protected sessions.','SC-23(05)','N/A','Determine if only the use of [SC-23(05)_ODP; certificate authorities to be allowed for verification of the establishment of protected sessions are defined] for verification of the establishment of protected sessions is allowed.'),\n('002470','draft','2013-07-02','DISA FSO','technical','Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.','SC-23(05)','N/A','Determine if only the use of [SC-23(05)_ODP; certificate authorities to be allowed for verification of the establishment of protected sessions are defined] for verification of the establishment of protected sessions is allowed.'),\n('002471','draft','2013-07-02','DISA FSO','policy','Defines the system components, with minimal functionality and information storage, to be employed.','SC-25','N/A','Determine if: - minimal functionality for [SC-25_ODP; system components to be employed with minimal functionality and information storage are defined] is employed. - minimal information storage on [SC-25_ODP; system components to be employed with minimal functionality and information storage are defined] is allocated.'),\n('002472','draft','2013-07-02','DISA FSO','policy','Defines the information at rest that is to be protected.','SC-28','N/A','Determine if the [SC-28_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {confidentiality; integrity}] of [SC-28_ODP[02]; information at rest requiring protection is defined] is/are protected.'),\n('002473','draft','2013-07-02','DISA FSO','policy','Defines the information at rest for which cryptographic mechanisms will be implemented.','SC-28(01)','N/A','Determine if: - cryptographic mechanisms are implemented to prevent unauthorized disclosure of [SC-28(01)_ODP[01]; information requiring cryptographic protection is defined] at rest on [SC-28(01)_ODP[02]; system components or media requiring cryptographic protection is/are defined]. - cryptographic mechanisms are implemented to prevent unauthorized modification of [SC-28(01)_ODP[01]; information requiring cryptographic protection is defined] at rest on [SC-28(01)_ODP[02; system components or media requiring cryptographic protection is/are defined].'),\n('002474','draft','2013-07-02','DISA FSO','policy','Defines the system components which require the implementation of cryptographic mechanisms to prevent unauthorized disclosure and modification of organization-defined information at rest.','SC-28(01)','N/A','Determine if: - cryptographic mechanisms are implemented to prevent unauthorized disclosure of [SC-28(01)_ODP[01]; information requiring cryptographic protection is defined] at rest on [SC-28(01)_ODP[02]; system components or media requiring cryptographic protection is/are defined]. - cryptographic mechanisms are implemented to prevent unauthorized modification of [SC-28(01)_ODP[01]; information requiring cryptographic protection is defined] at rest on [SC-28(01)_ODP[02; system components or media requiring cryptographic protection is/are defined].'),\n('002475','draft','2013-07-02','DISA FSO','technical','Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined system components.','SC-28(01)','N/A','Determine if: - cryptographic mechanisms are implemented to prevent unauthorized disclosure of [SC-28(01)_ODP[01]; information requiring cryptographic protection is defined] at rest on [SC-28(01)_ODP[02]; system components or media requiring cryptographic protection is/are defined]. - cryptographic mechanisms are implemented to prevent unauthorized modification of [SC-28(01)_ODP[01]; information requiring cryptographic protection is defined] at rest on [SC-28(01)_ODP[02; system components or media requiring cryptographic protection is/are defined].'),\n('002476','draft','2013-07-02','DISA FSO','technical','Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components.','SC-28(01)','N/A','Determine if: - cryptographic mechanisms are implemented to prevent unauthorized disclosure of [SC-28(01)_ODP[01]; information requiring cryptographic protection is defined] at rest on [SC-28(01)_ODP[02]; system components or media requiring cryptographic protection is/are defined]. - cryptographic mechanisms are implemented to prevent unauthorized modification of [SC-28(01)_ODP[01]; information requiring cryptographic protection is defined] at rest on [SC-28(01)_ODP[02; system components or media requiring cryptographic protection is/are defined].'),\n('002477','draft','2013-07-02','DISA FSO','policy','Defines the information to be removed from online storage and stored in an offline secure location.','SC-28(02)','N/A','Determine if: - [SC-28(02)_ODP; information to be removed from online storage and stored offline in a secure location is defined] is removed from online storage. - [SC-28(02)_ODP; information to be removed from online storage and stored offline in a secure location is defined] is stored offline in a secure location.'),\n('002478','draft','2013-07-02','DISA FSO','policy','Remove organization-defined information from online storage.','SC-28(02)','N/A','Determine if: - [SC-28(02)_ODP; information to be removed from online storage and stored offline in a secure location is defined] is removed from online storage. - [SC-28(02)_ODP; information to be removed from online storage and stored offline in a secure location is defined] is stored offline in a secure location.'),\n('002479','draft','2013-07-02','DISA FSO','policy','Store organization-defined information in an offline secure location.','SC-28(02)','N/A','Determine if: - [SC-28(02)_ODP; information to be removed from online storage and stored offline in a secure location is defined] is removed from online storage. - [SC-28(02)_ODP; information to be removed from online storage and stored offline in a secure location is defined] is stored offline in a secure location.'),\n('002480','draft','2013-07-02','DISA FSO','policy','Defines the system components for which a diverse set of information technologies are to be employed.','SC-29','N/A','Determine if a diverse set of information technologies is employed for [SC-29_ODP; system components requiring a diverse set of information technologies to be employed in the implementation of the system are defined] in the implementation of the system.'),\n('002481','draft','2013-07-02','DISA FSP','policy','Employ virtualization techniques to support the deployment of a diversity of applications that are changed per organization-defined frequency.','SC-29(01)','N/A','Determine if virtualization techniques are employed to support the deployment of a diverse range of operating systems and applications that are changed [SC-29(01)_ODP; the frequency at which to change the diversity of operating systems and applications deployed using virtualization techniques is defined].'),\n('002482','draft','2013-07-02','DISA FSO','policy','Defines the concealment and misdirection techniques employed for organization-defined systems to confuse and mislead adversaries.','SC-30','N/A','Determine if [SC-30_ODP[01]; concealment and misdirection techniques to be employed to confuse and mislead adversaries potentially targeting systems are defined] are employed for [SC-30_ODP[02]; systems for which concealment and misdirection techniques are to be employed are defined] for [SC-30_ODP[03]; time periods to employ concealment and misdirection techniques for systems are defined] to confuse and mislead adversaries.'),\n('002483','draft','2013-07-02','DISA FSO','policy','Defines the systems for which organization-defined concealment and misdirection techniques are to be employed.','SC-30','N/A','Determine if [SC-30_ODP[01]; concealment and misdirection techniques to be employed to confuse and mislead adversaries potentially targeting systems are defined] are employed for [SC-30_ODP[02]; systems for which concealment and misdirection techniques are to be employed are defined] for [SC-30_ODP[03]; time periods to employ concealment and misdirection techniques for systems are defined] to confuse and mislead adversaries.'),\n('002484','draft','2013-07-02','DISA FSO','policy','Defines the time periods at which to employ organization-defined concealment and misdirection techniques on organization-defined systems.','SC-30','N/A','Determine if [SC-30_ODP[01]; concealment and misdirection techniques to be employed to confuse and mislead adversaries potentially targeting systems are defined] are employed for [SC-30_ODP[02]; systems for which concealment and misdirection techniques are to be employed are defined] for [SC-30_ODP[03]; time periods to employ concealment and misdirection techniques for systems are defined] to confuse and mislead adversaries.'),\n('002485','draft','2013-07-02','DISA FSO','policy','Employ organization-defined concealment and misdirection techniques for organization-defined systems at organization-defined time periods to confuse and mislead adversaries.','SC-30','N/A','Determine if [SC-30_ODP[01]; concealment and misdirection techniques to be employed to confuse and mislead adversaries potentially targeting systems are defined] are employed for [SC-30_ODP[02]; systems for which concealment and misdirection techniques are to be employed are defined] for [SC-30_ODP[03]; time periods to employ concealment and misdirection techniques for systems are defined] to confuse and mislead adversaries.'),\n('002486','draft','2013-07-02','DISA FSO','policy','Defines the techniques to be employed to introduce randomness into organizational operations and assets.','SC-30(02)','N/A','Determine if [SC-30(02)_ODP; techniques employed to introduce randomness into organizational operations and assets are defined] are employed to introduce randomness into organizational operations and assets.'),\n('002487','draft','2013-07-02','DISA FSO','policy','Employ organization-defined techniques to introduce randomness into organizational operations.','SC-30(02)','N/A','Determine if [SC-30(02)_ODP; techniques employed to introduce randomness into organizational operations and assets are defined] are employed to introduce randomness into organizational operations and assets.'),\n('002488','draft','2013-07-02','DISA FSO','policy','Employ organization-defined techniques to introduce randomness into organizational assets.','SC-30(02)','N/A','Determine if [SC-30(02)_ODP; techniques employed to introduce randomness into organizational operations and assets are defined] are employed to introduce randomness into organizational operations and assets.'),\n('002489','draft','2013-07-02','DISA FSO','policy','Defines the processing and/or storage locations to be changed at random intervals or at an organization-defined frequency.','SC-30(03)','N/A','Determine if the location of [SC-30(03)_ODP[01]; processing and/or storage locations to be changed are defined] is changed [SC-30(03)_ODP[02]; one of the following PARAMETER VALUES is selected: {[SC-30(03)_ODP[03]; time frequency at which to change the location of processing and/or storage is defined (if selected)]; random time intervals}].'),\n('002490','draft','2013-07-02','DISA FSO','policy','Defines the frequency at which the location of organization-defined processing and/or storage changes.','SC-30(03)','N/A','Determine if the location of [SC-30(03)_ODP[01]; processing and/or storage locations to be changed are defined] is changed [SC-30(03)_ODP[02]; one of the following PARAMETER VALUES is selected: {[SC-30(03)_ODP[03]; time frequency at which to change the location of processing and/or storage is defined (if selected)]; random time intervals}].'),\n('002492','draft','2013-07-02','DISA FSO','policy','Change the location of organization-defined processing and/or storage at an organization-defined time frequency or at random time intervals.','SC-30(03)','N/A','Determine if the location of [SC-30(03)_ODP[01]; processing and/or storage locations to be changed are defined] is changed [SC-30(03)_ODP[02]; one of the following PARAMETER VALUES is selected: {[SC-30(03)_ODP[03]; time frequency at which to change the location of processing and/or storage is defined (if selected)]; random time intervals}].'),\n('002493','draft','2013-07-02','DISA FSO','policy','Defines the system components in which it will employ realistic but misleading information regarding its security state or posture.','SC-30(04)','N/A','Determine if realistic but misleading information about the security state or posture of [SC-30(04)_ODP; system components for which realistic but misleading information about their security state or posture is employed are defined] is employed.'),\n('002494','draft','2013-07-02','DISA FSO','policy','Employ realistic, but misleading, information in organization-defined system components about its security state or posture.','SC-30(04)','N/A','Determine if realistic but misleading information about the security state or posture of [SC-30(04)_ODP; system components for which realistic but misleading information about their security state or posture is employed are defined] is employed.'),\n('002495','draft','2013-07-02','DISA FSO','policy','Defines the techniques to be employed to hide or conceal organization-defined system components.','SC-30(05)','N/A','Determine if [SC-30(05)_ODP[01]; techniques to be employed to hide or conceal system components are defined] are employed to hide or conceal [SC-30(05)_ODP[02]; system components to be hidden or concealed using techniques (defined in SC-30(05)_ODP[01]) are defined].'),\n('002496','draft','2013-07-02','DISA FSO','policy','Defines the system components to be hidden or concealed.','SC-30(05)','N/A','Determine if [SC-30(05)_ODP[01]; techniques to be employed to hide or conceal system components are defined] are employed to hide or conceal [SC-30(05)_ODP[02]; system components to be hidden or concealed using techniques (defined in SC-30(05)_ODP[01]) are defined].'),\n('002497','draft','2013-07-02','DISA FSO','policy','Employ organization-defined techniques to hide or conceal organization-defined system components.','SC-30(05)','N/A','Determine if [SC-30(05)_ODP[01]; techniques to be employed to hide or conceal system components are defined] are employed to hide or conceal [SC-30(05)_ODP[02]; system components to be hidden or concealed using techniques (defined in SC-30(05)_ODP[01]) are defined].'),\n('002498','draft','2013-07-02','DISA FSO','policy','Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert storage and/or timing channels.','SC-31a.','N/A','Determine if a covert channel analysis is performed to identify those aspects of communications within the system that are potential avenues for covert [SC-31_ODP; one or more of the following PARAMETER VALUES is/are selected: {storage; timing}] channels.'),\n('002499','draft','2013-07-02','DISA FSO','policy','Estimate the maximum bandwidth of the covert storage and timing channels.','SC-31b.','N/A','Determine if the maximum bandwidth of those channels is estimated.'),\n('002500','draft','2013-07-02','DISA FSO','policy','Defines the maximum bandwidth values to which covert storage and/or timing channels are to be reduced.','SC-31(02)','N/A','Determine if the maximum bandwidth for identified covert [SC-31(02)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {storage; timing}] channels is reduced to [SC-31(02)_ODP[02]; values for the maximum bandwidth for identified covert channels are defined].'),\n('002501','draft','2013-07-02','DISA FSO','policy','Reduce the maximum bandwidth for identified covert storage and/or timing channels to organization-defined values.','SC-31(02)','N/A','Determine if the maximum bandwidth for identified covert [SC-31(02)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {storage; timing}] channels is reduced to [SC-31(02)_ODP[02]; values for the maximum bandwidth for identified covert channels are defined].'),\n('002502','draft','2013-07-02','DISA FSO','policy','Defines the subset of identified covert channels in the operational environment of the system that are to have the bandwidth measured.','SC-31(03)','N/A','Determine if the bandwidth of [SC-31(03)_ODP; subset of identified covert channels whose bandwidth is to be measured in the operational environment of the system is defined] is measured in the operational environment of the system.'),\n('002503','draft','2013-07-02','DISA FSO','policy','Measure the bandwidth of an organization-defined subset of identified covert channels in the operational environment of the information system.','SC-31(03)','N/A','Determine if the bandwidth of [SC-31(03)_ODP; subset of identified covert channels whose bandwidth is to be measured in the operational environment of the system is defined] is measured in the operational environment of the system.'),\n('002504','draft','2013-07-02','DISA FSO','policy','Defines the system components into which the system is partitioned.','SC-32','N/A','Determine if the system is partitioned into [SC-32_ODP[01]; system components to reside in separate physical or logical domains or environments based on circumstances for the physical or logical separation of components are defined] residing in separate [SC-32_ODP[02]; one of the following PARAMETER VALUES is selected: {physical; logical}] domains or environments based on [SC-32_ODP[03]; circumstances for the physical or logical separation of components are defined].'),\n('002505','draft','2013-07-02','DISA FSO','policy','Defines the circumstances under which the system components are to be physically or logically separated to support partitioning.','SC-32','N/A','Determine if the system is partitioned into [SC-32_ODP[01]; system components to reside in separate physical or logical domains or environments based on circumstances for the physical or logical separation of components are defined] residing in separate [SC-32_ODP[02]; one of the following PARAMETER VALUES is selected: {physical; logical}] domains or environments based on [SC-32_ODP[03]; circumstances for the physical or logical separation of components are defined].'),\n('002506','draft','2013-07-02','DISA FSO','policy','Partition the system into organization-defined system components residing in separate physical or logical domains or environments based on organization-defined circumstances for physical or logical separation of components.','SC-32','N/A','Determine if the system is partitioned into [SC-32_ODP[01]; system components to reside in separate physical or logical domains or environments based on circumstances for the physical or logical separation of components are defined] residing in separate [SC-32_ODP[02]; one of the following PARAMETER VALUES is selected: {physical; logical}] domains or environments based on [SC-32_ODP[03]; circumstances for the physical or logical separation of components are defined].'),\n('002507','draft','2013-07-02','DISA FSO','policy','Control read-only media after information has been recorded onto the media.',NULL,'N/A',NULL),\n('002508','draft','2013-07-02','DISA FSO','policy','Defines the system firmware components for which hardware-based, write-protect is employed.','SC-51a.','N/A','Determine if hardware-based write-protect for [SC-51_ODP[01]; system firmware components requiring hardware-based write-protect are defined] is employed.'),\n('002509','draft','2013-07-02','DISA FSO','policy','Employ hardware-based, write-protect for organization-defined information system firmware components.','SC-51a.','N/A','Determine if hardware-based write-protect for [SC-51_ODP[01]; system firmware components requiring hardware-based write-protect are defined] is employed.'),\n('002510','draft','2013-07-02','DISA FSO','policy','Defines the individuals authorized to manually disable hardware-based, write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.','SC-51b.','N/A','Determine if: - specific procedures are implemented for [SC-51_ODP[02]; authorized individuals requiring procedures for disabling and re-enabling hardware write-protect are defined] to manually disable hardware write-protect for firmware modifications. - specific procedures are implemented for [SC-51_ODP[02]; authorized individuals requiring procedures for disabling and re-enabling hardware write-protect are defined] to re-enable the write-protect prior to returning to operational mode.'),\n('002511','draft','2013-07-02','DISA FSO','policy','Implement specific procedures for organization-defined authorized individuals to manually disable hardware-based, write-protect for firmware modifications.','SC-51b.','N/A','Determine if: - specific procedures are implemented for [SC-51_ODP[02]; authorized individuals requiring procedures for disabling and re-enabling hardware write-protect are defined] to manually disable hardware write-protect for firmware modifications. - specific procedures are implemented for [SC-51_ODP[02]; authorized individuals requiring procedures for disabling and re-enabling hardware write-protect are defined] to re-enable the write-protect prior to returning to operational mode.'),\n('002512','draft','2013-07-02','DISA FSO','policy','Implement specific procedures for organization-defined authorized individuals to manually re-enable hardware write-protect prior to returning to operational mode.','SC-51b.','N/A','Determine if: - specific procedures are implemented for [SC-51_ODP[02]; authorized individuals requiring procedures for disabling and re-enabling hardware write-protect are defined] to manually disable hardware write-protect for firmware modifications. - specific procedures are implemented for [SC-51_ODP[02]; authorized individuals requiring procedures for disabling and re-enabling hardware write-protect are defined] to re-enable the write-protect prior to returning to operational mode.'),\n('002513','draft','2013-07-02','DISA FSO','policy','Defines the processing that is to be distributed across multiple physical locations or logical domains.','SC-36','N/A','Determine if: - [SC-36_ODP[01]; processing components to be distributed across multiple locations/domains are defined] are distributed across [SC-36_ODP[02]; one of the following PARAMETER VALUES is selected: {physical locations; logical domains}]. - [SC-36_ODP[03]; storage components to be distributed across multiple locations/domains are defined] are distributed across [SC-36_ODP[04]; one of the following PARAMETER VALUES is selected: {physical locations; logical domains}].'),\n('002514','draft','2013-07-02','DISA FSO','policy','Defines the storage components that is to be distributed across multiple physical locations or logical domains.','SC-36','N/A','Determine if: - [SC-36_ODP[01]; processing components to be distributed across multiple locations/domains are defined] are distributed across [SC-36_ODP[02]; one of the following PARAMETER VALUES is selected: {physical locations; logical domains}]. - [SC-36_ODP[03]; storage components to be distributed across multiple locations/domains are defined] are distributed across [SC-36_ODP[04]; one of the following PARAMETER VALUES is selected: {physical locations; logical domains}].'),\n('002515','draft','2013-07-02','DISA FSO','policy','Distributes organization-defined processing across multiple physical locations or logical domains.','SC-36','N/A','Determine if: - [SC-36_ODP[01]; processing components to be distributed across multiple locations/domains are defined] are distributed across [SC-36_ODP[02]; one of the following PARAMETER VALUES is selected: {physical locations; logical domains}]. - [SC-36_ODP[03]; storage components to be distributed across multiple locations/domains are defined] are distributed across [SC-36_ODP[04]; one of the following PARAMETER VALUES is selected: {physical locations; logical domains}].'),\n('002516','draft','2013-07-02','DISA FSO','policy','Distributes organization-defined storage components across multiple physical locations or logical domains.','SC-36','N/A','Determine if: - [SC-36_ODP[01]; processing components to be distributed across multiple locations/domains are defined] are distributed across [SC-36_ODP[02]; one of the following PARAMETER VALUES is selected: {physical locations; logical domains}]. - [SC-36_ODP[03]; storage components to be distributed across multiple locations/domains are defined] are distributed across [SC-36_ODP[04]; one of the following PARAMETER VALUES is selected: {physical locations; logical domains}].'),\n('002517','draft','2013-07-02','DISA FSO','policy','Defines the distributed processing components that are to be polled to identify potential faults, errors, or compromises.','SC-36(01)(a)','N/A','Determine if polling techniques are employed to identify potential faults, errors, or compromises to [SC-36(01)_ODP[01]; distributed processing and storage components for which polling techniques are to be employed to identify potential faults, errors, or compromises are defined].'),\n('002518','draft','2013-07-02','DISA FSO','policy','Defines the distributed storage components that are to be polled to identify potential faults, errors, or compromises.','SC-36(01)(a)','N/A','Determine if polling techniques are employed to identify potential faults, errors, or compromises to [SC-36(01)_ODP[01]; distributed processing and storage components for which polling techniques are to be employed to identify potential faults, errors, or compromises are defined].'),\n('002519','draft','2013-07-02','DISA FSO','policy','Employ polling techniques to identify potential faults, errors, or compromises to organization-defined distributed processing components.','SC-36(01)(a)','N/A','Determine if polling techniques are employed to identify potential faults, errors, or compromises to [SC-36(01)_ODP[01]; distributed processing and storage components for which polling techniques are to be employed to identify potential faults, errors, or compromises are defined].'),\n('002520','draft','2013-07-02','DISA FSO','policy','Employ polling techniques to identify potential faults, errors, or compromises to organization-defined distributed storage components.','SC-36(01)(a)','N/A','Determine if polling techniques are employed to identify potential faults, errors, or compromises to [SC-36(01)_ODP[01]; distributed processing and storage components for which polling techniques are to be employed to identify potential faults, errors, or compromises are defined].'),\n('002521','draft','2013-07-02','DISA FSO','policy','Defines the out-of-band channels to be employed for the physical delivery or electronic transmission of organization-defined information, system components, or devices.','SC-37','N/A','Determine if [SC-37_ODP[01]; out-of-band channels to be employed for the physical delivery or electronic transmission of information, system components, or devices to individuals or the system are defined] are employed for the physical delivery or electronic transmission of [SC-37_ODP[02]; information, system components, or devices to employ out-of-band-channels for physical delivery or electronic transmission are defined] to [SC-37_ODP[03]; individuals or systems to which physical delivery or electronic transmission of information, system components, or devices is to be achieved via the employment of out-of-band channels are defined].'),\n('002522','draft','2013-07-02','DISA FSO','policy','Defines the information, system components, or devices that are to be electronically transmitted or physically delivered via organization-defined out-of-band channels.','SC-37','N/A','Determine if [SC-37_ODP[01]; out-of-band channels to be employed for the physical delivery or electronic transmission of information, system components, or devices to individuals or the system are defined] are employed for the physical delivery or electronic transmission of [SC-37_ODP[02]; information, system components, or devices to employ out-of-band-channels for physical delivery or electronic transmission are defined] to [SC-37_ODP[03]; individuals or systems to which physical delivery or electronic transmission of information, system components, or devices is to be achieved via the employment of out-of-band channels are defined].'),\n('002523','draft','2013-07-02','DISA FSO','policy','Defines the individuals or systems authorized to be recipients of organization-defined information, system components, or devices to be delivered by employing organization-defined out-of-band channels for electronic transmission or physical delivery.','SC-37','N/A','Determine if [SC-37_ODP[01]; out-of-band channels to be employed for the physical delivery or electronic transmission of information, system components, or devices to individuals or the system are defined] are employed for the physical delivery or electronic transmission of [SC-37_ODP[02]; information, system components, or devices to employ out-of-band-channels for physical delivery or electronic transmission are defined] to [SC-37_ODP[03]; individuals or systems to which physical delivery or electronic transmission of information, system components, or devices is to be achieved via the employment of out-of-band channels are defined].'),\n('002524','draft','2013-07-02','DISA FSO','policy','Employ organization-defined out-of-band channels for the physical delivery or electronic transmission of organization-defined information, system components, or devices to organization-defined individuals or systems.','SC-37','N/A','Determine if [SC-37_ODP[01]; out-of-band channels to be employed for the physical delivery or electronic transmission of information, system components, or devices to individuals or the system are defined] are employed for the physical delivery or electronic transmission of [SC-37_ODP[02]; information, system components, or devices to employ out-of-band-channels for physical delivery or electronic transmission are defined] to [SC-37_ODP[03]; individuals or systems to which physical delivery or electronic transmission of information, system components, or devices is to be achieved via the employment of out-of-band channels are defined].'),\n('002525','draft','2013-07-02','DISA FSO','policy','Defines the controls to be employed to ensure only organization-defined individuals or systems receive organization-defined information, system components, or devices.','SC-37(01)','N/A','Determine if [SC-37(01)_ODP[01]; controls to be employed to ensure that only designated individuals or systems receive specific information, system components, or devices are defined] are employed to ensure that only [SC-37(01)_ODP[02]; individuals or systems designated to receive specific information, system components, or devices are defined] receive [SC-37(01)_ODP[03]; information, system components, or devices that only individuals or systems are designated to receive are defined].'),\n('002526','draft','2013-07-02','DISA FSO','policy','Defines the information, system components, or devices which are to be received only by organization-defined individuals or systems.','SC-37(01)','N/A','Determine if [SC-37(01)_ODP[01]; controls to be employed to ensure that only designated individuals or systems receive specific information, system components, or devices are defined] are employed to ensure that only [SC-37(01)_ODP[02]; individuals or systems designated to receive specific information, system components, or devices are defined] receive [SC-37(01)_ODP[03]; information, system components, or devices that only individuals or systems are designated to receive are defined].'),\n('002527','draft','2013-07-02','DISA FSO','policy','Employ organization-defined controls to ensure only organization-defined individuals or systems receive the organization-defined information, system components, or devices.','SC-37(01)','N/A','Determine if [SC-37(01)_ODP[01]; controls to be employed to ensure that only designated individuals or systems receive specific information, system components, or devices are defined] are employed to ensure that only [SC-37(01)_ODP[02]; individuals or systems designated to receive specific information, system components, or devices are defined] receive [SC-37(01)_ODP[03]; information, system components, or devices that only individuals or systems are designated to receive are defined].'),\n('002528','draft','2013-07-02','DISA FSO','policy','Defines the operations security controls to be employed to protect key organizational information throughout the system development life cycle.','SC-38','N/A','Determine if [SC-38_ODP; operations security controls to be employed to protect key organizational information throughout the system development life cycle are defined] are employed to protect key organizational information throughout the system development life cycle.'),\n('002529','draft','2013-07-02','DISA FSO','policy','Employ organization-defined operations security controls to protect key organizational information throughout the system development life cycle.','SC-38','N/A','Determine if [SC-38_ODP; operations security controls to be employed to protect key organizational information throughout the system development life cycle are defined] are employed to protect key organizational information throughout the system development life cycle.'),\n('002530','draft','2013-07-02','DISA FSO','technical','Maintain a separate execution domain for each executing system process.','SC-39','N/A','Determine if a separate execution domain is maintained for each executing system process.'),\n('002531','draft','2013-07-02','DISA FSO','technical','Implement hardware separation mechanisms to facilitate process isolation.','SC-39(01)','N/A','Determine if hardware separation is implemented to facilitate process isolation.'),\n('002532','draft','2013-07-02','DISA FSO','policy','Defines the multi-threaded processing in which a separate execution domain is maintained by the system for each thread.','SC-39(02)','N/A','Determine if a separate execution domain is maintained for each thread in [SC-39(02)_ODP; multi-thread processing for which a separate execution domain is to be maintained for each thread is defined].'),\n('002533','draft','2013-07-02','DISA FSO','technical','Maintain a separate execution domain for each thread in organization-defined multi-threaded processing.','SC-39(02)','N/A','Determine if a separate execution domain is maintained for each thread in [SC-39(02)_ODP; multi-thread processing for which a separate execution domain is to be maintained for each thread is defined].'),\n('002534','draft','2013-07-02','DISA FSO','policy','Defines types of signal parameter attacks or references to sources for such attacks from which the system protects organization-defined wireless links.','SC-40','N/A','Determine if: - external [SC-40_ODP[01]; external wireless links to be protected from particular types of signal parameter attacks are defined] are protected from [SC-40_ODP[02]; types of signal parameter attacks or references to sources for such attacks from which to protect external wireless links are defined]. - internal [SC-40_ODP[03]; internal wireless links to be protected from particular types of signal parameter attacks are defined] are protected from [SC-40_ODP[04]; types of signal parameter attacks or references to sources for such attacks from which to protect internal wireless links are defined].'),\n('002535','draft','2013-07-02','DISA FSO','policy','Defines the external and internal wireless links the system is to protect from organization-defined types of signal parameter attacks or references to sources for such attacks.','SC-40','N/A','Determine if: - external [SC-40_ODP[01]; external wireless links to be protected from particular types of signal parameter attacks are defined] are protected from [SC-40_ODP[02]; types of signal parameter attacks or references to sources for such attacks from which to protect external wireless links are defined]. - internal [SC-40_ODP[03]; internal wireless links to be protected from particular types of signal parameter attacks are defined] are protected from [SC-40_ODP[04]; types of signal parameter attacks or references to sources for such attacks from which to protect internal wireless links are defined].'),\n('002536','draft','2013-07-02','DISA FSO','technical','Protect organization-defined external and internal wireless links from organization-defined types of signal parameter attacks or references to sources for such attacks.','SC-40','N/A','Determine if: - external [SC-40_ODP[01]; external wireless links to be protected from particular types of signal parameter attacks are defined] are protected from [SC-40_ODP[02]; types of signal parameter attacks or references to sources for such attacks from which to protect external wireless links are defined]. - internal [SC-40_ODP[03]; internal wireless links to be protected from particular types of signal parameter attacks are defined] are protected from [SC-40_ODP[04]; types of signal parameter attacks or references to sources for such attacks from which to protect internal wireless links are defined].'),\n('002537','draft','2013-07-02','DISA FSO','policy','Defines the level of protection against the effects of intentional electromagnetic interference to be achieved by implemented cryptographic mechanisms.','SC-40(01)','N/A','Determine if cryptographic mechanisms that achieve [SC-40(01)_ODP; level of protection to be employed against the effects of intentional electromagnetic interference is defined] against the effects of intentional electromagnetic interference are implemented.'),\n('002538','draft','2013-07-02','DISA FSO','technical','Implement cryptographic mechanisms that achieve an organization-defined level of protection against the effects of intentional electromagnetic interference.','SC-40(01)','N/A','Determine if cryptographic mechanisms that achieve [SC-40(01)_ODP; level of protection to be employed against the effects of intentional electromagnetic interference is defined] against the effects of intentional electromagnetic interference are implemented.'),\n('002539','draft','2013-07-02','DISA FSO','policy','Defines the level of reduction the system is to implement to reduce the detection potential of wireless links.','SC-40(02)','N/A','Determine if cryptographic mechanisms to reduce the detection potential of wireless links to [SC-40(02)_ODP; the level of reduction to be achieved to reduce the detection potential of wireless links is defined] are implemented.'),\n('002540','draft','2013-07-02','DISA FSO','technical','Implement cryptographic mechanisms to reduce the detection potential of wireless links to an organization-defined level of reduction.','SC-40(02)','N/A','Determine if cryptographic mechanisms to reduce the detection potential of wireless links to [SC-40(02)_ODP; the level of reduction to be achieved to reduce the detection potential of wireless links is defined] are implemented.'),\n('002541','draft','2013-07-02','DISA FSO','technical','Implement cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.','SC-40(03)','N/A','Determine if cryptographic mechanisms are implemented to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.'),\n('002542','draft','2013-07-02','DISA FSO','policy','Defines the wireless transmitters that are to have cryptographic mechanisms implemented to prevent the identification of the wireless transmitters.','SC-40(04)','N/A','Determine if cryptographic mechanisms are implemented to prevent the identification of [SC-40(04)_ODP; wireless transmitters for which cryptographic mechanisms are to be implemented are defined] by using the transmitter signal parameters.'),\n('002543','draft','2013-07-02','DISA FSO','technical','Implement cryptographic mechanisms to prevent the identification of organization-defined wireless transmitters by using the transmitter signal parameters.','SC-40(04)','N/A','Determine if cryptographic mechanisms are implemented to prevent the identification of [SC-40(04)_ODP; wireless transmitters for which cryptographic mechanisms are to be implemented are defined] by using the transmitter signal parameters.'),\n('002544','draft','2013-07-02','DISA FSO','policy','Defines the systems or system components on which organization-defined connection ports or input/output devices are to be physically or logically disabled or removed.','SC-41','N/A','Determine if [SC-41_ODP[01]; connection ports or input/output devices to be disabled or removed are defined] are [SC-41_ODP[02]; one of the following PARAMETER VALUES is selected: {physically; logically}] disabled or removed on [SC-41_ODP[03]; systems or system components with connection ports or input/output devices to be disabled or removed are defined].'),\n('002545','draft','2013-07-02','DISA FSO','policy','Defines the connection ports or input/output devices that are to be physically or logically disabled or removed from organization-defined systems or system components.','SC-41','N/A','Determine if [SC-41_ODP[01]; connection ports or input/output devices to be disabled or removed are defined] are [SC-41_ODP[02]; one of the following PARAMETER VALUES is selected: {physically; logically}] disabled or removed on [SC-41_ODP[03]; systems or system components with connection ports or input/output devices to be disabled or removed are defined].'),\n('002546','draft','2013-07-02','DISA FSO','technical','Physically or logically disable or remove organization-defined connection ports or input/output devices on organization-defined systems or system components.','SC-41','N/A','Determine if [SC-41_ODP[01]; connection ports or input/output devices to be disabled or removed are defined] are [SC-41_ODP[02]; one of the following PARAMETER VALUES is selected: {physically; logically}] disabled or removed on [SC-41_ODP[03]; systems or system components with connection ports or input/output devices to be disabled or removed are defined].'),\n('002547','draft','2013-07-02','DISA FSO','policy','Defines the exceptions where remote activation of sensors is allowed.','SC-42a.','N/A','Determine if [SC-42_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {the use of devices possessing [SC-42_ODP[02]; environmental sensing capabilities in devices are defined (if selected)] in [SC-42_ODP[03]; facilities, areas, or systems where the use of devices possessing environmental sensing capabilities is prohibited are defined (if selected)]; the remote activation of environmental sensing capabilities on organizational systems or system components with the following exceptions: [SC-42_ODP[04]; exceptions where remote activation of sensors is allowed are defined (if selected)]}] is/are prohibited.'),\n('002548','draft','2013-07-02','DISA FSO','technical','Prohibit the use of devices possessing organization-defined environmental sensing capabilities in organization-defined facilities, areas, or systems; and/or the remote activation of environmental sensing capabilities on organizational systems or system components except for the organization-defined exceptions where remote activation of sensors is allowed.','SC-42a.','N/A','Determine if [SC-42_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {the use of devices possessing [SC-42_ODP[02]; environmental sensing capabilities in devices are defined (if selected)] in [SC-42_ODP[03]; facilities, areas, or systems where the use of devices possessing environmental sensing capabilities is prohibited are defined (if selected)]; the remote activation of environmental sensing capabilities on organizational systems or system components with the following exceptions: [SC-42_ODP[04]; exceptions where remote activation of sensors is allowed are defined (if selected)]}] is/are prohibited.'),\n('002549','draft','2013-07-02','DISA FSO','policy','Defines the class of users to receive explicit indication of sensor use.','SC-42b.','N/A','Determine if an explicit indication of sensor use is provided to [SC-42_ODP[05]; group of users to whom an explicit indication of sensor use is to be provided is defined].'),\n('002550','draft','2013-07-02','DISA FSO','technical','Provide an explicit indication of sensor use to the organization-defined class of users.','SC-42b.','N/A','Determine if an explicit indication of sensor use is provided to [SC-42_ODP[05]; group of users to whom an explicit indication of sensor use is to be provided is defined].'),\n('002551','draft','2013-07-02','DISA FSO','policy','Defines the sensors to be configured so that collected data or information is reported only to authorized individuals or roles.','SC-42(01)','N/A','Determine if the system is configured so that data or information collected by the [SC-42(01)_ODP; sensors to be used to collect data or information are defined] is only reported to authorized individuals or roles.'),\n('002552','draft','2013-07-02','DISA FSO','policy','Verify that the system is configured so that data or information collected by the organization-defined sensors is only reported to authorized individuals or roles.','SC-42(01)','N/A','Determine if the system is configured so that data or information collected by the [SC-42(01)_ODP; sensors to be used to collect data or information are defined] is only reported to authorized individuals or roles.'),\n('002553','draft','2013-07-02','DISA FSO','policy','Defines the measures to be employed to ensure data or information collected by organization-defined sensors is used only for authorized purposes.','SC-42(02)','N/A','Determine if [SC-42(02)_ODP; measures to be employed so that data or information collected by sensors is only used for authorized purposes are defined] are employed so that data or information collected by [SC-42(01)_ODP; sensors to be used to collect data or information are defined] is only used for authorized purposes.'),\n('002554','draft','2013-07-02','DISA FSO','policy','Defines the sensors that are to collect data or information for authorized purposes.','SC-42(02)','N/A','Determine if [SC-42(02)_ODP; measures to be employed so that data or information collected by sensors is only used for authorized purposes are defined] are employed so that data or information collected by [SC-42(01)_ODP; sensors to be used to collect data or information are defined] is only used for authorized purposes.'),\n('002555','draft','2013-07-02','DISA FSO','policy','Employ organization-defined measures, so that data or information collected by organization-defined sensors is only used for authorized purposes.','SC-42(02)','N/A','Determine if [SC-42(02)_ODP; measures to be employed so that data or information collected by sensors is only used for authorized purposes are defined] are employed so that data or information collected by [SC-42(01)_ODP; sensors to be used to collect data or information are defined] is only used for authorized purposes.'),\n('002556','draft','2013-07-02','DISA FSO','policy','Defines the environmental sensing capabilities prohibited on devices used in organization-defined facilities, areas, or systems.','SC-42a.','N/A','Determine if [SC-42_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {the use of devices possessing [SC-42_ODP[02]; environmental sensing capabilities in devices are defined (if selected)] in [SC-42_ODP[03]; facilities, areas, or systems where the use of devices possessing environmental sensing capabilities is prohibited are defined (if selected)]; the remote activation of environmental sensing capabilities on organizational systems or system components with the following exceptions: [SC-42_ODP[04]; exceptions where remote activation of sensors is allowed are defined (if selected)]}] is/are prohibited.'),\n('002557','draft','2013-07-02','DISA FSO','policy','Defines the facilities, areas, or systems where devices processing organization-defined environmental sensing capabilities are prohibited.','SC-42a.','N/A','Determine if [SC-42_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {the use of devices possessing [SC-42_ODP[02]; environmental sensing capabilities in devices are defined (if selected)] in [SC-42_ODP[03]; facilities, areas, or systems where the use of devices possessing environmental sensing capabilities is prohibited are defined (if selected)]; the remote activation of environmental sensing capabilities on organizational systems or system components with the following exceptions: [SC-42_ODP[04]; exceptions where remote activation of sensors is allowed are defined (if selected)]}] is/are prohibited.'),\n('002559','draft','2013-07-02','DISA FSO','policy','Defines the system components for which usage restrictions and implementation guidance are to be established.','SC-43a.','N/A','Determine if usage restrictions and implementation guidelines are established for [SC-43_ODP; the components for which usage restrictions and implementation guidance are to be established are defined].'),\n('002560','draft','2013-07-02','DISA FSO','policy','Establish usage restrictions and implementation guidance for organization-defined system components based on the potential to cause damage to the system if used maliciously.','SC-43a.','N/A','Determine if usage restrictions and implementation guidelines are established for [SC-43_ODP; the components for which usage restrictions and implementation guidance are to be established are defined].'),\n('002561','draft','2013-07-02','DISA FSO','policy','Authorize the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.','SC-43b.','N/A','Determine if: - the use of [SC-43_ODP; the components for which usage restrictions and implementation guidance are to be established are defined] is authorized within the system. - the use of [SC-43_ODP; the components for which usage restrictions and implementation guidance are to be established are defined] is monitored within the system. - the use of [SC-43_ODP; the components for which usage restrictions and implementation guidance are to be established are defined] is controlled within the system.'),\n('002562','draft','2013-07-02','DISA FSO','policy','Monitor the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.','SC-43b.','N/A','Determine if: - the use of [SC-43_ODP; the components for which usage restrictions and implementation guidance are to be established are defined] is authorized within the system. - the use of [SC-43_ODP; the components for which usage restrictions and implementation guidance are to be established are defined] is monitored within the system. - the use of [SC-43_ODP; the components for which usage restrictions and implementation guidance are to be established are defined] is controlled within the system.'),\n('002563','draft','2013-07-02','DISA FSO','policy','Control the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.','SC-43b.','N/A','Determine if: - the use of [SC-43_ODP; the components for which usage restrictions and implementation guidance are to be established are defined] is authorized within the system. - the use of [SC-43_ODP; the components for which usage restrictions and implementation guidance are to be established are defined] is monitored within the system. - the use of [SC-43_ODP; the components for which usage restrictions and implementation guidance are to be established are defined] is controlled within the system.'),\n('002564','draft','2013-07-02','DISA FSO','policy','Defines the system, system component, or location where a detonation chamber capability is employed.','SC-44','N/A','Determine if a detonation chamber capability is employed within the [SC-44_ODP; the system, system component, or location where a detonation chamber capability is to be employed is defined].'),\n('002565','draft','2013-07-02','DISA FSO','policy','Employ a detonation chamber capability within an organization-defined system, system component, or location.','SC-44','N/A','Determine if a detonation chamber capability is employed within the [SC-44_ODP; the system, system component, or location where a detonation chamber capability is to be employed is defined].'),\n('002566','draft','2013-07-09','DISA FSO','policy','Defines personnel or roles to whom a media protection policy and procedures will be disseminated.','MP-01a.','N/A','Determine if: - a media protection policy is developed and documented. - the media protection policy is disseminated to [MP-01_ODP[01]; personnel or roles to whom the media protection policy is to be disseminated is/are defined].'),\n('002567','draft','2013-07-09','DISA FSO','policy','Review and approve media sanitization.','MP-06(01)','N/A','Determine if: - media sanitization and disposal actions are reviewed. - media sanitization and disposal actions are approved. - media sanitization and disposal actions are tracked. - media sanitization and disposal actions are documented. - media sanitization and disposal actions are verified.'),\n('002568','draft','2013-07-09','DISA FSO','policy','Track and document media sanitization.','MP-06(01)','N/A','Determine if: - media sanitization and disposal actions are reviewed. - media sanitization and disposal actions are approved. - media sanitization and disposal actions are tracked. - media sanitization and disposal actions are documented. - media sanitization and disposal actions are verified.'),\n('002569','draft','2013-07-09','DISA FSO','policy','Verify media sanitization.','MP-06(01)','N/A','Determine if: - media sanitization and disposal actions are reviewed. - media sanitization and disposal actions are approved. - media sanitization and disposal actions are tracked. - media sanitization and disposal actions are documented. - media sanitization and disposal actions are verified.'),\n('002570','draft','2013-07-09','DISA FSO','policy','Review and approve media disposal actions.','MP-06(01)','N/A','Determine if: - media sanitization and disposal actions are reviewed. - media sanitization and disposal actions are approved. - media sanitization and disposal actions are tracked. - media sanitization and disposal actions are documented. - media sanitization and disposal actions are verified.'),\n('002571','draft','2013-07-09','DISA FSO','policy','Track and document media disposal actions.','MP-06(01)','N/A','Determine if: - media sanitization and disposal actions are reviewed. - media sanitization and disposal actions are approved. - media sanitization and disposal actions are tracked. - media sanitization and disposal actions are documented. - media sanitization and disposal actions are verified.'),\n('002572','draft','2013-07-09','DISA FSO','policy','Verify media disposal actions.','MP-06(01)','N/A','Determine if: - media sanitization and disposal actions are reviewed. - media sanitization and disposal actions are approved. - media sanitization and disposal actions are tracked. - media sanitization and disposal actions are documented. - media sanitization and disposal actions are verified.'),\n('002573','draft','2013-07-09','DISA FSO','policy','Enforce dual authorization for the sanitization of organization-defined system media.','MP-06(07)','N/A','Determine if dual authorization for sanitization of [MP-06(07)_ODP; system media to be sanitized using dual authorization is defined] is enforced.'),\n('002574','draft','2013-07-09','DISA FSO','policy','Defines the system media that dual authorization is enforced for sanitization.','MP-06(07)','N/A','Determine if dual authorization for sanitization of [MP-06(07)_ODP; system media to be sanitized using dual authorization is defined] is enforced.'),\n('002575','draft','2013-07-09','DISA FSO','policy','Defines systems or system components from which information is purged or wiped, either remotely or under the organization-defined conditions.','MP-06(08)','N/A','Determine if the capability to purge or wipe information from [MP-06(08)_ODP[01]; systems or system components to purge or wipe information either remotely or under specific conditions are defined] [MP-06(08)_ODP[02]; one of the following PARAMETER VALUES is selected: {remotely; under [MP-06(08)_ODP[03]; conditions under which information is to be purged or wiped are defined (if selected)]}] is provided.'),\n('002576','draft','2013-07-09','DISA FSO','policy','Defines conditions under which information from organization-defined systems or system components are to be purged or wiped.','MP-06(08)','N/A','Determine if the capability to purge or wipe information from [MP-06(08)_ODP[01]; systems or system components to purge or wipe information either remotely or under specific conditions are defined] [MP-06(08)_ODP[02]; one of the following PARAMETER VALUES is selected: {remotely; under [MP-06(08)_ODP[03]; conditions under which information is to be purged or wiped are defined (if selected)]}] is provided.'),\n('002577','draft','2013-07-09','DISA FSO','policy','Provide the capability to purge or wipe information from organization-defined systems, system components either remotely or under organization-defined conditions.','MP-06(08)','N/A','Determine if the capability to purge or wipe information from [MP-06(08)_ODP[01]; systems or system components to purge or wipe information either remotely or under specific conditions are defined] [MP-06(08)_ODP[02]; one of the following PARAMETER VALUES is selected: {remotely; under [MP-06(08)_ODP[03]; conditions under which information is to be purged or wiped are defined (if selected)]}] is provided.'),\n('002578','draft','2013-07-09','DISA FSO','policy','Defines system media to sanitize prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures.','MP-06a.','N/A','Determine if: - [MP-06_ODP[01]; system media to be sanitized prior to disposal is defined] is sanitized using [MP-06_ODP[04]; sanitization techniques and procedures to be used for sanitization prior to disposal are defined] prior to disposal. - [MP-06_ODP[02]; system media to be sanitized prior to release from organizational control is defined] is sanitized using [MP-06_ODP[05]; sanitization techniques and procedures to be used for sanitization prior to release from organizational control are defined] prior to release from organizational control. - [MP-06_ODP[03]; system media to be sanitized prior to release for reuse is defined] is sanitized using [MP-06_ODP[06]; sanitization techniques and procedures to be used for sanitization prior to release for reuse are defined] prior to release for reuse.'),\n('002579','draft','2013-07-09','DISA FSO','policy','Defines the sanitization techniques and procedures to be used to sanitize organization-defined system media prior to disposal, release out of organizational control, or release for reuse.','MP-06a.','N/A','Determine if: - [MP-06_ODP[01]; system media to be sanitized prior to disposal is defined] is sanitized using [MP-06_ODP[04]; sanitization techniques and procedures to be used for sanitization prior to disposal are defined] prior to disposal. - [MP-06_ODP[02]; system media to be sanitized prior to release from organizational control is defined] is sanitized using [MP-06_ODP[05]; sanitization techniques and procedures to be used for sanitization prior to release from organizational control are defined] prior to release from organizational control. - [MP-06_ODP[03]; system media to be sanitized prior to release for reuse is defined] is sanitized using [MP-06_ODP[06]; sanitization techniques and procedures to be used for sanitization prior to release for reuse are defined] prior to release for reuse.'),\n('002580','draft','2013-07-09','DISA FSO','policy','Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.','MP-06b.','N/A','Determine if sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed.'),\n('002581','draft','2013-07-09','DISA FSO','policy','Defines the types of system media to restrict or prohibit on organization-defined systems or system components using organization-defined controls.','MP-07a.','N/A','Determine if the use of [MP-07_ODP[01]; types of system media to be restricted or prohibited from use on systems or system components are defined] is [MP-07_ODP[02]; one of the following PARAMETER VALUES is selected: {restrict; prohibit}] on [MP-07_ODP[03]; systems or system components on which the use of specific types of system media to be restricted or prohibited are defined] using [MP-07_ODP[04]; controls to restrict or prohibit the use of specific types of system media on systems or system components are defined].'),\n('002582','draft','2013-07-09','DISA FSO','policy','Defines the systems or system components on which to restrict or prohibit the use of organization-defined types of system media using organization-defined controls.','MP-07a.','N/A','Determine if the use of [MP-07_ODP[01]; types of system media to be restricted or prohibited from use on systems or system components are defined] is [MP-07_ODP[02]; one of the following PARAMETER VALUES is selected: {restrict; prohibit}] on [MP-07_ODP[03]; systems or system components on which the use of specific types of system media to be restricted or prohibited are defined] using [MP-07_ODP[04]; controls to restrict or prohibit the use of specific types of system media on systems or system components are defined].'),\n('002583','draft','2013-07-09','DISA FSO','policy','Defines the controls to use for restricting or prohibiting the use of organization-defined types of system media on organization-defined systems or system components.','MP-07a.','N/A','Determine if the use of [MP-07_ODP[01]; types of system media to be restricted or prohibited from use on systems or system components are defined] is [MP-07_ODP[02]; one of the following PARAMETER VALUES is selected: {restrict; prohibit}] on [MP-07_ODP[03]; systems or system components on which the use of specific types of system media to be restricted or prohibited are defined] using [MP-07_ODP[04]; controls to restrict or prohibit the use of specific types of system media on systems or system components are defined].'),\n('002584','draft','2013-07-09','DISA FSO','policy','Restrict or prohibit the use of organization-defined types of system media on organization-defined systems or system components using organization-defined controls.','MP-07a.','N/A','Determine if the use of [MP-07_ODP[01]; types of system media to be restricted or prohibited from use on systems or system components are defined] is [MP-07_ODP[02]; one of the following PARAMETER VALUES is selected: {restrict; prohibit}] on [MP-07_ODP[03]; systems or system components on which the use of specific types of system media to be restricted or prohibited are defined] using [MP-07_ODP[04]; controls to restrict or prohibit the use of specific types of system media on systems or system components are defined].'),\n('002585','draft','2013-07-09','DISA FSO','policy','Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.','MP-07b.','N/A','Determine if the use of portable storage devices in organizational systems is prohibited when such devices have no identifiable owner.'),\n('002586','draft','2013-07-09','DISA FSO','policy','Prohibit the use of sanitization-resistant media in organizational systems.','MP-07(02)','N/A','Determine if: - sanitization-resistant media is identified. - the use of sanitization-resistant media in organizational systems is prohibited.'),\n('002587','draft','2013-07-09','DISA FSO','policy','Document system media downgrading actions.','MP-08(01)','N/A','Determine if system media downgrading actions are documented.'),\n('002591','draft','2013-07-09','DISA FSO','policy','Defines the frequency with which to test downgrading equipment and procedures to ensure correct performance.','MP-08(02)','N/A','Determine if: - downgrading equipment is tested [MP-08(02)_ODP[01]; the frequency with which to test downgrading equipment is defined] to ensure that downgrading actions are being achieved. - downgrading procedures are tested [MP-08(02)_ODP[02]; the frequency with which to test downgrading procedures is defined] to ensure that downgrading actions are being achieved.'),\n('002593','draft','2013-07-09','DISA FSO','policy','Downgrade system media containing Controlled Unclassified Information (CUI) prior to public release.','MP-08(03)','N/A','Determine if: - system media containing controlled unclassified information is identified. - system media containing controlled unclassified information is downgraded prior to public release.'),\n('002594','draft','2013-07-09','DISA FSO','policy','Downgrade system media containing classified information prior to release to individuals without required access authorizations.','MP-08(04)','N/A','Determine if: - system media containing classified information is identified. - system media containing classified information is downgraded prior to release to individuals without required access authorizations.'),\n('002600','draft','2013-07-09','DISA FSO','policy','Downgrade the identified system media using the established process.','MP-08d.','N/A','Determine if the identified system media is downgraded using the [MP-08_ODP[01]; a system media downgrading process is defined].'),\n('002601','draft','2013-07-11','DISA FSO','policy','Defines the personnel or roles to whom the system and information integrity policy and procedures are to be disseminated.','SI-01a.','N/A','Determine if: - a system and information integrity policy is developed and documented. - the system and information integrity policy is disseminated to [SI-01_ODP[01]; personnel or roles to whom the system and information integrity policy is to be disseminated is/are defined].'),\n('002602','draft','2013-07-11','DISA FSO','policy','Test firmware updates related to flaw remediation for effectiveness before installation.','SI-02b.','N/A','Determine if: - software updates related to flaw remediation are tested for effectiveness before installation. - software updates related to flaw remediation are tested for potential side effects before installation. - firmware updates related to flaw remediation are tested for effectiveness before installation. - firmware updates related to flaw remediation are tested for potential side effects before installation.'),\n('002603','draft','2013-07-11','DISA FSO','policy','Test firmware updates related to flaw remediation for potential side effects before installation.','SI-02b.','N/A','Determine if: - software updates related to flaw remediation are tested for effectiveness before installation. - software updates related to flaw remediation are tested for potential side effects before installation. - firmware updates related to flaw remediation are tested for effectiveness before installation. - firmware updates related to flaw remediation are tested for potential side effects before installation.'),\n('002604','draft','2013-07-11','DISA FSO','policy','Defines the time period following the release of updates within which security-related software updates are to be installed.','SI-02c.','N/A','Determine if: - security-relevant software updates are installed within [SI-02_ODP; time period within which to install security-relevant software updates after the release of the updates is defined] of the release of the updates. - security-relevant firmware updates are installed within [SI-02_ODP; time period within which to install security-relevant software updates after the release of the updates is defined] of the release of the updates.'),\n('002605','draft','2013-07-11','DISA FSO','technical','Install security-relevant software updates within an organization-defined time period of the release of the updates.','SI-02c.','N/A','Determine if: - security-relevant software updates are installed within [SI-02_ODP; time period within which to install security-relevant software updates after the release of the updates is defined] of the release of the updates. - security-relevant firmware updates are installed within [SI-02_ODP; time period within which to install security-relevant software updates after the release of the updates is defined] of the release of the updates.'),\n('002606','draft','2013-07-11','DISA FSO','policy','Defines the time period following the release of updates within which security-related firmware updates are to be installed.','SI-02c.','N/A','Determine if: - security-relevant software updates are installed within [SI-02_ODP; time period within which to install security-relevant software updates after the release of the updates is defined] of the release of the updates. - security-relevant firmware updates are installed within [SI-02_ODP; time period within which to install security-relevant software updates after the release of the updates is defined] of the release of the updates.'),\n('002607','draft','2013-07-11','DISA FSO','technical','Install security-relevant firmware updates within an organization-defined time period of the release of the updates.','SI-02c.','N/A','Determine if: - security-relevant software updates are installed within [SI-02_ODP; time period within which to install security-relevant software updates after the release of the updates is defined] of the release of the updates. - security-relevant firmware updates are installed within [SI-02_ODP; time period within which to install security-relevant software updates after the release of the updates is defined] of the release of the updates.'),\n('002608','draft','2013-07-11','DISA FSO','policy','Establish organization-defined benchmarks for the time taken to apply corrective actions after flaw identification.','SI-02(03)(b)','N/A','Determine if [SI-02(03)_ODP; the benchmarks for taking corrective actions are defined] for taking corrective actions have been established.'),\n('002609','draft','2013-07-11','DISA FSO','policy','Defines the system components on which organization-defined security-relevant software updates will be automatically installed.','SI-02(05)','N/A','Determine if [SI-02(05)_ODP[01]; security-relevant software and firmware updates to be automatically installed to system components are defined] are installed automatically to [SI-02(05)_ODP[02]; system components requiring security-relevant software updates to be automatically installed are defined].'),\n('002610','draft','2013-07-11','DISA FSO','policy','Defines the system components on which organization-defined security-relevant firmware updates will be automatically installed.','SI-02(05)','N/A','Determine if [SI-02(05)_ODP[01]; security-relevant software and firmware updates to be automatically installed to system components are defined] are installed automatically to [SI-02(05)_ODP[02]; system components requiring security-relevant software updates to be automatically installed are defined].'),\n('002611','draft','2013-07-11','DISA FSO','policy','Defines the security-relevant software updates to be automatically installed on organization-defined system components.','SI-02(05)','N/A','Determine if [SI-02(05)_ODP[01]; security-relevant software and firmware updates to be automatically installed to system components are defined] are installed automatically to [SI-02(05)_ODP[02]; system components requiring security-relevant software updates to be automatically installed are defined].'),\n('002612','draft','2013-07-11','DISA FSO','policy','Defines the security-relevant firmware updates to be automatically installed on organization-defined system components.','SI-02(05)','N/A','Determine if [SI-02(05)_ODP[01]; security-relevant software and firmware updates to be automatically installed to system components are defined] are installed automatically to [SI-02(05)_ODP[02]; system components requiring security-relevant software updates to be automatically installed are defined].'),\n('002613','draft','2013-07-11','DISA FSO','technical','Install organization-defined security-relevant software updates automatically to organization-defined system components.','SI-02(05)','N/A','Determine if [SI-02(05)_ODP[01]; security-relevant software and firmware updates to be automatically installed to system components are defined] are installed automatically to [SI-02(05)_ODP[02]; system components requiring security-relevant software updates to be automatically installed are defined].'),\n('002614','draft','2013-07-11','DISA FSO','technical','Install organization-defined security-relevant firmware updates automatically to organization-defined system components.','SI-02(05)','N/A','Determine if [SI-02(05)_ODP[01]; security-relevant software and firmware updates to be automatically installed to system components are defined] are installed automatically to [SI-02(05)_ODP[02]; system components requiring security-relevant software updates to be automatically installed are defined].'),\n('002615','draft','2013-07-11','DISA FSO','policy','Defines the software components to remove previous versions after updated versions have been installed.','SI-02(06)','N/A','Determine if previous versions of [SI-02(06)_ODP; software and firmware components to be removed after updated versions have been installed are defined] are removed after updated versions have been installed.'),\n('002616','draft','2013-07-11','DISA FSO','policy','Defines the firmware components to remove previous versions after updated versions have been installed.','SI-02(06)','N/A','Determine if previous versions of [SI-02(06)_ODP; software and firmware components to be removed after updated versions have been installed are defined] are removed after updated versions have been installed.'),\n('002617','draft','2013-07-11','DISA FSO','technical','Remove previous versions of organization-defined software components after updated versions have been installed.','SI-02(06)','N/A','Determine if previous versions of [SI-02(06)_ODP; software and firmware components to be removed after updated versions have been installed are defined] are removed after updated versions have been installed.'),\n('002618','draft','2013-07-11','DISA FSO','technical','Remove previous versions of organization-defined firmware components after updated versions have been installed.','SI-02(06)','N/A','Determine if previous versions of [SI-02(06)_ODP; software and firmware components to be removed after updated versions have been installed are defined] are removed after updated versions have been installed.'),\n('002623','draft','2013-07-11','DISA FSO','policy','Defines the frequency for performing periodic scans of the system for malicious code.','SI-03c.01','N/A','Determine if: - malicious code protection mechanisms are configured to perform periodic scans of the system [SI-03_ODP[02]; the frequency at which malicious code protection mechanisms perform scans is defined]. - malicious code protection mechanisms are configured to perform real-time scans of files from external sources at [SI-03_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {endpoint; network entry and exit points}] as the files are downloaded, opened, or executed in accordance with organizational policy.'),\n('002624','draft','2013-07-11','DISA FSO','technical','Configure malicious code protection mechanisms to perform real-time scans of files from external sources at endpoint; and/or network entry and exit points as the files are downloaded, opened, or executed in accordance with organizational policy.','SI-03c.01','N/A','Determine if: - malicious code protection mechanisms are configured to perform periodic scans of the system [SI-03_ODP[02]; the frequency at which malicious code protection mechanisms perform scans is defined]. - malicious code protection mechanisms are configured to perform real-time scans of files from external sources at [SI-03_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {endpoint; network entry and exit points}] as the files are downloaded, opened, or executed in accordance with organizational policy.'),\n('002625','draft','2013-07-11','DISA FSO','policy','When testing malicious code protection mechanisms, verify the detection of the code.','SI-03(06)(b)','N/A','Determine if: - the detection of (benign test) code occurs. - the associated incident reporting occurs.'),\n('002626','draft','2013-07-11','DISA FSO','policy','When testing malicious code protection mechanisms, verify the associated incident reporting of the code occurs.','SI-03(06)(b)','N/A','Determine if: - the detection of (benign test) code occurs. - the associated incident reporting occurs.'),\n('002628','draft','2013-07-11','DISA FSO','policy','Defines the unauthorized operating system commands that are to be detected through the kernel application programming interface on organization-defined system hardware components.','SI-03(08)(a)','N/A','Determine if [SI-03(08)_ODP[01]; system hardware components for which unauthorized operating system commands are to be detected through the kernel application programming interface are defined] are detected through the kernel application programming interface on [SI-03(08)_ODP[02]; unauthorized operating system commands to be detected are defined].'),\n('002629','draft','2013-07-11','DISA FSO','policy','Defines the system hardware components that are to detect organization-defined unauthorized operating system commands through the kernel programming application interface.','SI-03(08)(a)','N/A','Determine if [SI-03(08)_ODP[01]; system hardware components for which unauthorized operating system commands are to be detected through the kernel application programming interface are defined] are detected through the kernel application programming interface on [SI-03(08)_ODP[02]; unauthorized operating system commands to be detected are defined].'),\n('002630','draft','2013-07-11','DISA FSO','technical','Detect organization-defined unauthorized operating system commands through the kernel application programming interface at organization-defined system hardware components.','SI-03(08)(a)','N/A','Determine if [SI-03(08)_ODP[01]; system hardware components for which unauthorized operating system commands are to be detected through the kernel application programming interface are defined] are detected through the kernel application programming interface on [SI-03(08)_ODP[02]; unauthorized operating system commands to be detected are defined].'),\n('002631','draft','2013-07-11','DISA FSO','technical','Issue a warning; audit the command execution; and/or prevent the execution of the command when organization-defined unauthorized operating system commands are detected.','SI-03(08)(b)','N/A','Determine if [SI-03(08)_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {issue a warning; audit the command execution; prevent the execution of the command}] is/are performed.'),\n('002634','draft','2013-07-11','DISA FSO','policy','Defines the tools to be employed to analyze the characteristics and behavior of malicious code.','SI-03(10)(a)','N/A','Determine if [SI-03(10)_ODP; tools and techniques to be employed to analyze the characteristics and behavior of malicious code are defined] are employed to analyze the characteristics and behavior of malicious code.'),\n('002635','draft','2013-07-11','DISA FSO','policy','Defines the techniques to be employed to analyze the characteristics and behavior of malicious code.','SI-03(10)(a)','N/A','Determine if [SI-03(10)_ODP; tools and techniques to be employed to analyze the characteristics and behavior of malicious code are defined] are employed to analyze the characteristics and behavior of malicious code.'),\n('002636','draft','2013-07-11','DISA FSO','policy','Employ organization-defined tools to analyze the characteristics and behavior of malicious code.','SI-03(10)(a)','N/A','Determine if [SI-03(10)_ODP; tools and techniques to be employed to analyze the characteristics and behavior of malicious code are defined] are employed to analyze the characteristics and behavior of malicious code.'),\n('002638','draft','2013-07-11','DISA FSO','policy','Employ organization-defined techniques to analyze the characteristics and behavior of malicious code.','SI-03(10)(a)','N/A','Determine if [SI-03(10)_ODP; tools and techniques to be employed to analyze the characteristics and behavior of malicious code are defined] are employed to analyze the characteristics and behavior of malicious code.'),\n('002639','draft','2013-07-11','DISA FSO','policy','Incorporate the results from malicious code analysis into organizational incident response processes.','SI-03(10)(b)','N/A','Determine if: - the results from malicious code analysis are incorporated into organizational incident response processes. - the results from malicious code analysis are incorporated into organizational flaw remediation processes.'),\n('002640','draft','2013-07-11','DISA FSO','policy','Incorporate the results from malicious code analysis into organizational flaw remediation processes.','SI-03(10)(b)','N/A','Determine if: - the results from malicious code analysis are incorporated into organizational incident response processes. - the results from malicious code analysis are incorporated into organizational flaw remediation processes.'),\n('002641','draft','2013-07-11','DISA FSO','policy','Monitor the system to detect attacks and indicators of potential attacks in accordance with organization-defined monitoring objectives.','SI-04a.01','N/A','Determine if the system is monitored to detect attacks and indicators of potential attacks in accordance with [SI-04_ODP[01]; monitoring objectives to detect attacks and indicators of potential attacks on the system are defined].'),\n('002642','draft','2013-07-11','DISA FSO','policy','Monitor the system to detect unauthorized local connections.','SI-04a.02','N/A','Determine if: - the system is monitored to detect unauthorized local connections. - the system is monitored to detect unauthorized network connections. - the system is monitored to detect unauthorized remote connections.'),\n('002643','draft','2013-07-11','DISA FSO','policy','Monitor the system to detect unauthorized network connections.','SI-04a.02','N/A','Determine if: - the system is monitored to detect unauthorized local connections. - the system is monitored to detect unauthorized network connections. - the system is monitored to detect unauthorized remote connections.'),\n('002644','draft','2013-07-11','DISA FSO','policy','Monitor the system to detect unauthorized remote connections.','SI-04a.02','N/A','Determine if: - the system is monitored to detect unauthorized local connections. - the system is monitored to detect unauthorized network connections. - the system is monitored to detect unauthorized remote connections.'),\n('002645','draft','2013-07-11','DISA FSO','policy','Defines the techniques and methods to be used to identify unauthorized use of the system.','SI-04b.','N/A','Determine if unauthorized use of the system is identified through [SI-04_ODP[02]; techniques and methods used to identify unauthorized use of the system are defined].'),\n('002646','draft','2013-07-11','DISA FSO','policy','Identify unauthorized use of the system through organization-defined techniques and methods.','SI-04b.','N/A','Determine if unauthorized use of the system is identified through [SI-04_ODP[02]; techniques and methods used to identify unauthorized use of the system are defined].'),\n('002650','draft','2013-07-11','DISA FSO','policy','Defines the system monitoring information that is to be provided the organization-defined personnel or roles.','SI-04g.','N/A','Determine if [SI-04_ODP[03]; system monitoring information to be provided to personnel or roles is defined] is provided to [SI-04_ODP[04]; personnel or roles to whom system monitoring information is to be provided is/are defined] [SI-04_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {as needed; [SI-04_ODP[06]; a frequency for providing system monitoring to personnel or roles is defined (if selected)]}].'),\n('002651','draft','2013-07-11','DISA FSO','policy','Defines the personnel or roles that are to be provided organization-defined system monitoring information.','SI-04g.','N/A','Determine if [SI-04_ODP[03]; system monitoring information to be provided to personnel or roles is defined] is provided to [SI-04_ODP[04]; personnel or roles to whom system monitoring information is to be provided is/are defined] [SI-04_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {as needed; [SI-04_ODP[06]; a frequency for providing system monitoring to personnel or roles is defined (if selected)]}].'),\n('002652','draft','2013-07-11','DISA FSO','policy','Defines the frequency at which the organization will provide the organization-defined system monitoring information to organization-defined personnel or roles.','SI-04g.','N/A','Determine if [SI-04_ODP[03]; system monitoring information to be provided to personnel or roles is defined] is provided to [SI-04_ODP[04]; personnel or roles to whom system monitoring information is to be provided is/are defined] [SI-04_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {as needed; [SI-04_ODP[06]; a frequency for providing system monitoring to personnel or roles is defined (if selected)]}].'),\n('002654','draft','2013-07-11','DISA FSO','policy','Provide organization-defined system monitoring information to organization-defined personnel or roles as needed, and/or per organization-defined frequency.','SI-04g.','N/A','Determine if [SI-04_ODP[03]; system monitoring information to be provided to personnel or roles is defined] is provided to [SI-04_ODP[04]; personnel or roles to whom system monitoring information is to be provided is/are defined] [SI-04_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {as needed; [SI-04_ODP[06]; a frequency for providing system monitoring to personnel or roles is defined (if selected)]}].'),\n('002655','draft','2013-07-11','DISA FSO','policy','Connect individual intrusion detection tools into a system-wide intrusion detection system.','SI-04(01)','N/A','Determine if: - individual intrusion detection tools are connected to a system-wide intrusion detection system. - individual intrusion detection tools are configured into a system-wide intrusion detection system.'),\n('002656','draft','2013-07-11','DISA FSO','technical','Configure individual intrusion detection tools into a system-wide intrusion detection system.','SI-04(01)','N/A','Determine if: - individual intrusion detection tools are connected to a system-wide intrusion detection system. - individual intrusion detection tools are configured into a system-wide intrusion detection system.'),\n('002657','draft','2013-07-11','DISA FSO','policy','Employ automated tools to integrate intrusion detection tools into access control mechanisms.','SI-04(03)','N/A','Determine if: - automated tools and mechanisms are employed to integrate intrusion detection tools and mechanisms into access control mechanisms. - automated tools and mechanisms are employed to integrate intrusion detection tools and mechanisms into flow control mechanisms.'),\n('002658','draft','2013-07-11','DISA FSO','policy','Employ automated tools to integrate intrusion detection tools into flow control mechanisms.','SI-04(03)','N/A','Determine if: - automated tools and mechanisms are employed to integrate intrusion detection tools and mechanisms into access control mechanisms. - automated tools and mechanisms are employed to integrate intrusion detection tools and mechanisms into flow control mechanisms.'),\n('002659','draft','2013-07-11','DISA FSO','policy','Defines the frequency on which it will monitor inbound communications for unusual or unauthorized activities or conditions.','SI-04(04)(b)','N/A','Determine if: - inbound communications traffic is monitored [SI-04(04)_ODP[01]; the frequency at which to monitor inbound communications traffic for unusual or unauthorized activities or conditions is defined] for [SI-04(04)_ODP[02]; unusual or unauthorized activities or conditions that are to be monitored in inbound communications traffic are defined]. - outbound communications traffic is monitored [SI-04(04)_ODP[03]; the frequency at which to monitor outbound communications traffic for unusual or unauthorized activities or conditions is defined] for [SI-04(04)_ODP[04]; unusual or unauthorized activities or conditions that are to be monitored in outbound communications traffic are defined].'),\n('002660','draft','2013-07-11','DISA FSO','policy','Defines the frequency on which it will monitor outbound communications for unusual or unauthorized activities or conditions.','SI-04(04)(b)','N/A','Determine if: - inbound communications traffic is monitored [SI-04(04)_ODP[01]; the frequency at which to monitor inbound communications traffic for unusual or unauthorized activities or conditions is defined] for [SI-04(04)_ODP[02]; unusual or unauthorized activities or conditions that are to be monitored in inbound communications traffic are defined]. - outbound communications traffic is monitored [SI-04(04)_ODP[03]; the frequency at which to monitor outbound communications traffic for unusual or unauthorized activities or conditions is defined] for [SI-04(04)_ODP[04]; unusual or unauthorized activities or conditions that are to be monitored in outbound communications traffic are defined].'),\n('002661','draft','2013-07-11','DISA FSO','technical','Monitor inbound communications traffic per organization-defined frequency for organization-defined unusual or unauthorized activities or conditions.','SI-04(04)(b)','N/A','Determine if: - inbound communications traffic is monitored [SI-04(04)_ODP[01]; the frequency at which to monitor inbound communications traffic for unusual or unauthorized activities or conditions is defined] for [SI-04(04)_ODP[02]; unusual or unauthorized activities or conditions that are to be monitored in inbound communications traffic are defined]. - outbound communications traffic is monitored [SI-04(04)_ODP[03]; the frequency at which to monitor outbound communications traffic for unusual or unauthorized activities or conditions is defined] for [SI-04(04)_ODP[04]; unusual or unauthorized activities or conditions that are to be monitored in outbound communications traffic are defined].'),\n('002662','draft','2013-07-11','DISA FSO','technical','Monitor outbound communications traffic per organization-defined frequency for organization-defined unusual or unauthorized activities or conditions.','SI-04(04)(b)','N/A','Determine if: - inbound communications traffic is monitored [SI-04(04)_ODP[01]; the frequency at which to monitor inbound communications traffic for unusual or unauthorized activities or conditions is defined] for [SI-04(04)_ODP[02]; unusual or unauthorized activities or conditions that are to be monitored in inbound communications traffic are defined]. - outbound communications traffic is monitored [SI-04(04)_ODP[03]; the frequency at which to monitor outbound communications traffic for unusual or unauthorized activities or conditions is defined] for [SI-04(04)_ODP[04]; unusual or unauthorized activities or conditions that are to be monitored in outbound communications traffic are defined].'),\n('002663','draft','2013-07-11','DISA FSO','policy','Defines the personnel or roles to receive alerts when organization-defined indicators of compromise or potential compromise occur.','SI-04(05)','N/A','Determine if [SI-04(05)_ODP[01]; personnel or roles to be alerted when indications of compromise or potential compromise occur is/are defined] are alerted when system-generated [SI-04(05)_ODP[02]; compromise indicators are defined] occur.'),\n('002664','draft','2013-07-11','DISA FSO','technical','Alert organization-defined personnel or roles when organization-defined compromise indicators generate the occurrence of a compromise or a potential compromise.','SI-04(05)','N/A','Determine if [SI-04(05)_ODP[01]; personnel or roles to be alerted when indications of compromise or potential compromise occur is/are defined] are alerted when system-generated [SI-04(05)_ODP[02]; compromise indicators are defined] occur.'),\n('002665','draft','2013-07-11','DISA FSO','policy','Defines the encrypted communications traffic that is to be visible to organization-defined system monitoring tools.','SI-04(10)','N/A','Determine if provisions are made so that [SI-04(10)_ODP[01]; encrypted communications traffic to be made visible to system monitoring tools and mechanisms is defined] is visible to [SI-04(10)_ODP[02]; system monitoring tools and mechanisms to be provided access to encrypted communications traffic are defined].'),\n('002666','draft','2013-07-11','DISA FSO','policy','Defines the system monitoring tools that will have visibility into organization-defined encrypted communications traffic.','SI-04(10)','N/A','Determine if provisions are made so that [SI-04(10)_ODP[01]; encrypted communications traffic to be made visible to system monitoring tools and mechanisms is defined] is visible to [SI-04(10)_ODP[02]; system monitoring tools and mechanisms to be provided access to encrypted communications traffic are defined].'),\n('002667','draft','2013-07-11','DISA FSO','policy','Make provisions so that organization-defined encrypted communications traffic is visible to organization-defined system monitoring tools.','SI-04(10)','N/A','Determine if provisions are made so that [SI-04(10)_ODP[01]; encrypted communications traffic to be made visible to system monitoring tools and mechanisms is defined] is visible to [SI-04(10)_ODP[02]; system monitoring tools and mechanisms to be provided access to encrypted communications traffic are defined].'),\n('002668','draft','2013-07-11','DISA FSO','policy','Defines the interior points within the system where outbound communications will be analyzed to discover anomalies.','SI-04(11)','N/A','Determine if: - outbound communications traffic at the external interfaces to the system is analyzed to discover anomalies. - outbound communications traffic at [SI-04(11)_ODP; interior points within the system where communications traffic is to be analyzed are defined] is analyzed to discover anomalies. '),\n('002669','draft','2013-07-11','DISA FSO','policy','Use the traffic and event profiles in tuning system-monitoring devices.','SI-04(13)(c)','N/A','Determine if: - traffic profiles are used in tuning system-monitoring devices. - event profiles are used in tuning system-monitoring devices.'),\n('002670','draft','2013-07-11','DISA FSO','policy','Defines the interior points within the system where outbound communications will be analyzed to detect covert exfiltration of information.','SI-04(18)','N/A','Determine if: - outbound communications traffic is analyzed at interfaces external to the system to detect covert exfiltration of information. - outbound communications traffic is analyzed at [SI-04(18)_ODP; interior points within the system where communications traffic is to be analyzed are defined] to detect covert exfiltration of information.'),\n('002671','draft','2013-07-11','DISA FSO','policy','Analyze outbound communications traffic at the external interfaces of the system to detect covert exfiltration of information.','SI-04(18)','N/A','Determine if: - outbound communications traffic is analyzed at interfaces external to the system to detect covert exfiltration of information. - outbound communications traffic is analyzed at [SI-04(18)_ODP; interior points within the system where communications traffic is to be analyzed are defined] to detect covert exfiltration of information.'),\n('002672','draft','2013-07-11','DISA FSO','policy','Analyze outbound communications traffic at organization-defined interior points within the system to detect covert exfiltration of information.','SI-04(18)','N/A','Determine if: - outbound communications traffic is analyzed at interfaces external to the system to detect covert exfiltration of information. - outbound communications traffic is analyzed at [SI-04(18)_ODP; interior points within the system where communications traffic is to be analyzed are defined] to detect covert exfiltration of information.'),\n('002673','draft','2013-07-11','DISA FSO','policy','Defines the additional monitoring to be implemented for individuals identified as posing an increased level of risk.','SI-04(19)','N/A','Determine if [SI-04(19)_ODP[01]; additional monitoring of individuals who have been identified as posing an increased level of risk is defined] is implemented on individuals who have been identified by [SI-04(19)_ODP[02]; sources that identify individuals who pose an increased level of risk are defined] as posing an increased level of risk.'),\n('002674','draft','2013-07-11','DISA FSO','policy','Defines the sources that may be used to identify individuals who pose an increased level of risk.','SI-04(19)','N/A','Determine if [SI-04(19)_ODP[01]; additional monitoring of individuals who have been identified as posing an increased level of risk is defined] is implemented on individuals who have been identified by [SI-04(19)_ODP[02]; sources that identify individuals who pose an increased level of risk are defined] as posing an increased level of risk.'),\n('002675','draft','2013-07-11','DISA FSO','policy','Implement organization-defined additional monitoring of individuals who have been identified by organization-defined sources as posing an increased level of risk.','SI-04(19)','N/A','Determine if [SI-04(19)_ODP[01]; additional monitoring of individuals who have been identified as posing an increased level of risk is defined] is implemented on individuals who have been identified by [SI-04(19)_ODP[02]; sources that identify individuals who pose an increased level of risk are defined] as posing an increased level of risk.'),\n('002676','draft','2013-07-11','DISA FSO','policy','Defines additional monitoring to be implemented for privileged users.','SI-04(20)','N/A','Determine if [SI-04(20)_ODP; additional monitoring of privileged users is defined] of privileged users is implemented.'),\n('002677','draft','2013-07-11','DISA FSO','policy','Implement organization-defined additional monitoring of privileged users.','SI-04(20)','N/A','Determine if [SI-04(20)_ODP; additional monitoring of privileged users is defined] of privileged users is implemented.'),\n('002678','draft','2013-07-11','DISA FSO','policy','Defines additional monitoring to be implemented for individuals during an organization-defined probationary period.','SI-04(21)','N/A','Determine if [SI-04(21)_ODP[01]; additional monitoring to be implemented on individuals during probationary periods is defined] of individuals is implemented during [SI-04(21)_ODP[02]; the probationary period of individuals is defined].'),\n('002679','draft','2013-07-11','DISA FSO','policy','Defines the probationary period during which additional monitoring will be implemented for individuals.','SI-04(21)','N/A','Determine if [SI-04(21)_ODP[01]; additional monitoring to be implemented on individuals during probationary periods is defined] of individuals is implemented during [SI-04(21)_ODP[02]; the probationary period of individuals is defined].'),\n('002680','draft','2013-07-11','DISA FSO','policy','Implement organization-defined additional monitoring of individuals during an organization-defined probationary period.','SI-04(21)','N/A','Determine if [SI-04(21)_ODP[01]; additional monitoring to be implemented on individuals during probationary periods is defined] of individuals is implemented during [SI-04(21)_ODP[02]; the probationary period of individuals is defined].'),\n('002681','draft','2013-07-11','DISA FSO','policy','Defines the authorization or approval process for network services.','SI-04(22)(a)','N/A','Determine if network services that have not been authorized or approved by [SI-04(22)_ODP[01]; authorization or approval processes for network services are defined] are detected.'),\n('002682','draft','2013-07-11','DISA FSO','policy','Defines the personnel or roles to be alerted when unauthorized or unapproved network services are detected.','SI-04(22)(a)','N/A','Determine if network services that have not been authorized or approved by [SI-04(22)_ODP[01]; authorization or approval processes for network services are defined] are detected.'),\n('002683','draft','2013-07-11','DISA FSO','policy','Detect network services that have not been authorized or approved by the organization-defined authorization or approval processes.','SI-04(22)(a)','N/A','Determine if network services that have not been authorized or approved by [SI-04(22)_ODP[01]; authorization or approval processes for network services are defined] are detected.'),\n('002684','draft','2013-07-11','DISA FSO','technical','Audit and/or alert organization-defined personnel when unauthorized network services are detected.','SI-04(22)(b)','N/A','Determine if [SI-04(22)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {audit; alert [SI-04(22)_ODP[03]; personnel or roles to be alerted upon the detection of network services that have not been authorized or approved by authorization or approval processes is/are defined (if selected)]}] is/are initiated when network services that have not been authorized or approved by authorization or approval processes are detected.'),\n('002685','draft','2013-07-11','DISA FSO','policy','Defines the host-based monitoring mechanisms to be implemented at organization-defined system components.','SI-04(23)','N/A','Determine if [SI-04(23)_ODP[01]; host-based monitoring mechanisms to be implemented on system components are defined] are implemented on [SI-04(23)_ODP[02]; system components where host-based monitoring is to be implemented are defined].'),\n('002686','draft','2013-07-11','DISA FSO','policy','Defines the system components at which organization-defined host-based monitoring mechanisms are to be implemented.','SI-04(23)','N/A','Determine if [SI-04(23)_ODP[01]; host-based monitoring mechanisms to be implemented on system components are defined] are implemented on [SI-04(23)_ODP[02]; system components where host-based monitoring is to be implemented are defined].'),\n('002687','draft','2013-07-11','DISA FSO','policy','Implement organization-defined host-based monitoring mechanisms at organization-defined system components.','SI-04(23)','N/A','Determine if [SI-04(23)_ODP[01]; host-based monitoring mechanisms to be implemented on system components are defined] are implemented on [SI-04(23)_ODP[02]; system components where host-based monitoring is to be implemented are defined].'),\n('002688','draft','2013-07-11','DISA FSO','technical','Discover indicators of compromise.','SI-04(24)','N/A','Determine if: - indicators of compromise provided by [SI-04(24)_ODP[01]; sources that provide indicators of compromise are defined] are discovered. - indicators of compromise provided by [SI-04(24)_ODP[01]; sources that provide indicators of compromise are defined] are collected. - indicators of compromise provided by [SI-04(24)_ODP[01]; sources that provide indicators of compromise are defined] are distributed to [SI-04(24)_ODP[02]; personnel or roles to whom indicators of compromise are to be distributed is/are defined].'),\n('002689','draft','2013-07-11','DISA FSO','technical','Collect indicators of compromise.','SI-04(24)','N/A','Determine if: - indicators of compromise provided by [SI-04(24)_ODP[01]; sources that provide indicators of compromise are defined] are discovered. - indicators of compromise provided by [SI-04(24)_ODP[01]; sources that provide indicators of compromise are defined] are collected. - indicators of compromise provided by [SI-04(24)_ODP[01]; sources that provide indicators of compromise are defined] are distributed to [SI-04(24)_ODP[02]; personnel or roles to whom indicators of compromise are to be distributed is/are defined].'),\n('002690','draft','2013-07-11','DISA FSO','technical','Distribute indicators of compromise provided by organization-defined sources, to organization-defined personnel or roles.','SI-04(24)','N/A','Determine if: - indicators of compromise provided by [SI-04(24)_ODP[01]; sources that provide indicators of compromise are defined] are discovered. - indicators of compromise provided by [SI-04(24)_ODP[01]; sources that provide indicators of compromise are defined] are collected. - indicators of compromise provided by [SI-04(24)_ODP[01]; sources that provide indicators of compromise are defined] are distributed to [SI-04(24)_ODP[02]; personnel or roles to whom indicators of compromise are to be distributed is/are defined].'),\n('002692','draft','2013-07-11','DISA FSO','policy','Defines the external organizations from which it receives information system security alerts, advisories, and directives.','SI-05a.','N/A','Determine if system security alerts, advisories, and directives are received from [SI-05_ODP[01]; external organizations from whom system security alerts, advisories, and directives are to be received on an ongoing basis are defined] on an ongoing basis.'),\n('002693','draft','2013-07-11','DISA FSO','policy','Defines the elements within the organization to whom the organization will disseminate security alerts, advisories, and directives.','SI-05c.','N/A','Determine if security alerts, advisories, and directives are disseminated to [SI-05_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[SI-05_ODP[03]; personnel or roles to whom security alerts, advisories, and directives are to be disseminated is/are defined (if selected)]; [SI-05_ODP[04]; elements within the organization to whom security alerts, advisories, and directives are to be disseminated are defined (if selected)]; [SI-05_ODP[05]; external organizations to whom security alerts, advisories, and directives are to be disseminated are defined (if selected)]}].'),\n('002694','draft','2013-07-11','DISA FSO','policy','Defines the external organizations to which the organization will disseminate security alerts, advisories, and directives.','SI-05c.','N/A','Determine if security alerts, advisories, and directives are disseminated to [SI-05_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[SI-05_ODP[03]; personnel or roles to whom security alerts, advisories, and directives are to be disseminated is/are defined (if selected)]; [SI-05_ODP[04]; elements within the organization to whom security alerts, advisories, and directives are to be disseminated are defined (if selected)]; [SI-05_ODP[05]; external organizations to whom security alerts, advisories, and directives are to be disseminated are defined (if selected)]}].'),\n('002695','draft','2013-07-11','DISA FSO','policy','Defines the security functions that require verification of correct operation.','SI-06a.','N/A','Determine if: - [SI-06_ODP[01]; security functions to be verified for correct operation are defined] are verified to be operating correctly. - [SI-06_ODP[02]; privacy functions to be verified for correct operation are defined] are verified to be operating correctly.'),\n('002696','draft','2013-07-11','DISA FSO','technical','Verify correct operation of organization-defined security functions.','SI-06a.','N/A','Determine if: - [SI-06_ODP[01]; security functions to be verified for correct operation are defined] are verified to be operating correctly. - [SI-06_ODP[02]; privacy functions to be verified for correct operation are defined] are verified to be operating correctly.'),\n('002697','draft','2013-07-11','DISA FSO','policy','Defines the frequency at which it will verify correct operation of organization-defined security functions.','SI-06b.','N/A','Determine if: - [SI-06_ODP[01]; security functions to be verified for correct operation are defined] are verified [SI-06_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[SI-06_ODP[04]; system transitional states requiring the verification of security and privacy functions are defined; (if selected]; upon command by user with appropriate privilege; [SI-06_ODP[05]; frequency at which to verify the correct operation of security and privacy functions is defined; (if selected]}]. - [SI-06_ODP[02]; privacy functions to be verified for correct operation are defined] are verified [SI-06_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[SI-06_ODP[04]; system transitional states requiring the verification of security and privacy functions are defined; (if selected]; upon command by user with appropriate privilege; [SI-06_ODP[05]; frequency at which to verify the correct operation of security and privacy functions is defined; (if selected]}].'),\n('002698','draft','2013-07-11','DISA FSO','policy','Defines the system transitional states when the system will verify correct operation of organization-defined security functions.','SI-06b.','N/A','Determine if: - [SI-06_ODP[01]; security functions to be verified for correct operation are defined] are verified [SI-06_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[SI-06_ODP[04]; system transitional states requiring the verification of security and privacy functions are defined; (if selected]; upon command by user with appropriate privilege; [SI-06_ODP[05]; frequency at which to verify the correct operation of security and privacy functions is defined; (if selected]}]. - [SI-06_ODP[02]; privacy functions to be verified for correct operation are defined] are verified [SI-06_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[SI-06_ODP[04]; system transitional states requiring the verification of security and privacy functions are defined; (if selected]; upon command by user with appropriate privilege; [SI-06_ODP[05]; frequency at which to verify the correct operation of security and privacy functions is defined; (if selected]}].'),\n('002699','draft','2013-07-11','DISA FSO','technical','Perform verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.',NULL,'N/A',NULL),\n('002700','draft','2013-07-11','DISA FSO','policy','Defines the personnel or roles to be notified when security verification tests fail.','SI-06c.','N/A','Determine if: - [SI-06_ODP[06]; personnel or roles to be alerted of failed security and privacy verification tests is/are defined] is/are alerted to failed security verification tests. - [SI-06_ODP[06]; personnel or roles to be alerted of failed security and privacy verification tests is/are defined] is/are alerted to failed privacy verification tests.'),\n('002701','draft','2013-07-11','DISA FSO','policy','Defines alternative action(s) to be taken when anomalies in the operation of organization-defined security functions are discovered.','SI-06d.','N/A','Determine if [SI-06_ODP[07]; one or more of the following PARAMETER VALUES is/are selected: {shut the system down; restart the system; [SI-06_ODP[08]; alternative action(s) to be performed when anomalies are discovered are defined (if selected)]}] is/are initiated when anomalies are discovered.'),\n('002702','draft','2013-07-11','DISA FSO','technical','Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.','SI-06d.','N/A','Determine if [SI-06_ODP[07]; one or more of the following PARAMETER VALUES is/are selected: {shut the system down; restart the system; [SI-06_ODP[08]; alternative action(s) to be performed when anomalies are discovered are defined (if selected)]}] is/are initiated when anomalies are discovered.'),\n('002703','draft','2013-07-11','DISA FSO','policy','Defines the software, firmware, and information which will be subjected to integrity verification tools to detect unauthorized changes.',NULL,'N/A',NULL),\n('002704','draft','2013-07-11','DISA FSO','policy','Employ integrity verification tools to detect unauthorized changes to organization-defined software, firmware, and information.','SI-07a.','N/A','Determine if: - integrity verification tools are employed to detect unauthorized changes to [SI-07_ODP[01]; software requiring integrity verification tools to be employed to detect unauthorized changes is defined]. - integrity verification tools are employed to detect unauthorized changes to [SI-07_ODP[02]; firmware requiring integrity verification tools to be employed to detect unauthorized changes is defined]. - integrity verification tools are employed to detect unauthorized changes to [SI-07_ODP[03]; information requiring integrity verification tools to be employed to detect unauthorized changes is defined].'),\n('002705','draft','2013-07-11','DISA FSO','policy','Defines the software on which integrity checks will be performed.','SI-07(01)','N/A','Determine if: - an integrity check of [SI-07(01)_ODP[01]; software on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[03]; transitional states or security-relevant events requiring integrity checks (on software) are defined (if selected)]; [SI-07(01)_ODP[04]; frequency with which to perform an integrity check (on software) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[05]; firmware on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[06]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[07]; transitional states or security-relevant events requiring integrity checks (on firmware) are defined (if selected)]; [SI-07(01)_ODP[08]; frequency with which to perform an integrity check (on firmware) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[09]; information on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[10]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[11]; transitional states or security-relevant events requiring integrity checks (of information) are defined (if selected)]; [SI-07(01)_ODP[12]; frequency with which to perform an integrity check (of information) is defined (if selected)]}].'),\n('002706','draft','2013-07-11','DISA FSO','policy','Defines the firmware on which integrity checks will be performed.','SI-07(01)','N/A','Determine if: - an integrity check of [SI-07(01)_ODP[01]; software on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[03]; transitional states or security-relevant events requiring integrity checks (on software) are defined (if selected)]; [SI-07(01)_ODP[04]; frequency with which to perform an integrity check (on software) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[05]; firmware on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[06]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[07]; transitional states or security-relevant events requiring integrity checks (on firmware) are defined (if selected)]; [SI-07(01)_ODP[08]; frequency with which to perform an integrity check (on firmware) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[09]; information on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[10]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[11]; transitional states or security-relevant events requiring integrity checks (of information) are defined (if selected)]; [SI-07(01)_ODP[12]; frequency with which to perform an integrity check (of information) is defined (if selected)]}].'),\n('002707','draft','2013-07-11','DISA FSO','policy','Defines the information on which integrity checks will be performed.','SI-07(01)','N/A','Determine if: - an integrity check of [SI-07(01)_ODP[01]; software on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[03]; transitional states or security-relevant events requiring integrity checks (on software) are defined (if selected)]; [SI-07(01)_ODP[04]; frequency with which to perform an integrity check (on software) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[05]; firmware on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[06]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[07]; transitional states or security-relevant events requiring integrity checks (on firmware) are defined (if selected)]; [SI-07(01)_ODP[08]; frequency with which to perform an integrity check (on firmware) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[09]; information on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[10]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[11]; transitional states or security-relevant events requiring integrity checks (of information) are defined (if selected)]; [SI-07(01)_ODP[12]; frequency with which to perform an integrity check (of information) is defined (if selected)]}].'),\n('002708','draft','2013-07-11','DISA FSO','policy','Defines the transitional state or security-relevant events when performing integrity checks on software, firmware, and information.','SI-07(01)','N/A','Determine if: - an integrity check of [SI-07(01)_ODP[01]; software on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[03]; transitional states or security-relevant events requiring integrity checks (on software) are defined (if selected)]; [SI-07(01)_ODP[04]; frequency with which to perform an integrity check (on software) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[05]; firmware on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[06]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[07]; transitional states or security-relevant events requiring integrity checks (on firmware) are defined (if selected)]; [SI-07(01)_ODP[08]; frequency with which to perform an integrity check (on firmware) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[09]; information on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[10]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[11]; transitional states or security-relevant events requiring integrity checks (of information) are defined (if selected)]; [SI-07(01)_ODP[12]; frequency with which to perform an integrity check (of information) is defined (if selected)]}].'),\n('002709','draft','2013-07-11','DISA FSO','policy','Defines the frequency at which integrity checks of software, firmware, and information will be performed.','SI-07(01)','N/A','Determine if: - an integrity check of [SI-07(01)_ODP[01]; software on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[03]; transitional states or security-relevant events requiring integrity checks (on software) are defined (if selected)]; [SI-07(01)_ODP[04]; frequency with which to perform an integrity check (on software) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[05]; firmware on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[06]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[07]; transitional states or security-relevant events requiring integrity checks (on firmware) are defined (if selected)]; [SI-07(01)_ODP[08]; frequency with which to perform an integrity check (on firmware) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[09]; information on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[10]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[11]; transitional states or security-relevant events requiring integrity checks (of information) are defined (if selected)]; [SI-07(01)_ODP[12]; frequency with which to perform an integrity check (of information) is defined (if selected)]}].'),\n('002710','draft','2013-07-11','DISA FSO','technical','Perform an integrity check of organization-defined software at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.','SI-07(01)','N/A','Determine if: - an integrity check of [SI-07(01)_ODP[01]; software on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[03]; transitional states or security-relevant events requiring integrity checks (on software) are defined (if selected)]; [SI-07(01)_ODP[04]; frequency with which to perform an integrity check (on software) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[05]; firmware on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[06]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[07]; transitional states or security-relevant events requiring integrity checks (on firmware) are defined (if selected)]; [SI-07(01)_ODP[08]; frequency with which to perform an integrity check (on firmware) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[09]; information on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[10]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[11]; transitional states or security-relevant events requiring integrity checks (of information) are defined (if selected)]; [SI-07(01)_ODP[12]; frequency with which to perform an integrity check (of information) is defined (if selected)]}].'),\n('002711','draft','2013-07-11','DISA FSO','technical','Perform an integrity check of organization-defined firmware at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.','SI-07(01)','N/A','Determine if: - an integrity check of [SI-07(01)_ODP[01]; software on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[03]; transitional states or security-relevant events requiring integrity checks (on software) are defined (if selected)]; [SI-07(01)_ODP[04]; frequency with which to perform an integrity check (on software) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[05]; firmware on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[06]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[07]; transitional states or security-relevant events requiring integrity checks (on firmware) are defined (if selected)]; [SI-07(01)_ODP[08]; frequency with which to perform an integrity check (on firmware) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[09]; information on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[10]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[11]; transitional states or security-relevant events requiring integrity checks (of information) are defined (if selected)]; [SI-07(01)_ODP[12]; frequency with which to perform an integrity check (of information) is defined (if selected)]}].'),\n('002712','draft','2013-07-11','DISA FSO','technical','Perform an integrity check of organization-defined information at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.','SI-07(01)','N/A','Determine if: - an integrity check of [SI-07(01)_ODP[01]; software on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[03]; transitional states or security-relevant events requiring integrity checks (on software) are defined (if selected)]; [SI-07(01)_ODP[04]; frequency with which to perform an integrity check (on software) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[05]; firmware on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[06]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[07]; transitional states or security-relevant events requiring integrity checks (on firmware) are defined (if selected)]; [SI-07(01)_ODP[08]; frequency with which to perform an integrity check (on firmware) is defined (if selected)]}]. - an integrity check of [SI-07(01)_ODP[09]; information on which an integrity check is to be performed is defined] is performed [SI-07(01)_ODP[10]; one or more of the following PARAMETER VALUES is/are selected: {at startup; at [SI-07(01)_ODP[11]; transitional states or security-relevant events requiring integrity checks (of information) are defined (if selected)]; [SI-07(01)_ODP[12]; frequency with which to perform an integrity check (of information) is defined (if selected)]}].'),\n('002713','draft','2013-07-11','DISA FSO','policy','Defines the personnel or roles to be notified when discrepancies are discovered during integrity verification.','SI-07(02)','N/A','Determine if automated tools that provide notification to [SI-07(02)_ODP; personnel or roles to whom notification is to be provided upon discovering discrepancies during integrity verification is/are defined] upon discovering discrepancies during integrity verification are employed.'),\n('002714','draft','2013-07-11','DISA FSO','policy','Defines the controls that are to be employed when integrity violations are discovered.','SI-07(05)','N/A','Determine if [SI-07(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {shut down the system; restart the system; implement [SI-07(05)_ODP[02]; controls to be implemented automatically when integrity violations are discovered are defined (if selected)]}] are automatically performed when integrity violations are discovered.'),\n('002715','draft','2013-07-11','DISA FSO','technical','Automatically shut the system down, restart the system, and/or implement organization-defined controls when integrity violations are discovered.','SI-07(05)','N/A','Determine if [SI-07(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {shut down the system; restart the system; implement [SI-07(05)_ODP[02]; controls to be implemented automatically when integrity violations are discovered are defined (if selected)]}] are automatically performed when integrity violations are discovered.'),\n('002716','draft','2013-07-11','DISA FSO','technical','Implement cryptographic mechanisms to detect unauthorized changes to software.','SI-07(06)','N/A','Determine if: - cryptographic mechanisms are implemented to detect unauthorized changes to software. - cryptographic mechanisms are implemented to detect unauthorized changes to firmware. - cryptographic mechanisms are implemented to detect unauthorized changes to information.'),\n('002717','draft','2013-07-11','DISA FSO','technical','Implement cryptographic mechanisms to detect unauthorized changes to firmware.','SI-07(06)','N/A','Determine if: - cryptographic mechanisms are implemented to detect unauthorized changes to software. - cryptographic mechanisms are implemented to detect unauthorized changes to firmware. - cryptographic mechanisms are implemented to detect unauthorized changes to information.'),\n('002718','draft','2013-07-11','DISA FSO','technical','Implement cryptographic mechanisms to detect unauthorized changes to information.','SI-07(06)','N/A','Determine if: - cryptographic mechanisms are implemented to detect unauthorized changes to software. - cryptographic mechanisms are implemented to detect unauthorized changes to firmware. - cryptographic mechanisms are implemented to detect unauthorized changes to information.'),\n('002719','draft','2013-07-11','DISA FSO','policy','Defines the unauthorized security-relevant changes to the system that are to be incorporated into the organizational incident response capability.','SI-07(07)','N/A','Determine if the detection of [SI-07(07)_ODP; security-relevant changes to the system are defined] are incorporated into the organizational incident response capability.'),\n('002720','draft','2013-07-11','DISA FSO','policy','Incorporate the detection of organization-defined security-relevant unauthorized changes into the organizational incident response capability.','SI-07(07)','N/A','Determine if the detection of [SI-07(07)_ODP; security-relevant changes to the system are defined] are incorporated into the organizational incident response capability.'),\n('002721','draft','2013-07-11','DISA FSO','policy','Defines the personnel or roles that are to be alerted when a potential integrity violation is detected.','SI-07(08)','N/A','Determine if: - the capability to audit an event upon the detection of a potential integrity violation is provided. - [SI-07(08)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {generate an audit record; alert current user; alert [SI-07(08)_ODP[02]; personnel or roles to be alerted upon the detection of a potential integrity violation is/are defined (if selected)]; [SI-07(08)_ODP[03]; other actions to be taken upon the detection of a potential integrity violation are defined (if selected)]}] is/are initiated upon the detection of a potential integrity violation.'),\n('002722','draft','2013-07-11','DISA FSO','policy','Defines other actions that can be taken when a potential integrity violation is detected.','SI-07(08)','N/A','Determine if: - the capability to audit an event upon the detection of a potential integrity violation is provided. - [SI-07(08)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {generate an audit record; alert current user; alert [SI-07(08)_ODP[02]; personnel or roles to be alerted upon the detection of a potential integrity violation is/are defined (if selected)]; [SI-07(08)_ODP[03]; other actions to be taken upon the detection of a potential integrity violation are defined (if selected)]}] is/are initiated upon the detection of a potential integrity violation.'),\n('002723','draft','2013-07-11','DISA FSO','technical','Upon detection of a potential integrity violation, provides the capability to audit the event.','SI-07(08)','N/A','Determine if: - the capability to audit an event upon the detection of a potential integrity violation is provided. - [SI-07(08)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {generate an audit record; alert current user; alert [SI-07(08)_ODP[02]; personnel or roles to be alerted upon the detection of a potential integrity violation is/are defined (if selected)]; [SI-07(08)_ODP[03]; other actions to be taken upon the detection of a potential integrity violation are defined (if selected)]}] is/are initiated upon the detection of a potential integrity violation.'),\n('002724','draft','2013-07-11','DISA FSO','technical','Upon detection of a potential integrity violation, initiate one or more of the following actions: generate an audit record; alert the current user; alert organization-defined personnel or roles; and/or organization-defined other actions.','SI-07(08)','N/A','Determine if: - the capability to audit an event upon the detection of a potential integrity violation is provided. - [SI-07(08)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {generate an audit record; alert current user; alert [SI-07(08)_ODP[02]; personnel or roles to be alerted upon the detection of a potential integrity violation is/are defined (if selected)]; [SI-07(08)_ODP[03]; other actions to be taken upon the detection of a potential integrity violation are defined (if selected)]}] is/are initiated upon the detection of a potential integrity violation.'),\n('002725','draft','2013-07-11','DISA FSO','policy','Defines the system component which will have the integrity of the boot process verified.','SI-07(09)','N/A','Determine if the integrity of the boot process of [SI-07(09)_ODP; system components requiring integrity verification of the boot process are defined] is verified.'),\n('002726','draft','2013-07-11','DISA FSO','technical','Verify the integrity of the boot process of organization-defined system components.','SI-07(09)','N/A','Determine if the integrity of the boot process of [SI-07(09)_ODP; system components requiring integrity verification of the boot process are defined] is verified.'),\n('002727','draft','2013-07-11','DISA FSO','policy','Defines the mechanisms to be implemented to protect the integrity of the boot firmware in organization-defined system components.','SI-07(10)','N/A','Determine if [SI-07(10)_ODP[01]; mechanisms to be implemented to protect the integrity of boot firmware in system components are defined] are implemented to protect the integrity of boot firmware in [SI-07(10)_ODP[02]; system components requiring mechanisms to protect the integrity of boot firmware are defined].'),\n('002728','draft','2013-07-11','DISA FSO','policy','Defines the system components on which organization-defined mechanisms will be implemented to protect the integrity of the boot firmware.','SI-07(10)','N/A','Determine if [SI-07(10)_ODP[01]; mechanisms to be implemented to protect the integrity of boot firmware in system components are defined] are implemented to protect the integrity of boot firmware in [SI-07(10)_ODP[02]; system components requiring mechanisms to protect the integrity of boot firmware are defined].'),\n('002729','draft','2013-07-11','DISA FSO','technical','Implement organization-defined mechanisms to protect the integrity of boot firmware in organization-defined system components.','SI-07(10)','N/A','Determine if [SI-07(10)_ODP[01]; mechanisms to be implemented to protect the integrity of boot firmware in system components are defined] are implemented to protect the integrity of boot firmware in [SI-07(10)_ODP[02]; system components requiring mechanisms to protect the integrity of boot firmware are defined].'),\n('002732','draft','2013-07-11','DISA FSO','policy','Defines the user-installed software that is to have its integrity verified prior to execution.','SI-07(12)','N/A','Determine if the integrity of [SI-07(12)_ODP; user-installed software requiring integrity verification prior to execution is defined] is verified prior to execution.'),\n('002733','draft','2013-07-11','DISA FSO','policy','Require that the integrity of organization-defined user-installed software be verified prior to execution.','SI-07(12)','N/A','Determine if the integrity of [SI-07(12)_ODP; user-installed software requiring integrity verification prior to execution is defined] is verified prior to execution.'),\n('002739','draft','2013-07-11','DISA FSO','policy','Defines the software or firmware components on which cryptographic mechanisms are to be implemented to support authentication prior to installation.','SI-07(15)','N/A','Determine if cryptographic mechanisms are implemented to authenticate [SI-07(15)_ODP; software or firmware components to be authenticated by cryptographic mechanisms prior to installation are defined] prior to installation.'),\n('002740','draft','2013-07-11','DISA FSO','technical','Implement cryptographic mechanisms to authenticate organization-defined software or firmware components prior to installation.','SI-07(15)','N/A','Determine if cryptographic mechanisms are implemented to authenticate [SI-07(15)_ODP; software or firmware components to be authenticated by cryptographic mechanisms prior to installation are defined] prior to installation.'),\n('002741','draft','2013-07-11','DISA FSO','policy','Employ spam protection mechanisms at system entry points to detect and take action on unsolicited messages.','SI-08a.','N/A','Determine if: - spam protection mechanisms are employed at system entry points to detect unsolicited messages. - spam protection mechanisms are employed at system exit points to detect unsolicited messages. - spam protection mechanisms are employed at system entry points to act on unsolicited messages. - spam protection mechanisms are employed at system exit points to act on unsolicited messages.'),\n('002742','draft','2013-07-11','DISA FSO','policy','Employ spam protection mechanisms at system exit points to detect and take action on unsolicited messages.','SI-08a.','N/A','Determine if: - spam protection mechanisms are employed at system entry points to detect unsolicited messages. - spam protection mechanisms are employed at system exit points to detect unsolicited messages. - spam protection mechanisms are employed at system entry points to act on unsolicited messages. - spam protection mechanisms are employed at system exit points to act on unsolicited messages.'),\n('002743','draft','2013-07-11','DISA FSO','technical','Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.','SI-08(03)','N/A','Determine if spam protection mechanisms with a learning capability are implemented to more effectively identify legitimate communications traffic.'),\n('002744','draft','2013-07-11','DISA FSO','policy','Defines the inputs on which the system is to conduct validity checks.','SI-10','N/A','Determine if the validity of the [SI-10_ODP; information inputs to the system requiring validity checks are defined] is checked.'),\n('002745','draft','2013-07-11','DISA FSO','policy','Defines the inputs defined in base control (SI-10), which provide a manual override capability for input validation.','SI-10(01)(a)','N/A','Determine if a manual override capability for the validation of [SI-10_ODP; information inputs to the system requiring validity checks are defined] is provided.'),\n('002746','draft','2013-07-11','DISA FSO','technical','Provide a manual override capability for input validation of organization-defined inputs defined in base control (SI-10).','SI-10(01)(a)','N/A','Determine if a manual override capability for the validation of [SI-10_ODP; information inputs to the system requiring validity checks are defined] is provided.'),\n('002747','draft','2013-07-11','DISA FSO','policy','Defines the individuals who have the authorization to use the manual override capability for input validation.','SI-10(01)(b)','N/A','Determine if the use of the manual override capability is restricted to only [SI-10(01)_ODP; authorized individuals who can use the manual override capability are defined].'),\n('002748','draft','2013-07-11','DISA FSO','technical','Restrict the use of the manual override capability to only organization-defined authorized individuals.','SI-10(01)(b)','N/A','Determine if the use of the manual override capability is restricted to only [SI-10(01)_ODP; authorized individuals who can use the manual override capability are defined].'),\n('002749','draft','2013-07-11','DISA FSO','technical','Audit the use of the manual override capability.','SI-10(01)(c)','N/A','Determine if the use of the manual override capability is audited.'),\n('002750','draft','2013-07-11','DISA FSO','policy','Defines the time-period within which input validation errors are to be reviewed.','SI-10(02)','N/A','Determine if: - input validation errors are reviewed within [SI-10(02)_ODP[01]; the time period within which input validation errors are to be reviewed is defined]. - input validation errors are resolved within [SI-10(02)_ODP[02]; the time period within which input validation errors are to be resolved is defined].'),\n('002751','draft','2013-07-11','DISA FSO','policy','Defines the time-period within which input validation errors are to be resolved.','SI-10(02)','N/A','Determine if: - input validation errors are reviewed within [SI-10(02)_ODP[01]; the time period within which input validation errors are to be reviewed is defined]. - input validation errors are resolved within [SI-10(02)_ODP[02]; the time period within which input validation errors are to be resolved is defined].'),\n('002752','draft','2013-07-11','DISA FSO','policy','Review input validation errors within an organization-defined time period.','SI-10(02)','N/A','Determine if: - input validation errors are reviewed within [SI-10(02)_ODP[01]; the time period within which input validation errors are to be reviewed is defined]. - input validation errors are resolved within [SI-10(02)_ODP[02]; the time period within which input validation errors are to be resolved is defined].'),\n('002753','draft','2013-07-11','DISA FSO','policy','Resolve input validation errors within an organization-defined time period.','SI-10(02)','N/A','Determine if: - input validation errors are reviewed within [SI-10(02)_ODP[01]; the time period within which input validation errors are to be reviewed is defined]. - input validation errors are resolved within [SI-10(02)_ODP[02]; the time period within which input validation errors are to be resolved is defined].'),\n('002754','draft','2013-07-11','DISA FSO','policy','Verify that the system behaves in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.','SI-10(03)','N/A','Determine if: - the system behaves in a predictable manner when invalid inputs are received. - the system behaves in a documented manner when invalid inputs are received.'),\n('002755','draft','2013-07-11','DISA FSO','policy','Account for timing interactions among system components in determining appropriate responses for invalid inputs.','SI-10(04)','N/A','Determine if timing interactions among system components are accounted for in determining appropriate responses for invalid inputs.'),\n('002756','draft','2013-07-11','DISA FSO','policy','Defines the trusted sources to which the usage of information inputs will be restricted (e.g., whitelisting).','SI-10(05)','N/A','Determine if the use of information inputs is restricted to [SI-10(05)_ODP[01]; trusted sources to which the use of information inputs is to be restricted are defined] and/or [SI-10(05)_ODP[02]; formats to which the use of information inputs is to be restricted are defined].'),\n('002757','draft','2013-07-11','DISA FSO','policy','Defines the acceptable formats to which information inputs are restricted.','SI-10(05)','N/A','Determine if the use of information inputs is restricted to [SI-10(05)_ODP[01]; trusted sources to which the use of information inputs is to be restricted are defined] and/or [SI-10(05)_ODP[02]; formats to which the use of information inputs is to be restricted are defined].'),\n('002758','draft','2013-07-11','DISA FSO','policy','Restrict the use of information inputs to organization-defined trusted sources and/or organization-defined formats.','SI-10(05)','N/A','Determine if the use of information inputs is restricted to [SI-10(05)_ODP[01]; trusted sources to which the use of information inputs is to be restricted are defined] and/or [SI-10(05)_ODP[02]; formats to which the use of information inputs is to be restricted are defined].'),\n('002759','draft','2013-07-11','DISA FSO','policy','Defines the personnel or roles to whom error messages are to be revealed.','SI-11b.','N/A','Determine if error messages are revealed only to [SI-11_ODP; personnel or roles to whom error messages are to be revealed is/are defined].'),\n('002760','draft','2013-07-11','DISA FSO','policy','Determines mean time to failure (MTTF) for organization-defined system components in specific environments of operation.','SI-13a.','N/A','Determine if mean time to failure (MTTF) is determined for [SI-13_ODP[01]; system components for which mean time to failure (MTTF) should be determined are defined] in specific environments of operation.'),\n('002761','draft','2013-07-11','DISA FSO','policy','Defines the system components in specific environments of operation for which the mean time to failure (MTTF) is to be determined.','SI-13a.','N/A','Determine if mean time to failure (MTTF) is determined for [SI-13_ODP[01]; system components for which mean time to failure (MTTF) should be determined are defined] in specific environments of operation.'),\n('002762','draft','2013-07-11','DISA FSO','policy','Defines the mean time to failure (MTTF) substitution criteria to be employed as a means to determine the need to exchange active and standby components.','SI-13b.','N/A','Determine if substitute system components and a means to exchange active and standby components are provided in accordance with [SI-13_ODP[02]; mean time to failure (MTTF) substitution criteria to be used as a means to exchange active and standby components are defined].'),\n('002763','draft','2013-07-11','DISA FSO','policy','Provide a means to exchange active and standby components in accordance with the organization-defined mean time to failure (MTTF) substitution criteria.','SI-13b.','N/A','Determine if substitute system components and a means to exchange active and standby components are provided in accordance with [SI-13_ODP[02]; mean time to failure (MTTF) substitution criteria to be used as a means to exchange active and standby components are defined].'),\n('002764','draft','2013-07-11','DISA FSO','policy','Defines non-persistent system components and services to be implemented.','SI-14','N/A','Determine if: - non-persistent [SI-14_ODP[01]; non-persistent system components and services to be implemented are defined] that are initiated in a known state are implemented. - non-persistent [SI-14_ODP[01]; non-persistent system components and services to be implemented are defined] are terminated [SI-14_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {upon end of session of use; [SI-14_ODP[03]; the frequency at which to terminate non-persistent components and services that are initiated in a known state is defined (if selected)]}].'),\n('002765','draft','2013-07-11','DISA FSO','policy','Defines the frequency at which the organization-defined non-persistent system components and services will be terminated.','SI-14','N/A','Determine if: - non-persistent [SI-14_ODP[01]; non-persistent system components and services to be implemented are defined] that are initiated in a known state are implemented. - non-persistent [SI-14_ODP[01]; non-persistent system components and services to be implemented are defined] are terminated [SI-14_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {upon end of session of use; [SI-14_ODP[03]; the frequency at which to terminate non-persistent components and services that are initiated in a known state is defined (if selected)]}].'),\n('002766','draft','2013-07-11','DISA FSO','policy','Implement organization-defined non-persistence system components and services that are initiated in a known state.','SI-14','N/A','Determine if: - non-persistent [SI-14_ODP[01]; non-persistent system components and services to be implemented are defined] that are initiated in a known state are implemented. - non-persistent [SI-14_ODP[01]; non-persistent system components and services to be implemented are defined] are terminated [SI-14_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {upon end of session of use; [SI-14_ODP[03]; the frequency at which to terminate non-persistent components and services that are initiated in a known state is defined (if selected)]}].'),\n('002767','draft','2013-07-11','DISA FSO','policy','Implement organization-defined non-persistence system components and services that are terminated upon end of session of use and/or periodically at an organization-defined frequency.','SI-14','N/A','Determine if: - non-persistent [SI-14_ODP[01]; non-persistent system components and services to be implemented are defined] that are initiated in a known state are implemented. - non-persistent [SI-14_ODP[01]; non-persistent system components and services to be implemented are defined] are terminated [SI-14_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {upon end of session of use; [SI-14_ODP[03]; the frequency at which to terminate non-persistent components and services that are initiated in a known state is defined (if selected)]}].'),\n('002768','draft','2013-07-11','DISA FSO','policy','Defines the trusted sources from which it obtains software and data employed during the refreshing of non-persistent system components and services.','SI-14(01)','N/A','Determine if the software and data employed during system component and service refreshes are obtained from [SI-14(01)_ODP; trusted sources to obtain software and data for system component and service refreshes are defined].'),\n('002769','draft','2013-07-11','DISA FSO','policy','Obtain software and data employed during non-persistent system component and service refreshes are obtained from organization-defined trusted sources.','SI-14(01)','N/A','Determine if the software and data employed during system component and service refreshes are obtained from [SI-14(01)_ODP; trusted sources to obtain software and data for system component and service refreshes are defined].'),\n('002770','draft','2013-07-11','DISA FSO','policy','Defines the software programs and/or applications from which the system is to validate the information output to ensure the information is consistent with expected content.','SI-15','N/A','Determine if information output from [SI-15_ODP; software programs and/or applications whose information output requires validation are defined] is validated to ensure that the information is consistent with the expected content.'),\n('002771','draft','2013-07-11','DISA FSO','technical','Validate information output from organization-defined software programs and/or applications to ensure that the information is consistent with the expected content.','SI-15','N/A','Determine if information output from [SI-15_ODP; software programs and/or applications whose information output requires validation are defined] is validated to ensure that the information is consistent with the expected content.'),\n('002773','draft','2013-07-11','DISA FSO','policy','Defines the fail-safe procedures to be implemented when organization-defined failure conditions occur.','SI-17','N/A','Determine if [SI-17_ODP[01]; fail-safe procedures associated with failure conditions are defined] are implemented when [SI-17_ODP[02]; a list of failure conditions requiring fail-safe procedures is defined] occur.'),\n('002774','draft','2013-07-11','DISA FSO','policy','Defines the failure conditions which, when they occur, will result in the information system implementing organization-defined fail-safe procedures.','SI-17','N/A','Determine if [SI-17_ODP[01]; fail-safe procedures associated with failure conditions are defined] are implemented when [SI-17_ODP[02]; a list of failure conditions requiring fail-safe procedures is defined] occur.'),\n('002775','draft','2013-07-11','DISA FSO','technical','Implement organization-defined fail-safe procedures when organization-defined failure conditions occur.','SI-17','N/A','Determine if [SI-17_ODP[01]; fail-safe procedures associated with failure conditions are defined] are implemented when [SI-17_ODP[02]; a list of failure conditions requiring fail-safe procedures is defined] occur.'),\n('002776','draft','2013-07-12','DISA FSO','policy','Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level incident response policy is disseminated.','IR-01a.','N/A','Determine if: - an incident response policy is developed and documented. - the incident response policy is disseminated to [IR-01_ODP[01]; personnel or roles to whom the incident response policy is to be disseminated is/are defined].'),\n('002777','draft','2013-07-12','DISA FSO','policy','Defines the personnel or roles to whom the incident response procedures are disseminated.','IR-01a.02','N/A','Determine if: - incident response procedures to facilitate the implementation of the incident response policy and associated incident response controls are developed and documented. - the incident response procedures are disseminated to [IR-01_ODP[02]; personnel or roles to whom the incident response procedures are to be disseminated is/are defined].'),\n('002778','draft','2013-07-12','DISA FSO','policy','Defines the time period in which system users who assume an incident response role or responsibility receive incident response training.','IR-02a.01','N/A','Determine if incident response training is provided to system users consistent with assigned roles and responsibilities within [IR-02_ODP[01]; a time period within which incident response training is to be provided to system users assuming an incident response role or responsibility is defined] of assuming an incident response role or responsibility or acquiring system access.'),\n('002779','draft','2013-07-12','DISA FSO','policy','Provide incident response training to system users consistent with assigned roles and responsibilities when required by system changes.','IR-02a.02','N/A','Determine if incident response training is provided to system users consistent with assigned roles and responsibilities when required by system changes.'),\n('002780','draft','2013-07-12','DISA FSO','policy','Coordinate incident response testing with organizational elements responsible for related plans.','IR-03(02)','N/A','Determine if incident response testing is coordinated with organizational elements responsible for related plans.'),\n('002781','draft','2013-07-12','DISA FSO','policy','Defines the system components for dynamic reconfiguration as part of the incident response capability.','IR-04(02)','N/A','Determine if [IR-04(02)_ODP[01]; types of dynamic reconfiguration for system components are defined] for [IR-04(02)_ODP[02]; system components that require dynamic reconfiguration are defined] are included as part of the incident response capability.'),\n('002782','draft','2013-07-12','DISA FSO','policy','Implement an incident handling capability for incidents involving insider threats.','IR-04(06)','N/A','Determine if an incident handling capability is implemented for incidents involving insider threats.'),\n('002785','draft','2013-07-12','DISA FSO','policy','Coordinate with organization-defined external organizations to correlate and share organization-defined incident information to achieve a cross-organization perspective on incident awareness and more effective incident responses.','IR-04(08)','N/A','Determine if there is coordination with [IR-04(08)_ODP[01]; external organizations with whom organizational incident information is to be coordinated and shared are defined] to correlate and share [IR-04(08)_ODP[02]; incident information to be correlated and shared with organization-defined external organizations are defined] to achieve a cross-organization perspective on incident awareness and more effective incident responses.'),\n('002786','draft','2013-07-12','DISA FSO','policy','Defines external organizations with which to correlate and share organization-defined incident information.','IR-04(08)','N/A','Determine if there is coordination with [IR-04(08)_ODP[01]; external organizations with whom organizational incident information is to be coordinated and shared are defined] to correlate and share [IR-04(08)_ODP[02]; incident information to be correlated and shared with organization-defined external organizations are defined] to achieve a cross-organization perspective on incident awareness and more effective incident responses.'),\n('002787','draft','2013-07-12','DISA FSO','policy','Defines incident information to correlate and share with organization-defined external organizations.','IR-04(08)','N/A','Determine if there is coordination with [IR-04(08)_ODP[01]; external organizations with whom organizational incident information is to be coordinated and shared are defined] to correlate and share [IR-04(08)_ODP[02]; incident information to be correlated and shared with organization-defined external organizations are defined] to achieve a cross-organization perspective on incident awareness and more effective incident responses.'),\n('002788','draft','2013-07-12','DISA FSO','policy','Employ organization-defined dynamic response capabilities to effectively respond to incidents.','IR-04(09)','N/A','Determine if [IR-04(09)_ODP; dynamic response capabilities to be employed to respond to incidents are defined] are employed to respond to incidents.'),\n('002789','draft','2013-07-12','DISA FSO','policy','Defines dynamic response capabilities to effectively respond to incidents.','IR-04(09)','N/A','Determine if [IR-04(09)_ODP; dynamic response capabilities to be employed to respond to incidents are defined] are employed to respond to incidents.'),\n('002790','draft','2013-07-12','DISA FSO','policy','Coordinate incident handling activities involving supply chain events with other organizations involved in the supply chain.','IR-04(10)','N/A','Determine if incident handling activities involving supply chain events are coordinated with other organizations involved in the supply chain.'),\n('002791','draft','2013-07-12','DISA FSO','policy','Defines authorities to whom incident information is reported.','IR-06b.','N/A','Determine if incident information is reported to [IR-06_ODP[02]; authorities to whom incident information is to be reported are defined].'),\n('002792','draft','2013-07-12','DISA FSO','policy','Defines personnel or roles to whom system vulnerabilities associated with reported incident information are reported.','IR-06(02)','N/A','Determine if system vulnerabilities associated with reported incidents are reported to [IR-06(02)_ODP; personnel or roles to whom system vulnerabilities associated with reported incidents are reported to is/are defined].'),\n('002793','draft','2013-07-12','DISA FSO','policy','Provide incident information to other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.','IR-06(03)','N/A','Determine if incident information is provided to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.'),\n('002794','draft','2013-07-12','DISA FSO','policy','Develop an incident response plan.',NULL,'N/A',NULL),\n('002795','draft','2013-07-12','DISA FSO','policy','Develop an incident response plan that provides the organization with a roadmap for implementing its incident response capability.','IR-08a.01','N/A','Determine if an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability.'),\n('002796','draft','2013-07-12','DISA FSO','policy','Develop an incident response plan that describes the structure and organization of the incident response capability.','IR-08a.02','N/A','Determine if an incident response plan is developed that describes the structure and organization of the incident response capability.'),\n('002797','draft','2013-07-12','DISA FSO','policy','Develop an incident response plan that provides a high-level approach for how the incident response capability fits into the overall organization.','IR-08a.03','N/A','Determine if an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization.'),\n('002798','draft','2013-07-12','DISA FSO','policy','Develop an incident response plan that meets the unique requirements of the organization, which relate to mission, size, structure, and functions.','IR-08a.04','N/A','Determine if an incident response plan is developed that meets the unique requirements of the organization with regard to mission, size, structure, and functions.'),\n('002799','draft','2013-07-12','DISA FSO','policy','Develop an incident response plan that defines reportable incidents.','IR-08a.05','N/A','Determine if an incident response plan is developed that defines reportable incidents.'),\n('002800','draft','2013-07-12','DISA FSO','policy','Develop an incident response plan that provides metrics for measuring the incident response capability within the organization.','IR-08a.06','N/A','Determine if an incident response plan is developed that provides metrics for measuring the incident response capability within the organization.'),\n('002801','draft','2013-07-12','DISA FSO','policy','Develop an incident response plan that defines the resources and management support needed to effectively maintain and mature an incident response capability.','IR-08a.07','N/A','Determine if an incident response plan is developed that defines the resources and management support needed to effectively maintain and mature an incident response capability.'),\n('002802','draft','2013-07-12','DISA FSO','policy','Defines personnel or roles to review and approve the incident response plan.','IR-08a.09','N/A','Determine if an incident response plan is developed that is reviewed and approved by [IR-08_ODP[01]; personnel or roles that review and approve the incident response plan is/are identified] [IR-08_ODP[02]; the frequency at which to review and approve the incident response plan is defined].'),\n('002803','draft','2013-07-12','DISA FSO','policy','Defines incident response personnel (identified by name and/or by role) and organizational elements to whom incident response plan changes will be communicated.','IR-08d.','N/A','Determine if: - incident response plan changes are communicated to [IR-08_ODP[06]; incident response personnel (identified by name and/or by role) to whom changes to the incident response plan is/are communicated are defined]. - incident response plan changes are communicated to [IR-08_ODP[07]; organizational elements to which changes to the incident response plan are communicated are defined].'),\n('002804','draft','2013-07-12','DISA FSO','policy','Protect the incident response plan from unauthorized disclosure and modification.','IR-08e.','N/A','Determine if: - the incident response plan is protected from unauthorized disclosure. - the incident response plan is protected from unauthorized modification.'),\n('002805','draft','2013-07-12','DISA FSO','policy','Respond to information spills by identifying the specific information involved in the system contamination.','IR-09b.','N/A','Determine if the specific information involved in the system contamination is identified in response to information spills.'),\n('002806','draft','2013-07-12','DISA FSO','policy','Respond to information spills by alerting organization-defined personnel or roles of the information spill using a method of communication not associated with the spill.','IR-09c.','N/A','Determine if [IR-09_ODP[02]; personnel or roles to be alerted of the information spill using a method of communication not associated with the spill is/are defined] is/are alerted of the information spill using a method of communication not associated with the spill.'),\n('002807','draft','2013-07-12','DISA FSO','policy','Defines the personnel or roles to be alerted of information spills using a method of communication not associated with the spill.','IR-09c.','N/A','Determine if [IR-09_ODP[02]; personnel or roles to be alerted of the information spill using a method of communication not associated with the spill is/are defined] is/are alerted of the information spill using a method of communication not associated with the spill.'),\n('002808','draft','2013-07-12','DISA FSO','policy','Respond to information spills by isolating the contaminated system or system component.','IR-09c.','N/A','Determine if [IR-09_ODP[02]; personnel or roles to be alerted of the information spill using a method of communication not associated with the spill is/are defined] is/are alerted of the information spill using a method of communication not associated with the spill.'),\n('002809','draft','2013-07-12','DISA FSO','policy','Respond to information spills by eradicating the information from the contaminated system or component.','IR-09e.','N/A','Determine if the information is eradicated from the contaminated system or component in response to information spills.'),\n('002810','draft','2013-07-12','DISA FSO','policy','Respond to information spills by identifying other systems or system components that may have been subsequently contaminated.','IR-09f.','N/A','Determine if other systems or system components that may have been subsequently contaminated are identified in response to information spills.'),\n('002811','draft','2013-07-12','DISA FSO','policy','Respond to information spills by performing additional organization-defined actions.','IR-09g.','N/A','Determine if [IR-09_ODP[03]; actions to be performed are defined] are performed in response to information spills.'),\n('002812','draft','2013-07-12','DISA FSO','policy','Defines additional actions required to respond to information spills.','IR-09g.','N/A','Determine if [IR-09_ODP[03]; actions to be performed are defined] are performed in response to information spills.'),\n('002816','draft','2013-07-12','DISA FSO','policy','Provide information spillage response training according to an organization-defined frequency.','IR-09(02)','N/A','Determine if information spillage response training is provided [IR-09(02)_ODP; frequency at which to provide information spillage response training is defined].'),\n('002817','draft','2013-07-12','DISA FSO','policy','Defines the frequency with which to provide information spillage response training.','IR-09(02)','N/A','Determine if information spillage response training is provided [IR-09(02)_ODP; frequency at which to provide information spillage response training is defined].'),\n('002818','draft','2013-07-12','DISA FSO','policy','Implement organization-defined procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.','IR-09(03)','N/A','Determine if [IR-09(03)_ODP; procedures to be implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions are defined] are implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.'),\n('002819','draft','2013-07-12','DISA FSO','policy','Defines the procedures to be implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.','IR-09(03)','N/A','Determine if [IR-09(03)_ODP; procedures to be implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions are defined] are implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.'),\n('002820','draft','2013-07-12','DISA FSO','policy','Employ organization-defined controls for personnel exposed to information not within assigned access authorizations.','IR-09(04)','N/A','Determine if [IR-09(04)_ODP; controls employed for personnel exposed to information not within assigned access authorizations are defined] are employed for personnel exposed to information not within assigned access authorizations.'),\n('002821','draft','2013-07-12','DISA FSO','policy','Defines the controls to be employed for personnel exposed to information not within assigned access authorizations.','IR-09(04)','N/A','Determine if [IR-09(04)_ODP; controls employed for personnel exposed to information not within assigned access authorizations are defined] are employed for personnel exposed to information not within assigned access authorizations.'),\n('002823','draft','2013-07-12','DISA FSO','policy','Defines the controls to be implemented to protect the system memory from unauthorized code execution.','SI-16','N/A','Determine if [SI-16_ODP; controls to be implemented to protect the system memory from unauthorized code execution are defined] are implemented to protect the system memory from unauthorized code execution.'),\n('002824','draft','2013-07-12','DISA FSO','technical','Implement organization-defined controls to protect the system memory from unauthorized code execution.','SI-16','N/A','Determine if [SI-16_ODP; controls to be implemented to protect the system memory from unauthorized code execution are defined] are implemented to protect the system memory from unauthorized code execution.'),\n('002825','draft','2013-07-20','DISA FSO','policy','Defines the personnel or roles to whom the organizational-level; mission/business process-level; and/or system-level contingency planning policy is to be disseminated.','CP-01a.','N/A','Determine if: - a contingency planning policy is developed and documented. - the contingency planning policy is disseminated to [CP-01_ODP[01]; personnel or roles to whom the contingency planning policy is to be disseminated is/are defined].'),\n('002826','draft','2013-07-20','DISA FSO','policy','Defines personnel or roles to whom the contingency planning procedures are disseminated.','CP-01a.02','N/A','Determine if: - contingency planning procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls are developed and documented. - the contingency planning procedures are disseminated to [CP-01_ODP[02]; personnel or roles to whom the contingency planning procedures are to be disseminated is/are defined].'),\n('002827','draft','2013-07-20','DISA FSO','policy','Coordinate the contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.','CP-02(07)','N/A','Determine if the contingency plan is coordinated with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.'),\n('002828','draft','2013-07-20','DISA FSO','policy','Identify critical system assets supporting all or essential mission functions.','CP-02(08)','N/A','Determine if critical system assets supporting [CP-02(08)_ODP; one of the following PARAMETER VALUES is selected: {all; essential}] mission and business functions are identified.'),\n('002829','draft','2013-07-20','DISA FSO','policy','Identify critical system assets supporting all or essential business functions.','CP-02(08)','N/A','Determine if critical system assets supporting [CP-02(08)_ODP; one of the following PARAMETER VALUES is selected: {all; essential}] mission and business functions are identified.'),\n('002830','draft','2013-07-20','DISA FSO','policy','Defines the personnel or roles who review and approve the contingency plan for the system.','CP-02a.07','N/A','Determine if: - a contingency plan for the system is developed that is reviewed by [CP-02_ODP[01]; personnel or roles to review a contingency plan is/are defined]. - a contingency plan for the system is developed that is approved by [CP-02_ODP[02]; personnel or roles to approve a contingency plan is/are defined].'),\n('002831','draft','2013-07-20','DISA FSO','policy','Defines a list of key contingency personnel (identified by name and/or by role) and organizational elements to whom contingency plan changes are to be communicated.','CP-02f.','N/A','Determine if: - contingency plan changes are communicated to [CP-02_ODP[06]; key contingency personnel (identified by name and/or by role) to communicate changes to are defined]. - contingency plan changes are communicated to [CP-02_ODP[07]; key contingency organizational elements to communicate changes to are defined].'),\n('002832','draft','2013-07-20','DISA FSO','policy','Protects the contingency plan from unauthorized disclosure and modification.','CP-02h.','N/A','Determine if: - the contingency plan is protected from unauthorized disclosure. - the contingency plan is protected from unauthorized modification.'),\n('002833','draft','2013-07-20','DISA FSO','policy','Defines the time period that contingency training is to be provided to system users consistent with assigned roles and responsibilities within assuming a contingency role or responsibility.','CP-03a.01','N/A','Determine if contingency training is provided to system users consistent with assigned roles and responsibilities within [CP-03_ODP[01]; the time period within which to provide contingency training after assuming a contingency role or responsibility is defined] of assuming a contingency role or responsibility.'),\n('002834','draft','2013-07-20','DISA FSO','policy','Provide contingency training to system users consistent with assigned roles and responsibilities when required by system changes.','CP-03a.02','N/A','Determine if contingency training is provided to system users consistent with assigned roles and responsibilities when required by system changes.'),\n('002835','draft','2013-07-20','DISA FSO','policy','Test the contingency plan at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations.','CP-04(02)(b)','N/A','Determine if the contingency plan is tested at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations.'),\n('002836','draft','2013-07-20','DISA FSO','policy','Ensure that the alternate storage site provides security controls equivalent to that of the primary site.','CP-06b.','N/A','Determine if the alternate storage site provides controls equivalent to that of the primary site.'),\n('002837','draft','2013-07-20','DISA FSO','policy','Plan for circumstances that preclude returning to the primary processing site.','CP-07(06)','N/A','Determine if: - circumstances that preclude returning to the primary processing site are planned for. - circumstances that preclude returning to the primary processing site are prepared for.'),\n('002838','draft','2013-07-20','DISA FSO','policy','Prepare for circumstances that preclude returning to the primary processing site.','CP-07(06)','N/A','Determine if: - circumstances that preclude returning to the primary processing site are planned for. - circumstances that preclude returning to the primary processing site are prepared for.'),\n('002839','draft','2013-07-20','DISA FSO','policy','Defines system operations that are permitted to transfer and resume at an alternate processing site for essential missions/business functions when the primary processing capabilities are unavailable.','CP-07a.','N/A','Determine if an alternate processing site, including necessary agreements to permit the transfer and resumption of [CP-07_ODP[01]; system operations for essential mission and business functions are defined] for essential mission and business functions, is established within [CP-07_ODP[02]; time period consistent with recovery time and recovery point objectives is defined] when the primary processing capabilities are unavailable.'),\n('002840','draft','2013-07-20','DISA FSO','policy','Defines the system operations to be resumed for essential mission functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.','CP-08','N/A','Determine if alternate telecommunications services, including necessary agreements to permit the resumption of [CP-08_ODP[01]; system operations to be resumed for essential mission and business functions are defined], are established for essential mission and business functions within [CP-08_ODP[02]; time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable is defined] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.'),\n('002841','draft','2013-07-20','DISA FSO','policy','Defines the system operations to be resumed for essential business functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.','CP-08','N/A','Determine if alternate telecommunications services, including necessary agreements to permit the resumption of [CP-08_ODP[01]; system operations to be resumed for essential mission and business functions are defined], are established for essential mission and business functions within [CP-08_ODP[02]; time period within which to resume essential mission and business functions when the primary telecommunications capabilities are unavailable is defined] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.'),\n('002842','draft','2013-07-20','DISA FSO','policy','Review provider contingency plans to ensure that the plans meet organizational contingency requirements.','CP-08(04)(b)','N/A','Determine if provider contingency plans are reviewed to ensure that the plans meet organizational contingency requirements.'),\n('002843','draft','2013-07-20','DISA FSO','policy','Defines the frequency with which to obtain evidence of contingency testing by providers.','CP-08(04)(c)','N/A','Determine if: - evidence of contingency testing by providers is obtained [CP-08(04)_ODP[01]; frequency at which to obtain evidence of contingency testing by providers is defined]. - evidence of contingency training by providers is obtained [CP-08(04)_ODP[02]; frequency at which to obtain evidence of contingency training by providers is defined].'),\n('002844','draft','2013-07-20','DISA FSO','policy','Defines the frequency with which to obtain evidence of contingency training by providers.','CP-08(04)(c)','N/A','Determine if: - evidence of contingency testing by providers is obtained [CP-08(04)_ODP[01]; frequency at which to obtain evidence of contingency testing by providers is defined]. - evidence of contingency training by providers is obtained [CP-08(04)_ODP[02]; frequency at which to obtain evidence of contingency training by providers is defined].'),\n('002845','draft','2013-07-20','DISA FSO','policy','Obtain evidence of contingency testing by providers in accordance with organization-defined frequency.','CP-08(04)(c)','N/A','Determine if: - evidence of contingency testing by providers is obtained [CP-08(04)_ODP[01]; frequency at which to obtain evidence of contingency testing by providers is defined]. - evidence of contingency training by providers is obtained [CP-08(04)_ODP[02]; frequency at which to obtain evidence of contingency training by providers is defined].'),\n('002846','draft','2013-07-20','DISA FSO','policy','Obtain evidence of contingency training by providers in accordance with organization-defined frequency.','CP-08(04)(c)','N/A','Determine if: - evidence of contingency testing by providers is obtained [CP-08(04)_ODP[01]; frequency at which to obtain evidence of contingency testing by providers is defined]. - evidence of contingency training by providers is obtained [CP-08(04)_ODP[02]; frequency at which to obtain evidence of contingency training by providers is defined].'),\n('002847','draft','2013-07-20','DISA FSO','policy','Defines the frequency with which to test alternate telecommunication services.','CP-08(05)','N/A','Determine if alternate telecommunications services are tested [CP-08(05)_ODP; frequency at which alternate telecommunications services are tested is defined].'),\n('002848','draft','2013-07-20','DISA FSO','policy','Test alternate telecommunication services per organization-defined frequency.','CP-08(05)','N/A','Determine if alternate telecommunications services are tested [CP-08(05)_ODP; frequency at which alternate telecommunications services are tested is defined].'),\n('002849','draft','2013-07-20','DISA FSO','policy','Defines critical system software and other security-related information, of which backup copies must be stored in a separate facility or in a fire-rated container.','CP-09(03)','N/A','Determine if backup copies of [CP-09(03)_ODP; critical system software and other security-related information backups to be stored in a separate facility are defined] are stored in a separate facility or in a fire rated container that is not collocated with the operational system.'),\n('002850','draft','2013-07-20','DISA FSO','policy','Store backup copies of organization-defined critical system software and other security-related information in a separate facility or in a fire-rated container that is not collocated with the operational system.','CP-09(03)','N/A','Determine if backup copies of [CP-09(03)_ODP; critical system software and other security-related information backups to be stored in a separate facility are defined] are stored in a separate facility or in a fire rated container that is not collocated with the operational system.'),\n('002851','draft','2013-07-20','DISA FSO','policy','Defines the backup information that requires dual authorization for deletion or destruction.','CP-09(07)','N/A','Determine if dual authorization for the deletion or destruction of [CP-09(07)_ODP; backup information for which to enforce dual authorization in order to delete or destroy is defined] is enforced.'),\n('002852','draft','2013-07-20','DISA FSO','policy','Enforce dual authorization for the deletion or destruction of organization-defined backup information.','CP-09(07)','N/A','Determine if dual authorization for the deletion or destruction of [CP-09(07)_ODP; backup information for which to enforce dual authorization in order to delete or destroy is defined] is enforced.'),\n('002853','draft','2013-07-20','DISA FSO','technical','Provide the capability to employ organization-defined alternative communications protocols in support of maintaining continuity of operations.','CP-11','N/A','Determine if the capability to employ [CP-11_ODP; alternative communications protocols in support of maintaining continuity of operations are defined] are provided in support of maintaining continuity of operations.'),\n('002854','draft','2013-07-20','DISA FSO','policy','Defines the alternative communications protocols the system must be capable of providing in support of maintaining continuity of operations.','CP-11','N/A','Determine if the capability to employ [CP-11_ODP; alternative communications protocols in support of maintaining continuity of operations are defined] are provided in support of maintaining continuity of operations.'),\n('002855','draft','2013-07-20','DISA FSO','technical','When organization-defined conditions are detected, enters a safe mode of operation with organization-defined restrictions of safe mode of operation.','CP-12','N/A','Determine if a safe mode of operation is entered with [CP-12_ODP[01]; restrictions for safe mode of operation are defined] when [CP-12_ODP[02]; conditions detected to enter a safe mode of operation are defined] are detected.'),\n('002856','draft','2013-07-20','DISA FSO','policy','Defines the conditions that, when detected, the system enters a safe mode of operation with organization-defined restrictions of safe mode of operation.','CP-12','N/A','Determine if a safe mode of operation is entered with [CP-12_ODP[01]; restrictions for safe mode of operation are defined] when [CP-12_ODP[02]; conditions detected to enter a safe mode of operation are defined] are detected.'),\n('002857','draft','2013-07-20','DISA FSO','policy','Defines the restrictions of the safe mode of operation that the system will enter when organization-defined conditions are detected.','CP-12','N/A','Determine if a safe mode of operation is entered with [CP-12_ODP[01]; restrictions for safe mode of operation are defined] when [CP-12_ODP[02]; conditions detected to enter a safe mode of operation are defined] are detected.'),\n('002858','draft','2013-07-20','DISA FSO','policy','Employ organization-defined alternative or supplemental security mechanisms for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised.','CP-13','N/A','Determine if [CP-13_ODP[01]; alternative or supplemental security mechanisms are defined] are employed for satisfying [CP-13_ODP[02]; security functions are defined] when the primary means of implementing the security function is unavailable or compromised.'),\n('002859','draft','2013-07-20','DISA FSO','policy','Defines the alternative or supplemental security mechanisms that will be employed for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised.','CP-13','N/A','Determine if [CP-13_ODP[01]; alternative or supplemental security mechanisms are defined] are employed for satisfying [CP-13_ODP[02]; security functions are defined] when the primary means of implementing the security function is unavailable or compromised.'),\n('002860','draft','2013-07-20','DISA FSO','policy','Defines the security functions that must be satisfied when the primary means of implementing the security function is unavailable or compromised.','CP-13','N/A','Determine if [CP-13_ODP[01]; alternative or supplemental security mechanisms are defined] are employed for satisfying [CP-13_ODP[02]; security functions are defined] when the primary means of implementing the security function is unavailable or compromised.'),\n('002861','draft','2013-07-22','DISA FSO','policy','Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level maintenance policy is disseminated.','MA-01a.','N/A','Determine if: - a maintenance policy is developed and documented. - the maintenance policy is disseminated to [MA-01_ODP[01]; personnel or roles to whom the maintenance policy is to be disseminated is/are defined].'),\n('002862','draft','2013-07-22','DISA FSO','policy','Defines the personnel or roles to whom system maintenance procedures are to be disseminated.','MA-01a.02','N/A','Determine if: - maintenance procedures to facilitate the implementation of the maintenance policy and associated maintenance controls are developed and documented. - Determine if the maintenance procedures are disseminated to [MA-01_ODP[02]; personnel or roles to whom the maintenance procedures are to be disseminated is/are defined].'),\n('002864','draft','2013-07-22','DISA FSO','policy','Produce up-to date, accurate, and complete records of all maintenance requested, scheduled, in process, and completed.','MA-02(02)(b)','N/A','Determine if: - up-to date, accurate, and complete records of all maintenance actions requested, scheduled, in process, and completed are produced. - up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed are produced. - up-to date, accurate, and complete records of all replacement actions requested, scheduled, in process, and completed are produced.'),\n('002865','draft','2013-07-22','DISA FSO','policy','Produce up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed.','MA-02(02)(b)','N/A','Determine if: - up-to date, accurate, and complete records of all maintenance actions requested, scheduled, in process, and completed are produced. - up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed are produced. - up-to date, accurate, and complete records of all replacement actions requested, scheduled, in process, and completed are produced.'),\n('002866','draft','2013-07-22','DISA FSO','policy','Schedule maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-02a.','N/A','Determine if: - maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements. - maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements. - records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('002868','draft','2013-07-22','DISA FSO','policy','Document records of maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-02a.','N/A','Determine if: - maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements. - maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements. - records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('002869','draft','2013-07-22','DISA FSO','policy','Review records of maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-02a.','N/A','Determine if: - maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements. - maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements. - records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('002870','draft','2013-07-22','DISA FSO','policy','Schedule repair on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-02a.','N/A','Determine if: - maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements. - maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements. - records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('002872','draft','2013-07-22','DISA FSO','policy','Document repair on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-02a.','N/A','Determine if: - maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements. - maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements. - records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('002873','draft','2013-07-22','DISA FSO','policy','Review records of repairs on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-02a.','N/A','Determine if: - maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements. - maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements. - records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('002874','draft','2013-07-22','DISA FSO','policy','Defines the personnel or roles who can explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repairs or replacement.','MA-02c.','N/A','Determine if [MA-02_ODP[01]; personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs is/are defined] is/are required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement.'),\n('002875','draft','2013-07-22','DISA FSO','policy','Include organization-defined information in organizational maintenance records.','MA-02f.','N/A','Determine if [MA-02_ODP[03]; information to be included in organizational maintenance records is defined] is included in organizational maintenance records.'),\n('002876','draft','2013-07-22','DISA FSO','policy','Defines the information to include in organizational maintenance records.','MA-02f.','N/A','Determine if [MA-02_ODP[03]; information to be included in organizational maintenance records is defined] is included in organizational maintenance records.'),\n('002882','draft','2013-07-22','DISA FSO','policy','Defines the personnel or roles who can provide an exemption that explicitly authorizes removal of equipment from the facility.','MA-03(03)(d)','N/A','Determine if the removal of maintenance equipment containing organizational information is prevented by obtaining an exemption from [MA-03(03)_ODP; personnel or roles who can authorize removal of equipment from the facility is/are defined] explicitly authorizing removal of the equipment from the facility.'),\n('002883','draft','2013-07-22','DISA FSO','technical','Restrict the use of maintenance tools to authorized personnel only.','MA-03(04)','N/A','Determine if the use of maintenance tools is restricted to authorized personnel only.'),\n('002884','draft','2013-07-22','DISA FSO','technical','Log organization-defined audit events for nonlocal maintenance and diagnostic sessions.','MA-04(01)(a)','N/A','Determine if: - [MA-04(01)_ODP[01]; audit events to be logged for nonlocal maintenance are defined] are logged for nonlocal maintenance sessions. - [MA-04(01)_ODP[02]; audit events to be logged for diagnostic sessions are defined] are logged for nonlocal diagnostic sessions.'),\n('002885','draft','2013-07-22','DISA FSO','policy','Defines the audit events for logged for nonlocal maintenance and diagnostic sessions.','MA-04(01)(a)','N/A','Determine if: - [MA-04(01)_ODP[01]; audit events to be logged for nonlocal maintenance are defined] are logged for nonlocal maintenance sessions. - [MA-04(01)_ODP[02]; audit events to be logged for diagnostic sessions are defined] are logged for nonlocal diagnostic sessions.'),\n('002886','draft','2013-07-22','DISA FSO','policy','Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior.','MA-04(01)(b)','N/A','Determine if: - the audit records of the maintenance sessions are reviewed to detect anomalous behavior. - the audit records of the diagnostic sessions are reviewed to detect anomalous behavior.'),\n('002887','draft','2013-07-22','DISA FSO','policy','Defines the authenticators that are replay resistant which will be employed to protect nonlocal maintenance sessions.','MA-04(04)(a)','N/A','Determine if nonlocal maintenance sessions are protected by employing [MA-04(04)_ODP; authenticators that are replay resistant are defined].'),\n('002888','draft','2013-07-22','DISA FSO','policy','Defines the personnel or roles authorized to approve each nonlocal maintenance session.','MA-04(05)(a)','N/A','Determine if the approval of each nonlocal maintenance session is required by [MA-04(05)_ODP[01]; personnel or roles required to approve each nonlocal maintenance session is/are defined].'),\n('002889','draft','2013-07-22','DISA FSO','policy','Notify organization-defined personnel or roles of the date and time of planned nonlocal maintenance.','MA-04(05)(b)','N/A','Determine if [MA-04(05)_ODP[02]; personnel and roles to be notified of the date and time of planned nonlocal maintenance is/are defined] is/are notified of the date and time of planned nonlocal maintenance.'),\n('002890','draft','2013-07-22','DISA FSO','technical','Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.','MA-04(06)','N/A','Determine if: - [MA-04(06)_ODP; cryptographic mechanisms to be implemented to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications are defined] are implemented to protect the integrity of nonlocal maintenance and diagnostic communications. - [MA-04(06)_ODP; cryptographic mechanisms to be implemented to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications are defined] are implemented to protect the confidentiality of nonlocal maintenance and diagnostic communications.'),\n('002891','draft','2013-07-22','DISA FSO','technical','Verify session and network connection termination after the completion of nonlocal maintenance and diagnostic sessions.','MA-04(07)','N/A','Determine if: - session connection termination is verified after the completion of nonlocal maintenance and diagnostic sessions. - network connection termination is verified after the completion of nonlocal maintenance and diagnostic sessions.'),\n('002893','draft','2013-07-22','DISA FSO','policy','Ensure that non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system, have required access authorization.','MA-05(05)','N/A','Determine if non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system have required access authorizations.'),\n('002894','draft','2013-07-22','DISA FSO','policy','Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations.','MA-05b.','N/A','Determine if non-escorted personnel performing maintenance on the system possess the required access authorizations.'),\n('002895','draft','2013-07-22','DISA FSO','policy','Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.','MA-05c.','N/A','Determine if organizational personnel with required access authorizations and technical competence is/are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.'),\n('002896','draft','2013-07-22','DISA FSO','policy','Defines the system components for which it obtains maintenance support and/or spare parts.','MA-06','N/A','Determine if maintenance support and/or spare parts are obtained for [MA-06_ODP[01]; system components for which maintenance support and/or spare parts are obtained are defined] within [MA-06_ODP[02]; time period within which maintenance support and/or spare parts are to be obtained after a failure are defined] of failure.'),\n('002897','draft','2013-07-22','DISA FSO','policy','Defines a time period for obtaining maintenance support and/or spare parts for organization-defined system components after a failure.','MA-06','N/A','Determine if maintenance support and/or spare parts are obtained for [MA-06_ODP[01]; system components for which maintenance support and/or spare parts are obtained are defined] within [MA-06_ODP[02]; time period within which maintenance support and/or spare parts are to be obtained after a failure are defined] of failure.'),\n('002898','draft','2013-07-22','DISA FSO','policy','Perform preventive maintenance on organization-defined information system components at organization-defined time intervals.','MA-06(01)','N/A','Determine if preventive maintenance is performed on [MA-06(01)_ODP[01]; system components on which preventive maintenance is to be performed are defined] at [MA-06(01)_ODP[02]; time intervals within which preventive maintenance is to be performed on system components are defined].'),\n('002899','draft','2013-07-22','DISA FSO','policy','Defines system components on which to perform preventive maintenance.','MA-06(01)','N/A','Determine if preventive maintenance is performed on [MA-06(01)_ODP[01]; system components on which preventive maintenance is to be performed are defined] at [MA-06(01)_ODP[02]; time intervals within which preventive maintenance is to be performed on system components are defined].'),\n('002900','draft','2013-07-22','DISA FSO','policy','Defines time intervals at which to perform preventive maintenance on organization-defined system components.','MA-06(01)','N/A','Determine if preventive maintenance is performed on [MA-06(01)_ODP[01]; system components on which preventive maintenance is to be performed are defined] at [MA-06(01)_ODP[02]; time intervals within which preventive maintenance is to be performed on system components are defined].'),\n('002901','draft','2013-07-22','DISA FSO','policy','Perform predictive maintenance on organization-defined system components at organization-defined intervals.','MA-06(02)','N/A','Determine if predictive maintenance is performed on [MA-06(02)_ODP[01]; system components on which predictive maintenance is to be performed are defined] at [MA-06(02)_ODP[02]; time intervals within which predictive maintenance is to be performed are defined].'),\n('002902','draft','2013-07-22','DISA FSO','policy','Defines system components on which to perform predictive maintenance.','MA-06(02)','N/A','Determine if predictive maintenance is performed on [MA-06(02)_ODP[01]; system components on which predictive maintenance is to be performed are defined] at [MA-06(02)_ODP[02]; time intervals within which predictive maintenance is to be performed are defined].'),\n('002903','draft','2013-07-22','DISA FSO','policy','Defines time intervals at which to perform predictive maintenance on organization-defined system components.','MA-06(02)','N/A','Determine if predictive maintenance is performed on [MA-06(02)_ODP[01]; system components on which predictive maintenance is to be performed are defined] at [MA-06(02)_ODP[02]; time intervals within which predictive maintenance is to be performed are defined].'),\n('002904','draft','2013-07-22','DISA FSO','policy','Transfer predictive maintenance data to a maintenance management system using organization-defined automated mechanisms.','MA-06(03)','N/A','Determine if predictive maintenance data is transferred to a maintenance management system using [MA-06(03)_ODP; automated mechanisms used to transfer predictive maintenance data to a maintenance management system are defined].'),\n('002906','draft','2013-08-13','DISA FSO','policy','Defines the vulnerability scanning activities in which the system implements privileged access authorization to organization-identified system components.','RA-05(05)','N/A','Determine if privileged access authorization is implemented to [RA-05(05)_ODP[01]; system components to which privileged access is authorized for selected vulnerability scanning activities are defined] for [RA-05(05)_ODP[02]; vulnerability scanning activities selected for privileged access authorization to system components are defined].'),\n('002907','draft','2013-08-22','DISA FSO','policy','Defines the system mode to be invoked, such as a full system shutdown, a partial system shutdown, or a degraded operational mode with limited mission or business functionality available, in the event of organization-defined audit logging failures.','AU-05(04)','N/A','Determine if [AU-05(04)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {full system shutdown; partial system shutdown; degraded operational mode with limited mission or business functionality available}] is/are invoked in the event of [AU-05(04)_ODP[02]; audit logging failures that trigger a change in operational mode are defined], unless an alternate audit logging capability exists.'),\n('002908','draft','2013-08-27','DISA FSO','policy','Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy is disseminated.','PE-01a.','N/A','Determine if: - a physical and environmental protection policy is developed and documented. - the physical and environmental protection policy is disseminated to [PE-01_ODP[01]; personnel or roles to whom the physical and environmental protection policy is to be disseminated is/are defined].'),\n('002909','draft','2013-08-27','DISA FSO','policy','Defines the personnel or roles to whom the physical and environmental protection procedures are disseminated.','PE-01a.02','N/A','Determine if: - physical and environmental protection procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls are developed and documented. - the physical and environmental protection procedures are disseminated to [PE-01_ODP[02]; personnel or roles to whom the physical and environmental protection procedures are to be disseminated is/are defined].'),\n('002910','draft','2013-08-27','DISA FSO','policy','Approve a list of individuals with authorized access to the facility where the system resides.','PE-02a.','N/A','Determine if: - a list of individuals with authorized access to the facility where the system resides has been developed. - the list of individuals with authorized access to the facility where the system resides has been approved. - the list of individuals with authorized access to the facility where the system resides has been maintained.'),\n('002911','draft','2013-08-27','DISA FSO','policy','Maintain a list of individuals with authorized access to the facility where the system resides.','PE-02a.','N/A','Determine if: - a list of individuals with authorized access to the facility where the system resides has been developed. - the list of individuals with authorized access to the facility where the system resides has been approved. - the list of individuals with authorized access to the facility where the system resides has been maintained.'),\n('002912','draft','2013-08-27','DISA FSO','policy','Defines a list of acceptable forms of identification for visitor access to the facility where the system resides.','PE-02(02)','N/A','Determine if two forms of identification are required from [PE-02(02)_ODP; a list of acceptable forms of identification for visitor access to the facility where the system resides is defined] for visitor access to the facility where the system resides.'),\n('002913','draft','2013-08-27','DISA FSO','policy','Restrict unescorted access to the facility where the system resides to personnel with one or more of the following: security clearances for all information contained within the system; formal access authorizations for all information contained within the system; need for access to all information contained within the system; organization-defined physical access authorizations.','PE-02(03)','N/A','Determine if unescorted access to the facility where the system resides is restricted to personnel with [PE-02(03)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {security clearances for all information contained within the system; formal access authorizations for all information contained within the system; need for access to all information contained within the system; [PE-02(03)_ODP[02]; physical access authorizations for unescorted access to the facility where the system resides are defined (if selected)]}].'),\n('002914','draft','2013-08-27','DISA FSO','policy','Defines the credentials required for personnel to have unescorted access to the facility where the system resides.','PE-02(03)','N/A','Determine if unescorted access to the facility where the system resides is restricted to personnel with [PE-02(03)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {security clearances for all information contained within the system; formal access authorizations for all information contained within the system; need for access to all information contained within the system; [PE-02(03)_ODP[02]; physical access authorizations for unescorted access to the facility where the system resides are defined (if selected)]}].'),\n('002915','draft','2013-08-27','DISA FSO','policy','Defines the entry and exit points to the facility where the system resides.',NULL,'N/A',NULL),\n('002916','draft','2013-08-27','DISA FSO','policy','Defines the physical access control systems or devices or guards that control ingress and egress to the facility where the system resides.','PE-03a.02','N/A','Determine if physical access authorizations are enforced at [PE-03_ODP[01]; entry and exit points to the facility in which the system resides are defined] by controlling ingress and egress to the facility using [PE-03_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[PE-03_ODP[03]; physical access control systems or devices used to control ingress and egress to the facility are defined (if selected)]; guards}].'),\n('002917','draft','2013-08-27','DISA FSO','policy','Maintain physical access audit logs for organization-defined entry/exit points to the facility where the system resides.','PE-03b.','N/A','Determine if physical access audit logs are maintained for [PE-03_ODP[04]; entry or exit points for which physical access logs are maintained are defined].'),\n('002918','draft','2013-08-27','DISA FSO','policy','Defines entry and exit points to the facility where the system resides that require physical access audit logs be maintained.','PE-03b.','N/A','Determine if physical access audit logs are maintained for [PE-03_ODP[04]; entry or exit points for which physical access logs are maintained are defined].'),\n('002919','draft','2013-08-27','DISA FSO','policy','Control access to areas within the facility designated as publicly accessible by implementing organization-defined access controls.','PE-03c.','N/A','Determine if access to areas within the facility designated as publicly accessible are maintained by implementing [PE-03_ODP[05]; physical access controls to control access to areas within the facility designated as publicly accessible are defined].'),\n('002920','draft','2013-08-27','DISA FSO','policy','Defines physical access controls to control access to areas within the facility designated as publicly accessible.','PE-03c.','N/A','Determine if access to areas within the facility designated as publicly accessible are maintained by implementing [PE-03_ODP[05]; physical access controls to control access to areas within the facility designated as publicly accessible are defined].'),\n('002921','draft','2013-08-27','DISA FSO','policy','Escort visitors in the facility where the system resides during organization-defined circumstances requiring visitor escorts.','PE-03d.','N/A','Determine if: - visitors are escorted. - visitor activity is controlled [PE-03_ODP[06]; circumstances requiring visitor escorts and control of visitor activity are defined].'),\n('002922','draft','2013-08-27','DISA FSO','policy','Defines circumstances requiring visitor escorts in the facility where the system resides.','PE-03d.','N/A','Determine if: - visitors are escorted. - visitor activity is controlled [PE-03_ODP[06]; circumstances requiring visitor escorts and control of visitor activity are defined].'),\n('002923','draft','2013-08-27','DISA FSO','policy','Monitor visitor activity in the facility where the system resides during organization-defined circumstances requiring visitor monitoring.','PE-03d.','N/A','Determine if: - visitors are escorted. - visitor activity is controlled [PE-03_ODP[06]; circumstances requiring visitor escorts and control of visitor activity are defined].'),\n('002924','draft','2013-08-27','DISA FSO','policy','Define circumstances requiring visitor monitoring in the facility where the system resides.','PE-03d.','N/A','Determine if: - visitors are escorted. - visitor activity is controlled [PE-03_ODP[06]; circumstances requiring visitor escorts and control of visitor activity are defined].'),\n('002925','draft','2013-08-27','DISA FSO','policy','Defines the physical access devices to inventory.','PE-03f.','N/A','Determine if [PE-03_ODP[07]; physical access devices to be inventoried are defined] are inventoried [PE-03_ODP[08]; frequency at which to inventory physical access devices is defined].'),\n('002926','draft','2013-08-27','DISA FSO','policy','Defines the physical spaces containing one or more components of the system that require physical access authorizations and controls at the facility where the system resides.','PE-03(01)','N/A','Determine if: - physical access authorizations to the system are enforced. - physical access controls are enforced for the facility at [PE-03(01)_ODP; physical spaces containing one or more components of the system are defined].'),\n('002927','draft','2013-08-27','DISA FSO','policy','Defines the frequency with which to perform security checks at the physical boundary of the facility or system for exfiltration of information or removal of system components.','PE-03(02)','N/A','Determine if security checks are performed [PE-03(02)_ODP; the frequency at which to perform security checks at the physical perimeter of the facility or system for exfiltration of information or removal of system components is defined] at the physical perimeter of the facility or system for exfiltration of information or removal of system components.'),\n('002928','draft','2013-08-27','DISA FSO','policy','Defines anti-tamper technologies to detect and prevent physical tampering or alteration of organization-defined hardware components within the system.','PE-03(05)','N/A','Determine if [PE-03(05)_ODP[01]; anti-tamper technologies to be employed are defined] are employed to [PE-03(05)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {detect; prevent}] physical tampering or alteration of [PE-03(05)_ODP[03]; hardware components to be protected from physical tampering or alteration are defined] within the system.'),\n('002929','draft','2013-08-27','DISA FSO','policy','Defines hardware components within the system for which to employ organization-defined security safeguards to detect and prevent physical tampering or alteration.','PE-03(05)','N/A','Determine if [PE-03(05)_ODP[01]; anti-tamper technologies to be employed are defined] are employed to [PE-03(05)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {detect; prevent}] physical tampering or alteration of [PE-03(05)_ODP[03]; hardware components to be protected from physical tampering or alteration are defined] within the system.'),\n('002930','draft','2013-08-27','DISA FSO','policy','Defines system distribution and transmission lines within organizational facilities to control physical access to using organization-defined security controls.','PE-04','N/A','Determine if physical access to [PE-04_ODP[01]; system distribution and transmission lines requiring physical access controls are defined] within organizational facilities is controlled using [PE-04_ODP[02]; security controls to be implemented to control physical access to system distribution and transmission lines within the organizational facility are defined].'),\n('002931','draft','2013-08-27','DISA FSO','policy','Defines security controls to control physical access to organization-defined system distribution and transmission lines within organizational facilities.','PE-04','N/A','Determine if physical access to [PE-04_ODP[01]; system distribution and transmission lines requiring physical access controls are defined] within organizational facilities is controlled using [PE-04_ODP[02]; security controls to be implemented to control physical access to system distribution and transmission lines within the organizational facility are defined].'),\n('002939','draft','2013-08-27','DISA FSO','policy','Monitor physical access to the facility where the system resides to detect and respond to physical security incidents.','PE-06a.','N/A','Determine if physical access to the facility where the system resides is monitored to detect and respond to physical security incidents.'),\n('002940','draft','2013-08-27','DISA FSO','policy','Review physical access logs upon occurrence of organization-defined events or potential indications of events.','PE-06b.','N/A','Determine if: - physical access logs are reviewed [PE-06_ODP[01]; the frequency at which to review physical access logs is defined]. - physical access logs are reviewed upon occurrence of [PE-06_ODP[02]; events or potential indication of events requiring physical access logs to be reviewed are defined].'),\n('002941','draft','2013-08-27','DISA FSO','policy','Defines events or potential indications of events requiring review of physical access logs.','PE-06b.','N/A','Determine if: - physical access logs are reviewed [PE-06_ODP[01]; the frequency at which to review physical access logs is defined]. - physical access logs are reviewed upon occurrence of [PE-06_ODP[02]; events or potential indication of events requiring physical access logs to be reviewed are defined].'),\n('002942','draft','2013-08-27','DISA FSO','policy','Recognize organization-defined classes or types of intrusions, using organization-defined automated mechanisms.','PE-06(02)','N/A','Determine if: - [PE-06(02)_ODP[01]; classes or types of intrusions to be recognized by automated mechanisms are defined] are recognized. - [PE-06(02)_ODP[02]; response actions to be initiated by automated mechanisms when organization-defined classes or types of intrusions are recognized are defined] are initiated using [PE-06(02)_ODP[03]; automated mechanisms used to recognize classes or types of intrusions and initiate response actions (defined in PE-06(02)_ODP) are defined].'),\n('002943','draft','2013-08-27','DISA FSO','policy','Defines the classes or types of intrusions to recognize using automated mechanisms.','PE-06(02)','N/A','Determine if: - [PE-06(02)_ODP[01]; classes or types of intrusions to be recognized by automated mechanisms are defined] are recognized. - [PE-06(02)_ODP[02]; response actions to be initiated by automated mechanisms when organization-defined classes or types of intrusions are recognized are defined] are initiated using [PE-06(02)_ODP[03]; automated mechanisms used to recognize classes or types of intrusions and initiate response actions (defined in PE-06(02)_ODP) are defined].'),\n('002944','draft','2013-08-27','DISA FSO','policy','Initiate organization-defined response actions to organization-defined classes or types of intrusions, using organization-defined automated mechanisms.','PE-06(02)','N/A','Determine if: - [PE-06(02)_ODP[01]; classes or types of intrusions to be recognized by automated mechanisms are defined] are recognized. - [PE-06(02)_ODP[02]; response actions to be initiated by automated mechanisms when organization-defined classes or types of intrusions are recognized are defined] are initiated using [PE-06(02)_ODP[03]; automated mechanisms used to recognize classes or types of intrusions and initiate response actions (defined in PE-06(02)_ODP) are defined].'),\n('002945','draft','2013-08-27','DISA FSO','policy','Defines the response actions to initiate when organization-defined classes or types of intrusions are recognized.','PE-06(02)','N/A','Determine if: - [PE-06(02)_ODP[01]; classes or types of intrusions to be recognized by automated mechanisms are defined] are recognized. - [PE-06(02)_ODP[02]; response actions to be initiated by automated mechanisms when organization-defined classes or types of intrusions are recognized are defined] are initiated using [PE-06(02)_ODP[03]; automated mechanisms used to recognize classes or types of intrusions and initiate response actions (defined in PE-06(02)_ODP) are defined].'),\n('002946','draft','2013-08-27','DISA FSO','policy','Employ video surveillance of organization-defined operational areas.','PE-06(03)(a)','N/A','Determine if video surveillance of [PE-06(03)_ODP[01]; operational areas where video surveillance is to be employed are defined] is employed.'),\n('002947','draft','2013-08-27','DISA FSO','policy','Defines the operational areas in which to employ video surveillance.','PE-06(03)(a)','N/A','Determine if video surveillance of [PE-06(03)_ODP[01]; operational areas where video surveillance is to be employed are defined] is employed.'),\n('002948','draft','2013-08-27','DISA FSO','policy','Retain video surveillance recordings for an organization-defined time period.','PE-06(03)(c)','N/A','Determine if video recordings are retained for [PE-06(03)_ODP[03]; time period for which to retain video recordings is defined].'),\n('002949','draft','2013-08-27','DISA FSO','policy','Defines the time period to retain video surveillance recordings.','PE-06(03)(c)','N/A','Determine if video recordings are retained for [PE-06(03)_ODP[03]; time period for which to retain video recordings is defined].'),\n('002950','draft','2013-08-27','DISA FSO','policy','Monitor physical access to the system in addition to the physical access monitoring of the facility as organization-defined physical spaces containing one or more components of the system.','PE-06(04)','N/A','Determine if physical access to the system is monitored in addition to the physical access monitoring of the facility at [PE-06(04)_ODP; physical spaces containing one or more components of the system are defined].'),\n('002951','draft','2013-08-27','DISA FSO','policy','Defines physical spaces containing one or more components of the system in which physical access is monitored.','PE-06(04)','N/A','Determine if physical access to the system is monitored in addition to the physical access monitoring of the facility at [PE-06(04)_ODP; physical spaces containing one or more components of the system are defined].'),\n('002952','draft','2013-08-27','DISA FSO','policy','Defines the time period to maintain visitor access records to the facility where the system resides.','PE-08a.','N/A','Determine if visitor access records for the facility where the system resides are maintained for [PE-08_ODP[01]; time period for which to maintain visitor access records for the facility where the system resides is defined].'),\n('002953','draft','2013-08-27','DISA FSO','policy','Employ redundant power cabling paths that are physically separated by an organization-defined distance.','PE-09(01)','N/A','Determine if redundant power cabling paths that are physically separated by [PE-09(01)_ODP; distance by which redundant power cabling paths are to be physically separated is defined] are employed.'),\n('002954','draft','2013-08-27','DISA FSO','policy','Defines the distance by which to physically separate redundant power cabling paths.','PE-09(01)','N/A','Determine if redundant power cabling paths that are physically separated by [PE-09(01)_ODP; distance by which redundant power cabling paths are to be physically separated is defined] are employed.'),\n('002955','draft','2013-08-29','DISA FSO','policy','Provide an uninterruptible power supply to facilitate an orderly shutdown of the system, and/or transition of the system to long-term alternate power in the event of a primary power source loss.','PE-11','N/A','Determine if an uninterruptible power supply is provided to facilitate [PE-11_ODP; one of the following PARAMETER VALUES is selected: {an orderly shutdown of the system; transition of the system to long-term alternate power}] in the event of a primary power source loss.'),\n('002956','draft','2013-08-29','DISA FSO','policy','Provide an alternate power supply for the system that is activated manually or automatically and that is self-contained.','PE-11(02)(a)','N/A','Determine if the alternate power supply provided for the system is self-contained.'),\n('002957','draft','2013-08-29','DISA FSO','policy','Provide an alternate power supply for the system that is activated manually or automatically and that is not reliant on external power generation.','PE-11(02)(b)','N/A','Determine if the alternate power supply provided for the system is not reliant on external power generation.'),\n('002958','draft','2013-08-29','DISA FSO','policy','Provide an alternate power supply for the system that is activated manually or automatically and that is capable of maintaining minimally required operational capability or full operational capability in the event of an extended loss of the primary power source.','PE-11(02)(c)','N/A','Determine if the alternate power supply provided for the system is capable of maintaining [PE-11(02)_ODP[02]; one of the following PARAMETER VALUES is selected: {minimally required operational capability; full operational capability}] in the event of an extended loss of the primary power source.'),\n('002959','draft','2013-08-29','DISA FSO','policy','Provide emergency lighting for all areas within the facility supporting essential mission functions.','PE-12(01)','N/A','Determine if emergency lighting is provided for all areas within the facility supporting essential mission and business functions.'),\n('002960','draft','2013-08-29','DISA FSO','policy','Provide emergency lighting for all areas within the facility supporting essential business functions.','PE-12(01)','N/A','Determine if emergency lighting is provided for all areas within the facility supporting essential mission and business functions.'),\n('002961','draft','2013-08-29','DISA FSO','policy','Employ fire detection systems for the system that activate automatically.','PE-13(01)','N/A','Determine if: - fire detection systems that activate automatically are employed in the event of a fire. - fire detection systems that notify [PE-13(01)_ODP[01]; personnel or roles to be notified in the event of a fire is/are defined] automatically are employed in the event of a fire. - fire detection systems that notify [PE-13(01)_ODP[02]; emergency responders to be notified in the event of a fire are defined] automatically are employed in the event of a fire.'),\n('002962','draft','2013-08-29','DISA FSO','policy','Employ fire detection systems for the system that automatically activate to notify organization-defined personnel or roles and organization-defined emergency responders in the event of a fire.','PE-13(01)','N/A','Determine if: - fire detection systems that activate automatically are employed in the event of a fire. - fire detection systems that notify [PE-13(01)_ODP[01]; personnel or roles to be notified in the event of a fire is/are defined] automatically are employed in the event of a fire. - fire detection systems that notify [PE-13(01)_ODP[02]; emergency responders to be notified in the event of a fire are defined] automatically are employed in the event of a fire.'),\n('002963','draft','2013-08-29','DISA FSO','policy','Defines the personnel or roles to be notified in the event of a fire.','PE-13(01)','N/A','Determine if: - fire detection systems that activate automatically are employed in the event of a fire. - fire detection systems that notify [PE-13(01)_ODP[01]; personnel or roles to be notified in the event of a fire is/are defined] automatically are employed in the event of a fire. - fire detection systems that notify [PE-13(01)_ODP[02]; emergency responders to be notified in the event of a fire are defined] automatically are employed in the event of a fire.'),\n('002964','draft','2013-08-29','DISA FSO','policy','Defines the emergency responders to be notified in the event of a fire.','PE-13(01)','N/A','Determine if: - fire detection systems that activate automatically are employed in the event of a fire. - fire detection systems that notify [PE-13(01)_ODP[01]; personnel or roles to be notified in the event of a fire is/are defined] automatically are employed in the event of a fire. - fire detection systems that notify [PE-13(01)_ODP[02]; emergency responders to be notified in the event of a fire are defined] automatically are employed in the event of a fire.'),\n('002965','draft','2013-08-29','DISA FSO','policy','Employ fire suppression systems that activate automatically and notify organization-defined personnel or roles and organization-defined emergency responders.','PE-13(02)(a)','N/A','Determine if: - fire suppression systems that activate automatically are employed. - fire suppression systems that notify [PE-13(02)_ODP[01]; personnel or roles to be notified in the event of a fire is/are defined] automatically are employed. - fire suppression systems that notify [PE-13(02)_ODP[02]; emergency responders to be notified in the event of a fire are defined] automatically are employed.'),\n('002966','draft','2013-08-29','DISA FSO','policy','Defines the personnel or roles to be automatically notified of any activation of fire suppression systems.','PE-13(02)(a)','N/A','Determine if: - fire suppression systems that activate automatically are employed. - fire suppression systems that notify [PE-13(02)_ODP[01]; personnel or roles to be notified in the event of a fire is/are defined] automatically are employed. - fire suppression systems that notify [PE-13(02)_ODP[02]; emergency responders to be notified in the event of a fire are defined] automatically are employed.'),\n('002967','draft','2013-08-29','DISA FSO','policy','Defines the emergency responders to be automatically notified of any activation of fire suppression systems.','PE-13(02)(a)','N/A','Determine if: - fire suppression systems that activate automatically are employed. - fire suppression systems that notify [PE-13(02)_ODP[01]; personnel or roles to be notified in the event of a fire is/are defined] automatically are employed. - fire suppression systems that notify [PE-13(02)_ODP[02]; emergency responders to be notified in the event of a fire are defined] automatically are employed.'),\n('002968','draft','2013-08-29','DISA FSO','policy','Ensure that the facility undergoes, on an organization-defined frequency, fire protection inspections by authorized and qualified inspectors.','PE-13(04)','N/A','Determine if: - the facility undergoes fire protection inspections [PE-13(04)_ODP[01]; the frequency for conducting fire protection inspections on the facility is defined] by authorized and qualified inspectors. - the identified deficiencies from fire protection inspections are resolved within [PE-13(04)_ODP[02]; a time period for resolving deficiencies identified by fire protection inspections is defined].'),\n('002969','draft','2013-08-29','DISA FSO','policy','Defines a frequency with which the facility undergoes fire protection inspections.','PE-13(04)','N/A','Determine if: - the facility undergoes fire protection inspections [PE-13(04)_ODP[01]; the frequency for conducting fire protection inspections on the facility is defined] by authorized and qualified inspectors. - the identified deficiencies from fire protection inspections are resolved within [PE-13(04)_ODP[02]; a time period for resolving deficiencies identified by fire protection inspections is defined].'),\n('002970','draft','2013-08-29','DISA FSO','policy','Ensure the identified deficiencies are resolved within an organization-defined time period.','PE-13(04)','N/A','Determine if: - the facility undergoes fire protection inspections [PE-13(04)_ODP[01]; the frequency for conducting fire protection inspections on the facility is defined] by authorized and qualified inspectors. - the identified deficiencies from fire protection inspections are resolved within [PE-13(04)_ODP[02]; a time period for resolving deficiencies identified by fire protection inspections is defined].'),\n('002971','draft','2013-08-29','DISA FSO','policy','Defines the time period within which to resolve deficiencies identified during facility fire protection inspections.','PE-13(04)','N/A','Determine if: - the facility undergoes fire protection inspections [PE-13(04)_ODP[01]; the frequency for conducting fire protection inspections on the facility is defined] by authorized and qualified inspectors. - the identified deficiencies from fire protection inspections are resolved within [PE-13(04)_ODP[02]; a time period for resolving deficiencies identified by fire protection inspections is defined].'),\n('002973','draft','2013-08-29','DISA FSO','policy','Defines the personnel or roles to be alerted when automated mechanisms detect the presence of water near the system.','PE-15(01)','N/A','Determine if: - the presence of water near the system can be detected automatically. - [PE-15(01)_ODP[01]; personnel or roles to be alerted when the presence of water is detected near the system is/are defined] is/are alerted using [PE-15(01)_ODP[02]; automated mechanisms used to detect the presence of water near the system are defined].'),\n('002974','draft','2013-08-29','DISA FSO','policy','Defines types of system components to authorize and control entering and exiting the facility and to maintain records.','PE-16a.','N/A','Determine if: - [PE-16_ODP[01]; types of system components to be authorized and controlled when entering the facility are defined] are authorized when entering the facility. - [PE-16_ODP[01]; types of system components to be authorized and controlled when entering the facility are defined] are controlled when entering the facility. - [PE-16_ODP[02]; types of system components to be authorized and controlled when exiting the facility are defined] are authorized when exiting the facility. - [PE-16_ODP[02]; types of system components to be authorized and controlled when exiting the facility are defined] are controlled when exiting the facility.'),\n('002975','draft','2013-08-29','DISA FSO','policy','Defines controls to employ at alternate work sites.','PE-17b.','N/A','Determine if [PE-17_ODP[02]; controls to be employed at alternate work sites are defined] are employed at alternate work sites.'),\n('002976','draft','2013-08-29','DISA FSO','policy','Defines physical and environmental hazards that could cause potential damage to system components within the facility.','PE-18','N/A','Determine if system components are positioned within the facility to minimize potential damage from [PE-18_ODP; physical and environmental hazards that could result in potential damage to system components within the facility are defined] and to minimize the opportunity for unauthorized access.'),\n('002979','draft','2013-08-29','DISA FSO','policy','Employ organization-defined asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.','PE-20','N/A','Determine if [PE-20_ODP[01]; asset location technologies to be employed to track and monitor the location and movement of assets is defined] are employed to track and monitor the location and movement of [PE-20_ODP[02]; assets whose location and movement are to be tracked and monitored are defined] within [PE-20_ODP[03]; controlled areas within which asset location and movement are to be tracked and monitored are defined].'),\n('002980','draft','2013-08-29','DISA FSO','policy','Defines asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.','PE-20','N/A','Determine if [PE-20_ODP[01]; asset location technologies to be employed to track and monitor the location and movement of assets is defined] are employed to track and monitor the location and movement of [PE-20_ODP[02]; assets whose location and movement are to be tracked and monitored are defined] within [PE-20_ODP[03]; controlled areas within which asset location and movement are to be tracked and monitored are defined].'),\n('002981','draft','2013-08-29','DISA FSO','policy','Defines the assets within the organization-defined controlled areas which are to be tracked and monitored for their location and movement.','PE-20','N/A','Determine if [PE-20_ODP[01]; asset location technologies to be employed to track and monitor the location and movement of assets is defined] are employed to track and monitor the location and movement of [PE-20_ODP[02]; assets whose location and movement are to be tracked and monitored are defined] within [PE-20_ODP[03]; controlled areas within which asset location and movement are to be tracked and monitored are defined].'),\n('002982','draft','2013-08-29','DISA FSO','policy','Defines controlled areas where the location and movement of organization-defined assets are tracked and monitored.','PE-20','N/A','Determine if [PE-20_ODP[01]; asset location technologies to be employed to track and monitor the location and movement of assets is defined] are employed to track and monitor the location and movement of [PE-20_ODP[02]; assets whose location and movement are to be tracked and monitored are defined] within [PE-20_ODP[03]; controlled areas within which asset location and movement are to be tracked and monitored are defined].'),\n('002984','draft','2013-08-29','DISA FSO','policy','Develop an organization-wide information security program plan that reflects the coordination among organizational entities responsible for information security.','PM-01a.03','N/A','Determine if the information security program plan reflects the coordination among the organizational entities responsible for information security.'),\n('002985','draft','2013-08-29','DISA FSO','policy','Disseminate an organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements.','PM-01a.','N/A','Determine if: - an organization-wide information security program plan is developed. - the information security program plan is disseminated.'),\n('002986','draft','2013-08-29','DISA FSO','policy','Disseminate an organization-wide information security program plan that includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','PM-01a.02','N/A','Determine if: - the information security program plan includes the identification and assignment of roles. - the information security program plan includes the identification and assignment of responsibilities. - the information security program plan addresses management commitment. - the information security program plan addresses coordination among organizational entities. - the information security program plan addresses compliance.'),\n('002987','draft','2013-08-29','DISA FSO','policy','Disseminate an organization-wide information security plan that reflects the coordination among organizational entities responsible for information security.','PM-01a.','N/A','Determine if: - an organization-wide information security program plan is developed. - the information security program plan is disseminated.'),\n('002988','draft','2013-08-29','DISA FSO','policy','Disseminate an organization-wide information security program plan that is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.','PM-01a.','N/A','Determine if: - an organization-wide information security program plan is developed. - the information security program plan is disseminated.'),\n('002989','draft','2013-08-29','DISA FSO','policy','Protect the information security program plan from unauthorized disclosure.','PM-01c.','N/A','Determine if: - the information security program plan is protected from unauthorized disclosure. - the information security program plan is protected from unauthorized modification.'),\n('002990','draft','2013-08-29','DISA FSO','policy','Protect the information security program plan from unauthorized modification.','PM-01c.','N/A','Determine if: - the information security program plan is protected from unauthorized disclosure. - the information security program plan is protected from unauthorized modification.'),\n('002991','draft','2013-08-29','DISA FSO','policy','Implement a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed.','PM-04a.01','N/A','Determine if: - a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained.'),\n('002993','draft','2013-08-29','DISA FSO','policy','Review plans of action and milestones for the security program and associated organization systems for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.','PM-04b.','N/A','Determine if: - plans of action and milestones are reviewed for consistency with the organizational risk management strategy. - plans of action and milestones are reviewed for consistency with organization-wide priorities for risk response actions.'),\n('002994','draft','2013-08-29','DISA FSO','policy','Review and update the risk management strategy in accordance with organization-defined frequency or as required, to address organizational changes.','PM-09c.','N/A','Determine if the risk management strategy is reviewed and updated [PM-09_ODP; the frequency at which to review and update the risk management strategy is defined] or as required to address organizational changes.'),\n('002995','draft','2013-08-29','DISA FSO','policy','Defines the frequency with which to review and update the risk management strategy to address organizational changes.','PM-09c.','N/A','Determine if the risk management strategy is reviewed and updated [PM-09_ODP; the frequency at which to review and update the risk management strategy is defined] or as required to address organizational changes.'),\n('002996','draft','2013-08-29','DISA FSO','policy','Implement an insider threat program that includes a cross-discipline insider threat incident handling team.','PM-12','N/A','Determine if an insider threat program that includes a cross-discipline insider threat incident handling team is implemented.'),\n('002997','draft','2013-08-29','DISA FSO','policy','Establish a security workforce development and improvement program.','PM-13','N/A','Determine if: - a security workforce development and improvement program is established. - privacy workforce development and improvement program is established.'),\n('002998','draft','2013-08-29','DISA FSO','policy','Implement a process for ensuring that organizational plans for conducting security testing activities associated with organizational systems are developed.','PM-14a.01','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained.'),\n('002999','draft','2013-08-29','DISA FSO','policy','Implement a process for ensuring that organizational plans for conducting security testing activities associated with organizational systems are maintained.','PM-14a.01','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained.'),\n('003000','draft','2013-08-29','DISA FSO','policy','Implement a process for ensuring that organizational plans for conducting security training activities associated with organizational systems are developed.','PM-14a.01','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained.'),\n('003001','draft','2013-08-29','DISA FSO','policy','Implement a process for ensuring that organizational plans for conducting security training activities associated with organizational systems are maintained.','PM-14a.01','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained.'),\n('003002','draft','2013-08-29','DISA FSO','policy','Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational systems are developed.','PM-14a.01','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained.'),\n('003003','draft','2013-08-29','DISA FSO','policy','Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational systems are maintained.','PM-14a.01','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained.'),\n('003004','draft','2013-08-29','DISA FSO','policy','Implement a process for ensuring that organizational plans for conducting security testing associated with organizational systems continue to be executed.','PM-14a.02','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems continue to be executed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems continue to be executed.'),\n('003005','draft','2013-08-29','DISA FSO','policy','Implement a process for ensuring that organizational plans for conducting security training associated with organizational systems continue to be executed.','PM-14a.02','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems continue to be executed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems continue to be executed.'),\n('003006','draft','2013-08-29','DISA FSO','policy','Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational systems continue to be executed.','PM-14a.02','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems continue to be executed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems continue to be executed.'),\n('003007','draft','2013-08-29','DISA FSO','policy','Review testing plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.','PM-14b.','N/A','Determine if: - testing plans are reviewed for consistency with the organizational risk management strategy. - training plans are reviewed for consistency with the organizational risk management strategy. - monitoring plans are reviewed for consistency with the organizational risk management strategy. - testing plans are reviewed for consistency with organization-wide priorities for risk response actions. - training plans are reviewed for consistency with organization-wide priorities for risk response actions. - monitoring plans are reviewed for consistency with organization-wide priorities for risk response actions.'),\n('003008','draft','2013-08-29','DISA FSO','policy','Review training plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.','PM-14b.','N/A','Determine if: - testing plans are reviewed for consistency with the organizational risk management strategy. - training plans are reviewed for consistency with the organizational risk management strategy. - monitoring plans are reviewed for consistency with the organizational risk management strategy. - testing plans are reviewed for consistency with organization-wide priorities for risk response actions. - training plans are reviewed for consistency with organization-wide priorities for risk response actions. - monitoring plans are reviewed for consistency with organization-wide priorities for risk response actions.'),\n('003009','draft','2013-08-29','DISA FSO','policy','Review monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.','PM-14b.','N/A','Determine if: - testing plans are reviewed for consistency with the organizational risk management strategy. - training plans are reviewed for consistency with the organizational risk management strategy. - monitoring plans are reviewed for consistency with the organizational risk management strategy. - testing plans are reviewed for consistency with organization-wide priorities for risk response actions. - training plans are reviewed for consistency with organization-wide priorities for risk response actions. - monitoring plans are reviewed for consistency with organization-wide priorities for risk response actions.'),\n('003010','draft','2013-08-29','DISA FSO','policy','Establish and institutionalize contact with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel.','PM-15a.','N/A','Determine if: - contact is established and institutionalized with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel. - contact is established and institutionalized with selected groups and associations within the privacy community to facilitate ongoing privacy education and training for organizational personnel.'),\n('003011','draft','2013-08-29','DISA FSO','policy','Establish and institutionalize contact with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies.','PM-15b.','N/A','Determine if: - contact is established and institutionalized with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies. - contact is established and institutionalized with selected groups and associations within the privacy community to maintain currency with recommended privacy practices, techniques, and technologies.'),\n('003012','draft','2013-08-29','DISA FSO','policy','Establish and institutionalize contact with selected groups and associations within the security community to share current security information including threats, vulnerabilities, and incidents.','PM-15c.','N/A','Determine if: - contact is established and institutionalized with selected groups and associations within the security community to share current security information, including threats, vulnerabilities, and incidents. - contact is established and institutionalized with selected groups and associations within the privacy community to share current privacy information, including threats, vulnerabilities, and incidents.'),\n('003013','draft','2013-08-29','DISA FSO','policy','Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.','PM-16','N/A','Determine if a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence is implemented.'),\n('003014','draft','2013-08-30','DISA FSO','technical','Enforce organization-defined mandatory access control policies over all subjects and objects.','AC-03(03)','N/A','Determine if: - [AC-03(03)_ODP[01]; mandatory access control policy enforced over the set of covered subjects is defined] is enforced over the set of covered subjects specified in the policy. - [AC-03(03)_ODP[02]; mandatory access control policy enforced over the set of covered objects is defined] is enforced over the set of covered objects specified in the policy.'),\n('003015','draft','2013-08-30','DISA FSO','policy','Specifies that organization-defined subjects may explicitly be granted organization-defined privileges such that they are not limited by any defined subset (or all) of the above constraints.',NULL,'N/A',NULL),\n('003017','draft','2013-09-12','DISA FSO','policy','Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level personnel security policy is disseminated.','PS-01a.','N/A','Determine if: - a personnel security policy is developed and documented. - the personnel security policy is disseminated to [PS-01_ODP[01]; personnel or roles to whom the personnel security policy is to be disseminated is/are defined].'),\n('003018','draft','2013-09-12','DISA FSO','policy','Defines the personnel or roles to whom the personnel security procedures are disseminated.','PS-01a.02','N/A','Determine if: - Determine if personnel security procedures to facilitate the implementation of the personnel security policy and associated personnel security controls are developed and documented. - the personnel security procedures are disseminated to [PS-01_ODP[02]; personnel or roles to whom the personnel security procedures are to be disseminated is/are defined].'),\n('003019','draft','2013-09-12','DISA FSO','policy','Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties.','PS-03(03)(a)','N/A','Determine if individuals accessing a system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties.'),\n('003020','draft','2013-09-12','DISA FSO','policy','Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy organization-defined additional personnel screening criteria.','PS-03(03)(b)','N/A','Determine if individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy [PS-03(03)_ODP; additional personnel screening criteria to be satisfied for individuals accessing a system processing, storing, or transmitting information requiring special protection are defined].'),\n('003021','draft','2013-09-12','DISA FSO','policy','Defines additional personnel screening criteria that individuals accessing a system processing, storing, or transmitting information requiring protection must satisfy.','PS-03(03)(b)','N/A','Determine if individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy [PS-03(03)_ODP; additional personnel screening criteria to be satisfied for individuals accessing a system processing, storing, or transmitting information requiring special protection are defined].'),\n('003022','draft','2013-09-12','DISA FSO','policy','Defines the time period within which to disable system access upon termination of individual employment.','PS-04a.','N/A','Determine if upon termination of individual employment, system access is disabled within [PS-04_ODP[01]; a time period within which to disable system access is defined].'),\n('003023','draft','2013-09-12','DISA FSO','policy','Upon termination of individual employment, terminate or revoke any authenticators and credentials associated with the individual.','PS-04b.','N/A','Determine if upon termination of individual employment, any authenticators and credentials are terminated or revoked.'),\n('003024','draft','2013-09-12','DISA FSO','policy','Defines information security topics to be discussed while conducting exit interviews.','PS-04c.','N/A','Determine if upon termination of individual employment, exit interviews that include a discussion of [PS-04_ODP[02]; information security topics to be discussed when conducting exit interviews are defined] are conducted.'),\n('003027','draft','2013-09-12','DISA FSO','policy','Notify terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information.','PS-04(01)(a)','N/A','Determine if terminated individuals are notified of applicable, legally binding post-employment requirements for the protection of organizational information.'),\n('003028','draft','2013-09-12','DISA FSO','policy','Require terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.','PS-04(01)(b)','N/A','Determine if terminated individuals are required to sign an acknowledgement of post-employment requirements as part of the organizational termination process.'),\n('003029','draft','2013-09-12','DISA FSO','policy','Use organization-defined automated mechanisms to notify organization-defined personnel or roles of individual termination actions; and/or disable access to system resources.','PS-04(02)','N/A','Determine if [PS-04(02)_ODP[01]; automated mechanisms to notify personnel or roles of individual termination actions and/or to disable access to system resources are defined] are used to [PS-04(02)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {notify [PS-04(02)_ODP[03]; personnel or roles to be notified upon termination of an individual is/are defined (if selected)] of individual termination actions; disable access to system resources}].'),\n('003030','draft','2013-09-12','DISA FSO','policy','Defines the personnel or roles to be notified by automated mechanism of individual termination actions, and/or disable access to system resources.','PS-04(02)','N/A','Determine if [PS-04(02)_ODP[01]; automated mechanisms to notify personnel or roles of individual termination actions and/or to disable access to system resources are defined] are used to [PS-04(02)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {notify [PS-04(02)_ODP[03]; personnel or roles to be notified upon termination of an individual is/are defined (if selected)] of individual termination actions; disable access to system resources}].'),\n('003031','draft','2013-09-12','DISA FSO','policy','Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer.','PS-05c.','N/A','Determine if access authorization is modified as needed to correspond with any changes in operational need due to reassignment or transfer.'),\n('003032','draft','2013-09-12','DISA FSO','policy','Notify organization-defined personnel or roles within an organization-defined time period when individuals are transferred or reassigned to other positions within the organization.','PS-05d.','N/A','Determine if [PS-05_ODP[03]; personnel or roles to be notified when individuals are reassigned or transferred to other positions within the organization is/are defined] are notified within [PS-05_ODP[04]; time period within which to notify organization-defined personnel or roles when individuals are reassigned or transferred to other positions within the organization is defined].'),\n('003033','draft','2013-09-12','DISA FSO','policy','Defines personnel or roles to be notified when individuals are transferred or reassigned to other positions within the organization.','PS-05d.','N/A','Determine if [PS-05_ODP[03]; personnel or roles to be notified when individuals are reassigned or transferred to other positions within the organization is/are defined] are notified within [PS-05_ODP[04]; time period within which to notify organization-defined personnel or roles when individuals are reassigned or transferred to other positions within the organization is defined].'),\n('003034','draft','2013-09-12','DISA FSO','policy','Defines the time period within which organization-defined personnel or roles are to be notified when individuals are transferred or reassigned to other positions within the organization.','PS-05d.','N/A','Determine if [PS-05_ODP[03]; personnel or roles to be notified when individuals are reassigned or transferred to other positions within the organization is/are defined] are notified within [PS-05_ODP[04]; time period within which to notify organization-defined personnel or roles when individuals are reassigned or transferred to other positions within the organization is defined].'),\n('003035','draft','2013-09-12','DISA FSO','policy','Develop and document access agreements for organizational systems.','PS-06a.','N/A','Determine if access agreements are developed and documented for organizational systems.'),\n('003038','draft','2013-09-12','DISA FSO','policy','Notify individuals of applicable, legally binding post-employment requirements for protection of organizational information.','PS-06(03)(a)','N/A','Determine if individuals are notified of applicable, legally binding post-employment requirements for the protection of organizational information.'),\n('003039','draft','2013-09-12','DISA FSO','policy','Require individuals to sign an acknowledgement of legally binding post-employment requirements for protection of organizational information, if applicable, as part of granting initial access to covered information.','PS-06(03)(b)','N/A','Determine if individuals are required to sign an acknowledgement of applicable, legally binding post-employment requirements as part of being granted initial access to covered information.'),\n('003041','draft','2013-09-12','DISA FSO','policy','Require external providers to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within an organization-defined time period.','PS-07d.','N/A','Determine if external providers are required to notify [PS-07_ODP[01]; personnel or roles to be notified of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is/are defined] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges within [PS-07_ODP[02]; time period within which third-party providers are required to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is defined].'),\n('003042','draft','2013-09-12','DISA FSO','policy','Defines personnel or roles whom external providers are to notify when external personnel who possess organizational credentials and /or badges or who have system privileges are transferred or terminated.','PS-07d.','N/A','Determine if external providers are required to notify [PS-07_ODP[01]; personnel or roles to be notified of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is/are defined] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges within [PS-07_ODP[02]; time period within which third-party providers are required to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is defined].'),\n('003043','draft','2013-09-12','DISA FSO','policy','Defines the time period for external providers to notify organization-defined personnel or roles when external personnel who possess organizational credentials and/or badges, or who have system privileges are transferred or terminated.','PS-07d.','N/A','Determine if external providers are required to notify [PS-07_ODP[01]; personnel or roles to be notified of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is/are defined] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges within [PS-07_ODP[02]; time period within which third-party providers are required to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is defined].'),\n('003044','draft','2013-09-12','DISA FSO','policy','Notify organization-defined personnel or roles within an organization-defined time period when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.','PS-08b.','N/A','Determine if [PS-08_ODP[01]; personnel or roles to be notified when a formal employee sanctions process is initiated is/are defined] is/are notified within [PS-08_ODP[02]; the time period within which organization-defined personnel or roles must be notified when a formal employee sanctions process is initiated is defined] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.'),\n('003045','draft','2013-09-12','DISA FSO','policy','Defines personnel or roles who are to be notified when a formal employee sanctions process is initiated.','PS-08b.','N/A','Determine if [PS-08_ODP[01]; personnel or roles to be notified when a formal employee sanctions process is initiated is/are defined] is/are notified within [PS-08_ODP[02]; the time period within which organization-defined personnel or roles must be notified when a formal employee sanctions process is initiated is defined] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.'),\n('003046','draft','2013-09-12','DISA FSO','policy','Defines the time period within which to notify organization-defined personnel or roles when a formal employee sanctions process is initiated.','PS-08b.','N/A','Determine if [PS-08_ODP[01]; personnel or roles to be notified when a formal employee sanctions process is initiated is/are defined] is/are notified within [PS-08_ODP[02]; the time period within which organization-defined personnel or roles must be notified when a formal employee sanctions process is initiated is defined] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.'),\n('003047','draft','2013-09-23','DISA FSO','policy','Defines the personnel or roles to whom the planning policy is disseminated.','PL-01a.','N/A','Determine if: - a planning policy is developed and documented. - the planning policy is disseminated to [PL-01_ODP[01]; personnel or roles to whom the planning policy is to be disseminated is/are defined].'),\n('003048','draft','2013-09-23','DISA FSO','policy','Defines the personnel or roles to whom the planning procedures are disseminated.','PL-01a.02','N/A','Determine if: - planning procedures to facilitate the implementation of the planning policy and associated planning controls are developed and documented. - the planning procedures are disseminated to [PL-01_ODP[02]; personnel or roles to whom the planning procedures are to be disseminated is/are defined].'),\n('003049','draft','2013-09-23','DISA FSO','policy','Develop security and privacy plans for the system.',NULL,'N/A',NULL),\n('003050','draft','2013-09-23','DISA FSO','policy','Develop security and privacy plans for the system that are consistent with the organization''s enterprise architecture.','PL-02a.01','N/A','Determine if: - a security plan for the system is developed that is consistent with the organization''s enterprise architecture. - a privacy plan for the system is developed that is consistent with the organization''s enterprise architecture.'),\n('003051','draft','2013-09-23','DISA FSO','policy','Develop security and privacy plans for the system that explicitly defines the authorization boundary for the system.','PL-02a.02','N/A','Determine if: - a security plan for the system is developed that explicitly defines the constituent system components. - a privacy plan for the system is developed that explicitly defines the constituent system components.'),\n('003052','draft','2013-09-23','DISA FSO','policy','Develop security and privacy plans for the system that describes the operational context of the system in terms of missions and business processes.','PL-02a.03','N/A','Determine if: - a security plan for the system is developed that describes the operational context of the system in terms of mission and business processes. - a privacy plan for the system is developed that describes the operational context of the system in terms of mission and business processes.'),\n('003053','draft','2013-09-23','DISA FSO','policy','Develop security and privacy plans for the system that provide the security categorization of the system, including supporting rationale.','PL-02a.06','N/A','Determine if: - a security plan for the system is developed that provides the security categorization of the system, including supporting rationale. - a privacy plan for the system is developed that provides the security categorization of the system, including supporting rationale.'),\n('003054','draft','2013-09-23','DISA FSO','policy','Develop security and privacy plans for the system that describe the operational environment for the system and any dependencies on or connections to, other systems or system components.','PL-02a.09','N/A','Determine if: - a security plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components. - a privacy plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components.'),\n('003055','draft','2013-09-23','DISA FSO','policy','Develop security and privacy plans for the system that provide an overview of the security and privacy requirements for the system.','PL-02a.10','N/A','Determine if: - a security plan for the system is developed that provides an overview of the security requirements for the system. - a privacy plan for the system is developed that provides an overview of the privacy requirements for the system.'),\n('003056','draft','2013-09-23','DISA FSO','policy','Develop security and privacy plans for the system that identify any relevant control baselines or overlays, if applicable.','PL-02a.11','N/A','Determine if: - a security plan for the system is developed that identifies any relevant control baselines or overlays, if applicable. - a privacy plan for the system is developed that identifies any relevant control baselines or overlays, if applicable.'),\n('003057','draft','2013-09-23','DISA FSO','policy','Develop security and privacy plans for the system that describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions.','PL-02a.12','N/A','Determine if: - a security plan for the system is developed that describes the controls in place or planned for meeting the security requirements, including rationale for any tailoring decisions. - a privacy plan for the system is developed that describes the controls in place or planned for meeting the privacy requirements, including rationale for any tailoring decisions.'),\n('003059','draft','2013-09-23','DISA FSO','policy','Distribute copies of the plans to organization-defined personnel or roles.','PL-02b.','N/A','Determine if: - copies of the plans are distributed to [PL-02_ODP[02]; personnel or roles to receive distributed copies of the system security and privacy plans is/are assigned]. - subsequent changes to the plans are communicated to [PL-02_ODP[02]; personnel or roles to receive distributed copies of the system security and privacy plans is/are assigned].'),\n('003060','draft','2013-09-23','DISA FSO','policy','Defines the personnel or roles to whom copies of the plans are distributed.','PL-02b.','N/A','Determine if: - copies of the plans are distributed to [PL-02_ODP[02]; personnel or roles to receive distributed copies of the system security and privacy plans is/are assigned]. - subsequent changes to the plans are communicated to [PL-02_ODP[02]; personnel or roles to receive distributed copies of the system security and privacy plans is/are assigned].'),\n('003061','draft','2013-09-23','DISA FSO','policy','Communicate subsequent changes to the plans to organization-defined personnel or roles.','PL-02b.','N/A','Determine if: - copies of the plans are distributed to [PL-02_ODP[02]; personnel or roles to receive distributed copies of the system security and privacy plans is/are assigned]. - subsequent changes to the plans are communicated to [PL-02_ODP[02]; personnel or roles to receive distributed copies of the system security and privacy plans is/are assigned].'),\n('003062','draft','2013-09-23','DISA FSO','policy','Defines the personnel or roles to whom changes to the plans are communicated.','PL-02b.','N/A','Determine if: - copies of the plans are distributed to [PL-02_ODP[02]; personnel or roles to receive distributed copies of the system security and privacy plans is/are assigned]. - subsequent changes to the plans are communicated to [PL-02_ODP[02]; personnel or roles to receive distributed copies of the system security and privacy plans is/are assigned].'),\n('003063','draft','2013-09-23','DISA FSO','policy','Protect the plans from unauthorized disclosure.','PL-02e.','N/A','Determine if: - plans are protected from unauthorized disclosure. - plans are protected from unauthorized modification.'),\n('003064','draft','2013-09-23','DISA FSO','policy','Protect the plans from unauthorized modification.','PL-02e.','N/A','Determine if: - plans are protected from unauthorized disclosure. - plans are protected from unauthorized modification.'),\n('003068','draft','2013-09-23','DISA FSO','policy','Review and update the rules of behavior in accordance with organization-defined frequency.','PL-04c.','N/A','Determine if rules of behavior are reviewed and updated [PL-04_ODP[01]; frequency for reviewing and updating the rules of behavior is defined].'),\n('003069','draft','2013-09-23','DISA FSO','policy','Defines the frequency with which to review and update the rules of behavior.','PL-04c.','N/A','Determine if rules of behavior are reviewed and updated [PL-04_ODP[01]; frequency for reviewing and updating the rules of behavior is defined].'),\n('003070','draft','2013-09-23','DISA FSO','policy','Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge, on an organization-defined frequency, and/or when the rules of behavior are revised or updated.','PL-04d.','N/A','Determine if individuals who have acknowledged a previous version of the rules of behavior are required to read and reacknowledge [PL-04_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[PL-04_ODP[03]; frequency for individuals to read and re-acknowledge the rules of behavior is defined (if selected)]; when the rules are revised or updated}].'),\n('003071','draft','2013-09-23','DISA FSO','policy','Develop a security Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information security.','PL-07a.','N/A','Determine if a CONOPS for the system describing how the organization intends to operate the system from the perspective of information security and privacy is developed.'),\n('003072','draft','2013-09-23','DISA FSO','policy','Develop security architectures for the system.',NULL,'N/A',NULL),\n('003073','draft','2013-09-23','DISA FSO','policy','Develop security architectures for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information.','PL-08a.01','N/A','Determine if a security architecture for the system describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information.'),\n('003074','draft','2013-09-23','DISA FSO','policy','Develop security architectures for the system that describe how the architectures are integrated into and support the enterprise architecture.','PL-08a.03','N/A','Determine if: - a security architecture for the system describes how the architecture is integrated into and supports the enterprise architecture. - a privacy architecture for the system describes how the architecture is integrated into and supports the enterprise architecture.'),\n('003075','draft','2013-09-23','DISA FSO','policy','Develop security architectures for the system that describe any assumptions about, and dependencies on, external systems and services.','PL-08a.04','N/A','Determine if: - a security architecture for the system describes any assumptions about and dependencies on external systems and services. - a privacy architecture for the system describes any assumptions about and dependencies on external systems and services.'),\n('003076','draft','2013-09-23','DISA FSO','policy','Review and update the architectures in accordance with organization-defined frequency to reflect updates in the enterprise architecture.','PL-08b.','N/A','Determine if changes in the enterprise architecture are reviewed and updated [PL-08_ODP; frequency for review and update to reflect changes in the enterprise architecture] to reflect changes in the enterprise architecture.'),\n('003077','draft','2013-09-23','DISA FSO','policy','Defines the frequency with which to review and update the system architecture.','PL-08b.','N/A','Determine if changes in the enterprise architecture are reviewed and updated [PL-08_ODP; frequency for review and update to reflect changes in the enterprise architecture] to reflect changes in the enterprise architecture.'),\n('003078','draft','2013-09-23','DISA FSO','policy','Reflect planned security architecture changes in the security plans.','PL-08c.','N/A','Determine if: - planned architecture changes are reflected in the security plan. - planned architecture changes are reflected in the privacy plan. - planned architecture changes are reflected in the Concept of Operations (CONOPS). - planned architecture changes are reflected in criticality analysis. - planned architecture changes are reflected in organizational procedures. - planned architecture changes are reflected in procurements and acquisitions.'),\n('003079','draft','2013-09-23','DISA FSO','policy','Reflect planned security architecture changes in the security Concept of Operations (CONOPS).','PL-08c.','N/A','Determine if: - planned architecture changes are reflected in the security plan. - planned architecture changes are reflected in the privacy plan. - planned architecture changes are reflected in the Concept of Operations (CONOPS). - planned architecture changes are reflected in criticality analysis. - planned architecture changes are reflected in organizational procedures. - planned architecture changes are reflected in procurements and acquisitions.'),\n('003080','draft','2013-09-23','DISA FSO','policy','Reflect planned security architecture changes in the security organizational procurements and acquisitions.','PL-08c.','N/A','Determine if: - planned architecture changes are reflected in the security plan. - planned architecture changes are reflected in the privacy plan. - planned architecture changes are reflected in the Concept of Operations (CONOPS). - planned architecture changes are reflected in criticality analysis. - planned architecture changes are reflected in organizational procedures. - planned architecture changes are reflected in procurements and acquisitions.'),\n('003081','draft','2013-09-23','DISA FSO','policy','Design the security architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined locations.','PL-08(01)(a)','N/A','Determine if: - the security architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined]. - the privacy architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined].'),\n('003082','draft','2013-09-23','DISA FSO','policy','Design the security architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined architectural layers.','PL-08(01)(a)','N/A','Determine if: - the security architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined]. - the privacy architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined].'),\n('003083','draft','2013-09-23','DISA FSO','policy','Defines the controls to be allocated to organization-defined locations for the security architecture.','PL-08(01)(a)','N/A','Determine if: - the security architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined]. - the privacy architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined].'),\n('003084','draft','2013-09-23','DISA FSO','policy','Defines the controls to be allocated to organization-defined architectural layers.','PL-08(01)(a)','N/A','Determine if: - the security architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined]. - the privacy architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined].'),\n('003085','draft','2013-09-23','DISA FSO','policy','Defines the locations to which the system allocates organization-defined controls in the security architecture.','PL-08(01)(a)','N/A','Determine if: - the security architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined]. - the privacy architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined].'),\n('003086','draft','2013-09-23','DISA FSO','policy','Defines the architectural layers to which the system allocates organization-defined controls in the security architecture.','PL-08(01)(a)','N/A','Determine if: - the security architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined]. - the privacy architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined].'),\n('003087','draft','2013-09-23','DISA FSO','policy','Design the security architecture for the system using a defense-in-depth approach that ensures that the allocated controls operate in a coordinated and mutually reinforcing manner.','PL-08(01)(b)','N/A','Determine if: - the security architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner. - the privacy architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner.'),\n('003088','draft','2013-09-23','DISA FSO','policy','Require that organization-defined controls allocated to organization-defined locations and architectural layers be obtained from different suppliers.','PL-08(02)','N/A','Determine if [PL-08(02)_ODP[01]; controls to be allocated are defined] that are allocated to [PL-08(02)_ODP[02]; locations and architectural layers are defined] are required to be obtained from different suppliers.'),\n('003089','draft','2013-09-23','DISA FSO','policy','Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level system and services acquisition policy is disseminated.','SA-01a.','N/A','Determine if: - a system and services acquisition policy is developed and documented. - the system and services acquisition policy is disseminated to [SA-01_ODP[01]; personnel or roles to whom the system and services acquisition policy is to be disseminated is/are defined].'),\n('003090','draft','2013-09-23','DISA FSO','policy','Defines the personnel or roles to whom procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are disseminated.','SA-01a.02','N/A','Determine if: - system and services acquisition procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are developed and documented. - the system and services acquisition procedures are disseminated to [SA-01_ODP[02]; personnel or roles to whom the system and services acquisition procedures are to be disseminated is/are defined].'),\n('003091','draft','2013-09-23','DISA FSO','policy','Determine the high-level information security requirements for the system or system service in mission and business process planning.','SA-02a.','N/A','Determine if: - the high-level information security requirements for the system or system service are determined in mission and business process planning. - the high-level privacy requirements for the system or system service are determined in mission and business process planning.'),\n('003092','draft','2013-09-23','DISA FSO','policy','Defines a system development life cycle that is used to manage the system.','SA-03a.','N/A','Determine if: - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates information security considerations. - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates privacy considerations.'),\n('003093','draft','2013-09-23','DISA FSO','policy','Integrate the organizational information security risk management process into system development life cycle activities.','SA-03d.','N/A','Determine if: - organizational information security risk management processes are integrated into system development life cycle activities. - organizational privacy risk management processes are integrated into system development life cycle activities.'),\n('003094','draft','2013-09-23','DISA FSO','policy','Include the security functional requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the system, system component, or system service.','SA-04a.','N/A','Determine if: - security functional requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - privacy functional requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.'),\n('003095','draft','2013-09-23','DISA FSO','policy','Include the strength of mechanism requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04b.','N/A','Determine if strength of mechanism requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.'),\n('003096','draft','2013-09-23','DISA FSO','policy','Include the security assurance requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04c.','N/A','Determine if: - security assurance requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - privacy assurance requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.'),\n('003097','draft','2013-09-23','DISA FSO','policy','Include the security documentation requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04e.','N/A','Determine if: - security documentation requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - privacy documentation requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.'),\n('003098','draft','2013-09-23','DISA FSO','policy','Include the requirements for protecting security documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04f.','N/A','Determine if: - requirements for protecting security documentation, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - requirements for protecting privacy documentation, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.'),\n('003099','draft','2013-09-23','DISA FSO','policy','Include the description of the system development environment and environment in which the system is intended to operate, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04g.','N/A','Determine if the description of the system development environment and environment in which the system is intended to operate, requirements, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.'),\n('003100','draft','2013-09-23','DISA FSO','policy','Include the acceptance criteria, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04i.','N/A','Determine if acceptance criteria requirements and descriptions are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.'),\n('003101','draft','2013-09-23','DISA FSO','policy','Require the developer of the system, system component, or system service to provide design information for the controls that includes security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics, and/or organization-defined design information at an organization-defined level of detail.','SA-04(02)','N/A','Determine if the developer of the system, system component, or system service is required to provide design and implementation information for the controls that includes using [SA-04(02)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [SA-04(02)_ODP[02]; design and implementation information is defined (if selected)]}] at [SA-04(02)_ODP[03]; level of detail is defined].'),\n('003102','draft','2013-09-23','DISA FSO','policy','Require the developer of the system, system component, or system service to provide implementation information for the controls that includes security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics, and/or organization-defined implementation information at an organization-defined level of detail.','SA-04(02)','N/A','Determine if the developer of the system, system component, or system service is required to provide design and implementation information for the controls that includes using [SA-04(02)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [SA-04(02)_ODP[02]; design and implementation information is defined (if selected)]}] at [SA-04(02)_ODP[03]; level of detail is defined].'),\n('003103','draft','2013-09-23','DISA FSO','policy','Defines the design information that the developer of the system, system component, or system service is required to provide for the controls to be designed.','SA-04(02)','N/A','Determine if the developer of the system, system component, or system service is required to provide design and implementation information for the controls that includes using [SA-04(02)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [SA-04(02)_ODP[02]; design and implementation information is defined (if selected)]}] at [SA-04(02)_ODP[03]; level of detail is defined].'),\n('003104','draft','2013-09-23','DISA FSO','policy','Defines the implementation information that the developer of the system, system component, or system service is required to provide for the security controls to be implemented.','SA-04(02)','N/A','Determine if the developer of the system, system component, or system service is required to provide design and implementation information for the controls that includes using [SA-04(02)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [SA-04(02)_ODP[02]; design and implementation information is defined (if selected)]}] at [SA-04(02)_ODP[03]; level of detail is defined].'),\n('003105','draft','2013-09-23','DISA FSO','policy','Defines the level of detail for the design information of the controls that is required to be provided by the developer of the information system, system component, or information system services.','SA-04(02)','N/A','Determine if the developer of the system, system component, or system service is required to provide design and implementation information for the controls that includes using [SA-04(02)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [SA-04(02)_ODP[02]; design and implementation information is defined (if selected)]}] at [SA-04(02)_ODP[03]; level of detail is defined].'),\n('003106','draft','2013-09-23','DISA FSO','policy','Defines the level of detail for the implementation information of the security controls that is required to be provided by the developer of the information system, system component, or information system services.','SA-04(02)','N/A','Determine if the developer of the system, system component, or system service is required to provide design and implementation information for the controls that includes using [SA-04(02)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [SA-04(02)_ODP[02]; design and implementation information is defined (if selected)]}] at [SA-04(02)_ODP[03]; level of detail is defined].'),\n('003109','draft','2013-09-23','DISA FSO','policy','Require the developer of the system, system component, or system service to deliver the system, component, or service with organization-defined security configurations implemented.','SA-04(05)(a)','N/A','Determine if the developer of the system, system component, or system service is required to deliver the system, component, or service with [SA-04(05)_ODP; security configurations for the system, component, or service are defined] implemented.'),\n('003110','draft','2013-09-23','DISA FSO','policy','Defines the security configurations required to be implemented when the developer delivers the system, system component, or system service.','SA-04(05)(a)','N/A','Determine if the developer of the system, system component, or system service is required to deliver the system, component, or service with [SA-04(05)_ODP; security configurations for the system, component, or service are defined] implemented.'),\n('003111','draft','2013-09-23','DISA FSO','policy','Requires the developer of the system, system component, or system service to use the configurations as the default for any subsequent system, component, or service reinstallation or upgrade.','SA-04(05)(b)','N/A','Determine if the configurations are used as the default for any subsequent system, component, or service reinstallation or upgrade.'),\n('003112','draft','2013-09-23','DISA FSO','policy','Require the developer of the system, system component, or system service to produce a plan for the continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.','SA-04(08)','N/A','Determine if the developer of the system, system component, or system service is required to produce a plan for the continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.'),\n('003114','draft','2013-09-23','DISA FSO','policy','Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organizational use.','SA-04(09)','N/A','Determine if: - the developer of the system, system component, or system service is required to identify the functions intended for organizational use. - the developer of the system, system component, or system service is required to identify the ports intended for organizational use. - the developer of the system, system component, or system service is required to identify the protocols intended for organizational use. - the developer of the system, system component, or system service is required to identify the services intended for organizational use.'),\n('003116','draft','2013-09-23','DISA FSO','policy','Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems.','SA-04(10)','N/A','Determine if only information technology products on the FIPS 201-approved products list for the Personal Identity Verification (PIV) capability implemented within organizational systems are employed.'),\n('003117','draft','2013-09-23','DISA FSO','policy','Centrally manage organization-defined controls and related processes.','PL-09','N/A','Determine if [PL-09_ODP; security and privacy controls and related processes to be centrally managed are defined] are centrally managed.'),\n('003118','draft','2013-09-23','DISA FSO','policy','Defines the controls and related processes to be centrally managed.','PL-09','N/A','Determine if [PL-09_ODP; security and privacy controls and related processes to be centrally managed are defined] are centrally managed.'),\n('003119','draft','2013-09-23','DISA FSO','policy','Employ a technical surveillance countermeasures survey at organization-defined locations on an organization-defined frequency or when organization-defined events or indicators occur.','RA-06','N/A','Determine if a technical surveillance countermeasures survey is employed at [RA-06_ODP[01]; locations to employ technical surveillance countermeasure surveys are defined] [RA-06_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[RA-06_ODP[03]; the frequency at which to employ technical surveillance countermeasure surveys is defined (if selected)]; when [RA-06_ODP[04]; events or indicators which, if they occur, trigger a technical surveillance countermeasures survey are defined (if selected)]}].'),\n('003120','draft','2013-09-23','DISA FSO','policy','Defines the locations where technical surveillance countermeasures surveys are to be employed.','RA-06','N/A','Determine if a technical surveillance countermeasures survey is employed at [RA-06_ODP[01]; locations to employ technical surveillance countermeasure surveys are defined] [RA-06_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[RA-06_ODP[03]; the frequency at which to employ technical surveillance countermeasure surveys is defined (if selected)]; when [RA-06_ODP[04]; events or indicators which, if they occur, trigger a technical surveillance countermeasures survey are defined (if selected)]}].'),\n('003121','draft','2013-09-23','DISA FSO','policy','Defines the frequency on which to employ technical surveillance countermeasures surveys.','RA-06','N/A','Determine if a technical surveillance countermeasures survey is employed at [RA-06_ODP[01]; locations to employ technical surveillance countermeasure surveys are defined] [RA-06_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[RA-06_ODP[03]; the frequency at which to employ technical surveillance countermeasure surveys is defined (if selected)]; when [RA-06_ODP[04]; events or indicators which, if they occur, trigger a technical surveillance countermeasures survey are defined (if selected)]}].'),\n('003122','draft','2013-09-23','DISA FSO','policy','Defines the events or indicators upon which technical surveillance countermeasures surveys are to be employed.','RA-06','N/A','Determine if a technical surveillance countermeasures survey is employed at [RA-06_ODP[01]; locations to employ technical surveillance countermeasure surveys are defined] [RA-06_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[RA-06_ODP[03]; the frequency at which to employ technical surveillance countermeasure surveys is defined (if selected)]; when [RA-06_ODP[04]; events or indicators which, if they occur, trigger a technical surveillance countermeasures survey are defined (if selected)]}].'),\n('003123','draft','2013-09-24','DISA FSO','technical','Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.','MA-04(06)','N/A','Determine if: - [MA-04(06)_ODP; cryptographic mechanisms to be implemented to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications are defined] are implemented to protect the integrity of nonlocal maintenance and diagnostic communications. - [MA-04(06)_ODP; cryptographic mechanisms to be implemented to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications are defined] are implemented to protect the confidentiality of nonlocal maintenance and diagnostic communications.'),\n('003124','draft','2013-09-30','DISA FSO','policy','Obtain or develop administrator documentation for the system, system component, or system service that describes secure configuration of the system, component, or service.','SA-05a.01','N/A','Determine if: - administrator documentation for the system, system component, or system service that describes the secure configuration of the system, component, or service is obtained or developed. - administrator documentation for the system, system component, or system service that describes the secure installation of the system, component, or service is obtained or developed. - administrator documentation for the system, system component, or system service that describes the secure operation of the system, component, or service is obtained or developed.'),\n('003125','draft','2013-09-30','DISA FSO','policy','Obtain or develop administrator documentation for the system, system component, or system service that describes secure installation of the system, component, or service.','SA-05a.01','N/A','Determine if: - administrator documentation for the system, system component, or system service that describes the secure configuration of the system, component, or service is obtained or developed. - administrator documentation for the system, system component, or system service that describes the secure installation of the system, component, or service is obtained or developed. - administrator documentation for the system, system component, or system service that describes the secure operation of the system, component, or service is obtained or developed.'),\n('003126','draft','2013-09-30','DISA FSO','policy','Obtain or develop administrator documentation for the system, system component, or system service that describes secure operation of the system, component, or service.','SA-05a.01','N/A','Determine if: - administrator documentation for the system, system component, or system service that describes the secure configuration of the system, component, or service is obtained or developed. - administrator documentation for the system, system component, or system service that describes the secure installation of the system, component, or service is obtained or developed. - administrator documentation for the system, system component, or system service that describes the secure operation of the system, component, or service is obtained or developed.'),\n('003127','draft','2013-09-30','DISA FSO','policy','Obtain or develop administrator documentation for the system, system component, or system services that describes effective use and maintenance of security functions and mechanisms.','SA-05a.02','N/A','Determine if: - administrator documentation for the system, system component, or system service that describes the effective use of security functions and mechanisms is obtained or developed. - administrator documentation for the system, system component, or system service that describes the effective maintenance of security functions and mechanisms is obtained or developed. - administrator documentation for the system, system component, or system service that describes the effective use of privacy functions and mechanisms is obtained or developed. - administrator documentation for the system, system component, or system service that describes the effective maintenance of privacy functions and mechanisms is obtained or developed.'),\n('003128','draft','2013-09-30','DISA FSO','policy','Obtain or develop administrator documentation for the system, system component, or system service that describes known vulnerabilities regarding configuration and use of administrative or privileged functions.','SA-05a.03','N/A','Determine if: - administrator documentation for the system, system component, or system service that describes known vulnerabilities regarding the configuration of administrative or privileged functions is obtained or developed. - administrator documentation for the system, system component, or system service that describes known vulnerabilities regarding the use of administrative or privileged functions is obtained or developed.'),\n('003129','draft','2013-09-30','DISA FSO','policy','Obtain or develop user documentation for the system, system component, or system service that describes user-accessible security functions and mechanisms and how to effectively use those functions and mechanisms.','SA-05b.01','N/A','Determine if: - user documentation for the system, system component, or system service that describes user-accessible security functions and mechanisms is obtained or developed. - user documentation for the system, system component, or system service that describes how to effectively use those (user-accessible security) functions and mechanisms is obtained or developed. - user documentation for the system, system component, or system service that describes user-accessible privacy functions and mechanisms is obtained or developed. - user documentation for the system, system component, or system service that describes how to effectively use those (user-accessible privacy) functions and mechanisms is obtained or developed.'),\n('003130','draft','2013-09-30','DISA FSO','policy','Obtain or develop user documentation for the system, system component, or system service that describes methods for user interaction which enables individuals to use the system, component, or service in a more secure manner.','SA-05b.02','N/A','Determine if: - user documentation for the system, system component, or system service that describes methods for user interaction, which enable individuals to use the system, component, or service in a more secure manner is obtained or developed. - user documentation for the system, system component, or system service that describes methods for user interaction, which enable individuals to use the system, component, or service to protect individual privacy is obtained or developed.'),\n('003131','draft','2013-09-30','DISA FSO','policy','Obtain or develop user documentation for the system, system component, or system service that describes user responsibilities in maintaining the security of the system, component, or service.','SA-05b.03','N/A','Determine if: - user documentation for the system, system component, or system service that describes user responsibilities for maintaining the security of the system, component, or service is obtained or developed. - user documentation for the system, system component, or system service that describes user responsibilities for maintaining the privacy of individuals is obtained or developed.'),\n('003132','draft','2013-09-30','DISA FSO','policy','Take organization-defined actions in response to attempts to obtain either unavailable or nonexistent documentation for the system, system component, or system service.','SA-05c.','N/A','Determine if: - attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent is documented. - after attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent, [SA-05_ODP[01]; actions to take when system, system component, or system service documentation is either unavailable or nonexistent are defined] are taken in response.'),\n('003133','draft','2013-09-30','DISA FSO','policy','Defines actions to be taken in response to attempts to obtain either unavailable or nonexistent documentation for the system, system component, or system service.','SA-05c.','N/A','Determine if: - attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent is documented. - after attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent, [SA-05_ODP[01]; actions to take when system, system component, or system service documentation is either unavailable or nonexistent are defined] are taken in response.'),\n('003135','draft','2013-09-30','DISA FSO','policy','Distribute system, system component, or system service documentation to organization-defined personnel or roles.','SA-05d.','N/A','Determine if documentation is distributed to [SA-05_ODP[02]; personnel or roles to distribute system documentation to is/are defined].'),\n('003136','draft','2013-09-30','DISA FSO','policy','Defines the personnel or roles to whom system, system component, or system service documentation is to be distributed.','SA-05d.','N/A','Determine if documentation is distributed to [SA-05_ODP[02]; personnel or roles to distribute system documentation to is/are defined].'),\n('003138','draft','2013-09-30','DISA FSO','policy','Employ organization-defined processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis.','SA-09c.','N/A','Determine if [SA-09_ODP[02]; processes, methods, and techniques employed to monitor control compliance by external service providers are defined] are employed to monitor control compliance by external service providers on an ongoing basis.'),\n('003139','draft','2013-09-30','DISA FSO','policy','Defines processes, methods, and techniques to employ to monitor control compliance by external service providers on an ongoing basis.','SA-09c.','N/A','Determine if [SA-09_ODP[02]; processes, methods, and techniques employed to monitor control compliance by external service providers are defined] are employed to monitor control compliance by external service providers on an ongoing basis.'),\n('003140','draft','2013-09-30','DISA FSO','policy','Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services.','SA-09(01)(a)','N/A','Determine if an organizational assessment of risk is conducted prior to the acquisition or outsourcing of information security services.'),\n('003141','draft','2013-09-30','DISA FSO','policy','Verify that the acquisition or outsourcing of dedicated information security services is approved by organization-defined personnel or roles.','SA-09(01)(b)','N/A','Determine if [SA-09(01)_ODP; personnel or roles that approve the acquisition or outsourcing of dedicated information security services is/are defined] approve the acquisition or outsourcing of dedicated information security services.'),\n('003142','draft','2013-09-30','DISA FSO','policy','Defines the personnel or roles authorized to approve the acquisition or outsourcing of dedicated information security services.','SA-09(01)(b)','N/A','Determine if [SA-09(01)_ODP; personnel or roles that approve the acquisition or outsourcing of dedicated information security services is/are defined] approve the acquisition or outsourcing of dedicated information security services.'),\n('003143','draft','2013-09-30','DISA FSO','policy','Require providers of organization-defined external system services to identify the functions, ports, protocols, and other services required for the use of such services.','SA-09(02)','N/A','Determine if providers of [SA-09(02)_ODP; external system services that require the identification of functions, ports, protocols, and other services are defined] are required to identify the functions, ports, protocols, and other services required for the use of such services.'),\n('003144','draft','2013-09-30','DISA FSO','policy','Defines the external system services for which the providers are required to identify the functions, ports, protocols, and other services required for the use of such services.','SA-09(02)','N/A','Determine if providers of [SA-09(02)_ODP; external system services that require the identification of functions, ports, protocols, and other services are defined] are required to identify the functions, ports, protocols, and other services required for the use of such services.'),\n('003145','draft','2013-09-30','DISA FSO','policy','Establish trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.','SA-09(03)','N/A','Determine if: - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained.'),\n('003146','draft','2013-09-30','DISA FSO','policy','Document trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.','SA-09(03)','N/A','Determine if: - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained.'),\n('003147','draft','2013-09-30','DISA FSO','policy','Maintain trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships.','SA-09(03)','N/A','Determine if: - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained.'),\n('003148','draft','2013-09-30','DISA FSO','policy','Defines security requirements, properties, factors, or conditions defining acceptable trust relationships with external service providers.','SA-09(03)','N/A','Determine if: - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained.'),\n('003149','draft','2013-09-30','DISA FSO','policy','Take organization-defined actions to verify that the interests of organization-defined external service providers are consistent with and reflect organizational interests.','SA-09(04)','N/A','Determine if [SA-09(04)_ODP[02]; actions to be taken to verify that the interests of external service providers are consistent with and reflect organizational interests are defined] are taken to verify that the interests of [SA-09(04)_ODP[01]; external service providers are defined] are consistent with and reflect organizational interests.'),\n('003150','draft','2013-09-30','DISA FSO','policy','Defines the actions taken to verify that the interests of organization-defined external service providers are consistent with and reflect organizational interests.','SA-09(04)','N/A','Determine if [SA-09(04)_ODP[02]; actions to be taken to verify that the interests of external service providers are consistent with and reflect organizational interests are defined] are taken to verify that the interests of [SA-09(04)_ODP[01]; external service providers are defined] are consistent with and reflect organizational interests.'),\n('003151','draft','2013-09-30','DISA FSO','policy','Defines external service providers whose interests are consistent with and reflect organizational interests.','SA-09(04)','N/A','Determine if [SA-09(04)_ODP[02]; actions to be taken to verify that the interests of external service providers are consistent with and reflect organizational interests are defined] are taken to verify that the interests of [SA-09(04)_ODP[01]; external service providers are defined] are consistent with and reflect organizational interests.'),\n('003152','draft','2013-09-30','DISA FSO','policy','Restrict the location of information processing, information or data, and/or system services to organization-defined locations based on organization-defined requirements or conditions.','SA-09(05)','N/A','Determine if based on [SA-09(05)_ODP[03]; requirements or conditions for restricting the location of [SA-09(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {information processing; information or data; system services}] are defined] is/are restricted to [SA-09(05)_ODP[02]; locations where [SA-09(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {information processing; information or data; system services}] is/are to be restricted are defined].'),\n('003153','draft','2013-09-30','DISA FSO','policy','Defines the locations for which to restrict information processing, information or data, and/or system services based on organization-defined requirements or conditions.','SA-09(05)','N/A','Determine if based on [SA-09(05)_ODP[03]; requirements or conditions for restricting the location of [SA-09(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {information processing; information or data; system services}] are defined] is/are restricted to [SA-09(05)_ODP[02]; locations where [SA-09(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {information processing; information or data; system services}] is/are to be restricted are defined].'),\n('003154','draft','2013-09-30','DISA FSO','policy','Defines the requirements or conditions on which to base restricting the location of information processing, information or data, and/or system services to organization-defined locations.','SA-09(05)','N/A','Determine if based on [SA-09(05)_ODP[03]; requirements or conditions for restricting the location of [SA-09(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {information processing; information or data; system services}] are defined] is/are restricted to [SA-09(05)_ODP[02]; locations where [SA-09(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {information processing; information or data; system services}] is/are to be restricted are defined].'),\n('003155','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to perform configuration management during system, component, or service design, development, implementation, operation and/or disposal.','SA-10a.','N/A','Determine if the developer of the system, system component, or system service is required to perform configuration management during system, component, or service [SA-10_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {design; development; implementation; operation; disposal}].'),\n('003156','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to document the integrity of changes to organization-defined configuration items under configuration management.','SA-10b.','N/A','Determine if: - the developer of the system, system component, or system service is required to document the integrity of changes to [SA-10_ODP[02]; configuration items under configuration management are defined]. - the developer of the system, system component, or system service is required to manage the integrity of changes to [SA-10_ODP[02]; configuration items under configuration management are defined]. - the developer of the system, system component, or system service is required to control the integrity of changes to [SA-10_ODP[02]; configuration items under configuration management are defined].'),\n('003157','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to manage the integrity of changes to organization-defined configuration items under configuration management.','SA-10b.','N/A','Determine if: - the developer of the system, system component, or system service is required to document the integrity of changes to [SA-10_ODP[02]; configuration items under configuration management are defined]. - the developer of the system, system component, or system service is required to manage the integrity of changes to [SA-10_ODP[02]; configuration items under configuration management are defined]. - the developer of the system, system component, or system service is required to control the integrity of changes to [SA-10_ODP[02]; configuration items under configuration management are defined].'),\n('003158','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to control the integrity of changes to organization-defined configuration items under configuration management.','SA-10b.','N/A','Determine if: - the developer of the system, system component, or system service is required to document the integrity of changes to [SA-10_ODP[02]; configuration items under configuration management are defined]. - the developer of the system, system component, or system service is required to manage the integrity of changes to [SA-10_ODP[02]; configuration items under configuration management are defined]. - the developer of the system, system component, or system service is required to control the integrity of changes to [SA-10_ODP[02]; configuration items under configuration management are defined].'),\n('003159','draft','2013-09-30','DISA FSO','policy','Defines the configuration items under configuration management that require the integrity of changes to be documented, managed and controlled.','SA-10b.','N/A','Determine if: - the developer of the system, system component, or system service is required to document the integrity of changes to [SA-10_ODP[02]; configuration items under configuration management are defined]. - the developer of the system, system component, or system service is required to manage the integrity of changes to [SA-10_ODP[02]; configuration items under configuration management are defined]. - the developer of the system, system component, or system service is required to control the integrity of changes to [SA-10_ODP[02]; configuration items under configuration management are defined].'),\n('003160','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to document the potential security impacts of approved changes to the system, component, or service.','SA-10d.','N/A','Determine if: - the developer of the system, system component, or system service is required to document approved changes to the system, component, or service. - the developer of the system, system component, or system service is required to document the potential security impacts of approved changes. - the developer of the system, system component, or system service is required to document the potential privacy impacts of approved changes.'),\n('003161','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to track security flaws within the system, component, or service.','SA-10e.','N/A','Determine if: - the developer of the system, system component, or system service is required to track security flaws within the system, component, or service. - the developer of the system, system component, or system service is required to track security flaw resolutions within the system, component, or service. - the developer of the system, system component, or system service is required to report findings to [SA-10_ODP[03]; personnel to whom security flaws and flaw resolutions within the system, component, or service are reported is/are defined].'),\n('003162','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to track flaw resolution within the system, component, or service.','SA-10e.','N/A','Determine if: - the developer of the system, system component, or system service is required to track security flaws within the system, component, or service. - the developer of the system, system component, or system service is required to track security flaw resolutions within the system, component, or service. - the developer of the system, system component, or system service is required to report findings to [SA-10_ODP[03]; personnel to whom security flaws and flaw resolutions within the system, component, or service are reported is/are defined].'),\n('003163','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to report findings of security flaws and flaw resolution within the system, component, or service to organization-defined personnel.','SA-10e.','N/A','Determine if: - the developer of the system, system component, or system service is required to track security flaws within the system, component, or service. - the developer of the system, system component, or system service is required to track security flaw resolutions within the system, component, or service. - the developer of the system, system component, or system service is required to report findings to [SA-10_ODP[03]; personnel to whom security flaws and flaw resolutions within the system, component, or service are reported is/are defined].'),\n('003164','draft','2013-09-30','DISA FSO','policy','Defines the personnel to whom security flaw findings and flaw resolution within the system, component, or service are reported.','SA-10e.','N/A','Determine if: - the developer of the system, system component, or system service is required to track security flaws within the system, component, or service. - the developer of the system, system component, or system service is required to track security flaw resolutions within the system, component, or service. - the developer of the system, system component, or system service is required to report findings to [SA-10_ODP[03]; personnel to whom security flaws and flaw resolutions within the system, component, or service are reported is/are defined].'),\n('003165','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to enable integrity verification of hardware components.','SA-10(03)','N/A','Determine if the developer of the system, system component, or system service is required to enable integrity verification of hardware components.'),\n('003166','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions.','SA-10(04)','N/A','Determine if: - the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions. - the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of source code with previous versions. - the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of object code with previous versions. '),\n('003167','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of source code with previous versions.','SA-10(04)','N/A','Determine if: - the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions. - the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of source code with previous versions. - the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of object code with previous versions. '),\n('003168','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of object code with previous versions.','SA-10(04)','N/A','Determine if: - the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions. - the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of source code with previous versions. - the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of object code with previous versions. '),\n('003169','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.','SA-10(05)','N/A','Determine if the developer of the system, system component, or system service is required to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.'),\n('003170','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.','SA-10(06)','N/A','Determine if the developer of the system, system component, or system service is required to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.'),\n('003171','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to develop a plan for ongoing security control assessment.','SA-11a.','N/A','Determine if: - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for ongoing security assessments. - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing security assessments. - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for privacy assessments. - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing privacy assessments.'),\n('003172','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to implement a plan for ongoing security control assessment.','SA-11a.','N/A','Determine if: - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for ongoing security assessments. - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing security assessments. - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for privacy assessments. - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing privacy assessments.'),\n('003173','draft','2013-09-30','DISA FSO','policy','Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to perform unit, integration, system, and/or regression testing/evaluation on an organization-defined frequency, at an organization-defined depth and coverage.','SA-11b.','N/A','Determine if the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to perform [SA-11_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {unit; integration; system; regression}] testing/evaluation [SA-11_ODP[02]; frequency at which to conduct [SA-11_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {unit; integration; system; regression}] testing/evaluation is defined] at [SA-11_ODP[03]; depth and coverage of [SA-11_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {unit; integration; system; regression}] testing/evaluation is defined].'),\n('003174','draft','2013-09-30','DISA FSO','policy','Defines the depth and coverage at which to perform unit, integration, system, and/or regression testing/evaluation on an organization-defined frequency.','SA-11b.','N/A','Determine if the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to perform [SA-11_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {unit; integration; system; regression}] testing/evaluation [SA-11_ODP[02]; frequency at which to conduct [SA-11_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {unit; integration; system; regression}] testing/evaluation is defined] at [SA-11_ODP[03]; depth and coverage of [SA-11_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {unit; integration; system; regression}] testing/evaluation is defined].'),\n('003175','draft','2013-09-30','DISA FSO','policy','Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to produce evidence of the execution of the assessment plan.','SA-11c.','N/A','Determine if: - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce evidence of the execution of the assessment plan. - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce the results of the testing and evaluation.'),\n('003176','draft','2013-09-30','DISA FSO','policy','Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to produce the results of the testing and evaluation.','SA-11c.','N/A','Determine if: - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce evidence of the execution of the assessment plan. - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce the results of the testing and evaluation.'),\n('003177','draft','2013-09-30','DISA FSO','policy','Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to implement a verifiable flaw remediation process.','SA-11d.','N/A','Determine if the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a verifiable flaw remediation process.'),\n('003178','draft','2013-09-30','DISA FSO','policy','Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to correct flaws identified during testing/evaluation.','SA-11e.','N/A','Determine if the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to correct flaws identified during testing and evaluation.'),\n('003179','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws.','SA-11(01)','N/A','Determine if: - the developer of the system, system component, or system service is required to employ static code analysis tools to identify common flaws. - the developer of the system, system component, or system service is required to employ static code analysis tools to document the results of the analysis.'),\n('003180','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to document the results of static code analysis.','SA-11(01)','N/A','Determine if: - the developer of the system, system component, or system service is required to employ static code analysis tools to identify common flaws. - the developer of the system, system component, or system service is required to employ static code analysis tools to document the results of the analysis.'),\n('003181','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development.',NULL,'N/A',NULL),\n('003182','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analysis during subsequent testing and evaluation of the system, component, or service.',NULL,'N/A',NULL),\n('003183','draft','2013-09-30','DISA FSO','policy','Require an independent agent satisfying organization-defined independence criteria to verify the correct implementation of the developer security assessment plan.','SA-11(03)(a)','N/A','Determine if: - an independent agent is required to satisfy [SA-11(03)_ODP; independence criteria to be satisfied by an independent agent are defined] to verify the correct implementation of the developer security assessment plan and the evidence produced during testing and evaluation. - an independent agent is required to satisfy [SA-11(03)_ODP; independence criteria to be satisfied by an independent agent are defined] to verify the correct implementation of the developer privacy assessment plan and the evidence produced during testing and evaluation.'),\n('003184','draft','2013-09-30','DISA FSO','policy','Require an independent agent satisfying organization-defined independence criteria to verify the evidence produced during security testing and evaluation.','SA-11(03)(a)','N/A','Determine if: - an independent agent is required to satisfy [SA-11(03)_ODP; independence criteria to be satisfied by an independent agent are defined] to verify the correct implementation of the developer security assessment plan and the evidence produced during testing and evaluation. - an independent agent is required to satisfy [SA-11(03)_ODP; independence criteria to be satisfied by an independent agent are defined] to verify the correct implementation of the developer privacy assessment plan and the evidence produced during testing and evaluation.'),\n('003185','draft','2013-09-30','DISA FSO','policy','Defines the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer security assessment plan and the evidence produced during security testing and evaluation.','SA-11(03)(a)','N/A','Determine if: - an independent agent is required to satisfy [SA-11(03)_ODP; independence criteria to be satisfied by an independent agent are defined] to verify the correct implementation of the developer security assessment plan and the evidence produced during testing and evaluation. - an independent agent is required to satisfy [SA-11(03)_ODP; independence criteria to be satisfied by an independent agent are defined] to verify the correct implementation of the developer privacy assessment plan and the evidence produced during testing and evaluation.'),\n('003186','draft','2013-09-30','DISA FSO','policy','Verify that the independent agent either is provided with sufficient information to complete the verification process or has been granted the authority to obtain such information.','SA-11(03)(b)','N/A','Determine if the independent agent is provided with sufficient information to complete the verification process or granted the authority to obtain such information.'),\n('003187','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to perform a manual code review of organization-defined specific code using organization-defined processes, procedures, and/or techniques.','SA-11(04)','N/A','Determine if the developer of the system, system component, or system service is required to perform a manual code review of [SA-11(04)_ODP[01]; specific code requiring manual code review is defined] using [SA-11(04)_ODP[02]; processes, procedures, and/or techniques used for manual code reviews are defined].'),\n('003188','draft','2013-09-30','DISA FSO','policy','Defines the specific code for which the developer of the system, system component, or system service is required to perform a manual code review using organization-defined process, procedures, and/or techniques.','SA-11(04)','N/A','Determine if the developer of the system, system component, or system service is required to perform a manual code review of [SA-11(04)_ODP[01]; specific code requiring manual code review is defined] using [SA-11(04)_ODP[02]; processes, procedures, and/or techniques used for manual code reviews are defined].'),\n('003189','draft','2013-09-30','DISA FSO','policy','Defines the processes, procedures, and/or techniques to be used by the developer of the system, system component, or system service to perform a manual code review of organization-defined specific code.','SA-11(04)','N/A','Determine if the developer of the system, system component, or system service is required to perform a manual code review of [SA-11(04)_ODP[01]; specific code requiring manual code review is defined] using [SA-11(04)_ODP[02]; processes, procedures, and/or techniques used for manual code reviews are defined].'),\n('003191','draft','2013-09-30','DISA FSO','policy','Defines the breadth and depth at which the developer of the system, system component, or system service is required to perform penetration testing.','SA-11(05)(a)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform penetration testing at the following level of rigor: [SA-11(05)_ODP[01]; the breadth of penetration testing is defined]. - the developer of the system, system component, or system service is required to perform penetration testing at the following level of rigor: [SA-11(05)_ODP[02]; the depth of penetration testing is defined].'),\n('003192','draft','2013-09-30','DISA FSO','policy','Defines the constraints on penetration testing performed by the developer of the system, system component, or system service.','SA-11(05)(b)','N/A','Determine if the developer of the system, system component, or system service is required to perform penetration testing under [SA-11(05)_ODP[03]; constraints of penetration testing are defined].'),\n('003193','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to perform attack surface reviews.','SA-11(06)','N/A','Determine if the developer of the system, system component, or system service is required to perform attack surface reviews.'),\n('003194','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to verify that the scope of testing and evaluation provides complete coverage of required controls at an organization-defined depth of testing and evaluation.','SA-11(07)','N/A','Determine if: - the developer of the system, system component, or system service is required to verify that the scope of testing and evaluation provides complete coverage of the required controls at [SA-11(07)_ODP[01]; the breadth of testing and evaluation of required controls is defined]. - the developer of the system, system component, or system service is required to verify that the scope of testing and evaluation provides complete coverage of the required controls at [SA-11(07)_ODP[02]; the depth of testing and evaluation of required controls is defined].'),\n('003195','draft','2013-09-30','DISA FSO','policy','Defines the depth of testing and evaluation to which the developer of the system, system component, or system service is required to verify that the scope of security testing and evaluation provides complete coverage of the required controls.','SA-11(07)','N/A','Determine if: - the developer of the system, system component, or system service is required to verify that the scope of testing and evaluation provides complete coverage of the required controls at [SA-11(07)_ODP[01]; the breadth of testing and evaluation of required controls is defined]. - the developer of the system, system component, or system service is required to verify that the scope of testing and evaluation provides complete coverage of the required controls at [SA-11(07)_ODP[02]; the depth of testing and evaluation of required controls is defined].'),\n('003196','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to employ dynamic code analysis tools to identify common flaws.','SA-11(08)','N/A','Determine if: - the developer of the system, system component, or system service is required to employ dynamic code analysis tools to identify common flaws. - the developer of the system, system component, or system service is required to document the results of the analysis.'),\n('003197','draft','2013-09-30','DISA FSO ','policy','Require the developer of the system, system component, or system service to document the results of the dynamic code analysis.','SA-11(08)','N/A','Determine if: - the developer of the system, system component, or system service is required to employ dynamic code analysis tools to identify common flaws. - the developer of the system, system component, or system service is required to document the results of the analysis.'),\n('003233','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to follow a documented development process.',NULL,'N/A',NULL),\n('003234','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to follow a documented development process that explicitly addresses security requirements.','SA-15a.01','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses security requirements. - the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses privacy requirements.'),\n('003235','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to follow a documented development process that identifies the standards used in the development process.','SA-15a.02','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process that identifies the standards used in the development process. - the developer of the system, system component, or system service is required to follow a documented development process that identifies the tools used in the development process.'),\n('003236','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to follow a documented development process that identifies the tools used in the development process.','SA-15a.02','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process that identifies the standards used in the development process. - the developer of the system, system component, or system service is required to follow a documented development process that identifies the tools used in the development process.'),\n('003237','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to follow a documented development process that documents the specific tool options and tool configurations used in the development process.','SA-15a.03','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool used in the development process. - the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool configurations used in the development process.'),\n('003238','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to follow a documented development process that documents changes to the process and/or tools used in development.','SA-15a.04','N/A','Determine if the developer of the system, system component, or system service is required to follow a documented development process that documents, manages, and ensures the integrity of changes to the process and/or tools used in development.'),\n('003239','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to follow a documented development process that manages changes to the process and/or tools used in development.','SA-15a.04','N/A','Determine if the developer of the system, system component, or system service is required to follow a documented development process that documents, manages, and ensures the integrity of changes to the process and/or tools used in development.'),\n('003240','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to follow a documented development process that ensures the integrity of changes to the process and/or tools used in development.','SA-15a.04','N/A','Determine if the developer of the system, system component, or system service is required to follow a documented development process that documents, manages, and ensures the integrity of changes to the process and/or tools used in development.'),\n('003241','draft','2013-09-30','DISA FSO','policy','Review the development process in accordance with organization-defined frequency to determine if the development process selected and employed can satisfy organization-defined security requirements.','SA-15b.','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[02]; security requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined]. - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[03]; privacy requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined].'),\n('003242','draft','2013-09-30','DISA FSO','policy','Review the development standards in accordance with organization-defined frequency to determine if the development standards selected and employed can satisfy organization-defined security requirements.','SA-15b.','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[02]; security requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined]. - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[03]; privacy requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined].'),\n('003243','draft','2013-09-30','DISA FSO','policy','Review the development tools in accordance with organization-defined frequency to determine if the development tools selected and employed can satisfy organization-defined security requirements.','SA-15b.','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[02]; security requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined]. - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[03]; privacy requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined].'),\n('003244','draft','2013-09-30','DISA FSO','policy','Review the development tool options/configurations in accordance with organization-defined frequency to determine if the development tool options and tool configurations selected and employed can satisfy organization-defined security requirements.','SA-15b.','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[02]; security requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined]. - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[03]; privacy requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined].'),\n('003245','draft','2013-09-30','DISA FSO','policy','Defines the frequency on which to review the development process, standards, tools, and tool options/configurations to determine if the process, standards, tools, and tool options and tool configurations selected and employed can satisfy organization-defined security requirements.','SA-15b.','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[02]; security requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined]. - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[03]; privacy requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined].'),\n('003246','draft','2013-09-30','DISA FSO','policy','Defines the security requirements that must be satisfied by conducting a review of the development process, standards, tools, and tool options and tool configurations.','SA-15b.','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[02]; security requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined]. - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[03]; privacy requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined].'),\n('003247','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to define quality metrics at the beginning of the development process.','SA-15(01)(a)','N/A','Determine if the developer of the system, system component, or system service is required to define quality metrics at the beginning of the development process.'),\n('003248','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to provide evidence of meeting the quality metrics in accordance with organization-defined frequency, organization-defined program review milestones, and/or upon delivery.','SA-15(01)(b)','N/A','Determine if the developer of the system, system component, or system service is required to provide evidence of meeting the quality metrics [SA-15(01)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {[SA-15(01)_ODP[02]; frequency at which to provide evidence of meeting the quality metrics is defined (if selected)]; [SA-15(01)_ODP[03]; program review milestones are defined (if selected)]; upon delivery}].'),\n('003249','draft','2013-09-30','DISA FSO','policy','Defines the frequency on which the developer of the system, system component, or system service is required to provide evidence of meeting the quality metrics.','SA-15(01)(b)','N/A','Determine if the developer of the system, system component, or system service is required to provide evidence of meeting the quality metrics [SA-15(01)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {[SA-15(01)_ODP[02]; frequency at which to provide evidence of meeting the quality metrics is defined (if selected)]; [SA-15(01)_ODP[03]; program review milestones are defined (if selected)]; upon delivery}].'),\n('003250','draft','2013-09-30','DISA FSO','policy','Defines the program review milestones at which the developer of the information system, system component, or information system service is required to provide evidence of meeting the quality metrics.','SA-15(01)(b)','N/A','Determine if the developer of the system, system component, or system service is required to provide evidence of meeting the quality metrics [SA-15(01)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {[SA-15(01)_ODP[02]; frequency at which to provide evidence of meeting the quality metrics is defined (if selected)]; [SA-15(01)_ODP[03]; program review milestones are defined (if selected)]; upon delivery}].'),\n('003251','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to select a security tracking tool for use during the development process.','SA-15(02)','N/A','Determine if: - the developer of the system, system component, or system service is required to select and employ security tracking tools for use during the development process. - the developer of the system, system component, or system service is required to select and employ privacy tracking tools for use during the development process.'),\n('003252','draft','2013-09-30','DISA FSO','policy','Require the developer of the system, system component, or system service to employ a security tracking tool for use during the development process.','SA-15(02)','N/A','Determine if: - the developer of the system, system component, or system service is required to select and employ security tracking tools for use during the development process. - the developer of the system, system component, or system service is required to select and employ privacy tracking tools for use during the development process.'),\n('003254','draft','2013-09-30','DISA FSO','policy','Defines the breadth/depth of criticality analysis at which the developer of the system, system component, or system service is required to perform a criticality analysis.','SA-15(03)(b)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform a criticality analysis at the following rigor level: [SA-15(03)_ODP[02]; the breadth of criticality analysis is defined]. - the developer of the system, system component, or system service is required to perform a criticality analysis at the following rigor level: [SA-15(03)_ODP[03]; the depth of criticality analysis is defined].'),\n('003255','draft','2013-09-30','DISA FSO','policy','Defines decision points in the system development life cycle at which the developer of the system, system component, or system service is required to perform a criticality analysis.','SA-15(03)(a)','N/A','Determine if the developer of the system, system component, or system service is required to perform a criticality analysis at [SA-15(03)_ODP[01]; decision points in the system development life cycle are defined] in the system development life cycle.'),\n('003272','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to reduce attack surfaces to organization-defined thresholds.','SA-15(05)','N/A','Determine if the developer of the system, system component, or system service is required to reduce attack surfaces to [SA-15(05)_ODP; thresholds to which attack surfaces are to be reduced are defined].'),\n('003273','draft','2013-10-03','DISA FSO','policy','Defines the thresholds to which the developer of the system, system component, or system service is required to reduce attack surfaces.','SA-15(05)','N/A','Determine if the developer of the system, system component, or system service is required to reduce attack surfaces to [SA-15(05)_ODP; thresholds to which attack surfaces are to be reduced are defined].'),\n('003274','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development process.','SA-15(06)','N/A','Determine if the developer of the system, system component, or system service is required to implement an explicit process to continuously improve the development process.'),\n('003275','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system services, on an organization-defined frequency, to perform an automated vulnerability analysis using organization-defined tools.','SA-15(07)(a)','N/A','Determine if the developer of the system, system component, or system service is required to perform automated vulnerability analysis [SA-15(07)_ODP[01]; frequency at which to conduct vulnerability analysis is defined] using [SA-15(07)_ODP[02]; tools used to perform automated vulnerability analysis are defined].'),\n('003276','draft','2013-10-03','DISA FSO','policy','Defines the tools the developer of the system, system component, or system services uses to perform an automated vulnerability analysis.','SA-15(07)(a)','N/A','Determine if the developer of the system, system component, or system service is required to perform automated vulnerability analysis [SA-15(07)_ODP[01]; frequency at which to conduct vulnerability analysis is defined] using [SA-15(07)_ODP[02]; tools used to perform automated vulnerability analysis are defined].'),\n('003277','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system services, on an organization-defined frequency, to determine the exploitation potential for discovered vulnerabilities.','SA-15(07)(b)','N/A','Determine if the developer of the system, system component, or system service is required to determine the exploitation potential for discovered vulnerabilities [SA-15(07)_ODP[01]; frequency at which to conduct vulnerability analysis is defined].'),\n('003278','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system services, on an organization-defined frequency, to determine potential risk mitigations for delivered vulnerabilities.','SA-15(07)(c)','N/A','Determine if the developer of the system, system component, or system service is required to determine potential risk mitigations [SA-15(07)_ODP[01]; frequency at which to conduct vulnerability analysis is defined] for delivered vulnerabilities.'),\n('003279','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system services, on an organization-defined frequency, to deliver the outputs of the tools and results of the vulnerability analysis to organization-defined personnel or roles.','SA-15(07)(d)','N/A','Determine if the developer of the system, system component, or system service is required to deliver the outputs of the tools and results of the analysis [SA-15(07)_ODP[01]; frequency at which to conduct vulnerability analysis is defined] to [SA-15(07)_ODP[03]; personnel or roles to whom the outputs of tools and results of the analysis are to be delivered is/are defined].'),\n('003280','draft','2013-10-03','DISA FSO','policy','Defines the personnel or roles to whom the outputs of the tools and results of the vulnerability analysis are delivered.','SA-15(07)(d)','N/A','Determine if the developer of the system, system component, or system service is required to deliver the outputs of the tools and results of the analysis [SA-15(07)_ODP[01]; frequency at which to conduct vulnerability analysis is defined] to [SA-15(07)_ODP[03]; personnel or roles to whom the outputs of tools and results of the analysis are to be delivered is/are defined].'),\n('003281','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to use threat modeling from similar systems, components, or services to inform the current development process.','SA-15(08)','N/A','Determine if: - the developer of the system, system component, or system service is required to use threat modeling from similar systems, components, or services to inform the current development process. - the developer of the system, system component, or system service is required to use vulnerability analyses from similar systems, components, or services to inform the current development process.'),\n('003282','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to use vulnerability analysis from similar systems, components, or services to inform the current development process.','SA-15(08)','N/A','Determine if: - the developer of the system, system component, or system service is required to use threat modeling from similar systems, components, or services to inform the current development process. - the developer of the system, system component, or system service is required to use vulnerability analyses from similar systems, components, or services to inform the current development process.'),\n('003289','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to provide an incident response plan.','SA-15(10)','N/A','Determine if: - the developer of the system, system component, or system service is required to provide an incident response plan. - the developer of the system, system component, or system service is required to implement an incident response plan. - the developer of the system, system component, or system service is required to test an incident response plan.'),\n('003290','draft','2013-10-03','DISA FSO','policy','Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security review.','SA-15(11)','N/A','Determine if the developer of the system or system component is required to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security and privacy review.'),\n('003291','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to provide organization-defined training on the correct use and operation of the implemented security functions, controls, and/or mechanisms.','SA-16','N/A','Determine if the developer of the system, system component, or system service is required to provide [SA-16_ODP; training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms provided by the developer of the system, system component, or system service is defined] on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms.'),\n('003292','draft','2013-10-03','DISA FSO','policy','Defines the training the developer of the system, system component, or system service is required to provide on the correct use and operation of the implemented security functions, controls, and/or mechanisms.','SA-16','N/A','Determine if the developer of the system, system component, or system service is required to provide [SA-16_ODP; training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms provided by the developer of the system, system component, or system service is defined] on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms.'),\n('003293','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to produce a design specification and security architecture.',NULL,'N/A',NULL),\n('003294','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to produce a design specification and security architecture that is consistent with and supportive of the organization''s security architecture which is established within and is an integrated part of the organization''s enterprise architecture.','SA-17a.','N/A','Determine if: - the developer of the system, system component, or system service is required to produce a design specification and security architecture that are consistent with the organization''s security architecture, which is an integral part the organization''s enterprise architecture. - the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that are consistent with the organization''s privacy architecture, which is an integral part the organization''s enterprise architecture.'),\n('003295','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to produce a design specification and security architecture that accurately and completely describes the required security functionality.','SA-17b.','N/A','Determine if: - the developer of the system, system component, or system service is required to produce a design specification and security architecture that accurately and completely describe the required security functionality and the allocation of controls among physical and logical components. - the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that accurately and completely describe the required privacy functionality and the allocation of controls among physical and logical components.'),\n('003296','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to produce a design specification and security architecture that accurately and completely describes the allocation of security controls among physical and logical components.','SA-17b.','N/A','Determine if: - the developer of the system, system component, or system service is required to produce a design specification and security architecture that accurately and completely describe the required security functionality and the allocation of controls among physical and logical components. - the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that accurately and completely describe the required privacy functionality and the allocation of controls among physical and logical components.'),\n('003297','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to produce a design specification and security architecture that expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection.','SA-17c.','N/A','Determine if: - the developer of the system, system component, or system service is required to produce a design specification and security architecture that express how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection. - the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that express how individual privacy functions, mechanisms, and services work together to provide required privacy capabilities and a unified approach to protection.'),\n('003298','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system to produce, as an integral part of the development process, a formal policy model describing the organization-defined elements of organizational security policy to be enforced.','SA-17(01)(a)','N/A','Determine if: - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal policy model describing the [SA-17(01)_ODP[01]; organizational security policy to be enforced is defined] to be enforced. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal policy model describing the [SA-17(01)_ODP[02]; organizational privacy policy to be enforced is defined] to be enforced.'),\n('003299','draft','2013-10-03','DISA FSO','policy','Defines the elements of organizational security policy to be described in the formal policy model for enforcement on the system, system component, or system service.','SA-17(01)(a)','N/A','Determine if: - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal policy model describing the [SA-17(01)_ODP[01]; organizational security policy to be enforced is defined] to be enforced. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal policy model describing the [SA-17(01)_ODP[02]; organizational privacy policy to be enforced is defined] to be enforced.'),\n('003300','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented.','SA-17(01)(b)','N/A','Determine if: - the developer of the system, system component, or system service is required to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented. - the developer of the system, system component, or system service is required to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational privacy policy when implemented.'),\n('003301','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to define security-relevant hardware.','SA-17(02)(a)','N/A','Determine if: - the developer of the system, system component, or system service is required to define security-relevant hardware. - the developer of the system, system component, or system service is required to define security-relevant software. - the developer of the system, system component, or system service is required to define security-relevant firmware. '),\n('003303','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to define security-relevant software.','SA-17(02)(a)','N/A','Determine if: - the developer of the system, system component, or system service is required to define security-relevant hardware. - the developer of the system, system component, or system service is required to define security-relevant software. - the developer of the system, system component, or system service is required to define security-relevant firmware. '),\n('003304','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to define security-relevant firmware.','SA-17(02)(a)','N/A','Determine if: - the developer of the system, system component, or system service is required to define security-relevant hardware. - the developer of the system, system component, or system service is required to define security-relevant software. - the developer of the system, system component, or system service is required to define security-relevant firmware. '),\n('003305','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant hardware is complete.','SA-17(02)(b)','N/A','Determine if the developer of the system, system component, or system service is required to provide a rationale that the definition for security-relevant hardware, software, and firmware is complete.'),\n('003306','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant software is complete.','SA-17(02)(b)','N/A','Determine if the developer of the system, system component, or system service is required to provide a rationale that the definition for security-relevant hardware, software, and firmware is complete.'),\n('003307','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant firmware is complete.','SA-17(02)(b)','N/A','Determine if the developer of the system, system component, or system service is required to provide a rationale that the definition for security-relevant hardware, software, and firmware is complete.'),\n('003308','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects.','SA-17(03)(a)','N/A','Determine if: - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of error messages. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of effects.'),\n('003309','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant software in terms of exceptions, error messages, and effects.','SA-17(03)(a)','N/A','Determine if: - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of error messages. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of effects.'),\n('003310','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.','SA-17(03)(a)','N/A','Determine if: - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of error messages. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of effects.'),\n('003311','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to show via proof to the extent feasible with additional informal demonstration as necessary, that the formal top-level specification is consistent with the formal policy model.','SA-17(03)(b)','N/A','Determine if the developer of the system, system component, or system service is required to show proof that the formal top-level specification is consistent with the formal policy model to the extent feasible with additional informal demonstration as necessary.'),\n('003312','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant hardware.','SA-17(03)(c)','N/A','Determine if the developer of the system, system component, or system service is required to show via informal demonstration that the formal top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware.'),\n('003313','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant software.','SA-17(03)(c)','N/A','Determine if the developer of the system, system component, or system service is required to show via informal demonstration that the formal top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware.'),\n('003314','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant firmware.','SA-17(03)(c)','N/A','Determine if the developer of the system, system component, or system service is required to show via informal demonstration that the formal top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware.'),\n('003315','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant hardware.','SA-17(03)(d)','N/A','Determine if the developer of the system, system component, or system service is required to show that the formal top-level specification is an accurate description of the implemented security-relevant hardware, software, and firmware.'),\n('003316','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant software.','SA-17(03)(d)','N/A','Determine if the developer of the system, system component, or system service is required to show that the formal top-level specification is an accurate description of the implemented security-relevant hardware, software, and firmware.'),\n('003317','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant firmware.','SA-17(03)(d)','N/A','Determine if the developer of the system, system component, or system service is required to show that the formal top-level specification is an accurate description of the implemented security-relevant hardware, software, and firmware.'),\n('003318','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to describe the security-relevant hardware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant hardware.','SA-17(03)(e)','N/A','Determine if the developer of the system, system component, or system service is required to describe the security-relevant hardware, software, and firmware mechanisms that are not addressed in the formal top-level specification but are strictly internal to the security-relevant hardware, software, and firmware.'),\n('003319','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to describe the security-relevant software mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant software.','SA-17(03)(e)','N/A','Determine if the developer of the system, system component, or system service is required to describe the security-relevant hardware, software, and firmware mechanisms that are not addressed in the formal top-level specification but are strictly internal to the security-relevant hardware, software, and firmware.'),\n('003320','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to describe the security-relevant firmware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant firmware.','SA-17(03)(e)','N/A','Determine if the developer of the system, system component, or system service is required to describe the security-relevant hardware, software, and firmware mechanisms that are not addressed in the formal top-level specification but are strictly internal to the security-relevant hardware, software, and firmware.'),\n('003321','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects.','SA-17(04)(a)','N/A','Determine if: - as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of error messages. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of effects.'),\n('003322','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant software in terms of exceptions, error messages, and effects.','SA-17(04)(a)','N/A','Determine if: - as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of error messages. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of effects.'),\n('003323','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects.','SA-17(04)(a)','N/A','Determine if: - as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of error messages. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of effects.'),\n('003324','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to show via informal demonstration or convincing argument with formal methods as feasible that the descriptive top-level specification is consistent with the formal policy model.','SA-17(04)(b)','N/A','Determine if the developer of the system, system component, or system service is required to show via [SA-17(04)_ODP; one of the following PARAMETER VALUES is selected: {informal demonstration, convincing argument with formal methods as feasible}] that the descriptive top-level specification is consistent with the formal policy model.'),\n('003325','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant hardware.','SA-17(04)(c)','N/A','Determine if the developer of the system, system component, or system service is required to show via informal demonstration that the descriptive top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware.'),\n('003326','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant software.','SA-17(04)(c)','N/A','Determine if the developer of the system, system component, or system service is required to show via informal demonstration that the descriptive top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware.'),\n('003327','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant firmware.','SA-17(04)(c)','N/A','Determine if the developer of the system, system component, or system service is required to show via informal demonstration that the descriptive top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware.'),\n('003328','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware.','SA-17(04)(d)','N/A','Determine if the developer of the system, system component, or system service is required to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware, software, and firmware.'),\n('003329','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant software.','SA-17(04)(d)','N/A','Determine if the developer of the system, system component, or system service is required to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware, software, and firmware.'),\n('003330','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant firmware.','SA-17(04)(d)','N/A','Determine if the developer of the system, system component, or system service is required to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware, software, and firmware.'),\n('003331','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to describe the security-relevant hardware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant hardware.','SA-17(04)(e)','N/A','Determine if the developer of the system, system component, or system service is required to describe the security-relevant hardware, software, and firmware mechanisms that are not addressed in the descriptive top-level specification but are strictly internal to the security-relevant hardware, software, and firmware.'),\n('003332','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to describe the security-relevant software mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant software.','SA-17(04)(e)','N/A','Determine if the developer of the system, system component, or system service is required to describe the security-relevant hardware, software, and firmware mechanisms that are not addressed in the descriptive top-level specification but are strictly internal to the security-relevant hardware, software, and firmware.'),\n('003333','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to describe the security-relevant firmware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant firmware.','SA-17(04)(e)','N/A','Determine if the developer of the system, system component, or system service is required to describe the security-relevant hardware, software, and firmware mechanisms that are not addressed in the descriptive top-level specification but are strictly internal to the security-relevant hardware, software, and firmware.'),\n('003334','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to design and structure the security-relevant hardware to use a complete, conceptually simple protection mechanism with precisely defined semantics.','SA-17(05)(a)','N/A','Determine if the developer of the system, system component, or system service is required to design and structure the security-relevant hardware, software, and firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics.'),\n('003335','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to design and structure the security-relevant software to use a complete, conceptually simple protection mechanism with precisely defined semantics.','SA-17(05)(a)','N/A','Determine if the developer of the system, system component, or system service is required to design and structure the security-relevant hardware, software, and firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics.'),\n('003336','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to design and structure the security-relevant firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics.','SA-17(05)(a)','N/A','Determine if the developer of the system, system component, or system service is required to design and structure the security-relevant hardware, software, and firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics.'),\n('003337','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to internally structure the security-relevant hardware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.','SA-17(05)(b)','N/A','Determine if the developer of the system, system component, or system service is required to internally structure the security-relevant hardware, software, and firmware with specific regard for this mechanism.'),\n('003338','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to internally structure the security-relevant software with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.','SA-17(05)(b)','N/A','Determine if the developer of the system, system component, or system service is required to internally structure the security-relevant hardware, software, and firmware with specific regard for this mechanism.'),\n('003339','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, system component, or system service to internally structure the security-relevant firmware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics.','SA-17(05)(b)','N/A','Determine if the developer of the system, system component, or system service is required to internally structure the security-relevant hardware, software, and firmware with specific regard for this mechanism.'),\n('003340','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, component, or system service to structure security-relevant hardware to facilitate testing.','SA-17(06)','N/A','Determine if the developer of the system, system component, or system service is required to structure security-relevant hardware, software, and firmware to facilitate testing.'),\n('003341','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, component, or system service to structure security-relevant software to facilitate testing.','SA-17(06)','N/A','Determine if the developer of the system, system component, or system service is required to structure security-relevant hardware, software, and firmware to facilitate testing.'),\n('003342','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, component, or system service to structure security-relevant firmware to facilitate testing.','SA-17(06)','N/A','Determine if the developer of the system, system component, or system service is required to structure security-relevant hardware, software, and firmware to facilitate testing.'),\n('003343','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, component, or system service to structure security-relevant hardware to facilitate controlling access with least privilege.','SA-17(07)','N/A','Determine if the developer of the system, system component, or system service is required to structure security-relevant hardware, software, and firmware to facilitate controlling access with least privilege.'),\n('003344','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, component, or system service to structure security-relevant software to facilitate controlling access with least privilege.','SA-17(07)','N/A','Determine if the developer of the system, system component, or system service is required to structure security-relevant hardware, software, and firmware to facilitate controlling access with least privilege.'),\n('003345','draft','2013-10-03','DISA FSO','policy','Require the developer of the system, component, or system service to structure security-relevant firmware to facilitate controlling access with least privilege.','SA-17(07)','N/A','Determine if the developer of the system, system component, or system service is required to structure security-relevant hardware, software, and firmware to facilitate controlling access with least privilege.'),\n('003372','draft','2013-10-03','DISA FSO','policy','Define the support from external providers to be provided for alternative sources for continued support for unsupported system components.','SA-22b.','N/A','Determine if [SA-22_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {in-house support; [SA-22_ODP[02]; support from external providers is defined (if selected)]}] provide options for alternative sources for continued support for unsupported components.'),\n('003373','draft','2013-10-03','DISA FSO','policy','Provide in-house support and/or organization-defined support from external providers for alternative sources for continued support for unsupported components.','SA-22b.','N/A','Determine if [SA-22_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {in-house support; [SA-22_ODP[02]; support from external providers is defined (if selected)]}] provide options for alternative sources for continued support for unsupported components.'),\n('003376','draft','2013-10-03','DISA FSO','policy','Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer.','SA-22a.','N/A','Determine if system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer.'),\n('003381','draft','2013-10-03','DISA FSO','policy','Defines additional personnel screening criteria that must be satisfied by the developer of an organization-defined system, system component, or system service.','SA-21b.','N/A','Determine if the developer of [SA-21_ODP[01]; the system, systems component, or system service that the developer has access to is/are defined] is required to satisfy [SA-21_ODP[03]; additional personnel screening criteria for the developer are defined].'),\n('003382','draft','2013-10-03','DISA FSO','policy','Require that the developer of an organization-defined system, system component, or system service satisfies organization-defined additional personnel screening criteria.','SA-21b.','N/A','Determine if the developer of [SA-21_ODP[01]; the system, systems component, or system service that the developer has access to is/are defined] is required to satisfy [SA-21_ODP[03]; additional personnel screening criteria for the developer are defined].'),\n('003383','draft','2013-10-03','DISA FSO','policy','Defines the official government duties to be assigned to the developer of an organization-defined system, system component, or system service.','SA-21a.','N/A','Determine if the developer of [SA-21_ODP[01]; the system, systems component, or system service that the developer has access to is/are defined] is required to have appropriate access authorizations as determined by assigned [SA-21_ODP[02]; official government duties assigned to the developer are defined].'),\n('003384','draft','2013-10-03','DISA FSO','policy','Defines the system, system component, or system service which requires the system developer to have appropriate access authorizations, satisfy additional personnel screening criteria, and provide information that the access authorizations and screening criteria are satisfied.',NULL,'N/A',NULL),\n('003385','draft','2013-10-03','DISA FSO','policy','Require that the developer of an organization-defined system, system component, or system service has appropriate access authorizations as determined by assigned organization-defined official government duties.','SA-21a.','N/A','Determine if the developer of [SA-21_ODP[01]; the system, systems component, or system service that the developer has access to is/are defined] is required to have appropriate access authorizations as determined by assigned [SA-21_ODP[02]; official government duties assigned to the developer are defined].'),\n('003386','draft','2013-10-03','DISA FSO','policy','Defines the critical system components to re-implement or custom develop.','SA-20','N/A','Determine if [SA-20_ODP; critical system components to be reimplemented or custom-developed are defined] are reimplemented or custom-developed.'),\n('003387','draft','2013-10-03','DISA FSO','policy','Re-implement or custom develops organization-defined critical system components.','SA-20','N/A','Determine if [SA-20_ODP; critical system components to be reimplemented or custom-developed are defined] are reimplemented or custom-developed.'),\n('003601','draft','2022-03-01','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system-level access control policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','AC-01a.01(b)','N/A','Determine if the [AC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] access control policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('003602','draft','2022-03-01','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system-level access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','AC-01a.01(a)','N/A','Determine if: - the [AC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] access control policy addresses purpose. - the [AC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] access control policy addresses scope. - the [AC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] access control policy addresses roles. - the [AC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] access control policy addresses responsibilities. - the [AC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] access control policy addresses management commitment. - the [AC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] access control policy addresses coordination among organizational entities. - the [AC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] access control policy addresses compliance.'),\n('003603','draft','2022-03-01','DISA','policy','Disseminate the organization-level; mission/business process-level; and/or system-level access control policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines to organization-defined personnel or roles.','AC-01a.01(b)','N/A','Determine if the [AC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] access control policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('003604','draft','2022-03-01','DISA','policy','Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and the associated access control.','AC-01a.02','N/A','Determine if: - access control procedures to facilitate the implementation of the access control policy and associated controls are developed and documented. - the access control procedures are disseminated to [AC-01_ODP[02]; personnel or roles to whom the access control procedures are to be disseminated is/are defined].'),\n('003605','draft','2022-03-01','DISA','policy','Designate an organization-defined official to manage the development and documentation of the access control policy and procedures.','AC-01b.','N/A','Determine if the [AC-01_ODP[04]; an official to manage the access control policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the access control policy and procedures.'),\n('003606','draft','2022-03-01','DISA','policy','Designate an organization-defined official to manage the dissemination of the access control policy and procedures.','AC-01b.','N/A','Determine if the [AC-01_ODP[04]; an official to manage the access control policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the access control policy and procedures.'),\n('003607','draft','2022-03-01','DISA','policy','Defines the official designated to manage the development, documentation, and dissemination of the access control policy and procedures.','AC-01b.','N/A','Determine if the [AC-01_ODP[04]; an official to manage the access control policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the access control policy and procedures.'),\n('003608','draft','2022-03-01','DISA','policy','Review and update the current access control policy following organization-defined events.','AC-01c.01','N/A','Determine if: - the current access control policy is reviewed and updated [AC-01_ODP[05]; the frequency at which the current access control policy is reviewed and updated is defined]. - the current access control policy is reviewed and updated following [AC-01_ODP[06]; events that would require the current access control policy to be reviewed and updated are defined].'),\n('003609','draft','2022-03-01','DISA','policy','Defines the events following reviewing and updating the current access control policy.','AC-01c.01','N/A','Determine if: - the current access control policy is reviewed and updated [AC-01_ODP[05]; the frequency at which the current access control policy is reviewed and updated is defined]. - the current access control policy is reviewed and updated following [AC-01_ODP[06]; events that would require the current access control policy to be reviewed and updated are defined].'),\n('003610','draft','2022-03-01','DISA','policy','Review and update the current access control procedures following organization-defined events.','AC-01c.02','N/A','Determine if: - the current access control procedures are reviewed and updated [AC-01_ODP[07]; the frequency at which the current access control procedures are reviewed and updated is defined;]. - the current access control procedures are reviewed and updated following [AC-01_ODP[08]; events that would require procedures to be reviewed and updated are defined].'),\n('003611','draft','2022-03-01','DISA','policy','Defines the events following reviewing and updating the current access control procedures.','AC-01c.02','N/A','Determine if: - the current access control procedures are reviewed and updated [AC-01_ODP[07]; the frequency at which the current access control procedures are reviewed and updated is defined;]. - the current access control procedures are reviewed and updated following [AC-01_ODP[08]; events that would require procedures to be reviewed and updated are defined].'),\n('003612','draft','2022-03-01','DISA','policy','Define and document the types of accounts allowed and specifically prohibited for use within the system.','AC-02a.','N/A','Determine if: - account types allowed for use within the system are defined and documented. - account types specifically prohibited for use within the system are defined and documented.'),\n('003613','draft','2022-03-01','DISA','policy','Require organization-defined prerequisites and criteria for group membership.','AC-02c.','N/A','Determine if [AC-02_ODP[01]; prerequisites and criteria for group and role membership are defined] for group and role membership are required.'),\n('003614','draft','2022-03-01','DISA','policy','Require organization-defined prerequisites and criteria for role membership.','AC-02c.','N/A','Determine if [AC-02_ODP[01]; prerequisites and criteria for group and role membership are defined] for group and role membership are required.'),\n('003615','draft','2022-03-01','DISA','policy','Defines the prerequisites and criteria for group and role membership.','AC-02c.','N/A','Determine if [AC-02_ODP[01]; prerequisites and criteria for group and role membership are defined] for group and role membership are required.'),\n('003616','draft','2022-03-01','DISA','policy','Defines the attributes (as required) for each account.','AC-02d.03','N/A','Determine if: - access authorizations (i.e., privileges) are specified for each account. - [AC-02_ODP[02]; attributes (as required) for each account are defined] are specified for each account. '),\n('003617','draft','2022-03-01','DISA','policy','Create, enable, modify, disable, and remove system accounts in accordance with organization-defined policy.','AC-02f.','N/A','Determine if: - accounts are created in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are enabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are modified in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are disabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are removed in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined].'),\n('003618','draft','2022-03-01','DISA','policy','Create, enable, modify, disable, and remove system accounts in accordance with organization-defined criteria.','AC-02f.','N/A','Determine if: - accounts are created in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are enabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are modified in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are disabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are removed in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined].'),\n('003619','draft','2022-03-01','DISA','policy','Create, enable, modify, disable, and remove system accounts in accordance with organization-defined prerequisites.','AC-02f.','N/A','Determine if: - accounts are created in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are enabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are modified in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are disabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are removed in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined].'),\n('003620','draft','2022-03-01','DISA','policy','Defines the policy to be employed when creating, enabling, modifying, disabling, and removing information system accounts.','AC-02f.','N/A','Determine if: - accounts are created in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are enabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are modified in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are disabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are removed in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined].'),\n('003621','draft','2022-03-01','DISA','policy','Defines the prerequisites to be employed when creating, enabling, modifying, disabling, and removing information system accounts.','AC-02f.','N/A','Determine if: - accounts are created in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are enabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are modified in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are disabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are removed in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined].'),\n('003622','draft','2022-03-01','DISA','policy','Defines the criteria to be employed when creating, enabling, modifying, disabling, and removing information system accounts.','AC-02f.','N/A','Determine if: - accounts are created in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are enabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are modified in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are disabled in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined]. - accounts are removed in accordance with [AC-02_ODP[04]; policy, procedures, prerequisites, and criteria for account creation, enabling, modification, disabling, and removal are defined].'),\n('003623','draft','2022-03-01','DISA','policy','Defines the personnel or roles of whom to notify when accounts are no longer required; when users are terminated or transferred; and when system usage or need-to-know changes for an individual.',NULL,'N/A',NULL),\n('003624','draft','2022-03-01','DISA','policy','Defines the time period of when to notify account managers for each situation.',NULL,'N/A',NULL),\n('003625','draft','2022-03-01','DISA','policy','Defines the attributes (as required) for authorizing access to the system.','AC-02i.03','N/A','Determine if access to the system is authorized based on [AC-02_ODP[09]; attributes needed to authorize system access (as required) are defined].'),\n('003626','draft','2022-03-01','DISA','policy','Align account management processes with personnel termination and transfer processes.','AC-02l.','N/A','Determine if: - account management processes are aligned with personnel termination processes. - account management processes are aligned with personnel transfer processes.'),\n('003627','draft','2022-03-01','DISA','technical','Disable accounts when the accounts have expired.','AC-02(03)(a)','N/A','Determine if accounts are disabled within [AC-02(03)_ODP[01]; time period within which to disable accounts is defined] when the accounts have expired.'),\n('003628','draft','2022-03-01','DISA','technical','Disable accounts when the accounts are no longer associated to a user.','AC-02(03)(b)','N/A','Determine if accounts are disabled within [AC-02(03)_ODP[01]; time period within which to disable accounts is defined] when the accounts are no longer associated with a user or individual.'),\n('003629','draft','2022-03-01','DISA','technical','Disable accounts when the accounts are in violation of organizational policy.','AC-02(03)(c)','N/A','Determine if accounts are disabled within [AC-02(03)_ODP[01]; time period within which to disable accounts is defined] when the accounts are in violation of organizational policy.'),\n('003630','draft','2022-03-01','DISA','policy','Monitor changes to roles or attributes.','AC-02(07)(c)','N/A','Determine if changes to roles or attributes are monitored.'),\n('003631','draft','2022-03-01','DISA','technical','Defines the system accounts that can be dynamically activated.','AC-02(08)','N/A','Determine if: - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are created dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are activated dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are managed dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are deactivated dynamically.'),\n('003632','draft','2022-03-01','DISA','technical','Activate organization-defined system accounts dynamically.','AC-02(08)','N/A','Determine if: - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are created dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are activated dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are managed dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are deactivated dynamically.'),\n('003633','draft','2022-03-01','DISA','technical','Defines the system accounts that can be dynamically managed.','AC-02(08)','N/A','Determine if: - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are created dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are activated dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are managed dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are deactivated dynamically.'),\n('003634','draft','2022-03-01','DISA','technical','Manage organization-defined system accounts dynamically.','AC-02(08)','N/A','Determine if: - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are created dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are activated dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are managed dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are deactivated dynamically.'),\n('003635','draft','2022-03-01','DISA','technical','Defines the system accounts that can be dynamically deactivated.','AC-02(08)','N/A','Determine if: - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are created dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are activated dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are managed dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are deactivated dynamically.'),\n('003636','draft','2022-03-01','DISA','technical','Deactivate organization-defined system accounts dynamically.','AC-02(08)','N/A','Determine if: - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are created dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are activated dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are managed dynamically. - [AC-02(08)_ODP; system accounts that are dynamically created, activated, managed, and deactivated are defined] are deactivated dynamically.'),\n('003637','draft','2022-03-01','DISA','policy','Defines the significant risks that may be discovered requiring disabled accounts of individuals.','AC-02(13)','N/A','Determine if accounts of individuals are disabled within [AC-02(13)_ODP[01]; time period within which to disable accounts of individuals who are discovered to pose significant risk is defined] of discovery of [AC-02(13)_ODP[02]; significant risks leading to disabling accounts are defined].'),\n('003638','draft','2022-03-01','DISA','technical','Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can pass the information to any other subjects or objects.','AC-03(04)(a)','N/A','Determine if [AC-03(04)_ODP[01]; discretionary access control policy enforced over the set of covered subjects is defined] and [AC-03(04)_ODP[02]; discretionary access control policy enforced over the set of covered objects is defined] are enforced where the policy specifies that a subject that has been granted access to information can pass the information to any other subjects or objects.'),\n('003639','draft','2022-03-01','DISA','technical','Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can grant its privileges to other subjects.','AC-03(04)(b)','N/A','Determine if [AC-03(04)_ODP[01]; discretionary access control policy enforced over the set of covered subjects is defined] and [AC-03(04)_ODP[02]; discretionary access control policy enforced over the set of covered objects is defined] are enforced where the policy specifies that a subject that has been granted access to information can grant its privileges to other subjects.'),\n('003640','draft','2022-03-01','DISA','technical','Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can change security attributes on subjects, objects, the system, or the system''s components.','AC-03(04)(c)','N/A','Determine if [AC-03(04)_ODP[01]; discretionary access control policy enforced over the set of covered subjects is defined] and [AC-03(04)_ODP[02]; discretionary access control policy enforced over the set of covered objects is defined] are enforced where the policy specifies that a subject that has been granted access to information can change security attributes on subjects, objects, the system, or the system''s components.'),\n('003641','draft','2022-03-01','DISA','technical','Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can choose the security attributes to be associated with newly created or revised objects.','AC-03(04)(d)','N/A','Determine if [AC-03(04)_ODP[01]; discretionary access control policy enforced over the set of covered subjects is defined] and [AC-03(04)_ODP[02]; discretionary access control policy enforced over the set of covered objects is defined] are enforced where the policy specifies that a subject that has been granted access to information can choose the security attributes to be associated with newly created or revised objects.'),\n('003642','draft','2022-03-01','DISA','technical','Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can change the rules governing access control.','AC-03(04)(e)','N/A','Determine if [AC-03(04)_ODP[01]; discretionary access control policy enforced over the set of covered subjects is defined] and [AC-03(04)_ODP[02]; discretionary access control policy enforced over the set of covered objects is defined] are enforced where the policy specifies that a subject that has been granted access to information can change the rules governing access control.'),\n('003643','draft','2022-03-01','DISA','policy','Defines the organization-defined roles for which it will employ an audited override of automated access control mechanisms.','AC-03(10)','N/A','Determine if an audited override of automated access control mechanisms is employed under [AC-03(10)_ODP[01]; conditions under which to employ an audited override of automated access control mechanisms are defined] by [AC-03(10)_ODP[02]; roles allowed to employ an audited override of automated access control mechanisms are defined].'),\n('003644','draft','2022-03-01','DISA','technical','Restrict direct access to data repositories containing organization-defined information types.','AC-03(11)','N/A','Determine if access to data repositories containing [AC-03(11)_ODP; information types requiring restricted access to data repositories are defined] is restricted.'),\n('003645','draft','2022-03-01','DISA','technical','Defines the information types of which to restrict direct access to data repositories.','AC-03(11)','N/A','Determine if access to data repositories containing [AC-03(11)_ODP; information types requiring restricted access to data repositories are defined] is restricted.'),\n('003646','draft','2022-03-01','DISA','technical','Require applications to assert, as part of the installation process, the access needed to the organization-defined system applications and functions.','AC-03(12)(a)','N/A','Determine if as part of the installation process, applications are required to assert the access needed to the following system applications and functions: [AC-03(12)_ODP; system applications and functions requiring access assertion are defined].'),\n('003647','draft','2022-03-01','DISA','technical','Defines the organization-defined system applications and functions as required of the applications as part of the installation process.','AC-03(12)(a)','N/A','Determine if as part of the installation process, applications are required to assert the access needed to the following system applications and functions: [AC-03(12)_ODP; system applications and functions requiring access assertion are defined].'),\n('003648','draft','2022-03-01','DISA','technical','Require applications to provide an enforcement mechanism to prevent other-than-asserted access.','AC-03(12)(b)','N/A','Determine if an enforcement mechanism to prevent unauthorized access is provided.'),\n('003649','draft','2022-03-01','DISA','technical','Approve access changed after initial installations of the application.','AC-03(12)(c)','N/A','Determine if access changes after initial installation of the application are approved.'),\n('003650','draft','2022-03-01','DISA','technical','Enforce attribute-based access control policy over defined subjects and objects based upon organization-defined attributes to assume access permissions.','AC-03(13)','N/A','Determine if: - the attribute-based access control policy is enforced over defined subjects. - the attribute-based access control policy is enforced over defined objects. - access is controlled based on [AC-03(13)_ODP; attributes to assume access permissions are defined].'),\n('003651','draft','2022-03-01','DISA','technical','Defines the attributes to assume access permissions for enforcing attribute-based access control policy.','AC-03(13)','N/A','Determine if: - the attribute-based access control policy is enforced over defined subjects. - the attribute-based access control policy is enforced over defined objects. - access is controlled based on [AC-03(13)_ODP; attributes to assume access permissions are defined].'),\n('003652','draft','2022-03-01','DISA','technical','Enforce attribute-based control access over defined subjects and objects based upon organization-defined attributes to assume access permissions.','AC-03(13)','N/A','Determine if: - the attribute-based access control policy is enforced over defined subjects. - the attribute-based access control policy is enforced over defined objects. - access is controlled based on [AC-03(13)_ODP; attributes to assume access permissions are defined].'),\n('003653','draft','2022-03-01','DISA','technical','Defines the attributes to assume access permissions for enforcing attribute-based control access.','AC-03(13)','N/A','Determine if: - the attribute-based access control policy is enforced over defined subjects. - the attribute-based access control policy is enforced over defined objects. - access is controlled based on [AC-03(13)_ODP; attributes to assume access permissions are defined].'),\n('003654','draft','2022-03-01','DISA','technical','Provide organization-defined mechanisms to enable individuals to have access to the following elements of their personally identifiable information: organization-defined elements.','AC-03(14)','N/A','Determine if [AC-03(14)_ODP[01]; mechanisms enabling individuals to have access to elements of their personally identifiable information are defined] are provided to enable individuals to have access to [AC-03(14)_ODP[02]; elements of personally identifiable information to which individuals have access are defined] of their personally identifiable information.'),\n('003655','draft','2022-03-01','DISA','technical','Defines the mechanisms to be provided for access to elements of personally identifiable information.','AC-03(14)','N/A','Determine if [AC-03(14)_ODP[01]; mechanisms enabling individuals to have access to elements of their personally identifiable information are defined] are provided to enable individuals to have access to [AC-03(14)_ODP[02]; elements of personally identifiable information to which individuals have access are defined] of their personally identifiable information.'),\n('003656','draft','2022-03-01','DISA','technical','Defines the elements of personally identifiable information.','AC-03(14)','N/A','Determine if [AC-03(14)_ODP[01]; mechanisms enabling individuals to have access to elements of their personally identifiable information are defined] are provided to enable individuals to have access to [AC-03(14)_ODP[02]; elements of personally identifiable information to which individuals have access are defined] of their personally identifiable information.'),\n('003657','draft','2022-03-01','DISA','technical','Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy.','AC-03(15)(a)','N/A','Determine if: - [AC-03(15)_ODP[01]; a mandatory access control policy enforced over the set of covered subjects specified in the policy is defined] is enforced over the set of covered subjects specified in the policy. - [AC-03(15)_ODP[02]; a mandatory access control policy enforced over the set of covered objects specified in the policy is defined] is enforced over the set of covered objects specified in the policy.'),\n('003658','deprecated','2022-03-01','DISA','technical','Defines the mandatory access control policies that are to be enforced over all subjects and objects.','AC-03(15)(a)','N/A','Determine if: - [AC-03(15)_ODP[01]; a mandatory access control policy enforced over the set of covered subjects specified in the policy is defined] is enforced over the set of covered subjects specified in the policy. - [AC-03(15)_ODP[02]; a mandatory access control policy enforced over the set of covered objects specified in the policy is defined] is enforced over the set of covered objects specified in the policy.'),\n('003659','draft','2022-03-01','DISA','technical','Enforce organization-defined discretionary access control policy over the set of covered subjects and objects specified in the policy.','AC-03(15)(b)','N/A','Determine if: - [AC-03(15)_ODP[03]; a discretionary access control policy enforced over the set of covered subjects specified in the policy is defined] is enforced over the set of covered subjects specified in the policy. - [AC-03(15)_ODP[04]; a discretionary access control policy enforced over the set of covered objects specified in the policy is defined] is enforced over the set of covered objects specified in the policy.'),\n('003660','draft','2022-03-01','DISA','technical','Defines the discretionary access control policies the system is to enforce over subjects and objects.','AC-03(15)(b)','N/A','Determine if: - [AC-03(15)_ODP[03]; a discretionary access control policy enforced over the set of covered subjects specified in the policy is defined] is enforced over the set of covered subjects specified in the policy. - [AC-03(15)_ODP[04]; a discretionary access control policy enforced over the set of covered objects specified in the policy is defined] is enforced over the set of covered objects specified in the policy.'),\n('003661','draft','2022-03-01','DISA','technical','Defines the privacy attributes to be used to enforce organization-defined information flow control policies.','AC-04(01)','N/A','Determine if: - [AC-04(01)_ODP[01]; security attributes to be associated with information, source, and destination objects are defined] associated with [AC-04(01)_ODP[03]; information objects to be associated with information security attributes are defined], [AC-04(01)_ODP[05]; source objects to be associated with information security attributes are defined], and [AC-04(01)_ODP[07]; destination objects to be associated with information security attributes are defined] are used to enforce [AC-04(01)_ODP[09]; information flow control policies as a basis for enforcement of flow control decisions are defined] as a basis for flow control decisions. - [AC-04(01)_ODP[02]; privacy attributes to be associated with information, source, and destination objects are defined] associated with [AC-04(01)_ODP[04]; information objects to be associated with privacy attributes are defined], [AC-04(01)_ODP[06]; source objects to be associated with privacy attributes are defined], and [AC-04(01)_ODP[08]; destination objects to be associated with privacy attributes are defined] are used to enforce [AC-04(01)_ODP[09]; information flow control policies as a basis for enforcement of flow control decisions are defined] as a basis for flow control decisions.'),\n('003662','draft','2022-03-01','DISA','policy','Defines the information flow control mechanisms to prevent the bypassing of encrypted information.','AC-04(04)','N/A','Determine if encrypted information is prevented from bypassing [AC-04(04)_ODP[01]; information flow control mechanisms that encrypted information is prevented from bypassing are defined] by [AC-04(04)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {decrypting the information; blocking the flow of the encrypted information; terminating communications sessions attempting to pass encrypted information; [AC-04(04)_ODP[03]; the organization-defined procedure or method used to prevent encrypted information from bypassing information flow control mechanisms is defined (if selected)]].'),\n('003663','draft','2022-03-01','DISA','technical','Enforce information flow control using organization-defined privacy policy filters as a basis for flow control decisions for organization-defined information flows.','AC-04(08)(a)','N/A','Determine if: - information flow control is enforced using [AC-04(08)_ODP[01]; security policy filters to be used as a basis for enforcing information flow control are defined] as a basis for flow control decisions for [AC-04(08)_ODP[03]; information flows for which information flow control is enforced by security filters are defined]. - information flow control is enforced using [AC-04(08)_ODP[02]; privacy policy filters to be used as a basis for enforcing information flow control are defined] as a basis for flow control decisions for [AC-04(08)_ODP[04]; information flows for which information flow control is enforced by privacy filters are defined].'),\n('003664','draft','2022-03-01','DISA','technical','Enforce information flow control using block; strip; modify and/or quarantine data after a filter processing failure in accordance with organization-defined security or privacy policy.','AC-04(08)(b)','N/A','Determine if [AC-04(08)_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {block; strip; modify; quarantine}] data after a filter processing failure in accordance with [AC-04(08)_ODP[06]; security policy identifying actions to be taken after a filter processing failure are defined]; [AC-04(08)_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {block; strip; modify; quarantine}] data after a filter processing failure in accordance with [AC-04(08)_ODP[07]; privacy policy identifying actions to be taken after a filter processing failure are defined].'),\n('003665','draft','2022-03-01','DISA','technical','Defines the security or privacy policy to be enforced using block; strip; modify and/or quarantine data after a filter processing failure.','AC-04(08)(b)','N/A','Determine if [AC-04(08)_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {block; strip; modify; quarantine}] data after a filter processing failure in accordance with [AC-04(08)_ODP[06]; security policy identifying actions to be taken after a filter processing failure are defined]; [AC-04(08)_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {block; strip; modify; quarantine}] data after a filter processing failure in accordance with [AC-04(08)_ODP[07]; privacy policy identifying actions to be taken after a filter processing failure are defined].'),\n('003666','draft','2022-03-01','DISA','technical','Defines the security or privacy policy filters implemented when transferring information between security domains.','AC-04(19)','N/A','Determine if: - when transferring information between different security domains, [AC-04(19)_ODP[01]; security policy filters to be implemented on metadata are defined (if selected)] are implemented on metadata. - when transferring information between different security domains, [AC-04(19)_ODP[02]; privacy policy filters to be implemented on metadata are defined (if selected)] are implemented on metadata.'),\n('003667','draft','2022-03-01','DISA','policy','When transferring information between security domains, modify non-releasable information by implementing organization-defined modification action.','AC-04(23)','N/A','Determine if when transferring information between security domains, non-releasable information is modified by implementing [AC-04(23)_ODP; modification action implemented on non-releasable information is defined].'),\n('003668','draft','2022-03-01','DISA','policy','Defines the modification action when transferring information between different security domains.','AC-04(23)','N/A','Determine if when transferring information between security domains, non-releasable information is modified by implementing [AC-04(23)_ODP; modification action implemented on non-releasable information is defined].'),\n('003669','draft','2022-03-01','DISA','technical','When transferring information between different security domains, parse incoming data into an internal normalized format.','AC-04(24)','N/A','Determine if: - when transferring information between different security domains, incoming data is parsed into an internal, normalized format. - when transferring information between different security domains, the data is regenerated to be consistent with its intended specification.'),\n('003670','draft','2022-03-01','DISA','technical','When transferring information between different security domains, regenerate the data to be consistent with its intended specification.','AC-04(24)','N/A','Determine if: - when transferring information between different security domains, incoming data is parsed into an internal, normalized format. - when transferring information between different security domains, the data is regenerated to be consistent with its intended specification.'),\n('003671','draft','2022-03-01','DISA','technical','When transferring information between different security domains, sanitize data to minimize delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography encoded data; spillage of sensitive information in accordance with organization-defined policy.','AC-04(25)','N/A','Determine if when transferring information between different security domains, data is sanitized to minimize [AC-04(25)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography-encoded data; spillage of sensitive information}] in accordance with [AC-04(25)_ODP[02]; policy for sanitizing data is defined].'),\n('003672','draft','2022-03-01','DISA','technical','Defines the policy when transferring information between different security domains.','AC-04(25)','N/A','Determine if when transferring information between different security domains, data is sanitized to minimize [AC-04(25)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography-encoded data; spillage of sensitive information}] in accordance with [AC-04(25)_ODP[02]; policy for sanitizing data is defined].'),\n('003673','draft','2022-03-01','DISA','policy','When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.','AC-04(26)','N/A','Determine if: - when transferring information between different security domains, content-filtering actions are recorded and audited. - when transferring information between different security domains, results for the information being filtered are recorded and audited.'),\n('003674','draft','2022-03-01','DISA','technical','When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type.','AC-04(27)','N/A','Determine if when transferring information between security domains, implemented content filtering solutions provide redundant and independent filtering mechanisms for each data type.'),\n('003675','draft','2022-03-01','DISA','technical','When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.','AC-04(28)','N/A','Determine if when transferring information between security domains, a linear content filter pipeline is implemented that is enforced with discretionary and mandatory access controls.'),\n('003676','draft','2022-03-01','DISA','policy','When transferring information between different security domains, employ content filter orchestration engines to ensure that content filtering mechanisms successfully complete execution without errors.','AC-04(29)(a)','N/A','Determine if when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering mechanisms successfully complete execution without errors.'),\n('003677','draft','2022-03-01','DISA','policy','When transferring information between different security domains, employ content filter orchestration engines to ensure that content filtering actions occur in the correct order and comply with organization-defined policy.','AC-04(29)(b)','N/A','Determine if: - when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering actions occur in the correct order. - when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering actions comply with [AC-04(29)_ODP; policy for content-filtering actions is defined].'),\n('003678','draft','2022-03-01','DISA','technical','When transferring information between different security domains, implement content filtering mechanisms using multiple processes.','AC-04(30)','N/A','Determine if when transferring information between security domains, content-filtering mechanisms using multiple processes are implemented.'),\n('003679','draft','2022-03-01','DISA','technical','When transferring information between different security domains, prevent the transfer of failed content to the receiving domain.','AC-04(31)','N/A','Determine if when transferring information between different security domains, the transfer of failed content to the receiving domain is prevented.'),\n('003680','draft','2022-03-01','DISA','technical','When transferring information between different security domains, the process that transfers information between filter pipelines does not filter message content.','AC-04(32)(a)','N/A','Determine if when transferring information between different security domains, the process that transfers information between filter pipelines does not filter message content.'),\n('003681','draft','2022-03-01','DISA','technical','When transferring information between different security domains, the process that transfers information between filter pipelines validates filtering metadata.','AC-04(32)(b)','N/A','Determine if when transferring information between different security domains, the process that transfers information between filter pipelines validates filtering metadata.'),\n('003682','draft','2022-03-01','DISA','technical','When transferring information between different security domains, the process that transfers information between filter pipelines ensures the content associated with the filtering metadata has successfully completed filtering.','AC-04(32)(c)','N/A','Determine if when transferring information between different security domains, the process that transfers information between filter pipelines ensures that the content with the filtering metadata has successfully completed filtering.'),\n('003683','draft','2022-03-01','DISA','technical','When transferring information between different security domains, the process that transfers information between filter pipelines transfers the content to the destination filter pipeline.','AC-04(32)(d)','N/A','Determine if when transferring information between different security domains, the process that transfers information between filter pipelines transfers the content to the destination filter pipeline.'),\n('003684','draft','2022-03-01','DISA','policy','Identify and document organization-defined duties of individuals requiring separation.','AC-05b.','N/A','Determine if system access authorizations to support separation of duties are defined.'),\n('003685','draft','2022-03-01','DISA','policy','Defines the individuals or roles who authorize access to organization-defined security functions.','AC-06(01)(a)','N/A','Determine if: - access is authorized for [AC-06(01)_ODP[01]; individuals and roles with authorized access to security functions and security-relevant information are defined] to [AC-06(01)_ODP[02]; security functions (deployed in hardware) for authorized access are defined]. - access is authorized for [AC-06(01)_ODP[01]; individuals and roles with authorized access to security functions and security-relevant information are defined] to [AC-06(01)_ODP[03]; security functions (deployed in software) for authorized access are defined]. - access is authorized for [AC-06(01)_ODP[01]; individuals and roles with authorized access to security functions and security-relevant information are defined] to [AC-06(01)_ODP[04]; security functions (deployed in firmware) for authorized access are defined].'),\n('003686','draft','2022-03-01','DISA','policy','Defines the individuals or roles who authorize access to organization-defined security-relevant information.','AC-06(01)(b)','N/A','Determine if access is authorized for [AC-06(01)_ODP[01]; individuals and roles with authorized access to security functions and security-relevant information are defined] to [AC-06(01)_ODP[05]; security-relevant information for authorized access is defined].'),\n('003687','draft','2022-03-01','DISA','policy','Limit the number of unsuccessful biometric logon attempts to an organization-defined number.','AC-07(03)','N/A','Determine if unsuccessful biometric logon attempts are limited to [AC-07(03)_ODP; the number of unsuccessful biometric logon attempts is defined].'),\n('003688','draft','2022-03-01','DISA','policy','Defines the number of allowed unsuccessful biometric logon attempts.','AC-07(03)','N/A','Determine if unsuccessful biometric logon attempts are limited to [AC-07(03)_ODP; the number of unsuccessful biometric logon attempts is defined].'),\n('003689','draft','2022-03-01','DISA','policy','Allow the use of organization-defined authentication factors that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded.','AC-07(04)(a)','N/A','Determine if [AC-07(04)_ODP[01]; authentication factors allowed to be used that are different from the primary authentication factors are defined] that are different from the primary authentication factors are allowed to be used after the number of organization-defined consecutive invalid logon attempts have been exceeded.'),\n('003690','draft','2022-03-01','DISA','policy','Defines the authentication factors after a number of organization-defined consecutive invalid logon attempts have been executed.','AC-07(04)(a)','N/A','Determine if [AC-07(04)_ODP[01]; authentication factors allowed to be used that are different from the primary authentication factors are defined] that are different from the primary authentication factors are allowed to be used after the number of organization-defined consecutive invalid logon attempts have been exceeded.'),\n('003691','draft','2022-03-01','DISA','policy','Enforce a limit of organization-defined number consecutive invalid logon attempts through use of the alternative factors by a user during a organization-defined time period.','AC-07(04)(b)','N/A','Determine if a limit of [AC-07(04)_ODP[02]; the number of consecutive, invalid logon attempts through the use of alternative factors for which to enforce a limit by a user is defined] consecutive invalid logon attempts through the use of the alternative factors by the user during a [AC-07(04)_ODP[03]; time period during which a user can attempt logons through alternative factors is defined] is enforced.'),\n('003692','draft','2022-03-01','DISA','policy','Defines the number enforced for logon attempts.','AC-07(04)(b)','N/A','Determine if a limit of [AC-07(04)_ODP[02]; the number of consecutive, invalid logon attempts through the use of alternative factors for which to enforce a limit by a user is defined] consecutive invalid logon attempts through the use of the alternative factors by the user during a [AC-07(04)_ODP[03]; time period during which a user can attempt logons through alternative factors is defined] is enforced.'),\n('003693','draft','2022-03-01','DISA','technical','Display an explicit message to users indicating that the session will end at an organization-defined time until end of session.','AC-12(03)','N/A','Determine if an explicit message to users is displayed indicating that the session will end in [AC-12(03)_ODP; time until the end of session for display to users is defined].'),\n('003694','draft','2022-03-01','DISA','technical','Defines the time until end of session, indicating the session will end.','AC-12(03)','N/A','Determine if an explicit message to users is displayed indicating that the session will end in [AC-12(03)_ODP; time until the end of session for display to users is defined].'),\n('003695','draft','2022-03-01','DISA','policy','Defines the user actions that can be performed on the system without identification or authentication consistent with organizational missions/business functions.','AC-14a.','N/A','Determine if [AC-14_ODP; user actions that can be performed on the system without identification or authentication are defined] that can be performed on the system without identification or authentication consistent with organizational mission and business functions are identified.'),\n('003696','draft','2022-03-01','DISA','policy','Defines privacy attributes having organization-defined types of privacy attribute values which are associated with information in storage.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('003697','draft','2022-03-01','DISA','policy','Defines privacy attributes having organization-defined types of privacy attribute values which are associated with information in process.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('003698','draft','2022-03-01','DISA','policy','Defines privacy attributes, having organization-defined types of privacy attribute values, which are associated with information in transmission.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('003699','draft','2022-03-01','DISA','policy','Defines privacy attribute values associated with organization-defined types of privacy attributes for information in storage.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('003700','draft','2022-03-01','DISA','policy','Defines privacy attribute values associated with organization-defined types of privacy attributes for information in process.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('003701','draft','2022-03-01','DISA','policy','Defines privacy attribute values associated with organization-defined types of privacy attributes for information in transmission.','AC-16a.','N/A','Determine if: - the means to associate [AC-16_ODP[01]; types of security attributes to be associated with information security attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[03]; security attribute values for types of security attributes are defined] for information in storage, in process, and/or in transmission are provided. - the means to associate [AC-16_ODP[02]; types of privacy attributes to be associated with privacy attribute values for information in storage, in process, and/or in transmission are defined] with [AC-16_ODP[04]; privacy attribute values for types of privacy attributes are defined] for information in storage, in process, and/or in transmission are provided.'),\n('003702','draft','2022-03-01','DISA','policy','Ensure that the privacy attribute associations are made with the information.','AC-16b.','N/A','Determine if: - attribute associations are made. - attribute associations are retained with the information.'),\n('003703','draft','2022-03-01','DISA','policy','Ensure that the privacy attribute associations are restrained with the information.','AC-16b.','N/A','Determine if: - attribute associations are made. - attribute associations are retained with the information.'),\n('003704','draft','2022-03-01','DISA','policy','Establish the following permitted organization-defined privacy attributes defined in AC-16a for organization-defined systems.','AC-16c.','N/A','Determine if: - the following permitted security attributes are established from the attributes defined in AC-16_ODP[01] for [AC-16_ODP[05]; systems for which permitted security attributes are to be established are defined]: [AC-16_ODP[07]; security attributes defined as part of AC-16a that are permitted for systems are defined]. - the following permitted privacy attributes are established from the attributes defined in AC-16_ODP[02] for [AC-16_ODP[06]; systems for which permitted privacy attributes are to be established are defined]: [AC-16_ODP[08]; privacy attributes defined as part of AC-16a that are permitted for systems are defined].'),\n('003705','draft','2022-03-01','DISA','policy','Defines the privacy attributes that are permitted for organization-defined systems.','AC-16c.','N/A','Determine if: - the following permitted security attributes are established from the attributes defined in AC-16_ODP[01] for [AC-16_ODP[05]; systems for which permitted security attributes are to be established are defined]: [AC-16_ODP[07]; security attributes defined as part of AC-16a that are permitted for systems are defined]. - the following permitted privacy attributes are established from the attributes defined in AC-16_ODP[02] for [AC-16_ODP[06]; systems for which permitted privacy attributes are to be established are defined]: [AC-16_ODP[08]; privacy attributes defined as part of AC-16a that are permitted for systems are defined].'),\n('003706','draft','2022-03-01','DISA','policy','Defines the attribute values or ranges permitted for each of the established privacy attributes.','AC-16d.','N/A','Determine if the following permitted attribute values or ranges for each of the established attributes are determined: [AC-16_ODP[09]; attribute values or ranges for established attributes are defined].'),\n('003707','draft','2022-03-01','DISA','policy','Audit changes to the attributes.','AC-16e.','N/A','Determine if changes to attributes are audited.'),\n('003708','draft','2022-03-01','DISA','policy','Review organization-defined security attributes for applicability on an organization-defined frequency.','AC-16f.','N/A','Determine if: - [AC-16_ODP[07]; security attributes defined as part of AC-16a that are permitted for systems are defined] are reviewed for applicability [AC-16_ODP[10]; the frequency at which to review security attributes for applicability is defined]. - [AC-16_ODP[08]; privacy attributes defined as part of AC-16a that are permitted for systems are defined] are reviewed for applicability [AC-16_ODP[11]; the frequency at which to review privacy attributes for applicability is defined].'),\n('003709','draft','2022-03-01','DISA','policy','Review organization-defined privacy attributes for applicability on an organization-defined frequency.','AC-16f.','N/A','Determine if: - [AC-16_ODP[07]; security attributes defined as part of AC-16a that are permitted for systems are defined] are reviewed for applicability [AC-16_ODP[10]; the frequency at which to review security attributes for applicability is defined]. - [AC-16_ODP[08]; privacy attributes defined as part of AC-16a that are permitted for systems are defined] are reviewed for applicability [AC-16_ODP[11]; the frequency at which to review privacy attributes for applicability is defined].'),\n('003710','draft','2022-03-01','DISA','policy','Defines the security and privacy attributes to be reviewed for applicability.','AC-16f.','N/A','Determine if: - [AC-16_ODP[07]; security attributes defined as part of AC-16a that are permitted for systems are defined] are reviewed for applicability [AC-16_ODP[10]; the frequency at which to review security attributes for applicability is defined]. - [AC-16_ODP[08]; privacy attributes defined as part of AC-16a that are permitted for systems are defined] are reviewed for applicability [AC-16_ODP[11]; the frequency at which to review privacy attributes for applicability is defined].'),\n('003711','draft','2022-03-01','DISA','policy','Defines the frequency of which the security and privacy attributes will be reviewed.','AC-16f.','N/A','Determine if: - [AC-16_ODP[07]; security attributes defined as part of AC-16a that are permitted for systems are defined] are reviewed for applicability [AC-16_ODP[10]; the frequency at which to review security attributes for applicability is defined]. - [AC-16_ODP[08]; privacy attributes defined as part of AC-16a that are permitted for systems are defined] are reviewed for applicability [AC-16_ODP[11]; the frequency at which to review privacy attributes for applicability is defined].'),\n('003712','draft','2022-03-01','DISA','technical','Dynamically associate privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies as information is created and combined.','AC-16(01)','N/A','Determine if: - security attributes are dynamically associated with [AC-16(01)_ODP[01]; subjects with which security attributes are to be dynamically associated as information is created and combined are defined] in accordance with the following security policies as information is created and combined: [AC-16(01)_ODP[05]; security policies requiring dynamic association of security attributes with subjects and objects are defined]. - security attributes are dynamically associated with [AC-16(01)_ODP[02]; objects with which security attributes are to be dynamically associated as information is created and combined are defined] in accordance with the following security policies as information is created and combined: [AC-16(01)_ODP[05]; security policies requiring dynamic association of security attributes with subjects and objects are defined]. - privacy attributes are dynamically associated with [AC-16(01)_ODP[03]; subjects with which privacy attributes are to be dynamically associated as information is created and combined are defined] in accordance with the following privacy policies as information is created and combined: [AC-16(01)_ODP[06]; privacy policies requiring dynamic association of privacy attributes with subjects and objects are defined.] - privacy attributes are dynamically associated with [AC-16(01)_ODP[04]; objects with which privacy attributes are to be dynamically associated as information is created and combined are defined] in accordance with the following privacy policies as information is created and combined: [AC-16(01)_ODP[06]; privacy policies requiring dynamic association of privacy attributes with subjects and objects are defined].'),\n('003713','draft','2022-03-01','DISA','technical','Dynamically associate privacy attributes with organization-defined objects in accordance with organization-defined privacy policies as information is created and combined.','AC-16(01)','N/A','Determine if: - security attributes are dynamically associated with [AC-16(01)_ODP[01]; subjects with which security attributes are to be dynamically associated as information is created and combined are defined] in accordance with the following security policies as information is created and combined: [AC-16(01)_ODP[05]; security policies requiring dynamic association of security attributes with subjects and objects are defined]. - security attributes are dynamically associated with [AC-16(01)_ODP[02]; objects with which security attributes are to be dynamically associated as information is created and combined are defined] in accordance with the following security policies as information is created and combined: [AC-16(01)_ODP[05]; security policies requiring dynamic association of security attributes with subjects and objects are defined]. - privacy attributes are dynamically associated with [AC-16(01)_ODP[03]; subjects with which privacy attributes are to be dynamically associated as information is created and combined are defined] in accordance with the following privacy policies as information is created and combined: [AC-16(01)_ODP[06]; privacy policies requiring dynamic association of privacy attributes with subjects and objects are defined.] - privacy attributes are dynamically associated with [AC-16(01)_ODP[04]; objects with which privacy attributes are to be dynamically associated as information is created and combined are defined] in accordance with the following privacy policies as information is created and combined: [AC-16(01)_ODP[06]; privacy policies requiring dynamic association of privacy attributes with subjects and objects are defined].'),\n('003714','draft','2022-03-01','DISA','technical','Defines the privacy policies to adhere to when dynamically associating security attributes with organization-defined subjects and objects.','AC-16(01)','N/A','Determine if: - security attributes are dynamically associated with [AC-16(01)_ODP[01]; subjects with which security attributes are to be dynamically associated as information is created and combined are defined] in accordance with the following security policies as information is created and combined: [AC-16(01)_ODP[05]; security policies requiring dynamic association of security attributes with subjects and objects are defined]. - security attributes are dynamically associated with [AC-16(01)_ODP[02]; objects with which security attributes are to be dynamically associated as information is created and combined are defined] in accordance with the following security policies as information is created and combined: [AC-16(01)_ODP[05]; security policies requiring dynamic association of security attributes with subjects and objects are defined]. - privacy attributes are dynamically associated with [AC-16(01)_ODP[03]; subjects with which privacy attributes are to be dynamically associated as information is created and combined are defined] in accordance with the following privacy policies as information is created and combined: [AC-16(01)_ODP[06]; privacy policies requiring dynamic association of privacy attributes with subjects and objects are defined.] - privacy attributes are dynamically associated with [AC-16(01)_ODP[04]; objects with which privacy attributes are to be dynamically associated as information is created and combined are defined] in accordance with the following privacy policies as information is created and combined: [AC-16(01)_ODP[06]; privacy policies requiring dynamic association of privacy attributes with subjects and objects are defined].'),\n('003715','draft','2022-03-01','DISA','technical','Provides authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated privacy attributes.','AC-16(02)','N/A','Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated security attributes. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated privacy attributes.'),\n('003716','draft','2022-03-01','DISA','technical','Provides authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated privacy attributes.','AC-16(02)','N/A','Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated security attributes. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated privacy attributes.'),\n('003717','draft','2022-03-01','DISA','technical','Defines the privacy attributes for which the association and integrity to organization-defined subjects and objects is maintained.','AC-16(03)','N/A','Determine if: - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[03]; subjects requiring the association and integrity of security attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[04]; objects requiring the association and integrity of security attributes to such objects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[05]; subjects requiring the association and integrity of privacy attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[06]; objects requiring the association and integrity of privacy attributes to such objects to be maintained are defined] is maintained.'),\n('003718','draft','2022-03-01','DISA','technical','Maintain the association of organization-defined privacy attributes to organization-defined subjects.','AC-16(03)','N/A','Determine if: - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[03]; subjects requiring the association and integrity of security attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[04]; objects requiring the association and integrity of security attributes to such objects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[05]; subjects requiring the association and integrity of privacy attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[06]; objects requiring the association and integrity of privacy attributes to such objects to be maintained are defined] is maintained.'),\n('003719','draft','2022-03-01','DISA','technical','Maintain the association of organization-defined privacy attributes to organization-defined objects.','AC-16(03)','N/A','Determine if: - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[03]; subjects requiring the association and integrity of security attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[04]; objects requiring the association and integrity of security attributes to such objects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[05]; subjects requiring the association and integrity of privacy attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[06]; objects requiring the association and integrity of privacy attributes to such objects to be maintained are defined] is maintained.'),\n('003720','draft','2022-03-01','DISA','technical','Maintain the integrity of organization-defined privacy attributes associated with organization-defined subjects.','AC-16(03)','N/A','Determine if: - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[03]; subjects requiring the association and integrity of security attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[04]; objects requiring the association and integrity of security attributes to such objects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[05]; subjects requiring the association and integrity of privacy attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[06]; objects requiring the association and integrity of privacy attributes to such objects to be maintained are defined] is maintained.'),\n('003721','draft','2022-03-01','DISA','technical','Maintain the integrity of organization-defined privacy attributes associated with organization-defined objects.','AC-16(03)','N/A','Determine if: - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[03]; subjects requiring the association and integrity of security attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[01]; security attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[04]; objects requiring the association and integrity of security attributes to such objects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[05]; subjects requiring the association and integrity of privacy attributes to such subjects to be maintained are defined] is maintained. - the association and integrity of [AC-16(03)_ODP[02]; privacy attributes that require association and integrity maintenance are defined] to [AC-16(03)_ODP[06]; objects requiring the association and integrity of privacy attributes to such objects to be maintained are defined] is maintained.'),\n('003722','draft','2022-03-01','DISA','technical','Defines the subjects with which organization-defined privacy attributes may be associated by authorized individuals (or processes acting on behalf of individuals).','AC-16(04)','N/A','Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[01]; security attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[05]; subjects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[02]; security attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[06]; objects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[03]; privacy attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[07]; subjects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[04]; privacy attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[08]; objects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined].'),\n('003723','draft','2022-03-01','DISA','technical','Defines the objects with which organization-defined privacy attributes may be associated by authorized individuals (or processes acting on behalf of individuals).','AC-16(04)','N/A','Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[01]; security attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[05]; subjects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[02]; security attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[06]; objects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[03]; privacy attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[07]; subjects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[04]; privacy attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[08]; objects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined].'),\n('003724','draft','2022-03-01','DISA','technical','Defines the privacy attributes authorized individuals (or processes acting on behalf of individuals) are permitted to associate with organization-defined subjects and objects.','AC-16(04)','N/A','Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[01]; security attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[05]; subjects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[02]; security attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[06]; objects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[03]; privacy attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[07]; subjects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[04]; privacy attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[08]; objects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined].'),\n('003725','draft','2022-03-01','DISA','technical','Provide the capability to associate organization-defined privacy attributes with organization-defined subjects by authorized individuals (or processes acting on behalf of individuals).','AC-16(04)','N/A','Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[01]; security attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[05]; subjects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[02]; security attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[06]; objects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[03]; privacy attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[07]; subjects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[04]; privacy attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[08]; objects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined].'),\n('003726','draft','2022-03-01','DISA','technical','Provide the capability to associate organization-defined privacy attributes with organization-defined objects by authorized individuals (or processes acting on behalf of individuals).','AC-16(04)','N/A','Determine if: - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[01]; security attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[05]; subjects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[02]; security attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[06]; objects requiring the association of security attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[03]; privacy attributes to be associated with subjects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[07]; subjects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined]. - authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [AC-16(04)_ODP[04]; privacy attributes to be associated with objects by authorized individuals (or processes acting on behalf of individuals) are defined] with [AC-16(04)_ODP[08]; objects requiring the association of privacy attributes by authorized individuals (or processes acting on behalf of individuals) are defined].'),\n('003727','draft','2022-03-01','DISA','technical','Displays privacy attributes in human-readable form on each object that the system transmits to output devices to identify organization-identified special dissemination, handling, or distribution instructions using organization-identified human-readable, standard naming conventions.','AC-16(05)','N/A','Determine if: - security attributes are displayed in human-readable form on each object that the system transmits to output devices to identify [AC-16(05)_ODP[01]; special dissemination, handling, or distribution instructions to be used for each object that the system transmits to output devices are defined] using [AC-16(05)_ODP[02]; human-readable, standard naming conventions for the security and privacy attributes to be displayed in human-readable form on each object that the system transmits to output devices are defined]. - privacy attributes are displayed in human-readable form on each object that the system transmits to output devices to identify [AC-16(05)_ODP[01]; special dissemination, handling, or distribution instructions to be used for each object that the system transmits to output devices are defined] using [AC-16(05)_ODP[02]; human-readable, standard naming conventions for the security and privacy attributes to be displayed in human-readable form on each object that the system transmits to output devices are defined].'),\n('003728','draft','2022-03-01','DISA','technical','Identifies special dissemination, handling, or distribution instructions for identifying privacy attributes on output.','AC-16(05)','N/A','Determine if: - security attributes are displayed in human-readable form on each object that the system transmits to output devices to identify [AC-16(05)_ODP[01]; special dissemination, handling, or distribution instructions to be used for each object that the system transmits to output devices are defined] using [AC-16(05)_ODP[02]; human-readable, standard naming conventions for the security and privacy attributes to be displayed in human-readable form on each object that the system transmits to output devices are defined]. - privacy attributes are displayed in human-readable form on each object that the system transmits to output devices to identify [AC-16(05)_ODP[01]; special dissemination, handling, or distribution instructions to be used for each object that the system transmits to output devices are defined] using [AC-16(05)_ODP[02]; human-readable, standard naming conventions for the security and privacy attributes to be displayed in human-readable form on each object that the system transmits to output devices are defined].'),\n('003729','draft','2022-03-01','DISA','technical','Identifies human-readable, standard naming conventions for identifying privacy attributes on output.','AC-16(05)','N/A','Determine if: - security attributes are displayed in human-readable form on each object that the system transmits to output devices to identify [AC-16(05)_ODP[01]; special dissemination, handling, or distribution instructions to be used for each object that the system transmits to output devices are defined] using [AC-16(05)_ODP[02]; human-readable, standard naming conventions for the security and privacy attributes to be displayed in human-readable form on each object that the system transmits to output devices are defined]. - privacy attributes are displayed in human-readable form on each object that the system transmits to output devices to identify [AC-16(05)_ODP[01]; special dissemination, handling, or distribution instructions to be used for each object that the system transmits to output devices are defined] using [AC-16(05)_ODP[02]; human-readable, standard naming conventions for the security and privacy attributes to be displayed in human-readable form on each object that the system transmits to output devices are defined].'),\n('003730','draft','2022-03-01','DISA','policy','Defines the privacy policies to be followed by personnel when associating organization-defined privacy attributes with organization-defined subjects and objects.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('003731','draft','2022-03-01','DISA','policy','Defines the privacy attributes which are to be associated with organization-defined subjects and objects.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('003732','draft','2022-03-01','DISA','policy','Defines the subjects to be associated, and that association maintained, with organization-defined privacy attributes in accordance with organization-defined privacy policies.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('003733','draft','2022-03-01','DISA','policy','Defines the objects to be associated, and that association maintained, with organization-defined privacy attributes in accordance with organization-defined privacy policies.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('003734','draft','2022-03-01','DISA','policy','Require personnel to associate organization-defined privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('003735','draft','2022-03-01','DISA','policy','Require personnel to associate organization-defined privacy attributes with organization-defined objects in accordance with organization-defined privacy policies.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('003736','draft','2022-03-01','DISA','policy','Require personnel to maintain the association of organization-defined privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('003737','draft','2022-03-01','DISA','policy','Require personnel to maintain the association of organization-defined privacy attributes with organization-defined objects in accordance with organization-defined privacy policies.','AC-16(06)','N/A','Determine if: - personnel are required to associate and maintain the association of [AC-16(06)_ODP[01]; security attributes to be associated with subjects are defined] with [AC-16(06)_ODP[05]; subjects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[02]; security attributes to be associated with objects are defined] with [AC-16(06)_ODP[06]; objects to be associated with information security attributes are defined] in accordance with [AC-16(06)_ODP[09]; security policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[03]; privacy attributes to be associated with subjects are defined] with [AC-16(06)_ODP[07]; subjects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects]. - personnel are required to associate and maintain the association of [AC-16(06)_ODP[04]; privacy attributes to be associated with objects are defined] with [AC-16(06)_ODP[08]; objects to be associated with privacy attributes are defined] in accordance with [AC-16(06)_ODP[10]; privacy policies that require personnel to associate and maintain the association of security and privacy attributes with subjects and objects].'),\n('003738','draft','2022-03-01','DISA','policy','Provide a consistent interpretation of privacy attributes transmitted between distributed system components.','AC-16(07)','N/A','Determine if: - a consistent interpretation of security attributes transmitted between distributed system components is provided. - Determine if a consistent interpretation of privacy attributes transmitted between distributed system components is provided.'),\n('003739','draft','2022-03-01','DISA','technical','Defines the techniques and technologies to be implemented when associating security attributes to information.','AC-16(08)','N/A','Determine if: - [AC-16(08)_ODP[01]; techniques and technologies to be implemented in associating security attributes to information are defined] are implemented in associating security attributes to information. - [AC-16(08)_ODP[02]; techniques and technologies to be implemented in associating privacy attributes to information are defined] are implemented in associating privacy attributes to information.'),\n('003740','draft','2022-03-01','DISA','technical','Defines the level of assurance to be provided when implementing organization-defined techniques and technologies in associating privacy attributes to information.','AC-16(08)','N/A','Determine if: - [AC-16(08)_ODP[01]; techniques and technologies to be implemented in associating security attributes to information are defined] are implemented in associating security attributes to information. - [AC-16(08)_ODP[02]; techniques and technologies to be implemented in associating privacy attributes to information are defined] are implemented in associating privacy attributes to information.'),\n('003741','draft','2022-03-01','DISA','technical','Implement organization-defined techniques and technologies with an organization-defined level of assurance in associating privacy attributes to information.','AC-16(08)','N/A','Determine if: - [AC-16(08)_ODP[01]; techniques and technologies to be implemented in associating security attributes to information are defined] are implemented in associating security attributes to information. - [AC-16(08)_ODP[02]; techniques and technologies to be implemented in associating privacy attributes to information are defined] are implemented in associating privacy attributes to information.'),\n('003742','draft','2022-03-01','DISA','policy','Change privacy attributes associated with information are reassigned only via re-grading mechanisms validated using organization-defined techniques or procedures.','AC-16(09)','N/A','Determine if: - security attributes associated with information are changed only via regrading mechanisms validated using [AC-16(09)_ODP[01]; techniques or procedures used to validate regrading mechanisms for security attributes are defined]. - privacy attributes associated with information are changed only via regrading mechanisms validated using [AC-16(09)_ODP[02]; techniques or procedures used to validate regrading mechanisms for privacy attributes are defined].'),\n('003743','draft','2022-03-01','DISA','policy','Provide authorized individuals the capability to define or change the type of privacy attributes available for association with subjects.','AC-16(10)','N/A','Determine if: - authorized individuals are provided with the capability to define or change the type and value of security attributes available for association with subjects and objects. - authorized individuals are provided with the capability to define or change the type and value of privacy attributes available for association with subjects and objects.'),\n('003744','draft','2022-03-01','DISA','policy','Provide authorized individuals the capability to define or change the value of privacy attributes available for association with subjects.','AC-16(10)','N/A','Determine if: - authorized individuals are provided with the capability to define or change the type and value of security attributes available for association with subjects and objects. - authorized individuals are provided with the capability to define or change the type and value of privacy attributes available for association with subjects and objects.'),\n('003745','draft','2022-03-01','DISA','policy','Provide authorized individuals the capability to define or change the type of privacy attributes available for association with objects.','AC-16(10)','N/A','Determine if: - authorized individuals are provided with the capability to define or change the type and value of security attributes available for association with subjects and objects. - authorized individuals are provided with the capability to define or change the type and value of privacy attributes available for association with subjects and objects.'),\n('003746','draft','2022-03-01','DISA','policy','Provide authorized individuals the capability to define or change the value of privacy attributes available for association with objects.','AC-16(10)','N/A','Determine if: - authorized individuals are provided with the capability to define or change the type and value of security attributes available for association with subjects and objects. - authorized individuals are provided with the capability to define or change the type and value of privacy attributes available for association with subjects and objects.'),\n('003747','draft','2022-03-01','DISA','technical','Implement organization-defined mechanisms to authenticate organization-defined remote commands.','AC-17(10)','N/A','Determine if [AC-17(10)_ODP[01]; mechanisms implemented to authenticate remote commands are defined] are implemented to authenticate [AC-17(10)_ODP[02]; remote commands to be authenticated by mechanisms are defined].'),\n('003748','draft','2022-03-01','DISA','technical','Defines the mechanisms used to authenticate organization-defined remote commands.','AC-17(10)','N/A','Determine if [AC-17(10)_ODP[01]; mechanisms implemented to authenticate remote commands are defined] are implemented to authenticate [AC-17(10)_ODP[02]; remote commands to be authenticated by mechanisms are defined].'),\n('003749','draft','2022-03-01','DISA','technical','Defines the remote commands used for implementing organization-defined mechanisms.','AC-17(10)','N/A','Determine if [AC-17(10)_ODP[01]; mechanisms implemented to authenticate remote commands are defined] are implemented to authenticate [AC-17(10)_ODP[02]; remote commands to be authenticated by mechanisms are defined].'),\n('003750','draft','2022-03-01','DISA','policy','Defines the terms and conditions for accessing the system from external systems.','AC-20a.01','N/A','Determine if [AC-20_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {establish [AC-20_ODP[02]; terms and conditions consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems are defined (if selected)]; identify [AC-20_ODP[03]; controls asserted to be implemented on external systems consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems are defined (if selected)]}]]] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from external systems (if applicable).'),\n('003751','draft','2022-03-01','DISA','policy','Defines the controls asserted to be implemented on external systems allowing individuals to access the system from external systems.','AC-20a.01','N/A','Determine if [AC-20_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {establish [AC-20_ODP[02]; terms and conditions consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems are defined (if selected)]; identify [AC-20_ODP[03]; controls asserted to be implemented on external systems consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems are defined (if selected)]}]]] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from external systems (if applicable).'),\n('003752','draft','2022-03-01','DISA','policy','Defines the terms and conditions for processing, storing, or transmitting organization-controlled information using external systems.','AC-20a.02','N/A','Determine if [AC-20_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {establish [AC-20_ODP[02]; terms and conditions consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems are defined (if selected)]; identify [AC-20_ODP[03]; controls asserted to be implemented on external systems consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems are defined (if selected)]}]]] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using external systems (if applicable).'),\n('003753','draft','2022-03-01','DISA','policy','Defines the controls asserted to be implemented on external systems allowing individuals to process, store, or transmit organization-controlled information using external systems.','AC-20a.02','N/A','Determine if [AC-20_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {establish [AC-20_ODP[02]; terms and conditions consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems are defined (if selected)]; identify [AC-20_ODP[03]; controls asserted to be implemented on external systems consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems are defined (if selected)]}]]] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using external systems (if applicable).'),\n('003754','draft','2022-03-01','DISA','policy','Prohibit the use of organizationally-defined types of external systems.','AC-20b.','N/A','Determine if the use of [AC-20_ODP[04]; types of external systems prohibited from use are defined] is prohibited (if applicable).'),\n('003755','draft','2022-03-01','DISA','policy','Defines the types of external systems that are prohibited.','AC-20b.','N/A','Determine if the use of [AC-20_ODP[04]; types of external systems prohibited from use are defined] is prohibited (if applicable).'),\n('003756','draft','2022-03-01','DISA','policy','Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization''s security policy and security plan.','AC-20(01)(a)','N/A','Determine if authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization''s security and privacy policies and security and privacy plans (if applicable).'),\n('003757','draft','2022-03-01','DISA','policy','Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization''s privacy policy and privacy plan.','AC-20(01)(a)','N/A','Determine if authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization''s security and privacy policies and security and privacy plans (if applicable).'),\n('003758','draft','2022-03-01','DISA','policy','Defines the restrictions for the use of organization-controlled portable storage devices.','AC-20(02)','N/A','Determine if the use of organization-controlled portable storage devices by authorized individuals is restricted on external systems using [AC-20(02)_ODP; restrictions on the use of organization-controlled portable storage devices by authorized individuals on external systems are defined].'),\n('003759','draft','2022-03-01','DISA','policy','Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.','AC-20(05)','N/A','Determine if the use of organization-controlled portable storage devices by authorized individuals is prohibited on external systems.'),\n('003760','draft','2022-03-01','DISA','technical','Defines the privacy attributes, not to include the identity of the user or process acting on behalf of the user, to be used as the basis for enforcing access control decisions.','AC-24(02)','N/A','Determine if: - access control decisions are enforced based on [AC-24(02)_ODP[01]; security attributes that do not include the identity of the user or process acting on behalf of the user are defined (if selected)] that do not include the identity of the user or process acting on behalf of the user (if selected). - access control decisions are enforced based on [AC-24(02)_ODP[02]; privacy attributes that do not include the identity of the user or process acting on behalf of the user are defined (if selected)] that do not include the identity of the user or process acting on behalf of the user (if selected).'),\n('003761','draft','2022-03-01','DISA','policy','Develop and document an organization level, mission/business process-level, or system-level awareness and training policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','AT-01a.01(b)','N/A','Determine if the [AT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] awareness and training policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('003762','draft','2022-03-01','DISA','policy','Designate an organization-defined official to manage the development and documentation of the awareness and training policy.','AT-01b.','N/A','Determine if the [AT-01_ODP[04]; an official to manage the awareness and training policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the awareness and training policy and procedures.'),\n('003763','draft','2022-03-01','DISA','policy','Designate an organization-defined official to manage the dissemination of the awareness and training policy.','AT-01b.','N/A','Determine if the [AT-01_ODP[04]; an official to manage the awareness and training policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the awareness and training policy and procedures.'),\n('003764','draft','2022-03-01','DISA','policy','Designate an organization-defined official to manage the development and documentation of the awareness and training procedures.','AT-01b.','N/A','Determine if the [AT-01_ODP[04]; an official to manage the awareness and training policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the awareness and training policy and procedures.'),\n('003765','draft','2022-03-01','DISA','policy','Designate an organization-defined official to manage the dissemination of the awareness and training procedures.','AT-01b.','N/A','Determine if the [AT-01_ODP[04]; an official to manage the awareness and training policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the awareness and training policy and procedures.'),\n('003766','draft','2022-03-01','DISA','policy','Provide basic privacy awareness training to system users (including managers, senior executives, and contractors) when required by system changes or following organization-defined events.','AT-02a.02','N/A','Determine if: - security literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [AT-02_ODP[03]; events that require security literacy training for system users are defined]. - privacy literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [AT-02_ODP[04]; events that require privacy literacy training for system users are defined].'),\n('003767','draft','2022-03-01','DISA','policy','Employ organization-defined awareness techniques to increase the security awareness of system users.','AT-02b.','N/A','Determine if [AT-02_ODP[05]; techniques to be employed to increase the security and privacy awareness of system users are defined] are employed to increase the security and privacy awareness of system users.'),\n('003768','draft','2022-03-01','DISA','policy','Employ organization-defined awareness techniques to increase the privacy awareness of system users.','AT-02b.','N/A','Determine if [AT-02_ODP[05]; techniques to be employed to increase the security and privacy awareness of system users are defined] are employed to increase the security and privacy awareness of system users.'),\n('003769','draft','2022-03-01','DISA','policy','Defines the awareness techniques for to increase security and privacy awareness of system uses.','AT-02b.','N/A','Determine if [AT-02_ODP[05]; techniques to be employed to increase the security and privacy awareness of system users are defined] are employed to increase the security and privacy awareness of system users.'),\n('003770','draft','2022-03-01','DISA','policy','Update literacy training and awareness content on an organization-defined frequency.','AT-02c.','N/A','Determine if: - literacy training and awareness content is updated [AT-02_ODP[06]; the frequency at which to update literacy training and awareness content is defined]. - literacy training and awareness content is updated following [AT-02_ODP[07]; events that would require literacy training and awareness content to be updated are defined].'),\n('003771','draft','2022-03-01','DISA','policy','Update literacy training and awareness content following organization-defined event.','AT-02c.','N/A','Determine if: - literacy training and awareness content is updated [AT-02_ODP[06]; the frequency at which to update literacy training and awareness content is defined]. - literacy training and awareness content is updated following [AT-02_ODP[07]; events that would require literacy training and awareness content to be updated are defined].'),\n('003772','draft','2022-03-01','DISA','policy','Defines the frequency for updating literacy training and awareness content.','AT-02c.','N/A','Determine if: - literacy training and awareness content is updated [AT-02_ODP[06]; the frequency at which to update literacy training and awareness content is defined]. - literacy training and awareness content is updated following [AT-02_ODP[07]; events that would require literacy training and awareness content to be updated are defined].'),\n('003773','draft','2022-03-01','DISA','policy','Defines the events following updating literacy training and awareness content.','AT-02c.','N/A','Determine if: - literacy training and awareness content is updated [AT-02_ODP[06]; the frequency at which to update literacy training and awareness content is defined]. - literacy training and awareness content is updated following [AT-02_ODP[07]; events that would require literacy training and awareness content to be updated are defined].'),\n('003774','draft','2022-03-01','DISA','policy','Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.','AT-02d.','N/A','Determine if lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques.'),\n('003775','draft','2022-03-01','DISA','policy','Provide literacy training on recognizing and reporting potential and actual instances of social engineering.','AT-02(03)','N/A','Determine if: - literacy training on recognizing potential and actual instances of social engineering is provided. - literacy training on reporting potential and actual instances of social engineering is provided. - literacy training on recognizing potential and actual instances of social mining is provided. - literacy training on reporting potential and actual instances of social mining is provided.'),\n('003776','draft','2022-03-01','DISA','policy','Provide literacy training on recognizing and reporting potential and actual instances of social mining.','AT-02(03)','N/A','Determine if: - literacy training on recognizing potential and actual instances of social engineering is provided. - literacy training on reporting potential and actual instances of social engineering is provided. - literacy training on recognizing potential and actual instances of social mining is provided. - literacy training on reporting potential and actual instances of social mining is provided.'),\n('003777','draft','2022-03-01','DISA','policy','Provide literacy training on recognize suspicious communications and anomalous behavior in organizational systems using organization-defined indicators of malicious code.','AT-02(04)','N/A','Determine if literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using [AT-02(04)_ODP; indicators of malicious code are defined] is provided.'),\n('003778','draft','2022-03-01','DISA','policy','Defines the indicators of malicious code used to recognize suspicious communications and anomalous behavior in organizational systems.','AT-02(04)','N/A','Determine if literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using [AT-02(04)_ODP; indicators of malicious code are defined] is provided.'),\n('003779','draft','2022-03-01','DISA','policy','Provide literacy training on the advanced persistent threat.','AT-02(05)','N/A','Determine if literacy training on the advanced persistent threat is provided.'),\n('003780','draft','2022-03-01','DISA','policy','Provide literacy training on the cyber threat environment.','AT-02(06)(a)','N/A','Determine if literacy training on the cyber threat environment is provided.'),\n('003781','draft','2022-03-01','DISA','policy','Reflect current cyber threat information in system operations.','AT-02(06)(b)','N/A','Determine if system operations reflects current cyber threat information.'),\n('003782','draft','2022-03-01','DISA','policy','Defines the roles and responsibilities of the personnel providing role-based security and privacy training.',NULL,'N/A',NULL),\n('003783','draft','2022-03-01','DISA','policy','Provide role-based privacy training to personnel with organization-defined roles and responsibilities before authorizing access to the system, information, or performing assigned duties.','AT-03a.01','N/A','Determine if: - role-based security training is provided to [AT-03_ODP[01]; roles and responsibilities for role-based security training are defined] before authorizing access to the system, information, or performing assigned duties. - role-based privacy training is provided to [AT-03_ODP[02]; roles and responsibilities for role-based privacy training are defined] before authorizing access to the system, information, or performing assigned duties. - role-based security training is provided to [AT-03_ODP[01]; roles and responsibilities for role-based security training are defined] [AT-03_ODP[03]; the frequency at which to provide role-based security and privacy training to assigned personnel after initial training is defined] thereafter. - role-based privacy training is provided to [AT-03_ODP[02]; roles and responsibilities for role-based privacy training are defined] [AT-03_ODP[03]; the frequency at which to provide role-based security and privacy training to assigned personnel after initial training is defined] thereafter.'),\n('003784','draft','2022-03-01','DISA','policy','Provide role-based privacy training to personnel with organization-defined roles and responsibilities when required by system changes.','AT-03a.02','N/A','Determine if: - role-based security training is provided to personnel with assigned security roles and responsibilities when required by system changes. - role-based privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes.'),\n('003785','draft','2022-03-01','DISA','policy','Update role-based training content on an organization-defined frequency.','AT-03b.','N/A','Determine if: - role-based training content is updated [AT-03_ODP[04]; the frequency at which to update role-based training content is defined]. - role-based training content is updated following [AT-03_ODP[05]; events that require role-based training content to be updated are defined].'),\n('003786','draft','2022-03-01','DISA','policy','Defines the frequency of which the role-based training content is updated.','AT-03b.','N/A','Determine if: - role-based training content is updated [AT-03_ODP[04]; the frequency at which to update role-based training content is defined]. - role-based training content is updated following [AT-03_ODP[05]; events that require role-based training content to be updated are defined].'),\n('003787','draft','2022-03-01','DISA','policy','Update role-based training content following organization-defined events.','AT-03b.','N/A','Determine if: - role-based training content is updated [AT-03_ODP[04]; the frequency at which to update role-based training content is defined]. - role-based training content is updated following [AT-03_ODP[05]; events that require role-based training content to be updated are defined].'),\n('003788','draft','2022-03-01','DISA','policy','Defines the events following updating role-based training content.','AT-03b.','N/A','Determine if: - role-based training content is updated [AT-03_ODP[04]; the frequency at which to update role-based training content is defined]. - role-based training content is updated following [AT-03_ODP[05]; events that require role-based training content to be updated are defined].'),\n('003789','draft','2022-03-01','DISA','policy','Incorporate lessons learned from internal or external security incidents or breaches into role-based training.','AT-03c.','N/A','Determine if lessons learned from internal or external security incidents or breaches are incorporated into role-based training.'),\n('003790','draft','2022-03-01','DISA','policy','Provide practical exercises in privacy training that reinforce training objectives.','AT-03(03)','N/A','Determine if: - practical exercises in security training that reinforce training objectives are provided. - practical exercises in privacy training that reinforce training objectives are provided.'),\n('003791','draft','2022-03-01','DISA','policy','Defines the frequency for providing training in the employment and operation of personally identifiable information processing and transparency controls to personnel or roles.','AT-03(05)','N/A','Determine if [AT-03(05)_ODP[01]; personnel or roles to be provided with initial and refresher training in the employment and operation of personally identifiable information processing and transparency controls is/are defined] are provided with initial and refresher training [AT-03(05)_ODP[02]; the frequency at which to provide refresher training in the employment and operation of personally identifiable information processing and transparency controls is defined] in the employment and operation of personally identifiable information processing and transparency controls.'),\n('003792','draft','2022-03-01','DISA','policy','Provide organization-defined personnel or roles with initial training in the employment and operation of personally identifiable information processing and transparency controls.','AT-03(05)','N/A','Determine if [AT-03(05)_ODP[01]; personnel or roles to be provided with initial and refresher training in the employment and operation of personally identifiable information processing and transparency controls is/are defined] are provided with initial and refresher training [AT-03(05)_ODP[02]; the frequency at which to provide refresher training in the employment and operation of personally identifiable information processing and transparency controls is defined] in the employment and operation of personally identifiable information processing and transparency controls.'),\n('003793','draft','2022-03-01','DISA','policy','Defines the personnel or roles who are to be provided training in the employment and operation of personally identifiable information processing and transparency controls.','AT-03(05)','N/A','Determine if [AT-03(05)_ODP[01]; personnel or roles to be provided with initial and refresher training in the employment and operation of personally identifiable information processing and transparency controls is/are defined] are provided with initial and refresher training [AT-03(05)_ODP[02]; the frequency at which to provide refresher training in the employment and operation of personally identifiable information processing and transparency controls is defined] in the employment and operation of personally identifiable information processing and transparency controls.'),\n('003794','draft','2022-03-01','DISA','policy','Document individual privacy training activities, including privacy awareness training and specific system privacy training.','AT-04a.','N/A','Determine if: - information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented. - information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are monitored.'),\n('003795','draft','2022-03-01','DISA','policy','Monitor individual information privacy training activities, including privacy awareness training and specific privacy training.','AT-04a.','N/A','Determine if: - information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented. - information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are monitored.'),\n('003796','draft','2022-03-01','DISA','policy','Provide feedback on organizational training results to organization-defined personnel on an organization-defined frequency.','AT-06','N/A','Determine if feedback on organizational training results is provided [AT-06_ODP[01]; frequency at which to provide feedback on organizational training results is defined] to [AT-06_ODP[02]; personnel to whom feedback on organizational training results will be provided is/are assigned].'),\n('003797','draft','2022-03-01','DISA','policy','Defines the frequency of which feedback is provided on organizational training results.','AT-06','N/A','Determine if feedback on organizational training results is provided [AT-06_ODP[01]; frequency at which to provide feedback on organizational training results is defined] to [AT-06_ODP[02]; personnel to whom feedback on organizational training results will be provided is/are assigned].'),\n('003798','draft','2022-03-01','DISA','policy','Defines the organizational personnel or roles who provide feedback on organizational training results.','AT-06','N/A','Determine if feedback on organizational training results is provided [AT-06_ODP[01]; frequency at which to provide feedback on organizational training results is defined] to [AT-06_ODP[02]; personnel to whom feedback on organizational training results will be provided is/are assigned].'),\n('003799','draft','2022-03-01','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system-level audit and accountability policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','AU-01a.01(b)','N/A','Determine if the [AU-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] of the audit and accountability policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.'),\n('003800','draft','2022-03-01','DISA','policy','Designate an organization-defined official to manage the development and documentation of the audit and accountability policy.','AU-01b.','N/A','Determine if the [AU-01_ODP[04]; an official to manage the audit and accountability policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures.'),\n('003801','draft','2022-03-01','DISA','policy','Designate an organization-defined official to manage the dissemination of the audit and accountability policy.','AU-01b.','N/A','Determine if the [AU-01_ODP[04]; an official to manage the audit and accountability policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures.'),\n('003802','draft','2022-03-01','DISA','policy','Designate an organization-defined official to manage the development and documentation of the audit and accountability procedures.','AU-01b.','N/A','Determine if the [AU-01_ODP[04]; an official to manage the audit and accountability policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures.'),\n('003803','draft','2022-03-01','DISA','policy','Designate an organization-defined official to manage the dissemination of the audit and accountability procedures.','AU-01b.','N/A','Determine if the [AU-01_ODP[04]; an official to manage the audit and accountability policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures.'),\n('003804','draft','2022-03-01','DISA','policy','Defines the official designated for managing the development, documentation, and dissemination of the audit and accountability policy.','AU-01b.','N/A','Determine if the [AU-01_ODP[04]; an official to manage the audit and accountability policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures.'),\n('003805','draft','2022-03-01','DISA','policy','Defines the official designated for managing the development, documentation, and dissemination of the audit and accountability procedures.','AU-01b.','N/A','Determine if the [AU-01_ODP[04]; an official to manage the audit and accountability policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures.'),\n('003806','draft','2022-03-02','DISA','policy','Review and update the current audit and accountability policy following organization-defined events.','AU-01c.01','N/A','Determine if: - the current audit and accountability policy is reviewed and updated [AU-01_ODP[05]; the frequency at which the current audit and accountability policy is reviewed and updated is defined]. - the current audit and accountability policy is reviewed and updated following [AU-01_ODP[06]; events that would require the current audit and accountability policy to be reviewed and updated are defined.]'),\n('003807','draft','2022-03-02','DISA','policy','Defines the events following reviewing and updating the current audit and accountability policy.','AU-01c.01','N/A','Determine if: - the current audit and accountability policy is reviewed and updated [AU-01_ODP[05]; the frequency at which the current audit and accountability policy is reviewed and updated is defined]. - the current audit and accountability policy is reviewed and updated following [AU-01_ODP[06]; events that would require the current audit and accountability policy to be reviewed and updated are defined.]'),\n('003808','draft','2022-03-02','DISA','policy','Review and update the current audit and accountability procedures following organization-defined events.','AU-01c.02','N/A','Determine if: - the current audit and accountability procedures are reviewed and updated [AU-01_ODP[07]; the frequency at which the current audit and accountability procedures are reviewed and updated is defined]. - the current audit and accountability procedures are reviewed and updated following [AU-01_ODP[08]; events that would require audit and accountability procedures to be reviewed and updated are defined].'),\n('003809','draft','2022-03-02','DISA','policy','Defines the events following reviewing and updating the current audit and accountability procedures.','AU-01c.02','N/A','Determine if: - the current audit and accountability procedures are reviewed and updated [AU-01_ODP[07]; the frequency at which the current audit and accountability procedures are reviewed and updated is defined]. - the current audit and accountability procedures are reviewed and updated following [AU-01_ODP[08]; events that would require audit and accountability procedures to be reviewed and updated are defined].'),\n('003810','draft','2022-03-02','DISA','policy','Review and update the event types selected for logging on an organization-defined frequency.','AU-02e.','N/A','Determine if the event types selected for logging are reviewed and updated [AU-02_ODP[04]; the frequency of event types selected for logging are reviewed and updated].'),\n('003811','draft','2022-03-02','DISA','policy','Defines the frequency at which the event types selected for logging will be reviewed and updated.','AU-02e.','N/A','Determine if the event types selected for logging are reviewed and updated [AU-02_ODP[04]; the frequency of event types selected for logging are reviewed and updated].'),\n('003812','draft','2022-03-02','DISA','policy','Limit personally identifiable information contained in audit records to organization-defined elements identified in the privacy risk assessment.','AU-03(03)','N/A','Determine if personally identifiable information contained in audit records is limited to [AU-03(03)_ODP; elements identified in the privacy risk assessment are defined] identified in the privacy risk assessment.'),\n('003813','draft','2022-03-02','DISA','policy','Defines the elements identified in the privacy risk assessment for limiting personally identifiable information contained in audit records.','AU-03(03)','N/A','Determine if personally identifiable information contained in audit records is limited to [AU-03(03)_ODP; elements identified in the privacy risk assessment are defined] identified in the privacy risk assessment.'),\n('003814','draft','2022-03-02','DISA','policy','Defines the time-period for the alert in the event of an audit process failure.','AU-05a.','N/A','Determine if [AU-05_ODP[01]; personnel or roles receiving audit logging process failure alerts are defined] are alerted in the event of an audit logging process failure within [AU-05_ODP[02]; time period for personnel or roles receiving audit logging process failure alerts is defined].'),\n('003815','draft','2022-03-02','DISA','policy','Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements organization-defined alternate audit logging functionality.','AU-05(05)','N/A','Determine if an alternate audit logging capability is provided in the event of a failure in primary audit logging capability that implements [AU-05(05)_ODP; an alternate audit logging functionality in the event of a failure in primary audit logging capability is defined].'),\n('003816','draft','2022-03-02','DISA','policy','Defines the alternate audit logging functionality in the event of a failure in primary audit logging capability.','AU-05(05)','N/A','Determine if an alternate audit logging capability is provided in the event of a failure in primary audit logging capability that implements [AU-05(05)_ODP; an alternate audit logging functionality in the event of a failure in primary audit logging capability is defined].'),\n('003817','draft','2022-03-02','DISA','policy','Review and analyze the potential impact of the organization-defined inappropriate or unusual activity.','AU-06a.','N/A','Determine if system audit records are reviewed and analyzed [AU-06_ODP[01]; frequency at which system audit records are reviewed and analyzed is defined] for indications of [AU-06_ODP[02]; inappropriate or unusual activity is defined] and the potential impact of the inappropriate or unusual activity.'),\n('003818','draft','2022-03-02','DISA','policy','Adjust the level of audit review and analysis within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.','AU-06c.','N/A','Determine if the level of audit record review, analysis, and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.'),\n('003819','draft','2022-03-02','DISA','policy','Adjust the level of audit reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.','AU-06c.','N/A','Determine if the level of audit record review, analysis, and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.'),\n('003820','draft','2022-03-02','DISA','policy','Defines the automated mechanisms for integrating audit record review, analysis, and reporting processes.','AU-06(01)','N/A','Determine if audit record review, analysis, and reporting processes are integrated using [AU-06(01)_ODP; automated mechanisms used for integrating audit record review, analysis, and reporting processes are defined].'),\n('003821','draft','2022-03-02','DISA','technical','Implement the capability to centrally review and analyze audit records from multiple components within the system.','AU-06(04)','N/A','Determine if: - the capability to centrally review and analyze audit records from multiple components within the system is provided. - the capability to centrally review and analyze audit records from multiple components within the system is implemented.'),\n('003822','draft','2022-03-02','DISA','technical','Implement an audit reduction capability that supports on-demand audit review and analysis.','AU-07a.','N/A','Determine if: - an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents. - if an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents.'),\n('003823','draft','2022-03-02','DISA','technical','Implement an audit reduction capability that supports on-demand reporting requirements.','AU-07a.','N/A','Determine if: - an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents. - if an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents.'),\n('003824','draft','2022-03-02','DISA','technical','Implement an audit reduction capability that supports after-the-fact investigations of incidents.','AU-07a.','N/A','Determine if: - an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents. - if an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents.'),\n('003825','draft','2022-03-02','DISA','technical','Implement a report generation capability that supports on-demand audit review and analysis.','AU-07a.','N/A','Determine if: - an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents. - if an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents.'),\n('003826','draft','2022-03-02','DISA','technical','Implement a report generation capability that supports on-demand reporting requirements.','AU-07a.','N/A','Determine if: - an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents. - if an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents.'),\n('003827','draft','2022-03-02','DISA','technical','Implement a report generation capability that supports after-the-fact investigations of incidents.','AU-07a.','N/A','Determine if: - an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents. - if an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents.'),\n('003828','draft','2022-03-02','DISA','technical','Implement an audit reduction capability that does not alter original content or time ordering of audit records.','AU-07b.','N/A','Determine if: - an audit record reduction and report generation capability is provided that does not alter the original content or time ordering of audit records. - an audit record reduction and report generation capability is implemented that does not alter the original content or time ordering of audit records.'),\n('003829','draft','2022-03-02','DISA','technical','Implement a report generation capability that does not alter original content or time ordering of audit records.','AU-07b.','N/A','Determine if: - an audit record reduction and report generation capability is provided that does not alter the original content or time ordering of audit records. - an audit record reduction and report generation capability is implemented that does not alter the original content or time ordering of audit records.'),\n('003830','draft','2022-03-02','DISA','technical','Implement the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.','AU-07(01)','N/A','Determine if: - the capability to process, sort, and search audit records for events of interest based on [AU-07(01)_ODP; fields within audit records that can be processed, sorted, or searched are defined] are provided. - the capability to process, sort, and search audit records for events of interest based on [AU-07(01)_ODP; fields within audit records that can be processed, sorted, or searched are defined] are implemented.'),\n('003831','draft','2022-03-02','DISA','technical','Alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.','AU-09b.','N/A','Determine if [AU-09_ODP; personnel or roles to be alerted upon detection of unauthorized access, modification, or deletion of audit information is/are defined] are alerted upon detection of unauthorized access, modification, or deletion of audit information.'),\n('003832','draft','2022-03-02','DISA','technical','Defines the personnel or roles to be alerted upon detection of unauthorized access, modification, or deletion of audit information.','AU-09b.','N/A','Determine if [AU-09_ODP; personnel or roles to be alerted upon detection of unauthorized access, modification, or deletion of audit information is/are defined] are alerted upon detection of unauthorized access, modification, or deletion of audit information.'),\n('003833','draft','2022-03-02','DISA','policy','Store audit information on a component running a different operating system than the system component being audited.','AU-09(07)','N/A','Determine if audit information is stored on a component running a different operating system than the system or component being audited.'),\n('003834','draft','2022-03-02','DISA','technical','Implement the capability for organization-defined individuals or roles to change the auditing to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds.','AU-12(03)','N/A','Determine if: - the capability for [AU-12(03)_ODP[01]; individuals or roles authorized to change the logging on system components are defined] to change the logging to be performed on [AU-12(03)_ODP[02]; system components on which logging is to be performed are defined] based on [AU-12(03)_ODP[03]; selectable event criteria with which change logging is to be performed are defined] within [AU-12(03)_ODP[04]; time thresholds in which logging actions are to change is defined] is provided. - the capability for [AU-12(03)_ODP[01]; individuals or roles authorized to change the logging on system components are defined] to change the logging to be performed on [AU-12(03)_ODP[02]; system components on which logging is to be performed are defined] based on [AU-12(03)_ODP[03]; selectable event criteria with which change logging is to be performed are defined] within [AU-12(03)_ODP[04]; time thresholds in which logging actions are to change is defined] is implemented.'),\n('003835','draft','2022-03-02','DISA','technical','Provide the capability for auditing the parameters of user query events for data sets containing personally identifiable information.','AU-12(04)','N/A','Determine if: - the capability to audit the parameters of user query events for data sets containing personally identifiable information is provided. - the capability to audit the parameters of user query events for data sets containing personally identifiable information is implemented.'),\n('003836','draft','2022-03-02','DISA','technical','Implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.','AU-12(04)','N/A','Determine if: - the capability to audit the parameters of user query events for data sets containing personally identifiable information is provided. - the capability to audit the parameters of user query events for data sets containing personally identifiable information is implemented.'),\n('003837','draft','2022-03-02','DISA','policy','If an information disclosure is discovered, notify organization-defined personnel or roles.','AU-13b.01','N/A','Determine if [AU-13_ODP[03]; personnel or roles to be notified if an information disclosure is discovered is/are defined] are notified if an information disclosure is discovered.'),\n('003838','draft','2022-03-02','DISA','policy','Defines the personnel or roles to be notified if an information disclosure is discovered.','AU-13b.01','N/A','Determine if [AU-13_ODP[03]; personnel or roles to be notified if an information disclosure is discovered is/are defined] are notified if an information disclosure is discovered.'),\n('003839','draft','2022-03-02','DISA','policy','If an information disclosure is discovered, take organization-defined additional actions.','AU-13b.02','N/A','Determine if [AU-13_ODP[04]; additional actions to be taken if an information disclosure is discovered are defined] are taken if an information disclosure is discovered.'),\n('003840','draft','2022-03-02','DISA','policy','Defines the additional actions to be taken if an information disclosure is discovered.','AU-13b.02','N/A','Determine if [AU-13_ODP[04]; additional actions to be taken if an information disclosure is discovered are defined] are taken if an information disclosure is discovered.'),\n('003841','draft','2022-03-02','DISA','policy','Monitor open-source information and information sites using organization-defined automated mechanisms.','AU-13(01)','N/A','Determine if open-source information and information sites are monitored using [AU-13(01)_ODP; automated mechanisms for monitoring open-source information and information sites are defined].'),\n('003842','draft','2022-03-02','DISA','policy','Defines the automated mechanisms for monitoring open-source information.','AU-13(01)','N/A','Determine if open-source information and information sites are monitored using [AU-13(01)_ODP; automated mechanisms for monitoring open-source information and information sites are defined].'),\n('003843','draft','2022-03-02','DISA','policy','Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner.','AU-13(03)','N/A','Determine if discovery techniques, processes, and tools are employed to determine if external entities are replicating organizational information in an unauthorized manner.'),\n('003844','draft','2022-03-02','DISA','technical','Implement the capability for organization-defined users or roles to select a user session to record; view; hear; and/or log the content of a user session under organization-defined circumstances.','AU-14a.','N/A','Determine if: - [AU-14_ODP[01]; users or roles who can audit the content of a user session are defined] are provided with the capability to [AU-14_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {record; view; hear; log}] the content of a user session under [AU-14_ODP[03]; circumstances under which the content of a user session can be audited are defined]. - the capability for [AU-14_ODP[01]; users or roles who can audit the content of a user session are defined] to [AU-14_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {record; view; hear; log}] the content of a user session under [AU-14_ODP[03]; circumstances under which the content of a user session can be audited are defined] is implemented.'),\n('003845','draft','2022-03-02','DISA','technical','Defines users or roles who will provide and implement the capability to record; view; hear; and/or log the content of a user session under organization-defined circumstances.','AU-14a.','N/A','Determine if: - [AU-14_ODP[01]; users or roles who can audit the content of a user session are defined] are provided with the capability to [AU-14_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {record; view; hear; log}] the content of a user session under [AU-14_ODP[03]; circumstances under which the content of a user session can be audited are defined]. - the capability for [AU-14_ODP[01]; users or roles who can audit the content of a user session are defined] to [AU-14_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {record; view; hear; log}] the content of a user session under [AU-14_ODP[03]; circumstances under which the content of a user session can be audited are defined] is implemented.'),\n('003846','draft','2022-03-02','DISA','technical','Defines the circumstances to record; view; hear; and/or log the content of a user session.','AU-14a.','N/A','Determine if: - [AU-14_ODP[01]; users or roles who can audit the content of a user session are defined] are provided with the capability to [AU-14_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {record; view; hear; log}] the content of a user session under [AU-14_ODP[03]; circumstances under which the content of a user session can be audited are defined]. - the capability for [AU-14_ODP[01]; users or roles who can audit the content of a user session are defined] to [AU-14_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {record; view; hear; log}] the content of a user session under [AU-14_ODP[03]; circumstances under which the content of a user session can be audited are defined] is implemented.'),\n('003847','draft','2022-03-02','DISA','technical','Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.','AU-14b.','N/A','Determine if: - session auditing activities are developed in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. - session auditing activities are integrated in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. - session auditing activities are used in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.'),\n('003848','draft','2022-03-02','DISA','technical','Implement the capability for authorized users to remotely view and hear content related to an established user session in real time.','AU-14(03)','N/A','Determine if: - the capability for authorized users to remotely view and hear content related to an established user session in real time is provided. - the capability for authorized users to remotely view and hear content related to an established user session in real time is implemented.'),\n('003849','draft','2022-03-02','DISA','policy','Disseminate an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','CA-01a.01(b)','N/A','Determine if the [CA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] assessment, authorization, and monitoring policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.'),\n('003850','draft','2022-03-02','DISA','policy','Defines the personnel or roles to whom the assessment, authorization, and monitoring policy is to be disseminated.','CA-01a.02','N/A','Determine if: - assessment, authorization, and monitoring procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls are developed and documented. - the assessment, authorization, and monitoring procedures are disseminated to [CA-01_ODP[02]; personnel or roles to whom the assessment, authorization, and monitoring procedures are to be disseminated is/are defined].'),\n('003851','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage the development and documentation of the assessment, authorization, and monitoring policy.','CA-01b.','N/A','Determine if the [CA-01_ODP[04]; an official to manage the assessment, authorization, and monitoring policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures.'),\n('003852','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage the development and documentation of the assessment, authorization, and monitoring procedures.','CA-01b.','N/A','Determine if the [CA-01_ODP[04]; an official to manage the assessment, authorization, and monitoring policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures.'),\n('003853','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage the dissemination of the assessment, authorization, and monitoring policy.','CA-01b.','N/A','Determine if the [CA-01_ODP[04]; an official to manage the assessment, authorization, and monitoring policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures.'),\n('003854','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage the dissemination of the assessment, authorization, and monitoring procedures.','CA-01b.','N/A','Determine if the [CA-01_ODP[04]; an official to manage the assessment, authorization, and monitoring policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures.'),\n('003855','draft','2022-03-02','DISA','policy','Review and update the current assessment, authorization, and monitoring policy following organization-defined events.','CA-01c.01','N/A','Determine if: - the current assessment, authorization, and monitoring policy is reviewed and updated [CA-01_ODP[05]; the frequency at which the current assessment, authorization, and monitoring policy is reviewed and updated is defined]. - the current assessment, authorization, and monitoring policy is reviewed and updated following [CA-01_ODP[06]; events that would require the current assessment, authorization, and monitoring policy to be reviewed and updated are defined].'),\n('003856','draft','2022-03-02','DISA','policy','Defines the events following reviewing and updating the current assessment, authorization, and monitoring policy.','CA-01c.01','N/A','Determine if: - the current assessment, authorization, and monitoring policy is reviewed and updated [CA-01_ODP[05]; the frequency at which the current assessment, authorization, and monitoring policy is reviewed and updated is defined]. - the current assessment, authorization, and monitoring policy is reviewed and updated following [CA-01_ODP[06]; events that would require the current assessment, authorization, and monitoring policy to be reviewed and updated are defined].'),\n('003857','draft','2022-03-02','DISA','policy','Review and update the current assessment and authorization procedures following organization-defined events.','CA-01c.02','N/A','Determine if: - the current assessment, authorization, and monitoring procedures are reviewed and updated [CA-01_ODP[07]; the frequency at which the current assessment, authorization, and monitoring procedures are reviewed and updated is defined]. - the current assessment, authorization, and monitoring procedures are reviewed and updated following [CA-01_ODP[08]; events that would require assessment, authorization, and monitoring procedures to be reviewed and updated are defined].'),\n('003858','draft','2022-03-02','DISA','policy','Defines the events following reviewing and updating the current assessment, authorization, and monitoring procedures.','CA-01c.02','N/A','Determine if: - the current assessment, authorization, and monitoring procedures are reviewed and updated [CA-01_ODP[07]; the frequency at which the current assessment, authorization, and monitoring procedures are reviewed and updated is defined]. - the current assessment, authorization, and monitoring procedures are reviewed and updated following [CA-01_ODP[08]; events that would require assessment, authorization, and monitoring procedures to be reviewed and updated are defined].'),\n('003859','draft','2022-03-02','DISA','policy','Select the appropriate assessor or assessment team for the type of assessment to be conducted.','CA-02a.','N/A','Determine if an appropriate assessor or assessment team is selected for the type of assessment to be conducted.'),\n('003860','draft','2022-03-02','DISA','policy','Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment.','CA-02c.','N/A','Determine if the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment.'),\n('003861','draft','2022-03-02','DISA','policy','Assess the controls in the systems and its environment of operation on an organization-defined frequency, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the privacy requirements.','CA-02d.','N/A','Determine if: - controls are assessed in the system and its environment of operation [CA-02_ODP[01]; the frequency at which to assess controls in the system and its environment of operation is defined] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements. - controls are assessed in the system and its environment of operation [CA-02_ODP[01]; the frequency at which to assess controls in the system and its environment of operation is defined] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established privacy requirements.'),\n('003862','draft','2022-03-02','DISA','policy','Approve and manage the exchange of information between the system and other systems using interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreement; and/or nondisclosure agreements with an organization-defined type of agreement.','CA-03a.','N/A','Determine if the exchange of information between the system and other systems is approved and managed using [CA-03_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; [CA-03_ODP[02]; the type of agreement used to approve and manage the exchange of information is defined (if selected)]}].'),\n('003863','draft','2022-03-02','DISA','policy','Document, as part of each exchange agreement, the privacy requirements, controls and responsibilities for each system, and the impact level of the information communicated.','CA-03b.','N/A','Determine if: - the interface characteristics are documented as part of each exchange agreement. - security requirements are documented as part of each exchange agreement. - privacy requirements are documented as part of each exchange agreement. - controls are documented as part of each exchange agreement. - responsibilities for each system are documented as part of each exchange agreement. - the impact level of the information communicated is documented as part of each exchange agreement.'),\n('003864','draft','2022-03-02','DISA','policy','Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.','CA-03(06)','N/A','Determine if individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.'),\n('003865','draft','2022-03-02','DISA','policy','Identify transitive (downstream) information exchanges with other systems through the systems identified in CA-3a.','CA-03(07)(a)','N/A','Determine if transitive (downstream) information exchanges with other systems through the systems identified in CA-03a are identified.'),\n('003866','draft','2022-03-02','DISA','policy','Take measures to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.','CA-03(07)(b)','N/A','Determine if measures are taken to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.'),\n('003867','draft','2022-03-02','DISA','policy','Defines the automated mechanisms to ensure the accuracy, currency, and availability of the plan of actions and milestones.','CA-05(01)','N/A','Determine if [CA-05(01)_ODP; automated mechanisms used to ensure the accuracy, currency, and availability of the plan of action and milestones for the system are defined] are used to ensure the accuracy, currency, and availability of the plan of action and milestones for the system.'),\n('003868','draft','2022-03-02','DISA','policy','Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems.','CA-06b.','N/A','Determine if a senior official is assigned as the authorizing official for common controls available for inheritance by organizational systems.'),\n('003869','draft','2022-03-02','DISA','policy','Ensure the authorizing official accepts the use of common controls inherited by the system, before commencing operations.','CA-06c.01','N/A','Determine if before commencing operations, the authorizing official for the system accepts the use of common controls inherited by the system.'),\n('003870','draft','2022-03-02','DISA','policy','Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems.','CA-06d.','N/A','Determine if the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems.'),\n('003871','draft','2022-03-02','DISA','policy','Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization.','CA-06(01)','N/A','Determine if: - a joint authorization process is employed for the system. - the joint authorization process employed for the system includes multiple authorizing officials from the same organization conducting the authorization.'),\n('003872','draft','2022-03-02','DISA','policy','Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization.','CA-06(02)','N/A','Determine if: - a joint authorization process is employed for the system. - the joint authorization process employed for the system includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization.'),\n('003873','draft','2022-03-02','DISA','policy','Implement continuous monitoring in accordance with the organization-level continuous monitoring strategy.','CA-07','N/A','Determine if: - a system-level continuous monitoring strategy is developed. - system-level continuous monitoring is implemented in accordance with the organization-level continuous monitoring strategy.'),\n('003874','draft','2022-03-02','DISA','policy','Defines the system-level metrics to be monitored.','CA-07a.','N/A','Determine if system-level continuous monitoring includes establishment of the following system-level metrics to be monitored: [CA-07_ODP[01]; system-level metrics to be monitored are defined].'),\n('003875','draft','2022-03-02','DISA','policy','Establish organization-defined frequencies for assessment of control effectiveness.','CA-07b.','N/A','Determine if: - system-level continuous monitoring includes established [CA-07_ODP[02]; frequencies at which to monitor control effectiveness are defined] for monitoring. - system-level continuous monitoring includes established [CA-07_ODP[03]; frequencies at which to assess control effectiveness are defined] for assessment of control effectiveness.'),\n('003876','draft','2022-03-02','DISA','policy','Defines the frequencies for monitoring of control effectiveness.','CA-07b.','N/A','Determine if: - system-level continuous monitoring includes established [CA-07_ODP[02]; frequencies at which to monitor control effectiveness are defined] for monitoring. - system-level continuous monitoring includes established [CA-07_ODP[03]; frequencies at which to assess control effectiveness are defined] for assessment of control effectiveness.'),\n('003877','draft','2022-03-02','DISA','policy','Defines the frequencies for assessment of control effectiveness.','CA-07b.','N/A','Determine if: - system-level continuous monitoring includes established [CA-07_ODP[02]; frequencies at which to monitor control effectiveness are defined] for monitoring. - system-level continuous monitoring includes established [CA-07_ODP[03]; frequencies at which to assess control effectiveness are defined] for assessment of control effectiveness.'),\n('003878','draft','2022-03-02','DISA','policy','Develop ongoing control assessments in accordance with the continuous monitoring strategy.','CA-07c.','N/A','Determine if system-level continuous monitoring includes ongoing control assessments in accordance with the continuous monitoring strategy.'),\n('003879','draft','2022-03-02','DISA','policy','Implement a continuous monitoring program that includes reporting the privacy status to organization-defined personnel or roles on an organization-defined frequency.','CA-07g.','N/A','Determine if: - system-level continuous monitoring includes reporting the security status of the system to [CA-07_ODP[04]; personnel or roles to whom the security status of the system is reported are defined] [CA-07_ODP[05]; frequency at which the security status of the system is reported is defined]. - system-level continuous monitoring includes reporting the privacy status of the system to [CA-07_ODP[06]; personnel or roles to whom the privacy status of the system is reported are defined] [CA-07_ODP[07]; frequency at which the privacy status of the system is reported is defined].'),\n('003880','draft','2022-03-02','DISA','policy','Defines the frequency with which to report the privacy status to organization-defined personnel or roles.','CA-07g.','N/A','Determine if: - system-level continuous monitoring includes reporting the security status of the system to [CA-07_ODP[04]; personnel or roles to whom the security status of the system is reported are defined] [CA-07_ODP[05]; frequency at which the security status of the system is reported is defined]. - system-level continuous monitoring includes reporting the privacy status of the system to [CA-07_ODP[06]; personnel or roles to whom the privacy status of the system is reported are defined] [CA-07_ODP[07]; frequency at which the privacy status of the system is reported is defined].'),\n('003881','draft','2022-03-02','DISA','policy','Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes effectiveness monitoring.','CA-07(04)(a)','N/A','Determine if effectiveness monitoring is included in risk monitoring,'),\n('003882','draft','2022-03-02','DISA','policy','Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes compliance monitoring.','CA-07(04)(b)','N/A','Determine if compliance monitoring is included in risk monitoring,'),\n('003883','draft','2022-03-02','DISA','policy','Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes change monitoring.','CA-07(04)(c)','N/A','Determine if change monitoring is included in risk monitoring.'),\n('003884','draft','2022-03-02','DISA','policy','Employ organization-defined actions to validate that policies are established.','CA-07(05)','N/A','Determine if: - [CA-07(05)_ODP[01; actions to validate that policies are established are defined] are employed to validate that policies are established. - [CA-07(05)_ODP[02]; actions to validate that implemented controls are operating in a consistent manner are defined] are employed to validate that implemented controls are operating in a consistent manner.'),\n('003885','draft','2022-03-02','DISA','policy','Employ organization-defined actions to validate that implemented controls are operating in a consistent manner.','CA-07(05)','N/A','Determine if: - [CA-07(05)_ODP[01; actions to validate that policies are established are defined] are employed to validate that policies are established. - [CA-07(05)_ODP[02]; actions to validate that implemented controls are operating in a consistent manner are defined] are employed to validate that implemented controls are operating in a consistent manner.'),\n('003886','draft','2022-03-02','DISA','policy','Defines the actions used to validate policies.','CA-07(05)','N/A','Determine if: - [CA-07(05)_ODP[01; actions to validate that policies are established are defined] are employed to validate that policies are established. - [CA-07(05)_ODP[02]; actions to validate that implemented controls are operating in a consistent manner are defined] are employed to validate that implemented controls are operating in a consistent manner.'),\n('003887','draft','2022-03-02','DISA','policy','Ensure the accuracy, currency, and availability of monitoring results for the system using organization-defined automated mechanisms.','CA-07(06)','N/A','Determine if [CA-07(06)_ODP; automated mechanisms used to ensure the accuracy, currency, and availability of monitoring results for the system are defined] are used to ensure the accuracy, currency, and availability of monitoring results for the system.'),\n('003888','draft','2022-03-02','DISA','policy','Defines the automated mechanisms for ensuring accuracy, currency, and availability of monitoring results.','CA-07(06)','N/A','Determine if [CA-07(06)_ODP; automated mechanisms used to ensure the accuracy, currency, and availability of monitoring results for the system are defined] are used to ensure the accuracy, currency, and availability of monitoring results for the system.'),\n('003889','draft','2022-03-02','DISA','policy','Employ a penetration testing process, on an organization-defined frequency, that includes announced or unannounced attempts to bypass or circumvent controls associated with physical access points to the facility.','CA-08(03)','N/A','Determine if the penetration testing process includes [CA-08(03)_ODP[01]; frequency at which to employ penetration testing that attempts to bypass or circumvent controls associated with physical access points to the facility is defined] [CA-08(03)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {announced; unannounced}] attempts to bypass or circumvent controls associated with physical access points to facility.'),\n('003890','draft','2022-03-02','DISA','policy','Defines the frequency the penetration testing process will be employed.','CA-08(03)','N/A','Determine if the penetration testing process includes [CA-08(03)_ODP[01]; frequency at which to employ penetration testing that attempts to bypass or circumvent controls associated with physical access points to the facility is defined] [CA-08(03)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {announced; unannounced}] attempts to bypass or circumvent controls associated with physical access points to facility.'),\n('003891','draft','2022-03-02','DISA','policy','Document, for each internal connection, the privacy requirements.','CA-09b.','N/A','Determine if: - for each internal connection, the interface characteristics are documented. - for each internal connection, the security requirements are documented. - for each internal connection, the privacy requirements are documented. - for each internal connection, the nature of the information communicated is documented.'),\n('003892','draft','2022-03-02','DISA','policy','Terminate internal system connections after organization-defined conditions.','CA-09c.','N/A','Determine if internal system connections are terminated after [CA-09_ODP[02]; conditions requiring termination of internal connections are defined].'),\n('003893','draft','2022-03-02','DISA','policy','Defines the conditions for terminating internal system connections.','CA-09c.','N/A','Determine if internal system connections are terminated after [CA-09_ODP[02]; conditions requiring termination of internal connections are defined].'),\n('003894','draft','2022-03-02','DISA','policy','Review on an organization-defined frequency the continued need for each internal connection.','CA-09d.','N/A','Determine if the continued need for each internal connection is reviewed [CA-09_ODP[03]; frequency at which to review the continued need for each internal connection is defined].'),\n('003895','draft','2022-03-02','DISA','policy','Defines the frequency for reviewing each internal connection.','CA-09d.','N/A','Determine if the continued need for each internal connection is reviewed [CA-09_ODP[03]; frequency at which to review the continued need for each internal connection is defined].'),\n('003896','draft','2022-03-02','DISA','policy','Perform privacy compliance checks on constituent components prior to the establishment of the internal connection.','CA-09(01)','N/A','Determine if: - security compliance checks are performed on constituent system components prior to the establishment of the internal connection. - privacy compliance checks are performed on constituent system components prior to the establishment of the internal connection.'),\n('003897','draft','2022-03-02','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system-level configuration management policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','CM-01a.01(b)','N/A','Determine if the configuration management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('003898','draft','2022-03-02','DISA','policy','Defines the official to manage the development, documentation, and dissemination of the configuration management policy.','CM-01b.','N/A','Determine if the [CM-01_ODP[04]; an official to manage the configuration management policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures.'),\n('003899','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage the development and documentation of the configuration management policy.','CM-01b.','N/A','Determine if the [CM-01_ODP[04]; an official to manage the configuration management policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures.'),\n('003900','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage the dissemination of the configuration management policy.','CM-01b.','N/A','Determine if the [CM-01_ODP[04]; an official to manage the configuration management policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures.'),\n('003901','draft','2022-03-02','DISA','policy','Defines the official to manage the development, documentation, and dissemination of the configuration management procedures.','CM-01b.','N/A','Determine if the [CM-01_ODP[04]; an official to manage the configuration management policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures.'),\n('003902','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage the development and documentation of the configuration management procedures.','CM-01b.','N/A','Determine if the [CM-01_ODP[04]; an official to manage the configuration management policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures.'),\n('003903','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage the dissemination of the configuration management procedures.','CM-01b.','N/A','Determine if the [CM-01_ODP[04]; an official to manage the configuration management policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures.'),\n('003904','draft','2022-03-02','DISA','policy','Review and update the configuration management policy following organization-defined events.','CM-01c.01','N/A','Determine if: - the current configuration management policy is reviewed and updated [CM-01_ODP[05]; the frequency at which the current configuration management policy is reviewed and updated is defined]. - the current configuration management policy is reviewed and updated following [CM-01_ODP[06]; events that would require the current configuration management policy to be reviewed and updated are defined].'),\n('003905','draft','2022-03-02','DISA','policy','Defines the events for when the policy will be reviewed and updated.','CM-01c.01','N/A','Determine if: - the current configuration management policy is reviewed and updated [CM-01_ODP[05]; the frequency at which the current configuration management policy is reviewed and updated is defined]. - the current configuration management policy is reviewed and updated following [CM-01_ODP[06]; events that would require the current configuration management policy to be reviewed and updated are defined].'),\n('003906','draft','2022-03-02','DISA','policy','Review and update, on an organization-defined frequency, the current configuration management procedures.','CM-01c.02','N/A','Determine if: - the current configuration management procedures are reviewed and updated [CM-01_ODP[07]; the frequency at which the current configuration management procedures are reviewed and updated is defined]. - the current configuration management procedures are reviewed and updated following [CM-01_ODP[08]; events that would require configuration management procedures to be reviewed and updated are defined].'),\n('003907','draft','2022-03-02','DISA','policy','Review and update the configuration management procedures following organization-defined events.','CM-01c.02','N/A','Determine if: - the current configuration management procedures are reviewed and updated [CM-01_ODP[07]; the frequency at which the current configuration management procedures are reviewed and updated is defined]. - the current configuration management procedures are reviewed and updated following [CM-01_ODP[08]; events that would require configuration management procedures to be reviewed and updated are defined].'),\n('003908','draft','2022-03-02','DISA','policy','Defines the events for when the procedures will be reviewed and updated.','CM-01c.02','N/A','Determine if: - the current configuration management procedures are reviewed and updated [CM-01_ODP[07]; the frequency at which the current configuration management procedures are reviewed and updated is defined]. - the current configuration management procedures are reviewed and updated following [CM-01_ODP[08]; events that would require configuration management procedures to be reviewed and updated are defined].'),\n('003909','draft','2022-03-02','DISA','policy','Develop and document, under configuration control, a current baseline configuration of the system.','CM-02a.','N/A','Determine if: - a current baseline configuration of the system is developed and documented. - a current baseline configuration of the system is maintained under configuration control.'),\n('003910','draft','2022-03-02','DISA','policy','Review and update the baseline configuration of the system when system components are installed or upgraded.','CM-02b.03','N/A','Determine if the baseline configuration of the system is reviewed and updated when system components are installed or upgraded.'),\n('003911','draft','2022-03-02','DISA','policy','Defines the automated mechanisms for maintaining the currency, completeness, accuracy, and availability of the baseline configuration of the system.','CM-02(02)','N/A','Determine if: - the currency of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the completeness of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the accuracy of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined]. - the availability of the baseline configuration of the system is maintained using [CM-02(02)_ODP; automated mechanisms for maintaining baseline configuration of the system are defined].'),\n('003912','draft','2022-03-02','DISA','policy','Approve or disapprove configuration-controlled changes to the system, with explicit consideration for privacy impact analyses.','CM-03b.','N/A','Determine if: - proposed configuration-controlled changes to the system are reviewed. - proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security and privacy impact analyses.'),\n('003913','draft','2022-03-02','DISA','policy','Defines the automated mechanisms for documenting proposed changes to the system.','CM-03(01)(a)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to document proposed changes to the system.'),\n('003914','draft','2022-03-02','DISA','policy','Defines the automated mechanisms for notifying approval authorities of proposed changes to the system and request change proposal.','CM-03(01)(b)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to notify [CM-03(01)_ODP[02]; approval authorities to be notified of and request approval for proposed changes to the system are defined] of proposed changes to the system and request change approval.'),\n('003915','draft','2022-03-02','DISA','policy','Defines the automated mechanisms for highlighting proposed changes to the system that have not been approved or disapproved within an organization-defined time period.','CM-03(01)(c)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to highlight proposed changes to the system that have not been approved or disapproved within [CM-03(01)_ODP[03]l the time period after which to highlight changes that have not been approved or disapproved is defined].'),\n('003916','draft','2022-03-02','DISA','policy','Defines the automated mechanisms for prohibiting changes to the system until designated approvals are received.','CM-03(01)(d)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to prohibit changes to the system until designated approvals are received.'),\n('003917','draft','2022-03-02','DISA','policy','Defines the automated mechanisms for documenting all changes to the system.','CM-03(01)(e)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to document all changes to the system.'),\n('003918','draft','2022-03-02','DISA','policy','Defines the automated mechanisms for notifying organization-defined personnel when approved changes to the system are completed.','CM-03(01)(f)','N/A','Determine if [CM-03(01)_ODP[01]; mechanisms used to automate configuration change control are defined] are used to notify [CM-03(01)_ODP[04]; personnel to be notified when approved changes are complete is/are defined] when approved changes to the system are completed.'),\n('003919','draft','2022-03-02','DISA','policy','Defines the automated mechanisms to implement changes to the current system baseline.','CM-03(03)','N/A','Determine if: - changes to the current system baseline are implemented using [CM-03(03)_ODP; mechanisms used to automate the implementation of changes and deployment of the updated baseline across the installed base are defined]. - the updated baseline is deployed across the installed base using [CM-03(03)_ODP; mechanisms used to automate the implementation of changes and deployment of the updated baseline across the installed base are defined].'),\n('003920','draft','2022-03-02','DISA','policy','Defines the automated mechanisms to deploy the updated baselines across the installed base.','CM-03(03)','N/A','Determine if: - changes to the current system baseline are implemented using [CM-03(03)_ODP; mechanisms used to automate the implementation of changes and deployment of the updated baseline across the installed base are defined]. - the updated baseline is deployed across the installed base using [CM-03(03)_ODP; mechanisms used to automate the implementation of changes and deployment of the updated baseline across the installed base are defined].'),\n('003921','draft','2022-03-02','DISA','policy','Require an organization-defined privacy representative to be a member of the organization-defined configuration change control element.','CM-03(04)','N/A','Determine if: - [CM-03(04)_ODP[01]; security representatives required to be members of the change control element are defined] are required to be members of the [CM-03(04)_ODP[03]; the configuration change control element of which the security and privacy representatives are to be members is defined]. - [CM-03(04)_ODP[02]; privacy representatives required to be members of the change control element are defined] are required to be members of the [CM-03(04)_ODP[03]; the configuration change control element of which the security and privacy representatives are to be members is defined].'),\n('003922','draft','2022-03-02','DISA','policy','Defines the security representatives required to be members of the configuration change control element.','CM-03(04)','N/A','Determine if: - [CM-03(04)_ODP[01]; security representatives required to be members of the change control element are defined] are required to be members of the [CM-03(04)_ODP[03]; the configuration change control element of which the security and privacy representatives are to be members is defined]. - [CM-03(04)_ODP[02]; privacy representatives required to be members of the change control element are defined] are required to be members of the [CM-03(04)_ODP[03]; the configuration change control element of which the security and privacy representatives are to be members is defined].'),\n('003923','draft','2022-03-02','DISA','policy','Defines the privacy representatives required to be members of the configuration change control element.','CM-03(04)','N/A','Determine if: - [CM-03(04)_ODP[01]; security representatives required to be members of the change control element are defined] are required to be members of the [CM-03(04)_ODP[03]; the configuration change control element of which the security and privacy representatives are to be members is defined]. - [CM-03(04)_ODP[02]; privacy representatives required to be members of the change control element are defined] are required to be members of the [CM-03(04)_ODP[03]; the configuration change control element of which the security and privacy representatives are to be members is defined].'),\n('003924','draft','2022-03-02','DISA','policy','Defines the configuration change control element required for security and privacy representatives.','CM-03(04)','N/A','Determine if: - [CM-03(04)_ODP[01]; security representatives required to be members of the change control element are defined] are required to be members of the [CM-03(04)_ODP[03]; the configuration change control element of which the security and privacy representatives are to be members is defined]. - [CM-03(04)_ODP[02]; privacy representatives required to be members of the change control element are defined] are required to be members of the [CM-03(04)_ODP[03]; the configuration change control element of which the security and privacy representatives are to be members is defined].'),\n('003925','draft','2022-03-02','DISA','policy','Review changes to the system on an organization-defined frequency or when there are organization-defined circumstances to determine whether unauthorized changes have occurred.','CM-03(07)','N/A','Determine if changes to the system are reviewed [CM-03(07)_ODP[01]; the frequency at which changes are to be reviewed is defined] or when [CM-03(07)_ODP[02]; the circumstances under which changes are to be reviewed are defined] to determine whether unauthorized changes have occurred.'),\n('003926','draft','2022-03-02','DISA','policy','Defines the frequency for reviewing changes to the system.','CM-03(07)','N/A','Determine if changes to the system are reviewed [CM-03(07)_ODP[01]; the frequency at which changes are to be reviewed is defined] or when [CM-03(07)_ODP[02]; the circumstances under which changes are to be reviewed are defined] to determine whether unauthorized changes have occurred.'),\n('003927','draft','2022-03-02','DISA','policy','Defines the circumstances for determining whether unauthorized changes to the system have occurred.','CM-03(07)','N/A','Determine if changes to the system are reviewed [CM-03(07)_ODP[01]; the frequency at which changes are to be reviewed is defined] or when [CM-03(07)_ODP[02]; the circumstances under which changes are to be reviewed are defined] to determine whether unauthorized changes have occurred.'),\n('003928','draft','2022-03-02','DISA','technical','Prevent or restrict changes to the configuration of the system under organization-defined circumstances.','CM-03(08)','N/A','Determine if changes to the configuration of the system are prevented or restricted under [CM-03(08)_ODP; the circumstances under which changes are to be prevented or restricted are defined].'),\n('003929','draft','2022-03-02','DISA','technical','Defines the circumstances for preventing or restricting changes to the configuration of the system.','CM-03(08)','N/A','Determine if changes to the configuration of the system are prevented or restricted under [CM-03(08)_ODP; the circumstances under which changes are to be prevented or restricted are defined].'),\n('003930','draft','2022-03-02','DISA','policy','Analyze changes to the system to determine potential privacy impacts prior to change implementation.','CM-04','N/A','Determine if: - changes to the system are analyzed to determine potential security impacts prior to change implementation. - changes to the system are analyzed to determine potential privacy impacts prior to change implementation.'),\n('003931','draft','2022-03-02','DISA','policy','When analyzing changes to the system, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.','CM-04(01)','N/A','Determine if: - changes to the system are analyzed in a separate test environment before implementation in an operational environment. - changes to the system are analyzed for security impacts due to flaws. - changes to the system are analyzed for privacy impacts due to flaws. - changes to the system are analyzed for security impacts due to weaknesses. - changes to the system are analyzed for privacy impacts due to weaknesses. - changes to the system are analyzed for privacy impacts due to incompatibility. - changes to the system are analyzed for privacy impacts due to incompatibility. - changes to the system are analyzed for security impacts due to intentional malice. - changes to the system are analyzed for privacy impacts due to intentional malice.'),\n('003932','draft','2022-03-02','DISA','policy','After system changes, verify that the impacted controls are implemented correctly, meeting the privacy requirements for the system.','CM-04(02)','N/A','Determine if: - the impacted controls are implemented correctly with regard to meeting the security requirements for the system after system changes. - the impacted controls are implemented correctly with regard to meeting the privacy requirements for the system after system changes. - the impacted controls are operating as intended with regard to meeting the security requirements for the system after system changes. - the impacted controls are operating as intended with regard to meeting the privacy requirements for the system after system changes. - the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system after system changes. - the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system after system changes.'),\n('003933','draft','2022-03-02','DISA','policy','After system changes, verify that the impacted controls are operating as intended, meeting the privacy requirements for the system.','CM-04(02)','N/A','Determine if: - the impacted controls are implemented correctly with regard to meeting the security requirements for the system after system changes. - the impacted controls are implemented correctly with regard to meeting the privacy requirements for the system after system changes. - the impacted controls are operating as intended with regard to meeting the security requirements for the system after system changes. - the impacted controls are operating as intended with regard to meeting the privacy requirements for the system after system changes. - the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system after system changes. - the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system after system changes.'),\n('003934','draft','2022-03-02','DISA','policy','After system changes, verify that the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system.','CM-04(02)','N/A','Determine if: - the impacted controls are implemented correctly with regard to meeting the security requirements for the system after system changes. - the impacted controls are implemented correctly with regard to meeting the privacy requirements for the system after system changes. - the impacted controls are operating as intended with regard to meeting the security requirements for the system after system changes. - the impacted controls are operating as intended with regard to meeting the privacy requirements for the system after system changes. - the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system after system changes. - the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system after system changes.'),\n('003935','draft','2022-03-02','DISA','policy','Define and document physical access restrictions associated with changes to the system.','CM-05','N/A','Determine if: - physical access restrictions associated with changes to the system are defined and documented. - physical access restrictions associated with changes to the system are approved. - physical access restrictions associated with changes to the system are enforced. - logical access restrictions associated with changes to the system are defined and documented. - logical access restrictions associated with changes to the system are approved. - logical access restrictions associated with changes to the system are enforced.'),\n('003936','draft','2022-03-02','DISA','policy','Define and document logical access restrictions associated with changes to the system.','CM-05','N/A','Determine if: - physical access restrictions associated with changes to the system are defined and documented. - physical access restrictions associated with changes to the system are approved. - physical access restrictions associated with changes to the system are enforced. - logical access restrictions associated with changes to the system are defined and documented. - logical access restrictions associated with changes to the system are approved. - logical access restrictions associated with changes to the system are enforced.'),\n('003937','draft','2022-03-02','DISA','technical','Defines the automated mechanisms to enforce access restrictions.','CM-05(01)(a)','N/A','Determine if access restrictions for change are enforced using [CM-05(01)_ODP; mechanisms used to automate the enforcement of access restrictions are defined].'),\n('003938','draft','2022-03-02','DISA','technical','Automatically generate audit records of the enforcement actions.','CM-05(01)(b)','N/A','Determine if audit records of enforcement actions are automatically generated.'),\n('003939','draft','2022-03-02','DISA','policy','Defines the frequency with which to review and reevaluate system privileges.','CM-05(05)(b)','N/A','Determine if: - privileges are reviewed [CM-05(05)_ODP[01; frequency at which to review privileges is defined]. - privileges are reevaluated [CM-05(05)_ODP[02]; frequency at which to reevaluate privileges is defined].'),\n('003940','draft','2022-03-02','DISA','policy','Review and reevaluate system privileges per an organization-defined frequency.','CM-05(05)(b)','N/A','Determine if: - privileges are reviewed [CM-05(05)_ODP[01; frequency at which to review privileges is defined]. - privileges are reevaluated [CM-05(05)_ODP[02]; frequency at which to reevaluate privileges is defined].'),\n('003941','draft','2022-03-02','DISA','policy','Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using organization-defined common secure configurations.','CM-06a.','N/A','Determine if configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using [CM-06_ODP[01]; common secure configurations to establish and document configuration settings for components employed within the system are defined].'),\n('003942','draft','2022-03-02','DISA','policy','Defines the common secure configurations for establishing and documenting configuration settings within the system, that reflect the most restrictive mode consistent with operational requirements.','CM-06a.','N/A','Determine if configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using [CM-06_ODP[01]; common secure configurations to establish and document configuration settings for components employed within the system are defined].'),\n('003943','draft','2022-03-02','DISA','policy','Monitor changes to the configuration settings in accordance with organizational policies.','CM-06d.','N/A','Determine if: - changes to the configuration settings are monitored in accordance with organizational policies and procedures. - changes to the configuration settings are controlled in accordance with organizational policies and procedures.'),\n('003944','draft','2022-03-02','DISA','policy','Monitor changes to the configuration settings in accordance with organizational procedures.','CM-06d.','N/A','Determine if: - changes to the configuration settings are monitored in accordance with organizational policies and procedures. - changes to the configuration settings are controlled in accordance with organizational policies and procedures.'),\n('003945','draft','2022-03-02','DISA','policy','Control changes to the configuration settings in accordance with organizational policies.','CM-06d.','N/A','Determine if: - changes to the configuration settings are monitored in accordance with organizational policies and procedures. - changes to the configuration settings are controlled in accordance with organizational policies and procedures.'),\n('003946','draft','2022-03-02','DISA','policy','Control changes to the configuration settings in accordance with organizational procedures.','CM-06d.','N/A','Determine if: - changes to the configuration settings are monitored in accordance with organizational policies and procedures. - changes to the configuration settings are controlled in accordance with organizational policies and procedures.'),\n('003947','draft','2022-03-02','DISA','policy','Defines the automated mechanisms for managing, applying, and verifying configuration settings.','CM-06(01)','N/A','Determine if: - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are managed using [CM-06(01)_ODP[02]; automated mechanisms to manage configuration settings are defined]. - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are applied using [CM-06(01)_ODP[03]; automated mechanisms to apply configuration settings are defined]. - configuration settings for [CM-06(01)_ODP[01]; system components for which to manage, apply, and verify configuration settings are defined] are verified using [CM-06(01)_ODP[04]; automated mechanisms to verify configuration settings are defined].'),\n('003948','draft','2022-03-02','DISA','policy','Defines the mission essential capabilities for configuring the system.','CM-07a.','N/A','Determine if the system is configured to provide only [CM-07_ODP[01]; mission-essential capabilities for the system are defined].'),\n('003949','draft','2022-03-02','DISA','policy','Require that organization-defined user-installed software in a confined physical or virtual machine environment with limited privileges.','CM-07(06)','N/A','Determine if [CM-07(06)_ODP; user-installed software required to be executed in a confined environment is defined] is required to be executed in a confined physical or virtual machine environment with limited privileges.'),\n('003950','draft','2022-03-02','DISA','policy','Defines the user-installed software required for executing in a confined physical or virtual machine environment with limited privileges.','CM-07(06)','N/A','Determine if [CM-07(06)_ODP; user-installed software required to be executed in a confined environment is defined] is required to be executed in a confined physical or virtual machine environment with limited privileges.'),\n('003951','draft','2022-03-02','DISA','policy','Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of organization-defined personnel or roles when such code is obtained from sources with limited or no warranty.','CM-07(07)(a)','N/A','Determine if the execution of binary or machine-executable code obtained from sources with limited or no warranty is only allowed with the explicit approval of [CM-07(07)_ODP; personnel or roles to explicitly approve execution of binary or machine-executable code is/are defined].'),\n('003952','draft','2022-03-02','DISA','policy','Defines the personnel or roles who allow execution of binary or machine-executable code only in confined physical or virtual machine environments when such code is obtained from sources with limited or no warranty.','CM-07(07)(a)','N/A','Determine if the execution of binary or machine-executable code obtained from sources with limited or no warranty is only allowed with the explicit approval of [CM-07(07)_ODP; personnel or roles to explicitly approve execution of binary or machine-executable code is/are defined].'),\n('003953','draft','2022-03-02','DISA','policy','Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of organization-defined personnel or roles when such code is without the provision of source code.','CM-07(07)(b)','N/A','Determine if the execution of binary or machine-executable code without the provision of source code is only allowed with the explicit approval of [CM-07(07)_ODP; personnel or roles to explicitly approve execution of binary or machine-executable code is/are defined].'),\n('003954','draft','2022-03-02','DISA','policy','Defines the personnel or roles who allow execution of binary or machine-executable code only in confined physical or virtual machine environments when such code is without the provision of source code.','CM-07(07)(b)','N/A','Determine if the execution of binary or machine-executable code without the provision of source code is only allowed with the explicit approval of [CM-07(07)_ODP; personnel or roles to explicitly approve execution of binary or machine-executable code is/are defined].'),\n('003955','draft','2022-03-02','DISA','policy','Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code.','CM-07(08)(a)','N/A','Determine if the use of binary or machine-executable code is prohibited when it originates from sources with limited or no warranty or without the provision of source code.'),\n('003956','draft','2022-03-02','DISA','policy','Allow exceptions only for compelling mission or operational requirements and with the approval of the authorizing official.','CM-07(08)(b)','N/A','Determine if: - exceptions to the prohibition of binary or machine-executable code from sources with limited or no warranty or without the provision of source code are allowed only for compelling mission or operational requirements. - exceptions to the prohibition of binary or machine-executable code from sources with limited or no warranty or without the provision of source code are allowed only with the approval of the authorizing official.'),\n('003957','draft','2022-03-02','DISA','policy','Identify organization-defined hardware components authorized for system use.','CM-07(09)(a)','N/A','Determine if [CM-07(09)_ODP[01]; hardware components authorized for system use are defined] are identified.'),\n('003958','draft','2022-03-02','DISA','policy','Defines the hardware components to be identified for authorized system use.','CM-07(09)(a)','N/A','Determine if [CM-07(09)_ODP[01]; hardware components authorized for system use are defined] are identified.'),\n('003959','draft','2022-03-02','DISA','policy','Prohibit the use or connection of unauthorized hardware components.','CM-07(09)(b)','N/A','Determine if the use or connection of unauthorized hardware components is prohibited.'),\n('003960','draft','2022-03-02','DISA','policy','Review and update the list of authorized hardware components on an organization-defined frequency.','CM-07(09)(c)','N/A','Determine if the list of authorized hardware components is reviewed and updated [CM-07(09)_ODP[02]; frequency at which to review and update the list of authorized hardware components is defined].'),\n('003961','draft','2022-03-02','DISA','policy','Defines the frequency the hardware components are reviewed and updated.','CM-07(09)(c)','N/A','Determine if the list of authorized hardware components is reviewed and updated [CM-07(09)_ODP[02]; frequency at which to review and update the list of authorized hardware components is defined].'),\n('003962','draft','2022-03-02','DISA','policy','Develop and document an inventory of system components that accurately reflects the system.','CM-08a.01','N/A','Determine if an inventory of system components that accurately reflects the system is developed and documented.'),\n('003963','draft','2022-03-02','DISA','policy','Develop and document an inventory of system components that includes all components within the system.','CM-08a.02','N/A','Determine if an inventory of system components that includes all components within the system is developed and documented.'),\n('003964','draft','2022-03-02','DISA','policy','Develop and document an inventory of system components that does not include duplicate accounting of components or components assigned to any other system.','CM-08a.03','N/A','Determine if an inventory of system components that does not include duplicate accounting of components or components assigned to any other system is developed and documented.'),\n('003965','draft','2022-03-02','DISA','policy','Develop and document an inventory of system components that is at the level of granularity deemed necessary for tracking.','CM-08a.04','N/A','Determine if an inventory of system components that is at the level of granularity deemed necessary for tracking and reporting is developed and documented.'),\n('003966','draft','2022-03-02','DISA','policy','Develop and document an inventory of system components that is at the level of granularity deemed necessary for reporting.','CM-08a.04','N/A','Determine if an inventory of system components that is at the level of granularity deemed necessary for tracking and reporting is developed and documented.'),\n('003967','draft','2022-03-02','DISA','policy','Develop and document an inventory of system components that includes organization-defined information deemed necessary to achieve effective system component accountability.','CM-08a.05','N/A','Determine if an inventory of system components that includes [CM-08_ODP[01]; information deemed necessary to achieve effective system component accountability is defined] is developed and documented.'),\n('003968','draft','2022-03-02','DISA','policy','Defines the automated mechanisms for maintaining the currency, completeness, accuracy, and availability of the inventory of the system components.','CM-08(02)','N/A','Determine if: - [CM-08(02)_ODP[01]; automated mechanisms used to maintain the currency of the system component inventory are defined] are used to maintain the currency of the system component inventory. - [CM-08(02)_ODP[02]; automated mechanisms used to maintain the completeness of the system component inventory are defined] are used to maintain the completeness of the system component inventory. - [CM-08(02)_ODP[03]; automated mechanisms used to maintain the accuracy of the system component inventory are defined] are used to maintain the accuracy of the system component inventory. - [CM-08(02)_ODP[04]; automated mechanisms used to maintain the availability of the system component inventory are defined] are used to maintain the availability of the system component inventory.'),\n('003969','draft','2022-03-02','DISA','policy','Defines the automated mechanisms for detecting the presence of unauthorized hardware, software, and firmware components within the system.','CM-08(03)(a)','N/A','Determine if: - the presence of unauthorized hardware within the system is detected using [CM-08(03)_ODP[01]; automated mechanisms used to detect the presence of unauthorized hardware within the system are defined] [CM-08(03)_ODP[04]; frequency at which automated mechanisms are used to detect the presence of unauthorized system components within the system is defined]. - the presence of unauthorized software within the system is detected using [CM-08(03)_ODP[02]; automated mechanisms used to detect the presence of unauthorized software within the system are defined] [CM-08(03)_ODP[04]; frequency at which automated mechanisms are used to detect the presence of unauthorized system components within the system is defined;]. - the presence of unauthorized firmware within the system is detected using [CM-08(03)_ODP[03]; automated mechanisms used to detect the presence of unauthorized firmware within the system are defined] [CM-08(03)_ODP[04]; frequency at which automated mechanisms are used to detect the presence of unauthorized system components within the system is defined].'),\n('003970','draft','2022-03-02','DISA','policy','Defines the automated mechanisms for supporting the tracking of system components by geographic location.','CM-08(08)','N/A','Determine if [CM-08(08)_ODP; automated mechanisms for tracking components are defined] are used to support the tracking of system components by geographic location.'),\n('003971','draft','2022-03-02','DISA','policy','Develop and document a configuration management plan for the system that addresses roles, responsibilities, and configuration management processes.','CM-09a.','N/A','Determine if: - the configuration management plan addresses roles. - the configuration management plan addresses responsibilities. - the configuration management plan addresses configuration management processes and procedures.'),\n('003972','draft','2022-03-02','DISA','policy','Develop and document a configuration management plan for the system that addresses roles, responsibilities, and configuration management procedures.','CM-09a.','N/A','Determine if: - the configuration management plan addresses roles. - the configuration management plan addresses responsibilities. - the configuration management plan addresses configuration management processes and procedures.'),\n('003973','draft','2022-03-02','DISA','policy','Develop and document a configuration management plan for the system that establishes a process for identifying configuration items throughout the system development life cycle.','CM-09b.','N/A','Determine if: - the configuration management plan establishes a process for identifying configuration items throughout the system development life cycle. - the configuration management plan establishes a process for managing the configuration of the configuration items.'),\n('003974','draft','2022-03-02','DISA','policy','Develop and document a configuration management plan for the system that establishes a process for managing the configuration of the configuration items.','CM-09b.','N/A','Determine if: - the configuration management plan establishes a process for identifying configuration items throughout the system development life cycle. - the configuration management plan establishes a process for managing the configuration of the configuration items.'),\n('003975','draft','2022-03-02','DISA','policy','Develop and document a configuration management plan for the system that defines the configuration items for the system.','CM-09c.','N/A','Determine if: - the configuration management plan defines the configuration items for the system. - the configuration management plan places the configuration items under configuration management.'),\n('003976','draft','2022-03-02','DISA','policy','Develop and document a configuration management plan for the system that places the configuration items under configuration management.','CM-09c.','N/A','Determine if: - the configuration management plan defines the configuration items for the system. - the configuration management plan places the configuration items under configuration management.'),\n('003977','draft','2022-03-02','DISA','policy','Develop and document a configuration management plan for the system that is reviewed and approved by organization-defined personnel or roles.','CM-09d.','N/A','Determine if the configuration management plan is reviewed and approved by [CM-09_ODP; personnel or roles to review and approve the configuration management plan is/are defined].'),\n('003978','draft','2022-03-02','DISA','policy','Defines the personnel or roles for those who review and approve the configuration management plan.','CM-09d.','N/A','Determine if the configuration management plan is reviewed and approved by [CM-09_ODP; personnel or roles to review and approve the configuration management plan is/are defined].'),\n('003979','draft','2022-03-02','DISA','policy','Implement a configuration management plan for the system that is reviewed and approved by organization-defined personnel or roles.','CM-09d.','N/A','Determine if the configuration management plan is reviewed and approved by [CM-09_ODP; personnel or roles to review and approve the configuration management plan is/are defined].'),\n('003980','draft','2022-03-02','DISA','technical','Allow user installation of software only with explicit privileged status.','CM-11(02)','N/A','Determine if user installation of software is allowed only with explicit privileged status.'),\n('003981','draft','2022-03-02','DISA','technical','Enforce and monitor compliance with software installation policies using organization-defined automated mechanisms.','CM-11(03)','N/A','Determine if: - compliance with software installation policies is enforced using [CM-11(03)_ODP[01]; automated mechanisms used to enforce compliance are defined]. - compliance with software installation policies is monitored using [CM-11(03)_ODP[02]; automated mechanisms used to monitor compliance are defined].'),\n('003982','draft','2022-03-02','DISA','policy','Identify and document the location of the organization-defined information on which the information is processed and stored.','CM-12a.','N/A','Determine if: - the location of [CM-12_ODP; information for which the location is to be identified and documented is defined] is identified and documented. - the specific system components on which [CM-12_ODP; information for which the location is to be identified and documented is defined] is processed are identified and documented. - the specific system components on which [CM-12_ODP; information for which the location is to be identified and documented is defined] is stored are identified and documented.'),\n('003983','draft','2022-03-02','DISA','policy','Identify and document the specific system components on which the organization-defined information is processed and stored.','CM-12a.','N/A','Determine if: - the location of [CM-12_ODP; information for which the location is to be identified and documented is defined] is identified and documented. - the specific system components on which [CM-12_ODP; information for which the location is to be identified and documented is defined] is processed are identified and documented. - the specific system components on which [CM-12_ODP; information for which the location is to be identified and documented is defined] is stored are identified and documented.'),\n('003984','draft','2022-03-02','DISA','policy','Defines the information on which the location and specific system components are processed and stored.','CM-12a.','N/A','Determine if: - the location of [CM-12_ODP; information for which the location is to be identified and documented is defined] is identified and documented. - the specific system components on which [CM-12_ODP; information for which the location is to be identified and documented is defined] is processed are identified and documented. - the specific system components on which [CM-12_ODP; information for which the location is to be identified and documented is defined] is stored are identified and documented.'),\n('003985','draft','2022-03-02','DISA','policy','Identify and document the users who have access to the system where the information is processed and stored.','CM-12b.','N/A','Determine if: - the users who have access to the system and system components where [CM-12_ODP; information for which the location is to be identified and documented is defined] is processed are identified and documented. - the users who have access to the system and system components where [CM-12_ODP; information for which the location is to be identified and documented is defined] is stored are identified and documented.'),\n('003986','draft','2022-03-02','DISA','policy','Identify and document the users who have access to the system components where the information is processed and stored.','CM-12b.','N/A','Determine if: - the users who have access to the system and system components where [CM-12_ODP; information for which the location is to be identified and documented is defined] is processed are identified and documented. - the users who have access to the system and system components where [CM-12_ODP; information for which the location is to be identified and documented is defined] is stored are identified and documented.'),\n('003987','draft','2022-03-02','DISA','policy','Document changes to the location (i.e., system or system components) where the information is processed and stored.','CM-12c.','N/A','Determine if: - changes to the location (i.e., system or system components) where [CM-12_ODP; information for which the location is to be identified and documented is defined] is processed are documented. - changes to the location (i.e., system or system components) where [CM-12_ODP; information for which the location is to be identified and documented is defined] is stored are documented.'),\n('003988','draft','2022-03-02','DISA','policy','Use automated tools to identify organization-defined information by information type on organization-defined components to ensure adequate controls are in place to protect organizational information.','CM-12(01)','N/A','Determine if automated tools are used to identify [CM-12(01)_ODP[01]; information to be protected is defined by information type] on [CM-12(01)_ODP[02]; system components where the information is located are defined] to ensure that controls are in place to protect organizational information and individual privacy.'),\n('003989','draft','2022-03-02','DISA','policy','Defines the information by information type for identifying automated tools.','CM-12(01)','N/A','Determine if automated tools are used to identify [CM-12(01)_ODP[01]; information to be protected is defined by information type] on [CM-12(01)_ODP[02]; system components where the information is located are defined] to ensure that controls are in place to protect organizational information and individual privacy.'),\n('003990','draft','2022-03-02','DISA','policy','Defines the system components used to ensure controls are in place to protect organizational information and individual privacy.','CM-12(01)','N/A','Determine if automated tools are used to identify [CM-12(01)_ODP[01]; information to be protected is defined by information type] on [CM-12(01)_ODP[02]; system components where the information is located are defined] to ensure that controls are in place to protect organizational information and individual privacy.'),\n('003991','draft','2022-03-02','DISA','policy','Develop and document a map of system data actions.','CM-13','N/A','Determine if a map of system data actions is developed and documented.'),\n('003992','draft','2022-03-02','DISA','policy','Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.','CM-14','N/A','Determine if: - the installation of [CM-14_ODP[01]; software components requiring verification of a digitally signed certificate before installation are defined] is prevented unless it is verified that the software has been digitally signed using a certificate recognized and approved by the organization. - the installation of [CM-14_ODP[02]; firmware components requiring verification of a digitally signed certificate before installation are defined] is prevented unless it is verified that the firmware has been digitally signed using a certificate recognized and approved by the organization.'),\n('003993','draft','2022-03-02','DISA','policy','Defines the software and firmware for preventing installation without verification that the component has been digitally signed.','CM-14','N/A','Determine if: - the installation of [CM-14_ODP[01]; software components requiring verification of a digitally signed certificate before installation are defined] is prevented unless it is verified that the software has been digitally signed using a certificate recognized and approved by the organization. - the installation of [CM-14_ODP[02]; firmware components requiring verification of a digitally signed certificate before installation are defined] is prevented unless it is verified that the firmware has been digitally signed using a certificate recognized and approved by the organization.'),\n('003994','draft','2022-03-02','DISA','policy','Develop and document an organizational-level; mission/business process-level; and/or system-level contingency planning policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','CP-01a.01(b)','N/A','Determine if the [CP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] contingency planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('003995','draft','2022-03-02','DISA','policy','Disseminate an organizational-level; mission/business process-level; and/or system-level contingency planning policy to organization-defined personnel or roles that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','CP-01a.01(b)','N/A','Determine if the [CP-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] contingency planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('003996','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage development and documentation of the contingency planning policy.','CP-01b.','N/A','Determine if the [CP-01_ODP[04]; an official to manage the contingency planning policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the contingency planning policy and procedures.'),\n('003997','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage dissemination of the contingency planning policy.','CP-01b.','N/A','Determine if the [CP-01_ODP[04]; an official to manage the contingency planning policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the contingency planning policy and procedures.'),\n('003998','draft','2022-03-02','DISA','policy','Defines the official designated to manage the development, documentation, and dissemination of the contingency policy.','CP-01b.','N/A','Determine if the [CP-01_ODP[04]; an official to manage the contingency planning policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the contingency planning policy and procedures.'),\n('003999','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage the development and documentation of the contingency planning procedures.','CP-01b.','N/A','Determine if the [CP-01_ODP[04]; an official to manage the contingency planning policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the contingency planning policy and procedures.'),\n('004000','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage the dissemination of the contingency procedures.',NULL,'N/A',NULL),\n('004001','draft','2022-03-02','DISA','policy','Defines the official designated to manage the development, documentation, and dissemination of the contingency procedures.','CP-01b.','N/A','Determine if the [CP-01_ODP[04]; an official to manage the contingency planning policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the contingency planning policy and procedures.'),\n('004002','draft','2022-03-02','DISA','policy','Review and update the current contingency planning policy following organization-defined events.','CP-01c.01','N/A','Determine if: - the current contingency planning policy is reviewed and updated [CP-01_ODP[05]; the frequency at which the current contingency planning policy is reviewed and updated is defined]. - the current contingency planning policy is reviewed and updated following [CP-01_ODP[06]; events that would require the current contingency planning policy to be reviewed and updated are defined].'),\n('004003','draft','2022-03-02','DISA','policy','Defines the events with which to review and update the current contingency planning policy.','CP-01c.01','N/A','Determine if: - the current contingency planning policy is reviewed and updated [CP-01_ODP[05]; the frequency at which the current contingency planning policy is reviewed and updated is defined]. - the current contingency planning policy is reviewed and updated following [CP-01_ODP[06]; events that would require the current contingency planning policy to be reviewed and updated are defined].'),\n('004004','draft','2022-03-02','DISA','policy','Review and update the current contingency planning procedures following organization-defined events.','CP-01c.02','N/A','Determine if: - the current contingency planning procedures are reviewed and updated [CP-01_ODP[07]; the frequency at which the current contingency planning procedures are reviewed and updated is defined]. - the current contingency planning procedures are reviewed and updated following [CP-01_ODP[08]; events that would require procedures to be reviewed and updated are defined].'),\n('004005','draft','2022-03-02','DISA','policy','Defines the events with which to review and update the current contingency planning procedures.','CP-01c.02','N/A','Determine if: - the current contingency planning procedures are reviewed and updated [CP-01_ODP[07]; the frequency at which the current contingency planning procedures are reviewed and updated is defined]. - the current contingency planning procedures are reviewed and updated following [CP-01_ODP[08]; events that would require procedures to be reviewed and updated are defined].'),\n('004006','draft','2022-03-02','DISA','policy','Develop a contingency plan for the system that addresses maintaining essential mission functions despite a system disruption, compromise, or failure.','CP-02a.04','N/A','Determine if a contingency plan for the system is developed that addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure.'),\n('004007','draft','2022-03-02','DISA','policy','Develop a contingency plan for the system that addresses maintaining essential business functions despite a system disruption, compromise, or failure.','CP-02a.04','N/A','Determine if a contingency plan for the system is developed that addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure.'),\n('004008','draft','2022-03-02','DISA','policy','Develop a contingency plan for the system that addresses the sharing of contingency information.','CP-02a.06','N/A','Determine if a contingency plan for the system is developed that addresses the sharing of contingency information.'),\n('004009','draft','2022-03-02','DISA','policy','Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training.','CP-02g.','N/A','Determine if: - lessons learned from contingency plan testing or actual contingency activities are incorporated into contingency testing. - lessons learned from contingency plan training or actual contingency activities are incorporated into contingency testing and training.'),\n('004010','draft','2022-03-02','DISA','policy','Review and update contingency training content on an organization-defined frequency.','CP-03b.','N/A','Determine if: - the contingency plan training content is reviewed and updated [CP-03_ODP[03]; frequency at which to review and update contingency training content is defined]. - the contingency plan training content is reviewed and updated following [CP-03_ODP[04]; events necessitating review and update of contingency training are defined].'),\n('004011','draft','2022-03-02','DISA','policy','Defines the frequency the contingency training content will be reviewed and updated.','CP-03b.','N/A','Determine if: - the contingency plan training content is reviewed and updated [CP-03_ODP[03]; frequency at which to review and update contingency training content is defined]. - the contingency plan training content is reviewed and updated following [CP-03_ODP[04]; events necessitating review and update of contingency training are defined].'),\n('004012','draft','2022-03-02','DISA','policy','Review and update contingency training content following organization-defined events.','CP-03b.','N/A','Determine if: - the contingency plan training content is reviewed and updated [CP-03_ODP[03]; frequency at which to review and update contingency training content is defined]. - the contingency plan training content is reviewed and updated following [CP-03_ODP[04]; events necessitating review and update of contingency training are defined].'),\n('004013','draft','2022-03-02','DISA','policy','Defines the events for which the contingency training content will be reviewed and updated.','CP-03b.','N/A','Determine if: - the contingency plan training content is reviewed and updated [CP-03_ODP[03]; frequency at which to review and update contingency training content is defined]. - the contingency plan training content is reviewed and updated following [CP-03_ODP[04]; events necessitating review and update of contingency training are defined].'),\n('004014','draft','2022-03-02','DISA','policy','Defines the automated mechanisms to test the contingency plan.','CP-04(03)','N/A','Determine if the contingency plan is tested using [CP-04(03)_ODP; automated mechanisms for contingency plan testing are defined].'),\n('004015','draft','2022-03-02','DISA','policy','Employ organization-defined mechanisms to organization-defined system or system component to disrupt and adversely affect the system or system component.','CP-04(05)','N/A','Determine if [CP-04(05)_ODP[01]; mechanisms employed to disrupt and adversely affect the system or system component are defined] are employed to disrupt and adversely affect the [CP-04(05)_ODP[02]; system or system component on which to apply disruption mechanisms are defined].'),\n('004016','draft','2022-03-02','DISA','policy','Defines the mechanisms employed to disrupt and adversely affect the system or system component.','CP-04(05)','N/A','Determine if [CP-04(05)_ODP[01]; mechanisms employed to disrupt and adversely affect the system or system component are defined] are employed to disrupt and adversely affect the [CP-04(05)_ODP[02]; system or system component on which to apply disruption mechanisms are defined].'),\n('004017','draft','2022-03-02','DISA','policy','Defines the system or system component used to employ organization-defined mechanisms.','CP-04(05)','N/A','Determine if [CP-04(05)_ODP[01]; mechanisms employed to disrupt and adversely affect the system or system component are defined] are employed to disrupt and adversely affect the [CP-04(05)_ODP[02]; system or system component on which to apply disruption mechanisms are defined].'),\n('004018','draft','2022-03-02','DISA','policy','Establish an alternate storage site, including necessary agreements to permit the retrieval of system backup information.','CP-06a.','N/A','Determine if: - an alternate storage site is established. - establishment of the alternate storage site includes necessary agreements to permit the storage and retrieval of system backup information.'),\n('004019','draft','2022-03-02','DISA','policy','Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary and/or alternate telecommunications services are provided by a common carrier.','CP-08(01)(b)','N/A','Determine if Telecommunications Service Priority is requested for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier.'),\n('004020','draft','2022-03-02','DISA','policy','Defines the system components to conduct backups of user level information.','CP-09a.','N/A','Determine if backups of user-level information contained in [CP-09_ODP[01]; system components for which to conduct backups of user-level information is defined] are conducted [CP-09_ODP[02]; frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives is defined].'),\n('004021','draft','2022-03-02','DISA','policy','Conduct backups of system documentation, including privacy-related documentation, per an organization-defined frequency that is consistent with recovery time and recovery point objectives.','CP-09c.','N/A','Determine if backups of system documentation, including security- and privacy-related documentation are conducted [CP-09_ODP[04]; frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives is defined].'),\n('004022','draft','2022-03-02','DISA','policy','Protect the confidentiality of backup information.','CP-09d.','N/A','Determine if: - the confidentiality of backup information is protected. - the integrity of backup information is protected. - the availability of backup information is protected.'),\n('004023','draft','2022-03-02','DISA','policy','Protect integrity of backup information.','CP-09d.','N/A','Determine if: - the confidentiality of backup information is protected. - the integrity of backup information is protected. - the availability of backup information is protected.'),\n('004024','draft','2022-03-02','DISA','policy','Protect the availability of backup information.','CP-09d.','N/A','Determine if: - the confidentiality of backup information is protected. - the integrity of backup information is protected. - the availability of backup information is protected.'),\n('004025','draft','2022-03-02','DISA','policy','Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined backup information.','CP-09(08)','N/A','Determine if cryptographic mechanisms are implemented to prevent unauthorized disclosure and modification of [CP-09(08)_ODP; backup information to protect against unauthorized disclosure and modification is defined].'),\n('004026','draft','2022-03-02','DISA','policy','Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined backup information.','CP-09(08)','N/A','Determine if cryptographic mechanisms are implemented to prevent unauthorized disclosure and modification of [CP-09(08)_ODP; backup information to protect against unauthorized disclosure and modification is defined].'),\n('004027','draft','2022-03-02','DISA','policy','Defines the backup information which is protected by cryptographic mechanisms preventing unauthorized disclosure and modification.','CP-09(08)','N/A','Determine if cryptographic mechanisms are implemented to prevent unauthorized disclosure and modification of [CP-09(08)_ODP; backup information to protect against unauthorized disclosure and modification is defined].'),\n('004028','draft','2022-03-02','DISA','policy','Provide for the recovery and reconstitution of the system to a known state within an organization-defined time-period consistent with recovery time and recovery point objectives after a disruption, compromise, or failure.','CP-10','N/A','Determine if: - the recovery of the system to a known state is provided within [CP-10_ODP[01]; time period consistent with recovery time and recovery point objectives for the recovery of the system is determined] after a disruption, compromise, or failure. - a reconstitution of the system to a known state is provided within [CP-10_ODP[02]; time period consistent with recovery time and recovery point objectives for the reconstitution of the system is determined] after a disruption, compromise, or failure.'),\n('004029','draft','2022-03-02','DISA','policy','Defines the time-period consistent with recovery time and recovery point objectives for the recovery and reconstitution of the system.','CP-10','N/A','Determine if: - the recovery of the system to a known state is provided within [CP-10_ODP[01]; time period consistent with recovery time and recovery point objectives for the recovery of the system is determined] after a disruption, compromise, or failure. - a reconstitution of the system to a known state is provided within [CP-10_ODP[02]; time period consistent with recovery time and recovery point objectives for the reconstitution of the system is determined] after a disruption, compromise, or failure.'),\n('004030','draft','2022-03-02','DISA','policy','Protect system components used for recovery and reconstitution.','CP-10(06)','N/A','Determine if system components used for recovery and reconstitution are protected.'),\n('004031','draft','2022-03-02','DISA','policy','Defines the personnel or roles the organization-level; mission/business process-level; and/or system-level identification and authorization policy is disseminated to.','IA-01a.','N/A','Determine if: - an identification and authentication policy is developed and documented. - the identification and authentication policy is disseminated to [IA-01_ODP[01]; personnel or roles to whom the identification and authentication policy is to be disseminated are defined].'),\n('004032','draft','2022-03-02','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system-level identification and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination, among organizational entities, and compliance.','IA-01a.01(a)','N/A','Determine if: - the [IA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] identification and authentication policy addresses purpose. - the [IA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] identification and authentication policy addresses scope. - the [IA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] identification and authentication policy addresses roles. - the [IA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] identification and authentication policy addresses responsibilities. - the [IA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] identification and authentication policy addresses management commitment. - the [IA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] identification and authentication policy addresses coordination among organizational entities. - the [IA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] identification and authentication policy addresses compliance.'),\n('004033','draft','2022-03-02','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system-level identification and authorization policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','IA-01a.01(b)','N/A','Determine if the [IA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] identification and authentication policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.'),\n('004034','draft','2022-03-02','DISA','policy','Develop and document the procedures to facilitate the implementation of the identification and authorization policy and the associated identification and authentication controls.','IA-01a.02','N/A','Determine if: - identification and authentication procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls are developed and documented. - Determine if the identification and authentication procedures are disseminated to [IA-01_ODP[02]; personnel or roles to whom the identification and authentication procedures are to be disseminated is/are defined].'),\n('004035','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage development and documentation of the identification and authentication policy.','IA-01b.','N/A','Determine if the [IA-01_ODP[04]; an official to manage the identification and authentication policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the identification and authentication policy and procedures.'),\n('004036','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage dissemination of the identification and authentication policy.','IA-01b.','N/A','Determine if the [IA-01_ODP[04]; an official to manage the identification and authentication policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the identification and authentication policy and procedures.'),\n('004037','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage development and documentation of the identification and authentication procedures.','IA-01b.','N/A','Determine if the [IA-01_ODP[04]; an official to manage the identification and authentication policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the identification and authentication policy and procedures.'),\n('004038','draft','2022-03-02','DISA','policy','Designate an organization-defined official to manage dissemination of the identification and authentication procedures.','IA-01b.','N/A','Determine if the [IA-01_ODP[04]; an official to manage the identification and authentication policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the identification and authentication policy and procedures.'),\n('004039','draft','2022-03-02','DISA','policy','Defines the official designated to managing the development, documentation, and dissemination of the identification and authentication policy.','IA-01b.','N/A','Determine if the [IA-01_ODP[04]; an official to manage the identification and authentication policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the identification and authentication policy and procedures.'),\n('004040','draft','2022-03-02','DISA','policy','Defines the official designated to managing the development, documentation, and dissemination of the identification and authentication procedures.','IA-01b.','N/A','Determine if the [IA-01_ODP[04]; an official to manage the identification and authentication policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the identification and authentication policy and procedures.'),\n('004041','draft','2022-03-02','DISA','policy','Review and update the current identification and authentication policy following organization-defined events.','IA-01c.01','N/A','Determine if: - the current identification and authentication policy is reviewed and updated [IA-01_ODP[05]; the frequency at which the current identification and authentication policy is reviewed and updated is defined]. - the current identification and authentication policy is reviewed and updated following [IA-01_ODP[06]; events that would require the current identification and authentication policy to be reviewed and updated are defined].'),\n('004042','draft','2022-03-02','DISA','policy','Defines the events following reviewing and updating the current identification and authentication policy.','IA-01c.01','N/A','Determine if: - the current identification and authentication policy is reviewed and updated [IA-01_ODP[05]; the frequency at which the current identification and authentication policy is reviewed and updated is defined]. - the current identification and authentication policy is reviewed and updated following [IA-01_ODP[06]; events that would require the current identification and authentication policy to be reviewed and updated are defined].'),\n('004043','draft','2022-03-02','DISA','policy','Review and update the current identification and authentication procedures following organization-defined events.','IA-01c.02','N/A','Determine if: - the current identification and authentication procedures are reviewed and updated [IA-01_ODP[07]; the frequency at which the current identification and authentication procedures are reviewed and updated is defined]. - the current identification and authentication procedures are reviewed and updated following [IA-01_ODP[08]; events that would require identification and authentication procedures to be reviewed and updated are defined].'),\n('004044','draft','2022-03-02','DISA','policy','Defines the events following reviewing and updating the current identification and authentication procedures.','IA-01c.02','N/A','Determine if: - the current identification and authentication procedures are reviewed and updated [IA-01_ODP[07]; the frequency at which the current identification and authentication procedures are reviewed and updated is defined]. - the current identification and authentication procedures are reviewed and updated following [IA-01_ODP[08]; events that would require identification and authentication procedures to be reviewed and updated are defined].'),\n('004045','draft','2022-03-02','DISA','policy','Require users to be individually authenticated before granting access to the shared accounts or resources.','IA-02(05)','N/A','Determine if users are required to be individually authenticated before granting access to the shared accounts or resources when shared accounts or authenticators are employed.'),\n('004046','draft','2022-03-02','DISA','technical','Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.','IA-02(06)(a)','N/A','Determine if multi-factor authentication is implemented for [IA-02(06)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {local; network; remote}] access to [IA-02(06)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {privileged accounts; non-privileged accounts}] such that one of the factors is provided by a device separate from the system gaining access.'),\n('004047','draft','2022-03-02','DISA','technical','Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that the device meets organization-defined strength of mechanism requirements.','IA-02(06)(b)','N/A','Determine if multi-factor authentication is implemented for [IA-02(06)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {local; network; remote}] access to [IA-02(06)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {privileged accounts; non-privileged accounts}] such that the device meets [IA-02(06)_ODP[03]; the strength of mechanism requirements to be enforced by a device separate from the system gaining access to accounts is defined].'),\n('004048','draft','2022-03-02','DISA','technical','Defines the strength of mechanism requirements for implementing multi-factor authentication.','IA-02(06)(b)','N/A','Determine if multi-factor authentication is implemented for [IA-02(06)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {local; network; remote}] access to [IA-02(06)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {privileged accounts; non-privileged accounts}] such that the device meets [IA-02(06)_ODP[03]; the strength of mechanism requirements to be enforced by a device separate from the system gaining access to accounts is defined].'),\n('004049','draft','2022-03-02','DISA','technical','Defines the dynamic identifier policy for managing individual identifiers dynamically.','IA-04(05)','N/A','Determine if individual identifiers are dynamically managed in accordance with [IA-04(05)_ODP; a dynamic identifier policy for managing individual identifiers is defined].'),\n('004050','draft','2022-03-02','DISA','policy','Generate pairwise pseudonymous identifiers.','IA-04(08)','N/A','Determine if pairwise pseudonymous identifiers are generated.'),\n('004051','draft','2022-03-02','DISA','policy','Maintain the attributes for each uniquely identified individual, device, or service in organization-defined protected central storage.','IA-04(09)','N/A','Determine if the attributes for each uniquely identified individual, device, or service are maintained in [IA-04(09)_ODP; protected central storage used to maintain the attributes for each uniquely identified individual, device, or service is defined].'),\n('004052','draft','2022-03-02','DISA','policy','Defines the protected central storage for maintaining the attributes for each uniquely individual, device or service.','IA-04(09)','N/A','Determine if the attributes for each uniquely identified individual, device, or service are maintained in [IA-04(09)_ODP; protected central storage used to maintain the attributes for each uniquely identified individual, device, or service is defined].'),\n('004053','draft','2022-03-02','DISA','policy','Manage system authenticators by establishing administrative procedures for lost/compromised or damaged authenticators.','IA-05d.','N/A','Determine if system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators.'),\n('004054','draft','2022-03-02','DISA','policy','Manage system authenticators by implementing administrative procedures for lost/compromised or damaged authenticators.','IA-05d.','N/A','Determine if system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators.'),\n('004055','draft','2022-03-02','DISA','policy','Manage system authenticators by changing default authenticators prior to first use.','IA-05e.','N/A','Determine if system authenticators are managed through the change of default authenticators prior to first use.'),\n('004056','draft','2022-03-02','DISA','policy','Defines the events for when to change or refresh authenticators.','IA-05f.','N/A','Determine if system authenticators are managed through the change or refreshment of authenticators [IA-05_ODP[01]; a time period for changing or refreshing authenticators by authenticator type is defined] or when [IA-05_ODP[02]; events that trigger the change or refreshment of authenticators are defined] occur.'),\n('004057','draft','2022-03-02','DISA','policy','Defines the frequency for updating commonly used, expected, or compromised passwords, when they are suspected of being compromised directly or indirectly.','IA-05(01)(a)','N/A','Determine if for password-based authentication, a list of commonly used, expected, or compromised passwords is maintained and updated [IA-05(01)_ODP[01]; the frequency at which to update the list of commonly used, expected, or compromised passwords is defined] and when organizational passwords are suspected to have been compromised directly or indirectly.'),\n('004058','draft','2022-03-02','DISA','technical','For password-based authentication, maintain a list of commonly used, expected, or compromised passwords on an organization-defined frequency.','IA-05(01)(a)','N/A','Determine if for password-based authentication, a list of commonly used, expected, or compromised passwords is maintained and updated [IA-05(01)_ODP[01]; the frequency at which to update the list of commonly used, expected, or compromised passwords is defined] and when organizational passwords are suspected to have been compromised directly or indirectly.'),\n('004059','draft','2022-03-02','DISA','technical','For password-based authentication, update the list of passwords on an organization-defined frequency.','IA-05(01)(a)','N/A','Determine if for password-based authentication, a list of commonly used, expected, or compromised passwords is maintained and updated [IA-05(01)_ODP[01]; the frequency at which to update the list of commonly used, expected, or compromised passwords is defined] and when organizational passwords are suspected to have been compromised directly or indirectly.'),\n('004060','draft','2022-03-02','DISA','technical','For password-based authentication, update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly.','IA-05(01)(a)','N/A','Determine if for password-based authentication, a list of commonly used, expected, or compromised passwords is maintained and updated [IA-05(01)_ODP[01]; the frequency at which to update the list of commonly used, expected, or compromised passwords is defined] and when organizational passwords are suspected to have been compromised directly or indirectly.'),\n('004061','draft','2022-03-02','DISA','technical','For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).','IA-05(01)(b)','N/A','Determine if for password-based authentication when passwords are created or updated by users, the passwords are verified not to be found on the list of commonly used, expected, or compromised passwords in IA-05(01)(a).'),\n('004062','draft','2022-03-02','DISA','technical','For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.','IA-05(01)(d)','N/A','Determine if for password-based authentication, passwords are stored using an approved salted key derivation function, preferably using a keyed hash.'),\n('004063','draft','2022-03-02','DISA','technical','For password-based authentication, require immediate selection of a new password upon account recovery.','IA-05(01)(e)','N/A','Determine if for password-based authentication, immediate selection of a new password is required upon account recovery.'),\n('004064','draft','2022-03-02','DISA','technical','For password-based authentication, allow user selection of long passwords and passphrases, including spaces and all printable characters.','IA-05(01)(f)','N/A','Determine if for password-based authentication, user selection of long passwords and passphrases is allowed, including spaces and all printable characters.'),\n('004065','draft','2022-03-02','DISA','technical','For password-based authentication, employ automated tools to assist the user in selecting strong password authenticators.','IA-05(01)(g)','N/A','Determine if for password-based authentication, automated tools are employed to assist the user in selecting strong password authenticators.'),\n('004066','draft','2022-03-02','DISA','technical','For password-based authentication, enforce organization-defined composition and complexity rules.','IA-05(01)(h)','N/A','Determine if for password-based authentication, [IA-05(01)_ODP[02]; authenticator composition and complexity rules are defined] are enforced.'),\n('004067','draft','2022-03-02','DISA','policy','Defines the composition and complexity rules to be enforced.','IA-05(01)(h)','N/A','Determine if for password-based authentication, [IA-05(01)_ODP[02]; authenticator composition and complexity rules are defined] are enforced.'),\n('004068','draft','2022-03-02','DISA','technical','For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.','IA-05(02)(b)(02)','N/A','Determine if when public key infrastructure (PKI) is used, a local cache of revocation data is implemented to support path discovery and validation.'),\n('004069','draft','2022-03-02','DISA','policy','Ensure that the unencrypted static authenticators are not embedded in applications or other forms of static storage.','IA-05(07)','N/A','Determine if unencrypted static authenticators are not embedded in applications or other forms of static storage.'),\n('004070','draft','2022-03-02','DISA','policy','Use organization-defined external organizations to federate credentials.','IA-05(09)','N/A','Determine if [IA-05(09)_ODP; external organizations to be used for federating credentials are defined] are used to federate credentials.'),\n('004071','draft','2022-03-02','DISA','policy','Defines the external organizations used to federate credentials.','IA-05(09)','N/A','Determine if [IA-05(09)_ODP; external organizations to be used for federating credentials are defined] are used to federate credentials.'),\n('004072','draft','2022-03-02','DISA','technical','Defines the binding rules for binding identities and authenticators.','IA-05(10)','N/A','Determine if identities and authenticators are dynamically bound using [IA-05(10)_ODP; rules for dynamically binding identities and authenticators are defined].'),\n('004073','draft','2022-03-02','DISA','policy','Use only General Services Administration-approved and validated products and services for identity, credential, and access management.','IA-05(15)','N/A','Determine if only General Services Administration-approved products and services are used for identity, credential, and access management.'),\n('004074','draft','2022-03-02','DISA','policy','Require that the issuance of organization-defined types of and/or specific authenticators be conducted in person or by a trusted external party before the organization-defined registration authority with authorization by organization-defined personnel or roles.','IA-05(16)','N/A','Determine if the issuance of [IA-05(16)_ODP[01]; types of and/or specific authenticators to be issued are defined] is required to be conducted [IA-05(16)_ODP[02]; one of the following PARAMETER VALUES is selected: {in person; by a trusted external party}] before [IA-05(16)_ODP[03]; the registration authority that issues authenticators is defined] with authorization by [IA-05(16)_ODP[04]; the personnel or roles who authorize the issuance of authenticators are defined].'),\n('004075','draft','2022-03-02','DISA','policy','Defines types of and/or specific authenticators to be conducted in person or by a trusted external party before the organization-defined registration authority.','IA-05(16)','N/A','Determine if the issuance of [IA-05(16)_ODP[01]; types of and/or specific authenticators to be issued are defined] is required to be conducted [IA-05(16)_ODP[02]; one of the following PARAMETER VALUES is selected: {in person; by a trusted external party}] before [IA-05(16)_ODP[03]; the registration authority that issues authenticators is defined] with authorization by [IA-05(16)_ODP[04]; the personnel or roles who authorize the issuance of authenticators are defined].'),\n('004076','draft','2022-03-02','DISA','policy','Defines the registration authority who conducts the issuance of organization-defined types of and/or specific authenticators.','IA-05(16)','N/A','Determine if the issuance of [IA-05(16)_ODP[01]; types of and/or specific authenticators to be issued are defined] is required to be conducted [IA-05(16)_ODP[02]; one of the following PARAMETER VALUES is selected: {in person; by a trusted external party}] before [IA-05(16)_ODP[03]; the registration authority that issues authenticators is defined] with authorization by [IA-05(16)_ODP[04]; the personnel or roles who authorize the issuance of authenticators are defined].'),\n('004077','draft','2022-03-02','DISA','policy','Defines the personnel or roles who authorize the issuance of organization-defined types of and/or specific authenticators.','IA-05(16)','N/A','Determine if the issuance of [IA-05(16)_ODP[01]; types of and/or specific authenticators to be issued are defined] is required to be conducted [IA-05(16)_ODP[02]; one of the following PARAMETER VALUES is selected: {in person; by a trusted external party}] before [IA-05(16)_ODP[03]; the registration authority that issues authenticators is defined] with authorization by [IA-05(16)_ODP[04]; the personnel or roles who authorize the issuance of authenticators are defined].'),\n('004078','draft','2022-03-02','DISA','technical','Employ presentation attack detection mechanisms for biometric-based authentication.','IA-05(17)','N/A','Determine if presentation attack detection mechanisms are employed for biometric-based authentication.'),\n('004079','draft','2022-03-02','DISA','technical','Employ organization-defined password managers to generate and manage passwords.','IA-05(18)(a)','N/A','Determine if [IA-05(18)_ODP[01]; password managers employed for generating and managing passwords are defined] are employed to generate and manage passwords.'),\n('004080','draft','2022-03-02','DISA','technical','Defines the password managers employed to generate and manage passwords.',NULL,'N/A',NULL),\n('004081','draft','2022-03-02','DISA','technical','Protect the passwords using organization-defined controls.','IA-05(18)(b)','N/A','Determine if the passwords are protected using [IA-05(18)_ODP[02]; controls for protecting passwords are defined].'),\n('004082','draft','2022-03-02','DISA','technical','Defines the controls for protecting the passwords.','IA-05(18)(b)','N/A','Determine if the passwords are protected using [IA-05(18)_ODP[02]; controls for protecting passwords are defined].'),\n('004083','draft','2022-03-02','DISA','technical','Accept only external credentials that are NIST compliant.','IA-08(02)(a)','N/A','Determine if only external authenticators that are NIST-compliant are accepted.'),\n('004084','draft','2022-03-02','DISA','technical','Document and maintain a list of accepted external authenticators.','IA-08(02)(b)','N/A','Determine if: - a list of accepted external authenticators is documented. - a list of accepted external authenticators is maintained.'),\n('004085','draft','2022-03-02','DISA','technical','Conform to organization-defined identity management profiles for identity management.','IA-08(04)','N/A','Determine if there is conformance with [IA-08(04)_ODP; identity management profiles are defined] for identity management.'),\n('004086','draft','2022-03-02','DISA','technical','Defines the identity management profiles for conforming to the profiles for identity management.','IA-08(04)','N/A','Determine if there is conformance with [IA-08(04)_ODP; identity management profiles are defined] for identity management.'),\n('004087','draft','2022-03-02','DISA','technical','Defines the policy for accepting and verifying federated or PKI credentials.','IA-08(05)','N/A','Determine if: - federated or PKI credentials that meet [IA-08(05)_ODP; a policy for using federated or PKI credentials is defined] are accepted. - federated or PKI credentials that meet [IA-08(05)_ODP; a policy for using federated or PKI credentials is defined] are verified.'),\n('004088','draft','2022-03-02','DISA','policy','Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among individuals.','IA-08(06)','N/A','Determine if [IA-08(06)_ODP; disassociability measures are defined] to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties are implemented.'),\n('004089','draft','2022-03-02','DISA','policy','Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among credential service providers.','IA-08(06)','N/A','Determine if [IA-08(06)_ODP; disassociability measures are defined] to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties are implemented.'),\n('004090','draft','2022-03-02','DISA','policy','Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among relying parties.','IA-05(18)(a)','N/A','Determine if [IA-05(18)_ODP[01]; password managers employed for generating and managing passwords are defined] are employed to generate and manage passwords.'),\n('004091','draft','2022-03-02','DISA','policy','Defines the measures to be implemented to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties.',NULL,'N/A',NULL),\n('004092','draft','2022-03-02','DISA','policy','Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards.','IA-12a.','N/A','Determine if users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity proofed.'),\n('004093','draft','2022-03-02','DISA','policy','Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable guidelines.','IA-12a.','N/A','Determine if users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity proofed.'),\n('004094','draft','2022-03-02','DISA','policy','Resolve user identities to a unique individual.','IA-12b.','N/A','Determine if user identities are resolved to a unique individual.'),\n('004095','draft','2022-03-02','DISA','policy','Collect identity evidence.','IA-12c.','N/A','Determine if: - identity evidence is collected. - identity evidence is validated. - identity evidence is verified.'),\n('004096','draft','2022-03-02','DISA','policy','Validate identity evidence.',NULL,'N/A',NULL),\n('004097','draft','2022-03-02','DISA','policy','Verify identity evidence.','IA-12c.','N/A','Determine if: - identity evidence is collected. - identity evidence is validated. - identity evidence is verified.'),\n('004098','draft','2022-03-02','DISA','policy','Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization.','IA-12c.','N/A','Determine if: - identity evidence is collected. - identity evidence is validated. - identity evidence is verified.'),\n('004099','draft','2022-03-02','DISA','policy','Require evidence of individual identification be presented to the registration authority.','IA-12(02)','N/A','Determine if evidence of individual identification is presented to the registration authority.'),\n('004100','draft','2022-03-02','DISA','policy','Require that the presented identity evidence be validated through organizational defined methods of validation.','IA-12(03)','N/A','Determine if the presented identity evidence is validated and verified through [IA-12(03)_ODP; methods of validation and verification of identity evidence are defined].'),\n('004101','draft','2022-03-02','DISA','policy','Require that the presented identity evidence be verified through organizational defined methods of verification.','IA-12(03)','N/A','Determine if the presented identity evidence is validated and verified through [IA-12(03)_ODP; methods of validation and verification of identity evidence are defined].'),\n('004102','draft','2022-03-02','DISA','policy','Defines the methods of validation required for presenting identity evidence.','IA-12(03)','N/A','Determine if the presented identity evidence is validated and verified through [IA-12(03)_ODP; methods of validation and verification of identity evidence are defined].'),\n('004103','draft','2022-03-02','DISA','policy','Defines the methods of verification required for presenting identity evidence.','IA-12(03)','N/A','Determine if the presented identity evidence is validated and verified through [IA-12(03)_ODP; methods of validation and verification of identity evidence are defined].'),\n('004104','draft','2022-03-02','DISA','policy','Require that the validation of identity evidence be conducted in person before a designated registration authority.','IA-12(04)','N/A','Determine if the validation and verification of identity evidence is conducted in person before a designated registration authority.'),\n('004105','draft','2022-03-02','DISA','policy','Require that the verification of identity evidence be conducted in person before a designated registration authority.','IA-12(04)','N/A','Determine if the validation and verification of identity evidence is conducted in person before a designated registration authority.'),\n('004106','draft','2022-03-02','DISA','policy','Require that a registration code or notice of proofing be delivered through an out-of-band channel to verify the users address (physical or digital) of record.','IA-12(05)','N/A','Determine if a [IA-12(05)_ODP; one of the following PARAMETER VALUES is selected: {registration code; notice of proofing}] is delivered through an out-of-band channel to verify the user''s address (physical or digital) of record.'),\n('004107','draft','2022-03-03','DISA','policy','Accept externally-proofed identities at an organization-defined identity assurance level.','IA-12(06)','N/A','Determine if externally proofed identities are accepted [IA-12(06)_ODP; an identity assurance level for accepting externally proofed identities is defined].'),\n('004108','draft','2022-03-03','DISA','policy','Defines the identity assurance level by accepting externally-proofed identities.','IA-12(06)','N/A','Determine if externally proofed identities are accepted [IA-12(06)_ODP; an identity assurance level for accepting externally proofed identities is defined].'),\n('004109','draft','2022-03-03','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system-level incident response policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.','IR-01a.01(b)','N/A','Determine if the [IR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] incident response policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('004110','draft','2022-03-03','DISA','policy','Designate an organization-defined official to manage the incident response policy.','IR-01b.','N/A','Determine if the [IR-01_ODP[04]; an official to manage the incident response policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the incident response policy and procedures.'),\n('004111','draft','2022-03-03','DISA','policy','Designate an organization-defined official to manage the incident response procedures.','IR-01b.','N/A','Determine if the [IR-01_ODP[04]; an official to manage the incident response policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the incident response policy and procedures.'),\n('004112','draft','2022-03-03','DISA','policy','Defines the official designated to manage the incident response policy and procedures.','IR-01b.','N/A','Determine if the [IR-01_ODP[04]; an official to manage the incident response policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the incident response policy and procedures.'),\n('004113','draft','2022-03-03','DISA','policy','Review and update the current incident response policy following organization-defined events.','IR-01c.01','N/A','Determine if:  - the current incident response policy is reviewed and updated [IR-01_ODP[05]; the frequency at which the current incident response policy is reviewed and updated is defined]. - the current incident response policy is reviewed and updated following [IR-01_ODP[06]; events that would require the current incident response policy to be reviewed and updated are defined].'),\n('004114','draft','2022-03-03','DISA','policy','Defines the events for reviewing and updating the current incident response policy.','IR-01c.01','N/A','Determine if:  - the current incident response policy is reviewed and updated [IR-01_ODP[05]; the frequency at which the current incident response policy is reviewed and updated is defined]. - the current incident response policy is reviewed and updated following [IR-01_ODP[06]; events that would require the current incident response policy to be reviewed and updated are defined].'),\n('004115','draft','2022-03-03','DISA','policy','Review and update the current incident response procedures following organization-defined events.','IR-01c.02','N/A','Determine if: - the current incident response procedures are reviewed and updated [IR-01_ODP[07]; the frequency at which the current incident response procedures are reviewed and updated is defined]. - the current incident response procedures are reviewed and updated following [IR-01_ODP[08]; events that would require the incident response procedures to be reviewed and updated are defined].'),\n('004116','draft','2022-03-03','DISA','policy','Defines the events for reviewing and updating the current incident response procedures.','IR-01c.02','N/A','Determine if: - the current incident response procedures are reviewed and updated [IR-01_ODP[07]; the frequency at which the current incident response procedures are reviewed and updated is defined]. - the current incident response procedures are reviewed and updated following [IR-01_ODP[08]; events that would require the incident response procedures to be reviewed and updated are defined].'),\n('004117','draft','2022-03-03','DISA','policy','Defines the automated mechanisms to provide an incident response training environment.','IR-02(02)','N/A','Determine if an incident response training environment is provided using [IR-02(02)_ODP; automated mechanisms used in an incident response training environment are defined].'),\n('004118','draft','2022-03-03','DISA','policy','Provide incident response training on how to identify and respond to a breach, including the organization''s process for reporting a breach.','IR-02(03)','N/A','Determine if: - incident response training on how to identify and respond to a breach is provided. - incident response training on the organization''s process for reporting a breach is provided.'),\n('004119','draft','2022-03-03','DISA','policy','Defines the automated mechanisms to test the incident response capability.','IR-03(01)','N/A','Determine if the incident response capability is tested using [IR-03(01)_ODP; automated mechanisms used to test the incident response capability are defined].'),\n('004120','draft','2022-03-03','DISA','policy','Use qualitative data from testing to determine the effectiveness of incident response processes.','IR-03(03)(a)','N/A','Determine if: - qualitative data from testing are used to determine the effectiveness of incident response processes. - quantitative data from testing are used to determine the effectiveness of incident response processes.'),\n('004121','draft','2022-03-03','DISA','policy','Use quantitative data from testing to determine the effectiveness of incident response processes.','IR-03(03)(a)','N/A','Determine if: - qualitative data from testing are used to determine the effectiveness of incident response processes. - quantitative data from testing are used to determine the effectiveness of incident response processes.'),\n('004122','draft','2022-03-03','DISA','policy','Use qualitative data from testing to continuously improve incident response processes.','IR-03(03)(b)','N/A','Determine if: - qualitative data from testing are used to continuously improve incident response processes. - quantitative data from testing are used to continuously improve incident response processes.'),\n('004123','draft','2022-03-03','DISA','policy','Use quantitative data from testing to continuously improve incident response processes.','IR-03(03)(b)','N/A','Determine if: - qualitative data from testing are used to continuously improve incident response processes. - quantitative data from testing are used to continuously improve incident response processes.'),\n('004124','draft','2022-03-03','DISA','policy','Use qualitative data from testing to provide incident response measures and metrics that are accurate.','IR-03(03)(c)','N/A','Determine if: - qualitative data from testing are used to provide incident response measures and metrics that are accurate. - quantitative data from testing are used to provide incident response measures and metrics that are accurate. - qualitative data from testing are used to provide incident response measures and metrics that are consistent. - quantitative data from testing are used to provide incident response measures and metrics that are consistent. - qualitative data from testing are used to provide incident response measures and metrics in a reproducible format. - quantitative data from testing are used to provide incident response measures and metrics in a reproducible format.'),\n('004125','draft','2022-03-03','DISA','policy','Use quantitative data from testing to provide incident response measures and metrics that are accurate.','IR-03(03)(c)','N/A','Determine if: - qualitative data from testing are used to provide incident response measures and metrics that are accurate. - quantitative data from testing are used to provide incident response measures and metrics that are accurate. - qualitative data from testing are used to provide incident response measures and metrics that are consistent. - quantitative data from testing are used to provide incident response measures and metrics that are consistent. - qualitative data from testing are used to provide incident response measures and metrics in a reproducible format. - quantitative data from testing are used to provide incident response measures and metrics in a reproducible format.'),\n('004126','draft','2022-03-03','DISA','policy','Use qualitative data from testing to provide incident response measures and metrics that are consistent.','IR-03(03)(c)','N/A','Determine if: - qualitative data from testing are used to provide incident response measures and metrics that are accurate. - quantitative data from testing are used to provide incident response measures and metrics that are accurate. - qualitative data from testing are used to provide incident response measures and metrics that are consistent. - quantitative data from testing are used to provide incident response measures and metrics that are consistent. - qualitative data from testing are used to provide incident response measures and metrics in a reproducible format. - quantitative data from testing are used to provide incident response measures and metrics in a reproducible format.'),\n('004127','draft','2022-03-03','DISA','policy','Use quantitative data from testing to provide incident response measures and metrics that are consistent.','IR-03(03)(c)','N/A','Determine if: - qualitative data from testing are used to provide incident response measures and metrics that are accurate. - quantitative data from testing are used to provide incident response measures and metrics that are accurate. - qualitative data from testing are used to provide incident response measures and metrics that are consistent. - quantitative data from testing are used to provide incident response measures and metrics that are consistent. - qualitative data from testing are used to provide incident response measures and metrics in a reproducible format. - quantitative data from testing are used to provide incident response measures and metrics in a reproducible format.'),\n('004128','draft','2022-03-03','DISA','policy','Use qualitative data from testing to provide incident response measures and metrics that are in a reproducible format.','IR-03(03)(c)','N/A','Determine if: - qualitative data from testing are used to provide incident response measures and metrics that are accurate. - quantitative data from testing are used to provide incident response measures and metrics that are accurate. - qualitative data from testing are used to provide incident response measures and metrics that are consistent. - quantitative data from testing are used to provide incident response measures and metrics that are consistent. - qualitative data from testing are used to provide incident response measures and metrics in a reproducible format. - quantitative data from testing are used to provide incident response measures and metrics in a reproducible format.'),\n('004129','draft','2022-03-03','DISA','policy','Use quantitative data from testing to provide incident response measures and metrics that are in a reproducible format.','IR-03(03)(c)','N/A','Determine if: - qualitative data from testing are used to provide incident response measures and metrics that are accurate. - quantitative data from testing are used to provide incident response measures and metrics that are accurate. - qualitative data from testing are used to provide incident response measures and metrics that are consistent. - quantitative data from testing are used to provide incident response measures and metrics that are consistent. - qualitative data from testing are used to provide incident response measures and metrics in a reproducible format. - quantitative data from testing are used to provide incident response measures and metrics in a reproducible format.'),\n('004130','draft','2022-03-03','DISA','policy','Incorporate lessons learned from ongoing incident handling activities into incident response procedures.','IR-04c.','N/A','Determine if: - lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training, and testing. - the changes resulting from the incorporated lessons learned are implemented accordingly.'),\n('004131','draft','2022-03-03','DISA','policy','Incorporate lessons learned from ongoing incident handling activities into incident response training.','IR-04c.','N/A','Determine if: - lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training, and testing. - the changes resulting from the incorporated lessons learned are implemented accordingly.'),\n('004132','draft','2022-03-03','DISA','policy','Incorporate lessons learned from ongoing incident handling activities into incident response testing.','IR-04c.','N/A','Determine if: - lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training, and testing. - the changes resulting from the incorporated lessons learned are implemented accordingly.'),\n('004133','draft','2022-03-03','DISA','policy','Ensure the rigor of incident handling activities are comparable and predictable across the organization.','IR-04d.','N/A','Determine if: - the rigor of incident handling activities is comparable and predictable across the organization. - the intensity of incident handling activities is comparable and predictable across the organization. - the scope of incident handling activities is comparable and predictable across the organization. - the results of incident handling activities are comparable and predictable across the organization.'),\n('004134','draft','2022-03-03','DISA','policy','Ensure the intensity of incident handling activities are comparable and predictable across the organization.','IR-04d.','N/A','Determine if: - the rigor of incident handling activities is comparable and predictable across the organization. - the intensity of incident handling activities is comparable and predictable across the organization. - the scope of incident handling activities is comparable and predictable across the organization. - the results of incident handling activities are comparable and predictable across the organization.'),\n('004135','draft','2022-03-03','DISA','policy','Ensure the scope of incident handling activities are comparable and predictable across the organization.','IR-04d.','N/A','Determine if: - the rigor of incident handling activities is comparable and predictable across the organization. - the intensity of incident handling activities is comparable and predictable across the organization. - the scope of incident handling activities is comparable and predictable across the organization. - the results of incident handling activities are comparable and predictable across the organization.'),\n('004136','draft','2022-03-03','DISA','policy','Ensure the results of incident handling activities are comparable and predictable across the organization.','IR-04d.','N/A','Determine if: - the rigor of incident handling activities is comparable and predictable across the organization. - the intensity of incident handling activities is comparable and predictable across the organization. - the scope of incident handling activities is comparable and predictable across the organization. - the results of incident handling activities are comparable and predictable across the organization.'),\n('004137','draft','2022-03-03','DISA','policy','Defines the automated mechanisms for supporting the incident handling process.','IR-04(01)','N/A','Determine if the incident handling process is supported using [IR-04(01)_ODP; automated mechanisms used to support the incident handling process are defined].'),\n('004138','draft','2022-03-03','DISA','policy','Defines the types of dynamic reconfiguration for system components.','IR-04(02)','N/A','Determine if [IR-04(02)_ODP[01]; types of dynamic reconfiguration for system components are defined] for [IR-04(02)_ODP[02]; system components that require dynamic reconfiguration are defined] are included as part of the incident response capability.'),\n('004139','draft','2022-03-03','DISA','policy','Defines the classes of incidents to identify actions in response to those incidents.','IR-04(03)','N/A','Determine if: - [IR-04(03)_ODP[01]; classes of incidents requiring an organization-defined action (defined in IR-04(03)_ODP[02]) to be taken are defined] are identified. - [IR-04(03)_ODP[02]; actions to be taken in response to organization-defined classes of incidents are defined] are taken in response to those incidents (defined in IR-04(03)_ODP[01]) to ensure the continuation of organizational mission and business functions.'),\n('004140','draft','2022-03-03','DISA','policy','Defines the actions to take in response to organization-defined classes of incidents to ensure continuation of organizational mission and business functions.','IR-04(03)','N/A','Determine if: - [IR-04(03)_ODP[01]; classes of incidents requiring an organization-defined action (defined in IR-04(03)_ODP[02]) to be taken are defined] are identified. - [IR-04(03)_ODP[02]; actions to be taken in response to organization-defined classes of incidents are defined] are taken in response to those incidents (defined in IR-04(03)_ODP[01]) to ensure the continuation of organizational mission and business functions.'),\n('004141','draft','2022-03-03','DISA','policy','Coordinate an incident handling capability for insider threats that includes organization-defined entities.','IR-04(07)','N/A','Determine if: - an incident handling capability is coordinated for insider threats. - the coordinated incident handling capability includes [IR-04(07)_ODP; entities that require coordination for an incident handling capability for insider threats are defined].'),\n('004142','draft','2022-03-03','DISA','policy','Defines the organizational entities for coordinating an incident handling capability for insider threats.','IR-04(07)','N/A','Determine if: - an incident handling capability is coordinated for insider threats. - the coordinated incident handling capability includes [IR-04(07)_ODP; entities that require coordination for an incident handling capability for insider threats are defined].'),\n('004143','draft','2022-03-03','DISA','policy','Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in an organization-defined time period.','IR-04(11)','N/A','Determine if: - an integrated incident response team is established and maintained. - the integrated incident response team can be deployed to any location identified by the organization in [IR-04(11)_ODP; the time period within which an integrated incident response team can be deployed is defined].'),\n('004144','draft','2022-03-03','DISA','policy','Defines the time period for establishing and maintaining an integrated incident response team that can be deployed to any location identified by the organization.','IR-04(11)','N/A','Determine if: - an integrated incident response team is established and maintained. - the integrated incident response team can be deployed to any location identified by the organization in [IR-04(11)_ODP; the time period within which an integrated incident response team can be deployed is defined].'),\n('004145','draft','2022-03-03','DISA','policy','Analyze malicious code and/or other residual artifacts remaining in the system after the incident.','IR-04(12)','N/A','Determine if: - malicious code remaining in the system is analyzed after the incident. - other residual artifacts remaining in the system (if any) are analyzed after the incident.'),\n('004146','draft','2022-03-03','DISA','policy','Analyze anomalous or suspected adversarial behavior in or related to organization-defined environments or resources.','IR-04(13)','N/A','Determine if anomalous or suspected adversarial behavior in or related to [IR-04(13)_ODP; environments or resources which may contain or may be related to anomalous or suspected adversarial behavior are defined] are analyzed.'),\n('004147','draft','2022-03-03','DISA','policy','Defines the environments or resources for analyzing anomalous or suspected adversarial behavior.','IR-04(13)','N/A','Determine if anomalous or suspected adversarial behavior in or related to [IR-04(13)_ODP; environments or resources which may contain or may be related to anomalous or suspected adversarial behavior are defined] are analyzed.'),\n('004148','draft','2022-03-03','DISA','policy','Establish and maintain a security operations center.','IR-04(14)','N/A','Determine if: - a security operations center is established. - a security operations center is maintained.'),\n('004149','draft','2022-03-03','DISA','policy','Manage public relations associated with an incident.','IR-04(15)(a)','N/A','Determine if public relations associated with an incident are managed.'),\n('004150','draft','2022-03-03','DISA','policy','Employ measures to repair the reputation of the organization.','IR-04(15)(b)','N/A','Determine if measures are employed to repair the reputation of the organization.'),\n('004151','draft','2022-03-03','DISA','policy','Track incidents using organization-defined automated mechanisms.','IR-05(01)','N/A','Determine if: - incidents are tracked using [IR-05(01)_ODP[01]; automated mechanisms used to track incidents are defined]. - incident information is collected using [IR-05(01)_ODP[02]; automated mechanisms used to collect incident information are defined]. - incident information is analyzed using [IR-05(01)_ODP[03]; automated mechanisms used to analyze incident information are defined].'),\n('004152','draft','2022-03-03','DISA','policy','Collect incident information using organization-defined automated mechanisms.','IR-05(01)','N/A','Determine if: - incidents are tracked using [IR-05(01)_ODP[01]; automated mechanisms used to track incidents are defined]. - incident information is collected using [IR-05(01)_ODP[02]; automated mechanisms used to collect incident information are defined]. - incident information is analyzed using [IR-05(01)_ODP[03]; automated mechanisms used to analyze incident information are defined].'),\n('004153','draft','2022-03-03','DISA','policy','Analyze incident information using organization-defined automated mechanisms.','IR-05(01)','N/A','Determine if: - incidents are tracked using [IR-05(01)_ODP[01]; automated mechanisms used to track incidents are defined]. - incident information is collected using [IR-05(01)_ODP[02]; automated mechanisms used to collect incident information are defined]. - incident information is analyzed using [IR-05(01)_ODP[03]; automated mechanisms used to analyze incident information are defined].'),\n('004154','draft','2022-03-03','DISA','policy','Defines the automated mechanisms to track, collect, and analyze incident information.','IR-05(01)','N/A','Determine if: - incidents are tracked using [IR-05(01)_ODP[01]; automated mechanisms used to track incidents are defined]. - incident information is collected using [IR-05(01)_ODP[02]; automated mechanisms used to collect incident information are defined]. - incident information is analyzed using [IR-05(01)_ODP[03]; automated mechanisms used to analyze incident information are defined].'),\n('004155','draft','2022-03-03','DISA','policy','Defines the automated mechanisms for reporting incidents.','IR-06(01)','N/A','Determine if incidents are reported using [IR-06(01)_ODP; automated mechanisms used for reporting incidents are defined].'),\n('004156','draft','2022-03-03','DISA','policy','Provide incident information to the provider of the product or service.','IR-06(03)','N/A','Determine if incident information is provided to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.'),\n('004157','draft','2022-03-03','DISA','policy','Develop an incident response plan that addresses the sharing of incident information.','IR-08a.08','N/A','Determine if an incident response plan is developed that addresses the sharing of incident information.'),\n('004158','draft','2022-03-03','DISA','policy','Defines the frequency organization-defined personnel or roles will review and approve the incident response plan.','IR-08a.09','N/A','Determine if an incident response plan is developed that is reviewed and approved by [IR-08_ODP[01]; personnel or roles that review and approve the incident response plan is/are identified] [IR-08_ODP[02]; the frequency at which to review and approve the incident response plan is defined].'),\n('004159','draft','2022-03-03','DISA','policy','Develop an incident response plan that explicitly designates responsibility for incident response to organization-defined entities, personnel, or roles.','IR-08a.10','N/A','Determine if an incident response plan is developed that explicitly designates responsibility for incident response to [IR-08_ODP[03]; entities, personnel, or roles with designated responsibility for incident response are defined].'),\n('004160','draft','2022-03-03','DISA','policy','Include a process to determine if notice to individuals or other organizations, including oversight organizations, is needed, in the Incident Response Plan for breaches involving Personally Identifiable Information.','IR-08(01)(a)','N/A','Determine if the incident response plan for breaches involving personally identifiable information includes a process to determine if notice to individuals or other organizations, including oversight organizations, is needed.'),\n('004161','draft','2022-03-03','DISA','policy','Include an assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms in the Incident Response Plan for breaches involving Personally Identifiable Information.','IR-08(01)(b)','N/A','Determine if the incident response plan for breaches involving personally identifiable information includes an assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms.'),\n('004162','draft','2022-03-03','DISA','policy','Include identification of applicable privacy requirements in the Incident Response Plan for breaches involving Personally Identifiable Information.','IR-08(01)(c)','N/A','Determine if the incident response plan for breaches involving personally identifiable information includes the identification of applicable privacy requirements.'),\n('004163','draft','2022-03-03','DISA','policy','Respond to information spills by assigning organization-defined personnel or roles with responsibility for responding to information spills.','IR-09a.','N/A','Determine if [IR-09_ODP[01]; personnel or roles assigned the responsibility for responding to information spills is/are defined] is/are assigned the responsibility to respond to information spills.'),\n('004164','draft','2022-03-03','DISA','policy','Defines the personnel or roles who will respond to information spills.','IR-09a.','N/A','Determine if [IR-09_ODP[01]; personnel or roles assigned the responsibility for responding to information spills is/are defined] is/are assigned the responsibility to respond to information spills.'),\n('004165','draft','2022-03-03','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system-level maintenance policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','MA-01a.01(b)','N/A','Determine if the [MA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] maintenance policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('004166','draft','2022-03-03','DISA','policy','Designate an organization-defined official to manage the development, documentation, and dissemination of the maintenance policy.','MA-01b.','N/A','Determine if the [MA-01_ODP[04]; an official to manage the maintenance policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the maintenance policy and procedures.'),\n('004167','draft','2022-03-03','DISA','policy','Designate an organization-defined official to manage the development, documentation, and dissemination of the maintenance procedures.','MA-01b.','N/A','Determine if the [MA-01_ODP[04]; an official to manage the maintenance policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the maintenance policy and procedures.'),\n('004168','draft','2022-03-03','DISA','policy','Defines the official who will manage the development, documentation, and dissemination of the maintenance policy.','MA-01b.','N/A','Determine if the [MA-01_ODP[04]; an official to manage the maintenance policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the maintenance policy and procedures.'),\n('004169','draft','2022-03-03','DISA','policy','Defines the official who will manage the development, documentation, and dissemination of the maintenance procedures.','MA-01b.','N/A','Determine if the [MA-01_ODP[04]; an official to manage the maintenance policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the maintenance policy and procedures.'),\n('004170','draft','2022-03-03','DISA','policy','Review and update the current maintenance policy following organization-defined events.','MA-01c.01','N/A','Determine if: - the current maintenance policy is reviewed and updated [MA-01_ODP[05]; the frequency with which the current maintenance policy is reviewed and updated is defined]. - the current maintenance policy is reviewed and updated following [MA-01_ODP[06]; events that would require the current maintenance policy to be reviewed and updated are defined].'),\n('004171','draft','2022-03-03','DISA','policy','Defines the events following reviewing and updating the current maintenance policy.','MA-01c.01','N/A','Determine if: - the current maintenance policy is reviewed and updated [MA-01_ODP[05]; the frequency with which the current maintenance policy is reviewed and updated is defined]. - the current maintenance policy is reviewed and updated following [MA-01_ODP[06]; events that would require the current maintenance policy to be reviewed and updated are defined].'),\n('004172','draft','2022-03-03','DISA','policy','Review and update the current maintenance procedures following organization-defined events.','MA-01c.02','N/A','Determine if: - the current maintenance procedures are reviewed and updated [MA-01_ODP[07]; the frequency with which the current maintenance procedures are reviewed and updated is defined]. - the current maintenance procedures are reviewed and updated following [MA-01_ODP[08]; events that would require the maintenance procedures to be reviewed and updated are defined].'),\n('004173','draft','2022-03-03','DISA','policy','Defines the events following reviewing and updating the current maintenance procedures.','MA-01c.02','N/A','Determine if: - the current maintenance procedures are reviewed and updated [MA-01_ODP[07]; the frequency with which the current maintenance procedures are reviewed and updated is defined]. - the current maintenance procedures are reviewed and updated following [MA-01_ODP[08]; events that would require the maintenance procedures to be reviewed and updated are defined].'),\n('004174','draft','2022-03-03','DISA','policy','Schedule replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-02a.','N/A','Determine if: - maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements. - maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements. - records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('004175','draft','2022-03-03','DISA','policy','Document replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-02a.','N/A','Determine if: - maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements. - maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements. - records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('004176','draft','2022-03-03','DISA','policy','Review records of replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.','MA-02a.','N/A','Determine if: - maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements. - maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements. - records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements.'),\n('004177','draft','2022-03-03','DISA','policy','Approve all maintenance activities, whether performed on site or remotely.','MA-02b.','N/A','Determine if: - all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved. - all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are monitored.'),\n('004178','draft','2022-03-03','DISA','policy','Monitor all maintenance activities, whether performed on site or remotely.','MA-02b.','N/A','Determine if: - all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved. - all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are monitored.'),\n('004179','draft','2022-03-03','DISA','policy','Approve all maintenance activities, whether the system or system components are serviced on site or removed to another location.','MA-02b.','N/A','Determine if: - all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved. - all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are monitored.'),\n('004180','draft','2022-03-03','DISA','policy','Monitor all maintenance activities, whether the system or system components are serviced on site or removed to another location.','MA-02b.','N/A','Determine if: - all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved. - all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are monitored.'),\n('004181','draft','2022-03-03','DISA','policy','Defines the information to be removed from associated media.','MA-02d.','N/A','Determine if equipment is sanitized to remove [MA-02_ODP[02]; information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement is defined] from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement.'),\n('004182','draft','2022-03-03','DISA','policy','Schedule maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms.','MA-02(02)(a)','N/A','Determine if: - [MA-02(02)_ODP[01]; automated mechanisms used to schedule maintenance, repair, and replacement actions for the system are defined] are used to schedule maintenance, repair, and replacement actions for the system. - [MA-02(02)_ODP[02]; automated mechanisms used to conduct maintenance, repair, and replacement actions for the system are defined] are used to conduct maintenance, repair, and replacement actions for the system. - [MA-02(02)_ODP[03]; automated mechanisms used to document maintenance, repair, and replacement actions for the system are defined] are used to document maintenance, repair, and replacement actions for the system.'),\n('004183','draft','2022-03-03','DISA','policy','Conduct maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms.','MA-02(02)(a)','N/A','Determine if: - [MA-02(02)_ODP[01]; automated mechanisms used to schedule maintenance, repair, and replacement actions for the system are defined] are used to schedule maintenance, repair, and replacement actions for the system. - [MA-02(02)_ODP[02]; automated mechanisms used to conduct maintenance, repair, and replacement actions for the system are defined] are used to conduct maintenance, repair, and replacement actions for the system. - [MA-02(02)_ODP[03]; automated mechanisms used to document maintenance, repair, and replacement actions for the system are defined] are used to document maintenance, repair, and replacement actions for the system.'),\n('004184','draft','2022-03-03','DISA','policy','Document maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms.','MA-02(02)(a)','N/A','Determine if: - [MA-02(02)_ODP[01]; automated mechanisms used to schedule maintenance, repair, and replacement actions for the system are defined] are used to schedule maintenance, repair, and replacement actions for the system. - [MA-02(02)_ODP[02]; automated mechanisms used to conduct maintenance, repair, and replacement actions for the system are defined] are used to conduct maintenance, repair, and replacement actions for the system. - [MA-02(02)_ODP[03]; automated mechanisms used to document maintenance, repair, and replacement actions for the system are defined] are used to document maintenance, repair, and replacement actions for the system.'),\n('004185','draft','2022-03-03','DISA','policy','Produce up-to date, accurate, and complete records of all replacement actions requested, scheduled, in process, and completed.','MA-02(02)(b)','N/A','Determine if: - up-to date, accurate, and complete records of all maintenance actions requested, scheduled, in process, and completed are produced. - up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed are produced. - up-to date, accurate, and complete records of all replacement actions requested, scheduled, in process, and completed are produced.'),\n('004186','draft','2022-03-03','DISA','policy','Review previously approved system maintenance tools on an organization-defined frequency.','MA-03b.','N/A','Determine if previously approved system maintenance tools are reviewed [MA-03_ODP frequency; frequency at which to review previously approved system maintenance tools is defined].'),\n('004187','draft','2022-03-03','DISA','policy','Defines the frequency for reviewing previously approved system maintenance tools.','MA-03b.','N/A','Determine if previously approved system maintenance tools are reviewed [MA-03_ODP frequency; frequency at which to review previously approved system maintenance tools is defined].'),\n('004188','draft','2022-03-03','DISA','policy','Monitor the use of maintenance tools that execute with increased privilege.','MA-03(05)','N/A','Determine if the use of maintenance tools that execute with increased privilege is monitored.'),\n('004189','draft','2022-03-03','DISA','policy','Inspect the maintenance tools to ensure the latest software updates and patches are installed.','MA-03(06)','N/A','Determine if maintenance tools are inspected to ensure that the latest software updates and patches are installed.'),\n('004190','draft','2022-03-03','DISA','policy','Terminate session when nonlocal maintenance is completed.','MA-04e.','N/A','Determine if: - session connections are terminated when nonlocal maintenance is completed. - network connections are terminated when nonlocal maintenance is completed.'),\n('004191','draft','2022-03-03','DISA','policy','Terminate network connection when nonlocal maintenance is completed.','MA-04e.','N/A','Determine if: - session connections are terminated when nonlocal maintenance is completed. - network connections are terminated when nonlocal maintenance is completed.'),\n('004192','draft','2022-03-03','DISA','technical','Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths.','MA-04(04)(b)(02)','N/A','Determine if nonlocal maintenance sessions are protected by logically separated communication paths.'),\n('004193','draft','2022-03-03','DISA','policy','Defines the cryptographic mechanisms for protecting the integrity and confidentiality of nonlocal maintenance and diagnostic communications.','MA-04(06)','N/A','Determine if: - [MA-04(06)_ODP; cryptographic mechanisms to be implemented to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications are defined] are implemented to protect the integrity of nonlocal maintenance and diagnostic communications. - [MA-04(06)_ODP; cryptographic mechanisms to be implemented to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications are defined] are implemented to protect the confidentiality of nonlocal maintenance and diagnostic communications.'),\n('004194','draft','2022-03-03','DISA','policy','Develop organization-defined alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system.','MA-05(01)(b)','N/A','Determine if [MA-05(01)_ODP; alternate controls to be developed and implemented in the event that a system component cannot be sanitized, removed, or disconnected from the system are defined] are developed and implemented in the event that a system cannot be sanitized, removed, or disconnected from the system.'),\n('004195','draft','2022-03-03','DISA','policy','Implement organization-defined alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system.','MA-05(01)(b)','N/A','Determine if [MA-05(01)_ODP; alternate controls to be developed and implemented in the event that a system component cannot be sanitized, removed, or disconnected from the system are defined] are developed and implemented in the event that a system cannot be sanitized, removed, or disconnected from the system.'),\n('004196','draft','2022-03-03','DISA','policy','Defines alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system.','MA-05(01)(b)','N/A','Determine if [MA-05(01)_ODP; alternate controls to be developed and implemented in the event that a system component cannot be sanitized, removed, or disconnected from the system are defined] are developed and implemented in the event that a system cannot be sanitized, removed, or disconnected from the system.'),\n('004197','draft','2022-03-03','DISA','policy','Defines the automated mechanisms for transferring predictive maintenance data to a maintenance system.','MA-06(03)','N/A','Determine if predictive maintenance data is transferred to a maintenance management system using [MA-06(03)_ODP; automated mechanisms used to transfer predictive maintenance data to a maintenance management system are defined].'),\n('004198','draft','2022-03-03','DISA','policy','Restrict or prohibit field maintenance on organization-defined systems or system components to organization-defined trusted maintenance facilities.','MA-07','N/A','Determine if field maintenance on [MA-07_ODP[01]; systems or system components on which field maintenance is restricted or prohibited to trusted maintenance facilities are defined] are restricted or prohibited to [MA-07_ODP[02]; trusted maintenance facilities that are not restricted or prohibited from conducting field maintenance are defined].'),\n('004199','draft','2022-03-03','DISA','policy','Defines the systems or system components which restrict or prohibit field maintenance.','MA-07','N/A','Determine if field maintenance on [MA-07_ODP[01]; systems or system components on which field maintenance is restricted or prohibited to trusted maintenance facilities are defined] are restricted or prohibited to [MA-07_ODP[02]; trusted maintenance facilities that are not restricted or prohibited from conducting field maintenance are defined].'),\n('004200','draft','2022-03-03','DISA','policy','Defines the trusted maintenance facilities which the systems or system components restrict or prohibit field maintenance.','MA-07','N/A','Determine if field maintenance on [MA-07_ODP[01]; systems or system components on which field maintenance is restricted or prohibited to trusted maintenance facilities are defined] are restricted or prohibited to [MA-07_ODP[02]; trusted maintenance facilities that are not restricted or prohibited from conducting field maintenance are defined].'),\n('004201','draft','2022-03-03','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system-level media protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','MP-01a.01(b)','N/A','Determine if the media protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('004202','draft','2022-03-03','DISA','policy','Designate an organization-defined official to manage the development and documentation of the media protection policy.','MP-01b.','N/A','Determine if the [MP-01_ODP[04]; an official to manage the media protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the media protection policy and procedures.'),\n('004203','draft','2022-03-03','DISA','policy','Designate an organization-defined official to manage the dissemination of the media protection policy.','MP-01b.','N/A','Determine if the [MP-01_ODP[04]; an official to manage the media protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the media protection policy and procedures.'),\n('004204','draft','2022-03-03','DISA','policy','Designate an organization-defined official to manage development and documentation of the media protection procedures.','MP-01b.','N/A','Determine if the [MP-01_ODP[04]; an official to manage the media protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the media protection policy and procedures.'),\n('004205','draft','2022-03-03','DISA','policy','Designate an organization-defined official to manage dissemination of the media protection procedures.','MP-01b.','N/A','Determine if the [MP-01_ODP[04]; an official to manage the media protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the media protection policy and procedures.'),\n('004206','draft','2022-03-03','DISA','policy','Defines the official designated to manage the development, documentation, and dissemination of the media protection policy and procedures.','MP-01b.','N/A','Determine if the [MP-01_ODP[04]; an official to manage the media protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the media protection policy and procedures.'),\n('004207','draft','2022-03-03','DISA','policy','Review and update the current media protection policy following organization-defined events.','MP-01c.01','N/A','Determine if: - the current media protection policy is reviewed and updated [MP-01_ODP[05]; the frequency with which the current media protection policy is reviewed and updated is defined]. - the current media protection policy is reviewed and updated following [MP-01_ODP[06]; events that would require the current media protection policy to be reviewed and updated are defined].'),\n('004208','draft','2022-03-03','DISA','policy','Defines the events following reviewing and updating the current media policy.','MP-01c.01','N/A','Determine if: - the current media protection policy is reviewed and updated [MP-01_ODP[05]; the frequency with which the current media protection policy is reviewed and updated is defined]. - the current media protection policy is reviewed and updated following [MP-01_ODP[06]; events that would require the current media protection policy to be reviewed and updated are defined].'),\n('004209','draft','2022-03-03','DISA','policy','Review and update the current media protection procedures following organization-defined events.','MP-01c.02','N/A','Determine if: - the current media protection procedures are reviewed and updated [MP-01_ODP[07]; the frequency with which the current media protection procedures are reviewed and updated is defined]. - the current media protection procedures are reviewed and updated following [MP-01_ODP[08]; events that would require media protection procedures to be reviewed and updated are defined].'),\n('004210','draft','2022-03-03','DISA','policy','Defines the events following reviewing and updating the current media procedures.','MP-01c.02','N/A','Determine if: - the current media protection procedures are reviewed and updated [MP-01_ODP[07]; the frequency with which the current media protection procedures are reviewed and updated is defined]. - the current media protection procedures are reviewed and updated following [MP-01_ODP[08]; events that would require media protection procedures to be reviewed and updated are defined].'),\n('004211','draft','2022-03-03','DISA','policy','Physically control and securely store organization-defined types of digital and/or non-digital media within organization-defined controlled areas.','MP-04a.','N/A','Determine if: - [MP-04_ODP[01]; types of digital media to be physically controlled are defined (if selected)] are physically controlled. - [MP-04_ODP[02]; types of non-digital media to be physically controlled are defined (if selected)] are physically controlled. - [MP-04_ODP[03]; types of digital media to be securely stored are defined (if selected)] are securely stored within [MP-04_ODP[05]; controlled areas within which to securely store digital media are defined]. - [MP-04_ODP[04]; types of non-digital media to be securely stored are defined (if selected)] are securely stored within [MP-04_ODP[06]; controlled areas within which to securely store non-digital media are defined].'),\n('004212','draft','2022-03-03','DISA','policy','Securely store organization-defined types of digital and/or non-digital media within organization-defined controlled areas.','MP-04a.','N/A','Determine if: - [MP-04_ODP[01]; types of digital media to be physically controlled are defined (if selected)] are physically controlled. - [MP-04_ODP[02]; types of non-digital media to be physically controlled are defined (if selected)] are physically controlled. - [MP-04_ODP[03]; types of digital media to be securely stored are defined (if selected)] are securely stored within [MP-04_ODP[05]; controlled areas within which to securely store digital media are defined]. - [MP-04_ODP[04]; types of non-digital media to be securely stored are defined (if selected)] are securely stored within [MP-04_ODP[06]; controlled areas within which to securely store non-digital media are defined].'),\n('004213','draft','2022-03-03','DISA','policy','Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment.','MP-04b.','N/A','Determine if system media types (defined in MP-04_ODP[01], MP-04_ODP[02], MP-04_ODP[03], MP-04_ODP[04]) are protected until the media are destroyed or sanitized using approved equipment, techniques, and procedures.'),\n('004214','draft','2022-03-03','DISA','policy','Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved techniques.','MP-04b.','N/A','Determine if system media types (defined in MP-04_ODP[01], MP-04_ODP[02], MP-04_ODP[03], MP-04_ODP[04]) are protected until the media are destroyed or sanitized using approved equipment, techniques, and procedures.'),\n('004215','draft','2022-03-03','DISA','policy','Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved procedures.','MP-04b.','N/A','Determine if system media types (defined in MP-04_ODP[01], MP-04_ODP[02], MP-04_ODP[03], MP-04_ODP[04]) are protected until the media are destroyed or sanitized using approved equipment, techniques, and procedures.'),\n('004216','draft','2022-03-03','DISA','policy','Defines the automated mechanisms which restrict access to media storage areas and log access attempts and access granted.','MP-04(02)','N/A','Determine if: - access to media storage areas is restricted using [MP-04(02)_ODP[01]; automated mechanisms to restrict access to media storage areas are defined]. - access attempts to media storage areas are logged using [MP-04(02)_ODP[02]; automated mechanisms to log access attempts to media storage areas are defined]. - access granted to media storage areas is logged using [MP-04(02)_ODP[03]; automated mechanisms to log access granted to media storage areas are defined].'),\n('004217','draft','2022-03-03','DISA','policy','Protect organization-defined types of system media during transport outside of controlled areas using organization-defined controls.','MP-05a.','N/A','Determine if: - [MP-05_ODP[01]; types of system media to protect and control during transport outside of controlled areas are defined] are protected during transport outside of controlled areas using [MP-05_ODP[02]; controls used to protect system media outside of controlled areas are defined]. - [MP-05_ODP[01]; types of system media to protect and control during transport outside of controlled areas are defined] are controlled during transport outside of controlled areas using [MP-05_ODP[03]; controls used to control system media outside of controlled areas are defined].'),\n('004218','draft','2022-03-03','DISA','policy','Control organization-defined types of system media during transport outside of controlled areas using organization-defined controls.','MP-05a.','N/A','Determine if: - [MP-05_ODP[01]; types of system media to protect and control during transport outside of controlled areas are defined] are protected during transport outside of controlled areas using [MP-05_ODP[02]; controls used to protect system media outside of controlled areas are defined]. - [MP-05_ODP[01]; types of system media to protect and control during transport outside of controlled areas are defined] are controlled during transport outside of controlled areas using [MP-05_ODP[03]; controls used to control system media outside of controlled areas are defined].'),\n('004219','draft','2022-03-03','DISA','policy','Test sanitization equipment in accordance with the organization-defined frequency to ensure that the intended sanitization is being achieved.','MP-06(02)','N/A','Determine if: - sanitization equipment is tested [MP-06(02)_ODP[01]; frequency with which to test sanitization equipment is defined] to ensure that the intended sanitization is being achieved. - sanitization procedures are tested [MP-06(02)_ODP[02]; frequency with which to test sanitization procedures is defined] to ensure that the intended sanitization is being achieved.'),\n('004220','draft','2022-03-03','DISA','policy','Test sanitization procedures in accordance with the organization-defined frequency to ensure that the intended sanitization is being achieved.','MP-06(02)','N/A','Determine if: - sanitization equipment is tested [MP-06(02)_ODP[01]; frequency with which to test sanitization equipment is defined] to ensure that the intended sanitization is being achieved. - sanitization procedures are tested [MP-06(02)_ODP[02]; frequency with which to test sanitization procedures is defined] to ensure that the intended sanitization is being achieved.'),\n('004221','draft','2022-03-03','DISA','policy','Establish an organization-defined system media downgrading process that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information.','MP-08a.','N/A','Determine if: - a [MP-08_ODP[01]; a system media downgrading process is defined] is established. - the [MP-08_ODP[01]; a system media downgrading process is defined] includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information.'),\n('004222','draft','2022-03-03','DISA','policy','Defines the system media downgrading process that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information.','MP-08a.','N/A','Determine if: - a [MP-08_ODP[01]; a system media downgrading process is defined] is established. - the [MP-08_ODP[01]; a system media downgrading process is defined] includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information.'),\n('004223','draft','2022-03-03','DISA','policy','Verify that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed.','MP-08b.','N/A','Determine if: - there is verification that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed. - there is verification that the system media downgrading process is commensurate with the access authorizations of the potential recipients of the downgraded information.'),\n('004224','draft','2022-03-03','DISA','policy','Verify that the system media downgrading process is commensurate with the access authorizations of the potential recipients of the downgraded information.','MP-08b.','N/A','Determine if: - there is verification that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed. - there is verification that the system media downgrading process is commensurate with the access authorizations of the potential recipients of the downgraded information.'),\n('004225','draft','2022-03-03','DISA','policy','Identify organization-defined system media requiring downgrading.','MP-08c.','N/A','Determine if [MP-08_ODP[02]; system media requiring downgrading is defined] is identified.'),\n('004226','draft','2022-03-03','DISA','policy','Defines the system media requiring downgrading.','MP-08c.','N/A','Determine if [MP-08_ODP[02]; system media requiring downgrading is defined] is identified.'),\n('004227','draft','2022-03-03','DISA','policy','Test downgrading equipment on an organization-defined frequency to ensure that intended downgrading actions are being achieved.','MP-08(02)','N/A','Determine if: - downgrading equipment is tested [MP-08(02)_ODP[01]; the frequency with which to test downgrading equipment is defined] to ensure that downgrading actions are being achieved. - downgrading procedures are tested [MP-08(02)_ODP[02]; the frequency with which to test downgrading procedures is defined] to ensure that downgrading actions are being achieved.'),\n('004228','draft','2022-03-03','DISA','policy','Test downgrading procedures on an organization-defined frequency to ensure that intended downgrading actions are being achieved.','MP-08(02)','N/A','Determine if: - downgrading equipment is tested [MP-08(02)_ODP[01]; the frequency with which to test downgrading equipment is defined] to ensure that downgrading actions are being achieved. - downgrading procedures are tested [MP-08(02)_ODP[02]; the frequency with which to test downgrading procedures is defined] to ensure that downgrading actions are being achieved.'),\n('004229','draft','2022-03-03','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','PE-01a.01(b)','N/A','Determine if the [PE-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] physical and environmental protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('004230','draft','2022-03-03','DISA','policy','Designate an organization-defined official to manage the development and documentation of the physical and environmental protection policy.','PE-01b.','N/A','Determine if the [PE-01_ODP[04]; an official to manage the physical and environmental protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures.'),\n('004231','draft','2022-03-03','DISA','policy','Designate an organization-defined official to manage the dissemination of the physical and environmental protection policy.','PE-01b.','N/A','Determine if the [PE-01_ODP[04]; an official to manage the physical and environmental protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures.'),\n('004232','draft','2022-03-03','DISA','policy','Designate an organization-defined official to manage development and documentation of the physical and environmental protection procedures.','PE-01b.','N/A','Determine if the [PE-01_ODP[04]; an official to manage the physical and environmental protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures.'),\n('004233','draft','2022-03-03','DISA','policy','Designate an organization-defined official to manage dissemination of the physical and environmental protection procedures.','PE-01b.','N/A','Determine if the [PE-01_ODP[04]; an official to manage the physical and environmental protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures.'),\n('004234','draft','2022-03-03','DISA','policy','Defines the official who will manage the physical and environmental policy.','PE-01b.','N/A','Determine if the [PE-01_ODP[04]; an official to manage the physical and environmental protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures.'),\n('004235','draft','2022-03-03','DISA','policy','Defines the official who will manage the physical and environmental procedures.','PE-01b.','N/A','Determine if the [PE-01_ODP[04]; an official to manage the physical and environmental protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures.'),\n('004236','draft','2022-03-03','DISA','policy','Review and update the current physical and environmental protection policy following organization-defined events.','PE-01c.01','N/A','Determine if: - the current physical and environmental protection policy is reviewed and updated [PE-01_ODP[05]; the frequency at which the current physical and environmental protection policy is reviewed and updated is defined]. - the current physical and environmental protection policy is reviewed and updated following [PE-01_ODP[06]; events that would require the current physical and environmental protection policy to be reviewed and updated are defined].'),\n('004237','draft','2022-03-03','DISA','policy','Defines the events following reviewing and updating the current physical and environmental protection policy.','PE-01c.01','N/A','Determine if: - the current physical and environmental protection policy is reviewed and updated [PE-01_ODP[05]; the frequency at which the current physical and environmental protection policy is reviewed and updated is defined]. - the current physical and environmental protection policy is reviewed and updated following [PE-01_ODP[06]; events that would require the current physical and environmental protection policy to be reviewed and updated are defined].'),\n('004238','draft','2022-03-03','DISA','policy','Review and update the current physical and environmental protection procedures following organization-defined events.','PE-01c.02','N/A','Determine if: - the current physical and environmental protection procedures are reviewed and updated [PE-01_ODP[07]; the frequency at which the current physical and environmental protection procedures are reviewed and updated is defined]. - the current physical and environmental protection procedures are reviewed and updated following [PE-01_ODP[08]; events that would require the physical and environmental protection procedures to be reviewed and updated are defined].'),\n('004239','draft','2022-03-03','DISA','policy','Defines the events following reviewing and updating the current physical and environmental protection procedures.','PE-01c.02','N/A','Determine if: - the current physical and environmental protection procedures are reviewed and updated [PE-01_ODP[07]; the frequency at which the current physical and environmental protection procedures are reviewed and updated is defined]. - the current physical and environmental protection procedures are reviewed and updated following [PE-01_ODP[08]; events that would require the physical and environmental protection procedures to be reviewed and updated are defined].'),\n('004240','draft','2022-03-03','DISA','policy','Enforce physical access authorizations at organization-defined entry points to the facility where the system resides.',NULL,'N/A',NULL),\n('004241','draft','2022-03-03','DISA','policy','Enforce physical access authorizations at organization-defined exit points to the facility where the system resides.',NULL,'N/A',NULL),\n('004242','draft','2022-03-03','DISA','policy','Control ingress to the facility where the information system resides using one or more organization-defined physical access control systems or devices or guards.','PE-03a.02','N/A','Determine if physical access authorizations are enforced at [PE-03_ODP[01]; entry and exit points to the facility in which the system resides are defined] by controlling ingress and egress to the facility using [PE-03_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[PE-03_ODP[03]; physical access control systems or devices used to control ingress and egress to the facility are defined (if selected)]; guards}].'),\n('004243','draft','2022-03-03','DISA','policy','Control egress to the facility where the information system resides using one or more organization-defined physical access control systems or devices or guards.','PE-03a.02','N/A','Determine if physical access authorizations are enforced at [PE-03_ODP[01]; entry and exit points to the facility in which the system resides are defined] by controlling ingress and egress to the facility using [PE-03_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[PE-03_ODP[03]; physical access control systems or devices used to control ingress and egress to the facility are defined (if selected)]; guards}].'),\n('004244','draft','2022-03-03','DISA','policy','Limit access using physical barriers.','PE-03(07)','N/A','Determine if physical barriers are used to limit access.'),\n('004245','draft','2022-03-03','DISA','policy','Employ access control vestibules at organization-defined locations within the facility.','PE-03(08)','N/A','Determine if access control vestibules are employed at [PE-03(08)_ODP; locations within the facility where access control vestibules are to be employed are defined].'),\n('004246','draft','2022-03-03','DISA','policy','Defines the locations within the facility where the access control vestibules are employed.','PE-03(08)','N/A','Determine if access control vestibules are employed at [PE-03(08)_ODP; locations within the facility where access control vestibules are to be employed are defined].'),\n('004247','draft','2022-03-03','DISA','technical','Link individual identity to receipt of output from output devices.','PE-05(02)','N/A','Determine if individual identity is linked to the receipt of output from output devices.'),\n('004248','draft','2022-03-03','DISA','policy','Defines the automated mechanisms for recognizing organization-defined classes or types of intrusions and initiating organization-defined response actions.','PE-06(02)','N/A','Determine if: - [PE-06(02)_ODP[01]; classes or types of intrusions to be recognized by automated mechanisms are defined] are recognized. - [PE-06(02)_ODP[02]; response actions to be initiated by automated mechanisms when organization-defined classes or types of intrusions are recognized are defined] are initiated using [PE-06(02)_ODP[03]; automated mechanisms used to recognize classes or types of intrusions and initiate response actions (defined in PE-06(02)_ODP) are defined].'),\n('004249','draft','2022-03-03','DISA','policy','Review video recordings on an organization-defined frequency.','PE-06(03)(b)','N/A','Determine if video recordings are reviewed [PE-06(03)_ODP[02]; frequency at which to review video recordings is defined].'),\n('004250','draft','2022-03-03','DISA','policy','Defines the frequency with which to review video recordings.','PE-06(03)(b)','N/A','Determine if video recordings are reviewed [PE-06(03)_ODP[02]; frequency at which to review video recordings is defined].'),\n('004251','draft','2022-03-03','DISA','policy','Report anomalies in visitor access records to organization-defined personnel.','PE-08c.','N/A','Determine if visitor access records anomalies are reported to [PE-08_ODP[03]; personnel to whom visitor access records anomalies are reported to is/are defined].'),\n('004252','draft','2022-03-03','DISA','policy','Defines the personnel who are to report anomalies in visitor access records.','PE-08c.','N/A','Determine if visitor access records anomalies are reported to [PE-08_ODP[03]; personnel to whom visitor access records anomalies are reported to is/are defined].'),\n('004253','draft','2022-03-03','DISA','policy','Defines the automated mechanisms for maintaining and reviewing visitor access records.','PE-08(01)','N/A','Determine if: - visitor access records are maintained using [PE-08(01)_ODP[01]; automated mechanisms used to maintain visitor access records are defined]. - visitor access records are reviewed using [PE-08(01)_ODP[02]; automated mechanisms used to review visitor access records are defined].'),\n('004254','draft','2022-03-03','DISA','policy','Limit personally identifiable information contained in visitor access records to the organization-defined elements identified in the privacy risk assessment.','PE-08(03)','N/A','Determine if personally identifiable information contained in visitor access records is limited to [PE-08(03)_ODP; elements identified in the privacy risk assessment to limit personally identifiable information contained in visitor access logs are defined] identified in the privacy risk assessment.'),\n('004255','draft','2022-03-03','DISA','policy','Defines the elements identified in the privacy risk assessment for limiting personally identifiable information contained in visitor access records.','PE-08(03)','N/A','Determine if personally identifiable information contained in visitor access records is limited to [PE-08(03)_ODP; elements identified in the privacy risk assessment to limit personally identifiable information contained in visitor access logs are defined] identified in the privacy risk assessment.'),\n('004256','draft','2022-03-03','DISA','policy','Defines the system or individual system components that provide the capability of shutting off power in emergency situations.','PE-10a.','N/A','Determine if the capability to shut off power to [PE-10_ODP[01]; system or individual system components that require the capability to shut off power in emergency situations is/are defined] in emergency situations is provided.'),\n('004257','draft','2022-03-03','DISA','policy','Defines the automatic environmental controls for preventing potentially harmful fluctuations to the system.','PE-14(01)','N/A','Determine if [PE-14(01)_ODP; automatic environmental controls to prevent fluctuations that are potentially harmful to the system are defined] are employed in the facility to prevent fluctuations that are potentially harmful to the system.'),\n('004258','draft','2022-03-03','DISA','policy','Defines the personnel or roles who employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment.','PE-14(02)','N/A','Determine if: - environmental control monitoring is employed. - the environmental control monitoring capability provides an alarm or notification to [PE-14(02)_ODP; personnel or roles to be notified by environmental control monitoring when environmental changes are potentially harmful to personnel or equipment is/are defined] when changes are potentially harmful to personnel or equipment.'),\n('004259','draft','2022-03-03','DISA','policy','Detect the presence of water near the system.','PE-15(01)','N/A','Determine if: - the presence of water near the system can be detected automatically. - [PE-15(01)_ODP[01]; personnel or roles to be alerted when the presence of water is detected near the system is/are defined] is/are alerted using [PE-15(01)_ODP[02]; automated mechanisms used to detect the presence of water near the system are defined].'),\n('004260','draft','2022-03-03','DISA','policy','Alert organization-defined personnel or roles of the presence of water near the system using organization-defined automated mechanisms.','PE-15(01)','N/A','Determine if: - the presence of water near the system can be detected automatically. - [PE-15(01)_ODP[01]; personnel or roles to be alerted when the presence of water is detected near the system is/are defined] is/are alerted using [PE-15(01)_ODP[02]; automated mechanisms used to detect the presence of water near the system are defined].'),\n('004261','draft','2022-03-03','DISA','policy','Defines the automated mechanisms for detecting the presence of water and alerting organization-defined personnel or roles.','PE-15(01)','N/A','Determine if: - the presence of water near the system can be detected automatically. - [PE-15(01)_ODP[01]; personnel or roles to be alerted when the presence of water is detected near the system is/are defined] is/are alerted using [PE-15(01)_ODP[02]; automated mechanisms used to detect the presence of water near the system are defined].'),\n('004262','draft','2022-03-03','DISA','policy','Determine and document the organization-defined alternate work sites allowed for use by employees.','PE-17a.','N/A','Determine if [PE-17_ODP[01]; alternate work sites allowed for use by employees are defined] are determined and documented.'),\n('004263','draft','2022-03-03','DISA','policy','Provide a means for employees to communicate with information privacy personnel in case of incidents.','PE-17d.','N/A','Determine if a means for employees to communicate with information security and privacy personnel in case of incidents is provided.'),\n('004264','draft','2022-03-03','DISA','policy','Protect system components, associated data communications, and networks in accordance with national Emissions Security policies based on the security category or classification of the information.','PE-19(01)','N/A','Determine if: - system components are protected in accordance with national emissions security policies and procedures based on the security category or classification of the information. - associated data communications are protected in accordance with national emissions security policies and procedures based on the security category or classification of the information. - networks are protected in accordance with national emissions security policies and procedures based on the security category or classification of the information.'),\n('004265','draft','2022-03-03','DISA','policy','Protect system components, associated data communications, and networks in accordance with national Emissions Security procedures based on the security category or classification of the information.','PE-19(01)','N/A','Determine if: - system components are protected in accordance with national emissions security policies and procedures based on the security category or classification of the information. - associated data communications are protected in accordance with national emissions security policies and procedures based on the security category or classification of the information. - networks are protected in accordance with national emissions security policies and procedures based on the security category or classification of the information.'),\n('004266','draft','2022-03-03','DISA','policy','Employ organization-defined protective measures against electromagnetic pulse damage for organization-defined systems and system components.','PE-21','N/A','Determine if [PE-21_ODP[01]; protective measures to be employed against electromagnetic pulse damage are defined] are employed against electromagnetic pulse damage for [PE-21_ODP[02]; system and system components requiring protection against electromagnetic pulse damage are defined].'),\n('004267','draft','2022-03-03','DISA','policy','Defines the protective measure employed against electromagnetic pulse damage for organization-defined systems and system components.','PE-21','N/A','Determine if [PE-21_ODP[01]; protective measures to be employed against electromagnetic pulse damage are defined] are employed against electromagnetic pulse damage for [PE-21_ODP[02]; system and system components requiring protection against electromagnetic pulse damage are defined].'),\n('004268','draft','2022-03-03','DISA','policy','Defines the systems and system components in which organization-defined protective measures are employed against electromagnetic pulse damage.','PE-21','N/A','Determine if [PE-21_ODP[01]; protective measures to be employed against electromagnetic pulse damage are defined] are employed against electromagnetic pulse damage for [PE-21_ODP[02]; system and system components requiring protection against electromagnetic pulse damage are defined].'),\n('004269','draft','2022-03-03','DISA','policy','Mark organization-defined system hardware components indicating the impact or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.','PE-22','N/A','Determine if [PE-22_ODP; system hardware components to be marked indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component are defined] are marked indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.'),\n('004270','draft','2022-03-03','DISA','policy','Defines the system hardware components which are marked, indicating the impact or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.','PE-22','N/A','Determine if [PE-22_ODP; system hardware components to be marked indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component are defined] are marked indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.'),\n('004271','draft','2022-03-03','DISA','policy','Plan the location or site of the facility where the system resides considering physical and environmental hazards.','PE-23a.','N/A','Determine if the location or site of the facility where the system resides is planned considering physical and environmental hazards.'),\n('004272','draft','2022-03-03','DISA','policy','For existing facilities, consider the physical and environmental hazards in the organizational risk management strategy.','PE-23b.','N/A','Determine if for existing facilities, physical and environmental hazards are considered in the organizational risk management strategy.'),\n('004273','draft','2022-03-03','DISA','policy','Develop and document an organization-level; mission/business process-level; and or system-level planning policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','PL-01a.01(b)','N/A','Determine if the [PL-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('004274','draft','2022-03-03','DISA','policy','Designate an organization-defined official to manage the development and documentation of the planning policy and procedures.','PL-01b.','N/A','Determine if the [PL-01_ODP[04]; an official to manage the planning policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the planning policy and procedures.'),\n('004275','draft','2022-03-03','DISA','policy','Designate an organization-defined official to manage the dissemination of the planning policy and procedures.','PL-01b.','N/A','Determine if the [PL-01_ODP[04]; an official to manage the planning policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the planning policy and procedures.'),\n('004276','draft','2022-03-03','DISA','policy','Review and update the current planning policy following organization-defined events.','PL-01c.01','N/A','Determine if: - the current planning policy is reviewed and updated [PL-01_ODP[05]; the frequency with which the current planning policy is reviewed and updated is defined]. - the current planning policy is reviewed and updated following [PL-01_ODP[06]; events that would require the current planning policy to be reviewed and updated are defined].'),\n('004277','draft','2022-03-03','DISA','policy','Review and update the current planning procedures following organization-defined events.','PL-01c.02','N/A','Determine if: - the current planning procedures are reviewed and updated [PL-01_ODP[07]; the frequency with which the current planning procedures are reviewed and updated is defined]. - the current planning procedures are reviewed and updated following [PL-01_ODP[08]; events that would require procedures to be reviewed and updated are defined].'),\n('004278','draft','2022-03-03','DISA','policy','Develop security and privacy plans for the system that identify the individuals that fulfill system roles and responsibilities.','PL-02a.04','N/A','Determine if: - a security plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities. - a privacy plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities.'),\n('004279','draft','2022-03-03','DISA','policy','Develop security and privacy plans for the system that identify the information types processed, stored, and transmitted by the system.','PL-02a.05','N/A','Determine if: - a security plan for the system is developed that identifies the information types processed, stored, and transmitted by the system. - a privacy plan for the system is developed that identifies the information types processed, stored, and transmitted by the system.'),\n('004280','draft','2022-03-03','DISA','policy','Develop security and privacy plans for the system that describe any specific threats to the system that are of concern to the organization.','PL-02a.07','N/A','Determine if: - a security plan for the system is developed that describes any specific threats to the system that are of concern to the organization. - a privacy plan for the system is developed that describes any specific threats to the system that are of concern to the organization.'),\n('004281','draft','2022-03-03','DISA','policy','Develop security and privacy plans for the system that provide the results of a privacy risk assessment for the systems processing personally identifiable information.','PL-02a.08','N/A','Determine if: - a security plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information. - a privacy plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information.'),\n('004282','draft','2022-03-03','DISA','policy','Develop security and privacy plans for the system that include risk determinations for security and privacy architecture and design decisions.','PL-02a.13','N/A','Determine if: - a security plan for the system is developed that includes risk determinations for security architecture and design decisions. - a privacy plan for the system is developed that includes risk determinations for privacy architecture and design decisions.'),\n('004283','draft','2022-03-03','DISA','policy','Develop security and privacy plans for the system that include security- and privacy-related activities affecting the system that require planning and coordination with organization-defined individuals or groups.','PL-02a.14','N/A','Determine if: - a security plan for the system is developed that includes security-related activities affecting the system that require planning and coordination with [PL-02_ODP[01]; individuals or groups with whom security and privacy-related activities affecting the system that require planning and coordination is/are assigned]. - a privacy plan for the system is developed that includes privacy-related activities affecting the system that require planning and coordination with [PL-02_ODP[01]; individuals or groups with whom security and privacy-related activities affecting the system that require planning and coordination is/are assigned].'),\n('004284','draft','2022-03-03','DISA','policy','Establish the rules describing the responsibilities and expected behavior, for security, for individuals requiring access to the system.','PL-04a.','N/A','Determine if: - rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are established for individuals requiring access to the system. - rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are provided to individuals requiring access to the system.'),\n('004285','draft','2022-03-03','DISA','policy','Establish the rules describing the responsibilities and expected behavior, for privacy, for individuals requiring access to the system.','PL-04a.','N/A','Determine if: - rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are established for individuals requiring access to the system. - rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are provided to individuals requiring access to the system.'),\n('004286','draft','2022-03-03','DISA','policy','Provide the rules describing the responsibilities and expected behavior, for information and system usage, for individuals requiring access to the system.','PL-04a.','N/A','Determine if: - rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are established for individuals requiring access to the system. - rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are provided to individuals requiring access to the system.'),\n('004287','draft','2022-03-03','DISA','policy','Provide the rules describing the responsibilities and expected behavior, for security, for individuals requiring access to the system.','PL-04a.','N/A','Determine if: - rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are established for individuals requiring access to the system. - rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are provided to individuals requiring access to the system.'),\n('004288','draft','2022-03-03','DISA','policy','Provide the rules describing the responsibilities and expected behavior, for privacy, for individuals requiring access to the system.','PL-04a.','N/A','Determine if: - rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are established for individuals requiring access to the system. - rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are provided to individuals requiring access to the system.'),\n('004289','draft','2022-03-03','DISA','policy','Defines the frequency individuals are required to read and re-acknowledge the rules of behavior whenever the rules are revised or updated.','PL-04d.','N/A','Determine if individuals who have acknowledged a previous version of the rules of behavior are required to read and reacknowledge [PL-04_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[PL-04_ODP[03]; frequency for individuals to read and re-acknowledge the rules of behavior is defined (if selected)]; when the rules are revised or updated}].'),\n('004290','draft','2022-03-03','DISA','policy','Include in the rules of behavior, restrictions on use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.','PL-04(01)(c)','N/A','Determine if the rules of behavior include restrictions on the use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.'),\n('004291','draft','2022-03-03','DISA','policy','Develop a security Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information privacy.','PL-07a.','N/A','Determine if a CONOPS for the system describing how the organization intends to operate the system from the perspective of information security and privacy is developed.'),\n('004292','draft','2022-03-03','DISA','policy','Develop privacy architectures for the system.',NULL,'N/A',NULL),\n('004293','draft','2022-03-03','DISA','policy','Develop privacy architectures for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information.','PL-08a.01','N/A','Determine if a security architecture for the system describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information.'),\n('004294','draft','2022-03-03','DISA','policy','Develop security architectures for the system that describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals.','PL-08a.02','N/A','Determine if a privacy architecture describes the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals.'),\n('004295','draft','2022-03-03','DISA','policy','Develop privacy architectures for the system that describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals.','PL-08a.02','N/A','Determine if a privacy architecture describes the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals.'),\n('004296','draft','2022-03-03','DISA','policy','Develop privacy architectures for the system that describe how the architectures are integrated into and support the enterprise architecture.','PL-08a.03','N/A','Determine if: - a security architecture for the system describes how the architecture is integrated into and supports the enterprise architecture. - a privacy architecture for the system describes how the architecture is integrated into and supports the enterprise architecture.'),\n('004297','draft','2022-03-03','DISA','policy','Develop privacy architectures for the system that describe any assumptions about, and dependencies on, external systems and services.','PL-08a.04','N/A','Determine if: - a security architecture for the system describes any assumptions about and dependencies on external systems and services. - a privacy architecture for the system describes any assumptions about and dependencies on external systems and services.'),\n('004298','draft','2022-03-03','DISA','policy','Reflect planned privacy architecture changes in the privacy plans.','PL-08c.','N/A','Determine if: - planned architecture changes are reflected in the security plan. - planned architecture changes are reflected in the privacy plan. - planned architecture changes are reflected in the Concept of Operations (CONOPS). - planned architecture changes are reflected in criticality analysis. - planned architecture changes are reflected in organizational procedures. - planned architecture changes are reflected in procurements and acquisitions.'),\n('004299','draft','2022-03-03','DISA','policy','Reflect planned privacy architecture changes in the privacy Concept of Operations (CONOPS).','PL-08c.','N/A','Determine if: - planned architecture changes are reflected in the security plan. - planned architecture changes are reflected in the privacy plan. - planned architecture changes are reflected in the Concept of Operations (CONOPS). - planned architecture changes are reflected in criticality analysis. - planned architecture changes are reflected in organizational procedures. - planned architecture changes are reflected in procurements and acquisitions.'),\n('004300','draft','2022-03-03','DISA','policy','Reflect planned privacy architecture changes in the privacy organizational procurements and acquisitions.','PL-08c.','N/A','Determine if: - planned architecture changes are reflected in the security plan. - planned architecture changes are reflected in the privacy plan. - planned architecture changes are reflected in the Concept of Operations (CONOPS). - planned architecture changes are reflected in criticality analysis. - planned architecture changes are reflected in organizational procedures. - planned architecture changes are reflected in procurements and acquisitions.'),\n('004301','draft','2022-03-03','DISA','policy','Design the privacy architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined locations.','PL-08(01)(a)','N/A','Determine if: - the security architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined]. - the privacy architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined].'),\n('004302','draft','2022-03-03','DISA','policy','Design the privacy architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined architectural layers.','PL-08(01)(a)','N/A','Determine if: - the security architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined]. - the privacy architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined].'),\n('004303','draft','2022-03-03','DISA','policy','Defines the controls to be allocated to organization-defined locations for the privacy architecture.','PL-08(01)(a)','N/A','Determine if: - the security architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined]. - the privacy architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined].'),\n('004304','draft','2022-03-03','DISA','policy','Defines the controls to be allocated to the organization-defined privacy architectural layers.','PL-08(01)(a)','N/A','Determine if: - the security architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined]. - the privacy architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined].'),\n('004305','draft','2022-03-03','DISA','policy','Defines the locations to which the system allocates organization-defined controls in the privacy architecture.','PL-08(01)(a)','N/A','Determine if: - the security architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined]. - the privacy architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined].'),\n('004306','draft','2022-03-03','DISA','policy','Defines the architectural layers to which the system allocates organization-defined controls in the privacy architecture.','PL-08(01)(a)','N/A','Determine if: - the security architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined]. - the privacy architecture for the system is designed using a defense-in-depth approach that allocates [PL-08(01)_ODP[01]; controls to be allocated are defined] to [PL-08(01)_ODP[02]; locations and architectural layers are defined].'),\n('004307','draft','2022-03-03','DISA','policy','Design the privacy architecture for the system using a defense-in-depth approach that ensures that the allocated controls operate in a coordinated and mutually reinforcing manner.','PL-08(01)(b)','N/A','Determine if: - the security architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner. - the privacy architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner.'),\n('004308','draft','2022-03-03','DISA','policy','Defines the controls that are allocated to the organization-defined locations and architectural layers.','PL-08(02)','N/A','Determine if [PL-08(02)_ODP[01]; controls to be allocated are defined] that are allocated to [PL-08(02)_ODP[02]; locations and architectural layers are defined] are required to be obtained from different suppliers.'),\n('004309','draft','2022-03-03','DISA','policy','Defines the locations and architectural layers that are obtained from different suppliers.','PL-08(02)','N/A','Determine if [PL-08(02)_ODP[01]; controls to be allocated are defined] that are allocated to [PL-08(02)_ODP[02]; locations and architectural layers are defined] are required to be obtained from different suppliers.'),\n('004310','draft','2022-03-03','DISA','policy','Select a control baseline for the system.','PL-10','N/A','Determine if a control baseline for the system is selected.'),\n('004311','draft','2022-03-03','DISA','policy','Tailor the selected control baseline by applying specified tailoring actions.','PL-11','N/A','Determine if the selected control baseline is tailored by applying specified tailoring actions.'),\n('004312','draft','2022-03-03','DISA','policy','Review and update the organization-wide information security program plan following organization-defined events.','PM-01b.','N/A','Determine if: - the information security program plan is reviewed and updated [PM-01_ODP[01]; the frequency at which to review and update the organization-wide information security program plan is defined]. - the information security program plan is reviewed and updated following [PM-01_ODP[02]; events that trigger the review and update of the organization-wide information security program plan are defined].'),\n('004313','draft','2022-03-03','DISA','policy','Defines the events for reviewing and updating the organization-wide information security program plan.','PM-01b.','N/A','Determine if: - the information security program plan is reviewed and updated [PM-01_ODP[01]; the frequency at which to review and update the organization-wide information security program plan is defined]. - the information security program plan is reviewed and updated following [PM-01_ODP[02]; events that trigger the review and update of the organization-wide information security program plan are defined].'),\n('004314','draft','2022-03-03','DISA','policy','Include the resources needed to implement the information security programs in capital planning and investment requests.','PM-03a.','N/A','Determine if: - the resources needed to implement the information security program are included in capital planning and investment requests, and all exceptions are documented. - the resources needed to implement the privacy program are included in capital planning and investment requests, and all exceptions are documented.'),\n('004315','draft','2022-03-03','DISA','policy','Include the resources needed to implement the information privacy programs in capital planning and investment requests.',NULL,'N/A',NULL),\n('004316','draft','2022-03-03','DISA','policy','Prepare documentation required for addressing information security programs in capital planning and investment requests in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.','PM-03a.','N/A','Determine if: - the resources needed to implement the information security program are included in capital planning and investment requests, and all exceptions are documented. - the resources needed to implement the privacy program are included in capital planning and investment requests, and all exceptions are documented.'),\n('004317','draft','2022-03-03','DISA','policy','Prepare documentation required for addressing information privacy programs in capital planning and investment requests in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.','PM-03b.','N/A','Determine if: - the documentation required for addressing the information security program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards. - the documentation required for addressing the privacy program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards.'),\n('004318','draft','2022-03-03','DISA','policy','Make available for expenditure, the planned information privacy resources.','PM-03c.','N/A','Determine if: - information security resources are made available for expenditure as planned. - privacy resources are made available for expenditure as planned.'),\n('004319','draft','2022-03-03','DISA','policy','Implement a process to ensure that plans of action and milestones for the privacy program and the associated organizational systems are maintained.','PM-04a.01','N/A','Determine if: - a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained.'),\n('004320','draft','2022-03-03','DISA','policy','Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed.','PM-04a.01','N/A','Determine if: - a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained.'),\n('004321','draft','2022-03-03','DISA','policy','Implement a process to ensure that plans of action and milestones for the supply chain risk management programs and the associated organizational systems are maintained.','PM-04a.01','N/A','Determine if: - a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained.'),\n('004322','draft','2022-03-03','DISA','policy','Implement a process to ensure that plans of action and milestones for the supply chain risk management programs and the associated organizational systems are developed.','PM-04a.01','N/A','Determine if: - a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained.'),\n('004323','draft','2022-03-03','DISA','policy','Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document the remedial information privacy actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.','PM-04a.02','N/A','Determine if: - a process to ensure that plans of action and milestones for the information security program and associated organizational systems document remedial information security risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document remedial privacy risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document remedial supply chain risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation.'),\n('004324','draft','2022-03-03','DISA','policy','Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document the remedial information supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.','PM-04a.02','N/A','Determine if: - a process to ensure that plans of action and milestones for the information security program and associated organizational systems document remedial information security risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation. - a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document remedial privacy risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation. - a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document remedial supply chain risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation.'),\n('004325','draft','2022-03-03','DISA','policy','Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems are reported in accordance with established reporting requirements.','PM-04a.03','N/A','Determine if: - a process to ensure that plans of action and milestones for the information security risk management programs and associated organizational systems are reported in accordance with established reporting requirements. - a process to ensure that plans of action and milestones for the privacy risk management programs and associated organizational systems are reported in accordance with established reporting requirements. - a process to ensure that plans of action and milestones for the supply chain risk management programs and associated organizational systems are reported in accordance with established reporting requirements.'),\n('004326','draft','2022-03-03','DISA','policy','Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are reported in accordance with established reporting requirements.','PM-04a.03','N/A','Determine if: - a process to ensure that plans of action and milestones for the information security risk management programs and associated organizational systems are reported in accordance with established reporting requirements. - a process to ensure that plans of action and milestones for the privacy risk management programs and associated organizational systems are reported in accordance with established reporting requirements. - a process to ensure that plans of action and milestones for the supply chain risk management programs and associated organizational systems are reported in accordance with established reporting requirements.'),\n('004327','draft','2022-03-03','DISA','policy','Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are reported in accordance with established reporting requirements.','PM-04a.03','N/A','Determine if: - a process to ensure that plans of action and milestones for the information security risk management programs and associated organizational systems are reported in accordance with established reporting requirements. - a process to ensure that plans of action and milestones for the privacy risk management programs and associated organizational systems are reported in accordance with established reporting requirements. - a process to ensure that plans of action and milestones for the supply chain risk management programs and associated organizational systems are reported in accordance with established reporting requirements.'),\n('004328','draft','2022-03-03','DISA','policy','Develop an inventory of organizational systems.','PM-05','N/A','Determine if: - an inventory of organizational systems is developed. - the inventory of organizational systems is updated [PM-05_ODP; the frequency at which to update the inventory of organizational systems is defined].'),\n('004329','draft','2022-03-03','DISA','policy','Update, on an organization-defined frequency, an inventory of organizational systems.','PM-05','N/A','Determine if: - an inventory of organizational systems is developed. - the inventory of organizational systems is updated [PM-05_ODP; the frequency at which to update the inventory of organizational systems is defined].'),\n('004330','draft','2022-03-03','DISA','policy','Defines the frequency with which to update the inventory of organizational systems.','PM-05','N/A','Determine if: - an inventory of organizational systems is developed. - the inventory of organizational systems is updated [PM-05_ODP; the frequency at which to update the inventory of organizational systems is defined].'),\n('004331','draft','2022-03-03','DISA','policy','Establish an inventory of all systems, applications, and projects that process personally identifiable information.','PM-05(01)','N/A','Determine if: - an inventory of all systems, applications, and projects that process personally identifiable information is established. - an inventory of all systems, applications, and projects that process personally identifiable information is maintained. - an inventory of all systems, applications, and projects that process personally identifiable information is updated [PM-05(01)_ODP; the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information is defined].'),\n('004332','draft','2022-03-03','DISA','policy','Maintain an inventory of all systems, applications, and projects that process personally identifiable information.','PM-05(01)','N/A','Determine if: - an inventory of all systems, applications, and projects that process personally identifiable information is established. - an inventory of all systems, applications, and projects that process personally identifiable information is maintained. - an inventory of all systems, applications, and projects that process personally identifiable information is updated [PM-05(01)_ODP; the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information is defined].'),\n('004333','draft','2022-03-03','DISA','policy','Update on an organization-defined frequency, an inventory of all systems, applications, and projects that process personally identifiable information.','PM-05(01)','N/A','Determine if: - an inventory of all systems, applications, and projects that process personally identifiable information is established. - an inventory of all systems, applications, and projects that process personally identifiable information is maintained. - an inventory of all systems, applications, and projects that process personally identifiable information is updated [PM-05(01)_ODP; the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information is defined].'),\n('004334','draft','2022-03-03','DISA','policy','Defines the frequency of which an inventory of all systems, applications, and projects that process personally identifiable information will be updated.','PM-05(01)','N/A','Determine if: - an inventory of all systems, applications, and projects that process personally identifiable information is established. - an inventory of all systems, applications, and projects that process personally identifiable information is maintained. - an inventory of all systems, applications, and projects that process personally identifiable information is updated [PM-05(01)_ODP; the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information is defined].'),\n('004335','draft','2022-03-03','DISA','policy','Develop the results of information privacy measures of performance.','PM-06','N/A','Determine if: - information security measures of performance are developed. - information security measures of performance are monitored. - the results of information security measures of performance are reported. - privacy measures of performance are developed. - privacy measures of performance are monitored. - the results of privacy measures of performance are reported.'),\n('004336','draft','2022-03-03','DISA','policy','Monitor the results of information privacy measures of performance.','PM-06','N/A','Determine if: - information security measures of performance are developed. - information security measures of performance are monitored. - the results of information security measures of performance are reported. - privacy measures of performance are developed. - privacy measures of performance are monitored. - the results of privacy measures of performance are reported.'),\n('004337','draft','2022-03-03','DISA','policy','Report on the results of information privacy measures of performance.','PM-06','N/A','Determine if: - information security measures of performance are developed. - information security measures of performance are monitored. - the results of information security measures of performance are reported. - privacy measures of performance are developed. - privacy measures of performance are monitored. - the results of privacy measures of performance are reported.'),\n('004338','draft','2022-03-03','DISA','policy','Develop an enterprise architecture with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.','PM-07','N/A','Determine if: - an enterprise architecture is developed with consideration for information security. - an enterprise architecture is maintained with consideration for information security. - an enterprise architecture is developed with consideration for privacy. - an enterprise architecture is maintained with consideration for privacy. - an enterprise architecture is developed with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation. - an enterprise architecture is maintained with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.'),\n('004339','draft','2022-03-03','DISA','policy','Maintain an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.','PM-07','N/A','Determine if: - an enterprise architecture is developed with consideration for information security. - an enterprise architecture is maintained with consideration for information security. - an enterprise architecture is developed with consideration for privacy. - an enterprise architecture is maintained with consideration for privacy. - an enterprise architecture is developed with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation. - an enterprise architecture is maintained with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.'),\n('004340','draft','2022-03-03','DISA','policy','Maintain an enterprise architecture with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.','PM-07','N/A','Determine if: - an enterprise architecture is developed with consideration for information security. - an enterprise architecture is maintained with consideration for information security. - an enterprise architecture is developed with consideration for privacy. - an enterprise architecture is maintained with consideration for privacy. - an enterprise architecture is developed with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation. - an enterprise architecture is maintained with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.'),\n('004341','draft','2022-03-03','DISA','policy','Offload organization-defined non-essential functions or services to other systems, system components, or an external provider.','PM-07(01)','N/A','Determine if [PM-07(01)_ODP; non-essential functions or services to be offloaded are defined] are offloaded to other systems, system components, or an external provider.'),\n('004342','draft','2022-03-03','DISA','policy','Defines the non-essential functions or services to be offloaded to other systems, system components, or an external provider.','PM-07(01)','N/A','Determine if [PM-07(01)_ODP; non-essential functions or services to be offloaded are defined] are offloaded to other systems, system components, or an external provider.'),\n('004343','draft','2022-03-03','DISA','policy','Address information privacy issues in the development and documentation of a critical infrastructure and key resources protection plan.','PM-08','N/A','Determine if: - information security issues are addressed in the development of a critical infrastructure and key resources protection plan. - information security issues are addressed in the documentation of a critical infrastructure and key resources protection plan. - information security issues are addressed in the update of a critical infrastructure and key resources protection plan. - privacy issues are addressed in the development of a critical infrastructure and key resources protection plan. - privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan. - privacy issues are addressed in the update of a critical infrastructure and key resources protection plan.'),\n('004344','draft','2022-03-03','DISA','policy','Address information privacy issues in the updating of a critical infrastructure and key resources protection plan.','PM-08','N/A','Determine if: - information security issues are addressed in the development of a critical infrastructure and key resources protection plan. - information security issues are addressed in the documentation of a critical infrastructure and key resources protection plan. - information security issues are addressed in the update of a critical infrastructure and key resources protection plan. - privacy issues are addressed in the development of a critical infrastructure and key resources protection plan. - privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan. - privacy issues are addressed in the update of a critical infrastructure and key resources protection plan.'),\n('004345','draft','2022-03-03','DISA','policy','Develop a comprehensive strategy to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information.','PM-09a.02','N/A','Determine if a comprehensive strategy is developed to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information.'),\n('004346','draft','2022-03-03','DISA','policy','Manage the security state of organizational systems and the environments in which those systems operate through authorization processes.','PM-10a.','N/A','Determine if: - the security state of organizational systems and the environments in which those systems operate are managed through authorization processes. - the privacy state of organizational systems and the environments in which those systems operate are managed through authorization processes.'),\n('004347','draft','2022-03-03','DISA','policy','Manage the privacy state of organizational systems and the environments in which those systems operate through authorization processes.','PM-10a.','N/A','Determine if: - the security state of organizational systems and the environments in which those systems operate are managed through authorization processes. - the privacy state of organizational systems and the environments in which those systems operate are managed through authorization processes.'),\n('004348','draft','2022-03-03','DISA','policy','Define organizational mission and business processes with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.','PM-11a.','N/A','Determine if: - organizational mission and business processes are defined with consideration for information security. - organizational mission and business processes are defined with consideration for privacy. - organizational mission and business processes are defined with consideration for the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.'),\n('004349','draft','2022-03-03','DISA','policy','Determine personally identifiable information processing needs arising from the defined mission and business processes.','PM-11b.','N/A','Determine if: - information protection needs arising from the defined mission and business processes are determined. - personally identifiable information processing needs arising from the defined mission and business processes are determined.'),\n('004350','draft','2022-03-03','DISA','policy','Review and revise the mission and business processes on an organization-defined frequency.','PM-11c.','N/A','Determine if the mission and business processes are reviewed and revised [PM-11_ODP; the frequency at which to review and revise the mission and business processes is defined].'),\n('004351','draft','2022-03-03','DISA','policy','Defines the frequency at which the mission and business processes are reviewed and revised.','PM-11c.','N/A','Determine if the mission and business processes are reviewed and revised [PM-11_ODP; the frequency at which to review and revise the mission and business processes is defined].'),\n('004352','draft','2022-03-03','DISA','policy','Establish a privacy workforce development and improvement program.','PM-13','N/A','Determine if: - a security workforce development and improvement program is established. - privacy workforce development and improvement program is established.'),\n('004353','draft','2022-03-03','DISA','policy','Implement a process for ensuring that organizational plans for conducting privacy testing activities associated with organizational systems are developed.','PM-14a.01','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained.'),\n('004354','draft','2022-03-03','DISA','policy','Implement a process for ensuring that organizational plans for conducting privacy testing activities associated with organizational systems are maintained.','PM-14a.01','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained.'),\n('004355','draft','2022-03-03','DISA','policy','Implement a process for ensuring that organizational plans for conducting privacy training activities associated with organizational systems are developed.','PM-14a.01','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained.'),\n('004356','draft','2022-03-03','DISA','policy','Implement a process for ensuring that organizational plans for conducting privacy training activities associated with organizational systems are maintained.','PM-14a.01','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained.'),\n('004357','draft','2022-03-03','DISA','policy','Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational systems are developed.','PM-14a.01','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained.'),\n('004358','draft','2022-03-03','DISA','policy','Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational information systems are maintained.','PM-14a.01','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained.'),\n('004359','draft','2022-03-03','DISA','policy','Implement a process for ensuring that organizational plans for conducting privacy testing associated with organizational systems continue to be executed.','PM-14a.02','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems continue to be executed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems continue to be executed.'),\n('004360','draft','2022-03-03','DISA','policy','Implement a process for ensuring that organizational plans for conducting privacy training associated with organizational systems continue to be executed.','PM-14a.02','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems continue to be executed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems continue to be executed.'),\n('004361','draft','2022-03-03','DISA','policy','Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational systems continue to be executed.','PM-14a.02','N/A','Determine if: - a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems continue to be executed. - a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems continue to be executed.'),\n('004362','draft','2022-03-03','DISA','policy','Establish and institutionalize contact with selected groups and associations within the privacy community to facilitate ongoing privacy education and training for organizational personnel.','PM-15a.','N/A','Determine if: - contact is established and institutionalized with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel. - contact is established and institutionalized with selected groups and associations within the privacy community to facilitate ongoing privacy education and training for organizational personnel.'),\n('004363','draft','2022-03-03','DISA','policy','Establish and institutionalize contact with selected groups and associations within the privacy community to maintain currency with recommended privacy practices, techniques, and technologies.','PM-15b.','N/A','Determine if: - contact is established and institutionalized with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies. - contact is established and institutionalized with selected groups and associations within the privacy community to maintain currency with recommended privacy practices, techniques, and technologies.'),\n('004364','draft','2022-03-03','DISA','policy','Establish and institutionalize contact with selected groups and associations within the privacy community to share current privacy information including threats, vulnerabilities, and incidents.','PM-15c.','N/A','Determine if: - contact is established and institutionalized with selected groups and associations within the security community to share current security information, including threats, vulnerabilities, and incidents. - contact is established and institutionalized with selected groups and associations within the privacy community to share current privacy information, including threats, vulnerabilities, and incidents.'),\n('004365','draft','2022-03-03','DISA','policy','Employ automated means to maximize the effectiveness of sharing threat intelligence information.','PM-16(01)','N/A','Determine if automated mechanisms are employed to maximize the effectiveness of sharing threat intelligence information.'),\n('004366','draft','2022-03-03','DISA','policy','Establish policy to ensure that the requirements for the protection of Controlled Unclassified Information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.','PM-17a.','N/A','Determine if: - policy is established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards. - procedures are established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards.'),\n('004367','draft','2022-03-03','DISA','policy','Establish procedures to ensure that the requirements for the protection of Controlled Unclassified Information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.','PM-17a.','N/A','Determine if: - policy is established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards. - procedures are established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards.'),\n('004368','draft','2022-03-03','DISA','policy','Review and update the policy for Controlled Unclassified Information on an organization-defined frequency.','PM-17b.','N/A','Determine if: - policy is reviewed and updated [PM-17_ODP[01]; the frequency at which to review and update the policy is defined]. - procedures are reviewed and updated [PM-17_ODP[02]; the frequency at which to review and update the procedures is defined].'),\n('004369','draft','2022-03-03','DISA','policy','Defines the frequency in which the policy for Controlled Unclassified information is reviewed and updated.','PM-17b.','N/A','Determine if: - policy is reviewed and updated [PM-17_ODP[01]; the frequency at which to review and update the policy is defined]. - procedures are reviewed and updated [PM-17_ODP[02]; the frequency at which to review and update the procedures is defined].'),\n('004370','draft','2022-03-03','DISA','policy','Review and update the procedures for Controlled Unclassified Information on an organization-defined frequency.','PM-17b.','N/A','Determine if: - policy is reviewed and updated [PM-17_ODP[01]; the frequency at which to review and update the policy is defined]. - procedures are reviewed and updated [PM-17_ODP[02]; the frequency at which to review and update the procedures is defined].'),\n('004371','draft','2022-03-03','DISA','policy','Defines the frequency in which the procedures for Controlled Unclassified information is reviewed and updated.','PM-17b.','N/A','Determine if: - policy is reviewed and updated [PM-17_ODP[01]; the frequency at which to review and update the policy is defined]. - procedures are reviewed and updated [PM-17_ODP[02]; the frequency at which to review and update the procedures is defined].'),\n('004372','draft','2022-03-03','DISA','policy','Develop an organization-wide privacy program plan that provides an overview of the agency''s privacy program.','PM-18a.','N/A','Determine if: - an organization-wide privacy program plan that provides an overview of the agency''s privacy program is developed. - the privacy program plan is disseminated.'),\n('004373','draft','2022-03-03','DISA','policy','Disseminate an organization-wide privacy program plan that provides an overview of the agency''s privacy program.','PM-18a.','N/A','Determine if: - an organization-wide privacy program plan that provides an overview of the agency''s privacy program is developed. - the privacy program plan is disseminated.'),\n('004374','draft','2022-03-03','DISA','policy','Develop an organization-wide privacy program plan that provides an overview of the agency''s privacy program and includes a description of the structure of the privacy program and the resources dictated to the privacy program.','PM-18a.01','N/A','Determine if: - the privacy program plan includes a description of the structure of the privacy program. - the privacy program plan includes a description of the resources dedicated to the privacy program.'),\n('004375','draft','2022-03-03','DISA','policy','Disseminate an organization-wide privacy program plan that provides an overview of the agency''s privacy program and includes a description of the structure of the privacy program and the resources dictated to the privacy program.','PM-18a.01','N/A','Determine if: - the privacy program plan includes a description of the structure of the privacy program. - the privacy program plan includes a description of the resources dedicated to the privacy program.'),\n('004376','draft','2022-03-03','DISA','policy','Develop an organization-wide privacy program plan that provides an overview of the agency''s privacy program and provides an overview of the requirements for the privacy program.','PM-18a.02','N/A','Determine if: - the privacy program plan provides an overview of the requirements for the privacy program. - the privacy program plan provides a description of the privacy program management controls in place or planned for meeting the requirements of the privacy program. - the privacy program plan provides a description of common controls in place or planned for meeting the requirements of the privacy program.'),\n('004377','draft','2022-03-03','DISA','policy','Disseminate an organization-wide privacy program plan that provides an overview of the agency''s privacy program and provides an overview of the requirements for the privacy program.','PM-18a.02','N/A','Determine if: - the privacy program plan provides an overview of the requirements for the privacy program. - the privacy program plan provides a description of the privacy program management controls in place or planned for meeting the requirements of the privacy program. - the privacy program plan provides a description of common controls in place or planned for meeting the requirements of the privacy program.'),\n('004378','draft','2022-03-03','DISA','policy','Develop an organization-wide privacy program plan that provides an overview of the agency''s privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements.','PM-18a.02','N/A','Determine if: - the privacy program plan provides an overview of the requirements for the privacy program. - the privacy program plan provides a description of the privacy program management controls in place or planned for meeting the requirements of the privacy program. - the privacy program plan provides a description of common controls in place or planned for meeting the requirements of the privacy program.'),\n('004379','draft','2022-03-03','DISA','policy','Disseminate an organization-wide privacy program plan that provides an overview of the agency''s privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements.','PM-18a.02','N/A','Determine if: - the privacy program plan provides an overview of the requirements for the privacy program. - the privacy program plan provides a description of the privacy program management controls in place or planned for meeting the requirements of the privacy program. - the privacy program plan provides a description of common controls in place or planned for meeting the requirements of the privacy program.'),\n('004380','draft','2022-03-03','DISA','policy','Develop an organization-wide privacy program plan that provides an overview of the agency''s privacy program and includes the role of the Senior Agency Official for Privacy and the identification and assignment of the roles of other privacy officials and staff and their responsibilities.','PM-18a.03','N/A','Determine if: - the privacy program plan includes the role of the senior agency official for privacy. - the privacy program plan includes the identification and assignment of the roles of other privacy officials and staff and their responsibilities.'),\n('004381','draft','2022-03-03','DISA','policy','Disseminate an organization-wide privacy program plan that provides an overview of the agency''s privacy program and includes the role of the Senior Agency Official for Privacy and the identification and assignment of the roles of other privacy officials and staff and their responsibilities.','PM-18a.03','N/A','Determine if: - the privacy program plan includes the role of the senior agency official for privacy. - the privacy program plan includes the identification and assignment of the roles of other privacy officials and staff and their responsibilities.'),\n('004382','draft','2022-03-03','DISA','policy','Develop an organization-wide privacy program plan that provides an overview of the agency''s privacy program and describes management commitment, compliance, and the strategic goals and objectives of the privacy program.','PM-18a.04','N/A','Determine if: - the privacy program plan describes management commitment. - the privacy program plan describes compliance. - the privacy program plan describes the strategic goals and objectives of the privacy program.'),\n('004383','draft','2022-03-03','DISA','policy','Disseminate an organization-wide privacy program plan that provides an overview of the agency''s privacy program and describes management commitment, compliance, and the strategic goals and objectives of the privacy program.','PM-18a.04','N/A','Determine if: - the privacy program plan describes management commitment. - the privacy program plan describes compliance. - the privacy program plan describes the strategic goals and objectives of the privacy program.'),\n('004384','draft','2022-03-03','DISA','policy','Develop an organization-wide privacy program plan that provides an overview of the agency''s privacy program and reflects coordination among organizational entities responsible for the different aspects of privacy.','PM-18a.05','N/A','Determine if the privacy program plan reflects coordination among organizational entities responsible for the different aspects of privacy.'),\n('004385','draft','2022-03-03','DISA','policy','Disseminate an organization-wide privacy program plan that provides an overview of the agency''s privacy program and reflects coordination among organizational entities responsible for the different aspects of privacy.','PM-18a.05','N/A','Determine if the privacy program plan reflects coordination among organizational entities responsible for the different aspects of privacy.'),\n('004386','draft','2022-03-03','DISA','policy','Develop an organization-wide privacy program plan that provides an overview of the agency''s privacy program and is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.','PM-18a.06','N/A','Determine if the privacy program plan is approved by a senior official with responsibility and accountability for the privacy risk being incurred by organizational operations (including, mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.'),\n('004387','draft','2022-03-03','DISA','policy','Disseminate an organization-wide privacy program plan that provides an overview of the agency''s privacy program and is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.','PM-18a.06','N/A','Determine if the privacy program plan is approved by a senior official with responsibility and accountability for the privacy risk being incurred by organizational operations (including, mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.'),\n('004388','draft','2022-03-03','DISA','policy','Update the plan on an organization-defined frequency.','PM-18a.06','N/A','Determine if the privacy program plan is approved by a senior official with responsibility and accountability for the privacy risk being incurred by organizational operations (including, mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.'),\n('004389','draft','2022-03-03','DISA','policy','Update the plan to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.','PM-18b.','N/A','Determine if: - the privacy program plan is updated [PM-18_ODP; the frequency of updates to the privacy program plan is defined]. - the privacy program plan is updated to address changes in federal privacy laws and policies. - the privacy program plan is updated to address organizational changes. - the privacy program plan is updated to address problems identified during plan implementation or privacy control assessments.'),\n('004390','draft','2022-03-03','DISA','policy','Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to coordinate applicable privacy requirements.','PM-19','N/A','Determine if: - a senior agency official for privacy with authority, mission, accountability, and resources is appointed. - the senior agency official for privacy coordinates applicable privacy requirements. - the senior agency official for privacy develops applicable privacy requirements. - the senior agency official for privacy implements applicable privacy requirements. - the senior agency official for privacy manages privacy risks through the organization-wide privacy program.'),\n('004391','draft','2022-03-03','DISA','policy','Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to develop applicable privacy requirements.','PM-19','N/A','Determine if: - a senior agency official for privacy with authority, mission, accountability, and resources is appointed. - the senior agency official for privacy coordinates applicable privacy requirements. - the senior agency official for privacy develops applicable privacy requirements. - the senior agency official for privacy implements applicable privacy requirements. - the senior agency official for privacy manages privacy risks through the organization-wide privacy program.'),\n('004392','draft','2022-03-03','DISA','policy','Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to implement applicable privacy requirements.','PM-19','N/A','Determine if: - a senior agency official for privacy with authority, mission, accountability, and resources is appointed. - the senior agency official for privacy coordinates applicable privacy requirements. - the senior agency official for privacy develops applicable privacy requirements. - the senior agency official for privacy implements applicable privacy requirements. - the senior agency official for privacy manages privacy risks through the organization-wide privacy program.'),\n('004393','draft','2022-03-03','DISA','policy','Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to manage privacy risks through the organization-wide privacy program.','PM-19','N/A','Determine if: - a senior agency official for privacy with authority, mission, accountability, and resources is appointed. - the senior agency official for privacy coordinates applicable privacy requirements. - the senior agency official for privacy develops applicable privacy requirements. - the senior agency official for privacy implements applicable privacy requirements. - the senior agency official for privacy manages privacy risks through the organization-wide privacy program.'),\n('004394','draft','2022-03-03','DISA','policy','Maintain a central resource webpage on the organization''s principle public website that serves as a central source of information about the organization''s privacy plan.','PM-20','N/A','Determine if: - a central resource webpage is maintained on the organization''s principal public website. - the webpage serves as a central source of information about the organization''s privacy program.'),\n('004395','draft','2022-03-03','DISA','policy','Ensure that the public has access to information about organizational privacy activities.','PM-20a.','N/A','Determine if: - the webpage ensures that the public has access to information about organizational privacy activities. - the webpage ensures that the public can communicate with its senior agency official for privacy.'),\n('004396','draft','2022-03-03','DISA','policy','Ensure that the public can communicate with its Senior Agency Official for Privacy.','PM-20a.','N/A','Determine if: - the webpage ensures that the public has access to information about organizational privacy activities. - the webpage ensures that the public can communicate with its senior agency official for privacy.'),\n('004397','draft','2022-03-03','DISA','policy','Ensure that organizational privacy practices and reports are publicly available.','PM-20b.','N/A','Determine if: - the webpage ensures that organizational privacy practices are publicly available. - the webpage ensures that organizational privacy reports are publicly available.'),\n('004398','draft','2022-03-03','DISA','policy','Employ publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.','PM-20c.','N/A','Determine if the webpage employs publicly facing email addresses and/or phone numbers to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.'),\n('004399','draft','2022-03-03','DISA','policy','Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are written in plain language.','PM-20(01)(a)','N/A','Determine if: - the privacy policies are written in plain language. - the privacy policies are organized in a way that is easy to understand and navigate.'),\n('004400','draft','2022-03-03','DISA','policy','Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are organized in a way that is easy to understand and navigate.','PM-20(01)(a)','N/A','Determine if: - the privacy policies are written in plain language. - the privacy policies are organized in a way that is easy to understand and navigate.'),\n('004401','draft','2022-03-03','DISA','policy','Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that provide information needed by the public to make an informed about whether and how to interact with the organization.','PM-20(01)(b)','N/A','Determine if: - the privacy policies provide the information needed by the public to make an informed decision about whether to interact with the organization. - the privacy policies provide the information needed by the public to make an informed decision about how to interact with the organization.'),\n('004402','draft','2022-03-03','DISA','policy','Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are updated whenever the organization makes a substantive change to the practices it describes.','PM-20(01)(c)','N/A','Determine if: - the privacy policies are updated whenever the organization makes a substantive change to the practices it describes. - the privacy policies include a time/date stamp to inform the public of the date of the most recent changes.'),\n('004403','draft','2022-03-03','DISA','policy','Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that includes a time/date stamp to inform the public of the date of the most recent changes.','PM-20(01)(c)','N/A','Determine if: - the privacy policies are updated whenever the organization makes a substantive change to the practices it describes. - the privacy policies include a time/date stamp to inform the public of the date of the most recent changes.'),\n('004404','draft','2022-03-03','DISA','policy','Develop an accurate accounting of disclosures of personally identifiable information.','PM-21a.','N/A','Determine if an accurate accounting of disclosures of personally identifiable information is developed and maintained.'),\n('004405','draft','2022-03-03','DISA','policy','Maintain an accurate accounting of disclosures of personally identifiable information.','PM-21a.','N/A','Determine if an accurate accounting of disclosures of personally identifiable information is developed and maintained.'),\n('004406','draft','2022-03-03','DISA','policy','Develop an accurate accounting of disclosures of personally identifiable information, including date, nature, and purpose of each disclosure of a record.','PM-21a.01','N/A','Determine if: - the accounting includes the date of each disclosure. - the accounting includes the nature of each disclosure. - the accounting includes the purpose of each disclosure.'),\n('004407','draft','2022-03-03','DISA','policy','Maintain an accurate accounting of disclosures of personally identifiable information, including date, nature, and purpose of each disclosure of a record.','PM-21a.01','N/A','Determine if: - the accounting includes the date of each disclosure. - the accounting includes the nature of each disclosure. - the accounting includes the purpose of each disclosure.'),\n('004408','draft','2022-03-03','DISA','policy','Develop an accurate accounting of disclosures of personally identifiable information, including name and address, or other contact information of the individual or organization to which the disclosure was made.','PM-21a.02','N/A','Determine if: - the accounting includes the name of the individual or organization to whom the disclosure was made. - the accounting includes the address or other contact information of the individual or organization to whom the disclosure was made.'),\n('004409','draft','2022-03-03','DISA','policy','Maintain an accurate accounting of disclosures of personally identifiable information, including name and address, or other contact information of the individual or organization to which the disclosure was made.','PM-21a.02','N/A','Determine if: - the accounting includes the name of the individual or organization to whom the disclosure was made. - the accounting includes the address or other contact information of the individual or organization to whom the disclosure was made.'),\n('004410','draft','2022-03-03','DISA','policy','Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer.','PM-21b.','N/A','Determine if the accounting of disclosures is retained for the length of time that the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer.'),\n('004411','draft','2022-03-03','DISA','policy','Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request.','PM-21c.','N/A','Determine if the accounting of disclosures is made available to the individual to whom the personally identifiable information relates upon request.'),\n('004412','draft','2022-03-03','DISA','policy','Develop and document organization-wide policies for reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle.','PM-22a.','N/A','Determine if: - the policies address reviewing the accuracy of personally identifiable information across the information life cycle. - the policies address reviewing the relevance of personally identifiable information across the information life cycle. - the policies address reviewing the timeliness of personally identifiable information across the information life cycle. - the policies address reviewing the completeness of personally identifiable information across the information life cycle. - the procedures address reviewing the accuracy of personally identifiable information across the information life cycle. - the procedures address reviewing the relevance of personally identifiable information across the information life cycle. - the procedures address reviewing the timeliness of personally identifiable information across the information life cycle. - the procedures address reviewing the completeness of personally identifiable information across the information life cycle.'),\n('004413','draft','2022-03-03','DISA','policy','Develop and document organization-wide procedures for reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle.','PM-22a.','N/A','Determine if: - the policies address reviewing the accuracy of personally identifiable information across the information life cycle. - the policies address reviewing the relevance of personally identifiable information across the information life cycle. - the policies address reviewing the timeliness of personally identifiable information across the information life cycle. - the policies address reviewing the completeness of personally identifiable information across the information life cycle. - the procedures address reviewing the accuracy of personally identifiable information across the information life cycle. - the procedures address reviewing the relevance of personally identifiable information across the information life cycle. - the procedures address reviewing the timeliness of personally identifiable information across the information life cycle. - the procedures address reviewing the completeness of personally identifiable information across the information life cycle.'),\n('004414','draft','2022-03-03','DISA','policy','Develop and document organization-wide policies for correcting or deleting inaccurate or outdated personally identifiable information.','PM-22b.','N/A','Determine if: - the policies address correcting or deleting inaccurate or outdated personally identifiable information. - the procedures address correcting or deleting inaccurate or outdated personally identifiable information.'),\n('004415','draft','2022-03-03','DISA','policy','Develop and document organization-wide procedures for correcting or deleting inaccurate or outdated personally identifiable information.','PM-22b.','N/A','Determine if: - the policies address correcting or deleting inaccurate or outdated personally identifiable information. - the procedures address correcting or deleting inaccurate or outdated personally identifiable information.'),\n('004416','draft','2022-03-03','DISA','policy','Develop and document organization-wide policies for disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities.','PM-22c.','N/A','Determine if: - the policies address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities. - the procedures address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities.'),\n('004417','draft','2022-03-03','DISA','policy','Develop and document organization-wide procedures for disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities.','PM-22c.','N/A','Determine if: - the policies address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities. - the procedures address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities.'),\n('004418','draft','2022-03-03','DISA','policy','Develop and document organization-wide policies for appeals of adverse decisions on correction or deletion requests.','PM-22d.','N/A','Determine if: - the policies address appeals of adverse decisions on correction or deletion requests. - the procedures address appeals of adverse decisions on correction or deletion requests.'),\n('004419','draft','2022-03-03','DISA','policy','Develop and document organization-wide procedures for appeals of adverse decisions on correction or deletion requests.','PM-22d.','N/A','Determine if: - the policies address appeals of adverse decisions on correction or deletion requests. - the procedures address appeals of adverse decisions on correction or deletion requests.'),\n('004420','draft','2022-03-03','DISA','policy','Establish a Data Governance Body consisting of organization-defined roles with organization-defined responsibilities.','PM-23','N/A','Determine if a Data Governance Body consisting of [PM-23_ODP[01]; the roles of a Data Governance Body are defined] with [PM-23_ODP[02]; the responsibilities of a Data Governance Body are defined] is established.'),\n('004421','draft','2022-03-03','DISA','policy','Defines the roles that are established by the Data Governance Body.','PM-23','N/A','Determine if a Data Governance Body consisting of [PM-23_ODP[01]; the roles of a Data Governance Body are defined] with [PM-23_ODP[02]; the responsibilities of a Data Governance Body are defined] is established.'),\n('004422','draft','2022-03-03','DISA','policy','Defines the responsibilities the Data Governance Body establishes.','PM-23','N/A','Determine if a Data Governance Body consisting of [PM-23_ODP[01]; the roles of a Data Governance Body are defined] with [PM-23_ODP[02]; the responsibilities of a Data Governance Body are defined] is established.'),\n('004423','draft','2022-03-03','DISA','policy','Establish a Data Integrity Board to review proposals to conduct or participate in a matching program.','PM-24a.','N/A','Determine if the Data Integrity Board reviews proposals to conduct or participate in a matching program.'),\n('004424','draft','2022-03-03','DISA','policy','Establish a Data Integrity Board to conduct an annual review of all matching programs in which the agency has participated.','PM-24b.','N/A','Determine if the Data Integrity Board conducts an annual review of all matching programs in which the agency has participated.'),\n('004425','draft','2022-03-03','DISA','policy','Develop and document policies that address the use of personally identifiable information for internal testing, training, and research.','PM-25a.','N/A','Determine if: - policies that address the use of personally identifiable information for internal testing are developed and documented. - policies that address the use of personally identifiable information for internal training are developed and documented. - policies that address the use of personally identifiable information for internal research are developed and documented. - procedures that address the use of personally identifiable information for internal testing are developed and documented. - procedures that address the use of personally identifiable information for internal training are developed and documented. - procedures that address the use of personally identifiable information for internal research are developed and documented. - policies that address the use of personally identifiable information for internal testing are implemented. - policies that address the use of personally identifiable information for training are implemented. - policies that address the use of personally identifiable information for research are implemented. - procedures that address the use of personally identifiable information for internal testing are implemented. - procedures that address the use of personally identifiable information for training are implemented. - procedures that address the use of personally identifiable information for research are implemented.'),\n('004426','draft','2022-03-03','DISA','policy','Develop and document procedures that address the use of personally identifiable information for internal testing, training, and research.','PM-25a.','N/A','Determine if: - policies that address the use of personally identifiable information for internal testing are developed and documented. - policies that address the use of personally identifiable information for internal training are developed and documented. - policies that address the use of personally identifiable information for internal research are developed and documented. - procedures that address the use of personally identifiable information for internal testing are developed and documented. - procedures that address the use of personally identifiable information for internal training are developed and documented. - procedures that address the use of personally identifiable information for internal research are developed and documented. - policies that address the use of personally identifiable information for internal testing are implemented. - policies that address the use of personally identifiable information for training are implemented. - policies that address the use of personally identifiable information for research are implemented. - procedures that address the use of personally identifiable information for internal testing are implemented. - procedures that address the use of personally identifiable information for training are implemented. - procedures that address the use of personally identifiable information for research are implemented.'),\n('004427','draft','2022-03-03','DISA','policy','Implement policies that address the use of personally identifiable information for internal testing, training, and research.','PM-25a.','N/A','Determine if: - policies that address the use of personally identifiable information for internal testing are developed and documented. - policies that address the use of personally identifiable information for internal training are developed and documented. - policies that address the use of personally identifiable information for internal research are developed and documented. - procedures that address the use of personally identifiable information for internal testing are developed and documented. - procedures that address the use of personally identifiable information for internal training are developed and documented. - procedures that address the use of personally identifiable information for internal research are developed and documented. - policies that address the use of personally identifiable information for internal testing are implemented. - policies that address the use of personally identifiable information for training are implemented. - policies that address the use of personally identifiable information for research are implemented. - procedures that address the use of personally identifiable information for internal testing are implemented. - procedures that address the use of personally identifiable information for training are implemented. - procedures that address the use of personally identifiable information for research are implemented.'),\n('004428','draft','2022-03-03','DISA','policy','Implement procedures that address the use of personally identifiable information for internal testing, training, and research.','PM-25a.','N/A','Determine if: - policies that address the use of personally identifiable information for internal testing are developed and documented. - policies that address the use of personally identifiable information for internal training are developed and documented. - policies that address the use of personally identifiable information for internal research are developed and documented. - procedures that address the use of personally identifiable information for internal testing are developed and documented. - procedures that address the use of personally identifiable information for internal training are developed and documented. - procedures that address the use of personally identifiable information for internal research are developed and documented. - policies that address the use of personally identifiable information for internal testing are implemented. - policies that address the use of personally identifiable information for training are implemented. - policies that address the use of personally identifiable information for research are implemented. - procedures that address the use of personally identifiable information for internal testing are implemented. - procedures that address the use of personally identifiable information for training are implemented. - procedures that address the use of personally identifiable information for research are implemented.'),\n('004429','draft','2022-03-03','DISA','policy','Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes.','PM-25b.','N/A','Determine if: - the amount of personally identifiable information used for internal testing purposes is limited or minimized. - the amount of personally identifiable information used for internal training purposes is limited or minimized. - the amount of personally identifiable information used for internal research purposes is limited or minimized.'),\n('004430','draft','2022-03-03','DISA','policy','Authorize the use of personally identifiable information when such information is required for internal testing, training, and research.','PM-25c.','N/A','Determine if: - the required use of personally identifiable information for internal testing is authorized. - the required use of personally identifiable information for internal training is authorized. - the required use of personally identifiable information for internal research is authorized.'),\n('004431','draft','2022-03-03','DISA','policy','Review and update policies on an organization-defined frequency.','PM-25d.','N/A','Determine if: - policies are reviewed [PM-25_ODP[01]; the frequency for reviewing policies that address the use of personally identifiable information for internal testing, training, and research is defined]. - policies are updated [PM-25_ODP[02]; the frequency for updating policies that address the use of personally identifiable information for internal testing, training, and research is defined]. - procedures are reviewed [PM-25_ODP[03]; the frequency for reviewing procedures that address the use of personally identifiable information for internal testing, training, and research is defined]. - procedures are updated [PM-25_ODP[04]; the frequency for updating procedures that address the use of personally identifiable information for internal testing, training, and research is defined].'),\n('004432','draft','2022-03-03','DISA','policy','Defines the frequency of which the policies should be reviewed and updated.','PM-25d.','N/A','Determine if: - policies are reviewed [PM-25_ODP[01]; the frequency for reviewing policies that address the use of personally identifiable information for internal testing, training, and research is defined]. - policies are updated [PM-25_ODP[02]; the frequency for updating policies that address the use of personally identifiable information for internal testing, training, and research is defined]. - procedures are reviewed [PM-25_ODP[03]; the frequency for reviewing procedures that address the use of personally identifiable information for internal testing, training, and research is defined]. - procedures are updated [PM-25_ODP[04]; the frequency for updating procedures that address the use of personally identifiable information for internal testing, training, and research is defined].'),\n('004433','draft','2022-03-04','DISA','policy','Review and update procedures on an organization-defined frequency.','PM-25d.','N/A','Determine if: - policies are reviewed [PM-25_ODP[01]; the frequency for reviewing policies that address the use of personally identifiable information for internal testing, training, and research is defined]. - policies are updated [PM-25_ODP[02]; the frequency for updating policies that address the use of personally identifiable information for internal testing, training, and research is defined]. - procedures are reviewed [PM-25_ODP[03]; the frequency for reviewing procedures that address the use of personally identifiable information for internal testing, training, and research is defined]. - procedures are updated [PM-25_ODP[04]; the frequency for updating procedures that address the use of personally identifiable information for internal testing, training, and research is defined].'),\n('004434','draft','2022-03-04','DISA','policy','Defines the frequency of which the procedures should be reviewed and updated.','PM-25d.','N/A','Determine if: - policies are reviewed [PM-25_ODP[01]; the frequency for reviewing policies that address the use of personally identifiable information for internal testing, training, and research is defined]. - policies are updated [PM-25_ODP[02]; the frequency for updating policies that address the use of personally identifiable information for internal testing, training, and research is defined]. - procedures are reviewed [PM-25_ODP[03]; the frequency for reviewing procedures that address the use of personally identifiable information for internal testing, training, and research is defined]. - procedures are updated [PM-25_ODP[04]; the frequency for updating procedures that address the use of personally identifiable information for internal testing, training, and research is defined].'),\n('004435','draft','2022-03-04','DISA','policy','Implement a process for receiving and responding to complaints, concerns or questions from individuals about the organizational security practices.','PM-26','N/A','Determine if: - a process for receiving complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented. - a process for responding to complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented.'),\n('004436','draft','2022-03-04','DISA','policy','Implement a process for receiving and responding to complaints, concerns or questions from individuals about the organizational privacy practices.','PM-26','N/A','Determine if: - a process for receiving complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented. - a process for responding to complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented.'),\n('004437','draft','2022-03-04','DISA','policy','Implement mechanisms that are easy to use.','PM-26a.','N/A','Determine if: - the complaint management process includes mechanisms that are easy to use by the public. - the complaint management process includes mechanisms that are readily accessible by the public.'),\n('004438','draft','2022-03-04','DISA','policy','Implement mechanisms that are readily available by the public.','PM-26a.','N/A','Determine if: - the complaint management process includes mechanisms that are easy to use by the public. - the complaint management process includes mechanisms that are readily accessible by the public.'),\n('004439','draft','2022-03-04','DISA','policy','Implement all information necessary for successfully filing complaints.','PM-26b.','N/A','Determine if the complaint management process includes all information necessary for successfully filing complaints.'),\n('004440','draft','2022-03-04','DISA','policy','Implement tracking mechanisms to ensure all complaints received are reviewed and appropriately addressed within an organization-defined time period.','PM-26c.','N/A','Determine if: - the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within [PM-26_ODP[01]; the time period in which complaints (including concerns or questions) from individuals are to be reviewed is defined]. - the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within [PM-26_ODP[02]; the time period in which complaints (including concerns or questions) from individuals are to be addressed is defined].'),\n('004441','draft','2022-03-04','DISA','policy','Defines the time period of which the tracking mechanisms to ensure all complaints received are reviewed and addressed.','PM-26c.','N/A','Determine if: - the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within [PM-26_ODP[01]; the time period in which complaints (including concerns or questions) from individuals are to be reviewed is defined]. - the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within [PM-26_ODP[02]; the time period in which complaints (including concerns or questions) from individuals are to be addressed is defined].'),\n('004442','draft','2022-03-04','DISA','policy','Implement acknowledgement of receipt of complaints, concerns, or questions from individuals within an organization-defined time period.','PM-26d.','N/A','Determine if the complaint management process includes acknowledging the receipt of complaints, concerns, or questions from individuals within [PM-26_ODP[03]; the time period for acknowledging the receipt of complaints is defined].'),\n('004443','draft','2022-03-04','DISA','policy','Defines the time period for acknowledging the receipt of complaints, concerns, or questions from individuals.','PM-26d.','N/A','Determine if the complaint management process includes acknowledging the receipt of complaints, concerns, or questions from individuals within [PM-26_ODP[03]; the time period for acknowledging the receipt of complaints is defined].'),\n('004444','draft','2022-03-04','DISA','policy','Implement response to complaints, concerns, or questions from individuals within an organization-defined time period.','PM-26e.','N/A','Determine if the complaint management process includes responding to complaints, concerns, or questions from individuals within [PM-26_ODP[04]; the time period for responding to complaints is defined].'),\n('004445','draft','2022-03-04','DISA','policy','Defines the time period for response to complaints, concerns, or questions from individuals.','PM-26e.','N/A','Determine if the complaint management process includes responding to complaints, concerns, or questions from individuals within [PM-26_ODP[04]; the time period for responding to complaints is defined].'),\n('004446','draft','2022-03-04','DISA','policy','Develop organization-defined privacy reports.',NULL,'N/A',NULL),\n('004447','draft','2022-03-04','DISA','policy','Defines the privacy reports that are to be developed.',NULL,'N/A',NULL),\n('004448','draft','2022-03-04','DISA','policy','Disseminate privacy reports to organization-defined oversight bodies to demonstrate accountability with statutory, regulatory, and policy privacy program mandates.','PM-27a.01','N/A','Determine if the privacy reports are disseminated to [PM-27_ODP[02]; privacy oversight bodies are defined] to demonstrate accountability with statutory, regulatory, and policy privacy mandates.'),\n('004449','draft','2022-03-04','DISA','policy','Develop privacy reports for organization-defined officials and other personnel with responsibility for monitoring privacy program progress and compliance.','PM-27a.02','N/A','Determine if: - the privacy reports are disseminated to [PM-27_ODP[03]; officials responsible for monitoring privacy program compliance are defined]. - the privacy reports are disseminated to other personnel responsible for monitoring privacy program compliance.'),\n('004450','draft','2022-03-04','DISA','policy','Disseminate privacy reports for organization-defined officials and other personnel with responsibility for monitoring privacy program compliance.','PM-27a.02','N/A','Determine if: - the privacy reports are disseminated to [PM-27_ODP[03]; officials responsible for monitoring privacy program compliance are defined]. - the privacy reports are disseminated to other personnel responsible for monitoring privacy program compliance.'),\n('004451','draft','2022-03-04','DISA','policy','Defines the officials responsible for monitoring privacy program compliance.','PM-27a.02','N/A','Determine if: - the privacy reports are disseminated to [PM-27_ODP[03]; officials responsible for monitoring privacy program compliance are defined]. - the privacy reports are disseminated to other personnel responsible for monitoring privacy program compliance.'),\n('004452','draft','2022-03-04','DISA','policy','Review and update privacy reports on an organization-defined frequency.','PM-27b.','N/A','Determine if the privacy reports are reviewed and updated [PM-27_ODP[04]; the frequency for reviewing and updating privacy reports is defined].'),\n('004453','draft','2022-03-04','DISA','policy','Defines the frequency of which the privacy reports are reviewed and updated.','PM-27b.','N/A','Determine if the privacy reports are reviewed and updated [PM-27_ODP[04]; the frequency for reviewing and updating privacy reports is defined].'),\n('004454','draft','2022-03-04','DISA','policy','Identify and document assumptions affecting risk assessments, risk response, and risk monitoring.','PM-28a.01','N/A','Determine if: - assumptions affecting risk assessments are identified and documented. - assumptions affecting risk responses are identified and documented. - assumptions affecting risk monitoring are identified and documented.'),\n('004455','draft','2022-03-04','DISA','policy','Identify and document constraints affecting risk assessments, risk response, and risk monitoring.','PM-28a.02','N/A','Determine if: - constraints affecting risk assessments are identified and documented. - constraints affecting risk responses are identified and documented. - constraints affecting risk monitoring are identified and documented.'),\n('004456','draft','2022-03-04','DISA','policy','Identify and document priorities and trade-offs considered by the organization for managing risk.','PM-28a.03','N/A','Determine if: - priorities considered by the organization for managing risk are identified and documented. - trade-offs considered by the organization for managing risk are identified and documented.'),\n('004457','draft','2022-03-04','DISA','policy','Identify and document the organizational risk tolerance.','PM-28a.04','N/A','Determine if organizational risk tolerance is identified and documented.'),\n('004458','draft','2022-03-04','DISA','policy','Distribute the results of risk framing activities to organization-defined personnel.','PM-28b.','N/A','Determine if the results of risk framing activities are distributed to [PM-28_ODP[01]; the personnel to receive the results of risk framing activities is/are defined].'),\n('004459','draft','2022-03-04','DISA','policy','Defines the personnel to distribute the results of risk framing activities.','PM-28b.','N/A','Determine if the results of risk framing activities are distributed to [PM-28_ODP[01]; the personnel to receive the results of risk framing activities is/are defined].'),\n('004460','draft','2022-03-04','DISA','policy','Review and update risk framing considerations on an organization-defined frequency.','PM-28c.','N/A','Determine if risk framing considerations are reviewed and updated [PM-28_ODP[02]; the frequency for reviewing and updating risk framing considerations is defined].'),\n('004461','draft','2022-03-04','DISA','policy','Defines the frequency for reviewing and updating risk framing considerations.','PM-28c.','N/A','Determine if risk framing considerations are reviewed and updated [PM-28_ODP[02]; the frequency for reviewing and updating risk framing considerations is defined].'),\n('004462','draft','2022-03-04','DISA','policy','Appoint a Senior Accountable Official for Risk Management to align organizational information security management processes with strategic, operational, and budgetary planning processes.','PM-29a.','N/A','Determine if: - a Senior Accountable Official for Risk Management is appointed. - a Senior Accountable Official for Risk Management aligns information security and privacy management processes with strategic, operational, and budgetary planning processes.'),\n('004463','draft','2022-03-04','DISA','policy','Appoint a Senior Accountable Official for Risk Management to align organizational information privacy management processes with strategic, operational, and budgetary planning processes.','PM-29a.','N/A','Determine if: - a Senior Accountable Official for Risk Management is appointed. - a Senior Accountable Official for Risk Management aligns information security and privacy management processes with strategic, operational, and budgetary planning processes.'),\n('004464','draft','2022-03-04','DISA','policy','Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective.','PM-29b.','N/A','Determine if: - a Risk Executive (function) is established. - a Risk Executive (function) views and analyzes risk from an organization-wide perspective. - a Risk Executive (function) ensures that the management of risk is consistent across the organization.'),\n('004465','draft','2022-03-04','DISA','policy','Establish a Risk Executive (function) to ensure management of risk is consistent across the organization.','PM-29b.','N/A','Determine if: - a Risk Executive (function) is established. - a Risk Executive (function) views and analyzes risk from an organization-wide perspective. - a Risk Executive (function) ensures that the management of risk is consistent across the organization.'),\n('004466','draft','2022-03-04','DISA','policy','Develop an organization-wide strategy for managing supply chain risks associated with the development of systems, system components, and system services.','PM-30a.','N/A','Determine if: - an organization-wide strategy for managing supply chain risks is developed. - the supply chain risk management strategy addresses risks associated with the development of systems. - the supply chain risk management strategy addresses risks associated with the development of system components. - the supply chain risk management strategy addresses risks associated with the development of system services. - the supply chain risk management strategy addresses risks associated with the acquisition of systems. - the supply chain risk management strategy addresses risks associated with the acquisition of system components. - the supply chain risk management strategy addresses risks associated with the acquisition of system services. - the supply chain risk management strategy addresses risks associated with the maintenance of systems. - the supply chain risk management strategy addresses risks associated with the maintenance of system components. - the supply chain risk management strategy addresses risks associated with the maintenance of system services. - the supply chain risk management strategy addresses risks associated with the disposal of systems. - the supply chain risk management strategy addresses risks associated with the disposal of system components. - the supply chain risk management strategy addresses risks associated with the disposal of system services.'),\n('004467','draft','2022-03-04','DISA','policy','Develop an organization-wide strategy for managing supply chain risks associated with the acquisition of systems, system components, and system services.','PM-30a.','N/A','Determine if: - an organization-wide strategy for managing supply chain risks is developed. - the supply chain risk management strategy addresses risks associated with the development of systems. - the supply chain risk management strategy addresses risks associated with the development of system components. - the supply chain risk management strategy addresses risks associated with the development of system services. - the supply chain risk management strategy addresses risks associated with the acquisition of systems. - the supply chain risk management strategy addresses risks associated with the acquisition of system components. - the supply chain risk management strategy addresses risks associated with the acquisition of system services. - the supply chain risk management strategy addresses risks associated with the maintenance of systems. - the supply chain risk management strategy addresses risks associated with the maintenance of system components. - the supply chain risk management strategy addresses risks associated with the maintenance of system services. - the supply chain risk management strategy addresses risks associated with the disposal of systems. - the supply chain risk management strategy addresses risks associated with the disposal of system components. - the supply chain risk management strategy addresses risks associated with the disposal of system services.'),\n('004468','draft','2022-03-04','DISA','policy','Develop an organization-wide strategy for managing supply chain risks associated with the maintenance of systems, system components, and system services.','PM-30a.','N/A','Determine if: - an organization-wide strategy for managing supply chain risks is developed. - the supply chain risk management strategy addresses risks associated with the development of systems. - the supply chain risk management strategy addresses risks associated with the development of system components. - the supply chain risk management strategy addresses risks associated with the development of system services. - the supply chain risk management strategy addresses risks associated with the acquisition of systems. - the supply chain risk management strategy addresses risks associated with the acquisition of system components. - the supply chain risk management strategy addresses risks associated with the acquisition of system services. - the supply chain risk management strategy addresses risks associated with the maintenance of systems. - the supply chain risk management strategy addresses risks associated with the maintenance of system components. - the supply chain risk management strategy addresses risks associated with the maintenance of system services. - the supply chain risk management strategy addresses risks associated with the disposal of systems. - the supply chain risk management strategy addresses risks associated with the disposal of system components. - the supply chain risk management strategy addresses risks associated with the disposal of system services.'),\n('004469','draft','2022-03-04','DISA','policy','Develop an organization-wide strategy for managing supply chain risks associated with the disposal of systems, system components, and system services.','PM-30a.','N/A','Determine if: - an organization-wide strategy for managing supply chain risks is developed. - the supply chain risk management strategy addresses risks associated with the development of systems. - the supply chain risk management strategy addresses risks associated with the development of system components. - the supply chain risk management strategy addresses risks associated with the development of system services. - the supply chain risk management strategy addresses risks associated with the acquisition of systems. - the supply chain risk management strategy addresses risks associated with the acquisition of system components. - the supply chain risk management strategy addresses risks associated with the acquisition of system services. - the supply chain risk management strategy addresses risks associated with the maintenance of systems. - the supply chain risk management strategy addresses risks associated with the maintenance of system components. - the supply chain risk management strategy addresses risks associated with the maintenance of system services. - the supply chain risk management strategy addresses risks associated with the disposal of systems. - the supply chain risk management strategy addresses risks associated with the disposal of system components. - the supply chain risk management strategy addresses risks associated with the disposal of system services.'),\n('004470','draft','2022-03-04','DISA','policy','Implement the supply chain risk management strategy consistently across the organization.','PM-30b.','N/A','Determine if the supply chain risk management strategy is implemented consistently across the organization.'),\n('004471','draft','2022-03-04','DISA','policy','Review and update the supply chain risk management strategy on an organization-defined frequency or as required, to address organizational changes.','PM-30c.','N/A','Determine if the supply chain risk management strategy is reviewed and updated [PM-30_ODP; the frequency for reviewing and updating the supply chain risk management strategy is defined] or as required to address organizational changes.'),\n('004472','draft','2022-03-04','DISA','policy','Defines the frequency of which the supply chain risk management strategy will be reviewed and updated.','PM-30c.','N/A','Determine if the supply chain risk management strategy is reviewed and updated [PM-30_ODP; the frequency for reviewing and updating the supply chain risk management strategy is defined] or as required to address organizational changes.'),\n('004473','draft','2022-03-04','DISA','policy','Develop an organization-wide continuous monitoring strategy establishing organization-defined metrics to be monitored.','PM-31a.','N/A','Determine if continuous monitoring programs are implemented that include establishing [PM-31_ODP[01]; the metrics for organization-wide continuous monitoring are defined] to be monitored.'),\n('004474','draft','2022-03-04','DISA','policy','Implement continuous monitoring programs that include establishing organization-wide metrics to be monitored.','PM-31a.','N/A','Determine if continuous monitoring programs are implemented that include establishing [PM-31_ODP[01]; the metrics for organization-wide continuous monitoring are defined] to be monitored.'),\n('004475','draft','2022-03-04','DISA','policy','Defines the metrics for developing and implementing continuous monitoring programs.','PM-31a.','N/A','Determine if continuous monitoring programs are implemented that include establishing [PM-31_ODP[01]; the metrics for organization-wide continuous monitoring are defined] to be monitored.'),\n('004476','draft','2022-03-04','DISA','policy','Develop an organization-wide continuous monitoring strategy establishing organization-defined frequencies for monitoring.','PM-31b.','N/A','Determine if: - continuous monitoring programs are implemented that establish [PM-31_ODP[02]; the frequency for monitoring is defined] for monitoring. - continuous monitoring programs are implemented that establish [PM-31_ODP[03]; the frequency for assessing control effectiveness is defined] for assessment of control effectiveness.'),\n('004477','draft','2022-03-04','DISA','policy','Develop an organization-wide continuous monitoring strategy establishing organization-defined frequencies for assessment of control effectiveness.','PM-31b.','N/A','Determine if: - continuous monitoring programs are implemented that establish [PM-31_ODP[02]; the frequency for monitoring is defined] for monitoring. - continuous monitoring programs are implemented that establish [PM-31_ODP[03]; the frequency for assessing control effectiveness is defined] for assessment of control effectiveness.'),\n('004478','draft','2022-03-04','DISA','policy','Defines the frequencies for developing and implementing continuous monitoring programs for monitoring.','PM-31b.','N/A','Determine if: - continuous monitoring programs are implemented that establish [PM-31_ODP[02]; the frequency for monitoring is defined] for monitoring. - continuous monitoring programs are implemented that establish [PM-31_ODP[03]; the frequency for assessing control effectiveness is defined] for assessment of control effectiveness.'),\n('004479','draft','2022-03-04','DISA','policy','Implement continuous monitoring programs that include establishing organization-wide frequencies for monitoring.','PM-31b.','N/A','Determine if: - continuous monitoring programs are implemented that establish [PM-31_ODP[02]; the frequency for monitoring is defined] for monitoring. - continuous monitoring programs are implemented that establish [PM-31_ODP[03]; the frequency for assessing control effectiveness is defined] for assessment of control effectiveness.'),\n('004480','draft','2022-03-04','DISA','policy','Implement continuous monitoring programs that include establishing organization-wide frequencies for assessment of control effectiveness.','PM-31b.','N/A','Determine if: - continuous monitoring programs are implemented that establish [PM-31_ODP[02]; the frequency for monitoring is defined] for monitoring. - continuous monitoring programs are implemented that establish [PM-31_ODP[03]; the frequency for assessing control effectiveness is defined] for assessment of control effectiveness.'),\n('004481','draft','2022-03-04','DISA','policy','Defines the frequencies for developing and implementing continuous monitoring programs for assessment of control effectiveness.','PM-31b.','N/A','Determine if: - continuous monitoring programs are implemented that establish [PM-31_ODP[02]; the frequency for monitoring is defined] for monitoring. - continuous monitoring programs are implemented that establish [PM-31_ODP[03]; the frequency for assessing control effectiveness is defined] for assessment of control effectiveness.'),\n('004482','draft','2022-03-04','DISA','policy','Develop an organization-wide continuous monitoring strategy for ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy.','PM-31c.','N/A','Determine if continuous monitoring programs are implemented that include monitoring [PM-31_ODP[01]; the metrics for organization-wide continuous monitoring are defined] on an ongoing basis in accordance with the continuous monitoring strategy.'),\n('004483','draft','2022-03-04','DISA','policy','Implement continuous monitoring programs that include ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy.','PM-31c.','N/A','Determine if continuous monitoring programs are implemented that include monitoring [PM-31_ODP[01]; the metrics for organization-wide continuous monitoring are defined] on an ongoing basis in accordance with the continuous monitoring strategy.'),\n('004484','draft','2022-03-04','DISA','policy','Develop an organization-wide continuous monitoring strategy for correlation and analysis of information generated by control assessments and monitoring.','PM-31d.','N/A','Determine if: - continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring. - continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring.'),\n('004485','draft','2022-03-04','DISA','policy','Implement continuous monitoring programs that include correlation and analysis of information generated by control assessments and monitoring.','PM-31d.','N/A','Determine if: - continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring. - continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring.'),\n('004486','draft','2022-03-04','DISA','policy','Develop an organization-wide continuous monitoring strategy for response actions to address results of the analysis of control assessment and monitoring information.','PM-31e.','N/A','Determine if: - continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information. - continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information.'),\n('004487','draft','2022-03-04','DISA','policy','Implement continuous monitoring programs that include response actions to address results of the analysis of control assessment and monitoring information.','PM-31e.','N/A','Determine if: - continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information. - continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information.'),\n('004488','draft','2022-03-04','DISA','policy','Develop an organization-wide continuous monitoring strategy for reporting the security status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.','PM-31f.','N/A','Determine if: - continuous monitoring programs are implemented that include reporting the security status of organizational systems to [PM-31_ODP[04]; the personnel or roles for reporting the security status of organizational systems to is/are defined] [PM-31_ODP[06]; the frequency at which to report the security status of organizational systems is defined]. - continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to [PM-31_ODP[05]; the personnel or roles for reporting the privacy status of organizational systems to is/are defined] [PM-31_ODP[07]; the frequency at which to report the privacy status of organizational systems is defined].'),\n('004489','draft','2022-03-04','DISA','policy','Develop an organization-wide continuous monitoring strategy for reporting the privacy status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.','PM-31f.','N/A','Determine if: - continuous monitoring programs are implemented that include reporting the security status of organizational systems to [PM-31_ODP[04]; the personnel or roles for reporting the security status of organizational systems to is/are defined] [PM-31_ODP[06]; the frequency at which to report the security status of organizational systems is defined]. - continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to [PM-31_ODP[05]; the personnel or roles for reporting the privacy status of organizational systems to is/are defined] [PM-31_ODP[07]; the frequency at which to report the privacy status of organizational systems is defined].'),\n('004490','draft','2022-03-04','DISA','policy','Implement continuous monitoring programs that include reporting the security status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.','PM-31f.','N/A','Determine if: - continuous monitoring programs are implemented that include reporting the security status of organizational systems to [PM-31_ODP[04]; the personnel or roles for reporting the security status of organizational systems to is/are defined] [PM-31_ODP[06]; the frequency at which to report the security status of organizational systems is defined]. - continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to [PM-31_ODP[05]; the personnel or roles for reporting the privacy status of organizational systems to is/are defined] [PM-31_ODP[07]; the frequency at which to report the privacy status of organizational systems is defined].'),\n('004491','draft','2022-03-04','DISA','policy','Implement continuous monitoring programs that include reporting the privacy status of organizational systems to organization-defined personnel or roles on an organization-defined frequency.','PM-31f.','N/A','Determine if: - continuous monitoring programs are implemented that include reporting the security status of organizational systems to [PM-31_ODP[04]; the personnel or roles for reporting the security status of organizational systems to is/are defined] [PM-31_ODP[06]; the frequency at which to report the security status of organizational systems is defined]. - continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to [PM-31_ODP[05]; the personnel or roles for reporting the privacy status of organizational systems to is/are defined] [PM-31_ODP[07]; the frequency at which to report the privacy status of organizational systems is defined].'),\n('004492','draft','2022-03-04','DISA','policy','Defines the personnel or roles for whom to report the security status of organizational systems.','PM-31f.','N/A','Determine if: - continuous monitoring programs are implemented that include reporting the security status of organizational systems to [PM-31_ODP[04]; the personnel or roles for reporting the security status of organizational systems to is/are defined] [PM-31_ODP[06]; the frequency at which to report the security status of organizational systems is defined]. - continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to [PM-31_ODP[05]; the personnel or roles for reporting the privacy status of organizational systems to is/are defined] [PM-31_ODP[07]; the frequency at which to report the privacy status of organizational systems is defined].'),\n('004493','draft','2022-03-04','DISA','policy','Defines the personnel or roles for whom to report the privacy status of organizational systems.','PM-31f.','N/A','Determine if: - continuous monitoring programs are implemented that include reporting the security status of organizational systems to [PM-31_ODP[04]; the personnel or roles for reporting the security status of organizational systems to is/are defined] [PM-31_ODP[06]; the frequency at which to report the security status of organizational systems is defined]. - continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to [PM-31_ODP[05]; the personnel or roles for reporting the privacy status of organizational systems to is/are defined] [PM-31_ODP[07]; the frequency at which to report the privacy status of organizational systems is defined].'),\n('004494','draft','2022-03-04','DISA','policy','Defines the frequency of reporting the security status of organizational systems to organization-defined personnel or roles.','PM-31f.','N/A','Determine if: - continuous monitoring programs are implemented that include reporting the security status of organizational systems to [PM-31_ODP[04]; the personnel or roles for reporting the security status of organizational systems to is/are defined] [PM-31_ODP[06]; the frequency at which to report the security status of organizational systems is defined]. - continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to [PM-31_ODP[05]; the personnel or roles for reporting the privacy status of organizational systems to is/are defined] [PM-31_ODP[07]; the frequency at which to report the privacy status of organizational systems is defined].'),\n('004495','draft','2022-03-04','DISA','policy','Defines the frequency of reporting the privacy status of organizational systems to organization-defined personnel or roles.','PM-31f.','N/A','Determine if: - continuous monitoring programs are implemented that include reporting the security status of organizational systems to [PM-31_ODP[04]; the personnel or roles for reporting the security status of organizational systems to is/are defined] [PM-31_ODP[06]; the frequency at which to report the security status of organizational systems is defined]. - continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to [PM-31_ODP[05]; the personnel or roles for reporting the privacy status of organizational systems to is/are defined] [PM-31_ODP[07]; the frequency at which to report the privacy status of organizational systems is defined].'),\n('004496','draft','2022-03-04','DISA','policy','Analyze organization-defined systems or system components supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose.','PM-32','N/A','Determine if [PM-32_ODP; the systems or system components supporting mission-essential services or functions are defined] supporting mission-essential services or functions are analyzed to ensure that the information resources are being used in a manner that is consistent with their intended purpose.'),\n('004497','draft','2022-03-04','DISA','policy','Defines the systems or system components that are used to analyze mission essential services or functions.','PM-32','N/A','Determine if [PM-32_ODP; the systems or system components supporting mission-essential services or functions are defined] supporting mission-essential services or functions are analyzed to ensure that the information resources are being used in a manner that is consistent with their intended purpose.'),\n('004498','draft','2022-03-04','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system-level personnel security policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','PS-01a.01(b)','N/A','Determine if the [PS-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personnel security policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('004499','draft','2022-03-04','DISA','policy','Designate an organization-defined official to manage the development and documentation of the personnel security policy.','PS-01b.','N/A','Determine if the [PS-01_ODP[04]; an official to manage the personnel security policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the personnel security policy and procedures.'),\n('004500','draft','2022-03-04','DISA','policy','Designate an organization-defined official to manage the dissemination of the personnel security policy.','PS-01b.','N/A','Determine if the [PS-01_ODP[04]; an official to manage the personnel security policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the personnel security policy and procedures.'),\n('004501','draft','2022-03-04','DISA','policy','Defines the official who will manage the personnel security policy.','PS-01b.','N/A','Determine if the [PS-01_ODP[04]; an official to manage the personnel security policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the personnel security policy and procedures.'),\n('004502','draft','2022-03-04','DISA','policy','Designate an organization-defined official to manage development and documentation of the personnel security procedures.','PS-01b.','N/A','Determine if the [PS-01_ODP[04]; an official to manage the personnel security policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the personnel security policy and procedures.'),\n('004503','draft','2022-03-04','DISA','policy','Designate an organization-defined official to manage the dissemination of the personnel security procedures.','PS-01b.','N/A','Determine if the [PS-01_ODP[04]; an official to manage the personnel security policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the personnel security policy and procedures.'),\n('004504','draft','2022-03-04','DISA','policy','Defines the official who will manage the personnel security procedures.','PS-01b.','N/A','Determine if the [PS-01_ODP[04]; an official to manage the personnel security policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the personnel security policy and procedures.'),\n('004505','draft','2022-03-04','DISA','policy','Review and update the current personnel security policy following organization-defined events.','PS-01c.01','N/A','Determine if: - the current personnel security policy is reviewed and updated [PS-01_ODP[05]; the frequency at which the current personnel security policy is reviewed and updated is defined]. - the current personnel security policy is reviewed and updated following [PS-01_ODP[06]; events that would require the current personnel security policy to be reviewed and updated are defined].'),\n('004506','draft','2022-03-04','DISA','policy','Defines the events following reviewing and updating the current personnel security policy.','PS-01c.01','N/A','Determine if: - the current personnel security policy is reviewed and updated [PS-01_ODP[05]; the frequency at which the current personnel security policy is reviewed and updated is defined]. - the current personnel security policy is reviewed and updated following [PS-01_ODP[06]; events that would require the current personnel security policy to be reviewed and updated are defined].'),\n('004507','draft','2022-03-04','DISA','policy','Review and update the current personnel security procedures following organization-defined events.','PS-01c.02','N/A','Determine if: - the current personnel security procedures are reviewed and updated [PS-01_ODP[07]; the frequency at which the current personnel security procedures are reviewed and updated is defined]. - the current personnel security procedures are reviewed and updated following [PS-01_ODP[08]; events that would require the personnel security procedures to be reviewed and updated are defined].'),\n('004508','draft','2022-03-04','DISA','policy','Defines the events following reviewing and updating the current personnel security procedures.','PS-01c.02','N/A','Determine if: - the current personnel security procedures are reviewed and updated [PS-01_ODP[07]; the frequency at which the current personnel security procedures are reviewed and updated is defined]. - the current personnel security procedures are reviewed and updated following [PS-01_ODP[08]; events that would require the personnel security procedures to be reviewed and updated are defined].'),\n('004509','draft','2022-03-04','DISA','policy','Verify that individuals accessing a system processing, storing, or transmitting organization-defined information types meet organization-defined citizenship requirements.','PS-03(04)','N/A','Determine if individuals accessing a system processing, storing, or transmitting [PS-03(04)_ODP[01]; information types that are processed, stored, or transmitted by a system that require individuals accessing the system to meet PS-03(04)_ODP[02] citizenship requirements are defined] meet [PS-03(04)_ODP[02]; citizenship requirements to be met by individuals to access a system processing, storing, or transmitting information are defined].'),\n('004510','draft','2022-03-04','DISA','policy','Defines the information types that meet the organization-defined citizenship requirement.','PS-03(04)','N/A','Determine if individuals accessing a system processing, storing, or transmitting [PS-03(04)_ODP[01]; information types that are processed, stored, or transmitted by a system that require individuals accessing the system to meet PS-03(04)_ODP[02] citizenship requirements are defined] meet [PS-03(04)_ODP[02]; citizenship requirements to be met by individuals to access a system processing, storing, or transmitting information are defined].'),\n('004511','draft','2022-03-04','DISA','policy','Defines the citizenship requirements for individuals accessing a system, storing, or transmitting organization-defined information types.','PS-03(04)','N/A','Determine if individuals accessing a system processing, storing, or transmitting [PS-03(04)_ODP[01]; information types that are processed, stored, or transmitted by a system that require individuals accessing the system to meet PS-03(04)_ODP[02] citizenship requirements are defined] meet [PS-03(04)_ODP[02]; citizenship requirements to be met by individuals to access a system processing, storing, or transmitting information are defined].'),\n('004512','draft','2022-03-04','DISA','policy','Defines the automated mechanisms for notifying organization-defined personnel or roles of individual termination actions; and/or disable access to system resources.','PS-04(02)','N/A','Determine if [PS-04(02)_ODP[01]; automated mechanisms to notify personnel or roles of individual termination actions and/or to disable access to system resources are defined] are used to [PS-04(02)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {notify [PS-04(02)_ODP[03]; personnel or roles to be notified upon termination of an individual is/are defined (if selected)] of individual termination actions; disable access to system resources}].'),\n('004513','draft','2022-03-04','DISA','policy','Verify that individuals requiring access to organizational information sign appropriate access agreements prior to being granted access.','PS-06c.01','N/A','Determine if individuals requiring access to organizational information and systems sign appropriate access agreements prior to being granted access.'),\n('004514','draft','2022-03-04','DISA','policy','Verify that individuals requiring access to organizational systems sign appropriate access agreements prior to being granted access.','PS-06c.01','N/A','Determine if individuals requiring access to organizational information and systems sign appropriate access agreements prior to being granted access.'),\n('004515','draft','2022-03-04','DISA','policy','Verify that individuals requiring access to organizational information re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency.','PS-06c.02','N/A','Determine if individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [PS-06_ODP[02]; the frequency at which to re-sign access agreements to maintain access to organizational information is defined].'),\n('004516','draft','2022-03-04','DISA','policy','Verify that individuals requiring access to organizational systems re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency.','PS-06c.02','N/A','Determine if individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [PS-06_ODP[02]; the frequency at which to re-sign access agreements to maintain access to organizational information is defined].'),\n('004517','draft','2022-03-04','DISA','policy','Defines the frequency for individuals requiring access to organizational information to re-sign access agreements.','PS-06c.02','N/A','Determine if individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [PS-06_ODP[02]; the frequency at which to re-sign access agreements to maintain access to organizational information is defined].'),\n('004518','draft','2022-03-04','DISA','policy','Defines the frequency for individuals requiring access to organizational systems to re-sign access agreements.','PS-06c.02','N/A','Determine if individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [PS-06_ODP[02]; the frequency at which to re-sign access agreements to maintain access to organizational information is defined].'),\n('004519','draft','2022-03-04','DISA','policy','Require external providers to comply with personnel security policies established by the organization.','PS-07b.','N/A','Determine if external providers are required to comply with personnel security policies and procedures established by the organization.'),\n('004520','draft','2022-03-04','DISA','policy','Require external providers to comply with personnel security procedures established by the organization.','PS-07b.','N/A','Determine if external providers are required to comply with personnel security policies and procedures established by the organization.'),\n('004521','draft','2022-03-04','DISA','policy','Employ a formal sanctions process for individuals failing to comply with established information security policies.','PS-08a.','N/A','Determine if a formal sanctions process is employed for individuals failing to comply with established information security and privacy policies and procedures.'),\n('004522','draft','2022-03-04','DISA','policy','Employ a formal sanctions process for individuals failing to comply with established information security procedures.','PS-08a.','N/A','Determine if a formal sanctions process is employed for individuals failing to comply with established information security and privacy policies and procedures.'),\n('004523','draft','2022-03-04','DISA','policy','Incorporate security roles and responsibilities into organizational position descriptions.','PS-09','N/A','Determine if: - security roles and responsibilities are incorporated into organizational position descriptions. - privacy roles and responsibilities are incorporated into organizational position descriptions.'),\n('004524','draft','2022-03-04','DISA','policy','Incorporate privacy roles and responsibilities into organizational position descriptions.','PS-09','N/A','Determine if: - security roles and responsibilities are incorporated into organizational position descriptions. - privacy roles and responsibilities are incorporated into organizational position descriptions.'),\n('004525','draft','2022-03-04','DISA','policy','Develop and document organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','PT-01a.01(a)','N/A','Determine if: - the [PT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personally identifiable information processing and transparency policy addresses purpose. - the [PT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personally identifiable information processing and transparency policy addresses scope. - the [PT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personally identifiable information processing and transparency policy addresses roles. - the [PT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personally identifiable information processing and transparency policy addresses responsibilities. - the [PT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personally identifiable information processing and transparency policy addresses management commitment. - the [PT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personally identifiable information processing and transparency policy addresses coordination among organizational entities. - the [PT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personally identifiable information processing and transparency policy addresses compliance.'),\n('004526','draft','2022-03-04','DISA','policy','Disseminate organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy to organization-defined personnel or roles.','PT-01a.','N/A','Determine if: - a personally identifiable information processing and transparency policy is developed and documented. - the personally identifiable information processing and transparency policy is disseminated to [PT-01_ODP[01]; personnel or roles to whom the personally identifiable information processing and transparency policy is to be disseminated is/are defined].'),\n('004527','draft','2022-03-04','DISA','policy','Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy is to be disseminated.','PT-01a.','N/A','Determine if: - a personally identifiable information processing and transparency policy is developed and documented. - the personally identifiable information processing and transparency policy is disseminated to [PT-01_ODP[01]; personnel or roles to whom the personally identifiable information processing and transparency policy is to be disseminated is/are defined].'),\n('004528','draft','2022-03-04','DISA','policy','Develop and document organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.','PT-01a.01(b)','N/A','Determine if the [PT-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] personally identifiable information processing and transparency policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('004529','draft','2022-03-04','DISA','policy','Develop and document procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls.','PT-01a.02','N/A','Determine if: - personally identifiable information processing and transparency procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and associated personally identifiable information processing and transparency controls are developed and documented. - the personally identifiable information processing and transparency procedures are disseminated to [PT-01_ODP[02]; personnel or roles to whom the personally identifiable information processing and transparency procedures are to be disseminated is/are defined].'),\n('004530','draft','2022-03-04','DISA','policy','Designate an organization-defined official to manage the development and documentation of the personally identifiable information processing and transparency policy.','PT-01b.','N/A','Determine if the [PT-01_ODP[04]; an official to manage the personally identifiable information processing and transparency policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures.'),\n('004531','draft','2022-03-04','DISA','policy','Designate an organization-defined official to manage the development and documentation of the personally identifiable information processing and transparency procedures.','PT-01b.','N/A','Determine if the [PT-01_ODP[04]; an official to manage the personally identifiable information processing and transparency policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures.'),\n('004532','draft','2022-03-04','DISA','policy','Defines the official designated to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures.','PT-01b.','N/A','Determine if the [PT-01_ODP[04]; an official to manage the personally identifiable information processing and transparency policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures.'),\n('004533','draft','2022-03-04','DISA','policy','Review and update the current personally identifiable information processing and transparency policy on an organization-defined frequency.','PT-01c.01','N/A','Determine if: - the current personally identifiable information processing and transparency policy is reviewed and updated [PT-01_ODP[05]; the frequency at which the current personally identifiable information processing and transparency policy is reviewed and updated is defined]. - the current personally identifiable information processing and transparency policy is reviewed and updated following [PT-01_ODP[06]; events that would require the current personally identifiable information processing and transparency policy to be reviewed and updated are defined].'),\n('004534','draft','2022-03-04','DISA','policy','Review and update the current personally identifiable information processing and transparency policy following organization-defined events.','PT-01c.01','N/A','Determine if: - the current personally identifiable information processing and transparency policy is reviewed and updated [PT-01_ODP[05]; the frequency at which the current personally identifiable information processing and transparency policy is reviewed and updated is defined]. - the current personally identifiable information processing and transparency policy is reviewed and updated following [PT-01_ODP[06]; events that would require the current personally identifiable information processing and transparency policy to be reviewed and updated are defined].'),\n('004535','draft','2022-03-04','DISA','policy','Defines the events following reviewing and updating the current personally identifiable processing and transparency policy.','PT-01c.01','N/A','Determine if: - the current personally identifiable information processing and transparency policy is reviewed and updated [PT-01_ODP[05]; the frequency at which the current personally identifiable information processing and transparency policy is reviewed and updated is defined]. - the current personally identifiable information processing and transparency policy is reviewed and updated following [PT-01_ODP[06]; events that would require the current personally identifiable information processing and transparency policy to be reviewed and updated are defined].'),\n('004536','draft','2022-03-04','DISA','policy','Review and update the current personally identifiable information processing and transparency procedures on an organization-defined frequency.','PT-01c.02','N/A','Determine if: - the current personally identifiable information processing and transparency procedures are reviewed and updated [PT-01_ODP[07]; the frequency at which the current personally identifiable information processing and transparency procedures are reviewed and updated is defined]. - the current personally identifiable information processing and transparency procedures are reviewed and updated following [PT-01_ODP[08]; events that would require the personally identifiable information processing and transparency procedures to be reviewed and updated are defined].'),\n('004537','draft','2022-03-04','DISA','policy','Review and update the current personally identifiable information processing and transparency procedures following organization-defined events.','PT-01c.02','N/A','Determine if: - the current personally identifiable information processing and transparency procedures are reviewed and updated [PT-01_ODP[07]; the frequency at which the current personally identifiable information processing and transparency procedures are reviewed and updated is defined]. - the current personally identifiable information processing and transparency procedures are reviewed and updated following [PT-01_ODP[08]; events that would require the personally identifiable information processing and transparency procedures to be reviewed and updated are defined].'),\n('004538','draft','2022-03-04','DISA','policy','Defines the events following reviewing and updating the current personally identifiable processing and transparency procedures.','PT-01c.02','N/A','Determine if: - the current personally identifiable information processing and transparency procedures are reviewed and updated [PT-01_ODP[07]; the frequency at which the current personally identifiable information processing and transparency procedures are reviewed and updated is defined]. - the current personally identifiable information processing and transparency procedures are reviewed and updated following [PT-01_ODP[08]; events that would require the personally identifiable information processing and transparency procedures to be reviewed and updated are defined].'),\n('004539','draft','2022-03-04','DISA','policy','Determine and document the organization-defined authority that permits the organization-defined processing of personally identifiable information.','PT-02a.','N/A','Determine if the [PT-02_ODP[01]; the authority to permit the processing (defined in PT-02_ODP[02]) of personally identifiable information is defined] that permits the [PT-02_ODP[02]; the type of processing of personally identifiable information is defined] of personally identifiable information is determined and documented.'),\n('004540','draft','2022-03-04','DISA','policy','Defines the authority who will permit the organization-defined processing of personally identifiable information.','PT-02a.','N/A','Determine if the [PT-02_ODP[01]; the authority to permit the processing (defined in PT-02_ODP[02]) of personally identifiable information is defined] that permits the [PT-02_ODP[02]; the type of processing of personally identifiable information is defined] of personally identifiable information is determined and documented.'),\n('004541','draft','2022-03-04','DISA','policy','Defines the processing of the personally identifiable information.','PT-02a.','N/A','Determine if the [PT-02_ODP[01]; the authority to permit the processing (defined in PT-02_ODP[02]) of personally identifiable information is defined] that permits the [PT-02_ODP[02]; the type of processing of personally identifiable information is defined] of personally identifiable information is determined and documented.'),\n('004542','draft','2022-03-04','DISA','policy','Restrict the organization-defined processing of personally identifiable information to only that which is authorized.','PT-02b.','N/A','Determine if the [PT-02_ODP[03]; the type of processing of personally identifiable information to be restricted is defined] of personally identifiable information is restricted to only that which is authorized.'),\n('004543','draft','2022-03-04','DISA','policy','Defines the processing of the personally identifiable information to only that which is authorized.','PT-02b.','N/A','Determine if the [PT-02_ODP[03]; the type of processing of personally identifiable information to be restricted is defined] of personally identifiable information is restricted to only that which is authorized.'),\n('004544','draft','2022-03-04','DISA','technical','Attach data tags containing organization-defined authorized processing to organization-defined elements of personally identifiable information.','PT-02(01)','N/A','Determine if data tags containing [PT-02(01)_ODP[01]; the authorized processing of personally identifiable information is defined] are attached to [PT-02(01)_ODP[02]; elements of personally identifiable information to be tagged are defined].'),\n('004545','draft','2022-03-04','DISA','technical','Defines the authorized processing which will attach data tags to organization-defined elements of personally identifiable information.','PT-02(01)','N/A','Determine if data tags containing [PT-02(01)_ODP[01]; the authorized processing of personally identifiable information is defined] are attached to [PT-02(01)_ODP[02]; elements of personally identifiable information to be tagged are defined].'),\n('004546','draft','2022-03-04','DISA','technical','Defines the elements of personally identifiable information containing organization-defined authorized processing.','PT-02(01)','N/A','Determine if data tags containing [PT-02(01)_ODP[01]; the authorized processing of personally identifiable information is defined] are attached to [PT-02(01)_ODP[02]; elements of personally identifiable information to be tagged are defined].'),\n('004547','draft','2022-03-04','DISA','policy','Manage enforcement of the authorized processing of personally identifiable information using organization-defined automated mechanisms.','PT-02(02)','N/A','Determine if enforcement of the authorized processing of personally identifiable information is managed using [PT-02(02)_ODP; automated mechanisms used to manage enforcement of the authorized processing of personally identifiable information are defined].'),\n('004548','draft','2022-03-04','DISA','policy','Defines the automated mechanisms for managing enforcement of the authorized processing of personally identifiable information.','PT-02(02)','N/A','Determine if enforcement of the authorized processing of personally identifiable information is managed using [PT-02(02)_ODP; automated mechanisms used to manage enforcement of the authorized processing of personally identifiable information are defined].'),\n('004549','draft','2022-03-04','DISA','policy','Identify and document the organization-defined purpose(s) for processing personally identifiable information.','PT-03a.','N/A','Determine if the [PT-03_ODP[01]; the purpose(s) for processing personally identifiable information is/are defined] for processing personally identifiable information is/are identified and documented.'),\n('004550','draft','2022-03-04','DISA','policy','Defines the purpose(s) of identifying and documenting personally identifiable information.','PT-03a.','N/A','Determine if the [PT-03_ODP[01]; the purpose(s) for processing personally identifiable information is/are defined] for processing personally identifiable information is/are identified and documented.'),\n('004551','draft','2022-03-04','DISA','policy','Describe the purpose(s) in the public privacy notices and policies of the organization.','PT-03b.','N/A','Determine if: - the purpose(s) is/are described in the public privacy notices of the organization. - the purpose(s) is/are described in the policies of the organization.'),\n('004552','draft','2022-03-04','DISA','policy','Restrict the organization-defined processing of personally identifiable information to only that which is compatible with the identified purpose(s).','PT-03c.','N/A','Determine if the [PT-03_ODP[02]; the processing of personally identifiable information to be restricted is defined] of personally identifiable information are restricted to only that which is compatible with the identified purpose(s).'),\n('004553','draft','2022-03-04','DISA','policy','Defines the processing of personally identifiable information to only that which is compatible with the identified purpose(s).','PT-03c.','N/A','Determine if the [PT-03_ODP[02]; the processing of personally identifiable information to be restricted is defined] of personally identifiable information are restricted to only that which is compatible with the identified purpose(s).'),\n('004554','draft','2022-03-04','DISA','policy','Monitor changes in processing personally identifiable information.','PT-03d.','N/A','Determine if: - changes in the processing of personally identifiable information are monitored. - [PT-03_ODP[03]; mechanisms to be implemented for ensuring any changes in the processing of personally identifiable information are made in accordance with requirements are defined] are implemented to ensure that any changes are made in accordance with [PT-03_ODP[04]; requirements for changing the processing of personally identifiable information are defined].'),\n('004555','draft','2022-03-04','DISA','policy','Implement organization-defined mechanisms to ensure that any changes are made in accordance with organization-defined requirements.','PT-03d.','N/A','Determine if: - changes in the processing of personally identifiable information are monitored. - [PT-03_ODP[03]; mechanisms to be implemented for ensuring any changes in the processing of personally identifiable information are made in accordance with requirements are defined] are implemented to ensure that any changes are made in accordance with [PT-03_ODP[04]; requirements for changing the processing of personally identifiable information are defined].'),\n('004556','draft','2022-03-04','DISA','policy','Defines the mechanisms for ensuring any changes are made in accordance with organization-defined requirements.','PT-03d.','N/A','Determine if: - changes in the processing of personally identifiable information are monitored. - [PT-03_ODP[03]; mechanisms to be implemented for ensuring any changes in the processing of personally identifiable information are made in accordance with requirements are defined] are implemented to ensure that any changes are made in accordance with [PT-03_ODP[04]; requirements for changing the processing of personally identifiable information are defined].'),\n('004557','draft','2022-03-04','DISA','policy','Defines the requirements for implementing organization-defined mechanisms.','PT-03d.','N/A','Determine if: - changes in the processing of personally identifiable information are monitored. - [PT-03_ODP[03]; mechanisms to be implemented for ensuring any changes in the processing of personally identifiable information are made in accordance with requirements are defined] are implemented to ensure that any changes are made in accordance with [PT-03_ODP[04]; requirements for changing the processing of personally identifiable information are defined].'),\n('004558','draft','2022-03-04','DISA','technical','Attach data tags containing organization-defined processing purposes to organization-defined elements of personally identifiable information.','PT-03(01)','N/A','Determine if data tags containing [PT-03(01)_ODP[01]; processing purposes to be contained in data tags are defined] are attached to [PT-03(01)_ODP[02]; elements of personally identifiable information to be tagged are defined].'),\n('004559','draft','2022-03-04','DISA','technical','Defines the elements of personally identifiable information containing organization-defined processing purposes.','PT-03(01)','N/A','Determine if data tags containing [PT-03(01)_ODP[01]; processing purposes to be contained in data tags are defined] are attached to [PT-03(01)_ODP[02]; elements of personally identifiable information to be tagged are defined].'),\n('004560','draft','2022-03-04','DISA','policy','Track processing purposes of personally identifiable information using organization-defined automated mechanisms.','PT-03(02)','N/A','Determine if the processing purposes of personally identifiable information are tracked using [PT-03(02)_ODP; automated mechanisms for tracking the processing purposes of personally identifiable information are defined].'),\n('004561','draft','2022-03-04','DISA','policy','Implement organization-defined tools or mechanisms for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals'' informed decision-making.','PT-04','N/A','Determine if the [PT-04_ODP; the tools or mechanisms to be implemented for individuals to consent to the processing of their personally identifiable information are defined] are implemented for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individual''s informed decision-making.'),\n('004562','draft','2022-03-04','DISA','policy','Defines the tools or mechanisms for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals'' informed decision-making.','PT-04','N/A','Determine if the [PT-04_ODP; the tools or mechanisms to be implemented for individuals to consent to the processing of their personally identifiable information are defined] are implemented for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individual''s informed decision-making.'),\n('004563','draft','2022-03-04','DISA','policy','Provide organization-defined mechanisms to allow individuals to tailor processing permissions to selected elements of personally identifiable information.','PT-04(01)','N/A','Determine if [PT-04(01)_ODP; tailoring mechanisms for processing selected elements of personally identifiable information permissions are defined] are provided to allow individuals to tailor processing permissions to selected elements of personally identifiable information.'),\n('004564','draft','2022-03-04','DISA','policy','Defines the mechanisms for allowing individuals to tailor processing permissions to selected elements of personally identifiable information.','PT-04(01)','N/A','Determine if [PT-04(01)_ODP; tailoring mechanisms for processing selected elements of personally identifiable information permissions are defined] are provided to allow individuals to tailor processing permissions to selected elements of personally identifiable information.'),\n('004565','draft','2022-03-04','DISA','policy','Present organization-defined consent mechanisms to individuals at an organization-defined frequency and in conjunction with organization-defined personally identifiable information processing.','PT-04(02)','N/A','Determine if [PT-04(02)_ODP[01]; consent mechanisms to be presented to individuals are defined] are presented to individuals [PT-04(02)_ODP[02]; the frequency at which to present consent mechanisms to individuals is defined] and in conjunction with [PT-04(02)_ODP[03]; personally identifiable information processing to be presented in conjunction with organization-defined consent mechanisms is defined].'),\n('004566','draft','2022-03-04','DISA','policy','Defines the frequency for presenting organization-defined consent mechanisms to individuals.','PT-04(02)','N/A','Determine if [PT-04(02)_ODP[01]; consent mechanisms to be presented to individuals are defined] are presented to individuals [PT-04(02)_ODP[02]; the frequency at which to present consent mechanisms to individuals is defined] and in conjunction with [PT-04(02)_ODP[03]; personally identifiable information processing to be presented in conjunction with organization-defined consent mechanisms is defined].'),\n('004567','draft','2022-03-04','DISA','policy','Defines the consent mechanisms needed by individuals on an organization-defined frequency, with organization-defined personally identifiable information processing.','PT-04(02)','N/A','Determine if [PT-04(02)_ODP[01]; consent mechanisms to be presented to individuals are defined] are presented to individuals [PT-04(02)_ODP[02]; the frequency at which to present consent mechanisms to individuals is defined] and in conjunction with [PT-04(02)_ODP[03]; personally identifiable information processing to be presented in conjunction with organization-defined consent mechanisms is defined].'),\n('004568','draft','2022-03-04','DISA','policy','Defines the personally identifiable information processing needed for presenting organization-defined consent mechanisms to individuals.','PT-04(02)','N/A','Determine if [PT-04(02)_ODP[01]; consent mechanisms to be presented to individuals are defined] are presented to individuals [PT-04(02)_ODP[02]; the frequency at which to present consent mechanisms to individuals is defined] and in conjunction with [PT-04(02)_ODP[03]; personally identifiable information processing to be presented in conjunction with organization-defined consent mechanisms is defined].'),\n('004569','draft','2022-03-04','DISA','policy','Implement organization-defined tools or mechanisms for individuals to revoke consent to the processing of their personally identifiable information.','PT-04(03)','N/A','Determine if the [PT-04(03)_ODP; the tools or mechanisms to be implemented for revoking consent to the processing of personally identifiable information are defined] are implemented for individuals to revoke consent to the processing of their personally identifiable information.'),\n('004570','draft','2022-03-04','DISA','policy','Defines the tools or mechanisms for individuals to revoke consent to the processing of their personally identifiable information.','PT-04(03)','N/A','Determine if the [PT-04(03)_ODP; the tools or mechanisms to be implemented for revoking consent to the processing of personally identifiable information are defined] are implemented for individuals to revoke consent to the processing of their personally identifiable information.'),\n('004571','draft','2022-03-04','DISA','policy','Provide notice to individuals about the processing of personally identifiable information that is available to individuals upon first interacting with an organization, and subsequently at an organization-defined frequency.','PT-05a.','N/A','Determine if: - a notice to individuals about the processing of personally identifiable information is provided such that the notice is available to individuals upon first interacting with an organization. - a notice to individuals about the processing of personally identifiable information is provided such that the notice is subsequently available to individuals [PT-05_ODP[01]; the frequency at which a notice is provided to individuals after initial interaction with an organization is defined].'),\n('004572','draft','2022-03-04','DISA','policy','Defines the frequency for providing notice to individuals about the processing of personally identifiable information that is available to individuals upon first interacting with an organization.','PT-05a.','N/A','Determine if: - a notice to individuals about the processing of personally identifiable information is provided such that the notice is available to individuals upon first interacting with an organization. - a notice to individuals about the processing of personally identifiable information is provided such that the notice is subsequently available to individuals [PT-05_ODP[01]; the frequency at which a notice is provided to individuals after initial interaction with an organization is defined].'),\n('004573','draft','2022-03-04','DISA','policy','Provide notice to individuals about the processing of personally identifiable information is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language.','PT-05b.','N/A','Determine if a notice to individuals about the processing of personally identifiable information is provided that is clear, easy-to-understand, and expresses information about personally identifiable information processing in plain language.'),\n('004574','draft','2022-03-04','DISA','policy','Provide notice to individuals about the processing of personally identifiable information that identifies the authority that authorizes the processing of personally identifiable information.','PT-05c.','N/A','Determine if a notice to individuals about the processing of personally identifiable information that identifies the authority that authorizes the processing of personally identifiable information is provided.'),\n('004575','draft','2022-03-04','DISA','policy','Provide notice to individuals about the processing of personally identifiable information that identifies the purposes for which personally identifiable information is to be processes.','PT-05d.','N/A','Determine if a notice to individuals about the processing of personally identifiable information that identifies the purpose for which personally identifiable information is to be processed is provided.'),\n('004576','draft','2022-03-04','DISA','policy','Provide notice to individuals about the processing of personally identifiable information that includes organization-defined information.','PT-05e.','N/A','Determine if a notice to individuals about the processing of personally identifiable information which includes [PT-05_ODP[02]; information to be included with the notice about the processing of personally identifiable information is defined] is provided.'),\n('004577','draft','2022-03-04','DISA','policy','Defines the information that includes providing notice to individuals about the processing of personally identifiable information.','PT-05e.','N/A','Determine if a notice to individuals about the processing of personally identifiable information which includes [PT-05_ODP[02]; information to be included with the notice about the processing of personally identifiable information is defined] is provided.'),\n('004578','draft','2022-03-04','DISA','policy','Present notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action or organization-defined frequency.','PT-05(01)','N/A','Determine if a notice of personally identifiable information processing is presented to individuals at a time and location where the individual provides personally identifiable information, in conjunction with a data action, or [PT-05(01)_ODP; the frequency at which to present a notice of personally identifiable information processing is defined].'),\n('004579','draft','2022-03-04','DISA','policy','Defines the frequency for presenting notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action.','PT-05(01)','N/A','Determine if a notice of personally identifiable information processing is presented to individuals at a time and location where the individual provides personally identifiable information, in conjunction with a data action, or [PT-05(01)_ODP; the frequency at which to present a notice of personally identifiable information processing is defined].'),\n('004580','draft','2022-03-04','DISA','policy','Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals.','PT-05(02)','N/A','Determine if Privacy Act statements are included on forms that collect information that will be maintained in a Privacy Act system of records, or Privacy Act statements are provided on separate forms that can be retained by individuals.'),\n('004581','draft','2022-03-04','DISA','policy','For systems that process information that will be maintained in a Privacy Act system of records: draft system of records notices in accordance with OMB guidance.','PT-06a.','N/A','Determine if: - system of records notices are drafted in accordance with OMB guidance for systems that process information that will be maintained in a Privacy Act system of records. - new and significantly modified system of records notices are submitted to the OMB and appropriate congressional committees for advance review for systems that process information that will be maintained in a Privacy Act system of records.'),\n('004582','draft','2022-03-04','DISA','policy','For systems that process information that will be maintained in a Privacy Act system of records: submit new and significantly modified system of records notices to the OMB and appropriate committees for advance review.','PT-06a.','N/A','Determine if: - system of records notices are drafted in accordance with OMB guidance for systems that process information that will be maintained in a Privacy Act system of records. - new and significantly modified system of records notices are submitted to the OMB and appropriate congressional committees for advance review for systems that process information that will be maintained in a Privacy Act system of records.'),\n('004583','draft','2022-03-04','DISA','policy','For systems that process information that will be maintained in a Privacy Act system of records: publish system of records notices in the Federal Register.','PT-06b.','N/A','Determine if system of records notices are published in the Federal Register for systems that process information that will be maintained in a Privacy Act system of records.'),\n('004584','draft','2022-03-04','DISA','policy','For systems that process information that will be maintained in a Privacy Act system of records: keep system of records notices accurate, up-to-date, and scoped in accordance with policy.','PT-06c.','N/A','Determine if system of records notices are kept accurate, up-to-date, and scoped in accordance with policy for systems that process information that will be maintained in a Privacy Act system of records.'),\n('004585','draft','2022-03-04','DISA','policy','Review all routine uses published in the system of records notice at an organization-defined frequency to ensure continued accuracy.','PT-06(01)','N/A','Determine if all routine uses published in the system of records notice are reviewed [PT-06(01)_ODP; the frequency at which to review all routine uses published in the system of records notice is defined] to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.'),\n('004586','draft','2022-03-04','DISA','policy','Defines the frequency for reviewing all routine uses in published in the system of records notice.','PT-06(01)','N/A','Determine if all routine uses published in the system of records notice are reviewed [PT-06(01)_ODP; the frequency at which to review all routine uses published in the system of records notice is defined] to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.'),\n('004587','draft','2022-03-04','DISA','policy','Review all routine uses published in the system of records notice at an organization-defined frequency to ensure that routine uses continue to be compatible with the purpose for which the information was collected.','PT-06(01)','N/A','Determine if all routine uses published in the system of records notice are reviewed [PT-06(01)_ODP; the frequency at which to review all routine uses published in the system of records notice is defined] to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.'),\n('004588','draft','2022-03-04','DISA','policy','Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure they remain appropriate and necessary with law.','PT-06(02)','N/A','Determine if: - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they remain appropriate and necessary in accordance with law. - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they have been promulgated as regulations. - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they are accurately described in the system of records notice.'),\n('004589','draft','2022-03-04','DISA','policy','Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure they have been promulgated as regulations.','PT-06(02)','N/A','Determine if: - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they remain appropriate and necessary in accordance with law. - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they have been promulgated as regulations. - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they are accurately described in the system of records notice.'),\n('004590','draft','2022-03-04','DISA','policy','Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure that they are accurately described in the system of records notice.','PT-06(02)','N/A','Determine if: - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they remain appropriate and necessary in accordance with law. - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they have been promulgated as regulations. - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they are accurately described in the system of records notice.'),\n('004591','draft','2022-03-04','DISA','policy','Defines the frequency for reviewing all Privacy Act exemptions claimed for the system of records.','PT-06(02)','N/A','Determine if: - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they remain appropriate and necessary in accordance with law. - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they have been promulgated as regulations. - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they are accurately described in the system of records notice.'),\n('004592','draft','2022-03-04','DISA','policy','Apply organization-defined processing conditions for specific categories of personally identifiable information.','PT-07','N/A','Determine if [PT-07_ODP; processing conditions to be applied for specific categories of personally identifiable information are defined] are applied for specific categories of personally identifiable information.'),\n('004593','draft','2022-03-04','DISA','policy','Defines the processing conditions for applying specific categories of personally identifiable information.','PT-07','N/A','Determine if [PT-07_ODP; processing conditions to be applied for specific categories of personally identifiable information are defined] are applied for specific categories of personally identifiable information.'),\n('004594','draft','2022-03-04','DISA','policy','When a system processes Social Security numbers: eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier.','PT-07(01)(a)','N/A','Determine if: - when a system processes Social Security numbers, the unnecessary collection, maintenance, and use of Social Security numbers are eliminated. - when a system processes Social Security numbers, alternatives to the use of Social Security Numbers as a personal identifier are explored.'),\n('004595','draft','2022-03-04','DISA','policy','When a system processes Social Security numbers: do not deny any individuals any right, benefit, or privilege provided by law because of such individuals'' refusal to disclose his or her Social Security number.','PT-07(01)(b)','N/A','Determine if when a system processes Social Security numbers, individual rights, benefits, or privileges provided by law are not denied because of an individual''s refusal to disclose their Social Security number.'),\n('004596','draft','2022-03-04','DISA','policy','When a system processes Social Security numbers: inform any individual who is asked to disclose his or Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.','PT-07(01)(c)','N/A','Determine if: - when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it. - when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed by what statutory or other authority the number is solicited. - when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed what uses will be made of it.'),\n('004597','draft','2022-03-04','DISA','policy','Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statue or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.','PT-07(02)','N/A','Determine if the processing of information describing how any individual exercises rights guaranteed by the First Amendment is prohibited unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.'),\n('004598','draft','2022-03-04','DISA','policy','When a system or organization processes information for the purpose of conducting a matching program: obtain approval from the Data Integrity Board to conduct the matching program.','PT-08a.','N/A','Determine if approval to conduct the matching program is obtained from the Data Integrity Board when a system or organization processes information for the purpose of conducting a matching program.'),\n('004599','draft','2022-03-04','DISA','policy','When a system or organization processes information for the purpose of conducting a matching program: develop and enter into a computer matching agreement.','PT-08b.','N/A','Determine if: - a computer matching agreement is developed when a system or organization processes information for the purpose of conducting a matching program. - a computer matching agreement is entered into when a system or organization processes information for the purpose of conducting a matching program.'),\n('004600','draft','2022-03-04','DISA','policy','When a system or organization processes information for the purpose of conducting a matching program: publish a matching notice in the Federal Register.','PT-08c.','N/A','Determine if a matching notice is published in the Federal Register when a system or organization processes information for the purpose of conducting a matching program.'),\n('004601','draft','2022-03-04','DISA','policy','When a system or organization processes information for the purpose of conducting a matching program: independently verify the information produced by the matching program before taking adverse action against an individual, if required.','PT-08d.','N/A','Determine if the information produced by the matching program is independently verified before taking adverse action against an individual, if required, when a system or organization processes information for the purpose of conducting a matching program.'),\n('004602','draft','2022-03-04','DISA','policy','When a system or organization processes information for the purpose of conducting a matching program: provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual.','PT-08e.','N/A','Determine if: - individuals are provided with notice when a system or organization processes information for the purpose of conducting a matching program. - individuals are provided with an opportunity to contest the findings before adverse action is taken against them when a system or organization processes information for the purpose of conducting a matching program.'),\n('004603','draft','2022-03-04','DISA','policy','Develop and document an organization-level; mission/business process-level; system-level risk assessment policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','RA-01a.01(b)','N/A','Determine if the [RA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] risk assessment policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.'),\n('004604','draft','2022-03-04','DISA','policy','Disseminate an organization-level; mission/business process-level; system-level risk assessment policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines, to organization-defined personnel or roles.','RA-01a.01(b)','N/A','Determine if the [RA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] risk assessment policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.'),\n('004605','draft','2022-03-04','DISA','policy','Designate an organization-defined official to manage the development and documentation of the risk assessment policy.','RA-01b.','N/A','Determine if the [RA-01_ODP[04]; an official to manage the risk assessment policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures.'),\n('004606','draft','2022-03-04','DISA','policy','Designate an organization-defined official to manage the dissemination of the risk assessment policy.','RA-01b.','N/A','Determine if the [RA-01_ODP[04]; an official to manage the risk assessment policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures.'),\n('004607','draft','2022-03-04','DISA','policy','Designate an organization-defined official to manage development and documentation of the risk assessment procedures.','RA-01b.','N/A','Determine if the [RA-01_ODP[04]; an official to manage the risk assessment policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures.'),\n('004608','draft','2022-03-04','DISA','policy','Designate an organization-defined official to manage dissemination of the risk assessment procedures.','RA-01b.','N/A','Determine if the [RA-01_ODP[04]; an official to manage the risk assessment policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures.'),\n('004609','draft','2022-03-04','DISA','policy','Defines the official designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures.','RA-01b.','N/A','Determine if the [RA-01_ODP[04]; an official to manage the risk assessment policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures.'),\n('004610','draft','2022-03-04','DISA','policy','Review and update the current risk assessment policy following organization-defined events.','RA-01c.01','N/A','Determine if: - the current risk assessment policy is reviewed and updated [RA-01_ODP[05]; the frequency at which the current risk assessment policy is reviewed and updated is defined]. - the current risk assessment policy is reviewed and updated following [RA-01_ODP[06]; events that would require the current risk assessment policy to be reviewed and updated are defined].'),\n('004611','draft','2022-03-04','DISA','policy','Defines the events following reviewing and updating the current risk assessment policy.','RA-01c.01','N/A','Determine if: - the current risk assessment policy is reviewed and updated [RA-01_ODP[05]; the frequency at which the current risk assessment policy is reviewed and updated is defined]. - the current risk assessment policy is reviewed and updated following [RA-01_ODP[06]; events that would require the current risk assessment policy to be reviewed and updated are defined].'),\n('004612','draft','2022-03-04','DISA','policy','Review and update the current risk assessment procedures following organization-defined events.','RA-01c.02','N/A','Determine if: - the current risk assessment procedures are reviewed and updated [RA-01_ODP[07]; the frequency at which the current risk assessment procedures are reviewed and updated is defined]. - the current risk assessment procedures are reviewed and updated following [RA-01_ODP[08]; events that would require risk assessment procedures to be reviewed and updated are defined].'),\n('004613','draft','2022-03-04','DISA','policy','Defines the events following reviewing and updating the current risk assessment procedures.','RA-01c.02','N/A','Determine if: - the current risk assessment procedures are reviewed and updated [RA-01_ODP[07]; the frequency at which the current risk assessment procedures are reviewed and updated is defined]. - the current risk assessment procedures are reviewed and updated following [RA-01_ODP[08]; events that would require risk assessment procedures to be reviewed and updated are defined].'),\n('004614','draft','2022-03-04','DISA','policy','Categorize the system and information it processes.','RA-02a.','N/A','Determine if the system and the information it processes, stores, and transmits are categorized.'),\n('004615','draft','2022-03-04','DISA','policy','Categorize the system and information it stores.','RA-02a.','N/A','Determine if the system and the information it processes, stores, and transmits are categorized.'),\n('004616','draft','2022-03-04','DISA','policy','Categorize the system and information it transmits.','RA-02a.','N/A','Determine if the system and the information it processes, stores, and transmits are categorized.'),\n('004617','draft','2022-03-04','DISA','policy','Conduct a impact-level categorization of organizational systems to obtain additional granularity on system impact levels.','RA-02(01)','N/A','Determine if an impact-level prioritization of organizational systems is conducted to obtain additional granularity on system impact levels.'),\n('004618','draft','2022-03-04','DISA','policy','Conduct a risk assessment, including identifying threats to the system.','RA-03a.01','N/A','Determine if a risk assessment is conducted to identify threats to and vulnerabilities in the system.'),\n('004619','draft','2022-03-04','DISA','policy','Conduct a risk assessment, including identifying vulnerabilities in the system.','RA-03a.01','N/A','Determine if a risk assessment is conducted to identify threats to and vulnerabilities in the system.'),\n('004620','draft','2022-03-04','DISA','policy','Conduct a risk assessment, including determining the likelihood and impact of adverse effects on individuals arising from the processing of personally-identifiable information.','RA-03a.03','N/A','Determine if a risk assessment is conducted to determine the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information.'),\n('004621','draft','2022-03-04','DISA','policy','Integrate risk assessment results from the organization.','RA-03b.','N/A','Determine if risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments.'),\n('004622','draft','2022-03-04','DISA','policy','Integrate risk management decisions from the organization.','RA-03b.','N/A','Determine if risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments.'),\n('004623','draft','2022-03-04','DISA','policy','Integrate mission or business process perspectives with system-level risk assessments.','RA-03b.','N/A','Determine if risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments.'),\n('004624','draft','2022-03-04','DISA','policy','Assess supply chain risks associated with organization-defined systems, system components, and system services.','RA-03(01)(a)','N/A','Determine if supply chain risks associated with [RA-03(01)_ODP[01]; systems, system components, and system services to assess supply chain risks are defined] are assessed.'),\n('004625','draft','2022-03-04','DISA','policy','Defines the systems, system-components, and system services for assessing supply chain risks.','RA-03(01)(a)','N/A','Determine if supply chain risks associated with [RA-03(01)_ODP[01]; systems, system components, and system services to assess supply chain risks are defined] are assessed.'),\n('004626','draft','2022-03-04','DISA','policy','Update the supply chain risk assessment on an organization-defined frequency when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.','RA-03(01)(b)','N/A','Determine if the supply chain risk assessment is updated [RA-03(01)_ODP[02]; the frequency at which to update the supply chain risk assessment is defined], when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.'),\n('004627','draft','2022-03-04','DISA','policy','Defines the frequency for updating the supply chain assessment.','RA-03(01)(b)','N/A','Determine if the supply chain risk assessment is updated [RA-03(01)_ODP[02]; the frequency at which to update the supply chain risk assessment is defined], when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.'),\n('004628','draft','2022-03-04','DISA','policy','Use all-source intelligence to assist in the analysis of risk.','RA-03(02)','N/A','Determine if all-source intelligence is used to assist in the analysis of risk.'),\n('004629','draft','2022-03-04','DISA','policy','Determine the current cyber threat environment on an ongoing basis using organization-defined means.','RA-03(03)','N/A','Determine if the current cyber threat environment is determined on an ongoing basis using [RA-03(03)_ODP; means to determine the current cyber threat environment on an ongoing basis].'),\n('004630','draft','2022-03-04','DISA','policy','Defines the means for determining the current threat environment.','RA-03(03)','N/A','Determine if the current cyber threat environment is determined on an ongoing basis using [RA-03(03)_ODP; means to determine the current cyber threat environment on an ongoing basis].'),\n('004631','draft','2022-03-04','DISA','policy','Employ organization-defined advanced automation and analytics capabilities to predict and identify risks to organization-defined systems or system components.','RA-03(03)','N/A','Determine if the current cyber threat environment is determined on an ongoing basis using [RA-03(03)_ODP; means to determine the current cyber threat environment on an ongoing basis].'),\n('004632','draft','2022-03-04','DISA','policy','Defines the advanced automation and analytics capabilities for predicting and identifying risks to organization-defined systems or system components.','RA-03(04)','N/A','Determine if: - [RA-03(04)_ODP[01]; advanced automation capabilities to predict and identify risks are defined] are employed to predict and identify risks to [RA-03(04)_ODP[02]; systems or system components where advanced automation and analytics capabilities are to be employed are defined]. - [RA-03(04)_ODP[03]; advanced analytics capabilities to predict and identify risks are defined] are employed to predict and identify risks to [RA-03(04)_ODP[02]; systems or system components where advanced automation and analytics capabilities are to be employed are defined].'),\n('004633','draft','2022-03-04','DISA','policy','Defines the systems or system components for employing advanced automation and analytics capabilities.','RA-03(04)','N/A','Determine if: - [RA-03(04)_ODP[01]; advanced automation capabilities to predict and identify risks are defined] are employed to predict and identify risks to [RA-03(04)_ODP[02]; systems or system components where advanced automation and analytics capabilities are to be employed are defined]. - [RA-03(04)_ODP[03]; advanced analytics capabilities to predict and identify risks are defined] are employed to predict and identify risks to [RA-03(04)_ODP[02]; systems or system components where advanced automation and analytics capabilities are to be employed are defined].'),\n('004634','draft','2022-03-04','DISA','policy','Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: formatting checklists and test procedures.','RA-05b.02','N/A','Determine if vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for formatting checklists and test procedures.'),\n('004635','draft','2022-03-04','DISA','policy','Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: measuring vulnerability impact.','RA-05b.03','N/A','Determine if vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for measuring vulnerability impact.'),\n('004636','draft','2022-03-04','DISA','policy','Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.','RA-05f.','N/A','Determine if vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned are employed.'),\n('004637','draft','2022-03-04','DISA','policy','Defines the automated mechanisms for comparing the results of multiple vulnerability scans.','RA-05(06)','N/A','Determine if the results of multiple vulnerability scans are compared using [RA-05(06)_ODP; automated mechanisms to compare the results of multiple vulnerability scans are defined].'),\n('004638','draft','2022-03-04','DISA','policy','Defines the system in which will be identified for determining if a vulnerability has been exploited.','RA-05(08)','N/A','Determine if historic audit logs are reviewed to determine if a vulnerability identified in a [RA-05(08)_ODP[01]; a system whose historic audit logs are to be reviewed is defined] has been previously exploited within [RA-05(08)_ODP[02]; a time period for a potential previous exploit of a system is defined].'),\n('004639','draft','2022-03-04','DISA','policy','Defines the time period for reviewing historic audit logs to determine if a vulnerability identified has been exploited.','RA-05(08)','N/A','Determine if historic audit logs are reviewed to determine if a vulnerability identified in a [RA-05(08)_ODP[01]; a system whose historic audit logs are to be reviewed is defined] has been previously exploited within [RA-05(08)_ODP[02]; a time period for a potential previous exploit of a system is defined].'),\n('004640','draft','2022-03-04','DISA','policy','Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.','RA-05(11)','N/A','Determine if a public reporting channel is established for receiving reports of vulnerabilities in organizational systems and system components.'),\n('004641','draft','2022-03-04','DISA','policy','Respond to findings from security assessments.','RA-07','N/A','Determine if: - findings from security assessments are responded to in accordance with organizational risk tolerance. - findings from privacy assessments are responded to in accordance with organizational risk tolerance. - findings from monitoring are responded to in accordance with organizational risk tolerance. - findings from audits are responded to in accordance with organizational risk tolerance.'),\n('004642','draft','2022-03-04','DISA','policy','Respond to findings from privacy assessments.','RA-07','N/A','Determine if: - findings from security assessments are responded to in accordance with organizational risk tolerance. - findings from privacy assessments are responded to in accordance with organizational risk tolerance. - findings from monitoring are responded to in accordance with organizational risk tolerance. - findings from audits are responded to in accordance with organizational risk tolerance.'),\n('004643','draft','2022-03-04','DISA','policy','Respond to findings from monitoring.','RA-07','N/A','Determine if: - findings from security assessments are responded to in accordance with organizational risk tolerance. - findings from privacy assessments are responded to in accordance with organizational risk tolerance. - findings from monitoring are responded to in accordance with organizational risk tolerance. - findings from audits are responded to in accordance with organizational risk tolerance.'),\n('004644','draft','2022-03-04','DISA','policy','Respond to findings from audits in accordance with organizational risk tolerance.','RA-07','N/A','Determine if: - findings from security assessments are responded to in accordance with organizational risk tolerance. - findings from privacy assessments are responded to in accordance with organizational risk tolerance. - findings from monitoring are responded to in accordance with organizational risk tolerance. - findings from audits are responded to in accordance with organizational risk tolerance.'),\n('004645','draft','2022-03-04','DISA','policy','Conduct privacy impact assessments for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information.','RA-08a.','N/A','Determine if privacy impact assessments are conducted for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information.'),\n('004646','draft','2022-03-04','DISA','policy','Conduct privacy impact assessments for systems, programs, or other activities before initiating a new collection of personally identifiable information that will be processes using information technology.','RA-08b.','N/A','Determine if: - privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that will be processed using information technology. - privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.'),\n('004647','draft','2022-03-04','DISA','policy','Conduct privacy impact assessments for systems, programs, or other activities before initiating a new collection of personally identifiable information that includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more persons, other than agencies, instrumentalities, or employees of the Federal Government.','RA-08b.','N/A','Determine if: - privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that will be processed using information technology. - privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.'),\n('004648','draft','2022-03-04','DISA','policy','Identify critical system components and functions by performing a criticality analysis for organization-defined systems, system components, or system services at organization-defined decision points in the system development life cycle.','RA-09','N/A','Determine if critical system components and functions are identified by performing a criticality analysis for [RA-09_ODP[01]; systems, system components, or system services to be analyzed for criticality are defined] at [RA-09_ODP[02]; decision points in the system development life cycle when a criticality analysis is to be performed are defined].'),\n('004649','draft','2022-03-04','DISA','policy','Defines the system, system components, or system services to perform a criticality analysis for identifying critical system components and functions.','RA-09','N/A','Determine if critical system components and functions are identified by performing a criticality analysis for [RA-09_ODP[01]; systems, system components, or system services to be analyzed for criticality are defined] at [RA-09_ODP[02]; decision points in the system development life cycle when a criticality analysis is to be performed are defined].'),\n('004650','draft','2022-03-04','DISA','policy','Defines the decision points in the system development life cycle at which organization-defined system, system components, or system services to perform a criticality analysis for identifying critical system components and functions.','RA-09','N/A','Determine if critical system components and functions are identified by performing a criticality analysis for [RA-09_ODP[01]; systems, system components, or system services to be analyzed for criticality are defined] at [RA-09_ODP[02]; decision points in the system development life cycle when a criticality analysis is to be performed are defined].'),\n('004651','draft','2022-03-04','DISA','policy','Establish and maintain a cyber threat hunting capability to search for indicators of compromise in organizational systems.','RA-10a.01','N/A','Determine if a cyber threat capability is established and maintained to search for indicators of compromise in organizational systems.'),\n('004652','draft','2022-03-04','DISA','policy','Establish and maintain a cyber threat hunting capability to detect, track, and disrupt threats that evade existing controls.','RA-10a.02','N/A','Determine if a cyber threat capability is established and maintained to detect, track, and disrupt threats that evade existing controls.'),\n('004653','draft','2022-03-04','DISA','policy','Employ the threat hunting capability on an organization-defined frequency.','RA-10b.','N/A','Determine if the threat hunting capability is employed [RA-10_ODP; the frequency at which to employ the threat hunting capability is defined].'),\n('004654','draft','2022-03-04','DISA','policy','Defines the frequency for employing the threat hunting capability.','RA-10b.','N/A','Determine if the threat hunting capability is employed [RA-10_ODP; the frequency at which to employ the threat hunting capability is defined].'),\n('004655','draft','2022-03-04','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system-level system and services acquisition policy that is consistent with applicable laws, Executive Orders, directives, regulations, polices, standards, and guidelines.','SA-01a.01(b)','N/A','Determine if the [SA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] system and services acquisition policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('004656','draft','2022-03-04','DISA','policy','Designate an organization-defined official to manage development and documentation of the system and services acquisition policy.','SA-01b.','N/A','Determine if the [SA-01_ODP[04]; an official to manage the system and services acquisition policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures.'),\n('004657','draft','2022-03-04','DISA','policy','Designate an organization-defined official to manage dissemination of the system and services acquisition policy.','SA-01b.','N/A','Determine if the [SA-01_ODP[04]; an official to manage the system and services acquisition policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures.'),\n('004658','draft','2022-03-04','DISA','policy','Defines the official designated to manage development and documentation of the system and services acquisition policy.','SA-01b.','N/A','Determine if the [SA-01_ODP[04]; an official to manage the system and services acquisition policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures.'),\n('004659','draft','2022-03-04','DISA','policy','Designate an organization-defined official to manage the development and documentation of the system and services acquisition procedures.','SA-01b.','N/A','Determine if the [SA-01_ODP[04]; an official to manage the system and services acquisition policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures.'),\n('004660','draft','2022-03-04','DISA','policy','Designate an organization-defined official to manage the dissemination of the system and services acquisition procedures.','SA-01b.','N/A','Determine if the [SA-01_ODP[04]; an official to manage the system and services acquisition policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures.'),\n('004661','draft','2022-03-04','DISA','policy','Defines the official designated to manage the system and services acquisition procedures.','SA-01b.','N/A','Determine if the [SA-01_ODP[04]; an official to manage the system and services acquisition policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures.'),\n('004662','draft','2022-03-04','DISA','policy','Review and update the current system and services acquisition policy following organization-defined events.','SA-01c.01','N/A','Determine if: - the system and services acquisition policy is reviewed and updated [SA-01_ODP[05]; the frequency at which the current system and services acquisition policy is reviewed and updated is defined]. - the current system and services acquisition policy is reviewed and updated following [SA-01_ODP[06]; events that would require the current system and services acquisition policy to be reviewed and updated are defined].'),\n('004663','draft','2022-03-04','DISA','policy','Defines the events following reviewing and updating the current system and services acquisition policy.','SA-01c.01','N/A','Determine if: - the system and services acquisition policy is reviewed and updated [SA-01_ODP[05]; the frequency at which the current system and services acquisition policy is reviewed and updated is defined]. - the current system and services acquisition policy is reviewed and updated following [SA-01_ODP[06]; events that would require the current system and services acquisition policy to be reviewed and updated are defined].'),\n('004664','draft','2022-03-04','DISA','policy','Review and update the current system and services acquisition procedures following organization-defined events.','SA-01c.02','N/A','Determine if: - the current system and services acquisition procedures are reviewed and updated [SA-01_ODP[07]; the frequency at which the current system and services acquisition procedures are reviewed and updated is defined]. - the current system and services acquisition procedures are reviewed and updated following [SA-01_ODP[08]; events that would require the system and services acquisition procedures to be reviewed and updated are defined].'),\n('004665','draft','2022-03-04','DISA','policy','Defines the events following reviewing and updating the current system and services acquisition procedures.','SA-01c.02','N/A','Determine if: - the current system and services acquisition procedures are reviewed and updated [SA-01_ODP[07]; the frequency at which the current system and services acquisition procedures are reviewed and updated is defined]. - the current system and services acquisition procedures are reviewed and updated following [SA-01_ODP[08]; events that would require the system and services acquisition procedures to be reviewed and updated are defined].'),\n('004666','draft','2022-03-04','DISA','policy','Determine the high-level information privacy requirements for the system or system service in mission and business process planning.','SA-02a.','N/A','Determine if: - the high-level information security requirements for the system or system service are determined in mission and business process planning. - the high-level privacy requirements for the system or system service are determined in mission and business process planning.'),\n('004667','draft','2022-03-04','DISA','policy','Establish a discrete line item for information privacy in organizational programming documentation.','SA-02c.','N/A','Determine if: - a discrete line item for information security is established in organizational programming and budgeting documentation. - a discrete line item for privacy is established in organizational programming and budgeting documentation.'),\n('004668','draft','2022-03-04','DISA','policy','Establish a discrete line item for information privacy in organizational budgeting documentation.','SA-02c.','N/A','Determine if: - a discrete line item for information security is established in organizational programming and budgeting documentation. - a discrete line item for privacy is established in organizational programming and budgeting documentation.'),\n('004669','draft','2022-03-04','DISA','policy','Acquire the system using an organization-defined system development life cycle that incorporates information security considerations.','SA-03a.','N/A','Determine if: - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates information security considerations. - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates privacy considerations.'),\n('004670','draft','2022-03-04','DISA','policy','Acquire the system using an organization-defined system development life cycle that incorporates information privacy considerations.','SA-03a.','N/A','Determine if: - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates information security considerations. - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates privacy considerations.'),\n('004671','draft','2022-03-04','DISA','policy','Develop the system using an organization-defined system development life cycle that incorporates information security considerations.','SA-03a.','N/A','Determine if: - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates information security considerations. - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates privacy considerations.'),\n('004672','draft','2022-03-04','DISA','policy','Develop the system using an organization-defined system development life cycle that incorporates information privacy considerations.','SA-03a.','N/A','Determine if: - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates information security considerations. - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates privacy considerations.'),\n('004673','draft','2022-03-04','DISA','policy','Manage the system using an organization-defined system development life cycle that incorporates information privacy considerations.','SA-03a.','N/A','Determine if: - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates information security considerations. - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates privacy considerations.'),\n('004674','draft','2022-03-04','DISA','policy','Defines a system development life cycle that is used to develop the system.','SA-03a.','N/A','Determine if: - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates information security considerations. - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates privacy considerations.'),\n('004675','draft','2022-03-04','DISA','policy','Defines a system development life cycle that is used to acquire the system.','SA-03a.','N/A','Determine if: - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates information security considerations. - the system is acquired, developed, and managed using [SA-03_ODP; system development life cycle is defined] that incorporates privacy considerations.'),\n('004676','draft','2022-03-04','DISA','policy','Define and document information system privacy roles and responsibilities throughout the system development life cycle.','SA-03b.','N/A','Determine if: - information security roles and responsibilities are defined and documented throughout the system development life cycle. - privacy roles and responsibilities are defined and documented throughout the system development life cycle.'),\n('004677','draft','2022-03-04','DISA','policy','Identify individuals having information system privacy roles and responsibilities.','SA-03c.','N/A','Determine if: - individuals with information security roles and responsibilities are identified. - individuals with privacy roles and responsibilities are identified.'),\n('004678','draft','2022-03-04','DISA','policy','Integrate the organizational information privacy risk management process into system development life cycle activities.','SA-03d.','N/A','Determine if: - organizational information security risk management processes are integrated into system development life cycle activities. - organizational privacy risk management processes are integrated into system development life cycle activities.'),\n('004679','draft','2022-03-04','DISA','policy','Protect system preproduction environments commensurate with risk throughout the system development life cycle for the system, system component, or system service.','SA-03(01)','N/A','Determine if system pre-production environments are protected commensurate with risk throughout the system development life cycle for the system, system component, or system service.'),\n('004680','draft','2022-03-04','DISA','policy','Approve the use of live data in preproduction environments for the system, system component, or system service.','SA-03(02)(a)','N/A','Determine if: - the use of live data in pre-production environments is approved for the system, system component, or system service. - the use of live data in pre-production environments is documented for the system, system component, or system service. - the use of live data in pre-production environments is controlled for the system, system component, or system service.'),\n('004681','draft','2022-03-04','DISA','policy','Document the use of live data in preproduction environments for the system, system component, or system service.','SA-03(02)(a)','N/A','Determine if: - the use of live data in pre-production environments is approved for the system, system component, or system service. - the use of live data in pre-production environments is documented for the system, system component, or system service. - the use of live data in pre-production environments is controlled for the system, system component, or system service.'),\n('004682','draft','2022-03-04','DISA','policy','Control the use of live data in preproduction environments for the system, system component, or system service.','SA-03(02)(a)','N/A','Determine if: - the use of live data in pre-production environments is approved for the system, system component, or system service. - the use of live data in pre-production environments is documented for the system, system component, or system service. - the use of live data in pre-production environments is controlled for the system, system component, or system service.'),\n('004683','draft','2022-03-04','DISA','policy','Protect preproduction environments for the system, system component, or system service at the same impact or classification level as any live data in use within the preproduction environments.','SA-03(02)(b)','N/A','Determine if pre-production environments for the system, system component, or system service are protected at the same impact or classification level as any live data in use within the pre-production environments.'),\n('004684','draft','2022-03-04','DISA','policy','Plan for a technology refresh schedule to support the system throughout the system development life cycle.','SA-03(03)','N/A','Determine if: - a technology refresh schedule is planned for the system throughout the system development life cycle. - a technology refresh schedule is implemented for the system throughout the system development life cycle.'),\n('004685','draft','2022-03-04','DISA','policy','Implement technology refresh schedule to support the system throughout the system development life cycle.','SA-03(03)','N/A','Determine if: - a technology refresh schedule is planned for the system throughout the system development life cycle. - a technology refresh schedule is implemented for the system throughout the system development life cycle.'),\n('004686','draft','2022-03-04','DISA','policy','Defines the organization-defined contract language for including the requirements, descriptions, and criteria in the acquisition contract for the system, system component, or system service.',NULL,'N/A',NULL),\n('004687','draft','2022-03-04','DISA','policy','Include the privacy functional requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04a.','N/A','Determine if: - security functional requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - privacy functional requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.'),\n('004688','draft','2022-03-04','DISA','policy','Include the privacy assurance requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04c.','N/A','Determine if: - security assurance requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - privacy assurance requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.'),\n('004689','draft','2022-03-04','DISA','policy','Include the controls needed to satisfy security requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04d.','N/A','Determine if: - controls needed to satisfy the security requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - controls needed to satisfy the privacy requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.'),\n('004690','draft','2022-03-04','DISA','policy','Include the controls needed to satisfy privacy requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04d.','N/A','Determine if: - controls needed to satisfy the security requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - controls needed to satisfy the privacy requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.'),\n('004691','draft','2022-03-04','DISA','policy','Include the privacy documentation requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04e.','N/A','Determine if: - security documentation requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - privacy documentation requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.'),\n('004692','deprecated','2022-03-04','DISA','policy','Include the requirements for protecting security documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04f.','N/A','Determine if: - requirements for protecting security documentation, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - requirements for protecting privacy documentation, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.'),\n('004693','draft','2022-03-04','DISA','policy','Include the requirements for protecting privacy documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04f.','N/A','Determine if: - requirements for protecting security documentation, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - requirements for protecting privacy documentation, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service.'),\n('004694','draft','2022-03-04','DISA','policy','Include the allocation of responsibility or identification of parties responsible for information security, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04h.','N/A','Determine if: - the allocation of responsibility or identification of parties responsible for information security requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - the allocation of responsibility or identification of parties responsible for privacy requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}]. - the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}].'),\n('004695','draft','2022-03-04','DISA','policy','Include the allocation of responsibility or identification of parties responsible for information privacy, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04h.','N/A','Determine if: - the allocation of responsibility or identification of parties responsible for information security requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - the allocation of responsibility or identification of parties responsible for privacy requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}]. - the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}].'),\n('004696','draft','2022-03-04','DISA','policy','Include the allocation of responsibility or identification of parties responsible for supply chain risk management, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service.','SA-04h.','N/A','Determine if: - the allocation of responsibility or identification of parties responsible for information security requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}] in the acquisition contract for the system, system component, or system service. - the allocation of responsibility or identification of parties responsible for privacy requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}]. - the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions, and criteria are included explicitly or by reference using [SA-04_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; [SA-04_ODP[02]; contract language is defined (if selected)]}].'),\n('004697','draft','2022-03-04','DISA','policy','Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined systems engineering methods.','SA-04(03)(a)','N/A','Determine if the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [SA-04(03)_ODP[01]; systems engineering methods are defined].'),\n('004698','draft','2022-03-04','DISA','policy','Defines the systems engineering methods for demonstrating the use of a system development life cycle process.','SA-04(03)(a)','N/A','Determine if the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [SA-04(03)_ODP[01]; systems engineering methods are defined].'),\n('004699','draft','2022-03-04','DISA','policy','Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined system security engineering methods and/or privacy engineering methods.','SA-04(03)(b)','N/A','Determine if the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [SA-04(03)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[SA-04(03)_ODP[03]; system security engineering methods are defined (if selected)]; [SA-04(03)_ODP[04]; privacy engineering methods are defined (if selected)]}].'),\n('004700','draft','2022-03-04','DISA','policy','Defines the system security engineering methods and/or privacy engineering methods for demonstrating the use of a system development life cycle process.','SA-04(03)(b)','N/A','Determine if the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [SA-04(03)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[SA-04(03)_ODP[03]; system security engineering methods are defined (if selected)]; [SA-04(03)_ODP[04]; privacy engineering methods are defined (if selected)]}].'),\n('004701','draft','2022-03-04','DISA','policy','Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined software development methods; testing; evaluation, assessment, verification, and validation methods, and quality control processes.','SA-04(03)(c)','N/A','Determine if the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [SA-04(03)_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {[SA-04(03)_ODP[06]; software development methods are defined (if selected)]; [SA-04(03)_ODP[07]; testing, evaluation, assessment, verification, and validation methods are defined (if selected)]; [SA-04(03)_ODP[08]; quality control processes are defined (if selected)]}].'),\n('004702','draft','2022-03-04','DISA','policy','Defines the software development methods; testing; evaluation, assessment, verification, and validation methods, and quality control processes for demonstrating the use of a system development life cycle process.','SA-04(03)(c)','N/A','Determine if the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes [SA-04(03)_ODP[05]; one or more of the following PARAMETER VALUES is/are selected: {[SA-04(03)_ODP[06]; software development methods are defined (if selected)]; [SA-04(03)_ODP[07]; testing, evaluation, assessment, verification, and validation methods are defined (if selected)]; [SA-04(03)_ODP[08]; quality control processes are defined (if selected)]}].'),\n('004703','draft','2022-03-04','DISA','policy','Include organization-defined Privacy Act requirements in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.','SA-04(11)','N/A','Determine if [SA-04(11)_ODP; Privacy Act requirements for the operation of a system of records are defined] are defined in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.'),\n('004704','draft','2022-03-04','DISA','policy','Defines the Privacy Act requirements to include in the acquisition contract.','SA-04(11)','N/A','Determine if [SA-04(11)_ODP; Privacy Act requirements for the operation of a system of records are defined] are defined in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.'),\n('004705','draft','2022-03-04','DISA','policy','Include organizational data ownership requirements in the acquisition contract.','SA-04(12)(a)','N/A','Determine if organizational data ownership requirements are included in the acquisition contract.'),\n('004706','draft','2022-03-04','DISA','policy','Require all data to be removed from the contractor''s system and returned to the organization within an organization-defined time frame.','SA-04(12)(b)','N/A','Determine if all data to be removed from the contractor''s system and returned to the organization is required within [SA-04(12)_ODP; time frame to remove data from a contractor system and return it to the organization is defined].'),\n('004707','draft','2022-03-04','DISA','policy','Defines the time frame for returning the data removed from the contractor''s system.','SA-04(12)(b)','N/A','Determine if all data to be removed from the contractor''s system and returned to the organization is required within [SA-04(12)_ODP; time frame to remove data from a contractor system and return it to the organization is defined].'),\n('004708','draft','2022-03-04','DISA','policy','Obtain or develop administrator documentation for the system, system component, or system services that describes effective use and maintenance of privacy functions and mechanisms.','SA-05a.02','N/A','Determine if: - administrator documentation for the system, system component, or system service that describes the effective use of security functions and mechanisms is obtained or developed. - administrator documentation for the system, system component, or system service that describes the effective maintenance of security functions and mechanisms is obtained or developed. - administrator documentation for the system, system component, or system service that describes the effective use of privacy functions and mechanisms is obtained or developed. - administrator documentation for the system, system component, or system service that describes the effective maintenance of privacy functions and mechanisms is obtained or developed.'),\n('004709','draft','2022-03-04','DISA','policy','Obtain or develop user documentation for the system, system component, or system service that describes user-accessible privacy functions and mechanisms and how to effectively use those functions and mechanisms.','SA-05b.01','N/A','Determine if: - user documentation for the system, system component, or system service that describes user-accessible security functions and mechanisms is obtained or developed. - user documentation for the system, system component, or system service that describes how to effectively use those (user-accessible security) functions and mechanisms is obtained or developed. - user documentation for the system, system component, or system service that describes user-accessible privacy functions and mechanisms is obtained or developed. - user documentation for the system, system component, or system service that describes how to effectively use those (user-accessible privacy) functions and mechanisms is obtained or developed.'),\n('004710','draft','2022-03-04','DISA','policy','Obtain or develop user documentation for the system, system component, or system service that describes methods for user interaction which enables individuals to protect individual privacy.','SA-05b.02','N/A','Determine if: - user documentation for the system, system component, or system service that describes methods for user interaction, which enable individuals to use the system, component, or service in a more secure manner is obtained or developed. - user documentation for the system, system component, or system service that describes methods for user interaction, which enable individuals to use the system, component, or service to protect individual privacy is obtained or developed.'),\n('004711','draft','2022-03-04','DISA','policy','Obtain or develop user documentation for the system, system component, or system service that describes user responsibilities in maintaining the privacy of individuals.','SA-05b.03','N/A','Determine if: - user documentation for the system, system component, or system service that describes user responsibilities for maintaining the security of the system, component, or service is obtained or developed. - user documentation for the system, system component, or system service that describes user responsibilities for maintaining the privacy of individuals is obtained or developed.'),\n('004712','draft','2022-03-04','DISA','policy','Defines the systems security and privacy engineering principles applied to the specification of the system and system components.','SA-08','N/A','Determine if: - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the development of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the modification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the development of the system and system components.  - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the modification of the system and system components.'),\n('004713','draft','2022-03-04','DISA','policy','Defines the systems security engineering principles applied to the design of the system and system components.','SA-08','N/A','Determine if: - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the development of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the modification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the development of the system and system components.  - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the modification of the system and system components.'),\n('004714','draft','2022-03-04','DISA','policy','Defines the systems security engineering principles applied to the development of the system and system components.','SA-08','N/A','Determine if: - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the development of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the modification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the development of the system and system components.  - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the modification of the system and system components.'),\n('004715','draft','2022-03-04','DISA','policy','Defines the systems security engineering principles applied to the implementation of the system and system components.','SA-08','N/A','Determine if: - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the development of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the modification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the development of the system and system components.  - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the modification of the system and system components.'),\n('004716','draft','2022-03-04','DISA','policy','Defines the systems security engineering principles applied to the modification of the system and system components.','SA-08','N/A','Determine if: - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the development of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[01]; systems security engineering principles are defined] are applied in the modification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the specification of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the design of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the development of the system and system components.  - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the implementation of the system and system components. - [SA-08_ODP[02]; privacy engineering principles are defined] are applied in the modification of the system and system components.'),\n('004717','draft','2022-03-04','DISA','policy','Implement the security design principle of clear abstractions.','SA-08(01)','N/A','Determine if the security design principle of clear abstractions is implemented.'),\n('004718','draft','2022-03-04','DISA','policy','Implement the security design principle of least common mechanism in organization-defined systems or system components.','SA-08(02)','N/A','Determine if [SA-08(02)_ODP; systems or system components that implement the security design principle of least common mechanism are defined] implement the security design principle of least common mechanism.'),\n('004719','draft','2022-03-04','DISA','policy','Defines the systems or system components which will implement the security design principle of least common mechanism.','SA-08(02)','N/A','Determine if [SA-08(02)_ODP; systems or system components that implement the security design principle of least common mechanism are defined] implement the security design principle of least common mechanism.'),\n('004720','draft','2022-03-04','DISA','policy','Implement the security design principles of modularity and layering in organization-defined systems or system components.','SA-08(03)','N/A','Determine if: - [SA-08(03)_ODP[01]; systems or system components that implement the security design principle of modularity are defined] implement the security design principle of modularity. - [SA-08(03)_ODP[02]; systems or system components that implement the security design principle of layering are defined] implement the security design principle of layering.'),\n('004721','draft','2022-03-04','DISA','policy','Defines the systems or system components which will implement the security design principles of modularity and layering.','SA-08(03)','N/A','Determine if: - [SA-08(03)_ODP[01]; systems or system components that implement the security design principle of modularity are defined] implement the security design principle of modularity. - [SA-08(03)_ODP[02]; systems or system components that implement the security design principle of layering are defined] implement the security design principle of layering.'),\n('004722','draft','2022-03-04','DISA','policy','Implement the security design principle of partially ordered dependencies in organization-defined systems or system components.','SA-08(04)','N/A','Determine if [SA-08(04)_ODP; systems or system components that implement the security design principle of partially ordered dependencies are defined] implement the security design principle of partially ordered dependencies.'),\n('004723','draft','2022-03-04','DISA','policy','Defines the systems or system components which will implement the security design principle of partially ordered dependencies.','SA-08(04)','N/A','Determine if [SA-08(04)_ODP; systems or system components that implement the security design principle of partially ordered dependencies are defined] implement the security design principle of partially ordered dependencies.'),\n('004724','draft','2022-03-04','DISA','policy','Implement the security design principle of efficiently mediated access in organization-defined systems or system components.','SA-08(05)','N/A','Determine if [SA-08(05)_ODP; systems or system components that implement the security design principle of efficiently mediated access are defined] implement the security design principle of efficiently mediated access.'),\n('004725','draft','2022-03-04','DISA','policy','Defines the systems or system components which will implement the security design principle of efficiently mediated access.','SA-08(05)','N/A','Determine if [SA-08(05)_ODP; systems or system components that implement the security design principle of efficiently mediated access are defined] implement the security design principle of efficiently mediated access.'),\n('004726','draft','2022-03-04','DISA','policy','Implement the security design principle of minimized sharing in organization-defined systems or system components.','SA-08(06)','N/A','Determine if [SA-08(06)_ODP; systems or system components that implement the security design principle of minimized sharing are defined] implement the security design principle of minimized sharing.'),\n('004727','draft','2022-03-04','DISA','policy','Defines the systems or system components which will implement the security design principle of minimized sharing.','SA-08(06)','N/A','Determine if [SA-08(06)_ODP; systems or system components that implement the security design principle of minimized sharing are defined] implement the security design principle of minimized sharing.'),\n('004728','draft','2022-03-04','DISA','policy','Implement the security design principle of reduced complexity in organization-defined systems or system components.','SA-08(07)','N/A','Determine if [SA-08(07)_ODP; systems or system components that implement the security design principle of reduced complexity are defined] implement the security design principle of reduced complexity.'),\n('004729','draft','2022-03-04','DISA','policy','Defines the systems or system components which will implement the security design principle of reduced complexity.','SA-08(07)','N/A','Determine if [SA-08(07)_ODP; systems or system components that implement the security design principle of reduced complexity are defined] implement the security design principle of reduced complexity.'),\n('004730','draft','2022-03-04','DISA','policy','Implement the security design principle of secure evolvability in organization-defined systems or system components.','SA-08(08)','N/A','Determine if [SA-08(08)_ODP; systems or system components that implement the security design principle of secure evolvability are defined] implement the security design principle of secure evolvability.'),\n('004731','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of secure evolvability.','SA-08(08)','N/A','Determine if [SA-08(08)_ODP; systems or system components that implement the security design principle of secure evolvability are defined] implement the security design principle of secure evolvability.'),\n('004732','draft','2022-03-07','DISA','policy','Implement the security design principle of trusted components in organization-defined systems or system components.','SA-08(09)','N/A','Determine if [SA-08(09)_ODP; systems or system components that implement the security design principle of trusted components are defined] implement the security design principle of trusted components.'),\n('004733','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of trusted components.','SA-08(09)','N/A','Determine if [SA-08(09)_ODP; systems or system components that implement the security design principle of trusted components are defined] implement the security design principle of trusted components.'),\n('004734','draft','2022-03-07','DISA','policy','Implement the security design principle of hierarchical trust in organization-defined systems or system components.','SA-08(10)','N/A','Determine if [SA-08(10)_ODP; systems or system components that implement the security design principle of hierarchical trust are defined] implement the security design principle of hierarchical trust.'),\n('004735','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of hierarchical trust.','SA-08(10)','N/A','Determine if [SA-08(10)_ODP; systems or system components that implement the security design principle of hierarchical trust are defined] implement the security design principle of hierarchical trust.'),\n('004736','draft','2022-03-07','DISA','policy','Implement the security design principle of inverse modification threshold in organization-defined systems or system components.','SA-08(11)','N/A','Determine if [SA-08(11)_ODP; systems or system components that implement the security design principle of inverse modification threshold are defined] implement the security design principle of inverse modification threshold.'),\n('004737','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of inverse modification threshold.','SA-08(11)','N/A','Determine if [SA-08(11)_ODP; systems or system components that implement the security design principle of inverse modification threshold are defined] implement the security design principle of inverse modification threshold.'),\n('004738','draft','2022-03-07','DISA','policy','Implement the security design principle of hierarchical protection in organization-defined systems or system components.','SA-08(12)','N/A','Determine if [SA-08(12)_ODP; systems or system components that implement the security design principle of hierarchical protection are defined] implement the security design principle of hierarchical protection.'),\n('004739','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of hierarchical protection.','SA-08(12)','N/A','Determine if [SA-08(12)_ODP; systems or system components that implement the security design principle of hierarchical protection are defined] implement the security design principle of hierarchical protection.'),\n('004740','draft','2022-03-07','DISA','policy','Implement the security design principle of minimized security elements in organization-defined systems or system components.','SA-08(13)','N/A','Determine if [SA-08(13)_ODP; systems or system components that implement the security design principle of minimized security elements are defined] implement the security design principle of minimized security elements.'),\n('004741','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of minimized security elements.','SA-08(13)','N/A','Determine if [SA-08(13)_ODP; systems or system components that implement the security design principle of minimized security elements are defined] implement the security design principle of minimized security elements.'),\n('004742','draft','2022-03-07','DISA','policy','Implement the security design principle of least privilege in organization-defined systems or system components.','SA-08(14)','N/A','Determine if [SA-08(14)_ODP; systems or system components that implement the security design principle of least privilege are defined] implement the security design principle of least privilege.'),\n('004743','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of least privilege.','SA-08(14)','N/A','Determine if [SA-08(14)_ODP; systems or system components that implement the security design principle of least privilege are defined] implement the security design principle of least privilege.'),\n('004744','draft','2022-03-07','DISA','policy','Implement the security design principle of predicate permission in organization-defined systems or system components.','SA-08(15)','N/A','Determine if [SA-08(15)_ODP; systems or system components that implement the security design principle of predicate permission are defined] implement the security design principle of predicate permission.'),\n('004745','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of predicate permission.','SA-08(15)','N/A','Determine if [SA-08(15)_ODP; systems or system components that implement the security design principle of predicate permission are defined] implement the security design principle of predicate permission.'),\n('004746','draft','2022-03-07','DISA','policy','Implement the security design principle of self-reliant trustworthiness in organization-defined systems or system components.','SA-08(16)','N/A','Determine if [SA-08(16)_ODP; systems or system components that implement the security design principle of self-reliant trustworthiness are defined] implement the security design principle of self-reliant trustworthiness.'),\n('004747','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of self-reliant trustworthiness.','SA-08(16)','N/A','Determine if [SA-08(16)_ODP; systems or system components that implement the security design principle of self-reliant trustworthiness are defined] implement the security design principle of self-reliant trustworthiness.'),\n('004748','draft','2022-03-07','DISA','policy','Implement the security design principle of secure distributed composition in organization-defined systems or system components.','SA-08(17)','N/A','Determine if [SA-08(17)_ODP; systems or system components that implement the security design principle of secure distributed composition are defined] implement the security design principle of secure distributed composition.'),\n('004749','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of secure distributed composition.','SA-08(17)','N/A','Determine if [SA-08(17)_ODP; systems or system components that implement the security design principle of secure distributed composition are defined] implement the security design principle of secure distributed composition.'),\n('004750','draft','2022-03-07','DISA','policy','Implement the security design principle of trusted communication channels in organization-defined systems or system components.','SA-08(18)','N/A','Determine if [SA-08(18)_ODP; systems or system components that implement the security design principle of trusted communications channels are defined] implement the security design principle of trusted communications channels.'),\n('004751','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of trusted communication channels.','SA-08(18)','N/A','Determine if [SA-08(18)_ODP; systems or system components that implement the security design principle of trusted communications channels are defined] implement the security design principle of trusted communications channels.'),\n('004752','draft','2022-03-07','DISA','policy','Implement the security design principle of continuous protection in organization-defined systems or system components.','SA-08(19)','N/A','Determine if [SA-08(19)_ODP; systems or system components that implement the security design principle of continuous protection are defined] implement the security design principle of continuous protection.'),\n('004753','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of continuous protection.','SA-08(19)','N/A','Determine if [SA-08(19)_ODP; systems or system components that implement the security design principle of continuous protection are defined] implement the security design principle of continuous protection.'),\n('004754','draft','2022-03-07','DISA','policy','Implement the security design principle of secure metadata management in organization-defined systems or system components.','SA-08(20)','N/A','Determine if [SA-08(20)_ODP; systems or system components that implement the security design principle of secure metadata management are defined] implement the security design principle of secure metadata management.'),\n('004755','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of secure metadata management.','SA-08(20)','N/A','Determine if [SA-08(20)_ODP; systems or system components that implement the security design principle of secure metadata management are defined] implement the security design principle of secure metadata management.'),\n('004756','draft','2022-03-07','DISA','policy','Implement the security design principle of self-analysis in organization-defined systems or system components.','SA-08(21)','N/A','Determine if [SA-08(21)_ODP; systems or system components that implement the security design principle of self-analysis are defined] implement the security design principle of self-analysis.'),\n('004757','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of self-analysis.','SA-08(21)','N/A','Determine if [SA-08(21)_ODP; systems or system components that implement the security design principle of self-analysis are defined] implement the security design principle of self-analysis.'),\n('004758','draft','2022-03-07','DISA','policy','Implement the security design principle of accountability and traceability in organization-defined systems or system components.','SA-08(22)','N/A','Determine if: - [SA-08(22)_ODP[01]; systems or system components that implement the security design principle of accountability are defined] implement the security design principle of accountability. - [SA-08(22)_ODP[02]; systems or system components that implement the security design principle of traceability are defined] implement the security design principle of traceability.'),\n('004759','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of accountability and traceability.','SA-08(22)','N/A','Determine if: - [SA-08(22)_ODP[01]; systems or system components that implement the security design principle of accountability are defined] implement the security design principle of accountability. - [SA-08(22)_ODP[02]; systems or system components that implement the security design principle of traceability are defined] implement the security design principle of traceability.'),\n('004760','draft','2022-03-07','DISA','policy','Implement the security design principle of secure defaults in organization-defined systems or system components.','SA-08(23)','N/A','Determine if [SA-08(23)_ODP; systems or system components that implement the security design principle of secure defaults are defined] implement the security design principle of secure defaults.'),\n('004761','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of secure defaults.','SA-08(23)','N/A','Determine if [SA-08(23)_ODP; systems or system components that implement the security design principle of secure defaults are defined] implement the security design principle of secure defaults.'),\n('004762','draft','2022-03-07','DISA','policy','Implement the security design principle of secure failure and recovery in organization-defined systems or system components.','SA-08(24)','N/A','Determine if: - [SA-08(24)_ODP[01]; systems or system components that implement the security design principle of secure failure are defined] implement the security design principle of secure failure. - [SA-08(24)_ODP[02]; systems or system components that implement the security design principle of secure recovery are defined] implement the security design principle of secure recovery. '),\n('004763','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of secure failure and recovery.','SA-08(24)','N/A','Determine if: - [SA-08(24)_ODP[01]; systems or system components that implement the security design principle of secure failure are defined] implement the security design principle of secure failure. - [SA-08(24)_ODP[02]; systems or system components that implement the security design principle of secure recovery are defined] implement the security design principle of secure recovery. '),\n('004764','draft','2022-03-07','DISA','policy','Implement the security design principle of economic security in organization-defined systems or system components.','SA-08(25)','N/A','Determine if [SA-08(25)_ODP; systems or system components that implement the security design principle of economic security are defined] implement the security design principle of economic security.'),\n('004765','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of economic security.','SA-08(25)','N/A','Determine if [SA-08(25)_ODP; systems or system components that implement the security design principle of economic security are defined] implement the security design principle of economic security.'),\n('004766','draft','2022-03-07','DISA','policy','Implement the security design principle of performance security in organization-defined systems or system components.','SA-08(26)','N/A','Determine if [SA-08(26)_ODP; systems or system components that implement the security design principle of performance security are defined] implement the security design principle of performance security.'),\n('004767','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of performance security.','SA-08(26)','N/A','Determine if [SA-08(26)_ODP; systems or system components that implement the security design principle of performance security are defined] implement the security design principle of performance security.'),\n('004768','draft','2022-03-07','DISA','policy','Implement the security design principle of human factored security in organization-defined systems or system components.','SA-08(27)','N/A','Determine if [SA-08(27)_ODP; systems or system components that implement the security design principle of human factored security are defined] implement the security design principle of human factored security.'),\n('004769','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of human factored security.','SA-08(27)','N/A','Determine if [SA-08(27)_ODP; systems or system components that implement the security design principle of human factored security are defined] implement the security design principle of human factored security.'),\n('004770','draft','2022-03-07','DISA','policy','Implement the security design principle of acceptable security in organization-defined systems or system components.','SA-08(28)','N/A','Determine if [SA-08(28)_ODP; systems or system components that implement the security design principle of acceptable security are defined] implement the security design principle of acceptable security.'),\n('004771','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of acceptable security.','SA-08(28)','N/A','Determine if [SA-08(28)_ODP; systems or system components that implement the security design principle of acceptable security are defined] implement the security design principle of acceptable security.'),\n('004772','draft','2022-03-07','DISA','policy','Implement the security design principle of repeatable and documented procedures in organization-defined systems or system components.','SA-08(29)','N/A','Determine if [SA-08(29)_ODP; systems or system components that implement the security design principle of repeatable and documented procedures are defined] implement the security design principle of repeatable and documented procedures.'),\n('004773','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of repeatable and documented procedures.','SA-08(29)','N/A','Determine if [SA-08(29)_ODP; systems or system components that implement the security design principle of repeatable and documented procedures are defined] implement the security design principle of repeatable and documented procedures.'),\n('004774','draft','2022-03-07','DISA','policy','Implement the security design principle of procedural rigor in organization-defined systems or system components.','SA-08(30)','N/A','Determine if [SA-08(30)_ODP; systems or system components that implement the security design principle of procedural rigor are defined] implement the security design principle of procedural rigor.'),\n('004775','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of procedural rigor.','SA-08(30)','N/A','Determine if [SA-08(30)_ODP; systems or system components that implement the security design principle of procedural rigor are defined] implement the security design principle of procedural rigor.'),\n('004776','draft','2022-03-07','DISA','policy','Implement the security design principle of secure system modification in organization-defined systems or system components.','SA-08(31)','N/A','Determine if [SA-08(31)_ODP; systems or system components that implement the security design principle of secure system modification are defined] implement the security design principle of secure system modification.'),\n('004777','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of secure system modification.','SA-08(31)','N/A','Determine if [SA-08(31)_ODP; systems or system components that implement the security design principle of secure system modification are defined] implement the security design principle of secure system modification.'),\n('004778','draft','2022-03-07','DISA','policy','Implement the security design principle of sufficient documentation in organization-defined systems or system components.','SA-08(32)','N/A','Determine if [SA-08(32)_ODP; systems or system components that implement the security design principle of sufficient documentation are defined] implement the security design principle of sufficient documentation.'),\n('004779','draft','2022-03-07','DISA','policy','Defines the systems or system components which will implement the security design principle of sufficient documentation.','SA-08(32)','N/A','Determine if [SA-08(32)_ODP; systems or system components that implement the security design principle of sufficient documentation are defined] implement the security design principle of sufficient documentation.'),\n('004780','draft','2022-03-07','DISA','policy','Implement the privacy principle of minimization using organization-defined processes.','SA-08(33)','N/A','Determine if the privacy principle of minimization is implemented using [SA-08(33)_ODP; processes that implement the privacy principle of minimization are defined].'),\n('004781','draft','2022-03-07','DISA','policy','Defines the processes for implementing the privacy principle of minimization.','SA-08(33)','N/A','Determine if the privacy principle of minimization is implemented using [SA-08(33)_ODP; processes that implement the privacy principle of minimization are defined].'),\n('004782','draft','2022-03-07','DISA','policy','Require that providers of external system services comply with organizational privacy requirements.','SA-09a.','N/A','Determine if: - providers of external system services comply with organizational security requirements. - providers of external system services comply with organizational privacy requirements. - providers of external system services employ [SA-09_ODP[01]; controls to be employed by external system service providers are defined].'),\n('004783','draft','2022-03-07','DISA','policy','Require that providers of external system services employ organization-defined controls.','SA-09a.','N/A','Determine if: - providers of external system services comply with organizational security requirements. - providers of external system services comply with organizational privacy requirements. - providers of external system services employ [SA-09_ODP[01]; controls to be employed by external system service providers are defined].'),\n('004784','draft','2022-03-07','DISA','policy','Defines the controls for complying with organizational security and privacy requirements.','SA-09a.','N/A','Determine if: - providers of external system services comply with organizational security requirements. - providers of external system services comply with organizational privacy requirements. - providers of external system services employ [SA-09_ODP[01]; controls to be employed by external system service providers are defined].'),\n('004785','draft','2022-03-07','DISA','policy','Define and document organizational oversight with regard to external system services.','SA-09b.','N/A','Determine if: - organizational oversight with regard to external system services are defined and documented. - user roles and responsibilities with regard to external system services are defined and documented.'),\n('004786','draft','2022-03-07','DISA','policy','Define and document user roles and responsibilities with regard to external system services.','SA-09b.','N/A','Determine if: - organizational oversight with regard to external system services are defined and documented. - user roles and responsibilities with regard to external system services are defined and documented.'),\n('004787','draft','2022-03-07','DISA','policy','Establish trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships.','SA-09(03)','N/A','Determine if: - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained.'),\n('004788','draft','2022-03-07','DISA','policy','Document trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships.','SA-09(03)','N/A','Determine if: - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained.'),\n('004789','draft','2022-03-07','DISA','policy','Maintain trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships.','SA-09(03)','N/A','Determine if: - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained.'),\n('004790','draft','2022-03-07','DISA','policy','Defines privacy requirements, properties, factors, or conditions defining acceptable trust relationships with external service providers.','SA-09(03)','N/A','Determine if: - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[01]; security requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are established and documented. - trust relationships with external service provides based on [SA-09(03)_ODP[02]; privacy requirements, properties, factors, or conditions defining acceptable trust relationships on which a trust relationship is maintained are defined] are maintained.'),\n('004791','draft','2022-03-07','DISA','policy','Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.','SA-09(06)','N/A','Determine if exclusive control of cryptographic keys is maintained for encrypted material stored or transmitted through an external system.'),\n('004792','draft','2022-03-07','DISA','policy','Provide the capability to check the integrity of organizational information while it resides in the external system.','SA-09(07)','N/A','Determine if the capability is provided to check the integrity of information while it resides in the external system.'),\n('004793','draft','2022-03-07','DISA','policy','Restrict the geographic location of information processing and data storage to facilities located within the legal jurisdictional boundary of the United States.','SA-09(08)','N/A','Determine if the geographic location of information processing and data storage is restricted to facilities located within the legal jurisdictional boundary of the United States.'),\n('004794','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to document the potential privacy impacts of approved changes to the system, component, or service.','SA-10d.','N/A','Determine if: - the developer of the system, system component, or system service is required to document approved changes to the system, component, or service. - the developer of the system, system component, or system service is required to document the potential security impacts of approved changes. - the developer of the system, system component, or system service is required to document the potential privacy impacts of approved changes.'),\n('004795','draft','2022-03-07','DISA','policy','Require organization-defined security and privacy representatives to be included in the organization-defined configuration change management and control process.','SA-10(07)','N/A','Determine if: - [SA-10(07)_ODP[01]; security representatives to be included in the configuration change management and control process are defined] are required to be included in the [SA-10(07)_ODP[03]; configuration change management and control processes in which security representatives are required to be included are defined]. - [SA-10(07)_ODP[02]; privacy representatives to be included in the configuration change management and control process are defined] are required to be included in the [SA-10(07)_ODP[04]; configuration change management and control processes in which privacy representatives are required to be included are defined].'),\n('004796','draft','2022-03-07','DISA','policy','Defines the security and privacy representatives to be included the organization-defined configuration change management and control process.','SA-10(07)','N/A','Determine if: - [SA-10(07)_ODP[01]; security representatives to be included in the configuration change management and control process are defined] are required to be included in the [SA-10(07)_ODP[03]; configuration change management and control processes in which security representatives are required to be included are defined]. - [SA-10(07)_ODP[02]; privacy representatives to be included in the configuration change management and control process are defined] are required to be included in the [SA-10(07)_ODP[04]; configuration change management and control processes in which privacy representatives are required to be included are defined].'),\n('004797','draft','2022-03-07','DISA','policy','Defines the configuration change management and control process required for the organization-defined security and privacy representatives.','SA-10(07)','N/A','Determine if: - [SA-10(07)_ODP[01]; security representatives to be included in the configuration change management and control process are defined] are required to be included in the [SA-10(07)_ODP[03]; configuration change management and control processes in which security representatives are required to be included are defined]. - [SA-10(07)_ODP[02]; privacy representatives to be included in the configuration change management and control process are defined] are required to be included in the [SA-10(07)_ODP[04]; configuration change management and control processes in which privacy representatives are required to be included are defined].'),\n('004798','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to develop a plan for ongoing privacy control assessment.','SA-11a.','N/A','Determine if: - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for ongoing security assessments. - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing security assessments. - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for privacy assessments. - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing privacy assessments.'),\n('004799','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to implement a plan for ongoing privacy control assessment.','SA-11a.','N/A','Determine if: - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for ongoing security assessments. - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing security assessments. - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for privacy assessments. - the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing privacy assessments.'),\n('004800','draft','2022-03-07','DISA','policy','Defines the frequency that the unit, integration, system, and/or regression testing/evaluation is performed at an organization-defined depth and coverage.','SA-11b.','N/A','Determine if the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to perform [SA-11_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {unit; integration; system; regression}] testing/evaluation [SA-11_ODP[02]; frequency at which to conduct [SA-11_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {unit; integration; system; regression}] testing/evaluation is defined] at [SA-11_ODP[03]; depth and coverage of [SA-11_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {unit; integration; system; regression}] testing/evaluation is defined].'),\n('004801','draft','2022-03-07','DISA','policy','Use the following contextual information.','SA-11(02)(a)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that uses [SA-11(02)_ODP[01]; information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used as contextual information for threat modeling and vulnerability analyses is defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that uses [SA-11(02)_ODP[01]; information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used as contextual information for threat modeling and vulnerability analyses is defined]. - the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that uses [SA-11(02)_ODP[01]; information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used as contextual information for threat modeling and vulnerability analyses is defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that uses [SA-11(02)_ODP[01]; information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used as contextual information for threat modeling and vulnerability analyses is defined].'),\n('004802','draft','2022-03-07','DISA','policy','Defines the information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels.','SA-11(02)(a)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that uses [SA-11(02)_ODP[01]; information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used as contextual information for threat modeling and vulnerability analyses is defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that uses [SA-11(02)_ODP[01]; information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used as contextual information for threat modeling and vulnerability analyses is defined]. - the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that uses [SA-11(02)_ODP[01]; information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used as contextual information for threat modeling and vulnerability analyses is defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that uses [SA-11(02)_ODP[01]; information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used as contextual information for threat modeling and vulnerability analyses is defined].'),\n('004803','draft','2022-03-07','DISA','policy','Employ the following tools and methods.','SA-11(02)(b)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that employs [SA-11(02)_ODP[02]; the tools and methods to be employed for threat modeling and vulnerability analyses are defined]. - the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that employs [SA-11(02)_ODP[02]; the tools and methods to be employed for threat modeling and vulnerability analyses are defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that employs [SA-11(02)_ODP[02]; the tools and methods to be employed for threat modeling and vulnerability analyses are defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that employs [SA-11(02)_ODP[02]; the tools and methods to be employed for threat modeling and vulnerability analyses are defined].'),\n('004804','draft','2022-03-07','DISA','policy','Defines the tools and methods to be employed.','SA-11(02)(b)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that employs [SA-11(02)_ODP[02]; the tools and methods to be employed for threat modeling and vulnerability analyses are defined]. - the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that employs [SA-11(02)_ODP[02]; the tools and methods to be employed for threat modeling and vulnerability analyses are defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that employs [SA-11(02)_ODP[02]; the tools and methods to be employed for threat modeling and vulnerability analyses are defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that employs [SA-11(02)_ODP[02]; the tools and methods to be employed for threat modeling and vulnerability analyses are defined].'),\n('004805','draft','2022-03-07','DISA','policy','Conduct the modeling and analyses as the following level of rigor.','SA-11(02)(c)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform threat modeling at [SA-11(02)_ODP[03]; the breadth and depth of threat modeling to be conducted is defined] during development of the system, component, or service. - the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that conducts modeling and analyses at [SA-11(02)_ODP[04]; the breadth and depth of vulnerability analyses to be conducted is defined].'),\n('004806','draft','2022-03-07','DISA','policy','Defines the breadth and depth of modeling and analyses the level of rigor will be conducted.','SA-11(02)(c)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform threat modeling at [SA-11(02)_ODP[03]; the breadth and depth of threat modeling to be conducted is defined] during development of the system, component, or service. - the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that conducts modeling and analyses at [SA-11(02)_ODP[04]; the breadth and depth of vulnerability analyses to be conducted is defined].'),\n('004807','draft','2022-03-07','DISA','policy','Produces evidence that meets the following acceptance criteria.','SA-11(02)(d)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[05]; acceptance criteria to be met by produced evidence for threat modeling are defined]. - the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[05]; acceptance criteria to be met by produced evidence for threat modeling are defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[06]; acceptance criteria to be met by produced evidence for vulnerability analyses are defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[06]; acceptance criteria to be met by produced evidence for vulnerability analyses are defined].'),\n('004808','draft','2022-03-07','DISA','policy','Defines the acceptance criteria that meets the requirement for producing evidence.','SA-11(02)(d)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[05]; acceptance criteria to be met by produced evidence for threat modeling are defined]. - the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[05]; acceptance criteria to be met by produced evidence for threat modeling are defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[06]; acceptance criteria to be met by produced evidence for vulnerability analyses are defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[06]; acceptance criteria to be met by produced evidence for vulnerability analyses are defined].'),\n('004809','draft','2022-03-07','DISA','policy','Require an independent agent satisfying organization-defined independence criteria to verify the correct implementation of the developer privacy assessment plan.','SA-11(02)(d)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[05]; acceptance criteria to be met by produced evidence for threat modeling are defined]. - the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[05]; acceptance criteria to be met by produced evidence for threat modeling are defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[06]; acceptance criteria to be met by produced evidence for vulnerability analyses are defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[06]; acceptance criteria to be met by produced evidence for vulnerability analyses are defined].'),\n('004810','draft','2022-03-07','DISA','policy','Require an independent agent satisfying organization-defined independence criteria to verify the evidence produced during privacy testing and evaluation.','SA-11(02)(d)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[05]; acceptance criteria to be met by produced evidence for threat modeling are defined]. - the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[05]; acceptance criteria to be met by produced evidence for threat modeling are defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[06]; acceptance criteria to be met by produced evidence for vulnerability analyses are defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[06]; acceptance criteria to be met by produced evidence for vulnerability analyses are defined].'),\n('004811','draft','2022-03-07','DISA','policy','Defines the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer privacy assessment plan and the evidence produced during privacy testing and evaluation.','SA-11(02)(d)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[05]; acceptance criteria to be met by produced evidence for threat modeling are defined]. - the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[05]; acceptance criteria to be met by produced evidence for threat modeling are defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[06]; acceptance criteria to be met by produced evidence for vulnerability analyses are defined]. - the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets [SA-11(02)_ODP[06]; acceptance criteria to be met by produced evidence for vulnerability analyses are defined].'),\n('004812','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to perform penetration testing at an organization-defined breadth and depth of testing.','SA-11(05)(a)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform penetration testing at the following level of rigor: [SA-11(05)_ODP[01]; the breadth of penetration testing is defined]. - the developer of the system, system component, or system service is required to perform penetration testing at the following level of rigor: [SA-11(05)_ODP[02]; the depth of penetration testing is defined].'),\n('004813','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to perform penetration testing under organization-defined constraints.','SA-11(05)(b)','N/A','Determine if the developer of the system, system component, or system service is required to perform penetration testing under [SA-11(05)_ODP[03]; constraints of penetration testing are defined].'),\n('004814','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to employ interactive application security testing tools to identify flaws.','SA-11(09)','N/A','Determine if: - the developer of the system, system component, or system service is required to employ interactive application security testing tools to identify flaws. - the developer of the system, system component, or system service is required to document the results of flaw identification.'),\n('004815','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to employ interactive application security testing tools to document the results.','SA-11(09)','N/A','Determine if: - the developer of the system, system component, or system service is required to employ interactive application security testing tools to identify flaws. - the developer of the system, system component, or system service is required to document the results of flaw identification.'),\n('004816','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to follow a documented development process that explicitly addresses privacy requirements.','SA-15a.01','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses security requirements. - the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses privacy requirements.'),\n('004817','draft','2022-03-07','DISA','policy','Review the development process in accordance with organization-defined frequency to determine if the development process selected and employed can satisfy organization-defined privacy requirements.','SA-15b.','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[02]; security requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined]. - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[03]; privacy requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined].'),\n('004818','draft','2022-03-07','DISA','policy','Review the development standards in accordance with organization-defined frequency to determine if the development standards selected and employed can satisfy organization-defined privacy requirements.','SA-15b.','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[02]; security requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined]. - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[03]; privacy requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined].'),\n('004819','draft','2022-03-07','DISA','policy','Review the development tools in accordance with organization-defined frequency to determine if the development tools selected and employed can satisfy organization-defined privacy requirements.','SA-15b.','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[02]; security requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined]. - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[03]; privacy requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined].'),\n('004820','draft','2022-03-07','DISA','policy','Review the development tool options/configurations in accordance with organization-defined frequency to determine if the development tool options and tool configurations selected and employed can satisfy organization-defined privacy requirements.','SA-15b.','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[02]; security requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined]. - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[03]; privacy requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined].'),\n('004821','draft','2022-03-07','DISA','policy','Defines the frequency on which to review the development process, standards, tools, and tool options/configurations to determine if the process, standards, tools, and tool options and tool configurations selected and employed can satisfy organization-defined privacy requirements.','SA-15b.','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[02]; security requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined]. - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[03]; privacy requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined].'),\n('004822','draft','2022-03-07','DISA','policy','Defines the privacy requirements that must be satisfied by conducting a review of the development process, standards, tools, and tool options and tool configurations.','SA-15b.','N/A','Determine if: - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[02]; security requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined]. - the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [SA-15_ODP[01]; frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [SA-15_ODP[03]; privacy requirements to be satisfied by the process, standards, tools, tool options, and tool configurations are defined].'),\n('004823','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to select a privacy tracking tool for use during the development process.','SA-15(02)','N/A','Determine if: - the developer of the system, system component, or system service is required to select and employ security tracking tools for use during the development process. - the developer of the system, system component, or system service is required to select and employ privacy tracking tools for use during the development process.'),\n('004824','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to employ a privacy tracking tool for use during the development process.','SA-15(02)','N/A','Determine if: - the developer of the system, system component, or system service is required to select and employ security tracking tools for use during the development process. - the developer of the system, system component, or system service is required to select and employ privacy tracking tools for use during the development process.'),\n('004825','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to perform a criticality analysis at the organization-defined decision points in the system development life cycle.','SA-15(03)(a)','N/A','Determine if the developer of the system, system component, or system service is required to perform a criticality analysis at [SA-15(03)_ODP[01]; decision points in the system development life cycle are defined] in the system development life cycle.'),\n('004826','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to perform a criticality analysis at an organization-defined breadth/depth of criticality analysis.','SA-15(03)(b)','N/A','Determine if: - the developer of the system, system component, or system service is required to perform a criticality analysis at the following rigor level: [SA-15(03)_ODP[02]; the breadth of criticality analysis is defined]. - the developer of the system, system component, or system service is required to perform a criticality analysis at the following rigor level: [SA-15(03)_ODP[03]; the depth of criticality analysis is defined].'),\n('004827','draft','2022-03-07','DISA','policy','Defines the frequency for performing an automated vulnerability analysis using organization-defined tools.','SA-15(07)(a)','N/A','Determine if the developer of the system, system component, or system service is required to perform automated vulnerability analysis [SA-15(07)_ODP[01]; frequency at which to conduct vulnerability analysis is defined] using [SA-15(07)_ODP[02]; tools used to perform automated vulnerability analysis are defined].'),\n('004828','draft','2022-03-07','DISA','policy','Defines the frequency for determining the exploitation potential for discovered vulnerabilities.','SA-15(07)(b)','N/A','Determine if the developer of the system, system component, or system service is required to determine the exploitation potential for discovered vulnerabilities [SA-15(07)_ODP[01]; frequency at which to conduct vulnerability analysis is defined].'),\n('004829','draft','2022-03-07','DISA','policy','Defines the frequency for determining potential risk mitigations for delivered vulnerabilities.','SA-15(07)(c)','N/A','Determine if the developer of the system, system component, or system service is required to determine potential risk mitigations [SA-15(07)_ODP[01]; frequency at which to conduct vulnerability analysis is defined] for delivered vulnerabilities.'),\n('004830','draft','2022-03-07','DISA','policy','Defines the frequency for delivering the outputs of the tools and results of the vulnerability analysis to organization-defined personnel or roles.','SA-15(07)(d)','N/A','Determine if the developer of the system, system component, or system service is required to deliver the outputs of the tools and results of the analysis [SA-15(07)_ODP[01]; frequency at which to conduct vulnerability analysis is defined] to [SA-15(07)_ODP[03]; personnel or roles to whom the outputs of tools and results of the analysis are to be delivered is/are defined].'),\n('004831','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to implement an incident response plan.','SA-15(10)','N/A','Determine if: - the developer of the system, system component, or system service is required to provide an incident response plan. - the developer of the system, system component, or system service is required to implement an incident response plan. - the developer of the system, system component, or system service is required to test an incident response plan.'),\n('004832','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to test an incident response plan.','SA-15(10)','N/A','Determine if: - the developer of the system, system component, or system service is required to provide an incident response plan. - the developer of the system, system component, or system service is required to implement an incident response plan. - the developer of the system, system component, or system service is required to test an incident response plan.'),\n('004833','draft','2022-03-07','DISA','policy','Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final privacy review.','SA-15(11)','N/A','Determine if the developer of the system or system component is required to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security and privacy review.'),\n('004834','draft','2022-03-07','DISA','policy','Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.','SA-15(12)','N/A','Determine if the developer of the system or system component is required to minimize the use of personally identifiable information in development and test environments.'),\n('004835','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to provide organization-defined training on the correct use and operation of the implemented privacy functions, controls, and/or mechanisms.','SA-16','N/A','Determine if the developer of the system, system component, or system service is required to provide [SA-16_ODP; training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms provided by the developer of the system, system component, or system service is defined] on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms.'),\n('004836','draft','2022-03-07','DISA','policy','Defines the training the developer of the system, system component, or information system service is required to provide on the correct use and operation of the implemented privacy functions, controls, and/or mechanisms.','SA-16','N/A','Determine if the developer of the system, system component, or system service is required to provide [SA-16_ODP; training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms provided by the developer of the system, system component, or system service is defined] on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms.'),\n('004837','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to produce a privacy architecture.',NULL,'N/A',NULL),\n('004838','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to produce a privacy architecture that is consistent with and supportive of the organization''s privacy architecture which is established within and is an integrated part of the organization''s enterprise architecture.','SA-17a.','N/A','Determine if: - the developer of the system, system component, or system service is required to produce a design specification and security architecture that are consistent with the organization''s security architecture, which is an integral part the organization''s enterprise architecture. - the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that are consistent with the organization''s privacy architecture, which is an integral part the organization''s enterprise architecture.'),\n('004839','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to produce a privacy architecture that accurately and completely describes the required privacy functionality.','SA-17b.','N/A','Determine if: - the developer of the system, system component, or system service is required to produce a design specification and security architecture that accurately and completely describe the required security functionality and the allocation of controls among physical and logical components. - the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that accurately and completely describe the required privacy functionality and the allocation of controls among physical and logical components.'),\n('004840','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to produce a privacy architecture that accurately and completely describes the allocation of privacy controls among physical and logical components.','SA-17b.','N/A','Determine if: - the developer of the system, system component, or system service is required to produce a design specification and security architecture that accurately and completely describe the required security functionality and the allocation of controls among physical and logical components. - the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that accurately and completely describe the required privacy functionality and the allocation of controls among physical and logical components.'),\n('004841','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to produce a privacy architecture that expresses how individual privacy functions, mechanisms, and services work together to provide required privacy capabilities and a unified approach to protection.','SA-17c.','N/A','Determine if: - the developer of the system, system component, or system service is required to produce a design specification and security architecture that express how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection. - the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that express how individual privacy functions, mechanisms, and services work together to provide required privacy capabilities and a unified approach to protection.'),\n('004842','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system to produce, as an integral part of the development process, a formal policy model describing the organization-defined elements of organizational privacy policy to be enforced.','SA-17(01)(a)','N/A','Determine if: - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal policy model describing the [SA-17(01)_ODP[01]; organizational security policy to be enforced is defined] to be enforced. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal policy model describing the [SA-17(01)_ODP[02]; organizational privacy policy to be enforced is defined] to be enforced.'),\n('004843','draft','2022-03-07','DISA','policy','Defines the elements of organizational privacy policy to be described in the formal policy model for enforcement on the system, system component, or system service.','SA-17(01)(a)','N/A','Determine if: - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal policy model describing the [SA-17(01)_ODP[01]; organizational security policy to be enforced is defined] to be enforced. - as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal policy model describing the [SA-17(01)_ODP[02]; organizational privacy policy to be enforced is defined] to be enforced.'),\n('004844','draft','2022-03-07','DISA','policy','Require the developer of the system, system component, or system service to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational privacy policy when implemented.','SA-17(01)(b)','N/A','Determine if: - the developer of the system, system component, or system service is required to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented. - the developer of the system, system component, or system service is required to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational privacy policy when implemented.'),\n('004845','draft','2022-03-07','DISA','policy','Design organization-defined critical systems or system components with coordinated behavior to implement organization-defined capabilities, by system or component.','SA-17(08)','N/A','Determine if [SA-17(08)_ODP[01]; critical systems or system components are defined] are designed with coordinated behavior to implement [SA-17(08)_ODP[02]; capabilities to be implemented by systems or components are defined].'),\n('004846','draft','2022-03-07','DISA','policy','Defines the critical systems or system components for implementing organization-defined capabilities, by system or component.','SA-17(08)','N/A','Determine if [SA-17(08)_ODP[01]; critical systems or system components are defined] are designed with coordinated behavior to implement [SA-17(08)_ODP[02]; capabilities to be implemented by systems or components are defined].'),\n('004847','draft','2022-03-07','DISA','policy','Defines the capabilities, by system or component, for designing organization-defined critical systems or system components.','SA-17(08)','N/A','Determine if [SA-17(08)_ODP[01]; critical systems or system components are defined] are designed with coordinated behavior to implement [SA-17(08)_ODP[02]; capabilities to be implemented by systems or components are defined].'),\n('004848','draft','2022-03-07','DISA','policy','Use different designs for organization-defined critical systems or system components to satisfy a common set of requirements or to provide equivalent functionality.','SA-17(09)','N/A','Determine if different designs are used for [SA-17(09)_ODP; critical systems or system components to be designed differently are defined] to satisfy a common set of requirements or to provide equivalent functionality.'),\n('004849','draft','2022-03-07','DISA','policy','Defines the critical systems or system components for satisfying a common set of requirements or to provide equivalent functionality.','SA-17(09)','N/A','Determine if different designs are used for [SA-17(09)_ODP; critical systems or system components to be designed differently are defined] to satisfy a common set of requirements or to provide equivalent functionality.'),\n('004850','draft','2022-03-07','DISA','policy','Employ design; modification; augmentation; and/or reconfiguration on organization-defined systems or system components supporting mission essential services or functions to increase the trustworthiness in those systems or components.','SA-23','N/A','Determine if [SA-23_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {design modification; augmentation; reconfiguration}] is employed on [SA-23_ODP[02]; systems or system components supporting mission-essential services or functions are defined] supporting essential services or functions to increase the trustworthiness in those systems or components.'),\n('004851','draft','2022-03-07','DISA','policy','Defines the systems or system components for supporting mission essential services or functions.','SA-23','N/A','Determine if [SA-23_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {design modification; augmentation; reconfiguration}] is employed on [SA-23_ODP[02]; systems or system components supporting mission-essential services or functions are defined] supporting essential services or functions to increase the trustworthiness in those systems or components.'),\n('004852','draft','2022-03-07','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system-level system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','SC-01a.01(a)','N/A','Determine if: - the [SC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business-process-level; system-level}] system and communications protection policy addresses purpose. - the [SC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business-process-level; system-level}] system and communications protection policy addresses scope. - the [SC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business-process-level; system-level}] system and communications protection policy addresses roles. - the [SC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business-process-level; system-level}] system and communications protection policy addresses responsibilities. - the [SC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business-process-level; system-level}] system and communications protection policy addresses management commitment. - the [SC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business-process-level; system-level}] system and communications protection policy addresses coordination among organizational entities. - the [SC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business-process-level; system-level}] system and communications protection policy addresses compliance.'),\n('004853','draft','2022-03-07','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system-level a system and communications protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','SC-01a.01(b)','N/A','Determine if the [SC-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business-process-level; system-level}] system and communications protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('004854','draft','2022-03-07','DISA','policy','Develop and document system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.','SC-01a.02','N/A','Determine if: - system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls are developed and documented. - the system and communications protection procedures are disseminated to [SC-01_ODP[02]; personnel or roles to whom the system and communications protection procedures are to be disseminated is/are defined].'),\n('004855','draft','2022-03-07','DISA','policy','Designate an organization-defined official to manage the development and documentation of the system and communications protection policy.','SC-01b.','N/A','Determine if the [SC-01_ODP[04]; an official to manage the system and communications protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures.'),\n('004856','draft','2022-03-07','DISA','policy','Designate an organization-defined official to manage the development and documentation of the system and communications protection procedures.','SC-01b.','N/A','Determine if the [SC-01_ODP[04]; an official to manage the system and communications protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures.'),\n('004857','draft','2022-03-07','DISA','policy','Designate an organization-defined official to manage the dissemination of the system and communications protection policy.','SC-01b.','N/A','Determine if the [SC-01_ODP[04]; an official to manage the system and communications protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures.'),\n('004858','draft','2022-03-07','DISA','policy','Designate an organization-defined official to manage the dissemination of the system and communications protection procedures.','SC-01b.','N/A','Determine if the [SC-01_ODP[04]; an official to manage the system and communications protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures.'),\n('004859','draft','2022-03-07','DISA','policy','Defines the official to manage the development, documentation, and dissemination of the system and communications protection policy.','SC-01b.','N/A','Determine if the [SC-01_ODP[04]; an official to manage the system and communications protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures.'),\n('004860','draft','2022-03-07','DISA','policy','Defines the official to manage the development, documentation, and dissemination of the system and communications protection procedures.','SC-01b.','N/A','Determine if the [SC-01_ODP[04]; an official to manage the system and communications protection policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures.'),\n('004861','draft','2022-03-07','DISA','policy','Review and update the current system and communications protection policy following organization-defined events.','SC-01c.01','N/A','Determine if: - the current system and communications protection policy is reviewed and updated [SC-01_ODP[05]; the frequency at which the current system and communications protection policy is reviewed and updated is defined]. - the current system and communications protection policy is reviewed and updated following [SC-01_ODP[06]; events that would require the current system and communications protection policy to be reviewed and updated are defined].'),\n('004862','draft','2022-03-07','DISA','policy','Defines the events following reviewing and updating the current system and communications protection policy.','SC-01c.01','N/A','Determine if: - the current system and communications protection policy is reviewed and updated [SC-01_ODP[05]; the frequency at which the current system and communications protection policy is reviewed and updated is defined]. - the current system and communications protection policy is reviewed and updated following [SC-01_ODP[06]; events that would require the current system and communications protection policy to be reviewed and updated are defined].'),\n('004863','draft','2022-03-07','DISA','policy','Review and update the current system and communications protection procedures following organization-defined events.','SC-01c.02','N/A','Determine if: - the current system and communications protection procedures are reviewed and updated [SC-01_ODP[07]; the frequency at which the current system and communications protection procedures are reviewed and updated is defined]. - the current system and communications protection procedures are reviewed and updated following [SC-01_ODP[08]; events that would require the system and communications protection procedures to be reviewed and updated are defined].'),\n('004864','draft','2022-03-07','DISA','policy','Defines the events following reviewing and updating the current system and communications protection procedures.','SC-01c.02','N/A','Determine if: - the current system and communications protection procedures are reviewed and updated [SC-01_ODP[07]; the frequency at which the current system and communications protection procedures are reviewed and updated is defined]. - the current system and communications protection procedures are reviewed and updated following [SC-01_ODP[08]; events that would require the system and communications protection procedures to be reviewed and updated are defined].'),\n('004865','draft','2022-03-07','DISA','technical','Store state information from applications and software separately.','SC-02(02)','N/A','Determine if state information is stored separately from applications and software.'),\n('004866','draft','2022-03-07','DISA','technical','Employ organization-defined controls by type of denial-of-service to achieve the denial-of-service objective.','SC-05b.','N/A','Determine if [SC-05_ODP[03]; controls to achieve the denial-of-service objective by type of denial-of-service event are defined] are employed to achieve the denial-of-service protection objective.'),\n('004867','draft','2022-03-07','DISA','technical','Defines the controls by type of denial-of-service event by employing the controls to achieve the denial-of-service objective.','SC-05b.','N/A','Determine if [SC-05_ODP[03]; controls to achieve the denial-of-service objective by type of denial-of-service event are defined] are employed to achieve the denial-of-service protection objective.'),\n('004868','draft','2022-03-07','DISA','technical','Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational privacy architecture.','SC-07c.','N/A','Determine if external networks or systems are only connected to through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.'),\n('004869','draft','2022-03-07','DISA','policy','Prevent unauthorized exchange of control plane traffic with external networks.','SC-07(04)(f)','N/A','Determine if unauthorized exchanges of control plan traffic with external networks are prevented.'),\n('004870','draft','2022-03-07','DISA','policy','Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks.','SC-07(04)(g)','N/A','Determine if information is published to enable remote networks to detect unauthorized control plane traffic from internal networks.'),\n('004871','draft','2022-03-07','DISA','policy','Filter unauthorized control plane traffic from external networks.','SC-07(04)(h)','N/A','Determine if unauthorized control plane traffic is filtered from external networks.'),\n('004872','draft','2022-03-07','DISA','technical','Defines the systems that will deny network communications traffic by default and allow network communications traffic by exception.','SC-07(05)','N/A','Determine if: - network communications traffic is denied by default [SC-07(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {at managed interfaces; for [SC-07(05)_ODP[02]; systems for which network communications traffic is denied by default and network communications traffic is allowed by exception are defined (if selected)]}]. - network communications traffic is allowed by exception [SC-07(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {at managed interfaces; for [SC-07(05)_ODP[02]; systems for which network communications traffic is denied by default and network communications traffic is allowed by exception are defined (if selected)]}].'),\n('004873','draft','2022-03-07','DISA','technical','Defines the safeguards to prevent split tunneling for remote devices connecting to organizational systems.','SC-07(07)','N/A','Determine if split tunneling is prevented for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [SC-07(07)_ODP; safeguards to securely provision split tunneling are defined].'),\n('004874','draft','2022-03-07','DISA','policy','Conduct exfiltration tests at an organization-defined frequency.','SC-07(10)(b)','N/A','Determine if exfiltration tests are conducted [SC-07(10)_ODP; the frequency for conducting exfiltration tests is defined].'),\n('004875','draft','2022-03-07','DISA','policy','Defines the frequency to conduct exfiltration tests.','SC-07(10)(b)','N/A','Determine if exfiltration tests are conducted [SC-07(10)_ODP; the frequency for conducting exfiltration tests is defined].'),\n('004876','draft','2022-03-07','DISA','policy','For systems that process personally identifiable information, apply organization-defined processing rules to data elements of personally identifiable information.','SC-07(24)(a)','N/A','Determine if [SC-07(24)_ODP; processing rules for systems that process personally identifiable information are defined] are applied to data elements of personally identifiable information on systems that process personally identifiable information.'),\n('004877','draft','2022-03-07','DISA','policy','Defines processing rules to be applied to data elements of personally identifiable information.','SC-07(24)(a)','N/A','Determine if [SC-07(24)_ODP; processing rules for systems that process personally identifiable information are defined] are applied to data elements of personally identifiable information on systems that process personally identifiable information.'),\n('004878','draft','2022-03-07','DISA','policy','For systems that process personally identifiable information, monitor for permitted processing at the external boundary of the system and at key internal boundaries within the system.','SC-07(24)(b)','N/A','Determine if: - permitted processing is monitored at the external interfaces to the systems that process personally identifiable information. - permitted processing is monitored at key internal boundaries within the systems that process personally identifiable information.'),\n('004879','draft','2022-03-07','DISA','policy','For systems that process personally identifiable information, document each processing exception.','SC-07(24)(c)','N/A','Determine if each processing exception is documented for systems that process personally identifiable information.'),\n('004880','draft','2022-03-07','DISA','policy','For systems that process personally identifiable information, review and remove exceptions that are no longer supported.','SC-07(24)(d)','N/A','Determine if: - exceptions for systems that process personally identifiable information are reviewed. - exceptions for systems that process personally identifiable information that are no longer supported are removed.'),\n('004881','draft','2022-03-07','DISA','policy','Prohibit the direct connection of organization-defined unclassified national security system to an external network without the use of organization-defined boundary protection device.','SC-07(25)','N/A','Determine if the direct connection of [SC-07(25)_ODP[01]; the unclassified national security system prohibited from directly connecting to an external network is defined] to an external network without the use of [SC-07(25)_ODP[02]; the boundary protection device required for a direct connection to an external network is defined] is prohibited.'),\n('004882','draft','2022-03-07','DISA','policy','Defines the unclassified national security system that is prohibited from connecting to an external network without the use of organization-defined boundary protection device.','SC-07(25)','N/A','Determine if the direct connection of [SC-07(25)_ODP[01]; the unclassified national security system prohibited from directly connecting to an external network is defined] to an external network without the use of [SC-07(25)_ODP[02]; the boundary protection device required for a direct connection to an external network is defined] is prohibited.'),\n('004883','draft','2022-03-07','DISA','policy','Defines the boundary protection device that prohibits the direct connection of organization-defined unclassified national security system to an external system.','SC-07(25)','N/A','Determine if the direct connection of [SC-07(25)_ODP[01]; the unclassified national security system prohibited from directly connecting to an external network is defined] to an external network without the use of [SC-07(25)_ODP[02]; the boundary protection device required for a direct connection to an external network is defined] is prohibited.'),\n('004884','draft','2022-03-07','DISA','policy','Prohibit the direct connection of a classified national security system to an external network without the use of organization-defined boundary protection device.','SC-07(26)','N/A','Determine if the direct connection of classified national security system to an external network without the use of a [SC-07(26)_ODP; the boundary protection device required for a direct connection to an external network is defined] is prohibited.'),\n('004885','draft','2022-03-07','DISA','policy','Defines the boundary protection device that prohibits the direct connection of a classified national security system to an external system.','SC-07(26)','N/A','Determine if the direct connection of classified national security system to an external network without the use of a [SC-07(26)_ODP; the boundary protection device required for a direct connection to an external network is defined] is prohibited.'),\n('004886','draft','2022-03-07','DISA','policy','Prohibit the direct connection of organization-defined unclassified non-national security system to an external network without the use of organization-defined boundary protection device.','SC-07(27)','N/A','Determine if the direct connection of [SC-07(27)_ODP[01]; the unclassified, non-national security system prohibited from directly connecting to an external network is defined] to an external network without the use of a [SC-07(27)_ODP[02]; the boundary protection device required for a direct connection of unclassified, non-national security system to an external network is defined] is prohibited.'),\n('004887','draft','2022-03-07','DISA','policy','Defines the unclassified non-national security system that is prohibited from connecting to an external network without the use of organization-defined boundary protection device.','SC-07(27)','N/A','Determine if the direct connection of [SC-07(27)_ODP[01]; the unclassified, non-national security system prohibited from directly connecting to an external network is defined] to an external network without the use of a [SC-07(27)_ODP[02]; the boundary protection device required for a direct connection of unclassified, non-national security system to an external network is defined] is prohibited.'),\n('004888','draft','2022-03-07','DISA','policy','Defines the boundary protection device that prohibits the direct connection of organization-defined unclassified non-national security system to an external system.','SC-07(27)','N/A','Determine if the direct connection of [SC-07(27)_ODP[01]; the unclassified, non-national security system prohibited from directly connecting to an external network is defined] to an external network without the use of a [SC-07(27)_ODP[02]; the boundary protection device required for a direct connection of unclassified, non-national security system to an external network is defined] is prohibited.'),\n('004889','draft','2022-03-07','DISA','policy','Prohibit the direct connection of organization-defined system to a public network.','SC-07(28)','N/A','Determine if the direct connection of the [SC-07(28)_ODP; the system that is prohibited from directly connecting to a public network is defined] to a public network is prohibited.'),\n('004890','draft','2022-03-07','DISA','policy','Defines the system that prohibits the direct connection to a public network.','SC-07(28)','N/A','Determine if the direct connection of the [SC-07(28)_ODP; the system that is prohibited from directly connecting to a public network is defined] to a public network is prohibited.'),\n('004891','draft','2022-03-07','DISA','technical','Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.','SC-07(29)','N/A','Determine if subnetworks are separated [SC-07(29)_ODP[01]; one of the following PARAMETER VALUES is selected: {physically; logically}] to isolate [SC-07(29)_ODP[02]; critical system components and functions to be isolated are defined].'),\n('004892','draft','2022-03-07','DISA','technical','Defines the critical system components to implement physically or logically separate subnetworks.','SC-07(29)','N/A','Determine if subnetworks are separated [SC-07(29)_ODP[01]; one of the following PARAMETER VALUES is selected: {physically; logically}] to isolate [SC-07(29)_ODP[02]; critical system components and functions to be isolated are defined].'),\n('004893','draft','2022-03-07','DISA','technical','Implement organization-defined protection distribution system to prevent unauthorized disclosure of information, and/or detect changes to information during transmission.','SC-08(05)','N/A','Determine if the [SC-08(05)_ODP[01]; the protected distribution system is defined] is implemented to [SC-08(05)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {prevent unauthorized disclosure of information; detect changes to information}] during transmission.'),\n('004894','draft','2022-03-07','DISA','technical','Defines the protected distribution system for preventing unauthorized disclosure of information, and/or detect changes to information during transmission.','SC-08(05)','N/A','Determine if the [SC-08(05)_ODP[01]; the protected distribution system is defined] is implemented to [SC-08(05)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {prevent unauthorized disclosure of information; detect changes to information}] during transmission.'),\n('004895','draft','2022-03-07','DISA','technical','Permit users to invoke the trusted communications path for communications between the user and the organization-defined security functions, including at a minimum, authentication and re-authentication.','SC-11b.','N/A','Determine if users are permitted to invoke the trusted communication path for communications between the user and the [SC-11_ODP[02]; security functions of the system are defined] of the system, including authentication and re-authentication, at a minimum.'),\n('004896','draft','2022-03-07','DISA','technical','Initiates the trusted communications path for communications between the organization-defined security functions of the system and the user.','SC-11(01)(b)','N/A','Determine if the trusted communication path for communications between the [SC-11(01)_ODP; security functions of the system are defined] of the system and the user is initiated.'),\n('004897','draft','2022-03-07','DISA','technical','Defines the security functions to be initiated between the system and the user for trusted communications path for communications.','SC-11(01)(b)','N/A','Determine if the trusted communication path for communications between the [SC-11(01)_ODP; security functions of the system are defined] of the system and the user is initiated.'),\n('004898','draft','2022-03-07','DISA','policy','Defines requirements for certificates that are issued for producing, controlling, and distributing asymmetric cryptographic keys.','SC-12(03)','N/A','Determine if: - asymmetric cryptographic keys are produced using [SC-12(03)_ODP; one of the following PARAMETER VALUES is selected: {NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; certificates issued in accordance with organization-defined requirements}]. - asymmetric cryptographic keys are controlled using [SC-12(03)_ODP; one of the following PARAMETER VALUES is selected: {NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; certificates issued in accordance with organization-defined requirements}]. - asymmetric cryptographic keys are distributed using [SC-12(03)_ODP; one of the following PARAMETER VALUES is selected: {NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user''s private key; certificates issued in accordance with organization-defined requirements}].'),\n('004899','draft','2022-03-07','DISA','policy','Maintain physical control of cryptographic keys when store information is encrypted by external service providers.','SC-12(06)','N/A','Determine if physical control of cryptographic keys is maintained when stored information is encrypted by external service providers.'),\n('004900','draft','2022-03-07','DISA','technical','Determine the organization-defined cryptographic uses.','SC-13b.','N/A','Determine if [SC-13_ODP[02]; types of cryptography for each specified cryptographic use are defined] for each specified cryptographic use (defined in SC-13_ODP[01]) are implemented.'),\n('004901','draft','2022-03-07','DISA','technical','Associate organization-defined privacy attributes with information exchanged between systems.','SC-16','N/A','Determine if: - [SC-16_ODP[01]; security attributes to be associated with information exchanged are defined] are associated with information exchanged between systems. - [SC-16_ODP[01]; security attributes to be associated with information exchanged are defined] are associated with information exchanged between system components. - [SC-16_ODP[02]; privacy attributes to be associated with information exchanged are defined] are associated with information exchanged between systems. - [SC-16_ODP[02]; privacy attributes to be associated with information exchanged are defined] are associated with information exchanged between system components.'),\n('004902','draft','2022-03-07','DISA','technical','Associate organization-defined privacy attributes with information exchanged between system components.','SC-16','N/A','Determine if: - [SC-16_ODP[01]; security attributes to be associated with information exchanged are defined] are associated with information exchanged between systems. - [SC-16_ODP[01]; security attributes to be associated with information exchanged are defined] are associated with information exchanged between system components. - [SC-16_ODP[02]; privacy attributes to be associated with information exchanged are defined] are associated with information exchanged between systems. - [SC-16_ODP[02]; privacy attributes to be associated with information exchanged are defined] are associated with information exchanged between system components.'),\n('004903','draft','2022-03-07','DISA','policy','Defines the privacy attributes to associate with the information being exchanged between systems and between system components.','SC-16','N/A','Determine if: - [SC-16_ODP[01]; security attributes to be associated with information exchanged are defined] are associated with information exchanged between systems. - [SC-16_ODP[01]; security attributes to be associated with information exchanged are defined] are associated with information exchanged between system components. - [SC-16_ODP[02]; privacy attributes to be associated with information exchanged are defined] are associated with information exchanged between systems. - [SC-16_ODP[02]; privacy attributes to be associated with information exchanged are defined] are associated with information exchanged between system components.'),\n('004904','draft','2022-03-07','DISA','technical','Verify the integrity of transmitted privacy attributes.','SC-16(01)','N/A','Determine if: - the integrity of transmitted security attributes is verified. - the integrity of transmitted privacy attributes is verified.'),\n('004905','draft','2022-03-07','DISA','technical','Implement anti-spoofing mechanisms to prevent adversaries from falsifying the security attributes indicating the successful application of the security process.','SC-16(02)','N/A','Determine if anti-spoofing mechanisms are implemented to prevent adversaries from falsifying the security attributes indicating the successful application of the security process.'),\n('004906','draft','2022-03-07','DISA','technical','Implement organization-defined mechanisms or techniques to bind security attributes to transmitted information.','SC-16(03)','N/A','Determine if [SC-16(03)_ODP; mechanisms or techniques to bind security and privacy attributes to transmitted information are defined] are implemented to bind security and privacy attributes to transmitted information.'),\n('004907','draft','2022-03-07','DISA','technical','Implement organization-defined mechanisms or techniques to bind privacy attributes to transmitted information.','SC-16(03)','N/A','Determine if [SC-16(03)_ODP; mechanisms or techniques to bind security and privacy attributes to transmitted information are defined] are implemented to bind security and privacy attributes to transmitted information.'),\n('004908','draft','2022-03-07','DISA','technical','Defines the mechanisms or techniques for binding security and privacy attributes to transmitted information.','SC-16(03)','N/A','Determine if [SC-16(03)_ODP; mechanisms or techniques to bind security and privacy attributes to transmitted information are defined] are implemented to bind security and privacy attributes to transmitted information.'),\n('004909','draft','2022-03-07','DISA','policy','Include only approved trust anchors in trust stores or certificate stores managed by the organization.','SC-17b.','N/A','Determine if only approved trust anchors are included in trust stores or certificate stores managed by the organization.'),\n('004910','draft','2022-03-07','DISA','policy','Provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.','SC-28(03)','N/A','Determine if protected storage for cryptographic keys is provided using [SC-28(03)_ODP[01]; one of the following PARAMETER VALUES is selected: {[SC-28(03)_ODP[02]; safeguards for protecting the storage of cryptographic keys are defined (if selected)]; hardware-protected key store}].'),\n('004911','draft','2022-03-07','DISA','policy','Defines the safeguards for providing protected storage for cryptographic keys.','SC-28(03)','N/A','Determine if protected storage for cryptographic keys is provided using [SC-28(03)_ODP[01]; one of the following PARAMETER VALUES is selected: {[SC-28(03)_ODP[02]; safeguards for protecting the storage of cryptographic keys are defined (if selected)]; hardware-protected key store}].'),\n('004912','draft','2022-03-07','DISA','policy','Partition privileged functions into separate physical domains.','SC-32(01)','N/A','Determine if privileged functions are partitioned into separate physical domains.'),\n('004913','draft','2022-03-07','DISA','policy','Takes organization-defined actions in response to identified faults, errors, or compromises.','SC-36(01)(b)','N/A','Determine if [SC-36(01)_ODP[02]; actions to be taken in response to identified faults, errors, or compromise are defined] are taken in response to identified faults, errors, or compromise.'),\n('004914','draft','2022-03-07','DISA','policy','Defines actions to take in response to identified faults, errors, or compromises.','SC-36(01)(b)','N/A','Determine if [SC-36(01)_ODP[02]; actions to be taken in response to identified faults, errors, or compromise are defined] are taken in response to identified faults, errors, or compromise.'),\n('004915','draft','2022-03-07','DISA','policy','Synchronize the organization-defined duplicate systems or system components.','SC-36(02)','N/A','Determine if [SC-36(02)_ODP; duplicate systems or system components to be synchronized are defined] are synchronized.'),\n('004916','draft','2022-03-07','DISA','policy','Defines the duplicate systems or system components to be synchronized.','SC-36(02)','N/A','Determine if [SC-36(02)_ODP; duplicate systems or system components to be synchronized are defined] are synchronized.'),\n('004917','draft','2022-03-07','DISA','policy','Defines sensors to facilitate an individual''s awareness that personally identifiable information is being collected.','SC-42(04)','N/A','Determine if [SC-42(04)_ODP[01]; measures to facilitate an individual''s awareness that personally identifiable information is being collected are defined] are employed to facilitate an individual''s awareness that personally identifiable information is being collected by [SC-42(04)_ODP[02]; sensors that collect personally identifiable information are defined].'),\n('004918','draft','2022-03-07','DISA','policy','Defines measures to facility an individual''s awareness that personally identifiable information is being collected.','SC-42(04)','N/A','Determine if [SC-42(04)_ODP[01]; measures to facilitate an individual''s awareness that personally identifiable information is being collected are defined] are employed to facilitate an individual''s awareness that personally identifiable information is being collected by [SC-42(04)_ODP[02]; sensors that collect personally identifiable information are defined].'),\n('004919','draft','2022-03-07','DISA','policy','Employ organization-defined measures to facilitate an individual''s awareness that personally identifiable information is being collected by organization-defined sensors.','SC-42(04)','N/A','Determine if [SC-42(04)_ODP[01]; measures to facilitate an individual''s awareness that personally identifiable information is being collected are defined] are employed to facilitate an individual''s awareness that personally identifiable information is being collected by [SC-42(04)_ODP[02]; sensors that collect personally identifiable information are defined].'),\n('004920','draft','2022-03-07','DISA','policy','Defines sensors that are configured to minimize the collection of information about individuals that is not needed.','SC-42(05)','N/A','Determine if the [SC-42(05)_ODP; the sensors that are configured to minimize the collection of unneeded information about individuals are defined] configured to minimize the collection of information about individuals that is not needed are employed.'),\n('004921','draft','2022-03-07','DISA','policy','Employ organization-defined sensors that are configured to minimize the collection of information about individuals that is not needed.','SC-42(05)','N/A','Determine if the [SC-42(05)_ODP; the sensors that are configured to minimize the collection of unneeded information about individuals are defined] configured to minimize the collection of information about individuals that is not needed are employed.'),\n('004922','draft','2022-03-07','DISA','technical','Synchronize system clocks within and between systems or system components.','SC-45','N/A','Determine if system clocks are synchronized within and between systems and system components.'),\n('004923','draft','2022-03-07','DISA','technical','Compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source.','SC-45(01)(a)','N/A','Determine if the internal system clocks are compared [SC-45(01)_ODP[01]; the frequency at which to compare the internal system clocks with the authoritative time source is defined] with [SC-45(01)_ODP[02]; the authoritative time source to which internal system clocks are to be compared is defined].'),\n('004924','draft','2022-03-07','DISA','technical','Defines the frequency for comparing the internal system clocks with organization-defined authoritative time source.','SC-45(01)(a)','N/A','Determine if the internal system clocks are compared [SC-45(01)_ODP[01]; the frequency at which to compare the internal system clocks with the authoritative time source is defined] with [SC-45(01)_ODP[02]; the authoritative time source to which internal system clocks are to be compared is defined].'),\n('004925','draft','2022-03-07','DISA','technical','Defines the time source used for comparing the internal system clocks.','SC-45(01)(a)','N/A','Determine if the internal system clocks are compared [SC-45(01)_ODP[01]; the frequency at which to compare the internal system clocks with the authoritative time source is defined] with [SC-45(01)_ODP[02]; the authoritative time source to which internal system clocks are to be compared is defined].'),\n('004926','draft','2022-03-07','DISA','technical','Synchronize the internal system clocks to the authoritative time source when the time difference is greater than organization-defined time period.','SC-45(01)(b)','N/A','Determine if the internal system clocks are synchronized with the authoritative time source when the time difference is greater than [SC-45(01)_ODP[03]; the time period to compare the internal system clocks with the authoritative time source is defined].'),\n('004927','draft','2022-03-07','DISA','technical','Defines the time period for synchronizing the internal system clocks to the authoritative time source.','SC-45(01)(b)','N/A','Determine if the internal system clocks are synchronized with the authoritative time source when the time difference is greater than [SC-45(01)_ODP[03]; the time period to compare the internal system clocks with the authoritative time source is defined].'),\n('004928','draft','2022-03-07','DISA','technical','Identify a secondary authoritative time source that is in a different geographic region than the primary authoritative time source.','SC-45(02)(a)','N/A','Determine if a secondary authoritative time source is identified that is in a different geographic region than the primary authoritative time source.'),\n('004929','draft','2022-03-07','DISA','technical','Synchronize the internal system clocks to the secondary authoritative time source if the primary authoritative time source is unavailable.','SC-45(02)(b)','N/A','Determine if the internal system clocks are synchronized to the secondary authoritative time source if the primary authoritative time source is unavailable.'),\n('004930','draft','2022-03-07','DISA','technical','Implement a policy enforcement mechanism physically or logically between the physical and/or network interfaces for the connecting security domains.','SC-46','N/A','Determine if a policy enforcement mechanism is [SC-46_ODP; one of the following PARAMETER VALUES is selected: {physically; logically}] implemented between the physical and/or network interfaces for the connecting security domains.'),\n('004931','draft','2022-03-07','DISA','policy','Establish organization-defined alternate communications paths for system operations organizational command and control.','SC-47','N/A','Determine if [SC-47_ODP; alternate communication paths for system operations and operational command and control are defined] are established for system operations and operational command and control.'),\n('004932','draft','2022-03-07','DISA','policy','Relocate organization-defined sensors and monitoring capabilities to organization-defined locations under organization-defined conditions or circumstances.','SC-48','N/A','Determine if [SC-48_ODP[01]; sensors and monitoring capabilities to be relocated are defined] are relocated to [SC-48_ODP[02]; locations to where sensors and monitoring capabilities are to be relocated are defined] under [SC-48_ODP[03]; conditions or circumstances for relocating sensors and monitoring capabilities are defined].'),\n('004933','draft','2022-03-07','DISA','policy','Defines the sensors and monitoring capabilities to be relocated to organization-defined locations.','SC-48','N/A','Determine if [SC-48_ODP[01]; sensors and monitoring capabilities to be relocated are defined] are relocated to [SC-48_ODP[02]; locations to where sensors and monitoring capabilities are to be relocated are defined] under [SC-48_ODP[03]; conditions or circumstances for relocating sensors and monitoring capabilities are defined].'),\n('004934','draft','2022-03-07','DISA','policy','Defines the locations of which the organization-defined sensors and monitoring capabilities will be relocated.','SC-48','N/A','Determine if [SC-48_ODP[01]; sensors and monitoring capabilities to be relocated are defined] are relocated to [SC-48_ODP[02]; locations to where sensors and monitoring capabilities are to be relocated are defined] under [SC-48_ODP[03]; conditions or circumstances for relocating sensors and monitoring capabilities are defined].'),\n('004935','draft','2022-03-07','DISA','policy','Defines the conditions or circumstances of which the organization-defined sensors and monitoring capabilities are relocated.','SC-48','N/A','Determine if [SC-48_ODP[01]; sensors and monitoring capabilities to be relocated are defined] are relocated to [SC-48_ODP[02]; locations to where sensors and monitoring capabilities are to be relocated are defined] under [SC-48_ODP[03]; conditions or circumstances for relocating sensors and monitoring capabilities are defined].'),\n('004936','draft','2022-03-07','DISA','policy','Dynamically relocate organization-defined sensors and monitoring capabilities to organization-defined locations under organization-defined conditions or circumstances.','SC-48(01)','N/A','Determine if [SC-48(01)_ODP[01]; sensors and monitoring capabilities to be dynamically relocated are defined] are dynamically relocated to [SC-48(01)_ODP[02]; locations to where sensors and monitoring capabilities are to be dynamically relocated are defined] under [SC-48(01)_ODP[03]; conditions or circumstances for dynamically relocating sensors and monitoring capabilities are defined].'),\n('004937','draft','2022-03-07','DISA','policy','Defines the sensors and monitoring capabilities to be dynamically relocated to organization-defined locations.','SC-48(01)','N/A','Determine if [SC-48(01)_ODP[01]; sensors and monitoring capabilities to be dynamically relocated are defined] are dynamically relocated to [SC-48(01)_ODP[02]; locations to where sensors and monitoring capabilities are to be dynamically relocated are defined] under [SC-48(01)_ODP[03]; conditions or circumstances for dynamically relocating sensors and monitoring capabilities are defined].'),\n('004938','draft','2022-03-07','DISA','policy','Defines the locations of which the organization-defined sensors and monitoring capabilities will be dynamically relocated.','SC-48(01)','N/A','Determine if [SC-48(01)_ODP[01]; sensors and monitoring capabilities to be dynamically relocated are defined] are dynamically relocated to [SC-48(01)_ODP[02]; locations to where sensors and monitoring capabilities are to be dynamically relocated are defined] under [SC-48(01)_ODP[03]; conditions or circumstances for dynamically relocating sensors and monitoring capabilities are defined].'),\n('004939','draft','2022-03-07','DISA','policy','Defines the conditions or circumstances of which the organization-defined sensors and monitoring capabilities are dynamically relocated.','SC-48(01)','N/A','Determine if [SC-48(01)_ODP[01]; sensors and monitoring capabilities to be dynamically relocated are defined] are dynamically relocated to [SC-48(01)_ODP[02]; locations to where sensors and monitoring capabilities are to be dynamically relocated are defined] under [SC-48(01)_ODP[03]; conditions or circumstances for dynamically relocating sensors and monitoring capabilities are defined].'),\n('004940','draft','2022-03-07','DISA','policy','Implement hardware-enforced separation and policy enforcement mechanisms between organization-defined security domains.','SC-49','N/A','Determine if hardware-enforced separation and policy enforcement mechanisms are implemented between [SC-49_ODP; security domains requiring hardware-enforced separation and policy enforcement mechanisms are defined].'),\n('004941','draft','2022-03-07','DISA','policy','Defines the security domains for implementing hardware-enforced separation and policy enforcement mechanisms.','SC-49','N/A','Determine if hardware-enforced separation and policy enforcement mechanisms are implemented between [SC-49_ODP; security domains requiring hardware-enforced separation and policy enforcement mechanisms are defined].'),\n('004942','draft','2022-03-07','DISA','policy','Implement software-enforced separation and policy enforcement mechanisms between organization-defined security domains.','SC-50','N/A','Determine if software-enforced separation and policy enforcement mechanisms are implemented between [SC-50_ODP; security domains requiring software-enforced separation and policy enforcement mechanisms are defined].'),\n('004943','draft','2022-03-07','DISA','policy','Defines the security domains for implementing software-enforced separation and policy enforcement mechanisms.','SC-50','N/A','Determine if software-enforced separation and policy enforcement mechanisms are implemented between [SC-50_ODP; security domains requiring software-enforced separation and policy enforcement mechanisms are defined].'),\n('004944','draft','2022-03-07','DISA','policy','Develop and document an organization-level; mission/business process-level; and/or system level system and information integrity policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.','SI-01a.01(b)','N/A','Determine if the [SI-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] system and information integrity policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('004945','draft','2022-03-07','DISA','policy','Designate an organization-defined official to manage the development and documentation of the system and information integrity policy.','SI-01b.','N/A','Determine if the [SI-01_ODP[04]; an official to manage the system and information integrity policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures.'),\n('004946','draft','2022-03-07','DISA','policy','Designate an organization-defined official to manage the dissemination of the system and information integrity policy.','SI-01b.','N/A','Determine if the [SI-01_ODP[04]; an official to manage the system and information integrity policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures.'),\n('004947','draft','2022-03-07','DISA','policy','Designate an organization-defined official to manage the development and documentation of the system and information integrity procedures.','SI-01b.','N/A','Determine if the [SI-01_ODP[04]; an official to manage the system and information integrity policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures.'),\n('004948','draft','2022-03-07','DISA','policy','Designate an organization-defined official to manage the dissemination of the system and information integrity procedures.','SI-01b.','N/A','Determine if the [SI-01_ODP[04]; an official to manage the system and information integrity policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures.'),\n('004949','draft','2022-03-07','DISA','policy','Defines the official designated for managing the development, documentation, and dissemination of the system and information integrity policy.','SI-01b.','N/A','Determine if the [SI-01_ODP[04]; an official to manage the system and information integrity policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures.'),\n('004950','draft','2022-03-07','DISA','policy','Defines the official designated for managing the development, documentation, and dissemination of the system and information integrity procedures.','SI-01b.','N/A','Determine if the [SI-01_ODP[04]; an official to manage the system and information integrity policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures.'),\n('004951','draft','2022-03-07','DISA','policy','Review and update the current system and information integrity policy following organization-defined events.','SI-01c.01','N/A','Determine if: - the current system and information integrity policy is reviewed and updated [SI-01_ODP[05]; the frequency at which the current system and information integrity policy is reviewed and updated is defined]. - the current system and information integrity policy is reviewed and updated following [SI-01_ODP[06]; events that would require the current system and information integrity policy to be reviewed and updated are defined].'),\n('004952','draft','2022-03-07','DISA','policy','Defines the events following reviewing and updating the current system and information integrity policy.','SI-01c.01','N/A','Determine if: - the current system and information integrity policy is reviewed and updated [SI-01_ODP[05]; the frequency at which the current system and information integrity policy is reviewed and updated is defined]. - the current system and information integrity policy is reviewed and updated following [SI-01_ODP[06]; events that would require the current system and information integrity policy to be reviewed and updated are defined].'),\n('004953','draft','2022-03-07','DISA','policy','Review and update the current system and information integrity procedures following organization-defined events.','SI-01c.02','N/A','Determine if: - the current system and information integrity procedures are reviewed and updated [SI-01_ODP[07]; the frequency at which the current system and information integrity procedures are reviewed and updated is defined]. - the current system and information integrity procedures are reviewed and updated following [SI-01_ODP[08]; events that would require the system and information integrity procedures to be reviewed and updated are defined].'),\n('004954','draft','2022-03-07','DISA','policy','Defines the events following reviewing and updating the current system and information integrity procedures.','SI-01c.02','N/A','Determine if: - the current system and information integrity procedures are reviewed and updated [SI-01_ODP[07]; the frequency at which the current system and information integrity procedures are reviewed and updated is defined]. - the current system and information integrity procedures are reviewed and updated following [SI-01_ODP[08]; events that would require the system and information integrity procedures to be reviewed and updated are defined].'),\n('004955','draft','2022-03-07','DISA','policy','Determine if system components have applicable security-related software updates installed using organization-defined mechanisms on an organization-defined frequency.','SI-02(02)','N/A','Determine if system components have applicable security-relevant software and firmware updates installed [SI-02(02)_ODP[02]; the frequency at which to determine if applicable security-relevant software and firmware updates are installed on system components is defined] using [SI-02(02)_ODP[01]; automated mechanisms to determine if applicable security-relevant software and firmware updates are installed on system components are defined].'),\n('004956','draft','2022-03-07','DISA','policy','Determine if system components have applicable security-related firmware updates installed using organization-defined mechanisms on an organization-defined frequency.','SI-02(02)','N/A','Determine if system components have applicable security-relevant software and firmware updates installed [SI-02(02)_ODP[02]; the frequency at which to determine if applicable security-relevant software and firmware updates are installed on system components is defined] using [SI-02(02)_ODP[01]; automated mechanisms to determine if applicable security-relevant software and firmware updates are installed on system components are defined].'),\n('004957','draft','2022-03-07','DISA','policy','Defines a frequency for installing security-relevant software updates using organization-defined automated mechanisms.','SI-02(02)','N/A','Determine if system components have applicable security-relevant software and firmware updates installed [SI-02(02)_ODP[02]; the frequency at which to determine if applicable security-relevant software and firmware updates are installed on system components is defined] using [SI-02(02)_ODP[01]; automated mechanisms to determine if applicable security-relevant software and firmware updates are installed on system components are defined].'),\n('004958','draft','2022-03-07','DISA','policy','Defines a frequency for installing security-relevant firmware updates using organization-defined automated mechanisms.','SI-02(02)','N/A','Determine if system components have applicable security-relevant software and firmware updates installed [SI-02(02)_ODP[02]; the frequency at which to determine if applicable security-relevant software and firmware updates are installed on system components is defined] using [SI-02(02)_ODP[01]; automated mechanisms to determine if applicable security-relevant software and firmware updates are installed on system components are defined].'),\n('004959','draft','2022-03-07','DISA','policy','Defines the automated mechanisms for determining if system components have applicable security-related software updates installed.','SI-02(02)','N/A','Determine if system components have applicable security-relevant software and firmware updates installed [SI-02(02)_ODP[02]; the frequency at which to determine if applicable security-relevant software and firmware updates are installed on system components is defined] using [SI-02(02)_ODP[01]; automated mechanisms to determine if applicable security-relevant software and firmware updates are installed on system components are defined].'),\n('004960','draft','2022-03-07','DISA','policy','Defines the automated mechanisms for determining if system components have applicable security-related firmware updates installed.','SI-02(02)','N/A','Determine if system components have applicable security-relevant software and firmware updates installed [SI-02(02)_ODP[02]; the frequency at which to determine if applicable security-relevant software and firmware updates are installed on system components is defined] using [SI-02(02)_ODP[01]; automated mechanisms to determine if applicable security-relevant software and firmware updates are installed on system components are defined].'),\n('004961','draft','2022-03-07','DISA','policy','Employ automated patch management tools to facilitate flaw remediation to the organization-defined system components.','SI-02(04)','N/A','Determine if automated patch management tools are employed to facilitate flaw remediation to [SI-02(04)_ODP; the system components requiring automated patch management tools to facilitate flaw remediation are defined].'),\n('004962','draft','2022-03-07','DISA','policy','Defines the system components on which patch management tools to facilitate flaw remediation are employed.','SI-02(04)','N/A','Determine if automated patch management tools are employed to facilitate flaw remediation to [SI-02(04)_ODP; the system components requiring automated patch management tools to facilitate flaw remediation are defined].'),\n('004963','draft','2022-03-07','DISA','policy','Implement signature based and/or non-signature based malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code.','SI-03a.','N/A','Determine if: - [SI-03_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {signature-based; non-signature-based}] malicious code protection mechanisms are implemented at system entry and exit points to detect malicious code. - [SI-03_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {signature-based; non-signature-based}] malicious code protection mechanisms are implemented at system entry and exit points to eradicate malicious code.'),\n('004964','draft','2022-03-07','DISA','policy','Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy.','SI-03b.','N/A','Determine if malicious code protection mechanisms are updated automatically as new releases are available in accordance with organizational configuration management policy and procedures.'),\n('004965','draft','2022-03-07','DISA','policy','Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management procedures.','SI-03b.','N/A','Determine if malicious code protection mechanisms are updated automatically as new releases are available in accordance with organizational configuration management policy and procedures.'),\n('004966','draft','2022-03-07','DISA','policy','Configure malicious code protection mechanisms to send alerts to organization-defined personnel in response to malicious code detection.','SI-03c.02','N/A','Determine if: - malicious code protection mechanisms are configured to [SI-03_ODP[04]; one or more of the following PARAMETER VALUES is/are selected: {block malicious code; quarantine malicious code; take [SI-03_ODP[05]; action to be taken in response to malicious code detection are defined (if selected)}] in response to malicious code detection. - malicious code protection mechanisms are configured to send alerts to [SI-03_ODP[06]; personnel or roles to be alerted when malicious code is detected is/are defined] in response to malicious code detection.'),\n('004967','draft','2022-03-07','DISA','policy','Analyze detected events and anomalies.','SI-04d.','N/A','Determine if: - detected events are analyzed. - detected anomalies are analyzed.'),\n('004968','draft','2022-03-07','DISA','technical','Employ automated mechanisms to support near real-time analysis of events.','SI-04(02)','N/A','Determine if automated tools and mechanisms are employed to support a near real-time analysis of events.'),\n('004969','draft','2022-03-07','DISA','technical','Employ automated mechanisms to integrate intrusion detection mechanisms into access control mechanisms.','SI-04(03)','N/A','Determine if: - automated tools and mechanisms are employed to integrate intrusion detection tools and mechanisms into access control mechanisms. - automated tools and mechanisms are employed to integrate intrusion detection tools and mechanisms into flow control mechanisms.'),\n('004970','draft','2022-03-07','DISA','technical','Employ automated mechanisms to integrate intrusion detection mechanisms into flow control mechanisms.','SI-04(03)','N/A','Determine if: - automated tools and mechanisms are employed to integrate intrusion detection tools and mechanisms into access control mechanisms. - automated tools and mechanisms are employed to integrate intrusion detection tools and mechanisms into flow control mechanisms.'),\n('004971','draft','2022-03-07','DISA','technical','Determine criteria for unusual or unauthorized activities or conditions for inbound communications traffic.','SI-04(04)(a)','N/A','Determine if: - criteria for unusual or unauthorized activities or conditions for inbound communications traffic are defined. - criteria for unusual or unauthorized activities or conditions for outbound communications traffic are defined.'),\n('004972','draft','2022-03-07','DISA','technical','Determine criteria for unusual or unauthorized activities or conditions for outbound communications traffic.','SI-04(04)(a)','N/A','Determine if: - criteria for unusual or unauthorized activities or conditions for inbound communications traffic are defined. - criteria for unusual or unauthorized activities or conditions for outbound communications traffic are defined.'),\n('004973','draft','2022-03-07','DISA','technical','Defines the unusual or unauthorized activities or conditions that will be monitored for inbound communications traffic.','SI-04(04)(b)','N/A','Determine if: - inbound communications traffic is monitored [SI-04(04)_ODP[01]; the frequency at which to monitor inbound communications traffic for unusual or unauthorized activities or conditions is defined] for [SI-04(04)_ODP[02]; unusual or unauthorized activities or conditions that are to be monitored in inbound communications traffic are defined]. - outbound communications traffic is monitored [SI-04(04)_ODP[03]; the frequency at which to monitor outbound communications traffic for unusual or unauthorized activities or conditions is defined] for [SI-04(04)_ODP[04]; unusual or unauthorized activities or conditions that are to be monitored in outbound communications traffic are defined].'),\n('004974','draft','2022-03-07','DISA','technical','Defines the unusual or unauthorized activities or conditions that will be monitored for outbound communications traffic.','SI-04(04)(b)','N/A','Determine if: - inbound communications traffic is monitored [SI-04(04)_ODP[01]; the frequency at which to monitor inbound communications traffic for unusual or unauthorized activities or conditions is defined] for [SI-04(04)_ODP[02]; unusual or unauthorized activities or conditions that are to be monitored in inbound communications traffic are defined]. - outbound communications traffic is monitored [SI-04(04)_ODP[03]; the frequency at which to monitor outbound communications traffic for unusual or unauthorized activities or conditions is defined] for [SI-04(04)_ODP[04]; unusual or unauthorized activities or conditions that are to be monitored in outbound communications traffic are defined].'),\n('004975','draft','2022-03-07','DISA','policy','Test intrusion monitoring mechanisms at an organization-defined frequency.','SI-04(09)','N/A','Determine if intrusion-monitoring tools and mechanisms are tested [SI-04(09)_ODP; a frequency at which to test intrusion-monitoring tools and mechanisms is defined].'),\n('004976','draft','2022-03-07','DISA','policy','Defines the frequency for testing intrusion monitoring mechanisms.','SI-04(09)','N/A','Determine if intrusion-monitoring tools and mechanisms are tested [SI-04(09)_ODP; a frequency at which to test intrusion-monitoring tools and mechanisms is defined].'),\n('004977','draft','2022-03-07','DISA','policy','Defines the encrypted communications traffic that is to be visible to organization-defined system monitoring mechanisms.','SI-04(10)','N/A','Determine if provisions are made so that [SI-04(10)_ODP[01]; encrypted communications traffic to be made visible to system monitoring tools and mechanisms is defined] is visible to [SI-04(10)_ODP[02]; system monitoring tools and mechanisms to be provided access to encrypted communications traffic are defined].'),\n('004978','draft','2022-03-07','DISA','policy','Defines the system monitoring mechanisms that will have visibility into organization-defined encrypted communications traffic.','SI-04(10)','N/A','Determine if provisions are made so that [SI-04(10)_ODP[01]; encrypted communications traffic to be made visible to system monitoring tools and mechanisms is defined] is visible to [SI-04(10)_ODP[02]; system monitoring tools and mechanisms to be provided access to encrypted communications traffic are defined].'),\n('004979','draft','2022-03-07','DISA','policy','Make provisions so that organization-defined encrypted communications traffic is visible to organization-defined system monitoring mechanisms.','SI-04(10)','N/A','Determine if provisions are made so that [SI-04(10)_ODP[01]; encrypted communications traffic to be made visible to system monitoring tools and mechanisms is defined] is visible to [SI-04(10)_ODP[02]; system monitoring tools and mechanisms to be provided access to encrypted communications traffic are defined].'),\n('004980','draft','2022-03-07','DISA','policy','Defines the personnel or roles to receive alerts when indications of inappropriate or unusual activities with security or privacy occur.','SI-04(12)','N/A','Determine if [SI-04(12)_ODP[01]; personnel or roles to be alerted when indications of inappropriate or unusual activity with security or privacy implications occur is/are defined] is/are alerted using [SI-04(12)_ODP[02]; automated mechanisms used to alert personnel or roles are defined] when [SI-04(12)_ODP[03]; activities that trigger alerts to personnel or are defined] indicate inappropriate or unusual activities with security or privacy implications.'),\n('004981','draft','2022-03-07','DISA','policy','Correlate information from monitoring mechanisms employed throughout the system.','SI-04(16)','N/A','Determine if information from monitoring tools and mechanisms employed throughout the system is correlated.'),\n('004982','draft','2022-03-07','DISA','technical','Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.','SI-04(25)','N/A','Determine if: - visibility into network traffic at external system interfaces is provided to optimize the effectiveness of monitoring devices. - visibility into network traffic at key internal system interfaces is provided to optimize the effectiveness of monitoring devices.'),\n('004983','draft','2022-03-07','DISA','policy','Defines the automated mechanisms for broadcasting security alert and advisory information.','SI-05(01)','N/A','Determine if [SI-05(01)_ODP; automated mechanisms used to broadcast security alert and advisory information throughout the organization are defined] are used to broadcast security alert and advisory information throughout the organization.'),\n('004984','draft','2022-03-07','DISA','policy','Defines the privacy functions that require verification of correct operation.','SI-06a.','N/A','Determine if: - [SI-06_ODP[01]; security functions to be verified for correct operation are defined] are verified to be operating correctly. - [SI-06_ODP[02]; privacy functions to be verified for correct operation are defined] are verified to be operating correctly.'),\n('004985','draft','2022-03-07','DISA','technical','Verify correct operation of organization-defined privacy functions.','SI-06a.','N/A','Determine if: - [SI-06_ODP[01]; security functions to be verified for correct operation are defined] are verified to be operating correctly. - [SI-06_ODP[02]; privacy functions to be verified for correct operation are defined] are verified to be operating correctly.'),\n('004986','draft','2022-03-07','DISA','policy','Defines the frequency at which it will verify correct operation of organization-defined privacy functions.','SI-06b.','N/A','Determine if: - [SI-06_ODP[01]; security functions to be verified for correct operation are defined] are verified [SI-06_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[SI-06_ODP[04]; system transitional states requiring the verification of security and privacy functions are defined; (if selected]; upon command by user with appropriate privilege; [SI-06_ODP[05]; frequency at which to verify the correct operation of security and privacy functions is defined; (if selected]}]. - [SI-06_ODP[02]; privacy functions to be verified for correct operation are defined] are verified [SI-06_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[SI-06_ODP[04]; system transitional states requiring the verification of security and privacy functions are defined; (if selected]; upon command by user with appropriate privilege; [SI-06_ODP[05]; frequency at which to verify the correct operation of security and privacy functions is defined; (if selected]}].'),\n('004987','draft','2022-03-07','DISA','policy','Defines the system transitional states when the system will verify correct operation of organization-defined privacy functions.','SI-06b.','N/A','Determine if: - [SI-06_ODP[01]; security functions to be verified for correct operation are defined] are verified [SI-06_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[SI-06_ODP[04]; system transitional states requiring the verification of security and privacy functions are defined; (if selected]; upon command by user with appropriate privilege; [SI-06_ODP[05]; frequency at which to verify the correct operation of security and privacy functions is defined; (if selected]}]. - [SI-06_ODP[02]; privacy functions to be verified for correct operation are defined] are verified [SI-06_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[SI-06_ODP[04]; system transitional states requiring the verification of security and privacy functions are defined; (if selected]; upon command by user with appropriate privilege; [SI-06_ODP[05]; frequency at which to verify the correct operation of security and privacy functions is defined; (if selected]}].'),\n('004988','draft','2022-03-07','DISA','technical','Perform verification of the correct operation of organization-defined privacy functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.','SI-06b.','N/A','Determine if: - [SI-06_ODP[01]; security functions to be verified for correct operation are defined] are verified [SI-06_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[SI-06_ODP[04]; system transitional states requiring the verification of security and privacy functions are defined; (if selected]; upon command by user with appropriate privilege; [SI-06_ODP[05]; frequency at which to verify the correct operation of security and privacy functions is defined; (if selected]}]. - [SI-06_ODP[02]; privacy functions to be verified for correct operation are defined] are verified [SI-06_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[SI-06_ODP[04]; system transitional states requiring the verification of security and privacy functions are defined; (if selected]; upon command by user with appropriate privilege; [SI-06_ODP[05]; frequency at which to verify the correct operation of security and privacy functions is defined; (if selected]}].'),\n('004989','draft','2022-03-07','DISA','technical','Alert organization-defined personnel or roles of failed privacy verification tests.','SI-06b.','N/A','Determine if: - [SI-06_ODP[01]; security functions to be verified for correct operation are defined] are verified [SI-06_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[SI-06_ODP[04]; system transitional states requiring the verification of security and privacy functions are defined; (if selected]; upon command by user with appropriate privilege; [SI-06_ODP[05]; frequency at which to verify the correct operation of security and privacy functions is defined; (if selected]}]. - [SI-06_ODP[02]; privacy functions to be verified for correct operation are defined] are verified [SI-06_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {[SI-06_ODP[04]; system transitional states requiring the verification of security and privacy functions are defined; (if selected]; upon command by user with appropriate privilege; [SI-06_ODP[05]; frequency at which to verify the correct operation of security and privacy functions is defined; (if selected]}].'),\n('004990','draft','2022-03-07','DISA','policy','Defines the personnel or roles to be notified when privacy verification tests fail.','SI-06c.','N/A','Determine if: - [SI-06_ODP[06]; personnel or roles to be alerted of failed security and privacy verification tests is/are defined] is/are alerted to failed security verification tests. - [SI-06_ODP[06]; personnel or roles to be alerted of failed security and privacy verification tests is/are defined] is/are alerted to failed privacy verification tests.'),\n('004991','draft','2022-03-07','DISA','policy','Defines alternative action(s) to be taken when anomalies in the operation of organization-defined privacy functions are discovered.','SI-06d.','N/A','Determine if [SI-06_ODP[07]; one or more of the following PARAMETER VALUES is/are selected: {shut the system down; restart the system; [SI-06_ODP[08]; alternative action(s) to be performed when anomalies are discovered are defined (if selected)]}] is/are initiated when anomalies are discovered.'),\n('004992','draft','2022-03-07','DISA','technical','Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined privacy functions are discovered.','SI-06d.','N/A','Determine if [SI-06_ODP[07]; one or more of the following PARAMETER VALUES is/are selected: {shut the system down; restart the system; [SI-06_ODP[08]; alternative action(s) to be performed when anomalies are discovered are defined (if selected)]}] is/are initiated when anomalies are discovered.'),\n('004993','draft','2022-03-07','DISA','technical','Implement automated mechanisms to support the management of distributed privacy function testing.','SI-06(02)','N/A','Determine if: - automated mechanisms are implemented to support the management of distributed security function testing. - automated mechanisms are implemented to support the management of distributed privacy function testing.'),\n('004994','draft','2022-03-07','DISA','policy','Report the results of privacy function verification to organization-defined personnel or roles.','SI-06(03)','N/A','Determine if: - the results of security function verification are reported to [SI-06(03)_ODP; personnel or roles designated to receive the results of security and privacy function verification is/are defined]. - the results of privacy function verification are reported to [SI-06(03)_ODP; personnel or roles designated to receive the results of security and privacy function verification is/are defined].'),\n('004995','draft','2022-03-07','DISA','policy','Defines the personnel or roles that are to receive reports on the results of privacy function verification.','SI-06(03)','N/A','Determine if: - the results of security function verification are reported to [SI-06(03)_ODP; personnel or roles designated to receive the results of security and privacy function verification is/are defined]. - the results of privacy function verification are reported to [SI-06(03)_ODP; personnel or roles designated to receive the results of security and privacy function verification is/are defined].'),\n('004996','draft','2022-03-07','DISA','policy','Take organization-defined actions when unauthorized changes to the software, firmware, and information are detected.','SI-07b.','N/A','Determine if: - [SI-07_ODP[04]; actions to be taken when unauthorized changes to software are detected are defined] are taken when unauthorized changes to the software are detected. - [SI-07_ODP[05]; actions to be taken when unauthorized changes to firmware are detected are defined] are taken when unauthorized changes to the firmware are detected. - [SI-07_ODP[06]; actions to be taken when unauthorized changes to information are detected are defined] are taken when unauthorized changes to the information are detected.'),\n('004997','draft','2022-03-07','DISA','policy','Defines the actions to be taken when unauthorized changes to the software, firmware, and information are detected.','SI-07b.','N/A','Determine if: - [SI-07_ODP[04]; actions to be taken when unauthorized changes to software are detected are defined] are taken when unauthorized changes to the software are detected. - [SI-07_ODP[05]; actions to be taken when unauthorized changes to firmware are detected are defined] are taken when unauthorized changes to the firmware are detected. - [SI-07_ODP[06]; actions to be taken when unauthorized changes to information are detected are defined] are taken when unauthorized changes to the information are detected.'),\n('004998','draft','2022-03-07','DISA','technical','Implement organization-defined controls for application self-protection at runtime.','SI-07(17)','N/A','Determine if [SI-07(17)_ODP; controls to be implemented for application self-protection at runtime are defined] are implemented for application self-protection at runtime.'),\n('004999','draft','2022-03-07','DISA','policy','Defines the controls to be implemented for runtime application self-protection.','SI-07(17)','N/A','Determine if [SI-07(17)_ODP; controls to be implemented for application self-protection at runtime are defined] are implemented for application self-protection at runtime.'),\n('005000','draft','2022-03-07','DISA','policy','Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy.','SI-08b.','N/A','Determine if spam protection mechanisms are updated when new releases are available in accordance with organizational configuration management policies and procedures.'),\n('005001','draft','2022-03-07','DISA','policy','Update spam protection mechanisms when new releases are available in accordance with organizational configuration management procedures.','SI-08b.','N/A','Determine if spam protection mechanisms are updated when new releases are available in accordance with organizational configuration management policies and procedures.'),\n('005002','draft','2022-03-07','DISA','policy','Defines the frequency for updating spam protection mechanisms.','SI-08(02)','N/A','Determine if spam protection mechanisms are automatically updated [SI-08(02)_ODP; the frequency at which to automatically update spam protection mechanisms is defined].'),\n('005003','draft','2022-03-07','DISA','technical','Prevent untrusted data injections.','SI-10(06)','N/A','Determine if untrusted data injections are prevented.'),\n('005004','draft','2022-03-07','DISA','policy','Limit personally identifiable information being processed in the information life cycle to the organization-defined elements of personally identifiable information.','SI-12(01)','N/A','Determine if personally identifiable information being processed in the information life cycle is limited to [SI-12(01)_ODP; elements of personally identifiable information being processed in the information life cycle are defined].'),\n('005005','draft','2022-03-07','DISA','policy','Defines the elements of personally identifiable information being processed in the information life cycle.','SI-12(01)','N/A','Determine if personally identifiable information being processed in the information life cycle is limited to [SI-12(01)_ODP; elements of personally identifiable information being processed in the information life cycle are defined].'),\n('005006','draft','2022-03-07','DISA','policy','Use organization-defined techniques to minimize the use of personally identifiable information for research, testing, or training, in accordance with the privacy risk assessment.','SI-12(02)','N/A','Determine if: - [SI-12(02)_ODP[01]; techniques used to minimize the use of personally identifiable information for research are defined] are used to minimize the use of personally identifiable information for research. - [SI-12(02)_ODP[02]; techniques used to minimize the use of personally identifiable information for testing are defined] are used to minimize the use of personally identifiable information for testing. - [SI-12(02)_ODP[03]; techniques used to minimize the use of personally identifiable information for training are defined] are used to minimize the use of personally identifiable information for training.'),\n('005007','draft','2022-03-07','DISA','policy','Defines the techniques for minimizing the use of personally identifiable information for research, testing, or training.','SI-12(02)','N/A','Determine if: - [SI-12(02)_ODP[01]; techniques used to minimize the use of personally identifiable information for research are defined] are used to minimize the use of personally identifiable information for research. - [SI-12(02)_ODP[02]; techniques used to minimize the use of personally identifiable information for testing are defined] are used to minimize the use of personally identifiable information for testing. - [SI-12(02)_ODP[03]; techniques used to minimize the use of personally identifiable information for training are defined] are used to minimize the use of personally identifiable information for training.'),\n('005008','draft','2022-03-07','DISA','policy','Use organization-defined techniques to dispose of, destroy, or erase information following the retention period.','SI-12(03)','N/A','Determine if: - [SI-12(03)_ODP[01]; techniques used to dispose of information following the retention period are defined] are used to dispose of information following the retention period. - [SI-12(03)_ODP[02]; techniques used to destroy information following the retention period are defined] are used to destroy information following the retention period. - [SI-12(03)_ODP[03]; techniques used to erase information following the retention period are defined] are used to erase information following the retention period. '),\n('005009','draft','2022-03-07','DISA','policy','Defines the percentage of the mean time to failure used to manually initiate transfer between active and standby system components.','SI-13(03)','N/A','Determine if transfers are initiated manually between active and standby system components when the use of the active component reaches [SI-13(03)_ODP; the percentage of the mean time to failure for transfers to be manually initiated is defined] of the mean time to failure.'),\n('005010','draft','2022-03-07','DISA','policy','Defines the action to be taken when system failures are detected.','SI-13(04)(b)','N/A','Determine if [SI-13(04)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {activate [SI-13(04)_ODP[03]; alarm to be activated when system component failures are detected is defined (if selected)]; automatically shut down the system; [SI-13(04)_ODP[04]; action to be taken when system component failures are detected is defined (if selected)]}] are performed if system component failures are detected.'),\n('005011','draft','2022-03-07','DISA','policy','Refresh organization-defined information on an organization-defined frequency, or generate organization-defined information on demand.','SI-14(02)(a)','N/A','Determine if [SI-14(02)_ODP[01]; one of the following PARAMETER VALUES is selected: {refresh [SI-14(02)_ODP[02]; the information to be refreshed is defined (if selected)] [SI-14(02)_ODP[03]; the frequency at which to refresh information is defined (if selected)]; generate [SI-14(02)_ODP[04]; the information to be generated is defined (if selected)] on demand}] is performed.'),\n('005012','draft','2022-03-07','DISA','policy','Defines the information to be refreshed on an organization-defined frequency.','SI-14(02)(a)','N/A','Determine if [SI-14(02)_ODP[01]; one of the following PARAMETER VALUES is selected: {refresh [SI-14(02)_ODP[02]; the information to be refreshed is defined (if selected)] [SI-14(02)_ODP[03]; the frequency at which to refresh information is defined (if selected)]; generate [SI-14(02)_ODP[04]; the information to be generated is defined (if selected)] on demand}] is performed.'),\n('005013','draft','2022-03-07','DISA','policy','Defines the frequency at which to refresh organization-defined information.','SI-14(02)(a)','N/A','Determine if [SI-14(02)_ODP[01]; one of the following PARAMETER VALUES is selected: {refresh [SI-14(02)_ODP[02]; the information to be refreshed is defined (if selected)] [SI-14(02)_ODP[03]; the frequency at which to refresh information is defined (if selected)]; generate [SI-14(02)_ODP[04]; the information to be generated is defined (if selected)] on demand}] is performed.'),\n('005014','draft','2022-03-07','DISA','policy','Defines the information to be generated on demand.','SI-14(02)(a)','N/A','Determine if [SI-14(02)_ODP[01]; one of the following PARAMETER VALUES is selected: {refresh [SI-14(02)_ODP[02]; the information to be refreshed is defined (if selected)] [SI-14(02)_ODP[03]; the frequency at which to refresh information is defined (if selected)]; generate [SI-14(02)_ODP[04]; the information to be generated is defined (if selected)] on demand}] is performed.'),\n('005015','draft','2022-03-07','DISA','policy','Delete information when no longer needed.','SI-14(02)(b)','N/A','Determine if information is deleted when no longer needed.'),\n('005016','draft','2022-03-07','DISA','policy','Refresh connections to the system on demand.','SI-14(03)','N/A','Determine if: - connections to the system are established on demand. - connections to the system are terminated after [SI-14(03)_ODP; one of the following PARAMETER VALUES is selected: {completion of a request; a period of non-use}].'),\n('005017','draft','2022-03-07','DISA','policy','Terminate connections after completion of a request, or a period of non-use.','SI-14(03)','N/A','Determine if: - connections to the system are established on demand. - connections to the system are terminated after [SI-14(03)_ODP; one of the following PARAMETER VALUES is selected: {completion of a request; a period of non-use}].'),\n('005018','draft','2022-03-07','DISA','policy','Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle, on an organization-defined frequency.','SI-18a.','N/A','Determine if: - the accuracy of personally identifiable information across the information life cycle is checked [SI-18_ODP[01]; the frequency at which to check the accuracy of personally identifiable information across the information life cycle is defined]. - the relevance of personally identifiable information across the information life cycle is checked [SI-18_ODP[02]; the frequency at which to check the relevance of personally identifiable information across the information life cycle is defined]. - the timeliness of personally identifiable information across the information life cycle is checked [SI-18_ODP[03]; the frequency at which to check the timeliness of personally identifiable information across the information life cycle is defined]. - the completeness of personally identifiable information across the information life cycle is checked [SI-18_ODP[04]; the frequency at which to check the completeness of personally identifiable information across the information life cycle is defined].'),\n('005019','draft','2022-03-07','DISA','policy','Defines the frequency for checking the accuracy, relevance, timeliness, and completeness of personally identifiable information.','SI-18a.','N/A','Determine if: - the accuracy of personally identifiable information across the information life cycle is checked [SI-18_ODP[01]; the frequency at which to check the accuracy of personally identifiable information across the information life cycle is defined]. - the relevance of personally identifiable information across the information life cycle is checked [SI-18_ODP[02]; the frequency at which to check the relevance of personally identifiable information across the information life cycle is defined]. - the timeliness of personally identifiable information across the information life cycle is checked [SI-18_ODP[03]; the frequency at which to check the timeliness of personally identifiable information across the information life cycle is defined]. - the completeness of personally identifiable information across the information life cycle is checked [SI-18_ODP[04]; the frequency at which to check the completeness of personally identifiable information across the information life cycle is defined].'),\n('005020','draft','2022-03-07','DISA','policy','Correct or delete inaccurate or outdated personally identifiable information.','SI-18b.','N/A','Determine if inaccurate or outdated personally identifiable information is corrected or deleted.'),\n('005021','draft','2022-03-07','DISA','policy','Correct or delete personally identifiable information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using organization-defined mechanisms.','SI-18(01)','N/A','Determine if [SI-18(01)_ODP; automated mechanisms used to correct or delete personally identifiable information that is inaccurate, outdated, incorrectly determined regarding impact, or incorrectly de-identified are defined] are used to correct or delete personally identifiable information that is inaccurate, outdated, incorrectly determined regarding impact, or incorrectly de-identified.'),\n('005022','draft','2022-03-07','DISA','policy','Defines the automated mechanisms for identifying inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified personally identifiable information.','SI-18(01)','N/A','Determine if [SI-18(01)_ODP; automated mechanisms used to correct or delete personally identifiable information that is inaccurate, outdated, incorrectly determined regarding impact, or incorrectly de-identified are defined] are used to correct or delete personally identifiable information that is inaccurate, outdated, incorrectly determined regarding impact, or incorrectly de-identified.'),\n('005023','draft','2022-03-07','DISA','policy','Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.','SI-18(02)','N/A','Determine if data tags are employed to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.'),\n('005024','draft','2022-03-07','DISA','policy','Collect personally identifiable information directly from the individual.','SI-18(03)','N/A','Determine if personally identifiable information is collected directly from the individual.'),\n('005025','draft','2022-03-07','DISA','policy','Correct or delete personally identifiable information upon request by individuals or their designated representatives.','SI-18(04)','N/A','Determine if personally identifiable information is corrected or deleted upon request by individuals or their designated representatives.'),\n('005026','draft','2022-03-07','DISA','policy','Notify organization-defined recipients of personally identifiable information that the personally identifiable information has been corrected or deleted.','SI-18(05)','N/A','Determine if [SI-18(05)_ODP; recipients of personally identifiable information to be notified when the personally identifiable information has been corrected or deleted are defined] and individuals are notified when the personally identifiable information has been corrected or deleted.'),\n('005027','draft','2022-03-07','DISA','policy','Defines the recipients of personally identifiable information who are to be notified when the personally identifiable information is corrected or deleted.','SI-18(05)','N/A','Determine if [SI-18(05)_ODP; recipients of personally identifiable information to be notified when the personally identifiable information has been corrected or deleted are defined] and individuals are notified when the personally identifiable information has been corrected or deleted.'),\n('005028','draft','2022-03-07','DISA','policy','Notify individuals that the personally identifiable information has been corrected or deleted.','SI-18(05)','N/A','Determine if [SI-18(05)_ODP; recipients of personally identifiable information to be notified when the personally identifiable information has been corrected or deleted are defined] and individuals are notified when the personally identifiable information has been corrected or deleted.'),\n('005029','draft','2022-03-07','DISA','policy','Remove the following elements of personally identifiable information from datasets.','SI-19a.','N/A','Determine if [SI-19_ODP[01]; elements of personally identifiable information to be removed from datasets are defined] are removed from datasets.'),\n('005030','draft','2022-03-07','DISA','policy','Defines the elements of personally identifiable information to be removed from datasets.','SI-19a.','N/A','Determine if [SI-19_ODP[01]; elements of personally identifiable information to be removed from datasets are defined] are removed from datasets.'),\n('005031','draft','2022-03-07','DISA','policy','Evaluate organization-defined frequency for effectiveness of de-identification.','SI-19b.','N/A','Determine if the effectiveness of de-identification is evaluated [SI-19_ODP[02]; the frequency at which to evaluate the effectiveness of de-identification is defined].'),\n('005032','draft','2022-03-07','DISA','policy','Defines the frequency for evaluating for effectiveness of de-identification.','SI-19b.','N/A','Determine if the effectiveness of de-identification is evaluated [SI-19_ODP[02]; the frequency at which to evaluate the effectiveness of de-identification is defined].'),\n('005033','draft','2022-03-07','DISA','policy','De-identify the dataset upon collection by not collecting personally identifiable information.','SI-19(01)','N/A','Determine if the dataset is de-identified upon collection by not collecting personally identifiable information.'),\n('005034','draft','2022-03-07','DISA','policy','Prohibit archiving personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.','SI-19(02)','N/A','Determine if the archiving of personally identifiable information elements is prohibited if those elements in a dataset will not be needed after the dataset is archived.'),\n('005035','draft','2022-03-07','DISA','policy','Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.','SI-19(03)','N/A','Determine if personally identifiable information elements are removed from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.'),\n('005036','draft','2022-03-07','DISA','technical','Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.','SI-19(04)','N/A','Determine if direct identifiers in a dataset are removed, masked, encrypted, hashed, or replaced.'),\n('005037','draft','2022-03-07','DISA','policy','Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.','SI-19(05)','N/A','Determine if: - numerical data is manipulated so that no individual or organization is identifiable in the results of the analysis. - contingency tables are manipulated so that no individual or organization is identifiable in the results of the analysis. - statistical findings are manipulated so that no individual or organization is identifiable in the results of the analysis.'),\n('005038','draft','2022-03-07','DISA','policy','Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.','SI-19(06)','N/A','Determine if the disclosure of personally identifiable information is prevented by adding non-deterministic noise to the results of mathematical operations before the results are reported.'),\n('005039','draft','2022-03-07','DISA','policy','Perform de-identification using validated algorithms and software that is validated to implement the algorithms.','SI-19(07)','N/A','Determine if: - de-identification is performed using validated algorithms. - de-identification is performed using software that is validated to implement the algorithms.'),\n('005040','draft','2022-03-07','DISA','policy','Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.','SI-19(08)','N/A','Determine if a motivated intruder test is performed on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.'),\n('005041','draft','2022-03-07','DISA','policy','Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization.','SI-20','N/A','Determine if data or capabilities are embedded in [SI-20_ODP; the systems or system components with data or capabilities to be embedded are defined] to determine if organizational data has been exfiltrated or improperly removed from the organization.'),\n('005042','draft','2022-03-07','DISA','policy','Defines the systems or system components used to determine if organizational data has been exfiltrated or improperly removed from the organization.','SI-20','N/A','Determine if data or capabilities are embedded in [SI-20_ODP; the systems or system components with data or capabilities to be embedded are defined] to determine if organizational data has been exfiltrated or improperly removed from the organization.'),\n('005043','draft','2022-03-07','DISA','policy','Refresh organization-defined information at organization-defined frequencies or generate the information on demand and delete the information when no longer needed.','SI-21','N/A','Determine if the [SI-21_ODP[01]; the information to be refreshed is defined] is refreshed [SI-21_ODP[02]; the frequencies at which to refresh information are defined] or is generated on demand and deleted when no longer needed.'),\n('005044','draft','2022-03-07','DISA','policy','Defines the information to be refreshed at organization-defined frequencies or generate the information on demand and delete the information when no longer needed.','SI-21','N/A','Determine if the [SI-21_ODP[01]; the information to be refreshed is defined] is refreshed [SI-21_ODP[02]; the frequencies at which to refresh information are defined] or is generated on demand and deleted when no longer needed.'),\n('005045','draft','2022-03-07','DISA','policy','Defines the frequencies for refreshing organization-defined information.','SI-21','N/A','Determine if the [SI-21_ODP[01]; the information to be refreshed is defined] is refreshed [SI-21_ODP[02]; the frequencies at which to refresh information are defined] or is generated on demand and deleted when no longer needed.'),\n('005046','draft','2022-03-07','DISA','policy','Identify the following alternate sources of information for organization-defined essential functions and services.','SI-22a.','N/A','Determine if [SI-22_ODP[01]; alternative information sources for essential functions and services are defined] for [SI-22_ODP[02]; essential functions and services that require alternative sources of information are defined] are identified.'),\n('005047','draft','2022-03-07','DISA','policy','Defines the alternative information sources for identifying organization-defined essential functions and services.','SI-22a.','N/A','Determine if [SI-22_ODP[01]; alternative information sources for essential functions and services are defined] for [SI-22_ODP[02]; essential functions and services that require alternative sources of information are defined] are identified.'),\n('005048','draft','2022-03-07','DISA','policy','Use an alternate information source for the execution of essential functions or services on organization-defined systems or system components when the primary source of information is corrupted or unavailable.','SI-22b.','N/A','Determine if an alternative information source is used for the execution of essential functions or services on [SI-22_ODP[03]; systems or system components that require an alternative information source for the execution of essential functions or services are defined] when the primary source of information is corrupted or unavailable.'),\n('005049','draft','2022-03-07','DISA','policy','Defines the systems or system components used as an alternate information source for the execution of essential functions or services when the primary source of information is corrupted or unavailable.','SI-22b.','N/A','Determine if an alternative information source is used for the execution of essential functions or services on [SI-22_ODP[03]; systems or system components that require an alternative information source for the execution of essential functions or services are defined] when the primary source of information is corrupted or unavailable.'),\n('005050','draft','2022-03-07','DISA','policy','Based on organization-defined circumstances, fragment the following information.','SI-23a.','N/A','Determine if under [SI-23_ODP[01]; circumstances that require information fragmentation are defined], [SI-23_ODP[02]; the information to be fragmented is defined] is fragmented.'),\n('005051','draft','2022-03-07','DISA','policy','Defines the information for fragmentation.','SI-23a.','N/A','Determine if under [SI-23_ODP[01]; circumstances that require information fragmentation are defined], [SI-23_ODP[02]; the information to be fragmented is defined] is fragmented.'),\n('005052','draft','2022-03-07','DISA','policy','Defines the circumstances for fragmenting organization-defined information.','SI-23a.','N/A','Determine if under [SI-23_ODP[01]; circumstances that require information fragmentation are defined], [SI-23_ODP[02]; the information to be fragmented is defined] is fragmented.'),\n('005053','draft','2022-03-07','DISA','policy','Based on organization-defined circumstances, distribute the fragmented information across the following systems or system components.','SI-23b.','N/A','Determine if under [SI-23_ODP[01]; circumstances that require information fragmentation are defined], the fragmented information is distributed across [SI-23_ODP[03]; systems or system components across which the fragmented information is to be distributed are defined].'),\n('005054','draft','2022-03-07','DISA','policy','Defines the systems or system components used to distribute fragmented information.','SI-23b.','N/A','Determine if under [SI-23_ODP[01]; circumstances that require information fragmentation are defined], the fragmented information is distributed across [SI-23_ODP[03]; systems or system components across which the fragmented information is to be distributed are defined].'),\n('005055','draft','2022-03-07','DISA','policy','Defines the circumstances for distributing fragmented information across organization-defined systems or system components.','SI-23b.','N/A','Determine if under [SI-23_ODP[01]; circumstances that require information fragmentation are defined], the fragmented information is distributed across [SI-23_ODP[03]; systems or system components across which the fragmented information is to be distributed are defined].'),\n('005056','draft','2022-03-07','DISA','policy','Disseminate an organization-level, mission/business process-level, and/or system-level supply chain risk management policy to organization-defined personnel or roles.','SR-01a.','N/A','Determine if: - a supply chain risk management policy is developed and documented. - the supply chain risk management policy is disseminated to [SR-01_ODP[01]; personnel or roles to whom supply chain risk management policy is to be disseminated to is/are defined].'),\n('005057','draft','2022-03-07','DISA','policy','Develop and document an organization-level, mission/business process-level, and/or system-level supply chain risk management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.','SR-01a.01(a)','N/A','Determine if: - the [SR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] supply chain risk management policy addresses purpose. - the [SR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] supply chain risk management policy addresses scope. - [SR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] supply chain risk management policy addresses roles. - the [SR-01_ODP[03];one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] supply chain risk management policy addresses responsibilities. - the [SR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] supply chain risk management policy addresses management commitment. - the [SR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] supply chain risk management policy addresses coordination among organizational entities. - the [SR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] supply chain risk management policy addresses compliance.'),\n('005058','draft','2022-03-07','DISA','policy','Develop and document organization-level, mission/business process-level, and/or system-level supply chain risk management policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.','SR-01a.01(b)','N/A','Determine if the [SR-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] supply chain risk management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.'),\n('005059','draft','2022-03-07','DISA','policy','Develop and document procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls.','SR-01a.02','N/A','Determine if: - supply chain risk management procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls are developed and documented. - the supply chain risk management procedures are disseminated to [SR-01_ODP[02]; personnel or roles to whom supply chain risk management procedures are disseminated to is/are defined].'),\n('005060','draft','2022-03-07','DISA','policy','Designate an organization-defined official to manage the development and documentation of the supply chain risk management policy.','SR-01b.','N/A','Determine if the [SR-01_ODP[04]; an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures.'),\n('005061','draft','2022-03-07','DISA','policy','Designate an organization-defined official to manage the development and documentation of the supply chain risk management procedures.','SR-01b.','N/A','Determine if the [SR-01_ODP[04]; an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures.'),\n('005062','draft','2022-03-07','DISA','policy','Designate an organization-defined official to manage the dissemination of the supply chain risk management policy.','SR-01b.','N/A','Determine if the [SR-01_ODP[04]; an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures.'),\n('005063','draft','2022-03-07','DISA','policy','Designate an organization-defined official to manage the dissemination of the supply chain risk management procedures.','SR-01b.','N/A','Determine if the [SR-01_ODP[04]; an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures is defined] is designated to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures.'),\n('005064','draft','2022-03-07','DISA','policy','Review and update the current supply chain risk management policy on an organization-defined frequency.','SR-01c.01','N/A','Determine if: - the current supply chain risk management policy is reviewed and updated [SR-01_ODP[05]; the frequency at which the current supply chain risk management policy is reviewed and updated is defined]. - the current supply chain risk management policy is reviewed and updated following [SR-01_ODP[06]; events that require the current supply chain risk management policy to be reviewed and updated are defined].'),\n('005065','draft','2022-03-07','DISA','policy','Defines the frequency for reviewing and updating the current supply chain risk management policy.','SR-01c.01','N/A','Determine if: - the current supply chain risk management policy is reviewed and updated [SR-01_ODP[05]; the frequency at which the current supply chain risk management policy is reviewed and updated is defined]. - the current supply chain risk management policy is reviewed and updated following [SR-01_ODP[06]; events that require the current supply chain risk management policy to be reviewed and updated are defined].'),\n('005066','draft','2022-03-07','DISA','policy','Review and update the current supply chain risk management policy following organization-defined events.','SR-01c.01','N/A','Determine if: - the current supply chain risk management policy is reviewed and updated [SR-01_ODP[05]; the frequency at which the current supply chain risk management policy is reviewed and updated is defined]. - the current supply chain risk management policy is reviewed and updated following [SR-01_ODP[06]; events that require the current supply chain risk management policy to be reviewed and updated are defined].'),\n('005067','draft','2022-03-07','DISA','policy','Defines the events following reviewing and updating the current supply chain risk management policy.','SR-01c.01','N/A','Determine if: - the current supply chain risk management policy is reviewed and updated [SR-01_ODP[05]; the frequency at which the current supply chain risk management policy is reviewed and updated is defined]. - the current supply chain risk management policy is reviewed and updated following [SR-01_ODP[06]; events that require the current supply chain risk management policy to be reviewed and updated are defined].'),\n('005068','draft','2022-03-07','DISA','policy','Review and update the current supply chain risk management procedures on an organization-defined frequency.','SR-01c.02','N/A','Determine if: - the current supply chain risk management procedures are reviewed and updated [SR-01_ODP[07]; the frequency at which the current supply chain risk management procedure is reviewed and updated is defined]. - the current supply chain risk management procedures are reviewed and updated following [SR-01_ODP[08]; events that require the supply chain risk management procedures to be reviewed and updated are defined].'),\n('005069','draft','2022-03-07','DISA','policy','Defines the frequency for reviewing and updating the current supply chain risk management procedures.','SR-01c.02','N/A','Determine if: - the current supply chain risk management procedures are reviewed and updated [SR-01_ODP[07]; the frequency at which the current supply chain risk management procedure is reviewed and updated is defined]. - the current supply chain risk management procedures are reviewed and updated following [SR-01_ODP[08]; events that require the supply chain risk management procedures to be reviewed and updated are defined].'),\n('005070','draft','2022-03-07','DISA','policy','Review and update the current supply chain risk management procedures following organization-defined events.','SR-01c.02','N/A','Determine if: - the current supply chain risk management procedures are reviewed and updated [SR-01_ODP[07]; the frequency at which the current supply chain risk management procedure is reviewed and updated is defined]. - the current supply chain risk management procedures are reviewed and updated following [SR-01_ODP[08]; events that require the supply chain risk management procedures to be reviewed and updated are defined].'),\n('005071','draft','2022-03-07','DISA','policy','Defines the events following reviewing and updating the current supply chain risk management procedures.','SR-01c.02','N/A','Determine if: - the current supply chain risk management procedures are reviewed and updated [SR-01_ODP[07]; the frequency at which the current supply chain risk management procedure is reviewed and updated is defined]. - the current supply chain risk management procedures are reviewed and updated following [SR-01_ODP[08]; events that require the supply chain risk management procedures to be reviewed and updated are defined].'),\n('005072','draft','2022-03-07','DISA','policy','Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components, or system services.','SR-02a.','N/A','Determine if: - a plan for managing supply chain risks is developed. - the supply chain risk management plan addresses risks associated with the research and development of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined]. - the supply chain risk management plan addresses risks associated with the design of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined]. - the supply chain risk management plan addresses risks associated with the manufacturing of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined]. - the supply chain risk management plan addresses risks associated with the acquisition of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined]. - the supply chain risk management plan addresses risks associated with the delivery of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined]. - the supply chain risk management plan addresses risks associated with the integration of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined]. - the supply chain risk management plan addresses risks associated with the operation and maintenance of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined]. - the supply chain risk management plan addresses risks associated with the disposal of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined].'),\n('005073','draft','2022-03-07','DISA','policy','Defines the systems, system components, or system services that a plan for managing supply chain risks are developed.','SR-02a.','N/A','Determine if: - a plan for managing supply chain risks is developed. - the supply chain risk management plan addresses risks associated with the research and development of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined]. - the supply chain risk management plan addresses risks associated with the design of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined]. - the supply chain risk management plan addresses risks associated with the manufacturing of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined]. - the supply chain risk management plan addresses risks associated with the acquisition of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined]. - the supply chain risk management plan addresses risks associated with the delivery of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined]. - the supply chain risk management plan addresses risks associated with the integration of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined]. - the supply chain risk management plan addresses risks associated with the operation and maintenance of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined]. - the supply chain risk management plan addresses risks associated with the disposal of [SR-02_ODP[01]; systems, system components, or system services for which a supply chain risk management plan is developed are defined].'),\n('005074','draft','2022-03-07','DISA','policy','Review and update the supply chain risk management plan on an organization-defined frequency, or as required, to address threat, organizational or environmental changes.','SR-02b.','N/A','Determine if the supply chain risk management plan is reviewed and updated [SR-02_ODP[02]; the frequency at which to review and update the supply chain risk management plan is defined] or as required to address threat, organizational, or environmental changes.'),\n('005075','draft','2022-03-07','DISA','policy','Defines the frequency for reviewing and updating the supply chain risk management plan.','SR-02b.','N/A','Determine if the supply chain risk management plan is reviewed and updated [SR-02_ODP[02]; the frequency at which to review and update the supply chain risk management plan is defined] or as required to address threat, organizational, or environmental changes.'),\n('005076','draft','2022-03-07','DISA','policy','Protect the supply chain risk management plan from unauthorized disclosure and modification.','SR-02c.','N/A','Determine if: - the supply chain risk management plan is protected from unauthorized disclosure. - the supply chain risk management plan is protected from unauthorized modification.'),\n('005077','draft','2022-03-07','DISA','policy','Establish a supply chain risk management team consisting of organization-defined personnel, roles, and responsibilities to lead and support the following SCRM activities.','SR-02(01)','N/A','Determine if a supply chain risk management team consisting of [SR-02(01)_ODP[01]; the personnel, roles, and responsibilities of the supply chain risk management team are defined] is established to lead and support [SR-02(01)_ODP[02]; supply chain risk management activities are defined].'),\n('005078','draft','2022-03-07','DISA','policy','Defines the supply chain risk management activities that will be led by a supply chain risk management team consisting of organization-defined personnel, roles, and responsibilities.','SR-02(01)','N/A','Determine if a supply chain risk management team consisting of [SR-02(01)_ODP[01]; the personnel, roles, and responsibilities of the supply chain risk management team are defined] is established to lead and support [SR-02(01)_ODP[02]; supply chain risk management activities are defined].'),\n('005079','draft','2022-03-07','DISA','policy','Defines the personnel, roles, and responsibilities who lead and support organization-defined supply chain risk management activities.','SR-02(01)','N/A','Determine if a supply chain risk management team consisting of [SR-02(01)_ODP[01]; the personnel, roles, and responsibilities of the supply chain risk management team are defined] is established to lead and support [SR-02(01)_ODP[02]; supply chain risk management activities are defined].'),\n('005080','draft','2022-03-07','DISA','policy','Establish a process of processes to identify and address weaknesses or deficiencies in the supply chain elements of organization-defined system or system components in coordination with organization-defined supply chain personnel.','SR-03a.','N/A','Determine if: - a process or processes is/are established to identify and address weaknesses or deficiencies in the supply chain elements and processes of [SR-03_ODP[01]; the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined]. - the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [SR-03_ODP[01]; the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined] is/are coordinated with [SR-03_ODP[02]; supply chain personnel with whom to coordinate the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes is/are defined].'),\n('005081','draft','2022-03-07','DISA','policy','Defines the system or system processes which establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain elements.','SR-03a.','N/A','Determine if: - a process or processes is/are established to identify and address weaknesses or deficiencies in the supply chain elements and processes of [SR-03_ODP[01]; the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined]. - the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [SR-03_ODP[01]; the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined] is/are coordinated with [SR-03_ODP[02]; supply chain personnel with whom to coordinate the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes is/are defined].'),\n('005082','draft','2022-03-07','DISA','policy','Defines the supply chain personnel who, in coordination, establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain elements.','SR-03a.','N/A','Determine if: - a process or processes is/are established to identify and address weaknesses or deficiencies in the supply chain elements and processes of [SR-03_ODP[01]; the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined]. - the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [SR-03_ODP[01]; the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined] is/are coordinated with [SR-03_ODP[02]; supply chain personnel with whom to coordinate the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes is/are defined].'),\n('005083','draft','2022-03-07','DISA','policy','Establish a process of processes to identify and address weaknesses or deficiencies in the processes of organization-defined system or system components in coordination with organization-defined supply chain personnel.','SR-03a.','N/A','Determine if: - a process or processes is/are established to identify and address weaknesses or deficiencies in the supply chain elements and processes of [SR-03_ODP[01]; the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined]. - the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [SR-03_ODP[01]; the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined] is/are coordinated with [SR-03_ODP[02]; supply chain personnel with whom to coordinate the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes is/are defined].'),\n('005084','draft','2022-03-07','DISA','policy','Defines the system or system processes which establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain processes.','SR-03a.','N/A','Determine if: - a process or processes is/are established to identify and address weaknesses or deficiencies in the supply chain elements and processes of [SR-03_ODP[01]; the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined]. - the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [SR-03_ODP[01]; the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined] is/are coordinated with [SR-03_ODP[02]; supply chain personnel with whom to coordinate the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes is/are defined].'),\n('005085','draft','2022-03-07','DISA','policy','Defines the supply chain personnel who, in coordination, establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain processes.','SR-03a.','N/A','Determine if: - a process or processes is/are established to identify and address weaknesses or deficiencies in the supply chain elements and processes of [SR-03_ODP[01]; the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined]. - the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [SR-03_ODP[01]; the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined] is/are coordinated with [SR-03_ODP[02]; supply chain personnel with whom to coordinate the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes is/are defined].'),\n('005086','draft','2022-03-07','DISA','policy','Employ the following controls to protect against supply chain risks to the system, system component, or system service.','SR-03b.','N/A','Determine if [SR-03_ODP[03]; supply chain controls employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events are defined] are employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events.'),\n('005087','draft','2022-03-07','DISA','policy','Limit the harm or consequences from supply chain-related events.','SR-03b.','N/A','Determine if [SR-03_ODP[03]; supply chain controls employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events are defined] are employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events.'),\n('005088','draft','2022-03-07','DISA','policy','Defines the supply chain controls employed for protecting against supply chain risks to the system, system component, or system service.','SR-03b.','N/A','Determine if [SR-03_ODP[03]; supply chain controls employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events are defined] are employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events.'),\n('005089','draft','2022-03-07','DISA','policy','Document the selected and implemented supply chain processes and controls in security and privacy plans, supply chain risk management plan, or organization-defined document.','SR-03c.','N/A','Determine if the selected and implemented supply chain processes and controls are documented in [SR-03_ODP[04]; one or more of the following PARAMETER VALUES is/are selected: {security and privacy plans; supply chain risk management plan; [SR-03_ODP[05]; the document identifying the selected and implemented supply chain processes and controls is defined (if selected)]}].'),\n('005090','draft','2022-03-07','DISA','policy','Defines the document which contains supply chain processes and controls.','SR-03c.','N/A','Determine if the selected and implemented supply chain processes and controls are documented in [SR-03_ODP[04]; one or more of the following PARAMETER VALUES is/are selected: {security and privacy plans; supply chain risk management plan; [SR-03_ODP[05]; the document identifying the selected and implemented supply chain processes and controls is defined (if selected)]}].'),\n('005091','draft','2022-03-07','DISA','policy','Employ a diverse set of sources for the following system components and services.','SR-03(01)','N/A','Determine if: - a diverse set of sources is employed for [SR-03(01)_ODP[01]; system components with a diverse set of sources are defined]. - a diverse set of sources is employed for [SR-03(01)_ODP[02]; services with a diverse set of sources are defined].'),\n('005092','draft','2022-03-07','DISA','policy','Defines the system or system components and services which employ a diverse set of sources.','SR-03(01)','N/A','Determine if: - a diverse set of sources is employed for [SR-03(01)_ODP[01]; system components with a diverse set of sources are defined]. - a diverse set of sources is employed for [SR-03(01)_ODP[02]; services with a diverse set of sources are defined].'),\n('005093','draft','2022-03-07','DISA','policy','Employ the following controls to limit harm from potential adversaries identifying and targeting the organizational supply chain.','SR-03(02)','N/A','Determine if [SR-03(02)_ODP; controls to limit harm from potential supply chain adversaries are defined] are employed to limit harm from potential adversaries identifying and targeting the organizational supply chain.'),\n('005094','draft','2022-03-07','DISA','policy','Defines the controls to be employed to limit harm from potential adversaries identifying and targeting the organizational supply chain.','SR-03(02)','N/A','Determine if [SR-03(02)_ODP; controls to limit harm from potential supply chain adversaries are defined] are employed to limit harm from potential adversaries identifying and targeting the organizational supply chain.'),\n('005095','draft','2022-03-07','DISA','policy','Ensure that the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.','SR-03(03)','N/A','Determine if the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.'),\n('005096','draft','2022-03-07','DISA','policy','Document valid provenance of the following systems, system components, and associated data.','SR-04','N/A','Determine if: - valid provenance is documented for [SR-04_ODP; systems, system components, and associated data that require valid provenance are defined]. - valid provenance is monitored for [SR-04_ODP; systems, system components, and associated data that require valid provenance are defined]. - valid provenance is maintained for [SR-04_ODP; systems, system components, and associated data that require valid provenance are defined].'),\n('005097','draft','2022-03-07','DISA','policy','Monitor valid provenance of the following systems, system components, and associated data.','SR-04','N/A','Determine if: - valid provenance is documented for [SR-04_ODP; systems, system components, and associated data that require valid provenance are defined]. - valid provenance is monitored for [SR-04_ODP; systems, system components, and associated data that require valid provenance are defined]. - valid provenance is maintained for [SR-04_ODP; systems, system components, and associated data that require valid provenance are defined].'),\n('005098','draft','2022-03-07','DISA','policy','Maintain valid provenance of the following systems, system components, and associated data.','SR-04','N/A','Determine if: - valid provenance is documented for [SR-04_ODP; systems, system components, and associated data that require valid provenance are defined]. - valid provenance is monitored for [SR-04_ODP; systems, system components, and associated data that require valid provenance are defined]. - valid provenance is maintained for [SR-04_ODP; systems, system components, and associated data that require valid provenance are defined].'),\n('005099','draft','2022-03-07','DISA','policy','Defines the systems, system components, and associated data for documenting, monitoring, and maintaining valid provenance.','SR-04','N/A','Determine if: - valid provenance is documented for [SR-04_ODP; systems, system components, and associated data that require valid provenance are defined]. - valid provenance is monitored for [SR-04_ODP; systems, system components, and associated data that require valid provenance are defined]. - valid provenance is maintained for [SR-04_ODP; systems, system components, and associated data that require valid provenance are defined].'),\n('005100','draft','2022-03-07','DISA','policy','Establish and maintain unique identification of the following supply chain elements, processes, and personnel associated with the identified system and critical system components.','SR-04(01)','N/A','Determine if: - unique identification of [SR-04(01)_ODP; supply chain elements, processes, and personnel associated with systems and critical system components that require unique identification are defined] is established. - unique identification of [SR-04(01)_ODP; supply chain elements, processes, and personnel associated with systems and critical system components that require unique identification are defined] is maintained.'),\n('005101','draft','2022-03-07','DISA','policy','Defines the supply chain elements, processes, and personnel associated with organization-defined systems and critical system components for establishing and maintaining unique identification.','SR-04(01)','N/A','Determine if: - unique identification of [SR-04(01)_ODP; supply chain elements, processes, and personnel associated with systems and critical system components that require unique identification are defined] is established. - unique identification of [SR-04(01)_ODP; supply chain elements, processes, and personnel associated with systems and critical system components that require unique identification are defined] is maintained.'),\n('005102','draft','2022-03-07','DISA','policy','Establish and maintain unique identification of the following systems and critical components for tracking through the supply chain.','SR-04(02)','N/A','Determine if: - the unique identification of [SR-04(02)_ODP; systems and critical system components that require unique identification for tracking through the supply chain are defined] is established for tracking through the supply chain. - the unique identification of [SR-04(02)_ODP; systems and critical system components that require unique identification for tracking through the supply chain are defined] is maintained for tracking through the supply chain.'),\n('005103','draft','2022-03-07','DISA','policy','Defines the systems and critical system components for tracking through the supply chain.','SR-04(02)','N/A','Determine if: - the unique identification of [SR-04(02)_ODP; systems and critical system components that require unique identification for tracking through the supply chain are defined] is established for tracking through the supply chain. - the unique identification of [SR-04(02)_ODP; systems and critical system components that require unique identification for tracking through the supply chain are defined] is maintained for tracking through the supply chain.'),\n('005104','draft','2022-03-07','DISA','policy','Employ the following controls to validate that the system or system component received is genuine.','SR-04(03)','N/A','Determine if: - [SR-04(03)_ODP[01]; controls to validate that the system or system component received is genuine are defined] are employed to validate that the system or system component received is genuine. - [SR-04(03)_ODP[02]; controls to validate that the system or system component received has not been altered are defined] are employed to validate that the system or system component received has not been altered.'),\n('005105','draft','2022-03-07','DISA','policy','Employ the following controls to validate that the system or system component received has not been altered.','SR-04(03)','N/A','Determine if: - [SR-04(03)_ODP[01]; controls to validate that the system or system component received is genuine are defined] are employed to validate that the system or system component received is genuine. - [SR-04(03)_ODP[02]; controls to validate that the system or system component received has not been altered are defined] are employed to validate that the system or system component received has not been altered.'),\n('005106','draft','2022-03-07','DISA','policy','Defines the controls for validating that the system or system component received is genuine.','SR-04(03)','N/A','Determine if: - [SR-04(03)_ODP[01]; controls to validate that the system or system component received is genuine are defined] are employed to validate that the system or system component received is genuine. - [SR-04(03)_ODP[02]; controls to validate that the system or system component received has not been altered are defined] are employed to validate that the system or system component received has not been altered.'),\n('005107','draft','2022-03-07','DISA','policy','Defines the controls for validating that the system or system component received has not been altered.','SR-04(03)','N/A','Determine if: - [SR-04(03)_ODP[01]; controls to validate that the system or system component received is genuine are defined] are employed to validate that the system or system component received is genuine. - [SR-04(03)_ODP[02]; controls to validate that the system or system component received has not been altered are defined] are employed to validate that the system or system component received has not been altered.'),\n('005108','draft','2022-03-07','DISA','policy','Employ organization-defined controls to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission essential technologies, products, and services.','SR-04(04)','N/A','Determine if: - [SR-04(04)_ODP[01]; controls employed to ensure that the integrity of the system and system component are defined] are employed to ensure the integrity of the system and system components. - [SR-04(04)_ODP[02]; an analysis method to be conducted to validate the internal composition and provenance of critical or mission-essential technologies, products, and services to ensure the integrity of the system and system component is defined] is conducted to ensure the integrity of the system and system components.'),\n('005109','draft','2022-03-07','DISA','policy','Defines the controls for ensuring the integrity of the system and system components.','SR-04(04)','N/A','Determine if: - [SR-04(04)_ODP[01]; controls employed to ensure that the integrity of the system and system component are defined] are employed to ensure the integrity of the system and system components. - [SR-04(04)_ODP[02]; an analysis method to be conducted to validate the internal composition and provenance of critical or mission-essential technologies, products, and services to ensure the integrity of the system and system component is defined] is conducted to ensure the integrity of the system and system components.'),\n('005110','draft','2022-03-07','DISA','policy','Conduct organization-defined analysis to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission essential technologies, products, and services.','SR-04(04)','N/A','Determine if: - [SR-04(04)_ODP[01]; controls employed to ensure that the integrity of the system and system component are defined] are employed to ensure the integrity of the system and system components. - [SR-04(04)_ODP[02]; an analysis method to be conducted to validate the internal composition and provenance of critical or mission-essential technologies, products, and services to ensure the integrity of the system and system component is defined] is conducted to ensure the integrity of the system and system components.'),\n('005111','draft','2022-03-07','DISA','policy','Defines the analysis for ensuring the integrity of the system and system components.','SR-04(04)','N/A','Determine if: - [SR-04(04)_ODP[01]; controls employed to ensure that the integrity of the system and system component are defined] are employed to ensure the integrity of the system and system components. - [SR-04(04)_ODP[02]; an analysis method to be conducted to validate the internal composition and provenance of critical or mission-essential technologies, products, and services to ensure the integrity of the system and system component is defined] is conducted to ensure the integrity of the system and system components.'),\n('005112','draft','2022-03-07','DISA','policy','Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks.','SR-05','N/A','Determine if: - [SR-05_ODP; acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks are defined] are employed to protect against supply chain risks. - [SR-05_ODP; acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks are defined] are employed to identify supply chain risks. - [SR-05_ODP; acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks are defined] are employed to mitigate supply chain risks.'),\n('005113','draft','2022-03-07','DISA','policy','Defines the acquisition strategies, contract tools, and procurement methods for protecting against, identifying, and mitigating supply chain risks.','SR-05','N/A','Determine if: - [SR-05_ODP; acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks are defined] are employed to protect against supply chain risks. - [SR-05_ODP; acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks are defined] are employed to identify supply chain risks. - [SR-05_ODP; acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks are defined] are employed to mitigate supply chain risks.'),\n('005114','draft','2022-03-07','DISA','policy','Employ the following controls to ensure an adequate supply of organization-defined critical system components.','SR-05(01)','N/A','Determine if [SR-05(01)_ODP[01]; controls to ensure an adequate supply of critical system components are defined] are employed to ensure an adequate supply of [SR-05(01)_ODP[02]; critical system components of which an adequate supply is required are defined].'),\n('005115','draft','2022-03-07','DISA','policy','Defines the controls for ensuring an adequate supply of organization-defined critical system components.','SR-05(01)','N/A','Determine if [SR-05(01)_ODP[01]; controls to ensure an adequate supply of critical system components are defined] are employed to ensure an adequate supply of [SR-05(01)_ODP[02]; critical system components of which an adequate supply is required are defined].'),\n('005116','draft','2022-03-07','DISA','policy','Defines the critical system components that the organization-defined controls ensure an adequate supply of.','SR-05(01)','N/A','Determine if [SR-05(01)_ODP[01]; controls to ensure an adequate supply of critical system components are defined] are employed to ensure an adequate supply of [SR-05(01)_ODP[02]; critical system components of which an adequate supply is required are defined].'),\n('005117','draft','2022-03-07','DISA','policy','Access the system, system component, or system service prior to selection, acceptance, modification, or update.','SR-05(02)','N/A','Determine if: - the system, system component, or system service is assessed prior to selection. - the system, system component, or system service is assessed prior to acceptance. - the system, system component, or system service is assessed prior to modification. - the system, system component, or system service is assessed prior to update.'),\n('005118','draft','2022-03-07','DISA','policy','Access and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide on an organization-defined frequency.','SR-06','N/A','Determine if the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide are assessed and reviewed [SR-06_ODP; the frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide is defined].'),\n('005119','draft','2022-03-07','DISA','policy','Defines the frequency for assessing and reviewing the supply chain risks.','SR-06','N/A','Determine if the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide are assessed and reviewed [SR-06_ODP; the frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide is defined].'),\n('005120','draft','2022-03-07','DISA','policy','Employ organizational analysis, independent third-party analysis, organizational testing, and/or independent third-party testing of the following supply chain elements, processes, and actors associated with the system, system component, or system service.','SR-06(01)','N/A','Determine if [SR-06(01)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {organizational analysis; independent third-party analysis; organizational testing; independent third-party testing}] is/are employed on [SR-06(01)_ODP[02]; supply chain elements, processes, and actors to be analyzed and tested are defined] associated with the system, system component, or system service.'),\n('005121','draft','2022-03-07','DISA','policy','Defines the supply chain elements, processes, and actors for employing organizational analysis, independent third-party analysis, organizational testing, and/or independent third-party testing.','SR-06(01)','N/A','Determine if [SR-06(01)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {organizational analysis; independent third-party analysis; organizational testing; independent third-party testing}] is/are employed on [SR-06(01)_ODP[02]; supply chain elements, processes, and actors to be analyzed and tested are defined] associated with the system, system component, or system service.'),\n('005122','draft','2022-03-07','DISA','policy','Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service.','SR-07','N/A','Determine if [SR-07_ODP; Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service are defined] are employed to protect supply chain-related information for the system, system component, or system service.'),\n('005123','draft','2022-03-07','DISA','policy','Defines the Operations Security (OPSEC) controls that protect supply chain-related information for the system, system component, or system service.','SR-07','N/A','Determine if [SR-07_ODP; Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service are defined] are employed to protect supply chain-related information for the system, system component, or system service.'),\n('005124','draft','2022-03-07','DISA','policy','Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the notification of supply chain compromises, results of assessments or audits, and/or organization-defined information.','SR-08','N/A','Determine if agreements and procedures are established with entities involved in the supply chain for the system, system components, or system service for [SR-08_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {notification of supply chain compromises; [SR-08_ODP[02]; information for which agreements and procedures are to be established are defined (if selected)]}].'),\n('005125','draft','2022-03-07','DISA','policy','Defines the information for establishing agreements and procedures with entities involved in the supply chain for the system, system component, or system service.','SR-08','N/A','Determine if agreements and procedures are established with entities involved in the supply chain for the system, system components, or system service for [SR-08_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {notification of supply chain compromises; [SR-08_ODP[02]; information for which agreements and procedures are to be established are defined (if selected)]}].'),\n('005126','draft','2022-03-07','DISA','policy','Implement a tamper protection program for the system, system component, or system service.','SR-09','N/A','Determine if a tamper protection program is implemented for the system, system component, or system service.'),\n('005127','draft','2022-03-07','DISA','policy','Employ anti-tamper technologies, tool, and techniques throughout the system development life cycle.','SR-09(01)','N/A','Determine if anti-tamper technologies, tools, and techniques are employed throughout the system development life cycle.'),\n('005128','draft','2022-03-07','DISA','policy','Inspect the following systems or system components at random, at organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.','SR-10','N/A','Determine if [SR-10_ODP[01]; systems or system components that require inspection are defined] are inspected [SR-10_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {at random; at [SR-10_ODP[03]; frequency at which to inspect systems or system components is defined (if selected)]; upon [SR-10_ODP[04]; indications of the need for an inspection of systems or system components are defined (if selected)]}] to detect tampering.'),\n('005129','draft','2022-03-07','DISA','policy','Defines the frequency for inspecting systems or system components.','SR-10','N/A','Determine if [SR-10_ODP[01]; systems or system components that require inspection are defined] are inspected [SR-10_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {at random; at [SR-10_ODP[03]; frequency at which to inspect systems or system components is defined (if selected)]; upon [SR-10_ODP[04]; indications of the need for an inspection of systems or system components are defined (if selected)]}] to detect tampering.'),\n('005130','draft','2022-03-07','DISA','policy','Defines the indications of need for inspection for detecting tampering.','SR-10','N/A','Determine if [SR-10_ODP[01]; systems or system components that require inspection are defined] are inspected [SR-10_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {at random; at [SR-10_ODP[03]; frequency at which to inspect systems or system components is defined (if selected)]; upon [SR-10_ODP[04]; indications of the need for an inspection of systems or system components are defined (if selected)]}] to detect tampering.'),\n('005131','draft','2022-03-07','DISA','policy','Defines the system or system components which will be inspected at random, at organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.','SR-10','N/A','Determine if [SR-10_ODP[01]; systems or system components that require inspection are defined] are inspected [SR-10_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {at random; at [SR-10_ODP[03]; frequency at which to inspect systems or system components is defined (if selected)]; upon [SR-10_ODP[04]; indications of the need for an inspection of systems or system components are defined (if selected)]}] to detect tampering.'),\n('005132','draft','2022-03-07','DISA','policy','Develop and document anti-counterfeit policy that include the means to detect and prevent counterfeit components from entering the system.','SR-11a.','N/A','Determine if: - an anti-counterfeit policy is developed and implemented. - anti-counterfeit procedures are developed and implemented.  - the anti-counterfeit procedures include the means to detect counterfeit components entering the system. - the anti-counterfeit procedures include the means to prevent counterfeit components from entering the system.'),\n('005133','draft','2022-03-07','DISA','policy','Develop and document anti-counterfeit procedures that include the means to detect and prevent counterfeit components from entering the system.','SR-11a.','N/A','Determine if: - an anti-counterfeit policy is developed and implemented. - anti-counterfeit procedures are developed and implemented.  - the anti-counterfeit procedures include the means to detect counterfeit components entering the system. - the anti-counterfeit procedures include the means to prevent counterfeit components from entering the system.'),\n('005134','draft','2022-03-07','DISA','policy','Report counterfeit system components to source of counterfeit component, organization-defined external reporting organizations, and/or organization-defined personnel or roles.','SR-11b.','N/A','Determine if counterfeit system components are reported to [SR-11_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {source of counterfeit component; [SR-11_ODP[02]; external reporting organizations to whom counterfeit system components are to be reported is/are defined (if selected)]; [SR-11_ODP[03]; personnel or roles to whom counterfeit system components are to be reported is/are defined (if selected)]}].'),\n('005135','draft','2022-03-07','DISA','policy','Defines the external reporting organizations who report counterfeit system components.','SR-11b.','N/A','Determine if counterfeit system components are reported to [SR-11_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {source of counterfeit component; [SR-11_ODP[02]; external reporting organizations to whom counterfeit system components are to be reported is/are defined (if selected)]; [SR-11_ODP[03]; personnel or roles to whom counterfeit system components are to be reported is/are defined (if selected)]}].'),\n('005136','draft','2022-03-07','DISA','policy','Defines the personnel or roles who report counterfeit system components.','SR-11b.','N/A','Determine if counterfeit system components are reported to [SR-11_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {source of counterfeit component; [SR-11_ODP[02]; external reporting organizations to whom counterfeit system components are to be reported is/are defined (if selected)]; [SR-11_ODP[03]; personnel or roles to whom counterfeit system components are to be reported is/are defined (if selected)]}].'),\n('005137','draft','2022-03-07','DISA','policy','Train organization-defined personnel or roles to detect counterfeit system components including hardware, software, and firmware.','SR-11(01)','N/A','Determine if [SR-11(01)_ODP; personnel or roles requiring training to detect counterfeit system components (including hardware, software, and firmware) is/are defined] are trained to detect counterfeit system components (including hardware, software, and firmware).'),\n('005138','draft','2022-03-07','DISA','policy','Defines the personnel or roles who are trained to detect counterfeit system components (including hardware, software, and firmware).','SR-11(01)','N/A','Determine if [SR-11(01)_ODP; personnel or roles requiring training to detect counterfeit system components (including hardware, software, and firmware) is/are defined] are trained to detect counterfeit system components (including hardware, software, and firmware).'),\n('005139','draft','2022-03-07','DISA','policy','Maintain configuration control over the following system components awaiting service or repair.','SR-11(02)','N/A','Determine if: - configuration control over [SR-11(02)_ODP; system components requiring configuration control are defined] awaiting service or repair is maintained. - configuration control over serviced or repaired [SR-11(02)_ODP; system components requiring configuration control are defined] awaiting return to service is maintained.'),\n('005140','draft','2022-03-07','DISA','policy','Maintain configuration control over serviced or repaired components awaiting return to service.','SR-11(02)','N/A','Determine if: - configuration control over [SR-11(02)_ODP; system components requiring configuration control are defined] awaiting service or repair is maintained. - configuration control over serviced or repaired [SR-11(02)_ODP; system components requiring configuration control are defined] awaiting return to service is maintained.'),\n('005141','draft','2022-03-07','DISA','policy','Defines the system components awaiting service or repair.','SR-11(02)','N/A','Determine if: - configuration control over [SR-11(02)_ODP; system components requiring configuration control are defined] awaiting service or repair is maintained. - configuration control over serviced or repaired [SR-11(02)_ODP; system components requiring configuration control are defined] awaiting return to service is maintained.'),\n('005142','draft','2022-03-07','DISA','policy','Scan for counterfeit system components on an organization-defined frequency.','SR-11(03)','N/A','Determine if scanning for counterfeit system components is conducted [SR-11(03)_ODP; the frequency at which to scan for counterfeit system components is defined].'),\n('005143','draft','2022-03-07','DISA','policy','Defines the frequency for which the counterfeit system components are scanned.','SR-11(03)','N/A','Determine if scanning for counterfeit system components is conducted [SR-11(03)_ODP; the frequency at which to scan for counterfeit system components is defined].'),\n('005144','draft','2022-03-07','DISA','policy','Dispose of organization-defined data, documentation, tools, or system components using the following techniques and methods.','SR-12','N/A','Determine if [SR-12_ODP[01]; data, documentation, tools, or system components to be disposed of are defined] are disposed of using [SR-12_ODP[02]; techniques and methods for disposing of data, documentation, tools, or system components are defined].'),\n('005145','draft','2022-03-07','DISA','policy','Defines the data, documentation, tools, or system components which are to be disposed of using organization-defined techniques and methods.','SR-12','N/A','Determine if [SR-12_ODP[01]; data, documentation, tools, or system components to be disposed of are defined] are disposed of using [SR-12_ODP[02]; techniques and methods for disposing of data, documentation, tools, or system components are defined].'),\n('005146','draft','2022-03-07','DISA','policy','Defines the techniques or methods used to dispose of organization-defined data, documentation, tools, or system components.','SR-12','N/A','Determine if [SR-12_ODP[01]; data, documentation, tools, or system components to be disposed of are defined] are disposed of using [SR-12_ODP[02]; techniques and methods for disposing of data, documentation, tools, or system components are defined].'),\n('005147','draft','2022-03-08','DISA','policy','Provide basic privacy literacy training to system users (including managers, senior executives, and contractors) as part of initial training for new users.','AT-02a.01','N/A','Determine if: - security literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users. - privacy literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users. - security literacy training is provided to system users (including managers, senior executives, and contractors) [AT-02_ODP[01]; the frequency at which to provide security literacy training to system users (including managers, senior executives, and contractors) after initial training is defined] thereafter. - privacy literacy training is provided to system users (including managers, senior executives, and contractors) [AT-02_ODP[02]; the frequency at which to provide privacy literacy training to system users (including managers, senior executives, and contractors) after initial training is defined] thereafter.'),\n('005149','draft','2023-07-17','DISA FSO','policy','Implement organization-defined measures to disassociate individuals from audit information transmitted across organizational boundaries.',NULL,'N/A',NULL),\n('005150','draft','2023-07-17','DISA FSO','policy','Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.',NULL,'N/A',NULL),\n('005151','draft','2024-11-18','DISA','policy','Review and update incident response training content at an organization-defined frequency and following organization-defined events.',NULL,'N/A',NULL),\n('005152','draft','2024-11-18','DISA','policy','Defines the frequency to review and update incident response training content.',NULL,'N/A',NULL),\n('005153','draft','2024-11-18','DISA','policy','Defines events that require the review and update of incident response training content.',NULL,'N/A',NULL),\n('005154','draft','2024-11-18','DISA','policy','Increase the availability of incident response information and support using organization-defined automated mechanisms.',NULL,'N/A',NULL),\n('005155','draft','2025-01-23','DISA','policy','Employ identity providers and authorization servers to manage user, device, and non-person entity (NPE) identities, attributes, and access rights supporting authentication and authorization decisions in accordance with organization-defined identification and authentication policy using organization-defined mechanisms.',NULL,'N/A',NULL),\n('005156','draft','2025-01-23','DISA','policy','Cryptographic keys that protect access tokens are generated, managed, and protected from disclosure and misuse.',NULL,'N/A',NULL),\n('005157','draft','2025-01-23','DISA','policy','The private keys used to sign assertions and tokens are protected commensurate with the impact of the system and information resources that can be accessed.',NULL,'N/A',NULL),\n('005158','draft','2025-01-23','DISA','technical','Assertions are generated in accordance with organization-defined identification and authentication policy.',NULL,'N/A',NULL),\n('005159','draft','2025-01-23','DISA','technical','Assertions are issued in accordance with organization-defined identification and authentication policy.',NULL,'N/A',NULL),\n('005160','draft','2025-01-23','DISA','technical','Assertions are refreshed in accordance with organization-defined identification and authentication policy.',NULL,'N/A',NULL),\n('005161','draft','2025-01-23','DISA','technical','Assertions are revoked in accordance with organization-defined identification and authentication policy.',NULL,'N/A',NULL),\n('005162','draft','2025-01-23','DISA','technical','Assertions are time-restricted in accordance with organization-defined identification and authentication policy.',NULL,'N/A',NULL),\n('005163','draft','2025-01-23','DISA','technical','Assertions are audience-restricted in accordance with organization-defined identification and authentication policy.',NULL,'N/A',NULL),\n('005164','draft','2025-01-23','DISA','technical','Access tokens are generated in accordance with organization-defined identification and authentication policy.',NULL,'N/A',NULL),\n('005165','draft','2025-01-23','DISA','technical','Access tokens are issued in accordance with organization-defined identification and authentication policy.',NULL,'N/A',NULL),\n('005166','draft','2025-01-23','DISA','technical','Access tokens are refreshed in accordance with organization-defined identification and authentication policy.',NULL,'N/A',NULL),\n('005167','draft','2025-01-23','DISA','technical','Access tokens are revoked in accordance with organization-defined identification and authentication policy.',NULL,'N/A',NULL),\n('005168','draft','2025-01-23','DISA','technical','Access tokens are time-restricted in accordance with organization-defined identification and authentication policy.',NULL,'N/A',NULL),\n('005169','draft','2025-01-23','DISA','technical','Access tokens are audience-restricted in accordance with organization-defined identification and authentication policy.',NULL,'N/A',NULL);\n/*!40000 ALTER TABLE `cci` ENABLE KEYS */;\nUNLOCK TABLES;\n\n--\n-- Data for table `cci_reference_map`\n--\n\nLOCK TABLES `cci_reference_map` WRITE;\n/*!40000 ALTER TABLE `cci_reference_map` DISABLE KEYS */;\nINSERT INTO `cci_reference_map` (`cci`, `creator`, `title`, `version`, `location`, `indexDisa`, `textRefNist`, `parentControl`) VALUES ('000002','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 1 (a)','AC-1a1(a)','AC-1'),\n('000003','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 c 1','AC-1c1','AC-1'),\n('000005','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 2','AC-1a2','AC-1'),\n('000006','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 c 2','AC-1c2','AC-1'),\n('000010','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 e','AC-2e','AC-2'),\n('000011','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 f','AC-2f','AC-2'),\n('000012','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 j','AC-2j','AC-2'),\n('000015','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (1)','AC-2(1)','AC-2'),\n('000016','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (2)','AC-2(2)','AC-2'),\n('000017','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (3) (d)','AC-2(3)(d)','AC-2'),\n('000018','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2(4)','AC-2'),\n('000019','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (5)','AC-2(5)','AC-2'),\n('000021','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (2)','AC-3(2)','AC-3'),\n('000024','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (5)','AC-3(5)','AC-3'),\n('000026','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (2)','AC-4(2)','AC-4'),\n('000027','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (3)','AC-4(3)','AC-4'),\n('000028','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (4)','AC-4(4)','AC-4'),\n('000029','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (5)','AC-4(5)','AC-4'),\n('000030','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (6)','AC-4(6)','AC-4'),\n('000031','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (7)','AC-4(7)','AC-4'),\n('000032','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (8) (a)','AC-4(8)(a)','AC-4'),\n('000034','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (10)','AC-4(10)','AC-4'),\n('000035','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (11)','AC-4(11)','AC-4'),\n('000039','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (2)','AC-6(2)','AC-6'),\n('000041','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (3)','AC-6(3)','AC-6'),\n('000042','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (3)','AC-6(3)','AC-6'),\n('000043','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 a','AC-7a','AC-7'),\n('000044','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 a','AC-7a','AC-7'),\n('000048','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 a','AC-8a','AC-8'),\n('000050','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 b','AC-8b','AC-8'),\n('000052','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-9','AC-9','AC-9'),\n('000053','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (1)','AC-9(1)','AC-9'),\n('000054','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-10','AC-10','AC-10'),\n('000055','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-10','AC-10','AC-10'),\n('000056','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-11 b','AC-11b','AC-11'),\n('000057','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-11 a','AC-11a','AC-11'),\n('000059','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-11 a','AC-11a','AC-11'),\n('000060','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-11 (1)','AC-11(1)','AC-11'),\n('000061','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-14 a','AC-14a','AC-14'),\n('000065','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 b','AC-17b','AC-17'),\n('000067','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (1)','AC-17(1)','AC-17'),\n('000068','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (2)','AC-17(2)','AC-17'),\n('000069','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (3)','AC-17(3)','AC-17'),\n('000070','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (4) (a)','AC-17(4)(a)','AC-17'),\n('000072','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (6)','AC-17(6)','AC-17'),\n('000073','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 1','PM-1a1','PM-1'),\n('000074','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 4','PM-1a4','PM-1'),\n('000075','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 b','PM-1b','PM-1'),\n('000076','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 b','PM-1b','PM-1'),\n('000078','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-2','PM-2','PM-2'),\n('000080','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-3 a','PM-3a','PM-3'),\n('000083','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 a','AC-19a','AC-19'),\n('000084','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 b','AC-19b','AC-19'),\n('000093','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 a 1','AC-20a1','AC-20'),\n('000097','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (2)','AC-20(2)','AC-20'),\n('000098','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-21 a','AC-21a','AC-21'),\n('000099','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-21 (1)','AC-21(1)','AC-21'),\n('000100','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 a 1 (a)','AT-1a1(a)','AT-1'),\n('000101','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 a 1 (a)','AT-1a1(a)','AT-1'),\n('000102','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 c 1','AT-1c1','AT-1'),\n('000103','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 a 2','AT-1a2','AT-1'),\n('000104','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 a 2','AT-1a2','AT-1'),\n('000105','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 c 2','AT-1c2','AT-1'),\n('000106','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 a 1','AT-2a1','AT-2'),\n('000107','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 (1)','AT-2(1)','AT-2'),\n('000108','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 a 1','AT-3a1','AT-3'),\n('000109','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 a 2','AT-3a2','AT-3'),\n('000112','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 a 2','AT-2a2','AT-2'),\n('000113','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-4 a','AT-4a','AT-4'),\n('000114','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-4 a','AT-4a','AT-4'),\n('000117','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 1 (a)','AU-1a1(a)','AU-1'),\n('000119','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 c 1','AU-1c1','AU-1'),\n('000120','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 2','AU-1a2','AU-1'),\n('000122','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 c 2','AU-1c2','AU-1'),\n('000123','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 a','AU-2a','AU-2'),\n('000124','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 b','AU-2b','AU-2'),\n('000125','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 d','AU-2d','AU-2'),\n('000126','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 c','AU-2c','AU-2'),\n('000130','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 a','AU-3a','AU-3'),\n('000131','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 b','AU-3b','AU-3'),\n('000132','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 c','AU-3c','AU-3'),\n('000133','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 d','AU-3d','AU-3'),\n('000134','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 e','AU-3e','AU-3'),\n('000135','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 (1)','AU-3(1)','AU-3'),\n('000139','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 a','AU-5a','AU-5'),\n('000140','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 b','AU-5b','AU-5'),\n('000141','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-3 c','PM-3c','PM-3'),\n('000142','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 1','PM-4a1','PM-4'),\n('000145','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (3)','AU-5(3)','AU-5'),\n('000147','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (2)','AU-5(2)','AU-5'),\n('000148','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 a','AU-6a','AU-6'),\n('000149','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 b','AU-6b','AU-6'),\n('000151','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 a','AU-6a','AU-6'),\n('000153','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (3)','AU-6(3)','AU-6'),\n('000154','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (4)','AU-6(4)','AU-6'),\n('000158','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 (1)','AU-7(1)','AU-7'),\n('000159','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-8 a','AU-8a','AU-8'),\n('000162','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 a','AU-9a','AU-9'),\n('000163','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 a','AU-9a','AU-9'),\n('000164','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 a','AU-9a','AU-9'),\n('000165','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (1)','AU-9(1)','AU-9'),\n('000166','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-10','AU-10','AU-10'),\n('000167','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-11','AU-11','AU-11'),\n('000168','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-11','AU-11','AU-11'),\n('000169','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 a','AU-12a','AU-12'),\n('000170','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 2','PM-4a2','PM-4'),\n('000171','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 b','AU-12b','AU-12'),\n('000172','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 c','AU-12c','AU-12'),\n('000173','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (1)','AU-12(1)','AU-12'),\n('000174','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (1)','AU-12(1)','AU-12'),\n('000176','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 b','IA-5b','IA-5'),\n('000182','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 f','IA-5f','IA-5'),\n('000183','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 g','IA-5g','IA-5'),\n('000184','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 h','IA-5h','IA-5'),\n('000185','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (2) (b) (1)','IA-5(2)(b)(1)','IA-5'),\n('000186','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (2) (a) (1)','IA-5(2)(a)(1)','IA-5'),\n('000187','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (2) (a) (2)','IA-5(2)(a)(2)','IA-5'),\n('000197','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (c)','IA-5(1)(c)','IA-5'),\n('000201','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (6)','IA-5(6)','IA-5'),\n('000204','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (8)','IA-5(8)','IA-5'),\n('000206','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-6','IA-6','IA-6'),\n('000209','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-6','PM-6','PM-6'),\n('000210','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-6','PM-6','PM-6'),\n('000211','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-6','PM-6','PM-6'),\n('000212','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-7','PM-7','PM-7'),\n('000213','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3','AC-3','AC-3'),\n('000216','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-8','PM-8','PM-8'),\n('000217','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (3)','AC-2(3)','AC-2'),\n('000219','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (13)','AC-4(13)','AC-4'),\n('000225','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6','AC-6','AC-6'),\n('000227','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-9 a 1','PM-9a1','PM-9'),\n('000228','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-9 b','PM-9b','PM-9'),\n('000232','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-14 b','AC-14b','AC-14'),\n('000233','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-10 b','PM-10b','PM-10'),\n('000234','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-10 c','PM-10c','PM-10'),\n('000235','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-11 a','PM-11a','PM-11'),\n('000236','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-11 b','PM-11b','PM-11'),\n('000238','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 c 1','CA-1c1','CA-1'),\n('000239','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 1 (a)','CA-1a1(a)','CA-1'),\n('000240','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 1 (a)','CA-1a1(a)','CA-1'),\n('000241','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 c 1','CA-1c1','CA-1'),\n('000242','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 2','CA-1a2','CA-1'),\n('000243','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 2','CA-1a2','CA-1'),\n('000244','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 c 2','CA-1c2','CA-1'),\n('000246','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 b 1','CA-2b1','CA-2'),\n('000247','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 b 2','CA-2b2','CA-2'),\n('000248','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 b 3','CA-2b3','CA-2'),\n('000251','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 d','CA-2d','CA-2'),\n('000252','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 d','CA-2d','CA-2'),\n('000253','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 e','CA-2e','CA-2'),\n('000254','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 f','CA-2f','CA-2'),\n('000255','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (1)','CA-2(1)','CA-2'),\n('000256','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (2)','CA-2(2)','CA-2'),\n('000258','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 b','CA-3b','CA-3'),\n('000259','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 b','CA-3b','CA-3'),\n('000264','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-5 a','CA-5a','CA-5'),\n('000265','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-5 b','CA-5b','CA-5'),\n('000266','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-5 b','CA-5b','CA-5'),\n('000267','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-5 (1)','CA-5(1)','CA-5'),\n('000268','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-5 (1)','CA-5(1)','CA-5'),\n('000269','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-5 (1)','CA-5(1)','CA-5'),\n('000270','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-6 a','CA-6a','CA-6'),\n('000271','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-6 c 2','CA-6c2','CA-6'),\n('000272','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-6 e','CA-6e','CA-6'),\n('000273','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-6 e','CA-6e','CA-6'),\n('000274','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7','CA-7','CA-7'),\n('000279','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 c','CA-7c','CA-7'),\n('000280','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 g','CA-7g','CA-7'),\n('000281','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 g','CA-7g','CA-7'),\n('000282','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 (1)','CA-7(1)','CA-7'),\n('000286','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 c 1','CM-1c1','CM-1'),\n('000287','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 1 (a)','CM-1a1(a)','CM-1'),\n('000289','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 c 1','CM-1c1','CM-1'),\n('000290','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 2','CM-1a2','CM-1'),\n('000292','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 2','CM-1a2','CM-1'),\n('000295','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 a','CM-2a','CM-2'),\n('000296','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 b 1','CM-2b1','CM-2'),\n('000297','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 b 2','CM-2b2','CM-2'),\n('000300','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (2)','CM-2(2)','CM-2'),\n('000301','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (2)','CM-2(2)','CM-2'),\n('000302','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (2)','CM-2(2)','CM-2'),\n('000303','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (2)','CM-2(2)','CM-2'),\n('000304','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (3)','CM-2(3)','CM-2'),\n('000311','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (6)','CM-2(6)','CM-2'),\n('000312','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (6)','CM-2(6)','CM-2'),\n('000313','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 a','CM-3a','CM-3'),\n('000314','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 b','CM-3b','CM-3'),\n('000316','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 e','CM-3e','CM-3'),\n('000318','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 f','CM-3f','CM-3'),\n('000319','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 g','CM-3g','CM-3'),\n('000320','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 g','CM-3g','CM-3'),\n('000321','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 g','CM-3g','CM-3'),\n('000322','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (a)','CM-3(1)(a)','CM-3'),\n('000323','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (b)','CM-3(1)(b)','CM-3'),\n('000324','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (c)','CM-3(1)(c)','CM-3'),\n('000325','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (d)','CM-3(1)(d)','CM-3'),\n('000326','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (e)','CM-3(1)(e)','CM-3'),\n('000327','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (2)','CM-3(2)','CM-3'),\n('000328','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (2)','CM-3(2)','CM-3'),\n('000329','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (2)','CM-3(2)','CM-3'),\n('000330','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (3)','CM-3(3)','CM-3'),\n('000331','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (3)','CM-3(3)','CM-3'),\n('000332','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (4)','CM-3(4)','CM-3'),\n('000333','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-4','CM-4','CM-4'),\n('000335','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-4 (2)','CM-4(2)','CM-4'),\n('000336','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-4 (2)','CM-4(2)','CM-4'),\n('000337','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-4 (2)','CM-4(2)','CM-4'),\n('000340','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5','CM-5','CM-5'),\n('000341','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5','CM-5','CM-5'),\n('000344','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5','CM-5','CM-5'),\n('000345','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5','CM-5','CM-5'),\n('000353','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (4)','CM-5(4)','CM-5'),\n('000354','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (4)','CM-5(4)','CM-5'),\n('000366','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 b','CM-6b','CM-6'),\n('000367','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 c','CM-6c','CM-6'),\n('000368','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 c','CM-6c','CM-6'),\n('000369','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 c','CM-6c','CM-6'),\n('000370','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (1)','CM-6(1)','CM-6'),\n('000371','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (1)','CM-6(1)','CM-6'),\n('000372','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (1)','CM-6(1)','CM-6'),\n('000380','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 b','CM-7b','CM-7'),\n('000381','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 a','CM-7a','CM-7'),\n('000382','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 b','CM-7b','CM-7'),\n('000384','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (1) (a)','CM-7(1)(a)','CM-7'),\n('000387','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (3)','CM-7(3)','CM-7'),\n('000388','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (3)','CM-7(3)','CM-7'),\n('000398','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 5','CM-8a5','CM-8'),\n('000408','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (1)','CM-8(1)','CM-8'),\n('000409','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (1)','CM-8(1)','CM-8'),\n('000410','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (1)','CM-8(1)','CM-8'),\n('000411','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (2)','CM-8(2)','CM-8'),\n('000412','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (2)','CM-8(2)','CM-8'),\n('000413','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (2)','CM-8(2)','CM-8'),\n('000414','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (2)','CM-8(2)','CM-8'),\n('000415','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (3) (a)','CM-8(3)(a)','CM-8'),\n('000416','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (3) (a)','CM-8(3)(a)','CM-8'),\n('000418','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (4)','CM-8(4)','CM-8'),\n('000420','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (6)','CM-8(6)','CM-8'),\n('000423','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 a','CM-9a','CM-9'),\n('000426','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 c','CM-9c','CM-9'),\n('000436','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 (1)','CM-9(1)','CM-9'),\n('000437','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 c 1','CP-1c1','CP-1'),\n('000438','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 a 1 (a)','CP-1a1(a)','CP-1'),\n('000439','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 a 1 (a)','CP-1a1(a)','CP-1'),\n('000440','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 c 1','CP-1c1','CP-1'),\n('000441','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 a 2','CP-1a2','CP-1'),\n('000443','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 1','CP-2a1','CP-2'),\n('000444','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 1','CP-2a1','CP-2'),\n('000445','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 1','CP-2a1','CP-2'),\n('000446','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 2','CP-2a2','CP-2'),\n('000447','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 2','CP-2a2','CP-2'),\n('000448','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 2','CP-2a2','CP-2'),\n('000449','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 3','CP-2a3','CP-2'),\n('000456','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 5','CP-2a5','CP-2'),\n('000457','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 7','CP-2a7','CP-2'),\n('000458','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 b','CP-2b','CP-2'),\n('000459','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 b','CP-2b','CP-2'),\n('000460','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 c','CP-2c','CP-2'),\n('000461','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 d','CP-2d','CP-2'),\n('000462','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 d','CP-2d','CP-2'),\n('000463','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 e','CP-2e','CP-2'),\n('000464','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 e','CP-2e','CP-2'),\n('000465','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 e','CP-2e','CP-2'),\n('000466','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 e','CP-2e','CP-2'),\n('000468','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 f','CP-2f','CP-2'),\n('000469','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (1)','CP-2(1)','CP-2'),\n('000470','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (2)','CP-2(2)','CP-2'),\n('000471','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (2)','CP-2(2)','CP-2'),\n('000472','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (2)','CP-2(2)','CP-2'),\n('000473','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (3)','CP-2(3)','CP-2'),\n('000474','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (3)','CP-2(3)','CP-2'),\n('000475','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (3)','CP-2(3)','CP-2'),\n('000476','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (3)','CP-2(3)','CP-2'),\n('000481','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (5)','CP-2(5)','CP-2'),\n('000482','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (5)','CP-2(5)','CP-2'),\n('000483','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (6)','CP-2(6)','CP-2'),\n('000484','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (6)','CP-2(6)','CP-2'),\n('000485','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 a 3','CP-3a3','CP-3'),\n('000486','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 a 1','CP-3a1','CP-3'),\n('000487','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 a 3','CP-3a3','CP-3'),\n('000488','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 (1)','CP-3(1)','CP-3'),\n('000489','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 (2)','CP-3(2)','CP-3'),\n('000490','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 a','CP-4a','CP-4'),\n('000492','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 a','CP-4a','CP-4'),\n('000494','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 a','CP-4a','CP-4'),\n('000496','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 b','CP-4b','CP-4'),\n('000497','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 c','CP-4c','CP-4'),\n('000498','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 (1)','CP-4(1)','CP-4'),\n('000500','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 (2) (a)','CP-4(2)(a)','CP-4'),\n('000502','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 (3)','CP-4(3)','CP-4'),\n('000504','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 (4)','CP-4(4)','CP-4'),\n('000505','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-6 a','CP-6a','CP-6'),\n('000507','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-6 (1)','CP-6(1)','CP-6'),\n('000508','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-6 (2)','CP-6(2)','CP-6'),\n('000509','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-6 (3)','CP-6(3)','CP-6'),\n('000510','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 a','CP-7a','CP-7'),\n('000513','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 a','CP-7a','CP-7'),\n('000514','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 a','CP-7a','CP-7'),\n('000515','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 b','CP-7b','CP-7'),\n('000516','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (1)','CP-7(1)','CP-7'),\n('000517','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (2)','CP-7(2)','CP-7'),\n('000518','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (3)','CP-7(3)','CP-7'),\n('000519','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (4)','CP-7(4)','CP-7'),\n('000520','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (4)','CP-7(4)','CP-7'),\n('000521','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 c','CP-7c','CP-7'),\n('000522','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8','CP-8','CP-8'),\n('000523','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8','CP-8','CP-8'),\n('000524','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8','CP-8','CP-8'),\n('000525','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8','CP-8','CP-8'),\n('000526','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (1) (a)','CP-8(1)(a)','CP-8'),\n('000527','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (1) (a)','CP-8(1)(a)','CP-8'),\n('000530','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (2)','CP-8(2)','CP-8'),\n('000531','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (3)','CP-8(3)','CP-8'),\n('000532','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (4) (a)','CP-8(4)(a)','CP-8'),\n('000533','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (4) (a)','CP-8(4)(a)','CP-8'),\n('000534','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (a)','CP-9(a)','CP-9'),\n('000535','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (a)','CP-9(a)','CP-9'),\n('000536','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (b)','CP-9(b)','CP-9'),\n('000537','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (b)','CP-9(b)','CP-9'),\n('000538','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (c)','CP-9(c)','CP-9'),\n('000539','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (c)','CP-9(c)','CP-9'),\n('000541','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (1)','CP-9(1)','CP-9'),\n('000542','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (1)','CP-9(1)','CP-9'),\n('000543','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (2)','CP-9(2)','CP-9'),\n('000547','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (5)','CP-9(5)','CP-9'),\n('000548','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (5)','CP-9(5)','CP-9'),\n('000549','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (6)','CP-9(6)','CP-9'),\n('000553','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-10 (2)','CP-10(2)','CP-10'),\n('000556','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-10 (4)','CP-10(4)','CP-10'),\n('000557','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-10 (4)','CP-10(4)','CP-10'),\n('000558','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (5)','SI-13(5)','SI-13'),\n('000559','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (5)','SI-13(5)','SI-13'),\n('000563','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 a 1 (a)','PL-1a1(a)','PL-1'),\n('000564','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 a 1 (a)','PL-1a1(a)','PL-1'),\n('000566','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 a 2','PL-1a2','PL-1'),\n('000567','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 a 2','PL-1a2','PL-1'),\n('000568','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 c 2','PL-1c2','PL-1'),\n('000571','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 15','PL-2a15','PL-2'),\n('000572','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 c','PL-2c','PL-2'),\n('000573','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 c','PL-2c','PL-2'),\n('000574','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 d','PL-2d','PL-2'),\n('000577','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-7 b','PL-7b','PL-7'),\n('000578','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-7 b','PL-7b','PL-7'),\n('000592','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 a','PL-4a','PL-4'),\n('000593','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 b','PL-4b','PL-4'),\n('000594','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 (1) (a)','PL-4(1)(a)','PL-4'),\n('000595','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 (1) (b)','PL-4(1)(b)','PL-4'),\n('000601','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 c 1','SA-1c1','SA-1'),\n('000602','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 a 1 (a)','SA-1a1(a)','SA-1'),\n('000603','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 a 1','SA-1a1','SA-1'),\n('000604','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 c 1','SA-1c1','SA-1'),\n('000605','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 a 2','SA-1a2','SA-1'),\n('000606','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 a 2','SA-1a2','SA-1'),\n('000607','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 c 2','SA-1c2','SA-1'),\n('000610','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 b','SA-2b','SA-2'),\n('000611','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 b','SA-2b','SA-2'),\n('000612','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 b','SA-2b','SA-2'),\n('000613','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 c','SA-2c','SA-2'),\n('000614','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 c','SA-2c','SA-2'),\n('000615','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 a','SA-3a','SA-3'),\n('000616','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 b','SA-3b','SA-3'),\n('000618','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 c','SA-3c','SA-3'),\n('000623','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (1)','SA-4(1)','SA-4'),\n('000631','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (6) (a)','SA-4(6)(a)','SA-4'),\n('000633','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (6) (b)','SA-4(6)(b)','SA-4'),\n('000634','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (7) (a)','SA-4(7)(a)','SA-4'),\n('000635','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (7) (b)','SA-4(7)(b)','SA-4'),\n('000642','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 c','SA-5c','SA-5'),\n('000664','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n('000665','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n('000666','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n('000667','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n('000668','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n('000669','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9','SA-9','SA-9'),\n('000692','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 c','SA-10c','SA-10'),\n('000694','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 d','SA-10d','SA-10'),\n('000698','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (1)','SA-10(1)','SA-10'),\n('000700','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (2)','SA-10(2)','SA-10'),\n('000757','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 a 1 (a)','IA-1a1(a)','IA-1'),\n('000758','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 c 1','IA-1c1','IA-1'),\n('000759','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 c 1','IA-1c1','IA-1'),\n('000762','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 c 2','IA-1c2','IA-1'),\n('000763','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 c 2','IA-1c2','IA-1'),\n('000764','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2','IA-2','IA-2'),\n('000765','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (1)','IA-2(1)','IA-2'),\n('000766','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (2)','IA-2(2)','IA-2'),\n('000777','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-3','IA-3','IA-3'),\n('000778','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-3','IA-3','IA-3'),\n('000783','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (3) (b)','IA-3(3)(b)','IA-3'),\n('000796','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (1)','IA-4(1)','IA-4'),\n('000800','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (4)','IA-4(4)','IA-4'),\n('000801','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (4)','IA-4(4)','IA-4'),\n('000803','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-7','IA-7','IA-7'),\n('000804','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-8','IA-8','IA-8'),\n('000805','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 a 1 (a)','IR-1a1(a)','IR-1'),\n('000806','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 a 1 (a)','IR-1a1(a)','IR-1'),\n('000807','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 c 1','IR-1c1','IR-1'),\n('000808','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 c 1','IR-1c1','IR-1'),\n('000809','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 a 2','IR-1a2','IR-1'),\n('000810','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 a 2','IR-1a2','IR-1'),\n('000811','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 c 2','IR-1c2','IR-1'),\n('000812','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 c 2','IR-1c2','IR-1'),\n('000813','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 a 1','IR-2a1','IR-2'),\n('000814','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 a 3','IR-2a3','IR-2'),\n('000815','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 a 3','IR-2a3','IR-2'),\n('000816','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 (1)','IR-2(1)','IR-2'),\n('000817','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 (2)','IR-2(2)','IR-2'),\n('000818','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3','IR-3','IR-3'),\n('000819','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3','IR-3','IR-3'),\n('000820','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3','IR-3','IR-3'),\n('000821','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (1)','IR-3(1)','IR-3'),\n('000822','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 a','IR-4a','IR-4'),\n('000823','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 b','IR-4b','IR-4'),\n('000825','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (1)','IR-4(1)','IR-4'),\n('000826','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (2)','IR-4(2)','IR-4'),\n('000827','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (3)','IR-4(3)','IR-4'),\n('000828','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (3)','IR-4(3)','IR-4'),\n('000829','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (4)','IR-4(4)','IR-4'),\n('000830','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (5)','IR-4(5)','IR-4'),\n('000831','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (5)','IR-4(5)','IR-4'),\n('000832','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-5','IR-5','IR-5'),\n('000834','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 a','IR-6a','IR-6'),\n('000835','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 a','IR-6a','IR-6'),\n('000836','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 b','IR-6b','IR-6'),\n('000837','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 (1)','IR-6(1)','IR-6'),\n('000838','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 (2)','IR-6(2)','IR-6'),\n('000839','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-7','IR-7','IR-7'),\n('000841','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-7 (2) (a)','IR-7(2)(a)','IR-7'),\n('000842','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-7 (2) (b)','IR-7(2)(b)','IR-7'),\n('000844','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 9','IR-8a9','IR-8'),\n('000845','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 b','IR-8b','IR-8'),\n('000846','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 b','IR-8b','IR-8'),\n('000849','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 c','IR-8c','IR-8'),\n('000850','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 d','IR-8d','IR-8'),\n('000851','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 c 1','MA-1c1','MA-1'),\n('000852','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 a 1 (a)','MA-1a1(a)','MA-1'),\n('000853','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 a 1','MA-1a1','MA-1'),\n('000854','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 c 1','MA-1c1','MA-1'),\n('000855','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 a 2','MA-1a2','MA-1'),\n('000856','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 a 2','MA-1a2','MA-1'),\n('000857','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 c 2','MA-1c2','MA-1'),\n('000860','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 c','MA-2c','MA-2'),\n('000861','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 d','MA-2d','MA-2'),\n('000862','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 e','MA-2e','MA-2'),\n('000865','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 a','MA-3a','MA-3'),\n('000866','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 a','MA-3a','MA-3'),\n('000867','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 a','MA-3a','MA-3'),\n('000869','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (1)','MA-3(1)','MA-3'),\n('000870','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (2)','MA-3(2)','MA-3'),\n('000871','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (3)','MA-3(3)','MA-3'),\n('000873','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 a','MA-4a','MA-4'),\n('000874','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 a','MA-4a','MA-4'),\n('000876','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 b','MA-4b','MA-4'),\n('000877','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 c','MA-4c','MA-4'),\n('000878','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 d','MA-4d','MA-4'),\n('000882','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (3) (a)','MA-4(3)(a)','MA-4'),\n('000883','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (3) (b)','MA-4(3)(b)','MA-4'),\n('000884','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (4) (a)','MA-4(4)(a)','MA-4'),\n('000886','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (5) (b)','MA-4(5)(b)','MA-4'),\n('000887','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (5) (a)','MA-4(5)(a)','MA-4'),\n('000890','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 a','MA-5a','MA-5'),\n('000891','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 a','MA-5a','MA-5'),\n('000893','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (1) (a)','MA-5(1)(a)','MA-5'),\n('000894','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (1) (a) (1)','MA-5(1)(a)(1)','MA-5'),\n('000895','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (1) (a) (2)','MA-5(1)(a)(2)','MA-5'),\n('000897','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (2)','MA-5(2)','MA-5'),\n('000898','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (3)','MA-5(3)','MA-5'),\n('000899','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (4) (a)','MA-5(4)(a)','MA-5'),\n('000900','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (4) (b)','MA-5(4)(b)','MA-5'),\n('000903','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-6','MA-6','MA-6'),\n('000904','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 a 1 (a)','PE-1a1(a)','PE-1'),\n('000905','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 a 1','PE-1a1','PE-1'),\n('000906','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 c 1','PE-1c1','PE-1'),\n('000907','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 c 1','PE-1c1','PE-1'),\n('000908','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 a 2','PE-1a2','PE-1'),\n('000909','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 a 2','PE-1a2','PE-1'),\n('000910','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 c 2','PE-1c2','PE-1'),\n('000911','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 c 2','PE-1c2','PE-1'),\n('000912','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 a','PE-2a','PE-2'),\n('000913','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 b','PE-2b','PE-2'),\n('000914','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 c','PE-2c','PE-2'),\n('000915','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 c','PE-2c','PE-2'),\n('000916','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 (1)','PE-2(1)','PE-2'),\n('000917','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 (2)','PE-2(2)','PE-2'),\n('000920','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 a 1','PE-3a1','PE-3'),\n('000923','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 e','PE-3e','PE-3'),\n('000924','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 f','PE-3f','PE-3'),\n('000925','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 f','PE-3f','PE-3'),\n('000926','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 g','PE-3g','PE-3'),\n('000927','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 g','PE-3g','PE-3'),\n('000928','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (1)','PE-3(1)','PE-3'),\n('000929','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (2)','PE-3(2)','PE-3'),\n('000930','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (3)','PE-3(3)','PE-3'),\n('000931','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (4)','PE-3(4)','PE-3'),\n('000932','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (4)','PE-3(4)','PE-3'),\n('000933','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (5)','PE-3(5)','PE-3'),\n('000936','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-4','PE-4','PE-4'),\n('000937','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-5','PE-5','PE-5'),\n('000939','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 b','PE-6b','PE-6'),\n('000940','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 b','PE-6b','PE-6'),\n('000941','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 c','PE-6c','PE-6'),\n('000942','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (1)','PE-6(1)','PE-6'),\n('000947','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 a','PE-8a','PE-8'),\n('000948','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 b','PE-8b','PE-8'),\n('000949','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 b','PE-8b','PE-8'),\n('000950','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 (1)','PE-8(1)','PE-8'),\n('000952','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-9','PE-9','PE-9'),\n('000954','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-9 (2)','PE-9(2)','PE-9'),\n('000955','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-9 (2)','PE-9(2)','PE-9'),\n('000956','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-10 a','PE-10a','PE-10'),\n('000957','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-10 b','PE-10b','PE-10'),\n('000958','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-10 b','PE-10b','PE-10'),\n('000959','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-10 c','PE-10c','PE-10'),\n('000961','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-11 (1)','PE-11(1)','PE-11'),\n('000963','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-12','PE-12','PE-12'),\n('000965','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-13','PE-13','PE-13'),\n('000968','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (2) (b)','PE-13(2)(b)','PE-13'),\n('000971','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-14 a','PE-14a','PE-14'),\n('000972','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-14 a','PE-14a','PE-14'),\n('000973','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-14 b','PE-14b','PE-14'),\n('000974','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-14 b','PE-14b','PE-14'),\n('000975','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-14 (1)','PE-14(1)','PE-14'),\n('000976','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-14 (2)','PE-14(2)','PE-14'),\n('000977','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-15','PE-15','PE-15'),\n('000978','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-15','PE-15','PE-15'),\n('000979','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-15','PE-15','PE-15'),\n('000981','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-16 a','PE-16a','PE-16'),\n('000983','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-16 a','PE-16a','PE-16'),\n('000984','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-16 b','PE-16b','PE-16'),\n('000985','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-17 b','PE-17b','PE-17'),\n('000987','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-17 c','PE-17c','PE-17'),\n('000988','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-17 d','PE-17d','PE-17'),\n('000989','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-18','PE-18','PE-18'),\n('000991','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-18','PE-18','PE-18'),\n('000993','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-19','PE-19','PE-19'),\n('000995','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 a 1 (a)','MP-1a1(a)','MP-1'),\n('000996','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 a 1','MP-1a1','MP-1'),\n('000997','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 c 1','MP-1c1','MP-1'),\n('000998','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 c 1','MP-1c1','MP-1'),\n('000999','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 a 2','MP-1a2','MP-1'),\n('001000','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 a 2','MP-1a2','MP-1'),\n('001001','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 c 2','MP-1c2','MP-1'),\n('001002','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 c 2','MP-1c2','MP-1'),\n('001003','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-2','MP-2','MP-2'),\n('001004','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-2','MP-2','MP-2'),\n('001005','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-2','MP-2','MP-2'),\n('001007','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 (2)','MP-4(2)','MP-4'),\n('001008','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 (2)','MP-4(2)','MP-4'),\n('001010','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-3 a','MP-3a','MP-3'),\n('001011','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-3 b','MP-3b','MP-3'),\n('001012','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-3 b','MP-3b','MP-3'),\n('001013','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-3 b','MP-3b','MP-3'),\n('001015','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 a','MP-4a','MP-4'),\n('001016','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 a','MP-4a','MP-4'),\n('001021','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 a','MP-5a','MP-5'),\n('001022','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 a','MP-5a','MP-5'),\n('001023','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 b','MP-5b','MP-5'),\n('001024','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 d','MP-5d','MP-5'),\n('001025','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 c','MP-5c','MP-5'),\n('001026','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 (3)','MP-5(3)','MP-5'),\n('001028','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 a','MP-6a','MP-6'),\n('001031','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (2)','MP-6(2)','MP-6'),\n('001032','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (3)','MP-6(3)','MP-6'),\n('001033','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (3)','MP-6(3)','MP-6'),\n('001037','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 a 1 (a)','RA-1a1(a)','RA-1'),\n('001038','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 a 1 (a)','RA-1a1(a)','RA-1'),\n('001039','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 c 1','RA-1c1','RA-1'),\n('001040','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 c 1','RA-1c1','RA-1'),\n('001041','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 a 2','RA-1a2','RA-1'),\n('001042','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 a 2','RA-1a2','RA-1'),\n('001043','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 c 2','RA-1c2','RA-1'),\n('001044','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 c 2','RA-1c2','RA-1'),\n('001046','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-2 b','RA-2b','RA-2'),\n('001047','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-2 c','RA-2c','RA-2'),\n('001048','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 a 2','RA-3a2','RA-3'),\n('001049','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 c','RA-3c','RA-3'),\n('001050','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 d','RA-3d','RA-3'),\n('001051','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 d','RA-3d','RA-3'),\n('001052','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 f','RA-3f','RA-3'),\n('001053','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 f','RA-3f','RA-3'),\n('001054','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 a','RA-5a','RA-5'),\n('001055','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 a','RA-5a','RA-5'),\n('001056','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 a','RA-5a','RA-5'),\n('001057','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 b 1','RA-5b1','RA-5'),\n('001058','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 c','RA-5c','RA-5'),\n('001059','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 d','RA-5d','RA-5'),\n('001060','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 d','RA-5d','RA-5'),\n('001061','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 e','RA-5e','RA-5'),\n('001063','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (2)','RA-5(2)','RA-5'),\n('001064','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (2)','RA-5(2)','RA-5'),\n('001066','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (4)','RA-5(4)','RA-5'),\n('001067','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (5)','RA-5(5)','RA-5'),\n('001068','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (6)','RA-5(6)','RA-5'),\n('001071','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (8)','RA-5(8)','RA-5'),\n('001075','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 1','SC-1a1','SC-1'),\n('001076','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 c 1','SC-1c1','SC-1'),\n('001077','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 c 1','SC-1c1','SC-1'),\n('001079','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 2','SC-1a2','SC-1'),\n('001080','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 c 2','SC-1c2','SC-1'),\n('001081','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 c 2','SC-1c2','SC-1'),\n('001082','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-2','SC-2','SC-2'),\n('001083','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-2 (1)','SC-2(1)','SC-2'),\n('001084','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-3','SC-3','SC-3'),\n('001085','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-3 (1)','SC-3(1)','SC-3'),\n('001086','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-3 (2)','SC-3(2)','SC-3'),\n('001089','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-3 (5)','SC-3(5)','SC-3'),\n('001090','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-4','SC-4','SC-4'),\n('001093','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 a','SC-5a','SC-5'),\n('001094','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 (1)','SC-5(1)','SC-5'),\n('001095','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 (2)','SC-5(2)','SC-5'),\n('001097','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 a','SC-7a','SC-7'),\n('001098','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 c','SC-7c','SC-7'),\n('001101','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (3)','SC-7(3)','SC-7'),\n('001102','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (a)','SC-7(4)(a)','SC-7'),\n('001103','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (b)','SC-7(4)(b)','SC-7'),\n('001105','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (d)','SC-7(4)(d)','SC-7'),\n('001106','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (e)','SC-7(4)(e)','SC-7'),\n('001107','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (e)','SC-7(4)(e)','SC-7'),\n('001108','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (e)','SC-7(4)(e)','SC-7'),\n('001109','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (5)','SC-7(5)','SC-7'),\n('001112','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (8)','SC-7(8)','SC-7'),\n('001113','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (8)','SC-7(8)','SC-7'),\n('001114','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (8)','SC-7(8)','SC-7'),\n('001116','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (10) (a)','SC-7(10)(a)','SC-7'),\n('001119','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (13)','SC-7(13)','SC-7'),\n('001120','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (13)','SC-7(13)','SC-7'),\n('001121','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (14)','SC-7(14)','SC-7'),\n('001123','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (15)','SC-7(15)','SC-7'),\n('001124','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (16)','SC-7(16)','SC-7'),\n('001125','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (17)','SC-7(17)','SC-7'),\n('001126','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (18)','SC-7(18)','SC-7'),\n('001133','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-10','SC-10','SC-10'),\n('001134','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-10','SC-10','SC-10'),\n('001135','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-11 a','SC-11a','SC-11'),\n('001139','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (1)','SC-12(1)','SC-12'),\n('001150','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 a','SC-15a','SC-15'),\n('001151','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 a','SC-15a','SC-15'),\n('001152','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 b','SC-15b','SC-15'),\n('001153','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 (1)','SC-15(1)','SC-15'),\n('001155','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 (3)','SC-15(3)','SC-15'),\n('001156','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 (3)','SC-15(3)','SC-15'),\n('001157','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-16','SC-16','SC-16'),\n('001158','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-16 (1)','SC-16(1)','SC-16'),\n('001159','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-17 a','SC-17a','SC-17'),\n('001160','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 a','SC-18a','SC-18'),\n('001163','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 b','SC-18b','SC-18'),\n('001164','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 b','SC-18b','SC-18'),\n('001165','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 b','SC-18b','SC-18'),\n('001166','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (1)','SC-18(1)','SC-18'),\n('001167','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (2)','SC-18(2)','SC-18'),\n('001168','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (2)','SC-18(2)','SC-18'),\n('001169','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (3)','SC-18(3)','SC-18'),\n('001170','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (4)','SC-18(4)','SC-18'),\n('001171','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (4)','SC-18(4)','SC-18'),\n('001172','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (4)','SC-18(4)','SC-18'),\n('001178','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-20 a','SC-20a','SC-20'),\n('001179','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-20 b','SC-20b','SC-20'),\n('001182','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-22','SC-22','SC-22'),\n('001183','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-22','SC-22','SC-22'),\n('001184','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-23','SC-23','SC-23'),\n('001185','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-23 (1)','SC-23(1)','SC-23'),\n('001188','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-23 (3)','SC-23(3)','SC-23'),\n('001189','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-23 (3)','SC-23(3)','SC-23'),\n('001190','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-24','SC-24','SC-24'),\n('001191','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-24','SC-24','SC-24'),\n('001192','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-24','SC-24','SC-24'),\n('001193','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-24','SC-24','SC-24'),\n('001194','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-25','SC-25','SC-25'),\n('001195','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-26','SC-26','SC-26'),\n('001196','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-35','SC-35','SC-35'),\n('001197','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-27','SC-27','SC-27'),\n('001198','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-27','SC-27','SC-27'),\n('001199','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-28','SC-28','SC-28'),\n('001201','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-29','SC-29','SC-29'),\n('001203','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-29 (1)','SC-29(1)','SC-29'),\n('001204','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-29 (1)','SC-29(1)','SC-29'),\n('001207','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-31 (1)','SC-31(1)','SC-31'),\n('001210','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 a','SC-34a','SC-34'),\n('001211','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 b','SC-34b','SC-34'),\n('001212','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-34','SC-34','SC-34'),\n('001213','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 b','SC-34b','SC-34'),\n('001214','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 (1)','SC-34(1)','SC-34'),\n('001215','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 (1)','SC-34(1)','SC-34'),\n('001216','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 (2)','SC-34(2)','SC-34'),\n('001217','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 a 1 (a)','SI-1a1(a)','SI-1'),\n('001218','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 a 1','SI-1a1','SI-1'),\n('001219','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 c 1','SI-1c1','SI-1'),\n('001220','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 a 2','SI-1a2','SI-1'),\n('001221','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 a 2','SI-1a2','SI-1'),\n('001222','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 c 2','SI-1c2','SI-1'),\n('001223','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 c 1','SI-1c1','SI-1'),\n('001224','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 c 2','SI-1c2','SI-1'),\n('001225','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 a','SI-2a','SI-2'),\n('001226','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 a','SI-2a','SI-2'),\n('001227','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 a','SI-2a','SI-2'),\n('001228','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 b','SI-2b','SI-2'),\n('001229','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 b','SI-2b','SI-2'),\n('001230','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 d','SI-2d','SI-2'),\n('001235','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (3) (a)','SI-2(3)(a)','SI-2'),\n('001236','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (3) (b)','SI-2(3)(b)','SI-2'),\n('001241','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 c 1','SI-3c1','SI-3'),\n('001243','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 c 2','SI-3c2','SI-3'),\n('001244','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 c 2','SI-3c2','SI-3'),\n('001245','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 d','SI-3d','SI-3'),\n('001249','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (4)','SI-3(4)','SI-3'),\n('001251','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (6) (a)','SI-3(6)(a)','SI-3'),\n('001253','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 a 1','SI-4a1','SI-4'),\n('001255','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 c 1','SI-4c1','SI-4'),\n('001256','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 c 2','SI-4c2','SI-4'),\n('001257','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 e','SI-4e','SI-4'),\n('001258','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 f','SI-4f','SI-4'),\n('001260','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (2)','SI-4(2)','SI-4'),\n('001264','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (5)','SI-4(5)','SI-4'),\n('001266','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (7) (a)','SI-4(7)(a)','SI-4'),\n('001267','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (7) (a)','SI-4(7)(a)','SI-4'),\n('001268','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (7) (b)','SI-4(7)(b)','SI-4'),\n('001270','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (9)','SI-4(9)','SI-4'),\n('001271','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (9)','SI-4(9)','SI-4'),\n('001273','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (11)','SI-4(11)','SI-4'),\n('001274','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (12)','SI-4(12)','SI-4'),\n('001275','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (12)','SI-4(12)','SI-4'),\n('001276','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (13) (a)','SI-4(13)(a)','SI-4'),\n('001277','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (13) (b)','SI-4(13)(b)','SI-4'),\n('001282','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (15)','SI-4(15)','SI-4'),\n('001283','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (16)','SI-4(16)','SI-4'),\n('001284','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (17)','SI-4(17)','SI-4'),\n('001285','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 a','SI-5a','SI-5'),\n('001286','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 b','SI-5b','SI-5'),\n('001287','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 c','SI-5c','SI-5'),\n('001288','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 c','SI-5c','SI-5'),\n('001289','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 d','SI-5d','SI-5'),\n('001290','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 (1)','SI-5(1)','SI-5'),\n('001294','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 c','SI-6c','SI-6'),\n('001295','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 (2)','SI-6(2)','SI-6'),\n('001296','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 (3)','SI-6(3)','SI-6'),\n('001300','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (2)','SI-7(2)','SI-7'),\n('001301','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (3)','SI-7(3)','SI-7'),\n('001308','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-8 (2)','SI-8(2)','SI-8'),\n('001310','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10','SI-10','SI-10'),\n('001312','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-11 a','SI-11a','SI-11'),\n('001314','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-11 b','SI-11b','SI-11'),\n('001315','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-12','SI-12','SI-12'),\n('001318','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 b','SI-13b','SI-13'),\n('001319','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (1)','SI-13(1)','SI-13'),\n('001320','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (1)','SI-13(1)','SI-13'),\n('001321','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (16)','SI-7(16)','SI-7'),\n('001322','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (16)','SI-7(16)','SI-7'),\n('001323','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (3)','SI-13(3)','SI-13'),\n('001326','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (4) (a)','SI-13(4)(a)','SI-13'),\n('001327','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (4) (a)','SI-13(4)(a)','SI-13'),\n('001328','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (4) (b)','SI-13(4)(b)','SI-13'),\n('001329','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (4) (b)','SI-13(4)(b)','SI-13'),\n('001330','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (a)','AC-19(4)(a)','AC-19'),\n('001331','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (b) (1)','AC-19(4)(b)(1)','AC-19'),\n('001332','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (b) (2)','AC-19(4)(b)(2)','AC-19'),\n('001333','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (b) (3)','AC-19(4)(b)(3)','AC-19'),\n('001334','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (b) (4)','AC-19(4)(b)(4)','AC-19'),\n('001335','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (b) (4)','AC-19(4)(b)(4)','AC-19'),\n('001336','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-4 b','AT-4b','AT-4'),\n('001337','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-4 b','AT-4b','AT-4'),\n('001340','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (3)','AU-10(3)','AU-10'),\n('001341','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (4) (a)','AU-10(4)(a)','AU-10'),\n('001348','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (2)','AU-9(2)','AU-9'),\n('001349','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (2)','AU-9(2)','AU-9'),\n('001350','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (3)','AU-9(3)','AU-9'),\n('001351','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (4)','AU-9(4)','AU-9'),\n('001353','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (2)','AU-12(2)','AU-12'),\n('001358','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (7) (a)','AC-2(7)(a)','AC-2'),\n('001360','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (7) (b)','AC-2(7)(b)','AC-2'),\n('001361','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (2)','AC-2(2)','AC-2'),\n('001365','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (2)','AC-2(2)','AC-2'),\n('001368','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4','AC-4','AC-4'),\n('001371','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (14)','AC-4(14)','AC-4'),\n('001372','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (14)','AC-4(14)','AC-4'),\n('001373','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (15)','AC-4(15)','AC-4'),\n('001374','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (15)','AC-4(15)','AC-4'),\n('001384','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 c 1','AC-8c1','AC-8'),\n('001385','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 c 2','AC-8c2','AC-8'),\n('001386','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 c 2','AC-8c2','AC-8'),\n('001387','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 c 2','AC-8c2','AC-8'),\n('001388','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 c 3','AC-8c3','AC-8'),\n('001389','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (2)','AC-9(2)','AC-9'),\n('001390','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (2)','AC-9(2)','AC-9'),\n('001391','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (2)','AC-9(2)','AC-9'),\n('001392','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (2)','AC-9(2)','AC-9'),\n('001393','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (3)','AC-9(3)','AC-9'),\n('001394','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (3)','AC-9(3)','AC-9'),\n('001395','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (3)','AC-9(3)','AC-9'),\n('001403','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2(4)','AC-2'),\n('001404','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2(4)','AC-2'),\n('001405','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2(4)','AC-2'),\n('001406','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (5)','AC-2(5)','AC-2'),\n('001407','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (7) (a)','AC-2(7)(a)','AC-2'),\n('001408','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (2)','AC-3(2)','AC-3'),\n('001411','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (5)','AC-3(5)','AC-3'),\n('001414','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4','AC-4','AC-4'),\n('001415','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (5)','AC-4(5)','AC-4'),\n('001417','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (8) (a)','AC-4(8)(a)','AC-4'),\n('001419','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (2)','AC-6(2)','AC-6'),\n('001420','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (3)','AC-6(3)','AC-6'),\n('001422','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (6)','AC-6(6)','AC-6'),\n('001423','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 a','AC-7a','AC-7'),\n('001424','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (1)','AC-16(1)','AC-16'),\n('001425','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (2)','AC-16(2)','AC-16'),\n('001428','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (5)','AC-16(5)','AC-16'),\n('001429','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (5)','AC-16(5)','AC-16'),\n('001430','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (5)','AC-16(5)','AC-16'),\n('001439','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 a','AC-18a','AC-18'),\n('001441','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 b','AC-18b','AC-18'),\n('001443','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 (1)','AC-18(1)','AC-18'),\n('001444','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 (1)','AC-18(1)','AC-18'),\n('001449','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 (3)','AC-18(3)','AC-18'),\n('001451','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 (5)','AC-18(5)','AC-18'),\n('001453','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (2)','AC-17(2)','AC-17'),\n('001458','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (b) (4)','AC-19(4)(b)(4)','AC-19'),\n('001459','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 a','AU-12a','AU-12'),\n('001460','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 a','AU-13a','AU-13'),\n('001461','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 a','AU-13a','AU-13'),\n('001464','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-14 (1)','AU-14(1)','AU-14'),\n('001470','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-21 a','AC-21a','AC-21'),\n('001471','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-21 b','AC-21b','AC-21'),\n('001472','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-21 b','AC-21b','AC-21'),\n('001473','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-22 a','AC-22a','AC-22'),\n('001474','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-22 b','AC-22b','AC-22'),\n('001475','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-22 c','AC-22c','AC-22'),\n('001476','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-22 d','AC-22d','AC-22'),\n('001477','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-22 d','AC-22d','AC-22'),\n('001478','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-22 d','AC-22d','AC-22'),\n('001481','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (1)','AT-3(1)','AT-3'),\n('001482','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (1)','AT-3(1)','AT-3'),\n('001483','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (1)','AT-3(1)','AT-3'),\n('001484','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 c','AU-2c','AU-2'),\n('001485','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 c','AU-2c','AU-2'),\n('001487','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 f','AU-3f','AU-3'),\n('001488','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 (1)','AU-3(1)','AU-3'),\n('001490','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 b','AU-5b','AU-5'),\n('001491','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (6)','AU-6(6)','AU-6'),\n('001493','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 a','AU-9a','AU-9'),\n('001494','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 a','AU-9a','AU-9'),\n('001495','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 a','AU-9a','AU-9'),\n('001496','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (3)','AU-9(3)','AU-9'),\n('001497','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 b 1','CM-2b1','CM-2'),\n('001498','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (c)','CM-3(1)(c)','CM-3'),\n('001499','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (6)','CM-5(6)','CM-5'),\n('001504','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 a 1 (a)','PS-1a1(a)','PS-1'),\n('001505','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 a 1','PS-1a1','PS-1'),\n('001506','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 c 1','PS-1c1','PS-1'),\n('001507','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 c 1','PS-1c1','PS-1'),\n('001508','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 c 2','PS-1c2','PS-1'),\n('001509','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 a 2','PS-1a2','PS-1'),\n('001510','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 a 2','PS-1a2','PS-1'),\n('001511','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 c 2','PS-1c2','PS-1'),\n('001512','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-2 a','PS-2a','PS-2'),\n('001513','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-2 b','PS-2b','PS-2'),\n('001514','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-2 c','PS-2c','PS-2'),\n('001515','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-2 c','PS-2c','PS-2'),\n('001516','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 a','PS-3a','PS-3'),\n('001517','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 b','PS-3b','PS-3'),\n('001518','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 b','PS-3b','PS-3'),\n('001519','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 b','PS-3b','PS-3'),\n('001520','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 (1)','PS-3(1)','PS-3'),\n('001521','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 (2)','PS-3(2)','PS-3'),\n('001522','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 a','PS-4a','PS-4'),\n('001523','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 c','PS-4c','PS-4'),\n('001524','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 d','PS-4d','PS-4'),\n('001525','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 e','PS-4e','PS-4'),\n('001526','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 e','PS-4e','PS-4'),\n('001527','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 a','PS-5a','PS-5'),\n('001528','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 b','PS-5b','PS-5'),\n('001529','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 b','PS-5b','PS-5'),\n('001530','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 b','PS-5b','PS-5'),\n('001532','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 b','PS-6b','PS-6'),\n('001533','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 b','PS-6b','PS-6'),\n('001536','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 (2) (a)','PS-6(2)(a)','PS-6'),\n('001537','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 (2) (b)','PS-6(2)(b)','PS-6'),\n('001538','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 (2) (c)','PS-6(2)(c)','PS-6'),\n('001539','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 a','PS-7a','PS-7'),\n('001540','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 c','PS-7c','PS-7'),\n('001541','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 e','PS-7e','PS-7'),\n('001544','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 c','IA-5c','IA-5'),\n('001545','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 c 1','AC-1c1','AC-1'),\n('001546','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 c 2','AC-1c2','AC-1'),\n('001547','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 j','AC-2j','AC-2'),\n('001548','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4','AC-4','AC-4'),\n('001549','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4','AC-4','AC-4'),\n('001553','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (10)','AC-4(10)','AC-4'),\n('001554','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (11)','AC-4(11)','AC-4'),\n('001558','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (1) (a)','AC-6(1)(a)','AC-6'),\n('001564','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 c 1','AT-1c1','AT-1'),\n('001565','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 c 2','AT-1c2','AT-1'),\n('001566','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (2)','AT-3(2)','AT-3'),\n('001567','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (2)','AT-3(2)','AT-3'),\n('001568','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (2)','AT-3(2)','AT-3'),\n('001569','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 c 1','AU-1c1','AU-1'),\n('001570','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 c 2','AU-1c2','AU-1'),\n('001571','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 a','AU-2a','AU-2'),\n('001572','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 a','AU-5a','AU-5'),\n('001573','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (3)','AU-5(3)','AU-5'),\n('001577','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (1)','AU-12(1)','AU-12'),\n('001578','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 c 2','CA-1c2','CA-1'),\n('001582','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (2)','CA-2(2)','CA-2'),\n('001584','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 c 2','CM-1c2','CM-1'),\n('001585','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 b 2','CM-2b2','CM-2'),\n('001586','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 g','CM-3g','CM-3'),\n('001592','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (2)','CM-7(2)','CM-7'),\n('001596','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 c 2','CP-1c2','CP-1'),\n('001597','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 a 2','CP-1a2','CP-1'),\n('001598','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 c 2','CP-1c2','CP-1'),\n('001599','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (5)','CP-2(5)','CP-2'),\n('001600','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (5)','CP-2(5)','CP-2'),\n('001601','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (6)','CP-2(6)','CP-2'),\n('001602','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (6)','CP-2(6)','CP-2'),\n('001604','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-6 (3)','CP-6(3)','CP-6'),\n('001606','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (2)','CP-7(2)','CP-7'),\n('001609','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (6)','CP-9(6)','CP-9'),\n('001610','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 f','IA-5f','IA-5'),\n('001621','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (8)','IA-5(8)','IA-5'),\n('001625','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 c','IR-4c','IR-4'),\n('001628','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 c 2','MA-1c2','MA-1'),\n('001631','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (3) (b)','MA-4(3)(b)','MA-4'),\n('001632','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (4) (b) (1)','MA-4(4)(b)(1)','MA-4'),\n('001635','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 d','PE-2d','PE-2'),\n('001636','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 c 1','PL-1c1','PL-1'),\n('001637','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 c 1','PL-1c1','PL-1'),\n('001638','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 c 2','PL-1c2','PL-1'),\n('001640','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-8','PM-8','PM-8'),\n('001641','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 a','RA-5a','RA-5'),\n('001642','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 c','RA-3c','RA-3'),\n('001643','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 a','RA-5a','RA-5'),\n('001645','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (5)','RA-5(5)','RA-5'),\n('001646','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 c 2','SA-1c2','SA-1'),\n('001661','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-11 b','SC-11b','SC-11'),\n('001662','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (1)','SC-18(1)','SC-18'),\n('001663','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-20 b','SC-20b','SC-20'),\n('001664','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-23 (3)','SC-23(3)','SC-23'),\n('001665','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-24','SC-24','SC-24'),\n('001669','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (6) (a)','SI-3(6)(a)','SI-3'),\n('001670','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (7) (b)','SI-4(7)(b)','SI-4'),\n('001671','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (11)','SI-4(11)','SI-4'),\n('001673','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (14)','SI-4(14)','SI-4'),\n('001675','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 (3)','SI-6(3)','SI-6'),\n('001678','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-12','SI-12','SI-12'),\n('001680','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 2','PM-1a2','PM-1'),\n('001682','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (2)','AC-2(2)','AC-2'),\n('001687','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (2)','SC-18(2)','SC-18'),\n('001688','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (2)','SC-18(2)','SC-18'),\n('001695','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (3)','SC-18(3)','SC-18'),\n('001726','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 a','CM-10a','CM-10'),\n('001727','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 a','CM-10a','CM-10'),\n('001728','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 a','CM-10a','CM-10'),\n('001729','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 a','CM-10a','CM-10'),\n('001730','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 b','CM-10b','CM-10'),\n('001731','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 b','CM-10b','CM-10'),\n('001732','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 c','CM-10c','CM-10'),\n('001733','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 c','CM-10c','CM-10'),\n('001734','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 (1)','CM-10(1)','CM-10'),\n('001735','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 (1)','CM-10(1)','CM-10'),\n('001736','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (3)','CM-2(3)','CM-2'),\n('001737','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (7) (a)','CM-2(7)(a)','CM-2'),\n('001738','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (7) (a)','CM-2(7)(a)','CM-2'),\n('001739','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (7) (a)','CM-2(7)(a)','CM-2'),\n('001740','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 b','CM-3b','CM-3'),\n('001741','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 c','CM-3c','CM-3'),\n('001742','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (b)','CM-3(1)(b)','CM-3'),\n('001743','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (5)','CM-3(5)','CM-3'),\n('001744','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (5)','CM-3(5)','CM-3'),\n('001745','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (6)','CM-3(6)','CM-3'),\n('001746','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (6)','CM-3(6)','CM-3'),\n('001751','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (4)','CM-5(4)','CM-5'),\n('001752','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (4)','CM-5(4)','CM-5'),\n('001753','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (5) (a)','CM-5(5)(a)','CM-5'),\n('001754','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (5) (a)','CM-5(5)(a)','CM-5'),\n('001755','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 c','CM-6c','CM-6'),\n('001756','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 c','CM-6c','CM-6'),\n('001757','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (2)','CM-6(2)','CM-6'),\n('001758','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (2)','CM-6(2)','CM-6'),\n('001759','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (2)','CM-6(2)','CM-6'),\n('001760','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (1) (a)','CM-7(1)(a)','CM-7'),\n('001761','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (1) (b)','CM-7(1)(b)','CM-7'),\n('001762','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (1) (b)','CM-7(1)(b)','CM-7'),\n('001763','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (2)','CM-7(2)','CM-7'),\n('001764','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (2)','CM-7(2)','CM-7'),\n('001765','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (4) (a)','CM-7(4)(a)','CM-7'),\n('001766','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (4) (a)','CM-7(4)(a)','CM-7'),\n('001767','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (4) (b)','CM-7(4)(b)','CM-7'),\n('001768','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (4) (c)','CM-7(4)(c)','CM-7'),\n('001770','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (4) (c)','CM-7(4)(c)','CM-7'),\n('001772','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (5) (a)','CM-7(5)(a)','CM-7'),\n('001773','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (5) (a)','CM-7(5)(a)','CM-7'),\n('001774','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (5) (b)','CM-7(5)(b)','CM-7'),\n('001775','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (5) (c)','CM-7(5)(c)','CM-7'),\n('001777','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (5) (c)','CM-7(5)(c)','CM-7'),\n('001779','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 b','CM-8b','CM-8'),\n('001780','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 b','CM-8b','CM-8'),\n('001783','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (3) (b)','CM-8(3)(b)','CM-8'),\n('001784','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (3) (b)','CM-8(3)(b)','CM-8'),\n('001785','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (7)','CM-8(7)','CM-8'),\n('001786','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (8)','CM-8(8)','CM-8'),\n('001788','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (9) (a)','CM-8(9)(a)','CM-8'),\n('001789','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (9) (b)','CM-8(9)(b)','CM-8'),\n('001792','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 b','CM-9b','CM-9'),\n('001795','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 b','CM-9b','CM-9'),\n('001798','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 c','CM-9c','CM-9'),\n('001799','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 e','CM-9e','CM-9'),\n('001801','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 e','CM-9e','CM-9'),\n('001802','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 b','CM-10b','CM-10'),\n('001803','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-10 b','CM-10b','CM-10'),\n('001804','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 a','CM-11a','CM-11'),\n('001805','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 a','CM-11a','CM-11'),\n('001806','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 b','CM-11b','CM-11'),\n('001807','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 b','CM-11b','CM-11'),\n('001808','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 c','CM-11c','CM-11'),\n('001809','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 c','CM-11c','CM-11'),\n('001813','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (1) (a)','CM-5(1)(a)','CM-5'),\n('001815','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (7) (b)','CM-2(7)(b)','CM-2'),\n('001816','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (7) (b)','CM-2(7)(b)','CM-2'),\n('001817','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-4 (1)','CM-4(1)','CM-4'),\n('001818','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-4 (1)','CM-4(1)','CM-4'),\n('001819','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 d','CM-3d','CM-3'),\n('001821','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 1 (a)','CM-1a1(a)','CM-1'),\n('001822','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 1 (a)','CM-1a1(a)','CM-1'),\n('001824','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 2','CM-1a2','CM-1'),\n('001825','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 2','CM-1a2','CM-1'),\n('001832','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 1 (a)','AU-1a1(a)','AU-1'),\n('001834','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 2','AU-1a2','AU-1'),\n('001848','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-4','AU-4','AU-4'),\n('001849','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-4','AU-4','AU-4'),\n('001850','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-4 (1)','AU-4(1)','AU-4'),\n('001851','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-4 (1)','AU-4(1)','AU-4'),\n('001852','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (1)','AU-5(1)','AU-5'),\n('001853','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (1)','AU-5(1)','AU-5'),\n('001854','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (1)','AU-5(1)','AU-5'),\n('001855','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (1)','AU-5(1)','AU-5'),\n('001856','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (2)','AU-5(2)','AU-5'),\n('001857','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (2)','AU-5(2)','AU-5'),\n('001858','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (2)','AU-5(2)','AU-5'),\n('001859','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (3)','AU-5(3)','AU-5'),\n('001860','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (4)','AU-5(4)','AU-5'),\n('001861','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (4)','AU-5(4)','AU-5'),\n('001862','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 a','AU-6a','AU-6'),\n('001863','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 b','AU-6b','AU-6'),\n('001864','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (1)','AU-6(1)','AU-6'),\n('001865','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (1)','AU-6(1)','AU-6'),\n('001866','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (5)','AU-6(5)','AU-6'),\n('001867','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (5)','AU-6(5)','AU-6'),\n('001868','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (7)','AU-6(7)','AU-6'),\n('001869','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (7)','AU-6(7)','AU-6'),\n('001870','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (8)','AU-6(8)','AU-6'),\n('001871','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (9)','AU-6(9)','AU-6'),\n('001875','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a','AU-7'),\n('001876','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a','AU-7'),\n('001877','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a','AU-7'),\n('001878','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a','AU-7'),\n('001879','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a','AU-7'),\n('001880','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a','AU-7'),\n('001881','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 b','AU-7b','AU-7'),\n('001882','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 b','AU-7b','AU-7'),\n('001883','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 (1)','AU-7(1)','AU-7'),\n('001888','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-8 b','AU-8b','AU-8'),\n('001889','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-8 b','AU-8b','AU-8'),\n('001890','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-8 b','AU-8b','AU-8'),\n('001894','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (4)','AU-9(4)','AU-9'),\n('001895','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (5)','AU-9(5)','AU-9'),\n('001896','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (5)','AU-9(5)','AU-9'),\n('001897','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (6)','AU-9(6)','AU-9'),\n('001898','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (6)','AU-9(6)','AU-9'),\n('001899','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-10','AU-10','AU-10'),\n('001900','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (1) (a)','AU-10(1)(a)','AU-10'),\n('001901','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (1) (a)','AU-10(1)(a)','AU-10'),\n('001902','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (1) (b)','AU-10(1)(b)','AU-10'),\n('001903','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (2) (a)','AU-10(2)(a)','AU-10'),\n('001904','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (2) (a)','AU-10(2)(a)','AU-10'),\n('001905','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (2) (b)','AU-10(2)(b)','AU-10'),\n('001906','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (2) (b)','AU-10(2)(b)','AU-10'),\n('001907','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (4) (a)','AU-10(4)(a)','AU-10'),\n('001908','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (4) (b)','AU-10(4)(b)','AU-10'),\n('001909','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-10 (4) (b)','AU-10(4)(b)','AU-10'),\n('001910','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 b','AU-12b','AU-12'),\n('001911','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (3)','AU-12(3)','AU-12'),\n('001912','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (3)','AU-12(3)','AU-12'),\n('001913','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (3)','AU-12(3)','AU-12'),\n('001914','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (3)','AU-12(3)','AU-12'),\n('001915','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 a','AU-13a','AU-13'),\n('001917','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 (2)','AU-13(2)','AU-13'),\n('001918','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 (2)','AU-13(2)','AU-13'),\n('001919','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-14 a','AU-14a','AU-14'),\n('001920','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-14 (3)','AU-14(3)','AU-14'),\n('001923','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-16','AU-16','AU-16'),\n('001924','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-16','AU-16','AU-16'),\n('001925','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-16','AU-16','AU-16'),\n('001926','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-16 (1)','AU-16(1)','AU-16'),\n('001927','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-16 (2)','AU-16(2)','AU-16'),\n('001928','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-16 (2)','AU-16(2)','AU-16'),\n('001929','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-16 (2)','AU-16(2)','AU-16'),\n('001930','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 1','AU-1a1','AU-1'),\n('001931','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 2','AU-1a2','AU-1'),\n('001941','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (8)','IA-2(8)','IA-2'),\n('001943','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (10)','IA-2(10)','IA-2'),\n('001944','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (10)','IA-2(10)','IA-2'),\n('001945','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (10)','IA-2(10)','IA-2'),\n('001946','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (10)','IA-2(10)','IA-2'),\n('001953','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (12)','IA-2(12)','IA-2'),\n('001954','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (12)','IA-2(12)','IA-2'),\n('001955','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (13)','IA-2(13)','IA-2'),\n('001956','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (13)','IA-2(13)','IA-2'),\n('001957','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (13)','IA-2(13)','IA-2'),\n('001958','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-3','IA-3','IA-3'),\n('001959','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (1)','IA-3(1)','IA-3'),\n('001960','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (3) (a)','IA-3(3)(a)','IA-3'),\n('001961','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (3) (a)','IA-3(3)(a)','IA-3'),\n('001962','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (3) (a)','IA-3(3)(a)','IA-3'),\n('001963','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (3) (a)','IA-3(3)(a)','IA-3'),\n('001965','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (4)','IA-3(4)','IA-3'),\n('001966','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (4)','IA-3(4)','IA-3'),\n('001967','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (1)','IA-3(1)','IA-3'),\n('001968','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (4)','IA-3(4)','IA-3'),\n('001969','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-3 (4)','IA-3(4)','IA-3'),\n('001970','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 a','IA-4a','IA-4'),\n('001971','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 a','IA-4a','IA-4'),\n('001972','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 b','IA-4b','IA-4'),\n('001973','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 c','IA-4c','IA-4'),\n('001974','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 d','IA-4d','IA-4'),\n('001975','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 d','IA-4d','IA-4'),\n('001976','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (5)','IA-4(5)','IA-4'),\n('001977','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (6)','IA-4(6)','IA-4'),\n('001978','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (6)','IA-4(6)','IA-4'),\n('001980','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 a','IA-5a','IA-5'),\n('001981','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 d','IA-5d','IA-5'),\n('001984','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 d','IA-5d','IA-5'),\n('001985','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 d','IA-5d','IA-5'),\n('001988','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 d','IA-5d','IA-5'),\n('001990','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 i','IA-5i','IA-5'),\n('001998','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (5)','IA-5(5)','IA-5'),\n('002001','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (10)','IA-5(10)','IA-5'),\n('002004','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (12)','IA-5(12)','IA-5'),\n('002005','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (12)','IA-5(12)','IA-5'),\n('002006','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (13)','IA-5(13)','IA-5'),\n('002007','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (13)','IA-5(13)','IA-5'),\n('002008','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (14)','IA-5(14)','IA-5'),\n('002009','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (1)','IA-8(1)','IA-8'),\n('002010','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (1)','IA-8(1)','IA-8'),\n('002015','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (5)','IA-8(5)','IA-8'),\n('002016','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (5)','IA-8(5)','IA-8'),\n('002018','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-9','IA-9','IA-9'),\n('002021','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-9','IA-9','IA-9'),\n('002022','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-9','IA-9','IA-9'),\n('002033','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-10','IA-10','IA-10'),\n('002034','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-10','IA-10','IA-10'),\n('002035','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-10','IA-10','IA-10'),\n('002036','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-11','IA-11','IA-11'),\n('002038','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-11','IA-11','IA-11'),\n('002042','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 g','IA-5g','IA-5'),\n('002044','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-11 (1)','AU-11(1)','AU-11'),\n('002045','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-11 (1)','AU-11(1)','AU-11'),\n('002047','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (3)','AU-12(3)','AU-12'),\n('002048','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 a 1 (a)','AT-1a1(a)','AT-1'),\n('002049','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 a 2','AT-1a2','AT-1'),\n('002050','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (1)','AT-3(1)','AT-3'),\n('002051','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (2)','AT-3(2)','AT-3'),\n('002052','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (3)','AT-3(3)','AT-3'),\n('002055','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 (2)','AT-2(2)','AT-2'),\n('002056','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 e','CM-3e','CM-3'),\n('002057','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (f)','CM-3(1)(f)','CM-3'),\n('002058','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (f)','CM-3(1)(f)','CM-3'),\n('002059','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (1)','CM-6(1)','CM-6'),\n('002061','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 1 (a)','CA-1a1(a)','CA-1'),\n('002062','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 2','CA-1a2','CA-1'),\n('002065','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (2)','CA-2(2)','CA-2'),\n('002066','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (3)','CA-2(3)','CA-2'),\n('002067','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (3)','CA-2(3)','CA-2'),\n('002068','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (3)','CA-2(3)','CA-2'),\n('002069','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 (3)','CA-2(3)','CA-2'),\n('002070','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 b 3','CA-2b3','CA-2'),\n('002071','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 f','CA-2f','CA-2'),\n('002083','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 c','CA-3c','CA-3'),\n('002084','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 c','CA-3c','CA-3'),\n('002086','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 (3)','CA-7(3)','CA-7'),\n('002087','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 a','CA-7a','CA-7'),\n('002088','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 b','CA-7b','CA-7'),\n('002090','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 d','CA-7d','CA-7'),\n('002091','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 e','CA-7e','CA-7'),\n('002092','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 f','CA-7f','CA-7'),\n('002093','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-8','CA-8','CA-8'),\n('002094','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-8','CA-8','CA-8'),\n('002095','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-8','CA-8','CA-8'),\n('002096','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-8 (1)','CA-8(1)','CA-8'),\n('002097','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-8 (2)','CA-8(2)','CA-8'),\n('002099','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-8 (2)','CA-8(2)','CA-8'),\n('002100','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (1)','CA-9(1)','CA-9'),\n('002101','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (a)','CA-9(a)','CA-9'),\n('002102','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (a)','CA-9(a)','CA-9'),\n('002103','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (b)','CA-9(b)','CA-9'),\n('002104','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (b)','CA-9(b)','CA-9'),\n('002105','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (b)','CA-9(b)','CA-9'),\n('002107','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 1 (a)','AC-1a1(a)','AC-1'),\n('002108','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 2','AC-1a2','AC-1'),\n('002112','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 b','AC-2b','AC-2'),\n('002115','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 d 1','AC-2d1','AC-2'),\n('002116','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 d 2','AC-2d2','AC-2'),\n('002117','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 d 2','AC-2d2','AC-2'),\n('002118','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 d 3','AC-2d3','AC-2'),\n('002119','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 d 3','AC-2d3','AC-2'),\n('002120','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 e','AC-2e','AC-2'),\n('002121','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 f','AC-2f','AC-2'),\n('002122','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 g','AC-2g','AC-2'),\n('002123','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 h 1','AC-2h1','AC-2'),\n('002124','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 h 2','AC-2h2','AC-2'),\n('002125','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 h 3','AC-2h3','AC-2'),\n('002126','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 i 1','AC-2i1','AC-2'),\n('002127','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 i 2','AC-2i2','AC-2'),\n('002128','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 i 3','AC-2i3','AC-2'),\n('002129','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 k','AC-2k','AC-2'),\n('002130','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (4)','AC-2(4)','AC-2'),\n('002133','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (5)','AC-2(5)','AC-2'),\n('002134','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (6)','AC-2(6)','AC-2'),\n('002135','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (6)','AC-2(6)','AC-2'),\n('002137','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (7) (d)','AC-2(7)(d)','AC-2'),\n('002138','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (8)','AC-2(8)','AC-2'),\n('002139','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (8)','AC-2(8)','AC-2'),\n('002140','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (9)','AC-2(9)','AC-2'),\n('002141','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (9)','AC-2(9)','AC-2'),\n('002143','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (11)','AC-2(11)','AC-2'),\n('002144','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (11)','AC-2(11)','AC-2'),\n('002145','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (11)','AC-2(11)','AC-2'),\n('002146','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (12) (a)','AC-2(12)(a)','AC-2'),\n('002147','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (12) (a)','AC-2(12)(a)','AC-2'),\n('002148','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (12) (b)','AC-2(12)(b)','AC-2'),\n('002149','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (12) (b)','AC-2(12)(b)','AC-2'),\n('002150','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (13)','AC-2(13)','AC-2'),\n('002151','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (13)','AC-2(13)','AC-2'),\n('002152','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (2)','AC-3(2)','AC-3'),\n('002153','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3)','AC-3(3)','AC-3'),\n('002153','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (15) (a)','AC-3(15)(a)','AC-3'),\n('002154','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (a)','AC-3(3)(a)','AC-3'),\n('002155','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (b) (1)','AC-3(3)(b)(1)','AC-3'),\n('002156','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (b) (2)','AC-3(3)(b)(2)','AC-3'),\n('002157','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (b) (3)','AC-3(3)(b)(3)','AC-3'),\n('002158','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (b) (4)','AC-3(3)(b)(4)','AC-3'),\n('002159','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (b) (4)','AC-3(3)(b)(4)','AC-3'),\n('002160','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (b) (5)','AC-3(3)(b)(5)','AC-3'),\n('002161','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (c)','AC-3(3)(c)','AC-3'),\n('002162','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (c)','AC-3(3)(c)','AC-3'),\n('002163','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (4)','AC-3(4)','AC-3'),\n('002164','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (4)','AC-3(4)','AC-3'),\n('002165','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (4)','AC-3(4)','AC-3'),\n('002166','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3(7)','AC-3'),\n('002169','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3(7)','AC-3'),\n('002170','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3(7)','AC-3'),\n('002173','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3(7)','AC-3'),\n('002174','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (7)','AC-3(7)','AC-3'),\n('002177','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (8)','AC-3(8)','AC-3'),\n('002178','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (8)','AC-3(8)','AC-3'),\n('002179','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (8)','AC-3(8)','AC-3'),\n('002180','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (9) (a)','AC-3(9)(a)','AC-3'),\n('002181','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (9) (a)','AC-3(9)(a)','AC-3'),\n('002182','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (9) (a)','AC-3(9)(a)','AC-3'),\n('002183','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (9) (b)','AC-3(9)(b)','AC-3'),\n('002184','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (9) (b)','AC-3(9)(b)','AC-3'),\n('002185','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (10)','AC-3(10)','AC-3'),\n('002186','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (10)','AC-3(10)','AC-3'),\n('002187','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (1)','AC-4(1)','AC-4'),\n('002188','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (1)','AC-4(1)','AC-4'),\n('002189','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (1)','AC-4(1)','AC-4'),\n('002190','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (1)','AC-4(1)','AC-4'),\n('002191','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (2)','AC-4(2)','AC-4'),\n('002192','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (3)','AC-4(3)','AC-4'),\n('002193','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (4)','AC-4(4)','AC-4'),\n('002194','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (6)','AC-4(6)','AC-4'),\n('002195','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (8) (a)','AC-4(8)(a)','AC-4'),\n('002196','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (9)','AC-4(9)','AC-4'),\n('002197','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (9)','AC-4(9)','AC-4'),\n('002198','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (9)','AC-4(9)','AC-4'),\n('002199','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (10)','AC-4(10)','AC-4'),\n('002200','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (12)','AC-4(12)','AC-4'),\n('002201','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (12)','AC-4(12)','AC-4'),\n('002202','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (13)','AC-4(13)','AC-4'),\n('002203','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (15)','AC-4(15)','AC-4'),\n('002204','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (15)','AC-4(15)','AC-4'),\n('002205','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (17)','AC-4(17)','AC-4'),\n('002207','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (17)','AC-4(17)','AC-4'),\n('002211','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (19)','AC-4(19)','AC-4'),\n('002212','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (20)','AC-4(20)','AC-4'),\n('002213','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (20)','AC-4(20)','AC-4'),\n('002214','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (20)','AC-4(20)','AC-4'),\n('002215','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (21)','AC-4(21)','AC-4'),\n('002216','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (21)','AC-4(21)','AC-4'),\n('002217','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (21)','AC-4(21)','AC-4'),\n('002218','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (22)','AC-4(22)','AC-4'),\n('002219','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-5 a','AC-5a','AC-5'),\n('002220','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-5 b','AC-5b','AC-5'),\n('002221','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (1) (b)','AC-6(1)(b)','AC-6'),\n('002222','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (1) (a)','AC-6(1)(a)','AC-6'),\n('002223','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (1) (b)','AC-6(1)(b)','AC-6'),\n('002224','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (3)','AC-6(3)','AC-6'),\n('002225','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (4)','AC-6(4)','AC-6'),\n('002226','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (5)','AC-6(5)','AC-6'),\n('002227','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (5)','AC-6(5)','AC-6'),\n('002228','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (7) (a)','AC-6(7)(a)','AC-6'),\n('002229','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (7) (a)','AC-6(7)(a)','AC-6'),\n('002230','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (7) (a)','AC-6(7)(a)','AC-6'),\n('002231','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (7) (b)','AC-6(7)(b)','AC-6'),\n('002232','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (8)','AC-6(8)','AC-6'),\n('002233','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (8)','AC-6(8)','AC-6'),\n('002234','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (9)','AC-6(9)','AC-6'),\n('002235','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (10)','AC-6(10)','AC-6'),\n('002236','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 b','AC-7b','AC-7'),\n('002237','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 b','AC-7b','AC-7'),\n('002238','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 b','AC-7b','AC-7'),\n('002239','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 (2)','AC-7(2)','AC-7'),\n('002240','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 (2)','AC-7(2)','AC-7'),\n('002241','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 (2)','AC-7(2)','AC-7'),\n('002242','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 (2)','AC-7(2)','AC-7'),\n('002243','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 a 1','AC-8a1','AC-8'),\n('002244','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 a 2','AC-8a2','AC-8'),\n('002245','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 a 3','AC-8a3','AC-8'),\n('002246','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 a 4','AC-8a4','AC-8'),\n('002247','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 a','AC-8a','AC-8'),\n('002248','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-8 c 1','AC-8c1','AC-8'),\n('002249','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (4)','AC-9(4)','AC-9'),\n('002250','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-9 (4)','AC-9(4)','AC-9'),\n('002252','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-10','AC-10','AC-10'),\n('002256','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('002257','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('002258','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('002259','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('002260','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('002261','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('002262','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('002263','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('002264','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('002265','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 b','AC-16b','AC-16'),\n('002266','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 b','AC-16b','AC-16'),\n('002267','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 c','AC-16c','AC-16'),\n('002268','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 c','AC-16c','AC-16'),\n('002269','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 c','AC-16c','AC-16'),\n('002270','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 d','AC-16d','AC-16'),\n('002271','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 d','AC-16d','AC-16'),\n('002272','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (1)','AC-16(1)','AC-16'),\n('002273','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (1)','AC-16(1)','AC-16'),\n('002274','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (1)','AC-16(1)','AC-16'),\n('002275','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (1)','AC-16(1)','AC-16'),\n('002277','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (2)','AC-16(2)','AC-16'),\n('002278','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16(3)','AC-16'),\n('002279','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16(3)','AC-16'),\n('002280','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16(3)','AC-16'),\n('002281','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16(3)','AC-16'),\n('002282','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16(3)','AC-16'),\n('002283','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16(3)','AC-16'),\n('002284','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16(3)','AC-16'),\n('002286','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16(4)','AC-16'),\n('002287','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16(4)','AC-16'),\n('002288','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16(4)','AC-16'),\n('002289','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16(4)','AC-16'),\n('002290','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16(4)','AC-16'),\n('002291','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('002292','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('002293','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('002294','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('002295','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('002296','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('002297','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('002298','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('002299','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (7)','AC-16(7)','AC-16'),\n('002300','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (8)','AC-16(8)','AC-16'),\n('002301','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (8)','AC-16(8)','AC-16'),\n('002302','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (8)','AC-16(8)','AC-16'),\n('002303','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (9)','AC-16(9)','AC-16'),\n('002304','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (9)','AC-16(9)','AC-16'),\n('002306','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (10)','AC-16(10)','AC-16'),\n('002307','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (10)','AC-16(10)','AC-16'),\n('002308','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (10)','AC-16(10)','AC-16'),\n('002309','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (10)','AC-16(10)','AC-16'),\n('002310','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 a','AC-17a','AC-17'),\n('002311','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 a','AC-17a','AC-17'),\n('002312','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 a','AC-17a','AC-17'),\n('002314','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (1)','AC-17(1)','AC-17'),\n('002316','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (4) (a)','AC-17(4)(a)','AC-17'),\n('002317','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (4) (a)','AC-17(4)(a)','AC-17'),\n('002318','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (4) (a)','AC-17(4)(a)','AC-17'),\n('002319','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (4) (b)','AC-17(4)(b)','AC-17'),\n('002320','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (4) (b)','AC-17(4)(b)','AC-17'),\n('002321','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (9)','AC-17(9)','AC-17'),\n('002322','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (9)','AC-17(9)','AC-17'),\n('002323','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 a','AC-18a','AC-18'),\n('002324','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-18 (4)','AC-18(4)','AC-18'),\n('002325','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 a','AC-19a','AC-19'),\n('002326','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 a','AC-19a','AC-19'),\n('002327','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (c)','AC-19(4)(c)','AC-19'),\n('002328','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (4) (c)','AC-19(4)(c)','AC-19'),\n('002329','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (5)','AC-19(5)','AC-19'),\n('002330','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (5)','AC-19(5)','AC-19'),\n('002331','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-19 (5)','AC-19(5)','AC-19'),\n('002332','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 a 2','AC-20a2','AC-20'),\n('002337','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (1) (b)','AC-20(1)(b)','AC-20'),\n('002338','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (3)','AC-20(3)','AC-20'),\n('002339','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (4)','AC-20(4)','AC-20'),\n('002340','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (4)','AC-20(4)','AC-20'),\n('002341','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-21 (2)','AC-21(2)','AC-21'),\n('002342','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-21 (2)','AC-21(2)','AC-21'),\n('002343','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-23','AC-23','AC-23'),\n('002344','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-23','AC-23','AC-23'),\n('002345','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-23','AC-23','AC-23'),\n('002346','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-23','AC-23','AC-23'),\n('002347','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-23','AC-23','AC-23'),\n('002348','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-24','AC-24','AC-24'),\n('002349','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-24','AC-24','AC-24'),\n('002350','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-24 (1)','AC-24(1)','AC-24'),\n('002351','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-24 (1)','AC-24(1)','AC-24'),\n('002352','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-24 (1)','AC-24(1)','AC-24'),\n('002353','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-24 (1)','AC-24(1)','AC-24'),\n('002354','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-24 (2)','AC-24(2)','AC-24'),\n('002355','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-24 (2)','AC-24(2)','AC-24'),\n('002356','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-25','AC-25','AC-25'),\n('002357','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-25','AC-25','AC-25'),\n('002358','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-25','AC-25','AC-25'),\n('002359','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-25','AC-25','AC-25'),\n('002360','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-12','AC-12','AC-12'),\n('002361','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-12','AC-12','AC-12'),\n('002362','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-12 (1)','AC-12(1)','AC-12'),\n('002363','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-12 (1)','AC-12(1)','AC-12'),\n('002364','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-12 (2)','AC-12(2)','AC-12'),\n('002368','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 a 1 (a)','RA-1a1(a)','RA-1'),\n('002369','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 a 2','RA-1a2','RA-1'),\n('002370','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 e','RA-3e','RA-3'),\n('002371','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 e','RA-3e','RA-3'),\n('002372','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (10)','RA-5(10)','RA-5'),\n('002373','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (3)','RA-5(3)','RA-5'),\n('002374','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (4)','RA-5(4)','RA-5'),\n('002375','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (4)','RA-5(4)','RA-5'),\n('002376','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 e','RA-5e','RA-5'),\n('002378','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 1','SC-1a1','SC-1'),\n('002380','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 2','SC-1a2','SC-1'),\n('002381','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-3 (3)','SC-3(3)','SC-3'),\n('002382','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-3 (4)','SC-3(4)','SC-3'),\n('002383','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-4 (2)','SC-4(2)','SC-4'),\n('002384','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-4 (2)','SC-4(2)','SC-4'),\n('002385','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 a','SC-5a','SC-5'),\n('002387','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 (1)','SC-5(1)','SC-5'),\n('002388','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 (3) (a)','SC-5(3)(a)','SC-5'),\n('002389','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 (3) (a)','SC-5(3)(a)','SC-5'),\n('002390','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 (3) (b)','SC-5(3)(b)','SC-5'),\n('002391','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 (3) (b)','SC-5(3)(b)','SC-5'),\n('002392','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-6','SC-6','SC-6'),\n('002393','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-6','SC-6','SC-6'),\n('002394','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-6','SC-6','SC-6'),\n('002395','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 b','SC-7b','SC-7'),\n('002396','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (c)','SC-7(4)(c)','SC-7'),\n('002397','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (7)','SC-7(7)','SC-7'),\n('002398','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (9) (a)','SC-7(9)(a)','SC-7'),\n('002399','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (9) (a)','SC-7(9)(a)','SC-7'),\n('002400','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (9) (b)','SC-7(9)(b)','SC-7'),\n('002401','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (11)','SC-7(11)','SC-7'),\n('002402','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (11)','SC-7(11)','SC-7'),\n('002403','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (11)','SC-7(11)','SC-7'),\n('002404','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (12)','SC-7(12)','SC-7'),\n('002405','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (12)','SC-7(12)','SC-7'),\n('002406','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (12)','SC-7(12)','SC-7'),\n('002407','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (14)','SC-7(14)','SC-7'),\n('002408','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (19)','SC-7(19)','SC-7'),\n('002409','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (19)','SC-7(19)','SC-7'),\n('002410','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (20)','SC-7(20)','SC-7'),\n('002411','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (20)','SC-7(20)','SC-7'),\n('002413','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (21)','SC-7(21)','SC-7'),\n('002414','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (21)','SC-7(21)','SC-7'),\n('002415','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (21)','SC-7(21)','SC-7'),\n('002416','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (22)','SC-7(22)','SC-7'),\n('002417','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (23)','SC-7(23)','SC-7'),\n('002418','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-8','SC-8','SC-8'),\n('002420','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (2)','SC-8(2)','SC-8'),\n('002421','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (1)','SC-8(1)','SC-8'),\n('002422','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (2)','SC-8(2)','SC-8'),\n('002423','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (3)','SC-8(3)','SC-8'),\n('002424','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (4)','SC-8(4)','SC-8'),\n('002425','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (4)','SC-8(4)','SC-8'),\n('002426','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-11 (1) (a)','SC-11(1)(a)','SC-11'),\n('002427','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (3)','SC-8(3)','SC-8'),\n('002428','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002429','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002430','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002431','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002432','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002433','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002434','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002435','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002436','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002437','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002438','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002439','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002440','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002441','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002442','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12','SC-12','SC-12'),\n('002443','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (2)','SC-12(2)','SC-12'),\n('002444','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (2)','SC-12(2)','SC-12'),\n('002445','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (2)','SC-12(2)','SC-12'),\n('002446','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (3)','SC-12(3)','SC-12'),\n('002447','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (3)','SC-12(3)','SC-12'),\n('002448','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (3)','SC-12(3)','SC-12'),\n('002449','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-13','SC-13','SC-13'),\n('002450','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-13 b','SC-13b','SC-13'),\n('002451','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 (3)','SC-15(3)','SC-15'),\n('002452','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 (4)','SC-15(4)','SC-15'),\n('002453','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-15 (4)','SC-15(4)','SC-15'),\n('002454','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-16','SC-16','SC-16'),\n('002455','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-16','SC-16','SC-16'),\n('002456','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-17 a','SC-17a','SC-17'),\n('002457','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (1)','SC-18(1)','SC-18'),\n('002458','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (1)','SC-18(1)','SC-18'),\n('002459','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (3)','SC-18(3)','SC-18'),\n('002460','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (4)','SC-18(4)','SC-18'),\n('002461','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-18 (5)','SC-18(5)','SC-18'),\n('002462','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-20 a','SC-20a','SC-20'),\n('002463','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-20 (2)','SC-20(2)','SC-20'),\n('002464','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-20 (2)','SC-20(2)','SC-20'),\n('002465','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-21','SC-21','SC-21'),\n('002466','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-21','SC-21','SC-21'),\n('002467','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-21','SC-21','SC-21'),\n('002468','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-21','SC-21','SC-21'),\n('002469','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-23 (5)','SC-23(5)','SC-23'),\n('002470','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-23 (5)','SC-23(5)','SC-23'),\n('002471','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-25','SC-25','SC-25'),\n('002472','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-28','SC-28','SC-28'),\n('002473','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (1)','SC-28(1)','SC-28'),\n('002474','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (1)','SC-28(1)','SC-28'),\n('002475','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (1)','SC-28(1)','SC-28'),\n('002476','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (1)','SC-28(1)','SC-28'),\n('002477','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (2)','SC-28(2)','SC-28'),\n('002478','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (2)','SC-28(2)','SC-28'),\n('002479','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (2)','SC-28(2)','SC-28'),\n('002480','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-29','SC-29','SC-29'),\n('002481','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-29 (1)','SC-29(1)','SC-29'),\n('002482','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30','SC-30','SC-30'),\n('002483','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30','SC-30','SC-30'),\n('002484','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30','SC-30','SC-30'),\n('002485','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30','SC-30','SC-30'),\n('002486','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (2)','SC-30(2)','SC-30'),\n('002487','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (2)','SC-30(2)','SC-30'),\n('002488','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (2)','SC-30(2)','SC-30'),\n('002489','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (3)','SC-30(3)','SC-30'),\n('002490','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (3)','SC-30(3)','SC-30'),\n('002492','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (3)','SC-30(3)','SC-30'),\n('002493','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (4)','SC-30(4)','SC-30'),\n('002494','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (4)','SC-30(4)','SC-30'),\n('002495','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (5)','SC-30(5)','SC-30'),\n('002496','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (5)','SC-30(5)','SC-30'),\n('002497','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-30 (5)','SC-30(5)','SC-30'),\n('002498','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-31 a','SC-31a','SC-31'),\n('002499','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-31 b','SC-31b','SC-31'),\n('002500','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-31 (2)','SC-31(2)','SC-31'),\n('002501','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-31 (2)','SC-31(2)','SC-31'),\n('002502','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-31 (3)','SC-31(3)','SC-31'),\n('002503','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-31 (3)','SC-31(3)','SC-31'),\n('002504','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-32','SC-32','SC-32'),\n('002505','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-32','SC-32','SC-32'),\n('002506','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-32','SC-32','SC-32'),\n('002507','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-34 (2)','SC-34(2)','SC-34'),\n('002508','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-51 a','SC-51a','SC-51'),\n('002509','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-51 a','SC-51a','SC-51'),\n('002510','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-51 b','SC-51b','SC-51'),\n('002511','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-51 b','SC-51b','SC-51'),\n('002512','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-51 b','SC-51b','SC-51'),\n('002513','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-36','SC-36','SC-36'),\n('002514','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-36','SC-36','SC-36'),\n('002515','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-36','SC-36','SC-36'),\n('002516','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-36','SC-36','SC-36'),\n('002517','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-36 (1) (a)','SC-36(1)(a)','SC-36'),\n('002518','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-36 (1) (a)','SC-36(1)(a)','SC-36'),\n('002519','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-36 (1) (a)','SC-36(1)(a)','SC-36'),\n('002520','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-36 (1) (a)','SC-36(1)(a)','SC-36'),\n('002521','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-37','SC-37','SC-37'),\n('002522','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-37','SC-37','SC-37'),\n('002523','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-37 (1)','SC-37(1)','SC-37'),\n('002523','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-37','SC-37','SC-37'),\n('002524','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-37','SC-37','SC-37'),\n('002525','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-37 (1)','SC-37(1)','SC-37'),\n('002526','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-37 (1)','SC-37(1)','SC-37'),\n('002527','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-37 (1)','SC-37(1)','SC-37'),\n('002528','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-38','SC-38','SC-38'),\n('002529','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-38','SC-38','SC-38'),\n('002530','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-39','SC-39','SC-39'),\n('002531','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-39 (1)','SC-39(1)','SC-39'),\n('002532','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-39 (2)','SC-39(2)','SC-39'),\n('002533','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-39 (2)','SC-39(2)','SC-39'),\n('002534','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-40','SC-40','SC-40'),\n('002535','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-40','SC-40','SC-40'),\n('002536','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-40','SC-40','SC-40'),\n('002537','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-40 (1)','SC-40(1)','SC-40'),\n('002538','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-40 (1)','SC-40(1)','SC-40'),\n('002539','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-40 (2)','SC-40(2)','SC-40'),\n('002540','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-40 (2)','SC-40(2)','SC-40'),\n('002541','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-40 (3)','SC-40(3)','SC-40'),\n('002542','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-40 (4)','SC-40(4)','SC-40'),\n('002543','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-40 (4)','SC-40(4)','SC-40'),\n('002544','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-41','SC-41','SC-41'),\n('002545','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-41','SC-41','SC-41'),\n('002546','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-41','SC-41','SC-41'),\n('002547','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 a','SC-42a','SC-42'),\n('002548','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 a','SC-42a','SC-42'),\n('002549','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 b','SC-42b','SC-42'),\n('002550','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 b','SC-42b','SC-42'),\n('002551','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (1)','SC-42(1)','SC-42'),\n('002552','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (1)','SC-42(1)','SC-42'),\n('002553','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (2)','SC-42(2)','SC-42'),\n('002554','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (2)','SC-42(2)','SC-42'),\n('002555','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (2)','SC-42(2)','SC-42'),\n('002556','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 a','SC-42a','SC-42'),\n('002557','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 a','SC-42a','SC-42'),\n('002559','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-43 a','SC-43a','SC-43'),\n('002560','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-43 a','SC-43a','SC-43'),\n('002561','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-43 b','SC-43b','SC-43'),\n('002562','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-43 b','SC-43b','SC-43'),\n('002563','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-43 b','SC-43b','SC-43'),\n('002564','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-44','SC-44','SC-44'),\n('002565','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-44','SC-44','SC-44'),\n('002566','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 a 1','MP-1a1','MP-1'),\n('002567','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (1)','MP-6(1)','MP-6'),\n('002568','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (1)','MP-6(1)','MP-6'),\n('002569','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (1)','MP-6(1)','MP-6'),\n('002570','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (1)','MP-6(1)','MP-6'),\n('002571','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (1)','MP-6(1)','MP-6'),\n('002572','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (1)','MP-6(1)','MP-6'),\n('002573','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (7)','MP-6(7)','MP-6'),\n('002574','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (7)','MP-6(7)','MP-6'),\n('002575','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (8)','MP-6(8)','MP-6'),\n('002576','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (8)','MP-6(8)','MP-6'),\n('002577','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (8)','MP-6(8)','MP-6'),\n('002578','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 a','MP-6a','MP-6'),\n('002579','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 a','MP-6a','MP-6'),\n('002580','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 b','MP-6b','MP-6'),\n('002581','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-7 (a)','MP-7(a)','MP-7'),\n('002582','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-7 (a)','MP-7(a)','MP-7'),\n('002583','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-7 (a)','MP-7(a)','MP-7'),\n('002584','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-7 (a)','MP-7(a)','MP-7'),\n('002585','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-7 (b)','MP-7(b)','MP-7'),\n('002586','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-7 (2)','MP-7(2)','MP-7'),\n('002587','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 (1)','MP-8(1)','MP-8'),\n('002591','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 (2)','MP-8(2)','MP-8'),\n('002593','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 (3)','MP-8(3)','MP-8'),\n('002594','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 (4)','MP-8(4)','MP-8'),\n('002600','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 d','MP-8d','MP-8'),\n('002601','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 a','SI-1a','SI-1'),\n('002602','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 b','SI-2b','SI-2'),\n('002603','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 b','SI-2b','SI-2'),\n('002604','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 c','SI-2c','SI-2'),\n('002605','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 c','SI-2c','SI-2'),\n('002606','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 c','SI-2c','SI-2'),\n('002607','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 c','SI-2c','SI-2'),\n('002608','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (3) (b)','SI-2(3)(b)','SI-2'),\n('002609','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (5)','SI-2(5)','SI-2'),\n('002610','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (5)','SI-2(5)','SI-2'),\n('002611','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (5)','SI-2(5)','SI-2'),\n('002612','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (5)','SI-2(5)','SI-2'),\n('002613','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (5)','SI-2(5)','SI-2'),\n('002614','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (5)','SI-2(5)','SI-2'),\n('002615','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (6)','SI-2(6)','SI-2'),\n('002616','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (6)','SI-2(6)','SI-2'),\n('002617','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (6)','SI-2(6)','SI-2'),\n('002618','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (6)','SI-2(6)','SI-2'),\n('002623','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 c 1','SI-3c1','SI-3'),\n('002624','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 c 1','SI-3c1','SI-3'),\n('002625','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (6) (b)','SI-3(6)(b)','SI-3'),\n('002626','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (6) (b)','SI-3(6)(b)','SI-3'),\n('002628','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (8) (a)','SI-3(8)(a)','SI-3'),\n('002629','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (8) (a)','SI-3(8)(a)','SI-3'),\n('002630','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (8) (a)','SI-3(8)(a)','SI-3'),\n('002631','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (8) (b)','SI-3(8)(b)','SI-3'),\n('002634','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (10) (a)','SI-3(10)(a)','SI-3'),\n('002635','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (10) (a)','SI-3(10)(a)','SI-3'),\n('002636','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (10) (a)','SI-3(10)(a)','SI-3'),\n('002638','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (10) (a)','SI-3(10)(a)','SI-3'),\n('002639','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (10) (b)','SI-3(10)(b)','SI-3'),\n('002640','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 (10) (b)','SI-3(10)(b)','SI-3'),\n('002641','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 a 1','SI-4a1','SI-4'),\n('002642','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 a 2','SI-4a2','SI-4'),\n('002643','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 a 2','SI-4a2','SI-4'),\n('002644','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 a 2','SI-4a2','SI-4'),\n('002645','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 b','SI-4b','SI-4'),\n('002646','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 b','SI-4b','SI-4'),\n('002650','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 g','SI-4g','SI-4'),\n('002651','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 g','SI-4g','SI-4'),\n('002652','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 g','SI-4g','SI-4'),\n('002654','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 g','SI-4g','SI-4'),\n('002655','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (1)','SI-4(1)','SI-4'),\n('002656','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (1)','SI-4(1)','SI-4'),\n('002657','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (3)','SI-4(3)','SI-4'),\n('002658','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (3)','SI-4(3)','SI-4'),\n('002659','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (4) (b)','SI-4(4)(b)','SI-4'),\n('002660','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (4) (b)','SI-4(4)(b)','SI-4'),\n('002661','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (4) (b)','SI-4(4)(b)','SI-4'),\n('002662','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (4) (b)','SI-4(4)(b)','SI-4'),\n('002663','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (5)','SI-4(5)','SI-4'),\n('002664','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (5)','SI-4(5)','SI-4'),\n('002665','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (10)','SI-4(10)','SI-4'),\n('002666','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (10)','SI-4(10)','SI-4'),\n('002667','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (10)','SI-4(10)','SI-4'),\n('002668','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (11)','SI-4(11)','SI-4'),\n('002669','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (13) (c)','SI-4(13)(c)','SI-4'),\n('002670','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (18)','SI-4(18)','SI-4'),\n('002671','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (18)','SI-4(18)','SI-4'),\n('002672','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (18)','SI-4(18)','SI-4'),\n('002673','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (19)','SI-4(19)','SI-4'),\n('002674','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (19)','SI-4(19)','SI-4'),\n('002675','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (19)','SI-4(19)','SI-4'),\n('002676','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (20)','SI-4(20)','SI-4'),\n('002677','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (20)','SI-4(20)','SI-4'),\n('002678','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (21)','SI-4(21)','SI-4'),\n('002679','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (21)','SI-4(21)','SI-4'),\n('002680','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (21)','SI-4(21)','SI-4'),\n('002681','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (22) (a)','SI-4(22)(a)','SI-4'),\n('002682','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (22) (a)','SI-4(22)(a)','SI-4'),\n('002683','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (22) (a)','SI-4(22)(a)','SI-4'),\n('002684','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (22) (b)','SI-4(22)(b)','SI-4'),\n('002685','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (23)','SI-4(23)','SI-4'),\n('002686','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (23)','SI-4(23)','SI-4'),\n('002687','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (23)','SI-4(23)','SI-4'),\n('002688','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (24)','SI-4(24)','SI-4'),\n('002689','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (24)','SI-4(24)','SI-4'),\n('002690','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (24)','SI-4(24)','SI-4'),\n('002692','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 a','SI-5a','SI-5'),\n('002693','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 c','SI-5c','SI-5'),\n('002694','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 c','SI-5c','SI-5'),\n('002695','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 a','SI-6a','SI-6'),\n('002696','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 a','SI-6a','SI-6'),\n('002697','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 b','SI-6b','SI-6'),\n('002698','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 b','SI-6b','SI-6'),\n('002699','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 b','SI-6b','SI-6'),\n('002700','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 c','SI-6c','SI-6'),\n('002701','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 d','SI-6d','SI-6'),\n('002702','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 d','SI-6d','SI-6'),\n('002703','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7','SI-7','SI-7'),\n('002704','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 a','SI-7a','SI-7'),\n('002705','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7(1)','SI-7'),\n('002706','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7(1)','SI-7'),\n('002707','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7(1)','SI-7'),\n('002708','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7(1)','SI-7'),\n('002709','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7(1)','SI-7'),\n('002710','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7(1)','SI-7'),\n('002711','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7(1)','SI-7'),\n('002712','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (1)','SI-7(1)','SI-7'),\n('002713','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (2)','SI-7(2)','SI-7'),\n('002714','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (5)','SI-7(5)','SI-7'),\n('002715','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (5)','SI-7(5)','SI-7'),\n('002716','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (6)','SI-7(6)','SI-7'),\n('002717','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (6)','SI-7(6)','SI-7'),\n('002718','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (6)','SI-7(6)','SI-7'),\n('002719','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (7)','SI-7(7)','SI-7'),\n('002720','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (7)','SI-7(7)','SI-7'),\n('002721','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (8)','SI-7(8)','SI-7'),\n('002722','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (8)','SI-7(8)','SI-7'),\n('002723','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (8)','SI-7(8)','SI-7'),\n('002724','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (8)','SI-7(8)','SI-7'),\n('002725','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (9)','SI-7(9)','SI-7'),\n('002726','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (9)','SI-7(9)','SI-7'),\n('002727','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (10)','SI-7(10)','SI-7'),\n('002728','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (10)','SI-7(10)','SI-7'),\n('002729','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (10)','SI-7(10)','SI-7'),\n('002732','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (12)','SI-7(12)','SI-7'),\n('002733','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (12)','SI-7(12)','SI-7'),\n('002739','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (15)','SI-7(15)','SI-7'),\n('002740','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (15)','SI-7(15)','SI-7'),\n('002741','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-8 a','SI-8a','SI-8'),\n('002742','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-8 a','SI-8a','SI-8'),\n('002743','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-8 (3)','SI-8(3)','SI-8'),\n('002744','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10','SI-10','SI-10'),\n('002745','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (1) (a)','SI-10(1)(a)','SI-10'),\n('002746','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (1) (a)','SI-10(1)(a)','SI-10'),\n('002747','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (1) (b)','SI-10(1)(b)','SI-10'),\n('002748','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (1) (b)','SI-10(1)(b)','SI-10'),\n('002749','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (1) (c)','SI-10(1)(c)','SI-10'),\n('002750','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (2)','SI-10(2)','SI-10'),\n('002751','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (2)','SI-10(2)','SI-10'),\n('002752','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (2)','SI-10(2)','SI-10'),\n('002753','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (2)','SI-10(2)','SI-10'),\n('002754','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (3)','SI-10(3)','SI-10'),\n('002755','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (4)','SI-10(4)','SI-10'),\n('002756','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (5)','SI-10(5)','SI-10'),\n('002757','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (5)','SI-10(5)','SI-10'),\n('002758','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (5)','SI-10(5)','SI-10'),\n('002759','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-11 b','SI-11b','SI-11'),\n('002760','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 a','SI-13a','SI-13'),\n('002761','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 a','SI-13a','SI-13'),\n('002762','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 b','SI-13b','SI-13'),\n('002763','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 b','SI-13b','SI-13'),\n('002764','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-14','SI-14','SI-14'),\n('002765','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-14','SI-14','SI-14'),\n('002766','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-14','SI-14','SI-14'),\n('002767','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-14','SI-14','SI-14'),\n('002768','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-14 (1)','SI-14(1)','SI-14'),\n('002769','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-14 (1)','SI-14(1)','SI-14'),\n('002770','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-15','SI-15','SI-15'),\n('002771','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-15','SI-15','SI-15'),\n('002773','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-17','SI-17','SI-17'),\n('002774','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-17','SI-17','SI-17'),\n('002775','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-17','SI-17','SI-17'),\n('002776','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 a 1 (a)','IR-1a1(a)','IR-1'),\n('002777','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 a 2','IR-1a2','IR-1'),\n('002778','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 a 1','IR-2a1','IR-2'),\n('002779','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 a 2','IR-2a2','IR-2'),\n('002780','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (2)','IR-3(2)','IR-3'),\n('002781','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (2)','IR-4(2)','IR-4'),\n('002782','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (6)','IR-4(6)','IR-4'),\n('002785','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (8)','IR-4(8)','IR-4'),\n('002786','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (8)','IR-4(8)','IR-4'),\n('002787','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (8)','IR-4(8)','IR-4'),\n('002788','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (9)','IR-4(9)','IR-4'),\n('002789','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (9)','IR-4(9)','IR-4'),\n('002790','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (10)','IR-4(10)','IR-4'),\n('002791','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 b','IR-6b','IR-6'),\n('002792','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 (2)','IR-6(2)','IR-6'),\n('002793','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 (3)','IR-6(3)','IR-6'),\n('002794','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a','IR-8a','IR-8'),\n('002795','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 1','IR-8a1','IR-8'),\n('002796','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 2','IR-8a2','IR-8'),\n('002797','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 3','IR-8a3','IR-8'),\n('002798','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 4','IR-8a4','IR-8'),\n('002799','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 5','IR-8a5','IR-8'),\n('002800','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 6','IR-8a6','IR-8'),\n('002801','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 7','IR-8a7','IR-8'),\n('002802','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 9','IR-8a9','IR-8'),\n('002803','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 d','IR-8d','IR-8'),\n('002804','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 e','IR-8e','IR-8'),\n('002805','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 b','IR-9b','IR-9'),\n('002806','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 c','IR-9c','IR-9'),\n('002807','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 c','IR-9c','IR-9'),\n('002808','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 d','IR-9d','IR-9'),\n('002809','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 e','IR-9e','IR-9'),\n('002810','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 f','IR-9f','IR-9'),\n('002811','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 g','IR-9g','IR-9'),\n('002812','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 g','IR-9g','IR-9'),\n('002816','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (2)','IR-9(2)','IR-9'),\n('002817','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (2)','IR-9(2)','IR-9'),\n('002818','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (3)','IR-9(3)','IR-9'),\n('002819','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (3)','IR-9(3)','IR-9'),\n('002820','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (4)','IR-9(4)','IR-9'),\n('002821','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 (4)','IR-9(4)','IR-9'),\n('002823','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-16','SI-16','SI-16'),\n('002824','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-16','SI-16','SI-16'),\n('002825','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 a 1 (a)','CP-1a1(a)','CP-1'),\n('002826','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 a 2','CP-1a2','CP-1'),\n('002827','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (7)','CP-2(7)','CP-2'),\n('002828','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (8)','CP-2(8)','CP-2'),\n('002829','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 (8)','CP-2(8)','CP-2'),\n('002830','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 7','CP-2a7','CP-2'),\n('002831','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 f','CP-2f','CP-2'),\n('002832','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 h','CP-2h','CP-2'),\n('002833','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 a 1','CP-3a1','CP-3'),\n('002834','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 a 2','CP-3a2','CP-3'),\n('002835','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 (2) (b)','CP-4(2)(b)','CP-4'),\n('002836','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-6 b','CP-6b','CP-6'),\n('002837','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (6)','CP-7(6)','CP-7'),\n('002838','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 (6)','CP-7(6)','CP-7'),\n('002839','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-7 a','CP-7a','CP-7'),\n('002840','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8','CP-8','CP-8'),\n('002841','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8','CP-8','CP-8'),\n('002842','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (4) (b)','CP-8(4)(b)','CP-8'),\n('002843','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (4) (c)','CP-8(4)(c)','CP-8'),\n('002844','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (4) (c)','CP-8(4)(c)','CP-8'),\n('002845','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (4) (c)','CP-8(4)(c)','CP-8'),\n('002846','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (4) (c)','CP-8(4)(c)','CP-8'),\n('002847','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (5)','CP-8(5)','CP-8'),\n('002848','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (5)','CP-8(5)','CP-8'),\n('002849','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (3)','CP-9(3)','CP-9'),\n('002850','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (3)','CP-9(3)','CP-9'),\n('002851','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (7)','CP-9(7)','CP-9'),\n('002852','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (7)','CP-9(7)','CP-9'),\n('002853','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-11','CP-11','CP-11'),\n('002854','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-11','CP-11','CP-11'),\n('002855','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-12','CP-12','CP-12'),\n('002856','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-12','CP-12','CP-12'),\n('002857','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-12','CP-12','CP-12'),\n('002858','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-13','CP-13','CP-13'),\n('002859','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-13','CP-13','CP-13'),\n('002860','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-13','CP-13','CP-13'),\n('002861','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 a 1 (a)','MA-1a1(a)','MA-1'),\n('002862','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 a 2','MA-1a2','MA-1'),\n('002864','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 (2) (b)','MA-2(2)(b)','MA-2'),\n('002865','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 (2) (b)','MA-2(2)(b)','MA-2'),\n('002866','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a','MA-2'),\n('002868','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a','MA-2'),\n('002869','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a','MA-2'),\n('002870','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a','MA-2'),\n('002872','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a','MA-2'),\n('002873','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a','MA-2'),\n('002874','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 c','MA-2c','MA-2'),\n('002875','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 f','MA-2f','MA-2'),\n('002876','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 f','MA-2f','MA-2'),\n('002882','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (3) (d)','MA-3(3)(d)','MA-3'),\n('002883','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (4)','MA-3(4)','MA-3'),\n('002884','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (1) (a)','MA-4(1)(a)','MA-4'),\n('002885','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (1) (a)','MA-4(1)(a)','MA-4'),\n('002886','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (1) (b)','MA-4(1)(b)','MA-4'),\n('002887','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (4) (a)','MA-4(4)(a)','MA-4'),\n('002888','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (5) (a)','MA-4(5)(a)','MA-4'),\n('002889','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (5) (b)','MA-4(5)(b)','MA-4'),\n('002890','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (6)','MA-4(6)','MA-4'),\n('002891','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (7)','MA-4(7)','MA-4'),\n('002893','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (5)','MA-5(5)','MA-5'),\n('002894','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 b','MA-5b','MA-5'),\n('002895','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 c','MA-5c','MA-5'),\n('002896','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-6','MA-6','MA-6'),\n('002897','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-6','MA-6','MA-6'),\n('002898','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (1)','MA-6(1)','MA-6'),\n('002899','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (1)','MA-6(1)','MA-6'),\n('002900','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (1)','MA-6(1)','MA-6'),\n('002901','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (2)','MA-6(2)','MA-6'),\n('002902','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (2)','MA-6(2)','MA-6'),\n('002903','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (2)','MA-6(2)','MA-6'),\n('002904','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (3)','MA-6(3)','MA-6'),\n('002906','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (5)','RA-5(5)','RA-5'),\n('002907','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (4)','AU-5(4)','AU-5'),\n('002908','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 a 1','PE-1a1','PE-1'),\n('002909','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 a 2','PE-1a2','PE-1'),\n('002910','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 a','PE-2a','PE-2'),\n('002911','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 a','PE-2a','PE-2'),\n('002912','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 (2)','PE-2(2)','PE-2'),\n('002913','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 (3)','PE-2(3)','PE-2'),\n('002914','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-2 (3)','PE-2(3)','PE-2'),\n('002915','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 a','PE-3a','PE-3'),\n('002916','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 a 2','PE-3a2','PE-3'),\n('002917','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 b','PE-3b','PE-3'),\n('002918','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 b','PE-3b','PE-3'),\n('002919','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 c','PE-3c','PE-3'),\n('002920','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 c','PE-3c','PE-3'),\n('002921','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 d','PE-3d','PE-3'),\n('002922','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 d','PE-3d','PE-3'),\n('002923','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 d','PE-3d','PE-3'),\n('002924','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 d','PE-3d','PE-3'),\n('002925','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 f','PE-3f','PE-3'),\n('002926','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (1)','PE-3(1)','PE-3'),\n('002927','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (2)','PE-3(2)','PE-3'),\n('002928','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (5)','PE-3(5)','PE-3'),\n('002929','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (5)','PE-3(5)','PE-3'),\n('002930','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-4','PE-4','PE-4'),\n('002931','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-4','PE-4','PE-4'),\n('002939','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 a','PE-6a','PE-6'),\n('002940','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 b','PE-6b','PE-6'),\n('002941','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 b','PE-6b','PE-6'),\n('002942','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (2)','PE-6(2)','PE-6'),\n('002943','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (2)','PE-6(2)','PE-6'),\n('002944','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (2)','PE-6(2)','PE-6'),\n('002945','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (2)','PE-6(2)','PE-6'),\n('002946','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (3) (a)','PE-6(3)(a)','PE-6'),\n('002947','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (3) (a)','PE-6(3)(a)','PE-6'),\n('002948','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (3) (c)','PE-6(3)(c)','PE-6'),\n('002949','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (3) (c)','PE-6(3)(c)','PE-6'),\n('002950','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (4)','PE-6(4)','PE-6'),\n('002951','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (4)','PE-6(4)','PE-6'),\n('002952','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 a','PE-8a','PE-8'),\n('002953','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-9 (1)','PE-9(1)','PE-9'),\n('002954','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-9 (1)','PE-9(1)','PE-9'),\n('002955','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-11','PE-11','PE-11'),\n('002956','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-11 (2) (a)','PE-11(2)(a)','PE-11'),\n('002957','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-11 (2) (b)','PE-11(2)(b)','PE-11'),\n('002958','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-11 (2) (c)','PE-11(2)(c)','PE-11'),\n('002959','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-12 (1)','PE-12(1)','PE-12'),\n('002960','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-12 (1)','PE-12(1)','PE-12'),\n('002961','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (1)','PE-13(1)','PE-13'),\n('002962','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (1)','PE-13(1)','PE-13'),\n('002963','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (1)','PE-13(1)','PE-13'),\n('002964','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (1)','PE-13(1)','PE-13'),\n('002965','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (2) (a)','PE-13(2)(a)','PE-13'),\n('002966','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (2) (a)','PE-13(2)(a)','PE-13'),\n('002967','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (2) (a)','PE-13(2)(a)','PE-13'),\n('002968','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (4)','PE-13(4)','PE-13'),\n('002969','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (4)','PE-13(4)','PE-13'),\n('002970','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (4)','PE-13(4)','PE-13'),\n('002971','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-13 (4)','PE-13(4)','PE-13'),\n('002973','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-15 (1)','PE-15(1)','PE-15'),\n('002974','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-16 a','PE-16a','PE-16'),\n('002975','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-17 b','PE-17b','PE-17'),\n('002976','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-18','PE-18','PE-18'),\n('002979','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-20','PE-20','PE-20'),\n('002980','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-20','PE-20','PE-20'),\n('002981','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-20','PE-20','PE-20'),\n('002982','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-20','PE-20','PE-20'),\n('002984','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 3','PM-1a3','PM-1'),\n('002985','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 1','PM-1a1','PM-1'),\n('002986','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 2','PM-1a2','PM-1'),\n('002987','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 3','PM-1a3','PM-1'),\n('002988','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 a 4','PM-1a4','PM-1'),\n('002989','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 c','PM-1c','PM-1'),\n('002990','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 c','PM-1c','PM-1'),\n('002991','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 1','PM-4a1','PM-4'),\n('002993','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 b','PM-4b','PM-4'),\n('002994','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-9 c','PM-9c','PM-9'),\n('002995','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-9 c','PM-9c','PM-9'),\n('002996','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-12','PM-12','PM-12'),\n('002997','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-13','PM-13','PM-13'),\n('002998','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a1','PM-14'),\n('002999','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a1','PM-14'),\n('003000','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a1','PM-14'),\n('003001','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a1','PM-14'),\n('003002','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a1','PM-14'),\n('003003','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a1','PM-14'),\n('003004','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 2','PM-14a2','PM-14'),\n('003005','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 2','PM-14a2','PM-14'),\n('003006','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 2','PM-14a2','PM-14'),\n('003007','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 b','PM-14b','PM-14'),\n('003008','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 b','PM-14b','PM-14'),\n('003009','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 b','PM-14b','PM-14'),\n('003010','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-15 a','PM-15a','PM-15'),\n('003011','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-15 b','PM-15b','PM-15'),\n('003012','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-15 c','PM-15c','PM-15'),\n('003013','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-16','PM-16','PM-16'),\n('003014','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3)','AC-3(3)','AC-3'),\n('003015','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (3) (c)','AC-3(3)(c)','AC-3'),\n('003017','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 a 1','PS-1a1','PS-1'),\n('003018','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 a 2','PS-1a2','PS-1'),\n('003019','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 (3) (a)','PS-3(3)(a)','PS-3'),\n('003020','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 (3) (b)','PS-3(3)(b)','PS-3'),\n('003021','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 (3) (b)','PS-3(3)(b)','PS-3'),\n('003022','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 a','PS-4a','PS-4'),\n('003023','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 b','PS-4b','PS-4'),\n('003024','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 c','PS-4c','PS-4'),\n('003027','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 (1) (a)','PS-4(1)(a)','PS-4'),\n('003028','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 (1) (b)','PS-4(1)(b)','PS-4'),\n('003029','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 (2)','PS-4(2)','PS-4'),\n('003030','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 (2)','PS-4(2)','PS-4'),\n('003031','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 c','PS-5c','PS-5'),\n('003032','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 d','PS-5d','PS-5'),\n('003033','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 d','PS-5d','PS-5'),\n('003034','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-5 d','PS-5d','PS-5'),\n('003035','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 a','PS-6a','PS-6'),\n('003038','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 (3) (a)','PS-6(3)(a)','PS-6'),\n('003039','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 (3) (b)','PS-6(3)(b)','PS-6'),\n('003041','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 d','PS-7d','PS-7'),\n('003042','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 d','PS-7d','PS-7'),\n('003043','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 d','PS-7d','PS-7'),\n('003044','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-8 b','PS-8b','PS-8'),\n('003045','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-8 b','PS-8b','PS-8'),\n('003046','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-8 b','PS-8b','PS-8'),\n('003047','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 a 1 (a)','PL-1a1(a)','PL-1'),\n('003048','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 a 2','PL-1a2','PL-1'),\n('003049','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a','PL-2a','PL-2'),\n('003050','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 1','PL-2a1','PL-2'),\n('003051','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 2','PL-2a2','PL-2'),\n('003052','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 3','PL-2a3','PL-2'),\n('003053','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 6','PL-2a6','PL-2'),\n('003054','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 9','PL-2a9','PL-2'),\n('003055','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 10','PL-2a10','PL-2'),\n('003056','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 11','PL-2a11','PL-2'),\n('003057','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 12','PL-2a12','PL-2'),\n('003059','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 b','PL-2b','PL-2'),\n('003060','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 b','PL-2b','PL-2'),\n('003061','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 b','PL-2b','PL-2'),\n('003062','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 b','PL-2b','PL-2'),\n('003063','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 e','PL-2e','PL-2'),\n('003064','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 e','PL-2e','PL-2'),\n('003068','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 c','PL-4c','PL-4'),\n('003069','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 c','PL-4c','PL-4'),\n('003070','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 d','PL-4d','PL-4'),\n('003071','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-7 a','PL-7a','PL-7'),\n('003072','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 a','PL-8a','PL-8'),\n('003073','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 a 1','PL-8a1','PL-8'),\n('003074','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 a 3','PL-8a3','PL-8'),\n('003075','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 a 4','PL-8a4','PL-8'),\n('003076','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 b','PL-8b','PL-8'),\n('003077','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 b','PL-8b','PL-8'),\n('003078','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 c','PL-8c','PL-8'),\n('003079','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 c','PL-8c','PL-8'),\n('003080','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 c','PL-8c','PL-8'),\n('003081','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8(1)(a)','PL-8'),\n('003082','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8(1)(a)','PL-8'),\n('003083','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8(1)(a)','PL-8'),\n('003084','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8(1)(a)','PL-8'),\n('003085','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8(1)(a)','PL-8'),\n('003086','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8(1)(a)','PL-8'),\n('003087','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (b)','PL-8(1)(b)','PL-8'),\n('003088','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (2)','PL-8(2)','PL-8'),\n('003089','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 a 1 (a)','SA-1a1(a)','SA-1'),\n('003090','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 a 2','SA-1a2','SA-1'),\n('003091','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 a','SA-2a','SA-2'),\n('003092','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 a','SA-3a','SA-3'),\n('003093','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 d','SA-3d','SA-3'),\n('003094','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 a','SA-4a','SA-4'),\n('003095','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 b','SA-4b','SA-4'),\n('003096','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 c','SA-4c','SA-4'),\n('003097','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 e','SA-4e','SA-4'),\n('003098','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 f','SA-4f','SA-4'),\n('003099','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 g','SA-4g','SA-4'),\n('003100','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 i','SA-4i','SA-4'),\n('003101','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (2)','SA-4(2)','SA-4'),\n('003102','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (2)','SA-4(2)','SA-4'),\n('003103','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (2)','SA-4(2)','SA-4'),\n('003104','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (2)','SA-4(2)','SA-4'),\n('003105','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (2)','SA-4(2)','SA-4'),\n('003106','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (2)','SA-4(2)','SA-4'),\n('003109','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (5) (a)','SA-4(5)(a)','SA-4'),\n('003110','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (5) (a)','SA-4(5)(a)','SA-4'),\n('003111','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (5) (b)','SA-4(5)(b)','SA-4'),\n('003112','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (8)','SA-4(8)','SA-4'),\n('003114','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (9)','SA-4(9)','SA-4'),\n('003116','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (10)','SA-4(10)','SA-4'),\n('003117','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-9','PL-9','PL-9'),\n('003118','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-9','PL-9','PL-9'),\n('003119','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-6','RA-6','RA-6'),\n('003120','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-6','RA-6','RA-6'),\n('003121','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-6','RA-6','RA-6'),\n('003122','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-6','RA-6','RA-6'),\n('003123','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (6)','MA-4(6)','MA-4'),\n('003124','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 a 1','SA-5a1','SA-5'),\n('003125','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 a 1','SA-5a1','SA-5'),\n('003126','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 a 1','SA-5a1','SA-5'),\n('003127','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 a 2','SA-5a2','SA-5'),\n('003128','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 a 3','SA-5a3','SA-5'),\n('003129','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 b 1','SA-5b1','SA-5'),\n('003130','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 b 2','SA-5b2','SA-5'),\n('003131','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 b 3','SA-5b3','SA-5'),\n('003132','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 c','SA-5c','SA-5'),\n('003133','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 c','SA-5c','SA-5'),\n('003135','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 d','SA-5d','SA-5'),\n('003136','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 d','SA-5d','SA-5'),\n('003138','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 c','SA-9c','SA-9'),\n('003139','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 c','SA-9c','SA-9'),\n('003140','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (1) (a)','SA-9(1)(a)','SA-9'),\n('003141','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (1) (b)','SA-9(1)(b)','SA-9'),\n('003142','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (1) (b)','SA-9(1)(b)','SA-9'),\n('003143','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (2)','SA-9(2)','SA-9'),\n('003144','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (2)','SA-9(2)','SA-9'),\n('003145','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (3)','SA-9(3)','SA-9'),\n('003146','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (3)','SA-9(3)','SA-9'),\n('003147','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (3)','SA-9(3)','SA-9'),\n('003148','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (3)','SA-9(3)','SA-9'),\n('003149','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (4)','SA-9(4)','SA-9'),\n('003150','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (4)','SA-9(4)','SA-9'),\n('003151','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (4)','SA-9(4)','SA-9'),\n('003152','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (5)','SA-9(5)','SA-9'),\n('003153','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (5)','SA-9(5)','SA-9'),\n('003154','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (5)','SA-9(5)','SA-9'),\n('003155','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 a','SA-10a','SA-10'),\n('003156','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 b','SA-10b','SA-10'),\n('003157','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 b','SA-10b','SA-10'),\n('003158','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 b','SA-10b','SA-10'),\n('003159','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 b','SA-10b','SA-10'),\n('003160','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 d','SA-10d','SA-10'),\n('003161','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 e','SA-10e','SA-10'),\n('003162','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 e','SA-10e','SA-10'),\n('003163','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 e','SA-10e','SA-10'),\n('003164','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 e','SA-10e','SA-10'),\n('003165','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (3)','SA-10(3)','SA-10'),\n('003166','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (4)','SA-10(4)','SA-10'),\n('003167','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (4)','SA-10(4)','SA-10'),\n('003168','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (4)','SA-10(4)','SA-10'),\n('003169','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (5)','SA-10(5)','SA-10'),\n('003170','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (6)','SA-10(6)','SA-10'),\n('003171','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 a','SA-11a','SA-11'),\n('003172','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 a','SA-11a','SA-11'),\n('003173','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 b','SA-11b','SA-11'),\n('003174','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 b','SA-11b','SA-11'),\n('003175','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 c','SA-11c','SA-11'),\n('003176','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 c','SA-11c','SA-11'),\n('003177','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 d','SA-11d','SA-11'),\n('003178','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 e','SA-11e','SA-11'),\n('003179','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (1)','SA-11(1)','SA-11'),\n('003180','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (1)','SA-11(1)','SA-11'),\n('003181','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (2)','SA-11(2)','SA-11'),\n('003182','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (2)','SA-11(2)','SA-11'),\n('003183','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (3) (a)','SA-11(3)(a)','SA-11'),\n('003184','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (3) (a)','SA-11(3)(a)','SA-11'),\n('003185','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (3) (a)','SA-11(3)(a)','SA-11'),\n('003186','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (3) (b)','SA-11(3)(b)','SA-11'),\n('003187','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (4)','SA-11(4)','SA-11'),\n('003188','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (4)','SA-11(4)','SA-11'),\n('003189','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (4)','SA-11(4)','SA-11'),\n('003191','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (5) (a)','SA-11(5)(a)','SA-11'),\n('003192','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (5) (b)','SA-11(5)(b)','SA-11'),\n('003193','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (6)','SA-11(6)','SA-11'),\n('003194','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (7)','SA-11(7)','SA-11'),\n('003195','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (7)','SA-11(7)','SA-11'),\n('003196','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (8)','SA-11(8)','SA-11'),\n('003197','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (8)','SA-11(8)','SA-11'),\n('003233','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a','SA-15a','SA-15'),\n('003234','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 1','SA-15a1','SA-15'),\n('003235','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 2','SA-15a2','SA-15'),\n('003236','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 2','SA-15a2','SA-15'),\n('003237','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 3','SA-15a3','SA-15'),\n('003238','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 4','SA-15a4','SA-15'),\n('003239','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 4','SA-15a4','SA-15'),\n('003240','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 4','SA-15a4','SA-15'),\n('003241','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b','SA-15'),\n('003242','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b','SA-15'),\n('003243','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b','SA-15'),\n('003244','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b','SA-15'),\n('003245','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b','SA-15'),\n('003246','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b','SA-15'),\n('003247','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (1) (a)','SA-15(1)(a)','SA-15'),\n('003248','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (1) (b)','SA-15(1)(b)','SA-15'),\n('003249','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (1) (b)','SA-15(1)(b)','SA-15'),\n('003250','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (1) (b)','SA-15(1)(b)','SA-15'),\n('003251','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (2)','SA-15(2)','SA-15'),\n('003252','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (2)','SA-15(2)','SA-15'),\n('003254','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (3) (b)','SA-15(3)(b)','SA-15'),\n('003255','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (3) (a)','SA-15(3)(a)','SA-15'),\n('003272','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (5)','SA-15(5)','SA-15'),\n('003273','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (5)','SA-15(5)','SA-15'),\n('003274','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (6)','SA-15(6)','SA-15'),\n('003275','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (a)','SA-15(7)(a)','SA-15'),\n('003276','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (a)','SA-15(7)(a)','SA-15'),\n('003277','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (b)','SA-15(7)(b)','SA-15'),\n('003278','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (c)','SA-15(7)(c)','SA-15'),\n('003279','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (d)','SA-15(7)(d)','SA-15'),\n('003280','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (d)','SA-15(7)(d)','SA-15'),\n('003281','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (8)','SA-15(8)','SA-15'),\n('003282','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (8)','SA-15(8)','SA-15'),\n('003289','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (10)','SA-15(10)','SA-15'),\n('003290','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (11)','SA-15(11)','SA-15'),\n('003291','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-16','SA-16','SA-16'),\n('003292','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-16','SA-16','SA-16'),\n('003293','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17','SA-17','SA-17'),\n('003294','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 a','SA-17a','SA-17'),\n('003295','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 b','SA-17b','SA-17'),\n('003296','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 b','SA-17b','SA-17'),\n('003297','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 c','SA-17c','SA-17'),\n('003298','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (1) (a)','SA-17(1)(a)','SA-17'),\n('003299','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (1) (a)','SA-17(1)(a)','SA-17'),\n('003300','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (1) (b)','SA-17(1)(b)','SA-17'),\n('003301','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (2) (a)','SA-17(2)(a)','SA-17'),\n('003303','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (2) (a)','SA-17(2)(a)','SA-17'),\n('003304','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (2) (a)','SA-17(2)(a)','SA-17'),\n('003305','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (2) (b)','SA-17(2)(b)','SA-17'),\n('003306','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (2) (b)','SA-17(2)(b)','SA-17'),\n('003307','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (2) (b)','SA-17(2)(b)','SA-17'),\n('003308','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (a)','SA-17(3)(a)','SA-17'),\n('003309','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (a)','SA-17(3)(a)','SA-17'),\n('003310','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (a)','SA-17(3)(a)','SA-17'),\n('003311','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (b)','SA-17(3)(b)','SA-17'),\n('003312','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (c)','SA-17(3)(c)','SA-17'),\n('003313','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (c)','SA-17(3)(c)','SA-17'),\n('003314','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (c)','SA-17(3)(c)','SA-17'),\n('003315','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (d)','SA-17(3)(d)','SA-17'),\n('003316','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (d)','SA-17(3)(d)','SA-17'),\n('003317','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (d)','SA-17(3)(d)','SA-17'),\n('003318','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (e)','SA-17(3)(e)','SA-17'),\n('003319','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (e)','SA-17(3)(e)','SA-17'),\n('003320','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (3) (e)','SA-17(3)(e)','SA-17'),\n('003321','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (a)','SA-17(4)(a)','SA-17'),\n('003322','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (a)','SA-17(4)(a)','SA-17'),\n('003323','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (a)','SA-17(4)(a)','SA-17'),\n('003324','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (b)','SA-17(4)(b)','SA-17'),\n('003325','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (c)','SA-17(4)(c)','SA-17'),\n('003326','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (c)','SA-17(4)(c)','SA-17'),\n('003327','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (c)','SA-17(4)(c)','SA-17'),\n('003328','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (d)','SA-17(4)(d)','SA-17'),\n('003329','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (d)','SA-17(4)(d)','SA-17'),\n('003330','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (d)','SA-17(4)(d)','SA-17'),\n('003331','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (e)','SA-17(4)(e)','SA-17'),\n('003332','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (e)','SA-17(4)(e)','SA-17'),\n('003333','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (4) (e)','SA-17(4)(e)','SA-17'),\n('003334','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (5) (a)','SA-17(5)(a)','SA-17'),\n('003335','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (5) (a)','SA-17(5)(a)','SA-17'),\n('003336','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (5) (a)','SA-17(5)(a)','SA-17'),\n('003337','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (5) (b)','SA-17(5)(b)','SA-17'),\n('003338','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (5) (b)','SA-17(5)(b)','SA-17'),\n('003339','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (5) (b)','SA-17(5)(b)','SA-17'),\n('003340','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (6)','SA-17(6)','SA-17'),\n('003341','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (6)','SA-17(6)','SA-17'),\n('003342','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (6)','SA-17(6)','SA-17'),\n('003343','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (7)','SA-17(7)','SA-17'),\n('003344','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (7)','SA-17(7)','SA-17'),\n('003345','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (7)','SA-17(7)','SA-17'),\n('003372','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-22 b','SA-22b','SA-22'),\n('003373','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-22 b','SA-22b','SA-22'),\n('003376','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-22 a','SA-22a','SA-22'),\n('003381','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-21 b','SA-21b','SA-21'),\n('003382','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-21 b','SA-21b','SA-21'),\n('003383','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-21 a','SA-21a','SA-21'),\n('003384','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-21','SA-21','SA-21'),\n('003385','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-21 a','SA-21a','SA-21'),\n('003386','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-20','SA-20','SA-20'),\n('003387','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-20','SA-20','SA-20'),\n('003601','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 1 (b)','AC-1a1(b)','AC-1'),\n('003602','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 1 (a)','AC-1a1(a)','AC-1'),\n('003603','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 1 (b)','AC-1a1(b)','AC-1'),\n('003604','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 a 2','AC-1a2','AC-1'),\n('003605','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 b','AC-1b','AC-1'),\n('003606','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 b','AC-1b','AC-1'),\n('003607','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 b','AC-1b','AC-1'),\n('003608','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 c 1','AC-1c1','AC-1'),\n('003609','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 c 1','AC-1c1','AC-1'),\n('003610','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 c 2','AC-1c2','AC-1'),\n('003611','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-1 c 2','AC-1c2','AC-1'),\n('003612','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 a','AC-2a','AC-2'),\n('003613','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 c','AC-2c','AC-2'),\n('003614','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 c','AC-2c','AC-2'),\n('003615','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 c','AC-2c','AC-2'),\n('003616','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 d 3','AC-2d3','AC-2'),\n('003617','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 f','AC-2f','AC-2'),\n('003618','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 f','AC-2f','AC-2'),\n('003619','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 f','AC-2f','AC-2'),\n('003620','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 f','AC-2f','AC-2'),\n('003621','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 f','AC-2f','AC-2'),\n('003622','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 f','AC-2f','AC-2'),\n('003623','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 h','AC-2h','AC-2'),\n('003624','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 h','AC-2h','AC-2'),\n('003625','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 i 3','AC-2i3','AC-2'),\n('003626','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 l','AC-2l','AC-2'),\n('003627','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (3) (a)','AC-2(3)(a)','AC-2'),\n('003628','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (3) (b)','AC-2(3)(b)','AC-2'),\n('003629','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (3) (c)','AC-2(3)(c)','AC-2'),\n('003630','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (7) (c)','AC-2(7)(c)','AC-2'),\n('003631','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (8)','AC-2(8)','AC-2'),\n('003632','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (8)','AC-2(8)','AC-2'),\n('003633','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (8)','AC-2(8)','AC-2'),\n('003634','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (8)','AC-2(8)','AC-2'),\n('003635','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (8)','AC-2(8)','AC-2'),\n('003636','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (8)','AC-2(8)','AC-2'),\n('003637','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-2 (13)','AC-2(13)','AC-2'),\n('003638','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (4) (a)','AC-3(4)(a)','AC-3'),\n('003639','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (4) (b)','AC-3(4)(b)','AC-3'),\n('003640','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (4) (c)','AC-3(4)(c)','AC-3'),\n('003641','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (4) (d)','AC-3(4)(d)','AC-3'),\n('003642','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (4) (e)','AC-3(4)(e)','AC-3'),\n('003643','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (10)','AC-3(10)','AC-3'),\n('003644','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (11)','AC-3(11)','AC-3'),\n('003645','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (11)','AC-3(11)','AC-3'),\n('003646','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (12) (a)','AC-3(12)(a)','AC-3'),\n('003647','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (12) (a)','AC-3(12)(a)','AC-3'),\n('003648','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (12) (b)','AC-3(12)(b)','AC-3'),\n('003649','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (12) (c)','AC-3(12)(c)','AC-3'),\n('003650','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (13)','AC-3(13)','AC-3'),\n('003651','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (13)','AC-3(13)','AC-3'),\n('003652','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (13)','AC-3(13)','AC-3'),\n('003653','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (13)','AC-3(13)','AC-3'),\n('003654','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (14)','AC-3(14)','AC-3'),\n('003655','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (14)','AC-3(14)','AC-3'),\n('003656','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (14)','AC-3(14)','AC-3'),\n('003657','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (15) (a)','AC-3(15)(a)','AC-3'),\n('003658','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (15) (a)','AC-3(15)(a)','AC-3'),\n('003659','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (15) (b)','AC-3(15)(b)','AC-3'),\n('003660','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-3 (15) (b)','AC-3(15)(b)','AC-3'),\n('003661','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (1)','AC-4(1)','AC-4'),\n('003662','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (4)','AC-4(4)','AC-4'),\n('003663','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (8) (a)','AC-4(8)(a)','AC-4'),\n('003664','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (8) (b)','AC-4(8)(b)','AC-4'),\n('003665','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (8) (b)','AC-4(8)(b)','AC-4'),\n('003666','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (19)','AC-4(19)','AC-4'),\n('003667','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (23)','AC-4(23)','AC-4'),\n('003668','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (23)','AC-4(23)','AC-4'),\n('003669','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (24)','AC-4(24)','AC-4'),\n('003670','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (24)','AC-4(24)','AC-4'),\n('003671','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (25)','AC-4(25)','AC-4'),\n('003672','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (25)','AC-4(25)','AC-4'),\n('003673','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (26)','AC-4(26)','AC-4'),\n('003674','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (27)','AC-4(27)','AC-4'),\n('003675','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (28)','AC-4(28)','AC-4'),\n('003676','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (29) (a)','AC-4(29)(a)','AC-4'),\n('003677','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (29) (b)','AC-4(29)(b)','AC-4'),\n('003678','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (30)','AC-4(30)','AC-4'),\n('003679','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (31)','AC-4(31)','AC-4'),\n('003680','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (32) (a)','AC-4(32)(a)','AC-4'),\n('003681','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (32) (b)','AC-4(32)(b)','AC-4'),\n('003682','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (32) (c)','AC-4(32)(c)','AC-4'),\n('003683','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-4 (32) (d)','AC-4(32)(d)','AC-4'),\n('003684','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-5 a','AC-5a','AC-5'),\n('003685','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (1) (a)','AC-6(1)(a)','AC-6'),\n('003686','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-6 (1) (b)','AC-6(1)(b)','AC-6'),\n('003687','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 (3)','AC-7(3)','AC-7'),\n('003688','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 (3)','AC-7(3)','AC-7'),\n('003689','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 (4) (a)','AC-7(4)(a)','AC-7'),\n('003690','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 (4) (a)','AC-7(4)(a)','AC-7'),\n('003691','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 (4) (b)','AC-7(4)(b)','AC-7'),\n('003692','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-7 (4) (b)','AC-7(4)(b)','AC-7'),\n('003693','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-12 (3)','AC-12(3)','AC-12'),\n('003694','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-12 (3)','AC-12(3)','AC-12'),\n('003695','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-14 a','AC-14a','AC-14'),\n('003696','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('003697','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('003698','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('003699','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('003700','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('003701','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 a','AC-16a','AC-16'),\n('003702','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 b','AC-16b','AC-16'),\n('003703','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 b','AC-16b','AC-16'),\n('003704','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 c','AC-16c','AC-16'),\n('003705','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 c','AC-16c','AC-16'),\n('003706','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 d','AC-16d','AC-16'),\n('003707','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 e','AC-16e','AC-16'),\n('003708','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 f','AC-16f','AC-16'),\n('003709','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 f','AC-16f','AC-16'),\n('003710','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 f','AC-16f','AC-16'),\n('003711','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 f','AC-16f','AC-16'),\n('003712','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (1)','AC-16(1)','AC-16'),\n('003713','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (1)','AC-16(1)','AC-16'),\n('003714','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (1)','AC-16(1)','AC-16'),\n('003715','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (2)','AC-16(2)','AC-16'),\n('003716','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (2)','AC-16(2)','AC-16'),\n('003717','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16(3)','AC-16'),\n('003718','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16(3)','AC-16'),\n('003719','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16(3)','AC-16'),\n('003720','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16(3)','AC-16'),\n('003721','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (3)','AC-16(3)','AC-16'),\n('003722','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16(4)','AC-16'),\n('003723','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16(4)','AC-16'),\n('003724','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16(4)','AC-16'),\n('003725','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16(4)','AC-16'),\n('003726','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (4)','AC-16(4)','AC-16'),\n('003727','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (5)','AC-16(5)','AC-16'),\n('003728','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (5)','AC-16(5)','AC-16'),\n('003729','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (5)','AC-16(5)','AC-16'),\n('003730','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('003731','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('003732','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('003733','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('003734','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('003735','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('003736','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('003737','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (6)','AC-16(6)','AC-16'),\n('003738','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (7)','AC-16(7)','AC-16'),\n('003739','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (8)','AC-16(8)','AC-16'),\n('003740','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (8)','AC-16(8)','AC-16'),\n('003741','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (8)','AC-16(8)','AC-16'),\n('003742','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (9)','AC-16(9)','AC-16'),\n('003743','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (10)','AC-16(10)','AC-16'),\n('003744','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (10)','AC-16(10)','AC-16'),\n('003745','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (10)','AC-16(10)','AC-16'),\n('003746','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-16 (10)','AC-16(10)','AC-16'),\n('003747','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (10)','AC-17(10)','AC-17'),\n('003748','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (10)','AC-17(10)','AC-17'),\n('003749','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-17 (10)','AC-17(10)','AC-17'),\n('003750','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 a 1','AC-20a1','AC-20'),\n('003751','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 a 1','AC-20a1','AC-20'),\n('003752','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 a 2','AC-20a2','AC-20'),\n('003753','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 a 2','AC-20a2','AC-20'),\n('003754','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 b','AC-20b','AC-20'),\n('003755','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 b','AC-20b','AC-20'),\n('003756','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (1) (a)','AC-20(1)(a)','AC-20'),\n('003757','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (1) (a)','AC-20(1)(a)','AC-20'),\n('003758','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (2)','AC-20(2)','AC-20'),\n('003759','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-20 (5)','AC-20(5)','AC-20'),\n('003760','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AC-24 (2)','AC-24(2)','AC-24'),\n('003761','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 a 1 (b)','AT-1a1(b)','AT-1'),\n('003762','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 b','AT-1b','AT-1'),\n('003763','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 b','AT-1b','AT-1'),\n('003764','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 b','AT-1b','AT-1'),\n('003765','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-1 b','AT-1b','AT-1'),\n('003766','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 a 2','AT-2a2','AT-2'),\n('003767','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 b','AT-2b','AT-2'),\n('003768','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 b','AT-2b','AT-2'),\n('003769','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 b','AT-2b','AT-2'),\n('003770','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 c','AT-2c','AT-2'),\n('003771','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 c','AT-2c','AT-2'),\n('003772','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 c','AT-2c','AT-2'),\n('003773','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 c','AT-2c','AT-2'),\n('003774','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 d','AT-2d','AT-2'),\n('003775','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 (3)','AT-2(3)','AT-2'),\n('003776','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 (3)','AT-2(3)','AT-2'),\n('003777','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 (4)','AT-2(4)','AT-2'),\n('003778','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 (4)','AT-2(4)','AT-2'),\n('003779','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 (5)','AT-2(5)','AT-2'),\n('003780','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 (6) (a)','AT-2(6)(a)','AT-2'),\n('003781','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 (6) (b)','AT-2(6)(b)','AT-2'),\n('003782','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 a','AT-3a','AT-3'),\n('003783','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 a 1','AT-3a1','AT-3'),\n('003784','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 a 2','AT-3a2','AT-3'),\n('003785','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 b','AT-3b','AT-3'),\n('003786','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 b','AT-3b','AT-3'),\n('003787','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 b','AT-3b','AT-3'),\n('003788','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 b','AT-3b','AT-3'),\n('003789','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 c','AT-3c','AT-3'),\n('003790','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (3)','AT-3(3)','AT-3'),\n('003791','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (5)','AT-3(5)','AT-3'),\n('003792','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (5)','AT-3(5)','AT-3'),\n('003793','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-3 (5)','AT-3(5)','AT-3'),\n('003794','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-4 a','AT-4a','AT-4'),\n('003795','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-4 a','AT-4a','AT-4'),\n('003796','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-6','AT-6','AT-6'),\n('003797','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-6','AT-6','AT-6'),\n('003798','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-6','AT-6','AT-6'),\n('003799','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 a 1 (b)','AU-1a1(b)','AU-1'),\n('003800','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b','AU-1b','AU-1'),\n('003801','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b','AU-1b','AU-1'),\n('003802','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b','AU-1b','AU-1'),\n('003803','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b','AU-1b','AU-1'),\n('003804','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b','AU-1b','AU-1'),\n('003805','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 b','AU-1b','AU-1'),\n('003806','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 c 1','AU-1c1','AU-1'),\n('003807','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 c 1','AU-1c1','AU-1'),\n('003808','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 c 2','AU-1c2','AU-1'),\n('003809','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-1 c 2','AU-1c2','AU-1'),\n('003810','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 e','AU-2e','AU-2'),\n('003811','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-2 e','AU-2e','AU-2'),\n('003812','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 (3)','AU-3(3)','AU-3'),\n('003813','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-3 (3)','AU-3(3)','AU-3'),\n('003814','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 a','AU-5a','AU-5'),\n('003815','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (5)','AU-5(5)','AU-5'),\n('003816','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-5 (5)','AU-5(5)','AU-5'),\n('003817','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 a','AU-6a','AU-6'),\n('003818','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 c','AU-6c','AU-6'),\n('003819','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 c','AU-6c','AU-6'),\n('003820','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (1)','AU-6(1)','AU-6'),\n('003821','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-6 (4)','AU-6(4)','AU-6'),\n('003822','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a','AU-7'),\n('003823','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a','AU-7'),\n('003824','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a','AU-7'),\n('003825','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a','AU-7'),\n('003826','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a','AU-7'),\n('003827','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 a','AU-7a','AU-7'),\n('003828','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 b','AU-7b','AU-7'),\n('003829','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 b','AU-7b','AU-7'),\n('003830','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-7 (1)','AU-7(1)','AU-7'),\n('003831','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 b','AU-9b','AU-9'),\n('003832','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 b','AU-9b','AU-9'),\n('003833','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-9 (7)','AU-9(7)','AU-9'),\n('003834','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (3)','AU-12(3)','AU-12'),\n('003835','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (4)','AU-12(4)','AU-12'),\n('003836','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-12 (4)','AU-12(4)','AU-12'),\n('003837','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 b 1','AU-13b1','AU-13'),\n('003838','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 b 1','AU-13b1','AU-13'),\n('003839','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 b 2','AU-13b2','AU-13'),\n('003840','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 b 2','AU-13b2','AU-13'),\n('003841','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 (1)','AU-13(1)','AU-13'),\n('003842','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 (1)','AU-13(1)','AU-13'),\n('003843','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-13 (3)','AU-13(3)','AU-13'),\n('003844','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-14 a','AU-14a','AU-14'),\n('003845','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-14 a','AU-14a','AU-14'),\n('003846','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-14 a','AU-14a','AU-14'),\n('003847','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-14 b','AU-14b','AU-14'),\n('003848','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-14 (3)','AU-14(3)','AU-14'),\n('003849','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 1 (b)','CA-1a1(b)','CA-1'),\n('003850','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 a 2','CA-1a2','CA-1'),\n('003851','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 b','CA-1b','CA-1'),\n('003852','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 b','CA-1b','CA-1'),\n('003853','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 b','CA-1b','CA-1'),\n('003854','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 b','CA-1b','CA-1'),\n('003855','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 c 1','CA-1c1','CA-1'),\n('003856','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 c 1','CA-1c1','CA-1'),\n('003857','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 c 2','CA-1c2','CA-1'),\n('003858','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-1 c 2','CA-1c2','CA-1'),\n('003859','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 a','CA-2a','CA-2'),\n('003860','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 c','CA-2c','CA-2'),\n('003861','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-2 d','CA-2d','CA-2'),\n('003862','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 a','CA-3a','CA-3'),\n('003863','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 b','CA-3b','CA-3'),\n('003864','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (6)','CA-3(6)','CA-3'),\n('003865','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (7) (a)','CA-3(7)(a)','CA-3'),\n('003866','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-3 (7) (b)','CA-3(7)(b)','CA-3'),\n('003867','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-5 (1)','CA-5(1)','CA-5'),\n('003868','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-6 b','CA-6b','CA-6'),\n('003869','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-6 c 1','CA-6c1','CA-6'),\n('003870','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-6 d','CA-6d','CA-6'),\n('003871','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-6 (1)','CA-6(1)','CA-6'),\n('003872','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-6 (2)','CA-6(2)','CA-6'),\n('003873','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7','CA-7','CA-7'),\n('003874','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 a','CA-7a','CA-7'),\n('003875','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 b','CA-7b','CA-7'),\n('003876','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 b','CA-7b','CA-7'),\n('003877','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 b','CA-7b','CA-7'),\n('003878','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 c','CA-7c','CA-7'),\n('003879','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 g','CA-7g','CA-7'),\n('003880','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 g','CA-7g','CA-7'),\n('003881','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 (4) (a)','CA-7(4)(a)','CA-7'),\n('003882','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 (4) (b)','CA-7(4)(b)','CA-7'),\n('003883','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 (4) (c)','CA-7(4)(c)','CA-7'),\n('003884','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 (5)','CA-7(5)','CA-7'),\n('003885','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 (5)','CA-7(5)','CA-7'),\n('003886','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 (5)','CA-7(5)','CA-7'),\n('003887','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 (6)','CA-7(6)','CA-7'),\n('003888','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-7 (6)','CA-7(6)','CA-7'),\n('003889','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-8 (3)','CA-8(3)','CA-8'),\n('003890','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-8 (3)','CA-8(3)','CA-8'),\n('003891','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (b)','CA-9(b)','CA-9'),\n('003892','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (c)','CA-9(c)','CA-9'),\n('003893','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (c)','CA-9(c)','CA-9'),\n('003894','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (d)','CA-9(d)','CA-9'),\n('003895','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (d)','CA-9(d)','CA-9'),\n('003896','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CA-9 (1)','CA-9(1)','CA-9'),\n('003897','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 a 1 (b)','CM-1a1(b)','CM-1'),\n('003898','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 b','CM-1b','CM-1'),\n('003899','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 b','CM-1b','CM-1'),\n('003900','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 b','CM-1b','CM-1'),\n('003901','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 b','CM-1b','CM-1'),\n('003902','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 b','CM-1b','CM-1'),\n('003903','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 b','CM-1b','CM-1'),\n('003904','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 c 1','CM-1c1','CM-1'),\n('003905','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 c 1','CM-1c1','CM-1'),\n('003906','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 c 2','CM-1c2','CM-1'),\n('003907','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 c 2','CM-1c2','CM-1'),\n('003908','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-1 c 2','CM-1c2','CM-1'),\n('003909','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 a','CM-2a','CM-2'),\n('003910','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 b 3','CM-2b3','CM-2'),\n('003911','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-2 (2)','CM-2(2)','CM-2'),\n('003912','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 b','CM-3b','CM-3'),\n('003913','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (a)','CM-3(1)(a)','CM-3'),\n('003914','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (b)','CM-3(1)(b)','CM-3'),\n('003915','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (c)','CM-3(1)(c)','CM-3'),\n('003916','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (d)','CM-3(1)(d)','CM-3'),\n('003917','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (e)','CM-3(1)(e)','CM-3'),\n('003918','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (1) (f)','CM-3(1)(f)','CM-3'),\n('003919','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (3)','CM-3(3)','CM-3'),\n('003920','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (3)','CM-3(3)','CM-3'),\n('003921','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (4)','CM-3(4)','CM-3'),\n('003922','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (4)','CM-3(4)','CM-3'),\n('003923','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (4)','CM-3(4)','CM-3'),\n('003924','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (4)','CM-3(4)','CM-3'),\n('003925','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (7)','CM-3(7)','CM-3'),\n('003926','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (7)','CM-3(7)','CM-3'),\n('003927','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (7)','CM-3(7)','CM-3'),\n('003928','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (8)','CM-3(8)','CM-3'),\n('003929','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-3 (8)','CM-3(8)','CM-3'),\n('003930','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-4','CM-4','CM-4'),\n('003931','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-4 (1)','CM-4(1)','CM-4'),\n('003932','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-4 (2)','CM-4(2)','CM-4'),\n('003933','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-4 (2)','CM-4(2)','CM-4'),\n('003934','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-4 (2)','CM-4(2)','CM-4'),\n('003935','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5','CM-5','CM-5'),\n('003936','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5','CM-5','CM-5'),\n('003937','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (1) (a)','CM-5(1)(a)','CM-5'),\n('003938','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (1) (b)','CM-5(1)(b)','CM-5'),\n('003939','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (5) (b)','CM-5(5)(b)','CM-5'),\n('003940','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-5 (5) (b)','CM-5(5)(b)','CM-5'),\n('003941','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 a','CM-6a','CM-6'),\n('003942','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 a','CM-6a','CM-6'),\n('003943','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 d','CM-6d','CM-6'),\n('003944','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 d','CM-6d','CM-6'),\n('003945','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 d','CM-6d','CM-6'),\n('003946','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 d','CM-6d','CM-6'),\n('003947','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-6 (1)','CM-6(1)','CM-6'),\n('003948','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 a','CM-7a','CM-7'),\n('003949','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (6)','CM-7(6)','CM-7'),\n('003950','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (6)','CM-7(6)','CM-7'),\n('003951','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (7) (a)','CM-7(7)(a)','CM-7'),\n('003952','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (7) (a)','CM-7(7)(a)','CM-7'),\n('003953','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (7) (b)','CM-7(7)(b)','CM-7'),\n('003954','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (7) (b)','CM-7(7)(b)','CM-7'),\n('003955','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (8) (a)','CM-7(8)(a)','CM-7'),\n('003956','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (8) (b)','CM-7(8)(b)','CM-7'),\n('003957','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (9) (a)','CM-7(9)(a)','CM-7'),\n('003958','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (9) (a)','CM-7(9)(a)','CM-7'),\n('003959','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (9) (b)','CM-7(9)(b)','CM-7'),\n('003960','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (9) (c)','CM-7(9)(c)','CM-7'),\n('003961','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-7 (9) (c)','CM-7(9)(c)','CM-7'),\n('003962','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 1','CM-8a1','CM-8'),\n('003963','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 2','CM-8a2','CM-8'),\n('003964','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 3','CM-8a3','CM-8'),\n('003965','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 4','CM-8a4','CM-8'),\n('003966','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 4','CM-8a4','CM-8'),\n('003967','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 a 5','CM-8a5','CM-8'),\n('003968','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (2)','CM-8(2)','CM-8'),\n('003969','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (3) (a)','CM-8(3)(a)','CM-8'),\n('003970','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-8 (8)','CM-8(8)','CM-8'),\n('003971','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 a','CM-9a','CM-9'),\n('003972','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 a','CM-9a','CM-9'),\n('003973','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 b','CM-9b','CM-9'),\n('003974','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 b','CM-9b','CM-9'),\n('003975','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 c','CM-9c','CM-9'),\n('003976','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 c','CM-9c','CM-9'),\n('003977','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 d','CM-9d','CM-9'),\n('003978','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 d','CM-9d','CM-9'),\n('003979','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-9 d','CM-9d','CM-9'),\n('003980','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 (2)','CM-11(2)','CM-11'),\n('003981','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-11 (3)','CM-11(3)','CM-11'),\n('003982','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-12 a','CM-12a','CM-12'),\n('003983','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-12 a','CM-12a','CM-12'),\n('003984','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-12 a','CM-12a','CM-12'),\n('003985','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-12 b','CM-12b','CM-12'),\n('003986','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-12 b','CM-12b','CM-12'),\n('003987','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-12 c','CM-12c','CM-12'),\n('003988','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-12 (1)','CM-12(1)','CM-12'),\n('003989','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-12 (1)','CM-12(1)','CM-12'),\n('003990','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-12 (1)','CM-12(1)','CM-12'),\n('003991','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-13','CM-13','CM-13'),\n('003992','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-14','CM-14','CM-14'),\n('003993','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CM-14','CM-14','CM-14'),\n('003994','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 a 1 (b)','CP-1a1(b)','CP-1'),\n('003995','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 a 1 (b)','CP-1a1(b)','CP-1'),\n('003996','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 b','CP-1b','CP-1'),\n('003997','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 b','CP-1b','CP-1'),\n('003998','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 b','CP-1b','CP-1'),\n('003999','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 b','CP-1b','CP-1'),\n('004000','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 b','CP-1b','CP-1'),\n('004001','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 b','CP-1b','CP-1'),\n('004002','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 c 1','CP-1c1','CP-1'),\n('004003','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 c 1','CP-1c1','CP-1'),\n('004004','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 c 2','CP-1c2','CP-1'),\n('004005','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-1 c 2','CP-1c2','CP-1'),\n('004006','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 4','CP-2a4','CP-2'),\n('004007','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 4','CP-2a4','CP-2'),\n('004008','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 a 6','CP-2a6','CP-2'),\n('004009','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-2 g','CP-2g','CP-2'),\n('004010','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 b','CP-3b','CP-3'),\n('004011','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 b','CP-3b','CP-3'),\n('004012','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 b','CP-3b','CP-3'),\n('004013','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-3 b','CP-3b','CP-3'),\n('004014','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 (3)','CP-4(3)','CP-4'),\n('004015','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 (5)','CP-4(5)','CP-4'),\n('004016','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 (5)','CP-4(5)','CP-4'),\n('004017','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-4 (5)','CP-4(5)','CP-4'),\n('004018','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-6 a','CP-6a','CP-6'),\n('004019','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-8 (1) (b)','CP-8(1)(b)','CP-8'),\n('004020','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (a)','CP-9(a)','CP-9'),\n('004021','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (c)','CP-9(c)','CP-9'),\n('004022','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (d)','CP-9(d)','CP-9'),\n('004023','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (d)','CP-9(d)','CP-9'),\n('004024','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (d)','CP-9(d)','CP-9'),\n('004025','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (8)','CP-9(8)','CP-9'),\n('004026','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (8)','CP-9(8)','CP-9'),\n('004027','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-9 (8)','CP-9(8)','CP-9'),\n('004028','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-10','CP-10','CP-10'),\n('004029','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-10','CP-10','CP-10'),\n('004030','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','CP-10 (6)','CP-10(6)','CP-10'),\n('004031','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 a 1','IA-1a1','IA-1'),\n('004032','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 a 1 (a)','IA-1a1(a)','IA-1'),\n('004033','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 a 1 (b)','IA-1a1(b)','IA-1'),\n('004034','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 a 2','IA-1a2','IA-1'),\n('004035','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 b','IA-1b','IA-1'),\n('004036','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 b','IA-1b','IA-1'),\n('004037','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 b','IA-1b','IA-1'),\n('004038','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 b','IA-1b','IA-1'),\n('004039','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 b','IA-1b','IA-1'),\n('004040','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 b','IA-1b','IA-1'),\n('004041','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 c 1','IA-1c1','IA-1'),\n('004042','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 c 1','IA-1c1','IA-1'),\n('004043','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 c 2','IA-1c2','IA-1'),\n('004044','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-1 c 2','IA-1c2','IA-1'),\n('004045','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (5)','IA-2(5)','IA-2'),\n('004046','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (6) (a)','IA-2(6)(a)','IA-2'),\n('004047','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (6) (b)','IA-2(6)(b)','IA-2'),\n('004048','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-2 (6) (b)','IA-2(6)(b)','IA-2'),\n('004049','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (5)','IA-4(5)','IA-4'),\n('004050','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (8)','IA-4(8)','IA-4'),\n('004051','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (9)','IA-4(9)','IA-4'),\n('004052','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-4 (9)','IA-4(9)','IA-4'),\n('004053','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 d','IA-5d','IA-5'),\n('004054','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 d','IA-5d','IA-5'),\n('004055','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 e','IA-5e','IA-5'),\n('004056','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 f','IA-5f','IA-5'),\n('004057','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (a)','IA-5(1)(a)','IA-5'),\n('004058','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (a)','IA-5(1)(a)','IA-5'),\n('004059','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (a)','IA-5(1)(a)','IA-5'),\n('004060','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (a)','IA-5(1)(a)','IA-5'),\n('004061','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (b)','IA-5(1)(b)','IA-5'),\n('004062','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (d)','IA-5(1)(d)','IA-5'),\n('004063','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (e)','IA-5(1)(e)','IA-5'),\n('004064','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (f)','IA-5(1)(f)','IA-5'),\n('004065','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (g)','IA-5(1)(g)','IA-5'),\n('004066','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (h)','IA-5(1)(h)','IA-5'),\n('004067','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (1) (h)','IA-5(1)(h)','IA-5'),\n('004068','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (2) (b) (2)','IA-5(2)(b)(2)','IA-5'),\n('004069','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (7)','IA-5(7)','IA-5'),\n('004070','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (9)','IA-5(9)','IA-5'),\n('004071','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (9)','IA-5(9)','IA-5'),\n('004072','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (10)','IA-5(10)','IA-5'),\n('004073','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (15)','IA-5(15)','IA-5'),\n('004074','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (16)','IA-5(16)','IA-5'),\n('004075','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (16)','IA-5(16)','IA-5'),\n('004076','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (16)','IA-5(16)','IA-5'),\n('004077','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (16)','IA-5(16)','IA-5'),\n('004078','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (17)','IA-5(17)','IA-5'),\n('004079','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (18) (a)','IA-5(18)(a)','IA-5'),\n('004080','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (18) (a)','IA-5(18)(a)','IA-5'),\n('004081','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (18) (b)','IA-5(18)(b)','IA-5'),\n('004082','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-5 (18) (b)','IA-5(18)(b)','IA-5'),\n('004083','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (2) (a)','IA-8(2)(a)','IA-8'),\n('004084','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (2) (b)','IA-8(2)(b)','IA-8'),\n('004085','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (4)','IA-8(4)','IA-8'),\n('004086','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (4)','IA-8(4)','IA-8'),\n('004087','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (5)','IA-8(5)','IA-8'),\n('004088','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (6)','IA-8(6)','IA-8'),\n('004089','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (6)','IA-8(6)','IA-8'),\n('004090','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (6)','IA-8(6)','IA-8'),\n('004091','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-8 (6)','IA-8(6)','IA-8'),\n('004092','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 a','IA-12a','IA-12'),\n('004093','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 a','IA-12a','IA-12'),\n('004094','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 b','IA-12b','IA-12'),\n('004095','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 c','IA-12c','IA-12'),\n('004096','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 c','IA-12c','IA-12'),\n('004097','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 c','IA-12c','IA-12'),\n('004098','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 (1)','IA-12(1)','IA-12'),\n('004099','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 (2)','IA-12(2)','IA-12'),\n('004100','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 (3)','IA-12(3)','IA-12'),\n('004101','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 (3)','IA-12(3)','IA-12'),\n('004102','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 (3)','IA-12(3)','IA-12'),\n('004103','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 (3)','IA-12(3)','IA-12'),\n('004104','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 (4)','IA-12(4)','IA-12'),\n('004105','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 (4)','IA-12(4)','IA-12'),\n('004106','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 (5)','IA-12(5)','IA-12'),\n('004107','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 (6)','IA-12(6)','IA-12'),\n('004108','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-12 (6)','IA-12(6)','IA-12'),\n('004109','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 a 1 (b)','IR-1a1(b)','IR-1'),\n('004110','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 b','IR-1b','IR-1'),\n('004111','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 b','IR-1b','IR-1'),\n('004112','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 b','IR-1b','IR-1'),\n('004113','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 c 1','IR-1c1','IR-1'),\n('004114','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 c 1','IR-1c1','IR-1'),\n('004115','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 c 2','IR-1c2','IR-1'),\n('004116','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-1 c 2','IR-1c2','IR-1'),\n('004117','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 (2)','IR-2(2)','IR-2'),\n('004118','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 (3)','IR-2(3)','IR-2'),\n('004119','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (1)','IR-3(1)','IR-3'),\n('004120','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (3) (a)','IR-3(3)(a)','IR-3'),\n('004121','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (3) (a)','IR-3(3)(a)','IR-3'),\n('004122','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (3) (b)','IR-3(3)(b)','IR-3'),\n('004123','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (3) (b)','IR-3(3)(b)','IR-3'),\n('004124','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (3) (c)','IR-3(3)(c)','IR-3'),\n('004125','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (3) (c)','IR-3(3)(c)','IR-3'),\n('004126','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (3) (c)','IR-3(3)(c)','IR-3'),\n('004127','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (3) (c)','IR-3(3)(c)','IR-3'),\n('004128','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (3) (c)','IR-3(3)(c)','IR-3'),\n('004129','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-3 (3) (c)','IR-3(3)(c)','IR-3'),\n('004130','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 c','IR-4c','IR-4'),\n('004131','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 c','IR-4c','IR-4'),\n('004132','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 c','IR-4c','IR-4'),\n('004133','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 d','IR-4d','IR-4'),\n('004134','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 d','IR-4d','IR-4'),\n('004135','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 d','IR-4d','IR-4'),\n('004136','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 d','IR-4d','IR-4'),\n('004137','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (1)','IR-4(1)','IR-4'),\n('004138','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (2)','IR-4(2)','IR-4'),\n('004139','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (3)','IR-4(3)','IR-4'),\n('004140','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (3)','IR-4(3)','IR-4'),\n('004141','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (7)','IR-4(7)','IR-4'),\n('004142','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (7)','IR-4(7)','IR-4'),\n('004143','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (11)','IR-4(11)','IR-4'),\n('004144','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (11)','IR-4(11)','IR-4'),\n('004145','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (12)','IR-4(12)','IR-4'),\n('004146','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (13)','IR-4(13)','IR-4'),\n('004147','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (13)','IR-4(13)','IR-4'),\n('004148','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (14)','IR-4(14)','IR-4'),\n('004149','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (15) (a)','IR-4(15)(a)','IR-4'),\n('004150','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-4 (15) (b)','IR-4(15)(b)','IR-4'),\n('004151','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-5 (1)','IR-5(1)','IR-5'),\n('004152','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-5 (1)','IR-5(1)','IR-5'),\n('004153','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-5 (1)','IR-5(1)','IR-5'),\n('004154','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-5 (1)','IR-5(1)','IR-5'),\n('004155','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 (1)','IR-6(1)','IR-6'),\n('004156','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-6 (3)','IR-6(3)','IR-6'),\n('004157','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 8','IR-8a8','IR-8'),\n('004158','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 9','IR-8a9','IR-8'),\n('004159','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 a 10','IR-8a10','IR-8'),\n('004160','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 (1) (a)','IR-8(1)(a)','IR-8'),\n('004161','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 (1) (b)','IR-8(1)(b)','IR-8'),\n('004162','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-8 (1) (c)','IR-8(1)(c)','IR-8'),\n('004163','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 a','IR-9a','IR-9'),\n('004164','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-9 a','IR-9a','IR-9'),\n('004165','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 a 1 (b)','MA-1a1(b)','MA-1'),\n('004166','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 b','MA-1b','MA-1'),\n('004167','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 b','MA-1b','MA-1'),\n('004168','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 b','MA-1b','MA-1'),\n('004169','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 b','MA-1b','MA-1'),\n('004170','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 c 1','MA-1c1','MA-1'),\n('004171','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 c 1','MA-1c1','MA-1'),\n('004172','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 c 2','MA-1c2','MA-1'),\n('004173','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-1 c 2','MA-1c2','MA-1'),\n('004174','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a','MA-2'),\n('004175','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a','MA-2'),\n('004176','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 a','MA-2a','MA-2'),\n('004177','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 b','MA-2b','MA-2'),\n('004178','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 b','MA-2b','MA-2'),\n('004179','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 b','MA-2b','MA-2'),\n('004180','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 b','MA-2b','MA-2'),\n('004181','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 d','MA-2d','MA-2'),\n('004182','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 (2) (a)','MA-2(2)(a)','MA-2'),\n('004183','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 (2) (a)','MA-2(2)(a)','MA-2'),\n('004184','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 (2) (a)','MA-2(2)(a)','MA-2'),\n('004185','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-2 (2) (b)','MA-2(2)(b)','MA-2'),\n('004186','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 b','MA-3b','MA-3'),\n('004187','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 b','MA-3b','MA-3'),\n('004188','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (5)','MA-3(5)','MA-3'),\n('004189','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-3 (6)','MA-3(6)','MA-3'),\n('004190','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 e','MA-4e','MA-4'),\n('004191','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 e','MA-4e','MA-4'),\n('004192','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (4) (b) (2)','MA-4(4)(b)(2)','MA-4'),\n('004193','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-4 (6)','MA-4(6)','MA-4'),\n('004194','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (1) (b)','MA-5(1)(b)','MA-5'),\n('004195','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (1) (b)','MA-5(1)(b)','MA-5'),\n('004196','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-5 (1) (b)','MA-5(1)(b)','MA-5'),\n('004197','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-6 (3)','MA-6(3)','MA-6'),\n('004198','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-7','MA-7','MA-7'),\n('004199','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-7','MA-7','MA-7'),\n('004200','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MA-7','MA-7','MA-7'),\n('004201','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 a 1 (b)','MP-1a1(b)','MP-1'),\n('004202','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 b','MP-1b','MP-1'),\n('004203','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 b','MP-1b','MP-1'),\n('004204','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 b','MP-1b','MP-1'),\n('004205','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 b','MP-1b','MP-1'),\n('004206','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 b','MP-1b','MP-1'),\n('004207','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 c 1','MP-1c1','MP-1'),\n('004208','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 c 1','MP-1c1','MP-1'),\n('004209','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 c 2','MP-1c2','MP-1'),\n('004210','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-1 c 2','MP-1c2','MP-1'),\n('004211','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 a','MP-4a','MP-4'),\n('004212','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 a','MP-4a','MP-4'),\n('004213','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 b','MP-4b','MP-4'),\n('004214','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 b','MP-4b','MP-4'),\n('004215','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 b','MP-4b','MP-4'),\n('004216','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-4 (2)','MP-4(2)','MP-4'),\n('004217','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 a','MP-5a','MP-5'),\n('004218','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-5 a','MP-5a','MP-5'),\n('004219','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (2)','MP-6(2)','MP-6'),\n('004220','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-6 (2)','MP-6(2)','MP-6'),\n('004221','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 a','MP-8a','MP-8'),\n('004222','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 a','MP-8a','MP-8'),\n('004223','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 b','MP-8b','MP-8'),\n('004224','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 b','MP-8b','MP-8'),\n('004225','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 c','MP-8c','MP-8'),\n('004226','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 c','MP-8c','MP-8'),\n('004227','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 (2)','MP-8(2)','MP-8'),\n('004228','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','MP-8 (2)','MP-8(2)','MP-8'),\n('004229','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 a 1 (b)','PE-1a1(b)','PE-1'),\n('004230','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 b','PE-1b','PE-1'),\n('004231','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 b','PE-1b','PE-1'),\n('004232','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 b','PE-1b','PE-1'),\n('004233','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 b','PE-1b','PE-1'),\n('004234','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 b','PE-1b','PE-1'),\n('004235','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 b','PE-1b','PE-1'),\n('004236','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 c 1','PE-1c1','PE-1'),\n('004237','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 c 1','PE-1c1','PE-1'),\n('004238','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 c 2','PE-1c2','PE-1'),\n('004239','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-1 c 2','PE-1c2','PE-1'),\n('004240','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 a','PE-3a','PE-3'),\n('004241','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 a','PE-3a','PE-3'),\n('004242','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 a 2','PE-3a2','PE-3'),\n('004243','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 a 2','PE-3a2','PE-3'),\n('004244','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (7)','PE-3(7)','PE-3'),\n('004245','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (8)','PE-3(8)','PE-3'),\n('004246','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-3 (8)','PE-3(8)','PE-3'),\n('004247','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-5 (2)','PE-5(2)','PE-5'),\n('004248','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (2)','PE-6(2)','PE-6'),\n('004249','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (3) (b)','PE-6(3)(b)','PE-6'),\n('004250','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-6 (3) (b)','PE-6(3)(b)','PE-6'),\n('004251','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 c','PE-8c','PE-8'),\n('004252','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 c','PE-8c','PE-8'),\n('004253','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 (1)','PE-8(1)','PE-8'),\n('004254','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 (3)','PE-8(3)','PE-8'),\n('004255','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-8 (3)','PE-8(3)','PE-8'),\n('004256','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-10 a','PE-10a','PE-10'),\n('004257','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-14 (1)','PE-14(1)','PE-14'),\n('004258','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-14 (2)','PE-14(2)','PE-14'),\n('004259','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-15 (1)','PE-15(1)','PE-15'),\n('004260','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-15 (1)','PE-15(1)','PE-15'),\n('004261','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-15 (1)','PE-15(1)','PE-15'),\n('004262','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-17 a','PE-17a','PE-17'),\n('004263','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-17 d','PE-17d','PE-17'),\n('004264','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-19 (1)','PE-19(1)','PE-19'),\n('004265','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-19 (1)','PE-19(1)','PE-19'),\n('004266','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-21','PE-21','PE-21'),\n('004267','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-21','PE-21','PE-21'),\n('004268','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-21','PE-21','PE-21'),\n('004269','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-22','PE-22','PE-22'),\n('004270','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-22','PE-22','PE-22'),\n('004271','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-23 a','PE-23a','PE-23'),\n('004272','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PE-23 b','PE-23b','PE-23'),\n('004273','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 a 1 (b)','PL-1a1(b)','PL-1'),\n('004274','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 b','PL-1b','PL-1'),\n('004275','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 b','PL-1b','PL-1'),\n('004276','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 c 1','PL-1c1','PL-1'),\n('004277','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-1 c 2','PL-1c2','PL-1'),\n('004278','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 4','PL-2a4','PL-2'),\n('004279','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 5','PL-2a5','PL-2'),\n('004280','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 7','PL-2a7','PL-2'),\n('004281','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 8','PL-2a8','PL-2'),\n('004282','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 13','PL-2a13','PL-2'),\n('004283','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-2 a 14','PL-2a14','PL-2'),\n('004284','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 a','PL-4a','PL-4'),\n('004285','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 a','PL-4a','PL-4'),\n('004286','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 a','PL-4a','PL-4'),\n('004287','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 a','PL-4a','PL-4'),\n('004288','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 a','PL-4a','PL-4'),\n('004289','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 d','PL-4d','PL-4'),\n('004290','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-4 (1) (c)','PL-4(1)(c)','PL-4'),\n('004291','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-7 a','PL-7a','PL-7'),\n('004292','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 a','PL-8a','PL-8'),\n('004293','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 a 1','PL-8a1','PL-8'),\n('004294','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 a 2','PL-8a2','PL-8'),\n('004295','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 a 2','PL-8a2','PL-8'),\n('004296','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 a 3','PL-8a3','PL-8'),\n('004297','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 a 4','PL-8a4','PL-8'),\n('004298','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 c','PL-8c','PL-8'),\n('004299','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 c','PL-8c','PL-8'),\n('004300','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 c','PL-8c','PL-8'),\n('004301','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8(1)(a)','PL-8'),\n('004302','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8(1)(a)','PL-8'),\n('004303','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8(1)(a)','PL-8'),\n('004304','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8(1)(a)','PL-8'),\n('004305','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8(1)(a)','PL-8'),\n('004306','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (a)','PL-8(1)(a)','PL-8'),\n('004307','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (1) (b)','PL-8(1)(b)','PL-8'),\n('004308','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (2)','PL-8(2)','PL-8'),\n('004309','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-8 (2)','PL-8(2)','PL-8'),\n('004310','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-10','PL-10','PL-10'),\n('004311','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PL-11','PL-11','PL-11'),\n('004312','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 b','PM-1b','PM-1'),\n('004313','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-1 b','PM-1b','PM-1'),\n('004314','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-3 a','PM-3a','PM-3'),\n('004315','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-3 a','PM-3a','PM-3'),\n('004316','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-3 b','PM-3b','PM-3'),\n('004317','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-3 b','PM-3b','PM-3'),\n('004318','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-3 c','PM-3c','PM-3'),\n('004319','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 1','PM-4a1','PM-4'),\n('004320','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 1','PM-4a1','PM-4'),\n('004321','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 1','PM-4a1','PM-4'),\n('004322','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 1','PM-4a1','PM-4'),\n('004323','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 2','PM-4a2','PM-4'),\n('004324','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 2','PM-4a2','PM-4'),\n('004325','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 3','PM-4a3','PM-4'),\n('004326','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 3','PM-4a3','PM-4'),\n('004327','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-4 a 3','PM-4a3','PM-4'),\n('004328','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-5','PM-5','PM-5'),\n('004329','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-5','PM-5','PM-5'),\n('004330','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-5','PM-5','PM-5'),\n('004331','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-5 (1)','PM-5(1)','PM-5'),\n('004332','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-5 (1)','PM-5(1)','PM-5'),\n('004333','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-5 (1)','PM-5(1)','PM-5'),\n('004334','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-5 (1)','PM-5(1)','PM-5'),\n('004335','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-6','PM-6','PM-6'),\n('004336','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-6','PM-6','PM-6'),\n('004337','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-6','PM-6','PM-6'),\n('004338','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-7','PM-7','PM-7'),\n('004339','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-7','PM-7','PM-7'),\n('004340','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-7','PM-7','PM-7'),\n('004341','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-7 (1)','PM-7(1)','PM-7'),\n('004342','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-7 (1)','PM-7(1)','PM-7'),\n('004343','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-8','PM-8','PM-8'),\n('004344','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-8','PM-8','PM-8'),\n('004345','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-9 a 2','PM-9a2','PM-9'),\n('004346','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-10 a','PM-10a','PM-10'),\n('004347','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-10 a','PM-10a','PM-10'),\n('004348','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-11 a','PM-11a','PM-11'),\n('004349','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-11 b','PM-11b','PM-11'),\n('004350','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-11 c','PM-11c','PM-11'),\n('004351','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-11 c','PM-11c','PM-11'),\n('004352','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-13','PM-13','PM-13'),\n('004353','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a1','PM-14'),\n('004354','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a1','PM-14'),\n('004355','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a1','PM-14'),\n('004356','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a1','PM-14'),\n('004357','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a1','PM-14'),\n('004358','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 1','PM-14a1','PM-14'),\n('004359','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 2','PM-14a2','PM-14'),\n('004360','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 2','PM-14a2','PM-14'),\n('004361','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-14 a 2','PM-14a2','PM-14'),\n('004362','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-15 a','PM-15a','PM-15'),\n('004363','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-15 b','PM-15b','PM-15'),\n('004364','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-15 c','PM-15c','PM-15'),\n('004365','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-16 (1)','PM-16(1)','PM-16'),\n('004366','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-17 a','PM-17a','PM-17'),\n('004367','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-17 a','PM-17a','PM-17'),\n('004368','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-17 b','PM-17b','PM-17'),\n('004369','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-17 b','PM-17b','PM-17'),\n('004370','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-17 b','PM-17b','PM-17'),\n('004371','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-17 b','PM-17b','PM-17'),\n('004372','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a','PM-18a','PM-18'),\n('004373','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a','PM-18a','PM-18'),\n('004374','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 1','PM-18a1','PM-18'),\n('004375','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 1','PM-18a1','PM-18'),\n('004376','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 2','PM-18a2','PM-18'),\n('004377','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 2','PM-18a2','PM-18'),\n('004378','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 2','PM-18a2','PM-18'),\n('004379','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 2','PM-18a2','PM-18'),\n('004380','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 3','PM-18a3','PM-18'),\n('004381','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 3','PM-18a3','PM-18'),\n('004382','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 4','PM-18a4','PM-18'),\n('004383','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 4','PM-18a4','PM-18'),\n('004384','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 5','PM-18a5','PM-18'),\n('004385','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 5','PM-18a5','PM-18'),\n('004386','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 6','PM-18a6','PM-18'),\n('004387','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 6','PM-18a6','PM-18'),\n('004388','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 a 6','PM-18a6','PM-18'),\n('004389','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-18 b','PM-18b','PM-18'),\n('004390','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-19','PM-19','PM-19'),\n('004391','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-19','PM-19','PM-19'),\n('004392','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-19','PM-19','PM-19'),\n('004393','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-19','PM-19','PM-19'),\n('004394','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-20','PM-20','PM-20'),\n('004395','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-20 a','PM-20a','PM-20'),\n('004396','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-20 a','PM-20a','PM-20'),\n('004397','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-20 b','PM-20b','PM-20'),\n('004398','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-20 c','PM-20c','PM-20'),\n('004399','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-20 (1) (a)','PM-20(1)(a)','PM-20'),\n('004400','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-20 (1) (a)','PM-20(1)(a)','PM-20'),\n('004401','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-20 (1) (b)','PM-20(1)(b)','PM-20'),\n('004402','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-20 (1) (c)','PM-20(1)(c)','PM-20'),\n('004403','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-20 (1) (c)','PM-20(1)(c)','PM-20'),\n('004404','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-21 a','PM-21a','PM-21'),\n('004405','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-21 a','PM-21a','PM-21'),\n('004406','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-21 a 1','PM-21a1','PM-21'),\n('004407','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-21 a 1','PM-21a1','PM-21'),\n('004408','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-21 a 2','PM-21a2','PM-21'),\n('004409','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-21 a 2','PM-21a2','PM-21'),\n('004410','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-21 b','PM-21b','PM-21'),\n('004411','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-21 c','PM-21c','PM-21'),\n('004412','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-22 a','PM-22a','PM-22'),\n('004413','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-22 a','PM-22a','PM-22'),\n('004414','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-22 b','PM-22b','PM-22'),\n('004415','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-22 b','PM-22b','PM-22'),\n('004416','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-22 c','PM-22c','PM-22'),\n('004417','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-22 c','PM-22c','PM-22'),\n('004418','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-22 d','PM-22d','PM-22'),\n('004419','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-22 d','PM-22d','PM-22'),\n('004420','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-23','PM-23','PM-23'),\n('004421','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-23','PM-23','PM-23'),\n('004422','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-23','PM-23','PM-23'),\n('004423','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-24 a','PM-24a','PM-24'),\n('004424','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-24 b','PM-24b','PM-24'),\n('004425','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-25 a','PM-25a','PM-25'),\n('004426','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-25 a','PM-25a','PM-25'),\n('004427','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-25 a','PM-25a','PM-25'),\n('004428','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-25 a','PM-25a','PM-25'),\n('004429','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-25 b','PM-25b','PM-25'),\n('004430','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-25 c','PM-25c','PM-25'),\n('004431','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-25 d','PM-25d','PM-25'),\n('004432','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-25 d','PM-25d','PM-25'),\n('004433','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-25 d','PM-25d','PM-25'),\n('004434','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-25 d','PM-25d','PM-25'),\n('004435','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-26','PM-26','PM-26'),\n('004436','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-26','PM-26','PM-26'),\n('004437','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-26 a','PM-26a','PM-26'),\n('004438','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-26 a','PM-26a','PM-26'),\n('004439','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-26 b','PM-26b','PM-26'),\n('004440','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-26 c','PM-26c','PM-26'),\n('004441','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-26 c','PM-26c','PM-26'),\n('004442','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-26 d','PM-26d','PM-26'),\n('004443','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-26 d','PM-26d','PM-26'),\n('004444','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-26 e','PM-26e','PM-26'),\n('004445','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-26 e','PM-26e','PM-26'),\n('004446','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-27','PM-27','PM-27'),\n('004447','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-27','PM-27','PM-27'),\n('004448','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-27 a 1','PM-27a1','PM-27'),\n('004449','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-27 a 2','PM-27a2','PM-27'),\n('004450','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-27 a 2','PM-27a2','PM-27'),\n('004451','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-27 a 2','PM-27a2','PM-27'),\n('004452','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-27 b','PM-27b','PM-27'),\n('004453','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-27 b','PM-27b','PM-27'),\n('004454','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-28 a 1','PM-28a1','PM-28'),\n('004455','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-28 a 2','PM-28a2','PM-28'),\n('004456','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-28 a 3','PM-28a3','PM-28'),\n('004457','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-28 a 4','PM-28a4','PM-28'),\n('004458','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-28 b','PM-28b','PM-28'),\n('004459','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-28 b','PM-28b','PM-28'),\n('004460','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-28 c','PM-28c','PM-28'),\n('004461','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-28 c','PM-28c','PM-28'),\n('004462','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-29 a','PM-29a','PM-29'),\n('004463','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-29 a','PM-29a','PM-29'),\n('004464','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-29 b','PM-29b','PM-29'),\n('004465','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-29 b','PM-29b','PM-29'),\n('004466','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-30 a','PM-30a','PM-30'),\n('004467','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-30 a','PM-30a','PM-30'),\n('004468','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-30 a','PM-30a','PM-30'),\n('004469','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-30 a','PM-30a','PM-30'),\n('004470','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-30 b','PM-30b','PM-30'),\n('004471','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-30 c','PM-30c','PM-30'),\n('004472','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-30 c','PM-30c','PM-30'),\n('004473','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 a','PM-31a','PM-31'),\n('004474','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 a','PM-31a','PM-31'),\n('004475','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 a','PM-31a','PM-31'),\n('004476','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 b','PM-31b','PM-31'),\n('004477','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 b','PM-31b','PM-31'),\n('004478','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 b','PM-31b','PM-31'),\n('004479','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 b','PM-31b','PM-31'),\n('004480','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 b','PM-31b','PM-31'),\n('004481','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 b','PM-31b','PM-31'),\n('004482','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 c','PM-31c','PM-31'),\n('004483','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 c','PM-31c','PM-31'),\n('004484','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 d','PM-31d','PM-31'),\n('004485','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 d','PM-31d','PM-31'),\n('004486','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 e','PM-31e','PM-31'),\n('004487','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 e','PM-31e','PM-31'),\n('004488','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 f','PM-31f','PM-31'),\n('004489','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 f','PM-31f','PM-31'),\n('004490','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 f','PM-31f','PM-31'),\n('004491','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 f','PM-31f','PM-31'),\n('004492','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 f','PM-31f','PM-31'),\n('004493','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 f','PM-31f','PM-31'),\n('004494','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 f','PM-31f','PM-31'),\n('004495','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-31 f','PM-31f','PM-31'),\n('004496','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-32','PM-32','PM-32'),\n('004497','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-32','PM-32','PM-32'),\n('004498','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 a 1 (b)','PS-1a1(b)','PS-1'),\n('004499','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 b','PS-1b','PS-1'),\n('004500','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 b','PS-1b','PS-1'),\n('004501','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 b','PS-1b','PS-1'),\n('004502','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 b','PS-1b','PS-1'),\n('004503','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 b','PS-1b','PS-1'),\n('004504','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 b','PS-1b','PS-1'),\n('004505','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 c 1','PS-1c1','PS-1'),\n('004506','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 c 1','PS-1c1','PS-1'),\n('004507','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 c 2','PS-1c2','PS-1'),\n('004508','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-1 c 2','PS-1c2','PS-1'),\n('004509','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 (4)','PS-3(4)','PS-3'),\n('004510','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 (4)','PS-3(4)','PS-3'),\n('004511','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-3 (4)','PS-3(4)','PS-3'),\n('004512','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-4 (2)','PS-4(2)','PS-4'),\n('004513','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 c 1','PS-6c1','PS-6'),\n('004514','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 c 1','PS-6c1','PS-6'),\n('004515','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 c 2','PS-6c2','PS-6'),\n('004516','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 c 2','PS-6c2','PS-6'),\n('004517','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 c 2','PS-6c2','PS-6'),\n('004518','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-6 c 2','PS-6c2','PS-6'),\n('004519','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 b','PS-7b','PS-7'),\n('004520','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-7 b','PS-7b','PS-7'),\n('004521','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-8 a','PS-8a','PS-8'),\n('004522','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-8 a','PS-8a','PS-8'),\n('004523','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-9','PS-9','PS-9'),\n('004524','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PS-9','PS-9','PS-9'),\n('004525','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-1 a 1 (a)','PT-1a1(a)','PT-1'),\n('004526','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-1 a','PT-1a','PT-1'),\n('004527','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-1 a','PT-1a','PT-1'),\n('004528','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-1 a 1 (b)','PT-1a1(b)','PT-1'),\n('004529','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-1 a 2','PT-1a2','PT-1'),\n('004530','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-1 b','PT-1b','PT-1'),\n('004531','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-1 b','PT-1b','PT-1'),\n('004532','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-1 b','PT-1b','PT-1'),\n('004533','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-1 c 1','PT-1c1','PT-1'),\n('004534','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-1 c 1','PT-1c1','PT-1'),\n('004535','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-1 c 1','PT-1c1','PT-1'),\n('004536','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-1 c 2','PT-1c2','PT-1'),\n('004537','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-1 c 2','PT-1c2','PT-1'),\n('004538','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-1 c 2','PT-1c2','PT-1'),\n('004539','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-2 a','PT-2a','PT-2'),\n('004540','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-2 a','PT-2a','PT-2'),\n('004541','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-2 a','PT-2a','PT-2'),\n('004542','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-2 b','PT-2b','PT-2'),\n('004543','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-2 b','PT-2b','PT-2'),\n('004544','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-2 (1)','PT-2(1)','PT-2'),\n('004545','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-2 (1)','PT-2(1)','PT-2'),\n('004546','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-2 (1)','PT-2(1)','PT-2'),\n('004547','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-2 (2)','PT-2(2)','PT-2'),\n('004548','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-2 (2)','PT-2(2)','PT-2'),\n('004549','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-3 a','PT-3a','PT-3'),\n('004550','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-3 a','PT-3a','PT-3'),\n('004551','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-3 b','PT-3b','PT-3'),\n('004552','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-3 c','PT-3c','PT-3'),\n('004553','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-3 c','PT-3c','PT-3'),\n('004554','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-3 d','PT-3d','PT-3'),\n('004555','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-3 d','PT-3d','PT-3'),\n('004556','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-3 d','PT-3d','PT-3'),\n('004557','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-3 d','PT-3d','PT-3'),\n('004558','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-3 (1)','PT-3(1)','PT-3'),\n('004559','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-3 (1)','PT-3(1)','PT-3'),\n('004560','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-3 (2)','PT-3(2)','PT-3'),\n('004561','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-4','PT-4','PT-4'),\n('004562','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-4','PT-4','PT-4'),\n('004563','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-4 (1)','PT-4(1)','PT-4'),\n('004564','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-4 (1)','PT-4(1)','PT-4'),\n('004565','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-4 (2)','PT-4(2)','PT-4'),\n('004566','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-4 (2)','PT-4(2)','PT-4'),\n('004567','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-4 (2)','PT-4(2)','PT-4'),\n('004568','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-4 (2)','PT-4(2)','PT-4'),\n('004569','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-4 (3)','PT-4(3)','PT-4'),\n('004570','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-4 (3)','PT-4(3)','PT-4'),\n('004571','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-5 a','PT-5a','PT-5'),\n('004572','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-5 a','PT-5a','PT-5'),\n('004573','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-5 b','PT-5b','PT-5'),\n('004574','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-5 c','PT-5c','PT-5'),\n('004575','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-5 d','PT-5d','PT-5'),\n('004576','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-5 e','PT-5e','PT-5'),\n('004577','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-5 e','PT-5e','PT-5'),\n('004578','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-5 (1)','PT-5(1)','PT-5'),\n('004579','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-5 (1)','PT-5(1)','PT-5'),\n('004580','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-5 (2)','PT-5(2)','PT-5'),\n('004581','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-6 a','PT-6a','PT-6'),\n('004582','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-6 a','PT-6a','PT-6'),\n('004583','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-6 b','PT-6b','PT-6'),\n('004584','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-6 c','PT-6c','PT-6'),\n('004585','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-6 (1)','PT-6(1)','PT-6'),\n('004586','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-6 (1)','PT-6(1)','PT-6'),\n('004587','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-6 (1)','PT-6(1)','PT-6'),\n('004588','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-6 (2)','PT-6(2)','PT-6'),\n('004589','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-6 (2)','PT-6(2)','PT-6'),\n('004590','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-6 (2)','PT-6(2)','PT-6'),\n('004591','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-6 (2)','PT-6(2)','PT-6'),\n('004592','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-7','PT-7','PT-7'),\n('004593','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-7','PT-7','PT-7'),\n('004594','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-7 (1) (a)','PT-7(1)(a)','PT-7'),\n('004595','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-7 (1) (b)','PT-7(1)(b)','PT-7'),\n('004596','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-7 (1) (c)','PT-7(1)(c)','PT-7'),\n('004597','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-7 (2)','PT-7(2)','PT-7'),\n('004598','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-8 a','PT-8a','PT-8'),\n('004599','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-8 b','PT-8b','PT-8'),\n('004600','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-8 c','PT-8c','PT-8'),\n('004601','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-8 d','PT-8d','PT-8'),\n('004602','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PT-8 e','PT-8e','PT-8'),\n('004603','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 a 1 (b)','RA-1a1(b)','RA-1'),\n('004604','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 a 1 (b)','RA-1a1(b)','RA-1'),\n('004605','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 b','RA-1b','RA-1'),\n('004606','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 b','RA-1b','RA-1'),\n('004607','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 b','RA-1b','RA-1'),\n('004608','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 b','RA-1b','RA-1'),\n('004609','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 b','RA-1b','RA-1'),\n('004610','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 c 1','RA-1c1','RA-1'),\n('004611','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 c 1','RA-1c1','RA-1'),\n('004612','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 c 2','RA-1c2','RA-1'),\n('004613','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-1 c 2','RA-1c2','RA-1'),\n('004614','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-2 a','RA-2a','RA-2'),\n('004615','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-2 a','RA-2a','RA-2'),\n('004616','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-2 a','RA-2a','RA-2'),\n('004617','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-2 (1)','RA-2(1)','RA-2'),\n('004618','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 a 1','RA-3a1','RA-3'),\n('004619','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 a 1','RA-3a1','RA-3'),\n('004620','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 a 3','RA-3a3','RA-3'),\n('004621','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 b','RA-3b','RA-3'),\n('004622','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 b','RA-3b','RA-3'),\n('004623','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 b','RA-3b','RA-3'),\n('004624','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 (1) (a)','RA-3(1)(a)','RA-3'),\n('004625','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 (1) (a)','RA-3(1)(a)','RA-3'),\n('004626','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 (1) (b)','RA-3(1)(b)','RA-3'),\n('004627','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 (1) (b)','RA-3(1)(b)','RA-3'),\n('004628','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 (2)','RA-3(2)','RA-3'),\n('004629','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 (3)','RA-3(3)','RA-3'),\n('004630','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 (3)','RA-3(3)','RA-3'),\n('004631','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 (4)','RA-3(4)','RA-3'),\n('004632','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 (4)','RA-3(4)','RA-3'),\n('004633','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-3 (4)','RA-3(4)','RA-3'),\n('004634','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 b 2','RA-5b2','RA-5'),\n('004635','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 b 3','RA-5b3','RA-5'),\n('004636','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 f','RA-5f','RA-5'),\n('004637','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (6)','RA-5(6)','RA-5'),\n('004638','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (8)','RA-5(8)','RA-5'),\n('004639','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (8)','RA-5(8)','RA-5'),\n('004640','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-5 (11)','RA-5(11)','RA-5'),\n('004641','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-7','RA-7','RA-7'),\n('004642','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-7','RA-7','RA-7'),\n('004643','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-7','RA-7','RA-7'),\n('004644','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-7','RA-7','RA-7'),\n('004645','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-8 a','RA-8a','RA-8'),\n('004646','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-8 b 1','RA-8b1','RA-8'),\n('004647','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-8 b 2','RA-8b2','RA-8'),\n('004648','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-9','RA-9','RA-9'),\n('004649','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-9','RA-9','RA-9'),\n('004650','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-9','RA-9','RA-9'),\n('004651','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-10 a 1','RA-10a1','RA-10'),\n('004652','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-10 a 2','RA-10a2','RA-10'),\n('004653','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-10 b','RA-10b','RA-10'),\n('004654','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','RA-10 b','RA-10b','RA-10'),\n('004655','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 a 1 (b)','SA-1a1(b)','SA-1'),\n('004656','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 b','SA-1b','SA-1'),\n('004657','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 b','SA-1b','SA-1'),\n('004658','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 b','SA-1b','SA-1'),\n('004659','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 b','SA-1b','SA-1'),\n('004660','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 b','SA-1b','SA-1'),\n('004661','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 b','SA-1b','SA-1'),\n('004662','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 c 1','SA-1c1','SA-1'),\n('004663','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 c 1','SA-1c1','SA-1'),\n('004664','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 c 2','SA-1c2','SA-1'),\n('004665','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-1 c 2','SA-1c2','SA-1'),\n('004666','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 a','SA-2a','SA-2'),\n('004667','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 c','SA-2c','SA-2'),\n('004668','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-2 c','SA-2c','SA-2'),\n('004669','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 a','SA-3a','SA-3'),\n('004670','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 a','SA-3a','SA-3'),\n('004671','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 a','SA-3a','SA-3'),\n('004672','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 a','SA-3a','SA-3'),\n('004673','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 a','SA-3a','SA-3'),\n('004674','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 a','SA-3a','SA-3'),\n('004675','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 a','SA-3a','SA-3'),\n('004676','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 b','SA-3b','SA-3'),\n('004677','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 c','SA-3c','SA-3'),\n('004678','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 d','SA-3d','SA-3'),\n('004679','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 (1)','SA-3(1)','SA-3'),\n('004680','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 (2) (a)','SA-3(2)(a)','SA-3'),\n('004681','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 (2) (a)','SA-3(2)(a)','SA-3'),\n('004682','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 (2) (a)','SA-3(2)(a)','SA-3'),\n('004683','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 (2) (b)','SA-3(2)(b)','SA-3'),\n('004684','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 (3)','SA-3(3)','SA-3'),\n('004685','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-3 (3)','SA-3(3)','SA-3'),\n('004686','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4','SA-4','SA-4'),\n('004687','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 a','SA-4a','SA-4'),\n('004688','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 c','SA-4c','SA-4'),\n('004689','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 d','SA-4d','SA-4'),\n('004690','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 d','SA-4d','SA-4'),\n('004691','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 e','SA-4e','SA-4'),\n('004692','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 f','SA-4f','SA-4'),\n('004693','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 f','SA-4f','SA-4'),\n('004694','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 h','SA-4h','SA-4'),\n('004695','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 h','SA-4h','SA-4'),\n('004696','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 h','SA-4h','SA-4'),\n('004697','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (3) (a)','SA-4(3)(a)','SA-4'),\n('004698','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (3) (a)','SA-4(3)(a)','SA-4'),\n('004699','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (3) (b)','SA-4(3)(b)','SA-4'),\n('004700','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (3) (b)','SA-4(3)(b)','SA-4'),\n('004701','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (3) (c)','SA-4(3)(c)','SA-4'),\n('004702','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (3) (c)','SA-4(3)(c)','SA-4'),\n('004703','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (11)','SA-4(11)','SA-4'),\n('004704','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (11)','SA-4(11)','SA-4'),\n('004705','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (12) (a)','SA-4(12)(a)','SA-4'),\n('004706','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (12) (b)','SA-4(12)(b)','SA-4'),\n('004707','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-4 (12) (b)','SA-4(12)(b)','SA-4'),\n('004708','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 a 2','SA-5a2','SA-5'),\n('004709','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 b 1','SA-5b1','SA-5'),\n('004710','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 b 2','SA-5b2','SA-5'),\n('004711','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-5 b 3','SA-5b3','SA-5'),\n('004712','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n('004713','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n('004714','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n('004715','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n('004716','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8','SA-8','SA-8'),\n('004717','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (1)','SA-8(1)','SA-8'),\n('004718','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (2)','SA-8(2)','SA-8'),\n('004719','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (2)','SA-8(2)','SA-8'),\n('004720','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (3)','SA-8(3)','SA-8'),\n('004721','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (3)','SA-8(3)','SA-8'),\n('004722','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (4)','SA-8(4)','SA-8'),\n('004723','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (4)','SA-8(4)','SA-8'),\n('004724','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (5)','SA-8(5)','SA-8'),\n('004725','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (5)','SA-8(5)','SA-8'),\n('004726','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (6)','SA-8(6)','SA-8'),\n('004727','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (6)','SA-8(6)','SA-8'),\n('004728','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (7)','SA-8(7)','SA-8'),\n('004729','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (7)','SA-8(7)','SA-8'),\n('004730','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (8)','SA-8(8)','SA-8'),\n('004731','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (8)','SA-8(8)','SA-8'),\n('004732','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (9)','SA-8(9)','SA-8'),\n('004733','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (9)','SA-8(9)','SA-8'),\n('004734','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (10)','SA-8(10)','SA-8'),\n('004735','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (10)','SA-8(10)','SA-8'),\n('004736','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (11)','SA-8(11)','SA-8'),\n('004737','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (11)','SA-8(11)','SA-8'),\n('004738','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (12)','SA-8(12)','SA-8'),\n('004739','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (12)','SA-8(12)','SA-8'),\n('004740','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (13)','SA-8(13)','SA-8'),\n('004741','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (13)','SA-8(13)','SA-8'),\n('004742','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (14)','SA-8(14)','SA-8'),\n('004743','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (14)','SA-8(14)','SA-8'),\n('004744','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (15)','SA-8(15)','SA-8'),\n('004745','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (15)','SA-8(15)','SA-8'),\n('004746','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (16)','SA-8(16)','SA-8'),\n('004747','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (16)','SA-8(16)','SA-8'),\n('004748','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (17)','SA-8(17)','SA-8'),\n('004749','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (17)','SA-8(17)','SA-8'),\n('004750','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (18)','SA-8(18)','SA-8'),\n('004751','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (18)','SA-8(18)','SA-8'),\n('004752','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (19)','SA-8(19)','SA-8'),\n('004753','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (19)','SA-8(19)','SA-8'),\n('004754','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (20)','SA-8(20)','SA-8'),\n('004755','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (20)','SA-8(20)','SA-8'),\n('004756','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (21)','SA-8(21)','SA-8'),\n('004757','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (21)','SA-8(21)','SA-8'),\n('004758','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (22)','SA-8(22)','SA-8'),\n('004759','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (22)','SA-8(22)','SA-8'),\n('004760','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (23)','SA-8(23)','SA-8'),\n('004761','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (23)','SA-8(23)','SA-8'),\n('004762','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (24)','SA-8(24)','SA-8'),\n('004763','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (24)','SA-8(24)','SA-8'),\n('004764','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (25)','SA-8(25)','SA-8'),\n('004765','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (25)','SA-8(25)','SA-8'),\n('004766','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (26)','SA-8(26)','SA-8'),\n('004767','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (26)','SA-8(26)','SA-8'),\n('004768','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (27)','SA-8(27)','SA-8'),\n('004769','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (27)','SA-8(27)','SA-8'),\n('004770','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (28)','SA-8(28)','SA-8'),\n('004771','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (28)','SA-8(28)','SA-8'),\n('004772','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (29)','SA-8(29)','SA-8'),\n('004773','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (29)','SA-8(29)','SA-8'),\n('004774','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (30)','SA-8(30)','SA-8'),\n('004775','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (30)','SA-8(30)','SA-8'),\n('004776','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (31)','SA-8(31)','SA-8'),\n('004777','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (31)','SA-8(31)','SA-8'),\n('004778','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (32)','SA-8(32)','SA-8'),\n('004779','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (32)','SA-8(32)','SA-8'),\n('004780','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (33)','SA-8(33)','SA-8'),\n('004781','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-8 (33)','SA-8(33)','SA-8'),\n('004782','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 a','SA-9a','SA-9'),\n('004783','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 a','SA-9a','SA-9'),\n('004784','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 a','SA-9a','SA-9'),\n('004785','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 b','SA-9b','SA-9'),\n('004786','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 b','SA-9b','SA-9'),\n('004787','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (3)','SA-9(3)','SA-9'),\n('004788','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (3)','SA-9(3)','SA-9'),\n('004789','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (3)','SA-9(3)','SA-9'),\n('004790','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (3)','SA-9(3)','SA-9'),\n('004791','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (6)','SA-9(6)','SA-9'),\n('004792','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (7)','SA-9(7)','SA-9'),\n('004793','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-9 (8)','SA-9(8)','SA-9'),\n('004794','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 d','SA-10d','SA-10'),\n('004795','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (7)','SA-10(7)','SA-10'),\n('004796','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (7)','SA-10(7)','SA-10'),\n('004797','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-10 (7)','SA-10(7)','SA-10'),\n('004798','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 a','SA-11a','SA-11'),\n('004799','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 a','SA-11a','SA-11'),\n('004800','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 b','SA-11b','SA-11'),\n('004801','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (2) (a)','SA-11(2)(a)','SA-11'),\n('004802','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (2) (a)','SA-11(2)(a)','SA-11'),\n('004803','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (2) (b)','SA-11(2)(b)','SA-11'),\n('004804','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (2) (b)','SA-11(2)(b)','SA-11'),\n('004805','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (2) (c)','SA-11(2)(c)','SA-11'),\n('004806','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (2) (c)','SA-11(2)(c)','SA-11'),\n('004807','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (2) (d)','SA-11(2)(d)','SA-11'),\n('004808','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (2) (d)','SA-11(2)(d)','SA-11'),\n('004809','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (3) (a)','SA-11(3)(a)','SA-11'),\n('004810','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (3) (a)','SA-11(3)(a)','SA-11'),\n('004811','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (3) (a)','SA-11(3)(a)','SA-11'),\n('004812','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (5) (a)','SA-11(5)(a)','SA-11'),\n('004813','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (5) (b)','SA-11(5)(b)','SA-11'),\n('004814','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (9)','SA-11(9)','SA-11'),\n('004815','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-11 (9)','SA-11(9)','SA-11'),\n('004816','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 a 1','SA-15a1','SA-15'),\n('004817','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b','SA-15'),\n('004818','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b','SA-15'),\n('004819','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b','SA-15'),\n('004820','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b','SA-15'),\n('004821','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b','SA-15'),\n('004822','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 b','SA-15b','SA-15'),\n('004823','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (2)','SA-15(2)','SA-15'),\n('004824','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (2)','SA-15(2)','SA-15'),\n('004825','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (3) (a)','SA-15(3)(a)','SA-15'),\n('004826','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (3) (b)','SA-15(3)(b)','SA-15'),\n('004827','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (a)','SA-15(7)(a)','SA-15'),\n('004828','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (b)','SA-15(7)(b)','SA-15'),\n('004829','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (c)','SA-15(7)(c)','SA-15'),\n('004830','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (7) (d)','SA-15(7)(d)','SA-15'),\n('004831','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (10)','SA-15(10)','SA-15'),\n('004832','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (10)','SA-15(10)','SA-15'),\n('004833','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (11)','SA-15(11)','SA-15'),\n('004834','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-15 (12)','SA-15(12)','SA-15'),\n('004835','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-16','SA-16','SA-16'),\n('004836','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-16','SA-16','SA-16'),\n('004837','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17','SA-17','SA-17'),\n('004838','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 a','SA-17a','SA-17'),\n('004839','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 b','SA-17b','SA-17'),\n('004840','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 b','SA-17b','SA-17'),\n('004841','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 c','SA-17c','SA-17'),\n('004842','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (1) (a)','SA-17(1)(a)','SA-17'),\n('004843','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (1) (a)','SA-17(1)(a)','SA-17'),\n('004844','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (1) (b)','SA-17(1)(b)','SA-17'),\n('004845','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (8)','SA-17(8)','SA-17'),\n('004846','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (8)','SA-17(8)','SA-17'),\n('004847','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (8)','SA-17(8)','SA-17'),\n('004848','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (9)','SA-17(9)','SA-17'),\n('004849','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-17 (9)','SA-17(9)','SA-17'),\n('004850','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-23','SA-23','SA-23'),\n('004851','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SA-23','SA-23','SA-23'),\n('004852','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 1 (a)','SC-1a1(a)','SC-1'),\n('004853','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 1 (b)','SC-1a1(b)','SC-1'),\n('004854','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 a 2','SC-1a2','SC-1'),\n('004855','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 b','SC-1b','SC-1'),\n('004856','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 b','SC-1b','SC-1'),\n('004857','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 b','SC-1b','SC-1'),\n('004858','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 b','SC-1b','SC-1'),\n('004859','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 b','SC-1b','SC-1'),\n('004860','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 b','SC-1b','SC-1'),\n('004861','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 c 1','SC-1c1','SC-1'),\n('004862','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 c 1','SC-1c1','SC-1'),\n('004863','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 c 2','SC-1c2','SC-1'),\n('004864','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-1 c 2','SC-1c2','SC-1'),\n('004865','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-2 (2)','SC-2(2)','SC-2'),\n('004866','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 b','SC-5b','SC-5'),\n('004867','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-5 b','SC-5b','SC-5'),\n('004868','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 c','SC-7c','SC-7'),\n('004869','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (f)','SC-7(4)(f)','SC-7'),\n('004870','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (g)','SC-7(4)(g)','SC-7'),\n('004871','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (4) (h)','SC-7(4)(h)','SC-7'),\n('004872','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (5)','SC-7(5)','SC-7'),\n('004873','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (7)','SC-7(7)','SC-7'),\n('004874','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (10) (b)','SC-7(10)(b)','SC-7'),\n('004875','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (10) (b)','SC-7(10)(b)','SC-7'),\n('004876','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (24) (a)','SC-7(24)(a)','SC-7'),\n('004877','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (24) (a)','SC-7(24)(a)','SC-7'),\n('004878','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (24) (b)','SC-7(24)(b)','SC-7'),\n('004879','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (24) (c)','SC-7(24)(c)','SC-7'),\n('004880','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (24) (d)','SC-7(24)(d)','SC-7'),\n('004881','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (25)','SC-7(25)','SC-7'),\n('004882','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (25)','SC-7(25)','SC-7'),\n('004883','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (25)','SC-7(25)','SC-7'),\n('004884','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (26)','SC-7(26)','SC-7'),\n('004885','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (26)','SC-7(26)','SC-7'),\n('004886','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (27)','SC-7(27)','SC-7'),\n('004887','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (27)','SC-7(27)','SC-7'),\n('004888','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (27)','SC-7(27)','SC-7'),\n('004889','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (28)','SC-7(28)','SC-7'),\n('004890','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (28)','SC-7(28)','SC-7'),\n('004891','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (29)','SC-7(29)','SC-7'),\n('004892','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-7 (29)','SC-7(29)','SC-7'),\n('004893','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (5)','SC-8(5)','SC-8'),\n('004894','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-8 (5)','SC-8(5)','SC-8'),\n('004895','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-11 b','SC-11b','SC-11'),\n('004896','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-11 (1) (b)','SC-11(1)(b)','SC-11'),\n('004897','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-11 (1) (b)','SC-11(1)(b)','SC-11'),\n('004898','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (3)','SC-12(3)','SC-12'),\n('004899','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-12 (6)','SC-12(6)','SC-12'),\n('004900','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-13 a','SC-13a','SC-13'),\n('004901','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-16','SC-16','SC-16'),\n('004902','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-16','SC-16','SC-16'),\n('004903','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-16','SC-16','SC-16'),\n('004904','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-16 (1)','SC-16(1)','SC-16'),\n('004905','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-16 (2)','SC-16(2)','SC-16'),\n('004906','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-16 (3)','SC-16(3)','SC-16'),\n('004907','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-16 (3)','SC-16(3)','SC-16'),\n('004908','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-16 (3)','SC-16(3)','SC-16'),\n('004909','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-17 b','SC-17b','SC-17'),\n('004910','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (3)','SC-28(3)','SC-28'),\n('004911','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-28 (3)','SC-28(3)','SC-28'),\n('004912','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-32 (1)','SC-32(1)','SC-32'),\n('004913','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-36 (1) (b)','SC-36(1)(b)','SC-36'),\n('004914','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-36 (1) (b)','SC-36(1)(b)','SC-36'),\n('004915','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-36 (2)','SC-36(2)','SC-36'),\n('004916','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-36 (2)','SC-36(2)','SC-36'),\n('004917','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (4)','SC-42(4)','SC-42'),\n('004918','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (4)','SC-42(4)','SC-42'),\n('004919','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (4)','SC-42(4)','SC-42'),\n('004920','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (5)','SC-42(5)','SC-42'),\n('004921','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-42 (5)','SC-42(5)','SC-42'),\n('004922','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-45','SC-45','SC-45'),\n('004923','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-45 (1) (a)','SC-45(1)(a)','SC-45'),\n('004924','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-45 (1) (a)','SC-45(1)(a)','SC-45'),\n('004925','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-45 (1) (a)','SC-45(1)(a)','SC-45'),\n('004926','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-45 (1) (b)','SC-45(1)(b)','SC-45'),\n('004927','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-45 (1) (b)','SC-45(1)(b)','SC-45'),\n('004928','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-45 (2) (a)','SC-45(2)(a)','SC-45'),\n('004929','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-45 (2) (b)','SC-45(2)(b)','SC-45'),\n('004930','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-46','SC-46','SC-46'),\n('004931','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-47','SC-47','SC-47'),\n('004932','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-48','SC-48','SC-48'),\n('004933','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-48','SC-48','SC-48'),\n('004934','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-48','SC-48','SC-48'),\n('004935','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-48','SC-48','SC-48'),\n('004936','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-48 (1)','SC-48(1)','SC-48'),\n('004937','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-48 (1)','SC-48(1)','SC-48'),\n('004938','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-48 (1)','SC-48(1)','SC-48'),\n('004939','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-48 (1)','SC-48(1)','SC-48'),\n('004940','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-49','SC-49','SC-49'),\n('004941','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-49','SC-49','SC-49'),\n('004942','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-50','SC-50','SC-50'),\n('004943','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SC-50','SC-50','SC-50'),\n('004944','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 a 1 (b)','SI-1a1(b)','SI-1'),\n('004945','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 b','SI-1b','SI-1'),\n('004946','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 b','SI-1b','SI-1'),\n('004947','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 b','SI-1b','SI-1'),\n('004948','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 b','SI-1b','SI-1'),\n('004949','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 b','SI-1b','SI-1'),\n('004950','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 b','SI-1b','SI-1'),\n('004951','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 c 1','SI-1c1','SI-1'),\n('004952','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 c 1','SI-1c1','SI-1'),\n('004953','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 c 2','SI-1c2','SI-1'),\n('004954','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-1 c 2','SI-1c2','SI-1'),\n('004955','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (2)','SI-2(2)','SI-2'),\n('004956','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (2)','SI-2(2)','SI-2'),\n('004957','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (2)','SI-2(2)','SI-2'),\n('004958','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (2)','SI-2(2)','SI-2'),\n('004959','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (2)','SI-2(2)','SI-2'),\n('004960','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (2)','SI-2(2)','SI-2'),\n('004961','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (4)','SI-2(4)','SI-2'),\n('004962','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-2 (4)','SI-2(4)','SI-2'),\n('004963','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 a','SI-3a','SI-3'),\n('004964','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 b','SI-3b','SI-3'),\n('004965','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 b','SI-3b','SI-3'),\n('004966','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-3 c 2','SI-3c2','SI-3'),\n('004967','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 d','SI-4d','SI-4'),\n('004968','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (2)','SI-4(2)','SI-4'),\n('004969','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (3)','SI-4(3)','SI-4'),\n('004970','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (3)','SI-4(3)','SI-4'),\n('004971','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (4) (a)','SI-4(4)(a)','SI-4'),\n('004972','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (4) (a)','SI-4(4)(a)','SI-4'),\n('004973','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (4) (b)','SI-4(4)(b)','SI-4'),\n('004974','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (4) (b)','SI-4(4)(b)','SI-4'),\n('004975','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (9)','SI-4(9)','SI-4'),\n('004976','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (9)','SI-4(9)','SI-4'),\n('004977','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (10)','SI-4(10)','SI-4'),\n('004978','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (10)','SI-4(10)','SI-4'),\n('004979','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (10)','SI-4(10)','SI-4'),\n('004980','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (12)','SI-4(12)','SI-4'),\n('004981','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (16)','SI-4(16)','SI-4'),\n('004982','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-4 (25)','SI-4(25)','SI-4'),\n('004983','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-5 (1)','SI-5(1)','SI-5'),\n('004984','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 a','SI-6a','SI-6'),\n('004985','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 a','SI-6a','SI-6'),\n('004986','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 b','SI-6b','SI-6'),\n('004987','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 b','SI-6b','SI-6'),\n('004988','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 b','SI-6b','SI-6'),\n('004989','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 c','SI-6c','SI-6'),\n('004990','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 c','SI-6c','SI-6'),\n('004991','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 d','SI-6d','SI-6'),\n('004992','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 d','SI-6d','SI-6'),\n('004993','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 (2)','SI-6(2)','SI-6'),\n('004994','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 (3)','SI-6(3)','SI-6'),\n('004995','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-6 (3)','SI-6(3)','SI-6'),\n('004996','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 b','SI-7b','SI-7'),\n('004997','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 b','SI-7b','SI-7'),\n('004998','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (17)','SI-7(17)','SI-7'),\n('004999','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-7 (17)','SI-7(17)','SI-7'),\n('005000','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-8 b','SI-8b','SI-8'),\n('005001','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-8 b','SI-8b','SI-8'),\n('005002','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-8 (2)','SI-8(2)','SI-8'),\n('005003','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-10 (6)','SI-10(6)','SI-10'),\n('005004','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-12 (1)','SI-12(1)','SI-12'),\n('005005','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-12 (1)','SI-12(1)','SI-12'),\n('005006','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-12 (2)','SI-12(2)','SI-12'),\n('005007','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-12 (2)','SI-12(2)','SI-12'),\n('005008','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-12 (3)','SI-12(3)','SI-12'),\n('005009','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (3)','SI-13(3)','SI-13'),\n('005010','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-13 (4) (b)','SI-13(4)(b)','SI-13'),\n('005011','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-14 (2) (a)','SI-14(2)(a)','SI-14'),\n('005012','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-14 (2) (a)','SI-14(2)(a)','SI-14'),\n('005013','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-14 (2) (a)','SI-14(2)(a)','SI-14'),\n('005014','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-14 (2) (a)','SI-14(2)(a)','SI-14'),\n('005015','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-14 (2) (b)','SI-14(2)(b)','SI-14'),\n('005016','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-14 (3)','SI-14(3)','SI-14'),\n('005017','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-14 (3)','SI-14(3)','SI-14'),\n('005018','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-18 a','SI-18a','SI-18'),\n('005019','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-18 a','SI-18a','SI-18'),\n('005020','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-18 b 1','SI-18b1','SI-18'),\n('005021','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-18 (1)','SI-18(1)','SI-18'),\n('005022','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-18 (1)','SI-18(1)','SI-18'),\n('005023','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-18 (2)','SI-18(2)','SI-18'),\n('005024','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-18 (3)','SI-18(3)','SI-18'),\n('005025','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-18 (4)','SI-18(4)','SI-18'),\n('005026','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-18 (5)','SI-18(5)','SI-18'),\n('005027','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-18 (5)','SI-18(5)','SI-18'),\n('005028','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-18 (5)','SI-18(5)','SI-18'),\n('005029','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-19 a','SI-19a','SI-19'),\n('005030','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-19 a','SI-19a','SI-19'),\n('005031','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-19 b','SI-19b','SI-19'),\n('005032','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-19 b','SI-19b','SI-19'),\n('005033','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-19 (1)','SI-19(1)','SI-19'),\n('005034','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-19 (2)','SI-19(2)','SI-19'),\n('005035','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-19 (3)','SI-19(3)','SI-19'),\n('005036','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-19 (4)','SI-19(4)','SI-19'),\n('005037','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-19 (5)','SI-19(5)','SI-19'),\n('005038','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-19 (6)','SI-19(6)','SI-19'),\n('005039','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-19 (7)','SI-19(7)','SI-19'),\n('005040','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-19 (8)','SI-19(8)','SI-19'),\n('005041','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-20','SI-20','SI-20'),\n('005042','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-20','SI-20','SI-20'),\n('005043','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-21','SI-21','SI-21'),\n('005044','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-21','SI-21','SI-21'),\n('005045','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-21','SI-21','SI-21'),\n('005046','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-22 a','SI-22a','SI-22'),\n('005047','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-22 a','SI-22a','SI-22'),\n('005048','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-22 b','SI-22b','SI-22'),\n('005049','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-22 b','SI-22b','SI-22'),\n('005050','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-23 a','SI-23a','SI-23'),\n('005051','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-23 a','SI-23a','SI-23'),\n('005052','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-23 a','SI-23a','SI-23'),\n('005053','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-23 b','SI-23b','SI-23'),\n('005054','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-23 b','SI-23b','SI-23'),\n('005055','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SI-23 b','SI-23b','SI-23'),\n('005056','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 a 1','SR-1a1','SR-1'),\n('005057','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 a 1 (a)','SR-1a1(a)','SR-1'),\n('005058','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 a 1 (b)','SR-1a1(b)','SR-1'),\n('005059','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 a 2','SR-1a2','SR-1'),\n('005060','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 b','SR-1b','SR-1'),\n('005061','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 b','SR-1b','SR-1'),\n('005062','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 b','SR-1b','SR-1'),\n('005063','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 b','SR-1b','SR-1'),\n('005064','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 c 1','SR-1c1','SR-1'),\n('005065','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 c 1','SR-1c1','SR-1'),\n('005066','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 c 1','SR-1c1','SR-1'),\n('005067','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 c 1','SR-1c1','SR-1'),\n('005068','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 c 2','SR-1c2','SR-1'),\n('005069','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 c 2','SR-1c2','SR-1'),\n('005070','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 c 2','SR-1c2','SR-1'),\n('005071','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-1 c 2','SR-1c2','SR-1'),\n('005072','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-2 a','SR-2a','SR-2'),\n('005073','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-2 a','SR-2a','SR-2'),\n('005074','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-2 b','SR-2b','SR-2'),\n('005075','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-2 b','SR-2b','SR-2'),\n('005076','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-2 c','SR-2c','SR-2'),\n('005077','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-2 (1)','SR-2(1)','SR-2'),\n('005078','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-2 (1)','SR-2(1)','SR-2'),\n('005079','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-2 (1)','SR-2(1)','SR-2'),\n('005080','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 a','SR-3a','SR-3'),\n('005081','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 a','SR-3a','SR-3'),\n('005082','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 a','SR-3a','SR-3'),\n('005083','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 a','SR-3a','SR-3'),\n('005084','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 a','SR-3a','SR-3'),\n('005085','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 a','SR-3a','SR-3'),\n('005086','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 b','SR-3b','SR-3'),\n('005087','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 b','SR-3b','SR-3'),\n('005088','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 b','SR-3b','SR-3'),\n('005089','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 c','SR-3c','SR-3'),\n('005090','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 c','SR-3c','SR-3'),\n('005091','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 (1)','SR-3(1)','SR-3'),\n('005092','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 (1)','SR-3(1)','SR-3'),\n('005093','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 (2)','SR-3(2)','SR-3'),\n('005094','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 (2)','SR-3(2)','SR-3'),\n('005095','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-3 (3)','SR-3(3)','SR-3'),\n('005096','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4','SR-4','SR-4'),\n('005097','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4','SR-4','SR-4'),\n('005098','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4','SR-4','SR-4'),\n('005099','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4','SR-4','SR-4'),\n('005100','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4 (1)','SR-4(1)','SR-4'),\n('005101','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4 (1)','SR-4(1)','SR-4'),\n('005102','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4 (2)','SR-4(2)','SR-4'),\n('005103','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4 (2)','SR-4(2)','SR-4'),\n('005104','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4 (3)','SR-4(3)','SR-4'),\n('005105','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4 (3)','SR-4(3)','SR-4'),\n('005106','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4 (3)','SR-4(3)','SR-4'),\n('005107','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4 (3)','SR-4(3)','SR-4'),\n('005108','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4 (4)','SR-4(4)','SR-4'),\n('005109','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4 (4)','SR-4(4)','SR-4'),\n('005110','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4 (4)','SR-4(4)','SR-4'),\n('005111','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-4 (4)','SR-4(4)','SR-4'),\n('005112','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-5','SR-5','SR-5'),\n('005113','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-5','SR-5','SR-5'),\n('005114','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-5 (1)','SR-5(1)','SR-5'),\n('005115','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-5 (1)','SR-5(1)','SR-5'),\n('005116','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-5 (1)','SR-5(1)','SR-5'),\n('005117','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-5 (2)','SR-5(2)','SR-5'),\n('005118','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-6','SR-6','SR-6'),\n('005119','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-6','SR-6','SR-6'),\n('005120','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-6 (1)','SR-6(1)','SR-6'),\n('005121','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-6 (1)','SR-6(1)','SR-6'),\n('005122','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-7','SR-7','SR-7'),\n('005123','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-7','SR-7','SR-7'),\n('005124','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-8','SR-8','SR-8'),\n('005125','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-8','SR-8','SR-8'),\n('005126','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-9','SR-9','SR-9'),\n('005127','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-9 (1)','SR-9(1)','SR-9'),\n('005128','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-10','SR-10','SR-10'),\n('005129','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-10','SR-10','SR-10'),\n('005130','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-10','SR-10','SR-10'),\n('005131','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-10','SR-10','SR-10'),\n('005132','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-11 a','SR-11a','SR-11'),\n('005133','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-11 a','SR-11a','SR-11'),\n('005134','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-11 b','SR-11b','SR-11'),\n('005135','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-11 b','SR-11b','SR-11'),\n('005136','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-11 b','SR-11b','SR-11'),\n('005137','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-11 (1)','SR-11(1)','SR-11'),\n('005138','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-11 (1)','SR-11(1)','SR-11'),\n('005139','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-11 (2)','SR-11(2)','SR-11'),\n('005140','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-11 (2)','SR-11(2)','SR-11'),\n('005141','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-11 (2)','SR-11(2)','SR-11'),\n('005142','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-11 (3)','SR-11(3)','SR-11'),\n('005143','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-11 (3)','SR-11(3)','SR-11'),\n('005144','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-12','SR-12','SR-12'),\n('005145','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-12','SR-12','SR-12'),\n('005146','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','SR-12','SR-12','SR-12'),\n('005147','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AT-2 a 1','AT-2a1','AT-2'),\n('005149','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','AU-16 (3)','AU-16(3)','AU-16'),\n('005150','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','PM-30 (1)','PM-30(1)','PM-30'),\n('005151','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 b','IR-2b','IR-2'),\n('005152','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 b','IR-2b','IR-2'),\n('005153','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-2 b','IR-2b','IR-2'),\n('005154','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IR-7 (1)','IR-7(1)','IR-7'),\n('005155','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13','IA-13','IA-13'),\n('005156','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13 (01)','IA-13(01)','IA-13'),\n('005157','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13 (02)','IA-13(02)','IA-13'),\n('005158','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13 (03) (a)','IA-13(03)(a)','IA-13'),\n('005159','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13 (03) (b)','IA-13(03)(b)','IA-13'),\n('005160','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13 (03) (c)','IA-13(03)(c)','IA-13'),\n('005161','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13 (03) (d)','IA-13(03)(d)','IA-13'),\n('005162','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13 (03) (e)','IA-13(03)(e)','IA-13'),\n('005163','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13 (03) (f)','IA-13(03)(f)','IA-13'),\n('005164','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13 (03) (a)','IA-13(03)(a)','IA-13'),\n('005165','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13 (03) (b)','IA-13(03)(b)','IA-13'),\n('005166','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13 (03) (c)','IA-13(03)(c)','IA-13'),\n('005167','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13 (03) (d)','IA-13(03)(d)','IA-13'),\n('005168','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13 (03) (e)','IA-13(03)(e)','IA-13'),\n('005169','NIST','NIST SP 800-53 Revision 5','5','http://csrc.nist.gov/publications/PubsSPs.html','IA-13 (03) (f)','IA-13(03)(f)','IA-13');\n/*!40000 ALTER TABLE `cci_reference_map` ENABLE KEYS */;\nUNLOCK TABLES;\n\n/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;\n/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;\n/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;\n/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;\n"
  },
  {
    "path": "api/source/service/migrations/sql/generateSchema.sh",
    "content": "#!/bin/bash\n\n# Use this script to generate the current schema and static data for the 'stigman' database.\n# It will produce two SQL scripts which will be used in the stig manager application to recreate a new database schema in its most recent state. \n\n#NEEDS: mysqldump\n\n#How to use:\n# 1. Ensure that the MySQL server is running and that the 'stigman' database is accessible and in its most recent state.\n# 2. Run this script from the command line.\n# 3. When stig-manager is started, it will automatically run the SQL scripts to create the database schema and insert the static data.\n\n\n#List of table names for static data.\nstatic_data_tables=\"result status _migrations task job job_task_map\"\n\n# Export the schema of all tables in the 'stigman' database into a SQL file,\n# removing any AUTO_INCREMENT attribute values to prevent conflicts with existing data when imported\n# and removing statements that trigger a mysql2 bug when changing client character set\n# The '--no-data' flag means no table row data will be dumped, only the schema.\n# The '--no-create-db' flag prevents the inclusion of CREATE DATABASE statements in the dump.\nmysqldump -h 127.0.0.1 -P 3306 -u root -prootpw --routines --events --no-data --no-create-db stigman |\n  sed --expression='s/ AUTO_INCREMENT=[0-9]\\+//'  \\\n      --expression='s/DEFINER=`stigman`@`%` *//' \\\n      --expression '/SQL SECURITY DEFINER/d' \\\n      --expression='s/;;/$/g' |\n  awk 'tolower($0) !~ /character_set|set names/' > 10-stigman-tables.sql\n\n# Export only the data from specific tables listed in $static_data_tables into a separate SQL file. \n# '--no-create-info' flag ensures that table creation statements are not included, just the row insertions.\nmysqldump -h 127.0.0.1 -P 3306 -u root -prootpw --no-create-info stigman $static_data_tables |\n  awk 'tolower($0) !~ /character_set|set names/' > 20-stigman-static.sql\n\necho \"ALTER TABLE job AUTO_INCREMENT=100;\" >> 20-stigman-static.sql\necho \"ALTER TABLE job_task_map AUTO_INCREMENT=1000;\" >> 20-stigman-static.sql\n"
  },
  {
    "path": "api/source/service/utils.js",
    "content": "const mysql = require('mysql2/promise')\nconst config = require('../utils/config')\nconst logger = require('../utils/logger')\nconst retry = require('async-retry')\nconst Umzug = require('umzug')\nconst path = require('path')\nconst fs = require(\"fs\")\nconst semverGte = require('semver/functions/gte')\nconst semverCoerce = require('semver/functions/coerce')\nconst Importer = require('./migrations/lib/mysql-import.js')\nconst state = require('../utils/state')\nconst minMySqlVersion = '8.0.24'\nlet _this = this\nlet initAttempt = 0\nlet NetKeepAlive\nif (!process.pkg) {\n  // pkg does not support the dynamic loading used by net-keepalive.\n  // Therefore, support for TCP_USER_TIMEOUT is excluded from binaries built with pkg.\n  NetKeepAlive = require('net-keepalive')\n}\nconst PoolMonitor = require('../utils/PoolMonitor.js')\n\n/**\n * Performs a preflight connection check by getting and releasing a connection from the pool.\n */\nasync function preflightConnection () {\n  logger.writeDebug('mysql', 'preflight', { attempt: ++initAttempt })\n  const connection = await _this.pool.getConnection()\n  await connection.release()\n}\n\n/**\n * Retrieves the MySQL version from the database.\n * @returns {Promise<string>} The MySQL version.\n */\nasync function getMySqlVersion () {\n  let [result] = await _this.pool.query('SELECT VERSION() as version')\n  return result[0].version\n}\n\n/**\n * Retrieves the count of tables in the database.\n * @returns {Promise<number>} The number of tables.\n */\nasync function getTableCount () {\n  let [tables] = await _this.pool.query('SHOW TABLES')\n  return tables.length\n}\n\n/**\n * Checks if the provided MySQL version is acceptable.\n * @param {string} version - The MySQL version to check.\n * @returns {boolean} True if the version is acceptable, false otherwise.\n */\nfunction isOkVersion(version) {\n  return semverGte(semverCoerce(version), semverCoerce(minMySqlVersion))\n}\n\n/**\n * Performs database migrations using Umzug.\n * @returns {Promise<Array>} The list of executed migrations.\n */\nasync function doMigrations() {\n  // Perform migrations\n  const umzug = new Umzug({\n    migrations: {\n      path: path.join(__dirname, './migrations'),\n      params: [_this.pool]\n    },\n    storage: path.join(__dirname, './migrations/lib/umzug-mysql-storage'),\n    storageOptions: {\n      pool: _this.pool\n    }\n  })\n\n  if (config.database.revert) {\n    const migrations = await umzug.executed()\n    if (migrations.length) {\n      logger.writeInfo('mysql', 'migration', { message: 'MySQL schema will revert the last migration and terminate' })\n      await umzug.down()\n    } else {\n      logger.writeInfo('mysql', 'migration', { message: 'MySQL schema has no migrations to revert' })\n    }\n    logger.writeInfo('mysql', 'migration', { message: 'MySQL revert migration has completed' })\n    state.setState('stop')\n  }\n  const migrations = await umzug.pending()\n  if (migrations.length > 0) {\n    logger.writeInfo('mysql', 'migration', { message: `MySQL schema requires ${migrations.length} update${migrations.length > 1 ? 's' : ''}` })\n    await umzug.up()\n    logger.writeInfo('mysql', 'migration', { message: `All migrations performed successfully` })\n  }\n  else {\n    logger.writeInfo('mysql', 'migration', { message: `MySQL schema is up to date` })\n  }\n  return umzug.executed()\n}\n\n/**\n * Sets up the initial database schema by importing SQL files.\n */\nasync function setupInitialSchema(){\n  logger.writeInfo('mysql', 'schema', { message: 'setting up new schema.' })\n  const importer = new Importer(_this.pool)\n  const dir = path.join(__dirname, 'migrations', 'sql', 'current')\n  const files = await fs.promises.readdir(dir)\n  try {\n    for (const file of files) {\n      logger.writeInfo('mysql', 'schema', {status: 'running', name: file })\n      await importer.import(path.join(dir, file))\n    }    \n  }\n  catch (e) {\n    logger.writeError('mysql', 'schema', {status: 'error', files, message: e.message })\n    throw new Error(`failed to setup initial schema, ${e.message}`)\n  }\n  logger.writeInfo('mysql', 'schema', { message: 'schema setup complete.' })\n}\n\n/**\n * Sets up the database schema by checking the number of tables and performing migrations if necessary.\n */\nasync function setupSchema() {\n  try {\n    // Check the number of tables in the database\n    const numTables = await getTableCount()\n\n    if (numTables === 0) {\n      await setupInitialSchema()\n    }\n    const migrated = await doMigrations()\n    config.lastMigration = parseInt(migrated[migrated.length -1].file.substring(0,4))\n  }\n  catch (error) {\n    logger.writeError('mysql', 'initalization', { message: error.message })\n    throw new Error('Failed during database initialization or migration.')\n  } \n}\n\n/**\n * Resolves a database TLS certificate path.\n * Detects if the path is absolute or relative and returns the appropriate resolved path.\n * Relative paths are resolved relative to the /tls directory for backward compatibility.\n * \n * @param {string} certPath - The certificate path from configuration\n * @returns {string} The resolved absolute path\n */\nfunction resolveDbCertPath(certPath) {\n  if (path.isAbsolute(certPath)) {\n    // Path is already absolute, use it directly\n    return certPath\n  } else {\n    // Path is relative, resolve it relative to the /tls directory (legacy behavior)\n    return path.join(__dirname, '..', 'tls', certPath)\n  }\n}\n\n/**\n * Generates the pool configuration object based on the application configuration.\n * @returns {Object} The pool configuration object.\n */\nfunction getPoolConfig() {\n  const poolConfig = {\n    connectionLimit : config.database.maxConnections,\n    timezone: 'Z',\n    host: config.database.host,\n    port: config.database.port,\n    user: config.database.username,\n    database: config.database.schema,\n    decimalNumbers: true,\n    charset: 'utf8mb4_0900_ai_ci',\n    keepAliveInitialDelay: 10000,\n    connectAttributes: {\n      program_name: 'stig-manager'\n    },\n    typeCast: function (field, next) {\n      if ((field.type === \"BIT\") && (field.length === 1)) {\n        let bytes = field.buffer() || [0]\n        return( bytes[ 0 ] === 1 )\n      }\n      return next()\n    } \n  }\n  if (config.database.password) {\n    poolConfig.password = config.database.password\n  }\n  if (config.database.tls.ca_file || config.database.tls.cert_file || config.database.tls.key_file) {\n    const sslConfig = {}\n    if (config.database.tls.ca_file) {\n      sslConfig.ca = fs.readFileSync(resolveDbCertPath(config.database.tls.ca_file))\n    }\n    if (config.database.tls.cert_file) {\n      sslConfig.cert = fs.readFileSync(resolveDbCertPath(config.database.tls.cert_file))\n    }\n    if (config.database.tls.key_file) {\n      sslConfig.key = fs.readFileSync(resolveDbCertPath(config.database.tls.key_file))\n    }\n    poolConfig.ssl = sslConfig\n  }\n  return poolConfig\n}\n\n/**\n * Patches the pool to emit a 'remove' event when a connection is removed.\n * @param {Object} promisePool - The mysql2 PromisePool object.\n */\nfunction patchRemoveConnection(promisePool) {\n  const originalRemoveConnection = promisePool.pool._removeConnection\n  promisePool.pool._removeConnection = function (connection) {\n    originalRemoveConnection.call(promisePool.pool, connection)\n    promisePool.emit('remove', connection)\n  }\n}\n\n/**\n * Retry function for the pool monitor to attempt to restore pool connections.\n */\nasync function poolMonitorRetryFn () {\n  try {\n    logger.writeInfo('mysql', 'restore', { message: 'attempting to restore pool connection' })\n    await preflightConnection()\n    logger.writeInfo('mysql', 'restore', { message: `connection suceeded` })\n    const version = await getMySqlVersion()\n    if (!isOkVersion(version)) {\n      const connection = await _this.pool.getConnection()\n      connection.connection.destroy()\n      throw new Error(`MySQL release ${version} is too old. Update to release ${minMySqlVersion} or later.`)\n    } \n    else {\n      await setupSchema()\n      logger.writeInfo('mysql', 'restore', { success: true, version, message: 'pool connection restored' })\n    } \n  }\n  catch (e) {\n    logger.writeError('mysql', 'restore', { success: false, message: e.message })\n    throw e\n  }\n}\n\n/**\n * Retry function for bootstrapping the database connection.\n * @param {Function} fn - The function to retry.\n * @returns {Promise} The result of the retried function.\n */\nasync function bootstrapRetryFn (fn) {\n  return retry(fn, {\n    retries: config.settings.dependencyRetries,\n    factor: 1,\n    minTimeout: 5 * 1000,\n    maxTimeout: 5 * 1000,\n    onRetry: (error) => {\n      logger.writeError('mysql', 'preflight', { success: false, message: error.message })\n    }\n  })\n}\n\n/**\n * Formats a Node.js socket object into a string representation.\n * \n * @param {net.Socket} socket - The Node.js socket object.\n * @returns {string|undefined} A string representation of the socket's local and remote addresses and ports, or undefined if the socket is not connected.\n */\nfunction formatSocket(socket) {\n  return socket.localAddress ? `${socket.localAddress}:${socket.localPort} -> ${socket.remoteAddress}:${socket.remotePort}` : undefined\n}\n\n/**\n * Attaches event handlers to the pool for connection and removal events.\n * @param {Object} pool - The mysql2 PromisePool object.\n */\nfunction attachPoolEventHandlers(pool) {\n  pool.on('connection', function (connection) {\n    const socket = formatSocket(connection.stream)\n    connection.on('error', function (error) {\n      logger.writeError('mysql', 'connectionEvent', { event: 'error', socket, message: error.message })\n    })\n    logger.writeInfo('mysql', 'poolEvent', { event: 'connection', socket })\n    NetKeepAlive?.setUserTimeout(connection.stream, 20000)\n    connection.query('SET SESSION group_concat_max_len=10000000')\n  })\n  pool.on('remove', function (connection) {\n    const socket = formatSocket(connection.stream)\n    logger.writeInfo('mysql', 'poolEvent', { event: 'remove', socket, remaining: pool.pool._allConnections.toArray().length, authorized: connection.authorized })\n  })  \n}\n\nmodule.exports.initializeDatabase = async function () {\n  try {\n    // Create the connection pool\n    const poolConfig = getPoolConfig()\n    logger.writeDebug('mysql', 'poolConfig', { ...poolConfig })\n\n    _this.pool = mysql.createPool(poolConfig)\n    attachPoolEventHandlers(_this.pool)\n\n    new PoolMonitor({pool: _this.pool, state, retryInterval: 20000, retryFn: poolMonitorRetryFn})\n    state.dbPool = _this.pool\n\n    // Try to create a pool connection, will retry every 5 seconds\n    await bootstrapRetryFn(preflightConnection)\n\n    // Check the MySQL version\n    const version = await getMySqlVersion()\n    if (!isOkVersion(version)) {\n      logger.writeError('mysql', 'preflight', { success: false, message: `MySQL release ${version} is too old. Update to release ${minMySqlVersion} or later.` })\n      throw new Error('MySQL release is too old.')\n    } \n    else {\n      logger.writeInfo('mysql', 'preflight', {success: true, version })\n    }\n\n    // Patch the pool to emit a 'remove' event when a connection is removed\n    patchRemoveConnection(_this.pool)\n\n    // Setup the schema, will scaffold if necessary and run migrations\n    await setupSchema()\n\n    state.setDbStatus(true)\n  }\n  catch (err) {\n    state.setDbStatus(false)\n    throw err\n  }\n}\n\nmodule.exports.parseRevisionStr = function (revisionStr) {\n  const ro = {}\n  if (revisionStr !== 'latest') {\n    const results = /V(\\d+)R(\\d+(\\.\\d+)?)/.exec(revisionStr)\n    ro.version = results[1]\n    ro.release = results[2]\n    ro.table = 'revision'\n    ro.table_alias = 'r'\n    ro.predicates = ' and r.version = ? and r.release = ? '\n  }\n  else {\n    ro.version = null\n    ro.release = null\n    ro.table = 'current_rev'\n    ro.table_alias = 'cr'\n    ro.predicates = ''\n  }\n  return ro\n}\n\nmodule.exports.selectCollectionByAssetId = async function (assetId) {\n  const [rows] = await _this.pool.query(`SELECT c.* from enabled_asset a left join enabled_collection c using (collectionId) where a.assetId = ?`, [assetId])\n  return rows[0]\n}\n\nmodule.exports.getGrantByAssetId = async function (assetId, grants) {\n  const row = await _this.selectCollectionByAssetId(assetId)\n  return row ? grants[row.collectionId] : null\n}\n\nmodule.exports.getUserAssetStigAccess = async function ({assetId, benchmarkId, grants}) {\n  const grant = await _this.getGrantByAssetId(assetId, grants)\n  if (!grant) return 'none'\n  const binds = [assetId, benchmarkId]\n  const sql = `with ${_this.cteAclEffective({grantIds: grant.grantIds})} select\n    coalesce(ae.access, 'rw') as access\n  from\n\t  stig_asset_map sa\n    inner join enabled_asset a on sa.assetId = a.assetId\n    ${grant.roleId === 1 ? 'inner' : 'left'} join cteAclEffective ae using (saId)\n  where\n\t  sa.assetId = ? and sa.benchmarkId = ?`\n    const [rows] = await _this.pool.query(sql, binds)\n    return rows[0]?.access ?? 'none'\n}\n\n/**\n * updateStatsAssetStig\n * @param {PoolConnection} connection \n * @param {Object} param1 \n * @param {string} param1.collectionId\n * @param {string} param1.assetId\n * @param {string} param1.benchmarkId\n * @param {string[]} param1.rules\n */\nmodule.exports.updateStatsAssetStig = async function(connection, { \n  collectionId,\n  collectionIds,\n  assetId,\n  assetIds,\n  assetBenchmarkIds,\n  benchmarkId,\n  benchmarkIds,\n  rules,\n  saIds }) {\n  if (!connection) { throw new Error ('Connection required')}\n  // Handle optional predicates, \n  let predicates = ['sa.assetId IS NOT NULL AND sa.benchmarkId IS NOT NULL']\n  let binds = []\n  let whereClause = ''\n\n  if (rules && rules.length > 0) {\n    predicates.push(`sa.benchmarkId IN (SELECT DISTINCT benchmarkId from rev_group_rule_map left join revision using (revId) where ruleId IN ?)`)\n    binds.push( [rules] )\n  }\n\n  if (collectionId) {\n    predicates.push('a.collectionId = ?')\n    binds.push(collectionId)\n  }\n  if (collectionIds) {\n    predicates.push('a.collectionId IN ?')\n    binds.push([collectionIds])\n  }\n  if (assetId) {\n    predicates.push('a.assetId = ?')\n    binds.push(assetId)\n  }\n  if (assetIds) {\n    predicates.push('a.assetId IN ?')\n    binds.push([assetIds])\n  }\n  if (assetBenchmarkIds) {\n    predicates.push(`a.assetId IN (select assetId from stig_asset_map where benchmarkId in ?)`)\n    binds.push([assetBenchmarkIds])\n  }\n  if (benchmarkId) {\n    predicates.push('sa.benchmarkId = ?')\n    binds.push(benchmarkId)\n  }\n  if (benchmarkIds) {\n    predicates.push('sa.benchmarkId IN ?')\n    binds.push([benchmarkIds])\n  }\n  if (saIds) {\n    predicates.push('sa.saId IN ?')\n    binds.push([saIds])\n  }\n  if (predicates.length > 0) {\n    whereClause = `where  ${predicates.join(' and ')}`\n  }\n\n  const sqlUpdate = `\n  with source as\n    ( select\n       sa.assetId,\n       sa.benchmarkId,\n       min(review.ts) as minTs,\n       max(review.ts) as maxTs,  \n       max(review.touchTs) as maxTouchTs,  \n       \n       sum(CASE WHEN review.statusId = 0 THEN 1 ELSE 0 END) as saved,\n       sum(CASE WHEN review.resultEngine is not null and review.statusId = 0 THEN 1 ELSE 0 END) as savedResultEngine,\n       sum(CASE WHEN review.statusId = 1 THEN 1 ELSE 0 END) as submitted,\n       sum(CASE WHEN review.resultEngine is not null and review.statusId = 1 THEN 1 ELSE 0 END) as submittedResultEngine,\n       sum(CASE WHEN review.statusId = 2 THEN 1 ELSE 0 END) as rejected,\n       sum(CASE WHEN review.resultEngine is not null and review.statusId = 2 THEN 1 ELSE 0 END) as rejectedResultEngine,\n       sum(CASE WHEN review.statusId = 3 THEN 1 ELSE 0 END) as accepted,\n       sum(CASE WHEN review.resultEngine is not null and review.statusId = 3 THEN 1 ELSE 0 END) as acceptedResultEngine,\n\n       sum(CASE WHEN review.resultId=4 and rgr.severity='high' THEN 1 ELSE 0 END) as highCount,\n       sum(CASE WHEN review.resultId=4 and rgr.severity='medium' THEN 1 ELSE 0 END) as mediumCount,\n       sum(CASE WHEN review.resultId=4 and rgr.severity='low' THEN 1 ELSE 0 END) as lowCount,\n       \n       sum(CASE WHEN (review.resultId in (2,3,4)) and rgr.severity='high' THEN 1 ELSE 0 END) as assessedHighCount,\n       sum(CASE WHEN (review.resultId in (2,3,4)) and rgr.severity='medium' THEN 1 ELSE 0 END) as assessedMediumCount,\n       sum(CASE WHEN (review.resultId in (2,3,4)) and rgr.severity='low' THEN 1 ELSE 0 END) as assessedLowCount,\n       \n       sum(CASE WHEN review.resultId = 1 THEN 1 ELSE 0 END) as notchecked,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 1 THEN 1 ELSE 0 END) as notcheckedResultEngine,\n       sum(CASE WHEN review.resultId = 2 THEN 1 ELSE 0 END) as notapplicable,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 2 THEN 1 ELSE 0 END) as notapplicableResultEngine,\n       sum(CASE WHEN review.resultId = 3 THEN 1 ELSE 0 END) as pass,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 3 THEN 1 ELSE 0 END) as passResultEngine,\n       sum(CASE WHEN review.resultId = 4 THEN 1 ELSE 0 END) as fail,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 4 THEN 1 ELSE 0 END) as failResultEngine,\n       sum(CASE WHEN review.resultId = 5 THEN 1 ELSE 0 END) as unknown,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 5 THEN 1 ELSE 0 END) as unknownResultEngine,\n       sum(CASE WHEN review.resultId = 6 THEN 1 ELSE 0 END) as error,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 6 THEN 1 ELSE 0 END) as errorResultEngine,\n       sum(CASE WHEN review.resultId = 7 THEN 1 ELSE 0 END) as notselected,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 7 THEN 1 ELSE 0 END) as notselectedResultEngine,            \n       sum(CASE WHEN review.resultId = 8 THEN 1 ELSE 0 END) as informational,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 8 THEN 1 ELSE 0 END) as informationalResultEngine,\n       sum(CASE WHEN review.resultId = 9 THEN 1 ELSE 0 END) as fixed,\n       sum(CASE WHEN review.resultEngine is not null and review.resultId = 9 THEN 1 ELSE 0 END) as fixedResultEngine\n       \n       from\n         enabled_asset a\n         inner join enabled_collection ec on a.collectionId = ec.collectionId\n         left join stig_asset_map sa using (assetId)\n         left join default_rev dr on (sa.benchmarkId = dr.benchmarkId and a.collectionId = dr.collectionId)\n         left join rev_group_rule_map rgr on dr.revId = rgr.revId\n         left join rule_version_check_digest rvcd on rgr.ruleId = rvcd.ruleId\n         left join review on (rvcd.version=review.version and rvcd.checkDigest=review.checkDigest and review.assetId=sa.assetId)\n    ${whereClause}\n    group by\n      sa.assetId,\n      sa.benchmarkId\n      )\n  update stig_asset_map sam\n    inner join source on sam.assetId = source.assetId and source.benchmarkId = sam.benchmarkId\n    set sam.minTs = source.minTs,\n        sam.maxTs = source.maxTs,\n        sam.maxTouchTs = source.maxTouchTs,\n        sam.saved = source.saved,\n        sam.savedResultEngine = source.savedResultEngine,\n        sam.submitted = source.submitted,\n        sam.submittedResultEngine = source.submittedResultEngine,\n        sam.rejected = source.rejected,\n        sam.rejectedResultEngine = source.rejectedResultEngine,\n        sam.accepted = source.accepted,\n        sam.acceptedResultEngine = source.acceptedResultEngine,\n        sam.highCount = source.highCount,\n        sam.mediumCount = source.mediumCount,\n        sam.lowCount = source.lowCount,\n        sam.assessedHighCount = source.assessedHighCount,\n        sam.assessedMediumCount = source.assessedMediumCount,\n        sam.assessedLowCount = source.assessedLowCount,\n        sam.notchecked = source.notchecked,\n        sam.notcheckedResultEngine = source.notcheckedResultEngine,\n        sam.notapplicable = source.notapplicable,\n        sam.notapplicableResultEngine = source.notapplicableResultEngine,\n        sam.pass = source.pass,\n        sam.passResultEngine = source.passResultEngine,\n        sam.fail = source.fail,\n        sam.failResultEngine = source.failResultEngine,\n        sam.unknown = source.unknown,\n        sam.unknownResultEngine = source.unknownResultEngine,\n        sam.error = source.error,\n        sam.errorResultEngine = source.errorResultEngine,\n        sam.notselected = source.notselected,\n        sam.notselectedResultEngine = source.notselectedResultEngine,\n        sam.informational = source.informational,\n        sam.informationalResultEngine = source.informationalResultEngine,\n        sam.fixed = source.fixed,\n        sam.fixedResultEngine = source.fixedResultEngine        \n    `\n\n    let stats\n    [stats] = await connection.query(sqlUpdate, binds)\n    return stats\n\n}\n\nmodule.exports.uuidToSqlString  = function (uuid) {\n  return {\n    toSqlString: function () {\n      return `UUID_TO_BIN(${mysql.escape(uuid)},1)`\n    }\n  }\n}\n\nmodule.exports.makeQueryString = function ({ctes = [], hints= [], columns, joins, predicates, groupBy, orderBy, format = false}) {\n  if (joins instanceof Set) joins = Array.from(joins)\n  if (groupBy instanceof Set) groupBy = Array.from(groupBy)\n  const query = `${ctes.length ? 'WITH ' + ctes.join(',  \\n') : ''}\nSELECT ${hints.length ? '/*+ ' + hints.join(' ') + '*/' : ''}\n  ${columns.join(',\\n  ')}\nFROM\n  ${joins.join('\\n  ')}\n${predicates?.statements.length ? 'WHERE\\n  ' + predicates.statements.join(' and\\n  ') : ''}\n${groupBy?.length ? 'GROUP BY\\n  ' + groupBy.join(',\\n  ') : ''}\n${orderBy?.length ? 'ORDER BY\\n  ' + orderBy.join(',\\n  ') : ''}\n`\n  return format? mysql.format(query, predicates.binds) : query\n}\n\nmodule.exports.CONTEXT_ALL = 'all'\nmodule.exports.CONTEXT_DEPT = 'department'\nmodule.exports.CONTEXT_USER = 'user'\nmodule.exports.REVIEW_RESULT_API = { \n  'notchecked': 1,\n  'notapplicable': 2,\n  'pass': 3,\n  'fail': 4,\n  'unknown': 5,\n  'error': 6,\n  'notselected': 7,\n  'informational': 8,\n  'fixed': 9\n}\nmodule.exports.REVIEW_ACTION_API = { \n  'remediate': 1,\n  'mitigate': 2,\n  'exception': 3\n}\nmodule.exports.REVIEW_STATUS_API = { \n  'saved': 0,\n  'submitted': 1,\n  'rejected': 2,\n  'accepted': 3\n}\nmodule.exports.WRITE_ACTION = { \n  CREATE: 0,\n  REPLACE: 1,\n  UPDATE: 2\n}\n\nmodule.exports.retryOnDeadlock = async function (fn, statusObj = {}) {\n  const retryFunction = async function (bail) {\n    try {\n      return await fn()\n    }\n    catch (e) {\n      if (e.code === 'ER_LOCK_DEADLOCK') {\n        throw(e)\n      }\n      bail(e)\n    }\n  }\n  statusObj.retries = 0\n  return await retry(retryFunction, {\n    retries: 15,\n    factor: 1,\n    minTimeout: 200,\n    maxTimeout: 200,\n    onRetry: () => {\n      ++statusObj.retries\n    }\n  })\n}\n\nmodule.exports.retryOnDeadlock2 = async function ({ transactionFn, statusObj = {}, beforeReleaseFn, afterRollbackFn}) {\n  const connection = await _this.pool.getConnection()\n  const retryFunction = async function (bail) {\n    try {\n      await connection.query('START TRANSACTION')\n      const transactionReturn = await transactionFn(connection)\n      await connection.commit()\n      await connection.release()\n      return transactionReturn\n    }\n    catch (e) {\n      if (e.code === 'ER_LOCK_DEADLOCK') {\n        throw(e)\n      }\n      await connection.rollback()\n      afterRollbackFn?.(connection)\n      beforeReleaseFn?.(connection)\n      await connection.release()\n      bail(e)\n    }\n  }\n  statusObj.retries = 0\n  return  await retry(retryFunction, {\n    retries: 15,\n    factor: 1,\n    minTimeout: 200,\n    maxTimeout: 200,\n    onRetry: () => {\n      ++statusObj.retries\n    }\n  })\n  // return returnValue\n\n}\n\n\nexports.createAssetValidation = async function({ assets, collectionId}) {\n  const assetJson = JSON.stringify(assets)\n  const validationQuery = `\n  WITH cteFails AS (\n      SELECT \n          jt.positionA,\n          jt.positionB,\n          jt.positionL,\n          jt.name,\n          jt.benchmarkId, \n          jt.labelName, \n          a.name AS matchedName, \n          s.benchmarkId AS matchedBenchmarkId, \n          cl.clId AS matchedClId\n      FROM \n          JSON_TABLE(?, '$[*]'\n              COLUMNS (\n                  positionA FOR ORDINALITY,\n                  name VARCHAR(255) PATH '$.name',\n                  NESTED PATH '$.stigs[*]' \n                      COLUMNS (positionB FOR ORDINALITY, benchmarkId VARCHAR(255) PATH '$'),\n                  NESTED PATH '$.labelNames[*]' \n                      COLUMNS (positionL FOR ORDINALITY, labelName VARCHAR(255) PATH '$')\n              )\n          ) AS jt\n      LEFT JOIN enabled_asset a \n          ON jt.name = a.name \n          AND a.collectionId = ?\n      LEFT JOIN stig s \n          ON jt.benchmarkId COLLATE utf8mb4_0900_ai_ci = s.benchmarkId COLLATE utf8mb4_0900_ai_ci\n      LEFT JOIN collection_label cl \n          ON jt.labelName = cl.name \n          AND cl.collectionId = ?\n  )\n  SELECT\n      'name exists' AS failure, \n      JSON_OBJECT('assetIndex', positionA, 'name', name) AS detail\n  FROM cteFails\n  WHERE name IS NOT NULL AND matchedName IS NOT NULL\n\n  UNION\n\n  SELECT\n      'unknown benchmarkId', \n      JSON_OBJECT('assetIndex', positionA, 'name', name, 'benchmarkIdIndex', positionB, 'benchmarkId', benchmarkId)\n  FROM cteFails\n  WHERE benchmarkId IS NOT NULL AND matchedBenchmarkId IS NULL AND matchedName IS NULL\n\n  UNION\n\n  SELECT\n      'unknown labelName', \n      JSON_OBJECT('assetIndex', positionA, 'name', name, 'labelIndex', positionL, 'labelName', labelName)\n  FROM cteFails\n  WHERE labelName IS NOT NULL AND matchedClId IS NULL AND matchedName IS NULL\n  `\n\n  const [results] = await _this.pool.query(validationQuery, [assetJson, collectionId, collectionId])\n\n  return results  \n}\n\nmodule.exports.pruneCollectionRevMap = async function (connection) {\n  const sql = `delete crm from collection_rev_map crm\n  left join( select distinct a.collectionId, sa.benchmarkId from stig_asset_map sa left join enabled_asset a using (assetId)) maps using (collectionId, benchmarkId)\n  where maps.collectionId is null`\n  await (connection ?? _this.pool).query(sql)\n}\n\nmodule.exports.updateDefaultRev = async function (connection, {collectionId, collectionIds, benchmarkId}) {\n  const predicates = []\n  const binds = []\n  let whereClause = ''\n  if (collectionId) {\n    predicates.push(`collectionId = ?`)\n    binds.push(collectionId)\n  }\n  if (collectionIds) {\n    predicates.push(`collectionId IN ?`)\n    binds.push([collectionIds])\n  }\n  if (benchmarkId) {\n    predicates.push(`benchmarkId = ?`)\n    binds.push(benchmarkId)\n  }\n  if (predicates.length > 0) {\n    whereClause = `where  ${predicates.join(' and ')}`\n  }\n  const sqlDelete = `DELETE FROM default_rev ${whereClause}`\n  const sqlInsert = `INSERT INTO default_rev(collectionId, benchmarkId, revId, revisionPinned) SELECT collectionId, benchmarkId, revId, revisionPinned FROM v_default_rev ${whereClause}`\n  await (connection ?? _this.pool).query(sqlDelete, binds)\n  await (connection ?? _this.pool).query(sqlInsert, binds)\n  \n}\n\nmodule.exports.jsonArrayAggDistinct = function (valueStr) {\n  return `cast(concat('[', group_concat(distinct ${valueStr}), ']') as json)`\n}\n\nmodule.exports.jsonArrayAgg = function ({value, orderBy = '', distinct = false}) {\n  return `cast(concat('[', group_concat(${distinct ? 'distinct ' : ''}${value} ${orderBy ? `order by ${orderBy}` : ''}), ']') as json)`\n}\n\nmodule.exports.sqlGrantees = function ({collectionId, collectionIds, userId, username, nameMatch, includeColumnCollectionId = true, returnCte = false}) {\n  const predicates = {\n    statements: [],\n    binds: []\n  }\n  if (collectionId) {\n    predicates.statements.push('cg.collectionId = ?')\n    predicates.binds.push(collectionId)\n  }\n  if (collectionIds) {\n    predicates.statements.push('cg.collectionId IN (?)')\n    predicates.binds.push(collectionIds)\n  }\n  if (userId) {\n    predicates.statements.push('ud.userId = ?')\n    predicates.binds.push(userId)\n  }\n  if (username) {\n    let matchStr = '= ?'\n    if ( nameMatch && nameMatch !== 'exact') {\n      matchStr = 'LIKE ?'\n      switch (nameMatch) {\n        case 'startsWith':\n          username = `${username}%`\n          break\n        case 'endsWith':\n          username = `%${username}`\n          break\n        case 'contains':\n          username = `%${username}%`\n          break\n      }\n    }\n    predicates.statements.push(`ud.username ${matchStr}`)\n    predicates.binds.push(username)\n  }\n\n  // final query will be a UNION of sqlDirectGrants and sqlGroupGrants\n  const sqlDirectGrants = `select \n  ${includeColumnCollectionId ? 'cg.collectionId,' : ''}\n  cast(cg.userId as char) as userId,\n  cg.roleId,\n  json_array(json_object('userId', cast(ud.userId as char),'username', ud.username)) as grantees,\n  json_array(cg.grantId) as grantIds\nfrom\n  collection_grant cg\n  inner join enabled_collection c on (cg.collectionId = c.collectionId)\n  left join user_data ud on cg.userId = ud.userId\nwhere\n    cg.userId is not null\n    ${predicates.statements.length ? `and ${predicates.statements.join(' and ')}` : ''}`\n  const sqlFormattedDirectGrants = mysql.format(sqlDirectGrants, predicates.binds)\n\n  const sqlGroupGrants = `select\n  ${includeColumnCollectionId ? 'collectionId,' : ''}\n  userId,\n  roleId,\n  grantees,\n  grantIds\nfrom\n  (select\n    ROW_NUMBER() OVER(PARTITION BY ugu.userId, cg.collectionId ORDER BY cg.roleId desc) as rn,\n    ${includeColumnCollectionId ? 'cg.collectionId,' : ''} \n    cast(ugu.userId as char) as userId, \n    cg.roleId,\n    json_arrayagg(json_object('userGroupId', cast(cg.userGroupId as char),'name', ug.name)) OVER (PARTITION BY ugu.userId, cg.collectionId, cg.roleId) as grantees,\n    json_arrayagg(cg.grantId) OVER (PARTITION BY ugu.userId, cg.collectionId, cg.roleId) as grantIds\nfrom \n    collection_grant cg\n    inner join enabled_collection c on cg.collectionId = c.collectionId\n    left join user_group_user_map ugu on cg.userGroupId = ugu.userGroupId\n    left join user_group ug on ugu.userGroupId = ug.userGroupId\n    left join user_data ud on ugu.userId = ud.userId\n    left join collection_grant cgDirect on (cg.collectionId = cgDirect.collectionId and ugu.userId = cgDirect.userId)\n  where\n    cg.userGroupId is not null\n    and cgDirect.userId is null\n    ${predicates.statements.length ? `and ${predicates.statements.join(' and ')}` : ''}\n  ) dt\nwhere\n  dt.rn = 1`\n  const sqlFormattedGroupGrants = mysql.format(sqlGroupGrants, predicates.binds)\n\n  const sqlFormatted = `${sqlFormattedDirectGrants} union ${sqlFormattedGroupGrants}`\n  return returnCte ? `cteGrantees as (${sqlFormatted})` : sqlFormatted\n}\n\nmodule.exports.cteAclEffective = function ({grantIds = [], includeColumnCollectionId = true, inClauseTable = 'cteGrantees', inClauseColumn = 'grantIds', inClauseUserId = ''}) {\n  const inClause = grantIds.length ? '?' : `select jt.grantId from ${inClauseTable} left join json_table (${inClauseTable}.${inClauseColumn}, '$[*]' COLUMNS (grantId INT PATH '$')) jt on true${inClauseUserId ? ` where ${inClauseTable}.userId = ${inClauseUserId}` : ''}`\n  const sql = `cteAclRules as (select${includeColumnCollectionId ? ' a.collectionId,' : ''}\n\tsa.saId,\n\tcga.access,\n\tcase when cga.benchmarkId is not null then 1 else 0 end +\n\t  case when cga.assetId is not null then 1 else 0 end +\n\t  case when cga.assetId is not null and cga.benchmarkId is not null then 1 else 0 end +\n\t  case when cga.clId is not null then 1 else 0 end as specificity\nfrom\n\tcollection_grant_acl cga\n  left join collection_grant cg on cga.grantId = cg.grantId\n\tleft join collection_label_asset_map cla on cga.clId = cla.clId\n  left join collection_label cl on cla.clId = cl.clId\n\tinner join stig_asset_map sa on (\n\t  case when cga.assetId is not null \n\t\tthen cga.assetId = sa.assetId \n\t\telse true\n\t  end and \n\t  case when cga.benchmarkId is not null \n\t\tthen cga.benchmarkId = sa.benchmarkId\n\t\telse true\n\t  end and\n\t  case when cga.clId is not null \n\t\tthen cla.assetId = sa.assetId\n\t\telse true\n\t  end)\n\tinner join enabled_asset a on sa.assetId = a.assetId and cg.collectionId = a.collectionId\nwhere\n\tcga.grantId in (${inClause})\n),\ncteAclRulesRanked as (\n    select /*+ NO_MERGE() */ ${includeColumnCollectionId ? ' collectionId,' : ''}\n\t\tsaId,\n    access,\n\t\trow_number() over (partition by saId order by specificity desc, access asc) as rn\n\tfrom \n\t\tcteAclRules),\ncteAclEffective as (select${includeColumnCollectionId ? ' collectionId,' : ''} saId, access from cteAclRulesRanked where rn = 1 and access != 'none')`\n\n  const sqlFormatted = mysql.format(sql, [grantIds])\n  return sqlFormatted\n}\n\nmodule.exports.selectInvalidUserIds = async function (userIds) {\n  const sql = `select jt.inUserId as userId,ud.status from\nJSON_TABLE(?,'$[*]' COLUMNS( inUserId INT PATH '$')) as jt\nleft join user_data ud on jt.inUserId = ud.userId\nwhere ud.userId is null or ud.status='unavailable'`\n  const [results] = await _this.pool.query(sql, [JSON.stringify(userIds)])\n  return results\n}\n"
  },
  {
    "path": "api/source/specification/log-socket.yaml",
    "content": "asyncapi: 3.0.0\ninfo:\n  title: Log Stream WebSocket API\n  version: 1.0.0\n  description: |\n    WebSocket API for streaming log messages with token-based authentication.\n    Provides real-time log streaming after successful JWT token authorization.\n    \n    Stream Control:\n    - Clients must send 'stream-start' command to begin receiving log messages\n    - Clients can send 'stream-stop' command to stop receiving log messages\n    - Only authorized clients can send stream control commands\n  contact:\n    name: STIG Manager Team\n  license:\n    name: MIT\n\nservers:\n  development:\n    host: localhost:64001\n    protocol: ws\n    description: Development log stream server\n    pathname: /socket/log-socket\n\nchannels:\n  logStream:\n    address: /socket/log-socket\n    messages:\n      AuthorizeRequest:\n        $ref: '#/components/messages/AuthorizeRequest'\n      AuthorizeResponse:\n        $ref: '#/components/messages/AuthorizeResponse'\n      LogMessage:\n        $ref: '#/components/messages/LogMessage'\n      ErrorMessage:\n        $ref: '#/components/messages/ErrorMessage'\n      InfoMessage:\n        $ref: '#/components/messages/InfoMessage'\n      CloseMessage:\n        $ref: '#/components/messages/CloseMessage'\n      CommandMessage:\n        $ref: '#/components/messages/CommandMessage'\n\noperations:\n  receiveAuthorizeResponse:\n    action: receive\n    channel:\n      $ref: '#/channels/logStream'\n    messages:\n      - $ref: '#/channels/logStream/messages/AuthorizeResponse'\n    description: Server receives authorization tokens from clients\n\n  sendAuthorizeRequest:\n    action: send\n    channel:\n      $ref: '#/channels/logStream'\n    messages:\n      - $ref: '#/channels/logStream/messages/AuthorizeRequest'\n    description: Server sends authorization prompts or token expiration notices\n\n  sendLog:\n    action: send\n    channel:\n      $ref: '#/channels/logStream'\n    messages:\n      - $ref: '#/channels/logStream/messages/LogMessage'\n    description: Server sends log messages to authorized clients after receiving stream-start command\n\n  sendError:\n    action: send\n    channel:\n      $ref: '#/channels/logStream'\n    messages:\n      - $ref: '#/channels/logStream/messages/ErrorMessage'\n    description: Server sends error messages\n\n  sendInfo:\n    action: send\n    channel:\n      $ref: '#/channels/logStream'\n    messages:\n      - $ref: '#/channels/logStream/messages/InfoMessage'\n    description: Server sends informational messages\n\n  sendClose:\n    action: send\n    channel:\n      $ref: '#/channels/logStream'\n    messages:\n      - $ref: '#/channels/logStream/messages/CloseMessage'\n    description: Server sends close notification before terminating connection\n\n  receiveCommand:\n    action: receive\n    channel:\n      $ref: '#/channels/logStream'\n    messages:\n      - $ref: '#/channels/logStream/messages/CommandMessage'\n    description: Server receives stream control commands from authorized clients (stream-start, stream-stop)\n\ncomponents:\n  messages:\n    AuthorizeRequest:\n      name: authorize\n      title: Authorization Request\n      summary: Server requests authorization or notifies of token expiration\n      payload:\n        $ref: '#/components/schemas/AuthorizeRequestPayload'\n      examples:\n        - name: initialRequest\n          payload:\n            type: authorize\n            data: null\n        - name: tokenExpired\n          payload:\n            type: authorize\n            data: \"token expired\"\n\n    LogMessage:\n      name: log\n      title: Log Message\n      summary: Server sends log data to authorized clients\n      payload:\n        $ref: '#/components/schemas/LogMessagePayload'\n      examples:\n        - name: transactionLog\n          payload:\n            type: log\n            data:\n              timestamp: \"2025-09-03T10:30:00Z\"\n              level: 3\n              component: \"rest\"\n              type: \"transaction\"\n              message: \"API request processed\"\n\n    ErrorMessage:\n      name: error\n      title: Error Message\n      summary: Server sends error information\n      payload:\n        $ref: '#/components/schemas/ErrorMessagePayload'\n      examples:\n        - name: authError\n          payload:\n            type: error\n            data: \"Authorization failed: missing token\"\n        - name: unexpectedMessage\n          payload:\n            type: error\n            data: \"Unexpected message type\"\n\n    InfoMessage:\n      name: info\n      title: Info Message\n      summary: Server sends informational messages\n      payload:\n        $ref: '#/components/schemas/InfoMessagePayload'\n      examples:\n        - name: authSuccess\n          payload:\n            type: info\n            data: \"Authorization successful\"\n\n    CloseMessage:\n      name: close\n      title: Close Message\n      summary: Server notifies client before closing connection\n      payload:\n        $ref: '#/components/schemas/CloseMessagePayload'\n      examples:\n        - name: closing\n          payload:\n            type: close\n            data: \"Closing connection\"\n\n    CommandMessage:\n      name: command\n      title: Command Message\n      summary: Client sends stream control commands to server\n      description: |\n        Clients can send the following commands to control log streaming:\n        - `stream-start`: Begin receiving log messages (requires authorization). Optionally include filters to limit which logs are streamed.\n        - `stream-stop`: Stop receiving log messages\n      payload:\n        $ref: '#/components/schemas/CommandMessagePayload'\n      examples:\n        - name: streamStart\n          summary: Start log streaming\n          payload:\n            type: command\n            data:\n              command: \"stream-start\"\n        - name: streamStartWithFilter\n          summary: Start log streaming with filters\n          payload:\n            type: command\n            data:\n              command: \"stream-start\"\n              filter:\n                logLevels: [1, 2]\n                components: [\"rest\"]\n        - name: streamStop\n          summary: Stop log streaming\n          payload:\n            type: command\n            data:\n              command: \"stream-stop\"\n\n    AuthorizeResponse:\n      name: authorize\n      title: Authorization Response\n      summary: Client sends JWT token for authorization\n      payload:\n        $ref: '#/components/schemas/AuthorizeResponsePayload'\n      examples:\n        - name: tokenAuth\n          payload:\n            type: authorize\n            data:\n              token: \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...\"\n\n\n  schemas:\n    AuthorizeRequestPayload:\n      type: object\n      properties:\n        type:\n          const: authorize\n        data:\n          type: object\n          description: Authorization state notice\n          properties:\n            state:\n              type: string\n              enum: [\"unauthorized\", \"authorized\"]\n            reason:\n              type: string\n              description: Optional reason for unauthorized state (e.g., \"token expired\")\n          required:\n            - state\n          additionalProperties: false\n    AuthorizeResponsePayload:\n      type: object\n      properties:\n        type:\n          const: authorize\n        data:\n          type: object\n          required:\n            - token\n          properties:\n            token:\n              type: string\n              description: JWT token for authentication\n          additionalProperties: false\n\n    LogMessagePayload:\n      type: object\n      properties:\n        type:\n          const: log\n        data:\n          type: object\n          description: Log entry object with timestamp, level, component, etc.\n          additionalProperties: true\n\n    ErrorMessagePayload:\n      type: object\n      properties:\n        type:\n          const: error\n        data:\n          type: string\n          description: Error description\n\n    InfoMessagePayload:\n      type: object\n      properties:\n        type:\n          const: info\n        data:\n          type: object\n          description: Informational message\n\n    CloseMessagePayload:\n      type: object\n      properties:\n        type:\n          const: close\n        data:\n          type: string\n          description: Close reason\n\n    CommandMessagePayload:\n      type: object\n      properties:\n        type:\n          const: command\n        data:\n          oneOf:\n            - $ref: '#/components/schemas/StreamStartCommandData'\n            - $ref: '#/components/schemas/StreamStopCommandData'\n\n    StreamStartCommandData:\n      type: object\n      required:\n        - command\n      properties:\n        command:\n          const: \"stream-start\"\n          description: Instructs the server to begin sending log messages to this client. Client must be authorized.\n        filter:\n          type: object\n          description: Optional filter criteria. Only logs matching the filter will be sent.\n          properties:\n            level:\n              type: array\n              items:\n                type: integer\n                minimum: 1\n                maximum: 4\n              description: Array of log levels to include (e.g., [1, 2] for error and warn levels)\n              uniqueItems: true\n            component:\n              type: array\n              items:\n                type: string\n              description: Array of component names to include (e.g., [\"rest\", \"auth\"])\n              uniqueItems: true\n          additionalProperties: false\n      additionalProperties: false\n\n    StreamStopCommandData:\n      type: object\n      required:\n        - command\n      properties:\n        command:\n          const: \"stream-stop\"\n          description: Instructs the server to stop sending log messages to this client.\n      additionalProperties: false\n"
  },
  {
    "path": "api/source/specification/stig-manager.yaml",
    "content": "openapi: 3.0.1\ninfo:\n  title: STIG Manager API\n  description: An API for managing evaluations of Security Technical Implementation Guide (STIG) assessments.\n  contact:\n    name: STIG Manager OSS Project\n    url: https://github.com/NUWCDIVNPT/stig-manager\n  version: 'v1'\nservers:\n  - url: 'http://localhost:64001/api'\npaths:\n  /assets:\n    get:\n      tags:\n        - Asset\n      summary: Return a list of Assets accessible to the requester\n      operationId: getAssets\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdQuery'\n        - $ref: '#/components/parameters/LabelIdQuery'\n        - $ref: '#/components/parameters/LabelNameQuery'\n        - $ref: '#/components/parameters/LabelMatchQuery'\n        - $ref: '#/components/parameters/NameQuery'\n        - $ref: '#/components/parameters/NameMatchQuery'\n        - $ref: '#/components/parameters/MetadataQuery'\n        - $ref: '#/components/parameters/BenchmarkIdQuery'\n        - $ref: '#/components/parameters/AssetProjectionQuery'\n      responses:\n        '200':\n          description: AssetProjected array response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/AssetProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    post:\n      tags:\n        - Asset\n      summary: Create an Asset\n      operationId: createAsset\n      parameters:\n        - $ref: '#/components/parameters/AssetProjectionQuery'\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/AssetCreateOrReplace'\n      responses:\n        '201':\n          description: AssetProjected response\n          content:\n            application/json:\n              schema:\n               $ref: '#/components/schemas/AssetProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n        '422':\n          description: Unprocessable Entity\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/ClientErrorBadAssetPost'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    patch:\n      tags:\n        - Asset\n      summary: Delete one or more Assets\n      operationId: patchAssets\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdQuery'\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/AssetsPatchRequest'\n      responses:\n        '200':\n          description: AssetsPatch response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/AssetsPatchResponse'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/assets/{assetId}':\n    parameters:\n      - $ref: '#/components/parameters/AssetIdPath'\n      - $ref: '#/components/parameters/AssetProjectionQuery'\n    get:\n      tags:\n        - Asset\n      summary: Return an Asset\n      operationId: getAsset\n      responses:\n        '200':\n          description: AssetProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/AssetProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    patch:\n      tags:\n        - Asset\n      summary: Merge provided properties with an Asset\n      operationId: updateAsset\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/AssetUpdate'\n      responses:\n        '200':\n          description: AssetProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/AssetProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    put:\n      tags:\n        - Asset\n      summary: Set all properties of an Asset\n      operationId: replaceAsset\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/AssetCreateOrReplace'\n      responses:\n        '200':\n          description: AssetProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/AssetProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    delete:\n      tags:\n        - Asset\n      summary: Delete an Asset\n      operationId: deleteAsset\n      responses:\n        '200':\n          description: AssetProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/AssetProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/assets/{assetId}/checklists':\n    parameters:\n      - $ref: '#/components/parameters/AssetIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - name: format\n        in: query\n        description: The format of the response.\n        schema:\n          type: string\n          default: ckl\n          enum:\n            - ckl\n            - cklb\n    get:\n      tags:\n        - Asset\n      summary: Return a multi-STIG CKL for an Asset and its mapped STIGs\n      operationId: getChecklistByAsset\n      responses:\n        '200':\n          description: Review response\n          content:\n            application/xml:\n              schema:\n                $ref: '#/components/schemas/ChecklistCkl'\n            application/json:\n              schema:\n                $ref: '#/components/schemas/ChecklistCklb'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/assets/{assetId}/checklists/{benchmarkId}/{revisionStr}':\n    parameters:\n      - $ref: '#/components/parameters/AssetIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdPath'\n      - $ref: '#/components/parameters/RevisionStrPath'\n    get:\n      tags:\n        - Asset\n      summary: Return JSON summary, or CKL(B) file, or XCCDF file for an Asset and STIG\n      operationId: getChecklistByAssetStig\n      parameters:\n        - name: format\n          in: query\n          description: The format of the response.\n          schema:\n            type: string\n            default: json\n            enum:\n              - json\n              - json-access\n              - ckl\n              - cklb\n              - xccdf\n        - name: projection\n          in: query\n          description: Additional fields to include in JSON checklist responses.\n          schema:\n            type: array\n            items:\n              type: string\n              enum:\n                - rule\n                - detail\n                - comment\n          style: form\n          explode: true\n      responses:\n        '200':\n          description: A JSON array of Checklist summary items or a CKL\n          content:\n            application/json:\n              schema:\n                oneOf:\n                  - $ref: '#/components/schemas/ChecklistAssetStig'\n                  - $ref: '#/components/schemas/ChecklistJsonAccess'\n                  - $ref: '#/components/schemas/ChecklistCklb'\n            application/xml:\n              schema:\n                oneOf:\n                  - $ref: '#/components/schemas/ChecklistCkl'\n                  - $ref: '#/components/schemas/ChecklistXccdf'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/assets/{assetId}/metadata':\n    parameters:\n      - $ref: '#/components/parameters/AssetIdPath'\n    get:\n      tags:\n        - Asset\n      summary: Return the metadata for Asset\n      operationId: getAssetMetadata\n      responses:\n        '200':\n          description: Metadata response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Metadata'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    patch:\n      tags:\n        - Asset\n      summary: Merge the provided object to a Assetmetadata\n      operationId: patchAssetMetadata\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/Metadata'\n      responses:\n        '200':\n          description: Metadata response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Metadata'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    put:\n      tags:\n        - Asset\n      summary: Set a Asset metadata to the provided object\n      operationId: putAssetMetadata\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/Metadata'\n      responses:\n        '200':\n          description: Metadata response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Metadata'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/assets/{assetId}/metadata/keys':\n    parameters:\n      - $ref: '#/components/parameters/AssetIdPath'\n    get:\n      tags:\n        - Asset\n      summary: Return the keys of the provided Asset's metadata\n      operationId: getAssetMetadataKeys\n      responses:\n        '200':\n          description: MetadataKeys response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetadataKey'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/assets/{assetId}/metadata/keys/{key}':\n    parameters:\n      - $ref: '#/components/parameters/AssetIdPath'\n      - $ref: '#/components/parameters/MetadataKeyPath'\n    get:\n      tags:\n        - Asset\n      summary: Return the value of the provided Asset metadata key\n      operationId: getAssetMetadataValue\n      responses:\n        '200':\n          description: MetadataValue response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/MetadataValue'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    put:\n      tags:\n        - Asset\n      summary: Set the value of the provided Asset metadata key to the provided string\n      operationId: putAssetMetadataValue\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/MetadataValue'\n      responses:\n        '204':\n          description: Empty to avoid large response after putting key with large value\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    delete:\n      tags:\n        - Asset\n      summary: Remove the provided Asset metadata key\n      operationId: deleteAssetMetadataKey\n      responses:\n        '204':\n          description: Empty to avoid large response after deleting key with large value\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/assets/{assetId}/stigs':\n    parameters:\n      - $ref: '#/components/parameters/AssetIdPath'\n    get:\n      tags:\n        - Asset\n      summary: Return an Asset's STIG assignments\n      operationId: getStigsByAsset\n      responses:\n        '200':\n          description: STIG array response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/AssetStigResponse'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    # put:\n    #   tags:\n    #     - Asset\n    #   summary: UNIMPLEMENTED Set all the STIG assignments of an Asset\n    #   operationId: attachStigsToAsset\n    #   requestBody:\n    #     required: true\n    #     content:\n    #       application/json:\n    #         schema:\n    #           type: array\n    #           minItems: 1\n    #           items:\n    #             type: string\n    #   responses:\n    #     '200':\n    #       description: Asset response\n    #       content:\n    #         application/json:\n    #           schema:\n    #             $ref: '#/components/schemas/Asset'\n    #     default:\n    #       description: unexpected error\n    #       content:\n    #         application/json:\n    #           schema:\n    #             $ref: '#/components/schemas/Error'\n    #   security:\n    #     - oauth:\n    #         - 'stig-manager:collection'\n    delete:\n      tags:\n        - Asset\n      summary: Delete all STIG assignments to an Asset\n      operationId: removeStigsFromAsset\n      responses:\n        '200':\n          description: STIG array response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/STIG'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/assets/{assetId}/stigs/{benchmarkId}':\n    parameters:\n      - $ref: '#/components/parameters/AssetIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdPath'\n    put:\n      tags:\n        - Asset\n      summary: Assign a STIG to an Asset\n      operationId: attachStigToAsset\n      responses:\n        '200':\n          description: STIG array response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/AssetStigResponse'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    delete:\n      tags:\n        - Asset\n      summary: Delete a STIG assignment to an Asset\n      operationId: removeStigFromAsset\n      responses:\n        '200':\n          description: STIG array response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/AssetStigResponse'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  /collections:\n    parameters:\n      - $ref: '#/components/parameters/ElevateQuery'\n    get:\n      tags:\n        - Collection\n      summary: Return a list of Collections accessible to the requester\n      description: ''\n      operationId: getCollections\n      parameters:\n        - $ref: '#/components/parameters/NameQuery'\n        - $ref: '#/components/parameters/NameMatchQuery'\n        - $ref: '#/components/parameters/MetadataQuery'\n        - $ref: '#/components/parameters/CollectionsProjectionQuery'\n      responses:\n        '200':\n          description: CollectionsProjected response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/CollectionsProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    post:\n      tags:\n        - Collection\n      summary: Create a Collection\n      description: |\n        The `settings` property is optional and can be partially provided.\n        - If `settings` is not provided, the Collection will be created with the default settings.\n\n        The default settings are:\n        ```\n         {\n            fields: {\n              detail: {\n                enabled: 'always',\n                required: 'always'\n              },\n              comment: {\n                enabled: 'findings',\n                required: 'findings'\n              }\n            },\n            status: {\n              canAccept: true,\n              resetCriteria: 'result',\n              minAcceptGrant: 3\n            },\n            history: {\n              maxReviews: 5\n            }\n            importOptions: {\n              autoStatus: 'saved',\n              unreviewed: 'commented',\n              unreviewedCommented: 'informational',\n              emptyDetail: 'replace',\n              emptyComment: 'ignore',\n              updateAssetProps: false,\n              allowCustom: true\n            }\n        ```\n      operationId: createCollection\n      parameters:\n        - $ref: '#/components/parameters/CollectionProjectionQuery'\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/CollectionCreateOrReplace'\n      responses:\n        '201':\n          description: CollectionProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/CollectionProjected'\n        '400':\n          description: Client Error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/ClientErrorDuplicateCollection'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}':\n    parameters:\n      - $ref: '#/components/parameters/ElevateQuery'\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/CollectionProjectionQuery'\n    get:\n      tags:\n        - Collection\n      summary: Return a Collection\n      description: ''\n      operationId: getCollection\n      responses:\n        '200':\n          description: CollectionProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/CollectionProjected'\n        '204':\n          description: No Content\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    patch:\n      tags:\n        - Collection\n      summary: Merge provided properties with a Collection\n      operationId: updateCollection\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/CollectionUpdate'\n      responses:\n        '200':\n          description: CollectionProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/CollectionProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    put:\n      tags:\n        - Collection\n      summary: Set all properties of a Collection\n      description: |\n        See the description of path `POST /collections` for notes about the `settings` property\n      operationId: replaceCollection\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/CollectionCreateOrReplace'\n      responses:\n        '200':\n          description: CollectionProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/CollectionProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    delete:\n      tags:\n        - Collection\n      summary: Delete a Collection\n      operationId: deleteCollection\n      responses:\n        '200':\n          description: CollectionProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/CollectionProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/archive/ckl':\n    post:\n      tags:\n        - Collection\n      summary: Return a ZIP archive containing CKL files for the supplied Assets and STIGs\n      operationId: postCklArchiveByCollection\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdPath'\n        - $ref: '#/components/parameters/CklModeQuery'\n      requestBody:\n        required: true\n        description: An array of '#/components/schemas/AssetStigSelection'.\n        content:\n          application/json:\n            schema:\n              type: array\n              minItems: 1\n              uniqueItems: true\n              items:\n                $ref: '#/components/schemas/AssetStigSelection'\n      responses:\n        '200':\n          description: ZIP file stream\n          content:\n            application/zip:\n              schema:\n                type: string\n                format: binary\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n\n  '/collections/{collectionId}/archive/cklb':\n    post:\n      tags:\n        - Collection\n      summary: Return a ZIP archive containing CKLB files for the supplied Assets and STIGs\n      operationId: postCklbArchiveByCollection\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdPath'\n        - $ref: '#/components/parameters/CklModeQuery'\n      requestBody:\n        required: true\n        description: An array of '#/components/schemas/AssetStigSelection'.\n        content:\n          application/json:\n            schema:\n              type: array\n              minItems: 1\n              uniqueItems: true\n              items:\n                $ref: '#/components/schemas/AssetStigSelection'\n      responses:\n        '200':\n          description: ZIP file stream\n          content:\n            application/zip:\n              schema:\n                type: string\n                format: binary\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/assets':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n    post:\n      tags:\n        - Asset\n        - Collection\n      summary: Create Multiple Assets\n      operationId: createAssets\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdPath'\n        - $ref: '#/components/parameters/AssetProjectionQuery'\n        - $ref: '#/components/parameters/DryRunQuery'\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/AssetCreateBatch'\n      responses:\n        '200':\n          description: Dry Run Failure\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/ClientErrorBadAssetPost'\n        '201':\n          description: Array of AssetProjected responses\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/AssetProjected'\n        '204':\n          description: Dry run successful. Validation passed, but no data was persisted.\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/archive/xccdf':\n    post:\n      tags:\n        - Collection\n      summary: Return a ZIP archive containing XCCDF results for the supplied Assets and STIGs\n      operationId: postXccdfArchiveByCollection\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdPath'\n      requestBody:\n        required: true\n        description: An array of '#/components/schemas/AssetStigSelection'.\n        content:\n          application/json:\n            schema:\n              type: array\n              minItems: 1\n              items:\n                $ref: '#/components/schemas/AssetStigSelection'\n      responses:\n        '200':\n          description: ZIP file stream\n          content:\n            application/zip:\n              schema:\n                type: string\n                format: binary\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/checklists/{benchmarkId}/{revisionStr}':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdPath'\n      - $ref: '#/components/parameters/RevisionStrPath'\n    get:\n      tags:\n        - Collection\n      summary: Return the Checklist for the supplied Collection and STIG\n      operationId: getChecklistByCollectionStig\n      responses:\n        '200':\n          description: ChecklistCollectionStig response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/ChecklistCollectionStig'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/clone':\n    post:\n      tags:\n        - Collection\n      summary: Clone an existing Collection to a new Collection\n      description: |\n        Cloning large Collections can take several minutes! Users may see a performance impact when accessing the source Collection during this time.<br><br>Making changes to the source Collection while it is being cloned may lead to inconsistent results in the cloned Collection.<br><br><b>Before proceeding, it is recommended you warn Users that they refrain from modifying components of the source Collection while the cloning process is underway.</b>\n      operationId: cloneCollection\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdPath'\n        - $ref: '#/components/parameters/CollectionProjectionQuery'\n      requestBody:\n        required: true\n        description: CollectionClone request body\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/CollectionCloneRequest'\n      responses:\n        '200':\n          description: See the description for '#/components/schemas/CollectionCloneResponse'\n          content:\n            application/x-ndjson:\n              schema:\n                $ref: '#/components/schemas/CollectionCloneResponse'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/export-to/{dstCollectionId}':\n    post:\n      tags:\n        - Collection\n      summary: Export reviews from a source Collection to a destination Collection\n      description: |\n        Exports reviews (result, detail and comment) from a `srcCollection` to a `dstCollection`, creating Assets in `dstCollection` if they do not exist. The `status` property of existing reviews in `dstCollection` are reset, if necessary, in accordance with the Collection settings.\n      operationId: exportToCollection\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdPath'\n        - $ref: '#/components/parameters/DstCollectionIdPath'\n      requestBody:\n        required: true\n        description: An array of '#/components/schemas/AssetStigSelection'. <b>The number of array items must conform to the minItems/maxItems properties</b>\n        content:\n          application/json:\n            schema:\n              type: array\n              minItems: 1\n              maxItems: 100\n              uniqueItems: true\n              items:\n                $ref: '#/components/schemas/AssetStigSelection'\n      responses:\n        '200':\n          description: See the description for '#/components/schemas/CollectionExportToResponse'\n          content:\n            application/x-ndjson:\n              schema:\n                $ref: '#/components/schemas/CollectionExportToResponse'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/findings':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/FindingAggregatorQuery'\n      - name: acceptedOnly\n        in: query\n        schema:\n          type: boolean\n          default: false\n      - $ref: '#/components/parameters/BenchmarkIdQuery'\n      - $ref: '#/components/parameters/AssetIdQuery'\n      - $ref: '#/components/parameters/FindingProjectionQuery'\n    get:\n      tags:\n        - Collection\n      summary: Return the Findings for the specified Collection\n      operationId: getFindingsByCollection\n      responses:\n        '200':\n          description: CollectionFinding response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/FindingProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n\n  '/collections/{collectionId}/grants':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/ElevateQuery'\n    get:\n      tags:\n        - Collection\n      summary: Return all collection grants\n      operationId: getGrantsByCollection\n      responses:\n        '200':\n          description: Collection Grant array response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/Grant'     \n        '403':\n          $ref: '#/components/responses/Forbidden'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    post:\n      tags:\n        - Collection\n      summary: Add Grants to a Collection\n      operationId: postGrantsByCollection\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              type: array\n              items:\n                $ref: '#/components/schemas/GrantPost' \n      responses:\n        '201':\n          description: Collection grant array response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/Grant'      \n        '403':\n          $ref: '#/components/responses/Forbidden'  \n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  \n  '/collections/{collectionId}/grants/{grantId}':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/GrantIdPath'\n      - $ref: '#/components/parameters/ElevateQuery'\n    get:\n      tags:\n        - Collection\n      summary: Return a collection grant by grantId\n      operationId: getGrantByCollectionGrant\n      responses:\n        '200':\n          description: Collection StigAssetBasic array response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Grant'     \n        '403':\n          $ref: '#/components/responses/Forbidden'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    put:\n      tags:\n        - Collection\n      summary: Replace the properties of a Collection Grant by grantId.\n      operationId: putGrantByCollectionGrant\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              oneOf:\n                - $ref: '#/components/schemas/UserGrant'\n                - $ref: '#/components/schemas/UserGroupGrant'\n      responses:\n        '200':\n          description: Collection grant array response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Grant'     \n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    delete:\n      tags:\n        - Collection\n      operationId: deleteGrantByCollectionGrant\n      responses:\n        '200':\n          description: UserGrantEffective response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Grant'\n        '403':\n          $ref: '#/components/responses/Forbidden'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/grants/{grantId}/acl':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/GrantIdPath'\n    get:\n      tags:\n        - Collection\n      summary: Return the Access Control List for the specified Collection Grant.\n      operationId: getAclRulesByCollectionGrant\n      responses:\n        '200':\n          description: Collection AclRuleAssetBasic array response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/AclForGrant'\n        '403':\n          $ref: '#/components/responses/Forbidden'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    put:\n      tags:\n        - Collection\n      summary: Set the Access Control List for the specified Collection Grant.\n      operationId: putAclRulesByCollectionGrant\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              type: array\n              items:\n                $ref: '#/components/schemas/AclRulePut'\n      responses:\n        '200':\n          description: AclRuleAssetBasic array response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/AclForGrant'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'      \n  '/collections/{collectionId}/reviews':\n    get:\n      tags:\n        - Review\n      summary: Return a list of Reviews accessible to the requester\n      description: ''\n      operationId: getReviewsByCollection\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdPath'\n        - $ref: '#/components/parameters/ReviewRulesQuery'\n        - $ref: '#/components/parameters/ReviewResultQuery'\n        - $ref: '#/components/parameters/ReviewStatusQuery'\n        - $ref: '#/components/parameters/RuleIdQuery'\n        - $ref: '#/components/parameters/GroupIdQuery'\n        - $ref: '#/components/parameters/CciQuery'\n        - $ref: '#/components/parameters/UserIdQuery'\n        - $ref: '#/components/parameters/AssetIdQuery'\n        - $ref: '#/components/parameters/BenchmarkIdQuery'\n        - $ref: '#/components/parameters/MetadataQuery'\n        - $ref: '#/components/parameters/ReviewsProjectionQuery'\n      responses:\n        '200':\n          description: Review response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/ReviewRead'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    post:\n      tags:\n        - Review\n      summary: Insert, update, or merge a complete or partial Review to multiple Assets and Rules\n      description: |\n\n        Applies a complete or partial Review to multiple target Asset/Rule pairs. Depending on the Review properties supplied, new Reviews may be created, existing Reviews may be updated, or both operations may occur (similar to an SQL merge).\n\n        ## Caution\n\n        **It is possible to send a request which will place the database under considerable load and take many seconds (or minutes) to complete. To determine if a request affects a large set of Reviews, clients are strongly encouraged to send a \"preflight\" request with the `dryRun` option enabled.**\n\n        ## Request Validation\n\n        The overall request is validated as follows:\n\n        - conformance with the OAS schema for `ReviewBatch`\n        - the requesting user has been granted access to the {collectionId}\n\n        ## Request body\n\n        **source** *(required)*\n\n          The Review source is applied to the product of `assets` x `rules` (see below). It MUST contain at least one of the properties `result`, `detail`, `comment`, `resultEngine`, `metadata` or `status`.\n        - Multiple properties can be specified.\n        - a string value for the `status` property is normalized to `{ label: <string>, text: null }`\n\n\n        **assets** *(required)*\n\n        The target Assets, which are specified as either:\n          - an array of `assetId`\n          - an array of `benchmarkId` where target Assets are calculated as the list of distinct Assets assigned at least one of the given STIGs, taking into account the requesting User's collection grant.\n\n        **rules** *(required)*\n\n        The target Rules, which are specified as either:\n          - an array of `ruleId`\n          - an array of `benchmarkId` where target Rules are calculated as the list of distinct Rules from all available revisions of the given STIGs.\n\n        **action** *(optional)*\n\n        Constrains the data action to be taken. If present, the value MUST be one of `insert`, `update`, or `merge`.\n\n          - `insert`: only create new Reviews, do not update existing Reviews\n          - `update`: only update existing Reviews, do not create new Reviews\n          - `merge`: create new Reviews and update existing Reviews\n\n        If not present, the default value is:\n          \n          - `merge` if the source Review includes `result`\n          - `update` if the source Review does not include `result`   \n\n        New Reviews cannot be created when `source` does not include `result`. In that case, specifying either the `insert` or `merge` value is an error. \n\n        **updateFilters** *(optional)*\n\n        Limits the Reviews to be updated, based on an array of filtering objects. If present, updates are applied to Reviews from the product `assets` x `rules` that pass each of the filters (filters are combined with logical AND). If not present, updates are applied to each Review from the product `assets` x `rules`. \n\n        Filtering objects specify a Review `field` , a `condition`, and a `value`. See the schema definition for further details. \n\n        **dryRun** *(optional)*\n\n        If present with a `true` value, performs all processing and validation logic without actually changing any data. Useful to verify what a given request would do and to reveal any validation errors. The default value is `false`.\n\n        ## Review candidates\n\n        Candidate Reviews are created by cross joining the source Review with the product of `assets` x `rules` and applying the resulting rows to existing Reviews (if any) in accordance with the Collection settings.\n\n        **For updated Reviews** \n\n        In general, an absent source Review property will retain existing values except as below.\n\n        - an absent `status` property will either retain the existing value or update the `status` value to `{ label: \"saved\", text: \"Review change triggered status update\" }`, in accordance with the Collection `settings.status.resetCriteria`.\n        - an absent `resultEngine` property will either retain the existing value or update the `resultEngine` value to `null`. If applying the source Review changes an existing `result`, the `resultEngine` value will be set to `null`.\n\n        **For new Reviews**\n\n        - an absent `detail` or `comment` property will set the candidate value to the empty string.\n        - an absent `status` property will set the candidate value to `{ label: \"saved\", text: null }`.\n        - an absent `resultEngine` property will set the candidate value to `null`.\n        - an absent `metadata` property will set the candidate value to `{}`\n\n        ## Candidate validation\n\n        Each candidate Review is permitted or rejected as follows:\n\n        - If the requesting user's collection grant is `restricted` AND the `ruleId` is not included in any version of any `benchmarkId` for which the requesting user been granted access, then **reject** the Review.\n        - If `status.label` has value `saved`, then permit the Review.\n        - If the Review would not be submittable according to the Collection settings, then **reject** the Review\n        - If the value of `status.label` is `submitted`, then **permit** the Review.\n        - If the value of `status.label` is `accepted` or `rejected` AND the Collection settings allow Reviews to be Accepted or Rejected, then **permit** the Review.\n        - If `status.label` has value `accepted` or `rejected` AND the Collection settings prohibit Reviews from being Accepted or Rejected, then **reject** the Review.\n\n      operationId: postReviewBatch\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdPath'\n      requestBody:\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/ReviewBatch'\n      responses:\n        '200':\n          description: ReviewBatchResponse response\n          content:\n            application/json:\n              schema:\n                oneOf:\n                  - $ref: '#/components/schemas/ReviewBatchResponse'\n                  - $ref: '#/components/schemas/ReviewBatchResponseDryRun'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/reviews/{assetId}':\n    get:\n      tags:\n        - Review\n      summary: Return a list of Reviews for an Asset\n      operationId: getReviewsByAsset\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdPath'\n        - $ref: '#/components/parameters/AssetIdPath'\n        - $ref: '#/components/parameters/ReviewRulesQuery'\n        - $ref: '#/components/parameters/ReviewResultQuery'\n        - $ref: '#/components/parameters/ReviewStatusQuery'\n        - $ref: '#/components/parameters/BenchmarkIdQuery'\n        - $ref: '#/components/parameters/MetadataQuery'\n        - $ref: '#/components/parameters/ReviewsProjectionQuery'\n      responses:\n        '200':\n          description: ReviewAssetProjected response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/ReviewAsset'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    post:\n      tags:\n        - Review\n      summary: Post one or more Reviews\n      description: |\n        The request body is an array that can contain both new and updated Reviews. All Reviews MUST contain the properties `ruleId`, `result`, `detail`, and `comment`. The overall request is validated as follows:\n\n        - conformance with the OAS schema for `ReviewAssetPost`\n        - the requesting user has been granted access to the {collectionId}\n\n        **For all Reviews**\n\n        - a string value for the `status` property will set the stored value to `{ label: <string>, text: null }`\n        - an absent `resultEngine` property will set the stored value to `null`\n\n        **For updated Reviews** \n\n        - a `null` value for either `detail` or `comment` will retain the existing value.\n        - an absent `status` property will either retain the existing value or update the `status` value to `{ label: \"saved\", text: \"Review change triggered status update\" }`, in accordance with the Collection `settings.status.resetCriteria`.\n\n        **For new Reviews**\n\n        - a `null` value for either `detail` or `comment` will set the stored value to the empty string.\n        - an absent `status` property will set the stored value to `{ label: \"saved\", text: null }`.\n\n        **Each new or updated Review is permitted or rejected as follows:**\n\n        - If the requesting user's collection grant is `restricted` AND the `ruleId` is not included in any version of any `benchmarkId` for which the requesting user been granted access, then **reject** the Review\n        - If the optional property `status` is absent or `status.label` has value `saved`, then permit the Review\n        - If the new or updated Review would not be submittable according to the Collection settings, then **reject** the Review\n        - If the value of `status.label` is `submitted`, then **permit** the Review.\n        - If the value of `status.label` is `accepted` or `rejected` AND the Collection settings allow Reviews to be Accepted or Rejected, then **permit** the Review.\n        - If `status.label` has value `accepted` or `rejected` AND the Collection settings prohibit Reviews from being Accepted or Rejected, then **reject** the Review.\n      operationId: postReviewsByAsset\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdPath'\n        - $ref: '#/components/parameters/AssetIdPath'\n      requestBody:\n        content:\n          application/json:\n            schema:\n              type: array\n              minItems: 1\n              items:\n                $ref: '#/components/schemas/ReviewAssetPost'\n      responses:\n        '200':\n          description: ReviewPostResponse response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/ReviewPostResponse'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/reviews/{assetId}/{ruleId}':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/AssetIdPath'\n      - $ref: '#/components/parameters/RuleIdPath'\n      - $ref: '#/components/parameters/ReviewProjectionQuery'\n    get:\n      tags:\n        - Review\n      summary: Return the Review for an Asset and Rule\n      operationId: getReviewByAssetRule\n      responses:\n        '200':\n          description: ReviewAssetRuleRead response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/ReviewAssetRuleRead'\n        '204':\n          description: The requested resource has no content.\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    patch:\n      tags:\n        - Review\n      summary: Merge the provided properties with an existing Review\n      description: |\n        The request MUST target an existing Review and the request body MUST contain one or more Review properties. The overall request is validated as follows:\n\n        - the request body conforms with the OAS schema for `ReviewAssetRulePatch`\n        - a request body that includes `resultEngine` must also include `result`\n        - the requesting user has been granted access to the {collectionId}\n        - a Review already exists for the {assetId} and {ruleId}\n\n        A string value for the `status` property will set the stored value to `{ label: <string>, text: null }`.\n        If the request includes a `result`, then the `resultEngine` value will be set to `null` unless the request includes an explicit `resultEngine` value. \n\n        An absent `status` property may still lead to the `status` value being updated to `{ label: \"saved\", text: \"Review change triggered status update\" }`, in accordance with the Collection `settings.status.resetCriteria`.\n\n        Unlike the corresponding PUT endpoint, the `detail` and `comment` properties do not support `null` as a value.\n\n        The request is permitted or rejected as follows:\n\n        - If the requesting user's collection grant is `restricted` AND the `assetId` is not included in any user grant, then **reject** the Review\n        - If the requesting user's collection grant is `restricted` AND the `ruleId` is not included in any version of any `benchmarkId` for which the user been granted access, then **reject** the Review\n        - If the new or updated Review would not be submittable according to the Collection settings, then **reject** the Review\n        - If the value of `status.label` is `submitted`, then **permit** the Review.\n        - If the value of `status.label` is `accepted` or `rejected` AND the Collection settings allow Reviews to be Accepted or Rejected, then **permit** the Review.\n        - If `status.label` has value `accepted` or `rejected` AND the Collection settings prohibit Reviews from being Accepted or Rejected, then **reject** the Review.\n      operationId: patchReviewByAssetRule\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/ReviewAssetRulePatch'\n      responses:\n        '200':\n          description: ReviewProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/ReviewAssetRuleRead'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    put:\n      tags:\n        - Review\n      summary: Set all properties of a Review\n      description: |\n        The request can target either a new or an existing Review. The request body MUST contain the Review properties `result`, `detail`, and `comment`. The overall request is validated as follows:\n\n        - conformance with the OAS schema for `ReviewAssetRulePut`\n        - the requesting user has been granted access to the {collectionId}\n\n        **For all Reviews**\n\n        - a string value for the `status` property will set the stored value to `{ label: <string>, text: null }`\n        - an absent `resultEngine` property will set the stored value to `resultEngine: null`\n\n        **For updated Reviews** \n\n        - a `null` value for either `detail` or `comment` will retain the existing value.\n        - an absent `status` property will either retain or update the `status` value to `{ label: \"saved\", text: \"Review change triggered status update\" }`, in accordance with the Collection `settings.status.resetCriteria`.\n\n        **For new Reviews**\n\n        - a `null` value for either `detail` or `comment` will set the stored value to the empty string.\n        - an absent `status` property will set the stored value to `{ label: \"saved\", text: null }`.\n\n        The request is permitted or rejected as follows:\n\n        - If the requesting user's collection grant is `restricted` AND the `assetId` is not included in any user grant, then **reject** the Review\n        - If the requesting user's collection grant is `restricted` AND the `ruleId` is not included in any version of any `benchmarkId` for which the user been granted access, then **reject** the Review\n        - If the new or updated Review would not be submittable according to the Collection settings, then **reject** the Review\n        - If the value of `status.label` is `submitted`, then **permit** the Review.\n        - If the value of `status.label` is `accepted` or `rejected` AND the Collection settings allow Reviews to be Accepted or Rejected, then **permit** the Review.\n        - If `status.label` has value `accepted` or `rejected` AND the Collection settings prohibit Reviews from being Accepted or Rejected, then **reject** the Review.\n      operationId: putReviewByAssetRule\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/ReviewAssetRulePut'\n      responses:\n        '200':\n          description: ReviewProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/ReviewAssetRuleRead'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    delete:\n      tags:\n        - Review\n      summary: Delete a Review\n      operationId: deleteReviewByAssetRule\n      # parameters:\n      responses:\n        '200':\n          description: ReviewProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/ReviewAssetRuleRead'\n        '204':\n          description: No Content\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/reviews/{assetId}/{ruleId}/metadata':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/AssetIdPath'\n      - $ref: '#/components/parameters/RuleIdPath'\n    get:\n      tags:\n        - Review\n      summary: Return the metadata for Review\n      operationId: getReviewMetadata\n      responses:\n        '200':\n          description: Metadata response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Metadata'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    patch:\n      tags:\n        - Review\n      summary: Merge the provided object to a Review metadata\n      operationId: patchReviewMetadata\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/Metadata'\n      responses:\n        '200':\n          description: Metadata response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Metadata'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    put:\n      tags:\n        - Review\n      summary: Set a Review metadata to the provided object\n      operationId: putReviewMetadata\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/Metadata'\n      responses:\n        '200':\n          description: Metadata response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Metadata'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/reviews/{assetId}/{ruleId}/metadata/keys':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/AssetIdPath'\n      - $ref: '#/components/parameters/RuleIdPath'\n    get:\n      tags:\n        - Review\n      summary: Return the keys of the provided Review's metadata\n      operationId: getReviewMetadataKeys\n      responses:\n        '200':\n          description: MetadataKeys response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetadataKey'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/reviews/{assetId}/{ruleId}/metadata/keys/{key}':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/AssetIdPath'\n      - $ref: '#/components/parameters/RuleIdPath'\n      - $ref: '#/components/parameters/MetadataKeyPath'\n    get:\n      tags:\n        - Review\n      summary: Return the value of the provided Review metadata key\n      operationId: getReviewMetadataValue\n      responses:\n        '200':\n          description: MetadataValue response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/MetadataValue'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    put:\n      tags:\n        - Review\n      summary: Set the value of the provided Review metadata key to the provided string\n      operationId: putReviewMetadataValue\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/MetadataValue'\n      responses:\n        '204':\n          description: Empty to avoid large response after putting key with large value\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    delete:\n      tags:\n        - Review\n      summary: Remove the provided Review metadata key\n      operationId: deleteReviewMetadataKey\n      responses:\n        '204':\n          description: Empty to avoid large response after deleting key with large value\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/labels':\n    get:\n      tags:\n        - Collection\n      summary: Return labels of the specified Collection\n      operationId: getCollectionLabels\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdPath'\n      responses:\n        200:\n          description: Labels response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/Label'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    post:\n      tags:\n        - Collection\n      summary: Create a label in the specified Collection\n      operationId: createCollectionLabel\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdPath'\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/LabelCreate'\n      responses:\n        201:\n          description: Label response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Label'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/labels/batch':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n    post:\n      tags:\n        - Collection\n      summary: Create multiple labels in the specified Collection\n      operationId: createCollectionLabels\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              type: array\n              minItems: 1\n              items:\n                $ref: '#/components/schemas/LabelCreate'\n      responses:\n        201:\n          description: Labels response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/Label'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/labels/{labelId}':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/LabelIdPath'\n    get:\n      tags:\n        - Collection\n      summary: Return the specified Label of the specified Collection\n      operationId: getCollectionLabelById\n      responses:\n        200:\n          description: Labels response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Label'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    patch:\n      tags:\n        - Collection\n      summary: Update an existing Label\n      operationId: patchCollectionLabelById\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/LabelUpdate'\n      responses:\n        '200':\n          description: Label response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Label'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    delete:\n      tags:\n        - Collection\n      summary: Delete a Label\n      operationId: deleteCollectionLabelById\n      responses:\n        '204':\n          description: No Content\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/labels/{labelId}/assets':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/LabelIdPath'\n    get:\n      tags:\n        - Collection\n        - Asset\n      summary: Return the Assets mapped to the Label\n      operationId: getAssetsByCollectionLabelId\n      responses:\n        '200':\n          description: Asset response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/AssetBasic'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    put:\n      tags:\n        - Collection\n        - Asset\n      summary: Replace the Label's Asset mappings\n      operationId: putAssetsByCollectionLabelId\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              type: array\n              items:\n                $ref: '#/components/schemas/String255'\n      responses:\n        '200':\n          description: The Label's Asset mappings\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/AssetBasic'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/metadata':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n    get:\n      tags:\n        - Collection\n      summary: Return the metadata for Collection\n      operationId: getCollectionMetadata\n      responses:\n        '200':\n          description: Metadata response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Metadata'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    patch:\n      tags:\n        - Collection\n      summary: Merge the provided object to a Collection metadata\n      operationId: patchCollectionMetadata\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/Metadata'\n      responses:\n        '200':\n          description: Metadata response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Metadata'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    put:\n      tags:\n        - Collection\n      summary: Set a Collection metadata to the provided object\n      operationId: putCollectionMetadata\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/Metadata'\n      responses:\n        '200':\n          description: Metadata response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Metadata'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/metadata/keys':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n    get:\n      tags:\n        - Collection\n      summary: Return the keys of the provided Collection metadata\n      operationId: getCollectionMetadataKeys\n      responses:\n        '200':\n          description: MetadataKeys response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetadataKey'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/metadata/keys/{key}':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/MetadataKeyPath'\n    get:\n      tags:\n        - Collection\n      summary: Return the value of the provided Collection metadata key\n      operationId: getCollectionMetadataValue\n      responses:\n        '200':\n          description: MetadataValue response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/MetadataValue'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    put:\n      tags:\n        - Collection\n      summary: Set the value of the provided Collection metadata key to the provided string\n      operationId: putCollectionMetadataValue\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/MetadataValue'\n      responses:\n        '204':\n          description: Empty to avoid large response after putting key with large value\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n    delete:\n      tags:\n        - Collection\n      summary: Remove the provided Collection metadata key\n      operationId: deleteCollectionMetadataKey\n      responses:\n        '204':\n          description: Empty to avoid large response after deleting key with large value\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n\n  '/collections/{collectionId}/metrics/detail':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/AssetIdArrayQuery'\n      - $ref: '#/components/parameters/LabelIdQuery'\n      - $ref: '#/components/parameters/LabelNameQuery'\n      - $ref: '#/components/parameters/LabelMatchQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return unaggregated Asset/STIG metrics for the specified Collection\n      operationId: getMetricsDetailByCollection\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetricsDetailUnagg'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/metrics/detail/asset':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/AssetIdArrayQuery'\n      - $ref: '#/components/parameters/LabelIdQuery'\n      - $ref: '#/components/parameters/LabelNameQuery'\n      - $ref: '#/components/parameters/LabelMatchQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return metrics for the specified Collection aggregated by Asset\n      operationId: getMetricsDetailByCollectionAggAsset\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetricsDetailAggAsset'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/metrics/detail/collection':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/AssetIdArrayQuery'\n      - $ref: '#/components/parameters/LabelIdQuery'\n      - $ref: '#/components/parameters/LabelNameQuery'\n      - $ref: '#/components/parameters/LabelMatchQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return aggregated metrics for the specified Collection\n      operationId: getMetricsDetailByCollectionAgg\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/MetricsDetailAggCollection'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/metrics/detail/label':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/AssetIdArrayQuery'\n      - $ref: '#/components/parameters/LabelIdQuery'\n      - $ref: '#/components/parameters/LabelNameQuery'\n      - $ref: '#/components/parameters/LabelMatchQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return metrics for the specified Collection aggregated by Label\n      operationId: getMetricsDetailByCollectionAggLabel\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetricsDetailAggLabel'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/metrics/detail/stig':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/AssetIdArrayQuery'\n      - $ref: '#/components/parameters/LabelIdQuery'\n      - $ref: '#/components/parameters/LabelNameQuery'\n      - $ref: '#/components/parameters/LabelMatchQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return metrics for the specified Collection aggregated by STIG\n      operationId: getMetricsDetailByCollectionAggStig\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetricsDetailAggStig'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n\n  '/collections/{collectionId}/metrics/summary':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/AssetIdArrayQuery'\n      - $ref: '#/components/parameters/LabelIdQuery'\n      - $ref: '#/components/parameters/LabelNameQuery'\n      - $ref: '#/components/parameters/LabelMatchQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return unaggregated Asset/STIG metrics for the specified Collection\n      operationId: getMetricsSummaryByCollection\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetricsSummaryUnagg'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/metrics/summary/asset':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/AssetIdArrayQuery'\n      - $ref: '#/components/parameters/LabelIdQuery'\n      - $ref: '#/components/parameters/LabelNameQuery'\n      - $ref: '#/components/parameters/LabelMatchQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return metrics for the specified Collection aggregated by Asset\n      operationId: getMetricsSummaryByCollectionAggAsset\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetricsSummaryAggAsset'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/metrics/summary/collection':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/AssetIdArrayQuery'\n      - $ref: '#/components/parameters/LabelIdQuery'\n      - $ref: '#/components/parameters/LabelNameQuery'\n      - $ref: '#/components/parameters/LabelMatchQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return aggregated metrics for the specified Collection\n      operationId: getMetricsSummaryByCollectionAgg\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/MetricsSummaryAggCollection'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/metrics/summary/label':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/AssetIdArrayQuery'\n      - $ref: '#/components/parameters/LabelIdQuery'\n      - $ref: '#/components/parameters/LabelNameQuery'\n      - $ref: '#/components/parameters/LabelMatchQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return metrics for the specified Collection aggregated by Label\n      operationId: getMetricsSummaryByCollectionAggLabel\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetricsSummaryAggLabel'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/metrics/summary/stig':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/AssetIdArrayQuery'\n      - $ref: '#/components/parameters/LabelIdQuery'\n      - $ref: '#/components/parameters/LabelNameQuery'\n      - $ref: '#/components/parameters/LabelMatchQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return metrics for the specified Collection aggregated by STIG\n      operationId: getMetricsSummaryByCollectionAggStig\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetricsSummaryAggStig'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n\n  '/collections/{collectionId}/poam':\n    get:\n      tags:\n        - Collection\n      summary: Return a POAM-like spreadsheet for the specified Collection aggregated by groupId\n      operationId: getPoamByCollection\n      parameters:\n        - $ref: '#/components/parameters/CollectionIdPath'\n        - $ref: '#/components/parameters/PoamAggregatorQuery'\n        - name: acceptedOnly\n          in: query\n          schema:\n            type: boolean\n            default: false\n        - $ref: '#/components/parameters/BenchmarkIdQuery'\n        - $ref: '#/components/parameters/AssetIdQuery'\n        - name: date\n          description: Value for columns Scheduled Completion Date, Milestone With Completion Dates, Milestone Changes\n          in: query\n          schema:\n            type: string\n            pattern: '^(0[1-9]|1[0-2])/(0[1-9]|[12][0-9]|3[01])/\\d{4}$'\n        - name: office\n          description: Value for column Office/Org\n          in: query\n          schema:\n            type: string\n            maxLength: 255\n          allowReserved: true\n        - name: status\n          description: Value for column Status\n          in: query\n          schema:\n            type: string\n            maxLength: 255\n          allowReserved: true\n        - $ref: '#/components/parameters/PoamFormatQuery'\n        - name: mccastPackageId\n          description: Value for POAM MCCAST PackageId\n          in: query\n          schema:\n            type: string\n            maxLength: 255\n          allowReserved: true\n        - name: mccastAuthName\n          description: Value for POAM MCCAST Authorization Name\n          in: query\n          schema:\n            type: string\n            maxLength: 255\n          allowReserved: true\n      responses:\n        '200':\n          description: CollectionFinding response\n          content:\n            application/vnd.openxmlformats-officedocument.spreadsheetml.sheet:\n              schema:\n                type: string\n                format: binary\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/review-history':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n    get:\n      tags:\n        - Collection\n      summary: Return history records for the specified Collection that meet the specified criteria\n      operationId: getReviewHistoryByCollection\n      parameters:\n        - $ref: '#/components/parameters/StartDateQuery' # Lower bound (earliest date) of returned history entry timestamps\n        - $ref: '#/components/parameters/EndDateQuery' # Upper bound (latest date) of returned history entry timestamps\n        - $ref: '#/components/parameters/AssetIdQuery' # return review history entries for just the specified assetId, if provided.\n        - $ref: '#/components/parameters/RuleIdQuery' # return review history entries for just the specified RuleId, if provided.\n        - $ref: '#/components/parameters/ReviewStatusQuery' # return review history entries with the specified status\n      responses:\n        '200':\n          description: ReviewHistory response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/ReviewHistoryAsset'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    delete:\n      tags:\n        - Collection\n      summary: Remove history records that meet specified criteria\n      operationId: deleteReviewHistoryByCollection\n      parameters:\n        - $ref: '#/components/parameters/RetentionDateQuery' # Review History Entries older than this date will be deleted.\n        - $ref: '#/components/parameters/AssetIdQuery' # Apply operation to just the specified assetId, if provided.\n      responses:\n        '200':\n          description: Number of history records deleted.\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/ReviewHistoryDeleted'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/review-history/stats':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n    get:\n      tags:\n        - Collection\n      summary: Return history statistics for the specified Collection\n      operationId: getReviewHistoryStatsByCollection\n      parameters:\n        - $ref: '#/components/parameters/StartDateQuery' # Lower bound (earliest date) of returned history entry count\n        - $ref: '#/components/parameters/EndDateQuery' # Upper bound (latest date) of returned history entry count\n        - $ref: '#/components/parameters/AssetIdQuery' # return review history stats for just the specified assetId, if provided.\n        - $ref: '#/components/parameters/RuleIdQuery' # return review history stats for just the specified RuleId, if provided.\n        - $ref: '#/components/parameters/ReviewStatusQuery' # return review history stats with the specified status\n        - $ref: '#/components/parameters/ReviewHistoryStatsProjectionQuery'\n      responses:\n        '200':\n          description: ReviewHistoryStats response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/ReviewHistoryStats'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/stigs':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/LabelIdQuery'\n      - $ref: '#/components/parameters/LabelNameQuery'\n      - $ref: '#/components/parameters/LabelMatchQuery'\n      - $ref: '#/components/parameters/CollectionStigProjectionQuery'\n    get:\n      tags:\n        - Collection\n      summary: Return the STIGs mapped in the specified Collection\n      operationId: getStigsByCollection\n      responses:\n        '200':\n          description: Collection STIGs array response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/CollectionStigWithAssetCount'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/stigs/{benchmarkId}':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdPath'\n      - $ref: '#/components/parameters/CollectionStigProjectionQuery'\n    get:\n      tags:\n        - Collection\n      summary: Return the STIG mapped in the specified Collection\n      operationId: getStigByCollection\n      responses:\n        '200':\n          description: Collection STIGs array response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/CollectionStigWithAssetCount'\n        '204':\n          description: No content because STIG is not assigned\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    post:\n      tags:\n        - Collection\n      summary: Set the default Revision and/or the Asset list of a STIG in a Collection\n      description: |\n        Neither of the request body properties is required but at least one must be present. If the path parameter `{benchmarkId}` is not already mapped to at least one Asset in `{collectionId}`, then the `assetIds` property must be present.\n      operationId: writeStigPropsByCollectionStig\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              type: object\n              additionalProperties: false\n              minProperties: 1\n              properties:\n                defaultRevisionStr:\n                  $ref: '#/components/schemas/RevisionStr'\n                assetIds:\n                  type: array\n                  items:\n                    $ref: '#/components/schemas/StringIntId'\n      responses:\n        '200':\n          description: Default Revision response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/CollectionStigWithAssetCount'\n        '204':\n          description: No content because STIG is not assigned\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/stigs/{benchmarkId}/assets':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/BenchmarkIdPath'\n    get:\n      tags:\n        - Asset\n        - Collection\n      summary: Get the Assets in a Collection attached to a STIG\n      description: ''\n      operationId: getAssetsByStig\n      parameters:\n        - $ref: '#/components/parameters/LabelIdQuery'\n        - $ref: '#/components/parameters/LabelNameQuery'\n        - $ref: '#/components/parameters/LabelMatchQuery'\n      responses:\n        '200':\n          description: AssetBasicProjected response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/AssetBasicProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n    put:\n      tags:\n        - Asset\n        - Collection\n      summary: Set the Assets mapped to a STIG\n      description: ''\n      operationId: attachAssetsToStig\n      requestBody:\n        required: true\n        description: A list of assetIds from the specified Collection\n        content:\n          application/json:\n            schema:\n              type: array\n              items:\n                type: string\n      responses:\n        '200':\n          description: AssetBasicProjected response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/AssetBasicProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection'\n  '/collections/{collectionId}/unreviewed/assets':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/AssetIdQuery'\n      - $ref: '#/components/parameters/LabelIdQuery'\n      - $ref: '#/components/parameters/LabelNameQuery'\n      - $ref: '#/components/parameters/BenchmarkIdQuery'\n      - $ref: '#/components/parameters/RuleSeverityQuery'\n      - $ref: '#/components/parameters/UnreviewedAssetsProjectionQuery'\n    get:\n      tags:\n        - Collection\n      summary: EXPERIMENTAL - Return the Assets in the specified Collection with unreviewed Rules\n      operationId: getUnreviewedAssetsByCollection\n      responses:\n        '200':\n          description: UnreviewedAsset response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/UnreviewedAsset'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/unreviewed/rules':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/RuleIdQuery'\n      - $ref: '#/components/parameters/LabelIdQuery'\n      - $ref: '#/components/parameters/LabelNameQuery'\n      - $ref: '#/components/parameters/BenchmarkIdQuery'\n      - $ref: '#/components/parameters/RuleSeverityQuery'\n      - $ref: '#/components/parameters/UnreviewedRulesProjectionQuery'\n    get:\n      tags:\n        - Collection\n      summary: EXPERIMENTAL - Return the Rules in the specified Collection with unreviewed Assets\n      operationId: getUnreviewedRulesByCollection\n      responses:\n        '200':\n          description: UnreviewedRules response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/UnreviewedRule'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/{collectionId}/users/{userId}/effective-acl':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdPath'\n      - $ref: '#/components/parameters/UserIdPath'\n    get:\n      tags:\n        - Collection\n      summary: Return a User's effective access rules for the specified Collection.\n      operationId: getEffectiveAclByCollectionUser\n      responses:\n        '200':\n          description: EffectiveAcl array response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/EffectiveAcl'\n        '403':\n          $ref: '#/components/responses/Forbidden'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/meta/metrics/detail':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdArrayQuery'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return fully aggregated meta-metrics\n      operationId: getMetricsDetailByMeta\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/MetricsDetailAggMeta'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/meta/metrics/detail/collection':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdArrayQuery'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/RevisionIdArrayQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return meta-metrics aggregated by Collection\n      operationId: getMetricsDetailByMetaAggCollection\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetricsDetailAggCollection'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/meta/metrics/detail/stig':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdArrayQuery'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return meta-metrics aggregated by STIG\n      operationId: getMetricsDetailByMetaAggStig\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetricsDetailAggStig'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/meta/metrics/summary':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdArrayQuery'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return fully aggregated meta-metrics\n      operationId: getMetricsSummaryByMeta\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/MetricsSummaryAggMeta'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/meta/metrics/summary/collection':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdArrayQuery'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/RevisionIdArrayQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return meta-metrics aggregated by Collection\n      operationId: getMetricsSummaryByMetaAggCollection\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetricsSummaryAggCollection'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  '/collections/meta/metrics/summary/stig':\n    parameters:\n      - $ref: '#/components/parameters/CollectionIdArrayQuery'\n      - $ref: '#/components/parameters/BenchmarkIdArrayQuery'\n      - $ref: '#/components/parameters/MetricsFormatQuery'\n    get:\n      tags:\n        - Metrics\n      summary: Return meta-metrics aggregated by STIG\n      operationId: getMetricsSummaryByMetaAggStig\n      responses:\n        '200':\n          description: Metrics response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/MetricsSummaryAggStig'\n            text/csv:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:collection:read'\n  \n  /jobs:\n    get:\n      summary: List jobs\n      tags:\n        - Job\n      operationId: getJobs\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n      responses:\n        '200':\n          description: List of jobs\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/Job'\n        'default':\n          description: error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - stig-manager:op:read\n      x-elevation-required: true\n    post:\n      summary: Create a new job\n      tags:\n        - Job\n      operationId: postJob\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/JobCreate'\n      responses:\n        '201':\n          description: Job created\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Job'\n        'default':\n          description: error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - stig-manager:op\n      x-elevation-required: true\n  /jobs/{jobId}:\n    get:\n      summary: Get job by ID\n      tags:\n        - Job\n      operationId: getJob\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/JobIdPath'\n      responses:\n        '200':\n          description: Job details\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Job'\n        'default':\n          description: Job not found\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - stig-manager:op:read\n      x-elevation-required: true\n    delete:\n      summary: Delete job by ID\n      tags:\n        - Job\n      operationId: deleteJob\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/JobIdPath'\n      responses:\n        '204':\n          description: Job deleted\n        'default':\n          description: error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - stig-manager:op\n      x-elevation-required: true\n    patch:\n      summary: Update job by ID\n      tags:\n        - Job\n      operationId: patchJob\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/JobIdPath'\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/JobUpdate'\n      responses:\n        '200':\n          description: Job updated\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Job'\n        'default':\n          description: error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - stig-manager:op\n      x-elevation-required: true\n  /jobs/{jobId}/runs:\n    get:\n      summary: List the job runs\n      tags:\n        - Job\n      operationId: getRunsByJob\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/JobIdPath'\n      responses:\n        '200':\n          description: List of job runs\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/JobRun'\n        'default':\n          description: error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - stig-manager:op:read\n      x-elevation-required: true\n    post:\n      summary: Start an immediate job run\n      tags:\n        - Job\n      operationId: runImmediateJob\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/JobIdPath'\n      responses:\n        '201':\n          description: Job run created\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/JobRunCreated'\n        'default':\n          description: error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - stig-manager:op\n      x-elevation-required: true\n  /jobs/runs/{runId}:\n    get:\n      summary: Get a job run by ID\n      tags:\n        - Job\n      operationId: getRunById\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/JobRunIdPath'\n      responses:\n        '200':\n          description: Job run details\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/JobRun'\n        'default':\n          description: error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - stig-manager:op:read\n      x-elevation-required: true\n    delete:\n      summary: Delete a job run by ID\n      tags:\n        - Job\n      operationId: deleteRunById\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/JobRunIdPath'\n      responses:\n        '204':\n          description: Job run deleted\n        'default':\n          description: error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - stig-manager:op\n      x-elevation-required: true\n  /jobs/runs/{runId}/output:\n    get:\n      summary: Get the output for a job run\n      tags:\n        - Job\n      operationId: getOutputByRun\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/JobRunIdPath'\n        - $ref: '#/components/parameters/RunSequenceQuery'\n      responses:\n        '200':\n          description: Job run output\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/JobRunOutput'\n        'default':\n          description: error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - stig-manager:op:read\n      x-elevation-required: true\n  /jobs/tasks:\n    get:\n      summary: List all tasks\n      tags:\n        - Job\n      operationId: getAllTasks\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n      responses:\n        '200':\n          description: List of tasks\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/JobTask'\n        'default':\n          description: error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - stig-manager:op:read\n      x-elevation-required: true\n\n  /op/appdata:\n    get:\n      tags:\n        - Operation\n      summary: Export application data\n      operationId: getAppData\n      parameters:\n        - $ref: '#/components/parameters/AppDataFormatQuery'\n        - $ref: '#/components/parameters/ElevateQuery'\n      responses:\n        '200':\n          description: Exported data\n          content:\n            application/jsonl:\n              schema:\n                type: string\n            application/gzip:\n              schema:\n                type: string\n                format: binary     \n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - stig-manager:op:read\n    post:\n      tags:\n        - Operation\n      summary: Import and overwrite application data\n      operationId: replaceAppData\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n      requestBody:\n        required: false\n        content:\n          application/gzip:\n            schema:\n              type: string\n              format: binary\n          application/x-gzip:\n            schema:\n              type: string\n              format: binary\n          application/jsonl:\n            schema:\n              type: string\n              format: binary\n      responses:\n        '200':\n          description: Import successful\n          content:\n            application/jsonl:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - stig-manager:op\n  /op/appdata/tables:\n    get:\n      tags:\n        - Operation\n      summary: Get the name and data length of each table\n      operationId: getAppDataTables\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n      responses:\n        '200':\n          description: An array of table names and lengths\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/AppDataTable'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - stig-manager:op:read\n  /op/appinfo:\n    get:\n      tags:\n        - Operation\n      summary: Return information about the application deployment\n      operationId: getAppInfo\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n        - name: includeRowCounts\n          in: query\n          description: Include exact row counts for each table (slower) or use estimated counts (faster)\n          schema:\n            type: boolean\n            default: false\n      responses:\n        '200':\n          description: AppInfo response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/AppInfo'\n      security:\n        - oauth:\n            - stig-manager:op:read\n  /op/configuration:\n    get:\n      tags:\n        - Operation\n      summary: Return API version and configuration information\n      operationId: getConfiguration\n      security: []\n      responses:\n        '200':\n          description: Configuration response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/ApiConfiguration'\n  /op/definition:\n    get:\n      tags:\n        - Operation\n      summary: Return the API definition\n      operationId: getDefinition\n      security: []\n      parameters:\n        - $ref: '#/components/parameters/JsonPathQuery'\n      responses:\n        '200':\n          description: Definition response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/ApiDefinition'\n  /op/details:\n    get:\n      tags:\n        - Operation\n      summary: \"DEPRECATED: replaced by /op/appinfo\"\n      operationId: getDetails\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n      responses:\n        '200':\n          description: Detail response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Detail'\n      security:\n        - oauth:\n            - stig-manager:op:read\n  \n  \n  /op/state:\n    get:\n      tags:\n        - Operation\n      summary: Return information about the API state\n      operationId: getState\n      responses:\n        '200':\n          description: Detail response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/StateResponse'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n  /op/state/sse:\n    get:\n      tags:\n      - Operation\n      operationId: streamStateSse\n      summary: Stream Server-Sent Events (SSE) about changes to the current API state\n      description: >\n        Opens a one-way stream using SSE.\n        The response is a continuous stream of events in `text/event-stream` format.\n      responses:\n        '200':\n          description: Stream of events\n          content:\n            text/event-stream:\n              schema:\n                type: string\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n  /stigs:\n    get:\n      tags:\n        - STIG\n      summary: Return a list of available STIGs\n      operationId: getSTIGs\n      parameters:\n        - name: title\n          in: query\n          description: A string found anywhere in a STIG title\n          schema:\n            type: string\n        - $ref: '#/components/parameters/StigProjectionQuery'\n        - $ref: '#/components/parameters/ElevateQuery'\n      responses:\n        '200':\n          description: STIG response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/STIG'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig:read'\n    post:\n      tags:\n        - STIG\n      summary: Import a STIG Benchmark\n      operationId: importBenchmark\n      parameters:\n        - name: clobber\n          in: query\n          description: Should existing Revision data be overwritten\n          schema:\n            type: boolean\n            default: false\n        - $ref: '#/components/parameters/ElevateQuery'\n      requestBody:\n        required: true\n        content:\n          multipart/form-data:\n            schema:\n              type: object\n              properties:\n                importFile:\n                  type: string\n                  format: binary\n      responses:\n        '200':\n          description: The added STIG\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/RevisionPost'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig'\n  '/stigs/ccis/{cci}':\n    get:\n      tags:\n        - STIG\n      summary: Return data for the specified CCI\n      operationId: getCci\n      parameters:\n        - $ref: '#/components/parameters/CciProjectionQuery'\n        - name: cci\n          in: path\n          description: A path parameter that identifies a CCI\n          required: true\n          schema:\n            pattern: ^[0-9]{6}$\n            type: string\n      responses:\n        '200':\n          description: CCI response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Cci'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig:read'\n  '/stigs/rules/{ruleId}':\n    get:\n      tags:\n        - STIG\n      summary: Return the definition and associated check and fix for the specified Rule\n      description: |\n        Note: A very small number of edge cases are known to exist where published STIGs have updated Rule Content without updating the associated RuleId. In these cases, it is possible this endpoint may return inconsistent Rule info. If you need specific Rule information for a given STIG Revision, use the `/stigs/{benchmarkId}/revisions/{revisionStr}/rules/{ruleId}` endpoint.\n      operationId: getRuleByRuleId\n      parameters:\n        - $ref: '#/components/parameters/RuleProjectionQuery'\n        - name: ruleId\n          in: path\n          description: A path parameter that identifies a Rule\n          required: true\n          schema:\n            type: string\n      responses:\n        '200':\n          description: Rule response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/RuleProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig:read'\n  '/stigs/scap-maps':\n    get:\n      tags:\n        - STIG\n      summary: Return a list of SCAP benchmarkIds mapped to Manual benchmarkIds\n      operationId: getScapMap\n      responses:\n        '200':\n          description: SCAP Map response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/SCAPMap'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig:read'\n  '/stigs/{benchmarkId}':\n    get:\n      tags:\n        - STIG\n      summary: Return properties of the specified STIG\n      operationId: getStigById\n      parameters:\n        - name: benchmarkId\n          in: path\n          description: A path parameter that identifies a STIG\n          required: true\n          schema:\n            type: string\n        - $ref: '#/components/parameters/ElevateQuery'\n      responses:\n        '200':\n          description: STIG response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/STIG'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig:read'\n    delete:\n      tags:\n        - STIG\n      summary: Deletes a STIG (*** and all revisions ***)\n      operationId: deleteStigById\n      parameters:\n        - name: benchmarkId\n          in: path\n          description: A path parameter that identifies a STIG\n          required: true\n          schema:\n            type: string\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/ForceQuery'\n      responses:\n        '200':\n          description: The deleted STIG\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/STIG'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig'\n      x-rbac:\n        - admin\n  '/stigs/{benchmarkId}/revisions':\n    get:\n      tags:\n        - STIG\n      summary: Return a list of revisions for the specified STIG\n      operationId: getRevisionsByBenchmarkId\n      parameters:\n        - name: benchmarkId\n          in: path\n          description: A path parameter that identifies a STIG\n          required: true\n          schema:\n            type: string\n        - $ref: '#/components/parameters/ElevateQuery'\n      responses:\n        '200':\n          description: Revision response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/Revision'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig:read'\n  '/stigs/{benchmarkId}/revisions/{revisionStr}':\n    get:\n      tags:\n        - STIG\n      summary: Return metadata for the specified revision of a STIG\n      operationId: getRevisionByString\n      parameters:\n        - name: benchmarkId\n          in: path\n          description: A path parameter that identifies a STIG\n          required: true\n          schema:\n            type: string\n        - name: revisionStr\n          in: path\n          description: A path parameter that identifies a STIG revision [V{version_num}R{release_num} | 'latest' ]\n          required: true\n          schema:\n            pattern: ^(V\\d+R\\d+(\\.\\d+)?|latest)$\n            type: string\n        - $ref: '#/components/parameters/ElevateQuery'\n      responses:\n        '200':\n          description: Revision response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Revision'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig:read'\n    delete:\n      tags:\n        - STIG\n      summary: Deletes the specified revision of a STIG\n      operationId: deleteRevisionByString\n      parameters:\n        - name: benchmarkId\n          in: path\n          description: A path parameter that identifies a STIG\n          required: true\n          schema:\n            type: string\n        - name: revisionStr\n          in: path\n          description: A path parameter that identifies a STIG revision [V{version_num}R{release_num} | 'latest' ]\n          required: true\n          schema:\n            pattern: ^(V\\d+R\\d+(\\.\\d+)?)$\n            type: string\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/ForceQuery'\n      responses:\n        '200':\n          description: The deleted Revision\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Revision'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig'\n      x-rbac:\n        - admin\n  '/stigs/{benchmarkId}/revisions/{revisionStr}/ccis':\n    get:\n      tags:\n        - STIG\n      summary: Return a list of CCIs from a STIG revision\n      operationId: getCcisByRevision\n      parameters:\n        - name: benchmarkId\n          in: path\n          description: A path parameter that identifies a STIG\n          required: true\n          schema:\n            type: string\n        - name: revisionStr\n          in: path\n          description: A path parameter that identifies a STIG revision [V{version_num}R{release_num} | 'latest' ]\n          required: true\n          schema:\n            pattern: ^(V\\d+R\\d+(\\.\\d+)?|latest)$\n            type: string\n      responses:\n        '200':\n          description: CCI response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/CciListItem'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig:read'\n  '/stigs/{benchmarkId}/revisions/{revisionStr}/groups':\n    get:\n      tags:\n        - STIG\n      summary: Return the list of groups for the specified revision of a STIG.\n      operationId: getGroupsByRevision\n      parameters:\n        - $ref: '#/components/parameters/GroupProjectionQuery'\n        - name: benchmarkId\n          in: path\n          description: A path parameter that identifies a STIG\n          required: true\n          schema:\n            type: string\n        - name: revisionStr\n          in: path\n          description: A path parameter that identifies a STIG revision [V{version_num}R{release_num} | 'latest' ]\n          required: true\n          schema:\n            pattern: ^(V\\d+R\\d+(\\.\\d+)?|latest)$\n            type: string\n      responses:\n        '200':\n          description: GroupProjected response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/GroupProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig:read'\n  '/stigs/{benchmarkId}/revisions/{revisionStr}/groups/{groupId}':\n    get:\n      tags:\n        - STIG\n      summary: Return the rules, checks and fixes for a Group from a specified revision of a STIG.\n      description: None\n      operationId: getGroupByRevision\n      parameters:\n        - $ref: '#/components/parameters/GroupProjectionQuery'\n        - name: benchmarkId\n          in: path\n          description: A path parameter that identifies a STIG\n          required: true\n          schema:\n            type: string\n        - name: revisionStr\n          in: path\n          description: A path parameter that identifies a STIG revision [V{version_num}R{release_num} | 'latest' ]\n          required: true\n          schema:\n            pattern: ^(V\\d+R\\d+(\\.\\d+)?|latest)$\n            type: string\n        - name: groupId\n          in: path\n          description: A path parameter that identifies a Group\n          required: true\n          schema:\n            type: string\n      responses:\n        '200':\n          description: Group response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/GroupProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig:read'\n  '/stigs/{benchmarkId}/revisions/{revisionStr}/rules':\n    get:\n      tags:\n        - STIG\n      summary: Return rule data for the specified revision of a STIG.\n      operationId: getRulesByRevision\n      parameters:\n        - $ref: '#/components/parameters/RuleProjectionQuery'\n        - name: benchmarkId\n          in: path\n          description: A path parameter that identifies a STIG\n          required: true\n          schema:\n            type: string\n        - name: revisionStr\n          in: path\n          description: A path parameter that identifies a STIG revision [V{version_num}R{release_num} | 'latest' ]\n          required: true\n          schema:\n            pattern: ^(V\\d+R\\d+(\\.\\d+)?|latest)$\n            type: string\n      responses:\n        '200':\n          description: Rule response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/RuleProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig:read'\n  '/stigs/{benchmarkId}/revisions/{revisionStr}/rules/{ruleId}':\n    get:\n      tags:\n        - STIG\n      summary: Return rule data for the specified Rule in a revision of a STIG.\n      operationId: getRuleByRevision\n      parameters:\n        - $ref: '#/components/parameters/RuleProjectionQuery'\n        - name: benchmarkId\n          in: path\n          description: A path parameter that identifies a STIG\n          required: true\n          schema:\n            type: string\n        - name: revisionStr\n          in: path\n          description: A path parameter that identifies a STIG revision [V{version_num}R{release_num} | 'latest' ]\n          required: true\n          schema:\n            pattern: ^(V\\d+R\\d+(\\.\\d+)?|latest)$\n            type: string\n        - name: ruleId\n          in: path\n          description: A path parameter that identifies a Rule\n          required: true\n          schema:\n            type: string\n      responses:\n        '200':\n          description: RuleProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/RuleProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:stig:read'\n  /user:\n    parameters:\n      - $ref: '#/components/parameters/UserPreferenceQuery'\n    get:\n      tags:\n        - User\n      summary: Return the requester's user information\n      operationId: getUser\n      responses:\n        '200':\n          description: User response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/UserProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:user:read'\n  /user/web-preferences:\n    get:\n      tags:\n        - User\n      summary: Return the requester's web-preferences\n      operationId: getUserWebPreferences\n      responses:\n        '200':\n          description: User Web Preferences response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/WebPreferences'\n      security:\n        - oauth:\n            - 'stig-manager:user:read'\n    patch:\n      tags:\n        - User\n      summary: Merge the provided object to the requester's web-preferences\n      operationId: patchUserWebPreferences\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/WebPreferencesPatch'\n      responses:\n        '200':\n          description: User Web Preferences response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/WebPreferences'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n        # not semantically correct but needed for backwards compatability\n            - 'stig-manager:user:read'\n  /users:\n    parameters:\n      - $ref: '#/components/parameters/ElevateQuery'\n      - $ref: '#/components/parameters/UserProjectionQuery'\n    get:\n      tags:\n        - User\n      summary: Return a list of Users accessible to the requester\n      operationId: getUsers\n      parameters:\n        - $ref: '#/components/parameters/UsernameQuery'\n        - $ref: '#/components/parameters/PrivilegeQuery'\n        - $ref: '#/components/parameters/UsernameMatchQuery'\n        - $ref: '#/components/parameters/UserStatusQuery'\n      responses:\n        '200':\n          description: UserProjected array response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/UserProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:user:read'\n    post:\n      tags:\n        - User\n      summary: Create a User\n      operationId: createUser\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/UserPost'\n      responses:\n        '201':\n          description: UserProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/UserProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:user'\n  '/users/{userId}':\n    parameters:\n      - $ref: '#/components/parameters/ElevateQuery'\n      - $ref: '#/components/parameters/UserProjectionQuery'\n      - $ref: '#/components/parameters/UserIdPath'\n    get:\n      tags:\n        - User\n      summary: Return a User\n      operationId: getUserByUserId\n      responses:\n        '200':\n          description: UserProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/UserProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:user:read'\n    patch:\n      tags:\n        - User\n      summary: Merge provided properties with a User\n      operationId: updateUser\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/UserPatch'\n      responses:\n        '200':\n          description: UserProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/UserProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:user'\n    put:\n      tags:\n        - User\n      summary: Set all properties of a User\n      operationId: replaceUser\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/UserPut'\n      responses:\n        '200':\n          description: UserProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/UserProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:user'\n    delete:\n      tags:\n        - User\n      summary: Delete a User that has never accessed the system.\n      operationId: deleteUser\n      responses:\n        '200':\n          description: UserProjected response\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/UserProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:user'\n  /user-groups:\n    post:\n      tags:\n        - User\n      summary: Create a User Group\n      operationId: createUserGroup\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/UserGroupProjectionQuery'\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/UserGroupPostOrPut'\n      responses:\n        '201':\n          description: UserGroup response\n          content:\n            application/json:\n              schema:\n                  $ref: '#/components/schemas/UserGroupProjected'\n        default:\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:user'\n    get:\n      tags:\n        - User\n      summary: Get a list of User Groups accessible to the requester\n      operationId: getUserGroups\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/UserGroupProjectionQuery'\n      responses:\n        '200':\n          description: UserGroups response\n          content:\n            application/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#/components/schemas/UserGroupProjected'\n      security:\n        - oauth:\n            - 'stig-manager:user:read'\n  '/user-groups/{userGroupId}':\n    get:\n      tags:\n        - User\n      summary: Return a User Group\n      operationId: getUserGroup\n      parameters:\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/UserGroupIdPath'\n        - $ref: '#/components/parameters/UserGroupProjectionQuery'\n      responses:\n        '200':\n          description: UserGroup response\n          content:\n            application/json:\n              schema:\n                  $ref: '#/components/schemas/UserGroupProjected'\n        'default':\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:user:read'\n    patch: \n      tags:\n        - User \n      summary: Patch a User Group\n      operationId: patchUserGroup\n      parameters:\n        - $ref: '#/components/parameters/UserGroupIdPath'\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/UserGroupProjectionQuery'\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/UserGroupPatch'\n      responses:\n        '200':\n          description: UserGroup response\n          content:\n            application/json:\n              schema:\n                  $ref: '#/components/schemas/UserGroupProjected'\n        'default':\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:user'\n    put: \n      tags:\n        - User \n      summary: Replace a User Group\n      operationId: putUserGroup\n      parameters:\n        - $ref: '#/components/parameters/UserGroupIdPath'\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/UserGroupProjectionQuery'\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              $ref: '#/components/schemas/UserGroupPostOrPut'\n      responses:\n        '200':\n          description: UserGroup response\n          content:\n            application/json:\n              schema:\n                  $ref: '#/components/schemas/UserGroupProjected'\n        'default':\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:user'\n    delete:\n      tags:\n        - User\n      summary: Delete a User Group\n      operationId: deleteUserGroup\n      parameters:\n        - $ref: '#/components/parameters/UserGroupIdPath'\n        - $ref: '#/components/parameters/ElevateQuery'\n        - $ref: '#/components/parameters/UserGroupProjectionQuery'\n      responses:\n        '200':\n          description: UserGroup response\n          content:\n            application/json:\n              schema:\n                  $ref: '#/components/schemas/UserGroupProjected'\n        'default':\n          description: unexpected error\n          content:\n            application/json:\n              schema:\n                $ref: '#/components/schemas/Error'\n      security:\n        - oauth:\n            - 'stig-manager:user'\ncomponents:\n  schemas:\n    RoleId:\n      maximum: 4\n      minimum: 1\n      type: integer\n    AclForGrant:\n      type: object\n      properties:\n        defaultAccess:\n          $ref: '#/components/schemas/AclRuleAccess'\n        acl:\n          type: array\n          items:\n            $ref: '#/components/schemas/AclRuleBasic'\n    AclRuleAccess:\n      type: string\n      enum:\n        - none\n        - r\n        - rw\n      default: rw\n    AclRuleAssetBasic:\n      additionalProperties: false\n      type: object\n      properties:\n        asset:\n          $ref: '#/components/schemas/AssetBasic'\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        access:\n          $ref: '#/components/schemas/AclRuleAccess'\n      # required:\n      #   - access\n    AclRuleAssetPut:\n      additionalProperties: false\n      type: object\n      properties:\n        assetId:\n          $ref: '#/components/schemas/AssetId'\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        access:\n          $ref: '#/components/schemas/AclRuleAccess'\n      required:\n        - access\n    AclRuleBasic:\n      anyOf:\n       - $ref: '#/components/schemas/AclRuleAssetBasic'\n       - $ref: '#/components/schemas/AclRuleLabel'\n    AclRuleLabel:\n      additionalProperties: false\n      type: object\n      properties:\n        label:\n          $ref: '#/components/schemas/LabelBasicWithColor'\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        access:\n          $ref: '#/components/schemas/AclRuleAccess'\n      required:\n        - access\n    AclRuleLabelBasic:\n      additionalProperties: false\n      type: object\n      properties:\n        label:\n          $ref: '#/components/schemas/LabelBasic'\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        access:\n          $ref: '#/components/schemas/AclRuleAccess'\n      required:\n        - access\n    AclRuleLabelPut:\n      additionalProperties: false\n      type: object\n      properties:\n        labelId:\n          $ref: '#/components/schemas/LabelId'\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        access:\n          $ref: '#/components/schemas/AclRuleAccess'\n      required:\n        - access\n    AclRulePut:\n      anyOf:\n       - $ref: '#/components/schemas/AclRuleAssetPut'\n       - $ref: '#/components/schemas/AclRuleLabelPut'\n    AclSource:\n      type: object\n      properties:\n        grantee:\n          $ref: '#/components/schemas/Grantee'\n        aclRule:\n          anyOf:\n            - $ref: '#/components/schemas/AclRuleAssetBasic'\n            - $ref: '#/components/schemas/AclRuleLabelBasic'\n    ApAcronym:\n      $ref: '#/components/schemas/String20Nullable'\n    ApiClassification:\n      type: string\n      enum:\n        - NONE\n        - U\n        - FOUO\n        - CUI\n        - C\n        - S\n        - TS\n        - SCI\n    ApiConfiguration:\n      additionalProperties: false\n      type: object\n      properties:\n        classification:\n          $ref: '#/components/schemas/ApiClassification'\n        commit:\n          $ref: '#/components/schemas/CommitObject'\n        lastMigration:\n          $ref: '#/components/schemas/LastMigration'\n        version:\n          $ref: '#/components/schemas/ApiVersion'\n    ApiDefinition:\n      oneOf:\n        - type: object\n        - type: array\n    ApiVersion:\n      $ref: '#/components/schemas/Version'\n    AppDataFormat:\n      type: string\n      default: 'gzip'\n      enum:\n        - jsonl\n        - gzip\n    AppDataTable:\n      type: object\n      properties:\n        name:\n          $ref: '#/components/schemas/String255'\n        rows:\n          type: number\n        dataLength:\n          type: number\n    AppInfo:\n      type: object\n      properties:\n        date:\n          $ref: '#/components/schemas/StringDateTime'\n        schema:\n          $ref: '#/components/schemas/AppInfoSchemaVersion'\n        version:\n          $ref: '#/components/schemas/ApiVersion'\n        collections:\n          type: object\n          additionalProperties:\n            $ref: '#/components/schemas/AppInfoCollection'\n        requests:\n          $ref: '#/components/schemas/AppInfoRequests'\n        users:\n          $ref: '#/components/schemas/AppInfoUsers'\n        groups: \n          type: object\n          additionalProperties:\n            $ref: '#/components/schemas/AppInfoGroups'\n        mysql:\n          $ref: '#/components/schemas/AppInfoMySql'\n        nodejs:\n          $ref: '#/components/schemas/AppInfoNodejs'\n      required:\n        - date\n        - schema\n        - version\n        - collections\n        - requests\n        - users\n        - mysql\n        - nodejs\n    AppInfoGroups:\n      type: object\n      properties:\n        name:\n          $ref: '#/components/schemas/String255'\n        members:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        created:\n          $ref: '#/components/schemas/Created'\n        modifiedDate:\n         $ref: '#/components/schemas/StringDateTime'\n        roles:\n          $ref: '#/components/schemas/AppInfoGroupsRoles'\n      required:\n        - name\n        - members\n        - created\n        - modifiedDate\n        - roles\n    AppInfoGroupsRoles:\n      type: object\n      properties:\n        full:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        owner:\n         $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        manage:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        restricted:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n      required:\n        - full\n        - owner\n        - manage\n        - restricted\n    AppInfoSchemaVersion:\n      type: string\n      pattern: \"^[a-zA-Z0-9_-]+-appinfo-v[0-9]+\\\\.[0-9]+$\"\n    AppInfoNodejs:\n      type: object\n      properties:\n        version:\n          $ref: '#/components/schemas/ApiVersion'\n        uptime:\n          type: number\n          format: double\n        os:\n          $ref: '#/components/schemas/AppInfoNodeOs'\n        environment:\n          additionalProperties:\n            type: string\n        memory:\n          $ref: '#/components/schemas/AppInfoNodeMemory'\n        cpus:\n          type: array\n          items:\n            $ref: '#/components/schemas/AppInfoNodeCpus'\n      required:\n        - version\n        - uptime\n        - os\n        - environment\n        - memory\n        - cpus\n    AppInfoNodeOs:\n      type: object\n      properties:\n        platform:\n          $ref: '#/components/schemas/String255'\n        arch:\n          $ref: '#/components/schemas/String255'\n        osMachine:\n          $ref: '#/components/schemas/String255'\n        osName:\n          $ref: '#/components/schemas/String255'\n        osRelease:\n          $ref: '#/components/schemas/String255'\n        loadAverage:\n          $ref: '#/components/schemas/String255'\n      required:\n        - platform\n        - arch\n        - osMachine\n        - osName\n        - osRelease\n        - loadAverage \n    AppInfoNodeCpus:\n      type: object\n      properties:\n        model:\n          $ref: '#/components/schemas/String255'\n        speed:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n      required:\n        - model\n        - speed\n    AppInfoNodeMemory: \n      type: object\n      properties:\n        rss:\n          $ref: '#/components/schemas/Integer64MinimumZero'\n        heapTotal:\n          $ref: '#/components/schemas/Integer64MinimumZero'\n        heapUsed:\n          $ref: '#/components/schemas/Integer64MinimumZero'\n        external:\n          $ref: '#/components/schemas/Integer64MinimumZero'\n        arrayBuffers:\n          $ref: '#/components/schemas/Integer64MinimumZero'\n        maxRss:\n          $ref: '#/components/schemas/Integer64MinimumZero'\n      required:\n        - rss\n        - heapTotal\n        - heapUsed\n        - external\n        - arrayBuffers\n        - maxRss\n    AppInfoMySql:\n      type: object\n      properties:\n        version:\n          $ref: '#/components/schemas/ApiVersion'\n        tables:\n          $ref: '#/components/schemas/AppInfoMysqlTableStats'\n        variables:\n          $ref: '#/components/schemas/AppInfoMysqlVariables'\n        status:\n          $ref: '#/components/schemas/AppInfoMysqlStatus'\n      required:\n        - version\n        - tables\n        - variables\n        - status\n    AppInfoMysqlStatus:\n      type: object\n      properties:\n        # Network\n        Bytes_received:\n          $ref: '#/components/schemas/String255'\n        Bytes_sent:\n          $ref: '#/components/schemas/String255'\n        # Handler operations\n        Handler_commit:\n          $ref: '#/components/schemas/String255'\n        Handler_update:\n          $ref: '#/components/schemas/String255'\n        Handler_write:\n          $ref: '#/components/schemas/String255'\n        # Buffer pool health - critical for performance monitoring\n        Innodb_buffer_pool_bytes_data:\n          $ref: '#/components/schemas/String255'\n        Innodb_buffer_pool_pages_total:\n          $ref: '#/components/schemas/String255'\n        Innodb_buffer_pool_pages_free:\n          $ref: '#/components/schemas/String255'\n        Innodb_buffer_pool_pages_dirty:\n          $ref: '#/components/schemas/String255'\n        Innodb_buffer_pool_pages_flushed:\n          $ref: '#/components/schemas/String255'\n        Innodb_buffer_pool_read_requests:\n          $ref: '#/components/schemas/String255'\n        Innodb_buffer_pool_reads:\n          $ref: '#/components/schemas/String255'\n        Innodb_buffer_pool_wait_free:\n          $ref: '#/components/schemas/String255'\n        # Redo log / Checkpoint - detect checkpoint thrashing\n        Innodb_redo_log_current_lsn:\n          $ref: '#/components/schemas/String255'\n        Innodb_redo_log_checkpoint_lsn:\n          $ref: '#/components/schemas/String255'\n        Innodb_redo_log_flushed_to_disk_lsn:\n          $ref: '#/components/schemas/String255'\n        Innodb_log_waits:\n          $ref: '#/components/schemas/String255'\n        Innodb_log_writes:\n          $ref: '#/components/schemas/String255'\n        Innodb_os_log_fsyncs:\n          $ref: '#/components/schemas/String255'\n        # I/O operations\n        Innodb_data_reads:\n          $ref: '#/components/schemas/String255'\n        Innodb_data_writes:\n          $ref: '#/components/schemas/String255'\n        Innodb_data_fsyncs:\n          $ref: '#/components/schemas/String255'\n        Innodb_pages_read:\n          $ref: '#/components/schemas/String255'\n        Innodb_pages_written:\n          $ref: '#/components/schemas/String255'\n        Innodb_pages_created:\n          $ref: '#/components/schemas/String255'\n        # Row operations\n        Innodb_rows_read:\n          $ref: '#/components/schemas/String255'\n        Innodb_rows_updated:\n          $ref: '#/components/schemas/String255'\n        Innodb_rows_inserted:\n          $ref: '#/components/schemas/String255'\n        Innodb_rows_deleted:\n          $ref: '#/components/schemas/String255'\n        # Row locking\n        Innodb_row_lock_waits:\n          $ref: '#/components/schemas/String255'\n        Innodb_row_lock_current_waits:\n          $ref: '#/components/schemas/String255'\n        Innodb_row_lock_time:\n          $ref: '#/components/schemas/String255'\n        Innodb_row_lock_time_avg:\n          $ref: '#/components/schemas/String255'\n        Innodb_row_lock_time_max:\n          $ref: '#/components/schemas/String255'\n        # Temp tables\n        Created_tmp_tables:\n          $ref: '#/components/schemas/String255'\n        Created_tmp_disk_tables:\n          $ref: '#/components/schemas/String255'\n        Created_tmp_files:\n          $ref: '#/components/schemas/String255'\n        # Table cache\n        Open_tables:\n          $ref: '#/components/schemas/String255'\n        Opened_tables:\n          $ref: '#/components/schemas/String255'\n        Table_open_cache_hits:\n          $ref: '#/components/schemas/String255'\n        Table_open_cache_misses:\n          $ref: '#/components/schemas/String255'\n        Table_open_cache_overflows:\n          $ref: '#/components/schemas/String255'\n        # Connections/Threads\n        Connections:\n          $ref: '#/components/schemas/String255'\n        Max_used_connections:\n          $ref: '#/components/schemas/String255'\n        Threads_connected:\n          $ref: '#/components/schemas/String255'\n        Threads_running:\n          $ref: '#/components/schemas/String255'\n        Threads_created:\n          $ref: '#/components/schemas/String255'\n        Threads_cached:\n          $ref: '#/components/schemas/String255'\n        Aborted_connects:\n          $ref: '#/components/schemas/String255'\n        Aborted_clients:\n          $ref: '#/components/schemas/String255'\n        # Queries\n        Queries:\n          $ref: '#/components/schemas/String255'\n        Slow_queries:\n          $ref: '#/components/schemas/String255'\n        Select_scan:\n          $ref: '#/components/schemas/String255'\n        Select_full_join:\n          $ref: '#/components/schemas/String255'\n        Select_full_range_join:\n          $ref: '#/components/schemas/String255'\n        # Sorts\n        Sort_merge_passes:\n          $ref: '#/components/schemas/String255'\n        Sort_scan:\n          $ref: '#/components/schemas/String255'\n        Sort_range:\n          $ref: '#/components/schemas/String255'\n        Sort_rows:\n          $ref: '#/components/schemas/String255'\n        # Table locks\n        Table_locks_immediate:\n          $ref: '#/components/schemas/String255'\n        Table_locks_waited:\n          $ref: '#/components/schemas/String255'\n        # Server\n        Uptime:\n          $ref: '#/components/schemas/String255'\n        Uptime_since_flush_status:\n          $ref: '#/components/schemas/String255'\n      required:\n        # Network\n        - Bytes_received\n        - Bytes_sent\n        # Handler operations\n        - Handler_commit\n        - Handler_update\n        - Handler_write\n        # Buffer pool health\n        - Innodb_buffer_pool_bytes_data\n        - Innodb_buffer_pool_pages_total\n        - Innodb_buffer_pool_pages_free\n        - Innodb_buffer_pool_pages_dirty\n        - Innodb_buffer_pool_pages_flushed\n        - Innodb_buffer_pool_read_requests\n        - Innodb_buffer_pool_reads\n        - Innodb_buffer_pool_wait_free\n        # Redo log / Checkpoint\n        # - Innodb_redo_log_current_lsn (MySQL 8.0.30+ only)\n        # - Innodb_redo_log_checkpoint_lsn (MySQL 8.0.30+ only)\n        # - Innodb_redo_log_flushed_to_disk_lsn (MySQL 8.0.30+ only)\n        - Innodb_log_waits\n        - Innodb_log_writes\n        - Innodb_os_log_fsyncs\n        # I/O operations\n        - Innodb_data_reads\n        - Innodb_data_writes\n        - Innodb_data_fsyncs\n        - Innodb_pages_read\n        - Innodb_pages_written\n        - Innodb_pages_created\n        # Row operations\n        - Innodb_rows_read\n        - Innodb_rows_updated\n        - Innodb_rows_inserted\n        - Innodb_rows_deleted\n        # Row locking\n        - Innodb_row_lock_waits\n        - Innodb_row_lock_current_waits\n        - Innodb_row_lock_time\n        - Innodb_row_lock_time_avg\n        - Innodb_row_lock_time_max\n        # Temp tables\n        - Created_tmp_tables\n        - Created_tmp_disk_tables\n        - Created_tmp_files\n        # Table cache\n        - Open_tables\n        - Opened_tables\n        - Table_open_cache_hits\n        - Table_open_cache_misses\n        - Table_open_cache_overflows\n        # Connections/Threads\n        - Connections\n        - Max_used_connections\n        - Threads_connected\n        - Threads_running\n        - Threads_created\n        - Threads_cached\n        - Aborted_connects\n        - Aborted_clients\n        # Queries\n        - Queries\n        - Slow_queries\n        - Select_scan\n        - Select_full_join\n        - Select_full_range_join\n        # Sorts\n        - Sort_merge_passes\n        - Sort_scan\n        - Sort_range\n        - Sort_rows\n        # Table locks\n        - Table_locks_immediate\n        - Table_locks_waited\n        # Server\n        - Uptime\n        - Uptime_since_flush_status\n    AppInfoMysqlVariables:\n      type: object\n      properties:\n        # InnoDB Buffer Pool - critical for memory and caching\n        innodb_buffer_pool_size:\n          $ref: '#/components/schemas/String255'\n        innodb_buffer_pool_instances:\n          $ref: '#/components/schemas/String255'\n        # InnoDB Logging\n        innodb_log_buffer_size:\n          $ref: '#/components/schemas/String255'\n        innodb_log_file_size:\n          $ref: '#/components/schemas/String255'\n        innodb_redo_log_capacity:\n          $ref: '#/components/schemas/String255'\n        # InnoDB I/O and Flushing\n        innodb_io_capacity:\n          $ref: '#/components/schemas/String255'\n        innodb_io_capacity_max:\n          $ref: '#/components/schemas/String255'\n        innodb_flush_sync:\n          $ref: '#/components/schemas/String255'\n        innodb_flush_log_at_trx_commit:\n          $ref: '#/components/schemas/String255'\n        innodb_doublewrite:\n          $ref: '#/components/schemas/String255'\n        # InnoDB Locking and Buffering\n        innodb_lock_wait_timeout:\n          $ref: '#/components/schemas/String255'\n        innodb_change_buffering:\n          $ref: '#/components/schemas/String255'\n        # Temporary Tables\n        tmp_table_size:\n          $ref: '#/components/schemas/String255'\n        max_heap_table_size:\n          $ref: '#/components/schemas/String255'\n        temptable_max_mmap:\n          $ref: '#/components/schemas/String255'\n        temptable_max_ram:\n          $ref: '#/components/schemas/String255'\n        # Memory Buffers\n        key_buffer_size:\n          $ref: '#/components/schemas/String255'\n        sort_buffer_size:\n          $ref: '#/components/schemas/String255'\n        read_buffer_size:\n          $ref: '#/components/schemas/String255'\n        read_rnd_buffer_size:\n          $ref: '#/components/schemas/String255'\n        join_buffer_size:\n          $ref: '#/components/schemas/String255'\n        binlog_cache_size:\n          $ref: '#/components/schemas/String255'\n        # Connection and Table Cache\n        max_connections:\n          $ref: '#/components/schemas/String255'\n        max_allowed_packet:\n          $ref: '#/components/schemas/String255'\n        thread_cache_size:\n          $ref: '#/components/schemas/String255'\n        table_open_cache:\n          $ref: '#/components/schemas/String255'\n        table_definition_cache:\n          $ref: '#/components/schemas/String255'\n        # Server Version and Query Performance\n        version:\n          $ref: '#/components/schemas/Version'\n        version_compile_machine:\n          $ref: '#/components/schemas/String255'\n        version_compile_os:\n          $ref: '#/components/schemas/String255'\n        long_query_time:\n          $ref: '#/components/schemas/String255'\n      required:\n        # InnoDB Buffer Pool\n        - innodb_buffer_pool_size\n        - innodb_buffer_pool_instances\n        # InnoDB Logging\n        - innodb_log_buffer_size\n        - innodb_log_file_size\n        # - innodb_redo_log_capacity  (8.0.30+ only)\n        # InnoDB I/O and Flushing\n        - innodb_io_capacity\n        - innodb_io_capacity_max\n        - innodb_flush_sync\n        - innodb_flush_log_at_trx_commit\n        - innodb_doublewrite\n        # InnoDB Locking and Buffering\n        - innodb_lock_wait_timeout\n        - innodb_change_buffering\n        # Temporary Tables\n        - tmp_table_size\n        - max_heap_table_size\n        - temptable_max_mmap\n        - temptable_max_ram\n        # Memory Buffers\n        - key_buffer_size\n        - sort_buffer_size\n        - read_buffer_size\n        - read_rnd_buffer_size\n        - join_buffer_size\n        - binlog_cache_size\n        # Connection and Table Cache\n        - max_connections\n        - max_allowed_packet\n        - thread_cache_size\n        - table_open_cache\n        - table_definition_cache\n        # Server Version and Query Performance\n        - version\n        - version_compile_machine\n        - version_compile_os\n        - long_query_time\n    AppInfoMysqlTableStats:\n      type: object\n      additionalProperties:\n        $ref: '#/components/schemas/AppInfoTableInfo'\n    AppInfoTableInfo:\n      type: object\n      properties:\n        tableRows:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        tableCollation:\n          $ref: '#/components/schemas/String255'\n        avgRowLength:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        dataLength:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        indexLength:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        autoIncrement:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        createTime:\n          $ref: '#/components/schemas/Created'\n        updateTime:\n          $ref: '#/components/schemas/StringDateTimeNullable'\n        rowCount:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n      required:\n        - tableRows\n        - tableCollation\n        - avgRowLength\n        - dataLength\n        - indexLength\n        - autoIncrement\n        - createTime\n        - rowCount\n    AppInfoUsers:\n      type: object\n      properties:\n        userInfo:\n          additionalProperties:\n            $ref: '#/components/schemas/AppInfoUserInfo'\n        userPrivilegeCounts:\n          type: object\n          additionalProperties:\n            $ref: '#/components/schemas/AppInfoUserPrivilegeCounts'\n      required:\n        - userInfo\n        - userPrivilegeCounts\n    AppInfoUserPrivilegeCounts:\n      type: object\n      properties:\n        overall:\n            $ref: '#/components/schemas/AppInfoPrivilegeTimeSeriesCounts'\n        activeInLast30Days:\n          type: object\n          additionalProperties:\n            $ref: '#/components/schemas/AppInfoPrivilegeTimeSeriesCounts'\n        activeInLast90Days:\n          type: object\n          additionalProperties:\n            $ref: '#/components/schemas/AppInfoPrivilegeTimeSeriesCounts'\n    AppInfoPrivilegeTimeSeriesCounts:\n      type: object\n      additionalProperties:\n        $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n    AppInfoUserInfo:\n      type: object\n      properties:\n        username:\n          $ref: '#/components/schemas/Username'\n        created:\n          $ref: '#/components/schemas/Created'\n        lastAccess:\n          $ref: '#/components/schemas/UserLastAccess'\n        privileges:\n          $ref: '#/components/schemas/AppInfoUserPrivileges'\n        roles:\n          $ref: '#/components/schemas/AppInfoUserRoles'\n      required: \n        - username\n        - created\n        - lastAccess\n        - privileges\n        - roles\n    AppInfoUserRoles:\n      type: object\n      properties:\n        full:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        owner:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        manage:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        restricted:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n      required:\n        - full\n        - owner\n        - manage\n        - restricted\n    AppInfoUserPrivileges:\n      type: array\n      items:\n        $ref: '#/components/schemas/String255'\n    AppInfoRequests:\n      type: object\n      properties:\n        totalRequests:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        totalApiRequests:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        totalRequestDuration:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        operationIds:\n          additionalProperties:\n            $ref: '#/components/schemas/AppInfoOperation'\n      required:\n        - totalRequests\n        - totalApiRequests\n        - totalRequestDuration\n        - operationIds\n    AppInfoOperation:\n      type: object\n      properties:\n        totalRequests:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        totalDuration:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        elevatedRequests:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        minDuration:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        maxDuration:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        maxDurationUpdates:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        retried:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        averageRetries:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        totalResLength:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        minResLength:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        maxResLength:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        totalReqLength:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        minReqLength:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        maxReqLength:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        projections:\n          $ref: '#/components/schemas/AppInfoOperationIdProjections'\n        clients:\n          $ref: '#/components/schemas/AppInfoClients'\n        users:\n          $ref: '#/components/schemas/AppInfoUserRequests'\n        errors:\n          type: object\n          additionalProperties:\n            type: integer\n            format: int64\n            minimum: 0\n      required:\n        - totalRequests\n        - totalDuration\n        - elevatedRequests\n        - minDuration\n        - maxDuration\n        - maxDurationUpdates\n        - retried\n        - averageRetries\n        - totalResLength\n        - minResLength\n        - maxResLength\n        - clients\n        - users\n        - errors\n    AppInfoClients:\n      type: object \n      additionalProperties:\n        $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n    AppInfoUserRequests:\n      type: object\n      additionalProperties:\n        $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n    AppInfoOperationIdProjections:\n      type: object\n      additionalProperties:\n        $ref: '#/components/schemas/AppInfoOperationIdProjection'\n    AppInfoOperationIdProjection:\n      type: object\n      properties:\n        statusStats:\n          type: object\n          properties:\n            totalRequests:\n              $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n            minDuration:\n              $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n            maxDuration:\n              $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n            totalDuration:\n              $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n            retried:\n              $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n            averageRetries:\n              $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n            averageDuration:\n              $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n          required:\n            - totalRequests\n            - minDuration\n            - maxDuration\n            - totalDuration\n            - retried\n            - averageRetries\n            - averageDuration\n    AppInfoCollection:\n      type: object\n      properties:\n        name:\n          $ref: '#/components/schemas/CollectionName'\n        state:\n          $ref: '#/components/schemas/AppInfoCollectionState'\n        settings:\n          $ref: '#/components/schemas/CollectionSettings'\n        assets:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        assetsDisabled:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        uniqueStigs:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        stigAssignments:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        rules:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        reviews:\n          $ref: '#/components/schemas/Integer64MinimumZeroNullable'\n        reviewsDisabled:\n          $ref: '#/components/schemas/Integer64MinimumZeroNullable'\n        assetStigRanges:\n          $ref: '#/components/schemas/AppInfoAssetStigRanges'\n        grants:\n          $ref: '#/components/schemas/AppInfoCollectionGrants'\n        roleCounts:\n          $ref: '#/components/schemas/AppInfoCollectionRoleCounts'\n        labelCounts:\n          $ref: '#/components/schemas/AppInfoLabelCounts'\n      required:\n        - name\n        - state\n        - settings\n        - assets\n        - assetsDisabled\n        - uniqueStigs\n        - stigAssignments\n        - rules\n        - reviews\n        - reviewsDisabled\n        - assetStigRanges\n        - grants\n        - roleCounts\n        - labelCounts\n    AppInfoCollectionRoleCounts:\n      type: object\n      properties:\n        restricted:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        full:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        manage:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        owner:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n      required:\n        - restricted\n        - full\n        - manage\n        - owner\n    AppInfoCollectionGrants:\n      type: object\n      additionalProperties:\n        $ref: '#/components/schemas/AppInfoCollectionGrant'\n    AppInfoCollectionGrant:\n      type: object\n      properties:\n        role:\n          $ref: '#/components/schemas/Roles'\n        grantee:\n          $ref: '#/components/schemas/AppInfoGrantee'\n        ruleCounts:\n          $ref: '#/components/schemas/AppInfoRuleCounts'\n        uniqueStigs:\n          type: integer\n          format: int64\n          minimum: 0\n        uniqueAssets:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        uniqueStigsDisabled:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        uniqueAssetsDisabled:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n      required:\n        - role\n        - grantee\n        - ruleCounts\n        - uniqueStigs\n        - uniqueAssets\n        - uniqueStigsDisabled\n        - uniqueAssetsDisabled\n    AppInfoGrantee:\n      type: object\n      properties:\n        userId:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        userGroupId:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n      required:\n        - userId\n        - userGroupId\n    AppInfoRuleCounts:\n      type: object\n      properties:\n        r:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        rw:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        none:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n      required:\n        - r\n        - rw\n        - none\n    AppInfoCollectionSettings:\n      type: object\n      additionalProperties: false\n      properties:\n        fields:\n          $ref: '#/components/schemas/CollectionFieldSettings'\n        status:\n          $ref: '#/components/schemas/CollectionStatusSettings'\n        history:\n          $ref: '#/components/schemas/CollectionHistorySettings'\n        importOptions:\n          $ref: '#/components/schemas/CollectionImportOptions'          \n    AppInfoCollectionState:\n      type: string\n      enum:\n        - enabled\n        - disabled\n    AppInfoLabelCounts:\n      type: object\n      properties:\n        collectionLabels:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        labeledAssets:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        assetLabels:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n      required: \n        - collectionLabels\n        - labeledAssets\n        - assetLabels\n    AppInfoGrantCounts:\n      type: object\n      properties:\n        role1:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        role2:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        role3:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        role4:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n    AppInfoRestrictedUsers:\n      type: object\n      properties:\n        uniqueAssets:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        stigAsstCount:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n    AppInfoAssetStigRanges:\n      type: object\n      properties:\n        range00:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        range01to05:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        range06to10:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        range11to15:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n        range16plus:\n          $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n      required:\n        - range00\n        - range01to05\n        - range06to10\n        - range11to15\n        - range16plus\n    Asset:\n      additionalProperties: false\n      type: object\n      properties:\n        assetId:\n          $ref: '#/components/schemas/AssetId'\n        collection:\n          $ref: '#/components/schemas/CollectionBasic'\n        description:\n          $ref: '#/components/schemas/AssetDescription'\n        fqdn:\n          $ref: '#/components/schemas/AssetFqdn'\n        ip:\n          $ref: '#/components/schemas/AssetIp'\n        labelIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/LabelId' \n        mac:\n          $ref: '#/components/schemas/AssetMac'\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        name:\n          $ref: '#/components/schemas/AssetName'\n        noncomputing:\n          $ref: '#/components/schemas/AssetNoncomputing'\n      required:\n        - assetId\n        - name\n        - fqdn\n        - collection\n        - description\n        - ip\n        - mac\n        - noncomputing\n    AssetBasic:\n      additionalProperties: false\n      type: object\n      properties:\n        assetId:\n          $ref: '#/components/schemas/AssetId'\n        name:\n          $ref: '#/components/schemas/AssetName'\n      required:\n        - assetId\n        - name\n    AssetBasicProjected:\n      additionalProperties: false\n      type: object\n      properties:\n        assetId:\n          $ref: '#/components/schemas/AssetId'\n        assetLabelIds:\n          items:\n            $ref: '#/components/schemas/LabelId'\n          type: array\n        assetLabels:\n          type: array\n          items:\n            $ref: '#/components/schemas/LabelBasicWithColor'\n        collectionId:\n          $ref: '#/components/schemas/CollectionId'\n        name:\n          $ref: '#/components/schemas/AssetName'\n        access:\n          $ref: '#/components/schemas/AclRuleAccess'\n      required:\n        - assetId\n        - name\n    AssetCount:\n      minimum: 0\n      type: integer\n    AssetCreateBatch:\n      type: array\n      items:\n        $ref: '#/components/schemas/AssetBatchItem'\n      minItems: 1\n    AssetBatchItem: \n      additionalProperties: false\n      type: object\n      properties:\n        description:\n          $ref: '#/components/schemas/AssetDescription'\n        fqdn:\n          $ref: '#/components/schemas/AssetFqdn'\n        ip:\n          $ref: '#/components/schemas/AssetIp'\n        labelNames:\n          items:\n            $ref: '#/components/schemas/LabelName'\n          type: array\n        mac:\n          $ref: '#/components/schemas/AssetMac'\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        name:\n          $ref: '#/components/schemas/AssetName'\n        noncomputing:\n          $ref: '#/components/schemas/AssetNoncomputing'\n        stigs:\n          description: The benchmarkIds mapped to this Asset\n          items:\n            type: string\n          type: array\n      required:\n        - name\n        - description\n        - ip\n        - noncomputing\n        - metadata\n        - stigs\n    AssetCreateOrReplace:\n      additionalProperties: false\n      type: object\n      properties:\n        collectionId:\n          $ref: '#/components/schemas/CollectionId'\n        description:\n          $ref: '#/components/schemas/AssetDescription'\n        fqdn:\n          $ref: '#/components/schemas/AssetFqdn'\n        ip:\n          $ref: '#/components/schemas/AssetIp'\n        labelNames:\n          items:\n            $ref: '#/components/schemas/LabelName'\n          type: array\n        mac:\n          $ref: '#/components/schemas/AssetMac'\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        name:\n          $ref: '#/components/schemas/AssetName'\n        noncomputing:\n          $ref: '#/components/schemas/AssetNoncomputing'\n        stigs:\n          description: The benchmarkIds mapped to this Asset\n          items:\n            type: string\n          type: array\n      required:\n        - name\n        - collectionId\n        - description\n        - ip\n        - noncomputing\n        - metadata\n        - stigs\n    AssetDescription:\n      $ref: '#/components/schemas/String255Nullable'\n    AssetForCollection:\n      additionalProperties: false\n      type: object\n      properties:\n        assetId:\n          $ref: '#/components/schemas/AssetId'\n        name:\n          $ref: '#/components/schemas/AssetName'\n    AssetFqdn:\n      $ref: '#/components/schemas/String255Nullable'\n    AssetId:\n      $ref: '#/components/schemas/StringIntId'\n    AssetIp:\n      $ref: '#/components/schemas/String255Nullable'\n    AssetMac:\n      $ref: '#/components/schemas/String255Nullable'\n    AssetName:\n      $ref: '#/components/schemas/String255'\n    AssetNoncomputing:\n      type: boolean\n    AssetProjected:\n      additionalProperties: false\n      type: object\n      properties:\n        assetId:\n          $ref: '#/components/schemas/AssetId'\n        collection:\n          $ref: '#/components/schemas/CollectionBasic'\n        description:\n          $ref: '#/components/schemas/AssetDescription'\n        fqdn:\n          $ref: '#/components/schemas/AssetFqdn'\n        ip:\n          $ref: '#/components/schemas/AssetIp'\n        labelIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/LabelId'\n        labels:\n          type: array\n          items:\n            $ref: '#/components/schemas/LabelBasicWithColor'\n        mac:\n          $ref: '#/components/schemas/AssetMac'\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        name:\n          $ref: '#/components/schemas/AssetName'\n        noncomputing:\n          $ref: '#/components/schemas/AssetNoncomputing'\n        statusStats:\n          additionalProperties: false\n          type: object\n          properties:\n            acceptedCount:\n              nullable: true\n              type: integer\n            maxTs:\n              $ref: '#/components/schemas/MaxTs'\n            minTs:\n              $ref: '#/components/schemas/MinTs'\n            rejectedCount:\n              nullable: true\n              type: integer\n            ruleCount:\n              $ref: '#/components/schemas/RuleCount'\n            savedCount:\n              nullable: true\n              type: integer\n            stigCount:\n              type: integer\n            submittedCount:\n              nullable: true\n              type: integer\n        stigs:\n          type: array\n          description: The benchmarkIds mapped to this Asset\n          items:\n            $ref: '#/components/schemas/CollectionStig'\n      required:\n        - assetId\n        - name\n        - fqdn\n        - collection\n        - description\n        - ip\n        - mac\n        - noncomputing\n        - labelIds\n    AssetStigResponse:\n      additionalProperties: false\n      type: object\n      properties:\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        revisionDate:\n          $ref: '#/components/schemas/RevisionDate'\n        revisionStr:\n          $ref: '#/components/schemas/RevisionStrRaw'\n        ruleCount:\n          $ref: '#/components/schemas/RuleCount'\n      required:\n        - benchmarkId\n        - revisionStr\n        - revisionDate\n        - ruleCount\n    AssetStigSelection:\n      additionalProperties: false\n      type: object\n      description: >\n        An array that specifies a list of Assets/STIG items.\n\n\n        Each array item is an object that MUST include the property `assetId`\n        and MAY include the property `stigs`.\n\n\n        If the `stigs` property is absent, the default value of the property is\n        used. The default value is an array of the default revisions of each\n        STIG to which the requesting User\n\n        has been granted access on the Asset.\n\n\n        If the `stigs` property is present, the value MUST be an array. Each\n        array member is EITHER:\n\n        - an object that identifies both a `benchmarkId` and a specific\n        `revisionStr`\n\n        - a string whose value is a `benchmarkId`. This is equivalent to\n        specifying the object {\"benchmarkId\": [provided benchmarkId],\n        \"revisionStr\": [default revisionStr for the provided benchmarkId]}\n      properties:\n        assetId:\n          $ref: '#/components/schemas/AssetId'\n        stigs:\n          maxItems: 30\n          minItems: 1\n          type: array\n          uniqueItems: true\n          items:\n            oneOf:\n              - $ref: '#/components/schemas/RevisionBasic'\n              - $ref: '#/components/schemas/String255'\n      required:\n        - assetId\n    AssetUpdate:\n      additionalProperties: false\n      type: object\n      properties:\n        collectionId:\n          $ref: '#/components/schemas/CollectionId'\n        description:\n          $ref: '#/components/schemas/AssetDescription'\n        fqdn:\n          $ref: '#/components/schemas/AssetFqdn'\n        ip:\n          $ref: '#/components/schemas/AssetIp'\n        labelNames:\n          type: array\n          items:\n            $ref: '#/components/schemas/LabelName'\n        mac:\n          $ref: '#/components/schemas/AssetMac'\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        name:\n          $ref: '#/components/schemas/AssetName'\n        noncomputing:\n          $ref: '#/components/schemas/AssetNoncomputing'\n        stigs:\n          description: The benchmarkIds mapped to this Asset\n          type: array\n          items:\n            $ref: '#/components/schemas/BenchmarkId'\n    AssetsPatchRequest:\n      additionalProperties: false\n      type: object\n      properties:\n        assetIds:\n          type: array\n          minItems: 1\n          items:\n            $ref: '#/components/schemas/AssetId'\n        operation:\n          type: string\n          enum:\n            - delete\n      required:\n        - assetIds\n        - operation\n    AssetsPatchResponse:\n      additionalProperties: false\n      type: object\n      properties:\n        assetIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/AssetId'\n        operation:\n          type: string\n          enum:\n            - deleted\n    Attribution:\n      type: object\n      properties:\n        userId:\n          $ref: '#/components/schemas/UserId'\n        username:\n          $ref: '#/components/schemas/Username'\n        ts:\n          $ref: '#/components/schemas/StringDateTime'\n    Attributions:\n      type: object\n      properties:\n        created:\n          $ref: '#/components/schemas/Attribution'\n        modified:\n          $ref: '#/components/schemas/Attribution'\n    BenchmarkId:\n      $ref: '#/components/schemas/String255Nullable'\n    Cci:\n      additionalProperties: false\n      type: object\n      properties:\n        cci:\n          $ref: '#/components/schemas/CciString'\n        contributor:\n          type: string\n        definition:\n          $ref: '#/components/schemas/DefinitionString'\n        emassAp:\n          $ref: '#/components/schemas/EmassAp'\n        publishdate:\n          $ref: '#/components/schemas/StringDateTime'\n        references:\n          type: array\n          items:\n            $ref: '#/components/schemas/CciReferenceItem'\n        status:\n          $ref: '#/components/schemas/CciStatus'\n        stigs:\n          items:\n            $ref: '#/components/schemas/RevisionBasic'\n          type: array\n        type:\n          $ref: '#/components/schemas/CciType'\n    CciBasic:\n      additionalProperties: false\n      type: object\n      properties:\n        apAcronym:\n          $ref: '#/components/schemas/ApAcronym'\n        cci:\n          $ref: '#/components/schemas/CciString'\n        control:\n          nullable: true\n          type: string\n        definition:\n          $ref: '#/components/schemas/DefinitionString'\n      required:\n        - cci\n        - apAcronym\n        - definition\n        - control\n    CciListItem:\n      additionalProperties: false\n      type: object\n      properties:\n        cci:\n          $ref: '#/components/schemas/CciString'\n        references:\n          type: array\n          items:\n            $ref: '#/components/schemas/CciReferenceItem'\n        type:\n          $ref: '#/components/schemas/CciType'\n    CciLocation:\n      $ref: '#/components/schemas/String255'\n    CciReferenceItem:\n      additionalProperties: false\n      type: object\n      properties:\n        creator:\n          type: string\n        indexDisa:\n          $ref: '#/components/schemas/IndexDisa'\n        location:\n          $ref: '#/components/schemas/CciLocation'\n        parentControl:\n          $ref: '#/components/schemas/ParentControl'\n        textRefNist:\n          $ref: '#/components/schemas/TextRefNist'\n        title:\n          $ref: '#/components/schemas/CciString'\n        version:\n          $ref: '#/components/schemas/VersionString'\n    CciStatus:\n      $ref: '#/components/schemas/String20'\n    CciString:\n      $ref: '#/components/schemas/String255'\n    CciType:\n      $ref: '#/components/schemas/String20'\n    Check:\n      additionalProperties: false\n      type: object\n      properties:\n        content:\n          type: string\n        system:\n          type: string\n    ChecklistAssetStig:\n      type: array\n      items:\n        additionalProperties: false\n        type: object\n        properties:\n          assetId:\n            $ref: '#/components/schemas/AssetId'\n          autoResult:\n            type: boolean\n          comment:\n            $ref: '#/components/schemas/CommentaryStringNullable'\n          detail:\n            $ref: '#/components/schemas/CommentaryStringNullable'\n          groupId:\n            $ref: '#/components/schemas/GroupId'\n          groupTitle:\n            $ref: '#/components/schemas/GroupTitle'\n          result:\n            $ref: '#/components/schemas/ChecklistResult'\n          resultEngine:\n            $ref: '#/components/schemas/ResultEngine'\n          rule:\n            $ref: '#/components/schemas/RuleProjected'\n          ruleId:\n            $ref: '#/components/schemas/RuleId'\n          ruleTitle:\n            $ref: '#/components/schemas/RuleTitle'\n          severity:\n            $ref: '#/components/schemas/RuleSeverity'\n          status:\n            $ref: '#/components/schemas/ChecklistStatus'\n          statusTs:\n            $ref: '#/components/schemas/StringDateTimeNullable'\n          touchTs:\n            $ref: '#/components/schemas/StringDateTimeNullable'\n          ts:\n            $ref: '#/components/schemas/StringDateTimeNullable'\n          version:\n            $ref: '#/components/schemas/VersionString'\n    ChecklistCkl:\n      additionalProperties: false\n      description: The CKL format generated and read by DISA STIG Viewer\n      type: object\n      properties:\n        ASSET:\n          type: object\n          additionalProperties: false\n          properties:\n            ASSET_TYPE:\n              type: string\n            HOST_FQDN:\n              type: string\n            HOST_GUID:\n              type: string\n            HOST_IP:\n              type: string\n            HOST_MAC:\n              type: string\n            HOST_NAME:\n              type: string\n            TARGET_KEY:\n              type: string\n            TECH_AREA:\n              type: string\n        STIGS:\n          type: object\n          additionalProperties: false\n          properties:\n            iSTIG:\n              type: array\n              items:\n                type: object\n                properties:\n                  STIG_INFO:\n                    type: array\n                    items:\n                      type: object\n                      properties:\n                        SI_DATA:\n                          type: object\n                          properties:\n                            SID_DATA:\n                              type: string\n                            SID_NAME:\n                              type: string\n                  VULN:\n                    type: array\n                    items:\n                      type: object\n                      additionalProperties: false\n                      properties:\n                        COMMENTS:\n                          type: string\n                        FINDING_DETAILS:\n                          type: string\n                        SEVERITY_JUSTIFICATION:\n                          type: string\n                        SEVERITY_OVERRIDE:\n                          type: string\n                        STATUS:\n                          type: string\n                          enum:\n                            - Open\n                            - NotAFinding\n                            - Not_Applicable\n                            - Not_Reviewed\n                        STIG_DATA:\n                          type: array\n                          items:\n                            type: object\n                            properties:\n                              ATTRIBUTE_DATA:\n                                type: string\n                              VULN_ATTRIBUTE:\n                                type: string\n      xml:\n        name: CHECKLIST\n    ChecklistCklb:\n      additionalProperties: false\n      description: The CKLB format generated and read by DISA STIG VIewer 3\n      type: object\n      properties:\n        title:\n          type: string\n        id:\n          type: string\n          format: uuid\n        active:\n          type: boolean\n        mode:\n          type: integer\n        has_path:\n          type: boolean\n        target_data:\n          $ref: '#/components/schemas/TargetData'\n        stigs:\n          type: array\n          items:\n            $ref: '#/components/schemas/StigCklb'\n    ChecklistJsonAccess:\n      type: object\n      properties:\n        access:\n          $ref: '#/components/schemas/AclRuleAccess'\n        checklist:\n          $ref: '#/components/schemas/ChecklistAssetStig'\n    TargetData:\n      type: object\n      properties:\n        target_type:\n          type: string\n        host_name:\n          $ref: '#/components/schemas/AssetName'\n        ip_address:\n          $ref: '#/components/schemas/AssetIp'\n        mac_address:\n          $ref: '#/components/schemas/AssetMac'\n        fqdn:\n          $ref: '#/components/schemas/AssetFqdn'\n        comments:\n          type: string\n        role:\n          type: string\n        is_web_database:\n          type: boolean\n        technology_area:\n          type: string\n        web_db_site:\n          type: string\n        web_db_instance:\n          type: string\n    StigCklb:\n      type: object\n      properties:\n        stig_name:\n          type: string\n        display_name:\n          type: string\n        stig_id:\n          type: string\n        version:\n          type: string\n        release_info:\n          type: string\n        uuid:\n          type: string\n          format: uuid\n        reference_identifier:\n          type: string\n        size:\n          type: integer\n        rules:\n          type: array\n          items:\n            $ref: '#/components/schemas/Rule'\n    Rule:\n      type: object\n      properties:\n        uuid:\n          type: string\n          format: uuid\n        stig_uuid:\n          type: string\n          format: uuid\n        target_key:\n          type: string\n          nullable: true\n        stig_ref:\n          type: string\n          nullable: true\n        group_id:\n          type: string\n        rule_id:\n          type: string\n        rule_id_src:\n          type: string\n        weight:\n          type: string\n        classification:\n          type: string\n        severity:\n          type: string\n        rule_version:\n          type: string\n        group_title:\n          type: string\n        rule_title:\n          type: string\n        fix_text:\n          type: string\n        false_positives:\n          type: string\n          nullable: true\n        false_negatives:\n          type: string\n          nullable: true\n        discussion:\n          type: string\n        check_content:\n          type: string\n        documentable:\n          type: string\n        mitigations:\n          type: string\n          nullable: true\n        potential_impacts:\n          type: string\n          nullable: true\n        third_party_tools:\n          type: string\n          nullable: true\n        mitigation_control:\n          type: string\n          nullable: true\n        responsibility:\n          type: string\n          nullable: true\n        security_override_guidance:\n          type: string\n          nullable: true\n        ia_controls:\n          type: string\n          nullable: true\n        check_content_ref:\n          type: object\n          properties:\n            href:\n              type: string\n            name:\n              type: string\n        legacy_ids:\n          type: array\n          items:\n            type: string\n        group_tree:\n          type: array\n          items:\n            $ref: '#/components/schemas/GroupTree'\n        createdAt:\n          type: string\n          format: date-time\n        updatedAt:\n          type: string\n          format: date-time\n        STIGUuid:\n          type: string\n          format: uuid\n        status:\n          type: string\n        overrides:\n          type: object\n        comments:\n          type: string\n        finding_details:\n          type: string\n        ccis:\n          type: array\n          items:\n            type: string\n    GroupTree:\n      type: object\n      properties:\n        id:\n          type: string\n        title:\n          type: string\n        description:\n          type: string\n    ChecklistCollectionCounts:\n      additionalProperties: false\n      type: object\n      properties:\n        results:\n          type: object\n          additionalProperties: false\n          properties:\n            fail:\n              type: integer\n            notapplicable:\n              type: integer\n            other:\n              type: integer\n            pass:\n              type: integer\n        statuses:\n          additionalProperties: false\n          type: object\n          properties:\n            accepted:\n              type: integer\n            rejected:\n              type: integer\n            saved:\n              type: integer\n            submitted:\n              type: integer\n    ChecklistCollectionStig:\n      additionalProperties: false\n      type: object\n      properties:\n        counts:\n          $ref: '#/components/schemas/ChecklistCollectionCounts'\n        groupId:\n          $ref: '#/components/schemas/GroupId'\n        groupTitle:\n          $ref: '#/components/schemas/GroupTitle'\n        ruleId:\n          $ref: '#/components/schemas/RuleId'\n        ruleTitle:\n          $ref: '#/components/schemas/RuleTitle'\n        severity:\n          $ref: '#/components/schemas/RuleSeverity'\n        timestamps:\n          additionalProperties: false\n          type: object\n          properties:\n            statusTs:\n              $ref: '#/components/schemas/ChecklistCollectionStigTimestamps'\n            touchTs:\n              $ref: '#/components/schemas/ChecklistCollectionStigTimestamps'\n            ts:\n              $ref: '#/components/schemas/ChecklistCollectionStigTimestamps'\n        version:\n          $ref: '#/components/schemas/VersionString'\n    ChecklistCollectionStigTimestamp:\n      $ref: '#/components/schemas/StringDateTimeNullable'\n    ChecklistCollectionStigTimestamps:\n      additionalProperties: false\n      type: object\n      properties:\n        max:\n          $ref: '#/components/schemas/ChecklistCollectionStigTimestamp'\n        min:\n          $ref: '#/components/schemas/ChecklistCollectionStigTimestamp'\n    ChecklistResult:\n      description: The Review result\n      type: string\n      nullable: true\n      enum:\n        - fail\n        - pass\n        - notapplicable\n        - notchecked\n        - unknown\n        - error\n        - notselected\n        - informational\n        - fixed\n        - null\n    ChecklistResultUnreviewed:\n      description: The Review result\n      type: string\n      enum:\n        - notchecked\n        - unknown\n        - error\n        - notselected\n        - informational\n        - fixed\n        - null\n      nullable: true\n    ChecklistStatus:\n      type: string\n      nullable: true\n      enum:\n        - saved\n        - submitted\n        - accepted\n        - rejected\n        - null\n    ChecklistXccdf:\n      additionalProperties: true\n      type: object\n      description: >\n        An XCCDF document with TestResult. Note: OAS 3.x cannot represent the\n        actual XML schema\n      xml:\n        name: Benchmark\n        namespace: http://checklists.nist.gov/xccdf/1.2\n    ClientErrorBadAssetPost:\n      additionalProperties: false\n      type: object\n      properties:\n        code:\n          type: string\n          enum:\n            - \"422\"\n          nullable: true\n        error:\n          type: string\n        detail:\n          type: array\n          items:\n            type: object\n            properties:\n              failure: \n                type: string\n              detail:\n                type: object\n                properties:\n                  name:\n                    type: string\n                  assetIndex:\n                    type: integer\n                  benchmarkId:\n                    type: string\n                  benchmarkIdIndex:\n                    type: integer\n                  labelName:\n                    type: string\n                  labelIndex:\n                    type: integer\n      required:\n        - error\n        - detail\n    ClientErrorDuplicateCollection:\n      additionalProperties: false\n      type: object\n      properties:\n        code:\n          type: string\n          enum:\n            - \"400\"\n        data:\n          $ref: '#/components/schemas/Collection'\n        message:\n          type: string\n          enum:\n            - Duplicate name\n    Collection:\n      additionalProperties: false\n      type: object\n      properties:\n        collectionId:\n          $ref: '#/components/schemas/CollectionId'\n        created:\n          $ref: '#/components/schemas/Created'\n        description:\n          $ref: '#/components/schemas/CollectionDescription'\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        name:\n          $ref: '#/components/schemas/CollectionName'\n        settings:\n          $ref: '#/components/schemas/CollectionSettings'\n      required:\n        - collectionId\n        - name\n        - description\n        - settings\n        - metadata\n        - created\n    CollectionBasic:\n      additionalProperties: false\n      type: object\n      properties:\n        collectionId:\n          $ref: '#/components/schemas/CollectionId'\n        name:\n          $ref: '#/components/schemas/CollectionName'\n    CollectionCloneOptions:\n      additionalProperties: false\n      type: object\n      properties:\n        assets:\n          type: boolean\n          default: true\n          description: >-\n            Clone the source Collection's Assets and their core properties. If\n            this option is not enabled then the stagMappings and pinRevisions\n            options are ignored.\n        grants:\n          default: true\n          type: boolean\n          description: >-\n            Clone the source Collection's users and their grants. Whether this\n            option is enabled or not, the creator of the cloned Collection (ie.\n            you) will be given an Owner grant in the clone.\n        labels:\n          type: boolean\n          default: true\n          description: >-\n            Clone the source Collection's available labels. You must enable this\n            option AND the assets option for labels to be mapped to Assets in\n            the clone.\n        pinRevisions:\n          default: matchSource\n          type: string\n          description: >\n            <b>matchSource:</b> STIGs in the source Collection that are pinned\n            to a specific Revision will be pinned to that Revision in the clone.\n            STIGs that track the latest Revision (unpinned) in the source will\n            be unpinned in the clone.<br><br><b>sourceDefaults:</b> All STIGs in\n            the clone will be pinned to a specific Revision. STIGs that are\n            pinned to a specific Revision in the source Collection will be\n            pinned to that Revision in the clone. STIGs that track the latest\n            Revision in the source will be pinned to the current latest Revision\n            in the clone.\n          enum:\n            - matchSource\n            - sourceDefaults\n\n        stigMappings:\n          default: withReviews\n          type: string\n          description: >\n            <b>withReviews:</b> Assets will be cloned with their current STIG\n            assignments and ALL stored Reviews. This will include Reviews that\n            are no longer associated with a current STIG assignment or are\n            associated with a non-default Revision of a\n            STIG.<br><br><b>withoutReviews:</b> Assets will be cloned with their\n            current STIG assignments but NO stored Reviews will be cloned. All\n            Metrics will be set to zero.<br><br> <b>none:</b> Assets will be\n            cloned with only their core properties and no STIG assignments or\n            Reviews. The pinRevisions option will be ignored.\n          enum:\n            - none\n            - withReviews\n            - withoutReviews\n    CollectionCloneRequest:\n      additionalProperties: false\n      type: object\n      properties:\n        description:\n          $ref: '#/components/schemas/CollectionDescription'\n        name:\n          $ref: '#/components/schemas/CollectionName'\n        options:\n          $ref: '#/components/schemas/CollectionCloneOptions'\n      required:\n        - name\n        - description\n    CollectionCloneResponse:\n      description: >\n        The response body is a stream of newline-delimited JSON (NDJSON) objects\n        reporting the progress of the (possibly long running) cloning process.\n        Each object conforms to this schema, but not all objects will have every\n        property.<br/><br/>The sequence of objects starts with multiple\n        {\"stage\": \"collection\"} objects, optionally followed by multiple\n        {\"stage\": \"reviews\"} objects if review cloning is requested, and\n        concludes with one {\"stage\": \"result\"} object whose \"collection\"\n        property value conforms to the CollectionProjected schema for the\n        created Collection.<br/><br/>Success is indicated when the final\n        {\"stage\": \"result\"} message is sent. Errors that prevent cloning from\n        completing are reported with {\"status\": \"error\"} and the \"result\" stage\n        is not reported. Note that the endpoint will return HTTP status 200\n        immediately after the request is validated and the cloning process has\n        started, so you should not rely on status 200 for indication of cloning\n        success.\n      type: object\n      properties:\n        collection:\n          $ref: '#/components/schemas/CollectionProjected'\n        error:\n          type: object\n        message:\n          type: string\n        stack:\n          type: string\n        stage:\n          enum:\n            - collection\n            - reviews\n            - result\n          type: string\n        status:\n          enum:\n            - running\n            - finished\n            - error\n          type: string\n        step:\n          type: integer\n        stepCount:\n          type: integer\n        stepName:\n          type: string\n    CollectionCreateOrReplace:\n      additionalProperties: false\n      type: object\n      properties:\n        description:\n          $ref: '#/components/schemas/CollectionDescription'\n        grants:\n          type: array\n          items:\n            anyOf:\n              - $ref: '#/components/schemas/UserGrant'\n              - $ref: '#/components/schemas/UserGroupGrant'\n        labels:\n          type: array\n          items:\n            $ref: '#/components/schemas/LabelCreate'\n          \n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        name:\n          $ref: '#/components/schemas/CollectionName'\n        settings:\n          $ref: '#/components/schemas/CollectionSettings'\n      required:\n        - name\n        - grants\n    CollectionDescription:\n      $ref: '#/components/schemas/String255Nullable'\n    CollectionExportToResponse:\n      description: >\n        The response body is a stream of newline-delimited JSON (NDJSON) objects\n        reporting the progress of the (possibly long running) export process.\n        Each object conforms to this schema, but not all objects will have every\n        property.<br/><br/>The sequence of objects starts with multiple\n        {\"stage\": \"prepare\"} objects, followed by multiple {\"stage\": \"assets\"}\n        objects, multiple {\"stage\": \"reviews\"} objects, and multiple {\"stage\":\n        \"metrics\"} objects. The stream concludes with one {\"stage\": \"commit\"}\n        object and then one {\"stage\": \"result\"} object whose \"counts\" property\n        value conforms to the schema below.<br/><br/>Success is indicated when\n        the final {\"stage\": \"result\"} message is sent. Errors that prevent\n        exporting from completing are reported with {\"status\": \"error\"} and the\n        \"result\" stage is not reported. Note that the endpoint will return HTTP\n        status 200 immediately after the request is validated and the export\n        process has started, so you should not rely on status 200 for indication\n        of export success.\n      type: object\n      properties:\n        counts:\n          additionalProperties: false\n          type: object\n          properties:\n            assetsCreated:\n              type: integer\n            reviewsInserted:\n              type: integer\n            reviewsUpdated:\n              type: integer\n            stigsMapped:\n              type: integer\n        error:\n          type: object\n        message:\n          type: string\n        stack:\n          type: string\n        stage:\n          enum:\n            - prepare\n            - assets\n            - reviews\n            - metrics\n            - result\n          type: string\n        status:\n          enum:\n            - running\n            - error\n          type: string\n        step:\n          type: integer\n        stepCount:\n          type: integer\n        stepName:\n          type: string\n    CollectionFieldEnabledAlways:\n      additionalProperties: false\n      type: object\n      properties:\n        enabled:\n          type: string\n          enum:\n            - always\n        required:\n          type: string\n          enum:\n            - always\n            - findings\n            - optional\n      required:\n        - enabled\n        - required\n    CollectionFieldEnabledFindings:\n      additionalProperties: false\n      type: object\n      properties:\n        enabled:\n          type: string\n          enum:\n            - findings\n        required:\n          type: string\n          enum:\n            - findings\n            - optional\n      required:\n        - enabled\n        - required\n    CollectionFieldSetting:\n      type: object\n      example:\n        enabled: always\n        required: findings\n      oneOf:\n        - $ref: '#/components/schemas/CollectionFieldEnabledAlways'\n        - $ref: '#/components/schemas/CollectionFieldEnabledFindings'\n    CollectionFieldSettings:\n      additionalProperties: false\n      type: object\n      properties:\n        comment:\n          $ref: '#/components/schemas/CollectionFieldSetting'\n        detail:\n          $ref: '#/components/schemas/CollectionFieldSetting'\n      required:\n        - detail\n        - comment\n    CollectionGrant:\n      additionalProperties: false\n      type: object\n      properties:\n        roleId:\n          $ref: '#/components/schemas/RoleId'\n        collectionId:\n          $ref: '#/components/schemas/CollectionId'\n      required:\n        - collectionId\n        - roleId\n    CollectionGrantProjected:\n      additionalProperties: false\n      type: object\n      properties:\n        roleId:\n          $ref: '#/components/schemas/RoleId'\n        collection:\n          type: object\n          properties:\n            collectionId:\n              $ref: '#/components/schemas/CollectionId'\n            name:\n              $ref: '#/components/schemas/CollectionName'\n        grantees:\n          $ref: '#/components/schemas/Grantees'\n    CollectionHistorySettings:\n      additionalProperties: false\n      type: object\n      properties:\n        maxReviews:\n          example: 5\n          maximum: 15\n          minimum: 0\n          type: integer\n      required:\n        - maxReviews\n    CollectionId:\n      $ref: '#/components/schemas/StringIntId'\n    CollectionImportOptions:\n      additionalProperties: false\n      type: object\n      properties:\n        autoStatus:\n          $ref: '#/components/schemas/CollectionImportAutoStatus'\n        unreviewed:\n          description: |\n            Controls how to handle unreviewed rules (those with result = 'notchecked').\n            - 'never': Don't import unreviewed rules\n            - 'commented': Import unreviewed rules that have comments, using the result specified in unreviewedCommented\n            - 'always': Import all unreviewed rules, using the result specified in unreviewedCommented for those with comments\n          type: string\n          enum:\n            - never\n            - commented\n            - always\n        unreviewedCommented:\n          description: |\n            The result to use for unreviewed rules that have comments, when unreviewed is set to 'commented' or 'always'.\n          type: string\n          enum:\n            - notchecked\n            - informational\n        emptyDetail:\n          description: |\n            Controls how to handle rules with empty finding details.\n            - 'ignore': Leave the detail field null\n            - 'import': Import the empty detail (as an empty string)\n            - 'replace': Replace with a default message\n          type: string\n          enum:\n            - ignore\n            - import\n            - replace\n        emptyComment:\n          description: |\n            Controls how to handle rules with empty comments.\n            - 'ignore': Leave the comment field null\n            - 'import': Import the empty comment (as an empty string)\n            - 'replace': Replace with a default message\n          type: string\n          enum:\n            - ignore\n            - import\n            - replace\n        updateAssetProps:\n          description: |\n            Flag indicating whether to update Asset information (IP, MAC, FQDN, noncomputing, and metadata including role and tech area) when Asset already exists in the Collection.\n          type: boolean\n        allowCustom:\n          description: |\n            Flag indicating whether Clients may POST reviews that do not conform to importOptions specified.\n          type: boolean\n      required:\n        - autoStatus\n        - unreviewed\n        - unreviewedCommented\n        - emptyDetail\n        - emptyComment\n        - allowCustom\n    CollectionImportAutoStatus:\n      type: object\n      additionalProperties: false\n      description: |\n        Determines how to set the status property of imported reviews for each evaluation result.\n        Each property must be one of:\n         - 'null': Don't set a status (Keep existing Review Status)\n         - 'saved': Always set status to 'saved'\n         - 'submitted': Set status to 'submitted' if the review is submittable per Collection settings\n         - 'accepted': Set status to 'accepted' if the review is submittable, and User has permission to accept,  otherwise 'submitted'\n      properties:\n        fail:\n          $ref: '#/components/schemas/ReviewStatusOption'\n        notapplicable:\n          $ref: '#/components/schemas/ReviewStatusOption'\n        pass:\n          $ref: '#/components/schemas/ReviewStatusOption'\n      required:\n      - fail\n      - notapplicable\n      - pass\n    CollectionName:\n      $ref: '#/components/schemas/String45'\n    CollectionProjected:\n      additionalProperties: false\n      type: object\n      properties:\n        assets:\n          type: array\n          items:\n            $ref: '#/components/schemas/AssetForCollection'\n        collectionId:\n          $ref: '#/components/schemas/CollectionId'\n        description:\n          $ref: '#/components/schemas/CollectionDescription'\n        grants:\n          type: array\n          items:\n            anyOf:\n             - $ref: '#/components/schemas/UserGrantProjected'     \n             - $ref: '#/components/schemas/UserGroupGrantProjected'     \n        users:\n          type: array\n          items:\n            $ref: '#/components/schemas/GrantEffective'\n        labels:\n          type: array\n          items:\n            $ref: '#/components/schemas/Label'\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        name:\n          $ref: '#/components/schemas/CollectionName'\n        owners:\n          type: array\n          items:\n            $ref: '#/components/schemas/Owner'\n        settings:\n          $ref: '#/components/schemas/CollectionSettings'\n        statistics:\n          $ref: '#/components/schemas/CollectionStatistics'\n        stigs:\n          type: array\n          items:\n            $ref: '#/components/schemas/CollectionStig'\n      required:\n        - collectionId\n        - name\n        - description\n        - settings\n        - metadata\n    CollectionSettings:\n      additionalProperties: false\n      type: object\n      properties:\n        fields:\n          $ref: '#/components/schemas/CollectionFieldSettings'\n        history:\n          $ref: '#/components/schemas/CollectionHistorySettings'\n        status:\n          $ref: '#/components/schemas/CollectionStatusSettings'\n        importOptions:\n          $ref: '#/components/schemas/CollectionImportOptions'\n    CollectionSettingsRequired:\n      additionalProperties: false\n      type: object\n      properties:\n        fields:\n          $ref: '#/components/schemas/CollectionFieldSettings'\n        history:\n          $ref: '#/components/schemas/CollectionHistorySettings'\n        status:\n          $ref: '#/components/schemas/CollectionStatusSettings'\n        importOptions:\n          $ref: '#/components/schemas/CollectionImportOptions'\n      required:\n        - fields\n        - history\n        - status\n        - importOptions\n    CollectionStatistics:\n      additionalProperties: false\n      type: object\n      properties:\n        assetCount:\n          $ref: '#/components/schemas/AssetCount'\n        checklistCount:\n          type: integer\n        created:\n          $ref: '#/components/schemas/Created'\n        userCount:\n          type: integer\n      required:\n        - created\n        - assetCount\n        - userCount\n        - checklistCount\n    CollectionStatusCount:\n      additionalProperties: false\n      type: object\n      properties:\n        resultEngine:\n          type: integer\n        total:\n          type: integer\n      required:\n        - total\n        - resultEngine\n    CollectionStatusSettings:\n      additionalProperties: false\n      type: object\n      properties:\n        canAccept:\n          type: boolean\n        minAcceptGrant:\n          type: integer\n          example: 2\n          maximum: 4\n          minimum: 2\n        resetCriteria:\n          type: string\n          example: result\n          enum:\n            - any\n            - result\n      required:\n        - canAccept\n        - minAcceptGrant\n        - resetCriteria\n    CollectionStig:\n      additionalProperties: false\n      type: object\n      properties:\n        benchmarkDate:\n          $ref: '#/components/schemas/StringDateNullable'\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        revisionPinned:\n          type: boolean\n        revisionStr:\n          $ref: '#/components/schemas/RevisionStr'\n        ruleCount:\n          $ref: '#/components/schemas/RuleCount'\n      required:\n        - benchmarkId\n        - revisionStr\n        - benchmarkDate\n        - revisionPinned\n        - ruleCount\n    CollectionStigWithAssetCount:\n      additionalProperties: false\n      type: object\n      properties:\n        assetCount:\n          $ref: '#/components/schemas/AssetCount'\n        assets:\n          items:\n            $ref: '#/components/schemas/AssetForCollection'\n          type: array\n        benchmarkDate:\n          $ref: '#/components/schemas/StringDateNullable'\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        revisionPinned:\n          type: boolean\n        revisionStr:\n          $ref: '#/components/schemas/RevisionStr'\n        ruleCount:\n          $ref: '#/components/schemas/RuleCount'\n        title:\n          $ref: '#/components/schemas/StatusText'\n      required:\n        - benchmarkId\n        - revisionStr\n        - benchmarkDate\n        - revisionPinned\n        - ruleCount\n        - assetCount\n    CollectionStigWithIsDefault:\n      additionalProperties: false\n      type: object\n      properties:\n        benchmarkDate:\n          $ref: '#/components/schemas/StringDateNullable'\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        isDefault:\n          type: boolean\n        revisionPinned:\n          type: boolean\n        revisionStr:\n          $ref: '#/components/schemas/RevisionStr'\n        ruleCount:\n          $ref: '#/components/schemas/RuleCount'\n      required:\n        - benchmarkId\n        - revisionStr\n        - benchmarkDate\n        - revisionPinned\n        - ruleCount\n        - isDefault\n    CollectionUpdate:\n      type: object\n      additionalProperties: false\n      minProperties: 1\n      properties:\n        description:\n          $ref: '#/components/schemas/CollectionDescription'\n        grants:\n          type: array\n          items:\n            type: object\n            properties:\n              roleId:\n                $ref: '#/components/schemas/RoleId'\n              userId:\n                $ref: '#/components/schemas/UserId'\n        labels:\n          type: array\n          items:\n            $ref: '#/components/schemas/LabelCreate'\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        name:\n          $ref: '#/components/schemas/CollectionName'\n        settings:\n          $ref: '#/components/schemas/CollectionSettingsRequired'\n    CollectionsProjected:\n      additionalProperties: false\n      type: object\n      properties:\n        collectionId:\n          $ref: '#/components/schemas/CollectionId'\n        description:\n          $ref: '#/components/schemas/CollectionDescription'\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        name:\n          $ref: '#/components/schemas/CollectionName'\n        owners:\n          type: array\n          items:\n            $ref: '#/components/schemas/Owner'\n        settings:\n          $ref: '#/components/schemas/CollectionSettings'\n        statistics:\n          $ref: '#/components/schemas/CollectionStatistics'\n      required:\n        - collectionId\n        - name\n        - description\n        - settings\n        - metadata\n    CommentaryString:\n      $ref: '#/components/schemas/String32767'\n    CommentaryStringNullable:\n      $ref: '#/components/schemas/String32767Nullable'\n    CommitBranch:\n      type: string\n    CommitDescribe:\n      type: string\n    CommitObject:\n      type: object\n      additionalProperties: false\n      properties:\n        branch:\n          $ref: '#/components/schemas/CommitBranch'\n        describe:\n          $ref: '#/components/schemas/CommitDescribe'\n        sha:\n          $ref: '#/components/schemas/CommitSha'\n        tag:\n          $ref: '#/components/schemas/CommitTag'\n    CommitSha:\n      type: string\n    CommitTag:\n      type: string\n    Created:\n      $ref: '#/components/schemas/StringDateTime'\n    DefinitionString:\n      nullable: true\n      type: string\n    Detail:\n      type: object\n      properties:\n        assetStig:\n          type: array\n          items:\n            $ref: '#/components/schemas/DetailAssetStig'\n        dbInfo:\n          $ref: '#/components/schemas/DetailMySqlInfo'\n    DetailAssetStig:\n      additionalProperties: false\n      type: object\n      properties:\n        assetCnt:\n          type: integer\n        collectionId:\n          $ref: '#/components/schemas/CollectionId'\n        range01to05:\n          type: integer\n        range06to10:\n          type: integer\n        range11to15:\n          type: integer\n        range16plus:\n          type: integer\n    DetailMySqlInfo:\n      type: object\n      properties:\n        tables:\n          type: object\n          additionalProperties:\n            $ref: '#/components/schemas/DetailMySqlTableInfo'\n    DetailMySqlTableInfo:\n      additionalProperties: false\n      type: object\n      properties:\n        autoIncrement:\n          nullable: true\n          type: integer\n        avgRowLength:\n          nullable: true\n          type: integer\n        createTime:\n          $ref: '#/components/schemas/StringDateTimeNullable'\n        dataLength:\n          nullable: true\n          type: integer\n        indexLength:\n          nullable: true\n          type: integer\n        maxDataLength:\n          nullable: true\n          type: integer\n        tableCollation:\n          nullable: true\n          type: string\n        tableName:\n          type: string\n        tableRows:\n          nullable: true\n          type: integer\n        updateTime:\n          $ref: '#/components/schemas/StringDateTimeNullable'\n    Dependencies:\n      type: object\n      properties:\n        db:\n          type: boolean\n        oidc:\n          type: boolean\n    DisplayName:\n      $ref: '#/components/schemas/String255Nullable'\n    EffectiveAcl:\n      additionalProperties: false\n      type: object\n      properties:\n        access:\n          $ref: '#/components/schemas/AclRuleAccess'\n        asset:\n          $ref: '#/components/schemas/AssetBasic'\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        aclSources:\n          type: array\n          items:\n            $ref: '#/components/schemas/AclSource'\n    EmassAp:\n      additionalProperties: false\n      type: object\n      nullable: true\n      properties:\n        apAcronym:\n          $ref: '#/components/schemas/ApAcronym'\n        assessmentProcedure:\n          type: string\n        implementation:\n          type: string\n    Endpoints:\n      additionalProperties: false\n      type: object\n      properties:\n        ui:\n          type: string  \n    Error:\n      type: object\n      properties:\n        detail:\n          type: string\n        error:\n          type: string\n        stack:\n          type: string\n    FindingProjected:\n      additionalProperties: false\n      type: object\n      properties:\n        apAcronym:\n          $ref: '#/components/schemas/ApAcronym'\n        assetCount:\n          $ref: '#/components/schemas/AssetCount'\n        assets:\n          type: array\n          items:\n            $ref: '#/components/schemas/AssetBasic'\n        cci:\n          nullable: true\n          type: string\n        ccis:\n          type: array\n          minItems: 0\n          items:\n            $ref: '#/components/schemas/CciBasic'\n        definition:\n          $ref: '#/components/schemas/DefinitionString'\n        groupId:\n          $ref: '#/components/schemas/GroupId'\n        groups:\n          type: array\n          items:\n            $ref: '#/components/schemas/GroupProjected'\n        ruleId:\n          $ref: '#/components/schemas/RuleId'\n        rules:\n          type: array\n          items:\n            $ref: '#/components/schemas/RuleAbbr'\n        severity:\n          $ref: '#/components/schemas/RuleSeverity'\n        stigs:\n          type: array\n          items:\n            $ref: '#/components/schemas/CollectionStig'\n        title:\n          $ref: '#/components/schemas/RuleTitle'\n    Fix:\n      additionalProperties: false\n      type: object\n      properties:\n        fixref:\n          type: string\n        text:\n          type: string\n    Grant:\n      oneOf:\n        - $ref: '#/components/schemas/UserGrantProjected'     \n        - $ref: '#/components/schemas/UserGroupGrantProjected'\n    GrantPost:\n      oneOf:\n        - $ref: '#/components/schemas/UserGrant'     \n        - $ref: '#/components/schemas/UserGroupGrant'\n    GrantEffective:\n      type: object\n      properties:\n        roleId:\n          $ref: '#/components/schemas/RoleId'\n        grantees:\n          $ref: '#/components/schemas/Grantees'\n        user:\n          $ref: '#/components/schemas/UserBasicWithDisplayName'\n      required:\n        - roleId\n        - grantees\n        - user\n    Grantee:\n      oneOf:\n        - $ref: '#/components/schemas/UserBasic'\n        - $ref: '#/components/schemas/UserGroupBasic'\n    Grantees:\n      type: array\n      items:\n        $ref: '#/components/schemas/Grantee'\n    GrantId:\n      $ref: '#/components/schemas/StringIntId'\n    GroupId:\n      $ref: '#/components/schemas/String255Nullable'\n    GroupProjected:\n      additionalProperties: false\n      type: object\n      properties:\n        groupId:\n          $ref: '#/components/schemas/GroupId'\n        rules:\n          type: array\n          items:\n            $ref: '#/components/schemas/RuleAbbr'\n        severity:\n          $ref: '#/components/schemas/RuleSeverity'\n        title:\n          $ref: '#/components/schemas/GroupTitle'\n    GroupTitle:\n      $ref: '#/components/schemas/String255Nullable'\n    IndexDisa:\n      $ref: '#/components/schemas/String255'\n    IntegerMinimumZeroNullable:\n      type: integer\n      minimum: 0\n      nullable: true\n    Integer64MinimumZero:\n      type: integer\n      format: int64\n      minimum: 0\n    Integer64MinimumZeroNullable:\n      type: integer\n      format: int64\n      minimum: 0\n      nullable: true\n    Job:\n      additionalProperties: false\n      type: object\n      properties:\n        jobId:\n          $ref: '#/components/schemas/JobId'\n        name:\n          $ref: \"#/components/schemas/String45\"\n        description:\n          $ref: \"#/components/schemas/String255Nullable\"\n        createdBy:\n          $ref: '#/components/schemas/UserBasicNullable'\n        created:\n          $ref: '#/components/schemas/StringDateTime'\n        updatedBy:\n          $ref: '#/components/schemas/UserBasicNullable'\n        updated:\n          $ref: '#/components/schemas/StringDateTimeNullable'\n        tasks:\n          $ref: '#/components/schemas/JobTaskList'\n        event:\n          $ref: '#/components/schemas/JobEvent'\n        runCount:\n          type: integer\n        lastRun:\n          $ref: '#/components/schemas/JobRun'\n      required: [jobId, name, tasks, created, createdBy]\n    JobCreate:\n      additionalProperties: false\n      type: object\n      properties:\n        name:\n          $ref: \"#/components/schemas/String45\"\n        description:\n          $ref: \"#/components/schemas/String255Nullable\"\n        tasks:\n          $ref: '#/components/schemas/JobTaskListCreate'\n        event:\n          $ref: '#/components/schemas/JobEventCreate'\n      required: [name, tasks]\n    JobEvent:\n      oneOf:\n        - type: integer\n          nullable: true\n        - $ref: '#/components/schemas/JobEventRecurring'\n        - $ref: '#/components/schemas/JobEventOnce'\n    JobEventCreate:\n      oneOf:\n        - $ref: '#/components/schemas/JobEventRecurringCreate'\n        - $ref: '#/components/schemas/JobEventOnceCreate'\n        - type: integer\n          nullable: true\n    JobEventOnce:\n      additionalProperties: false\n      type: object\n      properties:\n        eventId:\n          $ref: \"#/components/schemas/String45\"\n        type:\n          type: string\n          enum:\n            - once\n        starts:\n          $ref: '#/components/schemas/StringDateTime'\n        enabled:\n          type: boolean\n          default: true\n      required: [eventId, starts, type]\n    JobEventOnceCreate:\n      additionalProperties: false\n      type: object\n      properties:\n        type:\n          type: string\n          enum:\n            - once\n        starts:\n          $ref: '#/components/schemas/StringDateTime'\n      required: [starts, type]\n    JobEventRecurring:\n      additionalProperties: false\n      type: object\n      properties:\n        eventId:\n          $ref: \"#/components/schemas/String45\"\n        type:\n          type: string\n          enum:\n            - recurring\n        interval:\n          $ref: '#/components/schemas/JobInterval'\n        starts:\n          $ref: '#/components/schemas/StringDateTimeNullable'\n        ends:\n          $ref: '#/components/schemas/StringDateTimeNullable'\n        enabled:\n          type: boolean\n          default: true\n      required: [eventId, type, interval]\n    JobEventRecurringCreate:\n      additionalProperties: false\n      type: object\n      properties:\n        type:\n          type: string\n          enum:\n            - recurring\n        interval:\n          $ref: '#/components/schemas/JobInterval'\n        starts:\n          $ref: '#/components/schemas/StringDateTimeNullable'\n        ends:\n          $ref: '#/components/schemas/StringDateTimeNullable'\n        enabled:\n          type: boolean\n          default: true\n      required: [type, interval]\n    JobInterval:\n      additionalProperties: false\n      type: object\n      properties:\n        value:\n          type: string\n        field:\n          type: string\n          enum:\n            - minute\n            - hour\n            - day\n            - week\n            - month\n      required: [value, field]\n    JobId:\n      $ref: '#/components/schemas/StringIntId'\n    JobRun:\n      additionalProperties: false\n      nullable: true\n      type: object\n      properties:\n        runId:\n          $ref: '#/components/schemas/JobRunId'\n        created:\n          $ref: '#/components/schemas/StringDateTime'\n        updated:\n          $ref: '#/components/schemas/StringDateTimeNullable'\n        state:\n          $ref: '#/components/schemas/JobRunState'\n        jobId:\n          $ref: '#/components/schemas/JobId'\n      required: [runId, created, state]\n    JobRunCreated:\n      additionalProperties: false\n      type: object\n      properties:\n        runId:\n          $ref: '#/components/schemas/JobRunId'\n      required: [runId]\n    JobRunId:\n      $ref: '#/components/schemas/StringUuid'\n    JobRunOutput:\n      additionalProperties: false\n      type: object\n      properties:\n        type:\n          type: string\n        message:\n          type: string\n        task:\n          $ref: \"#/components/schemas/String45\"\n        taskId:\n          $ref: \"#/components/schemas/JobTaskId\"\n        ts:\n          $ref: '#/components/schemas/StringDateTime'\n      required: [message, type, task, ts]\n    JobRunState:\n      type: string\n      nullable: true\n      enum:\n        - running\n        - completed\n        - failed\n    JobTask:\n      type: object\n      additionalProperties: false\n      properties:\n        taskId:\n          $ref: '#/components/schemas/StringIntId'\n        name:\n          $ref: \"#/components/schemas/String45\"\n        description:\n          $ref: \"#/components/schemas/String255Nullable\"\n        command:\n          $ref: '#/components/schemas/String255'\n      required: [taskId, name]\n    JobTaskId:\n      $ref: '#/components/schemas/StringIntId'\n    JobTaskList:\n      type: array\n      minItems: 1\n      items:\n        $ref: '#/components/schemas/JobTask'\n    JobTaskListCreate:\n      type: array\n      minItems: 1\n      items:\n        $ref: '#/components/schemas/JobTaskId'\n    JobUpdate:\n      type: object\n      additionalProperties: false\n      minProperties: 1\n      properties:\n        name:\n          $ref: \"#/components/schemas/String45\"\n        description:\n          $ref: \"#/components/schemas/String255Nullable\"\n        tasks:\n          $ref: '#/components/schemas/JobTaskListCreate'\n        event:\n          $ref: '#/components/schemas/JobEventCreate'\n\n    Label:\n      additionalProperties: false\n      type: object\n      properties:\n        color:\n          $ref: '#/components/schemas/StringHexColor'\n        description:\n          $ref: '#/components/schemas/String255Nullable'\n        labelId:\n          $ref: '#/components/schemas/LabelId'\n        name:\n          $ref: '#/components/schemas/LabelName'\n        uses:\n          type: integer\n      required:\n        - name\n        - description\n        - color\n        - labelId\n        - uses\n    LabelBasic:\n      additionalProperties: false\n      type: object\n      properties:\n        labelId:\n          $ref: '#/components/schemas/LabelId'\n        name:\n          $ref: '#/components/schemas/LabelName'\n      required:\n        - name\n        - labelId\n    LabelBasicWithColor:\n      additionalProperties: false\n      type: object\n      properties:\n        color:\n          $ref: '#/components/schemas/StringHexColor'\n        labelId:\n          $ref: '#/components/schemas/LabelId'\n        name:\n          $ref: '#/components/schemas/LabelName'\n      required:\n        - name\n        - color\n        - labelId\n    LabelCreate:\n      additionalProperties: false\n      type: object\n      properties:\n        color:\n          $ref: '#/components/schemas/StringHexColor'\n        description:\n          $ref: '#/components/schemas/String255Nullable'\n        name:\n          $ref: '#/components/schemas/LabelName'\n      required:\n        - name\n        - description\n        - color\n    LabelId:\n      $ref: '#/components/schemas/StringUuid'\n    LabelIdNullable:\n      $ref: '#/components/schemas/StringUuidNullable'\n    LabelName:\n      maxLength: 16\n      minLength: 1\n      type: string\n    LabelUpdate:\n      additionalProperties: false\n      type: object\n      properties:\n        color:\n          $ref: '#/components/schemas/StringHexColor'\n        description:\n          $ref: '#/components/schemas/String255Nullable'\n        name:\n          $ref: '#/components/schemas/LabelName'\n    LastMigration:\n      type: integer\n      minimum: 0\n    LocationString:\n      type: string\n    MaxTs:\n      format: date-time\n      nullable: true\n      type: string\n    Metadata:\n      type: object\n      additionalProperties:\n        type: string\n    MetadataKey:\n      type: string\n    MetadataValue:\n      type: string\n    MetricsAggAsset:\n      type: object\n      properties:\n        assetId:\n          $ref: '#/components/schemas/AssetId'\n        benchmarkIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/BenchmarkId'\n        fqdn:\n          $ref: '#/components/schemas/AssetFqdn'\n        ip:\n          $ref: '#/components/schemas/AssetIp'\n        labels:\n          type: array\n          items:\n            $ref: '#/components/schemas/LabelBasicWithColor'\n        mac:\n          $ref: '#/components/schemas/AssetMac'\n        name:\n          $ref: '#/components/schemas/AssetName'\n        noncomputing:\n          $ref: '#/components/schemas/AssetNoncomputing'\n      required:\n        - assetId\n        - name\n        - labels\n        - benchmarkIds\n    MetricsAggCollection:\n      type: object\n      properties:\n        assets:\n          type: integer\n        checklists:\n          type: integer\n        collectionId:\n          $ref: '#/components/schemas/CollectionId'\n        name:\n          $ref: '#/components/schemas/CollectionName'\n        stigs:\n          type: integer\n      required:\n        - collectionId\n        - name\n        - checklists\n        - assets\n        - stigs\n    MetricsAggLabel:\n      type: object\n      properties:\n        assets:\n          type: integer\n        labelId:\n          $ref: '#/components/schemas/LabelIdNullable'\n        name:\n          nullable: true\n          type: string\n      required:\n        - labelId\n        - name\n        - assets\n    MetricsAggMeta:\n      type: object\n      properties:\n        assets:\n          type: integer\n        checklists:\n          type: integer\n        collections:\n          type: integer\n        stigs:\n          type: integer\n      required:\n        - collections\n        - assets\n        - stigs\n        - checklists\n    MetricsAggStig:\n      type: object\n      properties:\n        assets:\n          type: integer\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        collections:\n          type: integer\n        marking:\n          $ref: '#/components/schemas/RevisionMarkingNullable'\n        revisionPinned:\n          type: boolean\n        revisionStr:\n          $ref: '#/components/schemas/RevisionStrRaw'\n        revisionDate:\n          $ref: \"#/components/schemas/StringDateNullable\"\n        ruleCount:\n          $ref: '#/components/schemas/RuleCount'\n        title:\n          $ref: '#/components/schemas/StigTitle'\n      required:\n        - benchmarkId\n        - marking\n        - title\n        - assets\n        - revisionStr\n        - revisionDate\n        - ruleCount\n    MetricsDetail:\n      properties:\n        metrics:\n          additionalProperties: false\n          type: object\n          properties:\n            assessed:\n              type: integer\n            assessedBySeverity:\n              additionalProperties: false\n              type: object\n              properties:\n                high:\n                  type: integer\n                low:\n                  type: integer\n                medium:\n                  type: integer\n              required:\n                - low\n                - medium\n                - high\n            assessments:\n              type: integer\n            assessmentsBySeverity:\n              additionalProperties: false\n              type: object\n              properties:\n                high:\n                  type: integer\n                low:\n                  type: integer\n                medium:\n                  type: integer\n              required:\n                - low\n                - medium\n                - high\n            findings:\n              additionalProperties: false\n              type: object\n              properties:\n                high:\n                  type: integer\n                low:\n                  type: integer\n                medium:\n                  type: integer\n              required:\n                - low\n                - medium\n                - high\n            maxTouchTs:\n              $ref: '#/components/schemas/StringDateTimeNullable'\n            maxTs:\n              $ref: '#/components/schemas/MaxTs'\n            minTs:\n              $ref: '#/components/schemas/MinTs'\n            results:\n              additionalProperties: false\n              type: object\n              properties:\n                error:\n                  $ref: '#/components/schemas/CollectionStatusCount'\n                fail:\n                  $ref: '#/components/schemas/CollectionStatusCount'\n                fixed:\n                  $ref: '#/components/schemas/CollectionStatusCount'\n                informational:\n                  $ref: '#/components/schemas/CollectionStatusCount'\n                notapplicable:\n                  $ref: '#/components/schemas/CollectionStatusCount'\n                notchecked:\n                  $ref: '#/components/schemas/CollectionStatusCount'\n                notselected:\n                  $ref: '#/components/schemas/CollectionStatusCount'\n                pass:\n                  $ref: '#/components/schemas/CollectionStatusCount'\n                unknown:\n                  $ref: '#/components/schemas/CollectionStatusCount'\n              required:\n                - notchecked\n                - notapplicable\n                - pass\n                - fail\n                - unknown\n                - error\n                - notselected\n                - informational\n                - fixed\n            statuses:\n              type: object\n              properties:\n                accepted:\n                  $ref: '#/components/schemas/CollectionStatusCount'\n                rejected:\n                  $ref: '#/components/schemas/CollectionStatusCount'\n                saved:\n                  $ref: '#/components/schemas/CollectionStatusCount'\n                submitted:\n                  $ref: '#/components/schemas/CollectionStatusCount'\n          required:\n            - assessed\n            - assessedBySeverity\n            - assessments\n            - assessmentsBySeverity\n            - findings\n            - minTs\n            - maxTs\n            - maxTouchTs\n            - results\n            - statuses\n      required:\n        - metrics\n    MetricsDetailAggAsset:\n      allOf:\n        - $ref: '#/components/schemas/MetricsAggAsset'\n        - $ref: '#/components/schemas/MetricsDetail'\n    MetricsDetailAggCollection:\n      allOf:\n        - $ref: '#/components/schemas/MetricsAggCollection'\n        - $ref: '#/components/schemas/MetricsDetail'\n    MetricsDetailAggLabel:\n      allOf:\n        - $ref: '#/components/schemas/MetricsAggLabel'\n        - $ref: '#/components/schemas/MetricsDetail'\n    MetricsDetailAggMeta:\n      allOf:\n        - $ref: '#/components/schemas/MetricsAggMeta'\n        - $ref: '#/components/schemas/MetricsDetail'\n    MetricsDetailAggStig:\n      allOf:\n        - $ref: '#/components/schemas/MetricsAggStig'\n        - $ref: '#/components/schemas/MetricsDetail'\n    MetricsDetailUnagg:\n      allOf:\n        - $ref: '#/components/schemas/MetricsUnagg'\n        - $ref: '#/components/schemas/MetricsDetail'\n    MetricsSummary:\n      properties:\n        metrics:\n          additionalProperties: false\n          type: object\n          properties:\n            assessed:\n              type: integer\n            assessedBySeverity:\n              additionalProperties: false\n              type: object\n              properties:\n                high:\n                  type: integer\n                low:\n                  type: integer\n                medium:\n                  type: integer\n              required:\n                - low\n                - medium\n                - high                   \n            assessments:\n              type: integer\n            assessmentsBySeverity:\n              additionalProperties: false\n              type: object\n              properties:\n                high:\n                  type: integer\n                low:\n                  type: integer\n                medium:\n                  type: integer\n              required:\n                - low\n                - medium\n                - high              \n            findings:\n              additionalProperties: false\n              type: object\n              properties:\n                high:\n                  type: integer\n                low:\n                  type: integer\n                medium:\n                  type: integer\n              required:\n                - low\n                - medium\n                - high\n            maxTouchTs:\n              $ref: '#/components/schemas/StringDateTimeNullable'\n            maxTs:\n              $ref: '#/components/schemas/MaxTs'\n            minTs:\n              $ref: '#/components/schemas/MinTs'\n            results:\n              additionalProperties: false\n              type: object\n              properties:\n                fail:\n                  type: integer\n                notapplicable:\n                  type: integer\n                other:\n                  type: integer\n                pass:\n                  type: integer\n              required:\n                - fail\n                - notapplicable\n                - other\n                - pass\n            statuses:\n              additionalProperties: false\n              type: object\n              properties:\n                accepted:\n                  type: integer\n                rejected:\n                  type: integer\n                saved:\n                  type: integer\n                submitted:\n                  type: integer\n              required:\n                - saved\n                - submitted\n                - accepted\n                - rejected           \n          required:\n            - assessed\n            - assessedBySeverity\n            - assessments\n            - assessmentsBySeverity\n            - findings\n            - minTs\n            - maxTs\n            - maxTouchTs\n            - results\n            - statuses\n      required:\n        - metrics\n    MetricsSummaryAggAsset:\n      allOf:\n        - $ref: '#/components/schemas/MetricsAggAsset'\n        - $ref: '#/components/schemas/MetricsSummary'\n    MetricsSummaryAggCollection:\n      allOf:\n        - $ref: '#/components/schemas/MetricsAggCollection'\n        - $ref: '#/components/schemas/MetricsSummary'\n    MetricsSummaryAggLabel:\n      allOf:\n        - $ref: '#/components/schemas/MetricsAggLabel'\n        - $ref: '#/components/schemas/MetricsSummary'\n    MetricsSummaryAggMeta:\n      allOf:\n        - $ref: '#/components/schemas/MetricsAggMeta'\n        - $ref: '#/components/schemas/MetricsSummary'\n    MetricsSummaryAggStig:\n      allOf:\n        - $ref: '#/components/schemas/MetricsAggStig'\n        - $ref: '#/components/schemas/MetricsSummary'\n    MetricsSummaryUnagg:\n      allOf:\n        - $ref: '#/components/schemas/MetricsUnagg'\n        - $ref: '#/components/schemas/MetricsSummary'\n    MetricsUnagg:\n      type: object\n      properties:\n        assetId:\n          type: string\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        labels:\n          items:\n            $ref: '#/components/schemas/LabelBasicWithColor'\n          type: array\n        name:\n          type: string\n        revisionPinned:\n          type: boolean\n        revisionStr:\n          $ref: '#/components/schemas/RevisionStrRaw'\n        revisionDate:\n          $ref: \"#/components/schemas/StringDateNullable\"          \n        title:\n          $ref: '#/components/schemas/StigTitle'\n      required:\n        - assetId\n        - name\n        - labels\n        - benchmarkId\n        - title\n        - revisionStr\n        - revisionDate\n        - revisionPinned\n    MinTs:\n      format: date-time\n      nullable: true\n      type: string\n    Owner:\n      oneOf:\n        - $ref: '#/components/schemas/UserBasicWithDisplayName'     \n        - $ref: '#/components/schemas/UserGroup'\n    ParentControl:\n      $ref: '#/components/schemas/String255'\n    ResultEngine:\n      additionalProperties: false\n      type: object\n      nullable: true\n      properties:\n        checkContent:\n          $ref: '#/components/schemas/ResultEngineCheckContent'\n        overrides:\n          type: array\n          items:\n            $ref: '#/components/schemas/ResultEngineOverride'\n          minItems: 1\n        product:\n          $ref: '#/components/schemas/String255'\n        time:\n          $ref: '#/components/schemas/StringDateTime'\n        type:\n          $ref: '#/components/schemas/ResultEngineType'\n        version:\n          $ref: '#/components/schemas/VersionString'\n      required:\n        - product\n        - type\n    ResultEngineCheckContent:\n      additionalProperties: false\n      nullable: true\n      type: object       \n      properties:\n        component:\n          $ref: '#/components/schemas/String255'\n        location:\n          $ref: '#/components/schemas/LocationString'\n      required:\n        - location\n    ResultEngineOverride:\n      additionalProperties: false\n      type: object\n      properties:\n        authority:\n          $ref: '#/components/schemas/String255'\n        newResult:\n          $ref: '#/components/schemas/ReviewResult'\n        oldResult:\n          $ref: '#/components/schemas/ReviewResult'\n        remark:\n          $ref: '#/components/schemas/String255'\n        time:\n          $ref: '#/components/schemas/StringDateTime'\n      required:\n        - authority\n        - oldResult\n        - newResult\n    ResultEngineType:\n      type: string\n      enum:\n        - scap\n        - script\n        - other\n    ReviewAsset:\n      type: object\n      properties:\n        autoResult:\n          type: boolean\n        comment:\n          $ref: '#/components/schemas/CommentaryString'\n        detail:\n          $ref: '#/components/schemas/CommentaryString'\n        history:\n          type: array\n          items:\n            $ref: '#/components/schemas/ReviewHistory'\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        result:\n          $ref: '#/components/schemas/ReviewResult'\n        resultEngine:\n          $ref: '#/components/schemas/ResultEngine'\n        rule:\n          $ref: '#/components/schemas/RuleAbbr'\n        ruleId:\n          $ref: '#/components/schemas/RuleId'\n        ruleIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/RuleId'\n        status:\n          $ref: '#/components/schemas/ReviewStatusRead'\n        stigs:\n          type: array\n          items:\n            $ref: '#/components/schemas/CollectionStigWithIsDefault'\n        touchTs:\n          $ref: '#/components/schemas/StringDateTime'\n        ts:\n          $ref: '#/components/schemas/StringDateTime'\n        userId:\n          $ref: '#/components/schemas/UserId'\n        username:\n          $ref: '#/components/schemas/Username'\n      required:\n        - ruleId\n        - ruleIds\n        - result\n        - detail\n        - comment\n        - status\n        - userId\n        - username\n        - ts\n        - touchTs\n    ReviewAssetPost:\n      type: object\n      required:\n        - ruleId\n        - result\n        - detail\n        - comment\n      additionalProperties: false\n      properties:\n        ruleId:\n          $ref: '#/components/schemas/RuleId'\n        result:\n          $ref: '#/components/schemas/ReviewResult'\n        resultEngine:\n          $ref: '#/components/schemas/ResultEngine'\n        detail:\n          $ref: '#/components/schemas/CommentaryStringNullable'\n        comment:\n          $ref: '#/components/schemas/CommentaryStringNullable'\n        autoResult:\n          type: boolean\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        status:\n          $ref: '#/components/schemas/ReviewStatusWrite'\n    ReviewAssetRulePatch:\n      additionalProperties: false\n      type: object\n      minProperties: 1\n      properties:\n        comment:\n          $ref: '#/components/schemas/CommentaryString'\n        detail:\n          $ref: '#/components/schemas/CommentaryString'\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        result:\n          $ref: '#/components/schemas/ReviewResult'\n        resultEngine:\n          $ref: '#/components/schemas/ResultEngine'\n        status:\n          $ref: '#/components/schemas/ReviewStatusWrite'\n    ReviewAssetRulePut:\n      additionalProperties: false\n      type: object\n      properties:\n        autoResult:\n          type: boolean\n        comment:\n          $ref: '#/components/schemas/CommentaryStringNullable'\n        detail:\n          $ref: '#/components/schemas/CommentaryStringNullable'\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        result:\n          $ref: '#/components/schemas/ReviewResult'\n        resultEngine:\n          $ref: '#/components/schemas/ResultEngine'\n        status:\n          $ref: '#/components/schemas/ReviewStatusWrite'\n      required:\n        - result\n        - detail\n        - comment\n    ReviewAssetRuleRead:\n      type: object\n      properties:\n        access:\n          $ref: '#/components/schemas/AclRuleAccess'\n        autoResult:\n          type: boolean\n        comment:\n          $ref: '#/components/schemas/CommentaryString'\n        detail:\n          $ref: '#/components/schemas/CommentaryString'\n        history:\n          type: array\n          items:\n            $ref: '#/components/schemas/ReviewHistory'\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        result:\n          $ref: '#/components/schemas/ReviewResult'\n        resultEngine:\n          $ref: '#/components/schemas/ResultEngine'\n        rule:\n          $ref: '#/components/schemas/RuleAbbr'\n        ruleIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/RuleId'\n        status:\n          $ref: '#/components/schemas/ReviewStatusRead'\n        stigs:\n          type: array\n          items:\n            $ref: '#/components/schemas/CollectionStigWithIsDefault'\n        touchTs:\n          $ref: '#/components/schemas/StringDateTime'\n        ts:\n          $ref: '#/components/schemas/StringDateTime'\n        userId:\n          $ref: '#/components/schemas/UserId'\n        username:\n          $ref: '#/components/schemas/Username'\n      required:\n        - access\n        - result\n        - detail\n        - comment\n        - userId\n        - username\n        - ts\n        - status\n        - touchTs\n    ReviewBatch:\n      additionalProperties: false\n      type: object\n      properties:\n        action:\n          $ref: '#/components/schemas/ReviewBatchAction'\n        assets:\n          $ref: '#/components/schemas/ReviewBatchAssetsCriteria'\n        dryRun:\n          default: false\n          type: boolean\n        rules:\n          $ref: '#/components/schemas/ReviewBatchRulesCriteria'\n        source:\n          $ref: '#/components/schemas/ReviewBatchSource'\n        updateFilters:\n          type: array \n          items:\n            $ref: '#/components/schemas/ReviewBatchFilter'\n      required:\n        - source\n        - assets\n        - rules\n    ReviewBatchAction:\n      type: string  \n      enum:\n        - insert\n        - update\n        - merge\n    ReviewBatchAssetsCriteria:\n      oneOf:\n        - $ref: '#/components/schemas/ReviewBatchCriteria_AssetIds'\n        - $ref: '#/components/schemas/ReviewBatchCriteria_BenchmarkIds'\n    ReviewBatchCriteria_AssetIds:\n      additionalProperties: false\n      type: object\n      properties:\n        assetIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/AssetId'\n          maxItems: 2500\n          minItems: 1\n          uniqueItems: true\n      required:\n        - assetIds\n    ReviewBatchCriteria_BenchmarkIds:\n      additionalProperties: false\n      type: object\n      properties:\n        benchmarkIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/BenchmarkId'\n          maxItems: 50\n          minItems: 1\n          uniqueItems: true\n      required:\n        - benchmarkIds\n    ReviewBatchCriteria_RuleIds:\n      additionalProperties: false\n      type: object\n      properties:\n        ruleIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/RuleId'\n          maxItems: 500\n          minItems: 1\n          uniqueItems: true\n      required:\n        - ruleIds\n    ReviewBatchFilter:\n      oneOf:\n        - $ref: '#/components/schemas/ReviewBatchFilter_String'\n        - $ref: '#/components/schemas/ReviewBatchFilter_Result'\n        - $ref: '#/components/schemas/ReviewBatchFilter_Status'\n        - $ref: '#/components/schemas/ReviewBatchFilter_Date'\n        - $ref: '#/components/schemas/ReviewBatchFilter_User'\n    ReviewBatchFilter_Date:\n      additionalProperties: false\n      type: object\n      properties:\n        condition:\n          default: equals\n          type: string\n          enum:\n            - equals\n            - lessThan\n            - greaterThan\n        field:\n          type: string\n          enum:\n            - ts\n            - statusTs\n            - touchTs\n        value:\n          $ref: '#/components/schemas/StringDateTime'\n      required:\n        - field\n        - value\n    ReviewBatchFilter_Result:\n      additionalProperties: false\n      type: object\n      properties:\n        condition:\n          default: equals\n          type: string\n          enum:\n            - equals\n            - notequal\n        field:\n          type: string\n          enum:\n            - result\n        value:\n          $ref: '#/components/schemas/ReviewResult'\n      required:\n        - field\n        - value\n    ReviewBatchFilter_Status:\n      additionalProperties: false\n      type: object\n      properties:\n        condition:\n          default: equals\n          type: string\n          enum:\n            - equals\n            - notequal\n        field:\n          type: string\n          enum:\n            - statusLabel\n            - status\n        value:\n          $ref: '#/components/schemas/ReviewStatusLabel'\n      required:\n        - field\n        - value\n    ReviewBatchFilter_String:\n      additionalProperties: false\n      type: object\n      properties:\n        condition:\n          default: equals\n          type: string\n          enum:\n            - equals\n            - contains\n            - beginsWith\n            - endsWith\n        field:\n          type: string\n          enum:\n            - detail\n            - comment\n            - statusText\n        value:\n          type: string\n      required:\n        - field\n        - value\n    ReviewBatchFilter_User:\n      additionalProperties: false\n      type: object\n      properties:\n        condition:\n          default: equals\n          type: string\n          enum:\n            - equals\n            - notequal\n        field:\n          type: string\n          enum:\n            - userId\n            - statusUserId\n        value:\n          $ref: '#/components/schemas/StringIntId'\n      required:\n        - field\n        - value\n    ReviewBatchResponse:\n      additionalProperties: false\n      type: object\n      properties:\n        failedValidation:\n          type: integer\n        inserted:\n          type: integer\n        updated:\n          type: integer\n        validationErrors:\n          type: array\n          items:\n            type: object\n            properties:\n              assetId:\n                $ref: '#/components/schemas/AssetId'\n              error:\n                $ref: '#/components/schemas/String255'\n              ruleId:\n                $ref: '#/components/schemas/RuleId'\n      required:\n        - inserted\n        - updated\n        - failedValidation\n        - validationErrors\n    ReviewBatchResponseDryRun:\n      additionalProperties: false\n      type: object\n      properties:\n        validationErrors:\n          type: array\n          items:\n            type: object\n            properties:\n              assetId:\n                $ref: '#/components/schemas/AssetId'\n              error:\n                $ref: '#/components/schemas/String255'\n              ruleId:\n                $ref: '#/components/schemas/RuleId'\n        willFailValidation:\n          type: integer\n        willInsert:\n          type: integer\n        willUpdate:\n          type: integer\n      required:\n        - willInsert\n        - willUpdate\n        - willFailValidation\n        - validationErrors\n    ReviewBatchRulesCriteria:\n      oneOf:\n        - $ref: '#/components/schemas/ReviewBatchCriteria_RuleIds'\n        - $ref: '#/components/schemas/ReviewBatchCriteria_BenchmarkIds'\n    ReviewBatchSource:\n      additionalProperties: false\n      type: object\n      properties:\n        review:\n          $ref: '#/components/schemas/ReviewAssetRulePatch'\n      required:\n        - review\n    ReviewHistory:\n      additionalProperties: false\n      type: object\n      properties:\n        autoResult:\n          type: boolean\n        comment:\n          $ref: '#/components/schemas/CommentaryString'\n        detail:\n          $ref: '#/components/schemas/CommentaryString'\n        result:\n          $ref: '#/components/schemas/ReviewResult'\n        resultEngine:\n          $ref: '#/components/schemas/ResultEngine'\n        ruleId:\n          $ref: '#/components/schemas/RuleId'\n        status:\n          $ref: '#/components/schemas/ReviewStatusRead'\n        touchTs:\n          $ref: '#/components/schemas/StringDateTime'\n        ts:\n          $ref: '#/components/schemas/StringDateTime'\n        userId:\n          $ref: '#/components/schemas/UserId'\n        username:\n          $ref: '#/components/schemas/Username'\n      required:\n        - result\n        - detail\n        - comment\n        - status\n        - userId\n        - username\n        - ts\n        - touchTs\n        - ruleId\n    ReviewHistoryAsset:\n      additionalProperties: false\n      type: object\n      properties:\n        assetId:\n          $ref: '#/components/schemas/String255'\n        reviewHistories:\n          type: array\n          items:\n            $ref: '#/components/schemas/ReviewHistoryRule'\n      required:\n        - assetId\n        - reviewHistories\n    ReviewHistoryDeleted:\n      additionalProperties: false\n      type: object\n      properties:\n        HistoryEntriesDeleted:\n          type: integer\n      required:\n        - HistoryEntriesDeleted\n    ReviewHistoryRule:\n      additionalProperties: false\n      type: object\n      properties:\n        history:\n          type: array\n          items:\n            $ref: '#/components/schemas/ReviewHistory'\n        ruleId:\n          $ref: '#/components/schemas/RuleId'\n      required:\n        - ruleId\n        - history\n    ReviewHistoryStats:\n      additionalProperties: false\n      type: object\n      properties:\n        assetHistoryEntryCounts:\n          type: array\n          items:\n            $ref: '#/components/schemas/ReviewHistoryStatsAsset'\n        collectionHistoryEntryCount:\n          type: integer\n        oldestHistoryEntryDate:\n          $ref: '#/components/schemas/StringDateTime'\n      required:\n        - collectionHistoryEntryCount\n        - oldestHistoryEntryDate\n    ReviewHistoryStatsAsset:\n      additionalProperties: false\n      type: object\n      properties:\n        assetId:\n          $ref: '#/components/schemas/String255'\n        historyEntryCount:\n          type: integer\n        oldestHistoryEntry:\n          nullable: true\n          type: string\n      required:\n        - assetId\n        - historyEntryCount\n        - oldestHistoryEntry\n    ReviewPostResponse:\n      additionalProperties: false\n      type: object\n      properties:\n        affected:\n          type: object\n          properties:\n            inserted:\n              type: number\n            updated:\n              type: number\n        rejected:\n          type: array\n          items:\n            type: object \n            properties:\n              reason:\n                $ref: '#/components/schemas/String255'\n              ruleId:\n                $ref: '#/components/schemas/RuleId'\n      required:\n        - rejected\n        - affected\n    ReviewRead:\n      additionalProperties: false\n      type: object\n      properties:\n        access:\n          $ref: '#/components/schemas/AclRuleAccess'\n        assetId:\n          $ref: '#/components/schemas/StringIntId'\n        assetLabelIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/LabelId'\n        assetLabels:\n          type: array\n          items:\n            $ref: '#/components/schemas/LabelBasicWithColor'\n        assetName:\n          $ref: '#/components/schemas/String255'\n        autoResult:\n          type: boolean\n        comment:\n          $ref: '#/components/schemas/CommentaryStringNullable'\n        detail:\n          $ref: '#/components/schemas/CommentaryStringNullable'\n        metadata:\n          $ref: '#/components/schemas/Metadata'\n        result:\n          $ref: '#/components/schemas/ReviewResult'\n        resultEngine:\n          $ref: '#/components/schemas/ResultEngine'\n        rule:\n          $ref: '#/components/schemas/RuleAbbr'\n        ruleId:\n          $ref: '#/components/schemas/RuleId'\n        ruleIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/RuleId'\n        status:\n          $ref: '#/components/schemas/ReviewStatusRead'\n        stigs:\n          type: array\n          items:\n            $ref: '#/components/schemas/CollectionStigWithIsDefault'\n        touchTs:\n          $ref: '#/components/schemas/StringDateTime'\n        ts:\n          $ref: '#/components/schemas/StringDateTime'\n        userId:\n          $ref: '#/components/schemas/UserId'\n        username:\n          $ref: '#/components/schemas/Username'\n      required:\n        - assetId\n        - assetName\n        - ruleId\n        - ruleIds\n        - result\n        - detail\n        - comment\n        - userId\n        - username\n        - ts\n        - touchTs\n        - status\n    ReviewResult:\n      enum:\n        - fail\n        - pass\n        - notapplicable\n        - notchecked\n        - unknown\n        - error\n        - notselected\n        - informational\n        - fixed\n      type: string\n    ReviewStatusLabel:\n      enum:\n        - saved\n        - submitted\n        - accepted\n        - rejected\n      type: string\n    ReviewStatusRead:\n      additionalProperties: false\n      type: object\n      properties:\n        label:\n          $ref: '#/components/schemas/ReviewStatusLabel'\n        text:\n          $ref: '#/components/schemas/StatusText'\n        ts:\n          $ref: '#/components/schemas/StringDateTime'\n        user:\n          $ref: '#/components/schemas/UserBasic'\n      required:\n        - label\n        - text\n        - user\n        - ts\n    ReviewStatusOption:\n      enum:\n        - \"null\"\n        - saved\n        - submitted\n        - accepted\n      type: string\n    ReviewStatusWrite:\n      oneOf:\n        - $ref: '#/components/schemas/ReviewStatusLabel'\n        - type: object\n          required:\n            - label\n            - text\n          additionalProperties: false\n          properties:\n            label:\n              $ref: '#/components/schemas/ReviewStatusLabel'\n            text:\n              $ref: '#/components/schemas/StatusText'\n    Revision:\n      additionalProperties: false\n      type: object\n      properties:\n        benchmarkDate:\n          $ref: '#/components/schemas/StringDateNullable'\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        collectionIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/CollectionId'\n        marking:\n          $ref: '#/components/schemas/RevisionMarkingNullable'\n        release:\n          $ref: '#/components/schemas/RevisionRelease'\n        revisionStr:\n          $ref: '#/components/schemas/RevisionStr'\n        ruleCount:\n          $ref: '#/components/schemas/RuleCount'\n        status:\n          $ref: '#/components/schemas/RevisionStatus'\n        statusDate:\n          $ref: '#/components/schemas/StringDateNullable'\n        version:\n          $ref: '#/components/schemas/VersionString'\n      required:\n        - benchmarkId\n        - revisionStr\n        - version\n        - release\n        - benchmarkDate\n        - status\n        - statusDate\n        - ruleCount\n        - collectionIds\n    RevisionBasic:\n      additionalProperties: false\n      type: object\n      properties:\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        revisionStr:\n          $ref: '#/components/schemas/RevisionStr'\n      required:\n        - benchmarkId\n        - revisionStr\n    RevisionDate:\n      $ref: '#/components/schemas/StringDate'\n    RevisionMarkingNullable:\n      type: string\n      nullable: true\n      pattern: ^CUI|U|FOUO$\n    RevisionPost:\n      additionalProperties: false\n      type: object\n      properties:\n        action:\n          type: string\n          enum:\n            - inserted\n            - preserved\n            - replaced\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        revisionStr:\n          $ref: '#/components/schemas/RevisionStr'\n        marking:\n          $ref: '#/components/schemas/RevisionMarkingNullable'\n      required:\n        - benchmarkId\n        - revisionStr\n        - action\n    RevisionRelease:\n      $ref: '#/components/schemas/String45'\n    RevisionStatus:\n      $ref: '#/components/schemas/String45Nullable'\n    RevisionStr:\n      pattern: ^(V\\d{1,3}R\\d{1,3}(\\.\\d{1,3})?|latest)$\n      type: string\n    RevisionStrRaw:\n      pattern: ^(V\\d{1,3}R\\d{1,3}(\\.\\d{1,3})?)$\n      type: string\n    Roles:\n      type: string\n      enum: [\"restricted\", \"full\", \"manage\", \"owner\"]\n    RuleAbbr:\n      additionalProperties: false\n      type: object\n      properties:\n        ruleId:\n          $ref: '#/components/schemas/RuleId'\n        severity:\n          type: string\n        title:\n          $ref: '#/components/schemas/RuleTitle'\n        version:\n          $ref: '#/components/schemas/VersionString'\n      required:\n        - ruleId\n        - version\n        - title\n        - severity\n    RuleCount:\n      nullable: true\n      type: integer\n    RuleId:\n      $ref: '#/components/schemas/String45Nullable'\n    RuleProjected:\n      additionalProperties: false\n      type: object\n      properties:\n        ccis:\n          items:\n            $ref: '#/components/schemas/CciBasic'\n          type: array\n        check:\n          $ref: '#/components/schemas/Check'\n        detail:\n          additionalProperties: false\n          type: object\n          properties:\n            documentable:\n              nullable: true\n              type: string\n            falseNegatives:\n              nullable: true\n              type: string\n            falsePositives:\n              nullable: true\n              type: string\n            mitigationControl:\n              nullable: true\n              type: string\n            mitigations:\n              nullable: true\n              type: string\n            potentialImpacts:\n              nullable: true\n              type: string\n            responsibility:\n              nullable: true\n              type: string\n            severityOverrideGuidance:\n              nullable: true\n              type: string\n            thirdPartyTools:\n              nullable: true\n              type: string\n            vulnDiscussion:\n              nullable: true\n              type: string\n            weight:\n              nullable: true\n              type: string\n        fix:\n          $ref: '#/components/schemas/Fix'\n        groupId:\n          $ref: '#/components/schemas/GroupId'\n        groupTitle:\n          $ref: '#/components/schemas/GroupTitle'\n        ruleId:\n          $ref: '#/components/schemas/RuleId'\n        ruleIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/RuleId'\n        severity:\n          type: string\n        stigs:  \n          type: array\n          items:\n            $ref: '#/components/schemas/RevisionBasic'\n        title:\n          $ref: '#/components/schemas/RuleTitle'\n        version:\n          $ref: '#/components/schemas/VersionString'\n      required:\n        - ruleId\n        - version\n        - title\n        - severity\n        - groupId\n        - groupTitle\n    RuleSeverity:\n      enum:\n        - high\n        - medium\n        - low\n        - null\n      type: string\n      nullable: true\n    RuleTitle:\n      $ref: '#/components/schemas/StringMax'\n    SCAPMap:\n      additionalProperties: false\n      type: object\n      properties:\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        scapBenchmarkId:\n          type: string\n    STIG:\n      additionalProperties: false\n      type: object\n      properties:\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        collectionIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/CollectionId'\n        lastRevisionDate:\n          $ref: '#/components/schemas/StringDateNullable'\n        lastRevisionStr:\n          type: string\n        marking:\n          $ref: '#/components/schemas/RevisionMarkingNullable'\n        revisionStrs:\n          type: array\n          items:\n            $ref: '#/components/schemas/RevisionStrRaw'\n        revisions:\n          type: array\n          items:\n            $ref: '#/components/schemas/Revision'\n        ruleCount:\n          $ref: '#/components/schemas/RuleCount'\n        status:\n          $ref: '#/components/schemas/StatusText'\n        title:\n          $ref: '#/components/schemas/StigTitle'\n      required:\n        - benchmarkId\n        - title\n        - lastRevisionStr\n        - lastRevisionDate\n        - ruleCount\n        - collectionIds\n    State:\n      type: string\n      enum:\n        - starting\n        - available\n        - unavailable\n        - fail\n        - stop\n    StateResponse:\n      type: object\n      properties:\n        currentState:\n          $ref: '#/components/schemas/State'\n        since:\n          $ref: '#/components/schemas/StringDateTime'\n        dependencies:\n          $ref: '#/components/schemas/Dependencies'\n        endpoints:\n          $ref: '#/components/schemas/Endpoints'\n    StatusText:\n      $ref: '#/components/schemas/String511Nullable'\n    StigTitle:\n      $ref: '#/components/schemas/String255'\n    String20:\n      maxLength: 20\n      type: string\n    String20Nullable:\n      maxLength: 20\n      nullable: true\n      type: string\n    String255:\n      maxLength: 255\n      type: string\n    String255Nullable:\n      maxLength: 255\n      nullable: true\n      type: string\n    String32767:\n      maxLength: 32767\n      type: string\n    String32767Nullable:\n      maxLength: 32767\n      nullable: true\n      type: string\n    String45:\n      maxLength: 45\n      type: string\n    String45Nullable:\n      maxLength: 45\n      nullable: true\n      type: string\n    String511Nullable:\n      maxLength: 511\n      nullable: true\n      type: string\n    StringDate:\n      format: date\n      type: string\n    StringDateNullable:\n      format: date\n      nullable: true\n      type: string\n    StringDateTime:\n      format: date-time\n      type: string\n    StringDateTimeNullable:\n      format: date-time\n      nullable: true\n      type: string\n    StringHexColor:\n      example: aa33cc\n      pattern: ^[a-fA-F0-9]{6}$\n      type: string\n    StringIntId:\n      maxLength: 10\n      minLength: 1\n      pattern: ^[0-9]{1,10}$\n      type: string\n    StringIntIdNullable:\n      nullable: true\n      maxLength: 10\n      minLength: 1\n      pattern: ^[0-9]{1,10}$\n      type: string\n    StringMax:\n      maxLength: 16777215\n      type: string\n    StringUuid:\n      pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\n      type: string\n    StringUuidNullable:\n      nullable: true\n      pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\n      type: string\n    TextRefNist:\n      $ref: '#/components/schemas/String255'\n    UnreviewedAsset:\n      additionalProperties: false\n      type: object\n      properties:\n        assetId:\n          $ref: '#/components/schemas/AssetId'\n        labels:\n          type: array\n          items:\n            $ref: '#/components/schemas/LabelBasic'\n        name:\n          $ref: '#/components/schemas/AssetName'\n        unreviewed:\n          type: array\n          items:\n            $ref: '#/components/schemas/UnreviewedAssetItem'\n      required:\n        - assetId\n        - name\n        - labels\n        - unreviewed\n    UnreviewedAssetItem:\n      additionalProperties: false\n      type: object\n      properties:\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        groupId:\n          $ref: '#/components/schemas/GroupId'\n        groupTitle:\n          $ref: '#/components/schemas/GroupTitle'\n        result:\n          $ref: '#/components/schemas/ChecklistResultUnreviewed'\n        ruleId:\n          $ref: '#/components/schemas/RuleId'\n        ruleTitle:\n          $ref: '#/components/schemas/RuleTitle'\n        severity:\n          $ref: '#/components/schemas/RuleSeverity'\n      required:\n        - result\n        - ruleId\n        - groupId\n        - benchmarkId\n    UnreviewedRule:\n      additionalProperties: false\n      type: object\n      properties:\n        benchmarkId:\n          $ref: '#/components/schemas/BenchmarkId'\n        groupId:\n          $ref: '#/components/schemas/GroupId'\n        groupTitle:\n          $ref: '#/components/schemas/GroupTitle'\n        ruleId:\n          $ref: '#/components/schemas/RuleId'\n        ruleTitle:\n          $ref: '#/components/schemas/RuleTitle'\n        severity:\n          $ref: '#/components/schemas/RuleSeverity'\n        unreviewed:\n          type: array\n          items:\n            $ref: '#/components/schemas/UnreviewedRuleItem'\n      required:\n        - ruleId\n        - groupId\n        - benchmarkId\n        - unreviewed\n    UnreviewedRuleItem:\n      additionalProperties: false\n      type: object\n      properties:\n        assetId:\n          $ref: '#/components/schemas/AssetId'\n        labels:\n          type: array\n          items:\n            $ref: '#/components/schemas/LabelBasic'\n        name:\n          $ref: '#/components/schemas/AssetName'\n        result:\n          $ref: '#/components/schemas/ChecklistResultUnreviewed'\n      required:\n        - result\n        - assetId\n        - name\n        - labels\n    UserBasic:\n      additionalProperties: false\n      type: object\n      properties:\n        userId:\n          $ref: '#/components/schemas/UserId'\n        username:\n          $ref: '#/components/schemas/Username'\n        roleId:\n          $ref: '#/components/schemas/RoleId'\n      required:\n        - userId\n        - username\n    UserBasicNullable:\n      nullable: true\n      additionalProperties: false\n      type: object\n      properties:\n        userId:\n          $ref: '#/components/schemas/UserIdNullable'\n        username:\n          $ref: '#/components/schemas/UsernameNullable'\n      required:\n        - userId\n        - username\n    UserBasicWithDisplayName:\n      additionalProperties: false\n      type: object\n      properties:\n        userId:\n          $ref: '#/components/schemas/UserId'\n        username:\n          $ref: '#/components/schemas/Username'\n        displayName:\n          $ref: '#/components/schemas/DisplayName'\n      required:\n        - userId\n        - username\n        - displayName\n    UserCreateOrReplace:\n      additionalProperties: false\n      type: object\n      properties:\n        collectionGrants:\n          type: array\n          items:\n            $ref: '#/components/schemas/CollectionGrant'\n          uniqueItems: true\n        userGroups:\n          type: array\n          items:\n            $ref: '#/components/schemas/UserGroupId'\n          uniqueItems: true\n          default: []\n        username:\n          $ref: '#/components/schemas/Username'\n        status:\n          $ref: '#/components/schemas/UserStatus'\n      required:\n        - username\n        - collectionGrants\n    UserGrant:\n      type: object\n      required:\n        - userId\n        - roleId\n      properties:\n        userId:\n          $ref: '#/components/schemas/UserId'\n        roleId:\n          $ref: '#/components/schemas/RoleId'\n    UserGrantProjected:\n      additionalProperties: false\n      type: object\n      properties:\n        grantId:\n          $ref: '#/components/schemas/GrantId'\n        roleId:\n          $ref: '#/components/schemas/RoleId'\n        user:\n          $ref: '#/components/schemas/UserBasicWithDisplayName'\n      required:\n        - user\n        - roleId\n    UserGroup:\n      type: object\n      additionalProperties: false\n      required:\n        - userGroupId\n        - name\n        - description\n      properties:\n        userGroupId:\n          $ref: '#/components/schemas/UserGroupId'\n        name:\n          $ref: '#/components/schemas/String255'\n        description:\n          $ref: '#/components/schemas/String255Nullable'\n    UserGroupBasic:\n      type: object\n      additionalProperties: false\n      required:\n        - userGroupId\n        - name\n      properties:\n        userGroupId:\n          $ref: '#/components/schemas/UserGroupId'\n        name:\n          $ref: '#/components/schemas/String255'\n        roleId:\n          $ref: '#/components/schemas/RoleId'\n    UserGroupCollectionGrant:\n      additionalProperties: false\n      type: object\n      properties:\n        roleId:\n          $ref: '#/components/schemas/RoleId'\n        collection:\n          type: object\n          properties:\n            collectionId:\n              $ref: '#/components/schemas/CollectionId'\n            name:\n              $ref: '#/components/schemas/CollectionName'\n    UserGroupGrant:\n      type: object\n      required:\n        - userGroupId\n        - roleId\n      additionalProperties: false\n      properties:\n        userGroupId:\n          $ref: '#/components/schemas/UserGroupId'\n        roleId:\n          type: integer\n          minimum: 1\n          maximum: 4\n    UserGroupGrantProjected:\n      type: object\n      required:\n        - userGroup          \n        - roleId\n      additionalProperties: false\n      properties:\n        grantId:\n          $ref: '#/components/schemas/GrantId'\n        userGroup:\n          $ref: '#/components/schemas/UserGroup'\n        roleId:\n          $ref: '#/components/schemas/RoleId'\n    UserGroupId:\n      $ref: '#/components/schemas/StringIntId' \n    UserGroupPatch:\n      type: object\n      additionalProperties: false\n      minProperties: 1\n      properties:\n        name:\n          $ref: '#/components/schemas/String255'\n        description:\n          $ref: '#/components/schemas/String255Nullable'\n        userIds:\n          type: array\n          items:\n            $ref: '#/components/schemas/UserId'\n        collectionGrants:\n          type: array\n          items:\n            $ref: '#/components/schemas/CollectionGrant'\n          uniqueItems: true\n    UserGroupProjected:\n      type: object\n      additionalProperties: false\n      required:\n        - userGroupId\n        - name\n        - description\n      properties:\n        userGroupId:\n          $ref: '#/components/schemas/UserGroupId'\n        name:\n          $ref: '#/components/schemas/String255'\n        description:\n          $ref: '#/components/schemas/String255Nullable'\n        users:\n          type: array\n          items:\n            $ref: '#/components/schemas/UserBasicWithDisplayName'\n        collectionGrants:\n          type: array\n          items:\n            $ref: '#/components/schemas/UserGroupCollectionGrant'\n        attributions:\n          $ref: '#/components/schemas/Attributions'\n    UserGroupPostOrPut:\n      type: object\n      additionalProperties: false\n      required:\n        - name\n      properties:\n        name:\n          $ref: '#/components/schemas/String255'\n        description:\n          $ref: '#/components/schemas/String255Nullable'\n        userIds:\n          type: array\n          uniqueItems: true\n          items:\n            $ref: '#/components/schemas/UserId'\n        collectionGrants:\n          type: array\n          items:\n            $ref: '#/components/schemas/CollectionGrant'\n          uniqueItems: true\n    UserId:\n      $ref: '#/components/schemas/StringIntId'\n    UserIdNullable:\n      $ref: '#/components/schemas/StringIntIdNullable'\n    UserLastAccess:\n      $ref: '#/components/schemas/IntegerMinimumZeroNullable'\n    UserPatch:\n      additionalProperties: false\n      minProperties: 1\n      type: object\n      properties:\n        collectionGrants:\n          type: array\n          items:\n            $ref: '#/components/schemas/CollectionGrant'\n          uniqueItems: true\n        userGroups:\n          type: array\n          items:\n            $ref: '#/components/schemas/UserGroupId'\n          uniqueItems: true\n        username:\n          $ref: '#/components/schemas/Username'\n        status:\n          $ref: '#/components/schemas/UserStatus'\n    UserPost:\n      additionalProperties: false\n      type: object\n      properties:\n        collectionGrants:\n          type: array\n          items:\n            $ref: '#/components/schemas/CollectionGrant'\n          uniqueItems: true\n        userGroups:\n          type: array\n          items:\n            $ref: '#/components/schemas/UserGroupId'\n          uniqueItems: true\n        username:\n          $ref: '#/components/schemas/Username'\n      required:\n        - collectionGrants\n        - username\n    UserPut:\n      additionalProperties: false\n      type: object\n      properties:\n        collectionGrants:\n          type: array\n          items:\n            $ref: '#/components/schemas/CollectionGrant'\n          uniqueItems: true\n        userGroups:\n          type: array\n          items:\n            $ref: '#/components/schemas/UserGroupId'\n          uniqueItems: true\n        username:\n          $ref: '#/components/schemas/Username'\n        status:\n          $ref: '#/components/schemas/UserStatus'\n      required:\n        - collectionGrants\n        - username\n    UserPrivileges:\n      type: object\n      additionalProperties: false\n      properties:\n        admin:\n          type: boolean\n        create_collection:\n          type: boolean\n    UserProjected:\n      additionalProperties: false\n      type: object\n      properties:\n        collectionGrants:\n          type: array\n          items:\n            $ref: '#/components/schemas/CollectionGrantProjected'\n        displayName:\n          $ref: '#/components/schemas/DisplayName'\n        email:\n          nullable: true\n          type: string\n        lastAccess:\n          $ref: '#/components/schemas/UserLastAccess'\n        privileges:\n          $ref: '#/components/schemas/UserPrivileges'\n        statistics:\n          $ref: '#/components/schemas/UserStatistics'\n        status:\n          $ref: '#/components/schemas/UserStatus'\n        statusDate:\n          $ref: '#/components/schemas/UserStatusDate'\n        statusUser:\n          $ref: '#/components/schemas/UserStatusUser'\n        userGroups:\n          type: array\n          items:\n            $ref: '#/components/schemas/UserGroupBasic'\n        userId:\n          $ref: '#/components/schemas/UserId'\n        username:\n          $ref: '#/components/schemas/Username'\n        webPreferences:\n          $ref: '#/components/schemas/WebPreferences'\n      required:\n        - userId\n        - username\n        - displayName\n        - email\n        - lastAccess\n    UserStatus:\n      type: string\n      enum:\n        - available\n        - unavailable\n    UserStatusDate:\n      $ref: '#/components/schemas/StringDateTime'\n    UserStatusUser:\n      $ref: '#/components/schemas/StringIntIdNullable'\n    UserStatistics:\n      additionalProperties: false\n      type: object\n      properties:\n        collectionGrantCount:\n          type: integer\n        created:\n          $ref: '#/components/schemas/Created'\n        lastClaims:\n          type: object\n      required:\n        - created\n        - collectionGrantCount\n        - lastClaims\n    Username:\n      $ref: '#/components/schemas/String255'\n    UsernameNullable:\n      $ref: '#/components/schemas/String255Nullable'\n    WebPreferences:\n      type: object\n      properties:\n        darkMode:\n          type: boolean\n        lastWhatsNew:\n          type: string\n          format: date\n      additionalProperties: false\n      required:\n        - darkMode\n        - lastWhatsNew\n    WebPreferencesPatch:\n      type: object\n      properties:\n        darkMode:\n          type: boolean\n        lastWhatsNew:\n          type: string\n          format: date\n      additionalProperties: false\n      minProperties: 1\n    Version:\n      description: |\n        Semver as defined by the BNF at semver.org\n      pattern: ^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-([0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*))?(?:\\+([0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*))?$ \n      type: string\n    VersionString:\n      $ref: '#/components/schemas/String255'\n  parameters:\n    AppDataFormatQuery:\n      name: format\n      in: query\n      description: The format of the appdata\n      schema:\n        $ref: '#/components/schemas/AppDataFormat'\n    AssetIdArrayQuery:\n      name: assetId\n      in: query\n      description: A query parameter that identifies a list of Assets\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          $ref: '#/components/schemas/AssetId'\n    AssetIdPath:\n      name: assetId\n      in: path\n      description: A path parameter that identifies an Asset\n      required: true\n      schema:\n        $ref: '#/components/schemas/AssetId'\n    AssetIdQuery:\n      name: assetId\n      in: query\n      description: A query parameter that identifies an Asset\n      schema:\n        $ref: '#/components/schemas/AssetId'\n    AssetProjectionQuery:\n      name: projection\n      in: query\n      description: Additional properties to include in the response.\n      style: form\n      explode: true\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          type: string\n          enum:\n            - statusStats\n            - stigs\n    BenchmarkIdArrayQuery:\n      name: benchmarkId\n      in: query\n      description: Filter by one or more benchmarkIds\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          $ref: '#/components/schemas/BenchmarkId'\n    BenchmarkIdPath:\n      name: benchmarkId\n      in: path\n      description: A path parameter that identifies a STIG\n      required: true\n      schema:\n        $ref: '#/components/schemas/BenchmarkId'\n    BenchmarkIdQuery:\n      name: benchmarkId\n      in: query\n      description: A query parameter that identifies a STIG\n      schema:\n        $ref: '#/components/schemas/BenchmarkId'\n    CciProjectionQuery:\n      name: projection\n      in: query\n      description: Additional properties to include in the response.\n      style: form\n      explode: true\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          type: string\n          enum:\n            - emassAp\n            - stigs\n            - references\n    CciQuery:\n      name: cci\n      in: query\n      description: A query parameter that identifies a CCI\n      schema:\n        $ref: '#/components/schemas/CciString'\n    CklModeQuery:\n      name: mode\n      in: query\n      description: A query parameter that describes the CKL mode\n      schema:\n        type: string\n        default: mono\n        enum:\n          - multi\n          - mono\n    CollectionIdPath:\n      name: collectionId\n      in: path\n      description: A path parameter that identifies a Collection\n      required: true\n      schema:\n        $ref: '#/components/schemas/CollectionId'\n    CollectionIdQuery:\n      name: collectionId\n      required: true\n      in: query\n      description: A query parameter that identifies a Collection\n      schema:\n        $ref: '#/components/schemas/CollectionId'\n    CollectionIdArrayQuery:\n      name: collectionId\n      required: false\n      in: query\n      description: Filter by one or more collectionIds\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          $ref: '#/components/schemas/CollectionId'\n    CollectionProjectionQuery:\n      name: projection\n      in: query\n      description: Additional properties to include in the response.\n      style: form\n      explode: true\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          type: string\n          enum:\n            - assets\n            - grants\n            - users\n            - owners\n            - statistics\n            - stigs\n            - labels\n    CollectionsProjectionQuery:\n      name: projection\n      in: query\n      description: Additional properties to include in the response.\n      style: form\n      explode: true\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          type: string\n          enum:\n            - owners\n            - statistics\n    CollectionStigProjectionQuery:\n      name: projection\n      in: query\n      description: Additional properties to include in the response.\n      style: form\n      explode: true\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          type: string\n          enum:\n            - assets\n    DryRunQuery:\n      name: dryRun\n      in: query\n      description: If set to `true`, performs validation without persisting data.\n      required: false\n      schema:\n        type: boolean\n    DstCollectionIdPath:\n      name: dstCollectionId\n      in: path\n      description: A path parameter that identifies a Collection\n      required: true\n      schema:\n        $ref: '#/components/schemas/CollectionId'\n    EndDateQuery:\n      name: endDate\n      in: query\n      description: History entries with a timestamp after the specified end date.\n      schema:\n        $ref: '#/components/schemas/StringDate'\n    ElevateQuery:\n      name: elevate\n      in: query\n      description: Elevate the user context for this request if user is permitted (canAdmin)\n      schema:\n        type: boolean\n        default: false\n    FindingAggregatorQuery:\n      name: aggregator\n      required: true\n      in: query\n      description: Aggregate the findings on this property\n      schema:\n        type: string\n        minLength: 1\n        enum:\n          - ruleId\n          - groupId\n          - cci\n    FindingProjectionQuery:\n      name: projection\n      in: query\n      description: Optional properties to return\n      style: form\n      explode: true\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          type: string\n          enum:\n            - assets\n            - groups\n            - rules\n            - stigs\n            - ccis\n    ForceQuery:\n      name: force\n      in: query\n      description: Force an action, such as a delete, that would otherwise not be permitted\n      schema:\n        type: boolean\n        default: false\n    GrantIdPath:\n      name: grantId\n      in: path\n      description: A path parameter that identifies a Grant\n      required: true\n      schema:\n        $ref: '#/components/schemas/GrantId'\n    GroupIdQuery:\n      name: groupId\n      in: query\n      description: A query parameter that identifies a Group\n      schema:\n        $ref: '#/components/schemas/GroupId'\n    GroupProjectionQuery:\n      name: projection\n      in: query\n      description: Additional properties to include in the response.\n      style: form\n      explode: true\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          type: string\n          enum:\n            - rules\n    JobIdPath:\n      name: jobId\n      in: path\n      description: A path parameter that identifies a Job\n      required: true\n      schema:\n        $ref: '#/components/schemas/JobId'\n    JobRunIdPath:\n      name: runId\n      in: path\n      description: A path parameter that identifies a Job Run\n      required: true\n      schema:\n        $ref: '#/components/schemas/JobRunId'\n    JsonPathQuery:\n      name: jsonpath\n      in: query\n      description: A JSONPath expression\n      schema:\n        $ref: '#/components/schemas/String255'\n    LabelIdPath:\n      name: labelId\n      in: path\n      required: true\n      description: A path parameter that specifies a Label\n      schema:\n        $ref: '#/components/schemas/LabelId'\n    LabelIdQuery:\n      name: labelId\n      in: query\n      description: Selects Assets by labelId\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          $ref: '#/components/schemas/LabelId'\n    LabelMatchQuery:\n      name: labelMatch\n      in: query\n      description: Selectes Assets without labels\n      schema:\n        type: string\n        enum:\n          - 'null'\n    LabelNameQuery:\n      name: labelName\n      in: query\n      description: Selectes Assets by label name\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          $ref: '#/components/schemas/LabelName'\n    MetadataKeyPath:\n      name: key\n      in: path\n      required: true\n      description: A path parameter that specifies a metadata key\n      schema:\n        pattern: '^([\\w\\.]+)$'\n        type: string\n    MetadataQuery:\n      name: metadata\n      in: query\n      description: A query parameter that specifies metadata key:value pairs to select matching Objects\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          pattern: '^([\\w\\.]+:.*?)$'\n          type: string\n    MetricsFormatQuery:\n      name: format\n      in: query\n      description: The format of the response body\n      schema:\n        type: string\n        default: 'json'\n        enum:\n          - json\n          - csv\n    NameQuery:\n      name: name\n      in: query\n      description: Matches against the name according to the `name-match` parameter\n      schema:\n        type: string\n    NameMatchQuery:\n      name: name-match\n      in: query\n      description: How to match against the `name` parameter\n      schema:\n        type: string\n        default: exact\n        enum:\n          - exact\n          - startsWith\n          - endsWith\n          - contains\n    PoamAggregatorQuery:\n      name: aggregator\n      required: true\n      in: query\n      description: Aggregate the findings on this property\n      schema:\n        type: string\n        enum:\n          - ruleId\n          - groupId\n    PoamFormatQuery:\n      name: format\n      in: query\n      description: Value for POAM format (ie. EMASS, MCCAST)\n      schema:\n        type: string\n        enum:\n          - EMASS\n          - MCCAST\n        default: EMASS\n    PrivilegeQuery:\n      name: privilege\n      in: query\n      description: Selects Users with the specified privilege\n      schema:\n        type: string\n        enum:\n          - admin\n          - create_collection\n    RetentionDateQuery:\n      name: retentionDate\n      in: query\n      description: Delete history entries with a timestamp earlier than the specified retention date.\n      required: true\n      schema:\n        $ref: '#/components/schemas/StringDate'\n    ReviewProjectionQuery:\n      name: projection\n      in: query\n      description: Additional properties to include in the response.\n      style: form\n      explode: true\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          type: string\n          enum:\n            - metadata\n            - rule\n            - stigs\n            - history\n    ReviewHistoryStatsProjectionQuery:\n      name: projection\n      in: query\n      description: Return review history statistics with the specified level of granularity.\n      style: form\n      explode: true\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          type: string\n          enum:\n            - asset\n    ReviewsProjectionQuery:\n      name: projection\n      in: query\n      description: Additional properties to include in the response.\n      style: form\n      explode: true\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          type: string\n          enum:\n            - metadata\n            - rule\n            - stigs\n    ReviewResultQuery:\n      name: result\n      in: query\n      schema:\n        $ref: '#/components/schemas/ReviewResult'\n    ReviewRulesQuery:\n      name: rules\n      in: query\n      description: \n        default - rules from the default revision of a STIG in the Collection.<br>mapped - rules from any version of a STIG assigned to the Asset\n      schema:\n        type: string\n        default: default-mapped\n        enum:\n          - all\n          - default\n          - default-mapped\n          - mapped\n          - not-default\n          - not-default-mapped\n          - not-mapped\n    ReviewStatusQuery:\n      name: status\n      in: query\n      schema:\n        $ref: '#/components/schemas/ReviewStatusLabel'\n    RevisionIdArrayQuery:\n      name: revisionId\n      in: query\n      description: Filter by one or more revisionIds (benchmarkId-version-release)  If Revision specified is not the default rev for at least one Collection, response will be empty.\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          type: string\n    RevisionStrPath:\n      name: revisionStr\n      in: path\n      description: A path parameter that identifies a STIG revision [V{version_num}R{release_num} | 'latest' ]\n      required: true\n      schema:\n        $ref: '#/components/schemas/RevisionStr'\n    RuleIdPath:\n      name: ruleId\n      in: path\n      description: A path parameter that identifies a Rule\n      required: true\n      schema:\n        $ref: '#/components/schemas/RuleId'\n    RuleIdQuery:\n      name: ruleId\n      in: query\n      description: Selects Reviews of a Rule\n      schema:\n        $ref: '#/components/schemas/RuleId'\n    RuleProjectionQuery:\n      name: projection\n      in: query\n      description: Additional properties to include in the response.\n      style: form\n      explode: true\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          type: string\n          enum:\n            - detail\n            - ccis\n            - check\n            - fix\n            - ruleIds\n            - stigs\n    RuleSeverityQuery:\n      name: severity\n      in: query\n      description: Selects Rules with the specified severity\n      style: form\n      explode: true\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        maxItems: 2\n        items:\n          $ref: '#/components/schemas/RuleSeverity'\n    RunSequenceQuery:\n      name: after-seq\n      in: query\n      description: The starting sequence number of the run output to retrieve. If not specified, all run output is returned.\n      schema:\n        type: integer\n        minimum: 0\n    StartDateQuery:\n      name: startDate\n      in: query\n      description: History entries with a timestamp before the specified start date.\n      schema:\n        $ref: '#/components/schemas/StringDate'\n    StigProjectionQuery:\n      name: projection\n      in: query\n      description: Additional properties to include in the response.\n      style: form\n      explode: true\n      schema:\n        type: array\n        items:\n          type: string\n          enum:\n            - revisions\n    UnreviewedAssetsProjectionQuery:\n      name: projection\n      in: query\n      description: Additional properties to include in the `unreviewed` objects.\n      style: form\n      explode: true\n      schema:\n        type: array\n        items:\n          type: string\n          enum:\n            - ruleTitle\n            - groupTitle\n    UnreviewedRulesProjectionQuery:\n      name: projection\n      in: query\n      description: Additional properties to include in the response.\n      style: form\n      explode: true\n      schema:\n        type: array\n        items:\n          type: string\n          enum:\n            - ruleTitle\n            - groupTitle\n    UserGroupIdPath:\n      name: userGroupId\n      in: path\n      description: A path parameter that identifies a User Group\n      required: true\n      schema:\n        $ref: '#/components/schemas/UserGroupId'\n    UserGroupProjectionQuery:\n      name: projection\n      in: query\n      description: Additional properties to include in the response.\n      style: form\n      explode: true\n      schema:\n        type: array\n        items:\n          type: string\n          enum:\n            - users\n            - collections\n            - collectionGrants\n            - attributions\n    UserIdPath:\n      name: userId\n      in: path\n      description: A path parameter that identifies a User\n      required: true\n      schema:\n        $ref: '#/components/schemas/UserId'\n    UserIdQuery:\n      name: userId\n      in: query\n      description: A query parameter that identifies a User\n      schema:\n        $ref: '#/components/schemas/UserId'\n    UsernameQuery:\n      name: username\n      in: query\n      description: Matches against the username according to the `username-match` parameter\n      schema:\n        $ref: '#/components/schemas/Username'\n    UsernameMatchQuery:\n      name: username-match\n      in: query\n      description: How to match against the `username` parameter\n      schema:\n        type: string\n        default: exact\n        enum:\n          - exact\n          - startsWith\n          - endsWith\n          - contains\n    UserStatusQuery:\n      name: status\n      in: query\n      description: A query parameter that identifies a UserStatus\n      schema:\n        $ref: '#/components/schemas/UserStatus'\n    UserPreferenceQuery:\n      name: projection\n      in: query\n      description: A query parameter that identifies a UserPreference\n      schema:\n        type: string\n        enum:\n          - webPreferences\n    UserProjectionQuery:\n      name: projection\n      in: query\n      description: Additional properties to include in the response.\n      style: form\n      explode: true\n      schema:\n        type: array\n        uniqueItems: true\n        minItems: 1\n        items:\n          type: string\n          enum:\n            - collectionGrants\n            - statistics\n            - userGroups\n            - webPreferences\n  responses:\n    Forbidden:\n      description: The requesting User does not have access rights to the content\n      content:\n        application/json:\n          schema:\n            $ref: '#/components/schemas/Error'\n  securitySchemes:\n    oauth:\n      type: openIdConnect\n      openIdConnectUrl: http://localhost:8080/realms/stigman/.well-known/openid-configuration\n# supported oauth scopes:\n# - stig-manager\n# - 'stig-manager:op'\n# - 'stig-manager:op:read'\n# - 'stig-manager:stig'\n# - 'stig-manager:stig:read'\n# - 'stig-manager:collection'\n# - 'stig-manager:collection:read'\n# - 'stig-manager:user'\n# - 'stig-manager:user:read'\n"
  },
  {
    "path": "api/source/tls/README.md",
    "content": "Optional: Place your TLS/SSL certificates and keys here"
  },
  {
    "path": "api/source/utils/PoolMonitor.js",
    "content": "/**\n * Class representing a PoolMonitor.\n * Monitors the database connection status and determines if the API should enter an Unavailable state.\n */\nclass PoolMonitor {\n  /**\n   * Creates an instance of PoolMonitor.\n   * @param {Object} options - Constructor options.\n   * @param {Object} options.pool - The mysql2 PromisePool object.\n   * @param {Object} options.state - The API state object.\n   * @param {number} [options.retryInterval=40000] - The interval at which to execute the retryFn (in milliseconds).\n   * @param {Function} [options.retryFn=async ()=>{})] - The retry function.\n   * @throws {Error} Throws an error if pool or state is not provided.\n   */\n  constructor({ pool, state, retryInterval = 40000, retryFn = async () => {} }) {\n    if (!pool || !state) {\n      throw new Error('PoolMonitor requires a pool and state object.')\n    }\n    this.pool = pool\n    this.state = state\n    this.retryInterval = retryInterval\n    this.retryFn = retryFn\n    this.retries = 0\n    this.pool.on('remove', this.onRemove.bind(this))\n  }\n\n  /**\n   * Handler for the pool's remove event.\n   * Sets the database status based on the pool's connection status.\n   */\n  onRemove() {\n    const poolIsEmpty = this.pool.pool._allConnections.length === 0\n    if (poolIsEmpty && this.state.dependencyStatus.db) {\n      this.state.setDbStatus(false)\n      this.retries = 0\n      this.timeoutId = setTimeout(this.callRetryFn.bind(this), this.retryInterval)\n    }\n  }\n\n  /**\n   * Calls the instance's retry function.\n   * If successful, sets the database status to true and clears the retry interval.\n   * If unsuccessful, increments the retry count and schedules the next retry.\n   */\n  async callRetryFn() {\n    try {\n      await this.retryFn()\n      this.state.setDbStatus(true)\n    } \n    catch (error) {\n      this.retries++\n      this.timeoutId = setTimeout(this.callRetryFn.bind(this), this.retryInterval)\n    }\n  }\n}\n\nmodule.exports = PoolMonitor\n"
  },
  {
    "path": "api/source/utils/asyncApiValidator.js",
    "content": "/**\r\n * Lightweight AsyncAPI 3.0 message validator.\r\n *\r\n * Builds AJV-compiled validators from an AsyncAPI 3.0 YAML spec file.\r\n * Provides a validate(key, payload, channel, operation) method for runtime\r\n * message validation on any channel defined in the spec.\r\n *\r\n * Parser limitations (not AsyncAPI requirements — these are constraints of this\r\n * module's simplified parsing approach):\r\n * - Only handles AsyncAPI 3.0 (not 2.x, which has a different structure)\r\n * - Spec must be a single YAML file (no external file $ref references)\r\n * - Circular $ref references will throw an error (detected via visited set)\r\n * - $ref pointers are only resolved within components/schemas\r\n * - Each message must have a `name` field (AsyncAPI makes this optional; we\r\n *   use it as the validation lookup key, same role as asyncapi-validator's\r\n *   msgIdentifier option)\r\n * - Message payloads must use a $ref to components/schemas (inline schemas\r\n *   are not supported)\r\n * - Operations must include a `messages` array (AsyncAPI makes this optional,\r\n *   defaulting to all channel messages; we require it to be explicit)\r\n *\r\n * Background:\r\n * Replaces the asyncapi-validator npm package, which was removed because its\r\n * dependency chain (asyncapi-validator -> @asyncapi/parser -> @stoplight/spectral-core\r\n * -> minimatch@3.1.2) included a version of minimatch vulnerable to CVE-2026-27904\r\n * (catastrophic regex backtracking). The asyncapi-validator package was not receiving\r\n * regular updates, and all alternative AsyncAPI message validation packages\r\n * (e.g., asyncapi-validation) also depend on @asyncapi/parser, so they would\r\n * introduce the same vulnerability.\r\n *\r\n * Why js-yaml instead of @asyncapi/parser:\r\n * @asyncapi/parser is a full-featured AsyncAPI spec parser that validates the spec\r\n * itself, resolves multi-file $ref chains, handles protocol bindings, and produces\r\n * a rich document model. Our specs are single self-contained files with only\r\n * intra-file $ref references and simple JSON schemas. js-yaml gives us the parsed\r\n * YAML object, and we resolve the $ref chains ourselves in ~15 lines. This\r\n * eliminates the entire @asyncapi/parser dependency tree (~160 packages) while\r\n * preserving identical validation behavior.\r\n *\r\n * Spec validation:\r\n * This module does not validate that the YAML file is a valid AsyncAPI document.\r\n * It trusts the spec structure. To validate a spec against the AsyncAPI schema,\r\n * use the AsyncAPI CLI (also enforced in CI via api-spec-validation.yml):\r\n *   npx @asyncapi/cli validate api/source/specification/log-socket.yaml\r\n */\r\n\r\nconst Ajv = require('ajv')\r\nconst addFormats = require('ajv-formats')\r\nconst fs = require('node:fs')\r\nconst jsYaml = require('js-yaml')\r\n\r\nclass AsyncApiValidator {\r\n  constructor(channels, ajv) {\r\n    this._channels = channels\r\n    this._ajv = ajv\r\n  }\r\n\r\n  /**\r\n   * Validate a message payload against the schema defined in the AsyncAPI spec.\r\n   * @param {string} key - Message name as defined in the spec (e.g., 'authorize', 'log')\r\n   * @param {object} payload - The message object to validate\r\n   * @param {string} channel - Channel name (e.g., 'logStream')\r\n   * @param {string} operation - 'send' or 'receive'\r\n   * @throws {Error} if validation fails or the key/channel/operation is not found\r\n   */\r\n  validate(key, payload, channel, operation) {\r\n    const channelDef = this._channels[channel]\r\n    if (!channelDef) {\r\n      throw new Error(`channel \"${channel}\" not found`)\r\n    }\r\n    const operationDef = channelDef[operation]\r\n    if (!operationDef) {\r\n      throw new Error(`operation \"${operation}\" not found on channel \"${channel}\"`)\r\n    }\r\n    const validateFn = operationDef[key]\r\n    if (!validateFn) {\r\n      throw new Error(`message \"${key}\" on channel \"${channel}\" operation \"${operation}\" not found`)\r\n    }\r\n    const valid = validateFn(payload)\r\n    if (!valid) {\r\n      throw new Error(this._ajv.errorsText(validateFn.errors))\r\n    }\r\n    return true\r\n  }\r\n}\r\n\r\n/**\r\n * Recursively resolve $ref pointers within a JSON Schema object.\r\n * Only handles intra-file references to components/schemas.\r\n * Tracks visited refs to detect circular references.\r\n */\r\nfunction resolveRefs(node, schemas, visited = new Set()) {\r\n  if (!node || typeof node !== 'object') return node\r\n  if (node.$ref) {\r\n    const refName = node.$ref.split('/').pop()\r\n    if (visited.has(refName)) {\r\n      throw new Error(`Circular $ref detected: ${refName}`)\r\n    }\r\n    if (!schemas[refName]) {\r\n      throw new Error(`Dangling $ref: \"${node.$ref}\" not found in components/schemas`)\r\n    }\r\n    return resolveRefs(schemas[refName], schemas, new Set(visited).add(refName))\r\n  }\r\n  if (Array.isArray(node)) {\r\n    return node.map(item => resolveRefs(item, schemas, visited))\r\n  }\r\n  const resolved = {}\r\n  for (const [key, value] of Object.entries(node)) {\r\n    resolved[key] = resolveRefs(value, schemas, visited)\r\n  }\r\n  return resolved\r\n}\r\n\r\n/**\r\n * Build an AsyncApiValidator from an AsyncAPI 3.0 YAML spec file.\r\n * Parses the spec, resolves $ref chains, and pre-compiles AJV validators\r\n * for each message type grouped by channel and operation (send/receive).\r\n *\r\n * Messages are keyed by their `name` field in the spec. See the module-level\r\n * JSDoc for full spec requirements.\r\n *\r\n * @param {string} schemaPath - Absolute path to the AsyncAPI YAML file\r\n * @returns {AsyncApiValidator}\r\n */\r\nfunction fromSource(schemaPath) {\r\n  const yamlContent = fs.readFileSync(schemaPath, 'utf8')\r\n  const spec = jsYaml.load(yamlContent)\r\n\r\n  const ajv = new Ajv({ allErrors: true, strict: false, unicodeRegExp: false })\r\n  addFormats(ajv)\r\n\r\n  const schemas = spec.components.schemas\r\n  const messages = spec.components.messages\r\n  const channels = {}\r\n\r\n  for (const operation of Object.values(spec.operations)) {\r\n    const channelName = operation.channel.$ref.split('/').pop()\r\n    const action = operation.action\r\n\r\n    for (const msgRefObj of operation.messages) {\r\n      // Resolve through channels to components/messages\r\n      const refParts = msgRefObj.$ref.split('/')\r\n      // e.g., '#/channels/logStream/messages/AuthorizeResponse'\r\n      const channelMsgEntry = spec.channels[refParts[2]].messages[refParts[4]]\r\n      const componentMsgName = channelMsgEntry.$ref.split('/').pop()\r\n      const message = messages[componentMsgName]\r\n      const msgKey = message.name\r\n      const schemaName = message.payload.$ref.split('/').pop()\r\n      const payloadSchema = resolveRefs(schemas[schemaName], schemas)\r\n\r\n      const validateFn = ajv.compile(payloadSchema)\r\n\r\n      channels[channelName] ??= {}\r\n      channels[channelName][action] ??= {}\r\n      channels[channelName][action][msgKey] = validateFn\r\n    }\r\n  }\r\n\r\n  return new AsyncApiValidator(channels, ajv)\r\n}\r\n\r\nmodule.exports = { fromSource }\r\n"
  },
  {
    "path": "api/source/utils/auth.js",
    "content": "const config = require('./config')\r\nconst logger = require('./logger')\r\nconst jwt = require('jsonwebtoken')\r\nconst retry = require('async-retry')\r\nconst UserService = require(`../service/UserService`)\r\nconst SmError = require('./error')\r\nconst state = require('./state')\r\nconst JWKSCache = require('./jwksCache')\r\nconst { Agent, fetch } = require('undici');\r\nconst fs = require('node:fs');\r\nconst path = require('node:path')\r\n\r\nlet jwksCache\r\nlet initAttempt = 0\r\n\r\n\r\n// Helper function to safely traverse object properties using dot notation\r\nfunction getClaimByPath(obj, path = config.oauth.claims.privilegesRaw) {\r\n  if (!obj || !path) return [];\r\n  try {\r\n    // Split the path by dots and traverse the object\r\n    const keys = path.split('.');\r\n    let value = obj;\r\n    for (const key of keys) {\r\n      if (value == null) return [];\r\n      value = value[key];\r\n    }\r\n    return value || [];\r\n  } catch {\r\n    return [];\r\n  }\r\n}\r\n\r\n// Helper function to decode and validate the JWT structure\r\nfunction decodeToken(tokenJWT) {\r\n    const tokenObj = jwt.decode(tokenJWT, { complete: true })\r\n    if (!tokenObj) {\r\n        throw new SmError.AuthorizeError(\"Token is not valid JWT\")\r\n    }\r\n    return tokenObj\r\n}\r\n\r\n// Helper function to check for insecure kids\r\nfunction checkInsecureKid(tokenObj) {\r\n    if (!config.oauth.allowInsecureTokens && config.oauth.insecureKids.includes(tokenObj.header.kid)) {\r\n        throw new SmError.InsecureTokenError(`Insecure kid found: ${tokenObj.header.kid}`)\r\n    }\r\n}\r\n\r\n// Helper function to retrieve the signing key\r\nasync function getSigningKey(tokenObj) {\r\n    let signingKey = jwksCache.getKey(tokenObj.header.kid)\r\n\r\n    if (signingKey === null) {\r\n        const result = await jwksCache.refreshCache(false) // Will not retry on failure\r\n        if (result) {\r\n            signingKey = jwksCache.getKey(tokenObj.header.kid)\r\n        }\r\n        if (!result || !signingKey) {\r\n            signingKey = 'unknown'\r\n            jwksCache.setKey(tokenObj.header.kid, signingKey)\r\n            logger.writeWarn('auth', 'unknownKid', { kid: tokenObj.header.kid })\r\n        }\r\n    }\r\n\r\n    if (signingKey === 'unknown') {\r\n        throw new SmError.SigningKeyNotFoundError(`Signing key unknown for kid: ${tokenObj.header.kid}`)\r\n    }\r\n\r\n    return signingKey\r\n}\r\n\r\n// Helper function to verify the token\r\nfunction verifyToken(tokenJWT, signingKey) {\r\n    const options = config.oauth.audienceValue ? {audience: config.oauth.audienceValue} : undefined\r\n    try {\r\n        jwt.verify(tokenJWT, signingKey, options)\r\n    } catch (e) {\r\n        throw new SmError.AuthorizeError(e.message)\r\n    }\r\n}\r\n\r\n// express middleware to validate token\r\nconst validateToken = async function (req, res, next) {\r\n    try {\r\n        const tokenJWT = getBearerToken(req)\r\n        if (tokenJWT) {\r\n            const tokenObj = decodeToken(tokenJWT)\r\n            checkInsecureKid(tokenObj)\r\n            const signingKey = await getSigningKey(tokenObj)\r\n            verifyToken(tokenJWT, signingKey)\r\n\r\n            req.access_token = tokenObj.payload\r\n            req.bearer = tokenJWT\r\n        }\r\n        next()\r\n    } catch (e) {\r\n        next(e)\r\n    }\r\n}\r\n\r\n// express middleware to setup user object, expects to be called after validateToken()\r\nconst setupUser = async function (req, res, next) {\r\n    try {\r\n        if (req.access_token) {\r\n            // Get decoded JWT payload from request\r\n            const tokenPayload = req.access_token\r\n    \r\n            // Get username from configured claims in token, or fall back through precedence list. \r\n            const usernamePrecedence = [config.oauth.claims.username, \"preferred_username\", config.oauth.claims.servicename, \"azp\", \"client_id\", \"clientId\"]\r\n            const username = tokenPayload[usernamePrecedence.find(element => !!tokenPayload[element])]\r\n            // If no username found, throw Privilege error\r\n            if (username === undefined) {\r\n                throw new SmError.AuthorizeError(\"No token claim mappable to username found\")\r\n            }\r\n            \r\n            const userObject = await UserService.getUserObject(username) ?? {username}\r\n\r\n            if (userObject.status === 'unavailable') {\r\n                throw new SmError.UserUnavailableError()\r\n            }\r\n            \r\n            const refreshFields = {}\r\n            let now = new Date().toUTCString()\r\n            now = new Date(now).getTime()\r\n            now = now / 1000 | 0 //https://stackoverflow.com/questions/7487977/using-bitwise-or-0-to-floor-a-number\r\n    \r\n            if (!userObject?.lastAccess || now - userObject?.lastAccess >= config.settings.lastAccessResolution) {\r\n                refreshFields.lastAccess = now\r\n            }\r\n            if (!userObject?.lastClaims || tokenPayload[config.oauth.claims.assertion] !== userObject?.lastClaims?.[config.oauth.claims.assertion]) {\r\n                refreshFields.lastClaims = JSON.stringify(tokenPayload)\r\n            }\r\n            if (refreshFields.lastAccess || refreshFields.lastClaims) {\r\n                const userId = await UserService.setUserData(userObject, refreshFields)\r\n                if (userId != userObject.userId) {\r\n                    userObject.userId = userId.toString()\r\n                }\r\n            }\r\n\r\n            // Get privileges and check elevate param  \r\n            userObject.privileges = {\r\n                create_collection: getClaimByPath(tokenPayload).includes('create_collection'),\r\n                admin: getClaimByPath(tokenPayload).includes('admin')\r\n            }\r\n\r\n            if ('elevate' in req.query && (req.query.elevate === 'true' && !userObject.privileges.admin)) {\r\n                throw new SmError.InvalidElevationError() \r\n            }\r\n\r\n            req.userObject = userObject\r\n        }\r\n        next()\r\n    }\r\n    catch (e) {\r\n        next(e)\r\n    }\r\n}\r\n\r\n// express-openapi-validator security handler\r\nconst validateOauthSecurity = function (req, requiredScopes) {\r\n    if (!req.access_token) {\r\n        throw new SmError.NoTokenError() \r\n    }\r\n    // Get decoded JWT payload from request\r\n    const tokenPayload = req.access_token\r\n\r\n    // Check scopes\r\n    const grantedScopes = typeof tokenPayload[config.oauth.claims.scope] === 'string' ? \r\n        tokenPayload[config.oauth.claims.scope].split(' ') : \r\n        tokenPayload[config.oauth.claims.scope]\r\n    const commonScopes = grantedScopes.filter(gs =>\r\n        requiredScopes.some(rs => {\r\n            if (gs === rs) return true\r\n            const gsTokens = gs.split(':').filter(i => i.length)\r\n            const rsTokens = rs.split(':').filter(i => i.length)\r\n            return gsTokens.length > 0 && gsTokens.every((t, i) => rsTokens[i] === t)\r\n        })\r\n    )\r\n    if (commonScopes.length == 0) {\r\n        throw new SmError.OutOfScopeError()\r\n    }\r\n\r\n    return true\r\n}\r\n\r\n// utility to extract bearer token from request\r\nconst getBearerToken = req => {\r\n    if (!req.headers.authorization) return\r\n    const headerParts = req.headers.authorization.split(' ')\r\n    if (headerParts[0].toLowerCase() === 'bearer') return headerParts[1]\r\n}\r\n\r\n// Check if JWKS contains any insecure key IDs\r\nconst containsInsecureKids = (kids) => {\r\n    return kids.some(kid => config.oauth.insecureKids.includes(kid))\r\n}\r\n\r\n// setup the JWKS key handling client\r\nconst setupJwks = async function (jwksUri, caCerts) {\r\n    jwksCache = new JWKSCache({\r\n        jwksUri,\r\n        caCerts,\r\n        cacheMaxAge: config.oauth.cacheMaxAge * 60 * 1000, // convert minutes to milliseconds\r\n    })\r\n    jwksCache.on('cacheUpdate', (cache) => {\r\n        logger.writeDebug('auth', 'jwksCacheEvent', { event: 'cacheUpdate', kids: jwksCache.getKidTypes() })\r\n    })\r\n    jwksCache.on('cacheStale', (cache) => {\r\n        logger.writeDebug('auth', 'jwksCacheEvent', { event: 'cacheStale', message: cache })\r\n        state.setOidcStatus(false)\r\n        jwksCache.once('cacheUpdate', (cache) => {\r\n            state.setOidcStatus(true)\r\n        })\r\n    })\r\n\r\n    // refresh cache of signing keys\r\n    const cacheResult = await jwksCache.refreshCache(false) // will not retry on failure\r\n    if (!cacheResult) throw new Error('refresh jwks cache failed')\r\n    const kids = jwksCache.getKids()\r\n    if (!config.oauth.allowInsecureTokens && containsInsecureKids(kids)) {\r\n        throw new Error('insecure_kid - JWKS contains insecure key IDs and STIGMAN_DEV_ALLOW_INSECURE_TOKENS is false')\r\n    }\r\n\r\n    logger.writeDebug('auth', 'discovery', { jwksUri, kids: jwksCache.getKidTypes() })\r\n}\r\n\r\nconst getCaCerts = () => {\r\n    if (config.oauth.caCerts) {\r\n        try {\r\n            return fs.readFileSync(config.oauth.caCerts);\r\n        } catch (e) {\r\n            logger.writeError('auth', 'getCaCerts', { message: `Failed to read CA certificates from path: ${config.oauth.caCerts}`, error: e.message })\r\n            throw new Error(`Failed to read CA certificates from path: ${config.oauth.caCerts}`)\r\n        }\r\n    }\r\n}\r\n\r\nasync function initializeAuth() {\r\n    const retries = config.settings.dependencyRetries\r\n    const metadataUri = `${config.oauth.authority}/.well-known/openid-configuration`\r\n    let jwksUri\r\n    let dispatcher\r\n    let caCerts = null\r\n    if (config.oauth.caCerts) {\r\n        caCerts = getCaCerts()\r\n        dispatcher = new Agent({ connect: { ca: caCerts } })\r\n        logger.writeInfo('auth', 'initializeAuth', { message: 'Using custom CA certificates to validate OIDC provider connections' })\r\n    }\r\n    \r\n    async function getJwks(bail) {\r\n        logger.writeDebug('auth', 'discovery', { metadataUri, attempt: ++initAttempt })\r\n        const response = await fetch(metadataUri, { method: 'GET', dispatcher })\r\n        const openidConfig = await response.json()\r\n        logger.writeDebug('auth', 'discovery', { metadataUri, metadata: openidConfig})\r\n        \r\n        if (!openidConfig.jwks_uri) {\r\n            const message = \"No jwks_uri property found in oidcConfig\"\r\n            logger.writeError('auth', 'discovery', { success: false, metadataUri, message })\r\n            bail(new Error(message)) // Bail if jwks_uri is not found\r\n            return // return after bail\r\n        }\r\n        jwksUri = openidConfig.jwks_uri\r\n        \r\n        try {\r\n            await setupJwks(jwksUri, caCerts)\r\n        } catch (error) {\r\n            // If the error is from insecure kids detection, bail immediately\r\n            if (error.message.startsWith('insecure_kid -')) {\r\n                logger.writeError('auth', 'discovery', { success: false, metadataUri, message: error.message })\r\n                bail(error) // This will immediately stop retrying\r\n                return // Make sure to return after bail\r\n            }\r\n            throw error // Other errors will be retried\r\n        }\r\n    }\r\n    \r\n    await retry(getJwks, {\r\n        retries,\r\n        factor: 1,\r\n        minTimeout: 5 * 1000,\r\n        maxTimeout: 5 * 1000,\r\n        onRetry: (error) => {\r\n            state.setOidcStatus(false)\r\n            logger.writeError('auth', 'discovery', { success: false, metadataUri, message: error.message })\r\n        }\r\n    })\r\n    \r\n    logger.writeInfo('auth', 'discovery', { success: true, metadataUri, jwksUri })\r\n    state.setOidcStatus(true)\r\n}\r\n\r\nmodule.exports = {\r\n    validateToken, \r\n    setupUser, \r\n    validateOauthSecurity, \r\n    initializeAuth, \r\n    getClaimByPath,\r\n    checkInsecureKid,\r\n    decodeToken,\r\n    getSigningKey,\r\n    verifyToken\r\n}"
  },
  {
    "path": "api/source/utils/buffer-json.js",
    "content": "function stringify (value, space) {\n    return JSON.stringify(value, replacer, space)\n  }\n  \n  function parse (text) {\n    return JSON.parse(text, reviver)\n  }\n  \n  function replacer (key, value) {\n    if (isBufferLike(value)) {\n      if (isArray(value.data)) {\n        if (value.data.length > 0) {\n          value.data = 'base64:' + Buffer.from(value.data).toString('base64')\n        } else {\n          value.data = ''\n        }\n      }\n    }\n    return value\n  }\n  \n  function reviver (key, value) {\n    if (isBufferLike(value)) {\n      if (isArray(value.data)) {\n        return Buffer.from(value.data)\n      } else if (isString(value.data)) {\n        if (value.data.startsWith('base64:')) {\n          return Buffer.from(value.data.slice('base64:'.length), 'base64')\n        }\n        // Assume that the string is UTF-8 encoded (or empty).\n        return Buffer.from(value.data)\n      }\n    }\n    return value\n  }\n  \n  function isBufferLike (x) {\n    return (\n      isObject(x) && x.type === 'Buffer' && (isArray(x.data) || isString(x.data))\n    )\n  }\n  \n  function isArray (x) {\n    return Array.isArray(x)\n  }\n  \n  function isString (x) {\n    return typeof x === 'string'\n  }\n  \n  function isObject (x) {\n    return typeof x === 'object' && x !== null\n  }\n  \n  module.exports = {\n    stringify,\n    parse,\n    replacer,\n    reviver\n  }"
  },
  {
    "path": "api/source/utils/config.js",
    "content": "const ourPackage = require(\"../package.json\")\n\n// Array of known insecure kid values\nconst insecureKids = ['FJ86GcF3jTbNLOco4NvZkUCIUmfYCqoqtOQeMfbhNlE']\n\nconst config = {\n    version: `${process.env.COMMIT_DESCRIBE ? process.env.COMMIT_DESCRIBE.replace(/-g[0-9a-f]+$/, \"\").replace(/-/g, \"+\") : ourPackage.version}`,\n    commit: {\n        branch: process.env.COMMIT_BRANCH || 'na',\n        sha: process.env.COMMIT_SHA || 'na',\n        tag: process.env.COMMIT_TAG || 'na',\n        describe: process.env.COMMIT_DESCRIBE || 'na'\n    },\n    settings: {\n        setClassification: process.env.STIGMAN_CLASSIFICATION ?? \"NONE\",\n        lastAccessResolution: 60,\n        // Supported STIGMAN_DEV_RESPONSE_VALIDATION values: \n        // \"logOnly\" (logs failing response, but still sends them) \n        // \"none\"(no validation performed)\n        responseValidation: process.env.STIGMAN_DEV_RESPONSE_VALIDATION || \"none\",\n        dependencyRetries: process.env.STIGMAN_DEPENDENCY_RETRIES || 24\n    },\n    client: {\n        clientId: process.env.STIGMAN_CLIENT_ID || \"stig-manager\",\n        consoleMode: process.env.STIGMAN_CLIENT_CONSOLE_MODE || \"production\",\n        displayAppManagers: process.env.STIGMAN_CLIENT_DISPLAY_APPMANAGERS || \"true\",\n        idleTimeoutUser: (() => {\n            const val = parseInt(process.env.STIGMAN_CLIENT_USER_TIMEOUT)\n            if (isNaN(val) || val < 0) return 0\n            return val\n        })(),\n        idleTimeoutAdmin: (() => {\n            const val = parseInt(process.env.STIGMAN_CLIENT_ADMIN_TIMEOUT)\n            if (isNaN(val) || val < 0) return 0\n            return val\n        })(),\n        authority: process.env.STIGMAN_CLIENT_OIDC_PROVIDER || process.env.STIGMAN_OIDC_PROVIDER || \"http://localhost:8080/realms/stigman\",\n        apiBase: process.env.STIGMAN_CLIENT_API_BASE || \"api\",\n        disabled: process.env.STIGMAN_CLIENT_DISABLED === \"true\",\n        directory: process.env.STIGMAN_CLIENT_DIRECTORY || '../../client/dist',\n        extraScopes: process.env.STIGMAN_CLIENT_EXTRA_SCOPES,\n        scopePrefix: process.env.STIGMAN_CLIENT_SCOPE_PREFIX,\n        responseMode: process.env.STIGMAN_CLIENT_RESPONSE_MODE || \"fragment\",\n        reauthAction: process.env.STIGMAN_CLIENT_REAUTH_ACTION || \"popup\",\n        strictPkce: process.env.STIGMAN_CLIENT_STRICT_PKCE !== 'false',\n        stateEvents: process.env.STIGMAN_CLIENT_STATE_EVENTS !== 'false',\n        welcome: {\n            image: process.env.STIGMAN_CLIENT_WELCOME_IMAGE || \"\",\n            message: process.env.STIGMAN_CLIENT_WELCOME_MESSAGE || \"\",\n            title: process.env.STIGMAN_CLIENT_WELCOME_TITLE || \"\",\n            link: process.env.STIGMAN_CLIENT_WELCOME_LINK || \"\"\n        }\n    },\n    docs: {\n        disabled: process.env.STIGMAN_DOCS_DISABLED  === \"true\",\n        docsDirectory: process.env.STIGMAN_DOCS_DIRECTORY || '../../docs/_build/html',\n    },    \n    http: {\n        address: process.env.STIGMAN_API_ADDRESS || \"0.0.0.0\",\n        port: process.env.STIGMAN_API_PORT || 54000,\n        maxJsonBody: process.env.STIGMAN_API_MAX_JSON_BODY || \"31457280\",\n        maxUpload: process.env.STIGMAN_API_MAX_UPLOAD || \"1073741824\",\n        tls: {\n            key_file: process.env.STIGMAN_API_TLS_KEY_FILE,\n            key_passphrase: process.env.STIGMAN_API_TLS_KEY_PASSPHRASE,\n            cert_file: process.env.STIGMAN_API_TLS_CERT_FILE\n        }\n    },\n    database: {\n        host: process.env.STIGMAN_DB_HOST || \"localhost\",\n        port: process.env.STIGMAN_DB_PORT || 3306,\n        schema: process.env.STIGMAN_DB_SCHEMA || \"stigman\",\n        username: process.env.STIGMAN_DB_USER || \"stigman\",\n        password: process.env.STIGMAN_DB_PASSWORD,\n        maxConnections: process.env.STIGMAN_DB_MAX_CONNECTIONS || 25,\n        tls: {\n            ca_file: process.env.STIGMAN_DB_TLS_CA_FILE,\n            cert_file: process.env.STIGMAN_DB_TLS_CERT_FILE,\n            key_file: process.env.STIGMAN_DB_TLS_KEY_FILE\n        },\n        revert: process.env.STIGMAN_DB_REVERT === \"true\",\n        toJSON: function () {\n            let {password, ...props} = this\n            props.password = !!password\n            return props          \n        }\n    },\n    swaggerUi: {\n        enabled: process.env.STIGMAN_SWAGGER_ENABLED === \"true\", \n        authority: process.env.STIGMAN_SWAGGER_OIDC_PROVIDER || process.env.STIGMAN_SWAGGER_AUTHORITY || process.env.STIGMAN_OIDC_PROVIDER || \"http://localhost:8080/auth/realms/stigman\", \n        server: process.env.STIGMAN_SWAGGER_SERVER || \"http://localhost:54000/api\",\n        oauth2RedirectUrl: process.env.STIGMAN_SWAGGER_REDIRECT || \"http://localhost:54000/api-docs/oauth2-redirect.html\"\n    },\n    oauth: {\n        authority: process.env.STIGMAN_OIDC_PROVIDER || process.env.STIGMAN_API_AUTHORITY || \"http://localhost:8080/realms/stigman\",\n        audienceValue: process.env.STIGMAN_JWT_AUD_VALUE,\n        allowInsecureTokens: process.env.STIGMAN_DEV_ALLOW_INSECURE_TOKENS === \"true\",\n        caCerts: process.env.STIGMAN_OIDC_CA_CERTS,\n        insecureKids,\n        cacheMaxAge: Math.min(Math.max(process.env.STIGMAN_JWKS_CACHE_MAX_AGE, 1) || 10, 35791),\n        claims: {\n            scope: process.env.STIGMAN_JWT_SCOPE_CLAIM || \"scope\",\n            username: process.env.STIGMAN_JWT_USERNAME_CLAIM || \"preferred_username\",\n            servicename: process.env.STIGMAN_JWT_SERVICENAME_CLAIM,\n            name: process.env.STIGMAN_JWT_NAME_CLAIM || process.env.STIGMAN_JWT_USERNAME_CLAIM || \"name\",\n            privileges: formatMySqlJsonPath(process.env.STIGMAN_JWT_PRIVILEGES_CLAIM || \"realm_access.roles\"),\n            privilegesChain: formatJsChain(process.env.STIGMAN_JWT_PRIVILEGES_CLAIM || \"realm_access.roles\"),\n            privilegesRaw: process.env.STIGMAN_JWT_PRIVILEGES_CLAIM || \"realm_access.roles\",\n            email: process.env.STIGMAN_JWT_EMAIL_CLAIM || \"email\",\n            assertion: process.env.STIGMAN_JWT_ASSERTION_CLAIM || \"jti\"\n        }\n    },\n    log: {\n        level: parseInt(process.env.STIGMAN_LOG_LEVEL) || 3,\n        mode: process.env.STIGMAN_LOG_MODE || 'combined',\n        optStats: process.env.STIGMAN_DEV_LOG_OPT_STATS === \"true\"\n    },\n    experimental: {\n        appData: process.env.STIGMAN_EXPERIMENTAL_APPDATA === \"true\",\n        logStream: process.env.STIGMAN_EXPERIMENTAL_LOGSTREAM !== \"false\"\n    }\n}\n\nfunction formatJsChain(path) {\n    const components = path?.split('.')\n    if (components?.length === 1) return path\n    for (let x=0; x < components.length; x++) {\n      components[x] = `['${components[x]}']`\n    }\n    return components.join('?.')\n}\n\nfunction formatMySqlJsonPath(path) {\n    return path?.split('.').map(p => `\"${p}\"`).join('.')\n}\n  \nmodule.exports = config"
  },
  {
    "path": "api/source/utils/error.js",
    "content": "class SmError extends Error {\n  constructor(message) {\n    super(message)\n   // Ensure the name of this error is the same as the class name\n    this.name = this.constructor.name\n   // This clips the constructor invocation from the stack trace.\n   // It's not absolutely essential, but it does make the stack trace a little nicer.\n   //  @see Node.js reference (bottom)\n    Error.captureStackTrace(this, this.constructor)\n    this.toJSON = () => ({ error: this.message })\n  }\n}\n\n\nclass ClientError extends SmError {\n  constructor(detail) {\n    super('Incorrect request.')\n    this.status = 400\n    this.detail = detail\n  }\n}\n\nclass AuthorizeError extends SmError {\n  constructor(detail) {\n    super('Request not authorized.')\n    this.status = 401\n    this.detail = detail\n  }\n}\n\nclass PrivilegeError extends SmError {\n  constructor(detail) {\n    super('User has insufficient privilege to complete this request.')\n    this.status = 403\n    this.detail = detail\n  }\n}\n\nclass NotFoundError extends SmError {\n  constructor(detail) {\n    super('Resource not found.')\n    this.status = 404\n    this.detail = detail\n  }\n}\n\nclass UnprocessableError extends SmError {\n  constructor(detail) {\n    super('Unprocessable Entity.')\n    this.status = 422\n    this.detail = detail\n  }\n}\n\nclass InternalError extends SmError {\n  constructor(error) {\n    super(error.message)\n    this.status = 500\n    this.detail = { error }\n  }\n}\n\nclass OIDCProviderError extends SmError {\n  constructor(detail) {\n    super('OIDC Provider is unreachable, unable to validate token.')\n    this.status = 503\n    this.detail = detail\n  }\n}\n\nclass SigningKeyNotFoundError extends SmError {\n  constructor(detail) {\n    super('Unknown signing key, unable to validate token.')\n    this.status = 401\n    this.detail = detail\n  }\n}\n\nclass InsecureTokenError extends SmError {\n  constructor(detail) {\n    super('Insecure token presented and STIGMAN_DEV_ALLOW_INSECURE_TOKENS is false.')\n    this.status = 401\n    this.detail = detail\n  }\n}\n\nclass NoTokenError extends SmError {\n  constructor(detail) {\n    super('Request requires an access token.')\n    this.status = 401\n    this.detail = detail\n  }\n}\n\nclass OutOfScopeError extends SmError {\n  constructor(detail) {\n    super('Required scopes were not found in token.')\n    this.status = 403\n    this.detail = detail\n  }\n}\n\nclass ElevationError extends SmError {\n  constructor(detail) {\n    super('Request requires parameter elevate=true.')\n    this.status = 403\n    this.detail = detail\n  }\n}\n\nclass InvalidElevationError extends SmError {\n  constructor(detail) {\n    super('Invalid use of parameter elevate=true.')\n    this.status = 403\n    this.detail = detail\n  }\n}\n\nclass UserUnavailableError extends SmError {\n  constructor(detail) {\n    super('User status is \"unavailable\".')\n    this.status = 403\n    this.detail = detail\n  }\n}\n\nclass UserInconsistentError extends SmError {\n  constructor(detail) {\n    super('Setting collectionGrants or userGroups is inconsistent with status \"unavailable\".')\n    this.status = 422\n    this.detail = detail\n  }\n}\n\nclass EndpointUnavailableError extends SmError {\n  constructor(detail) {\n    super('Endpoint is unavailable.')\n    this.status = 409\n    this.detail = detail\n  }\n}\n\nclass ModeLockedError extends SmError {\n  constructor(detail) {\n    super('API mode is locked.')\n    this.status = 409\n    this.detail = detail\n  }\n}\n\nmodule.exports = {\n  SmError,\n  AuthorizeError,  \n  PrivilegeError,\n  NotFoundError,\n  ClientError,\n  UnprocessableError,\n  OIDCProviderError,\n  SigningKeyNotFoundError,\n  NoTokenError,\n  OutOfScopeError,\n  ElevationError,\n  InvalidElevationError,\n  InternalError,\n  InsecureTokenError,\n  UserUnavailableError,\n  UserInconsistentError,\n  EndpointUnavailableError,\n  ModeLockedError\n}"
  },
  {
    "path": "api/source/utils/escape.js",
    "content": "\n\n/**\n * Escapes XML reserved characters with named entity references.\n * @param {string} value - The string to escape.\n * @returns {string} The escaped string.\n */\nmodule.exports.escapeForXml = function (name, value) {\n  /**\n   * Regex matches characters that need to be escaped in XML.\n   * @type {RegExp}\n   */\n  const regexEscapeXml = /[\"&'<>]/g\n\n  /**\n   * Map of characters to their corresponding named XML entities.\n   * @type {Object.<string, string>}\n   */\n  const escapeMapXml = {\n    '\"': '&quot;',\n    '&': '&amp;',\n    '\\'': '&apos;',\n    '<': '&lt;',\n    '>': '&gt;'\n  }\n  return value.toString().replace(regexEscapeXml, function ($0) {\n    return escapeMapXml[$0]\n  })\n}\n\n/**\n * Escapes filesystem reserved characters with named entity references.\n * @param {string} value - The string to escape.\n * @returns {string} The escaped string.\n */\nmodule.exports.escapeFilename = function (value) {\n  /**\n   * Regexes match characters that need to be escaped in filenames.\n   * @type {RegExp}\n   */\n  const osReserved = /[/\\\\:*\"?<>|]/g\n  const controlChars = /[\\x00-\\x1f]/g\n\n    /**\n   * Map of characters to their corresponding named HTML entities.\n   * @type {Object.<string, string>}\n   */\n  const osReserveReplace = {\n    '/': '&sol;',\n    '\\\\': '&bsol;',\n    ':': '&colon;',\n    '*': '&ast;',\n    '\"': '&quot;',\n    '?': '&quest;',\n    '<': '&lt;',\n    '>': '&gt;',\n    '|': '&vert;',\n  }\n\n  return value.toString()\n  .replace(osReserved, (match) => osReserveReplace[match])\n  .replace(controlChars, (match) => `&#x${match.charCodeAt(0).toString().padStart(2,'0')};`)\n  .substring(0, 255)\n}\n\nmodule.exports.filenameComponentFromDate = function (dateObject = new Date()) {\n  return dateObject.toISOString().replace(/:|\\d{2}\\.\\d{3}/g,'')\n}\n\n"
  },
  {
    "path": "api/source/utils/jwksCache.js",
    "content": "\nconst EventEmitter = require('node:events')\nconst crypto = require('node:crypto')\nconst http = require('node:http')\nconst https = require('node:https')\nconst logger = require('./logger')\n\nclass JWKSCache extends EventEmitter {\n  constructor({ jwksUri, caCerts, cacheMaxAge = 60000 }) {\n    super()\n    this.cache = new Map()\n    this.jwksUri = jwksUri\n    this.caCerts = caCerts\n    this.cacheMaxAge = Math.min(cacheMaxAge, 2 ** 31 - 1)\n    this.cacheRefreshAge = this.cacheMaxAge / 2\n    this.staleTimeoutId = null\n    this.refreshTimeoutId = null\n    this.isCacheUpdating = false\n  }\n\n  getKey(kid) {\n    if (this.cache.has(kid)) {\n      return this.cache.get(kid)\n    }\n    return null\n  }\n\n  getKids() {\n    return Array.from(this.cache.keys())\n  }\n\n  getKidTypes() {\n    const keys = {}\n    for (const [kid, key] of this.cache.entries()) {\n      keys[kid] = key.type\n    }\n    return keys\n  }\n\n  setKey(kid, key) {\n    this.cache.set(kid, key)\n    this.emit('keyAdded', kid, key)\n  }\n\n  async refreshCache(retryOnFailure = true) {\n    logger.writeInfo('jwksCache', 'refreshing cache', { uri: this.jwksUri })\n    clearTimeout(this.refreshTimeoutId)\n    const result = await this.updateCache()\n    if (result) {\n      this.refreshTimeoutId = setTimeout(this.refreshCache.bind(this), this.cacheRefreshAge)\n    }\n    else {\n      logger.writeError('jwksCache', 'refresh error', { message: 'updateCache returned false' })\n      if (retryOnFailure) this.refreshTimeoutId = setTimeout(this.refreshCache.bind(this), 10000)\n    }\n    return result\n  }\n\n  clearAllCache() {\n    this.cache.clear()\n  }\n\n  clearCacheKeepUnknown() {\n    for (const [kid, key] of this.cache.entries()) {\n      if (key !== 'unknown') {\n        this.cache.delete(kid)\n      }\n    }\n  }\n\n  onCacheStale() {\n    this.clearCacheKeepUnknown()\n    this.emit('cacheStale', this.cache)\n  }\n\n  request(url, options) {\n    return new Promise((resolve, reject) => {\n      const socketInfo = {\n        localAddress: undefined,\n        localPort: undefined,\n        remoteAddress: undefined,\n        remotePort: undefined\n      }\n      const requestOptions = {\n        timeout: 10000,\n        ...options\n      }\n      if (this.caCerts) {\n        requestOptions.ca = this.caCerts\n      }\n\n      const httpRequestLib = url.protocol === 'https:' ? https : http;\n      const httpRequest = httpRequestLib.request(url, requestOptions\n        , (res) => {\n          const socket = res.socket\n          socketInfo.localAddress = socket.localAddress\n          socketInfo.localPort = socket.localPort\n          socketInfo.remoteAddress = socket.remoteAddress\n          socketInfo.remotePort = socket.remotePort\n    \n          let rawData = ''\n          res.setEncoding('utf8')\n          res.on('data', (chunk) => rawData += chunk)\n          res.on('end', () => {\n            if (res.statusCode < 200 || res.statusCode >= 300) {\n              const errorMsg = res.body && (res.body.message || res.body) || res.statusMessage || `Http Error ${res.statusCode}`\n              reject({ errorMsg })\n            }\n            else {\n              try {\n                logger.writeInfo('jwksCache','response', {socket: formatSocket(socketInfo)})\n                resolve(rawData && JSON.parse(rawData))\n              }\n              catch (error) {\n                reject(error)\n              }\n            }\n          })\n        }\n      )\n  \n      /**\n       * Formats a Node.js socket object into a string representation.\n       * \n       * @param {net.Socket} socket - The Node.js socket object.\n       * @returns {string|undefined} A string representation of the socket's local and remote addresses and ports, or undefined if the socket is not connected.\n       */\n      function formatSocket(socket) {\n        return socket.localAddress || socket.remoteAddress ? `${socket.localAddress}:${socket.localPort} -> ${socket.remoteAddress}:${socket.remotePort}` : undefined\n      }\n  \n  \n      function onSocket(socket) {\n        socketInfo.localAddress = socket.localAddress\n        socketInfo.localPort = socket.localPort\n        socketInfo.remoteAddress = socket.remoteAddress\n        socketInfo.remotePort = socket.remotePort\n        socketInfo.socket = socket\n  \n        logger.writeDebug('jwksCache', 'requestEvent', {event: 'socket', socket: formatSocket(socketInfo)})\n        socket.on('error', (error) => {\n          const err = error.errors ? error.errors[0] : error\n          socketInfo.remoteAddress = err.address\n          socketInfo.remotePort = err.port\n          logger.writeError('jwksCache', 'socketEvent', {event: 'error', socket: formatSocket(socketInfo), message: err.message})\n        })\n        socket.on('connectionAttempt', (ip, port, family) => {\n          socketInfo.remoteAddress = ip\n          socketInfo.remotePort = port\n          logger.writeDebug('jwksCache', 'socketEvent', {event: 'connectionAttempt', ip, port, family})\n  \n        })\n        socket.on('connectionAttemptFailed', (ip, port, family, error) => {\n          socketInfo.remoteAddress = ip\n          socketInfo.remotePort = port\n          logger.writeDebug('jwksCache', 'socketEvent', {event: 'connectionAttemptFailed', ip, port, family, message: error.message})\n  \n        })\n        socket.on('lookup', (error, address, family, host) => {\n          socketInfo.remoteAddress = address\n          logger.writeDebug('jwksCache', 'socketEvent', {event: 'lookup', address, family, host, message: error?.message })\n        })\n      }\n   \n      function onTimeout() {\n        logger.writeError('jwksCache', 'requestTimeout', { socket: formatSocket(socketInfo) })\n        httpRequest.destroy()\n      }\n  \n      httpRequest\n        .on('socket', onSocket)\n        .on('timeout', onTimeout)\n        .on('error', reject)\n        .end()\n    })\n  }\n\n  extractKeysFromJwks(jwks) {\n    const results = []\n  \n    jwks = jwks\n      .filter(({ use }) => use === 'sig' || use === undefined)\n      .filter(({ kty }) => kty === 'RSA' || kty === 'EC' || kty === 'OKP')\n  \n    for (const jwk of jwks) {\n      try {\n        if (!jwk.kid) throw new Error('Missing kid')\n        const publicKey = crypto.createPublicKey({ format: 'jwk', key: jwk })\n  \n        results.push({\n          publicKey,\n          publicKeyPem: publicKey.export({ format: 'pem', type: 'spki' }),\n          kid: jwk.kid,\n          alg: jwk.alg\n        })\n      }\n      catch {\n        continue\n      }\n    }\n  \n    return results\n  }\n\n  updateCache() {\n    return new Promise((resolve) => {\n      if (!this.isCacheUpdating) {\n        this.isCacheUpdating = true\n        this.request(new URL(this.jwksUri), { method: 'GET' })\n          .then(jwks => {\n            clearTimeout(this.staleTimeoutId)\n            this.staleTimeoutId = setTimeout(this.onCacheStale.bind(this), this.cacheMaxAge)\n            this.clearCacheKeepUnknown()\n            const keys = this.extractKeysFromJwks(jwks.keys)\n            for (const key of keys) {\n              this.setKey(key.kid, key.publicKey)\n            }\n            \n            this.isCacheUpdating = false\n            this.emit('cacheUpdate', this.cache)\n            resolve(true)\n          })\n          .catch(error => {\n            this.isCacheUpdating = false\n            this.emit('cacheError', error)\n            resolve(false)\n          })\n      }\n      else { // an update is already in progress\n        logger.writeDebug('jwksCache', 'updateCache', { message: 'update already in progress' })\n        this.once('cacheUpdate', () => {\n          logger.writeDebug('jwksCache', 'cacheUpdate', { message: 'concurrent update event' })\n          resolve(true)\n        })\n        this.once('cacheError', () => {\n          logger.writeDebug('jwksCache', 'cacheError', { message: 'concurrent update event' })\n          resolve(false)\n        })\n      }\n    })\n  }\n}\n\nmodule.exports = JWKSCache"
  },
  {
    "path": "api/source/utils/klona.js",
    "content": "module.exports = function klona(val) {\n  // MIT License\n  // Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)\n  // https://github.com/lukeed/klona\n\n  let k, out, tmp\n\n  if (Array.isArray(val)) {\n    out = Array(k = val.length)\n    while (k--) out[k] = (tmp = val[k]) && typeof tmp === 'object' ? klona(tmp) : tmp\n    return out\n  }\n\n  if (Object.prototype.toString.call(val) === '[object Object]') {\n    out = {} // null\n    for (k in val) {\n      if (k === '__proto__') {\n        Object.defineProperty(out, k, {\n          value: klona(val[k]),\n          configurable: true,\n          enumerable: true,\n          writable: true,\n        })\n      } else {\n        out[k] = (tmp = val[k]) && typeof tmp === 'object' ? klona(tmp) : tmp\n      }\n    }\n    return out\n  }\n\n  return val\n}"
  },
  {
    "path": "api/source/utils/log-schema.json",
    "content": "{\n  \"$schema\": \"https://json-schema.org/draft-07/schema\",\n  \"$id\": \"http://yourdomain.com/schemas/myschema.json\",\n  \"type\": \"object\",\n  \"properties\": {\n    \"date\": {\n      \"type\": \"string\",\n      \"format\": \"date-time\"\n    },\n    \"level\": {\n      \"type\": \"integer\",\n      \"minimum\": 1,\n      \"maximum\": 4\n    },\n    \"component\": {\n      \"type\": \"string\"\n    },\n    \"type\": {\n      \"type\": \"string\"\n    },\n    \"data\": {\n      \"type\": \"object\"\n    }\n  },\n  \"required\": [\n    \"date\",\n    \"level\",\n    \"component\",\n    \"type\",\n    \"data\"\n  ],\n  \"additionalProperties\": false,\n  \"oneOf\": [\n    {\n      \"$ref\": \"#/$defs/componentIndex\"\n    },\n    {\n      \"$ref\": \"#/$defs/componentOidc\"\n    }\n  ],\n  \"$defs\": {\n    \"componentIndex\": {\n      \"properties\": {\n        \"component\": {\n          \"type\": \"string\",\n          \"const\": \"index\"\n        }\n      },\n      \"oneOf\": [\n        {\n          \"$ref\": \"#/$defs/typeStarting\"\n        },\n        {\n          \"$ref\": \"#/$defs/typeConfiguration\"\n        },\n        {\n          \"$ref\": \"#/$defs/typeStarted\"\n        }\n      ]\n    },\n    \"typeStarting\": {\n      \"properties\": {\n        \"type\": {\n          \"type\": \"string\",\n          \"const\": \"starting\"\n        },\n        \"data\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"version\": {\n              \"type\": \"string\"\n            }\n          },\n          \"additionalProperties\": false\n        }\n      }\n    },\n    \"typeConfiguration\": {\n      \"properties\": {\n        \"type\": {\n          \"type\": \"string\",\n          \"const\": \"configuration\"\n        },\n        \"data\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"version\": {\n              \"type\": \"string\"\n            },\n            \"commit\": {\n              \"type\": \"object\",\n              \"required\": [],\n              \"properties\": {\n                \"branch\": {\n                  \"type\": \"string\"\n                },\n                \"sha\": {\n                  \"type\": \"string\"\n                },\n                \"tag\": {\n                  \"type\": \"string\"\n                },\n                \"describe\": {\n                  \"type\": \"string\"\n                }\n              },\n              \"additionalProperties\": false\n            },\n            \"settings\": {\n              \"type\": \"object\",\n              \"required\": [],\n              \"properties\": {\n                \"setClassification\": {\n                  \"type\": \"string\"\n                },\n                \"lastAccessResolution\": {\n                  \"type\": \"integer\"\n                },\n                \"responseValidation\": {\n                  \"type\": \"string\"\n                }\n              },\n              \"additionalProperties\": false\n            },\n            \"client\": {\n              \"type\": \"object\",\n              \"required\": [],\n              \"properties\": {\n                \"clientId\": {\n                  \"type\": \"string\"\n                },\n                \"displayAppManagers\": {\n                  \"type\": \"boolean\"\n                },\n                \"authority\": {\n                  \"type\": \"string\"\n                },\n                \"apiBase\": {\n                  \"type\": \"string\"\n                },\n                \"disabled\": {\n                  \"type\": \"boolean\"\n                },\n                \"directory\": {\n                  \"type\": \"string\"\n                },\n                \"refreshToken\": {\n                  \"type\": \"object\",\n                  \"required\": [],\n                  \"properties\": {\n                    \"disabled\": {\n                      \"type\": \"boolean\"\n                    }\n                  },\n                  \"additionalProperties\": false\n                },\n                \"welcome\": {\n                  \"type\": \"object\",\n                  \"required\": [],\n                  \"properties\": {\n                    \"image\": {\n                      \"type\": \"string\"\n                    },\n                    \"message\": {\n                      \"type\": \"string\"\n                    },\n                    \"title\": {\n                      \"type\": \"string\"\n                    },\n                    \"link\": {\n                      \"type\": \"string\"\n                    }\n                  },\n                  \"additionalProperties\": false\n                }\n              },\n              \"additionalProperties\": false\n            },\n            \"docs\": {\n              \"type\": \"object\",\n              \"required\": [],\n              \"properties\": {\n                \"disabled\": {\n                  \"type\": \"boolean\"\n                },\n                \"docsDirectory\": {\n                  \"type\": \"string\"\n                }\n              },\n              \"additionalProperties\": false\n            },\n            \"http\": {\n              \"type\": \"object\",\n              \"required\": [],\n              \"properties\": {\n                \"address\": {\n                  \"type\": \"string\"\n                },\n                \"port\": {\n                  \"type\": \"string\"\n                },\n                \"maxJsonBody\": {\n                  \"type\": \"string\"\n                },\n                \"maxUpload\": {\n                  \"type\": \"string\"\n                }\n              },\n              \"additionalProperties\": false\n            },\n            \"database\": {\n              \"type\": \"object\",\n              \"required\": [],\n              \"properties\": {\n                \"type\": {\n                  \"type\": \"string\"\n                },\n                \"host\": {\n                  \"type\": \"string\"\n                },\n                \"port\": {\n                  \"type\": \"string\"\n                },\n                \"schema\": {\n                  \"type\": \"string\"\n                },\n                \"username\": {\n                  \"type\": \"string\"\n                },\n                \"maxConnections\": {\n                  \"type\": \"string\"\n                },\n                \"tls\": {\n                  \"type\": \"object\",\n                  \"required\": [],\n                  \"additionalProperties\": false\n                },\n                \"revert\": {\n                  \"type\": \"boolean\"\n                },\n                \"password\": {\n                  \"type\": \"boolean\"\n                }\n              },\n              \"additionalProperties\": false\n            },\n            \"init\": {\n              \"type\": \"object\",\n              \"required\": [],\n              \"properties\": {\n                \"importStigs\": {\n                  \"type\": \"boolean\"\n                },\n                \"importScap\": {\n                  \"type\": \"boolean\"\n                }\n              },\n              \"additionalProperties\": false\n            },\n            \"swaggerUi\": {\n              \"type\": \"object\",\n              \"required\": [],\n              \"properties\": {\n                \"enabled\": {\n                  \"type\": \"boolean\"\n                },\n                \"authority\": {\n                  \"type\": \"string\"\n                },\n                \"server\": {\n                  \"type\": \"string\"\n                },\n                \"oauth2RedirectUrl\": {\n                  \"type\": \"string\"\n                }\n              },\n              \"additionalProperties\": false\n            },\n            \"oauth\": {\n              \"type\": \"object\",\n              \"required\": [],\n              \"properties\": {\n                \"authority\": {\n                  \"type\": \"string\"\n                },\n                \"claims\": {\n                  \"type\": \"object\",\n                  \"required\": [],\n                  \"properties\": {\n                    \"scope\": {\n                      \"type\": \"string\"\n                    },\n                    \"scopeFormat\": {\n                      \"type\": \"string\"\n                    },\n                    \"username\": {\n                      \"type\": \"string\"\n                    },\n                    \"servicename\": {\n                      \"type\": \"string\"\n                    },\n                    \"name\": {\n                      \"type\": \"string\"\n                    },\n                    \"privileges\": {\n                      \"type\": \"string\"\n                    },\n                    \"email\": {\n                      \"type\": \"string\"\n                    }\n                  },\n                  \"additionalProperties\": false\n                }\n              },\n              \"additionalProperties\": false\n            },\n            \"log\": {\n              \"type\": \"object\",\n              \"required\": [],\n              \"properties\": {\n                \"level\": {\n                  \"type\": \"integer\"\n                },\n                \"mode\": {\n                  \"type\": \"string\"\n                }\n              },\n              \"additionalProperties\": false\n            }\n          },\n          \"additionalProperties\": false\n        }\n      }\n    },\n    \"typeStarted\": {\n      \"properties\": {\n        \"type\": {\n          \"type\": \"string\",\n          \"const\": \"started\"\n        },\n        \"data\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"durationS\": {\n              \"type\": \"number\"\n            },\n            \"port\": {\n              \"type\": \"string\"\n            },\n            \"api\": {\n              \"type\": \"string\"\n            },\n            \"client\": {\n              \"type\": \"string\"\n            },\n            \"documentation\": {\n              \"type\": \"string\"\n            },\n            \"swagger\": {\n              \"type\": \"string\"\n            }\n          },\n          \"additionalProperties\": false\n        }\n      }\n    },\n    \"componentOidc\": {\n      \"properties\": {\n        \"component\": {\n          \"type\": \"string\",\n          \"const\": \"oidc\"\n        }\n      },\n      \"oneOf\": [\n        {\n          \"$ref\": \"#/$defs/typeDiscovery\"\n        }\n      ]\n    },\n    \"typeDiscovery\": {\n      \"properties\": {\n        \"type\": {\n          \"type\": \"string\",\n          \"const\": \"discovery\"\n        },\n        \"data\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"success\": {\n              \"type\": \"boolean\"\n            },\n            \"url\": {\n              \"type\": \"string\"\n            }\n          }\n        },\n        \"additionalProperties\": false\n      }\n    }\n  }\n}"
  },
  {
    "path": "api/source/utils/logSocket.js",
    "content": "const { randomUUID } = require('node:crypto')\nconst logger = require('./logger')\nconst WebSocket = require('ws')\nconst component = 'logSocket'\nconst auth = require('./auth')\nconst SmError = require('./error')\nconst asyncApiValidator = require('./asyncApiValidator')\n\nconst socketPath = '/socket/log-socket'\n\nclass LogSession {\n  constructor(ws, validator) {\n    this.ws = ws;\n    this.validator = validator;\n    this.authorized = false;\n    this.tokenExp = null;\n    this.logForwarding = false;\n    this.sessionId = randomUUID();\n    this.filter = null;\n    this.pingIntervalId = null\n    this.unauthorizedTimerId = null\n    this.unauthorizedTimeoutMs = 10000\n    this.pingIntervalMs = 30000\n  }\n\n  start = () => {\n    logger.writeInfo(component, 'session-start', { sessionId: this.sessionId, message: 'Session started' });\n    this.ws.on('message', this.onSocketMessage);\n    this.ws.on('close', this.stop);\n    this.ws.on('pong', this.onSocketPong);\n    this.startHeartbeat();\n    this.sendUnauthorized();\n  }\n\n  stop = () => {\n    this.sendClose('Session ending');\n    this.disableLogForwarding();\n    this.stopHeartbeat();\n\n    this.ws.off('message', this.onSocketMessage);\n    this.ws.off('close', this.stop);\n    this.ws.off('pong', this.onSocketPong);\n\n    if (this.tokenTimer) clearTimeout(this.tokenTimer);\n    if (this.unauthorizedTimerId) {\n      clearTimeout(this.unauthorizedTimerId);\n      this.unauthorizedTimerId = null;\n    }\n\n    this.ws.close();\n    logger.writeInfo(component, 'session-stop', { sessionId: this.sessionId, message: 'Session stopped' });\n  }\n\n  enableLogForwarding = () => {\n    if (!this.logForwarding) {\n      logger.loggerEvents.on('log', this.loggerEventHandler);\n      this.logForwarding = true;\n    }\n  }\n\n  disableLogForwarding = () => {\n    if (this.logForwarding) {\n      logger.loggerEvents.off('log', this.loggerEventHandler);\n      this.logForwarding = false;\n    }\n  }\n\n  includeLogRecord = (logObj) => {\n    if (!this.filter) return true;\n    return Object.entries(this.filter).every(([key, value]) => {\n      return logObj[key] && value.includes(logObj[key]);\n    });\n  }\n\n  loggerEventHandler = (logObj) => {\n    if (this.authorized && this.includeLogRecord(logObj)) {\n      this.sendLog(logObj);\n    }\n  }\n  startHeartbeat = () => {\n    this.stopHeartbeat();\n    this.pingIntervalId = setInterval(this.sendPing, this.pingIntervalMs);\n  }\n\n  stopHeartbeat = () => {\n    if (this.pingIntervalId) {\n      clearInterval(this.pingIntervalId);\n      this.pingIntervalId = null;\n    }\n  }\n\n  sendPing = () => {\n    try {\n      this.ws.ping();\n      logger.writeInfo(component, 'ping-sent', { sessionId: this.sessionId });\n    } catch {\n      // Ignore ping errors\n    }\n  }\n\n  onSocketPong = () => {\n    // Pong received, connection is alive\n    logger.writeInfo(component, 'pong-received', { sessionId: this.sessionId });\n  }\n\n  onSocketMessage = (message) => {\n    let msgObj;\n    try {\n      msgObj = JSON.parse(message);\n    } catch {\n      this.sendError('Invalid JSON message');\n      return;\n    }\n    try {\n      this.validator.validate(msgObj.type, msgObj, 'logStream', 'receive');\n    }\n    catch (e) {\n      this.sendError('Message validation failed: ' + e.message);\n      return;\n    }\n      if (msgObj.type === 'authorize' && (typeof msgObj.data?.token === 'string')) {\n        const loggedMessage = this.deepClone(msgObj);\n        loggedMessage.data.token = this.decodeToken(msgObj.data.token) || loggedMessage.data.token;\n        logger.writeInfo(component, 'message-receive', { sessionId: this.sessionId, ...loggedMessage });\n      } else {\n        logger.writeInfo(component, 'message-receive', { sessionId: this.sessionId, ...msgObj });\n      }\n    switch (msgObj.type) {\n      case 'authorize':\n        this.onAuthorize(msgObj.data);\n        break;\n      case 'command':\n        if (this.authorized) {\n          this.onCommand(msgObj.data);\n        }\n        break;\n      default:\n        this.sendError('Unexpected message type');\n    }\n  }\n\n  deepClone = (msg) => {\n    return JSON.parse(JSON.stringify(msg));\n  }\n\n\n  onCommand = (commandData) => {\n    switch (commandData.command) {\n      case 'stream-start':\n        this.filter = commandData.filter;\n        this.enableLogForwarding();\n        break;\n      case 'stream-stop':\n        this.disableLogForwarding();\n        break;\n      default:\n        this.sendError('Unknown command');\n    }\n    this.sendInfo({ success: true, command: commandData });\n  }\n\n  onAuthorize = async (authData) => {\n    // Validate token (format and expiration)\n    try {\n      // Accept JWTs: decode and check exp\n      const decoded = auth.decodeToken(authData.token);\n      \n      // Mock a bad token for testing\n      // decoded.header.kid = 'xxx-bad-kid-xxx';\n\n      auth.checkInsecureKid(decoded);\n      const signingKey = await auth.getSigningKey(decoded);\n      auth.verifyToken(authData.token, signingKey);\n      const privileges = auth.getClaimByPath(decoded.payload);\n      if (!privileges.includes('admin')) {\n        throw new SmError.PrivilegeError();\n      }\n\n      // successful authorization\n      clearTimeout(this.unauthorizedTimerId);\n      this.unauthorizedTimerId = null;\n\n      this.tokenExp = decoded.payload.exp;\n      this.startTokenTimer();\n\n      this.authorized = true;\n      this.sendAuthorized();\n    } catch (e) {\n      this.authorized = false;\n      this.disableLogForwarding();\n      logger.writeWarn(component, 'authorize-failed', { sessionId: this.sessionId, message: e.message });\n      this.sendUnauthorized('Authorization failed: ' + e.detail || e.message);\n      return;\n    }\n  }\n\n  startTokenTimer = () => {\n    if (this.tokenTimer) clearTimeout(this.tokenTimer);\n    if (!this.tokenExp) return;\n    const now = Math.floor(Date.now() / 1000);\n    const ms = Math.max(0, (this.tokenExp - now) * 1000);\n    this.tokenTimer = setTimeout(() => {\n      this.authorized = false;\n      this.disableLogForwarding();\n      this.sendUnauthorized('jwt expired');\n    }, ms);\n  }\n\n  decodeToken = (token) => {\n    try {\n      const parts = token.split('.');\n      if (parts.length !== 3) throw new Error('Invalid JWT format');\n      const decoded = JSON.parse(Buffer.from(parts[1], 'base64').toString('utf8'));\n      return decoded;\n    } \n    catch {\n      return null;\n    }\n  }\n  \n  sendUnauthorized = (reason) => {\n    this.send({ type: 'authorize', data: { state: 'unauthorized', reason } });\n    if (!this.unauthorizedTimerId) {\n      this.unauthorizedTimerId = setTimeout(() => {\n        this.stop();\n      }, this.unauthorizedTimeoutMs); // Set a maximum time to be unauthorized\n    }\n  }\n\n  sendAuthorized = () => {\n    this.send({ type: 'authorize', data: { state: 'authorized' } });\n  }\n\n  sendClose = (message = 'Closing connection') => {\n    this.send({ type: 'close', data: message});\n  }\n\n  sendInfo = (info) => {\n    this.send({ type: 'info', data: info });\n  }\n\n  sendError = (error) => {\n    this.send({ type: 'error', data: error });\n  }\n\n  sendLog = (logObj) => {\n    this.send({ type: 'log', data: logObj });\n  }\n\n  send = (msg) => {\n    try {\n      this.validator.validate(msg.type, msg, 'logStream', 'send');\n    } catch (e) {\n      logger.writeError(component, 'message-validation-failed', { sessionId: this.sessionId, message: msg, error: e.message });\n    }\n    this.ws.send(JSON.stringify(msg));\n    if (msg.type !== 'log') {\n      const loggerFn = msg.type === 'error' ? logger.writeError : logger.writeInfo;\n      loggerFn(component, 'message-send', { sessionId: this.sessionId, ...msg });\n    }\n  }\n\n}\n\nasync function setupLogSocket (server, schemaPath) {\n  const validator = asyncApiValidator.fromSource(schemaPath)\n  const wss = new WebSocket.Server({ server, path: socketPath })\n  wss.on('connection', (ws) => onConnection(ws, validator))\n}\n\n\nfunction onConnection (ws, validator) {\n  const clientAddr = `${ws._socket.remoteAddress}:${ws._socket.remotePort}`;\n  const logSession = new LogSession(ws, validator);\n  logger.writeInfo(component, 'connection', {source: clientAddr, sessionId: logSession.sessionId, message: 'New log socket connection'});\n  logSession.start();\n}\n\n\nmodule.exports = { setupLogSocket }"
  },
  {
    "path": "api/source/utils/logger.js",
    "content": "\nconst { randomUUID } = require('node:crypto')\nconst onFinished = require('on-finished')\nconst onHeaders = require('on-headers')\nconst config = require('./config')\nconst EventEmitter = require('node:events')\n\nconst loggerEvents = new EventEmitter()\n\n// Ensure no other code will write to the console\nconst _log = console.log\nfor (const method of ['log', 'error', 'warn', 'trace', 'debug']) {\n  console[method] = function () {\n    writeError('logger', 'consoleIntercept', { method, arguments })\n  }\n}\n\n// Setup noops for logger methods > config.log.level\nconst writeDebug = config.log.level == 4 ? function writeDebug () {\n  write(4, ...arguments)\n} : () => {}\n\nconst writeInfo = config.log.level >= 3 ? function writeInfo () {\n  write(3, ...arguments)\n} : () => {}\n\nconst writeWarn = config.log.level >= 2 ? function writeWarn () {\n  write(2, ...arguments)\n} : () => {}\n\nconst writeError = config.log.level >= 1 ? function writeError () {\n  write(1, ...arguments)\n} : () => {}\n\n// Stats for all requests\nconst requestStats = {\n  totalRequests: 0,\n  totalApiRequests: 0,\n  totalRequestDuration: 0,\n  operationIds: {}\n}\n\n// All messages to STDOUT are handled here\nasync function write (level, component, type, data) {\n  try {\n    const date = new Date().toISOString()\n    const logObj = {date, level, component, type, data}\n    _log(JSON.stringify(logObj))\n    loggerEvents.emit('log', logObj)\n  }\n  catch (e) {\n    const date = new Date().toISOString()\n    const errorObj = {date, level:1, component:'logger', type:'error', data: { message: e.message, stack: e.stack}}\n    _log(JSON.stringify(errorObj))\n    loggerEvents.emit('log', errorObj)\n  }\n}\n\n// Base64 decoding\nconst atob = (data) => Buffer.from(data, 'base64').toString('ascii')\n\nfunction sanitizeHeaders () {\n  let {authorization, ...headers} = this\n  if (authorization !== undefined) {\n    headers.authorization = true\n    if (config.log.mode !== 'combined') {\n      const payload = authorization.match(/^Bearer [[A-Za-z0-9-_=]+\\.([[A-Za-z0-9-_=]+?)\\./)?.[1]\n      if (payload) {\n        headers.accessToken = JSON.parse(atob(payload))\n      } \n    }\n  }\n  else {\n    headers.authorization = false\n  }\n  return headers\n}\n\nfunction serializeRequest (req) {\n  req.headers.toJSON = sanitizeHeaders\n  if (config.log.mode === 'combined') {\n    req.headers.accessToken = req.access_token\n  }\n  return {\n    requestId: req.requestId,\n    date: req._startTime,\n    source: req.ip,\n    // claims: req.userObject ? serializeUserObject(req.userObject) : undefined,\n    method: req.method,\n    url: req.originalUrl,\n    headers: req.headers,\n    body: req.query.elevate === true ||  req.query.elevate === 'true' || config.log.level === 4 ? req.body : undefined\n  }\n}\n\nfunction recordStartTime () {\n  this._startTime = new Date()\n}\n\nfunction requestLogger (req, res, next) {\n\n  req._startAt = undefined\n  req._startTime = undefined\n  res._startAt = undefined\n  res._startTime = undefined\n  res.svcStatus = {}\n  req.requestId = randomUUID()\n  \n  // Response body length for appinfo and content for privileged requests\n  let responseBody\n  responseBody = ''\n  if (req.query.elevate) {\n    const originalSend = res.send\n    res.send = function (chunk) {\n      if (chunk !== undefined) {\n        responseBody += chunk\n      }\n      originalSend.apply(res, arguments)\n    }\n  }\n\n  // record request start\n  recordStartTime.call(req)\n\n  function logRequest () {\n    if (req.originalUrl.startsWith('/api')) {\n      req.component = 'rest'\n    } else {\n      req.component = 'static'\n    }\n    writeInfo(req.component, 'request', serializeRequest(req))\n  }\n\n  function logResponse () {\n    res._startTime = res._startTime ?? new Date()\n    requestStats.totalRequests += 1\n    const durationMs = Number(res._startTime - req._startTime)\n\n    requestStats.totalRequestDuration += durationMs\n    const operationId = res.req.openapi?.schema.operationId\n    let operationStats = {\n      operationId,\n      retries: res.svcStatus?.retries,\n      durationMs\n    }\n\n    //if operationId is defined, this is an api endpoint response so we can track some stats\n    if (operationId ) {\n      trackOperationStats(operationId, durationMs, res)\n      // If including stats in log entries, add to operationStats object\n      if (config.log.optStats) {\n        operationStats = {\n          ...operationStats,\n          ...requestStats.operationIds[operationId]\n        }\n      }\n    }    \n\n    if (config.log.mode === 'combined') {\n      writeInfo(req.component || 'rest', 'transaction', {\n        request: serializeRequest(res.req),\n        response: {\n          date: res._startTime,\n          status: res.finished ? res.statusCode : undefined,\n          clientTerminated: res.destroyed ? true : undefined,\n          headers: res.finished ? res.getHeaders() : undefined,\n          errorBody: res.errorBody,\n          responseBody,\n        },\n        operationStats\n      })  \n    }\n    else {\n      writeInfo(req.component || 'rest', 'response', {\n        requestId: res.req.requestId,\n        status: res.statusCode,\n        headers: res.getHeaders(),\n        errorBody: res.errorBody,\n        responseBody,\n        operationStats\n      })  \n    }\n  }\n\n  if (config.log.mode !== 'combined') {\n    logRequest()\n  }\n  onHeaders(res, recordStartTime)\n  onFinished(res, logResponse)\n  next()\n}\n\nfunction serializeEnvironment () {\n  let env = {}\n  for (const [key, value] of Object.entries(process.env)) {\n    if (/^(NODE|STIGMAN)_/.test(key)) {\n      env[key] = key === 'STIGMAN_DB_PASSWORD' ? '*' : value\n    }\n  }\n  return env\n}\n\nfunction trackOperationStats(operationId, durationMs, res) {\n\n  const acceptsRequestBody = (res.req.method === 'POST' || res.req.method === 'PUT' || res.req.method === 'PATCH')\n\n  //increment total api requests\n  requestStats.totalApiRequests++\n  // Ensure the operationIds object exists for the operationId\n  if (!requestStats.operationIds[operationId]) {\n    requestStats.operationIds[operationId] = {\n      totalRequests: 0,\n      totalDuration: 0,\n      elevatedRequests: 0,\n      minDuration: Infinity,\n      maxDuration: 0,\n      maxDurationUpdates: 0,\n      retried: 0,\n      averageRetries: 0,\n      totalResLength: 0,\n      minResLength: Infinity,\n      maxResLength: 0,\n      clients: {},\n      users: {},\n      errors: {}\n    }\n    if (acceptsRequestBody) {\n      requestStats.operationIds[operationId].totalReqLength = 0\n      requestStats.operationIds[operationId].minReqLength = Infinity\n      requestStats.operationIds[operationId].maxReqLength = 0\n    }\n  }\n\n  // Get the stats object for this operationId\n  const stats = requestStats.operationIds[operationId]\n\n  // errors\n  if (res.statusCode >= 500) {\n    const code = res.errorBody?.code || 'nocode'\n    stats.errors[code] = (stats.errors[code] || 0) + 1\n  }\n\n  // Update max duration\n  stats.minDuration = Math.min(stats.minDuration, durationMs)\n  if (durationMs > stats.maxDuration) {\n    stats.maxDuration = durationMs\n    stats.maxDurationUpdates++\n  }\n\n  // Increment total requests and total duration for this operationId\n  stats.totalRequests++\n  stats.totalDuration += durationMs\n\n  const responseLength = parseInt(res.getHeader('content-length')) || 0\n  stats.totalResLength += responseLength\n  stats.minResLength = Math.min(stats.minResLength, responseLength)\n  stats.maxResLength = Math.max(stats.maxResLength, responseLength)\n\n  if (acceptsRequestBody) {\n    const requestLength = parseInt(res.req.headers['content-length']) || 0\n    stats.totalReqLength += requestLength\n    stats.minReqLength = Math.min(stats.minReqLength, requestLength)\n    stats.maxReqLength = Math.max(stats.maxReqLength, requestLength)\n  }\n\n  // Update retries\n  if (res.svcStatus?.retries) {\n    stats.retried++\n    stats.averageRetries = runningAverage({\n      currentAvg: stats.averageRetries,\n      counter: stats.retried,\n      newValue: res.svcStatus.retries\n    })    \n  }\n  // Check token for userid\n  let userId = res.req.userObject?.userId || 'unknown'\n  // Increment user count for this operationId\n  stats.users[userId] = (stats.users[userId] || 0) + 1  \n\n  // Check token for client id\n  let client = res.req.access_token?.azp || 'unknown'\n  // Increment client count for this operationId\n  stats.clients[client] = (stats.clients[client] || 0) + 1\n\n  // Increment elevated request count if elevate query param is true\n  if (res.req.query?.elevate === true) {\n    stats.elevatedRequests = (stats.elevatedRequests || 0) + 1\n  }\n\n  // If projections are defined, track stats for each projection\n  if (res.req.query?.projection?.length > 0) {\n    stats.projections = stats.projections || {}\n    for (const projection of res.req.query.projection) {\n      // Ensure the projection stats object exists\n      stats.projections[projection] = stats.projections[projection] || {\n        totalRequests: 0,\n        minDuration: Infinity,\n        maxDuration: 0,\n        totalDuration: 0,\n        retried: 0,\n        averageRetries: 0,\n        get averageDuration() {\n          return this.totalRequests ? Math.round(this.totalDuration / this.totalRequests) : 0\n        }        \n      }\n\n      const projStats = stats.projections[projection]\n      // Increment projection count and update duration stats\n      projStats.totalRequests++\n      projStats.minDuration = Math.min(projStats.minDuration, durationMs)\n      projStats.maxDuration = Math.max(projStats.maxDuration, durationMs)\n      projStats.totalDuration += durationMs\n      \n      // Update retries\n      if (res.svcStatus?.retries) {\n        projStats.retried++\n        projStats.averageRetries = projStats.averageRetries + (res.svcStatus.retries - projStats.averageRetries) / projStats.retried\n      }\n    }\n  }\n\n  function runningAverage({currentAvg, counter, newValue}) {\n    return currentAvg + (newValue - currentAvg) / counter\n  }\n}\n\nmodule.exports = { \n  requestLogger, \n  sanitizeHeaders, \n  serializeRequest,\n  serializeEnvironment,\n  writeError, \n  writeWarn, \n  writeInfo, \n  writeDebug,\n  requestStats,\n  loggerEvents,\n}\n"
  },
  {
    "path": "api/source/utils/parsers.js",
    "content": "const {XMLParser} = require('fast-xml-parser')\nconst he = require('he')\n\nmodule.exports.benchmarkFromXccdf = function (xccdfData) {\n  \n  try {  \n    const parser = new XMLParser({\n      allowBooleanAttributes: false,\n      attributeNamePrefix: \"\",\n      textNodeName: \"_\",\n      ignoreAttributes: false,\n      removeNSPrefix: true,\n      parseTagValue: false,\n      parseAttributeValue: false,\n      trimValues: true,\n      processEntities: { enabled: true, maxTotalExpansions: 200000 },\n      isArray: (name, jpath, isLeafNode, isAttribute) => !isAttribute,\n      alwaysCreateTextNode: true,\n      tagValueProcessor: (name, value) => he.decode(value)\n    })\n    const j = parser.parse(xccdfData.toString())\n\n    let bIn, isScap=false\n    if (j['data-stream-collection']?.[0]) {\n      // SCAP\n      const components =  j['data-stream-collection'][0].component\n      const candidate = components?.find(component => 'Benchmark' in component)\n      if (candidate?.Benchmark?.[0]) {\n        bIn = candidate.Benchmark[0]\n        isScap = true\n      }\n      else {\n        throw new Error(\"Cannot parse as a DISA SCAP benchmark. No Benchmark element found.\")\n      }\n    }\n    else if (j.Benchmark?.[0]) { \n      // Manual STIG\n      bIn = j.Benchmark[0]\n    }\n    else {\n      throw new Error(\"Cannot parse XML document as STIG or SCAP.\") \n    }\n\n    const groups = bIn.Group.map(group => {\n      const rules = group.Rule.map(rule => {\n        const checks = rule.check ? rule.check.map(check => ({\n            system: check.system,\n            content: isScap? check['check-content-ref']?.[0]?._ : check['check-content']?.[0]?._\n          })) : []\n          const fixes = rule.fixtext ? rule.fixtext.map(fix => ({\n          fixref: fix.fixref,\n          text: fix._\n        })) : []\n        const idents = rule.ident ? rule.ident.map(ident => ({\n          ident: ident._,\n          system: ident.system\n        })) : []\n        // The description element's value is often not well-formed XML, so we fallback on extracting content between expected tags\n        function parseRuleDescription (d) {\n          const parsed = {}\n          const propMap = {\n            vulnDiscussion: 'VulnDiscussion',\n            falsePositives: 'FalsePositives',\n            falseNegatives: 'FalseNegatives',\n            documentable: 'Documentable',\n            mitigations: 'Mitigations',\n            severityOverrideGuidance: 'SeverityOverrideGuidance',\n            potentialImpacts: 'PotentialImpacts',\n            thirdPartyTools: 'ThirdPartyTools',\n            mitigationControl: 'MitigationControl',\n            responsibility: 'Responsibility',\n            iacontrols: 'IAControls'\n          }\n\n          for (const prop in propMap) {\n            const re = new RegExp(`<${propMap[prop]}>([\\\\s\\\\S]*)</${propMap[prop]}>`)\n            const result = re.exec(d)\n            parsed[propMap[prop]] = result && result.length > 1 ? result[1] : null\n          }\n          \n          if (parsed.Responsibility) {\n            parsed.Responsibility = parsed.Responsibility.replace(/<\\/Responsibility><Responsibility>/g, ', ')\n          }\n          return parsed\n        }\n\n        const desc = parseRuleDescription(rule.description?.[0]?._)\n\n        return {\n          ruleId: rule.id,\n          version: rule.version?.[0]._ || null,\n          title: rule.title?.[0]._ || null,\n          severity: rule.severity || null,\n          weight: rule.weight || null,\n          vulnDiscussion: desc.VulnDiscussion || null,\n          falsePositives: desc.FalsePositives || null,\n          falseNegatives: desc.FalseNegatives || null,\n          documentable: desc.Documentable || null,\n          mitigations: desc.Mitigations || null,\n          severityOverrideGuidance: desc.SeverityOverrideGuidance || null,\n          potentialImpacts: desc.PotentialImpacts || null,\n          thirdPartyTools: desc.ThirdPartyTools || null,\n          mitigationControl: desc.MitigationControl || null,\n          responsibility: desc.Responsibility || null,\n          iacontrols: desc.IAControls || null,\n          checks,\n          fixes,\n          idents\n        }\n      })\n\n      return {\n        groupId: group.id,\n        title: group.title[0]._ || null,\n        rules: rules\n      }\n    })\n    const [releaseInfo, release, benchmarkDate] = /Release:\\s+(\\S+)\\s+Benchmark Date:\\s+(.*)/g.exec(bIn['plain-text'][0]._)\n\n    return {\n      benchmarkId: bIn.id,\n      title: bIn.title?.[0]._,\n      scap: isScap,\n      revision: {\n        revisionStr: `V${bIn.version?.[0]._}R${release}`,\n        version: bIn.version?.[0]._,\n        release,\n        releaseInfo,\n        benchmarkDate,\n        benchmarkDate8601: benchmarkDateTo8601(benchmarkDate),\n        status: bIn.status?.[0]._ || null,\n        statusDate: bIn.status?.[0].date || null,\n        description: bIn.description?.[0]._ || null,\n        groups\n      }\n    }\n  }\n  catch (e) {\n    throw (e)\n  }\n\n  function benchmarkDateTo8601(benchmarkDate) {\n    const monthToNum = {\n      'Jan': '01',\n      'January': '01',\n      'Feb': '02',\n      'February': '02',\n      'Mar': '03',\n      'March': '03',\n      'Apr': '04',\n      'April': '04',\n      'May': '05',\n      'Jun': '06',\n      'June': '06',\n      'Jul': '07',\n      'July': '07',\n      'Aug': '08',\n      'August': '08',\n      'Sep': '09',\n      'Sept': '09',\n      'September': '09',\n      'Oct': '10',\n      'October': '10',\n      'Nov': '11',\n      'November': '11',\n      'Dec': '12',\n      'December': '12'\n    };\n    let [day, monStr, year] = benchmarkDate.split(/\\s+/);\n    return `${year}-${monthToNum[monStr]}-${day}`\n  }\n}\n\n  "
  },
  {
    "path": "api/source/utils/roles.js",
    "content": "module.exports.ROLES = { \n    'Restricted': 1,\n    'Full': 2,\n    'Manage': 3,\n    'Owner': 4\n}\n"
  },
  {
    "path": "api/source/utils/serializeError.js",
    "content": "// MIT License\n\n// Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)\n\n// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\n// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n\n'use strict';\n\nclass NonError extends Error {\n\tconstructor(message) {\n\t\tsuper(NonError._prepareSuperMessage(message));\n\t\tObject.defineProperty(this, 'name', {\n\t\t\tvalue: 'NonError',\n\t\t\tconfigurable: true,\n\t\t\twritable: true\n\t\t});\n\n\t\tif (Error.captureStackTrace) {\n\t\t\tError.captureStackTrace(this, NonError);\n\t\t}\n\t}\n\n\tstatic _prepareSuperMessage(message) {\n\t\ttry {\n\t\t\treturn JSON.stringify(message);\n\t\t} catch {\n\t\t\treturn String(message);\n\t\t}\n\t}\n}\n\nconst commonProperties = [\n\t{property: 'name', enumerable: false},\n\t{property: 'message', enumerable: false},\n\t{property: 'stack', enumerable: false},\n\t{property: 'code', enumerable: true}\n];\n\nconst isCalled = Symbol('.toJSON called');\n\nconst toJSON = from => {\n\tfrom[isCalled] = true;\n\tconst json = from.toJSON();\n\tdelete from[isCalled];\n\treturn json;\n};\n\nconst destroyCircular = ({\n\tfrom,\n\tseen,\n\tto_,\n\tforceEnumerable,\n\tmaxDepth,\n\tdepth\n}) => {\n\tconst to = to_ || (Array.isArray(from) ? [] : {});\n\n\tseen.push(from);\n\n\tif (depth >= maxDepth) {\n\t\treturn to;\n\t}\n\n\tif (typeof from.toJSON === 'function' && from[isCalled] !== true) {\n\t\treturn toJSON(from);\n\t}\n\n\tfor (const [key, value] of Object.entries(from)) {\n\t\tif (typeof Buffer === 'function' && Buffer.isBuffer(value)) {\n\t\t\tto[key] = '[object Buffer]';\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (typeof value === 'function') {\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (!value || typeof value !== 'object') {\n\t\t\tto[key] = value;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (!seen.includes(from[key])) {\n\t\t\tdepth++;\n\n\t\t\tto[key] = destroyCircular({\n\t\t\t\tfrom: from[key],\n\t\t\t\tseen: seen.slice(),\n\t\t\t\tforceEnumerable,\n\t\t\t\tmaxDepth,\n\t\t\t\tdepth\n\t\t\t});\n\t\t\tcontinue;\n\t\t}\n\n\t\tto[key] = '[Circular]';\n\t}\n\n\tfor (const {property, enumerable} of commonProperties) {\n\t\tif (typeof from[property] === 'string') {\n\t\t\tObject.defineProperty(to, property, {\n\t\t\t\tvalue: from[property],\n\t\t\t\tenumerable: forceEnumerable ? true : enumerable,\n\t\t\t\tconfigurable: true,\n\t\t\t\twritable: true\n\t\t\t});\n\t\t}\n\t}\n\n\treturn to;\n};\n\nconst serializeError = (value, options = {}) => {\n\tconst {maxDepth = Number.POSITIVE_INFINITY} = options;\n\n\tif (typeof value === 'object' && value !== null) {\n\t\treturn destroyCircular({\n\t\t\tfrom: value,\n\t\t\tseen: [],\n\t\t\tforceEnumerable: true,\n\t\t\tmaxDepth,\n\t\t\tdepth: 0\n\t\t});\n\t}\n\n\t// People sometimes throw things besides Error objects…\n\tif (typeof value === 'function') {\n\t\t// `JSON.stringify()` discards functions. We do too, unless a function is thrown directly.\n\t\treturn `[Function: ${(value.name || 'anonymous')}]`;\n\t}\n\n\treturn value;\n};\n\nconst deserializeError = (value, options = {}) => {\n\tconst {maxDepth = Number.POSITIVE_INFINITY} = options;\n\n\tif (value instanceof Error) {\n\t\treturn value;\n\t}\n\n\tif (typeof value === 'object' && value !== null && !Array.isArray(value)) {\n\t\tconst newError = new Error(); // eslint-disable-line unicorn/error-message\n\t\tdestroyCircular({\n\t\t\tfrom: value,\n\t\t\tseen: [],\n\t\t\tto_: newError,\n\t\t\tmaxDepth,\n\t\t\tdepth: 0\n\t\t});\n\t\treturn newError;\n\t}\n\n\treturn new NonError(value);\n};\n\nmodule.exports = {\n\tserializeError,\n\tdeserializeError\n};"
  },
  {
    "path": "api/source/utils/serializers.js",
    "content": "const {promises: fs} = require('fs')\nconst path = require('path')\nconst XlsxTemplate = require('xlsx-template')\n\nmodule.exports.mccastPoamObjectFromFindings = function (findings, defaults = {}) {\n    const vuln = findings.map( finding => ({\n        authPackage: defaults.mccastAuthName,\n        name: finding.rules[0].title,\n        dateId:  finding.stigs[0].ruleCount === 0 ? finding.stigs[0].benchmarkDate : '',\n        stigInfo: 'STIG Finding',\n        status: defaults.status,\n        packageId: defaults.mccastPackageId,\n        date: defaults.date,\n        startDate: '',\n        endDate: '',\n        securityChecks: finding.rules[0].ruleId || finding.groupId,\n        control: finding.ccis.map( cci => `DoD RMF-${defaults.mccastPackageId}-${cci.apAcronym?.replace(/\\./g,' ')}-CNSSI 1253`).join('\\n'),\n        resultingRisk: finding.severity === 'medium' ? 'Moderate' : `${finding.severity.charAt(0).toUpperCase()}${finding.severity.slice(1)}`,\n        weakness: finding.rules[0].vulnDiscussion,\n        mitigations: '',\n        comments: finding.stigs[0].ruleCount === 0 ? '' : finding.ccis.map( cci => `CCI-${cci.cci}`).join('\\n'),\n        assets: finding.assets.map( asset => asset.name ).join('\\n'),\n        mav: '',\n        mac: '',\n        mpr: '',\n        mui: '',\n        ms: '',\n        mi: '',\n        ma: ''\n    }))\n    return {vuln}\n}\n\nmodule.exports.poamObjectFromFindings = function (findings, defaults = {}) {\n    const vuln = findings.map( finding => ({\n        desc: `Title:\\n${finding.rules[0].title}\\n\\nDescription:\\n${finding.rules[0].vulnDiscussion}`,\n        control: finding.ccis.map( cci => cci.apAcronym).join('\\n'),\n        office: defaults.office,\n        securityChecks: finding.ruleId || finding.groupId,\n        resourcesRequired: '',\n        date: defaults.date,\n        milestone: `Resolve this finding. ${defaults.date}`,\n        milestoneChanges: `Resolve this finding. ${defaults.date}`,\n        stigInfo: finding.stigs.map( stig => \n            `${stig.benchmarkId}\\n${stig.revisionStr}\\nBenchmark Date: ${stig.benchmarkDate}` ).join('\\n\\n'),\n        status: defaults.status,\n        comments: finding.ccis.map( cci => `CCI-${cci.cci}`).join('\\n'),\n        rawSeverity: finding.severity === 'medium' ? 'II' : finding.severity === 'low' ? 'III' : finding.severity === 'high' ? 'I' : 'Mixed',\n        assets: finding.assets.map( asset => asset.name ).join('\\n'),\n        mitigations: '',\n        predisposingConditions: '',\n        severity: finding.severity === 'medium' ? 'Moderate' : `${finding.severity.charAt(0).toUpperCase()}${finding.severity.slice(1)}`, // uppercase first letter\n        threatRelevance: '',\n        threatDescription: '',\n        likelihood: '',\n        impact: '',\n        impactDescription: '',\n        residualRiskLevel: finding.severity === 'medium' ? 'Moderate' : `${finding.severity.charAt(0).toUpperCase()}${finding.severity.slice(1)}`,\n        recommendations: '',\n        resultingRisk: finding.severity === 'medium' ? 'Moderate' : `${finding.severity.charAt(0).toUpperCase()}${finding.severity.slice(1)}`,\n    }))\n    return {vuln}\n}\n\n\nmodule.exports.xlsxFromPoamObject = async function (substitutions, format) {\n    const templateFiles = {\n        EMASS: 'poam-template.xlsx',\n        MCCAST: 'poam-template-mccast.xlsx'\n    }\n    const templateData = await fs.readFile(path.join(__dirname, templateFiles[format]))\n    const template = new XlsxTemplate()\n    await template.loadTemplate(templateData)\n    await template.substitute(1, substitutions)\n    return await template.generate({type: 'nodebuffer'})\n}"
  },
  {
    "path": "api/source/utils/state.js",
    "content": "const EventEmitter = require('events')\nconst logger = require('./logger')\n\n/**\n * Represents the state of the API.\n * @typedef {'starting' | 'fail' | 'available' | 'unavailable' | 'stop'} StateString\n */\n\n/**\n * @typedef {Object} DependencyStatus\n * @property {boolean} db - The status of the database dependency.\n * @property {boolean} oidc - The status of the OIDC dependency.\n */\n\n/**\n * Class representing the state of the API.\n * @extends EventEmitter\n */\nclass State extends EventEmitter {\n  /** @type {StateString} */\n  #currentState\n  \n  /** @type {StateString} */\n  #previousState\n  \n  /** @type {Date} */\n  #stateDate\n\n  /** @type {DependencyStatus} */\n  #dependencyStatus\n\n  /** @type {Object} */\n  #dbPool\n\n  /** @type {Object} */\n  #endpoints\n\n  /** @type {Number} */\n  #changeTimeoutId\n\n\n  /**\n   * Creates an instance of State.\n   * @param {Object} options - Options for initializing the state.\n   * @param {StateString} [options.initialState='starting'] - The initial state of the API.\n   */\n  constructor({ \n    initialState = 'starting', \n    endpoints = { \n      ui: { \n        current: '/', \n        next: '' \n      } \n    } \n  } = {}) {\n    super()\n    this.#currentState = initialState\n    this.#stateDate = new Date()\n    this.#dependencyStatus = {\n      db: false,\n      oidc: false\n    }\n    this.#endpoints = endpoints\n  }\n\n  /**\n   * Emits 'state-changed', passing the previous and current state and dependency status.\n   * @private\n   */\n  #emitStateChangedEvent() {\n    this.emit('state-changed', this.#currentState, this.#previousState, this.#dependencyStatus)\n  }\n\n  #emitDependencyChangeEvent() {\n    this.emit('dependency-changed', this.#dependencyStatus)\n  }\n\n  /**\n   * Sets the state based on the dependency status.\n   * @private\n   */\n  #setStateFromDependencyStatus() {\n    if (this.#dependencyStatus.db && this.#dependencyStatus.oidc) {\n      this.setState('available')\n    }\n    else {\n      this.setState(this.#currentState === 'starting' ? 'starting' : 'unavailable')\n    }\n  }\n\n  /**\n   * Sets the state to the provided state and emits state-changed event.\n   * @param {StateString} state - The new state.\n   */\n  setState(state) {\n    if (this.#currentState === state) return\n    this.#previousState = this.#currentState\n    this.#currentState = state\n    this.#stateDate = new Date()\n    this.#emitStateChangedEvent()\n  }\n\n  /**\n   * Sets the status of the database dependency.\n   * @param {boolean} status - The new status of the database dependency.\n   */\n  setDbStatus(status) {\n    if (this.#dependencyStatus.db === status) return\n    this.#dependencyStatus.db = status\n    this.#emitDependencyChangeEvent()\n    this.#setStateFromDependencyStatus()\n  }\n\n  /**\n   * Sets the status of the OIDC dependency.\n   * @param {boolean} status - The new status of the OIDC dependency.\n   */\n  setOidcStatus(status) {\n    if (this.#dependencyStatus.oidc === status) return\n    this.#dependencyStatus.oidc = status\n    this.#emitDependencyChangeEvent()\n    this.#setStateFromDependencyStatus()\n  }\n\n  /**\n   * Gets the current state.\n   * @type {StateString}\n   * @readonly\n   */\n  get currentState() {\n    return this.#currentState\n  }\n\n  /**\n   * Gets the dependency status.\n   * @type {DependencyStatus}\n   * @readonly\n   */\n  get dependencyStatus() {\n    return {...this.#dependencyStatus}\n  }\n\n  /**\n   * Sets the database pool.\n   * @param {Object} pool - The new database pool.\n   */\n  set dbPool(pool) {\n    this.#dbPool = pool\n  }\n\n  /**\n   * Gets the database pool.\n   * @type {Object}\n   * @readonly\n   */\n  get dbPool() {\n    return this.#dbPool\n  }\n\n  /**\n   * Gets the API state.\n   * @type {Object}\n   * @readonly\n   */\n  get apiState() {\n    return {\n      currentState: this.#currentState,\n      since: this.#stateDate,\n      dependencies: this.#dependencyStatus,\n      endpoints: this.#endpoints,\n    }\n  }\n}\n\nconst state = new State()\nstate.on('state-changed', async (currentState, previousState, dependencyStatus) => {\n  logger.writeInfo('state','state-changed', {currentState, previousState, dependencyStatus})\n  let exitCode = 0\n  switch (currentState) {\n    case 'fail':\n      exitCode = 1\n      logger.writeError('state','fail', {message:'Application failed', exitCode})\n      process.exit(exitCode)\n      break\n    case 'stop':\n      try {\n        await state.dbPool?.end()\n      }\n      catch (err) {\n        logger.writeError('state','stop', {message:'Error closing database pool', error: serializeError(err)})\n      } \n      logger.writeInfo('state','stop', {message:'Application stopped', exitCode})\n      process.exit(exitCode)\n      break\n  }\n})\n\nmodule.exports = state"
  },
  {
    "path": "api/source/utils/writer.js",
    "content": "const escape = require ('./escape.js')\nlet ResponsePayload = function(code, payload) {\n  this.code = code;\n  this.payload = payload;\n}\n\nexports.respondWithCode = function(code, payload) {\n  return new ResponsePayload(code, payload);\n}\n\nlet writeJson = exports.writeJson = function(response, arg1, arg2) {\n  let code;\n  let payload;\n\n  if(arg1 && arg1 instanceof ResponsePayload) {\n    writeJson(response, arg1.payload, arg1.code);\n    return;\n  }\n\n  if(arg2 && Number.isInteger(arg2)) {\n    code = arg2;\n  }\n  else {\n    if(arg1 && Number.isInteger(arg1)) {\n      code = arg1;\n    }\n  }\n  if(code && arg1) {\n    payload = arg1;\n  }\n  else if(arg1) {\n    payload = arg1;\n  }\n\n  if(!code) {\n    // if no response code given, we default to 200\n    code = 200;\n  }\n  if (typeof payload == 'undefined') {\n    code = 204\n  }\n  if (payload instanceof Error) {\n    payload = JSON.stringify(payload, Object.getOwnPropertyNames(payload), 2);\n    code = 500\n  }\n  else {\n    payload = JSON.stringify(payload);\n  }\n  response.writeHead(code, {\n    'Content-Type': 'application/json',\n    'Cache-control': 'no-store'\n  });\n  response.end(payload);\n}\n\nexports.writeInlineFile = function(response, payload, filename, contentType) {\n  response.writeHead(200, {\n    'Content-Type': contentType,\n    'Content-Disposition': `inline; filename=\"${escape.escapeFilename(filename)}\"`,\n    'Access-Control-Expose-Headers': 'Content-Disposition'\n  })\n  response.write(payload)\n  response.end()\n}\n\nexports.writeWithContentType = function(response, {payload, status = \"200\", contentType = \"application/json\"}) {\n  response.writeHead(status, {\n    'Content-Type': contentType\n  })\n  response.end(payload)\n}\n\nexports.writeNoContent = function (response) {\n  response.writeHead(204)\n  response.end()\n}\n\n\n\n"
  },
  {
    "path": "api/source/utils/xlsx-template-js-zip-upgrade/LICENSE",
    "content": "Copyright (c) 2013-2018 Martin Aspeli, 2018-2020 Andrii Kurdiumov\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n"
  },
  {
    "path": "api/source/utils/xlsx-template-js-zip-upgrade/README.md",
    "content": "# XLSX Template\n\n[![Build status](https://api.travis-ci.org/optilude/xlsx-template.png?branch=master)](http://travis-ci.org/optilude/xlsx-template)\n\nThis module provides a means of generating \"real\" Excel reports (i.e. not CSV\nfiles) in NodeJS applications.\n\nThe basic principle is this: You create a template in Excel. This can be\nformatted as you wish, contain formulae etc. In this file, you put placeholders\nusing a specific syntax (see below). In code, you build a map of placeholders\nto values and then load the template, substitute the placeholders for the\nrelevant values, and generate a new .xlsx file that you can then serve to the\nuser.\n\n## Placeholders\n\nPlaceholders are inserted in cells in a spreadsheet. It does not matter how\nthose cells are formatted, so e.g. it is OK to insert a placeholder (which is\ntext content) into a cell formatted as a number or currecy or date, if you\nexpect the placeholder to resolve to a number or currency or date.\n\n### Scalars\n\nSimple placholders take the format `${name}`. Here, `name` is the name of a\nkey in the placeholders map. The value of this placholder here should be a\nscalar, i.e. not an array or object. The placeholder may appear on its own in a\ncell, or as part of a text string. For example:\n\n    | Extracted on: | ${extractDate} |\n\nmight result in (depending on date formatting in the second cell):\n\n    | Extracted on: | Jun-01-2013 |\n\nHere, `extractDate` may be a date and the second cell may be formatted as a\nnumber.\n\nInside scalars there possibility to use array indexers. \nFor example: \n\nGiven data\n\n    var template = { extractDates: [\"Jun-01-2113\", \"Jun-01-2013\" ]}\n\nwhich will be applied to following template\n\n    | Extracted on: | ${extractDates[0]} |\n\nwill results in the \n\n    | Extracted on: | Jun-01-2113 |\n\n### Columns\n\nYou can use arrays as placeholder values to indicate that the placeholder cell\nis to be replicated across columns. In this case, the placeholder cannot appear\ninside a text string - it must be the only thing in its cell. For example,\nif the placehodler value `dates` is an array of dates:\n\n    | ${dates} |\n\nmight result in:\n\n    | Jun-01-2013 | Jun-02-2013 | Jun-03-2013 |\n\n### Tables\n\nFinally, you can build tables made up of multiple rows. In this case, each\nplaceholder should be prefixed by `table:` and contain both the name of the\nplaceholder variable (a list of objects) and a key (in each object in the list).\nFor example:\n\n    | Name                 | Age                 |\n    | ${table:people.name} | ${table:people.age} |\n\nIf the replacement value under `people` is an array of objects, and each of\nthose objects have keys `name` and `age`, you may end up with something like:\n\n    | Name        | Age |\n    | John Smith  | 20  |\n    | Bob Johnson | 22  |\n\nIf a particular value is an array, then it will be repeated across columns as\nabove.\n\n## Generating reports\n\nTo make this magic happen, you need some code like this:\n\n```\n    var XlsxTemplate = require('xlsx-template');\n\n    // Load an XLSX file into memory\n    fs.readFile(path.join(__dirname, 'templates', 'template1.xlsx'), async function(err, data) {\n\n        // Create a template\n        var template = new XlsxTemplate();\n        await template.loadTemplate(data);\n\n        // Replacements take place on first sheet\n        var sheetNumber = 1;\n\n        // Set up some placeholder values matching the placeholders in the template\n        var values = {\n                extractDate: new Date(),\n                dates: [ new Date(\"2013-06-01\"), new Date(\"2013-06-02\"), new Date(\"2013-06-03\") ],\n                people: [\n                    {name: \"John Smith\", age: 20},\n                    {name: \"Bob Johnson\", age: 22}\n                ]\n            };\n\n        // Perform substitution\n        await template.substitute(sheetNumber, values);\n\n        // Get binary data\n        var data = await template.generate();\n\n        // ...\n\n    });\n```\n\nAt this stage, `data` is a string blob representing the compressed archive that\nis the `.xlsx` file (that's right, a `.xlsx` file is a zip file of XML files,\nif you didn't know). You can send this back to a client, store it to disk,\nattach it to an email or do whatever you want with it.\n\nYou can pass options to `generate()` to set a different return type. use\n`{type: 'uint8array'}` to generate a `Uint8Array`, `arraybuffer`, `blob`,\n`nodebuffer` to generate an `ArrayBuffer`, `Blob` or `nodebuffer`, or\n`base64` to generate a base64-encoded string.\n\n## Caveats\n\n* The spreadsheet must be saved in `.xlsx` format. `.xls`, `.xlsb` or `.xlsm`\n  won't work.\n* Column (array) and table (array-of-objects) insertions cause rows and cells to\n  be inserted or removed. When this happens, only a limited number of\n  adjustments are made:\n    * Merged cells and named cells/ranges to the right of cells where insertions\n      or deletions are made are moved right or left, appropriately. This may\n      not work well if cells are merged across rows, unless all rows have the\n      same number of insertions.\n    * Merged cells, named tables or named cells/ranges below rows where further\n      rows are inserted are moved down.\n  Formulae are not adjusted.\n* As a corollary to this, it is not always easy to build formulae that refer\n  to cells in a table (e.g. summing all rows) where the exact number of rows\n  or columns is not known in advance. There are two strategies for dealing\n  with this:\n    * Put the table as the last (or only) thing on a particular sheet, and\n      use a formula that includes a large number of rows or columns in the\n      hope that the actual table will be smaller than this number.\n    * Use named tables. When a placeholder in a named table causes columns or\n      rows to be added, the table definition (i.e. the cells included in the\n      table) will be updated accordingly. You can then use things like\n      `TableName[ColumnName]` in your formula to refer to all values in a given\n      column in the table as a logical range.\n* Placeholders only work in simple cells and tables, pivot tables or\n  other such things.\n\n## Changelog\n\n### Version 0.2.0\n\n* Add ability copy and delete sheets.\n\n### Version 0.0.7\n\n* Fix bug with calculating <dimensions /> when adding columns\n\n### Version 0.0.6\n\n* You can now pass `options` to `generate()`, which are passed to JSZip\n* Fix setting of sheet <dimensions /> when growing the sheet\n* Fix corruption of sheet when writing dates\n* Fix corruption of sheet when calculating calcChain\n\n### Version 0.0.5\n\n* Mysterious\n\n### Version 0.0.4\n\nMerged pending pull requests\n\n* Deletion of the sheets.\n\n### Version 0.0.3\n\nMerged a number of overdue pull requests, including:\n\n* Windows support\n* Support for table footers\n* Documentation improvements\n\n### Version 0.0.2\n\n* Fix a potential issue with the typing of string indices that could cause the\n  first string to not render correctly if it contained a substitution.\n\n### Version 0.0.1\n\n* Initial release\n"
  },
  {
    "path": "api/source/utils/xlsx-template-js-zip-upgrade/lib/index.d.ts",
    "content": "import * as etree from \"elementtree\";\nimport * as JSZip from \"jszip\";\n\nexport interface TemplatePlaceholder{\n    type: string;\n    string?: string;\n    full: boolean;\n    name: string;\n    key: string;\n    placeholder?: string\n}\n\nexport interface NamedTable{\n    filename: string;\n    root: etree.Element;\n}\n\nexport default class Workbook\n{\n\n    protected readonly sharedStrings: string[];\n    protected readonly workbook: etree.ElementTree;\n    protected readonly archive: JSZip;\n    protected readonly workbookPath: string;\n    protected readonly calcChainPath?: string;\n\n    constructor(data? : Buffer);\n    public deleteSheet(sheetName : string) : this;\n    public copySheet(sheetName : string, copyName : string) : this;\n    public loadTemplate(data : Buffer) : void;\n    public substitute(sheetName : string | number, substitutions : Object) : void;\n    public generate<T extends Buffer | Uint8Array | Blob | string | ArrayBuffer>(options? : GenerateOptions) : T;\n\n    // need typing properly\n    protected _rebuild() : void;\n    protected writeSharedStrings() : void;\n    protected addSharedString(s : any) : any; // I think s is a string? Not sure what its return \"idx\" is though, I think it's a number? Is \"idx\" short for \"index\"?\n    protected stringIndex(s : any) : any; // returns idx\n    protected replaceString(oldString : string, newString : string) : any; // returns idx\n    protected loadSheets(prefix : any, workbook : etree.ElementTree, workbookRels : any) : any[];\n    protected loadSheet(sheet : any) : { filename : any, name : any, id : any, root : any }; // this could definitely return a \"Sheet\" interface/class\n    protected loadTables(sheet : any, sheetFilename : any) : any;\n    protected writeTables(tables : any) : void;\n    protected substituteHyperlinks(sheetFilename : any, substitutions : any) : void;\n    protected substituteTableColumnHeaders(tables : any, substitutions : any) : void;\n    protected extractPlaceholders(string : any) : any[];\n    protected splitRef(ref : any) : { table : any, colAbsolute : any, col : any, rowAbsolute : any, row : any }\n    protected joinRef(ref : any) : string;\n    protected nextCol(ref : any) : string; \n    protected nextRow(ref : any) : string\n    protected charToNum(str : string) : number;\n    protected numToChar(num : number) : string;\n    protected isRange(ref : any) : boolean;\n    protected isWithin(ref : any, startRef : any, endRef : any) : boolean;\n    protected stringify(value : any) : string;\n    protected insertCellValue(cell : any, substitution : any) : string;\n    protected substituteScalar(cell : any, string: string, placeholder: TemplatePlaceholder, substitution: any);\n    protected substituteArray(cells : any[], cell : any, substitution : any);\n    protected substituteTable(row : any, newTableRows : any, cells : any[], cell : any, namedTables : any, substitution : any, key : any) : any;\n    protected cloneElement(element : any, deep? : any) : any;\n    protected replaceChildren(parent : any, children : any) : void;\n    protected getCurrentRow(row : any, rowsInserted : any) : number;\n    protected getCurrentCell(cell : any, currentRow : any, cellsInserted : any) : string;\n    protected updateRowSpan(row : any, cellsInserted : any) : any;\n    protected splitRange(range : string) : any;\n    protected joinRange(range : any) : string\n    protected pushRight(workbook : etree.ElementTree, sheet : any, currentCell : any, numCols : any) : any;\n    protected pushDown(workbook : etree.ElementTree, sheets : any, tables : any, currentRow : any, numRows : any) : any;\n}\n\nexport interface GenerateOptions\n{\n    type : \"uint8array\" | \"arraybuffer\" | \"blob\" | \"nodebuffer\" | \"base64\";\n}\n"
  },
  {
    "path": "api/source/utils/xlsx-template-js-zip-upgrade/lib/index.js",
    "content": "/*jshint globalstrict:true, devel:true */\n/*eslint no-var:0 */\n/*global require, module, Buffer */\n\"use strict\";\n\nvar path  = require('path'),\n    JSZip   = require('jszip'),\n    etree = require('elementtree');\n\nmodule.exports = (function() {\n\n    var DOCUMENT_RELATIONSHIP = \"http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument\",\n        CALC_CHAIN_RELATIONSHIP = \"http://schemas.openxmlformats.org/officeDocument/2006/relationships/calcChain\",\n        SHARED_STRINGS_RELATIONSHIP = \"http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings\",\n        HYPERLINK_RELATIONSHIP = \"http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink\";\n\n    /**\n     * Create a new workbook. and call `loadTemplate` later.\n     */\n    var Workbook = function() {\n        var self = this;\n        self.archive = null;\n        self.sharedStrings = [];\n        self.sharedStringsLookup = {};\n    };\n\n    var _get_simple = function (obj, desc) {\n        if (desc.indexOf(\"[\") >=0 ) {\n            var specification = desc.split(/[[[\\]]/);\n            var property = specification[0];\n            var index = specification[1];\n            return obj[property][index];\n        }\n\n        return obj[desc];\n    }\n\n    /**\n     * Based on http://stackoverflow.com/questions/8051975\n     * Mimic https://lodash.com/docs#get\n     */\n    var _get = function(obj, desc, defaultValue) {\n        var arr = desc.split('.');\n        try {\n            while (arr.length) {\n                obj = _get_simple(obj, arr.shift());\n            }\n        } catch(ex) {\n            /* invalid chain */\n            obj = undefined;\n        }\n        return obj === undefined ? defaultValue : obj;\n    }\n\n    /**\n    * Delete unused sheets if needed\n    */\n    Workbook.prototype.deleteSheet = function(sheetName){\n      var self = this;\n      var sheet = self.loadSheet(sheetName);\n\n      var sh = self.workbook.find(\"sheets/sheet[@sheetId='\" + sheet.id + \"']\");\n      self.workbook.find(\"sheets\").remove(sh);\n\n      var rel = self.workbookRels.find(\"Relationship[@Id='\" + sh.attrib['r:id'] + \"']\");\n      self.workbookRels.remove(rel);\n\n      self._rebuild();\n      return self\n    };\n\n    /**\n    * Clone sheets in current workbook template\n    */\n    Workbook.prototype.copySheet = function(sheetName, copyName){\n      var self = this;\n      var sheet = self.loadSheet(sheetName); //filename, name , id, root\n      var newSheetIndex = (self.workbook.findall(\"sheets/sheet\").length+1).toString();\n      var fileName = 'worksheets' + '/' + 'sheet' + newSheetIndex + '.xml';\n      var arcName = self.prefix + '/' + fileName;\n\n      self.archive.file(arcName, etree.tostring(sheet.root) );\n      self.archive.files[arcName].options.binary = true;\n\n      var newSheet = etree.SubElement( self.workbook.find('sheets'), 'sheet' );\n      newSheet.attrib.name = copyName || 'Sheet' + newSheetIndex;\n      newSheet.attrib.sheetId = newSheetIndex;\n      newSheet.attrib['r:id'] = 'rId' + newSheetIndex;\n\n      var newRel = etree.SubElement(self.workbookRels, 'Relationship');\n      newRel.attrib.Type = 'http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet';\n      newRel.attrib.Target = fileName;\n\n      self._rebuild();\n//    TODO: work with \"definedNames\"\n//    var defn = etree.SubElement(self.workbook.find('definedNames'), 'definedName');\n//\n      return self\n    };\n\n\n    /**\n    *  Partially rebuild after copy/delete sheets\n    */\n    Workbook.prototype._rebuild = function(){\n    //each <sheet> 'r:id' attribute in '\\xl\\workbook.xml'\n    //must point to correct <Relationship> 'Id' in xl\\_rels\\workbook.xml.rels\n      var self = this;\n      var order = ['worksheet', 'theme', 'styles','sharedStrings'];\n\n      self.workbookRels.findall(\"*\")\n      .sort(function(rel1, rel2){ //using order\n        var index1 = order.indexOf( path.basename(rel1.attrib.Type) );\n        var index2 = order.indexOf( path.basename(rel2.attrib.Type) );\n        if ((index1 + index2) == 0) {\n            if(rel1.attrib.Id && rel2.attrib.Id) return rel1.attrib.Id.substring(3) - rel2.attrib.Id.substring(3);\n          return rel1._id - rel2._id;\n        }\n        return index1 - index2\n      })\n      .forEach(function(item, index) {\n        item.attrib.Id = 'rId' + (index+1);\n      })\n\n      self.workbook.findall(\"sheets/sheet\").forEach(function(item, index) {\n        item.attrib['r:id'] = 'rId' + (index+1);\n        item.attrib.sheetId = (index+1).toString();\n      })\n\n      self.archive.file(self.prefix + '/' + '_rels' + '/' + path.basename(self.workbookPath) + '.rels', etree.tostring(self.workbookRels));\n      self.archive.file(self.workbookPath, etree.tostring(self.workbook));\n      self.sheets = self.loadSheets(self.prefix, self.workbook, self.workbookRels);\n    }\n\n\n    /**\n     * Load a .xlsx file from a byte array.\n     */\n    Workbook.prototype.loadTemplate = async function(data) {\n        var self = this;\n\n        if(Buffer.isBuffer(data)) {\n            data = data.toString('binary');\n        }\n\n        self.archive = await new JSZip.loadAsync(data, {base64: false, checkCRC32: true});\n\n        // Load relationships\n        var rels = etree.parse(await self.archive.file(\"_rels/.rels\").async(\"string\")).getroot(),\n            workbookPath = rels.find(\"Relationship[@Type='\" + DOCUMENT_RELATIONSHIP + \"']\").attrib.Target;\n\n        self.workbookPath = workbookPath;\n        self.prefix       = path.dirname(workbookPath);\n        self.workbook     = etree.parse(await self.archive.file(workbookPath).async(\"string\")).getroot();\n        self.workbookRels = etree.parse(await self.archive.file(self.prefix + \"/\" + '_rels' + \"/\" + path.basename(workbookPath) + '.rels').async(\"string\")).getroot();\n        self.sheets       = self.loadSheets(self.prefix, self.workbook, self.workbookRels);\n        self.calChainRel  = self.workbookRels.find(\"Relationship[@Type='\" + CALC_CHAIN_RELATIONSHIP + \"']\")\n\n        if (self.calChainRel) {\n          self.calcChainPath = self.prefix + \"/\" + self.calChainRel.attrib.Target;\n        }\n\n        self.sharedStringsPath = self.prefix + \"/\" + self.workbookRels.find(\"Relationship[@Type='\" + SHARED_STRINGS_RELATIONSHIP + \"']\").attrib.Target;\n        self.sharedStrings = [];\n        etree.parse(await self.archive.file(self.sharedStringsPath).async(\"string\")).getroot().findall('si').forEach(function(si) {\n            var t = {text:''};\n            si.findall('t').forEach(function(tmp){\n                t.text += tmp.text;\n            });\n            si.findall('r/t').forEach(function(tmp){\n                t.text += tmp.text;\n            });\n            self.sharedStrings.push(t.text);\n            self.sharedStringsLookup[t.text] = self.sharedStrings.length - 1;\n        });\n    };\n\n    /**\n     * Interpolate values for the sheet with the given number (1-based) or\n     * name (if a string) using the given substitutions (an object).\n     */\n    Workbook.prototype.substitute = async function(sheetName, substitutions) {\n        var self = this;\n\n        var sheet = await self.loadSheet(sheetName);\n\n        var dimension = sheet.root.find(\"dimension\"),\n            sheetData = sheet.root.find(\"sheetData\"),\n            currentRow = null,\n            totalRowsInserted = 0,\n            totalColumnsInserted = 0,\n            namedTables = await self.loadTables(sheet.root, sheet.filename),\n            rows = [];\n\n        sheetData.findall(\"row\").forEach(function(row) {\n            row.attrib.r = currentRow = self.getCurrentRow(row, totalRowsInserted);\n            rows.push(row);\n\n            var cells = [],\n                cellsInserted = 0,\n                newTableRows = [];\n\n            row.findall(\"c\").forEach(function(cell) {\n                var appendCell = true;\n                cell.attrib.r = self.getCurrentCell(cell, currentRow, cellsInserted);\n\n                // If c[@t=\"s\"] (string column), look up /c/v@text as integer in\n                // `this.sharedStrings`\n                if(cell.attrib.t === \"s\") {\n\n                    // Look for a shared string that may contain placeholders\n                    var cellValue   = cell.find(\"v\"),\n                        stringIndex = parseInt(cellValue.text, 10),\n                        string      = self.sharedStrings[stringIndex];\n\n                    if(string === undefined) {\n                        return;\n                    }\n\n                    // Loop over placeholders\n                    self.extractPlaceholders(string).forEach(function(placeholder) {\n\n                        // Only substitute things for which we have a substitution\n                        var substitution = _get(substitutions, placeholder.name, ''),\n                            newCellsInserted = 0;\n\n                        if(placeholder.full && placeholder.type === \"table\" && substitution instanceof Array) {\n                            newCellsInserted = self.substituteTable(\n                                row, newTableRows,\n                                cells, cell,\n                                namedTables, substitution, placeholder.key\n                            );\n\n                            // don't double-insert cells\n                            // this applies to arrays only, incorrectly applies to object arrays when there a single row, thus not rendering single row\n                            if (newCellsInserted !== 0 || substitution.length) {\n                                if (substitution.length === 1) {\n                                    appendCell = true;\n                                }\n                                if (substitution[0][placeholder.key] instanceof Array) {\n                                    appendCell = false;\n                                }\n                            }\n\n                            // Did we insert new columns (array values)?\n                            if(newCellsInserted !== 0) {\n                                cellsInserted += newCellsInserted;\n                                self.pushRight(self.workbook, sheet.root, cell.attrib.r, newCellsInserted);\n                            }\n                        } else if(placeholder.full && placeholder.type === \"normal\" && substitution instanceof Array) {\n                            appendCell = false; // don't double-insert cells\n                            newCellsInserted = self.substituteArray(\n                                cells, cell, substitution\n                            );\n\n                            if(newCellsInserted !== 0) {\n                                cellsInserted += newCellsInserted;\n                                self.pushRight(self.workbook, sheet.root, cell.attrib.r, newCellsInserted);\n                            }\n                        } else {\n                            if (placeholder.key) {\n                                substitution = _get(substitutions, placeholder.name + '.' + placeholder.key);\n                            }\n                            string = self.substituteScalar(cell, string, placeholder, substitution);\n                        }\n                    });\n                }\n\n                // if we are inserting columns, we may not want to keep the original cell anymore\n                if(appendCell) {\n                    cells.push(cell);\n                }\n\n            }); // cells loop\n\n            // We may have inserted columns, so re-build the children of the row\n            self.replaceChildren(row, cells);\n\n            // Update row spans attribute\n            if(cellsInserted !== 0) {\n                self.updateRowSpan(row, cellsInserted);\n\n                if(cellsInserted > totalColumnsInserted) {\n                    totalColumnsInserted = cellsInserted;\n                }\n\n            }\n\n            // Add newly inserted rows\n            if(newTableRows.length > 0) {\n                newTableRows.forEach(function(row) {\n                    rows.push(row);\n                    ++totalRowsInserted;\n                });\n                self.pushDown(self.workbook, sheet.root, namedTables, currentRow, newTableRows.length);\n            }\n\n        }); // rows loop\n\n        // We may have inserted rows, so re-build the children of the sheetData\n        self.replaceChildren(sheetData, rows);\n\n        // Update placeholders in table column headers\n        self.substituteTableColumnHeaders(namedTables, substitutions);\n\n        // Update placeholders in hyperlinks\n        await self.substituteHyperlinks(sheet.filename, substitutions);\n\n        // Update <dimension /> if we added rows or columns\n        if(dimension) {\n            if(totalRowsInserted > 0 || totalColumnsInserted > 0) {\n                var dimensionRange = self.splitRange(dimension.attrib.ref),\n                    dimensionEndRef = self.splitRef(dimensionRange.end);\n\n                dimensionEndRef.row += totalRowsInserted;\n                dimensionEndRef.col = self.numToChar(self.charToNum(dimensionEndRef.col) + totalColumnsInserted);\n                dimensionRange.end = self.joinRef(dimensionEndRef);\n\n                dimension.attrib.ref = self.joinRange(dimensionRange);\n            }\n        }\n\n       //Here we are forcing the values in formulas to be recalculated\n      // existing as well as just substituted\n        sheetData.findall(\"row\").forEach(function(row) {\n          row.findall(\"c\").forEach(function(cell) {\n            var formulas = cell.findall('f');\n            if (formulas && formulas.length > 0) {\n              cell.findall('v').forEach(function(v){\n                cell.remove(v);\n              });\n            }\n          })\n        })\n\n        // Write back the modified XML trees\n        self.archive.file(sheet.filename, etree.tostring(sheet.root));\n        self.archive.file(self.workbookPath, etree.tostring(self.workbook));\n\n        // Remove calc chain - Excel will re-build, and we may have moved some formulae\n        if(self.calcChainPath && self.archive.file(self.calcChainPath)) {\n            self.archive.remove(self.calcChainPath);\n        }\n\n        await self.writeSharedStrings();\n        self.writeTables(namedTables);\n    };\n\n    /**\n     * Generate a new binary .xlsx file\n     */\n    Workbook.prototype.generate = async function(options) {\n        var self = this;\n\n        if(!options) {\n            options = {\n                type: \"binarystring\"\n            }\n        }\n\n        return await self.archive.generateAsync(options);\n    };\n\n    // Helpers\n\n    // Write back the new shared strings list\n    Workbook.prototype.writeSharedStrings = async function() {\n        var self = this;\n\n        var root = etree.parse(await self.archive.file(self.sharedStringsPath).async(\"string\")).getroot(),\n            children = root.getchildren();\n\n        root.delSlice(0, children.length);\n\n        self.sharedStrings.forEach(function(string) {\n            var si = new etree.Element(\"si\"),\n                t  = new etree.Element(\"t\");\n\n            t.text = string;\n            si.append(t);\n            root.append(si);\n        });\n\n        root.attrib.count = self.sharedStrings.length;\n        root.attrib.uniqueCount = self.sharedStrings.length;\n\n        self.archive.file(self.sharedStringsPath, etree.tostring(root));\n    };\n\n    // Add a new shared string\n    Workbook.prototype.addSharedString = function(s) {\n        var self = this;\n\n        var idx = self.sharedStrings.length;\n        self.sharedStrings.push(s);\n        self.sharedStringsLookup[s] = idx;\n\n        return idx;\n    };\n\n    // Get the number of a shared string, adding a new one if necessary.\n    Workbook.prototype.stringIndex = function(s) {\n        var self = this;\n\n        var idx = self.sharedStringsLookup[s];\n        if(idx === undefined) {\n            idx = self.addSharedString(s);\n        }\n        return idx;\n    };\n\n    // Replace a shared string with a new one at the same index. Return the\n    // index.\n    Workbook.prototype.replaceString = function(oldString, newString) {\n        var self = this;\n\n        var idx = self.sharedStringsLookup[oldString];\n        if(idx === undefined) {\n            idx = self.addSharedString(newString);\n        } else {\n            self.sharedStrings[idx] = newString;\n            delete self.sharedStringsLookup[oldString];\n            self.sharedStringsLookup[newString] = idx;\n        }\n\n        return idx;\n    };\n\n    // Get a list of sheet ids, names and filenames\n    Workbook.prototype.loadSheets = function(prefix, workbook, workbookRels) {\n        var sheets = [];\n\n        workbook.findall(\"sheets/sheet\").forEach(function(sheet) {\n            var sheetId      = sheet.attrib.sheetId,\n                relId        = sheet.attrib['r:id'],\n                relationship = workbookRels.find(\"Relationship[@Id='\" + relId + \"']\"),\n                filename     = prefix + \"/\" + relationship.attrib.Target;\n\n            sheets.push({\n                id: parseInt(sheetId, 10),\n                name: sheet.attrib.name,\n                filename: filename\n            });\n        });\n\n        return sheets;\n    };\n\n    // Get sheet a sheet, including filename and name\n    Workbook.prototype.loadSheet = async function(sheet) {\n        var self = this;\n\n        var info = null;\n\n        for(var i = 0; i < self.sheets.length; ++i) {\n            if((typeof(sheet) === \"number\" && self.sheets[i].id === sheet) || (self.sheets[i].name === sheet))  {\n                info = self.sheets[i];\n                break;\n            }\n        }\n\n        if(info === null && (typeof(sheet) === \"number\")){\n            //Get the sheet that corresponds to the 0 based index if the id does not work\n            info = self.sheets[sheet - 1];\n        }\n\n        if(info === null) {\n            throw new Error(\"Sheet \" + sheet + \" not found\");\n        }\n\n        return {\n            filename: info.filename,\n            name: info.name,\n            id: info.id,\n            root: etree.parse(await self.archive.file(info.filename).async(\"string\")).getroot()\n        };\n    };\n\n    // Load tables for a given sheet\n    Workbook.prototype.loadTables = async function(sheet, sheetFilename) {\n        var self = this;\n\n        var sheetDirectory = path.dirname(sheetFilename),\n            sheetName      = path.basename(sheetFilename),\n            relsFilename   = sheetDirectory + \"/\" + '_rels' + \"/\" + sheetName + '.rels',\n            relsFile       = self.archive.file(relsFilename),\n            tables         = []; // [{filename: ..., root: ....}]\n\n        if(relsFile === null) {\n            return tables;\n        }\n\n        var rels = etree.parse(await relsFile.async(\"string\")).getroot();\n\n        for(let tablePart of sheet.findall(\"tableParts/tablePart\")) {\n            var relationshipId = tablePart.attrib['r:id'],\n                target         = rels.find(\"Relationship[@Id='\" + relationshipId + \"']\").attrib.Target,\n                tableFilename  = target.replace('..', self.prefix),\n                tableTree      = etree.parse(await self.archive.file(tableFilename).async(\"string\"));\n\n            tables.push({\n                filename: tableFilename,\n                root: tableTree.getroot()\n            });\n        }\n\n        return tables;\n    };\n\n    // Write back possibly-modified tables\n    Workbook.prototype.writeTables = function(tables) {\n        var self = this;\n\n        tables.forEach(function(namedTable) {\n            self.archive.file(namedTable.filename, etree.tostring(namedTable.root));\n        });\n    };\n\n    //Perform substitution in hyperlinks\n    Workbook.prototype.substituteHyperlinks = async function(sheetFilename, substitutions) {\n      let self = this;\n      const sheetDirectory = path.dirname(sheetFilename),\n        sheetName      = path.basename(sheetFilename),\n        relsFilename   = sheetDirectory + \"/\" + '_rels' + \"/\" + sheetName + '.rels',\n        relsFile       = self.archive.file(relsFilename);\n\n      etree.parse(await self.archive.file(self.sharedStringsPath).async(\"string\")).getroot();\n\n      if(relsFile === null) {\n        return;\n      }\n\n      const rels = etree.parse(await relsFile.async(\"string\")).getroot();\n\n      const relationships = rels._children;\n\n      const newRelationships = [];\n\n      relationships.forEach(function(relationship){\n        newRelationships.push(relationship);\n\n        if(relationship.attrib.Type === HYPERLINK_RELATIONSHIP) {\n\n          let target = relationship.attrib.Target;\n\n          //Double-decode due to excel double encoding url placeholders\n          target = decodeURI(decodeURI(target));\n          self.extractPlaceholders(target).forEach(function (placeholder) {\n              const substitution = substitutions[placeholder.name];\n\n              if (substitution === undefined) {\n                return;\n              }\n              target = target.replace(placeholder.placeholder, self.stringify(substitution));\n\n              relationship.attrib.Target = encodeURI(target);\n            }\n          );\n        }\n      });\n\n      self.replaceChildren(rels, newRelationships);\n\n      self.archive.file(relsFilename, etree.tostring(rels));\n    };\n\n    // Perform substitution in table headers\n    Workbook.prototype.substituteTableColumnHeaders = function(tables, substitutions) {\n        var self = this;\n\n        tables.forEach(function(table) {\n            var root = table.root,\n                columns = root.find(\"tableColumns\"),\n                autoFilter = root.find(\"autoFilter\"),\n                tableRange = self.splitRange(root.attrib.ref),\n                idx = 0,\n                inserted = 0,\n                newColumns = [];\n\n            columns.findall(\"tableColumn\").forEach(function(col) {\n                ++idx;\n                col.attrib.id = Number(idx).toString();\n                newColumns.push(col);\n\n                var name = col.attrib.name;\n\n                self.extractPlaceholders(name).forEach(function(placeholder) {\n                    var substitution = substitutions[placeholder.name];\n                    if(substitution === undefined) {\n                        return;\n                    }\n\n                    // Array -> new columns\n                    if(placeholder.full && placeholder.type === \"normal\" && substitution instanceof Array) {\n                        substitution.forEach(function(element, i) {\n                            var newCol = col;\n                            if(i > 0) {\n                                newCol = self.cloneElement(newCol);\n                                newCol.attrib.id = Number(++idx).toString();\n                                newColumns.push(newCol);\n                                ++inserted;\n                                tableRange.end = self.nextCol(tableRange.end);\n                            }\n                            newCol.attrib.name = self.stringify(element);\n                        });\n                    // Normal placeholder\n                    } else {\n                        name = name.replace(placeholder.placeholder, self.stringify(substitution));\n                        col.attrib.name = name;\n                    }\n                });\n            });\n\n            self.replaceChildren(columns, newColumns);\n\n            // Update range if we inserted columns\n            if(inserted > 0) {\n                columns.attrib.count = Number(idx).toString();\n                root.attrib.ref = self.joinRange(tableRange);\n                if(autoFilter !== null) {\n                    // XXX: This is a simplification that may stomp on some configurations\n                    autoFilter.attrib.ref = self.joinRange(tableRange);\n                }\n            }\n\n            //update ranges for totalsRowCount\n            var tableRoot  = table.root,\n                tableRange = self.splitRange(tableRoot.attrib.ref),\n                tableStart = self.splitRef(tableRange.start),\n                tableEnd   = self.splitRef(tableRange.end);\n\n            if (tableRoot.attrib.totalsRowCount) {\n                var autoFilter = tableRoot.find(\"autoFilter\");\n                if(autoFilter !== null) {\n                    autoFilter.attrib.ref = self.joinRange({\n                        start: self.joinRef(tableStart),\n                        end: self.joinRef(tableEnd),\n                    });\n                }\n\n                ++tableEnd.row;\n                tableRoot.attrib.ref = self.joinRange({\n                    start: self.joinRef(tableStart),\n                    end: self.joinRef(tableEnd),\n                });\n\n            }\n        });\n    };\n\n    // Return a list of tokens that may exist in the string.\n    // Keys are: `placeholder` (the full placeholder, including the `${}`\n    // delineators), `name` (the name part of the token), `key` (the object key\n    // for `table` tokens), `full` (boolean indicating whether this placeholder\n    // is the entirety of the string) and `type` (one of `table` or `cell`)\n    Workbook.prototype.extractPlaceholders = function(string) {\n        // Yes, that's right. It's a bunch of brackets and question marks and stuff.\n        var re = /\\${(?:(.+?):)?(.+?)(?:\\.(.+?))?}/g;\n\n        var match = null, matches = [];\n        while((match = re.exec(string)) !== null) {\n            matches.push({\n                placeholder: match[0],\n                type: match[1] || 'normal',\n                name: match[2],\n                key: match[3],\n                full: match[0].length === string.length\n            });\n        }\n\n        return matches;\n    };\n\n    // Split a reference into an object with keys `row` and `col` and,\n    // optionally, `table`, `rowAbsolute` and `colAbsolute`.\n    Workbook.prototype.splitRef = function(ref) {\n        var match = ref.match(/(?:(.+)!)?(\\$)?([A-Z]+)(\\$)?([0-9]+)/);\n        return {\n            table: match && match[1] || null,\n            colAbsolute: Boolean(match && match[2]),\n            col: match && match[3],\n            rowAbsolute: Boolean(match && match[4]),\n            row: parseInt(match && match[5], 10)\n        };\n    };\n\n    // Join an object with keys `row` and `col` into a single reference string\n    Workbook.prototype.joinRef = function(ref) {\n        return (ref.table?       ref.table + \"!\" : \"\") +\n               (ref.colAbsolute?             \"$\" : \"\") +\n                ref.col.toUpperCase()                 +\n               (ref.rowAbsolute?             \"$\" : \"\" )+\n               Number(ref.row).toString();\n    };\n\n    // Get the next column's cell reference given a reference like \"B2\".\n    Workbook.prototype.nextCol = function(ref) {\n        var self = this;\n        ref = ref.toUpperCase();\n        return ref.replace(/[A-Z]+/, function(match) {\n            return self.numToChar(self.charToNum(match) + 1);\n        });\n    };\n\n    // Get the next row's cell reference given a reference like \"B2\".\n    Workbook.prototype.nextRow = function(ref) {\n        ref = ref.toUpperCase();\n        return ref.replace(/[0-9]+/, function(match) {\n            return (parseInt(match, 10) + 1).toString();\n        });\n    };\n\n    // Turn a reference like \"AA\" into a number like 27\n    Workbook.prototype.charToNum = function(str) {\n        var num = 0;\n        for(var idx = str.length - 1, iteration = 0; idx >= 0; --idx, ++iteration) {\n            var thisChar = str.charCodeAt(idx) - 64, // A -> 1; B -> 2; ... Z->26\n                multiplier = Math.pow(26, iteration);\n            num += multiplier * thisChar;\n        }\n        return num;\n    };\n\n    // Turn a number like 27 into a reference like \"AA\"\n    Workbook.prototype.numToChar = function(num) {\n        var str = \"\";\n\n\n        for(var i = 0; num > 0; ++i) {\n            var remainder = num % 26,\n                charCode = remainder + 64;\n            num = (num - remainder) / 26;\n\n            // Compensate for the fact that we don't represent zero, e.g. A = 1, Z = 26, but AA = 27\n            if(remainder === 0) { // 26 -> Z\n                charCode = 90;\n                --num;\n            }\n\n            str = String.fromCharCode(charCode) + str;\n        }\n\n        return str;\n    };\n\n    // Is ref a range?\n    Workbook.prototype.isRange = function(ref) {\n        return ref.indexOf(':') !== -1;\n    };\n\n    // Is ref inside the table defined by startRef and endRef?\n    Workbook.prototype.isWithin = function(ref, startRef, endRef) {\n        var self = this;\n\n        var start  = self.splitRef(startRef),\n            end    = self.splitRef(endRef),\n            target = self.splitRef(ref);\n\n        start.col  = self.charToNum(start.col);\n        end.col    = self.charToNum(end.col);\n        target.col = self.charToNum(target.col);\n\n        return (\n            start.row <= target.row && target.row <= end.row &&\n            start.col <= target.col && target.col <= end.col\n        );\n\n    };\n\n    // Turn a value of any type into a string\n    Workbook.prototype.stringify = function (value) {\n        if(value instanceof Date) {\n            //In Excel date is a number of days since 01/01/1900\n            //           timestamp in ms    to days      + number of days from 1900 to 1970\n            return Number( (value.getTime()/(1000*60*60*24)) + 25569);\n        } else if(typeof(value) === \"number\" || typeof(value) === \"boolean\") {\n            return Number(value).toString();\n        } else if(typeof(value) === \"string\") {\n            return String(value).toString();\n        }\n\n        return \"\";\n    };\n\n    // Insert a substitution value into a cell (c tag)\n    Workbook.prototype.insertCellValue = function(cell, substitution) {\n        var self = this;\n\n        var cellValue = cell.find(\"v\"),\n            stringified = self.stringify(substitution);\n\n        if (typeof substitution ==='string' && substitution[0] === '='){\n          //substitution, started with '=' is a formula substitution\n          var formula = new etree.Element(\"f\");\n          formula.text = substitution.substr(1);\n          cell.insert(1, formula);\n          delete cell.attrib.t;  //cellValue will be deleted later\n          return formula.text\n        }\n\n        if(typeof(substitution) === \"number\" || substitution instanceof Date) {\n            delete cell.attrib.t;\n            cellValue.text = stringified;\n        } else if(typeof(substitution) === \"boolean\" ) {\n            cell.attrib.t = \"b\";\n            cellValue.text = stringified;\n        } else {\n            cell.attrib.t = \"s\";\n            cellValue.text = Number(self.stringIndex(stringified)).toString();\n        }\n\n        return stringified;\n    };\n\n    // Perform substitution of a single value\n    Workbook.prototype.substituteScalar = function(cell, string, placeholder, substitution) {\n        var self = this;\n\n        if(placeholder.full) {\n            return self.insertCellValue(cell, substitution);\n        } else {\n            var newString = string.replace(placeholder.placeholder, self.stringify(substitution));\n            cell.attrib.t = \"s\";\n            return self.insertCellValue(cell, newString)\n        }\n\n    };\n\n    // Perform a columns substitution from an array\n    Workbook.prototype.substituteArray = function(cells, cell, substitution) {\n        var self = this;\n\n        var newCellsInserted = -1, // we technically delete one before we start adding back\n            currentCell = cell.attrib.r;\n\n            // add a cell for each element in the list\n        substitution.forEach(function(element) {\n            ++newCellsInserted;\n\n            if(newCellsInserted > 0) {\n                currentCell = self.nextCol(currentCell);\n            }\n\n            var newCell = self.cloneElement(cell);\n            self.insertCellValue(newCell, element);\n\n            newCell.attrib.r = currentCell;\n            cells.push(newCell);\n        });\n\n        return newCellsInserted;\n    };\n\n    // Perform a table substitution. May update `newTableRows` and `cells` and change `cell`.\n    // Returns total number of new cells inserted on the original row.\n    Workbook.prototype.substituteTable = function(row, newTableRows, cells, cell, namedTables, substitution, key) {\n        var self = this,\n            newCellsInserted = 0; // on the original row\n\n        // if no elements, blank the cell, but don't delete it\n        if(substitution.length === 0) {\n            delete cell.attrib.t;\n            self.replaceChildren(cell, []);\n        } else {\n\n            var parentTables = namedTables.filter(function(namedTable) {\n                var range = self.splitRange(namedTable.root.attrib.ref);\n                return self.isWithin(cell.attrib.r, range.start, range.end);\n            });\n\n            substitution.forEach(function(element, idx) {\n                var newRow, newCell,\n                    newCellsInsertedOnNewRow = 0,\n                    newCells = [],\n                    value = _get(element, key, '');\n\n                if(idx === 0) { // insert in the row where the placeholders are\n\n                    if(value instanceof Array) {\n                        newCellsInserted = self.substituteArray(cells, cell, value);\n                    } else {\n                        self.insertCellValue(cell, value);\n                    }\n\n                } else { // insert new rows (or reuse rows just inserted)\n\n                    // Do we have an existing row to use? If not, create one.\n                    if((idx - 1) < newTableRows.length) {\n                        newRow = newTableRows[idx - 1];\n                    } else {\n                        newRow = self.cloneElement(row, false);\n                        newRow.attrib.r = self.getCurrentRow(row, newTableRows.length + 1);\n                        newTableRows.push(newRow);\n                    }\n\n                    // Create a new cell\n                    newCell = self.cloneElement(cell);\n                    newCell.attrib.r = self.joinRef({\n                        row: newRow.attrib.r,\n                        col: self.splitRef(newCell.attrib.r).col\n                    });\n\n                    if(value instanceof Array) {\n                        newCellsInsertedOnNewRow = self.substituteArray(newCells, newCell, value);\n\n                        // Add each of the new cells created by substituteArray()\n                        newCells.forEach(function(newCell) {\n                            newRow.append(newCell);\n                        });\n\n                        self.updateRowSpan(newRow, newCellsInsertedOnNewRow);\n                    } else {\n                        self.insertCellValue(newCell, value);\n\n                        // Add the cell that previously held the placeholder\n                        newRow.append(newCell);\n                    }\n\n                    // expand named table range if necessary\n                    parentTables.forEach(function(namedTable) {\n                        var tableRoot = namedTable.root,\n                            autoFilter = tableRoot.find(\"autoFilter\"),\n                            range = self.splitRange(tableRoot.attrib.ref);\n\n                        if(!self.isWithin(newCell.attrib.r, range.start, range.end)) {\n                            range.end = self.nextRow(range.end);\n                            tableRoot.attrib.ref = self.joinRange(range);\n                            if(autoFilter !== null) {\n                                // XXX: This is a simplification that may stomp on some configurations\n                                autoFilter.attrib.ref = tableRoot.attrib.ref;\n                            }\n                        }\n                    });\n                }\n            });\n        }\n\n        return newCellsInserted;\n    };\n\n    // Clone an element. If `deep` is true, recursively clone children\n    Workbook.prototype.cloneElement = function(element, deep) {\n        var self = this;\n\n        var newElement = etree.Element(element.tag, element.attrib);\n        newElement.text = element.text;\n        newElement.tail = element.tail;\n\n        if(deep !== false) {\n            element.getchildren().forEach(function(child) {\n                newElement.append(self.cloneElement(child, deep));\n            });\n        }\n\n        return newElement;\n    };\n\n    // Replace all children of `parent` with the nodes in the list `children`\n    Workbook.prototype.replaceChildren = function(parent, children) {\n        parent.delSlice(0, parent.len());\n        children.forEach(function(child) {\n            parent.append(child);\n        });\n    };\n\n    // Calculate the current row based on a source row and a number of new rows\n    // that have been inserted above\n    Workbook.prototype.getCurrentRow = function(row, rowsInserted) {\n        return parseInt(row.attrib.r, 10) + rowsInserted;\n    };\n\n    // Calculate the current cell based on asource cell, the current row index,\n    // and a number of new cells that have been inserted so far\n    Workbook.prototype.getCurrentCell = function(cell, currentRow, cellsInserted) {\n        var self = this;\n\n        var colRef = self.splitRef(cell.attrib.r).col,\n            colNum = self.charToNum(colRef);\n\n        return self.joinRef({\n            row: currentRow,\n            col: self.numToChar(colNum + cellsInserted)\n        });\n    };\n\n    // Adjust the row `spans` attribute by `cellsInserted`\n    Workbook.prototype.updateRowSpan = function(row, cellsInserted) {\n        if(cellsInserted !== 0 && row.attrib.spans) {\n            var rowSpan = row.attrib.spans.split(':').map(function(f) { return parseInt(f, 10); });\n            rowSpan[1] += cellsInserted;\n            row.attrib.spans = rowSpan.join(\":\");\n        }\n    };\n\n    // Split a range like \"A1:B1\" into {start: \"A1\", end: \"B1\"}\n    Workbook.prototype.splitRange = function(range) {\n        var split = range.split(\":\");\n        return {\n            start: split[0],\n            end: split[1]\n        };\n    };\n\n    // Join into a a range like \"A1:B1\" an object like {start: \"A1\", end: \"B1\"}\n    Workbook.prototype.joinRange = function(range) {\n        return range.start + \":\" + range.end;\n    };\n\n    // Look for any merged cell or named range definitions to the right of\n    // `currentCell` and push right by `numCols`.\n    Workbook.prototype.pushRight = function(workbook, sheet, currentCell, numCols) {\n        var self = this;\n\n        var cellRef = self.splitRef(currentCell),\n            currentRow = cellRef.row,\n            currentCol = self.charToNum(cellRef.col);\n\n        // Update merged cells on the same row, at a higher column\n        sheet.findall(\"mergeCells/mergeCell\").forEach(function(mergeCell) {\n            var mergeRange    = self.splitRange(mergeCell.attrib.ref),\n                mergeStart    = self.splitRef(mergeRange.start),\n                mergeStartCol = self.charToNum(mergeStart.col),\n                mergeEnd      = self.splitRef(mergeRange.end),\n                mergeEndCol   = self.charToNum(mergeEnd.col);\n\n            if(mergeStart.row === currentRow && currentCol < mergeStartCol) {\n                mergeStart.col = self.numToChar(mergeStartCol + numCols);\n                mergeEnd.col = self.numToChar(mergeEndCol + numCols);\n\n                mergeCell.attrib.ref = self.joinRange({\n                    start: self.joinRef(mergeStart),\n                    end: self.joinRef(mergeEnd),\n                });\n            }\n        });\n\n        // Named cells/ranges\n        workbook.findall(\"definedNames/definedName\").forEach(function(name) {\n            var ref = name.text;\n\n            if(self.isRange(ref)) {\n                var namedRange    = self.splitRange(ref),\n                    namedStart    = self.splitRef(namedRange.start),\n                    namedStartCol = self.charToNum(namedStart.col),\n                    namedEnd      = self.splitRef(namedRange.end),\n                    namedEndCol   = self.charToNum(namedEnd.col);\n\n                if(namedStart.row === currentRow && currentCol < namedStartCol) {\n                    namedStart.col = self.numToChar(namedStartCol + numCols);\n                    namedEnd.col = self.numToChar(namedEndCol + numCols);\n\n                    name.text = self.joinRange({\n                        start: self.joinRef(namedStart),\n                        end: self.joinRef(namedEnd),\n                    });\n                }\n            } else {\n                var namedRef = self.splitRef(ref),\n                    namedCol = self.charToNum(namedRef.col);\n\n                if(namedRef.row === currentRow && currentCol < namedCol) {\n                    namedRef.col = self.numToChar(namedCol + numCols);\n\n                    name.text = self.joinRef(namedRef);\n                }\n            }\n\n        });\n    };\n\n    // Look for any merged cell, named table or named range definitions below\n    // `currentRow` and push down by `numRows` (used when rows are inserted).\n    Workbook.prototype.pushDown = function(workbook, sheet, tables, currentRow, numRows) {\n        var self = this;\n\n\tvar mergeCells = sheet.find(\"mergeCells\");\n\n        // Update merged cells below this row\n        sheet.findall(\"mergeCells/mergeCell\").forEach(function(mergeCell) {\n            var mergeRange    = self.splitRange(mergeCell.attrib.ref),\n                mergeStart    = self.splitRef(mergeRange.start),\n                mergeEnd      = self.splitRef(mergeRange.end);\n\n            if(mergeStart.row > currentRow) {\n                mergeStart.row += numRows;\n                mergeEnd.row += numRows;\n\n                mergeCell.attrib.ref = self.joinRange({\n                    start: self.joinRef(mergeStart),\n                    end: self.joinRef(mergeEnd),\n                });\n\n            }\n\n\n\t\t//add new merge cell\n            if (mergeStart.row == currentRow) {\n              for (var i = 1; i <= numRows; i++) {\n                var newMergeCell = self.cloneElement(mergeCell);\n                mergeStart.row += 1;\n                mergeEnd.row += 1;\n                newMergeCell.attrib.ref = self.joinRange({\n                  start: self.joinRef(mergeStart),\n                  end: self.joinRef(mergeEnd)\n                });\n                mergeCells.attrib.count += 1;\n                mergeCells._children.push(newMergeCell);\n              }\n            }\n        });\n\n        // Update named tables below this row\n        tables.forEach(function(table) {\n            var tableRoot  = table.root,\n                tableRange = self.splitRange(tableRoot.attrib.ref),\n                tableStart = self.splitRef(tableRange.start),\n                tableEnd   = self.splitRef(tableRange.end);\n\n\n            if(tableStart.row > currentRow) {\n                tableStart.row += numRows;\n                tableEnd.row += numRows;\n\n                tableRoot.attrib.ref = self.joinRange({\n                    start: self.joinRef(tableStart),\n                    end: self.joinRef(tableEnd),\n                });\n\n                var autoFilter = tableRoot.find(\"autoFilter\");\n                if(autoFilter !== null) {\n                    // XXX: This is a simplification that may stomp on some configurations\n                    autoFilter.attrib.ref = tableRoot.attrib.ref;\n                }\n            }\n        });\n\n        // Named cells/ranges\n        workbook.findall(\"definedNames/definedName\").forEach(function(name) {\n            var ref = name.text;\n\n            if(self.isRange(ref)) {\n                var namedRange    = self.splitRange(ref),\n                    namedStart    = self.splitRef(namedRange.start),\n                    namedEnd      = self.splitRef(namedRange.end);\n\n                if(namedStart){\n                    if(namedStart.row > currentRow) {\n                        namedStart.row += numRows;\n                        namedEnd.row += numRows;\n\n                        name.text = self.joinRange({\n                            start: self.joinRef(namedStart),\n                            end: self.joinRef(namedEnd),\n                        });\n\n                    }\n                }\n            } else {\n                var namedRef = self.splitRef(ref);\n\n                if(namedRef.row > currentRow) {\n                    namedRef.row += numRows;\n                    name.text = self.joinRef(namedRef);\n                }\n            }\n\n        });\n    };\n\n    return Workbook;\n})();\n"
  },
  {
    "path": "api/source/utils/xlsx-template-js-zip-upgrade/package.json",
    "content": "{\n  \"name\": \"xlsx-template\",\n  \"version\": \"1.2.0\",\n  \"description\": \"Generate .xlsx (Excel) files from templates built in Excel\",\n  \"main\": \"./lib/index\",\n  \"files\": [\n    \"lib\"\n  ],\n  \"author\": {\n    \"name\": \"Martin Aspeli\"\n  },\n  \"contributors\": [\n    {\n      \"name\": \"Martin Aspeli\",\n      \"email\": \"optilude@gmail.com\"\n    },\n    {\n      \"name\": \"Andrii Kurdiumov\",\n      \"email\": \"kant2002@gmail.com\"\n    }\n  ],\n  \"license\": \"MIT\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"http://github.com/optilude/xlsx-template.git\"\n  },\n  \"bugs\": {\n    \"url\": \"http://github.com/optilude/xlsx-template/issues\"\n  },\n  \"licenses\": [\n    {\n      \"type\": \"MIT\",\n      \"url\": \"http://github.com/optilude/xlsx-template/raw/master/LICENSE\"\n    }\n  ],\n  \"dependencies\": {\n    \"elementtree\": \"0.1.6\",\n    \"jszip\": \"^3.5.0\"\n  }\n}\n"
  },
  {
    "path": "client/README.md",
    "content": "# STIG Manager Web App\n\n### Running the STIG Manager API and Web App from source\n\nYou must build the web app prior to starting the API. Assuming your shell is at the root of this repository:\n\n```\n$ cd client\n$ ./build.sh\n$ cd ../api/source\n$ npm ci\n$ node index.js\n\n```\n\n### If you wish to develop or modify the web app code\n\nYou must install the required modules. Assuming your shell is at the root of this repository:\n\n```\n$ cd client/src/js/modules\n$ npm ci\n```\n\nand invoke the API with the envar `STIGMAN_CLIENT_DIRECTORY` set to `../../client/src`\n\n```\n$ cd ../api/source\n$ npm ci\n$ STIGMAN_CLIENT_DIRECTORY=../../client/src node index.js\n```\n\n"
  },
  {
    "path": "client/build.sh",
    "content": "#!/bin/bash\n\n# STIG Manager client distribution build script\n#\n# Requires nodejs and npm to install uglify-js\n# npm install -g uglify-js\n#\n# Build artifacts will created in ./dist\n\nset -e\necho \"Client build starting\"\n\n# Change to this script directory\nScriptDir=$(dirname \"$(realpath \"$0\")\") \ncd $ScriptDir\necho \"Changed to $ScriptDir\"\n\n\nSrcDir=src\nDistDir=dist\n\n# Clean dist directory\necho \"Cleaning $DistDir\"\nrm -rf $DistDir/*\n\n# ExtJS\necho \"Preparing ExtJS resources\"\nExtResources=\"ext/adapter/ext/ext-base.js\next/ext-all.js\next/ux/GroupSummary.js\next/resources/css/ext-all.css\next/resources/css/xtheme-gray.css\next/resources/images/default/shadow-c.png\next/resources/images/default/shadow-lr.png\next/resources/images/default/shadow.png\next/resources/images/default/button/arrow.gif\next/resources/images/default/dd/drop-no.gif\next/resources/images/default/grid/loading.gif\next/resources/images/default/grid/hmenu-asc.gif\next/resources/images/default/grid/hmenu-desc.gif\next/resources/images/default/grid/columns.gif\next/resources/images/default/grid/grid-split.gif\next/resources/images/default/grid/grid3-special-col-bg.gif\next/resources/images/default/menu/menu.gif\next/resources/images/default/tree/loading.gif\next/resources/images/gray/button/btn.gif\next/resources/images/gray/button/group-cs.gif\next/resources/images/gray/button/group-tb.gif\next/resources/images/gray/button/group-lr.gif\next/resources/images/gray/form/trigger.gif\next/resources/images/gray/form/clear-trigger.gif\next/resources/images/gray/grid/col-move-bottom.gif\next/resources/images/gray/grid/col-move-top.gif\next/resources/images/gray/grid/grid3-special-col-sel-bg.gif\next/resources/images/gray/grid/sort_asc.gif\next/resources/images/gray/grid/sort_desc.gif\next/resources/images/gray/menu/group-checked.gif\next/resources/images/gray/menu/item-over.gif\next/resources/images/gray/menu/item-over-disabled.gif\next/resources/images/gray/menu/menu-parent.gif\next/resources/images/gray/panel/tool-sprites.gif\next/resources/images/gray/panel/white-top-bottom.gif\next/resources/images/gray/qtip/tip-anchor-sprite.gif\next/resources/images/gray/qtip/tip-sprite.gif\next/resources/images/gray/tabs/tab-close.gif\next/resources/images/gray/tabs/scroll-left.gif\next/resources/images/gray/tabs/scroll-right.gif\next/resources/images/gray/window/icon-question.gif\next/ux/css/LockingGridView.css\next/ux/fileuploadfield/css/fileuploadfield.css\"\ntar cf - -C $SrcDir --files-from <(echo \"${ExtResources}\") | tar xf - -C $DistDir\n\n# CSS\necho \"Preparing CSS resources\"\ncp -r $SrcDir/css $DistDir\n\n# Fonts\necho \"Preparing font resources\"\ncp -r $SrcDir/fonts $DistDir\n\n# Images\necho \"Preparing image resources\"\ncp -r $SrcDir/img $DistDir\n\n# HTML\necho \"Preparing HTML resources\"\ncp $SrcDir/index.html $DistDir/index.html\ncp $SrcDir/reauth.html $DistDir/reauth.html\n\n# Workers\necho \"Preparing Worker resources\"\nmkdir -p $DistDir/js\nmkdir -p $DistDir/js/workers\ncp $SrcDir/js/workers/service-worker.js $DistDir/js/workers/service-worker.js\ncp $SrcDir/js/workers/oidc-worker.js $DistDir/js/workers/oidc-worker.js\ncp $SrcDir/js/workers/state-worker.js $DistDir/js/workers/state-worker.js\n\n# npm\necho \"Preparing npm resources\"\ncd $SrcDir/js/modules\nnpm install\ncd $ScriptDir\n\n# JS\necho \"Preparing JavaScript resources\"\ncp $SrcDir/js/resources-dist.js $DistDir/js/resources.js\ncp $SrcDir/js/init.js $DistDir/js/init.js\ncp $SrcDir/js/Env.js.example $DistDir/js\ncp -r $SrcDir/js/modules $DistDir/js/modules\ncd $SrcDir/js\nuglifyjs \\\n'diff.js' \\\n'diff2html.min.js' \\\n'stigmanUtils.js' \\\n'SM/Global.js' \\\n'SM/StackTrace.js' \\\n'SM/Error.js' \\\n'SM/ActivityHandler.js' \\\n'SM/FlexboxLayout.js' \\\n'BufferView.js' \\\n'SM/EventDispatcher.js' \\\n'SM/Cache.js' \\\n'SM/ServiceWorker.js' \\\n'SM/State.js' \\\n'SM/TipContent.js' \\\n'SM/Ajax.js' \\\n'SM/Classification.js' \\\n'SM/MainPanel.js' \\\n'SM/WhatsNew.js' \\\n'FileUploadField.js' \\\n'MessageBox.js' \\\n'overrides.js' \\\n'RowEditor.js' \\\n'RowExpander.js' \\\n'SM/SelectingGridToolbar.js' \\\n'SM/NavTree.js' \\\n'SM/RowEditorToolbar.js' \\\n'SM/BatchReview.js' \\\n'SM/CollectionClone.js' \\\n'SM/Grant.js' \\\n'SM/Manage.js' \\\n'SM/CollectionPanel.js' \\\n'SM/MetaPanel.js' \\\n'LockingGridView.js' \\\n'SM/ColumnFilters.js' \\\n'SM/FindingsPanel.js' \\\n'SM/Acl.js' \\\n'SM/Attachments.js' \\\n'SM/Exports.js' \\\n'SM/Review.js' \\\n'SM/ReviewsImport.js' \\\n'SM/TransferAssets.js' \\\n'SM/Library.js' \\\n'SM/StigRevision.js' \\\n'SM/Inventory.js' \\\n'SM/AssetSelection.js' \\\n'SM/User.js' \\\n'SM/UserGroup.js' \\\n'SM/AppInfo.js' \\\n'SM/AppData.js' \\\n'SM/Job.js' \\\n'library.js' \\\n'collectionAdmin.js' \\\n'collectionManager.js' \\\n'stigAdmin.js' \\\n'completionStatus.js' \\\n'findingsSummary.js' \\\n'review.js' \\\n'collectionReview.js' \\\n'ExportButton.js' \\\n'jszip.min.js' \\\n'FileSaver.js' \\\n'jsonview.bundle.js' \\\n'SM/LogStream.js' \\\n'SM/ApiState.js' \\\n'stigman.js' -o ../../$DistDir/js/stig-manager.min.js -m -c --source-map \"root='src',url='stig-manager.min.js.map'\"\n\necho \"Copying files for sourcemap debugging\"\ncp -r . ../../$DistDir/js/src\n\necho \"Client build finished\"\n"
  },
  {
    "path": "client/dist/.gitignore",
    "content": "## Directory for the STIG Manager client distribution\n\n# Content can be written here by executing:\n# $ ../build.sh\n#\n# This file hopes to prevent commits to this directory\n\n# Ignore everything in this directory\n*\n\n# Except this file\n!.gitignore\n"
  },
  {
    "path": "client/src/css/ColumnHeaderGroup.css",
    "content": "/*!\n * Ext JS Library 3.2.1\n * Copyright(c) 2006-2010 Ext JS, Inc.\n * licensing@extjs.com\n * http://www.extjs.com/license\n */\ntd.ux-grid-hd-group-cell {\n    background: url(/ext/resources/images/default/grid/grid3-hrow.gif) repeat-x bottom;\n}"
  },
  {
    "path": "client/src/css/RowEditor.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.ext-ie .x-row-editor .x-form-text {\n    margin:0 !important; \n}\n.x-row-editor-header {\n    height:2px;\n    overflow:hidden;\n    background: transparent url(../img/row-editor-bg-grey.gif) repeat-x 0 0;\n}\n.x-row-editor-footer {\n    height:2px;\n    overflow:hidden;\n    background: transparent url(../img/row-editor-bg-grey.gif) repeat-x 0 -2px;\n}\n.ext-ie .x-row-editor-footer {\n    margin-top:-1px;\n}\n\n.x-row-editor-body {\n    overflow:hidden;\n    zoom:1;\n    background: #e8e8e8;\n    padding-top:2px;\n}\n.x-row-editor .x-btns {\n    position:absolute;\n    top:28px;\n    left:20px;\n    padding-left:5px;\n    background: transparent url(../img/row-editor-btns-grey.gif) no-repeat 0 0;\n}\n.x-row-editor .x-btns .x-plain-bwrap {\n    padding-right:5px;\n    background: transparent url(../img/row-editor-btns-grey.gif) no-repeat right -31px;\n}\n.x-row-editor .x-btns .x-plain-body {\n    background: transparent url(../img/row-editor-btns-grey.gif) repeat-x 0 -62px;\n    height:31px;\n}\n.x-row-editor .x-btns .x-table-layout-cell {\n    padding:3px;\n}\n\n/* Fixes for IE6/7 trigger fields */\n.ext-ie6 .x-row-editor .x-form-field-wrap .x-form-trigger, .ext-ie7 .x-row-editor .x-form-field-wrap .x-form-trigger {\n  top: 1px;\n}\n\n.ext-ie6 .x-row-editor .x-form-field-trigger-wrap, .ext-ie7 .x-row-editor .x-form-field-trigger-wrap {\n  margin-top: -1px;\n}\n\n.errorTip .x-tip-body ul{\n    list-style-type:disc;\n    margin-left:15px;\n}\n.x-row-editor.x-small-editor {\n  border-right: #c4c4c4 solid 1px;\n}\n"
  },
  {
    "path": "client/src/css/dark-mode.css",
    "content": "/*! Portions were generated by Dark Reader | Licensed under MIT https://github.com/darkreader/darkreader/blob/master/LICENSE */\n:root {\n  --color-severity-high:rgb(196 130 130);\n  --color-severity-medium:rgb(200 149 60);\n  --color-severity-low:rgb(169 177 219);\n  --color-risk-moderate: rgb(230 210 0);\n  --color-risk-very-low:rgb(100 167 90);\n  --color-scrollbar-idle: #333333;\n  --color-scrollbar-hover:#505050;\n  --color-http-status-200: #006017;\n  --color-http-status-300: #003761;\n  --color-http-status-400: #984a00;\n  --color-http-status-500: #980000;\n\n  --color-job-run-state-completed: hsl(121 84% 19% / 1);\n  --color-job-run-state-running: hsl(222, 84%, 19%);\n  --color-job-run-state-failed: hsl(1, 84%, 19%);\n  --color-job-run-state-missing: hsl(0deg 0% 32.91%);\t\n}\n\nhtml {\n    background-color: #181a1b!important\n}\n\nbody, button, html, input, select, textarea {\n    background-color: #181a1b;\n    border-color: #736b5e;\n    color: hsl(0 0% 85% / 1);\n}\n\na {\n    color: #3391ff\n}\n\ntable {\n    border-color: #545b5e\n}\n\n::placeholder {\n    color: #b2aba1;\n    opacity: .5!important\n}\n\ninput:-webkit-autofill, select:-webkit-autofill, textarea:-webkit-autofill {\n    background-color: #555b00!important;\n    color: #e8e6e3!important\n}\n\n::selection {\n    background-color: #004daa!important;\n    color: #e8e6e3!important\n}\n\n::-moz-selection {\n    background-color: #004daa!important;\n    color: #e8e6e3!important\n}\n \n:root {\n    color-scheme: dark\n}\n\n.x-grid3-row-over .sm-grid-cell-with-toolbar .sm-static-width {\n    filter: grayscale(100%) brightness(75%);\n}\n.x-grid3-row-over .sm-grid-cell-with-toolbar-2 .sm-static-width .sm-grid-cell-tool img {\n    filter: grayscale(100%) brightness(75%);\n}\n/* .x-grid3-row-over .sm-grid-cell-with-toolbar-2 .sm-static-width .sm-grid-cell-tool:hover img {\n    cursor: pointer;\n    scale: 150%;\n\tfilter: brightness(100%);\n}\n */\n\n.sm-metrics-status-table .sm-metrics-label {\n    border: 1px solid #444\n}\n\n.sm-metrics-status-table .sm-metrics-total td {\n    border-top: 1px solid #444\n}\n\n.sm-metrics-status-table .sm-metrics-assessed {\n    background-color: var(--metrics-status-chart-assessed-dark)\n}\n\n.sm-metrics-status-table .sm-metrics-submitted {\n    background-color: var(--metrics-status-chart-submitted-dark)\n}\n\n.sm-metrics-status-table .sm-metrics-accepted {\n    background-color: var(--metrics-status-chart-accepted-dark);\n}\n\n.sm-metrics-status-table .sm-metrics-unassessed {\n    background-color: var(--metrics-status-chart-unassessed-dark)\n}\n\n.sm-metrics-status-table .sm-metrics-unsaved {\n    background-color: var(--metrics-status-chart-unsaved-dark)\n}\n\n.sm-metrics-status-table .sm-metrics-rejected {\n    background-color: var(--metrics-status-chart-rejected-dark)\n}\n\n.sm-metrics-count-child {\n    border: 1px solid #444;\n}\n\n.sm-metric-agg-panel .x-layout-split {\n    background-color: #1f1f1f\n}\n\n.sm-metrics-inventory-box {\n    background-color: hsl(21 30% 60% / 1)\n}\n\n.sm-metrics-overview-panel .x-panel-body {\n    background-color: hsl(0 0% 12% / 1)\n}\n\n.sm-round-panel .sm-round-inner-panel .x-panel-body {\n    background-color: #1a1d1e\n}\n.sm-round-panel .x-panel-body, .sm-round-panel.x-window {\n    background-color: #1a1d1e;\n}\n\n.sm-round-panel.sm-offline-modal {\n\tbackground-color: hsl(4 71% 29% / 1)\n}\n\n.sm-round-panel.sm-unavailable-modal {\n\tbackground-color: hsl(24 71% 12% / 1);\n}\n\n.sm-round-panel.x-window-dlg {\n\tbackground-color: #1a1d1e;\n}\n\n\n.x-grid3-row-expanded .x-grid3-row-body {\n    background-color: hsl(37deg 10% 23%)\n}\n\n.sm-truncated-action {\n    color: #5a94b9\n}\n\n.sm-review-sprite {\n    background-color: hsl(0 0% 14% / 1);\n    border-color: hsl(0 0% 25% / 1);\n    color: hsl(0deg 0% 80%)\n}\n\n.sm-label-sprite {\n    filter: brightness(.9);\n}\n\nbody, html, img {\n    border-color: initial\n}\n\nol, ul {\n    list-style-image: initial\n}\n\n.x-hide-nosize, .x-hide-nosize * {\n    border-color: initial!important\n}\n\n.x-repaint {\n    background-color: transparent;\n    outline-color: initial\n}\n\n.x-color-palette a {\n    text-decoration-color: initial;\n    outline-color: initial\n}\n\n.x-color-palette a.x-color-palette-sel, .x-color-palette a:hover, .x-color-palette em, .x-shadow * {\n    border-color: initial\n}\n\n.x-shadow .xsmc {\n    background-color: transparent\n}\n\n.x-shadow .xsbc, .x-shadow .xsbl, .x-shadow .xsbr, .x-shadow .xsml, .x-shadow .xsmr, .x-shadow .xstc, .x-shadow .xstl, .x-shadow .xstr {\n    background-image: initial;\n    background-color: transparent\n}\n\n.loading-indicator {\n    background-color: initial\n}\n\n.x-drag-overlay {\n    background-image: url(\"../ext/resources/images/default/s.gif\")\n}\n\nul.x-tab-strip-bottom {\n    border-bottom-color: initial\n}\n\n.x-tab-panel-header-plain, .x-tab-panel-header-plain .x-tab-strip-top {\n    background-image: initial!important;\n    background-color: transparent!important\n}\n\n.x-tab-panel-footer-plain, .x-tab-panel-footer-plain .x-tab-strip-bottom {\n    background-image: initial!important;\n    background-color: transparent!important\n}\n\nul.x-tab-strip li.x-tab-edge {\n    border-color: initial!important;\n    background-image: initial!important;\n    background-color: transparent!important\n}\n\n.x-tab-strip a {\n    outline-color: initial;\n    text-decoration-color: initial!important\n}\n\n.x-tab-strip-bottom .x-tab-left, .x-tab-strip-bottom .x-tab-right, .x-tab-strip-bottom .x-tab-strip-active .x-tab-left, .x-tab-strip-bottom .x-tab-strip-active .x-tab-right {\n    background-color: initial\n}\n\n.x-tab-scroller-left, .x-tab-scroller-right {\n    background-color: transparent\n}\n\n.ext-webkit :focus {\n    outline-color: initial!important\n}\n\n.x-form-field-wrap .x-form-trigger {\n    border-color: initial;\n    background-color: #1a1d1e;\n}\n\n.x-form-grow-sizer p {\n    border-color: initial!important\n}\n\n.x-form-invalid-msg {\n    background-color: transparent\n}\n\n.x-form .x-form-btns-ct .x-form-btns td {\n    border-color: initial\n}\n\n.x-form-invalid-icon {\n    background-color: transparent\n}\n\nfieldset.x-panel-collapsed {\n    border-left-color: transparent;\n    border-right-color: transparent\n}\n\n.x-fieldset-noborder {\n    border-color: transparent\n}\n\n.ext-gecko .x-form-item, .ext-gecko .x-window-body .x-form-item {\n    outline-color: initial\n}\n\n.x-btn button {\n    border-color: initial;\n    background-color: transparent;\n    outline-color: initial\n}\n\n.x-btn button.sm-error-icon {\n    background-color: #602020\n}\n\n.x-btn-bc, .x-btn-bl, .x-btn-br, .x-btn-mc, .x-btn-ml, .x-btn-mr, .x-btn-tc, .x-btn-tl, .x-btn-tr {\n    background-color: initial\n}\n\n.x-btn-mc em.x-btn-arrow, .x-btn-mc em.x-btn-arrow-bottom, .x-btn-mc em.x-btn-split, .x-btn-mc em.x-btn-split-bottom {\n    background-color: transparent\n}\n\n.x-btn-as-arrow .x-btn-mc em {\n    background-color: transparent\n}\n\n.x-btn-group-bc, .x-btn-group-bl, .x-btn-group-br, .x-btn-group-tc, .x-btn-group-tl, .x-btn-group-tr {\n    background-color: transparent\n}\n\n.x-btn-group-mc {\n    border-color: initial\n}\n\n.x-btn-group-mc .x-btn-group-body {\n    background-color: transparent;\n    border-color: initial\n}\n\n.x-btn-group-ml, .x-btn-group-mr, .x-btn-group-notitle .x-btn-group-tc {\n    background-color: transparent\n}\n\n.x-toolbar .xtb-sep {\n    background-image: none;\n    background-color: #505050;\n    width: 1px;\n    margin: 0 3px 0 3px;\n}\n\n.x-toolbar-more em.x-btn-arrow {\n    background-color: transparent\n}\n\n.x-toolbar-more .x-btn-mc em.x-btn-arrow {\n    background-image: none\n}\n\ndiv.x-toolbar-no-items {\n    color: #988f81!important\n}\n\n.x-grid3-hd-row td, .x-grid3-row td, .x-grid3-summary-row td {\n    outline-color: initial\n}\n\n.x-grid3-body-cell {\n    outline-color: initial\n}\n\n.x-grid3-resize-marker, .x-grid3-resize-proxy {\n    border-color: initial\n}\n\n.x-grid3-focus {\n    outline-color: initial\n}\n\n.x-grid3-header-pop-inner {\n    background-color: transparent\n}\n\n.col-move-bottom, .col-move-top {\n    background-color: transparent\n}\n\n.x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker, .x-grid3-locked td.x-grid3-row-marker {\n    border-bottom-color: initial!important\n}\n\n.x-grid3-dirty-cell {\n    background-color: transparent\n}\n\n.x-grid3-topbar .x-toolbar {\n    border-right-color: initial\n}\n\n.x-grid3-bottombar .x-toolbar {\n    border-right-color: initial;\n    border-bottom-color: initial\n}\n\n.x-props-grid .x-grid3-td-name .x-grid3-cell-inner {\n    background-color: transparent!important\n}\n\n.x-props-grid .x-grid3-body .x-grid3-td-name {\n    border-color: initial\n}\n\n.x-grid3-col-dd {\n    border-color: initial;\n    background-color: transparent\n}\n\n.x-grid3-body .x-grid3-td-expander {\n    background-image: initial;\n    background-color: transparent\n}\n\n.x-grid3-row-expander {\n    background-color: transparent\n}\n\n.x-grid3-body .x-grid3-td-checker {\n    background-image: initial;\n    background-color: transparent\n}\n\n.x-grid3-hd-checker, .x-grid3-row-checker {\n    background-color: transparent\n}\n\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-checker, .x-grid3-body .x-grid3-row-selected .x-grid3-td-expander, .x-grid3-body .x-grid3-row-selected .x-grid3-td-numberer, .x-grid3-body .x-grid3-td-numberer, .x-grid3-body .x-grid3-td-row-icon {\n    background-image: initial;\n    background-color: transparent\n}\n\n.x-grid3-check-col, .x-grid3-check-col-on {\n    background-color: transparent\n}\n\n.x-grid-group-hd div.x-grid-group-title {\n    background-color: transparent\n}\n\n.x-dd-drag-repair .x-dd-drag-ghost {\n    border-color: initial;\n    background-color: transparent\n}\n\n.x-dd-drop-icon {\n    background-color: transparent\n}\n\n.x-tree-ec-icon, .x-tree-elbow, .x-tree-elbow-end, .x-tree-elbow-end-minus, .x-tree-elbow-end-plus, .x-tree-elbow-line, .x-tree-elbow-minus, .x-tree-elbow-plus, .x-tree-icon, .x-tree-node-collapsed .x-tree-node-icon, .x-tree-node-expanded .x-tree-node-icon, .x-tree-node-leaf .x-tree-node-icon, .x-view-selector {\n    border-color: initial\n}\n\n.x-tree-arrows .x-tree-elbow, .x-tree-no-lines .x-tree-elbow, .x-tree-no-lines .x-tree-elbow-end, .x-tree-no-lines .x-tree-elbow-line {\n    background-color: transparent\n}\n\n.x-tree-arrows .x-tree-elbow-minus, .x-tree-arrows .x-tree-elbow-plus {\n    background-color: transparent\n}\n\n.x-tree-arrows .x-tree-elbow-end {\n    background-color: transparent\n}\n\n.x-tree-arrows .x-tree-elbow-end-minus, .x-tree-arrows .x-tree-elbow-end-plus {\n    background-color: transparent\n}\n\n.x-tree-arrows .x-tree-elbow-line {\n    background-color: transparent\n}\n\n.x-dd-drag-ghost a, .x-tree-node a {\n    text-decoration-color: initial;\n    outline-color: initial\n}\n\n.x-tree-node .x-tree-node-inline-icon {\n    background-color: transparent\n}\n\n.x-dd-drag-ghost a:hover, .x-tree-node a:hover {\n    text-decoration-color: initial\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below {\n    border-bottom-color: initial\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above {\n    border-top-color: initial\n}\n\n.x-date-picker a {\n    outline-color: initial\n}\n\n.x-date-left, .x-date-middle, .x-date-right {\n    background-color: initial\n}\n\n.x-date-middle .x-btn-bc, .x-date-middle .x-btn-bl, .x-date-middle .x-btn-br, .x-date-middle .x-btn-mc, .x-date-middle .x-btn-ml, .x-date-middle .x-btn-mr, .x-date-middle .x-btn-tc, .x-date-middle .x-btn-tl, .x-date-middle .x-btn-tr {\n    background-image: initial!important;\n    background-color: transparent!important\n}\n\n.x-date-middle .x-btn-mc em.x-btn-arrow {\n    background-color: transparent\n}\n\n.x-date-left a, .x-date-right a {\n    text-decoration-color: initial!important\n}\n\n.x-date-inner a {\n    text-decoration-color: initial\n}\n\n.x-date-inner .x-date-nextday a, .x-date-inner .x-date-prevday a {\n    text-decoration-color: initial!important\n}\n\n.x-date-inner .x-date-disabled a:hover, .x-date-inner a:hover {\n    text-decoration-color: initial!important\n}\n\n.x-item-disabled .x-date-inner a:hover {\n    background-image: initial;\n    background-color: initial\n}\n\ntd.x-date-mp-month, td.x-date-mp-ybtn, td.x-date-mp-year {\n    border-color: initial\n}\n\n.x-date-mp-btns button {\n    text-decoration-color: initial!important\n}\n\ntd.x-date-mp-month a, td.x-date-mp-month a:hover, td.x-date-mp-year a, td.x-date-mp-year a:hover {\n    text-decoration-color: initial\n}\n\n.x-date-mp-ybtn a {\n    background-color: transparent\n}\n\n.x-tip {\n    border-color: initial\n}\n\n.x-tip .x-tip-bc, .x-tip .x-tip-bl, .x-tip .x-tip-br, .x-tip .x-tip-tc, .x-tip .x-tip-tl, .x-tip .x-tip-tr {\n    background-image: initial\n}\n\n.x-tip .x-tip-mc {\n    border-color: initial\n}\n\n.x-tip .x-tip-ml {\n    background-image: initial\n}\n\n.x-tip .x-tip-mr {\n    background-image: initial\n}\n\n.x-form-invalid-tip .x-tip-bc, .x-form-invalid-tip .x-tip-bl, .x-form-invalid-tip .x-tip-br, .x-form-invalid-tip .x-tip-tc {\n    background-color: initial\n}\n\n.x-form-invalid-tip .x-tip-body, .x-tip-anchor {\n    background-color: transparent\n}\n\n.x-menu {\n    background-image: initial\n}\n\n.x-menu a {\n    text-decoration-color: initial!important\n}\n\n.x-menu-list {\n    background-color: transparent;\n    border-color: initial\n}\n\n.x-menu-item-arrow {\n    background-color: transparent\n}\n\n.x-menu-focus {\n    outline-color: initial\n}\n\n.x-menu-item-icon {\n    border-color: initial\n}\n\n.x-menu-check-item .x-menu-item-icon {\n    background-color: transparent\n}\n\n.x-menu-group-item .x-menu-item-icon {\n    background-color: transparent\n}\n\n.x-menu-item-checked .x-menu-group-item .x-menu-item-icon {\n    background-color: transparent\n}\n\n.x-menu .x-date-picker, .x-menu-plain .x-color-palette, .x-menu-plain .x-date-picker {\n    border-color: initial\n}\n\n.x-box-ml, .x-box-tc, .x-box-tl, .x-box-tr {\n    background-color: transparent\n}\n\n.x-box-bc, .x-box-bl, .x-box-br, .x-box-mr {\n    background-color: transparent\n}\n\n.x-combo-list .x-toolbar {\n    border-bottom-color: initial\n}\n\n.x-panel-header {\n    background-color: transparent\n}\n\n.x-panel-mc .x-panel-tbar .x-toolbar, .x-panel-tbar-noheader .x-toolbar {\n    border-bottom-color: initial\n}\n\n.x-panel-tl .x-panel-header {\n    border-color: initial;\n    background-image: initial;\n    background-color: transparent\n}\n\n.x-panel-tc {\n    background-color: transparent\n}\n\n.x-panel-tl {\n    background-color: transparent\n}\n\n.x-panel-bc, .x-panel-bl, .x-panel-br, .x-panel-tr {\n    background-color: transparent\n}\n\n.x-panel-mc {\n    border-color: initial\n}\n\n.x-panel-mc .x-panel-body {\n    background-color: transparent;\n    border-color: initial\n}\n\n.x-panel-mr, .x-tool {\n    background-color: transparent\n}\n\n.x-panel-reset .x-panel-body del, .x-panel-reset .x-panel-body s, .x-panel-reset .x-panel-body strike {\n    text-decoration-color: initial\n}\n\n.x-panel-reset .x-panel-body hr {\n    border-color: initial\n}\n\n.x-panel-reset .x-panel-body :link, .x-panel-reset .x-panel-body :visited, .x-panel-reset .x-panel-body ins, .x-panel-reset .x-panel-body u {\n    text-decoration-color: initial\n}\n\n.x-window-bc, .x-window-bl, .x-window-br, .x-window-tc, .x-window-tl, .x-window-tr {\n    background-color: transparent\n}\n\n.x-window-ml, .x-window-mr {\n    background-color: transparent\n}\n\n.x-window-bbar .x-toolbar, .x-window-maximized .x-window-mc, .x-window-tbar .x-toolbar {\n    border-left-color: initial;\n    border-right-color: initial\n}\n\n.x-window-bbar .x-toolbar {\n    border-bottom-color: initial\n}\n\n.x-window-body {\n    background-color: transparent\n}\n\n.x-window-sizing-ghost ul {\n    border-color: initial!important\n}\n\n.x-dlg-focus {\n    outline-color: initial\n}\n\n.x-html-editor-tb .x-btn-text {\n    background-color: transparent\n}\n\n.x-html-editor-tb .x-edit-backcolor, .x-html-editor-tb .x-edit-bold, .x-html-editor-tb .x-edit-createlink, .x-html-editor-tb .x-edit-decreasefontsize, .x-html-editor-tb .x-edit-forecolor, .x-html-editor-tb .x-edit-increasefontsize, .x-html-editor-tb .x-edit-insertorderedlist, .x-html-editor-tb .x-edit-insertunorderedlist, .x-html-editor-tb .x-edit-italic, .x-html-editor-tb .x-edit-justifycenter, .x-html-editor-tb .x-edit-justifyleft, .x-html-editor-tb .x-edit-justifyright, .x-html-editor-tb .x-edit-sourceedit, .x-html-editor-tb .x-edit-underline, .x-menu-item img.x-edit-backcolor, .x-menu-item img.x-edit-bold, .x-menu-item img.x-edit-createlink, .x-menu-item img.x-edit-decreasefontsize, .x-menu-item img.x-edit-forecolor, .x-menu-item img.x-edit-increasefontsize, .x-menu-item img.x-edit-insertorderedlist, .x-menu-item img.x-edit-insertunorderedlist, .x-menu-item img.x-edit-italic, .x-menu-item img.x-edit-justifycenter, .x-menu-item img.x-edit-justifyleft, .x-menu-item img.x-edit-justifyright, .x-menu-item img.x-edit-sourceedit, .x-menu-item img.x-edit-underline {\n    background-image: url(\"../ext/resources/images/default/editor/tb-sprite.gif\")\n}\n\n.x-accordion-hd {\n    border-top-color: initial;\n    background-color: transparent\n}\n\n.x-layout-split {\n    background-color: transparent;\n    transition-property: background-color;\n    transition-duration: 100ms;\n    transition-delay: 0s;\n}\n\n.x-layout-split:hover {\n    background-color: #243385;\n    transition-duration: 100ms;\n    transition-delay: 0s;\n}\n\n.ext-strict .ext-ie6 .x-layout-split {\n    background-color: #181a1b!important\n}\n\n.x-layout-split-h, .x-layout-split-v {\n    background-image: url(\"../ext/resources/images/default/s.gif\")\n}\n\n.x-layout-cmini-east, .x-layout-cmini-north, .x-layout-cmini-south, .x-layout-cmini-west {\n    border-color: initial;\n    background-color: transparent\n}\n\n.x-progress-wrap, .x-viewport, .x-viewport body {\n    border-color: initial\n}\n\n.x-list-header-inner em.sort-asc, .x-list-header-inner em.sort-desc {\n    background-color: transparent\n}\n\n.x-slider-focus {\n    outline-color: initial\n}\n\n.x-slider-horz, .x-slider-horz .x-slider-end, .x-slider-horz .x-slider-inner, .x-slider-horz .x-slider-thumb, .x-slider-vert, .x-slider-vert .x-slider-end, .x-slider-vert .x-slider-inner, .x-slider-vert .x-slider-thumb {\n    background-color: transparent\n}\n\n.x-window-dlg .x-window-body, .x-window-dlg .x-window-mc {\n    border-color: initial!important\n}\n\n.x-window-dlg .ext-mb-error, .x-window-dlg .ext-mb-info, .x-window-dlg .ext-mb-question, .x-window-dlg .ext-mb-warning, .x-window-dlg .x-msg-box-wait {\n    background-color: transparent\n}\n\n.x-form-field-wrap .x-form-trigger {\n    border-bottom-color: #42484a\n}\n\n.x-form-invalid.x-form-composite {\n    border-color: initial;\n    background-image: none\n}\n\n.x-form-invalid.x-form-composite .x-form-invalid {\n    background-color: #181a1b;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iNCIgaGVpZ2h0PSIzIj48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMjQ5IC0wLjYxNCAtMC42NzIgMC4wMDAgMS4wMzUgLTAuNjQ2IDAuMjg4IC0wLjY2NCAwLjAwMCAxLjAyMCAtMC42MzYgLTAuNjA5IDAuMjUwIDAuMDAwIDAuOTk0IDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjQiIGhlaWdodD0iMyIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoQkFBREFJY0FBQUQvQVA4QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNINUJBRUFBQUFBTEFBQUFBQUVBQU1BQUFnTUFBTUFHQWhBb01DQ0FBSUNBRHM9IiAvPjwvc3ZnPg==\");\n    border-color: #c23000\n}\n\ntd.grid-hd-group-cell {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMiIgaGVpZ2h0PSIyNCI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIyIiBoZWlnaHQ9IjI0IiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBZ0FZQUljQUFORFEwT3ZzN3V6dDcrM3U4Tzd2OGUvdzh2RHg4L0h5OVBuNStRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ0g1QkFBQUFQOEFMQUFBQUFBQ0FCZ0FBQWdoQUJFSUhFaXdZTUVEQ0E4WVdNaXdnTU1DQkFnTW1EaEFnSUFBR0FNQUFCQVFBRHM9IiAvPjwvc3ZnPg==\");\n    background-color: initial\n}\n\n.x-menu-plain {\n    background-image: none\n}\n\n.x-color-menu, .x-date-menu {\n    background-color: #181a1b!important\n}\n\n.x-panel-mc .x-panel-tbar .x-toolbar, .x-panel-tbar-noheader .x-toolbar {\n    border-top-color: #1a4072\n}\n\n.x-item-disabled {\n    color: #988f81\n}\n\n.x-item-disabled * {\n    color: #988f81!important\n}\n\n.x-splitbar-proxy {\n    background-color: #484e51\n}\n\n.x-color-palette a {\n    border-color: #303436\n}\n\n.x-color-palette a.x-color-palette-sel, .x-color-palette a:hover {\n    border-color: #3e4345;\n    background-color: #242728\n}\n\n.x-color-palette em {\n    border-color: #4a5053\n}\n\n.x-ie-shadow {\n    background-color: #5a6165\n}\n\n.loading-indicator {\n    background-image: url(\"../ext/resources/images/default/grid/loading.gif\")\n}\n\n.x-spotlight {\n    background-color: #35393b\n}\n\n.x-tab-panel-footer, .x-tab-panel-header {\n    background-color: transparent;\n    border-color: #3d4245\n}\n\nul.x-tab-strip-bottom {\n    background-color: #2c3032;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMSIgaGVpZ2h0PSIyNiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIxIiBoZWlnaHQ9IjI2IiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBUUFhQUljQUFBQUFBQUVCQVFJQ0FnTURBd1FFQkFVRkJRWUdCZ2NIQndnSUNBa0pDUW9LQ2dzTEN3d01EQTBORFE0T0RnOFBEeEFRRUJFUkVSSVNFaE1URXhRVUZCVVZGUllXRmhjWEZ4Z1lHQmtaR1JvYUdoc2JHeHdjSEIwZEhSNGVIaDhmSHlBZ0lDRWhJU0lpSWlNakl5UWtKQ1VsSlNZbUppY25KeWdvS0NrcEtTb3FLaXNyS3l3c0xDMHRMUzR1TGk4dkx6QXdNREV4TVRJeU1qTXpNelEwTkRVMU5UWTJOamMzTnpnNE9EazVPVG82T2pzN096dzhQRDA5UFQ0K1BqOC9QMEJBUUVGQlFVSkNRa05EUTBSRVJFVkZSVVpHUmtkSFIwaElTRWxKU1VwS1NrdExTMHhNVEUxTlRVNU9UazlQVDFCUVVGRlJVVkpTVWxOVFUxUlVWRlZWVlZaV1ZsZFhWMWhZV0ZsWldWcGFXbHRiVzF4Y1hGMWRYVjVlWGw5ZlgyQmdZR0ZoWVdKaVltTmpZMlJrWkdWbFpXWm1abWRuWjJob2FHbHBhV3BxYW10cmEyeHNiRzF0Ylc1dWJtOXZiM0J3Y0hGeGNYSnljbk56YzNSMGRIVjFkWFoyZG5kM2QzaDRlSGw1ZVhwNmVudDdlM3g4ZkgxOWZYNStmbjkvZjRDQWdJR0JnWUtDZ29PRGc0U0VoSVdGaFlhR2hvZUhoNGlJaUltSmlZcUtpb3VMaTR5TWpJMk5qWTZPam8rUGo1Q1FrSkdSa1pLU2twT1RrNVNVbEpXVmxaYVdscGVYbDVpWW1KbVptWnFhbXB1Ym01eWNuSjJkblo2ZW5wK2ZuNkNnb0tHaG9hS2lvcU9qbzZTa3BLV2xwYWFtcHFlbnA2aW9xS21wcWFxcXFxdXJxNnlzcksydHJhNnVycSt2cjdDd3NMR3hzYkt5c3JPenM3UzB0TFcxdGJhMnRyZTN0N2k0dUxtNXVicTZ1cnU3dTd5OHZMMjl2YjYrdnIrL3Y4REF3TUhCd2NMQ3dzUER3OFRFeE1YRnhjYkd4c2ZIeDhqSXlNbkp5Y3JLeXN2THk4ek16TTNOemM3T3pzL1B6OURRME5IUjBkTFMwdFBUMDlUVTFOWFYxZGJXMXRmWDE5alkyTm5aMmRyYTJ0dmIyOXpjM04zZDNkN2UzdC9mMytEZzRPSGg0ZUxpNHVQajQrVGs1T1hsNWVibTV1Zm41K2pvNk9ucDZlcnE2dXZyNit6czdPM3Q3ZTd1N3UvdjcvRHc4UEh4OGZMeTh2UHo4L1QwOVBYMTlmYjI5dmYzOS9qNCtQbjUrZnI2K3Z2NysvejgvUDM5L2Y3Ky92Ly8veUg1QkFBQUFQOEFMQUFBQUFBQkFCb0FBQWdYQUpzMXc5Yk5HN2h3NDhpWlE1ZHVIYnVIRUNOQ0RBZ0FPdz09IiAvPjwvc3ZnPg==\");\n    border-top-color: #3d4245\n}\n\n.x-tab-panel-footer-plain .x-tab-strip-spacer, .x-tab-panel-header-plain .x-tab-strip-spacer {\n    border-color: #3d4245;\n    background-color: #242728\n}\n\n.x-tab-strip span.x-tab-strip-text {\n    color: #c8c3bc\n}\n\n.x-tab-strip-over span.x-tab-strip-text {\n    color: #dddad6\n}\n\n.x-tab-strip-active span.x-tab-strip-text {\n    color: #c8c3bc\n}\n\n.x-tab-strip-disabled .x-tabs-text {\n    color: #b2aca2\n}\n\n.x-tab-strip-bottom .x-tab-right {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjUwIj48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMzMzIC0wLjY2NyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IDAuMzMzIC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgLTAuNjY3IDAuMzMzIDAuMDAwIDEuMDAwIDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjMwMCIgaGVpZ2h0PSI1MCIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoTEFFeUFJY0FBQUFBQUFFQkFRSUNBZ01EQXdRRUJBVUZCUVlHQmdjSEJ3Z0lDQWtKQ1FvS0Nnc0xDd3dNREEwTkRRNE9EZzhQRHhBUUVCRVJFUklTRWhNVEV4UVVGQlVWRlJZV0ZoY1hGeGdZR0JrWkdSb2FHaHNiR3h3Y0hCMGRIUjRlSGg4Zkh5QWdJQ0VoSVNJaUlpTWpJeVFrSkNVbEpTWW1KaWNuSnlnb0tDa3BLU29xS2lzckt5d3NMQzB0TFM0dUxpOHZMekF3TURFeE1USXlNak16TXpRME5EVTFOVFkyTmpjM056ZzRPRGs1T1RvNk9qczdPenc4UEQwOVBUNCtQajgvUDBCQVFFRkJRVUpDUWtORFEwUkVSRVZGUlVaR1JrZEhSMGhJU0VsSlNVcEtTa3RMUzB4TVRFMU5UVTVPVGs5UFQxQlFVRkZSVVZKU1VsTlRVMVJVVkZWVlZWWldWbGRYVjFoWVdGbFpXVnBhV2x0YlcxeGNYRjFkWFY1ZVhsOWZYMkJnWUdGaFlXSmlZbU5qWTJSa1pHVmxaV1ptWm1kbloyaG9hR2xwYVdwcWFtdHJhMnhzYkcxdGJXNXVibTl2YjNCd2NIRnhjWEp5Y25OemMzUjBkSFYxZFhaMmRuZDNkM2g0ZUhsNWVYcDZlbnQ3ZTN4OGZIMTlmWDUrZm45L2Y0Q0FnSUdCZ1lLQ2dvT0RnNFNFaElXRmhZYUdob2VIaDRpSWlJbUppWXFLaW91TGk0eU1qSTJOalk2T2pvK1BqNUNRa0pHUmtaS1NrcE9UazVTVWxKV1ZsWmFXbHBlWGw1aVltSm1abVpxYW1wdWJtNXljbkoyZG5aNmVucCtmbjZDZ29LR2hvYUtpb3FPam82U2twS1dscGFhbXBxZW5wNmlvcUttcHFhcXFxcXVycTZ5c3JLMnRyYTZ1cnErdnI3Q3dzTEd4c2JLeXNyT3pzN1MwdExXMXRiYTJ0cmUzdDdpNHVMbTV1YnE2dXJ1N3U3eTh2TDI5dmI2K3ZyKy92OERBd01IQndjTEN3c1BEdzhURXhNWEZ4Y2JHeHNmSHg4akl5TW5KeWNyS3lzdkx5OHpNek0zTnpjN096cy9QejlEUTBOSFIwZExTMHRQVDA5VFUxTlhWMWRiVzF0ZlgxOWpZMk5uWjJkcmEydHZiMjl6YzNOM2QzZDdlM3QvZjMrRGc0T0hoNGVMaTR1UGo0K1RrNU9YbDVlYm01dWZuNStqbzZPbnA2ZXJxNnV2cjYrenM3TzN0N2U3dTd1L3Y3L0R3OFBIeDhmTHk4dlB6OC9UMDlQWDE5ZmIyOXZmMzkvajQrUG41K2ZyNit2djcrL3o4L1AzOS9mNysvdi8vL3lINUJBQUFBUDhBTEFBQUFBQXNBVElBQUFqL0FOVUpIRWl3b01HRENCTXFYTWl3b2NPSEVDTktuRWl4b3NXTEZ2KzV3c2l4bzhlUElFT0tIRW15SVRoY0pWT3FYTW15cGN1V0oxL0tuRW16cHMyVk1XL3EzTW16cDgrY1BvTUtIVXEwSTlDaVNKTXFYWHAwcWRPblVHazJqVXExcWxXUFU2OXEzY3BWWWRhdVlNTmUvU3Eyck5ta1pNK3FYYnN6TGR1M2NHR2lqRXUzcmx5N2VQT0tkS3UzcjkrRmZQOEtIcXd1TU9IRGVRMGpYaHhYTWVQSGFoMURuaHhXTXVYTFdpMWozaHhWTStmUFNqMkRIajFVTk9uVFBFMmpYbDFUTmV2WExsM0RucDFTTnUzYkljbk54YzE3SjdyZHZZUFRaQWRjdVBHVzc0b2ZYMTVTbm5MbTBFSE9leDY5T3NicDFyTjd4SzY5dTBYdTNzTkQvMHhYRDllNTgralRxMS9QdnIzNzkvRGp5NTlQdjc3OSsvano2OS9QZjMvNWNnQUdLT0NBQkJabzRJRUlKcWpnZ2d3MjZPQ0RFRVlvNFlRVVZramhkT1JrcU9HR0hIYm80WWNnaGlqaWlDU1dhT0tKS0thbzRvb3N0dWhpaTlPSkkrT01OTlpvNDQwNDVxampqanoyNk9PUFFBWXA1SkJFRm1ua2tVYkdnMHM0VERicDVKTlFSaW5sbEZSV2FlV1ZXR2FwNVpaY2R1bmxsMkNHQ2FZOHVYeGo1cGxvcHFubW1teTI2ZWFiY01ZcDU1eDAxbW5ublhqbXFlZWVlcnFqaXplQUJpcm9vSVFXYXVpaGlDYXE2S0tNTnVyb281QkdLdW1rbEZaS3FUcStjS1BwcHB4MjZ1bW5vSVlxNnFpa2xtcnFxYWltcXVxcXJMYnE2cXV1L2tSRHpEKzAxbXJycmJqbXF1dXV2UGJxNjYvQUJpdnNzTVFXYSt5eHlDYUxMRExrdU9Mc3M5QkdLKzIwMUZacjdiWFlacXZ0dHR4MjYrMjM0SVlyN3JqaWtzTk9RQUE3IiAvPjwvc3ZnPg==\")\n}\n\n.x-tab-strip-bottom .x-tab-left {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMyIgaGVpZ2h0PSI0OSI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIzIiBoZWlnaHQ9IjQ5IiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBd0F4QUljQUFBQUFBQUVCQVFJQ0FnTURBd1FFQkFVRkJRWUdCZ2NIQndnSUNBa0pDUW9LQ2dzTEN3d01EQTBORFE0T0RnOFBEeEFRRUJFUkVSSVNFaE1URXhRVUZCVVZGUllXRmhjWEZ4Z1lHQmtaR1JvYUdoc2JHeHdjSEIwZEhSNGVIaDhmSHlBZ0lDRWhJU0lpSWlNakl5UWtKQ1VsSlNZbUppY25KeWdvS0NrcEtTb3FLaXNyS3l3c0xDMHRMUzR1TGk4dkx6QXdNREV4TVRJeU1qTXpNelEwTkRVMU5UWTJOamMzTnpnNE9EazVPVG82T2pzN096dzhQRDA5UFQ0K1BqOC9QMEJBUUVGQlFVSkNRa05EUTBSRVJFVkZSVVpHUmtkSFIwaElTRWxKU1VwS1NrdExTMHhNVEUxTlRVNU9UazlQVDFCUVVGRlJVVkpTVWxOVFUxUlVWRlZWVlZaV1ZsZFhWMWhZV0ZsWldWcGFXbHRiVzF4Y1hGMWRYVjVlWGw5ZlgyQmdZR0ZoWVdKaVltTmpZMlJrWkdWbFpXWm1abWRuWjJob2FHbHBhV3BxYW10cmEyeHNiRzF0Ylc1dWJtOXZiM0J3Y0hGeGNYSnljbk56YzNSMGRIVjFkWFoyZG5kM2QzaDRlSGw1ZVhwNmVudDdlM3g4ZkgxOWZYNStmbjkvZjRDQWdJR0JnWUtDZ29PRGc0U0VoSVdGaFlhR2hvZUhoNGlJaUltSmlZcUtpb3VMaTR5TWpJMk5qWTZPam8rUGo1Q1FrSkdSa1pLU2twT1RrNVNVbEpXVmxaYVdscGVYbDVpWW1KbVptWnFhbXB1Ym01eWNuSjJkblo2ZW5wK2ZuNkNnb0tHaG9hS2lvcU9qbzZTa3BLV2xwYWFtcHFlbnA2aW9xS21wcWFxcXFxdXJxNnlzcksydHJhNnVycSt2cjdDd3NMR3hzYkt5c3JPenM3UzB0TFcxdGJhMnRyZTN0N2k0dUxtNXVicTZ1cnU3dTd5OHZMMjl2YjYrdnIrL3Y4REF3TUhCd2NMQ3dzUER3OFRFeE1YRnhjYkd4c2ZIeDhqSXlNbkp5Y3JLeXN2THk4ek16TTNOemM3T3pzL1B6OURRME5IUjBkTFMwdFBUMDlUVTFOWFYxZGJXMXRmWDE5alkyTm5aMmRyYTJ0dmIyOXpjM04zZDNkN2UzdC9mMytEZzRPSGg0ZUxpNHVQajQrVGs1T1hsNWVibTV1Zm41K2pvNk9ucDZlcnE2dXZyNit6czdPM3Q3ZTd1N3UvdjcvRHc4UEh4OGZMeTh2UHo4L1QwOVBYMTlmYjI5dmYzOS9qNCtQbjUrZnI2K3Z2NysvejgvUDM5L2Y3Ky92Ly8veUg1QkFBQUFQOEFMQUFBQUFBREFERUFBQWhPQUhHQlV5ZVE0TUNDQ0E4cU5NZ3dZY09GRGlOQ25QaXdJa0p5Qk5FUlpFZndIVUY1Qk9lRkhJbExKSzU2NlU2ZUsxbXVKRGxjOGNUbGtoZE9sN3R2dnRSNUkvYVBHemxrLzlpUmN4VVFBRHM9IiAvPjwvc3ZnPg==\")\n}\n\n.x-tab-strip-bottom .x-tab-strip-over .x-tab-left {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMyIgaGVpZ2h0PSI0OSI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIzIiBoZWlnaHQ9IjQ5IiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBd0F4QU1RQUFMYTJ0dkx5OHVmbjUvcjYrdm41K2ZEdzhPUGo0Ly8vLyt6czdPdnI2L3Y3Ky9Qejg3Mjl2YmUzdC9iMjl1cnE2cmk0dUx1N3U2eXNyTzN0N2NMQ3d2WDE5ZVhsNWZqNCtPL3Y3K2pvNkFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNINUJBQUFBQUFBTEFBQUFBQURBREVBQUFVNklDQUVJam1XNkttYWJOcXViZ3pQYjQwaVpFRXVwRU1TUDlKQVNBUW9Da1lNWURBQkVCQ0FTNkpCZUVBcUdVWkFRRGxZREpGRHdpQUpBUUE3IiAvPjwvc3ZnPg==\")\n}\n\n.x-tab-strip-bottom .x-tab-strip-over .x-tab-right {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjUwIj48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMzMzIC0wLjY2NyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IDAuMzMzIC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgLTAuNjY3IDAuMzMzIDAuMDAwIDEuMDAwIDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjMwMCIgaGVpZ2h0PSI1MCIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoTEFFeUFNUUFBUEx5OHV2cjYrM3Q3ZWpvNk9ycTZ1L3Y3Ly8vLytmbjU3dTd1K1hsNWV6czdLeXNyTjdlM3ZQejgrUGo0L1gxOWZIeDhlN3U3dG5aMlFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQUFBQUFBQUxBQUFBQUFzQVRJQUFBWC9JQ0NPWkdtZWFLcXViT3UrY0N6UGRHM2ZOclBnZk8vL3dLQndTR3pwaXNpa2NzbHNNby9PcUhSS3JTYWgxcXgyeStWaXUrQ3dlTXo3a3Mvb2ROcXNicnZmVWpaOFRxLzM1UGE4ZnAvQzgvK0FkWDZCaElWbmc0YUppbG1JaTQ2UFM0MlFrNVEva3BXWW1US1htcDJlS0p5Zm9wK2hvNmFZcGFlcWo2bXJyb2F0cjdKL3NiTzJkclczdW0rNXU3NW92Yi9DWWNIRHhsckZ4OHBUeWN2T1R6dlAwbXZSMDlaaUR0WFgyMXNEMnR6Z1ZBSGY0ZVZORWVUbTZrZ1E2ZXZ2UXU3dzh6d044dlQ0TlBiNS9QWDMvUUJYUEZoUW9LREJnd2dUS2x6SXNLSERoeEFqU3B4SXNhTEZpeGd6YXN3NFVJREhqeUJEaWh4SnNxVEpreWhUK0twY3liS2x5NWN3WThxY0tkT2VncHM0YytyY3liT256NTlBZ3dvZFNyU28wYU5Ja3lwZHluUXBnQVVCb2txZFNyV3ExYXRZczJyZHlyV3IxNjlndzRvZFM3YXMyYkx0Q0toZHk3YXQyN2R3NDhxZFM3ZXUzYnQ0OCtyZHk3ZXYzNzkrbnc0WVRMaXc0Y09JRXl0ZXpMaXg0OGVRSTB1ZVRMbXk1Y3VZTHd0WWNLQ3o1OCtnUTRzZVRicTA2ZE9vVTZ0ZXpicTE2OWV3WTh1T1RXQkJndHU0Yyt2ZXpidTM3OS9BZ3dzZlRyeTQ4ZVBJa3l0ZnpueTVoQVVHb2t1ZlRyMjY5ZXZZczJ2ZnpyMjc5Ky9ndzRzZlQ3NjgrZklMSENCWXo3NjkrL2Z3NDh1ZlQ3KysvZnY0OCt2Zno3Ky8vLzhBL3VkQUFDRUFBRHM9IiAvPjwvc3ZnPg==\")\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-right {\n    background-image: url(\"../ext/resources/images/gray/tabs/tab-btm-right-bg.gif\")\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-left {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMzAwIiBoZWlnaHQ9IjUwIj48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMzMzIC0wLjY2NyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IDAuMzMzIC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgLTAuNjY3IDAuMzMzIDAuMDAwIDEuMDAwIDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjMwMCIgaGVpZ2h0PSI1MCIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoTEFFeUFJY0FBQUFBQUFFQkFRSUNBZ01EQXdRRUJBVUZCUVlHQmdjSEJ3Z0lDQWtKQ1FvS0Nnc0xDd3dNREEwTkRRNE9EZzhQRHhBUUVCRVJFUklTRWhNVEV4UVVGQlVWRlJZV0ZoY1hGeGdZR0JrWkdSb2FHaHNiR3h3Y0hCMGRIUjRlSGg4Zkh5QWdJQ0VoSVNJaUlpTWpJeVFrSkNVbEpTWW1KaWNuSnlnb0tDa3BLU29xS2lzckt5d3NMQzB0TFM0dUxpOHZMekF3TURFeE1USXlNak16TXpRME5EVTFOVFkyTmpjM056ZzRPRGs1T1RvNk9qczdPenc4UEQwOVBUNCtQajgvUDBCQVFFRkJRVUpDUWtORFEwUkVSRVZGUlVaR1JrZEhSMGhJU0VsSlNVcEtTa3RMUzB4TVRFMU5UVTVPVGs5UFQxQlFVRkZSVVZKU1VsTlRVMVJVVkZWVlZWWldWbGRYVjFoWVdGbFpXVnBhV2x0YlcxeGNYRjFkWFY1ZVhsOWZYMkJnWUdGaFlXSmlZbU5qWTJSa1pHVmxaV1ptWm1kbloyaG9hR2xwYVdwcWFtdHJhMnhzYkcxdGJXNXVibTl2YjNCd2NIRnhjWEp5Y25OemMzUjBkSFYxZFhaMmRuZDNkM2g0ZUhsNWVYcDZlbnQ3ZTN4OGZIMTlmWDUrZm45L2Y0Q0FnSUdCZ1lLQ2dvT0RnNFNFaElXRmhZYUdob2VIaDRpSWlJbUppWXFLaW91TGk0eU1qSTJOalk2T2pvK1BqNUNRa0pHUmtaS1NrcE9UazVTVWxKV1ZsWmFXbHBlWGw1aVltSm1abVpxYW1wdWJtNXljbkoyZG5aNmVucCtmbjZDZ29LR2hvYUtpb3FPam82U2twS1dscGFhbXBxZW5wNmlvcUttcHFhcXFxcXVycTZ5c3JLMnRyYTZ1cnErdnI3Q3dzTEd4c2JLeXNyT3pzN1MwdExXMXRiYTJ0cmUzdDdpNHVMbTV1YnE2dXJ1N3U3eTh2TDI5dmI2K3ZyKy92OERBd01IQndjTEN3c1BEdzhURXhNWEZ4Y2JHeHNmSHg4akl5TW5KeWNyS3lzdkx5OHpNek0zTnpjN096cy9QejlEUTBOSFIwZExTMHRQVDA5VFUxTlhWMWRiVzF0ZlgxOWpZMk5uWjJkcmEydHZiMjl6YzNOM2QzZDdlM3QvZjMrRGc0T0hoNGVMaTR1UGo0K1RrNU9YbDVlYm01dWZuNStqbzZPbnA2ZXJxNnV2cjYrenM3TzN0N2U3dTd1L3Y3L0R3OFBIeDhmTHk4dlB6OC9UMDlQWDE5ZmIyOXZmMzkvajQrUG41K2ZyNit2djcrL3o4L1AzOS9mNysvdi8vL3lINUJBQUFBUDhBTEFBQUFBQXNBVElBQUFqL0FGMzlVMGV3b01HRENCTXFYTWl3b2NPSEVDTktuRWl4b3NXTEdETmlGS2l4bzhlUElFT0tIRW15NUVPT0psT3FYTW15cFV1V0tGL0tuRW16cHMyVU1XL3EzTW16SjgrY1BvTUtIVXBVSTlDaVNKTXFUWHAwcWRPblVHVTJqVXExcXRXT1U2OXEzY3BWWWRhdVlNTlcvU3Eyck5taVpNK3FYWHN6TGR1M2NGZTZqVXUzN3NlNWR2UHFuWWgzcjkrL0Nmc0NIdnhYTU9IRGRnMGpYdnhXTWVQSFpoMURudHhWTXVYTFZpMWozdnhVTStmUFNEMkRIaDFVTk9uVE9rMmpYajFUTmV2WE1BZkNucTNVTmUzYklXM2ozbTFVTnUvZmJYMERIeTVWT1BIamNvMGpYMDVTTi9QbkJaMURmeTR3bnZYcjJMTnIzODY5dS9mdjRNT0wveDlQdnJ6NTgralRxMSt2WHFDODkvRGp5NTlQdjc3OSsvano2OS9QdjcvLy93QUdLT0NBQkE0b0VEMElKcWpnZ2d3MjZPQ0RFRVlvNFlRVVZtamhoUmhtcU9HR0hIYklvVUQyaENqaWlDU1dhT0tKS0thbzRvb3N0dWppaXpER0tPT01OTlpvWTQwQzRhUGpqanoyNk9PUFFBWXA1SkJFRm1ua2tVZ21xZVNTVERicDVKTk9DcFRQbEZSV2FlV1ZXR2FwNVpaY2R1bmxsMkNHS2VhWVpKWnA1cGxvbmluUVBteTI2ZWFiY01ZcDU1eDAxbW5ublhqbXFlZWVmUGJwNTUrQUJncW9RUHdVYXVpaGlDYXE2S0tNTnVyb281QkdLdW1rbEZacTZhV1lacXBwcGdMNTQrbW5vSVlxNnFpa2xtcnFxYWltcXVxcXJMYnE2cXV3eGxjcTY2eXl1c0xOUDdqbXF1dXV2UGJxNjYvQUJpdnNzTVFXYSt5eHlDYXI3TExNTnNzc09iWTZLKzIwMUZacjdiWFlacXV0c094QTY4cTM0SVlyN3Jqa2xtdnV1ZWltcSs2NjdMYnI3cnZ3eGl2dnZQVEtHeEFBT3c9PSIgLz48L3N2Zz4=\")\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close {\n    background-image: url('../img/tab-close-dark.gif')\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close:hover {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTEiIGhlaWdodD0iMTEiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4zMzMgLTAuNjY3IC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgMC4zMzMgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAtMC42NjcgMC4zMzMgMC4wMDAgMS4wMDAgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTEiIGhlaWdodD0iMTEiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaEN3QUxBSWNBQUhkM2QzMTlmVUQvUUlPRGc0aUlpSTZPanE2dXJyaTR1Tm5aMmVIaDRlVGs1T2ZuNS9EdzhQVDA5UGo0K1BuNStmejgvUDM5L2YvLy93QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQU1BQUFJQUxBQUFBQUFMQUFzQUFBaGRBQVVJT0VDdzRBR0JBeVVvWENqaDRBRUpEQkE0bUlpQVFjTURFUkFVS09CZ0k0SUlCQ0UwSUVDU1pBTUlCQjh3WURDZzVjb0hCQmtrQ0VDVFpnSUdNUTBBQUtCZ3B3R2NCeGdzTUxDZ0tGR2NBMWNxWFhsUW9NR0NBZ01DQURzPSIgLz48L3N2Zz4=\")\n}\n\n.x-tab-panel-body-top {\n    border-top-color: initial\n}\n\n.x-tab-panel-body-bottom {\n    border-bottom-color: initial\n}\n\n.x-tab-scroller-left {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMzYiIGhlaWdodD0iNDMiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4zMzMgLTAuNjY3IC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgMC4zMzMgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAtMC42NjcgMC4zMzMgMC4wMDAgMS4wMDAgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMzYiIGhlaWdodD0iNDMiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaEpBQXJBSWNBQUc5dmIzbDVlVUQvUUlxS2lwU1VsSzZ1cnRiVzF0ZlgxOWpZMk5uWjJkcmEydHZiMjl6YzNOM2QzZDdlM3QvZjMrRGc0T0hoNGVMaTR1UGo0K1RrNU9YbDVlYm01dWZuNStqbzZPbnA2ZXJxNnV2cjYrenM3TzN0N2U3dTd1L3Y3L0R3OFBIeDhmUHo4L2IyOXZyNitnQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQUVBQUFJQUxBQUFBQUFrQUNzQUFBai9BQVVJSEVpd29NR0RDQXNvWE1pd29jT0hFRWxJbkVpeG9zUUNGak5TTENDaW84ZVBJRVdRS0pDaHBNbVRLRE9NRE1HeXBjdVhJVVplbUVtenBzMExJMEhvM01teko0aVJGb0lLSFVyVXdzZ1BTSk1xWGZwQlJJRUtVS05LblZyQnFZZXJXRDJNMkpyMXFsTUtZTU9LSFV2QmFZZXphTGNTMklyMnJOTUpjT1BDSFNBM3JsTU9lUEZ1RFJCZ3ExKzhUaVVJSGl3QkFBRENnNTF1V0x4aEwxKy9XeGM3alVDNXNtRUFsVE03MWNEWk1kL1BmVGs3aFVDYTlPWFRBRW83TGVrWjlPT1NUaC9JZm9ENjlHeW5HSEszQmowaXQxTUh3SUhYTmh6Y2FVM1BrRWZNZE5xZ3VmUEx6cU03SmVvNGVWQ25ETEpyWjJCNHUzYW5WTlZ1eVozcWRJSDU4K1lIb0QvL2xheGZzazRWeUo5UHY3NkN0M1h6eTNXYW9MLy8vd0FtRUJoaUJCTG1GQUlJSnFqZ2dnaE1sdG1ERURwMXdJUVVWbWpoQWFPVnB1R0dxaFZnd0ljZ2hpaWlBUmx5YUNJRVRvMm9Jb2dsbnJoaGlpdXEyS0tMSGNZb1l3RTBjZ2lqalNIT21PT09QSDdvSTQxQUJqbWtpMFh5ZU9TSlNkcTRwSWxOeHZpa2poNEd5U0tPT1dvWTVZcFR2bGlsbFNSaW1TVnBXOTQ0Wm8xZ2hua21tVjlhMmFXV2JSb3A1cGhsanZnbW1tRGV5V2FhYXE1WnA0aDZvaGlua2dVRUJBQTciIC8+PC9zdmc+\");\n    border-bottom-color: #3d4245\n}\n\n.x-tab-scroller-right {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMzYiIGhlaWdodD0iNDMiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4zMzMgLTAuNjY3IC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgMC4zMzMgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAtMC42NjcgMC4zMzMgMC4wMDAgMS4wMDAgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMzYiIGhlaWdodD0iNDMiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaEpBQXJBSWNBQUc5dmIzbDVlVUQvUUlxS2lwU1VsSzZ1cnRiVzF0ZlgxOWpZMk5uWjJkcmEydHZiMjl6YzNOM2QzZDdlM3QvZjMrRGc0T0hoNGVMaTR1UGo0K1RrNU9YbDVlYm01dWZuNStqbzZPbnA2ZXJxNnV2cjYrenM3TzN0N2U3dTd1L3Y3L0R3OFBIeDhmUHo4L2IyOXZyNitnQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQUVBQUFJQUxBQUFBQUFrQUNzQUFBai9BQVVJSEVpd29NR0RDQXNvWE1pd29jT0hFQXVRbUVpeG9zV0pFaTlxcENneGc4ZVBJRU5ta0NpaXBNbVRLRVZJdk1DeXBjdVhGeVNHbUVtenBzMFFFaTNvM01tenB3V0pJSUlLSFVvVVJBRVJGWklxWGNxMHd0RVBVS05LbmZyaEtJV3JXTE5xcFhEVWc5ZXZJOEorSFh0MGd0bXpFd2FnUlh1MGcxdTNZUW1FZmZ2MnFJUzdlQ1VBQUpBWDcxRU9ITUlLRGhBZ0xPRERSeU1vWGh4aEx3REdpbzl1MkNBNExPSENJeVpQUGdxaHMrUFBBRHFMUHFwQnc0akxxREdYMW5EMGdXdlFuMTI3UHVyeGRPckxZVDBlZGNBYjlsN2V3STlpd0dEN2R0amhHSTQyV002OGdlUG15NCt5ckZ3OHJNdWpETEpyWjdCM3UvYWpPcWtUMGc3YjgraUM4K2dYREVpZi9palR1R0diSGxWQXY3Nzkrd3FzYWhXOGxhdUlCQUFHS09DQUNaUzExb0ZzaVlEQWdndzI2Q0FDZHZVbFlWNUhIV0RoaFJobWVFQmlrSFhJMkZFR2hDamlpQ1Fhd0psb0tLWTRtZ2dsdGlqaWlTckdDQUdJTHJZSW80d3AwbGdqaVRmaXVPS09KZmJvNDR3c0FqbWlrRDdxYUtTSklneVpZNUZMTXVra2lrb2FpU1NPVlFKNXBZeFo3cmhsakYzVytLV0tZYm80NXBOUmhuZ21sVkF1dWVhUGFiN1pXWmsyTmpubG5HMWFhZWVkZEFhNTU1Ujk4dmluazRFZU9laVFoYjU0cUk4QkFRQTciIC8+PC9zdmc+\");\n    border-bottom-color: #3d4245\n}\n\n.x-tab-panel-bbar .x-toolbar, .x-tab-panel-tbar .x-toolbar {\n    border-color: #3d4245\n}\n\n.x-form-text, textarea.x-form-field {\n    background-color: #181a1b;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMSIgaGVpZ2h0PSIxOCI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIxIiBoZWlnaHQ9IjE4IiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBUUFTQUljQUFON2o1dkR6OC9QMTlmWDM5L2Y1K2ZuNysvejgvZjMrL3YvLy93QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ0g1QkFBQUFQOEFMQUFBQUFBQkFCSUFBQWdRQUFFRUVEQ0FRQUVEQnhBb1hNZ3dJQUE3IiAvPjwvc3ZnPg==\");\n    border-color: #42474a\n}\n\n.x-form-select-one {\n    background-color: #181a1b;\n    border-color: #42474a\n}\n\n.x-form-check-group-label {\n    border-bottom-color: #3d4245;\n    color: #c8c3bc\n}\n\n.x-editor .x-form-check-wrap {\n    background-color: #181a1b\n}\n\n.x-form-field-wrap .x-form-trigger {\n    background-image: url(\"../img/dark/trigger-flat-dark.svg\");\n    border: solid rgb(45 69 83);\n    border-width: 1px 1px 1px 0;\n    height: 20px;\n    width: 16px\n}\n\nx-trigger-wrap-focus .x-form-field-wrap .x-form-trigger {\n    border: solid rgb(83 72 45);\n    border-width: 1px 1px 1px 0;\n    height: 20px;\n    width: 16px\n}\n\n.x-small-editor .x-form-field-wrap .x-form-trigger {\n    height: 18px;\n}\n\n.x-form-field-wrap .x-form-date-trigger {\n    /* background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAyIiBoZWlnaHQ9IjI0Ij48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMzMzIC0wLjY2NyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IDAuMzMzIC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgLTAuNjY3IDAuMzMzIDAuMDAwIDEuMDAwIDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjEwMiIgaGVpZ2h0PSIyNCIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoWmdBWUFOVW9BSTZPanQ3ZTNzek16UC8vLzhuSnlhU2twT0RnNE5mWDE5SFIwY2pJeU83dTdpZ29LUHo4L1BiMjlybTV1Zkh4OGYzOS9kTFMwdFBUMDkzZDNjTEN3dHJhMnR2YjI5bloyZS92NzhyS3lzZkh4OFhGeGR6YzNQRHc4Ti9mMzh2THkvdjcrL1gxOWRiVzF0VFUxT3pzN1BQejgrM3Q3ZnI2K3YvLy93QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNINUJBRUFBQ2dBTEFBQUFBQm1BQmdBQUFiL1FJZHdTQ3c2VUlXa2Nza3NJSnZRNURQYW5GS1gxcXNVd3UxNnZ4Y0hZMHd1bXorRmczck5icVBOOFBJN0hrZTM3MnowWTgvdjk3a09Cb0tEaElRUUEybDRpZ1dGallPSEJRMlNrNVNVQTRpS2kzNmJmU0dCam82WW1YZU1vSTJJbGFtV2lhTnNCUjBkRkFDenRMVVVIU0FPSGg2eXRiNFVIcUt0YXdXN3ZiNjB3SWdoSWNmSUFCUWh3c01IQlJnWXo3NFl1UUVCMmJVQm9zN0lGR29GM2QrMDRRVWxKZW16SmVMcDVkVUtDZ0RkK1FQaCt3QUt1Uk1tNE1zWGpwKzNDYUxlQVRBWGNLQStnd0FRRnRqanNOdStTOTRlSkh4bnpsN0ZmQXNXZVB2bmdBT0hqOTFDZXVPUWtHQkJqQXVybVVRWlFDVUFscTg2MExUWm9TWEIvNHY5ekprd0FRQm91QVdYRmdBd2tjdUNoYUlHQnlDVkNzQ0NUNWMyelRtRmlsRnEwcXFJcm5HOU9GVXBocXNFczFZalFXTHMwYThrVGppb1VNR3RWNm9WRWhxOXE5UWNYYnRsQWVRdDRIRnZZQVY2b3dabUtOQmxTcEVSR3pqWXNHRW41QTBLQ2lSSUFQanI1Z0tVTFh2RFhPRENCZEVBTG1UZTNKbnE1Nzk3SVZhUXJFR0RYWWdhVm5OMlhCUHk1OXEzWWVZdXNEVTJUQXU2VVg4MkhiemZCY2taTWpUM2xpRzU4WDZmbzA4SFVMMUF3K3NIclVlRitGa056WHdMSlFzUWNCNmRBUEZkeVNjb3NMNjl0L2VsN0FNd0FQK2kvQUlpaUxDZENPcXhCeDRBK0xIR0czcWYxWGNnZm9Kc3g1OW11eTNveldjampLRFFDQVVxbEw0Z1p3YzJ5TjQ3RUJxZzBJU3NoVGlmQkN5MjZPS0xCYTRuNDR3ekp2ZU9pRFRtdUY1bXBqUmlZenFmUlNEa2tFUVdHYU9PTkdaR3dKSk1OdW5rZkVqcXlHT1BoQ2pwNUpWTXpvZkFsbHgyNmVXUlVlNVlBSlprUWhsbWphVlFLWWlWWkQ1WmdKZHdkZ2xtbUd5Mm1TVjlaOG80cFpvVDJ1bG1uSURPR1dXZGZwcVpaNGw4RW1xbmxvRENLU2lTaXJacGFKNTdxaGxwbVc4MitxVURoNHJwWjVPVG5sa3BsWmRpeWFpbVhENHE1WmlmTGhrcW5XbGF5bXFyOHdVQkFEcz0iIC8+PC9zdmc+\"); */\n}\n\n.x-form-field-wrap .x-form-clear-trigger {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAyIiBoZWlnaHQ9IjI0Ij48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMzMzIC0wLjY2NyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IDAuMzMzIC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgLTAuNjY3IDAuMzMzIDAuMDAwIDEuMDAwIDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjEwMiIgaGVpZ2h0PSIyNCIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoWmdBWUFPWUFBTXpNek9EZzROZlgxOG5KeWFTa3BNakl5TkhSMGZIeDhmejgvTnZiMjk3ZTNybTV1ZmIyOXMzTnpmRHc4Ti9mMys3dTd0M2QzWFoyZHRyYTJ1Ym01cFNVbFBYMTllL3Y3K1RrNU9ycTZ1M3Q3Zkx5OHVMaTR2MzkvZFBUMDYrdnI5TFMwdFRVMU1yS3l2UHo4OXpjM0xHeHNhYW1wcCtmbjJscGFaQ1FrTmJXMXBpWW1IZDNkMjl2YjluWjJlenM3T1BqNDhmSHg4WEZ4WnFhbXJDd3NPWGw1Yy9QejlYVjFlSGg0WnVibTZXbHBkalkyTWJHeHV2cjYram82T2ZuNStucDZmVDA5QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQUFBQUFBQUxBQUFBQUJtQUJnQUFBZi9nQXVDZzRTRmdnU0lpWXFMakkyT2o1Q1JrbzBkbFphWG1CMExDSnlkbnA4SUJBS2pwS1dtQWdTZ3FwMnBxNnFpcDdHakJBZTF0cmU0QndzQnZMMit2d0d3c3FjRXdNYTlCQXpLeTh6TkRNTERwYlM1MUxXN3g4YlEwYlBZMmM3Znk5cmJCQTdsRHJYbTZPWU9Ddy91RHh3YzcvSHY3dUxSQlBYMDd2dnZCQllBTFNnTE9EQ2doWHZEQ0Z4WXVNSENoZzBYSGpwY3VIQ0Jnb3NZSUdKNGdDRWlob3NYb1NWSVFHcWtLUUlnTTE3WTJISERSNUFFUnNnRU9NSkN6Wm8yWlk0UVNYS1VTV2tRSURnSXNxTEVnUkVIU3F3STRpQW9oQVVSSWdRNFVCUUNCUWhLRHdTSUdrR1lBZ2NhRk94UW9NR0JBbWxScDFhOW1uVnIxR2sxLzRzMjNLRFVwaTJ2WU1XU05RdFVLQVFhTFdqOERldzM2QUlTSkI3MCtORGlnd2JHSDNvOFFFd0NWZ0lIUlRWdzBLRFVRVTlVaUJWRGZ0eFlNbVZ5RGpZTXBuRUJzT0FONWl4akxxR1o4d3JQcEFobzJPMGdnd2tVT2xDWXlBQjJ0NFlGSXhQZ29QQTd1QWtLT0pJbnNKd0I4Z3ZJR1Q0VFNMNjh1WERvMGhVeTlBMWNlQWFJRktsYng2NzloZnNYQnlpY2tIQ0N3b0gzN2hkTTJKOEFCb2I1SjJBQVF3TDc3ZWNWYytVOWQxWnVCZmIzSDMwQ0VsZ2dBVTVCc0lGODlGR2dXb1VIZXFjZ1dsSEJBRVFPRXN3Z1FRNUF3TUJWQkF2SUlBTVBOdFJnNG93MTJNQ0RpeklRVU1DT0lnakFBWUFjQ0NEQ2pqc1M0Q0tNTXBaWVl2K05ON3BJZ0F0UUJ1QURpU2JtNEVNQVVFS3BJNDgrQWlra2tRVVFzRjhFR1ZRZ1FRVVJtRmxCQmhFVXVFQU1NVFJBZ1pvVHFFbEJBM0RHc0dVQkJ0UkE1WWsxR0FBbUFYREtTYWVkZU1LNVhRSUtsSGttQ1dwbW9FQnllL2I1Wnc2QkRnb2xDUnF3a0FJT0txYkFnZ1lrWkxtQUNDTFlrSUduWWlVZ2FnWTJvQ3JDbG9hZW1RQ2lSQktBcXFxczd1QXFDN0RLU2tCVU9FRGdLUWMvS0NBcUJEaHdSZXVjdHVKYUpDa0svQkNBWGdFa1c4b0NBQURRd0EwZjNmQ3RBaGlJMnkwQXRLNmF3bGtUdk5wQXJ0MStHKzY0NVRad2JqRzhVT0FEQjlCUndJRVBGUGlTTHFzQ3RBdnN1MFdxb0xBSyt5M2M4TUlxY0J1dkFRYlkyd0R1eGZiZVM2UUJHRVJnd0FBR1JJQ0JvUEJPWExHM0dKK0xyaTh3d05CTHk3OVUydkhISVk4OGFBZzQ1Nnp6emlGSXJQTFBQKzlaUUFNSUQxMTBrVUFuZlc4M3dBaE5OSkZQRCtyQjFGUlhiYlVIUGlzZE5KaGNkeDJtMWtuanl6UXlYcGNkSmdob3A2MzIyaUJrRFhhM0JBd2c5OXgwMS8zMTJ5cUxQWFl3ZGZkTmQ1Z1VCeTc0NEJTNy9YYmNmdnQ5Tjk1dzc0MU00b29UUVBqa2dSc09OdUtRLzAwQTQwczd6bmZtbWxOT3VlVmFZdzc2QUlzenJ2Zllwb01PdU9pRWs2NTA2NW1uanZmcVROTU8rZXV3Q3k1NzJLZlBiZnZobm44ZVBPKzlGODQ1M01ITFBmemx4ZXVlZUppQkFBQTciIC8+PC9zdmc+\")\n}\n\n.x-form-field-wrap .x-form-search-trigger {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAyIiBoZWlnaHQ9IjI0Ij48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMzMzIC0wLjY2NyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IDAuMzMzIC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgLTAuNjY3IDAuMzMzIDAuMDAwIDEuMDAwIDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjEwMiIgaGVpZ2h0PSIyNCIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoWmdBWUFQZUhBTXpNek1uSnlhU2twT0RnNE5mWDE5SFIwY2pJeU83dTd2ejgvTTNOemJtNXVkcmEydmIyOXRqWTJOUFQwK0hoNGQ3ZTN0M2QzZGJXMXR2YjI5L2YzLy8vLzg3T3p2SHg4ZWZuNStUazVPUGo0LzM5L2VqbzZQTHk4dUxpNG10cmEvRHc4TXJLeXVycTZ1Ym01dW5wNmR6YzNOTFMwdVhsNWMvUHoyaG9hS2FtcG1GaFlXSmlZbkJ3Y0lDQWdORFEwSXFLaXZYMTljdkx5OW5aMldscGFYcDZldFRVMUxTMHRKZVhsNUdSa2ZUMDlOWFYxV05qWThYRnhicTZ1c2ZIeDhIQndheXNyR2RuWi9qNCtPL3Y3MzE5ZmIyOXZhT2pvOGJHeG50N2UyUmtaSnVibSszdDdVMU5UWEZ4Y2Z2NyszSnljbXBxYXZQejgwVkZSV3hzYk96czdMS3lzb0tDZ3JHeHNYVjFkYlcxdFdWbFpXOXZiNGlJaUZsWldaQ1FrSFIwZElHQmdjREF3S3FxcXZuNStjVEV4SDUrZm5OemM3aTR1RzV1Ym54OGZKYVdsb09EZzNoNGVGcGFXbjkvZjdlM3Q2bXBxYTZ1cnErdnIyMXRiYUdob2JPenMzZDNkNktpb291TGkrdnI2NG1KaVVaR1J2cjYrb1NFaEx1N3UvZjM5MDVPVHBxYW1xZW5wMGRIUjdDd3NKbVptZi8vL3dBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNINUJBRUFBSWNBTEFBQUFBQm1BQmdBQUFqL0FCVUlIRWl3b0lKREFoSXFYTWhRQU1LR0VCTStqTmh3SXNXRkZpOUszTUN4bzhlUE14UWdHRW15cEVrWkFnaW9YTW15SlVxVE1FdStqQmtUWmN1YkxGRmUyTW16ZzQ0WU1YUjAyTWxSd1lDalJ4OW93TUNCQXdZTlJ6ZFVTSG16Z2RVR0xRVWdUYnEwNmRPb1V4bUlIY3RnaU5raFl5dE14WGtWSzBzQlBDLzRaQkFCZ0lVQkRJWmVpR0VVNmRJcUJINkVXQ0FDNm9DMUxCdE1vUERnQVlVRmI3ZitEVHk0OE5Hd1pJZVFvWkFBaFFZeWFhbXVWTXpZTWVTVkFrQ28zc3RCeFpVa1NkakFpWEVCeEJNRkZISjdJT0VCajRzYU5hNVlFZUhoc0dnQ0N3YU1jRkFHaVlRTUUxRG5wckM3OSsvZ3c0dFBCUXAwaUloQmJHRDcvMUdBTmdaaWxjbVhOMzhlWGFVQUl2QTdnRENVSlVjUElERE13TkZoV3dFRUNCU2NRQUlPOWQwSGd4cFlrUERBZVF0a0FFRWQxNFV4QjNUdS9SZmdnQVhpaDZDQ1UwbmhJVzJDWkppSEdXZ0FvZ09ERGtJSW5JUVVFaURBQVRCMjhJSVRNSFFRQVFRZy9KYkJCYmRGY09NSU1yUlE0NDA1dGdGQkJvZzFRTUVJYTRCaEgzNUp5SkVCWkFMNENBR1FRdHFJb3d0R0lnbVhYREVVUUtPV09kWXd3b2xVS2Nta2t3WkdPYVdMTUI3UWdRSWZHREdCQlo0RlFRVUFIZHhXUWdrUm5LQkZuWGZtK2NFUEp5VDVRQUJaRXVuQ0hTVlEwSUFBZndZNnFKMTRhaERFb1ltbXBwb09kR0thSnhVSm9LbFNBNHMydWlXa2tnckF4S3NkK1ArUXdnMFF2TEFEQmtmUVlFR2ZDa3d3UVFtQ0NrR3JyYmltWUlDWHB6NWdCNkdaYm9yRUE1UDZDcXdXd3RaNjZ4SEdlZ2tmRVZMNFVDMnh1Vm9naGFMTGlxcnBCODlPV2tVVlRGd2d3Ull0T0NVQ0JSK2NRUUlJZlNpd3dBSVRaRkFBdlBKU0VJVVRIaXlZNWdNM2ZIdHRDajlBSzhDKy9mNGJMd2J6RGx6d1ZIRjI4TzdFRlo4aHdnV0tKanpzd2cxUDZ1TUFJalJBd3dvMExJRkRDbWtBd1FGZUN2U0FCQUFsT0pBQ3l5NEw4WUVDRFlSd2dBQUdHQkJDQXdBb3diSEFYRXpnUUFBQzJJeXp6anpqNERQUVFnc3d3d3dSY0VEQXlpMi9USWNZSjVRd2RORkhKNzEwRkUwLy9YQUVJeEFBeGdwRjhNQ0RFazZJTVVJRUN6RC9vSUFCQ1N4UUFCUjBzOEFDRHkzb200QUJad2RnUVFSVWg1M0NCejRzc0RqUmdROWUrT0dKVzg2NEFCTkFnRUVEYzlkOU54UmlZQURCQkkwL0hybkxrMWQrT2JBNzBPRkdEa3g0QU1BTEo1d1F3ZForV3pEQkMxUjQ4UVVKRUJnQUFBVVRvQ0JEMWdGa1RuZ1JodlBBaGV3QkdDQ0E4TVFiajd6eXpEdWY5UUFrU0pERzdRZG9rRUFCSXlnSVFRUkRSeS80OU5WZmIzbjJBbERnZ0JKTjdPR1VCd1Y3ekVvWTRBTUpvSUFGVGVqQ0NRYXdyeGxJb0FBSkFBQUFoaFk0Rkh6QWV4SDRnUXdnY0wraXFjQ0FDRlFnQXhmZ1FBaEs4QUFxaUpzU0FnRURQVENCQkUwWlFYR09Rc0VGV0JDREd1UmdBcktudlFFRWdROWh3TUNiLzFZaWdTSktnQUYvbU1FWXB1Q0NERVRBQkJhSVlnSWllRUlWT0NBQklkUkFCQWhReEN2eTBBQXFVQ0lUblFoRktWSnhnaXJnUUNFSWNRVVJGS1l4amRrS0NxK1l4UzEyY1lkRjAxNEpJSENEREhpZ0FUdXdnU0FIS1VnQ1NtQUJWbmhBQkV3b3dVWldVUUp4bU1JYlBMQUFDNFFnQUpqTW93Y1BtY2hGbnRHUmFCeEJCdEJBQXN0c1JZNGZqT1FrSzNuSlRHcFNBQklJWFFrSVlBTUgyUEtXdC9UYkN5UlF3aytDY280TndBSUQ4YWpKVis2eWw2QjA1TkE4TUFJT3lQQ1Vwd1NtTUR0WXpEd0t3QVMzTklFMnQ4bE5FL2h0aWhhWVlqS1ZLUUFBT0VBQ1hzU2tPdGVwUFhDS2M1d24xQW9jb1JuTmNwNHpuZXRrcHdBS3dJblBmdnJ6bjM2RDV6ampGNEtDNXZPZzJoTm9Nb2RHejRZUzFLQUgxZWMvSityUGdDcVVuQkhOYUVJdjJraUdOaFNhOGNzb1F2ZEpVWXBhbEtNVEZJQklSNHJTZUg0VXBDcGRxVVJMT3RHVGNqU2tNczFrT1Z2cTBaY2lCYWM1MVI1TmE2cUFscVkwcCtyY0tFcDc2dE1CQUZXbVFoMXFSWXZLMDVnaVZhazMxVXBUYVdqVm9Bb2dJQUE3IiAvPjwvc3ZnPg==\")\n}\n\n.x-item-disabled .x-form-trigger-click, .x-item-disabled .x-form-trigger-over {\n    border-bottom-color: #42484a\n}\n\n.x-form-focus, textarea.x-form-focus {\n    border-color: #655e53\n}\n\n.x-form-invalid, textarea.x-form-invalid {\n    background-color: #181a1b;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iNCIgaGVpZ2h0PSIzIj48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMjQ5IC0wLjYxNCAtMC42NzIgMC4wMDAgMS4wMzUgLTAuNjQ2IDAuMjg4IC0wLjY2NCAwLjAwMCAxLjAyMCAtMC42MzYgLTAuNjA5IDAuMjUwIDAuMDAwIDAuOTk0IDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjQiIGhlaWdodD0iMyIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoQkFBREFJY0FBQUQvQVA4QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNINUJBRUFBQUFBTEFBQUFBQUVBQU1BQUFnTUFBTUFHQWhBb01DQ0FBSUNBRHM9IiAvPjwvc3ZnPg==\");\n    border-color: #c23000\n}\n\n.ext-webkit .x-form-invalid {\n    background-color: #3d0000;\n    border-color: #910800\n}\n\n.x-form-inner-invalid, textarea.x-form-inner-invalid {\n    background-color: #181a1b;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iNCIgaGVpZ2h0PSIzIj48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMjQ5IC0wLjYxNCAtMC42NzIgMC4wMDAgMS4wMzUgLTAuNjQ2IDAuMjg4IC0wLjY2NCAwLjAwMCAxLjAyMCAtMC42MzYgLTAuNjA5IDAuMjUwIDAuMDAwIDAuOTk0IDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjQiIGhlaWdodD0iMyIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoQkFBREFJY0FBQUQvQVA4QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNINUJBRUFBQUFBTEFBQUFBQUVBQU1BQUFnTUFBTUFHQWhBb01DQ0FBSUNBRHM9IiAvPjwvc3ZnPg==\")\n}\n\n.x-form-invalid-msg {\n    color: #db4e52;\n    background-image: url(\"../ext/resources/images/default/shared/warning.gif\")\n}\n\n.x-form-empty-field {\n    color: #988f81\n}\n\n.x-form-invalid-icon {\n    background-image: url(\"../ext/resources/images/default/form/exclamation.gif\")\n}\n\n.x-fieldset {\n    border-color: #3e4446\n}\n\n.x-fieldset legend {\n    color: hsl(0deg 0% 57%)\n}\n\n.x-btn button {\n    color: #c8c3bc\n}\n\n.x-btn-bc, .x-btn-bl, .x-btn-br, .x-btn-mc, .x-btn-ml, .x-btn-mr, .x-btn-tc, .x-btn-tl, .x-btn-tr {\n    background-image: none;\n}\n\n.x-btn-click .x-btn-text, .x-btn-menu-active .x-btn-text, .x-btn-pressed .x-btn-text {\n    color: #e8e6e3\n}\n\n.x-btn-disabled * {\n    color: #988f81!important\n}\n\n.x-btn-mc em.x-btn-arrow {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAiIGhlaWdodD0iMTAiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4yNDkgLTAuNjE0IC0wLjY3MiAwLjAwMCAxLjAzNSAtMC42NDYgMC4yODggLTAuNjY0IDAuMDAwIDEuMDIwIC0wLjYzNiAtMC42MDkgMC4yNTAgMC4wMDAgMC45OTQgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTAiIGhlaWdodD0iMTAiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaENnQUtBSWNBQUFBQUFQLy8vd0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQUVBQUFFQUxBQUFBQUFLQUFvQUFBZ1pBQU1JSEVpd29NR0RDQTBDV0xoUVljT0RBQkpLbkZnd0lBQTciIC8+PC9zdmc+\")\n}\n\n.x-btn-mc em.x-btn-split {\n    background-image: url(\"../ext/resources/images/default/button/s-arrow.gif\")\n}\n\n.x-btn-mc em.x-btn-arrow-bottom {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMjAwIiBoZWlnaHQ9IjE0Ij48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMjQ5IC0wLjYxNCAtMC42NzIgMC4wMDAgMS4wMzUgLTAuNjQ2IDAuMjg4IC0wLjY2NCAwLjAwMCAxLjAyMCAtMC42MzYgLTAuNjA5IDAuMjUwIDAuMDAwIDAuOTk0IDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjIwMCIgaGVpZ2h0PSIxNCIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoeUFBT0FJY0FBQUFBQU1URXhNTGE5di8vL3dBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNINUJBTUFBQUlBTEFBQUFBRElBQTRBQUFoZkFBVUlIRWl3b01HRENCTXFYTWl3b2NPSEVDTktuRWl4b3NXTEdETnEzTWl4bzhlUElFT0tIRW15cE1tVEtGT3FYTW15cGN1WE1HUEtuRW16cGsyR0FITG12TW16SjBlZFBvTUtyUWhncU5HalNKTXFYY3EwcWRPblVLTjJEQWdBT3c9PSIgLz48L3N2Zz4=\")\n}\n\n.x-btn-mc em.x-btn-split-bottom {\n    background-image: url(\"../ext/resources/images/default/button/s-arrow-b.gif\")\n}\n\n.x-btn-click .x-btn-mc em.x-btn-split-bottom, .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-btn-pressed .x-btn-mc em.x-btn-split-bottom {\n    background-image: url(\"../ext/resources/images/gray/button/s-arrow-bo.gif\")\n}\n\n.x-btn-group-header {\n    color: #a8a095\n}\n\n.x-btn-group-tc {\n    background-image: url(\"../ext/resources/images/gray/button/group-tb.gif\")\n}\n\n.x-btn-group-tl, .x-btn-group-tr {\n    background-image: url(\"../ext/resources/images/gray/button/group-cs.gif\")\n}\n\n.x-btn-group-bc {\n    background-image: url(\"../ext/resources/images/gray/button/group-tb.gif\")\n}\n\n.x-btn-group-bl, .x-btn-group-br {\n    background-image: url(\"../ext/resources/images/gray/button/group-cs.gif\")\n}\n\n.x-btn-group-ml, .x-btn-group-mr {\n    background-image: url(\"../ext/resources/images/gray/button/group-lr.gif\")\n}\n\n.x-btn-group-notitle .x-btn-group-tc {\n    background-image: url(\"../ext/resources/images/gray/button/group-tb.gif\")\n}\n\n.x-toolbar .x-item-disabled, .x-toolbar .x-item-disabled * {\n    color: #988f81\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTQiIGhlaWdodD0iNzIiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4yNDkgLTAuNjE0IC0wLjY3MiAwLjAwMCAxLjAzNSAtMC42NDYgMC4yODggLTAuNjY0IDAuMDAwIDEuMDIwIC0wLjYzNiAtMC42MDkgMC4yNTAgMC4wMDAgMC45OTQgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTQiIGhlaWdodD0iNzIiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaERnQklBSWNBQUFBQUFNbkp5Y0xhOXZYMTlRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQU1BQUFJQUxBQUFBQUFPQUVnQUFBZzhBQVVJSEVpd29NR0RDQk1xWE1pd29jT0hFQ05LbkVpeG9zV0xHRE5xM01peG84ZVBBRUtHVkNpU0lZQ1BLRk9xWE1teXBjdVhNR1BLbkJrUUFEcz0iIC8+PC9zdmc+\");\n}\n\n.x-toolbar .x-btn-click .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-over .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split {\n    background-image: url(\"../img/dark/s-arrow-o.gif\");\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split-bottom {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMjAwIiBoZWlnaHQ9IjE0Ij48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMjQ5IC0wLjYxNCAtMC42NzIgMC4wMDAgMS4wMzUgLTAuNjQ2IDAuMjg4IC0wLjY2NCAwLjAwMCAxLjAyMCAtMC42MzYgLTAuNjA5IDAuMjUwIDAuMDAwIDAuOTk0IDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjIwMCIgaGVpZ2h0PSIxNCIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoeUFBT0FJY0FBQUFBQU1URXhNTGE5di8vL3dBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNINUJBTUFBQUlBTEFBQUFBRElBQTRBQUFoZkFBVUlIRWl3b01HRENCTXFYTWl3b2NPSEVDTktuRWl4b3NXTEdETnEzTWl4bzhlUElFT0tIRW15cE1tVEtGT3FYTW15cGN1WE1HUEtuRW16cGsyR0FITG12TW16SjBlZFBvTUtyUWhncU5HalNKTXFYY3EwcWRPblVLTjJEQWdBT3c9PSIgLz48L3N2Zz4=\")\n}\n\n.x-toolbar .x-btn-click .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split-bottom {\n    background-image: url(\"../ext/resources/images/gray/button/s-arrow-bo.gif\")\n}\n\n.x-tbar-page-first {\n    background-image: url(\"../ext/resources/images/gray/grid/page-first.gif\")!important\n}\n\n.x-tbar-loading {\n    background-image: url(\"../ext/resources/images/gray/grid/refresh.gif\")!important\n}\n\n.x-tbar-page-last {\n    background-image: url(\"../ext/resources/images/gray/grid/page-last.gif\")!important\n}\n\n.x-tbar-page-next {\n    background-image: url(\"../ext/resources/images/gray/grid/page-next.gif\")!important\n}\n\n.x-tbar-page-prev {\n    background-image: url(\"../ext/resources/images/gray/grid/page-prev.gif\")!important\n}\n\n.x-item-disabled .x-tbar-loading {\n    background-image: url(\"../ext/resources/images/default/grid/loading.gif\")!important\n}\n\n.x-item-disabled .x-tbar-page-first {\n    background-image: url(\"../ext/resources/images/default/grid/page-first-disabled.gif\")!important\n}\n\n.x-item-disabled .x-tbar-page-last {\n    background-image: url(\"../ext/resources/images/default/grid/page-last-disabled.gif\")!important\n}\n\n.x-item-disabled .x-tbar-page-next {\n    background-image: url(\"../ext/resources/images/default/grid/page-next-disabled.gif\")!important\n}\n\n.x-item-disabled .x-tbar-page-prev {\n    background-image: url(\"../ext/resources/images/default/grid/page-prev-disabled.gif\")!important\n}\n\n.x-paging-info {\n    color: #bdb7af\n}\n\n.x-toolbar-more-icon {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTIiIGhlaWdodD0iMTYiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4yNDkgLTAuNjE0IC0wLjY3MiAwLjAwMCAxLjAzNSAtMC42NDYgMC4yODggLTAuNjY0IDAuMDAwIDEuMDIwIC0wLjYzNiAtMC42MDkgMC4yNTAgMC4wMDAgMC45OTQgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTIiIGhlaWdodD0iMTYiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaERBQVFBSUFBQUdOalkyTmpZeUg1QkFFQUFBRUFMQUFBQUFBTUFCQUFBQUlhakkrcHkrMEpvb2tBeWtCdHhmZGt2b0ZUOTMzaSthVHFXZ0FBT3c9PSIgLz48L3N2Zz4=\")!important\n}\n\n.x-resizable-handle {\n    background-color: #181a1b\n}\n\n.x-resizable-over .x-resizable-handle-east, .x-resizable-over .x-resizable-handle-west, .x-resizable-pinned .x-resizable-handle-east, .x-resizable-pinned .x-resizable-handle-west {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAiIGhlaWdodD0iMjAwMCI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIxMCIgaGVpZ2h0PSIyMDAwIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhDZ0RRQjZJQUFOZlgxK25wNmVYbDVkdmIyK0RnNEtPam8vLy8vd0FBQUNINUJBQUFBQUFBTEFBQUFBQUtBTkFIQUFQL0dFSUQvb285dU5vRTBjNThjZTNjRlc2ZldKS1NtYUlhdGJxdE04TGdTYXV4OThvMnYrdTVtUy9ZQTlaK1FpUHVTRVFXazlDbjFFbHRXcG5ZcFphVjVXNXYzakI0UE95U2xlTHlWNTFHbjZOVk0vczl2YTdkOHp4K0Q3ZTMrM0o4ZFlHQWQ0Vi9nNGFKaUhHS2pZeCtkSStTa1hxSGxJU0xtSTZWZ3BPV21xQ2ZucDJYb3FXaHBKbWpwcXFjcTZpc3FhMjBzN2F5dUxHNnNMeXZ2cEM5d0wrYndzWEV4NmZCeUs3R3ljUE96Y3pMdGJuSzBOTzN1OC9TMTkzYzM5VGEwZUhXNE5ubDVOdnA0K2ZxN2V6Vjd2SHc0dGp6OXZYZTYvam83L3p5K2N6ZDArZVA0RUNCQWZjWlRGZ1FZYitEQ2gwQ2ZNZ1FZc09JR0M5cXRNaXgvNkpIaWlBbmlxUVhrdVRJZnlaVG9seTVzQ1JMaVNwYm5wUVpFK2JMakIxZDByeTU4ZU5NbXp1REFoMkswMmZOb2pxSjlreUs5R2ZUbzB1ZFJvV2FVMnBWcWtaNVh0V2FWZWhUcmt5bmdyWGFWZWxXcjJMUm5qVmI5cXZhdG1uWmhsM3JWaTdadVhEcHhxM0xkNjlmdllEekNzWkwrSzVocklVUkh4NnJ1REhqeDI4VFE3YnJPUEppeTVVcFQrNGJXRExtelg4SFg5Yjh1VFRwMDV4RlowN3RHWFhvMXF4SHgxNzlXbmJ0b3dVS0JNbHRvSWFCM29aeTd5NEFuTVJ2RUIwZ0NBZkIyM2R4Q01sbExCZlIzTVJ4MjUyeHF3YWRuWFozN3R0Tnp3WVArelo1N2VXL2l6ZS9YcjFyOStQYmgzOC9Qejc5OVBYWjMwZlAzM3QrK0xiNjJTZGdnQVFDYU9CL0NPS25ZSC9uK2JlZ2d3eks5MkNERkVvWTRYNFFabGdoaGhzT2VPQ0VGbW9ZWW9jRkpuaWhoeWFLeU9HSUxLN29Jb29ndmxoaWpEQ2VPS09OSCtLWUlvazVxbGlqanpjQzJTT1BPN2I0STVFMEJvbWtqa2tPYWFTU1R6b3BvNVJIUmxua2xGZFdpV1dUV1VLNUpaTmdDdGtsbFY1cWFXYVphSktwNXBoc2N1bG1tRXVLK2FhY2NGbzVaNXg0MmxubmwzVDJtU2VmZjU2NTVwMTYrbGxvb0dtMnVhZWdpaG9LcUdrSkFBQTciIC8+PC9zdmc+\")\n}\n\n.x-resizable-over .x-resizable-handle-north, .x-resizable-over .x-resizable-handle-south, .x-resizable-pinned .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-south {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMjAwMCIgaGVpZ2h0PSIxMCI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIyMDAwIiBoZWlnaHQ9IjEwIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGgwQWNLQUtJQUFOZlgxK25wNmVYbDVkdmIyK0RnNEtPam8vLy8vd0FBQUNINUJBQUFBQUFBTEFBQUFBRFFCd29BQUFQL0dMcmMvakRLU2F1OU9Pdk51LzlnS0k1a2FaNW9xcTVzNjc1d0xNOTBiZDk0cnU5ODcvL0FvSEJJTEJwdmdxUnl5V3c2bjlDb2RFcXRXcS9ZckhiTDdYcS80TEI0VEM2YnoraTBlczF1dTkvd3VIeXVMQlNTZHZ4ZGtLZjcvNENCZ29PRWhZYUhpSW1LaTR5TmptUUVrWktUbEpXV2w1aVptcHVjblo2Zm9LR2lvNlNscHFlb3FhcXJySzJ1cjdDeHNyTzB0YmEzdUxtNnU1SjJCZ1Mrd0FXL3diekd4OGpKeXN2TXpjN1AwTkhTMDlUVjFxc0QyZHJiM04zZTMrRGg0dVBrNWVibjZPbnE2K3p0N3UvdzhmTHo5UFgyOS9qNSt2djgvZjcvQUFNS0hMak5nSUZzQmhFZUhKQ1FvTU9IRUNOS25FaXhvc1dMR0ROcTNNaXhzNlBIZVFCQ2loeEpzcVRKa3loVHFsekpzcVhMbHpCanlweEpzNmJObXpoejZ0ekpzNmZQbjBDRENoMUt0S2pSbzBpVEtsM0t0S25UcDFDalNwMUt0YXJWcTFpemF0M0t0YXZYcjJERGloMUx0cXpaczJqVHFsM0x0cTNidDNEanlwMUx0NjdkdTNqejZ0M0x0Ni9mdjRBREN4NU11TERodzRnVEsxN011TEhqeDVBalM1NU11YkxseTVnemE5N011YlBuejZCRGl4NU51clRwMDZoVHExN051clhyMTdCank1NU51N2J0MjdoemcwMEFBRHM9IiAvPjwvc3ZnPg==\")\n}\n\n.x-resizable-over .x-resizable-handle-southeast, .x-resizable-pinned .x-resizable-handle-southeast {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAiIGhlaWdodD0iMTAiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4zMzMgLTAuNjY3IC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgMC4zMzMgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAtMC42NjcgMC4zMzMgMC4wMDAgMS4wMDAgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTAiIGhlaWdodD0iMTAiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaENnQUtBTE1BQU5mWDE2T2pvLy8vLytEZzRPbnA2ZWJtNXRyYTJ1WGw1ZWZuNStMaTRnQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQUFBQUFBQUxBQUFBQUFLQUFvQUFBUWZrSkFTd2dBWUVIU3F5RUJ4SklQd1pkVlFHYURuZ2FWZ21HQnQzM2hlUndBNyIgLz48L3N2Zz4=\")\n}\n\n.x-resizable-over .x-resizable-handle-northwest, .x-resizable-pinned .x-resizable-handle-northwest {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAiIGhlaWdodD0iMTAiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4zMzMgLTAuNjY3IC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgMC4zMzMgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAtMC42NjcgMC4zMzMgMC4wMDAgMS4wMDAgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTAiIGhlaWdodD0iMTAiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaENnQUtBTE1BQU5mWDE2T2pvLy8vLytEZzRPbnA2ZWJtNXRyYTJ1WGw1ZWZuNStMaTRnQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQUFBQUFBQUxBQUFBQUFLQUFvQUFBUWZFTWhKcTcwWUMySDJvRUlRaEFGbGlJTUlDa055RktCNElBU1ZCZ1ZCUkFBNyIgLz48L3N2Zz4=\")\n}\n\n.x-resizable-over .x-resizable-handle-northeast, .x-resizable-pinned .x-resizable-handle-northeast {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAiIGhlaWdodD0iMTAiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4zMzMgLTAuNjY3IC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgMC4zMzMgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAtMC42NjcgMC4zMzMgMC4wMDAgMS4wMDAgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTAiIGhlaWdodD0iMTAiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaENnQUtBT01DQU5mWDE2T2pvLy8vLytEZzRPbnA2ZWJtNXRyYTJ1WGw1ZWZuNStMaTR2Ly8vLy8vLy8vLy8vLy8vLy8vLy8vLy95SCtFVU55WldGMFpXUWdkMmwwYUNCSFNVMVFBQ3dBQUFBQUNnQUtBQUFFSUJESVNhdTltQTRoREtkQklJUUNHQXloUVJWSHNwVVRnUndrUlJCRk9GQVJBRHM9IiAvPjwvc3ZnPg==\")\n}\n\n.x-resizable-over .x-resizable-handle-southwest, .x-resizable-pinned .x-resizable-handle-southwest {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAiIGhlaWdodD0iMTAiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4zMzMgLTAuNjY3IC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgMC4zMzMgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAtMC42NjcgMC4zMzMgMC4wMDAgMS4wMDAgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTAiIGhlaWdodD0iMTAiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaENnQUtBTE1BQU5mWDE2T2pvLy8vLytEZzRPbnA2ZWJtNXRyYTJ1WGw1ZWZuNStMaTRnQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQUFBQUFBQUxBQUFBQUFLQUFvQUFBUWhFRWd3UWlpRVRDRHNRZG9rQ0VOeUZKdGhWY0hXQmE4ckdPT3czWGl1NzBBRUFEcz0iIC8+PC9zdmc+\")\n}\n\n.x-resizable-proxy {\n    border-color: #70685c\n}\n\n.x-resizable-overlay {\n    background-color: #181a1b\n}\n\n.x-grid3 {\n    background-color: hsl(200deg 6% 11%)\n}\n\n.x-grid-panel .x-panel-mc .x-panel-body {\n    border-color: #3d4245\n}\n\n.x-grid3-hd-row td {\n    border-left-color: #35393b;\n    border-right-color: #3d4245\n}\n\n.x-grid-row-loading {\n    background-color: #181a1b;\n    background-image: url(\"../ext/resources/images/default/shared/loading-balls.gif\")\n}\n\n.x-grid3-row {\n    border-color: #303436 #353a3c #353a3c\n}\n\n.x-grid3-row-alt {\n    background-color: hsl(200deg 5% 13%)\n}\n\n.x-grid3-resize-marker, .x-grid3-resize-proxy {\n    background-color: #5a6165\n}\n\n.x-grid3-header-pop {\n    border-left-color: #3d4245\n}\n\n.x-grid3-header-pop-inner {\n    border-left-color: #35393b;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAiIGhlaWdodD0iOSI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjI0OSAtMC42MTQgLTAuNjcyIDAuMDAwIDEuMDM1IC0wLjY0NiAwLjI4OCAtMC42NjQgMC4wMDAgMS4wMjAgLTAuNjM2IC0wLjYwOSAwLjI1MCAwLjAwMCAwLjk5NCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIxMCIgaGVpZ2h0PSI5IiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhDZ0FKQUljQUFHRmhZVUQvUUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ0g1QkFNQUFBRUFMQUFBQUFBS0FBa0FBQWdrQUFFSUhEZ3dBSUFBQ0E4bU5FaVFvRUdFRHhjcWpQaHdJa1NJRmhzNlpHanhvc0tBQURzPSIgLz48L3N2Zz4=\")\n}\n\ntd.sort-asc .x-grid3-hd-inner, td.sort-desc .x-grid3-hd-inner, td.x-grid3-hd-menu-open .x-grid3-hd-inner, td.x-grid3-hd-over .x-grid3-hd-inner {\n    background-color: #1b1e1f;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMiIgaGVpZ2h0PSIyMiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIyIiBoZWlnaHQ9IjIyIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBZ0FXQUxNQUFOcmEydWJtNXVYbDVlTGk0dDNkM2R2YjI5N2UzdC9mMzd5OHZPSGg0ZVRrNU9QajQrRGc0TnpjM0FBQUFBQUFBQ0g1QkFBQUFBQUFMQUFBQUFBQ0FCWUFBQVFZTU1ncHFsQnFyY0ZIU2d4empFWkpuRVJUckVEcklrZ0VBRHM9IiAvPjwvc3ZnPg==\")\n}\n\n.x-grid3-cell-text, .x-grid3-hd-text {\n    color: #e8e6e3\n}\n\n.x-grid3-split {\n    background-image: url(\"../ext/resources/images/default/grid/grid-split.gif\")\n}\n\n.x-grid3-hd-text {\n    color: #c8c3bc\n}\n\n.x-dd-drag-proxy .x-grid3-hd-inner {\n    background-color: #1b1e1f;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMiIgaGVpZ2h0PSIyMiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIyIiBoZWlnaHQ9IjIyIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBZ0FXQUxNQUFOcmEydWJtNXVYbDVlTGk0dDNkM2R2YjI5N2UzdC9mMzd5OHZPSGg0ZVRrNU9QajQrRGc0TnpjM0FBQUFBQUFBQ0g1QkFBQUFBQUFMQUFBQUFBQ0FCWUFBQVFZTU1ncHFsQnFyY0ZIU2d4empFWkpuRVJUckVEcklrZ0VBRHM9IiAvPjwvc3ZnPg==\");\n    border-color: #474d50\n}\n\n.col-move-top {\n    background-image: url(\"../ext/resources/images/gray/grid/col-move-top.gif\")\n}\n\n.col-move-bottom {\n    background-image: url(\"../ext/resources/images/gray/grid/col-move-bottom.gif\")\n}\n\n.x-grid3-row-selected {\n    background-image: none;\n    border-color: #474d50;\n    background-color: #35393b!important\n}\n\n.x-grid3-cell-selected {\n    color: #e8e6e3;\n    background-color: #353a3c!important\n}\n\n.x-grid3-cell-selected span {\n    color: #e8e6e3!important\n}\n\n.x-grid3-cell-selected .x-grid3-cell-text {\n    color: #e8e6e3\n}\n\n.x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker, .x-grid3-locked td.x-grid3-row-marker {\n    color: #e8e6e3;\n    border-top-color: #303436;\n    background-color: #36351e!important;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMiIgaGVpZ2h0PSIyMiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIyIiBoZWlnaHQ9IjIyIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBZ0FXQUljQUFHK2czOWZYMTkzZDNkN2UzdC9mMytEZzRPSGg0ZUxpNHVQajQrVGs1T1hsNWVibTV1Zm41K2pvNk9ucDZlcnE2dXZyNit6czdPM3Q3ZTd1N3UvdjcvRHc4QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ0g1QkFBQUFQOEFMQUFBQUFBQ0FCWUFBQWcwQUFVSUdEQ0FBSUVDQlF3WU9IQUFBWUlFQ1JRb1dMQ0FBWU1HRFJ3NGVQQUFBb1FJRVNSSW1EQ0JBb1VLRlFJRUFBQWdJQUE3IiAvPjwvc3ZnPg==\")!important;\n    border-right-color: #1c477f!important\n}\n\n.x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker div, .x-grid3-locked td.x-grid3-row-marker div {\n    color: #c8c3bc!important\n}\n\n.x-grid3-dirty-cell {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAiIGhlaWdodD0iMTAiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4yNDkgLTAuNjE0IC0wLjY3MiAwLjAwMCAxLjAzNSAtMC42NDYgMC4yODggLTAuNjY0IDAuMDAwIDEuMDIwIC0wLjYzNiAtMC42MDkgMC4yNTAgMC4wMDAgMC45OTQgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTAiIGhlaWdodD0iMTAiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaENnQUtBSWNBQU1BQUFQLy8vd0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQU1BQUFFQUxBQUFBQUFLQUFvQUFBZ2RBQUVJRkJpZ1lNR0JBQXdhSEtod1ljS0dCeUZLbkVpeG9zV0pBUUVBT3c9PSIgLz48L3N2Zz4=\")\n}\n\n.x-grid3-bottombar .x-toolbar {\n    border-top-color: #30485d\n}\n\n.x-props-grid .x-grid3-td-name .x-grid3-cell-inner {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMjQiIGhlaWdodD0iMiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIyNCIgaGVpZ2h0PSIyIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhHQUFDQUljQUFORFEwT3ZzN3V6dDcrM3U4Tzd2OGUvdzh2RHg4L0h5OVBuNStRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ0g1QkFBQUFQOEFMQUFBQUFBWUFBSUFBQWdpQUJFSUhFand3QUVEQ0FzVUlEQmdnSUFBQVFBUW5JakFJRUlEQ2hrNmhBZ2dJQUE3IiAvPjwvc3ZnPg==\")!important;\n    color: #e8e6e3!important\n}\n\n.x-props-grid .x-grid3-body .x-grid3-td-name {\n    border-right-color: #35393b;\n    background-color: #181a1b!important\n}\n\n.xg-hmenu-lock .x-menu-item-icon {\n    background-image: url(\"../ext/resources/images/default/grid/hmenu-lock.gif\")\n}\n\n.xg-hmenu-unlock .x-menu-item-icon {\n    background-image: url(\"../ext/resources/images/default/grid/hmenu-unlock.gif\")\n}\n\n.x-grid3-row-expander {\n    background-image: url(\"../ext/resources/images/gray/grid/row-expand-sprite.gif\")\n}\n\n.x-grid3-hd-checker, .x-grid3-row-checker {\n    background-image: url(../img/checkboxes-dark.svg)\n}\n\n.x-grid3-body .x-grid3-td-numberer {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMjQiIGhlaWdodD0iMiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIyNCIgaGVpZ2h0PSIyIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhHQUFDQUljQUFORFEwT3ZzN3V6dDcrM3U4Tzd2OGUvdzh2RHg4L0h5OVBuNStRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ0g1QkFBQUFQOEFMQUFBQUFBWUFBSUFBQWdpQUJFSUhFand3QUVEQ0FzVUlEQmdnSUFBQVFBUW5JakFJRUlEQ2hrNmhBZ2dJQUE3IiAvPjwvc3ZnPg==\")\n}\n\n.x-grid3-body .x-grid3-td-numberer .x-grid3-cell-inner {\n    color: #bdb7af\n}\n\n.x-grid3-body .x-grid3-td-row-icon {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMjQiIGhlaWdodD0iMiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIyNCIgaGVpZ2h0PSIyIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhHQUFDQUljQUFORFEwT3ZzN3V6dDcrM3U4Tzd2OGUvdzh2RHg4L0h5OVBuNStRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ0g1QkFBQUFQOEFMQUFBQUFBWUFBSUFBQWdpQUJFSUhFand3QUVEQ0FzVUlEQmdnSUFBQVFBUW5JakFJRUlEQ2hrNmhBZ2dJQUE3IiAvPjwvc3ZnPg==\")\n}\n\n.x-grid3-check-col {\n    background-image: url(\"../ext/resources/images/default/menu/unchecked.gif\")\n}\n\n.x-grid3-check-col-on {\n    background-image: url(\"../ext/resources/images/default/menu/checked.gif\")\n}\n\n.x-grid-group-hd {\n    border-bottom-color: #3d4245\n}\n\n.x-grid-group-hd div.x-grid-group-title {\n    color: #aca59a\n}\n\n.x-group-by-icon {\n    background-image: url(\"../ext/resources/images/default/grid/group-by.gif\")\n}\n\n.x-show-groups-icon {\n    background-image: url(\"../ext/resources/images/default/grid/group-by.gif\")\n}\n\n.x-grid-empty {\n    color: #988f81\n}\n\n.x-grid-with-col-lines .x-grid3-row td.x-grid3-cell {\n    border-right-color: #353a3c\n}\n\n.x-grid-with-col-lines .x-grid3-row {\n    border-top-color: #353a3c\n}\n\n.x-grid-with-col-lines .x-grid3-row-selected {\n    border-top-color: #44494c\n}\n\n.x-pivotgrid .x-grid3-header-offset table td {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMiIgaGVpZ2h0PSIyMiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIyIiBoZWlnaHQ9IjIyIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBZ0FXQUxNQUFPYm01dkx5OHZIeDhlN3U3dW5wNmVycTZ1Zm41K3ZyNit6czdPL3Y3L0R3OE8zdDdjYkd4dWpvNkFBQUFBQUFBQ0g1QkFBQUFBQUFMQUFBQUFBQ0FCWUFBQVFZTU1ncHFsQXFwY0hIV2doeWpFVkpuRVJqckVEck1rd0VBRHM9IiAvPjwvc3ZnPg==\");\n    background-color: initial;\n    border-left-color: #3d4245;\n    border-right-color: #3d4245\n}\n\n.x-pivotgrid .x-grid3-row-headers {\n    background-color: #1b1e1f\n}\n\n.x-pivotgrid .x-grid3-row-headers table td {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMSIgaGVpZ2h0PSIxIj48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMzMzIC0wLjY2NyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IDAuMzMzIC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgLTAuNjY3IDAuMzMzIDAuMDAwIDEuMDAwIDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjEiIGhlaWdodD0iMSIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoQVFBQkFJQUFBUC8vL3dBQUFDSDVCQUFBQUFBQUxBQUFBQUFCQUFFQUFBSUNSQUVBT3c9PSIgLz48L3N2Zz4=\");\n    background-color: #222426;\n    border-left-color: #35393b;\n    border-right-color: #3d4245;\n    border-bottom-color: #3d4245\n}\n\n.x-dd-drag-ghost {\n    color: #e8e6e3;\n    border-color: #3a3e41 #43494c #43494c #3a3e41;\n    background-color: #181a1b\n}\n\n.x-view-selector {\n    background-color: #2f3335;\n    border-color: #52585c\n}\n\n.x-tree-node-expanded .x-tree-node-icon {\n    background-image: url(\"../ext/resources/images/default/tree/folder-open.gif\")\n}\n\n.x-tree-node-leaf .x-tree-node-icon {\n    background-image: url(\"../ext/resources/images/default/tree/leaf.gif\")\n}\n\n.x-tree-node-collapsed .x-tree-node-icon {\n    background-image: url(\"../ext/resources/images/default/tree/folder.gif\")\n}\n\n.x-tree-node-loading .x-tree-node-icon {\n    background-image: url(\"../ext/resources/images/default/tree/loading.gif\")!important\n}\n\n.x-tree-node .x-tree-node-inline-icon {\n    background-image: none\n}\n\n.x-tree-node-loading a span {\n    color: #bdb7af\n}\n\n.x-tree-no-lines .x-tree-elbow-plus {\n    background-image: url(\"../ext/resources/images/default/tree/elbow-plus-nl.gif\")\n}\n\n.x-tree-no-lines .x-tree-elbow-minus {\n    background-image: url(\"../ext/resources/images/default/tree/elbow-minus-nl.gif\")\n}\n\n.x-tree-no-lines .x-tree-elbow-end-plus {\n    background-image: url(\"../ext/resources/images/gray/tree/elbow-end-plus-nl.gif\")\n}\n\n.x-tree-no-lines .x-tree-elbow-end-minus {\n    background-image: url(\"../ext/resources/images/gray/tree/elbow-end-minus-nl.gif\")\n}\n\n.x-tree-arrows .x-tree-elbow-end-minus, .x-tree-arrows .x-tree-elbow-end-plus, .x-tree-arrows .x-tree-elbow-minus, .x-tree-arrows .x-tree-elbow-plus {\n    background-image: url(\"../ext/resources/images/gray/tree/arrows.gif\")\n}\n\n.x-dd-drag-ghost a, .x-tree-node, .x-tree-node a {\n    color: #e8e6e3\n}\n\n.x-dd-drag-ghost a span, .x-tree-node a span {\n    text-decoration-color: initial;\n    color: hsl(36deg 10% 85%)\n}\n\n.x-tree-node .x-tree-node-disabled a span {\n    color: #988f81!important\n}\n\n.x-tree-node div.x-tree-drag-insert-below {\n    border-bottom-color: #24478f\n}\n\n.x-tree-node div.x-tree-drag-insert-above {\n    border-top-color: #24478f\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below a {\n    border-bottom-color: #24478f\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above a {\n    border-top-color: #24478f\n}\n\n.x-tree-node .x-tree-drag-append a span {\n    background-color: #2b2f31;\n    border-color: #545b5e\n}\n\n.x-tree-node .x-tree-node-over {\n    background-color: #222426\n}\n\n.x-tree-node .x-tree-selected {\n    background-color: #2b2f31\n}\n\n.x-tree-drop-ok-append .x-dd-drop-icon {\n    background-image: url(\"../ext/resources/images/default/tree/drop-add.gif\")\n}\n\n.x-tree-drop-ok-above .x-dd-drop-icon {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTYiIGhlaWdodD0iMTYiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4zMzMgLTAuNjY3IC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgMC4zMzMgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAtMC42NjcgMC4zMzMgMC4wMDAgMS4wMDAgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaEVBQVFBSWNBQURWSlkwWTNLMGc1TEZKQk0xWkVOU0JJb0dkNmxXdCttWFNGbjN5TnBvOStZSnlNYXFHUWJxMmRkN0dnZU5mRllPUFViTy9pZUtpa243MnRncSt2cjcrL3Y1dXB3TUd3aE0vUHo5L2YzLy8vL3dBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQUFBQVA4QUxBQUFBQUFRQUJBQUFBaHNBRFVJSERnUVF3R0NDQWthUEVqUVFrSU5CU0pLcFBCUVlJV0lBak1jZFBqdzRrQ0dEUzFJRUlqaG93YU9BaDBDcUVqd2dnTUdDeFE4ZE9od1FnUUlEd2hvU0lEZ2dJR0VEUVlNRUJCZ0pzdWpKMFZXUkhsU3cwcWtMbUhLVEVoVGcwMmNPbm42QkNxVTZNT0FBRHM9IiAvPjwvc3ZnPg==\")\n}\n\n.x-tree-drop-ok-below .x-dd-drop-icon {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTYiIGhlaWdodD0iMTYiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4zMzMgLTAuNjY3IC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgMC4zMzMgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAtMC42NjcgMC4zMzMgMC4wMDAgMS4wMDAgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaEVBQVFBSWNBQURWSlkwWTNLMGc1TEZKQk0xWkVOU0JJb0dkNmxXdCttWFNGbjN5TnBvOStZSnlNYXFHUWJxMmRkN0dnZU5mRllPUFViTy9pZUtpa243MnRncSt2cjcrL3Y1dXB3TUd3aE0vUHo5L2YzLy8vL3dBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQUFBQVA4QUxBQUFBQUFRQUJBQUFBaHNBRFVJRkdqQmdvU0JDRFZZUUxnUVFNS0hHaTQ0WUxCQWdZWUVDQTRZSUtoUXc0UUlFQjRRZ0lpd3dZQUJBZ0pBWEVpeUpVR0RKRmx5ZE9neTRzU0tGek51N0xqd1k4aVJMazJpVklsaFlJR09FQ3NjRmJnMGFZR2xHWTR1bE1uMHFWVUtMVEU4clRsUWE4S0FBRHM9IiAvPjwvc3ZnPg==\")\n}\n\n.x-tree-drop-ok-between .x-dd-drop-icon {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTYiIGhlaWdodD0iMTYiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4zMzMgLTAuNjY3IC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgMC4zMzMgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAtMC42NjcgMC4zMzMgMC4wMDAgMS4wMDAgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaEVBQVFBSWNBQURWSlkwWTNLMGc1TEZKQk0xWkVOU0JJb0dkNmxXdCttWFNGbjN5TnBvOStZSnlNYXFHUWJxMmRkN0dnZU5mRllPUFViTy9pZUtpa243MnRncisvdjV1cHdNR3doTS9Qei8vLy93QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQUFBQVA4QUxBQUFBQUFRQUJBQUFBaG9BREVJRkZpaGdvU0JDREZVUUxnUVFNS0hHQ3c0WUxCQUFZWUVDQTRZSUtnUXc0UUlFQjRRZ0lpd3dZQUJBZ0lJdk1DUUpBWUtCVndpaEJsejRNS0ZDUXZvM0NuemdzNldKSDI2TEhod0pWQ09EbVZHbkZqeFlzYU5IUmQrRERsU3BrbVVLcFVxRFFnQU93PT0iIC8+PC9zdmc+\")\n}\n\n.x-date-picker {\n    border-color: #6f675b;\n    background-color: #181a1b\n}\n\n.x-date-left, .x-date-middle, .x-date-right {\n    background-image: none;\n    color: #e8e6e3\n}\n\n.x-date-middle .x-btn .x-btn-text {\n    color: #e8e6e3\n}\n\n.x-date-middle .x-btn-mc em.x-btn-arrow {\n    background-image: url(\"../ext/resources/images/gray/toolbar/btn-arrow-light.gif\")\n}\n\n.x-date-right a {\n    background-image: url(\"../ext/resources/images/gray/shared/right-btn.gif\")\n}\n\n.x-date-left a {\n    background-image: url(\"../ext/resources/images/gray/shared/left-btn.gif\")\n}\n\n.x-date-inner th {\n    background-color: #2e3234;\n    background-image: none;\n    border-bottom-color: #474c4f;\n    color: #b0a99f\n}\n\n.x-date-inner td {\n    border-color: #303436\n}\n\n.x-date-inner .x-date-active, .x-date-inner a {\n    color: #e8e6e3\n}\n\n.x-date-inner .x-date-selected a {\n    background-image: none;\n    background-color: #2e3234;\n    border-color: #3a3f41\n}\n\n.x-date-inner .x-date-today a {\n    border-color: #d50000\n}\n\n.x-date-inner .x-date-nextday a, .x-date-inner .x-date-prevday a {\n    color: #b2aca2\n}\n\n.x-date-bottom {\n    border-top-color: #474c4f;\n    background-image: none;\n    background-color: #2e3234\n}\n\n.x-date-inner .x-date-disabled a:hover, .x-date-inner a:hover {\n    color: #e8e6e3;\n    background-color: #2e3234\n}\n\n.x-date-inner .x-date-disabled a {\n    background-color: #222426;\n    color: #bdb7af\n}\n\n.x-date-mmenu {\n    background-color: #222426!important\n}\n\n.x-date-mmenu .x-menu-item {\n    color: #e8e6e3\n}\n\n.x-date-mp {\n    background-color: #181a1b\n}\n\n.x-date-mp-btns button {\n    background-color: #414749;\n    color: #e8e6e3;\n    border-color: #42474a #766e61 #766e61 #42474a;\n}\n\n.x-date-mp-btns {\n    background-image: none;\n    background-color: #2e3234\n}\n\n.x-date-mp-btns td {\n    border-top-color: #474c4f\n}\n\ntd.x-date-mp-month a, td.x-date-mp-year a {\n    color: #c8c3bc\n}\n\ntd.x-date-mp-month a:hover, td.x-date-mp-year a:hover {\n    color: #c8c3bc;\n    background-color: #191b1c\n}\n\ntd.x-date-mp-sel a {\n    background-image: none;\n    background-color: #2e3234;\n    border-color: #3a3f41\n}\n\n.x-date-mp-ybtn a.x-date-mp-prev {\n    background-image: url(../img/collapse-left.svg);\n    background-position: unset;\n}\n.x-date-mp-ybtn a.x-date-mp-next {\n    background-image: url(../img/collapse-right.svg);\n    background-position: unset;\n}\n.x-date-mp-ybtn a.x-date-mp-next:hover, .x-date-mp-ybtn a.x-date-mp-prev:hover {\n    background-position: unset;\n    opacity: 0.5;\n}\n\n\ntd.x-date-mp-sep {\n    border-right-color: #3b4043\n}\n\n.x-tip .x-tip-close {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTUiIGhlaWdodD0iMTUiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4zMzMgLTAuNjY3IC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgMC4zMzMgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAtMC42NjcgMC4zMzMgMC4wMDAgMS4wMDAgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTUiIGhlaWdodD0iMTUiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaER3QVBBSWNBQUdWbFpVRC9RSXVMaTQrUGo1T1RrNWVYbDV5Y25LQ2dvS1NrcEx5OHZMMjl2YjYrdnIrL3Y4REF3TUhCd2NMQ3dzWEZ4Y2ZIeDlIUjBkTFMwdDNkM2VqbzZPL3Y3L0h4OGZQejgvVDA5UFgxOWZiMjl2ZjM5L2o0K1BuNStmcjYrdnY3Ky96OC9QMzkvZjcrL3YvLy93QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQU1BQUFFQUxBQUFBQUFQQUE4QUFBaXBBQU5NR0Vpd0lNRUFFaWlRV01pd0lRa0tFaHFBK0FBQ1JJaUxHRU5ZZk1BQWhJZUtHVEZXZE5EUkE0Q1RHRThDR01uZ3cwY0JBZ0NJQUFCVFJNVUdEVnhXSERBQUFFOFJOa0U0V0pBaFE0Y09Id2dvbmZpaHd3YVNSWTkrS0VDVnFkTUhSREZ3NEdDZ2ExY1BIamhzYU1BZ2c5WURhRDJnUFJEMnFZSU1GeERJOWREQmcxd0VHalEwSUhxaDZOYWpIYmJtZFFDaEFnaWdJMFk0SkhFaFFvQUVrQ05Mamh3Z0lBQTciIC8+PC9zdmc+\")\n}\n\n.x-tip .x-tip-bc, .x-tip .x-tip-bl, .x-tip .x-tip-br, .x-tip .x-tip-ml, .x-tip .x-tip-mr, .x-tip .x-tip-tc, .x-tip .x-tip-tl, .x-tip .x-tip-tr {\n    background-color: hsl(25deg 20% 15%)\n}\n\n.x-tip .x-tip-body, .x-tip .x-tip-header-text {\n    color: #bdb7af\n}\n\n.x-form-invalid-tip .x-tip-bc, .x-form-invalid-tip .x-tip-bl, .x-form-invalid-tip .x-tip-br, .x-form-invalid-tip .x-tip-ml, .x-form-invalid-tip .x-tip-mr, .x-form-invalid-tip .x-tip-tc, .x-form-invalid-tip .x-tip-tl, .x-form-invalid-tip .x-tip-tr {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iNTAwIiBoZWlnaHQ9IjgyNCI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSI1MDAiIGhlaWdodD0iODI0IiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGg5QUU0QTRjQUFFRC9RS0V4SDlSV1J0aHhadDJMaGQzZDNlN3U3di8vL3dBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ0g1QkFNQUFBQUFMQUFBQUFEMEFUZ0RBQWovQUFFSUJFQkF3TUNEQ0JNcVhNaXdvY09IRUNOS25FaXhvc1dMR0ROcTNNaXhvOGVQSUVOMkZFQkFvWUFBQVVTcVhNbXlwY3VYTUdQS25FbXpwa0tVQmcrZUhIREFwcytmUUlNS0hVcTBxTkdCQndZRXlBbGc1d0VEUjZOS25VcTFxdFdySHcwa1hVb3dBRThEQmJDS0hVdTJyTm16S3d0b1ZWb3d3Tk1DUGRIS25VdTNybDJxQjlRZVdIcnliZHk3Z0FNTEhrd1lZMTZ0U3dsNGZWdTRzZVBIa092cVpkdDBNZFRJbUROcjNneDBMVmVCVGptTEhrMjZ0TWF0VEVHak5NMjZ0ZXZXT0JVV2ZFMjd0dTNHSkEraTNNMjd0Ky9md0lNTEgwNjh1UEhqeUpNclg4Njh1ZlBuMEtOTG4wNjl1dlhydlFkbzM4Njl1L2Z2NE1PTC94OVB2cno1OCtqVHExL1B2cjM3OS9Eank1OVB2Nzc5Kzl3TjZOL1B2Ny8vL3dBR0tPQ0FCQlpvNElFSUpxamdnZ3cyNk9DREVFWW80WVFVVm1qaGhmd1ZvT0dHSEhibzRZY2doaWppaUNTV2FPS0pLS2FvNG9vc3R1amlpekRHS09PTU5OWm80NDBjWXFqampqejI2T09QUUFZcDVKQkVGdW5mQVVnbXFlU1NURGJwNUpOUVJpbmxsRlJXYWVXVldHYXA1WlpjZHVubGwyQ0dLZWFZWkpacDVwbG9wcW5tbW15MjZlYWJjTVlwSjVSRzFtbm5uWGptcWVlZWZQYlpINDZBQmlyb29JUVdhdWloaUNhcTZLSWUrdW5vbzVCR0t1bWtsR0tJMzZXWVpxcnBwcHgyNnVtbm9JWXFxbmZZbFdycXFhaW1xdXFxckxicTZxdXcvdjgyQUZoejFtcnJyYmptcXV1dXZPcXFsbEplMGRycnNNUVdhK3l4eUNaYjVxOG96UXFYc3RCR0srMjAxRmFySnJQQlBtdnR0dHgyNisyM3lXTHJMTGprbG12dXVlaUdLYTZ3NmJicjdydndncnV1dHZIV2ErKzkrT0k2Yjc3ODl1dnZ2K29hQU95NEFCZHM4TUVJSHpZd3V3azM3UERENSs0TDhjUVVWeXl0eEJabnJQSEd0MkxNOGNjZ2g3eXN3TTB5TFBMSktLZE1wY2NxdCt4eXl5eS9MUFBNRzhkTTg4MDROMnh6emp6M3pPL09QZ2N0ZEx0QUQyMzAwZDBXamZUU1RDdXJkTk5RUjczcjAxSlhiVFdjVkYrdDlkWm1aczMxMTJCejZYWFlaSmN0NWRobXA2MDJrbWl2N1hiWWJiOHR0OVp4ejIxMzFIWGZyVGZTZWUvLzdYZlFmZjh0T002QkQyNzR5NFVmcmpqS2lTL3UrTWVOUHk2NXhaRlBidm5EbFYrdStjR1piKzY1djUxL0x2cTlvWTl1K3J1bG42NTZ4Q1JudS9yckZLY08rK3pieWs3NzdSZTNUakR1dlBkcmUrL0FFL3Q3OE1UN3Fydkp4U2R2N3ZES040LzE4ZlE2THoyM3pFOXYvWm5WWDYrOW1ObHY3MzJYM1g4dlBwYmhqMi8rbE9XZnI3NlQ2YS92ZnBMdHYrOSsvUEtyVDMvOTV0K1B2L2o2Nys5OS8vN1RIZ0FEYUwwQkVsQjZCanhnOHhLb3dPUXhzSUhFZXlBRWdTZkJDZkt1Z2hhOEhRWXpPTHNOY3ZCMUh2eWc2a0lvUXRPUnNJU2lPeUVLUGFmQ0ZXcXVoUzYwSEF4aktMa1owdEJ4TnJ5aDRuS29ROFB4c0llQyt5RVEvLzBteENIcXJZaEd0QnNTa3lpM0pUTFJiVTU4b3RxaUtFV3pVYkdLWkxzaUZzR214UzF5cll0ZXBCdjB3aGhBTUpLeGFtWThJOTdHcU1iNnBiR05USHNqSFBuR3hqbXVUNDUySEJvZTh3aTRPdkp4Zkh2OEk4OENLVWpDK2JHUTJ5TWtJbWVteUVVaTdwQ09uRjRqSTZteVNWS1NjWkM4cFBJc3FjbVFjYktUa01za0tJUDN5VkZxckpTbXBKd29VNGs3VkxKeVlxNThKZVpXS1V2WXhiS1dDYnNsTGpsSHkxMmVUcGUrQkJnd2d3bTZYaEx6YzhNOFpyNlNxVXpTR2JPWmwyTW1OT01seldtaTdwbldmRncxczVtdWJYS1RkUXVMM2pkZmlNMXgrckNjNWd3aU90Tkp4SFd5ODRqdWZLY1M0eW5QSnRLem5sQzhKejZucVAvUGZWcXhuLzdNSWtBRHlzV0JFdlNMQmoyb0dNT3AwTU41czZGT1N5aEVwZmJRaVI2cm9oWXRGa1l6T3F5TmNwUlhIdjJvOFJncTBubVN0S1QyUENsSzg2blNsZkt6cFM3OUoweGpLdENaMHJTZ05yMHBRbk9xMDRXV1RKdzkzZWxQZzFxMmtCS1ZUVVk5NnJVa3FsU1pKYldwMkdNcVZHRW0xYW1tN0tsV0hSTldzeG93bm5MVmFGdjlxcGZDS2xheFZiV3NIQ01yV3JPazFyVmVxYTF1clJKYzQ0cStzOUkxZG5hOUs4VG1xdGNuOGJXdlRmb3JZSmNrMk1IQ0w2K0c1YVZYRTF0SnhESldtSTU5YkRFWEsxbVJGVGF4bHpWc1pnZTdXY0IydHErZjFXdG83enBhdXBZMnJxZDFhMnJYdWxxMHRyYXNyeFZyYkw4Nlc2Ny8xamFydDdWcWJxZTZXNmoydHFtL1ZXcHdqenBjb2hZM3FNZnRhWEoxdXR5Yk5wZW16NDFwZEYwNjNaVldGNlhYTFdsMlJicmRqM2FYbzkvTmFIZ3RPdDZKbGhlaTUyMW9laFc2M29PMmw2RHZEV2g4L1RuZmZkWVhuL2V0WjM3bHVkOTM5cGVkLzAxbmdNMDU0SEVXK0pzSDVtYUNzN2xnYXpaNG1nK0dab1NiT1dGbFZ2aVlGeVptaG9PNVlWOTJlSmNmeG1XSWF6bGlXWmI0bFNkbVpZcFR1V0pUdG5pVUx3WmxqRHM1WTAzVytKSTNwbVNPSTdsalIvWjRrVDlHWkpBTE9XUkJGdm1QUitaamt2TzRaRHMyZVk1UGhtT1UyemhsTlZiNWpGY21ZNWJEdUdVdmRubUxYOFppbUtzNFppbVcrWWxuWm1LYWs3aG1JN1o1LzRodkJtS2NlemhuSGRiNWhuZW1ZWjVqdUdjWDlubUZmMFpob0VzNGFCRVcrb09INW1DaU03aG9Delo2Z28rR1lLUWJPR2tGVnZxQWx5Wmdwc3NZMmNvdXM5T2VkaVpsUTUxV1VKT2FtcVkrOVRWSHJXcFZzcnJWZUgwMXJQZWE2bG1EYzZpMlB0bW0vYmZyL2ZVYWY3OTJZNjF6VGE1Z3k4L1k3MFAyL0laTjdHOHArNDdNYm5iU29pM3QybEc3MnRWNnR2MnVqZTFwYWZ0ODM4NGZ0N3NkclhBRGN0emtqcWlzMCswN2RMUDdvdTUrdDBiakxlK08wcnZlSUwwM3ZrZUs2MzNyVE4vKzdoakFBMTRyYy9OdjRBU1hrOEcvdC9EL0lUemh6MXMzeEx2NThJbTNxZUdKckxqRjE0UnhBV3A4NDJucStQVkVYc0NQZ3p5cUV2OC91YnhNcm5JeWtWeVNMRzg1OTJJdWN6QzlISUUwci9sWWM2NXpzNmE4NTlubU9kRFpLdlNodjdYb1JwY3IwcE5lMTU4elhkMzlmdnF0WFNkMWROM2NlVmRmNE5LcnpyNnRjNTFKV2QrazE3K3VwTEE3Y094a1p4dmEwMjcyNHJVOWdtc24rOXRKR2Zldno1MkNkZWY2M1h1Mzl3dm12ZXA5YitYZnBSNTREUTcrNllXblhlSTdlSGltTDk2V2pVLzY0MEVZZWFOUGZuV1hIMkhsaDU3NVgyNGU2SjAzNGVkN0h2clJsVDZGbzlmNTZaR1orcHF2bm9XdGwvbnJOemQ3Y2pvOTdiMnFmVFJqMzNMZHk1RDNLdmY5NUlSZlErQ2ZuUGphTkQ3SWtZOUQ1VytjK1l1RC9nNmRiM0hwTzVUNkU3ZitPVytQKzZsaEgrTGFIMXovK05YSi9lN25hdngvUTM4N3kyOStnYk8vL1FYL2ZzTFZ2emY2dy9QOThGZTQvQWx1Lzd2MTM2UlJsMy9ldG44QjkzOXpZNEFwRllBQ1dHNEU2RzhJK0RZUHlGSUt1SUJRUjNVVW1EdjRkNEZJMVlEN0ZvRnI0NEV2TllFYWFDd2dtRFlsS0ZNaU9JTEN3NEg0ZG9KRnhZTDE1b0kxbFlJcW1Ic3dLRzh5Q0RjMytHNDVpRk0wV0lQZWw0RkEyRFU3eUc0OStEVkhLRlFXT0lUekpvUk1xRlZGbUc1SnVEVlQ2Rk5MK0lRMjZJUllhSE5SU0c1VmVEVmZhRFZoaUVaZDJHMWpTRkZsaUcxbnVFWmF1SVU3MTRadTZITS9HSWR4c29aUVk0ZE5nNGR4bEliVnBvZEw0NGQwQklkMFNIU0NPSWhIVjRpR3FIU0ltSWhOTjRlTS84aHhmQ2h0Z0hnMGt3aFdrZGhzbGFoSGwwaHNtU2cwbmRoSGkvaUlVUEtKUGtPS1BXT0tnN1NKdVlhS09jT0toaFNLb3RoMXNCaUxZS2VLdHVhS040T0xOS09MakdTTHM4YUxUdVdMc0FhTWp6U0x0Rmgyd3RocXhPZ3l5MGhWeG5pTWF2ZU0wTmlNalNXTngwaU5WNVdNcW9hTm1HU050TWlOdXFhTnB3YU9saVdPcEVhT25tU09vWWFPSU1PT29lU05zZWlPcFFhUG9paVBOYU9Pbm1hUHA0U1BsYVdQR2VPUHJ1YUkwT2h5L0NoWkFGa3hCeGxyQWptUU0wZVBqNWlRc0ZTUWp3V1J0T2FRakVpUnMyU1JpWWlSRHNPUi82YVJodWlSdVNTUmpDV1NDR09TaXJXUURNbUZJRG1JS0drd0wxa3dNUWxaTFVtSE0va3ZOLzg1V1NxNWttKzRrendwaDFmNGt5am5rMEpKaUVSWmxJZDRsRWlwaUVxNWxJMFlsRTdaVlUwWmxhTklrcGhsbFpxRmxaeWxsWjdGbGFEbGxhSUZscVFsbHFaRmxxaGxscXFGbHF5bGxxN0ZsckRsbHJJRmw3UWxsN1pGbDdobGw3cUZsN3lsbDc3Rmw4RGxsOElGbU1RbG1NWkZtTWhsbU1xRm1NeWxtTTdGbU5EbG1OSUZtZFFsbWRaRm1kaGxtZHFGbWR5bG1kN0ZtZURsbWVJRm11UWxtdVpGbXVobG11cUZtdXlsbXU3Rm12RGxtdklGbS9RbG0vWkZtL2hsbS9xRm0veWxtLzdGbXdEbW13SUduQVFtbkFaR25BaG1uQXFHbkF5bW5BN0duQkRtbkJJR25SUW1uUlpHblJobW5ScUduUnltblI3R25TRG1uU0lHbmlUL0pwNG1ScDRvWnA0cWhwNHNwcDR1eHA0dzVwNHlCcDgwSnA4MlJwODRacDg2aHA4OHBwOCt4cDlBNXA5Q0JxQkVKcUJHUnFCSVpxQktocUJNcHFCT3hxQlE1cUJTQnFGVUpxRldScUZZWnFGYWhxRmNwcUZleHFGZzVxRmlCcUprSnFKbVJxSm9acUpxaHFKc3BxSnV4cUp3NXFKeUJxTjBKcU4yUnFONFpxTjZocU44cHFOK3hxT0E1cU9DQnFTRUpxU0dScVNJWnFTS2hxU01wcVNPeHFTUTVxU1NCcVdVSnFXV1JxV1lacVdhaHFXY1ZwTnhtSlB0eHFWdTZLVS9vNlc4UnFhK1pxYkFocWJDQnFaYktLYWZ4cVpZNktiNElxZWlOcFZVS1l0MmVxZTFDS2RQU0tmMjRxZjFBcWlveHFkTUtLandZcWlybHFkNmlveUVORHFFaU9vdWowbzBhbnBzazVwc2xicHNqUXFFa1VweG1WcURtMnAxbHdwdG5hcUNuenAxdTdPb1gxS3F5eE9xMjZZVUFRRUFPdz09IiAvPjwvc3ZnPg==\")\n}\n\n.x-form-invalid-tip .x-tip-body {\n    background-image: url(\"../ext/resources/images/default/form/exclamation.gif\")\n}\n\n.x-tip-anchor {\n    background-image: url(\"../ext/resources/images/gray/qtip/tip-anchor-sprite.gif\")\n}\n\n.x-menu {\n    background-color: #202325\n}\n\n.x-menu-floating {\n    border-color: hsl(200 6% 20% / 1);\n    border-width: 2px;\n    border-radius: 6px;\n    box-shadow: 5px 5px 10px rgba(0, 0, 0, 0.5);\n}\n\n.x-menu-nosep {\n    background-image: none\n}\n\n.x-menu-item-arrow {\n    background-image: url(\"../ext/resources/images/gray/menu/menu-parent.gif\")\n}\n\n.x-menu-sep {\n    background-color: #2a2d2f;\n    border-bottom-color: #303436\n}\n\na.x-menu-item {\n    text-decoration-color: initial;\n    color: #d3cfc9\n}\n\n.x-menu-item-active {\n    background:  unset;\n    border:  unset;\n    margin:  unset;\n    padding: 1px;\n    background-color: #2f3537;\n    border-color: #474d50;\n    /* border: 1px solid red; */\n}\n\n.x-menu-item-active a.x-menu-item {\n    border:  unset;\n    margin:  unset;\n    border-color: #474d50\n}\n\n.x-menu-check-item .x-menu-item-icon, .x-menu-item-checked .x-menu-item-icon {\n    background-image: url(../img/checkboxes-dark.svg)\n}\n\n.x-menu-item-checked .x-menu-group-item .x-menu-item-icon {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTYiIGhlaWdodD0iMTYiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4yNDkgLTAuNjE0IC0wLjY3MiAwLjAwMCAxLjAzNSAtMC42NDYgMC4yODggLTAuNjY0IDAuMDAwIDEuMDIwIC0wLjYzNiAtMC42MDkgMC4yNTAgMC4wMDAgMC45OTQgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaEVBQVFBTlVpQURrNU9UMDlQVFUxTlZCUVVEYzNOM0J3Y0RBd01FQkFRRU5EUTJSa1pFOVBUenM3T3pvNk9qWTJOajQrUGxkWFZ5NHVManc4UEMwdExTOHZMMDVPVG1ob2FFbEpTV1ZsWldCZ1lHRmhZVjlmWHl3c0xEZzRPR0ppWWtSRVJISnlja1ZGUldscGFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDSDVCQUVBQUNJQUxBQUFBQUFRQUJBQUFBWkVRSkZ3U0N3YWo4aWtja2tzQkFDaDVXZWdRREFTeWNMZ1FVRUVCTmlqZzJvNUxBZ1RKQURrT1R3RkVHUmxFWWdBR29aTThrTGdDQXdhU3gwU0d4aE1oNGlKaWtFQU93PT0iIC8+PC9zdmc+\")\n}\n\n.x-menu-group-item .x-menu-item-icon {\n    background-image: none\n}\n\n.x-menu-plain {\n    background-color: #181a1b!important\n}\n\n.x-menu .x-date-picker {\n    border-color: #474c4f\n}\n\n.x-cycle-menu .x-menu-item-checked {\n    background-color: #202324;\n    border-color: #44494c!important\n}\n\n.x-menu-scroller-top {\n    background-image: url(\"../ext/resources/images/default/layout/mini-top.gif\")\n}\n\n.x-menu-scroller-bottom {\n    background-image: url(\"../ext/resources/images/default/layout/mini-bottom.gif\")\n}\n\n.x-box-tl {\n    background-image: url(\"../ext/resources/images/default/box/corners.gif\")\n}\n\n.x-box-tc {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMSIgaGVpZ2h0PSIzMiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIxIiBoZWlnaHQ9IjMyIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBUUFnQUljQUFNSEJ3Y2pJeU52YjIrVGs1T3pzN083dTd1L3Y3L0R3OFBIeDhmUHo4L1QwOVBYMTlmYjI5dmYzOS9qNCtQbjUrZnI2K3Z6OC9QMzkvZjcrL3YvLy93QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ0g1QkFBQUFQOEFMQUFBQUFBQkFDQUFBQWdrQUJrTUNDQ0Jna0VLQlJJV1lBQkFBQUVLRXlSRWdQREFRUU1HQ3hRa1FIREFRSUdBQURzPSIgLz48L3N2Zz4=\")\n}\n\n.x-box-tr {\n    background-image: url(\"../ext/resources/images/default/box/corners.gif\")\n}\n\n.x-box-ml {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iNCIgaGVpZ2h0PSIxIj48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMzMzIC0wLjY2NyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IDAuMzMzIC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgLTAuNjY3IDAuMzMzIDAuMDAwIDEuMDAwIDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjQiIGhlaWdodD0iMSIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoQkFBQkFJY0FBTUhCd2R6YzNPenM3UDcrL2dBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNINUJBQUFBUDhBTEFBQUFBQUVBQUVBQUFnSEFBVUVBREFnSUFBNyIgLz48L3N2Zz4=\")\n}\n\n.x-box-mc {\n    background-color: #222426;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMSIgaGVpZ2h0PSIzMiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIxIiBoZWlnaHQ9IjMyIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBUUFnQUljQUFNSEJ3Y2pJeU52YjIrVGs1T3pzN083dTd1L3Y3L0R3OFBIeDhmUHo4L1QwOVBYMTlmYjI5dmYzOS9qNCtQbjUrZnI2K3Z6OC9QMzkvZjcrL3YvLy93QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ0g1QkFBQUFQOEFMQUFBQUFBQkFDQUFBQWdrQUJrTUNDQ0Jna0VLQlJJV1lBQkFBQUVLRXlSRWdQREFRUU1HQ3hRa1FIREFRSUdBQURzPSIgLz48L3N2Zz4=\");\n    color: #c4bfb7\n}\n\n.x-box-mr {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iNCIgaGVpZ2h0PSIxIj48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMzMzIC0wLjY2NyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IDAuMzMzIC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgLTAuNjY3IDAuMzMzIDAuMDAwIDEuMDAwIDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjQiIGhlaWdodD0iMSIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoQkFBQkFJY0FBTUhCd2R6YzNPenM3UC8vL3dBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNINUJBQUFBUDhBTEFBQUFBQUVBQUVBQUFnSEFBY0FDQ0FnSUFBNyIgLz48L3N2Zz4=\")\n}\n\n.x-box-bl {\n    background-image: url(\"../ext/resources/images/default/box/corners.gif\")\n}\n\n.x-box-bc {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMSIgaGVpZ2h0PSIzMiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIxIiBoZWlnaHQ9IjMyIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBUUFnQUljQUFNSEJ3Y2pJeU52YjIrVGs1T3pzN083dTd1L3Y3L0R3OFBIeDhmUHo4L1QwOVBYMTlmYjI5dmYzOS9qNCtQbjUrZnI2K3Z6OC9QMzkvZjcrL3YvLy93QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ0g1QkFBQUFQOEFMQUFBQUFBQkFDQUFBQWdrQUJrTUNDQ0Jna0VLQlJJV1lBQkFBQUVLRXlSRWdQREFRUU1HQ3hRa1FIREFRSUdBQURzPSIgLz48L3N2Zz4=\")\n}\n\n.x-box-br {\n    background-image: url(\"../ext/resources/images/default/box/corners.gif\")\n}\n\n.x-box-blue .x-box-bl, .x-box-blue .x-box-br, .x-box-blue .x-box-tl, .x-box-blue .x-box-tr {\n    background-image: url(\"../ext/resources/images/default/box/corners-blue.gif\")\n}\n\n.x-box-blue .x-box-bc, .x-box-blue .x-box-mc, .x-box-blue .x-box-tc {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMSIgaGVpZ2h0PSI0MiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIxIiBoZWlnaHQ9IjQyIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBUUFxQUljQUFLTEc5S1RIOUtmSjlhbks5YXZNOWE3TjlyRFA5ckxROXJYUjk3ZlQ5N3JVK0x6VytMN1grTnZiMjhIWitjWGIrY2pkK2N6ZytzL2krdExrK3RibSt0cnArOS9zKytUazVPenM3T1B2L09qeS9QYjI5djM5L1FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ0g1QkFBQUFQOEFMQUFBQUFBQkFDb0FBQWd3QURkY0FNQkJnMEVORGhJNjJBQ2dBUVlOR1N4VW9FQmhnb1FJRUI0NEFCQkF3QUFDQlF3Y1FKQkF3UUlHRGdJQ0FEcz0iIC8+PC9zdmc+\")\n}\n\n.x-box-blue .x-box-mc {\n    background-color: #2b2e30\n}\n\n.x-box-blue .x-box-mc h3 {\n    color: #a0c7e7\n}\n\n.x-box-blue .x-box-ml {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iNCIgaGVpZ2h0PSIxIj48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMzMzIC0wLjY2NyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IDAuMzMzIC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgLTAuNjY3IDAuMzMzIDAuMDAwIDEuMDAwIDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjQiIGhlaWdodD0iMSIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoQkFBQkFJY0FBS0xHOU56YzNPenM3UDcrL2dBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNINUJBQUFBUDhBTEFBQUFBQUVBQUVBQUFnSEFBVUVBREFnSUFBNyIgLz48L3N2Zz4=\")\n}\n\n.x-box-blue .x-box-mr {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iNCIgaGVpZ2h0PSIxIj48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMzMzIC0wLjY2NyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IDAuMzMzIC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgLTAuNjY3IDAuMzMzIDAuMDAwIDEuMDAwIDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjQiIGhlaWdodD0iMSIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoQkFBQkFJY0FBS0xHOU56YzNPenM3UC8vL3dBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNINUJBQUFBUDhBTEFBQUFBQUVBQUVBQUFnSEFBY0FDQ0FnSUFBNyIgLz48L3N2Zz4=\")\n}\n\n.x-combo-list {\n    border-color: #3e4446;\n    background-color: #2b2f31;\n    box-shadow: 0 0 5px 3px #2c2ab0;\n}\n\n.x-combo-list-inner {\n    background-color: #212121;\n}\n\n.x-combo-list-hd {\n    color: #c8c3bc;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMSIgaGVpZ2h0PSI5OCI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIxIiBoZWlnaHQ9Ijk4IiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBUUJpQUljQUFNbmUrc3pmK3MvaCt0SGordFRsKzlmbSs5cm8rOTNxL09Ecy9PUHQvT1h2L09qeC9ldnovZTcxL1FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ0g1QkFBQUFQOEFMQUFBQUFBQkFHSUFBQWdnQUJzd1dLQWdBWUlEQmdvUUdDQWdBSUNIRUNOS25FaXhvc1dMR0ROU0RBZ0FPdz09IiAvPjwvc3ZnPg==\");\n    border-bottom-color: #43484b\n}\n\n.x-resizable-pinned .x-combo-list-inner {\n    border-bottom-color: #42484b\n}\n\n.x-combo-list-item {\n    border-color: #303436\n}\n\n.x-combo-list .x-combo-selected {\n    background-color: #494949;\n    border-color: #655e53!important\n}\n\n.x-combo-list .x-toolbar {\n    border-top-color: #43484b\n}\n\n.x-panel {\n    border-color: #3d4245\n}\n\n.x-panel-header {\n    border-color: #3d4245;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMSIgaGVpZ2h0PSIzMDAiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4zMzMgLTAuNjY3IC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgMC4zMzMgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAtMC42NjcgMC4zMzMgMC4wMDAgMS4wMDAgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMSIgaGVpZ2h0PSIzMDAiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaEFRQXNBZmNBQU5mWDE5alkyTnJhMnR2YjI5emMzTjdlM3VEZzRPTGk0dVBqNCtYbDVlZm41K2pvNk9ucDZldnI2K3pzN08zdDdlN3U3dkR3OFAvLy93QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFDd0FBQUFBQVFBc0FRQUlRUUFGU0lnQTRZR0RCZ3dXS0VpQUFNRUJBd1VLRUJnZ0lBQ0FpeGd6YXR6SXNhUEhqeUJEaWh4SjBxT0VreWhUcWx6SnNxWExsekJqeXB4SnM2Wk1BUUVCQURzPSIgLz48L3N2Zz4=\")\n}\n\n.x-panel-body {\n    border-color: #3d4245;\n    background-color: transparent;\n}\n\n.x-panel-bbar .x-toolbar, .x-panel-tbar .x-toolbar {\n    border-color: #3d4245\n}\n\n.x-panel-body-noheader, .x-panel-mc .x-panel-body, .x-panel-mc .x-panel-tbar .x-toolbar, .x-panel-tbar-noheader .x-toolbar {\n    border-top-color: #3d4245\n}\n\n.x-panel-tl .x-panel-header {\n    color: #c8c3bc\n}\n\n.x-panel-tc {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMSIgaGVpZ2h0PSIzMDAiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4zMzMgLTAuNjY3IC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgMC4zMzMgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAtMC42NjcgMC4zMzMgMC4wMDAgMS4wMDAgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMSIgaGVpZ2h0PSIzMDAiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaEFRQXNBWWNBQU03T3p0ZlgxOWpZMk5yYTJ0dmIyOXpjM04zZDNkN2UzdURnNE9IaDRlTGk0dVBqNCtYbDVlYm01dWZuNStqbzZPbnA2ZXZyNit6czdPM3Q3ZTd1N3ZEdzhQSHg4ZlgxOWYvLy8vLy8vd29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0NpSDVCQUFBQVA4QUxBQUFBQUFCQUN3QkFBaEVBQWRncUVCaGdvUUlFQjQ0WUxCZ2dRSUVCdzRVSURCQVFJQ0xHRE5xM01peG84ZVBJRU9LSEVuU280V1RLRk9xWE1teXBjdVhNR1BLbkVtenBzc0xPRE1NQ0FnQU93PT0iIC8+PC9zdmc+\")\n}\n\n.x-panel-bl, .x-panel-br, .x-panel-tl, .x-panel-tr {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTIiIGhlaWdodD0iMzAwIj48ZGVmcz48ZmlsdGVyIGlkPSJkYXJrcmVhZGVyLWltYWdlLWZpbHRlciI+PGZlQ29sb3JNYXRyaXggdHlwZT0ibWF0cml4IiB2YWx1ZXM9IjAuMzMzIC0wLjY2NyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IDAuMzMzIC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgLTAuNjY3IDAuMzMzIDAuMDAwIDEuMDAwIDAuMDAwIDAuMDAwIDAuMDAwIDEuMDAwIDAuMDAwIiAvPjwvZmlsdGVyPjwvZGVmcz48aW1hZ2Ugd2lkdGg9IjEyIiBoZWlnaHQ9IjMwMCIgZmlsdGVyPSJ1cmwoI2RhcmtyZWFkZXItaW1hZ2UtZmlsdGVyKSIgeGxpbms6aHJlZj0iZGF0YTppbWFnZS9naWY7YmFzZTY0LFIwbEdPRGxoREFBc0FZY0FBRXIvU3RmWDE5alkyTnJhMnR2YjI5emMzTjdlM3VEZzRPSGg0ZUxpNHVQajQrVGs1T1hsNWVibTV1Zm41K2pvNk9ucDZlcnE2dXZyNit6czdPM3Q3ZTd1N3UvdjcvRHc4UEh4OGZMeTh2UHo4L1gxOWZiMjl2ZjM5L2o0K1ByNit2djcrLy8vL3dBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNINUJBRUFBQUFBTEFBQUFBQU1BQ3dCQUFqL0FBRU1HRWl3b01BQklSSXFURWp3dzRXSEVCOStHT2loZ3NXTEZqME03RUNobzhlT0hRWnltRUN5SkVrT0F6ZElXTWx5NVlhQkdpREluQ2xUdzhBTUQzTHF6SmxoSUFZSFFJTUN4VERRQW9PalNJOWFHRWhCZ2RPblRpa3doUXBWNm9BSkNiSnF6VHBoWUlRRFlNT0NqVER3Z1lHemFNOCtLSnMyN2RvQkRRckluU3Uzd1VBR0JQTHF6Y3RnNElLQ0JmOE9TQ0Nnc09IQ0NRWWlDTUM0TVdNRWloMDdoanhnc2VUSGtTOEhvR3o1TW1mTm16TjdGaTM1czJiVG95dURSbDJhOUdUWGpWbS9WbjBhTm1iYXFUdTN4cjFiOTJ6ZnNXMkg1djE3dFhEWndZa25CMzZiK1hEbnlKc2JWeTY5TnZYbjA2RWYzMzQ5T25icjJydHovdzlQUHJ0NThPZHpwKys5dmpqNjkrcmhzNWZ2UHI3OStmZnI0OSt2di8veTl2L1JGMkIrQS9KWG9IL1ZFWmlnZ1FzaStKMkNEeklZb1lQZVZUZ2VnQTBlcUdHR0hFNjRvWWNkV2lqZWlPVUpHT0tGSm9Lb29vZ2xRc2dpaHNPQmdNR01OTTRJd2tBeTFrampqUVBrcUNNR1BQcW9ZNUEvMm9oamtVQWVXU1NSU3lyNUk1TlBPam1rbERWQ09XV1BTRnBaSlpVN2Nta2tsazJDR2FXWVZ3cTVKWmxubXRrbG1tdXErYVdiU2JMNVpwWmV4Z21ubG0zU0thZWRldDVaSjU1emh1bm5ub0R5S1dpZmlCNnE2SmlETnBvb280K1dHV21haythNXFLU1hVcHFwcFpCdUdtaW5vR0lhcXFhamNpcnFxYVNpYW1xcXJLN3E2cWVxd2xmYXFxeXZHbG9xcmJqYUdxdXVzL0phYTZIQS9pa3NvY002NnFtdnVRWkw3TExHM29yc3M4bzJ1MnUwbFNaYmJMWFFYbnNzdGR0cTZ5eTMzM283TFk0YmxHdHV1VUdlZTI2NjZxSkwwRUlMRFhRUVlBUUJFQkFBT3c9PSIgLz48L3N2Zz4=\");\n    border-bottom-color: #3d4245\n}\n\n.x-panel-bc {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMSIgaGVpZ2h0PSIzMDAiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4zMzMgLTAuNjY3IC0wLjY2NyAwLjAwMCAxLjAwMCAtMC42NjcgMC4zMzMgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAtMC42NjcgMC4zMzMgMC4wMDAgMS4wMDAgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMSIgaGVpZ2h0PSIzMDAiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvZ2lmO2Jhc2U2NCxSMGxHT0RsaEFRQXNBWWNBQU03T3p0ZlgxOWpZMk5yYTJ0dmIyOXpjM04zZDNkN2UzdURnNE9IaDRlTGk0dVBqNCtYbDVlYm01dWZuNStqbzZPbnA2ZXZyNit6czdPM3Q3ZTd1N3ZEdzhQSHg4ZlgxOWYvLy8vLy8vd29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0NpSDVCQUFBQVA4QUxBQUFBQUFCQUN3QkFBaEVBQWRncUVCaGdvUUlFQjQ0WUxCZ2dRSUVCdzRVSURCQVFJQ0xHRE5xM01peG84ZVBJRU9LSEVuU280V1RLRk9xWE1teXBjdVhNR1BLbkVtenBzc0xPRE1NQ0FnQU93PT0iIC8+PC9zdmc+\")\n}\n\n.x-panel-mc {\n    background-color: #202324\n}\n\n.x-panel-ml {\n    background-color: #181a1b;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTIiIGhlaWdodD0iMSI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIxMiIgaGVpZ2h0PSIxIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhEQUFCQUljQUFOcmEydkh4OGYvLy93b0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDaUg1QkFBQUFQOEFMQUFBQUFBTUFBRUFBQWdNQUFFSUNFQ3dJRUVCQUFJQ0FEcz0iIC8+PC9zdmc+\")\n}\n\n.x-panel-mr {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTIiIGhlaWdodD0iMSI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIxMiIgaGVpZ2h0PSIxIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhEQUFCQUljQUFOcmEydkh4OGYvLy93b0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDZ29LQ2dvS0Nnb0tDaUg1QkFBQUFQOEFMQUFBQUFBTUFBRUFBQWdNQUFFSUNFQ3dJRUVCQUFJQ0FEcz0iIC8+PC9zdmc+\")\n}\n\n.x-tool {\n    background-image: url('../img/tool-sprites-dark.gif')\n}\n\n.x-panel-ghost {\n    background-color: #1f2223\n}\n\n.x-panel-dd-spacer, .x-panel-ghost ul {\n    border-color: #3d4245\n}\n\n.x-window-proxy {\n    background-color: #1a1c1d;\n    border-color: #3d4245\n}\n\n.x-window-tl .x-window-header {\n    color: #b2aca2\n}\n\n.x-window-mc {\n    border-color: #3d4245;\n    background-color: #25282a\n}\n\n.x-window-ml, .x-window-mr {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTIiIGhlaWdodD0iNSI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIxMiIgaGVpZ2h0PSI1IiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUF3QUFBQUZDQU1BQUFCR3BQMGRBQUFBR1hSRldIUlRiMlowZDJGeVpRQkJaRzlpWlNCSmJXRm5aVkpsWVdSNWNjbGxQQUFBQUFsUVRGUkY5UFQwNit2cnU3dTdFeG1vSEFBQUFCVkpSRUZVZU5waVlHSmtnQUpHSmdZeU9BQUJCZ0FFRUFBZldSTWVEZ0FBQUFCSlJVNUVya0pnZ2c9PSIgLz48L3N2Zz4=\")\n}\n\n.x-window-maximized .x-window-tc {\n    background-color: #181a1b\n}\n\n.x-window-bbar .x-toolbar {\n    border-top-color: #3d4245\n}\n\n.x-panel-collapsed .x-window-tl, .x-panel-ghost .x-window-tl {\n    border-bottom-color: #3d4245\n}\n\n.x-dlg-mask {\n    background-color: #35393b\n}\n\n.x-window-plain .x-window-mc {\n    background-color: #25282a\n}\n\n.x-html-editor-wrap {\n    border-color: #43484b;\n    background-color: #181a1b\n}\n\n.x-html-editor-tb .x-btn-text {\n    background-image: url(\"../ext/resources/images/default/editor/tb-sprite.gif\")\n}\n\n.x-panel-noborder .x-panel-header-noborder, .x-panel-noborder .x-panel-tbar-noborder .x-toolbar {\n    border-bottom-color: #3d4245\n}\n\n.x-panel-noborder .x-panel-bbar-noborder .x-toolbar, .x-tab-panel-bbar-noborder .x-toolbar {\n    border-top-color: #3d4245\n}\n\n.x-tab-panel-tbar-noborder .x-toolbar {\n    border-bottom-color: #3d4245\n}\n\n.x-accordion-hd {\n    color: #d3cfc9;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMSIgaGVpZ2h0PSI0NiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIxIiBoZWlnaHQ9IjQ2IiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBUUF1QUljQUFBQUFBQUVCQVFJQ0FnTURBd1FFQkFVRkJRWUdCZ2NIQndnSUNBa0pDUW9LQ2dzTEN3d01EQTBORFE0T0RnOFBEeEFRRUJFUkVSSVNFaE1URXhRVUZCVVZGUllXRmhjWEZ4Z1lHQmtaR1JvYUdoc2JHeHdjSEIwZEhSNGVIaDhmSHlBZ0lDRWhJU0lpSWlNakl5UWtKQ1VsSlNZbUppY25KeWdvS0NrcEtTb3FLaXNyS3l3c0xDMHRMUzR1TGk4dkx6QXdNREV4TVRJeU1qTXpNelEwTkRVMU5UWTJOamMzTnpnNE9EazVPVG82T2pzN096dzhQRDA5UFQ0K1BqOC9QMEJBUUVGQlFVSkNRa05EUTBSRVJFVkZSVVpHUmtkSFIwaElTRWxKU1VwS1NrdExTMHhNVEUxTlRVNU9UazlQVDFCUVVGRlJVVkpTVWxOVFUxUlVWRlZWVlZaV1ZsZFhWMWhZV0ZsWldWcGFXbHRiVzF4Y1hGMWRYVjVlWGw5ZlgyQmdZR0ZoWVdKaVltTmpZMlJrWkdWbFpXWm1abWRuWjJob2FHbHBhV3BxYW10cmEyeHNiRzF0Ylc1dWJtOXZiM0J3Y0hGeGNYSnljbk56YzNSMGRIVjFkWFoyZG5kM2QzaDRlSGw1ZVhwNmVudDdlM3g4ZkgxOWZYNStmbjkvZjRDQWdJR0JnWUtDZ29PRGc0U0VoSVdGaFlhR2hvZUhoNGlJaUltSmlZcUtpb3VMaTR5TWpJMk5qWTZPam8rUGo1Q1FrSkdSa1pLU2twT1RrNVNVbEpXVmxaYVdscGVYbDVpWW1KbVptWnFhbXB1Ym01eWNuSjJkblo2ZW5wK2ZuNkNnb0tHaG9hS2lvcU9qbzZTa3BLV2xwYWFtcHFlbnA2aW9xS21wcWFxcXFxdXJxNnlzcksydHJhNnVycSt2cjdDd3NMR3hzYkt5c3JPenM3UzB0TFcxdGJhMnRyZTN0N2k0dUxtNXVicTZ1cnU3dTd5OHZMMjl2YjYrdnIrL3Y4REF3TUhCd2NMQ3dzUER3OFRFeE1YRnhjYkd4c2ZIeDhqSXlNbkp5Y3JLeXN2THk4ek16TTNOemM3T3pzL1B6OURRME5IUjBkTFMwdFBUMDlUVTFOWFYxZGJXMXRmWDE5alkyTm5aMmRyYTJ0dmIyOXpjM04zZDNkN2UzdC9mMytEZzRPSGg0ZUxpNHVQajQrVGs1T1hsNWVibTV1Zm41K2pvNk9ucDZlcnE2dXZyNit6czdPM3Q3ZTd1N3UvdjcvRHc4UEh4OGZMeTh2UHo4L1QwOVBYMTlmYjI5dmYzOS9qNCtQbjUrZnI2K3Z2NysvejgvUDM5L2Y3Ky92Ly8veUg1QkFBQUFQOEFMQUFBQUFBQkFDNEFBQWdZQVBYcHkzZlBIcjE1OGQ2MVkxZXVvY09IRUNOS2xCZ1FBRHM9IiAvPjwvc3ZnPg==\")\n}\n\n.x-layout-collapsed {\n    background-color: #2a2e2f;\n    border-color: #3d4245\n}\n\n.x-layout-collapsed-over {\n    background-color: #26292a\n}\n\n.x-layout-split-west .x-layout-mini {\n    background-image: url(\"../ext/resources/images/default/layout/mini-left.gif\")\n}\n\n.x-layout-split-east .x-layout-mini {\n    background-image: url(\"../ext/resources/images/default/layout/mini-right.gif\")\n}\n\n.x-layout-split-north .x-layout-mini {\n    background-image: url(\"../ext/resources/images/default/layout/mini-top.gif\")\n}\n\n.x-layout-split-south .x-layout-mini {\n    background-image: url(\"../ext/resources/images/default/layout/mini-bottom.gif\")\n}\n\n.x-layout-cmini-west .x-layout-mini {\n    background-image: url(\"../ext/resources/images/default/layout/mini-right.gif\")\n}\n\n.x-layout-cmini-east .x-layout-mini {\n    background-image: url(\"../ext/resources/images/default/layout/mini-left.gif\")\n}\n\n.x-layout-cmini-north .x-layout-mini {\n    background-image: url(\"../ext/resources/images/default/layout/mini-bottom.gif\")\n}\n\n.x-layout-cmini-south .x-layout-mini {\n    background-image: url(\"../ext/resources/images/default/layout/mini-top.gif\")\n}\n\n.x-progress-wrap {\n    border-color: #50575a\n}\n\n.x-progress-text-back {\n    color: #aca59a\n}\n\n.x-list-header {\n    background-color: #1b1e1f;\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMiIgaGVpZ2h0PSIyMiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIyIiBoZWlnaHQ9IjIyIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhBZ0FXQUxNQUFPYm01dkx5OHZIeDhlN3U3dW5wNmVycTZ1Zm41K3ZyNit6czdPL3Y3L0R3OE8zdDdjYkd4dWpvNkFBQUFBQUFBQ0g1QkFBQUFBQUFMQUFBQUFBQ0FCWUFBQVFZTU1ncHFsQXFwY0hIV2doeWpFVkpuRVJqckVEck1rd0VBRHM9IiAvPjwvc3ZnPg==\")\n}\n\n.x-list-header-inner div em {\n    border-left-color: #3a3e41\n}\n\n.x-list-over {\n    background-color: #222426\n}\n\n.x-list-selected {\n    background-color: #202325\n}\n\n.x-list-resizer {\n    border-left-color: #70685c;\n    border-right-color: #70685c\n}\n\n.x-list-header-inner em.sort-asc, .x-list-header-inner em.sort-desc {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTIwMCIgaGVpZ2h0PSI0NiI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjMzMyAtMC42NjcgLTAuNjY3IDAuMDAwIDEuMDAwIC0wLjY2NyAwLjMzMyAtMC42NjcgMC4wMDAgMS4wMDAgLTAuNjY3IC0wLjY2NyAwLjMzMyAwLjAwMCAxLjAwMCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSIxMjAwIiBoZWlnaHQ9IjQ2IiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL2dpZjtiYXNlNjQsUjBsR09EbGhzQVF1QUxNQUFOcmEydWJtNXQzZDNlTGk0dVhsNWQvZjM5dmIyOTdlM3ZuNStlRGc0T0hoNGVQajQ3eTh2T1RrNU56YzNJbUppU0gvQzFoTlVDQkVZWFJoV0UxUVBEOTRjR0ZqYTJWMElHSmxaMmx1UFNMdnU3OGlJR2xrUFNKWE5VMHdUWEJEWldocFNIcHlaVk42VGxSamVtdGpPV1FpUHo0Z1BIZzZlRzF3YldWMFlTQjRiV3h1Y3pwNFBTSmhaRzlpWlRwdWN6cHRaWFJoTHlJZ2VEcDRiWEIwYXowaVFXUnZZbVVnV0UxUUlFTnZjbVVnTlM0d0xXTXdOakFnTmpFdU1UTTBOemMzTENBeU1ERXdMekF5THpFeUxURTNPak15T2pBd0lDQWdJQ0FnSUNBaVBpQThjbVJtT2xKRVJpQjRiV3h1Y3pweVpHWTlJbWgwZEhBNkx5OTNkM2N1ZHpNdWIzSm5MekU1T1Rrdk1ESXZNakl0Y21SbUxYTjViblJoZUMxdWN5TWlQaUE4Y21SbU9rUmxjMk55YVhCMGFXOXVJSEprWmpwaFltOTFkRDBpSWlCNGJXeHVjenA0YlhCTlRUMGlhSFIwY0RvdkwyNXpMbUZrYjJKbExtTnZiUzk0WVhBdk1TNHdMMjF0THlJZ2VHMXNibk02YzNSU1pXWTlJbWgwZEhBNkx5OXVjeTVoWkc5aVpTNWpiMjB2ZUdGd0x6RXVNQzl6Vkhsd1pTOVNaWE52ZFhKalpWSmxaaU1pSUhodGJHNXpPbmh0Y0QwaWFIUjBjRG92TDI1ekxtRmtiMkpsTG1OdmJTOTRZWEF2TVM0d0x5SWdlRzF3VFUwNlQzSnBaMmx1WVd4RWIyTjFiV1Z1ZEVsRVBTSjRiWEF1Wkdsa09rRXdOalExTXpBMU1qTXlNRFk0TVRGQ1FUQkZPRFJFTTBZME1rUkVOVFpESWlCNGJYQk5UVHBFYjJOMWJXVnVkRWxFUFNKNGJYQXVaR2xrT2tVeU5UZzNRa0U1UkVaRFJERXhSRVpDUWtZeVFUaERNVEU0TURaQ1FqWTBJaUI0YlhCTlRUcEpibk4wWVc1alpVbEVQU0o0YlhBdWFXbGtPa1V5TlRnM1FrRTRSRVpEUkRFeFJFWkNRa1l5UVRoRE1URTRNRFpDUWpZMElpQjRiWEE2UTNKbFlYUnZjbFJ2YjJ3OUlrRmtiMkpsSUZCb2IzUnZjMmh2Y0NCRFV6VWdUV0ZqYVc1MGIzTm9JajRnUEhodGNFMU5Pa1JsY21sMlpXUkdjbTl0SUhOMFVtVm1PbWx1YzNSaGJtTmxTVVE5SW5odGNDNXBhV1E2UVRFMk5EVXpNRFV5TXpJd05qZ3hNVUpCTUVVNE5FUXpSalF5UkVRMU5rTWlJSE4wVW1WbU9tUnZZM1Z0Wlc1MFNVUTlJbmh0Y0M1a2FXUTZRVEEyTkRVek1EVXlNekl3TmpneE1VSkJNRVU0TkVRelJqUXlSRVExTmtNaUx6NGdQQzl5WkdZNlJHVnpZM0pwY0hScGIyNCtJRHd2Y21SbU9sSkVSajRnUEM5NE9uaHRjRzFsZEdFK0lEdy9lSEJoWTJ0bGRDQmxibVE5SW5JaVB6NEIvLzc5L1B2NitmajM5dlgwOC9MeDhPL3U3ZXpyNnVubzUrYmw1T1BpNGVEZjN0M2MyOXJaMk5mVzFkVFQwdEhRejg3TnpNdkt5Y2pIeHNYRXc4TEJ3TCsrdmJ5N3VybTR0N2ExdExPeXNiQ3ZycTJzcTZxcHFLZW1wYVNqb3FHZ241NmRuSnVhbVppWGxwV1VrNUtSa0krT2pZeUxpb21JaDRhRmhJT0NnWUIvZm4xOGUzcDVlSGQyZFhSemNuRndiMjV0Ykd0cWFXaG5abVZrWTJKaFlGOWVYVnhiV2xsWVYxWlZWRk5TVVZCUFRrMU1TMHBKU0VkR1JVUkRRa0ZBUHo0OVBEczZPVGczTmpVME16SXhNQzh1TFN3cktpa29KeVlsSkNNaUlTQWZIaDBjR3hvWkdCY1dGUlFURWhFUUR3NE5EQXNLQ1FnSEJnVUVBd0lCQUFBaCtRUUFBQUFBQUN3QUFBQUFzQVF1QUFBRS94REpTYXU5T092TnUvOWdLSTVrYVo1b3FxNXM2NzV3TE05MGJkOTRydTk4Ny85QVZHQklMQnFQeUtSeXlXdzZuOUNvZEVxdFdxL1lySGJMN1hxLzRMQjRiSHlReitpMGVzMXV1OS93dUh4T3I5dnYrTHgreisvN3NRK0JmNE9FaFlhSGlJbUtpNHlOam8rUWtaSnJnWldUbDVpWm1wdWNhQVNmb0tHaW82U2xwcWVvcWFxcnJLMnVyN0N4c3JPMHRiYTN1TG02dTd5OXZyK2ZsY0xBeE1YR3g4akp5c3ZNemM3UDBOSFMwOVRWMXRmWTJkcmIzTjNlMytEaDR1UGt6UTNuNk9ucTYrenQ3dS93OGZMejlQWDI5L2o1K3Z2OC9mNy9BQU1LSEVpd29NR0RDQk1xWE1pd29jT0hFQ05LbkVpeFlyOEZHRE5xM01peG84ZVBJUDlEaWh4SnNxVEpreWhUcWx6SnNxWExsekJqeXB4SnM2Yk5temh6NnR6SnM2ZlBuMENEQ2gxS3RLaFJsd09TS2wzS3RLblRwMUNqU3AxS3RhclZxMWl6YXQzS3RhdlhyMkREaWgxTHRxelpzMmpUcWwzTHRxM2J0M0RqeXAxTHQ2N2R1M2p6NnQzTHQ2L2Z2NEFEQ3g1TXVMRGh3NGdUSzE3Y1Y0SGp4NUFqUzU1TXViTGx5NWd6YTk3TXViUG56NkJEaXg1TnVyVHAwNmhUcTE3TnVyWHIxN0JqeTU1TnU3YnQyN2h6Njk3Tm0zU0MzOENEQ3g5T3ZMang0OGlUSzEvT3ZMbno1OUNqUzU5T3ZicjE2OWl6YTkvT3ZidjM3K0REaXg5UHZyejU4K2pUcTEvUHZuMzFBdkRqeTU5UHY3NzkrL2p6NjkvUHY3Ly8vd0FHS09EL2dBUVdhT0NCQ0NhbzRJSU1OdWpnZ3hCR0tPR0VGRlpvNFlVWVpxamhoaHgyNk9HSElJWW80b2drbG1qaWlTaW02T0FCTExibzRvc3d4aWpqakRUV2FPT05PT2FvNDQ0ODl1ampqMEFHS2VTUVJCWnA1SkZJSnFua2trdzI2ZVNUVUVZcDVaUlVWbW5sbFZobXFlV1dYSGJwNVpkZ2hpbm1tR1NXYWFRQWFLYXA1cHBzdHVubW0zREdLZWVjZE5acDU1MTQ1cW5ubm56MjZlZWZnQVlxNktDRUZtcm9vWWdtcXVpaWpEYnE2S09RUmlycHBKUldhdW1sbUdhcTZhYWNkdXJwcDZDR0t1cW9wSlpxNnFtb3Bxb3FwdzYwNnVxcnNNWXE2NnkwMW1ycnJiam1xdXV1dlBicTY2L0FCaXZzc01RV2EreXh5Q2FyN0xMTU5pdXIvd0hRUml2dHROUldhKzIxMkdhcjdiYmNkdXZ0dCtDR0srNjQ1SlpyN3Jub3BxdnV1dXkyNis2NzhNWXI3N3owMW12dnZmam1xKysrL1Bicjc3OEFCeXp3d0FRWGJQREJDQ2VzTGdBTU4rend3eEJITFBIRUZGZHM4Y1VZWjZ6eHhoeDM3UEhISUljczhzZ2tsMnp5eVNpbnJQTEtMTGZzOHNzd3h5enp6RFRYYlBQTk9PZXM4ODQ4OSt6enowQUhMZlRRUkJkdDlORklKNjMwMGt3MzdmVFRVRWN0OWRSVVYyMzExVmhucmZYV1hIZnROY29NaEMzMjJHU1hiZmJaYUtldDl0cHN0KzMyMjNESExmZmNkTmR0OTkxNDU2MzMzbnozN2ZmZmdBY3UrT0NFRjI3NDRZZ25ydmppakRmdStPTjNCeUg1NUpSWGJ2bmxtR2V1K2YvbW5IZnUrZWVnaHk3NjZLUzcwTW5wcUtldSt1cVhDR01KNjdESEx2dnN0TmR1KysyNDU2NjdISzd2N3Z2dndBY3YvUERFRjIvODhWUzhqdnp5ekRmdnZCWGxSQy85OU5SWGIvMzFzVHlBL2ZiY2QrLzk5K0NITC83NDVKZHYvdm5vcDYvKyt1eTNYNDVGOE1jdi8vejAxMi8vL2ZqbnIvLysvUGZ2Ly84QURLQUFCM0tVQWhyd2dBaE1vQUlYeU1BR092Q0JFSXlnQkNkSXdRcGE4SUkwWVl3R044akJEbnJ3Z3lBTW9RaEhTTUlTbXZDRUtFeWhDbGZJd2hhNjhJVXdqS0VNWjBoREYvYm1oampNb1E1M3lNTWUrdkNIUUF5aUVJZEl4Q0lhOFloSVRLSnEzTVBFSmpyeGlWQ01vaFNuU01VcVd2R0tXTXlpRnJmSXhTNzRlbkU3S2dxakdNZEl4akthOFl4b1RLTWExOGpHTnJyeGpYQ01veHpuU01jNjJ2R09lSVNQbWZiSXh6NzY4WStBREtRZ0IwbklRaHJ5a0loTXBDSVh5Y2hHT3ZLUmtJd2tKRmRGeVVwYThwS1l6S1FtTjhuSlRucnlrNkFNcFNoSFNjcFNtdktVcUV5bEtsZkp5bGE2RXBYT2lxVXNaMG5MV3RyeWxyak1wUzUzeWN0ZUFrdGh3QXltTUlkSnpHSWE4NWpJVEtZeWw4bk1aanJ6bWRDTXBqU25TYzFxV3JPYVg4dW1OcmZKelc1Njg1dmdES2M0eDBuT2NwcnpuT2hNcHpyWHljNTJ1dk9kOEl5blBPZEp6M3JhODU3NHpLYyt3UWE1ZnZyem53QU5xRUFIU3RDQ0d2U2dDRTJvUWhmSzBJWTY5S0Y4aXdBQU93PT0iIC8+PC9zdmc+\");\n    border-color: #3d4245\n}\n\n.x-slider {\n    filter: invert(100%) contrast(90%)\n}\n\n.x-slider-horz, .x-slider-horz .x-slider-end, .x-slider-horz .x-slider-inner {\n    background-image: url(\"../ext/resources/images/default/slider/slider-bg.png\")\n}\n\n.x-slider-horz .x-slider-thumb {\n    background-image: url(\"../ext/resources/images/gray/slider/slider-thumb.png\")\n}\n\n.x-slider-vert, .x-slider-vert .x-slider-end, .x-slider-vert .x-slider-inner {\n    background-image: url(\"../ext/resources/images/default/slider/slider-v-bg.png\")\n}\n\n.x-slider-vert .x-slider-thumb {\n    background-image: url(\"../ext/resources/images/gray/slider/slider-v-thumb.png\")\n}\n\n.x-window-dlg .x-msg-box-wait {\n    background-image: url(\"../ext/resources/images/default/grid/loading.gif\")\n}\n\n.x-window-dlg .ext-mb-info {\n    background-image: url(\"../ext/resources/images/gray/window/icon-info.gif\")\n}\n\n.x-window-dlg .ext-mb-warning {\n    background-image: url(\"../ext/resources/images/gray/window/icon-warning.gif\")\n}\n\n.x-window-dlg .ext-mb-question {\n    background-image: url(\"../img/question-circle.svg\");\n    background-size: 32px;\n}\n\n.x-window-dlg .ext-mb-error {\n    background-image: url(\"../ext/resources/images/gray/window/icon-error.gif\")\n}\n\n.sm-text-highlight {\n    background-color: #684006\n}\n\n.sm-menuitem-filter-label {\n    background-color: #46515d;\n    color: #d0ccc6!important\n}\n\n.sm-menuitem-filter-icon {\n    background-image: url(\"../img/bars-filter-d9.svg\");\n    background-size: 12px\n}\n\n.sm-grid3-col-filterable .x-grid3-hd-btn, .sm-grid3-col-filterable .x-grid3-hd-btn:hover {\n    background-image: url(\"../img/bars-filter-d9.svg\");\n    background-position: 2px 3px;\n    opacity: 0.5;\n}\n\n.sm-grid3-col-filtered .x-grid3-hd-btn {\n    background-color: hsl(107 57% 24% / 1);\n    opacity: 1;\n}\n\n.x-grid3-hd-btn {\n    background-color: transparent;\n    background-image: none\n}\n\n.sm-collection-manage-layout .x-border-layout-ct, .sm-collection-manage-layout .x-panel-body, .sm-dialog-window.sm-round-panel {\n    background-color: hsl(200deg 6% 11%)\n}\n\n.sm-collection-manage-layout .x-layout-split {\n    color: #b0a99f;\n    background-color: transparent\n}\n\n.x-form-search:focus, .x-form-text:focus, .x-form-textarea:focus {\n    border-color: #945619;\n    box-shadow: rgba(166,96,28,.2) 0 0 1px 1px inset\n}\n\n.sm-review-auto-sprite {\n    background-color: #2952a3;\n    color: #e6e4e1!important\n}\n\n.x-form-cb-label .sm-question-circle,\n.x-form-item-label .sm-question-circle,\n.x-grid3-hd .sm-question-circle,\n.x-panel-header .sm-question-circle {\n    color: grey\n}\n\n.x-form-field-wrap.x-form-field-trigger-wrap .x-form-field.sm-review-combo-input[disabled] {\n    color: gray;\n    background-color: transparent\n}\n\n.x-progress-inner {\n    background-image: none;\n    background-color: #1f2223\n}\n\n.x-progress-bar {\n    background-image: none;\n    background-color: #425722;\n    border-color: initial\n}\n\n.sm-pb-error .x-progress-bar {\n    background-color: #602020\n}\n\n.x-progress-text {\n    color: transparent\n}\n\n.x-progress-text.x-progress-text-back {\n    color: #b3aca2\n}\n\n.sm-cell-thermometer-bg {\n    background-color: #1e2021;\n    outline: solid 1px #4d4d4d;\n}\n\n.sm-cell-mercury-low {\n    background-color: #425722\n}\n\n.sm-cell-mercury-medium {\n    background-color: hsl(209deg 48% 26%)\n}\n\n.sm-cell-mercury-high {\n    background-color: hsl(5deg 56% 21%)\n}\n\n.sm-dialog-panel-content, .sm-dialog-panel-text {\n    color: #e8e6e3\n}\n\n.sm-dialog-panel-callout {\n    background-color: #26292b;\n    color: #e8e6e3\n}\n\n.sm-export-sprite-high, .sm-export-sprite-medium {\n    background-color: #2b2f31\n}\n\n.sm-export-sprite-low {\n    background-color: #425722\n}\n\n.x-grid-group-collapsed .x-grid-group-hd div.x-grid-group-title {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAiIGhlaWdodD0iMTAiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4yNDkgLTAuNjE0IC0wLjY3MiAwLjAwMCAxLjAzNSAtMC42NDYgMC4yODggLTAuNjY0IDAuMDAwIDEuMDIwIC0wLjYzNiAtMC42MDkgMC4yNTAgMC4wMDAgMC45OTQgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTAiIGhlaWdodD0iMTAiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2Uvc3ZnK3htbDtiYXNlNjQsUEQ5NGJXd2dkbVZ5YzJsdmJqMGlNUzR3SWlCbGJtTnZaR2x1WnowaVZWUkdMVGdpSUhOMFlXNWtZV3h2Ym1VOUltNXZJajgrQ2p4emRtY0tJQ0FnZUcxc2JuTTZaR005SW1oMGRIQTZMeTl3ZFhKc0xtOXlaeTlrWXk5bGJHVnRaVzUwY3k4eExqRXZJZ29nSUNCNGJXeHVjenBqWXowaWFIUjBjRG92TDJOeVpXRjBhWFpsWTI5dGJXOXVjeTV2Y21jdmJuTWpJZ29nSUNCNGJXeHVjenB5WkdZOUltaDBkSEE2THk5M2QzY3Vkek11YjNKbkx6RTVPVGt2TURJdk1qSXRjbVJtTFhONWJuUmhlQzF1Y3lNaUNpQWdJSGh0Ykc1ek9uTjJaejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpQ2lBZ0lIaHRiRzV6UFNKb2RIUndPaTh2ZDNkM0xuY3pMbTl5Wnk4eU1EQXdMM04yWnlJS0lDQWdlRzFzYm5NNmMyOWthWEJ2WkdrOUltaDBkSEE2THk5emIyUnBjRzlrYVM1emIzVnlZMlZtYjNKblpTNXVaWFF2UkZSRUwzTnZaR2x3YjJScExUQXVaSFJrSWdvZ0lDQjRiV3h1Y3pwcGJtdHpZMkZ3WlQwaWFIUjBjRG92TDNkM2R5NXBibXR6WTJGd1pTNXZjbWN2Ym1GdFpYTndZV05sY3k5cGJtdHpZMkZ3WlNJS0lDQWdkMmxrZEdnOUlqRXdJZ29nSUNCb1pXbG5hSFE5SWpFd0lnb2dJQ0IyYVdWM1FtOTRQU0l3SURBZ01pNDJORFU0TXpNeUlESXVOalExT0RNek5DSUtJQ0FnZG1WeWMybHZiajBpTVM0eElnb2dJQ0JwWkQwaWMzWm5PRFUySWdvZ0lDQnBibXR6WTJGd1pUcDJaWEp6YVc5dVBTSXhMakF1TVNBb01TNHdMakVyY2pjektTSUtJQ0FnYzI5a2FYQnZaR2s2Wkc5amJtRnRaVDBpZEhKbFpTMWxiR0p2ZHkxamJHOXpaV1F1YzNabklqNEtJQ0E4WkdWbWN3b2dJQ0FnSUdsa1BTSmtaV1p6T0RVd0lpQXZQZ29nSUR4emIyUnBjRzlrYVRwdVlXMWxaSFpwWlhjS0lDQWdJQ0JwWkQwaVltRnpaU0lLSUNBZ0lDQndZV2RsWTI5c2IzSTlJaU5tWm1abVptWWlDaUFnSUNBZ1ltOXlaR1Z5WTI5c2IzSTlJaU0yTmpZMk5qWWlDaUFnSUNBZ1ltOXlaR1Z5YjNCaFkybDBlVDBpTVM0d0lnb2dJQ0FnSUdsdWEzTmpZWEJsT25CaFoyVnZjR0ZqYVhSNVBTSXdMakFpQ2lBZ0lDQWdhVzVyYzJOaGNHVTZjR0ZuWlhOb1lXUnZkejBpTWlJS0lDQWdJQ0JwYm10elkyRndaVHA2YjI5dFBTSTBOUzR5TlRRNE16UWlDaUFnSUNBZ2FXNXJjMk5oY0dVNlkzZzlJakV1TVRRM01UVXlOaUlLSUNBZ0lDQnBibXR6WTJGd1pUcGplVDBpTkM0Mk5qYzBNakUzSWdvZ0lDQWdJR2x1YTNOallYQmxPbVJ2WTNWdFpXNTBMWFZ1YVhSelBTSndlQ0lLSUNBZ0lDQnBibXR6WTJGd1pUcGpkWEp5Wlc1MExXeGhlV1Z5UFNKc1lYbGxjakVpQ2lBZ0lDQWdhVzVyYzJOaGNHVTZaRzlqZFcxbGJuUXRjbTkwWVhScGIyNDlJakFpQ2lBZ0lDQWdjMmh2ZDJkeWFXUTlJbVpoYkhObElnb2dJQ0FnSUhWdWFYUnpQU0p3ZUNJS0lDQWdJQ0JwYm10elkyRndaVHAzYVc1a2IzY3RkMmxrZEdnOUlqRTFNVFlpQ2lBZ0lDQWdhVzVyYzJOaGNHVTZkMmx1Wkc5M0xXaGxhV2RvZEQwaU1UQXhOU0lLSUNBZ0lDQnBibXR6WTJGd1pUcDNhVzVrYjNjdGVEMGlNQ0lLSUNBZ0lDQnBibXR6WTJGd1pUcDNhVzVrYjNjdGVUMGlNQ0lLSUNBZ0lDQnBibXR6WTJGd1pUcDNhVzVrYjNjdGJXRjRhVzFwZW1Wa1BTSXdJaUF2UGdvZ0lEeHRaWFJoWkdGMFlRb2dJQ0FnSUdsa1BTSnRaWFJoWkdGMFlUZzFNeUkrQ2lBZ0lDQThjbVJtT2xKRVJqNEtJQ0FnSUNBZ1BHTmpPbGR2Y21zS0lDQWdJQ0FnSUNBZ2NtUm1PbUZpYjNWMFBTSWlQZ29nSUNBZ0lDQWdJRHhrWXpwbWIzSnRZWFErYVcxaFoyVXZjM1puSzNodGJEd3ZaR002Wm05eWJXRjBQZ29nSUNBZ0lDQWdJRHhrWXpwMGVYQmxDaUFnSUNBZ0lDQWdJQ0FnY21SbU9uSmxjMjkxY21ObFBTSm9kSFJ3T2k4dmNIVnliQzV2Y21jdlpHTXZaR050YVhSNWNHVXZVM1JwYkd4SmJXRm5aU0lnTHo0S0lDQWdJQ0FnSUNBOFpHTTZkR2wwYkdVK1BDOWtZenAwYVhSc1pUNEtJQ0FnSUNBZ1BDOWpZenBYYjNKclBnb2dJQ0FnUEM5eVpHWTZVa1JHUGdvZ0lEd3ZiV1YwWVdSaGRHRStDaUFnUEdjS0lDQWdJQ0JwYm10elkyRndaVHBzWVdKbGJEMGlUR0Y1WlhJZ01TSUtJQ0FnSUNCcGJtdHpZMkZ3WlRwbmNtOTFjRzF2WkdVOUlteGhlV1Z5SWdvZ0lDQWdJR2xrUFNKc1lYbGxjakVpUGdvZ0lDQWdQSEJoZEdnS0lDQWdJQ0FnSUhOMGVXeGxQU0ptYVd4c09pTTFPRFU0TlRnN1ptbHNiQzF2Y0dGamFYUjVPakU3YzNSeWIydGxPaU0xT0RVNE5UZzdjM1J5YjJ0bExYZHBaSFJvT2pBdU1qUTJOak00Y0hnN2MzUnliMnRsTFd4cGJtVmpZWEE2WW5WMGREdHpkSEp2YTJVdGJHbHVaV3B2YVc0NmJXbDBaWEk3YzNSeWIydGxMVzl3WVdOcGRIazZNU0lLSUNBZ0lDQWdJR1E5SWswZ01DNDFOekE0TlRFMU15d3lMak0xTkRRNU9UVWdWaUF3TGpJM09USXpOVFUwSUV3Z01TNDVPRGt6T0RJekxERXVNamN6TVRFeU1pQmFJZ29nSUNBZ0lDQWdhV1E5SW5CaGRHZ3hORGs1SWlBdlBnb2dJRHd2Wno0S1BDOXpkbWMrQ2c9PSIgLz48L3N2Zz4=\")\n}\n\n.x-grid-group-hd div.x-grid-group-title {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAiIGhlaWdodD0iMTAiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4yNDkgLTAuNjE0IC0wLjY3MiAwLjAwMCAxLjAzNSAtMC42NDYgMC4yODggLTAuNjY0IDAuMDAwIDEuMDIwIC0wLjYzNiAtMC42MDkgMC4yNTAgMC4wMDAgMC45OTQgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTAiIGhlaWdodD0iMTAiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2Uvc3ZnK3htbDtiYXNlNjQsUEQ5NGJXd2dkbVZ5YzJsdmJqMGlNUzR3SWlCbGJtTnZaR2x1WnowaVZWUkdMVGdpSUhOMFlXNWtZV3h2Ym1VOUltNXZJajgrQ2p4emRtY0tJQ0FnZUcxc2JuTTZaR005SW1oMGRIQTZMeTl3ZFhKc0xtOXlaeTlrWXk5bGJHVnRaVzUwY3k4eExqRXZJZ29nSUNCNGJXeHVjenBqWXowaWFIUjBjRG92TDJOeVpXRjBhWFpsWTI5dGJXOXVjeTV2Y21jdmJuTWpJZ29nSUNCNGJXeHVjenB5WkdZOUltaDBkSEE2THk5M2QzY3Vkek11YjNKbkx6RTVPVGt2TURJdk1qSXRjbVJtTFhONWJuUmhlQzF1Y3lNaUNpQWdJSGh0Ykc1ek9uTjJaejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpQ2lBZ0lIaHRiRzV6UFNKb2RIUndPaTh2ZDNkM0xuY3pMbTl5Wnk4eU1EQXdMM04yWnlJS0lDQWdlRzFzYm5NNmMyOWthWEJ2WkdrOUltaDBkSEE2THk5emIyUnBjRzlrYVM1emIzVnlZMlZtYjNKblpTNXVaWFF2UkZSRUwzTnZaR2x3YjJScExUQXVaSFJrSWdvZ0lDQjRiV3h1Y3pwcGJtdHpZMkZ3WlQwaWFIUjBjRG92TDNkM2R5NXBibXR6WTJGd1pTNXZjbWN2Ym1GdFpYTndZV05sY3k5cGJtdHpZMkZ3WlNJS0lDQWdkMmxrZEdnOUlqRXdJZ29nSUNCb1pXbG5hSFE5SWpFd0lnb2dJQ0IyYVdWM1FtOTRQU0l3SURBZ01pNDJORFU0TXpNeUlESXVOalExT0RNek5DSUtJQ0FnZG1WeWMybHZiajBpTVM0eElnb2dJQ0JwWkQwaWMzWm5PRFUySWdvZ0lDQnBibXR6WTJGd1pUcDJaWEp6YVc5dVBTSXhMakF1TVNBb01TNHdMakVyY2pjektTSUtJQ0FnYzI5a2FYQnZaR2s2Wkc5amJtRnRaVDBpZEhKbFpTMWxiR0p2ZHkxdGFXNTFjeTV6ZG1jaVBnb2dJRHhrWldaekNpQWdJQ0FnYVdROUltUmxabk00TlRBaUlDOCtDaUFnUEhOdlpHbHdiMlJwT201aGJXVmtkbWxsZHdvZ0lDQWdJR2xrUFNKaVlYTmxJZ29nSUNBZ0lIQmhaMlZqYjJ4dmNqMGlJMlptWm1abVppSUtJQ0FnSUNCaWIzSmtaWEpqYjJ4dmNqMGlJelkyTmpZMk5pSUtJQ0FnSUNCaWIzSmtaWEp2Y0dGamFYUjVQU0l4TGpBaUNpQWdJQ0FnYVc1cmMyTmhjR1U2Y0dGblpXOXdZV05wZEhrOUlqQXVNQ0lLSUNBZ0lDQnBibXR6WTJGd1pUcHdZV2RsYzJoaFpHOTNQU0l5SWdvZ0lDQWdJR2x1YTNOallYQmxPbnB2YjIwOUlqRTFMamd6T1RFNU1pSUtJQ0FnSUNCcGJtdHpZMkZ3WlRwamVEMGlNalF1T0RBNU56WXhJZ29nSUNBZ0lHbHVhM05qWVhCbE9tTjVQU0l5TUM0ek1Ua3dNeklpQ2lBZ0lDQWdhVzVyYzJOaGNHVTZaRzlqZFcxbGJuUXRkVzVwZEhNOUluQjRJZ29nSUNBZ0lHbHVhM05qWVhCbE9tTjFjbkpsYm5RdGJHRjVaWEk5SW14aGVXVnlNU0lLSUNBZ0lDQnBibXR6WTJGd1pUcGtiMk4xYldWdWRDMXliM1JoZEdsdmJqMGlNQ0lLSUNBZ0lDQnphRzkzWjNKcFpEMGlabUZzYzJVaUNpQWdJQ0FnZFc1cGRITTlJbkI0SWdvZ0lDQWdJR2x1YTNOallYQmxPbmRwYm1SdmR5MTNhV1IwYUQwaU1UVXhOaUlLSUNBZ0lDQnBibXR6WTJGd1pUcDNhVzVrYjNjdGFHVnBaMmgwUFNJeE1ERTFJZ29nSUNBZ0lHbHVhM05qWVhCbE9uZHBibVJ2ZHkxNFBTSXdJZ29nSUNBZ0lHbHVhM05qWVhCbE9uZHBibVJ2ZHkxNVBTSXdJZ29nSUNBZ0lHbHVhM05qWVhCbE9uZHBibVJ2ZHkxdFlYaHBiV2w2WldROUlqQWlJQzgrQ2lBZ1BHMWxkR0ZrWVhSaENpQWdJQ0FnYVdROUltMWxkR0ZrWVhSaE9EVXpJajRLSUNBZ0lEeHlaR1k2VWtSR1Bnb2dJQ0FnSUNBOFkyTTZWMjl5YXdvZ0lDQWdJQ0FnSUNCeVpHWTZZV0p2ZFhROUlpSStDaUFnSUNBZ0lDQWdQR1JqT21admNtMWhkRDVwYldGblpTOXpkbWNyZUcxc1BDOWtZenBtYjNKdFlYUStDaUFnSUNBZ0lDQWdQR1JqT25SNWNHVUtJQ0FnSUNBZ0lDQWdJQ0J5WkdZNmNtVnpiM1Z5WTJVOUltaDBkSEE2THk5d2RYSnNMbTl5Wnk5a1l5OWtZMjFwZEhsd1pTOVRkR2xzYkVsdFlXZGxJaUF2UGdvZ0lDQWdJQ0FnSUR4a1l6cDBhWFJzWlQ0OEwyUmpPblJwZEd4bFBnb2dJQ0FnSUNBOEwyTmpPbGR2Y21zK0NpQWdJQ0E4TDNKa1pqcFNSRVkrQ2lBZ1BDOXRaWFJoWkdGMFlUNEtJQ0E4WndvZ0lDQWdJR2x1YTNOallYQmxPbXhoWW1Wc1BTSk1ZWGxsY2lBeElnb2dJQ0FnSUdsdWEzTmpZWEJsT21keWIzVndiVzlrWlQwaWJHRjVaWElpQ2lBZ0lDQWdhV1E5SW14aGVXVnlNU0krQ2lBZ0lDQThjR0YwYUFvZ0lDQWdJQ0FnYzNSNWJHVTlJbVpwYkd3Nkl6VTROVGcxT0R0bWFXeHNMVzl3WVdOcGRIazZNVHR6ZEhKdmEyVTZJelU0TlRnMU9EdHpkSEp2YTJVdGQybGtkR2c2TUM0eU5EWTJNemh3ZUR0emRISnZhMlV0YkdsdVpXTmhjRHBpZFhSME8zTjBjbTlyWlMxc2FXNWxhbTlwYmpwdGFYUmxjanR6ZEhKdmEyVXRiM0JoWTJsMGVUb3hJZ29nSUNBZ0lDQWdaRDBpVFNBd0xqSTROak0zT1RrNExEQXVOamd6TWpjNE16UWdTQ0F5TGpNMk1UWTBNemtnVENBeExqTTJOemMyTnpNc01pNHhNREU0TURreElGb2lDaUFnSUNBZ0lDQnBaRDBpY0dGMGFERTBPVGtpSUM4K0NpQWdQQzluUGdvOEwzTjJaejRLIiAvPjwvc3ZnPg==\")\n}\n\n.x-grid3-row-collapsed .x-grid3-row-expander {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAiIGhlaWdodD0iMTAiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4yNDkgLTAuNjE0IC0wLjY3MiAwLjAwMCAxLjAzNSAtMC42NDYgMC4yODggLTAuNjY0IDAuMDAwIDEuMDIwIC0wLjYzNiAtMC42MDkgMC4yNTAgMC4wMDAgMC45OTQgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTAiIGhlaWdodD0iMTAiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2Uvc3ZnK3htbDtiYXNlNjQsUEQ5NGJXd2dkbVZ5YzJsdmJqMGlNUzR3SWlCbGJtTnZaR2x1WnowaVZWUkdMVGdpSUhOMFlXNWtZV3h2Ym1VOUltNXZJajgrQ2p4emRtY0tJQ0FnZUcxc2JuTTZaR005SW1oMGRIQTZMeTl3ZFhKc0xtOXlaeTlrWXk5bGJHVnRaVzUwY3k4eExqRXZJZ29nSUNCNGJXeHVjenBqWXowaWFIUjBjRG92TDJOeVpXRjBhWFpsWTI5dGJXOXVjeTV2Y21jdmJuTWpJZ29nSUNCNGJXeHVjenB5WkdZOUltaDBkSEE2THk5M2QzY3Vkek11YjNKbkx6RTVPVGt2TURJdk1qSXRjbVJtTFhONWJuUmhlQzF1Y3lNaUNpQWdJSGh0Ykc1ek9uTjJaejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpQ2lBZ0lIaHRiRzV6UFNKb2RIUndPaTh2ZDNkM0xuY3pMbTl5Wnk4eU1EQXdMM04yWnlJS0lDQWdlRzFzYm5NNmMyOWthWEJ2WkdrOUltaDBkSEE2THk5emIyUnBjRzlrYVM1emIzVnlZMlZtYjNKblpTNXVaWFF2UkZSRUwzTnZaR2x3YjJScExUQXVaSFJrSWdvZ0lDQjRiV3h1Y3pwcGJtdHpZMkZ3WlQwaWFIUjBjRG92TDNkM2R5NXBibXR6WTJGd1pTNXZjbWN2Ym1GdFpYTndZV05sY3k5cGJtdHpZMkZ3WlNJS0lDQWdkMmxrZEdnOUlqRXdJZ29nSUNCb1pXbG5hSFE5SWpFd0lnb2dJQ0IyYVdWM1FtOTRQU0l3SURBZ01pNDJORFU0TXpNeUlESXVOalExT0RNek5DSUtJQ0FnZG1WeWMybHZiajBpTVM0eElnb2dJQ0JwWkQwaWMzWm5PRFUySWdvZ0lDQnBibXR6WTJGd1pUcDJaWEp6YVc5dVBTSXhMakF1TVNBb01TNHdMakVyY2pjektTSUtJQ0FnYzI5a2FYQnZaR2s2Wkc5amJtRnRaVDBpZEhKbFpTMWxiR0p2ZHkxamJHOXpaV1F1YzNabklqNEtJQ0E4WkdWbWN3b2dJQ0FnSUdsa1BTSmtaV1p6T0RVd0lpQXZQZ29nSUR4emIyUnBjRzlrYVRwdVlXMWxaSFpwWlhjS0lDQWdJQ0JwWkQwaVltRnpaU0lLSUNBZ0lDQndZV2RsWTI5c2IzSTlJaU5tWm1abVptWWlDaUFnSUNBZ1ltOXlaR1Z5WTI5c2IzSTlJaU0yTmpZMk5qWWlDaUFnSUNBZ1ltOXlaR1Z5YjNCaFkybDBlVDBpTVM0d0lnb2dJQ0FnSUdsdWEzTmpZWEJsT25CaFoyVnZjR0ZqYVhSNVBTSXdMakFpQ2lBZ0lDQWdhVzVyYzJOaGNHVTZjR0ZuWlhOb1lXUnZkejBpTWlJS0lDQWdJQ0JwYm10elkyRndaVHA2YjI5dFBTSTBOUzR5TlRRNE16UWlDaUFnSUNBZ2FXNXJjMk5oY0dVNlkzZzlJakV1TVRRM01UVXlOaUlLSUNBZ0lDQnBibXR6WTJGd1pUcGplVDBpTkM0Mk5qYzBNakUzSWdvZ0lDQWdJR2x1YTNOallYQmxPbVJ2WTNWdFpXNTBMWFZ1YVhSelBTSndlQ0lLSUNBZ0lDQnBibXR6WTJGd1pUcGpkWEp5Wlc1MExXeGhlV1Z5UFNKc1lYbGxjakVpQ2lBZ0lDQWdhVzVyYzJOaGNHVTZaRzlqZFcxbGJuUXRjbTkwWVhScGIyNDlJakFpQ2lBZ0lDQWdjMmh2ZDJkeWFXUTlJbVpoYkhObElnb2dJQ0FnSUhWdWFYUnpQU0p3ZUNJS0lDQWdJQ0JwYm10elkyRndaVHAzYVc1a2IzY3RkMmxrZEdnOUlqRTFNVFlpQ2lBZ0lDQWdhVzVyYzJOaGNHVTZkMmx1Wkc5M0xXaGxhV2RvZEQwaU1UQXhOU0lLSUNBZ0lDQnBibXR6WTJGd1pUcDNhVzVrYjNjdGVEMGlNQ0lLSUNBZ0lDQnBibXR6WTJGd1pUcDNhVzVrYjNjdGVUMGlNQ0lLSUNBZ0lDQnBibXR6WTJGd1pUcDNhVzVrYjNjdGJXRjRhVzFwZW1Wa1BTSXdJaUF2UGdvZ0lEeHRaWFJoWkdGMFlRb2dJQ0FnSUdsa1BTSnRaWFJoWkdGMFlUZzFNeUkrQ2lBZ0lDQThjbVJtT2xKRVJqNEtJQ0FnSUNBZ1BHTmpPbGR2Y21zS0lDQWdJQ0FnSUNBZ2NtUm1PbUZpYjNWMFBTSWlQZ29nSUNBZ0lDQWdJRHhrWXpwbWIzSnRZWFErYVcxaFoyVXZjM1puSzNodGJEd3ZaR002Wm05eWJXRjBQZ29nSUNBZ0lDQWdJRHhrWXpwMGVYQmxDaUFnSUNBZ0lDQWdJQ0FnY21SbU9uSmxjMjkxY21ObFBTSm9kSFJ3T2k4dmNIVnliQzV2Y21jdlpHTXZaR050YVhSNWNHVXZVM1JwYkd4SmJXRm5aU0lnTHo0S0lDQWdJQ0FnSUNBOFpHTTZkR2wwYkdVK1BDOWtZenAwYVhSc1pUNEtJQ0FnSUNBZ1BDOWpZenBYYjNKclBnb2dJQ0FnUEM5eVpHWTZVa1JHUGdvZ0lEd3ZiV1YwWVdSaGRHRStDaUFnUEdjS0lDQWdJQ0JwYm10elkyRndaVHBzWVdKbGJEMGlUR0Y1WlhJZ01TSUtJQ0FnSUNCcGJtdHpZMkZ3WlRwbmNtOTFjRzF2WkdVOUlteGhlV1Z5SWdvZ0lDQWdJR2xrUFNKc1lYbGxjakVpUGdvZ0lDQWdQSEJoZEdnS0lDQWdJQ0FnSUhOMGVXeGxQU0ptYVd4c09pTTFPRFU0TlRnN1ptbHNiQzF2Y0dGamFYUjVPakU3YzNSeWIydGxPaU0xT0RVNE5UZzdjM1J5YjJ0bExYZHBaSFJvT2pBdU1qUTJOak00Y0hnN2MzUnliMnRsTFd4cGJtVmpZWEE2WW5WMGREdHpkSEp2YTJVdGJHbHVaV3B2YVc0NmJXbDBaWEk3YzNSeWIydGxMVzl3WVdOcGRIazZNU0lLSUNBZ0lDQWdJR1E5SWswZ01DNDFOekE0TlRFMU15d3lMak0xTkRRNU9UVWdWaUF3TGpJM09USXpOVFUwSUV3Z01TNDVPRGt6T0RJekxERXVNamN6TVRFeU1pQmFJZ29nSUNBZ0lDQWdhV1E5SW5CaGRHZ3hORGs1SWlBdlBnb2dJRHd2Wno0S1BDOXpkbWMrQ2c9PSIgLz48L3N2Zz4=\")\n}\n\n.x-grid3-row-expanded .x-grid3-row-expander {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTAiIGhlaWdodD0iMTAiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4yNDkgLTAuNjE0IC0wLjY3MiAwLjAwMCAxLjAzNSAtMC42NDYgMC4yODggLTAuNjY0IDAuMDAwIDEuMDIwIC0wLjYzNiAtMC42MDkgMC4yNTAgMC4wMDAgMC45OTQgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTAiIGhlaWdodD0iMTAiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2Uvc3ZnK3htbDtiYXNlNjQsUEQ5NGJXd2dkbVZ5YzJsdmJqMGlNUzR3SWlCbGJtTnZaR2x1WnowaVZWUkdMVGdpSUhOMFlXNWtZV3h2Ym1VOUltNXZJajgrQ2p4emRtY0tJQ0FnZUcxc2JuTTZaR005SW1oMGRIQTZMeTl3ZFhKc0xtOXlaeTlrWXk5bGJHVnRaVzUwY3k4eExqRXZJZ29nSUNCNGJXeHVjenBqWXowaWFIUjBjRG92TDJOeVpXRjBhWFpsWTI5dGJXOXVjeTV2Y21jdmJuTWpJZ29nSUNCNGJXeHVjenB5WkdZOUltaDBkSEE2THk5M2QzY3Vkek11YjNKbkx6RTVPVGt2TURJdk1qSXRjbVJtTFhONWJuUmhlQzF1Y3lNaUNpQWdJSGh0Ykc1ek9uTjJaejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpQ2lBZ0lIaHRiRzV6UFNKb2RIUndPaTh2ZDNkM0xuY3pMbTl5Wnk4eU1EQXdMM04yWnlJS0lDQWdlRzFzYm5NNmMyOWthWEJ2WkdrOUltaDBkSEE2THk5emIyUnBjRzlrYVM1emIzVnlZMlZtYjNKblpTNXVaWFF2UkZSRUwzTnZaR2x3YjJScExUQXVaSFJrSWdvZ0lDQjRiV3h1Y3pwcGJtdHpZMkZ3WlQwaWFIUjBjRG92TDNkM2R5NXBibXR6WTJGd1pTNXZjbWN2Ym1GdFpYTndZV05sY3k5cGJtdHpZMkZ3WlNJS0lDQWdkMmxrZEdnOUlqRXdJZ29nSUNCb1pXbG5hSFE5SWpFd0lnb2dJQ0IyYVdWM1FtOTRQU0l3SURBZ01pNDJORFU0TXpNeUlESXVOalExT0RNek5DSUtJQ0FnZG1WeWMybHZiajBpTVM0eElnb2dJQ0JwWkQwaWMzWm5PRFUySWdvZ0lDQnBibXR6WTJGd1pUcDJaWEp6YVc5dVBTSXhMakF1TVNBb01TNHdMakVyY2pjektTSUtJQ0FnYzI5a2FYQnZaR2s2Wkc5amJtRnRaVDBpZEhKbFpTMWxiR0p2ZHkxdGFXNTFjeTV6ZG1jaVBnb2dJRHhrWldaekNpQWdJQ0FnYVdROUltUmxabk00TlRBaUlDOCtDaUFnUEhOdlpHbHdiMlJwT201aGJXVmtkbWxsZHdvZ0lDQWdJR2xrUFNKaVlYTmxJZ29nSUNBZ0lIQmhaMlZqYjJ4dmNqMGlJMlptWm1abVppSUtJQ0FnSUNCaWIzSmtaWEpqYjJ4dmNqMGlJelkyTmpZMk5pSUtJQ0FnSUNCaWIzSmtaWEp2Y0dGamFYUjVQU0l4TGpBaUNpQWdJQ0FnYVc1cmMyTmhjR1U2Y0dGblpXOXdZV05wZEhrOUlqQXVNQ0lLSUNBZ0lDQnBibXR6WTJGd1pUcHdZV2RsYzJoaFpHOTNQU0l5SWdvZ0lDQWdJR2x1YTNOallYQmxPbnB2YjIwOUlqRTFMamd6T1RFNU1pSUtJQ0FnSUNCcGJtdHpZMkZ3WlRwamVEMGlNalF1T0RBNU56WXhJZ29nSUNBZ0lHbHVhM05qWVhCbE9tTjVQU0l5TUM0ek1Ua3dNeklpQ2lBZ0lDQWdhVzVyYzJOaGNHVTZaRzlqZFcxbGJuUXRkVzVwZEhNOUluQjRJZ29nSUNBZ0lHbHVhM05qWVhCbE9tTjFjbkpsYm5RdGJHRjVaWEk5SW14aGVXVnlNU0lLSUNBZ0lDQnBibXR6WTJGd1pUcGtiMk4xYldWdWRDMXliM1JoZEdsdmJqMGlNQ0lLSUNBZ0lDQnphRzkzWjNKcFpEMGlabUZzYzJVaUNpQWdJQ0FnZFc1cGRITTlJbkI0SWdvZ0lDQWdJR2x1YTNOallYQmxPbmRwYm1SdmR5MTNhV1IwYUQwaU1UVXhOaUlLSUNBZ0lDQnBibXR6WTJGd1pUcDNhVzVrYjNjdGFHVnBaMmgwUFNJeE1ERTFJZ29nSUNBZ0lHbHVhM05qWVhCbE9uZHBibVJ2ZHkxNFBTSXdJZ29nSUNBZ0lHbHVhM05qWVhCbE9uZHBibVJ2ZHkxNVBTSXdJZ29nSUNBZ0lHbHVhM05qWVhCbE9uZHBibVJ2ZHkxdFlYaHBiV2w2WldROUlqQWlJQzgrQ2lBZ1BHMWxkR0ZrWVhSaENpQWdJQ0FnYVdROUltMWxkR0ZrWVhSaE9EVXpJajRLSUNBZ0lEeHlaR1k2VWtSR1Bnb2dJQ0FnSUNBOFkyTTZWMjl5YXdvZ0lDQWdJQ0FnSUNCeVpHWTZZV0p2ZFhROUlpSStDaUFnSUNBZ0lDQWdQR1JqT21admNtMWhkRDVwYldGblpTOXpkbWNyZUcxc1BDOWtZenBtYjNKdFlYUStDaUFnSUNBZ0lDQWdQR1JqT25SNWNHVUtJQ0FnSUNBZ0lDQWdJQ0J5WkdZNmNtVnpiM1Z5WTJVOUltaDBkSEE2THk5d2RYSnNMbTl5Wnk5a1l5OWtZMjFwZEhsd1pTOVRkR2xzYkVsdFlXZGxJaUF2UGdvZ0lDQWdJQ0FnSUR4a1l6cDBhWFJzWlQ0OEwyUmpPblJwZEd4bFBnb2dJQ0FnSUNBOEwyTmpPbGR2Y21zK0NpQWdJQ0E4TDNKa1pqcFNSRVkrQ2lBZ1BDOXRaWFJoWkdGMFlUNEtJQ0E4WndvZ0lDQWdJR2x1YTNOallYQmxPbXhoWW1Wc1BTSk1ZWGxsY2lBeElnb2dJQ0FnSUdsdWEzTmpZWEJsT21keWIzVndiVzlrWlQwaWJHRjVaWElpQ2lBZ0lDQWdhV1E5SW14aGVXVnlNU0krQ2lBZ0lDQThjR0YwYUFvZ0lDQWdJQ0FnYzNSNWJHVTlJbVpwYkd3Nkl6VTROVGcxT0R0bWFXeHNMVzl3WVdOcGRIazZNVHR6ZEhKdmEyVTZJelU0TlRnMU9EdHpkSEp2YTJVdGQybGtkR2c2TUM0eU5EWTJNemh3ZUR0emRISnZhMlV0YkdsdVpXTmhjRHBpZFhSME8zTjBjbTlyWlMxc2FXNWxhbTlwYmpwdGFYUmxjanR6ZEhKdmEyVXRiM0JoWTJsMGVUb3hJZ29nSUNBZ0lDQWdaRDBpVFNBd0xqSTROak0zT1RrNExEQXVOamd6TWpjNE16UWdTQ0F5TGpNMk1UWTBNemtnVENBeExqTTJOemMyTnpNc01pNHhNREU0TURreElGb2lDaUFnSUNBZ0lDQnBaRDBpY0dGMGFERTBPVGtpSUM4K0NpQWdQQzluUGdvOEwzTjJaejRLIiAvPjwvc3ZnPg==\")\n}\n\n.sm-toolbar-legend-box {\n    border-color: #414749\n}\n\n.x-tree-lines .x-tree-elbow, .x-tree-lines .x-tree-elbow-end, .x-tree-lines .x-tree-elbow-line {\n    background-image: none\n}\n\n.sm-drop {\n    border-color: #43494c;\n    color: #bdb7af\n}\n\n.sm-grid-result-sprite {\n    background-color: #1e2021;\n    border-color: #414749\n}\n\n.sm-result-pass {\n    color: hsl(120 84% 42% / 1);\n}\n\n.sm-result-fail {\n    color: hsl(19 100% 40% / 1);\n}\n\n.sm-result-na {\n    color: #767676\n}\n\n.sm-result-nr {\n    color: #c0bab2\n}\n\n.sm-grid-sprite {\n    background-color: #181a1b;\n    border-color: #414749\n}\n\n.sm-content-sprite {\n    color: #e6e4e1;\n    background-color: #20407f;\n    border-color: #414749\n}\n\n.sm-navtree-sprite {\n    background-color: #20407f;\n    color: #e6e4e1!important\n}\n\n.sm-severity-high {\n    color: hsl(0deg 50% 50%);\n    background-color: #1e2021\n}\n\n.sm-severity-medium {\n    color: #5c98d6;\n    background-color: transparent\n}\n\n.sm-severity-low {\n    color: hsl(120deg 54% 46%);\n    background-color: #1e2021\n}\n\n.sm-home-widget-text {\n    color: hsl(36deg 10% 85%)\n}\n\n.sm-home-widget-text a {\n    color: hsl(36deg 23% 55%)\n}\n\n.sm-home-widget-header-1 {\n    color: #e8e6e3\n}\n\n.sm-empty-cell {\n    color: #bdb7af\n}\n\n.sm-bare-button .x-btn-bc, .sm-bare-button .x-btn-bl, .sm-bare-button .x-btn-br, .sm-bare-button .x-btn-mc, .sm-bare-button .x-btn-ml, .sm-bare-button .x-btn-mr, .sm-bare-button .x-btn-tc, .sm-bare-button .x-btn-tl, .sm-bare-button .x-btn-tr {\n    background-image: none\n}\n\n.sm-round-panel .x-window-header {\n    color: #dddad6;\n    background-color: #35393b;\n    background-image: none\n}\n\n.x-window-plain .x-window-mc {\n    border-color: initial\n}\n\n.x-window-plain .x-window-body {\n    border-color: initial;\n    background-image: initial!important;\n    background-color: transparent!important\n}\n\n.x-window-bc, .x-window-bl, .x-window-br, .x-window-mc, .x-window-ml, .x-window-mr, .x-window-tc, .x-window-tl, .x-window-tr {\n    background-image: none\n}\n\n.sm-review-footer, .sm-review-form {\n    background-color: #1d1f20\n}\n\n.x-panel-header {\n    color: #dddad6\n}\n\n.x-tab-panel-body {\n    border-color: #3d4245;\n    background-color: transparent\n}\n\n.x-tab-strip .x-tab-strip-active span.x-tab-strip-text {\n    color: #dddad6\n}\n\n.x-tab-strip-top .x-tab-strip-over .x-tab-left, .x-tab-strip-top .x-tab-strip-over .x-tab-right, .x-tab-strip-top .x-tab-strip-over .x-tab-strip-inner {\n    background-color: #2b2f31\n}\n\n.x-tab-strip-top .x-tab-strip-active .x-tab-left, .x-tab-strip-top .x-tab-strip-active .x-tab-right, .x-tab-strip-top .x-tab-strip-active .x-tab-strip-inner {\n    background-color: hsl(200deg 5% 25%)\n}\n\n.x-tab-strip-top .x-tab-left, .x-tab-strip-top .x-tab-right, .x-tab-strip-top .x-tab-strip-inner {\n    background-image: none;\n    background-color: #25282a\n}\n\n.x-form-search, .x-form-text, textarea.x-form-field {\n    background-color: #181a1b;\n    background-image: none;\n    border-color: hsl(202deg 30% 25%)\n}\n\n.x-form-search:read-only, .x-form-text:read-only, textarea.x-form-field:read-only {\n    /* background-color: transparent; */\n    border-color: hsl(202 0% 25% / 1);\n    color: gray;\n}\n\n.x-form-text:read-only.x-trigger-noedit {\n    color: #d9d9d9\n}\n\n.sm-home-title {\n    background-image: url(\"../img/shield-green-check.svg\");\n    color: #c8c3bc;\n    filter: saturate(.75)\n}\n\n#sm-home-oss-sprite {\n    color: #e6e4e1;\n    background-color: #20407f\n}\n\n#sm-home-version-sprite {\n    color: #e6e4e1;\n    background-color: #457a67\n}\n\nul.x-tab-strip-top {\n    background-color: transparent;\n    background-image: none;\n    border-bottom-color: #3e4446\n}\n\nbody.x-body-masked .x-window-plain .x-window-mc {\n    background-color: #1b1e1f\n}\n\ntd.sort-asc, td.sort-desc, td.x-grid3-hd-menu-open, td.x-grid3-hd-over {\n    border-left-color: #35393b;\n    border-right-color: #3d4245\n}\n\n.x-grid3-header, td.sort-asc .x-grid3-hd-inner, td.sort-desc .x-grid3-hd-inner, td.x-grid3-hd-menu-open .x-grid3-hd-inner, td.x-grid3-hd-over .x-grid3-hd-inner {\n    background-color: #202325;\n    background-image: none\n}\n\n.x-toolbar {\n    border-color: #3d4245;\n    background-color: #272a2c;\n    background-image: none\n}\n\n.sm-border-layout-ct {\n    background-color: #1a1c1d\n}\n\n.x-border-layout-ct {\n    background-color: hsl(0 0% 8% / 1);\n}\n\n/* .sm-round-panel {\n    background-color: #276d90;\n} \n */\n.sm-round-panel .x-panel-header {\n    background-color: #35393b;\n    background-image: none\n}\n\n.sm-round-inner-panel .x-panel-header {\n    background-color: hsl(200 5% 17% / 1)\n}\n\n.sm-round-panel .sm-home-widget-body {\n    background-color: #2b2e30\n}\n\n.sm-user-list {\n    background-color: #2b2e30;\n}\n\n.sm-home-widget-header {\n    background-color: #313537\n}\n\n.sm-dialog-panel-title, .sm-home-widget-collectionName, .sm-home-widget-subtitle, .sm-home-widget-title {\n    color: #5c98d6\n}\n\n.sm-banner-unclassified {\n    background-color: #006229;\n    color: #e8e6e3\n}\n\n.sm-banner-cui {\n    background-color: #40226a;\n    color: #e8e6e3\n}\n\n.sm-banner-confidential {\n    background-color: #002980;\n    color: #e8e6e3\n}\n\n.sm-banner-secret {\n    background-color: #a00d25;\n    color: #e8e6e3\n}\n\n.sm-banner-topsecret {\n    background-color: #b93c00;\n    color: #e8e6e3\n}\n\n.sm-banner-sci {\n    background-color: #9f9307;\n    color: #e8e6e3\n}\n\n.hbss-control .x-grid3-hd-checker, .hbss-control .x-grid3-row-checker {\n    background-image: url(\"../img/hbss-check-sprite.gif\")\n}\n\n.assignment-grid-item-selected {\n    background-color: #6c0000\n}\n\n.icon-department {\n    background-image: url(\"../img/department-16.png\")!important;\n    background-color: initial!important\n}\n\n.icon-refresh {\n    background-image: url(\"../img/reload.svg\");\n    background-color: initial\n}\n\n.icon-add {\n    background-image: url(\"../img/add.svg\");\n    background-color: initial\n}\n\n.icon-edit {\n    background-image: url(\"../img/edit.svg\")!important;\n    background-color: initial!important\n}\n\n.icon-save {\n    background-image: url(\"../img/save.gif\")!important;\n    background-color: initial!important\n}\n\n.icon-new-window {\n    background-image: url(\"../img/new_window.gif\")!important;\n    background-color: initial!important\n}\n\n.icon-new-tab {\n    background-image: url(\"../img/new_tab.gif\")!important;\n    background-color: initial!important\n}\n\n.icon-icon-all {\n    background-image: url(\"../img/icon-all.gif\")!important;\n    background-color: initial!important\n}\n\n.icon-excel {\n    background-image: url(\"../img/excel-16.gif\")!important;\n    background-color: initial!important\n}\n\n.cs-section-five-o-eight {\n    text-decoration-color: initial\n}\n\n.sm-rule-body {\n    background-color: hsl(210deg 6% 16%);\n}\n\n.sm-rule-body-title {\n    color: #5c98d6\n}\n\n.sm-rule-body-text {\n    color: hsl(36deg 10% 85%)\n}\n\n.sm-reviews-home-body-title {\n    color: #5c98d6\n}\n\n.sm-reviews-home-body-text {\n    color: #e8e6e3\n}\n\n.sm-reviews-home-tasks {\n    background-color: #930000\n}\n\n.sm-reviews-home-no-tasks {\n    background-color: #2c501c\n}\n\n.sm-feedback-panel-active {\n    background-color: #930000\n}\n\n.sm-feedback-panel-inactive {\n    background-color: #181a1b\n}\n\n.sm-feedback-body-title {\n    color: #5c98d6\n}\n\n.sm-feedback-body-text {\n    color: #e8e6e3\n}\n\n.deferral-approval-trigger {\n    background-image: url(\"../img/trigger2.png\")!important\n}\n\n.sm-manual-grid-item {\n    background-color: #181a1b\n}\n\n.sm-manual-grid-item.x-grid3-row-over {\n    background-color: #212425\n}\n\n.sm-grid3-row-red {\n    background-color: #6c0000\n}\n\n.sm-grid3-row-grey {\n    background-color: #2b2f31\n}\n\n.sm-grid3-row-orange {\n    background-color: #703800\n}\n\n.sm-grid3-row-green {\n    background-color: #2c501c\n}\n\n.sm-grid3-row-black td {\n    background-color: #0b0c0d;\n    color: #e8e6e3!important\n}\n\n.sm-grid3-row-error td, .sm-grid3-row-italic td {\n    background-color: #ff4b4b33 !important;\n}\n\n.x-grid3-row-over {\n    border-color: #3a3e41;\n    background-color: #212425;\n    background-image: none\n}\n\n.sm-add-icon {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTYiIGhlaWdodD0iMTYiPjxkZWZzPjxmaWx0ZXIgaWQ9ImRhcmtyZWFkZXItaW1hZ2UtZmlsdGVyIj48ZmVDb2xvck1hdHJpeCB0eXBlPSJtYXRyaXgiIHZhbHVlcz0iMC4yNDkgLTAuNjE0IC0wLjY3MiAwLjAwMCAxLjAzNSAtMC42NDYgMC4yODggLTAuNjY0IDAuMDAwIDEuMDIwIC0wLjYzNiAtMC42MDkgMC4yNTAgMC4wMDAgMC45OTQgMC4wMDAgMC4wMDAgMC4wMDAgMS4wMDAgMC4wMDAiIC8+PC9maWx0ZXI+PC9kZWZzPjxpbWFnZSB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIGZpbHRlcj0idXJsKCNkYXJrcmVhZGVyLWltYWdlLWZpbHRlcikiIHhsaW5rOmhyZWY9ImRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBQkFBQUFBUUNBWUFBQUFmOC85aEFBQUFCbUpMUjBRQS93RC9BUCtndmFlVEFBQUEzRWxFUVZRNGpjWFNUVTZDTVJTRjRVY0RPZ0dtT0ZEMlljQUY2RDdVdUIxQ3dncFVWa0NNUTlmQmp3a3kwZ1hJU0FlOVh5Sk5QM0JpZkpPbWYvZWUzdmFVUCtBQ0U2eXh3UnNlMGQrWDJNQVljMXpqRk0zb2I3REFLT0tLakRGRnEyYS9oYWNRS1pZOTI1RmMwY1pTNFRxVEtEdm5xN0IyaTRkOGNTM2Q5VGNDUGVsaHQ5amdLRXZNVzhVeFBxdkpZZlFmNlA0SU9vaVdqK0VFNzduQUN5NEw1WmE0aXZndEJwTC83VDNKSGJ6aXZMUTVrbnl1RStuZ0djTTY5VWFJTENXcnpxU0g3ZUV1VGg3YThSTXIrcExQSzhtZEZlN3J5djUvdmdGRWtpd3ltOVR5bUFBQUFBQkpSVTVFcmtKZ2dnPT0iIC8+PC9zdmc+\")!important\n}\n\n.sm-disc-drive {\n    background-image: url(\"../img/disc_drive.png\")!important\n}\n\n.sm-internet-search {\n    background-image: url(\"../img/internet_search.png\")!important\n}\n\n.sm-search-icon {\n    background-image: url(\"../img/search.png\")!important\n}\n\n.sm-filter-icon {\n    background-image: url(\"data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iNjgxIiBoZWlnaHQ9IjY4MSI+PGRlZnM+PGZpbHRlciBpZD0iZGFya3JlYWRlci1pbWFnZS1maWx0ZXIiPjxmZUNvbG9yTWF0cml4IHR5cGU9Im1hdHJpeCIgdmFsdWVzPSIwLjI0OSAtMC42MTQgLTAuNjcyIDAuMDAwIDEuMDM1IC0wLjY0NiAwLjI4OCAtMC42NjQgMC4wMDAgMS4wMjAgLTAuNjM2IC0wLjYwOSAwLjI1MCAwLjAwMCAwLjk5NCAwLjAwMCAwLjAwMCAwLjAwMCAxLjAwMCAwLjAwMCIgLz48L2ZpbHRlcj48L2RlZnM+PGltYWdlIHdpZHRoPSI2ODEiIGhlaWdodD0iNjgxIiBmaWx0ZXI9InVybCgjZGFya3JlYWRlci1pbWFnZS1maWx0ZXIpIiB4bGluazpocmVmPSJkYXRhOmltYWdlL3N2Zyt4bWw7YmFzZTY0LFBITjJaeUJvWldsbmFIUTlJalV4TVhCMElpQjJhV1YzUW05NFBTSXdJREFnTlRFeElEVXhNUzQ1T1RrNE1pSWdkMmxrZEdnOUlqVXhNWEIwSWlCNGJXeHVjejBpYUhSMGNEb3ZMM2QzZHk1M015NXZjbWN2TWpBd01DOXpkbWNpUGp4d1lYUm9JR1E5SW0wME9USXVORGMyTlRZeUlEQm9MVFEzTVM0NU56WTFOakpqTFRFeExqQTBOamczTlNBd0xUSXdJRGd1T1RVek1USTFMVEl3SURJd0lEQWdOVFV1TmprMU16RXlJREl6TGpnM05TQXhNRGd1T0RZM01UZzRJRFkxTGpVd016a3dOaUF4TkRVdU9EY3hNRGswYkRnM0xqVTRPVGcwTkNBM055NDROVEUxTmpKak1UVXVNVGczTlNBeE15NDFJREl6TGpnNU9EUXpPQ0F6TWk0NE9UZzBNemdnTWpNdU9EazRORE00SURVekxqSXlNalkxTm5ZeE9UVXVNRE14TWpWak1DQXhOUzQ1TXpjMUlERTNMamd4TWpVZ01qVXVORGt5TVRnNElETXhMakE0T1RnME15QXhOaTQyTXpZM01UbHNNVEUzTGprNU5qQTVOQzAzT0M0Mk5qQXhOVFpqTlM0MU5qSTFMVE11TnpFd09UTTNJRGd1T1RBMk1qVXRPUzQ1TlRNeE1qVWdPQzQ1TURZeU5TMHhOaTQyTkRBMk1qVjJMVEV4Tmk0ek5qY3hPRGhqTUMweU1DNHpNalF5TVRnZ09DNDNNVEE1TXpjdE16a3VOekl5TmpVMklESXpMamc1T0RRek55MDFNeTR5TWpJMk5UWnNPRGN1TlRnMU9UTTRMVGMzTGpnMU1UVTJNbU0wTVM0Mk1qZzVNRFl0TXpjdU1EQXpPVEEySURZMUxqVXdNemt3TmkwNU1DNHhOelUzT0RJZ05qVXVOVEF6T1RBMkxURTBOUzQ0TnpFd09UUWdNQzB4TVM0d05EWTROelV0T0M0NU5UTXhNalV0TWpBdE1Ua3VPVGsyTURrMExUSXdlbTB0TnpJdU1EZ3lNRE14SURFek5TNDVOekkyTlRZdE9EY3VOVGcxT1RNM0lEYzNMamcxTlRRMk9XTXRNak11TnpFNE56VWdNakV1TURnMU9UTTNMVE0zTGpNeU5ESXhPU0ExTVM0ek56ZzVNRFl0TXpjdU16STBNakU1SURnekxqRXhNekk0TVhZeE1EVXVOalkzT1RZNWJDMDNOeTQ1T1RZd09UUWdOVEV1T1RrMk1EazBkaTB4TlRjdU5qWXdNVFUzWXpBdE16RXVOek00TWpneExURXpMall3TlRRMk9TMDJNaTR3TXpFeU5TMHpOeTR6TWpReU1Ua3RPRE11TVRFM01UZzNiQzA0Tnk0MU9EVTVNemN0TnpjdU9EVXhOVFl6WXkweU9DNHdOekF6TVRNdE1qUXVPVFUzTURNeExUUTFMams0T0RJNE1TMDFPUzR4TlRJek5ETXROVEF1TnpnMU1UVTJMVGsxTGprNE1EUTJPR2cwTWprdU16ZzJOekU1WXkwMExqYzVOamczTmlBek5pNDRNamd4TWpVdE1qSXVOekV3T1RNNElEY3hMakF5TXpRek55MDFNQzQzT0RVeE5UY2dPVFV1T1RjMk5UWXllbTB3SURBaUx6NDhMM04yWno0PSIgLz48L3N2Zz4=\")\n}\n\n.sm-control-panel {\n    background-image: url(\"../img/control_panel.png\")!important\n}\n\n.sm-checklist-icon {\n    background-image: url(\"../img/shield-green-check.svg\")!important;\n    filter: saturate(.75)\n}\n\n.sm-checklist-tab-icon {\n    background-image: url(\"../img/shield-green-check.svg\")!important\n}\n\n.sm-setting-icon {\n    background-image: url(\"../img/gear.svg\")!important\n}\n\n.sm-export-icon {\n    background-image: url(\"../img/download.svg\")\n}\n\n.sm-import-icon {\n    background-image: url(\"../img/upload.svg\")\n}\n\n.sm-asset-icon {\n    background-image: url(\"../img/target.svg\")!important\n}\n\n.sm-template-icon {\n    background-image: url(\"../img/template.png\")!important\n}\n\n.sm-library-icon {\n    background-image: url(\"../img/library.svg\")!important\n}\n\n.sm-folder-icon {\n    background-image: url(\"../img/folder.svg\")!important\n}\n\n.sm-collection-icon, .sm-collection-tab-icon {\n    background-image: url(\"../img/collection.svg\")!important\n}\n\n.sm-department-icon {\n    background-image: url(\"../img/department-16.png\")!important\n}\n\n.sm-stig-icon {\n    background-image: url(\"../img/shield-green-check.svg\")!important;\n    filter: saturate(.75)\n}\n\n.sm-report-icon {\n    background-image: url(\"../img/grid.svg\")!important\n}\n\n.sm-chat-icon {\n    background-image: url(\"../img/chat-16.png\")!important\n}\n\n.sm-ackchat-icon, .sm-newchat-icon, .sm-unackchat-icon {\n    background-image: url(\"../img/message_edit.png\")!important\n}\n\n.sm-feedback-icon {\n    background-image: url(\"../img/feedback-16.gif\")!important\n}\n\n.sm-feedback-ack-icon {\n    background-image: url(\"../img/feedback-ack-16.gif\")!important\n}\n\n.sm-feedback-unack-icon {\n    background-image: url(\"../img/feedback-unack-16.gif\")!important\n}\n\n.sm-artifact-icon {\n    background-image: url(\"../img/page_white_text.png\")!important\n}\n\n.sm-note-icon {\n    background-image: url(\"../img/note-16.png\")!important\n}\n\n.sm-star-icon, .sm-star-icon-16 {\n    background-image: url(\"../img/star.svg\")!important\n}\n\n.sm-assign-icon {\n    background-image: url(\"../img/right-arrow-16.png\")!important\n}\n\n.sm-unlock-icon {\n    background-image: url(\"../img/unlock-16.png\")!important\n}\n\n.sm-ready-icon {\n    background-image: url(\"../img/ready-16.png\")!important\n}\n\n.sm-ready-flip-icon {\n    background-image: url(\"../img/ready-flip-16.png\")!important\n}\n\n.x-btn-pressed.sm-star-icon {\n    background-image: url(\"../img/star.svg\")!important\n}\n\n.sm-save-icon {\n    background-image: url(\"../img/save-16.png\")!important\n}\n\n.sm-disk-icon {\n    background-image: url(\"../img/save-icon.svg\")!important\n}\n\n.sm-database-save-icon {\n    background-image: url(\"../img/database.svg\")!important\n}\n\n.sm-table-icon {\n    background-image: url(\"../img/table.png\")!important\n}\n\n.sm-page-edit-icon {\n    background-image: url(\"../img/page_edit.png\")!important\n}\n\n.sm-page-white-get-icon {\n    background-image: url(\"../img/page_white_get.png\")!important\n}\n\n.sm-page-white-put-icon {\n    background-image: url(\"../img/page_white_put.png\")!important\n}\n\n.sm-hbss-disabled-icon, .sm-hbss-enabled-icon {\n    background-image: url(\"../img/hbss-check-sprite.gif\")\n}\n\n.sm-application-go-icon {\n    background-image: url(\"../img/application_go.png\")!important\n}\n\n.sm-list-remove-16-icon {\n    background-image: url(\"../img/list-remove-16.png\")\n}\n\n.sm-scan-assign-icon {\n    background-image: url(\"../img/greencheckt.gif\")\n}\n\n.x-item-disabled .sm-scan-assign-icon {\n    background-image: url(\"../img/greycheckt.gif\")\n}\n\n.sm-scan-unassign-icon {\n    background-image: url(\"../img/greydash.gif\")\n}\n\n.sm-scan-toggleAssign-icon {\n    background-image: url(\"../img/icon-all.gif\")\n}\n\n.sm-zip-icon {\n    background-image: url(\"../img/compress.png\")\n}\n\n.sm-scap-grid-item {\n    background-color: #1e3516\n}\n\n.sm-scap-grid-item.x-grid3-row-over {\n    background-color: #24361e\n}\n\n.sm-scap-grid-item.x-grid3-row-selected {\n    background-color: #2d3c28!important\n}\n\n.sm-cell-red {\n    background-color: #6c0000;\n    border-right-color: #303436;\n    border-left-color: #303436\n}\n\n.x-grid3-row-over .sm-cell-red {\n    background-color: #4e0b0b!important\n}\n\n.sm-cell-orange {\n    background-color: #703800;\n    border-right-color: #303436;\n    border-left-color: #303436\n}\n\n.x-grid3-row-over .sm-cell-orange {\n    background-color: #502e0b!important\n}\n\n.sm-cell-green {\n    background-color: #2c501c;\n    border-right-color: #303436;\n    border-left-color: #303436\n}\n\n.x-grid3-row-over .sm-cell-green {\n    background-color: #253d1c!important\n}\n\n.sm-cell-grey {\n    background-color: #2b2f31;\n    border-right-color: #303436;\n    border-left-color: #303436\n}\n\n.sm-cell-purple {\n    background-color: #5f225f;\n    border-right-color: #303436;\n    border-left-color: #303436\n}\n\n.x-grid3-row-over .sm-cell-purple {\n    background-color: #441f44!important\n}\n\n.sm-cell-peach {\n    background-color: #6c5a04\n}\n\n.sm-cell-status {\n    background-color: hsl(192deg 55% 16%);\n    border-left-color: #303436\n}\n\n.x-grid3-row-over .sm-cell-status {\n    border-left-color: #303436;\n    background-color: #242728!important\n}\n\n.sm-cell-checklist {\n    background-image: url(\"../img/security_firewall_on.png\")\n}\n\n.sm-cell-asset {\n    background-image: url(\"../img/target.svg\")\n}\n\n.sm-cell-template {\n    background-image: url(\"../img/template.png\")\n}\n\n.custom-stig-users .x-grid3-row-selected .x-grid3-cell-last {\n    background-image: url(\"../img/User-Group-icon.png\")\n}\n\n.sm-artifact-download-icon {\n    background-image: url(\"../img/download.svg\")\n}\n\n.sm-artifact-edit-icon {\n    background-image: url(\"../img/edit-16.png\")\n}\n\n.x-grid3-row-over .artifact-download {\n    background-image: url(\"../img/download.svg\")\n}\n\n.x-grid3-row-over .artifact-view {\n    background-image: url(\"../img/eye.svg\")\n}\n\n.x-grid3-row-over .artifact-edit {\n    background-image: url(\"../img/edit-16.png\")\n}\n\n.x-grid3-row-over .artifact-delete {\n    background-image: url(\"../img/delete.png\")\n}\n\n.x-grid3-row-over .artifact-download :active, .x-grid3-row-over .artifact-download:active {\n    background-image: url(\"../img/download.svg\")\n}\n\n.sm-reviews-home-background {\n    background-color: #181a1b\n}\n\n.sm-background-blue {\n    background-color: #222426!important\n}\n\n.x-grid3-summary-row {\n    border-left-color: #303436;\n    border-right-color: #303436;\n    color: #c8c3bc;\n    background-image: initial;\n    background-color: #1f2223\n}\n\n.sm-review-action-textarea[disabled], .sm-review-result-textarea[disabled] {\n    color: #e8e6e3;\n    background-image: none;\n    background-color: initial\n}\n\n.sm-combo-loading {\n    background-image: url(\"../img/loading.gif\")\n}\n\n.sm-context-menu {\n    background-image: none\n}\n\n.sm-context-menu-header {\n    background-color: #272a2c;\n    border-color: #1a4072\n}\n\n.fa-border {\n    border-color: #35393b\n}\n\n.fa-inverse {\n    color: #e8e6e3\n}\n\n.sr-only {\n    border-color: initial\n}\n\n.x-form-file-wrap .x-form-file-text {\n    color: #9d9488\n}\n\n.x-row-editor-footer, .x-row-editor-header {\n    background-image: url(../img/row-editor-bg-dark.gif);\n    background-color: transparent\n}\n\n.x-row-editor-body {\n    background-image: initial;\n    background-color: #25282a\n}\n\n.x-row-editor .x-btns, .x-row-editor .x-btns .x-plain-body, .x-row-editor .x-btns .x-plain-bwrap {\n    background-image: url(\"../img/row-editor-btns-dark.gif\");\n    background-color: transparent\n}\n\n.x-row-editor.x-small-editor {\n    border-right: 1px solid #c4c4c4\n}\n\n.json-container {\n    background-color: #181a1b;\n    color: #988f81\n}\n\n.json-container .json-key {\n    color: #bdb7af\n}\n\n.json-container .json-number {\n    color: #ff941a\n}\n\n.json-container .json-object {\n    color: #6b91d8\n}\n\n.json-container .json-boolean {\n    color: #ec6168\n}\n\n.json-container .json-string {\n    color: #b0f76d\n}\n\n.json-container .sm-caret-down {\n    border-color: #545b5e transparent\n}\n\n.json-container .sm-caret-right {\n    border-color: transparent transparent transparent #545b5e\n}\n\n.vimvixen-hint {\n    background-color: #7b5300!important;\n    border-color: #d8b013!important;\n    color: #f3e8c8!important\n}\n\na[href=\"https://coinmarketcap.com/\"] > svg[width=\"94\"][height=\"16\"] > path {\n    fill: var(--darkreader-neutral-text)!important\n}\n\n#edge-translate-panel-body {\n    color: var(--darkreader-neutral-text)!important\n}\n\ngr-main-header {\n    background-color: #0f3a48!important\n}\n\nembed[type=\"application/pdf\"] {\n    filter: invert(100%) contrast(90%)\n}\n\n.ext-el-mask-msg span {\n    border: 3px solid #bbb;\n    border-bottom-color: transparent\n}\n\n.ext-el-mask-msg div {\n    background-color: #565656;\n    color: #eee\n}\n\n.ext-el-mask-modal {\n    background-color: rgb(0 0 0 / 65%)\n}\n\n.x-tool:hover {\n    filter: brightness(150%)\n}\n\n.sm-line-height-up {\n    background-image: url(../img/line-height-up-dark.svg);\n    background-size: 16px 16px;\n}\n\n.sm-line-height-down {\n    background-image: url(../img/line-height-down-dark.svg);\n    background-size: 16px 16px;\n}\n\n.d2h-file-wrapper {\n    border-color: #444;\n}\n\n.d2h-file-header {\n    border-bottom-color: #444;\n    background-color: hsl(204deg 6% 16%);\n}\n\n.d2h-info {\n    background-color: hsl(216deg 56% 60%);\n    border-color: hsl(216deg 56% 55%);\n}\n\n.d2h-file-name-wrapper {\n    color: #999\n}\n\n.d2h-code-line del, .d2h-code-side-line del {\n    background-color: hsl(0 63% 31% / 1);\n}\n\n.d2h-file-diff .d2h-del.d2h-change {\n    background-color: hsl(0 60% 17% / 1);\n}\n\n.d2h-file-diff .d2h-ins.d2h-change {\n    background-color: hsl(110deg 22% 22%);\n}\n\n.d2h-code-line ins, .d2h-code-side-line ins {\n    background-color: hsl(110deg 35% 30%);\n}\n\n.d2h-code-linenumber {\n    background-color: transparent;\n    color: hsl(0deg 0% 50%);\n    border-right-color: hsl(0 0% 20%);\n}\n\n.d2h-del {\n    background-color: hsl(0 60% 17% / 1);\n    border-right-color: hsl(0 59% 20%);\n}\n\n.d2h-file-diff {\n    background-color: hsl(195deg 7% 11%);\n}\n\n.d2h-ins {\n    background-color: hsl(110deg 22% 22%);\n    border-right-color: hsl(120 33% 20%);\n}\n\n.sm-diff-ins {\n    background-color: hsl(78deg 35% 26%);\n}\n\n.sm-diff-del {\n    background-color: hsl(0deg 71% 25%)\n}\n.sm-round-panel .x-panel-header.sm-selections-panel-header {\n    background-color: var(--metrics-status-chart-submitted-dark);\n}\n.sm-grabbing *, .sm-grabbing .sm-grid3-draggable .x-grid3-row-selected *, .sm-grabbing .sm-grid3-draggable .x-grid3-row-selected {\n    cursor: url(\"../img/drag-drop-dark.svg\"), grabbing;\n}\n.sm-appinfo-message {\n    background-color: #2d2d2d;\n    color: #999999;\n}\n.sm-render-zero {\n\tcolor: #444444\n}\n.sm-whats-new img {\n  border: 1px solid hsl(0 0% 20% / 1)\n}\n\n.sm-feedback-box {\n  background-color: #2d3e4a;\n  border: 1px solid #3a4d5c;\n}\n\n.sm-feedback-box-title {\n  color: #7ab3e8;\n}\n\n.sm-feedback-box-content {\n  color: hsl(36deg 10% 85%);\n}\n\n.sm-feedback-box-content a {\n  color: #7ab3e8;\n}\n\n.x-btn {\n    background-color: #424242;\n    border-radius: 6px;\n}\n\n.x-btn:hover {\n    background-color: var(--metrics-status-chart-submitted-dark);\n}\n.x-toolbar .x-btn {\n    background-color: transparent;\n}\n\n.x-toolbar .x-btn:hover {\n    background-color: var(--metrics-status-chart-submitted-dark);\n}\n\n.x-toolbar .x-btn-pressed.x-btn {\n    background-color: var(--metrics-status-chart-submitted-dark);\n}\n\n.sm-label-sprite.sm-sprite-read, .sm-label-sprite.sm-sprite-readwrite {\n    color: #000000;\n}\n\n.x-form-field-wrap:hover .x-form-file-btn {\n\tbackground-color: var(--metrics-status-chart-submitted-dark);\n\tborder-radius: 5px;\n}\n\n.sm-cora-box-right {\n    border: 1px solid #444;\n}\n.sm-cora-cat {\n    border: 1px solid #444;\n}\n\n.sm-metrics-age-box {\n    background-color: #aaa\n}\n\n.x-btn-pressed {\n    box-shadow: inset 0px 0px 0px 1px hsl(0 0% 50% / 1);\n}\n\n.sm-log-line[data-component=\"logSocket\"] {\n  color: #c48eff;\n}\n\n.sm-log-line[data-component=\"jwksCache\"] {\n  color: #e7a15e;\n}\n\n.sm-log-line[data-component=\"static\"] {\n  color: #808080;\n}\n\n.sm-log-line[data-component=\"rest\"] {\n  color: #5ee75e;\n}\n\n.sm-log-line[data-level=\"1\"] {\n  color: red;\n}\n\n.sm-log-line[data-level=\"2\"] {\n  color: orange;\n}\n"
  },
  {
    "path": "client/src/css/init.css",
    "content": "\n#loading-mask {\n  position: absolute;\n  left: 0;\n  top: 0;\n  width: 100%;\n  height: 100%;\n  z-index: 20000;\n  display: flex;\n  align-items: start;\n  justify-content: center;\n  background-color: #2a3037;\n  color: #d0cec5;\n}\n\n#loading {\n  position: absolute;\n  top: 100px;\n  display: flex;\n  flex-direction: column;\n  align-items: center;\n  justify-content: flex-start;\n  gap: 16px; /* space between items */\n}\n\n#loading .loading-indicator {\n  background: url(\"../img/loading.svg\") no-repeat;\n  background-position: center top;\n  background-size: 50px;\n  color: #d0cec5;\n  font: bold 42px helvetica, sans-serif;\n  padding: 50px 0px;\n  margin: 0;\n  text-align: center;\n  height: auto;\n}\n\n#loading-text {\n  font: bold 12px helvetica, sans-serif;\n  padding-top: 8px;\n}\n\n#loading-text a {\n  color: #d0cec5;\n  background: url(\"../img/external-link.svg\") no-repeat 100% 0;\n  background-size: 12px 12px;\n  padding-right: 16px;\n}"
  },
  {
    "path": "client/src/css/jsonview.bundle.css",
    "content": ".json-container {\n  font-family: 'Open Sans';\n  font-size: 11px;\n  background-color: transparent;\n  color: #808080;\n  box-sizing: border-box;\n  }\n  .json-container .line {\n    margin: 2px 0;\n    display: flex;\n    justify-content: flex-start;\n    }\n  .json-container .caret-icon {\n    width: 18px;\n    text-align: center;\n    cursor: pointer; }\n  .json-container .empty-icon {\n    margin-left: 18px; }\n  .json-container .json-type {\n    margin-right: 4px;\n    margin-left: 4px; }\n  .json-container .empty-icon ~ .json-key {\n    font-weight: unset; }  \n  .json-container .json-key {\n    color: #444;\n    font-weight: 600;\n    margin-right: 4px;\n    margin-left: 4px; }\n  .json-container .json-index {\n    margin-right: 4px;\n    margin-left: 4px; }\n  .json-container .json-value {\n    margin-left: 8px; }\n  .json-container .json-number {\n    color: #ff8800;\n    }\n  .json-container .json-object {\n    color: #6b65d7;\n    }\n  .json-container .json-boolean {\n    color: #ec5f66; }\n  .json-container .json-string {\n    color: hsl(91 89% 29% / 1);\n    }\n  .json-container .json-size {\n    margin-right: 4px;\n    margin-left: 4px; }\n  .json-container .hide {\n    display: none; }\n  .json-container .sms {\n    display: inline-block;\n    width: 0;\n    height: 0;\n    border-style: solid;\n    }\n  .json-container .sm-caret-down {\n    border-width: 6px 5px 0 5px;\n    border-color: #585858 transparent;\n    }\n  .json-container .sm-caret-right {\n    border-width: 5px 0 5px 6px;\n    border-color: transparent transparent transparent #585858;\n    }\n"
  },
  {
    "path": "client/src/css/stigman.css",
    "content": ":root {\n  --metrics-status-chart-assessed-light: hsl(230deg 41% 86%);\n  --metrics-status-chart-submitted-light: hsl(92deg 44% 77%);\n  --metrics-status-chart-accepted-light: hsl(146deg 60% 69%);\n  --metrics-status-chart-unassessed-light: hsl(0deg 0% 93%);\n  --metrics-status-chart-unsaved-light: hsl(0deg 0% 93%);\n  --metrics-status-chart-rejected-light: hsl(13deg 69% 75%);\n  --metrics-status-chart-assessed-dark: hsl(204deg 91% 25%);\n  --metrics-status-chart-submitted-dark: hsl(87deg 41% 25%);\n  --metrics-status-chart-accepted-dark: hsl(146deg 90% 25%);\n  --metrics-status-chart-unassessed-dark: hsl(0 0% 18% / 1);\n  --metrics-status-chart-unsaved-dark: hsl(0deg 0% 18%);\n  --metrics-status-chart-rejected-dark: hsl(5deg 90% 25%);\n  --color-severity-high: hsl(13deg 68% 75%);\n  --color-severity-medium: hsl(38 100% 78% / 1);\n  --color-severity-low: hsl(230deg 41% 86%);\n  --color-risk-very-high: var(--color-severity-high);\n  --color-risk-very-high-text: rgb(88, 12, 21);\n  --color-risk-high: var(--color-severity-medium);\n  --color-risk-high-text: rgb(146, 50, 18);\n  --color-risk-moderate: hsl(60 100% 80% / 1);\n  --color-risk-moderate-text: #805500;\n  --color-risk-low: var(--color-severity-low);\n  --color-risk-low-text: rgb(14, 90, 161);\n  --color-risk-very-low: #c3deab;\n  --color-risk-very-low-text: rgb(0, 100, 0);\n  --color-scrollbar-idle: #d0d0d0;\n  --color-scrollbar-hover: #b0b0b0;\n  --color-marking-unclassified: #007a33;\n  --color-marking-cui: #502b85;\n  --color-marking-confidential: #0033a0;\n  --color-marking-fouo: #502b85;\n  --color-marking-secret: #c8102e;\n  --color-marking-topsecret: #ff671f;\n  --color-marking-sci: #f7ea48;\n  --color-http-status-200: #7dd491;\n  --color-http-status-300: #99c2ff;\n  --color-http-status-400: #ffc099;\n  --color-http-status-500: #ff9999;\n  --color-job-run-state-completed: hsl(121 84% 50% / 1);\t\n  --color-job-run-state-running: hsl(222, 84%, 50%);\n  --color-job-run-state-failed: hsl(1deg 74.55% 52.35%);\n  --color-job-run-state-missing: hsl(0 0% 73% / 1);\n}\n\n.x-tree-node-collapsed .x-tree-node-icon,\n.x-tree-node-expanded .x-tree-node-icon,\n.x-tree-node-leaf .x-tree-node-icon {\n  width: 22px;\n}\n\n.sm-grid-cell-with-toolbar {\n  position: relative;\n}\n\n.sm-grid-cell-with-toolbar .sm-dynamic-width {\n  margin-right: 0px;\n}\n\n.sm-grid-cell-with-toolbar .sm-info {\n  text-overflow: ellipsis;\n  overflow: hidden;\n  white-space: nowrap;\n}\n\n.sm-grid-cell-with-toolbar .sm-static-width {\n  position: absolute;\n  visibility: hidden;\n  top: 0;\n  right: 0;\n}\n\n.x-grid3-row-over .sm-grid-cell-with-toolbar .sm-dynamic-width {\n  margin-right: 28px;\n}\n\n.x-grid3-row-over .sm-grid-cell-with-toolbar .sm-static-width {\n  visibility: visible;\n  filter: grayscale(100%) brightness(125%);\n}\n\n.x-grid3-row-over .sm-grid-cell-with-toolbar .sm-static-width:hover {\n  scale: 110%;\n  filter: brightness(100%);\n}\n\n\n.sm-grid-cell-with-toolbar-2 {\n  position: relative;\n}\n\n.sm-grid-cell-with-toolbar-2 .sm-dynamic-width {\n  margin-right: 0px;\n}\n\n.sm-grid-cell-with-toolbar-2 .sm-info {\n  text-overflow: ellipsis;\n  overflow: hidden;\n  white-space: nowrap;\n}\n\n.sm-grid-cell-with-toolbar-2 .sm-static-width {\n  position: absolute;\n  visibility: hidden;\n  top: 0;\n  right: 0;\n}\n\n.x-grid3-row-over .sm-grid-cell-with-toolbar-2 .sm-dynamic-width {\n  margin-right: 58px;\n}\n\n.x-grid3-row-over .sm-grid-cell-with-toolbar-2 .sm-static-width .sm-grid-cell-tool img {\n  visibility: visible;\n  filter: grayscale(100%) brightness(125%);\n}\n\n.x-grid3-row-over .sm-grid-cell-with-toolbar-2 .sm-static-width .sm-grid-cell-tool:hover img {\n  cursor: pointer;\n  scale: 125%;\n  filter: brightness(100%);\n}\n\n.sm-metrics-no-assessments-body {\n  color: #bbb;\n  display: flex;\n  justify-content: center;\n  align-items: center;\n  height: inherit;\n  width: inherit\n}\n\n.sm-metrics-progress-parent {\n  text-align: center\n}\n\n.sm-metrics-progress-child {\n  display: inline-block;\n  width: 73px;\n  border-radius: 5px;\n  margin: 0 9px;\n  vertical-align: middle\n}\n\n.sm-metrics-progress-label {\n  font-weight: 600;\n  padding-bottom: 4px\n}\n\n.sm-metrics-progress-child .sm-metrics-progress-thermometer-wrap {\n  height: 20px;\n  line-height: 20px;\n  font-weight: 600\n}\n\n.sm-metrics-progress-child .sm-cell-mercury-high,\n.sm-metrics-progress-child .sm-cell-mercury-low,\n.sm-metrics-progress-child .sm-cell-mercury-medium,\n.sm-metrics-progress-child .sm-cell-thermometer-bg {\n  height: 100%\n}\n\n.sm-metrics-status-table {\n  padding-top: 10px\n}\n\n.sm-metrics-status-pct {\n  text-align: center;\n  font-size: large;\n  font-weight: 600\n}\n\n.sm-metrics-status-table .sm-metrics-total {\n  font-weight: 600\n}\n\n.sm-metrics-status-table .sm-metrics-total td {\n  font-weight: 600;\n  border-top: 1px solid #bbb\n}\n\n.sm-metrics-status-table tr {\n  height: 19px\n}\n\n.sm-metrics-status-table td {\n  padding-left: 4px;\n  padding-right: 4px\n}\n\n.sm-metrics-status-table .sm-metrics-value {\n  text-align: right;\n  padding-left: 10px\n}\n\n.sm-metrics-status-table .sm-metrics-label {\n  border: 1px solid #bbb;\n  border-radius: 3px\n}\n\n.sm-metrics-status-table .sm-metrics-assessed {\n  background-color: var(--metrics-status-chart-assessed-light)\n}\n\n.sm-metrics-status-table .sm-metrics-submitted {\n  background-color: var(--metrics-status-chart-submitted-light);\n}\n\n.sm-metrics-status-table .sm-metrics-accepted {\n  background-color: var(--metrics-status-chart-accepted-light)\n}\n\n.sm-metrics-status-table .sm-metrics-unassessed {\n  background-color: var(--metrics-status-chart-unassessed-light)\n}\n\n.sm-metrics-status-table .sm-metrics-unsaved {\n  background-color: var(--metrics-status-chart-unsaved-light)\n}\n\n.sm-metrics-status-table .sm-metrics-rejected {\n  background-color: var(--metrics-status-chart-rejected-light)\n}\n\n.sm-metrics-refresh-parent {\n  padding-right: 20px;\n  text-align: right;\n  font-style: italic\n}\n\n.sm-metrics-count-parent {\n  text-align: center;\n  color: #111\n}\n\n.sm-metrics-count-child {\n  display: inline-block;\n  cursor: default;\n  width: 61px;\n  height: 36px;\n  border-radius: 5px;\n  background-color: #eee;\n  border: 1px solid #bbb;\n  padding: 4px 12px;\n  margin: 0 12px;\n  vertical-align: middle;\n  line-height: 18px\n}\n\n.sm-metrics-count-label {\n  font-weight: 600;\n  font-size: larger\n}\n\n.sm-metrics-count-value {\n  font-weight: 800;\n  font-size: large\n}\n\n.sm-cora-column,\n.sm-metrics-findings-count-cell {\n  border-radius: 5px;\n  outline: #bbb solid 1px;\n  outline-offset: -1px;\n  width: 35px;\n  font-weight: 600;\n  color: #111;\n  margin: 0 auto\n}\n\n.sm-cora-tooltip-label {\n  border-radius: 5px;\n  outline: #bbb solid 1px;\n  outline-offset: -1px;\n  width: auto;\n  /* Allow width to fit content */\n  min-width: 80px;\n  /* Ensure minimum width for consistency */\n  font-weight: 500;\n  /* Lighter weight */\n  color: #111;\n  margin: 2px auto;\n  padding: 2px 6px;\n  /* Add padding for better text spacing */\n  display: inline-block;\n  text-align: center;\n}\n\n.sm-metrics-high-box {\n  background-color: var(--color-severity-high)\n}\n\n.sm-metrics-medium-box {\n  background-color: var(--color-severity-medium)\n}\n\n.sm-metrics-low-box {\n  background-color: var(--color-severity-low)\n}\n\n.sm-metrics-inventory-box {\n  background-color: hsl(21deg 41% 86%)\n}\n\n.sm-metrics-overview-panel .x-panel-body {\n  background-color: hsl(0 0% 95% / 1)\n}\n\n.sm-round-inner-panel {\n  border-radius: 6px;\n  overflow: hidden;\n  margin: 12px;\n}\n\n.sm-round-panel .sm-round-inner-panel .x-panel-body {\n  background-color: #fff;\n  border-bottom-left-radius: 6px;\n  border-bottom-right-radius: 6px\n}\n\n.sm-metric-agg-panel .x-layout-split {\n  background-color: #eee\n}\n\n.sm-combo-list-icon {\n  border-width: 0px;\n  padding-left: 20px;\n  background-position: left\n}\n\n.sm-col-wrap .x-grid3-cell-inner,\n.x-grid3-row-body {\n  white-space: pre-wrap;\n  overflow-wrap: break-word\n}\n\n.x-grid3-row-expanded .x-grid3-row-body {\n  max-width: 600px;\n  background-color: #faebd7\n}\n\n.sm-truncated-action {\n  color: #36c;\n  font-style: italic;\n  text-decoration: underline;\n  cursor: pointer\n}\n\n.sm-whats-new p {\n  margin-top: 10px;\n  margin-bottom: 10px\n}\n\n.sm-whats-new img {\n  border: 1px solid hsl(0deg 0% 65%)\n}\n\n.sm-whats-new-no-border img {\n  border: 0px\n}\n\n.sm-whats-new-feedback-panel {\n  padding: 10px 20px 20px 20px;\n}\n\n.sm-feedback-box {\n  background-color: #e8f4f8;\n  border: 1px solid #b8d4e8;\n  border-radius: 4px;\n  padding: 8px 16px;\n  margin: 0;\n}\n\n.sm-feedback-box-title {\n  font-weight: bold;\n  font-size: 14px;\n  margin-bottom: 8px;\n  color: #2c5f7c;\n}\n\n.sm-feedback-box-content {\n  font-size: 13px;\n  color: #333;\n}\n\n.sm-feedback-box-content a {\n  color: #2c5f7c;\n  text-decoration: underline;\n}\n\n.sm-whats-new-title {\n  padding-top: 10px;\n}\n\n.x-tree-node-leaf .x-tree-node-icon.sm-whats-new-icon {\n  background-image: url(../img/clock.svg);\n  background-size: 16px 16px\n}\n\n.sm-dark-mode-icon {\n  background-image: url(../img/dark-mode.svg) !important;\n  background-size: 16px 16px\n}\n\n.x-grid3-cell-inner {\n  padding-left: 4px\n}\n\n.sm-engine-result-icon {\n  background-image: url(../img/bot2.svg);\n  background-repeat: no-repeat;\n  width: 12px;\n}\n\n.sm-engine-override-icon {\n  background-image: url(../img/override2.svg);\n  background-repeat: no-repeat\n}\n\n.sm-engine-manual-icon {\n  background-image: url(../img/user.svg);\n  background-repeat: no-repeat\n}\n\n.x-grid3-cell.x-grid3-hd .sm-engine-result-icon {\n  background-size: 12px 12px;\n  width: 12px;\n  height: 12px\n}\n\n.x-grid3-cell :is(.sm-engine-result-icon, .sm-engine-override-icon, .sm-engine-manual-icon) {\n  background-size: 14px 14px;\n  height: 14px;\n  width: 14px\n}\n\n.x-menu-item-text .sm-engine-result-icon,\n.x-menu-item-text .sm-history-icon {\n  background-size: 12px 12px;\n  height: 12px\n}\n\n.x-grid3-cell.x-grid3-hd .sm-history-icon {\n  background-size: 12px 12px;\n  background-position: center;\n  height: 12px\n}\n\n.x-menu-check-item .x-menu-item-icon {\n  background-image: url(../img/checkboxes.svg);\n  background-position: 1px 0;\n  background-repeat: no-repeat;\n  background-color: transparent\n}\n\n.x-menu-item-checked .x-menu-item-icon {\n  background-position: -24px 0\n}\n\n.x-menu-group-item .x-menu-item-icon {\n  background-image: none\n}\n\n.x-tree-node {\n  margin-bottom: 2px;\n  font-size: 11px\n}\n\n.x-grid3-row td,\n.x-grid3-summary-row td {\n  line-height: 15px\n}\n\n.sm-label-edit-color {\n  position: absolute;\n  top: 5px;\n  right: 2px;\n  cursor: pointer\n}\n\n.x-tree-node-el.x-unselectable {\n  cursor: default\n}\n\n.sm-tree-toolbar {\n  display: none\n}\n\n/* Always show Meta Dashboard button (grid icon) */\n.sm-tree-toolbar.sm-tree-toolbar-persistent {\n  display: inline;\n  position: absolute;\n  right: 10px;\n  margin-top: 2px;\n  cursor: pointer;\n  opacity: .5\n}\n\n.x-tree-node-el:hover .sm-tree-toolbar,\n.x-tree-selected .sm-tree-toolbar {\n  display: inline;\n  position: absolute;\n  right: 10px;\n  margin-top: 2px;\n  cursor: pointer;\n  opacity: .5\n}\n\n.x-tree-node-el:hover .sm-tree-toolbar:hover,\n.x-tree-selected .sm-tree-toolbar:hover {\n  opacity: 1;\n  scale: 125%\n}\n\n.x-color-palette {\n  height: unset;\n  width: 108px\n}\n\n.x-color-palette em {\n  border: 0\n}\n\n.x-color-palette em span {\n  width: 12px;\n  height: 12px\n}\n\n.sm-label-icon {\n  background-image: url(../img/label.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-pin-icon {\n  background-image: url(../img/pin.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-label-sprite {\n  font: 600 10px/14px Open Sans, helvetica, sans-serif;\n  top: 0;\n  padding: 0 5px;\n  border-radius: 3px;\n  margin-left: 3px;\n  white-space: nowrap\n}\n\n.sm-jumbo-sprite {\n  font-size: 12px;\n}\n\n.sm-diff-sprite {\n  background-color: hsl(207deg 100% 84%);\n  color: #000;\n}\n\n.sm-diff-sprite-check {\n  background-color: #F5A3A3;\n  color: #000;\n}\n\n.x-tip .x-tip-bc,\n.x-tip .x-tip-bl,\n.x-tip .x-tip-br,\n.x-tip .x-tip-ml,\n.x-tip .x-tip-mr,\n.x-tip .x-tip-tc,\n.x-tip .x-tip-tl,\n.x-tip .x-tip-tr {\n  background-color: #feeecc;\n  background-image: unset\n}\n\n.x-grid3-row-selected {\n  background-color: hsl(212deg 14% 85%) !important;\n  background-image: none;\n  border-color: #acacac\n}\n\n.x-grid3-hd-checker,\n.x-grid3-row-checker {\n  background-image: url(../img/checkboxes.svg);\n  width: 100%;\n  height: 18px;\n  background-position: 1px 2px;\n  background-repeat: no-repeat;\n  background-color: transparent\n}\n\n.x-grid3-body .x-grid3-td-checker {\n  background: unset\n}\n\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-checker {\n  background-image: unset\n}\n\n.x-grid3-row .x-grid3-row-checker {\n  background-position: 1px 2px\n}\n\n.x-grid3-hd-checker-on .x-grid3-hd-checker,\n.x-grid3-row-checked .x-grid3-row-checker,\n.x-grid3-row-selected .x-grid3-row-checker {\n  background-position: -24px 2px;\n}\n\n.x-grid3-hd-checker {\n  background-position: 1px 1px\n}\n\n.ext-border-box .x-grid3-hd-checker {\n  background-position: 1px 3px\n}\n\n.x-grid3-hd-checker-on .x-grid3-hd-checker {\n  background-position: -24px 1px\n}\n\n.x-grid3-hd-checker-ind .x-grid3-hd-checker {\n  background-position: -50px 1px\n}\n\n.x-grid3-row-selected-checkonly .x-grid3-row-checker {\n  background-position: -24px 2px\n}\n\ninput.x-tree-node-cb {\n  margin-right: 2px\n}\n\n.sm-text-highlight {\n  background-color: #fad6a2\n}\n\n.sm-menuitem-filter-label {\n  background-color: #d3d8de;\n  font-weight: 700;\n  font-size: 9px;\n  color: hsl(0 0% 50% / 1) !important;\n  height: 10px;\n  line-height: 10px !important\n}\n\n.sm-menuitem-filter-icon {\n  background-image: url(../img/bars-filter.svg);\n  background-size: 16px;\n  background-position: center;\n  background-repeat: no-repeat;\n  top: 0\n}\n\n.sm-menuitem-status-icon {\n  width: 12px;\n  height: 12px;\n  padding-right: 3px;\n  vertical-align: -2px\n}\n\n.sm-menuitem-div-icon {\n  padding-left: 18px;\n  background-size: 14px 14px;\n  background-position: 0 1px\n}\n\n.sm-grid3-col-filterable .x-grid3-hd-btn {\n  background-image: url(../img/bars-filter.svg);\n  background-size: 10px 14px;\n  background-position: center;\n  display: block;\n  margin-top: 1px;\n  height: 22px;\n  margin-right: 0\n}\n\n.sm-grid3-col-filtered .x-grid3-hd-btn {\n  background-color: var(--metrics-status-chart-submitted-light);\n}\n.x-grid3-hd-btn {\n  background-color: transparent;\n  background-image: none;\n  display: block;\n  cursor: default\n}\n\n.sm-cb .x-form-cb-label {\n  top: 3px\n}\n\n.sm-collection-manage-layout .x-border-layout-ct,\n.sm-collection-manage-layout .x-panel-body,\n.sm-dialog-window.sm-round-panel {\n  background-color: #fdfdfd\n}\n\n.sm-collection-manage-layout .x-layout-split {\n  position: absolute;\n  height: 5px;\n  width: 5px;\n  text-align: center;\n  line-height: 5px;\n  font-size: 10px;\n  color: hsl(0deg 0% 65%);\n  background-color: transparent\n}\n\n.sm-collection-manage-layout .x-layout-split:after {\n  content: \"====\"\n}\n\n.x-form-search:focus,\n.x-form-text:focus,\n.x-form-textarea:focus {\n  border: 1px solid #dc8633;\n  box-shadow: inset rgb(220 134 51 / 20%) 0 0 1px 1px\n}\n\n.sm-result-engine-span.x-column {\n  overflow: unset\n}\n\n.sm-result-engine-sprite {\n  color: #fcfcfc !important;\n  font: bold 10px Open Sans, helvetica, sans-serif;\n  position: relative;\n  top: -1px;\n  background-color: hsl(220deg 60% 50%);\n  padding: 1px 4px 2px !important;\n  border-radius: 3px;\n  margin-left: 4px;\n  user-select: none\n}\n\n.sm-result-override-sprite {\n  color: #fcfcfc !important;\n  font: bold 10px Open Sans, helvetica, sans-serif;\n  position: relative;\n  top: -1px;\n  background-color: #cc5e33;\n  padding: 1px 4px 2px !important;\n  border-radius: 3px;\n  margin-left: 4px;\n  user-select: none\n}\n\n.x-form-cb-label .sm-question-circle,\n.x-form-item-label .sm-question-circle,\n.x-grid3-hd .sm-question-circle,\n.x-panel-header .sm-question-circle {\n  color: hsl(0deg 0% 60%);\n  margin-left: 3px;\n  font-size: 13px\n}\n\n.x-form-trigger+.sm-question-circle {\n  margin-left: 22px;\n  color: hsl(0deg 0% 60%);\n  font-size: 14px;\n  position: absolute;\n  top: 3px\n}\n\n.x-form-trigger[style*=\"display: none;\"]+.sm-question-circle {\n  margin-left: 5px\n}\n\n.x-form-field-wrap.x-form-field-trigger-wrap .x-form-field.sm-review-combo-input[disabled] {\n  color: gray;\n  background-color: transparent;\n  cursor: auto\n}\n\n.sm-home-widget-bwrap {\n  overflow: auto;\n  height: 338px;\n  margin-right: 0\n}\n\n.x-progress-inner {\n  background-image: none;\n  background-color: hsl(0deg 0% 95%)\n}\n\n.x-progress-bar {\n  background-image: none;\n  background-color: #bdd0e5;\n  border: none\n}\n\n.sm-pb-error .x-progress-bar {\n  background-color: #ebadad\n}\n\n.x-progress-text {\n  color: transparent\n}\n\n.x-progress-text.x-progress-text-back {\n  color: hsl(0deg 0% 33%)\n}\n\n.sm-cell-thermometer-bg {\n  background-color: #eee;\n  border-radius: 3px;\n  outline: #bbb solid 1px;\n  outline-offset: 0px\n}\n\n.sm-cell-thermometer-text {\n  float: left;\n  margin-left: 4px;\n  font-style: italic;\n  font-weight: 600\n}\n\n.sm-cell-mercury-low {\n  background-color: #c3deab\n}\n\n.sm-cell-mercury-medium {\n  background-color: hsl(230deg 40% 86%)\n}\n\n.sm-cell-mercury-high {\n  background-color: #eba795;\n  height: 15px\n}\n\n.x-panel-btns td.x-toolbar-cell {\n  padding: 0 18px 10px 0\n}\n\n.sm-dialog-panel-text {\n  padding-bottom: 10px;\n  font: 10px Open Sans, helvetica, sans-serif;\n  color: #000;\n  word-wrap: break-word\n}\n\n.sm-dialog-panel-content {\n  padding-bottom: 10px;\n  font: 11px/13px Open Sans, helvetica, sans-serif;\n  color: #000;\n  word-wrap: break-word\n}\n\n.sm-dialog-panel-callout {\n  margin-top: 20px;\n  padding: 10px;\n  font: 11px/13px Open Sans, helvetica, sans-serif;\n  background-color: #e6e6e6;\n  color: #000;\n  word-wrap: break-word\n}\n\n.sm-dialog-panel-content ul {\n  list-style-type: square;\n  display: list-item;\n  margin-left: 2em\n}\n\n.ext-gecko .x-btn button,\n.ext-webkit .x-btn button,\n.x-btn button {\n  font-weight: 600;\n  padding: 0 3px 3px 3px\n}\n\n.x-btn button.sm-error-icon {\n  background-color: #ebadad;\n  background-image: url(\"../img/remove.svg\")\n}\n\n.sm-export-sprite {\n  font: 10px Open Sans, helvetica, sans-serif;\n  position: relative;\n  top: -1px;\n  border-radius: 12px;\n  padding: 0 5px 1px !important;\n  user-select: none\n}\n\n.sm-export-sprite-high,\n.sm-export-sprite-medium {\n  background-color: #ddd\n}\n\n.sm-export-sprite-low {\n  background-color: #c3deab\n}\n\n.x-form-display-field {\n  padding-top: 3px\n}\n\n.ext-webkit .x-small-editor .x-form-field {\n  font: 10px Open Sans, helvetica, sans-serif\n}\n\n.x-grid-group-collapsed .x-grid-group-hd div.x-grid-group-title {\n  background-image: url(../img/tree-elbow-closed.svg);\n  background-position: 3px 7px\n}\n\n.x-grid-group-hd div.x-grid-group-title {\n  background-image: url(../img/tree-elbow-minus.svg);\n  background-position: 3px 7px\n}\n\n.x-grid3-row-collapsed .x-grid3-row-expander {\n  background-image: url(../img/tree-elbow-closed.svg);\n  background-position: 3px 4px\n}\n\n.x-grid3-row-expanded .x-grid3-row-expander {\n  background-image: url(../img/tree-elbow-minus.svg);\n  background-position: 3px 4px\n}\n\n.sm-toolbar-legend-box {\n  width: 20px;\n  height: 10px;\n  border: 1px solid #c2c2c2\n}\n\n.x-tree-lines .x-tree-elbow,\n.x-tree-lines .x-tree-elbow-end,\n.x-tree-lines .x-tree-elbow-line {\n  background-image: none\n}\n\n.x-tree-lines .x-tree-elbow-end-minus,\n.x-tree-lines .x-tree-elbow-minus {\n  background-image: url(../img/tree-elbow-minus.svg);\n  background-position: 3px 4px\n}\n\n.x-tree-lines .x-tree-elbow-end-plus,\n.x-tree-lines .x-tree-elbow-plus {\n  background-image: url(../img/tree-elbow-closed.svg);\n  background-position: 3px 4px\n}\n\n.sm-drop {\n  border: 2px dashed #bbb;\n  -moz-border-radius: 5px;\n  -webkit-border-radius: 5px;\n  border-radius: 5px;\n  padding: 25px;\n  text-align: center;\n  font: 20pt bold;\n  color: #bbb\n}\n\nbody {\n  font: 11px Open Sans, verdana, helvetica, sans-serif\n}\n\n.sm-grid-result-sprite {\n  font: bold 11px/13px Open Sans, helvetica, sans-serif;\n  position: relative;\n  top: 0;\n  background-color: #f5f3f3;\n  border: 1px solid #c1c1c1;\n  border-radius: 3px;\n  user-select: none;\n  max-width: 20px;\n  margin: 0 auto\n}\n\n.sm-tooltip-result-sprite {\n  font: bold 11px/13px Open Sans, helvetica, sans-serif;\n  position: relative;\n  top: 0;\n  background-color: #f5f3f3;\n  border: 1px solid #c1c1c1;\n  border-radius: 3px;\n  user-select: none\n}\n\n.sm-result-pass {\n  color: green;\n  text-align: center\n}\n\n.sm-result-fail {\n  color: #d74400;\n  text-align: center\n}\n\n.sm-result-na {\n  color: #909090;\n  text-align: center\n}\n\n.sm-result-nr {\n  color: #404040;\n  text-align: center\n}\n\n.sm-grid-sprite {\n  font: bold 10px/13px Open Sans, helvetica, sans-serif;\n  position: relative;\n  top: 1px;\n  background-color: #fff;\n  border: 1px solid #c1c1c1;\n  border-radius: 3px;\n  margin-left: 0;\n  user-select: none\n}\n\n.sm-content-sprite {\n  color: #fcfcfc;\n  font: bold 14px Open Sans, helvetica, sans-serif;\n  position: relative;\n  top: 5px;\n  background-color: #6f93db;\n  padding: 1px 4px;\n  border: 1px solid #c1c1c1;\n  border-radius: 3px;\n  user-select: none;\n  float: right;\n}\n\n.sm-navtree-sprite {\n  color: #fcfcfc !important;\n  font: bold 9px Open Sans, helvetica, sans-serif;\n  position: relative;\n  top: -1px;\n  background-color: #6f93db;\n  padding: 1px 4px 2px;\n  border-radius: 3px;\n  margin-left: 11px;\n  user-select: none\n}\n\n.sm-severity-high {\n  color: #d74400;\n  background-color: #f5f3f3;\n  padding: 0 2px\n}\n\n.sm-severity-medium {\n  color: #36c;\n  background-color: #f5f3f3;\n  padding: 0 2px\n}\n\n.sm-severity-low {\n  color: green;\n  background-color: #f5f3f3;\n  padding: 0 2px\n}\n\n.sm-home-widget-image-text-wrap {\n  float: left;\n  margin-right: 15px;\n  width: 125px;\n  height: 125px;\n  display: flex;\n  justify-content: center;\n  align-items: center\n}\n\n.sm-home-widget-text {\n  padding: 10px 20px;\n  font: 12px Open Sans, helvetica, sans-serif;\n  color: #000;\n  word-wrap: break-word\n}\n\n.sm-home-widget-text a {\n  color: #000\n}\n\n.sm-home-widget-text ul {\n  list-style-type: square;\n  margin-left: 20px;\n  margin-top: 4px;\n  margin-bottom: 4px\n}\n\n.sm-home-widget-text b {\n  font-weight: 600\n}\n\n.sm-home-widget-header-1 {\n  padding: 10px 20px;\n  font: 11px Open Sans, helvetica, sans-serif;\n  color: #000;\n  word-wrap: break-word\n}\n\n.sm-empty-cell {\n  font-style: italic;\n  color: #bbb\n}\n\n.sm-empty-cell::after {\n  content: \"No value\"\n}\n\n.sm-round-panel .ext-mb-content {\n  font-family: Open Sans, verdana, sans-serif\n}\n\n.sm-bare-button .x-btn-bc,\n.sm-bare-button .x-btn-bl,\n.sm-bare-button .x-btn-br,\n.sm-bare-button .x-btn-mc,\n.sm-bare-button .x-btn-ml,\n.sm-bare-button .x-btn-mr,\n.sm-bare-button .x-btn-tc,\n.sm-bare-button .x-btn-tl,\n.sm-bare-button .x-btn-tr {\n  background-image: none\n}\n\n.x-fieldset {\n  border-radius: 3px\n}\n\n.ext-el-mask {\n  background-color: rgb(0 0 0 / 0%);\n  backdrop-filter: blur(3px) grayscale();\n  animation: fadein 0.25s;\n  animation-fill-mode: forwards;\n}\n\n@keyframes fadein {\n  from {\n    opacity: 0;\n  }\n\n  to {\n    opacity: 1;\n  }\n}\n\n.ext-el-mask-modal {\n  background-color: rgb(0 0 0 / 50%);\n  backdrop-filter: blur(1px) grayscale();\n  animation: fadein 0.25s;\n  animation-fill-mode: forwards;\n  position: absolute;\n  top: 0;\n  left: 0;\n}\n\n.ext-el-mask-msg {\n  background-image: none;\n  background-color: unset;\n  border: none;\n  top: 50%;\n  left: 50%;\n  text-align: center;\n  transform: translate(-50%, -50%);\n}\n\n.ext-el-mask-msg div {\n  background-color: #dedede;\n  border: none;\n  color: #010101;\n  font-weight: 600;\n  border-radius: 6px;\n  margin-bottom: 10px;\n}\n\n.ext-el-mask-msg span {\n  width: 32px;\n  height: 32px;\n  border: 3px solid #888;\n  border-bottom-color: transparent;\n  border-radius: 50%;\n  display: inline-block;\n  box-sizing: border-box;\n  animation: rotation 1s linear infinite;\n}\n\n@keyframes rotation {\n  0% {\n    transform: rotate(0deg);\n  }\n\n  100% {\n    transform: rotate(360deg);\n  }\n}\n\n.sm-round-panel .x-window-header {\n  color: #111;\n  font-weight: 700;\n  font-size: 11px;\n  font-family: Open Sans, verdana, sans-serif;\n  background-color: #ccc;\n  background-image: none;\n  padding: 6px 8px 5px\n}\n\n.x-window-plain .x-window-mc {\n  border: 0 solid\n}\n\n.x-window-plain .x-window-body {\n  border: 0 solid;\n  background: 0 0 !important\n}\n\n.x-window-bc,\n.x-window-bl,\n.x-window-br,\n.x-window-mc,\n.x-window-ml,\n.x-window-mr,\n.x-window-tc,\n.x-window-tl,\n.x-window-tr {\n  background-image: none\n}\n\n.sm-review-footer,\n.sm-review-form {\n  background-color: #f7f7f7\n}\n\n.x-panel-header {\n  color: #111\n}\n\n.x-tab-panel-body {\n  border-color: #d0d0d0;\n  background-color: transparent\n}\n\n.x-tab-panel-noborder .x-tab-panel-header-noborder {\n  border-width: 0\n}\n\n.x-tab-strip .x-tab-strip-over span.x-tab-strip-text {\n  opacity: 1\n}\n\n.x-tab-strip .x-tab-with-icon span.x-tab-strip-text {\n  opacity: .75;\n  background-position: 0 4px\n}\n\n.x-tab-strip .x-tab-strip-active span.x-tab-strip-text {\n  opacity: 1;\n  color: #111;\n  background-position: 0 4px\n}\n\n.x-tab-strip-top .x-tab-strip-over .x-tab-left,\n.x-tab-strip-top .x-tab-strip-over .x-tab-right,\n.x-tab-strip-top .x-tab-strip-over .x-tab-strip-inner {\n  background-color: #ddd\n}\n\n.x-tab-strip-top .x-tab-strip-active .x-tab-left,\n.x-tab-strip-top .x-tab-strip-active .x-tab-right,\n.x-tab-strip-top .x-tab-strip-active .x-tab-strip-inner {\n  background-color: hsl(0deg 0% 91%)\n}\n\n.x-tab-strip-top .x-tab-left,\n.x-tab-strip-top .x-tab-right,\n.x-tab-strip-top .x-tab-strip-inner {\n  background-image: none;\n  background-color: #ccc;\n  border-top-left-radius: 6px;\n  border-top-right-radius: 6px\n}\n\n.x-form-search,\n.x-form-text,\ntextarea.x-form-field {\n  background-color: #fff;\n  background-image: none;\n  border: 1px solid #c1c1c1\n}\n\n.x-form-search:read-only,\n.x-form-text:read-only,\ntextarea.x-form-field:read-only {\n  border-color: hsl(0deg 0% 80.31%);\n  color: gray;\n}\n\n.x-form-text:read-only.x-trigger-noedit {\n  color: #000000\n}\n\n.x-tab-panel-footer,\n.x-tab-panel-header {\n  background-color: transparent\n}\n\n.sm-home-title {\n  background-image: url(../img/shield-green-check.svg);\n  background-size: 48px 48px;\n  background-position: 18px 12px;\n  background-repeat: no-repeat;\n  font: bold 36px Open Sans, helvetica, sans-serif;\n  color: #333;\n  padding-bottom: 30px;\n  padding-left: 74px;\n  padding-top: 12px\n}\n\n#sm-home-oss-sprite {\n  color: #fcfcfc;\n  font: bold 10px Open Sans, helvetica, sans-serif;\n  position: relative;\n  top: -14px;\n  background-color: #6f93db;\n  padding: 1px 4px 2px;\n  border-radius: 3px;\n  margin-left: 11px;\n  user-select: none\n}\n\n#sm-home-version-sprite {\n  color: #fcfcfc;\n  font: bold 10px Open Sans, helvetica, sans-serif;\n  position: relative;\n  top: -14px;\n  background-color: #569981;\n  padding: 1px 4px 2px;\n  border-radius: 3px;\n  margin-left: 5px;\n  user-select: none\n}\n\n.sm-main-tab-panels-common {\n  border-radius: 6px\n}\n\nul.x-tab-strip-top {\n  background-color: transparent;\n  background-image: none;\n  border-bottom-color: #ccc;\n  border-bottom-width: 3px\n}\n\nbody.x-body-masked .x-window-plain .x-window-mc {\n  background-color: #f9f9f9\n}\n\ntd.sort-asc,\ntd.sort-desc,\ntd.x-grid3-hd-menu-open,\ntd.x-grid3-hd-over {\n  border-left-color: #eee;\n  border-right-color: #d0d0d0\n}\n\n.x-grid3-header,\ntd.sort-asc .x-grid3-hd-inner,\ntd.sort-desc .x-grid3-hd-inner,\ntd.x-grid3-hd-menu-open .x-grid3-hd-inner,\ntd.x-grid3-hd-over .x-grid3-hd-inner {\n  background-color: #f0f0f0;\n  background-image: none\n}\n\n.x-toolbar {\n  border-color: #d0d0d0;\n  background-color: #e5e5e5;\n  background-image: none\n}\n\n.sm-border-layout-ct {\n  background-color: #fcfcfc\n}\n\n.x-border-layout-ct {\n  background-color: hsl(220 8% 50% / 1);\n}\n\n.sm-round-panel {\n  border-radius: 6px;\n  overflow: hidden\n}\n\n.sm-round-panel.x-window-dlg {\n  background-color: hsl(0 0% 95% / 1);\n}\n\n.sm-round-panel .x-panel-body,\n.sm-round-panel.x-window {\n  background-color: hsl(0 0% 95% / 1);\n}\n\n.sm-round-panel .x-panel-header {\n  background-color: #ccc;\n  background-image: none;\n  padding: 5px 3px 4px 8px\n}\n\n.sm-round-inner-panel .x-panel-header {\n  background-color: hsl(0deg 0% 90%);\n  background-image: none;\n  overflow: hidden;\n  border-radius: 6px 6px 0 0;\n  padding: 5px 8px 4px 8px;\n}\n\n.sm-round-panel .sm-home-widget-body {\n  background-color: #dedede;\n  border-radius: 25px;\n  border: none;\n  margin: 10px;\n  height: 400px;\n  width: 380px;\n}\n\n.sm-scroll-home-widget-body {\n  max-height: 340px;\n  overflow: auto;\n  scrollbar-width: thin;\n  margin-right: 8px;\n  margin-top: 5px;\n}\n\n.sm-user-list {\n  list-style: none;\n  max-height: 340px;\n  padding: 0;\n  margin-left: 0;\n\n}\n\n.sm-user-item {\n  padding: 3px;\n  display: flex;\n  align-items: left;\n}\n\n.sm-user-item::before {\n  content: \"• \";\n  font-size: 16px;\n  color: #dedede;\n  margin-right: 3px;\n}\n\n.sm-user-details {\n  display: flex;\n  flex-direction: column;\n  font-size: 13px;\n}\n\n.sm-user-name {\n  font-size: 13px;\n  font-weight: bold;\n}\n\n.sm-user-email {\n  font-size: 11px;\n  font-style: italic;\n}\n\n\n.sm-home-widget-header {\n  background-color: #d3d3d3\n}\n\n.sm-home-widget-title {\n  padding: 10px 20px;\n  font: bold 18px Open Sans, helvetica, sans-serif;\n  color: #36c\n}\n\n.sm-dialog-panel-title {\n  padding-top: 10px;\n  padding-right: 20px;\n  padding-bottom: 10px;\n  font: bold 18px Open Sans, helvetica, sans-serif;\n  color: #36c\n}\n\n.sm-home-widget-subtitle {\n  padding-top: 5px;\n  padding-bottom: 5px;\n  font: bold 14px Open Sans, helvetica, sans-serif;\n  color: #36c\n}\n\n.sm-home-widget-collectionName {\n  font: bold 13px Open Sans, helvetica, sans-serif;\n  color: #36c\n}\n\n.sm-banner-unclassified {\n  background-color: var(--color-marking-unclassified);\n  color: #fff;\n  height: 20px\n}\n\n.sm-banner-cui {\n  background-color: var(--color-marking-cui);\n  color: #fff;\n  height: 20px\n}\n\n.sm-banner-confidential {\n  background-color: var(--color-marking-confidential);\n  color: #fff;\n  height: 20px\n}\n\n.sm-banner-secret {\n  background-color: var(--color-marking-secret);\n  color: #fff;\n  height: 20px\n}\n\n.sm-banner-topsecret {\n  background-color: var(--color-marking-topsecret);\n  color: #fff;\n  height: 20px\n}\n\n.sm-banner-sci {\n  background-color: var(--color-marking-sci);\n  color: #000;\n  height: 20px\n}\n\n.sm-banner-body-text {\n  text-align: center;\n  font: bold 12px Open Sans, helvetica, sans-serif;\n  padding-top: 1px\n}\n\n.sm-tree-node-collection-review,\n.sm-tree-node-create {\n  font-style: italic\n}\n\n.x-grid3-row.x-stigman-cross-department {\n  opacity: .4\n}\n\n::-ms-clear {\n  display: none\n}\n\n.hbss-control .x-grid3-hd-checker,\n.hbss-control .x-grid3-row-checker {\n  background-image: url(../img/hbss-check-sprite.gif)\n}\n\n.assignment-grid-item-selected {\n  font-weight: 700;\n  background-color: #ffa0a0\n}\n\n.icon-department {\n  background: url(../img/department-16.png) 0 no-repeat !important\n}\n\n.icon-refresh {\n  background: url(../img/reload.svg) 0 0/16px 16px\n}\n\n.icon-loading {\n  background: url(../img/loading.gif);\n  background-size: 16px 16px;\n  background-repeat: no-repeat;\n}\n\n.icon-add {\n  background: url(../img/add.svg) 0 0/16px 16px\n}\n\n.icon-edit {\n  background: url(../img/edit.svg) 0 no-repeat !important\n}\n\n.icon-del {\n  background: url(../img/trash.svg) 0 0/16px 16px\n}\n\n.icon-remove {\n  background: url(../img/remove.svg);\n}\n\n.icon-save {\n  background: url(../img/save.gif) 0 no-repeat !important\n}\n\n.icon-new-window {\n  background: url(../img/new_window.gif) 0 no-repeat !important\n}\n\n.icon-new-tab {\n  background: url(../img/new_tab.gif) 0 no-repeat !important\n}\n\n.icon-icon-all {\n  background: url(../img/icon-all.gif) 0 no-repeat !important\n}\n\n.icon-excel {\n  background: url(../img/excel-16.gif) 0 no-repeat !important\n}\n\n.sm-rule-header-top,\n.sm-rule-content-header-top {\n  font: bold 22px Open Sans, helvetica, sans-serif\n}\n\n.cs-section-five-o-eight {\n  font: 9px Open Sans, helvetica, sans-serif;\n  text-decoration: underline;\n  cursor: pointer\n}\n\n.sm-rule-version {\n  padding: 10px;\n  font: 10px Open Sans, helvetica, sans-serif\n}\n\n.sm-rule-header-sub {\n  padding: 20px;\n  font: bold 14px Open Sans, helvetica, sans-serif\n}\n\n.sm-rule-body {\n  padding: 10px 20px;\n  background-color: #ddd;\n  border-radius: 6px;\n  margin-bottom: 6px;\n}\n\n.sm-rule-body-title {\n  font: bold 14px Open Sans, helvetica, sans-serif;\n  color: #36c\n}\n\n.sm-rule-body-text {\n  padding: 10px 20px;\n  font: 11px Open Sans, helvetica, sans-serif;\n  color: #000;\n  word-wrap: break-word\n}\n\n.sm-rule-body-text pre {\n  white-space: pre-wrap;\n  font: 11px Open Sans, helvetica, sans-serif\n}\n\n.sm-rule-body-table {\n  width: 100%;\n  border-collapse: collapse\n}\n\n.sm-rule-body-table td {\n  padding: 2px\n}\n\n.sm-reviews-home-body-title {\n  padding: 10px 20px;\n  font: bold 14px Open Sans, helvetica, sans-serif;\n  color: #36c\n}\n\n.sm-reviews-home-body-text {\n  padding: 10px 20px;\n  font: 11px Open Sans, helvetica, sans-serif;\n  color: #000;\n  word-wrap: break-word\n}\n\n.sm-reviews-home-tasks {\n  background-color: #ff5f5f\n}\n\n.sm-reviews-home-no-tasks {\n  background-color: #bbe6b8\n}\n\n.sm-rule-body-text li {\n  margin-top: 5px\n}\n\n.sm-feedback-panel-active {\n  background-color: #ff5f5f\n}\n\n.sm-feedback-panel-inactive {\n  background-color: #fff\n}\n\n.sm-feedback-body-title {\n  padding: 10px 20px;\n  font: bold 14px Open Sans, helvetica, sans-serif;\n  color: #36c\n}\n\n.sm-feedback-body-text {\n  padding: 10px 20px;\n  font: 11px Open Sans, helvetica, sans-serif;\n  color: #000;\n  word-wrap: break-word\n}\n\n.sm-feedback-body-text li {\n  margin-top: 5px\n}\n\n.deferral-approval-trigger {\n  background-image: url(../img/trigger2.png) !important\n}\n\n.x-form-field,\n.x-form-item {\n  font: 11px Open Sans, helvetica, sans-serif\n}\n\n.sm-manual-grid-item {\n  background-color: #fff\n}\n\n.sm-manual-grid-item.x-grid3-row-over {\n  background-color: #efefef\n}\n\n.sm-grid3-row-red {\n  background-color: #ffa0a0\n}\n\n.sm-grid3-row-grey {\n  background-color: #ddd\n}\n\n.sm-grid3-row-orange {\n  background-color: #fc9\n}\n\n.sm-grid3-row-green {\n  background-color: #bbe6b8\n}\n\n.sm-grid3-row-black td {\n  background-color: #0f0f0f;\n  color: #fff !important\n}\n\n.sm-grid3-row-error td,\n.sm-grid3-row-italic td {\n  background-color: #ffdede !important;\n}\n\n.x-grid3-row-over {\n  border-color: #ddd;\n  background-color: #efefef;\n  background-image: none\n}\n\n.sm-add-icon {\n  background-image: url(../img/icons8-add-16.png) !important\n}\n\n.sm-copy-icon {\n  background-image: url(../img/copy.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-clone-icon {\n  background-image: url(../img/clone.svg) !important;\n  background-size: 16px 16px\n}\n\n.sm-disc-drive {\n  background-image: url(../img/disc_drive.png) !important\n}\n\n.sm-internet-search {\n  background-image: url(../img/internet_search.png) !important\n}\n\n.sm-search-icon {\n  background-image: url(../img/search.png) !important\n}\n\n.sm-filter-icon {\n  background-image: url(../img/filter.svg);\n  background-size: 12px 12px\n}\n\n.sm-control-panel {\n  background-image: url(../img/control_panel.png) !important\n}\n\n.sm-checklist-icon,\n.sm-checklist-tab-icon {\n  background-image: url(../img/shield-green-check.svg) !important\n}\n\n.sm-setting-icon {\n  background-image: url(../img/gear.svg) !important;\n  background-size: 16px 16px\n}\n\n.sm-export-icon {\n  background-image: url(../img/download.svg);\n  background-size: 16px 16px\n}\n\n.sm-wrap-lines-icon {   \n  background-image: url(../img/wrap-lines.svg);\n  background-size: 16px 16px\n}\n.sm-clear-icon {\n  background-image: url(../img/clear.svg);\n  background-size: 16px 16px\n}\n.sm-stream-icon {\n  background-image: url(../img/stream.svg);\n  background-size: 16px 16px\n}\n.sm-stream-stopped-icon {\n  background-image: url(../img/stream-stopped.svg);\n  background-size: 16px 16px\n}\n.sm-recording-icon {\n  background-image: url(../img/recording.svg);\n  background-size: 16px 16px\n}\n.sm-recording-stopped-icon {\n  background-image: url(../img/recording-stopped.svg);\n  background-size: 16px 16px\n}\n\n\n.sm-alert-icon {\n  background-image: url(\"data:image/svg+xml,%3C%3Fxml version='1.0' encoding='UTF-8'%3F%3E%3Csvg width='16px' height='16px' fill='%23000000' version='1.1' viewBox='0 0 310.81 310.81' xml:space='preserve' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath d='m305.1 229.1-119.04-186.52c-6.713-10.52-18.172-16.801-30.652-16.801-12.481 0-23.94 6.281-30.651 16.801l-119.04 186.52c-7.145 11.197-7.619 25.39-1.233 37.042 6.386 11.647 18.604 18.883 31.886 18.883h238.08c13.282 0 25.5-7.235 31.888-18.886 6.383-11.649 5.909-25.841-1.236-37.038zm-149.69 24.527c-10.947 0-19.82-8.874-19.82-19.82 0-10.947 8.874-19.821 19.82-19.821 10.947 0 19.82 8.874 19.82 19.821 0 10.946-8.874 19.82-19.82 19.82zm27.472-137.73-9.762 65.727c-1.437 9.675-10.445 16.353-20.119 14.916-7.816-1.161-13.676-7.289-14.881-14.692l-10.601-65.597c-2.468-15.273 7.912-29.655 23.185-32.123s29.655 7.912 32.123 23.185c0.464 2.876 0.448 5.845 0.055 8.584z' fill='%23f38c00'/%3E%3C/svg%3E%0A\");\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-import-icon {\n  background-image: url(../img/upload.svg);\n  background-size: 16px 16px\n}\n\n.sm-asset-icon {\n  background-image: url(../img/target.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-template-icon {\n  background-image: url(../img/template.png) !important\n}\n\n.sm-library-icon {\n  background-image: url(../img/library.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-folder-icon {\n  background-image: url(../img/folder.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-collection-color-icon {\n  background-image: url(../img/collection-color.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px;\n}\n\n.sm-collection-icon,\n.sm-collection-tab-icon {\n  background-image: url(../img/collection.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-department-icon {\n  background-image: url(../img/department-16.png) !important\n}\n\n.sm-user-icon {\n  background-image: url(../img/user.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-user-unavailable-icon {\n  background-image: url(../img/user-unavailable.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-users-icon {\n  background-image: url(../img/users.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-stig-icon {\n  background-image: url(../img/shield-green-check.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-history-icon {\n  background-image: url(../img/clock.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-report-icon {\n  background-image: url(../img/grid.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-trash-icon {\n  background-image: url(../img/trash.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-chat-icon {\n  background-image: url(../img/chat-16.png) !important\n}\n\n.sm-ackchat-icon,\n.sm-newchat-icon,\n.sm-unackchat-icon {\n  background-image: url(../img/message_edit.png) !important\n}\n\n.sm-feedback-icon {\n  background-image: url(../img/feedback-16.gif) !important\n}\n\n.sm-feedback-ack-icon {\n  background-image: url(../img/feedback-ack-16.gif) !important\n}\n\n.sm-feedback-unack-icon {\n  background-image: url(../img/feedback-unack-16.gif) !important\n}\n\n.sm-artifact-icon {\n  background-image: url(../img/page_white_text.png) !important\n}\n\n.sm-note-icon {\n  background-image: url(../img/note-16.png) !important\n}\n\n.sm-star-icon {\n  background-image: url(../img/star.svg) !important\n}\n\n.sm-star-icon-16 {\n  background-image: url(../img/star.svg) !important;\n  background-size: 16px\n}\n\n.sm-assign-icon {\n  background-image: url(../img/right-arrow-16.png) !important\n}\n\n.sm-unlock-icon {\n  background-image: url(../img/unlock-16.png) !important\n}\n\n.sm-lock-icon {\n  background-image: url(../img/lock.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-ready-icon {\n  background-image: url(../img/ready-16.png) !important\n}\n\n.sm-ready-flip-icon {\n  background-image: url(../img/ready-flip-16.png) !important\n}\n\n.sm-rejected-icon {\n  background-image: url(../img/rejected-16.png) !important\n}\n\n.x-btn-pressed.sm-star-icon {\n  background-image: url(../img/star.svg) !important\n}\n\n.sm-save-icon {\n  background-image: url(../img/save-16.png) !important\n}\n\n.sm-disk-icon {\n  background-image: url(../img/save-icon.svg) !important;\n  background-size: 12px\n}\n\n.sm-database-save-icon {\n  background-image: url(../img/database.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-database-icon {\n  background-image: url(../img/database.svg) !important\n}\n\n.sm-table-icon {\n  background-image: url(../img/table.png) !important\n}\n\n.sm-page-edit-icon {\n  background-image: url(../img/page_edit.png) !important\n}\n\n.sm-page-white-get-icon {\n  background-image: url(../img/page_white_get.png) !important\n}\n\n.sm-page-white-put-icon {\n  background-image: url(../img/page_white_put.png) !important\n}\n\n.sm-hbss-disabled-icon {\n  background-image: url(../img/hbss-check-sprite.gif);\n  background-position: -23px 0;\n  background-repeat: no-repeat\n}\n\n.sm-hbss-enabled-icon {\n  background-image: url(../img/hbss-check-sprite.gif);\n  background-position: 2px 0;\n  background-repeat: no-repeat\n}\n\n.sm-application-go-icon {\n  background-image: url(../img/application_go.png) !important\n}\n\n.sm-list-remove-16-icon {\n  background-image: url(../img/list-remove-16.png)\n}\n\n.sm-scan-assign-icon {\n  background-image: url(../img/greencheckt.gif)\n}\n\n.x-item-disabled .sm-scan-assign-icon {\n  background-image: url(../img/greycheckt.gif)\n}\n\n.sm-scan-unassign-icon {\n  background-image: url(../img/greydash.gif)\n}\n\n.sm-scan-toggleAssign-icon {\n  background-image: url(../img/icon-all.gif)\n}\n\n.sm-zip-icon {\n  background-image: url(../img/compress.png)\n}\n\n.sm-scap-grid-item {\n  background-color: #e2f2e2\n}\n\n.sm-scap-grid-item.x-grid3-row-over {\n  background-color: #daebda\n}\n\n.sm-scap-grid-item.x-grid3-row-selected {\n  background-color: #cedece !important\n}\n\n.sm-cell-red {\n  background-color: #ffa0a0;\n  border-right: 1px solid #fff;\n  border-left: 1px solid #fff\n}\n\n.x-grid3-row-selected .sm-cell-red {\n  filter: brightness(85%)\n}\n\n.x-grid3-row-over .sm-cell-red {\n  background-color: #f7c8c8 !important\n}\n\n.x-grid3-row-selected.sm-grid3-row-error .sm-cell-red {\n  filter: brightness(85%)\n}\n\n.sm-cell-orange {\n  background-color: #fc9;\n  border-right: 1px solid #fff;\n  border-left: 1px solid #fff\n}\n\n.x-grid3-row-selected .sm-cell-orange {\n  filter: brightness(85%)\n}\n\n.x-grid3-row-over .sm-cell-orange {\n  background-color: #f7dec4 !important\n}\n\n.x-grid3-row-selected.sm-grid3-row-error .sm-cell-orange {\n  filter: brightness(85%)\n}\n\n.sm-cell-green {\n  background-color: #bbe6b8;\n  border-right: 1px solid #fff;\n  border-left: 1px solid #fff\n}\n\n.x-grid3-row-selected .sm-cell-green {\n  filter: brightness(85%)\n}\n\n.x-grid3-row-over .sm-cell-green {\n  background-color: #d5ebd4 !important\n}\n\n.x-grid3-row-selected.sm-grid3-row-error .sm-cell-green {\n  filter: brightness(85%)\n}\n\n.sm-cell-grey {\n  background-color: #ddd;\n  border-right: 1px solid #fff;\n  border-left: 1px solid #fff\n}\n\n.x-grid3-row-selected .sm-cell-grey {\n  filter: brightness(85%)\n}\n\n.sm-cell-purple {\n  background-color: plum;\n  border-right: 1px solid #fff;\n  border-left: 1px solid #fff\n}\n\n.x-grid3-row-selected .sm-cell-purple {\n  filter: brightness(85%)\n}\n\n.x-grid3-row-over .sm-cell-purple {\n  background-color: #e6c8e6 !important\n}\n\n.x-grid3-row-selected.sm-grid3-row-error .sm-cell-purple {\n  filter: brightness(85%)\n}\n\n.sm-cell-peach {\n  background-color: #fbeb9d\n}\n\n.sm-cell-status {\n  background-color: #ccf;\n  border-left: 1px solid #fff\n}\n\n.x-grid3-row-selected .sm-cell-status {\n  filter: brightness(85%)\n}\n\n.x-grid3-row-over .sm-cell-status {\n  background-color: #dedef7 !important;\n  border-left: 1px solid #fff\n}\n\n.sm-cell-checklist {\n  background-image: url(../img/security_firewall_on.png);\n  background-repeat: no-repeat;\n  padding-left: 14px !important\n}\n\n.sm-cell-pinned {\n  background-image: url(../img/pin.svg);\n  background-repeat: no-repeat;\n  background-size: 14px 14px;\n}\n\n.sm-cell-asset {\n  background-image: url(../img/target.svg);\n  background-repeat: no-repeat;\n  background-position: 0 2px;\n  padding-left: 14px !important\n}\n\n.sm-cell-template {\n  background-image: url(../img/template.png);\n  background-repeat: no-repeat;\n  padding-left: 14px !important\n}\n\n.custom-stig-users .x-grid3-row-selected .x-grid3-cell-last {\n  background-image: url(../img/User-Group-icon.png);\n  background-position: left;\n  background-repeat: no-repeat\n}\n\n.sm-artifact-download-icon {\n  background-image: url(../img/download.svg)\n}\n\n.sm-artifact-edit-icon {\n  background-image: url(../img/edit-16.png)\n}\n\n.x-grid3-row-over .artifact-download {\n  background-image: url(../img/download.svg);\n  background-size: 14px 14px;\n  background-position: 2px 5px;\n  background-repeat: no-repeat\n}\n\n.x-grid3-row-over .artifact-view {\n  background-image: url(../img/eye.svg);\n  background-size: 14px 14px;\n  background-position: 2px 5px;\n  background-repeat: no-repeat\n}\n\n.x-grid3-row-over .artifact-edit {\n  background-image: url(../img/edit-16.png);\n  background-size: 14px 14px;\n  background-position: 2px 5px;\n  background-repeat: no-repeat\n}\n\n.x-grid3-row-over .artifact-delete {\n  background-image: url(../img/delete.png);\n  background-size: 14px 14px;\n  background-position: 2px 5px;\n  background-repeat: no-repeat\n}\n\n.x-grid3-row-over .artifact-download :active,\n.x-grid3-row-over .artifact-download:active {\n  background-image: url(../img/download.svg);\n  background-size: 14px 14px;\n  background-position: 4px 10px;\n  background-repeat: no-repeat\n}\n\n.sm-reviews-home-background {\n  background-color: #fff\n}\n\n#artifact-admin .x-grid3-row td,\n.artifact-grid .x-grid3-row td {\n  line-height: 25px\n}\n\n.sm-background-blue {\n  background-color: #eee !important\n}\n\n.sm-artifact-file-icon {\n  position: relative;\n  top: 3px;\n  margin-right: 5px\n}\n\n.x-grid3-summary-row {\n  border-left: 1px solid #fff;\n  border-right: 1px solid #fff;\n  color: #333;\n  background: #f1f2f4\n}\n\n.x-grid3-summary-row .x-grid3-cell-inner {\n  font-weight: 700;\n  padding-bottom: 4px\n}\n\n.x-grid-hide-summary .x-grid3-summary-row {\n  display: none\n}\n\n.x-grid3-summary-msg {\n  padding: 4px 16px;\n  font-weight: 700\n}\n\n.sm-review-action-textarea[disabled],\n.sm-review-result-textarea[disabled] {\n  color: #000;\n  opacity: 1;\n  background: 0 0\n}\n\n.sm-progress-textarea {\n  font-size: 8pt;\n  font-family: Consolas, Courier, monospace\n}\n\n.sm-combo-loading {\n  background-image: url(../img/loading.gif);\n  background-repeat: no-repeat;\n  background-position: 2px 1px;\n  text-indent: 20px\n}\n\n.sm-context-menu {\n  background-image: none\n}\n\n.sm-context-menu .x-menu li.x-menu-sep-li {\n  padding: 0\n}\n\n.sm-context-menu-header {\n  background-color: #d5e4f5;\n  border: 1px solid #99bbe8;\n  padding-left: 8px;\n  font-style: italic;\n  font-weight: 700\n}\n\n.x-toolbar-cell .x-form-checkbox,\n.x-toolbar-cell .x-form-radio {\n  margin-top: 0\n}\n\n.ext-chrome .x-toolbar-cell .x-form-checkbox,\n.x-toolbar-cell .x-form-radio {\n  margin-top: 3px\n}\n\n.ext-chrome .x-toolbar-cell .x-form-cb-label {\n  vertical-align: bottom;\n  top: 1px;\n}\n\n.ext-strict .x-small-editor .x-form-text {\n  line-height: 18px\n}\n\n.sm-review-sprite {\n  color: #161128;\n  font: 600 10px Open Sans, helvetica, sans-serif;\n  position: relative;\n  top: 0px;\n  background-color: #f2f2f2;\n  padding: 1px 4px 2px 17px;\n  border-radius: 3px;\n  user-select: none;\n  background-size: 12px 12px;\n  background-repeat: no-repeat;\n  background-position: 2px 2px;\n  border: 1px solid #ccc;\n  display: inline-block;\n  margin-left: 0px;\n}\n\n.sm-review-sprite-user {\n  background-image: url(../img/user-60.svg);\n  width: auto\n}\n\n.sm-review-sprite-date {\n  background-image: url(../img/clock.svg);\n  width: auto\n}\n\n.sm-review-sprite-modified {\n  background-image: url(../img/shield-green-check.svg)\n}\n\n.sm-review-sprite-modified::after {\n  content: \"Modified\"\n}\n\n.sm-review-sprite-saved {\n  background-image: url(../img/save-icon-60.svg)\n}\n\n.sm-review-sprite-submitted {\n  background-image: url(../img/ready-16.png)\n}\n\n.sm-review-sprite-rejected {\n  background-image: url(../img/rejected-16.png)\n}\n\n.sm-review-sprite-accepted {\n  background-image: url(../img/star.svg)\n}\n\n.sm-review-sprite-saved::after {\n  content: \"Saved\"\n}\n\n.sm-review-sprite-submitted::after {\n  content: \"Submitted\"\n}\n\n.sm-review-sprite-rejected::after {\n  content: \"Rejected\"\n}\n\n.sm-review-sprite-accepted::after {\n  content: \"Accepted\"\n}\n\n.sm-review-sprite-rule {\n  background-image: url(../img/shield-green-check.svg)\n}\n\n.sm-assessment-icon {\n  background-image: url(../img/assessment.svg);\n}\n\n.sm-review-sprite-asset {\n  background-image: url(../img/target.svg)\n}\n\n.sm-review-sprite-stat-saved {\n  background-image: url(../img/save-icon-60.svg)\n}\n\n.sm-review-sprite-stat-submitted {\n  background-image: url(../img/ready-16.png)\n}\n\n.sm-review-sprite-stat-rejected {\n  background-image: url(../img/rejected-16.png)\n}\n\n.sm-review-sprite-stat-accepted {\n  background-image: url(../img/star.svg)\n}\n\n.sm-review-sprite-stat-result {\n  padding: 1px 4px 2px 4px;\n}\n\n.xtb-text .sm-xtb-sep {\n  display: inline-block;\n  position: relative;\n  top: 2px;\n  height: 13px;\n  width: 2px;\n  margin: 0 5px 0 5px;\n  background-image: url(../ext/resources/images/default/grid/grid-split.gif);\n  background-position: center;\n  background-repeat: no-repeat;\n}\n\n@font-face {\n  font-family: 'Open Sans';\n  font-style: normal;\n  font-weight: 300;\n  src: local('Open Sans Light'), local('OpenSans-Light'), url('../fonts/open-sans-v15-latin-300.woff2') format('woff2'), url('../fonts/open-sans-v15-latin-300.woff') format('woff')\n}\n\n@font-face {\n  font-family: 'Open Sans';\n  font-style: italic;\n  font-weight: 300;\n  src: local('Open Sans Light Italic'), local('OpenSans-LightItalic'), url('../fonts/open-sans-v15-latin-300italic.woff2') format('woff2'), url('../fonts/open-sans-v15-latin-300italic.woff') format('woff')\n}\n\n@font-face {\n  font-family: 'Open Sans';\n  font-style: normal;\n  font-weight: 400;\n  src: local('Open Sans Regular'), local('OpenSans-Regular'), url('../fonts/open-sans-v15-latin-regular.woff2') format('woff2'), url('../fonts/open-sans-v15-latin-regular.woff') format('woff')\n}\n\n@font-face {\n  font-family: 'Open Sans';\n  font-style: italic;\n  font-weight: 400;\n  src: local('Open Sans Italic'), local('OpenSans-Italic'), url('../fonts/open-sans-v15-latin-italic.woff2') format('woff2'), url('../fonts/open-sans-v15-latin-italic.woff') format('woff')\n}\n\n@font-face {\n  font-family: 'Open Sans';\n  font-style: normal;\n  font-weight: 600;\n  src: local('Open Sans SemiBold'), local('OpenSans-SemiBold'), url('../fonts/open-sans-v15-latin-600.woff2') format('woff2'), url('../fonts/open-sans-v15-latin-600.woff') format('woff')\n}\n\n@font-face {\n  font-family: 'Open Sans';\n  font-style: italic;\n  font-weight: 600;\n  src: local('Open Sans SemiBold Italic'), local('OpenSans-SemiBoldItalic'), url('../fonts/open-sans-v15-latin-600italic.woff2') format('woff2'), url('../fonts/open-sans-v15-latin-600italic.woff') format('woff')\n}\n\n@font-face {\n  font-family: 'Open Sans';\n  font-style: normal;\n  font-weight: 700;\n  src: local('Open Sans Bold'), local('OpenSans-Bold'), url('../fonts/open-sans-v15-latin-700.woff2') format('woff2'), url('../fonts/open-sans-v15-latin-700.woff') format('woff')\n}\n\n@font-face {\n  font-family: 'Open Sans';\n  font-style: italic;\n  font-weight: 700;\n  src: local('Open Sans Bold Italic'), local('OpenSans-BoldItalic'), url('../fonts/open-sans-v15-latin-700italic.woff2') format('woff2'), url('../fonts/open-sans-v15-latin-700italic.woff') format('woff')\n}\n\n@font-face {\n  font-family: 'Open Sans';\n  font-style: normal;\n  font-weight: 800;\n  src: local('Open Sans ExtraBold'), local('OpenSans-ExtraBold'), url('../fonts/open-sans-v15-latin-800.woff2') format('woff2'), url('../fonts/open-sans-v15-latin-800.woff') format('woff')\n}\n\n@font-face {\n  font-family: 'Open Sans';\n  font-style: italic;\n  font-weight: 800;\n  src: local('Open Sans ExtraBold Italic'), local('OpenSans-ExtraBoldItalic'), url('../fonts/open-sans-v15-latin-800italic.woff2') format('woff2'), url('../fonts/open-sans-v15-latin-800italic.woff') format('woff')\n}\n\n@font-face {\n  font-family: 'Ubuntu Mono';\n  font-style: normal;\n  font-weight: 400;\n  src: local(''),\n    url('../fonts/ubuntu-mono-v15-latin-regular.woff2') format('woff2'),\n    /* Chrome 26+, Opera 23+, Firefox 39+ */\n}\n\n.x-tool.x-tool-import {\n  background-image: url(../img/upload.svg);\n  background-repeat: no-repeat;\n  background-size: 12px 16px;\n  color: grey;\n  width: auto;\n  padding-left: 15px;\n  font-size: 10px;\n  line-height: 16px;\n}\n\n.x-tool.x-tool-label {\n  background-image: url(../img/label.svg);\n  background-repeat: no-repeat;\n  background-size: 12px 16px;\n  color: grey;\n  width: auto;\n  padding-left: 15px;\n  font-size: 10px;\n  line-height: 16px;\n}\n\n.x-tool.x-tool-collection {\n  background-image: url(../img/collection.svg);\n  background-repeat: no-repeat;\n  background-size: 12px 16px;\n  color: grey;\n  width: auto;\n  padding-left: 15px;\n  font-size: 10px;\n  line-height: 16px;\n}\n\n.x-tool.x-tool-manage {\n  background-image: url(../img/gear.svg);\n  background-repeat: no-repeat;\n  background-size: 12px 16px;\n  color: grey;\n  width: auto;\n  padding-left: 15px;\n  font-size: 10px;\n  line-height: 16px;\n}\n\n.x-tool.x-tool-download {\n  background-image: url(../img/download.svg);\n  background-repeat: no-repeat;\n  background-size: 16px 20px;\n  background-position: left;\n  color: grey;\n  width: auto;\n  padding-left: 20px;\n  font-size: 10px;\n  line-height: 16px;\n}\n\n.x-tool.x-tool-report {\n  background-image: url(../img/grid.svg);\n  background-repeat: no-repeat;\n  background-size: 12px 16px;\n  color: grey;\n  width: auto;\n  padding-left: 15px;\n  font-size: 10px;\n  line-height: 16px;\n}\n\n.x-tool.x-tool-trash {\n  background-image: url(../img/trash.svg);\n  background-repeat: no-repeat;\n  background-size: 14px 14px;\n  color: grey;\n  width: auto;\n  padding-left: 15px;\n  font-size: 10px;\n  line-height: 16px;\n}\n\n.x-tool.x-tool-clone {\n  background-image: url(../img/clone.svg);\n  background-repeat: no-repeat;\n  background-size: 14px 14px;\n  color: grey;\n  width: auto;\n  padding-left: 15px;\n  font-size: 10px;\n  line-height: 16px;\n}\n\n.x-tool.x-tool-spacer {\n  width: 10px;\n  background-image: unset;\n}\n\n.x-tool.x-tool-logout {\n  background-image: url(../img/logout.svg);\n  background-repeat: no-repeat;\n  background-size: 14px 14px;\n}\n\n.x-tool.x-tool-expand-grid {\n  background-image: url(../img/expand.svg);\n  background-repeat: no-repeat;\n  background-size: 14px 14px;\n  padding-right: 3px;\n}\n\n.x-tool.x-tool-collapse-grids {\n  background-image: url(../img/collapse.svg);\n  background-repeat: no-repeat;\n  background-size: 14px 14px;\n  padding-right: 3px;\n}\n\n.x-tool.x-tool-toggle.x-tool-collapse-west {\n  background-image: url(../img/collapse-left.svg);\n  background-repeat: no-repeat;\n  background-size: 10px 10px;\n  background-position: 2px 3px;\n}\n\n.x-tool.x-tool-expand-west {\n  background-image: url(../img/collapse-right.svg);\n  background-repeat: no-repeat;\n  background-size: 10px 10px;\n  background-position: 4px 4px;\n}\n\n.x-tool.x-tool-toggle.x-tool-collapse-east {\n  background-image: url(../img/collapse-right.svg);\n  background-repeat: no-repeat;\n  background-size: 10px 10px;\n  background-position: 2px 3px;\n}\n\n.x-tool.x-tool-expand-east {\n  background-image: url(../img/collapse-left.svg);\n  background-repeat: no-repeat;\n  background-size: 10px 10px;\n  background-position: 4px 4px;\n}\n\n.x-tool:hover {\n  filter: brightness(50%)\n}\n\n.sm-line-clamp-wrap .x-grid3-cell-inner {\n  overflow: hidden;\n  display: -webkit-box;\n  line-clamp: 1;\n  -webkit-line-clamp: 1;\n  -webkit-box-orient: vertical;\n  white-space: normal;\n  overflow-wrap: break-word;\n}\n\n.sm-line-height-up {\n  background-image: url(../img/line-height-up.svg);\n  background-size: 16px 16px;\n}\n\n.sm-line-height-down {\n  background-image: url(../img/line-height-down.svg);\n  background-size: 16px 16px;\n}\n\n.sm-content-stigid {\n  font-size: 10px;\n  font-weight: normal;\n  color: #808080;\n}\n\n.sm-direction-rtl {\n  direction: rtl;\n}\n\n.sm-diff-icon {\n  background-image: url(../img/diff.svg) !important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px;\n}\n\n.sm-diff-ins {\n  background-color: hsl(110 62% 90% / 1);\n}\n\n.sm-diff-del {\n  background-color: hsl(0deg 60% 85%);\n}\n\n.sm-diff-rule-ins {\n  background-color: red\n}\n\n.sm-diff-rule-del {\n  background-color: green\n}\n\n.sm-toolbar-diff .x-toolbar-ct {\n  height: 100%;\n  margin-left: 3px;\n}\n\n.sm-toolbar-diff .xtb-spacer {\n  width: 12px;\n}\n\n.x-menu-item-active {\n  background-image: none;\n  background-color: #e5e5e5\n}\n\n.x-btn-text-icon .x-btn-icon-small-left .x-btn-text {\n  background-size: 14px 14px;\n  background-position: 0px 1px;\n}\n\n.sm-hover-icon {\n  opacity: 0.75;\n  filter: grayscale(50%)\n}\n\n.sm-hover-icon:hover {\n  opacity: 1;\n  scale: 110%;\n  filter: grayscale(0%)\n}\n\n.sm-warning-header {\n  background-image: url(../img/red-flag.svg);\n  background-size: 32px 32px;\n  background-repeat: no-repeat;\n  font-weight: 600;\n  font-size: 20px;\n  padding-left: 36px;\n}\n\n.x-panel-inline-icon {\n  vertical-align: bottom;\n  margin-top: 0px;\n  margin-bottom: 0px;\n}\n\n.sm-add-assignment-icon {\n  background-image: url(../img/add-assignment.svg);\n  background-size: 18px;\n  background-repeat: no-repeat;\n}\n\n.sm-remove-assignment-icon {\n  background-image: url(../img/remove-assignment.svg);\n  background-size: 18px;\n  background-repeat: no-repeat;\n}\n\n.x-dd-drop-nodrop .x-dd-drop-icon {\n  background-image: url(\"../img/remove.svg\");\n  background-size: 16px 16px;\n}\n\n.x-dd-drop-ok .x-dd-drop-icon {\n  background-image: url(\"../img/add.svg\");\n  background-size: 16px 16px;\n}\n\n.x-dd-drop-ok-add .x-dd-drop-icon {\n  background-image: url(\"../img/add.svg\");\n  background-size: 16px 16px;\n}\n\n.sm-round-panel .x-panel-header.sm-selections-panel-header {\n  background-color: #c3deab;\n}\n\n.sm-fieldset-title-with-icon {\n  background-repeat: no-repeat;\n  background-size: 14px 14px;\n  padding-left: 20px;\n}\n\n.sm-stig-information-title {\n  background-image: url(../img/shield-green-check.svg);\n  background-repeat: no-repeat;\n  background-size: 14px 14px;\n  padding-left: 20px;\n\n}\n\n.sm-asset-assignments-title {\n  background-image: url(../img/target.svg);\n  background-repeat: no-repeat;\n  background-size: 14px 14px;\n  padding-left: 20px;\n}\n\n.sm-label-title {\n  background-image: url(../img/label.svg);\n  background-repeat: no-repeat;\n  background-size: 14px 14px;\n  padding-left: 20px;\n}\n\n.sm-grid3-draggable .x-grid3-row-selected .x-grid3-td-checker * {\n  cursor: default;\n}\n\n.sm-grid3-draggable .x-grid3-row-selected *,\n.sm-grid3-draggable .x-grid3-row-selected {\n  cursor: grab;\n}\n\n.sm-grabbing *,\n.sm-grabbing .sm-grid3-draggable .x-grid3-row-selected *,\n.sm-grabbing .sm-grid3-draggable .x-grid3-row-selected {\n  cursor: url(\"../img/drag-drop-light.svg\"), grabbing;\n}\n\n.x-item-disabled {\n  filter: saturate(0.25)\n}\n\n.sm-column-with-icon {\n  padding-left: 20px;\n}\n\n.sm-cell-with-icon {\n  padding-left: 20px;\n  line-height: 18px;\n}\n\n.sm-match-case-icon {\n  background-image: url(../img/match-case.svg);\n  background-size: contain;\n}\n\n.sm-match-word-icon {\n  background-image: url(../img/match-word.svg);\n  background-size: contain;\n}\n\n.sm-browser-icon {\n  background-image: url(../img/browser.svg);\n  background-size: 16px;\n}\n\n.sm-nodejs-icon {\n  background-image: url(../img/jsIconGreen.svg);\n  background-size: 16px;\n}\n\n.sm-mysql-icon {\n  background-image: url(../img/mysql.svg);\n  background-size: 16px;\n}\n\n.sm-json-icon {\n  background-image: url(../img/json.svg);\n  background-size: 16px;\n}\n\n.sm-login-icon {\n  background-image: url(../img/login.svg);\n  background-size: 16px;\n}\n\n.x-layout-split {\n  background-color: transparent;\n  transition-property: background-color;\n  transition-duration: 0.25s;\n  transition-delay: 0s;\n}\n\n.x-layout-split:hover {\n  background-color: hsl(0 0% 66% / 1);\n  transition-duration: 0.25s;\n  transition-delay: 0s;\n}\n\n.sm-row-disabled {\n  color: #a15e5e\n}\n\n.sm-share-icon {\n  background-image: url(../img/share.svg);\n  background-size: 16px;\n}\n\n.xg-hmenu-sort-asc .x-menu-item-icon {\n  background-image: url(\"../img/up.svg\");\n  background-size: 16px 16px;\n}\n\n.xg-hmenu-sort-desc .x-menu-item-icon {\n  background-image: url(\"../img/down.svg\");\n  background-size: 16px 16px;\n}\n\n.x-cols-icon {\n  background-image: url(\"../img/columns.svg\");\n  background-size: 16px 16px;\n}\n\n.sort-asc .x-grid3-sort-icon {\n  background-image: url(\"../img/up.svg\");\n  background-size: 10px;\n  background-position: center\n}\n\n.sort-desc .x-grid3-sort-icon {\n  background-image: url(\"../img/down.svg\");\n  background-size: 10px;\n  background-position: center\n}\n\n.sm-circle-icon {\n  background-image: url(\"../img/circle.svg\");\n  background-size: 7px 7px;\n  background-position: top 5px left 5px;\n}\n\n.x-menu {\n  background-image: none\n}\n\n.sm-appinfo-message {\n  background-color: #e0e0e0;\n  width: 330px;\n  height: 60px;\n  color: #484848;\n  padding: 7px;\n}\n\n.sm-info-circle-icon {\n  background-image: url(../img/info-circle.svg) !important;\n  background-size: 16px 16px;\n}\n\n.sm-render-zero {\n  color: #cccccc\n}\n\n.sm-appinfo-message a:link {\n  text-decoration: none\n}\n\n.sm-appinfo-message .sm-share-icon {\n  padding-left: 14px;\n  background-size: 12px 12px;\n  background-repeat: no-repeat;\n  background-position: left;\n  font-weight: 600;\n}\n\n.sm-appinfo-message .sm-email {\n  font-weight: 600;\n  color: cadetblue;\n}\n\n.sm-grid-cell-role {\n  height: 28px;\n  line-height: 28px;\n}\n\n.x-grid3-row-over .sm-grid-cell-with-menu {\n  background-image: url(\"../img/tree-elbow-minus.svg\");\n  background-repeat: no-repeat;\n  background-size: 12px 12px;\n  background-position: right 3px center;\n\n}\n\n.sm-vbox-disabled .x-box-inner {\n  filter: opacity(0.25)\n}\n\n.sm-label-sprite.sm-sprite-read {\n  float: right;\n  background-color: #757c8a;\n  color: #eee;\n}\n\n.sm-label-sprite.sm-sprite-readwrite {\n  float: right;\n  background-color: #976a6e;\n  color: #eee;\n}\n\n.sm-row-readonly-icon {\n  background-size: 14px;\n  background-repeat: no-repeat;\n  background-image: url(../img/read-only.svg);\n  background-position: 0px 2px;\n  height: 18px;\n}\n\n.sm-read-only-icon {\n  background-size: 16px 16px;\n  background-image: url(../img/read-only.svg);\n}\n\n.sm-checklist-read,\n.sm-checklist-read-write {\n  float: right;\n  color: #f2f2f2;\n}\n\n.sm-checklist-read-write {\n  background-color: hsl(145.08deg 100% 23.92%);\n}\n\n.sm-checklist-read {\n  background-color: hsl(330 55% 24% / 1);\n}\n\n.sm-sprite-U {\n  background-color: var(--color-marking-unclassified);\n  border-radius: 6px;\n}\n\n.sm-sprite-U::before {\n  content: \"U\";\n  font-weight: 800;\n  margin: 2px;\n}\n\n.sm-sprite-CUI {\n  background-color: var(--color-marking-cui);\n  border-radius: 6px;\n}\n\n.sm-sprite-CUI::before {\n  content: \"CUI\";\n  font-weight: 800;\n  margin: 2px;\n}\n\n.sm-sprite-FOUO::before {\n  content: \"FOUO\";\n  font-weight: 800;\n  margin: 2px;\n}\n\n.sm-sprite-FOUO {\n  background-color: var(--color-marking-unclassified);\n  border-radius: 6px;\n}\n\n.sm-flexbox-layout-ct {\n  display: flex;\n  flex-wrap: wrap;\n  overflow: auto;\n  scrollbar-width: none;\n  align-content: flex-start;\n}\n\n.sm-flexbox-layout-ct:hover {\n  scrollbar-width: auto;\n}\n\n.sm-status-csv {\n  color: #eee;\n  padding: 4px;\n  border-radius: 10px;\n  font-weight: bold;\n  font-size: 12px;\n}\n\n.sm-error-icon {\n  background-image: url(../img/x-red-svg.svg);\n}\n\n.sm-cora-container {\n  display: flex;\n  flex-direction: row;\n  justify-content: space-evenly;\n}\n\n.sm-cora-box-left {\n  display: flex;\n  flex-direction: column;\n  justify-content: space-between;\n  border-radius: 10px;\n  width: fit-content;\n}\n\n.sm-cora-box-title {\n  text-align: center;\n  font-weight: 600;\n}\n\n.sm-cora-cat {\n  color: #111;\n  border-radius: 5px;\n  border: 1px solid #bbb;\n  font-weight: 700;\n  text-align: right;\n  padding: 0px 6px;\n  margin: 0px 12px;\n}\n\n.sm-cat1 {\n  background-color: var(--color-severity-high);\n}\n\n.sm-cat2 {\n  background-color: var(--color-severity-medium);\n}\n\n.sm-cat3 {\n  background-color: var(--color-severity-low);\n}\n\n.sm-cat1::before {\n  content: \"CAT 1\";\n  float: left;\n  font-weight: 600\n}\n\n.sm-cat2::before {\n  content: \"CAT 2\";\n  float: left;\n  font-weight: 600\n}\n\n.sm-cat3::before {\n  content: \"CAT 3\";\n  float: left;\n  font-weight: 600\n}\n\n.sm-cora-box-right {\n  padding: 6px;\n  border-radius: 10px;\n  border: 1px solid #bbb;\n  text-align: center;\n  width: 110px;\n}\n\n.sm-cora-score-header {\n  font-weight: 600;\n  font-size: larger;\n  color: #111;\n}\n\n.sm-cora-score-risk-level {\n  font-size: 11px;\n  font-weight: 800;\n}\n\n.sm-risk-indicator {\n  margin: auto;\n  font-weight: 800;\n  font-size: 18px;\n  color: #111;\n}\n\n.sm-cora-risk-very-high {\n  background-color: var(--color-risk-very-high);\n}\n\n.sm-cora-risk-very-high .sm-cora-score-risk-level {\n  color: var(--color-risk-very-high-text);\n}\n\n.sm-cora-risk-high {\n  background-color: var(--color-risk-high);\n}\n\n.sm-cora-risk-high .sm-cora-score-risk-level {\n  color: var(--color-risk-high-text);\n}\n\n.sm-cora-risk-moderate {\n  background-color: var(--color-risk-moderate);\n}\n\n.sm-cora-risk-moderate .sm-cora-score-risk-level {\n  color: var(--color-risk-moderate-text);\n}\n\n.sm-cora-risk-low {\n  background-color: var(--color-risk-low);\n}\n\n.sm-cora-risk-low .sm-cora-score-risk-level {\n  color: var(--color-risk-low-text);\n}\n\n.sm-cora-risk-very-low {\n  background-color: var(--color-risk-very-low);\n}\n\n.sm-cora-risk-very-low .sm-cora-score-risk-level {\n  color: var(--color-risk-very-low-text);\n}\n\n.x-grid3-scroller {\n  overflow-x: auto;\n  scrollbar-color: var(--color-scrollbar-idle) transparent;\n  transition: scrollbar-color 0.125s;\n}\n\n.x-grid3-scroller:hover {\n  overflow-x: auto;\n  scrollbar-color: var(--color-scrollbar-hover) transparent;\n}\n\n.sm-round-panel .x-panel-body {\n  scrollbar-color: var(--color-scrollbar-idle) transparent;\n  transition: scrollbar-color 0.125s;\n}\n\n.sm-round-panel .x-panel-body:hover {\n  scrollbar-color: var(--color-scrollbar-hover) transparent;\n}\n\n.sm-multi-value-grid .x-grid3-row-selected {\n  background-color: transparent !important;\n}\n\n.x-menu-list-item:has(> .x-hide-display) {\n  padding: 0\n}\n\n.sm-logs-icon {\n  background-image: url(../img/logs.svg) !important;\n  background-size: 16px 16px\n}\n\n.sm-log-line {\n  width: 100%;\n  padding: 0.2em 0;\n  border-bottom: 1px solid #4b4b4b;\n  font-family: monospace;\n  font-size: 10px;\n}\n\n.sm-log-line:hover {\n  background-color: color-mix(in srgb, currentColor 10%, transparent);\n}\n\n.sm-log-line.selected {\n  background-color: color-mix(in srgb, currentColor 20%, transparent);\n}\n\n.sm-log-line[data-component=\"logSocket\"] {\n  color: #8b1fff;\n}\n\n.sm-log-line[data-component=\"jwksCache\"] {\n  color: #ad611a;\n}\n\n.sm-log-line[data-component=\"static\"] {\n  color: #808080;\n}\n\n.sm-log-line[data-component=\"rest\"] {\n  color: #00a900;\n}\n\n.sm-log-line[data-level=\"1\"] {\n  color: red;\n}\n\n.sm-log-line[data-level=\"2\"] {\n  color: orange;\n}\n\n.sm-log-panel-body {\n  cursor: pointer;\n  overflow: auto;\n  text-wrap-mode: nowrap;\n}\n\n.sm-log-wrapper {\n  padding: 0 0.2em;\n  display: table;\n}\n\n.sm-http-status-sprite {\n  font: 600 10px/14px Open Sans, helvetica, sans-serif;\n  top: 0;\n  padding: 0 5px;\n  border-radius: 3px;\n  margin-left: 3px;\n  white-space: nowrap\n}\n.sm-http-status-200 {\n  background-color: var(--color-http-status-200);\n}\n.sm-http-status-300 {\n  background-color: var(--color-http-status-300);\n}\n.sm-http-status-400 {\n  background-color: var(--color-http-status-400);\n}\n.sm-http-status-500 {\n  background-color: var(--color-http-status-500);\n}\n.x-toolbar-cell .x-form-check-wrap {\n  margin-bottom: 4px;\n  margin-right: 4px;\n}\n\n.sm-log-panel .x-toolbar-ct {\n\tpadding: 0\n}\n.sm-job-icon {\n  background-image: url(../img/job.svg)!important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-job-run-icon {\n  background-image: url(../img/job-run.svg)!important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n.sm-job-task-icon {\n  background-image: url(../img/job-task.svg)!important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-run-output-icon {\n  background-image: url(../img/logs.svg)!important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-job-event-icon {\n  background-image: url(../img/clock.svg)!important;\n  background-repeat: no-repeat;\n  background-size: 16px 16px\n}\n\n.sm-move-up-icon {\n  background-image: url(../img/move-up.svg)!important;\n  background-repeat: no-repeat;\n  background-size: 18px\n}\n.sm-move-down-icon {\n  background-image: url(../img/move-down.svg)!important;\n  background-repeat: no-repeat;\n  background-size: 18px\n}\n.sm-task-description {\n  font-size: smaller;\n  font-style: italic;\n  color: #808080;\n  line-height: 12px;\n  padding-left: 6px;\n}\n\n.sm-job-sprite {\n  font: 600 10px/14px Open Sans,helvetica,sans-serif;\n  top: 0;\n  padding: 0 5px;\n  border-radius: 3px;\n  margin-left: 3px;\n  white-space: nowrap;\n  line-height: 16px;\t\n}\n.sm-job-sprite.sm-job-scheduled {\n  background-color: var(--color-job-scheduled)\n}\n\n.sm-job-sprite.sm-job-unscheduled {\n  background-color: var(--color-job-unscheduled)\n}\n\n.sm-job-sprite.sm-job-run-state-completed {\n  background-color: var(--color-job-run-state-completed);\n}\n\n.sm-job-sprite.sm-job-run-state-running {\n  background-color: var(--color-job-run-state-running);\n}\n\n.sm-job-sprite.sm-job-run-state-failed {\n  background-color: var(--color-job-run-state-failed);\n}\n\n.sm-job-sprite.sm-job-run-state-missing {\n  background-color: var(--color-job-run-state-missing);\n}\n.sm-job-sprite.sm-job-run-state-shutdown {\n  background-color: var(--color-job-run-state-failed);\n}\n\n\n.sm-round-panel.sm-offline-modal {\n\tbackground-color: hsl(0 61% 64% / 1);\n}\n\n.sm-round-panel.sm-unavailable-modal {\n\tbackground-color: hsl(26.39deg 62.3% 64.31%);\n}\n\n.sm-icon-column {\n\tpadding-left: 20px;\n\tbackground-size: 14px;\n}\n.sm-job-event-disabled {\n\topacity: 50%;\n}\n"
  },
  {
    "path": "client/src/ext/INCLUDE_ORDER.txt",
    "content": "All adapter related files below are located in \n/adapters/<lib name>/ of this zip file.\n\nYour include order should be:\n\nExt Stand-alone\n-------------------------------------------------------------------\next-base.js\next-all.js (or your choice of files)\n\n\nYahoo! UI (.12+)\n-------------------------------------------------------------------\nyui-utilities.js\next-yui-adapter.js\next-all.js (or your choice of files)\n\n\njQuery (1.1+)\n-------------------------------------------------------------------\njquery.js\next-jquery-adapter.js\next-all.js (or your choice of files)\n\n\nPrototype (1.5+) / Scriptaculous (1.7+)\n-------------------------------------------------------------------\nprototype.js\nscriptaculous.js?load=effects  (or whatever you want to load)\next-prototype-adapter.js\next-all.js (or your choice of files)\n\n\n\nSee the examples folders for more examples.\n"
  },
  {
    "path": "client/src/ext/adapter/ext/ext-base-debug.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n// for old browsers\nwindow.undefined = window.undefined;\n\n/**\n * @class Ext\n * Ext core utilities and functions.\n * @singleton\n */\n\nExt = {\n    /**\n     * The version of the framework\n     * @type String\n     */\n    version : '3.4.1.1',\n    versionDetail : {\n        major : 3,\n        minor : 4,\n        patch : 1.1\n    }\n};\n\n/**\n * Copies all the properties of config to obj.\n * @param {Object} obj The receiver of the properties\n * @param {Object} config The source of the properties\n * @param {Object} defaults A different object that will also be applied for default values\n * @return {Object} returns obj\n * @member Ext apply\n */\nExt.apply = function(o, c, defaults){\n    // no \"this\" reference for friendly out of scope calls\n    if(defaults){\n        Ext.apply(o, defaults);\n    }\n    if(o && c && typeof c == 'object'){\n        for(var p in c){\n            o[p] = c[p];\n        }\n    }\n    return o;\n};\n\n(function(){\n    var idSeed = 0,\n        toString = Object.prototype.toString,\n        ua = navigator.userAgent.toLowerCase(),\n        check = function(r){\n            return r.test(ua);\n        },\n        DOC = document,\n        docMode = DOC.documentMode,\n        isStrict = DOC.compatMode == \"CSS1Compat\",\n        isOpera = check(/opera/),\n        isChrome = check(/\\bchrome\\b/),\n        isWebKit = check(/webkit/),\n        isSafari = !isChrome && check(/safari/),\n        isSafari2 = isSafari && check(/applewebkit\\/4/), // unique to Safari 2\n        isSafari3 = isSafari && check(/version\\/3/),\n        isSafari4 = isSafari && check(/version\\/4/),\n        isIE = !isOpera && check(/msie/),\n        isIE7 = isIE && ((check(/msie 7/) && docMode != 8 && docMode != 9 && docMode != 10) || docMode == 7),\n        isIE8 = isIE && ((check(/msie 8/) && docMode != 7 && docMode != 9 && docMode != 10) || docMode == 8),\n        isIE9 = isIE && ((check(/msie 9/) && docMode != 7 && docMode != 8 && docMode != 10) || docMode == 9),\n        isIE10 = isIE && ((check(/msie 10/) && docMode != 7 && docMode != 8 && docMode != 9) || docMode == 10),\n        isIE6 = isIE && check(/msie 6/),\n        isIE9m = isIE && (isIE6 || isIE7 || isIE8 || isIE9),\n        isGecko = !isWebKit && check(/gecko/),\n        isGecko2 = isGecko && check(/rv:1\\.8/),\n        isGecko3 = isGecko && check(/rv:1\\.9/),\n        isBorderBox = isIE9m && !isStrict,\n        isWindows = check(/windows|win32/),\n        isMac = check(/macintosh|mac os x/),\n        isAir = check(/adobeair/),\n        isLinux = check(/linux/),\n        isSecure = /^https/i.test(window.location.protocol),\n        noArgs = [],\n        nonEnumerables = [],\n        emptyFn = Ext.emptyFn,\n        t = Ext.apply({}, {\n            constructor: emptyFn,\n            toString: emptyFn,\n            valueOf: emptyFn\n        }),\n        callOverrideParent = function () {\n            var method = callOverrideParent.caller.caller; // skip callParent (our caller)\n            return method.$owner.prototype[method.$name].apply(this, arguments);\n        };\n\n    if (t.constructor !== emptyFn) {\n        nonEnumerables.push('constructor');\n    }\n    if (t.toString !== emptyFn) {\n        nonEnumerables.push('toString');\n    }\n    if (t.valueOf !== emptyFn) {\n        nonEnumerables.push('valueOf');\n    }\n    if (!nonEnumerables.length) {\n        nonEnumerables = null;\n    }\n\n    // Create the abstract Base class to provide an empty constructor and callParent implementations\n    function Base () {\n        //\n    }\n\n    Ext.apply(Base, {\n        $isClass: true,\n\n        callParent: function (args) {\n            var method;\n\n            // This code is intentionally inlined for the least number of debugger stepping\n            return (method = this.callParent.caller) && (method.$previous ||\n                ((method = method.$owner ? method : method.caller) &&\n                        method.$owner.superclass.self[method.$name])).apply(this, args || noArgs);\n        }\n    });\n\n    Base.prototype = {\n        constructor: function() {\n        },\n        callParent: function(args) {\n            // NOTE: this code is deliberately as few expressions (and no function calls)\n            // as possible so that a debugger can skip over this noise with the minimum number\n            // of steps. Basically, just hit Step Into until you are where you really wanted\n            // to be.\n            var method,\n                superMethod = (method = this.callParent.caller) && (method.$previous ||\n                        ((method = method.$owner ? method : method.caller) &&\n                                method.$owner.superclass[method.$name]));\n\n            return superMethod.apply(this, args || noArgs);\n        }\n    };\n\n    // remove css image flicker\n    if(isIE6){\n        try{\n            DOC.execCommand(\"BackgroundImageCache\", false, true);\n        }catch(e){}\n    }\n\n    Ext.apply(Ext, {\n        /**\n         * URL to a blank file used by Ext when in secure mode for iframe src and onReady src to prevent\n         * the IE insecure content warning (<tt>'about:blank'</tt>, except for IE in secure mode, which is <tt>'javascript:\"\"'</tt>).\n         * @type String\n         */\n        SSL_SECURE_URL : isSecure && isIE ? 'javascript:\"\"' : 'about:blank',\n        /**\n         * True if the browser is in strict (standards-compliant) mode, as opposed to quirks mode\n         * @type Boolean\n         */\n        isStrict : isStrict,\n        /**\n         * True if the page is running over SSL\n         * @type Boolean\n         */\n        isSecure : isSecure,\n        /**\n         * True when the document is fully initialized and ready for action\n         * @type Boolean\n         */\n        isReady : false,\n\n        /**\n         * True if the {@link Ext.Fx} Class is available\n         * @type Boolean\n         * @property enableFx\n         */\n\n        /**\n         * HIGHLY EXPERIMENTAL\n         * True to force css based border-box model override and turning off javascript based adjustments. This is a\n         * runtime configuration and must be set before onReady.\n         * @type Boolean\n         */\n        enableForcedBoxModel : false,\n\n        /**\n         * True to automatically uncache orphaned Ext.Elements periodically (defaults to true)\n         * @type Boolean\n         */\n        enableGarbageCollector : true,\n\n        /**\n         * True to automatically purge event listeners during garbageCollection (defaults to false).\n         * @type Boolean\n         */\n        enableListenerCollection : false,\n\n        /**\n         * EXPERIMENTAL - True to cascade listener removal to child elements when an element is removed.\n         * Currently not optimized for performance.\n         * @type Boolean\n         */\n        enableNestedListenerRemoval : false,\n\n        /**\n         * Indicates whether to use native browser parsing for JSON methods.\n         * This option is ignored if the browser does not support native JSON methods.\n         * <b>Note: Native JSON methods will not work with objects that have functions.\n         * Also, property names must be quoted, otherwise the data will not parse.</b> (Defaults to false)\n         * @type Boolean\n         */\n        USE_NATIVE_JSON : false,\n\n        /**\n         * Copies all the properties of config to obj if they don't already exist.\n         * @param {Object} obj The receiver of the properties\n         * @param {Object} config The source of the properties\n         * @return {Object} returns obj\n         */\n        applyIf : function(o, c){\n            if(o){\n                for(var p in c){\n                    if(!Ext.isDefined(o[p])){\n                        o[p] = c[p];\n                    }\n                }\n            }\n            return o;\n        },\n\n        /**\n         * Generates unique ids. If the element already has an id, it is unchanged\n         * @param {Mixed} el (optional) The element to generate an id for\n         * @param {String} prefix (optional) Id prefix (defaults \"ext-gen\")\n         * @return {String} The generated Id.\n         */\n        id : function(el, prefix){\n            el = Ext.getDom(el, true) || {};\n            if (!el.id) {\n                el.id = (prefix || \"ext-gen\") + (++idSeed);\n            }\n            return el.id;\n        },\n\n        /**\n         * <p>Extends one class to create a subclass and optionally overrides members with the passed literal. This method\n         * also adds the function \"override()\" to the subclass that can be used to override members of the class.</p>\n         * For example, to create a subclass of Ext GridPanel:\n         * <pre><code>\nMyGridPanel = Ext.extend(Ext.grid.GridPanel, {\n    constructor: function(config) {\n\n//      Create configuration for this Grid.\n        var store = new Ext.data.Store({...});\n        var colModel = new Ext.grid.ColumnModel({...});\n\n//      Create a new config object containing our computed properties\n//      *plus* whatever was in the config parameter.\n        config = Ext.apply({\n            store: store,\n            colModel: colModel\n        }, config);\n\n        MyGridPanel.superclass.constructor.call(this, config);\n\n//      Your postprocessing here\n    },\n\n    yourMethod: function() {\n        // etc.\n    }\n});\n</code></pre>\n         *\n         * <p>This function also supports a 3-argument call in which the subclass's constructor is\n         * passed as an argument. In this form, the parameters are as follows:</p>\n         * <div class=\"mdetail-params\"><ul>\n         * <li><code>subclass</code> : Function <div class=\"sub-desc\">The subclass constructor.</div></li>\n         * <li><code>superclass</code> : Function <div class=\"sub-desc\">The constructor of class being extended</div></li>\n         * <li><code>overrides</code> : Object <div class=\"sub-desc\">A literal with members which are copied into the subclass's\n         * prototype, and are therefore shared among all instances of the new class.</div></li>\n         * </ul></div>\n         *\n         * @param {Function} superclass The constructor of class being extended.\n         * @param {Object} overrides <p>A literal with members which are copied into the subclass's\n         * prototype, and are therefore shared between all instances of the new class.</p>\n         * <p>This may contain a special member named <tt><b>constructor</b></tt>. This is used\n         * to define the constructor of the new class, and is returned. If this property is\n         * <i>not</i> specified, a constructor is generated and returned which just calls the\n         * superclass's constructor passing on its parameters.</p>\n         * <p><b>It is essential that you call the superclass constructor in any provided constructor. See example code.</b></p>\n         * @return {Function} The subclass constructor from the <code>overrides</code> parameter, or a generated one if not provided.\n         */\n        extend : function(){\n            // inline overrides\n            var io = function(o){\n                for(var m in o){\n                    this[m] = o[m];\n                }\n            };\n            var oc = Object.prototype.constructor;\n\n            return function(sb, sp, overrides){\n                if(typeof sp == 'object'){\n                    overrides = sp;\n                    sp = sb;\n                    sb = overrides.constructor != oc ? overrides.constructor : function(){sp.apply(this, arguments);};\n                }\n                var F = function(){},\n                    sbp,\n                    spp = sp.prototype;\n\n                F.prototype = spp;\n                sbp = sb.prototype = new F();\n                sbp.constructor=sb;\n                sb.superclass=spp;\n                if(spp.constructor == oc){\n                    spp.constructor=sp;\n                }\n                sb.override = function(o){\n                    Ext.override(sb, o);\n                };\n                sbp.superclass = sbp.supr = (function(){\n                    return spp;\n                });\n                sbp.override = io;\n                Ext.override(sb, overrides);\n                sb.extend = function(o){return Ext.extend(sb, o);};\n                return sb;\n            };\n        }(),\n\n        global: (function () {\n            return this;\n        })(),\n\n        Base: Base,\n\n        namespaceCache: {},\n\n        createNamespace: function (namespaceOrClass, isClass) {\n            var cache = Ext.namespaceCache,\n                namespace = isClass ? namespaceOrClass.substring(0, namespaceOrClass.lastIndexOf('.'))\n                            : namespaceOrClass,\n                ns = cache[namespace],\n                i, n, part, parts, partials;\n\n            if (!ns) {\n                ns = Ext.global;\n                if (namespace) {\n                    partials = [];\n                    parts = namespace.split('.');\n\n                    for (i = 0, n = parts.length; i < n; ++i) {\n                        part = parts[i];\n\n                        ns = ns[part] || (ns[part] = {});\n                        partials.push(part);\n\n                        cache[partials.join('.')] = ns; // build up prefixes as we go\n                    }\n                }\n            }\n\n            return ns;\n        },\n\n        getClassByName: function (className) {\n            var parts = className.split('.'),\n                cls = Ext.global,\n                n = parts.length,\n                i;\n\n            for (i = 0; cls && i < n; ++i) {\n                cls = cls[parts[i]];\n            }\n\n            return cls || null;\n        },\n\n        addMembers: function (cls, target, members, handleNonEnumerables) {\n            var i, name, member;\n\n            for (name in members) {\n                if (members.hasOwnProperty(name)) {\n                    member = members[name];\n                    if (typeof member == 'function') {\n                        member.$owner = cls;\n                        member.$name = name;\n                    }\n\n                    target[name] = member;\n                }\n            }\n\n            if (handleNonEnumerables && nonEnumerables) {\n                for (i = nonEnumerables.length; i-- > 0; ) {\n                    name = nonEnumerables[i];\n                    if (members.hasOwnProperty(name)) {\n                        member = members[name];\n                        if (typeof member == 'function') {\n                            member.$owner = cls;\n                            member.$name = name;\n                        }\n\n                        target[name] = member;\n                    }\n                }\n            }\n        },\n\n        /**\n         * @method\n         * Defines a class or override. A basic class is defined like this:\n         *\n         *      Ext.define('My.awesome.Class', {\n         *          someProperty: 'something',\n         *\n         *          someMethod: function(s) {\n         *              alert(s + this.someProperty);\n         *          }\n         *\n         *          ...\n         *      });\n         *\n         *      var obj = new My.awesome.Class();\n         *\n         *      obj.someMethod('Say '); // alerts 'Say something'\n         *\n         * To create an anonymous class, pass `null` for the `className`:\n         * \n         *      Ext.define(null, {\n         *          constructor: function () {\n         *              // ...\n         *          }\n         *      });\n         *\n         * In some cases, it is helpful to create a nested scope to contain some private\n         * properties. The best way to do this is to pass a function instead of an object\n         * as the second parameter. This function will be called to produce the class\n         * body:\n         * \n         *      Ext.define('MyApp.foo.Bar', function () {\n         *          var id = 0;\n         *          \n         *          return {\n         *              nextId: function () {\n         *                  return ++id;\n         *              }\n         *          };\n         *      });\n         * \n         * When using this form of `Ext.define`, the function is passed a reference to its\n         * class. This can be used as an efficient way to access any static properties you\n         * may have:\n         * \n         *      Ext.define('MyApp.foo.Bar', function (Bar) {\n         *          return {\n         *              statics: {\n         *                  staticMethod: function () {\n         *                      // ...\n         *                  }\n         *              },\n         *              \n         *              method: function () {\n         *                  return Bar.staticMethod();\n         *              }\n         *          };\n         *      });\n         *\n         * To define an override, include the `override` property. The content of an\n         * override is aggregated with the specified class in order to extend or modify\n         * that class. This can be as simple as setting default property values or it can\n         * extend and/or replace methods. This can also extend the statics of the class.\n         *\n         * One use for an override is to break a large class into manageable pieces.\n         *\n         *      // File: /src/app/Panel.js\n         *\n         *      Ext.define('My.app.Panel', {\n         *          extend: 'Ext.panel.Panel',\n         *\n         *          constructor: function (config) {\n         *              this.callParent(arguments); // calls Ext.panel.Panel's constructor\n         *              //...\n         *          },\n         *\n         *          statics: {\n         *              method: function () {\n         *                  return 'abc';\n         *              }\n         *          }\n         *      });\n         *\n         *      // File: /src/app/PanelPart2.js\n         *      Ext.define('My.app.PanelPart2', {\n         *          override: 'My.app.Panel',\n         *\n         *          constructor: function (config) {\n         *              this.callParent(arguments); // calls My.app.Panel's constructor\n         *              //...\n         *          }\n         *      });\n         *\n         * Another use of overrides is to provide optional parts of classes that can be\n         * independently required. In this case, the class may even be unaware of the\n         * override altogether.\n         *\n         *      Ext.define('My.ux.CoolTip', {\n         *          override: 'Ext.tip.ToolTip',\n         *\n         *          constructor: function (config) {\n         *              this.callParent(arguments); // calls Ext.tip.ToolTip's constructor\n         *              //...\n         *          }\n         *      });\n         *\n         * Overrides can also contain statics:\n         *\n         *      Ext.define('My.app.BarMod', {\n         *          override: 'Ext.foo.Bar',\n         *\n         *          statics: {\n         *              method: function (x) {\n         *                  return this.callParent([x * 2]); // call Ext.foo.Bar.method\n         *              }\n         *          }\n         *      });\n         *\n         * @param {String} className The class name to create in string dot-namespaced format, for example:\n         * 'My.very.awesome.Class', 'FeedViewer.plugin.CoolPager'\n         * It is highly recommended to follow this simple convention:\n         *  - The root and the class name are 'CamelCased'\n         *  - Everything else is lower-cased\n         * Pass `null` to create an anonymous class.\n         * @param {Object} data The key - value pairs of properties to apply to this class. Property names can be of any valid\n         * strings, except those in the reserved listed below:\n         *  - `mixins`\n         *  - `statics`\n         *  - `config`\n         *  - `alias`\n         *  - `self`\n         *  - `singleton`\n         *  - `alternateClassName`\n         *  - `override`\n         *\n         * @param {Function} createdFn Optional callback to execute after the class is created, the execution scope of which\n         * (`this`) will be the newly created class itself.\n         * @return {Ext.Base}\n         * @markdown\n         * @member Ext\n         * @method define\n         */\n        define: function (className, body, createdFn) {\n            var override = body.override,\n                cls, extend, name, namespace;\n\n            if (override) {\n                delete body.override;\n                cls = Ext.getClassByName(override);\n                Ext.override(cls, body);\n            } else {\n                if (className) {\n                    namespace = Ext.createNamespace(className, true);\n                    name = className.substring(className.lastIndexOf('.')+1);\n                }\n\n                cls = function ctor () {\n                    this.constructor.apply(this, arguments);\n                }\n\n                if (className) {\n                    cls.displayName = className;\n                }\n                cls.$isClass = true;\n                cls.callParent = Ext.Base.callParent;\n\n                if (typeof body == 'function') {\n                    body = body(cls);\n                }\n\n                extend = body.extend;\n                if (extend) {\n                    delete body.extend;\n                    if (typeof extend == 'string') {\n                        extend = Ext.getClassByName(extend);\n                    }\n                } else {\n                    extend = Base;\n                }\n\n                Ext.extend(cls, extend, body);\n                if (cls.prototype.constructor === cls) {\n                    delete cls.prototype.constructor;\n                }\n\n                // Not extending a class which derives from Base...\n                if (!cls.prototype.$isClass) {\n                    Ext.applyIf(cls.prototype, Base.prototype);\n                }\n                cls.prototype.self = cls;\n                \n                if (body.xtype) {\n                    Ext.reg(body.xtype, cls);\n                }\n                cls = body.singleton ? new cls() : cls;\n                if (className) {\n                    namespace[name] = cls;\n                }\n            }\n\n            if (createdFn) {\n                createdFn.call(cls);\n            }\n\n            return cls;\n        },\n\n        /**\n         * Overrides members of the specified `target` with the given values.\n         *\n         * If the `target` is a function, it is assumed to be a constructor and the contents\n         * of `overrides` are applied to its `prototype` using {@link Ext#apply Ext.apply}.\n         * \n         * If the `target` is an instance of a class created using {@link #define},\n         * the `overrides` are applied to only that instance. In this case, methods are\n         * specially processed to allow them to use {@link Ext.Base#callParent}.\n         * \n         *      var panel = new Ext.Panel({ ... });\n         *      \n         *      Ext.override(panel, {\n         *          initComponent: function () {\n         *              // extra processing...\n         *              \n         *              this.callParent();\n         *          }\n         *      });\n         *\n         * If the `target` is none of these, the `overrides` are applied to the `target`\n         * using {@link Ext#apply Ext.apply}.\n         *\n         * Please refer to {@link Ext#define Ext.define} for further details.\n         *\n         * @param {Object} target The target to override.\n         * @param {Object} overrides The properties to add or replace on `target`. \n         * @method override\n         */\n        override: function (target, overrides) {\n            var proto, statics;\n\n            if (overrides) {\n                if (target.$isClass) {\n                    statics = overrides.statics;\n                    if (statics) {\n                        delete overrides.statics;\n                    }\n\n                    Ext.addMembers(target, target.prototype, overrides, true);\n                    if (statics) {\n                        Ext.addMembers(target, target, statics);\n                    }\n                } else if (typeof target == 'function') {\n                    proto = target.prototype;\n                    Ext.apply(proto, overrides);\n                    if(Ext.isIE && overrides.hasOwnProperty('toString')){\n                        proto.toString = overrides.toString;\n                    }\n                } else {\n                    var owner = target.self,\n                        name, value;\n\n                    if (owner && owner.$isClass) {\n                        for (name in overrides) {\n                            if (overrides.hasOwnProperty(name)) {\n                                value = overrides[name];\n\n                                if (typeof value == 'function') {\n                                    //<debug>\n                                    if (owner.$className) {\n                                        value.displayName = owner.$className + '#' + name;\n                                    }\n                                    //</debug>\n\n                                    value.$name = name;\n                                    value.$owner = owner;\n                                    value.$previous = target.hasOwnProperty(name)\n                                        ? target[name] // already hooked, so call previous hook\n                                        : callOverrideParent; // calls by name on prototype\n                                }\n\n                                target[name] = value;\n                            }\n                        }\n                    } else {\n                        Ext.apply(target, overrides);\n\n                        if (!target.constructor.$isClass) {\n                            target.constructor.prototype.callParent = Base.prototype.callParent;\n                            target.constructor.callParent = Base.callParent;\n                        }\n                    }\n                }\n            }\n        },\n\n        /**\n         * Creates namespaces to be used for scoping variables and classes so that they are not global.\n         * Specifying the last node of a namespace implicitly creates all other nodes. Usage:\n         * <pre><code>\nExt.namespace('Company', 'Company.data');\nExt.namespace('Company.data'); // equivalent and preferable to above syntax\nCompany.Widget = function() { ... }\nCompany.data.CustomStore = function(config) { ... }\n</code></pre>\n         * @param {String} namespace1\n         * @param {String} namespace2\n         * @param {String} etc\n         * @return {Object} The namespace object. (If multiple arguments are passed, this will be the last namespace created)\n         * @method namespace\n         */\n        namespace : function(){\n            var len1 = arguments.length,\n                i = 0,\n                len2,\n                j,\n                main,\n                ns,\n                sub,\n                current;\n\n            for(; i < len1; ++i) {\n                main = arguments[i];\n                ns = arguments[i].split('.');\n                current = window[ns[0]];\n                if (current === undefined) {\n                    current = window[ns[0]] = {};\n                }\n                sub = ns.slice(1);\n                len2 = sub.length;\n                for(j = 0; j < len2; ++j) {\n                    current = current[sub[j]] = current[sub[j]] || {};\n                }\n            }\n            return current;\n        },\n\n        /**\n         * Takes an object and converts it to an encoded URL. e.g. Ext.urlEncode({foo: 1, bar: 2}); would return \"foo=1&bar=2\".  Optionally, property values can be arrays, instead of keys and the resulting string that's returned will contain a name/value pair for each array value.\n         * @param {Object} o\n         * @param {String} pre (optional) A prefix to add to the url encoded string\n         * @return {String}\n         */\n        urlEncode : function(o, pre){\n            var empty,\n                buf = [],\n                e = encodeURIComponent;\n\n            Ext.iterate(o, function(key, item){\n                empty = Ext.isEmpty(item);\n                Ext.each(empty ? key : item, function(val){\n                    buf.push('&', e(key), '=', (!Ext.isEmpty(val) && (val != key || !empty)) ? (Ext.isDate(val) ? Ext.encode(val).replace(/\"/g, '') : e(val)) : '');\n                });\n            });\n            if(!pre){\n                buf.shift();\n                pre = '';\n            }\n            return pre + buf.join('');\n        },\n\n        /**\n         * Takes an encoded URL and and converts it to an object. Example: <pre><code>\nExt.urlDecode(\"foo=1&bar=2\"); // returns {foo: \"1\", bar: \"2\"}\nExt.urlDecode(\"foo=1&bar=2&bar=3&bar=4\", false); // returns {foo: \"1\", bar: [\"2\", \"3\", \"4\"]}\n</code></pre>\n         * @param {String} string\n         * @param {Boolean} overwrite (optional) Items of the same name will overwrite previous values instead of creating an an array (Defaults to false).\n         * @return {Object} A literal with members\n         */\n        urlDecode : function(string, overwrite){\n            if(Ext.isEmpty(string)){\n                return {};\n            }\n            var obj = {},\n                pairs = string.split('&'),\n                d = decodeURIComponent,\n                name,\n                value;\n            Ext.each(pairs, function(pair) {\n                pair = pair.split('=');\n                name = d(pair[0]);\n                value = d(pair[1]);\n                obj[name] = overwrite || !obj[name] ? value :\n                            [].concat(obj[name]).concat(value);\n            });\n            return obj;\n        },\n\n        /**\n         * Appends content to the query string of a URL, handling logic for whether to place\n         * a question mark or ampersand.\n         * @param {String} url The URL to append to.\n         * @param {String} s The content to append to the URL.\n         * @return (String) The resulting URL\n         */\n        urlAppend : function(url, s){\n            if(!Ext.isEmpty(s)){\n                return url + (url.indexOf('?') === -1 ? '?' : '&') + s;\n            }\n            return url;\n        },\n\n        /**\n         * Converts any iterable (numeric indices and a length property) into a true array\n         * Don't use this on strings. IE doesn't support \"abc\"[0] which this implementation depends on.\n         * For strings, use this instead: \"abc\".match(/./g) => [a,b,c];\n         * @param {Iterable} the iterable object to be turned into a true Array.\n         * @return (Array) array\n         */\n         toArray : function(){\n             return isIE ?\n                 function(a, i, j, res){\n                     res = [];\n                     for(var x = 0, len = a.length; x < len; x++) {\n                         res.push(a[x]);\n                     }\n                     return res.slice(i || 0, j || res.length);\n                 } :\n                 function(a, i, j){\n                     return Array.prototype.slice.call(a, i || 0, j || a.length);\n                 };\n         }(),\n\n        isIterable : function(v){\n            //check for array or arguments\n            if(Ext.isArray(v) || v.callee){\n                return true;\n            }\n            //check for node list type\n            if(/NodeList|HTMLCollection/.test(toString.call(v))){\n                return true;\n            }\n            //NodeList has an item and length property\n            //IXMLDOMNodeList has nextNode method, needs to be checked first.\n            return ((typeof v.nextNode != 'undefined' || v.item) && Ext.isNumber(v.length));\n        },\n\n        /**\n         * Iterates an array calling the supplied function.\n         * @param {Array/NodeList/Mixed} array The array to be iterated. If this\n         * argument is not really an array, the supplied function is called once.\n         * @param {Function} fn The function to be called with each item. If the\n         * supplied function returns false, iteration stops and this method returns\n         * the current <code>index</code>. This function is called with\n         * the following arguments:\n         * <div class=\"mdetail-params\"><ul>\n         * <li><code>item</code> : <i>Mixed</i>\n         * <div class=\"sub-desc\">The item at the current <code>index</code>\n         * in the passed <code>array</code></div></li>\n         * <li><code>index</code> : <i>Number</i>\n         * <div class=\"sub-desc\">The current index within the array</div></li>\n         * <li><code>allItems</code> : <i>Array</i>\n         * <div class=\"sub-desc\">The <code>array</code> passed as the first\n         * argument to <code>Ext.each</code>.</div></li>\n         * </ul></div>\n         * @param {Object} scope The scope (<code>this</code> reference) in which the specified function is executed.\n         * Defaults to the <code>item</code> at the current <code>index</code>\n         * within the passed <code>array</code>.\n         * @return See description for the fn parameter.\n         */\n        each : function(array, fn, scope){\n            if(Ext.isEmpty(array, true)){\n                return;\n            }\n            if(!Ext.isIterable(array) || Ext.isPrimitive(array)){\n                array = [array];\n            }\n            for(var i = 0, len = array.length; i < len; i++){\n                if(fn.call(scope || array[i], array[i], i, array) === false){\n                    return i;\n                };\n            }\n        },\n\n        /**\n         * Iterates either the elements in an array, or each of the properties in an object.\n         * <b>Note</b>: If you are only iterating arrays, it is better to call {@link #each}.\n         * @param {Object/Array} object The object or array to be iterated\n         * @param {Function} fn The function to be called for each iteration.\n         * The iteration will stop if the supplied function returns false, or\n         * all array elements / object properties have been covered. The signature\n         * varies depending on the type of object being interated:\n         * <div class=\"mdetail-params\"><ul>\n         * <li>Arrays : <tt>(Object item, Number index, Array allItems)</tt>\n         * <div class=\"sub-desc\">\n         * When iterating an array, the supplied function is called with each item.</div></li>\n         * <li>Objects : <tt>(String key, Object value, Object)</tt>\n         * <div class=\"sub-desc\">\n         * When iterating an object, the supplied function is called with each key-value pair in\n         * the object, and the iterated object</div></li>\n         * </ul></div>\n         * @param {Object} scope The scope (<code>this</code> reference) in which the specified function is executed. Defaults to\n         * the <code>object</code> being iterated.\n         */\n        iterate : function(obj, fn, scope){\n            if(Ext.isEmpty(obj)){\n                return;\n            }\n            if(Ext.isIterable(obj)){\n                Ext.each(obj, fn, scope);\n                return;\n            }else if(typeof obj == 'object'){\n                for(var prop in obj){\n                    if(obj.hasOwnProperty(prop)){\n                        if(fn.call(scope || obj, prop, obj[prop], obj) === false){\n                            return;\n                        };\n                    }\n                }\n            }\n        },\n\n        /**\n         * Return the dom node for the passed String (id), dom node, or Ext.Element.\n         * Optional 'strict' flag is needed for IE since it can return 'name' and\n         * 'id' elements by using getElementById.\n         * Here are some examples:\n         * <pre><code>\n// gets dom node based on id\nvar elDom = Ext.getDom('elId');\n// gets dom node based on the dom node\nvar elDom1 = Ext.getDom(elDom);\n\n// If we don&#39;t know if we are working with an\n// Ext.Element or a dom node use Ext.getDom\nfunction(el){\n    var dom = Ext.getDom(el);\n    // do something with the dom node\n}\n         * </code></pre>\n         * <b>Note</b>: the dom node to be found actually needs to exist (be rendered, etc)\n         * when this method is called to be successful.\n         * @param {Mixed} el\n         * @return HTMLElement\n         */\n        getDom : function(el, strict){\n            if(!el || !DOC){\n                return null;\n            }\n            if (el.dom){\n                return el.dom;\n            } else {\n                if (typeof el == 'string') {\n                    var e = DOC.getElementById(el);\n                    // IE returns elements with the 'name' and 'id' attribute.\n                    // we do a strict check to return the element with only the id attribute\n                    if (e && isIE && strict) {\n                        if (el == e.getAttribute('id')) {\n                            return e;\n                        } else {\n                            return null;\n                        }\n                    }\n                    return e;\n                } else {\n                    return el;\n                }\n            }\n        },\n\n        /**\n         * Returns the current document body as an {@link Ext.Element}.\n         * @return Ext.Element The document body\n         */\n        getBody : function(){\n            return Ext.get(DOC.body || DOC.documentElement);\n        },\n\n        /**\n         * Returns the current document body as an {@link Ext.Element}.\n         * @return Ext.Element The document body\n         * @method\n         */\n        getHead : function() {\n            var head;\n\n            return function() {\n                if (head == undefined) {\n                    head = Ext.get(DOC.getElementsByTagName(\"head\")[0]);\n                }\n\n                return head;\n            };\n        }(),\n\n        /**\n         * <p>Removes this element from the document, removes all DOM event listeners, and deletes the cache reference.\n         * All DOM event listeners are removed from this element. If {@link Ext#enableNestedListenerRemoval} is\n         * <code>true</code>, then DOM event listeners are also removed from all child nodes. The body node\n         * will be ignored if passed in.</p>\n         * @param {HTMLElement} node The node to remove\n         * @method\n         */\n        removeNode : isIE && !isIE8 ? function(){\n            var d;\n            return function(n){\n                if(n && n.tagName != 'BODY'){\n                    (Ext.enableNestedListenerRemoval) ? Ext.EventManager.purgeElement(n, true) : Ext.EventManager.removeAll(n);\n                    d = d || DOC.createElement('div');\n                    d.appendChild(n);\n                    d.innerHTML = '';\n                    delete Ext.elCache[n.id];\n                }\n            };\n        }() : function(n){\n            if(n && n.parentNode && n.tagName != 'BODY'){\n                (Ext.enableNestedListenerRemoval) ? Ext.EventManager.purgeElement(n, true) : Ext.EventManager.removeAll(n);\n                n.parentNode.removeChild(n);\n                delete Ext.elCache[n.id];\n            }\n        },\n\n        /**\n         * <p>Returns true if the passed value is empty.</p>\n         * <p>The value is deemed to be empty if it is<div class=\"mdetail-params\"><ul>\n         * <li>null</li>\n         * <li>undefined</li>\n         * <li>an empty array</li>\n         * <li>a zero length string (Unless the <tt>allowBlank</tt> parameter is <tt>true</tt>)</li>\n         * </ul></div>\n         * @param {Mixed} value The value to test\n         * @param {Boolean} allowBlank (optional) true to allow empty strings (defaults to false)\n         * @return {Boolean}\n         */\n        isEmpty : function(v, allowBlank){\n            return v === null || v === undefined || ((Ext.isArray(v) && !v.length)) || (!allowBlank ? v === '' : false);\n        },\n\n        /**\n         * Returns true if the passed value is a JavaScript array, otherwise false.\n         * @param {Mixed} value The value to test\n         * @return {Boolean}\n         */\n        isArray : function(v){\n            return toString.apply(v) === '[object Array]';\n        },\n\n        /**\n         * Returns true if the passed object is a JavaScript date object, otherwise false.\n         * @param {Object} object The object to test\n         * @return {Boolean}\n         */\n        isDate : function(v){\n            return toString.apply(v) === '[object Date]';\n        },\n\n        /**\n         * Returns true if the passed value is a JavaScript Object, otherwise false.\n         * @param {Mixed} value The value to test\n         * @return {Boolean}\n         */\n        isObject : function(v){\n            return !!v && Object.prototype.toString.call(v) === '[object Object]';\n        },\n\n        /**\n         * Returns true if the passed value is a JavaScript 'primitive', a string, number or boolean.\n         * @param {Mixed} value The value to test\n         * @return {Boolean}\n         */\n        isPrimitive : function(v){\n            return Ext.isString(v) || Ext.isNumber(v) || Ext.isBoolean(v);\n        },\n\n        /**\n         * Returns true if the passed value is a JavaScript Function, otherwise false.\n         * @param {Mixed} value The value to test\n         * @return {Boolean}\n         */\n        isFunction : function(v){\n            return toString.apply(v) === '[object Function]';\n        },\n\n        /**\n         * Returns true if the passed value is a number. Returns false for non-finite numbers.\n         * @param {Mixed} value The value to test\n         * @return {Boolean}\n         */\n        isNumber : function(v){\n            return typeof v === 'number' && isFinite(v);\n        },\n\n        /**\n         * Returns true if the passed value is a string.\n         * @param {Mixed} value The value to test\n         * @return {Boolean}\n         */\n        isString : function(v){\n            return typeof v === 'string';\n        },\n\n        /**\n         * Returns true if the passed value is a boolean.\n         * @param {Mixed} value The value to test\n         * @return {Boolean}\n         */\n        isBoolean : function(v){\n            return typeof v === 'boolean';\n        },\n\n        /**\n         * Returns true if the passed value is an HTMLElement\n         * @param {Mixed} value The value to test\n         * @return {Boolean}\n         */\n        isElement : function(v) {\n            return v ? !!v.tagName : false;\n        },\n\n        /**\n         * Returns true if the passed value is not undefined.\n         * @param {Mixed} value The value to test\n         * @return {Boolean}\n         */\n        isDefined : function(v){\n            return typeof v !== 'undefined';\n        },\n\n        /**\n         * True if the detected browser is Opera.\n         * @type Boolean\n         */\n        isOpera : isOpera,\n        /**\n         * True if the detected browser uses WebKit.\n         * @type Boolean\n         */\n        isWebKit : isWebKit,\n        /**\n         * True if the detected browser is Chrome.\n         * @type Boolean\n         */\n        isChrome : isChrome,\n        /**\n         * True if the detected browser is Safari.\n         * @type Boolean\n         */\n        isSafari : isSafari,\n        /**\n         * True if the detected browser is Safari 3.x.\n         * @type Boolean\n         */\n        isSafari3 : isSafari3,\n        /**\n         * True if the detected browser is Safari 4.x.\n         * @type Boolean\n         */\n        isSafari4 : isSafari4,\n        /**\n         * True if the detected browser is Safari 2.x.\n         * @type Boolean\n         */\n        isSafari2 : isSafari2,\n        /**\n         * True if the detected browser is Internet Explorer.\n         * @type Boolean\n         */\n        isIE : isIE,\n        /**\n         * True if the detected browser is Internet Explorer 6.x.\n         * @type Boolean\n         */\n        isIE6 : isIE6,\n        /**\n         * True if the detected browser is Internet Explorer 7.x.\n         * @type Boolean\n         */\n        isIE7 : isIE7,\n        /**\n         * True if the detected browser is Internet Explorer 8.x.\n         * @type Boolean\n         */\n        isIE8 : isIE8,\n        /**\n         * True if the detected browser is Internet Explorer 9.x.\n         * @type Boolean\n         */\n        isIE9 : isIE9,\n        \n        /**\n         * True if the detected browser is Internet Explorer 10.x\n         * @type Boolean\n         */\n        isIE10 : isIE10,\n        \n        /**\n         * True if the detected browser is Internet Explorer 9.x or lower\n         * @type Boolean\n         */\n        isIE9m : isIE9m,\n        \n        /**\n         * True if the detected browser is Internet Explorer 10.x or higher\n         * @type Boolean\n         */ \n        isIE10p : isIE && !(isIE6 || isIE7 || isIE8 || isIE9),\n        \n        // IE10 quirks behaves like Gecko/WebKit quirks, so don't include it here\n        // Used internally\n        isIEQuirks: isIE && (!isStrict && (isIE6 || isIE7 || isIE8 || isIE9)),\n                \n        /**\n         * True if the detected browser uses the Gecko layout engine (e.g. Mozilla, Firefox).\n         * @type Boolean\n         */\n        isGecko : isGecko,\n        /**\n         * True if the detected browser uses a pre-Gecko 1.9 layout engine (e.g. Firefox 2.x).\n         * @type Boolean\n         */\n        isGecko2 : isGecko2,\n        /**\n         * True if the detected browser uses a Gecko 1.9+ layout engine (e.g. Firefox 3.x).\n         * @type Boolean\n         */\n        isGecko3 : isGecko3,\n        /**\n         * True if the detected browser is Internet Explorer running in non-strict mode.\n         * @type Boolean\n         */\n        isBorderBox : isBorderBox,\n        /**\n         * True if the detected platform is Linux.\n         * @type Boolean\n         */\n        isLinux : isLinux,\n        /**\n         * True if the detected platform is Windows.\n         * @type Boolean\n         */\n        isWindows : isWindows,\n        /**\n         * True if the detected platform is Mac OS.\n         * @type Boolean\n         */\n        isMac : isMac,\n        /**\n         * True if the detected platform is Adobe Air.\n         * @type Boolean\n         */\n        isAir : isAir\n    });\n\n    /**\n     * Creates namespaces to be used for scoping variables and classes so that they are not global.\n     * Specifying the last node of a namespace implicitly creates all other nodes. Usage:\n     * <pre><code>\nExt.namespace('Company', 'Company.data');\nExt.namespace('Company.data'); // equivalent and preferable to above syntax\nCompany.Widget = function() { ... }\nCompany.data.CustomStore = function(config) { ... }\n</code></pre>\n     * @param {String} namespace1\n     * @param {String} namespace2\n     * @param {String} etc\n     * @return {Object} The namespace object. (If multiple arguments are passed, this will be the last namespace created)\n     * @method ns\n     */\n    Ext.ns = Ext.namespace;\n})();\n\nExt.ns('Ext.util', 'Ext.lib', 'Ext.data', 'Ext.supports');\n\nExt.elCache = {};\n\n/**\n * @class Function\n * These functions are available on every Function object (any JavaScript function).\n */\nExt.apply(Function.prototype, {\n     /**\n     * Creates an interceptor function. The passed function is called before the original one. If it returns false,\n     * the original one is not called. The resulting function returns the results of the original function.\n     * The passed function is called with the parameters of the original function. Example usage:\n     * <pre><code>\nvar sayHi = function(name){\n    alert('Hi, ' + name);\n}\n\nsayHi('Fred'); // alerts \"Hi, Fred\"\n\n// create a new function that validates input without\n// directly modifying the original function:\nvar sayHiToFriend = sayHi.createInterceptor(function(name){\n    return name == 'Brian';\n});\n\nsayHiToFriend('Fred');  // no alert\nsayHiToFriend('Brian'); // alerts \"Hi, Brian\"\n</code></pre>\n     * @param {Function} fcn The function to call before the original\n     * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the passed function is executed.\n     * <b>If omitted, defaults to the scope in which the original function is called or the browser window.</b>\n     * @return {Function} The new function\n     */\n    createInterceptor : function(fcn, scope){\n        var method = this;\n        return !Ext.isFunction(fcn) ?\n                this :\n                function() {\n                    var me = this,\n                        args = arguments;\n                    fcn.target = me;\n                    fcn.method = method;\n                    return (fcn.apply(scope || me || window, args) !== false) ?\n                            method.apply(me || window, args) :\n                            null;\n                };\n    },\n\n     /**\n     * Creates a callback that passes arguments[0], arguments[1], arguments[2], ...\n     * Call directly on any function. Example: <code>myFunction.createCallback(arg1, arg2)</code>\n     * Will create a function that is bound to those 2 args. <b>If a specific scope is required in the\n     * callback, use {@link #createDelegate} instead.</b> The function returned by createCallback always\n     * executes in the window scope.\n     * <p>This method is required when you want to pass arguments to a callback function.  If no arguments\n     * are needed, you can simply pass a reference to the function as a callback (e.g., callback: myFn).\n     * However, if you tried to pass a function with arguments (e.g., callback: myFn(arg1, arg2)) the function\n     * would simply execute immediately when the code is parsed. Example usage:\n     * <pre><code>\nvar sayHi = function(name){\n    alert('Hi, ' + name);\n}\n\n// clicking the button alerts \"Hi, Fred\"\nnew Ext.Button({\n    text: 'Say Hi',\n    renderTo: Ext.getBody(),\n    handler: sayHi.createCallback('Fred')\n});\n</code></pre>\n     * @return {Function} The new function\n    */\n    createCallback : function(/*args...*/){\n        // make args available, in function below\n        var args = arguments,\n            method = this;\n        return function() {\n            return method.apply(window, args);\n        };\n    },\n\n    /**\n     * Creates a delegate (callback) that sets the scope to obj.\n     * Call directly on any function. Example: <code>this.myFunction.createDelegate(this, [arg1, arg2])</code>\n     * Will create a function that is automatically scoped to obj so that the <tt>this</tt> variable inside the\n     * callback points to obj. Example usage:\n     * <pre><code>\nvar sayHi = function(name){\n    // Note this use of \"this.text\" here.  This function expects to\n    // execute within a scope that contains a text property.  In this\n    // example, the \"this\" variable is pointing to the btn object that\n    // was passed in createDelegate below.\n    alert('Hi, ' + name + '. You clicked the \"' + this.text + '\" button.');\n}\n\nvar btn = new Ext.Button({\n    text: 'Say Hi',\n    renderTo: Ext.getBody()\n});\n\n// This callback will execute in the scope of the\n// button instance. Clicking the button alerts\n// \"Hi, Fred. You clicked the \"Say Hi\" button.\"\nbtn.on('click', sayHi.createDelegate(btn, ['Fred']));\n</code></pre>\n     * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the function is executed.\n     * <b>If omitted, defaults to the browser window.</b>\n     * @param {Array} args (optional) Overrides arguments for the call. (Defaults to the arguments passed by the caller)\n     * @param {Boolean/Number} appendArgs (optional) if True args are appended to call args instead of overriding,\n     * if a number the args are inserted at the specified position\n     * @return {Function} The new function\n     */\n    createDelegate : function(obj, args, appendArgs){\n        var method = this;\n        return function() {\n            var callArgs = args || arguments;\n            if (appendArgs === true){\n                callArgs = Array.prototype.slice.call(arguments, 0);\n                callArgs = callArgs.concat(args);\n            }else if (Ext.isNumber(appendArgs)){\n                callArgs = Array.prototype.slice.call(arguments, 0); // copy arguments first\n                var applyArgs = [appendArgs, 0].concat(args); // create method call params\n                Array.prototype.splice.apply(callArgs, applyArgs); // splice them in\n            }\n            return method.apply(obj || window, callArgs);\n        };\n    },\n\n    /**\n     * Calls this function after the number of millseconds specified, optionally in a specific scope. Example usage:\n     * <pre><code>\nvar sayHi = function(name){\n    alert('Hi, ' + name);\n}\n\n// executes immediately:\nsayHi('Fred');\n\n// executes after 2 seconds:\nsayHi.defer(2000, this, ['Fred']);\n\n// this syntax is sometimes useful for deferring\n// execution of an anonymous function:\n(function(){\n    alert('Anonymous');\n}).defer(100);\n</code></pre>\n     * @param {Number} millis The number of milliseconds for the setTimeout call (if less than or equal to 0 the function is executed immediately)\n     * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the function is executed.\n     * <b>If omitted, defaults to the browser window.</b>\n     * @param {Array} args (optional) Overrides arguments for the call. (Defaults to the arguments passed by the caller)\n     * @param {Boolean/Number} appendArgs (optional) if True args are appended to call args instead of overriding,\n     * if a number the args are inserted at the specified position\n     * @return {Number} The timeout id that can be used with clearTimeout\n     */\n    defer : function(millis, obj, args, appendArgs){\n        var fn = this.createDelegate(obj, args, appendArgs);\n        if(millis > 0){\n            return setTimeout(fn, millis);\n        }\n        fn();\n        return 0;\n    }\n});\n\n/**\n * @class String\n * These functions are available on every String object.\n */\nExt.applyIf(String, {\n    /**\n     * Allows you to define a tokenized string and pass an arbitrary number of arguments to replace the tokens.  Each\n     * token must be unique, and must increment in the format {0}, {1}, etc.  Example usage:\n     * <pre><code>\nvar cls = 'my-class', text = 'Some text';\nvar s = String.format('&lt;div class=\"{0}\">{1}&lt;/div>', cls, text);\n// s now contains the string: '&lt;div class=\"my-class\">Some text&lt;/div>'\n     * </code></pre>\n     * @param {String} string The tokenized string to be formatted\n     * @param {String} value1 The value to replace token {0}\n     * @param {String} value2 Etc...\n     * @return {String} The formatted string\n     * @static\n     */\n    format : function(format){\n        var args = Ext.toArray(arguments, 1);\n        return format.replace(/\\{(\\d+)\\}/g, function(m, i){\n            return args[i];\n        });\n    }\n});\n\n/**\n * @class Array\n */\nExt.applyIf(Array.prototype, {\n    /**\n     * Checks whether or not the specified object exists in the array.\n     * @param {Object} o The object to check for\n     * @param {Number} from (Optional) The index at which to begin the search\n     * @return {Number} The index of o in the array (or -1 if it is not found)\n     */\n    indexOf : function(o, from){\n        var len = this.length;\n        from = from || 0;\n        from += (from < 0) ? len : 0;\n        for (; from < len; ++from){\n            if(this[from] === o){\n                return from;\n            }\n        }\n        return -1;\n    },\n\n    /**\n     * Removes the specified object from the array.  If the object is not found nothing happens.\n     * @param {Object} o The object to remove\n     * @return {Array} this array\n     */\n    remove : function(o){\n        var index = this.indexOf(o);\n        if(index != -1){\n            this.splice(index, 1);\n        }\n        return this;\n    }\n});\n/**\n * @class Ext.util.TaskRunner\n * Provides the ability to execute one or more arbitrary tasks in a multithreaded\n * manner.  Generally, you can use the singleton {@link Ext.TaskMgr} instead, but\n * if needed, you can create separate instances of TaskRunner.  Any number of\n * separate tasks can be started at any time and will run independently of each\n * other. Example usage:\n * <pre><code>\n// Start a simple clock task that updates a div once per second\nvar updateClock = function(){\n    Ext.fly('clock').update(new Date().format('g:i:s A'));\n} \nvar task = {\n    run: updateClock,\n    interval: 1000 //1 second\n}\nvar runner = new Ext.util.TaskRunner();\nrunner.start(task);\n\n// equivalent using TaskMgr\nExt.TaskMgr.start({\n    run: updateClock,\n    interval: 1000\n});\n\n * </code></pre>\n * <p>See the {@link #start} method for details about how to configure a task object.</p>\n * Also see {@link Ext.util.DelayedTask}. \n * \n * @constructor\n * @param {Number} interval (optional) The minimum precision in milliseconds supported by this TaskRunner instance\n * (defaults to 10)\n */\nExt.util.TaskRunner = function(interval){\n    interval = interval || 10;\n    var tasks = [], \n    \tremoveQueue = [],\n    \tid = 0,\n    \trunning = false,\n\n    \t// private\n    \tstopThread = function(){\n\t        running = false;\n\t        clearInterval(id);\n\t        id = 0;\n\t    },\n\n    \t// private\n    \tstartThread = function(){\n\t        if(!running){\n\t            running = true;\n\t            id = setInterval(runTasks, interval);\n\t        }\n\t    },\n\n    \t// private\n    \tremoveTask = function(t){\n\t        removeQueue.push(t);\n\t        if(t.onStop){\n\t            t.onStop.apply(t.scope || t);\n\t        }\n\t    },\n\t    \n    \t// private\n    \trunTasks = function(){\n\t    \tvar rqLen = removeQueue.length,\n\t    \t\tnow = new Date().getTime();\t    \t\t\t    \t\t\n\t    \n\t        if(rqLen > 0){\n\t            for(var i = 0; i < rqLen; i++){\n\t                tasks.remove(removeQueue[i]);\n\t            }\n\t            removeQueue = [];\n\t            if(tasks.length < 1){\n\t                stopThread();\n\t                return;\n\t            }\n\t        }\t        \n\t        for(var i = 0, t, itime, rt, len = tasks.length; i < len; ++i){\n\t            t = tasks[i];\n\t            itime = now - t.taskRunTime;\n\t            if(t.interval <= itime){\n\t                rt = t.run.apply(t.scope || t, t.args || [++t.taskRunCount]);\n\t                t.taskRunTime = now;\n\t                if(rt === false || t.taskRunCount === t.repeat){\n\t                    removeTask(t);\n\t                    return;\n\t                }\n\t            }\n\t            if(t.duration && t.duration <= (now - t.taskStartTime)){\n\t                removeTask(t);\n\t            }\n\t        }\n\t    };\n\n    /**\n     * Starts a new task.\n     * @method start\n     * @param {Object} task <p>A config object that supports the following properties:<ul>\n     * <li><code>run</code> : Function<div class=\"sub-desc\"><p>The function to execute each time the task is invoked. The\n     * function will be called at each interval and passed the <code>args</code> argument if specified, and the\n     * current invocation count if not.</p>\n     * <p>If a particular scope (<code>this</code> reference) is required, be sure to specify it using the <code>scope</code> argument.</p>\n     * <p>Return <code>false</code> from this function to terminate the task.</p></div></li>\n     * <li><code>interval</code> : Number<div class=\"sub-desc\">The frequency in milliseconds with which the task\n     * should be invoked.</div></li>\n     * <li><code>args</code> : Array<div class=\"sub-desc\">(optional) An array of arguments to be passed to the function\n     * specified by <code>run</code>. If not specified, the current invocation count is passed.</div></li>\n     * <li><code>scope</code> : Object<div class=\"sub-desc\">(optional) The scope (<tt>this</tt> reference) in which to execute the\n     * <code>run</code> function. Defaults to the task config object.</div></li>\n     * <li><code>duration</code> : Number<div class=\"sub-desc\">(optional) The length of time in milliseconds to invoke\n     * the task before stopping automatically (defaults to indefinite).</div></li>\n     * <li><code>repeat</code> : Number<div class=\"sub-desc\">(optional) The number of times to invoke the task before\n     * stopping automatically (defaults to indefinite).</div></li>\n     * </ul></p>\n     * <p>Before each invocation, Ext injects the property <code>taskRunCount</code> into the task object so\n     * that calculations based on the repeat count can be performed.</p>\n     * @return {Object} The task\n     */\n    this.start = function(task){\n        tasks.push(task);\n        task.taskStartTime = new Date().getTime();\n        task.taskRunTime = 0;\n        task.taskRunCount = 0;\n        startThread();\n        return task;\n    };\n\n    /**\n     * Stops an existing running task.\n     * @method stop\n     * @param {Object} task The task to stop\n     * @return {Object} The task\n     */\n    this.stop = function(task){\n        removeTask(task);\n        return task;\n    };\n\n    /**\n     * Stops all tasks that are currently running.\n     * @method stopAll\n     */\n    this.stopAll = function(){\n        stopThread();\n        for(var i = 0, len = tasks.length; i < len; i++){\n            if(tasks[i].onStop){\n                tasks[i].onStop();\n            }\n        }\n        tasks = [];\n        removeQueue = [];\n    };\n};\n\n/**\n * @class Ext.TaskMgr\n * @extends Ext.util.TaskRunner\n * A static {@link Ext.util.TaskRunner} instance that can be used to start and stop arbitrary tasks.  See\n * {@link Ext.util.TaskRunner} for supported methods and task config properties.\n * <pre><code>\n// Start a simple clock task that updates a div once per second\nvar task = {\n    run: function(){\n        Ext.fly('clock').update(new Date().format('g:i:s A'));\n    },\n    interval: 1000 //1 second\n}\nExt.TaskMgr.start(task);\n</code></pre>\n * <p>See the {@link #start} method for details about how to configure a task object.</p>\n * @singleton\n */\nExt.TaskMgr = new Ext.util.TaskRunner();(function(){\n\tvar libFlyweight;\n\t\n\tfunction fly(el) {\n        if (!libFlyweight) {\n            libFlyweight = new Ext.Element.Flyweight();\n        }\n        libFlyweight.dom = el;\n        return libFlyweight;\n    }\n    \n    (function(){\n\tvar doc = document,\n\t\tisCSS1 = doc.compatMode == \"CSS1Compat\",\n\t\tMAX = Math.max,\t\t\n        ROUND = Math.round,\n\t\tPARSEINT = parseInt;\n\t\t\n\tExt.lib.Dom = {\n\t    isAncestor : function(p, c) {\n\t\t    var ret = false;\n\t\t\t\n\t\t\tp = Ext.getDom(p);\n\t\t\tc = Ext.getDom(c);\n\t\t\tif (p && c) {\n\t\t\t\tif (p.contains) {\n\t\t\t\t\treturn p.contains(c);\n\t\t\t\t} else if (p.compareDocumentPosition) {\n\t\t\t\t\treturn !!(p.compareDocumentPosition(c) & 16);\n\t\t\t\t} else {\n\t\t\t\t\twhile (c = c.parentNode) {\n\t\t\t\t\t\tret = c == p || ret;\t        \t\t\t\n\t\t\t\t\t}\n\t\t\t\t}\t            \n\t\t\t}\t\n\t\t\treturn ret;\n\t\t},\n\t\t\n        getViewWidth : function(full) {\n            return full ? this.getDocumentWidth() : this.getViewportWidth();\n        },\n\n        getViewHeight : function(full) {\n            return full ? this.getDocumentHeight() : this.getViewportHeight();\n        },\n\n        getDocumentHeight: function() {            \n            return MAX(!isCSS1 ? doc.body.scrollHeight : doc.documentElement.scrollHeight, this.getViewportHeight());\n        },\n\n        getDocumentWidth: function() {            \n            return MAX(!isCSS1 ? doc.body.scrollWidth : doc.documentElement.scrollWidth, this.getViewportWidth());\n        },\n\n        getViewportHeight: function(){\n\t        return Ext.isIE9m ? \n\t        \t   (Ext.isStrict ? doc.documentElement.clientHeight : doc.body.clientHeight) :\n\t        \t   self.innerHeight;\n        },\n\n        getViewportWidth : function() {\n\t        return !Ext.isStrict && !Ext.isOpera ? doc.body.clientWidth :\n\t        \t   Ext.isIE9m ? doc.documentElement.clientWidth : self.innerWidth;\n        },\n        \n        getY : function(el) {\n            return this.getXY(el)[1];\n        },\n\n        getX : function(el) {\n            return this.getXY(el)[0];\n        },\n\n        getXY : function(el) {\n            var p, \n            \tpe, \n            \tb,\n            \tbt, \n            \tbl,     \n            \tdbd,       \t\n            \tx = 0,\n            \ty = 0, \n            \tscroll,\n            \thasAbsolute, \n            \tbd = (doc.body || doc.documentElement),\n            \tret = [0,0];\n            \t\n            el = Ext.getDom(el);\n\n            if(el != bd){\n\t            if (el.getBoundingClientRect) {\n\t                b = el.getBoundingClientRect();\n\t                scroll = fly(document).getScroll();\n\t                ret = [ROUND(b.left + scroll.left), ROUND(b.top + scroll.top)];\n\t            } else {  \n\t\t            p = el;\t\t\n\t\t            hasAbsolute = fly(el).isStyle(\"position\", \"absolute\");\n\t\t\n\t\t            while (p) {\n\t\t\t            pe = fly(p);\t\t\n\t\t                x += p.offsetLeft;\n\t\t                y += p.offsetTop;\n\t\t\n\t\t                hasAbsolute = hasAbsolute || pe.isStyle(\"position\", \"absolute\");\n\t\t                \t\t\n\t\t                if (Ext.isGecko) {\t\t                    \n\t\t                    y += bt = PARSEINT(pe.getStyle(\"borderTopWidth\"), 10) || 0;\n\t\t                    x += bl = PARSEINT(pe.getStyle(\"borderLeftWidth\"), 10) || 0;\t\n\t\t\n\t\t                    if (p != el && !pe.isStyle('overflow','visible')) {\n\t\t                        x += bl;\n\t\t                        y += bt;\n\t\t                    }\n\t\t                }\n\t\t                p = p.offsetParent;\n\t\t            }\n\t\t\n\t\t            if (Ext.isSafari && hasAbsolute) {\n\t\t                x -= bd.offsetLeft;\n\t\t                y -= bd.offsetTop;\n\t\t            }\n\t\t\n\t\t            if (Ext.isGecko && !hasAbsolute) {\n\t\t                dbd = fly(bd);\n\t\t                x += PARSEINT(dbd.getStyle(\"borderLeftWidth\"), 10) || 0;\n\t\t                y += PARSEINT(dbd.getStyle(\"borderTopWidth\"), 10) || 0;\n\t\t            }\n\t\t\n\t\t            p = el.parentNode;\n\t\t            while (p && p != bd) {\n\t\t                if (!Ext.isOpera || (p.tagName != 'TR' && !fly(p).isStyle(\"display\", \"inline\"))) {\n\t\t                    x -= p.scrollLeft;\n\t\t                    y -= p.scrollTop;\n\t\t                }\n\t\t                p = p.parentNode;\n\t\t            }\n\t\t            ret = [x,y];\n\t            }\n         \t}\n            return ret;\n        },\n\n        setXY : function(el, xy) {\n            (el = Ext.fly(el, '_setXY')).position();\n            \n            var pts = el.translatePoints(xy),\n            \tstyle = el.dom.style,\n            \tpos;            \t\n            \n            for (pos in pts) {\t            \n\t            if (!isNaN(pts[pos])) {\n\t                style[pos] = pts[pos] + \"px\";\n                }\n            }\n        },\n\n        setX : function(el, x) {\n            this.setXY(el, [x, false]);\n        },\n\n        setY : function(el, y) {\n            this.setXY(el, [false, y]);\n        }\n    };\n})();Ext.lib.Event = function() {\n    var loadComplete = false,\n        unloadListeners = {},\n        retryCount = 0,\n        onAvailStack = [],\n        _interval,\n        locked = false,\n        win = window,\n        doc = document,\n\n        // constants\n        POLL_RETRYS = 200,\n        POLL_INTERVAL = 20,\n        TYPE = 0,\n        FN = 1,\n        OBJ = 2,\n        ADJ_SCOPE = 3,\n        SCROLLLEFT = 'scrollLeft',\n        SCROLLTOP = 'scrollTop',\n        UNLOAD = 'unload',\n        MOUSEOVER = 'mouseover',\n        MOUSEOUT = 'mouseout',\n        // private\n        doAdd = function() {\n            var ret;\n            if (win.addEventListener) {\n                ret = function(el, eventName, fn, capture) {\n                    if (eventName == 'mouseenter') {\n                        fn = fn.createInterceptor(checkRelatedTarget);\n                        el.addEventListener(MOUSEOVER, fn, (capture));\n                    } else if (eventName == 'mouseleave') {\n                        fn = fn.createInterceptor(checkRelatedTarget);\n                        el.addEventListener(MOUSEOUT, fn, (capture));\n                    } else {\n                        el.addEventListener(eventName, fn, (capture));\n                    }\n                    return fn;\n                };\n            } else if (win.attachEvent) {\n                ret = function(el, eventName, fn, capture) {\n                    el.attachEvent(\"on\" + eventName, fn);\n                    return fn;\n                };\n            } else {\n                ret = function(){};\n            }\n            return ret;\n        }(),\n        // private\n        doRemove = function(){\n            var ret;\n            if (win.removeEventListener) {\n                ret = function (el, eventName, fn, capture) {\n                    if (eventName == 'mouseenter') {\n                        eventName = MOUSEOVER;\n                    } else if (eventName == 'mouseleave') {\n                        eventName = MOUSEOUT;\n                    }\n                    el.removeEventListener(eventName, fn, (capture));\n                };\n            } else if (win.detachEvent) {\n                ret = function (el, eventName, fn) {\n                    el.detachEvent(\"on\" + eventName, fn);\n                };\n            } else {\n                ret = function(){};\n            }\n            return ret;\n        }();\n\n    function checkRelatedTarget(e) {\n        return !elContains(e.currentTarget, pub.getRelatedTarget(e));\n    }\n\n    function elContains(parent, child) {\n       if(parent && parent.firstChild){\n         while(child) {\n            if(child === parent) {\n                return true;\n            }\n            child = child.parentNode;\n            if(child && (child.nodeType != 1)) {\n                child = null;\n            }\n          }\n        }\n        return false;\n    }\n\n    // private\n    function _tryPreloadAttach() {\n        var ret = false,\n            notAvail = [],\n            element, i, v, override,\n            tryAgain = !loadComplete || (retryCount > 0);\n\n        if(!locked){\n            locked = true;\n            \n            for(i = 0; i < onAvailStack.length; ++i){\n                v = onAvailStack[i];\n                if(v && (element = doc.getElementById(v.id))){\n                    if(!v.checkReady || loadComplete || element.nextSibling || (doc && doc.body)) {\n                        override = v.override;\n                        element = override ? (override === true ? v.obj : override) : element;\n                        v.fn.call(element, v.obj);\n                        onAvailStack.remove(v);\n                        --i;\n                    }else{\n                        notAvail.push(v);\n                    }\n                }\n            }\n\n            retryCount = (notAvail.length === 0) ? 0 : retryCount - 1;\n\n            if (tryAgain) {\n                startInterval();\n            } else {\n                clearInterval(_interval);\n                _interval = null;\n            }\n            ret = !(locked = false);\n        }\n        return ret;\n    }\n\n    // private\n    function startInterval() {\n        if(!_interval){\n            var callback = function() {\n                _tryPreloadAttach();\n            };\n            _interval = setInterval(callback, POLL_INTERVAL);\n        }\n    }\n\n    // private\n    function getScroll() {\n        var dd = doc.documentElement,\n            db = doc.body;\n        if(dd && (dd[SCROLLTOP] || dd[SCROLLLEFT])){\n            return [dd[SCROLLLEFT], dd[SCROLLTOP]];\n        }else if(db){\n            return [db[SCROLLLEFT], db[SCROLLTOP]];\n        }else{\n            return [0, 0];\n        }\n    }\n\n    // private\n    function getPageCoord (ev, xy) {\n        ev = ev.browserEvent || ev;\n        var coord  = ev['page' + xy];\n        if (!coord && coord !== 0) {\n            coord = ev['client' + xy] || 0;\n\n            if (Ext.isIE) {\n                coord += getScroll()[xy == \"X\" ? 0 : 1];\n            }\n        }\n\n        return coord;\n    }\n\n    var pub =  {\n        extAdapter: true,\n        onAvailable : function(p_id, p_fn, p_obj, p_override) {\n            onAvailStack.push({\n                id:         p_id,\n                fn:         p_fn,\n                obj:        p_obj,\n                override:   p_override,\n                checkReady: false });\n\n            retryCount = POLL_RETRYS;\n            startInterval();\n        },\n\n        // This function should ALWAYS be called from Ext.EventManager\n        addListener: function(el, eventName, fn) {\n            el = Ext.getDom(el);\n            if (el && fn) {\n                if (eventName == UNLOAD) {\n                    if (unloadListeners[el.id] === undefined) {\n                        unloadListeners[el.id] = [];\n                    }\n                    unloadListeners[el.id].push([eventName, fn]);\n                    return fn;\n                }\n                return doAdd(el, eventName, fn, false);\n            }\n            return false;\n        },\n\n        // This function should ALWAYS be called from Ext.EventManager\n        removeListener: function(el, eventName, fn) {\n            el = Ext.getDom(el);\n            var i, len, li, lis;\n            if (el && fn) {\n                if(eventName == UNLOAD){\n                    if((lis = unloadListeners[el.id]) !== undefined){\n                        for(i = 0, len = lis.length; i < len; i++){\n                            if((li = lis[i]) && li[TYPE] == eventName && li[FN] == fn){\n                                unloadListeners[el.id].splice(i, 1);\n                            }\n                        }\n                    }\n                    return;\n                }\n                doRemove(el, eventName, fn, false);\n            }\n        },\n\n        getTarget : function(ev) {\n            ev = ev.browserEvent || ev;\n            return this.resolveTextNode(ev.target || ev.srcElement);\n        },\n\n        resolveTextNode : Ext.isGecko ? function(node){\n            if(!node){\n                return;\n            }\n            // work around firefox bug, https://bugzilla.mozilla.org/show_bug.cgi?id=101197\n            var s = HTMLElement.prototype.toString.call(node);\n            if(s == '[xpconnect wrapped native prototype]' || s == '[object XULElement]'){\n                return;\n            }\n            return node.nodeType == 3 ? node.parentNode : node;\n        } : function(node){\n            return node && node.nodeType == 3 ? node.parentNode : node;\n        },\n\n        getRelatedTarget : function(ev) {\n            ev = ev.browserEvent || ev;\n            return this.resolveTextNode(ev.relatedTarget ||\n                (/(mouseout|mouseleave)/.test(ev.type) ? ev.toElement :\n                 /(mouseover|mouseenter)/.test(ev.type) ? ev.fromElement : null));\n        },\n\n        getPageX : function(ev) {\n            return getPageCoord(ev, \"X\");\n        },\n\n        getPageY : function(ev) {\n            return getPageCoord(ev, \"Y\");\n        },\n\n\n        getXY : function(ev) {\n            return [this.getPageX(ev), this.getPageY(ev)];\n        },\n\n        stopEvent : function(ev) {\n            this.stopPropagation(ev);\n            this.preventDefault(ev);\n        },\n\n        stopPropagation : function(ev) {\n            ev = ev.browserEvent || ev;\n            if (ev.stopPropagation) {\n                ev.stopPropagation();\n            } else {\n                ev.cancelBubble = true;\n            }\n        },\n\n        preventDefault : function(ev) {\n            ev = ev.browserEvent || ev;\n            if (ev.preventDefault) {\n                ev.preventDefault();\n            } else {\n                if (ev.keyCode) {\n                    ev.keyCode = 0;\n                }\n                ev.returnValue = false;\n            }\n        },\n\n        getEvent : function(e) {\n            e = e || win.event;\n            if (!e) {\n                var c = this.getEvent.caller;\n                while (c) {\n                    e = c.arguments[0];\n                    if (e && Event == e.constructor) {\n                        break;\n                    }\n                    c = c.caller;\n                }\n            }\n            return e;\n        },\n\n        getCharCode : function(ev) {\n            ev = ev.browserEvent || ev;\n            return ev.charCode || ev.keyCode || 0;\n        },\n\n        //clearCache: function() {},\n        // deprecated, call from EventManager\n        getListeners : function(el, eventName) {\n            Ext.EventManager.getListeners(el, eventName);\n        },\n\n        // deprecated, call from EventManager\n        purgeElement : function(el, recurse, eventName) {\n            Ext.EventManager.purgeElement(el, recurse, eventName);\n        },\n\n        _load : function(e) {\n            loadComplete = true;\n            \n            if (Ext.isIE9m && e !== true) {\n                // IE8 complains that _load is null or not an object\n                // so lets remove self via arguments.callee\n                doRemove(win, \"load\", arguments.callee);\n            }\n        },\n\n        _unload : function(e) {\n             var EU = Ext.lib.Event,\n                i, v, ul, id, len, scope;\n\n            for (id in unloadListeners) {\n                ul = unloadListeners[id];\n                for (i = 0, len = ul.length; i < len; i++) {\n                    v = ul[i];\n                    if (v) {\n                        try{\n                            scope = v[ADJ_SCOPE] ? (v[ADJ_SCOPE] === true ? v[OBJ] : v[ADJ_SCOPE]) :  win;\n                            v[FN].call(scope, EU.getEvent(e), v[OBJ]);\n                        }catch(ex){}\n                    }\n                }\n            };\n\n            Ext.EventManager._unload();\n\n            doRemove(win, UNLOAD, EU._unload);\n        }\n    };\n\n    // Initialize stuff.\n    pub.on = pub.addListener;\n    pub.un = pub.removeListener;\n    if (doc && doc.body) {\n        pub._load(true);\n    } else {\n        doAdd(win, \"load\", pub._load);\n    }\n    doAdd(win, UNLOAD, pub._unload);\n    _tryPreloadAttach();\n\n    return pub;\n}();\n/*\n* Portions of this file are based on pieces of Yahoo User Interface Library\n* Copyright (c) 2007, Yahoo! Inc. All rights reserved.\n* YUI licensed under the BSD License:\n* http://developer.yahoo.net/yui/license.txt\n*/\nExt.lib.Ajax = function() {\n    var activeX = ['Msxml2.XMLHTTP.3.0',\n                   'Msxml2.XMLHTTP'],\n        CONTENTTYPE = 'Content-Type';\n\n    // private\n    function setHeader(o) {\n        var conn = o.conn,\n            prop,\n            headers = {};\n\n        function setTheHeaders(conn, headers){\n            for (prop in headers) {\n                if (headers.hasOwnProperty(prop)) {\n                    conn.setRequestHeader(prop, headers[prop]);\n                }\n            }\n        }\n\n        Ext.apply(headers, pub.headers, pub.defaultHeaders);\n        setTheHeaders(conn, headers);\n        delete pub.headers;\n    }\n\n    // private\n    function createExceptionObject(tId, callbackArg, isAbort, isTimeout) {\n        return {\n            tId : tId,\n            status : isAbort ? -1 : 0,\n            statusText : isAbort ? 'transaction aborted' : 'communication failure',\n            isAbort: isAbort,\n            isTimeout: isTimeout,\n            argument : callbackArg\n        };\n    }\n\n    // private\n    function initHeader(label, value) {\n        (pub.headers = pub.headers || {})[label] = value;\n    }\n\n    // private\n    function createResponseObject(o, callbackArg) {\n        var headerObj = {},\n            headerStr,\n            conn = o.conn,\n            t,\n            s,\n            // see: https://prototype.lighthouseapp.com/projects/8886/tickets/129-ie-mangles-http-response-status-code-204-to-1223\n            isBrokenStatus = conn.status == 1223;\n\n        try {\n            headerStr = o.conn.getAllResponseHeaders();\n            Ext.each(headerStr.replace(/\\r\\n/g, '\\n').split('\\n'), function(v){\n                t = v.indexOf(':');\n                if(t >= 0){\n                    s = v.substr(0, t).toLowerCase();\n                    if(v.charAt(t + 1) == ' '){\n                        ++t;\n                    }\n                    headerObj[s] = v.substr(t + 1);\n                }\n            });\n        } catch(e) {}\n\n        return {\n            tId : o.tId,\n            // Normalize the status and statusText when IE returns 1223, see the above link.\n            status : isBrokenStatus ? 204 : conn.status,\n            statusText : isBrokenStatus ? 'No Content' : conn.statusText,\n            getResponseHeader : function(header){return headerObj[header.toLowerCase()];},\n            getAllResponseHeaders : function(){return headerStr;},\n            responseText : conn.responseText,\n            responseXML : conn.responseXML,\n            argument : callbackArg\n        };\n    }\n\n    // private\n    function releaseObject(o) {\n        if (o.tId) {\n            pub.conn[o.tId] = null;\n        }\n        o.conn = null;\n        o = null;\n    }\n\n    // private\n    function handleTransactionResponse(o, callback, isAbort, isTimeout) {\n        if (!callback) {\n            releaseObject(o);\n            return;\n        }\n\n        var httpStatus, responseObject;\n\n        try {\n            if (o.conn.status !== undefined && o.conn.status != 0) {\n                httpStatus = o.conn.status;\n            }\n            else {\n                httpStatus = 13030;\n            }\n        }\n        catch(e) {\n            httpStatus = 13030;\n        }\n\n        if ((httpStatus >= 200 && httpStatus < 300) || (Ext.isIE && httpStatus == 1223)) {\n            responseObject = createResponseObject(o, callback.argument);\n            if (callback.success) {\n                if (!callback.scope) {\n                    callback.success(responseObject);\n                }\n                else {\n                    callback.success.apply(callback.scope, [responseObject]);\n                }\n            }\n        }\n        else {\n            switch (httpStatus) {\n                case 12002:\n                case 12029:\n                case 12030:\n                case 12031:\n                case 12152:\n                case 13030:\n                    responseObject = createExceptionObject(o.tId, callback.argument, (isAbort ? isAbort : false), isTimeout);\n                    if (callback.failure) {\n                        if (!callback.scope) {\n                            callback.failure(responseObject);\n                        }\n                        else {\n                            callback.failure.apply(callback.scope, [responseObject]);\n                        }\n                    }\n                    break;\n                default:\n                    responseObject = createResponseObject(o, callback.argument);\n                    if (callback.failure) {\n                        if (!callback.scope) {\n                            callback.failure(responseObject);\n                        }\n                        else {\n                            callback.failure.apply(callback.scope, [responseObject]);\n                        }\n                    }\n            }\n        }\n\n        releaseObject(o);\n        responseObject = null;\n    }\n    \n    function checkResponse(o, callback, conn, tId, poll, cbTimeout){\n        if (conn && conn.readyState == 4) {\n            clearInterval(poll[tId]);\n            poll[tId] = null;\n\n            if (cbTimeout) {\n                clearTimeout(pub.timeout[tId]);\n                pub.timeout[tId] = null;\n            }\n            handleTransactionResponse(o, callback);\n        }\n    }\n    \n    function checkTimeout(o, callback){\n        pub.abort(o, callback, true);\n    }\n    \n\n    // private\n    function handleReadyState(o, callback){\n        callback = callback || {};\n        var conn = o.conn,\n            tId = o.tId,\n            poll = pub.poll,\n            cbTimeout = callback.timeout || null;\n\n        if (cbTimeout) {\n            pub.conn[tId] = conn;\n            pub.timeout[tId] = setTimeout(checkTimeout.createCallback(o, callback), cbTimeout);\n        }\n        poll[tId] = setInterval(checkResponse.createCallback(o, callback, conn, tId, poll, cbTimeout), pub.pollInterval);\n    }\n\n    // private\n    function asyncRequest(method, uri, callback, postData) {\n        var o = getConnectionObject() || null;\n\n        if (o) {\n            o.conn.open(method, uri, true);\n\n            if (pub.useDefaultXhrHeader) {\n                initHeader('X-Requested-With', pub.defaultXhrHeader);\n            }\n\n            if(postData && pub.useDefaultHeader && (!pub.headers || !pub.headers[CONTENTTYPE])){\n                initHeader(CONTENTTYPE, pub.defaultPostHeader);\n            }\n\n            if (pub.defaultHeaders || pub.headers) {\n                setHeader(o);\n            }\n\n            handleReadyState(o, callback);\n            o.conn.send(postData || null);\n        }\n        return o;\n    }\n\n    // private\n    function getConnectionObject() {\n        var o;\n\n        try {\n            if (o = createXhrObject(pub.transactionId)) {\n                pub.transactionId++;\n            }\n        } catch(e) {\n        } finally {\n            return o;\n        }\n    }\n\n    // private\n    function createXhrObject(transactionId) {\n        var http;\n\n        try {\n            http = new XMLHttpRequest();\n        } catch(e) {\n            for (var i = Ext.isIE6 ? 1 : 0; i < activeX.length; ++i) {\n                try {\n                    http = new ActiveXObject(activeX[i]);\n                    break;\n                } catch(e) {}\n            }\n        } finally {\n            return {conn : http, tId : transactionId};\n        }\n    }\n\n    var pub = {\n        request : function(method, uri, cb, data, options) {\n            if(options){\n                var me = this,\n                    xmlData = options.xmlData,\n                    jsonData = options.jsonData,\n                    hs;\n\n                Ext.applyIf(me, options);\n\n                if(xmlData || jsonData){\n                    hs = me.headers;\n                    if(!hs || !hs[CONTENTTYPE]){\n                        initHeader(CONTENTTYPE, xmlData ? 'text/xml' : 'application/json');\n                    }\n                    data = xmlData || (!Ext.isPrimitive(jsonData) ? Ext.encode(jsonData) : jsonData);\n                }\n            }\n            return asyncRequest(method || options.method || \"POST\", uri, cb, data);\n        },\n\n        serializeForm : function(form) {\n            var fElements = form.elements || (document.forms[form] || Ext.getDom(form)).elements, \n                hasSubmit = false, \n                encoder = encodeURIComponent, \n                name, \n                data = '', \n                type, \n                hasValue;\n    \n            Ext.each(fElements, function(element){\n                name = element.name;\n                type = element.type;\n        \n                if (!element.disabled && name) {\n                    if (/select-(one|multiple)/i.test(type)) {\n                        Ext.each(element.options, function(opt){\n                            if (opt.selected) {\n                                hasValue = opt.hasAttribute ? opt.hasAttribute('value') : opt.getAttributeNode('value').specified;\n                                data += String.format(\"{0}={1}&\", encoder(name), encoder(hasValue ? opt.value : opt.text));\n                            }\n                        });\n                    } else if (!(/file|undefined|reset|button/i.test(type))) {\n                        if (!(/radio|checkbox/i.test(type) && !element.checked) && !(type == 'submit' && hasSubmit)) {\n                            data += encoder(name) + '=' + encoder(element.value) + '&';\n                            hasSubmit = /submit/i.test(type);\n                        }\n                    }\n                }\n            });\n            return data.substr(0, data.length - 1);\n        },\n\n        useDefaultHeader : true,\n        defaultPostHeader : 'application/x-www-form-urlencoded; charset=UTF-8',\n        useDefaultXhrHeader : true,\n        defaultXhrHeader : 'XMLHttpRequest',\n        poll : {},\n        timeout : {},\n        conn: {},\n        pollInterval : 50,\n        transactionId : 0,\n\n//  This is never called - Is it worth exposing this?\n//          setProgId : function(id) {\n//              activeX.unshift(id);\n//          },\n\n//  This is never called - Is it worth exposing this?\n//          setDefaultPostHeader : function(b) {\n//              this.useDefaultHeader = b;\n//          },\n\n//  This is never called - Is it worth exposing this?\n//          setDefaultXhrHeader : function(b) {\n//              this.useDefaultXhrHeader = b;\n//          },\n\n//  This is never called - Is it worth exposing this?\n//          setPollingInterval : function(i) {\n//              if (typeof i == 'number' && isFinite(i)) {\n//                  this.pollInterval = i;\n//              }\n//          },\n\n//  This is never called - Is it worth exposing this?\n//          resetDefaultHeaders : function() {\n//              this.defaultHeaders = null;\n//          },\n\n        abort : function(o, callback, isTimeout) {\n            var me = this,\n                tId = o.tId,\n                isAbort = false;\n\n            if (me.isCallInProgress(o)) {\n                o.conn.abort();\n                clearInterval(me.poll[tId]);\n                me.poll[tId] = null;\n                clearTimeout(pub.timeout[tId]);\n                me.timeout[tId] = null;\n\n                handleTransactionResponse(o, callback, (isAbort = true), isTimeout);\n            }\n            return isAbort;\n        },\n\n        isCallInProgress : function(o) {\n            // if there is a connection and readyState is not 0 or 4\n            return o.conn && !{0:true,4:true}[o.conn.readyState];\n        }\n    };\n    return pub;\n}();(function(){\n    var EXTLIB = Ext.lib,\n        noNegatives = /width|height|opacity|padding/i,\n        offsetAttribute = /^((width|height)|(top|left))$/,\n        defaultUnit = /width|height|top$|bottom$|left$|right$/i,\n        offsetUnit =  /\\d+(em|%|en|ex|pt|in|cm|mm|pc)$/i,\n        isset = function(v){\n            return typeof v !== 'undefined';\n        },\n        now = function(){\n            return new Date();\n        };\n\n    EXTLIB.Anim = {\n        motion : function(el, args, duration, easing, cb, scope) {\n            return this.run(el, args, duration, easing, cb, scope, Ext.lib.Motion);\n        },\n\n        run : function(el, args, duration, easing, cb, scope, type) {\n            type = type || Ext.lib.AnimBase;\n            if (typeof easing == \"string\") {\n                easing = Ext.lib.Easing[easing];\n            }\n            var anim = new type(el, args, duration, easing);\n            anim.animateX(function() {\n                if(Ext.isFunction(cb)){\n                    cb.call(scope);\n                }\n            });\n            return anim;\n        }\n    };\n\n    EXTLIB.AnimBase = function(el, attributes, duration, method) {\n        if (el) {\n            this.init(el, attributes, duration, method);\n        }\n    };\n\n    EXTLIB.AnimBase.prototype = {\n        doMethod: function(attr, start, end) {\n            var me = this;\n            return me.method(me.curFrame, start, end - start, me.totalFrames);\n        },\n\n\n        setAttr: function(attr, val, unit) {\n            if (noNegatives.test(attr) && val < 0) {\n                val = 0;\n            }\n            Ext.fly(this.el, '_anim').setStyle(attr, val + unit);\n        },\n\n\n        getAttr: function(attr) {\n            var el = Ext.fly(this.el),\n                val = el.getStyle(attr),\n                a = offsetAttribute.exec(attr) || [];\n\n            if (val !== 'auto' && !offsetUnit.test(val)) {\n                return parseFloat(val);\n            }\n\n            return (!!(a[2]) || (el.getStyle('position') == 'absolute' && !!(a[3]))) ? el.dom['offset' + a[0].charAt(0).toUpperCase() + a[0].substr(1)] : 0;\n        },\n\n\n        getDefaultUnit: function(attr) {\n            return defaultUnit.test(attr) ? 'px' : '';\n        },\n\n        animateX : function(callback, scope) {\n            var me = this,\n                f = function() {\n                me.onComplete.removeListener(f);\n                if (Ext.isFunction(callback)) {\n                    callback.call(scope || me, me);\n                }\n            };\n            me.onComplete.addListener(f, me);\n            me.animate();\n        },\n\n\n        setRunAttr: function(attr) {\n            var me = this,\n                a = this.attributes[attr],\n                to = a.to,\n                by = a.by,\n                from = a.from,\n                unit = a.unit,\n                ra = (this.runAttrs[attr] = {}),\n                end;\n\n            if (!isset(to) && !isset(by)){\n                return false;\n            }\n\n            var start = isset(from) ? from : me.getAttr(attr);\n            if (isset(to)) {\n                end = to;\n            }else if(isset(by)) {\n                if (Ext.isArray(start)){\n                    end = [];\n                    for(var i=0,len=start.length; i<len; i++) {\n                        end[i] = start[i] + by[i];\n                    }\n                }else{\n                    end = start + by;\n                }\n            }\n\n            Ext.apply(ra, {\n                start: start,\n                end: end,\n                unit: isset(unit) ? unit : me.getDefaultUnit(attr)\n            });\n        },\n\n\n        init: function(el, attributes, duration, method) {\n            var me = this,\n                actualFrames = 0,\n                mgr = EXTLIB.AnimMgr;\n\n            Ext.apply(me, {\n                isAnimated: false,\n                startTime: null,\n                el: Ext.getDom(el),\n                attributes: attributes || {},\n                duration: duration || 1,\n                method: method || EXTLIB.Easing.easeNone,\n                useSec: true,\n                curFrame: 0,\n                totalFrames: mgr.fps,\n                runAttrs: {},\n                animate: function(){\n                    var me = this,\n                        d = me.duration;\n\n                    if(me.isAnimated){\n                        return false;\n                    }\n\n                    me.curFrame = 0;\n                    me.totalFrames = me.useSec ? Math.ceil(mgr.fps * d) : d;\n                    mgr.registerElement(me);\n                },\n\n                stop: function(finish){\n                    var me = this;\n\n                    if(finish){\n                        me.curFrame = me.totalFrames;\n                        me._onTween.fire();\n                    }\n                    mgr.stop(me);\n                }\n            });\n\n            var onStart = function(){\n                var me = this,\n                    attr;\n\n                me.onStart.fire();\n                me.runAttrs = {};\n                for(attr in this.attributes){\n                    this.setRunAttr(attr);\n                }\n\n                me.isAnimated = true;\n                me.startTime = now();\n                actualFrames = 0;\n            };\n\n\n            var onTween = function(){\n                var me = this;\n\n                me.onTween.fire({\n                    duration: now() - me.startTime,\n                    curFrame: me.curFrame\n                });\n\n                var ra = me.runAttrs;\n                for (var attr in ra) {\n                    this.setAttr(attr, me.doMethod(attr, ra[attr].start, ra[attr].end), ra[attr].unit);\n                }\n\n                ++actualFrames;\n            };\n\n            var onComplete = function() {\n                var me = this,\n                    actual = (now() - me.startTime) / 1000,\n                    data = {\n                        duration: actual,\n                        frames: actualFrames,\n                        fps: actualFrames / actual\n                    };\n\n                me.isAnimated = false;\n                actualFrames = 0;\n                me.onComplete.fire(data);\n            };\n\n            me.onStart = new Ext.util.Event(me);\n            me.onTween = new Ext.util.Event(me);\n            me.onComplete = new Ext.util.Event(me);\n            (me._onStart = new Ext.util.Event(me)).addListener(onStart);\n            (me._onTween = new Ext.util.Event(me)).addListener(onTween);\n            (me._onComplete = new Ext.util.Event(me)).addListener(onComplete);\n        }\n    };\n\n\n    Ext.lib.AnimMgr = new function() {\n        var me = this,\n            thread = null,\n            queue = [],\n            tweenCount = 0;\n\n\n        Ext.apply(me, {\n            fps: 1000,\n            delay: 1,\n            registerElement: function(tween){\n                queue.push(tween);\n                ++tweenCount;\n                tween._onStart.fire();\n                me.start();\n            },\n\n            unRegister: function(tween, index){\n                tween._onComplete.fire();\n                index = index || getIndex(tween);\n                if (index != -1) {\n                    queue.splice(index, 1);\n                }\n\n                if (--tweenCount <= 0) {\n                    me.stop();\n                }\n            },\n\n            start: function(){\n                if(thread === null){\n                    thread = setInterval(me.run, me.delay);\n                }\n            },\n\n            stop: function(tween){\n                if(!tween){\n                    clearInterval(thread);\n                    for(var i = 0, len = queue.length; i < len; ++i){\n                        if(queue[0].isAnimated){\n                            me.unRegister(queue[0], 0);\n                        }\n                    }\n\n                    queue = [];\n                    thread = null;\n                    tweenCount = 0;\n                }else{\n                    me.unRegister(tween);\n                }\n            },\n\n            run: function(){\n                var tf, i, len, tween;\n                for(i = 0, len = queue.length; i<len; i++) {\n                    tween = queue[i];\n                    if(tween && tween.isAnimated){\n                        tf = tween.totalFrames;\n                        if(tween.curFrame < tf || tf === null){\n                            ++tween.curFrame;\n                            if(tween.useSec){\n                                correctFrame(tween);\n                            }\n                            tween._onTween.fire();\n                        }else{\n                            me.stop(tween);\n                        }\n                    }\n                }\n            }\n        });\n\n        var getIndex = function(anim) {\n            var i, len;\n            for(i = 0, len = queue.length; i<len; i++) {\n                if(queue[i] === anim) {\n                    return i;\n                }\n            }\n            return -1;\n        };\n\n        var correctFrame = function(tween) {\n            var frames = tween.totalFrames,\n                frame = tween.curFrame,\n                duration = tween.duration,\n                expected = (frame * duration * 1000 / frames),\n                elapsed = (now() - tween.startTime),\n                tweak = 0;\n\n            if(elapsed < duration * 1000){\n                tweak = Math.round((elapsed / expected - 1) * frame);\n            }else{\n                tweak = frames - (frame + 1);\n            }\n            if(tweak > 0 && isFinite(tweak)){\n                if(tween.curFrame + tweak >= frames){\n                    tweak = frames - (frame + 1);\n                }\n                tween.curFrame += tweak;\n            }\n        };\n    };\n\n    EXTLIB.Bezier = new function() {\n\n        this.getPosition = function(points, t) {\n            var n = points.length,\n                tmp = [],\n                c = 1 - t,\n                i,\n                j;\n\n            for (i = 0; i < n; ++i) {\n                tmp[i] = [points[i][0], points[i][1]];\n            }\n\n            for (j = 1; j < n; ++j) {\n                for (i = 0; i < n - j; ++i) {\n                    tmp[i][0] = c * tmp[i][0] + t * tmp[parseInt(i + 1, 10)][0];\n                    tmp[i][1] = c * tmp[i][1] + t * tmp[parseInt(i + 1, 10)][1];\n                }\n            }\n\n            return [ tmp[0][0], tmp[0][1] ];\n\n        };\n    };\n\n\n    EXTLIB.Easing = {\n        easeNone: function (t, b, c, d) {\n            return c * t / d + b;\n        },\n\n\n        easeIn: function (t, b, c, d) {\n            return c * (t /= d) * t + b;\n        },\n\n\n        easeOut: function (t, b, c, d) {\n            return -c * (t /= d) * (t - 2) + b;\n        }\n    };\n\n    (function() {\n        EXTLIB.Motion = function(el, attributes, duration, method) {\n            if (el) {\n                EXTLIB.Motion.superclass.constructor.call(this, el, attributes, duration, method);\n            }\n        };\n\n        Ext.extend(EXTLIB.Motion, Ext.lib.AnimBase);\n\n        var superclass = EXTLIB.Motion.superclass,\n            pointsRe = /^points$/i;\n\n        Ext.apply(EXTLIB.Motion.prototype, {\n            setAttr: function(attr, val, unit){\n                var me = this,\n                    setAttr = superclass.setAttr;\n\n                if (pointsRe.test(attr)) {\n                    unit = unit || 'px';\n                    setAttr.call(me, 'left', val[0], unit);\n                    setAttr.call(me, 'top', val[1], unit);\n                } else {\n                    setAttr.call(me, attr, val, unit);\n                }\n            },\n\n            getAttr: function(attr){\n                var me = this,\n                    getAttr = superclass.getAttr;\n\n                return pointsRe.test(attr) ? [getAttr.call(me, 'left'), getAttr.call(me, 'top')] : getAttr.call(me, attr);\n            },\n\n            doMethod: function(attr, start, end){\n                var me = this;\n\n                return pointsRe.test(attr)\n                        ? EXTLIB.Bezier.getPosition(me.runAttrs[attr], me.method(me.curFrame, 0, 100, me.totalFrames) / 100)\n                        : superclass.doMethod.call(me, attr, start, end);\n            },\n\n            setRunAttr: function(attr){\n                if(pointsRe.test(attr)){\n\n                    var me = this,\n                        el = this.el,\n                        points = this.attributes.points,\n                        control = points.control || [],\n                        from = points.from,\n                        to = points.to,\n                        by = points.by,\n                        DOM = EXTLIB.Dom,\n                        start,\n                        i,\n                        end,\n                        len,\n                        ra;\n\n\n                    if(control.length > 0 && !Ext.isArray(control[0])){\n                        control = [control];\n                    }else{\n                        /*\n                        var tmp = [];\n                        for (i = 0,len = control.length; i < len; ++i) {\n                            tmp[i] = control[i];\n                        }\n                        control = tmp;\n                        */\n                    }\n\n                    Ext.fly(el, '_anim').position();\n                    DOM.setXY(el, isset(from) ? from : DOM.getXY(el));\n                    start = me.getAttr('points');\n\n\n                    if(isset(to)){\n                        end = translateValues.call(me, to, start);\n                        for (i = 0,len = control.length; i < len; ++i) {\n                            control[i] = translateValues.call(me, control[i], start);\n                        }\n                    } else if (isset(by)) {\n                        end = [start[0] + by[0], start[1] + by[1]];\n\n                        for (i = 0,len = control.length; i < len; ++i) {\n                            control[i] = [ start[0] + control[i][0], start[1] + control[i][1] ];\n                        }\n                    }\n\n                    ra = this.runAttrs[attr] = [start];\n                    if (control.length > 0) {\n                        ra = ra.concat(control);\n                    }\n\n                    ra[ra.length] = end;\n                }else{\n                    superclass.setRunAttr.call(this, attr);\n                }\n            }\n        });\n\n        var translateValues = function(val, start) {\n            var pageXY = EXTLIB.Dom.getXY(this.el);\n            return [val[0] - pageXY[0] + start[0], val[1] - pageXY[1] + start[1]];\n        };\n    })();\n})();// Easing functions\n(function(){\n    // shortcuts to aid compression\n    var abs = Math.abs,\n        pi = Math.PI,\n        asin = Math.asin,\n        pow = Math.pow,\n        sin = Math.sin,\n        EXTLIB = Ext.lib;\n\n    Ext.apply(EXTLIB.Easing, {\n\n        easeBoth: function (t, b, c, d) {\n            return ((t /= d / 2) < 1)  ?  c / 2 * t * t + b  :  -c / 2 * ((--t) * (t - 2) - 1) + b;\n        },\n\n        easeInStrong: function (t, b, c, d) {\n            return c * (t /= d) * t * t * t + b;\n        },\n\n        easeOutStrong: function (t, b, c, d) {\n            return -c * ((t = t / d - 1) * t * t * t - 1) + b;\n        },\n\n        easeBothStrong: function (t, b, c, d) {\n            return ((t /= d / 2) < 1)  ?  c / 2 * t * t * t * t + b  :  -c / 2 * ((t -= 2) * t * t * t - 2) + b;\n        },\n\n        elasticIn: function (t, b, c, d, a, p) {\n            if (t == 0 || (t /= d) == 1) {\n                return t == 0 ? b : b + c;\n            }\n            p = p || (d * .3);\n\n            var s;\n            if (a >= abs(c)) {\n                s = p / (2 * pi) * asin(c / a);\n            } else {\n                a = c;\n                s = p / 4;\n            }\n\n            return -(a * pow(2, 10 * (t -= 1)) * sin((t * d - s) * (2 * pi) / p)) + b;\n\n        },\n\n        elasticOut: function (t, b, c, d, a, p) {\n            if (t == 0 || (t /= d) == 1) {\n                return t == 0 ? b : b + c;\n            }\n            p = p || (d * .3);\n\n            var s;\n            if (a >= abs(c)) {\n                s = p / (2 * pi) * asin(c / a);\n            } else {\n                a = c;\n                s = p / 4;\n            }\n\n            return a * pow(2, -10 * t) * sin((t * d - s) * (2 * pi) / p) + c + b;\n        },\n\n        elasticBoth: function (t, b, c, d, a, p) {\n            if (t == 0 || (t /= d / 2) == 2) {\n                return t == 0 ? b : b + c;\n            }\n\n            p = p || (d * (.3 * 1.5));\n\n            var s;\n            if (a >= abs(c)) {\n                s = p / (2 * pi) * asin(c / a);\n            } else {\n                a = c;\n                s = p / 4;\n            }\n\n            return t < 1 ?\n                    -.5 * (a * pow(2, 10 * (t -= 1)) * sin((t * d - s) * (2 * pi) / p)) + b :\n                    a * pow(2, -10 * (t -= 1)) * sin((t * d - s) * (2 * pi) / p) * .5 + c + b;\n        },\n\n        backIn: function (t, b, c, d, s) {\n            s = s ||  1.70158;\n            return c * (t /= d) * t * ((s + 1) * t - s) + b;\n        },\n\n\n        backOut: function (t, b, c, d, s) {\n            if (!s) {\n                s = 1.70158;\n            }\n            return c * ((t = t / d - 1) * t * ((s + 1) * t + s) + 1) + b;\n        },\n\n\n        backBoth: function (t, b, c, d, s) {\n            s = s || 1.70158;\n\n            return ((t /= d / 2 ) < 1) ?\n                    c / 2 * (t * t * (((s *= (1.525)) + 1) * t - s)) + b :\n                    c / 2 * ((t -= 2) * t * (((s *= (1.525)) + 1) * t + s) + 2) + b;\n        },\n\n\n        bounceIn: function (t, b, c, d) {\n            return c - EXTLIB.Easing.bounceOut(d - t, 0, c, d) + b;\n        },\n\n\n        bounceOut: function (t, b, c, d) {\n        if ((t /= d) < (1 / 2.75)) {\n                return c * (7.5625 * t * t) + b;\n            } else if (t < (2 / 2.75)) {\n                return c * (7.5625 * (t -= (1.5 / 2.75)) * t + .75) + b;\n            } else if (t < (2.5 / 2.75)) {\n                return c * (7.5625 * (t -= (2.25 / 2.75)) * t + .9375) + b;\n            }\n            return c * (7.5625 * (t -= (2.625 / 2.75)) * t + .984375) + b;\n        },\n\n\n        bounceBoth: function (t, b, c, d) {\n            return (t < d / 2) ?\n                    EXTLIB.Easing.bounceIn(t * 2, 0, c, d) * .5 + b :\n                    EXTLIB.Easing.bounceOut(t * 2 - d, 0, c, d) * .5 + c * .5 + b;\n        }\n    });\n})();\n\n(function() {\n    var EXTLIB = Ext.lib;\n    // Color Animation\n    EXTLIB.Anim.color = function(el, args, duration, easing, cb, scope) {\n        return EXTLIB.Anim.run(el, args, duration, easing, cb, scope, EXTLIB.ColorAnim);\n    };\n\n    EXTLIB.ColorAnim = function(el, attributes, duration, method) {\n        EXTLIB.ColorAnim.superclass.constructor.call(this, el, attributes, duration, method);\n    };\n\n    Ext.extend(EXTLIB.ColorAnim, EXTLIB.AnimBase);\n\n    var superclass = EXTLIB.ColorAnim.superclass,\n        colorRE = /color$/i,\n        transparentRE = /^transparent|rgba\\(0, 0, 0, 0\\)$/,\n        rgbRE = /^rgb\\(([0-9]+)\\s*,\\s*([0-9]+)\\s*,\\s*([0-9]+)\\)$/i,\n        hexRE= /^#?([0-9A-F]{2})([0-9A-F]{2})([0-9A-F]{2})$/i,\n        hex3RE = /^#?([0-9A-F]{1})([0-9A-F]{1})([0-9A-F]{1})$/i,\n        isset = function(v){\n            return typeof v !== 'undefined';\n        };\n\n    // private\n    function parseColor(s) {\n        var pi = parseInt,\n            base,\n            out = null,\n            c;\n\n        if (s.length == 3) {\n            return s;\n        }\n\n        Ext.each([hexRE, rgbRE, hex3RE], function(re, idx){\n            base = (idx % 2 == 0) ? 16 : 10;\n            c = re.exec(s);\n            if(c && c.length == 4){\n                out = [pi(c[1], base), pi(c[2], base), pi(c[3], base)];\n                return false;\n            }\n        });\n        return out;\n    }\n\n    Ext.apply(EXTLIB.ColorAnim.prototype, {\n        getAttr : function(attr) {\n            var me = this,\n                el = me.el,\n                val;\n            if(colorRE.test(attr)){\n                while(el && transparentRE.test(val = Ext.fly(el).getStyle(attr))){\n                    el = el.parentNode;\n                    val = \"fff\";\n                }\n            }else{\n                val = superclass.getAttr.call(me, attr);\n            }\n            return val;\n        },\n\n        doMethod : function(attr, start, end) {\n            var me = this,\n                val,\n                floor = Math.floor,\n                i,\n                len,\n                v;\n\n            if(colorRE.test(attr)){\n                val = [];\n                end = end || [];\n\n                for(i = 0, len = start.length; i < len; i++) {\n                    v = start[i];\n                    val[i] = superclass.doMethod.call(me, attr, v, end[i]);\n                }\n                val = 'rgb(' + floor(val[0]) + ',' + floor(val[1]) + ',' + floor(val[2]) + ')';\n            }else{\n                val = superclass.doMethod.call(me, attr, start, end);\n            }\n            return val;\n        },\n\n        setRunAttr : function(attr) {\n            var me = this,\n                a = me.attributes[attr],\n                to = a.to,\n                by = a.by,\n                ra;\n\n            superclass.setRunAttr.call(me, attr);\n            ra = me.runAttrs[attr];\n            if(colorRE.test(attr)){\n                var start = parseColor(ra.start),\n                    end = parseColor(ra.end);\n\n                if(!isset(to) && isset(by)){\n                    end = parseColor(by);\n                    for(var i=0,len=start.length; i<len; i++) {\n                        end[i] = start[i] + end[i];\n                    }\n                }\n                ra.start = start;\n                ra.end = end;\n            }\n        }\n    });\n})();\n\n\n(function() {\n    // Scroll Animation\n    var EXTLIB = Ext.lib;\n    EXTLIB.Anim.scroll = function(el, args, duration, easing, cb, scope) {\n        return EXTLIB.Anim.run(el, args, duration, easing, cb, scope, EXTLIB.Scroll);\n    };\n\n    EXTLIB.Scroll = function(el, attributes, duration, method) {\n        if(el){\n            EXTLIB.Scroll.superclass.constructor.call(this, el, attributes, duration, method);\n        }\n    };\n\n    Ext.extend(EXTLIB.Scroll, EXTLIB.ColorAnim);\n\n    var superclass = EXTLIB.Scroll.superclass,\n        SCROLL = 'scroll';\n\n    Ext.apply(EXTLIB.Scroll.prototype, {\n\n        doMethod : function(attr, start, end) {\n            var val,\n                me = this,\n                curFrame = me.curFrame,\n                totalFrames = me.totalFrames;\n\n            if(attr == SCROLL){\n                val = [me.method(curFrame, start[0], end[0] - start[0], totalFrames),\n                       me.method(curFrame, start[1], end[1] - start[1], totalFrames)];\n            }else{\n                val = superclass.doMethod.call(me, attr, start, end);\n            }\n            return val;\n        },\n\n        getAttr : function(attr) {\n            var me = this;\n\n            if (attr == SCROLL) {\n                return [me.el.scrollLeft, me.el.scrollTop];\n            }else{\n                return superclass.getAttr.call(me, attr);\n            }\n        },\n\n        setAttr : function(attr, val, unit) {\n            var me = this;\n\n            if(attr == SCROLL){\n                me.el.scrollLeft = val[0];\n                me.el.scrollTop = val[1];\n            }else{\n                superclass.setAttr.call(me, attr, val, unit);\n            }\n        }\n    });\n})();\t\n\tif (Ext.isIE9m) {\n        function fnCleanUp() {\n            var p = Function.prototype;\n            delete p.createSequence;\n            delete p.defer;\n            delete p.createDelegate;\n            delete p.createCallback;\n            delete p.createInterceptor;\n\n            window.detachEvent(\"onunload\", fnCleanUp);\n        }\n        window.attachEvent(\"onunload\", fnCleanUp);\n    }\n})();"
  },
  {
    "path": "client/src/ext/adapter/ext/ext-base.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nwindow.undefined=window.undefined;Ext={version:\"3.4.1.1\",versionDetail:{major:3,minor:4,patch:1.1}};Ext.apply=function(d,e,b){if(b){Ext.apply(d,b)}if(d&&e&&typeof e==\"object\"){for(var a in e){d[a]=e[a]}}return d};(function(){var g=0,f=Object.prototype.toString,y=navigator.userAgent.toLowerCase(),n=function(e){return e.test(y)},s=document,q=s.documentMode,u=s.compatMode==\"CSS1Compat\",a=n(/opera/),H=n(/\\bchrome\\b/),z=n(/webkit/),d=!H&&n(/safari/),F=d&&n(/applewebkit\\/4/),D=d&&n(/version\\/3/),B=d&&n(/version\\/4/),j=!a&&n(/msie/),G=j&&((n(/msie 7/)&&q!=8&&q!=9&&q!=10)||q==7),E=j&&((n(/msie 8/)&&q!=7&&q!=9&&q!=10)||q==8),C=j&&((n(/msie 9/)&&q!=7&&q!=8&&q!=10)||q==9),i=j&&((n(/msie 10/)&&q!=7&&q!=8&&q!=9)||q==10),J=j&&n(/msie 6/),K=j&&(J||G||E||C),c=!z&&n(/gecko/),M=c&&n(/rv:1\\.8/),L=c&&n(/rv:1\\.9/),m=K&&!u,h=n(/windows|win32/),A=n(/macintosh|mac os x/),p=n(/adobeair/),v=n(/linux/),r=/^https/i.test(window.location.protocol),b=[],w=[],o=Ext.emptyFn,x=Ext.apply({},{constructor:o,toString:o,valueOf:o}),l=function(){var e=l.caller.caller;return e.$owner.prototype[e.$name].apply(this,arguments)};if(x.constructor!==o){w.push(\"constructor\")}if(x.toString!==o){w.push(\"toString\")}if(x.valueOf!==o){w.push(\"valueOf\")}if(!w.length){w=null}function k(){}Ext.apply(k,{$isClass:true,callParent:function(e){var t;return(t=this.callParent.caller)&&(t.$previous||((t=t.$owner?t:t.caller)&&t.$owner.superclass.self[t.$name])).apply(this,e||b)}});k.prototype={constructor:function(){},callParent:function(t){var N,e=(N=this.callParent.caller)&&(N.$previous||((N=N.$owner?N:N.caller)&&N.$owner.superclass[N.$name]));return e.apply(this,t||b)}};if(J){try{s.execCommand(\"BackgroundImageCache\",false,true)}catch(I){}}Ext.apply(Ext,{SSL_SECURE_URL:r&&j?'javascript:\"\"':\"about:blank\",isStrict:u,isSecure:r,isReady:false,enableForcedBoxModel:false,enableGarbageCollector:true,enableListenerCollection:false,enableNestedListenerRemoval:false,USE_NATIVE_JSON:false,applyIf:function(t,N){if(t){for(var e in N){if(!Ext.isDefined(t[e])){t[e]=N[e]}}}return t},id:function(e,t){e=Ext.getDom(e,true)||{};if(!e.id){e.id=(t||\"ext-gen\")+(++g)}return e.id},extend:function(){var t=function(O){for(var N in O){this[N]=O[N]}};var e=Object.prototype.constructor;return function(S,P,R){if(typeof P==\"object\"){R=P;P=S;S=R.constructor!=e?R.constructor:function(){P.apply(this,arguments)}}var O=function(){},Q,N=P.prototype;O.prototype=N;Q=S.prototype=new O();Q.constructor=S;S.superclass=N;if(N.constructor==e){N.constructor=P}S.override=function(T){Ext.override(S,T)};Q.superclass=Q.supr=(function(){return N});Q.override=t;Ext.override(S,R);S.extend=function(T){return Ext.extend(S,T)};return S}}(),global:(function(){return this})(),Base:k,namespaceCache:{},createNamespace:function(R,O){var e=Ext.namespaceCache,P=O?R.substring(0,R.lastIndexOf(\".\")):R,U=e[P],S,N,t,Q,T;if(!U){U=Ext.global;if(P){T=[];Q=P.split(\".\");for(S=0,N=Q.length;S<N;++S){t=Q[S];U=U[t]||(U[t]={});T.push(t);e[T.join(\".\")]=U}}}return U},getClassByName:function(N){var O=N.split(\".\"),e=Ext.global,P=O.length,t;for(t=0;e&&t<P;++t){e=e[O[t]]}return e||null},addMembers:function(t,Q,N,e){var P,O,R;for(O in N){if(N.hasOwnProperty(O)){R=N[O];if(typeof R==\"function\"){R.$owner=t;R.$name=O}Q[O]=R}}if(e&&w){for(P=w.length;P-->0;){O=w[P];if(N.hasOwnProperty(O)){R=N[O];if(typeof R==\"function\"){R.$owner=t;R.$name=O}Q[O]=R}}}},define:function(R,P,N){var t=P.override,T,Q,e,O;if(t){delete P.override;T=Ext.getClassByName(t);Ext.override(T,P)}else{if(R){O=Ext.createNamespace(R,true);e=R.substring(R.lastIndexOf(\".\")+1)}T=function S(){this.constructor.apply(this,arguments)};if(R){T.displayName=R}T.$isClass=true;T.callParent=Ext.Base.callParent;if(typeof P==\"function\"){P=P(T)}Q=P.extend;if(Q){delete P.extend;if(typeof Q==\"string\"){Q=Ext.getClassByName(Q)}}else{Q=k}Ext.extend(T,Q,P);if(T.prototype.constructor===T){delete T.prototype.constructor}if(!T.prototype.$isClass){Ext.applyIf(T.prototype,k.prototype)}T.prototype.self=T;if(P.xtype){Ext.reg(P.xtype,T)}T=P.singleton?new T():T;if(R){O[e]=T}}if(N){N.call(T)}return T},override:function(P,R){var N,Q;if(R){if(P.$isClass){Q=R.statics;if(Q){delete R.statics}Ext.addMembers(P,P.prototype,R,true);if(Q){Ext.addMembers(P,P,Q)}}else{if(typeof P==\"function\"){N=P.prototype;Ext.apply(N,R);if(Ext.isIE&&R.hasOwnProperty(\"toString\")){N.toString=R.toString}}else{var e=P.self,t,O;if(e&&e.$isClass){for(t in R){if(R.hasOwnProperty(t)){O=R[t];if(typeof O==\"function\"){if(e.$className){O.displayName=e.$className+\"#\"+t}O.$name=t;O.$owner=e;O.$previous=P.hasOwnProperty(t)?P[t]:l}P[t]=O}}}else{Ext.apply(P,R);if(!P.constructor.$isClass){P.constructor.prototype.callParent=k.prototype.callParent;P.constructor.callParent=k.callParent}}}}}},namespace:function(){var O=arguments.length,P=0,t,N,e,R,Q,S;for(;P<O;++P){e=arguments[P];R=arguments[P].split(\".\");S=window[R[0]];if(S===undefined){S=window[R[0]]={}}Q=R.slice(1);t=Q.length;for(N=0;N<t;++N){S=S[Q[N]]=S[Q[N]]||{}}}return S},urlEncode:function(Q,P){var N,t=[],O=encodeURIComponent;Ext.iterate(Q,function(e,R){N=Ext.isEmpty(R);Ext.each(N?e:R,function(S){t.push(\"&\",O(e),\"=\",(!Ext.isEmpty(S)&&(S!=e||!N))?(Ext.isDate(S)?Ext.encode(S).replace(/\"/g,\"\"):O(S)):\"\")})});if(!P){t.shift();P=\"\"}return P+t.join(\"\")},urlDecode:function(N,t){if(Ext.isEmpty(N)){return{}}var Q={},P=N.split(\"&\"),R=decodeURIComponent,e,O;Ext.each(P,function(S){S=S.split(\"=\");e=R(S[0]);O=R(S[1]);Q[e]=t||!Q[e]?O:[].concat(Q[e]).concat(O)});return Q},urlAppend:function(e,t){if(!Ext.isEmpty(t)){return e+(e.indexOf(\"?\")===-1?\"?\":\"&\")+t}return e},toArray:function(){return j?function(N,Q,O,P){P=[];for(var t=0,e=N.length;t<e;t++){P.push(N[t])}return P.slice(Q||0,O||P.length)}:function(e,N,t){return Array.prototype.slice.call(e,N||0,t||e.length)}}(),isIterable:function(e){if(Ext.isArray(e)||e.callee){return true}if(/NodeList|HTMLCollection/.test(f.call(e))){return true}return((typeof e.nextNode!=\"undefined\"||e.item)&&Ext.isNumber(e.length))},each:function(P,O,N){if(Ext.isEmpty(P,true)){return}if(!Ext.isIterable(P)||Ext.isPrimitive(P)){P=[P]}for(var t=0,e=P.length;t<e;t++){if(O.call(N||P[t],P[t],t,P)===false){return t}}},iterate:function(N,t,e){if(Ext.isEmpty(N)){return}if(Ext.isIterable(N)){Ext.each(N,t,e);return}else{if(typeof N==\"object\"){for(var O in N){if(N.hasOwnProperty(O)){if(t.call(e||N,O,N[O],N)===false){return}}}}}},getDom:function(N,t){if(!N||!s){return null}if(N.dom){return N.dom}else{if(typeof N==\"string\"){var O=s.getElementById(N);if(O&&j&&t){if(N==O.getAttribute(\"id\")){return O}else{return null}}return O}else{return N}}},getBody:function(){return Ext.get(s.body||s.documentElement)},getHead:function(){var e;return function(){if(e==undefined){e=Ext.get(s.getElementsByTagName(\"head\")[0])}return e}}(),removeNode:j&&!E?function(){var e;return function(t){if(t&&t.tagName!=\"BODY\"){(Ext.enableNestedListenerRemoval)?Ext.EventManager.purgeElement(t,true):Ext.EventManager.removeAll(t);e=e||s.createElement(\"div\");e.appendChild(t);e.innerHTML=\"\";delete Ext.elCache[t.id]}}}():function(e){if(e&&e.parentNode&&e.tagName!=\"BODY\"){(Ext.enableNestedListenerRemoval)?Ext.EventManager.purgeElement(e,true):Ext.EventManager.removeAll(e);e.parentNode.removeChild(e);delete Ext.elCache[e.id]}},isEmpty:function(t,e){return t===null||t===undefined||((Ext.isArray(t)&&!t.length))||(!e?t===\"\":false)},isArray:function(e){return f.apply(e)===\"[object Array]\"},isDate:function(e){return f.apply(e)===\"[object Date]\"},isObject:function(e){return !!e&&Object.prototype.toString.call(e)===\"[object Object]\"},isPrimitive:function(e){return Ext.isString(e)||Ext.isNumber(e)||Ext.isBoolean(e)},isFunction:function(e){return f.apply(e)===\"[object Function]\"},isNumber:function(e){return typeof e===\"number\"&&isFinite(e)},isString:function(e){return typeof e===\"string\"},isBoolean:function(e){return typeof e===\"boolean\"},isElement:function(e){return e?!!e.tagName:false},isDefined:function(e){return typeof e!==\"undefined\"},isOpera:a,isWebKit:z,isChrome:H,isSafari:d,isSafari3:D,isSafari4:B,isSafari2:F,isIE:j,isIE6:J,isIE7:G,isIE8:E,isIE9:C,isIE10:i,isIE9m:K,isIE10p:j&&!(J||G||E||C),isIEQuirks:j&&(!u&&(J||G||E||C)),isGecko:c,isGecko2:M,isGecko3:L,isBorderBox:m,isLinux:v,isWindows:h,isMac:A,isAir:p});Ext.ns=Ext.namespace})();Ext.ns(\"Ext.util\",\"Ext.lib\",\"Ext.data\",\"Ext.supports\");Ext.elCache={};Ext.apply(Function.prototype,{createInterceptor:function(b,a){var c=this;return !Ext.isFunction(b)?this:function(){var e=this,d=arguments;b.target=e;b.method=c;return(b.apply(a||e||window,d)!==false)?c.apply(e||window,d):null}},createCallback:function(){var a=arguments,b=this;return function(){return b.apply(window,a)}},createDelegate:function(c,b,a){var d=this;return function(){var f=b||arguments;if(a===true){f=Array.prototype.slice.call(arguments,0);f=f.concat(b)}else{if(Ext.isNumber(a)){f=Array.prototype.slice.call(arguments,0);var e=[a,0].concat(b);Array.prototype.splice.apply(f,e)}}return d.apply(c||window,f)}},defer:function(c,e,b,a){var d=this.createDelegate(e,b,a);if(c>0){return setTimeout(d,c)}d();return 0}});Ext.applyIf(String,{format:function(b){var a=Ext.toArray(arguments,1);return b.replace(/\\{(\\d+)\\}/g,function(c,d){return a[d]})}});Ext.applyIf(Array.prototype,{indexOf:function(b,c){var a=this.length;c=c||0;c+=(c<0)?a:0;for(;c<a;++c){if(this[c]===b){return c}}return -1},remove:function(b){var a=this.indexOf(b);if(a!=-1){this.splice(a,1)}return this}});Ext.util.TaskRunner=function(e){e=e||10;var f=[],a=[],b=0,g=false,d=function(){g=false;clearInterval(b);b=0},h=function(){if(!g){g=true;b=setInterval(i,e)}},c=function(j){a.push(j);if(j.onStop){j.onStop.apply(j.scope||j)}},i=function(){var l=a.length,n=new Date().getTime();if(l>0){for(var p=0;p<l;p++){f.remove(a[p])}a=[];if(f.length<1){d();return}}for(var p=0,o,k,m,j=f.length;p<j;++p){o=f[p];k=n-o.taskRunTime;if(o.interval<=k){m=o.run.apply(o.scope||o,o.args||[++o.taskRunCount]);o.taskRunTime=n;if(m===false||o.taskRunCount===o.repeat){c(o);return}}if(o.duration&&o.duration<=(n-o.taskStartTime)){c(o)}}};this.start=function(j){f.push(j);j.taskStartTime=new Date().getTime();j.taskRunTime=0;j.taskRunCount=0;h();return j};this.stop=function(j){c(j);return j};this.stopAll=function(){d();for(var k=0,j=f.length;k<j;k++){if(f[k].onStop){f[k].onStop()}}f=[];a=[]}};Ext.TaskMgr=new Ext.util.TaskRunner();(function(){var b;function c(d){if(!b){b=new Ext.Element.Flyweight()}b.dom=d;return b}(function(){var g=document,e=g.compatMode==\"CSS1Compat\",f=Math.max,d=Math.round,h=parseInt;Ext.lib.Dom={isAncestor:function(j,k){var i=false;j=Ext.getDom(j);k=Ext.getDom(k);if(j&&k){if(j.contains){return j.contains(k)}else{if(j.compareDocumentPosition){return !!(j.compareDocumentPosition(k)&16)}else{while(k=k.parentNode){i=k==j||i}}}}return i},getViewWidth:function(i){return i?this.getDocumentWidth():this.getViewportWidth()},getViewHeight:function(i){return i?this.getDocumentHeight():this.getViewportHeight()},getDocumentHeight:function(){return f(!e?g.body.scrollHeight:g.documentElement.scrollHeight,this.getViewportHeight())},getDocumentWidth:function(){return f(!e?g.body.scrollWidth:g.documentElement.scrollWidth,this.getViewportWidth())},getViewportHeight:function(){return Ext.isIE9m?(Ext.isStrict?g.documentElement.clientHeight:g.body.clientHeight):self.innerHeight},getViewportWidth:function(){return !Ext.isStrict&&!Ext.isOpera?g.body.clientWidth:Ext.isIE9m?g.documentElement.clientWidth:self.innerWidth},getY:function(i){return this.getXY(i)[1]},getX:function(i){return this.getXY(i)[0]},getXY:function(k){var j,q,s,v,l,m,u=0,r=0,t,i,n=(g.body||g.documentElement),o=[0,0];k=Ext.getDom(k);if(k!=n){if(k.getBoundingClientRect){s=k.getBoundingClientRect();t=c(document).getScroll();o=[d(s.left+t.left),d(s.top+t.top)]}else{j=k;i=c(k).isStyle(\"position\",\"absolute\");while(j){q=c(j);u+=j.offsetLeft;r+=j.offsetTop;i=i||q.isStyle(\"position\",\"absolute\");if(Ext.isGecko){r+=v=h(q.getStyle(\"borderTopWidth\"),10)||0;u+=l=h(q.getStyle(\"borderLeftWidth\"),10)||0;if(j!=k&&!q.isStyle(\"overflow\",\"visible\")){u+=l;r+=v}}j=j.offsetParent}if(Ext.isSafari&&i){u-=n.offsetLeft;r-=n.offsetTop}if(Ext.isGecko&&!i){m=c(n);u+=h(m.getStyle(\"borderLeftWidth\"),10)||0;r+=h(m.getStyle(\"borderTopWidth\"),10)||0}j=k.parentNode;while(j&&j!=n){if(!Ext.isOpera||(j.tagName!=\"TR\"&&!c(j).isStyle(\"display\",\"inline\"))){u-=j.scrollLeft;r-=j.scrollTop}j=j.parentNode}o=[u,r]}}return o},setXY:function(j,k){(j=Ext.fly(j,\"_setXY\")).position();var l=j.translatePoints(k),i=j.dom.style,m;for(m in l){if(!isNaN(l[m])){i[m]=l[m]+\"px\"}}},setX:function(j,i){this.setXY(j,[i,false])},setY:function(i,j){this.setXY(i,[false,j])}}})();Ext.lib.Event=function(){var v=false,f={},z=0,o=[],d,A=false,k=window,E=document,l=200,r=20,p=0,i=1,s=2,w=3,t=\"scrollLeft\",q=\"scrollTop\",g=\"unload\",y=\"mouseover\",D=\"mouseout\",e=function(){var F;if(k.addEventListener){F=function(J,H,I,G){if(H==\"mouseenter\"){I=I.createInterceptor(n);J.addEventListener(y,I,(G))}else{if(H==\"mouseleave\"){I=I.createInterceptor(n);J.addEventListener(D,I,(G))}else{J.addEventListener(H,I,(G))}}return I}}else{if(k.attachEvent){F=function(J,H,I,G){J.attachEvent(\"on\"+H,I);return I}}else{F=function(){}}}return F}(),h=function(){var F;if(k.removeEventListener){F=function(J,H,I,G){if(H==\"mouseenter\"){H=y}else{if(H==\"mouseleave\"){H=D}}J.removeEventListener(H,I,(G))}}else{if(k.detachEvent){F=function(I,G,H){I.detachEvent(\"on\"+G,H)}}else{F=function(){}}}return F}();function n(F){return !u(F.currentTarget,x.getRelatedTarget(F))}function u(F,G){if(F&&F.firstChild){while(G){if(G===F){return true}G=G.parentNode;if(G&&(G.nodeType!=1)){G=null}}}return false}function B(){var G=false,L=[],J,I,F,H,K=!v||(z>0);if(!A){A=true;for(I=0;I<o.length;++I){F=o[I];if(F&&(J=E.getElementById(F.id))){if(!F.checkReady||v||J.nextSibling||(E&&E.body)){H=F.override;J=H?(H===true?F.obj:H):J;F.fn.call(J,F.obj);o.remove(F);--I}else{L.push(F)}}}z=(L.length===0)?0:z-1;if(K){m()}else{clearInterval(d);d=null}G=!(A=false)}return G}function m(){if(!d){var F=function(){B()};d=setInterval(F,r)}}function C(){var F=E.documentElement,G=E.body;if(F&&(F[q]||F[t])){return[F[t],F[q]]}else{if(G){return[G[t],G[q]]}else{return[0,0]}}}function j(F,G){F=F.browserEvent||F;var H=F[\"page\"+G];if(!H&&H!==0){H=F[\"client\"+G]||0;if(Ext.isIE){H+=C()[G==\"X\"?0:1]}}return H}var x={extAdapter:true,onAvailable:function(H,F,I,G){o.push({id:H,fn:F,obj:I,override:G,checkReady:false});z=l;m()},addListener:function(H,F,G){H=Ext.getDom(H);if(H&&G){if(F==g){if(f[H.id]===undefined){f[H.id]=[]}f[H.id].push([F,G]);return G}return e(H,F,G,false)}return false},removeListener:function(L,H,K){L=Ext.getDom(L);var J,G,F,I;if(L&&K){if(H==g){if((I=f[L.id])!==undefined){for(J=0,G=I.length;J<G;J++){if((F=I[J])&&F[p]==H&&F[i]==K){f[L.id].splice(J,1)}}}return}h(L,H,K,false)}},getTarget:function(F){F=F.browserEvent||F;return this.resolveTextNode(F.target||F.srcElement)},resolveTextNode:Ext.isGecko?function(G){if(!G){return}var F=HTMLElement.prototype.toString.call(G);if(F==\"[xpconnect wrapped native prototype]\"||F==\"[object XULElement]\"){return}return G.nodeType==3?G.parentNode:G}:function(F){return F&&F.nodeType==3?F.parentNode:F},getRelatedTarget:function(F){F=F.browserEvent||F;return this.resolveTextNode(F.relatedTarget||(/(mouseout|mouseleave)/.test(F.type)?F.toElement:/(mouseover|mouseenter)/.test(F.type)?F.fromElement:null))},getPageX:function(F){return j(F,\"X\")},getPageY:function(F){return j(F,\"Y\")},getXY:function(F){return[this.getPageX(F),this.getPageY(F)]},stopEvent:function(F){this.stopPropagation(F);this.preventDefault(F)},stopPropagation:function(F){F=F.browserEvent||F;if(F.stopPropagation){F.stopPropagation()}else{F.cancelBubble=true}},preventDefault:function(F){F=F.browserEvent||F;if(F.preventDefault){F.preventDefault()}else{if(F.keyCode){F.keyCode=0}F.returnValue=false}},getEvent:function(F){F=F||k.event;if(!F){var G=this.getEvent.caller;while(G){F=G.arguments[0];if(F&&Event==F.constructor){break}G=G.caller}}return F},getCharCode:function(F){F=F.browserEvent||F;return F.charCode||F.keyCode||0},getListeners:function(G,F){Ext.EventManager.getListeners(G,F)},purgeElement:function(G,H,F){Ext.EventManager.purgeElement(G,H,F)},_load:function(F){v=true;if(Ext.isIE9m&&F!==true){h(k,\"load\",arguments.callee)}},_unload:function(J){var G=Ext.lib.Event,H,M,K,F,I,N;for(F in f){K=f[F];for(H=0,I=K.length;H<I;H++){M=K[H];if(M){try{N=M[w]?(M[w]===true?M[s]:M[w]):k;M[i].call(N,G.getEvent(J),M[s])}catch(L){}}}}Ext.EventManager._unload();h(k,g,G._unload)}};x.on=x.addListener;x.un=x.removeListener;if(E&&E.body){x._load(true)}else{e(k,\"load\",x._load)}e(k,g,x._unload);B();return x}();Ext.lib.Ajax=function(){var g=[\"Msxml2.XMLHTTP.3.0\",\"Msxml2.XMLHTTP\"],d=\"Content-Type\";function h(v){var t=v.conn,w,u={};function s(x,y){for(w in y){if(y.hasOwnProperty(w)){x.setRequestHeader(w,y[w])}}}Ext.apply(u,k.headers,k.defaultHeaders);s(t,u);delete k.headers}function e(v,u,t,s){return{tId:v,status:t?-1:0,statusText:t?\"transaction aborted\":\"communication failure\",isAbort:t,isTimeout:s,argument:u}}function j(s,t){(k.headers=k.headers||{})[s]=t}function p(u,y){var C={},x,w=u.conn,A,B,v=w.status==1223;try{x=u.conn.getAllResponseHeaders();Ext.each(x.replace(/\\r\\n/g,\"\\n\").split(\"\\n\"),function(s){A=s.indexOf(\":\");if(A>=0){B=s.substr(0,A).toLowerCase();if(s.charAt(A+1)==\" \"){++A}C[B]=s.substr(A+1)}})}catch(z){}return{tId:u.tId,status:v?204:w.status,statusText:v?\"No Content\":w.statusText,getResponseHeader:function(s){return C[s.toLowerCase()]},getAllResponseHeaders:function(){return x},responseText:w.responseText,responseXML:w.responseXML,argument:y}}function o(s){if(s.tId){k.conn[s.tId]=null}s.conn=null;s=null}function f(x,y,t,s){if(!y){o(x);return}var v,u;try{if(x.conn.status!==undefined&&x.conn.status!=0){v=x.conn.status}else{v=13030}}catch(w){v=13030}if((v>=200&&v<300)||(Ext.isIE&&v==1223)){u=p(x,y.argument);if(y.success){if(!y.scope){y.success(u)}else{y.success.apply(y.scope,[u])}}}else{switch(v){case 12002:case 12029:case 12030:case 12031:case 12152:case 13030:u=e(x.tId,y.argument,(t?t:false),s);if(y.failure){if(!y.scope){y.failure(u)}else{y.failure.apply(y.scope,[u])}}break;default:u=p(x,y.argument);if(y.failure){if(!y.scope){y.failure(u)}else{y.failure.apply(y.scope,[u])}}}}o(x);u=null}function m(u,x,s,w,t,v){if(s&&s.readyState==4){clearInterval(t[w]);t[w]=null;if(v){clearTimeout(k.timeout[w]);k.timeout[w]=null}f(u,x)}}function r(s,t){k.abort(s,t,true)}function n(u,x){x=x||{};var s=u.conn,w=u.tId,t=k.poll,v=x.timeout||null;if(v){k.conn[w]=s;k.timeout[w]=setTimeout(r.createCallback(u,x),v)}t[w]=setInterval(m.createCallback(u,x,s,w,t,v),k.pollInterval)}function i(w,t,v,s){var u=l()||null;if(u){u.conn.open(w,t,true);if(k.useDefaultXhrHeader){j(\"X-Requested-With\",k.defaultXhrHeader)}if(s&&k.useDefaultHeader&&(!k.headers||!k.headers[d])){j(d,k.defaultPostHeader)}if(k.defaultHeaders||k.headers){h(u)}n(u,v);u.conn.send(s||null)}return u}function l(){var t;try{if(t=q(k.transactionId)){k.transactionId++}}catch(s){}finally{return t}}function q(v){var s;try{s=new XMLHttpRequest()}catch(u){for(var t=Ext.isIE6?1:0;t<g.length;++t){try{s=new ActiveXObject(g[t]);break}catch(u){}}}finally{return{conn:s,tId:v}}}var k={request:function(s,u,v,w,A){if(A){var x=this,t=A.xmlData,y=A.jsonData,z;Ext.applyIf(x,A);if(t||y){z=x.headers;if(!z||!z[d]){j(d,t?\"text/xml\":\"application/json\")}w=t||(!Ext.isPrimitive(y)?Ext.encode(y):y)}}return i(s||A.method||\"POST\",u,v,w)},serializeForm:function(y){var x=y.elements||(document.forms[y]||Ext.getDom(y)).elements,s=false,w=encodeURIComponent,t,z=\"\",v,u;Ext.each(x,function(A){t=A.name;v=A.type;if(!A.disabled&&t){if(/select-(one|multiple)/i.test(v)){Ext.each(A.options,function(B){if(B.selected){u=B.hasAttribute?B.hasAttribute(\"value\"):B.getAttributeNode(\"value\").specified;z+=String.format(\"{0}={1}&\",w(t),w(u?B.value:B.text))}})}else{if(!(/file|undefined|reset|button/i.test(v))){if(!(/radio|checkbox/i.test(v)&&!A.checked)&&!(v==\"submit\"&&s)){z+=w(t)+\"=\"+w(A.value)+\"&\";s=/submit/i.test(v)}}}}});return z.substr(0,z.length-1)},useDefaultHeader:true,defaultPostHeader:\"application/x-www-form-urlencoded; charset=UTF-8\",useDefaultXhrHeader:true,defaultXhrHeader:\"XMLHttpRequest\",poll:{},timeout:{},conn:{},pollInterval:50,transactionId:0,abort:function(v,x,s){var u=this,w=v.tId,t=false;if(u.isCallInProgress(v)){v.conn.abort();clearInterval(u.poll[w]);u.poll[w]=null;clearTimeout(k.timeout[w]);u.timeout[w]=null;f(v,x,(t=true),s)}return t},isCallInProgress:function(s){return s.conn&&!{0:true,4:true}[s.conn.readyState]}};return k}();(function(){var g=Ext.lib,i=/width|height|opacity|padding/i,f=/^((width|height)|(top|left))$/,d=/width|height|top$|bottom$|left$|right$/i,h=/\\d+(em|%|en|ex|pt|in|cm|mm|pc)$/i,j=function(k){return typeof k!==\"undefined\"},e=function(){return new Date()};g.Anim={motion:function(n,l,o,p,k,m){return this.run(n,l,o,p,k,m,Ext.lib.Motion)},run:function(o,l,q,r,k,n,m){m=m||Ext.lib.AnimBase;if(typeof r==\"string\"){r=Ext.lib.Easing[r]}var p=new m(o,l,q,r);p.animateX(function(){if(Ext.isFunction(k)){k.call(n)}});return p}};g.AnimBase=function(l,k,m,n){if(l){this.init(l,k,m,n)}};g.AnimBase.prototype={doMethod:function(k,n,l){var m=this;return m.method(m.curFrame,n,l-n,m.totalFrames)},setAttr:function(k,m,l){if(i.test(k)&&m<0){m=0}Ext.fly(this.el,\"_anim\").setStyle(k,m+l)},getAttr:function(k){var m=Ext.fly(this.el),n=m.getStyle(k),l=f.exec(k)||[];if(n!==\"auto\"&&!h.test(n)){return parseFloat(n)}return(!!(l[2])||(m.getStyle(\"position\")==\"absolute\"&&!!(l[3])))?m.dom[\"offset\"+l[0].charAt(0).toUpperCase()+l[0].substr(1)]:0},getDefaultUnit:function(k){return d.test(k)?\"px\":\"\"},animateX:function(n,k){var l=this,m=function(){l.onComplete.removeListener(m);if(Ext.isFunction(n)){n.call(k||l,l)}};l.onComplete.addListener(m,l);l.animate()},setRunAttr:function(p){var r=this,s=this.attributes[p],t=s.to,q=s.by,u=s.from,v=s.unit,l=(this.runAttrs[p]={}),m;if(!j(t)&&!j(q)){return false}var k=j(u)?u:r.getAttr(p);if(j(t)){m=t}else{if(j(q)){if(Ext.isArray(k)){m=[];for(var n=0,o=k.length;n<o;n++){m[n]=k[n]+q[n]}}else{m=k+q}}}Ext.apply(l,{start:k,end:m,unit:j(v)?v:r.getDefaultUnit(p)})},init:function(l,p,o,k){var r=this,n=0,s=g.AnimMgr;Ext.apply(r,{isAnimated:false,startTime:null,el:Ext.getDom(l),attributes:p||{},duration:o||1,method:k||g.Easing.easeNone,useSec:true,curFrame:0,totalFrames:s.fps,runAttrs:{},animate:function(){var u=this,v=u.duration;if(u.isAnimated){return false}u.curFrame=0;u.totalFrames=u.useSec?Math.ceil(s.fps*v):v;s.registerElement(u)},stop:function(u){var v=this;if(u){v.curFrame=v.totalFrames;v._onTween.fire()}s.stop(v)}});var t=function(){var v=this,u;v.onStart.fire();v.runAttrs={};for(u in this.attributes){this.setRunAttr(u)}v.isAnimated=true;v.startTime=e();n=0};var q=function(){var v=this;v.onTween.fire({duration:e()-v.startTime,curFrame:v.curFrame});var w=v.runAttrs;for(var u in w){this.setAttr(u,v.doMethod(u,w[u].start,w[u].end),w[u].unit)}++n};var m=function(){var u=this,w=(e()-u.startTime)/1000,v={duration:w,frames:n,fps:n/w};u.isAnimated=false;n=0;u.onComplete.fire(v)};r.onStart=new Ext.util.Event(r);r.onTween=new Ext.util.Event(r);r.onComplete=new Ext.util.Event(r);(r._onStart=new Ext.util.Event(r)).addListener(t);(r._onTween=new Ext.util.Event(r)).addListener(q);(r._onComplete=new Ext.util.Event(r)).addListener(m)}};Ext.lib.AnimMgr=new function(){var o=this,m=null,l=[],k=0;Ext.apply(o,{fps:1000,delay:1,registerElement:function(q){l.push(q);++k;q._onStart.fire();o.start()},unRegister:function(r,q){r._onComplete.fire();q=q||p(r);if(q!=-1){l.splice(q,1)}if(--k<=0){o.stop()}},start:function(){if(m===null){m=setInterval(o.run,o.delay)}},stop:function(s){if(!s){clearInterval(m);for(var r=0,q=l.length;r<q;++r){if(l[0].isAnimated){o.unRegister(l[0],0)}}l=[];m=null;k=0}else{o.unRegister(s)}},run:function(){var t,s,q,r;for(s=0,q=l.length;s<q;s++){r=l[s];if(r&&r.isAnimated){t=r.totalFrames;if(r.curFrame<t||t===null){++r.curFrame;if(r.useSec){n(r)}r._onTween.fire()}else{o.stop(r)}}}}});var p=function(s){var r,q;for(r=0,q=l.length;r<q;r++){if(l[r]===s){return r}}return -1};var n=function(r){var v=r.totalFrames,u=r.curFrame,t=r.duration,s=(u*t*1000/v),q=(e()-r.startTime),w=0;if(q<t*1000){w=Math.round((q/s-1)*u)}else{w=v-(u+1)}if(w>0&&isFinite(w)){if(r.curFrame+w>=v){w=v-(u+1)}r.curFrame+=w}}};g.Bezier=new function(){this.getPosition=function(p,o){var r=p.length,m=[],q=1-o,l,k;for(l=0;l<r;++l){m[l]=[p[l][0],p[l][1]]}for(k=1;k<r;++k){for(l=0;l<r-k;++l){m[l][0]=q*m[l][0]+o*m[parseInt(l+1,10)][0];m[l][1]=q*m[l][1]+o*m[parseInt(l+1,10)][1]}}return[m[0][0],m[0][1]]}};g.Easing={easeNone:function(l,k,n,m){return n*l/m+k},easeIn:function(l,k,n,m){return n*(l/=m)*l+k},easeOut:function(l,k,n,m){return -n*(l/=m)*(l-2)+k}};(function(){g.Motion=function(o,n,p,q){if(o){g.Motion.superclass.constructor.call(this,o,n,p,q)}};Ext.extend(g.Motion,Ext.lib.AnimBase);var m=g.Motion.superclass,l=/^points$/i;Ext.apply(g.Motion.prototype,{setAttr:function(n,r,q){var p=this,o=m.setAttr;if(l.test(n)){q=q||\"px\";o.call(p,\"left\",r[0],q);o.call(p,\"top\",r[1],q)}else{o.call(p,n,r,q)}},getAttr:function(n){var p=this,o=m.getAttr;return l.test(n)?[o.call(p,\"left\"),o.call(p,\"top\")]:o.call(p,n)},doMethod:function(n,q,o){var p=this;return l.test(n)?g.Bezier.getPosition(p.runAttrs[n],p.method(p.curFrame,0,100,p.totalFrames)/100):m.doMethod.call(p,n,q,o)},setRunAttr:function(u){if(l.test(u)){var w=this,p=this.el,z=this.attributes.points,s=z.control||[],x=z.from,y=z.to,v=z.by,A=g.Dom,o,r,q,t,n;if(s.length>0&&!Ext.isArray(s[0])){s=[s]}else{}Ext.fly(p,\"_anim\").position();A.setXY(p,j(x)?x:A.getXY(p));o=w.getAttr(\"points\");if(j(y)){q=k.call(w,y,o);for(r=0,t=s.length;r<t;++r){s[r]=k.call(w,s[r],o)}}else{if(j(v)){q=[o[0]+v[0],o[1]+v[1]];for(r=0,t=s.length;r<t;++r){s[r]=[o[0]+s[r][0],o[1]+s[r][1]]}}}n=this.runAttrs[u]=[o];if(s.length>0){n=n.concat(s)}n[n.length]=q}else{m.setRunAttr.call(this,u)}}});var k=function(n,p){var o=g.Dom.getXY(this.el);return[n[0]-o[0]+p[0],n[1]-o[1]+p[1]]}})()})();(function(){var d=Math.abs,i=Math.PI,h=Math.asin,g=Math.pow,e=Math.sin,f=Ext.lib;Ext.apply(f.Easing,{easeBoth:function(k,j,m,l){return((k/=l/2)<1)?m/2*k*k+j:-m/2*((--k)*(k-2)-1)+j},easeInStrong:function(k,j,m,l){return m*(k/=l)*k*k*k+j},easeOutStrong:function(k,j,m,l){return -m*((k=k/l-1)*k*k*k-1)+j},easeBothStrong:function(k,j,m,l){return((k/=l/2)<1)?m/2*k*k*k*k+j:-m/2*((k-=2)*k*k*k-2)+j},elasticIn:function(l,j,q,o,k,n){if(l==0||(l/=o)==1){return l==0?j:j+q}n=n||(o*0.3);var m;if(k>=d(q)){m=n/(2*i)*h(q/k)}else{k=q;m=n/4}return -(k*g(2,10*(l-=1))*e((l*o-m)*(2*i)/n))+j},elasticOut:function(l,j,q,o,k,n){if(l==0||(l/=o)==1){return l==0?j:j+q}n=n||(o*0.3);var m;if(k>=d(q)){m=n/(2*i)*h(q/k)}else{k=q;m=n/4}return k*g(2,-10*l)*e((l*o-m)*(2*i)/n)+q+j},elasticBoth:function(l,j,q,o,k,n){if(l==0||(l/=o/2)==2){return l==0?j:j+q}n=n||(o*(0.3*1.5));var m;if(k>=d(q)){m=n/(2*i)*h(q/k)}else{k=q;m=n/4}return l<1?-0.5*(k*g(2,10*(l-=1))*e((l*o-m)*(2*i)/n))+j:k*g(2,-10*(l-=1))*e((l*o-m)*(2*i)/n)*0.5+q+j},backIn:function(k,j,n,m,l){l=l||1.70158;return n*(k/=m)*k*((l+1)*k-l)+j},backOut:function(k,j,n,m,l){if(!l){l=1.70158}return n*((k=k/m-1)*k*((l+1)*k+l)+1)+j},backBoth:function(k,j,n,m,l){l=l||1.70158;return((k/=m/2)<1)?n/2*(k*k*(((l*=(1.525))+1)*k-l))+j:n/2*((k-=2)*k*(((l*=(1.525))+1)*k+l)+2)+j},bounceIn:function(k,j,m,l){return m-f.Easing.bounceOut(l-k,0,m,l)+j},bounceOut:function(k,j,m,l){if((k/=l)<(1/2.75)){return m*(7.5625*k*k)+j}else{if(k<(2/2.75)){return m*(7.5625*(k-=(1.5/2.75))*k+0.75)+j}else{if(k<(2.5/2.75)){return m*(7.5625*(k-=(2.25/2.75))*k+0.9375)+j}}}return m*(7.5625*(k-=(2.625/2.75))*k+0.984375)+j},bounceBoth:function(k,j,m,l){return(k<l/2)?f.Easing.bounceIn(k*2,0,m,l)*0.5+j:f.Easing.bounceOut(k*2-l,0,m,l)*0.5+m*0.5+j}})})();(function(){var h=Ext.lib;h.Anim.color=function(p,n,q,r,m,o){return h.Anim.run(p,n,q,r,m,o,h.ColorAnim)};h.ColorAnim=function(n,m,o,p){h.ColorAnim.superclass.constructor.call(this,n,m,o,p)};Ext.extend(h.ColorAnim,h.AnimBase);var j=h.ColorAnim.superclass,i=/color$/i,f=/^transparent|rgba\\(0, 0, 0, 0\\)$/,l=/^rgb\\(([0-9]+)\\s*,\\s*([0-9]+)\\s*,\\s*([0-9]+)\\)$/i,d=/^#?([0-9A-F]{2})([0-9A-F]{2})([0-9A-F]{2})$/i,e=/^#?([0-9A-F]{1})([0-9A-F]{1})([0-9A-F]{1})$/i,g=function(m){return typeof m!==\"undefined\"};function k(n){var p=parseInt,o,m=null,q;if(n.length==3){return n}Ext.each([d,l,e],function(s,r){o=(r%2==0)?16:10;q=s.exec(n);if(q&&q.length==4){m=[p(q[1],o),p(q[2],o),p(q[3],o)];return false}});return m}Ext.apply(h.ColorAnim.prototype,{getAttr:function(m){var o=this,n=o.el,p;if(i.test(m)){while(n&&f.test(p=Ext.fly(n).getStyle(m))){n=n.parentNode;p=\"fff\"}}else{p=j.getAttr.call(o,m)}return p},doMethod:function(s,m,o){var t=this,n,q=Math.floor,p,r,u;if(i.test(s)){n=[];o=o||[];for(p=0,r=m.length;p<r;p++){u=m[p];n[p]=j.doMethod.call(t,s,u,o[p])}n=\"rgb(\"+q(n[0])+\",\"+q(n[1])+\",\"+q(n[2])+\")\"}else{n=j.doMethod.call(t,s,m,o)}return n},setRunAttr:function(r){var t=this,u=t.attributes[r],v=u.to,s=u.by,n;j.setRunAttr.call(t,r);n=t.runAttrs[r];if(i.test(r)){var m=k(n.start),o=k(n.end);if(!g(v)&&g(s)){o=k(s);for(var p=0,q=m.length;p<q;p++){o[p]=m[p]+o[p]}}n.start=m;n.end=o}}})})();(function(){var d=Ext.lib;d.Anim.scroll=function(j,h,k,l,g,i){return d.Anim.run(j,h,k,l,g,i,d.Scroll)};d.Scroll=function(h,g,i,j){if(h){d.Scroll.superclass.constructor.call(this,h,g,i,j)}};Ext.extend(d.Scroll,d.ColorAnim);var f=d.Scroll.superclass,e=\"scroll\";Ext.apply(d.Scroll.prototype,{doMethod:function(g,m,h){var k,j=this,l=j.curFrame,i=j.totalFrames;if(g==e){k=[j.method(l,m[0],h[0]-m[0],i),j.method(l,m[1],h[1]-m[1],i)]}else{k=f.doMethod.call(j,g,m,h)}return k},getAttr:function(g){var h=this;if(g==e){return[h.el.scrollLeft,h.el.scrollTop]}else{return f.getAttr.call(h,g)}},setAttr:function(g,j,i){var h=this;if(g==e){h.el.scrollLeft=j[0];h.el.scrollTop=j[1]}else{f.setAttr.call(h,g,j,i)}}})})();if(Ext.isIE9m){function a(){var d=Function.prototype;delete d.createSequence;delete d.defer;delete d.createDelegate;delete d.createCallback;delete d.createInterceptor;window.detachEvent(\"onunload\",a)}window.attachEvent(\"onunload\",a)}})();"
  },
  {
    "path": "client/src/ext/ext-all-debug-w-comments.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n(function(){\n\nvar EXTUTIL = Ext.util,\n    EACH = Ext.each,\n    TRUE = true,\n    FALSE = false;\n/**\n * @class Ext.util.Observable\n * Base class that provides a common interface for publishing events. Subclasses are expected to\n * to have a property \"events\" with all the events defined, and, optionally, a property \"listeners\"\n * with configured listeners defined.<br>\n * For example:\n * <pre><code>\nEmployee = Ext.extend(Ext.util.Observable, {\n    constructor: function(config){\n        this.name = config.name;\n        this.addEvents({\n            \"fired\" : true,\n            \"quit\" : true\n        });\n\n        // Copy configured listeners into *this* object so that the base class&#39;s\n        // constructor will add them.\n        this.listeners = config.listeners;\n\n        // Call our superclass constructor to complete construction process.\n        Employee.superclass.constructor.call(this, config)\n    }\n});\n</code></pre>\n * This could then be used like this:<pre><code>\nvar newEmployee = new Employee({\n    name: employeeName,\n    listeners: {\n        quit: function() {\n            // By default, \"this\" will be the object that fired the event.\n            alert(this.name + \" has quit!\");\n        }\n    }\n});\n</code></pre>\n */\nEXTUTIL.Observable = function(){\n    /**\n     * @cfg {Object} listeners (optional) <p>A config object containing one or more event handlers to be added to this\n     * object during initialization.  This should be a valid listeners config object as specified in the\n     * {@link #addListener} example for attaching multiple handlers at once.</p>\n     * <br><p><b><u>DOM events from ExtJs {@link Ext.Component Components}</u></b></p>\n     * <br><p>While <i>some</i> ExtJs Component classes export selected DOM events (e.g. \"click\", \"mouseover\" etc), this\n     * is usually only done when extra value can be added. For example the {@link Ext.DataView DataView}'s\n     * <b><code>{@link Ext.DataView#click click}</code></b> event passing the node clicked on. To access DOM\n     * events directly from a Component's HTMLElement, listeners must be added to the <i>{@link Ext.Component#getEl Element}</i> after the Component\n     * has been rendered. A plugin can simplify this step:<pre><code>\n// Plugin is configured with a listeners config object.\n// The Component is appended to the argument list of all handler functions.\nExt.DomObserver = Ext.extend(Object, {\n    constructor: function(config) {\n        this.listeners = config.listeners ? config.listeners : config;\n    },\n\n    // Component passes itself into plugin&#39;s init method\n    init: function(c) {\n        var p, l = this.listeners;\n        for (p in l) {\n            if (Ext.isFunction(l[p])) {\n                l[p] = this.createHandler(l[p], c);\n            } else {\n                l[p].fn = this.createHandler(l[p].fn, c);\n            }\n        }\n\n        // Add the listeners to the Element immediately following the render call\n        c.render = c.render.{@link Function#createSequence createSequence}(function() {\n            var e = c.getEl();\n            if (e) {\n                e.on(l);\n            }\n        });\n    },\n\n    createHandler: function(fn, c) {\n        return function(e) {\n            fn.call(this, e, c);\n        };\n    }\n});\n\nvar combo = new Ext.form.ComboBox({\n\n    // Collapse combo when its element is clicked on\n    plugins: [ new Ext.DomObserver({\n        click: function(evt, comp) {\n            comp.collapse();\n        }\n    })],\n    store: myStore,\n    typeAhead: true,\n    mode: 'local',\n    triggerAction: 'all'\n});\n     * </code></pre></p>\n     */\n    var me = this, e = me.events;\n    if(me.listeners){\n        me.on(me.listeners);\n        delete me.listeners;\n    }\n    me.events = e || {};\n};\n\nEXTUTIL.Observable.prototype = {\n    // private\n    filterOptRe : /^(?:scope|delay|buffer|single)$/,\n\n    /**\n     * <p>Fires the specified event with the passed parameters (minus the event name).</p>\n     * <p>An event may be set to bubble up an Observable parent hierarchy (See {@link Ext.Component#getBubbleTarget})\n     * by calling {@link #enableBubble}.</p>\n     * @param {String} eventName The name of the event to fire.\n     * @param {Object...} args Variable number of parameters are passed to handlers.\n     * @return {Boolean} returns false if any of the handlers return false otherwise it returns true.\n     */\n    fireEvent : function(){\n        var a = Array.prototype.slice.call(arguments, 0),\n            ename = a[0].toLowerCase(),\n            me = this,\n            ret = TRUE,\n            ce = me.events[ename],\n            cc,\n            q,\n            c;\n        if (me.eventsSuspended === TRUE) {\n            if (q = me.eventQueue) {\n                q.push(a);\n            }\n        }\n        else if(typeof ce == 'object') {\n            if (ce.bubble){\n                if(ce.fire.apply(ce, a.slice(1)) === FALSE) {\n                    return FALSE;\n                }\n                c = me.getBubbleTarget && me.getBubbleTarget();\n                if(c && c.enableBubble) {\n                    cc = c.events[ename];\n                    if(!cc || typeof cc != 'object' || !cc.bubble) {\n                        c.enableBubble(ename);\n                    }\n                    return c.fireEvent.apply(c, a);\n                }\n            }\n            else {\n                a.shift();\n                ret = ce.fire.apply(ce, a);\n            }\n        }\n        return ret;\n    },\n\n    /**\n     * Appends an event handler to this object.\n     * @param {String}   eventName The name of the event to listen for.\n     * @param {Function} handler The method the event invokes.\n     * @param {Object}   scope (optional) The scope (<code><b>this</b></code> reference) in which the handler function is executed.\n     * <b>If omitted, defaults to the object which fired the event.</b>\n     * @param {Object}   options (optional) An object containing handler configuration.\n     * properties. This may contain any of the following properties:<ul>\n     * <li><b>scope</b> : Object<div class=\"sub-desc\">The scope (<code><b>this</b></code> reference) in which the handler function is executed.\n     * <b>If omitted, defaults to the object which fired the event.</b></div></li>\n     * <li><b>delay</b> : Number<div class=\"sub-desc\">The number of milliseconds to delay the invocation of the handler after the event fires.</div></li>\n     * <li><b>single</b> : Boolean<div class=\"sub-desc\">True to add a handler to handle just the next firing of the event, and then remove itself.</div></li>\n     * <li><b>buffer</b> : Number<div class=\"sub-desc\">Causes the handler to be scheduled to run in an {@link Ext.util.DelayedTask} delayed\n     * by the specified number of milliseconds. If the event fires again within that time, the original\n     * handler is <em>not</em> invoked, but the new handler is scheduled in its place.</div></li>\n     * <li><b>target</b> : Observable<div class=\"sub-desc\">Only call the handler if the event was fired on the target Observable, <i>not</i>\n     * if the event was bubbled up from a child Observable.</div></li>\n     * </ul><br>\n     * <p>\n     * <b>Combining Options</b><br>\n     * Using the options argument, it is possible to combine different types of listeners:<br>\n     * <br>\n     * A delayed, one-time listener.\n     * <pre><code>\nmyDataView.on('click', this.onClick, this, {\nsingle: true,\ndelay: 100\n});</code></pre>\n     * <p>\n     * <b>Attaching multiple handlers in 1 call</b><br>\n     * The method also allows for a single argument to be passed which is a config object containing properties\n     * which specify multiple handlers.\n     * <p>\n     * <pre><code>\nmyGridPanel.on({\n'click' : {\n    fn: this.onClick,\n    scope: this,\n    delay: 100\n},\n'mouseover' : {\n    fn: this.onMouseOver,\n    scope: this\n},\n'mouseout' : {\n    fn: this.onMouseOut,\n    scope: this\n}\n});</code></pre>\n * <p>\n * Or a shorthand syntax:<br>\n * <pre><code>\nmyGridPanel.on({\n'click' : this.onClick,\n'mouseover' : this.onMouseOver,\n'mouseout' : this.onMouseOut,\n scope: this\n});</code></pre>\n     */\n    addListener : function(eventName, fn, scope, o){\n        var me = this,\n            e,\n            oe,\n            ce;\n            \n        if (typeof eventName == 'object') {\n            o = eventName;\n            for (e in o) {\n                oe = o[e];\n                if (!me.filterOptRe.test(e)) {\n                    me.addListener(e, oe.fn || oe, oe.scope || o.scope, oe.fn ? oe : o);\n                }\n            }\n        } else {\n            eventName = eventName.toLowerCase();\n            ce = me.events[eventName] || TRUE;\n            if (typeof ce == 'boolean') {\n                me.events[eventName] = ce = new EXTUTIL.Event(me, eventName);\n            }\n            ce.addListener(fn, scope, typeof o == 'object' ? o : {});\n        }\n    },\n\n    /**\n     * Removes an event handler.\n     * @param {String}   eventName The type of event the handler was associated with.\n     * @param {Function} handler   The handler to remove. <b>This must be a reference to the function passed into the {@link #addListener} call.</b>\n     * @param {Object}   scope     (optional) The scope originally specified for the handler.\n     */\n    removeListener : function(eventName, fn, scope){\n        var ce = this.events[eventName.toLowerCase()];\n        if (typeof ce == 'object') {\n            ce.removeListener(fn, scope);\n        }\n    },\n\n    /**\n     * Removes all listeners for this object\n     */\n    purgeListeners : function(){\n        var events = this.events,\n            evt,\n            key;\n        for(key in events){\n            evt = events[key];\n            if(typeof evt == 'object'){\n                evt.clearListeners();\n            }\n        }\n    },\n\n    /**\n     * Adds the specified events to the list of events which this Observable may fire.\n     * @param {Object|String} o Either an object with event names as properties with a value of <code>true</code>\n     * or the first event name string if multiple event names are being passed as separate parameters.\n     * @param {string} Optional. Event name if multiple event names are being passed as separate parameters.\n     * Usage:<pre><code>\nthis.addEvents('storeloaded', 'storecleared');\n</code></pre>\n     */\n    addEvents : function(o){\n        var me = this;\n        me.events = me.events || {};\n        if (typeof o == 'string') {\n            var a = arguments,\n                i = a.length;\n            while(i--) {\n                me.events[a[i]] = me.events[a[i]] || TRUE;\n            }\n        } else {\n            Ext.applyIf(me.events, o);\n        }\n    },\n\n    /**\n     * Checks to see if this object has any listeners for a specified event\n     * @param {String} eventName The name of the event to check for\n     * @return {Boolean} True if the event is being listened for, else false\n     */\n    hasListener : function(eventName){\n        var e = this.events[eventName.toLowerCase()];\n        return typeof e == 'object' && e.listeners.length > 0;\n    },\n\n    /**\n     * Suspend the firing of all events. (see {@link #resumeEvents})\n     * @param {Boolean} queueSuspended Pass as true to queue up suspended events to be fired\n     * after the {@link #resumeEvents} call instead of discarding all suspended events;\n     */\n    suspendEvents : function(queueSuspended){\n        this.eventsSuspended = TRUE;\n        if(queueSuspended && !this.eventQueue){\n            this.eventQueue = [];\n        }\n    },\n\n    /**\n     * Resume firing events. (see {@link #suspendEvents})\n     * If events were suspended using the <tt><b>queueSuspended</b></tt> parameter, then all\n     * events fired during event suspension will be sent to any listeners now.\n     */\n    resumeEvents : function(){\n        var me = this,\n            queued = me.eventQueue || [];\n        me.eventsSuspended = FALSE;\n        delete me.eventQueue;\n        EACH(queued, function(e) {\n            me.fireEvent.apply(me, e);\n        });\n    }\n};\n\nvar OBSERVABLE = EXTUTIL.Observable.prototype;\n/**\n * Appends an event handler to this object (shorthand for {@link #addListener}.)\n * @param {String}   eventName     The type of event to listen for\n * @param {Function} handler       The method the event invokes\n * @param {Object}   scope         (optional) The scope (<code><b>this</b></code> reference) in which the handler function is executed.\n * <b>If omitted, defaults to the object which fired the event.</b>\n * @param {Object}   options       (optional) An object containing handler configuration.\n * @method\n */\nOBSERVABLE.on = OBSERVABLE.addListener;\n/**\n * Removes an event handler (shorthand for {@link #removeListener}.)\n * @param {String}   eventName     The type of event the handler was associated with.\n * @param {Function} handler       The handler to remove. <b>This must be a reference to the function passed into the {@link #addListener} call.</b>\n * @param {Object}   scope         (optional) The scope originally specified for the handler.\n * @method\n */\nOBSERVABLE.un = OBSERVABLE.removeListener;\n\n/**\n * Removes <b>all</b> added captures from the Observable.\n * @param {Observable} o The Observable to release\n * @static\n */\nEXTUTIL.Observable.releaseCapture = function(o){\n    o.fireEvent = OBSERVABLE.fireEvent;\n};\n\nfunction createTargeted(h, o, scope){\n    return function(){\n        if(o.target == arguments[0]){\n            h.apply(scope, Array.prototype.slice.call(arguments, 0));\n        }\n    };\n};\n\nfunction createBuffered(h, o, l, scope){\n    l.task = new EXTUTIL.DelayedTask();\n    return function(){\n        l.task.delay(o.buffer, h, scope, Array.prototype.slice.call(arguments, 0));\n    };\n};\n\nfunction createSingle(h, e, fn, scope){\n    return function(){\n        e.removeListener(fn, scope);\n        return h.apply(scope, arguments);\n    };\n};\n\nfunction createDelayed(h, o, l, scope){\n    return function(){\n        var task = new EXTUTIL.DelayedTask(),\n            args = Array.prototype.slice.call(arguments, 0);\n        if(!l.tasks) {\n            l.tasks = [];\n        }\n        l.tasks.push(task);\n        task.delay(o.delay || 10, function(){\n            l.tasks.remove(task);\n            h.apply(scope, args);\n        }, scope);\n    };\n};\n\nEXTUTIL.Event = function(obj, name){\n    this.name = name;\n    this.obj = obj;\n    this.listeners = [];\n};\n\nEXTUTIL.Event.prototype = {\n    addListener : function(fn, scope, options){\n        var me = this,\n            l;\n        scope = scope || me.obj;\n        if(!me.isListening(fn, scope)){\n            l = me.createListener(fn, scope, options);\n            if(me.firing){ // if we are currently firing this event, don't disturb the listener loop\n                me.listeners = me.listeners.slice(0);\n            }\n            me.listeners.push(l);\n        }\n    },\n\n    createListener: function(fn, scope, o){\n        o = o || {};\n        scope = scope || this.obj;\n        var l = {\n            fn: fn,\n            scope: scope,\n            options: o\n        }, h = fn;\n        if(o.target){\n            h = createTargeted(h, o, scope);\n        }\n        if(o.delay){\n            h = createDelayed(h, o, l, scope);\n        }\n        if(o.single){\n            h = createSingle(h, this, fn, scope);\n        }\n        if(o.buffer){\n            h = createBuffered(h, o, l, scope);\n        }\n        l.fireFn = h;\n        return l;\n    },\n\n    findListener : function(fn, scope){\n        var list = this.listeners,\n            i = list.length,\n            l;\n\n        scope = scope || this.obj;\n        while(i--){\n            l = list[i];\n            if(l){\n                if(l.fn == fn && l.scope == scope){\n                    return i;\n                }\n            }\n        }\n        return -1;\n    },\n\n    isListening : function(fn, scope){\n        return this.findListener(fn, scope) != -1;\n    },\n\n    removeListener : function(fn, scope){\n        var index,\n            l,\n            k,\n            me = this,\n            ret = FALSE;\n        if((index = me.findListener(fn, scope)) != -1){\n            if (me.firing) {\n                me.listeners = me.listeners.slice(0);\n            }\n            l = me.listeners[index];\n            if(l.task) {\n                l.task.cancel();\n                delete l.task;\n            }\n            k = l.tasks && l.tasks.length;\n            if(k) {\n                while(k--) {\n                    l.tasks[k].cancel();\n                }\n                delete l.tasks;\n            }\n            me.listeners.splice(index, 1);\n            ret = TRUE;\n        }\n        return ret;\n    },\n\n    // Iterate to stop any buffered/delayed events\n    clearListeners : function(){\n        var me = this,\n            l = me.listeners,\n            i = l.length;\n        while(i--) {\n            me.removeListener(l[i].fn, l[i].scope);\n        }\n    },\n\n    fire : function(){\n        var me = this,\n            listeners = me.listeners,\n            len = listeners.length,\n            i = 0,\n            l;\n\n        if(len > 0){\n            me.firing = TRUE;\n            var args = Array.prototype.slice.call(arguments, 0);\n            for (; i < len; i++) {\n                l = listeners[i];\n                if(l && l.fireFn.apply(l.scope || me.obj || window, args) === FALSE) {\n                    return (me.firing = FALSE);\n                }\n            }\n        }\n        me.firing = FALSE;\n        return TRUE;\n    }\n\n};\n})();\n/**\n * @class Ext.DomHelper\n * <p>The DomHelper class provides a layer of abstraction from DOM and transparently supports creating\n * elements via DOM or using HTML fragments. It also has the ability to create HTML fragment templates\n * from your DOM building code.</p>\n *\n * <p><b><u>DomHelper element specification object</u></b></p>\n * <p>A specification object is used when creating elements. Attributes of this object\n * are assumed to be element attributes, except for 4 special attributes:\n * <div class=\"mdetail-params\"><ul>\n * <li><b><tt>tag</tt></b> : <div class=\"sub-desc\">The tag name of the element</div></li>\n * <li><b><tt>children</tt></b> : or <tt>cn</tt><div class=\"sub-desc\">An array of the\n * same kind of element definition objects to be created and appended. These can be nested\n * as deep as you want.</div></li>\n * <li><b><tt>cls</tt></b> : <div class=\"sub-desc\">The class attribute of the element.\n * This will end up being either the \"class\" attribute on a HTML fragment or className\n * for a DOM node, depending on whether DomHelper is using fragments or DOM.</div></li>\n * <li><b><tt>html</tt></b> : <div class=\"sub-desc\">The innerHTML for the element</div></li>\n * </ul></div></p>\n *\n * <p><b><u>Insertion methods</u></b></p>\n * <p>Commonly used insertion methods:\n * <div class=\"mdetail-params\"><ul>\n * <li><b><tt>{@link #append}</tt></b> : <div class=\"sub-desc\"></div></li>\n * <li><b><tt>{@link #insertBefore}</tt></b> : <div class=\"sub-desc\"></div></li>\n * <li><b><tt>{@link #insertAfter}</tt></b> : <div class=\"sub-desc\"></div></li>\n * <li><b><tt>{@link #overwrite}</tt></b> : <div class=\"sub-desc\"></div></li>\n * <li><b><tt>{@link #createTemplate}</tt></b> : <div class=\"sub-desc\"></div></li>\n * <li><b><tt>{@link #insertHtml}</tt></b> : <div class=\"sub-desc\"></div></li>\n * </ul></div></p>\n *\n * <p><b><u>Example</u></b></p>\n * <p>This is an example, where an unordered list with 3 children items is appended to an existing\n * element with id <tt>'my-div'</tt>:<br>\n <pre><code>\nvar dh = Ext.DomHelper; // create shorthand alias\n// specification object\nvar spec = {\n    id: 'my-ul',\n    tag: 'ul',\n    cls: 'my-list',\n    // append children after creating\n    children: [     // may also specify 'cn' instead of 'children'\n        {tag: 'li', id: 'item0', html: 'List Item 0'},\n        {tag: 'li', id: 'item1', html: 'List Item 1'},\n        {tag: 'li', id: 'item2', html: 'List Item 2'}\n    ]\n};\nvar list = dh.append(\n    'my-div', // the context element 'my-div' can either be the id or the actual node\n    spec      // the specification object\n);\n </code></pre></p>\n * <p>Element creation specification parameters in this class may also be passed as an Array of\n * specification objects. This can be used to insert multiple sibling nodes into an existing\n * container very efficiently. For example, to add more list items to the example above:<pre><code>\ndh.append('my-ul', [\n    {tag: 'li', id: 'item3', html: 'List Item 3'},\n    {tag: 'li', id: 'item4', html: 'List Item 4'}\n]);\n * </code></pre></p>\n *\n * <p><b><u>Templating</u></b></p>\n * <p>The real power is in the built-in templating. Instead of creating or appending any elements,\n * <tt>{@link #createTemplate}</tt> returns a Template object which can be used over and over to\n * insert new elements. Revisiting the example above, we could utilize templating this time:\n * <pre><code>\n// create the node\nvar list = dh.append('my-div', {tag: 'ul', cls: 'my-list'});\n// get template\nvar tpl = dh.createTemplate({tag: 'li', id: 'item{0}', html: 'List Item {0}'});\n\nfor(var i = 0; i < 5, i++){\n    tpl.append(list, [i]); // use template to append to the actual node\n}\n * </code></pre></p>\n * <p>An example using a template:<pre><code>\nvar html = '<a id=\"{0}\" href=\"{1}\" class=\"nav\">{2}</a>';\n\nvar tpl = new Ext.DomHelper.createTemplate(html);\ntpl.append('blog-roll', ['link1', 'http://www.jackslocum.com/', \"Jack&#39;s Site\"]);\ntpl.append('blog-roll', ['link2', 'http://www.dustindiaz.com/', \"Dustin&#39;s Site\"]);\n * </code></pre></p>\n *\n * <p>The same example using named parameters:<pre><code>\nvar html = '<a id=\"{id}\" href=\"{url}\" class=\"nav\">{text}</a>';\n\nvar tpl = new Ext.DomHelper.createTemplate(html);\ntpl.append('blog-roll', {\n    id: 'link1',\n    url: 'http://www.jackslocum.com/',\n    text: \"Jack&#39;s Site\"\n});\ntpl.append('blog-roll', {\n    id: 'link2',\n    url: 'http://www.dustindiaz.com/',\n    text: \"Dustin&#39;s Site\"\n});\n * </code></pre></p>\n *\n * <p><b><u>Compiling Templates</u></b></p>\n * <p>Templates are applied using regular expressions. The performance is great, but if\n * you are adding a bunch of DOM elements using the same template, you can increase\n * performance even further by {@link Ext.Template#compile \"compiling\"} the template.\n * The way \"{@link Ext.Template#compile compile()}\" works is the template is parsed and\n * broken up at the different variable points and a dynamic function is created and eval'ed.\n * The generated function performs string concatenation of these parts and the passed\n * variables instead of using regular expressions.\n * <pre><code>\nvar html = '<a id=\"{id}\" href=\"{url}\" class=\"nav\">{text}</a>';\n\nvar tpl = new Ext.DomHelper.createTemplate(html);\ntpl.compile();\n\n//... use template like normal\n * </code></pre></p>\n *\n * <p><b><u>Performance Boost</u></b></p>\n * <p>DomHelper will transparently create HTML fragments when it can. Using HTML fragments instead\n * of DOM can significantly boost performance.</p>\n * <p>Element creation specification parameters may also be strings. If {@link #useDom} is <tt>false</tt>,\n * then the string is used as innerHTML. If {@link #useDom} is <tt>true</tt>, a string specification\n * results in the creation of a text node. Usage:</p>\n * <pre><code>\nExt.DomHelper.useDom = true; // force it to use DOM; reduces performance\n * </code></pre>\n * @singleton\n */\nExt.DomHelper = function(){\n    var tempTableEl = null,\n        emptyTags = /^(?:br|frame|hr|img|input|link|meta|range|spacer|wbr|area|param|col)$/i,\n        tableRe = /^table|tbody|tr|td$/i,\n        confRe = /tag|children|cn|html$/i,\n        tableElRe = /td|tr|tbody/i,\n        cssRe = /([a-z0-9-]+)\\s*:\\s*([^;\\s]+(?:\\s*[^;\\s]+)*);?/gi,\n        endRe = /end/i,\n        pub,\n        // kill repeat to save bytes\n        afterbegin = 'afterbegin',\n        afterend = 'afterend',\n        beforebegin = 'beforebegin',\n        beforeend = 'beforeend',\n        ts = '<table>',\n        te = '</table>',\n        tbs = ts+'<tbody>',\n        tbe = '</tbody>'+te,\n        trs = tbs + '<tr>',\n        tre = '</tr>'+tbe;\n\n    // private\n    function doInsert(el, o, returnElement, pos, sibling, append){\n        var newNode = pub.insertHtml(pos, Ext.getDom(el), createHtml(o));\n        return returnElement ? Ext.get(newNode, true) : newNode;\n    }\n\n    // build as innerHTML where available\n    function createHtml(o){\n        var b = '',\n            attr,\n            val,\n            key,\n            cn;\n\n        if(typeof o == \"string\"){\n            b = o;\n        } else if (Ext.isArray(o)) {\n            for (var i=0; i < o.length; i++) {\n                if(o[i]) {\n                    b += createHtml(o[i]);\n                }\n            };\n        } else {\n            b += '<' + (o.tag = o.tag || 'div');\n            for (attr in o) {\n                val = o[attr];\n                if(!confRe.test(attr)){\n                    if (typeof val == \"object\") {\n                        b += ' ' + attr + '=\"';\n                        for (key in val) {\n                            b += key + ':' + val[key] + ';';\n                        };\n                        b += '\"';\n                    }else{\n                        b += ' ' + ({cls : 'class', htmlFor : 'for'}[attr] || attr) + '=\"' + val + '\"';\n                    }\n                }\n            };\n            // Now either just close the tag or try to add children and close the tag.\n            if (emptyTags.test(o.tag)) {\n                b += '/>';\n            } else {\n                b += '>';\n                if ((cn = o.children || o.cn)) {\n                    b += createHtml(cn);\n                } else if(o.html){\n                    b += o.html;\n                }\n                b += '</' + o.tag + '>';\n            }\n        }\n        return b;\n    }\n\n    function ieTable(depth, s, h, e){\n        tempTableEl.innerHTML = [s, h, e].join('');\n        var i = -1,\n            el = tempTableEl,\n            ns;\n        while(++i < depth){\n            el = el.firstChild;\n        }\n//      If the result is multiple siblings, then encapsulate them into one fragment.\n        if(ns = el.nextSibling){\n            var df = document.createDocumentFragment();\n            while(el){\n                ns = el.nextSibling;\n                df.appendChild(el);\n                el = ns;\n            }\n            el = df;\n        }\n        return el;\n    }\n\n    /**\n     * @ignore\n     * Nasty code for IE's broken table implementation\n     */\n    function insertIntoTable(tag, where, el, html) {\n        var node,\n            before;\n\n        tempTableEl = tempTableEl || document.createElement('div');\n\n        if(tag == 'td' && (where == afterbegin || where == beforeend) ||\n           !tableElRe.test(tag) && (where == beforebegin || where == afterend)) {\n            return;\n        }\n        before = where == beforebegin ? el :\n                 where == afterend ? el.nextSibling :\n                 where == afterbegin ? el.firstChild : null;\n\n        if (where == beforebegin || where == afterend) {\n            el = el.parentNode;\n        }\n\n        if (tag == 'td' || (tag == 'tr' && (where == beforeend || where == afterbegin))) {\n            node = ieTable(4, trs, html, tre);\n        } else if ((tag == 'tbody' && (where == beforeend || where == afterbegin)) ||\n                   (tag == 'tr' && (where == beforebegin || where == afterend))) {\n            node = ieTable(3, tbs, html, tbe);\n        } else {\n            node = ieTable(2, ts, html, te);\n        }\n        el.insertBefore(node, before);\n        return node;\n    }\n\n    /**\n     * @ignore\n     * Fix for IE9 createContextualFragment missing method\n     */   \n    function createContextualFragment(html){\n        var div = document.createElement(\"div\"),\n            fragment = document.createDocumentFragment(),\n            i = 0,\n            length, childNodes;\n        \n        div.innerHTML = html;\n        childNodes = div.childNodes;\n        length = childNodes.length;\n        \n        for (; i < length; i++) {\n            fragment.appendChild(childNodes[i].cloneNode(true));\n        }\n        \n        return fragment;\n    }\n    \n    pub = {\n        /**\n         * Returns the markup for the passed Element(s) config.\n         * @param {Object} o The DOM object spec (and children)\n         * @return {String}\n         */\n        markup : function(o){\n            return createHtml(o);\n        },\n\n        /**\n         * Applies a style specification to an element.\n         * @param {String/HTMLElement} el The element to apply styles to\n         * @param {String/Object/Function} styles A style specification string e.g. 'width:100px', or object in the form {width:'100px'}, or\n         * a function which returns such a specification.\n         */\n        applyStyles : function(el, styles){\n            if (styles) {\n                var matches;\n\n                el = Ext.fly(el);\n                if (typeof styles == \"function\") {\n                    styles = styles.call();\n                }\n                if (typeof styles == \"string\") {\n                    /**\n                     * Since we're using the g flag on the regex, we need to set the lastIndex.\n                     * This automatically happens on some implementations, but not others, see:\n                     * http://stackoverflow.com/questions/2645273/javascript-regular-expression-literal-persists-between-function-calls\n                     * http://blog.stevenlevithan.com/archives/fixing-javascript-regexp\n                     */\n                    cssRe.lastIndex = 0;\n                    while ((matches = cssRe.exec(styles))) {\n                        el.setStyle(matches[1], matches[2]);\n                    }\n                } else if (typeof styles == \"object\") {\n                    el.setStyle(styles);\n                }\n            }\n        },\n        /**\n         * Inserts an HTML fragment into the DOM.\n         * @param {String} where Where to insert the html in relation to el - beforeBegin, afterBegin, beforeEnd, afterEnd.\n         * @param {HTMLElement} el The context element\n         * @param {String} html The HTML fragment\n         * @return {HTMLElement} The new node\n         */\n        insertHtml : function(where, el, html){\n            var hash = {},\n                hashVal,\n                range,\n                rangeEl,\n                setStart,\n                frag,\n                rs;\n\n            where = where.toLowerCase();\n            // add these here because they are used in both branches of the condition.\n            hash[beforebegin] = ['BeforeBegin', 'previousSibling'];\n            hash[afterend] = ['AfterEnd', 'nextSibling'];\n\n            if (el.insertAdjacentHTML) {\n                if(tableRe.test(el.tagName) && (rs = insertIntoTable(el.tagName.toLowerCase(), where, el, html))){\n                    return rs;\n                }\n                // add these two to the hash.\n                hash[afterbegin] = ['AfterBegin', 'firstChild'];\n                hash[beforeend] = ['BeforeEnd', 'lastChild'];\n                if ((hashVal = hash[where])) {\n                    el.insertAdjacentHTML(hashVal[0], html);\n                    return el[hashVal[1]];\n                }\n            } else {\n                range = el.ownerDocument.createRange();\n                setStart = 'setStart' + (endRe.test(where) ? 'After' : 'Before');\n                if (hash[where]) {\n                    range[setStart](el);\n                    if (!range.createContextualFragment) {\n                        frag = createContextualFragment(html);\n                    }\n                    else {\n                        frag = range.createContextualFragment(html);\n                    }\n                    el.parentNode.insertBefore(frag, where == beforebegin ? el : el.nextSibling);\n                    return el[(where == beforebegin ? 'previous' : 'next') + 'Sibling'];\n                } else {\n                    rangeEl = (where == afterbegin ? 'first' : 'last') + 'Child';\n                    if (el.firstChild) {\n                        range[setStart](el[rangeEl]);\n                        if (!range.createContextualFragment) {\n                            frag = createContextualFragment(html);\n                        }\n                        else {\n                            frag = range.createContextualFragment(html);\n                        }\n                        if(where == afterbegin){\n                            el.insertBefore(frag, el.firstChild);\n                        }else{\n                            el.appendChild(frag);\n                        }\n                    } else {\n                        el.innerHTML = html;\n                    }\n                    return el[rangeEl];\n                }\n            }\n            throw 'Illegal insertion point -> \"' + where + '\"';\n        },\n\n        /**\n         * Creates new DOM element(s) and inserts them before el.\n         * @param {Mixed} el The context element\n         * @param {Object/String} o The DOM object spec (and children) or raw HTML blob\n         * @param {Boolean} returnElement (optional) true to return a Ext.Element\n         * @return {HTMLElement/Ext.Element} The new node\n         */\n        insertBefore : function(el, o, returnElement){\n            return doInsert(el, o, returnElement, beforebegin);\n        },\n\n        /**\n         * Creates new DOM element(s) and inserts them after el.\n         * @param {Mixed} el The context element\n         * @param {Object} o The DOM object spec (and children)\n         * @param {Boolean} returnElement (optional) true to return a Ext.Element\n         * @return {HTMLElement/Ext.Element} The new node\n         */\n        insertAfter : function(el, o, returnElement){\n            return doInsert(el, o, returnElement, afterend, 'nextSibling');\n        },\n\n        /**\n         * Creates new DOM element(s) and inserts them as the first child of el.\n         * @param {Mixed} el The context element\n         * @param {Object/String} o The DOM object spec (and children) or raw HTML blob\n         * @param {Boolean} returnElement (optional) true to return a Ext.Element\n         * @return {HTMLElement/Ext.Element} The new node\n         */\n        insertFirst : function(el, o, returnElement){\n            return doInsert(el, o, returnElement, afterbegin, 'firstChild');\n        },\n\n        /**\n         * Creates new DOM element(s) and appends them to el.\n         * @param {Mixed} el The context element\n         * @param {Object/String} o The DOM object spec (and children) or raw HTML blob\n         * @param {Boolean} returnElement (optional) true to return a Ext.Element\n         * @return {HTMLElement/Ext.Element} The new node\n         */\n        append : function(el, o, returnElement){\n            return doInsert(el, o, returnElement, beforeend, '', true);\n        },\n\n        /**\n         * Creates new DOM element(s) and overwrites the contents of el with them.\n         * @param {Mixed} el The context element\n         * @param {Object/String} o The DOM object spec (and children) or raw HTML blob\n         * @param {Boolean} returnElement (optional) true to return a Ext.Element\n         * @return {HTMLElement/Ext.Element} The new node\n         */\n        overwrite : function(el, o, returnElement){\n            el = Ext.getDom(el);\n            el.innerHTML = createHtml(o);\n            return returnElement ? Ext.get(el.firstChild) : el.firstChild;\n        },\n\n        createHtml : createHtml\n    };\n    return pub;\n}();\n/**\n * @class Ext.Template\n * <p>Represents an HTML fragment template. Templates may be {@link #compile precompiled}\n * for greater performance.</p>\n * <p>For example usage {@link #Template see the constructor}.</p>\n *\n * @constructor\n * An instance of this class may be created by passing to the constructor either\n * a single argument, or multiple arguments:\n * <div class=\"mdetail-params\"><ul>\n * <li><b>single argument</b> : String/Array\n * <div class=\"sub-desc\">\n * The single argument may be either a String or an Array:<ul>\n * <li><tt>String</tt> : </li><pre><code>\nvar t = new Ext.Template(\"&lt;div>Hello {0}.&lt;/div>\");\nt.{@link #append}('some-element', ['foo']);\n * </code></pre>\n * <li><tt>Array</tt> : </li>\n * An Array will be combined with <code>join('')</code>.\n<pre><code>\nvar t = new Ext.Template([\n    '&lt;div name=\"{id}\"&gt;',\n        '&lt;span class=\"{cls}\"&gt;{name:trim} {value:ellipsis(10)}&lt;/span&gt;',\n    '&lt;/div&gt;',\n]);\nt.{@link #compile}();\nt.{@link #append}('some-element', {id: 'myid', cls: 'myclass', name: 'foo', value: 'bar'});\n</code></pre>\n * </ul></div></li>\n * <li><b>multiple arguments</b> : String, Object, Array, ...\n * <div class=\"sub-desc\">\n * Multiple arguments will be combined with <code>join('')</code>.\n * <pre><code>\nvar t = new Ext.Template(\n    '&lt;div name=\"{id}\"&gt;',\n        '&lt;span class=\"{cls}\"&gt;{name} {value}&lt;/span&gt;',\n    '&lt;/div&gt;',\n    // a configuration object:\n    {\n        compiled: true,      // {@link #compile} immediately\n        disableFormats: true // See Notes below.\n    }\n);\n * </code></pre>\n * <p><b>Notes</b>:</p>\n * <div class=\"mdetail-params\"><ul>\n * <li>Formatting and <code>disableFormats</code> are not applicable for Ext Core.</li>\n * <li>For a list of available format functions, see {@link Ext.util.Format}.</li>\n * <li><code>disableFormats</code> reduces <code>{@link #apply}</code> time\n * when no formatting is required.</li>\n * </ul></div>\n * </div></li>\n * </ul></div>\n * @param {Mixed} config\n */\nExt.Template = function(html){\n    var me = this,\n        a = arguments,\n        buf = [],\n        v;\n\n    if (Ext.isArray(html)) {\n        html = html.join(\"\");\n    } else if (a.length > 1) {\n        for(var i = 0, len = a.length; i < len; i++){\n            v = a[i];\n            if(typeof v == 'object'){\n                Ext.apply(me, v);\n            } else {\n                buf.push(v);\n            }\n        };\n        html = buf.join('');\n    }\n\n    /**@private*/\n    me.html = html;\n    /**\n     * @cfg {Boolean} compiled Specify <tt>true</tt> to compile the template\n     * immediately (see <code>{@link #compile}</code>).\n     * Defaults to <tt>false</tt>.\n     */\n    if (me.compiled) {\n        me.compile();\n    }\n};\nExt.Template.prototype = {\n    /**\n     * @cfg {RegExp} re The regular expression used to match template variables.\n     * Defaults to:<pre><code>\n     * re : /\\{([\\w\\-]+)\\}/g                                     // for Ext Core\n     * re : /\\{([\\w\\-]+)(?:\\:([\\w\\.]*)(?:\\((.*?)?\\))?)?\\}/g      // for Ext JS\n     * </code></pre>\n     */\n    re : /\\{([\\w\\-]+)\\}/g,\n    /**\n     * See <code>{@link #re}</code>.\n     * @type RegExp\n     * @property re\n     */\n\n    /**\n     * Returns an HTML fragment of this template with the specified <code>values</code> applied.\n     * @param {Object/Array} values\n     * The template values. Can be an array if the params are numeric (i.e. <code>{0}</code>)\n     * or an object (i.e. <code>{foo: 'bar'}</code>).\n     * @return {String} The HTML fragment\n     */\n    applyTemplate : function(values){\n        var me = this;\n\n        return me.compiled ?\n                me.compiled(values) :\n                me.html.replace(me.re, function(m, name){\n                    return values[name] !== undefined ? values[name] : \"\";\n                });\n    },\n\n    /**\n     * Sets the HTML used as the template and optionally compiles it.\n     * @param {String} html\n     * @param {Boolean} compile (optional) True to compile the template (defaults to undefined)\n     * @return {Ext.Template} this\n     */\n    set : function(html, compile){\n        var me = this;\n        me.html = html;\n        me.compiled = null;\n        return compile ? me.compile() : me;\n    },\n\n    /**\n     * Compiles the template into an internal function, eliminating the RegEx overhead.\n     * @return {Ext.Template} this\n     */\n    compile : function(){\n        var me = this,\n            sep = Ext.isGecko ? \"+\" : \",\";\n\n        function fn(m, name){\n            name = \"values['\" + name + \"']\";\n            return \"'\"+ sep + '(' + name + \" == undefined ? '' : \" + name + ')' + sep + \"'\";\n        }\n\n        eval(\"this.compiled = function(values){ return \" + (Ext.isGecko ? \"'\" : \"['\") +\n             me.html.replace(/\\\\/g, '\\\\\\\\').replace(/(\\r\\n|\\n)/g, '\\\\n').replace(/'/g, \"\\\\'\").replace(this.re, fn) +\n             (Ext.isGecko ?  \"';};\" : \"'].join('');};\"));\n        return me;\n    },\n\n    /**\n     * Applies the supplied values to the template and inserts the new node(s) as the first child of el.\n     * @param {Mixed} el The context element\n     * @param {Object/Array} values The template values. Can be an array if your params are numeric (i.e. {0}) or an object (i.e. {foo: 'bar'})\n     * @param {Boolean} returnElement (optional) true to return a Ext.Element (defaults to undefined)\n     * @return {HTMLElement/Ext.Element} The new node or Element\n     */\n    insertFirst: function(el, values, returnElement){\n        return this.doInsert('afterBegin', el, values, returnElement);\n    },\n\n    /**\n     * Applies the supplied values to the template and inserts the new node(s) before el.\n     * @param {Mixed} el The context element\n     * @param {Object/Array} values The template values. Can be an array if your params are numeric (i.e. {0}) or an object (i.e. {foo: 'bar'})\n     * @param {Boolean} returnElement (optional) true to return a Ext.Element (defaults to undefined)\n     * @return {HTMLElement/Ext.Element} The new node or Element\n     */\n    insertBefore: function(el, values, returnElement){\n        return this.doInsert('beforeBegin', el, values, returnElement);\n    },\n\n    /**\n     * Applies the supplied values to the template and inserts the new node(s) after el.\n     * @param {Mixed} el The context element\n     * @param {Object/Array} values The template values. Can be an array if your params are numeric (i.e. {0}) or an object (i.e. {foo: 'bar'})\n     * @param {Boolean} returnElement (optional) true to return a Ext.Element (defaults to undefined)\n     * @return {HTMLElement/Ext.Element} The new node or Element\n     */\n    insertAfter : function(el, values, returnElement){\n        return this.doInsert('afterEnd', el, values, returnElement);\n    },\n\n    /**\n     * Applies the supplied <code>values</code> to the template and appends\n     * the new node(s) to the specified <code>el</code>.\n     * <p>For example usage {@link #Template see the constructor}.</p>\n     * @param {Mixed} el The context element\n     * @param {Object/Array} values\n     * The template values. Can be an array if the params are numeric (i.e. <code>{0}</code>)\n     * or an object (i.e. <code>{foo: 'bar'}</code>).\n     * @param {Boolean} returnElement (optional) true to return an Ext.Element (defaults to undefined)\n     * @return {HTMLElement/Ext.Element} The new node or Element\n     */\n    append : function(el, values, returnElement){\n        return this.doInsert('beforeEnd', el, values, returnElement);\n    },\n\n    doInsert : function(where, el, values, returnEl){\n        el = Ext.getDom(el);\n        var newNode = Ext.DomHelper.insertHtml(where, el, this.applyTemplate(values));\n        return returnEl ? Ext.get(newNode, true) : newNode;\n    },\n\n    /**\n     * Applies the supplied values to the template and overwrites the content of el with the new node(s).\n     * @param {Mixed} el The context element\n     * @param {Object/Array} values The template values. Can be an array if your params are numeric (i.e. {0}) or an object (i.e. {foo: 'bar'})\n     * @param {Boolean} returnElement (optional) true to return a Ext.Element (defaults to undefined)\n     * @return {HTMLElement/Ext.Element} The new node or Element\n     */\n    overwrite : function(el, values, returnElement){\n        el = Ext.getDom(el);\n        el.innerHTML = this.applyTemplate(values);\n        return returnElement ? Ext.get(el.firstChild, true) : el.firstChild;\n    }\n};\n/**\n * Alias for {@link #applyTemplate}\n * Returns an HTML fragment of this template with the specified <code>values</code> applied.\n * @param {Object/Array} values\n * The template values. Can be an array if the params are numeric (i.e. <code>{0}</code>)\n * or an object (i.e. <code>{foo: 'bar'}</code>).\n * @return {String} The HTML fragment\n * @member Ext.Template\n * @method apply\n */\nExt.Template.prototype.apply = Ext.Template.prototype.applyTemplate;\n\n/**\n * Creates a template from the passed element's value (<i>display:none</i> textarea, preferred) or innerHTML.\n * @param {String/HTMLElement} el A DOM element or its id\n * @param {Object} config A configuration object\n * @return {Ext.Template} The created template\n * @static\n */\nExt.Template.from = function(el, config){\n    el = Ext.getDom(el);\n    return new Ext.Template(el.value || el.innerHTML, config || '');\n};\n/*\n * This is code is also distributed under MIT license for use\n * with jQuery and prototype JavaScript libraries.\n */\n/**\n * @class Ext.DomQuery\nProvides high performance selector/xpath processing by compiling queries into reusable functions. New pseudo classes and matchers can be plugged. It works on HTML and XML documents (if a content node is passed in).\n<p>\nDomQuery supports most of the <a href=\"http://www.w3.org/TR/2005/WD-css3-selectors-20051215/#selectors\">CSS3 selectors spec</a>, along with some custom selectors and basic XPath.</p>\n\n<p>\nAll selectors, attribute filters and pseudos below can be combined infinitely in any order. For example \"div.foo:nth-child(odd)[@foo=bar].bar:first\" would be a perfectly valid selector. Node filters are processed in the order in which they appear, which allows you to optimize your queries for your document structure.\n</p>\n<h4>Element Selectors:</h4>\n<ul class=\"list\">\n    <li> <b>*</b> any element</li>\n    <li> <b>E</b> an element with the tag E</li>\n    <li> <b>E F</b> All descendent elements of E that have the tag F</li>\n    <li> <b>E > F</b> or <b>E/F</b> all direct children elements of E that have the tag F</li>\n    <li> <b>E + F</b> all elements with the tag F that are immediately preceded by an element with the tag E</li>\n    <li> <b>E ~ F</b> all elements with the tag F that are preceded by a sibling element with the tag E</li>\n</ul>\n<h4>Attribute Selectors:</h4>\n<p>The use of &#64; and quotes are optional. For example, div[&#64;foo='bar'] is also a valid attribute selector.</p>\n<ul class=\"list\">\n    <li> <b>E[foo]</b> has an attribute \"foo\"</li>\n    <li> <b>E[foo=bar]</b> has an attribute \"foo\" that equals \"bar\"</li>\n    <li> <b>E[foo^=bar]</b> has an attribute \"foo\" that starts with \"bar\"</li>\n    <li> <b>E[foo$=bar]</b> has an attribute \"foo\" that ends with \"bar\"</li>\n    <li> <b>E[foo*=bar]</b> has an attribute \"foo\" that contains the substring \"bar\"</li>\n    <li> <b>E[foo%=2]</b> has an attribute \"foo\" that is evenly divisible by 2</li>\n    <li> <b>E[foo!=bar]</b> attribute \"foo\" does not equal \"bar\"</li>\n</ul>\n<h4>Pseudo Classes:</h4>\n<ul class=\"list\">\n    <li> <b>E:first-child</b> E is the first child of its parent</li>\n    <li> <b>E:last-child</b> E is the last child of its parent</li>\n    <li> <b>E:nth-child(<i>n</i>)</b> E is the <i>n</i>th child of its parent (1 based as per the spec)</li>\n    <li> <b>E:nth-child(odd)</b> E is an odd child of its parent</li>\n    <li> <b>E:nth-child(even)</b> E is an even child of its parent</li>\n    <li> <b>E:only-child</b> E is the only child of its parent</li>\n    <li> <b>E:checked</b> E is an element that is has a checked attribute that is true (e.g. a radio or checkbox) </li>\n    <li> <b>E:first</b> the first E in the resultset</li>\n    <li> <b>E:last</b> the last E in the resultset</li>\n    <li> <b>E:nth(<i>n</i>)</b> the <i>n</i>th E in the resultset (1 based)</li>\n    <li> <b>E:odd</b> shortcut for :nth-child(odd)</li>\n    <li> <b>E:even</b> shortcut for :nth-child(even)</li>\n    <li> <b>E:contains(foo)</b> E's innerHTML contains the substring \"foo\"</li>\n    <li> <b>E:nodeValue(foo)</b> E contains a textNode with a nodeValue that equals \"foo\"</li>\n    <li> <b>E:not(S)</b> an E element that does not match simple selector S</li>\n    <li> <b>E:has(S)</b> an E element that has a descendent that matches simple selector S</li>\n    <li> <b>E:next(S)</b> an E element whose next sibling matches simple selector S</li>\n    <li> <b>E:prev(S)</b> an E element whose previous sibling matches simple selector S</li>\n    <li> <b>E:any(S1|S2|S2)</b> an E element which matches any of the simple selectors S1, S2 or S3//\\\\</li>\n</ul>\n<h4>CSS Value Selectors:</h4>\n<ul class=\"list\">\n    <li> <b>E{display=none}</b> css value \"display\" that equals \"none\"</li>\n    <li> <b>E{display^=none}</b> css value \"display\" that starts with \"none\"</li>\n    <li> <b>E{display$=none}</b> css value \"display\" that ends with \"none\"</li>\n    <li> <b>E{display*=none}</b> css value \"display\" that contains the substring \"none\"</li>\n    <li> <b>E{display%=2}</b> css value \"display\" that is evenly divisible by 2</li>\n    <li> <b>E{display!=none}</b> css value \"display\" that does not equal \"none\"</li>\n</ul>\n * @singleton\n */\nExt.DomQuery = function(){\n    var cache = {}, \n    \tsimpleCache = {}, \n    \tvalueCache = {},\n    \tnonSpace = /\\S/,\n    \ttrimRe = /^\\s+|\\s+$/g,\n    \ttplRe = /\\{(\\d+)\\}/g,\n    \tmodeRe = /^(\\s?[\\/>+~]\\s?|\\s|$)/,\n    \ttagTokenRe = /^(#)?([\\w\\-\\*]+)/,\n    \tnthRe = /(\\d*)n\\+?(\\d*)/, \n    \tnthRe2 = /\\D/,\n    \t// This is for IE MSXML which does not support expandos.\n\t// IE runs the same speed using setAttribute, however FF slows way down\n\t// and Safari completely fails so they need to continue to use expandos.\n\tisIE = window.ActiveXObject ? true : false,\n\tkey = 30803;\n    \n    // this eval is stop the compressor from\n    // renaming the variable to something shorter\n    eval(\"var batch = 30803;\");    \t\n\n    // Retrieve the child node from a particular\n    // parent at the specified index.\n    function child(parent, index){\n        var i = 0,\n            n = parent.firstChild;\n        while(n){\n            if(n.nodeType == 1){\n               if(++i == index){\n                   return n;\n               }\n            }\n            n = n.nextSibling;\n        }\n        return null;\n    }\n\n    // retrieve the next element node\n    function next(n){\t\n        while((n = n.nextSibling) && n.nodeType != 1);\n        return n;\n    }\n\n    // retrieve the previous element node \n    function prev(n){\n        while((n = n.previousSibling) && n.nodeType != 1);\n        return n;\n    }\n\n    // Mark each child node with a nodeIndex skipping and\n    // removing empty text nodes.\n    function children(parent){\n        var n = parent.firstChild,\n\t    nodeIndex = -1,\n\t    nextNode;\n\twhile(n){\n\t    nextNode = n.nextSibling;\n\t    // clean worthless empty nodes.\n\t    if(n.nodeType == 3 && !nonSpace.test(n.nodeValue)){\n\t\tparent.removeChild(n);\n\t    }else{\n\t\t// add an expando nodeIndex\n\t\tn.nodeIndex = ++nodeIndex;\n\t    }\n\t    n = nextNode;\n\t}\n\treturn this;\n    }\n\n\n    // nodeSet - array of nodes\n    // cls - CSS Class\n    function byClassName(nodeSet, cls){\n        if(!cls){\n            return nodeSet;\n        }\n        var result = [], ri = -1;\n        for(var i = 0, ci; ci = nodeSet[i]; i++){\n            if((' '+ci.className+' ').indexOf(cls) != -1){\n                result[++ri] = ci;\n            }\n        }\n        return result;\n    };\n\n    function attrValue(n, attr){\n\t// if its an array, use the first node.\n        if(!n.tagName && typeof n.length != \"undefined\"){\n            n = n[0];\n        }\n        if(!n){\n            return null;\n        }\n\n        if(attr == \"for\"){\n            return n.htmlFor;\n        }\n        if(attr == \"class\" || attr == \"className\"){\n            return n.className;\n        }\n        return n.getAttribute(attr) || n[attr];\n\n    };\n\n\n    // ns - nodes\n    // mode - false, /, >, +, ~\n    // tagName - defaults to \"*\"\n    function getNodes(ns, mode, tagName){\n        var result = [], ri = -1, cs;\n        if(!ns){\n            return result;\n        }\n        tagName = tagName || \"*\";\n\t// convert to array\n        if(typeof ns.getElementsByTagName != \"undefined\"){\n            ns = [ns];\n        }\n\t\n\t// no mode specified, grab all elements by tagName\n\t// at any depth\n        if(!mode){\n            for(var i = 0, ni; ni = ns[i]; i++){\n                cs = ni.getElementsByTagName(tagName);\n                for(var j = 0, ci; ci = cs[j]; j++){\n                    result[++ri] = ci;\n                }\n            }\n\t// Direct Child mode (/ or >)\n\t// E > F or E/F all direct children elements of E that have the tag \t\n        } else if(mode == \"/\" || mode == \">\"){\n            var utag = tagName.toUpperCase();\n            for(var i = 0, ni, cn; ni = ns[i]; i++){\n                cn = ni.childNodes;\n                for(var j = 0, cj; cj = cn[j]; j++){\n                    if(cj.nodeName == utag || cj.nodeName == tagName  || tagName == '*'){\n                        result[++ri] = cj;\n                    }\n                }\n            }\n\t// Immediately Preceding mode (+)\n\t// E + F all elements with the tag F that are immediately preceded by an element with the tag E\n        }else if(mode == \"+\"){\n            var utag = tagName.toUpperCase();\n            for(var i = 0, n; n = ns[i]; i++){\n                while((n = n.nextSibling) && n.nodeType != 1);\n                if(n && (n.nodeName == utag || n.nodeName == tagName || tagName == '*')){\n                    result[++ri] = n;\n                }\n            }\n\t// Sibling mode (~)\n\t// E ~ F all elements with the tag F that are preceded by a sibling element with the tag E\n        }else if(mode == \"~\"){\n            var utag = tagName.toUpperCase();\n            for(var i = 0, n; n = ns[i]; i++){\n                while((n = n.nextSibling)){\n                    if (n.nodeName == utag || n.nodeName == tagName || tagName == '*'){\n                        result[++ri] = n;\n                    }\n                }\n            }\n        }\n        return result;\n    }\n\n    function concat(a, b){\n        if(b.slice){\n            return a.concat(b);\n        }\n        for(var i = 0, l = b.length; i < l; i++){\n            a[a.length] = b[i];\n        }\n        return a;\n    }\n\n    function byTag(cs, tagName){\n        if(cs.tagName || cs == document){\n            cs = [cs];\n        }\n        if(!tagName){\n            return cs;\n        }\n        var result = [], ri = -1;\n        tagName = tagName.toLowerCase();\n        for(var i = 0, ci; ci = cs[i]; i++){\n            if(ci.nodeType == 1 && ci.tagName.toLowerCase() == tagName){\n                result[++ri] = ci;\n            }\n        }\n        return result;\n    }\n\n    function byId(cs, id){\n        if(cs.tagName || cs == document){\n            cs = [cs];\n        }\n        if(!id){\n            return cs;\n        }\n        var result = [], ri = -1;\n        for(var i = 0, ci; ci = cs[i]; i++){\n            if(ci && ci.id == id){\n                result[++ri] = ci;\n                return result;\n            }\n        }\n        return result;\n    }\n\n    // operators are =, !=, ^=, $=, *=, %=, |= and ~=\n    // custom can be \"{\"\n    function byAttribute(cs, attr, value, op, custom){\n        var result = [], \n            ri = -1, \n            useGetStyle = custom == \"{\",\t    \n            fn = Ext.DomQuery.operators[op],\t    \n            a,\n            xml,\n            hasXml;\n            \n        for(var i = 0, ci; ci = cs[i]; i++){\n\t    // skip non-element nodes.\n            if(ci.nodeType != 1){\n                continue;\n            }\n            // only need to do this for the first node\n            if(!hasXml){\n                xml = Ext.DomQuery.isXml(ci);\n                hasXml = true;\n            }\n\t    \n            // we only need to change the property names if we're dealing with html nodes, not XML\n            if(!xml){\n                if(useGetStyle){\n                    a = Ext.DomQuery.getStyle(ci, attr);\n                } else if (attr == \"class\" || attr == \"className\"){\n                    a = ci.className;\n                } else if (attr == \"for\"){\n                    a = ci.htmlFor;\n                } else if (attr == \"href\"){\n\t\t    // getAttribute href bug\n\t\t    // http://www.glennjones.net/Post/809/getAttributehrefbug.htm\n                    a = ci.getAttribute(\"href\", 2);\n                } else{\n                    a = ci.getAttribute(attr);\n                }\n            }else{\n                a = ci.getAttribute(attr);\n            }\n            if((fn && fn(a, value)) || (!fn && a)){\n                result[++ri] = ci;\n            }\n        }\n        return result;\n    }\n\n    function byPseudo(cs, name, value){\n        return Ext.DomQuery.pseudos[name](cs, value);\n    }\n\n    function nodupIEXml(cs){\n        var d = ++key, \n            r;\n        cs[0].setAttribute(\"_nodup\", d);\n        r = [cs[0]];\n        for(var i = 1, len = cs.length; i < len; i++){\n            var c = cs[i];\n            if(!c.getAttribute(\"_nodup\") != d){\n                c.setAttribute(\"_nodup\", d);\n                r[r.length] = c;\n            }\n        }\n        for(var i = 0, len = cs.length; i < len; i++){\n            cs[i].removeAttribute(\"_nodup\");\n        }\n        return r;\n    }\n\n    function nodup(cs){\n        if(!cs){\n            return [];\n        }\n        var len = cs.length, c, i, r = cs, cj, ri = -1;\n        if(!len || typeof cs.nodeType != \"undefined\" || len == 1){\n            return cs;\n        }\n        if(isIE && typeof cs[0].selectSingleNode != \"undefined\"){\n            return nodupIEXml(cs);\n        }\n        var d = ++key;\n        cs[0]._nodup = d;\n        for(i = 1; c = cs[i]; i++){\n            if(c._nodup != d){\n                c._nodup = d;\n            }else{\n                r = [];\n                for(var j = 0; j < i; j++){\n                    r[++ri] = cs[j];\n                }\n                for(j = i+1; cj = cs[j]; j++){\n                    if(cj._nodup != d){\n                        cj._nodup = d;\n                        r[++ri] = cj;\n                    }\n                }\n                return r;\n            }\n        }\n        return r;\n    }\n\n    function quickDiffIEXml(c1, c2){\n        var d = ++key,\n            r = [];\n        for(var i = 0, len = c1.length; i < len; i++){\n            c1[i].setAttribute(\"_qdiff\", d);\n        }        \n        for(var i = 0, len = c2.length; i < len; i++){\n            if(c2[i].getAttribute(\"_qdiff\") != d){\n                r[r.length] = c2[i];\n            }\n        }\n        for(var i = 0, len = c1.length; i < len; i++){\n           c1[i].removeAttribute(\"_qdiff\");\n        }\n        return r;\n    }\n\n    function quickDiff(c1, c2){\n        var len1 = c1.length,\n        \td = ++key,\n        \tr = [];\n        if(!len1){\n            return c2;\n        }\n        if(isIE && typeof c1[0].selectSingleNode != \"undefined\"){\n            return quickDiffIEXml(c1, c2);\n        }        \n        for(var i = 0; i < len1; i++){\n            c1[i]._qdiff = d;\n        }        \n        for(var i = 0, len = c2.length; i < len; i++){\n            if(c2[i]._qdiff != d){\n                r[r.length] = c2[i];\n            }\n        }\n        return r;\n    }\n\n    function quickId(ns, mode, root, id){\n        if(ns == root){\n           var d = root.ownerDocument || root;\n           return d.getElementById(id);\n        }\n        ns = getNodes(ns, mode, \"*\");\n        return byId(ns, id);\n    }\n\n    return {\n        getStyle : function(el, name){\n            return Ext.fly(el).getStyle(name);\n        },\n        /**\n         * Compiles a selector/xpath query into a reusable function. The returned function\n         * takes one parameter \"root\" (optional), which is the context node from where the query should start.\n         * @param {String} selector The selector/xpath query\n         * @param {String} type (optional) Either \"select\" (the default) or \"simple\" for a simple selector match\n         * @return {Function}\n         */\n        compile : function(path, type){\n            type = type || \"select\";\n\n    \t    // setup fn preamble\n            var fn = [\"var f = function(root){\\n var mode; ++batch; var n = root || document;\\n\"],\n        \t\tmode,\t\t\n        \t\tlastPath,\n            \tmatchers = Ext.DomQuery.matchers,\n            \tmatchersLn = matchers.length,\n            \tmodeMatch,\n            \t// accept leading mode switch\n            \tlmode = path.match(modeRe);\n            \n            if(lmode && lmode[1]){\n                fn[fn.length] = 'mode=\"'+lmode[1].replace(trimRe, \"\")+'\";';\n                path = path.replace(lmode[1], \"\");\n            }\n\t    \n            // strip leading slashes\n            while(path.substr(0, 1)==\"/\"){\n                path = path.substr(1);\n            }\n\n            while(path && lastPath != path){\n                lastPath = path;\n                var tokenMatch = path.match(tagTokenRe);\n                if(type == \"select\"){\n                    if(tokenMatch){\n\t\t\t// ID Selector\n                        if(tokenMatch[1] == \"#\"){\n                            fn[fn.length] = 'n = quickId(n, mode, root, \"'+tokenMatch[2]+'\");';\t\t\t\n                        }else{\n                            fn[fn.length] = 'n = getNodes(n, mode, \"'+tokenMatch[2]+'\");';\n                        }\n                        path = path.replace(tokenMatch[0], \"\");\n                    }else if(path.substr(0, 1) != '@'){\n                        fn[fn.length] = 'n = getNodes(n, mode, \"*\");';\n                    }\n\t\t// type of \"simple\"\n                }else{\n                    if(tokenMatch){\n                        if(tokenMatch[1] == \"#\"){\n                            fn[fn.length] = 'n = byId(n, \"'+tokenMatch[2]+'\");';\n                        }else{\n                            fn[fn.length] = 'n = byTag(n, \"'+tokenMatch[2]+'\");';\n                        }\n                        path = path.replace(tokenMatch[0], \"\");\n                    }\n                }\n                while(!(modeMatch = path.match(modeRe))){\n                    var matched = false;\n                    for(var j = 0; j < matchersLn; j++){\n                        var t = matchers[j];\n                        var m = path.match(t.re);\n                        if(m){\n                            fn[fn.length] = t.select.replace(tplRe, function(x, i){\n\t\t\t\treturn m[i];\n\t\t\t    });\n                            path = path.replace(m[0], \"\");\n                            matched = true;\n                            break;\n                        }\n                    }\n                    // prevent infinite loop on bad selector\n                    if(!matched){\n                        throw 'Error parsing selector, parsing failed at \"' + path + '\"';\n                    }\n                }\n                if(modeMatch[1]){\n                    fn[fn.length] = 'mode=\"'+modeMatch[1].replace(trimRe, \"\")+'\";';\n                    path = path.replace(modeMatch[1], \"\");\n                }\n            }\n\t    // close fn out\n            fn[fn.length] = \"return nodup(n);\\n}\";\n\t    \n\t    // eval fn and return it\n            eval(fn.join(\"\"));\n            return f;\n        },\n\n        /**\n         * Selects a group of elements.\n         * @param {String} selector The selector/xpath query (can be a comma separated list of selectors)\n         * @param {Node/String} root (optional) The start of the query (defaults to document).\n         * @return {Array} An Array of DOM elements which match the selector. If there are\n         * no matches, and empty Array is returned.\n         */\n\tjsSelect: function(path, root, type){\n\t    // set root to doc if not specified.\n\t    root = root || document;\n\t    \n            if(typeof root == \"string\"){\n                root = document.getElementById(root);\n            }\n            var paths = path.split(\",\"),\n            \tresults = [];\n\t\t\n\t    // loop over each selector\n            for(var i = 0, len = paths.length; i < len; i++){\t\t\n                var subPath = paths[i].replace(trimRe, \"\");\n\t\t// compile and place in cache\n                if(!cache[subPath]){\n                    cache[subPath] = Ext.DomQuery.compile(subPath);\n                    if(!cache[subPath]){\n                        throw subPath + \" is not a valid selector\";\n                    }\n                }\n                var result = cache[subPath](root);\n                if(result && result != document){\n                    results = results.concat(result);\n                }\n            }\n\t    \n\t    // if there were multiple selectors, make sure dups\n\t    // are eliminated\n            if(paths.length > 1){\n                return nodup(results);\n            }\n            return results;\n        },\n\tisXml: function(el) {\n\t    var docEl = (el ? el.ownerDocument || el : 0).documentElement;\n\t    return docEl ? docEl.nodeName !== \"HTML\" : false;\n\t},\n        select : document.querySelectorAll ? function(path, root, type) {\n\t    root = root || document;\n\t    if (!Ext.DomQuery.isXml(root)) {\n\t\ttry {\n\t\t    var cs = root.querySelectorAll(path);\n\t\t    return Ext.toArray(cs);\n\t\t}\n\t\tcatch (ex) {}\t\t\n\t    }\t    \n\t    return Ext.DomQuery.jsSelect.call(this, path, root, type);\n\t} : function(path, root, type) {\n\t    return Ext.DomQuery.jsSelect.call(this, path, root, type);\n\t},\n\n        /**\n         * Selects a single element.\n         * @param {String} selector The selector/xpath query\n         * @param {Node} root (optional) The start of the query (defaults to document).\n         * @return {Element} The DOM element which matched the selector.\n         */\n        selectNode : function(path, root){\n            return Ext.DomQuery.select(path, root)[0];\n        },\n\n        /**\n         * Selects the value of a node, optionally replacing null with the defaultValue.\n         * @param {String} selector The selector/xpath query\n         * @param {Node} root (optional) The start of the query (defaults to document).\n         * @param {String} defaultValue (optional)\n         * @return {String}\n         */\n        selectValue : function(path, root, defaultValue){\n            path = path.replace(trimRe, \"\");\n            if(!valueCache[path]){\n                valueCache[path] = Ext.DomQuery.compile(path, \"select\");\n            }\n            var n = valueCache[path](root), v;\n            n = n[0] ? n[0] : n;\n            \t    \n\t    // overcome a limitation of maximum textnode size\n\t    // Rumored to potentially crash IE6 but has not been confirmed.\n\t    // http://reference.sitepoint.com/javascript/Node/normalize\n\t    // https://developer.mozilla.org/En/DOM/Node.normalize\t    \n            if (typeof n.normalize == 'function') n.normalize();\n            \n            v = (n && n.firstChild ? n.firstChild.nodeValue : null);\n            return ((v === null||v === undefined||v==='') ? defaultValue : v);\n        },\n\n        /**\n         * Selects the value of a node, parsing integers and floats. Returns the defaultValue, or 0 if none is specified.\n         * @param {String} selector The selector/xpath query\n         * @param {Node} root (optional) The start of the query (defaults to document).\n         * @param {Number} defaultValue (optional)\n         * @return {Number}\n         */\n        selectNumber : function(path, root, defaultValue){\n            var v = Ext.DomQuery.selectValue(path, root, defaultValue || 0);\n            return parseFloat(v);\n        },\n\n        /**\n         * Returns true if the passed element(s) match the passed simple selector (e.g. div.some-class or span:first-child)\n         * @param {String/HTMLElement/Array} el An element id, element or array of elements\n         * @param {String} selector The simple selector to test\n         * @return {Boolean}\n         */\n        is : function(el, ss){\n            if(typeof el == \"string\"){\n                el = document.getElementById(el);\n            }\n            var isArray = Ext.isArray(el),\n            \tresult = Ext.DomQuery.filter(isArray ? el : [el], ss);\n            return isArray ? (result.length == el.length) : (result.length > 0);\n        },\n\n        /**\n         * Filters an array of elements to only include matches of a simple selector (e.g. div.some-class or span:first-child)\n         * @param {Array} el An array of elements to filter\n         * @param {String} selector The simple selector to test\n         * @param {Boolean} nonMatches If true, it returns the elements that DON'T match\n         * the selector instead of the ones that match\n         * @return {Array} An Array of DOM elements which match the selector. If there are\n         * no matches, and empty Array is returned.\n         */\n        filter : function(els, ss, nonMatches){\n            ss = ss.replace(trimRe, \"\");\n            if(!simpleCache[ss]){\n                simpleCache[ss] = Ext.DomQuery.compile(ss, \"simple\");\n            }\n            var result = simpleCache[ss](els);\n            return nonMatches ? quickDiff(result, els) : result;\n        },\n\n        /**\n         * Collection of matching regular expressions and code snippets.\n         * Each capture group within () will be replace the {} in the select\n         * statement as specified by their index.\n         */\n        matchers : [{\n                re: /^\\.([\\w\\-]+)/,\n                select: 'n = byClassName(n, \" {1} \");'\n            }, {\n                re: /^\\:([\\w\\-]+)(?:\\(((?:[^\\s>\\/]*|.*?))\\))?/,\n                select: 'n = byPseudo(n, \"{1}\", \"{2}\");'\n            },{\n                re: /^(?:([\\[\\{])(?:@)?([\\w\\-]+)\\s?(?:(=|.=)\\s?([\"']?)(.*?)\\4)?[\\]\\}])/,\n                select: 'n = byAttribute(n, \"{2}\", \"{5}\", \"{3}\", \"{1}\");'\n            }, {\n                re: /^#([\\w\\-]+)/,\n                select: 'n = byId(n, \"{1}\");'\n            },{\n                re: /^@([\\w\\-]+)/,\n                select: 'return {firstChild:{nodeValue:attrValue(n, \"{1}\")}};'\n            }\n        ],\n\n        /**\n         * Collection of operator comparison functions. The default operators are =, !=, ^=, $=, *=, %=, |= and ~=.\n         * New operators can be added as long as the match the format <i>c</i>= where <i>c</i> is any character other than space, &gt; &lt;.\n         */\n        operators : {\n            \"=\" : function(a, v){\n                return a == v;\n            },\n            \"!=\" : function(a, v){\n                return a != v;\n            },\n            \"^=\" : function(a, v){\n                return a && a.substr(0, v.length) == v;\n            },\n            \"$=\" : function(a, v){\n                return a && a.substr(a.length-v.length) == v;\n            },\n            \"*=\" : function(a, v){\n                return a && a.indexOf(v) !== -1;\n            },\n            \"%=\" : function(a, v){\n                return (a % v) == 0;\n            },\n            \"|=\" : function(a, v){\n                return a && (a == v || a.substr(0, v.length+1) == v+'-');\n            },\n            \"~=\" : function(a, v){\n                return a && (' '+a+' ').indexOf(' '+v+' ') != -1;\n            }\n        },\n\n        /**\n         * <p>Object hash of \"pseudo class\" filter functions which are used when filtering selections. Each function is passed\n         * two parameters:</p><div class=\"mdetail-params\"><ul>\n         * <li><b>c</b> : Array<div class=\"sub-desc\">An Array of DOM elements to filter.</div></li>\n         * <li><b>v</b> : String<div class=\"sub-desc\">The argument (if any) supplied in the selector.</div></li>\n         * </ul></div>\n         * <p>A filter function returns an Array of DOM elements which conform to the pseudo class.</p>\n         * <p>In addition to the provided pseudo classes listed above such as <code>first-child</code> and <code>nth-child</code>,\n         * developers may add additional, custom psuedo class filters to select elements according to application-specific requirements.</p>\n         * <p>For example, to filter <code>&lt;a></code> elements to only return links to <i>external</i> resources:</p>\n         * <code><pre>\nExt.DomQuery.pseudos.external = function(c, v){\n    var r = [], ri = -1;\n    for(var i = 0, ci; ci = c[i]; i++){\n//      Include in result set only if it's a link to an external resource\n        if(ci.hostname != location.hostname){\n            r[++ri] = ci;\n        }\n    }\n    return r;\n};</pre></code>\n         * Then external links could be gathered with the following statement:<code><pre>\nvar externalLinks = Ext.select(\"a:external\");\n</code></pre>\n         */\n        pseudos : {\n            \"first-child\" : function(c){\n                var r = [], ri = -1, n;\n                for(var i = 0, ci; ci = n = c[i]; i++){\n                    while((n = n.previousSibling) && n.nodeType != 1);\n                    if(!n){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"last-child\" : function(c){\n                var r = [], ri = -1, n;\n                for(var i = 0, ci; ci = n = c[i]; i++){\n                    while((n = n.nextSibling) && n.nodeType != 1);\n                    if(!n){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"nth-child\" : function(c, a) {\n                var r = [], ri = -1,\n                \tm = nthRe.exec(a == \"even\" && \"2n\" || a == \"odd\" && \"2n+1\" || !nthRe2.test(a) && \"n+\" + a || a),\n                \tf = (m[1] || 1) - 0, l = m[2] - 0;\n                for(var i = 0, n; n = c[i]; i++){\n                    var pn = n.parentNode;\n                    if (batch != pn._batch) {\n                        var j = 0;\n                        for(var cn = pn.firstChild; cn; cn = cn.nextSibling){\n                            if(cn.nodeType == 1){\n                               cn.nodeIndex = ++j;\n                            }\n                        }\n                        pn._batch = batch;\n                    }\n                    if (f == 1) {\n                        if (l == 0 || n.nodeIndex == l){\n                            r[++ri] = n;\n                        }\n                    } else if ((n.nodeIndex + l) % f == 0){\n                        r[++ri] = n;\n                    }\n                }\n\n                return r;\n            },\n\n            \"only-child\" : function(c){\n                var r = [], ri = -1;;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    if(!prev(ci) && !next(ci)){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"empty\" : function(c){\n                var r = [], ri = -1;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    var cns = ci.childNodes, j = 0, cn, empty = true;\n                    while(cn = cns[j]){\n                        ++j;\n                        if(cn.nodeType == 1 || cn.nodeType == 3){\n                            empty = false;\n                            break;\n                        }\n                    }\n                    if(empty){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"contains\" : function(c, v){\n                var r = [], ri = -1;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    if((ci.textContent||ci.innerText||'').indexOf(v) != -1){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"nodeValue\" : function(c, v){\n                var r = [], ri = -1;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    if(ci.firstChild && ci.firstChild.nodeValue == v){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"checked\" : function(c){\n                var r = [], ri = -1;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    if(ci.checked == true){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"not\" : function(c, ss){\n                return Ext.DomQuery.filter(c, ss, true);\n            },\n\n            \"any\" : function(c, selectors){\n                var ss = selectors.split('|'),\n                \tr = [], ri = -1, s;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    for(var j = 0; s = ss[j]; j++){\n                        if(Ext.DomQuery.is(ci, s)){\n                            r[++ri] = ci;\n                            break;\n                        }\n                    }\n                }\n                return r;\n            },\n\n            \"odd\" : function(c){\n                return this[\"nth-child\"](c, \"odd\");\n            },\n\n            \"even\" : function(c){\n                return this[\"nth-child\"](c, \"even\");\n            },\n\n            \"nth\" : function(c, a){\n                return c[a-1] || [];\n            },\n\n            \"first\" : function(c){\n                return c[0] || [];\n            },\n\n            \"last\" : function(c){\n                return c[c.length-1] || [];\n            },\n\n            \"has\" : function(c, ss){\n                var s = Ext.DomQuery.select,\n                \tr = [], ri = -1;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    if(s(ss, ci).length > 0){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"next\" : function(c, ss){\n                var is = Ext.DomQuery.is,\n                \tr = [], ri = -1;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    var n = next(ci);\n                    if(n && is(n, ss)){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"prev\" : function(c, ss){\n                var is = Ext.DomQuery.is,\n                \tr = [], ri = -1;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    var n = prev(ci);\n                    if(n && is(n, ss)){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            }\n        }\n    };\n}();\n\n/**\n * Selects an array of DOM nodes by CSS/XPath selector. Shorthand of {@link Ext.DomQuery#select}\n * @param {String} path The selector/xpath query\n * @param {Node} root (optional) The start of the query (defaults to document).\n * @return {Array}\n * @member Ext\n * @method query\n */\nExt.query = Ext.DomQuery.select;\n/**\n * @class Ext.util.DelayedTask\n * <p> The DelayedTask class provides a convenient way to \"buffer\" the execution of a method,\n * performing setTimeout where a new timeout cancels the old timeout. When called, the\n * task will wait the specified time period before executing. If durng that time period,\n * the task is called again, the original call will be cancelled. This continues so that\n * the function is only called a single time for each iteration.</p>\n * <p>This method is especially useful for things like detecting whether a user has finished\n * typing in a text field. An example would be performing validation on a keypress. You can\n * use this class to buffer the keypress events for a certain number of milliseconds, and\n * perform only if they stop for that amount of time.  Usage:</p><pre><code>\nvar task = new Ext.util.DelayedTask(function(){\n    alert(Ext.getDom('myInputField').value.length);\n});\n// Wait 500ms before calling our function. If the user presses another key \n// during that 500ms, it will be cancelled and we'll wait another 500ms.\nExt.get('myInputField').on('keypress', function(){\n    task.{@link #delay}(500); \n});\n * </code></pre> \n * <p>Note that we are using a DelayedTask here to illustrate a point. The configuration\n * option <tt>buffer</tt> for {@link Ext.util.Observable#addListener addListener/on} will\n * also setup a delayed task for you to buffer events.</p> \n * @constructor The parameters to this constructor serve as defaults and are not required.\n * @param {Function} fn (optional) The default function to call.\n * @param {Object} scope (optional) The default scope (The <code><b>this</b></code> reference) in which the\n * function is called. If not specified, <code>this</code> will refer to the browser window.\n * @param {Array} args (optional) The default Array of arguments.\n */\nExt.util.DelayedTask = function(fn, scope, args){\n    var me = this,\n    \tid,    \t\n    \tcall = function(){\n    \t\tclearInterval(id);\n\t        id = null;\n\t        fn.apply(scope, args || []);\n\t    };\n\t    \n    /**\n     * Cancels any pending timeout and queues a new one\n     * @param {Number} delay The milliseconds to delay\n     * @param {Function} newFn (optional) Overrides function passed to constructor\n     * @param {Object} newScope (optional) Overrides scope passed to constructor. Remember that if no scope\n     * is specified, <code>this</code> will refer to the browser window.\n     * @param {Array} newArgs (optional) Overrides args passed to constructor\n     */\n    me.delay = function(delay, newFn, newScope, newArgs){\n        me.cancel();\n        fn = newFn || fn;\n        scope = newScope || scope;\n        args = newArgs || args;\n        id = setInterval(call, delay);\n    };\n\n    /**\n     * Cancel the last queued timeout\n     */\n    me.cancel = function(){\n        if(id){\n            clearInterval(id);\n            id = null;\n        }\n    };\n};/**\n * @class Ext.Element\n * <p>Encapsulates a DOM element, adding simple DOM manipulation facilities, normalizing for browser differences.</p>\n * <p>All instances of this class inherit the methods of {@link Ext.Fx} making visual effects easily available to all DOM elements.</p>\n * <p>Note that the events documented in this class are not Ext events, they encapsulate browser events. To\n * access the underlying browser event, see {@link Ext.EventObject#browserEvent}. Some older\n * browsers may not support the full range of events. Which events are supported is beyond the control of ExtJs.</p>\n * Usage:<br>\n<pre><code>\n// by id\nvar el = Ext.get(\"my-div\");\n\n// by DOM element reference\nvar el = Ext.get(myDivElement);\n</code></pre>\n * <b>Animations</b><br />\n * <p>When an element is manipulated, by default there is no animation.</p>\n * <pre><code>\nvar el = Ext.get(\"my-div\");\n\n// no animation\nel.setWidth(100);\n * </code></pre>\n * <p>Many of the functions for manipulating an element have an optional \"animate\" parameter.  This\n * parameter can be specified as boolean (<tt>true</tt>) for default animation effects.</p>\n * <pre><code>\n// default animation\nel.setWidth(100, true);\n * </code></pre>\n *\n * <p>To configure the effects, an object literal with animation options to use as the Element animation\n * configuration object can also be specified. Note that the supported Element animation configuration\n * options are a subset of the {@link Ext.Fx} animation options specific to Fx effects.  The supported\n * Element animation configuration options are:</p>\n<pre>\nOption    Default   Description\n--------- --------  ---------------------------------------------\n{@link Ext.Fx#duration duration}  .35       The duration of the animation in seconds\n{@link Ext.Fx#easing easing}    easeOut   The easing method\n{@link Ext.Fx#callback callback}  none      A function to execute when the anim completes\n{@link Ext.Fx#scope scope}     this      The scope (this) of the callback function\n</pre>\n *\n * <pre><code>\n// Element animation options object\nvar opt = {\n    {@link Ext.Fx#duration duration}: 1,\n    {@link Ext.Fx#easing easing}: 'elasticIn',\n    {@link Ext.Fx#callback callback}: this.foo,\n    {@link Ext.Fx#scope scope}: this\n};\n// animation with some options set\nel.setWidth(100, opt);\n * </code></pre>\n * <p>The Element animation object being used for the animation will be set on the options\n * object as \"anim\", which allows you to stop or manipulate the animation. Here is an example:</p>\n * <pre><code>\n// using the \"anim\" property to get the Anim object\nif(opt.anim.isAnimated()){\n    opt.anim.stop();\n}\n * </code></pre>\n * <p>Also see the <tt>{@link #animate}</tt> method for another animation technique.</p>\n * <p><b> Composite (Collections of) Elements</b></p>\n * <p>For working with collections of Elements, see {@link Ext.CompositeElement}</p>\n * @constructor Create a new Element directly.\n * @param {String/HTMLElement} element\n * @param {Boolean} forceNew (optional) By default the constructor checks to see if there is already an instance of this element in the cache and if there is it returns the same instance. This will skip that check (useful for extending this class).\n */\n(function(){\nvar DOC = document;\n\nExt.Element = function(element, forceNew){\n    var dom = typeof element == \"string\" ?\n              DOC.getElementById(element) : element,\n        id;\n\n    if(!dom) return null;\n\n    id = dom.id;\n\n    if(!forceNew && id && Ext.elCache[id]){ // element object already exists\n        return Ext.elCache[id].el;\n    }\n\n    /**\n     * The DOM element\n     * @type HTMLElement\n     */\n    this.dom = dom;\n\n    /**\n     * The DOM element ID\n     * @type String\n     */\n    this.id = id || Ext.id(dom);\n};\n\nvar DH = Ext.DomHelper,\n    El = Ext.Element,\n    EC = Ext.elCache;\n\nEl.prototype = {\n    /**\n     * Sets the passed attributes as attributes of this element (a style attribute can be a string, object or function)\n     * @param {Object} o The object with the attributes\n     * @param {Boolean} useSet (optional) false to override the default setAttribute to use expandos.\n     * @return {Ext.Element} this\n     */\n    set : function(o, useSet){\n        var el = this.dom,\n            attr,\n            val,\n            useSet = (useSet !== false) && !!el.setAttribute;\n\n        for (attr in o) {\n            if (o.hasOwnProperty(attr)) {\n                val = o[attr];\n                if (attr == 'style') {\n                    DH.applyStyles(el, val);\n                } else if (attr == 'cls') {\n                    el.className = val;\n                } else if (useSet) {\n                    el.setAttribute(attr, val);\n                } else {\n                    el[attr] = val;\n                }\n            }\n        }\n        return this;\n    },\n\n//  Mouse events\n    /**\n     * @event click\n     * Fires when a mouse click is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event contextmenu\n     * Fires when a right click is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event dblclick\n     * Fires when a mouse double click is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event mousedown\n     * Fires when a mousedown is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event mouseup\n     * Fires when a mouseup is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event mouseover\n     * Fires when a mouseover is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event mousemove\n     * Fires when a mousemove is detected with the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event mouseout\n     * Fires when a mouseout is detected with the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event mouseenter\n     * Fires when the mouse enters the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event mouseleave\n     * Fires when the mouse leaves the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n\n//  Keyboard events\n    /**\n     * @event keypress\n     * Fires when a keypress is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event keydown\n     * Fires when a keydown is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event keyup\n     * Fires when a keyup is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n\n\n//  HTML frame/object events\n    /**\n     * @event load\n     * Fires when the user agent finishes loading all content within the element. Only supported by window, frames, objects and images.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event unload\n     * Fires when the user agent removes all content from a window or frame. For elements, it fires when the target element or any of its content has been removed.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event abort\n     * Fires when an object/image is stopped from loading before completely loaded.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event error\n     * Fires when an object/image/frame cannot be loaded properly.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event resize\n     * Fires when a document view is resized.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event scroll\n     * Fires when a document view is scrolled.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n\n//  Form events\n    /**\n     * @event select\n     * Fires when a user selects some text in a text field, including input and textarea.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event change\n     * Fires when a control loses the input focus and its value has been modified since gaining focus.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event submit\n     * Fires when a form is submitted.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event reset\n     * Fires when a form is reset.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event focus\n     * Fires when an element receives focus either via the pointing device or by tab navigation.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event blur\n     * Fires when an element loses focus either via the pointing device or by tabbing navigation.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n\n//  User Interface events\n    /**\n     * @event DOMFocusIn\n     * Where supported. Similar to HTML focus event, but can be applied to any focusable element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMFocusOut\n     * Where supported. Similar to HTML blur event, but can be applied to any focusable element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMActivate\n     * Where supported. Fires when an element is activated, for instance, through a mouse click or a keypress.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n\n//  DOM Mutation events\n    /**\n     * @event DOMSubtreeModified\n     * Where supported. Fires when the subtree is modified.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMNodeInserted\n     * Where supported. Fires when a node has been added as a child of another node.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMNodeRemoved\n     * Where supported. Fires when a descendant node of the element is removed.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMNodeRemovedFromDocument\n     * Where supported. Fires when a node is being removed from a document.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMNodeInsertedIntoDocument\n     * Where supported. Fires when a node is being inserted into a document.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMAttrModified\n     * Where supported. Fires when an attribute has been modified.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMCharacterDataModified\n     * Where supported. Fires when the character data has been modified.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n\n    /**\n     * The default unit to append to CSS values where a unit isn't provided (defaults to px).\n     * @type String\n     */\n    defaultUnit : \"px\",\n\n    /**\n     * Returns true if this element matches the passed simple selector (e.g. div.some-class or span:first-child)\n     * @param {String} selector The simple selector to test\n     * @return {Boolean} True if this element matches the selector, else false\n     */\n    is : function(simpleSelector){\n        return Ext.DomQuery.is(this.dom, simpleSelector);\n    },\n\n    /**\n     * Tries to focus the element. Any exceptions are caught and ignored.\n     * @param {Number} defer (optional) Milliseconds to defer the focus\n     * @return {Ext.Element} this\n     */\n    focus : function(defer, /* private */ dom) {\n        var me = this,\n            dom = dom || me.dom;\n        try{\n            if(Number(defer)){\n                me.focus.defer(defer, null, [null, dom]);\n            }else{\n                dom.focus();\n            }\n        }catch(e){}\n        return me;\n    },\n\n    /**\n     * Tries to blur the element. Any exceptions are caught and ignored.\n     * @return {Ext.Element} this\n     */\n    blur : function() {\n        try{\n            this.dom.blur();\n        }catch(e){}\n        return this;\n    },\n\n    /**\n     * Returns the value of the \"value\" attribute\n     * @param {Boolean} asNumber true to parse the value as a number\n     * @return {String/Number}\n     */\n    getValue : function(asNumber){\n        var val = this.dom.value;\n        return asNumber ? parseInt(val, 10) : val;\n    },\n\n    /**\n     * Appends an event handler to this element.  The shorthand version {@link #on} is equivalent.\n     * @param {String} eventName The name of event to handle.\n     * @param {Function} fn The handler function the event invokes. This function is passed\n     * the following parameters:<ul>\n     * <li><b>evt</b> : EventObject<div class=\"sub-desc\">The {@link Ext.EventObject EventObject} describing the event.</div></li>\n     * <li><b>el</b> : HtmlElement<div class=\"sub-desc\">The DOM element which was the target of the event.\n     * Note that this may be filtered by using the <tt>delegate</tt> option.</div></li>\n     * <li><b>o</b> : Object<div class=\"sub-desc\">The options object from the addListener call.</div></li>\n     * </ul>\n     * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the handler function is executed.\n     * <b>If omitted, defaults to this Element.</b>.\n     * @param {Object} options (optional) An object containing handler configuration properties.\n     * This may contain any of the following properties:<ul>\n     * <li><b>scope</b> Object : <div class=\"sub-desc\">The scope (<code><b>this</b></code> reference) in which the handler function is executed.\n     * <b>If omitted, defaults to this Element.</b></div></li>\n     * <li><b>delegate</b> String: <div class=\"sub-desc\">A simple selector to filter the target or look for a descendant of the target. See below for additional details.</div></li>\n     * <li><b>stopEvent</b> Boolean: <div class=\"sub-desc\">True to stop the event. That is stop propagation, and prevent the default action.</div></li>\n     * <li><b>preventDefault</b> Boolean: <div class=\"sub-desc\">True to prevent the default action</div></li>\n     * <li><b>stopPropagation</b> Boolean: <div class=\"sub-desc\">True to prevent event propagation</div></li>\n     * <li><b>normalized</b> Boolean: <div class=\"sub-desc\">False to pass a browser event to the handler function instead of an Ext.EventObject</div></li>\n     * <li><b>target</b> Ext.Element: <div class=\"sub-desc\">Only call the handler if the event was fired on the target Element, <i>not</i> if the event was bubbled up from a child node.</div></li>\n     * <li><b>delay</b> Number: <div class=\"sub-desc\">The number of milliseconds to delay the invocation of the handler after the event fires.</div></li>\n     * <li><b>single</b> Boolean: <div class=\"sub-desc\">True to add a handler to handle just the next firing of the event, and then remove itself.</div></li>\n     * <li><b>buffer</b> Number: <div class=\"sub-desc\">Causes the handler to be scheduled to run in an {@link Ext.util.DelayedTask} delayed\n     * by the specified number of milliseconds. If the event fires again within that time, the original\n     * handler is <em>not</em> invoked, but the new handler is scheduled in its place.</div></li>\n     * </ul><br>\n     * <p>\n     * <b>Combining Options</b><br>\n     * In the following examples, the shorthand form {@link #on} is used rather than the more verbose\n     * addListener.  The two are equivalent.  Using the options argument, it is possible to combine different\n     * types of listeners:<br>\n     * <br>\n     * A delayed, one-time listener that auto stops the event and adds a custom argument (forumId) to the\n     * options object. The options object is available as the third parameter in the handler function.<div style=\"margin: 5px 20px 20px;\">\n     * Code:<pre><code>\nel.on('click', this.onClick, this, {\n    single: true,\n    delay: 100,\n    stopEvent : true,\n    forumId: 4\n});</code></pre></p>\n     * <p>\n     * <b>Attaching multiple handlers in 1 call</b><br>\n     * The method also allows for a single argument to be passed which is a config object containing properties\n     * which specify multiple handlers.</p>\n     * <p>\n     * Code:<pre><code>\nel.on({\n    'click' : {\n        fn: this.onClick,\n        scope: this,\n        delay: 100\n    },\n    'mouseover' : {\n        fn: this.onMouseOver,\n        scope: this\n    },\n    'mouseout' : {\n        fn: this.onMouseOut,\n        scope: this\n    }\n});</code></pre>\n     * <p>\n     * Or a shorthand syntax:<br>\n     * Code:<pre><code></p>\nel.on({\n    'click' : this.onClick,\n    'mouseover' : this.onMouseOver,\n    'mouseout' : this.onMouseOut,\n    scope: this\n});\n     * </code></pre></p>\n     * <p><b>delegate</b></p>\n     * <p>This is a configuration option that you can pass along when registering a handler for\n     * an event to assist with event delegation. Event delegation is a technique that is used to\n     * reduce memory consumption and prevent exposure to memory-leaks. By registering an event\n     * for a container element as opposed to each element within a container. By setting this\n     * configuration option to a simple selector, the target element will be filtered to look for\n     * a descendant of the target.\n     * For example:<pre><code>\n// using this markup:\n&lt;div id='elId'>\n    &lt;p id='p1'>paragraph one&lt;/p>\n    &lt;p id='p2' class='clickable'>paragraph two&lt;/p>\n    &lt;p id='p3'>paragraph three&lt;/p>\n&lt;/div>\n// utilize event delegation to registering just one handler on the container element:\nel = Ext.get('elId');\nel.on(\n    'click',\n    function(e,t) {\n        // handle click\n        console.info(t.id); // 'p2'\n    },\n    this,\n    {\n        // filter the target element to be a descendant with the class 'clickable'\n        delegate: '.clickable'\n    }\n);\n     * </code></pre></p>\n     * @return {Ext.Element} this\n     */\n    addListener : function(eventName, fn, scope, options){\n        Ext.EventManager.on(this.dom,  eventName, fn, scope || this, options);\n        return this;\n    },\n\n    /**\n     * Removes an event handler from this element.  The shorthand version {@link #un} is equivalent.\n     * <b>Note</b>: if a <i>scope</i> was explicitly specified when {@link #addListener adding} the\n     * listener, the same scope must be specified here.\n     * Example:\n     * <pre><code>\nel.removeListener('click', this.handlerFn);\n// or\nel.un('click', this.handlerFn);\n</code></pre>\n     * @param {String} eventName The name of the event from which to remove the handler.\n     * @param {Function} fn The handler function to remove. <b>This must be a reference to the function passed into the {@link #addListener} call.</b>\n     * @param {Object} scope If a scope (<b><code>this</code></b> reference) was specified when the listener was added,\n     * then this must refer to the same object.\n     * @return {Ext.Element} this\n     */\n    removeListener : function(eventName, fn, scope){\n        Ext.EventManager.removeListener(this.dom,  eventName, fn, scope || this);\n        return this;\n    },\n\n    /**\n     * Removes all previous added listeners from this element\n     * @return {Ext.Element} this\n     */\n    removeAllListeners : function(){\n        Ext.EventManager.removeAll(this.dom);\n        return this;\n    },\n\n    /**\n     * Recursively removes all previous added listeners from this element and its children\n     * @return {Ext.Element} this\n     */\n    purgeAllListeners : function() {\n        Ext.EventManager.purgeElement(this, true);\n        return this;\n    },\n    /**\n     * @private Test if size has a unit, otherwise appends the default\n     */\n    addUnits : function(size){\n        if(size === \"\" || size == \"auto\" || size === undefined){\n            size = size || '';\n        } else if(!isNaN(size) || !unitPattern.test(size)){\n            size = size + (this.defaultUnit || 'px');\n        }\n        return size;\n    },\n\n    /**\n     * <p>Updates the <a href=\"http://developer.mozilla.org/en/DOM/element.innerHTML\">innerHTML</a> of this Element\n     * from a specified URL. Note that this is subject to the <a href=\"http://en.wikipedia.org/wiki/Same_origin_policy\">Same Origin Policy</a></p>\n     * <p>Updating innerHTML of an element will <b>not</b> execute embedded <tt>&lt;script></tt> elements. This is a browser restriction.</p>\n     * @param {Mixed} options. Either a sring containing the URL from which to load the HTML, or an {@link Ext.Ajax#request} options object specifying\n     * exactly how to request the HTML.\n     * @return {Ext.Element} this\n     */\n    load : function(url, params, cb){\n        Ext.Ajax.request(Ext.apply({\n            params: params,\n            url: url.url || url,\n            callback: cb,\n            el: this.dom,\n            indicatorText: url.indicatorText || ''\n        }, Ext.isObject(url) ? url : {}));\n        return this;\n    },\n\n    /**\n     * Tests various css rules/browsers to determine if this element uses a border box\n     * @return {Boolean}\n     */\n    isBorderBox : function(){\n        return Ext.isBorderBox || Ext.isForcedBorderBox || noBoxAdjust[(this.dom.tagName || \"\").toLowerCase()];\n    },\n\n    /**\n     * <p>Removes this element's dom reference.  Note that event and cache removal is handled at {@link Ext#removeNode}</p>\n     */\n    remove : function(){\n        var me = this,\n            dom = me.dom;\n\n        if (dom) {\n            delete me.dom;\n            Ext.removeNode(dom);\n        }\n    },\n\n    /**\n     * Sets up event handlers to call the passed functions when the mouse is moved into and out of the Element.\n     * @param {Function} overFn The function to call when the mouse enters the Element.\n     * @param {Function} outFn The function to call when the mouse leaves the Element.\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the functions are executed. Defaults to the Element's DOM element.\n     * @param {Object} options (optional) Options for the listener. See {@link Ext.util.Observable#addListener the <tt>options</tt> parameter}.\n     * @return {Ext.Element} this\n     */\n    hover : function(overFn, outFn, scope, options){\n        var me = this;\n        me.on('mouseenter', overFn, scope || me.dom, options);\n        me.on('mouseleave', outFn, scope || me.dom, options);\n        return me;\n    },\n\n    /**\n     * Returns true if this element is an ancestor of the passed element\n     * @param {HTMLElement/String} el The element to check\n     * @return {Boolean} True if this element is an ancestor of el, else false\n     */\n    contains : function(el){\n        return !el ? false : Ext.lib.Dom.isAncestor(this.dom, el.dom ? el.dom : el);\n    },\n\n    /**\n     * Returns the value of a namespaced attribute from the element's underlying DOM node.\n     * @param {String} namespace The namespace in which to look for the attribute\n     * @param {String} name The attribute name\n     * @return {String} The attribute value\n     * @deprecated\n     */\n    getAttributeNS : function(ns, name){\n        return this.getAttribute(name, ns);\n    },\n\n    /**\n     * Returns the value of an attribute from the element's underlying DOM node.\n     * @param {String} name The attribute name\n     * @param {String} namespace (optional) The namespace in which to look for the attribute\n     * @return {String} The attribute value\n     */\n    getAttribute: (function(){\n        var test = document.createElement('table'),\n            isBrokenOnTable = false,\n            hasGetAttribute = 'getAttribute' in test,\n            unknownRe = /undefined|unknown/;\n\n        if (hasGetAttribute) {\n\n            try {\n                test.getAttribute('ext:qtip');\n            } catch (e) {\n                isBrokenOnTable = true;\n            }\n\n            return function(name, ns) {\n                var el = this.dom,\n                    value;\n\n                if (el.getAttributeNS) {\n                    value  = el.getAttributeNS(ns, name) || null;\n                }\n\n                if (value == null) {\n                    if (ns) {\n                        if (isBrokenOnTable && el.tagName.toUpperCase() == 'TABLE') {\n                            try {\n                                value = el.getAttribute(ns + ':' + name);\n                            } catch (e) {\n                                value = '';\n                            }\n                        } else {\n                            value = el.getAttribute(ns + ':' + name);\n                        }\n                    } else {\n                        value = el.getAttribute(name) || el[name];\n                    }\n                }\n                return value || '';\n            };\n        } else {\n            return function(name, ns) {\n                var el = this.om,\n                    value,\n                    attribute;\n\n                if (ns) {\n                    attribute = el[ns + ':' + name];\n                    value = unknownRe.test(typeof attribute) ? undefined : attribute;\n                } else {\n                    value = el[name];\n                }\n                return value || '';\n            };\n        }\n        test = null;\n    })(),\n\n    /**\n    * Update the innerHTML of this element\n    * @param {String} html The new HTML\n    * @return {Ext.Element} this\n     */\n    update : function(html) {\n        if (this.dom) {\n            this.dom.innerHTML = html;\n        }\n        return this;\n    }\n};\n\nvar ep = El.prototype;\n\nEl.addMethods = function(o){\n   Ext.apply(ep, o);\n};\n\n/**\n * Appends an event handler (shorthand for {@link #addListener}).\n * @param {String} eventName The name of event to handle.\n * @param {Function} fn The handler function the event invokes.\n * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the handler function is executed.\n * @param {Object} options (optional) An object containing standard {@link #addListener} options\n * @member Ext.Element\n * @method on\n */\nep.on = ep.addListener;\n\n/**\n * Removes an event handler from this element (see {@link #removeListener} for additional notes).\n * @param {String} eventName The name of the event from which to remove the handler.\n * @param {Function} fn The handler function to remove. <b>This must be a reference to the function passed into the {@link #addListener} call.</b>\n * @param {Object} scope If a scope (<b><code>this</code></b> reference) was specified when the listener was added,\n * then this must refer to the same object.\n * @return {Ext.Element} this\n * @member Ext.Element\n * @method un\n */\nep.un = ep.removeListener;\n\n/**\n * true to automatically adjust width and height settings for box-model issues (default to true)\n */\nep.autoBoxAdjust = true;\n\n// private\nvar unitPattern = /\\d+(px|em|%|en|ex|pt|in|cm|mm|pc)$/i,\n    docEl;\n\n/**\n * Retrieves Ext.Element objects.\n * <p><b>This method does not retrieve {@link Ext.Component Component}s.</b> This method\n * retrieves Ext.Element objects which encapsulate DOM elements. To retrieve a Component by\n * its ID, use {@link Ext.ComponentMgr#get}.</p>\n * <p>Uses simple caching to consistently return the same object. Automatically fixes if an\n * object was recreated with the same id via AJAX or DOM.</p>\n * @param {Mixed} el The id of the node, a DOM Node or an existing Element.\n * @return {Element} The Element object (or null if no matching element was found)\n * @static\n * @member Ext.Element\n * @method get\n */\nEl.get = function(el){\n    var ex,\n        elm,\n        id;\n    if(!el){ return null; }\n    if (typeof el == \"string\") { // element id\n        if (!(elm = DOC.getElementById(el))) {\n            return null;\n        }\n        if (EC[el] && EC[el].el) {\n            ex = EC[el].el;\n            ex.dom = elm;\n        } else {\n            ex = El.addToCache(new El(elm));\n        }\n        return ex;\n    } else if (el.tagName) { // dom element\n        if(!(id = el.id)){\n            id = Ext.id(el);\n        }\n        if (EC[id] && EC[id].el) {\n            ex = EC[id].el;\n            ex.dom = el;\n        } else {\n            ex = El.addToCache(new El(el));\n        }\n        return ex;\n    } else if (el instanceof El) {\n        if(el != docEl){\n            // refresh dom element in case no longer valid,\n            // catch case where it hasn't been appended\n\n            // If an el instance is passed, don't pass to getElementById without some kind of id\n            if (Ext.isIE && (el.id == undefined || el.id == '')) {\n                el.dom = el.dom;\n            } else {\n                el.dom = DOC.getElementById(el.id) || el.dom;\n            }\n        }\n        return el;\n    } else if(el.isComposite) {\n        return el;\n    } else if(Ext.isArray(el)) {\n        return El.select(el);\n    } else if(el == DOC) {\n        // create a bogus element object representing the document object\n        if(!docEl){\n            var f = function(){};\n            f.prototype = El.prototype;\n            docEl = new f();\n            docEl.dom = DOC;\n        }\n        return docEl;\n    }\n    return null;\n};\n\nEl.addToCache = function(el, id){\n    id = id || el.id;\n    EC[id] = {\n        el:  el,\n        data: {},\n        events: {}\n    };\n    return el;\n};\n\n// private method for getting and setting element data\nEl.data = function(el, key, value){\n    el = El.get(el);\n    if (!el) {\n        return null;\n    }\n    var c = EC[el.id].data;\n    if(arguments.length == 2){\n        return c[key];\n    }else{\n        return (c[key] = value);\n    }\n};\n\n// private\n// Garbage collection - uncache elements/purge listeners on orphaned elements\n// so we don't hold a reference and cause the browser to retain them\nfunction garbageCollect(){\n    if(!Ext.enableGarbageCollector){\n        clearInterval(El.collectorThreadId);\n    } else {\n        var eid,\n            el,\n            d,\n            o;\n\n        for(eid in EC){\n            o = EC[eid];\n            if(o.skipGC){\n                Ext.EventManager.removeFromSpecialCache(o.el);\n                continue;\n            }\n            el = o.el;\n            d = el.dom;\n            // -------------------------------------------------------\n            // Determining what is garbage:\n            // -------------------------------------------------------\n            // !d\n            // dom node is null, definitely garbage\n            // -------------------------------------------------------\n            // !d.parentNode\n            // no parentNode == direct orphan, definitely garbage\n            // -------------------------------------------------------\n            // !d.offsetParent && !document.getElementById(eid)\n            // display none elements have no offsetParent so we will\n            // also try to look it up by it's id. However, check\n            // offsetParent first so we don't do unneeded lookups.\n            // This enables collection of elements that are not orphans\n            // directly, but somewhere up the line they have an orphan\n            // parent.\n            // -------------------------------------------------------\n            if(!d || !d.parentNode || (!d.offsetParent && !DOC.getElementById(eid))){\n                if(Ext.enableListenerCollection){\n                    Ext.EventManager.removeAll(d);\n                }\n                delete EC[eid];\n            }\n        }\n        // Cleanup IE Object leaks\n        if (Ext.isIE) {\n            var t = {};\n            for (eid in EC) {\n                t[eid] = EC[eid];\n            }\n            EC = Ext.elCache = t;\n        }\n    }\n}\nEl.collectorThreadId = setInterval(garbageCollect, 30000);\n\nvar flyFn = function(){};\nflyFn.prototype = El.prototype;\n\n// dom is optional\nEl.Flyweight = function(dom){\n    this.dom = dom;\n};\n\nEl.Flyweight.prototype = new flyFn();\nEl.Flyweight.prototype.isFlyweight = true;\nEl._flyweights = {};\n\n/**\n * <p>Gets the globally shared flyweight Element, with the passed node as the active element. Do not store a reference to this element -\n * the dom node can be overwritten by other code. Shorthand of {@link Ext.Element#fly}</p>\n * <p>Use this to make one-time references to DOM elements which are not going to be accessed again either by\n * application code, or by Ext's classes. If accessing an element which will be processed regularly, then {@link Ext#get}\n * will be more appropriate to take advantage of the caching provided by the Ext.Element class.</p>\n * @param {String/HTMLElement} el The dom node or id\n * @param {String} named (optional) Allows for creation of named reusable flyweights to prevent conflicts\n * (e.g. internally Ext uses \"_global\")\n * @return {Element} The shared Element object (or null if no matching element was found)\n * @member Ext.Element\n * @method fly\n */\nEl.fly = function(el, named){\n    var ret = null;\n    named = named || '_global';\n\n    if (el = Ext.getDom(el)) {\n        (El._flyweights[named] = El._flyweights[named] || new El.Flyweight()).dom = el;\n        ret = El._flyweights[named];\n    }\n    return ret;\n};\n\n/**\n * Retrieves Ext.Element objects.\n * <p><b>This method does not retrieve {@link Ext.Component Component}s.</b> This method\n * retrieves Ext.Element objects which encapsulate DOM elements. To retrieve a Component by\n * its ID, use {@link Ext.ComponentMgr#get}.</p>\n * <p>Uses simple caching to consistently return the same object. Automatically fixes if an\n * object was recreated with the same id via AJAX or DOM.</p>\n * Shorthand of {@link Ext.Element#get}\n * @param {Mixed} el The id of the node, a DOM Node or an existing Element.\n * @return {Element} The Element object (or null if no matching element was found)\n * @member Ext\n * @method get\n */\nExt.get = El.get;\n\n/**\n * <p>Gets the globally shared flyweight Element, with the passed node as the active element. Do not store a reference to this element -\n * the dom node can be overwritten by other code. Shorthand of {@link Ext.Element#fly}</p>\n * <p>Use this to make one-time references to DOM elements which are not going to be accessed again either by\n * application code, or by Ext's classes. If accessing an element which will be processed regularly, then {@link Ext#get}\n * will be more appropriate to take advantage of the caching provided by the Ext.Element class.</p>\n * @param {String/HTMLElement} el The dom node or id\n * @param {String} named (optional) Allows for creation of named reusable flyweights to prevent conflicts\n * (e.g. internally Ext uses \"_global\")\n * @return {Element} The shared Element object (or null if no matching element was found)\n * @member Ext\n * @method fly\n */\nExt.fly = El.fly;\n\n// speedy lookup for elements never to box adjust\nvar noBoxAdjust = Ext.isStrict ? {\n    select:1\n} : {\n    input:1, select:1, textarea:1\n};\nif(Ext.isIE || Ext.isGecko){\n    noBoxAdjust['button'] = 1;\n}\n\n})();\n/**\n * @class Ext.Element\n */\nExt.Element.addMethods(function(){\n\tvar PARENTNODE = 'parentNode',\n\t\tNEXTSIBLING = 'nextSibling',\n\t\tPREVIOUSSIBLING = 'previousSibling',\n\t\tDQ = Ext.DomQuery,\n\t\tGET = Ext.get;\n\t\n\treturn {\n\t\t/**\n\t     * Looks at this node and then at parent nodes for a match of the passed simple selector (e.g. div.some-class or span:first-child)\n\t     * @param {String} selector The simple selector to test\n\t     * @param {Number/Mixed} maxDepth (optional) The max depth to search as a number or element (defaults to 50 || document.body)\n\t     * @param {Boolean} returnEl (optional) True to return a Ext.Element object instead of DOM node\n\t     * @return {HTMLElement} The matching DOM node (or null if no match was found)\n\t     */\n\t    findParent : function(simpleSelector, maxDepth, returnEl){\n\t        var p = this.dom,\n\t        \tb = document.body, \n\t        \tdepth = 0, \t        \t\n\t        \tstopEl;\t        \n            if(Ext.isGecko && Object.prototype.toString.call(p) == '[object XULElement]') {\n                return null;\n            }\n\t        maxDepth = maxDepth || 50;\n\t        if (isNaN(maxDepth)) {\n\t            stopEl = Ext.getDom(maxDepth);\n\t            maxDepth = Number.MAX_VALUE;\n\t        }\n\t        while(p && p.nodeType == 1 && depth < maxDepth && p != b && p != stopEl){\n\t            if(DQ.is(p, simpleSelector)){\n\t                return returnEl ? GET(p) : p;\n\t            }\n\t            depth++;\n\t            p = p.parentNode;\n\t        }\n\t        return null;\n\t    },\n\t\n\t    /**\n\t     * Looks at parent nodes for a match of the passed simple selector (e.g. div.some-class or span:first-child)\n\t     * @param {String} selector The simple selector to test\n\t     * @param {Number/Mixed} maxDepth (optional) The max depth to\n\t            search as a number or element (defaults to 10 || document.body)\n\t     * @param {Boolean} returnEl (optional) True to return a Ext.Element object instead of DOM node\n\t     * @return {HTMLElement} The matching DOM node (or null if no match was found)\n\t     */\n\t    findParentNode : function(simpleSelector, maxDepth, returnEl){\n\t        var p = Ext.fly(this.dom.parentNode, '_internal');\n\t        return p ? p.findParent(simpleSelector, maxDepth, returnEl) : null;\n\t    },\n\t\n\t    /**\n\t     * Walks up the dom looking for a parent node that matches the passed simple selector (e.g. div.some-class or span:first-child).\n\t     * This is a shortcut for findParentNode() that always returns an Ext.Element.\n\t     * @param {String} selector The simple selector to test\n\t     * @param {Number/Mixed} maxDepth (optional) The max depth to\n\t            search as a number or element (defaults to 10 || document.body)\n\t     * @return {Ext.Element} The matching DOM node (or null if no match was found)\n\t     */\n\t    up : function(simpleSelector, maxDepth){\n\t        return this.findParentNode(simpleSelector, maxDepth, true);\n\t    },\n\t\n\t    /**\n\t     * Creates a {@link Ext.CompositeElement} for child nodes based on the passed CSS selector (the selector should not contain an id).\n\t     * @param {String} selector The CSS selector\n\t     * @return {CompositeElement/CompositeElementLite} The composite element\n\t     */\n\t    select : function(selector){\n\t        return Ext.Element.select(selector, this.dom);\n\t    },\n\t\n\t    /**\n\t     * Selects child nodes based on the passed CSS selector (the selector should not contain an id).\n\t     * @param {String} selector The CSS selector\n\t     * @return {Array} An array of the matched nodes\n\t     */\n\t    query : function(selector){\n\t        return DQ.select(selector, this.dom);\n\t    },\n\t\n\t    /**\n\t     * Selects a single child at any depth below this element based on the passed CSS selector (the selector should not contain an id).\n\t     * @param {String} selector The CSS selector\n\t     * @param {Boolean} returnDom (optional) True to return the DOM node instead of Ext.Element (defaults to false)\n\t     * @return {HTMLElement/Ext.Element} The child Ext.Element (or DOM node if returnDom = true)\n\t     */\n\t    child : function(selector, returnDom){\n\t        var n = DQ.selectNode(selector, this.dom);\n\t        return returnDom ? n : GET(n);\n\t    },\n\t\n\t    /**\n\t     * Selects a single *direct* child based on the passed CSS selector (the selector should not contain an id).\n\t     * @param {String} selector The CSS selector\n\t     * @param {Boolean} returnDom (optional) True to return the DOM node instead of Ext.Element (defaults to false)\n\t     * @return {HTMLElement/Ext.Element} The child Ext.Element (or DOM node if returnDom = true)\n\t     */\n\t    down : function(selector, returnDom){\n\t        var n = DQ.selectNode(\" > \" + selector, this.dom);\n\t        return returnDom ? n : GET(n);\n\t    },\n\t\n\t\t /**\n\t     * Gets the parent node for this element, optionally chaining up trying to match a selector\n\t     * @param {String} selector (optional) Find a parent node that matches the passed simple selector\n\t     * @param {Boolean} returnDom (optional) True to return a raw dom node instead of an Ext.Element\n\t     * @return {Ext.Element/HTMLElement} The parent node or null\n\t\t */\n\t    parent : function(selector, returnDom){\n\t        return this.matchNode(PARENTNODE, PARENTNODE, selector, returnDom);\n\t    },\n\t\n\t     /**\n\t     * Gets the next sibling, skipping text nodes\n\t     * @param {String} selector (optional) Find the next sibling that matches the passed simple selector\n\t     * @param {Boolean} returnDom (optional) True to return a raw dom node instead of an Ext.Element\n\t     * @return {Ext.Element/HTMLElement} The next sibling or null\n\t\t */\n\t    next : function(selector, returnDom){\n\t        return this.matchNode(NEXTSIBLING, NEXTSIBLING, selector, returnDom);\n\t    },\n\t\n\t    /**\n\t     * Gets the previous sibling, skipping text nodes\n\t     * @param {String} selector (optional) Find the previous sibling that matches the passed simple selector\n\t     * @param {Boolean} returnDom (optional) True to return a raw dom node instead of an Ext.Element\n\t     * @return {Ext.Element/HTMLElement} The previous sibling or null\n\t\t */\n\t    prev : function(selector, returnDom){\n\t        return this.matchNode(PREVIOUSSIBLING, PREVIOUSSIBLING, selector, returnDom);\n\t    },\n\t\n\t\n\t    /**\n\t     * Gets the first child, skipping text nodes\n\t     * @param {String} selector (optional) Find the next sibling that matches the passed simple selector\n\t     * @param {Boolean} returnDom (optional) True to return a raw dom node instead of an Ext.Element\n\t     * @return {Ext.Element/HTMLElement} The first child or null\n\t\t */\n\t    first : function(selector, returnDom){\n\t        return this.matchNode(NEXTSIBLING, 'firstChild', selector, returnDom);\n\t    },\n\t\n\t    /**\n\t     * Gets the last child, skipping text nodes\n\t     * @param {String} selector (optional) Find the previous sibling that matches the passed simple selector\n\t     * @param {Boolean} returnDom (optional) True to return a raw dom node instead of an Ext.Element\n\t     * @return {Ext.Element/HTMLElement} The last child or null\n\t\t */\n\t    last : function(selector, returnDom){\n\t        return this.matchNode(PREVIOUSSIBLING, 'lastChild', selector, returnDom);\n\t    },\n\t    \n\t    matchNode : function(dir, start, selector, returnDom){\n\t        var n = this.dom[start];\n\t        while(n){\n\t            if(n.nodeType == 1 && (!selector || DQ.is(n, selector))){\n\t                return !returnDom ? GET(n) : n;\n\t            }\n\t            n = n[dir];\n\t        }\n\t        return null;\n\t    }\t\n    };\n}());/**\n * @class Ext.Element\n */\nExt.Element.addMethods(\nfunction() {\n\tvar GETDOM = Ext.getDom,\n\t\tGET = Ext.get,\n\t\tDH = Ext.DomHelper;\n\t\n\treturn {\n\t    /**\n\t     * Appends the passed element(s) to this element\n\t     * @param {String/HTMLElement/Array/Element/CompositeElement} el\n\t     * @return {Ext.Element} this\n\t     */\n\t    appendChild: function(el){        \n\t        return GET(el).appendTo(this);        \n\t    },\n\t\n\t    /**\n\t     * Appends this element to the passed element\n\t     * @param {Mixed} el The new parent element\n\t     * @return {Ext.Element} this\n\t     */\n\t    appendTo: function(el){        \n\t        GETDOM(el).appendChild(this.dom);        \n\t        return this;\n\t    },\n\t\n\t    /**\n\t     * Inserts this element before the passed element in the DOM\n\t     * @param {Mixed} el The element before which this element will be inserted\n\t     * @return {Ext.Element} this\n\t     */\n\t    insertBefore: function(el){  \t          \n\t        (el = GETDOM(el)).parentNode.insertBefore(this.dom, el);\n\t        return this;\n\t    },\n\t\n\t    /**\n\t     * Inserts this element after the passed element in the DOM\n\t     * @param {Mixed} el The element to insert after\n\t     * @return {Ext.Element} this\n\t     */\n\t    insertAfter: function(el){\n\t        (el = GETDOM(el)).parentNode.insertBefore(this.dom, el.nextSibling);\n\t        return this;\n\t    },\n\t\n\t    /**\n\t     * Inserts (or creates) an element (or DomHelper config) as the first child of this element\n\t     * @param {Mixed/Object} el The id or element to insert or a DomHelper config to create and insert\n\t     * @return {Ext.Element} The new child\n\t     */\n\t    insertFirst: function(el, returnDom){\n            el = el || {};\n            if(el.nodeType || el.dom || typeof el == 'string'){ // element\n                el = GETDOM(el);\n                this.dom.insertBefore(el, this.dom.firstChild);\n                return !returnDom ? GET(el) : el;\n            }else{ // dh config\n                return this.createChild(el, this.dom.firstChild, returnDom);\n            }\n        },\n\t\n\t    /**\n\t     * Replaces the passed element with this element\n\t     * @param {Mixed} el The element to replace\n\t     * @return {Ext.Element} this\n\t     */\n\t    replace: function(el){\n\t        el = GET(el);\n\t        this.insertBefore(el);\n\t        el.remove();\n\t        return this;\n\t    },\n\t\n\t    /**\n\t     * Replaces this element with the passed element\n\t     * @param {Mixed/Object} el The new element or a DomHelper config of an element to create\n\t     * @return {Ext.Element} this\n\t     */\n\t    replaceWith: function(el){\n\t\t    var me = this;\n                \n            if(el.nodeType || el.dom || typeof el == 'string'){\n                el = GETDOM(el);\n                me.dom.parentNode.insertBefore(el, me.dom);\n            }else{\n                el = DH.insertBefore(me.dom, el);\n            }\n\t        \n\t        delete Ext.elCache[me.id];\n\t        Ext.removeNode(me.dom);      \n\t        me.id = Ext.id(me.dom = el);\n\t        Ext.Element.addToCache(me.isFlyweight ? new Ext.Element(me.dom) : me);     \n            return me;\n\t    },\n\t    \n\t\t/**\n\t\t * Creates the passed DomHelper config and appends it to this element or optionally inserts it before the passed child element.\n\t\t * @param {Object} config DomHelper element config object.  If no tag is specified (e.g., {tag:'input'}) then a div will be\n\t\t * automatically generated with the specified attributes.\n\t\t * @param {HTMLElement} insertBefore (optional) a child element of this element\n\t\t * @param {Boolean} returnDom (optional) true to return the dom node instead of creating an Element\n\t\t * @return {Ext.Element} The new child element\n\t\t */\n\t\tcreateChild: function(config, insertBefore, returnDom){\n\t\t    config = config || {tag:'div'};\n\t\t    return insertBefore ? \n\t\t    \t   DH.insertBefore(insertBefore, config, returnDom !== true) :\t\n\t\t    \t   DH[!this.dom.firstChild ? 'overwrite' : 'append'](this.dom, config,  returnDom !== true);\n\t\t},\n\t\t\n\t\t/**\n\t\t * Creates and wraps this element with another element\n\t\t * @param {Object} config (optional) DomHelper element config object for the wrapper element or null for an empty div\n\t\t * @param {Boolean} returnDom (optional) True to return the raw DOM element instead of Ext.Element\n\t\t * @return {HTMLElement/Element} The newly created wrapper element\n\t\t */\n\t\twrap: function(config, returnDom){        \n\t\t    var newEl = DH.insertBefore(this.dom, config || {tag: \"div\"}, !returnDom);\n\t\t    newEl.dom ? newEl.dom.appendChild(this.dom) : newEl.appendChild(this.dom);\n\t\t    return newEl;\n\t\t},\n\t\t\n\t\t/**\n\t\t * Inserts an html fragment into this element\n\t\t * @param {String} where Where to insert the html in relation to this element - beforeBegin, afterBegin, beforeEnd, afterEnd.\n\t\t * @param {String} html The HTML fragment\n\t\t * @param {Boolean} returnEl (optional) True to return an Ext.Element (defaults to false)\n\t\t * @return {HTMLElement/Ext.Element} The inserted node (or nearest related if more than 1 inserted)\n\t\t */\n\t\tinsertHtml : function(where, html, returnEl){\n\t\t    var el = DH.insertHtml(where, this.dom, html);\n\t\t    return returnEl ? Ext.get(el) : el;\n\t\t}\n\t};\n}());/**\n * @class Ext.Element\n */\nExt.Element.addMethods(function(){\n    // local style camelizing for speed\n    var supports = Ext.supports,\n        propCache = {},\n        camelRe = /(-[a-z])/gi,\n        view = document.defaultView,\n        opacityRe = /alpha\\(opacity=(.*)\\)/i,\n        trimRe = /^\\s+|\\s+$/g,\n        EL = Ext.Element,\n        spacesRe = /\\s+/,\n        wordsRe = /\\w/g,\n        PADDING = \"padding\",\n        MARGIN = \"margin\",\n        BORDER = \"border\",\n        LEFT = \"-left\",\n        RIGHT = \"-right\",\n        TOP = \"-top\",\n        BOTTOM = \"-bottom\",\n        WIDTH = \"-width\",\n        MATH = Math,\n        HIDDEN = 'hidden',\n        ISCLIPPED = 'isClipped',\n        OVERFLOW = 'overflow',\n        OVERFLOWX = 'overflow-x',\n        OVERFLOWY = 'overflow-y',\n        ORIGINALCLIP = 'originalClip',\n        // special markup used throughout Ext when box wrapping elements\n        borders = {l: BORDER + LEFT + WIDTH, r: BORDER + RIGHT + WIDTH, t: BORDER + TOP + WIDTH, b: BORDER + BOTTOM + WIDTH},\n        paddings = {l: PADDING + LEFT, r: PADDING + RIGHT, t: PADDING + TOP, b: PADDING + BOTTOM},\n        margins = {l: MARGIN + LEFT, r: MARGIN + RIGHT, t: MARGIN + TOP, b: MARGIN + BOTTOM},\n        data = Ext.Element.data;\n\n\n    // private\n    function camelFn(m, a) {\n        return a.charAt(1).toUpperCase();\n    }\n\n    function chkCache(prop) {\n        return propCache[prop] || (propCache[prop] = prop == 'float' ? (supports.cssFloat ? 'cssFloat' : 'styleFloat') : prop.replace(camelRe, camelFn));\n    }\n\n    return {\n        // private  ==> used by Fx\n        adjustWidth : function(width) {\n            var me = this;\n            var isNum = (typeof width == \"number\");\n            if(isNum && me.autoBoxAdjust && !me.isBorderBox()){\n               width -= (me.getBorderWidth(\"lr\") + me.getPadding(\"lr\"));\n            }\n            return (isNum && width < 0) ? 0 : width;\n        },\n\n        // private   ==> used by Fx\n        adjustHeight : function(height) {\n            var me = this;\n            var isNum = (typeof height == \"number\");\n            if(isNum && me.autoBoxAdjust && !me.isBorderBox()){\n               height -= (me.getBorderWidth(\"tb\") + me.getPadding(\"tb\"));\n            }\n            return (isNum && height < 0) ? 0 : height;\n        },\n\n\n        /**\n         * Adds one or more CSS classes to the element. Duplicate classes are automatically filtered out.\n         * @param {String/Array} className The CSS class to add, or an array of classes\n         * @return {Ext.Element} this\n         */\n        addClass : function(className){\n            var me = this,\n                i,\n                len,\n                v,\n                cls = [];\n            // Separate case is for speed\n            if (!Ext.isArray(className)) {\n                if (typeof className == 'string' && !this.hasClass(className)) {\n                    me.dom.className += \" \" + className;\n                }\n            }\n            else {\n                for (i = 0, len = className.length; i < len; i++) {\n                    v = className[i];\n                    if (typeof v == 'string' && (' ' + me.dom.className + ' ').indexOf(' ' + v + ' ') == -1) {\n                        cls.push(v);\n                    }\n                }\n                if (cls.length) {\n                    me.dom.className += \" \" + cls.join(\" \");\n                }\n            }\n            return me;\n        },\n\n        /**\n         * Removes one or more CSS classes from the element.\n         * @param {String/Array} className The CSS class to remove, or an array of classes\n         * @return {Ext.Element} this\n         */\n        removeClass : function(className){\n            var me = this,\n                i,\n                idx,\n                len,\n                cls,\n                elClasses;\n            if (!Ext.isArray(className)){\n                className = [className];\n            }\n            if (me.dom && me.dom.className) {\n                elClasses = me.dom.className.replace(trimRe, '').split(spacesRe);\n                for (i = 0, len = className.length; i < len; i++) {\n                    cls = className[i];\n                    if (typeof cls == 'string') {\n                        cls = cls.replace(trimRe, '');\n                        idx = elClasses.indexOf(cls);\n                        if (idx != -1) {\n                            elClasses.splice(idx, 1);\n                        }\n                    }\n                }\n                me.dom.className = elClasses.join(\" \");\n            }\n            return me;\n        },\n\n        /**\n         * Adds one or more CSS classes to this element and removes the same class(es) from all siblings.\n         * @param {String/Array} className The CSS class to add, or an array of classes\n         * @return {Ext.Element} this\n         */\n        radioClass : function(className){\n            var cn = this.dom.parentNode.childNodes,\n                v,\n                i,\n                len;\n            className = Ext.isArray(className) ? className : [className];\n            for (i = 0, len = cn.length; i < len; i++) {\n                v = cn[i];\n                if (v && v.nodeType == 1) {\n                    Ext.fly(v, '_internal').removeClass(className);\n                }\n            };\n            return this.addClass(className);\n        },\n\n        /**\n         * Toggles the specified CSS class on this element (removes it if it already exists, otherwise adds it).\n         * @param {String} className The CSS class to toggle\n         * @return {Ext.Element} this\n         */\n        toggleClass : function(className){\n            return this.hasClass(className) ? this.removeClass(className) : this.addClass(className);\n        },\n\n        /**\n         * Checks if the specified CSS class exists on this element's DOM node.\n         * @param {String} className The CSS class to check for\n         * @return {Boolean} True if the class exists, else false\n         */\n        hasClass : function(className){\n            return className && (' '+this.dom.className+' ').indexOf(' '+className+' ') != -1;\n        },\n\n        /**\n         * Replaces a CSS class on the element with another.  If the old name does not exist, the new name will simply be added.\n         * @param {String} oldClassName The CSS class to replace\n         * @param {String} newClassName The replacement CSS class\n         * @return {Ext.Element} this\n         */\n        replaceClass : function(oldClassName, newClassName){\n            return this.removeClass(oldClassName).addClass(newClassName);\n        },\n\n        isStyle : function(style, val) {\n            return this.getStyle(style) == val;\n        },\n\n        /**\n         * Normalizes currentStyle and computedStyle.\n         * @param {String} property The style property whose value is returned.\n         * @return {String} The current value of the style property for this element.\n         */\n        getStyle : function(){\n            return view && view.getComputedStyle ?\n                function(prop){\n                    var el = this.dom,\n                        v,\n                        cs,\n                        out,\n                        display;\n\n                    if(el == document){\n                        return null;\n                    }\n                    prop = chkCache(prop);\n                    out = (v = el.style[prop]) ? v :\n                           (cs = view.getComputedStyle(el, \"\")) ? cs[prop] : null;\n                           \n                    // Ignore cases when the margin is correctly reported as 0, the bug only shows\n                    // numbers larger.\n                    if(prop == 'marginRight' && out != '0px' && !supports.correctRightMargin){\n                        display = el.style.display;\n                        el.style.display = 'inline-block';\n                        out = view.getComputedStyle(el, '').marginRight;\n                        el.style.display = display;\n                    }\n                    \n                    if(prop == 'backgroundColor' && out == 'rgba(0, 0, 0, 0)' && !supports.correctTransparentColor){\n                        out = 'transparent';\n                    }\n                    return out;\n                } :\n                function(prop){\n                    var el = this.dom,\n                        m,\n                        cs;\n\n                    if(el == document) return null;\n                    if (prop == 'opacity') {\n                        if (el.style.filter.match) {\n                            if(m = el.style.filter.match(opacityRe)){\n                                var fv = parseFloat(m[1]);\n                                if(!isNaN(fv)){\n                                    return fv ? fv / 100 : 0;\n                                }\n                            }\n                        }\n                        return 1;\n                    }\n                    prop = chkCache(prop);\n                    return el.style[prop] || ((cs = el.currentStyle) ? cs[prop] : null);\n                };\n        }(),\n\n        /**\n         * Return the CSS color for the specified CSS attribute. rgb, 3 digit (like #fff) and valid values\n         * are convert to standard 6 digit hex color.\n         * @param {String} attr The css attribute\n         * @param {String} defaultValue The default value to use when a valid color isn't found\n         * @param {String} prefix (optional) defaults to #. Use an empty string when working with\n         * color anims.\n         */\n        getColor : function(attr, defaultValue, prefix){\n            var v = this.getStyle(attr),\n                color = (typeof prefix != 'undefined') ? prefix : '#',\n                h;\n\n            if(!v || (/transparent|inherit/.test(v))) {\n                return defaultValue;\n            }\n            if(/^r/.test(v)){\n                Ext.each(v.slice(4, v.length -1).split(','), function(s){\n                    h = parseInt(s, 10);\n                    color += (h < 16 ? '0' : '') + h.toString(16);\n                });\n            }else{\n                v = v.replace('#', '');\n                color += v.length == 3 ? v.replace(/^(\\w)(\\w)(\\w)$/, '$1$1$2$2$3$3') : v;\n            }\n            return(color.length > 5 ? color.toLowerCase() : defaultValue);\n        },\n\n        /**\n         * Wrapper for setting style properties, also takes single object parameter of multiple styles.\n         * @param {String/Object} property The style property to be set, or an object of multiple styles.\n         * @param {String} value (optional) The value to apply to the given property, or null if an object was passed.\n         * @return {Ext.Element} this\n         */\n        setStyle : function(prop, value){\n            var tmp, style;\n            \n            if (typeof prop != 'object') {\n                tmp = {};\n                tmp[prop] = value;\n                prop = tmp;\n            }\n            for (style in prop) {\n                value = prop[style];\n                style == 'opacity' ?\n                    this.setOpacity(value) :\n                    this.dom.style[chkCache(style)] = value;\n            }\n            return this;\n        },\n\n        /**\n         * Set the opacity of the element\n         * @param {Float} opacity The new opacity. 0 = transparent, .5 = 50% visibile, 1 = fully visible, etc\n         * @param {Boolean/Object} animate (optional) a standard Element animation config object or <tt>true</tt> for\n         * the default animation (<tt>{duration: .35, easing: 'easeIn'}</tt>)\n         * @return {Ext.Element} this\n         */\n         setOpacity : function(opacity, animate){\n            var me = this,\n                s = me.dom.style;\n\n            if(!animate || !me.anim){\n                if(Ext.isIE9m){\n                    var opac = opacity < 1 ? 'alpha(opacity=' + opacity * 100 + ')' : '',\n                    val = s.filter.replace(opacityRe, '').replace(trimRe, '');\n\n                    s.zoom = 1;\n                    s.filter = val + (val.length > 0 ? ' ' : '') + opac;\n                }else{\n                    s.opacity = opacity;\n                }\n            }else{\n                me.anim({opacity: {to: opacity}}, me.preanim(arguments, 1), null, .35, 'easeIn');\n            }\n            return me;\n        },\n\n        /**\n         * Clears any opacity settings from this element. Required in some cases for IE.\n         * @return {Ext.Element} this\n         */\n        clearOpacity : function(){\n            var style = this.dom.style;\n            if(Ext.isIE9m){\n                if(!Ext.isEmpty(style.filter)){\n                    style.filter = style.filter.replace(opacityRe, '').replace(trimRe, '');\n                }\n            }else{\n                style.opacity = style['-moz-opacity'] = style['-khtml-opacity'] = '';\n            }\n            return this;\n        },\n\n        /**\n         * Returns the offset height of the element\n         * @param {Boolean} contentHeight (optional) true to get the height minus borders and padding\n         * @return {Number} The element's height\n         */\n        getHeight : function(contentHeight){\n            var me = this,\n                dom = me.dom,\n                hidden = Ext.isIE9m && me.isStyle('display', 'none'),\n                h = MATH.max(dom.offsetHeight, hidden ? 0 : dom.clientHeight) || 0;\n\n            h = !contentHeight ? h : h - me.getBorderWidth(\"tb\") - me.getPadding(\"tb\");\n            return h < 0 ? 0 : h;\n        },\n\n        /**\n         * Returns the offset width of the element\n         * @param {Boolean} contentWidth (optional) true to get the width minus borders and padding\n         * @return {Number} The element's width\n         */\n        getWidth : function(contentWidth){\n            var me = this,\n                dom = me.dom,\n                hidden = Ext.isIE9m && me.isStyle('display', 'none'),\n                w = MATH.max(dom.offsetWidth, hidden ? 0 : dom.clientWidth) || 0;\n            w = !contentWidth ? w : w - me.getBorderWidth(\"lr\") - me.getPadding(\"lr\");\n            return w < 0 ? 0 : w;\n        },\n\n        /**\n         * Set the width of this Element.\n         * @param {Mixed} width The new width. This may be one of:<div class=\"mdetail-params\"><ul>\n         * <li>A Number specifying the new width in this Element's {@link #defaultUnit}s (by default, pixels).</li>\n         * <li>A String used to set the CSS width style. Animation may <b>not</b> be used.\n         * </ul></div>\n         * @param {Boolean/Object} animate (optional) true for the default animation or a standard Element animation config object\n         * @return {Ext.Element} this\n         */\n        setWidth : function(width, animate){\n            var me = this;\n            width = me.adjustWidth(width);\n            !animate || !me.anim ?\n                me.dom.style.width = me.addUnits(width) :\n                me.anim({width : {to : width}}, me.preanim(arguments, 1));\n            return me;\n        },\n\n        /**\n         * Set the height of this Element.\n         * <pre><code>\n// change the height to 200px and animate with default configuration\nExt.fly('elementId').setHeight(200, true);\n\n// change the height to 150px and animate with a custom configuration\nExt.fly('elId').setHeight(150, {\n    duration : .5, // animation will have a duration of .5 seconds\n    // will change the content to \"finished\"\n    callback: function(){ this.{@link #update}(\"finished\"); }\n});\n         * </code></pre>\n         * @param {Mixed} height The new height. This may be one of:<div class=\"mdetail-params\"><ul>\n         * <li>A Number specifying the new height in this Element's {@link #defaultUnit}s (by default, pixels.)</li>\n         * <li>A String used to set the CSS height style. Animation may <b>not</b> be used.</li>\n         * </ul></div>\n         * @param {Boolean/Object} animate (optional) true for the default animation or a standard Element animation config object\n         * @return {Ext.Element} this\n         */\n         setHeight : function(height, animate){\n            var me = this;\n            height = me.adjustHeight(height);\n            !animate || !me.anim ?\n                me.dom.style.height = me.addUnits(height) :\n                me.anim({height : {to : height}}, me.preanim(arguments, 1));\n            return me;\n        },\n\n        /**\n         * Gets the width of the border(s) for the specified side(s)\n         * @param {String} side Can be t, l, r, b or any combination of those to add multiple values. For example,\n         * passing <tt>'lr'</tt> would get the border <b><u>l</u></b>eft width + the border <b><u>r</u></b>ight width.\n         * @return {Number} The width of the sides passed added together\n         */\n        getBorderWidth : function(side){\n            return this.addStyles(side, borders);\n        },\n\n        /**\n         * Gets the width of the padding(s) for the specified side(s)\n         * @param {String} side Can be t, l, r, b or any combination of those to add multiple values. For example,\n         * passing <tt>'lr'</tt> would get the padding <b><u>l</u></b>eft + the padding <b><u>r</u></b>ight.\n         * @return {Number} The padding of the sides passed added together\n         */\n        getPadding : function(side){\n            return this.addStyles(side, paddings);\n        },\n\n        /**\n         *  Store the current overflow setting and clip overflow on the element - use <tt>{@link #unclip}</tt> to remove\n         * @return {Ext.Element} this\n         */\n        clip : function(){\n            var me = this,\n                dom = me.dom;\n\n            if(!data(dom, ISCLIPPED)){\n                data(dom, ISCLIPPED, true);\n                data(dom, ORIGINALCLIP, {\n                    o: me.getStyle(OVERFLOW),\n                    x: me.getStyle(OVERFLOWX),\n                    y: me.getStyle(OVERFLOWY)\n                });\n                me.setStyle(OVERFLOW, HIDDEN);\n                me.setStyle(OVERFLOWX, HIDDEN);\n                me.setStyle(OVERFLOWY, HIDDEN);\n            }\n            return me;\n        },\n\n        /**\n         *  Return clipping (overflow) to original clipping before <tt>{@link #clip}</tt> was called\n         * @return {Ext.Element} this\n         */\n        unclip : function(){\n            var me = this,\n                dom = me.dom;\n\n            if(data(dom, ISCLIPPED)){\n                data(dom, ISCLIPPED, false);\n                var o = data(dom, ORIGINALCLIP);\n                if(o.o){\n                    me.setStyle(OVERFLOW, o.o);\n                }\n                if(o.x){\n                    me.setStyle(OVERFLOWX, o.x);\n                }\n                if(o.y){\n                    me.setStyle(OVERFLOWY, o.y);\n                }\n            }\n            return me;\n        },\n\n        // private\n        addStyles : function(sides, styles){\n            var ttlSize = 0,\n                sidesArr = sides.match(wordsRe),\n                side,\n                size,\n                i,\n                len = sidesArr.length;\n            for (i = 0; i < len; i++) {\n                side = sidesArr[i];\n                size = side && parseInt(this.getStyle(styles[side]), 10);\n                if (size) {\n                    ttlSize += MATH.abs(size);\n                }\n            }\n            return ttlSize;\n        },\n\n        margins : margins\n    };\n}()\n);\n/**\n * @class Ext.Element\n */\n(function(){\nvar D = Ext.lib.Dom,\n        LEFT = \"left\",\n        RIGHT = \"right\",\n        TOP = \"top\",\n        BOTTOM = \"bottom\",\n        POSITION = \"position\",\n        STATIC = \"static\",\n        RELATIVE = \"relative\",\n        AUTO = \"auto\",\n        ZINDEX = \"z-index\";\n\nExt.Element.addMethods({\n\t/**\n      * Gets the current X position of the element based on page coordinates.  Element must be part of the DOM tree to have page coordinates (display:none or elements not appended return false).\n      * @return {Number} The X position of the element\n      */\n    getX : function(){\n        return D.getX(this.dom);\n    },\n\n    /**\n      * Gets the current Y position of the element based on page coordinates.  Element must be part of the DOM tree to have page coordinates (display:none or elements not appended return false).\n      * @return {Number} The Y position of the element\n      */\n    getY : function(){\n        return D.getY(this.dom);\n    },\n\n    /**\n      * Gets the current position of the element based on page coordinates.  Element must be part of the DOM tree to have page coordinates (display:none or elements not appended return false).\n      * @return {Array} The XY position of the element\n      */\n    getXY : function(){\n        return D.getXY(this.dom);\n    },\n\n    /**\n      * Returns the offsets of this element from the passed element. Both element must be part of the DOM tree and not have display:none to have page coordinates.\n      * @param {Mixed} element The element to get the offsets from.\n      * @return {Array} The XY page offsets (e.g. [100, -200])\n      */\n    getOffsetsTo : function(el){\n        var o = this.getXY(),\n        \te = Ext.fly(el, '_internal').getXY();\n        return [o[0]-e[0],o[1]-e[1]];\n    },\n\n    /**\n     * Sets the X position of the element based on page coordinates.  Element must be part of the DOM tree to have page coordinates (display:none or elements not appended return false).\n     * @param {Number} The X position of the element\n     * @param {Boolean/Object} animate (optional) True for the default animation, or a standard Element animation config object\n     * @return {Ext.Element} this\n     */\n    setX : function(x, animate){\t    \n\t    return this.setXY([x, this.getY()], this.animTest(arguments, animate, 1));\n    },\n\n    /**\n     * Sets the Y position of the element based on page coordinates.  Element must be part of the DOM tree to have page coordinates (display:none or elements not appended return false).\n     * @param {Number} The Y position of the element\n     * @param {Boolean/Object} animate (optional) True for the default animation, or a standard Element animation config object\n     * @return {Ext.Element} this\n     */\n    setY : function(y, animate){\t    \n\t    return this.setXY([this.getX(), y], this.animTest(arguments, animate, 1));\n    },\n\n    /**\n     * Sets the element's left position directly using CSS style (instead of {@link #setX}).\n     * @param {String} left The left CSS property value\n     * @return {Ext.Element} this\n     */\n    setLeft : function(left){\n        this.setStyle(LEFT, this.addUnits(left));\n        return this;\n    },\n\n    /**\n     * Sets the element's top position directly using CSS style (instead of {@link #setY}).\n     * @param {String} top The top CSS property value\n     * @return {Ext.Element} this\n     */\n    setTop : function(top){\n        this.setStyle(TOP, this.addUnits(top));\n        return this;\n    },\n\n    /**\n     * Sets the element's CSS right style.\n     * @param {String} right The right CSS property value\n     * @return {Ext.Element} this\n     */\n    setRight : function(right){\n        this.setStyle(RIGHT, this.addUnits(right));\n        return this;\n    },\n\n    /**\n     * Sets the element's CSS bottom style.\n     * @param {String} bottom The bottom CSS property value\n     * @return {Ext.Element} this\n     */\n    setBottom : function(bottom){\n        this.setStyle(BOTTOM, this.addUnits(bottom));\n        return this;\n    },\n\n    /**\n     * Sets the position of the element in page coordinates, regardless of how the element is positioned.\n     * The element must be part of the DOM tree to have page coordinates (display:none or elements not appended return false).\n     * @param {Array} pos Contains X & Y [x, y] values for new position (coordinates are page-based)\n     * @param {Boolean/Object} animate (optional) True for the default animation, or a standard Element animation config object\n     * @return {Ext.Element} this\n     */\n    setXY : function(pos, animate){\n\t    var me = this;\n        if(!animate || !me.anim){\n            D.setXY(me.dom, pos);\n        }else{\n            me.anim({points: {to: pos}}, me.preanim(arguments, 1), 'motion');\n        }\n        return me;\n    },\n\n    /**\n     * Sets the position of the element in page coordinates, regardless of how the element is positioned.\n     * The element must be part of the DOM tree to have page coordinates (display:none or elements not appended return false).\n     * @param {Number} x X value for new position (coordinates are page-based)\n     * @param {Number} y Y value for new position (coordinates are page-based)\n     * @param {Boolean/Object} animate (optional) True for the default animation, or a standard Element animation config object\n     * @return {Ext.Element} this\n     */\n    setLocation : function(x, y, animate){\n        return this.setXY([x, y], this.animTest(arguments, animate, 2));\n    },\n\n    /**\n     * Sets the position of the element in page coordinates, regardless of how the element is positioned.\n     * The element must be part of the DOM tree to have page coordinates (display:none or elements not appended return false).\n     * @param {Number} x X value for new position (coordinates are page-based)\n     * @param {Number} y Y value for new position (coordinates are page-based)\n     * @param {Boolean/Object} animate (optional) True for the default animation, or a standard Element animation config object\n     * @return {Ext.Element} this\n     */\n    moveTo : function(x, y, animate){\n        return this.setXY([x, y], this.animTest(arguments, animate, 2));        \n    },    \n    \n    /**\n     * Gets the left X coordinate\n     * @param {Boolean} local True to get the local css position instead of page coordinate\n     * @return {Number}\n     */\n    getLeft : function(local){\n\t    return !local ? this.getX() : parseInt(this.getStyle(LEFT), 10) || 0;\n    },\n\n    /**\n     * Gets the right X coordinate of the element (element X position + element width)\n     * @param {Boolean} local True to get the local css position instead of page coordinate\n     * @return {Number}\n     */\n    getRight : function(local){\n\t    var me = this;\n\t    return !local ? me.getX() + me.getWidth() : (me.getLeft(true) + me.getWidth()) || 0;\n    },\n\n    /**\n     * Gets the top Y coordinate\n     * @param {Boolean} local True to get the local css position instead of page coordinate\n     * @return {Number}\n     */\n    getTop : function(local) {\n\t    return !local ? this.getY() : parseInt(this.getStyle(TOP), 10) || 0;\n    },\n\n    /**\n     * Gets the bottom Y coordinate of the element (element Y position + element height)\n     * @param {Boolean} local True to get the local css position instead of page coordinate\n     * @return {Number}\n     */\n    getBottom : function(local){\n\t    var me = this;\n\t    return !local ? me.getY() + me.getHeight() : (me.getTop(true) + me.getHeight()) || 0;\n    },\n\n    /**\n    * Initializes positioning on this element. If a desired position is not passed, it will make the\n    * the element positioned relative IF it is not already positioned.\n    * @param {String} pos (optional) Positioning to use \"relative\", \"absolute\" or \"fixed\"\n    * @param {Number} zIndex (optional) The zIndex to apply\n    * @param {Number} x (optional) Set the page X position\n    * @param {Number} y (optional) Set the page Y position\n    */\n    position : function(pos, zIndex, x, y){\n\t    var me = this;\n\t    \n        if(!pos && me.isStyle(POSITION, STATIC)){           \n            me.setStyle(POSITION, RELATIVE);           \n        } else if(pos) {\n            me.setStyle(POSITION, pos);\n        }\n        if(zIndex){\n            me.setStyle(ZINDEX, zIndex);\n        }\n        if(x || y) me.setXY([x || false, y || false]);\n    },\n\n    /**\n    * Clear positioning back to the default when the document was loaded\n    * @param {String} value (optional) The value to use for the left,right,top,bottom, defaults to '' (empty string). You could use 'auto'.\n    * @return {Ext.Element} this\n     */\n    clearPositioning : function(value){\n        value = value || '';\n        this.setStyle({\n            left : value,\n            right : value,\n            top : value,\n            bottom : value,\n            \"z-index\" : \"\",\n            position : STATIC\n        });\n        return this;\n    },\n\n    /**\n    * Gets an object with all CSS positioning properties. Useful along with setPostioning to get\n    * snapshot before performing an update and then restoring the element.\n    * @return {Object}\n    */\n    getPositioning : function(){\n        var l = this.getStyle(LEFT);\n        var t = this.getStyle(TOP);\n        return {\n            \"position\" : this.getStyle(POSITION),\n            \"left\" : l,\n            \"right\" : l ? \"\" : this.getStyle(RIGHT),\n            \"top\" : t,\n            \"bottom\" : t ? \"\" : this.getStyle(BOTTOM),\n            \"z-index\" : this.getStyle(ZINDEX)\n        };\n    },\n    \n    /**\n    * Set positioning with an object returned by getPositioning().\n    * @param {Object} posCfg\n    * @return {Ext.Element} this\n     */\n    setPositioning : function(pc){\n\t    var me = this,\n\t    \tstyle = me.dom.style;\n\t    \t\n        me.setStyle(pc);\n        \n        if(pc.right == AUTO){\n            style.right = \"\";\n        }\n        if(pc.bottom == AUTO){\n            style.bottom = \"\";\n        }\n        \n        return me;\n    },    \n\t\n    /**\n     * Translates the passed page coordinates into left/top css values for this element\n     * @param {Number/Array} x The page x or an array containing [x, y]\n     * @param {Number} y (optional) The page y, required if x is not an array\n     * @return {Object} An object with left and top properties. e.g. {left: (value), top: (value)}\n     */\n    translatePoints : function(x, y){        \t     \n\t    y = isNaN(x[1]) ? y : x[1];\n        x = isNaN(x[0]) ? x : x[0];\n        var me = this,\n        \trelative = me.isStyle(POSITION, RELATIVE),\n        \to = me.getXY(),\n        \tl = parseInt(me.getStyle(LEFT), 10),\n        \tt = parseInt(me.getStyle(TOP), 10);\n        \n        l = !isNaN(l) ? l : (relative ? 0 : me.dom.offsetLeft);\n        t = !isNaN(t) ? t : (relative ? 0 : me.dom.offsetTop);        \n\n        return {left: (x - o[0] + l), top: (y - o[1] + t)}; \n    },\n    \n    animTest : function(args, animate, i) {\n        return !!animate && this.preanim ? this.preanim(args, i) : false;\n    }\n});\n})();/**\n * @class Ext.Element\n */\nExt.Element.addMethods({\n    /**\n     * Returns true if this element is scrollable.\n     * @return {Boolean}\n     */\n    isScrollable : function(){\n        var dom = this.dom;\n        return dom.scrollHeight > dom.clientHeight || dom.scrollWidth > dom.clientWidth;\n    },\n\n    /**\n     * Scrolls this element the specified scroll point. It does NOT do bounds checking so if you scroll to a weird value it will try to do it. For auto bounds checking, use scroll().\n     * @param {String} side Either \"left\" for scrollLeft values or \"top\" for scrollTop values.\n     * @param {Number} value The new scroll value.\n     * @return {Element} this\n     */\n    scrollTo : function(side, value){\n        this.dom[\"scroll\" + (/top/i.test(side) ? \"Top\" : \"Left\")] = value;\n        return this;\n    },\n\n    /**\n     * Returns the current scroll position of the element.\n     * @return {Object} An object containing the scroll position in the format {left: (scrollLeft), top: (scrollTop)}\n     */\n    getScroll : function(){\n        var d = this.dom, \n            doc = document,\n            body = doc.body,\n            docElement = doc.documentElement,\n            l,\n            t,\n            ret;\n\n        if(d == doc || d == body){\n            if(Ext.isIE && Ext.isStrict){\n                l = docElement.scrollLeft; \n                t = docElement.scrollTop;\n            }else{\n                l = window.pageXOffset;\n                t = window.pageYOffset;\n            }\n            ret = {left: l || (body ? body.scrollLeft : 0), top: t || (body ? body.scrollTop : 0)};\n        }else{\n            ret = {left: d.scrollLeft, top: d.scrollTop};\n        }\n        return ret;\n    }\n});/**\n * @class Ext.Element\n */\n/**\n * Visibility mode constant for use with {@link #setVisibilityMode}. Use visibility to hide element\n * @static\n * @type Number\n */\nExt.Element.VISIBILITY = 1;\n/**\n * Visibility mode constant for use with {@link #setVisibilityMode}. Use display to hide element\n * @static\n * @type Number\n */\nExt.Element.DISPLAY = 2;\n\n/**\n * Visibility mode constant for use with {@link #setVisibilityMode}. Use offsets (x and y positioning offscreen)\n * to hide element.\n * @static\n * @type Number\n */\nExt.Element.OFFSETS = 3;\n\n\nExt.Element.ASCLASS = 4;\n\n/**\n * Defaults to 'x-hide-nosize'\n * @static\n * @type String\n */\nExt.Element.visibilityCls = 'x-hide-nosize';\n\nExt.Element.addMethods(function(){\n    var El = Ext.Element,\n        OPACITY = \"opacity\",\n        VISIBILITY = \"visibility\",\n        DISPLAY = \"display\",\n        HIDDEN = \"hidden\",\n        OFFSETS = \"offsets\",\n        ASCLASS = \"asclass\",\n        NONE = \"none\",\n        NOSIZE = 'nosize',\n        ORIGINALDISPLAY = 'originalDisplay',\n        VISMODE = 'visibilityMode',\n        ISVISIBLE = 'isVisible',\n        data = El.data,\n        getDisplay = function(dom){\n            var d = data(dom, ORIGINALDISPLAY);\n            if(d === undefined){\n                data(dom, ORIGINALDISPLAY, d = '');\n            }\n            return d;\n        },\n        getVisMode = function(dom){\n            var m = data(dom, VISMODE);\n            if(m === undefined){\n                data(dom, VISMODE, m = 1);\n            }\n            return m;\n        };\n\n    return {\n        /**\n         * The element's default display mode  (defaults to \"\")\n         * @type String\n         */\n        originalDisplay : \"\",\n        visibilityMode : 1,\n\n        /**\n         * Sets the element's visibility mode. When setVisible() is called it\n         * will use this to determine whether to set the visibility or the display property.\n         * @param {Number} visMode Ext.Element.VISIBILITY or Ext.Element.DISPLAY\n         * @return {Ext.Element} this\n         */\n        setVisibilityMode : function(visMode){\n            data(this.dom, VISMODE, visMode);\n            return this;\n        },\n\n        /**\n         * Perform custom animation on this element.\n         * <div><ul class=\"mdetail-params\">\n         * <li><u>Animation Properties</u></li>\n         *\n         * <p>The Animation Control Object enables gradual transitions for any member of an\n         * element's style object that takes a numeric value including but not limited to\n         * these properties:</p><div><ul class=\"mdetail-params\">\n         * <li><tt>bottom, top, left, right</tt></li>\n         * <li><tt>height, width</tt></li>\n         * <li><tt>margin, padding</tt></li>\n         * <li><tt>borderWidth</tt></li>\n         * <li><tt>opacity</tt></li>\n         * <li><tt>fontSize</tt></li>\n         * <li><tt>lineHeight</tt></li>\n         * </ul></div>\n         *\n         *\n         * <li><u>Animation Property Attributes</u></li>\n         *\n         * <p>Each Animation Property is a config object with optional properties:</p>\n         * <div><ul class=\"mdetail-params\">\n         * <li><tt>by</tt>*  : relative change - start at current value, change by this value</li>\n         * <li><tt>from</tt> : ignore current value, start from this value</li>\n         * <li><tt>to</tt>*  : start at current value, go to this value</li>\n         * <li><tt>unit</tt> : any allowable unit specification</li>\n         * <p>* do not specify both <tt>to</tt> and <tt>by</tt> for an animation property</p>\n         * </ul></div>\n         *\n         * <li><u>Animation Types</u></li>\n         *\n         * <p>The supported animation types:</p><div><ul class=\"mdetail-params\">\n         * <li><tt>'run'</tt> : Default\n         * <pre><code>\nvar el = Ext.get('complexEl');\nel.animate(\n    // animation control object\n    {\n        borderWidth: {to: 3, from: 0},\n        opacity: {to: .3, from: 1},\n        height: {to: 50, from: el.getHeight()},\n        width: {to: 300, from: el.getWidth()},\n        top  : {by: - 100, unit: 'px'},\n    },\n    0.35,      // animation duration\n    null,      // callback\n    'easeOut', // easing method\n    'run'      // animation type ('run','color','motion','scroll')\n);\n         * </code></pre>\n         * </li>\n         * <li><tt>'color'</tt>\n         * <p>Animates transition of background, text, or border colors.</p>\n         * <pre><code>\nel.animate(\n    // animation control object\n    {\n        color: { to: '#06e' },\n        backgroundColor: { to: '#e06' }\n    },\n    0.35,      // animation duration\n    null,      // callback\n    'easeOut', // easing method\n    'color'    // animation type ('run','color','motion','scroll')\n);\n         * </code></pre>\n         * </li>\n         *\n         * <li><tt>'motion'</tt>\n         * <p>Animates the motion of an element to/from specific points using optional bezier\n         * way points during transit.</p>\n         * <pre><code>\nel.animate(\n    // animation control object\n    {\n        borderWidth: {to: 3, from: 0},\n        opacity: {to: .3, from: 1},\n        height: {to: 50, from: el.getHeight()},\n        width: {to: 300, from: el.getWidth()},\n        top  : {by: - 100, unit: 'px'},\n        points: {\n            to: [50, 100],  // go to this point\n            control: [      // optional bezier way points\n                [ 600, 800],\n                [-100, 200]\n            ]\n        }\n    },\n    3000,      // animation duration (milliseconds!)\n    null,      // callback\n    'easeOut', // easing method\n    'motion'   // animation type ('run','color','motion','scroll')\n);\n         * </code></pre>\n         * </li>\n         * <li><tt>'scroll'</tt>\n         * <p>Animate horizontal or vertical scrolling of an overflowing page element.</p>\n         * <pre><code>\nel.animate(\n    // animation control object\n    {\n        scroll: {to: [400, 300]}\n    },\n    0.35,      // animation duration\n    null,      // callback\n    'easeOut', // easing method\n    'scroll'   // animation type ('run','color','motion','scroll')\n);\n         * </code></pre>\n         * </li>\n         * </ul></div>\n         *\n         * </ul></div>\n         *\n         * @param {Object} args The animation control args\n         * @param {Float} duration (optional) How long the animation lasts in seconds (defaults to <tt>.35</tt>)\n         * @param {Function} onComplete (optional) Function to call when animation completes\n         * @param {String} easing (optional) {@link Ext.Fx#easing} method to use (defaults to <tt>'easeOut'</tt>)\n         * @param {String} animType (optional) <tt>'run'</tt> is the default. Can also be <tt>'color'</tt>,\n         * <tt>'motion'</tt>, or <tt>'scroll'</tt>\n         * @return {Ext.Element} this\n         */\n        animate : function(args, duration, onComplete, easing, animType){\n            this.anim(args, {duration: duration, callback: onComplete, easing: easing}, animType);\n            return this;\n        },\n\n        /*\n         * @private Internal animation call\n         */\n        anim : function(args, opt, animType, defaultDur, defaultEase, cb){\n            animType = animType || 'run';\n            opt = opt || {};\n            var me = this,\n                anim = Ext.lib.Anim[animType](\n                    me.dom,\n                    args,\n                    (opt.duration || defaultDur) || .35,\n                    (opt.easing || defaultEase) || 'easeOut',\n                    function(){\n                        if(cb) cb.call(me);\n                        if(opt.callback) opt.callback.call(opt.scope || me, me, opt);\n                    },\n                    me\n                );\n            opt.anim = anim;\n            return anim;\n        },\n\n        // private legacy anim prep\n        preanim : function(a, i){\n            return !a[i] ? false : (typeof a[i] == 'object' ? a[i]: {duration: a[i+1], callback: a[i+2], easing: a[i+3]});\n        },\n\n        /**\n         * Checks whether the element is currently visible using both visibility and display properties.\n         * @return {Boolean} True if the element is currently visible, else false\n         */\n        isVisible : function() {\n            var me = this,\n                dom = me.dom,\n                visible = data(dom, ISVISIBLE);\n\n            if(typeof visible == 'boolean'){ //return the cached value if registered\n                return visible;\n            }\n            //Determine the current state based on display states\n            visible = !me.isStyle(VISIBILITY, HIDDEN) &&\n                      !me.isStyle(DISPLAY, NONE) &&\n                      !((getVisMode(dom) == El.ASCLASS) && me.hasClass(me.visibilityCls || El.visibilityCls));\n\n            data(dom, ISVISIBLE, visible);\n            return visible;\n        },\n\n        /**\n         * Sets the visibility of the element (see details). If the visibilityMode is set to Element.DISPLAY, it will use\n         * the display property to hide the element, otherwise it uses visibility. The default is to hide and show using the visibility property.\n         * @param {Boolean} visible Whether the element is visible\n         * @param {Boolean/Object} animate (optional) True for the default animation, or a standard Element animation config object\n         * @return {Ext.Element} this\n         */\n        setVisible : function(visible, animate){\n            var me = this, isDisplay, isVisibility, isOffsets, isNosize,\n                dom = me.dom,\n                visMode = getVisMode(dom);\n\n\n            // hideMode string override\n            if (typeof animate == 'string'){\n                switch (animate) {\n                    case DISPLAY:\n                        visMode = El.DISPLAY;\n                        break;\n                    case VISIBILITY:\n                        visMode = El.VISIBILITY;\n                        break;\n                    case OFFSETS:\n                        visMode = El.OFFSETS;\n                        break;\n                    case NOSIZE:\n                    case ASCLASS:\n                        visMode = El.ASCLASS;\n                        break;\n                }\n                me.setVisibilityMode(visMode);\n                animate = false;\n            }\n\n            if (!animate || !me.anim) {\n                if(visMode == El.ASCLASS ){\n\n                    me[visible?'removeClass':'addClass'](me.visibilityCls || El.visibilityCls);\n\n                } else if (visMode == El.DISPLAY){\n\n                    return me.setDisplayed(visible);\n\n                } else if (visMode == El.OFFSETS){\n\n                    if (!visible){\n                        me.hideModeStyles = {\n                            position: me.getStyle('position'),\n                            top: me.getStyle('top'),\n                            left: me.getStyle('left')\n                        };\n                        me.applyStyles({position: 'absolute', top: '-10000px', left: '-10000px'});\n                    } else {\n                        me.applyStyles(me.hideModeStyles || {position: '', top: '', left: ''});\n                        delete me.hideModeStyles;\n                    }\n\n                }else{\n                    me.fixDisplay();\n                    dom.style.visibility = visible ? \"visible\" : HIDDEN;\n                }\n            }else{\n                // closure for composites\n                if(visible){\n                    me.setOpacity(.01);\n                    me.setVisible(true);\n                }\n                me.anim({opacity: { to: (visible?1:0) }},\n                        me.preanim(arguments, 1),\n                        null,\n                        .35,\n                        'easeIn',\n                        function(){\n                            visible || me.setVisible(false).setOpacity(1);\n                        });\n            }\n            data(dom, ISVISIBLE, visible);  //set logical visibility state\n            return me;\n        },\n\n\n        /**\n         * @private\n         * Determine if the Element has a relevant height and width available based\n         * upon current logical visibility state\n         */\n        hasMetrics  : function(){\n            var dom = this.dom;\n            return this.isVisible() || (getVisMode(dom) == El.VISIBILITY);\n        },\n\n        /**\n         * Toggles the element's visibility or display, depending on visibility mode.\n         * @param {Boolean/Object} animate (optional) True for the default animation, or a standard Element animation config object\n         * @return {Ext.Element} this\n         */\n        toggle : function(animate){\n            var me = this;\n            me.setVisible(!me.isVisible(), me.preanim(arguments, 0));\n            return me;\n        },\n\n        /**\n         * Sets the CSS display property. Uses originalDisplay if the specified value is a boolean true.\n         * @param {Mixed} value Boolean value to display the element using its default display, or a string to set the display directly.\n         * @return {Ext.Element} this\n         */\n        setDisplayed : function(value) {\n            if(typeof value == \"boolean\"){\n               value = value ? getDisplay(this.dom) : NONE;\n            }\n            this.setStyle(DISPLAY, value);\n            return this;\n        },\n\n        // private\n        fixDisplay : function(){\n            var me = this;\n            if(me.isStyle(DISPLAY, NONE)){\n                me.setStyle(VISIBILITY, HIDDEN);\n                me.setStyle(DISPLAY, getDisplay(this.dom)); // first try reverting to default\n                if(me.isStyle(DISPLAY, NONE)){ // if that fails, default to block\n                    me.setStyle(DISPLAY, \"block\");\n                }\n            }\n        },\n\n        /**\n         * Hide this element - Uses display mode to determine whether to use \"display\" or \"visibility\". See {@link #setVisible}.\n         * @param {Boolean/Object} animate (optional) true for the default animation or a standard Element animation config object\n         * @return {Ext.Element} this\n         */\n        hide : function(animate){\n            // hideMode override\n            if (typeof animate == 'string'){\n                this.setVisible(false, animate);\n                return this;\n            }\n            this.setVisible(false, this.preanim(arguments, 0));\n            return this;\n        },\n\n        /**\n        * Show this element - Uses display mode to determine whether to use \"display\" or \"visibility\". See {@link #setVisible}.\n        * @param {Boolean/Object} animate (optional) true for the default animation or a standard Element animation config object\n         * @return {Ext.Element} this\n         */\n        show : function(animate){\n            // hideMode override\n            if (typeof animate == 'string'){\n                this.setVisible(true, animate);\n                return this;\n            }\n            this.setVisible(true, this.preanim(arguments, 0));\n            return this;\n        }\n    };\n}());(function(){\n    // contants\n    var NULL = null,\n        UNDEFINED = undefined,\n        TRUE = true,\n        FALSE = false,\n        SETX = \"setX\",\n        SETY = \"setY\",\n        SETXY = \"setXY\",\n        LEFT = \"left\",\n        BOTTOM = \"bottom\",\n        TOP = \"top\",\n        RIGHT = \"right\",\n        HEIGHT = \"height\",\n        WIDTH = \"width\",\n        POINTS = \"points\",\n        HIDDEN = \"hidden\",\n        ABSOLUTE = \"absolute\",\n        VISIBLE = \"visible\",\n        MOTION = \"motion\",\n        POSITION = \"position\",\n        EASEOUT = \"easeOut\",\n        /*\n         * Use a light flyweight here since we are using so many callbacks and are always assured a DOM element\n         */\n        flyEl = new Ext.Element.Flyweight(),\n        queues = {},\n        getObject = function(o){\n            return o || {};\n        },\n        fly = function(dom){\n            flyEl.dom = dom;\n            flyEl.id = Ext.id(dom);\n            return flyEl;\n        },\n        /*\n         * Queueing now stored outside of the element due to closure issues\n         */\n        getQueue = function(id){\n            if(!queues[id]){\n                queues[id] = [];\n            }\n            return queues[id];\n        },\n        setQueue = function(id, value){\n            queues[id] = value;\n        };\n        \n//Notifies Element that fx methods are available\nExt.enableFx = TRUE;\n\n/**\n * @class Ext.Fx\n * <p>A class to provide basic animation and visual effects support.  <b>Note:</b> This class is automatically applied\n * to the {@link Ext.Element} interface when included, so all effects calls should be performed via {@link Ext.Element}.\n * Conversely, since the effects are not actually defined in {@link Ext.Element}, Ext.Fx <b>must</b> be\n * {@link Ext#enableFx included} in order for the Element effects to work.</p><br/>\n * \n * <p><b><u>Method Chaining</u></b></p>\n * <p>It is important to note that although the Fx methods and many non-Fx Element methods support \"method chaining\" in that\n * they return the Element object itself as the method return value, it is not always possible to mix the two in a single\n * method chain.  The Fx methods use an internal effects queue so that each effect can be properly timed and sequenced.\n * Non-Fx methods, on the other hand, have no such internal queueing and will always execute immediately.  For this reason,\n * while it may be possible to mix certain Fx and non-Fx method calls in a single chain, it may not always provide the\n * expected results and should be done with care.  Also see <tt>{@link #callback}</tt>.</p><br/>\n *\n * <p><b><u>Anchor Options for Motion Effects</u></b></p>\n * <p>Motion effects support 8-way anchoring, meaning that you can choose one of 8 different anchor points on the Element\n * that will serve as either the start or end point of the animation.  Following are all of the supported anchor positions:</p>\n<pre>\nValue  Description\n-----  -----------------------------\ntl     The top left corner\nt      The center of the top edge\ntr     The top right corner\nl      The center of the left edge\nr      The center of the right edge\nbl     The bottom left corner\nb      The center of the bottom edge\nbr     The bottom right corner\n</pre>\n * <b>Note</b>: some Fx methods accept specific custom config parameters.  The options shown in the Config Options\n * section below are common options that can be passed to any Fx method unless otherwise noted.</b>\n * \n * @cfg {Function} callback A function called when the effect is finished.  Note that effects are queued internally by the\n * Fx class, so a callback is not required to specify another effect -- effects can simply be chained together\n * and called in sequence (see note for <b><u>Method Chaining</u></b> above), for example:<pre><code>\n * el.slideIn().highlight();\n * </code></pre>\n * The callback is intended for any additional code that should run once a particular effect has completed. The Element\n * being operated upon is passed as the first parameter.\n * \n * @cfg {Object} scope The scope (<code>this</code> reference) in which the <tt>{@link #callback}</tt> function is executed. Defaults to the browser window.\n * \n * @cfg {String} easing A valid Ext.lib.Easing value for the effect:</p><div class=\"mdetail-params\"><ul>\n * <li><b><tt>backBoth</tt></b></li>\n * <li><b><tt>backIn</tt></b></li>\n * <li><b><tt>backOut</tt></b></li>\n * <li><b><tt>bounceBoth</tt></b></li>\n * <li><b><tt>bounceIn</tt></b></li>\n * <li><b><tt>bounceOut</tt></b></li>\n * <li><b><tt>easeBoth</tt></b></li>\n * <li><b><tt>easeBothStrong</tt></b></li>\n * <li><b><tt>easeIn</tt></b></li>\n * <li><b><tt>easeInStrong</tt></b></li>\n * <li><b><tt>easeNone</tt></b></li>\n * <li><b><tt>easeOut</tt></b></li>\n * <li><b><tt>easeOutStrong</tt></b></li>\n * <li><b><tt>elasticBoth</tt></b></li>\n * <li><b><tt>elasticIn</tt></b></li>\n * <li><b><tt>elasticOut</tt></b></li>\n * </ul></div>\n *\n * @cfg {String} afterCls A css class to apply after the effect\n * @cfg {Number} duration The length of time (in seconds) that the effect should last\n * \n * @cfg {Number} endOpacity Only applicable for {@link #fadeIn} or {@link #fadeOut}, a number between\n * <tt>0</tt> and <tt>1</tt> inclusive to configure the ending opacity value.\n *  \n * @cfg {Boolean} remove Whether the Element should be removed from the DOM and destroyed after the effect finishes\n * @cfg {Boolean} useDisplay Whether to use the <i>display</i> CSS property instead of <i>visibility</i> when hiding Elements (only applies to \n * effects that end with the element being visually hidden, ignored otherwise)\n * @cfg {String/Object/Function} afterStyle A style specification string, e.g. <tt>\"width:100px\"</tt>, or an object\n * in the form <tt>{width:\"100px\"}</tt>, or a function which returns such a specification that will be applied to the\n * Element after the effect finishes.\n * @cfg {Boolean} block Whether the effect should block other effects from queueing while it runs\n * @cfg {Boolean} concurrent Whether to allow subsequently-queued effects to run at the same time as the current effect, or to ensure that they run in sequence\n * @cfg {Boolean} stopFx Whether preceding effects should be stopped and removed before running current effect (only applies to non blocking effects)\n */\nExt.Fx = {\n    \n    // private - calls the function taking arguments from the argHash based on the key.  Returns the return value of the function.\n    //           this is useful for replacing switch statements (for example).\n    switchStatements : function(key, fn, argHash){\n        return fn.apply(this, argHash[key]);\n    },\n    \n    /**\n     * Slides the element into view.  An anchor point can be optionally passed to set the point of\n     * origin for the slide effect.  This function automatically handles wrapping the element with\n     * a fixed-size container if needed.  See the Fx class overview for valid anchor point options.\n     * Usage:\n     *<pre><code>\n// default: slide the element in from the top\nel.slideIn();\n\n// custom: slide the element in from the right with a 2-second duration\nel.slideIn('r', { duration: 2 });\n\n// common config options shown with default values\nel.slideIn('t', {\n    easing: 'easeOut',\n    duration: .5\n});\n</code></pre>\n     * @param {String} anchor (optional) One of the valid Fx anchor positions (defaults to top: 't')\n     * @param {Object} options (optional) Object literal with any of the Fx config options\n     * @return {Ext.Element} The Element\n     */\n    slideIn : function(anchor, o){ \n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            st = dom.style,\n            xy,\n            r,\n            b,              \n            wrap,               \n            after,\n            st,\n            args, \n            pt,\n            bw,\n            bh;\n            \n        anchor = anchor || \"t\";\n\n        me.queueFx(o, function(){            \n            xy = fly(dom).getXY();\n            // fix display to visibility\n            fly(dom).fixDisplay();            \n            \n            // restore values after effect\n            r = fly(dom).getFxRestore();      \n            b = {x: xy[0], y: xy[1], 0: xy[0], 1: xy[1], width: dom.offsetWidth, height: dom.offsetHeight};\n            b.right = b.x + b.width;\n            b.bottom = b.y + b.height;\n            \n            // fixed size for slide\n            fly(dom).setWidth(b.width).setHeight(b.height);            \n            \n            // wrap if needed\n            wrap = fly(dom).fxWrap(r.pos, o, HIDDEN);\n            \n            st.visibility = VISIBLE;\n            st.position = ABSOLUTE;\n            \n            // clear out temp styles after slide and unwrap\n            function after(){\n                 fly(dom).fxUnwrap(wrap, r.pos, o);\n                 st.width = r.width;\n                 st.height = r.height;\n                 fly(dom).afterFx(o);\n            }\n            \n            // time to calculate the positions        \n            pt = {to: [b.x, b.y]}; \n            bw = {to: b.width};\n            bh = {to: b.height};\n                \n            function argCalc(wrap, style, ww, wh, sXY, sXYval, s1, s2, w, h, p){                    \n                var ret = {};\n                fly(wrap).setWidth(ww).setHeight(wh);\n                if(fly(wrap)[sXY]){\n                    fly(wrap)[sXY](sXYval);                  \n                }\n                style[s1] = style[s2] = \"0\";                    \n                if(w){\n                    ret.width = w;\n                }\n                if(h){\n                    ret.height = h;\n                }\n                if(p){\n                    ret.points = p;\n                }\n                return ret;\n            };\n\n            args = fly(dom).switchStatements(anchor.toLowerCase(), argCalc, {\n                    t  : [wrap, st, b.width, 0, NULL, NULL, LEFT, BOTTOM, NULL, bh, NULL],\n                    l  : [wrap, st, 0, b.height, NULL, NULL, RIGHT, TOP, bw, NULL, NULL],\n                    r  : [wrap, st, b.width, b.height, SETX, b.right, LEFT, TOP, NULL, NULL, pt],\n                    b  : [wrap, st, b.width, b.height, SETY, b.bottom, LEFT, TOP, NULL, bh, pt],\n                    tl : [wrap, st, 0, 0, NULL, NULL, RIGHT, BOTTOM, bw, bh, pt],\n                    bl : [wrap, st, 0, 0, SETY, b.y + b.height, RIGHT, TOP, bw, bh, pt],\n                    br : [wrap, st, 0, 0, SETXY, [b.right, b.bottom], LEFT, TOP, bw, bh, pt],\n                    tr : [wrap, st, 0, 0, SETX, b.x + b.width, LEFT, BOTTOM, bw, bh, pt]\n                });\n            \n            st.visibility = VISIBLE;\n            fly(wrap).show();\n\n            arguments.callee.anim = fly(wrap).fxanim(args,\n                o,\n                MOTION,\n                .5,\n                EASEOUT, \n                after);\n        });\n        return me;\n    },\n    \n    /**\n     * Slides the element out of view.  An anchor point can be optionally passed to set the end point\n     * for the slide effect.  When the effect is completed, the element will be hidden (visibility = \n     * 'hidden') but block elements will still take up space in the document.  The element must be removed\n     * from the DOM using the 'remove' config option if desired.  This function automatically handles \n     * wrapping the element with a fixed-size container if needed.  See the Fx class overview for valid anchor point options.\n     * Usage:\n     *<pre><code>\n// default: slide the element out to the top\nel.slideOut();\n\n// custom: slide the element out to the right with a 2-second duration\nel.slideOut('r', { duration: 2 });\n\n// common config options shown with default values\nel.slideOut('t', {\n    easing: 'easeOut',\n    duration: .5,\n    remove: false,\n    useDisplay: false\n});\n</code></pre>\n     * @param {String} anchor (optional) One of the valid Fx anchor positions (defaults to top: 't')\n     * @param {Object} options (optional) Object literal with any of the Fx config options\n     * @return {Ext.Element} The Element\n     */\n    slideOut : function(anchor, o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            st = dom.style,\n            xy = me.getXY(),\n            wrap,\n            r,\n            b,\n            a,\n            zero = {to: 0}; \n                    \n        anchor = anchor || \"t\";\n\n        me.queueFx(o, function(){\n            \n            // restore values after effect\n            r = fly(dom).getFxRestore(); \n            b = {x: xy[0], y: xy[1], 0: xy[0], 1: xy[1], width: dom.offsetWidth, height: dom.offsetHeight};\n            b.right = b.x + b.width;\n            b.bottom = b.y + b.height;\n                \n            // fixed size for slide   \n            fly(dom).setWidth(b.width).setHeight(b.height);\n\n            // wrap if needed\n            wrap = fly(dom).fxWrap(r.pos, o, VISIBLE);\n                \n            st.visibility = VISIBLE;\n            st.position = ABSOLUTE;\n            fly(wrap).setWidth(b.width).setHeight(b.height);            \n\n            function after(){\n                o.useDisplay ? fly(dom).setDisplayed(FALSE) : fly(dom).hide();                \n                fly(dom).fxUnwrap(wrap, r.pos, o);\n                st.width = r.width;\n                st.height = r.height;\n                fly(dom).afterFx(o);\n            }            \n            \n            function argCalc(style, s1, s2, p1, v1, p2, v2, p3, v3){                    \n                var ret = {};\n                \n                style[s1] = style[s2] = \"0\";\n                ret[p1] = v1;               \n                if(p2){\n                    ret[p2] = v2;               \n                }\n                if(p3){\n                    ret[p3] = v3;\n                }\n                \n                return ret;\n            };\n            \n            a = fly(dom).switchStatements(anchor.toLowerCase(), argCalc, {\n                t  : [st, LEFT, BOTTOM, HEIGHT, zero],\n                l  : [st, RIGHT, TOP, WIDTH, zero],\n                r  : [st, LEFT, TOP, WIDTH, zero, POINTS, {to : [b.right, b.y]}],\n                b  : [st, LEFT, TOP, HEIGHT, zero, POINTS, {to : [b.x, b.bottom]}],\n                tl : [st, RIGHT, BOTTOM, WIDTH, zero, HEIGHT, zero],\n                bl : [st, RIGHT, TOP, WIDTH, zero, HEIGHT, zero, POINTS, {to : [b.x, b.bottom]}],\n                br : [st, LEFT, TOP, WIDTH, zero, HEIGHT, zero, POINTS, {to : [b.x + b.width, b.bottom]}],\n                tr : [st, LEFT, BOTTOM, WIDTH, zero, HEIGHT, zero, POINTS, {to : [b.right, b.y]}]\n            });\n            \n            arguments.callee.anim = fly(wrap).fxanim(a,\n                o,\n                MOTION,\n                .5,\n                EASEOUT, \n                after);\n        });\n        return me;\n    },\n\n    /**\n     * Fades the element out while slowly expanding it in all directions.  When the effect is completed, the \n     * element will be hidden (visibility = 'hidden') but block elements will still take up space in the document. \n     * The element must be removed from the DOM using the 'remove' config option if desired.\n     * Usage:\n     *<pre><code>\n// default\nel.puff();\n\n// common config options shown with default values\nel.puff({\n    easing: 'easeOut',\n    duration: .5,\n    remove: false,\n    useDisplay: false\n});\n</code></pre>\n     * @param {Object} options (optional) Object literal with any of the Fx config options\n     * @return {Ext.Element} The Element\n     */\n    puff : function(o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            st = dom.style,\n            width,\n            height,\n            r;\n\n        me.queueFx(o, function(){\n            width = fly(dom).getWidth();\n            height = fly(dom).getHeight();\n            fly(dom).clearOpacity();\n            fly(dom).show();\n\n            // restore values after effect\n            r = fly(dom).getFxRestore();                   \n            \n            function after(){\n                o.useDisplay ? fly(dom).setDisplayed(FALSE) : fly(dom).hide();                  \n                fly(dom).clearOpacity();  \n                fly(dom).setPositioning(r.pos);\n                st.width = r.width;\n                st.height = r.height;\n                st.fontSize = '';\n                fly(dom).afterFx(o);\n            }   \n\n            arguments.callee.anim = fly(dom).fxanim({\n                    width : {to : fly(dom).adjustWidth(width * 2)},\n                    height : {to : fly(dom).adjustHeight(height * 2)},\n                    points : {by : [-width * .5, -height * .5]},\n                    opacity : {to : 0},\n                    fontSize: {to : 200, unit: \"%\"}\n                },\n                o,\n                MOTION,\n                .5,\n                EASEOUT,\n                 after);\n        });\n        return me;\n    },\n\n    /**\n     * Blinks the element as if it was clicked and then collapses on its center (similar to switching off a television).\n     * When the effect is completed, the element will be hidden (visibility = 'hidden') but block elements will still \n     * take up space in the document. The element must be removed from the DOM using the 'remove' config option if desired.\n     * Usage:\n     *<pre><code>\n// default\nel.switchOff();\n\n// all config options shown with default values\nel.switchOff({\n    easing: 'easeIn',\n    duration: .3,\n    remove: false,\n    useDisplay: false\n});\n</code></pre>\n     * @param {Object} options (optional) Object literal with any of the Fx config options\n     * @return {Ext.Element} The Element\n     */\n    switchOff : function(o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            st = dom.style,\n            r;\n\n        me.queueFx(o, function(){\n            fly(dom).clearOpacity();\n            fly(dom).clip();\n\n            // restore values after effect\n            r = fly(dom).getFxRestore();\n                \n            function after(){\n                o.useDisplay ? fly(dom).setDisplayed(FALSE) : fly(dom).hide();  \n                fly(dom).clearOpacity();\n                fly(dom).setPositioning(r.pos);\n                st.width = r.width;\n                st.height = r.height;   \n                fly(dom).afterFx(o);\n            };\n\n            fly(dom).fxanim({opacity : {to : 0.3}}, \n                NULL, \n                NULL, \n                .1, \n                NULL, \n                function(){                                 \n                    fly(dom).clearOpacity();\n                        (function(){                            \n                            fly(dom).fxanim({\n                                height : {to : 1},\n                                points : {by : [0, fly(dom).getHeight() * .5]}\n                            }, \n                            o, \n                            MOTION, \n                            0.3, \n                            'easeIn', \n                            after);\n                        }).defer(100);\n                });\n        });\n        return me;\n    },\n\n    /**\n     * Highlights the Element by setting a color (applies to the background-color by default, but can be\n     * changed using the \"attr\" config option) and then fading back to the original color. If no original\n     * color is available, you should provide the \"endColor\" config option which will be cleared after the animation.\n     * Usage:\n<pre><code>\n// default: highlight background to yellow\nel.highlight();\n\n// custom: highlight foreground text to blue for 2 seconds\nel.highlight(\"0000ff\", { attr: 'color', duration: 2 });\n\n// common config options shown with default values\nel.highlight(\"ffff9c\", {\n    attr: \"background-color\", //can be any valid CSS property (attribute) that supports a color value\n    endColor: (current color) or \"ffffff\",\n    easing: 'easeIn',\n    duration: 1\n});\n</code></pre>\n     * @param {String} color (optional) The highlight color. Should be a 6 char hex color without the leading # (defaults to yellow: 'ffff9c')\n     * @param {Object} options (optional) Object literal with any of the Fx config options\n     * @return {Ext.Element} The Element\n     */ \n    highlight : function(color, o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            attr = o.attr || \"backgroundColor\",\n            a = {},\n            restore;\n\n        me.queueFx(o, function(){\n            fly(dom).clearOpacity();\n            fly(dom).show();\n\n            function after(){\n                dom.style[attr] = restore;\n                fly(dom).afterFx(o);\n            }            \n            restore = dom.style[attr];\n            a[attr] = {from: color || \"ffff9c\", to: o.endColor || fly(dom).getColor(attr) || \"ffffff\"};\n            arguments.callee.anim = fly(dom).fxanim(a,\n                o,\n                'color',\n                1,\n                'easeIn', \n                after);\n        });\n        return me;\n    },\n\n   /**\n    * Shows a ripple of exploding, attenuating borders to draw attention to an Element.\n    * Usage:\n<pre><code>\n// default: a single light blue ripple\nel.frame();\n\n// custom: 3 red ripples lasting 3 seconds total\nel.frame(\"ff0000\", 3, { duration: 3 });\n\n// common config options shown with default values\nel.frame(\"C3DAF9\", 1, {\n    duration: 1 //duration of each individual ripple.\n    // Note: Easing is not configurable and will be ignored if included\n});\n</code></pre>\n    * @param {String} color (optional) The color of the border.  Should be a 6 char hex color without the leading # (defaults to light blue: 'C3DAF9').\n    * @param {Number} count (optional) The number of ripples to display (defaults to 1)\n    * @param {Object} options (optional) Object literal with any of the Fx config options\n    * @return {Ext.Element} The Element\n    */\n    frame : function(color, count, o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            proxy,\n            active;\n\n        me.queueFx(o, function(){\n            color = color || '#C3DAF9';\n            if(color.length == 6){\n                color = '#' + color;\n            }            \n            count = count || 1;\n            fly(dom).show();\n\n            var xy = fly(dom).getXY(),\n                b = {x: xy[0], y: xy[1], 0: xy[0], 1: xy[1], width: dom.offsetWidth, height: dom.offsetHeight},\n                queue = function(){\n                    proxy = fly(document.body || document.documentElement).createChild({\n                        style:{\n                            position : ABSOLUTE,\n                            'z-index': 35000, // yee haw\n                            border : '0px solid ' + color\n                        }\n                    });\n                    return proxy.queueFx({}, animFn);\n                };\n            \n            \n            arguments.callee.anim = {\n                isAnimated: true,\n                stop: function() {\n                    count = 0;\n                    proxy.stopFx();\n                }\n            };\n            \n            function animFn(){\n                var scale = Ext.isBorderBox ? 2 : 1;\n                active = proxy.anim({\n                    top : {from : b.y, to : b.y - 20},\n                    left : {from : b.x, to : b.x - 20},\n                    borderWidth : {from : 0, to : 10},\n                    opacity : {from : 1, to : 0},\n                    height : {from : b.height, to : b.height + 20 * scale},\n                    width : {from : b.width, to : b.width + 20 * scale}\n                },{\n                    duration: o.duration || 1,\n                    callback: function() {\n                        proxy.remove();\n                        --count > 0 ? queue() : fly(dom).afterFx(o);\n                    }\n                });\n                arguments.callee.anim = {\n                    isAnimated: true,\n                    stop: function(){\n                        active.stop();\n                    }\n                };\n            };\n            queue();\n        });\n        return me;\n    },\n\n   /**\n    * Creates a pause before any subsequent queued effects begin.  If there are\n    * no effects queued after the pause it will have no effect.\n    * Usage:\n<pre><code>\nel.pause(1);\n</code></pre>\n    * @param {Number} seconds The length of time to pause (in seconds)\n    * @return {Ext.Element} The Element\n    */\n    pause : function(seconds){        \n        var dom = this.dom,\n            t;\n\n        this.queueFx({}, function(){\n            t = setTimeout(function(){\n                fly(dom).afterFx({});\n            }, seconds * 1000);\n            arguments.callee.anim = {\n                isAnimated: true,\n                stop: function(){\n                    clearTimeout(t);\n                    fly(dom).afterFx({});\n                }\n            };\n        });\n        return this;\n    },\n\n   /**\n    * Fade an element in (from transparent to opaque).  The ending opacity can be specified\n    * using the <tt>{@link #endOpacity}</tt> config option.\n    * Usage:\n<pre><code>\n// default: fade in from opacity 0 to 100%\nel.fadeIn();\n\n// custom: fade in from opacity 0 to 75% over 2 seconds\nel.fadeIn({ endOpacity: .75, duration: 2});\n\n// common config options shown with default values\nel.fadeIn({\n    endOpacity: 1, //can be any value between 0 and 1 (e.g. .5)\n    easing: 'easeOut',\n    duration: .5\n});\n</code></pre>\n    * @param {Object} options (optional) Object literal with any of the Fx config options\n    * @return {Ext.Element} The Element\n    */\n    fadeIn : function(o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            to = o.endOpacity || 1;\n        \n        me.queueFx(o, function(){\n            fly(dom).setOpacity(0);\n            fly(dom).fixDisplay();\n            dom.style.visibility = VISIBLE;\n            arguments.callee.anim = fly(dom).fxanim({opacity:{to:to}},\n                o, NULL, .5, EASEOUT, function(){\n                if(to == 1){\n                    fly(dom).clearOpacity();\n                }\n                fly(dom).afterFx(o);\n            });\n        });\n        return me;\n    },\n\n   /**\n    * Fade an element out (from opaque to transparent).  The ending opacity can be specified\n    * using the <tt>{@link #endOpacity}</tt> config option.  Note that IE may require\n    * <tt>{@link #useDisplay}:true</tt> in order to redisplay correctly.\n    * Usage:\n<pre><code>\n// default: fade out from the element's current opacity to 0\nel.fadeOut();\n\n// custom: fade out from the element's current opacity to 25% over 2 seconds\nel.fadeOut({ endOpacity: .25, duration: 2});\n\n// common config options shown with default values\nel.fadeOut({\n    endOpacity: 0, //can be any value between 0 and 1 (e.g. .5)\n    easing: 'easeOut',\n    duration: .5,\n    remove: false,\n    useDisplay: false\n});\n</code></pre>\n    * @param {Object} options (optional) Object literal with any of the Fx config options\n    * @return {Ext.Element} The Element\n    */\n    fadeOut : function(o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            style = dom.style,\n            to = o.endOpacity || 0;         \n        \n        me.queueFx(o, function(){  \n            arguments.callee.anim = fly(dom).fxanim({ \n                opacity : {to : to}},\n                o, \n                NULL, \n                .5, \n                EASEOUT, \n                function(){\n                    if(to == 0){\n                        Ext.Element.data(dom, 'visibilityMode') == Ext.Element.DISPLAY || o.useDisplay ? \n                            style.display = \"none\" :\n                            style.visibility = HIDDEN;\n                            \n                        fly(dom).clearOpacity();\n                    }\n                    fly(dom).afterFx(o);\n            });\n        });\n        return me;\n    },\n\n   /**\n    * Animates the transition of an element's dimensions from a starting height/width\n    * to an ending height/width.  This method is a convenience implementation of {@link shift}.\n    * Usage:\n<pre><code>\n// change height and width to 100x100 pixels\nel.scale(100, 100);\n\n// common config options shown with default values.  The height and width will default to\n// the element&#39;s existing values if passed as null.\nel.scale(\n    [element&#39;s width],\n    [element&#39;s height], {\n        easing: 'easeOut',\n        duration: .35\n    }\n);\n</code></pre>\n    * @param {Number} width  The new width (pass undefined to keep the original width)\n    * @param {Number} height  The new height (pass undefined to keep the original height)\n    * @param {Object} options (optional) Object literal with any of the Fx config options\n    * @return {Ext.Element} The Element\n    */\n    scale : function(w, h, o){\n        this.shift(Ext.apply({}, o, {\n            width: w,\n            height: h\n        }));\n        return this;\n    },\n\n   /**\n    * Animates the transition of any combination of an element's dimensions, xy position and/or opacity.\n    * Any of these properties not specified in the config object will not be changed.  This effect \n    * requires that at least one new dimension, position or opacity setting must be passed in on\n    * the config object in order for the function to have any effect.\n    * Usage:\n<pre><code>\n// slide the element horizontally to x position 200 while changing the height and opacity\nel.shift({ x: 200, height: 50, opacity: .8 });\n\n// common config options shown with default values.\nel.shift({\n    width: [element&#39;s width],\n    height: [element&#39;s height],\n    x: [element&#39;s x position],\n    y: [element&#39;s y position],\n    opacity: [element&#39;s opacity],\n    easing: 'easeOut',\n    duration: .35\n});\n</code></pre>\n    * @param {Object} options  Object literal with any of the Fx config options\n    * @return {Ext.Element} The Element\n    */\n    shift : function(o){\n        o = getObject(o);\n        var dom = this.dom,\n            a = {};\n                \n        this.queueFx(o, function(){\n            for (var prop in o) {\n                if (o[prop] != UNDEFINED) {                                                 \n                    a[prop] = {to : o[prop]};                   \n                }\n            } \n            \n            a.width ? a.width.to = fly(dom).adjustWidth(o.width) : a;\n            a.height ? a.height.to = fly(dom).adjustWidth(o.height) : a;   \n            \n            if (a.x || a.y || a.xy) {\n                a.points = a.xy || \n                           {to : [ a.x ? a.x.to : fly(dom).getX(),\n                                   a.y ? a.y.to : fly(dom).getY()]};                  \n            }\n\n            arguments.callee.anim = fly(dom).fxanim(a,\n                o, \n                MOTION, \n                .35, \n                EASEOUT, \n                function(){\n                    fly(dom).afterFx(o);\n                });\n        });\n        return this;\n    },\n\n    /**\n     * Slides the element while fading it out of view.  An anchor point can be optionally passed to set the \n     * ending point of the effect.\n     * Usage:\n     *<pre><code>\n// default: slide the element downward while fading out\nel.ghost();\n\n// custom: slide the element out to the right with a 2-second duration\nel.ghost('r', { duration: 2 });\n\n// common config options shown with default values\nel.ghost('b', {\n    easing: 'easeOut',\n    duration: .5,\n    remove: false,\n    useDisplay: false\n});\n</code></pre>\n     * @param {String} anchor (optional) One of the valid Fx anchor positions (defaults to bottom: 'b')\n     * @param {Object} options (optional) Object literal with any of the Fx config options\n     * @return {Ext.Element} The Element\n     */\n    ghost : function(anchor, o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            st = dom.style,\n            a = {opacity: {to: 0}, points: {}},\n            pt = a.points,\n            r,\n            w,\n            h;\n            \n        anchor = anchor || \"b\";\n\n        me.queueFx(o, function(){\n            // restore values after effect\n            r = fly(dom).getFxRestore();\n            w = fly(dom).getWidth();\n            h = fly(dom).getHeight();\n            \n            function after(){\n                o.useDisplay ? fly(dom).setDisplayed(FALSE) : fly(dom).hide();   \n                fly(dom).clearOpacity();\n                fly(dom).setPositioning(r.pos);\n                st.width = r.width;\n                st.height = r.height;\n                fly(dom).afterFx(o);\n            }\n                \n            pt.by = fly(dom).switchStatements(anchor.toLowerCase(), function(v1,v2){ return [v1, v2];}, {\n               t  : [0, -h],\n               l  : [-w, 0],\n               r  : [w, 0],\n               b  : [0, h],\n               tl : [-w, -h],\n               bl : [-w, h],\n               br : [w, h],\n               tr : [w, -h] \n            });\n                \n            arguments.callee.anim = fly(dom).fxanim(a,\n                o,\n                MOTION,\n                .5,\n                EASEOUT, after);\n        });\n        return me;\n    },\n\n    /**\n     * Ensures that all effects queued after syncFx is called on the element are\n     * run concurrently.  This is the opposite of {@link #sequenceFx}.\n     * @return {Ext.Element} The Element\n     */\n    syncFx : function(){\n        var me = this;\n        me.fxDefaults = Ext.apply(me.fxDefaults || {}, {\n            block : FALSE,\n            concurrent : TRUE,\n            stopFx : FALSE\n        });\n        return me;\n    },\n\n    /**\n     * Ensures that all effects queued after sequenceFx is called on the element are\n     * run in sequence.  This is the opposite of {@link #syncFx}.\n     * @return {Ext.Element} The Element\n     */\n    sequenceFx : function(){\n        var me = this;\n        me.fxDefaults = Ext.apply(me.fxDefaults || {}, {\n            block : FALSE,\n            concurrent : FALSE,\n            stopFx : FALSE\n        });\n        return me;\n    },\n\n    /* @private */\n    nextFx : function(){        \n        var ef = getQueue(this.dom.id)[0];\n        if(ef){\n            ef.call(this);\n        }\n    },\n\n    /**\n     * Returns true if the element has any effects actively running or queued, else returns false.\n     * @return {Boolean} True if element has active effects, else false\n     */\n    hasActiveFx : function(){\n        return getQueue(this.dom.id)[0];\n    },\n\n    /**\n     * Stops any running effects and clears the element's internal effects queue if it contains\n     * any additional effects that haven't started yet.\n     * @return {Ext.Element} The Element\n     */\n    stopFx : function(finish){\n        var me = this,\n            id = me.dom.id;\n        if(me.hasActiveFx()){\n            var cur = getQueue(id)[0];\n            if(cur && cur.anim){\n                if(cur.anim.isAnimated){\n                    setQueue(id, [cur]); //clear\n                    cur.anim.stop(finish !== undefined ? finish : TRUE);\n                }else{\n                    setQueue(id, []);\n                }\n            }\n        }\n        return me;\n    },\n\n    /* @private */\n    beforeFx : function(o){\n        if(this.hasActiveFx() && !o.concurrent){\n           if(o.stopFx){\n               this.stopFx();\n               return TRUE;\n           }\n           return FALSE;\n        }\n        return TRUE;\n    },\n\n    /**\n     * Returns true if the element is currently blocking so that no other effect can be queued\n     * until this effect is finished, else returns false if blocking is not set.  This is commonly\n     * used to ensure that an effect initiated by a user action runs to completion prior to the\n     * same effect being restarted (e.g., firing only one effect even if the user clicks several times).\n     * @return {Boolean} True if blocking, else false\n     */\n    hasFxBlock : function(){\n        var q = getQueue(this.dom.id);\n        return q && q[0] && q[0].block;\n    },\n\n    /* @private */\n    queueFx : function(o, fn){\n        var me = fly(this.dom);\n        if(!me.hasFxBlock()){\n            Ext.applyIf(o, me.fxDefaults);\n            if(!o.concurrent){\n                var run = me.beforeFx(o);\n                fn.block = o.block;\n                getQueue(me.dom.id).push(fn);\n                if(run){\n                    me.nextFx();\n                }\n            }else{\n                fn.call(me);\n            }\n        }\n        return me;\n    },\n\n    /* @private */\n    fxWrap : function(pos, o, vis){ \n        var dom = this.dom,\n            wrap,\n            wrapXY;\n        if(!o.wrap || !(wrap = Ext.getDom(o.wrap))){            \n            if(o.fixPosition){\n                wrapXY = fly(dom).getXY();\n            }\n            var div = document.createElement(\"div\");\n            div.style.visibility = vis;\n            wrap = dom.parentNode.insertBefore(div, dom);\n            fly(wrap).setPositioning(pos);\n            if(fly(wrap).isStyle(POSITION, \"static\")){\n                fly(wrap).position(\"relative\");\n            }\n            fly(dom).clearPositioning('auto');\n            fly(wrap).clip();\n            wrap.appendChild(dom);\n            if(wrapXY){\n                fly(wrap).setXY(wrapXY);\n            }\n        }\n        return wrap;\n    },\n\n    /* @private */\n    fxUnwrap : function(wrap, pos, o){      \n        var dom = this.dom;\n        fly(dom).clearPositioning();\n        fly(dom).setPositioning(pos);\n        if(!o.wrap){\n            var pn = fly(wrap).dom.parentNode;\n            pn.insertBefore(dom, wrap); \n            fly(wrap).remove();\n        }\n    },\n\n    /* @private */\n    getFxRestore : function(){\n        var st = this.dom.style;\n        return {pos: this.getPositioning(), width: st.width, height : st.height};\n    },\n\n    /* @private */\n    afterFx : function(o){\n        var dom = this.dom,\n            id = dom.id;\n        if(o.afterStyle){\n            fly(dom).setStyle(o.afterStyle);            \n        }\n        if(o.afterCls){\n            fly(dom).addClass(o.afterCls);\n        }\n        if(o.remove == TRUE){\n            fly(dom).remove();\n        }\n        if(o.callback){\n            o.callback.call(o.scope, fly(dom));\n        }\n        if(!o.concurrent){\n            getQueue(id).shift();\n            fly(dom).nextFx();\n        }\n    },\n\n    /* @private */\n    fxanim : function(args, opt, animType, defaultDur, defaultEase, cb){\n        animType = animType || 'run';\n        opt = opt || {};\n        var anim = Ext.lib.Anim[animType](\n                this.dom, \n                args,\n                (opt.duration || defaultDur) || .35,\n                (opt.easing || defaultEase) || EASEOUT,\n                cb,            \n                this\n            );\n        opt.anim = anim;\n        return anim;\n    }\n};\n\n// backwards compat\nExt.Fx.resize = Ext.Fx.scale;\n\n//When included, Ext.Fx is automatically applied to Element so that all basic\n//effects are available directly via the Element API\nExt.Element.addMethods(Ext.Fx);\n})();\n/**\n * @class Ext.CompositeElementLite\n * <p>This class encapsulates a <i>collection</i> of DOM elements, providing methods to filter\n * members, or to perform collective actions upon the whole set.</p>\n * <p>Although they are not listed, this class supports all of the methods of {@link Ext.Element} and\n * {@link Ext.Fx}. The methods from these classes will be performed on all the elements in this collection.</p>\n * Example:<pre><code>\nvar els = Ext.select(\"#some-el div.some-class\");\n// or select directly from an existing element\nvar el = Ext.get('some-el');\nel.select('div.some-class');\n\nels.setWidth(100); // all elements become 100 width\nels.hide(true); // all elements fade out and hide\n// or\nels.setWidth(100).hide(true);\n</code>\n */\nExt.CompositeElementLite = function(els, root){\n    /**\n     * <p>The Array of DOM elements which this CompositeElement encapsulates. Read-only.</p>\n     * <p>This will not <i>usually</i> be accessed in developers' code, but developers wishing\n     * to augment the capabilities of the CompositeElementLite class may use it when adding\n     * methods to the class.</p>\n     * <p>For example to add the <code>nextAll</code> method to the class to <b>add</b> all\n     * following siblings of selected elements, the code would be</p><code><pre>\nExt.override(Ext.CompositeElementLite, {\n    nextAll: function() {\n        var els = this.elements, i, l = els.length, n, r = [], ri = -1;\n\n//      Loop through all elements in this Composite, accumulating\n//      an Array of all siblings.\n        for (i = 0; i < l; i++) {\n            for (n = els[i].nextSibling; n; n = n.nextSibling) {\n                r[++ri] = n;\n            }\n        }\n\n//      Add all found siblings to this Composite\n        return this.add(r);\n    }\n});</pre></code>\n     * @type Array\n     * @property elements\n     */\n    this.elements = [];\n    this.add(els, root);\n    this.el = new Ext.Element.Flyweight();\n};\n\nExt.CompositeElementLite.prototype = {\n    isComposite: true,\n\n    // private\n    getElement : function(el){\n        // Set the shared flyweight dom property to the current element\n        var e = this.el;\n        e.dom = el;\n        e.id = el.id;\n        return e;\n    },\n\n    // private\n    transformElement : function(el){\n        return Ext.getDom(el);\n    },\n\n    /**\n     * Returns the number of elements in this Composite.\n     * @return Number\n     */\n    getCount : function(){\n        return this.elements.length;\n    },\n    /**\n     * Adds elements to this Composite object.\n     * @param {Mixed} els Either an Array of DOM elements to add, or another Composite object who's elements should be added.\n     * @return {CompositeElement} This Composite object.\n     */\n    add : function(els, root){\n        var me = this,\n            elements = me.elements;\n        if(!els){\n            return this;\n        }\n        if(typeof els == \"string\"){\n            els = Ext.Element.selectorFunction(els, root);\n        }else if(els.isComposite){\n            els = els.elements;\n        }else if(!Ext.isIterable(els)){\n            els = [els];\n        }\n\n        for(var i = 0, len = els.length; i < len; ++i){\n            elements.push(me.transformElement(els[i]));\n        }\n        return me;\n    },\n\n    invoke : function(fn, args){\n        var me = this,\n            els = me.elements,\n            len = els.length,\n            e,\n            i;\n\n        for(i = 0; i < len; i++) {\n            e = els[i];\n            if(e){\n                Ext.Element.prototype[fn].apply(me.getElement(e), args);\n            }\n        }\n        return me;\n    },\n    /**\n     * Returns a flyweight Element of the dom element object at the specified index\n     * @param {Number} index\n     * @return {Ext.Element}\n     */\n    item : function(index){\n        var me = this,\n            el = me.elements[index],\n            out = null;\n\n        if(el){\n            out = me.getElement(el);\n        }\n        return out;\n    },\n\n    // fixes scope with flyweight\n    addListener : function(eventName, handler, scope, opt){\n        var els = this.elements,\n            len = els.length,\n            i, e;\n\n        for(i = 0; i<len; i++) {\n            e = els[i];\n            if(e) {\n                Ext.EventManager.on(e, eventName, handler, scope || e, opt);\n            }\n        }\n        return this;\n    },\n    /**\n     * <p>Calls the passed function for each element in this composite.</p>\n     * @param {Function} fn The function to call. The function is passed the following parameters:<ul>\n     * <li><b>el</b> : Element<div class=\"sub-desc\">The current Element in the iteration.\n     * <b>This is the flyweight (shared) Ext.Element instance, so if you require a\n     * a reference to the dom node, use el.dom.</b></div></li>\n     * <li><b>c</b> : Composite<div class=\"sub-desc\">This Composite object.</div></li>\n     * <li><b>idx</b> : Number<div class=\"sub-desc\">The zero-based index in the iteration.</div></li>\n     * </ul>\n     * @param {Object} scope (optional) The scope (<i>this</i> reference) in which the function is executed. (defaults to the Element)\n     * @return {CompositeElement} this\n     */\n    each : function(fn, scope){\n        var me = this,\n            els = me.elements,\n            len = els.length,\n            i, e;\n\n        for(i = 0; i<len; i++) {\n            e = els[i];\n            if(e){\n                e = this.getElement(e);\n                if(fn.call(scope || e, e, me, i) === false){\n                    break;\n                }\n            }\n        }\n        return me;\n    },\n\n    /**\n    * Clears this Composite and adds the elements passed.\n    * @param {Mixed} els Either an array of DOM elements, or another Composite from which to fill this Composite.\n    * @return {CompositeElement} this\n    */\n    fill : function(els){\n        var me = this;\n        me.elements = [];\n        me.add(els);\n        return me;\n    },\n\n    /**\n     * Filters this composite to only elements that match the passed selector.\n     * @param {String/Function} selector A string CSS selector or a comparison function.\n     * The comparison function will be called with the following arguments:<ul>\n     * <li><code>el</code> : Ext.Element<div class=\"sub-desc\">The current DOM element.</div></li>\n     * <li><code>index</code> : Number<div class=\"sub-desc\">The current index within the collection.</div></li>\n     * </ul>\n     * @return {CompositeElement} this\n     */\n    filter : function(selector){\n        var els = [],\n            me = this,\n            fn = Ext.isFunction(selector) ? selector\n                : function(el){\n                    return el.is(selector);\n                };\n\n        me.each(function(el, self, i) {\n            if (fn(el, i) !== false) {\n                els[els.length] = me.transformElement(el);\n            }\n        });\n        \n        me.elements = els;\n        return me;\n    },\n\n    /**\n     * Find the index of the passed element within the composite collection.\n     * @param el {Mixed} The id of an element, or an Ext.Element, or an HtmlElement to find within the composite collection.\n     * @return Number The index of the passed Ext.Element in the composite collection, or -1 if not found.\n     */\n    indexOf : function(el){\n        return this.elements.indexOf(this.transformElement(el));\n    },\n\n    /**\n    * Replaces the specified element with the passed element.\n    * @param {Mixed} el The id of an element, the Element itself, the index of the element in this composite\n    * to replace.\n    * @param {Mixed} replacement The id of an element or the Element itself.\n    * @param {Boolean} domReplace (Optional) True to remove and replace the element in the document too.\n    * @return {CompositeElement} this\n    */\n    replaceElement : function(el, replacement, domReplace){\n        var index = !isNaN(el) ? el : this.indexOf(el),\n            d;\n        if(index > -1){\n            replacement = Ext.getDom(replacement);\n            if(domReplace){\n                d = this.elements[index];\n                d.parentNode.insertBefore(replacement, d);\n                Ext.removeNode(d);\n            }\n            this.elements.splice(index, 1, replacement);\n        }\n        return this;\n    },\n\n    /**\n     * Removes all elements.\n     */\n    clear : function(){\n        this.elements = [];\n    }\n};\n\nExt.CompositeElementLite.prototype.on = Ext.CompositeElementLite.prototype.addListener;\n\n/**\n * @private\n * Copies all of the functions from Ext.Element's prototype onto CompositeElementLite's prototype.\n * This is called twice - once immediately below, and once again after additional Ext.Element\n * are added in Ext JS\n */\nExt.CompositeElementLite.importElementMethods = function() {\n    var fnName,\n        ElProto = Ext.Element.prototype,\n        CelProto = Ext.CompositeElementLite.prototype;\n\n    for (fnName in ElProto) {\n        if (typeof ElProto[fnName] == 'function'){\n            (function(fnName) {\n                CelProto[fnName] = CelProto[fnName] || function() {\n                    return this.invoke(fnName, arguments);\n                };\n            }).call(CelProto, fnName);\n\n        }\n    }\n};\n\nExt.CompositeElementLite.importElementMethods();\n\nif(Ext.DomQuery){\n    Ext.Element.selectorFunction = Ext.DomQuery.select;\n}\n\n/**\n * Selects elements based on the passed CSS selector to enable {@link Ext.Element Element} methods\n * to be applied to many related elements in one statement through the returned {@link Ext.CompositeElement CompositeElement} or\n * {@link Ext.CompositeElementLite CompositeElementLite} object.\n * @param {String/Array} selector The CSS selector or an array of elements\n * @param {HTMLElement/String} root (optional) The root element of the query or id of the root\n * @return {CompositeElementLite/CompositeElement}\n * @member Ext.Element\n * @method select\n * @static\n */\nExt.Element.select = function(selector, root){\n    var els;\n    if(typeof selector == \"string\"){\n        els = Ext.Element.selectorFunction(selector, root);\n    }else if(selector.length !== undefined){\n        els = selector;\n    }else{\n        throw \"Invalid selector\";\n    }\n    return new Ext.CompositeElementLite(els);\n};\n/**\n * Selects elements based on the passed CSS selector to enable {@link Ext.Element Element} methods\n * to be applied to many related elements in one statement through the returned {@link Ext.CompositeElement CompositeElement} or\n * {@link Ext.CompositeElementLite CompositeElementLite} object.\n * @param {String/Array} selector The CSS selector or an array of elements\n * @param {HTMLElement/String} root (optional) The root element of the query or id of the root\n * @return {CompositeElementLite/CompositeElement}\n * @member Ext\n * @method select\n */\nExt.select = Ext.Element.select;\n(function(){\n    var BEFOREREQUEST = \"beforerequest\",\n        REQUESTCOMPLETE = \"requestcomplete\",\n        REQUESTEXCEPTION = \"requestexception\",\n        UNDEFINED = undefined,\n        LOAD = 'load',\n        POST = 'POST',\n        GET = 'GET',\n        WINDOW = window;\n\n    /**\n     * @class Ext.data.Connection\n     * @extends Ext.util.Observable\n     * <p>The class encapsulates a connection to the page's originating domain, allowing requests to be made\n     * either to a configured URL, or to a URL specified at request time.</p>\n     * <p>Requests made by this class are asynchronous, and will return immediately. No data from\n     * the server will be available to the statement immediately following the {@link #request} call.\n     * To process returned data, use a\n     * <a href=\"#request-option-success\" ext:member=\"request-option-success\" ext:cls=\"Ext.data.Connection\">success callback</a>\n     * in the request options object,\n     * or an {@link #requestcomplete event listener}.</p>\n     * <p><h3>File Uploads</h3><a href=\"#request-option-isUpload\" ext:member=\"request-option-isUpload\" ext:cls=\"Ext.data.Connection\">File uploads</a> are not performed using normal \"Ajax\" techniques, that\n     * is they are <b>not</b> performed using XMLHttpRequests. Instead the form is submitted in the standard\n     * manner with the DOM <tt>&lt;form></tt> element temporarily modified to have its\n     * <a href=\"http://www.w3.org/TR/REC-html40/present/frames.html#adef-target\">target</a> set to refer\n     * to a dynamically generated, hidden <tt>&lt;iframe></tt> which is inserted into the document\n     * but removed after the return data has been gathered.</p>\n     * <p>The server response is parsed by the browser to create the document for the IFRAME. If the\n     * server is using JSON to send the return object, then the\n     * <a href=\"http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.17\">Content-Type</a> header\n     * must be set to \"text/html\" in order to tell the browser to insert the text unchanged into the document body.</p>\n     * <p>Characters which are significant to an HTML parser must be sent as HTML entities, so encode\n     * \"&lt;\" as \"&amp;lt;\", \"&amp;\" as \"&amp;amp;\" etc.</p>\n     * <p>The response text is retrieved from the document, and a fake XMLHttpRequest object\n     * is created containing a <tt>responseText</tt> property in order to conform to the\n     * requirements of event handlers and callbacks.</p>\n     * <p>Be aware that file upload packets are sent with the content type <a href=\"http://www.faqs.org/rfcs/rfc2388.html\">multipart/form</a>\n     * and some server technologies (notably JEE) may require some custom processing in order to\n     * retrieve parameter names and parameter values from the packet content.</p>\n     * <p>Also note that it's not possible to check the response code of the hidden iframe, so the success handler will ALWAYS fire.</p>\n     * @constructor\n     * @param {Object} config a configuration object.\n     */\n    Ext.data.Connection = function(config){\n        Ext.apply(this, config);\n        this.addEvents(\n            /**\n             * @event beforerequest\n             * Fires before a network request is made to retrieve a data object.\n             * @param {Connection} conn This Connection object.\n             * @param {Object} options The options config object passed to the {@link #request} method.\n             */\n            BEFOREREQUEST,\n            /**\n             * @event requestcomplete\n             * Fires if the request was successfully completed.\n             * @param {Connection} conn This Connection object.\n             * @param {Object} response The XHR object containing the response data.\n             * See <a href=\"http://www.w3.org/TR/XMLHttpRequest/\">The XMLHttpRequest Object</a>\n             * for details.\n             * @param {Object} options The options config object passed to the {@link #request} method.\n             */\n            REQUESTCOMPLETE,\n            /**\n             * @event requestexception\n             * Fires if an error HTTP status was returned from the server.\n             * See <a href=\"http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html\">HTTP Status Code Definitions</a>\n             * for details of HTTP status codes.\n             * @param {Connection} conn This Connection object.\n             * @param {Object} response The XHR object containing the response data.\n             * See <a href=\"http://www.w3.org/TR/XMLHttpRequest/\">The XMLHttpRequest Object</a>\n             * for details.\n             * @param {Object} options The options config object passed to the {@link #request} method.\n             */\n            REQUESTEXCEPTION\n        );\n        Ext.data.Connection.superclass.constructor.call(this);\n    };\n\n    Ext.extend(Ext.data.Connection, Ext.util.Observable, {\n        /**\n         * @cfg {String} url (Optional) <p>The default URL to be used for requests to the server. Defaults to undefined.</p>\n         * <p>The <code>url</code> config may be a function which <i>returns</i> the URL to use for the Ajax request. The scope\n         * (<code><b>this</b></code> reference) of the function is the <code>scope</code> option passed to the {@link #request} method.</p>\n         */\n        /**\n         * @cfg {Object} extraParams (Optional) An object containing properties which are used as\n         * extra parameters to each request made by this object. (defaults to undefined)\n         */\n        /**\n         * @cfg {Object} defaultHeaders (Optional) An object containing request headers which are added\n         *  to each request made by this object. (defaults to undefined)\n         */\n        /**\n         * @cfg {String} method (Optional) The default HTTP method to be used for requests.\n         * (defaults to undefined; if not set, but {@link #request} params are present, POST will be used;\n         * otherwise, GET will be used.)\n         */\n        /**\n         * @cfg {Number} timeout (Optional) The timeout in milliseconds to be used for requests. (defaults to 30000)\n         */\n        timeout : 30000,\n        /**\n         * @cfg {Boolean} autoAbort (Optional) Whether this request should abort any pending requests. (defaults to false)\n         * @type Boolean\n         */\n        autoAbort:false,\n\n        /**\n         * @cfg {Boolean} disableCaching (Optional) True to add a unique cache-buster param to GET requests. (defaults to true)\n         * @type Boolean\n         */\n        disableCaching: true,\n\n        /**\n         * @cfg {String} disableCachingParam (Optional) Change the parameter which is sent went disabling caching\n         * through a cache buster. Defaults to '_dc'\n         * @type String\n         */\n        disableCachingParam: '_dc',\n\n        /**\n         * <p>Sends an HTTP request to a remote server.</p>\n         * <p><b>Important:</b> Ajax server requests are asynchronous, and this call will\n         * return before the response has been received. Process any returned data\n         * in a callback function.</p>\n         * <pre><code>\nExt.Ajax.request({\n   url: 'ajax_demo/sample.json',\n   success: function(response, opts) {\n      var obj = Ext.decode(response.responseText);\n      console.dir(obj);\n   },\n   failure: function(response, opts) {\n      console.log('server-side failure with status code ' + response.status);\n   }\n});\n         * </code></pre>\n         * <p>To execute a callback function in the correct scope, use the <tt>scope</tt> option.</p>\n         * @param {Object} options An object which may contain the following properties:<ul>\n         * <li><b>url</b> : String/Function (Optional)<div class=\"sub-desc\">The URL to\n         * which to send the request, or a function to call which returns a URL string. The scope of the\n         * function is specified by the <tt>scope</tt> option. Defaults to the configured\n         * <tt>{@link #url}</tt>.</div></li>\n         * <li><b>params</b> : Object/String/Function (Optional)<div class=\"sub-desc\">\n         * An object containing properties which are used as parameters to the\n         * request, a url encoded string or a function to call to get either. The scope of the function\n         * is specified by the <tt>scope</tt> option.</div></li>\n         * <li><b>method</b> : String (Optional)<div class=\"sub-desc\">The HTTP method to use\n         * for the request. Defaults to the configured method, or if no method was configured,\n         * \"GET\" if no parameters are being sent, and \"POST\" if parameters are being sent.  Note that\n         * the method name is case-sensitive and should be all caps.</div></li>\n         * <li><b>callback</b> : Function (Optional)<div class=\"sub-desc\">The\n         * function to be called upon receipt of the HTTP response. The callback is\n         * called regardless of success or failure and is passed the following\n         * parameters:<ul>\n         * <li><b>options</b> : Object<div class=\"sub-desc\">The parameter to the request call.</div></li>\n         * <li><b>success</b> : Boolean<div class=\"sub-desc\">True if the request succeeded.</div></li>\n         * <li><b>response</b> : Object<div class=\"sub-desc\">The XMLHttpRequest object containing the response data.\n         * See <a href=\"http://www.w3.org/TR/XMLHttpRequest/\">http://www.w3.org/TR/XMLHttpRequest/</a> for details about\n         * accessing elements of the response.</div></li>\n         * </ul></div></li>\n         * <li><a id=\"request-option-success\"></a><b>success</b> : Function (Optional)<div class=\"sub-desc\">The function\n         * to be called upon success of the request. The callback is passed the following\n         * parameters:<ul>\n         * <li><b>response</b> : Object<div class=\"sub-desc\">The XMLHttpRequest object containing the response data.</div></li>\n         * <li><b>options</b> : Object<div class=\"sub-desc\">The parameter to the request call.</div></li>\n         * </ul></div></li>\n         * <li><b>failure</b> : Function (Optional)<div class=\"sub-desc\">The function\n         * to be called upon failure of the request. The callback is passed the\n         * following parameters:<ul>\n         * <li><b>response</b> : Object<div class=\"sub-desc\">The XMLHttpRequest object containing the response data.</div></li>\n         * <li><b>options</b> : Object<div class=\"sub-desc\">The parameter to the request call.</div></li>\n         * </ul></div></li>\n         * <li><b>scope</b> : Object (Optional)<div class=\"sub-desc\">The scope in\n         * which to execute the callbacks: The \"this\" object for the callback function. If the <tt>url</tt>, or <tt>params</tt> options were\n         * specified as functions from which to draw values, then this also serves as the scope for those function calls.\n         * Defaults to the browser window.</div></li>\n         * <li><b>timeout</b> : Number (Optional)<div class=\"sub-desc\">The timeout in milliseconds to be used for this request. Defaults to 30 seconds.</div></li>\n         * <li><b>form</b> : Element/HTMLElement/String (Optional)<div class=\"sub-desc\">The <tt>&lt;form&gt;</tt>\n         * Element or the id of the <tt>&lt;form&gt;</tt> to pull parameters from.</div></li>\n         * <li><a id=\"request-option-isUpload\"></a><b>isUpload</b> : Boolean (Optional)<div class=\"sub-desc\"><b>Only meaningful when used\n         * with the <tt>form</tt> option</b>.\n         * <p>True if the form object is a file upload (will be set automatically if the form was\n         * configured with <b><tt>enctype</tt></b> \"multipart/form-data\").</p>\n         * <p>File uploads are not performed using normal \"Ajax\" techniques, that is they are <b>not</b>\n         * performed using XMLHttpRequests. Instead the form is submitted in the standard manner with the\n         * DOM <tt>&lt;form></tt> element temporarily modified to have its\n         * <a href=\"http://www.w3.org/TR/REC-html40/present/frames.html#adef-target\">target</a> set to refer\n         * to a dynamically generated, hidden <tt>&lt;iframe></tt> which is inserted into the document\n         * but removed after the return data has been gathered.</p>\n         * <p>The server response is parsed by the browser to create the document for the IFRAME. If the\n         * server is using JSON to send the return object, then the\n         * <a href=\"http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.17\">Content-Type</a> header\n         * must be set to \"text/html\" in order to tell the browser to insert the text unchanged into the document body.</p>\n         * <p>The response text is retrieved from the document, and a fake XMLHttpRequest object\n         * is created containing a <tt>responseText</tt> property in order to conform to the\n         * requirements of event handlers and callbacks.</p>\n         * <p>Be aware that file upload packets are sent with the content type <a href=\"http://www.faqs.org/rfcs/rfc2388.html\">multipart/form</a>\n         * and some server technologies (notably JEE) may require some custom processing in order to\n         * retrieve parameter names and parameter values from the packet content.</p>\n         * </div></li>\n         * <li><b>headers</b> : Object (Optional)<div class=\"sub-desc\">Request\n         * headers to set for the request.</div></li>\n         * <li><b>xmlData</b> : Object (Optional)<div class=\"sub-desc\">XML document\n         * to use for the post. Note: This will be used instead of params for the post\n         * data. Any params will be appended to the URL.</div></li>\n         * <li><b>jsonData</b> : Object/String (Optional)<div class=\"sub-desc\">JSON\n         * data to use as the post. Note: This will be used instead of params for the post\n         * data. Any params will be appended to the URL.</div></li>\n         * <li><b>disableCaching</b> : Boolean (Optional)<div class=\"sub-desc\">True\n         * to add a unique cache-buster param to GET requests.</div></li>\n         * </ul></p>\n         * <p>The options object may also contain any other property which might be needed to perform\n         * postprocessing in a callback because it is passed to callback functions.</p>\n         * @return {Number} transactionId The id of the server transaction. This may be used\n         * to cancel the request.\n         */\n        request : function(o){\n            var me = this;\n            if(me.fireEvent(BEFOREREQUEST, me, o)){\n                if (o.el) {\n                    if(!Ext.isEmpty(o.indicatorText)){\n                        me.indicatorText = '<div class=\"loading-indicator\">'+o.indicatorText+\"</div>\";\n                    }\n                    if(me.indicatorText) {\n                        Ext.getDom(o.el).innerHTML = me.indicatorText;\n                    }\n                    o.success = (Ext.isFunction(o.success) ? o.success : function(){}).createInterceptor(function(response) {\n                        Ext.getDom(o.el).innerHTML = response.responseText;\n                    });\n                }\n\n                var p = o.params,\n                    url = o.url || me.url,\n                    method,\n                    cb = {success: me.handleResponse,\n                          failure: me.handleFailure,\n                          scope: me,\n                          argument: {options: o},\n                          timeout : Ext.num(o.timeout, me.timeout)\n                    },\n                    form,\n                    serForm;\n\n\n                if (Ext.isFunction(p)) {\n                    p = p.call(o.scope||WINDOW, o);\n                }\n\n                p = Ext.urlEncode(me.extraParams, Ext.isObject(p) ? Ext.urlEncode(p) : p);\n\n                if (Ext.isFunction(url)) {\n                    url = url.call(o.scope || WINDOW, o);\n                }\n\n                if((form = Ext.getDom(o.form))){\n                    url = url || form.action;\n                     if(o.isUpload || (/multipart\\/form-data/i.test(form.getAttribute(\"enctype\")))) {\n                         return me.doFormUpload.call(me, o, p, url);\n                     }\n                    serForm = Ext.lib.Ajax.serializeForm(form);\n                    p = p ? (p + '&' + serForm) : serForm;\n                }\n\n                method = o.method || me.method || ((p || o.xmlData || o.jsonData) ? POST : GET);\n\n                if(method === GET && (me.disableCaching && o.disableCaching !== false) || o.disableCaching === true){\n                    var dcp = o.disableCachingParam || me.disableCachingParam;\n                    url = Ext.urlAppend(url, dcp + '=' + (new Date().getTime()));\n                }\n\n                o.headers = Ext.applyIf(o.headers || {}, me.defaultHeaders || {});\n\n                if(o.autoAbort === true || me.autoAbort) {\n                    me.abort();\n                }\n\n                if((method == GET || o.xmlData || o.jsonData) && p){\n                    url = Ext.urlAppend(url, p);\n                    p = '';\n                }\n                return (me.transId = Ext.lib.Ajax.request(method, url, cb, p, o));\n            }else{\n                return o.callback ? o.callback.apply(o.scope, [o,UNDEFINED,UNDEFINED]) : null;\n            }\n        },\n\n        /**\n         * Determine whether this object has a request outstanding.\n         * @param {Number} transactionId (Optional) defaults to the last transaction\n         * @return {Boolean} True if there is an outstanding request.\n         */\n        isLoading : function(transId){\n            return transId ? Ext.lib.Ajax.isCallInProgress(transId) : !! this.transId;\n        },\n\n        /**\n         * Aborts any outstanding request.\n         * @param {Number} transactionId (Optional) defaults to the last transaction\n         */\n        abort : function(transId){\n            if(transId || this.isLoading()){\n                Ext.lib.Ajax.abort(transId || this.transId);\n            }\n        },\n\n        // private\n        handleResponse : function(response){\n            this.transId = false;\n            var options = response.argument.options;\n            response.argument = options ? options.argument : null;\n            this.fireEvent(REQUESTCOMPLETE, this, response, options);\n            if(options.success){\n                options.success.call(options.scope, response, options);\n            }\n            if(options.callback){\n                options.callback.call(options.scope, options, true, response);\n            }\n        },\n\n        // private\n        handleFailure : function(response, e){\n            this.transId = false;\n            var options = response.argument.options;\n            response.argument = options ? options.argument : null;\n            this.fireEvent(REQUESTEXCEPTION, this, response, options, e);\n            if(options.failure){\n                options.failure.call(options.scope, response, options);\n            }\n            if(options.callback){\n                options.callback.call(options.scope, options, false, response);\n            }\n        },\n\n        // private\n        doFormUpload : function(o, ps, url){\n            var id = Ext.id(),\n                doc = document,\n                frame = doc.createElement('iframe'),\n                form = Ext.getDom(o.form),\n                hiddens = [],\n                hd,\n                encoding = 'multipart/form-data',\n                buf = {\n                    target: form.target,\n                    method: form.method,\n                    encoding: form.encoding,\n                    enctype: form.enctype,\n                    action: form.action\n                };\n\n            /*\n             * Originally this behaviour was modified for Opera 10 to apply the secure URL after\n             * the frame had been added to the document. It seems this has since been corrected in\n             * Opera so the behaviour has been reverted, the URL will be set before being added.\n             */\n            Ext.fly(frame).set({\n                id: id,\n                name: id,\n                cls: 'x-hidden',\n                src: Ext.SSL_SECURE_URL\n            }); \n\n            doc.body.appendChild(frame);\n\n            // This is required so that IE doesn't pop the response up in a new window.\n            if(Ext.isIE){\n               document.frames[id].name = id;\n            }\n\n\n            Ext.fly(form).set({\n                target: id,\n                method: POST,\n                enctype: encoding,\n                encoding: encoding,\n                action: url || buf.action\n            });\n\n            // add dynamic params\n            Ext.iterate(Ext.urlDecode(ps, false), function(k, v){\n                hd = doc.createElement('input');\n                Ext.fly(hd).set({\n                    type: 'hidden',\n                    value: v,\n                    name: k\n                });\n                form.appendChild(hd);\n                hiddens.push(hd);\n            });\n\n            function cb(){\n                var me = this,\n                    // bogus response object\n                    r = {responseText : '',\n                         responseXML : null,\n                         argument : o.argument},\n                    doc,\n                    firstChild;\n\n                try{\n                    doc = frame.contentWindow.document || frame.contentDocument || WINDOW.frames[id].document;\n                    if(doc){\n                        if(doc.body){\n                            if(/textarea/i.test((firstChild = doc.body.firstChild || {}).tagName)){ // json response wrapped in textarea\n                                r.responseText = firstChild.value;\n                            }else{\n                                r.responseText = doc.body.innerHTML;\n                            }\n                        }\n                        //in IE the document may still have a body even if returns XML.\n                        r.responseXML = doc.XMLDocument || doc;\n                    }\n                }\n                catch(e) {}\n\n                Ext.EventManager.removeListener(frame, LOAD, cb, me);\n\n                me.fireEvent(REQUESTCOMPLETE, me, r, o);\n\n                function runCallback(fn, scope, args){\n                    if(Ext.isFunction(fn)){\n                        fn.apply(scope, args);\n                    }\n                }\n\n                runCallback(o.success, o.scope, [r, o]);\n                runCallback(o.callback, o.scope, [o, true, r]);\n\n                if(!me.debugUploads){\n                    setTimeout(function(){Ext.removeNode(frame);}, 100);\n                }\n            }\n\n            Ext.EventManager.on(frame, LOAD, cb, this);\n            form.submit();\n\n            Ext.fly(form).set(buf);\n            Ext.each(hiddens, function(h) {\n                Ext.removeNode(h);\n            });\n        }\n    });\n})();\n\n/**\n * @class Ext.Ajax\n * @extends Ext.data.Connection\n * <p>The global Ajax request class that provides a simple way to make Ajax requests\n * with maximum flexibility.</p>\n * <p>Since Ext.Ajax is a singleton, you can set common properties/events for it once\n * and override them at the request function level only if necessary.</p>\n * <p>Common <b>Properties</b> you may want to set are:<div class=\"mdetail-params\"><ul>\n * <li><b><tt>{@link #method}</tt></b><p class=\"sub-desc\"></p></li>\n * <li><b><tt>{@link #extraParams}</tt></b><p class=\"sub-desc\"></p></li>\n * <li><b><tt>{@link #url}</tt></b><p class=\"sub-desc\"></p></li>\n * </ul></div>\n * <pre><code>\n// Default headers to pass in every request\nExt.Ajax.defaultHeaders = {\n    'Powered-By': 'Ext'\n};\n * </code></pre>\n * </p>\n * <p>Common <b>Events</b> you may want to set are:<div class=\"mdetail-params\"><ul>\n * <li><b><tt>{@link Ext.data.Connection#beforerequest beforerequest}</tt></b><p class=\"sub-desc\"></p></li>\n * <li><b><tt>{@link Ext.data.Connection#requestcomplete requestcomplete}</tt></b><p class=\"sub-desc\"></p></li>\n * <li><b><tt>{@link Ext.data.Connection#requestexception requestexception}</tt></b><p class=\"sub-desc\"></p></li>\n * </ul></div>\n * <pre><code>\n// Example: show a spinner during all Ajax requests\nExt.Ajax.on('beforerequest', this.showSpinner, this);\nExt.Ajax.on('requestcomplete', this.hideSpinner, this);\nExt.Ajax.on('requestexception', this.hideSpinner, this);\n * </code></pre>\n * </p>\n * <p>An example request:</p>\n * <pre><code>\n// Basic request\nExt.Ajax.{@link Ext.data.Connection#request request}({\n   url: 'foo.php',\n   success: someFn,\n   failure: otherFn,\n   headers: {\n       'my-header': 'foo'\n   },\n   params: { foo: 'bar' }\n});\n\n// Simple ajax form submission\nExt.Ajax.{@link Ext.data.Connection#request request}({\n    form: 'some-form',\n    params: 'foo=bar'\n});\n * </code></pre>\n * </p>\n * @singleton\n */\nExt.Ajax = new Ext.data.Connection({\n    /**\n     * @cfg {String} url @hide\n     */\n    /**\n     * @cfg {Object} extraParams @hide\n     */\n    /**\n     * @cfg {Object} defaultHeaders @hide\n     */\n    /**\n     * @cfg {String} method (Optional) @hide\n     */\n    /**\n     * @cfg {Number} timeout (Optional) @hide\n     */\n    /**\n     * @cfg {Boolean} autoAbort (Optional) @hide\n     */\n\n    /**\n     * @cfg {Boolean} disableCaching (Optional) @hide\n     */\n\n    /**\n     * @property  disableCaching\n     * True to add a unique cache-buster param to GET requests. (defaults to true)\n     * @type Boolean\n     */\n    /**\n     * @property  url\n     * The default URL to be used for requests to the server. (defaults to undefined)\n     * If the server receives all requests through one URL, setting this once is easier than\n     * entering it on every request.\n     * @type String\n     */\n    /**\n     * @property  extraParams\n     * An object containing properties which are used as extra parameters to each request made\n     * by this object (defaults to undefined). Session information and other data that you need\n     * to pass with each request are commonly put here.\n     * @type Object\n     */\n    /**\n     * @property  defaultHeaders\n     * An object containing request headers which are added to each request made by this object\n     * (defaults to undefined).\n     * @type Object\n     */\n    /**\n     * @property  method\n     * The default HTTP method to be used for requests. Note that this is case-sensitive and\n     * should be all caps (defaults to undefined; if not set but params are present will use\n     * <tt>\"POST\"</tt>, otherwise will use <tt>\"GET\"</tt>.)\n     * @type String\n     */\n    /**\n     * @property  timeout\n     * The timeout in milliseconds to be used for requests. (defaults to 30000)\n     * @type Number\n     */\n\n    /**\n     * @property  autoAbort\n     * Whether a new request should abort any pending requests. (defaults to false)\n     * @type Boolean\n     */\n    autoAbort : false,\n\n    /**\n     * Serialize the passed form into a url encoded string\n     * @param {String/HTMLElement} form\n     * @return {String}\n     */\n    serializeForm : function(form){\n        return Ext.lib.Ajax.serializeForm(form);\n    }\n});\n/**\n * @class Ext.util.JSON\n * Modified version of Douglas Crockford\"s json.js that doesn\"t\n * mess with the Object prototype\n * http://www.json.org/js.html\n * @singleton\n */\nExt.util.JSON = new (function(){\n    var useHasOwn = !!{}.hasOwnProperty,\n        isNative = function() {\n            var useNative = null;\n\n            return function() {\n                if (useNative === null) {\n                    useNative = Ext.USE_NATIVE_JSON && window.JSON && JSON.toString() == '[object JSON]';\n                }\n        \n                return useNative;\n            };\n        }(),\n        pad = function(n) {\n            return n < 10 ? \"0\" + n : n;\n        },\n        doDecode = function(json){\n            return json ? eval(\"(\" + json + \")\") : \"\";    \n        },\n        doEncode = function(o){\n            if(!Ext.isDefined(o) || o === null){\n                return \"null\";\n            }else if(Ext.isArray(o)){\n                return encodeArray(o);\n            }else if(Ext.isDate(o)){\n                return Ext.util.JSON.encodeDate(o);\n            }else if(Ext.isString(o)){\n                return encodeString(o);\n            }else if(typeof o == \"number\"){\n                //don't use isNumber here, since finite checks happen inside isNumber\n                return isFinite(o) ? String(o) : \"null\";\n            }else if(Ext.isBoolean(o)){\n                return String(o);\n            }else {\n                var a = [\"{\"], b, i, v;\n                for (i in o) {\n                    // don't encode DOM objects\n                    if(!o.getElementsByTagName){\n                        if(!useHasOwn || o.hasOwnProperty(i)) {\n                            v = o[i];\n                            switch (typeof v) {\n                            case \"undefined\":\n                            case \"function\":\n                            case \"unknown\":\n                                break;\n                            default:\n                                if(b){\n                                    a.push(',');\n                                }\n                                a.push(doEncode(i), \":\",\n                                        v === null ? \"null\" : doEncode(v));\n                                b = true;\n                            }\n                        }\n                    }\n                }\n                a.push(\"}\");\n                return a.join(\"\");\n            }    \n        },\n        m = {\n            \"\\b\": '\\\\b',\n            \"\\t\": '\\\\t',\n            \"\\n\": '\\\\n',\n            \"\\f\": '\\\\f',\n            \"\\r\": '\\\\r',\n            '\"' : '\\\\\"',\n            \"\\\\\": '\\\\\\\\'\n        },\n        encodeString = function(s){\n            if (/[\"\\\\\\x00-\\x1f]/.test(s)) {\n                return '\"' + s.replace(/([\\x00-\\x1f\\\\\"])/g, function(a, b) {\n                    var c = m[b];\n                    if(c){\n                        return c;\n                    }\n                    c = b.charCodeAt();\n                    return \"\\\\u00\" +\n                        Math.floor(c / 16).toString(16) +\n                        (c % 16).toString(16);\n                }) + '\"';\n            }\n            return '\"' + s + '\"';\n        },\n        encodeArray = function(o){\n            var a = [\"[\"], b, i, l = o.length, v;\n                for (i = 0; i < l; i += 1) {\n                    v = o[i];\n                    switch (typeof v) {\n                        case \"undefined\":\n                        case \"function\":\n                        case \"unknown\":\n                            break;\n                        default:\n                            if (b) {\n                                a.push(',');\n                            }\n                            a.push(v === null ? \"null\" : Ext.util.JSON.encode(v));\n                            b = true;\n                    }\n                }\n                a.push(\"]\");\n                return a.join(\"\");\n        };\n\n    /**\n     * <p>Encodes a Date. This returns the actual string which is inserted into the JSON string as the literal expression.\n     * <b>The returned value includes enclosing double quotation marks.</b></p>\n     * <p>The default return format is \"yyyy-mm-ddThh:mm:ss\".</p>\n     * <p>To override this:</p><pre><code>\nExt.util.JSON.encodeDate = function(d) {\n    return d.format('\"Y-m-d\"');\n};\n</code></pre>\n     * @param {Date} d The Date to encode\n     * @return {String} The string literal to use in a JSON string.\n     */\n    this.encodeDate = function(o){\n        return '\"' + o.getFullYear() + \"-\" +\n                pad(o.getMonth() + 1) + \"-\" +\n                pad(o.getDate()) + \"T\" +\n                pad(o.getHours()) + \":\" +\n                pad(o.getMinutes()) + \":\" +\n                pad(o.getSeconds()) + '\"';\n    };\n\n    /**\n     * Encodes an Object, Array or other value\n     * @param {Mixed} o The variable to encode\n     * @return {String} The JSON string\n     */\n    this.encode = function() {\n        var ec;\n        return function(o) {\n            if (!ec) {\n                // setup encoding function on first access\n                ec = isNative() ? JSON.stringify : doEncode;\n            }\n            return ec(o);\n        };\n    }();\n\n\n    /**\n     * Decodes (parses) a JSON string to an object. If the JSON is invalid, this function throws a SyntaxError unless the safe option is set.\n     * @param {String} json The JSON string\n     * @return {Object} The resulting object\n     */\n    this.decode = function() {\n        var dc;\n        return function(json) {\n            if (!dc) {\n                // setup decoding function on first access\n                dc = isNative() ? JSON.parse : doDecode;\n            }\n            return dc(json);\n        };\n    }();\n\n})();\n/**\n * Shorthand for {@link Ext.util.JSON#encode}\n * @param {Mixed} o The variable to encode\n * @return {String} The JSON string\n * @member Ext\n * @method encode\n */\nExt.encode = Ext.util.JSON.encode;\n/**\n * Shorthand for {@link Ext.util.JSON#decode}\n * @param {String} json The JSON string\n * @param {Boolean} safe (optional) Whether to return null or throw an exception if the JSON is invalid.\n * @return {Object} The resulting object\n * @member Ext\n * @method decode\n */\nExt.decode = Ext.util.JSON.decode;\n/**\n * @class Ext.EventManager\n * Registers event handlers that want to receive a normalized EventObject instead of the standard browser event and provides\n * several useful events directly.\n * See {@link Ext.EventObject} for more details on normalized event objects.\n * @singleton\n */\nExt.EventManager = function(){\n    var docReadyEvent,\n        docReadyProcId,\n        docReadyState = false,\n        DETECT_NATIVE = Ext.isGecko || Ext.isWebKit || Ext.isSafari || Ext.isIE10p,\n        E = Ext.lib.Event,\n        D = Ext.lib.Dom,\n        DOC = document,\n        WINDOW = window,\n        DOMCONTENTLOADED = \"DOMContentLoaded\",\n        COMPLETE = 'complete',\n        propRe = /^(?:scope|delay|buffer|single|stopEvent|preventDefault|stopPropagation|normalized|args|delegate)$/,\n        /*\n         * This cache is used to hold special js objects, the document and window, that don't have an id. We need to keep\n         * a reference to them so we can look them up at a later point.\n         */\n        specialElCache = [];\n\n     function getId(el){\n        var id = false,\n            i = 0,\n            len = specialElCache.length,\n            skip = false,\n            o;\n\n        if (el) {\n            if (el.getElementById || el.navigator) {\n                // look up the id\n                for(; i < len; ++i){\n                    o = specialElCache[i];\n                    if(o.el === el){\n                        id = o.id;\n                        break;\n                    }\n                }\n                if(!id){\n                    // for browsers that support it, ensure that give the el the same id\n                    id = Ext.id(el);\n                    specialElCache.push({\n                        id: id,\n                        el: el\n                    });\n                    skip = true;\n                }\n            }else{\n                id = Ext.id(el);\n            }\n            if(!Ext.elCache[id]){\n                Ext.Element.addToCache(new Ext.Element(el), id);\n                if(skip){\n                    Ext.elCache[id].skipGC = true;\n                }\n            }\n        }\n        return id;\n     }\n\n    /// There is some jquery work around stuff here that isn't needed in Ext Core.\n    function addListener(el, ename, fn, task, wrap, scope){\n        el = Ext.getDom(el);\n        var id = getId(el),\n            es = Ext.elCache[id].events,\n            wfn;\n\n        wfn = E.on(el, ename, wrap);\n        es[ename] = es[ename] || [];\n\n        /* 0 = Original Function,\n           1 = Event Manager Wrapped Function,\n           2 = Scope,\n           3 = Adapter Wrapped Function,\n           4 = Buffered Task\n        */\n        es[ename].push([fn, wrap, scope, wfn, task]);\n\n        // this is a workaround for jQuery and should somehow be removed from Ext Core in the future\n        // without breaking ExtJS.\n\n        // workaround for jQuery\n        if(el.addEventListener && ename == \"mousewheel\"){\n            var args = [\"DOMMouseScroll\", wrap, false];\n            el.addEventListener.apply(el, args);\n            Ext.EventManager.addListener(WINDOW, 'unload', function(){\n                el.removeEventListener.apply(el, args);\n            });\n        }\n\n        // fix stopped mousedowns on the document\n        if(el == DOC && ename == \"mousedown\"){\n            Ext.EventManager.stoppedMouseDownEvent.addListener(wrap);\n        }\n    }\n\n    function doScrollChk(){\n        /* Notes:\n             'doScroll' will NOT work in a IFRAME/FRAMESET.\n             The method succeeds but, a DOM query done immediately after -- FAILS.\n          */\n        if(window != top){\n            return false;\n        }\n\n        try{\n            DOC.documentElement.doScroll('left');\n        }catch(e){\n             return false;\n        }\n\n        fireDocReady();\n        return true;\n    }\n    /**\n     * @return {Boolean} True if the document is in a 'complete' state (or was determined to\n     * be true by other means). If false, the state is evaluated again until canceled.\n     */\n    function checkReadyState(e){\n\n        if(Ext.isIE9m && doScrollChk()){\n            return true;\n        }\n        if(DOC.readyState == COMPLETE){\n            fireDocReady();\n            return true;\n        }\n        docReadyState || (docReadyProcId = setTimeout(arguments.callee, 2));\n        return false;\n    }\n\n    var styles;\n    function checkStyleSheets(e){\n        styles || (styles = Ext.query('style, link[rel=stylesheet]'));\n        if(styles.length == DOC.styleSheets.length){\n            fireDocReady();\n            return true;\n        }\n        docReadyState || (docReadyProcId = setTimeout(arguments.callee, 2));\n        return false;\n    }\n\n    function OperaDOMContentLoaded(e){\n        DOC.removeEventListener(DOMCONTENTLOADED, arguments.callee, false);\n        checkStyleSheets();\n    }\n\n    function fireDocReady(e){\n        if(!docReadyState){\n            docReadyState = true; //only attempt listener removal once\n\n            if(docReadyProcId){\n                clearTimeout(docReadyProcId);\n            }\n            if(DETECT_NATIVE) {\n                DOC.removeEventListener(DOMCONTENTLOADED, fireDocReady, false);\n            }\n            if(Ext.isIE9m && checkReadyState.bindIE){  //was this was actually set ??\n                DOC.detachEvent('onreadystatechange', checkReadyState);\n            }\n            E.un(WINDOW, \"load\", arguments.callee);\n        }\n        if(docReadyEvent && !Ext.isReady){\n            Ext.isReady = true;\n            docReadyEvent.fire();\n            docReadyEvent.listeners = [];\n        }\n\n    }\n\n    function initDocReady(){\n        docReadyEvent || (docReadyEvent = new Ext.util.Event());\n        if (DETECT_NATIVE) {\n            DOC.addEventListener(DOMCONTENTLOADED, fireDocReady, false);\n        }\n        /*\n         * Handle additional (exceptional) detection strategies here\n         */\n        if (Ext.isIE9m){\n            //Use readystatechange as a backup AND primary detection mechanism for a FRAME/IFRAME\n            //See if page is already loaded\n            if(!checkReadyState()){\n                checkReadyState.bindIE = true;\n                DOC.attachEvent('onreadystatechange', checkReadyState);\n            }\n\n        }else if(Ext.isOpera ){\n            /* Notes:\n               Opera needs special treatment needed here because CSS rules are NOT QUITE\n               available after DOMContentLoaded is raised.\n            */\n\n            //See if page is already loaded and all styleSheets are in place\n            (DOC.readyState == COMPLETE && checkStyleSheets()) ||\n                DOC.addEventListener(DOMCONTENTLOADED, OperaDOMContentLoaded, false);\n\n        }else if (Ext.isWebKit){\n            //Fallback for older Webkits without DOMCONTENTLOADED support\n            checkReadyState();\n        }\n        // no matter what, make sure it fires on load\n        E.on(WINDOW, \"load\", fireDocReady);\n    }\n\n    function createTargeted(h, o){\n        return function(){\n            var args = Ext.toArray(arguments);\n            if(o.target == Ext.EventObject.setEvent(args[0]).target){\n                h.apply(this, args);\n            }\n        };\n    }\n\n    function createBuffered(h, o, task){\n        return function(e){\n            // create new event object impl so new events don't wipe out properties\n            task.delay(o.buffer, h, null, [new Ext.EventObjectImpl(e)]);\n        };\n    }\n\n    function createSingle(h, el, ename, fn, scope){\n        return function(e){\n            Ext.EventManager.removeListener(el, ename, fn, scope);\n            h(e);\n        };\n    }\n\n    function createDelayed(h, o, fn){\n        return function(e){\n            var task = new Ext.util.DelayedTask(h);\n            if(!fn.tasks) {\n                fn.tasks = [];\n            }\n            fn.tasks.push(task);\n            task.delay(o.delay || 10, h, null, [new Ext.EventObjectImpl(e)]);\n        };\n    }\n\n    function listen(element, ename, opt, fn, scope){\n        var o = (!opt || typeof opt == \"boolean\") ? {} : opt,\n            el = Ext.getDom(element), task;\n\n        fn = fn || o.fn;\n        scope = scope || o.scope;\n\n        if(!el){\n            throw \"Error listening for \\\"\" + ename + '\\\". Element \"' + element + '\" doesn\\'t exist.';\n        }\n        function h(e){\n            // prevent errors while unload occurring\n            if(!Ext){// !window[xname]){  ==> can't we do this?\n                return;\n            }\n            e = Ext.EventObject.setEvent(e);\n            var t;\n            if (o.delegate) {\n                if(!(t = e.getTarget(o.delegate, el))){\n                    return;\n                }\n            } else {\n                t = e.target;\n            }\n            if (o.stopEvent) {\n                e.stopEvent();\n            }\n            if (o.preventDefault) {\n               e.preventDefault();\n            }\n            if (o.stopPropagation) {\n                e.stopPropagation();\n            }\n            if (o.normalized === false) {\n                e = e.browserEvent;\n            }\n\n            fn.call(scope || el, e, t, o);\n        }\n        if(o.target){\n            h = createTargeted(h, o);\n        }\n        if(o.delay){\n            h = createDelayed(h, o, fn);\n        }\n        if(o.single){\n            h = createSingle(h, el, ename, fn, scope);\n        }\n        if(o.buffer){\n            task = new Ext.util.DelayedTask(h);\n            h = createBuffered(h, o, task);\n        }\n\n        addListener(el, ename, fn, task, h, scope);\n        return h;\n    }\n\n    var pub = {\n        /**\n         * Appends an event handler to an element.  The shorthand version {@link #on} is equivalent.  Typically you will\n         * use {@link Ext.Element#addListener} directly on an Element in favor of calling this version.\n         * @param {String/HTMLElement} el The html element or id to assign the event handler to.\n         * @param {String} eventName The name of the event to listen for.\n         * @param {Function} handler The handler function the event invokes. This function is passed\n         * the following parameters:<ul>\n         * <li>evt : EventObject<div class=\"sub-desc\">The {@link Ext.EventObject EventObject} describing the event.</div></li>\n         * <li>t : Element<div class=\"sub-desc\">The {@link Ext.Element Element} which was the target of the event.\n         * Note that this may be filtered by using the <tt>delegate</tt> option.</div></li>\n         * <li>o : Object<div class=\"sub-desc\">The options object from the addListener call.</div></li>\n         * </ul>\n         * @param {Object} scope (optional) The scope (<b><code>this</code></b> reference) in which the handler function is executed. <b>Defaults to the Element</b>.\n         * @param {Object} options (optional) An object containing handler configuration properties.\n         * This may contain any of the following properties:<ul>\n         * <li>scope : Object<div class=\"sub-desc\">The scope (<b><code>this</code></b> reference) in which the handler function is executed. <b>Defaults to the Element</b>.</div></li>\n         * <li>delegate : String<div class=\"sub-desc\">A simple selector to filter the target or look for a descendant of the target</div></li>\n         * <li>stopEvent : Boolean<div class=\"sub-desc\">True to stop the event. That is stop propagation, and prevent the default action.</div></li>\n         * <li>preventDefault : Boolean<div class=\"sub-desc\">True to prevent the default action</div></li>\n         * <li>stopPropagation : Boolean<div class=\"sub-desc\">True to prevent event propagation</div></li>\n         * <li>normalized : Boolean<div class=\"sub-desc\">False to pass a browser event to the handler function instead of an Ext.EventObject</div></li>\n         * <li>delay : Number<div class=\"sub-desc\">The number of milliseconds to delay the invocation of the handler after te event fires.</div></li>\n         * <li>single : Boolean<div class=\"sub-desc\">True to add a handler to handle just the next firing of the event, and then remove itself.</div></li>\n         * <li>buffer : Number<div class=\"sub-desc\">Causes the handler to be scheduled to run in an {@link Ext.util.DelayedTask} delayed\n         * by the specified number of milliseconds. If the event fires again within that time, the original\n         * handler is <em>not</em> invoked, but the new handler is scheduled in its place.</div></li>\n         * <li>target : Element<div class=\"sub-desc\">Only call the handler if the event was fired on the target Element, <i>not</i> if the event was bubbled up from a child node.</div></li>\n         * </ul><br>\n         * <p>See {@link Ext.Element#addListener} for examples of how to use these options.</p>\n         */\n        addListener : function(element, eventName, fn, scope, options){\n            if(typeof eventName == 'object'){\n                var o = eventName, e, val;\n                for(e in o){\n                    val = o[e];\n                    if(!propRe.test(e)){\n                        if(Ext.isFunction(val)){\n                            // shared options\n                            listen(element, e, o, val, o.scope);\n                        }else{\n                            // individual options\n                            listen(element, e, val);\n                        }\n                    }\n                }\n            } else {\n                listen(element, eventName, options, fn, scope);\n            }\n        },\n\n        /**\n         * Removes an event handler from an element.  The shorthand version {@link #un} is equivalent.  Typically\n         * you will use {@link Ext.Element#removeListener} directly on an Element in favor of calling this version.\n         * @param {String/HTMLElement} el The id or html element from which to remove the listener.\n         * @param {String} eventName The name of the event.\n         * @param {Function} fn The handler function to remove. <b>This must be a reference to the function passed into the {@link #addListener} call.</b>\n         * @param {Object} scope If a scope (<b><code>this</code></b> reference) was specified when the listener was added,\n         * then this must refer to the same object.\n         */\n        removeListener : function(el, eventName, fn, scope){\n            el = Ext.getDom(el);\n            var id = getId(el),\n                f = el && (Ext.elCache[id].events)[eventName] || [],\n                wrap, i, l, k, len, fnc;\n\n            for (i = 0, len = f.length; i < len; i++) {\n\n                /* 0 = Original Function,\n                   1 = Event Manager Wrapped Function,\n                   2 = Scope,\n                   3 = Adapter Wrapped Function,\n                   4 = Buffered Task\n                */\n                if (Ext.isArray(fnc = f[i]) && fnc[0] == fn && (!scope || fnc[2] == scope)) {\n                    if(fnc[4]) {\n                        fnc[4].cancel();\n                    }\n                    k = fn.tasks && fn.tasks.length;\n                    if(k) {\n                        while(k--) {\n                            fn.tasks[k].cancel();\n                        }\n                        delete fn.tasks;\n                    }\n                    wrap = fnc[1];\n                    E.un(el, eventName, E.extAdapter ? fnc[3] : wrap);\n\n                    // jQuery workaround that should be removed from Ext Core\n                    if(wrap && el.addEventListener && eventName == \"mousewheel\"){\n                        el.removeEventListener(\"DOMMouseScroll\", wrap, false);\n                    }\n\n                    // fix stopped mousedowns on the document\n                    if(wrap && el == DOC && eventName == \"mousedown\"){\n                        Ext.EventManager.stoppedMouseDownEvent.removeListener(wrap);\n                    }\n\n                    f.splice(i, 1);\n                    if (f.length === 0) {\n                        delete Ext.elCache[id].events[eventName];\n                    }\n                    for (k in Ext.elCache[id].events) {\n                        return false;\n                    }\n                    Ext.elCache[id].events = {};\n                    return false;\n                }\n            }\n        },\n\n        /**\n         * Removes all event handers from an element.  Typically you will use {@link Ext.Element#removeAllListeners}\n         * directly on an Element in favor of calling this version.\n         * @param {String/HTMLElement} el The id or html element from which to remove all event handlers.\n         */\n        removeAll : function(el){\n            el = Ext.getDom(el);\n            var id = getId(el),\n                ec = Ext.elCache[id] || {},\n                es = ec.events || {},\n                f, i, len, ename, fn, k, wrap;\n\n            for(ename in es){\n                if(es.hasOwnProperty(ename)){\n                    f = es[ename];\n                    /* 0 = Original Function,\n                       1 = Event Manager Wrapped Function,\n                       2 = Scope,\n                       3 = Adapter Wrapped Function,\n                       4 = Buffered Task\n                    */\n                    for (i = 0, len = f.length; i < len; i++) {\n                        fn = f[i];\n                        if(fn[4]) {\n                            fn[4].cancel();\n                        }\n                        if(fn[0].tasks && (k = fn[0].tasks.length)) {\n                            while(k--) {\n                                fn[0].tasks[k].cancel();\n                            }\n                            delete fn.tasks;\n                        }\n                        wrap =  fn[1];\n                        E.un(el, ename, E.extAdapter ? fn[3] : wrap);\n\n                        // jQuery workaround that should be removed from Ext Core\n                        if(el.addEventListener && wrap && ename == \"mousewheel\"){\n                            el.removeEventListener(\"DOMMouseScroll\", wrap, false);\n                        }\n\n                        // fix stopped mousedowns on the document\n                        if(wrap && el == DOC &&  ename == \"mousedown\"){\n                            Ext.EventManager.stoppedMouseDownEvent.removeListener(wrap);\n                        }\n                    }\n                }\n            }\n            if (Ext.elCache[id]) {\n                Ext.elCache[id].events = {};\n            }\n        },\n\n        getListeners : function(el, eventName) {\n            el = Ext.getDom(el);\n            var id = getId(el),\n                ec = Ext.elCache[id] || {},\n                es = ec.events || {},\n                results = [];\n            if (es && es[eventName]) {\n                return es[eventName];\n            } else {\n                return null;\n            }\n        },\n        \n        removeFromSpecialCache: function(o) {\n            var i = 0,\n                len = specialElCache.length;\n                \n            for (; i < len; ++i) {\n                if (specialElCache[i].el == o) {\n                    specialElCache.splice(i, 1); \n                }\n            }\n        },\n\n        purgeElement : function(el, recurse, eventName) {\n            el = Ext.getDom(el);\n            var id = getId(el),\n                ec = Ext.elCache[id] || {},\n                es = ec.events || {},\n                i, f, len;\n            if (eventName) {\n                if (es && es.hasOwnProperty(eventName)) {\n                    f = es[eventName];\n                    for (i = 0, len = f.length; i < len; i++) {\n                        Ext.EventManager.removeListener(el, eventName, f[i][0]);\n                    }\n                }\n            } else {\n                Ext.EventManager.removeAll(el);\n            }\n            if (recurse && el && el.childNodes) {\n                for (i = 0, len = el.childNodes.length; i < len; i++) {\n                    Ext.EventManager.purgeElement(el.childNodes[i], recurse, eventName);\n                }\n            }\n        },\n\n        _unload : function() {\n            var el;\n            for (el in Ext.elCache) {\n                Ext.EventManager.removeAll(el);\n            }\n            delete Ext.elCache;\n            delete Ext.Element._flyweights;\n\n            // Abort any outstanding Ajax requests\n            var c,\n                conn,\n                tid,\n                ajax = Ext.lib.Ajax;\n            (typeof ajax.conn == 'object') ? conn = ajax.conn : conn = {};\n            for (tid in conn) {\n                c = conn[tid];\n                if (c) {\n                    ajax.abort({conn: c, tId: tid});\n                }\n            }\n        },\n        /**\n         * Adds a listener to be notified when the document is ready (before onload and before images are loaded). Can be\n         * accessed shorthanded as Ext.onReady().\n         * @param {Function} fn The method the event invokes.\n         * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the handler function executes. Defaults to the browser window.\n         * @param {boolean} options (optional) Options object as passed to {@link Ext.Element#addListener}. It is recommended that the options\n         * <code>{single: true}</code> be used so that the handler is removed on first invocation.\n         */\n        onDocumentReady : function(fn, scope, options){\n            if (Ext.isReady) { // if it already fired or document.body is present\n                docReadyEvent || (docReadyEvent = new Ext.util.Event());\n                docReadyEvent.addListener(fn, scope, options);\n                docReadyEvent.fire();\n                docReadyEvent.listeners = [];\n            } else {\n                if (!docReadyEvent) {\n                    initDocReady();\n                }\n                options = options || {};\n                options.delay = options.delay || 1;\n                docReadyEvent.addListener(fn, scope, options);\n            }\n        },\n\n        /**\n         * Forces a document ready state transition for the framework.  Used when Ext is loaded\n         * into a DOM structure AFTER initial page load (Google API or other dynamic load scenario.\n         * Any pending 'onDocumentReady' handlers will be fired (if not already handled).\n         */\n        fireDocReady  : fireDocReady\n    };\n     /**\n     * Appends an event handler to an element.  Shorthand for {@link #addListener}.\n     * @param {String/HTMLElement} el The html element or id to assign the event handler to\n     * @param {String} eventName The name of the event to listen for.\n     * @param {Function} handler The handler function the event invokes.\n     * @param {Object} scope (optional) (<code>this</code> reference) in which the handler function executes. <b>Defaults to the Element</b>.\n     * @param {Object} options (optional) An object containing standard {@link #addListener} options\n     * @member Ext.EventManager\n     * @method on\n     */\n    pub.on = pub.addListener;\n    /**\n     * Removes an event handler from an element.  Shorthand for {@link #removeListener}.\n     * @param {String/HTMLElement} el The id or html element from which to remove the listener.\n     * @param {String} eventName The name of the event.\n     * @param {Function} fn The handler function to remove. <b>This must be a reference to the function passed into the {@link #on} call.</b>\n     * @param {Object} scope If a scope (<b><code>this</code></b> reference) was specified when the listener was added,\n     * then this must refer to the same object.\n     * @member Ext.EventManager\n     * @method un\n     */\n    pub.un = pub.removeListener;\n\n    pub.stoppedMouseDownEvent = new Ext.util.Event();\n    return pub;\n}();\n/**\n  * Adds a listener to be notified when the document is ready (before onload and before images are loaded). Shorthand of {@link Ext.EventManager#onDocumentReady}.\n  * @param {Function} fn The method the event invokes.\n  * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the handler function executes. Defaults to the browser window.\n  * @param {boolean} options (optional) Options object as passed to {@link Ext.Element#addListener}. It is recommended that the options\n  * <code>{single: true}</code> be used so that the handler is removed on first invocation.\n  * @member Ext\n  * @method onReady\n */\nExt.onReady = Ext.EventManager.onDocumentReady;\n\n\n//Initialize doc classes\n(function(){\n    var initExtCss = function() {\n        // find the body element\n        var bd = document.body || document.getElementsByTagName('body')[0];\n        if (!bd) {\n            return false;\n        }\n\n        var cls = [];\n        \n        if (Ext.isIE) {\n            // Only treat IE9 and less like IE in the css\n            if (!Ext.isIE10p) {\n                cls.push('ext-ie');\n            }\n            if (Ext.isIE6) {\n                cls.push('ext-ie6');\n            } else if (Ext.isIE7) {\n                cls.push('ext-ie7', 'ext-ie7m');\n            } else if (Ext.isIE8) {\n                cls.push('ext-ie8', 'ext-ie8m');\n            } else if (Ext.isIE9) {\n                cls.push('ext-ie9', 'ext-ie9m');\n            } else if (Ext.isIE10) {\n                cls.push('ext-ie10');\n            }\n        }\n        \n        if (Ext.isGecko) {\n            if (Ext.isGecko2) {\n                cls.push('ext-gecko2');\n            } else {\n                cls.push('ext-gecko3');\n            }\n        }\n        \n        if (Ext.isOpera) {\n            cls.push('ext-opera');\n        }\n        \n        if (Ext.isWebKit) {\n            cls.push('ext-webkit');\n        }\n\n        if (Ext.isSafari) {\n            cls.push(\"ext-safari \" + (Ext.isSafari2 ? 'ext-safari2' : (Ext.isSafari3 ? 'ext-safari3' : 'ext-safari4')));\n        } else if(Ext.isChrome) {\n            cls.push(\"ext-chrome\");\n        }\n\n        if (Ext.isMac) {\n            cls.push(\"ext-mac\");\n        }\n        if (Ext.isLinux) {\n            cls.push(\"ext-linux\");\n        }\n\n        // add to the parent to allow for selectors like \".ext-strict .ext-ie\"\n        if (Ext.isStrict || Ext.isBorderBox) {\n            var p = bd.parentNode;\n            if (p) {\n                if (!Ext.isStrict) {\n                    Ext.fly(p, '_internal').addClass('x-quirks');\n                    if (Ext.isIE9m && !Ext.isStrict) {\n                        Ext.isIEQuirks = true;\n                    }\n                }\n                Ext.fly(p, '_internal').addClass(((Ext.isStrict && Ext.isIE ) || (!Ext.enableForcedBoxModel && !Ext.isIE)) ? ' ext-strict' : ' ext-border-box');\n            }\n        }\n        // Forced border box model class applied to all elements. Bypassing javascript based box model adjustments\n        // in favor of css.  This is for non-IE browsers.\n        if (Ext.enableForcedBoxModel && !Ext.isIE) {\n            Ext.isForcedBorderBox = true;\n            cls.push(\"ext-forced-border-box\");\n        }\n\n        Ext.fly(bd, '_internal').addClass(cls);\n        return true;\n    };\n\n    if (!initExtCss()) {\n        Ext.onReady(initExtCss);\n    }\n})();\n\n// Code used to detect certain browser feature/quirks/bugs at startup.\n(function(){\n    /**\n     * @class Ext.supports\n     * @ignore\n     */\n    var supports = Ext.apply(Ext.supports, {\n        /**\n         * In Webkit, there is an issue with getting the margin right property, see\n         * https://bugs.webkit.org/show_bug.cgi?id=13343\n         */\n        correctRightMargin: true,\n\n        /**\n         * Webkit browsers return rgba(0, 0, 0) when a transparent color is used\n         */\n        correctTransparentColor: true,\n\n        /**\n         * IE uses styleFloat, not cssFloat for the float property.\n         */\n        cssFloat: true\n    });\n\n    var supportTests = function(){\n            var div = document.createElement('div'),\n                doc = document,\n                view,\n                last;\n\n            div.innerHTML = '<div style=\"height:30px;width:50px;\"><div style=\"height:20px;width:20px;\"></div></div><div style=\"float:left;background-color:transparent;\">';\n            doc.body.appendChild(div);\n            last = div.lastChild;\n\n            if((view = doc.defaultView)){\n                if(view.getComputedStyle(div.firstChild.firstChild, null).marginRight != '0px'){\n                    supports.correctRightMargin = false;\n                }\n                if(view.getComputedStyle(last, null).backgroundColor != 'transparent'){\n                    supports.correctTransparentColor = false;\n                }\n            }\n            supports.cssFloat = !!last.style.cssFloat;\n            doc.body.removeChild(div);\n    };\n\n    if (Ext.isReady) {\n        supportTests();\n    } else {\n        Ext.onReady(supportTests);\n    }\n})();\n\n\n/**\n * @class Ext.EventObject\n * Just as {@link Ext.Element} wraps around a native DOM node, Ext.EventObject\n * wraps the browser's native event-object normalizing cross-browser differences,\n * such as which mouse button is clicked, keys pressed, mechanisms to stop\n * event-propagation along with a method to prevent default actions from taking place.\n * <p>For example:</p>\n * <pre><code>\nfunction handleClick(e, t){ // e is not a standard event object, it is a Ext.EventObject\n    e.preventDefault();\n    var target = e.getTarget(); // same as t (the target HTMLElement)\n    ...\n}\nvar myDiv = {@link Ext#get Ext.get}(\"myDiv\");  // get reference to an {@link Ext.Element}\nmyDiv.on(         // 'on' is shorthand for addListener\n    \"click\",      // perform an action on click of myDiv\n    handleClick   // reference to the action handler\n);\n// other methods to do the same:\nExt.EventManager.on(\"myDiv\", 'click', handleClick);\nExt.EventManager.addListener(\"myDiv\", 'click', handleClick);\n </code></pre>\n * @singleton\n */\nExt.EventObject = function(){\n    var E = Ext.lib.Event,\n        clickRe = /(dbl)?click/,\n        // safari keypress events for special keys return bad keycodes\n        safariKeys = {\n            3 : 13, // enter\n            63234 : 37, // left\n            63235 : 39, // right\n            63232 : 38, // up\n            63233 : 40, // down\n            63276 : 33, // page up\n            63277 : 34, // page down\n            63272 : 46, // delete\n            63273 : 36, // home\n            63275 : 35  // end\n        },\n        // normalize button clicks\n        btnMap = Ext.isIE ? {1:0,4:1,2:2} : {0:0,1:1,2:2};\n\n    Ext.EventObjectImpl = function(e){\n        if(e){\n            this.setEvent(e.browserEvent || e);\n        }\n    };\n\n    Ext.EventObjectImpl.prototype = {\n           /** @private */\n        setEvent : function(e){\n            var me = this;\n            if(e == me || (e && e.browserEvent)){ // already wrapped\n                return e;\n            }\n            me.browserEvent = e;\n            if(e){\n                // normalize buttons\n                me.button = e.button ? btnMap[e.button] : (e.which ? e.which - 1 : -1);\n                if(clickRe.test(e.type) && me.button == -1){\n                    me.button = 0;\n                }\n                me.type = e.type;\n                me.shiftKey = e.shiftKey;\n                // mac metaKey behaves like ctrlKey\n                me.ctrlKey = e.ctrlKey || e.metaKey || false;\n                me.altKey = e.altKey;\n                // in getKey these will be normalized for the mac\n                me.keyCode = e.keyCode;\n                me.charCode = e.charCode;\n                // cache the target for the delayed and or buffered events\n                me.target = E.getTarget(e);\n                // same for XY\n                me.xy = E.getXY(e);\n            }else{\n                me.button = -1;\n                me.shiftKey = false;\n                me.ctrlKey = false;\n                me.altKey = false;\n                me.keyCode = 0;\n                me.charCode = 0;\n                me.target = null;\n                me.xy = [0, 0];\n            }\n            return me;\n        },\n\n        /**\n         * Stop the event (preventDefault and stopPropagation)\n         */\n        stopEvent : function(){\n            var me = this;\n            if(me.browserEvent){\n                if(me.browserEvent.type == 'mousedown'){\n                    Ext.EventManager.stoppedMouseDownEvent.fire(me);\n                }\n                E.stopEvent(me.browserEvent);\n            }\n        },\n\n        /**\n         * Prevents the browsers default handling of the event.\n         */\n        preventDefault : function(){\n            if(this.browserEvent){\n                E.preventDefault(this.browserEvent);\n            }\n        },\n\n        /**\n         * Cancels bubbling of the event.\n         */\n        stopPropagation : function(){\n            var me = this;\n            if(me.browserEvent){\n                if(me.browserEvent.type == 'mousedown'){\n                    Ext.EventManager.stoppedMouseDownEvent.fire(me);\n                }\n                E.stopPropagation(me.browserEvent);\n            }\n        },\n\n        /**\n         * Gets the character code for the event.\n         * @return {Number}\n         */\n        getCharCode : function(){\n            return this.charCode || this.keyCode;\n        },\n\n        /**\n         * Returns a normalized keyCode for the event.\n         * @return {Number} The key code\n         */\n        getKey : function(){\n            return this.normalizeKey(this.keyCode || this.charCode);\n        },\n\n        // private\n        normalizeKey: function(k){\n            return Ext.isSafari ? (safariKeys[k] || k) : k;\n        },\n\n        /**\n         * Gets the x coordinate of the event.\n         * @return {Number}\n         */\n        getPageX : function(){\n            return this.xy[0];\n        },\n\n        /**\n         * Gets the y coordinate of the event.\n         * @return {Number}\n         */\n        getPageY : function(){\n            return this.xy[1];\n        },\n\n        /**\n         * Gets the page coordinates of the event.\n         * @return {Array} The xy values like [x, y]\n         */\n        getXY : function(){\n            return this.xy;\n        },\n\n        /**\n         * Gets the target for the event.\n         * @param {String} selector (optional) A simple selector to filter the target or look for an ancestor of the target\n         * @param {Number/Mixed} maxDepth (optional) The max depth to\n                search as a number or element (defaults to 10 || document.body)\n         * @param {Boolean} returnEl (optional) True to return a Ext.Element object instead of DOM node\n         * @return {HTMLelement}\n         */\n        getTarget : function(selector, maxDepth, returnEl){\n            return selector ? Ext.fly(this.target).findParent(selector, maxDepth, returnEl) : (returnEl ? Ext.get(this.target) : this.target);\n        },\n\n        /**\n         * Gets the related target.\n         * @return {HTMLElement}\n         */\n        getRelatedTarget : function(){\n            return this.browserEvent ? E.getRelatedTarget(this.browserEvent) : null;\n        },\n\n        /**\n         * Normalizes mouse wheel delta across browsers\n         * @return {Number} The delta\n         */\n        getWheelDelta : function(){\n            var e = this.browserEvent;\n            var delta = 0;\n            if(e.wheelDelta){ /* IE/Opera. */\n                delta = e.wheelDelta/120;\n            }else if(e.detail){ /* Mozilla case. */\n                delta = -e.detail/3;\n            }\n            return delta;\n        },\n\n        /**\n        * Returns true if the target of this event is a child of el.  Unless the allowEl parameter is set, it will return false if if the target is el.\n        * Example usage:<pre><code>\n        // Handle click on any child of an element\n        Ext.getBody().on('click', function(e){\n            if(e.within('some-el')){\n                alert('Clicked on a child of some-el!');\n            }\n        });\n\n        // Handle click directly on an element, ignoring clicks on child nodes\n        Ext.getBody().on('click', function(e,t){\n            if((t.id == 'some-el') && !e.within(t, true)){\n                alert('Clicked directly on some-el!');\n            }\n        });\n        </code></pre>\n         * @param {Mixed} el The id, DOM element or Ext.Element to check\n         * @param {Boolean} related (optional) true to test if the related target is within el instead of the target\n         * @param {Boolean} allowEl (optional) true to also check if the passed element is the target or related target\n         * @return {Boolean}\n         */\n        within : function(el, related, allowEl){\n            if(el){\n                var t = this[related ? \"getRelatedTarget\" : \"getTarget\"]();\n                return t && ((allowEl ? (t == Ext.getDom(el)) : false) || Ext.fly(el).contains(t));\n            }\n            return false;\n        }\n     };\n\n    return new Ext.EventObjectImpl();\n}();/**\n * @class Ext.Loader\n * @singleton\n * Simple class to help load JavaScript files on demand\n */\nExt.Loader = Ext.apply({}, {\n    /**\n     * Loads a given set of .js files. Calls the callback function when all files have been loaded\n     * Set preserveOrder to true to ensure non-parallel loading of files if load order is important\n     * @param {Array} fileList Array of all files to load\n     * @param {Function} callback Callback to call after all files have been loaded\n     * @param {Object} scope The scope to call the callback in\n     * @param {Boolean} preserveOrder True to make files load in serial, one after the other (defaults to false)\n     */\n    load: function(fileList, callback, scope, preserveOrder) {\n        var scope       = scope || this,\n            head        = document.getElementsByTagName(\"head\")[0],\n            fragment    = document.createDocumentFragment(),\n            numFiles    = fileList.length,\n            loadedFiles = 0,\n            me          = this;\n        \n        /**\n         * Loads a particular file from the fileList by index. This is used when preserving order\n         */\n        var loadFileIndex = function(index) {\n            head.appendChild(\n                me.buildScriptTag(fileList[index], onFileLoaded)\n            );\n        };\n        \n        /**\n         * Callback function which is called after each file has been loaded. This calls the callback\n         * passed to load once the final file in the fileList has been loaded\n         */\n        var onFileLoaded = function() {\n            loadedFiles ++;\n            \n            //if this was the last file, call the callback, otherwise load the next file\n            if (numFiles == loadedFiles && typeof callback == 'function') {\n                callback.call(scope);\n            } else {\n                if (preserveOrder === true) {\n                    loadFileIndex(loadedFiles);\n                }\n            }\n        };\n        \n        if (preserveOrder === true) {\n            loadFileIndex.call(this, 0);\n        } else {\n            //load each file (most browsers will do this in parallel)\n            Ext.each(fileList, function(file, index) {\n                fragment.appendChild(\n                    this.buildScriptTag(file, onFileLoaded)\n                );  \n            }, this);\n            \n            head.appendChild(fragment);\n        }\n    },\n    \n    /**\n     * @private\n     * Creates and returns a script tag, but does not place it into the document. If a callback function\n     * is passed, this is called when the script has been loaded\n     * @param {String} filename The name of the file to create a script tag for\n     * @param {Function} callback Optional callback, which is called when the script has been loaded\n     * @return {Element} The new script ta\n     */\n    buildScriptTag: function(filename, callback) {\n        var script  = document.createElement('script');\n        script.type = \"text/javascript\";\n        script.src  = filename;\n        \n        //IE has a different way of handling &lt;script&gt; loads, so we need to check for it here\n        if (script.readyState) {\n            script.onreadystatechange = function() {\n                if (script.readyState == \"loaded\" || script.readyState == \"complete\") {\n                    script.onreadystatechange = null;\n                    callback();\n                }\n            };\n        } else {\n            script.onload = callback;\n        }    \n        \n        return script;\n    }\n});\n/**\n * @class Ext\n */\n\nExt.ns(\"Ext.grid\", \"Ext.list\", \"Ext.dd\", \"Ext.tree\", \"Ext.form\", \"Ext.menu\",\n       \"Ext.state\", \"Ext.layout.boxOverflow\", \"Ext.app\", \"Ext.ux\", \"Ext.chart\", \"Ext.direct\", \"Ext.slider\");\n    /**\n     * Namespace alloted for extensions to the framework.\n     * @property ux\n     * @type Object\n     */\n\nExt.apply(Ext, function(){\n    var E = Ext,\n        idSeed = 0,\n        scrollWidth = null;\n\n    return {\n        /**\n        * A reusable empty function\n        * @property\n        * @type Function\n        */\n        emptyFn : function(){},\n\n        /**\n         * URL to a 1x1 transparent gif image used by Ext to create inline icons with CSS background images.\n         * In older versions of IE, this defaults to \"http://extjs.com/s.gif\" and you should change this to a URL on your server.\n         * For other browsers it uses an inline data URL.\n         * @type String\n         */\n        BLANK_IMAGE_URL : Ext.isIE6 || Ext.isIE7 || Ext.isAir ?\n                            'http:/' + '/www.extjs.com/s.gif' :\n                            'data:image/gif;base64,R0lGODlhAQABAID/AMDAwAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==',\n\n        extendX : function(supr, fn){\n            return Ext.extend(supr, fn(supr.prototype));\n        },\n\n        /**\n         * Returns the current HTML document object as an {@link Ext.Element}.\n         * @return Ext.Element The document\n         */\n        getDoc : function(){\n            return Ext.get(document);\n        },\n\n        /**\n         * Utility method for validating that a value is numeric, returning the specified default value if it is not.\n         * @param {Mixed} value Should be a number, but any type will be handled appropriately\n         * @param {Number} defaultValue The value to return if the original value is non-numeric\n         * @return {Number} Value, if numeric, else defaultValue\n         */\n        num : function(v, defaultValue){\n            v = Number(Ext.isEmpty(v) || Ext.isArray(v) || typeof v == 'boolean' || (typeof v == 'string' && v.trim().length == 0) ? NaN : v);\n            return isNaN(v) ? defaultValue : v;\n        },\n\n        /**\n         * <p>Utility method for returning a default value if the passed value is empty.</p>\n         * <p>The value is deemed to be empty if it is<div class=\"mdetail-params\"><ul>\n         * <li>null</li>\n         * <li>undefined</li>\n         * <li>an empty array</li>\n         * <li>a zero length string (Unless the <tt>allowBlank</tt> parameter is <tt>true</tt>)</li>\n         * </ul></div>\n         * @param {Mixed} value The value to test\n         * @param {Mixed} defaultValue The value to return if the original value is empty\n         * @param {Boolean} allowBlank (optional) true to allow zero length strings to qualify as non-empty (defaults to false)\n         * @return {Mixed} value, if non-empty, else defaultValue\n         */\n        value : function(v, defaultValue, allowBlank){\n            return Ext.isEmpty(v, allowBlank) ? defaultValue : v;\n        },\n\n        /**\n         * Escapes the passed string for use in a regular expression\n         * @param {String} str\n         * @return {String}\n         */\n        escapeRe : function(s) {\n            return s.replace(/([-.*+?^${}()|[\\]\\/\\\\])/g, \"\\\\$1\");\n        },\n\n        sequence : function(o, name, fn, scope){\n            o[name] = o[name].createSequence(fn, scope);\n        },\n\n        /**\n         * Applies event listeners to elements by selectors when the document is ready.\n         * The event name is specified with an <tt>&#64;</tt> suffix.\n         * <pre><code>\nExt.addBehaviors({\n    // add a listener for click on all anchors in element with id foo\n    '#foo a&#64;click' : function(e, t){\n        // do something\n    },\n\n    // add the same listener to multiple selectors (separated by comma BEFORE the &#64;)\n    '#foo a, #bar span.some-class&#64;mouseover' : function(){\n        // do something\n    }\n});\n         * </code></pre>\n         * @param {Object} obj The list of behaviors to apply\n         */\n        addBehaviors : function(o){\n            if(!Ext.isReady){\n                Ext.onReady(function(){\n                    Ext.addBehaviors(o);\n                });\n            } else {\n                var cache = {}, // simple cache for applying multiple behaviors to same selector does query multiple times\n                    parts,\n                    b,\n                    s;\n                for (b in o) {\n                    if ((parts = b.split('@'))[1]) { // for Object prototype breakers\n                        s = parts[0];\n                        if(!cache[s]){\n                            cache[s] = Ext.select(s);\n                        }\n                        cache[s].on(parts[1], o[b]);\n                    }\n                }\n                cache = null;\n            }\n        },\n\n        /**\n         * Utility method for getting the width of the browser scrollbar. This can differ depending on\n         * operating system settings, such as the theme or font size.\n         * @param {Boolean} force (optional) true to force a recalculation of the value.\n         * @return {Number} The width of the scrollbar.\n         */\n        getScrollBarWidth: function(force){\n            if(!Ext.isReady){\n                return 0;\n            }\n\n            if(force === true || scrollWidth === null){\n                    // Append our div, do our calculation and then remove it\n                var div = Ext.getBody().createChild('<div class=\"x-hide-offsets\" style=\"width:100px;height:50px;overflow:hidden;\"><div style=\"height:200px;\"></div></div>'),\n                    child = div.child('div', true);\n                var w1 = child.offsetWidth;\n                div.setStyle('overflow', (Ext.isWebKit || Ext.isGecko) ? 'auto' : 'scroll');\n                var w2 = child.offsetWidth;\n                div.remove();\n                // Need to add 2 to ensure we leave enough space\n                scrollWidth = w1 - w2 + 2;\n            }\n            return scrollWidth;\n        },\n\n\n        // deprecated\n        combine : function(){\n            var as = arguments, l = as.length, r = [];\n            for(var i = 0; i < l; i++){\n                var a = as[i];\n                if(Ext.isArray(a)){\n                    r = r.concat(a);\n                }else if(a.length !== undefined && !a.substr){\n                    r = r.concat(Array.prototype.slice.call(a, 0));\n                }else{\n                    r.push(a);\n                }\n            }\n            return r;\n        },\n\n        /**\n         * Copies a set of named properties fom the source object to the destination object.\n         * <p>example:<pre><code>\nImageComponent = Ext.extend(Ext.BoxComponent, {\n    initComponent: function() {\n        this.autoEl = { tag: 'img' };\n        MyComponent.superclass.initComponent.apply(this, arguments);\n        this.initialBox = Ext.copyTo({}, this.initialConfig, 'x,y,width,height');\n    }\n});\n         * </code></pre>\n         * @param {Object} dest The destination object.\n         * @param {Object} source The source object.\n         * @param {Array/String} names Either an Array of property names, or a comma-delimited list\n         * of property names to copy.\n         * @return {Object} The modified object.\n        */\n        copyTo : function(dest, source, names){\n            if(typeof names == 'string'){\n                names = names.split(/[,;\\s]/);\n            }\n            Ext.each(names, function(name){\n                if(source.hasOwnProperty(name)){\n                    dest[name] = source[name];\n                }\n            }, this);\n            return dest;\n        },\n\n        /**\n         * Attempts to destroy any objects passed to it by removing all event listeners, removing them from the\n         * DOM (if applicable) and calling their destroy functions (if available).  This method is primarily\n         * intended for arguments of type {@link Ext.Element} and {@link Ext.Component}, but any subclass of\n         * {@link Ext.util.Observable} can be passed in.  Any number of elements and/or components can be\n         * passed into this function in a single call as separate arguments.\n         * @param {Mixed...} args An {@link Ext.Element}, {@link Ext.Component}, or an Array of either of these to destroy\n         */\n        destroy : function(){\n            Ext.each(arguments, function(arg){\n                if(arg){\n                    if(Ext.isArray(arg)){\n                        this.destroy.apply(this, arg);\n                    }else if(typeof arg.destroy == 'function'){\n                        arg.destroy();\n                    }else if(arg.dom){\n                        arg.remove();\n                    }\n                }\n            }, this);\n        },\n\n        /**\n         * Attempts to destroy and then remove a set of named properties of the passed object.\n         * @param {Object} o The object (most likely a Component) who's properties you wish to destroy.\n         * @param {Mixed} arg1 The name of the property to destroy and remove from the object.\n         * @param {Mixed} etc... More property names to destroy and remove.\n         */\n        destroyMembers : function(o, arg1, arg2, etc){\n            for(var i = 1, a = arguments, len = a.length; i < len; i++) {\n                Ext.destroy(o[a[i]]);\n                delete o[a[i]];\n            }\n        },\n\n        /**\n         * Creates a copy of the passed Array with falsy values removed.\n         * @param {Array/NodeList} arr The Array from which to remove falsy values.\n         * @return {Array} The new, compressed Array.\n         */\n        clean : function(arr){\n            var ret = [];\n            Ext.each(arr, function(v){\n                if(!!v){\n                    ret.push(v);\n                }\n            });\n            return ret;\n        },\n\n        /**\n         * Creates a copy of the passed Array, filtered to contain only unique values.\n         * @param {Array} arr The Array to filter\n         * @return {Array} The new Array containing unique values.\n         */\n        unique : function(arr){\n            var ret = [],\n                collect = {};\n\n            Ext.each(arr, function(v) {\n                if(!collect[v]){\n                    ret.push(v);\n                }\n                collect[v] = true;\n            });\n            return ret;\n        },\n\n        /**\n         * Recursively flattens into 1-d Array. Injects Arrays inline.\n         * @param {Array} arr The array to flatten\n         * @return {Array} The new, flattened array.\n         */\n        flatten : function(arr){\n            var worker = [];\n            function rFlatten(a) {\n                Ext.each(a, function(v) {\n                    if(Ext.isArray(v)){\n                        rFlatten(v);\n                    }else{\n                        worker.push(v);\n                    }\n                });\n                return worker;\n            }\n            return rFlatten(arr);\n        },\n\n        /**\n         * Returns the minimum value in the Array.\n         * @param {Array|NodeList} arr The Array from which to select the minimum value.\n         * @param {Function} comp (optional) a function to perform the comparision which determines minimization.\n         *                   If omitted the \"<\" operator will be used. Note: gt = 1; eq = 0; lt = -1\n         * @return {Object} The minimum value in the Array.\n         */\n        min : function(arr, comp){\n            var ret = arr[0];\n            comp = comp || function(a,b){ return a < b ? -1 : 1; };\n            Ext.each(arr, function(v) {\n                ret = comp(ret, v) == -1 ? ret : v;\n            });\n            return ret;\n        },\n\n        /**\n         * Returns the maximum value in the Array\n         * @param {Array|NodeList} arr The Array from which to select the maximum value.\n         * @param {Function} comp (optional) a function to perform the comparision which determines maximization.\n         *                   If omitted the \">\" operator will be used. Note: gt = 1; eq = 0; lt = -1\n         * @return {Object} The maximum value in the Array.\n         */\n        max : function(arr, comp){\n            var ret = arr[0];\n            comp = comp || function(a,b){ return a > b ? 1 : -1; };\n            Ext.each(arr, function(v) {\n                ret = comp(ret, v) == 1 ? ret : v;\n            });\n            return ret;\n        },\n\n        /**\n         * Calculates the mean of the Array\n         * @param {Array} arr The Array to calculate the mean value of.\n         * @return {Number} The mean.\n         */\n        mean : function(arr){\n           return arr.length > 0 ? Ext.sum(arr) / arr.length : undefined;\n        },\n\n        /**\n         * Calculates the sum of the Array\n         * @param {Array} arr The Array to calculate the sum value of.\n         * @return {Number} The sum.\n         */\n        sum : function(arr){\n           var ret = 0;\n           Ext.each(arr, function(v) {\n               ret += v;\n           });\n           return ret;\n        },\n\n        /**\n         * Partitions the set into two sets: a true set and a false set.\n         * Example:\n         * Example2:\n         * <pre><code>\n// Example 1:\nExt.partition([true, false, true, true, false]); // [[true, true, true], [false, false]]\n\n// Example 2:\nExt.partition(\n    Ext.query(\"p\"),\n    function(val){\n        return val.className == \"class1\"\n    }\n);\n// true are those paragraph elements with a className of \"class1\",\n// false set are those that do not have that className.\n         * </code></pre>\n         * @param {Array|NodeList} arr The array to partition\n         * @param {Function} truth (optional) a function to determine truth.  If this is omitted the element\n         *                   itself must be able to be evaluated for its truthfulness.\n         * @return {Array} [true<Array>,false<Array>]\n         */\n        partition : function(arr, truth){\n            var ret = [[],[]];\n            Ext.each(arr, function(v, i, a) {\n                ret[ (truth && truth(v, i, a)) || (!truth && v) ? 0 : 1].push(v);\n            });\n            return ret;\n        },\n\n        /**\n         * Invokes a method on each item in an Array.\n         * <pre><code>\n// Example:\nExt.invoke(Ext.query(\"p\"), \"getAttribute\", \"id\");\n// [el1.getAttribute(\"id\"), el2.getAttribute(\"id\"), ..., elN.getAttribute(\"id\")]\n         * </code></pre>\n         * @param {Array|NodeList} arr The Array of items to invoke the method on.\n         * @param {String} methodName The method name to invoke.\n         * @param {...*} args Arguments to send into the method invocation.\n         * @return {Array} The results of invoking the method on each item in the array.\n         */\n        invoke : function(arr, methodName){\n            var ret = [],\n                args = Array.prototype.slice.call(arguments, 2);\n            Ext.each(arr, function(v,i) {\n                if (v && typeof v[methodName] == 'function') {\n                    ret.push(v[methodName].apply(v, args));\n                } else {\n                    ret.push(undefined);\n                }\n            });\n            return ret;\n        },\n\n        /**\n         * Plucks the value of a property from each item in the Array\n         * <pre><code>\n// Example:\nExt.pluck(Ext.query(\"p\"), \"className\"); // [el1.className, el2.className, ..., elN.className]\n         * </code></pre>\n         * @param {Array|NodeList} arr The Array of items to pluck the value from.\n         * @param {String} prop The property name to pluck from each element.\n         * @return {Array} The value from each item in the Array.\n         */\n        pluck : function(arr, prop){\n            var ret = [];\n            Ext.each(arr, function(v) {\n                ret.push( v[prop] );\n            });\n            return ret;\n        },\n\n        /**\n         * <p>Zips N sets together.</p>\n         * <pre><code>\n// Example 1:\nExt.zip([1,2,3],[4,5,6]); // [[1,4],[2,5],[3,6]]\n// Example 2:\nExt.zip(\n    [ \"+\", \"-\", \"+\"],\n    [  12,  10,  22],\n    [  43,  15,  96],\n    function(a, b, c){\n        return \"$\" + a + \"\" + b + \".\" + c\n    }\n); // [\"$+12.43\", \"$-10.15\", \"$+22.96\"]\n         * </code></pre>\n         * @param {Arrays|NodeLists} arr This argument may be repeated. Array(s) to contribute values.\n         * @param {Function} zipper (optional) The last item in the argument list. This will drive how the items are zipped together.\n         * @return {Array} The zipped set.\n         */\n        zip : function(){\n            var parts = Ext.partition(arguments, function( val ){ return typeof val != 'function'; }),\n                arrs = parts[0],\n                fn = parts[1][0],\n                len = Ext.max(Ext.pluck(arrs, \"length\")),\n                ret = [];\n\n            for (var i = 0; i < len; i++) {\n                ret[i] = [];\n                if(fn){\n                    ret[i] = fn.apply(fn, Ext.pluck(arrs, i));\n                }else{\n                    for (var j = 0, aLen = arrs.length; j < aLen; j++){\n                        ret[i].push( arrs[j][i] );\n                    }\n                }\n            }\n            return ret;\n        },\n\n        /**\n         * This is shorthand reference to {@link Ext.ComponentMgr#get}.\n         * Looks up an existing {@link Ext.Component Component} by {@link Ext.Component#id id}\n         * @param {String} id The component {@link Ext.Component#id id}\n         * @return Ext.Component The Component, <tt>undefined</tt> if not found, or <tt>null</tt> if a\n         * Class was found.\n        */\n        getCmp : function(id){\n            return Ext.ComponentMgr.get(id);\n        },\n\n        /**\n         * By default, Ext intelligently decides whether floating elements should be shimmed. If you are using flash,\n         * you may want to set this to true.\n         * @type Boolean\n         */\n        useShims: E.isIE6 || (E.isMac && E.isGecko2),\n\n        // inpired by a similar function in mootools library\n        /**\n         * Returns the type of object that is passed in. If the object passed in is null or undefined it\n         * return false otherwise it returns one of the following values:<div class=\"mdetail-params\"><ul>\n         * <li><b>string</b>: If the object passed is a string</li>\n         * <li><b>number</b>: If the object passed is a number</li>\n         * <li><b>boolean</b>: If the object passed is a boolean value</li>\n         * <li><b>date</b>: If the object passed is a Date object</li>\n         * <li><b>function</b>: If the object passed is a function reference</li>\n         * <li><b>object</b>: If the object passed is an object</li>\n         * <li><b>array</b>: If the object passed is an array</li>\n         * <li><b>regexp</b>: If the object passed is a regular expression</li>\n         * <li><b>element</b>: If the object passed is a DOM Element</li>\n         * <li><b>nodelist</b>: If the object passed is a DOM NodeList</li>\n         * <li><b>textnode</b>: If the object passed is a DOM text node and contains something other than whitespace</li>\n         * <li><b>whitespace</b>: If the object passed is a DOM text node and contains only whitespace</li>\n         * </ul></div>\n         * @param {Mixed} object\n         * @return {String}\n         */\n        type : function(o){\n            if(o === undefined || o === null){\n                return false;\n            }\n            if(o.htmlElement){\n                return 'element';\n            }\n            var t = typeof o;\n            if(t == 'object' && o.nodeName) {\n                switch(o.nodeType) {\n                    case 1: return 'element';\n                    case 3: return (/\\S/).test(o.nodeValue) ? 'textnode' : 'whitespace';\n                }\n            }\n            if(t == 'object' || t == 'function') {\n                switch(o.constructor) {\n                    case Array: return 'array';\n                    case RegExp: return 'regexp';\n                    case Date: return 'date';\n                }\n                if(typeof o.length == 'number' && typeof o.item == 'function') {\n                    return 'nodelist';\n                }\n            }\n            return t;\n        },\n\n        intercept : function(o, name, fn, scope){\n            o[name] = o[name].createInterceptor(fn, scope);\n        },\n\n        // internal\n        callback : function(cb, scope, args, delay){\n            if(typeof cb == 'function'){\n                if(delay){\n                    cb.defer(delay, scope, args || []);\n                }else{\n                    cb.apply(scope, args || []);\n                }\n            }\n        }\n    };\n}());\n\n/**\n * @class Function\n * These functions are available on every Function object (any JavaScript function).\n */\nExt.apply(Function.prototype, {\n    /**\n     * Create a combined function call sequence of the original function + the passed function.\n     * The resulting function returns the results of the original function.\n     * The passed fcn is called with the parameters of the original function. Example usage:\n     * <pre><code>\nvar sayHi = function(name){\n    alert('Hi, ' + name);\n}\n\nsayHi('Fred'); // alerts \"Hi, Fred\"\n\nvar sayGoodbye = sayHi.createSequence(function(name){\n    alert('Bye, ' + name);\n});\n\nsayGoodbye('Fred'); // both alerts show\n</code></pre>\n     * @param {Function} fcn The function to sequence\n     * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the passed function is executed.\n     * <b>If omitted, defaults to the scope in which the original function is called or the browser window.</b>\n     * @return {Function} The new function\n     */\n    createSequence : function(fcn, scope){\n        var method = this;\n        return (typeof fcn != 'function') ?\n                this :\n                function(){\n                    var retval = method.apply(this || window, arguments);\n                    fcn.apply(scope || this || window, arguments);\n                    return retval;\n                };\n    }\n});\n\n\n/**\n * @class String\n * These functions are available as static methods on the JavaScript String object.\n */\nExt.applyIf(String, {\n\n    /**\n     * Escapes the passed string for ' and \\\n     * @param {String} string The string to escape\n     * @return {String} The escaped string\n     * @static\n     */\n    escape : function(string) {\n        return string.replace(/('|\\\\)/g, \"\\\\$1\");\n    },\n\n    /**\n     * Pads the left side of a string with a specified character.  This is especially useful\n     * for normalizing number and date strings.  Example usage:\n     * <pre><code>\nvar s = String.leftPad('123', 5, '0');\n// s now contains the string: '00123'\n     * </code></pre>\n     * @param {String} string The original string\n     * @param {Number} size The total length of the output string\n     * @param {String} char (optional) The character with which to pad the original string (defaults to empty string \" \")\n     * @return {String} The padded string\n     * @static\n     */\n    leftPad : function (val, size, ch) {\n        var result = String(val);\n        if(!ch) {\n            ch = \" \";\n        }\n        while (result.length < size) {\n            result = ch + result;\n        }\n        return result;\n    }\n});\n\n/**\n * Utility function that allows you to easily switch a string between two alternating values.  The passed value\n * is compared to the current string, and if they are equal, the other value that was passed in is returned.  If\n * they are already different, the first value passed in is returned.  Note that this method returns the new value\n * but does not change the current string.\n * <pre><code>\n// alternate sort directions\nsort = sort.toggle('ASC', 'DESC');\n\n// instead of conditional logic:\nsort = (sort == 'ASC' ? 'DESC' : 'ASC');\n</code></pre>\n * @param {String} value The value to compare to the current string\n * @param {String} other The new value to use if the string already equals the first value passed in\n * @return {String} The new value\n */\nString.prototype.toggle = function(value, other){\n    return this == value ? other : value;\n};\n\n/**\n * Trims whitespace from either end of a string, leaving spaces within the string intact.  Example:\n * <pre><code>\nvar s = '  foo bar  ';\nalert('-' + s + '-');         //alerts \"- foo bar -\"\nalert('-' + s.trim() + '-');  //alerts \"-foo bar-\"\n</code></pre>\n * @return {String} The trimmed string\n */\nString.prototype.trim = function(){\n    var re = /^\\s+|\\s+$/g;\n    return function(){ return this.replace(re, \"\"); };\n}();\n\n// here to prevent dependency on Date.js\n/**\n Returns the number of milliseconds between this date and date\n @param {Date} date (optional) Defaults to now\n @return {Number} The diff in milliseconds\n @member Date getElapsed\n */\nDate.prototype.getElapsed = function(date) {\n    return Math.abs((date || new Date()).getTime()-this.getTime());\n};\n\n\n/**\n * @class Number\n */\nExt.applyIf(Number.prototype, {\n    /**\n     * Checks whether or not the current number is within a desired range.  If the number is already within the\n     * range it is returned, otherwise the min or max value is returned depending on which side of the range is\n     * exceeded.  Note that this method returns the constrained value but does not change the current number.\n     * @param {Number} min The minimum number in the range\n     * @param {Number} max The maximum number in the range\n     * @return {Number} The constrained value if outside the range, otherwise the current value\n     */\n    constrain : function(min, max){\n        return Math.min(Math.max(this, min), max);\n    }\n});\nExt.lib.Dom.getRegion = function(el) {\n    return Ext.lib.Region.getRegion(el);\n};\tExt.lib.Region = function(t, r, b, l) {\n\t\tvar me = this;\n        me.top = t;\n        me[1] = t;\n        me.right = r;\n        me.bottom = b;\n        me.left = l;\n        me[0] = l;\n    };\n\n    Ext.lib.Region.prototype = {\n        contains : function(region) {\n\t        var me = this;\n            return ( region.left >= me.left &&\n                     region.right <= me.right &&\n                     region.top >= me.top &&\n                     region.bottom <= me.bottom );\n\n        },\n\n        getArea : function() {\n\t        var me = this;\n            return ( (me.bottom - me.top) * (me.right - me.left) );\n        },\n\n        intersect : function(region) {\n            var me = this,\n            \tt = Math.max(me.top, region.top),\n            \tr = Math.min(me.right, region.right),\n            \tb = Math.min(me.bottom, region.bottom),\n            \tl = Math.max(me.left, region.left);\n\n            if (b >= t && r >= l) {\n                return new Ext.lib.Region(t, r, b, l);\n            }\n        },\n        \n        union : function(region) {\n\t        var me = this,\n            \tt = Math.min(me.top, region.top),\n            \tr = Math.max(me.right, region.right),\n            \tb = Math.max(me.bottom, region.bottom),\n            \tl = Math.min(me.left, region.left);\n\n            return new Ext.lib.Region(t, r, b, l);\n        },\n\n        constrainTo : function(r) {\n\t        var me = this;\n            me.top = me.top.constrain(r.top, r.bottom);\n            me.bottom = me.bottom.constrain(r.top, r.bottom);\n            me.left = me.left.constrain(r.left, r.right);\n            me.right = me.right.constrain(r.left, r.right);\n            return me;\n        },\n\n        adjust : function(t, l, b, r) {\n\t        var me = this;\n            me.top += t;\n            me.left += l;\n            me.right += r;\n            me.bottom += b;\n            return me;\n        }\n    };\n\n    Ext.lib.Region.getRegion = function(el) {\n        var p = Ext.lib.Dom.getXY(el),\n        \tt = p[1],\n        \tr = p[0] + el.offsetWidth,\n        \tb = p[1] + el.offsetHeight,\n        \tl = p[0];\n\n        return new Ext.lib.Region(t, r, b, l);\n    };\tExt.lib.Point = function(x, y) {\n        if (Ext.isArray(x)) {\n            y = x[1];\n            x = x[0];\n        }\n        var me = this;\n        me.x = me.right = me.left = me[0] = x;\n        me.y = me.top = me.bottom = me[1] = y;\n    };\n\n    Ext.lib.Point.prototype = new Ext.lib.Region();\n/**\n * @class Ext.DomHelper\n */\nExt.apply(Ext.DomHelper,\nfunction(){\n    var pub,\n        afterbegin = 'afterbegin',\n        afterend = 'afterend',\n        beforebegin = 'beforebegin',\n        beforeend = 'beforeend',\n        confRe = /tag|children|cn|html$/i;\n\n    // private\n    function doInsert(el, o, returnElement, pos, sibling, append){\n        el = Ext.getDom(el);\n        var newNode;\n        if (pub.useDom) {\n            newNode = createDom(o, null);\n            if (append) {\n                el.appendChild(newNode);\n            } else {\n                (sibling == 'firstChild' ? el : el.parentNode).insertBefore(newNode, el[sibling] || el);\n            }\n        } else {\n            newNode = Ext.DomHelper.insertHtml(pos, el, Ext.DomHelper.createHtml(o));\n        }\n        return returnElement ? Ext.get(newNode, true) : newNode;\n    }\n\n    // build as dom\n    /** @ignore */\n    function createDom(o, parentNode){\n        var el,\n            doc = document,\n            useSet,\n            attr,\n            val,\n            cn;\n\n        if (Ext.isArray(o)) {                       // Allow Arrays of siblings to be inserted\n            el = doc.createDocumentFragment(); // in one shot using a DocumentFragment\n            for (var i = 0, l = o.length; i < l; i++) {\n                createDom(o[i], el);\n            }\n        } else if (typeof o == 'string') {         // Allow a string as a child spec.\n            el = doc.createTextNode(o);\n        } else {\n            el = doc.createElement( o.tag || 'div' );\n            useSet = !!el.setAttribute; // In IE some elements don't have setAttribute\n            for (var attr in o) {\n                if(!confRe.test(attr)){\n                    val = o[attr];\n                    if(attr == 'cls'){\n                        el.className = val;\n                    }else{\n                        if(useSet){\n                            el.setAttribute(attr, val);\n                        }else{\n                            el[attr] = val;\n                        }\n                    }\n                }\n            }\n            Ext.DomHelper.applyStyles(el, o.style);\n\n            if ((cn = o.children || o.cn)) {\n                createDom(cn, el);\n            } else if (o.html) {\n                el.innerHTML = o.html;\n            }\n        }\n        if(parentNode){\n           parentNode.appendChild(el);\n        }\n        return el;\n    }\n\n    pub = {\n        /**\n         * Creates a new Ext.Template from the DOM object spec.\n         * @param {Object} o The DOM object spec (and children)\n         * @return {Ext.Template} The new template\n         */\n        createTemplate : function(o){\n            var html = Ext.DomHelper.createHtml(o);\n            return new Ext.Template(html);\n        },\n\n        /** True to force the use of DOM instead of html fragments @type Boolean */\n        useDom : false,\n\n        /**\n         * Creates new DOM element(s) and inserts them before el.\n         * @param {Mixed} el The context element\n         * @param {Object/String} o The DOM object spec (and children) or raw HTML blob\n         * @param {Boolean} returnElement (optional) true to return a Ext.Element\n         * @return {HTMLElement/Ext.Element} The new node\n         * @hide (repeat)\n         */\n        insertBefore : function(el, o, returnElement){\n            return doInsert(el, o, returnElement, beforebegin);\n        },\n\n        /**\n         * Creates new DOM element(s) and inserts them after el.\n         * @param {Mixed} el The context element\n         * @param {Object} o The DOM object spec (and children)\n         * @param {Boolean} returnElement (optional) true to return a Ext.Element\n         * @return {HTMLElement/Ext.Element} The new node\n         * @hide (repeat)\n         */\n        insertAfter : function(el, o, returnElement){\n            return doInsert(el, o, returnElement, afterend, 'nextSibling');\n        },\n\n        /**\n         * Creates new DOM element(s) and inserts them as the first child of el.\n         * @param {Mixed} el The context element\n         * @param {Object/String} o The DOM object spec (and children) or raw HTML blob\n         * @param {Boolean} returnElement (optional) true to return a Ext.Element\n         * @return {HTMLElement/Ext.Element} The new node\n         * @hide (repeat)\n         */\n        insertFirst : function(el, o, returnElement){\n            return doInsert(el, o, returnElement, afterbegin, 'firstChild');\n        },\n\n        /**\n         * Creates new DOM element(s) and appends them to el.\n         * @param {Mixed} el The context element\n         * @param {Object/String} o The DOM object spec (and children) or raw HTML blob\n         * @param {Boolean} returnElement (optional) true to return a Ext.Element\n         * @return {HTMLElement/Ext.Element} The new node\n         * @hide (repeat)\n         */\n        append: function(el, o, returnElement){\n            return doInsert(el, o, returnElement, beforeend, '', true);\n        },\n\n        /**\n         * Creates new DOM element(s) without inserting them to the document.\n         * @param {Object/String} o The DOM object spec (and children) or raw HTML blob\n         * @return {HTMLElement} The new uninserted node\n         */\n        createDom: createDom\n    };\n    return pub;\n}());\n/**\n * @class Ext.Template\n */\nExt.apply(Ext.Template.prototype, {\n    /**\n     * @cfg {Boolean} disableFormats Specify <tt>true</tt> to disable format\n     * functions in the template. If the template does not contain\n     * {@link Ext.util.Format format functions}, setting <code>disableFormats</code>\n     * to true will reduce <code>{@link #apply}</code> time. Defaults to <tt>false</tt>.\n     * <pre><code>\nvar t = new Ext.Template(\n    '&lt;div name=\"{id}\"&gt;',\n        '&lt;span class=\"{cls}\"&gt;{name} {value}&lt;/span&gt;',\n    '&lt;/div&gt;',\n    {\n        compiled: true,      // {@link #compile} immediately\n        disableFormats: true // reduce <code>{@link #apply}</code> time since no formatting\n    }\n);\n     * </code></pre>\n     * For a list of available format functions, see {@link Ext.util.Format}.\n     */\n    disableFormats : false,\n    /**\n     * See <code>{@link #disableFormats}</code>.\n     * @type Boolean\n     * @property disableFormats\n     */\n\n    /**\n     * The regular expression used to match template variables\n     * @type RegExp\n     * @property\n     * @hide repeat doc\n     */\n    re : /\\{([\\w\\-]+)(?:\\:([\\w\\.]*)(?:\\((.*?)?\\))?)?\\}/g,\n    argsRe : /^\\s*['\"](.*)[\"']\\s*$/,\n    compileARe : /\\\\/g,\n    compileBRe : /(\\r\\n|\\n)/g,\n    compileCRe : /'/g,\n\n    /**\n     * Returns an HTML fragment of this template with the specified values applied.\n     * @param {Object/Array} values The template values. Can be an array if your params are numeric (i.e. {0}) or an object (i.e. {foo: 'bar'})\n     * @return {String} The HTML fragment\n     * @hide repeat doc\n     */\n    applyTemplate : function(values){\n        var me = this,\n            useF = me.disableFormats !== true,\n            fm = Ext.util.Format,\n            tpl = me;\n\n        if(me.compiled){\n            return me.compiled(values);\n        }\n        function fn(m, name, format, args){\n            if (format && useF) {\n                if (format.substr(0, 5) == \"this.\") {\n                    return tpl.call(format.substr(5), values[name], values);\n                } else {\n                    if (args) {\n                        // quoted values are required for strings in compiled templates,\n                        // but for non compiled we need to strip them\n                        // quoted reversed for jsmin\n                        var re = me.argsRe;\n                        args = args.split(',');\n                        for(var i = 0, len = args.length; i < len; i++){\n                            args[i] = args[i].replace(re, \"$1\");\n                        }\n                        args = [values[name]].concat(args);\n                    } else {\n                        args = [values[name]];\n                    }\n                    return fm[format].apply(fm, args);\n                }\n            } else {\n                return values[name] !== undefined ? values[name] : \"\";\n            }\n        }\n        return me.html.replace(me.re, fn);\n    },\n\n    /**\n     * Compiles the template into an internal function, eliminating the RegEx overhead.\n     * @return {Ext.Template} this\n     * @hide repeat doc\n     */\n    compile : function(){\n        var me = this,\n            fm = Ext.util.Format,\n            useF = me.disableFormats !== true,\n            sep = Ext.isGecko ? \"+\" : \",\",\n            body;\n\n        function fn(m, name, format, args){\n            if(format && useF){\n                args = args ? ',' + args : \"\";\n                if(format.substr(0, 5) != \"this.\"){\n                    format = \"fm.\" + format + '(';\n                }else{\n                    format = 'this.call(\"'+ format.substr(5) + '\", ';\n                    args = \", values\";\n                }\n            }else{\n                args= ''; format = \"(values['\" + name + \"'] == undefined ? '' : \";\n            }\n            return \"'\"+ sep + format + \"values['\" + name + \"']\" + args + \")\"+sep+\"'\";\n        }\n\n        // branched to use + in gecko and [].join() in others\n        if(Ext.isGecko){\n            body = \"this.compiled = function(values){ return '\" +\n                   me.html.replace(me.compileARe, '\\\\\\\\').replace(me.compileBRe, '\\\\n').replace(me.compileCRe, \"\\\\'\").replace(me.re, fn) +\n                    \"';};\";\n        }else{\n            body = [\"this.compiled = function(values){ return ['\"];\n            body.push(me.html.replace(me.compileARe, '\\\\\\\\').replace(me.compileBRe, '\\\\n').replace(me.compileCRe, \"\\\\'\").replace(me.re, fn));\n            body.push(\"'].join('');};\");\n            body = body.join('');\n        }\n        eval(body);\n        return me;\n    },\n\n    // private function used to call members\n    call : function(fnName, value, allValues){\n        return this[fnName](value, allValues);\n    }\n});\nExt.Template.prototype.apply = Ext.Template.prototype.applyTemplate;\n/**\n * @class Ext.util.Functions\n * @singleton\n */\nExt.util.Functions = {\n    /**\n     * Creates an interceptor function. The passed function is called before the original one. If it returns false,\n     * the original one is not called. The resulting function returns the results of the original function.\n     * The passed function is called with the parameters of the original function. Example usage:\n     * <pre><code>\nvar sayHi = function(name){\n    alert('Hi, ' + name);\n}\n\nsayHi('Fred'); // alerts \"Hi, Fred\"\n\n// create a new function that validates input without\n// directly modifying the original function:\nvar sayHiToFriend = Ext.createInterceptor(sayHi, function(name){\n    return name == 'Brian';\n});\n\nsayHiToFriend('Fred');  // no alert\nsayHiToFriend('Brian'); // alerts \"Hi, Brian\"\n       </code></pre>\n     * @param {Function} origFn The original function.\n     * @param {Function} newFn The function to call before the original\n     * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the passed function is executed.\n     * <b>If omitted, defaults to the scope in which the original function is called or the browser window.</b>\n     * @return {Function} The new function\n     */\n    createInterceptor: function(origFn, newFn, scope) { \n        var method = origFn;\n        if (!Ext.isFunction(newFn)) {\n            return origFn;\n        }\n        else {\n            return function() {\n                var me = this,\n                    args = arguments;\n                newFn.target = me;\n                newFn.method = origFn;\n                return (newFn.apply(scope || me || window, args) !== false) ?\n                        origFn.apply(me || window, args) :\n                        null;\n            };\n        }\n    },\n\n    /**\n     * Creates a delegate (callback) that sets the scope to obj.\n     * Call directly on any function. Example: <code>Ext.createDelegate(this.myFunction, this, [arg1, arg2])</code>\n     * Will create a function that is automatically scoped to obj so that the <tt>this</tt> variable inside the\n     * callback points to obj. Example usage:\n     * <pre><code>\nvar sayHi = function(name){\n    // Note this use of \"this.text\" here.  This function expects to\n    // execute within a scope that contains a text property.  In this\n    // example, the \"this\" variable is pointing to the btn object that\n    // was passed in createDelegate below.\n    alert('Hi, ' + name + '. You clicked the \"' + this.text + '\" button.');\n}\n\nvar btn = new Ext.Button({\n    text: 'Say Hi',\n    renderTo: Ext.getBody()\n});\n\n// This callback will execute in the scope of the\n// button instance. Clicking the button alerts\n// \"Hi, Fred. You clicked the \"Say Hi\" button.\"\nbtn.on('click', Ext.createDelegate(sayHi, btn, ['Fred']));\n       </code></pre>\n     * @param {Function} fn The function to delegate.\n     * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the function is executed.\n     * <b>If omitted, defaults to the browser window.</b>\n     * @param {Array} args (optional) Overrides arguments for the call. (Defaults to the arguments passed by the caller)\n     * @param {Boolean/Number} appendArgs (optional) if True args are appended to call args instead of overriding,\n     * if a number the args are inserted at the specified position\n     * @return {Function} The new function\n     */\n    createDelegate: function(fn, obj, args, appendArgs) {\n        if (!Ext.isFunction(fn)) {\n            return fn;\n        }\n        return function() {\n            var callArgs = args || arguments;\n            if (appendArgs === true) {\n                callArgs = Array.prototype.slice.call(arguments, 0);\n                callArgs = callArgs.concat(args);\n            }\n            else if (Ext.isNumber(appendArgs)) {\n                callArgs = Array.prototype.slice.call(arguments, 0);\n                // copy arguments first\n                var applyArgs = [appendArgs, 0].concat(args);\n                // create method call params\n                Array.prototype.splice.apply(callArgs, applyArgs);\n                // splice them in\n            }\n            return fn.apply(obj || window, callArgs);\n        };\n    },\n\n    /**\n     * Calls this function after the number of millseconds specified, optionally in a specific scope. Example usage:\n     * <pre><code>\nvar sayHi = function(name){\n    alert('Hi, ' + name);\n}\n\n// executes immediately:\nsayHi('Fred');\n\n// executes after 2 seconds:\nExt.defer(sayHi, 2000, this, ['Fred']);\n\n// this syntax is sometimes useful for deferring\n// execution of an anonymous function:\nExt.defer(function(){\n    alert('Anonymous');\n}, 100);\n       </code></pre>\n     * @param {Function} fn The function to defer.\n     * @param {Number} millis The number of milliseconds for the setTimeout call (if less than or equal to 0 the function is executed immediately)\n     * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the function is executed.\n     * <b>If omitted, defaults to the browser window.</b>\n     * @param {Array} args (optional) Overrides arguments for the call. (Defaults to the arguments passed by the caller)\n     * @param {Boolean/Number} appendArgs (optional) if True args are appended to call args instead of overriding,\n     * if a number the args are inserted at the specified position\n     * @return {Number} The timeout id that can be used with clearTimeout\n     */\n    defer: function(fn, millis, obj, args, appendArgs) {\n        fn = Ext.util.Functions.createDelegate(fn, obj, args, appendArgs);\n        if (millis > 0) {\n            return setTimeout(fn, millis);\n        }\n        fn();\n        return 0;\n    },\n\n\n    /**\n     * Create a combined function call sequence of the original function + the passed function.\n     * The resulting function returns the results of the original function.\n     * The passed fcn is called with the parameters of the original function. Example usage:\n     * \n\nvar sayHi = function(name){\n    alert('Hi, ' + name);\n}\n\nsayHi('Fred'); // alerts \"Hi, Fred\"\n\nvar sayGoodbye = Ext.createSequence(sayHi, function(name){\n    alert('Bye, ' + name);\n});\n\nsayGoodbye('Fred'); // both alerts show\n\n     * @param {Function} origFn The original function.\n     * @param {Function} newFn The function to sequence\n     * @param {Object} scope (optional) The scope (this reference) in which the passed function is executed.\n     * If omitted, defaults to the scope in which the original function is called or the browser window.\n     * @return {Function} The new function\n     */\n    createSequence: function(origFn, newFn, scope) {\n        if (!Ext.isFunction(newFn)) {\n            return origFn;\n        }\n        else {\n            return function() {\n                var retval = origFn.apply(this || window, arguments);\n                newFn.apply(scope || this || window, arguments);\n                return retval;\n            };\n        }\n    }\n};\n\n/**\n * Shorthand for {@link Ext.util.Functions#defer}   \n * @param {Function} fn The function to defer.\n * @param {Number} millis The number of milliseconds for the setTimeout call (if less than or equal to 0 the function is executed immediately)\n * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the function is executed.\n * <b>If omitted, defaults to the browser window.</b>\n * @param {Array} args (optional) Overrides arguments for the call. (Defaults to the arguments passed by the caller)\n * @param {Boolean/Number} appendArgs (optional) if True args are appended to call args instead of overriding,\n * if a number the args are inserted at the specified position\n * @return {Number} The timeout id that can be used with clearTimeout\n * @member Ext\n * @method defer\n */\n\nExt.defer = Ext.util.Functions.defer;\n\n/**\n * Shorthand for {@link Ext.util.Functions#createInterceptor}   \n * @param {Function} origFn The original function.\n * @param {Function} newFn The function to call before the original\n * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the passed function is executed.\n * <b>If omitted, defaults to the scope in which the original function is called or the browser window.</b>\n * @return {Function} The new function\n * @member Ext\n * @method createInterceptor\n */\n\nExt.createInterceptor = Ext.util.Functions.createInterceptor;\n\n/**\n * Shorthand for {@link Ext.util.Functions#createSequence}\n * @param {Function} origFn The original function.\n * @param {Function} newFn The function to sequence\n * @param {Object} scope (optional) The scope (this reference) in which the passed function is executed.\n * If omitted, defaults to the scope in which the original function is called or the browser window.\n * @return {Function} The new function\n * @member Ext\n * @method createSequence\n */\n\nExt.createSequence = Ext.util.Functions.createSequence;\n\n/**\n * Shorthand for {@link Ext.util.Functions#createDelegate}\n * @param {Function} fn The function to delegate.\n * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the function is executed.\n * <b>If omitted, defaults to the browser window.</b>\n * @param {Array} args (optional) Overrides arguments for the call. (Defaults to the arguments passed by the caller)\n * @param {Boolean/Number} appendArgs (optional) if True args are appended to call args instead of overriding,\n * if a number the args are inserted at the specified position\n * @return {Function} The new function\n * @member Ext\n * @method createDelegate\n */\nExt.createDelegate = Ext.util.Functions.createDelegate;\n/**\n * @class Ext.util.Observable\n */\nExt.apply(Ext.util.Observable.prototype, function(){\n    // this is considered experimental (along with beforeMethod, afterMethod, removeMethodListener?)\n    // allows for easier interceptor and sequences, including cancelling and overwriting the return value of the call\n    // private\n    function getMethodEvent(method){\n        var e = (this.methodEvents = this.methodEvents ||\n        {})[method], returnValue, v, cancel, obj = this;\n\n        if (!e) {\n            this.methodEvents[method] = e = {};\n            e.originalFn = this[method];\n            e.methodName = method;\n            e.before = [];\n            e.after = [];\n\n            var makeCall = function(fn, scope, args){\n                if((v = fn.apply(scope || obj, args)) !== undefined){\n                    if (typeof v == 'object') {\n                        if(v.returnValue !== undefined){\n                            returnValue = v.returnValue;\n                        }else{\n                            returnValue = v;\n                        }\n                        cancel = !!v.cancel;\n                    }\n                    else\n                        if (v === false) {\n                            cancel = true;\n                        }\n                        else {\n                            returnValue = v;\n                        }\n                }\n            };\n\n            this[method] = function(){\n                var args = Array.prototype.slice.call(arguments, 0),\n                    b;\n                returnValue = v = undefined;\n                cancel = false;\n\n                for(var i = 0, len = e.before.length; i < len; i++){\n                    b = e.before[i];\n                    makeCall(b.fn, b.scope, args);\n                    if (cancel) {\n                        return returnValue;\n                    }\n                }\n\n                if((v = e.originalFn.apply(obj, args)) !== undefined){\n                    returnValue = v;\n                }\n\n                for(var i = 0, len = e.after.length; i < len; i++){\n                    b = e.after[i];\n                    makeCall(b.fn, b.scope, args);\n                    if (cancel) {\n                        return returnValue;\n                    }\n                }\n                return returnValue;\n            };\n        }\n        return e;\n    }\n\n    return {\n        // these are considered experimental\n        // allows for easier interceptor and sequences, including cancelling and overwriting the return value of the call\n        // adds an 'interceptor' called before the original method\n        beforeMethod : function(method, fn, scope){\n            getMethodEvent.call(this, method).before.push({\n                fn: fn,\n                scope: scope\n            });\n        },\n\n        // adds a 'sequence' called after the original method\n        afterMethod : function(method, fn, scope){\n            getMethodEvent.call(this, method).after.push({\n                fn: fn,\n                scope: scope\n            });\n        },\n\n        removeMethodListener: function(method, fn, scope){\n            var e = this.getMethodEvent(method);\n            for(var i = 0, len = e.before.length; i < len; i++){\n                if(e.before[i].fn == fn && e.before[i].scope == scope){\n                    e.before.splice(i, 1);\n                    return;\n                }\n            }\n            for(var i = 0, len = e.after.length; i < len; i++){\n                if(e.after[i].fn == fn && e.after[i].scope == scope){\n                    e.after.splice(i, 1);\n                    return;\n                }\n            }\n        },\n\n        /**\n         * Relays selected events from the specified Observable as if the events were fired by <tt><b>this</b></tt>.\n         * @param {Object} o The Observable whose events this object is to relay.\n         * @param {Array} events Array of event names to relay.\n         */\n        relayEvents : function(o, events){\n            var me = this;\n            function createHandler(ename){\n                return function(){\n                    return me.fireEvent.apply(me, [ename].concat(Array.prototype.slice.call(arguments, 0)));\n                };\n            }\n            for(var i = 0, len = events.length; i < len; i++){\n                var ename = events[i];\n                me.events[ename] = me.events[ename] || true;\n                o.on(ename, createHandler(ename), me);\n            }\n        },\n\n        /**\n         * <p>Enables events fired by this Observable to bubble up an owner hierarchy by calling\n         * <code>this.getBubbleTarget()</code> if present. There is no implementation in the Observable base class.</p>\n         * <p>This is commonly used by Ext.Components to bubble events to owner Containers. See {@link Ext.Component.getBubbleTarget}. The default\n         * implementation in Ext.Component returns the Component's immediate owner. But if a known target is required, this can be overridden to\n         * access the required target more quickly.</p>\n         * <p>Example:</p><pre><code>\nExt.override(Ext.form.Field, {\n    //  Add functionality to Field&#39;s initComponent to enable the change event to bubble\n    initComponent : Ext.form.Field.prototype.initComponent.createSequence(function() {\n        this.enableBubble('change');\n    }),\n\n    //  We know that we want Field&#39;s events to bubble directly to the FormPanel.\n    getBubbleTarget : function() {\n        if (!this.formPanel) {\n            this.formPanel = this.findParentByType('form');\n        }\n        return this.formPanel;\n    }\n});\n\nvar myForm = new Ext.formPanel({\n    title: 'User Details',\n    items: [{\n        ...\n    }],\n    listeners: {\n        change: function() {\n            // Title goes red if form has been modified.\n            myForm.header.setStyle('color', 'red');\n        }\n    }\n});\n</code></pre>\n         * @param {String/Array} events The event name to bubble, or an Array of event names.\n         */\n        enableBubble : function(events){\n            var me = this;\n            if(!Ext.isEmpty(events)){\n                events = Ext.isArray(events) ? events : Array.prototype.slice.call(arguments, 0);\n                for(var i = 0, len = events.length; i < len; i++){\n                    var ename = events[i];\n                    ename = ename.toLowerCase();\n                    var ce = me.events[ename] || true;\n                    if (typeof ce == 'boolean') {\n                        ce = new Ext.util.Event(me, ename);\n                        me.events[ename] = ce;\n                    }\n                    ce.bubble = true;\n                }\n            }\n        }\n    };\n}());\n\n\n/**\n * Starts capture on the specified Observable. All events will be passed\n * to the supplied function with the event name + standard signature of the event\n * <b>before</b> the event is fired. If the supplied function returns false,\n * the event will not fire.\n * @param {Observable} o The Observable to capture events from.\n * @param {Function} fn The function to call when an event is fired.\n * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to the Observable firing the event.\n * @static\n */\nExt.util.Observable.capture = function(o, fn, scope){\n    o.fireEvent = o.fireEvent.createInterceptor(fn, scope);\n};\n\n\n/**\n * Sets observability on the passed class constructor.<p>\n * <p>This makes any event fired on any instance of the passed class also fire a single event through\n * the <i>class</i> allowing for central handling of events on many instances at once.</p>\n * <p>Usage:</p><pre><code>\nExt.util.Observable.observeClass(Ext.data.Connection);\nExt.data.Connection.on('beforerequest', function(con, options) {\n    console.log('Ajax request made to ' + options.url);\n});</code></pre>\n * @param {Function} c The class constructor to make observable.\n * @param {Object} listeners An object containing a series of listeners to add. See {@link #addListener}.\n * @static\n */\nExt.util.Observable.observeClass = function(c, listeners){\n    if(c){\n      if(!c.fireEvent){\n          Ext.apply(c, new Ext.util.Observable());\n          Ext.util.Observable.capture(c.prototype, c.fireEvent, c);\n      }\n      if(typeof listeners == 'object'){\n          c.on(listeners);\n      }\n      return c;\n   }\n};\n/**\n* @class Ext.EventManager\n*/\nExt.apply(Ext.EventManager, function(){\n   var resizeEvent,\n       resizeTask,\n       textEvent,\n       textSize,\n       D = Ext.lib.Dom,\n       propRe = /^(?:scope|delay|buffer|single|stopEvent|preventDefault|stopPropagation|normalized|args|delegate)$/,\n       unload = Ext.EventManager._unload,\n       curWidth = 0,\n       curHeight = 0,\n       // note 1: IE fires ONLY the keydown event on specialkey autorepeat\n       // note 2: Safari < 3.1, Gecko (Mac/Linux) & Opera fire only the keypress event on specialkey autorepeat\n       // (research done by @Jan Wolter at http://unixpapa.com/js/key.html)\n       useKeydown = Ext.isWebKit ?\n                   Ext.num(navigator.userAgent.match(/AppleWebKit\\/(\\d+)/)[1]) >= 525 :\n                   !((Ext.isGecko && !Ext.isWindows) || Ext.isOpera);\n\n   return {\n       _unload: function(){\n           Ext.EventManager.un(window, \"resize\", this.fireWindowResize, this);\n           unload.call(Ext.EventManager);    \n       },\n       \n       // private\n       doResizeEvent: function(){\n           var h = D.getViewHeight(),\n               w = D.getViewWidth();\n\n            //whacky problem in IE where the resize event will fire even though the w/h are the same.\n            if(curHeight != h || curWidth != w){\n               resizeEvent.fire(curWidth = w, curHeight = h);\n            }\n       },\n\n       /**\n        * Adds a listener to be notified when the browser window is resized and provides resize event buffering (100 milliseconds),\n        * passes new viewport width and height to handlers.\n        * @param {Function} fn      The handler function the window resize event invokes.\n        * @param {Object}   scope   The scope (<code>this</code> reference) in which the handler function executes. Defaults to the browser window.\n        * @param {boolean}  options Options object as passed to {@link Ext.Element#addListener}\n        */\n       onWindowResize : function(fn, scope, options){\n           if(!resizeEvent){\n               resizeEvent = new Ext.util.Event();\n               resizeTask = new Ext.util.DelayedTask(this.doResizeEvent);\n               Ext.EventManager.on(window, \"resize\", this.fireWindowResize, this);\n           }\n           resizeEvent.addListener(fn, scope, options);\n       },\n\n       // exposed only to allow manual firing\n       fireWindowResize : function(){\n           if(resizeEvent){\n               resizeTask.delay(100);\n           }\n       },\n\n       /**\n        * Adds a listener to be notified when the user changes the active text size. Handler gets called with 2 params, the old size and the new size.\n        * @param {Function} fn      The function the event invokes.\n        * @param {Object}   scope   The scope (<code>this</code> reference) in which the handler function executes. Defaults to the browser window.\n        * @param {boolean}  options Options object as passed to {@link Ext.Element#addListener}\n        */\n       onTextResize : function(fn, scope, options){\n           if(!textEvent){\n               textEvent = new Ext.util.Event();\n               var textEl = new Ext.Element(document.createElement('div'));\n               textEl.dom.className = 'x-text-resize';\n               textEl.dom.innerHTML = 'X';\n               textEl.appendTo(document.body);\n               textSize = textEl.dom.offsetHeight;\n               setInterval(function(){\n                   if(textEl.dom.offsetHeight != textSize){\n                       textEvent.fire(textSize, textSize = textEl.dom.offsetHeight);\n                   }\n               }, this.textResizeInterval);\n           }\n           textEvent.addListener(fn, scope, options);\n       },\n\n       /**\n        * Removes the passed window resize listener.\n        * @param {Function} fn        The method the event invokes\n        * @param {Object}   scope    The scope of handler\n        */\n       removeResizeListener : function(fn, scope){\n           if(resizeEvent){\n               resizeEvent.removeListener(fn, scope);\n           }\n       },\n\n       // private\n       fireResize : function(){\n           if(resizeEvent){\n               resizeEvent.fire(D.getViewWidth(), D.getViewHeight());\n           }\n       },\n\n        /**\n        * The frequency, in milliseconds, to check for text resize events (defaults to 50)\n        */\n       textResizeInterval : 50,\n\n       /**\n        * Url used for onDocumentReady with using SSL (defaults to Ext.SSL_SECURE_URL)\n        */\n       ieDeferSrc : false,\n       \n       // protected, short accessor for useKeydown\n       getKeyEvent : function(){\n           return useKeydown ? 'keydown' : 'keypress';\n       },\n\n       // protected for use inside the framework\n       // detects whether we should use keydown or keypress based on the browser.\n       useKeydown: useKeydown\n   };\n}());\n\nExt.EventManager.on = Ext.EventManager.addListener;\n\n\nExt.apply(Ext.EventObjectImpl.prototype, {\n   /** Key constant @type Number */\n   BACKSPACE: 8,\n   /** Key constant @type Number */\n   TAB: 9,\n   /** Key constant @type Number */\n   NUM_CENTER: 12,\n   /** Key constant @type Number */\n   ENTER: 13,\n   /** Key constant @type Number */\n   RETURN: 13,\n   /** Key constant @type Number */\n   SHIFT: 16,\n   /** Key constant @type Number */\n   CTRL: 17,\n   CONTROL : 17, // legacy\n   /** Key constant @type Number */\n   ALT: 18,\n   /** Key constant @type Number */\n   PAUSE: 19,\n   /** Key constant @type Number */\n   CAPS_LOCK: 20,\n   /** Key constant @type Number */\n   ESC: 27,\n   /** Key constant @type Number */\n   SPACE: 32,\n   /** Key constant @type Number */\n   PAGE_UP: 33,\n   PAGEUP : 33, // legacy\n   /** Key constant @type Number */\n   PAGE_DOWN: 34,\n   PAGEDOWN : 34, // legacy\n   /** Key constant @type Number */\n   END: 35,\n   /** Key constant @type Number */\n   HOME: 36,\n   /** Key constant @type Number */\n   LEFT: 37,\n   /** Key constant @type Number */\n   UP: 38,\n   /** Key constant @type Number */\n   RIGHT: 39,\n   /** Key constant @type Number */\n   DOWN: 40,\n   /** Key constant @type Number */\n   PRINT_SCREEN: 44,\n   /** Key constant @type Number */\n   INSERT: 45,\n   /** Key constant @type Number */\n   DELETE: 46,\n   /** Key constant @type Number */\n   ZERO: 48,\n   /** Key constant @type Number */\n   ONE: 49,\n   /** Key constant @type Number */\n   TWO: 50,\n   /** Key constant @type Number */\n   THREE: 51,\n   /** Key constant @type Number */\n   FOUR: 52,\n   /** Key constant @type Number */\n   FIVE: 53,\n   /** Key constant @type Number */\n   SIX: 54,\n   /** Key constant @type Number */\n   SEVEN: 55,\n   /** Key constant @type Number */\n   EIGHT: 56,\n   /** Key constant @type Number */\n   NINE: 57,\n   /** Key constant @type Number */\n   A: 65,\n   /** Key constant @type Number */\n   B: 66,\n   /** Key constant @type Number */\n   C: 67,\n   /** Key constant @type Number */\n   D: 68,\n   /** Key constant @type Number */\n   E: 69,\n   /** Key constant @type Number */\n   F: 70,\n   /** Key constant @type Number */\n   G: 71,\n   /** Key constant @type Number */\n   H: 72,\n   /** Key constant @type Number */\n   I: 73,\n   /** Key constant @type Number */\n   J: 74,\n   /** Key constant @type Number */\n   K: 75,\n   /** Key constant @type Number */\n   L: 76,\n   /** Key constant @type Number */\n   M: 77,\n   /** Key constant @type Number */\n   N: 78,\n   /** Key constant @type Number */\n   O: 79,\n   /** Key constant @type Number */\n   P: 80,\n   /** Key constant @type Number */\n   Q: 81,\n   /** Key constant @type Number */\n   R: 82,\n   /** Key constant @type Number */\n   S: 83,\n   /** Key constant @type Number */\n   T: 84,\n   /** Key constant @type Number */\n   U: 85,\n   /** Key constant @type Number */\n   V: 86,\n   /** Key constant @type Number */\n   W: 87,\n   /** Key constant @type Number */\n   X: 88,\n   /** Key constant @type Number */\n   Y: 89,\n   /** Key constant @type Number */\n   Z: 90,\n   /** Key constant @type Number */\n   CONTEXT_MENU: 93,\n   /** Key constant @type Number */\n   NUM_ZERO: 96,\n   /** Key constant @type Number */\n   NUM_ONE: 97,\n   /** Key constant @type Number */\n   NUM_TWO: 98,\n   /** Key constant @type Number */\n   NUM_THREE: 99,\n   /** Key constant @type Number */\n   NUM_FOUR: 100,\n   /** Key constant @type Number */\n   NUM_FIVE: 101,\n   /** Key constant @type Number */\n   NUM_SIX: 102,\n   /** Key constant @type Number */\n   NUM_SEVEN: 103,\n   /** Key constant @type Number */\n   NUM_EIGHT: 104,\n   /** Key constant @type Number */\n   NUM_NINE: 105,\n   /** Key constant @type Number */\n   NUM_MULTIPLY: 106,\n   /** Key constant @type Number */\n   NUM_PLUS: 107,\n   /** Key constant @type Number */\n   NUM_MINUS: 109,\n   /** Key constant @type Number */\n   NUM_PERIOD: 110,\n   /** Key constant @type Number */\n   NUM_DIVISION: 111,\n   /** Key constant @type Number */\n   F1: 112,\n   /** Key constant @type Number */\n   F2: 113,\n   /** Key constant @type Number */\n   F3: 114,\n   /** Key constant @type Number */\n   F4: 115,\n   /** Key constant @type Number */\n   F5: 116,\n   /** Key constant @type Number */\n   F6: 117,\n   /** Key constant @type Number */\n   F7: 118,\n   /** Key constant @type Number */\n   F8: 119,\n   /** Key constant @type Number */\n   F9: 120,\n   /** Key constant @type Number */\n   F10: 121,\n   /** Key constant @type Number */\n   F11: 122,\n   /** Key constant @type Number */\n   F12: 123,\n\n   /** @private */\n   isNavKeyPress : function(){\n       var me = this,\n           k = this.normalizeKey(me.keyCode);\n       return (k >= 33 && k <= 40) ||  // Page Up/Down, End, Home, Left, Up, Right, Down\n       k == me.RETURN ||\n       k == me.TAB ||\n       k == me.ESC;\n   },\n\n   isSpecialKey : function(){\n       var k = this.normalizeKey(this.keyCode);\n       return (this.type == 'keypress' && this.ctrlKey) ||\n       this.isNavKeyPress() ||\n       (k == this.BACKSPACE) || // Backspace\n       (k >= 16 && k <= 20) || // Shift, Ctrl, Alt, Pause, Caps Lock\n       (k >= 44 && k <= 46);   // Print Screen, Insert, Delete\n   },\n\n   getPoint : function(){\n       return new Ext.lib.Point(this.xy[0], this.xy[1]);\n   },\n\n   /**\n    * Returns true if the control, meta, shift or alt key was pressed during this event.\n    * @return {Boolean}\n    */\n   hasModifier : function(){\n       return ((this.ctrlKey || this.altKey) || this.shiftKey);\n   }\n});/**\n * @class Ext.Element\n */\nExt.Element.addMethods({\n    /**\n     * Stops the specified event(s) from bubbling and optionally prevents the default action\n     * @param {String/Array} eventName an event / array of events to stop from bubbling\n     * @param {Boolean} preventDefault (optional) true to prevent the default action too\n     * @return {Ext.Element} this\n     */\n    swallowEvent : function(eventName, preventDefault) {\n        var me = this;\n        function fn(e) {\n            e.stopPropagation();\n            if (preventDefault) {\n                e.preventDefault();\n            }\n        }\n        \n        if (Ext.isArray(eventName)) {\n            Ext.each(eventName, function(e) {\n                 me.on(e, fn);\n            });\n            return me;\n        }\n        me.on(eventName, fn);\n        return me;\n    },\n\n    /**\n     * Create an event handler on this element such that when the event fires and is handled by this element,\n     * it will be relayed to another object (i.e., fired again as if it originated from that object instead).\n     * @param {String} eventName The type of event to relay\n     * @param {Object} object Any object that extends {@link Ext.util.Observable} that will provide the context\n     * for firing the relayed event\n     */\n    relayEvent : function(eventName, observable) {\n        this.on(eventName, function(e) {\n            observable.fireEvent(eventName, e);\n        });\n    },\n\n    /**\n     * Removes worthless text nodes\n     * @param {Boolean} forceReclean (optional) By default the element\n     * keeps track if it has been cleaned already so\n     * you can call this over and over. However, if you update the element and\n     * need to force a reclean, you can pass true.\n     */\n    clean : function(forceReclean) {\n        var me  = this,\n            dom = me.dom,\n            n   = dom.firstChild,\n            ni  = -1;\n\n        if (Ext.Element.data(dom, 'isCleaned') && forceReclean !== true) {\n            return me;\n        }\n\n        while (n) {\n            var nx = n.nextSibling;\n            if (n.nodeType == 3 && !(/\\S/.test(n.nodeValue))) {\n                dom.removeChild(n);\n            } else {\n                n.nodeIndex = ++ni;\n            }\n            n = nx;\n        }\n        \n        Ext.Element.data(dom, 'isCleaned', true);\n        return me;\n    },\n\n    /**\n     * Direct access to the Updater {@link Ext.Updater#update} method. The method takes the same object\n     * parameter as {@link Ext.Updater#update}\n     * @return {Ext.Element} this\n     */\n    load : function() {\n        var updateManager = this.getUpdater();\n        updateManager.update.apply(updateManager, arguments);\n        \n        return this;\n    },\n\n    /**\n    * Gets this element's {@link Ext.Updater Updater}\n    * @return {Ext.Updater} The Updater\n    */\n    getUpdater : function() {\n        return this.updateManager || (this.updateManager = new Ext.Updater(this));\n    },\n\n    /**\n    * Update the innerHTML of this element, optionally searching for and processing scripts\n    * @param {String} html The new HTML\n    * @param {Boolean} loadScripts (optional) True to look for and process scripts (defaults to false)\n    * @param {Function} callback (optional) For async script loading you can be notified when the update completes\n    * @return {Ext.Element} this\n     */\n    update : function(html, loadScripts, callback) {\n        if (!this.dom) {\n            return this;\n        }\n        html = html || \"\";\n\n        if (loadScripts !== true) {\n            this.dom.innerHTML = html;\n            if (typeof callback == 'function') {\n                callback();\n            }\n            return this;\n        }\n\n        var id  = Ext.id(),\n            dom = this.dom;\n\n        html += '<span id=\"' + id + '\"></span>';\n\n        Ext.lib.Event.onAvailable(id, function() {\n            var DOC    = document,\n                hd     = DOC.getElementsByTagName(\"head\")[0],\n                re     = /(?:<script([^>]*)?>)((\\n|\\r|.)*?)(?:<\\/script>)/ig,\n                srcRe  = /\\ssrc=([\\'\\\"])(.*?)\\1/i,\n                typeRe = /\\stype=([\\'\\\"])(.*?)\\1/i,\n                match,\n                attrs,\n                srcMatch,\n                typeMatch,\n                el,\n                s;\n\n            while ((match = re.exec(html))) {\n                attrs = match[1];\n                srcMatch = attrs ? attrs.match(srcRe) : false;\n                if (srcMatch && srcMatch[2]) {\n                   s = DOC.createElement(\"script\");\n                   s.src = srcMatch[2];\n                   typeMatch = attrs.match(typeRe);\n                   if (typeMatch && typeMatch[2]) {\n                       s.type = typeMatch[2];\n                   }\n                   hd.appendChild(s);\n                } else if (match[2] && match[2].length > 0) {\n                    if (window.execScript) {\n                       window.execScript(match[2]);\n                    } else {\n                       window.eval(match[2]);\n                    }\n                }\n            }\n            \n            el = DOC.getElementById(id);\n            if (el) {\n                Ext.removeNode(el);\n            }\n            \n            if (typeof callback == 'function') {\n                callback();\n            }\n        });\n        dom.innerHTML = html.replace(/(?:<script.*?>)((\\n|\\r|.)*?)(?:<\\/script>)/ig, \"\");\n        return this;\n    },\n\n    // inherit docs, overridden so we can add removeAnchor\n    removeAllListeners : function() {\n        this.removeAnchor();\n        Ext.EventManager.removeAll(this.dom);\n        return this;\n    },\n\n    /**\n     * Creates a proxy element of this element\n     * @param {String/Object} config The class name of the proxy element or a DomHelper config object\n     * @param {String/HTMLElement} renderTo (optional) The element or element id to render the proxy to (defaults to document.body)\n     * @param {Boolean} matchBox (optional) True to align and size the proxy to this element now (defaults to false)\n     * @return {Ext.Element} The new proxy element\n     */\n    createProxy : function(config, renderTo, matchBox) {\n        config = (typeof config == 'object') ? config : {tag : \"div\", cls: config};\n\n        var me = this,\n            proxy = renderTo ? Ext.DomHelper.append(renderTo, config, true) :\n                               Ext.DomHelper.insertBefore(me.dom, config, true);\n\n        if (matchBox && me.setBox && me.getBox) { // check to make sure Element.position.js is loaded\n           proxy.setBox(me.getBox());\n        }\n        return proxy;\n    }\n});\n\nExt.Element.prototype.getUpdateManager = Ext.Element.prototype.getUpdater;\n/**\n * @class Ext.Element\n */\nExt.Element.addMethods({\n    /**\n     * Gets the x,y coordinates specified by the anchor position on the element.\n     * @param {String} anchor (optional) The specified anchor position (defaults to \"c\").  See {@link #alignTo}\n     * for details on supported anchor positions.\n     * @param {Boolean} local (optional) True to get the local (element top/left-relative) anchor position instead\n     * of page coordinates\n     * @param {Object} size (optional) An object containing the size to use for calculating anchor position\n     * {width: (target width), height: (target height)} (defaults to the element's current size)\n     * @return {Array} [x, y] An array containing the element's x and y coordinates\n     */\n    getAnchorXY : function(anchor, local, s){\n        //Passing a different size is useful for pre-calculating anchors,\n        //especially for anchored animations that change the el size.\n\t\tanchor = (anchor || \"tl\").toLowerCase();\n        s = s || {};\n        \n        var me = this,        \n        \tvp = me.dom == document.body || me.dom == document,\n        \tw = s.width || vp ? Ext.lib.Dom.getViewWidth() : me.getWidth(),\n        \th = s.height || vp ? Ext.lib.Dom.getViewHeight() : me.getHeight(),         \t        \t\n        \txy,       \t\n        \tr = Math.round,\n        \to = me.getXY(),\n        \tscroll = me.getScroll(),\n        \textraX = vp ? scroll.left : !local ? o[0] : 0,\n        \textraY = vp ? scroll.top : !local ? o[1] : 0,\n        \thash = {\n\t        \tc  : [r(w * 0.5), r(h * 0.5)],\n\t        \tt  : [r(w * 0.5), 0],\n\t        \tl  : [0, r(h * 0.5)],\n\t        \tr  : [w, r(h * 0.5)],\n\t        \tb  : [r(w * 0.5), h],\n\t        \ttl : [0, 0],\t\n\t        \tbl : [0, h],\n\t        \tbr : [w, h],\n\t        \ttr : [w, 0]\n        \t};\n        \n        xy = hash[anchor];\t\n        return [xy[0] + extraX, xy[1] + extraY]; \n    },\n\n    /**\n     * Anchors an element to another element and realigns it when the window is resized.\n     * @param {Mixed} element The element to align to.\n     * @param {String} position The position to align to.\n     * @param {Array} offsets (optional) Offset the positioning by [x, y]\n     * @param {Boolean/Object} animate (optional) True for the default animation or a standard Element animation config object\n     * @param {Boolean/Number} monitorScroll (optional) True to monitor body scroll and reposition. If this parameter\n     * is a number, it is used as the buffer delay (defaults to 50ms).\n     * @param {Function} callback (optional) The function to call after the animation finishes\n     * @return {Ext.Element} this\n     */\n    anchorTo : function(el, alignment, offsets, animate, monitorScroll, callback){        \n\t    var me = this,\n            dom = me.dom,\n            scroll = !Ext.isEmpty(monitorScroll),\n            action = function(){\n                Ext.fly(dom).alignTo(el, alignment, offsets, animate);\n                Ext.callback(callback, Ext.fly(dom));\n            },\n            anchor = this.getAnchor();\n            \n        // previous listener anchor, remove it\n        this.removeAnchor();\n        Ext.apply(anchor, {\n            fn: action,\n            scroll: scroll\n        });\n\n        Ext.EventManager.onWindowResize(action, null);\n        \n        if(scroll){\n            Ext.EventManager.on(window, 'scroll', action, null,\n                {buffer: !isNaN(monitorScroll) ? monitorScroll : 50});\n        }\n        action.call(me); // align immediately\n        return me;\n    },\n    \n    /**\n     * Remove any anchor to this element. See {@link #anchorTo}.\n     * @return {Ext.Element} this\n     */\n    removeAnchor : function(){\n        var me = this,\n            anchor = this.getAnchor();\n            \n        if(anchor && anchor.fn){\n            Ext.EventManager.removeResizeListener(anchor.fn);\n            if(anchor.scroll){\n                Ext.EventManager.un(window, 'scroll', anchor.fn);\n            }\n            delete anchor.fn;\n        }\n        return me;\n    },\n    \n    // private\n    getAnchor : function(){\n        var data = Ext.Element.data,\n            dom = this.dom;\n            if (!dom) {\n                return;\n            }\n            var anchor = data(dom, '_anchor');\n            \n        if(!anchor){\n            anchor = data(dom, '_anchor', {});\n        }\n        return anchor;\n    },\n\n    /**\n     * Gets the x,y coordinates to align this element with another element. See {@link #alignTo} for more info on the\n     * supported position values.\n     * @param {Mixed} element The element to align to.\n     * @param {String} position (optional, defaults to \"tl-bl?\") The position to align to.\n     * @param {Array} offsets (optional) Offset the positioning by [x, y]\n     * @return {Array} [x, y]\n     */\n    getAlignToXY : function(el, p, o){\t    \n        el = Ext.get(el);\n        \n        if(!el || !el.dom){\n            throw \"Element.alignToXY with an element that doesn't exist\";\n        }\n        \n        o = o || [0,0];\n        p = (!p || p == \"?\" ? \"tl-bl?\" : (!(/-/).test(p) && p !== \"\" ? \"tl-\" + p : p || \"tl-bl\")).toLowerCase();       \n                \n        var me = this,\n        \td = me.dom,\n        \ta1,\n        \ta2,\n        \tx,\n        \ty,\n        \t//constrain the aligned el to viewport if necessary\n        \tw,\n        \th,\n        \tr,\n        \tdw = Ext.lib.Dom.getViewWidth() -10, // 10px of margin for ie\n        \tdh = Ext.lib.Dom.getViewHeight()-10, // 10px of margin for ie\n        \tp1y,\n        \tp1x,        \t\n        \tp2y,\n        \tp2x,\n        \tswapY,\n        \tswapX,\n        \tdoc = document,\n        \tdocElement = doc.documentElement,\n        \tdocBody = doc.body,\n        \tscrollX = (docElement.scrollLeft || docBody.scrollLeft || 0)+5,\n        \tscrollY = (docElement.scrollTop || docBody.scrollTop || 0)+5,\n        \tc = false, //constrain to viewport\n        \tp1 = \"\", \n        \tp2 = \"\",\n        \tm = p.match(/^([a-z]+)-([a-z]+)(\\?)?$/);\n        \n        if(!m){\n           throw \"Element.alignTo with an invalid alignment \" + p;\n        }\n        \n        p1 = m[1]; \n        p2 = m[2]; \n        c = !!m[3];\n\n        //Subtract the aligned el's internal xy from the target's offset xy\n        //plus custom offset to get the aligned el's new offset xy\n        a1 = me.getAnchorXY(p1, true);\n        a2 = el.getAnchorXY(p2, false);\n\n        x = a2[0] - a1[0] + o[0];\n        y = a2[1] - a1[1] + o[1];\n\n        if(c){    \n\t       w = me.getWidth();\n           h = me.getHeight();\n           r = el.getRegion();       \n           //If we are at a viewport boundary and the aligned el is anchored on a target border that is\n           //perpendicular to the vp border, allow the aligned el to slide on that border,\n           //otherwise swap the aligned el to the opposite border of the target.\n           p1y = p1.charAt(0);\n           p1x = p1.charAt(p1.length-1);\n           p2y = p2.charAt(0);\n           p2x = p2.charAt(p2.length-1);\n           swapY = ((p1y==\"t\" && p2y==\"b\") || (p1y==\"b\" && p2y==\"t\"));\n           swapX = ((p1x==\"r\" && p2x==\"l\") || (p1x==\"l\" && p2x==\"r\"));          \n           \n\n           if (x + w > dw + scrollX) {\n                x = swapX ? r.left-w : dw+scrollX-w;\n           }\n           if (x < scrollX) {\n               x = swapX ? r.right : scrollX;\n           }\n           if (y + h > dh + scrollY) {\n                y = swapY ? r.top-h : dh+scrollY-h;\n            }\n           if (y < scrollY){\n               y = swapY ? r.bottom : scrollY;\n           }\n        }\n        return [x,y];\n    },\n\n    /**\n     * Aligns this element with another element relative to the specified anchor points. If the other element is the\n     * document it aligns it to the viewport.\n     * The position parameter is optional, and can be specified in any one of the following formats:\n     * <ul>\n     *   <li><b>Blank</b>: Defaults to aligning the element's top-left corner to the target's bottom-left corner (\"tl-bl\").</li>\n     *   <li><b>One anchor (deprecated)</b>: The passed anchor position is used as the target element's anchor point.\n     *       The element being aligned will position its top-left corner (tl) to that point.  <i>This method has been\n     *       deprecated in favor of the newer two anchor syntax below</i>.</li>\n     *   <li><b>Two anchors</b>: If two values from the table below are passed separated by a dash, the first value is used as the\n     *       element's anchor point, and the second value is used as the target's anchor point.</li>\n     * </ul>\n     * In addition to the anchor points, the position parameter also supports the \"?\" character.  If \"?\" is passed at the end of\n     * the position string, the element will attempt to align as specified, but the position will be adjusted to constrain to\n     * the viewport if necessary.  Note that the element being aligned might be swapped to align to a different position than\n     * that specified in order to enforce the viewport constraints.\n     * Following are all of the supported anchor positions:\n<pre>\nValue  Description\n-----  -----------------------------\ntl     The top left corner (default)\nt      The center of the top edge\ntr     The top right corner\nl      The center of the left edge\nc      In the center of the element\nr      The center of the right edge\nbl     The bottom left corner\nb      The center of the bottom edge\nbr     The bottom right corner\n</pre>\nExample Usage:\n<pre><code>\n// align el to other-el using the default positioning (\"tl-bl\", non-constrained)\nel.alignTo(\"other-el\");\n\n// align the top left corner of el with the top right corner of other-el (constrained to viewport)\nel.alignTo(\"other-el\", \"tr?\");\n\n// align the bottom right corner of el with the center left edge of other-el\nel.alignTo(\"other-el\", \"br-l?\");\n\n// align the center of el with the bottom left corner of other-el and\n// adjust the x position by -6 pixels (and the y position by 0)\nel.alignTo(\"other-el\", \"c-bl\", [-6, 0]);\n</code></pre>\n     * @param {Mixed} element The element to align to.\n     * @param {String} position (optional, defaults to \"tl-bl?\") The position to align to.\n     * @param {Array} offsets (optional) Offset the positioning by [x, y]\n     * @param {Boolean/Object} animate (optional) true for the default animation or a standard Element animation config object\n     * @return {Ext.Element} this\n     */\n    alignTo : function(element, position, offsets, animate){\n\t    var me = this;\n        return me.setXY(me.getAlignToXY(element, position, offsets),\n          \t\t        me.preanim && !!animate ? me.preanim(arguments, 3) : false);\n    },\n    \n    // private ==>  used outside of core\n    adjustForConstraints : function(xy, parent, offsets){\n        return this.getConstrainToXY(parent || document, false, offsets, xy) ||  xy;\n    },\n\n    // private ==>  used outside of core\n    getConstrainToXY : function(el, local, offsets, proposedXY){   \n\t    var os = {top:0, left:0, bottom:0, right: 0};\n\n        return function(el, local, offsets, proposedXY){\n            el = Ext.get(el);\n            offsets = offsets ? Ext.applyIf(offsets, os) : os;\n\n            var vw, vh, vx = 0, vy = 0;\n            if(el.dom == document.body || el.dom == document){\n                vw =Ext.lib.Dom.getViewWidth();\n                vh = Ext.lib.Dom.getViewHeight();\n            }else{\n                vw = el.dom.clientWidth;\n                vh = el.dom.clientHeight;\n                if(!local){\n                    var vxy = el.getXY();\n                    vx = vxy[0];\n                    vy = vxy[1];\n                }\n            }\n\n            var s = el.getScroll();\n\n            vx += offsets.left + s.left;\n            vy += offsets.top + s.top;\n\n            vw -= offsets.right;\n            vh -= offsets.bottom;\n\n            var vr = vx + vw,\n                vb = vy + vh,\n                xy = proposedXY || (!local ? this.getXY() : [this.getLeft(true), this.getTop(true)]),\n                x = xy[0], y = xy[1],\n                offset = this.getConstrainOffset(),\n                w = this.dom.offsetWidth + offset, \n                h = this.dom.offsetHeight + offset;\n\n            // only move it if it needs it\n            var moved = false;\n\n            // first validate right/bottom\n            if((x + w) > vr){\n                x = vr - w;\n                moved = true;\n            }\n            if((y + h) > vb){\n                y = vb - h;\n                moved = true;\n            }\n            // then make sure top/left isn't negative\n            if(x < vx){\n                x = vx;\n                moved = true;\n            }\n            if(y < vy){\n                y = vy;\n                moved = true;\n            }\n            return moved ? [x, y] : false;\n        };\n    }(),\n\t    \n\t    \n\t        \n//         el = Ext.get(el);\n//         offsets = Ext.applyIf(offsets || {}, {top : 0, left : 0, bottom : 0, right : 0});\n\n//         var\tme = this,\n//         \tdoc = document,\n//         \ts = el.getScroll(),\n//         \tvxy = el.getXY(),\n//         \tvx = offsets.left + s.left, \n//         \tvy = offsets.top + s.top,            \t\n//         \tvw = -offsets.right, \n//         \tvh = -offsets.bottom, \n//         \tvr,\n//         \tvb,\n//         \txy = proposedXY || (!local ? me.getXY() : [me.getLeft(true), me.getTop(true)]),\n//         \tx = xy[0],\n//         \ty = xy[1],\n//         \tw = me.dom.offsetWidth, h = me.dom.offsetHeight,\n//         \tmoved = false; // only move it if it needs it\n//       \n//         \t\n//         if(el.dom == doc.body || el.dom == doc){\n//             vw += Ext.lib.Dom.getViewWidth();\n//             vh += Ext.lib.Dom.getViewHeight();\n//         }else{\n//             vw += el.dom.clientWidth;\n//             vh += el.dom.clientHeight;\n//             if(!local){                    \n//                 vx += vxy[0];\n//                 vy += vxy[1];\n//             }\n//         }\n\n//         // first validate right/bottom\n//         if(x + w > vx + vw){\n//             x = vx + vw - w;\n//             moved = true;\n//         }\n//         if(y + h > vy + vh){\n//             y = vy + vh - h;\n//             moved = true;\n//         }\n//         // then make sure top/left isn't negative\n//         if(x < vx){\n//             x = vx;\n//             moved = true;\n//         }\n//         if(y < vy){\n//             y = vy;\n//             moved = true;\n//         }\n//         return moved ? [x, y] : false;\n//    },\n\n    // private, used internally\n    getConstrainOffset : function(){\n        return 0;\n    },\n    \n    /**\n    * Calculates the x, y to center this element on the screen\n    * @return {Array} The x, y values [x, y]\n    */\n    getCenterXY : function(){\n        return this.getAlignToXY(document, 'c-c');\n    },\n\n    /**\n    * Centers the Element in either the viewport, or another Element.\n    * @param {Mixed} centerIn (optional) The element in which to center the element.\n    */\n    center : function(centerIn){\n        return this.alignTo(centerIn || document, 'c-c');        \n    }    \n});\n/**\n * @class Ext.Element\n */\nExt.Element.addMethods({\n    /**\n     * Creates a {@link Ext.CompositeElement} for child nodes based on the passed CSS selector (the selector should not contain an id).\n     * @param {String} selector The CSS selector\n     * @param {Boolean} unique (optional) True to create a unique Ext.Element for each child (defaults to false, which creates a single shared flyweight object)\n     * @return {CompositeElement/CompositeElementLite} The composite element\n     */\n    select : function(selector, unique){\n        return Ext.Element.select(selector, unique, this.dom);\n    }\n});/**\n * @class Ext.Element\n */\nExt.apply(Ext.Element.prototype, function() {\n\tvar GETDOM = Ext.getDom,\n\t\tGET = Ext.get,\n\t\tDH = Ext.DomHelper;\n\t\n\treturn {\t\n\t\t/**\n\t     * Inserts (or creates) the passed element (or DomHelper config) as a sibling of this element\n\t     * @param {Mixed/Object/Array} el The id, element to insert or a DomHelper config to create and insert *or* an array of any of those.\n\t     * @param {String} where (optional) 'before' or 'after' defaults to before\n\t     * @param {Boolean} returnDom (optional) True to return the raw DOM element instead of Ext.Element\n\t     * @return {Ext.Element} The inserted Element. If an array is passed, the last inserted element is returned.\n\t     */\n\t    insertSibling: function(el, where, returnDom){\n\t        var me = this,\n\t        \trt,\n                isAfter = (where || 'before').toLowerCase() == 'after',\n                insertEl;\n\t        \t\n\t        if(Ext.isArray(el)){\n                insertEl = me;\n\t            Ext.each(el, function(e) {\n\t\t            rt = Ext.fly(insertEl, '_internal').insertSibling(e, where, returnDom);\n                    if(isAfter){\n                        insertEl = rt;\n                    }\n\t            });\n\t            return rt;\n\t        }\n\t                \n\t        el = el || {};\n\t       \t\n            if(el.nodeType || el.dom){\n                rt = me.dom.parentNode.insertBefore(GETDOM(el), isAfter ? me.dom.nextSibling : me.dom);\n                if (!returnDom) {\n                    rt = GET(rt);\n                }\n            }else{\n                if (isAfter && !me.dom.nextSibling) {\n                    rt = DH.append(me.dom.parentNode, el, !returnDom);\n                } else {                    \n                    rt = DH[isAfter ? 'insertAfter' : 'insertBefore'](me.dom, el, !returnDom);\n                }\n            }\n\t        return rt;\n\t    }\n    };\n}());/**\n * @class Ext.Element\n */\n\n// special markup used throughout Ext when box wrapping elements\nExt.Element.boxMarkup = '<div class=\"{0}-tl\"><div class=\"{0}-tr\"><div class=\"{0}-tc\"></div></div></div><div class=\"{0}-ml\"><div class=\"{0}-mr\"><div class=\"{0}-mc\"></div></div></div><div class=\"{0}-bl\"><div class=\"{0}-br\"><div class=\"{0}-bc\"></div></div></div>';\n\nExt.Element.addMethods(function(){\n    var INTERNAL = \"_internal\",\n        pxMatch = /(\\d+\\.?\\d+)px/;\n    return {\n        /**\n         * More flexible version of {@link #setStyle} for setting style properties.\n         * @param {String/Object/Function} styles A style specification string, e.g. \"width:100px\", or object in the form {width:\"100px\"}, or\n         * a function which returns such a specification.\n         * @return {Ext.Element} this\n         */\n        applyStyles : function(style){\n            Ext.DomHelper.applyStyles(this.dom, style);\n            return this;\n        },\n\n        /**\n         * Returns an object with properties matching the styles requested.\n         * For example, el.getStyles('color', 'font-size', 'width') might return\n         * {'color': '#FFFFFF', 'font-size': '13px', 'width': '100px'}.\n         * @param {String} style1 A style name\n         * @param {String} style2 A style name\n         * @param {String} etc.\n         * @return {Object} The style object\n         */\n        getStyles : function(){\n            var ret = {};\n            Ext.each(arguments, function(v) {\n               ret[v] = this.getStyle(v);\n            },\n            this);\n            return ret;\n        },\n\n        // private  ==> used by ext full\n        setOverflow : function(v){\n            var dom = this.dom;\n            if(v=='auto' && Ext.isMac && Ext.isGecko2){ // work around stupid FF 2.0/Mac scroll bar bug\n                dom.style.overflow = 'hidden';\n                (function(){dom.style.overflow = 'auto';}).defer(1);\n            }else{\n                dom.style.overflow = v;\n            }\n        },\n\n       /**\n        * <p>Wraps the specified element with a special 9 element markup/CSS block that renders by default as\n        * a gray container with a gradient background, rounded corners and a 4-way shadow.</p>\n        * <p>This special markup is used throughout Ext when box wrapping elements ({@link Ext.Button},\n        * {@link Ext.Panel} when <tt>{@link Ext.Panel#frame frame=true}</tt>, {@link Ext.Window}).  The markup\n        * is of this form:</p>\n        * <pre><code>\n    Ext.Element.boxMarkup =\n    &#39;&lt;div class=\"{0}-tl\">&lt;div class=\"{0}-tr\">&lt;div class=\"{0}-tc\">&lt;/div>&lt;/div>&lt;/div>\n     &lt;div class=\"{0}-ml\">&lt;div class=\"{0}-mr\">&lt;div class=\"{0}-mc\">&lt;/div>&lt;/div>&lt;/div>\n     &lt;div class=\"{0}-bl\">&lt;div class=\"{0}-br\">&lt;div class=\"{0}-bc\">&lt;/div>&lt;/div>&lt;/div>&#39;;\n        * </code></pre>\n        * <p>Example usage:</p>\n        * <pre><code>\n    // Basic box wrap\n    Ext.get(\"foo\").boxWrap();\n\n    // You can also add a custom class and use CSS inheritance rules to customize the box look.\n    // 'x-box-blue' is a built-in alternative -- look at the related CSS definitions as an example\n    // for how to create a custom box wrap style.\n    Ext.get(\"foo\").boxWrap().addClass(\"x-box-blue\");\n        * </code></pre>\n        * @param {String} class (optional) A base CSS class to apply to the containing wrapper element\n        * (defaults to <tt>'x-box'</tt>). Note that there are a number of CSS rules that are dependent on\n        * this name to make the overall effect work, so if you supply an alternate base class, make sure you\n        * also supply all of the necessary rules.\n        * @return {Ext.Element} The outermost wrapping element of the created box structure.\n        */\n        boxWrap : function(cls){\n            cls = cls || 'x-box';\n            var el = Ext.get(this.insertHtml(\"beforeBegin\", \"<div class='\" + cls + \"'>\" + String.format(Ext.Element.boxMarkup, cls) + \"</div>\"));        //String.format('<div class=\"{0}\">'+Ext.Element.boxMarkup+'</div>', cls)));\n            Ext.DomQuery.selectNode('.' + cls + '-mc', el.dom).appendChild(this.dom);\n            return el;\n        },\n\n        /**\n         * Set the size of this Element. If animation is true, both width and height will be animated concurrently.\n         * @param {Mixed} width The new width. This may be one of:<div class=\"mdetail-params\"><ul>\n         * <li>A Number specifying the new width in this Element's {@link #defaultUnit}s (by default, pixels).</li>\n         * <li>A String used to set the CSS width style. Animation may <b>not</b> be used.\n         * <li>A size object in the format <code>{width: widthValue, height: heightValue}</code>.</li>\n         * </ul></div>\n         * @param {Mixed} height The new height. This may be one of:<div class=\"mdetail-params\"><ul>\n         * <li>A Number specifying the new height in this Element's {@link #defaultUnit}s (by default, pixels).</li>\n         * <li>A String used to set the CSS height style. Animation may <b>not</b> be used.</li>\n         * </ul></div>\n         * @param {Boolean/Object} animate (optional) true for the default animation or a standard Element animation config object\n         * @return {Ext.Element} this\n         */\n        setSize : function(width, height, animate){\n            var me = this;\n            if(typeof width == 'object'){ // in case of object from getSize()\n                height = width.height;\n                width = width.width;\n            }\n            width = me.adjustWidth(width);\n            height = me.adjustHeight(height);\n            if(!animate || !me.anim){\n                me.dom.style.width = me.addUnits(width);\n                me.dom.style.height = me.addUnits(height);\n            }else{\n                me.anim({width: {to: width}, height: {to: height}}, me.preanim(arguments, 2));\n            }\n            return me;\n        },\n\n        /**\n         * Returns either the offsetHeight or the height of this element based on CSS height adjusted by padding or borders\n         * when needed to simulate offsetHeight when offsets aren't available. This may not work on display:none elements\n         * if a height has not been set using CSS.\n         * @return {Number}\n         */\n        getComputedHeight : function(){\n            var me = this,\n                h = Math.max(me.dom.offsetHeight, me.dom.clientHeight);\n            if(!h){\n                h = parseFloat(me.getStyle('height')) || 0;\n                if(!me.isBorderBox()){\n                    h += me.getFrameWidth('tb');\n                }\n            }\n            return h;\n        },\n\n        /**\n         * Returns either the offsetWidth or the width of this element based on CSS width adjusted by padding or borders\n         * when needed to simulate offsetWidth when offsets aren't available. This may not work on display:none elements\n         * if a width has not been set using CSS.\n         * @return {Number}\n         */\n        getComputedWidth : function(){\n            var w = Math.max(this.dom.offsetWidth, this.dom.clientWidth);\n            if(!w){\n                w = parseFloat(this.getStyle('width')) || 0;\n                if(!this.isBorderBox()){\n                    w += this.getFrameWidth('lr');\n                }\n            }\n            return w;\n        },\n\n        /**\n         * Returns the sum width of the padding and borders for the passed \"sides\". See getBorderWidth()\n         for more information about the sides.\n         * @param {String} sides\n         * @return {Number}\n         */\n        getFrameWidth : function(sides, onlyContentBox){\n            return onlyContentBox && this.isBorderBox() ? 0 : (this.getPadding(sides) + this.getBorderWidth(sides));\n        },\n\n        /**\n         * Sets up event handlers to add and remove a css class when the mouse is over this element\n         * @param {String} className\n         * @return {Ext.Element} this\n         */\n        addClassOnOver : function(className){\n            this.hover(\n                function(){\n                    Ext.fly(this, INTERNAL).addClass(className);\n                },\n                function(){\n                    Ext.fly(this, INTERNAL).removeClass(className);\n                }\n            );\n            return this;\n        },\n\n        /**\n         * Sets up event handlers to add and remove a css class when this element has the focus\n         * @param {String} className\n         * @return {Ext.Element} this\n         */\n        addClassOnFocus : function(className){\n            this.on(\"focus\", function(){\n                Ext.fly(this, INTERNAL).addClass(className);\n            }, this.dom);\n            this.on(\"blur\", function(){\n                Ext.fly(this, INTERNAL).removeClass(className);\n            }, this.dom);\n            return this;\n        },\n\n        /**\n         * Sets up event handlers to add and remove a css class when the mouse is down and then up on this element (a click effect)\n         * @param {String} className\n         * @return {Ext.Element} this\n         */\n        addClassOnClick : function(className){\n            var dom = this.dom;\n            this.on(\"mousedown\", function(){\n                Ext.fly(dom, INTERNAL).addClass(className);\n                var d = Ext.getDoc(),\n                    fn = function(){\n                        Ext.fly(dom, INTERNAL).removeClass(className);\n                        d.removeListener(\"mouseup\", fn);\n                    };\n                d.on(\"mouseup\", fn);\n            });\n            return this;\n        },\n\n        /**\n         * <p>Returns the dimensions of the element available to lay content out in.<p>\n         * <p>If the element (or any ancestor element) has CSS style <code>display : none</code>, the dimensions will be zero.</p>\n         * example:<pre><code>\n        var vpSize = Ext.getBody().getViewSize();\n\n        // all Windows created afterwards will have a default value of 90% height and 95% width\n        Ext.Window.override({\n            width: vpSize.width * 0.9,\n            height: vpSize.height * 0.95\n        });\n        // To handle window resizing you would have to hook onto onWindowResize.\n        * </code></pre>\n        *\n        * getViewSize utilizes clientHeight/clientWidth which excludes sizing of scrollbars.\n        * To obtain the size including scrollbars, use getStyleSize\n        *\n        * Sizing of the document body is handled at the adapter level which handles special cases for IE and strict modes, etc.\n        */\n\n        getViewSize : function(){\n            var doc = document,\n                d = this.dom,\n                isDoc = (d == doc || d == doc.body);\n\n            // If the body, use Ext.lib.Dom\n            if (isDoc) {\n                var extdom = Ext.lib.Dom;\n                return {\n                    width : extdom.getViewWidth(),\n                    height : extdom.getViewHeight()\n                };\n\n            // Else use clientHeight/clientWidth\n            } else {\n                return {\n                    width : d.clientWidth,\n                    height : d.clientHeight\n                };\n            }\n        },\n\n        /**\n        * <p>Returns the dimensions of the element available to lay content out in.<p>\n        *\n        * getStyleSize utilizes prefers style sizing if present, otherwise it chooses the larger of offsetHeight/clientHeight and offsetWidth/clientWidth.\n        * To obtain the size excluding scrollbars, use getViewSize\n        *\n        * Sizing of the document body is handled at the adapter level which handles special cases for IE and strict modes, etc.\n        */\n\n        getStyleSize : function(){\n            var me = this,\n                w, h,\n                doc = document,\n                d = this.dom,\n                isDoc = (d == doc || d == doc.body),\n                s = d.style;\n\n            // If the body, use Ext.lib.Dom\n            if (isDoc) {\n                var extdom = Ext.lib.Dom;\n                return {\n                    width : extdom.getViewWidth(),\n                    height : extdom.getViewHeight()\n                };\n            }\n            // Use Styles if they are set\n            if(s.width && s.width != 'auto'){\n                w = parseFloat(s.width);\n                if(me.isBorderBox()){\n                   w -= me.getFrameWidth('lr');\n                }\n            }\n            // Use Styles if they are set\n            if(s.height && s.height != 'auto'){\n                h = parseFloat(s.height);\n                if(me.isBorderBox()){\n                   h -= me.getFrameWidth('tb');\n                }\n            }\n            // Use getWidth/getHeight if style not set.\n            return {width: w || me.getWidth(true), height: h || me.getHeight(true)};\n        },\n\n        /**\n         * Returns the size of the element.\n         * @param {Boolean} contentSize (optional) true to get the width/size minus borders and padding\n         * @return {Object} An object containing the element's size {width: (element width), height: (element height)}\n         */\n        getSize : function(contentSize){\n            return {width: this.getWidth(contentSize), height: this.getHeight(contentSize)};\n        },\n\n        /**\n         * Forces the browser to repaint this element\n         * @return {Ext.Element} this\n         */\n        repaint : function(){\n            var dom = this.dom;\n            this.addClass(\"x-repaint\");\n            setTimeout(function(){\n                Ext.fly(dom).removeClass(\"x-repaint\");\n            }, 1);\n            return this;\n        },\n\n        /**\n         * Disables text selection for this element (normalized across browsers)\n         * @return {Ext.Element} this\n         */\n        unselectable : function(){\n            this.dom.unselectable = \"on\";\n            return this.swallowEvent(\"selectstart\", true).\n                        addClass(\"x-unselectable\");\n        },\n\n        /**\n         * Returns an object with properties top, left, right and bottom representing the margins of this element unless sides is passed,\n         * then it returns the calculated width of the sides (see getPadding)\n         * @param {String} sides (optional) Any combination of l, r, t, b to get the sum of those sides\n         * @return {Object/Number}\n         */\n        getMargins : function(side){\n            var me = this,\n                key,\n                hash = {t:\"top\", l:\"left\", r:\"right\", b: \"bottom\"},\n                o = {};\n\n            if (!side) {\n                for (key in me.margins){\n                    o[hash[key]] = parseFloat(me.getStyle(me.margins[key])) || 0;\n                }\n                return o;\n            } else {\n                return me.addStyles.call(me, side, me.margins);\n            }\n        }\n    };\n}());\n/**\n * @class Ext.Element\n */\nExt.Element.addMethods({\n    /**\n     * Sets the element's box. Use getBox() on another element to get a box obj. If animate is true then width, height, x and y will be animated concurrently.\n     * @param {Object} box The box to fill {x, y, width, height}\n     * @param {Boolean} adjust (optional) Whether to adjust for box-model issues automatically\n     * @param {Boolean/Object} animate (optional) true for the default animation or a standard Element animation config object\n     * @return {Ext.Element} this\n     */\n    setBox : function(box, adjust, animate){\n        var me = this,\n        \tw = box.width, \n        \th = box.height;\n        if((adjust && !me.autoBoxAdjust) && !me.isBorderBox()){\n           w -= (me.getBorderWidth(\"lr\") + me.getPadding(\"lr\"));\n           h -= (me.getBorderWidth(\"tb\") + me.getPadding(\"tb\"));\n        }\n        me.setBounds(box.x, box.y, w, h, me.animTest.call(me, arguments, animate, 2));\n        return me;\n    },\n\n    /**\n     * Return an object defining the area of this Element which can be passed to {@link #setBox} to\n     * set another Element's size/location to match this element.\n     * @param {Boolean} contentBox (optional) If true a box for the content of the element is returned.\n     * @param {Boolean} local (optional) If true the element's left and top are returned instead of page x/y.\n     * @return {Object} box An object in the format<pre><code>\n{\n    x: &lt;Element's X position>,\n    y: &lt;Element's Y position>,\n    width: &lt;Element's width>,\n    height: &lt;Element's height>,\n    bottom: &lt;Element's lower bound>,\n    right: &lt;Element's rightmost bound>\n}\n</code></pre>\n     * The returned object may also be addressed as an Array where index 0 contains the X position\n     * and index 1 contains the Y position. So the result may also be used for {@link #setXY}\n     */\n\tgetBox : function(contentBox, local) {\t    \n\t    var me = this,\n        \txy,\n        \tleft,\n        \ttop,\n        \tgetBorderWidth = me.getBorderWidth,\n        \tgetPadding = me.getPadding, \n        \tl,\n        \tr,\n        \tt,\n        \tb;\n        if(!local){\n            xy = me.getXY();\n        }else{\n            left = parseInt(me.getStyle(\"left\"), 10) || 0;\n            top = parseInt(me.getStyle(\"top\"), 10) || 0;\n            xy = [left, top];\n        }\n        var el = me.dom, w = el.offsetWidth, h = el.offsetHeight, bx;\n        if(!contentBox){\n            bx = {x: xy[0], y: xy[1], 0: xy[0], 1: xy[1], width: w, height: h};\n        }else{\n            l = getBorderWidth.call(me, \"l\") + getPadding.call(me, \"l\");\n            r = getBorderWidth.call(me, \"r\") + getPadding.call(me, \"r\");\n            t = getBorderWidth.call(me, \"t\") + getPadding.call(me, \"t\");\n            b = getBorderWidth.call(me, \"b\") + getPadding.call(me, \"b\");\n            bx = {x: xy[0]+l, y: xy[1]+t, 0: xy[0]+l, 1: xy[1]+t, width: w-(l+r), height: h-(t+b)};\n        }\n        bx.right = bx.x + bx.width;\n        bx.bottom = bx.y + bx.height;\n        return bx;\n\t},\n\t\n    /**\n     * Move this element relative to its current position.\n     * @param {String} direction Possible values are: \"l\" (or \"left\"), \"r\" (or \"right\"), \"t\" (or \"top\", or \"up\"), \"b\" (or \"bottom\", or \"down\").\n     * @param {Number} distance How far to move the element in pixels\n     * @param {Boolean/Object} animate (optional) true for the default animation or a standard Element animation config object\n     * @return {Ext.Element} this\n     */\n     move : function(direction, distance, animate){\n        var me = this,        \t\n        \txy = me.getXY(),\n        \tx = xy[0],\n        \ty = xy[1],        \t\n        \tleft = [x - distance, y],\n        \tright = [x + distance, y],\n        \ttop = [x, y - distance],\n        \tbottom = [x, y + distance],\n\t       \thash = {\n\t        \tl :\tleft,\n\t        \tleft : left,\n\t        \tr : right,\n\t        \tright : right,\n\t        \tt : top,\n\t        \ttop : top,\n\t        \tup : top,\n\t        \tb : bottom, \n\t        \tbottom : bottom,\n\t        \tdown : bottom\t        \t\t\n\t        };\n        \n \t    direction = direction.toLowerCase();    \n \t    me.moveTo(hash[direction][0], hash[direction][1], me.animTest.call(me, arguments, animate, 2));\n    },\n    \n    /**\n     * Quick set left and top adding default units\n     * @param {String} left The left CSS property value\n     * @param {String} top The top CSS property value\n     * @return {Ext.Element} this\n     */\n     setLeftTop : function(left, top){\n\t    var me = this,\n\t    \tstyle = me.dom.style;\n        style.left = me.addUnits(left);\n        style.top = me.addUnits(top);\n        return me;\n    },\n    \n    /**\n     * Returns the region of the given element.\n     * The element must be part of the DOM tree to have a region (display:none or elements not appended return false).\n     * @return {Region} A Ext.lib.Region containing \"top, left, bottom, right\" member data.\n     */\n    getRegion : function(){\n        return Ext.lib.Dom.getRegion(this.dom);\n    },\n    \n    /**\n     * Sets the element's position and size in one shot. If animation is true then width, height, x and y will be animated concurrently.\n     * @param {Number} x X value for new position (coordinates are page-based)\n     * @param {Number} y Y value for new position (coordinates are page-based)\n     * @param {Mixed} width The new width. This may be one of:<div class=\"mdetail-params\"><ul>\n     * <li>A Number specifying the new width in this Element's {@link #defaultUnit}s (by default, pixels)</li>\n     * <li>A String used to set the CSS width style. Animation may <b>not</b> be used.\n     * </ul></div>\n     * @param {Mixed} height The new height. This may be one of:<div class=\"mdetail-params\"><ul>\n     * <li>A Number specifying the new height in this Element's {@link #defaultUnit}s (by default, pixels)</li>\n     * <li>A String used to set the CSS height style. Animation may <b>not</b> be used.</li>\n     * </ul></div>\n     * @param {Boolean/Object} animate (optional) true for the default animation or a standard Element animation config object\n     * @return {Ext.Element} this\n     */\n    setBounds : function(x, y, width, height, animate){\n\t    var me = this;\n        if (!animate || !me.anim) {\n            me.setSize(width, height);\n            me.setLocation(x, y);\n        } else {\n            me.anim({points: {to: [x, y]}, \n            \t\t width: {to: me.adjustWidth(width)}, \n            \t\t height: {to: me.adjustHeight(height)}},\n                     me.preanim(arguments, 4), \n                     'motion');\n        }\n        return me;\n    },\n\n    /**\n     * Sets the element's position and size the specified region. If animation is true then width, height, x and y will be animated concurrently.\n     * @param {Ext.lib.Region} region The region to fill\n     * @param {Boolean/Object} animate (optional) true for the default animation or a standard Element animation config object\n     * @return {Ext.Element} this\n     */\n    setRegion : function(region, animate) {\n        return this.setBounds(region.left, region.top, region.right-region.left, region.bottom-region.top, this.animTest.call(this, arguments, animate, 1));\n    }\n});/**\n * @class Ext.Element\n */\nExt.Element.addMethods({\n    /**\n     * Scrolls this element the specified scroll point. It does NOT do bounds checking so if you scroll to a weird value it will try to do it. For auto bounds checking, use scroll().\n     * @param {String} side Either \"left\" for scrollLeft values or \"top\" for scrollTop values.\n     * @param {Number} value The new scroll value\n     * @param {Boolean/Object} animate (optional) true for the default animation or a standard Element animation config object\n     * @return {Element} this\n     */\n    scrollTo : function(side, value, animate) {\n        //check if we're scrolling top or left\n        var top = /top/i.test(side),\n            me = this,\n            dom = me.dom,\n            prop;\n        if (!animate || !me.anim) {\n            // just setting the value, so grab the direction\n            prop = 'scroll' + (top ? 'Top' : 'Left');\n            dom[prop] = value;\n        }\n        else {\n            // if scrolling top, we need to grab scrollLeft, if left, scrollTop\n            prop = 'scroll' + (top ? 'Left' : 'Top');\n            me.anim({scroll: {to: top ? [dom[prop], value] : [value, dom[prop]]}}, me.preanim(arguments, 2), 'scroll');\n        }\n        return me;\n    },\n    \n    /**\n     * Scrolls this element into view within the passed container.\n     * @param {Mixed} container (optional) The container element to scroll (defaults to document.body).  Should be a\n     * string (id), dom node, or Ext.Element.\n     * @param {Boolean} hscroll (optional) False to disable horizontal scroll (defaults to true)\n     * @return {Ext.Element} this\n     */\n    scrollIntoView : function(container, hscroll) {\n        var c = Ext.getDom(container) || Ext.getBody().dom,\n            el = this.dom,\n            o = this.getOffsetsTo(c),\n            l = o[0] + c.scrollLeft,\n            t = o[1] + c.scrollTop,\n            b = t + el.offsetHeight,\n            r = l + el.offsetWidth,\n            ch = c.clientHeight,\n            ct = parseInt(c.scrollTop, 10),\n            cl = parseInt(c.scrollLeft, 10),\n            cb = ct + ch,\n            cr = cl + c.clientWidth;\n\n        if (el.offsetHeight > ch || t < ct) {\n            c.scrollTop = t;\n        }\n        else if (b > cb) {\n            c.scrollTop = b-ch;\n        }\n        // corrects IE, other browsers will ignore\n        c.scrollTop = c.scrollTop;\n\n        if (hscroll !== false) {\n            if (el.offsetWidth > c.clientWidth || l < cl) {\n                c.scrollLeft = l;\n            }\n            else if (r > cr) {\n                c.scrollLeft = r - c.clientWidth;\n            }\n            c.scrollLeft = c.scrollLeft;\n        }\n        return this;\n    },\n\n    // private\n    scrollChildIntoView : function(child, hscroll) {\n        Ext.fly(child, '_scrollChildIntoView').scrollIntoView(this, hscroll);\n    },\n    \n    /**\n     * Scrolls this element the specified direction. Does bounds checking to make sure the scroll is\n     * within this element's scrollable range.\n     * @param {String} direction Possible values are: \"l\" (or \"left\"), \"r\" (or \"right\"), \"t\" (or \"top\", or \"up\"), \"b\" (or \"bottom\", or \"down\").\n     * @param {Number} distance How far to scroll the element in pixels\n     * @param {Boolean/Object} animate (optional) true for the default animation or a standard Element animation config object\n     * @return {Boolean} Returns true if a scroll was triggered or false if the element\n     * was scrolled as far as it could go.\n     */\n     scroll : function(direction, distance, animate) {\n        if (!this.isScrollable()) {\n            return false;\n        }\n        var el = this.dom,\n            l = el.scrollLeft, t = el.scrollTop,\n            w = el.scrollWidth, h = el.scrollHeight,\n            cw = el.clientWidth, ch = el.clientHeight,\n            scrolled = false, v,\n            hash = {\n                l: Math.min(l + distance, w-cw),\n                r: v = Math.max(l - distance, 0),\n                t: Math.max(t - distance, 0),\n                b: Math.min(t + distance, h-ch)\n            };\n            hash.d = hash.b;\n            hash.u = hash.t;\n        \n        direction = direction.substr(0, 1);\n        if ((v = hash[direction]) > -1) {\n            scrolled = true;\n            this.scrollTo(direction == 'l' || direction == 'r' ? 'left' : 'top', v, this.preanim(arguments, 2));\n        }\n        return scrolled;\n    }\n});/**\n * @class Ext.Element\n */\nExt.Element.addMethods(\n    function() {\n        var VISIBILITY      = \"visibility\",\n            DISPLAY         = \"display\",\n            HIDDEN          = \"hidden\",\n            NONE            = \"none\",\n            XMASKED         = \"x-masked\",\n            XMASKEDRELATIVE = \"x-masked-relative\",\n            data            = Ext.Element.data;\n\n        return {\n            /**\n             * Checks whether the element is currently visible using both visibility and display properties.\n             * @param {Boolean} deep (optional) True to walk the dom and see if parent elements are hidden (defaults to false)\n             * @return {Boolean} True if the element is currently visible, else false\n             */\n            isVisible : function(deep) {\n                var vis = !this.isStyle(VISIBILITY, HIDDEN) && !this.isStyle(DISPLAY, NONE),\n                    p   = this.dom.parentNode;\n                \n                if (deep !== true || !vis) {\n                    return vis;\n                }\n                \n                while (p && !(/^body/i.test(p.tagName))) {\n                    if (!Ext.fly(p, '_isVisible').isVisible()) {\n                        return false;\n                    }\n                    p = p.parentNode;\n                }\n                return true;\n            },\n\n            /**\n             * Returns true if display is not \"none\"\n             * @return {Boolean}\n             */\n            isDisplayed : function() {\n                return !this.isStyle(DISPLAY, NONE);\n            },\n\n            /**\n             * Convenience method for setVisibilityMode(Element.DISPLAY)\n             * @param {String} display (optional) What to set display to when visible\n             * @return {Ext.Element} this\n             */\n            enableDisplayMode : function(display) {\n                this.setVisibilityMode(Ext.Element.DISPLAY);\n                \n                if (!Ext.isEmpty(display)) {\n                    data(this.dom, 'originalDisplay', display);\n                }\n                \n                return this;\n            },\n\n            /**\n             * Puts a mask over this element to disable user interaction. Requires core.css.\n             * This method can only be applied to elements which accept child nodes.\n             * @param {String} msg (optional) A message to display in the mask\n             * @param {String} msgCls (optional) A css class to apply to the msg element\n             * @return {Element} The mask element\n             */\n            mask : function(msg, msgCls) {\n                var me  = this,\n                    dom = me.dom,\n                    dh  = Ext.DomHelper,\n                    EXTELMASKMSG = \"ext-el-mask-msg\",\n                    el,\n                    mask;\n\n                if (!/^body/i.test(dom.tagName) && me.getStyle('position') == 'static') {\n                    me.addClass(XMASKEDRELATIVE);\n                }\n                if (el = data(dom, 'maskMsg')) {\n                    el.remove();\n                }\n                if (el = data(dom, 'mask')) {\n                    el.remove();\n                }\n\n                mask = dh.append(dom, {cls : \"ext-el-mask\"}, true);\n                data(dom, 'mask', mask);\n\n                me.addClass(XMASKED);\n                mask.setDisplayed(true);\n                \n                if (typeof msg == 'string') {\n                    var mm = dh.append(dom, {cls : EXTELMASKMSG, cn:{tag:'div'}}, true);\n                    data(dom, 'maskMsg', mm);\n                    mm.dom.className = msgCls ? EXTELMASKMSG + \" \" + msgCls : EXTELMASKMSG;\n                    mm.dom.firstChild.innerHTML = msg;\n                    mm.setDisplayed(true);\n                    mm.center(me);\n                }\n                \n                // ie will not expand full height automatically\n                if (Ext.isIE && !(Ext.isIE7 && Ext.isStrict) && me.getStyle('height') == 'auto') {\n                    mask.setSize(undefined, me.getHeight());\n                }\n                \n                return mask;\n            },\n\n            /**\n             * Removes a previously applied mask.\n             */\n            unmask : function() {\n                var me      = this,\n                    dom     = me.dom,\n                    mask    = data(dom, 'mask'),\n                    maskMsg = data(dom, 'maskMsg');\n\n                if (mask) {\n                    if (maskMsg) {\n                        maskMsg.remove();\n                        data(dom, 'maskMsg', undefined);\n                    }\n                    \n                    mask.remove();\n                    data(dom, 'mask', undefined);\n                    me.removeClass([XMASKED, XMASKEDRELATIVE]);\n                }\n            },\n\n            /**\n             * Returns true if this element is masked\n             * @return {Boolean}\n             */\n            isMasked : function() {\n                var m = data(this.dom, 'mask');\n                return m && m.isVisible();\n            },\n\n            /**\n             * Creates an iframe shim for this element to keep selects and other windowed objects from\n             * showing through.\n             * @return {Ext.Element} The new shim element\n             */\n            createShim : function() {\n                var el = document.createElement('iframe'),\n                    shim;\n                \n                el.frameBorder = '0';\n                el.className = 'ext-shim';\n                el.src = Ext.SSL_SECURE_URL;\n                shim = Ext.get(this.dom.parentNode.insertBefore(el, this.dom));\n                shim.autoBoxAdjust = false;\n                return shim;\n            }\n        };\n    }()\n);/**\n * @class Ext.Element\n */\nExt.Element.addMethods({\n    /**\n     * Convenience method for constructing a KeyMap\n     * @param {Number/Array/Object/String} key Either a string with the keys to listen for, the numeric key code, array of key codes or an object with the following options:\n     * <code>{key: (number or array), shift: (true/false), ctrl: (true/false), alt: (true/false)}</code>\n     * @param {Function} fn The function to call\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the specified function is executed. Defaults to this Element.\n     * @return {Ext.KeyMap} The KeyMap created\n     */\n    addKeyListener : function(key, fn, scope){\n        var config;\n        if(typeof key != 'object' || Ext.isArray(key)){\n            config = {\n                key: key,\n                fn: fn,\n                scope: scope\n            };\n        }else{\n            config = {\n                key : key.key,\n                shift : key.shift,\n                ctrl : key.ctrl,\n                alt : key.alt,\n                fn: fn,\n                scope: scope\n            };\n        }\n        return new Ext.KeyMap(this, config);\n    },\n\n    /**\n     * Creates a KeyMap for this element\n     * @param {Object} config The KeyMap config. See {@link Ext.KeyMap} for more details\n     * @return {Ext.KeyMap} The KeyMap created\n     */\n    addKeyMap : function(config){\n        return new Ext.KeyMap(this, config);\n    }\n});\n\n//Import the newly-added Ext.Element functions into CompositeElementLite. We call this here because\n//Element.keys.js is the last extra Ext.Element include in the ext-all.js build\nExt.CompositeElementLite.importElementMethods();/**\n * @class Ext.CompositeElementLite\n */\nExt.apply(Ext.CompositeElementLite.prototype, {\n    addElements : function(els, root){\n        if(!els){\n            return this;\n        }\n        if(typeof els == \"string\"){\n            els = Ext.Element.selectorFunction(els, root);\n        }\n        var yels = this.elements;\n        Ext.each(els, function(e) {\n            yels.push(Ext.get(e));\n        });\n        return this;\n    },\n\n    /**\n     * Returns the first Element\n     * @return {Ext.Element}\n     */\n    first : function(){\n        return this.item(0);\n    },\n\n    /**\n     * Returns the last Element\n     * @return {Ext.Element}\n     */\n    last : function(){\n        return this.item(this.getCount()-1);\n    },\n\n    /**\n     * Returns true if this composite contains the passed element\n     * @param el {Mixed} The id of an element, or an Ext.Element, or an HtmlElement to find within the composite collection.\n     * @return Boolean\n     */\n    contains : function(el){\n        return this.indexOf(el) != -1;\n    },\n\n    /**\n    * Removes the specified element(s).\n    * @param {Mixed} el The id of an element, the Element itself, the index of the element in this composite\n    * or an array of any of those.\n    * @param {Boolean} removeDom (optional) True to also remove the element from the document\n    * @return {CompositeElement} this\n    */\n    removeElement : function(keys, removeDom){\n        var me = this,\n            els = this.elements,\n            el;\n        Ext.each(keys, function(val){\n            if ((el = (els[val] || els[val = me.indexOf(val)]))) {\n                if(removeDom){\n                    if(el.dom){\n                        el.remove();\n                    }else{\n                        Ext.removeNode(el);\n                    }\n                }\n                els.splice(val, 1);\n            }\n        });\n        return this;\n    }\n});\n/**\n * @class Ext.CompositeElement\n * @extends Ext.CompositeElementLite\n * <p>This class encapsulates a <i>collection</i> of DOM elements, providing methods to filter\n * members, or to perform collective actions upon the whole set.</p>\n * <p>Although they are not listed, this class supports all of the methods of {@link Ext.Element} and\n * {@link Ext.Fx}. The methods from these classes will be performed on all the elements in this collection.</p>\n * <p>All methods return <i>this</i> and can be chained.</p>\n * Usage:\n<pre><code>\nvar els = Ext.select(\"#some-el div.some-class\", true);\n// or select directly from an existing element\nvar el = Ext.get('some-el');\nel.select('div.some-class', true);\n\nels.setWidth(100); // all elements become 100 width\nels.hide(true); // all elements fade out and hide\n// or\nels.setWidth(100).hide(true);\n</code></pre>\n */\nExt.CompositeElement = Ext.extend(Ext.CompositeElementLite, {\n\n    constructor : function(els, root){\n        this.elements = [];\n        this.add(els, root);\n    },\n\n    // private\n    getElement : function(el){\n        // In this case just return it, since we already have a reference to it\n        return el;\n    },\n\n    // private\n    transformElement : function(el){\n        return Ext.get(el);\n    }\n\n    /**\n    * Adds elements to this composite.\n    * @param {String/Array} els A string CSS selector, an array of elements or an element\n    * @return {CompositeElement} this\n    * @ignore\n    */\n\n    /**\n     * Returns the Element object at the specified index\n     * @param {Number} index\n     * @return {Ext.Element}\n     * @ignore\n     */\n\n    /**\n     * Iterates each <code>element</code> in this <code>composite</code>\n     * calling the supplied function using {@link Ext#each}.\n     * @param {Function} fn The function to be called with each\n     * <code>element</code>. If the supplied function returns <tt>false</tt>,\n     * iteration stops. This function is called with the following arguments:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><code>element</code> : <i>Ext.Element</i><div class=\"sub-desc\">The element at the current <code>index</code>\n     * in the <code>composite</code></div></li>\n     * <li><code>composite</code> : <i>Object</i> <div class=\"sub-desc\">This composite.</div></li>\n     * <li><code>index</code> : <i>Number</i> <div class=\"sub-desc\">The current index within the <code>composite</code> </div></li>\n     * </ul></div>\n     * @param {Object} scope (optional) The scope (<code><this</code> reference) in which the specified function is executed.\n     * Defaults to the <code>element</code> at the current <code>index</code>\n     * within the composite.\n     * @return {CompositeElement} this\n     * @ignore\n     */\n});\n\n/**\n * Selects elements based on the passed CSS selector to enable {@link Ext.Element Element} methods\n * to be applied to many related elements in one statement through the returned {@link Ext.CompositeElement CompositeElement} or\n * {@link Ext.CompositeElementLite CompositeElementLite} object.\n * @param {String/Array} selector The CSS selector or an array of elements\n * @param {Boolean} unique (optional) true to create a unique Ext.Element for each element (defaults to a shared flyweight object)\n * @param {HTMLElement/String} root (optional) The root element of the query or id of the root\n * @return {CompositeElementLite/CompositeElement}\n * @member Ext.Element\n * @method select\n * @static\n */\nExt.Element.select = function(selector, unique, root){\n    var els;\n    if(typeof selector == \"string\"){\n        els = Ext.Element.selectorFunction(selector, root);\n    }else if(selector.length !== undefined){\n        els = selector;\n    }else{\n        throw \"Invalid selector\";\n    }\n\n    return (unique === true) ? new Ext.CompositeElement(els) : new Ext.CompositeElementLite(els);\n};\n\n/**\n * Selects elements based on the passed CSS selector to enable {@link Ext.Element Element} methods\n * to be applied to many related elements in one statement through the returned {@link Ext.CompositeElement CompositeElement} or\n * {@link Ext.CompositeElementLite CompositeElementLite} object.\n * @param {String/Array} selector The CSS selector or an array of elements\n * @param {Boolean} unique (optional) true to create a unique Ext.Element for each element (defaults to a shared flyweight object)\n * @param {HTMLElement/String} root (optional) The root element of the query or id of the root\n * @return {CompositeElementLite/CompositeElement}\n * @member Ext\n * @method select\n */\nExt.select = Ext.Element.select;/**\n * @class Ext.Updater\n * @extends Ext.util.Observable\n * Provides AJAX-style update capabilities for Element objects.  Updater can be used to {@link #update}\n * an {@link Ext.Element} once, or you can use {@link #startAutoRefresh} to set up an auto-updating\n * {@link Ext.Element Element} on a specific interval.<br><br>\n * Usage:<br>\n * <pre><code>\n * var el = Ext.get(\"foo\"); // Get Ext.Element object\n * var mgr = el.getUpdater();\n * mgr.update({\n        url: \"http://myserver.com/index.php\",\n        params: {\n            param1: \"foo\",\n            param2: \"bar\"\n        }\n * });\n * ...\n * mgr.formUpdate(\"myFormId\", \"http://myserver.com/index.php\");\n * <br>\n * // or directly (returns the same Updater instance)\n * var mgr = new Ext.Updater(\"myElementId\");\n * mgr.startAutoRefresh(60, \"http://myserver.com/index.php\");\n * mgr.on(\"update\", myFcnNeedsToKnow);\n * <br>\n * // short handed call directly from the element object\n * Ext.get(\"foo\").load({\n        url: \"bar.php\",\n        scripts: true,\n        params: \"param1=foo&amp;param2=bar\",\n        text: \"Loading Foo...\"\n * });\n * </code></pre>\n * @constructor\n * Create new Updater directly.\n * @param {Mixed} el The element to update\n * @param {Boolean} forceNew (optional) By default the constructor checks to see if the passed element already\n * has an Updater and if it does it returns the same instance. This will skip that check (useful for extending this class).\n */\nExt.UpdateManager = Ext.Updater = Ext.extend(Ext.util.Observable,\nfunction() {\n    var BEFOREUPDATE = \"beforeupdate\",\n        UPDATE = \"update\",\n        FAILURE = \"failure\";\n\n    // private\n    function processSuccess(response){\n        var me = this;\n        me.transaction = null;\n        if (response.argument.form && response.argument.reset) {\n            try { // put in try/catch since some older FF releases had problems with this\n                response.argument.form.reset();\n            } catch(e){}\n        }\n        if (me.loadScripts) {\n            me.renderer.render(me.el, response, me,\n               updateComplete.createDelegate(me, [response]));\n        } else {\n            me.renderer.render(me.el, response, me);\n            updateComplete.call(me, response);\n        }\n    }\n\n    // private\n    function updateComplete(response, type, success){\n        this.fireEvent(type || UPDATE, this.el, response);\n        if(Ext.isFunction(response.argument.callback)){\n            response.argument.callback.call(response.argument.scope, this.el, Ext.isEmpty(success) ? true : false, response, response.argument.options);\n        }\n    }\n\n    // private\n    function processFailure(response){\n        updateComplete.call(this, response, FAILURE, !!(this.transaction = null));\n    }\n\n    return {\n        constructor: function(el, forceNew){\n            var me = this;\n            el = Ext.get(el);\n            if(!forceNew && el.updateManager){\n                return el.updateManager;\n            }\n            /**\n             * The Element object\n             * @type Ext.Element\n             */\n            me.el = el;\n            /**\n             * Cached url to use for refreshes. Overwritten every time update() is called unless \"discardUrl\" param is set to true.\n             * @type String\n             */\n            me.defaultUrl = null;\n\n            me.addEvents(\n                /**\n                 * @event beforeupdate\n                 * Fired before an update is made, return false from your handler and the update is cancelled.\n                 * @param {Ext.Element} el\n                 * @param {String/Object/Function} url\n                 * @param {String/Object} params\n                 */\n                BEFOREUPDATE,\n                /**\n                 * @event update\n                 * Fired after successful update is made.\n                 * @param {Ext.Element} el\n                 * @param {Object} oResponseObject The response Object\n                 */\n                UPDATE,\n                /**\n                 * @event failure\n                 * Fired on update failure.\n                 * @param {Ext.Element} el\n                 * @param {Object} oResponseObject The response Object\n                 */\n                FAILURE\n            );\n\n            Ext.apply(me, Ext.Updater.defaults);\n            /**\n             * Blank page URL to use with SSL file uploads (defaults to {@link Ext.Updater.defaults#sslBlankUrl}).\n             * @property sslBlankUrl\n             * @type String\n             */\n            /**\n             * Whether to append unique parameter on get request to disable caching (defaults to {@link Ext.Updater.defaults#disableCaching}).\n             * @property disableCaching\n             * @type Boolean\n             */\n            /**\n             * Text for loading indicator (defaults to {@link Ext.Updater.defaults#indicatorText}).\n             * @property indicatorText\n             * @type String\n             */\n            /**\n             * Whether to show indicatorText when loading (defaults to {@link Ext.Updater.defaults#showLoadIndicator}).\n             * @property showLoadIndicator\n             * @type String\n             */\n            /**\n             * Timeout for requests or form posts in seconds (defaults to {@link Ext.Updater.defaults#timeout}).\n             * @property timeout\n             * @type Number\n             */\n            /**\n             * True to process scripts in the output (defaults to {@link Ext.Updater.defaults#loadScripts}).\n             * @property loadScripts\n             * @type Boolean\n             */\n\n            /**\n             * Transaction object of the current executing transaction, or null if there is no active transaction.\n             */\n            me.transaction = null;\n            /**\n             * Delegate for refresh() prebound to \"this\", use myUpdater.refreshDelegate.createCallback(arg1, arg2) to bind arguments\n             * @type Function\n             */\n            me.refreshDelegate = me.refresh.createDelegate(me);\n            /**\n             * Delegate for update() prebound to \"this\", use myUpdater.updateDelegate.createCallback(arg1, arg2) to bind arguments\n             * @type Function\n             */\n            me.updateDelegate = me.update.createDelegate(me);\n            /**\n             * Delegate for formUpdate() prebound to \"this\", use myUpdater.formUpdateDelegate.createCallback(arg1, arg2) to bind arguments\n             * @type Function\n             */\n            me.formUpdateDelegate = (me.formUpdate || function(){}).createDelegate(me);\n\n            /**\n             * The renderer for this Updater (defaults to {@link Ext.Updater.BasicRenderer}).\n             */\n            me.renderer = me.renderer || me.getDefaultRenderer();\n\n            Ext.Updater.superclass.constructor.call(me);\n        },\n\n        /**\n         * Sets the content renderer for this Updater. See {@link Ext.Updater.BasicRenderer#render} for more details.\n         * @param {Object} renderer The object implementing the render() method\n         */\n        setRenderer : function(renderer){\n            this.renderer = renderer;\n        },\n\n        /**\n         * Returns the current content renderer for this Updater. See {@link Ext.Updater.BasicRenderer#render} for more details.\n         * @return {Object}\n         */\n        getRenderer : function(){\n           return this.renderer;\n        },\n\n        /**\n         * This is an overrideable method which returns a reference to a default\n         * renderer class if none is specified when creating the Ext.Updater.\n         * Defaults to {@link Ext.Updater.BasicRenderer}\n         */\n        getDefaultRenderer: function() {\n            return new Ext.Updater.BasicRenderer();\n        },\n\n        /**\n         * Sets the default URL used for updates.\n         * @param {String/Function} defaultUrl The url or a function to call to get the url\n         */\n        setDefaultUrl : function(defaultUrl){\n            this.defaultUrl = defaultUrl;\n        },\n\n        /**\n         * Get the Element this Updater is bound to\n         * @return {Ext.Element} The element\n         */\n        getEl : function(){\n            return this.el;\n        },\n\n        /**\n         * Performs an <b>asynchronous</b> request, updating this element with the response.\n         * If params are specified it uses POST, otherwise it uses GET.<br><br>\n         * <b>Note:</b> Due to the asynchronous nature of remote server requests, the Element\n         * will not have been fully updated when the function returns. To post-process the returned\n         * data, use the callback option, or an <b><code>update</code></b> event handler.\n         * @param {Object} options A config object containing any of the following options:<ul>\n         * <li>url : <b>String/Function</b><p class=\"sub-desc\">The URL to request or a function which\n         * <i>returns</i> the URL (defaults to the value of {@link Ext.Ajax#url} if not specified).</p></li>\n         * <li>method : <b>String</b><p class=\"sub-desc\">The HTTP method to\n         * use. Defaults to POST if the <code>params</code> argument is present, otherwise GET.</p></li>\n         * <li>params : <b>String/Object/Function</b><p class=\"sub-desc\">The\n         * parameters to pass to the server (defaults to none). These may be specified as a url-encoded\n         * string, or as an object containing properties which represent parameters,\n         * or as a function, which returns such an object.</p></li>\n         * <li>scripts : <b>Boolean</b><p class=\"sub-desc\">If <code>true</code>\n         * any &lt;script&gt; tags embedded in the response text will be extracted\n         * and executed (defaults to {@link Ext.Updater.defaults#loadScripts}). If this option is specified,\n         * the callback will be called <i>after</i> the execution of the scripts.</p></li>\n         * <li>callback : <b>Function</b><p class=\"sub-desc\">A function to\n         * be called when the response from the server arrives. The following\n         * parameters are passed:<ul>\n         * <li><b>el</b> : Ext.Element<p class=\"sub-desc\">The Element being updated.</p></li>\n         * <li><b>success</b> : Boolean<p class=\"sub-desc\">True for success, false for failure.</p></li>\n         * <li><b>response</b> : XMLHttpRequest<p class=\"sub-desc\">The XMLHttpRequest which processed the update.</p></li>\n         * <li><b>options</b> : Object<p class=\"sub-desc\">The config object passed to the update call.</p></li></ul>\n         * </p></li>\n         * <li>scope : <b>Object</b><p class=\"sub-desc\">The scope in which\n         * to execute the callback (The callback's <code>this</code> reference.) If the\n         * <code>params</code> argument is a function, this scope is used for that function also.</p></li>\n         * <li>discardUrl : <b>Boolean</b><p class=\"sub-desc\">By default, the URL of this request becomes\n         * the default URL for this Updater object, and will be subsequently used in {@link #refresh}\n         * calls.  To bypass this behavior, pass <code>discardUrl:true</code> (defaults to false).</p></li>\n         * <li>timeout : <b>Number</b><p class=\"sub-desc\">The number of seconds to wait for a response before\n         * timing out (defaults to {@link Ext.Updater.defaults#timeout}).</p></li>\n         * <li>text : <b>String</b><p class=\"sub-desc\">The text to use as the innerHTML of the\n         * {@link Ext.Updater.defaults#indicatorText} div (defaults to 'Loading...').  To replace the entire div, not\n         * just the text, override {@link Ext.Updater.defaults#indicatorText} directly.</p></li>\n         * <li>nocache : <b>Boolean</b><p class=\"sub-desc\">Only needed for GET\n         * requests, this option causes an extra, auto-generated parameter to be appended to the request\n         * to defeat caching (defaults to {@link Ext.Updater.defaults#disableCaching}).</p></li></ul>\n         * <p>\n         * For example:\n    <pre><code>\n    um.update({\n        url: \"your-url.php\",\n        params: {param1: \"foo\", param2: \"bar\"}, // or a URL encoded string\n        callback: yourFunction,\n        scope: yourObject, //(optional scope)\n        discardUrl: true,\n        nocache: true,\n        text: \"Loading...\",\n        timeout: 60,\n        scripts: false // Save time by avoiding RegExp execution.\n    });\n    </code></pre>\n         */\n        update : function(url, params, callback, discardUrl){\n            var me = this,\n                cfg,\n                callerScope;\n\n            if(me.fireEvent(BEFOREUPDATE, me.el, url, params) !== false){\n                if(Ext.isObject(url)){ // must be config object\n                    cfg = url;\n                    url = cfg.url;\n                    params = params || cfg.params;\n                    callback = callback || cfg.callback;\n                    discardUrl = discardUrl || cfg.discardUrl;\n                    callerScope = cfg.scope;\n                    if(!Ext.isEmpty(cfg.nocache)){me.disableCaching = cfg.nocache;};\n                    if(!Ext.isEmpty(cfg.text)){me.indicatorText = '<div class=\"loading-indicator\">'+cfg.text+\"</div>\";};\n                    if(!Ext.isEmpty(cfg.scripts)){me.loadScripts = cfg.scripts;};\n                    if(!Ext.isEmpty(cfg.timeout)){me.timeout = cfg.timeout;};\n                }\n                me.showLoading();\n\n                if(!discardUrl){\n                    me.defaultUrl = url;\n                }\n                if(Ext.isFunction(url)){\n                    url = url.call(me);\n                }\n\n                var o = Ext.apply({}, {\n                    url : url,\n                    params: (Ext.isFunction(params) && callerScope) ? params.createDelegate(callerScope) : params,\n                    success: processSuccess,\n                    failure: processFailure,\n                    scope: me,\n                    callback: undefined,\n                    timeout: (me.timeout*1000),\n                    disableCaching: me.disableCaching,\n                    argument: {\n                        \"options\": cfg,\n                        \"url\": url,\n                        \"form\": null,\n                        \"callback\": callback,\n                        \"scope\": callerScope || window,\n                        \"params\": params\n                    }\n                }, cfg);\n\n                me.transaction = Ext.Ajax.request(o);\n            }\n        },\n\n        /**\n         * <p>Performs an asynchronous form post, updating this element with the response. If the form has the attribute\n         * enctype=\"<a href=\"http://www.faqs.org/rfcs/rfc2388.html\">multipart/form-data</a>\", it assumes it's a file upload.\n         * Uses this.sslBlankUrl for SSL file uploads to prevent IE security warning.</p>\n         * <p>File uploads are not performed using normal \"Ajax\" techniques, that is they are <b>not</b>\n         * performed using XMLHttpRequests. Instead the form is submitted in the standard manner with the\n         * DOM <code>&lt;form></code> element temporarily modified to have its\n         * <a href=\"http://www.w3.org/TR/REC-html40/present/frames.html#adef-target\">target</a> set to refer\n         * to a dynamically generated, hidden <code>&lt;iframe></code> which is inserted into the document\n         * but removed after the return data has been gathered.</p>\n         * <p>Be aware that file upload packets, sent with the content type <a href=\"http://www.faqs.org/rfcs/rfc2388.html\">multipart/form-data</a>\n         * and some server technologies (notably JEE) may require some custom processing in order to\n         * retrieve parameter names and parameter values from the packet content.</p>\n         * @param {String/HTMLElement} form The form Id or form element\n         * @param {String} url (optional) The url to pass the form to. If omitted the action attribute on the form will be used.\n         * @param {Boolean} reset (optional) Whether to try to reset the form after the update\n         * @param {Function} callback (optional) Callback when transaction is complete. The following\n         * parameters are passed:<ul>\n         * <li><b>el</b> : Ext.Element<p class=\"sub-desc\">The Element being updated.</p></li>\n         * <li><b>success</b> : Boolean<p class=\"sub-desc\">True for success, false for failure.</p></li>\n         * <li><b>response</b> : XMLHttpRequest<p class=\"sub-desc\">The XMLHttpRequest which processed the update.</p></li></ul>\n         */\n        formUpdate : function(form, url, reset, callback){\n            var me = this;\n            if(me.fireEvent(BEFOREUPDATE, me.el, form, url) !== false){\n                if(Ext.isFunction(url)){\n                    url = url.call(me);\n                }\n                form = Ext.getDom(form);\n                me.transaction = Ext.Ajax.request({\n                    form: form,\n                    url:url,\n                    success: processSuccess,\n                    failure: processFailure,\n                    scope: me,\n                    timeout: (me.timeout*1000),\n                    argument: {\n                        \"url\": url,\n                        \"form\": form,\n                        \"callback\": callback,\n                        \"reset\": reset\n                    }\n                });\n                me.showLoading.defer(1, me);\n            }\n        },\n\n        /**\n         * Set this element to auto refresh.  Can be canceled by calling {@link #stopAutoRefresh}.\n         * @param {Number} interval How often to update (in seconds).\n         * @param {String/Object/Function} url (optional) The url for this request, a config object in the same format\n         * supported by {@link #load}, or a function to call to get the url (defaults to the last used url).  Note that while\n         * the url used in a load call can be reused by this method, other load config options will not be reused and must be\n         * sepcified as part of a config object passed as this paramter if needed.\n         * @param {String/Object} params (optional) The parameters to pass as either a url encoded string\n         * \"&param1=1&param2=2\" or as an object {param1: 1, param2: 2}\n         * @param {Function} callback (optional) Callback when transaction is complete - called with signature (oElement, bSuccess)\n         * @param {Boolean} refreshNow (optional) Whether to execute the refresh now, or wait the interval\n         */\n        startAutoRefresh : function(interval, url, params, callback, refreshNow){\n            var me = this;\n            if(refreshNow){\n                me.update(url || me.defaultUrl, params, callback, true);\n            }\n            if(me.autoRefreshProcId){\n                clearInterval(me.autoRefreshProcId);\n            }\n            me.autoRefreshProcId = setInterval(me.update.createDelegate(me, [url || me.defaultUrl, params, callback, true]), interval * 1000);\n        },\n\n        /**\n         * Stop auto refresh on this element.\n         */\n        stopAutoRefresh : function(){\n            if(this.autoRefreshProcId){\n                clearInterval(this.autoRefreshProcId);\n                delete this.autoRefreshProcId;\n            }\n        },\n\n        /**\n         * Returns true if the Updater is currently set to auto refresh its content (see {@link #startAutoRefresh}), otherwise false.\n         */\n        isAutoRefreshing : function(){\n           return !!this.autoRefreshProcId;\n        },\n\n        /**\n         * Display the element's \"loading\" state. By default, the element is updated with {@link #indicatorText}. This\n         * method may be overridden to perform a custom action while this Updater is actively updating its contents.\n         */\n        showLoading : function(){\n            if(this.showLoadIndicator){\n                this.el.dom.innerHTML = this.indicatorText;\n            }\n        },\n\n        /**\n         * Aborts the currently executing transaction, if any.\n         */\n        abort : function(){\n            if(this.transaction){\n                Ext.Ajax.abort(this.transaction);\n            }\n        },\n\n        /**\n         * Returns true if an update is in progress, otherwise false.\n         * @return {Boolean}\n         */\n        isUpdating : function(){\n            return this.transaction ? Ext.Ajax.isLoading(this.transaction) : false;\n        },\n\n        /**\n         * Refresh the element with the last used url or defaultUrl. If there is no url, it returns immediately\n         * @param {Function} callback (optional) Callback when transaction is complete - called with signature (oElement, bSuccess)\n         */\n        refresh : function(callback){\n            if(this.defaultUrl){\n                this.update(this.defaultUrl, null, callback, true);\n            }\n        }\n    };\n}());\n\n/**\n * @class Ext.Updater.defaults\n * The defaults collection enables customizing the default properties of Updater\n */\nExt.Updater.defaults = {\n   /**\n     * Timeout for requests or form posts in seconds (defaults to 30 seconds).\n     * @type Number\n     */\n    timeout : 30,\n    /**\n     * True to append a unique parameter to GET requests to disable caching (defaults to false).\n     * @type Boolean\n     */\n    disableCaching : false,\n    /**\n     * Whether or not to show {@link #indicatorText} during loading (defaults to true).\n     * @type Boolean\n     */\n    showLoadIndicator : true,\n    /**\n     * Text for loading indicator (defaults to '&lt;div class=\"loading-indicator\"&gt;Loading...&lt;/div&gt;').\n     * @type String\n     */\n    indicatorText : '<div class=\"loading-indicator\">Loading...</div>',\n     /**\n     * True to process scripts by default (defaults to false).\n     * @type Boolean\n     */\n    loadScripts : false,\n    /**\n    * Blank page URL to use with SSL file uploads (defaults to {@link Ext#SSL_SECURE_URL} if set, or \"javascript:false\").\n    * @type String\n    */\n    sslBlankUrl : Ext.SSL_SECURE_URL\n};\n\n\n/**\n * Static convenience method. <b>This method is deprecated in favor of el.load({url:'foo.php', ...})</b>.\n * Usage:\n * <pre><code>Ext.Updater.updateElement(\"my-div\", \"stuff.php\");</code></pre>\n * @param {Mixed} el The element to update\n * @param {String} url The url\n * @param {String/Object} params (optional) Url encoded param string or an object of name/value pairs\n * @param {Object} options (optional) A config object with any of the Updater properties you want to set - for\n * example: {disableCaching:true, indicatorText: \"Loading data...\"}\n * @static\n * @deprecated\n * @member Ext.Updater\n */\nExt.Updater.updateElement = function(el, url, params, options){\n    var um = Ext.get(el).getUpdater();\n    Ext.apply(um, options);\n    um.update(url, params, options ? options.callback : null);\n};\n\n/**\n * @class Ext.Updater.BasicRenderer\n * <p>This class is a base class implementing a simple render method which updates an element using results from an Ajax request.</p>\n * <p>The BasicRenderer updates the element's innerHTML with the responseText. To perform a custom render (i.e. XML or JSON processing),\n * create an object with a conforming {@link #render} method and pass it to setRenderer on the Updater.</p>\n */\nExt.Updater.BasicRenderer = function(){};\n\nExt.Updater.BasicRenderer.prototype = {\n    /**\n     * This method is called when an Ajax response is received, and an Element needs updating.\n     * @param {Ext.Element} el The element being rendered\n     * @param {Object} xhr The XMLHttpRequest object\n     * @param {Updater} updateManager The calling update manager\n     * @param {Function} callback A callback that will need to be called if loadScripts is true on the Updater\n     */\n     render : function(el, response, updateManager, callback){\n        el.update(response.responseText, updateManager.loadScripts, callback);\n    }\n};/**\n * @class Date\n *\n * The date parsing and formatting syntax contains a subset of\n * <a href=\"http://www.php.net/date\">PHP's date() function</a>, and the formats that are\n * supported will provide results equivalent to their PHP versions.\n *\n * The following is a list of all currently supported formats:\n * <pre>\nFormat  Description                                                               Example returned values\n------  -----------------------------------------------------------------------   -----------------------\n  d     Day of the month, 2 digits with leading zeros                             01 to 31\n  D     A short textual representation of the day of the week                     Mon to Sun\n  j     Day of the month without leading zeros                                    1 to 31\n  l     A full textual representation of the day of the week                      Sunday to Saturday\n  N     ISO-8601 numeric representation of the day of the week                    1 (for Monday) through 7 (for Sunday)\n  S     English ordinal suffix for the day of the month, 2 characters             st, nd, rd or th. Works well with j\n  w     Numeric representation of the day of the week                             0 (for Sunday) to 6 (for Saturday)\n  z     The day of the year (starting from 0)                                     0 to 364 (365 in leap years)\n  W     ISO-8601 week number of year, weeks starting on Monday                    01 to 53\n  F     A full textual representation of a month, such as January or March        January to December\n  m     Numeric representation of a month, with leading zeros                     01 to 12\n  M     A short textual representation of a month                                 Jan to Dec\n  n     Numeric representation of a month, without leading zeros                  1 to 12\n  t     Number of days in the given month                                         28 to 31\n  L     Whether it's a leap year                                                  1 if it is a leap year, 0 otherwise.\n  o     ISO-8601 year number (identical to (Y), but if the ISO week number (W)    Examples: 1998 or 2004\n        belongs to the previous or next year, that year is used instead)\n  Y     A full numeric representation of a year, 4 digits                         Examples: 1999 or 2003\n  y     A two digit representation of a year                                      Examples: 99 or 03\n  a     Lowercase Ante meridiem and Post meridiem                                 am or pm\n  A     Uppercase Ante meridiem and Post meridiem                                 AM or PM\n  g     12-hour format of an hour without leading zeros                           1 to 12\n  G     24-hour format of an hour without leading zeros                           0 to 23\n  h     12-hour format of an hour with leading zeros                              01 to 12\n  H     24-hour format of an hour with leading zeros                              00 to 23\n  i     Minutes, with leading zeros                                               00 to 59\n  s     Seconds, with leading zeros                                               00 to 59\n  u     Decimal fraction of a second                                              Examples:\n        (minimum 1 digit, arbitrary number of digits allowed)                     001 (i.e. 0.001s) or\n                                                                                  100 (i.e. 0.100s) or\n                                                                                  999 (i.e. 0.999s) or\n                                                                                  999876543210 (i.e. 0.999876543210s)\n  O     Difference to Greenwich time (GMT) in hours and minutes                   Example: +1030\n  P     Difference to Greenwich time (GMT) with colon between hours and minutes   Example: -08:00\n  T     Timezone abbreviation of the machine running the code                     Examples: EST, MDT, PDT ...\n  Z     Timezone offset in seconds (negative if west of UTC, positive if east)    -43200 to 50400\n  c     ISO 8601 date\n        Notes:                                                                    Examples:\n        1) If unspecified, the month / day defaults to the current month / day,   1991 or\n           the time defaults to midnight, while the timezone defaults to the      1992-10 or\n           browser's timezone. If a time is specified, it must include both hours 1993-09-20 or\n           and minutes. The \"T\" delimiter, seconds, milliseconds and timezone     1994-08-19T16:20+01:00 or\n           are optional.                                                          1995-07-18T17:21:28-02:00 or\n        2) The decimal fraction of a second, if specified, must contain at        1996-06-17T18:22:29.98765+03:00 or\n           least 1 digit (there is no limit to the maximum number                 1997-05-16T19:23:30,12345-0400 or\n           of digits allowed), and may be delimited by either a '.' or a ','      1998-04-15T20:24:31.2468Z or\n        Refer to the examples on the right for the various levels of              1999-03-14T20:24:32Z or\n        date-time granularity which are supported, or see                         2000-02-13T21:25:33\n        http://www.w3.org/TR/NOTE-datetime for more info.                         2001-01-12 22:26:34\n  U     Seconds since the Unix Epoch (January 1 1970 00:00:00 GMT)                1193432466 or -2138434463\n  M$    Microsoft AJAX serialized dates                                           \\/Date(1238606590509)\\/ (i.e. UTC milliseconds since epoch) or\n                                                                                  \\/Date(1238606590509+0800)\\/\n</pre>\n *\n * Example usage (note that you must escape format specifiers with '\\\\' to render them as character literals):\n * <pre><code>\n// Sample date:\n// 'Wed Jan 10 2007 15:05:01 GMT-0600 (Central Standard Time)'\n\nvar dt = new Date('1/10/2007 03:05:01 PM GMT-0600');\ndocument.write(dt.format('Y-m-d'));                           // 2007-01-10\ndocument.write(dt.format('F j, Y, g:i a'));                   // January 10, 2007, 3:05 pm\ndocument.write(dt.format('l, \\\\t\\\\he jS \\\\of F Y h:i:s A'));  // Wednesday, the 10th of January 2007 03:05:01 PM\n</code></pre>\n *\n * Here are some standard date/time patterns that you might find helpful.  They\n * are not part of the source of Date.js, but to use them you can simply copy this\n * block of code into any script that is included after Date.js and they will also become\n * globally available on the Date object.  Feel free to add or remove patterns as needed in your code.\n * <pre><code>\nDate.patterns = {\n    ISO8601Long:\"Y-m-d H:i:s\",\n    ISO8601Short:\"Y-m-d\",\n    ShortDate: \"n/j/Y\",\n    LongDate: \"l, F d, Y\",\n    FullDateTime: \"l, F d, Y g:i:s A\",\n    MonthDay: \"F d\",\n    ShortTime: \"g:i A\",\n    LongTime: \"g:i:s A\",\n    SortableDateTime: \"Y-m-d\\\\TH:i:s\",\n    UniversalSortableDateTime: \"Y-m-d H:i:sO\",\n    YearMonth: \"F, Y\"\n};\n</code></pre>\n *\n * Example usage:\n * <pre><code>\nvar dt = new Date();\ndocument.write(dt.format(Date.patterns.ShortDate));\n</code></pre>\n * <p>Developer-written, custom formats may be used by supplying both a formatting and a parsing function\n * which perform to specialized requirements. The functions are stored in {@link #parseFunctions} and {@link #formatFunctions}.</p>\n */\n\n/*\n * Most of the date-formatting functions below are the excellent work of Baron Schwartz.\n * (see http://www.xaprb.com/blog/2005/12/12/javascript-closures-for-runtime-efficiency/)\n * They generate precompiled functions from format patterns instead of parsing and\n * processing each pattern every time a date is formatted. These functions are available\n * on every Date object.\n */\n\n(function() {\n\n/**\n * Global flag which determines if strict date parsing should be used.\n * Strict date parsing will not roll-over invalid dates, which is the\n * default behaviour of javascript Date objects.\n * (see {@link #parseDate} for more information)\n * Defaults to <tt>false</tt>.\n * @static\n * @type Boolean\n*/\nDate.useStrict = false;\n\n\n// create private copy of Ext's String.format() method\n// - to remove unnecessary dependency\n// - to resolve namespace conflict with M$-Ajax's implementation\nfunction xf(format) {\n    var args = Array.prototype.slice.call(arguments, 1);\n    return format.replace(/\\{(\\d+)\\}/g, function(m, i) {\n        return args[i];\n    });\n}\n\n\n// private\nDate.formatCodeToRegex = function(character, currentGroup) {\n    // Note: currentGroup - position in regex result array (see notes for Date.parseCodes below)\n    var p = Date.parseCodes[character];\n\n    if (p) {\n      p = typeof p == 'function'? p() : p;\n      Date.parseCodes[character] = p; // reassign function result to prevent repeated execution\n    }\n\n    return p ? Ext.applyIf({\n      c: p.c ? xf(p.c, currentGroup || \"{0}\") : p.c\n    }, p) : {\n        g:0,\n        c:null,\n        s:Ext.escapeRe(character) // treat unrecognised characters as literals\n    };\n};\n\n// private shorthand for Date.formatCodeToRegex since we'll be using it fairly often\nvar $f = Date.formatCodeToRegex;\n\nExt.apply(Date, {\n    /**\n     * <p>An object hash in which each property is a date parsing function. The property name is the\n     * format string which that function parses.</p>\n     * <p>This object is automatically populated with date parsing functions as\n     * date formats are requested for Ext standard formatting strings.</p>\n     * <p>Custom parsing functions may be inserted into this object, keyed by a name which from then on\n     * may be used as a format string to {@link #parseDate}.<p>\n     * <p>Example:</p><pre><code>\nDate.parseFunctions['x-date-format'] = myDateParser;\n</code></pre>\n     * <p>A parsing function should return a Date object, and is passed the following parameters:<div class=\"mdetail-params\"><ul>\n     * <li><code>date</code> : String<div class=\"sub-desc\">The date string to parse.</div></li>\n     * <li><code>strict</code> : Boolean<div class=\"sub-desc\">True to validate date strings while parsing\n     * (i.e. prevent javascript Date \"rollover\") (The default must be false).\n     * Invalid date strings should return null when parsed.</div></li>\n     * </ul></div></p>\n     * <p>To enable Dates to also be <i>formatted</i> according to that format, a corresponding\n     * formatting function must be placed into the {@link #formatFunctions} property.\n     * @property parseFunctions\n     * @static\n     * @type Object\n     */\n    parseFunctions: {\n        \"M$\": function(input, strict) {\n            // note: the timezone offset is ignored since the M$ Ajax server sends\n            // a UTC milliseconds-since-Unix-epoch value (negative values are allowed)\n            var re = new RegExp('\\\\/Date\\\\(([-+])?(\\\\d+)(?:[+-]\\\\d{4})?\\\\)\\\\/');\n            var r = (input || '').match(re);\n            return r? new Date(((r[1] || '') + r[2]) * 1) : null;\n        }\n    },\n    parseRegexes: [],\n\n    /**\n     * <p>An object hash in which each property is a date formatting function. The property name is the\n     * format string which corresponds to the produced formatted date string.</p>\n     * <p>This object is automatically populated with date formatting functions as\n     * date formats are requested for Ext standard formatting strings.</p>\n     * <p>Custom formatting functions may be inserted into this object, keyed by a name which from then on\n     * may be used as a format string to {@link #format}. Example:</p><pre><code>\nDate.formatFunctions['x-date-format'] = myDateFormatter;\n</code></pre>\n     * <p>A formatting function should return a string representation of the passed Date object, and is passed the following parameters:<div class=\"mdetail-params\"><ul>\n     * <li><code>date</code> : Date<div class=\"sub-desc\">The Date to format.</div></li>\n     * </ul></div></p>\n     * <p>To enable date strings to also be <i>parsed</i> according to that format, a corresponding\n     * parsing function must be placed into the {@link #parseFunctions} property.\n     * @property formatFunctions\n     * @static\n     * @type Object\n     */\n    formatFunctions: {\n        \"M$\": function() {\n            // UTC milliseconds since Unix epoch (M$-AJAX serialized date format (MRSF))\n            return '\\\\/Date(' + this.getTime() + ')\\\\/';\n        }\n    },\n\n    y2kYear : 50,\n\n    /**\n     * Date interval constant\n     * @static\n     * @type String\n     */\n    MILLI : \"ms\",\n\n    /**\n     * Date interval constant\n     * @static\n     * @type String\n     */\n    SECOND : \"s\",\n\n    /**\n     * Date interval constant\n     * @static\n     * @type String\n     */\n    MINUTE : \"mi\",\n\n    /** Date interval constant\n     * @static\n     * @type String\n     */\n    HOUR : \"h\",\n\n    /**\n     * Date interval constant\n     * @static\n     * @type String\n     */\n    DAY : \"d\",\n\n    /**\n     * Date interval constant\n     * @static\n     * @type String\n     */\n    MONTH : \"mo\",\n\n    /**\n     * Date interval constant\n     * @static\n     * @type String\n     */\n    YEAR : \"y\",\n\n    /**\n     * <p>An object hash containing default date values used during date parsing.</p>\n     * <p>The following properties are available:<div class=\"mdetail-params\"><ul>\n     * <li><code>y</code> : Number<div class=\"sub-desc\">The default year value. (defaults to undefined)</div></li>\n     * <li><code>m</code> : Number<div class=\"sub-desc\">The default 1-based month value. (defaults to undefined)</div></li>\n     * <li><code>d</code> : Number<div class=\"sub-desc\">The default day value. (defaults to undefined)</div></li>\n     * <li><code>h</code> : Number<div class=\"sub-desc\">The default hour value. (defaults to undefined)</div></li>\n     * <li><code>i</code> : Number<div class=\"sub-desc\">The default minute value. (defaults to undefined)</div></li>\n     * <li><code>s</code> : Number<div class=\"sub-desc\">The default second value. (defaults to undefined)</div></li>\n     * <li><code>ms</code> : Number<div class=\"sub-desc\">The default millisecond value. (defaults to undefined)</div></li>\n     * </ul></div></p>\n     * <p>Override these properties to customize the default date values used by the {@link #parseDate} method.</p>\n     * <p><b>Note: In countries which experience Daylight Saving Time (i.e. DST), the <tt>h</tt>, <tt>i</tt>, <tt>s</tt>\n     * and <tt>ms</tt> properties may coincide with the exact time in which DST takes effect.\n     * It is the responsiblity of the developer to account for this.</b></p>\n     * Example Usage:\n     * <pre><code>\n// set default day value to the first day of the month\nDate.defaults.d = 1;\n\n// parse a February date string containing only year and month values.\n// setting the default day value to 1 prevents weird date rollover issues\n// when attempting to parse the following date string on, for example, March 31st 2009.\nDate.parseDate('2009-02', 'Y-m'); // returns a Date object representing February 1st 2009\n</code></pre>\n     * @property defaults\n     * @static\n     * @type Object\n     */\n    defaults: {},\n\n    /**\n     * An array of textual day names.\n     * Override these values for international dates.\n     * Example:\n     * <pre><code>\nDate.dayNames = [\n    'SundayInYourLang',\n    'MondayInYourLang',\n    ...\n];\n</code></pre>\n     * @type Array\n     * @static\n     */\n    dayNames : [\n        \"Sunday\",\n        \"Monday\",\n        \"Tuesday\",\n        \"Wednesday\",\n        \"Thursday\",\n        \"Friday\",\n        \"Saturday\"\n    ],\n\n    /**\n     * An array of textual month names.\n     * Override these values for international dates.\n     * Example:\n     * <pre><code>\nDate.monthNames = [\n    'JanInYourLang',\n    'FebInYourLang',\n    ...\n];\n</code></pre>\n     * @type Array\n     * @static\n     */\n    monthNames : [\n        \"January\",\n        \"February\",\n        \"March\",\n        \"April\",\n        \"May\",\n        \"June\",\n        \"July\",\n        \"August\",\n        \"September\",\n        \"October\",\n        \"November\",\n        \"December\"\n    ],\n\n    /**\n     * An object hash of zero-based javascript month numbers (with short month names as keys. note: keys are case-sensitive).\n     * Override these values for international dates.\n     * Example:\n     * <pre><code>\nDate.monthNumbers = {\n    'ShortJanNameInYourLang':0,\n    'ShortFebNameInYourLang':1,\n    ...\n};\n</code></pre>\n     * @type Object\n     * @static\n     */\n    monthNumbers : {\n        Jan:0,\n        Feb:1,\n        Mar:2,\n        Apr:3,\n        May:4,\n        Jun:5,\n        Jul:6,\n        Aug:7,\n        Sep:8,\n        Oct:9,\n        Nov:10,\n        Dec:11\n    },\n\n    /**\n     * Get the short month name for the given month number.\n     * Override this function for international dates.\n     * @param {Number} month A zero-based javascript month number.\n     * @return {String} The short month name.\n     * @static\n     */\n    getShortMonthName : function(month) {\n        return Date.monthNames[month].substring(0, 3);\n    },\n\n    /**\n     * Get the short day name for the given day number.\n     * Override this function for international dates.\n     * @param {Number} day A zero-based javascript day number.\n     * @return {String} The short day name.\n     * @static\n     */\n    getShortDayName : function(day) {\n        return Date.dayNames[day].substring(0, 3);\n    },\n\n    /**\n     * Get the zero-based javascript month number for the given short/full month name.\n     * Override this function for international dates.\n     * @param {String} name The short/full month name.\n     * @return {Number} The zero-based javascript month number.\n     * @static\n     */\n    getMonthNumber : function(name) {\n        // handle camel casing for english month names (since the keys for the Date.monthNumbers hash are case sensitive)\n        return Date.monthNumbers[name.substring(0, 1).toUpperCase() + name.substring(1, 3).toLowerCase()];\n    },\n    \n    /**\n     * Checks if the specified format contains hour information\n     * @param {Object} format The format to check\n     * @return {Boolean} True if the format contains hour information\n     * @static\n     */\n    formatContainsHourInfo : (function(){\n        var stripEscapeRe = /(\\\\.)/g,\n            hourInfoRe = /([gGhHisucUOPZ]|M\\$)/;\n        return function(format){\n            return hourInfoRe.test(format.replace(stripEscapeRe, ''));\n        };\n    })(),\n\n    /**\n     * The base format-code to formatting-function hashmap used by the {@link #format} method.\n     * Formatting functions are strings (or functions which return strings) which\n     * will return the appropriate value when evaluated in the context of the Date object\n     * from which the {@link #format} method is called.\n     * Add to / override these mappings for custom date formatting.\n     * Note: Date.format() treats characters as literals if an appropriate mapping cannot be found.\n     * Example:\n     * <pre><code>\nDate.formatCodes.x = \"String.leftPad(this.getDate(), 2, '0')\";\n(new Date()).format(\"X\"); // returns the current day of the month\n</code></pre>\n     * @type Object\n     * @static\n     */\n    formatCodes : {\n        d: \"String.leftPad(this.getDate(), 2, '0')\",\n        D: \"Date.getShortDayName(this.getDay())\", // get localised short day name\n        j: \"this.getDate()\",\n        l: \"Date.dayNames[this.getDay()]\",\n        N: \"(this.getDay() ? this.getDay() : 7)\",\n        S: \"this.getSuffix()\",\n        w: \"this.getDay()\",\n        z: \"this.getDayOfYear()\",\n        W: \"String.leftPad(this.getWeekOfYear(), 2, '0')\",\n        F: \"Date.monthNames[this.getMonth()]\",\n        m: \"String.leftPad(this.getMonth() + 1, 2, '0')\",\n        M: \"Date.getShortMonthName(this.getMonth())\", // get localised short month name\n        n: \"(this.getMonth() + 1)\",\n        t: \"this.getDaysInMonth()\",\n        L: \"(this.isLeapYear() ? 1 : 0)\",\n        o: \"(this.getFullYear() + (this.getWeekOfYear() == 1 && this.getMonth() > 0 ? +1 : (this.getWeekOfYear() >= 52 && this.getMonth() < 11 ? -1 : 0)))\",\n        Y: \"String.leftPad(this.getFullYear(), 4, '0')\",\n        y: \"('' + this.getFullYear()).substring(2, 4)\",\n        a: \"(this.getHours() < 12 ? 'am' : 'pm')\",\n        A: \"(this.getHours() < 12 ? 'AM' : 'PM')\",\n        g: \"((this.getHours() % 12) ? this.getHours() % 12 : 12)\",\n        G: \"this.getHours()\",\n        h: \"String.leftPad((this.getHours() % 12) ? this.getHours() % 12 : 12, 2, '0')\",\n        H: \"String.leftPad(this.getHours(), 2, '0')\",\n        i: \"String.leftPad(this.getMinutes(), 2, '0')\",\n        s: \"String.leftPad(this.getSeconds(), 2, '0')\",\n        u: \"String.leftPad(this.getMilliseconds(), 3, '0')\",\n        O: \"this.getGMTOffset()\",\n        P: \"this.getGMTOffset(true)\",\n        T: \"this.getTimezone()\",\n        Z: \"(this.getTimezoneOffset() * -60)\",\n\n        c: function() { // ISO-8601 -- GMT format\n            for (var c = \"Y-m-dTH:i:sP\", code = [], i = 0, l = c.length; i < l; ++i) {\n                var e = c.charAt(i);\n                code.push(e == \"T\" ? \"'T'\" : Date.getFormatCode(e)); // treat T as a character literal\n            }\n            return code.join(\" + \");\n        },\n        /*\n        c: function() { // ISO-8601 -- UTC format\n            return [\n              \"this.getUTCFullYear()\", \"'-'\",\n              \"String.leftPad(this.getUTCMonth() + 1, 2, '0')\", \"'-'\",\n              \"String.leftPad(this.getUTCDate(), 2, '0')\",\n              \"'T'\",\n              \"String.leftPad(this.getUTCHours(), 2, '0')\", \"':'\",\n              \"String.leftPad(this.getUTCMinutes(), 2, '0')\", \"':'\",\n              \"String.leftPad(this.getUTCSeconds(), 2, '0')\",\n              \"'Z'\"\n            ].join(\" + \");\n        },\n        */\n\n        U: \"Math.round(this.getTime() / 1000)\"\n    },\n\n    /**\n     * Checks if the passed Date parameters will cause a javascript Date \"rollover\".\n     * @param {Number} year 4-digit year\n     * @param {Number} month 1-based month-of-year\n     * @param {Number} day Day of month\n     * @param {Number} hour (optional) Hour\n     * @param {Number} minute (optional) Minute\n     * @param {Number} second (optional) Second\n     * @param {Number} millisecond (optional) Millisecond\n     * @return {Boolean} true if the passed parameters do not cause a Date \"rollover\", false otherwise.\n     * @static\n     */\n    isValid : function(y, m, d, h, i, s, ms) {\n        // setup defaults\n        h = h || 0;\n        i = i || 0;\n        s = s || 0;\n        ms = ms || 0;\n\n        // Special handling for year < 100\n        var dt = new Date(y < 100 ? 100 : y, m - 1, d, h, i, s, ms).add(Date.YEAR, y < 100 ? y - 100 : 0);\n\n        return y == dt.getFullYear() &&\n            m == dt.getMonth() + 1 &&\n            d == dt.getDate() &&\n            h == dt.getHours() &&\n            i == dt.getMinutes() &&\n            s == dt.getSeconds() &&\n            ms == dt.getMilliseconds();\n    },\n\n    /**\n     * Parses the passed string using the specified date format.\n     * Note that this function expects normal calendar dates, meaning that months are 1-based (i.e. 1 = January).\n     * The {@link #defaults} hash will be used for any date value (i.e. year, month, day, hour, minute, second or millisecond)\n     * which cannot be found in the passed string. If a corresponding default date value has not been specified in the {@link #defaults} hash,\n     * the current date's year, month, day or DST-adjusted zero-hour time value will be used instead.\n     * Keep in mind that the input date string must precisely match the specified format string\n     * in order for the parse operation to be successful (failed parse operations return a null value).\n     * <p>Example:</p><pre><code>\n//dt = Fri May 25 2007 (current date)\nvar dt = new Date();\n\n//dt = Thu May 25 2006 (today&#39;s month/day in 2006)\ndt = Date.parseDate(\"2006\", \"Y\");\n\n//dt = Sun Jan 15 2006 (all date parts specified)\ndt = Date.parseDate(\"2006-01-15\", \"Y-m-d\");\n\n//dt = Sun Jan 15 2006 15:20:01\ndt = Date.parseDate(\"2006-01-15 3:20:01 PM\", \"Y-m-d g:i:s A\");\n\n// attempt to parse Sun Feb 29 2006 03:20:01 in strict mode\ndt = Date.parseDate(\"2006-02-29 03:20:01\", \"Y-m-d H:i:s\", true); // returns null\n</code></pre>\n     * @param {String} input The raw date string.\n     * @param {String} format The expected date string format.\n     * @param {Boolean} strict (optional) True to validate date strings while parsing (i.e. prevents javascript Date \"rollover\")\n                        (defaults to false). Invalid date strings will return null when parsed.\n     * @return {Date} The parsed Date.\n     * @static\n     */\n    parseDate : function(input, format, strict) {\n        var p = Date.parseFunctions;\n        if (p[format] == null) {\n            Date.createParser(format);\n        }\n        return p[format](input, Ext.isDefined(strict) ? strict : Date.useStrict);\n    },\n\n    // private\n    getFormatCode : function(character) {\n        var f = Date.formatCodes[character];\n\n        if (f) {\n          f = typeof f == 'function'? f() : f;\n          Date.formatCodes[character] = f; // reassign function result to prevent repeated execution\n        }\n\n        // note: unknown characters are treated as literals\n        return f || (\"'\" + String.escape(character) + \"'\");\n    },\n\n    // private\n    createFormat : function(format) {\n        var code = [],\n            special = false,\n            ch = '';\n\n        for (var i = 0; i < format.length; ++i) {\n            ch = format.charAt(i);\n            if (!special && ch == \"\\\\\") {\n                special = true;\n            } else if (special) {\n                special = false;\n                code.push(\"'\" + String.escape(ch) + \"'\");\n            } else {\n                code.push(Date.getFormatCode(ch));\n            }\n        }\n        Date.formatFunctions[format] = new Function(\"return \" + code.join('+'));\n    },\n\n    // private\n    createParser : function() {\n        var code = [\n            \"var dt, y, m, d, h, i, s, ms, o, z, zz, u, v,\",\n                \"def = Date.defaults,\",\n                \"results = String(input).match(Date.parseRegexes[{0}]);\", // either null, or an array of matched strings\n\n            \"if(results){\",\n                \"{1}\",\n\n                \"if(u != null){\", // i.e. unix time is defined\n                    \"v = new Date(u * 1000);\", // give top priority to UNIX time\n                \"}else{\",\n                    // create Date object representing midnight of the current day;\n                    // this will provide us with our date defaults\n                    // (note: clearTime() handles Daylight Saving Time automatically)\n                    \"dt = (new Date()).clearTime();\",\n\n                    // date calculations (note: these calculations create a dependency on Ext.num())\n                    \"y = Ext.num(y, Ext.num(def.y, dt.getFullYear()));\",\n                    \"m = Ext.num(m, Ext.num(def.m - 1, dt.getMonth()));\",\n                    \"d = Ext.num(d, Ext.num(def.d, dt.getDate()));\",\n\n                    // time calculations (note: these calculations create a dependency on Ext.num())\n                    \"h  = Ext.num(h, Ext.num(def.h, dt.getHours()));\",\n                    \"i  = Ext.num(i, Ext.num(def.i, dt.getMinutes()));\",\n                    \"s  = Ext.num(s, Ext.num(def.s, dt.getSeconds()));\",\n                    \"ms = Ext.num(ms, Ext.num(def.ms, dt.getMilliseconds()));\",\n\n                    \"if(z >= 0 && y >= 0){\",\n                        // both the year and zero-based day of year are defined and >= 0.\n                        // these 2 values alone provide sufficient info to create a full date object\n\n                        // create Date object representing January 1st for the given year\n                        // handle years < 100 appropriately\n                        \"v = new Date(y < 100 ? 100 : y, 0, 1, h, i, s, ms).add(Date.YEAR, y < 100 ? y - 100 : 0);\",\n\n                        // then add day of year, checking for Date \"rollover\" if necessary\n                        \"v = !strict? v : (strict === true && (z <= 364 || (v.isLeapYear() && z <= 365))? v.add(Date.DAY, z) : null);\",\n                    \"}else if(strict === true && !Date.isValid(y, m + 1, d, h, i, s, ms)){\", // check for Date \"rollover\"\n                        \"v = null;\", // invalid date, so return null\n                    \"}else{\",\n                        // plain old Date object\n                        // handle years < 100 properly\n                        \"v = new Date(y < 100 ? 100 : y, m, d, h, i, s, ms).add(Date.YEAR, y < 100 ? y - 100 : 0);\",\n                    \"}\",\n                \"}\",\n            \"}\",\n\n            \"if(v){\",\n                // favour UTC offset over GMT offset\n                \"if(zz != null){\",\n                    // reset to UTC, then add offset\n                    \"v = v.add(Date.SECOND, -v.getTimezoneOffset() * 60 - zz);\",\n                \"}else if(o){\",\n                    // reset to GMT, then add offset\n                    \"v = v.add(Date.MINUTE, -v.getTimezoneOffset() + (sn == '+'? -1 : 1) * (hr * 60 + mn));\",\n                \"}\",\n            \"}\",\n\n            \"return v;\"\n        ].join('\\n');\n\n        return function(format) {\n            var regexNum = Date.parseRegexes.length,\n                currentGroup = 1,\n                calc = [],\n                regex = [],\n                special = false,\n                ch = \"\",\n                i = 0,\n                obj,\n                last;\n\n            for (; i < format.length; ++i) {\n                ch = format.charAt(i);\n                if (!special && ch == \"\\\\\") {\n                    special = true;\n                } else if (special) {\n                    special = false;\n                    regex.push(String.escape(ch));\n                } else {\n                    obj = $f(ch, currentGroup);\n                    currentGroup += obj.g;\n                    regex.push(obj.s);\n                    if (obj.g && obj.c) {\n                        if (obj.calcLast) {\n                            last = obj.c;\n                        } else {\n                            calc.push(obj.c);\n                        }\n                    }\n                }\n            }\n            \n            if (last) {\n                calc.push(last);\n            }\n\n            Date.parseRegexes[regexNum] = new RegExp(\"^\" + regex.join('') + \"$\", 'i');\n            Date.parseFunctions[format] = new Function(\"input\", \"strict\", xf(code, regexNum, calc.join('')));\n        };\n    }(),\n\n    // private\n    parseCodes : {\n        /*\n         * Notes:\n         * g = {Number} calculation group (0 or 1. only group 1 contributes to date calculations.)\n         * c = {String} calculation method (required for group 1. null for group 0. {0} = currentGroup - position in regex result array)\n         * s = {String} regex pattern. all matches are stored in results[], and are accessible by the calculation mapped to 'c'\n         */\n        d: {\n            g:1,\n            c:\"d = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{2})\" // day of month with leading zeroes (01 - 31)\n        },\n        j: {\n            g:1,\n            c:\"d = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{1,2})\" // day of month without leading zeroes (1 - 31)\n        },\n        D: function() {\n            for (var a = [], i = 0; i < 7; a.push(Date.getShortDayName(i)), ++i); // get localised short day names\n            return {\n                g:0,\n                c:null,\n                s:\"(?:\" + a.join(\"|\") +\")\"\n            };\n        },\n        l: function() {\n            return {\n                g:0,\n                c:null,\n                s:\"(?:\" + Date.dayNames.join(\"|\") + \")\"\n            };\n        },\n        N: {\n            g:0,\n            c:null,\n            s:\"[1-7]\" // ISO-8601 day number (1 (monday) - 7 (sunday))\n        },\n        S: {\n            g:0,\n            c:null,\n            s:\"(?:st|nd|rd|th)\"\n        },\n        w: {\n            g:0,\n            c:null,\n            s:\"[0-6]\" // javascript day number (0 (sunday) - 6 (saturday))\n        },\n        z: {\n            g:1,\n            c:\"z = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{1,3})\" // day of the year (0 - 364 (365 in leap years))\n        },\n        W: {\n            g:0,\n            c:null,\n            s:\"(?:\\\\d{2})\" // ISO-8601 week number (with leading zero)\n        },\n        F: function() {\n            return {\n                g:1,\n                c:\"m = parseInt(Date.getMonthNumber(results[{0}]), 10);\\n\", // get localised month number\n                s:\"(\" + Date.monthNames.join(\"|\") + \")\"\n            };\n        },\n        M: function() {\n            for (var a = [], i = 0; i < 12; a.push(Date.getShortMonthName(i)), ++i); // get localised short month names\n            return Ext.applyIf({\n                s:\"(\" + a.join(\"|\") + \")\"\n            }, $f(\"F\"));\n        },\n        m: {\n            g:1,\n            c:\"m = parseInt(results[{0}], 10) - 1;\\n\",\n            s:\"(\\\\d{2})\" // month number with leading zeros (01 - 12)\n        },\n        n: {\n            g:1,\n            c:\"m = parseInt(results[{0}], 10) - 1;\\n\",\n            s:\"(\\\\d{1,2})\" // month number without leading zeros (1 - 12)\n        },\n        t: {\n            g:0,\n            c:null,\n            s:\"(?:\\\\d{2})\" // no. of days in the month (28 - 31)\n        },\n        L: {\n            g:0,\n            c:null,\n            s:\"(?:1|0)\"\n        },\n        o: function() {\n            return $f(\"Y\");\n        },\n        Y: {\n            g:1,\n            c:\"y = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{4})\" // 4-digit year\n        },\n        y: {\n            g:1,\n            c:\"var ty = parseInt(results[{0}], 10);\\n\"\n                + \"y = ty > Date.y2kYear ? 1900 + ty : 2000 + ty;\\n\", // 2-digit year\n            s:\"(\\\\d{1,2})\"\n        },\n        /**\n         * In the am/pm parsing routines, we allow both upper and lower case \n         * even though it doesn't exactly match the spec. It gives much more flexibility\n         * in being able to specify case insensitive regexes.\n         */\n        a: function(){\n            return $f(\"A\");\n        },\n        A: {\n            // We need to calculate the hour before we apply AM/PM when parsing\n            calcLast: true,\n            g:1,\n            c:\"if (/(am)/i.test(results[{0}])) {\\n\"\n                + \"if (!h || h == 12) { h = 0; }\\n\"\n                + \"} else { if (!h || h < 12) { h = (h || 0) + 12; }}\",\n            s:\"(AM|PM|am|pm)\"\n        },\n        g: function() {\n            return $f(\"G\");\n        },\n        G: {\n            g:1,\n            c:\"h = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{1,2})\" // 24-hr format of an hour without leading zeroes (0 - 23)\n        },\n        h: function() {\n            return $f(\"H\");\n        },\n        H: {\n            g:1,\n            c:\"h = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{2})\" //  24-hr format of an hour with leading zeroes (00 - 23)\n        },\n        i: {\n            g:1,\n            c:\"i = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{2})\" // minutes with leading zeros (00 - 59)\n        },\n        s: {\n            g:1,\n            c:\"s = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{2})\" // seconds with leading zeros (00 - 59)\n        },\n        u: {\n            g:1,\n            c:\"ms = results[{0}]; ms = parseInt(ms, 10)/Math.pow(10, ms.length - 3);\\n\",\n            s:\"(\\\\d+)\" // decimal fraction of a second (minimum = 1 digit, maximum = unlimited)\n        },\n        O: {\n            g:1,\n            c:[\n                \"o = results[{0}];\",\n                \"var sn = o.substring(0,1),\", // get + / - sign\n                    \"hr = o.substring(1,3)*1 + Math.floor(o.substring(3,5) / 60),\", // get hours (performs minutes-to-hour conversion also, just in case)\n                    \"mn = o.substring(3,5) % 60;\", // get minutes\n                \"o = ((-12 <= (hr*60 + mn)/60) && ((hr*60 + mn)/60 <= 14))? (sn + String.leftPad(hr, 2, '0') + String.leftPad(mn, 2, '0')) : null;\\n\" // -12hrs <= GMT offset <= 14hrs\n            ].join(\"\\n\"),\n            s: \"([+\\-]\\\\d{4})\" // GMT offset in hrs and mins\n        },\n        P: {\n            g:1,\n            c:[\n                \"o = results[{0}];\",\n                \"var sn = o.substring(0,1),\", // get + / - sign\n                    \"hr = o.substring(1,3)*1 + Math.floor(o.substring(4,6) / 60),\", // get hours (performs minutes-to-hour conversion also, just in case)\n                    \"mn = o.substring(4,6) % 60;\", // get minutes\n                \"o = ((-12 <= (hr*60 + mn)/60) && ((hr*60 + mn)/60 <= 14))? (sn + String.leftPad(hr, 2, '0') + String.leftPad(mn, 2, '0')) : null;\\n\" // -12hrs <= GMT offset <= 14hrs\n            ].join(\"\\n\"),\n            s: \"([+\\-]\\\\d{2}:\\\\d{2})\" // GMT offset in hrs and mins (with colon separator)\n        },\n        T: {\n            g:0,\n            c:null,\n            s:\"[A-Z]{1,4}\" // timezone abbrev. may be between 1 - 4 chars\n        },\n        Z: {\n            g:1,\n            c:\"zz = results[{0}] * 1;\\n\" // -43200 <= UTC offset <= 50400\n                  + \"zz = (-43200 <= zz && zz <= 50400)? zz : null;\\n\",\n            s:\"([+\\-]?\\\\d{1,5})\" // leading '+' sign is optional for UTC offset\n        },\n        c: function() {\n            var calc = [],\n                arr = [\n                    $f(\"Y\", 1), // year\n                    $f(\"m\", 2), // month\n                    $f(\"d\", 3), // day\n                    $f(\"h\", 4), // hour\n                    $f(\"i\", 5), // minute\n                    $f(\"s\", 6), // second\n                    {c:\"ms = results[7] || '0'; ms = parseInt(ms, 10)/Math.pow(10, ms.length - 3);\\n\"}, // decimal fraction of a second (minimum = 1 digit, maximum = unlimited)\n                    {c:[ // allow either \"Z\" (i.e. UTC) or \"-0530\" or \"+08:00\" (i.e. UTC offset) timezone delimiters. assumes local timezone if no timezone is specified\n                        \"if(results[8]) {\", // timezone specified\n                            \"if(results[8] == 'Z'){\",\n                                \"zz = 0;\", // UTC\n                            \"}else if (results[8].indexOf(':') > -1){\",\n                                $f(\"P\", 8).c, // timezone offset with colon separator\n                            \"}else{\",\n                                $f(\"O\", 8).c, // timezone offset without colon separator\n                            \"}\",\n                        \"}\"\n                    ].join('\\n')}\n                ];\n\n            for (var i = 0, l = arr.length; i < l; ++i) {\n                calc.push(arr[i].c);\n            }\n\n            return {\n                g:1,\n                c:calc.join(\"\"),\n                s:[\n                    arr[0].s, // year (required)\n                    \"(?:\", \"-\", arr[1].s, // month (optional)\n                        \"(?:\", \"-\", arr[2].s, // day (optional)\n                            \"(?:\",\n                                \"(?:T| )?\", // time delimiter -- either a \"T\" or a single blank space\n                                arr[3].s, \":\", arr[4].s,  // hour AND minute, delimited by a single colon (optional). MUST be preceded by either a \"T\" or a single blank space\n                                \"(?::\", arr[5].s, \")?\", // seconds (optional)\n                                \"(?:(?:\\\\.|,)(\\\\d+))?\", // decimal fraction of a second (e.g. \",12345\" or \".98765\") (optional)\n                                \"(Z|(?:[-+]\\\\d{2}(?::)?\\\\d{2}))?\", // \"Z\" (UTC) or \"-0530\" (UTC offset without colon delimiter) or \"+08:00\" (UTC offset with colon delimiter) (optional)\n                            \")?\",\n                        \")?\",\n                    \")?\"\n                ].join(\"\")\n            };\n        },\n        U: {\n            g:1,\n            c:\"u = parseInt(results[{0}], 10);\\n\",\n            s:\"(-?\\\\d+)\" // leading minus sign indicates seconds before UNIX epoch\n        }\n    }\n});\n\n}());\n\nExt.apply(Date.prototype, {\n    // private\n    dateFormat : function(format) {\n        if (Date.formatFunctions[format] == null) {\n            Date.createFormat(format);\n        }\n        return Date.formatFunctions[format].call(this);\n    },\n\n    /**\n     * Get the timezone abbreviation of the current date (equivalent to the format specifier 'T').\n     *\n     * Note: The date string returned by the javascript Date object's toString() method varies\n     * between browsers (e.g. FF vs IE) and system region settings (e.g. IE in Asia vs IE in America).\n     * For a given date string e.g. \"Thu Oct 25 2007 22:55:35 GMT+0800 (Malay Peninsula Standard Time)\",\n     * getTimezone() first tries to get the timezone abbreviation from between a pair of parentheses\n     * (which may or may not be present), failing which it proceeds to get the timezone abbreviation\n     * from the GMT offset portion of the date string.\n     * @return {String} The abbreviated timezone name (e.g. 'CST', 'PDT', 'EDT', 'MPST' ...).\n     */\n    getTimezone : function() {\n        // the following list shows the differences between date strings from different browsers on a WinXP SP2 machine from an Asian locale:\n        //\n        // Opera  : \"Thu, 25 Oct 2007 22:53:45 GMT+0800\" -- shortest (weirdest) date string of the lot\n        // Safari : \"Thu Oct 25 2007 22:55:35 GMT+0800 (Malay Peninsula Standard Time)\" -- value in parentheses always gives the correct timezone (same as FF)\n        // FF     : \"Thu Oct 25 2007 22:55:35 GMT+0800 (Malay Peninsula Standard Time)\" -- value in parentheses always gives the correct timezone\n        // IE     : \"Thu Oct 25 22:54:35 UTC+0800 2007\" -- (Asian system setting) look for 3-4 letter timezone abbrev\n        // IE     : \"Thu Oct 25 17:06:37 PDT 2007\" -- (American system setting) look for 3-4 letter timezone abbrev\n        //\n        // this crazy regex attempts to guess the correct timezone abbreviation despite these differences.\n        // step 1: (?:\\((.*)\\) -- find timezone in parentheses\n        // step 2: ([A-Z]{1,4})(?:[\\-+][0-9]{4})?(?: -?\\d+)?) -- if nothing was found in step 1, find timezone from timezone offset portion of date string\n        // step 3: remove all non uppercase characters found in step 1 and 2\n        return this.toString().replace(/^.* (?:\\((.*)\\)|([A-Z]{1,4})(?:[\\-+][0-9]{4})?(?: -?\\d+)?)$/, \"$1$2\").replace(/[^A-Z]/g, \"\");\n    },\n\n    /**\n     * Get the offset from GMT of the current date (equivalent to the format specifier 'O').\n     * @param {Boolean} colon (optional) true to separate the hours and minutes with a colon (defaults to false).\n     * @return {String} The 4-character offset string prefixed with + or - (e.g. '-0600').\n     */\n    getGMTOffset : function(colon) {\n        return (this.getTimezoneOffset() > 0 ? \"-\" : \"+\")\n            + String.leftPad(Math.floor(Math.abs(this.getTimezoneOffset()) / 60), 2, \"0\")\n            + (colon ? \":\" : \"\")\n            + String.leftPad(Math.abs(this.getTimezoneOffset() % 60), 2, \"0\");\n    },\n\n    /**\n     * Get the numeric day number of the year, adjusted for leap year.\n     * @return {Number} 0 to 364 (365 in leap years).\n     */\n    getDayOfYear: function() {\n        var num = 0,\n            d = this.clone(),\n            m = this.getMonth(),\n            i;\n\n        for (i = 0, d.setDate(1), d.setMonth(0); i < m; d.setMonth(++i)) {\n            num += d.getDaysInMonth();\n        }\n        return num + this.getDate() - 1;\n    },\n\n    /**\n     * Get the numeric ISO-8601 week number of the year.\n     * (equivalent to the format specifier 'W', but without a leading zero).\n     * @return {Number} 1 to 53\n     */\n    getWeekOfYear : function() {\n        // adapted from http://www.merlyn.demon.co.uk/weekcalc.htm\n        var ms1d = 864e5, // milliseconds in a day\n            ms7d = 7 * ms1d; // milliseconds in a week\n\n        return function() { // return a closure so constants get calculated only once\n            var DC3 = Date.UTC(this.getFullYear(), this.getMonth(), this.getDate() + 3) / ms1d, // an Absolute Day Number\n                AWN = Math.floor(DC3 / 7), // an Absolute Week Number\n                Wyr = new Date(AWN * ms7d).getUTCFullYear();\n\n            return AWN - Math.floor(Date.UTC(Wyr, 0, 7) / ms7d) + 1;\n        };\n    }(),\n\n    /**\n     * Checks if the current date falls within a leap year.\n     * @return {Boolean} True if the current date falls within a leap year, false otherwise.\n     */\n    isLeapYear : function() {\n        var year = this.getFullYear();\n        return !!((year & 3) == 0 && (year % 100 || (year % 400 == 0 && year)));\n    },\n\n    /**\n     * Get the first day of the current month, adjusted for leap year.  The returned value\n     * is the numeric day index within the week (0-6) which can be used in conjunction with\n     * the {@link #monthNames} array to retrieve the textual day name.\n     * Example:\n     * <pre><code>\nvar dt = new Date('1/10/2007');\ndocument.write(Date.dayNames[dt.getFirstDayOfMonth()]); //output: 'Monday'\n</code></pre>\n     * @return {Number} The day number (0-6).\n     */\n    getFirstDayOfMonth : function() {\n        var day = (this.getDay() - (this.getDate() - 1)) % 7;\n        return (day < 0) ? (day + 7) : day;\n    },\n\n    /**\n     * Get the last day of the current month, adjusted for leap year.  The returned value\n     * is the numeric day index within the week (0-6) which can be used in conjunction with\n     * the {@link #monthNames} array to retrieve the textual day name.\n     * Example:\n     * <pre><code>\nvar dt = new Date('1/10/2007');\ndocument.write(Date.dayNames[dt.getLastDayOfMonth()]); //output: 'Wednesday'\n</code></pre>\n     * @return {Number} The day number (0-6).\n     */\n    getLastDayOfMonth : function() {\n        return this.getLastDateOfMonth().getDay();\n    },\n\n\n    /**\n     * Get the date of the first day of the month in which this date resides.\n     * @return {Date}\n     */\n    getFirstDateOfMonth : function() {\n        return new Date(this.getFullYear(), this.getMonth(), 1);\n    },\n\n    /**\n     * Get the date of the last day of the month in which this date resides.\n     * @return {Date}\n     */\n    getLastDateOfMonth : function() {\n        return new Date(this.getFullYear(), this.getMonth(), this.getDaysInMonth());\n    },\n\n    /**\n     * Get the number of days in the current month, adjusted for leap year.\n     * @return {Number} The number of days in the month.\n     */\n    getDaysInMonth: function() {\n        var daysInMonth = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];\n\n        return function() { // return a closure for efficiency\n            var m = this.getMonth();\n\n            return m == 1 && this.isLeapYear() ? 29 : daysInMonth[m];\n        };\n    }(),\n\n    /**\n     * Get the English ordinal suffix of the current day (equivalent to the format specifier 'S').\n     * @return {String} 'st, 'nd', 'rd' or 'th'.\n     */\n    getSuffix : function() {\n        switch (this.getDate()) {\n            case 1:\n            case 21:\n            case 31:\n                return \"st\";\n            case 2:\n            case 22:\n                return \"nd\";\n            case 3:\n            case 23:\n                return \"rd\";\n            default:\n                return \"th\";\n        }\n    },\n\n    /**\n     * Creates and returns a new Date instance with the exact same date value as the called instance.\n     * Dates are copied and passed by reference, so if a copied date variable is modified later, the original\n     * variable will also be changed.  When the intention is to create a new variable that will not\n     * modify the original instance, you should create a clone.\n     *\n     * Example of correctly cloning a date:\n     * <pre><code>\n//wrong way:\nvar orig = new Date('10/1/2006');\nvar copy = orig;\ncopy.setDate(5);\ndocument.write(orig);  //returns 'Thu Oct 05 2006'!\n\n//correct way:\nvar orig = new Date('10/1/2006');\nvar copy = orig.clone();\ncopy.setDate(5);\ndocument.write(orig);  //returns 'Thu Oct 01 2006'\n</code></pre>\n     * @return {Date} The new Date instance.\n     */\n    clone : function() {\n        return new Date(this.getTime());\n    },\n\n    /**\n     * Checks if the current date is affected by Daylight Saving Time (DST).\n     * @return {Boolean} True if the current date is affected by DST.\n     */\n    isDST : function() {\n        // adapted from http://extjs.com/forum/showthread.php?p=247172#post247172\n        // courtesy of @geoffrey.mcgill\n        return new Date(this.getFullYear(), 0, 1).getTimezoneOffset() != this.getTimezoneOffset();\n    },\n\n    /**\n     * Attempts to clear all time information from this Date by setting the time to midnight of the same day,\n     * automatically adjusting for Daylight Saving Time (DST) where applicable.\n     * (note: DST timezone information for the browser's host operating system is assumed to be up-to-date)\n     * @param {Boolean} clone true to create a clone of this date, clear the time and return it (defaults to false).\n     * @return {Date} this or the clone.\n     */\n    clearTime : function(clone) {\n        if (clone) {\n            return this.clone().clearTime();\n        }\n\n        // get current date before clearing time\n        var d = this.getDate();\n\n        // clear time\n        this.setHours(0);\n        this.setMinutes(0);\n        this.setSeconds(0);\n        this.setMilliseconds(0);\n\n        if (this.getDate() != d) { // account for DST (i.e. day of month changed when setting hour = 0)\n            // note: DST adjustments are assumed to occur in multiples of 1 hour (this is almost always the case)\n            // refer to http://www.timeanddate.com/time/aboutdst.html for the (rare) exceptions to this rule\n\n            // increment hour until cloned date == current date\n            for (var hr = 1, c = this.add(Date.HOUR, hr); c.getDate() != d; hr++, c = this.add(Date.HOUR, hr));\n\n            this.setDate(d);\n            this.setHours(c.getHours());\n        }\n\n        return this;\n    },\n\n    /**\n     * Provides a convenient method for performing basic date arithmetic. This method\n     * does not modify the Date instance being called - it creates and returns\n     * a new Date instance containing the resulting date value.\n     *\n     * Examples:\n     * <pre><code>\n// Basic usage:\nvar dt = new Date('10/29/2006').add(Date.DAY, 5);\ndocument.write(dt); //returns 'Fri Nov 03 2006 00:00:00'\n\n// Negative values will be subtracted:\nvar dt2 = new Date('10/1/2006').add(Date.DAY, -5);\ndocument.write(dt2); //returns 'Tue Sep 26 2006 00:00:00'\n\n// You can even chain several calls together in one line:\nvar dt3 = new Date('10/1/2006').add(Date.DAY, 5).add(Date.HOUR, 8).add(Date.MINUTE, -30);\ndocument.write(dt3); //returns 'Fri Oct 06 2006 07:30:00'\n</code></pre>\n     *\n     * @param {String} interval A valid date interval enum value.\n     * @param {Number} value The amount to add to the current date.\n     * @return {Date} The new Date instance.\n     */\n    add : function(interval, value) {\n        var d = this.clone();\n        if (!interval || value === 0) return d;\n\n        switch(interval.toLowerCase()) {\n            case Date.MILLI:\n                d.setMilliseconds(this.getMilliseconds() + value);\n                break;\n            case Date.SECOND:\n                d.setSeconds(this.getSeconds() + value);\n                break;\n            case Date.MINUTE:\n                d.setMinutes(this.getMinutes() + value);\n                break;\n            case Date.HOUR:\n                d.setHours(this.getHours() + value);\n                break;\n            case Date.DAY:\n                d.setDate(this.getDate() + value);\n                break;\n            case Date.MONTH:\n                var day = this.getDate();\n                if (day > 28) {\n                    day = Math.min(day, this.getFirstDateOfMonth().add('mo', value).getLastDateOfMonth().getDate());\n                }\n                d.setDate(day);\n                d.setMonth(this.getMonth() + value);\n                break;\n            case Date.YEAR:\n                d.setFullYear(this.getFullYear() + value);\n                break;\n        }\n        return d;\n    },\n\n    /**\n     * Checks if this date falls on or between the given start and end dates.\n     * @param {Date} start Start date\n     * @param {Date} end End date\n     * @return {Boolean} true if this date falls on or between the given start and end dates.\n     */\n    between : function(start, end) {\n        var t = this.getTime();\n        return start.getTime() <= t && t <= end.getTime();\n    }\n});\n\n\n/**\n * Formats a date given the supplied format string.\n * @param {String} format The format string.\n * @return {String} The formatted date.\n * @method format\n */\nDate.prototype.format = Date.prototype.dateFormat;\n\n\n// private\nif (Ext.isSafari && (navigator.userAgent.match(/WebKit\\/(\\d+)/)[1] || NaN) < 420) {\n    Ext.apply(Date.prototype, {\n        _xMonth : Date.prototype.setMonth,\n        _xDate  : Date.prototype.setDate,\n\n        // Bug in Safari 1.3, 2.0 (WebKit build < 420)\n        // Date.setMonth does not work consistently if iMonth is not 0-11\n        setMonth : function(num) {\n            if (num <= -1) {\n                var n = Math.ceil(-num),\n                    back_year = Math.ceil(n / 12),\n                    month = (n % 12) ? 12 - n % 12 : 0;\n\n                this.setFullYear(this.getFullYear() - back_year);\n\n                return this._xMonth(month);\n            } else {\n                return this._xMonth(num);\n            }\n        },\n\n        // Bug in setDate() method (resolved in WebKit build 419.3, so to be safe we target Webkit builds < 420)\n        // The parameter for Date.setDate() is converted to a signed byte integer in Safari\n        // http://brianary.blogspot.com/2006/03/safari-date-bug.html\n        setDate : function(d) {\n            // use setTime() to workaround setDate() bug\n            // subtract current day of month in milliseconds, then add desired day of month in milliseconds\n            return this.setTime(this.getTime() - (this.getDate() - d) * 864e5);\n        }\n    });\n}\n\n\n\n/* Some basic Date tests... (requires Firebug)\n\nDate.parseDate('', 'c'); // call Date.parseDate() once to force computation of regex string so we can console.log() it\nconsole.log('Insane Regex for \"c\" format: %o', Date.parseCodes.c.s); // view the insane regex for the \"c\" format specifier\n\n// standard tests\nconsole.group('Standard Date.parseDate() Tests');\n    console.log('Date.parseDate(\"2009-01-05T11:38:56\", \"c\")               = %o', Date.parseDate(\"2009-01-05T11:38:56\", \"c\")); // assumes browser's timezone setting\n    console.log('Date.parseDate(\"2009-02-04T12:37:55.001000\", \"c\")        = %o', Date.parseDate(\"2009-02-04T12:37:55.001000\", \"c\")); // assumes browser's timezone setting\n    console.log('Date.parseDate(\"2009-03-03T13:36:54,101000Z\", \"c\")       = %o', Date.parseDate(\"2009-03-03T13:36:54,101000Z\", \"c\")); // UTC\n    console.log('Date.parseDate(\"2009-04-02T14:35:53.901000-0530\", \"c\")   = %o', Date.parseDate(\"2009-04-02T14:35:53.901000-0530\", \"c\")); // GMT-0530\n    console.log('Date.parseDate(\"2009-05-01T15:34:52,9876000+08:00\", \"c\") = %o', Date.parseDate(\"2009-05-01T15:34:52,987600+08:00\", \"c\")); // GMT+08:00\nconsole.groupEnd();\n\n// ISO-8601 format as specified in http://www.w3.org/TR/NOTE-datetime\n// -- accepts ALL 6 levels of date-time granularity\nconsole.group('ISO-8601 Granularity Test (see http://www.w3.org/TR/NOTE-datetime)');\n    console.log('Date.parseDate(\"1997\", \"c\")                              = %o', Date.parseDate(\"1997\", \"c\")); // YYYY (e.g. 1997)\n    console.log('Date.parseDate(\"1997-07\", \"c\")                           = %o', Date.parseDate(\"1997-07\", \"c\")); // YYYY-MM (e.g. 1997-07)\n    console.log('Date.parseDate(\"1997-07-16\", \"c\")                        = %o', Date.parseDate(\"1997-07-16\", \"c\")); // YYYY-MM-DD (e.g. 1997-07-16)\n    console.log('Date.parseDate(\"1997-07-16T19:20+01:00\", \"c\")            = %o', Date.parseDate(\"1997-07-16T19:20+01:00\", \"c\")); // YYYY-MM-DDThh:mmTZD (e.g. 1997-07-16T19:20+01:00)\n    console.log('Date.parseDate(\"1997-07-16T19:20:30+01:00\", \"c\")         = %o', Date.parseDate(\"1997-07-16T19:20:30+01:00\", \"c\")); // YYYY-MM-DDThh:mm:ssTZD (e.g. 1997-07-16T19:20:30+01:00)\n    console.log('Date.parseDate(\"1997-07-16T19:20:30.45+01:00\", \"c\")      = %o', Date.parseDate(\"1997-07-16T19:20:30.45+01:00\", \"c\")); // YYYY-MM-DDThh:mm:ss.sTZD (e.g. 1997-07-16T19:20:30.45+01:00)\n    console.log('Date.parseDate(\"1997-07-16 19:20:30.45+01:00\", \"c\")      = %o', Date.parseDate(\"1997-07-16 19:20:30.45+01:00\", \"c\")); // YYYY-MM-DD hh:mm:ss.sTZD (e.g. 1997-07-16T19:20:30.45+01:00)\n    console.log('Date.parseDate(\"1997-13-16T19:20:30.45+01:00\", \"c\", true)= %o', Date.parseDate(\"1997-13-16T19:20:30.45+01:00\", \"c\", true)); // strict date parsing with invalid month value\nconsole.groupEnd();\n\n*/\n/**\n * @class Ext.util.MixedCollection\n * @extends Ext.util.Observable\n * A Collection class that maintains both numeric indexes and keys and exposes events.\n * @constructor\n * @param {Boolean} allowFunctions Specify <tt>true</tt> if the {@link #addAll}\n * function should add function references to the collection. Defaults to\n * <tt>false</tt>.\n * @param {Function} keyFn A function that can accept an item of the type(s) stored in this MixedCollection\n * and return the key value for that item.  This is used when available to look up the key on items that\n * were passed without an explicit key parameter to a MixedCollection method.  Passing this parameter is\n * equivalent to providing an implementation for the {@link #getKey} method.\n */\nExt.util.MixedCollection = function(allowFunctions, keyFn){\n    this.items = [];\n    this.map = {};\n    this.keys = [];\n    this.length = 0;\n    this.addEvents(\n        /**\n         * @event clear\n         * Fires when the collection is cleared.\n         */\n        'clear',\n        /**\n         * @event add\n         * Fires when an item is added to the collection.\n         * @param {Number} index The index at which the item was added.\n         * @param {Object} o The item added.\n         * @param {String} key The key associated with the added item.\n         */\n        'add',\n        /**\n         * @event replace\n         * Fires when an item is replaced in the collection.\n         * @param {String} key he key associated with the new added.\n         * @param {Object} old The item being replaced.\n         * @param {Object} new The new item.\n         */\n        'replace',\n        /**\n         * @event remove\n         * Fires when an item is removed from the collection.\n         * @param {Object} o The item being removed.\n         * @param {String} key (optional) The key associated with the removed item.\n         */\n        'remove',\n        'sort'\n    );\n    this.allowFunctions = allowFunctions === true;\n    if(keyFn){\n        this.getKey = keyFn;\n    }\n    Ext.util.MixedCollection.superclass.constructor.call(this);\n};\n\nExt.extend(Ext.util.MixedCollection, Ext.util.Observable, {\n\n    /**\n     * @cfg {Boolean} allowFunctions Specify <tt>true</tt> if the {@link #addAll}\n     * function should add function references to the collection. Defaults to\n     * <tt>false</tt>.\n     */\n    allowFunctions : false,\n\n    /**\n     * Adds an item to the collection. Fires the {@link #add} event when complete.\n     * @param {String} key <p>The key to associate with the item, or the new item.</p>\n     * <p>If a {@link #getKey} implementation was specified for this MixedCollection,\n     * or if the key of the stored items is in a property called <tt><b>id</b></tt>,\n     * the MixedCollection will be able to <i>derive</i> the key for the new item.\n     * In this case just pass the new item in this parameter.</p>\n     * @param {Object} o The item to add.\n     * @return {Object} The item added.\n     */\n    add : function(key, o){\n        if(arguments.length == 1){\n            o = arguments[0];\n            key = this.getKey(o);\n        }\n        if(typeof key != 'undefined' && key !== null){\n            var old = this.map[key];\n            if(typeof old != 'undefined'){\n                return this.replace(key, o);\n            }\n            this.map[key] = o;\n        }\n        this.length++;\n        this.items.push(o);\n        this.keys.push(key);\n        this.fireEvent('add', this.length-1, o, key);\n        return o;\n    },\n\n    /**\n      * MixedCollection has a generic way to fetch keys if you implement getKey.  The default implementation\n      * simply returns <b><code>item.id</code></b> but you can provide your own implementation\n      * to return a different value as in the following examples:<pre><code>\n// normal way\nvar mc = new Ext.util.MixedCollection();\nmc.add(someEl.dom.id, someEl);\nmc.add(otherEl.dom.id, otherEl);\n//and so on\n\n// using getKey\nvar mc = new Ext.util.MixedCollection();\nmc.getKey = function(el){\n   return el.dom.id;\n};\nmc.add(someEl);\nmc.add(otherEl);\n\n// or via the constructor\nvar mc = new Ext.util.MixedCollection(false, function(el){\n   return el.dom.id;\n});\nmc.add(someEl);\nmc.add(otherEl);\n     * </code></pre>\n     * @param {Object} item The item for which to find the key.\n     * @return {Object} The key for the passed item.\n     */\n    getKey : function(o){\n         return o.id;\n    },\n\n    /**\n     * Replaces an item in the collection. Fires the {@link #replace} event when complete.\n     * @param {String} key <p>The key associated with the item to replace, or the replacement item.</p>\n     * <p>If you supplied a {@link #getKey} implementation for this MixedCollection, or if the key\n     * of your stored items is in a property called <tt><b>id</b></tt>, then the MixedCollection\n     * will be able to <i>derive</i> the key of the replacement item. If you want to replace an item\n     * with one having the same key value, then just pass the replacement item in this parameter.</p>\n     * @param o {Object} o (optional) If the first parameter passed was a key, the item to associate\n     * with that key.\n     * @return {Object}  The new item.\n     */\n    replace : function(key, o){\n        if(arguments.length == 1){\n            o = arguments[0];\n            key = this.getKey(o);\n        }\n        var old = this.map[key];\n        if(typeof key == 'undefined' || key === null || typeof old == 'undefined'){\n             return this.add(key, o);\n        }\n        var index = this.indexOfKey(key);\n        this.items[index] = o;\n        this.map[key] = o;\n        this.fireEvent('replace', key, old, o);\n        return o;\n    },\n\n    /**\n     * Adds all elements of an Array or an Object to the collection.\n     * @param {Object/Array} objs An Object containing properties which will be added\n     * to the collection, or an Array of values, each of which are added to the collection.\n     * Functions references will be added to the collection if <code>{@link #allowFunctions}</code>\n     * has been set to <tt>true</tt>.\n     */\n    addAll : function(objs){\n        if(arguments.length > 1 || Ext.isArray(objs)){\n            var args = arguments.length > 1 ? arguments : objs;\n            for(var i = 0, len = args.length; i < len; i++){\n                this.add(args[i]);\n            }\n        }else{\n            for(var key in objs){\n                if(this.allowFunctions || typeof objs[key] != 'function'){\n                    this.add(key, objs[key]);\n                }\n            }\n        }\n    },\n\n    /**\n     * Executes the specified function once for every item in the collection, passing the following arguments:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>item</b> : Mixed<p class=\"sub-desc\">The collection item</p></li>\n     * <li><b>index</b> : Number<p class=\"sub-desc\">The item's index</p></li>\n     * <li><b>length</b> : Number<p class=\"sub-desc\">The total number of items in the collection</p></li>\n     * </ul></div>\n     * The function should return a boolean value. Returning false from the function will stop the iteration.\n     * @param {Function} fn The function to execute for each item.\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to the current item in the iteration.\n     */\n    each : function(fn, scope){\n        var items = [].concat(this.items); // each safe for removal\n        for(var i = 0, len = items.length; i < len; i++){\n            if(fn.call(scope || items[i], items[i], i, len) === false){\n                break;\n            }\n        }\n    },\n\n    /**\n     * Executes the specified function once for every key in the collection, passing each\n     * key, and its associated item as the first two parameters.\n     * @param {Function} fn The function to execute for each item.\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to the browser window.\n     */\n    eachKey : function(fn, scope){\n        for(var i = 0, len = this.keys.length; i < len; i++){\n            fn.call(scope || window, this.keys[i], this.items[i], i, len);\n        }\n    },\n\n    /**\n     * Returns the first item in the collection which elicits a true return value from the\n     * passed selection function.\n     * @param {Function} fn The selection function to execute for each item.\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to the browser window.\n     * @return {Object} The first item in the collection which returned true from the selection function.\n     */\n    find : function(fn, scope){\n        for(var i = 0, len = this.items.length; i < len; i++){\n            if(fn.call(scope || window, this.items[i], this.keys[i])){\n                return this.items[i];\n            }\n        }\n        return null;\n    },\n\n    /**\n     * Inserts an item at the specified index in the collection. Fires the {@link #add} event when complete.\n     * @param {Number} index The index to insert the item at.\n     * @param {String} key The key to associate with the new item, or the item itself.\n     * @param {Object} o (optional) If the second parameter was a key, the new item.\n     * @return {Object} The item inserted.\n     */\n    insert : function(index, key, o){\n        if(arguments.length == 2){\n            o = arguments[1];\n            key = this.getKey(o);\n        }\n        if(this.containsKey(key)){\n            this.suspendEvents();\n            this.removeKey(key);\n            this.resumeEvents();\n        }\n        if(index >= this.length){\n            return this.add(key, o);\n        }\n        this.length++;\n        this.items.splice(index, 0, o);\n        if(typeof key != 'undefined' && key !== null){\n            this.map[key] = o;\n        }\n        this.keys.splice(index, 0, key);\n        this.fireEvent('add', index, o, key);\n        return o;\n    },\n\n    /**\n     * Remove an item from the collection.\n     * @param {Object} o The item to remove.\n     * @return {Object} The item removed or false if no item was removed.\n     */\n    remove : function(o){\n        return this.removeAt(this.indexOf(o));\n    },\n\n    /**\n     * Remove an item from a specified index in the collection. Fires the {@link #remove} event when complete.\n     * @param {Number} index The index within the collection of the item to remove.\n     * @return {Object} The item removed or false if no item was removed.\n     */\n    removeAt : function(index){\n        if(index < this.length && index >= 0){\n            this.length--;\n            var o = this.items[index];\n            this.items.splice(index, 1);\n            var key = this.keys[index];\n            if(typeof key != 'undefined'){\n                delete this.map[key];\n            }\n            this.keys.splice(index, 1);\n            this.fireEvent('remove', o, key);\n            return o;\n        }\n        return false;\n    },\n\n    /**\n     * Removed an item associated with the passed key fom the collection.\n     * @param {String} key The key of the item to remove.\n     * @return {Object} The item removed or false if no item was removed.\n     */\n    removeKey : function(key){\n        return this.removeAt(this.indexOfKey(key));\n    },\n\n    /**\n     * Returns the number of items in the collection.\n     * @return {Number} the number of items in the collection.\n     */\n    getCount : function(){\n        return this.length;\n    },\n\n    /**\n     * Returns index within the collection of the passed Object.\n     * @param {Object} o The item to find the index of.\n     * @return {Number} index of the item. Returns -1 if not found.\n     */\n    indexOf : function(o){\n        return this.items.indexOf(o);\n    },\n\n    /**\n     * Returns index within the collection of the passed key.\n     * @param {String} key The key to find the index of.\n     * @return {Number} index of the key.\n     */\n    indexOfKey : function(key){\n        return this.keys.indexOf(key);\n    },\n\n    /**\n     * Returns the item associated with the passed key OR index.\n     * Key has priority over index.  This is the equivalent\n     * of calling {@link #key} first, then if nothing matched calling {@link #itemAt}.\n     * @param {String/Number} key The key or index of the item.\n     * @return {Object} If the item is found, returns the item.  If the item was not found, returns <tt>undefined</tt>.\n     * If an item was found, but is a Class, returns <tt>null</tt>.\n     */\n    item : function(key){\n        var mk = this.map[key],\n            item = mk !== undefined ? mk : (typeof key == 'number') ? this.items[key] : undefined;\n        return typeof item != 'function' || this.allowFunctions ? item : null; // for prototype!\n    },\n\n    /**\n     * Returns the item at the specified index.\n     * @param {Number} index The index of the item.\n     * @return {Object} The item at the specified index.\n     */\n    itemAt : function(index){\n        return this.items[index];\n    },\n\n    /**\n     * Returns the item associated with the passed key.\n     * @param {String/Number} key The key of the item.\n     * @return {Object} The item associated with the passed key.\n     */\n    key : function(key){\n        return this.map[key];\n    },\n\n    /**\n     * Returns true if the collection contains the passed Object as an item.\n     * @param {Object} o  The Object to look for in the collection.\n     * @return {Boolean} True if the collection contains the Object as an item.\n     */\n    contains : function(o){\n        return this.indexOf(o) != -1;\n    },\n\n    /**\n     * Returns true if the collection contains the passed Object as a key.\n     * @param {String} key The key to look for in the collection.\n     * @return {Boolean} True if the collection contains the Object as a key.\n     */\n    containsKey : function(key){\n        return typeof this.map[key] != 'undefined';\n    },\n\n    /**\n     * Removes all items from the collection.  Fires the {@link #clear} event when complete.\n     */\n    clear : function(){\n        this.length = 0;\n        this.items = [];\n        this.keys = [];\n        this.map = {};\n        this.fireEvent('clear');\n    },\n\n    /**\n     * Returns the first item in the collection.\n     * @return {Object} the first item in the collection..\n     */\n    first : function(){\n        return this.items[0];\n    },\n\n    /**\n     * Returns the last item in the collection.\n     * @return {Object} the last item in the collection..\n     */\n    last : function(){\n        return this.items[this.length-1];\n    },\n\n    /**\n     * @private\n     * Performs the actual sorting based on a direction and a sorting function. Internally,\n     * this creates a temporary array of all items in the MixedCollection, sorts it and then writes\n     * the sorted array data back into this.items and this.keys\n     * @param {String} property Property to sort by ('key', 'value', or 'index')\n     * @param {String} dir (optional) Direction to sort 'ASC' or 'DESC'. Defaults to 'ASC'.\n     * @param {Function} fn (optional) Comparison function that defines the sort order.\n     * Defaults to sorting by numeric value.\n     */\n    _sort : function(property, dir, fn){\n        var i, len,\n            dsc   = String(dir).toUpperCase() == 'DESC' ? -1 : 1,\n\n            //this is a temporary array used to apply the sorting function\n            c     = [],\n            keys  = this.keys,\n            items = this.items;\n\n        //default to a simple sorter function if one is not provided\n        fn = fn || function(a, b) {\n            return a - b;\n        };\n\n        //copy all the items into a temporary array, which we will sort\n        for(i = 0, len = items.length; i < len; i++){\n            c[c.length] = {\n                key  : keys[i],\n                value: items[i],\n                index: i\n            };\n        }\n\n        //sort the temporary array\n        c.sort(function(a, b){\n            var v = fn(a[property], b[property]) * dsc;\n            if(v === 0){\n                v = (a.index < b.index ? -1 : 1);\n            }\n            return v;\n        });\n\n        //copy the temporary array back into the main this.items and this.keys objects\n        for(i = 0, len = c.length; i < len; i++){\n            items[i] = c[i].value;\n            keys[i]  = c[i].key;\n        }\n\n        this.fireEvent('sort', this);\n    },\n\n    /**\n     * Sorts this collection by <b>item</b> value with the passed comparison function.\n     * @param {String} direction (optional) 'ASC' or 'DESC'. Defaults to 'ASC'.\n     * @param {Function} fn (optional) Comparison function that defines the sort order.\n     * Defaults to sorting by numeric value.\n     */\n    sort : function(dir, fn){\n        this._sort('value', dir, fn);\n    },\n\n    /**\n     * Reorders each of the items based on a mapping from old index to new index. Internally this\n     * just translates into a sort. The 'sort' event is fired whenever reordering has occured.\n     * @param {Object} mapping Mapping from old item index to new item index\n     */\n    reorder: function(mapping) {\n        this.suspendEvents();\n\n        var items = this.items,\n            index = 0,\n            length = items.length,\n            order = [],\n            remaining = [],\n            oldIndex;\n\n        //object of {oldPosition: newPosition} reversed to {newPosition: oldPosition}\n        for (oldIndex in mapping) {\n            order[mapping[oldIndex]] = items[oldIndex];\n        }\n\n        for (index = 0; index < length; index++) {\n            if (mapping[index] == undefined) {\n                remaining.push(items[index]);\n            }\n        }\n\n        for (index = 0; index < length; index++) {\n            if (order[index] == undefined) {\n                order[index] = remaining.shift();\n            }\n        }\n\n        this.clear();\n        this.addAll(order);\n\n        this.resumeEvents();\n        this.fireEvent('sort', this);\n    },\n\n    /**\n     * Sorts this collection by <b>key</b>s.\n     * @param {String} direction (optional) 'ASC' or 'DESC'. Defaults to 'ASC'.\n     * @param {Function} fn (optional) Comparison function that defines the sort order.\n     * Defaults to sorting by case insensitive string.\n     */\n    keySort : function(dir, fn){\n        this._sort('key', dir, fn || function(a, b){\n            var v1 = String(a).toUpperCase(), v2 = String(b).toUpperCase();\n            return v1 > v2 ? 1 : (v1 < v2 ? -1 : 0);\n        });\n    },\n\n    /**\n     * Returns a range of items in this collection\n     * @param {Number} startIndex (optional) The starting index. Defaults to 0.\n     * @param {Number} endIndex (optional) The ending index. Defaults to the last item.\n     * @return {Array} An array of items\n     */\n    getRange : function(start, end){\n        var items = this.items;\n        if(items.length < 1){\n            return [];\n        }\n        start = start || 0;\n        end = Math.min(typeof end == 'undefined' ? this.length-1 : end, this.length-1);\n        var i, r = [];\n        if(start <= end){\n            for(i = start; i <= end; i++) {\n                r[r.length] = items[i];\n            }\n        }else{\n            for(i = start; i >= end; i--) {\n                r[r.length] = items[i];\n            }\n        }\n        return r;\n    },\n\n    /**\n     * Filter the <i>objects</i> in this collection by a specific property.\n     * Returns a new collection that has been filtered.\n     * @param {String} property A property on your objects\n     * @param {String/RegExp} value Either string that the property values\n     * should start with or a RegExp to test against the property\n     * @param {Boolean} anyMatch (optional) True to match any part of the string, not just the beginning\n     * @param {Boolean} caseSensitive (optional) True for case sensitive comparison (defaults to False).\n     * @return {MixedCollection} The new filtered collection\n     */\n    filter : function(property, value, anyMatch, caseSensitive){\n        if(Ext.isEmpty(value, false)){\n            return this.clone();\n        }\n        value = this.createValueMatcher(value, anyMatch, caseSensitive);\n        return this.filterBy(function(o){\n            return o && value.test(o[property]);\n        });\n    },\n\n    /**\n     * Filter by a function. Returns a <i>new</i> collection that has been filtered.\n     * The passed function will be called with each object in the collection.\n     * If the function returns true, the value is included otherwise it is filtered.\n     * @param {Function} fn The function to be called, it will receive the args o (the object), k (the key)\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to this MixedCollection.\n     * @return {MixedCollection} The new filtered collection\n     */\n    filterBy : function(fn, scope){\n        var r = new Ext.util.MixedCollection();\n        r.getKey = this.getKey;\n        var k = this.keys, it = this.items;\n        for(var i = 0, len = it.length; i < len; i++){\n            if(fn.call(scope||this, it[i], k[i])){\n                r.add(k[i], it[i]);\n            }\n        }\n        return r;\n    },\n\n    /**\n     * Finds the index of the first matching object in this collection by a specific property/value.\n     * @param {String} property The name of a property on your objects.\n     * @param {String/RegExp} value A string that the property values\n     * should start with or a RegExp to test against the property.\n     * @param {Number} start (optional) The index to start searching at (defaults to 0).\n     * @param {Boolean} anyMatch (optional) True to match any part of the string, not just the beginning.\n     * @param {Boolean} caseSensitive (optional) True for case sensitive comparison.\n     * @return {Number} The matched index or -1\n     */\n    findIndex : function(property, value, start, anyMatch, caseSensitive){\n        if(Ext.isEmpty(value, false)){\n            return -1;\n        }\n        value = this.createValueMatcher(value, anyMatch, caseSensitive);\n        return this.findIndexBy(function(o){\n            return o && value.test(o[property]);\n        }, null, start);\n    },\n\n    /**\n     * Find the index of the first matching object in this collection by a function.\n     * If the function returns <i>true</i> it is considered a match.\n     * @param {Function} fn The function to be called, it will receive the args o (the object), k (the key).\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to this MixedCollection.\n     * @param {Number} start (optional) The index to start searching at (defaults to 0).\n     * @return {Number} The matched index or -1\n     */\n    findIndexBy : function(fn, scope, start){\n        var k = this.keys, it = this.items;\n        for(var i = (start||0), len = it.length; i < len; i++){\n            if(fn.call(scope||this, it[i], k[i])){\n                return i;\n            }\n        }\n        return -1;\n    },\n\n    /**\n     * Returns a regular expression based on the given value and matching options. This is used internally for finding and filtering,\n     * and by Ext.data.Store#filter\n     * @private\n     * @param {String} value The value to create the regex for. This is escaped using Ext.escapeRe\n     * @param {Boolean} anyMatch True to allow any match - no regex start/end line anchors will be added. Defaults to false\n     * @param {Boolean} caseSensitive True to make the regex case sensitive (adds 'i' switch to regex). Defaults to false.\n     * @param {Boolean} exactMatch True to force exact match (^ and $ characters added to the regex). Defaults to false. Ignored if anyMatch is true.\n     */\n    createValueMatcher : function(value, anyMatch, caseSensitive, exactMatch) {\n        if (!value.exec) { // not a regex\n            var er = Ext.escapeRe;\n            value = String(value);\n\n            if (anyMatch === true) {\n                value = er(value);\n            } else {\n                value = '^' + er(value);\n                if (exactMatch === true) {\n                    value += '$';\n                }\n            }\n            value = new RegExp(value, caseSensitive ? '' : 'i');\n         }\n         return value;\n    },\n\n    /**\n     * Creates a shallow copy of this collection\n     * @return {MixedCollection}\n     */\n    clone : function(){\n        var r = new Ext.util.MixedCollection();\n        var k = this.keys, it = this.items;\n        for(var i = 0, len = it.length; i < len; i++){\n            r.add(k[i], it[i]);\n        }\n        r.getKey = this.getKey;\n        return r;\n    }\n});\n/**\n * This method calls {@link #item item()}.\n * Returns the item associated with the passed key OR index. Key has priority\n * over index.  This is the equivalent of calling {@link #key} first, then if\n * nothing matched calling {@link #itemAt}.\n * @param {String/Number} key The key or index of the item.\n * @return {Object} If the item is found, returns the item.  If the item was\n * not found, returns <tt>undefined</tt>. If an item was found, but is a Class,\n * returns <tt>null</tt>.\n */\nExt.util.MixedCollection.prototype.get = Ext.util.MixedCollection.prototype.item;\n/**\n * @class Ext.AbstractManager\n * @extends Object\n * Base Manager class - extended by ComponentMgr and PluginMgr\n */\nExt.AbstractManager = Ext.extend(Object, {\n    typeName: 'type',\n    \n    constructor: function(config) {\n        Ext.apply(this, config || {});\n        \n        /**\n         * Contains all of the items currently managed\n         * @property all\n         * @type Ext.util.MixedCollection\n         */\n        this.all = new Ext.util.MixedCollection();\n        \n        this.types = {};\n    },\n    \n    /**\n     * Returns a component by {@link Ext.Component#id id}.\n     * For additional details see {@link Ext.util.MixedCollection#get}.\n     * @param {String} id The component {@link Ext.Component#id id}\n     * @return Ext.Component The Component, <code>undefined</code> if not found, or <code>null</code> if a\n     * Class was found.\n     */\n    get : function(id){\n        return this.all.get(id);\n    },\n    \n    /**\n     * Registers an item to be managed\n     * @param {Mixed} item The item to register\n     */\n    register: function(item) {\n        this.all.add(item);\n    },\n    \n    /**\n     * Unregisters a component by removing it from this manager\n     * @param {Mixed} item The item to unregister\n     */\n    unregister: function(item) {\n        this.all.remove(item);        \n    },\n    \n    /**\n     * <p>Registers a new Component constructor, keyed by a new\n     * {@link Ext.Component#xtype}.</p>\n     * <p>Use this method (or its alias {@link Ext#reg Ext.reg}) to register new\n     * subclasses of {@link Ext.Component} so that lazy instantiation may be used when specifying\n     * child Components.\n     * see {@link Ext.Container#items}</p>\n     * @param {String} xtype The mnemonic string by which the Component class may be looked up.\n     * @param {Constructor} cls The new Component class.\n     */\n    registerType : function(type, cls){\n        this.types[type] = cls;\n        cls[this.typeName] = type;\n    },\n    \n    /**\n     * Checks if a Component type is registered.\n     * @param {Ext.Component} xtype The mnemonic string by which the Component class may be looked up\n     * @return {Boolean} Whether the type is registered.\n     */\n    isRegistered : function(type){\n        return this.types[type] !== undefined;    \n    },\n    \n    /**\n     * Creates and returns an instance of whatever this manager manages, based on the supplied type and config object\n     * @param {Object} config The config object\n     * @param {String} defaultType If no type is discovered in the config object, we fall back to this type\n     * @return {Mixed} The instance of whatever this manager is managing\n     */\n    create: function(config, defaultType) {\n        var type        = config[this.typeName] || config.type || defaultType,\n            Constructor = this.types[type];\n        \n        if (Constructor == undefined) {\n            throw new Error(String.format(\"The '{0}' type has not been registered with this manager\", type));\n        }\n        \n        return new Constructor(config);\n    },\n    \n    /**\n     * Registers a function that will be called when a Component with the specified id is added to the manager. This will happen on instantiation.\n     * @param {String} id The component {@link Ext.Component#id id}\n     * @param {Function} fn The callback function\n     * @param {Object} scope The scope (<code>this</code> reference) in which the callback is executed. Defaults to the Component.\n     */\n    onAvailable : function(id, fn, scope){\n        var all = this.all;\n        \n        all.on(\"add\", function(index, o){\n            if (o.id == id) {\n                fn.call(scope || o, o);\n                all.un(\"add\", fn, scope);\n            }\n        });\n    }\n});/**\n * @class Ext.util.Format\n * Reusable data formatting functions\n * @singleton\n */\nExt.util.Format = function() {\n    var trimRe         = /^\\s+|\\s+$/g,\n        stripTagsRE    = /<\\/?[^>]+>/gi,\n        stripScriptsRe = /(?:<script.*?>)((\\n|\\r|.)*?)(?:<\\/script>)/ig,\n        nl2brRe        = /\\r?\\n/g;\n\n    return {\n        /**\n         * Truncate a string and add an ellipsis ('...') to the end if it exceeds the specified length\n         * @param {String} value The string to truncate\n         * @param {Number} length The maximum length to allow before truncating\n         * @param {Boolean} word True to try to find a common work break\n         * @return {String} The converted text\n         */\n        ellipsis : function(value, len, word) {\n            if (value && value.length > len) {\n                if (word) {\n                    var vs    = value.substr(0, len - 2),\n                        index = Math.max(vs.lastIndexOf(' '), vs.lastIndexOf('.'), vs.lastIndexOf('!'), vs.lastIndexOf('?'));\n                    if (index == -1 || index < (len - 15)) {\n                        return value.substr(0, len - 3) + \"...\";\n                    } else {\n                        return vs.substr(0, index) + \"...\";\n                    }\n                } else {\n                    return value.substr(0, len - 3) + \"...\";\n                }\n            }\n            return value;\n        },\n\n        /**\n         * Checks a reference and converts it to empty string if it is undefined\n         * @param {Mixed} value Reference to check\n         * @return {Mixed} Empty string if converted, otherwise the original value\n         */\n        undef : function(value) {\n            return value !== undefined ? value : \"\";\n        },\n\n        /**\n         * Checks a reference and converts it to the default value if it's empty\n         * @param {Mixed} value Reference to check\n         * @param {String} defaultValue The value to insert if it's undefined (defaults to \"\")\n         * @return {String}\n         */\n        defaultValue : function(value, defaultValue) {\n            if (!defaultValue && defaultValue !== 0) {\n                defaultValue = '';\n            }\n            return value !== undefined && value !== '' ? value : defaultValue;\n        },\n\n        /**\n         * Convert certain characters (&, <, >, and ') to their HTML character equivalents for literal display in web pages.\n         * @param {String} value The string to encode\n         * @return {String} The encoded text\n         */\n        htmlEncode : function(value) {\n            return !value ? value : String(value).replace(/&/g, \"&amp;\").replace(/>/g, \"&gt;\").replace(/</g, \"&lt;\").replace(/\"/g, \"&quot;\");\n        },\n\n        /**\n         * Convert certain characters (&, <, >, and ') from their HTML character equivalents.\n         * @param {String} value The string to decode\n         * @return {String} The decoded text\n         */\n        htmlDecode : function(value) {\n            return !value ? value : String(value).replace(/&gt;/g, \">\").replace(/&lt;/g, \"<\").replace(/&quot;/g, '\"').replace(/&amp;/g, \"&\");\n        },\n\n        /**\n         * Trims any whitespace from either side of a string\n         * @param {String} value The text to trim\n         * @return {String} The trimmed text\n         */\n        trim : function(value) {\n            return String(value).replace(trimRe, \"\");\n        },\n\n        /**\n         * Returns a substring from within an original string\n         * @param {String} value The original text\n         * @param {Number} start The start index of the substring\n         * @param {Number} length The length of the substring\n         * @return {String} The substring\n         */\n        substr : function(value, start, length) {\n            return String(value).substr(start, length);\n        },\n\n        /**\n         * Converts a string to all lower case letters\n         * @param {String} value The text to convert\n         * @return {String} The converted text\n         */\n        lowercase : function(value) {\n            return String(value).toLowerCase();\n        },\n\n        /**\n         * Converts a string to all upper case letters\n         * @param {String} value The text to convert\n         * @return {String} The converted text\n         */\n        uppercase : function(value) {\n            return String(value).toUpperCase();\n        },\n\n        /**\n         * Converts the first character only of a string to upper case\n         * @param {String} value The text to convert\n         * @return {String} The converted text\n         */\n        capitalize : function(value) {\n            return !value ? value : value.charAt(0).toUpperCase() + value.substr(1).toLowerCase();\n        },\n\n        // private\n        call : function(value, fn) {\n            if (arguments.length > 2) {\n                var args = Array.prototype.slice.call(arguments, 2);\n                args.unshift(value);\n                return eval(fn).apply(window, args);\n            } else {\n                return eval(fn).call(window, value);\n            }\n        },\n\n        /**\n         * Format a number as US currency\n         * @param {Number/String} value The numeric value to format\n         * @return {String} The formatted currency string\n         */\n        usMoney : function(v) {\n            v = (Math.round((v-0)*100))/100;\n            v = (v == Math.floor(v)) ? v + \".00\" : ((v*10 == Math.floor(v*10)) ? v + \"0\" : v);\n            v = String(v);\n            var ps = v.split('.'),\n                whole = ps[0],\n                sub = ps[1] ? '.'+ ps[1] : '.00',\n                r = /(\\d+)(\\d{3})/;\n            while (r.test(whole)) {\n                whole = whole.replace(r, '$1' + ',' + '$2');\n            }\n            v = whole + sub;\n            if (v.charAt(0) == '-') {\n                return '-$' + v.substr(1);\n            }\n            return \"$\" +  v;\n        },\n\n        /**\n         * Parse a value into a formatted date using the specified format pattern.\n         * @param {String/Date} value The value to format (Strings must conform to the format expected by the javascript Date object's <a href=\"http://www.w3schools.com/jsref/jsref_parse.asp\">parse()</a> method)\n         * @param {String} format (optional) Any valid date format string (defaults to 'm/d/Y')\n         * @return {String} The formatted date string\n         */\n        date : function(v, format) {\n            if (!v) {\n                return \"\";\n            }\n            if (!Ext.isDate(v)) {\n                v = new Date(Date.parse(v));\n            }\n            return v.dateFormat(format || \"m/d/Y\");\n        },\n\n        /**\n         * Returns a date rendering function that can be reused to apply a date format multiple times efficiently\n         * @param {String} format Any valid date format string\n         * @return {Function} The date formatting function\n         */\n        dateRenderer : function(format) {\n            return function(v) {\n                return Ext.util.Format.date(v, format);\n            };\n        },\n\n        /**\n         * Strips all HTML tags\n         * @param {Mixed} value The text from which to strip tags\n         * @return {String} The stripped text\n         */\n        stripTags : function(v) {\n            return !v ? v : String(v).replace(stripTagsRE, \"\");\n        },\n\n        /**\n         * Strips all script tags\n         * @param {Mixed} value The text from which to strip script tags\n         * @return {String} The stripped text\n         */\n        stripScripts : function(v) {\n            return !v ? v : String(v).replace(stripScriptsRe, \"\");\n        },\n\n        /**\n         * Simple format for a file size (xxx bytes, xxx KB, xxx MB)\n         * @param {Number/String} size The numeric value to format\n         * @return {String} The formatted file size\n         */\n        fileSize : function(size) {\n            if (size < 1024) {\n                return size + \" bytes\";\n            } else if (size < 1048576) {\n                return (Math.round(((size*10) / 1024))/10) + \" KB\";\n            } else {\n                return (Math.round(((size*10) / 1048576))/10) + \" MB\";\n            }\n        },\n\n        /**\n         * It does simple math for use in a template, for example:<pre><code>\n         * var tpl = new Ext.Template('{value} * 10 = {value:math(\"* 10\")}');\n         * </code></pre>\n         * @return {Function} A function that operates on the passed value.\n         */\n        math : function(){\n            var fns = {};\n            \n            return function(v, a){\n                if (!fns[a]) {\n                    fns[a] = new Function('v', 'return v ' + a + ';');\n                }\n                return fns[a](v);\n            };\n        }(),\n\n        /**\n         * Rounds the passed number to the required decimal precision.\n         * @param {Number/String} value The numeric value to round.\n         * @param {Number} precision The number of decimal places to which to round the first parameter's value.\n         * @return {Number} The rounded value.\n         */\n        round : function(value, precision) {\n            var result = Number(value);\n            if (typeof precision == 'number') {\n                precision = Math.pow(10, precision);\n                result = Math.round(value * precision) / precision;\n            }\n            return result;\n        },\n\n        /**\n         * Formats the number according to the format string.\n         * <div style=\"margin-left:40px\">examples (123456.789):\n         * <div style=\"margin-left:10px\">\n         * 0 - (123456) show only digits, no precision<br>\n         * 0.00 - (123456.78) show only digits, 2 precision<br>\n         * 0.0000 - (123456.7890) show only digits, 4 precision<br>\n         * 0,000 - (123,456) show comma and digits, no precision<br>\n         * 0,000.00 - (123,456.78) show comma and digits, 2 precision<br>\n         * 0,0.00 - (123,456.78) shortcut method, show comma and digits, 2 precision<br>\n         * To reverse the grouping (,) and decimal (.) for international numbers, add /i to the end.\n         * For example: 0.000,00/i\n         * </div></div>\n         * @param {Number} v The number to format.\n         * @param {String} format The way you would like to format this text.\n         * @return {String} The formatted number.\n         */\n        number: function(v, format) {\n            if (!format) {\n                return v;\n            }\n            v = Ext.num(v, NaN);\n            if (isNaN(v)) {\n                return '';\n            }\n            var comma = ',',\n                dec   = '.',\n                i18n  = false,\n                neg   = v < 0;\n\n            v = Math.abs(v);\n            if (format.substr(format.length - 2) == '/i') {\n                format = format.substr(0, format.length - 2);\n                i18n   = true;\n                comma  = '.';\n                dec    = ',';\n            }\n\n            var hasComma = format.indexOf(comma) != -1,\n                psplit   = (i18n ? format.replace(/[^\\d\\,]/g, '') : format.replace(/[^\\d\\.]/g, '')).split(dec);\n\n            if (1 < psplit.length) {\n                v = v.toFixed(psplit[1].length);\n            } else if(2 < psplit.length) {\n                throw ('NumberFormatException: invalid format, formats should have no more than 1 period: ' + format);\n            } else {\n                v = v.toFixed(0);\n            }\n\n            var fnum = v.toString();\n\n            psplit = fnum.split('.');\n\n            if (hasComma) {\n                var cnum = psplit[0], \n                    parr = [], \n                    j    = cnum.length, \n                    m    = Math.floor(j / 3),\n                    n    = cnum.length % 3 || 3,\n                    i;\n\n                for (i = 0; i < j; i += n) {\n                    if (i != 0) {\n                        n = 3;\n                    }\n                    \n                    parr[parr.length] = cnum.substr(i, n);\n                    m -= 1;\n                }\n                fnum = parr.join(comma);\n                if (psplit[1]) {\n                    fnum += dec + psplit[1];\n                }\n            } else {\n                if (psplit[1]) {\n                    fnum = psplit[0] + dec + psplit[1];\n                }\n            }\n\n            return (neg ? '-' : '') + format.replace(/[\\d,?\\.?]+/, fnum);\n        },\n\n        /**\n         * Returns a number rendering function that can be reused to apply a number format multiple times efficiently\n         * @param {String} format Any valid number format string for {@link #number}\n         * @return {Function} The number formatting function\n         */\n        numberRenderer : function(format) {\n            return function(v) {\n                return Ext.util.Format.number(v, format);\n            };\n        },\n\n        /**\n         * Selectively do a plural form of a word based on a numeric value. For example, in a template,\n         * {commentCount:plural(\"Comment\")}  would result in \"1 Comment\" if commentCount was 1 or would be \"x Comments\"\n         * if the value is 0 or greater than 1.\n         * @param {Number} value The value to compare against\n         * @param {String} singular The singular form of the word\n         * @param {String} plural (optional) The plural form of the word (defaults to the singular with an \"s\")\n         */\n        plural : function(v, s, p) {\n            return v +' ' + (v == 1 ? s : (p ? p : s+'s'));\n        },\n\n        /**\n         * Converts newline characters to the HTML tag &lt;br/>\n         * @param {String} The string value to format.\n         * @return {String} The string with embedded &lt;br/> tags in place of newlines.\n         */\n        nl2br : function(v) {\n            return Ext.isEmpty(v) ? '' : v.replace(nl2brRe, '<br/>');\n        }\n    };\n}();\n/**\n * @class Ext.XTemplate\n * @extends Ext.Template\n * <p>A template class that supports advanced functionality like:<div class=\"mdetail-params\"><ul>\n * <li>Autofilling arrays using templates and sub-templates</li>\n * <li>Conditional processing with basic comparison operators</li>\n * <li>Basic math function support</li>\n * <li>Execute arbitrary inline code with special built-in template variables</li>\n * <li>Custom member functions</li>\n * <li>Many special tags and built-in operators that aren't defined as part of\n * the API, but are supported in the templates that can be created</li>\n * </ul></div></p>\n * <p>XTemplate provides the templating mechanism built into:<div class=\"mdetail-params\"><ul>\n * <li>{@link Ext.DataView}</li>\n * <li>{@link Ext.ListView}</li>\n * <li>{@link Ext.form.ComboBox}</li>\n * <li>{@link Ext.grid.TemplateColumn}</li>\n * <li>{@link Ext.grid.GroupingView}</li>\n * <li>{@link Ext.menu.Item}</li>\n * <li>{@link Ext.layout.MenuLayout}</li>\n * <li>{@link Ext.ColorPalette}</li>\n * </ul></div></p>\n *\n * <p>For example usage {@link #XTemplate see the constructor}.</p>\n *\n * @constructor\n * The {@link Ext.Template#Template Ext.Template constructor} describes\n * the acceptable parameters to pass to the constructor. The following\n * examples demonstrate all of the supported features.</p>\n *\n * <div class=\"mdetail-params\"><ul>\n *\n * <li><b><u>Sample Data</u></b>\n * <div class=\"sub-desc\">\n * <p>This is the data object used for reference in each code example:</p>\n * <pre><code>\nvar data = {\n    name: 'Jack Slocum',\n    title: 'Lead Developer',\n    company: 'Ext JS, LLC',\n    email: 'jack@extjs.com',\n    address: '4 Red Bulls Drive',\n    city: 'Cleveland',\n    state: 'Ohio',\n    zip: '44102',\n    drinks: ['Red Bull', 'Coffee', 'Water'],\n    kids: [{\n        name: 'Sara Grace',\n        age:3\n    },{\n        name: 'Zachary',\n        age:2\n    },{\n        name: 'John James',\n        age:0\n    }]\n};\n * </code></pre>\n * </div>\n * </li>\n *\n *\n * <li><b><u>Auto filling of arrays</u></b>\n * <div class=\"sub-desc\">\n * <p>The <b><tt>tpl</tt></b> tag and the <b><tt>for</tt></b> operator are used\n * to process the provided data object:\n * <ul>\n * <li>If the value specified in <tt>for</tt> is an array, it will auto-fill,\n * repeating the template block inside the <tt>tpl</tt> tag for each item in the\n * array.</li>\n * <li>If <tt>for=\".\"</tt> is specified, the data object provided is examined.</li>\n * <li>While processing an array, the special variable <tt>{#}</tt>\n * will provide the current array index + 1 (starts at 1, not 0).</li>\n * </ul>\n * </p>\n * <pre><code>\n&lt;tpl <b>for</b>=\".\">...&lt;/tpl>       // loop through array at root node\n&lt;tpl <b>for</b>=\"foo\">...&lt;/tpl>     // loop through array at foo node\n&lt;tpl <b>for</b>=\"foo.bar\">...&lt;/tpl> // loop through array at foo.bar node\n * </code></pre>\n * Using the sample data above:\n * <pre><code>\nvar tpl = new Ext.XTemplate(\n    '&lt;p>Kids: ',\n    '&lt;tpl <b>for</b>=\".\">',       // process the data.kids node\n        '&lt;p>{#}. {name}&lt;/p>',  // use current array index to autonumber\n    '&lt;/tpl>&lt;/p>'\n);\ntpl.overwrite(panel.body, data.kids); // pass the kids property of the data object\n * </code></pre>\n * <p>An example illustrating how the <b><tt>for</tt></b> property can be leveraged\n * to access specified members of the provided data object to populate the template:</p>\n * <pre><code>\nvar tpl = new Ext.XTemplate(\n    '&lt;p>Name: {name}&lt;/p>',\n    '&lt;p>Title: {title}&lt;/p>',\n    '&lt;p>Company: {company}&lt;/p>',\n    '&lt;p>Kids: ',\n    '&lt;tpl <b>for=\"kids\"</b>>',     // interrogate the kids property within the data\n        '&lt;p>{name}&lt;/p>',\n    '&lt;/tpl>&lt;/p>'\n);\ntpl.overwrite(panel.body, data);  // pass the root node of the data object\n * </code></pre>\n * <p>Flat arrays that contain values (and not objects) can be auto-rendered\n * using the special <b><tt>{.}</tt></b> variable inside a loop.  This variable\n * will represent the value of the array at the current index:</p>\n * <pre><code>\nvar tpl = new Ext.XTemplate(\n    '&lt;p>{name}\\&#39;s favorite beverages:&lt;/p>',\n    '&lt;tpl for=\"drinks\">',\n       '&lt;div> - {.}&lt;/div>',\n    '&lt;/tpl>'\n);\ntpl.overwrite(panel.body, data);\n * </code></pre>\n * <p>When processing a sub-template, for example while looping through a child array,\n * you can access the parent object's members via the <b><tt>parent</tt></b> object:</p>\n * <pre><code>\nvar tpl = new Ext.XTemplate(\n    '&lt;p>Name: {name}&lt;/p>',\n    '&lt;p>Kids: ',\n    '&lt;tpl for=\"kids\">',\n        '&lt;tpl if=\"age > 1\">',\n            '&lt;p>{name}&lt;/p>',\n            '&lt;p>Dad: {<b>parent</b>.name}&lt;/p>',\n        '&lt;/tpl>',\n    '&lt;/tpl>&lt;/p>'\n);\ntpl.overwrite(panel.body, data);\n * </code></pre>\n * </div>\n * </li>\n *\n *\n * <li><b><u>Conditional processing with basic comparison operators</u></b>\n * <div class=\"sub-desc\">\n * <p>The <b><tt>tpl</tt></b> tag and the <b><tt>if</tt></b> operator are used\n * to provide conditional checks for deciding whether or not to render specific\n * parts of the template. Notes:<div class=\"sub-desc\"><ul>\n * <li>Double quotes must be encoded if used within the conditional</li>\n * <li>There is no <tt>else</tt> operator &mdash; if needed, two opposite\n * <tt>if</tt> statements should be used.</li>\n * </ul></div>\n * <pre><code>\n&lt;tpl if=\"age &gt; 1 &amp;&amp; age &lt; 10\">Child&lt;/tpl>\n&lt;tpl if=\"age >= 10 && age < 18\">Teenager&lt;/tpl>\n&lt;tpl <b>if</b>=\"this.isGirl(name)\">...&lt;/tpl>\n&lt;tpl <b>if</b>=\"id==\\'download\\'\">...&lt;/tpl>\n&lt;tpl <b>if</b>=\"needsIcon\">&lt;img src=\"{icon}\" class=\"{iconCls}\"/>&lt;/tpl>\n// no good:\n&lt;tpl if=\"name == \"Jack\"\">Hello&lt;/tpl>\n// encode &#34; if it is part of the condition, e.g.\n&lt;tpl if=\"name == &#38;quot;Jack&#38;quot;\">Hello&lt;/tpl>\n * </code></pre>\n * Using the sample data above:\n * <pre><code>\nvar tpl = new Ext.XTemplate(\n    '&lt;p>Name: {name}&lt;/p>',\n    '&lt;p>Kids: ',\n    '&lt;tpl for=\"kids\">',\n        '&lt;tpl if=\"age > 1\">',\n            '&lt;p>{name}&lt;/p>',\n        '&lt;/tpl>',\n    '&lt;/tpl>&lt;/p>'\n);\ntpl.overwrite(panel.body, data);\n * </code></pre>\n * </div>\n * </li>\n *\n *\n * <li><b><u>Basic math support</u></b>\n * <div class=\"sub-desc\">\n * <p>The following basic math operators may be applied directly on numeric\n * data values:</p><pre>\n * + - * /\n * </pre>\n * For example:\n * <pre><code>\nvar tpl = new Ext.XTemplate(\n    '&lt;p>Name: {name}&lt;/p>',\n    '&lt;p>Kids: ',\n    '&lt;tpl for=\"kids\">',\n        '&lt;tpl if=\"age &amp;gt; 1\">',  // <-- Note that the &gt; is encoded\n            '&lt;p>{#}: {name}&lt;/p>',  // <-- Auto-number each item\n            '&lt;p>In 5 Years: {age+5}&lt;/p>',  // <-- Basic math\n            '&lt;p>Dad: {parent.name}&lt;/p>',\n        '&lt;/tpl>',\n    '&lt;/tpl>&lt;/p>'\n);\ntpl.overwrite(panel.body, data);\n</code></pre>\n * </div>\n * </li>\n *\n *\n * <li><b><u>Execute arbitrary inline code with special built-in template variables</u></b>\n * <div class=\"sub-desc\">\n * <p>Anything between <code>{[ ... ]}</code> is considered code to be executed\n * in the scope of the template. There are some special variables available in that code:\n * <ul>\n * <li><b><tt>values</tt></b>: The values in the current scope. If you are using\n * scope changing sub-templates, you can change what <tt>values</tt> is.</li>\n * <li><b><tt>parent</tt></b>: The scope (values) of the ancestor template.</li>\n * <li><b><tt>xindex</tt></b>: If you are in a looping template, the index of the\n * loop you are in (1-based).</li>\n * <li><b><tt>xcount</tt></b>: If you are in a looping template, the total length\n * of the array you are looping.</li>\n * <li><b><tt>fm</tt></b>: An alias for <tt>Ext.util.Format</tt>.</li>\n * </ul>\n * This example demonstrates basic row striping using an inline code block and the\n * <tt>xindex</tt> variable:</p>\n * <pre><code>\nvar tpl = new Ext.XTemplate(\n    '&lt;p>Name: {name}&lt;/p>',\n    '&lt;p>Company: {[values.company.toUpperCase() + \", \" + values.title]}&lt;/p>',\n    '&lt;p>Kids: ',\n    '&lt;tpl for=\"kids\">',\n       '&lt;div class=\"{[xindex % 2 === 0 ? \"even\" : \"odd\"]}\">',\n        '{name}',\n        '&lt;/div>',\n    '&lt;/tpl>&lt;/p>'\n);\ntpl.overwrite(panel.body, data);\n * </code></pre>\n * </div>\n * </li>\n *\n * <li><b><u>Template member functions</u></b>\n * <div class=\"sub-desc\">\n * <p>One or more member functions can be specified in a configuration\n * object passed into the XTemplate constructor for more complex processing:</p>\n * <pre><code>\nvar tpl = new Ext.XTemplate(\n    '&lt;p>Name: {name}&lt;/p>',\n    '&lt;p>Kids: ',\n    '&lt;tpl for=\"kids\">',\n        '&lt;tpl if=\"this.isGirl(name)\">',\n            '&lt;p>Girl: {name} - {age}&lt;/p>',\n        '&lt;/tpl>',\n        // use opposite if statement to simulate 'else' processing:\n        '&lt;tpl if=\"this.isGirl(name) == false\">',\n            '&lt;p>Boy: {name} - {age}&lt;/p>',\n        '&lt;/tpl>',\n        '&lt;tpl if=\"this.isBaby(age)\">',\n            '&lt;p>{name} is a baby!&lt;/p>',\n        '&lt;/tpl>',\n    '&lt;/tpl>&lt;/p>',\n    {\n        // XTemplate configuration:\n        compiled: true,\n        disableFormats: true,\n        // member functions:\n        isGirl: function(name){\n            return name == 'Sara Grace';\n        },\n        isBaby: function(age){\n            return age < 1;\n        }\n    }\n);\ntpl.overwrite(panel.body, data);\n * </code></pre>\n * </div>\n * </li>\n *\n * </ul></div>\n *\n * @param {Mixed} config\n */\nExt.XTemplate = function(){\n    Ext.XTemplate.superclass.constructor.apply(this, arguments);\n\n    var me = this,\n        s = me.html,\n        re = /<tpl\\b[^>]*>((?:(?=([^<]+))\\2|<(?!tpl\\b[^>]*>))*?)<\\/tpl>/,\n        nameRe = /^<tpl\\b[^>]*?for=\"(.*?)\"/,\n        ifRe = /^<tpl\\b[^>]*?if=\"(.*?)\"/,\n        execRe = /^<tpl\\b[^>]*?exec=\"(.*?)\"/,\n        m,\n        id = 0,\n        tpls = [],\n        VALUES = 'values',\n        PARENT = 'parent',\n        XINDEX = 'xindex',\n        XCOUNT = 'xcount',\n        RETURN = 'return ',\n        WITHVALUES = 'with(values){ ';\n\n    s = ['<tpl>', s, '</tpl>'].join('');\n\n    while((m = s.match(re))){\n        var m2 = m[0].match(nameRe),\n            m3 = m[0].match(ifRe),\n            m4 = m[0].match(execRe),\n            exp = null,\n            fn = null,\n            exec = null,\n            name = m2 && m2[1] ? m2[1] : '';\n\n       if (m3) {\n           exp = m3 && m3[1] ? m3[1] : null;\n           if(exp){\n               fn = new Function(VALUES, PARENT, XINDEX, XCOUNT, WITHVALUES + RETURN +(Ext.util.Format.htmlDecode(exp))+'; }');\n           }\n       }\n       if (m4) {\n           exp = m4 && m4[1] ? m4[1] : null;\n           if(exp){\n               exec = new Function(VALUES, PARENT, XINDEX, XCOUNT, WITHVALUES +(Ext.util.Format.htmlDecode(exp))+'; }');\n           }\n       }\n       if(name){\n           switch(name){\n               case '.': name = new Function(VALUES, PARENT, WITHVALUES + RETURN + VALUES + '; }'); break;\n               case '..': name = new Function(VALUES, PARENT, WITHVALUES + RETURN + PARENT + '; }'); break;\n               default: name = new Function(VALUES, PARENT, WITHVALUES + RETURN + name + '; }');\n           }\n       }\n       tpls.push({\n            id: id,\n            target: name,\n            exec: exec,\n            test: fn,\n            body: m[1]||''\n        });\n       s = s.replace(m[0], '{xtpl'+ id + '}');\n       ++id;\n    }\n    for(var i = tpls.length-1; i >= 0; --i){\n        me.compileTpl(tpls[i]);\n    }\n    me.master = tpls[tpls.length-1];\n    me.tpls = tpls;\n};\nExt.extend(Ext.XTemplate, Ext.Template, {\n    // private\n    re : /\\{([\\w\\-\\.\\#]+)(?:\\:([\\w\\.]*)(?:\\((.*?)?\\))?)?(\\s?[\\+\\-\\*\\\\]\\s?[\\d\\.\\+\\-\\*\\\\\\(\\)]+)?\\}/g,\n    // private\n    codeRe : /\\{\\[((?:\\\\\\]|.|\\n)*?)\\]\\}/g,\n\n    // private\n    applySubTemplate : function(id, values, parent, xindex, xcount){\n        var me = this,\n            len,\n            t = me.tpls[id],\n            vs,\n            buf = [];\n        if ((t.test && !t.test.call(me, values, parent, xindex, xcount)) ||\n            (t.exec && t.exec.call(me, values, parent, xindex, xcount))) {\n            return '';\n        }\n        vs = t.target ? t.target.call(me, values, parent) : values;\n        len = vs.length;\n        parent = t.target ? values : parent;\n        if(t.target && Ext.isArray(vs)){\n            for(var i = 0, len = vs.length; i < len; i++){\n                buf[buf.length] = t.compiled.call(me, vs[i], parent, i+1, len);\n            }\n            return buf.join('');\n        }\n        return t.compiled.call(me, vs, parent, xindex, xcount);\n    },\n\n    // private\n    compileTpl : function(tpl){\n        var fm = Ext.util.Format,\n            useF = this.disableFormats !== true,\n            sep = Ext.isGecko ? \"+\" : \",\",\n            body;\n\n        function fn(m, name, format, args, math){\n            if(name.substr(0, 4) == 'xtpl'){\n                return \"'\"+ sep +'this.applySubTemplate('+name.substr(4)+', values, parent, xindex, xcount)'+sep+\"'\";\n            }\n            var v;\n            if(name === '.'){\n                v = 'values';\n            }else if(name === '#'){\n                v = 'xindex';\n            }else if(name.indexOf('.') != -1){\n                v = name;\n            }else{\n                v = \"values['\" + name + \"']\";\n            }\n            if(math){\n                v = '(' + v + math + ')';\n            }\n            if (format && useF) {\n                args = args ? ',' + args : \"\";\n                if(format.substr(0, 5) != \"this.\"){\n                    format = \"fm.\" + format + '(';\n                }else{\n                    format = 'this.call(\"'+ format.substr(5) + '\", ';\n                    args = \", values\";\n                }\n            } else {\n                args= ''; format = \"(\"+v+\" === undefined ? '' : \";\n            }\n            return \"'\"+ sep + format + v + args + \")\"+sep+\"'\";\n        }\n\n        function codeFn(m, code){\n            // Single quotes get escaped when the template is compiled, however we want to undo this when running code.\n            return \"'\" + sep + '(' + code.replace(/\\\\'/g, \"'\") + ')' + sep + \"'\";\n        }\n\n        // branched to use + in gecko and [].join() in others\n        if(Ext.isGecko){\n            body = \"tpl.compiled = function(values, parent, xindex, xcount){ return '\" +\n                   tpl.body.replace(/(\\r\\n|\\n)/g, '\\\\n').replace(/'/g, \"\\\\'\").replace(this.re, fn).replace(this.codeRe, codeFn) +\n                    \"';};\";\n        }else{\n            body = [\"tpl.compiled = function(values, parent, xindex, xcount){ return ['\"];\n            body.push(tpl.body.replace(/(\\r\\n|\\n)/g, '\\\\n').replace(/'/g, \"\\\\'\").replace(this.re, fn).replace(this.codeRe, codeFn));\n            body.push(\"'].join('');};\");\n            body = body.join('');\n        }\n        eval(body);\n        return this;\n    },\n\n    /**\n     * Returns an HTML fragment of this template with the specified values applied.\n     * @param {Object} values The template values. Can be an array if your params are numeric (i.e. {0}) or an object (i.e. {foo: 'bar'})\n     * @return {String} The HTML fragment\n     */\n    applyTemplate : function(values){\n        return this.master.compiled.call(this, values, {}, 1, 1);\n    },\n\n    /**\n     * Compile the template to a function for optimized performance.  Recommended if the template will be used frequently.\n     * @return {Function} The compiled function\n     */\n    compile : function(){return this;}\n\n    /**\n     * @property re\n     * @hide\n     */\n    /**\n     * @property disableFormats\n     * @hide\n     */\n    /**\n     * @method set\n     * @hide\n     */\n\n});\n/**\n * Alias for {@link #applyTemplate}\n * Returns an HTML fragment of this template with the specified values applied.\n * @param {Object/Array} values The template values. Can be an array if your params are numeric (i.e. {0}) or an object (i.e. {foo: 'bar'})\n * @return {String} The HTML fragment\n * @member Ext.XTemplate\n * @method apply\n */\nExt.XTemplate.prototype.apply = Ext.XTemplate.prototype.applyTemplate;\n\n/**\n * Creates a template from the passed element's value (<i>display:none</i> textarea, preferred) or innerHTML.\n * @param {String/HTMLElement} el A DOM element or its id\n * @return {Ext.Template} The created template\n * @static\n */\nExt.XTemplate.from = function(el){\n    el = Ext.getDom(el);\n    return new Ext.XTemplate(el.value || el.innerHTML);\n};\n/**\n * @class Ext.util.CSS\n * Utility class for manipulating CSS rules\n * @singleton\n */\nExt.util.CSS = function(){\n\tvar rules = null;\n   \tvar doc = document;\n\n    var camelRe = /(-[a-z])/gi;\n    var camelFn = function(m, a){ return a.charAt(1).toUpperCase(); };\n\n   return {\n   /**\n    * Creates a stylesheet from a text blob of rules.\n    * These rules will be wrapped in a STYLE tag and appended to the HEAD of the document.\n    * @param {String} cssText The text containing the css rules\n    * @param {String} id An id to add to the stylesheet for later removal\n    * @return {StyleSheet}\n    */\n   createStyleSheet : function(cssText, id){\n       var ss;\n       var head = doc.getElementsByTagName(\"head\")[0];\n       var rules = doc.createElement(\"style\");\n       rules.setAttribute(\"type\", \"text/css\");\n       if(id){\n           rules.setAttribute(\"id\", id);\n       }\n       if(Ext.isIE){\n           head.appendChild(rules);\n           ss = rules.styleSheet;\n           ss.cssText = cssText;\n       }else{\n           try{\n                rules.appendChild(doc.createTextNode(cssText));\n           }catch(e){\n               rules.cssText = cssText;\n           }\n           head.appendChild(rules);\n           ss = rules.styleSheet ? rules.styleSheet : (rules.sheet || doc.styleSheets[doc.styleSheets.length-1]);\n       }\n       this.cacheStyleSheet(ss);\n       return ss;\n   },\n\n   /**\n    * Removes a style or link tag by id\n    * @param {String} id The id of the tag\n    */\n   removeStyleSheet : function(id){\n       var existing = doc.getElementById(id);\n       if(existing){\n           existing.parentNode.removeChild(existing);\n       }\n   },\n\n   /**\n    * Dynamically swaps an existing stylesheet reference for a new one\n    * @param {String} id The id of an existing link tag to remove\n    * @param {String} url The href of the new stylesheet to include\n    */\n   swapStyleSheet : function(id, url){\n       this.removeStyleSheet(id);\n       var ss = doc.createElement(\"link\");\n       ss.setAttribute(\"rel\", \"stylesheet\");\n       ss.setAttribute(\"type\", \"text/css\");\n       ss.setAttribute(\"id\", id);\n       ss.setAttribute(\"href\", url);\n       doc.getElementsByTagName(\"head\")[0].appendChild(ss);\n   },\n   \n   /**\n    * Refresh the rule cache if you have dynamically added stylesheets\n    * @return {Object} An object (hash) of rules indexed by selector\n    */\n   refreshCache : function(){\n       return this.getRules(true);\n   },\n\n   // private\n   cacheStyleSheet : function(ss){\n       if(!rules){\n           rules = {};\n       }\n       try{// try catch for cross domain access issue\n           var ssRules = ss.cssRules || ss.rules;\n           for(var j = ssRules.length-1; j >= 0; --j){\n               rules[ssRules[j].selectorText.toLowerCase()] = ssRules[j];\n           }\n       }catch(e){}\n   },\n   \n   /**\n    * Gets all css rules for the document\n    * @param {Boolean} refreshCache true to refresh the internal cache\n    * @return {Object} An object (hash) of rules indexed by selector\n    */\n   getRules : function(refreshCache){\n   \t\tif(rules === null || refreshCache){\n   \t\t\trules = {};\n   \t\t\tvar ds = doc.styleSheets;\n   \t\t\tfor(var i =0, len = ds.length; i < len; i++){\n   \t\t\t    try{\n    \t\t        this.cacheStyleSheet(ds[i]);\n    \t\t    }catch(e){} \n\t        }\n   \t\t}\n   \t\treturn rules;\n   \t},\n   \t\n   \t/**\n    * Gets an an individual CSS rule by selector(s)\n    * @param {String/Array} selector The CSS selector or an array of selectors to try. The first selector that is found is returned.\n    * @param {Boolean} refreshCache true to refresh the internal cache if you have recently updated any rules or added styles dynamically\n    * @return {CSSRule} The CSS rule or null if one is not found\n    */\n   getRule : function(selector, refreshCache){\n   \t\tvar rs = this.getRules(refreshCache);\n   \t\tif(!Ext.isArray(selector)){\n   \t\t    return rs[selector.toLowerCase()];\n   \t\t}\n   \t\tfor(var i = 0; i < selector.length; i++){\n\t\t\tif(rs[selector[i]]){\n\t\t\t\treturn rs[selector[i].toLowerCase()];\n\t\t\t}\n\t\t}\n\t\treturn null;\n   \t},\n   \t\n   \t\n   \t/**\n    * Updates a rule property\n    * @param {String/Array} selector If it's an array it tries each selector until it finds one. Stops immediately once one is found.\n    * @param {String} property The css property\n    * @param {String} value The new value for the property\n    * @return {Boolean} true If a rule was found and updated\n    */\n   updateRule : function(selector, property, value){\n   \t\tif(!Ext.isArray(selector)){\n   \t\t\tvar rule = this.getRule(selector);\n   \t\t\tif(rule){\n   \t\t\t\trule.style[property.replace(camelRe, camelFn)] = value;\n   \t\t\t\treturn true;\n   \t\t\t}\n   \t\t}else{\n   \t\t\tfor(var i = 0; i < selector.length; i++){\n   \t\t\t\tif(this.updateRule(selector[i], property, value)){\n   \t\t\t\t\treturn true;\n   \t\t\t\t}\n   \t\t\t}\n   \t\t}\n   \t\treturn false;\n   \t}\n   };\t\n}();/**\n @class Ext.util.ClickRepeater\n @extends Ext.util.Observable\n\n A wrapper class which can be applied to any element. Fires a \"click\" event while the\n mouse is pressed. The interval between firings may be specified in the config but\n defaults to 20 milliseconds.\n\n Optionally, a CSS class may be applied to the element during the time it is pressed.\n\n @cfg {Mixed} el The element to act as a button.\n @cfg {Number} delay The initial delay before the repeating event begins firing.\n Similar to an autorepeat key delay.\n @cfg {Number} interval The interval between firings of the \"click\" event. Default 20 ms.\n @cfg {String} pressClass A CSS class name to be applied to the element while pressed.\n @cfg {Boolean} accelerate True if autorepeating should start slowly and accelerate.\n           \"interval\" and \"delay\" are ignored.\n @cfg {Boolean} preventDefault True to prevent the default click event\n @cfg {Boolean} stopDefault True to stop the default click event\n\n @history\n    2007-02-02 jvs Original code contributed by Nige \"Animal\" White\n    2007-02-02 jvs Renamed to ClickRepeater\n    2007-02-03 jvs Modifications for FF Mac and Safari\n\n @constructor\n @param {Mixed} el The element to listen on\n @param {Object} config\n */\nExt.util.ClickRepeater = Ext.extend(Ext.util.Observable, {\n    \n    constructor : function(el, config){\n        this.el = Ext.get(el);\n        this.el.unselectable();\n\n        Ext.apply(this, config);\n\n        this.addEvents(\n        /**\n         * @event mousedown\n         * Fires when the mouse button is depressed.\n         * @param {Ext.util.ClickRepeater} this\n         * @param {Ext.EventObject} e\n         */\n        \"mousedown\",\n        /**\n         * @event click\n         * Fires on a specified interval during the time the element is pressed.\n         * @param {Ext.util.ClickRepeater} this\n         * @param {Ext.EventObject} e\n         */\n        \"click\",\n        /**\n         * @event mouseup\n         * Fires when the mouse key is released.\n         * @param {Ext.util.ClickRepeater} this\n         * @param {Ext.EventObject} e\n         */\n        \"mouseup\"\n        );\n\n        if(!this.disabled){\n            this.disabled = true;\n            this.enable();\n        }\n\n        // allow inline handler\n        if(this.handler){\n            this.on(\"click\", this.handler,  this.scope || this);\n        }\n\n        Ext.util.ClickRepeater.superclass.constructor.call(this);        \n    },\n    \n    interval : 20,\n    delay: 250,\n    preventDefault : true,\n    stopDefault : false,\n    timer : 0,\n\n    /**\n     * Enables the repeater and allows events to fire.\n     */\n    enable: function(){\n        if(this.disabled){\n            this.el.on('mousedown', this.handleMouseDown, this);\n            if (Ext.isIE){\n                this.el.on('dblclick', this.handleDblClick, this);\n            }\n            if(this.preventDefault || this.stopDefault){\n                this.el.on('click', this.eventOptions, this);\n            }\n        }\n        this.disabled = false;\n    },\n\n    /**\n     * Disables the repeater and stops events from firing.\n     */\n    disable: function(/* private */ force){\n        if(force || !this.disabled){\n            clearTimeout(this.timer);\n            if(this.pressClass){\n                this.el.removeClass(this.pressClass);\n            }\n            Ext.getDoc().un('mouseup', this.handleMouseUp, this);\n            this.el.removeAllListeners();\n        }\n        this.disabled = true;\n    },\n\n    /**\n     * Convenience function for setting disabled/enabled by boolean.\n     * @param {Boolean} disabled\n     */\n    setDisabled: function(disabled){\n        this[disabled ? 'disable' : 'enable']();\n    },\n\n    eventOptions: function(e){\n        if(this.preventDefault){\n            e.preventDefault();\n        }\n        if(this.stopDefault){\n            e.stopEvent();\n        }\n    },\n\n    // private\n    destroy : function() {\n        this.disable(true);\n        Ext.destroy(this.el);\n        this.purgeListeners();\n    },\n\n    handleDblClick : function(e){\n        clearTimeout(this.timer);\n        this.el.blur();\n\n        this.fireEvent(\"mousedown\", this, e);\n        this.fireEvent(\"click\", this, e);\n    },\n\n    // private\n    handleMouseDown : function(e){\n        clearTimeout(this.timer);\n        this.el.blur();\n        if(this.pressClass){\n            this.el.addClass(this.pressClass);\n        }\n        this.mousedownTime = new Date();\n\n        Ext.getDoc().on(\"mouseup\", this.handleMouseUp, this);\n        this.el.on(\"mouseout\", this.handleMouseOut, this);\n\n        this.fireEvent(\"mousedown\", this, e);\n        this.fireEvent(\"click\", this, e);\n\n        // Do not honor delay or interval if acceleration wanted.\n        if (this.accelerate) {\n            this.delay = 400;\n        }\n        this.timer = this.click.defer(this.delay || this.interval, this, [e]);\n    },\n\n    // private\n    click : function(e){\n        this.fireEvent(\"click\", this, e);\n        this.timer = this.click.defer(this.accelerate ?\n            this.easeOutExpo(this.mousedownTime.getElapsed(),\n                400,\n                -390,\n                12000) :\n            this.interval, this, [e]);\n    },\n\n    easeOutExpo : function (t, b, c, d) {\n        return (t==d) ? b+c : c * (-Math.pow(2, -10 * t/d) + 1) + b;\n    },\n\n    // private\n    handleMouseOut : function(){\n        clearTimeout(this.timer);\n        if(this.pressClass){\n            this.el.removeClass(this.pressClass);\n        }\n        this.el.on(\"mouseover\", this.handleMouseReturn, this);\n    },\n\n    // private\n    handleMouseReturn : function(){\n        this.el.un(\"mouseover\", this.handleMouseReturn, this);\n        if(this.pressClass){\n            this.el.addClass(this.pressClass);\n        }\n        this.click();\n    },\n\n    // private\n    handleMouseUp : function(e){\n        clearTimeout(this.timer);\n        this.el.un(\"mouseover\", this.handleMouseReturn, this);\n        this.el.un(\"mouseout\", this.handleMouseOut, this);\n        Ext.getDoc().un(\"mouseup\", this.handleMouseUp, this);\n        this.el.removeClass(this.pressClass);\n        this.fireEvent(\"mouseup\", this, e);\n    }\n});/**\n * @class Ext.KeyNav\n * <p>Provides a convenient wrapper for normalized keyboard navigation.  KeyNav allows you to bind\n * navigation keys to function calls that will get called when the keys are pressed, providing an easy\n * way to implement custom navigation schemes for any UI component.</p>\n * <p>The following are all of the possible keys that can be implemented: enter, left, right, up, down, tab, esc,\n * pageUp, pageDown, del, home, end.  Usage:</p>\n <pre><code>\nvar nav = new Ext.KeyNav(\"my-element\", {\n    \"left\" : function(e){\n        this.moveLeft(e.ctrlKey);\n    },\n    \"right\" : function(e){\n        this.moveRight(e.ctrlKey);\n    },\n    \"enter\" : function(e){\n        this.save();\n    },\n    scope : this\n});\n</code></pre>\n * @constructor\n * @param {Mixed} el The element to bind to\n * @param {Object} config The config\n */\nExt.KeyNav = function(el, config){\n    this.el = Ext.get(el);\n    Ext.apply(this, config);\n    if(!this.disabled){\n        this.disabled = true;\n        this.enable();\n    }\n};\n\nExt.KeyNav.prototype = {\n    /**\n     * @cfg {Boolean} disabled\n     * True to disable this KeyNav instance (defaults to false)\n     */\n    disabled : false,\n    /**\n     * @cfg {String} defaultEventAction\n     * The method to call on the {@link Ext.EventObject} after this KeyNav intercepts a key.  Valid values are\n     * {@link Ext.EventObject#stopEvent}, {@link Ext.EventObject#preventDefault} and\n     * {@link Ext.EventObject#stopPropagation} (defaults to 'stopEvent')\n     */\n    defaultEventAction: \"stopEvent\",\n    /**\n     * @cfg {Boolean} forceKeyDown\n     * Handle the keydown event instead of keypress (defaults to false).  KeyNav automatically does this for IE since\n     * IE does not propagate special keys on keypress, but setting this to true will force other browsers to also\n     * handle keydown instead of keypress.\n     */\n    forceKeyDown : false,\n\n    // private\n    relay : function(e){\n        var k = e.getKey(),\n            h = this.keyToHandler[k];\n        if(h && this[h]){\n            if(this.doRelay(e, this[h], h) !== true){\n                e[this.defaultEventAction]();\n            }\n        }\n    },\n\n    // private\n    doRelay : function(e, h, hname){\n        return h.call(this.scope || this, e, hname);\n    },\n\n    // possible handlers\n    enter : false,\n    left : false,\n    right : false,\n    up : false,\n    down : false,\n    tab : false,\n    esc : false,\n    pageUp : false,\n    pageDown : false,\n    del : false,\n    home : false,\n    end : false,\n    space : false,\n\n    // quick lookup hash\n    keyToHandler : {\n        37 : \"left\",\n        39 : \"right\",\n        38 : \"up\",\n        40 : \"down\",\n        33 : \"pageUp\",\n        34 : \"pageDown\",\n        46 : \"del\",\n        36 : \"home\",\n        35 : \"end\",\n        13 : \"enter\",\n        27 : \"esc\",\n        9  : \"tab\",\n        32 : \"space\"\n    },\n    \n    stopKeyUp: function(e) {\n        var k = e.getKey();\n\n        if (k >= 37 && k <= 40) {\n            // *** bugfix - safari 2.x fires 2 keyup events on cursor keys\n            // *** (note: this bugfix sacrifices the \"keyup\" event originating from keyNav elements in Safari 2)\n            e.stopEvent();\n        }\n    },\n    \n    /**\n     * Destroy this KeyNav (this is the same as calling disable).\n     */\n    destroy: function(){\n        this.disable();    \n    },\n\n\t/**\n\t * Enable this KeyNav\n\t */\n\tenable: function() {\n        if (this.disabled) {\n            if (Ext.isSafari2) {\n                // call stopKeyUp() on \"keyup\" event\n                this.el.on('keyup', this.stopKeyUp, this);\n            }\n\n            this.el.on(this.isKeydown()? 'keydown' : 'keypress', this.relay, this);\n            this.disabled = false;\n        }\n    },\n\n\t/**\n\t * Disable this KeyNav\n\t */\n\tdisable: function() {\n        if (!this.disabled) {\n            if (Ext.isSafari2) {\n                // remove \"keyup\" event handler\n                this.el.un('keyup', this.stopKeyUp, this);\n            }\n\n            this.el.un(this.isKeydown()? 'keydown' : 'keypress', this.relay, this);\n            this.disabled = true;\n        }\n    },\n    \n    /**\n     * Convenience function for setting disabled/enabled by boolean.\n     * @param {Boolean} disabled\n     */\n    setDisabled : function(disabled){\n        this[disabled ? \"disable\" : \"enable\"]();\n    },\n    \n    // private\n    isKeydown: function(){\n        return this.forceKeyDown || Ext.EventManager.useKeydown;\n    }\n};\n/**\n * @class Ext.KeyMap\n * Handles mapping keys to actions for an element. One key map can be used for multiple actions.\n * The constructor accepts the same config object as defined by {@link #addBinding}.\n * If you bind a callback function to a KeyMap, anytime the KeyMap handles an expected key\n * combination it will call the function with this signature (if the match is a multi-key\n * combination the callback will still be called only once): (String key, Ext.EventObject e)\n * A KeyMap can also handle a string representation of keys.<br />\n * Usage:\n <pre><code>\n// map one key by key code\nvar map = new Ext.KeyMap(\"my-element\", {\n    key: 13, // or Ext.EventObject.ENTER\n    fn: myHandler,\n    scope: myObject\n});\n\n// map multiple keys to one action by string\nvar map = new Ext.KeyMap(\"my-element\", {\n    key: \"a\\r\\n\\t\",\n    fn: myHandler,\n    scope: myObject\n});\n\n// map multiple keys to multiple actions by strings and array of codes\nvar map = new Ext.KeyMap(\"my-element\", [\n    {\n        key: [10,13],\n        fn: function(){ alert(\"Return was pressed\"); }\n    }, {\n        key: \"abc\",\n        fn: function(){ alert('a, b or c was pressed'); }\n    }, {\n        key: \"\\t\",\n        ctrl:true,\n        shift:true,\n        fn: function(){ alert('Control + shift + tab was pressed.'); }\n    }\n]);\n</code></pre>\n * <b>Note: A KeyMap starts enabled</b>\n * @constructor\n * @param {Mixed} el The element to bind to\n * @param {Object} config The config (see {@link #addBinding})\n * @param {String} eventName (optional) The event to bind to (defaults to \"keydown\")\n */\nExt.KeyMap = function(el, config, eventName){\n    this.el  = Ext.get(el);\n    this.eventName = eventName || \"keydown\";\n    this.bindings = [];\n    if(config){\n        this.addBinding(config);\n    }\n    this.enable();\n};\n\nExt.KeyMap.prototype = {\n    /**\n     * True to stop the event from bubbling and prevent the default browser action if the\n     * key was handled by the KeyMap (defaults to false)\n     * @type Boolean\n     */\n    stopEvent : false,\n\n    /**\n     * Add a new binding to this KeyMap. The following config object properties are supported:\n     * <pre>\nProperty    Type             Description\n----------  ---------------  ----------------------------------------------------------------------\nkey         String/Array     A single keycode or an array of keycodes to handle\nshift       Boolean          True to handle key only when shift is pressed, False to handle the key only when shift is not pressed (defaults to undefined)\nctrl        Boolean          True to handle key only when ctrl is pressed, False to handle the key only when ctrl is not pressed (defaults to undefined)\nalt         Boolean          True to handle key only when alt is pressed, False to handle the key only when alt is not pressed (defaults to undefined)\nhandler     Function         The function to call when KeyMap finds the expected key combination\nfn          Function         Alias of handler (for backwards-compatibility)\nscope       Object           The scope of the callback function\nstopEvent   Boolean          True to stop the event from bubbling and prevent the default browser action if the key was handled by the KeyMap (defaults to false)\n</pre>\n     *\n     * Usage:\n     * <pre><code>\n// Create a KeyMap\nvar map = new Ext.KeyMap(document, {\n    key: Ext.EventObject.ENTER,\n    fn: handleKey,\n    scope: this\n});\n\n//Add a new binding to the existing KeyMap later\nmap.addBinding({\n    key: 'abc',\n    shift: true,\n    fn: handleKey,\n    scope: this\n});\n</code></pre>\n     * @param {Object/Array} config A single KeyMap config or an array of configs\n     */\n\taddBinding : function(config){\n        if(Ext.isArray(config)){\n            Ext.each(config, function(c){\n                this.addBinding(c);\n            }, this);\n            return;\n        }\n        var keyCode = config.key,\n            fn = config.fn || config.handler,\n            scope = config.scope;\n\n\tif (config.stopEvent) {\n\t    this.stopEvent = config.stopEvent;    \n\t}\t\n\n        if(typeof keyCode == \"string\"){\n            var ks = [];\n            var keyString = keyCode.toUpperCase();\n            for(var j = 0, len = keyString.length; j < len; j++){\n                ks.push(keyString.charCodeAt(j));\n            }\n            keyCode = ks;\n        }\n        var keyArray = Ext.isArray(keyCode);\n        \n        var handler = function(e){\n            if(this.checkModifiers(config, e)){\n                var k = e.getKey();\n                if(keyArray){\n                    for(var i = 0, len = keyCode.length; i < len; i++){\n                        if(keyCode[i] == k){\n                          if(this.stopEvent){\n                              e.stopEvent();\n                          }\n                          fn.call(scope || window, k, e);\n                          return;\n                        }\n                    }\n                }else{\n                    if(k == keyCode){\n                        if(this.stopEvent){\n                           e.stopEvent();\n                        }\n                        fn.call(scope || window, k, e);\n                    }\n                }\n            }\n        };\n        this.bindings.push(handler);\n\t},\n    \n    // private\n    checkModifiers: function(config, e){\n        var val, key, keys = ['shift', 'ctrl', 'alt'];\n        for (var i = 0, len = keys.length; i < len; ++i){\n            key = keys[i];\n            val = config[key];\n            if(!(val === undefined || (val === e[key + 'Key']))){\n                return false;\n            }\n        }\n        return true;\n    },\n\n    /**\n     * Shorthand for adding a single key listener\n     * @param {Number/Array/Object} key Either the numeric key code, array of key codes or an object with the\n     * following options:\n     * {key: (number or array), shift: (true/false), ctrl: (true/false), alt: (true/false)}\n     * @param {Function} fn The function to call\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to the browser window.\n     */\n    on : function(key, fn, scope){\n        var keyCode, shift, ctrl, alt;\n        if(typeof key == \"object\" && !Ext.isArray(key)){\n            keyCode = key.key;\n            shift = key.shift;\n            ctrl = key.ctrl;\n            alt = key.alt;\n        }else{\n            keyCode = key;\n        }\n        this.addBinding({\n            key: keyCode,\n            shift: shift,\n            ctrl: ctrl,\n            alt: alt,\n            fn: fn,\n            scope: scope\n        });\n    },\n\n    // private\n    handleKeyDown : function(e){\n\t    if(this.enabled){ //just in case\n    \t    var b = this.bindings;\n    \t    for(var i = 0, len = b.length; i < len; i++){\n    \t        b[i].call(this, e);\n    \t    }\n\t    }\n\t},\n\n\t/**\n\t * Returns true if this KeyMap is enabled\n\t * @return {Boolean}\n\t */\n\tisEnabled : function(){\n\t    return this.enabled;\n\t},\n\n\t/**\n\t * Enables this KeyMap\n\t */\n\tenable: function(){\n\t\tif(!this.enabled){\n\t\t    this.el.on(this.eventName, this.handleKeyDown, this);\n\t\t    this.enabled = true;\n\t\t}\n\t},\n\n\t/**\n\t * Disable this KeyMap\n\t */\n\tdisable: function(){\n\t\tif(this.enabled){\n\t\t    this.el.removeListener(this.eventName, this.handleKeyDown, this);\n\t\t    this.enabled = false;\n\t\t}\n\t},\n    \n    /**\n     * Convenience function for setting disabled/enabled by boolean.\n     * @param {Boolean} disabled\n     */\n    setDisabled : function(disabled){\n        this[disabled ? \"disable\" : \"enable\"]();\n    }\n};/**\n * @class Ext.util.TextMetrics\n * Provides precise pixel measurements for blocks of text so that you can determine exactly how high and\n * wide, in pixels, a given block of text will be. Note that when measuring text, it should be plain text and\n * should not contain any HTML, otherwise it may not be measured correctly.\n * @singleton\n */\nExt.util.TextMetrics = function(){\n    var shared;\n    return {\n        /**\n         * Measures the size of the specified text\n         * @param {String/HTMLElement} el The element, dom node or id from which to copy existing CSS styles\n         * that can affect the size of the rendered text\n         * @param {String} text The text to measure\n         * @param {Number} fixedWidth (optional) If the text will be multiline, you have to set a fixed width\n         * in order to accurately measure the text height\n         * @return {Object} An object containing the text's size {width: (width), height: (height)}\n         */\n        measure : function(el, text, fixedWidth){\n            if(!shared){\n                shared = Ext.util.TextMetrics.Instance(el, fixedWidth);\n            }\n            shared.bind(el);\n            shared.setFixedWidth(fixedWidth || 'auto');\n            return shared.getSize(text);\n        },\n\n        /**\n         * Return a unique TextMetrics instance that can be bound directly to an element and reused.  This reduces\n         * the overhead of multiple calls to initialize the style properties on each measurement.\n         * @param {String/HTMLElement} el The element, dom node or id that the instance will be bound to\n         * @param {Number} fixedWidth (optional) If the text will be multiline, you have to set a fixed width\n         * in order to accurately measure the text height\n         * @return {Ext.util.TextMetrics.Instance} instance The new instance\n         */\n        createInstance : function(el, fixedWidth){\n            return Ext.util.TextMetrics.Instance(el, fixedWidth);\n        }\n    };\n}();\n\nExt.util.TextMetrics.Instance = function(bindTo, fixedWidth){\n    var ml = new Ext.Element(document.createElement('div'));\n    document.body.appendChild(ml.dom);\n    ml.position('absolute');\n    ml.setLeftTop(-1000, -1000);\n    ml.hide();\n\n    if(fixedWidth){\n        ml.setWidth(fixedWidth);\n    }\n\n    var instance = {\n        /**\n         * <p><b>Only available on the instance returned from {@link #createInstance}, <u>not</u> on the singleton.</b></p>\n         * Returns the size of the specified text based on the internal element's style and width properties\n         * @param {String} text The text to measure\n         * @return {Object} An object containing the text's size {width: (width), height: (height)}\n         */\n        getSize : function(text){\n            ml.update(text);\n            var s = ml.getSize();\n            ml.update('');\n            return s;\n        },\n\n        /**\n         * <p><b>Only available on the instance returned from {@link #createInstance}, <u>not</u> on the singleton.</b></p>\n         * Binds this TextMetrics instance to an element from which to copy existing CSS styles\n         * that can affect the size of the rendered text\n         * @param {String/HTMLElement} el The element, dom node or id\n         */\n        bind : function(el){\n            ml.setStyle(\n                Ext.fly(el).getStyles('font-size','font-style', 'font-weight', 'font-family','line-height', 'text-transform', 'letter-spacing')\n            );\n        },\n\n        /**\n         * <p><b>Only available on the instance returned from {@link #createInstance}, <u>not</u> on the singleton.</b></p>\n         * Sets a fixed width on the internal measurement element.  If the text will be multiline, you have\n         * to set a fixed width in order to accurately measure the text height.\n         * @param {Number} width The width to set on the element\n         */\n        setFixedWidth : function(width){\n            ml.setWidth(width);\n        },\n\n        /**\n         * <p><b>Only available on the instance returned from {@link #createInstance}, <u>not</u> on the singleton.</b></p>\n         * Returns the measured width of the specified text\n         * @param {String} text The text to measure\n         * @return {Number} width The width in pixels\n         */\n        getWidth : function(text){\n            ml.dom.style.width = 'auto';\n            return this.getSize(text).width;\n        },\n\n        /**\n         * <p><b>Only available on the instance returned from {@link #createInstance}, <u>not</u> on the singleton.</b></p>\n         * Returns the measured height of the specified text.  For multiline text, be sure to call\n         * {@link #setFixedWidth} if necessary.\n         * @param {String} text The text to measure\n         * @return {Number} height The height in pixels\n         */\n        getHeight : function(text){\n            return this.getSize(text).height;\n        }\n    };\n\n    instance.bind(bindTo);\n\n    return instance;\n};\n\nExt.Element.addMethods({\n    /**\n     * Returns the width in pixels of the passed text, or the width of the text in this Element.\n     * @param {String} text The text to measure. Defaults to the innerHTML of the element.\n     * @param {Number} min (Optional) The minumum value to return.\n     * @param {Number} max (Optional) The maximum value to return.\n     * @return {Number} The text width in pixels.\n     * @member Ext.Element getTextWidth\n     */\n    getTextWidth : function(text, min, max){\n        return (Ext.util.TextMetrics.measure(this.dom, Ext.value(text, this.dom.innerHTML, true)).width).constrain(min || 0, max || 1000000);\n    }\n});\n/**\n * @class Ext.util.Cookies\n * Utility class for managing and interacting with cookies.\n * @singleton\n */\nExt.util.Cookies = {\n    /**\n     * Create a cookie with the specified name and value. Additional settings\n     * for the cookie may be optionally specified (for example: expiration,\n     * access restriction, SSL).\n     * @param {String} name The name of the cookie to set. \n     * @param {Mixed} value The value to set for the cookie.\n     * @param {Object} expires (Optional) Specify an expiration date the\n     * cookie is to persist until.  Note that the specified Date object will\n     * be converted to Greenwich Mean Time (GMT). \n     * @param {String} path (Optional) Setting a path on the cookie restricts\n     * access to pages that match that path. Defaults to all pages (<tt>'/'</tt>). \n     * @param {String} domain (Optional) Setting a domain restricts access to\n     * pages on a given domain (typically used to allow cookie access across\n     * subdomains). For example, \"extjs.com\" will create a cookie that can be\n     * accessed from any subdomain of extjs.com, including www.extjs.com,\n     * support.extjs.com, etc.\n     * @param {Boolean} secure (Optional) Specify true to indicate that the cookie\n     * should only be accessible via SSL on a page using the HTTPS protocol.\n     * Defaults to <tt>false</tt>. Note that this will only work if the page\n     * calling this code uses the HTTPS protocol, otherwise the cookie will be\n     * created with default options.\n     */\n    set : function(name, value){\n        var argv = arguments;\n        var argc = arguments.length;\n        var expires = (argc > 2) ? argv[2] : null;\n        var path = (argc > 3) ? argv[3] : '/';\n        var domain = (argc > 4) ? argv[4] : null;\n        var secure = (argc > 5) ? argv[5] : false;\n        document.cookie = name + \"=\" + escape(value) + ((expires === null) ? \"\" : (\"; expires=\" + expires.toGMTString())) + ((path === null) ? \"\" : (\"; path=\" + path)) + ((domain === null) ? \"\" : (\"; domain=\" + domain)) + ((secure === true) ? \"; secure\" : \"\");\n    },\n\n    /**\n     * Retrieves cookies that are accessible by the current page. If a cookie\n     * does not exist, <code>get()</code> returns <tt>null</tt>.  The following\n     * example retrieves the cookie called \"valid\" and stores the String value\n     * in the variable <tt>validStatus</tt>.\n     * <pre><code>\n     * var validStatus = Ext.util.Cookies.get(\"valid\");\n     * </code></pre>\n     * @param {String} name The name of the cookie to get\n     * @return {Mixed} Returns the cookie value for the specified name;\n     * null if the cookie name does not exist.\n     */\n    get : function(name){\n        var arg = name + \"=\";\n        var alen = arg.length;\n        var clen = document.cookie.length;\n        var i = 0;\n        var j = 0;\n        while(i < clen){\n            j = i + alen;\n            if(document.cookie.substring(i, j) == arg){\n                return Ext.util.Cookies.getCookieVal(j);\n            }\n            i = document.cookie.indexOf(\" \", i) + 1;\n            if(i === 0){\n                break;\n            }\n        }\n        return null;\n    },\n\n    /**\n     * Removes a cookie with the provided name from the browser\n     * if found by setting its expiration date to sometime in the past. \n     * @param {String} name The name of the cookie to remove\n     */\n    clear : function(name){\n        if(Ext.util.Cookies.get(name)){\n            document.cookie = name + \"=\" + \"; expires=Thu, 01-Jan-70 00:00:01 GMT\";\n        }\n    },\n    /**\n     * @private\n     */\n    getCookieVal : function(offset){\n        var endstr = document.cookie.indexOf(\";\", offset);\n        if(endstr == -1){\n            endstr = document.cookie.length;\n        }\n        return unescape(document.cookie.substring(offset, endstr));\n    }\n};/**\n * Framework-wide error-handler.  Developers can override this method to provide\n * custom exception-handling.  Framework errors will often extend from the base\n * Ext.Error class.\n * @param {Object/Error} e The thrown exception object.\n * @member Ext\n */\nExt.handleError = function(e) {\n    throw e;\n};\n\n/**\n * @class Ext.Error\n * @extends Error\n * <p>A base error class. Future implementations are intended to provide more\n * robust error handling throughout the framework (<b>in the debug build only</b>)\n * to check for common errors and problems. The messages issued by this class\n * will aid error checking. Error checks will be automatically removed in the\n * production build so that performance is not negatively impacted.</p>\n * <p>Some sample messages currently implemented:</p><pre>\n\"DataProxy attempted to execute an API-action but found an undefined\nurl / function. Please review your Proxy url/api-configuration.\"\n * </pre><pre>\n\"Could not locate your \"root\" property in your server response.\nPlease review your JsonReader config to ensure the config-property\n\"root\" matches the property your server-response.  See the JsonReader\ndocs for additional assistance.\"\n * </pre>\n * <p>An example of the code used for generating error messages:</p><pre><code>\ntry {\n    generateError({\n        foo: 'bar'\n    });\n}\ncatch (e) {\n    console.error(e);\n}\nfunction generateError(data) {\n    throw new Ext.Error('foo-error', data);\n}\n * </code></pre>\n * @param {String} message\n */\nExt.Error = function(message) {\n    // Try to read the message from Ext.Error.lang\n    this.message = (this.lang[message]) ? this.lang[message] : message;\n};\n\nExt.Error.prototype = new Error();\nExt.apply(Ext.Error.prototype, {\n    // protected.  Extensions place their error-strings here.\n    lang: {},\n\n    name: 'Ext.Error',\n    /**\n     * getName\n     * @return {String}\n     */\n    getName : function() {\n        return this.name;\n    },\n    /**\n     * getMessage\n     * @return {String}\n     */\n    getMessage : function() {\n        return this.message;\n    },\n    /**\n     * toJson\n     * @return {String}\n     */\n    toJson : function() {\n        return Ext.encode(this);\n    }\n});\n/**\n * @class Ext.ComponentMgr\n * <p>Provides a registry of all Components (instances of {@link Ext.Component} or any subclass\n * thereof) on a page so that they can be easily accessed by {@link Ext.Component component}\n * {@link Ext.Component#id id} (see {@link #get}, or the convenience method {@link Ext#getCmp Ext.getCmp}).</p>\n * <p>This object also provides a registry of available Component <i>classes</i>\n * indexed by a mnemonic code known as the Component's {@link Ext.Component#xtype xtype}.\n * The <code>{@link Ext.Component#xtype xtype}</code> provides a way to avoid instantiating child Components\n * when creating a full, nested config object for a complete Ext page.</p>\n * <p>A child Component may be specified simply as a <i>config object</i>\n * as long as the correct <code>{@link Ext.Component#xtype xtype}</code> is specified so that if and when the Component\n * needs rendering, the correct type can be looked up for lazy instantiation.</p>\n * <p>For a list of all available <code>{@link Ext.Component#xtype xtypes}</code>, see {@link Ext.Component}.</p>\n * @singleton\n */\nExt.ComponentMgr = function(){\n    var all = new Ext.util.MixedCollection();\n    var types = {};\n    var ptypes = {};\n\n    return {\n        /**\n         * Registers a component.\n         * @param {Ext.Component} c The component\n         */\n        register : function(c){\n            all.add(c);\n        },\n\n        /**\n         * Unregisters a component.\n         * @param {Ext.Component} c The component\n         */\n        unregister : function(c){\n            all.remove(c);\n        },\n\n        /**\n         * Returns a component by {@link Ext.Component#id id}.\n         * For additional details see {@link Ext.util.MixedCollection#get}.\n         * @param {String} id The component {@link Ext.Component#id id}\n         * @return Ext.Component The Component, <code>undefined</code> if not found, or <code>null</code> if a\n         * Class was found.\n         */\n        get : function(id){\n            return all.get(id);\n        },\n\n        /**\n         * Registers a function that will be called when a Component with the specified id is added to ComponentMgr. This will happen on instantiation.\n         * @param {String} id The component {@link Ext.Component#id id}\n         * @param {Function} fn The callback function\n         * @param {Object} scope The scope (<code>this</code> reference) in which the callback is executed. Defaults to the Component.\n         */\n        onAvailable : function(id, fn, scope){\n            all.on(\"add\", function(index, o){\n                if(o.id == id){\n                    fn.call(scope || o, o);\n                    all.un(\"add\", fn, scope);\n                }\n            });\n        },\n\n        /**\n         * The MixedCollection used internally for the component cache. An example usage may be subscribing to\n         * events on the MixedCollection to monitor addition or removal.  Read-only.\n         * @type {MixedCollection}\n         */\n        all : all,\n        \n        /**\n         * The xtypes that have been registered with the component manager.\n         * @type {Object}\n         */\n        types : types,\n        \n        /**\n         * The ptypes that have been registered with the component manager.\n         * @type {Object}\n         */\n        ptypes: ptypes,\n        \n        /**\n         * Checks if a Component type is registered.\n         * @param {Ext.Component} xtype The mnemonic string by which the Component class may be looked up\n         * @return {Boolean} Whether the type is registered.\n         */\n        isRegistered : function(xtype){\n            return types[xtype] !== undefined;    \n        },\n        \n        /**\n         * Checks if a Plugin type is registered.\n         * @param {Ext.Component} ptype The mnemonic string by which the Plugin class may be looked up\n         * @return {Boolean} Whether the type is registered.\n         */\n        isPluginRegistered : function(ptype){\n            return ptypes[ptype] !== undefined;    \n        },        \n\n        /**\n         * <p>Registers a new Component constructor, keyed by a new\n         * {@link Ext.Component#xtype}.</p>\n         * <p>Use this method (or its alias {@link Ext#reg Ext.reg}) to register new\n         * subclasses of {@link Ext.Component} so that lazy instantiation may be used when specifying\n         * child Components.\n         * see {@link Ext.Container#items}</p>\n         * @param {String} xtype The mnemonic string by which the Component class may be looked up.\n         * @param {Constructor} cls The new Component class.\n         */\n        registerType : function(xtype, cls){\n            types[xtype] = cls;\n            cls.xtype = xtype;\n        },\n\n        /**\n         * Creates a new Component from the specified config object using the\n         * config object's {@link Ext.component#xtype xtype} to determine the class to instantiate.\n         * @param {Object} config A configuration object for the Component you wish to create.\n         * @param {Constructor} defaultType The constructor to provide the default Component type if\n         * the config object does not contain a <code>xtype</code>. (Optional if the config contains a <code>xtype</code>).\n         * @return {Ext.Component} The newly instantiated Component.\n         */\n        create : function(config, defaultType){\n            return config.render ? config : new types[config.xtype || defaultType](config);\n        },\n\n        /**\n         * <p>Registers a new Plugin constructor, keyed by a new\n         * {@link Ext.Component#ptype}.</p>\n         * <p>Use this method (or its alias {@link Ext#preg Ext.preg}) to register new\n         * plugins for {@link Ext.Component}s so that lazy instantiation may be used when specifying\n         * Plugins.</p>\n         * @param {String} ptype The mnemonic string by which the Plugin class may be looked up.\n         * @param {Constructor} cls The new Plugin class.\n         */\n        registerPlugin : function(ptype, cls){\n            ptypes[ptype] = cls;\n            cls.ptype = ptype;\n        },\n\n        /**\n         * Creates a new Plugin from the specified config object using the\n         * config object's {@link Ext.component#ptype ptype} to determine the class to instantiate.\n         * @param {Object} config A configuration object for the Plugin you wish to create.\n         * @param {Constructor} defaultType The constructor to provide the default Plugin type if\n         * the config object does not contain a <code>ptype</code>. (Optional if the config contains a <code>ptype</code>).\n         * @return {Ext.Component} The newly instantiated Plugin.\n         */\n        createPlugin : function(config, defaultType){\n            var PluginCls = ptypes[config.ptype || defaultType];\n            if (PluginCls.init) {\n                return PluginCls;                \n            } else {\n                return new PluginCls(config);\n            }            \n        }\n    };\n}();\n\n/**\n * Shorthand for {@link Ext.ComponentMgr#registerType}\n * @param {String} xtype The {@link Ext.component#xtype mnemonic string} by which the Component class\n * may be looked up.\n * @param {Constructor} cls The new Component class.\n * @member Ext\n * @method reg\n */\nExt.reg = Ext.ComponentMgr.registerType; // this will be called a lot internally, shorthand to keep the bytes down\n/**\n * Shorthand for {@link Ext.ComponentMgr#registerPlugin}\n * @param {String} ptype The {@link Ext.component#ptype mnemonic string} by which the Plugin class\n * may be looked up.\n * @param {Constructor} cls The new Plugin class.\n * @member Ext\n * @method preg\n */\nExt.preg = Ext.ComponentMgr.registerPlugin;\n/**\n * Shorthand for {@link Ext.ComponentMgr#create}\n * Creates a new Component from the specified config object using the\n * config object's {@link Ext.component#xtype xtype} to determine the class to instantiate.\n * @param {Object} config A configuration object for the Component you wish to create.\n * @param {Constructor} defaultType The constructor to provide the default Component type if\n * the config object does not contain a <code>xtype</code>. (Optional if the config contains a <code>xtype</code>).\n * @return {Ext.Component} The newly instantiated Component.\n * @member Ext\n * @method create\n */\nExt.create = Ext.ComponentMgr.create;/**\n * @class Ext.Component\n * @extends Ext.util.Observable\n * <p>Base class for all Ext components.  All subclasses of Component may participate in the automated\n * Ext component lifecycle of creation, rendering and destruction which is provided by the {@link Ext.Container Container} class.\n * Components may be added to a Container through the {@link Ext.Container#items items} config option at the time the Container is created,\n * or they may be added dynamically via the {@link Ext.Container#add add} method.</p>\n * <p>The Component base class has built-in support for basic hide/show and enable/disable behavior.</p>\n * <p>All Components are registered with the {@link Ext.ComponentMgr} on construction so that they can be referenced at any time via\n * {@link Ext#getCmp}, passing the {@link #id}.</p>\n * <p>All user-developed visual widgets that are required to participate in automated lifecycle and size management should subclass Component (or\n * {@link Ext.BoxComponent} if managed box model handling is required, ie height and width management).</p>\n * <p>See the <a href=\"http://extjs.com/learn/Tutorial:Creating_new_UI_controls\">Creating new UI controls</a> tutorial for details on how\n * and to either extend or augment ExtJs base classes to create custom Components.</p>\n * <p>Every component has a specific xtype, which is its Ext-specific type name, along with methods for checking the\n * xtype like {@link #getXType} and {@link #isXType}. This is the list of all valid xtypes:</p>\n * <pre>\nxtype            Class\n-------------    ------------------\nbox              {@link Ext.BoxComponent}\nbutton           {@link Ext.Button}\nbuttongroup      {@link Ext.ButtonGroup}\ncolorpalette     {@link Ext.ColorPalette}\ncomponent        {@link Ext.Component}\ncontainer        {@link Ext.Container}\ncycle            {@link Ext.CycleButton}\ndataview         {@link Ext.DataView}\ndatepicker       {@link Ext.DatePicker}\neditor           {@link Ext.Editor}\neditorgrid       {@link Ext.grid.EditorGridPanel}\nflash            {@link Ext.FlashComponent}\ngrid             {@link Ext.grid.GridPanel}\nlistview         {@link Ext.ListView}\nmultislider      {@link Ext.slider.MultiSlider}\npanel            {@link Ext.Panel}\nprogress         {@link Ext.ProgressBar}\npropertygrid     {@link Ext.grid.PropertyGrid}\nslider           {@link Ext.slider.SingleSlider}\nspacer           {@link Ext.Spacer}\nsplitbutton      {@link Ext.SplitButton}\ntabpanel         {@link Ext.TabPanel}\ntreepanel        {@link Ext.tree.TreePanel}\nviewport         {@link Ext.ViewPort}\nwindow           {@link Ext.Window}\n\nToolbar components\n---------------------------------------\npaging           {@link Ext.PagingToolbar}\ntoolbar          {@link Ext.Toolbar}\ntbbutton         {@link Ext.Toolbar.Button}        (deprecated; use button)\ntbfill           {@link Ext.Toolbar.Fill}\ntbitem           {@link Ext.Toolbar.Item}\ntbseparator      {@link Ext.Toolbar.Separator}\ntbspacer         {@link Ext.Toolbar.Spacer}\ntbsplit          {@link Ext.Toolbar.SplitButton}   (deprecated; use splitbutton)\ntbtext           {@link Ext.Toolbar.TextItem}\n\nMenu components\n---------------------------------------\nmenu             {@link Ext.menu.Menu}\ncolormenu        {@link Ext.menu.ColorMenu}\ndatemenu         {@link Ext.menu.DateMenu}\nmenubaseitem     {@link Ext.menu.BaseItem}\nmenucheckitem    {@link Ext.menu.CheckItem}\nmenuitem         {@link Ext.menu.Item}\nmenuseparator    {@link Ext.menu.Separator}\nmenutextitem     {@link Ext.menu.TextItem}\n\nForm components\n---------------------------------------\nform             {@link Ext.form.FormPanel}\ncheckbox         {@link Ext.form.Checkbox}\ncheckboxgroup    {@link Ext.form.CheckboxGroup}\ncombo            {@link Ext.form.ComboBox}\ncompositefield   {@link Ext.form.CompositeField}\ndatefield        {@link Ext.form.DateField}\ndisplayfield     {@link Ext.form.DisplayField}\nfield            {@link Ext.form.Field}\nfieldset         {@link Ext.form.FieldSet}\nhidden           {@link Ext.form.Hidden}\nhtmleditor       {@link Ext.form.HtmlEditor}\nlabel            {@link Ext.form.Label}\nnumberfield      {@link Ext.form.NumberField}\nradio            {@link Ext.form.Radio}\nradiogroup       {@link Ext.form.RadioGroup}\ntextarea         {@link Ext.form.TextArea}\ntextfield        {@link Ext.form.TextField}\ntimefield        {@link Ext.form.TimeField}\ntrigger          {@link Ext.form.TriggerField}\ntwintrigger      {@link Ext.form.TwinTriggerField}\n\nChart components\n---------------------------------------\nchart            {@link Ext.chart.Chart}\nbarchart         {@link Ext.chart.BarChart}\ncartesianchart   {@link Ext.chart.CartesianChart}\ncolumnchart      {@link Ext.chart.ColumnChart}\nlinechart        {@link Ext.chart.LineChart}\npiechart         {@link Ext.chart.PieChart}\n\nStore xtypes\n---------------------------------------\narraystore       {@link Ext.data.ArrayStore}\ndirectstore      {@link Ext.data.DirectStore}\ngroupingstore    {@link Ext.data.GroupingStore}\njsonstore        {@link Ext.data.JsonStore}\nsimplestore      {@link Ext.data.SimpleStore}      (deprecated; use arraystore)\nstore            {@link Ext.data.Store}\nxmlstore         {@link Ext.data.XmlStore}\n</pre>\n * @constructor\n * @param {Ext.Element/String/Object} config The configuration options may be specified as either:\n * <div class=\"mdetail-params\"><ul>\n * <li><b>an element</b> :\n * <p class=\"sub-desc\">it is set as the internal element and its id used as the component id</p></li>\n * <li><b>a string</b> :\n * <p class=\"sub-desc\">it is assumed to be the id of an existing element and is used as the component id</p></li>\n * <li><b>anything else</b> :\n * <p class=\"sub-desc\">it is assumed to be a standard config object and is applied to the component</p></li>\n * </ul></div>\n */\nExt.Component = function(config){\n    config = config || {};\n    if(config.initialConfig){\n        if(config.isAction){           // actions\n            this.baseAction = config;\n        }\n        config = config.initialConfig; // component cloning / action set up\n    }else if(config.tagName || config.dom || Ext.isString(config)){ // element object\n        config = {applyTo: config, id: config.id || config};\n    }\n\n    /**\n     * This Component's initial configuration specification. Read-only.\n     * @type Object\n     * @property initialConfig\n     */\n    this.initialConfig = config;\n\n    Ext.apply(this, config);\n    this.addEvents(\n        /**\n         * @event added\n         * Fires when a component is added to an Ext.Container\n         * @param {Ext.Component} this\n         * @param {Ext.Container} ownerCt Container which holds the component\n         * @param {number} index Position at which the component was added\n         */\n        'added',\n        /**\n         * @event disable\n         * Fires after the component is disabled.\n         * @param {Ext.Component} this\n         */\n        'disable',\n        /**\n         * @event enable\n         * Fires after the component is enabled.\n         * @param {Ext.Component} this\n         */\n        'enable',\n        /**\n         * @event beforeshow\n         * Fires before the component is shown by calling the {@link #show} method.\n         * Return false from an event handler to stop the show.\n         * @param {Ext.Component} this\n         */\n        'beforeshow',\n        /**\n         * @event show\n         * Fires after the component is shown when calling the {@link #show} method.\n         * @param {Ext.Component} this\n         */\n        'show',\n        /**\n         * @event beforehide\n         * Fires before the component is hidden by calling the {@link #hide} method.\n         * Return false from an event handler to stop the hide.\n         * @param {Ext.Component} this\n         */\n        'beforehide',\n        /**\n         * @event hide\n         * Fires after the component is hidden.\n         * Fires after the component is hidden when calling the {@link #hide} method.\n         * @param {Ext.Component} this\n         */\n        'hide',\n        /**\n         * @event removed\n         * Fires when a component is removed from an Ext.Container\n         * @param {Ext.Component} this\n         * @param {Ext.Container} ownerCt Container which holds the component\n         */\n        'removed',\n        /**\n         * @event beforerender\n         * Fires before the component is {@link #rendered}. Return false from an\n         * event handler to stop the {@link #render}.\n         * @param {Ext.Component} this\n         */\n        'beforerender',\n        /**\n         * @event render\n         * Fires after the component markup is {@link #rendered}.\n         * @param {Ext.Component} this\n         */\n        'render',\n        /**\n         * @event afterrender\n         * <p>Fires after the component rendering is finished.</p>\n         * <p>The afterrender event is fired after this Component has been {@link #rendered}, been postprocesed\n         * by any afterRender method defined for the Component, and, if {@link #stateful}, after state\n         * has been restored.</p>\n         * @param {Ext.Component} this\n         */\n        'afterrender',\n        /**\n         * @event beforedestroy\n         * Fires before the component is {@link #destroy}ed. Return false from an event handler to stop the {@link #destroy}.\n         * @param {Ext.Component} this\n         */\n        'beforedestroy',\n        /**\n         * @event destroy\n         * Fires after the component is {@link #destroy}ed.\n         * @param {Ext.Component} this\n         */\n        'destroy',\n        /**\n         * @event beforestaterestore\n         * Fires before the state of the component is restored. Return false from an event handler to stop the restore.\n         * @param {Ext.Component} this\n         * @param {Object} state The hash of state values returned from the StateProvider. If this\n         * event is not vetoed, then the state object is passed to <b><tt>applyState</tt></b>. By default,\n         * that simply copies property values into this Component. The method maybe overriden to\n         * provide custom state restoration.\n         */\n        'beforestaterestore',\n        /**\n         * @event staterestore\n         * Fires after the state of the component is restored.\n         * @param {Ext.Component} this\n         * @param {Object} state The hash of state values returned from the StateProvider. This is passed\n         * to <b><tt>applyState</tt></b>. By default, that simply copies property values into this\n         * Component. The method maybe overriden to provide custom state restoration.\n         */\n        'staterestore',\n        /**\n         * @event beforestatesave\n         * Fires before the state of the component is saved to the configured state provider. Return false to stop the save.\n         * @param {Ext.Component} this\n         * @param {Object} state The hash of state values. This is determined by calling\n         * <b><tt>getState()</tt></b> on the Component. This method must be provided by the\n         * developer to return whetever representation of state is required, by default, Ext.Component\n         * has a null implementation.\n         */\n        'beforestatesave',\n        /**\n         * @event statesave\n         * Fires after the state of the component is saved to the configured state provider.\n         * @param {Ext.Component} this\n         * @param {Object} state The hash of state values. This is determined by calling\n         * <b><tt>getState()</tt></b> on the Component. This method must be provided by the\n         * developer to return whetever representation of state is required, by default, Ext.Component\n         * has a null implementation.\n         */\n        'statesave'\n    );\n    this.getId();\n    Ext.ComponentMgr.register(this);\n    Ext.Component.superclass.constructor.call(this);\n\n    if(this.baseAction){\n        this.baseAction.addComponent(this);\n    }\n\n    this.initComponent();\n\n    if(this.plugins){\n        if(Ext.isArray(this.plugins)){\n            for(var i = 0, len = this.plugins.length; i < len; i++){\n                this.plugins[i] = this.initPlugin(this.plugins[i]);\n            }\n        }else{\n            this.plugins = this.initPlugin(this.plugins);\n        }\n    }\n\n    if(this.stateful !== false){\n        this.initState();\n    }\n\n    if(this.applyTo){\n        this.applyToMarkup(this.applyTo);\n        delete this.applyTo;\n    }else if(this.renderTo){\n        this.render(this.renderTo);\n        delete this.renderTo;\n    }\n};\n\n// private\nExt.Component.AUTO_ID = 1000;\n\nExt.extend(Ext.Component, Ext.util.Observable, {\n    // Configs below are used for all Components when rendered by FormLayout.\n    /**\n     * @cfg {String} fieldLabel <p>The label text to display next to this Component (defaults to '').</p>\n     * <br><p><b>Note</b>: this config is only used when this Component is rendered by a Container which\n     * has been configured to use the <b>{@link Ext.layout.FormLayout FormLayout}</b> layout manager (e.g.\n     * {@link Ext.form.FormPanel} or specifying <tt>layout:'form'</tt>).</p><br>\n     * <p>Also see <tt>{@link #hideLabel}</tt> and\n     * {@link Ext.layout.FormLayout}.{@link Ext.layout.FormLayout#fieldTpl fieldTpl}.</p>\n     * Example use:<pre><code>\nnew Ext.FormPanel({\n    height: 100,\n    renderTo: Ext.getBody(),\n    items: [{\n        xtype: 'textfield',\n        fieldLabel: 'Name'\n    }]\n});\n</code></pre>\n     */\n    /**\n     * @cfg {String} labelStyle <p>A CSS style specification string to apply directly to this field's\n     * label.  Defaults to the container's labelStyle value if set (e.g.,\n     * <tt>{@link Ext.layout.FormLayout#labelStyle}</tt> , or '').</p>\n     * <br><p><b>Note</b>: see the note for <code>{@link #clearCls}</code>.</p><br>\n     * <p>Also see <code>{@link #hideLabel}</code> and\n     * <code>{@link Ext.layout.FormLayout}.{@link Ext.layout.FormLayout#fieldTpl fieldTpl}.</code></p>\n     * Example use:<pre><code>\nnew Ext.FormPanel({\n    height: 100,\n    renderTo: Ext.getBody(),\n    items: [{\n        xtype: 'textfield',\n        fieldLabel: 'Name',\n        labelStyle: 'font-weight:bold;'\n    }]\n});\n</code></pre>\n     */\n    /**\n     * @cfg {String} labelSeparator <p>The separator to display after the text of each\n     * <tt>{@link #fieldLabel}</tt>.  This property may be configured at various levels.\n     * The order of precedence is:\n     * <div class=\"mdetail-params\"><ul>\n     * <li>field / component level</li>\n     * <li>container level</li>\n     * <li>{@link Ext.layout.FormLayout#labelSeparator layout level} (defaults to colon <tt>':'</tt>)</li>\n     * </ul></div>\n     * To display no separator for this field's label specify empty string ''.</p>\n     * <br><p><b>Note</b>: see the note for <tt>{@link #clearCls}</tt>.</p><br>\n     * <p>Also see <tt>{@link #hideLabel}</tt> and\n     * {@link Ext.layout.FormLayout}.{@link Ext.layout.FormLayout#fieldTpl fieldTpl}.</p>\n     * Example use:<pre><code>\nnew Ext.FormPanel({\n    height: 100,\n    renderTo: Ext.getBody(),\n    layoutConfig: {\n        labelSeparator: '~'   // layout config has lowest priority (defaults to ':')\n    },\n    {@link Ext.layout.FormLayout#labelSeparator labelSeparator}: '>>',     // config at container level\n    items: [{\n        xtype: 'textfield',\n        fieldLabel: 'Field 1',\n        labelSeparator: '...' // field/component level config supersedes others\n    },{\n        xtype: 'textfield',\n        fieldLabel: 'Field 2' // labelSeparator will be '='\n    }]\n});\n</code></pre>\n     */\n    /**\n     * @cfg {Boolean} hideLabel <p><tt>true</tt> to completely hide the label element\n     * ({@link #fieldLabel label} and {@link #labelSeparator separator}). Defaults to <tt>false</tt>.\n     * By default, even if you do not specify a <tt>{@link #fieldLabel}</tt> the space will still be\n     * reserved so that the field will line up with other fields that do have labels.\n     * Setting this to <tt>true</tt> will cause the field to not reserve that space.</p>\n     * <br><p><b>Note</b>: see the note for <tt>{@link #clearCls}</tt>.</p><br>\n     * Example use:<pre><code>\nnew Ext.FormPanel({\n    height: 100,\n    renderTo: Ext.getBody(),\n    items: [{\n        xtype: 'textfield'\n        hideLabel: true\n    }]\n});\n</code></pre>\n     */\n    /**\n     * @cfg {String} clearCls <p>The CSS class used to to apply to the special clearing div rendered\n     * directly after each form field wrapper to provide field clearing (defaults to\n     * <tt>'x-form-clear-left'</tt>).</p>\n     * <br><p><b>Note</b>: this config is only used when this Component is rendered by a Container\n     * which has been configured to use the <b>{@link Ext.layout.FormLayout FormLayout}</b> layout\n     * manager (e.g. {@link Ext.form.FormPanel} or specifying <tt>layout:'form'</tt>) and either a\n     * <tt>{@link #fieldLabel}</tt> is specified or <tt>isFormField=true</tt> is specified.</p><br>\n     * <p>See {@link Ext.layout.FormLayout}.{@link Ext.layout.FormLayout#fieldTpl fieldTpl} also.</p>\n     */\n    /**\n     * @cfg {String} itemCls\n     * <p><b>Note</b>: this config is only used when this Component is rendered by a Container which\n     * has been configured to use the <b>{@link Ext.layout.FormLayout FormLayout}</b> layout manager (e.g.\n     * {@link Ext.form.FormPanel} or specifying <tt>layout:'form'</tt>).</p><br>\n     * <p>An additional CSS class to apply to the div wrapping the form item\n     * element of this field.  If supplied, <tt>itemCls</tt> at the <b>field</b> level will override\n     * the default <tt>itemCls</tt> supplied at the <b>container</b> level. The value specified for\n     * <tt>itemCls</tt> will be added to the default class (<tt>'x-form-item'</tt>).</p>\n     * <p>Since it is applied to the item wrapper (see\n     * {@link Ext.layout.FormLayout}.{@link Ext.layout.FormLayout#fieldTpl fieldTpl}), it allows\n     * you to write standard CSS rules that can apply to the field, the label (if specified), or\n     * any other element within the markup for the field.</p>\n     * <br><p><b>Note</b>: see the note for <tt>{@link #fieldLabel}</tt>.</p><br>\n     * Example use:<pre><code>\n// Apply a style to the field&#39;s label:\n&lt;style>\n    .required .x-form-item-label {font-weight:bold;color:red;}\n&lt;/style>\n\nnew Ext.FormPanel({\n    height: 100,\n    renderTo: Ext.getBody(),\n    items: [{\n        xtype: 'textfield',\n        fieldLabel: 'Name',\n        itemCls: 'required' //this label will be styled\n    },{\n        xtype: 'textfield',\n        fieldLabel: 'Favorite Color'\n    }]\n});\n</code></pre>\n     */\n\n    /**\n     * @cfg {String} id\n     * <p>The <b>unique</b> id of this component (defaults to an {@link #getId auto-assigned id}).\n     * You should assign an id if you need to be able to access the component later and you do\n     * not have an object reference available (e.g., using {@link Ext}.{@link Ext#getCmp getCmp}).</p>\n     * <p>Note that this id will also be used as the element id for the containing HTML element\n     * that is rendered to the page for this component. This allows you to write id-based CSS\n     * rules to style the specific instance of this component uniquely, and also to select\n     * sub-elements using this component's id as the parent.</p>\n     * <p><b>Note</b>: to avoid complications imposed by a unique <tt>id</tt> also see\n     * <code>{@link #itemId}</code> and <code>{@link #ref}</code>.</p>\n     * <p><b>Note</b>: to access the container of an item see <code>{@link #ownerCt}</code>.</p>\n     */\n    /**\n     * @cfg {String} itemId\n     * <p>An <tt>itemId</tt> can be used as an alternative way to get a reference to a component\n     * when no object reference is available.  Instead of using an <code>{@link #id}</code> with\n     * {@link Ext}.{@link Ext#getCmp getCmp}, use <code>itemId</code> with\n     * {@link Ext.Container}.{@link Ext.Container#getComponent getComponent} which will retrieve\n     * <code>itemId</code>'s or <tt>{@link #id}</tt>'s. Since <code>itemId</code>'s are an index to the\n     * container's internal MixedCollection, the <code>itemId</code> is scoped locally to the container --\n     * avoiding potential conflicts with {@link Ext.ComponentMgr} which requires a <b>unique</b>\n     * <code>{@link #id}</code>.</p>\n     * <pre><code>\nvar c = new Ext.Panel({ //\n    {@link Ext.BoxComponent#height height}: 300,\n    {@link #renderTo}: document.body,\n    {@link Ext.Container#layout layout}: 'auto',\n    {@link Ext.Container#items items}: [\n        {\n            itemId: 'p1',\n            {@link Ext.Panel#title title}: 'Panel 1',\n            {@link Ext.BoxComponent#height height}: 150\n        },\n        {\n            itemId: 'p2',\n            {@link Ext.Panel#title title}: 'Panel 2',\n            {@link Ext.BoxComponent#height height}: 150\n        }\n    ]\n})\np1 = c.{@link Ext.Container#getComponent getComponent}('p1'); // not the same as {@link Ext#getCmp Ext.getCmp()}\np2 = p1.{@link #ownerCt}.{@link Ext.Container#getComponent getComponent}('p2'); // reference via a sibling\n     * </code></pre>\n     * <p>Also see <tt>{@link #id}</tt> and <code>{@link #ref}</code>.</p>\n     * <p><b>Note</b>: to access the container of an item see <tt>{@link #ownerCt}</tt>.</p>\n     */\n    /**\n     * @cfg {String} xtype\n     * The registered <tt>xtype</tt> to create. This config option is not used when passing\n     * a config object into a constructor. This config option is used only when\n     * lazy instantiation is being used, and a child item of a Container is being\n     * specified not as a fully instantiated Component, but as a <i>Component config\n     * object</i>. The <tt>xtype</tt> will be looked up at render time up to determine what\n     * type of child Component to create.<br><br>\n     * The predefined xtypes are listed {@link Ext.Component here}.\n     * <br><br>\n     * If you subclass Components to create your own Components, you may register\n     * them using {@link Ext.ComponentMgr#registerType} in order to be able to\n     * take advantage of lazy instantiation and rendering.\n     */\n    /**\n     * @cfg {String} ptype\n     * The registered <tt>ptype</tt> to create. This config option is not used when passing\n     * a config object into a constructor. This config option is used only when\n     * lazy instantiation is being used, and a Plugin is being\n     * specified not as a fully instantiated Component, but as a <i>Component config\n     * object</i>. The <tt>ptype</tt> will be looked up at render time up to determine what\n     * type of Plugin to create.<br><br>\n     * If you create your own Plugins, you may register them using\n     * {@link Ext.ComponentMgr#registerPlugin} in order to be able to\n     * take advantage of lazy instantiation and rendering.\n     */\n    /**\n     * @cfg {String} cls\n     * An optional extra CSS class that will be added to this component's Element (defaults to '').  This can be\n     * useful for adding customized styles to the component or any of its children using standard CSS rules.\n     */\n    /**\n     * @cfg {String} overCls\n     * An optional extra CSS class that will be added to this component's Element when the mouse moves\n     * over the Element, and removed when the mouse moves out. (defaults to '').  This can be\n     * useful for adding customized 'active' or 'hover' styles to the component or any of its children using standard CSS rules.\n     */\n    /**\n     * @cfg {String} style\n     * A custom style specification to be applied to this component's Element.  Should be a valid argument to\n     * {@link Ext.Element#applyStyles}.\n     * <pre><code>\nnew Ext.Panel({\n    title: 'Some Title',\n    renderTo: Ext.getBody(),\n    width: 400, height: 300,\n    layout: 'form',\n    items: [{\n        xtype: 'textarea',\n        style: {\n            width: '95%',\n            marginBottom: '10px'\n        }\n    },\n        new Ext.Button({\n            text: 'Send',\n            minWidth: '100',\n            style: {\n                marginBottom: '10px'\n            }\n        })\n    ]\n});\n     * </code></pre>\n     */\n    /**\n     * @cfg {String} ctCls\n     * <p>An optional extra CSS class that will be added to this component's container. This can be useful for\n     * adding customized styles to the container or any of its children using standard CSS rules.  See\n     * {@link Ext.layout.ContainerLayout}.{@link Ext.layout.ContainerLayout#extraCls extraCls} also.</p>\n     * <p><b>Note</b>: <tt>ctCls</tt> defaults to <tt>''</tt> except for the following class\n     * which assigns a value by default:\n     * <div class=\"mdetail-params\"><ul>\n     * <li>{@link Ext.layout.Box Box Layout} : <tt>'x-box-layout-ct'</tt></li>\n     * </ul></div>\n     * To configure the above Class with an extra CSS class append to the default.  For example,\n     * for BoxLayout (Hbox and Vbox):<pre><code>\n     * ctCls: 'x-box-layout-ct custom-class'\n     * </code></pre>\n     * </p>\n     */\n    /**\n     * @cfg {Boolean} disabled\n     * Render this component disabled (default is false).\n     */\n    disabled : false,\n    /**\n     * @cfg {Boolean} hidden\n     * Render this component hidden (default is false). If <tt>true</tt>, the\n     * {@link #hide} method will be called internally.\n     */\n    hidden : false,\n    /**\n     * @cfg {Object/Array} plugins\n     * An object or array of objects that will provide custom functionality for this component.  The only\n     * requirement for a valid plugin is that it contain an init method that accepts a reference of type Ext.Component.\n     * When a component is created, if any plugins are available, the component will call the init method on each\n     * plugin, passing a reference to itself.  Each plugin can then call methods or respond to events on the\n     * component as needed to provide its functionality.\n     */\n    /**\n     * @cfg {Mixed} applyTo\n     * <p>Specify the id of the element, a DOM element or an existing Element corresponding to a DIV\n     * that is already present in the document that specifies some structural markup for this\n     * component.</p><div><ul>\n     * <li><b>Description</b> : <ul>\n     * <div class=\"sub-desc\">When <tt>applyTo</tt> is used, constituent parts of the component can also be specified\n     * by id or CSS class name within the main element, and the component being created may attempt\n     * to create its subcomponents from that markup if applicable.</div>\n     * </ul></li>\n     * <li><b>Notes</b> : <ul>\n     * <div class=\"sub-desc\">When using this config, a call to render() is not required.</div>\n     * <div class=\"sub-desc\">If applyTo is specified, any value passed for {@link #renderTo} will be ignored and the target\n     * element's parent node will automatically be used as the component's container.</div>\n     * </ul></li>\n     * </ul></div>\n     */\n    /**\n     * @cfg {Mixed} renderTo\n     * <p>Specify the id of the element, a DOM element or an existing Element that this component\n     * will be rendered into.</p><div><ul>\n     * <li><b>Notes</b> : <ul>\n     * <div class=\"sub-desc\">Do <u>not</u> use this option if the Component is to be a child item of\n     * a {@link Ext.Container Container}. It is the responsibility of the\n     * {@link Ext.Container Container}'s {@link Ext.Container#layout layout manager}\n     * to render and manage its child items.</div>\n     * <div class=\"sub-desc\">When using this config, a call to render() is not required.</div>\n     * </ul></li>\n     * </ul></div>\n     * <p>See <tt>{@link #render}</tt> also.</p>\n     */\n    /**\n     * @cfg {Boolean} stateful\n     * <p>A flag which causes the Component to attempt to restore the state of\n     * internal properties from a saved state on startup. The component must have\n     * either a <code>{@link #stateId}</code> or <code>{@link #id}</code> assigned\n     * for state to be managed. Auto-generated ids are not guaranteed to be stable\n     * across page loads and cannot be relied upon to save and restore the same\n     * state for a component.<p>\n     * <p>For state saving to work, the state manager's provider must have been\n     * set to an implementation of {@link Ext.state.Provider} which overrides the\n     * {@link Ext.state.Provider#set set} and {@link Ext.state.Provider#get get}\n     * methods to save and recall name/value pairs. A built-in implementation,\n     * {@link Ext.state.CookieProvider} is available.</p>\n     * <p>To set the state provider for the current page:</p>\n     * <pre><code>\nExt.state.Manager.setProvider(new Ext.state.CookieProvider({\n    expires: new Date(new Date().getTime()+(1000*60*60*24*7)), //7 days from now\n}));\n     * </code></pre>\n     * <p>A stateful Component attempts to save state when one of the events\n     * listed in the <code>{@link #stateEvents}</code> configuration fires.</p>\n     * <p>To save state, a stateful Component first serializes its state by\n     * calling <b><code>getState</code></b>. By default, this function does\n     * nothing. The developer must provide an implementation which returns an\n     * object hash which represents the Component's restorable state.</p>\n     * <p>The value yielded by getState is passed to {@link Ext.state.Manager#set}\n     * which uses the configured {@link Ext.state.Provider} to save the object\n     * keyed by the Component's <code>{@link stateId}</code>, or, if that is not\n     * specified, its <code>{@link #id}</code>.</p>\n     * <p>During construction, a stateful Component attempts to <i>restore</i>\n     * its state by calling {@link Ext.state.Manager#get} passing the\n     * <code>{@link #stateId}</code>, or, if that is not specified, the\n     * <code>{@link #id}</code>.</p>\n     * <p>The resulting object is passed to <b><code>applyState</code></b>.\n     * The default implementation of <code>applyState</code> simply copies\n     * properties into the object, but a developer may override this to support\n     * more behaviour.</p>\n     * <p>You can perform extra processing on state save and restore by attaching\n     * handlers to the {@link #beforestaterestore}, {@link #staterestore},\n     * {@link #beforestatesave} and {@link #statesave} events.</p>\n     */\n    /**\n     * @cfg {String} stateId\n     * The unique id for this component to use for state management purposes\n     * (defaults to the component id if one was set, otherwise null if the\n     * component is using a generated id).\n     * <p>See <code>{@link #stateful}</code> for an explanation of saving and\n     * restoring Component state.</p>\n     */\n    /**\n     * @cfg {Array} stateEvents\n     * <p>An array of events that, when fired, should trigger this component to\n     * save its state (defaults to none). <code>stateEvents</code> may be any type\n     * of event supported by this component, including browser or custom events\n     * (e.g., <tt>['click', 'customerchange']</tt>).</p>\n     * <p>See <code>{@link #stateful}</code> for an explanation of saving and\n     * restoring Component state.</p>\n     */\n    /**\n     * @cfg {Mixed} autoEl\n     * <p>A tag name or {@link Ext.DomHelper DomHelper} spec used to create the {@link #getEl Element} which will\n     * encapsulate this Component.</p>\n     * <p>You do not normally need to specify this. For the base classes {@link Ext.Component}, {@link Ext.BoxComponent},\n     * and {@link Ext.Container}, this defaults to <b><tt>'div'</tt></b>. The more complex Ext classes use a more complex\n     * DOM structure created by their own onRender methods.</p>\n     * <p>This is intended to allow the developer to create application-specific utility Components encapsulated by\n     * different DOM elements. Example usage:</p><pre><code>\n{\n    xtype: 'box',\n    autoEl: {\n        tag: 'img',\n        src: 'http://www.example.com/example.jpg'\n    }\n}, {\n    xtype: 'box',\n    autoEl: {\n        tag: 'blockquote',\n        html: 'autoEl is cool!'\n    }\n}, {\n    xtype: 'container',\n    autoEl: 'ul',\n    cls: 'ux-unordered-list',\n    items: {\n        xtype: 'box',\n        autoEl: 'li',\n        html: 'First list item'\n    }\n}\n</code></pre>\n     */\n    autoEl : 'div',\n\n    /**\n     * @cfg {String} disabledClass\n     * CSS class added to the component when it is disabled (defaults to 'x-item-disabled').\n     */\n    disabledClass : 'x-item-disabled',\n    /**\n     * @cfg {Boolean} allowDomMove\n     * Whether the component can move the Dom node when rendering (defaults to true).\n     */\n    allowDomMove : true,\n    /**\n     * @cfg {Boolean} autoShow\n     * True if the component should check for hidden classes (e.g. 'x-hidden' or 'x-hide-display') and remove\n     * them on render (defaults to false).\n     */\n    autoShow : false,\n    /**\n     * @cfg {String} hideMode\n     * <p>How this component should be hidden. Supported values are <tt>'visibility'</tt>\n     * (css visibility), <tt>'offsets'</tt> (negative offset position) and <tt>'display'</tt>\n     * (css display).</p>\n     * <br><p><b>Note</b>: the default of <tt>'display'</tt> is generally preferred\n     * since items are automatically laid out when they are first shown (no sizing\n     * is done while hidden).</p>\n     */\n    hideMode : 'display',\n    /**\n     * @cfg {Boolean} hideParent\n     * True to hide and show the component's container when hide/show is called on the component, false to hide\n     * and show the component itself (defaults to false).  For example, this can be used as a shortcut for a hide\n     * button on a window by setting hide:true on the button when adding it to its parent container.\n     */\n    hideParent : false,\n    /**\n     * <p>The {@link Ext.Element} which encapsulates this Component. Read-only.</p>\n     * <p>This will <i>usually</i> be a &lt;DIV> element created by the class's onRender method, but\n     * that may be overridden using the <code>{@link #autoEl}</code> config.</p>\n     * <br><p><b>Note</b>: this element will not be available until this Component has been rendered.</p><br>\n     * <p>To add listeners for <b>DOM events</b> to this Component (as opposed to listeners\n     * for this Component's own Observable events), see the {@link Ext.util.Observable#listeners listeners}\n     * config for a suggestion, or use a render listener directly:</p><pre><code>\nnew Ext.Panel({\n    title: 'The Clickable Panel',\n    listeners: {\n        render: function(p) {\n            // Append the Panel to the click handler&#39;s argument list.\n            p.getEl().on('click', handlePanelClick.createDelegate(null, [p], true));\n        },\n        single: true  // Remove the listener after first invocation\n    }\n});\n</code></pre>\n     * <p>See also <tt>{@link #getEl getEl}</tt></p>\n     * @type Ext.Element\n     * @property el\n     */\n    /**\n     * This Component's owner {@link Ext.Container Container} (defaults to undefined, and is set automatically when\n     * this Component is added to a Container).  Read-only.\n     * <p><b>Note</b>: to access items within the Container see <tt>{@link #itemId}</tt>.</p>\n     * @type Ext.Container\n     * @property ownerCt\n     */\n    /**\n     * True if this component is hidden. Read-only.\n     * @type Boolean\n     * @property hidden\n     */\n    /**\n     * True if this component is disabled. Read-only.\n     * @type Boolean\n     * @property disabled\n     */\n    /**\n     * True if this component has been rendered. Read-only.\n     * @type Boolean\n     * @property rendered\n     */\n    rendered : false,\n\n    /**\n     * @cfg {String} contentEl\n     * <p>Optional. Specify an existing HTML element, or the <code>id</code> of an existing HTML element to use as the content\n     * for this component.</p>\n     * <ul>\n     * <li><b>Description</b> :\n     * <div class=\"sub-desc\">This config option is used to take an existing HTML element and place it in the layout element\n     * of a new component (it simply moves the specified DOM element <i>after the Component is rendered</i> to use as the content.</div></li>\n     * <li><b>Notes</b> :\n     * <div class=\"sub-desc\">The specified HTML element is appended to the layout element of the component <i>after any configured\n     * {@link #html HTML} has been inserted</i>, and so the document will not contain this element at the time the {@link #render} event is fired.</div>\n     * <div class=\"sub-desc\">The specified HTML element used will not participate in any <code><b>{@link Ext.Container#layout layout}</b></code>\n     * scheme that the Component may use. It is just HTML. Layouts operate on child <code><b>{@link Ext.Container#items items}</b></code>.</div>\n     * <div class=\"sub-desc\">Add either the <code>x-hidden</code> or the <code>x-hide-display</code> CSS class to\n     * prevent a brief flicker of the content before it is rendered to the panel.</div></li>\n     * </ul>\n     */\n    /**\n     * @cfg {String/Object} html\n     * An HTML fragment, or a {@link Ext.DomHelper DomHelper} specification to use as the layout element\n     * content (defaults to ''). The HTML content is added after the component is rendered,\n     * so the document will not contain this HTML at the time the {@link #render} event is fired.\n     * This content is inserted into the body <i>before</i> any configured {@link #contentEl} is appended.\n     */\n\n    /**\n     * @cfg {Mixed} tpl\n     * An <bold>{@link Ext.Template}</bold>, <bold>{@link Ext.XTemplate}</bold>\n     * or an array of strings to form an Ext.XTemplate.\n     * Used in conjunction with the <code>{@link #data}</code> and\n     * <code>{@link #tplWriteMode}</code> configurations.\n     */\n\n    /**\n     * @cfg {String} tplWriteMode The Ext.(X)Template method to use when\n     * updating the content area of the Component. Defaults to <tt>'overwrite'</tt>\n     * (see <code>{@link Ext.XTemplate#overwrite}</code>).\n     */\n    tplWriteMode : 'overwrite',\n\n    /**\n     * @cfg {Mixed} data\n     * The initial set of data to apply to the <code>{@link #tpl}</code> to\n     * update the content area of the Component.\n     */\n\n    /**\n     * @cfg {Array} bubbleEvents\n     * <p>An array of events that, when fired, should be bubbled to any parent container.\n     * See {@link Ext.util.Observable#enableBubble}.\n     * Defaults to <tt>[]</tt>.\n     */\n    bubbleEvents: [],\n\n\n    // private\n    ctype : 'Ext.Component',\n\n    // private\n    actionMode : 'el',\n\n    // private\n    getActionEl : function(){\n        return this[this.actionMode];\n    },\n\n    initPlugin : function(p){\n        if(p.ptype && !Ext.isFunction(p.init)){\n            p = Ext.ComponentMgr.createPlugin(p);\n        }else if(Ext.isString(p)){\n            p = Ext.ComponentMgr.createPlugin({\n                ptype: p\n            });\n        }\n        p.init(this);\n        return p;\n    },\n\n    /* // protected\n     * Function to be implemented by Component subclasses to be part of standard component initialization flow (it is empty by default).\n     * <pre><code>\n// Traditional constructor:\nExt.Foo = function(config){\n    // call superclass constructor:\n    Ext.Foo.superclass.constructor.call(this, config);\n\n    this.addEvents({\n        // add events\n    });\n};\nExt.extend(Ext.Foo, Ext.Bar, {\n   // class body\n}\n\n// initComponent replaces the constructor:\nExt.Foo = Ext.extend(Ext.Bar, {\n    initComponent : function(){\n        // call superclass initComponent\n        Ext.Container.superclass.initComponent.call(this);\n\n        this.addEvents({\n            // add events\n        });\n    }\n}\n</code></pre>\n     */\n    initComponent : function(){\n        /*\n         * this is double processing, however it allows people to be able to do\n         * Ext.apply(this, {\n         *     listeners: {\n         *         //here\n         *     }\n         * });\n         * MyClass.superclass.initComponent.call(this);\n         */\n        if(this.listeners){\n            this.on(this.listeners);\n            delete this.listeners;\n        }\n        this.enableBubble(this.bubbleEvents);\n    },\n\n    /**\n     * <p>Render this Component into the passed HTML element.</p>\n     * <p><b>If you are using a {@link Ext.Container Container} object to house this Component, then\n     * do not use the render method.</b></p>\n     * <p>A Container's child Components are rendered by that Container's\n     * {@link Ext.Container#layout layout} manager when the Container is first rendered.</p>\n     * <p>Certain layout managers allow dynamic addition of child components. Those that do\n     * include {@link Ext.layout.CardLayout}, {@link Ext.layout.AnchorLayout},\n     * {@link Ext.layout.FormLayout}, {@link Ext.layout.TableLayout}.</p>\n     * <p>If the Container is already rendered when a new child Component is added, you may need to call\n     * the Container's {@link Ext.Container#doLayout doLayout} to refresh the view which causes any\n     * unrendered child Components to be rendered. This is required so that you can add multiple\n     * child components if needed while only refreshing the layout once.</p>\n     * <p>When creating complex UIs, it is important to remember that sizing and positioning\n     * of child items is the responsibility of the Container's {@link Ext.Container#layout layout} manager.\n     * If you expect child items to be sized in response to user interactions, you must\n     * configure the Container with a layout manager which creates and manages the type of layout you\n     * have in mind.</p>\n     * <p><b>Omitting the Container's {@link Ext.Container#layout layout} config means that a basic\n     * layout manager is used which does nothing but render child components sequentially into the\n     * Container. No sizing or positioning will be performed in this situation.</b></p>\n     * @param {Element/HTMLElement/String} container (optional) The element this Component should be\n     * rendered into. If it is being created from existing markup, this should be omitted.\n     * @param {String/Number} position (optional) The element ID or DOM node index within the container <b>before</b>\n     * which this component will be inserted (defaults to appending to the end of the container)\n     */\n    render : function(container, position){\n        if(!this.rendered && this.fireEvent('beforerender', this) !== false){\n            if(!container && this.el){\n                this.el = Ext.get(this.el);\n                container = this.el.dom.parentNode;\n                this.allowDomMove = false;\n            }\n            this.container = Ext.get(container);\n            if(this.ctCls){\n                this.container.addClass(this.ctCls);\n            }\n            this.rendered = true;\n            if(position !== undefined){\n                if(Ext.isNumber(position)){\n                    position = this.container.dom.childNodes[position];\n                }else{\n                    position = Ext.getDom(position);\n                }\n            }\n            this.onRender(this.container, position || null);\n            if(this.autoShow){\n                this.el.removeClass(['x-hidden','x-hide-' + this.hideMode]);\n            }\n            if(this.cls){\n                this.el.addClass(this.cls);\n                delete this.cls;\n            }\n            if(this.style){\n                this.el.applyStyles(this.style);\n                delete this.style;\n            }\n            if(this.overCls){\n                this.el.addClassOnOver(this.overCls);\n            }\n            this.fireEvent('render', this);\n\n\n            // Populate content of the component with html, contentEl or\n            // a tpl.\n            var contentTarget = this.getContentTarget();\n            if (this.html){\n                contentTarget.update(Ext.DomHelper.markup(this.html));\n                delete this.html;\n            }\n            if (this.contentEl){\n                var ce = Ext.getDom(this.contentEl);\n                Ext.fly(ce).removeClass(['x-hidden', 'x-hide-display']);\n                contentTarget.appendChild(ce);\n            }\n            if (this.tpl) {\n                if (!this.tpl.compile) {\n                    this.tpl = new Ext.XTemplate(this.tpl);\n                }\n                if (this.data) {\n                    this.tpl[this.tplWriteMode](contentTarget, this.data);\n                    delete this.data;\n                }\n            }\n            this.afterRender(this.container);\n\n\n            if(this.hidden){\n                // call this so we don't fire initial hide events.\n                this.doHide();\n            }\n            if(this.disabled){\n                // pass silent so the event doesn't fire the first time.\n                this.disable(true);\n            }\n\n            if(this.stateful !== false){\n                this.initStateEvents();\n            }\n            this.fireEvent('afterrender', this);\n        }\n        return this;\n    },\n\n\n    /**\n     * Update the content area of a component.\n     * @param {Mixed} htmlOrData\n     * If this component has been configured with a template via the tpl config\n     * then it will use this argument as data to populate the template.\n     * If this component was not configured with a template, the components\n     * content area will be updated via Ext.Element update\n     * @param {Boolean} loadScripts\n     * (optional) Only legitimate when using the html configuration. Defaults to false\n     * @param {Function} callback\n     * (optional) Only legitimate when using the html configuration. Callback to execute when scripts have finished loading\n     */\n    update: function(htmlOrData, loadScripts, cb) {\n        var contentTarget = this.getContentTarget();\n        if (this.tpl && typeof htmlOrData !== \"string\") {\n            this.tpl[this.tplWriteMode](contentTarget, htmlOrData || {});\n        } else {\n            var html = Ext.isObject(htmlOrData) ? Ext.DomHelper.markup(htmlOrData) : htmlOrData;\n            contentTarget.update(html, loadScripts, cb);\n        }\n    },\n\n\n    /**\n     * @private\n     * Method to manage awareness of when components are added to their\n     * respective Container, firing an added event.\n     * References are established at add time rather than at render time.\n     * @param {Ext.Container} container Container which holds the component\n     * @param {number} pos Position at which the component was added\n     */\n    onAdded : function(container, pos) {\n        this.ownerCt = container;\n        this.initRef();\n        this.fireEvent('added', this, container, pos);\n    },\n\n    /**\n     * @private\n     * Method to manage awareness of when components are removed from their\n     * respective Container, firing an removed event. References are properly\n     * cleaned up after removing a component from its owning container.\n     */\n    onRemoved : function() {\n        this.removeRef();\n        this.fireEvent('removed', this, this.ownerCt);\n        delete this.ownerCt;\n    },\n\n    /**\n     * @private\n     * Method to establish a reference to a component.\n     */\n    initRef : function() {\n        /**\n         * @cfg {String} ref\n         * <p>A path specification, relative to the Component's <code>{@link #ownerCt}</code>\n         * specifying into which ancestor Container to place a named reference to this Component.</p>\n         * <p>The ancestor axis can be traversed by using '/' characters in the path.\n         * For example, to put a reference to a Toolbar Button into <i>the Panel which owns the Toolbar</i>:</p><pre><code>\nvar myGrid = new Ext.grid.EditorGridPanel({\n    title: 'My EditorGridPanel',\n    store: myStore,\n    colModel: myColModel,\n    tbar: [{\n        text: 'Save',\n        handler: saveChanges,\n        disabled: true,\n        ref: '../saveButton'\n    }],\n    listeners: {\n        afteredit: function() {\n//          The button reference is in the GridPanel\n            myGrid.saveButton.enable();\n        }\n    }\n});\n</code></pre>\n         * <p>In the code above, if the <code>ref</code> had been <code>'saveButton'</code>\n         * the reference would have been placed into the Toolbar. Each '/' in the <code>ref</code>\n         * moves up one level from the Component's <code>{@link #ownerCt}</code>.</p>\n         * <p>Also see the <code>{@link #added}</code> and <code>{@link #removed}</code> events.</p>\n         */\n        if(this.ref && !this.refOwner){\n            var levels = this.ref.split('/'),\n                last = levels.length,\n                i = 0,\n                t = this;\n\n            while(t && i < last){\n                t = t.ownerCt;\n                ++i;\n            }\n            if(t){\n                t[this.refName = levels[--i]] = this;\n                /**\n                 * @type Ext.Container\n                 * @property refOwner\n                 * The ancestor Container into which the {@link #ref} reference was inserted if this Component\n                 * is a child of a Container, and has been configured with a <code>ref</code>.\n                 */\n                this.refOwner = t;\n            }\n        }\n    },\n\n    removeRef : function() {\n        if (this.refOwner && this.refName) {\n            delete this.refOwner[this.refName];\n            delete this.refOwner;\n        }\n    },\n\n    // private\n    initState : function(){\n        if(Ext.state.Manager){\n            var id = this.getStateId();\n            if(id){\n                var state = Ext.state.Manager.get(id);\n                if(state){\n                    if(this.fireEvent('beforestaterestore', this, state) !== false){\n                        this.applyState(Ext.apply({}, state));\n                        this.fireEvent('staterestore', this, state);\n                    }\n                }\n            }\n        }\n    },\n\n    // private\n    getStateId : function(){\n        return this.stateId || ((/^(ext-comp-|ext-gen)/).test(String(this.id)) ? null : this.id);\n    },\n\n    // private\n    initStateEvents : function(){\n        if(this.stateEvents){\n            for(var i = 0, e; e = this.stateEvents[i]; i++){\n                this.on(e, this.saveState, this, {delay:100});\n            }\n        }\n    },\n\n    // private\n    applyState : function(state){\n        if(state){\n            Ext.apply(this, state);\n        }\n    },\n\n    // private\n    getState : function(){\n        return null;\n    },\n\n    // private\n    saveState : function(){\n        if(Ext.state.Manager && this.stateful !== false){\n            var id = this.getStateId();\n            if(id){\n                var state = this.getState();\n                if(this.fireEvent('beforestatesave', this, state) !== false){\n                    Ext.state.Manager.set(id, state);\n                    this.fireEvent('statesave', this, state);\n                }\n            }\n        }\n    },\n\n    /**\n     * Apply this component to existing markup that is valid. With this function, no call to render() is required.\n     * @param {String/HTMLElement} el\n     */\n    applyToMarkup : function(el){\n        this.allowDomMove = false;\n        this.el = Ext.get(el);\n        this.render(this.el.dom.parentNode);\n    },\n\n    /**\n     * Adds a CSS class to the component's underlying element.\n     * @param {string} cls The CSS class name to add\n     * @return {Ext.Component} this\n     */\n    addClass : function(cls){\n        if(this.el){\n            this.el.addClass(cls);\n        }else{\n            this.cls = this.cls ? this.cls + ' ' + cls : cls;\n        }\n        return this;\n    },\n\n    /**\n     * Removes a CSS class from the component's underlying element.\n     * @param {string} cls The CSS class name to remove\n     * @return {Ext.Component} this\n     */\n    removeClass : function(cls){\n        if(this.el){\n            this.el.removeClass(cls);\n        }else if(this.cls){\n            this.cls = this.cls.split(' ').remove(cls).join(' ');\n        }\n        return this;\n    },\n\n    // private\n    // default function is not really useful\n    onRender : function(ct, position){\n        if(!this.el && this.autoEl){\n            if(Ext.isString(this.autoEl)){\n                this.el = document.createElement(this.autoEl);\n            }else{\n                var div = document.createElement('div');\n                Ext.DomHelper.overwrite(div, this.autoEl);\n                this.el = div.firstChild;\n            }\n            if (!this.el.id) {\n                this.el.id = this.getId();\n            }\n        }\n        if(this.el){\n            this.el = Ext.get(this.el);\n            if(this.allowDomMove !== false){\n                ct.dom.insertBefore(this.el.dom, position);\n                if (div) {\n                    Ext.removeNode(div);\n                    div = null;\n                }\n            }\n        }\n    },\n\n    // private\n    getAutoCreate : function(){\n        var cfg = Ext.isObject(this.autoCreate) ?\n                      this.autoCreate : Ext.apply({}, this.defaultAutoCreate);\n        if(this.id && !cfg.id){\n            cfg.id = this.id;\n        }\n        return cfg;\n    },\n\n    // private\n    afterRender : Ext.emptyFn,\n\n    /**\n     * Destroys this component by purging any event listeners, removing the component's element from the DOM,\n     * removing the component from its {@link Ext.Container} (if applicable) and unregistering it from\n     * {@link Ext.ComponentMgr}.  Destruction is generally handled automatically by the framework and this method\n     * should usually not need to be called directly.\n     *\n     */\n    destroy : function(){\n        if(!this.isDestroyed){\n            if(this.fireEvent('beforedestroy', this) !== false){\n                this.destroying = true;\n                this.beforeDestroy();\n                if(this.ownerCt && this.ownerCt.remove){\n                    this.ownerCt.remove(this, false);\n                }\n                if(this.rendered){\n                    this.el.remove();\n                    if(this.actionMode == 'container' || this.removeMode == 'container'){\n                        this.container.remove();\n                    }\n                }\n                // Stop any buffered tasks\n                if(this.focusTask && this.focusTask.cancel){\n                    this.focusTask.cancel();\n                }\n                this.onDestroy();\n                Ext.ComponentMgr.unregister(this);\n                this.fireEvent('destroy', this);\n                this.purgeListeners();\n                this.destroying = false;\n                this.isDestroyed = true;\n            }\n        }\n    },\n\n    deleteMembers : function(){\n        var args = arguments;\n        for(var i = 0, len = args.length; i < len; ++i){\n            delete this[args[i]];\n        }\n    },\n\n    // private\n    beforeDestroy : Ext.emptyFn,\n\n    // private\n    onDestroy  : Ext.emptyFn,\n\n    /**\n     * <p>Returns the {@link Ext.Element} which encapsulates this Component.</p>\n     * <p>This will <i>usually</i> be a &lt;DIV> element created by the class's onRender method, but\n     * that may be overridden using the {@link #autoEl} config.</p>\n     * <br><p><b>Note</b>: this element will not be available until this Component has been rendered.</p><br>\n     * <p>To add listeners for <b>DOM events</b> to this Component (as opposed to listeners\n     * for this Component's own Observable events), see the {@link #listeners} config for a suggestion,\n     * or use a render listener directly:</p><pre><code>\nnew Ext.Panel({\n    title: 'The Clickable Panel',\n    listeners: {\n        render: function(p) {\n            // Append the Panel to the click handler&#39;s argument list.\n            p.getEl().on('click', handlePanelClick.createDelegate(null, [p], true));\n        },\n        single: true  // Remove the listener after first invocation\n    }\n});\n</code></pre>\n     * @return {Ext.Element} The Element which encapsulates this Component.\n     */\n    getEl : function(){\n        return this.el;\n    },\n\n    // private\n    getContentTarget : function(){\n        return this.el;\n    },\n\n    /**\n     * Returns the <code>id</code> of this component or automatically generates and\n     * returns an <code>id</code> if an <code>id</code> is not defined yet:<pre><code>\n     * 'ext-comp-' + (++Ext.Component.AUTO_ID)\n     * </code></pre>\n     * @return {String} id\n     */\n    getId : function(){\n        return this.id || (this.id = 'ext-comp-' + (++Ext.Component.AUTO_ID));\n    },\n\n    /**\n     * Returns the <code>{@link #itemId}</code> of this component.  If an\n     * <code>{@link #itemId}</code> was not assigned through configuration the\n     * <code>id</code> is returned using <code>{@link #getId}</code>.\n     * @return {String}\n     */\n    getItemId : function(){\n        return this.itemId || this.getId();\n    },\n\n    /**\n     * Try to focus this component.\n     * @param {Boolean} selectText (optional) If applicable, true to also select the text in this component\n     * @param {Boolean/Number} delay (optional) Delay the focus this number of milliseconds (true for 10 milliseconds)\n     * @return {Ext.Component} this\n     */\n    focus : function(selectText, delay){\n        if(delay){\n            this.focusTask = new Ext.util.DelayedTask(this.focus, this, [selectText, false]);\n            this.focusTask.delay(Ext.isNumber(delay) ? delay : 10);\n            return this;\n        }\n        if(this.rendered && !this.isDestroyed){\n            this.el.focus();\n            if(selectText === true){\n                this.el.dom.select();\n            }\n        }\n        return this;\n    },\n\n    // private\n    blur : function(){\n        if(this.rendered){\n            this.el.blur();\n        }\n        return this;\n    },\n\n    /**\n     * Disable this component and fire the 'disable' event.\n     * @return {Ext.Component} this\n     */\n    disable : function(/* private */ silent){\n        if(this.rendered){\n            this.onDisable();\n        }\n        this.disabled = true;\n        if(silent !== true){\n            this.fireEvent('disable', this);\n        }\n        return this;\n    },\n\n    // private\n    onDisable : function(){\n        this.getActionEl().addClass(this.disabledClass);\n        this.el.dom.disabled = true;\n    },\n\n    /**\n     * Enable this component and fire the 'enable' event.\n     * @return {Ext.Component} this\n     */\n    enable : function(){\n        if(this.rendered){\n            this.onEnable();\n        }\n        this.disabled = false;\n        this.fireEvent('enable', this);\n        return this;\n    },\n\n    // private\n    onEnable : function(){\n        this.getActionEl().removeClass(this.disabledClass);\n        this.el.dom.disabled = false;\n    },\n\n    /**\n     * Convenience function for setting disabled/enabled by boolean.\n     * @param {Boolean} disabled\n     * @return {Ext.Component} this\n     */\n    setDisabled : function(disabled){\n        return this[disabled ? 'disable' : 'enable']();\n    },\n\n    /**\n     * Show this component.  Listen to the '{@link #beforeshow}' event and return\n     * <tt>false</tt> to cancel showing the component.  Fires the '{@link #show}'\n     * event after showing the component.\n     * @return {Ext.Component} this\n     */\n    show : function(){\n        if(this.fireEvent('beforeshow', this) !== false){\n            this.hidden = false;\n            if(this.autoRender){\n                this.render(Ext.isBoolean(this.autoRender) ? Ext.getBody() : this.autoRender);\n            }\n            if(this.rendered){\n                this.onShow();\n            }\n            this.fireEvent('show', this);\n        }\n        return this;\n    },\n\n    // private\n    onShow : function(){\n        this.getVisibilityEl().removeClass('x-hide-' + this.hideMode);\n    },\n\n    /**\n     * Hide this component.  Listen to the '{@link #beforehide}' event and return\n     * <tt>false</tt> to cancel hiding the component.  Fires the '{@link #hide}'\n     * event after hiding the component. Note this method is called internally if\n     * the component is configured to be <code>{@link #hidden}</code>.\n     * @return {Ext.Component} this\n     */\n    hide : function(){\n        if(this.fireEvent('beforehide', this) !== false){\n            this.doHide();\n            this.fireEvent('hide', this);\n        }\n        return this;\n    },\n\n    // private\n    doHide: function(){\n        this.hidden = true;\n        if(this.rendered){\n            this.onHide();\n        }\n    },\n\n    // private\n    onHide : function(){\n        this.getVisibilityEl().addClass('x-hide-' + this.hideMode);\n    },\n\n    // private\n    getVisibilityEl : function(){\n        return this.hideParent ? this.container : this.getActionEl();\n    },\n\n    /**\n     * Convenience function to hide or show this component by boolean.\n     * @param {Boolean} visible True to show, false to hide\n     * @return {Ext.Component} this\n     */\n    setVisible : function(visible){\n        return this[visible ? 'show' : 'hide']();\n    },\n\n    /**\n     * Returns true if this component is visible.\n     * @return {Boolean} True if this component is visible, false otherwise.\n     */\n    isVisible : function(){\n        return this.rendered && this.getVisibilityEl().isVisible();\n    },\n\n    /**\n     * Clone the current component using the original config values passed into this instance by default.\n     * @param {Object} overrides A new config containing any properties to override in the cloned version.\n     * An id property can be passed on this object, otherwise one will be generated to avoid duplicates.\n     * @return {Ext.Component} clone The cloned copy of this component\n     */\n    cloneConfig : function(overrides){\n        overrides = overrides || {};\n        var id = overrides.id || Ext.id();\n        var cfg = Ext.applyIf(overrides, this.initialConfig);\n        cfg.id = id; // prevent dup id\n        return new this.constructor(cfg);\n    },\n\n    /**\n     * Gets the xtype for this component as registered with {@link Ext.ComponentMgr}. For a list of all\n     * available xtypes, see the {@link Ext.Component} header. Example usage:\n     * <pre><code>\nvar t = new Ext.form.TextField();\nalert(t.getXType());  // alerts 'textfield'\n</code></pre>\n     * @return {String} The xtype\n     */\n    getXType : function(){\n        return this.constructor.xtype;\n    },\n\n    /**\n     * <p>Tests whether or not this Component is of a specific xtype. This can test whether this Component is descended\n     * from the xtype (default) or whether it is directly of the xtype specified (shallow = true).</p>\n     * <p><b>If using your own subclasses, be aware that a Component must register its own xtype\n     * to participate in determination of inherited xtypes.</b></p>\n     * <p>For a list of all available xtypes, see the {@link Ext.Component} header.</p>\n     * <p>Example usage:</p>\n     * <pre><code>\nvar t = new Ext.form.TextField();\nvar isText = t.isXType('textfield');        // true\nvar isBoxSubclass = t.isXType('box');       // true, descended from BoxComponent\nvar isBoxInstance = t.isXType('box', true); // false, not a direct BoxComponent instance\n</code></pre>\n     * @param {String/Ext.Component/Class} xtype The xtype to check for this Component. Note that the the component can either be an instance\n     * or a component class:\n     * <pre><code>\nvar c = new Ext.Component();\nconsole.log(c.isXType(c));\nconsole.log(c.isXType(Ext.Component));\n</code></pre>\n     * @param {Boolean} shallow (optional) False to check whether this Component is descended from the xtype (this is\n     * the default), or true to check whether this Component is directly of the specified xtype.\n     * @return {Boolean} True if this component descends from the specified xtype, false otherwise.\n     */\n    isXType : function(xtype, shallow){\n        //assume a string by default\n        if (Ext.isFunction(xtype)){\n            xtype = xtype.xtype; //handle being passed the class, e.g. Ext.Component\n        }else if (Ext.isObject(xtype)){\n            xtype = xtype.constructor.xtype; //handle being passed an instance\n        }\n\n        return !shallow ? ('/' + this.getXTypes() + '/').indexOf('/' + xtype + '/') != -1 : this.constructor.xtype == xtype;\n    },\n\n    /**\n     * <p>Returns this Component's xtype hierarchy as a slash-delimited string. For a list of all\n     * available xtypes, see the {@link Ext.Component} header.</p>\n     * <p><b>If using your own subclasses, be aware that a Component must register its own xtype\n     * to participate in determination of inherited xtypes.</b></p>\n     * <p>Example usage:</p>\n     * <pre><code>\nvar t = new Ext.form.TextField();\nalert(t.getXTypes());  // alerts 'component/box/field/textfield'\n</code></pre>\n     * @return {String} The xtype hierarchy string\n     */\n    getXTypes : function(){\n        var tc = this.constructor;\n        if(!tc.xtypes){\n            var c = [], sc = this;\n            while(sc && sc.constructor.xtype){\n                c.unshift(sc.constructor.xtype);\n                sc = sc.constructor.superclass;\n            }\n            tc.xtypeChain = c;\n            tc.xtypes = c.join('/');\n        }\n        return tc.xtypes;\n    },\n\n    /**\n     * Find a container above this component at any level by a custom function. If the passed function returns\n     * true, the container will be returned.\n     * @param {Function} fn The custom function to call with the arguments (container, this component).\n     * @return {Ext.Container} The first Container for which the custom function returns true\n     */\n    findParentBy : function(fn) {\n        for (var p = this.ownerCt; (p != null) && !fn(p, this); p = p.ownerCt);\n        return p || null;\n    },\n\n    /**\n     * Find a container above this component at any level by xtype or class\n     * @param {String/Ext.Component/Class} xtype The xtype to check for this Component. Note that the the component can either be an instance\n     * or a component class:\n     * @param {Boolean} shallow (optional) False to check whether this Component is descended from the xtype (this is\n     * the default), or true to check whether this Component is directly of the specified xtype.\n     * @return {Ext.Container} The first Container which matches the given xtype or class\n     */\n    findParentByType : function(xtype, shallow){\n        return this.findParentBy(function(c){\n            return c.isXType(xtype, shallow);\n        });\n    },\n\n    /**\n     * Bubbles up the component/container heirarchy, calling the specified function with each component. The scope (<i>this</i>) of\n     * function call will be the scope provided or the current component. The arguments to the function\n     * will be the args provided or the current component. If the function returns false at any point,\n     * the bubble is stopped.\n     * @param {Function} fn The function to call\n     * @param {Object} scope (optional) The scope of the function (defaults to current node)\n     * @param {Array} args (optional) The args to call the function with (default to passing the current component)\n     * @return {Ext.Component} this\n     */\n    bubble : function(fn, scope, args){\n        var p = this;\n        while(p){\n            if(fn.apply(scope || p, args || [p]) === false){\n                break;\n            }\n            p = p.ownerCt;\n        }\n        return this;\n    },\n\n    // protected\n    getPositionEl : function(){\n        return this.positionEl || this.el;\n    },\n\n    // private\n    purgeListeners : function(){\n        Ext.Component.superclass.purgeListeners.call(this);\n        if(this.mons){\n            this.on('beforedestroy', this.clearMons, this, {single: true});\n        }\n    },\n\n    // private\n    clearMons : function(){\n        Ext.each(this.mons, function(m){\n            m.item.un(m.ename, m.fn, m.scope);\n        }, this);\n        this.mons = [];\n    },\n\n    // private\n    createMons: function(){\n        if(!this.mons){\n            this.mons = [];\n            this.on('beforedestroy', this.clearMons, this, {single: true});\n        }\n    },\n\n    /**\n     * <p>Adds listeners to any Observable object (or Elements) which are automatically removed when this Component\n     * is destroyed. Usage:</p><code><pre>\nmyGridPanel.mon(myGridPanel.getSelectionModel(), 'selectionchange', handleSelectionChange, null, {buffer: 50});\n</pre></code>\n     * <p>or:</p><code><pre>\nmyGridPanel.mon(myGridPanel.getSelectionModel(), {\n    selectionchange: handleSelectionChange,\n    buffer: 50\n});\n</pre></code>\n     * @param {Observable|Element} item The item to which to add a listener/listeners.\n     * @param {Object|String} ename The event name, or an object containing event name properties.\n     * @param {Function} fn Optional. If the <code>ename</code> parameter was an event name, this\n     * is the handler function.\n     * @param {Object} scope Optional. If the <code>ename</code> parameter was an event name, this\n     * is the scope (<code>this</code> reference) in which the handler function is executed.\n     * @param {Object} opt Optional. If the <code>ename</code> parameter was an event name, this\n     * is the {@link Ext.util.Observable#addListener addListener} options.\n     */\n    mon : function(item, ename, fn, scope, opt){\n        this.createMons();\n        if(Ext.isObject(ename)){\n            var propRe = /^(?:scope|delay|buffer|single|stopEvent|preventDefault|stopPropagation|normalized|args|delegate)$/;\n\n            var o = ename;\n            for(var e in o){\n                if(propRe.test(e)){\n                    continue;\n                }\n                if(Ext.isFunction(o[e])){\n                    // shared options\n                    this.mons.push({\n                        item: item, ename: e, fn: o[e], scope: o.scope\n                    });\n                    item.on(e, o[e], o.scope, o);\n                }else{\n                    // individual options\n                    this.mons.push({\n                        item: item, ename: e, fn: o[e], scope: o.scope\n                    });\n                    item.on(e, o[e]);\n                }\n            }\n            return;\n        }\n\n        this.mons.push({\n            item: item, ename: ename, fn: fn, scope: scope\n        });\n        item.on(ename, fn, scope, opt);\n    },\n\n    /**\n     * Removes listeners that were added by the {@link #mon} method.\n     * @param {Observable|Element} item The item from which to remove a listener/listeners.\n     * @param {Object|String} ename The event name, or an object containing event name properties.\n     * @param {Function} fn Optional. If the <code>ename</code> parameter was an event name, this\n     * is the handler function.\n     * @param {Object} scope Optional. If the <code>ename</code> parameter was an event name, this\n     * is the scope (<code>this</code> reference) in which the handler function is executed.\n     */\n    mun : function(item, ename, fn, scope){\n        var found, mon;\n        this.createMons();\n        for(var i = 0, len = this.mons.length; i < len; ++i){\n            mon = this.mons[i];\n            if(item === mon.item && ename == mon.ename && fn === mon.fn && scope === mon.scope){\n                this.mons.splice(i, 1);\n                item.un(ename, fn, scope);\n                found = true;\n                break;\n            }\n        }\n        return found;\n    },\n\n    /**\n     * Returns the next component in the owning container\n     * @return Ext.Component\n     */\n    nextSibling : function(){\n        if(this.ownerCt){\n            var index = this.ownerCt.items.indexOf(this);\n            if(index != -1 && index+1 < this.ownerCt.items.getCount()){\n                return this.ownerCt.items.itemAt(index+1);\n            }\n        }\n        return null;\n    },\n\n    /**\n     * Returns the previous component in the owning container\n     * @return Ext.Component\n     */\n    previousSibling : function(){\n        if(this.ownerCt){\n            var index = this.ownerCt.items.indexOf(this);\n            if(index > 0){\n                return this.ownerCt.items.itemAt(index-1);\n            }\n        }\n        return null;\n    },\n\n    /**\n     * Provides the link for Observable's fireEvent method to bubble up the ownership hierarchy.\n     * @return {Ext.Container} the Container which owns this Component.\n     */\n    getBubbleTarget : function(){\n        return this.ownerCt;\n    }\n});\n\nExt.reg('component', Ext.Component);\n/**\n * @class Ext.Action\n * <p>An Action is a piece of reusable functionality that can be abstracted out of any particular component so that it\n * can be usefully shared among multiple components.  Actions let you share handlers, configuration options and UI\n * updates across any components that support the Action interface (primarily {@link Ext.Toolbar}, {@link Ext.Button}\n * and {@link Ext.menu.Menu} components).</p>\n * <p>Aside from supporting the config object interface, any component that needs to use Actions must also support\n * the following method list, as these will be called as needed by the Action class: setText(string), setIconCls(string),\n * setDisabled(boolean), setVisible(boolean) and setHandler(function).</p>\n * Example usage:<br>\n * <pre><code>\n// Define the shared action.  Each component below will have the same\n// display text and icon, and will display the same message on click.\nvar action = new Ext.Action({\n    {@link #text}: 'Do something',\n    {@link #handler}: function(){\n        Ext.Msg.alert('Click', 'You did something.');\n    },\n    {@link #iconCls}: 'do-something',\n    {@link #itemId}: 'myAction'\n});\n\nvar panel = new Ext.Panel({\n    title: 'Actions',\n    width: 500,\n    height: 300,\n    tbar: [\n        // Add the action directly to a toolbar as a menu button\n        action,\n        {\n            text: 'Action Menu',\n            // Add the action to a menu as a text item\n            menu: [action]\n        }\n    ],\n    items: [\n        // Add the action to the panel body as a standard button\n        new Ext.Button(action)\n    ],\n    renderTo: Ext.getBody()\n});\n\n// Change the text for all components using the action\naction.setText('Something else');\n\n// Reference an action through a container using the itemId\nvar btn = panel.getComponent('myAction');\nvar aRef = btn.baseAction;\naRef.setText('New text');\n</code></pre>\n * @constructor\n * @param {Object} config The configuration options\n */\nExt.Action = Ext.extend(Object, {\n    /**\n     * @cfg {String} text The text to set for all components using this action (defaults to '').\n     */\n    /**\n     * @cfg {String} iconCls\n     * The CSS class selector that specifies a background image to be used as the header icon for\n     * all components using this action (defaults to '').\n     * <p>An example of specifying a custom icon class would be something like:\n     * </p><pre><code>\n// specify the property in the config for the class:\n     ...\n     iconCls: 'do-something'\n\n// css class that specifies background image to be used as the icon image:\n.do-something { background-image: url(../images/my-icon.gif) 0 6px no-repeat !important; }\n</code></pre>\n     */\n    /**\n     * @cfg {Boolean} disabled True to disable all components using this action, false to enable them (defaults to false).\n     */\n    /**\n     * @cfg {Boolean} hidden True to hide all components using this action, false to show them (defaults to false).\n     */\n    /**\n     * @cfg {Function} handler The function that will be invoked by each component tied to this action\n     * when the component's primary event is triggered (defaults to undefined).\n     */\n    /**\n     * @cfg {String} itemId\n     * See {@link Ext.Component}.{@link Ext.Component#itemId itemId}.\n     */\n    /**\n     * @cfg {Object} scope The scope (<tt><b>this</b></tt> reference) in which the\n     * <code>{@link #handler}</code> is executed. Defaults to this Button.\n     */\n\n    constructor : function(config){\n        this.initialConfig = config;\n        this.itemId = config.itemId = (config.itemId || config.id || Ext.id());\n        this.items = [];\n    },\n    \n    // private\n    isAction : true,\n\n    /**\n     * Sets the text to be displayed by all components using this action.\n     * @param {String} text The text to display\n     */\n    setText : function(text){\n        this.initialConfig.text = text;\n        this.callEach('setText', [text]);\n    },\n\n    /**\n     * Gets the text currently displayed by all components using this action.\n     */\n    getText : function(){\n        return this.initialConfig.text;\n    },\n\n    /**\n     * Sets the icon CSS class for all components using this action.  The class should supply\n     * a background image that will be used as the icon image.\n     * @param {String} cls The CSS class supplying the icon image\n     */\n    setIconClass : function(cls){\n        this.initialConfig.iconCls = cls;\n        this.callEach('setIconClass', [cls]);\n    },\n\n    /**\n     * Gets the icon CSS class currently used by all components using this action.\n     */\n    getIconClass : function(){\n        return this.initialConfig.iconCls;\n    },\n\n    /**\n     * Sets the disabled state of all components using this action.  Shortcut method\n     * for {@link #enable} and {@link #disable}.\n     * @param {Boolean} disabled True to disable the component, false to enable it\n     */\n    setDisabled : function(v){\n        this.initialConfig.disabled = v;\n        this.callEach('setDisabled', [v]);\n    },\n\n    /**\n     * Enables all components using this action.\n     */\n    enable : function(){\n        this.setDisabled(false);\n    },\n\n    /**\n     * Disables all components using this action.\n     */\n    disable : function(){\n        this.setDisabled(true);\n    },\n\n    /**\n     * Returns true if the components using this action are currently disabled, else returns false.  \n     */\n    isDisabled : function(){\n        return this.initialConfig.disabled;\n    },\n\n    /**\n     * Sets the hidden state of all components using this action.  Shortcut method\n     * for <code>{@link #hide}</code> and <code>{@link #show}</code>.\n     * @param {Boolean} hidden True to hide the component, false to show it\n     */\n    setHidden : function(v){\n        this.initialConfig.hidden = v;\n        this.callEach('setVisible', [!v]);\n    },\n\n    /**\n     * Shows all components using this action.\n     */\n    show : function(){\n        this.setHidden(false);\n    },\n\n    /**\n     * Hides all components using this action.\n     */\n    hide : function(){\n        this.setHidden(true);\n    },\n\n    /**\n     * Returns true if the components using this action are currently hidden, else returns false.  \n     */\n    isHidden : function(){\n        return this.initialConfig.hidden;\n    },\n\n    /**\n     * Sets the function that will be called by each Component using this action when its primary event is triggered.\n     * @param {Function} fn The function that will be invoked by the action's components.  The function\n     * will be called with no arguments.\n     * @param {Object} scope The scope (<code>this</code> reference) in which the function is executed. Defaults to the Component firing the event.\n     */\n    setHandler : function(fn, scope){\n        this.initialConfig.handler = fn;\n        this.initialConfig.scope = scope;\n        this.callEach('setHandler', [fn, scope]);\n    },\n\n    /**\n     * Executes the specified function once for each Component currently tied to this action.  The function passed\n     * in should accept a single argument that will be an object that supports the basic Action config/method interface.\n     * @param {Function} fn The function to execute for each component\n     * @param {Object} scope The scope (<code>this</code> reference) in which the function is executed.  Defaults to the Component.\n     */\n    each : function(fn, scope){\n        Ext.each(this.items, fn, scope);\n    },\n\n    // private\n    callEach : function(fnName, args){\n        var cs = this.items;\n        for(var i = 0, len = cs.length; i < len; i++){\n            cs[i][fnName].apply(cs[i], args);\n        }\n    },\n\n    // private\n    addComponent : function(comp){\n        this.items.push(comp);\n        comp.on('destroy', this.removeComponent, this);\n    },\n\n    // private\n    removeComponent : function(comp){\n        this.items.remove(comp);\n    },\n\n    /**\n     * Executes this action manually using the handler function specified in the original config object\n     * or the handler function set with <code>{@link #setHandler}</code>.  Any arguments passed to this\n     * function will be passed on to the handler function.\n     * @param {Mixed...} args Variable number of arguments passed to the handler function\n     */\n    execute : function(){\n        this.initialConfig.handler.apply(this.initialConfig.scope || window, arguments);\n    }\n});\n/**\n * @class Ext.Layer\n * @extends Ext.Element\n * An extended {@link Ext.Element} object that supports a shadow and shim, constrain to viewport and\n * automatic maintaining of shadow/shim positions.\n * @cfg {Boolean} shim False to disable the iframe shim in browsers which need one (defaults to true)\n * @cfg {String/Boolean} shadow True to automatically create an {@link Ext.Shadow}, or a string indicating the\n * shadow's display {@link Ext.Shadow#mode}. False to disable the shadow. (defaults to false)\n * @cfg {Object} dh DomHelper object config to create element with (defaults to {tag: 'div', cls: 'x-layer'}).\n * @cfg {Boolean} constrain False to disable constrain to viewport (defaults to true)\n * @cfg {String} cls CSS class to add to the element\n * @cfg {Number} zindex Starting z-index (defaults to 11000)\n * @cfg {Number} shadowOffset Number of pixels to offset the shadow (defaults to 4)\n * @cfg {Boolean} useDisplay\n * Defaults to use css offsets to hide the Layer. Specify <tt>true</tt>\n * to use css style <tt>'display:none;'</tt> to hide the Layer.\n * @constructor\n * @param {Object} config An object with config options.\n * @param {String/HTMLElement} existingEl (optional) Uses an existing DOM element. If the element is not found it creates it.\n */\n(function(){\nExt.Layer = function(config, existingEl){\n    config = config || {};\n    var dh = Ext.DomHelper,\n        cp = config.parentEl, pel = cp ? Ext.getDom(cp) : document.body;\n        \n    if (existingEl) {\n        this.dom = Ext.getDom(existingEl);\n    }\n    if(!this.dom){\n        var o = config.dh || {tag: 'div', cls: 'x-layer'};\n        this.dom = dh.append(pel, o);\n    }\n    if(config.cls){\n        this.addClass(config.cls);\n    }\n    this.constrain = config.constrain !== false;\n    this.setVisibilityMode(Ext.Element.VISIBILITY);\n    if(config.id){\n        this.id = this.dom.id = config.id;\n    }else{\n        this.id = Ext.id(this.dom);\n    }\n    this.zindex = config.zindex || this.getZIndex();\n    this.position('absolute', this.zindex);\n    if(config.shadow){\n        this.shadowOffset = config.shadowOffset || 4;\n        this.shadow = new Ext.Shadow({\n            offset : this.shadowOffset,\n            mode : config.shadow\n        });\n    }else{\n        this.shadowOffset = 0;\n    }\n    this.useShim = config.shim !== false && Ext.useShims;\n    this.useDisplay = config.useDisplay;\n    this.hide();\n};\n\nvar supr = Ext.Element.prototype;\n\n// shims are shared among layer to keep from having 100 iframes\nvar shims = [];\n\nExt.extend(Ext.Layer, Ext.Element, {\n\n    getZIndex : function(){\n        return this.zindex || parseInt((this.getShim() || this).getStyle('z-index'), 10) || 11000;\n    },\n\n    getShim : function(){\n        if(!this.useShim){\n            return null;\n        }\n        if(this.shim){\n            return this.shim;\n        }\n        var shim = shims.shift();\n        if(!shim){\n            shim = this.createShim();\n            shim.enableDisplayMode('block');\n            shim.dom.style.display = 'none';\n            shim.dom.style.visibility = 'visible';\n        }\n        var pn = this.dom.parentNode;\n        if(shim.dom.parentNode != pn){\n            pn.insertBefore(shim.dom, this.dom);\n        }\n        shim.setStyle('z-index', this.getZIndex()-2);\n        this.shim = shim;\n        return shim;\n    },\n\n    hideShim : function(){\n        if(this.shim){\n            this.shim.setDisplayed(false);\n            shims.push(this.shim);\n            delete this.shim;\n        }\n    },\n\n    disableShadow : function(){\n        if(this.shadow){\n            this.shadowDisabled = true;\n            this.shadow.hide();\n            this.lastShadowOffset = this.shadowOffset;\n            this.shadowOffset = 0;\n        }\n    },\n\n    enableShadow : function(show){\n        if(this.shadow){\n            this.shadowDisabled = false;\n            if(Ext.isDefined(this.lastShadowOffset)) {\n                this.shadowOffset = this.lastShadowOffset;\n                delete this.lastShadowOffset;\n            }\n            if(show){\n                this.sync(true);\n            }\n        }\n    },\n\n    // private\n    // this code can execute repeatedly in milliseconds (i.e. during a drag) so\n    // code size was sacrificed for effeciency (e.g. no getBox/setBox, no XY calls)\n    sync : function(doShow){\n        var shadow = this.shadow;\n        if(!this.updating && this.isVisible() && (shadow || this.useShim)){\n            var shim = this.getShim(),\n                w = this.getWidth(),\n                h = this.getHeight(),\n                l = this.getLeft(true),\n                t = this.getTop(true);\n\n            if(shadow && !this.shadowDisabled){\n                if(doShow && !shadow.isVisible()){\n                    shadow.show(this);\n                }else{\n                    shadow.realign(l, t, w, h);\n                }\n                if(shim){\n                    if(doShow){\n                       shim.show();\n                    }\n                    // fit the shim behind the shadow, so it is shimmed too\n                    var shadowAdj = shadow.el.getXY(), shimStyle = shim.dom.style,\n                        shadowSize = shadow.el.getSize();\n                    shimStyle.left = (shadowAdj[0])+'px';\n                    shimStyle.top = (shadowAdj[1])+'px';\n                    shimStyle.width = (shadowSize.width)+'px';\n                    shimStyle.height = (shadowSize.height)+'px';\n                }\n            }else if(shim){\n                if(doShow){\n                   shim.show();\n                }\n                shim.setSize(w, h);\n                shim.setLeftTop(l, t);\n            }\n        }\n    },\n\n    // private\n    destroy : function(){\n        this.hideShim();\n        if(this.shadow){\n            this.shadow.hide();\n        }\n        this.removeAllListeners();\n        Ext.removeNode(this.dom);\n        delete this.dom;\n    },\n\n    remove : function(){\n        this.destroy();\n    },\n\n    // private\n    beginUpdate : function(){\n        this.updating = true;\n    },\n\n    // private\n    endUpdate : function(){\n        this.updating = false;\n        this.sync(true);\n    },\n\n    // private\n    hideUnders : function(negOffset){\n        if(this.shadow){\n            this.shadow.hide();\n        }\n        this.hideShim();\n    },\n\n    // private\n    constrainXY : function(){\n        if(this.constrain){\n            var vw = Ext.lib.Dom.getViewWidth(),\n                vh = Ext.lib.Dom.getViewHeight();\n            var s = Ext.getDoc().getScroll();\n\n            var xy = this.getXY();\n            var x = xy[0], y = xy[1];\n            var so = this.shadowOffset;\n            var w = this.dom.offsetWidth+so, h = this.dom.offsetHeight+so;\n            // only move it if it needs it\n            var moved = false;\n            // first validate right/bottom\n            if((x + w) > vw+s.left){\n                x = vw - w - so;\n                moved = true;\n            }\n            if((y + h) > vh+s.top){\n                y = vh - h - so;\n                moved = true;\n            }\n            // then make sure top/left isn't negative\n            if(x < s.left){\n                x = s.left;\n                moved = true;\n            }\n            if(y < s.top){\n                y = s.top;\n                moved = true;\n            }\n            if(moved){\n                if(this.avoidY){\n                    var ay = this.avoidY;\n                    if(y <= ay && (y+h) >= ay){\n                        y = ay-h-5;\n                    }\n                }\n                xy = [x, y];\n                this.storeXY(xy);\n                supr.setXY.call(this, xy);\n                this.sync();\n            }\n        }\n        return this;\n    },\n    \n    getConstrainOffset : function(){\n        return this.shadowOffset;    \n    },\n\n    isVisible : function(){\n        return this.visible;\n    },\n\n    // private\n    showAction : function(){\n        this.visible = true; // track visibility to prevent getStyle calls\n        if(this.useDisplay === true){\n            this.setDisplayed('');\n        }else if(this.lastXY){\n            supr.setXY.call(this, this.lastXY);\n        }else if(this.lastLT){\n            supr.setLeftTop.call(this, this.lastLT[0], this.lastLT[1]);\n        }\n    },\n\n    // private\n    hideAction : function(){\n        this.visible = false;\n        if(this.useDisplay === true){\n            this.setDisplayed(false);\n        }else{\n            this.setLeftTop(-10000,-10000);\n        }\n    },\n\n    // overridden Element method\n    setVisible : function(v, a, d, c, e){\n        if(v){\n            this.showAction();\n        }\n        if(a && v){\n            var cb = function(){\n                this.sync(true);\n                if(c){\n                    c();\n                }\n            }.createDelegate(this);\n            supr.setVisible.call(this, true, true, d, cb, e);\n        }else{\n            if(!v){\n                this.hideUnders(true);\n            }\n            var cb = c;\n            if(a){\n                cb = function(){\n                    this.hideAction();\n                    if(c){\n                        c();\n                    }\n                }.createDelegate(this);\n            }\n            supr.setVisible.call(this, v, a, d, cb, e);\n            if(v){\n                this.sync(true);\n            }else if(!a){\n                this.hideAction();\n            }\n        }\n        return this;\n    },\n\n    storeXY : function(xy){\n        delete this.lastLT;\n        this.lastXY = xy;\n    },\n\n    storeLeftTop : function(left, top){\n        delete this.lastXY;\n        this.lastLT = [left, top];\n    },\n\n    // private\n    beforeFx : function(){\n        this.beforeAction();\n        return Ext.Layer.superclass.beforeFx.apply(this, arguments);\n    },\n\n    // private\n    afterFx : function(){\n        Ext.Layer.superclass.afterFx.apply(this, arguments);\n        this.sync(this.isVisible());\n    },\n\n    // private\n    beforeAction : function(){\n        if(!this.updating && this.shadow){\n            this.shadow.hide();\n        }\n    },\n\n    // overridden Element method\n    setLeft : function(left){\n        this.storeLeftTop(left, this.getTop(true));\n        supr.setLeft.apply(this, arguments);\n        this.sync();\n        return this;\n    },\n\n    setTop : function(top){\n        this.storeLeftTop(this.getLeft(true), top);\n        supr.setTop.apply(this, arguments);\n        this.sync();\n        return this;\n    },\n\n    setLeftTop : function(left, top){\n        this.storeLeftTop(left, top);\n        supr.setLeftTop.apply(this, arguments);\n        this.sync();\n        return this;\n    },\n\n    setXY : function(xy, a, d, c, e){\n        this.fixDisplay();\n        this.beforeAction();\n        this.storeXY(xy);\n        var cb = this.createCB(c);\n        supr.setXY.call(this, xy, a, d, cb, e);\n        if(!a){\n            cb();\n        }\n        return this;\n    },\n\n    // private\n    createCB : function(c){\n        var el = this;\n        return function(){\n            el.constrainXY();\n            el.sync(true);\n            if(c){\n                c();\n            }\n        };\n    },\n\n    // overridden Element method\n    setX : function(x, a, d, c, e){\n        this.setXY([x, this.getY()], a, d, c, e);\n        return this;\n    },\n\n    // overridden Element method\n    setY : function(y, a, d, c, e){\n        this.setXY([this.getX(), y], a, d, c, e);\n        return this;\n    },\n\n    // overridden Element method\n    setSize : function(w, h, a, d, c, e){\n        this.beforeAction();\n        var cb = this.createCB(c);\n        supr.setSize.call(this, w, h, a, d, cb, e);\n        if(!a){\n            cb();\n        }\n        return this;\n    },\n\n    // overridden Element method\n    setWidth : function(w, a, d, c, e){\n        this.beforeAction();\n        var cb = this.createCB(c);\n        supr.setWidth.call(this, w, a, d, cb, e);\n        if(!a){\n            cb();\n        }\n        return this;\n    },\n\n    // overridden Element method\n    setHeight : function(h, a, d, c, e){\n        this.beforeAction();\n        var cb = this.createCB(c);\n        supr.setHeight.call(this, h, a, d, cb, e);\n        if(!a){\n            cb();\n        }\n        return this;\n    },\n\n    // overridden Element method\n    setBounds : function(x, y, w, h, a, d, c, e){\n        this.beforeAction();\n        var cb = this.createCB(c);\n        if(!a){\n            this.storeXY([x, y]);\n            supr.setXY.call(this, [x, y]);\n            supr.setSize.call(this, w, h, a, d, cb, e);\n            cb();\n        }else{\n            supr.setBounds.call(this, x, y, w, h, a, d, cb, e);\n        }\n        return this;\n    },\n\n    /**\n     * Sets the z-index of this layer and adjusts any shadow and shim z-indexes. The layer z-index is automatically\n     * incremented by two more than the value passed in so that it always shows above any shadow or shim (the shadow\n     * element, if any, will be assigned z-index + 1, and the shim element, if any, will be assigned the unmodified z-index).\n     * @param {Number} zindex The new z-index to set\n     * @return {this} The Layer\n     */\n    setZIndex : function(zindex){\n        this.zindex = zindex;\n        this.setStyle('z-index', zindex + 2);\n        if(this.shadow){\n            this.shadow.setZIndex(zindex + 1);\n        }\n        if(this.shim){\n            this.shim.setStyle('z-index', zindex);\n        }\n        return this;\n    }\n});\n})();\n/**\n * @class Ext.Shadow\n * Simple class that can provide a shadow effect for any element.  Note that the element MUST be absolutely positioned,\n * and the shadow does not provide any shimming.  This should be used only in simple cases -- for more advanced\n * functionality that can also provide the same shadow effect, see the {@link Ext.Layer} class.\n * @constructor\n * Create a new Shadow\n * @param {Object} config The config object\n */\nExt.Shadow = function(config) {\n    Ext.apply(this, config);\n    if (typeof this.mode != \"string\") {\n        this.mode = this.defaultMode;\n    }\n    var o = this.offset,\n        a = {\n            h: 0\n        },\n        rad = Math.floor(this.offset / 2);\n    switch (this.mode.toLowerCase()) {\n        // all this hideous nonsense calculates the various offsets for shadows\n        case \"drop\":\n            a.w = 0;\n            a.l = a.t = o;\n            a.t -= 1;\n            if (Ext.isIE9m) {\n                a.l -= this.offset + rad;\n                a.t -= this.offset + rad;\n                a.w -= rad;\n                a.h -= rad;\n                a.t += 1;\n            }\n        break;\n        case \"sides\":\n            a.w = (o * 2);\n            a.l = -o;\n            a.t = o - 1;\n            if (Ext.isIE9m) {\n                a.l -= (this.offset - rad);\n                a.t -= this.offset + rad;\n                a.l += 1;\n                a.w -= (this.offset - rad) * 2;\n                a.w -= rad + 1;\n                a.h -= 1;\n            }\n        break;\n        case \"frame\":\n            a.w = a.h = (o * 2);\n            a.l = a.t = -o;\n            a.t += 1;\n            a.h -= 2;\n            if (Ext.isIE9m) {\n                a.l -= (this.offset - rad);\n                a.t -= (this.offset - rad);\n                a.l += 1;\n                a.w -= (this.offset + rad + 1);\n                a.h -= (this.offset + rad);\n                a.h += 1;\n            }\n        break;\n    };\n\n    this.adjusts = a;\n};\n\nExt.Shadow.prototype = {\n    /**\n     * @cfg {String} mode\n     * The shadow display mode.  Supports the following options:<div class=\"mdetail-params\"><ul>\n     * <li><b><tt>sides</tt></b> : Shadow displays on both sides and bottom only</li>\n     * <li><b><tt>frame</tt></b> : Shadow displays equally on all four sides</li>\n     * <li><b><tt>drop</tt></b> : Traditional bottom-right drop shadow</li>\n     * </ul></div>\n     */\n    /**\n     * @cfg {String} offset\n     * The number of pixels to offset the shadow from the element (defaults to <tt>4</tt>)\n     */\n    offset: 4,\n\n    // private\n    defaultMode: \"drop\",\n\n    /**\n     * Displays the shadow under the target element\n     * @param {Mixed} targetEl The id or element under which the shadow should display\n     */\n    show: function(target) {\n        target = Ext.get(target);\n        if (!this.el) {\n            this.el = Ext.Shadow.Pool.pull();\n            if (this.el.dom.nextSibling != target.dom) {\n                this.el.insertBefore(target);\n            }\n        }\n        this.el.setStyle(\"z-index\", this.zIndex || parseInt(target.getStyle(\"z-index\"), 10) - 1);\n        if (Ext.isIE9m) {\n            this.el.dom.style.filter = \"progid:DXImageTransform.Microsoft.alpha(opacity=50) progid:DXImageTransform.Microsoft.Blur(pixelradius=\" + (this.offset) + \")\";\n        }\n        this.realign(\n        target.getLeft(true),\n        target.getTop(true),\n        target.getWidth(),\n        target.getHeight()\n        );\n        this.el.dom.style.display = \"block\";\n    },\n\n    /**\n     * Returns true if the shadow is visible, else false\n     */\n    isVisible: function() {\n        return this.el ? true: false;\n    },\n\n    /**\n     * Direct alignment when values are already available. Show must be called at least once before\n     * calling this method to ensure it is initialized.\n     * @param {Number} left The target element left position\n     * @param {Number} top The target element top position\n     * @param {Number} width The target element width\n     * @param {Number} height The target element height\n     */\n    realign: function(l, t, w, h) {\n        if (!this.el) {\n            return;\n        }\n        var a = this.adjusts,\n            d = this.el.dom,\n            s = d.style,\n            iea = 0,\n            sw = (w + a.w),\n            sh = (h + a.h),\n            sws = sw + \"px\",\n            shs = sh + \"px\",\n            cn,\n            sww;\n        s.left = (l + a.l) + \"px\";\n        s.top = (t + a.t) + \"px\";\n        if (s.width != sws || s.height != shs) {\n            s.width = sws;\n            s.height = shs;\n            if (!Ext.isIE9m) {\n                cn = d.childNodes;\n                sww = Math.max(0, (sw - 12)) + \"px\";\n                cn[0].childNodes[1].style.width = sww;\n                cn[1].childNodes[1].style.width = sww;\n                cn[2].childNodes[1].style.width = sww;\n                cn[1].style.height = Math.max(0, (sh - 12)) + \"px\";\n            }\n        }\n    },\n\n    /**\n     * Hides this shadow\n     */\n    hide: function() {\n        if (this.el) {\n            this.el.dom.style.display = \"none\";\n            Ext.Shadow.Pool.push(this.el);\n            delete this.el;\n        }\n    },\n\n    /**\n     * Adjust the z-index of this shadow\n     * @param {Number} zindex The new z-index\n     */\n    setZIndex: function(z) {\n        this.zIndex = z;\n        if (this.el) {\n            this.el.setStyle(\"z-index\", z);\n        }\n    }\n};\n\n// Private utility class that manages the internal Shadow cache\nExt.Shadow.Pool = function() {\n    var p = [],\n        markup = Ext.isIE9m ?\n            '<div class=\"x-ie-shadow\"></div>':\n            '<div class=\"x-shadow\"><div class=\"xst\"><div class=\"xstl\"></div><div class=\"xstc\"></div><div class=\"xstr\"></div></div><div class=\"xsc\"><div class=\"xsml\"></div><div class=\"xsmc\"></div><div class=\"xsmr\"></div></div><div class=\"xsb\"><div class=\"xsbl\"></div><div class=\"xsbc\"></div><div class=\"xsbr\"></div></div></div>';\n    return {\n        pull: function() {\n            var sh = p.shift();\n            if (!sh) {\n                sh = Ext.get(Ext.DomHelper.insertHtml(\"beforeBegin\", document.body.firstChild, markup));\n                sh.autoBoxAdjust = false;\n            }\n            return sh;\n        },\n\n        push: function(sh) {\n            p.push(sh);\n        }\n    };\n}();/**\n * @class Ext.BoxComponent\n * @extends Ext.Component\n * <p>Base class for any {@link Ext.Component Component} that is to be sized as a box, using width and height.</p>\n * <p>BoxComponent provides automatic box model adjustments for sizing and positioning and will work correctly\n * within the Component rendering model.</p>\n * <p>A BoxComponent may be created as a custom Component which encapsulates any HTML element, either a pre-existing\n * element, or one that is created to your specifications at render time. Usually, to participate in layouts,\n * a Component will need to be a <b>Box</b>Component in order to have its width and height managed.</p>\n * <p>To use a pre-existing element as a BoxComponent, configure it so that you preset the <b>el</b> property to the\n * element to reference:<pre><code>\nvar pageHeader = new Ext.BoxComponent({\n    el: 'my-header-div'\n});</code></pre>\n * This may then be {@link Ext.Container#add added} to a {@link Ext.Container Container} as a child item.</p>\n * <p>To create a BoxComponent based around a HTML element to be created at render time, use the\n * {@link Ext.Component#autoEl autoEl} config option which takes the form of a\n * {@link Ext.DomHelper DomHelper} specification:<pre><code>\nvar myImage = new Ext.BoxComponent({\n    autoEl: {\n        tag: 'img',\n        src: '/images/my-image.jpg'\n    }\n});</code></pre></p>\n * @constructor\n * @param {Ext.Element/String/Object} config The configuration options.\n * @xtype box\n */\nExt.BoxComponent = Ext.extend(Ext.Component, {\n\n    // Configs below are used for all Components when rendered by BoxLayout.\n    /**\n     * @cfg {Number} flex\n     * <p><b>Note</b>: this config is only used when this Component is rendered\n     * by a Container which has been configured to use a <b>{@link Ext.layout.BoxLayout BoxLayout}.</b>\n     * Each child Component with a <code>flex</code> property will be flexed either vertically (by a VBoxLayout)\n     * or horizontally (by an HBoxLayout) according to the item's <b>relative</b> <code>flex</code> value\n     * compared to the sum of all Components with <code>flex</code> value specified. Any child items that have\n     * either a <code>flex = 0</code> or <code>flex = undefined</code> will not be 'flexed' (the initial size will not be changed).\n     */\n    // Configs below are used for all Components when rendered by AnchorLayout.\n    /**\n     * @cfg {String} anchor <p><b>Note</b>: this config is only used when this Component is rendered\n     * by a Container which has been configured to use an <b>{@link Ext.layout.AnchorLayout AnchorLayout} (or subclass thereof).</b>\n     * based layout manager, for example:<div class=\"mdetail-params\"><ul>\n     * <li>{@link Ext.form.FormPanel}</li>\n     * <li>specifying <code>layout: 'anchor' // or 'form', or 'absolute'</code></li>\n     * </ul></div></p>\n     * <p>See {@link Ext.layout.AnchorLayout}.{@link Ext.layout.AnchorLayout#anchor anchor} also.</p>\n     */\n    // tabTip config is used when a BoxComponent is a child of a TabPanel\n    /**\n     * @cfg {String} tabTip\n     * <p><b>Note</b>: this config is only used when this BoxComponent is a child item of a TabPanel.</p>\n     * A string to be used as innerHTML (html tags are accepted) to show in a tooltip when mousing over\n     * the associated tab selector element. {@link Ext.QuickTips}.init()\n     * must be called in order for the tips to render.\n     */\n    // Configs below are used for all Components when rendered by BorderLayout.\n    /**\n     * @cfg {String} region <p><b>Note</b>: this config is only used when this BoxComponent is rendered\n     * by a Container which has been configured to use the <b>{@link Ext.layout.BorderLayout BorderLayout}</b>\n     * layout manager (e.g. specifying <tt>layout:'border'</tt>).</p><br>\n     * <p>See {@link Ext.layout.BorderLayout} also.</p>\n     */\n    // margins config is used when a BoxComponent is rendered by BorderLayout or BoxLayout.\n    /**\n     * @cfg {Object} margins <p><b>Note</b>: this config is only used when this BoxComponent is rendered\n     * by a Container which has been configured to use the <b>{@link Ext.layout.BorderLayout BorderLayout}</b>\n     * or one of the two <b>{@link Ext.layout.BoxLayout BoxLayout} subclasses.</b></p>\n     * <p>An object containing margins to apply to this BoxComponent in the\n     * format:</p><pre><code>\n{\n    top: (top margin),\n    right: (right margin),\n    bottom: (bottom margin),\n    left: (left margin)\n}</code></pre>\n     * <p>May also be a string containing space-separated, numeric margin values. The order of the\n     * sides associated with each value matches the way CSS processes margin values:</p>\n     * <p><div class=\"mdetail-params\"><ul>\n     * <li>If there is only one value, it applies to all sides.</li>\n     * <li>If there are two values, the top and bottom borders are set to the first value and the\n     * right and left are set to the second.</li>\n     * <li>If there are three values, the top is set to the first value, the left and right are set\n     * to the second, and the bottom is set to the third.</li>\n     * <li>If there are four values, they apply to the top, right, bottom, and left, respectively.</li>\n     * </ul></div></p>\n     * <p>Defaults to:</p><pre><code>\n     * {top:0, right:0, bottom:0, left:0}\n     * </code></pre>\n     */\n    /**\n     * @cfg {Number} x\n     * The local x (left) coordinate for this component if contained within a positioning container.\n     */\n    /**\n     * @cfg {Number} y\n     * The local y (top) coordinate for this component if contained within a positioning container.\n     */\n    /**\n     * @cfg {Number} pageX\n     * The page level x coordinate for this component if contained within a positioning container.\n     */\n    /**\n     * @cfg {Number} pageY\n     * The page level y coordinate for this component if contained within a positioning container.\n     */\n    /**\n     * @cfg {Number} height\n     * The height of this component in pixels (defaults to auto).\n     * <b>Note</b> to express this dimension as a percentage or offset see {@link Ext.Component#anchor}.\n     */\n    /**\n     * @cfg {Number} width\n     * The width of this component in pixels (defaults to auto).\n     * <b>Note</b> to express this dimension as a percentage or offset see {@link Ext.Component#anchor}.\n     */\n    /**\n     * @cfg {Number} boxMinHeight\n     * <p>The minimum value in pixels which this BoxComponent will set its height to.</p>\n     * <p><b>Warning:</b> This will override any size management applied by layout managers.</p>\n     */\n    /**\n     * @cfg {Number} boxMinWidth\n     * <p>The minimum value in pixels which this BoxComponent will set its width to.</p>\n     * <p><b>Warning:</b> This will override any size management applied by layout managers.</p>\n     */\n    /**\n     * @cfg {Number} boxMaxHeight\n     * <p>The maximum value in pixels which this BoxComponent will set its height to.</p>\n     * <p><b>Warning:</b> This will override any size management applied by layout managers.</p>\n     */\n    /**\n     * @cfg {Number} boxMaxWidth\n     * <p>The maximum value in pixels which this BoxComponent will set its width to.</p>\n     * <p><b>Warning:</b> This will override any size management applied by layout managers.</p>\n     */\n    /**\n     * @cfg {Boolean} autoHeight\n     * <p>True to use height:'auto', false to use fixed height (or allow it to be managed by its parent\n     * Container's {@link Ext.Container#layout layout manager}. Defaults to false.</p>\n     * <p><b>Note</b>: Although many components inherit this config option, not all will\n     * function as expected with a height of 'auto'. Setting autoHeight:true means that the\n     * browser will manage height based on the element's contents, and that Ext will not manage it at all.</p>\n     * <p>If the <i>browser</i> is managing the height, be aware that resizes performed by the browser in response\n     * to changes within the structure of the Component cannot be detected. Therefore changes to the height might\n     * result in elements needing to be synchronized with the new height. Example:</p><pre><code>\nvar w = new Ext.Window({\n    title: 'Window',\n    width: 600,\n    autoHeight: true,\n    items: {\n        title: 'Collapse Me',\n        height: 400,\n        collapsible: true,\n        border: false,\n        listeners: {\n            beforecollapse: function() {\n                w.el.shadow.hide();\n            },\n            beforeexpand: function() {\n                w.el.shadow.hide();\n            },\n            collapse: function() {\n                w.syncShadow();\n            },\n            expand: function() {\n                w.syncShadow();\n            }\n        }\n    }\n}).show();\n</code></pre>\n     */\n    /**\n     * @cfg {Boolean} autoWidth\n     * <p>True to use width:'auto', false to use fixed width (or allow it to be managed by its parent\n     * Container's {@link Ext.Container#layout layout manager}. Defaults to false.</p>\n     * <p><b>Note</b>: Although many components  inherit this config option, not all will\n     * function as expected with a width of 'auto'. Setting autoWidth:true means that the\n     * browser will manage width based on the element's contents, and that Ext will not manage it at all.</p>\n     * <p>If the <i>browser</i> is managing the width, be aware that resizes performed by the browser in response\n     * to changes within the structure of the Component cannot be detected. Therefore changes to the width might\n     * result in elements needing to be synchronized with the new width. For example, where the target element is:</p><pre><code>\n&lt;div id='grid-container' style='margin-left:25%;width:50%'>&lt;/div>\n</code></pre>\n     * A Panel rendered into that target element must listen for browser window resize in order to relay its\n      * child items when the browser changes its width:<pre><code>\nvar myPanel = new Ext.Panel({\n    renderTo: 'grid-container',\n    monitorResize: true, // relay on browser resize\n    title: 'Panel',\n    height: 400,\n    autoWidth: true,\n    layout: 'hbox',\n    layoutConfig: {\n        align: 'stretch'\n    },\n    defaults: {\n        flex: 1\n    },\n    items: [{\n        title: 'Box 1',\n    }, {\n        title: 'Box 2'\n    }, {\n        title: 'Box 3'\n    }],\n});\n</code></pre>\n     */\n    /**\n     * @cfg {Boolean} autoScroll\n     * <code>true</code> to use overflow:'auto' on the components layout element and show scroll bars automatically when\n     * necessary, <code>false</code> to clip any overflowing content (defaults to <code>false</code>).\n     */\n\n    /* // private internal config\n     * {Boolean} deferHeight\n     * True to defer height calculations to an external component, false to allow this component to set its own\n     * height (defaults to false).\n     */\n\n    // private\n    initComponent : function(){\n        Ext.BoxComponent.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event resize\n             * Fires after the component is resized.\n             * @param {Ext.Component} this\n             * @param {Number} adjWidth The box-adjusted width that was set\n             * @param {Number} adjHeight The box-adjusted height that was set\n             * @param {Number} rawWidth The width that was originally specified\n             * @param {Number} rawHeight The height that was originally specified\n             */\n            'resize',\n            /**\n             * @event move\n             * Fires after the component is moved.\n             * @param {Ext.Component} this\n             * @param {Number} x The new x position\n             * @param {Number} y The new y position\n             */\n            'move'\n        );\n    },\n\n    // private, set in afterRender to signify that the component has been rendered\n    boxReady : false,\n    // private, used to defer height settings to subclasses\n    deferHeight: false,\n\n    /**\n     * Sets the width and height of this BoxComponent. This method fires the {@link #resize} event. This method can accept\n     * either width and height as separate arguments, or you can pass a size object like <code>{width:10, height:20}</code>.\n     * @param {Mixed} width The new width to set. This may be one of:<div class=\"mdetail-params\"><ul>\n     * <li>A Number specifying the new width in the {@link #getEl Element}'s {@link Ext.Element#defaultUnit}s (by default, pixels).</li>\n     * <li>A String used to set the CSS width style.</li>\n     * <li>A size object in the format <code>{width: widthValue, height: heightValue}</code>.</li>\n     * <li><code>undefined</code> to leave the width unchanged.</li>\n     * </ul></div>\n     * @param {Mixed} height The new height to set (not required if a size object is passed as the first arg).\n     * This may be one of:<div class=\"mdetail-params\"><ul>\n     * <li>A Number specifying the new height in the {@link #getEl Element}'s {@link Ext.Element#defaultUnit}s (by default, pixels).</li>\n     * <li>A String used to set the CSS height style. Animation may <b>not</b> be used.</li>\n     * <li><code>undefined</code> to leave the height unchanged.</li>\n     * </ul></div>\n     * @return {Ext.BoxComponent} this\n     */\n    setSize : function(w, h){\n\n        // support for standard size objects\n        if(typeof w == 'object'){\n            h = w.height;\n            w = w.width;\n        }\n        if (Ext.isDefined(w) && Ext.isDefined(this.boxMinWidth) && (w < this.boxMinWidth)) {\n            w = this.boxMinWidth;\n        }\n        if (Ext.isDefined(h) && Ext.isDefined(this.boxMinHeight) && (h < this.boxMinHeight)) {\n            h = this.boxMinHeight;\n        }\n        if (Ext.isDefined(w) && Ext.isDefined(this.boxMaxWidth) && (w > this.boxMaxWidth)) {\n            w = this.boxMaxWidth;\n        }\n        if (Ext.isDefined(h) && Ext.isDefined(this.boxMaxHeight) && (h > this.boxMaxHeight)) {\n            h = this.boxMaxHeight;\n        }\n        // not rendered\n        if(!this.boxReady){\n            this.width  = w;\n            this.height = h;\n            return this;\n        }\n\n        // prevent recalcs when not needed\n        if(this.cacheSizes !== false && this.lastSize && this.lastSize.width == w && this.lastSize.height == h){\n            return this;\n        }\n        this.lastSize = {width: w, height: h};\n        var adj = this.adjustSize(w, h),\n            aw = adj.width,\n            ah = adj.height,\n            rz;\n        if(aw !== undefined || ah !== undefined){ // this code is nasty but performs better with floaters\n            rz = this.getResizeEl();\n            if(!this.deferHeight && aw !== undefined && ah !== undefined){\n                rz.setSize(aw, ah);\n            }else if(!this.deferHeight && ah !== undefined){\n                rz.setHeight(ah);\n            }else if(aw !== undefined){\n                rz.setWidth(aw);\n            }\n            this.onResize(aw, ah, w, h);\n            this.fireEvent('resize', this, aw, ah, w, h);\n        }\n        return this;\n    },\n\n    /**\n     * Sets the width of the component.  This method fires the {@link #resize} event.\n     * @param {Mixed} width The new width to set. This may be one of:<div class=\"mdetail-params\"><ul>\n     * <li>A Number specifying the new width in the {@link #getEl Element}'s {@link Ext.Element#defaultUnit defaultUnit}s (by default, pixels).</li>\n     * <li>A String used to set the CSS width style.</li>\n     * </ul></div>\n     * @return {Ext.BoxComponent} this\n     */\n    setWidth : function(width){\n        return this.setSize(width);\n    },\n\n    /**\n     * Sets the height of the component.  This method fires the {@link #resize} event.\n     * @param {Mixed} height The new height to set. This may be one of:<div class=\"mdetail-params\"><ul>\n     * <li>A Number specifying the new height in the {@link #getEl Element}'s {@link Ext.Element#defaultUnit defaultUnit}s (by default, pixels).</li>\n     * <li>A String used to set the CSS height style.</li>\n     * <li><i>undefined</i> to leave the height unchanged.</li>\n     * </ul></div>\n     * @return {Ext.BoxComponent} this\n     */\n    setHeight : function(height){\n        return this.setSize(undefined, height);\n    },\n\n    /**\n     * Gets the current size of the component's underlying element.\n     * @return {Object} An object containing the element's size {width: (element width), height: (element height)}\n     */\n    getSize : function(){\n        return this.getResizeEl().getSize();\n    },\n\n    /**\n     * Gets the current width of the component's underlying element.\n     * @return {Number}\n     */\n    getWidth : function(){\n        return this.getResizeEl().getWidth();\n    },\n\n    /**\n     * Gets the current height of the component's underlying element.\n     * @return {Number}\n     */\n    getHeight : function(){\n        return this.getResizeEl().getHeight();\n    },\n\n    /**\n     * Gets the current size of the component's underlying element, including space taken by its margins.\n     * @return {Object} An object containing the element's size {width: (element width + left/right margins), height: (element height + top/bottom margins)}\n     */\n    getOuterSize : function(){\n        var el = this.getResizeEl();\n        return {width: el.getWidth() + el.getMargins('lr'),\n                height: el.getHeight() + el.getMargins('tb')};\n    },\n\n    /**\n     * Gets the current XY position of the component's underlying element.\n     * @param {Boolean} local (optional) If true the element's left and top are returned instead of page XY (defaults to false)\n     * @return {Array} The XY position of the element (e.g., [100, 200])\n     */\n    getPosition : function(local){\n        var el = this.getPositionEl();\n        if(local === true){\n            return [el.getLeft(true), el.getTop(true)];\n        }\n        return this.xy || el.getXY();\n    },\n\n    /**\n     * Gets the current box measurements of the component's underlying element.\n     * @param {Boolean} local (optional) If true the element's left and top are returned instead of page XY (defaults to false)\n     * @return {Object} box An object in the format {x, y, width, height}\n     */\n    getBox : function(local){\n        var pos = this.getPosition(local);\n        var s = this.getSize();\n        s.x = pos[0];\n        s.y = pos[1];\n        return s;\n    },\n\n    /**\n     * Sets the current box measurements of the component's underlying element.\n     * @param {Object} box An object in the format {x, y, width, height}\n     * @return {Ext.BoxComponent} this\n     */\n    updateBox : function(box){\n        this.setSize(box.width, box.height);\n        this.setPagePosition(box.x, box.y);\n        return this;\n    },\n\n    /**\n     * <p>Returns the outermost Element of this Component which defines the Components overall size.</p>\n     * <p><i>Usually</i> this will return the same Element as <code>{@link #getEl}</code>,\n     * but in some cases, a Component may have some more wrapping Elements around its main\n     * active Element.</p>\n     * <p>An example is a ComboBox. It is encased in a <i>wrapping</i> Element which\n     * contains both the <code>&lt;input></code> Element (which is what would be returned\n     * by its <code>{@link #getEl}</code> method, <i>and</i> the trigger button Element.\n     * This Element is returned as the <code>resizeEl</code>.\n     * @return {Ext.Element} The Element which is to be resized by size managing layouts.\n     */\n    getResizeEl : function(){\n        return this.resizeEl || this.el;\n    },\n\n    /**\n     * Sets the overflow on the content element of the component.\n     * @param {Boolean} scroll True to allow the Component to auto scroll.\n     * @return {Ext.BoxComponent} this\n     */\n    setAutoScroll : function(scroll){\n        if(this.rendered){\n            this.getContentTarget().setOverflow(scroll ? 'auto' : '');\n        }\n        this.autoScroll = scroll;\n        return this;\n    },\n\n    /**\n     * Sets the left and top of the component.  To set the page XY position instead, use {@link #setPagePosition}.\n     * This method fires the {@link #move} event.\n     * @param {Number} left The new left\n     * @param {Number} top The new top\n     * @return {Ext.BoxComponent} this\n     */\n    setPosition : function(x, y){\n        if(x && typeof x[1] == 'number'){\n            y = x[1];\n            x = x[0];\n        }\n        this.x = x;\n        this.y = y;\n        if(!this.boxReady){\n            return this;\n        }\n        var adj = this.adjustPosition(x, y);\n        var ax = adj.x, ay = adj.y;\n\n        var el = this.getPositionEl();\n        if(ax !== undefined || ay !== undefined){\n            if(ax !== undefined && ay !== undefined){\n                el.setLeftTop(ax, ay);\n            }else if(ax !== undefined){\n                el.setLeft(ax);\n            }else if(ay !== undefined){\n                el.setTop(ay);\n            }\n            this.onPosition(ax, ay);\n            this.fireEvent('move', this, ax, ay);\n        }\n        return this;\n    },\n\n    /**\n     * Sets the page XY position of the component.  To set the left and top instead, use {@link #setPosition}.\n     * This method fires the {@link #move} event.\n     * @param {Number} x The new x position\n     * @param {Number} y The new y position\n     * @return {Ext.BoxComponent} this\n     */\n    setPagePosition : function(x, y){\n        if(x && typeof x[1] == 'number'){\n            y = x[1];\n            x = x[0];\n        }\n        this.pageX = x;\n        this.pageY = y;\n        if(!this.boxReady){\n            return;\n        }\n        if(x === undefined || y === undefined){ // cannot translate undefined points\n            return;\n        }\n        var p = this.getPositionEl().translatePoints(x, y);\n        this.setPosition(p.left, p.top);\n        return this;\n    },\n\n    // private\n    afterRender : function(){\n        Ext.BoxComponent.superclass.afterRender.call(this);\n        if(this.resizeEl){\n            this.resizeEl = Ext.get(this.resizeEl);\n        }\n        if(this.positionEl){\n            this.positionEl = Ext.get(this.positionEl);\n        }\n        this.boxReady = true;\n        Ext.isDefined(this.autoScroll) && this.setAutoScroll(this.autoScroll);\n        this.setSize(this.width, this.height);\n        if(this.x || this.y){\n            this.setPosition(this.x, this.y);\n        }else if(this.pageX || this.pageY){\n            this.setPagePosition(this.pageX, this.pageY);\n        }\n    },\n\n    /**\n     * Force the component's size to recalculate based on the underlying element's current height and width.\n     * @return {Ext.BoxComponent} this\n     */\n    syncSize : function(){\n        delete this.lastSize;\n        this.setSize(this.autoWidth ? undefined : this.getResizeEl().getWidth(), this.autoHeight ? undefined : this.getResizeEl().getHeight());\n        return this;\n    },\n\n    /* // protected\n     * Called after the component is resized, this method is empty by default but can be implemented by any\n     * subclass that needs to perform custom logic after a resize occurs.\n     * @param {Number} adjWidth The box-adjusted width that was set\n     * @param {Number} adjHeight The box-adjusted height that was set\n     * @param {Number} rawWidth The width that was originally specified\n     * @param {Number} rawHeight The height that was originally specified\n     */\n    onResize : function(adjWidth, adjHeight, rawWidth, rawHeight){\n    },\n\n    /* // protected\n     * Called after the component is moved, this method is empty by default but can be implemented by any\n     * subclass that needs to perform custom logic after a move occurs.\n     * @param {Number} x The new x position\n     * @param {Number} y The new y position\n     */\n    onPosition : function(x, y){\n\n    },\n\n    // private\n    adjustSize : function(w, h){\n        if(this.autoWidth){\n            w = 'auto';\n        }\n        if(this.autoHeight){\n            h = 'auto';\n        }\n        return {width : w, height: h};\n    },\n\n    // private\n    adjustPosition : function(x, y){\n        return {x : x, y: y};\n    }\n});\nExt.reg('box', Ext.BoxComponent);\n\n\n/**\n * @class Ext.Spacer\n * @extends Ext.BoxComponent\n * <p>Used to provide a sizable space in a layout.</p>\n * @constructor\n * @param {Object} config\n */\nExt.Spacer = Ext.extend(Ext.BoxComponent, {\n    autoEl:'div'\n});\nExt.reg('spacer', Ext.Spacer);/**\n * @class Ext.SplitBar\n * @extends Ext.util.Observable\n * Creates draggable splitter bar functionality from two elements (element to be dragged and element to be resized).\n * <br><br>\n * Usage:\n * <pre><code>\nvar split = new Ext.SplitBar(\"elementToDrag\", \"elementToSize\",\n                   Ext.SplitBar.HORIZONTAL, Ext.SplitBar.LEFT);\nsplit.setAdapter(new Ext.SplitBar.AbsoluteLayoutAdapter(\"container\"));\nsplit.minSize = 100;\nsplit.maxSize = 600;\nsplit.animate = true;\nsplit.on('moved', splitterMoved);\n</code></pre>\n * @constructor\n * Create a new SplitBar\n * @param {Mixed} dragElement The element to be dragged and act as the SplitBar.\n * @param {Mixed} resizingElement The element to be resized based on where the SplitBar element is dragged\n * @param {Number} orientation (optional) Either Ext.SplitBar.HORIZONTAL or Ext.SplitBar.VERTICAL. (Defaults to HORIZONTAL)\n * @param {Number} placement (optional) Either Ext.SplitBar.LEFT or Ext.SplitBar.RIGHT for horizontal or\n                        Ext.SplitBar.TOP or Ext.SplitBar.BOTTOM for vertical. (By default, this is determined automatically by the initial\n                        position of the SplitBar).\n */\nExt.SplitBar = function(dragElement, resizingElement, orientation, placement, existingProxy){\n\n    /** @private */\n    this.el = Ext.get(dragElement, true);\n    this.el.unselectable();\n    /** @private */\n    this.resizingEl = Ext.get(resizingElement, true);\n\n    /**\n     * @private\n     * The orientation of the split. Either Ext.SplitBar.HORIZONTAL or Ext.SplitBar.VERTICAL. (Defaults to HORIZONTAL)\n     * Note: If this is changed after creating the SplitBar, the placement property must be manually updated\n     * @type Number\n     */\n    this.orientation = orientation || Ext.SplitBar.HORIZONTAL;\n\n    /**\n     * The increment, in pixels by which to move this SplitBar. When <i>undefined</i>, the SplitBar moves smoothly.\n     * @type Number\n     * @property tickSize\n     */\n    /**\n     * The minimum size of the resizing element. (Defaults to 0)\n     * @type Number\n     */\n    this.minSize = 0;\n\n    /**\n     * The maximum size of the resizing element. (Defaults to 2000)\n     * @type Number\n     */\n    this.maxSize = 2000;\n\n    /**\n     * Whether to animate the transition to the new size\n     * @type Boolean\n     */\n    this.animate = false;\n\n    /**\n     * Whether to create a transparent shim that overlays the page when dragging, enables dragging across iframes.\n     * @type Boolean\n     */\n    this.useShim = false;\n\n    /** @private */\n    this.shim = null;\n\n    if(!existingProxy){\n        /** @private */\n        this.proxy = Ext.SplitBar.createProxy(this.orientation);\n    }else{\n        this.proxy = Ext.get(existingProxy).dom;\n    }\n    /** @private */\n    this.dd = new Ext.dd.DDProxy(this.el.dom.id, \"XSplitBars\", {dragElId : this.proxy.id});\n\n    /** @private */\n    this.dd.b4StartDrag = this.onStartProxyDrag.createDelegate(this);\n\n    /** @private */\n    this.dd.endDrag = this.onEndProxyDrag.createDelegate(this);\n\n    /** @private */\n    this.dragSpecs = {};\n\n    /**\n     * @private The adapter to use to positon and resize elements\n     */\n    this.adapter = new Ext.SplitBar.BasicLayoutAdapter();\n    this.adapter.init(this);\n\n    if(this.orientation == Ext.SplitBar.HORIZONTAL){\n        /** @ignore */\n        this.placement = placement || (this.el.getX() > this.resizingEl.getX() ? Ext.SplitBar.LEFT : Ext.SplitBar.RIGHT);\n        this.el.addClass(\"x-splitbar-h\");\n    }else{\n        /** @ignore */\n        this.placement = placement || (this.el.getY() > this.resizingEl.getY() ? Ext.SplitBar.TOP : Ext.SplitBar.BOTTOM);\n        this.el.addClass(\"x-splitbar-v\");\n    }\n\n    this.addEvents(\n        /**\n         * @event resize\n         * Fires when the splitter is moved (alias for {@link #moved})\n         * @param {Ext.SplitBar} this\n         * @param {Number} newSize the new width or height\n         */\n        \"resize\",\n        /**\n         * @event moved\n         * Fires when the splitter is moved\n         * @param {Ext.SplitBar} this\n         * @param {Number} newSize the new width or height\n         */\n        \"moved\",\n        /**\n         * @event beforeresize\n         * Fires before the splitter is dragged\n         * @param {Ext.SplitBar} this\n         */\n        \"beforeresize\",\n\n        \"beforeapply\"\n    );\n\n    Ext.SplitBar.superclass.constructor.call(this);\n};\n\nExt.extend(Ext.SplitBar, Ext.util.Observable, {\n    onStartProxyDrag : function(x, y){\n        this.fireEvent(\"beforeresize\", this);\n        this.overlay =  Ext.DomHelper.append(document.body,  {cls: \"x-drag-overlay\", html: \"&#160;\"}, true);\n        this.overlay.unselectable();\n        this.overlay.setSize(Ext.lib.Dom.getViewWidth(true), Ext.lib.Dom.getViewHeight(true));\n        this.overlay.show();\n        Ext.get(this.proxy).setDisplayed(\"block\");\n        var size = this.adapter.getElementSize(this);\n        this.activeMinSize = this.getMinimumSize();\n        this.activeMaxSize = this.getMaximumSize();\n        var c1 = size - this.activeMinSize;\n        var c2 = Math.max(this.activeMaxSize - size, 0);\n        if(this.orientation == Ext.SplitBar.HORIZONTAL){\n            this.dd.resetConstraints();\n            this.dd.setXConstraint(\n                this.placement == Ext.SplitBar.LEFT ? c1 : c2,\n                this.placement == Ext.SplitBar.LEFT ? c2 : c1,\n                this.tickSize\n            );\n            this.dd.setYConstraint(0, 0);\n        }else{\n            this.dd.resetConstraints();\n            this.dd.setXConstraint(0, 0);\n            this.dd.setYConstraint(\n                this.placement == Ext.SplitBar.TOP ? c1 : c2,\n                this.placement == Ext.SplitBar.TOP ? c2 : c1,\n                this.tickSize\n            );\n         }\n        this.dragSpecs.startSize = size;\n        this.dragSpecs.startPoint = [x, y];\n        Ext.dd.DDProxy.prototype.b4StartDrag.call(this.dd, x, y);\n    },\n\n    /**\n     * @private Called after the drag operation by the DDProxy\n     */\n    onEndProxyDrag : function(e){\n        Ext.get(this.proxy).setDisplayed(false);\n        var endPoint = Ext.lib.Event.getXY(e);\n        if(this.overlay){\n            Ext.destroy(this.overlay);\n            delete this.overlay;\n        }\n        var newSize;\n        if(this.orientation == Ext.SplitBar.HORIZONTAL){\n            newSize = this.dragSpecs.startSize +\n                (this.placement == Ext.SplitBar.LEFT ?\n                    endPoint[0] - this.dragSpecs.startPoint[0] :\n                    this.dragSpecs.startPoint[0] - endPoint[0]\n                );\n        }else{\n            newSize = this.dragSpecs.startSize +\n                (this.placement == Ext.SplitBar.TOP ?\n                    endPoint[1] - this.dragSpecs.startPoint[1] :\n                    this.dragSpecs.startPoint[1] - endPoint[1]\n                );\n        }\n        newSize = Math.min(Math.max(newSize, this.activeMinSize), this.activeMaxSize);\n        if(newSize != this.dragSpecs.startSize){\n            if(this.fireEvent('beforeapply', this, newSize) !== false){\n                this.adapter.setElementSize(this, newSize);\n                this.fireEvent(\"moved\", this, newSize);\n                this.fireEvent(\"resize\", this, newSize);\n            }\n        }\n    },\n\n    /**\n     * Get the adapter this SplitBar uses\n     * @return The adapter object\n     */\n    getAdapter : function(){\n        return this.adapter;\n    },\n\n    /**\n     * Set the adapter this SplitBar uses\n     * @param {Object} adapter A SplitBar adapter object\n     */\n    setAdapter : function(adapter){\n        this.adapter = adapter;\n        this.adapter.init(this);\n    },\n\n    /**\n     * Gets the minimum size for the resizing element\n     * @return {Number} The minimum size\n     */\n    getMinimumSize : function(){\n        return this.minSize;\n    },\n\n    /**\n     * Sets the minimum size for the resizing element\n     * @param {Number} minSize The minimum size\n     */\n    setMinimumSize : function(minSize){\n        this.minSize = minSize;\n    },\n\n    /**\n     * Gets the maximum size for the resizing element\n     * @return {Number} The maximum size\n     */\n    getMaximumSize : function(){\n        return this.maxSize;\n    },\n\n    /**\n     * Sets the maximum size for the resizing element\n     * @param {Number} maxSize The maximum size\n     */\n    setMaximumSize : function(maxSize){\n        this.maxSize = maxSize;\n    },\n\n    /**\n     * Sets the initialize size for the resizing element\n     * @param {Number} size The initial size\n     */\n    setCurrentSize : function(size){\n        var oldAnimate = this.animate;\n        this.animate = false;\n        this.adapter.setElementSize(this, size);\n        this.animate = oldAnimate;\n    },\n\n    /**\n     * Destroy this splitbar.\n     * @param {Boolean} removeEl True to remove the element\n     */\n    destroy : function(removeEl){\n        Ext.destroy(this.shim, Ext.get(this.proxy));\n        this.dd.unreg();\n        if(removeEl){\n            this.el.remove();\n        }\n        this.purgeListeners();\n    }\n});\n\n/**\n * @private static Create our own proxy element element. So it will be the same same size on all browsers, we won't use borders. Instead we use a background color.\n */\nExt.SplitBar.createProxy = function(dir){\n    var proxy = new Ext.Element(document.createElement(\"div\"));\n    document.body.appendChild(proxy.dom);\n    proxy.unselectable();\n    var cls = 'x-splitbar-proxy';\n    proxy.addClass(cls + ' ' + (dir == Ext.SplitBar.HORIZONTAL ? cls +'-h' : cls + '-v'));\n    return proxy.dom;\n};\n\n/**\n * @class Ext.SplitBar.BasicLayoutAdapter\n * Default Adapter. It assumes the splitter and resizing element are not positioned\n * elements and only gets/sets the width of the element. Generally used for table based layouts.\n */\nExt.SplitBar.BasicLayoutAdapter = function(){\n};\n\nExt.SplitBar.BasicLayoutAdapter.prototype = {\n    // do nothing for now\n    init : function(s){\n\n    },\n    /**\n     * Called before drag operations to get the current size of the resizing element.\n     * @param {Ext.SplitBar} s The SplitBar using this adapter\n     */\n     getElementSize : function(s){\n        if(s.orientation == Ext.SplitBar.HORIZONTAL){\n            return s.resizingEl.getWidth();\n        }else{\n            return s.resizingEl.getHeight();\n        }\n    },\n\n    /**\n     * Called after drag operations to set the size of the resizing element.\n     * @param {Ext.SplitBar} s The SplitBar using this adapter\n     * @param {Number} newSize The new size to set\n     * @param {Function} onComplete A function to be invoked when resizing is complete\n     */\n    setElementSize : function(s, newSize, onComplete){\n        if(s.orientation == Ext.SplitBar.HORIZONTAL){\n            if(!s.animate){\n                s.resizingEl.setWidth(newSize);\n                if(onComplete){\n                    onComplete(s, newSize);\n                }\n            }else{\n                s.resizingEl.setWidth(newSize, true, .1, onComplete, 'easeOut');\n            }\n        }else{\n\n            if(!s.animate){\n                s.resizingEl.setHeight(newSize);\n                if(onComplete){\n                    onComplete(s, newSize);\n                }\n            }else{\n                s.resizingEl.setHeight(newSize, true, .1, onComplete, 'easeOut');\n            }\n        }\n    }\n};\n\n/**\n *@class Ext.SplitBar.AbsoluteLayoutAdapter\n * @extends Ext.SplitBar.BasicLayoutAdapter\n * Adapter that  moves the splitter element to align with the resized sizing element.\n * Used with an absolute positioned SplitBar.\n * @param {Mixed} container The container that wraps around the absolute positioned content. If it's\n * document.body, make sure you assign an id to the body element.\n */\nExt.SplitBar.AbsoluteLayoutAdapter = function(container){\n    this.basic = new Ext.SplitBar.BasicLayoutAdapter();\n    this.container = Ext.get(container);\n};\n\nExt.SplitBar.AbsoluteLayoutAdapter.prototype = {\n    init : function(s){\n        this.basic.init(s);\n    },\n\n    getElementSize : function(s){\n        return this.basic.getElementSize(s);\n    },\n\n    setElementSize : function(s, newSize, onComplete){\n        this.basic.setElementSize(s, newSize, this.moveSplitter.createDelegate(this, [s]));\n    },\n\n    moveSplitter : function(s){\n        var yes = Ext.SplitBar;\n        switch(s.placement){\n            case yes.LEFT:\n                s.el.setX(s.resizingEl.getRight());\n                break;\n            case yes.RIGHT:\n                s.el.setStyle(\"right\", (this.container.getWidth() - s.resizingEl.getLeft()) + \"px\");\n                break;\n            case yes.TOP:\n                s.el.setY(s.resizingEl.getBottom());\n                break;\n            case yes.BOTTOM:\n                s.el.setY(s.resizingEl.getTop() - s.el.getHeight());\n                break;\n        }\n    }\n};\n\n/**\n * Orientation constant - Create a vertical SplitBar\n * @static\n * @type Number\n */\nExt.SplitBar.VERTICAL = 1;\n\n/**\n * Orientation constant - Create a horizontal SplitBar\n * @static\n * @type Number\n */\nExt.SplitBar.HORIZONTAL = 2;\n\n/**\n * Placement constant - The resizing element is to the left of the splitter element\n * @static\n * @type Number\n */\nExt.SplitBar.LEFT = 1;\n\n/**\n * Placement constant - The resizing element is to the right of the splitter element\n * @static\n * @type Number\n */\nExt.SplitBar.RIGHT = 2;\n\n/**\n * Placement constant - The resizing element is positioned above the splitter element\n * @static\n * @type Number\n */\nExt.SplitBar.TOP = 3;\n\n/**\n * Placement constant - The resizing element is positioned under splitter element\n * @static\n * @type Number\n */\nExt.SplitBar.BOTTOM = 4;\n/**\n * @class Ext.Container\n * @extends Ext.BoxComponent\n * <p>Base class for any {@link Ext.BoxComponent} that may contain other Components. Containers handle the\n * basic behavior of containing items, namely adding, inserting and removing items.</p>\n *\n * <p>The most commonly used Container classes are {@link Ext.Panel}, {@link Ext.Window} and {@link Ext.TabPanel}.\n * If you do not need the capabilities offered by the aforementioned classes you can create a lightweight\n * Container to be encapsulated by an HTML element to your specifications by using the\n * <code><b>{@link Ext.Component#autoEl autoEl}</b></code> config option. This is a useful technique when creating\n * embedded {@link Ext.layout.ColumnLayout column} layouts inside {@link Ext.form.FormPanel FormPanels}\n * for example.</p>\n *\n * <p>The code below illustrates both how to explicitly create a Container, and how to implicitly\n * create one using the <b><code>'container'</code></b> xtype:<pre><code>\n// explicitly create a Container\nvar embeddedColumns = new Ext.Container({\n    autoEl: 'div',  // This is the default\n    layout: 'column',\n    defaults: {\n        // implicitly create Container by specifying xtype\n        xtype: 'container',\n        autoEl: 'div', // This is the default.\n        layout: 'form',\n        columnWidth: 0.5,\n        style: {\n            padding: '10px'\n        }\n    },\n//  The two items below will be Ext.Containers, each encapsulated by a &lt;DIV> element.\n    items: [{\n        items: {\n            xtype: 'datefield',\n            name: 'startDate',\n            fieldLabel: 'Start date'\n        }\n    }, {\n        items: {\n            xtype: 'datefield',\n            name: 'endDate',\n            fieldLabel: 'End date'\n        }\n    }]\n});</code></pre></p>\n *\n * <p><u><b>Layout</b></u></p>\n * <p>Container classes delegate the rendering of child Components to a layout\n * manager class which must be configured into the Container using the\n * <code><b>{@link #layout}</b></code> configuration property.</p>\n * <p>When either specifying child <code>{@link #items}</code> of a Container,\n * or dynamically {@link #add adding} Components to a Container, remember to\n * consider how you wish the Container to arrange those child elements, and\n * whether those child elements need to be sized using one of Ext's built-in\n * <b><code>{@link #layout}</code></b> schemes. By default, Containers use the\n * {@link Ext.layout.ContainerLayout ContainerLayout} scheme which only\n * renders child components, appending them one after the other inside the\n * Container, and <b>does not apply any sizing</b> at all.</p>\n * <p>A common mistake is when a developer neglects to specify a\n * <b><code>{@link #layout}</code></b> (e.g. widgets like GridPanels or\n * TreePanels are added to Containers for which no <code><b>{@link #layout}</b></code>\n * has been specified). If a Container is left to use the default\n * {@link Ext.layout.ContainerLayout ContainerLayout} scheme, none of its\n * child components will be resized, or changed in any way when the Container\n * is resized.</p>\n * <p>Certain layout managers allow dynamic addition of child components.\n * Those that do include {@link Ext.layout.CardLayout},\n * {@link Ext.layout.AnchorLayout}, {@link Ext.layout.FormLayout}, and\n * {@link Ext.layout.TableLayout}. For example:<pre><code>\n//  Create the GridPanel.\nvar myNewGrid = new Ext.grid.GridPanel({\n    store: myStore,\n    columns: myColumnModel,\n    title: 'Results', // the title becomes the title of the tab\n});\n\nmyTabPanel.add(myNewGrid); // {@link Ext.TabPanel} implicitly uses {@link Ext.layout.CardLayout CardLayout}\nmyTabPanel.{@link Ext.TabPanel#setActiveTab setActiveTab}(myNewGrid);\n * </code></pre></p>\n * <p>The example above adds a newly created GridPanel to a TabPanel. Note that\n * a TabPanel uses {@link Ext.layout.CardLayout} as its layout manager which\n * means all its child items are sized to {@link Ext.layout.FitLayout fit}\n * exactly into its client area.\n * <p><b><u>Overnesting is a common problem</u></b>.\n * An example of overnesting occurs when a GridPanel is added to a TabPanel\n * by wrapping the GridPanel <i>inside</i> a wrapping Panel (that has no\n * <code><b>{@link #layout}</b></code> specified) and then add that wrapping Panel\n * to the TabPanel. The point to realize is that a GridPanel <b>is</b> a\n * Component which can be added directly to a Container. If the wrapping Panel\n * has no <code><b>{@link #layout}</b></code> configuration, then the overnested\n * GridPanel will not be sized as expected.<p>\n *\n * <p><u><b>Adding via remote configuration</b></u></p>\n *\n * <p>A server side script can be used to add Components which are generated dynamically on the server.\n * An example of adding a GridPanel to a TabPanel where the GridPanel is generated by the server\n * based on certain parameters:\n * </p><pre><code>\n// execute an Ajax request to invoke server side script:\nExt.Ajax.request({\n    url: 'gen-invoice-grid.php',\n    // send additional parameters to instruct server script\n    params: {\n        startDate: Ext.getCmp('start-date').getValue(),\n        endDate: Ext.getCmp('end-date').getValue()\n    },\n    // process the response object to add it to the TabPanel:\n    success: function(xhr) {\n        var newComponent = eval(xhr.responseText); // see discussion below\n        myTabPanel.add(newComponent); // add the component to the TabPanel\n        myTabPanel.setActiveTab(newComponent);\n    },\n    failure: function() {\n        Ext.Msg.alert(\"Grid create failed\", \"Server communication failure\");\n    }\n});\n</code></pre>\n * <p>The server script needs to return an executable Javascript statement which, when processed\n * using <code>eval()</code>, will return either a config object with an {@link Ext.Component#xtype xtype},\n * or an instantiated Component. The server might return this for example:</p><pre><code>\n(function() {\n    function formatDate(value){\n        return value ? value.dateFormat('M d, Y') : '';\n    };\n\n    var store = new Ext.data.Store({\n        url: 'get-invoice-data.php',\n        baseParams: {\n            startDate: '01/01/2008',\n            endDate: '01/31/2008'\n        },\n        reader: new Ext.data.JsonReader({\n            record: 'transaction',\n            idProperty: 'id',\n            totalRecords: 'total'\n        }, [\n           'customer',\n           'invNo',\n           {name: 'date', type: 'date', dateFormat: 'm/d/Y'},\n           {name: 'value', type: 'float'}\n        ])\n    });\n\n    var grid = new Ext.grid.GridPanel({\n        title: 'Invoice Report',\n        bbar: new Ext.PagingToolbar(store),\n        store: store,\n        columns: [\n            {header: \"Customer\", width: 250, dataIndex: 'customer', sortable: true},\n            {header: \"Invoice Number\", width: 120, dataIndex: 'invNo', sortable: true},\n            {header: \"Invoice Date\", width: 100, dataIndex: 'date', renderer: formatDate, sortable: true},\n            {header: \"Value\", width: 120, dataIndex: 'value', renderer: 'usMoney', sortable: true}\n        ],\n    });\n    store.load();\n    return grid;  // return instantiated component\n})();\n</code></pre>\n * <p>When the above code fragment is passed through the <code>eval</code> function in the success handler\n * of the Ajax request, the code is executed by the Javascript processor, and the anonymous function\n * runs, and returns the instantiated grid component.</p>\n * <p>Note: since the code above is <i>generated</i> by a server script, the <code>baseParams</code> for\n * the Store, the metadata to allow generation of the Record layout, and the ColumnModel\n * can all be generated into the code since these are all known on the server.</p>\n *\n * @xtype container\n */\nExt.Container = Ext.extend(Ext.BoxComponent, {\n    /**\n     * @cfg {Boolean} monitorResize\n     * True to automatically monitor window resize events to handle anything that is sensitive to the current size\n     * of the viewport.  This value is typically managed by the chosen <code>{@link #layout}</code> and should not need\n     * to be set manually.\n     */\n    /**\n     * @cfg {String/Object} layout\n     * <p><b>*Important</b>: In order for child items to be correctly sized and\n     * positioned, typically a layout manager <b>must</b> be specified through\n     * the <code>layout</code> configuration option.</p>\n     * <br><p>The sizing and positioning of child {@link items} is the responsibility of\n     * the Container's layout manager which creates and manages the type of layout\n     * you have in mind.  For example:</p><pre><code>\nnew Ext.Window({\n    width:300, height: 300,\n    layout: 'fit', // explicitly set layout manager: override the default (layout:'auto')\n    items: [{\n        title: 'Panel inside a Window'\n    }]\n}).show();\n     * </code></pre>\n     * <p>If the {@link #layout} configuration is not explicitly specified for\n     * a general purpose container (e.g. Container or Panel) the\n     * {@link Ext.layout.ContainerLayout default layout manager} will be used\n     * which does nothing but render child components sequentially into the\n     * Container (no sizing or positioning will be performed in this situation).\n     * Some container classes implicitly specify a default layout\n     * (e.g. FormPanel specifies <code>layout:'form'</code>). Other specific\n     * purpose classes internally specify/manage their internal layout (e.g.\n     * GridPanel, TabPanel, TreePanel, Toolbar, Menu, etc.).</p>\n     * <br><p><b><code>layout</code></b> may be specified as either as an Object or\n     * as a String:</p><div><ul class=\"mdetail-params\">\n     *\n     * <li><u>Specify as an Object</u></li>\n     * <div><ul class=\"mdetail-params\">\n     * <li>Example usage:</li>\n<pre><code>\nlayout: {\n    type: 'vbox',\n    padding: '5',\n    align: 'left'\n}\n</code></pre>\n     *\n     * <li><code><b>type</b></code></li>\n     * <br/><p>The layout type to be used for this container.  If not specified,\n     * a default {@link Ext.layout.ContainerLayout} will be created and used.</p>\n     * <br/><p>Valid layout <code>type</code> values are:</p>\n     * <div class=\"sub-desc\"><ul class=\"mdetail-params\">\n     * <li><code><b>{@link Ext.layout.AbsoluteLayout absolute}</b></code></li>\n     * <li><code><b>{@link Ext.layout.AccordionLayout accordion}</b></code></li>\n     * <li><code><b>{@link Ext.layout.AnchorLayout anchor}</b></code></li>\n     * <li><code><b>{@link Ext.layout.ContainerLayout auto}</b></code> &nbsp;&nbsp;&nbsp; <b>Default</b></li>\n     * <li><code><b>{@link Ext.layout.BorderLayout border}</b></code></li>\n     * <li><code><b>{@link Ext.layout.CardLayout card}</b></code></li>\n     * <li><code><b>{@link Ext.layout.ColumnLayout column}</b></code></li>\n     * <li><code><b>{@link Ext.layout.FitLayout fit}</b></code></li>\n     * <li><code><b>{@link Ext.layout.FormLayout form}</b></code></li>\n     * <li><code><b>{@link Ext.layout.HBoxLayout hbox}</b></code></li>\n     * <li><code><b>{@link Ext.layout.MenuLayout menu}</b></code></li>\n     * <li><code><b>{@link Ext.layout.TableLayout table}</b></code></li>\n     * <li><code><b>{@link Ext.layout.ToolbarLayout toolbar}</b></code></li>\n     * <li><code><b>{@link Ext.layout.VBoxLayout vbox}</b></code></li>\n     * </ul></div>\n     *\n     * <li>Layout specific configuration properties</li>\n     * <br/><p>Additional layout specific configuration properties may also be\n     * specified. For complete details regarding the valid config options for\n     * each layout type, see the layout class corresponding to the <code>type</code>\n     * specified.</p>\n     *\n     * </ul></div>\n     *\n     * <li><u>Specify as a String</u></li>\n     * <div><ul class=\"mdetail-params\">\n     * <li>Example usage:</li>\n<pre><code>\nlayout: 'vbox',\nlayoutConfig: {\n    padding: '5',\n    align: 'left'\n}\n</code></pre>\n     * <li><code><b>layout</b></code></li>\n     * <br/><p>The layout <code>type</code> to be used for this container (see list\n     * of valid layout type values above).</p><br/>\n     * <li><code><b>{@link #layoutConfig}</b></code></li>\n     * <br/><p>Additional layout specific configuration properties. For complete\n     * details regarding the valid config options for each layout type, see the\n     * layout class corresponding to the <code>layout</code> specified.</p>\n     * </ul></div></ul></div>\n     */\n    /**\n     * @cfg {Object} layoutConfig\n     * This is a config object containing properties specific to the chosen\n     * <b><code>{@link #layout}</code></b> if <b><code>{@link #layout}</code></b>\n     * has been specified as a <i>string</i>.</p>\n     */\n    /**\n     * @cfg {Boolean/Number} bufferResize\n     * When set to true (50 milliseconds) or a number of milliseconds, the layout assigned for this container will buffer\n     * the frequency it calculates and does a re-layout of components. This is useful for heavy containers or containers\n     * with a large quantity of sub-components for which frequent layout calls would be expensive. Defaults to <code>50</code>.\n     */\n    bufferResize: 50,\n\n    /**\n     * @cfg {String/Number} activeItem\n     * A string component id or the numeric index of the component that should be initially activated within the\n     * container's layout on render.  For example, activeItem: 'item-1' or activeItem: 0 (index 0 = the first\n     * item in the container's collection).  activeItem only applies to layout styles that can display\n     * items one at a time (like {@link Ext.layout.AccordionLayout}, {@link Ext.layout.CardLayout} and\n     * {@link Ext.layout.FitLayout}).  Related to {@link Ext.layout.ContainerLayout#activeItem}.\n     */\n    /**\n     * @cfg {Object/Array} items\n     * <pre><b>** IMPORTANT</b>: be sure to <b>{@link #layout specify a <code>layout</code>} if needed ! **</b></pre>\n     * <p>A single item, or an array of child Components to be added to this container,\n     * for example:</p>\n     * <pre><code>\n// specifying a single item\nitems: {...},\nlayout: 'fit',    // specify a layout!\n\n// specifying multiple items\nitems: [{...}, {...}],\nlayout: 'anchor', // specify a layout!\n     * </code></pre>\n     * <p>Each item may be:</p>\n     * <div><ul class=\"mdetail-params\">\n     * <li>any type of object based on {@link Ext.Component}</li>\n     * <li>a fully instanciated object or</li>\n     * <li>an object literal that:</li>\n     * <div><ul class=\"mdetail-params\">\n     * <li>has a specified <code>{@link Ext.Component#xtype xtype}</code></li>\n     * <li>the {@link Ext.Component#xtype} specified is associated with the Component\n     * desired and should be chosen from one of the available xtypes as listed\n     * in {@link Ext.Component}.</li>\n     * <li>If an <code>{@link Ext.Component#xtype xtype}</code> is not explicitly\n     * specified, the {@link #defaultType} for that Container is used.</li>\n     * <li>will be \"lazily instanciated\", avoiding the overhead of constructing a fully\n     * instanciated Component object</li>\n     * </ul></div></ul></div>\n     * <p><b>Notes</b>:</p>\n     * <div><ul class=\"mdetail-params\">\n     * <li>Ext uses lazy rendering. Child Components will only be rendered\n     * should it become necessary. Items are automatically laid out when they are first\n     * shown (no sizing is done while hidden), or in response to a {@link #doLayout} call.</li>\n     * <li>Do not specify <code>{@link Ext.Panel#contentEl contentEl}</code>/\n     * <code>{@link Ext.Panel#html html}</code> with <code>items</code>.</li>\n     * </ul></div>\n     */\n    /**\n     * @cfg {Object|Function} defaults\n     * <p>This option is a means of applying default settings to all added items whether added through the {@link #items}\n     * config or via the {@link #add} or {@link #insert} methods.</p>\n     * <p>If an added item is a config object, and <b>not</b> an instantiated Component, then the default properties are\n     * unconditionally applied. If the added item <b>is</b> an instantiated Component, then the default properties are\n     * applied conditionally so as not to override existing properties in the item.</p>\n     * <p>If the defaults option is specified as a function, then the function will be called using this Container as the\n     * scope (<code>this</code> reference) and passing the added item as the first parameter. Any resulting object\n     * from that call is then applied to the item as default properties.</p>\n     * <p>For example, to automatically apply padding to the body of each of a set of\n     * contained {@link Ext.Panel} items, you could pass: <code>defaults: {bodyStyle:'padding:15px'}</code>.</p>\n     * <p>Usage:</p><pre><code>\ndefaults: {               // defaults are applied to items, not the container\n    autoScroll:true\n},\nitems: [\n    {\n        xtype: 'panel',   // defaults <b>do not</b> have precedence over\n        id: 'panel1',     // options in config objects, so the defaults\n        autoScroll: false // will not be applied here, panel1 will be autoScroll:false\n    },\n    new Ext.Panel({       // defaults <b>do</b> have precedence over options\n        id: 'panel2',     // options in components, so the defaults\n        autoScroll: false // will be applied here, panel2 will be autoScroll:true.\n    })\n]\n     * </code></pre>\n     */\n\n\n    /** @cfg {Boolean} autoDestroy\n     * If true the container will automatically destroy any contained component that is removed from it, else\n     * destruction must be handled manually (defaults to true).\n     */\n    autoDestroy : true,\n\n    /** @cfg {Boolean} forceLayout\n     * If true the container will force a layout initially even if hidden or collapsed. This option\n     * is useful for forcing forms to render in collapsed or hidden containers. (defaults to false).\n     */\n    forceLayout: false,\n\n    /** @cfg {Boolean} hideBorders\n     * True to hide the borders of each contained component, false to defer to the component's existing\n     * border settings (defaults to false).\n     */\n    /** @cfg {String} defaultType\n     * <p>The default {@link Ext.Component xtype} of child Components to create in this Container when\n     * a child item is specified as a raw configuration object, rather than as an instantiated Component.</p>\n     * <p>Defaults to <code>'panel'</code>, except {@link Ext.menu.Menu} which defaults to <code>'menuitem'</code>,\n     * and {@link Ext.Toolbar} and {@link Ext.ButtonGroup} which default to <code>'button'</code>.</p>\n     */\n    defaultType : 'panel',\n\n    /** @cfg {String} resizeEvent\n     * The event to listen to for resizing in layouts. Defaults to <code>'resize'</code>.\n     */\n    resizeEvent: 'resize',\n\n    /**\n     * @cfg {Array} bubbleEvents\n     * <p>An array of events that, when fired, should be bubbled to any parent container.\n     * See {@link Ext.util.Observable#enableBubble}.\n     * Defaults to <code>['add', 'remove']</code>.\n     */\n    bubbleEvents: ['add', 'remove'],\n\n    // private\n    initComponent : function(){\n        Ext.Container.superclass.initComponent.call(this);\n\n        this.addEvents(\n            /**\n             * @event afterlayout\n             * Fires when the components in this container are arranged by the associated layout manager.\n             * @param {Ext.Container} this\n             * @param {ContainerLayout} layout The ContainerLayout implementation for this container\n             */\n            'afterlayout',\n            /**\n             * @event beforeadd\n             * Fires before any {@link Ext.Component} is added or inserted into the container.\n             * A handler can return false to cancel the add.\n             * @param {Ext.Container} this\n             * @param {Ext.Component} component The component being added\n             * @param {Number} index The index at which the component will be added to the container's items collection\n             */\n            'beforeadd',\n            /**\n             * @event beforeremove\n             * Fires before any {@link Ext.Component} is removed from the container.  A handler can return\n             * false to cancel the remove.\n             * @param {Ext.Container} this\n             * @param {Ext.Component} component The component being removed\n             */\n            'beforeremove',\n            /**\n             * @event add\n             * @bubbles\n             * Fires after any {@link Ext.Component} is added or inserted into the container.\n             * @param {Ext.Container} this\n             * @param {Ext.Component} component The component that was added\n             * @param {Number} index The index at which the component was added to the container's items collection\n             */\n            'add',\n            /**\n             * @event remove\n             * @bubbles\n             * Fires after any {@link Ext.Component} is removed from the container.\n             * @param {Ext.Container} this\n             * @param {Ext.Component} component The component that was removed\n             */\n            'remove'\n        );\n\n        /**\n         * The collection of components in this container as a {@link Ext.util.MixedCollection}\n         * @type MixedCollection\n         * @property items\n         */\n        var items = this.items;\n        if(items){\n            delete this.items;\n            this.add(items);\n        }\n    },\n\n    // private\n    initItems : function(){\n        if(!this.items){\n            this.items = new Ext.util.MixedCollection(false, this.getComponentId);\n            this.getLayout(); // initialize the layout\n        }\n    },\n\n    // private\n    setLayout : function(layout){\n        if(this.layout && this.layout != layout){\n            this.layout.setContainer(null);\n        }\n        this.layout = layout;\n        this.initItems();\n        layout.setContainer(this);\n    },\n\n    afterRender: function(){\n        // Render this Container, this should be done before setLayout is called which\n        // will hook onResize\n        Ext.Container.superclass.afterRender.call(this);\n        if(!this.layout){\n            this.layout = 'auto';\n        }\n        if(Ext.isObject(this.layout) && !this.layout.layout){\n            this.layoutConfig = this.layout;\n            this.layout = this.layoutConfig.type;\n        }\n        if(Ext.isString(this.layout)){\n            this.layout = new Ext.Container.LAYOUTS[this.layout.toLowerCase()](this.layoutConfig);\n        }\n        this.setLayout(this.layout);\n\n        // If a CardLayout, the active item set\n        if(this.activeItem !== undefined && this.layout.setActiveItem){\n            var item = this.activeItem;\n            delete this.activeItem;\n            this.layout.setActiveItem(item);\n        }\n\n        // If we have no ownerCt, render and size all children\n        if(!this.ownerCt){\n            this.doLayout(false, true);\n        }\n\n        // This is a manually configured flag set by users in conjunction with renderTo.\n        // Not to be confused with the flag by the same name used in Layouts.\n        if(this.monitorResize === true){\n            Ext.EventManager.onWindowResize(this.doLayout, this, [false]);\n        }\n    },\n\n    /**\n     * <p>Returns the Element to be used to contain the child Components of this Container.</p>\n     * <p>An implementation is provided which returns the Container's {@link #getEl Element}, but\n     * if there is a more complex structure to a Container, this may be overridden to return\n     * the element into which the {@link #layout layout} renders child Components.</p>\n     * @return {Ext.Element} The Element to render child Components into.\n     */\n    getLayoutTarget : function(){\n        return this.el;\n    },\n\n    // private - used as the key lookup function for the items collection\n    getComponentId : function(comp){\n        return comp.getItemId();\n    },\n\n    /**\n     * <p>Adds {@link Ext.Component Component}(s) to this Container.</p>\n     * <br><p><b>Description</b></u> :\n     * <div><ul class=\"mdetail-params\">\n     * <li>Fires the {@link #beforeadd} event before adding</li>\n     * <li>The Container's {@link #defaults default config values} will be applied\n     * accordingly (see <code>{@link #defaults}</code> for details).</li>\n     * <li>Fires the {@link #add} event after the component has been added.</li>\n     * </ul></div>\n     * <br><p><b>Notes</b></u> :\n     * <div><ul class=\"mdetail-params\">\n     * <li>If the Container is <i>already rendered</i> when <code>add</code>\n     * is called, you may need to call {@link #doLayout} to refresh the view which causes\n     * any unrendered child Components to be rendered. This is required so that you can\n     * <code>add</code> multiple child components if needed while only refreshing the layout\n     * once. For example:<pre><code>\nvar tb = new {@link Ext.Toolbar}();\ntb.render(document.body);  // toolbar is rendered\ntb.add({text:'Button 1'}); // add multiple items ({@link #defaultType} for {@link Ext.Toolbar Toolbar} is 'button')\ntb.add({text:'Button 2'});\ntb.{@link #doLayout}();             // refresh the layout\n     * </code></pre></li>\n     * <li><i>Warning:</i> Containers directly managed by the BorderLayout layout manager\n     * may not be removed or added.  See the Notes for {@link Ext.layout.BorderLayout BorderLayout}\n     * for more details.</li>\n     * </ul></div>\n     * @param {...Object/Array} component\n     * <p>Either one or more Components to add or an Array of Components to add.  See\n     * <code>{@link #items}</code> for additional information.</p>\n     * @return {Ext.Component/Array} The Components that were added.\n     */\n    add : function(comp){\n        this.initItems();\n        var args = arguments.length > 1;\n        if(args || Ext.isArray(comp)){\n            var result = [];\n            Ext.each(args ? arguments : comp, function(c){\n                result.push(this.add(c));\n            }, this);\n            return result;\n        }\n        var c = this.lookupComponent(this.applyDefaults(comp));\n        var index = this.items.length;\n        if(this.fireEvent('beforeadd', this, c, index) !== false && this.onBeforeAdd(c) !== false){\n            this.items.add(c);\n            // *onAdded\n            c.onAdded(this, index);\n            this.onAdd(c);\n            this.fireEvent('add', this, c, index);\n        }\n        return c;\n    },\n\n    onAdd : function(c){\n        // Empty template method\n    },\n\n    // private\n    onAdded : function(container, pos) {\n        //overridden here so we can cascade down, not worth creating a template method.\n        this.ownerCt = container;\n        this.initRef();\n        //initialize references for child items\n        this.cascade(function(c){\n            c.initRef();\n        });\n        this.fireEvent('added', this, container, pos);\n    },\n\n    /**\n     * Inserts a Component into this Container at a specified index. Fires the\n     * {@link #beforeadd} event before inserting, then fires the {@link #add} event after the\n     * Component has been inserted.\n     * @param {Number} index The index at which the Component will be inserted\n     * into the Container's items collection\n     * @param {Ext.Component} component The child Component to insert.<br><br>\n     * Ext uses lazy rendering, and will only render the inserted Component should\n     * it become necessary.<br><br>\n     * A Component config object may be passed in order to avoid the overhead of\n     * constructing a real Component object if lazy rendering might mean that the\n     * inserted Component will not be rendered immediately. To take advantage of\n     * this 'lazy instantiation', set the {@link Ext.Component#xtype} config\n     * property to the registered type of the Component wanted.<br><br>\n     * For a list of all available xtypes, see {@link Ext.Component}.\n     * @return {Ext.Component} component The Component (or config object) that was\n     * inserted with the Container's default config values applied.\n     */\n    insert : function(index, comp) {\n        var args   = arguments,\n            length = args.length,\n            result = [],\n            i, c;\n        \n        this.initItems();\n        \n        if (length > 2) {\n            for (i = length - 1; i >= 1; --i) {\n                result.push(this.insert(index, args[i]));\n            }\n            return result;\n        }\n        \n        c = this.lookupComponent(this.applyDefaults(comp));\n        index = Math.min(index, this.items.length);\n        \n        if (this.fireEvent('beforeadd', this, c, index) !== false && this.onBeforeAdd(c) !== false) {\n            if (c.ownerCt == this) {\n                this.items.remove(c);\n            }\n            this.items.insert(index, c);\n            c.onAdded(this, index);\n            this.onAdd(c);\n            this.fireEvent('add', this, c, index);\n        }\n        \n        return c;\n    },\n\n    // private\n    applyDefaults : function(c){\n        var d = this.defaults;\n        if(d){\n            if(Ext.isFunction(d)){\n                d = d.call(this, c);\n            }\n            if(Ext.isString(c)){\n                c = Ext.ComponentMgr.get(c);\n                Ext.apply(c, d);\n            }else if(!c.events){\n                Ext.applyIf(c.isAction ? c.initialConfig : c, d);\n            }else{\n                Ext.apply(c, d);\n            }\n        }\n        return c;\n    },\n\n    // private\n    onBeforeAdd : function(item){\n        if(item.ownerCt){\n            item.ownerCt.remove(item, false);\n        }\n        if(this.hideBorders === true){\n            item.border = (item.border === true);\n        }\n    },\n\n    /**\n     * Removes a component from this container.  Fires the {@link #beforeremove} event before removing, then fires\n     * the {@link #remove} event after the component has been removed.\n     * @param {Component/String} component The component reference or id to remove.\n     * @param {Boolean} autoDestroy (optional) True to automatically invoke the removed Component's {@link Ext.Component#destroy} function.\n     * Defaults to the value of this Container's {@link #autoDestroy} config.\n     * @return {Ext.Component} component The Component that was removed.\n     */\n    remove : function(comp, autoDestroy){\n        this.initItems();\n        var c = this.getComponent(comp);\n        if(c && this.fireEvent('beforeremove', this, c) !== false){\n            this.doRemove(c, autoDestroy);\n            this.fireEvent('remove', this, c);\n        }\n        return c;\n    },\n\n    onRemove: function(c){\n        // Empty template method\n    },\n\n    // private\n    doRemove: function(c, autoDestroy){\n        var l = this.layout,\n            hasLayout = l && this.rendered;\n\n        if(hasLayout){\n            l.onRemove(c);\n        }\n        this.items.remove(c);\n        c.onRemoved();\n        this.onRemove(c);\n        if(autoDestroy === true || (autoDestroy !== false && this.autoDestroy)){\n            c.destroy();\n        }\n        if(hasLayout){\n            l.afterRemove(c);\n        }\n    },\n\n    /**\n     * Removes all components from this container.\n     * @param {Boolean} autoDestroy (optional) True to automatically invoke the removed Component's {@link Ext.Component#destroy} function.\n     * Defaults to the value of this Container's {@link #autoDestroy} config.\n     * @return {Array} Array of the destroyed components\n     */\n    removeAll: function(autoDestroy){\n        this.initItems();\n        var item, rem = [], items = [];\n        this.items.each(function(i){\n            rem.push(i);\n        });\n        for (var i = 0, len = rem.length; i < len; ++i){\n            item = rem[i];\n            this.remove(item, autoDestroy);\n            if(item.ownerCt !== this){\n                items.push(item);\n            }\n        }\n        return items;\n    },\n\n    /**\n     * Examines this container's <code>{@link #items}</code> <b>property</b>\n     * and gets a direct child component of this container.\n     * @param {String/Number} comp This parameter may be any of the following:\n     * <div><ul class=\"mdetail-params\">\n     * <li>a <b><code>String</code></b> : representing the <code>{@link Ext.Component#itemId itemId}</code>\n     * or <code>{@link Ext.Component#id id}</code> of the child component </li>\n     * <li>a <b><code>Number</code></b> : representing the position of the child component\n     * within the <code>{@link #items}</code> <b>property</b></li>\n     * </ul></div>\n     * <p>For additional information see {@link Ext.util.MixedCollection#get}.\n     * @return Ext.Component The component (if found).\n     */\n    getComponent : function(comp){\n        if(Ext.isObject(comp)){\n            comp = comp.getItemId();\n        }\n        return this.items.get(comp);\n    },\n\n    // private\n    lookupComponent : function(comp){\n        if(Ext.isString(comp)){\n            return Ext.ComponentMgr.get(comp);\n        }else if(!comp.events){\n            return this.createComponent(comp);\n        }\n        return comp;\n    },\n\n    // private\n    createComponent : function(config, defaultType){\n        if (config.render) {\n            return config;\n        }\n        // add in ownerCt at creation time but then immediately\n        // remove so that onBeforeAdd can handle it\n        var c = Ext.create(Ext.apply({\n            ownerCt: this\n        }, config), defaultType || this.defaultType);\n        delete c.initialConfig.ownerCt;\n        delete c.ownerCt;\n        return c;\n    },\n\n    /**\n     * @private\n     * We can only lay out if there is a view area in which to layout.\n     * display:none on the layout target, *or any of its parent elements* will mean it has no view area.\n     */\n    canLayout : function() {\n        var el = this.getVisibilityEl();\n        return el && el.dom && !el.isStyle(\"display\", \"none\");\n    },\n\n    /**\n     * Force this container's layout to be recalculated. A call to this function is required after adding a new component\n     * to an already rendered container, or possibly after changing sizing/position properties of child components.\n     * @param {Boolean} shallow (optional) True to only calc the layout of this component, and let child components auto\n     * calc layouts as required (defaults to false, which calls doLayout recursively for each subcontainer)\n     * @param {Boolean} force (optional) True to force a layout to occur, even if the item is hidden.\n     * @return {Ext.Container} this\n     */\n\n    doLayout : function(shallow, force){\n        var rendered = this.rendered,\n            forceLayout = force || this.forceLayout;\n\n        if(this.collapsed || !this.canLayout()){\n            this.deferLayout = this.deferLayout || !shallow;\n            if(!forceLayout){\n                return;\n            }\n            shallow = shallow && !this.deferLayout;\n        } else {\n            delete this.deferLayout;\n        }\n        if(rendered && this.layout){\n            this.layout.layout();\n        }\n        if(shallow !== true && this.items){\n            var cs = this.items.items;\n            for(var i = 0, len = cs.length; i < len; i++){\n                var c = cs[i];\n                if(c.doLayout){\n                    c.doLayout(false, forceLayout);\n                }\n            }\n        }\n        if(rendered){\n            this.onLayout(shallow, forceLayout);\n        }\n        // Initial layout completed\n        this.hasLayout = true;\n        delete this.forceLayout;\n    },\n\n    onLayout : Ext.emptyFn,\n\n    // private\n    shouldBufferLayout: function(){\n        /*\n         * Returns true if the container should buffer a layout.\n         * This is true only if the container has previously been laid out\n         * and has a parent container that is pending a layout.\n         */\n        var hl = this.hasLayout;\n        if(this.ownerCt){\n            // Only ever buffer if we've laid out the first time and we have one pending.\n            return hl ? !this.hasLayoutPending() : false;\n        }\n        // Never buffer initial layout\n        return hl;\n    },\n\n    // private\n    hasLayoutPending: function(){\n        // Traverse hierarchy to see if any parent container has a pending layout.\n        var pending = false;\n        this.ownerCt.bubble(function(c){\n            if(c.layoutPending){\n                pending = true;\n                return false;\n            }\n        });\n        return pending;\n    },\n\n    onShow : function(){\n        // removes css classes that were added to hide\n        Ext.Container.superclass.onShow.call(this);\n        // If we were sized during the time we were hidden, layout.\n        if(Ext.isDefined(this.deferLayout)){\n            delete this.deferLayout;\n            this.doLayout(true);\n        }\n    },\n\n    /**\n     * Returns the layout currently in use by the container.  If the container does not currently have a layout\n     * set, a default {@link Ext.layout.ContainerLayout} will be created and set as the container's layout.\n     * @return {ContainerLayout} layout The container's layout\n     */\n    getLayout : function(){\n        if(!this.layout){\n            var layout = new Ext.layout.AutoLayout(this.layoutConfig);\n            this.setLayout(layout);\n        }\n        return this.layout;\n    },\n\n    // private\n    beforeDestroy : function(){\n        var c;\n        if(this.items){\n            while(c = this.items.first()){\n                this.doRemove(c, true);\n            }\n        }\n        if(this.monitorResize){\n            Ext.EventManager.removeResizeListener(this.doLayout, this);\n        }\n        Ext.destroy(this.layout);\n        Ext.Container.superclass.beforeDestroy.call(this);\n    },\n\n    /**\n     * Cascades down the component/container heirarchy from this component (called first), calling the specified function with\n     * each component. The scope (<i>this</i>) of\n     * function call will be the scope provided or the current component. The arguments to the function\n     * will be the args provided or the current component. If the function returns false at any point,\n     * the cascade is stopped on that branch.\n     * @param {Function} fn The function to call\n     * @param {Object} scope (optional) The scope of the function (defaults to current component)\n     * @param {Array} args (optional) The args to call the function with (defaults to passing the current component)\n     * @return {Ext.Container} this\n     */\n    cascade : function(fn, scope, args){\n        if(fn.apply(scope || this, args || [this]) !== false){\n            if(this.items){\n                var cs = this.items.items;\n                for(var i = 0, len = cs.length; i < len; i++){\n                    if(cs[i].cascade){\n                        cs[i].cascade(fn, scope, args);\n                    }else{\n                        fn.apply(scope || cs[i], args || [cs[i]]);\n                    }\n                }\n            }\n        }\n        return this;\n    },\n\n    /**\n     * Find a component under this container at any level by id\n     * @param {String} id\n     * @deprecated Fairly useless method, since you can just use Ext.getCmp. Should be removed for 4.0\n     * If you need to test if an id belongs to a container, you can use getCmp and findParent*.\n     * @return Ext.Component\n     */\n    findById : function(id){\n        var m = null, \n            ct = this;\n        this.cascade(function(c){\n            if(ct != c && c.id === id){\n                m = c;\n                return false;\n            }\n        });\n        return m;\n    },\n\n    /**\n     * Find a component under this container at any level by xtype or class\n     * @param {String/Class} xtype The xtype string for a component, or the class of the component directly\n     * @param {Boolean} shallow (optional) False to check whether this Component is descended from the xtype (this is\n     * the default), or true to check whether this Component is directly of the specified xtype.\n     * @return {Array} Array of Ext.Components\n     */\n    findByType : function(xtype, shallow){\n        return this.findBy(function(c){\n            return c.isXType(xtype, shallow);\n        });\n    },\n\n    /**\n     * Find a component under this container at any level by property\n     * @param {String} prop\n     * @param {String} value\n     * @return {Array} Array of Ext.Components\n     */\n    find : function(prop, value){\n        return this.findBy(function(c){\n            return c[prop] === value;\n        });\n    },\n\n    /**\n     * Find a component under this container at any level by a custom function. If the passed function returns\n     * true, the component will be included in the results. The passed function is called with the arguments (component, this container).\n     * @param {Function} fn The function to call\n     * @param {Object} scope (optional)\n     * @return {Array} Array of Ext.Components\n     */\n    findBy : function(fn, scope){\n        var m = [], ct = this;\n        this.cascade(function(c){\n            if(ct != c && fn.call(scope || c, c, ct) === true){\n                m.push(c);\n            }\n        });\n        return m;\n    },\n\n    /**\n     * Get a component contained by this container (alias for items.get(key))\n     * @param {String/Number} key The index or id of the component\n     * @deprecated Should be removed in 4.0, since getComponent does the same thing.\n     * @return {Ext.Component} Ext.Component\n     */\n    get : function(key){\n        return this.getComponent(key);\n    }\n});\n\nExt.Container.LAYOUTS = {};\nExt.reg('container', Ext.Container);\n/**\n * @class Ext.layout.ContainerLayout\n * <p>This class is intended to be extended or created via the <tt><b>{@link Ext.Container#layout layout}</b></tt>\n * configuration property.  See <tt><b>{@link Ext.Container#layout}</b></tt> for additional details.</p>\n */\nExt.layout.ContainerLayout = Ext.extend(Object, {\n    /**\n     * @cfg {String} extraCls\n     * <p>An optional extra CSS class that will be added to the container. This can be useful for adding\n     * customized styles to the container or any of its children using standard CSS rules. See\n     * {@link Ext.Component}.{@link Ext.Component#ctCls ctCls} also.</p>\n     * <p><b>Note</b>: <tt>extraCls</tt> defaults to <tt>''</tt> except for the following classes\n     * which assign a value by default:\n     * <div class=\"mdetail-params\"><ul>\n     * <li>{@link Ext.layout.AbsoluteLayout Absolute Layout} : <tt>'x-abs-layout-item'</tt></li>\n     * <li>{@link Ext.layout.Box Box Layout} : <tt>'x-box-item'</tt></li>\n     * <li>{@link Ext.layout.ColumnLayout Column Layout} : <tt>'x-column'</tt></li>\n     * </ul></div>\n     * To configure the above Classes with an extra CSS class append to the default.  For example,\n     * for ColumnLayout:<pre><code>\n     * extraCls: 'x-column custom-class'\n     * </code></pre>\n     * </p>\n     */\n    /**\n     * @cfg {Boolean} renderHidden\n     * True to hide each contained item on render (defaults to false).\n     */\n\n    /**\n     * A reference to the {@link Ext.Component} that is active.  For example, <pre><code>\n     * if(myPanel.layout.activeItem.id == 'item-1') { ... }\n     * </code></pre>\n     * <tt>activeItem</tt> only applies to layout styles that can display items one at a time\n     * (like {@link Ext.layout.AccordionLayout}, {@link Ext.layout.CardLayout}\n     * and {@link Ext.layout.FitLayout}).  Read-only.  Related to {@link Ext.Container#activeItem}.\n     * @type {Ext.Component}\n     * @property activeItem\n     */\n\n    // private\n    monitorResize:false,\n    // private\n    activeItem : null,\n\n    constructor : function(config){\n        this.id = Ext.id(null, 'ext-layout-');\n        Ext.apply(this, config);\n    },\n\n    type: 'container',\n\n    /* Workaround for how IE measures autoWidth elements.  It prefers bottom-up measurements\n      whereas other browser prefer top-down.  We will hide all target child elements before we measure and\n      put them back to get an accurate measurement.\n    */\n    IEMeasureHack : function(target, viewFlag) {\n        var tChildren = target.dom.childNodes, tLen = tChildren.length, c, d = [], e, i, ret;\n        for (i = 0 ; i < tLen ; i++) {\n            c = tChildren[i];\n            e = Ext.get(c);\n            if (e) {\n                d[i] = e.getStyle('display');\n                e.setStyle({display: 'none'});\n            }\n        }\n        ret = target ? target.getViewSize(viewFlag) : {};\n        for (i = 0 ; i < tLen ; i++) {\n            c = tChildren[i];\n            e = Ext.get(c);\n            if (e) {\n                e.setStyle({display: d[i]});\n            }\n        }\n        return ret;\n    },\n\n    // Placeholder for the derived layouts\n    getLayoutTargetSize : Ext.EmptyFn,\n\n    // private\n    layout : function(){\n        var ct = this.container, target = ct.getLayoutTarget();\n        if(!(this.hasLayout || Ext.isEmpty(this.targetCls))){\n            target.addClass(this.targetCls);\n        }\n        this.onLayout(ct, target);\n        ct.fireEvent('afterlayout', ct, this);\n    },\n\n    // private\n    onLayout : function(ct, target){\n        this.renderAll(ct, target);\n    },\n\n    // private\n    isValidParent : function(c, target){\n        return target && c.getPositionEl().dom.parentNode == (target.dom || target);\n    },\n\n    // private\n    renderAll : function(ct, target){\n        var items = ct.items.items, i, c, len = items.length;\n        for(i = 0; i < len; i++) {\n            c = items[i];\n            if(c && (!c.rendered || !this.isValidParent(c, target))){\n                this.renderItem(c, i, target);\n            }\n        }\n    },\n\n    /**\n     * @private\n     * Renders the given Component into the target Element. If the Component is already rendered,\n     * it is moved to the provided target instead.\n     * @param {Ext.Component} c The Component to render\n     * @param {Number} position The position within the target to render the item to\n     * @param {Ext.Element} target The target Element\n     */\n    renderItem : function(c, position, target){\n        if (c) {\n            if (!c.rendered) {\n                c.render(target, position);\n                this.configureItem(c);\n            } else if (!this.isValidParent(c, target)) {\n                if (Ext.isNumber(position)) {\n                    position = target.dom.childNodes[position];\n                }\n\n                target.dom.insertBefore(c.getPositionEl().dom, position || null);\n                c.container = target;\n                this.configureItem(c);\n            }\n        }\n    },\n\n    // private.\n    // Get all rendered items to lay out.\n    getRenderedItems: function(ct){\n        var t = ct.getLayoutTarget(), cti = ct.items.items, len = cti.length, i, c, items = [];\n        for (i = 0; i < len; i++) {\n            if((c = cti[i]).rendered && this.isValidParent(c, t) && c.shouldLayout !== false){\n                items.push(c);\n            }\n        };\n        return items;\n    },\n\n    /**\n     * @private\n     * Applies extraCls and hides the item if renderHidden is true\n     */\n    configureItem: function(c){\n        if (this.extraCls) {\n            var t = c.getPositionEl ? c.getPositionEl() : c;\n            t.addClass(this.extraCls);\n        }\n\n        // If we are forcing a layout, do so *before* we hide so elements have height/width\n        if (c.doLayout && this.forceLayout) {\n            c.doLayout();\n        }\n        if (this.renderHidden && c != this.activeItem) {\n            c.hide();\n        }\n    },\n\n    onRemove: function(c){\n        if(this.activeItem == c){\n            delete this.activeItem;\n        }\n        if(c.rendered && this.extraCls){\n            var t = c.getPositionEl ? c.getPositionEl() : c;\n            t.removeClass(this.extraCls);\n        }\n    },\n\n    afterRemove: function(c){\n        if(c.removeRestore){\n            c.removeMode = 'container';\n            delete c.removeRestore;\n        }\n    },\n\n    // private\n    onResize: function(){\n        var ct = this.container,\n            b;\n        if(ct.collapsed){\n            return;\n        }\n        if(b = ct.bufferResize && ct.shouldBufferLayout()){\n            if(!this.resizeTask){\n                this.resizeTask = new Ext.util.DelayedTask(this.runLayout, this);\n                this.resizeBuffer = Ext.isNumber(b) ? b : 50;\n            }\n            ct.layoutPending = true;\n            this.resizeTask.delay(this.resizeBuffer);\n        }else{\n            this.runLayout();\n        }\n    },\n\n    runLayout: function(){\n        var ct = this.container;\n        this.layout();\n        ct.onLayout();\n        delete ct.layoutPending;\n    },\n\n    // private\n    setContainer : function(ct){\n        /*\n         * This monitorResize flag will be renamed soon as to avoid confusion\n         * with the Container version which hooks onWindowResize to doLayout\n         *\n         * monitorResize flag in this context attaches the resize event between\n         * a container and it's layout\n         */\n        if(this.monitorResize && ct != this.container){\n            var old = this.container;\n            if(old){\n                old.un(old.resizeEvent, this.onResize, this);\n            }\n            if(ct){\n                ct.on(ct.resizeEvent, this.onResize, this);\n            }\n        }\n        this.container = ct;\n    },\n\n    /**\n     * Parses a number or string representing margin sizes into an object. Supports CSS-style margin declarations\n     * (e.g. 10, \"10\", \"10 10\", \"10 10 10\" and \"10 10 10 10\" are all valid options and would return the same result)\n     * @param {Number|String} v The encoded margins\n     * @return {Object} An object with margin sizes for top, right, bottom and left\n     */\n    parseMargins : function(v){\n        if (Ext.isNumber(v)) {\n            v = v.toString();\n        }\n        var ms  = v.split(' '),\n            len = ms.length;\n\n        if (len == 1) {\n            ms[1] = ms[2] = ms[3] = ms[0];\n        } else if(len == 2) {\n            ms[2] = ms[0];\n            ms[3] = ms[1];\n        } else if(len == 3) {\n            ms[3] = ms[1];\n        }\n\n        return {\n            top   :parseInt(ms[0], 10) || 0,\n            right :parseInt(ms[1], 10) || 0,\n            bottom:parseInt(ms[2], 10) || 0,\n            left  :parseInt(ms[3], 10) || 0\n        };\n    },\n\n    /**\n     * The {@link Ext.Template Ext.Template} used by Field rendering layout classes (such as\n     * {@link Ext.layout.FormLayout}) to create the DOM structure of a fully wrapped,\n     * labeled and styled form Field. A default Template is supplied, but this may be\n     * overriden to create custom field structures. The template processes values returned from\n     * {@link Ext.layout.FormLayout#getTemplateArgs}.\n     * @property fieldTpl\n     * @type Ext.Template\n     */\n    fieldTpl: (function() {\n        var t = new Ext.Template(\n            '<div class=\"x-form-item {itemCls}\" tabIndex=\"-1\">',\n                '<label for=\"{id}\" style=\"{labelStyle}\" class=\"x-form-item-label\">{label}{labelSeparator}</label>',\n                '<div class=\"x-form-element\" id=\"x-form-el-{id}\" style=\"{elementStyle}\">',\n                '</div><div class=\"{clearCls}\"></div>',\n            '</div>'\n        );\n        t.disableFormats = true;\n        return t.compile();\n    })(),\n\n    /*\n     * Destroys this layout. This is a template method that is empty by default, but should be implemented\n     * by subclasses that require explicit destruction to purge event handlers or remove DOM nodes.\n     * @protected\n     */\n    destroy : function(){\n        // Stop any buffered layout tasks\n        if(this.resizeTask && this.resizeTask.cancel){\n            this.resizeTask.cancel();\n        }\n        if(this.container) {\n            this.container.un(this.container.resizeEvent, this.onResize, this);\n        }\n        if(!Ext.isEmpty(this.targetCls)){\n            var target = this.container.getLayoutTarget();\n            if(target){\n                target.removeClass(this.targetCls);\n            }\n        }\n    }\n});/**\n * @class Ext.layout.AutoLayout\n * <p>The AutoLayout is the default layout manager delegated by {@link Ext.Container} to\n * render any child Components when no <tt>{@link Ext.Container#layout layout}</tt> is configured into\n * a {@link Ext.Container Container}.</tt>.  AutoLayout provides only a passthrough of any layout calls\n * to any child containers.</p>\n */\nExt.layout.AutoLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    type: 'auto',\n\n    monitorResize: true,\n\n    onLayout : function(ct, target){\n        Ext.layout.AutoLayout.superclass.onLayout.call(this, ct, target);\n        var cs = this.getRenderedItems(ct), len = cs.length, i, c;\n        for(i = 0; i < len; i++){\n            c = cs[i];\n            if (c.doLayout){\n                // Shallow layout children\n                c.doLayout(true);\n            }\n        }\n    }\n});\n\nExt.Container.LAYOUTS['auto'] = Ext.layout.AutoLayout;\n/**\n * @class Ext.layout.FitLayout\n * @extends Ext.layout.ContainerLayout\n * <p>This is a base class for layouts that contain <b>a single item</b> that automatically expands to fill the layout's\n * container.  This class is intended to be extended or created via the <tt>layout:'fit'</tt> {@link Ext.Container#layout}\n * config, and should generally not need to be created directly via the new keyword.</p>\n * <p>FitLayout does not have any direct config options (other than inherited ones).  To fit a panel to a container\n * using FitLayout, simply set layout:'fit' on the container and add a single panel to it.  If the container has\n * multiple panels, only the first one will be displayed.  Example usage:</p>\n * <pre><code>\nvar p = new Ext.Panel({\n    title: 'Fit Layout',\n    layout:'fit',\n    items: {\n        title: 'Inner Panel',\n        html: '&lt;p&gt;This is the inner panel content&lt;/p&gt;',\n        border: false\n    }\n});\n</code></pre>\n */\nExt.layout.FitLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    // private\n    monitorResize:true,\n\n    type: 'fit',\n\n    getLayoutTargetSize : function() {\n        var target = this.container.getLayoutTarget();\n        if (!target) {\n            return {};\n        }\n        // Style Sized (scrollbars not included)\n        return target.getStyleSize();\n    },\n\n    // private\n    onLayout : function(ct, target){\n        Ext.layout.FitLayout.superclass.onLayout.call(this, ct, target);\n        if(!ct.collapsed){\n            this.setItemSize(this.activeItem || ct.items.itemAt(0), this.getLayoutTargetSize());\n        }\n    },\n\n    // private\n    setItemSize : function(item, size){\n        if(item && size.height > 0){ // display none?\n            item.setSize(size);\n        }\n    }\n});\nExt.Container.LAYOUTS['fit'] = Ext.layout.FitLayout;/**\n * @class Ext.layout.CardLayout\n * @extends Ext.layout.FitLayout\n * <p>This layout manages multiple child Components, each fitted to the Container, where only a single child Component can be\n * visible at any given time.  This layout style is most commonly used for wizards, tab implementations, etc.\n * This class is intended to be extended or created via the layout:'card' {@link Ext.Container#layout} config,\n * and should generally not need to be created directly via the new keyword.</p>\n * <p>The CardLayout's focal method is {@link #setActiveItem}.  Since only one panel is displayed at a time,\n * the only way to move from one Component to the next is by calling setActiveItem, passing the id or index of\n * the next panel to display.  The layout itself does not provide a user interface for handling this navigation,\n * so that functionality must be provided by the developer.</p>\n * <p>In the following example, a simplistic wizard setup is demonstrated.  A button bar is added\n * to the footer of the containing panel to provide navigation buttons.  The buttons will be handled by a\n * common navigation routine -- for this example, the implementation of that routine has been ommitted since\n * it can be any type of custom logic.  Note that other uses of a CardLayout (like a tab control) would require a\n * completely different implementation.  For serious implementations, a better approach would be to extend\n * CardLayout to provide the custom functionality needed.  Example usage:</p>\n * <pre><code>\nvar navHandler = function(direction){\n    // This routine could contain business logic required to manage the navigation steps.\n    // It would call setActiveItem as needed, manage navigation button state, handle any\n    // branching logic that might be required, handle alternate actions like cancellation\n    // or finalization, etc.  A complete wizard implementation could get pretty\n    // sophisticated depending on the complexity required, and should probably be\n    // done as a subclass of CardLayout in a real-world implementation.\n};\n\nvar card = new Ext.Panel({\n    title: 'Example Wizard',\n    layout:'card',\n    activeItem: 0, // make sure the active item is set on the container config!\n    bodyStyle: 'padding:15px',\n    defaults: {\n        // applied to each contained panel\n        border:false\n    },\n    // just an example of one possible navigation scheme, using buttons\n    bbar: [\n        {\n            id: 'move-prev',\n            text: 'Back',\n            handler: navHandler.createDelegate(this, [-1]),\n            disabled: true\n        },\n        '->', // greedy spacer so that the buttons are aligned to each side\n        {\n            id: 'move-next',\n            text: 'Next',\n            handler: navHandler.createDelegate(this, [1])\n        }\n    ],\n    // the panels (or \"cards\") within the layout\n    items: [{\n        id: 'card-0',\n        html: '&lt;h1&gt;Welcome to the Wizard!&lt;/h1&gt;&lt;p&gt;Step 1 of 3&lt;/p&gt;'\n    },{\n        id: 'card-1',\n        html: '&lt;p&gt;Step 2 of 3&lt;/p&gt;'\n    },{\n        id: 'card-2',\n        html: '&lt;h1&gt;Congratulations!&lt;/h1&gt;&lt;p&gt;Step 3 of 3 - Complete&lt;/p&gt;'\n    }]\n});\n</code></pre>\n */\nExt.layout.CardLayout = Ext.extend(Ext.layout.FitLayout, {\n    /**\n     * @cfg {Boolean} deferredRender\n     * True to render each contained item at the time it becomes active, false to render all contained items\n     * as soon as the layout is rendered (defaults to false).  If there is a significant amount of content or\n     * a lot of heavy controls being rendered into panels that are not displayed by default, setting this to\n     * true might improve performance.\n     */\n    deferredRender : false,\n\n    /**\n     * @cfg {Boolean} layoutOnCardChange\n     * True to force a layout of the active item when the active card is changed. Defaults to false.\n     */\n    layoutOnCardChange : false,\n\n    /**\n     * @cfg {Boolean} renderHidden @hide\n     */\n    // private\n    renderHidden : true,\n\n    type: 'card',\n\n    /**\n     * Sets the active (visible) item in the layout.\n     * @param {String/Number} item The string component id or numeric index of the item to activate\n     */\n    setActiveItem : function(item){\n        var ai = this.activeItem,\n            ct = this.container;\n        item = ct.getComponent(item);\n\n        // Is this a valid, different card?\n        if(item && ai != item){\n\n            // Changing cards, hide the current one\n            if(ai){\n                ai.hide();\n                if (ai.hidden !== true) {\n                    return false;\n                }\n                ai.fireEvent('deactivate', ai);\n            }\n\n            var layout = item.doLayout && (this.layoutOnCardChange || !item.rendered);\n\n            // Change activeItem reference\n            this.activeItem = item;\n\n            // The container is about to get a recursive layout, remove any deferLayout reference\n            // because it will trigger a redundant layout.\n            delete item.deferLayout;\n\n            // Show the new component\n            item.show();\n\n            this.layout();\n\n            if(layout){\n                item.doLayout();\n            }\n            item.fireEvent('activate', item);\n        }\n    },\n\n    // private\n    renderAll : function(ct, target){\n        if(this.deferredRender){\n            this.renderItem(this.activeItem, undefined, target);\n        }else{\n            Ext.layout.CardLayout.superclass.renderAll.call(this, ct, target);\n        }\n    }\n});\nExt.Container.LAYOUTS['card'] = Ext.layout.CardLayout;\n/**\n * @class Ext.layout.AnchorLayout\n * @extends Ext.layout.ContainerLayout\n * <p>This is a layout that enables anchoring of contained elements relative to the container's dimensions.\n * If the container is resized, all anchored items are automatically rerendered according to their\n * <b><tt>{@link #anchor}</tt></b> rules.</p>\n * <p>This class is intended to be extended or created via the layout:'anchor' {@link Ext.Container#layout}\n * config, and should generally not need to be created directly via the new keyword.</p>\n * <p>AnchorLayout does not have any direct config options (other than inherited ones). By default,\n * AnchorLayout will calculate anchor measurements based on the size of the container itself. However, the\n * container using the AnchorLayout can supply an anchoring-specific config property of <b>anchorSize</b>.\n * If anchorSize is specifed, the layout will use it as a virtual container for the purposes of calculating\n * anchor measurements based on it instead, allowing the container to be sized independently of the anchoring\n * logic if necessary.  For example:</p>\n * <pre><code>\nvar viewport = new Ext.Viewport({\n    layout:'anchor',\n    anchorSize: {width:800, height:600},\n    items:[{\n        title:'Item 1',\n        html:'Content 1',\n        width:800,\n        anchor:'right 20%'\n    },{\n        title:'Item 2',\n        html:'Content 2',\n        width:300,\n        anchor:'50% 30%'\n    },{\n        title:'Item 3',\n        html:'Content 3',\n        width:600,\n        anchor:'-100 50%'\n    }]\n});\n * </code></pre>\n */\nExt.layout.AnchorLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    /**\n     * @cfg {String} anchor\n     * <p>This configuation option is to be applied to <b>child <tt>items</tt></b> of a container managed by\n     * this layout (ie. configured with <tt>layout:'anchor'</tt>).</p><br/>\n     *\n     * <p>This value is what tells the layout how an item should be anchored to the container. <tt>items</tt>\n     * added to an AnchorLayout accept an anchoring-specific config property of <b>anchor</b> which is a string\n     * containing two values: the horizontal anchor value and the vertical anchor value (for example, '100% 50%').\n     * The following types of anchor values are supported:<div class=\"mdetail-params\"><ul>\n     *\n     * <li><b>Percentage</b> : Any value between 1 and 100, expressed as a percentage.<div class=\"sub-desc\">\n     * The first anchor is the percentage width that the item should take up within the container, and the\n     * second is the percentage height.  For example:<pre><code>\n// two values specified\nanchor: '100% 50%' // render item complete width of the container and\n                   // 1/2 height of the container\n// one value specified\nanchor: '100%'     // the width value; the height will default to auto\n     * </code></pre></div></li>\n     *\n     * <li><b>Offsets</b> : Any positive or negative integer value.<div class=\"sub-desc\">\n     * This is a raw adjustment where the first anchor is the offset from the right edge of the container,\n     * and the second is the offset from the bottom edge. For example:<pre><code>\n// two values specified\nanchor: '-50 -100' // render item the complete width of the container\n                   // minus 50 pixels and\n                   // the complete height minus 100 pixels.\n// one value specified\nanchor: '-50'      // anchor value is assumed to be the right offset value\n                   // bottom offset will default to 0\n     * </code></pre></div></li>\n     *\n     * <li><b>Sides</b> : Valid values are <tt>'right'</tt> (or <tt>'r'</tt>) and <tt>'bottom'</tt>\n     * (or <tt>'b'</tt>).<div class=\"sub-desc\">\n     * Either the container must have a fixed size or an anchorSize config value defined at render time in\n     * order for these to have any effect.</div></li>\n     *\n     * <li><b>Mixed</b> : <div class=\"sub-desc\">\n     * Anchor values can also be mixed as needed.  For example, to render the width offset from the container\n     * right edge by 50 pixels and 75% of the container's height use:\n     * <pre><code>\nanchor: '-50 75%'\n     * </code></pre></div></li>\n     *\n     *\n     * </ul></div>\n     */\n\n    // private\n    monitorResize : true,\n\n    type : 'anchor',\n\n    /**\n     * @cfg {String} defaultAnchor\n     *\n     * default anchor for all child container items applied if no anchor or specific width is set on the child item.  Defaults to '100%'.\n     *\n     */\n    defaultAnchor : '100%',\n\n    parseAnchorRE : /^(r|right|b|bottom)$/i,\n\n\n    getLayoutTargetSize : function() {\n        var target = this.container.getLayoutTarget(), ret = {};\n        if (target) {\n            ret = target.getViewSize();\n\n            // IE in strict mode will return a width of 0 on the 1st pass of getViewSize.\n            // Use getStyleSize to verify the 0 width, the adjustment pass will then work properly\n            // with getViewSize\n            if (Ext.isIE9m && Ext.isStrict && ret.width == 0){\n                ret =  target.getStyleSize();\n            }\n            ret.width -= target.getPadding('lr');\n            ret.height -= target.getPadding('tb');\n        }\n        return ret;\n    },\n\n    // private\n    onLayout : function(container, target) {\n        Ext.layout.AnchorLayout.superclass.onLayout.call(this, container, target);\n\n        var size = this.getLayoutTargetSize(),\n            containerWidth = size.width,\n            containerHeight = size.height,\n            overflow = target.getStyle('overflow'),\n            components = this.getRenderedItems(container),\n            len = components.length,\n            boxes = [],\n            box,\n            anchorWidth,\n            anchorHeight,\n            component,\n            anchorSpec,\n            calcWidth,\n            calcHeight,\n            anchorsArray,\n            totalHeight = 0,\n            i,\n            el;\n\n        if(containerWidth < 20 && containerHeight < 20){\n            return;\n        }\n\n        // find the container anchoring size\n        if(container.anchorSize) {\n            if(typeof container.anchorSize == 'number') {\n                anchorWidth = container.anchorSize;\n            } else {\n                anchorWidth = container.anchorSize.width;\n                anchorHeight = container.anchorSize.height;\n            }\n        } else {\n            anchorWidth = container.initialConfig.width;\n            anchorHeight = container.initialConfig.height;\n        }\n\n        for(i = 0; i < len; i++) {\n            component = components[i];\n            el = component.getPositionEl();\n\n            // If a child container item has no anchor and no specific width, set the child to the default anchor size\n            if (!component.anchor && component.items && !Ext.isNumber(component.width) && !(Ext.isIE6 && Ext.isStrict)){\n                component.anchor = this.defaultAnchor;\n            }\n\n            if(component.anchor) {\n                anchorSpec = component.anchorSpec;\n                // cache all anchor values\n                if(!anchorSpec){\n                    anchorsArray = component.anchor.split(' ');\n                    component.anchorSpec = anchorSpec = {\n                        right: this.parseAnchor(anchorsArray[0], component.initialConfig.width, anchorWidth),\n                        bottom: this.parseAnchor(anchorsArray[1], component.initialConfig.height, anchorHeight)\n                    };\n                }\n                calcWidth = anchorSpec.right ? this.adjustWidthAnchor(anchorSpec.right(containerWidth) - el.getMargins('lr'), component) : undefined;\n                calcHeight = anchorSpec.bottom ? this.adjustHeightAnchor(anchorSpec.bottom(containerHeight) - el.getMargins('tb'), component) : undefined;\n\n                if(calcWidth || calcHeight) {\n                    boxes.push({\n                        component: component,\n                        width: calcWidth || undefined,\n                        height: calcHeight || undefined\n                    });\n                }\n            }\n        }\n        for (i = 0, len = boxes.length; i < len; i++) {\n            box = boxes[i];\n            box.component.setSize(box.width, box.height);\n        }\n\n        if (overflow && overflow != 'hidden' && !this.adjustmentPass) {\n            var newTargetSize = this.getLayoutTargetSize();\n            if (newTargetSize.width != size.width || newTargetSize.height != size.height){\n                this.adjustmentPass = true;\n                this.onLayout(container, target);\n            }\n        }\n\n        delete this.adjustmentPass;\n    },\n\n    // private\n    parseAnchor : function(a, start, cstart) {\n        if (a && a != 'none') {\n            var last;\n            // standard anchor\n            if (this.parseAnchorRE.test(a)) {\n                var diff = cstart - start;\n                return function(v){\n                    if(v !== last){\n                        last = v;\n                        return v - diff;\n                    }\n                };\n            // percentage\n            } else if(a.indexOf('%') != -1) {\n                var ratio = parseFloat(a.replace('%', ''))*.01;\n                return function(v){\n                    if(v !== last){\n                        last = v;\n                        return Math.floor(v*ratio);\n                    }\n                };\n            // simple offset adjustment\n            } else {\n                a = parseInt(a, 10);\n                if (!isNaN(a)) {\n                    return function(v) {\n                        if (v !== last) {\n                            last = v;\n                            return v + a;\n                        }\n                    };\n                }\n            }\n        }\n        return false;\n    },\n\n    // private\n    adjustWidthAnchor : function(value, comp){\n        return value;\n    },\n\n    // private\n    adjustHeightAnchor : function(value, comp){\n        return value;\n    }\n\n    /**\n     * @property activeItem\n     * @hide\n     */\n});\nExt.Container.LAYOUTS['anchor'] = Ext.layout.AnchorLayout;\n/**\n * @class Ext.layout.ColumnLayout\n * @extends Ext.layout.ContainerLayout\n * <p>This is the layout style of choice for creating structural layouts in a multi-column format where the width of\n * each column can be specified as a percentage or fixed width, but the height is allowed to vary based on the content.\n * This class is intended to be extended or created via the layout:'column' {@link Ext.Container#layout} config,\n * and should generally not need to be created directly via the new keyword.</p>\n * <p>ColumnLayout does not have any direct config options (other than inherited ones), but it does support a\n * specific config property of <b><tt>columnWidth</tt></b> that can be included in the config of any panel added to it.  The\n * layout will use the columnWidth (if present) or width of each panel during layout to determine how to size each panel.\n * If width or columnWidth is not specified for a given panel, its width will default to the panel's width (or auto).</p>\n * <p>The width property is always evaluated as pixels, and must be a number greater than or equal to 1.\n * The columnWidth property is always evaluated as a percentage, and must be a decimal value greater than 0 and\n * less than 1 (e.g., .25).</p>\n * <p>The basic rules for specifying column widths are pretty simple.  The logic makes two passes through the\n * set of contained panels.  During the first layout pass, all panels that either have a fixed width or none\n * specified (auto) are skipped, but their widths are subtracted from the overall container width.  During the second\n * pass, all panels with columnWidths are assigned pixel widths in proportion to their percentages based on\n * the total <b>remaining</b> container width.  In other words, percentage width panels are designed to fill the space\n * left over by all the fixed-width and/or auto-width panels.  Because of this, while you can specify any number of columns\n * with different percentages, the columnWidths must always add up to 1 (or 100%) when added together, otherwise your\n * layout may not render as expected.  Example usage:</p>\n * <pre><code>\n// All columns are percentages -- they must add up to 1\nvar p = new Ext.Panel({\n    title: 'Column Layout - Percentage Only',\n    layout:'column',\n    items: [{\n        title: 'Column 1',\n        columnWidth: .25\n    },{\n        title: 'Column 2',\n        columnWidth: .6\n    },{\n        title: 'Column 3',\n        columnWidth: .15\n    }]\n});\n\n// Mix of width and columnWidth -- all columnWidth values must add up\n// to 1. The first column will take up exactly 120px, and the last two\n// columns will fill the remaining container width.\nvar p = new Ext.Panel({\n    title: 'Column Layout - Mixed',\n    layout:'column',\n    items: [{\n        title: 'Column 1',\n        width: 120\n    },{\n        title: 'Column 2',\n        columnWidth: .8\n    },{\n        title: 'Column 3',\n        columnWidth: .2\n    }]\n});\n</code></pre>\n */\nExt.layout.ColumnLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    // private\n    monitorResize:true,\n\n    type: 'column',\n\n    extraCls: 'x-column',\n\n    scrollOffset : 0,\n\n    // private\n\n    targetCls: 'x-column-layout-ct',\n\n    isValidParent : function(c, target){\n        return this.innerCt && c.getPositionEl().dom.parentNode == this.innerCt.dom;\n    },\n\n    getLayoutTargetSize : function() {\n        var target = this.container.getLayoutTarget(), ret;\n        if (target) {\n            ret = target.getViewSize();\n\n            // IE in strict mode will return a width of 0 on the 1st pass of getViewSize.\n            // Use getStyleSize to verify the 0 width, the adjustment pass will then work properly\n            // with getViewSize\n            if (Ext.isIE9m && Ext.isStrict && ret.width == 0){\n                ret =  target.getStyleSize();\n            }\n\n            ret.width -= target.getPadding('lr');\n            ret.height -= target.getPadding('tb');\n        }\n        return ret;\n    },\n\n    renderAll : function(ct, target) {\n        if(!this.innerCt){\n            // the innerCt prevents wrapping and shuffling while\n            // the container is resizing\n            this.innerCt = target.createChild({cls:'x-column-inner'});\n            this.innerCt.createChild({cls:'x-clear'});\n        }\n        Ext.layout.ColumnLayout.superclass.renderAll.call(this, ct, this.innerCt);\n    },\n\n    // private\n    onLayout : function(ct, target){\n        var cs = ct.items.items,\n            len = cs.length,\n            c,\n            i,\n            m,\n            margins = [];\n\n        this.renderAll(ct, target);\n\n        var size = this.getLayoutTargetSize();\n\n        if (Ext.isIE9m && (size.width < 1 && size.height < 1)) { // display none?\n            return;\n        }\n\n        var w = size.width - this.scrollOffset,\n            h = size.height,\n            pw = w;\n\n        this.innerCt.setWidth(w);\n\n        // some columns can be percentages while others are fixed\n        // so we need to make 2 passes\n\n        for(i = 0; i < len; i++){\n            c = cs[i];\n            m = c.getPositionEl().getMargins('lr');\n            margins[i] = m;\n            if(!c.columnWidth){\n                pw -= (c.getWidth() + m);\n            }\n        }\n\n        pw = pw < 0 ? 0 : pw;\n\n        for(i = 0; i < len; i++){\n            c = cs[i];\n            m = margins[i];\n            if(c.columnWidth){\n                c.setSize(Math.floor(c.columnWidth * pw) - m);\n            }\n        }\n\n        // Browsers differ as to when they account for scrollbars.  We need to re-measure to see if the scrollbar\n        // spaces were accounted for properly.  If not, re-layout.\n        if (Ext.isIE9m) {\n            if (i = target.getStyle('overflow') && i != 'hidden' && !this.adjustmentPass) {\n                var ts = this.getLayoutTargetSize();\n                if (ts.width != size.width){\n                    this.adjustmentPass = true;\n                    this.onLayout(ct, target);\n                }\n            }\n        }\n        delete this.adjustmentPass;\n    }\n\n    /**\n     * @property activeItem\n     * @hide\n     */\n});\n\nExt.Container.LAYOUTS['column'] = Ext.layout.ColumnLayout;\n/**\n * @class Ext.layout.BorderLayout\n * @extends Ext.layout.ContainerLayout\n * <p>This is a multi-pane, application-oriented UI layout style that supports multiple\n * nested panels, automatic {@link Ext.layout.BorderLayout.Region#split split} bars between\n * {@link Ext.layout.BorderLayout.Region#BorderLayout.Region regions} and built-in\n * {@link Ext.layout.BorderLayout.Region#collapsible expanding and collapsing} of regions.</p>\n * <p>This class is intended to be extended or created via the <tt>layout:'border'</tt>\n * {@link Ext.Container#layout} config, and should generally not need to be created directly\n * via the new keyword.</p>\n * <p>BorderLayout does not have any direct config options (other than inherited ones).\n * All configuration options available for customizing the BorderLayout are at the\n * {@link Ext.layout.BorderLayout.Region} and {@link Ext.layout.BorderLayout.SplitRegion}\n * levels.</p>\n * <p>Example usage:</p>\n * <pre><code>\nvar myBorderPanel = new Ext.Panel({\n    {@link Ext.Component#renderTo renderTo}: document.body,\n    {@link Ext.BoxComponent#width width}: 700,\n    {@link Ext.BoxComponent#height height}: 500,\n    {@link Ext.Panel#title title}: 'Border Layout',\n    {@link Ext.Container#layout layout}: 'border',\n    {@link Ext.Container#items items}: [{\n        {@link Ext.Panel#title title}: 'South Region is resizable',\n        {@link Ext.layout.BorderLayout.Region#BorderLayout.Region region}: 'south',     // position for region\n        {@link Ext.BoxComponent#height height}: 100,\n        {@link Ext.layout.BorderLayout.Region#split split}: true,         // enable resizing\n        {@link Ext.SplitBar#minSize minSize}: 75,         // defaults to {@link Ext.layout.BorderLayout.Region#minHeight 50}\n        {@link Ext.SplitBar#maxSize maxSize}: 150,\n        {@link Ext.layout.BorderLayout.Region#margins margins}: '0 5 5 5'\n    },{\n        // xtype: 'panel' implied by default\n        {@link Ext.Panel#title title}: 'West Region is collapsible',\n        {@link Ext.layout.BorderLayout.Region#BorderLayout.Region region}:'west',\n        {@link Ext.layout.BorderLayout.Region#margins margins}: '5 0 0 5',\n        {@link Ext.BoxComponent#width width}: 200,\n        {@link Ext.layout.BorderLayout.Region#collapsible collapsible}: true,   // make collapsible\n        {@link Ext.layout.BorderLayout.Region#cmargins cmargins}: '5 5 0 5', // adjust top margin when collapsed\n        {@link Ext.Component#id id}: 'west-region-container',\n        {@link Ext.Container#layout layout}: 'fit',\n        {@link Ext.Panel#unstyled unstyled}: true\n    },{\n        {@link Ext.Panel#title title}: 'Center Region',\n        {@link Ext.layout.BorderLayout.Region#BorderLayout.Region region}: 'center',     // center region is required, no width/height specified\n        {@link Ext.Component#xtype xtype}: 'container',\n        {@link Ext.Container#layout layout}: 'fit',\n        {@link Ext.layout.BorderLayout.Region#margins margins}: '5 5 0 0'\n    }]\n});\n</code></pre>\n * <p><b><u>Notes</u></b>:</p><div class=\"mdetail-params\"><ul>\n * <li>Any container using the BorderLayout <b>must</b> have a child item with <tt>region:'center'</tt>.\n * The child item in the center region will always be resized to fill the remaining space not used by\n * the other regions in the layout.</li>\n * <li>Any child items with a region of <tt>west</tt> or <tt>east</tt> must have <tt>width</tt> defined\n * (an integer representing the number of pixels that the region should take up).</li>\n * <li>Any child items with a region of <tt>north</tt> or <tt>south</tt> must have <tt>height</tt> defined.</li>\n * <li>The regions of a BorderLayout are <b>fixed at render time</b> and thereafter, its child Components may not be removed or added</b>.  To add/remove\n * Components within a BorderLayout, have them wrapped by an additional Container which is directly\n * managed by the BorderLayout.  If the region is to be collapsible, the Container used directly\n * by the BorderLayout manager should be a Panel.  In the following example a Container (an Ext.Panel)\n * is added to the west region:\n * <div style=\"margin-left:16px\"><pre><code>\nwrc = {@link Ext#getCmp Ext.getCmp}('west-region-container');\nwrc.{@link Ext.Panel#removeAll removeAll}();\nwrc.{@link Ext.Container#add add}({\n    title: 'Added Panel',\n    html: 'Some content'\n});\nwrc.{@link Ext.Container#doLayout doLayout}();\n * </code></pre></div>\n * </li>\n * <li> To reference a {@link Ext.layout.BorderLayout.Region Region}:\n * <div style=\"margin-left:16px\"><pre><code>\nwr = myBorderPanel.layout.west;\n * </code></pre></div>\n * </li>\n * </ul></div>\n */\nExt.layout.BorderLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    // private\n    monitorResize:true,\n    // private\n    rendered : false,\n\n    type: 'border',\n\n    targetCls: 'x-border-layout-ct',\n\n    getLayoutTargetSize : function() {\n        var target = this.container.getLayoutTarget();\n        return target ? target.getViewSize() : {};\n    },\n\n    // private\n    onLayout : function(ct, target){\n        var collapsed, i, c, pos, items = ct.items.items, len = items.length;\n        if(!this.rendered){\n            collapsed = [];\n            for(i = 0; i < len; i++) {\n                c = items[i];\n                pos = c.region;\n                if(c.collapsed){\n                    collapsed.push(c);\n                }\n                c.collapsed = false;\n                if(!c.rendered){\n                    c.render(target, i);\n                    c.getPositionEl().addClass('x-border-panel');\n                }\n                this[pos] = pos != 'center' && c.split ?\n                    new Ext.layout.BorderLayout.SplitRegion(this, c.initialConfig, pos) :\n                    new Ext.layout.BorderLayout.Region(this, c.initialConfig, pos);\n                this[pos].render(target, c);\n            }\n            this.rendered = true;\n        }\n\n        var size = this.getLayoutTargetSize();\n        if(size.width < 20 || size.height < 20){ // display none?\n            if(collapsed){\n                this.restoreCollapsed = collapsed;\n            }\n            return;\n        }else if(this.restoreCollapsed){\n            collapsed = this.restoreCollapsed;\n            delete this.restoreCollapsed;\n        }\n\n        var w = size.width, h = size.height,\n            centerW = w, centerH = h, centerY = 0, centerX = 0,\n            n = this.north, s = this.south, west = this.west, e = this.east, c = this.center,\n            b, m, totalWidth, totalHeight;\n        if(!c && Ext.layout.BorderLayout.WARN !== false){\n            throw 'No center region defined in BorderLayout ' + ct.id;\n        }\n\n        if(n && n.isVisible()){\n            b = n.getSize();\n            m = n.getMargins();\n            b.width = w - (m.left+m.right);\n            b.x = m.left;\n            b.y = m.top;\n            centerY = b.height + b.y + m.bottom;\n            centerH -= centerY;\n            n.applyLayout(b);\n        }\n        if(s && s.isVisible()){\n            b = s.getSize();\n            m = s.getMargins();\n            b.width = w - (m.left+m.right);\n            b.x = m.left;\n            totalHeight = (b.height + m.top + m.bottom);\n            b.y = h - totalHeight + m.top;\n            centerH -= totalHeight;\n            s.applyLayout(b);\n        }\n        if(west && west.isVisible()){\n            b = west.getSize();\n            m = west.getMargins();\n            b.height = centerH - (m.top+m.bottom);\n            b.x = m.left;\n            b.y = centerY + m.top;\n            totalWidth = (b.width + m.left + m.right);\n            centerX += totalWidth;\n            centerW -= totalWidth;\n            west.applyLayout(b);\n        }\n        if(e && e.isVisible()){\n            b = e.getSize();\n            m = e.getMargins();\n            b.height = centerH - (m.top+m.bottom);\n            totalWidth = (b.width + m.left + m.right);\n            b.x = w - totalWidth + m.left;\n            b.y = centerY + m.top;\n            centerW -= totalWidth;\n            e.applyLayout(b);\n        }\n        if(c){\n            m = c.getMargins();\n            var centerBox = {\n                x: centerX + m.left,\n                y: centerY + m.top,\n                width: centerW - (m.left+m.right),\n                height: centerH - (m.top+m.bottom)\n            };\n            c.applyLayout(centerBox);\n        }\n        if(collapsed){\n            for(i = 0, len = collapsed.length; i < len; i++){\n                collapsed[i].collapse(false);\n            }\n        }\n        if(Ext.isIE9m && Ext.isStrict){ // workaround IE strict repainting issue\n            target.repaint();\n        }\n        // Putting a border layout into an overflowed container is NOT correct and will make a second layout pass necessary.\n        if (i = target.getStyle('overflow') && i != 'hidden' && !this.adjustmentPass) {\n            var ts = this.getLayoutTargetSize();\n            if (ts.width != size.width || ts.height != size.height){\n                this.adjustmentPass = true;\n                this.onLayout(ct, target);\n            }\n        }\n        delete this.adjustmentPass;\n    },\n\n    destroy: function() {\n        var r = ['north', 'south', 'east', 'west'], i, region;\n        for (i = 0; i < r.length; i++) {\n            region = this[r[i]];\n            if(region){\n                if(region.destroy){\n                    region.destroy();\n                }else if (region.split){\n                    region.split.destroy(true);\n                }\n            }\n        }\n        Ext.layout.BorderLayout.superclass.destroy.call(this);\n    }\n\n    /**\n     * @property activeItem\n     * @hide\n     */\n});\n\n/**\n * @class Ext.layout.BorderLayout.Region\n * <p>This is a region of a {@link Ext.layout.BorderLayout BorderLayout} that acts as a subcontainer\n * within the layout. Each region in the layout is a component, the region itself is constructed on top\n * of that component, acting like a mixin. Each region has its own {@link Ext.layout.ContainerLayout layout} \n * that is independent of other regions and the containing BorderLayout, and can be any of the\n * {@link Ext.layout.ContainerLayout valid Ext layout types}.</p>\n * <p>Region size is managed automatically and cannot be changed by the user -- for\n * {@link #split resizable regions}, see {@link Ext.layout.BorderLayout.SplitRegion}.</p>\n * @constructor\n * Create a new Region.\n * @param {Layout} layout The {@link Ext.layout.BorderLayout BorderLayout} instance that is managing this Region.\n * @param {Object} config The configuration options\n * @param {String} position The region position.  Valid values are: <tt>north</tt>, <tt>south</tt>,\n * <tt>east</tt>, <tt>west</tt> and <tt>center</tt>.  Every {@link Ext.layout.BorderLayout BorderLayout}\n * <b>must have a center region</b> for the primary content -- all other regions are optional.\n */\nExt.layout.BorderLayout.Region = function(layout, config, pos){\n    Ext.apply(this, config);\n    this.layout = layout;\n    this.position = pos;\n    this.state = {};\n    if(typeof this.margins == 'string'){\n        this.margins = this.layout.parseMargins(this.margins);\n    }\n    this.margins = Ext.applyIf(this.margins || {}, this.defaultMargins);\n    if(this.collapsible){\n        if(typeof this.cmargins == 'string'){\n            this.cmargins = this.layout.parseMargins(this.cmargins);\n        }\n        if(this.collapseMode == 'mini' && !this.cmargins){\n            this.cmargins = {left:0,top:0,right:0,bottom:0};\n        }else{\n            this.cmargins = Ext.applyIf(this.cmargins || {},\n                pos == 'north' || pos == 'south' ? this.defaultNSCMargins : this.defaultEWCMargins);\n        }\n    }\n};\n\nExt.layout.BorderLayout.Region.prototype = {\n    /**\n     * @cfg {Boolean} animFloat\n     * When a collapsed region's bar is clicked, the region's panel will be displayed as a floated\n     * panel that will close again once the user mouses out of that panel (or clicks out if\n     * <tt>{@link #autoHide} = false</tt>).  Setting <tt>{@link #animFloat} = false</tt> will\n     * prevent the open and close of these floated panels from being animated (defaults to <tt>true</tt>).\n     */\n    /**\n     * @cfg {Boolean} autoHide\n     * When a collapsed region's bar is clicked, the region's panel will be displayed as a floated\n     * panel.  If <tt>autoHide = true</tt>, the panel will automatically hide after the user mouses\n     * out of the panel.  If <tt>autoHide = false</tt>, the panel will continue to display until the\n     * user clicks outside of the panel (defaults to <tt>true</tt>).\n     */\n    /**\n     * @cfg {String} collapseMode\n     * <tt>collapseMode</tt> supports two configuration values:<div class=\"mdetail-params\"><ul>\n     * <li><b><tt>undefined</tt></b> (default)<div class=\"sub-desc\">By default, {@link #collapsible}\n     * regions are collapsed by clicking the expand/collapse tool button that renders into the region's\n     * title bar.</div></li>\n     * <li><b><tt>'mini'</tt></b><div class=\"sub-desc\">Optionally, when <tt>collapseMode</tt> is set to\n     * <tt>'mini'</tt> the region's split bar will also display a small collapse button in the center of\n     * the bar. In <tt>'mini'</tt> mode the region will collapse to a thinner bar than in normal mode.\n     * </div></li>\n     * </ul></div></p>\n     * <p><b>Note</b>: if a collapsible region does not have a title bar, then set <tt>collapseMode =\n     * 'mini'</tt> and <tt>{@link #split} = true</tt> in order for the region to be {@link #collapsible}\n     * by the user as the expand/collapse tool button (that would go in the title bar) will not be rendered.</p>\n     * <p>See also <tt>{@link #cmargins}</tt>.</p>\n     */\n    /**\n     * @cfg {Object} margins\n     * An object containing margins to apply to the region when in the expanded state in the\n     * format:<pre><code>\n{\n    top: (top margin),\n    right: (right margin),\n    bottom: (bottom margin),\n    left: (left margin)\n}</code></pre>\n     * <p>May also be a string containing space-separated, numeric margin values. The order of the\n     * sides associated with each value matches the way CSS processes margin values:</p>\n     * <p><div class=\"mdetail-params\"><ul>\n     * <li>If there is only one value, it applies to all sides.</li>\n     * <li>If there are two values, the top and bottom borders are set to the first value and the\n     * right and left are set to the second.</li>\n     * <li>If there are three values, the top is set to the first value, the left and right are set\n     * to the second, and the bottom is set to the third.</li>\n     * <li>If there are four values, they apply to the top, right, bottom, and left, respectively.</li>\n     * </ul></div></p>\n     * <p>Defaults to:</p><pre><code>\n     * {top:0, right:0, bottom:0, left:0}\n     * </code></pre>\n     */\n    /**\n     * @cfg {Object} cmargins\n     * An object containing margins to apply to the region when in the collapsed state in the\n     * format:<pre><code>\n{\n    top: (top margin),\n    right: (right margin),\n    bottom: (bottom margin),\n    left: (left margin)\n}</code></pre>\n     * <p>May also be a string containing space-separated, numeric margin values. The order of the\n     * sides associated with each value matches the way CSS processes margin values.</p>\n     * <p><ul>\n     * <li>If there is only one value, it applies to all sides.</li>\n     * <li>If there are two values, the top and bottom borders are set to the first value and the\n     * right and left are set to the second.</li>\n     * <li>If there are three values, the top is set to the first value, the left and right are set\n     * to the second, and the bottom is set to the third.</li>\n     * <li>If there are four values, they apply to the top, right, bottom, and left, respectively.</li>\n     * </ul></p>\n     */\n    /**\n     * @cfg {Boolean} collapsible\n     * <p><tt>true</tt> to allow the user to collapse this region (defaults to <tt>false</tt>).  If\n     * <tt>true</tt>, an expand/collapse tool button will automatically be rendered into the title\n     * bar of the region, otherwise the button will not be shown.</p>\n     * <p><b>Note</b>: that a title bar is required to display the collapse/expand toggle button -- if\n     * no <tt>title</tt> is specified for the region's panel, the region will only be collapsible if\n     * <tt>{@link #collapseMode} = 'mini'</tt> and <tt>{@link #split} = true</tt>.\n     */\n    collapsible : false,\n    /**\n     * @cfg {Boolean} split\n     * <p><tt>true</tt> to create a {@link Ext.layout.BorderLayout.SplitRegion SplitRegion} and\n     * display a 5px wide {@link Ext.SplitBar} between this region and its neighbor, allowing the user to\n     * resize the regions dynamically.  Defaults to <tt>false</tt> creating a\n     * {@link Ext.layout.BorderLayout.Region Region}.</p><br>\n     * <p><b>Notes</b>:</p><div class=\"mdetail-params\"><ul>\n     * <li>this configuration option is ignored if <tt>region='center'</tt></li>\n     * <li>when <tt>split == true</tt>, it is common to specify a\n     * <tt>{@link Ext.SplitBar#minSize minSize}</tt> and <tt>{@link Ext.SplitBar#maxSize maxSize}</tt>\n     * for the {@link Ext.BoxComponent BoxComponent} representing the region. These are not native\n     * configs of {@link Ext.BoxComponent BoxComponent}, and are used only by this class.</li>\n     * <li>if <tt>{@link #collapseMode} = 'mini'</tt> requires <tt>split = true</tt> to reserve space\n     * for the collapse tool</tt></li>\n     * </ul></div>\n     */\n    split:false,\n    /**\n     * @cfg {Boolean} floatable\n     * <tt>true</tt> to allow clicking a collapsed region's bar to display the region's panel floated\n     * above the layout, <tt>false</tt> to force the user to fully expand a collapsed region by\n     * clicking the expand button to see it again (defaults to <tt>true</tt>).\n     */\n    floatable: true,\n    /**\n     * @cfg {Number} minWidth\n     * <p>The minimum allowable width in pixels for this region (defaults to <tt>50</tt>).\n     * <tt>maxWidth</tt> may also be specified.</p><br>\n     * <p><b>Note</b>: setting the <tt>{@link Ext.SplitBar#minSize minSize}</tt> /\n     * <tt>{@link Ext.SplitBar#maxSize maxSize}</tt> supersedes any specified\n     * <tt>minWidth</tt> / <tt>maxWidth</tt>.</p>\n     */\n    minWidth:50,\n    /**\n     * @cfg {Number} minHeight\n     * The minimum allowable height in pixels for this region (defaults to <tt>50</tt>)\n     * <tt>maxHeight</tt> may also be specified.</p><br>\n     * <p><b>Note</b>: setting the <tt>{@link Ext.SplitBar#minSize minSize}</tt> /\n     * <tt>{@link Ext.SplitBar#maxSize maxSize}</tt> supersedes any specified\n     * <tt>minHeight</tt> / <tt>maxHeight</tt>.</p>\n     */\n    minHeight:50,\n\n    // private\n    defaultMargins : {left:0,top:0,right:0,bottom:0},\n    // private\n    defaultNSCMargins : {left:5,top:5,right:5,bottom:5},\n    // private\n    defaultEWCMargins : {left:5,top:0,right:5,bottom:0},\n    floatingZIndex: 100,\n\n    /**\n     * True if this region is collapsed. Read-only.\n     * @type Boolean\n     * @property\n     */\n    isCollapsed : false,\n\n    /**\n     * This region's panel.  Read-only.\n     * @type Ext.Panel\n     * @property panel\n     */\n    /**\n     * This region's layout.  Read-only.\n     * @type Layout\n     * @property layout\n     */\n    /**\n     * This region's layout position (north, south, east, west or center).  Read-only.\n     * @type String\n     * @property position\n     */\n\n    // private\n    render : function(ct, p){\n        this.panel = p;\n        p.el.enableDisplayMode();\n        this.targetEl = ct;\n        this.el = p.el;\n\n        var gs = p.getState, ps = this.position;\n        p.getState = function(){\n            return Ext.apply(gs.call(p) || {}, this.state);\n        }.createDelegate(this);\n\n        if(ps != 'center'){\n            p.allowQueuedExpand = false;\n            p.on({\n                beforecollapse: this.beforeCollapse,\n                collapse: this.onCollapse,\n                beforeexpand: this.beforeExpand,\n                expand: this.onExpand,\n                hide: this.onHide,\n                show: this.onShow,\n                scope: this\n            });\n            if(this.collapsible || this.floatable){\n                p.collapseEl = 'el';\n                p.slideAnchor = this.getSlideAnchor();\n            }\n            if(p.tools && p.tools.toggle){\n                p.tools.toggle.addClass('x-tool-collapse-'+ps);\n                p.tools.toggle.addClassOnOver('x-tool-collapse-'+ps+'-over');\n            }\n        }\n    },\n\n    // private\n    getCollapsedEl : function(){\n        if(!this.collapsedEl){\n            if(!this.toolTemplate){\n                var tt = new Ext.Template(\n                     '<div class=\"x-tool x-tool-{id}\">&#160;</div>'\n                );\n                tt.disableFormats = true;\n                tt.compile();\n                Ext.layout.BorderLayout.Region.prototype.toolTemplate = tt;\n            }\n            this.collapsedEl = this.targetEl.createChild({\n                cls: \"x-layout-collapsed x-layout-collapsed-\"+this.position,\n                id: this.panel.id + '-xcollapsed'\n            });\n            this.collapsedEl.enableDisplayMode('block');\n\n            if(this.collapseMode == 'mini'){\n                this.collapsedEl.addClass('x-layout-cmini-'+this.position);\n                this.miniCollapsedEl = this.collapsedEl.createChild({\n                    cls: \"x-layout-mini x-layout-mini-\"+this.position, html: \"&#160;\"\n                });\n                this.miniCollapsedEl.addClassOnOver('x-layout-mini-over');\n                this.collapsedEl.addClassOnOver(\"x-layout-collapsed-over\");\n                this.collapsedEl.on('click', this.onExpandClick, this, {stopEvent:true});\n            }else {\n                if(this.collapsible !== false && !this.hideCollapseTool) {\n                    var t = this.expandToolEl = this.toolTemplate.append(\n                            this.collapsedEl.dom,\n                            {id:'expand-'+this.position}, true);\n                    t.addClassOnOver('x-tool-expand-'+this.position+'-over');\n                    t.on('click', this.onExpandClick, this, {stopEvent:true});\n                }\n                if(this.floatable !== false || this.titleCollapse){\n                   this.collapsedEl.addClassOnOver(\"x-layout-collapsed-over\");\n                   this.collapsedEl.on(\"click\", this[this.floatable ? 'collapseClick' : 'onExpandClick'], this);\n                }\n            }\n        }\n        return this.collapsedEl;\n    },\n\n    // private\n    onExpandClick : function(e){\n        if(this.isSlid){\n            this.panel.expand(false);\n        }else{\n            this.panel.expand();\n        }\n    },\n\n    // private\n    onCollapseClick : function(e){\n        this.panel.collapse();\n    },\n\n    // private\n    beforeCollapse : function(p, animate){\n        this.lastAnim = animate;\n        if(this.splitEl){\n            this.splitEl.hide();\n        }\n        this.getCollapsedEl().show();\n        var el = this.panel.getEl();\n        this.originalZIndex = el.getStyle('z-index');\n        el.setStyle('z-index', 100);\n        this.isCollapsed = true;\n        this.layout.layout();\n    },\n\n    // private\n    onCollapse : function(animate){\n        this.panel.el.setStyle('z-index', 1);\n        if(this.lastAnim === false || this.panel.animCollapse === false){\n            this.getCollapsedEl().dom.style.visibility = 'visible';\n        }else{\n            this.getCollapsedEl().slideIn(this.panel.slideAnchor, {duration:.2});\n        }\n        this.state.collapsed = true;\n        this.panel.saveState();\n    },\n\n    // private\n    beforeExpand : function(animate){\n        if(this.isSlid){\n            this.afterSlideIn();\n        }\n        var c = this.getCollapsedEl();\n        this.el.show();\n        if(this.position == 'east' || this.position == 'west'){\n            this.panel.setSize(undefined, c.getHeight());\n        }else{\n            this.panel.setSize(c.getWidth(), undefined);\n        }\n        c.hide();\n        c.dom.style.visibility = 'hidden';\n        this.panel.el.setStyle('z-index', this.floatingZIndex);\n    },\n\n    // private\n    onExpand : function(){\n        this.isCollapsed = false;\n        if(this.splitEl){\n            this.splitEl.show();\n        }\n        this.layout.layout();\n        this.panel.el.setStyle('z-index', this.originalZIndex);\n        this.state.collapsed = false;\n        this.panel.saveState();\n    },\n\n    // private\n    collapseClick : function(e){\n        if(this.isSlid){\n           e.stopPropagation();\n           this.slideIn();\n        }else{\n           e.stopPropagation();\n           this.slideOut();\n        }\n    },\n\n    // private\n    onHide : function(){\n        if(this.isCollapsed){\n            this.getCollapsedEl().hide();\n        }else if(this.splitEl){\n            this.splitEl.hide();\n        }\n    },\n\n    // private\n    onShow : function(){\n        if(this.isCollapsed){\n            this.getCollapsedEl().show();\n        }else if(this.splitEl){\n            this.splitEl.show();\n        }\n    },\n\n    /**\n     * True if this region is currently visible, else false.\n     * @return {Boolean}\n     */\n    isVisible : function(){\n        return !this.panel.hidden;\n    },\n\n    /**\n     * Returns the current margins for this region.  If the region is collapsed, the\n     * {@link #cmargins} (collapsed margins) value will be returned, otherwise the\n     * {@link #margins} value will be returned.\n     * @return {Object} An object containing the element's margins: <tt>{left: (left\n     * margin), top: (top margin), right: (right margin), bottom: (bottom margin)}</tt>\n     */\n    getMargins : function(){\n        return this.isCollapsed && this.cmargins ? this.cmargins : this.margins;\n    },\n\n    /**\n     * Returns the current size of this region.  If the region is collapsed, the size of the\n     * collapsedEl will be returned, otherwise the size of the region's panel will be returned.\n     * @return {Object} An object containing the element's size: <tt>{width: (element width),\n     * height: (element height)}</tt>\n     */\n    getSize : function(){\n        return this.isCollapsed ? this.getCollapsedEl().getSize() : this.panel.getSize();\n    },\n\n    /**\n     * Sets the specified panel as the container element for this region.\n     * @param {Ext.Panel} panel The new panel\n     */\n    setPanel : function(panel){\n        this.panel = panel;\n    },\n\n    /**\n     * Returns the minimum allowable width for this region.\n     * @return {Number} The minimum width\n     */\n    getMinWidth: function(){\n        return this.minWidth;\n    },\n\n    /**\n     * Returns the minimum allowable height for this region.\n     * @return {Number} The minimum height\n     */\n    getMinHeight: function(){\n        return this.minHeight;\n    },\n\n    // private\n    applyLayoutCollapsed : function(box){\n        var ce = this.getCollapsedEl();\n        ce.setLeftTop(box.x, box.y);\n        ce.setSize(box.width, box.height);\n    },\n\n    // private\n    applyLayout : function(box){\n        if(this.isCollapsed){\n            this.applyLayoutCollapsed(box);\n        }else{\n            this.panel.setPosition(box.x, box.y);\n            this.panel.setSize(box.width, box.height);\n        }\n    },\n\n    // private\n    beforeSlide: function(){\n        this.panel.beforeEffect();\n    },\n\n    // private\n    afterSlide : function(){\n        this.panel.afterEffect();\n    },\n\n    // private\n    initAutoHide : function(){\n        if(this.autoHide !== false){\n            if(!this.autoHideHd){\n                this.autoHideSlideTask = new Ext.util.DelayedTask(this.slideIn, this);\n                this.autoHideHd = {\n                    \"mouseout\": function(e){\n                        if(!e.within(this.el, true)){\n                            this.autoHideSlideTask.delay(500);\n                        }\n                    },\n                    \"mouseover\" : function(e){\n                        this.autoHideSlideTask.cancel();\n                    },\n                    scope : this\n                };\n            }\n            this.el.on(this.autoHideHd);\n            this.collapsedEl.on(this.autoHideHd);\n        }\n    },\n\n    // private\n    clearAutoHide : function(){\n        if(this.autoHide !== false){\n            this.el.un(\"mouseout\", this.autoHideHd.mouseout);\n            this.el.un(\"mouseover\", this.autoHideHd.mouseover);\n            this.collapsedEl.un(\"mouseout\", this.autoHideHd.mouseout);\n            this.collapsedEl.un(\"mouseover\", this.autoHideHd.mouseover);\n        }\n    },\n\n    // private\n    clearMonitor : function(){\n        Ext.getDoc().un(\"click\", this.slideInIf, this);\n    },\n\n    /**\n     * If this Region is {@link #floatable}, this method slides this Region into full visibility <i>over the top\n     * of the center Region</i> where it floats until either {@link #slideIn} is called, or other regions of the layout\n     * are clicked, or the mouse exits the Region.\n     */\n    slideOut : function(){\n        if(this.isSlid || this.el.hasActiveFx()){\n            return;\n        }\n        this.isSlid = true;\n        var ts = this.panel.tools, dh, pc;\n        if(ts && ts.toggle){\n            ts.toggle.hide();\n        }\n        this.el.show();\n\n        // Temporarily clear the collapsed flag so we can onResize the panel on the slide\n        pc = this.panel.collapsed;\n        this.panel.collapsed = false;\n\n        if(this.position == 'east' || this.position == 'west'){\n            // Temporarily clear the deferHeight flag so we can size the height on the slide\n            dh = this.panel.deferHeight;\n            this.panel.deferHeight = false;\n\n            this.panel.setSize(undefined, this.collapsedEl.getHeight());\n\n            // Put the deferHeight flag back after setSize\n            this.panel.deferHeight = dh;\n        }else{\n            this.panel.setSize(this.collapsedEl.getWidth(), undefined);\n        }\n\n        // Put the collapsed flag back after onResize\n        this.panel.collapsed = pc;\n\n        this.restoreLT = [this.el.dom.style.left, this.el.dom.style.top];\n        this.el.alignTo(this.collapsedEl, this.getCollapseAnchor());\n        this.el.setStyle(\"z-index\", this.floatingZIndex+2);\n        this.panel.el.replaceClass('x-panel-collapsed', 'x-panel-floating');\n        if(this.animFloat !== false){\n            this.beforeSlide();\n            this.el.slideIn(this.getSlideAnchor(), {\n                callback: function(){\n                    this.afterSlide();\n                    this.initAutoHide();\n                    Ext.getDoc().on(\"click\", this.slideInIf, this);\n                },\n                scope: this,\n                block: true\n            });\n        }else{\n            this.initAutoHide();\n             Ext.getDoc().on(\"click\", this.slideInIf, this);\n        }\n    },\n\n    // private\n    afterSlideIn : function(){\n        this.clearAutoHide();\n        this.isSlid = false;\n        this.clearMonitor();\n        this.el.setStyle(\"z-index\", \"\");\n        this.panel.el.replaceClass('x-panel-floating', 'x-panel-collapsed');\n        this.el.dom.style.left = this.restoreLT[0];\n        this.el.dom.style.top = this.restoreLT[1];\n\n        var ts = this.panel.tools;\n        if(ts && ts.toggle){\n            ts.toggle.show();\n        }\n    },\n\n    /**\n     * If this Region is {@link #floatable}, and this Region has been slid into floating visibility, then this method slides\n     * this region back into its collapsed state.\n     */\n    slideIn : function(cb){\n        if(!this.isSlid || this.el.hasActiveFx()){\n            Ext.callback(cb);\n            return;\n        }\n        this.isSlid = false;\n        if(this.animFloat !== false){\n            this.beforeSlide();\n            this.el.slideOut(this.getSlideAnchor(), {\n                callback: function(){\n                    this.el.hide();\n                    this.afterSlide();\n                    this.afterSlideIn();\n                    Ext.callback(cb);\n                },\n                scope: this,\n                block: true\n            });\n        }else{\n            this.el.hide();\n            this.afterSlideIn();\n        }\n    },\n\n    // private\n    slideInIf : function(e){\n        if(!e.within(this.el)){\n            this.slideIn();\n        }\n    },\n\n    // private\n    anchors : {\n        \"west\" : \"left\",\n        \"east\" : \"right\",\n        \"north\" : \"top\",\n        \"south\" : \"bottom\"\n    },\n\n    // private\n    sanchors : {\n        \"west\" : \"l\",\n        \"east\" : \"r\",\n        \"north\" : \"t\",\n        \"south\" : \"b\"\n    },\n\n    // private\n    canchors : {\n        \"west\" : \"tl-tr\",\n        \"east\" : \"tr-tl\",\n        \"north\" : \"tl-bl\",\n        \"south\" : \"bl-tl\"\n    },\n\n    // private\n    getAnchor : function(){\n        return this.anchors[this.position];\n    },\n\n    // private\n    getCollapseAnchor : function(){\n        return this.canchors[this.position];\n    },\n\n    // private\n    getSlideAnchor : function(){\n        return this.sanchors[this.position];\n    },\n\n    // private\n    getAlignAdj : function(){\n        var cm = this.cmargins;\n        switch(this.position){\n            case \"west\":\n                return [0, 0];\n            break;\n            case \"east\":\n                return [0, 0];\n            break;\n            case \"north\":\n                return [0, 0];\n            break;\n            case \"south\":\n                return [0, 0];\n            break;\n        }\n    },\n\n    // private\n    getExpandAdj : function(){\n        var c = this.collapsedEl, cm = this.cmargins;\n        switch(this.position){\n            case \"west\":\n                return [-(cm.right+c.getWidth()+cm.left), 0];\n            break;\n            case \"east\":\n                return [cm.right+c.getWidth()+cm.left, 0];\n            break;\n            case \"north\":\n                return [0, -(cm.top+cm.bottom+c.getHeight())];\n            break;\n            case \"south\":\n                return [0, cm.top+cm.bottom+c.getHeight()];\n            break;\n        }\n    },\n\n    destroy : function(){\n        if (this.autoHideSlideTask && this.autoHideSlideTask.cancel){\n            this.autoHideSlideTask.cancel();\n        }\n        Ext.destroyMembers(this, 'miniCollapsedEl', 'collapsedEl', 'expandToolEl');\n    }\n};\n\n/**\n * @class Ext.layout.BorderLayout.SplitRegion\n * @extends Ext.layout.BorderLayout.Region\n * <p>This is a specialized type of {@link Ext.layout.BorderLayout.Region BorderLayout region} that\n * has a built-in {@link Ext.SplitBar} for user resizing of regions.  The movement of the split bar\n * is configurable to move either {@link #tickSize smooth or incrementally}.</p>\n * @constructor\n * Create a new SplitRegion.\n * @param {Layout} layout The {@link Ext.layout.BorderLayout BorderLayout} instance that is managing this Region.\n * @param {Object} config The configuration options\n * @param {String} position The region position.  Valid values are: north, south, east, west and center.  Every\n * BorderLayout must have a center region for the primary content -- all other regions are optional.\n */\nExt.layout.BorderLayout.SplitRegion = function(layout, config, pos){\n    Ext.layout.BorderLayout.SplitRegion.superclass.constructor.call(this, layout, config, pos);\n    // prevent switch\n    this.applyLayout = this.applyFns[pos];\n};\n\nExt.extend(Ext.layout.BorderLayout.SplitRegion, Ext.layout.BorderLayout.Region, {\n    /**\n     * @cfg {Number} tickSize\n     * The increment, in pixels by which to move this Region's {@link Ext.SplitBar SplitBar}.\n     * By default, the {@link Ext.SplitBar SplitBar} moves smoothly.\n     */\n    /**\n     * @cfg {String} splitTip\n     * The tooltip to display when the user hovers over a\n     * {@link Ext.layout.BorderLayout.Region#collapsible non-collapsible} region's split bar\n     * (defaults to <tt>\"Drag to resize.\"</tt>).  Only applies if\n     * <tt>{@link #useSplitTips} = true</tt>.\n     */\n    splitTip : \"Drag to resize.\",\n    /**\n     * @cfg {String} collapsibleSplitTip\n     * The tooltip to display when the user hovers over a\n     * {@link Ext.layout.BorderLayout.Region#collapsible collapsible} region's split bar\n     * (defaults to \"Drag to resize. Double click to hide.\"). Only applies if\n     * <tt>{@link #useSplitTips} = true</tt>.\n     */\n    collapsibleSplitTip : \"Drag to resize. Double click to hide.\",\n    /**\n     * @cfg {Boolean} useSplitTips\n     * <tt>true</tt> to display a tooltip when the user hovers over a region's split bar\n     * (defaults to <tt>false</tt>).  The tooltip text will be the value of either\n     * <tt>{@link #splitTip}</tt> or <tt>{@link #collapsibleSplitTip}</tt> as appropriate.\n     */\n    useSplitTips : false,\n\n    // private\n    splitSettings : {\n        north : {\n            orientation: Ext.SplitBar.VERTICAL,\n            placement: Ext.SplitBar.TOP,\n            maxFn : 'getVMaxSize',\n            minProp: 'minHeight',\n            maxProp: 'maxHeight'\n        },\n        south : {\n            orientation: Ext.SplitBar.VERTICAL,\n            placement: Ext.SplitBar.BOTTOM,\n            maxFn : 'getVMaxSize',\n            minProp: 'minHeight',\n            maxProp: 'maxHeight'\n        },\n        east : {\n            orientation: Ext.SplitBar.HORIZONTAL,\n            placement: Ext.SplitBar.RIGHT,\n            maxFn : 'getHMaxSize',\n            minProp: 'minWidth',\n            maxProp: 'maxWidth'\n        },\n        west : {\n            orientation: Ext.SplitBar.HORIZONTAL,\n            placement: Ext.SplitBar.LEFT,\n            maxFn : 'getHMaxSize',\n            minProp: 'minWidth',\n            maxProp: 'maxWidth'\n        }\n    },\n\n    // private\n    applyFns : {\n        west : function(box){\n            if(this.isCollapsed){\n                return this.applyLayoutCollapsed(box);\n            }\n            var sd = this.splitEl.dom, s = sd.style;\n            this.panel.setPosition(box.x, box.y);\n            var sw = sd.offsetWidth;\n            s.left = (box.x+box.width-sw)+'px';\n            s.top = (box.y)+'px';\n            s.height = Math.max(0, box.height)+'px';\n            this.panel.setSize(box.width-sw, box.height);\n        },\n        east : function(box){\n            if(this.isCollapsed){\n                return this.applyLayoutCollapsed(box);\n            }\n            var sd = this.splitEl.dom, s = sd.style;\n            var sw = sd.offsetWidth;\n            this.panel.setPosition(box.x+sw, box.y);\n            s.left = (box.x)+'px';\n            s.top = (box.y)+'px';\n            s.height = Math.max(0, box.height)+'px';\n            this.panel.setSize(box.width-sw, box.height);\n        },\n        north : function(box){\n            if(this.isCollapsed){\n                return this.applyLayoutCollapsed(box);\n            }\n            var sd = this.splitEl.dom, s = sd.style;\n            var sh = sd.offsetHeight;\n            this.panel.setPosition(box.x, box.y);\n            s.left = (box.x)+'px';\n            s.top = (box.y+box.height-sh)+'px';\n            s.width = Math.max(0, box.width)+'px';\n            this.panel.setSize(box.width, box.height-sh);\n        },\n        south : function(box){\n            if(this.isCollapsed){\n                return this.applyLayoutCollapsed(box);\n            }\n            var sd = this.splitEl.dom, s = sd.style;\n            var sh = sd.offsetHeight;\n            this.panel.setPosition(box.x, box.y+sh);\n            s.left = (box.x)+'px';\n            s.top = (box.y)+'px';\n            s.width = Math.max(0, box.width)+'px';\n            this.panel.setSize(box.width, box.height-sh);\n        }\n    },\n\n    // private\n    render : function(ct, p){\n        Ext.layout.BorderLayout.SplitRegion.superclass.render.call(this, ct, p);\n\n        var ps = this.position;\n\n        this.splitEl = ct.createChild({\n            cls: \"x-layout-split x-layout-split-\"+ps, html: \"&#160;\",\n            id: this.panel.id + '-xsplit'\n        });\n\n        if(this.collapseMode == 'mini'){\n            this.miniSplitEl = this.splitEl.createChild({\n                cls: \"x-layout-mini x-layout-mini-\"+ps, html: \"&#160;\"\n            });\n            this.miniSplitEl.addClassOnOver('x-layout-mini-over');\n            this.miniSplitEl.on('click', this.onCollapseClick, this, {stopEvent:true});\n        }\n\n        var s = this.splitSettings[ps];\n\n        this.split = new Ext.SplitBar(this.splitEl.dom, p.el, s.orientation);\n        this.split.tickSize = this.tickSize;\n        this.split.placement = s.placement;\n        this.split.getMaximumSize = this[s.maxFn].createDelegate(this);\n        this.split.minSize = this.minSize || this[s.minProp];\n        this.split.on(\"beforeapply\", this.onSplitMove, this);\n        this.split.useShim = this.useShim === true;\n        this.maxSize = this.maxSize || this[s.maxProp];\n\n        if(p.hidden){\n            this.splitEl.hide();\n        }\n\n        if(this.useSplitTips){\n            this.splitEl.dom.title = this.collapsible ? this.collapsibleSplitTip : this.splitTip;\n        }\n        if(this.collapsible){\n            this.splitEl.on(\"dblclick\", this.onCollapseClick,  this);\n        }\n    },\n\n    //docs inherit from superclass\n    getSize : function(){\n        if(this.isCollapsed){\n            return this.collapsedEl.getSize();\n        }\n        var s = this.panel.getSize();\n        if(this.position == 'north' || this.position == 'south'){\n            s.height += this.splitEl.dom.offsetHeight;\n        }else{\n            s.width += this.splitEl.dom.offsetWidth;\n        }\n        return s;\n    },\n\n    // private\n    getHMaxSize : function(){\n         var cmax = this.maxSize || 10000;\n         var center = this.layout.center;\n         return Math.min(cmax, (this.el.getWidth()+center.el.getWidth())-center.getMinWidth());\n    },\n\n    // private\n    getVMaxSize : function(){\n        var cmax = this.maxSize || 10000;\n        var center = this.layout.center;\n        return Math.min(cmax, (this.el.getHeight()+center.el.getHeight())-center.getMinHeight());\n    },\n\n    // private\n    onSplitMove : function(split, newSize){\n        var s = this.panel.getSize();\n        this.lastSplitSize = newSize;\n        if(this.position == 'north' || this.position == 'south'){\n            this.panel.setSize(s.width, newSize);\n            this.state.height = newSize;\n        }else{\n            this.panel.setSize(newSize, s.height);\n            this.state.width = newSize;\n        }\n        this.layout.layout();\n        this.panel.saveState();\n        return false;\n    },\n\n    /**\n     * Returns a reference to the split bar in use by this region.\n     * @return {Ext.SplitBar} The split bar\n     */\n    getSplitBar : function(){\n        return this.split;\n    },\n\n    // inherit docs\n    destroy : function() {\n        Ext.destroy(this.miniSplitEl, this.split, this.splitEl);\n        Ext.layout.BorderLayout.SplitRegion.superclass.destroy.call(this);\n    }\n});\n\nExt.Container.LAYOUTS['border'] = Ext.layout.BorderLayout;\n/**\n * @class Ext.layout.FormLayout\n * @extends Ext.layout.AnchorLayout\n * <p>This layout manager is specifically designed for rendering and managing child Components of\n * {@link Ext.form.FormPanel forms}. It is responsible for rendering the labels of\n * {@link Ext.form.Field Field}s.</p>\n *\n * <p>This layout manager is used when a Container is configured with the <tt>layout:'form'</tt>\n * {@link Ext.Container#layout layout} config option, and should generally not need to be created directly\n * via the new keyword. See <tt><b>{@link Ext.Container#layout}</b></tt> for additional details.</p>\n *\n * <p>In an application, it will usually be preferrable to use a {@link Ext.form.FormPanel FormPanel}\n * (which is configured with FormLayout as its layout class by default) since it also provides built-in\n * functionality for {@link Ext.form.BasicForm#doAction loading, validating and submitting} the form.</p>\n *\n * <p>A {@link Ext.Container Container} <i>using</i> the FormLayout layout manager (e.g.\n * {@link Ext.form.FormPanel} or specifying <tt>layout:'form'</tt>) can also accept the following\n * layout-specific config properties:<div class=\"mdetail-params\"><ul>\n * <li><b><tt>{@link Ext.form.FormPanel#hideLabels hideLabels}</tt></b></li>\n * <li><b><tt>{@link Ext.form.FormPanel#labelAlign labelAlign}</tt></b></li>\n * <li><b><tt>{@link Ext.form.FormPanel#labelPad labelPad}</tt></b></li>\n * <li><b><tt>{@link Ext.form.FormPanel#labelSeparator labelSeparator}</tt></b></li>\n * <li><b><tt>{@link Ext.form.FormPanel#labelWidth labelWidth}</tt></b></li>\n * </ul></div></p>\n *\n * <p>Any Component (including Fields) managed by FormLayout accepts the following as a config option:\n * <div class=\"mdetail-params\"><ul>\n * <li><b><tt>{@link Ext.Component#anchor anchor}</tt></b></li>\n * </ul></div></p>\n *\n * <p>Any Component managed by FormLayout may be rendered as a form field (with an associated label) by\n * configuring it with a non-null <b><tt>{@link Ext.Component#fieldLabel fieldLabel}</tt></b>. Components configured\n * in this way may be configured with the following options which affect the way the FormLayout renders them:\n * <div class=\"mdetail-params\"><ul>\n * <li><b><tt>{@link Ext.Component#clearCls clearCls}</tt></b></li>\n * <li><b><tt>{@link Ext.Component#fieldLabel fieldLabel}</tt></b></li>\n * <li><b><tt>{@link Ext.Component#hideLabel hideLabel}</tt></b></li>\n * <li><b><tt>{@link Ext.Component#itemCls itemCls}</tt></b></li>\n * <li><b><tt>{@link Ext.Component#labelSeparator labelSeparator}</tt></b></li>\n * <li><b><tt>{@link Ext.Component#labelStyle labelStyle}</tt></b></li>\n * </ul></div></p>\n *\n * <p>Example usage:</p>\n * <pre><code>\n// Required if showing validation messages\nExt.QuickTips.init();\n\n// While you can create a basic Panel with layout:'form', practically\n// you should usually use a FormPanel to also get its form functionality\n// since it already creates a FormLayout internally.\nvar form = new Ext.form.FormPanel({\n    title: 'Form Layout',\n    bodyStyle: 'padding:15px',\n    width: 350,\n    defaultType: 'textfield',\n    defaults: {\n        // applied to each contained item\n        width: 230,\n        msgTarget: 'side'\n    },\n    items: [{\n            fieldLabel: 'First Name',\n            name: 'first',\n            allowBlank: false,\n            {@link Ext.Component#labelSeparator labelSeparator}: ':' // override labelSeparator layout config\n        },{\n            fieldLabel: 'Last Name',\n            name: 'last'\n        },{\n            fieldLabel: 'Email',\n            name: 'email',\n            vtype:'email'\n        }, {\n            xtype: 'textarea',\n            hideLabel: true,     // override hideLabels layout config\n            name: 'msg',\n            anchor: '100% -53'\n        }\n    ],\n    buttons: [\n        {text: 'Save'},\n        {text: 'Cancel'}\n    ],\n    layoutConfig: {\n        {@link #labelSeparator}: '~' // superseded by assignment below\n    },\n    // config options applicable to container when layout='form':\n    hideLabels: false,\n    labelAlign: 'left',   // or 'right' or 'top'\n    {@link Ext.form.FormPanel#labelSeparator labelSeparator}: '>>', // takes precedence over layoutConfig value\n    labelWidth: 65,       // defaults to 100\n    labelPad: 8           // defaults to 5, must specify labelWidth to be honored\n});\n</code></pre>\n */\nExt.layout.FormLayout = Ext.extend(Ext.layout.AnchorLayout, {\n\n    /**\n     * @cfg {String} labelSeparator\n     * See {@link Ext.form.FormPanel}.{@link Ext.form.FormPanel#labelSeparator labelSeparator}.  Configuration\n     * of this property at the <b>container</b> level takes precedence.\n     */\n    labelSeparator : ':',\n\n    /**\n     * Read only. The CSS style specification string added to field labels in this layout if not\n     * otherwise {@link Ext.Component#labelStyle specified by each contained field}.\n     * @type String\n     * @property labelStyle\n     */\n\n    /**\n     * @cfg {Boolean} trackLabels\n     * True to show/hide the field label when the field is hidden. Defaults to <tt>true</tt>.\n     */\n    trackLabels: true,\n\n    type: 'form',\n\n    onRemove: function(c){\n        Ext.layout.FormLayout.superclass.onRemove.call(this, c);\n        if(this.trackLabels){\n            c.un('show', this.onFieldShow, this);\n            c.un('hide', this.onFieldHide, this);\n        }\n        // check for itemCt, since we may be removing a fieldset or something similar\n        var el = c.getPositionEl(),\n            ct = c.getItemCt && c.getItemCt();\n        if (c.rendered && ct) {\n            if (el && el.dom) {\n                el.insertAfter(ct);\n            }\n            Ext.destroy(ct);\n            Ext.destroyMembers(c, 'label', 'itemCt');\n            if (c.customItemCt) {\n                Ext.destroyMembers(c, 'getItemCt', 'customItemCt');\n            }\n        }\n    },\n\n    // private\n    setContainer : function(ct){\n        Ext.layout.FormLayout.superclass.setContainer.call(this, ct);\n        ct.labelAlign = ct.labelAlign || this.labelAlign;\n        if (ct.labelAlign) {\n            ct.addClass('x-form-label-' + ct.labelAlign);\n        }\n\n        if (ct.hideLabels || this.hideLabels) { \n            Ext.apply(this, {\n                labelStyle: 'display:none',\n                elementStyle: 'padding-left:0;',\n                labelAdjust: 0\n            });\n        } else {\n            this.labelSeparator = Ext.isDefined(ct.labelSeparator) ? ct.labelSeparator : this.labelSeparator;\n            ct.labelWidth = ct.labelWidth || this.labelWidth || 100;\n            if(Ext.isNumber(ct.labelWidth)){\n                var pad = ct.labelPad || this.labelPad;\n                pad = Ext.isNumber(pad) ? pad : 5;\n                Ext.apply(this, {\n                    labelAdjust: ct.labelWidth + pad,\n                    labelStyle: 'width:' + ct.labelWidth + 'px;',\n                    elementStyle: 'padding-left:' + (ct.labelWidth + pad) + 'px'\n                });\n            }\n            if(ct.labelAlign == 'top'){\n                Ext.apply(this, {\n                    labelStyle: 'width:auto;',\n                    labelAdjust: 0,\n                    elementStyle: 'padding-left:0;'\n                });\n            }\n        }\n    },\n\n    // private\n    isHide: function(c){\n        return c.hideLabel || this.container.hideLabels;\n    },\n\n    onFieldShow: function(c){\n        c.getItemCt().removeClass('x-hide-' + c.hideMode);\n\n        // Composite fields will need to layout after the container is made visible\n        if (c.isComposite) {\n            c.doLayout();\n        }\n    },\n\n    onFieldHide: function(c){\n        c.getItemCt().addClass('x-hide-' + c.hideMode);\n    },\n\n    //private\n    getLabelStyle: function(s){\n        var ls = '', items = [this.labelStyle, s];\n        for (var i = 0, len = items.length; i < len; ++i){\n            if (items[i]){\n                ls += items[i];\n                if (ls.substr(-1, 1) != ';'){\n                    ls += ';';\n                }\n            }\n        }\n        return ls;\n    },\n\n    /**\n     * @cfg {Ext.Template} fieldTpl\n     * A {@link Ext.Template#compile compile}d {@link Ext.Template} for rendering\n     * the fully wrapped, labeled and styled form Field. Defaults to:</p><pre><code>\nnew Ext.Template(\n    &#39;&lt;div class=\"x-form-item {itemCls}\" tabIndex=\"-1\">&#39;,\n        &#39;&lt;&#108;abel for=\"{id}\" style=\"{labelStyle}\" class=\"x-form-item-&#108;abel\">{&#108;abel}{labelSeparator}&lt;/&#108;abel>&#39;,\n        &#39;&lt;div class=\"x-form-element\" id=\"x-form-el-{id}\" style=\"{elementStyle}\">&#39;,\n        &#39;&lt;/div>&lt;div class=\"{clearCls}\">&lt;/div>&#39;,\n    '&lt;/div>'\n);\n</code></pre>\n     * <p>This may be specified to produce a different DOM structure when rendering form Fields.</p>\n     * <p>A description of the properties within the template follows:</p><div class=\"mdetail-params\"><ul>\n     * <li><b><tt>itemCls</tt></b> : String<div class=\"sub-desc\">The CSS class applied to the outermost div wrapper\n     * that contains this field label and field element (the default class is <tt>'x-form-item'</tt> and <tt>itemCls</tt>\n     * will be added to that). If supplied, <tt>itemCls</tt> at the field level will override the default <tt>itemCls</tt>\n     * supplied at the container level.</div></li>\n     * <li><b><tt>id</tt></b> : String<div class=\"sub-desc\">The id of the Field</div></li>\n     * <li><b><tt>{@link #labelStyle}</tt></b> : String<div class=\"sub-desc\">\n     * A CSS style specification string to add to the field label for this field (defaults to <tt>''</tt> or the\n     * {@link #labelStyle layout's value for <tt>labelStyle</tt>}).</div></li>\n     * <li><b><tt>label</tt></b> : String<div class=\"sub-desc\">The text to display as the label for this\n     * field (defaults to <tt>''</tt>)</div></li>\n     * <li><b><tt>{@link #labelSeparator}</tt></b> : String<div class=\"sub-desc\">The separator to display after\n     * the text of the label for this field (defaults to a colon <tt>':'</tt> or the\n     * {@link #labelSeparator layout's value for labelSeparator}). To hide the separator use empty string ''.</div></li>\n     * <li><b><tt>elementStyle</tt></b> : String<div class=\"sub-desc\">The styles text for the input element's wrapper.</div></li>\n     * <li><b><tt>clearCls</tt></b> : String<div class=\"sub-desc\">The CSS class to apply to the special clearing div\n     * rendered directly after each form field wrapper (defaults to <tt>'x-form-clear-left'</tt>)</div></li>\n     * </ul></div>\n     * <p>Also see <tt>{@link #getTemplateArgs}</tt></p>\n     */\n\n    /**\n     * @private\n     *\n     */\n    renderItem : function(c, position, target){\n        if(c && (c.isFormField || c.fieldLabel) && c.inputType != 'hidden'){\n            var args = this.getTemplateArgs(c);\n            if(Ext.isNumber(position)){\n                position = target.dom.childNodes[position] || null;\n            }\n            if(position){\n                c.itemCt = this.fieldTpl.insertBefore(position, args, true);\n            }else{\n                c.itemCt = this.fieldTpl.append(target, args, true);\n            }\n            if(!c.getItemCt){\n                // Non form fields don't have getItemCt, apply it here\n                // This will get cleaned up in onRemove\n                Ext.apply(c, {\n                    getItemCt: function(){\n                        return c.itemCt;\n                    },\n                    customItemCt: true\n                });\n            }\n            c.label = c.getItemCt().child('label.x-form-item-label');\n            if(!c.rendered){\n                c.render('x-form-el-' + c.id);\n            }else if(!this.isValidParent(c, target)){\n                Ext.fly('x-form-el-' + c.id).appendChild(c.getPositionEl());\n            }\n            if(this.trackLabels){\n                if(c.hidden){\n                    this.onFieldHide(c);\n                }\n                c.on({\n                    scope: this,\n                    show: this.onFieldShow,\n                    hide: this.onFieldHide\n                });\n            }\n            this.configureItem(c);\n        }else {\n            Ext.layout.FormLayout.superclass.renderItem.apply(this, arguments);\n        }\n    },\n\n    /**\n     * <p>Provides template arguments for rendering the fully wrapped, labeled and styled form Field.</p>\n     * <p>This method returns an object hash containing properties used by the layout's {@link #fieldTpl}\n     * to create a correctly wrapped, labeled and styled form Field. This may be overriden to\n     * create custom layouts. The properties which must be returned are:</p><div class=\"mdetail-params\"><ul>\n     * <li><b><tt>itemCls</tt></b> : String<div class=\"sub-desc\">The CSS class applied to the outermost div wrapper\n     * that contains this field label and field element (the default class is <tt>'x-form-item'</tt> and <tt>itemCls</tt>\n     * will be added to that). If supplied, <tt>itemCls</tt> at the field level will override the default <tt>itemCls</tt>\n     * supplied at the container level.</div></li>\n     * <li><b><tt>id</tt></b> : String<div class=\"sub-desc\">The id of the Field</div></li>\n     * <li><b><tt>{@link #labelStyle}</tt></b> : String<div class=\"sub-desc\">\n     * A CSS style specification string to add to the field label for this field (defaults to <tt>''</tt> or the\n     * {@link #labelStyle layout's value for <tt>labelStyle</tt>}).</div></li>\n     * <li><b><tt>label</tt></b> : String<div class=\"sub-desc\">The text to display as the label for this\n     * field (defaults to the field's configured fieldLabel property)</div></li>\n     * <li><b><tt>{@link #labelSeparator}</tt></b> : String<div class=\"sub-desc\">The separator to display after\n     * the text of the label for this field (defaults to a colon <tt>':'</tt> or the\n     * {@link #labelSeparator layout's value for labelSeparator}). To hide the separator use empty string ''.</div></li>\n     * <li><b><tt>elementStyle</tt></b> : String<div class=\"sub-desc\">The styles text for the input element's wrapper.</div></li>\n     * <li><b><tt>clearCls</tt></b> : String<div class=\"sub-desc\">The CSS class to apply to the special clearing div\n     * rendered directly after each form field wrapper (defaults to <tt>'x-form-clear-left'</tt>)</div></li>\n     * </ul></div>\n     * @param (Ext.form.Field} field The {@link Ext.form.Field Field} being rendered.\n     * @return {Object} An object hash containing the properties required to render the Field.\n     */\n    getTemplateArgs: function(field) {\n        var noLabelSep = !field.fieldLabel || field.hideLabel,\n            itemCls = (field.itemCls || this.container.itemCls || '') + (field.hideLabel ? ' x-hide-label' : '');\n\n        // IE9 quirks needs an extra, identifying class on wrappers of TextFields\n        if (Ext.isIE9 && Ext.isIEQuirks && field instanceof Ext.form.TextField) {\n            itemCls += ' x-input-wrapper';\n        }\n\n        return {\n            id            : field.id,\n            label         : field.fieldLabel,\n            itemCls       : itemCls,\n            clearCls      : field.clearCls || 'x-form-clear-left',\n            labelStyle    : this.getLabelStyle(field.labelStyle),\n            elementStyle  : this.elementStyle || '',\n            labelSeparator: noLabelSep ? '' : (Ext.isDefined(field.labelSeparator) ? field.labelSeparator : this.labelSeparator)\n        };\n    },\n\n    // private\n    adjustWidthAnchor: function(value, c){\n        if(c.label && !this.isHide(c) && (this.container.labelAlign != 'top')){\n            var adjust = Ext.isIE6 || Ext.isIEQuirks;\n            return value - this.labelAdjust + (adjust ? -3 : 0);\n        }\n        return value;\n    },\n\n    adjustHeightAnchor : function(value, c){\n        if(c.label && !this.isHide(c) && (this.container.labelAlign == 'top')){\n            return value - c.label.getHeight();\n        }\n        return value;\n    },\n\n    // private\n    isValidParent : function(c, target){\n        return target && this.container.getEl().contains(c.getPositionEl());\n    }\n\n    /**\n     * @property activeItem\n     * @hide\n     */\n});\n\nExt.Container.LAYOUTS['form'] = Ext.layout.FormLayout;\n/**\n * @class Ext.layout.AccordionLayout\n * @extends Ext.layout.FitLayout\n * <p>This is a layout that manages multiple Panels in an expandable accordion style such that only\n * <b>one Panel can be expanded at any given time</b>. Each Panel has built-in support for expanding and collapsing.</p>\n * <p>Note: Only Ext.Panels <b>and all subclasses of Ext.Panel</b> may be used in an accordion layout Container.</p>\n * <p>This class is intended to be extended or created via the <tt><b>{@link Ext.Container#layout layout}</b></tt>\n * configuration property.  See <tt><b>{@link Ext.Container#layout}</b></tt> for additional details.</p>\n * <p>Example usage:</p>\n * <pre><code>\nvar accordion = new Ext.Panel({\n    title: 'Accordion Layout',\n    layout:'accordion',\n    defaults: {\n        // applied to each contained panel\n        bodyStyle: 'padding:15px'\n    },\n    layoutConfig: {\n        // layout-specific configs go here\n        titleCollapse: false,\n        animate: true,\n        activeOnTop: true\n    },\n    items: [{\n        title: 'Panel 1',\n        html: '&lt;p&gt;Panel content!&lt;/p&gt;'\n    },{\n        title: 'Panel 2',\n        html: '&lt;p&gt;Panel content!&lt;/p&gt;'\n    },{\n        title: 'Panel 3',\n        html: '&lt;p&gt;Panel content!&lt;/p&gt;'\n    }]\n});\n</code></pre>\n */\nExt.layout.AccordionLayout = Ext.extend(Ext.layout.FitLayout, {\n    /**\n     * @cfg {Boolean} fill\n     * True to adjust the active item's height to fill the available space in the container, false to use the\n     * item's current height, or auto height if not explicitly set (defaults to true).\n     */\n    fill : true,\n    /**\n     * @cfg {Boolean} autoWidth\n     * True to set each contained item's width to 'auto', false to use the item's current width (defaults to true).\n     * Note that some components, in particular the {@link Ext.grid.GridPanel grid}, will not function properly within\n     * layouts if they have auto width, so in such cases this config should be set to false.\n     */\n    autoWidth : true,\n    /**\n     * @cfg {Boolean} titleCollapse\n     * True to allow expand/collapse of each contained panel by clicking anywhere on the title bar, false to allow\n     * expand/collapse only when the toggle tool button is clicked (defaults to true).  When set to false,\n     * {@link #hideCollapseTool} should be false also.\n     */\n    titleCollapse : true,\n    /**\n     * @cfg {Boolean} hideCollapseTool\n     * True to hide the contained panels' collapse/expand toggle buttons, false to display them (defaults to false).\n     * When set to true, {@link #titleCollapse} should be true also.\n     */\n    hideCollapseTool : false,\n    /**\n     * @cfg {Boolean} collapseFirst\n     * True to make sure the collapse/expand toggle button always renders first (to the left of) any other tools\n     * in the contained panels' title bars, false to render it last (defaults to false).\n     */\n    collapseFirst : false,\n    /**\n     * @cfg {Boolean} animate\n     * True to slide the contained panels open and closed during expand/collapse using animation, false to open and\n     * close directly with no animation (defaults to false).  Note: to defer to the specific config setting of each\n     * contained panel for this property, set this to undefined at the layout level.\n     */\n    animate : false,\n    /**\n     * @cfg {Boolean} sequence\n     * <b>Experimental</b>. If animate is set to true, this will result in each animation running in sequence.\n     */\n    sequence : false,\n    /**\n     * @cfg {Boolean} activeOnTop\n     * True to swap the position of each panel as it is expanded so that it becomes the first item in the container,\n     * false to keep the panels in the rendered order. <b>This is NOT compatible with \"animate:true\"</b> (defaults to false).\n     */\n    activeOnTop : false,\n\n    type: 'accordion',\n\n    renderItem : function(c){\n        if(this.animate === false){\n            c.animCollapse = false;\n        }\n        c.collapsible = true;\n        if(this.autoWidth){\n            c.autoWidth = true;\n        }\n        if(this.titleCollapse){\n            c.titleCollapse = true;\n        }\n        if(this.hideCollapseTool){\n            c.hideCollapseTool = true;\n        }\n        if(this.collapseFirst !== undefined){\n            c.collapseFirst = this.collapseFirst;\n        }\n        if(!this.activeItem && !c.collapsed){\n            this.setActiveItem(c, true);\n        }else if(this.activeItem && this.activeItem != c){\n            c.collapsed = true;\n        }\n        Ext.layout.AccordionLayout.superclass.renderItem.apply(this, arguments);\n        c.header.addClass('x-accordion-hd');\n        c.on('beforeexpand', this.beforeExpand, this);\n    },\n\n    onRemove: function(c){\n        Ext.layout.AccordionLayout.superclass.onRemove.call(this, c);\n        if(c.rendered){\n            c.header.removeClass('x-accordion-hd');\n        }\n        c.un('beforeexpand', this.beforeExpand, this);\n    },\n\n    // private\n    beforeExpand : function(p, anim){\n        var ai = this.activeItem;\n        if(ai){\n            if(this.sequence){\n                delete this.activeItem;\n                if (!ai.collapsed){\n                    ai.collapse({callback:function(){\n                        p.expand(anim || true);\n                    }, scope: this});\n                    return false;\n                }\n            }else{\n                ai.collapse(this.animate);\n            }\n        }\n        this.setActive(p);\n        if(this.activeOnTop){\n            p.el.dom.parentNode.insertBefore(p.el.dom, p.el.dom.parentNode.firstChild);\n        }\n        // Items have been hidden an possibly rearranged, we need to get the container size again.\n        this.layout();\n    },\n\n    // private\n    setItemSize : function(item, size){\n        if(this.fill && item){\n            var hh = 0, i, ct = this.getRenderedItems(this.container), len = ct.length, p;\n            // Add up all the header heights\n            for (i = 0; i < len; i++) {\n                if((p = ct[i]) != item && !p.hidden){\n                    hh += p.header.getHeight();\n                }\n            };\n            // Subtract the header heights from the container size\n            size.height -= hh;\n            // Call setSize on the container to set the correct height.  For Panels, deferedHeight\n            // will simply store this size for when the expansion is done.\n            item.setSize(size);\n        }\n    },\n\n    /**\n     * Sets the active (expanded) item in the layout.\n     * @param {String/Number} item The string component id or numeric index of the item to activate\n     */\n    setActiveItem : function(item){\n        this.setActive(item, true);\n    },\n\n    // private\n    setActive : function(item, expand){\n        var ai = this.activeItem;\n        item = this.container.getComponent(item);\n        if(ai != item){\n            if(item.rendered && item.collapsed && expand){\n                item.expand();\n            }else{\n                if(ai){\n                   ai.fireEvent('deactivate', ai);\n                }\n                this.activeItem = item;\n                item.fireEvent('activate', item);\n            }\n        }\n    }\n});\nExt.Container.LAYOUTS.accordion = Ext.layout.AccordionLayout;\n\n//backwards compat\nExt.layout.Accordion = Ext.layout.AccordionLayout;/**\n * @class Ext.layout.TableLayout\n * @extends Ext.layout.ContainerLayout\n * <p>This layout allows you to easily render content into an HTML table.  The total number of columns can be\n * specified, and rowspan and colspan can be used to create complex layouts within the table.\n * This class is intended to be extended or created via the layout:'table' {@link Ext.Container#layout} config,\n * and should generally not need to be created directly via the new keyword.</p>\n * <p>Note that when creating a layout via config, the layout-specific config properties must be passed in via\n * the {@link Ext.Container#layoutConfig} object which will then be applied internally to the layout.  In the\n * case of TableLayout, the only valid layout config property is {@link #columns}.  However, the items added to a\n * TableLayout can supply the following table-specific config properties:</p>\n * <ul>\n * <li><b>rowspan</b> Applied to the table cell containing the item.</li>\n * <li><b>colspan</b> Applied to the table cell containing the item.</li>\n * <li><b>cellId</b> An id applied to the table cell containing the item.</li>\n * <li><b>cellCls</b> A CSS class name added to the table cell containing the item.</li>\n * </ul>\n * <p>The basic concept of building up a TableLayout is conceptually very similar to building up a standard\n * HTML table.  You simply add each panel (or \"cell\") that you want to include along with any span attributes\n * specified as the special config properties of rowspan and colspan which work exactly like their HTML counterparts.\n * Rather than explicitly creating and nesting rows and columns as you would in HTML, you simply specify the\n * total column count in the layoutConfig and start adding panels in their natural order from left to right,\n * top to bottom.  The layout will automatically figure out, based on the column count, rowspans and colspans,\n * how to position each panel within the table.  Just like with HTML tables, your rowspans and colspans must add\n * up correctly in your overall layout or you'll end up with missing and/or extra cells!  Example usage:</p>\n * <pre><code>\n// This code will generate a layout table that is 3 columns by 2 rows\n// with some spanning included.  The basic layout will be:\n// +--------+-----------------+\n// |   A    |   B             |\n// |        |--------+--------|\n// |        |   C    |   D    |\n// +--------+--------+--------+\nvar table = new Ext.Panel({\n    title: 'Table Layout',\n    layout:'table',\n    defaults: {\n        // applied to each contained panel\n        bodyStyle:'padding:20px'\n    },\n    layoutConfig: {\n        // The total column count must be specified here\n        columns: 3\n    },\n    items: [{\n        html: '&lt;p&gt;Cell A content&lt;/p&gt;',\n        rowspan: 2\n    },{\n        html: '&lt;p&gt;Cell B content&lt;/p&gt;',\n        colspan: 2\n    },{\n        html: '&lt;p&gt;Cell C content&lt;/p&gt;',\n        cellCls: 'highlight'\n    },{\n        html: '&lt;p&gt;Cell D content&lt;/p&gt;'\n    }]\n});\n</code></pre>\n */\nExt.layout.TableLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    /**\n     * @cfg {Number} columns\n     * The total number of columns to create in the table for this layout.  If not specified, all Components added to\n     * this layout will be rendered into a single row using one column per Component.\n     */\n\n    // private\n    monitorResize:false,\n\n    type: 'table',\n\n    targetCls: 'x-table-layout-ct',\n\n    /**\n     * @cfg {Object} tableAttrs\n     * <p>An object containing properties which are added to the {@link Ext.DomHelper DomHelper} specification\n     * used to create the layout's <tt>&lt;table&gt;</tt> element. Example:</p><pre><code>\n{\n    xtype: 'panel',\n    layout: 'table',\n    layoutConfig: {\n        tableAttrs: {\n            style: {\n                width: '100%'\n            }\n        },\n        columns: 3\n    }\n}</code></pre>\n     */\n    tableAttrs:null,\n\n    // private\n    setContainer : function(ct){\n        Ext.layout.TableLayout.superclass.setContainer.call(this, ct);\n\n        this.currentRow = 0;\n        this.currentColumn = 0;\n        this.cells = [];\n    },\n    \n    // private\n    onLayout : function(ct, target){\n        var cs = ct.items.items, len = cs.length, c, i;\n\n        if(!this.table){\n            target.addClass('x-table-layout-ct');\n\n            this.table = target.createChild(\n                Ext.apply({tag:'table', cls:'x-table-layout', cellspacing: 0, cn: {tag: 'tbody'}}, this.tableAttrs), null, true);\n        }\n        this.renderAll(ct, target);\n    },\n\n    // private\n    getRow : function(index){\n        var row = this.table.tBodies[0].childNodes[index];\n        if(!row){\n            row = document.createElement('tr');\n            this.table.tBodies[0].appendChild(row);\n        }\n        return row;\n    },\n\n    // private\n    getNextCell : function(c){\n        var cell = this.getNextNonSpan(this.currentColumn, this.currentRow);\n        var curCol = this.currentColumn = cell[0], curRow = this.currentRow = cell[1];\n        for(var rowIndex = curRow; rowIndex < curRow + (c.rowspan || 1); rowIndex++){\n            if(!this.cells[rowIndex]){\n                this.cells[rowIndex] = [];\n            }\n            for(var colIndex = curCol; colIndex < curCol + (c.colspan || 1); colIndex++){\n                this.cells[rowIndex][colIndex] = true;\n            }\n        }\n        var td = document.createElement('td');\n        if(c.cellId){\n            td.id = c.cellId;\n        }\n        var cls = 'x-table-layout-cell';\n        if(c.cellCls){\n            cls += ' ' + c.cellCls;\n        }\n        td.className = cls;\n        if(c.colspan){\n            td.colSpan = c.colspan;\n        }\n        if(c.rowspan){\n            td.rowSpan = c.rowspan;\n        }\n        this.getRow(curRow).appendChild(td);\n        return td;\n    },\n\n    // private\n    getNextNonSpan: function(colIndex, rowIndex){\n        var cols = this.columns;\n        while((cols && colIndex >= cols) || (this.cells[rowIndex] && this.cells[rowIndex][colIndex])) {\n            if(cols && colIndex >= cols){\n                rowIndex++;\n                colIndex = 0;\n            }else{\n                colIndex++;\n            }\n        }\n        return [colIndex, rowIndex];\n    },\n\n    // private\n    renderItem : function(c, position, target){\n        // Ensure we have our inner table to get cells to render into.\n        if(!this.table){\n            this.table = target.createChild(\n                Ext.apply({tag:'table', cls:'x-table-layout', cellspacing: 0, cn: {tag: 'tbody'}}, this.tableAttrs), null, true);\n        }\n        if(c && !c.rendered){\n            c.render(this.getNextCell(c));\n            this.configureItem(c);\n        }else if(c && !this.isValidParent(c, target)){\n            var container = this.getNextCell(c);\n            container.insertBefore(c.getPositionEl().dom, null);\n            c.container = Ext.get(container);\n            this.configureItem(c);\n        }\n    },\n\n    // private\n    isValidParent : function(c, target){\n        return c.getPositionEl().up('table', 5).dom.parentNode === (target.dom || target);\n    },\n    \n    destroy: function(){\n        delete this.table;\n        Ext.layout.TableLayout.superclass.destroy.call(this);\n    }\n\n    /**\n     * @property activeItem\n     * @hide\n     */\n});\n\nExt.Container.LAYOUTS['table'] = Ext.layout.TableLayout;/**\n * @class Ext.layout.AbsoluteLayout\n * @extends Ext.layout.AnchorLayout\n * <p>This is a layout that inherits the anchoring of <b>{@link Ext.layout.AnchorLayout}</b> and adds the\n * ability for x/y positioning using the standard x and y component config options.</p>\n * <p>This class is intended to be extended or created via the <tt><b>{@link Ext.Container#layout layout}</b></tt>\n * configuration property.  See <tt><b>{@link Ext.Container#layout}</b></tt> for additional details.</p>\n * <p>Example usage:</p>\n * <pre><code>\nvar form = new Ext.form.FormPanel({\n    title: 'Absolute Layout',\n    layout:'absolute',\n    layoutConfig: {\n        // layout-specific configs go here\n        extraCls: 'x-abs-layout-item',\n    },\n    baseCls: 'x-plain',\n    url:'save-form.php',\n    defaultType: 'textfield',\n    items: [{\n        x: 0,\n        y: 5,\n        xtype:'label',\n        text: 'Send To:'\n    },{\n        x: 60,\n        y: 0,\n        name: 'to',\n        anchor:'100%'  // anchor width by percentage\n    },{\n        x: 0,\n        y: 35,\n        xtype:'label',\n        text: 'Subject:'\n    },{\n        x: 60,\n        y: 30,\n        name: 'subject',\n        anchor: '100%'  // anchor width by percentage\n    },{\n        x:0,\n        y: 60,\n        xtype: 'textarea',\n        name: 'msg',\n        anchor: '100% 100%'  // anchor width and height\n    }]\n});\n</code></pre>\n */\nExt.layout.AbsoluteLayout = Ext.extend(Ext.layout.AnchorLayout, {\n\n    extraCls: 'x-abs-layout-item',\n\n    type: 'absolute',\n\n    onLayout : function(ct, target){\n        target.position();\n        this.paddingLeft = target.getPadding('l');\n        this.paddingTop = target.getPadding('t');\n        Ext.layout.AbsoluteLayout.superclass.onLayout.call(this, ct, target);\n    },\n\n    // private\n    adjustWidthAnchor : function(value, comp){\n        return value ? value - comp.getPosition(true)[0] + this.paddingLeft : value;\n    },\n\n    // private\n    adjustHeightAnchor : function(value, comp){\n        return  value ? value - comp.getPosition(true)[1] + this.paddingTop : value;\n    }\n    /**\n     * @property activeItem\n     * @hide\n     */\n});\nExt.Container.LAYOUTS['absolute'] = Ext.layout.AbsoluteLayout;\n/**\n * @class Ext.layout.BoxLayout\n * @extends Ext.layout.ContainerLayout\n * <p>Base Class for HBoxLayout and VBoxLayout Classes. Generally it should not need to be used directly.</p>\n */\nExt.layout.BoxLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    /**\n     * @cfg {Object} defaultMargins\n     * <p>If the individual contained items do not have a <tt>margins</tt>\n     * property specified, the default margins from this property will be\n     * applied to each item.</p>\n     * <br><p>This property may be specified as an object containing margins\n     * to apply in the format:</p><pre><code>\n{\n    top: (top margin),\n    right: (right margin),\n    bottom: (bottom margin),\n    left: (left margin)\n}</code></pre>\n     * <p>This property may also be specified as a string containing\n     * space-separated, numeric margin values. The order of the sides associated\n     * with each value matches the way CSS processes margin values:</p>\n     * <div class=\"mdetail-params\"><ul>\n     * <li>If there is only one value, it applies to all sides.</li>\n     * <li>If there are two values, the top and bottom borders are set to the\n     * first value and the right and left are set to the second.</li>\n     * <li>If there are three values, the top is set to the first value, the left\n     * and right are set to the second, and the bottom is set to the third.</li>\n     * <li>If there are four values, they apply to the top, right, bottom, and\n     * left, respectively.</li>\n     * </ul></div>\n     * <p>Defaults to:</p><pre><code>\n     * {top:0, right:0, bottom:0, left:0}\n     * </code></pre>\n     */\n    defaultMargins : {left:0,top:0,right:0,bottom:0},\n    /**\n     * @cfg {String} padding\n     * <p>Sets the padding to be applied to all child items managed by this layout.</p>\n     * <p>This property must be specified as a string containing\n     * space-separated, numeric padding values. The order of the sides associated\n     * with each value matches the way CSS processes padding values:</p>\n     * <div class=\"mdetail-params\"><ul>\n     * <li>If there is only one value, it applies to all sides.</li>\n     * <li>If there are two values, the top and bottom borders are set to the\n     * first value and the right and left are set to the second.</li>\n     * <li>If there are three values, the top is set to the first value, the left\n     * and right are set to the second, and the bottom is set to the third.</li>\n     * <li>If there are four values, they apply to the top, right, bottom, and\n     * left, respectively.</li>\n     * </ul></div>\n     * <p>Defaults to: <code>\"0\"</code></p>\n     */\n    padding : '0',\n    // documented in subclasses\n    pack : 'start',\n\n    // private\n    monitorResize : true,\n    type: 'box',\n    scrollOffset : 0,\n    extraCls : 'x-box-item',\n    targetCls : 'x-box-layout-ct',\n    innerCls : 'x-box-inner',\n\n    constructor : function(config){\n        Ext.layout.BoxLayout.superclass.constructor.call(this, config);\n\n        if (Ext.isString(this.defaultMargins)) {\n            this.defaultMargins = this.parseMargins(this.defaultMargins);\n        }\n        \n        var handler = this.overflowHandler;\n        \n        if (typeof handler == 'string') {\n            handler = {\n                type: handler\n            };\n        }\n        \n        var handlerType = 'none';\n        if (handler && handler.type != undefined) {\n            handlerType = handler.type;\n        }\n        \n        var constructor = Ext.layout.boxOverflow[handlerType];\n        if (constructor[this.type]) {\n            constructor = constructor[this.type];\n        }\n        \n        this.overflowHandler = new constructor(this, handler);\n    },\n\n    /**\n     * @private\n     * Runs the child box calculations and caches them in childBoxCache. Subclasses can used these cached values\n     * when laying out\n     */\n    onLayout: function(container, target) {\n        Ext.layout.BoxLayout.superclass.onLayout.call(this, container, target);\n\n        var tSize = this.getLayoutTargetSize(),\n            items = this.getVisibleItems(container),\n            calcs = this.calculateChildBoxes(items, tSize),\n            boxes = calcs.boxes,\n            meta  = calcs.meta;\n        \n        //invoke the overflow handler, if one is configured\n        if (tSize.width > 0) {\n            var handler = this.overflowHandler,\n                method  = meta.tooNarrow ? 'handleOverflow' : 'clearOverflow';\n            \n            var results = handler[method](calcs, tSize);\n            \n            if (results) {\n                if (results.targetSize) {\n                    tSize = results.targetSize;\n                }\n                \n                if (results.recalculate) {\n                    items = this.getVisibleItems(container);\n                    calcs = this.calculateChildBoxes(items, tSize);\n                    boxes = calcs.boxes;\n                }\n            }\n        }\n        \n        /**\n         * @private\n         * @property layoutTargetLastSize\n         * @type Object\n         * Private cache of the last measured size of the layout target. This should never be used except by\n         * BoxLayout subclasses during their onLayout run.\n         */\n        this.layoutTargetLastSize = tSize;\n        \n        /**\n         * @private\n         * @property childBoxCache\n         * @type Array\n         * Array of the last calculated height, width, top and left positions of each visible rendered component\n         * within the Box layout.\n         */\n        this.childBoxCache = calcs;\n        \n        this.updateInnerCtSize(tSize, calcs);\n        this.updateChildBoxes(boxes);\n\n        // Putting a box layout into an overflowed container is NOT correct and will make a second layout pass necessary.\n        this.handleTargetOverflow(tSize, container, target);\n    },\n\n    /**\n     * Resizes and repositions each child component\n     * @param {Array} boxes The box measurements\n     */\n    updateChildBoxes: function(boxes) {\n        for (var i = 0, length = boxes.length; i < length; i++) {\n            var box  = boxes[i],\n                comp = box.component;\n            \n            if (box.dirtySize) {\n                comp.setSize(box.width, box.height);\n            }\n            // Don't set positions to NaN\n            if (isNaN(box.left) || isNaN(box.top)) {\n                continue;\n            }\n            \n            comp.setPosition(box.left, box.top);\n        }\n    },\n\n    /**\n     * @private\n     * Called by onRender just before the child components are sized and positioned. This resizes the innerCt\n     * to make sure all child items fit within it. We call this before sizing the children because if our child\n     * items are larger than the previous innerCt size the browser will insert scrollbars and then remove them\n     * again immediately afterwards, giving a performance hit.\n     * Subclasses should provide an implementation.\n     * @param {Object} currentSize The current height and width of the innerCt\n     * @param {Array} calculations The new box calculations of all items to be laid out\n     */\n    updateInnerCtSize: function(tSize, calcs) {\n        var align   = this.align,\n            padding = this.padding,\n            width   = tSize.width,\n            height  = tSize.height;\n        \n        if (this.type == 'hbox') {\n            var innerCtWidth  = width,\n                innerCtHeight = calcs.meta.maxHeight + padding.top + padding.bottom;\n\n            if (align == 'stretch') {\n                innerCtHeight = height;\n            } else if (align == 'middle') {\n                innerCtHeight = Math.max(height, innerCtHeight);\n            }\n        } else {\n            var innerCtHeight = height,\n                innerCtWidth  = calcs.meta.maxWidth + padding.left + padding.right;\n\n            if (align == 'stretch') {\n                innerCtWidth = width;\n            } else if (align == 'center') {\n                innerCtWidth = Math.max(width, innerCtWidth);\n            }\n        }\n\n        this.innerCt.setSize(innerCtWidth || undefined, innerCtHeight || undefined);\n    },\n\n    /**\n     * @private\n     * This should be called after onLayout of any BoxLayout subclass. If the target's overflow is not set to 'hidden',\n     * we need to lay out a second time because the scrollbars may have modified the height and width of the layout\n     * target. Having a Box layout inside such a target is therefore not recommended.\n     * @param {Object} previousTargetSize The size and height of the layout target before we just laid out\n     * @param {Ext.Container} container The container\n     * @param {Ext.Element} target The target element\n     */\n    handleTargetOverflow: function(previousTargetSize, container, target) {\n        var overflow = target.getStyle('overflow');\n\n        if (overflow && overflow != 'hidden' &&!this.adjustmentPass) {\n            var newTargetSize = this.getLayoutTargetSize();\n            if (newTargetSize.width != previousTargetSize.width || newTargetSize.height != previousTargetSize.height){\n                this.adjustmentPass = true;\n                this.onLayout(container, target);\n            }\n        }\n\n        delete this.adjustmentPass;\n    },\n\n    // private\n    isValidParent : function(c, target) {\n        return this.innerCt && c.getPositionEl().dom.parentNode == this.innerCt.dom;\n    },\n\n    /**\n     * @private\n     * Returns all items that are both rendered and visible\n     * @return {Array} All matching items\n     */\n    getVisibleItems: function(ct) {\n        var ct  = ct || this.container,\n            t   = ct.getLayoutTarget(),\n            cti = ct.items.items,\n            len = cti.length,\n\n            i, c, items = [];\n\n        for (i = 0; i < len; i++) {\n            if((c = cti[i]).rendered && this.isValidParent(c, t) && c.hidden !== true  && c.collapsed !== true && c.shouldLayout !== false){\n                items.push(c);\n            }\n        }\n\n        return items;\n    },\n\n    // private\n    renderAll : function(ct, target) {\n        if (!this.innerCt) {\n            // the innerCt prevents wrapping and shuffling while the container is resizing\n            this.innerCt = target.createChild({cls:this.innerCls});\n            this.padding = this.parseMargins(this.padding);\n        }\n        Ext.layout.BoxLayout.superclass.renderAll.call(this, ct, this.innerCt);\n    },\n\n    getLayoutTargetSize : function() {\n        var target = this.container.getLayoutTarget(), ret;\n        \n        if (target) {\n            ret = target.getViewSize();\n\n            // IE in strict mode will return a width of 0 on the 1st pass of getViewSize.\n            // Use getStyleSize to verify the 0 width, the adjustment pass will then work properly\n            // with getViewSize\n            if (Ext.isIE9m && Ext.isStrict && ret.width == 0){\n                ret =  target.getStyleSize();\n            }\n\n            ret.width  -= target.getPadding('lr');\n            ret.height -= target.getPadding('tb');\n        }\n        \n        return ret;\n    },\n\n    // private\n    renderItem : function(c) {\n        if(Ext.isString(c.margins)){\n            c.margins = this.parseMargins(c.margins);\n        }else if(!c.margins){\n            c.margins = this.defaultMargins;\n        }\n        Ext.layout.BoxLayout.superclass.renderItem.apply(this, arguments);\n    },\n    \n    /**\n     * @private\n     */\n    destroy: function() {\n        Ext.destroy(this.overflowHandler);\n        \n        Ext.layout.BoxLayout.superclass.destroy.apply(this, arguments);\n    }\n});\n\n/**\n * @class Ext.layout.boxOverflow.None\n * @extends Object\n * Base class for Box Layout overflow handlers. These specialized classes are invoked when a Box Layout\n * (either an HBox or a VBox) has child items that are either too wide (for HBox) or too tall (for VBox)\n * for its container.\n */\n\nExt.layout.boxOverflow.None = Ext.extend(Object, {\n    constructor: function(layout, config) {\n        this.layout = layout;\n        \n        Ext.apply(this, config || {});\n    },\n    \n    handleOverflow: Ext.emptyFn,\n    \n    clearOverflow: Ext.emptyFn\n});\n\n\nExt.layout.boxOverflow.none = Ext.layout.boxOverflow.None;\n/**\n * @class Ext.layout.boxOverflow.Menu\n * @extends Ext.layout.boxOverflow.None\n * Description\n */\nExt.layout.boxOverflow.Menu = Ext.extend(Ext.layout.boxOverflow.None, {\n    /**\n     * @cfg afterCls\n     * @type String\n     * CSS class added to the afterCt element. This is the element that holds any special items such as scrollers,\n     * which must always be present at the rightmost edge of the Container\n     */\n    afterCls: 'x-strip-right',\n    \n    /**\n     * @property noItemsMenuText\n     * @type String\n     * HTML fragment to render into the toolbar overflow menu if there are no items to display\n     */\n    noItemsMenuText : '<div class=\"x-toolbar-no-items\">(None)</div>',\n    \n    constructor: function(layout) {\n        Ext.layout.boxOverflow.Menu.superclass.constructor.apply(this, arguments);\n        \n        /**\n         * @property menuItems\n         * @type Array\n         * Array of all items that are currently hidden and should go into the dropdown menu\n         */\n        this.menuItems = [];\n    },\n    \n    /**\n     * @private\n     * Creates the beforeCt, innerCt and afterCt elements if they have not already been created\n     * @param {Ext.Container} container The Container attached to this Layout instance\n     * @param {Ext.Element} target The target Element\n     */\n    createInnerElements: function() {\n        if (!this.afterCt) {\n            this.afterCt  = this.layout.innerCt.insertSibling({cls: this.afterCls},  'before');\n        }\n    },\n    \n    /**\n     * @private\n     */\n    clearOverflow: function(calculations, targetSize) {\n        var newWidth = targetSize.width + (this.afterCt ? this.afterCt.getWidth() : 0),\n            items    = this.menuItems;\n        \n        this.hideTrigger();\n        \n        for (var index = 0, length = items.length; index < length; index++) {\n            items.pop().component.show();\n        }\n        \n        return {\n            targetSize: {\n                height: targetSize.height,\n                width : newWidth\n            }\n        };\n    },\n    \n    /**\n     * @private\n     */\n    showTrigger: function() {\n        this.createMenu();\n        this.menuTrigger.show();\n    },\n    \n    /**\n     * @private\n     */\n    hideTrigger: function() {\n        if (this.menuTrigger != undefined) {\n            this.menuTrigger.hide();\n        }\n    },\n    \n    /**\n     * @private\n     * Called before the overflow menu is shown. This constructs the menu's items, caching them for as long as it can.\n     */\n    beforeMenuShow: function(menu) {\n        var items = this.menuItems,\n            len   = items.length,\n            item,\n            prev;\n\n        var needsSep = function(group, item){\n            return group.isXType('buttongroup') && !(item instanceof Ext.Toolbar.Separator);\n        };\n        \n        this.clearMenu();\n        menu.removeAll();\n        \n        for (var i = 0; i < len; i++) {\n            item = items[i].component;\n            \n            if (prev && (needsSep(item, prev) || needsSep(prev, item))) {\n                menu.add('-');\n            }\n            \n            this.addComponentToMenu(menu, item);\n            prev = item;\n        }\n\n        // put something so the menu isn't empty if no compatible items found\n        if (menu.items.length < 1) {\n            menu.add(this.noItemsMenuText);\n        }\n    },\n    \n    /**\n     * @private\n     * Returns a menu config for a given component. This config is used to create a menu item\n     * to be added to the expander menu\n     * @param {Ext.Component} component The component to create the config for\n     * @param {Boolean} hideOnClick Passed through to the menu item\n     */\n    createMenuConfig : function(component, hideOnClick){\n        var config = Ext.apply({}, component.initialConfig),\n            group  = component.toggleGroup;\n\n        Ext.copyTo(config, component, [\n            'iconCls', 'icon', 'itemId', 'disabled', 'handler', 'scope', 'menu'\n        ]);\n\n        Ext.apply(config, {\n            text       : component.overflowText || component.text,\n            hideOnClick: hideOnClick\n        });\n\n        if (group || component.enableToggle) {\n            Ext.apply(config, {\n                group  : group,\n                checked: component.pressed,\n                listeners: {\n                    checkchange: function(item, checked){\n                        component.toggle(checked);\n                    }\n                }\n            });\n        }\n\n        delete config.ownerCt;\n        delete config.xtype;\n        delete config.id;\n\n        return config;\n    },\n\n    /**\n     * @private\n     * Adds the given Toolbar item to the given menu. Buttons inside a buttongroup are added individually.\n     * @param {Ext.menu.Menu} menu The menu to add to\n     * @param {Ext.Component} component The component to add\n     */\n    addComponentToMenu : function(menu, component) {\n        if (component instanceof Ext.Toolbar.Separator) {\n            menu.add('-');\n\n        } else if (Ext.isFunction(component.isXType)) {\n            if (component.isXType('splitbutton')) {\n                menu.add(this.createMenuConfig(component, true));\n\n            } else if (component.isXType('button')) {\n                menu.add(this.createMenuConfig(component, !component.menu));\n\n            } else if (component.isXType('buttongroup')) {\n                component.items.each(function(item){\n                     this.addComponentToMenu(menu, item);\n                }, this);\n            }\n        }\n    },\n    \n    /**\n     * @private\n     * Deletes the sub-menu of each item in the expander menu. Submenus are created for items such as\n     * splitbuttons and buttongroups, where the Toolbar item cannot be represented by a single menu item\n     */\n    clearMenu : function(){\n        var menu = this.moreMenu;\n        if (menu && menu.items) {\n            menu.items.each(function(item){\n                delete item.menu;\n            });\n        }\n    },\n    \n    /**\n     * @private\n     * Creates the overflow trigger and menu used when enableOverflow is set to true and the items\n     * in the layout are too wide to fit in the space available\n     */\n    createMenu: function() {\n        if (!this.menuTrigger) {\n            this.createInnerElements();\n            \n            /**\n             * @private\n             * @property menu\n             * @type Ext.menu.Menu\n             * The expand menu - holds items for every item that cannot be shown\n             * because the container is currently not large enough.\n             */\n            this.menu = new Ext.menu.Menu({\n                ownerCt : this.layout.container,\n                listeners: {\n                    scope: this,\n                    beforeshow: this.beforeMenuShow\n                }\n            });\n\n            /**\n             * @private\n             * @property menuTrigger\n             * @type Ext.Button\n             * The expand button which triggers the overflow menu to be shown\n             */\n            this.menuTrigger = new Ext.Button({\n                iconCls : 'x-toolbar-more-icon',\n                cls     : 'x-toolbar-more',\n                menu    : this.menu,\n                renderTo: this.afterCt\n            });\n        }\n    },\n    \n    /**\n     * @private\n     */\n    destroy: function() {\n        Ext.destroy(this.menu, this.menuTrigger);\n    }\n});\n\nExt.layout.boxOverflow.menu = Ext.layout.boxOverflow.Menu;\n\n\n/**\n * @class Ext.layout.boxOverflow.HorizontalMenu\n * @extends Ext.layout.boxOverflow.Menu\n * Description\n */\nExt.layout.boxOverflow.HorizontalMenu = Ext.extend(Ext.layout.boxOverflow.Menu, {\n    \n    constructor: function() {\n        Ext.layout.boxOverflow.HorizontalMenu.superclass.constructor.apply(this, arguments);\n        \n        var me = this,\n            layout = me.layout,\n            origFunction = layout.calculateChildBoxes;\n        \n        layout.calculateChildBoxes = function(visibleItems, targetSize) {\n            var calcs = origFunction.apply(layout, arguments),\n                meta  = calcs.meta,\n                items = me.menuItems;\n            \n            //calculate the width of the items currently hidden solely because there is not enough space\n            //to display them\n            var hiddenWidth = 0;\n            for (var index = 0, length = items.length; index < length; index++) {\n                hiddenWidth += items[index].width;\n            }\n            \n            meta.minimumWidth += hiddenWidth;\n            meta.tooNarrow = meta.minimumWidth > targetSize.width;\n            \n            return calcs;\n        };        \n    },\n    \n    handleOverflow: function(calculations, targetSize) {\n        this.showTrigger();\n        \n        var newWidth    = targetSize.width - this.afterCt.getWidth(),\n            boxes       = calculations.boxes,\n            usedWidth   = 0,\n            recalculate = false;\n        \n        //calculate the width of all visible items and any spare width\n        for (var index = 0, length = boxes.length; index < length; index++) {\n            usedWidth += boxes[index].width;\n        }\n        \n        var spareWidth = newWidth - usedWidth,\n            showCount  = 0;\n        \n        //see if we can re-show any of the hidden components\n        for (var index = 0, length = this.menuItems.length; index < length; index++) {\n            var hidden = this.menuItems[index],\n                comp   = hidden.component,\n                width  = hidden.width;\n            \n            if (width < spareWidth) {\n                comp.show();\n                \n                spareWidth -= width;\n                showCount ++;\n                recalculate = true;\n            } else {\n                break;\n            }\n        }\n                \n        if (recalculate) {\n            this.menuItems = this.menuItems.slice(showCount);\n        } else {\n            for (var i = boxes.length - 1; i >= 0; i--) {\n                var item  = boxes[i].component,\n                    right = boxes[i].left + boxes[i].width;\n\n                if (right >= newWidth) {\n                    this.menuItems.unshift({\n                        component: item,\n                        width    : boxes[i].width\n                    });\n\n                    item.hide();\n                } else {\n                    break;\n                }\n            }\n        }\n        \n        if (this.menuItems.length == 0) {\n            this.hideTrigger();\n        }\n        \n        return {\n            targetSize: {\n                height: targetSize.height,\n                width : newWidth\n            },\n            recalculate: recalculate\n        };\n    }\n});\n\nExt.layout.boxOverflow.menu.hbox = Ext.layout.boxOverflow.HorizontalMenu;/**\n * @class Ext.layout.boxOverflow.Scroller\n * @extends Ext.layout.boxOverflow.None\n * Description\n */\nExt.layout.boxOverflow.Scroller = Ext.extend(Ext.layout.boxOverflow.None, {\n    /**\n     * @cfg animateScroll\n     * @type Boolean\n     * True to animate the scrolling of items within the layout (defaults to true, ignored if enableScroll is false)\n     */\n    animateScroll: true,\n    \n    /**\n     * @cfg scrollIncrement\n     * @type Number\n     * The number of pixels to scroll by on scroller click (defaults to 100)\n     */\n    scrollIncrement: 100,\n    \n    /**\n     * @cfg wheelIncrement\n     * @type Number\n     * The number of pixels to increment on mouse wheel scrolling (defaults to <tt>3</tt>).\n     */\n    wheelIncrement: 3,\n    \n    /**\n     * @cfg scrollRepeatInterval\n     * @type Number\n     * Number of milliseconds between each scroll while a scroller button is held down (defaults to 400)\n     */\n    scrollRepeatInterval: 400,\n    \n    /**\n     * @cfg scrollDuration\n     * @type Number\n     * Number of seconds that each scroll animation lasts (defaults to 0.4)\n     */\n    scrollDuration: 0.4,\n    \n    /**\n     * @cfg beforeCls\n     * @type String\n     * CSS class added to the beforeCt element. This is the element that holds any special items such as scrollers,\n     * which must always be present at the leftmost edge of the Container\n     */\n    beforeCls: 'x-strip-left',\n    \n    /**\n     * @cfg afterCls\n     * @type String\n     * CSS class added to the afterCt element. This is the element that holds any special items such as scrollers,\n     * which must always be present at the rightmost edge of the Container\n     */\n    afterCls: 'x-strip-right',\n    \n    /**\n     * @cfg scrollerCls\n     * @type String\n     * CSS class added to both scroller elements if enableScroll is used\n     */\n    scrollerCls: 'x-strip-scroller',\n    \n    /**\n     * @cfg beforeScrollerCls\n     * @type String\n     * CSS class added to the left scroller element if enableScroll is used\n     */\n    beforeScrollerCls: 'x-strip-scroller-left',\n    \n    /**\n     * @cfg afterScrollerCls\n     * @type String\n     * CSS class added to the right scroller element if enableScroll is used\n     */\n    afterScrollerCls: 'x-strip-scroller-right',\n    \n    /**\n     * @private\n     * Sets up an listener to scroll on the layout's innerCt mousewheel event\n     */\n    createWheelListener: function() {\n        this.layout.innerCt.on({\n            scope     : this,\n            mousewheel: function(e) {\n                e.stopEvent();\n\n                this.scrollBy(e.getWheelDelta() * this.wheelIncrement * -1, false);\n            }\n        });\n    },\n    \n    /**\n     * @private\n     * Most of the heavy lifting is done in the subclasses\n     */\n    handleOverflow: function(calculations, targetSize) {\n        this.createInnerElements();\n        this.showScrollers();\n    },\n    \n    /**\n     * @private\n     */\n    clearOverflow: function() {\n        this.hideScrollers();\n    },\n    \n    /**\n     * @private\n     * Shows the scroller elements in the beforeCt and afterCt. Creates the scrollers first if they are not already\n     * present. \n     */\n    showScrollers: function() {\n        this.createScrollers();\n        \n        this.beforeScroller.show();\n        this.afterScroller.show();\n        \n        this.updateScrollButtons();\n    },\n    \n    /**\n     * @private\n     * Hides the scroller elements in the beforeCt and afterCt\n     */\n    hideScrollers: function() {\n        if (this.beforeScroller != undefined) {\n            this.beforeScroller.hide();\n            this.afterScroller.hide();          \n        }\n    },\n    \n    /**\n     * @private\n     * Creates the clickable scroller elements and places them into the beforeCt and afterCt\n     */\n    createScrollers: function() {\n        if (!this.beforeScroller && !this.afterScroller) {\n            var before = this.beforeCt.createChild({\n                cls: String.format(\"{0} {1} \", this.scrollerCls, this.beforeScrollerCls)\n            });\n            \n            var after = this.afterCt.createChild({\n                cls: String.format(\"{0} {1}\", this.scrollerCls, this.afterScrollerCls)\n            });\n            \n            before.addClassOnOver(this.beforeScrollerCls + '-hover');\n            after.addClassOnOver(this.afterScrollerCls + '-hover');\n            \n            before.setVisibilityMode(Ext.Element.DISPLAY);\n            after.setVisibilityMode(Ext.Element.DISPLAY);\n            \n            this.beforeRepeater = new Ext.util.ClickRepeater(before, {\n                interval: this.scrollRepeatInterval,\n                handler : this.scrollLeft,\n                scope   : this\n            });\n            \n            this.afterRepeater = new Ext.util.ClickRepeater(after, {\n                interval: this.scrollRepeatInterval,\n                handler : this.scrollRight,\n                scope   : this\n            });\n            \n            /**\n             * @property beforeScroller\n             * @type Ext.Element\n             * The left scroller element. Only created when needed.\n             */\n            this.beforeScroller = before;\n            \n            /**\n             * @property afterScroller\n             * @type Ext.Element\n             * The left scroller element. Only created when needed.\n             */\n            this.afterScroller = after;\n        }\n    },\n    \n    /**\n     * @private\n     */\n    destroy: function() {\n        Ext.destroy(this.beforeScroller, this.afterScroller, this.beforeRepeater, this.afterRepeater, this.beforeCt, this.afterCt);\n    },\n    \n    /**\n     * @private\n     * Scrolls left or right by the number of pixels specified\n     * @param {Number} delta Number of pixels to scroll to the right by. Use a negative number to scroll left\n     */\n    scrollBy: function(delta, animate) {\n        this.scrollTo(this.getScrollPosition() + delta, animate);\n    },\n    \n    /**\n     * @private\n     * Normalizes an item reference, string id or numerical index into a reference to the item\n     * @param {Ext.Component|String|Number} item The item reference, id or index\n     * @return {Ext.Component} The item\n     */\n    getItem: function(item) {\n        if (Ext.isString(item)) {\n            item = Ext.getCmp(item);\n        } else if (Ext.isNumber(item)) {\n            item = this.items[item];\n        }\n        \n        return item;\n    },\n    \n    /**\n     * @private\n     * @return {Object} Object passed to scrollTo when scrolling\n     */\n    getScrollAnim: function() {\n        return {\n            duration: this.scrollDuration, \n            callback: this.updateScrollButtons, \n            scope   : this\n        };\n    },\n    \n    /**\n     * @private\n     * Enables or disables each scroller button based on the current scroll position\n     */\n    updateScrollButtons: function() {\n        if (this.beforeScroller == undefined || this.afterScroller == undefined) {\n            return;\n        }\n        \n        var beforeMeth = this.atExtremeBefore()  ? 'addClass' : 'removeClass',\n            afterMeth  = this.atExtremeAfter() ? 'addClass' : 'removeClass',\n            beforeCls  = this.beforeScrollerCls + '-disabled',\n            afterCls   = this.afterScrollerCls  + '-disabled';\n        \n        this.beforeScroller[beforeMeth](beforeCls);\n        this.afterScroller[afterMeth](afterCls);\n        this.scrolling = false;\n    },\n    \n    /**\n     * @private\n     * Returns true if the innerCt scroll is already at its left-most point\n     * @return {Boolean} True if already at furthest left point\n     */\n    atExtremeBefore: function() {\n        return this.getScrollPosition() === 0;\n    },\n    \n    /**\n     * @private\n     * Scrolls to the left by the configured amount\n     */\n    scrollLeft: function(animate) {\n        this.scrollBy(-this.scrollIncrement, animate);\n    },\n    \n    /**\n     * @private\n     * Scrolls to the right by the configured amount\n     */\n    scrollRight: function(animate) {\n        this.scrollBy(this.scrollIncrement, animate);\n    },\n    \n    /**\n     * Scrolls to the given component.\n     * @param {String|Number|Ext.Component} item The item to scroll to. Can be a numerical index, component id \n     * or a reference to the component itself.\n     * @param {Boolean} animate True to animate the scrolling\n     */\n    scrollToItem: function(item, animate) {\n        item = this.getItem(item);\n        \n        if (item != undefined) {\n            var visibility = this.getItemVisibility(item);\n            \n            if (!visibility.fullyVisible) {\n                var box  = item.getBox(true, true),\n                    newX = box.x;\n                    \n                if (visibility.hiddenRight) {\n                    newX -= (this.layout.innerCt.getWidth() - box.width);\n                }\n                \n                this.scrollTo(newX, animate);\n            }\n        }\n    },\n    \n    /**\n     * @private\n     * For a given item in the container, return an object with information on whether the item is visible\n     * with the current innerCt scroll value.\n     * @param {Ext.Component} item The item\n     * @return {Object} Values for fullyVisible, hiddenLeft and hiddenRight\n     */\n    getItemVisibility: function(item) {\n        var box         = this.getItem(item).getBox(true, true),\n            itemLeft    = box.x,\n            itemRight   = box.x + box.width,\n            scrollLeft  = this.getScrollPosition(),\n            scrollRight = this.layout.innerCt.getWidth() + scrollLeft;\n        \n        return {\n            hiddenLeft  : itemLeft < scrollLeft,\n            hiddenRight : itemRight > scrollRight,\n            fullyVisible: itemLeft > scrollLeft && itemRight < scrollRight\n        };\n    }\n});\n\nExt.layout.boxOverflow.scroller = Ext.layout.boxOverflow.Scroller;\n\n\n/**\n * @class Ext.layout.boxOverflow.VerticalScroller\n * @extends Ext.layout.boxOverflow.Scroller\n * Description\n */\nExt.layout.boxOverflow.VerticalScroller = Ext.extend(Ext.layout.boxOverflow.Scroller, {\n    scrollIncrement: 75,\n    wheelIncrement : 2,\n    \n    handleOverflow: function(calculations, targetSize) {\n        Ext.layout.boxOverflow.VerticalScroller.superclass.handleOverflow.apply(this, arguments);\n        \n        return {\n            targetSize: {\n                height: targetSize.height - (this.beforeCt.getHeight() + this.afterCt.getHeight()),\n                width : targetSize.width\n            }\n        };\n    },\n    \n    /**\n     * @private\n     * Creates the beforeCt and afterCt elements if they have not already been created\n     */\n    createInnerElements: function() {\n        var target = this.layout.innerCt;\n        \n        //normal items will be rendered to the innerCt. beforeCt and afterCt allow for fixed positioning of\n        //special items such as scrollers or dropdown menu triggers\n        if (!this.beforeCt) {\n            this.beforeCt = target.insertSibling({cls: this.beforeCls}, 'before');\n            this.afterCt  = target.insertSibling({cls: this.afterCls},  'after');\n\n            this.createWheelListener();\n        }\n    },\n    \n    /**\n     * @private\n     * Scrolls to the given position. Performs bounds checking.\n     * @param {Number} position The position to scroll to. This is constrained.\n     * @param {Boolean} animate True to animate. If undefined, falls back to value of this.animateScroll\n     */\n    scrollTo: function(position, animate) {\n        var oldPosition = this.getScrollPosition(),\n            newPosition = position.constrain(0, this.getMaxScrollBottom());\n        \n        if (newPosition != oldPosition && !this.scrolling) {\n            if (animate == undefined) {\n                animate = this.animateScroll;\n            }\n            \n            this.layout.innerCt.scrollTo('top', newPosition, animate ? this.getScrollAnim() : false);\n            \n            if (animate) {\n                this.scrolling = true;\n            } else {\n                this.scrolling = false;\n                this.updateScrollButtons();\n            }\n        }\n    },\n    \n    /**\n     * Returns the current scroll position of the innerCt element\n     * @return {Number} The current scroll position\n     */\n    getScrollPosition: function(){\n        return parseInt(this.layout.innerCt.dom.scrollTop, 10) || 0;\n    },\n    \n    /**\n     * @private\n     * Returns the maximum value we can scrollTo\n     * @return {Number} The max scroll value\n     */\n    getMaxScrollBottom: function() {\n        return this.layout.innerCt.dom.scrollHeight - this.layout.innerCt.getHeight();\n    },\n    \n    /**\n     * @private\n     * Returns true if the innerCt scroll is already at its right-most point\n     * @return {Boolean} True if already at furthest right point\n     */\n    atExtremeAfter: function() {\n        return this.getScrollPosition() >= this.getMaxScrollBottom();\n    }\n});\n\nExt.layout.boxOverflow.scroller.vbox = Ext.layout.boxOverflow.VerticalScroller;\n\n\n/**\n * @class Ext.layout.boxOverflow.HorizontalScroller\n * @extends Ext.layout.boxOverflow.Scroller\n * Description\n */\nExt.layout.boxOverflow.HorizontalScroller = Ext.extend(Ext.layout.boxOverflow.Scroller, {\n    handleOverflow: function(calculations, targetSize) {\n        Ext.layout.boxOverflow.HorizontalScroller.superclass.handleOverflow.apply(this, arguments);\n        \n        return {\n            targetSize: {\n                height: targetSize.height,\n                width : targetSize.width - (this.beforeCt.getWidth() + this.afterCt.getWidth())\n            }\n        };\n    },\n    \n    /**\n     * @private\n     * Creates the beforeCt and afterCt elements if they have not already been created\n     */\n    createInnerElements: function() {\n        var target = this.layout.innerCt;\n        \n        //normal items will be rendered to the innerCt. beforeCt and afterCt allow for fixed positioning of\n        //special items such as scrollers or dropdown menu triggers\n        if (!this.beforeCt) {\n            this.afterCt  = target.insertSibling({cls: this.afterCls},  'before');\n            this.beforeCt = target.insertSibling({cls: this.beforeCls}, 'before');\n            \n            this.createWheelListener();\n        }\n    },\n    \n    /**\n     * @private\n     * Scrolls to the given position. Performs bounds checking.\n     * @param {Number} position The position to scroll to. This is constrained.\n     * @param {Boolean} animate True to animate. If undefined, falls back to value of this.animateScroll\n     */\n    scrollTo: function(position, animate) {\n        var oldPosition = this.getScrollPosition(),\n            newPosition = position.constrain(0, this.getMaxScrollRight());\n        \n        if (newPosition != oldPosition && !this.scrolling) {\n            if (animate == undefined) {\n                animate = this.animateScroll;\n            }\n            \n            this.layout.innerCt.scrollTo('left', newPosition, animate ? this.getScrollAnim() : false);\n            \n            if (animate) {\n                this.scrolling = true;\n            } else {\n                this.scrolling = false;\n                this.updateScrollButtons();\n            }\n        }\n    },\n    \n    /**\n     * Returns the current scroll position of the innerCt element\n     * @return {Number} The current scroll position\n     */\n    getScrollPosition: function(){\n        return parseInt(this.layout.innerCt.dom.scrollLeft, 10) || 0;\n    },\n    \n    /**\n     * @private\n     * Returns the maximum value we can scrollTo\n     * @return {Number} The max scroll value\n     */\n    getMaxScrollRight: function() {\n        return this.layout.innerCt.dom.scrollWidth - this.layout.innerCt.getWidth();\n    },\n    \n    /**\n     * @private\n     * Returns true if the innerCt scroll is already at its right-most point\n     * @return {Boolean} True if already at furthest right point\n     */\n    atExtremeAfter: function() {\n        return this.getScrollPosition() >= this.getMaxScrollRight();\n    }\n});\n\nExt.layout.boxOverflow.scroller.hbox = Ext.layout.boxOverflow.HorizontalScroller;/**\n * @class Ext.layout.HBoxLayout\n * @extends Ext.layout.BoxLayout\n * <p>A layout that arranges items horizontally across a Container. This layout optionally divides available horizontal\n * space between child items containing a numeric <code>flex</code> configuration.</p>\n * This layout may also be used to set the heights of child items by configuring it with the {@link #align} option.\n */\nExt.layout.HBoxLayout = Ext.extend(Ext.layout.BoxLayout, {\n    /**\n     * @cfg {String} align\n     * Controls how the child items of the container are aligned. Acceptable configuration values for this\n     * property are:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b><tt>top</tt></b> : <b>Default</b><div class=\"sub-desc\">child items are aligned vertically\n     * at the <b>top</b> of the container</div></li>\n     * <li><b><tt>middle</tt></b> : <div class=\"sub-desc\">child items are aligned vertically in the\n     * <b>middle</b> of the container</div></li>\n     * <li><b><tt>stretch</tt></b> : <div class=\"sub-desc\">child items are stretched vertically to fill\n     * the height of the container</div></li>\n     * <li><b><tt>stretchmax</tt></b> : <div class=\"sub-desc\">child items are stretched vertically to\n     * the height of the largest item.</div></li>\n     * </ul></div>\n     */\n    align: 'top', // top, middle, stretch, strechmax\n\n    type : 'hbox',\n\n    /**\n     * @cfg {String} pack\n     * Controls how the child items of the container are packed together. Acceptable configuration values\n     * for this property are:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b><tt>start</tt></b> : <b>Default</b><div class=\"sub-desc\">child items are packed together at\n     * <b>left</b> side of container</div></li>\n     * <li><b><tt>center</tt></b> : <div class=\"sub-desc\">child items are packed together at\n     * <b>mid-width</b> of container</div></li>\n     * <li><b><tt>end</tt></b> : <div class=\"sub-desc\">child items are packed together at <b>right</b>\n     * side of container</div></li>\n     * </ul></div>\n     */\n    /**\n     * @cfg {Number} flex\n     * This configuation option is to be applied to <b>child <tt>items</tt></b> of the container managed\n     * by this layout. Each child item with a <tt>flex</tt> property will be flexed <b>horizontally</b>\n     * according to each item's <b>relative</b> <tt>flex</tt> value compared to the sum of all items with\n     * a <tt>flex</tt> value specified.  Any child items that have either a <tt>flex = 0</tt> or\n     * <tt>flex = undefined</tt> will not be 'flexed' (the initial size will not be changed).\n     */\n\n    /**\n     * @private\n     * Calculates the size and positioning of each item in the HBox. This iterates over all of the rendered,\n     * visible items and returns a height, width, top and left for each, as well as a reference to each. Also\n     * returns meta data such as maxHeight which are useful when resizing layout wrappers such as this.innerCt.\n     * @param {Array} visibleItems The array of all rendered, visible items to be calculated for\n     * @param {Object} targetSize Object containing target size and height\n     * @return {Object} Object containing box measurements for each child, plus meta data\n     */\n    calculateChildBoxes: function(visibleItems, targetSize) {\n        var visibleCount = visibleItems.length,\n\n            padding      = this.padding,\n            topOffset    = padding.top,\n            leftOffset   = padding.left,\n            paddingVert  = topOffset  + padding.bottom,\n            paddingHoriz = leftOffset + padding.right,\n\n            width        = targetSize.width - this.scrollOffset,\n            height       = targetSize.height,\n            availHeight  = Math.max(0, height - paddingVert),\n\n            isStart      = this.pack == 'start',\n            isCenter     = this.pack == 'center',\n            isEnd        = this.pack == 'end',\n\n            nonFlexWidth = 0,\n            maxHeight    = 0,\n            totalFlex    = 0,\n            desiredWidth = 0,\n            minimumWidth = 0,\n\n            //used to cache the calculated size and position values for each child item\n            boxes        = [],\n\n            //used in the for loops below, just declared here for brevity\n            child, childWidth, childHeight, childSize, childMargins, canLayout, i, calcs, flexedWidth,\n            horizMargins, vertMargins, stretchHeight;\n\n        //gather the total flex of all flexed items and the width taken up by fixed width items\n        for (i = 0; i < visibleCount; i++) {\n            child       = visibleItems[i];\n            childHeight = child.height;\n            childWidth  = child.width;\n            canLayout   = !child.hasLayout && typeof child.doLayout == 'function';\n\n            // Static width (numeric) requires no calcs\n            if (typeof childWidth != 'number') {\n\n                // flex and not 'auto' width\n                if (child.flex && !childWidth) {\n                    totalFlex += child.flex;\n\n                // Not flexed or 'auto' width or undefined width\n                } else {\n                    //Render and layout sub-containers without a flex or width defined, as otherwise we\n                    //don't know how wide the sub-container should be and cannot calculate flexed widths\n                    if (!childWidth && canLayout) {\n                        child.doLayout();\n                    }\n\n                    childSize   = child.getSize();\n                    childWidth  = childSize.width;\n                    childHeight = childSize.height;\n                }\n            }\n\n            childMargins = child.margins;\n            horizMargins = childMargins.left + childMargins.right;\n\n            nonFlexWidth += horizMargins + (childWidth || 0);\n            desiredWidth += horizMargins + (child.flex ? child.minWidth || 0 : childWidth);\n            minimumWidth += horizMargins + (child.minWidth || childWidth || 0);\n\n            // Max height for align - force layout of non-laid out subcontainers without a numeric height\n            if (typeof childHeight != 'number') {\n                if (canLayout) {\n                    child.doLayout();\n                }\n                childHeight = child.getHeight();\n            }\n\n            maxHeight = Math.max(maxHeight, childHeight + childMargins.top + childMargins.bottom);\n\n            //cache the size of each child component. Don't set height or width to 0, keep undefined instead\n            boxes.push({\n                component: child,\n                height   : childHeight || undefined,\n                width    : childWidth  || undefined\n            });\n        }\n\n        var shortfall = desiredWidth - width,\n            tooNarrow = minimumWidth > width;\n\n        //the width available to the flexed items\n        var availableWidth = Math.max(0, width - nonFlexWidth - paddingHoriz);\n\n        if (tooNarrow) {\n            for (i = 0; i < visibleCount; i++) {\n                boxes[i].width = visibleItems[i].minWidth || visibleItems[i].width || boxes[i].width;\n            }\n        } else {\n            //all flexed items should be sized to their minimum width, other items should be shrunk down until\n            //the shortfall has been accounted for\n            if (shortfall > 0) {\n                var minWidths = [];\n\n                // When we have a shortfall but are not tooNarrow, we need to shrink the width of each non-flexed item.\n                // Flexed items are immediately reduced to their minWidth and anything already at minWidth is ignored.\n                // The remaining items are collected into the minWidths array, which is later used to distribute the shortfall.\n                for (var index = 0, length = visibleCount; index < length; index++) {\n                    var item     = visibleItems[index],\n                        minWidth = item.minWidth || 0;\n\n                    //shrink each non-flex tab by an equal amount to make them all fit. Flexed items are all\n                    //shrunk to their minWidth because they're flexible and should be the first to lose width\n                    if (item.flex) {\n                        boxes[index].width = minWidth;\n                    } else {\n                        minWidths.push({\n                            minWidth : minWidth,\n                            available: boxes[index].width - minWidth,\n                            index    : index\n                        });\n                    }\n                }\n\n                //sort by descending amount of width remaining before minWidth is reached\n                minWidths.sort(function(a, b) {\n                    return a.available > b.available ? 1 : -1;\n                });\n\n                /*\n                 * Distribute the shortfall (difference between total desired with of all items and actual width available)\n                 * between the non-flexed items. We try to distribute the shortfall evenly, but apply it to items with the\n                 * smallest difference between their width and minWidth first, so that if reducing the width by the average\n                 * amount would make that item less than its minWidth, we carry the remainder over to the next item.\n                 */\n                for (var i = 0, length = minWidths.length; i < length; i++) {\n                    var itemIndex = minWidths[i].index;\n\n                    if (itemIndex == undefined) {\n                        continue;\n                    }\n\n                    var item      = visibleItems[itemIndex],\n                        box       = boxes[itemIndex],\n                        oldWidth  = box.width,\n                        minWidth  = item.minWidth,\n                        newWidth  = Math.max(minWidth, oldWidth - Math.ceil(shortfall / (length - i))),\n                        reduction = oldWidth - newWidth;\n\n                    boxes[itemIndex].width = newWidth;\n                    shortfall -= reduction;\n                }\n            } else {\n                //temporary variables used in the flex width calculations below\n                var remainingWidth = availableWidth,\n                    remainingFlex  = totalFlex;\n\n                //calculate the widths of each flexed item\n                for (i = 0; i < visibleCount; i++) {\n                    child = visibleItems[i];\n                    calcs = boxes[i];\n\n                    childMargins = child.margins;\n                    vertMargins  = childMargins.top + childMargins.bottom;\n\n                    if (isStart && child.flex && !child.width) {\n                        flexedWidth     = Math.ceil((child.flex / remainingFlex) * remainingWidth);\n                        remainingWidth -= flexedWidth;\n                        remainingFlex  -= child.flex;\n\n                        calcs.width = flexedWidth;\n                        calcs.dirtySize = true;\n                    }\n                }\n            }\n        }\n\n        if (isCenter) {\n            leftOffset += availableWidth / 2;\n        } else if (isEnd) {\n            leftOffset += availableWidth;\n        }\n\n        //finally, calculate the left and top position of each item\n        for (i = 0; i < visibleCount; i++) {\n            child = visibleItems[i];\n            calcs = boxes[i];\n\n            childMargins = child.margins;\n            leftOffset  += childMargins.left;\n            vertMargins  = childMargins.top + childMargins.bottom;\n\n            calcs.left = leftOffset;\n            calcs.top  = topOffset + childMargins.top;\n\n            switch (this.align) {\n                case 'stretch':\n                    stretchHeight = availHeight - vertMargins;\n                    calcs.height  = stretchHeight.constrain(child.minHeight || 0, child.maxHeight || 1000000);\n                    calcs.dirtySize = true;\n                    break;\n                case 'stretchmax':\n                    stretchHeight = maxHeight - vertMargins;\n                    calcs.height  = stretchHeight.constrain(child.minHeight || 0, child.maxHeight || 1000000);\n                    calcs.dirtySize = true;\n                    break;\n                case 'middle':\n                    var diff = availHeight - calcs.height - vertMargins;\n                    if (diff > 0) {\n                        calcs.top = topOffset + vertMargins + (diff / 2);\n                    }\n            }\n\n            leftOffset += calcs.width + childMargins.right;\n        }\n\n        return {\n            boxes: boxes,\n            meta : {\n                maxHeight   : maxHeight,\n                nonFlexWidth: nonFlexWidth,\n                desiredWidth: desiredWidth,\n                minimumWidth: minimumWidth,\n                shortfall   : desiredWidth - width,\n                tooNarrow   : tooNarrow\n            }\n        };\n    }\n});\n\nExt.Container.LAYOUTS.hbox = Ext.layout.HBoxLayout;/**\n * @class Ext.layout.VBoxLayout\n * @extends Ext.layout.BoxLayout\n * <p>A layout that arranges items vertically down a Container. This layout optionally divides available vertical\n * space between child items containing a numeric <code>flex</code> configuration.</p>\n * This layout may also be used to set the widths of child items by configuring it with the {@link #align} option.\n */\nExt.layout.VBoxLayout = Ext.extend(Ext.layout.BoxLayout, {\n    /**\n     * @cfg {String} align\n     * Controls how the child items of the container are aligned. Acceptable configuration values for this\n     * property are:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b><tt>left</tt></b> : <b>Default</b><div class=\"sub-desc\">child items are aligned horizontally\n     * at the <b>left</b> side of the container</div></li>\n     * <li><b><tt>center</tt></b> : <div class=\"sub-desc\">child items are aligned horizontally at the\n     * <b>mid-width</b> of the container</div></li>\n     * <li><b><tt>stretch</tt></b> : <div class=\"sub-desc\">child items are stretched horizontally to fill\n     * the width of the container</div></li>\n     * <li><b><tt>stretchmax</tt></b> : <div class=\"sub-desc\">child items are stretched horizontally to\n     * the size of the largest item.</div></li>\n     * </ul></div>\n     */\n    align : 'left', // left, center, stretch, strechmax\n    type: 'vbox',\n\n    /**\n     * @cfg {String} pack\n     * Controls how the child items of the container are packed together. Acceptable configuration values\n     * for this property are:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b><tt>start</tt></b> : <b>Default</b><div class=\"sub-desc\">child items are packed together at\n     * <b>top</b> side of container</div></li>\n     * <li><b><tt>center</tt></b> : <div class=\"sub-desc\">child items are packed together at\n     * <b>mid-height</b> of container</div></li>\n     * <li><b><tt>end</tt></b> : <div class=\"sub-desc\">child items are packed together at <b>bottom</b>\n     * side of container</div></li>\n     * </ul></div>\n     */\n\n    /**\n     * @cfg {Number} flex\n     * This configuation option is to be applied to <b>child <tt>items</tt></b> of the container managed\n     * by this layout. Each child item with a <tt>flex</tt> property will be flexed <b>vertically</b>\n     * according to each item's <b>relative</b> <tt>flex</tt> value compared to the sum of all items with\n     * a <tt>flex</tt> value specified.  Any child items that have either a <tt>flex = 0</tt> or\n     * <tt>flex = undefined</tt> will not be 'flexed' (the initial size will not be changed).\n     */\n\n    /**\n     * @private\n     * Calculates the size and positioning of each item in the VBox. This iterates over all of the rendered,\n     * visible items and returns a height, width, top and left for each, as well as a reference to each. Also\n     * returns meta data such as maxHeight which are useful when resizing layout wrappers such as this.innerCt.\n     * @param {Array} visibleItems The array of all rendered, visible items to be calculated for\n     * @param {Object} targetSize Object containing target size and height\n     * @return {Object} Object containing box measurements for each child, plus meta data\n     */\n    calculateChildBoxes: function(visibleItems, targetSize) {\n        var visibleCount = visibleItems.length,\n\n            padding      = this.padding,\n            topOffset    = padding.top,\n            leftOffset   = padding.left,\n            paddingVert  = topOffset  + padding.bottom,\n            paddingHoriz = leftOffset + padding.right,\n\n            width        = targetSize.width - this.scrollOffset,\n            height       = targetSize.height,\n            availWidth   = Math.max(0, width - paddingHoriz),\n\n            isStart      = this.pack == 'start',\n            isCenter     = this.pack == 'center',\n            isEnd        = this.pack == 'end',\n\n            nonFlexHeight= 0,\n            maxWidth     = 0,\n            totalFlex    = 0,\n            desiredHeight= 0,\n            minimumHeight= 0,\n\n            //used to cache the calculated size and position values for each child item\n            boxes        = [],\n\n            //used in the for loops below, just declared here for brevity\n            child, childWidth, childHeight, childSize, childMargins, canLayout, i, calcs, flexedHeight,\n            horizMargins, vertMargins, stretchWidth, length;\n\n        //gather the total flex of all flexed items and the width taken up by fixed width items\n        for (i = 0; i < visibleCount; i++) {\n            child = visibleItems[i];\n            childHeight = child.height;\n            childWidth  = child.width;\n            canLayout   = !child.hasLayout && typeof child.doLayout == 'function';\n\n            // Static height (numeric) requires no calcs\n            if (typeof childHeight != 'number') {\n\n                // flex and not 'auto' height\n                if (child.flex && !childHeight) {\n                    totalFlex += child.flex;\n\n                // Not flexed or 'auto' height or undefined height\n                } else {\n                    //Render and layout sub-containers without a flex or width defined, as otherwise we\n                    //don't know how wide the sub-container should be and cannot calculate flexed widths\n                    if (!childHeight && canLayout) {\n                        child.doLayout();\n                    }\n\n                    childSize = child.getSize();\n                    childWidth = childSize.width;\n                    childHeight = childSize.height;\n                }\n            }\n\n            childMargins = child.margins;\n            vertMargins  = childMargins.top + childMargins.bottom;\n\n            nonFlexHeight += vertMargins + (childHeight || 0);\n            desiredHeight += vertMargins + (child.flex ? child.minHeight || 0 : childHeight);\n            minimumHeight += vertMargins + (child.minHeight || childHeight || 0);\n\n            // Max width for align - force layout of non-layed out subcontainers without a numeric width\n            if (typeof childWidth != 'number') {\n                if (canLayout) {\n                    child.doLayout();\n                }\n                childWidth = child.getWidth();\n            }\n\n            maxWidth = Math.max(maxWidth, childWidth + childMargins.left + childMargins.right);\n\n            //cache the size of each child component\n            boxes.push({\n                component: child,\n                height   : childHeight || undefined,\n                width    : childWidth || undefined\n            });\n        }\n\n        var shortfall = desiredHeight - height,\n            tooNarrow = minimumHeight > height;\n\n        //the height available to the flexed items\n        var availableHeight = Math.max(0, (height - nonFlexHeight - paddingVert));\n\n        if (tooNarrow) {\n            for (i = 0, length = visibleCount; i < length; i++) {\n                boxes[i].height = visibleItems[i].minHeight || visibleItems[i].height || boxes[i].height;\n            }\n        } else {\n            //all flexed items should be sized to their minimum width, other items should be shrunk down until\n            //the shortfall has been accounted for\n            if (shortfall > 0) {\n                var minHeights = [];\n\n                // When we have a shortfall but are not tooNarrow, we need to shrink the height of each non-flexed item.\n                // Flexed items are immediately reduced to their minHeight and anything already at minHeight is ignored.\n                // The remaining items are collected into the minHeights array, which is later used to distribute the shortfall.\n                for (var index = 0, length = visibleCount; index < length; index++) {\n                    var item      = visibleItems[index],\n                        minHeight = item.minHeight || 0;\n\n                    //shrink each non-flex tab by an equal amount to make them all fit. Flexed items are all\n                    //shrunk to their minHeight because they're flexible and should be the first to lose height\n                    if (item.flex) {\n                        boxes[index].height = minHeight;\n                    } else {\n                        minHeights.push({\n                            minHeight: minHeight,\n                            available: boxes[index].height - minHeight,\n                            index    : index\n                        });\n                    }\n                }\n\n                //sort by descending minHeight value\n                minHeights.sort(function(a, b) {\n                    return a.available > b.available ? 1 : -1;\n                });\n\n                /*\n                 * Distribute the shortfall (difference between total desired with of all items and actual height available)\n                 * between the non-flexed items. We try to distribute the shortfall evenly, but apply it to items with the\n                 * smallest difference between their height and minHeight first, so that if reducing the height by the average\n                 * amount would make that item less than its minHeight, we carry the remainder over to the next item.\n                 */\n                for (var i = 0, length = minHeights.length; i < length; i++) {\n                    var itemIndex = minHeights[i].index;\n\n                    if (itemIndex == undefined) {\n                        continue;\n                    }\n\n                    var item      = visibleItems[itemIndex],\n                        box       = boxes[itemIndex],\n                        oldHeight  = box.height,\n                        minHeight  = item.minHeight,\n                        newHeight  = Math.max(minHeight, oldHeight - Math.ceil(shortfall / (length - i))),\n                        reduction = oldHeight - newHeight;\n\n                    boxes[itemIndex].height = newHeight;\n                    shortfall -= reduction;\n                }\n            } else {\n                //temporary variables used in the flex height calculations below\n                var remainingHeight = availableHeight,\n                    remainingFlex   = totalFlex;\n\n                //calculate the height of each flexed item\n                for (i = 0; i < visibleCount; i++) {\n                    child = visibleItems[i];\n                    calcs = boxes[i];\n\n                    childMargins = child.margins;\n                    horizMargins = childMargins.left + childMargins.right;\n\n                    if (isStart && child.flex && !child.height) {\n                        flexedHeight     = Math.ceil((child.flex / remainingFlex) * remainingHeight);\n                        remainingHeight -= flexedHeight;\n                        remainingFlex   -= child.flex;\n\n                        calcs.height = flexedHeight;\n                        calcs.dirtySize = true;\n                    }\n                }\n            }\n        }\n\n        if (isCenter) {\n            topOffset += availableHeight / 2;\n        } else if (isEnd) {\n            topOffset += availableHeight;\n        }\n\n        //finally, calculate the left and top position of each item\n        for (i = 0; i < visibleCount; i++) {\n            child = visibleItems[i];\n            calcs = boxes[i];\n\n            childMargins = child.margins;\n            topOffset   += childMargins.top;\n            horizMargins = childMargins.left + childMargins.right;\n\n\n            calcs.left = leftOffset + childMargins.left;\n            calcs.top  = topOffset;\n\n            switch (this.align) {\n                case 'stretch':\n                    stretchWidth = availWidth - horizMargins;\n                    calcs.width  = stretchWidth.constrain(child.minWidth || 0, child.maxWidth || 1000000);\n                    calcs.dirtySize = true;\n                    break;\n                case 'stretchmax':\n                    stretchWidth = maxWidth - horizMargins;\n                    calcs.width  = stretchWidth.constrain(child.minWidth || 0, child.maxWidth || 1000000);\n                    calcs.dirtySize = true;\n                    break;\n                case 'center':\n                    var diff = availWidth - calcs.width - horizMargins;\n                    if (diff > 0) {\n                        calcs.left = leftOffset + horizMargins + (diff / 2);\n                    }\n            }\n\n            topOffset += calcs.height + childMargins.bottom;\n        }\n\n        return {\n            boxes: boxes,\n            meta : {\n                maxWidth     : maxWidth,\n                nonFlexHeight: nonFlexHeight,\n                desiredHeight: desiredHeight,\n                minimumHeight: minimumHeight,\n                shortfall    : desiredHeight - height,\n                tooNarrow    : tooNarrow\n            }\n        };\n    }\n});\n\nExt.Container.LAYOUTS.vbox = Ext.layout.VBoxLayout;\n/**\n * @class Ext.layout.ToolbarLayout\n * @extends Ext.layout.ContainerLayout\n * Layout manager used by Ext.Toolbar. This is highly specialised for use by Toolbars and would not\n * usually be used by any other class.\n */\nExt.layout.ToolbarLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    monitorResize : true,\n\n    type: 'toolbar',\n\n    /**\n     * @property triggerWidth\n     * @type Number\n     * The width allocated for the menu trigger at the extreme right end of the Toolbar\n     */\n    triggerWidth: 18,\n\n    /**\n     * @property noItemsMenuText\n     * @type String\n     * HTML fragment to render into the toolbar overflow menu if there are no items to display\n     */\n    noItemsMenuText : '<div class=\"x-toolbar-no-items\">(None)</div>',\n\n    /**\n     * @private\n     * @property lastOverflow\n     * @type Boolean\n     * Used internally to record whether the last layout caused an overflow or not\n     */\n    lastOverflow: false,\n\n    /**\n     * @private\n     * @property tableHTML\n     * @type String\n     * String used to build the HTML injected to support the Toolbar's layout. The align property is\n     * injected into this string inside the td.x-toolbar-left element during onLayout.\n     */\n    tableHTML: [\n        '<table cellspacing=\"0\" class=\"x-toolbar-ct\">',\n            '<tbody>',\n                '<tr>',\n                    '<td class=\"x-toolbar-left\" align=\"{0}\">',\n                        '<table cellspacing=\"0\">',\n                            '<tbody>',\n                                '<tr class=\"x-toolbar-left-row\"></tr>',\n                            '</tbody>',\n                        '</table>',\n                    '</td>',\n                    '<td class=\"x-toolbar-right\" align=\"right\">',\n                        '<table cellspacing=\"0\" class=\"x-toolbar-right-ct\">',\n                            '<tbody>',\n                                '<tr>',\n                                    '<td>',\n                                        '<table cellspacing=\"0\">',\n                                            '<tbody>',\n                                                '<tr class=\"x-toolbar-right-row\"></tr>',\n                                            '</tbody>',\n                                        '</table>',\n                                    '</td>',\n                                    '<td>',\n                                        '<table cellspacing=\"0\">',\n                                            '<tbody>',\n                                                '<tr class=\"x-toolbar-extras-row\"></tr>',\n                                            '</tbody>',\n                                        '</table>',\n                                    '</td>',\n                                '</tr>',\n                            '</tbody>',\n                        '</table>',\n                    '</td>',\n                '</tr>',\n            '</tbody>',\n        '</table>'\n    ].join(\"\"),\n\n    /**\n     * @private\n     * Create the wrapping Toolbar HTML and render/move all the items into the correct places\n     */\n    onLayout : function(ct, target) {\n        //render the Toolbar <table> HTML if it's not already present\n        if (!this.leftTr) {\n            var align = ct.buttonAlign == 'center' ? 'center' : 'left';\n\n            target.addClass('x-toolbar-layout-ct');\n            target.insertHtml('beforeEnd', String.format(this.tableHTML, align));\n\n            this.leftTr   = target.child('tr.x-toolbar-left-row', true);\n            this.rightTr  = target.child('tr.x-toolbar-right-row', true);\n            this.extrasTr = target.child('tr.x-toolbar-extras-row', true);\n\n            if (this.hiddenItem == undefined) {\n                /**\n                 * @property hiddenItems\n                 * @type Array\n                 * Holds all items that are currently hidden due to there not being enough space to render them\n                 * These items will appear on the expand menu.\n                 */\n                this.hiddenItems = [];\n            }\n        }\n\n        var side     = ct.buttonAlign == 'right' ? this.rightTr : this.leftTr,\n            items    = ct.items.items,\n            position = 0;\n\n        //render each item if not already rendered, place it into the correct (left or right) target\n        for (var i = 0, len = items.length, c; i < len; i++, position++) {\n            c = items[i];\n\n            if (c.isFill) {\n                side   = this.rightTr;\n                position = -1;\n            } else if (!c.rendered) {\n                c.render(this.insertCell(c, side, position));\n                this.configureItem(c);\n            } else {\n                if (!c.xtbHidden && !this.isValidParent(c, side.childNodes[position])) {\n                    var td = this.insertCell(c, side, position);\n                    td.appendChild(c.getPositionEl().dom);\n                    c.container = Ext.get(td);\n                }\n            }\n        }\n\n        //strip extra empty cells\n        this.cleanup(this.leftTr);\n        this.cleanup(this.rightTr);\n        this.cleanup(this.extrasTr);\n        this.fitToSize(target);\n    },\n\n    /**\n     * @private\n     * Removes any empty nodes from the given element\n     * @param {Ext.Element} el The element to clean up\n     */\n    cleanup : function(el) {\n        var cn = el.childNodes, i, c;\n\n        for (i = cn.length-1; i >= 0 && (c = cn[i]); i--) {\n            if (!c.firstChild) {\n                el.removeChild(c);\n            }\n        }\n    },\n\n    /**\n     * @private\n     * Inserts the given Toolbar item into the given element\n     * @param {Ext.Component} c The component to add\n     * @param {Ext.Element} target The target to add the component to\n     * @param {Number} position The position to add the component at\n     */\n    insertCell : function(c, target, position) {\n        var td = document.createElement('td');\n        td.className = 'x-toolbar-cell';\n\n        target.insertBefore(td, target.childNodes[position] || null);\n\n        return td;\n    },\n\n    /**\n     * @private\n     * Hides an item because it will not fit in the available width. The item will be unhidden again\n     * if the Toolbar is resized to be large enough to show it\n     * @param {Ext.Component} item The item to hide\n     */\n    hideItem : function(item) {\n        this.hiddenItems.push(item);\n\n        item.xtbHidden = true;\n        item.xtbWidth = item.getPositionEl().dom.parentNode.offsetWidth;\n        item.hide();\n    },\n\n    /**\n     * @private\n     * Unhides an item that was previously hidden due to there not being enough space left on the Toolbar\n     * @param {Ext.Component} item The item to show\n     */\n    unhideItem : function(item) {\n        item.show();\n        item.xtbHidden = false;\n        this.hiddenItems.remove(item);\n    },\n\n    /**\n     * @private\n     * Returns the width of the given toolbar item. If the item is currently hidden because there\n     * is not enough room to render it, its previous width is returned\n     * @param {Ext.Component} c The component to measure\n     * @return {Number} The width of the item\n     */\n    getItemWidth : function(c) {\n        return c.hidden ? (c.xtbWidth || 0) : c.getPositionEl().dom.parentNode.offsetWidth;\n    },\n\n    /**\n     * @private\n     * Called at the end of onLayout. At this point the Toolbar has already been resized, so we need\n     * to fit the items into the available width. We add up the width required by all of the items in\n     * the toolbar - if we don't have enough space we hide the extra items and render the expand menu\n     * trigger.\n     * @param {Ext.Element} target The Element the Toolbar is currently laid out within\n     */\n    fitToSize : function(target) {\n        if (this.container.enableOverflow === false) {\n            return;\n        }\n\n        var width       = target.dom.clientWidth,\n            tableWidth  = target.dom.firstChild.offsetWidth,\n            clipWidth   = width - this.triggerWidth,\n            lastWidth   = this.lastWidth || 0,\n\n            hiddenItems = this.hiddenItems,\n            hasHiddens  = hiddenItems.length != 0,\n            isLarger    = width >= lastWidth;\n\n        this.lastWidth  = width;\n\n        if (tableWidth > width || (hasHiddens && isLarger)) {\n            var items     = this.container.items.items,\n                len       = items.length,\n                loopWidth = 0,\n                item;\n\n            for (var i = 0; i < len; i++) {\n                item = items[i];\n\n                if (!item.isFill) {\n                    loopWidth += this.getItemWidth(item);\n                    if (loopWidth > clipWidth) {\n                        if (!(item.hidden || item.xtbHidden)) {\n                            this.hideItem(item);\n                        }\n                    } else if (item.xtbHidden) {\n                        this.unhideItem(item);\n                    }\n                }\n            }\n        }\n\n        //test for number of hidden items again here because they may have changed above\n        hasHiddens = hiddenItems.length != 0;\n\n        if (hasHiddens) {\n            this.initMore();\n\n            if (!this.lastOverflow) {\n                this.container.fireEvent('overflowchange', this.container, true);\n                this.lastOverflow = true;\n            }\n        } else if (this.more) {\n            this.clearMenu();\n            this.more.destroy();\n            delete this.more;\n\n            if (this.lastOverflow) {\n                this.container.fireEvent('overflowchange', this.container, false);\n                this.lastOverflow = false;\n            }\n        }\n    },\n\n    /**\n     * @private\n     * Returns a menu config for a given component. This config is used to create a menu item\n     * to be added to the expander menu\n     * @param {Ext.Component} component The component to create the config for\n     * @param {Boolean} hideOnClick Passed through to the menu item\n     */\n    createMenuConfig : function(component, hideOnClick){\n        var config = Ext.apply({}, component.initialConfig),\n            group  = component.toggleGroup;\n\n        Ext.copyTo(config, component, [\n            'iconCls', 'icon', 'itemId', 'disabled', 'handler', 'scope', 'menu'\n        ]);\n\n        Ext.apply(config, {\n            text       : component.overflowText || component.text,\n            hideOnClick: hideOnClick\n        });\n\n        if (group || component.enableToggle) {\n            Ext.apply(config, {\n                group  : group,\n                checked: component.pressed,\n                listeners: {\n                    checkchange: function(item, checked){\n                        component.toggle(checked);\n                    }\n                }\n            });\n        }\n\n        delete config.ownerCt;\n        delete config.xtype;\n        delete config.id;\n\n        return config;\n    },\n\n    /**\n     * @private\n     * Adds the given Toolbar item to the given menu. Buttons inside a buttongroup are added individually.\n     * @param {Ext.menu.Menu} menu The menu to add to\n     * @param {Ext.Component} component The component to add\n     */\n    addComponentToMenu : function(menu, component) {\n        if (component instanceof Ext.Toolbar.Separator) {\n            menu.add('-');\n\n        } else if (Ext.isFunction(component.isXType)) {\n            if (component.isXType('splitbutton')) {\n                menu.add(this.createMenuConfig(component, true));\n\n            } else if (component.isXType('button')) {\n                menu.add(this.createMenuConfig(component, !component.menu));\n\n            } else if (component.isXType('buttongroup')) {\n                component.items.each(function(item){\n                     this.addComponentToMenu(menu, item);\n                }, this);\n            }\n        }\n    },\n\n    /**\n     * @private\n     * Deletes the sub-menu of each item in the expander menu. Submenus are created for items such as\n     * splitbuttons and buttongroups, where the Toolbar item cannot be represented by a single menu item\n     */\n    clearMenu : function(){\n        var menu = this.moreMenu;\n        if (menu && menu.items) {\n            menu.items.each(function(item){\n                delete item.menu;\n            });\n        }\n    },\n\n    /**\n     * @private\n     * Called before the expand menu is shown, this rebuilds the menu since it was last shown because\n     * it is possible that the items hidden due to space limitations on the Toolbar have changed since.\n     * @param {Ext.menu.Menu} m The menu\n     */\n    beforeMoreShow : function(menu) {\n        var items = this.container.items.items,\n            len   = items.length,\n            item,\n            prev;\n\n        var needsSep = function(group, item){\n            return group.isXType('buttongroup') && !(item instanceof Ext.Toolbar.Separator);\n        };\n\n        this.clearMenu();\n        menu.removeAll();\n        for (var i = 0; i < len; i++) {\n            item = items[i];\n            if (item.xtbHidden) {\n                if (prev && (needsSep(item, prev) || needsSep(prev, item))) {\n                    menu.add('-');\n                }\n                this.addComponentToMenu(menu, item);\n                prev = item;\n            }\n        }\n\n        // put something so the menu isn't empty if no compatible items found\n        if (menu.items.length < 1) {\n            menu.add(this.noItemsMenuText);\n        }\n    },\n\n    /**\n     * @private\n     * Creates the expand trigger and menu, adding them to the <tr> at the extreme right of the\n     * Toolbar table\n     */\n    initMore : function(){\n        if (!this.more) {\n            /**\n             * @private\n             * @property moreMenu\n             * @type Ext.menu.Menu\n             * The expand menu - holds items for every Toolbar item that cannot be shown\n             * because the Toolbar is currently not wide enough.\n             */\n            this.moreMenu = new Ext.menu.Menu({\n                ownerCt : this.container,\n                listeners: {\n                    beforeshow: this.beforeMoreShow,\n                    scope: this\n                }\n            });\n\n            /**\n             * @private\n             * @property more\n             * @type Ext.Button\n             * The expand button which triggers the overflow menu to be shown\n             */\n            this.more = new Ext.Button({\n                iconCls: 'x-toolbar-more-icon',\n                cls    : 'x-toolbar-more',\n                menu   : this.moreMenu,\n                ownerCt: this.container\n            });\n\n            var td = this.insertCell(this.more, this.extrasTr, 100);\n            this.more.render(td);\n        }\n    },\n\n    destroy : function(){\n        Ext.destroy(this.more, this.moreMenu);\n        delete this.leftTr;\n        delete this.rightTr;\n        delete this.extrasTr;\n        Ext.layout.ToolbarLayout.superclass.destroy.call(this);\n    }\n});\n\nExt.Container.LAYOUTS.toolbar = Ext.layout.ToolbarLayout;\n/**\n * @class Ext.layout.MenuLayout\n * @extends Ext.layout.ContainerLayout\n * <p>Layout manager used by {@link Ext.menu.Menu}. Generally this class should not need to be used directly.</p>\n */\n Ext.layout.MenuLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    monitorResize : true,\n\n    type: 'menu',\n\n    setContainer : function(ct){\n        this.monitorResize = !ct.floating;\n        // This event is only fired by the menu in IE, used so we don't couple\n        // the menu with the layout.\n        ct.on('autosize', this.doAutoSize, this);\n        Ext.layout.MenuLayout.superclass.setContainer.call(this, ct);\n    },\n\n    renderItem : function(c, position, target){\n        if (!this.itemTpl) {\n            this.itemTpl = Ext.layout.MenuLayout.prototype.itemTpl = new Ext.XTemplate(\n                '<li id=\"{itemId}\" class=\"{itemCls}\">',\n                    '<tpl if=\"needsIcon\">',\n                        '<img alt=\"{altText}\" src=\"{icon}\" class=\"{iconCls}\"/>',\n                    '</tpl>',\n                '</li>'\n            );\n        }\n\n        if(c && !c.rendered){\n            if(Ext.isNumber(position)){\n                position = target.dom.childNodes[position];\n            }\n            var a = this.getItemArgs(c);\n\n//          The Component's positionEl is the <li> it is rendered into\n            c.render(c.positionEl = position ?\n                this.itemTpl.insertBefore(position, a, true) :\n                this.itemTpl.append(target, a, true));\n\n//          Link the containing <li> to the item.\n            c.positionEl.menuItemId = c.getItemId();\n\n//          If rendering a regular Component, and it needs an icon,\n//          move the Component rightwards.\n            if (!a.isMenuItem && a.needsIcon) {\n                c.positionEl.addClass('x-menu-list-item-indent');\n            }\n            this.configureItem(c);\n        }else if(c && !this.isValidParent(c, target)){\n            if(Ext.isNumber(position)){\n                position = target.dom.childNodes[position];\n            }\n            target.dom.insertBefore(c.getActionEl().dom, position || null);\n        }\n    },\n\n    getItemArgs : function(c) {\n        var isMenuItem = c instanceof Ext.menu.Item,\n            canHaveIcon = !(isMenuItem || c instanceof Ext.menu.Separator);\n\n        return {\n            isMenuItem: isMenuItem,\n            needsIcon: canHaveIcon && (c.icon || c.iconCls),\n            icon: c.icon || Ext.BLANK_IMAGE_URL,\n            iconCls: 'x-menu-item-icon ' + (c.iconCls || ''),\n            itemId: 'x-menu-el-' + c.id,\n            itemCls: 'x-menu-list-item ',\n            altText: c.altText || ''\n        };\n    },\n\n    //  Valid if the Component is in a <li> which is part of our target <ul>\n    isValidParent : function(c, target) {\n        return c.el.up('li.x-menu-list-item', 5).dom.parentNode === (target.dom || target);\n    },\n\n    onLayout : function(ct, target){\n        Ext.layout.MenuLayout.superclass.onLayout.call(this, ct, target);\n        this.doAutoSize();\n    },\n\n    doAutoSize : function(){\n        var ct = this.container, w = ct.width;\n        if(ct.floating){\n            if(w){\n                ct.setWidth(w);\n            }else if(Ext.isIE9m){\n                ct.setWidth(Ext.isStrict && (Ext.isIE7 || Ext.isIE8 || Ext.isIE9) ? 'auto' : ct.minWidth);\n                var el = ct.getEl(), t = el.dom.offsetWidth; // force recalc\n                ct.setWidth(ct.getLayoutTarget().getWidth() + el.getFrameWidth('lr'));\n            }\n        }\n    }\n});\nExt.Container.LAYOUTS['menu'] = Ext.layout.MenuLayout;\n/**\n * @class Ext.Viewport\n * @extends Ext.Container\n * <p>A specialized container representing the viewable application area (the browser viewport).</p>\n * <p>The Viewport renders itself to the document body, and automatically sizes itself to the size of\n * the browser viewport and manages window resizing. There may only be one Viewport created\n * in a page. Inner layouts are available by virtue of the fact that all {@link Ext.Panel Panel}s\n * added to the Viewport, either through its {@link #items}, or through the items, or the {@link #add}\n * method of any of its child Panels may themselves have a layout.</p>\n * <p>The Viewport does not provide scrolling, so child Panels within the Viewport should provide\n * for scrolling if needed using the {@link #autoScroll} config.</p>\n * <p>An example showing a classic application border layout:</p><pre><code>\nnew Ext.Viewport({\n    layout: 'border',\n    items: [{\n        region: 'north',\n        html: '&lt;h1 class=\"x-panel-header\">Page Title&lt;/h1>',\n        autoHeight: true,\n        border: false,\n        margins: '0 0 5 0'\n    }, {\n        region: 'west',\n        collapsible: true,\n        title: 'Navigation',\n        width: 200\n        // the west region might typically utilize a {@link Ext.tree.TreePanel TreePanel} or a Panel with {@link Ext.layout.AccordionLayout Accordion layout}\n    }, {\n        region: 'south',\n        title: 'Title for Panel',\n        collapsible: true,\n        html: 'Information goes here',\n        split: true,\n        height: 100,\n        minHeight: 100\n    }, {\n        region: 'east',\n        title: 'Title for the Grid Panel',\n        collapsible: true,\n        split: true,\n        width: 200,\n        xtype: 'grid',\n        // remaining grid configuration not shown ...\n        // notice that the GridPanel is added directly as the region\n        // it is not \"overnested\" inside another Panel\n    }, {\n        region: 'center',\n        xtype: 'tabpanel', // TabPanel itself has no title\n        items: {\n            title: 'Default Tab',\n            html: 'The first tab\\'s content. Others may be added dynamically'\n        }\n    }]\n});\n</code></pre>\n * @constructor\n * Create a new Viewport\n * @param {Object} config The config object\n * @xtype viewport\n */\nExt.Viewport = Ext.extend(Ext.Container, {\n    /*\n     * Privatize config options which, if used, would interfere with the\n     * correct operation of the Viewport as the sole manager of the\n     * layout of the document body.\n     */\n    /**\n     * @cfg {Mixed} applyTo @hide\n     */\n    /**\n     * @cfg {Boolean} allowDomMove @hide\n     */\n    /**\n     * @cfg {Boolean} hideParent @hide\n     */\n    /**\n     * @cfg {Mixed} renderTo @hide\n     */\n    /**\n     * @cfg {Number} height @hide\n     */\n    /**\n     * @cfg {Number} width @hide\n     */\n    /**\n     * @cfg {Boolean} autoHeight @hide\n     */\n    /**\n     * @cfg {Boolean} autoWidth @hide\n     */\n    /**\n     * @cfg {Boolean} deferHeight @hide\n     */\n    /**\n     * @cfg {Boolean} monitorResize @hide\n     */\n\n    initComponent : function() {\n        Ext.Viewport.superclass.initComponent.call(this);\n        document.getElementsByTagName('html')[0].className += ' x-viewport';\n        this.el = Ext.getBody();\n        this.el.setHeight = Ext.emptyFn;\n        this.el.setWidth = Ext.emptyFn;\n        this.el.setSize = Ext.emptyFn;\n        this.el.dom.scroll = 'no';\n        this.allowDomMove = false;\n        this.autoWidth = true;\n        this.autoHeight = true;\n        Ext.EventManager.onWindowResize(this.fireResize, this);\n        this.renderTo = this.el;\n    },\n\n    fireResize : function(w, h){\n        this.fireEvent('resize', this, w, h, w, h);\n    }\n});\nExt.reg('viewport', Ext.Viewport);\n/**\n * @class Ext.Panel\n * @extends Ext.Container\n * <p>Panel is a container that has specific functionality and structural components that make\n * it the perfect building block for application-oriented user interfaces.</p>\n * <p>Panels are, by virtue of their inheritance from {@link Ext.Container}, capable\n * of being configured with a {@link Ext.Container#layout layout}, and containing child Components.</p>\n * <p>When either specifying child {@link Ext.Component#items items} of a Panel, or dynamically {@link Ext.Container#add adding} Components\n * to a Panel, remember to consider how you wish the Panel to arrange those child elements, and whether\n * those child elements need to be sized using one of Ext's built-in <code><b>{@link Ext.Container#layout layout}</b></code> schemes. By\n * default, Panels use the {@link Ext.layout.ContainerLayout ContainerLayout} scheme. This simply renders\n * child components, appending them one after the other inside the Container, and <b>does not apply any sizing</b>\n * at all.</p>\n * <p>A Panel may also contain {@link #bbar bottom} and {@link #tbar top} toolbars, along with separate\n * {@link #header}, {@link #footer} and {@link #body} sections (see {@link #frame} for additional\n * information).</p>\n * <p>Panel also provides built-in {@link #collapsible expandable and collapsible behavior}, along with\n * a variety of {@link #tools prebuilt tool buttons} that can be wired up to provide other customized\n * behavior.  Panels can be easily dropped into any {@link Ext.Container Container} or layout, and the\n * layout and rendering pipeline is {@link Ext.Container#add completely managed by the framework}.</p>\n * @constructor\n * @param {Object} config The config object\n * @xtype panel\n */\nExt.Panel = Ext.extend(Ext.Container, {\n    /**\n     * The Panel's header {@link Ext.Element Element}. Read-only.\n     * <p>This Element is used to house the {@link #title} and {@link #tools}</p>\n     * <br><p><b>Note</b>: see the Note for <code>{@link Ext.Component#el el}</code> also.</p>\n     * @type Ext.Element\n     * @property header\n     */\n    /**\n     * The Panel's body {@link Ext.Element Element} which may be used to contain HTML content.\n     * The content may be specified in the {@link #html} config, or it may be loaded using the\n     * {@link autoLoad} config, or through the Panel's {@link #getUpdater Updater}. Read-only.\n     * <p>If this is used to load visible HTML elements in either way, then\n     * the Panel may not be used as a Layout for hosting nested Panels.</p>\n     * <p>If this Panel is intended to be used as the host of a Layout (See {@link #layout}\n     * then the body Element must not be loaded or changed - it is under the control\n     * of the Panel's Layout.\n     * <br><p><b>Note</b>: see the Note for <code>{@link Ext.Component#el el}</code> also.</p>\n     * @type Ext.Element\n     * @property body\n     */\n    /**\n     * The Panel's bwrap {@link Ext.Element Element} used to contain other Panel elements\n     * (tbar, body, bbar, footer). See {@link #bodyCfg}. Read-only.\n     * @type Ext.Element\n     * @property bwrap\n     */\n    /**\n     * True if this panel is collapsed. Read-only.\n     * @type Boolean\n     * @property collapsed\n     */\n    /**\n     * @cfg {Object} bodyCfg\n     * <p>A {@link Ext.DomHelper DomHelper} element specification object may be specified for any\n     * Panel Element.</p>\n     * <p>By default, the Default element in the table below will be used for the html markup to\n     * create a child element with the commensurate Default class name (<code>baseCls</code> will be\n     * replaced by <code>{@link #baseCls}</code>):</p>\n     * <pre>\n     * Panel      Default  Default             Custom      Additional       Additional\n     * Element    element  class               element     class            style\n     * ========   ==========================   =========   ==============   ===========\n     * {@link #header}     div      {@link #baseCls}+'-header'   {@link #headerCfg}   headerCssClass   headerStyle\n     * {@link #bwrap}      div      {@link #baseCls}+'-bwrap'     {@link #bwrapCfg}    bwrapCssClass    bwrapStyle\n     * + tbar     div      {@link #baseCls}+'-tbar'       {@link #tbarCfg}     tbarCssClass     tbarStyle\n     * + {@link #body}     div      {@link #baseCls}+'-body'       {@link #bodyCfg}     {@link #bodyCssClass}     {@link #bodyStyle}\n     * + bbar     div      {@link #baseCls}+'-bbar'       {@link #bbarCfg}     bbarCssClass     bbarStyle\n     * + {@link #footer}   div      {@link #baseCls}+'-footer'   {@link #footerCfg}   footerCssClass   footerStyle\n     * </pre>\n     * <p>Configuring a Custom element may be used, for example, to force the {@link #body} Element\n     * to use a different form of markup than is created by default. An example of this might be\n     * to {@link Ext.Element#createChild create a child} Panel containing a custom content, such as\n     * a header, or forcing centering of all Panel content by having the body be a &lt;center&gt;\n     * element:</p>\n     * <pre><code>\nnew Ext.Panel({\n    title: 'Message Title',\n    renderTo: Ext.getBody(),\n    width: 200, height: 130,\n    <b>bodyCfg</b>: {\n        tag: 'center',\n        cls: 'x-panel-body',  // Default class not applied if Custom element specified\n        html: 'Message'\n    },\n    footerCfg: {\n        tag: 'h2',\n        cls: 'x-panel-footer',        // same as the Default class\n        html: 'footer html'\n    },\n    footerCssClass: 'custom-footer', // additional css class, see {@link Ext.element#addClass addClass}\n    footerStyle:    'background-color:red' // see {@link #bodyStyle}\n});\n     * </code></pre>\n     * <p>The example above also explicitly creates a <code>{@link #footer}</code> with custom markup and\n     * styling applied.</p>\n     */\n    /**\n     * @cfg {Object} headerCfg\n     * <p>A {@link Ext.DomHelper DomHelper} element specification object specifying the element structure\n     * of this Panel's {@link #header} Element.  See <code>{@link #bodyCfg}</code> also.</p>\n     */\n    /**\n     * @cfg {Object} bwrapCfg\n     * <p>A {@link Ext.DomHelper DomHelper} element specification object specifying the element structure\n     * of this Panel's {@link #bwrap} Element.  See <code>{@link #bodyCfg}</code> also.</p>\n     */\n    /**\n     * @cfg {Object} tbarCfg\n     * <p>A {@link Ext.DomHelper DomHelper} element specification object specifying the element structure\n     * of this Panel's {@link #tbar} Element.  See <code>{@link #bodyCfg}</code> also.</p>\n     */\n    /**\n     * @cfg {Object} bbarCfg\n     * <p>A {@link Ext.DomHelper DomHelper} element specification object specifying the element structure\n     * of this Panel's {@link #bbar} Element.  See <code>{@link #bodyCfg}</code> also.</p>\n     */\n    /**\n     * @cfg {Object} footerCfg\n     * <p>A {@link Ext.DomHelper DomHelper} element specification object specifying the element structure\n     * of this Panel's {@link #footer} Element.  See <code>{@link #bodyCfg}</code> also.</p>\n     */\n    /**\n     * @cfg {Boolean} closable\n     * Panels themselves do not directly support being closed, but some Panel subclasses do (like\n     * {@link Ext.Window}) or a Panel Class within an {@link Ext.TabPanel}.  Specify <code>true</code>\n     * to enable closing in such situations. Defaults to <code>false</code>.\n     */\n    /**\n     * The Panel's footer {@link Ext.Element Element}. Read-only.\n     * <p>This Element is used to house the Panel's <code>{@link #buttons}</code> or <code>{@link #fbar}</code>.</p>\n     * <br><p><b>Note</b>: see the Note for <code>{@link Ext.Component#el el}</code> also.</p>\n     * @type Ext.Element\n     * @property footer\n     */\n    /**\n     * @cfg {Mixed} applyTo\n     * <p>The id of the node, a DOM node or an existing Element corresponding to a DIV that is already present in\n     * the document that specifies some panel-specific structural markup.  When <code>applyTo</code> is used,\n     * constituent parts of the panel can be specified by CSS class name within the main element, and the panel\n     * will automatically create those components from that markup. Any required components not specified in the\n     * markup will be autogenerated if necessary.</p>\n     * <p>The following class names are supported (baseCls will be replaced by {@link #baseCls}):</p>\n     * <ul><li>baseCls + '-header'</li>\n     * <li>baseCls + '-header-text'</li>\n     * <li>baseCls + '-bwrap'</li>\n     * <li>baseCls + '-tbar'</li>\n     * <li>baseCls + '-body'</li>\n     * <li>baseCls + '-bbar'</li>\n     * <li>baseCls + '-footer'</li></ul>\n     * <p>Using this config, a call to render() is not required.  If applyTo is specified, any value passed for\n     * {@link #renderTo} will be ignored and the target element's parent node will automatically be used as the\n     * panel's container.</p>\n     */\n    /**\n     * @cfg {Object/Array} tbar\n     * <p>The top toolbar of the panel. This can be a {@link Ext.Toolbar} object, a toolbar config, or an array of\n     * buttons/button configs to be added to the toolbar.  Note that this is not available as a property after render.\n     * To access the top toolbar after render, use {@link #getTopToolbar}.</p>\n     * <p><b>Note:</b> Although a Toolbar may contain Field components, these will <b>not</b> be updated by a load\n     * of an ancestor FormPanel. A Panel's toolbars are not part of the standard Container->Component hierarchy, and\n     * so are not scanned to collect form items. However, the values <b>will</b> be submitted because form\n     * submission parameters are collected from the DOM tree.</p>\n     */\n    /**\n     * @cfg {Object/Array} bbar\n     * <p>The bottom toolbar of the panel. This can be a {@link Ext.Toolbar} object, a toolbar config, or an array of\n     * buttons/button configs to be added to the toolbar.  Note that this is not available as a property after render.\n     * To access the bottom toolbar after render, use {@link #getBottomToolbar}.</p>\n     * <p><b>Note:</b> Although a Toolbar may contain Field components, these will <b>not</b> be updated by a load\n     * of an ancestor FormPanel. A Panel's toolbars are not part of the standard Container->Component hierarchy, and\n     * so are not scanned to collect form items. However, the values <b>will</b> be submitted because form\n     * submission parameters are collected from the DOM tree.</p>\n     */\n    /** @cfg {Object/Array} fbar\n     * <p>A {@link Ext.Toolbar Toolbar} object, a Toolbar config, or an array of\n     * {@link Ext.Button Button}s/{@link Ext.Button Button} configs, describing a {@link Ext.Toolbar Toolbar} to be rendered into this Panel's footer element.</p>\n     * <p>After render, the <code>fbar</code> property will be an {@link Ext.Toolbar Toolbar} instance.</p>\n     * <p>If <code>{@link #buttons}</code> are specified, they will supersede the <code>fbar</code> configuration property.</p>\n     * The Panel's <code>{@link #buttonAlign}</code> configuration affects the layout of these items, for example:\n     * <pre><code>\nvar w = new Ext.Window({\n    height: 250,\n    width: 500,\n    bbar: new Ext.Toolbar({\n        items: [{\n            text: 'bbar Left'\n        },'->',{\n            text: 'bbar Right'\n        }]\n    }),\n    {@link #buttonAlign}: 'left', // anything but 'center' or 'right' and you can use '-', and '->'\n                                  // to control the alignment of fbar items\n    fbar: [{\n        text: 'fbar Left'\n    },'->',{\n        text: 'fbar Right'\n    }]\n}).show();\n     * </code></pre>\n     * <p><b>Note:</b> Although a Toolbar may contain Field components, these will <b>not</b> be updated by a load\n     * of an ancestor FormPanel. A Panel's toolbars are not part of the standard Container->Component hierarchy, and\n     * so are not scanned to collect form items. However, the values <b>will</b> be submitted because form\n     * submission parameters are collected from the DOM tree.</p>\n     */\n    /**\n     * @cfg {Boolean} header\n     * <code>true</code> to create the Panel's header element explicitly, <code>false</code> to skip creating\n     * it.  If a <code>{@link #title}</code> is set the header will be created automatically, otherwise it will not.\n     * If a <code>{@link #title}</code> is set but <code>header</code> is explicitly set to <code>false</code>, the header\n     * will not be rendered.\n     */\n    /**\n     * @cfg {Boolean} footer\n     * <code>true</code> to create the footer element explicitly, false to skip creating it. The footer\n     * will be created automatically if <code>{@link #buttons}</code> or a <code>{@link #fbar}</code> have\n     * been configured.  See <code>{@link #bodyCfg}</code> for an example.\n     */\n    /**\n     * @cfg {String} title\n     * The title text to be used as innerHTML (html tags are accepted) to display in the panel\n     * <code>{@link #header}</code> (defaults to ''). When a <code>title</code> is specified the\n     * <code>{@link #header}</code> element will automatically be created and displayed unless\n     * {@link #header} is explicitly set to <code>false</code>.  If you do not want to specify a\n     * <code>title</code> at config time, but you may want one later, you must either specify a non-empty\n     * <code>title</code> (a blank space ' ' will do) or <code>header:true</code> so that the container\n     * element will get created.\n     */\n    /**\n     * @cfg {Array} buttons\n     * <code>buttons</code> will be used as <code>{@link Ext.Container#items items}</code> for the toolbar in\n     * the footer (<code>{@link #fbar}</code>). Typically the value of this configuration property will be\n     * an array of {@link Ext.Button}s or {@link Ext.Button} configuration objects.\n     * If an item is configured with <code>minWidth</code> or the Panel is configured with <code>minButtonWidth</code>,\n     * that width will be applied to the item.\n     */\n    /**\n     * @cfg {Object/String/Function} autoLoad\n     * A valid url spec according to the Updater {@link Ext.Updater#update} method.\n     * If autoLoad is not null, the panel will attempt to load its contents\n     * immediately upon render.<p>\n     * The URL will become the default URL for this panel's {@link #body} element,\n     * so it may be {@link Ext.Element#refresh refresh}ed at any time.</p>\n     */\n    /**\n     * @cfg {Boolean} frame\n     * <code>false</code> by default to render with plain 1px square borders. <code>true</code> to render with\n     * 9 elements, complete with custom rounded corners (also see {@link Ext.Element#boxWrap}).\n     * <p>The template generated for each condition is depicted below:</p><pre><code>\n     *\n// frame = false\n&lt;div id=\"developer-specified-id-goes-here\" class=\"x-panel\">\n\n    &lt;div class=\"x-panel-header\">&lt;span class=\"x-panel-header-text\">Title: (frame:false)&lt;/span>&lt;/div>\n\n    &lt;div class=\"x-panel-bwrap\">\n        &lt;div class=\"x-panel-body\">&lt;p>html value goes here&lt;/p>&lt;/div>\n    &lt;/div>\n&lt;/div>\n\n// frame = true (create 9 elements)\n&lt;div id=\"developer-specified-id-goes-here\" class=\"x-panel\">\n    &lt;div class=\"x-panel-tl\">&lt;div class=\"x-panel-tr\">&lt;div class=\"x-panel-tc\">\n        &lt;div class=\"x-panel-header\">&lt;span class=\"x-panel-header-text\">Title: (frame:true)&lt;/span>&lt;/div>\n    &lt;/div>&lt;/div>&lt;/div>\n\n    &lt;div class=\"x-panel-bwrap\">\n        &lt;div class=\"x-panel-ml\">&lt;div class=\"x-panel-mr\">&lt;div class=\"x-panel-mc\">\n            &lt;div class=\"x-panel-body\">&lt;p>html value goes here&lt;/p>&lt;/div>\n        &lt;/div>&lt;/div>&lt;/div>\n\n        &lt;div class=\"x-panel-bl\">&lt;div class=\"x-panel-br\">&lt;div class=\"x-panel-bc\"/>\n        &lt;/div>&lt;/div>&lt;/div>\n&lt;/div>\n     * </code></pre>\n     */\n    /**\n     * @cfg {Boolean} border\n     * True to display the borders of the panel's body element, false to hide them (defaults to true).  By default,\n     * the border is a 2px wide inset border, but this can be further altered by setting {@link #bodyBorder} to false.\n     */\n    /**\n     * @cfg {Boolean} bodyBorder\n     * True to display an interior border on the body element of the panel, false to hide it (defaults to true).\n     * This only applies when {@link #border} == true.  If border == true and bodyBorder == false, the border will display\n     * as a 1px wide inset border, giving the entire body element an inset appearance.\n     */\n    /**\n     * @cfg {String/Object/Function} bodyCssClass\n     * Additional css class selector to be applied to the {@link #body} element in the format expected by\n     * {@link Ext.Element#addClass} (defaults to null). See {@link #bodyCfg}.\n     */\n    /**\n     * @cfg {String/Object/Function} bodyStyle\n     * Custom CSS styles to be applied to the {@link #body} element in the format expected by\n     * {@link Ext.Element#applyStyles} (defaults to null). See {@link #bodyCfg}.\n     */\n    /**\n     * @cfg {String} iconCls\n     * The CSS class selector that specifies a background image to be used as the header icon (defaults to '').\n     * <p>An example of specifying a custom icon class would be something like:\n     * </p><pre><code>\n// specify the property in the config for the class:\n     ...\n     iconCls: 'my-icon'\n\n// css class that specifies background image to be used as the icon image:\n.my-icon { background-image: url(../images/my-icon.gif) 0 6px no-repeat !important; }\n</code></pre>\n     */\n    /**\n     * @cfg {Boolean} collapsible\n     * True to make the panel collapsible and have the expand/collapse toggle button automatically rendered into\n     * the header tool button area, false to keep the panel statically sized with no button (defaults to false).\n     */\n    /**\n     * @cfg {Array} tools\n     * An array of tool button configs to be added to the header tool area. When rendered, each tool is\n     * stored as an {@link Ext.Element Element} referenced by a public property called <code><b></b>tools.<i>&lt;tool-type&gt;</i></code>\n     * <p>Each tool config may contain the following properties:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>id</b> : String<div class=\"sub-desc\"><b>Required.</b> The type\n     * of tool to create. By default, this assigns a CSS class of the form <code>x-tool-<i>&lt;tool-type&gt;</i></code> to the\n     * resulting tool Element. Ext provides CSS rules, and an icon sprite containing images for the tool types listed below.\n     * The developer may implement custom tools by supplying alternate CSS rules and background images:\n     * <ul>\n     * <div class=\"x-tool x-tool-toggle\" style=\"float:left; margin-right:5;\"> </div><div><code> toggle</code> (Created by default when {@link #collapsible} is <code>true</code>)</div>\n     * <div class=\"x-tool x-tool-close\" style=\"float:left; margin-right:5;\"> </div><div><code> close</code></div>\n     * <div class=\"x-tool x-tool-minimize\" style=\"float:left; margin-right:5;\"> </div><div><code> minimize</code></div>\n     * <div class=\"x-tool x-tool-maximize\" style=\"float:left; margin-right:5;\"> </div><div><code> maximize</code></div>\n     * <div class=\"x-tool x-tool-restore\" style=\"float:left; margin-right:5;\"> </div><div><code> restore</code></div>\n     * <div class=\"x-tool x-tool-gear\" style=\"float:left; margin-right:5;\"> </div><div><code> gear</code></div>\n     * <div class=\"x-tool x-tool-pin\" style=\"float:left; margin-right:5;\"> </div><div><code> pin</code></div>\n     * <div class=\"x-tool x-tool-unpin\" style=\"float:left; margin-right:5;\"> </div><div><code> unpin</code></div>\n     * <div class=\"x-tool x-tool-right\" style=\"float:left; margin-right:5;\"> </div><div><code> right</code></div>\n     * <div class=\"x-tool x-tool-left\" style=\"float:left; margin-right:5;\"> </div><div><code> left</code></div>\n     * <div class=\"x-tool x-tool-up\" style=\"float:left; margin-right:5;\"> </div><div><code> up</code></div>\n     * <div class=\"x-tool x-tool-down\" style=\"float:left; margin-right:5;\"> </div><div><code> down</code></div>\n     * <div class=\"x-tool x-tool-refresh\" style=\"float:left; margin-right:5;\"> </div><div><code> refresh</code></div>\n     * <div class=\"x-tool x-tool-minus\" style=\"float:left; margin-right:5;\"> </div><div><code> minus</code></div>\n     * <div class=\"x-tool x-tool-plus\" style=\"float:left; margin-right:5;\"> </div><div><code> plus</code></div>\n     * <div class=\"x-tool x-tool-help\" style=\"float:left; margin-right:5;\"> </div><div><code> help</code></div>\n     * <div class=\"x-tool x-tool-search\" style=\"float:left; margin-right:5;\"> </div><div><code> search</code></div>\n     * <div class=\"x-tool x-tool-save\" style=\"float:left; margin-right:5;\"> </div><div><code> save</code></div>\n     * <div class=\"x-tool x-tool-print\" style=\"float:left; margin-right:5;\"> </div><div><code> print</code></div>\n     * </ul></div></li>\n     * <li><b>handler</b> : Function<div class=\"sub-desc\"><b>Required.</b> The function to\n     * call when clicked. Arguments passed are:<ul>\n     * <li><b>event</b> : Ext.EventObject<div class=\"sub-desc\">The click event.</div></li>\n     * <li><b>toolEl</b> : Ext.Element<div class=\"sub-desc\">The tool Element.</div></li>\n     * <li><b>panel</b> : Ext.Panel<div class=\"sub-desc\">The host Panel</div></li>\n     * <li><b>tc</b> : Object<div class=\"sub-desc\">The tool configuration object</div></li>\n     * </ul></div></li>\n     * <li><b>stopEvent</b> : Boolean<div class=\"sub-desc\">Defaults to true. Specify as false to allow click event to propagate.</div></li>\n     * <li><b>scope</b> : Object<div class=\"sub-desc\">The scope in which to call the handler.</div></li>\n     * <li><b>qtip</b> : String/Object<div class=\"sub-desc\">A tip string, or\n     * a config argument to {@link Ext.QuickTip#register}</div></li>\n     * <li><b>hidden</b> : Boolean<div class=\"sub-desc\">True to initially render hidden.</div></li>\n     * <li><b>on</b> : Object<div class=\"sub-desc\">A listener config object specifiying\n     * event listeners in the format of an argument to {@link #addListener}</div></li>\n     * </ul></div>\n     * <p>Note that, apart from the toggle tool which is provided when a panel is collapsible, these\n     * tools only provide the visual button. Any required functionality must be provided by adding\n     * handlers that implement the necessary behavior.</p>\n     * <p>Example usage:</p>\n     * <pre><code>\ntools:[{\n    id:'refresh',\n    qtip: 'Refresh form Data',\n    // hidden:true,\n    handler: function(event, toolEl, panel){\n        // refresh logic\n    }\n},\n{\n    id:'help',\n    qtip: 'Get Help',\n    handler: function(event, toolEl, panel){\n        // whatever\n    }\n}]\n</code></pre>\n     * <p>For the custom id of <code>'help'</code> define two relevant css classes with a link to\n     * a 15x15 image:</p>\n     * <pre><code>\n.x-tool-help {background-image: url(images/help.png);}\n.x-tool-help-over {background-image: url(images/help_over.png);}\n// if using an image sprite:\n.x-tool-help {background-image: url(images/help.png) no-repeat 0 0;}\n.x-tool-help-over {background-position:-15px 0;}\n</code></pre>\n     */\n    /**\n     * @cfg {Ext.Template/Ext.XTemplate} toolTemplate\n     * <p>A Template used to create {@link #tools} in the {@link #header} Element. Defaults to:</p><pre><code>\nnew Ext.Template('&lt;div class=\"x-tool x-tool-{id}\">&amp;#160;&lt;/div>')</code></pre>\n     * <p>This may may be overridden to provide a custom DOM structure for tools based upon a more\n     * complex XTemplate. The template's data is a single tool configuration object (Not the entire Array)\n     * as specified in {@link #tools}.  In the following example an &lt;a> tag is used to provide a\n     * visual indication when hovering over the tool:</p><pre><code>\nvar win = new Ext.Window({\n    tools: [{\n        id: 'download',\n        href: '/MyPdfDoc.pdf'\n    }],\n    toolTemplate: new Ext.XTemplate(\n        '&lt;tpl if=\"id==\\'download\\'\">',\n            '&lt;a class=\"x-tool x-tool-pdf\" href=\"{href}\">&lt;/a>',\n        '&lt;/tpl>',\n        '&lt;tpl if=\"id!=\\'download\\'\">',\n            '&lt;div class=\"x-tool x-tool-{id}\">&amp;#160;&lt;/div>',\n        '&lt;/tpl>'\n    ),\n    width:500,\n    height:300,\n    closeAction:'hide'\n});</code></pre>\n     * <p>Note that the CSS class 'x-tool-pdf' should have an associated style rule which provides an\n     * appropriate background image, something like:</p>\n    <pre><code>\n    a.x-tool-pdf {background-image: url(../shared/extjs/images/pdf.gif)!important;}\n    </code></pre>\n     */\n    /**\n     * @cfg {Boolean} hideCollapseTool\n     * <code>true</code> to hide the expand/collapse toggle button when <code>{@link #collapsible} == true</code>,\n     * <code>false</code> to display it (defaults to <code>false</code>).\n     */\n    /**\n     * @cfg {Boolean} titleCollapse\n     * <code>true</code> to allow expanding and collapsing the panel (when <code>{@link #collapsible} = true</code>)\n     * by clicking anywhere in the header bar, <code>false</code>) to allow it only by clicking to tool button\n     * (defaults to <code>false</code>)). If this panel is a child item of a border layout also see the\n     * {@link Ext.layout.BorderLayout.Region BorderLayout.Region}\n     * <code>{@link Ext.layout.BorderLayout.Region#floatable floatable}</code> config option.\n     */\n\n    /**\n     * @cfg {Mixed} floating\n     * <p>This property is used to configure the underlying {@link Ext.Layer}. Acceptable values for this\n     * configuration property are:</p><div class=\"mdetail-params\"><ul>\n     * <li><b><code>false</code></b> : <b>Default.</b><div class=\"sub-desc\">Display the panel inline where it is\n     * rendered.</div></li>\n     * <li><b><code>true</code></b> : <div class=\"sub-desc\">Float the panel (absolute position it with automatic\n     * shimming and shadow).<ul>\n     * <div class=\"sub-desc\">Setting floating to true will create an Ext.Layer for this panel and display the\n     * panel at negative offsets so that it is hidden.</div>\n     * <div class=\"sub-desc\">Since the panel will be absolute positioned, the position must be set explicitly\n     * <i>after</i> render (e.g., <code>myPanel.setPosition(100,100);</code>).</div>\n     * <div class=\"sub-desc\"><b>Note</b>: when floating a panel you should always assign a fixed width,\n     * otherwise it will be auto width and will expand to fill to the right edge of the viewport.</div>\n     * </ul></div></li>\n     * <li><b><code>{@link Ext.Layer object}</code></b> : <div class=\"sub-desc\">The specified object will be used\n     * as the configuration object for the {@link Ext.Layer} that will be created.</div></li>\n     * </ul></div>\n     */\n    /**\n     * @cfg {Boolean/String} shadow\n     * <code>true</code> (or a valid Ext.Shadow {@link Ext.Shadow#mode} value) to display a shadow behind the\n     * panel, <code>false</code> to display no shadow (defaults to <code>'sides'</code>).  Note that this option\n     * only applies when <code>{@link #floating} = true</code>.\n     */\n    /**\n     * @cfg {Number} shadowOffset\n     * The number of pixels to offset the shadow if displayed (defaults to <code>4</code>). Note that this\n     * option only applies when <code>{@link #floating} = true</code>.\n     */\n    /**\n     * @cfg {Boolean} shim\n     * <code>false</code> to disable the iframe shim in browsers which need one (defaults to <code>true</code>).\n     * Note that this option only applies when <code>{@link #floating} = true</code>.\n     */\n    /**\n     * @cfg {Object/Array} keys\n     * A {@link Ext.KeyMap} config object (in the format expected by {@link Ext.KeyMap#addBinding}\n     * used to assign custom key handling to this panel (defaults to <code>null</code>).\n     */\n    /**\n     * @cfg {Boolean/Object} draggable\n     * <p><code>true</code> to enable dragging of this Panel (defaults to <code>false</code>).</p>\n     * <p>For custom drag/drop implementations, an <b>Ext.Panel.DD</b> config could also be passed\n     * in this config instead of <code>true</code>. Ext.Panel.DD is an internal, undocumented class which\n     * moves a proxy Element around in place of the Panel's element, but provides no other behaviour\n     * during dragging or on drop. It is a subclass of {@link Ext.dd.DragSource}, so behaviour may be\n     * added by implementing the interface methods of {@link Ext.dd.DragDrop} e.g.:\n     * <pre><code>\nnew Ext.Panel({\n    title: 'Drag me',\n    x: 100,\n    y: 100,\n    renderTo: Ext.getBody(),\n    floating: true,\n    frame: true,\n    width: 400,\n    height: 200,\n    draggable: {\n//      Config option of Ext.Panel.DD class.\n//      It&#39;s a floating Panel, so do not show a placeholder proxy in the original position.\n        insertProxy: false,\n\n//      Called for each mousemove event while dragging the DD object.\n        onDrag : function(e){\n//          Record the x,y position of the drag proxy so that we can\n//          position the Panel at end of drag.\n            var pel = this.proxy.getEl();\n            this.x = pel.getLeft(true);\n            this.y = pel.getTop(true);\n\n//          Keep the Shadow aligned if there is one.\n            var s = this.panel.getEl().shadow;\n            if (s) {\n                s.realign(this.x, this.y, pel.getWidth(), pel.getHeight());\n            }\n        },\n\n//      Called on the mouseup event.\n        endDrag : function(e){\n            this.panel.setPosition(this.x, this.y);\n        }\n    }\n}).show();\n</code></pre>\n     */\n    /**\n     * @cfg {Boolean} disabled\n     * Render this panel disabled (default is <code>false</code>). An important note when using the disabled\n     * config on panels is that IE will often fail to initialize the disabled mask element correectly if\n     * the panel's layout has not yet completed by the time the Panel is disabled during the render process.\n     * If you experience this issue, you may need to instead use the {@link #afterlayout} event to initialize\n     * the disabled state:\n     * <pre><code>\nnew Ext.Panel({\n    ...\n    listeners: {\n        'afterlayout': {\n            fn: function(p){\n                p.disable();\n            },\n            single: true // important, as many layouts can occur\n        }\n    }\n});\n</code></pre>\n     */\n    /**\n     * @cfg {Boolean} autoHeight\n     * <code>true</code> to use height:'auto', <code>false</code> to use fixed height (defaults to <code>false</code>).\n     * <b>Note</b>: Setting <code>autoHeight: true</code> means that the browser will manage the panel's height\n     * based on its contents, and that Ext will not manage it at all. If the panel is within a layout that\n     * manages dimensions (<code>fit</code>, <code>border</code>, etc.) then setting <code>autoHeight: true</code>\n     * can cause issues with scrolling and will not generally work as expected since the panel will take\n     * on the height of its contents rather than the height required by the Ext layout.\n     */\n\n\n    /**\n     * @cfg {String} baseCls\n     * The base CSS class to apply to this panel's element (defaults to <code>'x-panel'</code>).\n     * <p>Another option available by default is to specify <code>'x-plain'</code> which strips all styling\n     * except for required attributes for Ext layouts to function (e.g. overflow:hidden).\n     * See <code>{@link #unstyled}</code> also.</p>\n     */\n    baseCls : 'x-panel',\n    /**\n     * @cfg {String} collapsedCls\n     * A CSS class to add to the panel's element after it has been collapsed (defaults to\n     * <code>'x-panel-collapsed'</code>).\n     */\n    collapsedCls : 'x-panel-collapsed',\n    /**\n     * @cfg {Boolean} maskDisabled\n     * <code>true</code> to mask the panel when it is {@link #disabled}, <code>false</code> to not mask it (defaults\n     * to <code>true</code>).  Either way, the panel will always tell its contained elements to disable themselves\n     * when it is disabled, but masking the panel can provide an additional visual cue that the panel is\n     * disabled.\n     */\n    maskDisabled : true,\n    /**\n     * @cfg {Boolean} animCollapse\n     * <code>true</code> to animate the transition when the panel is collapsed, <code>false</code> to skip the\n     * animation (defaults to <code>true</code> if the {@link Ext.Fx} class is available, otherwise <code>false</code>).\n     */\n    animCollapse : Ext.enableFx,\n    /**\n     * @cfg {Boolean} headerAsText\n     * <code>true</code> to display the panel <code>{@link #title}</code> in the <code>{@link #header}</code>,\n     * <code>false</code> to hide it (defaults to <code>true</code>).\n     */\n    headerAsText : true,\n    /**\n     * @cfg {String} buttonAlign\n     * The alignment of any {@link #buttons} added to this panel.  Valid values are <code>'right'</code>,\n     * <code>'left'</code> and <code>'center'</code> (defaults to <code>'right'</code>).\n     */\n    buttonAlign : 'right',\n    /**\n     * @cfg {Boolean} collapsed\n     * <code>true</code> to render the panel collapsed, <code>false</code> to render it expanded (defaults to\n     * <code>false</code>).\n     */\n    collapsed : false,\n    /**\n     * @cfg {Boolean} collapseFirst\n     * <code>true</code> to make sure the collapse/expand toggle button always renders first (to the left of)\n     * any other tools in the panel's title bar, <code>false</code> to render it last (defaults to <code>true</code>).\n     */\n    collapseFirst : true,\n    /**\n     * @cfg {Number} minButtonWidth\n     * Minimum width in pixels of all {@link #buttons} in this panel (defaults to <code>75</code>)\n     */\n    minButtonWidth : 75,\n    /**\n     * @cfg {Boolean} unstyled\n     * Overrides the <code>{@link #baseCls}</code> setting to <code>{@link #baseCls} = 'x-plain'</code> which renders\n     * the panel unstyled except for required attributes for Ext layouts to function (e.g. overflow:hidden).\n     */\n    /**\n     * @cfg {String} elements\n     * A comma-delimited list of panel elements to initialize when the panel is rendered.  Normally, this list will be\n     * generated automatically based on the items added to the panel at config time, but sometimes it might be useful to\n     * make sure a structural element is rendered even if not specified at config time (for example, you may want\n     * to add a button or toolbar dynamically after the panel has been rendered).  Adding those elements to this\n     * list will allocate the required placeholders in the panel when it is rendered.  Valid values are<div class=\"mdetail-params\"><ul>\n     * <li><code>header</code></li>\n     * <li><code>tbar</code> (top bar)</li>\n     * <li><code>body</code></li>\n     * <li><code>bbar</code> (bottom bar)</li>\n     * <li><code>footer</code></li>\n     * </ul></div>\n     * Defaults to '<code>body</code>'.\n     */\n    elements : 'body',\n    /**\n     * @cfg {Boolean} preventBodyReset\n     * Defaults to <code>false</code>.  When set to <code>true</code>, an extra css class <code>'x-panel-normal'</code>\n     * will be added to the panel's element, effectively applying css styles suggested by the W3C\n     * (see http://www.w3.org/TR/CSS21/sample.html) to the Panel's <b>body</b> element (not the header,\n     * footer, etc.).\n     */\n    preventBodyReset : false,\n\n    /**\n     * @cfg {Number/String} padding\n     * A shortcut for setting a padding style on the body element. The value can either be\n     * a number to be applied to all sides, or a normal css string describing padding.\n     * Defaults to <tt>undefined</tt>.\n     *\n     */\n    padding: undefined,\n\n    /** @cfg {String} resizeEvent\n     * The event to listen to for resizing in layouts. Defaults to <tt>'bodyresize'</tt>.\n     */\n    resizeEvent: 'bodyresize',\n\n    // protected - these could be used to customize the behavior of the window,\n    // but changing them would not be useful without further mofifications and\n    // could lead to unexpected or undesirable results.\n    toolTarget : 'header',\n    collapseEl : 'bwrap',\n    slideAnchor : 't',\n    disabledClass : '',\n\n    // private, notify box this class will handle heights\n    deferHeight : true,\n    // private\n    expandDefaults: {\n        duration : 0.25\n    },\n    // private\n    collapseDefaults : {\n        duration : 0.25\n    },\n\n    // private\n    initComponent : function(){\n        Ext.Panel.superclass.initComponent.call(this);\n\n        this.addEvents(\n            /**\n             * @event bodyresize\n             * Fires after the Panel has been resized.\n             * @param {Ext.Panel} p the Panel which has been resized.\n             * @param {Number} width The Panel body's new width.\n             * @param {Number} height The Panel body's new height.\n             */\n            'bodyresize',\n            /**\n             * @event titlechange\n             * Fires after the Panel title has been {@link #title set} or {@link #setTitle changed}.\n             * @param {Ext.Panel} p the Panel which has had its title changed.\n             * @param {String} The new title.\n             */\n            'titlechange',\n            /**\n             * @event iconchange\n             * Fires after the Panel icon class has been {@link #iconCls set} or {@link #setIconClass changed}.\n             * @param {Ext.Panel} p the Panel which has had its {@link #iconCls icon class} changed.\n             * @param {String} newIcon The new icon class.\n             * @param {String} oldIcon The old icon class.\n             */\n            'iconchange',\n            /**\n             * @event collapse\n             * Fires after the Panel has been collapsed.\n             * @param {Ext.Panel} p the Panel that has been collapsed.\n             */\n            'collapse',\n            /**\n             * @event expand\n             * Fires after the Panel has been expanded.\n             * @param {Ext.Panel} p The Panel that has been expanded.\n             */\n            'expand',\n            /**\n             * @event beforecollapse\n             * Fires before the Panel is collapsed.  A handler can return false to cancel the collapse.\n             * @param {Ext.Panel} p the Panel being collapsed.\n             * @param {Boolean} animate True if the collapse is animated, else false.\n             */\n            'beforecollapse',\n            /**\n             * @event beforeexpand\n             * Fires before the Panel is expanded.  A handler can return false to cancel the expand.\n             * @param {Ext.Panel} p The Panel being expanded.\n             * @param {Boolean} animate True if the expand is animated, else false.\n             */\n            'beforeexpand',\n            /**\n             * @event beforeclose\n             * Fires before the Panel is closed.  Note that Panels do not directly support being closed, but some\n             * Panel subclasses do (like {@link Ext.Window}) or a Panel within a Ext.TabPanel.  This event only\n             * applies to such subclasses.\n             * A handler can return false to cancel the close.\n             * @param {Ext.Panel} p The Panel being closed.\n             */\n            'beforeclose',\n            /**\n             * @event close\n             * Fires after the Panel is closed.  Note that Panels do not directly support being closed, but some\n             * Panel subclasses do (like {@link Ext.Window}) or a Panel within a Ext.TabPanel.\n             * @param {Ext.Panel} p The Panel that has been closed.\n             */\n            'close',\n            /**\n             * @event activate\n             * Fires after the Panel has been visually activated.\n             * Note that Panels do not directly support being activated, but some Panel subclasses\n             * do (like {@link Ext.Window}). Panels which are child Components of a TabPanel fire the\n             * activate and deactivate events under the control of the TabPanel.\n             * @param {Ext.Panel} p The Panel that has been activated.\n             */\n            'activate',\n            /**\n             * @event deactivate\n             * Fires after the Panel has been visually deactivated.\n             * Note that Panels do not directly support being deactivated, but some Panel subclasses\n             * do (like {@link Ext.Window}). Panels which are child Components of a TabPanel fire the\n             * activate and deactivate events under the control of the TabPanel.\n             * @param {Ext.Panel} p The Panel that has been deactivated.\n             */\n            'deactivate'\n        );\n\n        if(this.unstyled){\n            this.baseCls = 'x-plain';\n        }\n\n\n        this.toolbars = [];\n        // shortcuts\n        if(this.tbar){\n            this.elements += ',tbar';\n            this.topToolbar = this.createToolbar(this.tbar);\n            this.tbar = null;\n\n        }\n        if(this.bbar){\n            this.elements += ',bbar';\n            this.bottomToolbar = this.createToolbar(this.bbar);\n            this.bbar = null;\n        }\n\n        if(this.header === true){\n            this.elements += ',header';\n            this.header = null;\n        }else if(this.headerCfg || (this.title && this.header !== false)){\n            this.elements += ',header';\n        }\n\n        if(this.footerCfg || this.footer === true){\n            this.elements += ',footer';\n            this.footer = null;\n        }\n\n        if(this.buttons){\n            this.fbar = this.buttons;\n            this.buttons = null;\n        }\n        if(this.fbar){\n            this.createFbar(this.fbar);\n        }\n        if(this.autoLoad){\n            this.on('render', this.doAutoLoad, this, {delay:10});\n        }\n    },\n\n    // private\n    createFbar : function(fbar){\n        var min = this.minButtonWidth;\n        this.elements += ',footer';\n        this.fbar = this.createToolbar(fbar, {\n            buttonAlign: this.buttonAlign,\n            toolbarCls: 'x-panel-fbar',\n            enableOverflow: false,\n            defaults: function(c){\n                return {\n                    minWidth: c.minWidth || min\n                };\n            }\n        });\n        // @compat addButton and buttons could possibly be removed\n        // @target 4.0\n        /**\n         * This Panel's Array of buttons as created from the <code>{@link #buttons}</code>\n         * config property. Read only.\n         * @type Array\n         * @property buttons\n         */\n        this.fbar.items.each(function(c){\n            c.minWidth = c.minWidth || this.minButtonWidth;\n        }, this);\n        this.buttons = this.fbar.items.items;\n    },\n\n    // private\n    createToolbar: function(tb, options){\n        var result;\n        // Convert array to proper toolbar config\n        if(Ext.isArray(tb)){\n            tb = {\n                items: tb\n            };\n        }\n        result = tb.events ? Ext.apply(tb, options) : this.createComponent(Ext.apply({}, tb, options), 'toolbar');\n        this.toolbars.push(result);\n        return result;\n    },\n\n    // private\n    createElement : function(name, pnode){\n        if(this[name]){\n            pnode.appendChild(this[name].dom);\n            return;\n        }\n\n        if(name === 'bwrap' || this.elements.indexOf(name) != -1){\n            if(this[name+'Cfg']){\n                this[name] = Ext.fly(pnode).createChild(this[name+'Cfg']);\n            }else{\n                var el = document.createElement('div');\n                el.className = this[name+'Cls'];\n                this[name] = Ext.get(pnode.appendChild(el));\n            }\n            if(this[name+'CssClass']){\n                this[name].addClass(this[name+'CssClass']);\n            }\n            if(this[name+'Style']){\n                this[name].applyStyles(this[name+'Style']);\n            }\n        }\n    },\n\n    // private\n    onRender : function(ct, position){\n        Ext.Panel.superclass.onRender.call(this, ct, position);\n        this.createClasses();\n\n        var el = this.el,\n            d = el.dom,\n            bw,\n            ts;\n\n\n        if(this.collapsible && !this.hideCollapseTool){\n            this.tools = this.tools ? this.tools.slice(0) : [];\n            this.tools[this.collapseFirst?'unshift':'push']({\n                id: 'toggle',\n                handler : this.toggleCollapse,\n                scope: this\n            });\n        }\n\n        if(this.tools){\n            ts = this.tools;\n            this.elements += (this.header !== false) ? ',header' : '';\n        }\n        this.tools = {};\n\n        el.addClass(this.baseCls);\n        if(d.firstChild){ // existing markup\n            this.header = el.down('.'+this.headerCls);\n            this.bwrap = el.down('.'+this.bwrapCls);\n            var cp = this.bwrap ? this.bwrap : el;\n            this.tbar = cp.down('.'+this.tbarCls);\n            this.body = cp.down('.'+this.bodyCls);\n            this.bbar = cp.down('.'+this.bbarCls);\n            this.footer = cp.down('.'+this.footerCls);\n            this.fromMarkup = true;\n        }\n        if (this.preventBodyReset === true) {\n            el.addClass('x-panel-reset');\n        }\n        if(this.cls){\n            el.addClass(this.cls);\n        }\n\n        if(this.buttons){\n            this.elements += ',footer';\n        }\n\n        // This block allows for maximum flexibility and performance when using existing markup\n\n        // framing requires special markup\n        if(this.frame){\n            el.insertHtml('afterBegin', String.format(Ext.Element.boxMarkup, this.baseCls));\n\n            this.createElement('header', d.firstChild.firstChild.firstChild);\n            this.createElement('bwrap', d);\n\n            // append the mid and bottom frame to the bwrap\n            bw = this.bwrap.dom;\n            var ml = d.childNodes[1], bl = d.childNodes[2];\n            bw.appendChild(ml);\n            bw.appendChild(bl);\n\n            var mc = bw.firstChild.firstChild.firstChild;\n            this.createElement('tbar', mc);\n            this.createElement('body', mc);\n            this.createElement('bbar', mc);\n            this.createElement('footer', bw.lastChild.firstChild.firstChild);\n\n            if(!this.footer){\n                this.bwrap.dom.lastChild.className += ' x-panel-nofooter';\n            }\n            /*\n             * Store a reference to this element so:\n             * a) We aren't looking it up all the time\n             * b) The last element is reported incorrectly when using a loadmask\n             */\n            this.ft = Ext.get(this.bwrap.dom.lastChild);\n            this.mc = Ext.get(mc);\n        }else{\n            this.createElement('header', d);\n            this.createElement('bwrap', d);\n\n            // append the mid and bottom frame to the bwrap\n            bw = this.bwrap.dom;\n            this.createElement('tbar', bw);\n            this.createElement('body', bw);\n            this.createElement('bbar', bw);\n            this.createElement('footer', bw);\n\n            if(!this.header){\n                this.body.addClass(this.bodyCls + '-noheader');\n                if(this.tbar){\n                    this.tbar.addClass(this.tbarCls + '-noheader');\n                }\n            }\n        }\n\n        if(Ext.isDefined(this.padding)){\n            this.body.setStyle('padding', this.body.addUnits(this.padding));\n        }\n\n        if(this.border === false){\n            this.el.addClass(this.baseCls + '-noborder');\n            this.body.addClass(this.bodyCls + '-noborder');\n            if(this.header){\n                this.header.addClass(this.headerCls + '-noborder');\n            }\n            if(this.footer){\n                this.footer.addClass(this.footerCls + '-noborder');\n            }\n            if(this.tbar){\n                this.tbar.addClass(this.tbarCls + '-noborder');\n            }\n            if(this.bbar){\n                this.bbar.addClass(this.bbarCls + '-noborder');\n            }\n        }\n\n        if(this.bodyBorder === false){\n           this.body.addClass(this.bodyCls + '-noborder');\n        }\n\n        this.bwrap.enableDisplayMode('block');\n\n        if(this.header){\n            this.header.unselectable();\n\n            // for tools, we need to wrap any existing header markup\n            if(this.headerAsText){\n                this.header.dom.innerHTML =\n                    '<span class=\"' + this.headerTextCls + '\">'+this.header.dom.innerHTML+'</span>';\n\n                if(this.iconCls){\n                    this.setIconClass(this.iconCls);\n                }\n            }\n        }\n\n        if(this.floating){\n            this.makeFloating(this.floating);\n        }\n\n        if(this.collapsible && this.titleCollapse && this.header){\n            this.mon(this.header, 'click', this.toggleCollapse, this);\n            this.header.setStyle('cursor', 'pointer');\n        }\n        if(ts){\n            this.addTool.apply(this, ts);\n        }\n\n        // Render Toolbars.\n        if(this.fbar){\n            this.footer.addClass('x-panel-btns');\n            this.fbar.ownerCt = this;\n            this.fbar.render(this.footer);\n            this.footer.createChild({cls:'x-clear'});\n        }\n        if(this.tbar && this.topToolbar){\n            this.topToolbar.ownerCt = this;\n            this.topToolbar.render(this.tbar);\n        }\n        if(this.bbar && this.bottomToolbar){\n            this.bottomToolbar.ownerCt = this;\n            this.bottomToolbar.render(this.bbar);\n        }\n    },\n\n    /**\n     * Sets the CSS class that provides the icon image for this panel.  This method will replace any existing\n     * icon class if one has already been set and fire the {@link #iconchange} event after completion.\n     * @param {String} cls The new CSS class name\n     */\n    setIconClass : function(cls){\n        var old = this.iconCls;\n        this.iconCls = cls;\n        if(this.rendered && this.header){\n            if(this.frame){\n                this.header.addClass('x-panel-icon');\n                this.header.replaceClass(old, this.iconCls);\n            }else{\n                var hd = this.header,\n                    img = hd.child('img.x-panel-inline-icon');\n                if(img){\n                    Ext.fly(img).replaceClass(old, this.iconCls);\n                }else{\n                    var hdspan = hd.child('span.' + this.headerTextCls);\n                    if (hdspan) {\n                        Ext.DomHelper.insertBefore(hdspan.dom, {\n                            tag:'img', alt: '', src: Ext.BLANK_IMAGE_URL, cls:'x-panel-inline-icon '+this.iconCls\n                        });\n                    }\n                 }\n            }\n        }\n        this.fireEvent('iconchange', this, cls, old);\n    },\n\n    // private\n    makeFloating : function(cfg){\n        this.floating = true;\n        this.el = new Ext.Layer(Ext.apply({}, cfg, {\n            shadow: Ext.isDefined(this.shadow) ? this.shadow : 'sides',\n            shadowOffset: this.shadowOffset,\n            constrain:false,\n            shim: this.shim === false ? false : undefined\n        }), this.el);\n    },\n\n    /**\n     * Returns the {@link Ext.Toolbar toolbar} from the top (<code>{@link #tbar}</code>) section of the panel.\n     * @return {Ext.Toolbar} The toolbar\n     */\n    getTopToolbar : function(){\n        return this.topToolbar;\n    },\n\n    /**\n     * Returns the {@link Ext.Toolbar toolbar} from the bottom (<code>{@link #bbar}</code>) section of the panel.\n     * @return {Ext.Toolbar} The toolbar\n     */\n    getBottomToolbar : function(){\n        return this.bottomToolbar;\n    },\n\n    /**\n     * Returns the {@link Ext.Toolbar toolbar} from the footer (<code>{@link #fbar}</code>) section of the panel.\n     * @return {Ext.Toolbar} The toolbar\n     */\n    getFooterToolbar : function() {\n        return this.fbar;\n    },\n\n    /**\n     * Adds a button to this panel.  Note that this method must be called prior to rendering.  The preferred\n     * approach is to add buttons via the {@link #buttons} config.\n     * @param {String/Object} config A valid {@link Ext.Button} config.  A string will become the text for a default\n     * button config, an object will be treated as a button config object.\n     * @param {Function} handler The function to be called on button {@link Ext.Button#click}\n     * @param {Object} scope The scope (<code>this</code> reference) in which the button handler function is executed. Defaults to the Button.\n     * @return {Ext.Button} The button that was added\n     */\n    addButton : function(config, handler, scope){\n        if(!this.fbar){\n            this.createFbar([]);\n        }\n        if(handler){\n            if(Ext.isString(config)){\n                config = {text: config};\n            }\n            config = Ext.apply({\n                handler: handler,\n                scope: scope\n            }, config);\n        }\n        return this.fbar.add(config);\n    },\n\n    // private\n    addTool : function(){\n        if(!this.rendered){\n            if(!this.tools){\n                this.tools = [];\n            }\n            Ext.each(arguments, function(arg){\n                this.tools.push(arg);\n            }, this);\n            return;\n        }\n         // nowhere to render tools!\n        if(!this[this.toolTarget]){\n            return;\n        }\n        if(!this.toolTemplate){\n            // initialize the global tool template on first use\n            var tt = new Ext.Template(\n                 '<div class=\"x-tool x-tool-{id}\">&#160;</div>'\n            );\n            tt.disableFormats = true;\n            tt.compile();\n            Ext.Panel.prototype.toolTemplate = tt;\n        }\n        for(var i = 0, a = arguments, len = a.length; i < len; i++) {\n            var tc = a[i];\n            if(!this.tools[tc.id]){\n                var overCls = 'x-tool-'+tc.id+'-over';\n                var t = this.toolTemplate.insertFirst(this[this.toolTarget], tc, true);\n                this.tools[tc.id] = t;\n                t.enableDisplayMode('block');\n                this.mon(t, 'click',  this.createToolHandler(t, tc, overCls, this));\n                if(tc.on){\n                    this.mon(t, tc.on);\n                }\n                if(tc.hidden){\n                    t.hide();\n                }\n                if(tc.qtip){\n                    if(Ext.isObject(tc.qtip)){\n                        Ext.QuickTips.register(Ext.apply({\n                              target: t.id\n                        }, tc.qtip));\n                    } else {\n                        t.dom.qtip = tc.qtip;\n                    }\n                }\n                t.addClassOnOver(overCls);\n            }\n        }\n    },\n\n    onLayout : function(shallow, force){\n        Ext.Panel.superclass.onLayout.apply(this, arguments);\n        if(this.hasLayout && this.toolbars.length > 0){\n            Ext.each(this.toolbars, function(tb){\n                tb.doLayout(undefined, force);\n            });\n            this.syncHeight();\n        }\n    },\n\n    syncHeight : function(){\n        var h = this.toolbarHeight,\n                bd = this.body,\n                lsh = this.lastSize.height,\n                sz;\n\n        if(this.autoHeight || !Ext.isDefined(lsh) || lsh == 'auto'){\n            return;\n        }\n\n\n        if(h != this.getToolbarHeight()){\n            h = Math.max(0, lsh - this.getFrameHeight());\n            bd.setHeight(h);\n            sz = bd.getSize();\n            this.toolbarHeight = this.getToolbarHeight();\n            this.onBodyResize(sz.width, sz.height);\n        }\n    },\n\n    // private\n    onShow : function(){\n        if(this.floating){\n            return this.el.show();\n        }\n        Ext.Panel.superclass.onShow.call(this);\n    },\n\n    // private\n    onHide : function(){\n        if(this.floating){\n            return this.el.hide();\n        }\n        Ext.Panel.superclass.onHide.call(this);\n    },\n\n    // private\n    createToolHandler : function(t, tc, overCls, panel){\n        return function(e){\n            t.removeClass(overCls);\n            if(tc.stopEvent !== false){\n                e.stopEvent();\n            }\n            if(tc.handler){\n                tc.handler.call(tc.scope || t, e, t, panel, tc);\n            }\n        };\n    },\n\n    // private\n    afterRender : function(){\n        if(this.floating && !this.hidden){\n            this.el.show();\n        }\n        if(this.title){\n            this.setTitle(this.title);\n        }\n        Ext.Panel.superclass.afterRender.call(this); // do sizing calcs last\n        if (this.collapsed) {\n            this.collapsed = false;\n            this.collapse(false);\n        }\n        this.initEvents();\n    },\n\n    // private\n    getKeyMap : function(){\n        if(!this.keyMap){\n            this.keyMap = new Ext.KeyMap(this.el, this.keys);\n        }\n        return this.keyMap;\n    },\n\n    // private\n    initEvents : function(){\n        if(this.keys){\n            this.getKeyMap();\n        }\n        if(this.draggable){\n            this.initDraggable();\n        }\n        if(this.toolbars.length > 0){\n            Ext.each(this.toolbars, function(tb){\n                tb.doLayout();\n                tb.on({\n                    scope: this,\n                    afterlayout: this.syncHeight,\n                    remove: this.syncHeight\n                });\n            }, this);\n            this.syncHeight();\n        }\n\n    },\n\n    // private\n    initDraggable : function(){\n        /**\n         * <p>If this Panel is configured {@link #draggable}, this property will contain\n         * an instance of {@link Ext.dd.DragSource} which handles dragging the Panel.</p>\n         * The developer must provide implementations of the abstract methods of {@link Ext.dd.DragSource}\n         * in order to supply behaviour for each stage of the drag/drop process. See {@link #draggable}.\n         * @type Ext.dd.DragSource\n         * @property dd\n         */\n        this.dd = new Ext.Panel.DD(this, Ext.isBoolean(this.draggable) ? null : this.draggable);\n    },\n\n    // private\n    beforeEffect : function(anim){\n        if(this.floating){\n            this.el.beforeAction();\n        }\n        if(anim !== false){\n            this.el.addClass('x-panel-animated');\n        }\n    },\n\n    // private\n    afterEffect : function(anim){\n        this.syncShadow();\n        this.el.removeClass('x-panel-animated');\n    },\n\n    // private - wraps up an animation param with internal callbacks\n    createEffect : function(a, cb, scope){\n        var o = {\n            scope:scope,\n            block:true\n        };\n        if(a === true){\n            o.callback = cb;\n            return o;\n        }else if(!a.callback){\n            o.callback = cb;\n        }else { // wrap it up\n            o.callback = function(){\n                cb.call(scope);\n                Ext.callback(a.callback, a.scope);\n            };\n        }\n        return Ext.applyIf(o, a);\n    },\n\n    /**\n     * Collapses the panel body so that it becomes hidden.  Fires the {@link #beforecollapse} event which will\n     * cancel the collapse action if it returns false.\n     * @param {Boolean} animate True to animate the transition, else false (defaults to the value of the\n     * {@link #animCollapse} panel config)\n     * @return {Ext.Panel} this\n     */\n    collapse : function(animate){\n        if(this.collapsed || this.el.hasFxBlock() || this.fireEvent('beforecollapse', this, animate) === false){\n            return;\n        }\n        var doAnim = animate === true || (animate !== false && this.animCollapse);\n        this.beforeEffect(doAnim);\n        this.onCollapse(doAnim, animate);\n        return this;\n    },\n\n    // private\n    onCollapse : function(doAnim, animArg){\n        if(doAnim){\n            this[this.collapseEl].slideOut(this.slideAnchor,\n                    Ext.apply(this.createEffect(animArg||true, this.afterCollapse, this),\n                        this.collapseDefaults));\n        }else{\n            this[this.collapseEl].hide(this.hideMode);\n            this.afterCollapse(false);\n        }\n    },\n\n    // private\n    afterCollapse : function(anim){\n        this.collapsed = true;\n        this.el.addClass(this.collapsedCls);\n        if(anim !== false){\n            this[this.collapseEl].hide(this.hideMode);\n        }\n        this.afterEffect(anim);\n\n        // Reset lastSize of all sub-components so they KNOW they are in a collapsed container\n        this.cascade(function(c) {\n            if (c.lastSize) {\n                c.lastSize = { width: undefined, height: undefined };\n            }\n        });\n        this.fireEvent('collapse', this);\n    },\n\n    /**\n     * Expands the panel body so that it becomes visible.  Fires the {@link #beforeexpand} event which will\n     * cancel the expand action if it returns false.\n     * @param {Boolean} animate True to animate the transition, else false (defaults to the value of the\n     * {@link #animCollapse} panel config)\n     * @return {Ext.Panel} this\n     */\n    expand : function(animate){\n        if(!this.collapsed || this.el.hasFxBlock() || this.fireEvent('beforeexpand', this, animate) === false){\n            return;\n        }\n        var doAnim = animate === true || (animate !== false && this.animCollapse);\n        this.el.removeClass(this.collapsedCls);\n        this.beforeEffect(doAnim);\n        this.onExpand(doAnim, animate);\n        return this;\n    },\n\n    // private\n    onExpand : function(doAnim, animArg){\n        if(doAnim){\n            this[this.collapseEl].slideIn(this.slideAnchor,\n                    Ext.apply(this.createEffect(animArg||true, this.afterExpand, this),\n                        this.expandDefaults));\n        }else{\n            this[this.collapseEl].show(this.hideMode);\n            this.afterExpand(false);\n        }\n    },\n\n    // private\n    afterExpand : function(anim){\n        this.collapsed = false;\n        if(anim !== false){\n            this[this.collapseEl].show(this.hideMode);\n        }\n        this.afterEffect(anim);\n        if (this.deferLayout) {\n            delete this.deferLayout;\n            this.doLayout(true);\n        }\n        this.fireEvent('expand', this);\n    },\n\n    /**\n     * Shortcut for performing an {@link #expand} or {@link #collapse} based on the current state of the panel.\n     * @param {Boolean} animate True to animate the transition, else false (defaults to the value of the\n     * {@link #animCollapse} panel config)\n     * @return {Ext.Panel} this\n     */\n    toggleCollapse : function(animate){\n        this[this.collapsed ? 'expand' : 'collapse'](animate);\n        return this;\n    },\n\n    // private\n    onDisable : function(){\n        if(this.rendered && this.maskDisabled){\n            this.el.mask();\n        }\n        Ext.Panel.superclass.onDisable.call(this);\n    },\n\n    // private\n    onEnable : function(){\n        if(this.rendered && this.maskDisabled){\n            this.el.unmask();\n        }\n        Ext.Panel.superclass.onEnable.call(this);\n    },\n\n    // private\n    onResize : function(adjWidth, adjHeight, rawWidth, rawHeight){\n        var w = adjWidth,\n            h = adjHeight;\n\n        if(Ext.isDefined(w) || Ext.isDefined(h)){\n            if(!this.collapsed){\n                // First, set the the Panel's body width.\n                // If we have auto-widthed it, get the resulting full offset width so we can size the Toolbars to match\n                // The Toolbars must not buffer this resize operation because we need to know their heights.\n\n                if(Ext.isNumber(w)){\n                    this.body.setWidth(w = this.adjustBodyWidth(w - this.getFrameWidth()));\n                } else if (w == 'auto') {\n                    w = this.body.setWidth('auto').dom.offsetWidth;\n                } else {\n                    w = this.body.dom.offsetWidth;\n                }\n\n                if(this.tbar){\n                    this.tbar.setWidth(w);\n                    if(this.topToolbar){\n                        this.topToolbar.setSize(w);\n                    }\n                }\n                if(this.bbar){\n                    this.bbar.setWidth(w);\n                    if(this.bottomToolbar){\n                        this.bottomToolbar.setSize(w);\n                        // The bbar does not move on resize without this.\n                        if (Ext.isIE9m) {\n                            this.bbar.setStyle('position', 'static');\n                            this.bbar.setStyle('position', '');\n                        }\n                    }\n                }\n                if(this.footer){\n                    this.footer.setWidth(w);\n                    if(this.fbar){\n                        this.fbar.setSize(Ext.isIE9m ? (w - this.footer.getFrameWidth('lr')) : 'auto');\n                    }\n                }\n\n                // At this point, the Toolbars must be layed out for getFrameHeight to find a result.\n                if(Ext.isNumber(h)){\n                    h = Math.max(0, h - this.getFrameHeight());\n                    //h = Math.max(0, h - (this.getHeight() - this.body.getHeight()));\n                    this.body.setHeight(h);\n                }else if(h == 'auto'){\n                    this.body.setHeight(h);\n                }\n\n                if(this.disabled && this.el._mask){\n                    this.el._mask.setSize(this.el.dom.clientWidth, this.el.getHeight());\n                }\n            }else{\n                // Adds an event to set the correct height afterExpand.  This accounts for the deferHeight flag in panel\n                this.queuedBodySize = {width: w, height: h};\n                if(!this.queuedExpand && this.allowQueuedExpand !== false){\n                    this.queuedExpand = true;\n                    this.on('expand', function(){\n                        delete this.queuedExpand;\n                        this.onResize(this.queuedBodySize.width, this.queuedBodySize.height);\n                    }, this, {single:true});\n                }\n            }\n            this.onBodyResize(w, h);\n        }\n        this.syncShadow();\n        Ext.Panel.superclass.onResize.call(this, adjWidth, adjHeight, rawWidth, rawHeight);\n\n    },\n\n    // private\n    onBodyResize: function(w, h){\n        this.fireEvent('bodyresize', this, w, h);\n    },\n\n    // private\n    getToolbarHeight: function(){\n        var h = 0;\n        if(this.rendered){\n            Ext.each(this.toolbars, function(tb){\n                h += tb.getHeight();\n            }, this);\n        }\n        return h;\n    },\n\n    // deprecate\n    adjustBodyHeight : function(h){\n        return h;\n    },\n\n    // private\n    adjustBodyWidth : function(w){\n        return w;\n    },\n\n    // private\n    onPosition : function(){\n        this.syncShadow();\n    },\n\n    /**\n     * Returns the width in pixels of the framing elements of this panel (not including the body width).  To\n     * retrieve the body width see {@link #getInnerWidth}.\n     * @return {Number} The frame width\n     */\n    getFrameWidth : function(){\n        var w = this.el.getFrameWidth('lr') + this.bwrap.getFrameWidth('lr');\n\n        if(this.frame){\n            var l = this.bwrap.dom.firstChild;\n            w += (Ext.fly(l).getFrameWidth('l') + Ext.fly(l.firstChild).getFrameWidth('r'));\n            w += this.mc.getFrameWidth('lr');\n        }\n        return w;\n    },\n\n    /**\n     * Returns the height in pixels of the framing elements of this panel (including any top and bottom bars and\n     * header and footer elements, but not including the body height).  To retrieve the body height see {@link #getInnerHeight}.\n     * @return {Number} The frame height\n     */\n    getFrameHeight : function() {\n        var h  = this.el.getFrameWidth('tb') + this.bwrap.getFrameWidth('tb');\n        h += (this.tbar ? this.tbar.getHeight() : 0) +\n             (this.bbar ? this.bbar.getHeight() : 0);\n\n        if(this.frame){\n            h += this.el.dom.firstChild.offsetHeight + this.ft.dom.offsetHeight + this.mc.getFrameWidth('tb');\n        }else{\n            h += (this.header ? this.header.getHeight() : 0) +\n                (this.footer ? this.footer.getHeight() : 0);\n        }\n        return h;\n    },\n\n    /**\n     * Returns the width in pixels of the body element (not including the width of any framing elements).\n     * For the frame width see {@link #getFrameWidth}.\n     * @return {Number} The body width\n     */\n    getInnerWidth : function(){\n        return this.getSize().width - this.getFrameWidth();\n    },\n\n    /**\n     * Returns the height in pixels of the body element (not including the height of any framing elements).\n     * For the frame height see {@link #getFrameHeight}.\n     * @return {Number} The body height\n     */\n    getInnerHeight : function(){\n        return this.body.getHeight();\n        /* Deprecate\n            return this.getSize().height - this.getFrameHeight();\n        */\n    },\n\n    // private\n    syncShadow : function(){\n        if(this.floating){\n            this.el.sync(true);\n        }\n    },\n\n    // private\n    getLayoutTarget : function(){\n        return this.body;\n    },\n\n    // private\n    getContentTarget : function(){\n        return this.body;\n    },\n\n    /**\n     * <p>Sets the title text for the panel and optionally the {@link #iconCls icon class}.</p>\n     * <p>In order to be able to set the title, a header element must have been created\n     * for the Panel. This is triggered either by configuring the Panel with a non-blank <code>{@link #title}</code>,\n     * or configuring it with <code><b>{@link #header}: true</b></code>.</p>\n     * @param {String} title The title text to set\n     * @param {String} iconCls (optional) {@link #iconCls iconCls} A user-defined CSS class that provides the icon image for this panel\n     */\n    setTitle : function(title, iconCls){\n        this.title = title;\n        if(this.header && this.headerAsText){\n            this.header.child('span').update(title);\n        }\n        if(iconCls){\n            this.setIconClass(iconCls);\n        }\n        this.fireEvent('titlechange', this, title);\n        return this;\n    },\n\n    /**\n     * Get the {@link Ext.Updater} for this panel. Enables you to perform Ajax updates of this panel's body.\n     * @return {Ext.Updater} The Updater\n     */\n    getUpdater : function(){\n        return this.body.getUpdater();\n    },\n\n     /**\n     * Loads this content panel immediately with content returned from an XHR call.\n     * @param {Object/String/Function} config A config object containing any of the following options:\n<pre><code>\npanel.load({\n    url: 'your-url.php',\n    params: {param1: 'foo', param2: 'bar'}, // or a URL encoded string\n    callback: yourFunction,\n    scope: yourObject, // optional scope for the callback\n    discardUrl: false,\n    nocache: false,\n    text: 'Loading...',\n    timeout: 30,\n    scripts: false\n});\n</code></pre>\n     * The only required property is url. The optional properties nocache, text and scripts\n     * are shorthand for disableCaching, indicatorText and loadScripts and are used to set their\n     * associated property on this panel Updater instance.\n     * @return {Ext.Panel} this\n     */\n    load : function(){\n        var um = this.body.getUpdater();\n        um.update.apply(um, arguments);\n        return this;\n    },\n\n    // private\n    beforeDestroy : function(){\n        Ext.Panel.superclass.beforeDestroy.call(this);\n        if(this.header){\n            this.header.removeAllListeners();\n        }\n        if(this.tools){\n            for(var k in this.tools){\n                Ext.destroy(this.tools[k]);\n            }\n        }\n        if(this.toolbars.length > 0){\n            Ext.each(this.toolbars, function(tb){\n                tb.un('afterlayout', this.syncHeight, this);\n                tb.un('remove', this.syncHeight, this);\n            }, this);\n        }\n        if(Ext.isArray(this.buttons)){\n            while(this.buttons.length) {\n                Ext.destroy(this.buttons[0]);\n            }\n        }\n        if(this.rendered){\n            Ext.destroy(\n                this.ft,\n                this.header,\n                this.footer,\n                this.tbar,\n                this.bbar,\n                this.body,\n                this.mc,\n                this.bwrap,\n                this.dd\n            );\n            if (this.fbar) {\n                Ext.destroy(\n                    this.fbar,\n                    this.fbar.el\n                );\n            }\n        }\n        Ext.destroy(this.toolbars);\n    },\n\n    // private\n    createClasses : function(){\n        this.headerCls = this.baseCls + '-header';\n        this.headerTextCls = this.baseCls + '-header-text';\n        this.bwrapCls = this.baseCls + '-bwrap';\n        this.tbarCls = this.baseCls + '-tbar';\n        this.bodyCls = this.baseCls + '-body';\n        this.bbarCls = this.baseCls + '-bbar';\n        this.footerCls = this.baseCls + '-footer';\n    },\n\n    // private\n    createGhost : function(cls, useShim, appendTo){\n        var el = document.createElement('div');\n        el.className = 'x-panel-ghost ' + (cls ? cls : '');\n        if(this.header){\n            el.appendChild(this.el.dom.firstChild.cloneNode(true));\n        }\n        Ext.fly(el.appendChild(document.createElement('ul'))).setHeight(this.bwrap.getHeight());\n        el.style.width = this.el.dom.offsetWidth + 'px';;\n        if(!appendTo){\n            this.container.dom.appendChild(el);\n        }else{\n            Ext.getDom(appendTo).appendChild(el);\n        }\n        if(useShim !== false && this.el.useShim !== false){\n            var layer = new Ext.Layer({shadow:false, useDisplay:true, constrain:false}, el);\n            layer.show();\n            return layer;\n        }else{\n            return new Ext.Element(el);\n        }\n    },\n\n    // private\n    doAutoLoad : function(){\n        var u = this.body.getUpdater();\n        if(this.renderer){\n            u.setRenderer(this.renderer);\n        }\n        u.update(Ext.isObject(this.autoLoad) ? this.autoLoad : {url: this.autoLoad});\n    },\n\n    /**\n     * Retrieve a tool by id.\n     * @param {String} id\n     * @return {Object} tool\n     */\n    getTool : function(id) {\n        return this.tools[id];\n    }\n\n/**\n * @cfg {String} autoEl @hide\n */\n});\nExt.reg('panel', Ext.Panel);\n/**\n * @class Ext.Editor\n * @extends Ext.Component\n * A base editor field that handles displaying/hiding on demand and has some built-in sizing and event handling logic.\n * @constructor\n * Create a new Editor\n * @param {Object} config The config object\n * @xtype editor\n */\nExt.Editor = function(field, config){\n    if(field.field){\n        this.field = Ext.create(field.field, 'textfield');\n        config = Ext.apply({}, field); // copy so we don't disturb original config\n        delete config.field;\n    }else{\n        this.field = field;\n    }\n    Ext.Editor.superclass.constructor.call(this, config);\n};\n\nExt.extend(Ext.Editor, Ext.Component, {\n    /**\n    * @cfg {Ext.form.Field} field\n    * The Field object (or descendant) or config object for field\n    */\n    /**\n     * @cfg {Boolean} allowBlur\n     * True to {@link #completeEdit complete the editing process} if in edit mode when the\n     * field is blurred. Defaults to <tt>true</tt>.\n     */\n    allowBlur: true,\n    /**\n     * @cfg {Boolean/String} autoSize\n     * True for the editor to automatically adopt the size of the underlying field, \"width\" to adopt the width only,\n     * or \"height\" to adopt the height only, \"none\" to always use the field dimensions. (defaults to false)\n     */\n    /**\n     * @cfg {Boolean} revertInvalid\n     * True to automatically revert the field value and cancel the edit when the user completes an edit and the field\n     * validation fails (defaults to true)\n     */\n    /**\n     * @cfg {Boolean} ignoreNoChange\n     * True to skip the edit completion process (no save, no events fired) if the user completes an edit and\n     * the value has not changed (defaults to false).  Applies only to string values - edits for other data types\n     * will never be ignored.\n     */\n    /**\n     * @cfg {Boolean} hideEl\n     * False to keep the bound element visible while the editor is displayed (defaults to true)\n     */\n    /**\n     * @cfg {Mixed} value\n     * The data value of the underlying field (defaults to \"\")\n     */\n    value : \"\",\n    /**\n     * @cfg {String} alignment\n     * The position to align to (see {@link Ext.Element#alignTo} for more details, defaults to \"c-c?\").\n     */\n    alignment: \"c-c?\",\n    /**\n     * @cfg {Array} offsets\n     * The offsets to use when aligning (see {@link Ext.Element#alignTo} for more details. Defaults to <tt>[0, 0]</tt>.\n     */\n    offsets: [0, 0],\n    /**\n     * @cfg {Boolean/String} shadow \"sides\" for sides/bottom only, \"frame\" for 4-way shadow, and \"drop\"\n     * for bottom-right shadow (defaults to \"frame\")\n     */\n    shadow : \"frame\",\n    /**\n     * @cfg {Boolean} constrain True to constrain the editor to the viewport\n     */\n    constrain : false,\n    /**\n     * @cfg {Boolean} swallowKeys Handle the keydown/keypress events so they don't propagate (defaults to true)\n     */\n    swallowKeys : true,\n    /**\n     * @cfg {Boolean} completeOnEnter True to complete the edit when the enter key is pressed. Defaults to <tt>true</tt>.\n     */\n    completeOnEnter : true,\n    /**\n     * @cfg {Boolean} cancelOnEsc True to cancel the edit when the escape key is pressed. Defaults to <tt>true</tt>.\n     */\n    cancelOnEsc : true,\n    /**\n     * @cfg {Boolean} updateEl True to update the innerHTML of the bound element when the update completes (defaults to false)\n     */\n    updateEl : false,\n\n    initComponent : function(){\n        Ext.Editor.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event beforestartedit\n             * Fires when editing is initiated, but before the value changes.  Editing can be canceled by returning\n             * false from the handler of this event.\n             * @param {Editor} this\n             * @param {Ext.Element} boundEl The underlying element bound to this editor\n             * @param {Mixed} value The field value being set\n             */\n            \"beforestartedit\",\n            /**\n             * @event startedit\n             * Fires when this editor is displayed\n             * @param {Ext.Element} boundEl The underlying element bound to this editor\n             * @param {Mixed} value The starting field value\n             */\n            \"startedit\",\n            /**\n             * @event beforecomplete\n             * Fires after a change has been made to the field, but before the change is reflected in the underlying\n             * field.  Saving the change to the field can be canceled by returning false from the handler of this event.\n             * Note that if the value has not changed and ignoreNoChange = true, the editing will still end but this\n             * event will not fire since no edit actually occurred.\n             * @param {Editor} this\n             * @param {Mixed} value The current field value\n             * @param {Mixed} startValue The original field value\n             */\n            \"beforecomplete\",\n            /**\n             * @event complete\n             * Fires after editing is complete and any changed value has been written to the underlying field.\n             * @param {Editor} this\n             * @param {Mixed} value The current field value\n             * @param {Mixed} startValue The original field value\n             */\n            \"complete\",\n            /**\n             * @event canceledit\n             * Fires after editing has been canceled and the editor's value has been reset.\n             * @param {Editor} this\n             * @param {Mixed} value The user-entered field value that was discarded\n             * @param {Mixed} startValue The original field value that was set back into the editor after cancel\n             */\n            \"canceledit\",\n            /**\n             * @event specialkey\n             * Fires when any key related to navigation (arrows, tab, enter, esc, etc.) is pressed.  You can check\n             * {@link Ext.EventObject#getKey} to determine which key was pressed.\n             * @param {Ext.form.Field} this\n             * @param {Ext.EventObject} e The event object\n             */\n            \"specialkey\"\n        );\n    },\n\n    // private\n    onRender : function(ct, position){\n        this.el = new Ext.Layer({\n            shadow: this.shadow,\n            cls: \"x-editor\",\n            parentEl : ct,\n            shim : this.shim,\n            shadowOffset: this.shadowOffset || 4,\n            id: this.id,\n            constrain: this.constrain\n        });\n        if(this.zIndex){\n            this.el.setZIndex(this.zIndex);\n        }\n        this.el.setStyle(\"overflow\", Ext.isGecko ? \"auto\" : \"hidden\");\n        if(this.field.msgTarget != 'title'){\n            this.field.msgTarget = 'qtip';\n        }\n        this.field.inEditor = true;\n        this.mon(this.field, {\n            scope: this,\n            blur: this.onBlur,\n            specialkey: this.onSpecialKey\n        });\n        if(this.field.grow){\n            this.mon(this.field, \"autosize\", this.el.sync,  this.el, {delay:1});\n        }\n        this.field.render(this.el).show();\n        this.field.getEl().dom.name = '';\n        if(this.swallowKeys){\n            this.field.el.swallowEvent([\n                'keypress', // *** Opera\n                'keydown'   // *** all other browsers\n            ]);\n        }\n    },\n\n    // private\n    onSpecialKey : function(field, e){\n        var key = e.getKey(),\n            complete = this.completeOnEnter && key == e.ENTER,\n            cancel = this.cancelOnEsc && key == e.ESC;\n        if(complete || cancel){\n            e.stopEvent();\n            if(complete){\n                this.completeEdit();\n            }else{\n                this.cancelEdit();\n            }\n            if(field.triggerBlur){\n                field.triggerBlur();\n            }\n        }\n        this.fireEvent('specialkey', field, e);\n    },\n\n    /**\n     * Starts the editing process and shows the editor.\n     * @param {Mixed} el The element to edit\n     * @param {String} value (optional) A value to initialize the editor with. If a value is not provided, it defaults\n      * to the innerHTML of el.\n     */\n    startEdit : function(el, value){\n        if(this.editing){\n            this.completeEdit();\n        }\n        this.boundEl = Ext.get(el);\n        var v = value !== undefined ? value : this.boundEl.dom.innerHTML;\n        if(!this.rendered){\n            this.render(this.parentEl || document.body);\n        }\n        if(this.fireEvent(\"beforestartedit\", this, this.boundEl, v) !== false){\n            this.startValue = v;\n            this.field.reset();\n            this.field.setValue(v);\n            this.realign(true);\n            this.editing = true;\n            this.show();\n        }\n    },\n\n    // private\n    doAutoSize : function(){\n        if(this.autoSize){\n            var sz = this.boundEl.getSize(),\n                fs = this.field.getSize();\n\n            switch(this.autoSize){\n                case \"width\":\n                    this.setSize(sz.width, fs.height);\n                    break;\n                case \"height\":\n                    this.setSize(fs.width, sz.height);\n                    break;\n                case \"none\":\n                    this.setSize(fs.width, fs.height);\n                    break;\n                default:\n                    this.setSize(sz.width, sz.height);\n            }\n        }\n    },\n\n    /**\n     * Sets the height and width of this editor.\n     * @param {Number} width The new width\n     * @param {Number} height The new height\n     */\n    setSize : function(w, h){\n        delete this.field.lastSize;\n        this.field.setSize(w, h);\n        if(this.el){\n            // IE7 in strict mode doesn't size properly.\n            if(Ext.isGecko2 || Ext.isOpera || (Ext.isIE7 && Ext.isStrict)){\n                // prevent layer scrollbars\n                this.el.setSize(w, h);\n            }\n            this.el.sync();\n        }\n    },\n\n    /**\n     * Realigns the editor to the bound field based on the current alignment config value.\n     * @param {Boolean} autoSize (optional) True to size the field to the dimensions of the bound element.\n     */\n    realign : function(autoSize){\n        if(autoSize === true){\n            this.doAutoSize();\n        }\n        this.el.alignTo(this.boundEl, this.alignment, this.offsets);\n    },\n\n    /**\n     * Ends the editing process, persists the changed value to the underlying field, and hides the editor.\n     * @param {Boolean} remainVisible Override the default behavior and keep the editor visible after edit (defaults to false)\n     */\n    completeEdit : function(remainVisible){\n        if(!this.editing){\n            return;\n        }\n        // Assert combo values first\n        if (this.field.assertValue) {\n            this.field.assertValue();\n        }\n        var v = this.getValue();\n        if(!this.field.isValid()){\n            if(this.revertInvalid !== false){\n                this.cancelEdit(remainVisible);\n            }\n            return;\n        }\n        if(String(v) === String(this.startValue) && this.ignoreNoChange){\n            this.hideEdit(remainVisible);\n            return;\n        }\n        if(this.fireEvent(\"beforecomplete\", this, v, this.startValue) !== false){\n            v = this.getValue();\n            if(this.updateEl && this.boundEl){\n                this.boundEl.update(v);\n            }\n            this.hideEdit(remainVisible);\n            this.fireEvent(\"complete\", this, v, this.startValue);\n        }\n    },\n\n    // private\n    onShow : function(){\n        this.el.show();\n        if(this.hideEl !== false){\n            this.boundEl.hide();\n        }\n        this.field.show().focus(false, true);\n        this.fireEvent(\"startedit\", this.boundEl, this.startValue);\n    },\n\n    /**\n     * Cancels the editing process and hides the editor without persisting any changes.  The field value will be\n     * reverted to the original starting value.\n     * @param {Boolean} remainVisible Override the default behavior and keep the editor visible after\n     * cancel (defaults to false)\n     */\n    cancelEdit : function(remainVisible){\n        if(this.editing){\n            var v = this.getValue();\n            this.setValue(this.startValue);\n            this.hideEdit(remainVisible);\n            this.fireEvent(\"canceledit\", this, v, this.startValue);\n        }\n    },\n\n    // private\n    hideEdit: function(remainVisible){\n        if(remainVisible !== true){\n            this.editing = false;\n            this.hide();\n        }\n    },\n\n    // private\n    onBlur : function(){\n        // selectSameEditor flag allows the same editor to be started without onBlur firing on itself\n        if(this.allowBlur === true && this.editing && this.selectSameEditor !== true){\n            this.completeEdit();\n        }\n    },\n\n    // private\n    onHide : function(){\n        if(this.editing){\n            this.completeEdit();\n            return;\n        }\n        this.field.blur();\n        if(this.field.collapse){\n            this.field.collapse();\n        }\n        this.el.hide();\n        if(this.hideEl !== false){\n            this.boundEl.show();\n        }\n    },\n\n    /**\n     * Sets the data value of the editor\n     * @param {Mixed} value Any valid value supported by the underlying field\n     */\n    setValue : function(v){\n        this.field.setValue(v);\n    },\n\n    /**\n     * Gets the data value of the editor\n     * @return {Mixed} The data value\n     */\n    getValue : function(){\n        return this.field.getValue();\n    },\n\n    beforeDestroy : function(){\n        Ext.destroyMembers(this, 'field');\n\n        delete this.parentEl;\n        delete this.boundEl;\n    }\n});\nExt.reg('editor', Ext.Editor);\n/**\n * @class Ext.ColorPalette\n * @extends Ext.Component\n * Simple color palette class for choosing colors.  The palette can be rendered to any container.<br />\n * Here's an example of typical usage:\n * <pre><code>\nvar cp = new Ext.ColorPalette({value:'993300'});  // initial selected color\ncp.render('my-div');\n\ncp.on('select', function(palette, selColor){\n    // do something with selColor\n});\n</code></pre>\n * @constructor\n * Create a new ColorPalette\n * @param {Object} config The config object\n * @xtype colorpalette\n */\nExt.ColorPalette = Ext.extend(Ext.Component, {\n\t/**\n\t * @cfg {String} tpl An existing XTemplate instance to be used in place of the default template for rendering the component.\n\t */\n    /**\n     * @cfg {String} itemCls\n     * The CSS class to apply to the containing element (defaults to 'x-color-palette')\n     */\n    itemCls : 'x-color-palette',\n    /**\n     * @cfg {String} value\n     * The initial color to highlight (should be a valid 6-digit color hex code without the # symbol).  Note that\n     * the hex codes are case-sensitive.\n     */\n    value : null,\n    /**\n     * @cfg {String} clickEvent\n     * The DOM event that will cause a color to be selected. This can be any valid event name (dblclick, contextmenu). \n     * Defaults to <tt>'click'</tt>.\n     */\n    clickEvent :'click',\n    // private\n    ctype : 'Ext.ColorPalette',\n\n    /**\n     * @cfg {Boolean} allowReselect If set to true then reselecting a color that is already selected fires the {@link #select} event\n     */\n    allowReselect : false,\n\n    /**\n     * <p>An array of 6-digit color hex code strings (without the # symbol).  This array can contain any number\n     * of colors, and each hex code should be unique.  The width of the palette is controlled via CSS by adjusting\n     * the width property of the 'x-color-palette' class (or assigning a custom class), so you can balance the number\n     * of colors with the width setting until the box is symmetrical.</p>\n     * <p>You can override individual colors if needed:</p>\n     * <pre><code>\nvar cp = new Ext.ColorPalette();\ncp.colors[0] = 'FF0000';  // change the first box to red\n</code></pre>\n\nOr you can provide a custom array of your own for complete control:\n<pre><code>\nvar cp = new Ext.ColorPalette();\ncp.colors = ['000000', '993300', '333300'];\n</code></pre>\n     * @type Array\n     */\n    colors : [\n        '000000', '993300', '333300', '003300', '003366', '000080', '333399', '333333',\n        '800000', 'FF6600', '808000', '008000', '008080', '0000FF', '666699', '808080',\n        'FF0000', 'FF9900', '99CC00', '339966', '33CCCC', '3366FF', '800080', '969696',\n        'FF00FF', 'FFCC00', 'FFFF00', '00FF00', '00FFFF', '00CCFF', '993366', 'C0C0C0',\n        'FF99CC', 'FFCC99', 'FFFF99', 'CCFFCC', 'CCFFFF', '99CCFF', 'CC99FF', 'FFFFFF'\n    ],\n\n    /**\n     * @cfg {Function} handler\n     * Optional. A function that will handle the select event of this palette.\n     * The handler is passed the following parameters:<div class=\"mdetail-params\"><ul>\n     * <li><code>palette</code> : ColorPalette<div class=\"sub-desc\">The {@link #palette Ext.ColorPalette}.</div></li>\n     * <li><code>color</code> : String<div class=\"sub-desc\">The 6-digit color hex code (without the # symbol).</div></li>\n     * </ul></div>\n     */\n    /**\n     * @cfg {Object} scope\n     * The scope (<tt><b>this</b></tt> reference) in which the <code>{@link #handler}</code>\n     * function will be called.  Defaults to this ColorPalette instance.\n     */\n    \n    // private\n    initComponent : function(){\n        Ext.ColorPalette.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event select\n             * Fires when a color is selected\n             * @param {ColorPalette} this\n             * @param {String} color The 6-digit color hex code (without the # symbol)\n             */\n            'select'\n        );\n\n        if(this.handler){\n            this.on('select', this.handler, this.scope, true);\n        }    \n    },\n\n    // private\n    onRender : function(container, position){\n        this.autoEl = {\n            tag: 'div',\n            cls: this.itemCls\n        };\n        Ext.ColorPalette.superclass.onRender.call(this, container, position);\n        var t = this.tpl || new Ext.XTemplate(\n            '<tpl for=\".\"><a href=\"#\" class=\"color-{.}\" hidefocus=\"on\"><em><span style=\"background:#{.}\" class=\"x-unselectable\" unselectable=\"on\">&#160;</span></em></a></tpl>'\n        );\n        t.overwrite(this.el, this.colors);\n        this.mon(this.el, this.clickEvent, this.handleClick, this, {delegate: 'a'});\n        if(this.clickEvent != 'click'){\n        \tthis.mon(this.el, 'click', Ext.emptyFn, this, {delegate: 'a', preventDefault: true});\n        }\n    },\n\n    // private\n    afterRender : function(){\n        Ext.ColorPalette.superclass.afterRender.call(this);\n        if(this.value){\n            var s = this.value;\n            this.value = null;\n            this.select(s, true);\n        }\n    },\n\n    // private\n    handleClick : function(e, t){\n        e.preventDefault();\n        if(!this.disabled){\n            var c = t.className.match(/(?:^|\\s)color-(.{6})(?:\\s|$)/)[1];\n            this.select(c.toUpperCase());\n        }\n    },\n\n    /**\n     * Selects the specified color in the palette (fires the {@link #select} event)\n     * @param {String} color A valid 6-digit color hex code (# will be stripped if included)\n     * @param {Boolean} suppressEvent (optional) True to stop the select event from firing. Defaults to <tt>false</tt>.\n     */\n    select : function(color, suppressEvent){\n        color = color.replace('#', '');\n        if(color != this.value || this.allowReselect){\n            var el = this.el;\n            if(this.value){\n                el.child('a.color-'+this.value).removeClass('x-color-palette-sel');\n            }\n            el.child('a.color-'+color).addClass('x-color-palette-sel');\n            this.value = color;\n            if(suppressEvent !== true){\n                this.fireEvent('select', this, color);\n            }\n        }\n    }\n\n    /**\n     * @cfg {String} autoEl @hide\n     */\n});\nExt.reg('colorpalette', Ext.ColorPalette);/**\n * @class Ext.DatePicker\n * @extends Ext.Component\n * <p>A popup date picker. This class is used by the {@link Ext.form.DateField DateField} class\n * to allow browsing and selection of valid dates.</p>\n * <p>All the string values documented below may be overridden by including an Ext locale file in\n * your page.</p>\n * @constructor\n * Create a new DatePicker\n * @param {Object} config The config object\n * @xtype datepicker\n */\nExt.DatePicker = Ext.extend(Ext.BoxComponent, {\n    /**\n     * @cfg {String} todayText\n     * The text to display on the button that selects the current date (defaults to <code>'Today'</code>)\n     */\n    todayText : 'Today',\n    /**\n     * @cfg {String} okText\n     * The text to display on the ok button (defaults to <code>'&#160;OK&#160;'</code> to give the user extra clicking room)\n     */\n    okText : '&#160;OK&#160;',\n    /**\n     * @cfg {String} cancelText\n     * The text to display on the cancel button (defaults to <code>'Cancel'</code>)\n     */\n    cancelText : 'Cancel',\n    /**\n     * @cfg {Function} handler\n     * Optional. A function that will handle the select event of this picker.\n     * The handler is passed the following parameters:<div class=\"mdetail-params\"><ul>\n     * <li><code>picker</code> : DatePicker<div class=\"sub-desc\">This DatePicker.</div></li>\n     * <li><code>date</code> : Date<div class=\"sub-desc\">The selected date.</div></li>\n     * </ul></div>\n     */\n    /**\n     * @cfg {Object} scope\n     * The scope (<code><b>this</b></code> reference) in which the <code>{@link #handler}</code>\n     * function will be called.  Defaults to this DatePicker instance.\n     */\n    /**\n     * @cfg {String} todayTip\n     * A string used to format the message for displaying in a tooltip over the button that\n     * selects the current date. Defaults to <code>'{0} (Spacebar)'</code> where\n     * the <code>{0}</code> token is replaced by today's date.\n     */\n    todayTip : '{0} (Spacebar)',\n    /**\n     * @cfg {String} minText\n     * The error text to display if the minDate validation fails (defaults to <code>'This date is before the minimum date'</code>)\n     */\n    minText : 'This date is before the minimum date',\n    /**\n     * @cfg {String} maxText\n     * The error text to display if the maxDate validation fails (defaults to <code>'This date is after the maximum date'</code>)\n     */\n    maxText : 'This date is after the maximum date',\n    /**\n     * @cfg {String} format\n     * The default date format string which can be overriden for localization support.  The format must be\n     * valid according to {@link Date#parseDate} (defaults to <code>'m/d/y'</code>).\n     */\n    format : 'm/d/y',\n    /**\n     * @cfg {String} disabledDaysText\n     * The tooltip to display when the date falls on a disabled day (defaults to <code>'Disabled'</code>)\n     */\n    disabledDaysText : 'Disabled',\n    /**\n     * @cfg {String} disabledDatesText\n     * The tooltip text to display when the date falls on a disabled date (defaults to <code>'Disabled'</code>)\n     */\n    disabledDatesText : 'Disabled',\n    /**\n     * @cfg {Array} monthNames\n     * An array of textual month names which can be overriden for localization support (defaults to Date.monthNames)\n     */\n    monthNames : Date.monthNames,\n    /**\n     * @cfg {Array} dayNames\n     * An array of textual day names which can be overriden for localization support (defaults to Date.dayNames)\n     */\n    dayNames : Date.dayNames,\n    /**\n     * @cfg {String} nextText\n     * The next month navigation button tooltip (defaults to <code>'Next Month (Control+Right)'</code>)\n     */\n    nextText : 'Next Month (Control+Right)',\n    /**\n     * @cfg {String} prevText\n     * The previous month navigation button tooltip (defaults to <code>'Previous Month (Control+Left)'</code>)\n     */\n    prevText : 'Previous Month (Control+Left)',\n    /**\n     * @cfg {String} monthYearText\n     * The header month selector tooltip (defaults to <code>'Choose a month (Control+Up/Down to move years)'</code>)\n     */\n    monthYearText : 'Choose a month (Control+Up/Down to move years)',\n    /**\n     * @cfg {Number} startDay\n     * Day index at which the week should begin, 0-based (defaults to 0, which is Sunday)\n     */\n    startDay : 0,\n    /**\n     * @cfg {Boolean} showToday\n     * False to hide the footer area containing the Today button and disable the keyboard handler for spacebar\n     * that selects the current date (defaults to <code>true</code>).\n     */\n    showToday : true,\n    /**\n     * @cfg {Date} minDate\n     * Minimum allowable date (JavaScript date object, defaults to null)\n     */\n    /**\n     * @cfg {Date} maxDate\n     * Maximum allowable date (JavaScript date object, defaults to null)\n     */\n    /**\n     * @cfg {Array} disabledDays\n     * An array of days to disable, 0-based. For example, [0, 6] disables Sunday and Saturday (defaults to null).\n     */\n    /**\n     * @cfg {RegExp} disabledDatesRE\n     * JavaScript regular expression used to disable a pattern of dates (defaults to null).  The {@link #disabledDates}\n     * config will generate this regex internally, but if you specify disabledDatesRE it will take precedence over the\n     * disabledDates value.\n     */\n    /**\n     * @cfg {Array} disabledDates\n     * An array of 'dates' to disable, as strings. These strings will be used to build a dynamic regular\n     * expression so they are very powerful. Some examples:\n     * <ul>\n     * <li>['03/08/2003', '09/16/2003'] would disable those exact dates</li>\n     * <li>['03/08', '09/16'] would disable those days for every year</li>\n     * <li>['^03/08'] would only match the beginning (useful if you are using short years)</li>\n     * <li>['03/../2006'] would disable every day in March 2006</li>\n     * <li>['^03'] would disable every day in every March</li>\n     * </ul>\n     * Note that the format of the dates included in the array should exactly match the {@link #format} config.\n     * In order to support regular expressions, if you are using a date format that has '.' in it, you will have to\n     * escape the dot when restricting dates. For example: ['03\\\\.08\\\\.03'].\n     */\n\n    // private\n    // Set by other components to stop the picker focus being updated when the value changes.\n    focusOnSelect: true,\n\n    // default value used to initialise each date in the DatePicker\n    // (note: 12 noon was chosen because it steers well clear of all DST timezone changes)\n    initHour: 12, // 24-hour format\n\n    // private\n    initComponent : function(){\n        Ext.DatePicker.superclass.initComponent.call(this);\n\n        this.value = this.value ?\n                 this.value.clearTime(true) : new Date().clearTime();\n\n        this.addEvents(\n            /**\n             * @event select\n             * Fires when a date is selected\n             * @param {DatePicker} this DatePicker\n             * @param {Date} date The selected date\n             */\n            'select'\n        );\n\n        if(this.handler){\n            this.on('select', this.handler,  this.scope || this);\n        }\n\n        this.initDisabledDays();\n    },\n\n    // private\n    initDisabledDays : function(){\n        if(!this.disabledDatesRE && this.disabledDates){\n            var dd = this.disabledDates,\n                len = dd.length - 1,\n                re = '(?:';\n\n            Ext.each(dd, function(d, i){\n                re += Ext.isDate(d) ? '^' + Ext.escapeRe(d.dateFormat(this.format)) + '$' : dd[i];\n                if(i != len){\n                    re += '|';\n                }\n            }, this);\n            this.disabledDatesRE = new RegExp(re + ')');\n        }\n    },\n\n    /**\n     * Replaces any existing disabled dates with new values and refreshes the DatePicker.\n     * @param {Array/RegExp} disabledDates An array of date strings (see the {@link #disabledDates} config\n     * for details on supported values), or a JavaScript regular expression used to disable a pattern of dates.\n     */\n    setDisabledDates : function(dd){\n        if(Ext.isArray(dd)){\n            this.disabledDates = dd;\n            this.disabledDatesRE = null;\n        }else{\n            this.disabledDatesRE = dd;\n        }\n        this.initDisabledDays();\n        this.update(this.value, true);\n    },\n\n    /**\n     * Replaces any existing disabled days (by index, 0-6) with new values and refreshes the DatePicker.\n     * @param {Array} disabledDays An array of disabled day indexes. See the {@link #disabledDays} config\n     * for details on supported values.\n     */\n    setDisabledDays : function(dd){\n        this.disabledDays = dd;\n        this.update(this.value, true);\n    },\n\n    /**\n     * Replaces any existing {@link #minDate} with the new value and refreshes the DatePicker.\n     * @param {Date} value The minimum date that can be selected\n     */\n    setMinDate : function(dt){\n        this.minDate = dt;\n        this.update(this.value, true);\n    },\n\n    /**\n     * Replaces any existing {@link #maxDate} with the new value and refreshes the DatePicker.\n     * @param {Date} value The maximum date that can be selected\n     */\n    setMaxDate : function(dt){\n        this.maxDate = dt;\n        this.update(this.value, true);\n    },\n\n    /**\n     * Sets the value of the date field\n     * @param {Date} value The date to set\n     */\n    setValue : function(value){\n        this.value = value.clearTime(true);\n        this.update(this.value);\n    },\n\n    /**\n     * Gets the current selected value of the date field\n     * @return {Date} The selected date\n     */\n    getValue : function(){\n        return this.value;\n    },\n\n    // private\n    focus : function(){\n        this.update(this.activeDate);\n    },\n\n    // private\n    onEnable: function(initial){\n        Ext.DatePicker.superclass.onEnable.call(this);\n        this.doDisabled(false);\n        this.update(initial ? this.value : this.activeDate);\n        if(Ext.isIE9m){\n            this.el.repaint();\n        }\n\n    },\n\n    // private\n    onDisable : function(){\n        Ext.DatePicker.superclass.onDisable.call(this);\n        this.doDisabled(true);\n        if(Ext.isIE9m && !Ext.isIE8){\n            /* Really strange problem in IE6/7, when disabled, have to explicitly\n             * repaint each of the nodes to get them to display correctly, simply\n             * calling repaint on the main element doesn't appear to be enough.\n             */\n             Ext.each([].concat(this.textNodes, this.el.query('th span')), function(el){\n                 Ext.fly(el).repaint();\n             });\n        }\n    },\n\n    // private\n    doDisabled : function(disabled){\n        this.keyNav.setDisabled(disabled);\n        this.prevRepeater.setDisabled(disabled);\n        this.nextRepeater.setDisabled(disabled);\n        if(this.showToday){\n            this.todayKeyListener.setDisabled(disabled);\n            this.todayBtn.setDisabled(disabled);\n        }\n    },\n\n    // private\n    onRender : function(container, position){\n        var m = [\n             '<table cellspacing=\"0\">',\n                '<tr><td class=\"x-date-left\"><a href=\"#\" title=\"', this.prevText ,'\">&#160;</a></td><td class=\"x-date-middle\" align=\"center\"></td><td class=\"x-date-right\"><a href=\"#\" title=\"', this.nextText ,'\">&#160;</a></td></tr>',\n                '<tr><td colspan=\"3\"><table class=\"x-date-inner\" cellspacing=\"0\"><thead><tr>'],\n                dn = this.dayNames,\n                i;\n        for(i = 0; i < 7; i++){\n            var d = this.startDay+i;\n            if(d > 6){\n                d = d-7;\n            }\n            m.push('<th><span>', dn[d].substr(0,1), '</span></th>');\n        }\n        m[m.length] = '</tr></thead><tbody><tr>';\n        for(i = 0; i < 42; i++) {\n            if(i % 7 === 0 && i !== 0){\n                m[m.length] = '</tr><tr>';\n            }\n            m[m.length] = '<td><a href=\"#\" hidefocus=\"on\" class=\"x-date-date\" tabIndex=\"1\"><em><span></span></em></a></td>';\n        }\n        m.push('</tr></tbody></table></td></tr>',\n                this.showToday ? '<tr><td colspan=\"3\" class=\"x-date-bottom\" align=\"center\"></td></tr>' : '',\n                '</table><div class=\"x-date-mp\"></div>');\n\n        var el = document.createElement('div');\n        el.className = 'x-date-picker';\n        el.innerHTML = m.join('');\n\n        container.dom.insertBefore(el, position);\n\n        this.el = Ext.get(el);\n        this.eventEl = Ext.get(el.firstChild);\n\n        this.prevRepeater = new Ext.util.ClickRepeater(this.el.child('td.x-date-left a'), {\n            handler: this.showPrevMonth,\n            scope: this,\n            preventDefault:true,\n            stopDefault:true\n        });\n\n        this.nextRepeater = new Ext.util.ClickRepeater(this.el.child('td.x-date-right a'), {\n            handler: this.showNextMonth,\n            scope: this,\n            preventDefault:true,\n            stopDefault:true\n        });\n\n        this.monthPicker = this.el.down('div.x-date-mp');\n        this.monthPicker.enableDisplayMode('block');\n\n        this.keyNav = new Ext.KeyNav(this.eventEl, {\n            'left' : function(e){\n                if(e.ctrlKey){\n                    this.showPrevMonth();\n                }else{\n                    this.update(this.activeDate.add('d', -1));\n                }\n            },\n\n            'right' : function(e){\n                if(e.ctrlKey){\n                    this.showNextMonth();\n                }else{\n                    this.update(this.activeDate.add('d', 1));\n                }\n            },\n\n            'up' : function(e){\n                if(e.ctrlKey){\n                    this.showNextYear();\n                }else{\n                    this.update(this.activeDate.add('d', -7));\n                }\n            },\n\n            'down' : function(e){\n                if(e.ctrlKey){\n                    this.showPrevYear();\n                }else{\n                    this.update(this.activeDate.add('d', 7));\n                }\n            },\n\n            'pageUp' : function(e){\n                this.showNextMonth();\n            },\n\n            'pageDown' : function(e){\n                this.showPrevMonth();\n            },\n\n            'enter' : function(e){\n                e.stopPropagation();\n                return true;\n            },\n\n            scope : this\n        });\n\n        this.el.unselectable();\n\n        this.cells = this.el.select('table.x-date-inner tbody td');\n        this.textNodes = this.el.query('table.x-date-inner tbody span');\n\n        this.mbtn = new Ext.Button({\n            text: '&#160;',\n            tooltip: this.monthYearText,\n            renderTo: this.el.child('td.x-date-middle', true)\n        });\n        this.mbtn.el.child('em').addClass('x-btn-arrow');\n\n        if(this.showToday){\n            this.todayKeyListener = this.eventEl.addKeyListener(Ext.EventObject.SPACE, this.selectToday,  this);\n            var today = (new Date()).dateFormat(this.format);\n            this.todayBtn = new Ext.Button({\n                renderTo: this.el.child('td.x-date-bottom', true),\n                text: String.format(this.todayText, today),\n                tooltip: String.format(this.todayTip, today),\n                handler: this.selectToday,\n                scope: this\n            });\n        }\n        this.mon(this.eventEl, 'mousewheel', this.handleMouseWheel, this);\n        this.mon(this.eventEl, 'click', this.handleDateClick,  this, {delegate: 'a.x-date-date'});\n        this.mon(this.mbtn, 'click', this.showMonthPicker, this);\n        this.onEnable(true);\n    },\n\n    // private\n    createMonthPicker : function(){\n        if(!this.monthPicker.dom.firstChild){\n            var buf = ['<table border=\"0\" cellspacing=\"0\">'];\n            for(var i = 0; i < 6; i++){\n                buf.push(\n                    '<tr><td class=\"x-date-mp-month\"><a href=\"#\">', Date.getShortMonthName(i), '</a></td>',\n                    '<td class=\"x-date-mp-month x-date-mp-sep\"><a href=\"#\">', Date.getShortMonthName(i + 6), '</a></td>',\n                    i === 0 ?\n                    '<td class=\"x-date-mp-ybtn\" align=\"center\"><a class=\"x-date-mp-prev\"></a></td><td class=\"x-date-mp-ybtn\" align=\"center\"><a class=\"x-date-mp-next\"></a></td></tr>' :\n                    '<td class=\"x-date-mp-year\"><a href=\"#\"></a></td><td class=\"x-date-mp-year\"><a href=\"#\"></a></td></tr>'\n                );\n            }\n            buf.push(\n                '<tr class=\"x-date-mp-btns\"><td colspan=\"4\"><button type=\"button\" class=\"x-date-mp-ok\">',\n                    this.okText,\n                    '</button><button type=\"button\" class=\"x-date-mp-cancel\">',\n                    this.cancelText,\n                    '</button></td></tr>',\n                '</table>'\n            );\n            this.monthPicker.update(buf.join(''));\n\n            this.mon(this.monthPicker, 'click', this.onMonthClick, this);\n            this.mon(this.monthPicker, 'dblclick', this.onMonthDblClick, this);\n\n            this.mpMonths = this.monthPicker.select('td.x-date-mp-month');\n            this.mpYears = this.monthPicker.select('td.x-date-mp-year');\n\n            this.mpMonths.each(function(m, a, i){\n                i += 1;\n                if((i%2) === 0){\n                    m.dom.xmonth = 5 + Math.round(i * 0.5);\n                }else{\n                    m.dom.xmonth = Math.round((i-1) * 0.5);\n                }\n            });\n        }\n    },\n\n    // private\n    showMonthPicker : function(){\n        if(!this.disabled){\n            this.createMonthPicker();\n            var size = this.el.getSize();\n            this.monthPicker.setSize(size);\n            this.monthPicker.child('table').setSize(size);\n\n            this.mpSelMonth = (this.activeDate || this.value).getMonth();\n            this.updateMPMonth(this.mpSelMonth);\n            this.mpSelYear = (this.activeDate || this.value).getFullYear();\n            this.updateMPYear(this.mpSelYear);\n\n            this.monthPicker.slideIn('t', {duration:0.2});\n        }\n    },\n\n    // private\n    updateMPYear : function(y){\n        this.mpyear = y;\n        var ys = this.mpYears.elements;\n        for(var i = 1; i <= 10; i++){\n            var td = ys[i-1], y2;\n            if((i%2) === 0){\n                y2 = y + Math.round(i * 0.5);\n                td.firstChild.innerHTML = y2;\n                td.xyear = y2;\n            }else{\n                y2 = y - (5-Math.round(i * 0.5));\n                td.firstChild.innerHTML = y2;\n                td.xyear = y2;\n            }\n            this.mpYears.item(i-1)[y2 == this.mpSelYear ? 'addClass' : 'removeClass']('x-date-mp-sel');\n        }\n    },\n\n    // private\n    updateMPMonth : function(sm){\n        this.mpMonths.each(function(m, a, i){\n            m[m.dom.xmonth == sm ? 'addClass' : 'removeClass']('x-date-mp-sel');\n        });\n    },\n\n    // private\n    selectMPMonth : function(m){\n\n    },\n\n    // private\n    onMonthClick : function(e, t){\n        e.stopEvent();\n        var el = new Ext.Element(t), pn;\n        if(el.is('button.x-date-mp-cancel')){\n            this.hideMonthPicker();\n        }\n        else if(el.is('button.x-date-mp-ok')){\n            var d = new Date(this.mpSelYear, this.mpSelMonth, (this.activeDate || this.value).getDate());\n            if(d.getMonth() != this.mpSelMonth){\n                // 'fix' the JS rolling date conversion if needed\n                d = new Date(this.mpSelYear, this.mpSelMonth, 1).getLastDateOfMonth();\n            }\n            this.update(d);\n            this.hideMonthPicker();\n        }\n        else if((pn = el.up('td.x-date-mp-month', 2))){\n            this.mpMonths.removeClass('x-date-mp-sel');\n            pn.addClass('x-date-mp-sel');\n            this.mpSelMonth = pn.dom.xmonth;\n        }\n        else if((pn = el.up('td.x-date-mp-year', 2))){\n            this.mpYears.removeClass('x-date-mp-sel');\n            pn.addClass('x-date-mp-sel');\n            this.mpSelYear = pn.dom.xyear;\n        }\n        else if(el.is('a.x-date-mp-prev')){\n            this.updateMPYear(this.mpyear-10);\n        }\n        else if(el.is('a.x-date-mp-next')){\n            this.updateMPYear(this.mpyear+10);\n        }\n    },\n\n    // private\n    onMonthDblClick : function(e, t){\n        e.stopEvent();\n        var el = new Ext.Element(t), pn;\n        if((pn = el.up('td.x-date-mp-month', 2))){\n            this.update(new Date(this.mpSelYear, pn.dom.xmonth, (this.activeDate || this.value).getDate()));\n            this.hideMonthPicker();\n        }\n        else if((pn = el.up('td.x-date-mp-year', 2))){\n            this.update(new Date(pn.dom.xyear, this.mpSelMonth, (this.activeDate || this.value).getDate()));\n            this.hideMonthPicker();\n        }\n    },\n\n    // private\n    hideMonthPicker : function(disableAnim){\n        if(this.monthPicker){\n            if(disableAnim === true){\n                this.monthPicker.hide();\n            }else{\n                this.monthPicker.slideOut('t', {duration:0.2});\n            }\n        }\n    },\n\n    // private\n    showPrevMonth : function(e){\n        this.update(this.activeDate.add('mo', -1));\n    },\n\n    // private\n    showNextMonth : function(e){\n        this.update(this.activeDate.add('mo', 1));\n    },\n\n    // private\n    showPrevYear : function(){\n        this.update(this.activeDate.add('y', -1));\n    },\n\n    // private\n    showNextYear : function(){\n        this.update(this.activeDate.add('y', 1));\n    },\n\n    // private\n    handleMouseWheel : function(e){\n        e.stopEvent();\n        if(!this.disabled){\n            var delta = e.getWheelDelta();\n            if(delta > 0){\n                this.showPrevMonth();\n            } else if(delta < 0){\n                this.showNextMonth();\n            }\n        }\n    },\n\n    // private\n    handleDateClick : function(e, t){\n        e.stopEvent();\n        if(!this.disabled && t.dateValue && !Ext.fly(t.parentNode).hasClass('x-date-disabled')){\n            this.cancelFocus = this.focusOnSelect === false;\n            this.setValue(new Date(t.dateValue));\n            delete this.cancelFocus;\n            this.fireEvent('select', this, this.value);\n        }\n    },\n\n    // private\n    selectToday : function(){\n        if(this.todayBtn && !this.todayBtn.disabled){\n            this.setValue(new Date().clearTime());\n            this.fireEvent('select', this, this.value);\n        }\n    },\n\n    // private\n    update : function(date, forceRefresh){\n        if(this.rendered){\n            var vd = this.activeDate, vis = this.isVisible();\n            this.activeDate = date;\n            if(!forceRefresh && vd && this.el){\n                var t = date.getTime();\n                if(vd.getMonth() == date.getMonth() && vd.getFullYear() == date.getFullYear()){\n                    this.cells.removeClass('x-date-selected');\n                    this.cells.each(function(c){\n                       if(c.dom.firstChild.dateValue == t){\n                           c.addClass('x-date-selected');\n                           if(vis && !this.cancelFocus){\n                               Ext.fly(c.dom.firstChild).focus(50);\n                           }\n                           return false;\n                       }\n                    }, this);\n                    return;\n                }\n            }\n            var days = date.getDaysInMonth(),\n                firstOfMonth = date.getFirstDateOfMonth(),\n                startingPos = firstOfMonth.getDay()-this.startDay;\n\n            if(startingPos < 0){\n                startingPos += 7;\n            }\n            days += startingPos;\n\n            var pm = date.add('mo', -1),\n                prevStart = pm.getDaysInMonth()-startingPos,\n                cells = this.cells.elements,\n                textEls = this.textNodes,\n                // convert everything to numbers so it's fast\n                d = (new Date(pm.getFullYear(), pm.getMonth(), prevStart, this.initHour)),\n                today = new Date().clearTime().getTime(),\n                sel = date.clearTime(true).getTime(),\n                min = this.minDate ? this.minDate.clearTime(true) : Number.NEGATIVE_INFINITY,\n                max = this.maxDate ? this.maxDate.clearTime(true) : Number.POSITIVE_INFINITY,\n                ddMatch = this.disabledDatesRE,\n                ddText = this.disabledDatesText,\n                ddays = this.disabledDays ? this.disabledDays.join('') : false,\n                ddaysText = this.disabledDaysText,\n                format = this.format;\n\n            if(this.showToday){\n                var td = new Date().clearTime(),\n                    disable = (td < min || td > max ||\n                    (ddMatch && format && ddMatch.test(td.dateFormat(format))) ||\n                    (ddays && ddays.indexOf(td.getDay()) != -1));\n\n                if(!this.disabled){\n                    this.todayBtn.setDisabled(disable);\n                    this.todayKeyListener[disable ? 'disable' : 'enable']();\n                }\n            }\n\n            var setCellClass = function(cal, cell){\n                cell.title = '';\n                var t = d.clearTime(true).getTime();\n                cell.firstChild.dateValue = t;\n                if(t == today){\n                    cell.className += ' x-date-today';\n                    cell.title = cal.todayText;\n                }\n                if(t == sel){\n                    cell.className += ' x-date-selected';\n                    if(vis){\n                        Ext.fly(cell.firstChild).focus(50);\n                    }\n                }\n                // disabling\n                if(t < min) {\n                    cell.className = ' x-date-disabled';\n                    cell.title = cal.minText;\n                    return;\n                }\n                if(t > max) {\n                    cell.className = ' x-date-disabled';\n                    cell.title = cal.maxText;\n                    return;\n                }\n                if(ddays){\n                    if(ddays.indexOf(d.getDay()) != -1){\n                        cell.title = ddaysText;\n                        cell.className = ' x-date-disabled';\n                    }\n                }\n                if(ddMatch && format){\n                    var fvalue = d.dateFormat(format);\n                    if(ddMatch.test(fvalue)){\n                        cell.title = ddText.replace('%0', fvalue);\n                        cell.className = ' x-date-disabled';\n                    }\n                }\n            };\n\n            var i = 0;\n            for(; i < startingPos; i++) {\n                textEls[i].innerHTML = (++prevStart);\n                d.setDate(d.getDate()+1);\n                cells[i].className = 'x-date-prevday';\n                setCellClass(this, cells[i]);\n            }\n            for(; i < days; i++){\n                var intDay = i - startingPos + 1;\n                textEls[i].innerHTML = (intDay);\n                d.setDate(d.getDate()+1);\n                cells[i].className = 'x-date-active';\n                setCellClass(this, cells[i]);\n            }\n            var extraDays = 0;\n            for(; i < 42; i++) {\n                 textEls[i].innerHTML = (++extraDays);\n                 d.setDate(d.getDate()+1);\n                 cells[i].className = 'x-date-nextday';\n                 setCellClass(this, cells[i]);\n            }\n\n            this.mbtn.setText(this.monthNames[date.getMonth()] + ' ' + date.getFullYear());\n\n            if(!this.internalRender){\n                var main = this.el.dom.firstChild,\n                    w = main.offsetWidth;\n                this.el.setWidth(w + this.el.getBorderWidth('lr'));\n                Ext.fly(main).setWidth(w);\n                this.internalRender = true;\n                // opera does not respect the auto grow header center column\n                // then, after it gets a width opera refuses to recalculate\n                // without a second pass\n                if(Ext.isOpera && !this.secondPass){\n                    main.rows[0].cells[1].style.width = (w - (main.rows[0].cells[0].offsetWidth+main.rows[0].cells[2].offsetWidth)) + 'px';\n                    this.secondPass = true;\n                    this.update.defer(10, this, [date]);\n                }\n            }\n        }\n    },\n\n    // private\n    beforeDestroy : function() {\n        if(this.rendered){\n            Ext.destroy(\n                this.keyNav,\n                this.monthPicker,\n                this.eventEl,\n                this.mbtn,\n                this.nextRepeater,\n                this.prevRepeater,\n                this.cells.el,\n                this.todayBtn\n            );\n            delete this.textNodes;\n            delete this.cells.elements;\n        }\n    }\n\n    /**\n     * @cfg {String} autoEl @hide\n     */\n});\n\nExt.reg('datepicker', Ext.DatePicker);\n/**\n * @class Ext.LoadMask\n * A simple utility class for generically masking elements while loading data.  If the {@link #store}\n * config option is specified, the masking will be automatically synchronized with the store's loading\n * process and the mask element will be cached for reuse.  For all other elements, this mask will replace the\n * element's Updater load indicator and will be destroyed after the initial load.\n * <p>Example usage:</p>\n *<pre><code>\n// Basic mask:\nvar myMask = new Ext.LoadMask(Ext.getBody(), {msg:\"Please wait...\"});\nmyMask.show();\n</code></pre>\n * @constructor\n * Create a new LoadMask\n * @param {Mixed} el The element or DOM node, or its id\n * @param {Object} config The config object\n */\nExt.LoadMask = function(el, config){\n    this.el = Ext.get(el);\n    Ext.apply(this, config);\n    if(this.store){\n        this.store.on({\n            scope: this,\n            beforeload: this.onBeforeLoad,\n            load: this.onLoad,\n            exception: this.onLoad\n        });\n        this.removeMask = Ext.value(this.removeMask, false);\n    }else{\n        var um = this.el.getUpdater();\n        um.showLoadIndicator = false; // disable the default indicator\n        um.on({\n            scope: this,\n            beforeupdate: this.onBeforeLoad,\n            update: this.onLoad,\n            failure: this.onLoad\n        });\n        this.removeMask = Ext.value(this.removeMask, true);\n    }\n};\n\nExt.LoadMask.prototype = {\n    /**\n     * @cfg {Ext.data.Store} store\n     * Optional Store to which the mask is bound. The mask is displayed when a load request is issued, and\n     * hidden on either load sucess, or load fail.\n     */\n    /**\n     * @cfg {Boolean} removeMask\n     * True to create a single-use mask that is automatically destroyed after loading (useful for page loads),\n     * False to persist the mask element reference for multiple uses (e.g., for paged data widgets).  Defaults to false.\n     */\n    /**\n     * @cfg {String} msg\n     * The text to display in a centered loading message box (defaults to 'Loading...')\n     */\n    msg : 'Loading...',\n    /**\n     * @cfg {String} msgCls\n     * The CSS class to apply to the loading message element (defaults to \"x-mask-loading\")\n     */\n    msgCls : 'x-mask-loading',\n\n    /**\n     * Read-only. True if the mask is currently disabled so that it will not be displayed (defaults to false)\n     * @type Boolean\n     */\n    disabled: false,\n\n    /**\n     * Disables the mask to prevent it from being displayed\n     */\n    disable : function(){\n       this.disabled = true;\n    },\n\n    /**\n     * Enables the mask so that it can be displayed\n     */\n    enable : function(){\n        this.disabled = false;\n    },\n\n    // private\n    onLoad : function(){\n        this.el.unmask(this.removeMask);\n    },\n\n    // private\n    onBeforeLoad : function(){\n        if(!this.disabled){\n            this.el.mask(this.msg, this.msgCls);\n        }\n    },\n\n    /**\n     * Show this LoadMask over the configured Element.\n     */\n    show: function(){\n        this.onBeforeLoad();\n    },\n\n    /**\n     * Hide this LoadMask.\n     */\n    hide: function(){\n        this.onLoad();\n    },\n\n    // private\n    destroy : function(){\n        if(this.store){\n            this.store.un('beforeload', this.onBeforeLoad, this);\n            this.store.un('load', this.onLoad, this);\n            this.store.un('exception', this.onLoad, this);\n        }else{\n            var um = this.el.getUpdater();\n            um.un('beforeupdate', this.onBeforeLoad, this);\n            um.un('update', this.onLoad, this);\n            um.un('failure', this.onLoad, this);\n        }\n    }\n};/**\n * @class Ext.slider.Thumb\n * @extends Object\n * Represents a single thumb element on a Slider. This would not usually be created manually and would instead\n * be created internally by an {@link Ext.slider.MultiSlider Ext.Slider}.\n */\nExt.slider.Thumb = Ext.extend(Object, {\n    \n    /**\n     * True while the thumb is in a drag operation\n     * @type Boolean\n     */\n    dragging: false,\n\n    /**\n     * @constructor\n     * @cfg {Ext.slider.MultiSlider} slider The Slider to render to (required)\n     */\n    constructor: function(config) {\n        /**\n         * @property slider\n         * @type Ext.slider.MultiSlider\n         * The slider this thumb is contained within\n         */\n        Ext.apply(this, config || {}, {\n            cls: 'x-slider-thumb',\n\n            /**\n             * @cfg {Boolean} constrain True to constrain the thumb so that it cannot overlap its siblings\n             */\n            constrain: false\n        });\n\n        Ext.slider.Thumb.superclass.constructor.call(this, config);\n\n        if (this.slider.vertical) {\n            Ext.apply(this, Ext.slider.Thumb.Vertical);\n        }\n    },\n\n    /**\n     * Renders the thumb into a slider\n     */\n    render: function() {\n        this.el = this.slider.innerEl.insertFirst({cls: this.cls});\n\n        this.initEvents();\n    },\n\n    /**\n     * Enables the thumb if it is currently disabled\n     */\n    enable: function() {\n        this.disabled = false;\n        this.el.removeClass(this.slider.disabledClass);\n    },\n\n    /**\n     * Disables the thumb if it is currently enabled\n     */\n    disable: function() {\n        this.disabled = true;\n        this.el.addClass(this.slider.disabledClass);\n    },\n\n    /**\n     * Sets up an Ext.dd.DragTracker for this thumb\n     */\n    initEvents: function() {\n        var el = this.el;\n\n        el.addClassOnOver('x-slider-thumb-over');\n\n        this.tracker = new Ext.dd.DragTracker({\n            onBeforeStart: this.onBeforeDragStart.createDelegate(this),\n            onStart      : this.onDragStart.createDelegate(this),\n            onDrag       : this.onDrag.createDelegate(this),\n            onEnd        : this.onDragEnd.createDelegate(this),\n            tolerance    : 3,\n            autoStart    : 300\n        });\n\n        this.tracker.initEl(el);\n    },\n\n    /**\n     * @private\n     * This is tied into the internal Ext.dd.DragTracker. If the slider is currently disabled,\n     * this returns false to disable the DragTracker too.\n     * @return {Boolean} False if the slider is currently disabled\n     */\n    onBeforeDragStart : function(e) {\n        if (this.disabled) {\n            return false;\n        } else {\n            this.slider.promoteThumb(this);\n            return true;\n        }\n    },\n\n    /**\n     * @private\n     * This is tied into the internal Ext.dd.DragTracker's onStart template method. Adds the drag CSS class\n     * to the thumb and fires the 'dragstart' event\n     */\n    onDragStart: function(e){\n        this.el.addClass('x-slider-thumb-drag');\n        this.dragging = true;\n        this.dragStartValue = this.value;\n\n        this.slider.fireEvent('dragstart', this.slider, e, this);\n    },\n\n    /**\n     * @private\n     * This is tied into the internal Ext.dd.DragTracker's onDrag template method. This is called every time\n     * the DragTracker detects a drag movement. It updates the Slider's value using the position of the drag\n     */\n    onDrag: function(e) {\n        var slider   = this.slider,\n            index    = this.index,\n            newValue = this.getNewValue();\n\n        if (this.constrain) {\n            var above = slider.thumbs[index + 1],\n                below = slider.thumbs[index - 1];\n\n            if (below != undefined && newValue <= below.value) newValue = below.value;\n            if (above != undefined && newValue >= above.value) newValue = above.value;\n        }\n\n        slider.setValue(index, newValue, false);\n        slider.fireEvent('drag', slider, e, this);\n    },\n\n    getNewValue: function() {\n        var slider   = this.slider,\n            pos      = slider.innerEl.translatePoints(this.tracker.getXY());\n\n        return Ext.util.Format.round(slider.reverseValue(pos.left), slider.decimalPrecision);\n    },\n\n    /**\n     * @private\n     * This is tied to the internal Ext.dd.DragTracker's onEnd template method. Removes the drag CSS class and\n     * fires the 'changecomplete' event with the new value\n     */\n    onDragEnd: function(e) {\n        var slider = this.slider,\n            value  = this.value;\n\n        this.el.removeClass('x-slider-thumb-drag');\n\n        this.dragging = false;\n        slider.fireEvent('dragend', slider, e);\n\n        if (this.dragStartValue != value) {\n            slider.fireEvent('changecomplete', slider, value, this);\n        }\n    },\n    \n    /**\n     * @private\n     * Destroys the thumb\n     */\n    destroy: function(){\n        Ext.destroyMembers(this, 'tracker', 'el');\n    }\n});\n\n/**\n * @class Ext.slider.MultiSlider\n * @extends Ext.BoxComponent\n * Slider which supports vertical or horizontal orientation, keyboard adjustments, configurable snapping, axis clicking and animation. Can be added as an item to any container. Example usage:\n<pre>\nnew Ext.Slider({\n    renderTo: Ext.getBody(),\n    width: 200,\n    value: 50,\n    increment: 10,\n    minValue: 0,\n    maxValue: 100\n});\n</pre>\n * Sliders can be created with more than one thumb handle by passing an array of values instead of a single one:\n<pre>\nnew Ext.Slider({\n    renderTo: Ext.getBody(),\n    width: 200,\n    values: [25, 50, 75],\n    minValue: 0,\n    maxValue: 100,\n\n    //this defaults to true, setting to false allows the thumbs to pass each other\n    {@link #constrainThumbs}: false\n});\n</pre>\n */\nExt.slider.MultiSlider = Ext.extend(Ext.BoxComponent, {\n    /**\n     * @cfg {Number} value The value to initialize the slider with. Defaults to minValue.\n     */\n    /**\n     * @cfg {Boolean} vertical Orient the Slider vertically rather than horizontally, defaults to false.\n     */\n    vertical: false,\n    /**\n     * @cfg {Number} minValue The minimum value for the Slider. Defaults to 0.\n     */\n    minValue: 0,\n    /**\n     * @cfg {Number} maxValue The maximum value for the Slider. Defaults to 100.\n     */\n    maxValue: 100,\n    /**\n     * @cfg {Number/Boolean} decimalPrecision.\n     * <p>The number of decimal places to which to round the Slider's value. Defaults to 0.</p>\n     * <p>To disable rounding, configure as <tt><b>false</b></tt>.</p>\n     */\n    decimalPrecision: 0,\n    /**\n     * @cfg {Number} keyIncrement How many units to change the Slider when adjusting with keyboard navigation. Defaults to 1. If the increment config is larger, it will be used instead.\n     */\n    keyIncrement: 1,\n    /**\n     * @cfg {Number} increment How many units to change the slider when adjusting by drag and drop. Use this option to enable 'snapping'.\n     */\n    increment: 0,\n\n    /**\n     * @private\n     * @property clickRange\n     * @type Array\n     * Determines whether or not a click to the slider component is considered to be a user request to change the value. Specified as an array of [top, bottom],\n     * the click event's 'top' property is compared to these numbers and the click only considered a change request if it falls within them. e.g. if the 'top'\n     * value of the click event is 4 or 16, the click is not considered a change request as it falls outside of the [5, 15] range\n     */\n    clickRange: [5,15],\n\n    /**\n     * @cfg {Boolean} clickToChange Determines whether or not clicking on the Slider axis will change the slider. Defaults to true\n     */\n    clickToChange : true,\n    /**\n     * @cfg {Boolean} animate Turn on or off animation. Defaults to true\n     */\n    animate: true,\n    /**\n     * @cfg {Boolean} constrainThumbs True to disallow thumbs from overlapping one another. Defaults to true\n     */\n    constrainThumbs: true,\n\n    /**\n     * @private\n     * @property topThumbZIndex\n     * @type Number\n     * The number used internally to set the z index of the top thumb (see promoteThumb for details)\n     */\n    topThumbZIndex: 10000,\n\n    // private override\n    initComponent : function(){\n        if(!Ext.isDefined(this.value)){\n            this.value = this.minValue;\n        }\n\n        /**\n         * @property thumbs\n         * @type Array\n         * Array containing references to each thumb\n         */\n        this.thumbs = [];\n\n        Ext.slider.MultiSlider.superclass.initComponent.call(this);\n\n        this.keyIncrement = Math.max(this.increment, this.keyIncrement);\n        this.addEvents(\n            /**\n             * @event beforechange\n             * Fires before the slider value is changed. By returning false from an event handler,\n             * you can cancel the event and prevent the slider from changing.\n             * @param {Ext.slider.MultiSlider} slider The slider\n             * @param {Number} newValue The new value which the slider is being changed to.\n             * @param {Number} oldValue The old value which the slider was previously.\n             */\n            'beforechange',\n\n            /**\n             * @event change\n             * Fires when the slider value is changed.\n             * @param {Ext.slider.MultiSlider} slider The slider\n             * @param {Number} newValue The new value which the slider has been changed to.\n             * @param {Ext.slider.Thumb} thumb The thumb that was changed\n             */\n            'change',\n\n            /**\n             * @event changecomplete\n             * Fires when the slider value is changed by the user and any drag operations have completed.\n             * @param {Ext.slider.MultiSlider} slider The slider\n             * @param {Number} newValue The new value which the slider has been changed to.\n             * @param {Ext.slider.Thumb} thumb The thumb that was changed\n             */\n            'changecomplete',\n\n            /**\n             * @event dragstart\n             * Fires after a drag operation has started.\n             * @param {Ext.slider.MultiSlider} slider The slider\n             * @param {Ext.EventObject} e The event fired from Ext.dd.DragTracker\n             */\n            'dragstart',\n\n            /**\n             * @event drag\n             * Fires continuously during the drag operation while the mouse is moving.\n             * @param {Ext.slider.MultiSlider} slider The slider\n             * @param {Ext.EventObject} e The event fired from Ext.dd.DragTracker\n             */\n            'drag',\n\n            /**\n             * @event dragend\n             * Fires after the drag operation has completed.\n             * @param {Ext.slider.MultiSlider} slider The slider\n             * @param {Ext.EventObject} e The event fired from Ext.dd.DragTracker\n             */\n            'dragend'\n        );\n\n        /**\n         * @property values\n         * @type Array\n         * Array of values to initalize the thumbs with\n         */\n        if (this.values == undefined || Ext.isEmpty(this.values)) this.values = [0];\n\n        var values = this.values;\n\n        for (var i=0; i < values.length; i++) {\n            this.addThumb(values[i]);\n        }\n\n        if(this.vertical){\n            Ext.apply(this, Ext.slider.Vertical);\n        }\n    },\n\n    /**\n     * Creates a new thumb and adds it to the slider\n     * @param {Number} value The initial value to set on the thumb. Defaults to 0\n     */\n    addThumb: function(value) {\n        var thumb = new Ext.slider.Thumb({\n            value    : value,\n            slider   : this,\n            index    : this.thumbs.length,\n            constrain: this.constrainThumbs\n        });\n        this.thumbs.push(thumb);\n\n        //render the thumb now if needed\n        if (this.rendered) thumb.render();\n    },\n\n    /**\n     * @private\n     * Moves the given thumb above all other by increasing its z-index. This is called when as drag\n     * any thumb, so that the thumb that was just dragged is always at the highest z-index. This is\n     * required when the thumbs are stacked on top of each other at one of the ends of the slider's\n     * range, which can result in the user not being able to move any of them.\n     * @param {Ext.slider.Thumb} topThumb The thumb to move to the top\n     */\n    promoteThumb: function(topThumb) {\n        var thumbs = this.thumbs,\n            zIndex, thumb;\n\n        for (var i = 0, j = thumbs.length; i < j; i++) {\n            thumb = thumbs[i];\n\n            if (thumb == topThumb) {\n                zIndex = this.topThumbZIndex;\n            } else {\n                zIndex = '';\n            }\n\n            thumb.el.setStyle('zIndex', zIndex);\n        }\n    },\n\n    // private override\n    onRender : function() {\n        this.autoEl = {\n            cls: 'x-slider ' + (this.vertical ? 'x-slider-vert' : 'x-slider-horz'),\n            cn : {\n                cls: 'x-slider-end',\n                cn : {\n                    cls:'x-slider-inner',\n                    cn : [{tag:'a', cls:'x-slider-focus', href:\"#\", tabIndex: '-1', hidefocus:'on'}]\n                }\n            }\n        };\n\n        Ext.slider.MultiSlider.superclass.onRender.apply(this, arguments);\n\n        this.endEl   = this.el.first();\n        this.innerEl = this.endEl.first();\n        this.focusEl = this.innerEl.child('.x-slider-focus');\n\n        //render each thumb\n        for (var i=0; i < this.thumbs.length; i++) {\n            this.thumbs[i].render();\n        }\n\n        //calculate the size of half a thumb\n        var thumb      = this.innerEl.child('.x-slider-thumb');\n        this.halfThumb = (this.vertical ? thumb.getHeight() : thumb.getWidth()) / 2;\n\n        this.initEvents();\n    },\n\n    /**\n     * @private\n     * Adds keyboard and mouse listeners on this.el. Ignores click events on the internal focus element.\n     * Creates a new DragTracker which is used to control what happens when the user drags the thumb around.\n     */\n    initEvents : function(){\n        this.mon(this.el, {\n            scope    : this,\n            mousedown: this.onMouseDown,\n            keydown  : this.onKeyDown\n        });\n\n        this.focusEl.swallowEvent(\"click\", true);\n    },\n\n    /**\n     * @private\n     * Mousedown handler for the slider. If the clickToChange is enabled and the click was not on the draggable 'thumb',\n     * this calculates the new value of the slider and tells the implementation (Horizontal or Vertical) to move the thumb\n     * @param {Ext.EventObject} e The click event\n     */\n    onMouseDown : function(e){\n        if(this.disabled){\n            return;\n        }\n\n        //see if the click was on any of the thumbs\n        var thumbClicked = false;\n        for (var i=0; i < this.thumbs.length; i++) {\n            thumbClicked = thumbClicked || e.target == this.thumbs[i].el.dom;\n        }\n\n        if (this.clickToChange && !thumbClicked) {\n            var local = this.innerEl.translatePoints(e.getXY());\n            this.onClickChange(local);\n        }\n        this.focus();\n    },\n\n    /**\n     * @private\n     * Moves the thumb to the indicated position. Note that a Vertical implementation is provided in Ext.slider.Vertical.\n     * Only changes the value if the click was within this.clickRange.\n     * @param {Object} local Object containing top and left values for the click event.\n     */\n    onClickChange : function(local) {\n        if (local.top > this.clickRange[0] && local.top < this.clickRange[1]) {\n            //find the nearest thumb to the click event\n            var thumb = this.getNearest(local, 'left'),\n                index = thumb.index;\n\n            this.setValue(index, Ext.util.Format.round(this.reverseValue(local.left), this.decimalPrecision), undefined, true);\n        }\n    },\n\n    /**\n     * @private\n     * Returns the nearest thumb to a click event, along with its distance\n     * @param {Object} local Object containing top and left values from a click event\n     * @param {String} prop The property of local to compare on. Use 'left' for horizontal sliders, 'top' for vertical ones\n     * @return {Object} The closest thumb object and its distance from the click event\n     */\n    getNearest: function(local, prop) {\n        var localValue = prop == 'top' ? this.innerEl.getHeight() - local[prop] : local[prop],\n            clickValue = this.reverseValue(localValue),\n            nearestDistance = (this.maxValue - this.minValue) + 5, //add a small fudge for the end of the slider \n            index = 0,\n            nearest = null;\n\n        for (var i=0; i < this.thumbs.length; i++) {\n            var thumb = this.thumbs[i],\n                value = thumb.value,\n                dist  = Math.abs(value - clickValue);\n\n            if (Math.abs(dist <= nearestDistance)) {\n                nearest = thumb;\n                index = i;\n                nearestDistance = dist;\n            }\n        }\n        return nearest;\n    },\n\n    /**\n     * @private\n     * Handler for any keypresses captured by the slider. If the key is UP or RIGHT, the thumb is moved along to the right\n     * by this.keyIncrement. If DOWN or LEFT it is moved left. Pressing CTRL moves the slider to the end in either direction\n     * @param {Ext.EventObject} e The Event object\n     */\n    onKeyDown : function(e){\n        /*\n         * The behaviour for keyboard handling with multiple thumbs is currently undefined.\n         * There's no real sane default for it, so leave it like this until we come up\n         * with a better way of doing it.\n         */\n        if(this.disabled || this.thumbs.length !== 1){\n            e.preventDefault();\n            return;\n        }\n        var k = e.getKey(),\n            val;\n        switch(k){\n            case e.UP:\n            case e.RIGHT:\n                e.stopEvent();\n                val = e.ctrlKey ? this.maxValue : this.getValue(0) + this.keyIncrement;\n                this.setValue(0, val, undefined, true);\n            break;\n            case e.DOWN:\n            case e.LEFT:\n                e.stopEvent();\n                val = e.ctrlKey ? this.minValue : this.getValue(0) - this.keyIncrement;\n                this.setValue(0, val, undefined, true);\n            break;\n            default:\n                e.preventDefault();\n        }\n    },\n\n    /**\n     * @private\n     * If using snapping, this takes a desired new value and returns the closest snapped\n     * value to it\n     * @param {Number} value The unsnapped value\n     * @return {Number} The value of the nearest snap target\n     */\n    doSnap : function(value){\n        if (!(this.increment && value)) {\n            return value;\n        }\n        var newValue = value,\n            inc = this.increment,\n            m = value % inc;\n        if (m != 0) {\n            newValue -= m;\n            if (m * 2 >= inc) {\n                newValue += inc;\n            } else if (m * 2 < -inc) {\n                newValue -= inc;\n            }\n        }\n        return newValue.constrain(this.minValue,  this.maxValue);\n    },\n\n    // private\n    afterRender : function(){\n        Ext.slider.MultiSlider.superclass.afterRender.apply(this, arguments);\n\n        for (var i=0; i < this.thumbs.length; i++) {\n            var thumb = this.thumbs[i];\n\n            if (thumb.value !== undefined) {\n                var v = this.normalizeValue(thumb.value);\n\n                if (v !== thumb.value) {\n                    // delete this.value;\n                    this.setValue(i, v, false);\n                } else {\n                    this.moveThumb(i, this.translateValue(v), false);\n                }\n            }\n        };\n    },\n\n    /**\n     * @private\n     * Returns the ratio of pixels to mapped values. e.g. if the slider is 200px wide and maxValue - minValue is 100,\n     * the ratio is 2\n     * @return {Number} The ratio of pixels to mapped values\n     */\n    getRatio : function(){\n        var w = this.innerEl.getWidth(),\n            v = this.maxValue - this.minValue;\n        return v == 0 ? w : (w/v);\n    },\n\n    /**\n     * @private\n     * Returns a snapped, constrained value when given a desired value\n     * @param {Number} value Raw number value\n     * @return {Number} The raw value rounded to the correct d.p. and constrained within the set max and min values\n     */\n    normalizeValue : function(v){\n        v = this.doSnap(v);\n        v = Ext.util.Format.round(v, this.decimalPrecision);\n        v = v.constrain(this.minValue, this.maxValue);\n        return v;\n    },\n\n    /**\n     * Sets the minimum value for the slider instance. If the current value is less than the\n     * minimum value, the current value will be changed.\n     * @param {Number} val The new minimum value\n     */\n    setMinValue : function(val){\n        this.minValue = val;\n        var i = 0,\n            thumbs = this.thumbs,\n            len = thumbs.length,\n            t;\n            \n        for(; i < len; ++i){\n            t = thumbs[i];\n            t.value = t.value < val ? val : t.value;\n        }\n        this.syncThumb();\n    },\n\n    /**\n     * Sets the maximum value for the slider instance. If the current value is more than the\n     * maximum value, the current value will be changed.\n     * @param {Number} val The new maximum value\n     */\n    setMaxValue : function(val){\n        this.maxValue = val;\n        var i = 0,\n            thumbs = this.thumbs,\n            len = thumbs.length,\n            t;\n            \n        for(; i < len; ++i){\n            t = thumbs[i];\n            t.value = t.value > val ? val : t.value;\n        }\n        this.syncThumb();\n    },\n\n    /**\n     * Programmatically sets the value of the Slider. Ensures that the value is constrained within\n     * the minValue and maxValue.\n     * @param {Number} index Index of the thumb to move\n     * @param {Number} value The value to set the slider to. (This will be constrained within minValue and maxValue)\n     * @param {Boolean} animate Turn on or off animation, defaults to true\n     */\n    setValue : function(index, v, animate, changeComplete) {\n        var thumb = this.thumbs[index],\n            el    = thumb.el;\n\n        v = this.normalizeValue(v);\n\n        if (v !== thumb.value && this.fireEvent('beforechange', this, v, thumb.value, thumb) !== false) {\n            thumb.value = v;\n            if(this.rendered){\n                this.moveThumb(index, this.translateValue(v), animate !== false);\n                this.fireEvent('change', this, v, thumb);\n                if(changeComplete){\n                    this.fireEvent('changecomplete', this, v, thumb);\n                }\n            }\n        }\n    },\n\n    /**\n     * @private\n     */\n    translateValue : function(v) {\n        var ratio = this.getRatio();\n        return (v * ratio) - (this.minValue * ratio) - this.halfThumb;\n    },\n\n    /**\n     * @private\n     * Given a pixel location along the slider, returns the mapped slider value for that pixel.\n     * E.g. if we have a slider 200px wide with minValue = 100 and maxValue = 500, reverseValue(50)\n     * returns 200\n     * @param {Number} pos The position along the slider to return a mapped value for\n     * @return {Number} The mapped value for the given position\n     */\n    reverseValue : function(pos){\n        var ratio = this.getRatio();\n        return (pos + (this.minValue * ratio)) / ratio;\n    },\n\n    /**\n     * @private\n     * @param {Number} index Index of the thumb to move\n     */\n    moveThumb: function(index, v, animate){\n        var thumb = this.thumbs[index].el;\n\n        if(!animate || this.animate === false){\n            thumb.setLeft(v);\n        }else{\n            thumb.shift({left: v, stopFx: true, duration:.35});\n        }\n    },\n\n    // private\n    focus : function(){\n        this.focusEl.focus(10);\n    },\n\n    // private\n    onResize : function(w, h){\n        var thumbs = this.thumbs,\n            len = thumbs.length,\n            i = 0;\n            \n        /*\n         * If we happen to be animating during a resize, the position of the thumb will likely be off\n         * when the animation stops. As such, just stop any animations before syncing the thumbs.\n         */\n        for(; i < len; ++i){\n            thumbs[i].el.stopFx();    \n        }\n        // check to see if we're using an auto width\n        if(Ext.isNumber(w)){\n            this.innerEl.setWidth(w - (this.el.getPadding('l') + this.endEl.getPadding('r')));\n        }\n        this.syncThumb();\n        Ext.slider.MultiSlider.superclass.onResize.apply(this, arguments);\n    },\n\n    //private\n    onDisable: function(){\n        Ext.slider.MultiSlider.superclass.onDisable.call(this);\n\n        for (var i=0; i < this.thumbs.length; i++) {\n            var thumb = this.thumbs[i],\n                el    = thumb.el;\n\n            thumb.disable();\n\n            if(Ext.isIE){\n                //IE breaks when using overflow visible and opacity other than 1.\n                //Create a place holder for the thumb and display it.\n                var xy = el.getXY();\n                el.hide();\n\n                this.innerEl.addClass(this.disabledClass).dom.disabled = true;\n\n                if (!this.thumbHolder) {\n                    this.thumbHolder = this.endEl.createChild({cls: 'x-slider-thumb ' + this.disabledClass});\n                }\n\n                this.thumbHolder.show().setXY(xy);\n            }\n        }\n    },\n\n    //private\n    onEnable: function(){\n        Ext.slider.MultiSlider.superclass.onEnable.call(this);\n\n        for (var i=0; i < this.thumbs.length; i++) {\n            var thumb = this.thumbs[i],\n                el    = thumb.el;\n\n            thumb.enable();\n\n            if (Ext.isIE) {\n                this.innerEl.removeClass(this.disabledClass).dom.disabled = false;\n\n                if (this.thumbHolder) this.thumbHolder.hide();\n\n                el.show();\n                this.syncThumb();\n            }\n        }\n    },\n\n    /**\n     * Synchronizes the thumb position to the proper proportion of the total component width based\n     * on the current slider {@link #value}.  This will be called automatically when the Slider\n     * is resized by a layout, but if it is rendered auto width, this method can be called from\n     * another resize handler to sync the Slider if necessary.\n     */\n    syncThumb : function() {\n        if (this.rendered) {\n            for (var i=0; i < this.thumbs.length; i++) {\n                this.moveThumb(i, this.translateValue(this.thumbs[i].value));\n            }\n        }\n    },\n\n    /**\n     * Returns the current value of the slider\n     * @param {Number} index The index of the thumb to return a value for\n     * @return {Number} The current value of the slider\n     */\n    getValue : function(index) {\n        return this.thumbs[index].value;\n    },\n\n    /**\n     * Returns an array of values - one for the location of each thumb\n     * @return {Array} The set of thumb values\n     */\n    getValues: function() {\n        var values = [];\n\n        for (var i=0; i < this.thumbs.length; i++) {\n            values.push(this.thumbs[i].value);\n        }\n\n        return values;\n    },\n\n    // private\n    beforeDestroy : function(){\n        var thumbs = this.thumbs;\n        for(var i = 0, len = thumbs.length; i < len; ++i){\n            thumbs[i].destroy();\n            thumbs[i] = null;\n        }\n        Ext.destroyMembers(this, 'endEl', 'innerEl', 'focusEl', 'thumbHolder');\n        Ext.slider.MultiSlider.superclass.beforeDestroy.call(this);\n    }\n});\n\nExt.reg('multislider', Ext.slider.MultiSlider);\n\n/**\n * @class Ext.slider.SingleSlider\n * @extends Ext.slider.MultiSlider\n * Slider which supports vertical or horizontal orientation, keyboard adjustments,\n * configurable snapping, axis clicking and animation. Can be added as an item to\n * any container. Example usage:\n<pre><code>\nnew Ext.slider.SingleSlider({\n    renderTo: Ext.getBody(),\n    width: 200,\n    value: 50,\n    increment: 10,\n    minValue: 0,\n    maxValue: 100\n});\n</code></pre>\n * The class Ext.slider.SingleSlider is aliased to Ext.Slider for backwards compatibility.\n */\nExt.slider.SingleSlider = Ext.extend(Ext.slider.MultiSlider, {\n    constructor: function(config) {\n      config = config || {};\n\n      Ext.applyIf(config, {\n          values: [config.value || 0]\n      });\n\n      Ext.slider.SingleSlider.superclass.constructor.call(this, config);\n    },\n\n    /**\n     * Returns the current value of the slider\n     * @return {Number} The current value of the slider\n     */\n    getValue: function() {\n        //just returns the value of the first thumb, which should be the only one in a single slider\n        return Ext.slider.SingleSlider.superclass.getValue.call(this, 0);\n    },\n\n    /**\n     * Programmatically sets the value of the Slider. Ensures that the value is constrained within\n     * the minValue and maxValue.\n     * @param {Number} value The value to set the slider to. (This will be constrained within minValue and maxValue)\n     * @param {Boolean} animate Turn on or off animation, defaults to true\n     */\n    setValue: function(value, animate) {\n        var args = Ext.toArray(arguments),\n            len  = args.length;\n\n        //this is to maintain backwards compatiblity for sliders with only one thunb. Usually you must pass the thumb\n        //index to setValue, but if we only have one thumb we inject the index here first if given the multi-slider\n        //signature without the required index. The index will always be 0 for a single slider\n        if (len == 1 || (len <= 3 && typeof arguments[1] != 'number')) {\n            args.unshift(0);\n        }\n\n        return Ext.slider.SingleSlider.superclass.setValue.apply(this, args);\n    },\n\n    /**\n     * Synchronizes the thumb position to the proper proportion of the total component width based\n     * on the current slider {@link #value}.  This will be called automatically when the Slider\n     * is resized by a layout, but if it is rendered auto width, this method can be called from\n     * another resize handler to sync the Slider if necessary.\n     */\n    syncThumb : function() {\n        return Ext.slider.SingleSlider.superclass.syncThumb.apply(this, [0].concat(arguments));\n    },\n    \n    // private\n    getNearest : function(){\n        // Since there's only 1 thumb, it's always the nearest\n        return this.thumbs[0];    \n    }\n});\n\n//backwards compatibility\nExt.Slider = Ext.slider.SingleSlider;\n\nExt.reg('slider', Ext.slider.SingleSlider);\n\n// private class to support vertical sliders\nExt.slider.Vertical = {\n    onResize : function(w, h){\n        this.innerEl.setHeight(h - (this.el.getPadding('t') + this.endEl.getPadding('b')));\n        this.syncThumb();\n    },\n\n    getRatio : function(){\n        var h = this.innerEl.getHeight(),\n            v = this.maxValue - this.minValue;\n        return h/v;\n    },\n\n    moveThumb: function(index, v, animate) {\n        var thumb = this.thumbs[index],\n            el    = thumb.el;\n\n        if (!animate || this.animate === false) {\n            el.setBottom(v);\n        } else {\n            el.shift({bottom: v, stopFx: true, duration:.35});\n        }\n    },\n\n    onClickChange : function(local) {\n        if (local.left > this.clickRange[0] && local.left < this.clickRange[1]) {\n            var thumb = this.getNearest(local, 'top'),\n                index = thumb.index,\n                value = this.minValue + this.reverseValue(this.innerEl.getHeight() - local.top);\n\n            this.setValue(index, Ext.util.Format.round(value, this.decimalPrecision), undefined, true);\n        }\n    }\n};\n\n//private class to support vertical dragging of thumbs within a slider\nExt.slider.Thumb.Vertical = {\n    getNewValue: function() {\n        var slider   = this.slider,\n            innerEl  = slider.innerEl,\n            pos      = innerEl.translatePoints(this.tracker.getXY()),\n            bottom   = innerEl.getHeight() - pos.top;\n\n        return slider.minValue + Ext.util.Format.round(bottom / slider.getRatio(), slider.decimalPrecision);\n    }\n};\n/**\n * @class Ext.ProgressBar\n * @extends Ext.BoxComponent\n * <p>An updateable progress bar component.  The progress bar supports two different modes: manual and automatic.</p>\n * <p>In manual mode, you are responsible for showing, updating (via {@link #updateProgress}) and clearing the\n * progress bar as needed from your own code.  This method is most appropriate when you want to show progress\n * throughout an operation that has predictable points of interest at which you can update the control.</p>\n * <p>In automatic mode, you simply call {@link #wait} and let the progress bar run indefinitely, only clearing it\n * once the operation is complete.  You can optionally have the progress bar wait for a specific amount of time\n * and then clear itself.  Automatic mode is most appropriate for timed operations or asynchronous operations in\n * which you have no need for indicating intermediate progress.</p>\n * @cfg {Float} value A floating point value between 0 and 1 (e.g., .5, defaults to 0)\n * @cfg {String} text The progress bar text (defaults to '')\n * @cfg {Mixed} textEl The element to render the progress text to (defaults to the progress\n * bar's internal text element)\n * @cfg {String} id The progress bar element's id (defaults to an auto-generated id)\n * @xtype progress\n */\nExt.ProgressBar = Ext.extend(Ext.BoxComponent, {\n   /**\n    * @cfg {String} baseCls\n    * The base CSS class to apply to the progress bar's wrapper element (defaults to 'x-progress')\n    */\n    baseCls : 'x-progress',\n    \n    /**\n    * @cfg {Boolean} animate\n    * True to animate the progress bar during transitions (defaults to false)\n    */\n    animate : false,\n\n    // private\n    waitTimer : null,\n\n    // private\n    initComponent : function(){\n        Ext.ProgressBar.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event update\n             * Fires after each update interval\n             * @param {Ext.ProgressBar} this\n             * @param {Number} value  The current progress value\n             * @param {String} text The current progress text\n             */\n            \"update\"\n        );\n    },\n\n    // private\n    onRender : function(ct, position){\n        var tpl = new Ext.Template(\n            '<div class=\"{cls}-wrap\">',\n                '<div class=\"{cls}-inner\">',\n                    '<div class=\"{cls}-bar\">',\n                        '<div class=\"{cls}-text\">',\n                            '<div>&#160;</div>',\n                        '</div>',\n                    '</div>',\n                    '<div class=\"{cls}-text {cls}-text-back\">',\n                        '<div>&#160;</div>',\n                    '</div>',\n                '</div>',\n            '</div>'\n        );\n\n        this.el = position ? tpl.insertBefore(position, {cls: this.baseCls}, true)\n            : tpl.append(ct, {cls: this.baseCls}, true);\n                \n        if(this.id){\n            this.el.dom.id = this.id;\n        }\n        var inner = this.el.dom.firstChild;\n        this.progressBar = Ext.get(inner.firstChild);\n\n        if(this.textEl){\n            //use an external text el\n            this.textEl = Ext.get(this.textEl);\n            delete this.textTopEl;\n        }else{\n            //setup our internal layered text els\n            this.textTopEl = Ext.get(this.progressBar.dom.firstChild);\n            var textBackEl = Ext.get(inner.childNodes[1]);\n            this.textTopEl.setStyle(\"z-index\", 99).addClass('x-hidden');\n            this.textEl = new Ext.CompositeElement([this.textTopEl.dom.firstChild, textBackEl.dom.firstChild]);\n            this.textEl.setWidth(inner.offsetWidth);\n        }\n        this.progressBar.setHeight(inner.offsetHeight);\n    },\n    \n    // private\n    afterRender : function(){\n        Ext.ProgressBar.superclass.afterRender.call(this);\n        if(this.value){\n            this.updateProgress(this.value, this.text);\n        }else{\n            this.updateText(this.text);\n        }\n    },\n\n    /**\n     * Updates the progress bar value, and optionally its text.  If the text argument is not specified,\n     * any existing text value will be unchanged.  To blank out existing text, pass ''.  Note that even\n     * if the progress bar value exceeds 1, it will never automatically reset -- you are responsible for\n     * determining when the progress is complete and calling {@link #reset} to clear and/or hide the control.\n     * @param {Float} value (optional) A floating point value between 0 and 1 (e.g., .5, defaults to 0)\n     * @param {String} text (optional) The string to display in the progress text element (defaults to '')\n     * @param {Boolean} animate (optional) Whether to animate the transition of the progress bar. If this value is\n     * not specified, the default for the class is used (default to false)\n     * @return {Ext.ProgressBar} this\n     */\n    updateProgress : function(value, text, animate){\n        this.value = value || 0;\n        if(text){\n            this.updateText(text);\n        }\n        if(this.rendered && !this.isDestroyed){\n            var w = Math.floor(value*this.el.dom.firstChild.offsetWidth);\n            this.progressBar.setWidth(w, animate === true || (animate !== false && this.animate));\n            if(this.textTopEl){\n                //textTopEl should be the same width as the bar so overflow will clip as the bar moves\n                this.textTopEl.removeClass('x-hidden').setWidth(w);\n            }\n        }\n        this.fireEvent('update', this, value, text);\n        return this;\n    },\n\n    /**\n     * Initiates an auto-updating progress bar.  A duration can be specified, in which case the progress\n     * bar will automatically reset after a fixed amount of time and optionally call a callback function\n     * if specified.  If no duration is passed in, then the progress bar will run indefinitely and must\n     * be manually cleared by calling {@link #reset}.  The wait method accepts a config object with\n     * the following properties:\n     * <pre>\nProperty   Type          Description\n---------- ------------  ----------------------------------------------------------------------\nduration   Number        The length of time in milliseconds that the progress bar should\n                         run before resetting itself (defaults to undefined, in which case it\n                         will run indefinitely until reset is called)\ninterval   Number        The length of time in milliseconds between each progress update\n                         (defaults to 1000 ms)\nanimate    Boolean       Whether to animate the transition of the progress bar. If this value is\n                         not specified, the default for the class is used.                                                   \nincrement  Number        The number of progress update segments to display within the progress\n                         bar (defaults to 10).  If the bar reaches the end and is still\n                         updating, it will automatically wrap back to the beginning.\ntext       String        Optional text to display in the progress bar element (defaults to '').\nfn         Function      A callback function to execute after the progress bar finishes auto-\n                         updating.  The function will be called with no arguments.  This function\n                         will be ignored if duration is not specified since in that case the\n                         progress bar can only be stopped programmatically, so any required function\n                         should be called by the same code after it resets the progress bar.\nscope      Object        The scope that is passed to the callback function (only applies when\n                         duration and fn are both passed).\n</pre>\n         *\n         * Example usage:\n         * <pre><code>\nvar p = new Ext.ProgressBar({\n   renderTo: 'my-el'\n});\n\n//Wait for 5 seconds, then update the status el (progress bar will auto-reset)\np.wait({\n   interval: 100, //bar will move fast!\n   duration: 5000,\n   increment: 15,\n   text: 'Updating...',\n   scope: this,\n   fn: function(){\n      Ext.fly('status').update('Done!');\n   }\n});\n\n//Or update indefinitely until some async action completes, then reset manually\np.wait();\nmyAction.on('complete', function(){\n    p.reset();\n    Ext.fly('status').update('Done!');\n});\n</code></pre>\n     * @param {Object} config (optional) Configuration options\n     * @return {Ext.ProgressBar} this\n     */\n    wait : function(o){\n        if(!this.waitTimer){\n            var scope = this;\n            o = o || {};\n            this.updateText(o.text);\n            this.waitTimer = Ext.TaskMgr.start({\n                run: function(i){\n                    var inc = o.increment || 10;\n                    i -= 1;\n                    this.updateProgress(((((i+inc)%inc)+1)*(100/inc))*0.01, null, o.animate);\n                },\n                interval: o.interval || 1000,\n                duration: o.duration,\n                onStop: function(){\n                    if(o.fn){\n                        o.fn.apply(o.scope || this);\n                    }\n                    this.reset();\n                },\n                scope: scope\n            });\n        }\n        return this;\n    },\n\n    /**\n     * Returns true if the progress bar is currently in a {@link #wait} operation\n     * @return {Boolean} True if waiting, else false\n     */\n    isWaiting : function(){\n        return this.waitTimer !== null;\n    },\n\n    /**\n     * Updates the progress bar text.  If specified, textEl will be updated, otherwise the progress\n     * bar itself will display the updated text.\n     * @param {String} text (optional) The string to display in the progress text element (defaults to '')\n     * @return {Ext.ProgressBar} this\n     */\n    updateText : function(text){\n        this.text = text || '&#160;';\n        if(this.rendered){\n            this.textEl.update(this.text);\n        }\n        return this;\n    },\n    \n    /**\n     * Synchronizes the inner bar width to the proper proportion of the total componet width based\n     * on the current progress {@link #value}.  This will be called automatically when the ProgressBar\n     * is resized by a layout, but if it is rendered auto width, this method can be called from\n     * another resize handler to sync the ProgressBar if necessary.\n     */\n    syncProgressBar : function(){\n        if(this.value){\n            this.updateProgress(this.value, this.text);\n        }\n        return this;\n    },\n\n    /**\n     * Sets the size of the progress bar.\n     * @param {Number} width The new width in pixels\n     * @param {Number} height The new height in pixels\n     * @return {Ext.ProgressBar} this\n     */\n    setSize : function(w, h){\n        Ext.ProgressBar.superclass.setSize.call(this, w, h);\n        if(this.textTopEl){\n            var inner = this.el.dom.firstChild;\n            this.textEl.setSize(inner.offsetWidth, inner.offsetHeight);\n        }\n        this.syncProgressBar();\n        return this;\n    },\n\n    /**\n     * Resets the progress bar value to 0 and text to empty string.  If hide = true, the progress\n     * bar will also be hidden (using the {@link #hideMode} property internally).\n     * @param {Boolean} hide (optional) True to hide the progress bar (defaults to false)\n     * @return {Ext.ProgressBar} this\n     */\n    reset : function(hide){\n        this.updateProgress(0);\n        if(this.textTopEl){\n            this.textTopEl.addClass('x-hidden');\n        }\n        this.clearTimer();\n        if(hide === true){\n            this.hide();\n        }\n        return this;\n    },\n    \n    // private\n    clearTimer : function(){\n        if(this.waitTimer){\n            this.waitTimer.onStop = null; //prevent recursion\n            Ext.TaskMgr.stop(this.waitTimer);\n            this.waitTimer = null;\n        }\n    },\n    \n    onDestroy: function(){\n        this.clearTimer();\n        if(this.rendered){\n            if(this.textEl.isComposite){\n                this.textEl.clear();\n            }\n            Ext.destroyMembers(this, 'textEl', 'progressBar', 'textTopEl');\n        }\n        Ext.ProgressBar.superclass.onDestroy.call(this);\n    }\n});\nExt.reg('progress', Ext.ProgressBar);/*\n * These classes are derivatives of the similarly named classes in the YUI Library.\n * The original license:\n * Copyright (c) 2006, Yahoo! Inc. All rights reserved.\n * Code licensed under the BSD License:\n * http://developer.yahoo.net/yui/license.txt\n */\n\n(function() {\n\nvar Event=Ext.EventManager;\nvar Dom=Ext.lib.Dom;\n\n/**\n * @class Ext.dd.DragDrop\n * Defines the interface and base operation of items that that can be\n * dragged or can be drop targets.  It was designed to be extended, overriding\n * the event handlers for startDrag, onDrag, onDragOver and onDragOut.\n * Up to three html elements can be associated with a DragDrop instance:\n * <ul>\n * <li>linked element: the element that is passed into the constructor.\n * This is the element which defines the boundaries for interaction with\n * other DragDrop objects.</li>\n * <li>handle element(s): The drag operation only occurs if the element that\n * was clicked matches a handle element.  By default this is the linked\n * element, but there are times that you will want only a portion of the\n * linked element to initiate the drag operation, and the setHandleElId()\n * method provides a way to define this.</li>\n * <li>drag element: this represents the element that would be moved along\n * with the cursor during a drag operation.  By default, this is the linked\n * element itself as in {@link Ext.dd.DD}.  setDragElId() lets you define\n * a separate element that would be moved, as in {@link Ext.dd.DDProxy}.\n * </li>\n * </ul>\n * This class should not be instantiated until the onload event to ensure that\n * the associated elements are available.\n * The following would define a DragDrop obj that would interact with any\n * other DragDrop obj in the \"group1\" group:\n * <pre>\n *  dd = new Ext.dd.DragDrop(\"div1\", \"group1\");\n * </pre>\n * Since none of the event handlers have been implemented, nothing would\n * actually happen if you were to run the code above.  Normally you would\n * override this class or one of the default implementations, but you can\n * also override the methods you want on an instance of the class...\n * <pre>\n *  dd.onDragDrop = function(e, id) {\n *  &nbsp;&nbsp;alert(\"dd was dropped on \" + id);\n *  }\n * </pre>\n * @constructor\n * @param {String} id of the element that is linked to this instance\n * @param {String} sGroup the group of related DragDrop objects\n * @param {object} config an object containing configurable attributes\n *                Valid properties for DragDrop:\n *                    padding, isTarget, maintainOffset, primaryButtonOnly\n */\nExt.dd.DragDrop = function(id, sGroup, config) {\n    if(id) {\n        this.init(id, sGroup, config);\n    }\n};\n\nExt.dd.DragDrop.prototype = {\n\n    /**\n     * Set to false to enable a DragDrop object to fire drag events while dragging\n     * over its own Element. Defaults to true - DragDrop objects do not by default\n     * fire drag events to themselves.\n     * @property ignoreSelf\n     * @type Boolean\n     */\n\n    /**\n     * The id of the element associated with this object.  This is what we\n     * refer to as the \"linked element\" because the size and position of\n     * this element is used to determine when the drag and drop objects have\n     * interacted.\n     * @property id\n     * @type String\n     */\n    id: null,\n\n    /**\n     * Configuration attributes passed into the constructor\n     * @property config\n     * @type object\n     */\n    config: null,\n\n    /**\n     * The id of the element that will be dragged.  By default this is same\n     * as the linked element, but could be changed to another element. Ex:\n     * Ext.dd.DDProxy\n     * @property dragElId\n     * @type String\n     * @private\n     */\n    dragElId: null,\n\n    /**\n     * The ID of the element that initiates the drag operation.  By default\n     * this is the linked element, but could be changed to be a child of this\n     * element.  This lets us do things like only starting the drag when the\n     * header element within the linked html element is clicked.\n     * @property handleElId\n     * @type String\n     * @private\n     */\n    handleElId: null,\n\n    /**\n     * An object who's property names identify HTML tags to be considered invalid as drag handles.\n     * A non-null property value identifies the tag as invalid. Defaults to the \n     * following value which prevents drag operations from being initiated by &lt;a> elements:<pre><code>\n{\n    A: \"A\"\n}</code></pre>\n     * @property invalidHandleTypes\n     * @type Object\n     */\n    invalidHandleTypes: null,\n\n    /**\n     * An object who's property names identify the IDs of elements to be considered invalid as drag handles.\n     * A non-null property value identifies the ID as invalid. For example, to prevent\n     * dragging from being initiated on element ID \"foo\", use:<pre><code>\n{\n    foo: true\n}</code></pre>\n     * @property invalidHandleIds\n     * @type Object\n     */\n    invalidHandleIds: null,\n\n    /**\n     * An Array of CSS class names for elements to be considered in valid as drag handles.\n     * @property invalidHandleClasses\n     * @type Array\n     */\n    invalidHandleClasses: null,\n\n    /**\n     * The linked element's absolute X position at the time the drag was\n     * started\n     * @property startPageX\n     * @type int\n     * @private\n     */\n    startPageX: 0,\n\n    /**\n     * The linked element's absolute X position at the time the drag was\n     * started\n     * @property startPageY\n     * @type int\n     * @private\n     */\n    startPageY: 0,\n\n    /**\n     * The group defines a logical collection of DragDrop objects that are\n     * related.  Instances only get events when interacting with other\n     * DragDrop object in the same group.  This lets us define multiple\n     * groups using a single DragDrop subclass if we want.\n     * @property groups\n     * @type object An object in the format {'group1':true, 'group2':true}\n     */\n    groups: null,\n\n    /**\n     * Individual drag/drop instances can be locked.  This will prevent\n     * onmousedown start drag.\n     * @property locked\n     * @type boolean\n     * @private\n     */\n    locked: false,\n\n    /**\n     * Lock this instance\n     * @method lock\n     */\n    lock: function() {\n        this.locked = true;\n    },\n\n    /**\n     * When set to true, other DD objects in cooperating DDGroups do not receive\n     * notification events when this DD object is dragged over them. Defaults to false.\n     * @property moveOnly\n     * @type boolean\n     */\n    moveOnly: false,\n\n    /**\n     * Unlock this instace\n     * @method unlock\n     */\n    unlock: function() {\n        this.locked = false;\n    },\n\n    /**\n     * By default, all instances can be a drop target.  This can be disabled by\n     * setting isTarget to false.\n     * @property isTarget\n     * @type boolean\n     */\n    isTarget: true,\n\n    /**\n     * The padding configured for this drag and drop object for calculating\n     * the drop zone intersection with this object.\n     * @property padding\n     * @type int[] An array containing the 4 padding values: [top, right, bottom, left]\n     */\n    padding: null,\n\n    /**\n     * Cached reference to the linked element\n     * @property _domRef\n     * @private\n     */\n    _domRef: null,\n\n    /**\n     * Internal typeof flag\n     * @property __ygDragDrop\n     * @private\n     */\n    __ygDragDrop: true,\n\n    /**\n     * Set to true when horizontal contraints are applied\n     * @property constrainX\n     * @type boolean\n     * @private\n     */\n    constrainX: false,\n\n    /**\n     * Set to true when vertical contraints are applied\n     * @property constrainY\n     * @type boolean\n     * @private\n     */\n    constrainY: false,\n\n    /**\n     * The left constraint\n     * @property minX\n     * @type int\n     * @private\n     */\n    minX: 0,\n\n    /**\n     * The right constraint\n     * @property maxX\n     * @type int\n     * @private\n     */\n    maxX: 0,\n\n    /**\n     * The up constraint\n     * @property minY\n     * @type int\n     * @private\n     */\n    minY: 0,\n\n    /**\n     * The down constraint\n     * @property maxY\n     * @type int\n     * @private\n     */\n    maxY: 0,\n\n    /**\n     * Maintain offsets when we resetconstraints.  Set to true when you want\n     * the position of the element relative to its parent to stay the same\n     * when the page changes\n     *\n     * @property maintainOffset\n     * @type boolean\n     */\n    maintainOffset: false,\n\n    /**\n     * Array of pixel locations the element will snap to if we specified a\n     * horizontal graduation/interval.  This array is generated automatically\n     * when you define a tick interval.\n     * @property xTicks\n     * @type int[]\n     */\n    xTicks: null,\n\n    /**\n     * Array of pixel locations the element will snap to if we specified a\n     * vertical graduation/interval.  This array is generated automatically\n     * when you define a tick interval.\n     * @property yTicks\n     * @type int[]\n     */\n    yTicks: null,\n\n    /**\n     * By default the drag and drop instance will only respond to the primary\n     * button click (left button for a right-handed mouse).  Set to true to\n     * allow drag and drop to start with any mouse click that is propogated\n     * by the browser\n     * @property primaryButtonOnly\n     * @type boolean\n     */\n    primaryButtonOnly: true,\n\n    /**\n     * The available property is false until the linked dom element is accessible.\n     * @property available\n     * @type boolean\n     */\n    available: false,\n\n    /**\n     * By default, drags can only be initiated if the mousedown occurs in the\n     * region the linked element is.  This is done in part to work around a\n     * bug in some browsers that mis-report the mousedown if the previous\n     * mouseup happened outside of the window.  This property is set to true\n     * if outer handles are defined.\n     *\n     * @property hasOuterHandles\n     * @type boolean\n     * @default false\n     */\n    hasOuterHandles: false,\n\n    /**\n     * Code that executes immediately before the startDrag event\n     * @method b4StartDrag\n     * @private\n     */\n    b4StartDrag: function(x, y) { },\n\n    /**\n     * Abstract method called after a drag/drop object is clicked\n     * and the drag or mousedown time thresholds have beeen met.\n     * @method startDrag\n     * @param {int} X click location\n     * @param {int} Y click location\n     */\n    startDrag: function(x, y) { /* override this */ },\n\n    /**\n     * Code that executes immediately before the onDrag event\n     * @method b4Drag\n     * @private\n     */\n    b4Drag: function(e) { },\n\n    /**\n     * Abstract method called during the onMouseMove event while dragging an\n     * object.\n     * @method onDrag\n     * @param {Event} e the mousemove event\n     */\n    onDrag: function(e) { /* override this */ },\n\n    /**\n     * Abstract method called when this element fist begins hovering over\n     * another DragDrop obj\n     * @method onDragEnter\n     * @param {Event} e the mousemove event\n     * @param {String|DragDrop[]} id In POINT mode, the element\n     * id this is hovering over.  In INTERSECT mode, an array of one or more\n     * dragdrop items being hovered over.\n     */\n    onDragEnter: function(e, id) { /* override this */ },\n\n    /**\n     * Code that executes immediately before the onDragOver event\n     * @method b4DragOver\n     * @private\n     */\n    b4DragOver: function(e) { },\n\n    /**\n     * Abstract method called when this element is hovering over another\n     * DragDrop obj\n     * @method onDragOver\n     * @param {Event} e the mousemove event\n     * @param {String|DragDrop[]} id In POINT mode, the element\n     * id this is hovering over.  In INTERSECT mode, an array of dd items\n     * being hovered over.\n     */\n    onDragOver: function(e, id) { /* override this */ },\n\n    /**\n     * Code that executes immediately before the onDragOut event\n     * @method b4DragOut\n     * @private\n     */\n    b4DragOut: function(e) { },\n\n    /**\n     * Abstract method called when we are no longer hovering over an element\n     * @method onDragOut\n     * @param {Event} e the mousemove event\n     * @param {String|DragDrop[]} id In POINT mode, the element\n     * id this was hovering over.  In INTERSECT mode, an array of dd items\n     * that the mouse is no longer over.\n     */\n    onDragOut: function(e, id) { /* override this */ },\n\n    /**\n     * Code that executes immediately before the onDragDrop event\n     * @method b4DragDrop\n     * @private\n     */\n    b4DragDrop: function(e) { },\n\n    /**\n     * Abstract method called when this item is dropped on another DragDrop\n     * obj\n     * @method onDragDrop\n     * @param {Event} e the mouseup event\n     * @param {String|DragDrop[]} id In POINT mode, the element\n     * id this was dropped on.  In INTERSECT mode, an array of dd items this\n     * was dropped on.\n     */\n    onDragDrop: function(e, id) { /* override this */ },\n\n    /**\n     * Abstract method called when this item is dropped on an area with no\n     * drop target\n     * @method onInvalidDrop\n     * @param {Event} e the mouseup event\n     */\n    onInvalidDrop: function(e) { /* override this */ },\n\n    /**\n     * Code that executes immediately before the endDrag event\n     * @method b4EndDrag\n     * @private\n     */\n    b4EndDrag: function(e) { },\n\n    /**\n     * Fired when we are done dragging the object\n     * @method endDrag\n     * @param {Event} e the mouseup event\n     */\n    endDrag: function(e) { /* override this */ },\n\n    /**\n     * Code executed immediately before the onMouseDown event\n     * @method b4MouseDown\n     * @param {Event} e the mousedown event\n     * @private\n     */\n    b4MouseDown: function(e) {  },\n\n    /**\n     * Event handler that fires when a drag/drop obj gets a mousedown\n     * @method onMouseDown\n     * @param {Event} e the mousedown event\n     */\n    onMouseDown: function(e) { /* override this */ },\n\n    /**\n     * Event handler that fires when a drag/drop obj gets a mouseup\n     * @method onMouseUp\n     * @param {Event} e the mouseup event\n     */\n    onMouseUp: function(e) { /* override this */ },\n\n    /**\n     * Override the onAvailable method to do what is needed after the initial\n     * position was determined.\n     * @method onAvailable\n     */\n    onAvailable: function () {\n    },\n\n    /**\n     * Provides default constraint padding to \"constrainTo\" elements (defaults to {left: 0, right:0, top:0, bottom:0}).\n     * @type Object\n     */\n    defaultPadding : {left:0, right:0, top:0, bottom:0},\n\n    /**\n     * Initializes the drag drop object's constraints to restrict movement to a certain element.\n *\n * Usage:\n <pre><code>\n var dd = new Ext.dd.DDProxy(\"dragDiv1\", \"proxytest\",\n                { dragElId: \"existingProxyDiv\" });\n dd.startDrag = function(){\n     this.constrainTo(\"parent-id\");\n };\n </code></pre>\n * Or you can initalize it using the {@link Ext.Element} object:\n <pre><code>\n Ext.get(\"dragDiv1\").initDDProxy(\"proxytest\", {dragElId: \"existingProxyDiv\"}, {\n     startDrag : function(){\n         this.constrainTo(\"parent-id\");\n     }\n });\n </code></pre>\n     * @param {Mixed} constrainTo The element to constrain to.\n     * @param {Object/Number} pad (optional) Pad provides a way to specify \"padding\" of the constraints,\n     * and can be either a number for symmetrical padding (4 would be equal to {left:4, right:4, top:4, bottom:4}) or\n     * an object containing the sides to pad. For example: {right:10, bottom:10}\n     * @param {Boolean} inContent (optional) Constrain the draggable in the content box of the element (inside padding and borders)\n     */\n    constrainTo : function(constrainTo, pad, inContent){\n        if(Ext.isNumber(pad)){\n            pad = {left: pad, right:pad, top:pad, bottom:pad};\n        }\n        pad = pad || this.defaultPadding;\n        var b = Ext.get(this.getEl()).getBox(),\n            ce = Ext.get(constrainTo),\n            s = ce.getScroll(),\n            c, \n            cd = ce.dom;\n        if(cd == document.body){\n            c = { x: s.left, y: s.top, width: Ext.lib.Dom.getViewWidth(), height: Ext.lib.Dom.getViewHeight()};\n        }else{\n            var xy = ce.getXY();\n            c = {x : xy[0], y: xy[1], width: cd.clientWidth, height: cd.clientHeight};\n        }\n\n\n        var topSpace = b.y - c.y,\n            leftSpace = b.x - c.x;\n\n        this.resetConstraints();\n        this.setXConstraint(leftSpace - (pad.left||0), // left\n                c.width - leftSpace - b.width - (pad.right||0), //right\n\t\t\t\tthis.xTickSize\n        );\n        this.setYConstraint(topSpace - (pad.top||0), //top\n                c.height - topSpace - b.height - (pad.bottom||0), //bottom\n\t\t\t\tthis.yTickSize\n        );\n    },\n\n    /**\n     * Returns a reference to the linked element\n     * @method getEl\n     * @return {HTMLElement} the html element\n     */\n    getEl: function() {\n        if (!this._domRef) {\n            this._domRef = Ext.getDom(this.id);\n        }\n\n        return this._domRef;\n    },\n\n    /**\n     * Returns a reference to the actual element to drag.  By default this is\n     * the same as the html element, but it can be assigned to another\n     * element. An example of this can be found in Ext.dd.DDProxy\n     * @method getDragEl\n     * @return {HTMLElement} the html element\n     */\n    getDragEl: function() {\n        return Ext.getDom(this.dragElId);\n    },\n\n    /**\n     * Sets up the DragDrop object.  Must be called in the constructor of any\n     * Ext.dd.DragDrop subclass\n     * @method init\n     * @param id the id of the linked element\n     * @param {String} sGroup the group of related items\n     * @param {object} config configuration attributes\n     */\n    init: function(id, sGroup, config) {\n        this.initTarget(id, sGroup, config);\n        Event.on(this.id, \"mousedown\", this.handleMouseDown, this);\n        // Event.on(this.id, \"selectstart\", Event.preventDefault);\n    },\n\n    /**\n     * Initializes Targeting functionality only... the object does not\n     * get a mousedown handler.\n     * @method initTarget\n     * @param id the id of the linked element\n     * @param {String} sGroup the group of related items\n     * @param {object} config configuration attributes\n     */\n    initTarget: function(id, sGroup, config) {\n\n        // configuration attributes\n        this.config = config || {};\n\n        // create a local reference to the drag and drop manager\n        this.DDM = Ext.dd.DDM;\n        // initialize the groups array\n        this.groups = {};\n\n        // assume that we have an element reference instead of an id if the\n        // parameter is not a string\n        if (typeof id !== \"string\") {\n            id = Ext.id(id);\n        }\n\n        // set the id\n        this.id = id;\n\n        // add to an interaction group\n        this.addToGroup((sGroup) ? sGroup : \"default\");\n\n        // We don't want to register this as the handle with the manager\n        // so we just set the id rather than calling the setter.\n        this.handleElId = id;\n\n        // the linked element is the element that gets dragged by default\n        this.setDragElId(id);\n\n        // by default, clicked anchors will not start drag operations.\n        this.invalidHandleTypes = { A: \"A\" };\n        this.invalidHandleIds = {};\n        this.invalidHandleClasses = [];\n\n        this.applyConfig();\n\n        this.handleOnAvailable();\n    },\n\n    /**\n     * Applies the configuration parameters that were passed into the constructor.\n     * This is supposed to happen at each level through the inheritance chain.  So\n     * a DDProxy implentation will execute apply config on DDProxy, DD, and\n     * DragDrop in order to get all of the parameters that are available in\n     * each object.\n     * @method applyConfig\n     */\n    applyConfig: function() {\n\n        // configurable properties:\n        //    padding, isTarget, maintainOffset, primaryButtonOnly\n        this.padding           = this.config.padding || [0, 0, 0, 0];\n        this.isTarget          = (this.config.isTarget !== false);\n        this.maintainOffset    = (this.config.maintainOffset);\n        this.primaryButtonOnly = (this.config.primaryButtonOnly !== false);\n\n    },\n\n    /**\n     * Executed when the linked element is available\n     * @method handleOnAvailable\n     * @private\n     */\n    handleOnAvailable: function() {\n        this.available = true;\n        this.resetConstraints();\n        this.onAvailable();\n    },\n\n     /**\n     * Configures the padding for the target zone in px.  Effectively expands\n     * (or reduces) the virtual object size for targeting calculations.\n     * Supports css-style shorthand; if only one parameter is passed, all sides\n     * will have that padding, and if only two are passed, the top and bottom\n     * will have the first param, the left and right the second.\n     * @method setPadding\n     * @param {int} iTop    Top pad\n     * @param {int} iRight  Right pad\n     * @param {int} iBot    Bot pad\n     * @param {int} iLeft   Left pad\n     */\n    setPadding: function(iTop, iRight, iBot, iLeft) {\n        // this.padding = [iLeft, iRight, iTop, iBot];\n        if (!iRight && 0 !== iRight) {\n            this.padding = [iTop, iTop, iTop, iTop];\n        } else if (!iBot && 0 !== iBot) {\n            this.padding = [iTop, iRight, iTop, iRight];\n        } else {\n            this.padding = [iTop, iRight, iBot, iLeft];\n        }\n    },\n\n    /**\n     * Stores the initial placement of the linked element.\n     * @method setInitPosition\n     * @param {int} diffX   the X offset, default 0\n     * @param {int} diffY   the Y offset, default 0\n     */\n    setInitPosition: function(diffX, diffY) {\n        var el = this.getEl();\n\n        if (!this.DDM.verifyEl(el)) {\n            return;\n        }\n\n        var dx = diffX || 0;\n        var dy = diffY || 0;\n\n        var p = Dom.getXY( el );\n\n        this.initPageX = p[0] - dx;\n        this.initPageY = p[1] - dy;\n\n        this.lastPageX = p[0];\n        this.lastPageY = p[1];\n\n        this.setStartPosition(p);\n    },\n\n    /**\n     * Sets the start position of the element.  This is set when the obj\n     * is initialized, the reset when a drag is started.\n     * @method setStartPosition\n     * @param pos current position (from previous lookup)\n     * @private\n     */\n    setStartPosition: function(pos) {\n        var p = pos || Dom.getXY( this.getEl() );\n        this.deltaSetXY = null;\n\n        this.startPageX = p[0];\n        this.startPageY = p[1];\n    },\n\n    /**\n     * Add this instance to a group of related drag/drop objects.  All\n     * instances belong to at least one group, and can belong to as many\n     * groups as needed.\n     * @method addToGroup\n     * @param sGroup {string} the name of the group\n     */\n    addToGroup: function(sGroup) {\n        this.groups[sGroup] = true;\n        this.DDM.regDragDrop(this, sGroup);\n    },\n\n    /**\n     * Remove's this instance from the supplied interaction group\n     * @method removeFromGroup\n     * @param {string}  sGroup  The group to drop\n     */\n    removeFromGroup: function(sGroup) {\n        if (this.groups[sGroup]) {\n            delete this.groups[sGroup];\n        }\n\n        this.DDM.removeDDFromGroup(this, sGroup);\n    },\n\n    /**\n     * Allows you to specify that an element other than the linked element\n     * will be moved with the cursor during a drag\n     * @method setDragElId\n     * @param id {string} the id of the element that will be used to initiate the drag\n     */\n    setDragElId: function(id) {\n        this.dragElId = id;\n    },\n\n    /**\n     * Allows you to specify a child of the linked element that should be\n     * used to initiate the drag operation.  An example of this would be if\n     * you have a content div with text and links.  Clicking anywhere in the\n     * content area would normally start the drag operation.  Use this method\n     * to specify that an element inside of the content div is the element\n     * that starts the drag operation.\n     * @method setHandleElId\n     * @param id {string} the id of the element that will be used to\n     * initiate the drag.\n     */\n    setHandleElId: function(id) {\n        if (typeof id !== \"string\") {\n            id = Ext.id(id);\n        }\n        this.handleElId = id;\n        this.DDM.regHandle(this.id, id);\n    },\n\n    /**\n     * Allows you to set an element outside of the linked element as a drag\n     * handle\n     * @method setOuterHandleElId\n     * @param id the id of the element that will be used to initiate the drag\n     */\n    setOuterHandleElId: function(id) {\n        if (typeof id !== \"string\") {\n            id = Ext.id(id);\n        }\n        Event.on(id, \"mousedown\",\n                this.handleMouseDown, this);\n        this.setHandleElId(id);\n\n        this.hasOuterHandles = true;\n    },\n\n    /**\n     * Remove all drag and drop hooks for this element\n     * @method unreg\n     */\n    unreg: function() {\n        Event.un(this.id, \"mousedown\",\n                this.handleMouseDown);\n        this._domRef = null;\n        this.DDM._remove(this);\n    },\n\n    destroy : function(){\n        this.unreg();\n    },\n\n    /**\n     * Returns true if this instance is locked, or the drag drop mgr is locked\n     * (meaning that all drag/drop is disabled on the page.)\n     * @method isLocked\n     * @return {boolean} true if this obj or all drag/drop is locked, else\n     * false\n     */\n    isLocked: function() {\n        return (this.DDM.isLocked() || this.locked);\n    },\n\n    /**\n     * Fired when this object is clicked\n     * @method handleMouseDown\n     * @param {Event} e\n     * @param {Ext.dd.DragDrop} oDD the clicked dd object (this dd obj)\n     * @private\n     */\n    handleMouseDown: function(e, oDD){\n        if (this.primaryButtonOnly && e.button != 0) {\n            return;\n        }\n\n        if (this.isLocked()) {\n            return;\n        }\n\n        this.DDM.refreshCache(this.groups);\n\n        var pt = new Ext.lib.Point(Ext.lib.Event.getPageX(e), Ext.lib.Event.getPageY(e));\n        if (!this.hasOuterHandles && !this.DDM.isOverTarget(pt, this) )  {\n        } else {\n            if (this.clickValidator(e)) {\n\n                // set the initial element position\n                this.setStartPosition();\n\n                this.b4MouseDown(e);\n                this.onMouseDown(e);\n\n                this.DDM.handleMouseDown(e, this);\n\n                if (this.preventDefault || this.stopPropagation) {\n                    if (this.preventDefault) {\n                        e.preventDefault();\n                    }\n                    if (this.stopPropagation) {\n                        e.stopPropagation();\n                    }\n                } else {\n                    this.DDM.stopEvent(e);\n                }\n            } else {\n\n\n            }\n        }\n    },\n\n    clickValidator: function(e) {\n        var target = e.getTarget();\n        return ( this.isValidHandleChild(target) &&\n                    (this.id == this.handleElId ||\n                        this.DDM.handleWasClicked(target, this.id)) );\n    },\n\n    /**\n     * Allows you to specify a tag name that should not start a drag operation\n     * when clicked.  This is designed to facilitate embedding links within a\n     * drag handle that do something other than start the drag.\n     * @method addInvalidHandleType\n     * @param {string} tagName the type of element to exclude\n     */\n    addInvalidHandleType: function(tagName) {\n        var type = tagName.toUpperCase();\n        this.invalidHandleTypes[type] = type;\n    },\n\n    /**\n     * Lets you to specify an element id for a child of a drag handle\n     * that should not initiate a drag\n     * @method addInvalidHandleId\n     * @param {string} id the element id of the element you wish to ignore\n     */\n    addInvalidHandleId: function(id) {\n        if (typeof id !== \"string\") {\n            id = Ext.id(id);\n        }\n        this.invalidHandleIds[id] = id;\n    },\n\n    /**\n     * Lets you specify a css class of elements that will not initiate a drag\n     * @method addInvalidHandleClass\n     * @param {string} cssClass the class of the elements you wish to ignore\n     */\n    addInvalidHandleClass: function(cssClass) {\n        this.invalidHandleClasses.push(cssClass);\n    },\n\n    /**\n     * Unsets an excluded tag name set by addInvalidHandleType\n     * @method removeInvalidHandleType\n     * @param {string} tagName the type of element to unexclude\n     */\n    removeInvalidHandleType: function(tagName) {\n        var type = tagName.toUpperCase();\n        // this.invalidHandleTypes[type] = null;\n        delete this.invalidHandleTypes[type];\n    },\n\n    /**\n     * Unsets an invalid handle id\n     * @method removeInvalidHandleId\n     * @param {string} id the id of the element to re-enable\n     */\n    removeInvalidHandleId: function(id) {\n        if (typeof id !== \"string\") {\n            id = Ext.id(id);\n        }\n        delete this.invalidHandleIds[id];\n    },\n\n    /**\n     * Unsets an invalid css class\n     * @method removeInvalidHandleClass\n     * @param {string} cssClass the class of the element(s) you wish to\n     * re-enable\n     */\n    removeInvalidHandleClass: function(cssClass) {\n        for (var i=0, len=this.invalidHandleClasses.length; i<len; ++i) {\n            if (this.invalidHandleClasses[i] == cssClass) {\n                delete this.invalidHandleClasses[i];\n            }\n        }\n    },\n\n    /**\n     * Checks the tag exclusion list to see if this click should be ignored\n     * @method isValidHandleChild\n     * @param {HTMLElement} node the HTMLElement to evaluate\n     * @return {boolean} true if this is a valid tag type, false if not\n     */\n    isValidHandleChild: function(node) {\n\n        var valid = true;\n        // var n = (node.nodeName == \"#text\") ? node.parentNode : node;\n        var nodeName;\n        try {\n            nodeName = node.nodeName.toUpperCase();\n        } catch(e) {\n            nodeName = node.nodeName;\n        }\n        valid = valid && !this.invalidHandleTypes[nodeName];\n        valid = valid && !this.invalidHandleIds[node.id];\n\n        for (var i=0, len=this.invalidHandleClasses.length; valid && i<len; ++i) {\n            valid = !Ext.fly(node).hasClass(this.invalidHandleClasses[i]);\n        }\n\n\n        return valid;\n\n    },\n\n    /**\n     * Create the array of horizontal tick marks if an interval was specified\n     * in setXConstraint().\n     * @method setXTicks\n     * @private\n     */\n    setXTicks: function(iStartX, iTickSize) {\n        this.xTicks = [];\n        this.xTickSize = iTickSize;\n\n        var tickMap = {};\n\n        for (var i = this.initPageX; i >= this.minX; i = i - iTickSize) {\n            if (!tickMap[i]) {\n                this.xTicks[this.xTicks.length] = i;\n                tickMap[i] = true;\n            }\n        }\n\n        for (i = this.initPageX; i <= this.maxX; i = i + iTickSize) {\n            if (!tickMap[i]) {\n                this.xTicks[this.xTicks.length] = i;\n                tickMap[i] = true;\n            }\n        }\n\n        this.xTicks.sort(this.DDM.numericSort) ;\n    },\n\n    /**\n     * Create the array of vertical tick marks if an interval was specified in\n     * setYConstraint().\n     * @method setYTicks\n     * @private\n     */\n    setYTicks: function(iStartY, iTickSize) {\n        this.yTicks = [];\n        this.yTickSize = iTickSize;\n\n        var tickMap = {};\n\n        for (var i = this.initPageY; i >= this.minY; i = i - iTickSize) {\n            if (!tickMap[i]) {\n                this.yTicks[this.yTicks.length] = i;\n                tickMap[i] = true;\n            }\n        }\n\n        for (i = this.initPageY; i <= this.maxY; i = i + iTickSize) {\n            if (!tickMap[i]) {\n                this.yTicks[this.yTicks.length] = i;\n                tickMap[i] = true;\n            }\n        }\n\n        this.yTicks.sort(this.DDM.numericSort) ;\n    },\n\n    /**\n     * By default, the element can be dragged any place on the screen.  Use\n     * this method to limit the horizontal travel of the element.  Pass in\n     * 0,0 for the parameters if you want to lock the drag to the y axis.\n     * @method setXConstraint\n     * @param {int} iLeft the number of pixels the element can move to the left\n     * @param {int} iRight the number of pixels the element can move to the\n     * right\n     * @param {int} iTickSize optional parameter for specifying that the\n     * element\n     * should move iTickSize pixels at a time.\n     */\n    setXConstraint: function(iLeft, iRight, iTickSize) {\n        this.leftConstraint = iLeft;\n        this.rightConstraint = iRight;\n\n        this.minX = this.initPageX - iLeft;\n        this.maxX = this.initPageX + iRight;\n        if (iTickSize) { this.setXTicks(this.initPageX, iTickSize); }\n\n        this.constrainX = true;\n    },\n\n    /**\n     * Clears any constraints applied to this instance.  Also clears ticks\n     * since they can't exist independent of a constraint at this time.\n     * @method clearConstraints\n     */\n    clearConstraints: function() {\n        this.constrainX = false;\n        this.constrainY = false;\n        this.clearTicks();\n    },\n\n    /**\n     * Clears any tick interval defined for this instance\n     * @method clearTicks\n     */\n    clearTicks: function() {\n        this.xTicks = null;\n        this.yTicks = null;\n        this.xTickSize = 0;\n        this.yTickSize = 0;\n    },\n\n    /**\n     * By default, the element can be dragged any place on the screen.  Set\n     * this to limit the vertical travel of the element.  Pass in 0,0 for the\n     * parameters if you want to lock the drag to the x axis.\n     * @method setYConstraint\n     * @param {int} iUp the number of pixels the element can move up\n     * @param {int} iDown the number of pixels the element can move down\n     * @param {int} iTickSize optional parameter for specifying that the\n     * element should move iTickSize pixels at a time.\n     */\n    setYConstraint: function(iUp, iDown, iTickSize) {\n        this.topConstraint = iUp;\n        this.bottomConstraint = iDown;\n\n        this.minY = this.initPageY - iUp;\n        this.maxY = this.initPageY + iDown;\n        if (iTickSize) { this.setYTicks(this.initPageY, iTickSize); }\n\n        this.constrainY = true;\n\n    },\n\n    /**\n     * resetConstraints must be called if you manually reposition a dd element.\n     * @method resetConstraints\n     * @param {boolean} maintainOffset\n     */\n    resetConstraints: function() {\n        // Maintain offsets if necessary\n        if (this.initPageX || this.initPageX === 0) {\n            // figure out how much this thing has moved\n            var dx = (this.maintainOffset) ? this.lastPageX - this.initPageX : 0;\n            var dy = (this.maintainOffset) ? this.lastPageY - this.initPageY : 0;\n\n            this.setInitPosition(dx, dy);\n\n        // This is the first time we have detected the element's position\n        } else {\n            this.setInitPosition();\n        }\n\n        if (this.constrainX) {\n            this.setXConstraint( this.leftConstraint,\n                                 this.rightConstraint,\n                                 this.xTickSize        );\n        }\n\n        if (this.constrainY) {\n            this.setYConstraint( this.topConstraint,\n                                 this.bottomConstraint,\n                                 this.yTickSize         );\n        }\n    },\n\n    /**\n     * Normally the drag element is moved pixel by pixel, but we can specify\n     * that it move a number of pixels at a time.  This method resolves the\n     * location when we have it set up like this.\n     * @method getTick\n     * @param {int} val where we want to place the object\n     * @param {int[]} tickArray sorted array of valid points\n     * @return {int} the closest tick\n     * @private\n     */\n    getTick: function(val, tickArray) {\n        if (!tickArray) {\n            // If tick interval is not defined, it is effectively 1 pixel,\n            // so we return the value passed to us.\n            return val;\n        } else if (tickArray[0] >= val) {\n            // The value is lower than the first tick, so we return the first\n            // tick.\n            return tickArray[0];\n        } else {\n            for (var i=0, len=tickArray.length; i<len; ++i) {\n                var next = i + 1;\n                if (tickArray[next] && tickArray[next] >= val) {\n                    var diff1 = val - tickArray[i];\n                    var diff2 = tickArray[next] - val;\n                    return (diff2 > diff1) ? tickArray[i] : tickArray[next];\n                }\n            }\n\n            // The value is larger than the last tick, so we return the last\n            // tick.\n            return tickArray[tickArray.length - 1];\n        }\n    },\n\n    /**\n     * toString method\n     * @method toString\n     * @return {string} string representation of the dd obj\n     */\n    toString: function() {\n        return (\"DragDrop \" + this.id);\n    }\n\n};\n\n})();\n/*\n * The drag and drop utility provides a framework for building drag and drop\n * applications.  In addition to enabling drag and drop for specific elements,\n * the drag and drop elements are tracked by the manager class, and the\n * interactions between the various elements are tracked during the drag and\n * the implementing code is notified about these important moments.\n */\n\n// Only load the library once.  Rewriting the manager class would orphan\n// existing drag and drop instances.\nif (!Ext.dd.DragDropMgr) {\n\n/**\n * @class Ext.dd.DragDropMgr\n * DragDropMgr is a singleton that tracks the element interaction for\n * all DragDrop items in the window.  Generally, you will not call\n * this class directly, but it does have helper methods that could\n * be useful in your DragDrop implementations.\n * @singleton\n */\nExt.dd.DragDropMgr = function() {\n\n    var Event = Ext.EventManager;\n\n    return {\n\n        /**\n         * Two dimensional Array of registered DragDrop objects.  The first\n         * dimension is the DragDrop item group, the second the DragDrop\n         * object.\n         * @property ids\n         * @type String[]\n         * @private\n         */\n        ids: {},\n\n        /**\n         * Array of element ids defined as drag handles.  Used to determine\n         * if the element that generated the mousedown event is actually the\n         * handle and not the html element itself.\n         * @property handleIds\n         * @type String[]\n         * @private\n         */\n        handleIds: {},\n\n        /**\n         * the DragDrop object that is currently being dragged\n         * @property dragCurrent\n         * @type DragDrop\n         * @private\n         **/\n        dragCurrent: null,\n\n        /**\n         * the DragDrop object(s) that are being hovered over\n         * @property dragOvers\n         * @type Array\n         * @private\n         */\n        dragOvers: {},\n\n        /**\n         * the X distance between the cursor and the object being dragged\n         * @property deltaX\n         * @type int\n         * @private\n         */\n        deltaX: 0,\n\n        /**\n         * the Y distance between the cursor and the object being dragged\n         * @property deltaY\n         * @type int\n         * @private\n         */\n        deltaY: 0,\n\n        /**\n         * Flag to determine if we should prevent the default behavior of the\n         * events we define. By default this is true, but this can be set to\n         * false if you need the default behavior (not recommended)\n         * @property preventDefault\n         * @type boolean\n         */\n        preventDefault: true,\n\n        /**\n         * Flag to determine if we should stop the propagation of the events\n         * we generate. This is true by default but you may want to set it to\n         * false if the html element contains other features that require the\n         * mouse click.\n         * @property stopPropagation\n         * @type boolean\n         */\n        stopPropagation: true,\n\n        /**\n         * Internal flag that is set to true when drag and drop has been\n         * intialized\n         * @property initialized\n         * @private\n         */\n        initialized: false,\n\n        /**\n         * All drag and drop can be disabled.\n         * @property locked\n         * @private\n         */\n        locked: false,\n\n        /**\n         * Called the first time an element is registered.\n         * @method init\n         * @private\n         */\n        init: function() {\n            this.initialized = true;\n        },\n\n        /**\n         * In point mode, drag and drop interaction is defined by the\n         * location of the cursor during the drag/drop\n         * @property POINT\n         * @type int\n         */\n        POINT: 0,\n\n        /**\n         * In intersect mode, drag and drop interaction is defined by the\n         * overlap of two or more drag and drop objects.\n         * @property INTERSECT\n         * @type int\n         */\n        INTERSECT: 1,\n\n        /**\n         * The current drag and drop mode.  Default: POINT\n         * @property mode\n         * @type int\n         */\n        mode: 0,\n        \n        /**\n         * @property {Boolean} [notifyOccluded=false]\n         * This config is only provided to provide old, usually unwanted drag/drop behaviour.\n         *\n         * From ExtJS 4.1.0 onwards, when drop targets are contained in floating, absolutely positioned elements\n         * such as in {@link Ext.window.Window Windows}, which may overlap each other, `over` and `drop` events\n         * are only delivered to the topmost drop target at the mouse position.\n         *\n         * If all targets below that in zIndex order should also receive notifications, set\n         * `notifyOccluded` to `true`.\n         */\n        notifyOccluded: false,\n\n        /**\n         * Runs method on all drag and drop objects\n         * @method _execOnAll\n         * @private\n         */\n        _execOnAll: function(sMethod, args) {\n            for (var i in this.ids) {\n                for (var j in this.ids[i]) {\n                    var oDD = this.ids[i][j];\n                    if (! this.isTypeOfDD(oDD)) {\n                        continue;\n                    }\n                    oDD[sMethod].apply(oDD, args);\n                }\n            }\n        },\n\n        /**\n         * Drag and drop initialization.  Sets up the global event handlers\n         * @method _onLoad\n         * @private\n         */\n        _onLoad: function() {\n\n            this.init();\n\n\n            Event.on(document, \"mouseup\",   this.handleMouseUp, this, true);\n            Event.on(document, \"mousemove\", this.handleMouseMove, this, true);\n            Event.on(window,   \"unload\",    this._onUnload, this, true);\n            Event.on(window,   \"resize\",    this._onResize, this, true);\n            // Event.on(window,   \"mouseout\",    this._test);\n\n        },\n\n        /**\n         * Reset constraints on all drag and drop objs\n         * @method _onResize\n         * @private\n         */\n        _onResize: function(e) {\n            this._execOnAll(\"resetConstraints\", []);\n        },\n\n        /**\n         * Lock all drag and drop functionality\n         * @method lock\n         */\n        lock: function() { this.locked = true; },\n\n        /**\n         * Unlock all drag and drop functionality\n         * @method unlock\n         */\n        unlock: function() { this.locked = false; },\n\n        /**\n         * Is drag and drop locked?\n         * @method isLocked\n         * @return {boolean} True if drag and drop is locked, false otherwise.\n         */\n        isLocked: function() { return this.locked; },\n\n        /**\n         * Location cache that is set for all drag drop objects when a drag is\n         * initiated, cleared when the drag is finished.\n         * @property locationCache\n         * @private\n         */\n        locationCache: {},\n\n        /**\n         * Set useCache to false if you want to force object the lookup of each\n         * drag and drop linked element constantly during a drag.\n         * @property useCache\n         * @type boolean\n         */\n        useCache: true,\n\n        /**\n         * The number of pixels that the mouse needs to move after the\n         * mousedown before the drag is initiated.  Default=3;\n         * @property clickPixelThresh\n         * @type int\n         */\n        clickPixelThresh: 3,\n\n        /**\n         * The number of milliseconds after the mousedown event to initiate the\n         * drag if we don't get a mouseup event. Default=350\n         * @property clickTimeThresh\n         * @type int\n         */\n        clickTimeThresh: 350,\n\n        /**\n         * Flag that indicates that either the drag pixel threshold or the\n         * mousdown time threshold has been met\n         * @property dragThreshMet\n         * @type boolean\n         * @private\n         */\n        dragThreshMet: false,\n\n        /**\n         * Timeout used for the click time threshold\n         * @property clickTimeout\n         * @type Object\n         * @private\n         */\n        clickTimeout: null,\n\n        /**\n         * The X position of the mousedown event stored for later use when a\n         * drag threshold is met.\n         * @property startX\n         * @type int\n         * @private\n         */\n        startX: 0,\n\n        /**\n         * The Y position of the mousedown event stored for later use when a\n         * drag threshold is met.\n         * @property startY\n         * @type int\n         * @private\n         */\n        startY: 0,\n\n        /**\n         * Each DragDrop instance must be registered with the DragDropMgr.\n         * This is executed in DragDrop.init()\n         * @method regDragDrop\n         * @param {DragDrop} oDD the DragDrop object to register\n         * @param {String} sGroup the name of the group this element belongs to\n         */\n        regDragDrop: function(oDD, sGroup) {\n            if (!this.initialized) { this.init(); }\n\n            if (!this.ids[sGroup]) {\n                this.ids[sGroup] = {};\n            }\n            this.ids[sGroup][oDD.id] = oDD;\n        },\n\n        /**\n         * Removes the supplied dd instance from the supplied group. Executed\n         * by DragDrop.removeFromGroup, so don't call this function directly.\n         * @method removeDDFromGroup\n         * @private\n         */\n        removeDDFromGroup: function(oDD, sGroup) {\n            if (!this.ids[sGroup]) {\n                this.ids[sGroup] = {};\n            }\n\n            var obj = this.ids[sGroup];\n            if (obj && obj[oDD.id]) {\n                delete obj[oDD.id];\n            }\n        },\n\n        /**\n         * Unregisters a drag and drop item.  This is executed in\n         * DragDrop.unreg, use that method instead of calling this directly.\n         * @method _remove\n         * @private\n         */\n        _remove: function(oDD) {\n            for (var g in oDD.groups) {\n                if (g && this.ids[g] && this.ids[g][oDD.id]) {\n                    delete this.ids[g][oDD.id];\n                }\n            }\n            delete this.handleIds[oDD.id];\n        },\n\n        /**\n         * Each DragDrop handle element must be registered.  This is done\n         * automatically when executing DragDrop.setHandleElId()\n         * @method regHandle\n         * @param {String} sDDId the DragDrop id this element is a handle for\n         * @param {String} sHandleId the id of the element that is the drag\n         * handle\n         */\n        regHandle: function(sDDId, sHandleId) {\n            if (!this.handleIds[sDDId]) {\n                this.handleIds[sDDId] = {};\n            }\n            this.handleIds[sDDId][sHandleId] = sHandleId;\n        },\n\n        /**\n         * Utility function to determine if a given element has been\n         * registered as a drag drop item.\n         * @method isDragDrop\n         * @param {String} id the element id to check\n         * @return {boolean} true if this element is a DragDrop item,\n         * false otherwise\n         */\n        isDragDrop: function(id) {\n            return ( this.getDDById(id) ) ? true : false;\n        },\n\n        /**\n         * Returns the drag and drop instances that are in all groups the\n         * passed in instance belongs to.\n         * @method getRelated\n         * @param {DragDrop} p_oDD the obj to get related data for\n         * @param {boolean} bTargetsOnly if true, only return targetable objs\n         * @return {DragDrop[]} the related instances\n         */\n        getRelated: function(p_oDD, bTargetsOnly) {\n            var oDDs = [];\n            for (var i in p_oDD.groups) {\n                for (var j in this.ids[i]) {\n                    var dd = this.ids[i][j];\n                    if (! this.isTypeOfDD(dd)) {\n                        continue;\n                    }\n                    if (!bTargetsOnly || dd.isTarget) {\n                        oDDs[oDDs.length] = dd;\n                    }\n                }\n            }\n\n            return oDDs;\n        },\n\n        /**\n         * Returns true if the specified dd target is a legal target for\n         * the specifice drag obj\n         * @method isLegalTarget\n         * @param {DragDrop} oDD the drag obj\n         * @param {DragDrop} oTargetDD the target\n         * @return {boolean} true if the target is a legal target for the\n         * dd obj\n         */\n        isLegalTarget: function (oDD, oTargetDD) {\n            var targets = this.getRelated(oDD, true);\n            for (var i=0, len=targets.length;i<len;++i) {\n                if (targets[i].id == oTargetDD.id) {\n                    return true;\n                }\n            }\n\n            return false;\n        },\n\n        /**\n         * My goal is to be able to transparently determine if an object is\n         * typeof DragDrop, and the exact subclass of DragDrop.  typeof\n         * returns \"object\", oDD.constructor.toString() always returns\n         * \"DragDrop\" and not the name of the subclass.  So for now it just\n         * evaluates a well-known variable in DragDrop.\n         * @method isTypeOfDD\n         * @param {Object} the object to evaluate\n         * @return {boolean} true if typeof oDD = DragDrop\n         */\n        isTypeOfDD: function (oDD) {\n            return (oDD && oDD.__ygDragDrop);\n        },\n\n        /**\n         * Utility function to determine if a given element has been\n         * registered as a drag drop handle for the given Drag Drop object.\n         * @method isHandle\n         * @param {String} id the element id to check\n         * @return {boolean} true if this element is a DragDrop handle, false\n         * otherwise\n         */\n        isHandle: function(sDDId, sHandleId) {\n            return ( this.handleIds[sDDId] &&\n                            this.handleIds[sDDId][sHandleId] );\n        },\n\n        /**\n         * Returns the DragDrop instance for a given id\n         * @method getDDById\n         * @param {String} id the id of the DragDrop object\n         * @return {DragDrop} the drag drop object, null if it is not found\n         */\n        getDDById: function(id) {\n            for (var i in this.ids) {\n                if (this.ids[i][id]) {\n                    return this.ids[i][id];\n                }\n            }\n            return null;\n        },\n\n        /**\n         * Fired after a registered DragDrop object gets the mousedown event.\n         * Sets up the events required to track the object being dragged\n         * @method handleMouseDown\n         * @param {Event} e the event\n         * @param oDD the DragDrop object being dragged\n         * @private\n         */\n        handleMouseDown: function(e, oDD) {\n            if(Ext.QuickTips){\n                Ext.QuickTips.ddDisable();\n            }\n            if(this.dragCurrent){\n                // the original browser mouseup wasn't handled (e.g. outside FF browser window)\n                // so clean up first to avoid breaking the next drag\n                this.handleMouseUp(e);\n            }\n            \n            this.currentTarget = e.getTarget();\n            this.dragCurrent = oDD;\n\n            var el = oDD.getEl();\n\n            // track start position\n            this.startX = e.getPageX();\n            this.startY = e.getPageY();\n\n            this.deltaX = this.startX - el.offsetLeft;\n            this.deltaY = this.startY - el.offsetTop;\n\n            this.dragThreshMet = false;\n\n            this.clickTimeout = setTimeout(\n                    function() {\n                        var DDM = Ext.dd.DDM;\n                        DDM.startDrag(DDM.startX, DDM.startY);\n                    },\n                    this.clickTimeThresh );\n        },\n\n        /**\n         * Fired when either the drag pixel threshol or the mousedown hold\n         * time threshold has been met.\n         * @method startDrag\n         * @param x {int} the X position of the original mousedown\n         * @param y {int} the Y position of the original mousedown\n         */\n        startDrag: function(x, y) {\n            clearTimeout(this.clickTimeout);\n            if (this.dragCurrent) {\n                this.dragCurrent.b4StartDrag(x, y);\n                this.dragCurrent.startDrag(x, y);\n            }\n            this.dragThreshMet = true;\n        },\n\n        /**\n         * Internal function to handle the mouseup event.  Will be invoked\n         * from the context of the document.\n         * @method handleMouseUp\n         * @param {Event} e the event\n         * @private\n         */\n        handleMouseUp: function(e) {\n\n            if(Ext.QuickTips){\n                Ext.QuickTips.ddEnable();\n            }\n            if (! this.dragCurrent) {\n                return;\n            }\n\n            clearTimeout(this.clickTimeout);\n\n            if (this.dragThreshMet) {\n                this.fireEvents(e, true);\n            } else {\n            }\n\n            this.stopDrag(e);\n\n            this.stopEvent(e);\n        },\n\n        /**\n         * Utility to stop event propagation and event default, if these\n         * features are turned on.\n         * @method stopEvent\n         * @param {Event} e the event as returned by this.getEvent()\n         */\n        stopEvent: function(e){\n            if(this.stopPropagation) {\n                e.stopPropagation();\n            }\n\n            if (this.preventDefault) {\n                e.preventDefault();\n            }\n        },\n\n        /**\n         * Internal function to clean up event handlers after the drag\n         * operation is complete\n         * @method stopDrag\n         * @param {Event} e the event\n         * @private\n         */\n        stopDrag: function(e) {\n            // Fire the drag end event for the item that was dragged\n            if (this.dragCurrent) {\n                if (this.dragThreshMet) {\n                    this.dragCurrent.b4EndDrag(e);\n                    this.dragCurrent.endDrag(e);\n                }\n\n                this.dragCurrent.onMouseUp(e);\n            }\n\n            this.dragCurrent = null;\n            this.dragOvers = {};\n        },\n\n        /**\n         * Internal function to handle the mousemove event.  Will be invoked\n         * from the context of the html element.\n         *\n         * @TODO figure out what we can do about mouse events lost when the\n         * user drags objects beyond the window boundary.  Currently we can\n         * detect this in internet explorer by verifying that the mouse is\n         * down during the mousemove event.  Firefox doesn't give us the\n         * button state on the mousemove event.\n         * @method handleMouseMove\n         * @param {Event} e the event\n         * @private\n         */\n        handleMouseMove: function(e) {\n            if (! this.dragCurrent) {\n                return true;\n            }\n            // var button = e.which || e.button;\n\n            // check for IE mouseup outside of page boundary\n            if (Ext.isIE && (e.button !== 0 && e.button !== 1 && e.button !== 2)) {\n                this.stopEvent(e);\n                return this.handleMouseUp(e);\n            }\n\n            if (!this.dragThreshMet) {\n                var diffX = Math.abs(this.startX - e.getPageX());\n                var diffY = Math.abs(this.startY - e.getPageY());\n                if (diffX > this.clickPixelThresh ||\n                            diffY > this.clickPixelThresh) {\n                    this.startDrag(this.startX, this.startY);\n                }\n            }\n\n            if (this.dragThreshMet) {\n                this.dragCurrent.b4Drag(e);\n                this.dragCurrent.onDrag(e);\n                if(!this.dragCurrent.moveOnly){\n                    this.fireEvents(e, false);\n                }\n            }\n\n            this.stopEvent(e);\n\n            return true;\n        },\n\n        /**\n         * Iterates over all of the DragDrop elements to find ones we are\n         * hovering over or dropping on\n         * @method fireEvents\n         * @param {Event} e the event\n         * @param {boolean} isDrop is this a drop op or a mouseover op?\n         * @private\n         */\n        fireEvents: function(e, isDrop) {\n            var me = this,\n                dragCurrent = me.dragCurrent,\n                mousePoint = e.getPoint(),\n                overTarget,\n                overTargetEl,\n                allTargets = [],\n                oldOvers  = [],  // cache the previous dragOver array\n                outEvts   = [],\n                overEvts  = [],\n                dropEvts  = [],\n                enterEvts = [],\n                needsSort,\n                i,\n                len,\n                sGroup;\n\n            // If the user did the mouse up outside of the window, we could\n            // get here even though we have ended the drag.\n            if (!dragCurrent || dragCurrent.isLocked()) {\n                return;\n            }\n\n            // Check to see if the object(s) we were hovering over is no longer\n            // being hovered over so we can fire the onDragOut event\n            for (i in me.dragOvers) {\n                overTarget = me.dragOvers[i];\n\n                if (! me.isTypeOfDD(overTarget)) {\n                    continue;\n                }\n\n                if (! this.isOverTarget(mousePoint, overTarget, me.mode)) {\n                    outEvts.push( overTarget );\n                }\n\n                oldOvers[i] = true;\n                delete me.dragOvers[i];\n            }\n\n            // Collect all targets which are members of the same ddGoups that the dragCurrent is a member of, and which may recieve mouseover and drop notifications.\n            // This is preparatory to seeing which one(s) we are currently over\n            // Begin by iterating through the ddGroups of which the dragCurrent is a member\n            for (sGroup in dragCurrent.groups) {\n\n                if (\"string\" != typeof sGroup) {\n                    continue;\n                }\n\n                // Loop over the registered members of each group, testing each as a potential target\n                for (i in me.ids[sGroup]) {\n                    overTarget = me.ids[sGroup][i];\n\n                    // The target is valid if it is a DD type\n                    // And it's got a DOM element\n                    // And it's configured to be a drop target\n                    // And it's not locked\n                    // And it's either not the dragCurrent, or, if it is, tha dragCurrent is configured to not ignore itself.\n                    if (me.isTypeOfDD(overTarget) &&\n                        (overTargetEl = overTarget.getEl()) &&\n                        (overTarget.isTarget) &&\n                        (!overTarget.isLocked()) &&\n                        ((overTarget != dragCurrent) || (dragCurrent.ignoreSelf === false))) {\n\n                        // Only sort by zIndex if there were some which had a floating zIndex value\n                        if ((overTarget.zIndex = me.getZIndex(overTargetEl)) !== -1) {\n                            needsSort = true;\n                        }\n                        allTargets.push(overTarget);\n                    }\n                }\n            }\n\n            // If there were floating targets, sort the highest zIndex to the top\n            if (needsSort) {\n                allTargets.sort(me.byZIndex);\n            }\n\n            // Loop through possible targets, notifying the one(s) we are over.\n            // Usually we only deliver events to the topmost.\n            for (i = 0, len = allTargets.length; i < len; i++) {\n                overTarget = allTargets[i];\n\n                // If we are over the overTarget, queue it up to recieve an event of whatever type we are handling\n                if (me.isOverTarget(mousePoint, overTarget, me.mode)) {\n                    // look for drop interactions\n                    if (isDrop) {\n                        dropEvts.push( overTarget );\n                    // look for drag enter and drag over interactions\n                    } else {\n                        // initial drag over: dragEnter fires\n                        if (!oldOvers[overTarget.id]) {\n                            enterEvts.push( overTarget );\n                        // subsequent drag overs: dragOver fires\n                        } else {\n                            overEvts.push( overTarget );\n                        }\n                        me.dragOvers[overTarget.id] = overTarget;\n                    }\n\n                    // Unless this DragDropManager has been explicitly configured to deliver events to multiple targets, then we are done.\n                    if (!me.notifyOccluded) {\n                        break;\n                    }\n                }\n            }\n\n            if (me.mode) {\n                if (outEvts.length) {\n                    dragCurrent.b4DragOut(e, outEvts);\n                    dragCurrent.onDragOut(e, outEvts);\n                }\n    \n                if (enterEvts.length) {\n                    dragCurrent.onDragEnter(e, enterEvts);\n                }\n\n                if (overEvts.length) {\n                    dragCurrent.b4DragOver(e, overEvts);\n                    dragCurrent.onDragOver(e, overEvts);\n                }\n\n                if (dropEvts.length) {\n                    dragCurrent.b4DragDrop(e, dropEvts);\n                    dragCurrent.onDragDrop(e, dropEvts);\n                }\n\n            } else {\n                // fire dragout events\n                for (i=0, len=outEvts.length; i<len; ++i) {\n                    dragCurrent.b4DragOut(e, outEvts[i].id);\n                    dragCurrent.onDragOut(e, outEvts[i].id);\n                }\n\n                // fire enter events\n                for (i=0,len=enterEvts.length; i<len; ++i) {\n                    // dc.b4DragEnter(e, oDD.id);\n                    dragCurrent.onDragEnter(e, enterEvts[i].id);\n                }\n\n                // fire over events\n                for (i=0,len=overEvts.length; i<len; ++i) {\n                    dragCurrent.b4DragOver(e, overEvts[i].id);\n                    dragCurrent.onDragOver(e, overEvts[i].id);\n                }   \n\n                // fire drop events\n                for (i=0, len=dropEvts.length; i<len; ++i) {\n                    dragCurrent.b4DragDrop(e, dropEvts[i].id);\n                    dragCurrent.onDragDrop(e, dropEvts[i].id);\n                }\n\n            }\n\n            // notify about a drop that did not find a target\n            if (isDrop && !dropEvts.length) {\n                dragCurrent.onInvalidDrop(e);\n            }\n        },\n        \n        /**\n         * @private\n         * Collects the z-index of the passed element, looking up the parentNode axis to find an absolutely positioned ancestor\n         * which is able to yield a z-index. If found to be not absolutely positionedm returns -1.\n         *\n         * This is used when sorting potential drop targets into z-index order so that only the topmost receives `over` and `drop` events.\n         *\n         * @return {Number} The z-index of the element, or of its topmost absolutely positioned ancestor. Returns -1 if the element is not\n         * absolutely positioned.\n         */\n        getZIndex: function(element) {\n            var body = document.body,\n                z,\n                zIndex = -1;\n\n            element = Ext.getDom(element);\n            while (element !== body) {\n                if (!isNaN(z = Number(Ext.fly(element).getStyle('zIndex')))) {\n                    zIndex = z;\n                }\n                element = element.parentNode;\n            }\n            return zIndex;\n        },\n\n        /**\n        * @private\n        * Utility method to pass to {@link Ext.Array#sort} when sorting potential drop targets by z-index.\n        */\n        byZIndex: function(d1, d2) {\n            return d1.zIndex < d2.zIndex;\n        },\n\n        /**\n         * Helper function for getting the best match from the list of drag\n         * and drop objects returned by the drag and drop events when we are\n         * in INTERSECT mode.  It returns either the first object that the\n         * cursor is over, or the object that has the greatest overlap with\n         * the dragged element.\n         * @method getBestMatch\n         * @param  {DragDrop[]} dds The array of drag and drop objects\n         * targeted\n         * @return {DragDrop}       The best single match\n         */\n        getBestMatch: function(dds) {\n            var winner = null;\n            // Return null if the input is not what we expect\n            //if (!dds || !dds.length || dds.length == 0) {\n               // winner = null;\n            // If there is only one item, it wins\n            //} else if (dds.length == 1) {\n\n            var len = dds.length;\n\n            if (len == 1) {\n                winner = dds[0];\n            } else {\n                // Loop through the targeted items\n                for (var i=0; i<len; ++i) {\n                    var dd = dds[i];\n                    // If the cursor is over the object, it wins.  If the\n                    // cursor is over multiple matches, the first one we come\n                    // to wins.\n                    if (dd.cursorIsOver) {\n                        winner = dd;\n                        break;\n                    // Otherwise the object with the most overlap wins\n                    } else {\n                        if (!winner ||\n                            winner.overlap.getArea() < dd.overlap.getArea()) {\n                            winner = dd;\n                        }\n                    }\n                }\n            }\n\n            return winner;\n        },\n\n        /**\n         * Refreshes the cache of the top-left and bottom-right points of the\n         * drag and drop objects in the specified group(s).  This is in the\n         * format that is stored in the drag and drop instance, so typical\n         * usage is:\n         * <code>\n         * Ext.dd.DragDropMgr.refreshCache(ddinstance.groups);\n         * </code>\n         * Alternatively:\n         * <code>\n         * Ext.dd.DragDropMgr.refreshCache({group1:true, group2:true});\n         * </code>\n         * @TODO this really should be an indexed array.  Alternatively this\n         * method could accept both.\n         * @method refreshCache\n         * @param {Object} groups an associative array of groups to refresh\n         */\n        refreshCache: function(groups) {\n            for (var sGroup in groups) {\n                if (\"string\" != typeof sGroup) {\n                    continue;\n                }\n                for (var i in this.ids[sGroup]) {\n                    var oDD = this.ids[sGroup][i];\n\n                    if (this.isTypeOfDD(oDD)) {\n                    // if (this.isTypeOfDD(oDD) && oDD.isTarget) {\n                        var loc = this.getLocation(oDD);\n                        if (loc) {\n                            this.locationCache[oDD.id] = loc;\n                        } else {\n                            delete this.locationCache[oDD.id];\n                            // this will unregister the drag and drop object if\n                            // the element is not in a usable state\n                            // oDD.unreg();\n                        }\n                    }\n                }\n            }\n        },\n\n        /**\n         * This checks to make sure an element exists and is in the DOM.  The\n         * main purpose is to handle cases where innerHTML is used to remove\n         * drag and drop objects from the DOM.  IE provides an 'unspecified\n         * error' when trying to access the offsetParent of such an element\n         * @method verifyEl\n         * @param {HTMLElement} el the element to check\n         * @return {boolean} true if the element looks usable\n         */\n        verifyEl: function(el) {\n            if (el) {\n                var parent;\n                if(Ext.isIE){\n                    try{\n                        parent = el.offsetParent;\n                    }catch(e){}\n                }else{\n                    parent = el.offsetParent;\n                }\n                if (parent) {\n                    return true;\n                }\n            }\n\n            return false;\n        },\n\n        /**\n         * Returns a Region object containing the drag and drop element's position\n         * and size, including the padding configured for it\n         * @method getLocation\n         * @param {DragDrop} oDD the drag and drop object to get the\n         *                       location for\n         * @return {Ext.lib.Region} a Region object representing the total area\n         *                             the element occupies, including any padding\n         *                             the instance is configured for.\n         */\n        getLocation: function(oDD) {\n            if (! this.isTypeOfDD(oDD)) {\n                return null;\n            }\n\n            var el = oDD.getEl(), pos, x1, x2, y1, y2, t, r, b, l, region;\n\n            try {\n                pos= Ext.lib.Dom.getXY(el);\n            } catch (e) { }\n\n            if (!pos) {\n                return null;\n            }\n\n            x1 = pos[0];\n            x2 = x1 + el.offsetWidth;\n            y1 = pos[1];\n            y2 = y1 + el.offsetHeight;\n\n            t = y1 - oDD.padding[0];\n            r = x2 + oDD.padding[1];\n            b = y2 + oDD.padding[2];\n            l = x1 - oDD.padding[3];\n\n            return new Ext.lib.Region( t, r, b, l );\n        },\n\n        /**\n         * Checks the cursor location to see if it over the target\n         * @method isOverTarget\n         * @param {Ext.lib.Point} pt The point to evaluate\n         * @param {DragDrop} oTarget the DragDrop object we are inspecting\n         * @return {boolean} true if the mouse is over the target\n         * @private\n         */\n        isOverTarget: function(pt, oTarget, intersect) {\n            // use cache if available\n            var loc = this.locationCache[oTarget.id];\n            if (!loc || !this.useCache) {\n                loc = this.getLocation(oTarget);\n                this.locationCache[oTarget.id] = loc;\n\n            }\n\n            if (!loc) {\n                return false;\n            }\n\n            oTarget.cursorIsOver = loc.contains( pt );\n\n            // DragDrop is using this as a sanity check for the initial mousedown\n            // in this case we are done.  In POINT mode, if the drag obj has no\n            // contraints, we are also done. Otherwise we need to evaluate the\n            // location of the target as related to the actual location of the\n            // dragged element.\n            var dc = this.dragCurrent;\n            if (!dc || !dc.getTargetCoord ||\n                    (!intersect && !dc.constrainX && !dc.constrainY)) {\n                return oTarget.cursorIsOver;\n            }\n\n            oTarget.overlap = null;\n\n            // Get the current location of the drag element, this is the\n            // location of the mouse event less the delta that represents\n            // where the original mousedown happened on the element.  We\n            // need to consider constraints and ticks as well.\n            var pos = dc.getTargetCoord(pt.x, pt.y);\n\n            var el = dc.getDragEl();\n            var curRegion = new Ext.lib.Region( pos.y,\n                                                   pos.x + el.offsetWidth,\n                                                   pos.y + el.offsetHeight,\n                                                   pos.x );\n\n            var overlap = curRegion.intersect(loc);\n\n            if (overlap) {\n                oTarget.overlap = overlap;\n                return (intersect) ? true : oTarget.cursorIsOver;\n            } else {\n                return false;\n            }\n        },\n\n        /**\n         * unload event handler\n         * @method _onUnload\n         * @private\n         */\n        _onUnload: function(e, me) {\n            Event.removeListener(document, \"mouseup\",   this.handleMouseUp, this);\n            Event.removeListener(document, \"mousemove\", this.handleMouseMove, this);\n            Event.removeListener(window,   \"resize\",    this._onResize, this);\n            Ext.dd.DragDropMgr.unregAll();\n        },\n\n        /**\n         * Cleans up the drag and drop events and objects.\n         * @method unregAll\n         * @private\n         */\n        unregAll: function() {\n\n            if (this.dragCurrent) {\n                this.stopDrag();\n                this.dragCurrent = null;\n            }\n\n            this._execOnAll(\"unreg\", []);\n\n            for (var i in this.elementCache) {\n                delete this.elementCache[i];\n            }\n\n            this.elementCache = {};\n            this.ids = {};\n        },\n\n        /**\n         * A cache of DOM elements\n         * @property elementCache\n         * @private\n         */\n        elementCache: {},\n\n        /**\n         * Get the wrapper for the DOM element specified\n         * @method getElWrapper\n         * @param {String} id the id of the element to get\n         * @return {Ext.dd.DDM.ElementWrapper} the wrapped element\n         * @private\n         * @deprecated This wrapper isn't that useful\n         */\n        getElWrapper: function(id) {\n            var oWrapper = this.elementCache[id];\n            if (!oWrapper || !oWrapper.el) {\n                oWrapper = this.elementCache[id] =\n                    new this.ElementWrapper(Ext.getDom(id));\n            }\n            return oWrapper;\n        },\n\n        /**\n         * Returns the actual DOM element\n         * @method getElement\n         * @param {String} id the id of the elment to get\n         * @return {Object} The element\n         * @deprecated use Ext.lib.Ext.getDom instead\n         */\n        getElement: function(id) {\n            return Ext.getDom(id);\n        },\n\n        /**\n         * Returns the style property for the DOM element (i.e.,\n         * document.getElById(id).style)\n         * @method getCss\n         * @param {String} id the id of the elment to get\n         * @return {Object} The style property of the element\n         * @deprecated use Ext.lib.Dom instead\n         */\n        getCss: function(id) {\n            var el = Ext.getDom(id);\n            return (el) ? el.style : null;\n        },\n\n        /**\n         * Inner class for cached elements\n         * @class Ext.dd.DragDropMgr.ElementWrapper\n         * @for DragDropMgr\n         * @private\n         * @deprecated\n         */\n        ElementWrapper: function(el) {\n                /**\n                 * The element\n                 * @property el\n                 */\n                this.el = el || null;\n                /**\n                 * The element id\n                 * @property id\n                 */\n                this.id = this.el && el.id;\n                /**\n                 * A reference to the style property\n                 * @property css\n                 */\n                this.css = this.el && el.style;\n            },\n\n        /**\n         * Returns the X position of an html element\n         * @method getPosX\n         * @param el the element for which to get the position\n         * @return {int} the X coordinate\n         * @for DragDropMgr\n         * @deprecated use Ext.lib.Dom.getX instead\n         */\n        getPosX: function(el) {\n            return Ext.lib.Dom.getX(el);\n        },\n\n        /**\n         * Returns the Y position of an html element\n         * @method getPosY\n         * @param el the element for which to get the position\n         * @return {int} the Y coordinate\n         * @deprecated use Ext.lib.Dom.getY instead\n         */\n        getPosY: function(el) {\n            return Ext.lib.Dom.getY(el);\n        },\n\n        /**\n         * Swap two nodes.  In IE, we use the native method, for others we\n         * emulate the IE behavior\n         * @method swapNode\n         * @param n1 the first node to swap\n         * @param n2 the other node to swap\n         */\n        swapNode: function(n1, n2) {\n            if (n1.swapNode) {\n                n1.swapNode(n2);\n            } else {\n                var p = n2.parentNode;\n                var s = n2.nextSibling;\n\n                if (s == n1) {\n                    p.insertBefore(n1, n2);\n                } else if (n2 == n1.nextSibling) {\n                    p.insertBefore(n2, n1);\n                } else {\n                    n1.parentNode.replaceChild(n2, n1);\n                    p.insertBefore(n1, s);\n                }\n            }\n        },\n\n        /**\n         * Returns the current scroll position\n         * @method getScroll\n         * @private\n         */\n        getScroll: function () {\n            var t, l, dde=document.documentElement, db=document.body;\n            if (dde && (dde.scrollTop || dde.scrollLeft)) {\n                t = dde.scrollTop;\n                l = dde.scrollLeft;\n            } else if (db) {\n                t = db.scrollTop;\n                l = db.scrollLeft;\n            } else {\n\n            }\n            return { top: t, left: l };\n        },\n\n        /**\n         * Returns the specified element style property\n         * @method getStyle\n         * @param {HTMLElement} el          the element\n         * @param {string}      styleProp   the style property\n         * @return {string} The value of the style property\n         * @deprecated use Ext.lib.Dom.getStyle\n         */\n        getStyle: function(el, styleProp) {\n            return Ext.fly(el).getStyle(styleProp);\n        },\n\n        /**\n         * Gets the scrollTop\n         * @method getScrollTop\n         * @return {int} the document's scrollTop\n         */\n        getScrollTop: function () {\n            return this.getScroll().top;\n        },\n\n        /**\n         * Gets the scrollLeft\n         * @method getScrollLeft\n         * @return {int} the document's scrollTop\n         */\n        getScrollLeft: function () {\n            return this.getScroll().left;\n        },\n\n        /**\n         * Sets the x/y position of an element to the location of the\n         * target element.\n         * @method moveToEl\n         * @param {HTMLElement} moveEl      The element to move\n         * @param {HTMLElement} targetEl    The position reference element\n         */\n        moveToEl: function (moveEl, targetEl) {\n            var aCoord = Ext.lib.Dom.getXY(targetEl);\n            Ext.lib.Dom.setXY(moveEl, aCoord);\n        },\n\n        /**\n         * Numeric array sort function\n         * @method numericSort\n         */\n        numericSort: function(a, b) {\n            return (a - b);\n        },\n\n        /**\n         * Internal counter\n         * @property _timeoutCount\n         * @private\n         */\n        _timeoutCount: 0,\n\n        /**\n         * Trying to make the load order less important.  Without this we get\n         * an error if this file is loaded before the Event Utility.\n         * @method _addListeners\n         * @private\n         */\n        _addListeners: function() {\n            var DDM = Ext.dd.DDM;\n            if ( Ext.lib.Event && document ) {\n                DDM._onLoad();\n            } else {\n                if (DDM._timeoutCount > 2000) {\n                } else {\n                    setTimeout(DDM._addListeners, 10);\n                    if (document && document.body) {\n                        DDM._timeoutCount += 1;\n                    }\n                }\n            }\n        },\n\n        /**\n         * Recursively searches the immediate parent and all child nodes for\n         * the handle element in order to determine wheter or not it was\n         * clicked.\n         * @method handleWasClicked\n         * @param node the html element to inspect\n         */\n        handleWasClicked: function(node, id) {\n            if (this.isHandle(id, node.id)) {\n                return true;\n            } else {\n                // check to see if this is a text node child of the one we want\n                var p = node.parentNode;\n\n                while (p) {\n                    if (this.isHandle(id, p.id)) {\n                        return true;\n                    } else {\n                        p = p.parentNode;\n                    }\n                }\n            }\n\n            return false;\n        }\n\n    };\n\n}();\n\n// shorter alias, save a few bytes\nExt.dd.DDM = Ext.dd.DragDropMgr;\nExt.dd.DDM._addListeners();\n\n}\n\n/**\n * @class Ext.dd.DD\n * A DragDrop implementation where the linked element follows the\n * mouse cursor during a drag.\n * @extends Ext.dd.DragDrop\n * @constructor\n * @param {String} id the id of the linked element\n * @param {String} sGroup the group of related DragDrop items\n * @param {object} config an object containing configurable attributes\n *                Valid properties for DD:\n *                    scroll\n */\nExt.dd.DD = function(id, sGroup, config) {\n    if (id) {\n        this.init(id, sGroup, config);\n    }\n};\n\nExt.extend(Ext.dd.DD, Ext.dd.DragDrop, {\n\n    /**\n     * When set to true, the utility automatically tries to scroll the browser\n     * window when a drag and drop element is dragged near the viewport boundary.\n     * Defaults to true.\n     * @property scroll\n     * @type boolean\n     */\n    scroll: true,\n\n    /**\n     * Sets the pointer offset to the distance between the linked element's top\n     * left corner and the location the element was clicked\n     * @method autoOffset\n     * @param {int} iPageX the X coordinate of the click\n     * @param {int} iPageY the Y coordinate of the click\n     */\n    autoOffset: function(iPageX, iPageY) {\n        var x = iPageX - this.startPageX;\n        var y = iPageY - this.startPageY;\n        this.setDelta(x, y);\n    },\n\n    /**\n     * Sets the pointer offset.  You can call this directly to force the\n     * offset to be in a particular location (e.g., pass in 0,0 to set it\n     * to the center of the object)\n     * @method setDelta\n     * @param {int} iDeltaX the distance from the left\n     * @param {int} iDeltaY the distance from the top\n     */\n    setDelta: function(iDeltaX, iDeltaY) {\n        this.deltaX = iDeltaX;\n        this.deltaY = iDeltaY;\n    },\n\n    /**\n     * Sets the drag element to the location of the mousedown or click event,\n     * maintaining the cursor location relative to the location on the element\n     * that was clicked.  Override this if you want to place the element in a\n     * location other than where the cursor is.\n     * @method setDragElPos\n     * @param {int} iPageX the X coordinate of the mousedown or drag event\n     * @param {int} iPageY the Y coordinate of the mousedown or drag event\n     */\n    setDragElPos: function(iPageX, iPageY) {\n        // the first time we do this, we are going to check to make sure\n        // the element has css positioning\n\n        var el = this.getDragEl();\n        this.alignElWithMouse(el, iPageX, iPageY);\n    },\n\n    /**\n     * Sets the element to the location of the mousedown or click event,\n     * maintaining the cursor location relative to the location on the element\n     * that was clicked.  Override this if you want to place the element in a\n     * location other than where the cursor is.\n     * @method alignElWithMouse\n     * @param {HTMLElement} el the element to move\n     * @param {int} iPageX the X coordinate of the mousedown or drag event\n     * @param {int} iPageY the Y coordinate of the mousedown or drag event\n     */\n    alignElWithMouse: function(el, iPageX, iPageY) {\n        var oCoord = this.getTargetCoord(iPageX, iPageY);\n        var fly = el.dom ? el : Ext.fly(el, '_dd');\n        if (!this.deltaSetXY) {\n            var aCoord = [oCoord.x, oCoord.y];\n            fly.setXY(aCoord);\n            var newLeft = fly.getLeft(true);\n            var newTop  = fly.getTop(true);\n            this.deltaSetXY = [ newLeft - oCoord.x, newTop - oCoord.y ];\n        } else {\n            fly.setLeftTop(oCoord.x + this.deltaSetXY[0], oCoord.y + this.deltaSetXY[1]);\n        }\n\n        this.cachePosition(oCoord.x, oCoord.y);\n        this.autoScroll(oCoord.x, oCoord.y, el.offsetHeight, el.offsetWidth);\n        return oCoord;\n    },\n\n    /**\n     * Saves the most recent position so that we can reset the constraints and\n     * tick marks on-demand.  We need to know this so that we can calculate the\n     * number of pixels the element is offset from its original position.\n     * @method cachePosition\n     * @param iPageX the current x position (optional, this just makes it so we\n     * don't have to look it up again)\n     * @param iPageY the current y position (optional, this just makes it so we\n     * don't have to look it up again)\n     */\n    cachePosition: function(iPageX, iPageY) {\n        if (iPageX) {\n            this.lastPageX = iPageX;\n            this.lastPageY = iPageY;\n        } else {\n            var aCoord = Ext.lib.Dom.getXY(this.getEl());\n            this.lastPageX = aCoord[0];\n            this.lastPageY = aCoord[1];\n        }\n    },\n\n    /**\n     * Auto-scroll the window if the dragged object has been moved beyond the\n     * visible window boundary.\n     * @method autoScroll\n     * @param {int} x the drag element's x position\n     * @param {int} y the drag element's y position\n     * @param {int} h the height of the drag element\n     * @param {int} w the width of the drag element\n     * @private\n     */\n    autoScroll: function(x, y, h, w) {\n\n        if (this.scroll) {\n            // The client height\n            var clientH = Ext.lib.Dom.getViewHeight();\n\n            // The client width\n            var clientW = Ext.lib.Dom.getViewWidth();\n\n            // The amt scrolled down\n            var st = this.DDM.getScrollTop();\n\n            // The amt scrolled right\n            var sl = this.DDM.getScrollLeft();\n\n            // Location of the bottom of the element\n            var bot = h + y;\n\n            // Location of the right of the element\n            var right = w + x;\n\n            // The distance from the cursor to the bottom of the visible area,\n            // adjusted so that we don't scroll if the cursor is beyond the\n            // element drag constraints\n            var toBot = (clientH + st - y - this.deltaY);\n\n            // The distance from the cursor to the right of the visible area\n            var toRight = (clientW + sl - x - this.deltaX);\n\n\n            // How close to the edge the cursor must be before we scroll\n            // var thresh = (document.all) ? 100 : 40;\n            var thresh = 40;\n\n            // How many pixels to scroll per autoscroll op.  This helps to reduce\n            // clunky scrolling. IE is more sensitive about this ... it needs this\n            // value to be higher.\n            var scrAmt = (document.all) ? 80 : 30;\n\n            // Scroll down if we are near the bottom of the visible page and the\n            // obj extends below the crease\n            if ( bot > clientH && toBot < thresh ) {\n                window.scrollTo(sl, st + scrAmt);\n            }\n\n            // Scroll up if the window is scrolled down and the top of the object\n            // goes above the top border\n            if ( y < st && st > 0 && y - st < thresh ) {\n                window.scrollTo(sl, st - scrAmt);\n            }\n\n            // Scroll right if the obj is beyond the right border and the cursor is\n            // near the border.\n            if ( right > clientW && toRight < thresh ) {\n                window.scrollTo(sl + scrAmt, st);\n            }\n\n            // Scroll left if the window has been scrolled to the right and the obj\n            // extends past the left border\n            if ( x < sl && sl > 0 && x - sl < thresh ) {\n                window.scrollTo(sl - scrAmt, st);\n            }\n        }\n    },\n\n    /**\n     * Finds the location the element should be placed if we want to move\n     * it to where the mouse location less the click offset would place us.\n     * @method getTargetCoord\n     * @param {int} iPageX the X coordinate of the click\n     * @param {int} iPageY the Y coordinate of the click\n     * @return an object that contains the coordinates (Object.x and Object.y)\n     * @private\n     */\n    getTargetCoord: function(iPageX, iPageY) {\n        var x = iPageX - this.deltaX;\n        var y = iPageY - this.deltaY;\n\n        if (this.constrainX) {\n            if (x < this.minX) { x = this.minX; }\n            if (x > this.maxX) { x = this.maxX; }\n        }\n\n        if (this.constrainY) {\n            if (y < this.minY) { y = this.minY; }\n            if (y > this.maxY) { y = this.maxY; }\n        }\n\n        x = this.getTick(x, this.xTicks);\n        y = this.getTick(y, this.yTicks);\n\n\n        return {x:x, y:y};\n    },\n\n    /**\n     * Sets up config options specific to this class. Overrides\n     * Ext.dd.DragDrop, but all versions of this method through the\n     * inheritance chain are called\n     */\n    applyConfig: function() {\n        Ext.dd.DD.superclass.applyConfig.call(this);\n        this.scroll = (this.config.scroll !== false);\n    },\n\n    /**\n     * Event that fires prior to the onMouseDown event.  Overrides\n     * Ext.dd.DragDrop.\n     */\n    b4MouseDown: function(e) {\n        // this.resetConstraints();\n        this.autoOffset(e.getPageX(),\n                            e.getPageY());\n    },\n\n    /**\n     * Event that fires prior to the onDrag event.  Overrides\n     * Ext.dd.DragDrop.\n     */\n    b4Drag: function(e) {\n        this.setDragElPos(e.getPageX(),\n                            e.getPageY());\n    },\n\n    toString: function() {\n        return (\"DD \" + this.id);\n    }\n\n    //////////////////////////////////////////////////////////////////////////\n    // Debugging ygDragDrop events that can be overridden\n    //////////////////////////////////////////////////////////////////////////\n    /*\n    startDrag: function(x, y) {\n    },\n\n    onDrag: function(e) {\n    },\n\n    onDragEnter: function(e, id) {\n    },\n\n    onDragOver: function(e, id) {\n    },\n\n    onDragOut: function(e, id) {\n    },\n\n    onDragDrop: function(e, id) {\n    },\n\n    endDrag: function(e) {\n    }\n\n    */\n\n});\n/**\n * @class Ext.dd.DDProxy\n * A DragDrop implementation that inserts an empty, bordered div into\n * the document that follows the cursor during drag operations.  At the time of\n * the click, the frame div is resized to the dimensions of the linked html\n * element, and moved to the exact location of the linked element.\n *\n * References to the \"frame\" element refer to the single proxy element that\n * was created to be dragged in place of all DDProxy elements on the\n * page.\n *\n * @extends Ext.dd.DD\n * @constructor\n * @param {String} id the id of the linked html element\n * @param {String} sGroup the group of related DragDrop objects\n * @param {object} config an object containing configurable attributes\n *                Valid properties for DDProxy in addition to those in DragDrop:\n *                   resizeFrame, centerFrame, dragElId\n */\nExt.dd.DDProxy = function(id, sGroup, config) {\n    if (id) {\n        this.init(id, sGroup, config);\n        this.initFrame();\n    }\n};\n\n/**\n * The default drag frame div id\n * @property Ext.dd.DDProxy.dragElId\n * @type String\n * @static\n */\nExt.dd.DDProxy.dragElId = \"ygddfdiv\";\n\nExt.extend(Ext.dd.DDProxy, Ext.dd.DD, {\n\n    /**\n     * By default we resize the drag frame to be the same size as the element\n     * we want to drag (this is to get the frame effect).  We can turn it off\n     * if we want a different behavior.\n     * @property resizeFrame\n     * @type boolean\n     */\n    resizeFrame: true,\n\n    /**\n     * By default the frame is positioned exactly where the drag element is, so\n     * we use the cursor offset provided by Ext.dd.DD.  Another option that works only if\n     * you do not have constraints on the obj is to have the drag frame centered\n     * around the cursor.  Set centerFrame to true for this effect.\n     * @property centerFrame\n     * @type boolean\n     */\n    centerFrame: false,\n\n    /**\n     * Creates the proxy element if it does not yet exist\n     * @method createFrame\n     */\n    createFrame: function() {\n        var self = this;\n        var body = document.body;\n\n        if (!body || !body.firstChild) {\n            setTimeout( function() { self.createFrame(); }, 50 );\n            return;\n        }\n\n        var div = this.getDragEl();\n\n        if (!div) {\n            div    = document.createElement(\"div\");\n            div.id = this.dragElId;\n            var s  = div.style;\n\n            s.position   = \"absolute\";\n            s.visibility = \"hidden\";\n            s.cursor     = \"move\";\n            s.border     = \"2px solid #aaa\";\n            s.zIndex     = 999;\n\n            // appendChild can blow up IE if invoked prior to the window load event\n            // while rendering a table.  It is possible there are other scenarios\n            // that would cause this to happen as well.\n            body.insertBefore(div, body.firstChild);\n        }\n    },\n\n    /**\n     * Initialization for the drag frame element.  Must be called in the\n     * constructor of all subclasses\n     * @method initFrame\n     */\n    initFrame: function() {\n        this.createFrame();\n    },\n\n    applyConfig: function() {\n        Ext.dd.DDProxy.superclass.applyConfig.call(this);\n\n        this.resizeFrame = (this.config.resizeFrame !== false);\n        this.centerFrame = (this.config.centerFrame);\n        this.setDragElId(this.config.dragElId || Ext.dd.DDProxy.dragElId);\n    },\n\n    /**\n     * Resizes the drag frame to the dimensions of the clicked object, positions\n     * it over the object, and finally displays it\n     * @method showFrame\n     * @param {int} iPageX X click position\n     * @param {int} iPageY Y click position\n     * @private\n     */\n    showFrame: function(iPageX, iPageY) {\n        var el = this.getEl();\n        var dragEl = this.getDragEl();\n        var s = dragEl.style;\n\n        this._resizeProxy();\n\n        if (this.centerFrame) {\n            this.setDelta( Math.round(parseInt(s.width,  10)/2),\n                           Math.round(parseInt(s.height, 10)/2) );\n        }\n\n        this.setDragElPos(iPageX, iPageY);\n\n        Ext.fly(dragEl).show();\n    },\n\n    /**\n     * The proxy is automatically resized to the dimensions of the linked\n     * element when a drag is initiated, unless resizeFrame is set to false\n     * @method _resizeProxy\n     * @private\n     */\n    _resizeProxy: function() {\n        if (this.resizeFrame) {\n            var el = this.getEl();\n            Ext.fly(this.getDragEl()).setSize(el.offsetWidth, el.offsetHeight);\n        }\n    },\n\n    // overrides Ext.dd.DragDrop\n    b4MouseDown: function(e) {\n        var x = e.getPageX();\n        var y = e.getPageY();\n        this.autoOffset(x, y);\n        this.setDragElPos(x, y);\n    },\n\n    // overrides Ext.dd.DragDrop\n    b4StartDrag: function(x, y) {\n        // show the drag frame\n        this.showFrame(x, y);\n    },\n\n    // overrides Ext.dd.DragDrop\n    b4EndDrag: function(e) {\n        Ext.fly(this.getDragEl()).hide();\n    },\n\n    // overrides Ext.dd.DragDrop\n    // By default we try to move the element to the last location of the frame.\n    // This is so that the default behavior mirrors that of Ext.dd.DD.\n    endDrag: function(e) {\n\n        var lel = this.getEl();\n        var del = this.getDragEl();\n\n        // Show the drag frame briefly so we can get its position\n        del.style.visibility = \"\";\n\n        this.beforeMove();\n        // Hide the linked element before the move to get around a Safari\n        // rendering bug.\n        lel.style.visibility = \"hidden\";\n        Ext.dd.DDM.moveToEl(lel, del);\n        del.style.visibility = \"hidden\";\n        lel.style.visibility = \"\";\n\n        this.afterDrag();\n    },\n\n    beforeMove : function(){\n\n    },\n\n    afterDrag : function(){\n\n    },\n\n    toString: function() {\n        return (\"DDProxy \" + this.id);\n    }\n\n});\n/**\n * @class Ext.dd.DDTarget\n * A DragDrop implementation that does not move, but can be a drop\n * target.  You would get the same result by simply omitting implementation\n * for the event callbacks, but this way we reduce the processing cost of the\n * event listener and the callbacks.\n * @extends Ext.dd.DragDrop\n * @constructor\n * @param {String} id the id of the element that is a drop target\n * @param {String} sGroup the group of related DragDrop objects\n * @param {object} config an object containing configurable attributes\n *                 Valid properties for DDTarget in addition to those in\n *                 DragDrop:\n *                    none\n */\nExt.dd.DDTarget = function(id, sGroup, config) {\n    if (id) {\n        this.initTarget(id, sGroup, config);\n    }\n};\n\n// Ext.dd.DDTarget.prototype = new Ext.dd.DragDrop();\nExt.extend(Ext.dd.DDTarget, Ext.dd.DragDrop, {\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    getDragEl: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    isValidHandleChild: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    startDrag: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    endDrag: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    onDrag: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    onDragDrop: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    onDragEnter: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    onDragOut: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    onDragOver: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    onInvalidDrop: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    onMouseDown: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    onMouseUp: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    setXConstraint: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    setYConstraint: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    resetConstraints: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    clearConstraints: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    clearTicks: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    setInitPosition: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    setDragElId: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    setHandleElId: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    setOuterHandleElId: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    addInvalidHandleClass: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    addInvalidHandleId: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    addInvalidHandleType: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    removeInvalidHandleClass: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    removeInvalidHandleId: Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. A DDTarget does not support being dragged.\n     * @method\n     */\n    removeInvalidHandleType: Ext.emptyFn,\n\n    toString: function() {\n        return (\"DDTarget \" + this.id);\n    }\n});/**\n * @class Ext.dd.DragTracker\n * @extends Ext.util.Observable\n * A DragTracker listens for drag events on an Element and fires events at the start and end of the drag,\n * as well as during the drag. This is useful for components such as {@link Ext.slider.MultiSlider}, where there is\n * an element that can be dragged around to change the Slider's value.\n * DragTracker provides a series of template methods that should be overridden to provide functionality\n * in response to detected drag operations. These are onBeforeStart, onStart, onDrag and onEnd.\n * See {@link Ext.slider.MultiSlider}'s initEvents function for an example implementation.\n */\nExt.dd.DragTracker = Ext.extend(Ext.util.Observable,  {    \n    /**\n     * @cfg {Boolean} active\n\t * Defaults to <tt>false</tt>.\n\t */\t\n    active: false,\n    /**\n     * @cfg {Number} tolerance\n\t * Number of pixels the drag target must be moved before dragging is considered to have started. Defaults to <tt>5</tt>.\n\t */\t\n    tolerance: 5,\n    /**\n     * @cfg {Boolean/Number} autoStart\n\t * Defaults to <tt>false</tt>. Specify <tt>true</tt> to defer trigger start by 1000 ms.\n\t * Specify a Number for the number of milliseconds to defer trigger start.\n\t */\t\n    autoStart: false,\n    \n    constructor : function(config){\n        Ext.apply(this, config);\n\t    this.addEvents(\n\t        /**\n\t         * @event mousedown\n\t         * @param {Object} this\n\t         * @param {Object} e event object\n\t         */\n\t        'mousedown',\n\t        /**\n\t         * @event mouseup\n\t         * @param {Object} this\n\t         * @param {Object} e event object\n\t         */\n\t        'mouseup',\n\t        /**\n\t         * @event mousemove\n\t         * @param {Object} this\n\t         * @param {Object} e event object\n\t         */\n\t        'mousemove',\n\t        /**\n\t         * @event dragstart\n\t         * @param {Object} this\n\t         * @param {Object} e event object\n\t         */\n\t        'dragstart',\n\t        /**\n\t         * @event dragend\n\t         * @param {Object} this\n\t         * @param {Object} e event object\n\t         */\n\t        'dragend',\n\t        /**\n\t         * @event drag\n\t         * @param {Object} this\n\t         * @param {Object} e event object\n\t         */\n\t        'drag'\n\t    );\n\t\n\t    this.dragRegion = new Ext.lib.Region(0,0,0,0);\n\t\n\t    if(this.el){\n\t        this.initEl(this.el);\n\t    }\n        Ext.dd.DragTracker.superclass.constructor.call(this, config);\n    },\n\n    initEl: function(el){\n        this.el = Ext.get(el);\n        el.on('mousedown', this.onMouseDown, this,\n                this.delegate ? {delegate: this.delegate} : undefined);\n    },\n\n    destroy : function(){\n        this.el.un('mousedown', this.onMouseDown, this);\n        delete this.el;\n    },\n\n    onMouseDown: function(e, target){\n        if(this.fireEvent('mousedown', this, e) !== false && this.onBeforeStart(e) !== false){\n            this.startXY = this.lastXY = e.getXY();\n            this.dragTarget = this.delegate ? target : this.el.dom;\n            if(this.preventDefault !== false){\n                e.preventDefault();\n            }\n            Ext.getDoc().on({\n                scope: this,\n                mouseup: this.onMouseUp,\n                mousemove: this.onMouseMove,\n                selectstart: this.stopSelect\n            });\n            if(this.autoStart){\n                this.timer = this.triggerStart.defer(this.autoStart === true ? 1000 : this.autoStart, this, [e]);\n            }\n        }\n    },\n\n    onMouseMove: function(e, target){\n        // HACK: IE hack to see if button was released outside of window. Resolved in IE9.\n        var ieCheck = Ext.isIE6 || Ext.isIE7 || Ext.isIE8;\n        if(this.active && ieCheck && !e.browserEvent.button){\n            e.preventDefault();\n            this.onMouseUp(e);\n            return;\n        }\n\n        e.preventDefault();\n        var xy = e.getXY(), s = this.startXY;\n        this.lastXY = xy;\n        if(!this.active){\n            if(Math.abs(s[0]-xy[0]) > this.tolerance || Math.abs(s[1]-xy[1]) > this.tolerance){\n                this.triggerStart(e);\n            }else{\n                return;\n            }\n        }\n        this.fireEvent('mousemove', this, e);\n        this.onDrag(e);\n        this.fireEvent('drag', this, e);\n    },\n\n    onMouseUp: function(e) {\n        var doc = Ext.getDoc(),\n            wasActive = this.active;\n            \n        doc.un('mousemove', this.onMouseMove, this);\n        doc.un('mouseup', this.onMouseUp, this);\n        doc.un('selectstart', this.stopSelect, this);\n        e.preventDefault();\n        this.clearStart();\n        this.active = false;\n        delete this.elRegion;\n        this.fireEvent('mouseup', this, e);\n        if(wasActive){\n            this.onEnd(e);\n            this.fireEvent('dragend', this, e);\n        }\n    },\n\n    triggerStart: function(e) {\n        this.clearStart();\n        this.active = true;\n        this.onStart(e);\n        this.fireEvent('dragstart', this, e);\n    },\n\n    clearStart : function() {\n        if(this.timer){\n            clearTimeout(this.timer);\n            delete this.timer;\n        }\n    },\n\n    stopSelect : function(e) {\n        e.stopEvent();\n        return false;\n    },\n    \n    /**\n     * Template method which should be overridden by each DragTracker instance. Called when the user first clicks and\n     * holds the mouse button down. Return false to disallow the drag\n     * @param {Ext.EventObject} e The event object\n     */\n    onBeforeStart : function(e) {\n\n    },\n\n    /**\n     * Template method which should be overridden by each DragTracker instance. Called when a drag operation starts\n     * (e.g. the user has moved the tracked element beyond the specified tolerance)\n     * @param {Ext.EventObject} e The event object\n     */\n    onStart : function(xy) {\n\n    },\n\n    /**\n     * Template method which should be overridden by each DragTracker instance. Called whenever a drag has been detected.\n     * @param {Ext.EventObject} e The event object\n     */\n    onDrag : function(e) {\n\n    },\n\n    /**\n     * Template method which should be overridden by each DragTracker instance. Called when a drag operation has been completed\n     * (e.g. the user clicked and held the mouse down, dragged the element and then released the mouse button)\n     * @param {Ext.EventObject} e The event object\n     */\n    onEnd : function(e) {\n\n    },\n\n    /**\n     * Returns the drag target\n     * @return {Ext.Element} The element currently being tracked\n     */\n    getDragTarget : function(){\n        return this.dragTarget;\n    },\n\n    getDragCt : function(){\n        return this.el;\n    },\n\n    getXY : function(constrain){\n        return constrain ?\n               this.constrainModes[constrain].call(this, this.lastXY) : this.lastXY;\n    },\n\n    getOffset : function(constrain){\n        var xy = this.getXY(constrain),\n            s = this.startXY;\n        return [s[0]-xy[0], s[1]-xy[1]];\n    },\n\n    constrainModes: {\n        'point' : function(xy){\n\n            if(!this.elRegion){\n                this.elRegion = this.getDragCt().getRegion();\n            }\n\n            var dr = this.dragRegion;\n\n            dr.left = xy[0];\n            dr.top = xy[1];\n            dr.right = xy[0];\n            dr.bottom = xy[1];\n\n            dr.constrainTo(this.elRegion);\n\n            return [dr.left, dr.top];\n        }\n    }\n});/**\n * @class Ext.dd.ScrollManager\n * <p>Provides automatic scrolling of overflow regions in the page during drag operations.</p>\n * <p>The ScrollManager configs will be used as the defaults for any scroll container registered with it,\n * but you can also override most of the configs per scroll container by adding a \n * <tt>ddScrollConfig</tt> object to the target element that contains these properties: {@link #hthresh},\n * {@link #vthresh}, {@link #increment} and {@link #frequency}.  Example usage:\n * <pre><code>\nvar el = Ext.get('scroll-ct');\nel.ddScrollConfig = {\n    vthresh: 50,\n    hthresh: -1,\n    frequency: 100,\n    increment: 200\n};\nExt.dd.ScrollManager.register(el);\n</code></pre>\n * <b>Note: This class uses \"Point Mode\" and is untested in \"Intersect Mode\".</b>\n * @singleton\n */\nExt.dd.ScrollManager = function(){\n    var ddm = Ext.dd.DragDropMgr;\n    var els = {};\n    var dragEl = null;\n    var proc = {};\n    \n    var onStop = function(e){\n        dragEl = null;\n        clearProc();\n    };\n    \n    var triggerRefresh = function(){\n        if(ddm.dragCurrent){\n             ddm.refreshCache(ddm.dragCurrent.groups);\n        }\n    };\n    \n    var doScroll = function(){\n        if(ddm.dragCurrent){\n            var dds = Ext.dd.ScrollManager;\n            var inc = proc.el.ddScrollConfig ?\n                      proc.el.ddScrollConfig.increment : dds.increment;\n            if(!dds.animate){\n                if(proc.el.scroll(proc.dir, inc)){\n                    triggerRefresh();\n                }\n            }else{\n                proc.el.scroll(proc.dir, inc, true, dds.animDuration, triggerRefresh);\n            }\n        }\n    };\n    \n    var clearProc = function(){\n        if(proc.id){\n            clearInterval(proc.id);\n        }\n        proc.id = 0;\n        proc.el = null;\n        proc.dir = \"\";\n    };\n\n    var startProc = function(el, dir){\n        clearProc();\n        proc.el = el;\n        proc.dir = dir;\n        var group = el.ddScrollConfig ? el.ddScrollConfig.ddGroup : undefined,\n            freq  = (el.ddScrollConfig && el.ddScrollConfig.frequency)\n                  ? el.ddScrollConfig.frequency\n                  : Ext.dd.ScrollManager.frequency;\n\n        if (group === undefined || ddm.dragCurrent.ddGroup == group) {\n            proc.id = setInterval(doScroll, freq);\n        }\n    };\n    \n    var onFire = function(e, isDrop){\n        if(isDrop || !ddm.dragCurrent){ return; }\n        var dds = Ext.dd.ScrollManager;\n        if(!dragEl || dragEl != ddm.dragCurrent){\n            dragEl = ddm.dragCurrent;\n            // refresh regions on drag start\n            dds.refreshCache();\n        }\n        \n        var xy = Ext.lib.Event.getXY(e);\n        var pt = new Ext.lib.Point(xy[0], xy[1]);\n        for(var id in els){\n            var el = els[id], r = el._region;\n            var c = el.ddScrollConfig ? el.ddScrollConfig : dds;\n            if(r && r.contains(pt) && el.isScrollable()){\n                if(r.bottom - pt.y <= c.vthresh){\n                    if(proc.el != el){\n                        startProc(el, \"down\");\n                    }\n                    return;\n                }else if(r.right - pt.x <= c.hthresh){\n                    if(proc.el != el){\n                        startProc(el, \"left\");\n                    }\n                    return;\n                }else if(pt.y - r.top <= c.vthresh){\n                    if(proc.el != el){\n                        startProc(el, \"up\");\n                    }\n                    return;\n                }else if(pt.x - r.left <= c.hthresh){\n                    if(proc.el != el){\n                        startProc(el, \"right\");\n                    }\n                    return;\n                }\n            }\n        }\n        clearProc();\n    };\n    \n    ddm.fireEvents = ddm.fireEvents.createSequence(onFire, ddm);\n    ddm.stopDrag = ddm.stopDrag.createSequence(onStop, ddm);\n    \n    return {\n        /**\n         * Registers new overflow element(s) to auto scroll\n         * @param {Mixed/Array} el The id of or the element to be scrolled or an array of either\n         */\n        register : function(el){\n            if(Ext.isArray(el)){\n                for(var i = 0, len = el.length; i < len; i++) {\n                \tthis.register(el[i]);\n                }\n            }else{\n                el = Ext.get(el);\n                els[el.id] = el;\n            }\n        },\n        \n        /**\n         * Unregisters overflow element(s) so they are no longer scrolled\n         * @param {Mixed/Array} el The id of or the element to be removed or an array of either\n         */\n        unregister : function(el){\n            if(Ext.isArray(el)){\n                for(var i = 0, len = el.length; i < len; i++) {\n                \tthis.unregister(el[i]);\n                }\n            }else{\n                el = Ext.get(el);\n                delete els[el.id];\n            }\n        },\n        \n        /**\n         * The number of pixels from the top or bottom edge of a container the pointer needs to be to\n         * trigger scrolling (defaults to 25)\n         * @type Number\n         */\n        vthresh : 25,\n        /**\n         * The number of pixels from the right or left edge of a container the pointer needs to be to\n         * trigger scrolling (defaults to 25)\n         * @type Number\n         */\n        hthresh : 25,\n\n        /**\n         * The number of pixels to scroll in each scroll increment (defaults to 100)\n         * @type Number\n         */\n        increment : 100,\n        \n        /**\n         * The frequency of scrolls in milliseconds (defaults to 500)\n         * @type Number\n         */\n        frequency : 500,\n        \n        /**\n         * True to animate the scroll (defaults to true)\n         * @type Boolean\n         */\n        animate: true,\n        \n        /**\n         * The animation duration in seconds - \n         * MUST BE less than Ext.dd.ScrollManager.frequency! (defaults to .4)\n         * @type Number\n         */\n        animDuration: .4,\n        \n        /**\n         * The named drag drop {@link Ext.dd.DragSource#ddGroup group} to which this container belongs (defaults to undefined). \n         * If a ddGroup is specified, then container scrolling will only occur when a dragged object is in the same ddGroup.\n         * @type String\n         */\n        ddGroup: undefined,\n        \n        /**\n         * Manually trigger a cache refresh.\n         */\n        refreshCache : function(){\n            for(var id in els){\n                if(typeof els[id] == 'object'){ // for people extending the object prototype\n                    els[id]._region = els[id].getRegion();\n                }\n            }\n        }\n    };\n}();/**\n * @class Ext.dd.Registry\n * Provides easy access to all drag drop components that are registered on a page.  Items can be retrieved either\n * directly by DOM node id, or by passing in the drag drop event that occurred and looking up the event target.\n * @singleton\n */\nExt.dd.Registry = function(){\n    var elements = {}; \n    var handles = {}; \n    var autoIdSeed = 0;\n\n    var getId = function(el, autogen){\n        if(typeof el == \"string\"){\n            return el;\n        }\n        var id = el.id;\n        if(!id && autogen !== false){\n            id = \"extdd-\" + (++autoIdSeed);\n            el.id = id;\n        }\n        return id;\n    };\n    \n    return {\n    /**\n     * Resgister a drag drop element\n     * @param {String/HTMLElement} element The id or DOM node to register\n     * @param {Object} data (optional) An custom data object that will be passed between the elements that are involved\n     * in drag drop operations.  You can populate this object with any arbitrary properties that your own code\n     * knows how to interpret, plus there are some specific properties known to the Registry that should be\n     * populated in the data object (if applicable):\n     * <pre>\nValue      Description<br />\n---------  ------------------------------------------<br />\nhandles    Array of DOM nodes that trigger dragging<br />\n           for the element being registered<br />\nisHandle   True if the element passed in triggers<br />\n           dragging itself, else false\n</pre>\n     */\n        register : function(el, data){\n            data = data || {};\n            if(typeof el == \"string\"){\n                el = document.getElementById(el);\n            }\n            data.ddel = el;\n            elements[getId(el)] = data;\n            if(data.isHandle !== false){\n                handles[data.ddel.id] = data;\n            }\n            if(data.handles){\n                var hs = data.handles;\n                for(var i = 0, len = hs.length; i < len; i++){\n                \thandles[getId(hs[i])] = data;\n                }\n            }\n        },\n\n    /**\n     * Unregister a drag drop element\n     * @param {String/HTMLElement} element The id or DOM node to unregister\n     */\n        unregister : function(el){\n            var id = getId(el, false);\n            var data = elements[id];\n            if(data){\n                delete elements[id];\n                if(data.handles){\n                    var hs = data.handles;\n                    for(var i = 0, len = hs.length; i < len; i++){\n                    \tdelete handles[getId(hs[i], false)];\n                    }\n                }\n            }\n        },\n\n    /**\n     * Returns the handle registered for a DOM Node by id\n     * @param {String/HTMLElement} id The DOM node or id to look up\n     * @return {Object} handle The custom handle data\n     */\n        getHandle : function(id){\n            if(typeof id != \"string\"){ // must be element?\n                id = id.id;\n            }\n            return handles[id];\n        },\n\n    /**\n     * Returns the handle that is registered for the DOM node that is the target of the event\n     * @param {Event} e The event\n     * @return {Object} handle The custom handle data\n     */\n        getHandleFromEvent : function(e){\n            var t = Ext.lib.Event.getTarget(e);\n            return t ? handles[t.id] : null;\n        },\n\n    /**\n     * Returns a custom data object that is registered for a DOM node by id\n     * @param {String/HTMLElement} id The DOM node or id to look up\n     * @return {Object} data The custom data\n     */\n        getTarget : function(id){\n            if(typeof id != \"string\"){ // must be element?\n                id = id.id;\n            }\n            return elements[id];\n        },\n\n    /**\n     * Returns a custom data object that is registered for the DOM node that is the target of the event\n     * @param {Event} e The event\n     * @return {Object} data The custom data\n     */\n        getTargetFromEvent : function(e){\n            var t = Ext.lib.Event.getTarget(e);\n            return t ? elements[t.id] || handles[t.id] : null;\n        }\n    };\n}();/**\n * @class Ext.dd.StatusProxy\n * A specialized drag proxy that supports a drop status icon, {@link Ext.Layer} styles and auto-repair.  This is the\n * default drag proxy used by all Ext.dd components.\n * @constructor\n * @param {Object} config\n */\nExt.dd.StatusProxy = function(config){\n    Ext.apply(this, config);\n    this.id = this.id || Ext.id();\n    this.el = new Ext.Layer({\n        dh: {\n            id: this.id, tag: \"div\", cls: \"x-dd-drag-proxy \"+this.dropNotAllowed, children: [\n                {tag: \"div\", cls: \"x-dd-drop-icon\"},\n                {tag: \"div\", cls: \"x-dd-drag-ghost\"}\n            ]\n        }, \n        shadow: !config || config.shadow !== false\n    });\n    this.ghost = Ext.get(this.el.dom.childNodes[1]);\n    this.dropStatus = this.dropNotAllowed;\n};\n\nExt.dd.StatusProxy.prototype = {\n    /**\n     * @cfg {String} dropAllowed\n     * The CSS class to apply to the status element when drop is allowed (defaults to \"x-dd-drop-ok\").\n     */\n    dropAllowed : \"x-dd-drop-ok\",\n    /**\n     * @cfg {String} dropNotAllowed\n     * The CSS class to apply to the status element when drop is not allowed (defaults to \"x-dd-drop-nodrop\").\n     */\n    dropNotAllowed : \"x-dd-drop-nodrop\",\n\n    /**\n     * Updates the proxy's visual element to indicate the status of whether or not drop is allowed\n     * over the current target element.\n     * @param {String} cssClass The css class for the new drop status indicator image\n     */\n    setStatus : function(cssClass){\n        cssClass = cssClass || this.dropNotAllowed;\n        if(this.dropStatus != cssClass){\n            this.el.replaceClass(this.dropStatus, cssClass);\n            this.dropStatus = cssClass;\n        }\n    },\n\n    /**\n     * Resets the status indicator to the default dropNotAllowed value\n     * @param {Boolean} clearGhost True to also remove all content from the ghost, false to preserve it\n     */\n    reset : function(clearGhost){\n        this.el.dom.className = \"x-dd-drag-proxy \" + this.dropNotAllowed;\n        this.dropStatus = this.dropNotAllowed;\n        if(clearGhost){\n            this.ghost.update(\"\");\n        }\n    },\n\n    /**\n     * Updates the contents of the ghost element\n     * @param {String/HTMLElement} html The html that will replace the current innerHTML of the ghost element, or a\n     * DOM node to append as the child of the ghost element (in which case the innerHTML will be cleared first).\n     */\n    update : function(html){\n        if(typeof html == \"string\"){\n            this.ghost.update(html);\n        }else{\n            this.ghost.update(\"\");\n            html.style.margin = \"0\";\n            this.ghost.dom.appendChild(html);\n        }\n        var el = this.ghost.dom.firstChild; \n        if(el){\n            Ext.fly(el).setStyle('float', 'none');\n        }\n    },\n\n    /**\n     * Returns the underlying proxy {@link Ext.Layer}\n     * @return {Ext.Layer} el\n    */\n    getEl : function(){\n        return this.el;\n    },\n\n    /**\n     * Returns the ghost element\n     * @return {Ext.Element} el\n     */\n    getGhost : function(){\n        return this.ghost;\n    },\n\n    /**\n     * Hides the proxy\n     * @param {Boolean} clear True to reset the status and clear the ghost contents, false to preserve them\n     */\n    hide : function(clear){\n        this.el.hide();\n        if(clear){\n            this.reset(true);\n        }\n    },\n\n    /**\n     * Stops the repair animation if it's currently running\n     */\n    stop : function(){\n        if(this.anim && this.anim.isAnimated && this.anim.isAnimated()){\n            this.anim.stop();\n        }\n    },\n\n    /**\n     * Displays this proxy\n     */\n    show : function(){\n        this.el.show();\n    },\n\n    /**\n     * Force the Layer to sync its shadow and shim positions to the element\n     */\n    sync : function(){\n        this.el.sync();\n    },\n\n    /**\n     * Causes the proxy to return to its position of origin via an animation.  Should be called after an\n     * invalid drop operation by the item being dragged.\n     * @param {Array} xy The XY position of the element ([x, y])\n     * @param {Function} callback The function to call after the repair is complete.\n     * @param {Object} scope The scope (<code>this</code> reference) in which the callback function is executed. Defaults to the browser window.\n     */\n    repair : function(xy, callback, scope){\n        this.callback = callback;\n        this.scope = scope;\n        if(xy && this.animRepair !== false){\n            this.el.addClass(\"x-dd-drag-repair\");\n            this.el.hideUnders(true);\n            this.anim = this.el.shift({\n                duration: this.repairDuration || .5,\n                easing: 'easeOut',\n                xy: xy,\n                stopFx: true,\n                callback: this.afterRepair,\n                scope: this\n            });\n        }else{\n            this.afterRepair();\n        }\n    },\n\n    // private\n    afterRepair : function(){\n        this.hide(true);\n        if(typeof this.callback == \"function\"){\n            this.callback.call(this.scope || this);\n        }\n        this.callback = null;\n        this.scope = null;\n    },\n    \n    destroy: function(){\n        Ext.destroy(this.ghost, this.el);    \n    }\n};/**\n * @class Ext.dd.DragSource\n * @extends Ext.dd.DDProxy\n * A simple class that provides the basic implementation needed to make any element draggable.\n * @constructor\n * @param {Mixed} el The container element\n * @param {Object} config\n */\nExt.dd.DragSource = function(el, config){\n    this.el = Ext.get(el);\n    if(!this.dragData){\n        this.dragData = {};\n    }\n    \n    Ext.apply(this, config);\n    \n    if(!this.proxy){\n        this.proxy = new Ext.dd.StatusProxy();\n    }\n    Ext.dd.DragSource.superclass.constructor.call(this, this.el.dom, this.ddGroup || this.group, \n          {dragElId : this.proxy.id, resizeFrame: false, isTarget: false, scroll: this.scroll === true});\n    \n    this.dragging = false;\n};\n\nExt.extend(Ext.dd.DragSource, Ext.dd.DDProxy, {\n    /**\n     * @cfg {String} ddGroup\n     * A named drag drop group to which this object belongs.  If a group is specified, then this object will only\n     * interact with other drag drop objects in the same group (defaults to undefined).\n     */\n    /**\n     * @cfg {String} dropAllowed\n     * The CSS class returned to the drag source when drop is allowed (defaults to \"x-dd-drop-ok\").\n     */\n    dropAllowed : \"x-dd-drop-ok\",\n    /**\n     * @cfg {String} dropNotAllowed\n     * The CSS class returned to the drag source when drop is not allowed (defaults to \"x-dd-drop-nodrop\").\n     */\n    dropNotAllowed : \"x-dd-drop-nodrop\",\n\n    /**\n     * Returns the data object associated with this drag source\n     * @return {Object} data An object containing arbitrary data\n     */\n    getDragData : function(e){\n        return this.dragData;\n    },\n\n    // private\n    onDragEnter : function(e, id){\n        var target = Ext.dd.DragDropMgr.getDDById(id);\n        this.cachedTarget = target;\n        if(this.beforeDragEnter(target, e, id) !== false){\n            if(target.isNotifyTarget){\n                var status = target.notifyEnter(this, e, this.dragData);\n                this.proxy.setStatus(status);\n            }else{\n                this.proxy.setStatus(this.dropAllowed);\n            }\n            \n            if(this.afterDragEnter){\n                /**\n                 * An empty function by default, but provided so that you can perform a custom action\n                 * when the dragged item enters the drop target by providing an implementation.\n                 * @param {Ext.dd.DragDrop} target The drop target\n                 * @param {Event} e The event object\n                 * @param {String} id The id of the dragged element\n                 * @method afterDragEnter\n                 */\n                this.afterDragEnter(target, e, id);\n            }\n        }\n    },\n\n    /**\n     * An empty function by default, but provided so that you can perform a custom action\n     * before the dragged item enters the drop target and optionally cancel the onDragEnter.\n     * @param {Ext.dd.DragDrop} target The drop target\n     * @param {Event} e The event object\n     * @param {String} id The id of the dragged element\n     * @return {Boolean} isValid True if the drag event is valid, else false to cancel\n     */\n    beforeDragEnter : function(target, e, id){\n        return true;\n    },\n\n    // private\n    alignElWithMouse: function() {\n        Ext.dd.DragSource.superclass.alignElWithMouse.apply(this, arguments);\n        this.proxy.sync();\n    },\n\n    // private\n    onDragOver : function(e, id){\n        var target = this.cachedTarget || Ext.dd.DragDropMgr.getDDById(id);\n        if(this.beforeDragOver(target, e, id) !== false){\n            if(target.isNotifyTarget){\n                var status = target.notifyOver(this, e, this.dragData);\n                this.proxy.setStatus(status);\n            }\n\n            if(this.afterDragOver){\n                /**\n                 * An empty function by default, but provided so that you can perform a custom action\n                 * while the dragged item is over the drop target by providing an implementation.\n                 * @param {Ext.dd.DragDrop} target The drop target\n                 * @param {Event} e The event object\n                 * @param {String} id The id of the dragged element\n                 * @method afterDragOver\n                 */\n                this.afterDragOver(target, e, id);\n            }\n        }\n    },\n\n    /**\n     * An empty function by default, but provided so that you can perform a custom action\n     * while the dragged item is over the drop target and optionally cancel the onDragOver.\n     * @param {Ext.dd.DragDrop} target The drop target\n     * @param {Event} e The event object\n     * @param {String} id The id of the dragged element\n     * @return {Boolean} isValid True if the drag event is valid, else false to cancel\n     */\n    beforeDragOver : function(target, e, id){\n        return true;\n    },\n\n    // private\n    onDragOut : function(e, id){\n        var target = this.cachedTarget || Ext.dd.DragDropMgr.getDDById(id);\n        if(this.beforeDragOut(target, e, id) !== false){\n            if(target.isNotifyTarget){\n                target.notifyOut(this, e, this.dragData);\n            }\n            this.proxy.reset();\n            if(this.afterDragOut){\n                /**\n                 * An empty function by default, but provided so that you can perform a custom action\n                 * after the dragged item is dragged out of the target without dropping.\n                 * @param {Ext.dd.DragDrop} target The drop target\n                 * @param {Event} e The event object\n                 * @param {String} id The id of the dragged element\n                 * @method afterDragOut\n                 */\n                this.afterDragOut(target, e, id);\n            }\n        }\n        this.cachedTarget = null;\n    },\n\n    /**\n     * An empty function by default, but provided so that you can perform a custom action before the dragged\n     * item is dragged out of the target without dropping, and optionally cancel the onDragOut.\n     * @param {Ext.dd.DragDrop} target The drop target\n     * @param {Event} e The event object\n     * @param {String} id The id of the dragged element\n     * @return {Boolean} isValid True if the drag event is valid, else false to cancel\n     */\n    beforeDragOut : function(target, e, id){\n        return true;\n    },\n    \n    // private\n    onDragDrop : function(e, id){\n        var target = this.cachedTarget || Ext.dd.DragDropMgr.getDDById(id);\n        if(this.beforeDragDrop(target, e, id) !== false){\n            if(target.isNotifyTarget){\n                if(target.notifyDrop(this, e, this.dragData)){ // valid drop?\n                    this.onValidDrop(target, e, id);\n                }else{\n                    this.onInvalidDrop(target, e, id);\n                }\n            }else{\n                this.onValidDrop(target, e, id);\n            }\n            \n            if(this.afterDragDrop){\n                /**\n                 * An empty function by default, but provided so that you can perform a custom action\n                 * after a valid drag drop has occurred by providing an implementation.\n                 * @param {Ext.dd.DragDrop} target The drop target\n                 * @param {Event} e The event object\n                 * @param {String} id The id of the dropped element\n                 * @method afterDragDrop\n                 */\n                this.afterDragDrop(target, e, id);\n            }\n        }\n        delete this.cachedTarget;\n    },\n\n    /**\n     * An empty function by default, but provided so that you can perform a custom action before the dragged\n     * item is dropped onto the target and optionally cancel the onDragDrop.\n     * @param {Ext.dd.DragDrop} target The drop target\n     * @param {Event} e The event object\n     * @param {String} id The id of the dragged element\n     * @return {Boolean} isValid True if the drag drop event is valid, else false to cancel\n     */\n    beforeDragDrop : function(target, e, id){\n        return true;\n    },\n\n    // private\n    onValidDrop : function(target, e, id){\n        this.hideProxy();\n        if(this.afterValidDrop){\n            /**\n             * An empty function by default, but provided so that you can perform a custom action\n             * after a valid drop has occurred by providing an implementation.\n             * @param {Object} target The target DD \n             * @param {Event} e The event object\n             * @param {String} id The id of the dropped element\n             * @method afterValidDrop\n             */\n            this.afterValidDrop(target, e, id);\n        }\n    },\n\n    // private\n    getRepairXY : function(e, data){\n        return this.el.getXY();  \n    },\n\n    // private\n    onInvalidDrop : function(target, e, id){\n        this.beforeInvalidDrop(target, e, id);\n        if(this.cachedTarget){\n            if(this.cachedTarget.isNotifyTarget){\n                this.cachedTarget.notifyOut(this, e, this.dragData);\n            }\n            this.cacheTarget = null;\n        }\n        this.proxy.repair(this.getRepairXY(e, this.dragData), this.afterRepair, this);\n\n        if(this.afterInvalidDrop){\n            /**\n             * An empty function by default, but provided so that you can perform a custom action\n             * after an invalid drop has occurred by providing an implementation.\n             * @param {Event} e The event object\n             * @param {String} id The id of the dropped element\n             * @method afterInvalidDrop\n             */\n            this.afterInvalidDrop(e, id);\n        }\n    },\n\n    // private\n    afterRepair : function(){\n        if(Ext.enableFx){\n            this.el.highlight(this.hlColor || \"c3daf9\");\n        }\n        this.dragging = false;\n    },\n\n    /**\n     * An empty function by default, but provided so that you can perform a custom action after an invalid\n     * drop has occurred.\n     * @param {Ext.dd.DragDrop} target The drop target\n     * @param {Event} e The event object\n     * @param {String} id The id of the dragged element\n     * @return {Boolean} isValid True if the invalid drop should proceed, else false to cancel\n     */\n    beforeInvalidDrop : function(target, e, id){\n        return true;\n    },\n\n    // private\n    handleMouseDown : function(e){\n        if(this.dragging) {\n            return;\n        }\n        var data = this.getDragData(e);\n        if(data && this.onBeforeDrag(data, e) !== false){\n            this.dragData = data;\n            this.proxy.stop();\n            Ext.dd.DragSource.superclass.handleMouseDown.apply(this, arguments);\n        } \n    },\n\n    /**\n     * An empty function by default, but provided so that you can perform a custom action before the initial\n     * drag event begins and optionally cancel it.\n     * @param {Object} data An object containing arbitrary data to be shared with drop targets\n     * @param {Event} e The event object\n     * @return {Boolean} isValid True if the drag event is valid, else false to cancel\n     */\n    onBeforeDrag : function(data, e){\n        return true;\n    },\n\n    /**\n     * An empty function by default, but provided so that you can perform a custom action once the initial\n     * drag event has begun.  The drag cannot be canceled from this function.\n     * @param {Number} x The x position of the click on the dragged object\n     * @param {Number} y The y position of the click on the dragged object\n     */\n    onStartDrag : Ext.emptyFn,\n\n    // private override\n    startDrag : function(x, y){\n        this.proxy.reset();\n        this.dragging = true;\n        this.proxy.update(\"\");\n        this.onInitDrag(x, y);\n        this.proxy.show();\n    },\n\n    // private\n    onInitDrag : function(x, y){\n        var clone = this.el.dom.cloneNode(true);\n        clone.id = Ext.id(); // prevent duplicate ids\n        this.proxy.update(clone);\n        this.onStartDrag(x, y);\n        return true;\n    },\n\n    /**\n     * Returns the drag source's underlying {@link Ext.dd.StatusProxy}\n     * @return {Ext.dd.StatusProxy} proxy The StatusProxy\n     */\n    getProxy : function(){\n        return this.proxy;  \n    },\n\n    /**\n     * Hides the drag source's {@link Ext.dd.StatusProxy}\n     */\n    hideProxy : function(){\n        this.proxy.hide();  \n        this.proxy.reset(true);\n        this.dragging = false;\n    },\n\n    // private\n    triggerCacheRefresh : function(){\n        Ext.dd.DDM.refreshCache(this.groups);\n    },\n\n    // private - override to prevent hiding\n    b4EndDrag: function(e) {\n    },\n\n    // private - override to prevent moving\n    endDrag : function(e){\n        this.onEndDrag(this.dragData, e);\n    },\n\n    // private\n    onEndDrag : function(data, e){\n    },\n    \n    // private - pin to cursor\n    autoOffset : function(x, y) {\n        this.setDelta(-12, -20);\n    },\n    \n    destroy: function(){\n        Ext.dd.DragSource.superclass.destroy.call(this);\n        Ext.destroy(this.proxy);\n    }\n});/**\n * @class Ext.dd.DropTarget\n * @extends Ext.dd.DDTarget\n * A simple class that provides the basic implementation needed to make any element a drop target that can have\n * draggable items dropped onto it.  The drop has no effect until an implementation of notifyDrop is provided.\n * @constructor\n * @param {Mixed} el The container element\n * @param {Object} config\n */\nExt.dd.DropTarget = Ext.extend(Ext.dd.DDTarget, {\n    \n    constructor : function(el, config){\n        this.el = Ext.get(el);\n    \n        Ext.apply(this, config);\n    \n        if(this.containerScroll){\n            Ext.dd.ScrollManager.register(this.el);\n        }\n    \n        Ext.dd.DropTarget.superclass.constructor.call(this, this.el.dom, this.ddGroup || this.group, \n              {isTarget: true});        \n    },\n    \n    /**\n     * @cfg {String} ddGroup\n     * A named drag drop group to which this object belongs.  If a group is specified, then this object will only\n     * interact with other drag drop objects in the same group (defaults to undefined).\n     */\n    /**\n     * @cfg {String} overClass\n     * The CSS class applied to the drop target element while the drag source is over it (defaults to \"\").\n     */\n    /**\n     * @cfg {String} dropAllowed\n     * The CSS class returned to the drag source when drop is allowed (defaults to \"x-dd-drop-ok\").\n     */\n    dropAllowed : \"x-dd-drop-ok\",\n    /**\n     * @cfg {String} dropNotAllowed\n     * The CSS class returned to the drag source when drop is not allowed (defaults to \"x-dd-drop-nodrop\").\n     */\n    dropNotAllowed : \"x-dd-drop-nodrop\",\n\n    // private\n    isTarget : true,\n\n    // private\n    isNotifyTarget : true,\n\n    /**\n     * The function a {@link Ext.dd.DragSource} calls once to notify this drop target that the source is now over the\n     * target.  This default implementation adds the CSS class specified by overClass (if any) to the drop element\n     * and returns the dropAllowed config value.  This method should be overridden if drop validation is required.\n     * @param {Ext.dd.DragSource} source The drag source that was dragged over this drop target\n     * @param {Event} e The event\n     * @param {Object} data An object containing arbitrary data supplied by the drag source\n     * @return {String} status The CSS class that communicates the drop status back to the source so that the\n     * underlying {@link Ext.dd.StatusProxy} can be updated\n     */\n    notifyEnter : function(dd, e, data){\n        if(this.overClass){\n            this.el.addClass(this.overClass);\n        }\n        return this.dropAllowed;\n    },\n\n    /**\n     * The function a {@link Ext.dd.DragSource} calls continuously while it is being dragged over the target.\n     * This method will be called on every mouse movement while the drag source is over the drop target.\n     * This default implementation simply returns the dropAllowed config value.\n     * @param {Ext.dd.DragSource} source The drag source that was dragged over this drop target\n     * @param {Event} e The event\n     * @param {Object} data An object containing arbitrary data supplied by the drag source\n     * @return {String} status The CSS class that communicates the drop status back to the source so that the\n     * underlying {@link Ext.dd.StatusProxy} can be updated\n     */\n    notifyOver : function(dd, e, data){\n        return this.dropAllowed;\n    },\n\n    /**\n     * The function a {@link Ext.dd.DragSource} calls once to notify this drop target that the source has been dragged\n     * out of the target without dropping.  This default implementation simply removes the CSS class specified by\n     * overClass (if any) from the drop element.\n     * @param {Ext.dd.DragSource} source The drag source that was dragged over this drop target\n     * @param {Event} e The event\n     * @param {Object} data An object containing arbitrary data supplied by the drag source\n     */\n    notifyOut : function(dd, e, data){\n        if(this.overClass){\n            this.el.removeClass(this.overClass);\n        }\n    },\n\n    /**\n     * The function a {@link Ext.dd.DragSource} calls once to notify this drop target that the dragged item has\n     * been dropped on it.  This method has no default implementation and returns false, so you must provide an\n     * implementation that does something to process the drop event and returns true so that the drag source's\n     * repair action does not run.\n     * @param {Ext.dd.DragSource} source The drag source that was dragged over this drop target\n     * @param {Event} e The event\n     * @param {Object} data An object containing arbitrary data supplied by the drag source\n     * @return {Boolean} True if the drop was valid, else false\n     */\n    notifyDrop : function(dd, e, data){\n        return false;\n    },\n    \n    destroy : function(){\n        Ext.dd.DropTarget.superclass.destroy.call(this);\n        if(this.containerScroll){\n            Ext.dd.ScrollManager.unregister(this.el);\n        }\n    }\n});/**\n * @class Ext.dd.DragZone\n * @extends Ext.dd.DragSource\n * <p>This class provides a container DD instance that allows dragging of multiple child source nodes.</p>\n * <p>This class does not move the drag target nodes, but a proxy element which may contain\n * any DOM structure you wish. The DOM element to show in the proxy is provided by either a\n * provided implementation of {@link #getDragData}, or by registered draggables registered with {@link Ext.dd.Registry}</p>\n * <p>If you wish to provide draggability for an arbitrary number of DOM nodes, each of which represent some\n * application object (For example nodes in a {@link Ext.DataView DataView}) then use of this class\n * is the most efficient way to \"activate\" those nodes.</p>\n * <p>By default, this class requires that draggable child nodes are registered with {@link Ext.dd.Registry}.\n * However a simpler way to allow a DragZone to manage any number of draggable elements is to configure\n * the DragZone with  an implementation of the {@link #getDragData} method which interrogates the passed\n * mouse event to see if it has taken place within an element, or class of elements. This is easily done\n * by using the event's {@link Ext.EventObject#getTarget getTarget} method to identify a node based on a\n * {@link Ext.DomQuery} selector. For example, to make the nodes of a DataView draggable, use the following\n * technique. Knowledge of the use of the DataView is required:</p><pre><code>\nmyDataView.on('render', function(v) {\n    myDataView.dragZone = new Ext.dd.DragZone(v.getEl(), {\n\n//      On receipt of a mousedown event, see if it is within a DataView node.\n//      Return a drag data object if so.\n        getDragData: function(e) {\n\n//          Use the DataView's own itemSelector (a mandatory property) to\n//          test if the mousedown is within one of the DataView's nodes.\n            var sourceEl = e.getTarget(v.itemSelector, 10);\n\n//          If the mousedown is within a DataView node, clone the node to produce\n//          a ddel element for use by the drag proxy. Also add application data\n//          to the returned data object.\n            if (sourceEl) {\n                d = sourceEl.cloneNode(true);\n                d.id = Ext.id();\n                return {\n                    ddel: d,\n                    sourceEl: sourceEl,\n                    repairXY: Ext.fly(sourceEl).getXY(),\n                    sourceStore: v.store,\n                    draggedRecord: v.{@link Ext.DataView#getRecord getRecord}(sourceEl)\n                }\n            }\n        },\n\n//      Provide coordinates for the proxy to slide back to on failed drag.\n//      This is the original XY coordinates of the draggable element captured\n//      in the getDragData method.\n        getRepairXY: function() {\n            return this.dragData.repairXY;\n        }\n    });\n});</code></pre>\n * See the {@link Ext.dd.DropZone DropZone} documentation for details about building a DropZone which\n * cooperates with this DragZone.\n * @constructor\n * @param {Mixed} el The container element\n * @param {Object} config\n */\nExt.dd.DragZone = Ext.extend(Ext.dd.DragSource, {\n    \n    constructor : function(el, config){\n        Ext.dd.DragZone.superclass.constructor.call(this, el, config);\n        if(this.containerScroll){\n            Ext.dd.ScrollManager.register(this.el);\n        }\n    },\n    \n    /**\n     * This property contains the data representing the dragged object. This data is set up by the implementation\n     * of the {@link #getDragData} method. It must contain a <tt>ddel</tt> property, but can contain\n     * any other data according to the application's needs.\n     * @type Object\n     * @property dragData\n     */\n    /**\n     * @cfg {Boolean} containerScroll True to register this container with the Scrollmanager\n     * for auto scrolling during drag operations.\n     */\n    /**\n     * @cfg {String} hlColor The color to use when visually highlighting the drag source in the afterRepair\n     * method after a failed drop (defaults to \"c3daf9\" - light blue)\n     */\n\n    /**\n     * Called when a mousedown occurs in this container. Looks in {@link Ext.dd.Registry}\n     * for a valid target to drag based on the mouse down. Override this method\n     * to provide your own lookup logic (e.g. finding a child by class name). Make sure your returned\n     * object has a \"ddel\" attribute (with an HTML Element) for other functions to work.\n     * @param {EventObject} e The mouse down event\n     * @return {Object} The dragData\n     */\n    getDragData : function(e){\n        return Ext.dd.Registry.getHandleFromEvent(e);\n    },\n    \n    /**\n     * Called once drag threshold has been reached to initialize the proxy element. By default, it clones the\n     * this.dragData.ddel\n     * @param {Number} x The x position of the click on the dragged object\n     * @param {Number} y The y position of the click on the dragged object\n     * @return {Boolean} true to continue the drag, false to cancel\n     */\n    onInitDrag : function(x, y){\n        this.proxy.update(this.dragData.ddel.cloneNode(true));\n        this.onStartDrag(x, y);\n        return true;\n    },\n    \n    /**\n     * Called after a repair of an invalid drop. By default, highlights this.dragData.ddel \n     */\n    afterRepair : function(){\n        if(Ext.enableFx){\n            Ext.Element.fly(this.dragData.ddel).highlight(this.hlColor || \"c3daf9\");\n        }\n        this.dragging = false;\n    },\n\n    /**\n     * Called before a repair of an invalid drop to get the XY to animate to. By default returns\n     * the XY of this.dragData.ddel\n     * @param {EventObject} e The mouse up event\n     * @return {Array} The xy location (e.g. [100, 200])\n     */\n    getRepairXY : function(e){\n        return Ext.Element.fly(this.dragData.ddel).getXY();  \n    },\n    \n    destroy : function(){\n        Ext.dd.DragZone.superclass.destroy.call(this);\n        if(this.containerScroll){\n            Ext.dd.ScrollManager.unregister(this.el);\n        }\n    }\n});/**\n * @class Ext.dd.DropZone\n * @extends Ext.dd.DropTarget\n * <p>This class provides a container DD instance that allows dropping on multiple child target nodes.</p>\n * <p>By default, this class requires that child nodes accepting drop are registered with {@link Ext.dd.Registry}.\n * However a simpler way to allow a DropZone to manage any number of target elements is to configure the\n * DropZone with an implementation of {@link #getTargetFromEvent} which interrogates the passed\n * mouse event to see if it has taken place within an element, or class of elements. This is easily done\n * by using the event's {@link Ext.EventObject#getTarget getTarget} method to identify a node based on a\n * {@link Ext.DomQuery} selector.</p>\n * <p>Once the DropZone has detected through calling getTargetFromEvent, that the mouse is over\n * a drop target, that target is passed as the first parameter to {@link #onNodeEnter}, {@link #onNodeOver},\n * {@link #onNodeOut}, {@link #onNodeDrop}. You may configure the instance of DropZone with implementations\n * of these methods to provide application-specific behaviour for these events to update both\n * application state, and UI state.</p>\n * <p>For example to make a GridPanel a cooperating target with the example illustrated in\n * {@link Ext.dd.DragZone DragZone}, the following technique might be used:</p><pre><code>\nmyGridPanel.on('render', function() {\n    myGridPanel.dropZone = new Ext.dd.DropZone(myGridPanel.getView().scroller, {\n\n//      If the mouse is over a grid row, return that node. This is\n//      provided as the \"target\" parameter in all \"onNodeXXXX\" node event handling functions\n        getTargetFromEvent: function(e) {\n            return e.getTarget(myGridPanel.getView().rowSelector);\n        },\n\n//      On entry into a target node, highlight that node.\n        onNodeEnter : function(target, dd, e, data){ \n            Ext.fly(target).addClass('my-row-highlight-class');\n        },\n\n//      On exit from a target node, unhighlight that node.\n        onNodeOut : function(target, dd, e, data){ \n            Ext.fly(target).removeClass('my-row-highlight-class');\n        },\n\n//      While over a target node, return the default drop allowed class which\n//      places a \"tick\" icon into the drag proxy.\n        onNodeOver : function(target, dd, e, data){ \n            return Ext.dd.DropZone.prototype.dropAllowed;\n        },\n\n//      On node drop we can interrogate the target to find the underlying\n//      application object that is the real target of the dragged data.\n//      In this case, it is a Record in the GridPanel's Store.\n//      We can use the data set up by the DragZone's getDragData method to read\n//      any data we decided to attach in the DragZone's getDragData method.\n        onNodeDrop : function(target, dd, e, data){\n            var rowIndex = myGridPanel.getView().findRowIndex(target);\n            var r = myGridPanel.getStore().getAt(rowIndex);\n            Ext.Msg.alert('Drop gesture', 'Dropped Record id ' + data.draggedRecord.id +\n                ' on Record id ' + r.id);\n            return true;\n        }\n    });\n}\n</code></pre>\n * See the {@link Ext.dd.DragZone DragZone} documentation for details about building a DragZone which\n * cooperates with this DropZone.\n * @constructor\n * @param {Mixed} el The container element\n * @param {Object} config\n */\nExt.dd.DropZone = function(el, config){\n    Ext.dd.DropZone.superclass.constructor.call(this, el, config);\n};\n\nExt.extend(Ext.dd.DropZone, Ext.dd.DropTarget, {\n    /**\n     * Returns a custom data object associated with the DOM node that is the target of the event.  By default\n     * this looks up the event target in the {@link Ext.dd.Registry}, although you can override this method to\n     * provide your own custom lookup.\n     * @param {Event} e The event\n     * @return {Object} data The custom data\n     */\n    getTargetFromEvent : function(e){\n        return Ext.dd.Registry.getTargetFromEvent(e);\n    },\n\n    /**\n     * Called when the DropZone determines that a {@link Ext.dd.DragSource} has entered a drop node\n     * that has either been registered or detected by a configured implementation of {@link #getTargetFromEvent}.\n     * This method has no default implementation and should be overridden to provide\n     * node-specific processing if necessary.\n     * @param {Object} nodeData The custom data associated with the drop node (this is the same value returned from \n     * {@link #getTargetFromEvent} for this node)\n     * @param {Ext.dd.DragSource} source The drag source that was dragged over this drop zone\n     * @param {Event} e The event\n     * @param {Object} data An object containing arbitrary data supplied by the drag source\n     */\n    onNodeEnter : function(n, dd, e, data){\n        \n    },\n\n    /**\n     * Called while the DropZone determines that a {@link Ext.dd.DragSource} is over a drop node\n     * that has either been registered or detected by a configured implementation of {@link #getTargetFromEvent}.\n     * The default implementation returns this.dropNotAllowed, so it should be\n     * overridden to provide the proper feedback.\n     * @param {Object} nodeData The custom data associated with the drop node (this is the same value returned from\n     * {@link #getTargetFromEvent} for this node)\n     * @param {Ext.dd.DragSource} source The drag source that was dragged over this drop zone\n     * @param {Event} e The event\n     * @param {Object} data An object containing arbitrary data supplied by the drag source\n     * @return {String} status The CSS class that communicates the drop status back to the source so that the\n     * underlying {@link Ext.dd.StatusProxy} can be updated\n     */\n    onNodeOver : function(n, dd, e, data){\n        return this.dropAllowed;\n    },\n\n    /**\n     * Called when the DropZone determines that a {@link Ext.dd.DragSource} has been dragged out of\n     * the drop node without dropping.  This method has no default implementation and should be overridden to provide\n     * node-specific processing if necessary.\n     * @param {Object} nodeData The custom data associated with the drop node (this is the same value returned from\n     * {@link #getTargetFromEvent} for this node)\n     * @param {Ext.dd.DragSource} source The drag source that was dragged over this drop zone\n     * @param {Event} e The event\n     * @param {Object} data An object containing arbitrary data supplied by the drag source\n     */\n    onNodeOut : function(n, dd, e, data){\n        \n    },\n\n    /**\n     * Called when the DropZone determines that a {@link Ext.dd.DragSource} has been dropped onto\n     * the drop node.  The default implementation returns false, so it should be overridden to provide the\n     * appropriate processing of the drop event and return true so that the drag source's repair action does not run.\n     * @param {Object} nodeData The custom data associated with the drop node (this is the same value returned from\n     * {@link #getTargetFromEvent} for this node)\n     * @param {Ext.dd.DragSource} source The drag source that was dragged over this drop zone\n     * @param {Event} e The event\n     * @param {Object} data An object containing arbitrary data supplied by the drag source\n     * @return {Boolean} True if the drop was valid, else false\n     */\n    onNodeDrop : function(n, dd, e, data){\n        return false;\n    },\n\n    /**\n     * Called while the DropZone determines that a {@link Ext.dd.DragSource} is being dragged over it,\n     * but not over any of its registered drop nodes.  The default implementation returns this.dropNotAllowed, so\n     * it should be overridden to provide the proper feedback if necessary.\n     * @param {Ext.dd.DragSource} source The drag source that was dragged over this drop zone\n     * @param {Event} e The event\n     * @param {Object} data An object containing arbitrary data supplied by the drag source\n     * @return {String} status The CSS class that communicates the drop status back to the source so that the\n     * underlying {@link Ext.dd.StatusProxy} can be updated\n     */\n    onContainerOver : function(dd, e, data){\n        return this.dropNotAllowed;\n    },\n\n    /**\n     * Called when the DropZone determines that a {@link Ext.dd.DragSource} has been dropped on it,\n     * but not on any of its registered drop nodes.  The default implementation returns false, so it should be\n     * overridden to provide the appropriate processing of the drop event if you need the drop zone itself to\n     * be able to accept drops.  It should return true when valid so that the drag source's repair action does not run.\n     * @param {Ext.dd.DragSource} source The drag source that was dragged over this drop zone\n     * @param {Event} e The event\n     * @param {Object} data An object containing arbitrary data supplied by the drag source\n     * @return {Boolean} True if the drop was valid, else false\n     */\n    onContainerDrop : function(dd, e, data){\n        return false;\n    },\n\n    /**\n     * The function a {@link Ext.dd.DragSource} calls once to notify this drop zone that the source is now over\n     * the zone.  The default implementation returns this.dropNotAllowed and expects that only registered drop\n     * nodes can process drag drop operations, so if you need the drop zone itself to be able to process drops\n     * you should override this method and provide a custom implementation.\n     * @param {Ext.dd.DragSource} source The drag source that was dragged over this drop zone\n     * @param {Event} e The event\n     * @param {Object} data An object containing arbitrary data supplied by the drag source\n     * @return {String} status The CSS class that communicates the drop status back to the source so that the\n     * underlying {@link Ext.dd.StatusProxy} can be updated\n     */\n    notifyEnter : function(dd, e, data){\n        return this.dropNotAllowed;\n    },\n\n    /**\n     * The function a {@link Ext.dd.DragSource} calls continuously while it is being dragged over the drop zone.\n     * This method will be called on every mouse movement while the drag source is over the drop zone.\n     * It will call {@link #onNodeOver} while the drag source is over a registered node, and will also automatically\n     * delegate to the appropriate node-specific methods as necessary when the drag source enters and exits\n     * registered nodes ({@link #onNodeEnter}, {@link #onNodeOut}). If the drag source is not currently over a\n     * registered node, it will call {@link #onContainerOver}.\n     * @param {Ext.dd.DragSource} source The drag source that was dragged over this drop zone\n     * @param {Event} e The event\n     * @param {Object} data An object containing arbitrary data supplied by the drag source\n     * @return {String} status The CSS class that communicates the drop status back to the source so that the\n     * underlying {@link Ext.dd.StatusProxy} can be updated\n     */\n    notifyOver : function(dd, e, data){\n        var n = this.getTargetFromEvent(e);\n        if(!n){ // not over valid drop target\n            if(this.lastOverNode){\n                this.onNodeOut(this.lastOverNode, dd, e, data);\n                this.lastOverNode = null;\n            }\n            return this.onContainerOver(dd, e, data);\n        }\n        if(this.lastOverNode != n){\n            if(this.lastOverNode){\n                this.onNodeOut(this.lastOverNode, dd, e, data);\n            }\n            this.onNodeEnter(n, dd, e, data);\n            this.lastOverNode = n;\n        }\n        return this.onNodeOver(n, dd, e, data);\n    },\n\n    /**\n     * The function a {@link Ext.dd.DragSource} calls once to notify this drop zone that the source has been dragged\n     * out of the zone without dropping.  If the drag source is currently over a registered node, the notification\n     * will be delegated to {@link #onNodeOut} for node-specific handling, otherwise it will be ignored.\n     * @param {Ext.dd.DragSource} source The drag source that was dragged over this drop target\n     * @param {Event} e The event\n     * @param {Object} data An object containing arbitrary data supplied by the drag zone\n     */\n    notifyOut : function(dd, e, data){\n        if(this.lastOverNode){\n            this.onNodeOut(this.lastOverNode, dd, e, data);\n            this.lastOverNode = null;\n        }\n    },\n\n    /**\n     * The function a {@link Ext.dd.DragSource} calls once to notify this drop zone that the dragged item has\n     * been dropped on it.  The drag zone will look up the target node based on the event passed in, and if there\n     * is a node registered for that event, it will delegate to {@link #onNodeDrop} for node-specific handling,\n     * otherwise it will call {@link #onContainerDrop}.\n     * @param {Ext.dd.DragSource} source The drag source that was dragged over this drop zone\n     * @param {Event} e The event\n     * @param {Object} data An object containing arbitrary data supplied by the drag source\n     * @return {Boolean} True if the drop was valid, else false\n     */\n    notifyDrop : function(dd, e, data){\n        if(this.lastOverNode){\n            this.onNodeOut(this.lastOverNode, dd, e, data);\n            this.lastOverNode = null;\n        }\n        var n = this.getTargetFromEvent(e);\n        return n ?\n            this.onNodeDrop(n, dd, e, data) :\n            this.onContainerDrop(dd, e, data);\n    },\n\n    // private\n    triggerCacheRefresh : function(){\n        Ext.dd.DDM.refreshCache(this.groups);\n    }  \n});/**\n * @class Ext.Element\n */\nExt.Element.addMethods({\n    /**\n     * Initializes a {@link Ext.dd.DD} drag drop object for this element.\n     * @param {String} group The group the DD object is member of\n     * @param {Object} config The DD config object\n     * @param {Object} overrides An object containing methods to override/implement on the DD object\n     * @return {Ext.dd.DD} The DD object\n     */\n    initDD : function(group, config, overrides){\n        var dd = new Ext.dd.DD(Ext.id(this.dom), group, config);\n        return Ext.apply(dd, overrides);\n    },\n\n    /**\n     * Initializes a {@link Ext.dd.DDProxy} object for this element.\n     * @param {String} group The group the DDProxy object is member of\n     * @param {Object} config The DDProxy config object\n     * @param {Object} overrides An object containing methods to override/implement on the DDProxy object\n     * @return {Ext.dd.DDProxy} The DDProxy object\n     */\n    initDDProxy : function(group, config, overrides){\n        var dd = new Ext.dd.DDProxy(Ext.id(this.dom), group, config);\n        return Ext.apply(dd, overrides);\n    },\n\n    /**\n     * Initializes a {@link Ext.dd.DDTarget} object for this element.\n     * @param {String} group The group the DDTarget object is member of\n     * @param {Object} config The DDTarget config object\n     * @param {Object} overrides An object containing methods to override/implement on the DDTarget object\n     * @return {Ext.dd.DDTarget} The DDTarget object\n     */\n    initDDTarget : function(group, config, overrides){\n        var dd = new Ext.dd.DDTarget(Ext.id(this.dom), group, config);\n        return Ext.apply(dd, overrides);\n    }\n});\n/**\n * @class Ext.data.Api\n * @extends Object\n * Ext.data.Api is a singleton designed to manage the data API including methods\n * for validating a developer's DataProxy API.  Defines variables for CRUD actions\n * create, read, update and destroy in addition to a mapping of RESTful HTTP methods\n * GET, POST, PUT and DELETE to CRUD actions.\n * @singleton\n */\nExt.data.Api = (function() {\n\n    // private validActions.  validActions is essentially an inverted hash of Ext.data.Api.actions, where value becomes the key.\n    // Some methods in this singleton (e.g.: getActions, getVerb) will loop through actions with the code <code>for (var verb in this.actions)</code>\n    // For efficiency, some methods will first check this hash for a match.  Those methods which do acces validActions will cache their result here.\n    // We cannot pre-define this hash since the developer may over-ride the actions at runtime.\n    var validActions = {};\n\n    return {\n        /**\n         * Defined actions corresponding to remote actions:\n         * <pre><code>\nactions: {\n    create  : 'create',  // Text representing the remote-action to create records on server.\n    read    : 'read',    // Text representing the remote-action to read/load data from server.\n    update  : 'update',  // Text representing the remote-action to update records on server.\n    destroy : 'destroy'  // Text representing the remote-action to destroy records on server.\n}\n         * </code></pre>\n         * @property actions\n         * @type Object\n         */\n        actions : {\n            create  : 'create',\n            read    : 'read',\n            update  : 'update',\n            destroy : 'destroy'\n        },\n\n        /**\n         * Defined {CRUD action}:{HTTP method} pairs to associate HTTP methods with the\n         * corresponding actions for {@link Ext.data.DataProxy#restful RESTful proxies}.\n         * Defaults to:\n         * <pre><code>\nrestActions : {\n    create  : 'POST',\n    read    : 'GET',\n    update  : 'PUT',\n    destroy : 'DELETE'\n},\n         * </code></pre>\n         */\n        restActions : {\n            create  : 'POST',\n            read    : 'GET',\n            update  : 'PUT',\n            destroy : 'DELETE'\n        },\n\n        /**\n         * Returns true if supplied action-name is a valid API action defined in <code>{@link #actions}</code> constants\n         * @param {String} action Action to test for availability.\n         * @return {Boolean}\n         */\n        isAction : function(action) {\n            return (Ext.data.Api.actions[action]) ? true : false;\n        },\n\n        /**\n         * Returns the actual CRUD action KEY \"create\", \"read\", \"update\" or \"destroy\" from the supplied action-name.  This method is used internally and shouldn't generally\n         * need to be used directly.  The key/value pair of Ext.data.Api.actions will often be identical but this is not necessarily true.  A developer can override this naming\n         * convention if desired.  However, the framework internally calls methods based upon the KEY so a way of retreiving the the words \"create\", \"read\", \"update\" and \"destroy\" is\n         * required.  This method will cache discovered KEYS into the private validActions hash.\n         * @param {String} name The runtime name of the action.\n         * @return {String/null} returns the action-key, or verb of the user-action or null if invalid.\n         * @nodoc\n         */\n        getVerb : function(name) {\n            if (validActions[name]) {\n                return validActions[name];  // <-- found in cache.  return immediately.\n            }\n            for (var verb in this.actions) {\n                if (this.actions[verb] === name) {\n                    validActions[name] = verb;\n                    break;\n                }\n            }\n            return (validActions[name] !== undefined) ? validActions[name] : null;\n        },\n\n        /**\n         * Returns true if the supplied API is valid; that is, check that all keys match defined actions\n         * otherwise returns an array of mistakes.\n         * @return {String[]|true}\n         */\n        isValid : function(api){\n            var invalid = [];\n            var crud = this.actions; // <-- cache a copy of the actions.\n            for (var action in api) {\n                if (!(action in crud)) {\n                    invalid.push(action);\n                }\n            }\n            return (!invalid.length) ? true : invalid;\n        },\n\n        /**\n         * Returns true if the supplied verb upon the supplied proxy points to a unique url in that none of the other api-actions\n         * point to the same url.  The question is important for deciding whether to insert the \"xaction\" HTTP parameter within an\n         * Ajax request.  This method is used internally and shouldn't generally need to be called directly.\n         * @param {Ext.data.DataProxy} proxy\n         * @param {String} verb\n         * @return {Boolean}\n         */\n        hasUniqueUrl : function(proxy, verb) {\n            var url = (proxy.api[verb]) ? proxy.api[verb].url : null;\n            var unique = true;\n            for (var action in proxy.api) {\n                if ((unique = (action === verb) ? true : (proxy.api[action].url != url) ? true : false) === false) {\n                    break;\n                }\n            }\n            return unique;\n        },\n\n        /**\n         * This method is used internally by <tt>{@link Ext.data.DataProxy DataProxy}</tt> and should not generally need to be used directly.\n         * Each action of a DataProxy api can be initially defined as either a String or an Object.  When specified as an object,\n         * one can explicitly define the HTTP method (GET|POST) to use for each CRUD action.  This method will prepare the supplied API, setting\n         * each action to the Object form.  If your API-actions do not explicitly define the HTTP method, the \"method\" configuration-parameter will\n         * be used.  If the method configuration parameter is not specified, POST will be used.\n         <pre><code>\nnew Ext.data.HttpProxy({\n    method: \"POST\",     // <-- default HTTP method when not specified.\n    api: {\n        create: 'create.php',\n        load: 'read.php',\n        save: 'save.php',\n        destroy: 'destroy.php'\n    }\n});\n\n// Alternatively, one can use the object-form to specify the API\nnew Ext.data.HttpProxy({\n    api: {\n        load: {url: 'read.php', method: 'GET'},\n        create: 'create.php',\n        destroy: 'destroy.php',\n        save: 'update.php'\n    }\n});\n        </code></pre>\n         *\n         * @param {Ext.data.DataProxy} proxy\n         */\n        prepare : function(proxy) {\n            if (!proxy.api) {\n                proxy.api = {}; // <-- No api?  create a blank one.\n            }\n            for (var verb in this.actions) {\n                var action = this.actions[verb];\n                proxy.api[action] = proxy.api[action] || proxy.url || proxy.directFn;\n                if (typeof(proxy.api[action]) == 'string') {\n                    proxy.api[action] = {\n                        url: proxy.api[action],\n                        method: (proxy.restful === true) ? Ext.data.Api.restActions[action] : undefined\n                    };\n                }\n            }\n        },\n\n        /**\n         * Prepares a supplied Proxy to be RESTful.  Sets the HTTP method for each api-action to be one of\n         * GET, POST, PUT, DELETE according to the defined {@link #restActions}.\n         * @param {Ext.data.DataProxy} proxy\n         */\n        restify : function(proxy) {\n            proxy.restful = true;\n            for (var verb in this.restActions) {\n                proxy.api[this.actions[verb]].method ||\n                    (proxy.api[this.actions[verb]].method = this.restActions[verb]);\n            }\n            // TODO: perhaps move this interceptor elsewhere?  like into DataProxy, perhaps?  Placed here\n            // to satisfy initial 3.0 final release of REST features.\n            proxy.onWrite = proxy.onWrite.createInterceptor(function(action, o, response, rs) {\n                var reader = o.reader;\n                var res = new Ext.data.Response({\n                    action: action,\n                    raw: response\n                });\n\n                switch (response.status) {\n                    case 200:   // standard 200 response, send control back to HttpProxy#onWrite by returning true from this intercepted #onWrite\n                        return true;\n                        break;\n                    case 201:   // entity created but no response returned\n                        if (Ext.isEmpty(res.raw.responseText)) {\n                          res.success = true;\n                        } else {\n                          //if the response contains data, treat it like a 200\n                          return true;\n                        }\n                        break;\n                    case 204:  // no-content.  Create a fake response.\n                        res.success = true;\n                        res.data = null;\n                        break;\n                    default:\n                        return true;\n                        break;\n                }\n                if (res.success === true) {\n                    this.fireEvent(\"write\", this, action, res.data, res, rs, o.request.arg);\n                } else {\n                    this.fireEvent('exception', this, 'remote', action, o, res, rs);\n                }\n                o.request.callback.call(o.request.scope, res.data, res, res.success);\n\n                return false;   // <-- false to prevent intercepted function from running.\n            }, proxy);\n        }\n    };\n})();\n\n/**\n * Ext.data.Response\n * Experimental.  Do not use directly.\n */\nExt.data.Response = function(params, response) {\n    Ext.apply(this, params, {\n        raw: response\n    });\n};\nExt.data.Response.prototype = {\n    message : null,\n    success : false,\n    status : null,\n    root : null,\n    raw : null,\n\n    getMessage : function() {\n        return this.message;\n    },\n    getSuccess : function() {\n        return this.success;\n    },\n    getStatus : function() {\n        return this.status;\n    },\n    getRoot : function() {\n        return this.root;\n    },\n    getRawResponse : function() {\n        return this.raw;\n    }\n};\n\n/**\n * @class Ext.data.Api.Error\n * @extends Ext.Error\n * Error class for Ext.data.Api errors\n */\nExt.data.Api.Error = Ext.extend(Ext.Error, {\n    constructor : function(message, arg) {\n        this.arg = arg;\n        Ext.Error.call(this, message);\n    },\n    name: 'Ext.data.Api'\n});\nExt.apply(Ext.data.Api.Error.prototype, {\n    lang: {\n        'action-url-undefined': 'No fallback url defined for this action.  When defining a DataProxy api, please be sure to define an url for each CRUD action in Ext.data.Api.actions or define a default url in addition to your api-configuration.',\n        'invalid': 'received an invalid API-configuration.  Please ensure your proxy API-configuration contains only the actions defined in Ext.data.Api.actions',\n        'invalid-url': 'Invalid url.  Please review your proxy configuration.',\n        'execute': 'Attempted to execute an unknown action.  Valid API actions are defined in Ext.data.Api.actions\"'\n    }\n});\n\n\n\n/**\n * @class Ext.data.SortTypes\n * @singleton\n * Defines the default sorting (casting?) comparison functions used when sorting data.\n */\nExt.data.SortTypes = {\n    /**\n     * Default sort that does nothing\n     * @param {Mixed} s The value being converted\n     * @return {Mixed} The comparison value\n     */\n    none : function(s){\n        return s;\n    },\n    \n    /**\n     * The regular expression used to strip tags\n     * @type {RegExp}\n     * @property\n     */\n    stripTagsRE : /<\\/?[^>]+>/gi,\n    \n    /**\n     * Strips all HTML tags to sort on text only\n     * @param {Mixed} s The value being converted\n     * @return {String} The comparison value\n     */\n    asText : function(s){\n        return String(s).replace(this.stripTagsRE, \"\");\n    },\n    \n    /**\n     * Strips all HTML tags to sort on text only - Case insensitive\n     * @param {Mixed} s The value being converted\n     * @return {String} The comparison value\n     */\n    asUCText : function(s){\n        return String(s).toUpperCase().replace(this.stripTagsRE, \"\");\n    },\n    \n    /**\n     * Case insensitive string\n     * @param {Mixed} s The value being converted\n     * @return {String} The comparison value\n     */\n    asUCString : function(s) {\n    \treturn String(s).toUpperCase();\n    },\n    \n    /**\n     * Date sorting\n     * @param {Mixed} s The value being converted\n     * @return {Number} The comparison value\n     */\n    asDate : function(s) {\n        if(!s){\n            return 0;\n        }\n        if(Ext.isDate(s)){\n            return s.getTime();\n        }\n    \treturn Date.parse(String(s));\n    },\n    \n    /**\n     * Float sorting\n     * @param {Mixed} s The value being converted\n     * @return {Float} The comparison value\n     */\n    asFloat : function(s) {\n    \tvar val = parseFloat(String(s).replace(/,/g, \"\"));\n    \treturn isNaN(val) ? 0 : val;\n    },\n    \n    /**\n     * Integer sorting\n     * @param {Mixed} s The value being converted\n     * @return {Number} The comparison value\n     */\n    asInt : function(s) {\n        var val = parseInt(String(s).replace(/,/g, \"\"), 10);\n        return isNaN(val) ? 0 : val;\n    }\n};/**\n * @class Ext.data.Record\n * <p>Instances of this class encapsulate both Record <em>definition</em> information, and Record\n * <em>value</em> information for use in {@link Ext.data.Store} objects, or any code which needs\n * to access Records cached in an {@link Ext.data.Store} object.</p>\n * <p>Constructors for this class are generated by passing an Array of field definition objects to {@link #create}.\n * Instances are usually only created by {@link Ext.data.Reader} implementations when processing unformatted data\n * objects.</p>\n * <p>Note that an instance of a Record class may only belong to one {@link Ext.data.Store Store} at a time.\n * In order to copy data from one Store to another, use the {@link #copy} method to create an exact\n * copy of the Record, and insert the new instance into the other Store.</p>\n * <p>When serializing a Record for submission to the server, be aware that it contains many private\n * properties, and also a reference to its owning Store which in turn holds references to its Records.\n * This means that a whole Record may not be encoded using {@link Ext.util.JSON.encode}. Instead, use the\n * <code>{@link #data}</code> and <code>{@link #id}</code> properties.</p>\n * <p>Record objects generated by this constructor inherit all the methods of Ext.data.Record listed below.</p>\n * @constructor\n * <p>This constructor should not be used to create Record objects. Instead, use {@link #create} to\n * generate a subclass of Ext.data.Record configured with information about its constituent fields.<p>\n * <p><b>The generated constructor has the same signature as this constructor.</b></p>\n * @param {Object} data (Optional) An object, the properties of which provide values for the new Record's\n * fields. If not specified the <code>{@link Ext.data.Field#defaultValue defaultValue}</code>\n * for each field will be assigned.\n * @param {Object} id (Optional) The id of the Record. The id is used by the\n * {@link Ext.data.Store} object which owns the Record to index its collection\n * of Records (therefore this id should be unique within each store). If an\n * <code>id</code> is not specified a <b><code>{@link #phantom}</code></b>\n * Record will be created with an {@link #Record.id automatically generated id}.\n */\nExt.data.Record = function(data, id){\n    // if no id, call the auto id method\n    this.id = (id || id === 0) ? id : Ext.data.Record.id(this);\n    this.data = data || {};\n};\n\n/**\n * Generate a constructor for a specific Record layout.\n * @param {Array} o An Array of <b>{@link Ext.data.Field Field}</b> definition objects.\n * The constructor generated by this method may be used to create new Record instances. The data\n * object must contain properties named after the {@link Ext.data.Field field}\n * <b><tt>{@link Ext.data.Field#name}s</tt></b>.  Example usage:<pre><code>\n// create a Record constructor from a description of the fields\nvar TopicRecord = Ext.data.Record.create([ // creates a subclass of Ext.data.Record\n    {{@link Ext.data.Field#name name}: 'title', {@link Ext.data.Field#mapping mapping}: 'topic_title'},\n    {name: 'author', mapping: 'username', allowBlank: false},\n    {name: 'totalPosts', mapping: 'topic_replies', type: 'int'},\n    {name: 'lastPost', mapping: 'post_time', type: 'date'},\n    {name: 'lastPoster', mapping: 'user2'},\n    {name: 'excerpt', mapping: 'post_text', allowBlank: false},\n    // In the simplest case, if no properties other than <tt>name</tt> are required,\n    // a field definition may consist of just a String for the field name.\n    'signature'\n]);\n\n// create Record instance\nvar myNewRecord = new TopicRecord(\n    {\n        title: 'Do my job please',\n        author: 'noobie',\n        totalPosts: 1,\n        lastPost: new Date(),\n        lastPoster: 'Animal',\n        excerpt: 'No way dude!',\n        signature: ''\n    },\n    id // optionally specify the id of the record otherwise {@link #Record.id one is auto-assigned}\n);\nmyStore.{@link Ext.data.Store#add add}(myNewRecord);\n</code></pre>\n * @method create\n * @return {Function} A constructor which is used to create new Records according\n * to the definition. The constructor has the same signature as {@link #Record}.\n * @static\n */\nExt.data.Record.create = function(o){\n    var f = Ext.extend(Ext.data.Record, {});\n    var p = f.prototype;\n    p.fields = new Ext.util.MixedCollection(false, function(field){\n        return field.name;\n    });\n    for(var i = 0, len = o.length; i < len; i++){\n        p.fields.add(new Ext.data.Field(o[i]));\n    }\n    f.getField = function(name){\n        return p.fields.get(name);\n    };\n    return f;\n};\n\nExt.data.Record.PREFIX = 'ext-record';\nExt.data.Record.AUTO_ID = 1;\nExt.data.Record.EDIT = 'edit';\nExt.data.Record.REJECT = 'reject';\nExt.data.Record.COMMIT = 'commit';\n\n\n/**\n * Generates a sequential id. This method is typically called when a record is {@link #create}d\n * and {@link #Record no id has been specified}. The returned id takes the form:\n * <tt>&#123;PREFIX}-&#123;AUTO_ID}</tt>.<div class=\"mdetail-params\"><ul>\n * <li><b><tt>PREFIX</tt></b> : String<p class=\"sub-desc\"><tt>Ext.data.Record.PREFIX</tt>\n * (defaults to <tt>'ext-record'</tt>)</p></li>\n * <li><b><tt>AUTO_ID</tt></b> : String<p class=\"sub-desc\"><tt>Ext.data.Record.AUTO_ID</tt>\n * (defaults to <tt>1</tt> initially)</p></li>\n * </ul></div>\n * @param {Record} rec The record being created.  The record does not exist, it's a {@link #phantom}.\n * @return {String} auto-generated string id, <tt>\"ext-record-i++'</tt>;\n */\nExt.data.Record.id = function(rec) {\n    rec.phantom = true;\n    return [Ext.data.Record.PREFIX, '-', Ext.data.Record.AUTO_ID++].join('');\n};\n\nExt.data.Record.prototype = {\n    /**\n     * <p><b>This property is stored in the Record definition's <u>prototype</u></b></p>\n     * A MixedCollection containing the defined {@link Ext.data.Field Field}s for this Record.  Read-only.\n     * @property fields\n     * @type Ext.util.MixedCollection\n     */\n    /**\n     * An object hash representing the data for this Record. Every field name in the Record definition\n     * is represented by a property of that name in this object. Note that unless you specified a field\n     * with {@link Ext.data.Field#name name} \"id\" in the Record definition, this will <b>not</b> contain\n     * an <tt>id</tt> property.\n     * @property data\n     * @type {Object}\n     */\n    /**\n     * The unique ID of the Record {@link #Record as specified at construction time}.\n     * @property id\n     * @type {Object}\n     */\n    /**\n     * <p><b>Only present if this Record was created by an {@link Ext.data.XmlReader XmlReader}</b>.</p>\n     * <p>The XML element which was the source of the data for this Record.</p>\n     * @property node\n     * @type {XMLElement}\n     */\n    /**\n     * <p><b>Only present if this Record was created by an {@link Ext.data.ArrayReader ArrayReader} or a {@link Ext.data.JsonReader JsonReader}</b>.</p>\n     * <p>The Array or object which was the source of the data for this Record.</p>\n     * @property json\n     * @type {Array|Object}\n     */\n    /**\n     * Readonly flag - true if this Record has been modified.\n     * @type Boolean\n     */\n    dirty : false,\n    editing : false,\n    error : null,\n    /**\n     * This object contains a key and value storing the original values of all modified\n     * fields or is null if no fields have been modified.\n     * @property modified\n     * @type {Object}\n     */\n    modified : null,\n    /**\n     * <tt>true</tt> when the record does not yet exist in a server-side database (see\n     * {@link #markDirty}).  Any record which has a real database pk set as its id property\n     * is NOT a phantom -- it's real.\n     * @property phantom\n     * @type {Boolean}\n     */\n    phantom : false,\n\n    // private\n    join : function(store){\n        /**\n         * The {@link Ext.data.Store} to which this Record belongs.\n         * @property store\n         * @type {Ext.data.Store}\n         */\n        this.store = store;\n    },\n\n    /**\n     * Set the {@link Ext.data.Field#name named field} to the specified value.  For example:\n     * <pre><code>\n// record has a field named 'firstname'\nvar Employee = Ext.data.Record.{@link #create}([\n    {name: 'firstname'},\n    ...\n]);\n\n// update the 2nd record in the store:\nvar rec = myStore.{@link Ext.data.Store#getAt getAt}(1);\n\n// set the value (shows dirty flag):\nrec.set('firstname', 'Betty');\n\n// commit the change (removes dirty flag):\nrec.{@link #commit}();\n\n// update the record in the store, bypass setting dirty flag,\n// and do not store the change in the {@link Ext.data.Store#getModifiedRecords modified records}\nrec.{@link #data}['firstname'] = 'Wilma'; // updates record, but not the view\nrec.{@link #commit}(); // updates the view\n     * </code></pre>\n     * <b>Notes</b>:<div class=\"mdetail-params\"><ul>\n     * <li>If the store has a writer and <code>autoSave=true</code>, each set()\n     * will execute an XHR to the server.</li>\n     * <li>Use <code>{@link #beginEdit}</code> to prevent the store's <code>update</code>\n     * event firing while using set().</li>\n     * <li>Use <code>{@link #endEdit}</code> to have the store's <code>update</code>\n     * event fire.</li>\n     * </ul></div>\n     * @param {String} name The {@link Ext.data.Field#name name of the field} to set.\n     * @param {String/Object/Array} value The value to set the field to.\n     */\n    set : function(name, value){\n        var encode = Ext.isPrimitive(value) ? String : Ext.encode;\n        if(encode(this.data[name]) == encode(value)) {\n            return;\n        }        \n        this.dirty = true;\n        if(!this.modified){\n            this.modified = {};\n        }\n        if(this.modified[name] === undefined){\n            this.modified[name] = this.data[name];\n        }\n        this.data[name] = value;\n        if(!this.editing){\n            this.afterEdit();\n        }\n    },\n\n    // private\n    afterEdit : function(){\n        if (this.store != undefined && typeof this.store.afterEdit == \"function\") {\n            this.store.afterEdit(this);\n        }\n    },\n\n    // private\n    afterReject : function(){\n        if(this.store){\n            this.store.afterReject(this);\n        }\n    },\n\n    // private\n    afterCommit : function(){\n        if(this.store){\n            this.store.afterCommit(this);\n        }\n    },\n\n    /**\n     * Get the value of the {@link Ext.data.Field#name named field}.\n     * @param {String} name The {@link Ext.data.Field#name name of the field} to get the value of.\n     * @return {Object} The value of the field.\n     */\n    get : function(name){\n        return this.data[name];\n    },\n\n    /**\n     * Begin an edit. While in edit mode, no events (e.g.. the <code>update</code> event)\n     * are relayed to the containing store.\n     * See also: <code>{@link #endEdit}</code> and <code>{@link #cancelEdit}</code>.\n     */\n    beginEdit : function(){\n        this.editing = true;\n        this.modified = this.modified || {};\n    },\n\n    /**\n     * Cancels all changes made in the current edit operation.\n     */\n    cancelEdit : function(){\n        this.editing = false;\n        delete this.modified;\n    },\n\n    /**\n     * End an edit. If any data was modified, the containing store is notified\n     * (ie, the store's <code>update</code> event will fire).\n     */\n    endEdit : function(){\n        this.editing = false;\n        if(this.dirty){\n            this.afterEdit();\n        }\n    },\n\n    /**\n     * Usually called by the {@link Ext.data.Store} which owns the Record.\n     * Rejects all changes made to the Record since either creation, or the last commit operation.\n     * Modified fields are reverted to their original values.\n     * <p>Developers should subscribe to the {@link Ext.data.Store#update} event\n     * to have their code notified of reject operations.</p>\n     * @param {Boolean} silent (optional) True to skip notification of the owning\n     * store of the change (defaults to false)\n     */\n    reject : function(silent){\n        var m = this.modified;\n        for(var n in m){\n            if(typeof m[n] != \"function\"){\n                this.data[n] = m[n];\n            }\n        }\n        this.dirty = false;\n        delete this.modified;\n        this.editing = false;\n        if(silent !== true){\n            this.afterReject();\n        }\n    },\n\n    /**\n     * Usually called by the {@link Ext.data.Store} which owns the Record.\n     * Commits all changes made to the Record since either creation, or the last commit operation.\n     * <p>Developers should subscribe to the {@link Ext.data.Store#update} event\n     * to have their code notified of commit operations.</p>\n     * @param {Boolean} silent (optional) True to skip notification of the owning\n     * store of the change (defaults to false)\n     */\n    commit : function(silent){\n        this.dirty = false;\n        delete this.modified;\n        this.editing = false;\n        if(silent !== true){\n            this.afterCommit();\n        }\n    },\n\n    /**\n     * Gets a hash of only the fields that have been modified since this Record was created or commited.\n     * @return Object\n     */\n    getChanges : function(){\n        var m = this.modified, cs = {};\n        for(var n in m){\n            if(m.hasOwnProperty(n)){\n                cs[n] = this.data[n];\n            }\n        }\n        return cs;\n    },\n\n    // private\n    hasError : function(){\n        return this.error !== null;\n    },\n\n    // private\n    clearError : function(){\n        this.error = null;\n    },\n\n    /**\n     * Creates a copy (clone) of this Record.\n     * @param {String} id (optional) A new Record id, defaults to the id\n     * of the record being copied. See <code>{@link #id}</code>. \n     * To generate a phantom record with a new id use:<pre><code>\nvar rec = record.copy(); // clone the record\nExt.data.Record.id(rec); // automatically generate a unique sequential id\n     * </code></pre>\n     * @return {Record}\n     */\n    copy : function(newId) {\n        return new this.constructor(Ext.apply({}, this.data), newId || this.id);\n    },\n\n    /**\n     * Returns <tt>true</tt> if the passed field name has been <code>{@link #modified}</code>\n     * since the load or last commit.\n     * @param {String} fieldName {@link Ext.data.Field.{@link Ext.data.Field#name}\n     * @return {Boolean}\n     */\n    isModified : function(fieldName){\n        return !!(this.modified && this.modified.hasOwnProperty(fieldName));\n    },\n\n    /**\n     * By default returns <tt>false</tt> if any {@link Ext.data.Field field} within the\n     * record configured with <tt>{@link Ext.data.Field#allowBlank} = false</tt> returns\n     * <tt>true</tt> from an {@link Ext}.{@link Ext#isEmpty isempty} test.\n     * @return {Boolean}\n     */\n    isValid : function() {\n        return this.fields.find(function(f) {\n            return (f.allowBlank === false && Ext.isEmpty(this.data[f.name])) ? true : false;\n        },this) ? false : true;\n    },\n\n    /**\n     * <p>Marks this <b>Record</b> as <code>{@link #dirty}</code>.  This method\n     * is used interally when adding <code>{@link #phantom}</code> records to a\n     * {@link Ext.data.Store#writer writer enabled store}.</p>\n     * <br><p>Marking a record <code>{@link #dirty}</code> causes the phantom to\n     * be returned by {@link Ext.data.Store#getModifiedRecords} where it will\n     * have a create action composed for it during {@link Ext.data.Store#save store save}\n     * operations.</p>\n     */\n    markDirty : function(){\n        this.dirty = true;\n        if(!this.modified){\n            this.modified = {};\n        }\n        this.fields.each(function(f) {\n            this.modified[f.name] = this.data[f.name];\n        },this);\n    }\n};\n/**\n * @class Ext.StoreMgr\n * @extends Ext.util.MixedCollection\n * The default global group of stores.\n * @singleton\n */\nExt.StoreMgr = Ext.apply(new Ext.util.MixedCollection(), {\n    /**\n     * @cfg {Object} listeners @hide\n     */\n\n    /**\n     * Registers one or more Stores with the StoreMgr. You do not normally need to register stores\n     * manually.  Any store initialized with a {@link Ext.data.Store#storeId} will be auto-registered. \n     * @param {Ext.data.Store...} stores Any number of Store instances\n     */\n    register : function(){\n        for(var i = 0, s; (s = arguments[i]); i++){\n            this.add(s);\n        }\n    },\n\n    /**\n     * Unregisters one or more Stores with the StoreMgr\n     * @param {String/Object} ids IDs of the Stores, or Store instances\n     */\n    unregister : function(){\n        for(var i = 0, s; (s = arguments[i]); i++){\n            this.remove(this.lookup(s));\n        }\n    },\n\n    /**\n     * Gets a registered Store by id\n     * @param {String/Object} id The id of the Store, or a Store instance\n     * @return {Ext.data.Store}\n     */\n    lookup : function(id){\n        if(Ext.isArray(id)){\n            var fields = ['field1'], expand = !Ext.isArray(id[0]);\n            if(!expand){\n                for(var i = 2, len = id[0].length; i <= len; ++i){\n                    fields.push('field' + i);\n                }\n            }\n            return new Ext.data.ArrayStore({\n                fields: fields,\n                data: id,\n                expandData: expand,\n                autoDestroy: true,\n                autoCreated: true\n\n            });\n        }\n        return Ext.isObject(id) ? (id.events ? id : Ext.create(id, 'store')) : this.get(id);\n    },\n\n    // getKey implementation for MixedCollection\n    getKey : function(o){\n         return o.storeId;\n    }\n});/**\n * @class Ext.data.Store\n * @extends Ext.util.Observable\n * <p>The Store class encapsulates a client side cache of {@link Ext.data.Record Record}\n * objects which provide input data for Components such as the {@link Ext.grid.GridPanel GridPanel},\n * the {@link Ext.form.ComboBox ComboBox}, or the {@link Ext.DataView DataView}.</p>\n * <p><u>Retrieving Data</u></p>\n * <p>A Store object may access a data object using:<div class=\"mdetail-params\"><ul>\n * <li>{@link #proxy configured implementation} of {@link Ext.data.DataProxy DataProxy}</li>\n * <li>{@link #data} to automatically pass in data</li>\n * <li>{@link #loadData} to manually pass in data</li>\n * </ul></div></p>\n * <p><u>Reading Data</u></p>\n * <p>A Store object has no inherent knowledge of the format of the data object (it could be\n * an Array, XML, or JSON). A Store object uses an appropriate {@link #reader configured implementation}\n * of a {@link Ext.data.DataReader DataReader} to create {@link Ext.data.Record Record} instances from the data\n * object.</p>\n * <p><u>Store Types</u></p>\n * <p>There are several implementations of Store available which are customized for use with\n * a specific DataReader implementation.  Here is an example using an ArrayStore which implicitly\n * creates a reader commensurate to an Array data object.</p>\n * <pre><code>\nvar myStore = new Ext.data.ArrayStore({\n    fields: ['fullname', 'first'],\n    idIndex: 0 // id for each record will be the first element\n});\n * </code></pre>\n * <p>For custom implementations create a basic {@link Ext.data.Store} configured as needed:</p>\n * <pre><code>\n// create a {@link Ext.data.Record Record} constructor:\nvar rt = Ext.data.Record.create([\n    {name: 'fullname'},\n    {name: 'first'}\n]);\nvar myStore = new Ext.data.Store({\n    // explicitly create reader\n    reader: new Ext.data.ArrayReader(\n        {\n            idIndex: 0  // id for each record will be the first element\n        },\n        rt // recordType\n    )\n});\n * </code></pre>\n * <p>Load some data into store (note the data object is an array which corresponds to the reader):</p>\n * <pre><code>\nvar myData = [\n    [1, 'Fred Flintstone', 'Fred'],  // note that id for the record is the first element\n    [2, 'Barney Rubble', 'Barney']\n];\nmyStore.loadData(myData);\n * </code></pre>\n * <p>Records are cached and made available through accessor functions.  An example of adding\n * a record to the store:</p>\n * <pre><code>\nvar defaultData = {\n    fullname: 'Full Name',\n    first: 'First Name'\n};\nvar recId = 100; // provide unique id for the record\nvar r = new myStore.recordType(defaultData, ++recId); // create new record\nmyStore.{@link #insert}(0, r); // insert a new record into the store (also see {@link #add})\n * </code></pre>\n * <p><u>Writing Data</u></p>\n * <p>And <b>new in Ext version 3</b>, use the new {@link Ext.data.DataWriter DataWriter} to create an automated, <a href=\"http://extjs.com/deploy/dev/examples/writer/writer.html\">Writable Store</a>\n * along with <a href=\"http://extjs.com/deploy/dev/examples/restful/restful.html\">RESTful features.</a>\n * @constructor\n * Creates a new Store.\n * @param {Object} config A config object containing the objects needed for the Store to access data,\n * and read the data into Records.\n * @xtype store\n */\nExt.data.Store = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {String} storeId If passed, the id to use to register with the <b>{@link Ext.StoreMgr StoreMgr}</b>.\n     * <p><b>Note</b>: if a (deprecated) <tt>{@link #id}</tt> is specified it will supersede the <tt>storeId</tt>\n     * assignment.</p>\n     */\n    /**\n     * @cfg {String} url If a <tt>{@link #proxy}</tt> is not specified the <tt>url</tt> will be used to\n     * implicitly configure a {@link Ext.data.HttpProxy HttpProxy} if an <tt>url</tt> is specified.\n     * Typically this option, or the <code>{@link #data}</code> option will be specified.\n     */\n    /**\n     * @cfg {Boolean/Object} autoLoad If <tt>{@link #data}</tt> is not specified, and if <tt>autoLoad</tt>\n     * is <tt>true</tt> or an <tt>Object</tt>, this store's {@link #load} method is automatically called\n     * after creation. If the value of <tt>autoLoad</tt> is an <tt>Object</tt>, this <tt>Object</tt> will\n     * be passed to the store's {@link #load} method.\n     */\n    /**\n     * @cfg {Ext.data.DataProxy} proxy The {@link Ext.data.DataProxy DataProxy} object which provides\n     * access to a data object.  See <code>{@link #url}</code>.\n     */\n    /**\n     * @cfg {Array} data An inline data object readable by the <code>{@link #reader}</code>.\n     * Typically this option, or the <code>{@link #url}</code> option will be specified.\n     */\n    /**\n     * @cfg {Ext.data.DataReader} reader The {@link Ext.data.DataReader Reader} object which processes the\n     * data object and returns an Array of {@link Ext.data.Record} objects which are cached keyed by their\n     * <b><tt>{@link Ext.data.Record#id id}</tt></b> property.\n     */\n    /**\n     * @cfg {Ext.data.DataWriter} writer\n     * <p>The {@link Ext.data.DataWriter Writer} object which processes a record object for being written\n     * to the server-side database.</p>\n     * <br><p>When a writer is installed into a Store the {@link #add}, {@link #remove}, and {@link #update}\n     * events on the store are monitored in order to remotely {@link #createRecords create records},\n     * {@link #destroyRecord destroy records}, or {@link #updateRecord update records}.</p>\n     * <br><p>The proxy for this store will relay any {@link #writexception} events to this store.</p>\n     * <br><p>Sample implementation:\n     * <pre><code>\nvar writer = new {@link Ext.data.JsonWriter}({\n    encode: true,\n    writeAllFields: true // write all fields, not just those that changed\n});\n\n// Typical Store collecting the Proxy, Reader and Writer together.\nvar store = new Ext.data.Store({\n    storeId: 'user',\n    root: 'records',\n    proxy: proxy,\n    reader: reader,\n    writer: writer,     // <-- plug a DataWriter into the store just as you would a Reader\n    paramsAsHash: true,\n    autoSave: false    // <-- false to delay executing create, update, destroy requests\n                        //     until specifically told to do so.\n});\n     * </code></pre></p>\n     */\n    writer : undefined,\n    /**\n     * @cfg {Object} baseParams\n     * <p>An object containing properties which are to be sent as parameters\n     * for <i>every</i> HTTP request.</p>\n     * <p>Parameters are encoded as standard HTTP parameters using {@link Ext#urlEncode}.</p>\n     * <p><b>Note</b>: <code>baseParams</code> may be superseded by any <code>params</code>\n     * specified in a <code>{@link #load}</code> request, see <code>{@link #load}</code>\n     * for more details.</p>\n     * This property may be modified after creation using the <code>{@link #setBaseParam}</code>\n     * method.\n     */\n    /**\n     * @cfg {Object} sortInfo A config object to specify the sort order in the request of a Store's\n     * {@link #load} operation.  Note that for local sorting, the <tt>direction</tt> property is\n     * case-sensitive. See also {@link #remoteSort} and {@link #paramNames}.\n     * For example:<pre><code>\nsortInfo: {\n    field: 'fieldName',\n    direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n}\n</code></pre>\n     */\n    /**\n     * @cfg {boolean} remoteSort <tt>true</tt> if sorting is to be handled by requesting the <tt>{@link #proxy Proxy}</tt>\n     * to provide a refreshed version of the data object in sorted order, as opposed to sorting the Record cache\n     * in place (defaults to <tt>false</tt>).\n     * <p>If <tt>remoteSort</tt> is <tt>true</tt>, then clicking on a {@link Ext.grid.Column Grid Column}'s\n     * {@link Ext.grid.Column#header header} causes the current page to be requested from the server appending\n     * the following two parameters to the <b><tt>{@link #load params}</tt></b>:<div class=\"mdetail-params\"><ul>\n     * <li><b><tt>sort</tt></b> : String<p class=\"sub-desc\">The <tt>name</tt> (as specified in the Record's\n     * {@link Ext.data.Field Field definition}) of the field to sort on.</p></li>\n     * <li><b><tt>dir</tt></b> : String<p class=\"sub-desc\">The direction of the sort, 'ASC' or 'DESC' (case-sensitive).</p></li>\n     * </ul></div></p>\n     */\n    remoteSort : false,\n\n    /**\n     * @cfg {Boolean} autoDestroy <tt>true</tt> to destroy the store when the component the store is bound\n     * to is destroyed (defaults to <tt>false</tt>).\n     * <p><b>Note</b>: this should be set to true when using stores that are bound to only 1 component.</p>\n     */\n    autoDestroy : false,\n\n    /**\n     * @cfg {Boolean} pruneModifiedRecords <tt>true</tt> to clear all modified record information each time\n     * the store is loaded or when a record is removed (defaults to <tt>false</tt>). See {@link #getModifiedRecords}\n     * for the accessor method to retrieve the modified records.\n     */\n    pruneModifiedRecords : false,\n\n    /**\n     * Contains the last options object used as the parameter to the {@link #load} method. See {@link #load}\n     * for the details of what this may contain. This may be useful for accessing any params which were used\n     * to load the current Record cache.\n     * @property\n     */\n    lastOptions : null,\n\n    /**\n     * @cfg {Boolean} autoSave\n     * <p>Defaults to <tt>true</tt> causing the store to automatically {@link #save} records to\n     * the server when a record is modified (ie: becomes 'dirty'). Specify <tt>false</tt> to manually call {@link #save}\n     * to send all modifiedRecords to the server.</p>\n     * <br><p><b>Note</b>: each CRUD action will be sent as a separate request.</p>\n     */\n    autoSave : true,\n\n    /**\n     * @cfg {Boolean} batch\n     * <p>Defaults to <tt>true</tt> (unless <code>{@link #restful}:true</code>). Multiple\n     * requests for each CRUD action (CREATE, READ, UPDATE and DESTROY) will be combined\n     * and sent as one transaction. Only applies when <code>{@link #autoSave}</code> is set\n     * to <tt>false</tt>.</p>\n     * <br><p>If Store is RESTful, the DataProxy is also RESTful, and a unique transaction is\n     * generated for each record.</p>\n     */\n    batch : true,\n\n    /**\n     * @cfg {Boolean} restful\n     * Defaults to <tt>false</tt>.  Set to <tt>true</tt> to have the Store and the set\n     * Proxy operate in a RESTful manner. The store will automatically generate GET, POST,\n     * PUT and DELETE requests to the server. The HTTP method used for any given CRUD\n     * action is described in {@link Ext.data.Api#restActions}.  For additional information\n     * see {@link Ext.data.DataProxy#restful}.\n     * <p><b>Note</b>: if <code>{@link #restful}:true</code> <code>batch</code> will\n     * internally be set to <tt>false</tt>.</p>\n     */\n    restful: false,\n\n    /**\n     * @cfg {Object} paramNames\n     * <p>An object containing properties which specify the names of the paging and\n     * sorting parameters passed to remote servers when loading blocks of data. By default, this\n     * object takes the following form:</p><pre><code>\n{\n    start : 'start',  // The parameter name which specifies the start row\n    limit : 'limit',  // The parameter name which specifies number of rows to return\n    sort : 'sort',    // The parameter name which specifies the column to sort on\n    dir : 'dir'       // The parameter name which specifies the sort direction\n}\n</code></pre>\n     * <p>The server must produce the requested data block upon receipt of these parameter names.\n     * If different parameter names are required, this property can be overriden using a configuration\n     * property.</p>\n     * <p>A {@link Ext.PagingToolbar PagingToolbar} bound to this Store uses this property to determine\n     * the parameter names to use in its {@link #load requests}.\n     */\n    paramNames : undefined,\n\n    /**\n     * @cfg {Object} defaultParamNames\n     * Provides the default values for the {@link #paramNames} property. To globally modify the parameters\n     * for all stores, this object should be changed on the store prototype.\n     */\n    defaultParamNames : {\n        start : 'start',\n        limit : 'limit',\n        sort : 'sort',\n        dir : 'dir'\n    },\n\n    isDestroyed: false,\n    hasMultiSort: false,\n\n    // private\n    batchKey : '_ext_batch_',\n\n    constructor : function(config){\n        /**\n         * @property hasMultiSort\n         * @type Boolean\n         * True if this store is currently sorted by more than one field/direction combination.\n         */\n\n        /**\n         * @property isDestroyed\n         * @type Boolean\n         * True if the store has been destroyed already. Read only\n         */\n\n        this.data = new Ext.util.MixedCollection(false);\n        this.data.getKey = function(o){\n            return o.id;\n        };\n\n\n        // temporary removed-records cache\n        this.removed = [];\n\n        if(config && config.data){\n            this.inlineData = config.data;\n            delete config.data;\n        }\n\n        Ext.apply(this, config);\n\n        /**\n         * See the <code>{@link #baseParams corresponding configuration option}</code>\n         * for a description of this property.\n         * To modify this property see <code>{@link #setBaseParam}</code>.\n         * @property\n         */\n        this.baseParams = Ext.isObject(this.baseParams) ? this.baseParams : {};\n\n        this.paramNames = Ext.applyIf(this.paramNames || {}, this.defaultParamNames);\n\n        if((this.url || this.api) && !this.proxy){\n            this.proxy = new Ext.data.HttpProxy({url: this.url, api: this.api});\n        }\n        // If Store is RESTful, so too is the DataProxy\n        if (this.restful === true && this.proxy) {\n            // When operating RESTfully, a unique transaction is generated for each record.\n            // TODO might want to allow implemention of faux REST where batch is possible using RESTful routes only.\n            this.batch = false;\n            Ext.data.Api.restify(this.proxy);\n        }\n\n        if(this.reader){ // reader passed\n            if(!this.recordType){\n                this.recordType = this.reader.recordType;\n            }\n            if(this.reader.onMetaChange){\n                this.reader.onMetaChange = this.reader.onMetaChange.createSequence(this.onMetaChange, this);\n            }\n            if (this.writer) { // writer passed\n                if (this.writer instanceof(Ext.data.DataWriter) === false) {    // <-- config-object instead of instance.\n                    this.writer = this.buildWriter(this.writer);\n                }\n                this.writer.meta = this.reader.meta;\n                this.pruneModifiedRecords = true;\n            }\n        }\n\n        /**\n         * The {@link Ext.data.Record Record} constructor as supplied to (or created by) the\n         * {@link Ext.data.DataReader Reader}. Read-only.\n         * <p>If the Reader was constructed by passing in an Array of {@link Ext.data.Field} definition objects,\n         * instead of a Record constructor, it will implicitly create a Record constructor from that Array (see\n         * {@link Ext.data.Record}.{@link Ext.data.Record#create create} for additional details).</p>\n         * <p>This property may be used to create new Records of the type held in this Store, for example:</p><pre><code>\n    // create the data store\n    var store = new Ext.data.ArrayStore({\n        autoDestroy: true,\n        fields: [\n           {name: 'company'},\n           {name: 'price', type: 'float'},\n           {name: 'change', type: 'float'},\n           {name: 'pctChange', type: 'float'},\n           {name: 'lastChange', type: 'date', dateFormat: 'n/j h:ia'}\n        ]\n    });\n    store.loadData(myData);\n\n    // create the Grid\n    var grid = new Ext.grid.EditorGridPanel({\n        store: store,\n        colModel: new Ext.grid.ColumnModel({\n            columns: [\n                {id:'company', header: 'Company', width: 160, dataIndex: 'company'},\n                {header: 'Price', renderer: 'usMoney', dataIndex: 'price'},\n                {header: 'Change', renderer: change, dataIndex: 'change'},\n                {header: '% Change', renderer: pctChange, dataIndex: 'pctChange'},\n                {header: 'Last Updated', width: 85,\n                    renderer: Ext.util.Format.dateRenderer('m/d/Y'),\n                    dataIndex: 'lastChange'}\n            ],\n            defaults: {\n                sortable: true,\n                width: 75\n            }\n        }),\n        autoExpandColumn: 'company', // match the id specified in the column model\n        height:350,\n        width:600,\n        title:'Array Grid',\n        tbar: [{\n            text: 'Add Record',\n            handler : function(){\n                var defaultData = {\n                    change: 0,\n                    company: 'New Company',\n                    lastChange: (new Date()).clearTime(),\n                    pctChange: 0,\n                    price: 10\n                };\n                var recId = 3; // provide unique id\n                var p = new store.recordType(defaultData, recId); // create new record\n                grid.stopEditing();\n                store.{@link #insert}(0, p); // insert a new record into the store (also see {@link #add})\n                grid.startEditing(0, 0);\n            }\n        }]\n    });\n         * </code></pre>\n         * @property recordType\n         * @type Function\n         */\n\n        if(this.recordType){\n            /**\n             * A {@link Ext.util.MixedCollection MixedCollection} containing the defined {@link Ext.data.Field Field}s\n             * for the {@link Ext.data.Record Records} stored in this Store. Read-only.\n             * @property fields\n             * @type Ext.util.MixedCollection\n             */\n            this.fields = this.recordType.prototype.fields;\n        }\n        this.modified = [];\n\n        this.addEvents(\n            /**\n             * @event datachanged\n             * Fires when the data cache has changed in a bulk manner (e.g., it has been sorted, filtered, etc.) and a\n             * widget that is using this Store as a Record cache should refresh its view.\n             * @param {Store} this\n             */\n            'datachanged',\n            /**\n             * @event metachange\n             * Fires when this store's reader provides new metadata (fields). This is currently only supported for JsonReaders.\n             * @param {Store} this\n             * @param {Object} meta The JSON metadata\n             */\n            'metachange',\n            /**\n             * @event add\n             * Fires when Records have been {@link #add}ed to the Store\n             * @param {Store} this\n             * @param {Ext.data.Record[]} records The array of Records added\n             * @param {Number} index The index at which the record(s) were added\n             */\n            'add',\n            /**\n             * @event remove\n             * Fires when a Record has been {@link #remove}d from the Store\n             * @param {Store} this\n             * @param {Ext.data.Record} record The Record that was removed\n             * @param {Number} index The index at which the record was removed\n             */\n            'remove',\n            /**\n             * @event update\n             * Fires when a Record has been updated\n             * @param {Store} this\n             * @param {Ext.data.Record} record The Record that was updated\n             * @param {String} operation The update operation being performed.  Value may be one of:\n             * <pre><code>\n     Ext.data.Record.EDIT\n     Ext.data.Record.REJECT\n     Ext.data.Record.COMMIT\n             * </code></pre>\n             */\n            'update',\n            /**\n             * @event clear\n             * Fires when the data cache has been cleared.\n             * @param {Store} this\n             * @param {Record[]} records The records that were cleared.\n             */\n            'clear',\n            /**\n             * @event exception\n             * <p>Fires if an exception occurs in the Proxy during a remote request.\n             * This event is relayed through the corresponding {@link Ext.data.DataProxy}.\n             * See {@link Ext.data.DataProxy}.{@link Ext.data.DataProxy#exception exception}\n             * for additional details.\n             * @param {misc} misc See {@link Ext.data.DataProxy}.{@link Ext.data.DataProxy#exception exception}\n             * for description.\n             */\n            'exception',\n            /**\n             * @event beforeload\n             * Fires before a request is made for a new data object.  If the beforeload handler returns\n             * <tt>false</tt> the {@link #load} action will be canceled.\n             * @param {Store} this\n             * @param {Object} options The loading options that were specified (see {@link #load} for details)\n             */\n            'beforeload',\n            /**\n             * @event load\n             * Fires after a new set of Records has been loaded.\n             * @param {Store} this\n             * @param {Ext.data.Record[]} records The Records that were loaded\n             * @param {Object} options The loading options that were specified (see {@link #load} for details)\n             */\n            'load',\n            /**\n             * @event loadexception\n             * <p>This event is <b>deprecated</b> in favor of the catch-all <b><code>{@link #exception}</code></b>\n             * event instead.</p>\n             * <p>This event is relayed through the corresponding {@link Ext.data.DataProxy}.\n             * See {@link Ext.data.DataProxy}.{@link Ext.data.DataProxy#loadexception loadexception}\n             * for additional details.\n             * @param {misc} misc See {@link Ext.data.DataProxy}.{@link Ext.data.DataProxy#loadexception loadexception}\n             * for description.\n             */\n            'loadexception',\n            /**\n             * @event beforewrite\n             * @param {Ext.data.Store} store\n             * @param {String} action [Ext.data.Api.actions.create|update|destroy]\n             * @param {Record/Record[]} rs The Record(s) being written.\n             * @param {Object} options The loading options that were specified. Edit <code>options.params</code> to add Http parameters to the request.  (see {@link #save} for details)\n             * @param {Object} arg The callback's arg object passed to the {@link #request} function\n             */\n            'beforewrite',\n            /**\n             * @event write\n             * Fires if the server returns 200 after an Ext.data.Api.actions CRUD action.\n             * Success of the action is determined in the <code>result['successProperty']</code>property (<b>NOTE</b> for RESTful stores,\n             * a simple 20x response is sufficient for the actions \"destroy\" and \"update\".  The \"create\" action should should return 200 along with a database pk).\n             * @param {Ext.data.Store} store\n             * @param {String} action [Ext.data.Api.actions.create|update|destroy]\n             * @param {Object} result The 'data' picked-out out of the response for convenience.\n             * @param {Ext.Direct.Transaction} res\n             * @param {Record/Record[]} rs Store's records, the subject(s) of the write-action\n             */\n            'write',\n            /**\n             * @event beforesave\n             * Fires before a save action is called. A save encompasses destroying records, updating records and creating records.\n             * @param {Ext.data.Store} store\n             * @param {Object} data An object containing the data that is to be saved. The object will contain a key for each appropriate action,\n             * with an array of records for each action.\n             */\n            'beforesave',\n            /**\n             * @event save\n             * Fires after a save is completed. A save encompasses destroying records, updating records and creating records.\n             * @param {Ext.data.Store} store\n             * @param {Number} batch The identifier for the batch that was saved.\n             * @param {Object} data An object containing the data that is to be saved. The object will contain a key for each appropriate action,\n             * with an array of records for each action.\n             */\n            'save'\n\n        );\n\n        if(this.proxy){\n            // TODO remove deprecated loadexception with ext-3.0.1\n            this.relayEvents(this.proxy,  ['loadexception', 'exception']);\n        }\n        // With a writer set for the Store, we want to listen to add/remove events to remotely create/destroy records.\n        if (this.writer) {\n            this.on({\n                scope: this,\n                add: this.createRecords,\n                remove: this.destroyRecord,\n                update: this.updateRecord,\n                clear: this.onClear\n            });\n        }\n\n        this.sortToggle = {};\n        if(this.sortField){\n            this.setDefaultSort(this.sortField, this.sortDir);\n        }else if(this.sortInfo){\n            this.setDefaultSort(this.sortInfo.field, this.sortInfo.direction);\n        }\n\n        Ext.data.Store.superclass.constructor.call(this);\n\n        if(this.id){\n            this.storeId = this.id;\n            delete this.id;\n        }\n        if(this.storeId){\n            Ext.StoreMgr.register(this);\n        }\n        if(this.inlineData){\n            this.loadData(this.inlineData);\n            delete this.inlineData;\n        }else if(this.autoLoad){\n            this.load.defer(10, this, [\n                typeof this.autoLoad == 'object' ?\n                    this.autoLoad : undefined]);\n        }\n        // used internally to uniquely identify a batch\n        this.batchCounter = 0;\n        this.batches = {};\n    },\n\n    /**\n     * builds a DataWriter instance when Store constructor is provided with a writer config-object instead of an instace.\n     * @param {Object} config Writer configuration\n     * @return {Ext.data.DataWriter}\n     * @private\n     */\n    buildWriter : function(config) {\n        var klass = undefined,\n            type = (config.format || 'json').toLowerCase();\n        switch (type) {\n            case 'json':\n                klass = Ext.data.JsonWriter;\n                break;\n            case 'xml':\n                klass = Ext.data.XmlWriter;\n                break;\n            default:\n                klass = Ext.data.JsonWriter;\n        }\n        return new klass(config);\n    },\n\n    /**\n     * Destroys the store.\n     */\n    destroy : function(){\n        if(!this.isDestroyed){\n            if(this.storeId){\n                Ext.StoreMgr.unregister(this);\n            }\n            this.clearData();\n            this.data = null;\n            Ext.destroy(this.proxy);\n            this.reader = this.writer = null;\n            this.purgeListeners();\n            this.isDestroyed = true;\n        }\n    },\n\n    /**\n     * Add Records to the Store and fires the {@link #add} event.  To add Records\n     * to the store from a remote source use <code>{@link #load}({add:true})</code>.\n     * See also <code>{@link #recordType}</code> and <code>{@link #insert}</code>.\n     * @param {Ext.data.Record[]} records An Array of Ext.data.Record objects\n     * to add to the cache. See {@link #recordType}.\n     */\n    add : function(records) {\n        var i, len, record, index;\n\n        records = [].concat(records);\n        if (records.length < 1) {\n            return;\n        }\n\n        for (i = 0, len = records.length; i < len; i++) {\n            record = records[i];\n\n            record.join(this);\n\n            if (record.dirty || record.phantom) {\n                this.modified.push(record);\n            }\n        }\n\n        index = this.data.length;\n        this.data.addAll(records);\n\n        if (this.snapshot) {\n            this.snapshot.addAll(records);\n        }\n\n        this.fireEvent('add', this, records, index);\n    },\n\n    /**\n     * (Local sort only) Inserts the passed Record into the Store at the index where it\n     * should go based on the current sort information.\n     * @param {Ext.data.Record} record\n     */\n    addSorted : function(record){\n        var index = this.findInsertIndex(record);\n        this.insert(index, record);\n    },\n\n    /**\n     * @private\n     * Update a record within the store with a new reference\n     */\n    doUpdate: function(rec){\n        var id = rec.id;\n        // unjoin the old record\n        this.getById(id).join(null);\n\n        this.data.replace(id, rec);\n        if (this.snapshot) {\n            this.snapshot.replace(id, rec);\n        }\n        rec.join(this);\n        this.fireEvent('update', this, rec, Ext.data.Record.COMMIT);\n    },\n\n    /**\n     * Remove Records from the Store and fires the {@link #remove} event.\n     * @param {Ext.data.Record/Ext.data.Record[]} record The record object or array of records to remove from the cache.\n     */\n    remove : function(record){\n        if(Ext.isArray(record)){\n            Ext.each(record, function(r){\n                this.remove(r);\n            }, this);\n            return;\n        }\n        var index = this.data.indexOf(record);\n        if(index > -1){\n            record.join(null);\n            this.data.removeAt(index);\n        }\n        if(this.pruneModifiedRecords){\n            this.modified.remove(record);\n        }\n        if(this.snapshot){\n            this.snapshot.remove(record);\n        }\n        if(index > -1){\n            this.fireEvent('remove', this, record, index);\n        }\n    },\n\n    /**\n     * Remove a Record from the Store at the specified index. Fires the {@link #remove} event.\n     * @param {Number} index The index of the record to remove.\n     */\n    removeAt : function(index){\n        this.remove(this.getAt(index));\n    },\n\n    /**\n     * Remove all Records from the Store and fires the {@link #clear} event.\n     * @param {Boolean} silent [false] Defaults to <tt>false</tt>.  Set <tt>true</tt> to not fire clear event.\n     */\n    removeAll : function(silent){\n        var items = [];\n        this.each(function(rec){\n            items.push(rec);\n        });\n        this.clearData();\n        if(this.snapshot){\n            this.snapshot.clear();\n        }\n        if(this.pruneModifiedRecords){\n            this.modified = [];\n        }\n        if (silent !== true) {  // <-- prevents write-actions when we just want to clear a store.\n            this.fireEvent('clear', this, items);\n        }\n    },\n\n    // private\n    onClear: function(store, records){\n        Ext.each(records, function(rec, index){\n            this.destroyRecord(this, rec, index);\n        }, this);\n    },\n\n    /**\n     * Inserts Records into the Store at the given index and fires the {@link #add} event.\n     * See also <code>{@link #add}</code> and <code>{@link #addSorted}</code>.\n     * @param {Number} index The start index at which to insert the passed Records.\n     * @param {Ext.data.Record[]} records An Array of Ext.data.Record objects to add to the cache.\n     */\n    insert : function(index, records) {\n        var i, len, record;\n\n        records = [].concat(records);\n        for (i = 0, len = records.length; i < len; i++) {\n            record = records[i];\n\n            this.data.insert(index + i, record);\n            record.join(this);\n\n            if (record.dirty || record.phantom) {\n                this.modified.push(record);\n            }\n        }\n\n        if (this.snapshot) {\n            this.snapshot.addAll(records);\n        }\n\n        this.fireEvent('add', this, records, index);\n    },\n\n    /**\n     * Get the index within the cache of the passed Record.\n     * @param {Ext.data.Record} record The Ext.data.Record object to find.\n     * @return {Number} The index of the passed Record. Returns -1 if not found.\n     */\n    indexOf : function(record){\n        return this.data.indexOf(record);\n    },\n\n    /**\n     * Get the index within the cache of the Record with the passed id.\n     * @param {String} id The id of the Record to find.\n     * @return {Number} The index of the Record. Returns -1 if not found.\n     */\n    indexOfId : function(id){\n        return this.data.indexOfKey(id);\n    },\n\n    /**\n     * Get the Record with the specified id.\n     * @param {String} id The id of the Record to find.\n     * @return {Ext.data.Record} The Record with the passed id. Returns undefined if not found.\n     */\n    getById : function(id){\n        return (this.snapshot || this.data).key(id);\n    },\n\n    /**\n     * Get the Record at the specified index.\n     * @param {Number} index The index of the Record to find.\n     * @return {Ext.data.Record} The Record at the passed index. Returns undefined if not found.\n     */\n    getAt : function(index){\n        return this.data.itemAt(index);\n    },\n\n    /**\n     * Returns a range of Records between specified indices.\n     * @param {Number} startIndex (optional) The starting index (defaults to 0)\n     * @param {Number} endIndex (optional) The ending index (defaults to the last Record in the Store)\n     * @return {Ext.data.Record[]} An array of Records\n     */\n    getRange : function(start, end){\n        return this.data.getRange(start, end);\n    },\n\n    // private\n    storeOptions : function(o){\n        o = Ext.apply({}, o);\n        delete o.callback;\n        delete o.scope;\n        this.lastOptions = o;\n    },\n\n    // private\n    clearData: function(){\n        this.data.each(function(rec) {\n            rec.join(null);\n        });\n        this.data.clear();\n    },\n\n    /**\n     * <p>Loads the Record cache from the configured <tt>{@link #proxy}</tt> using the configured <tt>{@link #reader}</tt>.</p>\n     * <br><p>Notes:</p><div class=\"mdetail-params\"><ul>\n     * <li><b><u>Important</u></b>: loading is asynchronous! This call will return before the new data has been\n     * loaded. To perform any post-processing where information from the load call is required, specify\n     * the <tt>callback</tt> function to be called, or use a {@link Ext.util.Observable#listeners a 'load' event handler}.</li>\n     * <li>If using {@link Ext.PagingToolbar remote paging}, the first load call must specify the <tt>start</tt> and <tt>limit</tt>\n     * properties in the <code>options.params</code> property to establish the initial position within the\n     * dataset, and the number of Records to cache on each read from the Proxy.</li>\n     * <li>If using {@link #remoteSort remote sorting}, the configured <code>{@link #sortInfo}</code>\n     * will be automatically included with the posted parameters according to the specified\n     * <code>{@link #paramNames}</code>.</li>\n     * </ul></div>\n     * @param {Object} options An object containing properties which control loading options:<ul>\n     * <li><b><tt>params</tt></b> :Object<div class=\"sub-desc\"><p>An object containing properties to pass as HTTP\n     * parameters to a remote data source. <b>Note</b>: <code>params</code> will override any\n     * <code>{@link #baseParams}</code> of the same name.</p>\n     * <p>Parameters are encoded as standard HTTP parameters using {@link Ext#urlEncode}.</p></div></li>\n     * <li><b>callback</b> : Function<div class=\"sub-desc\"><p>A function to be called after the Records\n     * have been loaded. The callback is called after the load event is fired, and is passed the following arguments:<ul>\n     * <li>r : Ext.data.Record[] An Array of Records loaded.</li>\n     * <li>options : Options object from the load call.</li>\n     * <li>success : Boolean success indicator.</li></ul></p></div></li>\n     * <li><b>scope</b> : Object<div class=\"sub-desc\"><p>Scope with which to call the callback (defaults\n     * to the Store object)</p></div></li>\n     * <li><b>add</b> : Boolean<div class=\"sub-desc\"><p>Indicator to append loaded records rather than\n     * replace the current cache.  <b>Note</b>: see note for <tt>{@link #loadData}</tt></p></div></li>\n     * </ul>\n     * @return {Boolean} If the <i>developer</i> provided <tt>{@link #beforeload}</tt> event handler returns\n     * <tt>false</tt>, the load call will abort and will return <tt>false</tt>; otherwise will return <tt>true</tt>.\n     */\n    load : function(options) {\n        options = Ext.apply({}, options);\n        this.storeOptions(options);\n        if(this.sortInfo && this.remoteSort){\n            var pn = this.paramNames;\n            options.params = Ext.apply({}, options.params);\n            options.params[pn.sort] = this.sortInfo.field;\n            options.params[pn.dir] = this.sortInfo.direction;\n        }\n        try {\n            return this.execute('read', null, options); // <-- null represents rs.  No rs for load actions.\n        } catch(e) {\n            this.handleException(e);\n            return false;\n        }\n    },\n\n    /**\n     * updateRecord  Should not be used directly.  This method will be called automatically if a Writer is set.\n     * Listens to 'update' event.\n     * @param {Object} store\n     * @param {Object} record\n     * @param {Object} action\n     * @private\n     */\n    updateRecord : function(store, record, action) {\n        if (action == Ext.data.Record.EDIT && this.autoSave === true && (!record.phantom || (record.phantom && record.isValid()))) {\n            this.save();\n        }\n    },\n\n    /**\n     * @private\n     * Should not be used directly.  Store#add will call this automatically if a Writer is set\n     * @param {Object} store\n     * @param {Object} records\n     * @param {Object} index\n     */\n    createRecords : function(store, records, index) {\n        var modified = this.modified,\n            length   = records.length,\n            record, i;\n\n        for (i = 0; i < length; i++) {\n            record = records[i];\n\n            if (record.phantom && record.isValid()) {\n                record.markDirty();  // <-- Mark new records dirty (Ed: why?)\n\n                if (modified.indexOf(record) == -1) {\n                    modified.push(record);\n                }\n            }\n        }\n        if (this.autoSave === true) {\n            this.save();\n        }\n    },\n\n    /**\n     * Destroys a Record.  Should not be used directly.  It's called by Store#remove if a Writer is set.\n     * @param {Store} store this\n     * @param {Ext.data.Record} record\n     * @param {Number} index\n     * @private\n     */\n    destroyRecord : function(store, record, index) {\n        if (this.modified.indexOf(record) != -1) {  // <-- handled already if @cfg pruneModifiedRecords == true\n            this.modified.remove(record);\n        }\n        if (!record.phantom) {\n            this.removed.push(record);\n\n            // since the record has already been removed from the store but the server request has not yet been executed,\n            // must keep track of the last known index this record existed.  If a server error occurs, the record can be\n            // put back into the store.  @see Store#createCallback where the record is returned when response status === false\n            record.lastIndex = index;\n\n            if (this.autoSave === true) {\n                this.save();\n            }\n        }\n    },\n\n    /**\n     * This method should generally not be used directly.  This method is called internally\n     * by {@link #load}, or if a Writer is set will be called automatically when {@link #add},\n     * {@link #remove}, or {@link #update} events fire.\n     * @param {String} action Action name ('read', 'create', 'update', or 'destroy')\n     * @param {Record/Record[]} rs\n     * @param {Object} options\n     * @throws Error\n     * @private\n     */\n    execute : function(action, rs, options, /* private */ batch) {\n        // blow up if action not Ext.data.CREATE, READ, UPDATE, DESTROY\n        if (!Ext.data.Api.isAction(action)) {\n            throw new Ext.data.Api.Error('execute', action);\n        }\n        // make sure options has a fresh, new params hash\n        options = Ext.applyIf(options||{}, {\n            params: {}\n        });\n        if(batch !== undefined){\n            this.addToBatch(batch);\n        }\n        // have to separate before-events since load has a different signature than create,destroy and save events since load does not\n        // include the rs (record resultset) parameter.  Capture return values from the beforeaction into doRequest flag.\n        var doRequest = true;\n\n        if (action === 'read') {\n            doRequest = this.fireEvent('beforeload', this, options);\n            Ext.applyIf(options.params, this.baseParams);\n        }\n        else {\n            // if Writer is configured as listful, force single-record rs to be [{}] instead of {}\n            // TODO Move listful rendering into DataWriter where the @cfg is defined.  Should be easy now.\n            if (this.writer.listful === true && this.restful !== true) {\n                rs = (Ext.isArray(rs)) ? rs : [rs];\n            }\n            // if rs has just a single record, shift it off so that Writer writes data as '{}' rather than '[{}]'\n            else if (Ext.isArray(rs) && rs.length == 1) {\n                rs = rs.shift();\n            }\n            // Write the action to options.params\n            if ((doRequest = this.fireEvent('beforewrite', this, action, rs, options)) !== false) {\n                this.writer.apply(options.params, this.baseParams, action, rs);\n            }\n        }\n        if (doRequest !== false) {\n            // Send request to proxy.\n            if (this.writer && this.proxy.url && !this.proxy.restful && !Ext.data.Api.hasUniqueUrl(this.proxy, action)) {\n                options.params.xaction = action;    // <-- really old, probaby unecessary.\n            }\n            // Note:  Up until this point we've been dealing with 'action' as a key from Ext.data.Api.actions.\n            // We'll flip it now and send the value into DataProxy#request, since it's the value which maps to\n            // the user's configured DataProxy#api\n            // TODO Refactor all Proxies to accept an instance of Ext.data.Request (not yet defined) instead of this looooooong list\n            // of params.  This method is an artifact from Ext2.\n            this.proxy.request(Ext.data.Api.actions[action], rs, options.params, this.reader, this.createCallback(action, rs, batch), this, options);\n        }\n        return doRequest;\n    },\n\n    /**\n     * Saves all pending changes to the store.  If the commensurate Ext.data.Api.actions action is not configured, then\n     * the configured <code>{@link #url}</code> will be used.\n     * <pre>\n     * change            url\n     * ---------------   --------------------\n     * removed records   Ext.data.Api.actions.destroy\n     * phantom records   Ext.data.Api.actions.create\n     * {@link #getModifiedRecords modified records}  Ext.data.Api.actions.update\n     * </pre>\n     * @TODO:  Create extensions of Error class and send associated Record with thrown exceptions.\n     * e.g.:  Ext.data.DataReader.Error or Ext.data.Error or Ext.data.DataProxy.Error, etc.\n     * @return {Number} batch Returns a number to uniquely identify the \"batch\" of saves occurring. -1 will be returned\n     * if there are no items to save or the save was cancelled.\n     */\n    save : function() {\n        if (!this.writer) {\n            throw new Ext.data.Store.Error('writer-undefined');\n        }\n\n        var queue = [],\n            len,\n            trans,\n            batch,\n            data = {},\n            i;\n        // DESTROY:  First check for removed records.  Records in this.removed are guaranteed non-phantoms.  @see Store#remove\n        if(this.removed.length){\n            queue.push(['destroy', this.removed]);\n        }\n\n        // Check for modified records. Use a copy so Store#rejectChanges will work if server returns error.\n        var rs = [].concat(this.getModifiedRecords());\n        if(rs.length){\n            // CREATE:  Next check for phantoms within rs.  splice-off and execute create.\n            var phantoms = [];\n            for(i = rs.length-1; i >= 0; i--){\n                if(rs[i].phantom === true){\n                    var rec = rs.splice(i, 1).shift();\n                    if(rec.isValid()){\n                        phantoms.push(rec);\n                    }\n                }else if(!rs[i].isValid()){ // <-- while we're here, splice-off any !isValid real records\n                    rs.splice(i,1);\n                }\n            }\n            // If we have valid phantoms, create them...\n            if(phantoms.length){\n                queue.push(['create', phantoms]);\n            }\n\n            // UPDATE:  And finally, if we're still here after splicing-off phantoms and !isValid real records, update the rest...\n            if(rs.length){\n                queue.push(['update', rs]);\n            }\n        }\n        len = queue.length;\n        if(len){\n            batch = ++this.batchCounter;\n            for(i = 0; i < len; ++i){\n                trans = queue[i];\n                data[trans[0]] = trans[1];\n            }\n            if(this.fireEvent('beforesave', this, data) !== false){\n                for(i = 0; i < len; ++i){\n                    trans = queue[i];\n                    this.doTransaction(trans[0], trans[1], batch);\n                }\n                return batch;\n            }\n        }\n        return -1;\n    },\n\n    // private.  Simply wraps call to Store#execute in try/catch.  Defers to Store#handleException on error.  Loops if batch: false\n    doTransaction : function(action, rs, batch) {\n        function transaction(records) {\n            try{\n                this.execute(action, records, undefined, batch);\n            }catch (e){\n                this.handleException(e);\n            }\n        }\n        if(this.batch === false){\n            for(var i = 0, len = rs.length; i < len; i++){\n                transaction.call(this, rs[i]);\n            }\n        }else{\n            transaction.call(this, rs);\n        }\n    },\n\n    // private\n    addToBatch : function(batch){\n        var b = this.batches,\n            key = this.batchKey + batch,\n            o = b[key];\n\n        if(!o){\n            b[key] = o = {\n                id: batch,\n                count: 0,\n                data: {}\n            };\n        }\n        ++o.count;\n    },\n\n    removeFromBatch : function(batch, action, data){\n        var b = this.batches,\n            key = this.batchKey + batch,\n            o = b[key],\n            arr;\n\n\n        if(o){\n            arr = o.data[action] || [];\n            o.data[action] = arr.concat(data);\n            if(o.count === 1){\n                data = o.data;\n                delete b[key];\n                this.fireEvent('save', this, batch, data);\n            }else{\n                --o.count;\n            }\n        }\n    },\n\n    // @private callback-handler for remote CRUD actions\n    // Do not override -- override loadRecords, onCreateRecords, onDestroyRecords and onUpdateRecords instead.\n    createCallback : function(action, rs, batch) {\n        var actions = Ext.data.Api.actions;\n        return (action == 'read') ? this.loadRecords : function(data, response, success) {\n            // calls: onCreateRecords | onUpdateRecords | onDestroyRecords\n            this['on' + Ext.util.Format.capitalize(action) + 'Records'](success, rs, [].concat(data));\n            // If success === false here, exception will have been called in DataProxy\n            if (success === true) {\n                this.fireEvent('write', this, action, data, response, rs);\n            }\n            this.removeFromBatch(batch, action, data);\n        };\n    },\n\n    // Clears records from modified array after an exception event.\n    // NOTE:  records are left marked dirty.  Do we want to commit them even though they were not updated/realized?\n    // TODO remove this method?\n    clearModified : function(rs) {\n        if (Ext.isArray(rs)) {\n            for (var n=rs.length-1;n>=0;n--) {\n                this.modified.splice(this.modified.indexOf(rs[n]), 1);\n            }\n        } else {\n            this.modified.splice(this.modified.indexOf(rs), 1);\n        }\n    },\n\n    // remap record ids in MixedCollection after records have been realized.  @see Store#onCreateRecords, @see DataReader#realize\n    reMap : function(record) {\n        if (Ext.isArray(record)) {\n            for (var i = 0, len = record.length; i < len; i++) {\n                this.reMap(record[i]);\n            }\n        } else {\n            delete this.data.map[record._phid];\n            this.data.map[record.id] = record;\n            var index = this.data.keys.indexOf(record._phid);\n            this.data.keys.splice(index, 1, record.id);\n            delete record._phid;\n        }\n    },\n\n    // @protected onCreateRecord proxy callback for create action\n    onCreateRecords : function(success, rs, data) {\n        if (success === true) {\n            try {\n                this.reader.realize(rs, data);\n            }\n            catch (e) {\n                this.handleException(e);\n                if (Ext.isArray(rs)) {\n                    // Recurse to run back into the try {}.  DataReader#realize splices-off the rs until empty.\n                    this.onCreateRecords(success, rs, data);\n                }\n            }\n        }\n    },\n\n    // @protected, onUpdateRecords proxy callback for update action\n    onUpdateRecords : function(success, rs, data) {\n        if (success === true) {\n            try {\n                this.reader.update(rs, data);\n            } catch (e) {\n                this.handleException(e);\n                if (Ext.isArray(rs)) {\n                    // Recurse to run back into the try {}.  DataReader#update splices-off the rs until empty.\n                    this.onUpdateRecords(success, rs, data);\n                }\n            }\n        }\n    },\n\n    // @protected onDestroyRecords proxy callback for destroy action\n    onDestroyRecords : function(success, rs, data) {\n        // splice each rec out of this.removed\n        rs = (rs instanceof Ext.data.Record) ? [rs] : [].concat(rs);\n        for (var i=0,len=rs.length;i<len;i++) {\n            this.removed.splice(this.removed.indexOf(rs[i]), 1);\n        }\n        if (success === false) {\n            // put records back into store if remote destroy fails.\n            // @TODO: Might want to let developer decide.\n            for (i=rs.length-1;i>=0;i--) {\n                this.insert(rs[i].lastIndex, rs[i]);    // <-- lastIndex set in Store#destroyRecord\n            }\n        }\n    },\n\n    // protected handleException.  Possibly temporary until Ext framework has an exception-handler.\n    handleException : function(e) {\n        // @see core/Error.js\n        Ext.handleError(e);\n    },\n\n    /**\n     * <p>Reloads the Record cache from the configured Proxy using the configured\n     * {@link Ext.data.Reader Reader} and the options from the last load operation\n     * performed.</p>\n     * <p><b>Note</b>: see the Important note in {@link #load}.</p>\n     * @param {Object} options <p>(optional) An <tt>Object</tt> containing\n     * {@link #load loading options} which may override the {@link #lastOptions options}\n     * used in the last {@link #load} operation. See {@link #load} for details\n     * (defaults to <tt>null</tt>, in which case the {@link #lastOptions} are\n     * used).</p>\n     * <br><p>To add new params to the existing params:</p><pre><code>\nlastOptions = myStore.lastOptions;\nExt.apply(lastOptions.params, {\n    myNewParam: true\n});\nmyStore.reload(lastOptions);\n     * </code></pre>\n     */\n    reload : function(options){\n        this.load(Ext.applyIf(options||{}, this.lastOptions));\n    },\n\n    // private\n    // Called as a callback by the Reader during a load operation.\n    loadRecords : function(o, options, success){\n        var i, len;\n\n        if (this.isDestroyed === true) {\n            return;\n        }\n        if(!o || success === false){\n            if(success !== false){\n                this.fireEvent('load', this, [], options);\n            }\n            if(options.callback){\n                options.callback.call(options.scope || this, [], options, false, o);\n            }\n            return;\n        }\n        var r = o.records, t = o.totalRecords || r.length;\n        if(!options || options.add !== true){\n            if(this.pruneModifiedRecords){\n                this.modified = [];\n            }\n            for(i = 0, len = r.length; i < len; i++){\n                r[i].join(this);\n            }\n            if(this.snapshot){\n                this.data = this.snapshot;\n                delete this.snapshot;\n            }\n            this.clearData();\n            this.data.addAll(r);\n            this.totalLength = t;\n            this.applySort();\n            this.fireEvent('datachanged', this);\n        }else{\n            var toAdd = [],\n                rec,\n                cnt = 0;\n            for(i = 0, len = r.length; i < len; ++i){\n                rec = r[i];\n                if(this.indexOfId(rec.id) > -1){\n                    this.doUpdate(rec);\n                }else{\n                    toAdd.push(rec);\n                    ++cnt;\n                }\n            }\n            this.totalLength = Math.max(t, this.data.length + cnt);\n            this.add(toAdd);\n        }\n        this.fireEvent('load', this, r, options);\n        if(options.callback){\n            options.callback.call(options.scope || this, r, options, true);\n        }\n    },\n\n    /**\n     * Loads data from a passed data block and fires the {@link #load} event. A {@link Ext.data.Reader Reader}\n     * which understands the format of the data must have been configured in the constructor.\n     * @param {Object} data The data block from which to read the Records.  The format of the data expected\n     * is dependent on the type of {@link Ext.data.Reader Reader} that is configured and should correspond to\n     * that {@link Ext.data.Reader Reader}'s <tt>{@link Ext.data.Reader#readRecords}</tt> parameter.\n     * @param {Boolean} append (Optional) <tt>true</tt> to append the new Records rather the default to replace\n     * the existing cache.\n     * <b>Note</b>: that Records in a Store are keyed by their {@link Ext.data.Record#id id}, so added Records\n     * with ids which are already present in the Store will <i>replace</i> existing Records. Only Records with\n     * new, unique ids will be added.\n     */\n    loadData : function(o, append){\n        var r = this.reader.readRecords(o);\n        this.loadRecords(r, {add: append}, true);\n    },\n\n    /**\n     * Gets the number of cached records.\n     * <p>If using paging, this may not be the total size of the dataset. If the data object\n     * used by the Reader contains the dataset size, then the {@link #getTotalCount} function returns\n     * the dataset size.  <b>Note</b>: see the Important note in {@link #load}.</p>\n     * @return {Number} The number of Records in the Store's cache.\n     */\n    getCount : function(){\n        return this.data.length || 0;\n    },\n\n    /**\n     * Gets the total number of records in the dataset as returned by the server.\n     * <p>If using paging, for this to be accurate, the data object used by the {@link #reader Reader}\n     * must contain the dataset size. For remote data sources, the value for this property\n     * (<tt>totalProperty</tt> for {@link Ext.data.JsonReader JsonReader},\n     * <tt>totalRecords</tt> for {@link Ext.data.XmlReader XmlReader}) shall be returned by a query on the server.\n     * <b>Note</b>: see the Important note in {@link #load}.</p>\n     * @return {Number} The number of Records as specified in the data object passed to the Reader\n     * by the Proxy.\n     * <p><b>Note</b>: this value is not updated when changing the contents of the Store locally.</p>\n     */\n    getTotalCount : function(){\n        return this.totalLength || 0;\n    },\n\n    /**\n     * Returns an object describing the current sort state of this Store.\n     * @return {Object} The sort state of the Store. An object with two properties:<ul>\n     * <li><b>field : String</b><p class=\"sub-desc\">The name of the field by which the Records are sorted.</p></li>\n     * <li><b>direction : String</b><p class=\"sub-desc\">The sort order, 'ASC' or 'DESC' (case-sensitive).</p></li>\n     * </ul>\n     * See <tt>{@link #sortInfo}</tt> for additional details.\n     */\n    getSortState : function(){\n        return this.sortInfo;\n    },\n\n    /**\n     * @private\n     * Invokes sortData if we have sortInfo to sort on and are not sorting remotely\n     */\n    applySort : function(){\n        if ((this.sortInfo || this.multiSortInfo) && !this.remoteSort) {\n            this.sortData();\n        }\n    },\n\n    /**\n     * @private\n     * Performs the actual sorting of data. This checks to see if we currently have a multi sort or not. It applies\n     * each sorter field/direction pair in turn by building an OR'ed master sorting function and running it against\n     * the full dataset\n     */\n    sortData : function() {\n        var sortInfo  = this.hasMultiSort ? this.multiSortInfo : this.sortInfo,\n            direction = sortInfo.direction || \"ASC\",\n            sorters   = sortInfo.sorters,\n            sortFns   = [];\n\n        //if we just have a single sorter, pretend it's the first in an array\n        if (!this.hasMultiSort) {\n            sorters = [{direction: direction, field: sortInfo.field}];\n        }\n\n        //create a sorter function for each sorter field/direction combo\n        for (var i=0, j = sorters.length; i < j; i++) {\n            sortFns.push(this.createSortFunction(sorters[i].field, sorters[i].direction));\n        }\n\n        if (sortFns.length == 0) {\n            return;\n        }\n\n        //the direction modifier is multiplied with the result of the sorting functions to provide overall sort direction\n        //(as opposed to direction per field)\n        var directionModifier = direction.toUpperCase() == \"DESC\" ? -1 : 1;\n\n        //create a function which ORs each sorter together to enable multi-sort\n        var fn = function(r1, r2) {\n          var result = sortFns[0].call(this, r1, r2);\n\n          //if we have more than one sorter, OR any additional sorter functions together\n          if (sortFns.length > 1) {\n              for (var i=1, j = sortFns.length; i < j; i++) {\n                  result = result || sortFns[i].call(this, r1, r2);\n              }\n          }\n\n          return directionModifier * result;\n        };\n\n        //sort the data\n        this.data.sort(direction, fn);\n        if (this.snapshot && this.snapshot != this.data) {\n            this.snapshot.sort(direction, fn);\n        }\n    },\n\n    /**\n     * @private\n     * Creates and returns a function which sorts an array by the given field and direction\n     * @param {String} field The field to create the sorter for\n     * @param {String} direction The direction to sort by (defaults to \"ASC\")\n     * @return {Function} A function which sorts by the field/direction combination provided\n     */\n    createSortFunction: function(field, direction) {\n        direction = direction || \"ASC\";\n        var directionModifier = direction.toUpperCase() == \"DESC\" ? -1 : 1;\n\n        var sortType = this.fields.get(field).sortType;\n\n        //create a comparison function. Takes 2 records, returns 1 if record 1 is greater,\n        //-1 if record 2 is greater or 0 if they are equal\n        return function(r1, r2) {\n            var v1 = sortType(r1.data[field]),\n                v2 = sortType(r2.data[field]);\n\n            return directionModifier * (v1 > v2 ? 1 : (v1 < v2 ? -1 : 0));\n        };\n    },\n\n    /**\n     * Sets the default sort column and order to be used by the next {@link #load} operation.\n     * @param {String} fieldName The name of the field to sort by.\n     * @param {String} dir (optional) The sort order, 'ASC' or 'DESC' (case-sensitive, defaults to <tt>'ASC'</tt>)\n     */\n    setDefaultSort : function(field, dir) {\n        dir = dir ? dir.toUpperCase() : 'ASC';\n        this.sortInfo = {field: field, direction: dir};\n        this.sortToggle[field] = dir;\n    },\n\n    /**\n     * Sort the Records.\n     * If remote sorting is used, the sort is performed on the server, and the cache is reloaded. If local\n     * sorting is used, the cache is sorted internally. See also {@link #remoteSort} and {@link #paramNames}.\n     * This function accepts two call signatures - pass in a field name as the first argument to sort on a single\n     * field, or pass in an array of sort configuration objects to sort by multiple fields.\n     * Single sort example:\n     * store.sort('name', 'ASC');\n     * Multi sort example:\n     * store.sort([\n     *   {\n     *     field    : 'name',\n     *     direction: 'ASC'\n     *   },\n     *   {\n     *     field    : 'salary',\n     *     direction: 'DESC'\n     *   }\n     * ], 'ASC');\n     * In this second form, the sort configs are applied in order, with later sorters sorting within earlier sorters' results.\n     * For example, if two records with the same name are present they will also be sorted by salary if given the sort configs\n     * above. Any number of sort configs can be added.\n     * @param {String/Array} fieldName The name of the field to sort by, or an array of ordered sort configs\n     * @param {String} dir (optional) The sort order, 'ASC' or 'DESC' (case-sensitive, defaults to <tt>'ASC'</tt>)\n     */\n    sort : function(fieldName, dir) {\n        if (Ext.isArray(arguments[0])) {\n            return this.multiSort.call(this, fieldName, dir);\n        } else {\n            return this.singleSort(fieldName, dir);\n        }\n    },\n\n    /**\n     * Sorts the store contents by a single field and direction. This is called internally by {@link sort} and would\n     * not usually be called manually\n     * @param {String} fieldName The name of the field to sort by.\n     * @param {String} dir (optional) The sort order, 'ASC' or 'DESC' (case-sensitive, defaults to <tt>'ASC'</tt>)\n     */\n    singleSort: function(fieldName, dir) {\n        var field = this.fields.get(fieldName);\n        if (!field) {\n            return false;\n        }\n\n        var name       = field.name,\n            sortInfo   = this.sortInfo || null,\n            sortToggle = this.sortToggle ? this.sortToggle[name] : null;\n\n        if (!dir) {\n            if (sortInfo && sortInfo.field == name) { // toggle sort dir\n                dir = (this.sortToggle[name] || 'ASC').toggle('ASC', 'DESC');\n            } else {\n                dir = field.sortDir;\n            }\n        }\n\n        this.sortToggle[name] = dir;\n        this.sortInfo = {field: name, direction: dir};\n        this.hasMultiSort = false;\n\n        if (this.remoteSort) {\n            if (!this.load(this.lastOptions)) {\n                if (sortToggle) {\n                    this.sortToggle[name] = sortToggle;\n                }\n                if (sortInfo) {\n                    this.sortInfo = sortInfo;\n                }\n            }\n        } else {\n            this.applySort();\n            this.fireEvent('datachanged', this);\n        }\n        return true;\n    },\n\n    /**\n     * Sorts the contents of this store by multiple field/direction sorters. This is called internally by {@link sort}\n     * and would not usually be called manually.\n     * Multi sorting only currently applies to local datasets - multiple sort data is not currently sent to a proxy\n     * if remoteSort is used.\n     * @param {Array} sorters Array of sorter objects (field and direction)\n     * @param {String} direction Overall direction to sort the ordered results by (defaults to \"ASC\")\n     */\n    multiSort: function(sorters, direction) {\n        this.hasMultiSort = true;\n        direction = direction || \"ASC\";\n\n        //toggle sort direction\n        if (this.multiSortInfo && direction == this.multiSortInfo.direction) {\n            direction = direction.toggle(\"ASC\", \"DESC\");\n        }\n\n        /**\n         * Object containing overall sort direction and an ordered array of sorter configs used when sorting on multiple fields\n         * @property multiSortInfo\n         * @type Object\n         */\n        this.multiSortInfo = {\n            sorters  : sorters,\n            direction: direction\n        };\n\n        if (this.remoteSort) {\n            this.singleSort(sorters[0].field, sorters[0].direction);\n\n        } else {\n            this.applySort();\n            this.fireEvent('datachanged', this);\n        }\n    },\n\n    /**\n     * Calls the specified function for each of the {@link Ext.data.Record Records} in the cache.\n     * @param {Function} fn The function to call. The {@link Ext.data.Record Record} is passed as the first parameter.\n     * Returning <tt>false</tt> aborts and exits the iteration.\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed.\n     * Defaults to the current {@link Ext.data.Record Record} in the iteration.\n     */\n    each : function(fn, scope){\n        this.data.each(fn, scope);\n    },\n\n    /**\n     * Gets all {@link Ext.data.Record records} modified since the last commit.  Modified records are\n     * persisted across load operations (e.g., during paging). <b>Note</b>: deleted records are not\n     * included.  See also <tt>{@link #pruneModifiedRecords}</tt> and\n     * {@link Ext.data.Record}<tt>{@link Ext.data.Record#markDirty markDirty}.</tt>.\n     * @return {Ext.data.Record[]} An array of {@link Ext.data.Record Records} containing outstanding\n     * modifications.  To obtain modified fields within a modified record see\n     *{@link Ext.data.Record}<tt>{@link Ext.data.Record#modified modified}.</tt>.\n     */\n    getModifiedRecords : function(){\n        return this.modified;\n    },\n\n    /**\n     * Sums the value of <tt>property</tt> for each {@link Ext.data.Record record} between <tt>start</tt>\n     * and <tt>end</tt> and returns the result.\n     * @param {String} property A field in each record\n     * @param {Number} start (optional) The record index to start at (defaults to <tt>0</tt>)\n     * @param {Number} end (optional) The last record index to include (defaults to length - 1)\n     * @return {Number} The sum\n     */\n    sum : function(property, start, end){\n        var rs = this.data.items, v = 0;\n        start = start || 0;\n        end = (end || end === 0) ? end : rs.length-1;\n\n        for(var i = start; i <= end; i++){\n            v += (rs[i].data[property] || 0);\n        }\n        return v;\n    },\n\n    /**\n     * @private\n     * Returns a filter function used to test a the given property's value. Defers most of the work to\n     * Ext.util.MixedCollection's createValueMatcher function\n     * @param {String} property The property to create the filter function for\n     * @param {String/RegExp} value The string/regex to compare the property value to\n     * @param {Boolean} anyMatch True if we don't care if the filter value is not the full value (defaults to false)\n     * @param {Boolean} caseSensitive True to create a case-sensitive regex (defaults to false)\n     * @param {Boolean} exactMatch True to force exact match (^ and $ characters added to the regex). Defaults to false. Ignored if anyMatch is true.\n     */\n    createFilterFn : function(property, value, anyMatch, caseSensitive, exactMatch){\n        if(Ext.isEmpty(value, false)){\n            return false;\n        }\n        value = this.data.createValueMatcher(value, anyMatch, caseSensitive, exactMatch);\n        return function(r) {\n            return value.test(r.data[property]);\n        };\n    },\n\n    /**\n     * @private\n     * Given an array of filter functions (each with optional scope), constructs and returns a single function that returns\n     * the result of all of the filters ANDed together\n     * @param {Array} filters The array of filter objects (each object should contain an 'fn' and optional scope)\n     * @return {Function} The multiple filter function\n     */\n    createMultipleFilterFn: function(filters) {\n        return function(record) {\n            var isMatch = true;\n\n            for (var i=0, j = filters.length; i < j; i++) {\n                var filter = filters[i],\n                    fn     = filter.fn,\n                    scope  = filter.scope;\n\n                isMatch = isMatch && fn.call(scope, record);\n            }\n\n            return isMatch;\n        };\n    },\n\n    /**\n     * Filter the {@link Ext.data.Record records} by a specified property. Alternatively, pass an array of filter\n     * options to filter by more than one property.\n     * Single filter example:\n     * store.filter('name', 'Ed', true, true); //finds all records containing the substring 'Ed'\n     * Multiple filter example:\n     * <pre><code>\n     * store.filter([\n     *   {\n     *     property     : 'name',\n     *     value        : 'Ed',\n     *     anyMatch     : true, //optional, defaults to true\n     *     caseSensitive: true  //optional, defaults to true\n     *   },\n     *\n     *   //filter functions can also be passed\n     *   {\n     *     fn   : function(record) {\n     *       return record.get('age') == 24\n     *     },\n     *     scope: this\n     *   }\n     * ]);\n     * </code></pre>\n     * @param {String|Array} field A field on your records, or an array containing multiple filter options\n     * @param {String/RegExp} value Either a string that the field should begin with, or a RegExp to test\n     * against the field.\n     * @param {Boolean} anyMatch (optional) <tt>true</tt> to match any part not just the beginning\n     * @param {Boolean} caseSensitive (optional) <tt>true</tt> for case sensitive comparison\n     * @param {Boolean} exactMatch (optional) True to force exact match (^ and $ characters added to the regex). Defaults to false. Ignored if anyMatch is true.\n     */\n    filter : function(property, value, anyMatch, caseSensitive, exactMatch){\n        var fn;\n        //we can accept an array of filter objects, or a single filter object - normalize them here\n        if (Ext.isObject(property)) {\n            property = [property];\n        }\n\n        if (Ext.isArray(property)) {\n            var filters = [];\n\n            //normalize the filters passed into an array of filter functions\n            for (var i=0, j = property.length; i < j; i++) {\n                var filter = property[i],\n                    func   = filter.fn,\n                    scope  = filter.scope || this;\n\n                //if we weren't given a filter function, construct one now\n                if (!Ext.isFunction(func)) {\n                    func = this.createFilterFn(filter.property, filter.value, filter.anyMatch, filter.caseSensitive, filter.exactMatch);\n                }\n\n                filters.push({fn: func, scope: scope});\n            }\n\n            fn = this.createMultipleFilterFn(filters);\n        } else {\n            //classic single property filter\n            fn = this.createFilterFn(property, value, anyMatch, caseSensitive, exactMatch);\n        }\n\n        return fn ? this.filterBy(fn) : this.clearFilter();\n    },\n\n    /**\n     * Filter by a function. The specified function will be called for each\n     * Record in this Store. If the function returns <tt>true</tt> the Record is included,\n     * otherwise it is filtered out.\n     * @param {Function} fn The function to be called. It will be passed the following parameters:<ul>\n     * <li><b>record</b> : Ext.data.Record<p class=\"sub-desc\">The {@link Ext.data.Record record}\n     * to test for filtering. Access field values using {@link Ext.data.Record#get}.</p></li>\n     * <li><b>id</b> : Object<p class=\"sub-desc\">The ID of the Record passed.</p></li>\n     * </ul>\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to this Store.\n     */\n    filterBy : function(fn, scope){\n        this.snapshot = this.snapshot || this.data;\n        this.data = this.queryBy(fn, scope || this);\n        this.fireEvent('datachanged', this);\n    },\n\n    /**\n     * Revert to a view of the Record cache with no filtering applied.\n     * @param {Boolean} suppressEvent If <tt>true</tt> the filter is cleared silently without firing the\n     * {@link #datachanged} event.\n     */\n    clearFilter : function(suppressEvent){\n        if(this.isFiltered()){\n            this.data = this.snapshot;\n            delete this.snapshot;\n            if(suppressEvent !== true){\n                this.fireEvent('datachanged', this);\n            }\n        }\n    },\n\n    /**\n     * Returns true if this store is currently filtered\n     * @return {Boolean}\n     */\n    isFiltered : function(){\n        return !!this.snapshot && this.snapshot != this.data;\n    },\n\n    /**\n     * Query the records by a specified property.\n     * @param {String} field A field on your records\n     * @param {String/RegExp} value Either a string that the field\n     * should begin with, or a RegExp to test against the field.\n     * @param {Boolean} anyMatch (optional) True to match any part not just the beginning\n     * @param {Boolean} caseSensitive (optional) True for case sensitive comparison\n     * @return {MixedCollection} Returns an Ext.util.MixedCollection of the matched records\n     */\n    query : function(property, value, anyMatch, caseSensitive){\n        var fn = this.createFilterFn(property, value, anyMatch, caseSensitive);\n        return fn ? this.queryBy(fn) : this.data.clone();\n    },\n\n    /**\n     * Query the cached records in this Store using a filtering function. The specified function\n     * will be called with each record in this Store. If the function returns <tt>true</tt> the record is\n     * included in the results.\n     * @param {Function} fn The function to be called. It will be passed the following parameters:<ul>\n     * <li><b>record</b> : Ext.data.Record<p class=\"sub-desc\">The {@link Ext.data.Record record}\n     * to test for filtering. Access field values using {@link Ext.data.Record#get}.</p></li>\n     * <li><b>id</b> : Object<p class=\"sub-desc\">The ID of the Record passed.</p></li>\n     * </ul>\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to this Store.\n     * @return {MixedCollection} Returns an Ext.util.MixedCollection of the matched records\n     **/\n    queryBy : function(fn, scope){\n        var data = this.snapshot || this.data;\n        return data.filterBy(fn, scope||this);\n    },\n\n    /**\n     * Finds the index of the first matching Record in this store by a specific field value.\n     * @param {String} fieldName The name of the Record field to test.\n     * @param {String/RegExp} value Either a string that the field value\n     * should begin with, or a RegExp to test against the field.\n     * @param {Number} startIndex (optional) The index to start searching at\n     * @param {Boolean} anyMatch (optional) True to match any part of the string, not just the beginning\n     * @param {Boolean} caseSensitive (optional) True for case sensitive comparison\n     * @return {Number} The matched index or -1\n     */\n    find : function(property, value, start, anyMatch, caseSensitive){\n        var fn = this.createFilterFn(property, value, anyMatch, caseSensitive);\n        return fn ? this.data.findIndexBy(fn, null, start) : -1;\n    },\n\n    /**\n     * Finds the index of the first matching Record in this store by a specific field value.\n     * @param {String} fieldName The name of the Record field to test.\n     * @param {Mixed} value The value to match the field against.\n     * @param {Number} startIndex (optional) The index to start searching at\n     * @return {Number} The matched index or -1\n     */\n    findExact: function(property, value, start){\n        return this.data.findIndexBy(function(rec){\n            return rec.get(property) === value;\n        }, this, start);\n    },\n\n    /**\n     * Find the index of the first matching Record in this Store by a function.\n     * If the function returns <tt>true</tt> it is considered a match.\n     * @param {Function} fn The function to be called. It will be passed the following parameters:<ul>\n     * <li><b>record</b> : Ext.data.Record<p class=\"sub-desc\">The {@link Ext.data.Record record}\n     * to test for filtering. Access field values using {@link Ext.data.Record#get}.</p></li>\n     * <li><b>id</b> : Object<p class=\"sub-desc\">The ID of the Record passed.</p></li>\n     * </ul>\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to this Store.\n     * @param {Number} startIndex (optional) The index to start searching at\n     * @return {Number} The matched index or -1\n     */\n    findBy : function(fn, scope, start){\n        return this.data.findIndexBy(fn, scope, start);\n    },\n\n    /**\n     * Collects unique values for a particular dataIndex from this store.\n     * @param {String} dataIndex The property to collect\n     * @param {Boolean} allowNull (optional) Pass true to allow null, undefined or empty string values\n     * @param {Boolean} bypassFilter (optional) Pass true to collect from all records, even ones which are filtered\n     * @return {Array} An array of the unique values\n     **/\n    collect : function(dataIndex, allowNull, bypassFilter){\n        var d = (bypassFilter === true && this.snapshot) ?\n                this.snapshot.items : this.data.items;\n        var v, sv, r = [], l = {};\n        for(var i = 0, len = d.length; i < len; i++){\n            v = d[i].data[dataIndex];\n            sv = String(v);\n            if((allowNull || !Ext.isEmpty(v)) && !l[sv]){\n                l[sv] = true;\n                r[r.length] = v;\n            }\n        }\n        return r;\n    },\n\n    // private\n    afterEdit : function(record){\n        if(this.modified.indexOf(record) == -1){\n            this.modified.push(record);\n        }\n        this.fireEvent('update', this, record, Ext.data.Record.EDIT);\n    },\n\n    // private\n    afterReject : function(record){\n        this.modified.remove(record);\n        this.fireEvent('update', this, record, Ext.data.Record.REJECT);\n    },\n\n    // private\n    afterCommit : function(record){\n        this.modified.remove(record);\n        this.fireEvent('update', this, record, Ext.data.Record.COMMIT);\n    },\n\n    /**\n     * Commit all Records with {@link #getModifiedRecords outstanding changes}. To handle updates for changes,\n     * subscribe to the Store's {@link #update update event}, and perform updating when the third parameter is\n     * Ext.data.Record.COMMIT.\n     */\n    commitChanges : function(){\n        var modified = this.modified.slice(0),\n            length   = modified.length,\n            i;\n\n        for (i = 0; i < length; i++){\n            modified[i].commit();\n        }\n\n        this.modified = [];\n        this.removed  = [];\n    },\n\n    /**\n     * {@link Ext.data.Record#reject Reject} outstanding changes on all {@link #getModifiedRecords modified records}.\n     */\n    rejectChanges : function() {\n        var modified = this.modified.slice(0),\n            removed  = this.removed.slice(0).reverse(),\n            mLength  = modified.length,\n            rLength  = removed.length,\n            i;\n\n        for (i = 0; i < mLength; i++) {\n            modified[i].reject();\n        }\n\n        for (i = 0; i < rLength; i++) {\n            this.insert(removed[i].lastIndex || 0, removed[i]);\n            removed[i].reject();\n        }\n\n        this.modified = [];\n        this.removed  = [];\n    },\n\n    // private\n    onMetaChange : function(meta){\n        this.recordType = this.reader.recordType;\n        this.fields = this.recordType.prototype.fields;\n        delete this.snapshot;\n        if(this.reader.meta.sortInfo){\n            this.sortInfo = this.reader.meta.sortInfo;\n        }else if(this.sortInfo  && !this.fields.get(this.sortInfo.field)){\n            delete this.sortInfo;\n        }\n        if(this.writer){\n            this.writer.meta = this.reader.meta;\n        }\n        this.modified = [];\n        this.fireEvent('metachange', this, this.reader.meta);\n    },\n\n    // private\n    findInsertIndex : function(record){\n        this.suspendEvents();\n        var data = this.data.clone();\n        this.data.add(record);\n        this.applySort();\n        var index = this.data.indexOf(record);\n        this.data = data;\n        this.resumeEvents();\n        return index;\n    },\n\n    /**\n     * Set the value for a property name in this store's {@link #baseParams}.  Usage:</p><pre><code>\nmyStore.setBaseParam('foo', {bar:3});\n</code></pre>\n     * @param {String} name Name of the property to assign\n     * @param {Mixed} value Value to assign the <tt>name</tt>d property\n     **/\n    setBaseParam : function (name, value){\n        this.baseParams = this.baseParams || {};\n        this.baseParams[name] = value;\n    }\n});\n\nExt.reg('store', Ext.data.Store);\n\n/**\n * @class Ext.data.Store.Error\n * @extends Ext.Error\n * Store Error extension.\n * @param {String} name\n */\nExt.data.Store.Error = Ext.extend(Ext.Error, {\n    name: 'Ext.data.Store'\n});\nExt.apply(Ext.data.Store.Error.prototype, {\n    lang: {\n        'writer-undefined' : 'Attempted to execute a write-action without a DataWriter installed.'\n    }\n});\n/**\n * @class Ext.data.Field\n * <p>This class encapsulates the field definition information specified in the field definition objects\n * passed to {@link Ext.data.Record#create}.</p>\n * <p>Developers do not need to instantiate this class. Instances are created by {@link Ext.data.Record.create}\n * and cached in the {@link Ext.data.Record#fields fields} property of the created Record constructor's <b>prototype.</b></p>\n */\nExt.data.Field = Ext.extend(Object, {\n    \n    constructor : function(config){\n        if(Ext.isString(config)){\n            config = {name: config};\n        }\n        Ext.apply(this, config);\n        \n        var types = Ext.data.Types,\n            st = this.sortType,\n            t;\n\n        if(this.type){\n            if(Ext.isString(this.type)){\n                this.type = Ext.data.Types[this.type.toUpperCase()] || types.AUTO;\n            }\n        }else{\n            this.type = types.AUTO;\n        }\n\n        // named sortTypes are supported, here we look them up\n        if(Ext.isString(st)){\n            this.sortType = Ext.data.SortTypes[st];\n        }else if(Ext.isEmpty(st)){\n            this.sortType = this.type.sortType;\n        }\n\n        if(!this.convert){\n            this.convert = this.type.convert;\n        }\n    },\n    \n    /**\n     * @cfg {String} name\n     * The name by which the field is referenced within the Record. This is referenced by, for example,\n     * the <code>dataIndex</code> property in column definition objects passed to {@link Ext.grid.ColumnModel}.\n     * <p>Note: In the simplest case, if no properties other than <code>name</code> are required, a field\n     * definition may consist of just a String for the field name.</p>\n     */\n    /**\n     * @cfg {Mixed} type\n     * (Optional) The data type for automatic conversion from received data to the <i>stored</i> value if <code>{@link Ext.data.Field#convert convert}</code>\n     * has not been specified. This may be specified as a string value. Possible values are\n     * <div class=\"mdetail-params\"><ul>\n     * <li>auto (Default, implies no conversion)</li>\n     * <li>string</li>\n     * <li>int</li>\n     * <li>float</li>\n     * <li>boolean</li>\n     * <li>date</li></ul></div>\n     * <p>This may also be specified by referencing a member of the {@link Ext.data.Types} class.</p>\n     * <p>Developers may create their own application-specific data types by defining new members of the\n     * {@link Ext.data.Types} class.</p>\n     */\n    /**\n     * @cfg {Function} convert\n     * (Optional) A function which converts the value provided by the Reader into an object that will be stored\n     * in the Record. It is passed the following parameters:<div class=\"mdetail-params\"><ul>\n     * <li><b>v</b> : Mixed<div class=\"sub-desc\">The data value as read by the Reader, if undefined will use\n     * the configured <code>{@link Ext.data.Field#defaultValue defaultValue}</code>.</div></li>\n     * <li><b>rec</b> : Mixed<div class=\"sub-desc\">The data object containing the row as read by the Reader.\n     * Depending on the Reader type, this could be an Array ({@link Ext.data.ArrayReader ArrayReader}), an object\n     *  ({@link Ext.data.JsonReader JsonReader}), or an XML element ({@link Ext.data.XMLReader XMLReader}).</div></li>\n     * </ul></div>\n     * <pre><code>\n// example of convert function\nfunction fullName(v, record){\n    return record.name.last + ', ' + record.name.first;\n}\n\nfunction location(v, record){\n    return !record.city ? '' : (record.city + ', ' + record.state);\n}\n\nvar Dude = Ext.data.Record.create([\n    {name: 'fullname',  convert: fullName},\n    {name: 'firstname', mapping: 'name.first'},\n    {name: 'lastname',  mapping: 'name.last'},\n    {name: 'city', defaultValue: 'homeless'},\n    'state',\n    {name: 'location',  convert: location}\n]);\n\n// create the data store\nvar store = new Ext.data.Store({\n    reader: new Ext.data.JsonReader(\n        {\n            idProperty: 'key',\n            root: 'daRoot',\n            totalProperty: 'total'\n        },\n        Dude  // recordType\n    )\n});\n\nvar myData = [\n    { key: 1,\n      name: { first: 'Fat',    last:  'Albert' }\n      // notice no city, state provided in data object\n    },\n    { key: 2,\n      name: { first: 'Barney', last:  'Rubble' },\n      city: 'Bedrock', state: 'Stoneridge'\n    },\n    { key: 3,\n      name: { first: 'Cliff',  last:  'Claven' },\n      city: 'Boston',  state: 'MA'\n    }\n];\n     * </code></pre>\n     */\n    /**\n     * @cfg {String} dateFormat\n     * <p>(Optional) Used when converting received data into a Date when the {@link #type} is specified as <code>\"date\"</code>.</p>\n     * <p>A format string for the {@link Date#parseDate Date.parseDate} function, or \"timestamp\" if the\n     * value provided by the Reader is a UNIX timestamp, or \"time\" if the value provided by the Reader is a\n     * javascript millisecond timestamp. See {@link Date}</p>\n     */\n    dateFormat: null,\n    \n    /**\n     * @cfg {Boolean} useNull\n     * <p>(Optional) Use when converting received data into a Number type (either int or float). If the value cannot be parsed,\n     * null will be used if useNull is true, otherwise the value will be 0. Defaults to <tt>false</tt>\n     */\n    useNull: false,\n    \n    /**\n     * @cfg {Mixed} defaultValue\n     * (Optional) The default value used <b>when a Record is being created by a {@link Ext.data.Reader Reader}</b>\n     * when the item referenced by the <code>{@link Ext.data.Field#mapping mapping}</code> does not exist in the data\n     * object (i.e. undefined). (defaults to \"\")\n     */\n    defaultValue: \"\",\n    /**\n     * @cfg {String/Number} mapping\n     * <p>(Optional) A path expression for use by the {@link Ext.data.DataReader} implementation\n     * that is creating the {@link Ext.data.Record Record} to extract the Field value from the data object.\n     * If the path expression is the same as the field name, the mapping may be omitted.</p>\n     * <p>The form of the mapping expression depends on the Reader being used.</p>\n     * <div class=\"mdetail-params\"><ul>\n     * <li>{@link Ext.data.JsonReader}<div class=\"sub-desc\">The mapping is a string containing the javascript\n     * expression to reference the data from an element of the data item's {@link Ext.data.JsonReader#root root} Array. Defaults to the field name.</div></li>\n     * <li>{@link Ext.data.XmlReader}<div class=\"sub-desc\">The mapping is an {@link Ext.DomQuery} path to the data\n     * item relative to the DOM element that represents the {@link Ext.data.XmlReader#record record}. Defaults to the field name.</div></li>\n     * <li>{@link Ext.data.ArrayReader}<div class=\"sub-desc\">The mapping is a number indicating the Array index\n     * of the field's value. Defaults to the field specification's Array position.</div></li>\n     * </ul></div>\n     * <p>If a more complex value extraction strategy is required, then configure the Field with a {@link #convert}\n     * function. This is passed the whole row object, and may interrogate it in whatever way is necessary in order to\n     * return the desired data.</p>\n     */\n    mapping: null,\n    /**\n     * @cfg {Function} sortType\n     * (Optional) A function which converts a Field's value to a comparable value in order to ensure\n     * correct sort ordering. Predefined functions are provided in {@link Ext.data.SortTypes}. A custom\n     * sort example:<pre><code>\n// current sort     after sort we want\n// +-+------+          +-+------+\n// |1|First |          |1|First |\n// |2|Last  |          |3|Second|\n// |3|Second|          |2|Last  |\n// +-+------+          +-+------+\n\nsortType: function(value) {\n   switch (value.toLowerCase()) // native toLowerCase():\n   {\n      case 'first': return 1;\n      case 'second': return 2;\n      default: return 3;\n   }\n}\n     * </code></pre>\n     */\n    sortType : null,\n    /**\n     * @cfg {String} sortDir\n     * (Optional) Initial direction to sort (<code>\"ASC\"</code> or  <code>\"DESC\"</code>).  Defaults to\n     * <code>\"ASC\"</code>.\n     */\n    sortDir : \"ASC\",\n    /**\n     * @cfg {Boolean} allowBlank\n     * (Optional) Used for validating a {@link Ext.data.Record record}, defaults to <code>true</code>.\n     * An empty value here will cause {@link Ext.data.Record}.{@link Ext.data.Record#isValid isValid}\n     * to evaluate to <code>false</code>.\n     */\n    allowBlank : true\n});\n/**\n * @class Ext.data.DataReader\n * Abstract base class for reading structured data from a data source and converting\n * it into an object containing {@link Ext.data.Record} objects and metadata for use\n * by an {@link Ext.data.Store}.  This class is intended to be extended and should not\n * be created directly. For existing implementations, see {@link Ext.data.ArrayReader},\n * {@link Ext.data.JsonReader} and {@link Ext.data.XmlReader}.\n * @constructor Create a new DataReader\n * @param {Object} meta Metadata configuration options (implementation-specific).\n * @param {Array/Object} recordType\n * <p>Either an Array of {@link Ext.data.Field Field} definition objects (which\n * will be passed to {@link Ext.data.Record#create}, or a {@link Ext.data.Record Record}\n * constructor created using {@link Ext.data.Record#create}.</p>\n */\nExt.data.DataReader = function(meta, recordType){\n    /**\n     * This DataReader's configured metadata as passed to the constructor.\n     * @type Mixed\n     * @property meta\n     */\n    this.meta = meta;\n    /**\n     * @cfg {Array/Object} fields\n     * <p>Either an Array of {@link Ext.data.Field Field} definition objects (which\n     * will be passed to {@link Ext.data.Record#create}, or a {@link Ext.data.Record Record}\n     * constructor created from {@link Ext.data.Record#create}.</p>\n     */\n    this.recordType = Ext.isArray(recordType) ?\n        Ext.data.Record.create(recordType) : recordType;\n\n    // if recordType defined make sure extraction functions are defined\n    if (this.recordType){\n        this.buildExtractors();\n    }\n};\n\nExt.data.DataReader.prototype = {\n    /**\n     * @cfg {String} messageProperty [undefined] Optional name of a property within a server-response that represents a user-feedback message.\n     */\n    /**\n     * Abstract method created in extension's buildExtractors impl.\n     */\n    getTotal: Ext.emptyFn,\n    /**\n     * Abstract method created in extension's buildExtractors impl.\n     */\n    getRoot: Ext.emptyFn,\n    /**\n     * Abstract method created in extension's buildExtractors impl.\n     */\n    getMessage: Ext.emptyFn,\n    /**\n     * Abstract method created in extension's buildExtractors impl.\n     */\n    getSuccess: Ext.emptyFn,\n    /**\n     * Abstract method created in extension's buildExtractors impl.\n     */\n    getId: Ext.emptyFn,\n    /**\n     * Abstract method, overridden in DataReader extensions such as {@link Ext.data.JsonReader} and {@link Ext.data.XmlReader}\n     */\n    buildExtractors : Ext.emptyFn,\n    /**\n     * Abstract method overridden in DataReader extensions such as {@link Ext.data.JsonReader} and {@link Ext.data.XmlReader}\n     */\n    extractValues : Ext.emptyFn,\n\n    /**\n     * Used for un-phantoming a record after a successful database insert.  Sets the records pk along with new data from server.\n     * You <b>must</b> return at least the database pk using the idProperty defined in your DataReader configuration.  The incoming\n     * data from server will be merged with the data in the local record.\n     * In addition, you <b>must</b> return record-data from the server in the same order received.\n     * Will perform a commit as well, un-marking dirty-fields.  Store's \"update\" event will be suppressed.\n     * @param {Record/Record[]} record The phantom record to be realized.\n     * @param {Object/Object[]} data The new record data to apply.  Must include the primary-key from database defined in idProperty field.\n     */\n    realize: function(rs, data){\n        if (Ext.isArray(rs)) {\n            for (var i = rs.length - 1; i >= 0; i--) {\n                // recurse\n                if (Ext.isArray(data)) {\n                    this.realize(rs.splice(i,1).shift(), data.splice(i,1).shift());\n                }\n                else {\n                    // weird...rs is an array but data isn't??  recurse but just send in the whole invalid data object.\n                    // the else clause below will detect !this.isData and throw exception.\n                    this.realize(rs.splice(i,1).shift(), data);\n                }\n            }\n        }\n        else {\n            // If rs is NOT an array but data IS, see if data contains just 1 record.  If so extract it and carry on.\n            if (Ext.isArray(data) && data.length == 1) {\n                data = data.shift();\n            }\n            if (!this.isData(data)) {\n                // TODO: Let exception-handler choose to commit or not rather than blindly rs.commit() here.\n                //rs.commit();\n                throw new Ext.data.DataReader.Error('realize', rs);\n            }\n            rs.phantom = false; // <-- That's what it's all about\n            rs._phid = rs.id;  // <-- copy phantom-id -> _phid, so we can remap in Store#onCreateRecords\n            rs.id = this.getId(data);\n            rs.data = data;\n\n            rs.commit();\n            rs.store.reMap(rs);\n        }\n    },\n\n    /**\n     * Used for updating a non-phantom or \"real\" record's data with fresh data from server after remote-save.\n     * If returning data from multiple-records after a batch-update, you <b>must</b> return record-data from the server in\n     * the same order received.  Will perform a commit as well, un-marking dirty-fields.  Store's \"update\" event will be\n     * suppressed as the record receives fresh new data-hash\n     * @param {Record/Record[]} rs\n     * @param {Object/Object[]} data\n     */\n    update : function(rs, data) {\n        if (Ext.isArray(rs)) {\n            for (var i=rs.length-1; i >= 0; i--) {\n                if (Ext.isArray(data)) {\n                    this.update(rs.splice(i,1).shift(), data.splice(i,1).shift());\n                }\n                else {\n                    // weird...rs is an array but data isn't??  recurse but just send in the whole data object.\n                    // the else clause below will detect !this.isData and throw exception.\n                    this.update(rs.splice(i,1).shift(), data);\n                }\n            }\n        }\n        else {\n            // If rs is NOT an array but data IS, see if data contains just 1 record.  If so extract it and carry on.\n            if (Ext.isArray(data) && data.length == 1) {\n                data = data.shift();\n            }\n            if (this.isData(data)) {\n                rs.data = Ext.apply(rs.data, data);\n            }\n            rs.commit();\n        }\n    },\n\n    /**\n     * returns extracted, type-cast rows of data.  Iterates to call #extractValues for each row\n     * @param {Object[]/Object} data-root from server response\n     * @param {Boolean} returnRecords [false] Set true to return instances of Ext.data.Record\n     * @private\n     */\n    extractData : function(root, returnRecords) {\n        // A bit ugly this, too bad the Record's raw data couldn't be saved in a common property named \"raw\" or something.\n        var rawName = (this instanceof Ext.data.JsonReader) ? 'json' : 'node';\n\n        var rs = [];\n\n        // Had to add Check for XmlReader, #isData returns true if root is an Xml-object.  Want to check in order to re-factor\n        // #extractData into DataReader base, since the implementations are almost identical for JsonReader, XmlReader\n        if (this.isData(root) && !(this instanceof Ext.data.XmlReader)) {\n            root = [root];\n        }\n        var f       = this.recordType.prototype.fields,\n            fi      = f.items,\n            fl      = f.length,\n            rs      = [];\n        if (returnRecords === true) {\n            var Record = this.recordType;\n            for (var i = 0; i < root.length; i++) {\n                var n = root[i];\n                var record = new Record(this.extractValues(n, fi, fl), this.getId(n));\n                record[rawName] = n;    // <-- There's implementation of ugly bit, setting the raw record-data.\n                rs.push(record);\n            }\n        }\n        else {\n            for (var i = 0; i < root.length; i++) {\n                var data = this.extractValues(root[i], fi, fl);\n                data[this.meta.idProperty] = this.getId(root[i]);\n                rs.push(data);\n            }\n        }\n        return rs;\n    },\n\n    /**\n     * Returns true if the supplied data-hash <b>looks</b> and quacks like data.  Checks to see if it has a key\n     * corresponding to idProperty defined in your DataReader config containing non-empty pk.\n     * @param {Object} data\n     * @return {Boolean}\n     */\n    isData : function(data) {\n        return (data && Ext.isObject(data) && !Ext.isEmpty(this.getId(data))) ? true : false;\n    },\n\n    // private function a store will createSequence upon\n    onMetaChange : function(meta){\n        delete this.ef;\n        this.meta = meta;\n        this.recordType = Ext.data.Record.create(meta.fields);\n        this.buildExtractors();\n    }\n};\n\n/**\n * @class Ext.data.DataReader.Error\n * @extends Ext.Error\n * General error class for Ext.data.DataReader\n */\nExt.data.DataReader.Error = Ext.extend(Ext.Error, {\n    constructor : function(message, arg) {\n        this.arg = arg;\n        Ext.Error.call(this, message);\n    },\n    name: 'Ext.data.DataReader'\n});\nExt.apply(Ext.data.DataReader.Error.prototype, {\n    lang : {\n        'update': \"#update received invalid data from server.  Please see docs for DataReader#update and review your DataReader configuration.\",\n        'realize': \"#realize was called with invalid remote-data.  Please see the docs for DataReader#realize and review your DataReader configuration.\",\n        'invalid-response': \"#readResponse received an invalid response from the server.\"\n    }\n});\n/**\n * @class Ext.data.DataWriter\n * <p>Ext.data.DataWriter facilitates create, update, and destroy actions between\n * an Ext.data.Store and a server-side framework. A Writer enabled Store will\n * automatically manage the Ajax requests to perform CRUD actions on a Store.</p>\n * <p>Ext.data.DataWriter is an abstract base class which is intended to be extended\n * and should not be created directly. For existing implementations, see\n * {@link Ext.data.JsonWriter}.</p>\n * <p>Creating a writer is simple:</p>\n * <pre><code>\nvar writer = new Ext.data.JsonWriter({\n    encode: false   // &lt;--- false causes data to be printed to jsonData config-property of Ext.Ajax#reqeust\n});\n * </code></pre>\n * * <p>Same old JsonReader as Ext-2.x:</p>\n * <pre><code>\nvar reader = new Ext.data.JsonReader({idProperty: 'id'}, [{name: 'first'}, {name: 'last'}, {name: 'email'}]);\n * </code></pre>\n *\n * <p>The proxy for a writer enabled store can be configured with a simple <code>url</code>:</p>\n * <pre><code>\n// Create a standard HttpProxy instance.\nvar proxy = new Ext.data.HttpProxy({\n    url: 'app.php/users'    // &lt;--- Supports \"provides\"-type urls, such as '/users.json', '/products.xml' (Hello Rails/Merb)\n});\n * </code></pre>\n * <p>For finer grained control, the proxy may also be configured with an <code>API</code>:</p>\n * <pre><code>\n// Maximum flexibility with the API-configuration\nvar proxy = new Ext.data.HttpProxy({\n    api: {\n        read    : 'app.php/users/read',\n        create  : 'app.php/users/create',\n        update  : 'app.php/users/update',\n        destroy : {  // &lt;--- Supports object-syntax as well\n            url: 'app.php/users/destroy',\n            method: \"DELETE\"\n        }\n    }\n});\n * </code></pre>\n * <p>Pulling it all together into a Writer-enabled Store:</p>\n * <pre><code>\nvar store = new Ext.data.Store({\n    proxy: proxy,\n    reader: reader,\n    writer: writer,\n    autoLoad: true,\n    autoSave: true  // -- Cell-level updates.\n});\n * </code></pre>\n * <p>Initiating write-actions <b>automatically</b>, using the existing Ext2.0 Store/Record API:</p>\n * <pre><code>\nvar rec = store.getAt(0);\nrec.set('email', 'foo@bar.com');  // &lt;--- Immediately initiates an UPDATE action through configured proxy.\n\nstore.remove(rec);  // &lt;---- Immediately initiates a DESTROY action through configured proxy.\n * </code></pre>\n * <p>For <b>record/batch</b> updates, use the Store-configuration {@link Ext.data.Store#autoSave autoSave:false}</p>\n * <pre><code>\nvar store = new Ext.data.Store({\n    proxy: proxy,\n    reader: reader,\n    writer: writer,\n    autoLoad: true,\n    autoSave: false  // -- disable cell-updates\n});\n\nvar urec = store.getAt(0);\nurec.set('email', 'foo@bar.com');\n\nvar drec = store.getAt(1);\nstore.remove(drec);\n\n// Push the button!\nstore.save();\n * </code></pre>\n * @constructor Create a new DataWriter\n * @param {Object} meta Metadata configuration options (implementation-specific)\n * @param {Object} recordType Either an Array of field definition objects as specified\n * in {@link Ext.data.Record#create}, or an {@link Ext.data.Record} object created\n * using {@link Ext.data.Record#create}.\n */\nExt.data.DataWriter = function(config){\n    Ext.apply(this, config);\n};\nExt.data.DataWriter.prototype = {\n\n    /**\n     * @cfg {Boolean} writeAllFields\n     * <tt>false</tt> by default.  Set <tt>true</tt> to have DataWriter return ALL fields of a modified\n     * record -- not just those that changed.\n     * <tt>false</tt> to have DataWriter only request modified fields from a record.\n     */\n    writeAllFields : false,\n    /**\n     * @cfg {Boolean} listful\n     * <tt>false</tt> by default.  Set <tt>true</tt> to have the DataWriter <b>always</b> write HTTP params as a list,\n     * even when acting upon a single record.\n     */\n    listful : false,    // <-- listful is actually not used internally here in DataWriter.  @see Ext.data.Store#execute.\n\n    /**\n     * Compiles a Store recordset into a data-format defined by an extension such as {@link Ext.data.JsonWriter} or {@link Ext.data.XmlWriter} in preparation for a {@link Ext.data.Api#actions server-write action}.  The first two params are similar similar in nature to {@link Ext#apply},\n     * Where the first parameter is the <i>receiver</i> of paramaters and the second, baseParams, <i>the source</i>.\n     * @param {Object} params The request-params receiver.\n     * @param {Object} baseParams as defined by {@link Ext.data.Store#baseParams}.  The baseParms must be encoded by the extending class, eg: {@link Ext.data.JsonWriter}, {@link Ext.data.XmlWriter}.\n     * @param {String} action [{@link Ext.data.Api#actions create|update|destroy}]\n     * @param {Record/Record[]} rs The recordset to write, the subject(s) of the write action.\n     */\n    apply : function(params, baseParams, action, rs) {\n        var data    = [],\n        renderer    = action + 'Record';\n        // TODO implement @cfg listful here\n        if (Ext.isArray(rs)) {\n            Ext.each(rs, function(rec){\n                data.push(this[renderer](rec));\n            }, this);\n        }\n        else if (rs instanceof Ext.data.Record) {\n            data = this[renderer](rs);\n        }\n        this.render(params, baseParams, data);\n    },\n\n    /**\n     * abstract method meant to be overridden by all DataWriter extensions.  It's the extension's job to apply the \"data\" to the \"params\".\n     * The data-object provided to render is populated with data according to the meta-info defined in the user's DataReader config,\n     * @param {String} action [Ext.data.Api.actions.create|read|update|destroy]\n     * @param {Record[]} rs Store recordset\n     * @param {Object} params Http params to be sent to server.\n     * @param {Object} data object populated according to DataReader meta-data.\n     */\n    render : Ext.emptyFn,\n\n    /**\n     * @cfg {Function} updateRecord Abstract method that should be implemented in all subclasses\n     * (e.g.: {@link Ext.data.JsonWriter#updateRecord JsonWriter.updateRecord}\n     */\n    updateRecord : Ext.emptyFn,\n\n    /**\n     * @cfg {Function} createRecord Abstract method that should be implemented in all subclasses\n     * (e.g.: {@link Ext.data.JsonWriter#createRecord JsonWriter.createRecord})\n     */\n    createRecord : Ext.emptyFn,\n\n    /**\n     * @cfg {Function} destroyRecord Abstract method that should be implemented in all subclasses\n     * (e.g.: {@link Ext.data.JsonWriter#destroyRecord JsonWriter.destroyRecord})\n     */\n    destroyRecord : Ext.emptyFn,\n\n    /**\n     * Converts a Record to a hash, taking into account the state of the Ext.data.Record along with configuration properties\n     * related to its rendering, such as {@link #writeAllFields}, {@link Ext.data.Record#phantom phantom}, {@link Ext.data.Record#getChanges getChanges} and\n     * {@link Ext.data.DataReader#idProperty idProperty}\n     * @param {Ext.data.Record} rec The Record from which to create a hash.\n     * @param {Object} config <b>NOT YET IMPLEMENTED</b>.  Will implement an exlude/only configuration for fine-control over which fields do/don't get rendered.\n     * @return {Object}\n     * @protected\n     * TODO Implement excludes/only configuration with 2nd param?\n     */\n    toHash : function(rec, config) {\n        var map = rec.fields.map,\n            data = {},\n            raw = (this.writeAllFields === false && rec.phantom === false) ? rec.getChanges() : rec.data,\n            m;\n        Ext.iterate(raw, function(prop, value){\n            if((m = map[prop])){\n                data[m.mapping ? m.mapping : m.name] = value;\n            }\n        });\n        // we don't want to write Ext auto-generated id to hash.  Careful not to remove it on Models not having auto-increment pk though.\n        // We can tell its not auto-increment if the user defined a DataReader field for it *and* that field's value is non-empty.\n        // we could also do a RegExp here for the Ext.data.Record AUTO_ID prefix.\n        if (rec.phantom) {\n            if (rec.fields.containsKey(this.meta.idProperty) && Ext.isEmpty(rec.data[this.meta.idProperty])) {\n                delete data[this.meta.idProperty];\n            }\n        } else {\n            data[this.meta.idProperty] = rec.id;\n        }\n        return data;\n    },\n\n    /**\n     * Converts a {@link Ext.data.DataWriter#toHash Hashed} {@link Ext.data.Record} to fields-array array suitable\n     * for encoding to xml via XTemplate, eg:\n<code><pre>&lt;tpl for=\".\">&lt;{name}>{value}&lt;/{name}&lt;/tpl></pre></code>\n     * eg, <b>non-phantom</b>:\n<code><pre>{id: 1, first: 'foo', last: 'bar'} --> [{name: 'id', value: 1}, {name: 'first', value: 'foo'}, {name: 'last', value: 'bar'}]</pre></code>\n     * {@link Ext.data.Record#phantom Phantom} records will have had their idProperty omitted in {@link #toHash} if determined to be auto-generated.\n     * Non AUTOINCREMENT pks should have been protected.\n     * @param {Hash} data Hashed by Ext.data.DataWriter#toHash\n     * @return {Object[]} Array of attribute-objects.\n     * @protected\n     */\n    toArray : function(data) {\n        var fields = [];\n        Ext.iterate(data, function(k, v) {fields.push({name: k, value: v});},this);\n        return fields;\n    }\n};/**\n * @class Ext.data.DataProxy\n * @extends Ext.util.Observable\n * <p>Abstract base class for implementations which provide retrieval of unformatted data objects.\n * This class is intended to be extended and should not be created directly. For existing implementations,\n * see {@link Ext.data.DirectProxy}, {@link Ext.data.HttpProxy}, {@link Ext.data.ScriptTagProxy} and\n * {@link Ext.data.MemoryProxy}.</p>\n * <p>DataProxy implementations are usually used in conjunction with an implementation of {@link Ext.data.DataReader}\n * (of the appropriate type which knows how to parse the data object) to provide a block of\n * {@link Ext.data.Records} to an {@link Ext.data.Store}.</p>\n * <p>The parameter to a DataProxy constructor may be an {@link Ext.data.Connection} or can also be the\n * config object to an {@link Ext.data.Connection}.</p>\n * <p>Custom implementations must implement either the <code><b>doRequest</b></code> method (preferred) or the\n * <code>load</code> method (deprecated). See\n * {@link Ext.data.HttpProxy}.{@link Ext.data.HttpProxy#doRequest doRequest} or\n * {@link Ext.data.HttpProxy}.{@link Ext.data.HttpProxy#load load} for additional details.</p>\n * <p><b><u>Example 1</u></b></p>\n * <pre><code>\nproxy: new Ext.data.ScriptTagProxy({\n    {@link Ext.data.Connection#url url}: 'http://extjs.com/forum/topics-remote.php'\n}),\n * </code></pre>\n * <p><b><u>Example 2</u></b></p>\n * <pre><code>\nproxy : new Ext.data.HttpProxy({\n    {@link Ext.data.Connection#method method}: 'GET',\n    {@link Ext.data.HttpProxy#prettyUrls prettyUrls}: false,\n    {@link Ext.data.Connection#url url}: 'local/default.php', // see options parameter for {@link Ext.Ajax#request}\n    {@link #api}: {\n        // all actions except the following will use above url\n        create  : 'local/new.php',\n        update  : 'local/update.php'\n    }\n}),\n * </code></pre>\n * <p>And <b>new in Ext version 3</b>, attach centralized event-listeners upon the DataProxy class itself!  This is a great place\n * to implement a <i>messaging system</i> to centralize your application's user-feedback and error-handling.</p>\n * <pre><code>\n// Listen to all \"beforewrite\" event fired by all proxies.\nExt.data.DataProxy.on('beforewrite', function(proxy, action) {\n    console.log('beforewrite: ', action);\n});\n\n// Listen to \"write\" event fired by all proxies\nExt.data.DataProxy.on('write', function(proxy, action, data, res, rs) {\n    console.info('write: ', action);\n});\n\n// Listen to \"exception\" event fired by all proxies\nExt.data.DataProxy.on('exception', function(proxy, type, action, exception) {\n    console.error(type + action + ' exception);\n});\n * </code></pre>\n * <b>Note:</b> These three events are all fired with the signature of the corresponding <i>DataProxy instance</i> event {@link #beforewrite beforewrite}, {@link #write write} and {@link #exception exception}.\n */\nExt.data.DataProxy = function(conn){\n    // make sure we have a config object here to support ux proxies.\n    // All proxies should now send config into superclass constructor.\n    conn = conn || {};\n\n    // This line caused a bug when people use custom Connection object having its own request method.\n    // http://extjs.com/forum/showthread.php?t=67194.  Have to set DataProxy config\n    //Ext.applyIf(this, conn);\n\n    this.api     = conn.api;\n    this.url     = conn.url;\n    this.restful = conn.restful;\n    this.listeners = conn.listeners;\n\n    // deprecated\n    this.prettyUrls = conn.prettyUrls;\n\n    /**\n     * @cfg {Object} api\n     * Specific urls to call on CRUD action methods \"read\", \"create\", \"update\" and \"destroy\".\n     * Defaults to:<pre><code>\napi: {\n    read    : undefined,\n    create  : undefined,\n    update  : undefined,\n    destroy : undefined\n}\n     * </code></pre>\n     * <p>The url is built based upon the action being executed <tt>[load|create|save|destroy]</tt>\n     * using the commensurate <tt>{@link #api}</tt> property, or if undefined default to the\n     * configured {@link Ext.data.Store}.{@link Ext.data.Store#url url}.</p><br>\n     * <p>For example:</p>\n     * <pre><code>\napi: {\n    load :    '/controller/load',\n    create :  '/controller/new',  // Server MUST return idProperty of new record\n    save :    '/controller/update',\n    destroy : '/controller/destroy_action'\n}\n\n// Alternatively, one can use the object-form to specify each API-action\napi: {\n    load: {url: 'read.php', method: 'GET'},\n    create: 'create.php',\n    destroy: 'destroy.php',\n    save: 'update.php'\n}\n     * </code></pre>\n     * <p>If the specific URL for a given CRUD action is undefined, the CRUD action request\n     * will be directed to the configured <tt>{@link Ext.data.Connection#url url}</tt>.</p>\n     * <br><p><b>Note</b>: To modify the URL for an action dynamically the appropriate API\n     * property should be modified before the action is requested using the corresponding before\n     * action event.  For example to modify the URL associated with the load action:\n     * <pre><code>\n// modify the url for the action\nmyStore.on({\n    beforeload: {\n        fn: function (store, options) {\n            // use <tt>{@link Ext.data.HttpProxy#setUrl setUrl}</tt> to change the URL for *just* this request.\n            store.proxy.setUrl('changed1.php');\n\n            // set optional second parameter to true to make this URL change\n            // permanent, applying this URL for all subsequent requests.\n            store.proxy.setUrl('changed1.php', true);\n\n            // Altering the proxy API should be done using the public\n            // method <tt>{@link Ext.data.DataProxy#setApi setApi}</tt>.\n            store.proxy.setApi('read', 'changed2.php');\n\n            // Or set the entire API with a config-object.\n            // When using the config-object option, you must redefine the <b>entire</b>\n            // API -- not just a specific action of it.\n            store.proxy.setApi({\n                read    : 'changed_read.php',\n                create  : 'changed_create.php',\n                update  : 'changed_update.php',\n                destroy : 'changed_destroy.php'\n            });\n        }\n    }\n});\n     * </code></pre>\n     * </p>\n     */\n\n    this.addEvents(\n        /**\n         * @event exception\n         * <p>Fires if an exception occurs in the Proxy during a remote request. This event is relayed\n         * through a corresponding {@link Ext.data.Store}.{@link Ext.data.Store#exception exception},\n         * so any Store instance may observe this event.</p>\n         * <p>In addition to being fired through the DataProxy instance that raised the event, this event is also fired\n         * through the Ext.data.DataProxy <i>class</i> to allow for centralized processing of exception events from <b>all</b>\n         * DataProxies by attaching a listener to the Ext.data.DataProxy class itself.</p>\n         * <p>This event can be fired for one of two reasons:</p>\n         * <div class=\"mdetail-params\"><ul>\n         * <li>remote-request <b>failed</b> : <div class=\"sub-desc\">\n         * The server did not return status === 200.\n         * </div></li>\n         * <li>remote-request <b>succeeded</b> : <div class=\"sub-desc\">\n         * The remote-request succeeded but the reader could not read the response.\n         * This means the server returned data, but the configured Reader threw an\n         * error while reading the response.  In this case, this event will be\n         * raised and the caught error will be passed along into this event.\n         * </div></li>\n         * </ul></div>\n         * <br><p>This event fires with two different contexts based upon the 2nd\n         * parameter <tt>type [remote|response]</tt>.  The first four parameters\n         * are identical between the two contexts -- only the final two parameters\n         * differ.</p>\n         * @param {DataProxy} this The proxy that sent the request\n         * @param {String} type\n         * <p>The value of this parameter will be either <tt>'response'</tt> or <tt>'remote'</tt>.</p>\n         * <div class=\"mdetail-params\"><ul>\n         * <li><b><tt>'response'</tt></b> : <div class=\"sub-desc\">\n         * <p>An <b>invalid</b> response from the server was returned: either 404,\n         * 500 or the response meta-data does not match that defined in the DataReader\n         * (e.g.: root, idProperty, successProperty).</p>\n         * </div></li>\n         * <li><b><tt>'remote'</tt></b> : <div class=\"sub-desc\">\n         * <p>A <b>valid</b> response was returned from the server having\n         * successProperty === false.  This response might contain an error-message\n         * sent from the server.  For example, the user may have failed\n         * authentication/authorization or a database validation error occurred.</p>\n         * </div></li>\n         * </ul></div>\n         * @param {String} action Name of the action (see {@link Ext.data.Api#actions}.\n         * @param {Object} options The options for the action that were specified in the {@link #request}.\n         * @param {Object} response\n         * <p>The value of this parameter depends on the value of the <code>type</code> parameter:</p>\n         * <div class=\"mdetail-params\"><ul>\n         * <li><b><tt>'response'</tt></b> : <div class=\"sub-desc\">\n         * <p>The raw browser response object (e.g.: XMLHttpRequest)</p>\n         * </div></li>\n         * <li><b><tt>'remote'</tt></b> : <div class=\"sub-desc\">\n         * <p>The decoded response object sent from the server.</p>\n         * </div></li>\n         * </ul></div>\n         * @param {Mixed} arg\n         * <p>The type and value of this parameter depends on the value of the <code>type</code> parameter:</p>\n         * <div class=\"mdetail-params\"><ul>\n         * <li><b><tt>'response'</tt></b> : Error<div class=\"sub-desc\">\n         * <p>The JavaScript Error object caught if the configured Reader could not read the data.\n         * If the remote request returns success===false, this parameter will be null.</p>\n         * </div></li>\n         * <li><b><tt>'remote'</tt></b> : Record/Record[]<div class=\"sub-desc\">\n         * <p>This parameter will only exist if the <tt>action</tt> was a <b>write</b> action\n         * (Ext.data.Api.actions.create|update|destroy).</p>\n         * </div></li>\n         * </ul></div>\n         */\n        'exception',\n        /**\n         * @event beforeload\n         * Fires before a request to retrieve a data object.\n         * @param {DataProxy} this The proxy for the request\n         * @param {Object} params The params object passed to the {@link #request} function\n         */\n        'beforeload',\n        /**\n         * @event load\n         * Fires before the load method's callback is called.\n         * @param {DataProxy} this The proxy for the request\n         * @param {Object} o The request transaction object\n         * @param {Object} options The callback's <tt>options</tt> property as passed to the {@link #request} function\n         */\n        'load',\n        /**\n         * @event loadexception\n         * <p>This event is <b>deprecated</b>.  The signature of the loadexception event\n         * varies depending on the proxy, use the catch-all {@link #exception} event instead.\n         * This event will fire in addition to the {@link #exception} event.</p>\n         * @param {misc} misc See {@link #exception}.\n         * @deprecated\n         */\n        'loadexception',\n        /**\n         * @event beforewrite\n         * <p>Fires before a request is generated for one of the actions Ext.data.Api.actions.create|update|destroy</p>\n         * <p>In addition to being fired through the DataProxy instance that raised the event, this event is also fired\n         * through the Ext.data.DataProxy <i>class</i> to allow for centralized processing of beforewrite events from <b>all</b>\n         * DataProxies by attaching a listener to the Ext.data.DataProxy class itself.</p>\n         * @param {DataProxy} this The proxy for the request\n         * @param {String} action [Ext.data.Api.actions.create|update|destroy]\n         * @param {Record/Record[]} rs The Record(s) to create|update|destroy.\n         * @param {Object} params The request <code>params</code> object.  Edit <code>params</code> to add parameters to the request.\n         */\n        'beforewrite',\n        /**\n         * @event write\n         * <p>Fires before the request-callback is called</p>\n         * <p>In addition to being fired through the DataProxy instance that raised the event, this event is also fired\n         * through the Ext.data.DataProxy <i>class</i> to allow for centralized processing of write events from <b>all</b>\n         * DataProxies by attaching a listener to the Ext.data.DataProxy class itself.</p>\n         * @param {DataProxy} this The proxy that sent the request\n         * @param {String} action [Ext.data.Api.actions.create|upate|destroy]\n         * @param {Object} data The data object extracted from the server-response\n         * @param {Object} response The decoded response from server\n         * @param {Record/Record[]} rs The Record(s) from Store\n         * @param {Object} options The callback's <tt>options</tt> property as passed to the {@link #request} function\n         */\n        'write'\n    );\n    Ext.data.DataProxy.superclass.constructor.call(this);\n\n    // Prepare the proxy api.  Ensures all API-actions are defined with the Object-form.\n    try {\n        Ext.data.Api.prepare(this);\n    } catch (e) {\n        if (e instanceof Ext.data.Api.Error) {\n            e.toConsole();\n        }\n    }\n    // relay each proxy's events onto Ext.data.DataProxy class for centralized Proxy-listening\n    Ext.data.DataProxy.relayEvents(this, ['beforewrite', 'write', 'exception']);\n};\n\nExt.extend(Ext.data.DataProxy, Ext.util.Observable, {\n    /**\n     * @cfg {Boolean} restful\n     * <p>Defaults to <tt>false</tt>.  Set to <tt>true</tt> to operate in a RESTful manner.</p>\n     * <br><p> Note: this parameter will automatically be set to <tt>true</tt> if the\n     * {@link Ext.data.Store} it is plugged into is set to <code>restful: true</code>. If the\n     * Store is RESTful, there is no need to set this option on the proxy.</p>\n     * <br><p>RESTful implementations enable the serverside framework to automatically route\n     * actions sent to one url based upon the HTTP method, for example:\n     * <pre><code>\nstore: new Ext.data.Store({\n    restful: true,\n    proxy: new Ext.data.HttpProxy({url:'/users'}); // all requests sent to /users\n    ...\n)}\n     * </code></pre>\n     * If there is no <code>{@link #api}</code> specified in the configuration of the proxy,\n     * all requests will be marshalled to a single RESTful url (/users) so the serverside\n     * framework can inspect the HTTP Method and act accordingly:\n     * <pre>\n<u>Method</u>   <u>url</u>        <u>action</u>\nPOST     /users     create\nGET      /users     read\nPUT      /users/23  update\nDESTROY  /users/23  delete\n     * </pre></p>\n     * <p>If set to <tt>true</tt>, a {@link Ext.data.Record#phantom non-phantom} record's\n     * {@link Ext.data.Record#id id} will be appended to the url. Some MVC (e.g., Ruby on Rails,\n     * Merb and Django) support segment based urls where the segments in the URL follow the\n     * Model-View-Controller approach:<pre><code>\n     * someSite.com/controller/action/id\n     * </code></pre>\n     * Where the segments in the url are typically:<div class=\"mdetail-params\"><ul>\n     * <li>The first segment : represents the controller class that should be invoked.</li>\n     * <li>The second segment : represents the class function, or method, that should be called.</li>\n     * <li>The third segment : represents the ID (a variable typically passed to the method).</li>\n     * </ul></div></p>\n     * <br><p>Refer to <code>{@link Ext.data.DataProxy#api}</code> for additional information.</p>\n     */\n    restful: false,\n\n    /**\n     * <p>Redefines the Proxy's API or a single action of an API. Can be called with two method signatures.</p>\n     * <p>If called with an object as the only parameter, the object should redefine the <b>entire</b> API, e.g.:</p><pre><code>\nproxy.setApi({\n    read    : '/users/read',\n    create  : '/users/create',\n    update  : '/users/update',\n    destroy : '/users/destroy'\n});\n</code></pre>\n     * <p>If called with two parameters, the first parameter should be a string specifying the API action to\n     * redefine and the second parameter should be the URL (or function if using DirectProxy) to call for that action, e.g.:</p><pre><code>\nproxy.setApi(Ext.data.Api.actions.read, '/users/new_load_url');\n</code></pre>\n     * @param {String/Object} api An API specification object, or the name of an action.\n     * @param {String/Function} url The URL (or function if using DirectProxy) to call for the action.\n     */\n    setApi : function() {\n        if (arguments.length == 1) {\n            var valid = Ext.data.Api.isValid(arguments[0]);\n            if (valid === true) {\n                this.api = arguments[0];\n            }\n            else {\n                throw new Ext.data.Api.Error('invalid', valid);\n            }\n        }\n        else if (arguments.length == 2) {\n            if (!Ext.data.Api.isAction(arguments[0])) {\n                throw new Ext.data.Api.Error('invalid', arguments[0]);\n            }\n            this.api[arguments[0]] = arguments[1];\n        }\n        Ext.data.Api.prepare(this);\n    },\n\n    /**\n     * Returns true if the specified action is defined as a unique action in the api-config.\n     * request.  If all API-actions are routed to unique urls, the xaction parameter is unecessary.  However, if no api is defined\n     * and all Proxy actions are routed to DataProxy#url, the server-side will require the xaction parameter to perform a switch to\n     * the corresponding code for CRUD action.\n     * @param {String} action CREATE READ UPDATE or DESTROY\n     * @return {Boolean}\n     */\n    isApiAction : function(action) {\n        return (this.api[action]) ? true : false;\n    },\n\n    /**\n     * All proxy actions are executed through this method.  Automatically fires the \"before\" + action event\n     * @param {String} action Name of the action\n     * @param {Ext.data.Record/Ext.data.Record[]/null} rs Will be null when action is 'load'\n     * @param {Object} params\n     * @param {Ext.data.DataReader} reader\n     * @param {Function} callback\n     * @param {Object} scope The scope (<code>this</code> reference) in which the callback function is executed. Defaults to the Proxy object.\n     * @param {Object} options Any options specified for the action (e.g. see {@link Ext.data.Store#load}.\n     */\n    request : function(action, rs, params, reader, callback, scope, options) {\n        if (!this.api[action] && !this.load) {\n            throw new Ext.data.DataProxy.Error('action-undefined', action);\n        }\n        params = params || {};\n        if ((action === Ext.data.Api.actions.read) ? this.fireEvent(\"beforeload\", this, params) : this.fireEvent(\"beforewrite\", this, action, rs, params) !== false) {\n            this.doRequest.apply(this, arguments);\n        }\n        else {\n            callback.call(scope || this, null, options, false);\n        }\n    },\n\n\n    /**\n     * <b>Deprecated</b> load method using old method signature. See {@doRequest} for preferred method.\n     * @deprecated\n     * @param {Object} params\n     * @param {Object} reader\n     * @param {Object} callback\n     * @param {Object} scope\n     * @param {Object} arg\n     */\n    load : null,\n\n    /**\n     * @cfg {Function} doRequest Abstract method that should be implemented in all subclasses.  <b>Note:</b> Should only be used by custom-proxy developers.\n     * (e.g.: {@link Ext.data.HttpProxy#doRequest HttpProxy.doRequest},\n     * {@link Ext.data.DirectProxy#doRequest DirectProxy.doRequest}).\n     */\n    doRequest : function(action, rs, params, reader, callback, scope, options) {\n        // default implementation of doRequest for backwards compatibility with 2.0 proxies.\n        // If we're executing here, the action is probably \"load\".\n        // Call with the pre-3.0 method signature.\n        this.load(params, reader, callback, scope, options);\n    },\n\n    /**\n     * @cfg {Function} onRead Abstract method that should be implemented in all subclasses.  <b>Note:</b> Should only be used by custom-proxy developers.  Callback for read {@link Ext.data.Api#actions action}.\n     * @param {String} action Action name as per {@link Ext.data.Api.actions#read}.\n     * @param {Object} o The request transaction object\n     * @param {Object} res The server response\n     * @fires loadexception (deprecated)\n     * @fires exception\n     * @fires load\n     * @protected\n     */\n    onRead : Ext.emptyFn,\n    /**\n     * @cfg {Function} onWrite Abstract method that should be implemented in all subclasses.  <b>Note:</b> Should only be used by custom-proxy developers.  Callback for <i>create, update and destroy</i> {@link Ext.data.Api#actions actions}.\n     * @param {String} action [Ext.data.Api.actions.create|read|update|destroy]\n     * @param {Object} trans The request transaction object\n     * @param {Object} res The server response\n     * @fires exception\n     * @fires write\n     * @protected\n     */\n    onWrite : Ext.emptyFn,\n    /**\n     * buildUrl\n     * Sets the appropriate url based upon the action being executed.  If restful is true, and only a single record is being acted upon,\n     * url will be built Rails-style, as in \"/controller/action/32\".  restful will aply iff the supplied record is an\n     * instance of Ext.data.Record rather than an Array of them.\n     * @param {String} action The api action being executed [read|create|update|destroy]\n     * @param {Ext.data.Record/Ext.data.Record[]} record The record or Array of Records being acted upon.\n     * @return {String} url\n     * @private\n     */\n    buildUrl : function(action, record) {\n        record = record || null;\n\n        // conn.url gets nullified after each request.  If it's NOT null here, that means the user must have intervened with a call\n        // to DataProxy#setUrl or DataProxy#setApi and changed it before the request was executed.  If that's the case, use conn.url,\n        // otherwise, build the url from the api or this.url.\n        var url = (this.conn && this.conn.url) ? this.conn.url : (this.api[action]) ? this.api[action].url : this.url;\n        if (!url) {\n            throw new Ext.data.Api.Error('invalid-url', action);\n        }\n\n        // look for urls having \"provides\" suffix used in some MVC frameworks like Rails/Merb and others.  The provides suffice informs\n        // the server what data-format the client is dealing with and returns data in the same format (eg: application/json, application/xml, etc)\n        // e.g.: /users.json, /users.xml, etc.\n        // with restful routes, we need urls like:\n        // PUT /users/1.json\n        // DELETE /users/1.json\n        var provides = null;\n        var m = url.match(/(.*)(\\.json|\\.xml|\\.html)$/);\n        if (m) {\n            provides = m[2];    // eg \".json\"\n            url      = m[1];    // eg: \"/users\"\n        }\n        // prettyUrls is deprectated in favor of restful-config\n        if ((this.restful === true || this.prettyUrls === true) && record instanceof Ext.data.Record && !record.phantom) {\n            url += '/' + record.id;\n        }\n        return (provides === null) ? url : url + provides;\n    },\n\n    /**\n     * Destroys the proxy by purging any event listeners and cancelling any active requests.\n     */\n    destroy: function(){\n        this.purgeListeners();\n    }\n});\n\n// Apply the Observable prototype to the DataProxy class so that proxy instances can relay their\n// events to the class.  Allows for centralized listening of all proxy instances upon the DataProxy class.\nExt.apply(Ext.data.DataProxy, Ext.util.Observable.prototype);\nExt.util.Observable.call(Ext.data.DataProxy);\n\n/**\n * @class Ext.data.DataProxy.Error\n * @extends Ext.Error\n * DataProxy Error extension.\n * constructor\n * @param {String} message Message describing the error.\n * @param {Record/Record[]} arg\n */\nExt.data.DataProxy.Error = Ext.extend(Ext.Error, {\n    constructor : function(message, arg) {\n        this.arg = arg;\n        Ext.Error.call(this, message);\n    },\n    name: 'Ext.data.DataProxy'\n});\nExt.apply(Ext.data.DataProxy.Error.prototype, {\n    lang: {\n        'action-undefined': \"DataProxy attempted to execute an API-action but found an undefined url / function.  Please review your Proxy url/api-configuration.\",\n        'api-invalid': 'Recieved an invalid API-configuration.  Please ensure your proxy API-configuration contains only the actions from Ext.data.Api.actions.'\n    }\n});\n\n\n/**\n * @class Ext.data.Request\n * A simple Request class used internally to the data package to provide more generalized remote-requests\n * to a DataProxy.\n * TODO Not yet implemented.  Implement in Ext.data.Store#execute\n */\nExt.data.Request = function(params) {\n    Ext.apply(this, params);\n};\nExt.data.Request.prototype = {\n    /**\n     * @cfg {String} action\n     */\n    action : undefined,\n    /**\n     * @cfg {Ext.data.Record[]/Ext.data.Record} rs The Store recordset associated with the request.\n     */\n    rs : undefined,\n    /**\n     * @cfg {Object} params HTTP request params\n     */\n    params: undefined,\n    /**\n     * @cfg {Function} callback The function to call when request is complete\n     */\n    callback : Ext.emptyFn,\n    /**\n     * @cfg {Object} scope The scope of the callback funtion\n     */\n    scope : undefined,\n    /**\n     * @cfg {Ext.data.DataReader} reader The DataReader instance which will parse the received response\n     */\n    reader : undefined\n};\n/**\n * @class Ext.data.Response\n * A generic response class to normalize response-handling internally to the framework.\n */\nExt.data.Response = function(params) {\n    Ext.apply(this, params);\n};\nExt.data.Response.prototype = {\n    /**\n     * @cfg {String} action {@link Ext.data.Api#actions}\n     */\n    action: undefined,\n    /**\n     * @cfg {Boolean} success\n     */\n    success : undefined,\n    /**\n     * @cfg {String} message\n     */\n    message : undefined,\n    /**\n     * @cfg {Array/Object} data\n     */\n    data: undefined,\n    /**\n     * @cfg {Object} raw The raw response returned from server-code\n     */\n    raw: undefined,\n    /**\n     * @cfg {Ext.data.Record/Ext.data.Record[]} records related to the Request action\n     */\n    records: undefined\n};\n/**\n * @class Ext.data.ScriptTagProxy\n * @extends Ext.data.DataProxy\n * An implementation of Ext.data.DataProxy that reads a data object from a URL which may be in a domain\n * other than the originating domain of the running page.<br>\n * <p>\n * <b>Note that if you are retrieving data from a page that is in a domain that is NOT the same as the originating domain\n * of the running page, you must use this class, rather than HttpProxy.</b><br>\n * <p>\n * The content passed back from a server resource requested by a ScriptTagProxy <b>must</b> be executable JavaScript\n * source code because it is used as the source inside a &lt;script> tag.<br>\n * <p>\n * In order for the browser to process the returned data, the server must wrap the data object\n * with a call to a callback function, the name of which is passed as a parameter by the ScriptTagProxy.\n * Below is a Java example for a servlet which returns data for either a ScriptTagProxy, or an HttpProxy\n * depending on whether the callback name was passed:\n * <p>\n * <pre><code>\nboolean scriptTag = false;\nString cb = request.getParameter(\"callback\");\nif (cb != null) {\n    scriptTag = true;\n    response.setContentType(\"text/javascript\");\n} else {\n    response.setContentType(\"application/x-json\");\n}\nWriter out = response.getWriter();\nif (scriptTag) {\n    out.write(cb + \"(\");\n}\nout.print(dataBlock.toJsonString());\nif (scriptTag) {\n    out.write(\");\");\n}\n</code></pre>\n * <p>Below is a PHP example to do the same thing:</p><pre><code>\n$callback = $_REQUEST['callback'];\n\n// Create the output object.\n$output = array('a' => 'Apple', 'b' => 'Banana');\n\n//start output\nif ($callback) {\n    header('Content-Type: text/javascript');\n    echo $callback . '(' . json_encode($output) . ');';\n} else {\n    header('Content-Type: application/x-json');\n    echo json_encode($output);\n}\n</code></pre>\n * <p>Below is the ASP.Net code to do the same thing:</p><pre><code>\nString jsonString = \"{success: true}\";\nString cb = Request.Params.Get(\"callback\");\nString responseString = \"\";\nif (!String.IsNullOrEmpty(cb)) {\n    responseString = cb + \"(\" + jsonString + \")\";\n} else {\n    responseString = jsonString;\n}\nResponse.Write(responseString);\n</code></pre>\n *\n * @constructor\n * @param {Object} config A configuration object.\n */\nExt.data.ScriptTagProxy = function(config){\n    Ext.apply(this, config);\n\n    Ext.data.ScriptTagProxy.superclass.constructor.call(this, config);\n\n    this.head = document.getElementsByTagName(\"head\")[0];\n\n    /**\n     * @event loadexception\n     * <b>Deprecated</b> in favor of 'exception' event.\n     * Fires if an exception occurs in the Proxy during data loading.  This event can be fired for one of two reasons:\n     * <ul><li><b>The load call timed out.</b>  This means the load callback did not execute within the time limit\n     * specified by {@link #timeout}.  In this case, this event will be raised and the\n     * fourth parameter (read error) will be null.</li>\n     * <li><b>The load succeeded but the reader could not read the response.</b>  This means the server returned\n     * data, but the configured Reader threw an error while reading the data.  In this case, this event will be\n     * raised and the caught error will be passed along as the fourth parameter of this event.</li></ul>\n     * Note that this event is also relayed through {@link Ext.data.Store}, so you can listen for it directly\n     * on any Store instance.\n     * @param {Object} this\n     * @param {Object} options The loading options that were specified (see {@link #load} for details).  If the load\n     * call timed out, this parameter will be null.\n     * @param {Object} arg The callback's arg object passed to the {@link #load} function\n     * @param {Error} e The JavaScript Error object caught if the configured Reader could not read the data.\n     * If the remote request returns success: false, this parameter will be null.\n     */\n};\n\nExt.data.ScriptTagProxy.TRANS_ID = 1000;\n\nExt.extend(Ext.data.ScriptTagProxy, Ext.data.DataProxy, {\n    /**\n     * @cfg {String} url The URL from which to request the data object.\n     */\n    /**\n     * @cfg {Number} timeout (optional) The number of milliseconds to wait for a response. Defaults to 30 seconds.\n     */\n    timeout : 30000,\n    /**\n     * @cfg {String} callbackParam (Optional) The name of the parameter to pass to the server which tells\n     * the server the name of the callback function set up by the load call to process the returned data object.\n     * Defaults to \"callback\".<p>The server-side processing must read this parameter value, and generate\n     * javascript output which calls this named function passing the data object as its only parameter.\n     */\n    callbackParam : \"callback\",\n    /**\n     *  @cfg {Boolean} nocache (optional) Defaults to true. Disable caching by adding a unique parameter\n     * name to the request.\n     */\n    nocache : true,\n\n    /**\n     * HttpProxy implementation of DataProxy#doRequest\n     * @param {String} action\n     * @param {Ext.data.Record/Ext.data.Record[]} rs If action is <tt>read</tt>, rs will be null\n     * @param {Object} params An object containing properties which are to be used as HTTP parameters\n     * for the request to the remote server.\n     * @param {Ext.data.DataReader} reader The Reader object which converts the data\n     * object into a block of Ext.data.Records.\n     * @param {Function} callback The function into which to pass the block of Ext.data.Records.\n     * The function must be passed <ul>\n     * <li>The Record block object</li>\n     * <li>The \"arg\" argument from the load function</li>\n     * <li>A boolean success indicator</li>\n     * </ul>\n     * @param {Object} scope The scope (<code>this</code> reference) in which the callback function is executed. Defaults to the browser window.\n     * @param {Object} arg An optional argument which is passed to the callback as its second parameter.\n     */\n    doRequest : function(action, rs, params, reader, callback, scope, arg) {\n        var p = Ext.urlEncode(Ext.apply(params, this.extraParams));\n\n        var url = this.buildUrl(action, rs);\n        if (!url) {\n            throw new Ext.data.Api.Error('invalid-url', url);\n        }\n        url = Ext.urlAppend(url, p);\n\n        if(this.nocache){\n            url = Ext.urlAppend(url, '_dc=' + (new Date().getTime()));\n        }\n        var transId = ++Ext.data.ScriptTagProxy.TRANS_ID;\n        var trans = {\n            id : transId,\n            action: action,\n            cb : \"stcCallback\"+transId,\n            scriptId : \"stcScript\"+transId,\n            params : params,\n            arg : arg,\n            url : url,\n            callback : callback,\n            scope : scope,\n            reader : reader\n        };\n        window[trans.cb] = this.createCallback(action, rs, trans);\n        url += String.format(\"&{0}={1}\", this.callbackParam, trans.cb);\n        if(this.autoAbort !== false){\n            this.abort();\n        }\n\n        trans.timeoutId = this.handleFailure.defer(this.timeout, this, [trans]);\n\n        var script = document.createElement(\"script\");\n        script.setAttribute(\"src\", url);\n        script.setAttribute(\"type\", \"text/javascript\");\n        script.setAttribute(\"id\", trans.scriptId);\n        this.head.appendChild(script);\n\n        this.trans = trans;\n    },\n\n    // @private createCallback\n    createCallback : function(action, rs, trans) {\n        var self = this;\n        return function(res) {\n            self.trans = false;\n            self.destroyTrans(trans, true);\n            if (action === Ext.data.Api.actions.read) {\n                self.onRead.call(self, action, trans, res);\n            } else {\n                self.onWrite.call(self, action, trans, res, rs);\n            }\n        };\n    },\n    /**\n     * Callback for read actions\n     * @param {String} action [Ext.data.Api.actions.create|read|update|destroy]\n     * @param {Object} trans The request transaction object\n     * @param {Object} res The server response\n     * @protected\n     */\n    onRead : function(action, trans, res) {\n        var result;\n        try {\n            result = trans.reader.readRecords(res);\n        }catch(e){\n            // @deprecated: fire loadexception\n            this.fireEvent(\"loadexception\", this, trans, res, e);\n\n            this.fireEvent('exception', this, 'response', action, trans, res, e);\n            trans.callback.call(trans.scope||window, null, trans.arg, false);\n            return;\n        }\n        if (result.success === false) {\n            // @deprecated: fire old loadexception for backwards-compat.\n            this.fireEvent('loadexception', this, trans, res);\n\n            this.fireEvent('exception', this, 'remote', action, trans, res, null);\n        } else {\n            this.fireEvent(\"load\", this, res, trans.arg);\n        }\n        trans.callback.call(trans.scope||window, result, trans.arg, result.success);\n    },\n    /**\n     * Callback for write actions\n     * @param {String} action [Ext.data.Api.actions.create|read|update|destroy]\n     * @param {Object} trans The request transaction object\n     * @param {Object} res The server response\n     * @protected\n     */\n    onWrite : function(action, trans, response, rs) {\n        var reader = trans.reader;\n        try {\n            // though we already have a response object here in STP, run through readResponse to catch any meta-data exceptions.\n            var res = reader.readResponse(action, response);\n        } catch (e) {\n            this.fireEvent('exception', this, 'response', action, trans, res, e);\n            trans.callback.call(trans.scope||window, null, res, false);\n            return;\n        }\n        if(!res.success === true){\n            this.fireEvent('exception', this, 'remote', action, trans, res, rs);\n            trans.callback.call(trans.scope||window, null, res, false);\n            return;\n        }\n        this.fireEvent(\"write\", this, action, res.data, res, rs, trans.arg );\n        trans.callback.call(trans.scope||window, res.data, res, true);\n    },\n\n    // private\n    isLoading : function(){\n        return this.trans ? true : false;\n    },\n\n    /**\n     * Abort the current server request.\n     */\n    abort : function(){\n        if(this.isLoading()){\n            this.destroyTrans(this.trans);\n        }\n    },\n\n    // private\n    destroyTrans : function(trans, isLoaded){\n        this.head.removeChild(document.getElementById(trans.scriptId));\n        clearTimeout(trans.timeoutId);\n        if(isLoaded){\n            window[trans.cb] = undefined;\n            try{\n                delete window[trans.cb];\n            }catch(e){}\n        }else{\n            // if hasn't been loaded, wait for load to remove it to prevent script error\n            window[trans.cb] = function(){\n                window[trans.cb] = undefined;\n                try{\n                    delete window[trans.cb];\n                }catch(e){}\n            };\n        }\n    },\n\n    // private\n    handleFailure : function(trans){\n        this.trans = false;\n        this.destroyTrans(trans, false);\n        if (trans.action === Ext.data.Api.actions.read) {\n            // @deprecated firing loadexception\n            this.fireEvent(\"loadexception\", this, null, trans.arg);\n        }\n\n        this.fireEvent('exception', this, 'response', trans.action, {\n            response: null,\n            options: trans.arg\n        });\n        trans.callback.call(trans.scope||window, null, trans.arg, false);\n    },\n\n    // inherit docs\n    destroy: function(){\n        this.abort();\n        Ext.data.ScriptTagProxy.superclass.destroy.call(this);\n    }\n});/**\n * @class Ext.data.HttpProxy\n * @extends Ext.data.DataProxy\n * <p>An implementation of {@link Ext.data.DataProxy} that processes data requests within the same\n * domain of the originating page.</p>\n * <p><b>Note</b>: this class cannot be used to retrieve data from a domain other\n * than the domain from which the running page was served. For cross-domain requests, use a\n * {@link Ext.data.ScriptTagProxy ScriptTagProxy}.</p>\n * <p>Be aware that to enable the browser to parse an XML document, the server must set\n * the Content-Type header in the HTTP response to \"<tt>text/xml</tt>\".</p>\n * @constructor\n * @param {Object} conn\n * An {@link Ext.data.Connection} object, or options parameter to {@link Ext.Ajax#request}.\n * <p>Note that if this HttpProxy is being used by a {@link Ext.data.Store Store}, then the\n * Store's call to {@link #load} will override any specified <tt>callback</tt> and <tt>params</tt>\n * options. In this case, use the Store's {@link Ext.data.Store#events events} to modify parameters,\n * or react to loading events. The Store's {@link Ext.data.Store#baseParams baseParams} may also be\n * used to pass parameters known at instantiation time.</p>\n * <p>If an options parameter is passed, the singleton {@link Ext.Ajax} object will be used to make\n * the request.</p>\n */\nExt.data.HttpProxy = function(conn){\n    Ext.data.HttpProxy.superclass.constructor.call(this, conn);\n\n    /**\n     * The Connection object (Or options parameter to {@link Ext.Ajax#request}) which this HttpProxy\n     * uses to make requests to the server. Properties of this object may be changed dynamically to\n     * change the way data is requested.\n     * @property\n     */\n    this.conn = conn;\n\n    // nullify the connection url.  The url param has been copied to 'this' above.  The connection\n    // url will be set during each execution of doRequest when buildUrl is called.  This makes it easier for users to override the\n    // connection url during beforeaction events (ie: beforeload, beforewrite, etc).\n    // Url is always re-defined during doRequest.\n    this.conn.url = null;\n\n    this.useAjax = !conn || !conn.events;\n\n    // A hash containing active requests, keyed on action [Ext.data.Api.actions.create|read|update|destroy]\n    var actions = Ext.data.Api.actions;\n    this.activeRequest = {};\n    for (var verb in actions) {\n        this.activeRequest[actions[verb]] = undefined;\n    }\n};\n\nExt.extend(Ext.data.HttpProxy, Ext.data.DataProxy, {\n    /**\n     * Return the {@link Ext.data.Connection} object being used by this Proxy.\n     * @return {Connection} The Connection object. This object may be used to subscribe to events on\n     * a finer-grained basis than the DataProxy events.\n     */\n    getConnection : function() {\n        return this.useAjax ? Ext.Ajax : this.conn;\n    },\n\n    /**\n     * Used for overriding the url used for a single request.  Designed to be called during a beforeaction event.  Calling setUrl\n     * will override any urls set via the api configuration parameter.  Set the optional parameter makePermanent to set the url for\n     * all subsequent requests.  If not set to makePermanent, the next request will use the same url or api configuration defined\n     * in the initial proxy configuration.\n     * @param {String} url\n     * @param {Boolean} makePermanent (Optional) [false]\n     *\n     * (e.g.: beforeload, beforesave, etc).\n     */\n    setUrl : function(url, makePermanent) {\n        this.conn.url = url;\n        if (makePermanent === true) {\n            this.url = url;\n            this.api = null;\n            Ext.data.Api.prepare(this);\n        }\n    },\n\n    /**\n     * HttpProxy implementation of DataProxy#doRequest\n     * @param {String} action The crud action type (create, read, update, destroy)\n     * @param {Ext.data.Record/Ext.data.Record[]} rs If action is load, rs will be null\n     * @param {Object} params An object containing properties which are to be used as HTTP parameters\n     * for the request to the remote server.\n     * @param {Ext.data.DataReader} reader The Reader object which converts the data\n     * object into a block of Ext.data.Records.\n     * @param {Function} callback\n     * <div class=\"sub-desc\"><p>A function to be called after the request.\n     * The <tt>callback</tt> is passed the following arguments:<ul>\n     * <li><tt>r</tt> : Ext.data.Record[] The block of Ext.data.Records.</li>\n     * <li><tt>options</tt>: Options object from the action request</li>\n     * <li><tt>success</tt>: Boolean success indicator</li></ul></p></div>\n     * @param {Object} scope The scope (<code>this</code> reference) in which the callback function is executed. Defaults to the browser window.\n     * @param {Object} arg An optional argument which is passed to the callback as its second parameter.\n     * @protected\n     */\n    doRequest : function(action, rs, params, reader, cb, scope, arg) {\n        var  o = {\n            method: (this.api[action]) ? this.api[action]['method'] : undefined,\n            request: {\n                callback : cb,\n                scope : scope,\n                arg : arg\n            },\n            reader: reader,\n            callback : this.createCallback(action, rs),\n            scope: this\n        };\n\n        // If possible, transmit data using jsonData || xmlData on Ext.Ajax.request (An installed DataWriter would have written it there.).\n        // Use std HTTP params otherwise.\n        if (params.jsonData) {\n            o.jsonData = params.jsonData;\n        } else if (params.xmlData) {\n            o.xmlData = params.xmlData;\n        } else {\n            o.params = params || {};\n        }\n        // Set the connection url.  If this.conn.url is not null here,\n        // the user must have overridden the url during a beforewrite/beforeload event-handler.\n        // this.conn.url is nullified after each request.\n        this.conn.url = this.buildUrl(action, rs);\n\n        if(this.useAjax){\n\n            Ext.applyIf(o, this.conn);\n\n            // If a currently running read request is found, abort it\n            if (action == Ext.data.Api.actions.read && this.activeRequest[action]) {\n                Ext.Ajax.abort(this.activeRequest[action]);\n            }\n            this.activeRequest[action] = Ext.Ajax.request(o);\n        }else{\n            this.conn.request(o);\n        }\n        // request is sent, nullify the connection url in preparation for the next request\n        this.conn.url = null;\n    },\n\n    /**\n     * Returns a callback function for a request.  Note a special case is made for the\n     * read action vs all the others.\n     * @param {String} action [create|update|delete|load]\n     * @param {Ext.data.Record[]} rs The Store-recordset being acted upon\n     * @private\n     */\n    createCallback : function(action, rs) {\n        return function(o, success, response) {\n            this.activeRequest[action] = undefined;\n            if (!success) {\n                if (action === Ext.data.Api.actions.read) {\n                    // @deprecated: fire loadexception for backwards compat.\n                    // TODO remove\n                    this.fireEvent('loadexception', this, o, response);\n                }\n                this.fireEvent('exception', this, 'response', action, o, response);\n                o.request.callback.call(o.request.scope, null, o.request.arg, false);\n                return;\n            }\n            if (action === Ext.data.Api.actions.read) {\n                this.onRead(action, o, response);\n            } else {\n                this.onWrite(action, o, response, rs);\n            }\n        };\n    },\n\n    /**\n     * Callback for read action\n     * @param {String} action Action name as per {@link Ext.data.Api.actions#read}.\n     * @param {Object} o The request transaction object\n     * @param {Object} res The server response\n     * @fires loadexception (deprecated)\n     * @fires exception\n     * @fires load\n     * @protected\n     */\n    onRead : function(action, o, response) {\n        var result;\n        try {\n            result = o.reader.read(response);\n        }catch(e){\n            // @deprecated: fire old loadexception for backwards-compat.\n            // TODO remove\n            this.fireEvent('loadexception', this, o, response, e);\n\n            this.fireEvent('exception', this, 'response', action, o, response, e);\n            o.request.callback.call(o.request.scope, null, o.request.arg, false);\n            return;\n        }\n        if (result.success === false) {\n            // @deprecated: fire old loadexception for backwards-compat.\n            // TODO remove\n            this.fireEvent('loadexception', this, o, response);\n\n            // Get DataReader read-back a response-object to pass along to exception event\n            var res = o.reader.readResponse(action, response);\n            this.fireEvent('exception', this, 'remote', action, o, res, null);\n        }\n        else {\n            this.fireEvent('load', this, o, o.request.arg);\n        }\n        // TODO refactor onRead, onWrite to be more generalized now that we're dealing with Ext.data.Response instance\n        // the calls to request.callback(...) in each will have to be made identical.\n        // NOTE reader.readResponse does not currently return Ext.data.Response\n        o.request.callback.call(o.request.scope, result, o.request.arg, result.success);\n    },\n    /**\n     * Callback for write actions\n     * @param {String} action [Ext.data.Api.actions.create|read|update|destroy]\n     * @param {Object} trans The request transaction object\n     * @param {Object} res The server response\n     * @fires exception\n     * @fires write\n     * @protected\n     */\n    onWrite : function(action, o, response, rs) {\n        var reader = o.reader;\n        var res;\n        try {\n            res = reader.readResponse(action, response);\n        } catch (e) {\n            this.fireEvent('exception', this, 'response', action, o, response, e);\n            o.request.callback.call(o.request.scope, null, o.request.arg, false);\n            return;\n        }\n        if (res.success === true) {\n            this.fireEvent('write', this, action, res.data, res, rs, o.request.arg);\n        } else {\n            this.fireEvent('exception', this, 'remote', action, o, res, rs);\n        }\n        // TODO refactor onRead, onWrite to be more generalized now that we're dealing with Ext.data.Response instance\n        // the calls to request.callback(...) in each will have to be made similar.\n        // NOTE reader.readResponse does not currently return Ext.data.Response\n        o.request.callback.call(o.request.scope, res.data, res, res.success);\n    },\n\n    // inherit docs\n    destroy: function(){\n        if(!this.useAjax){\n            this.conn.abort();\n        }else if(this.activeRequest){\n            var actions = Ext.data.Api.actions;\n            for (var verb in actions) {\n                if(this.activeRequest[actions[verb]]){\n                    Ext.Ajax.abort(this.activeRequest[actions[verb]]);\n                }\n            }\n        }\n        Ext.data.HttpProxy.superclass.destroy.call(this);\n    }\n});/**\n * @class Ext.data.MemoryProxy\n * @extends Ext.data.DataProxy\n * An implementation of Ext.data.DataProxy that simply passes the data specified in its constructor\n * to the Reader when its load method is called.\n * @constructor\n * @param {Object} data The data object which the Reader uses to construct a block of Ext.data.Records.\n */\nExt.data.MemoryProxy = function(data){\n    // Must define a dummy api with \"read\" action to satisfy DataProxy#doRequest and Ext.data.Api#prepare *before* calling super\n    var api = {};\n    api[Ext.data.Api.actions.read] = true;\n    Ext.data.MemoryProxy.superclass.constructor.call(this, {\n        api: api\n    });\n    this.data = data;\n};\n\nExt.extend(Ext.data.MemoryProxy, Ext.data.DataProxy, {\n    /**\n     * @event loadexception\n     * Fires if an exception occurs in the Proxy during data loading. Note that this event is also relayed\n     * through {@link Ext.data.Store}, so you can listen for it directly on any Store instance.\n     * @param {Object} this\n     * @param {Object} arg The callback's arg object passed to the {@link #load} function\n     * @param {Object} null This parameter does not apply and will always be null for MemoryProxy\n     * @param {Error} e The JavaScript Error object caught if the configured Reader could not read the data\n     */\n\n       /**\n     * MemoryProxy implementation of DataProxy#doRequest\n     * @param {String} action\n     * @param {Ext.data.Record/Ext.data.Record[]} rs If action is load, rs will be null\n     * @param {Object} params An object containing properties which are to be used as HTTP parameters\n     * for the request to the remote server.\n     * @param {Ext.data.DataReader} reader The Reader object which converts the data\n     * object into a block of Ext.data.Records.\n     * @param {Function} callback The function into which to pass the block of Ext.data.Records.\n     * The function must be passed <ul>\n     * <li>The Record block object</li>\n     * <li>The \"arg\" argument from the load function</li>\n     * <li>A boolean success indicator</li>\n     * </ul>\n     * @param {Object} scope The scope (<code>this</code> reference) in which the callback function is executed. Defaults to the browser window.\n     * @param {Object} arg An optional argument which is passed to the callback as its second parameter.\n     */\n    doRequest : function(action, rs, params, reader, callback, scope, arg) {\n        // No implementation for CRUD in MemoryProxy.  Assumes all actions are 'load'\n        params = params || {};\n        var result;\n        try {\n            result = reader.readRecords(this.data);\n        }catch(e){\n            // @deprecated loadexception\n            this.fireEvent(\"loadexception\", this, null, arg, e);\n\n            this.fireEvent('exception', this, 'response', action, arg, null, e);\n            callback.call(scope, null, arg, false);\n            return;\n        }\n        callback.call(scope, result, arg, true);\n    }\n});/**\n * @class Ext.data.Types\n * <p>This is s static class containing the system-supplied data types which may be given to a {@link Ext.data.Field Field}.<p/>\n * <p>The properties in this class are used as type indicators in the {@link Ext.data.Field Field} class, so to\n * test whether a Field is of a certain type, compare the {@link Ext.data.Field#type type} property against properties\n * of this class.</p>\n * <p>Developers may add their own application-specific data types to this class. Definition names must be UPPERCASE.\n * each type definition must contain three properties:</p>\n * <div class=\"mdetail-params\"><ul>\n * <li><code>convert</code> : <i>Function</i><div class=\"sub-desc\">A function to convert raw data values from a data block into the data\n * to be stored in the Field. The function is passed the collowing parameters:\n * <div class=\"mdetail-params\"><ul>\n * <li><b>v</b> : Mixed<div class=\"sub-desc\">The data value as read by the Reader, if undefined will use\n * the configured <tt>{@link Ext.data.Field#defaultValue defaultValue}</tt>.</div></li>\n * <li><b>rec</b> : Mixed<div class=\"sub-desc\">The data object containing the row as read by the Reader.\n * Depending on the Reader type, this could be an Array ({@link Ext.data.ArrayReader ArrayReader}), an object\n * ({@link Ext.data.JsonReader JsonReader}), or an XML element ({@link Ext.data.XMLReader XMLReader}).</div></li>\n * </ul></div></div></li>\n * <li><code>sortType</code> : <i>Function</i> <div class=\"sub-desc\">A function to convert the stored data into comparable form, as defined by {@link Ext.data.SortTypes}.</div></li>\n * <li><code>type</code> : <i>String</i> <div class=\"sub-desc\">A textual data type name.</div></li>\n * </ul></div>\n * <p>For example, to create a VELatLong field (See the Microsoft Bing Mapping API) containing the latitude/longitude value of a datapoint on a map from a JsonReader data block\n * which contained the properties <code>lat</code> and <code>long</code>, you would define a new data type like this:</p>\n *<pre><code>\n// Add a new Field data type which stores a VELatLong object in the Record.\nExt.data.Types.VELATLONG = {\n    convert: function(v, data) {\n        return new VELatLong(data.lat, data.long);\n    },\n    sortType: function(v) {\n        return v.Latitude;  // When sorting, order by latitude\n    },\n    type: 'VELatLong'\n};\n</code></pre>\n * <p>Then, when declaring a Record, use <pre><code>\nvar types = Ext.data.Types; // allow shorthand type access\nUnitRecord = Ext.data.Record.create([\n    { name: 'unitName', mapping: 'UnitName' },\n    { name: 'curSpeed', mapping: 'CurSpeed', type: types.INT },\n    { name: 'latitude', mapping: 'lat', type: types.FLOAT },\n    { name: 'latitude', mapping: 'lat', type: types.FLOAT },\n    { name: 'position', type: types.VELATLONG }\n]);\n</code></pre>\n * @singleton\n */\nExt.data.Types = new function(){\n    var st = Ext.data.SortTypes;\n    Ext.apply(this, {\n        /**\n         * @type Regexp\n         * @property stripRe\n         * A regular expression for stripping non-numeric characters from a numeric value. Defaults to <tt>/[\\$,%]/g</tt>.\n         * This should be overridden for localization.\n         */\n        stripRe: /[\\$,%]/g,\n        \n        /**\n         * @type Object\n         * @property AUTO\n         * This data type means that no conversion is applied to the raw data before it is placed into a Record.\n         */\n        AUTO: {\n            convert: function(v){ return v; },\n            sortType: st.none,\n            type: 'auto'\n        },\n\n        /**\n         * @type Object\n         * @property STRING\n         * This data type means that the raw data is converted into a String before it is placed into a Record.\n         */\n        STRING: {\n            convert: function(v){ return (v === undefined || v === null) ? '' : String(v); },\n            sortType: st.asUCString,\n            type: 'string'\n        },\n\n        /**\n         * @type Object\n         * @property INT\n         * This data type means that the raw data is converted into an integer before it is placed into a Record.\n         * <p>The synonym <code>INTEGER</code> is equivalent.</p>\n         */\n        INT: {\n            convert: function(v){\n                return v !== undefined && v !== null && v !== '' ?\n                    parseInt(String(v).replace(Ext.data.Types.stripRe, ''), 10) : (this.useNull ? null : 0);\n            },\n            sortType: st.none,\n            type: 'int'\n        },\n        \n        /**\n         * @type Object\n         * @property FLOAT\n         * This data type means that the raw data is converted into a number before it is placed into a Record.\n         * <p>The synonym <code>NUMBER</code> is equivalent.</p>\n         */\n        FLOAT: {\n            convert: function(v){\n                return v !== undefined && v !== null && v !== '' ?\n                    parseFloat(String(v).replace(Ext.data.Types.stripRe, ''), 10) : (this.useNull ? null : 0);\n            },\n            sortType: st.none,\n            type: 'float'\n        },\n        \n        /**\n         * @type Object\n         * @property BOOL\n         * <p>This data type means that the raw data is converted into a boolean before it is placed into\n         * a Record. The string \"true\" and the number 1 are converted to boolean <code>true</code>.</p>\n         * <p>The synonym <code>BOOLEAN</code> is equivalent.</p>\n         */\n        BOOL: {\n            convert: function(v){ return v === true || v === 'true' || v == 1; },\n            sortType: st.none,\n            type: 'bool'\n        },\n        \n        /**\n         * @type Object\n         * @property DATE\n         * This data type means that the raw data is converted into a Date before it is placed into a Record.\n         * The date format is specified in the constructor of the {@link Ext.data.Field} to which this type is\n         * being applied.\n         */\n        DATE: {\n            convert: function(v){\n                var df = this.dateFormat;\n                if(!v){\n                    return null;\n                }\n                if(Ext.isDate(v)){\n                    return v;\n                }\n                if(df){\n                    if(df == 'timestamp'){\n                        return new Date(v*1000);\n                    }\n                    if(df == 'time'){\n                        return new Date(parseInt(v, 10));\n                    }\n                    return Date.parseDate(v, df);\n                }\n                var parsed = Date.parse(v);\n                return parsed ? new Date(parsed) : null;\n            },\n            sortType: st.asDate,\n            type: 'date'\n        }\n    });\n    \n    Ext.apply(this, {\n        /**\n         * @type Object\n         * @property BOOLEAN\n         * <p>This data type means that the raw data is converted into a boolean before it is placed into\n         * a Record. The string \"true\" and the number 1 are converted to boolean <code>true</code>.</p>\n         * <p>The synonym <code>BOOL</code> is equivalent.</p>\n         */\n        BOOLEAN: this.BOOL,\n        /**\n         * @type Object\n         * @property INTEGER\n         * This data type means that the raw data is converted into an integer before it is placed into a Record.\n         * <p>The synonym <code>INT</code> is equivalent.</p>\n         */\n        INTEGER: this.INT,\n        /**\n         * @type Object\n         * @property NUMBER\n         * This data type means that the raw data is converted into a number before it is placed into a Record.\n         * <p>The synonym <code>FLOAT</code> is equivalent.</p>\n         */\n        NUMBER: this.FLOAT    \n    });\n};/**\n * @class Ext.data.JsonWriter\n * @extends Ext.data.DataWriter\n * DataWriter extension for writing an array or single {@link Ext.data.Record} object(s) in preparation for executing a remote CRUD action.\n */\nExt.data.JsonWriter = Ext.extend(Ext.data.DataWriter, {\n    /**\n     * @cfg {Boolean} encode <p><tt>true</tt> to {@link Ext.util.JSON#encode JSON encode} the\n     * {@link Ext.data.DataWriter#toHash hashed data} into a standard HTTP parameter named after this\n     * Reader's <code>meta.root</code> property which, by default is imported from the associated Reader. Defaults to <tt>true</tt>.</p>\n     * <p>If set to <code>false</code>, the hashed data is {@link Ext.util.JSON#encode JSON encoded}, along with\n     * the associated {@link Ext.data.Store}'s {@link Ext.data.Store#baseParams baseParams}, into the POST body.</p>\n     * <p>When using {@link Ext.data.DirectProxy}, set this to <tt>false</tt> since Ext.Direct.JsonProvider will perform\n     * its own json-encoding.  In addition, if you're using {@link Ext.data.HttpProxy}, setting to <tt>false</tt>\n     * will cause HttpProxy to transmit data using the <b>jsonData</b> configuration-params of {@link Ext.Ajax#request}\n     * instead of <b>params</b>.</p>\n     * <p>When using a {@link Ext.data.Store#restful} Store, some serverside frameworks are\n     * tuned to expect data through the jsonData mechanism.  In those cases, one will want to set <b>encode: <tt>false</tt></b>, as in\n     * let the lower-level connection object (eg: Ext.Ajax) do the encoding.</p>\n     */\n    encode : true,\n    /**\n     * @cfg {Boolean} encodeDelete False to send only the id to the server on delete, true to encode it in an object\n     * literal, eg: <pre><code>\n{id: 1}\n * </code></pre> Defaults to <tt>false</tt>\n     */\n    encodeDelete: false,\n    \n    constructor : function(config){\n        Ext.data.JsonWriter.superclass.constructor.call(this, config);    \n    },\n\n    /**\n     * <p>This method should not need to be called by application code, however it may be useful on occasion to\n     * override it, or augment it with an {@link Function#createInterceptor interceptor} or {@link Function#createSequence sequence}.</p>\n     * <p>The provided implementation encodes the serialized data representing the Store's modified Records into the Ajax request's\n     * <code>params</code> according to the <code>{@link #encode}</code> setting.</p>\n     * @param {Object} Ajax request params object to write into.\n     * @param {Object} baseParams as defined by {@link Ext.data.Store#baseParams}.  The baseParms must be encoded by the extending class, eg: {@link Ext.data.JsonWriter}, {@link Ext.data.XmlWriter}.\n     * @param {Object/Object[]} data Data object representing the serialized modified records from the Store. May be either a single object,\n     * or an Array of objects - user implementations must handle both cases.\n     */\n    render : function(params, baseParams, data) {\n        if (this.encode === true) {\n            // Encode here now.\n            Ext.apply(params, baseParams);\n            params[this.meta.root] = Ext.encode(data);\n        } else {\n            // defer encoding for some other layer, probably in {@link Ext.Ajax#request}.  Place everything into \"jsonData\" key.\n            var jdata = Ext.apply({}, baseParams);\n            jdata[this.meta.root] = data;\n            params.jsonData = jdata;\n        }\n    },\n    /**\n     * Implements abstract Ext.data.DataWriter#createRecord\n     * @protected\n     * @param {Ext.data.Record} rec\n     * @return {Object}\n     */\n    createRecord : function(rec) {\n       return this.toHash(rec);\n    },\n    /**\n     * Implements abstract Ext.data.DataWriter#updateRecord\n     * @protected\n     * @param {Ext.data.Record} rec\n     * @return {Object}\n     */\n    updateRecord : function(rec) {\n        return this.toHash(rec);\n\n    },\n    /**\n     * Implements abstract Ext.data.DataWriter#destroyRecord\n     * @protected\n     * @param {Ext.data.Record} rec\n     * @return {Object}\n     */\n    destroyRecord : function(rec){\n        if(this.encodeDelete){\n            var data = {};\n            data[this.meta.idProperty] = rec.id;\n            return data;\n        }else{\n            return rec.id;\n        }\n    }\n});/**\n * @class Ext.data.JsonReader\n * @extends Ext.data.DataReader\n * <p>Data reader class to create an Array of {@link Ext.data.Record} objects\n * from a JSON packet based on mappings in a provided {@link Ext.data.Record}\n * constructor.</p>\n * <p>Example code:</p>\n * <pre><code>\nvar myReader = new Ext.data.JsonReader({\n    // metadata configuration options:\n    {@link #idProperty}: 'id'\n    {@link #root}: 'rows',\n    {@link #totalProperty}: 'results',\n    {@link Ext.data.DataReader#messageProperty}: \"msg\"  // The element within the response that provides a user-feedback message (optional)\n\n    // the fields config option will internally create an {@link Ext.data.Record}\n    // constructor that provides mapping for reading the record data objects\n    {@link Ext.data.DataReader#fields fields}: [\n        // map Record&#39;s 'firstname' field to data object&#39;s key of same name\n        {name: 'name', mapping: 'firstname'},\n        // map Record&#39;s 'job' field to data object&#39;s 'occupation' key\n        {name: 'job', mapping: 'occupation'}\n    ]\n});\n</code></pre>\n * <p>This would consume a JSON data object of the form:</p><pre><code>\n{\n    results: 2000, // Reader&#39;s configured {@link #totalProperty}\n    rows: [        // Reader&#39;s configured {@link #root}\n        // record data objects:\n        { {@link #idProperty id}: 1, firstname: 'Bill', occupation: 'Gardener' },\n        { {@link #idProperty id}: 2, firstname: 'Ben' , occupation: 'Horticulturalist' },\n        ...\n    ]\n}\n</code></pre>\n * <p><b><u>Automatic configuration using metaData</u></b></p>\n * <p>It is possible to change a JsonReader's metadata at any time by including\n * a <b><tt>metaData</tt></b> property in the JSON data object. If the JSON data\n * object has a <b><tt>metaData</tt></b> property, a {@link Ext.data.Store Store}\n * object using this Reader will reconfigure itself to use the newly provided\n * field definition and fire its {@link Ext.data.Store#metachange metachange}\n * event. The metachange event handler may interrogate the <b><tt>metaData</tt></b>\n * property to perform any configuration required.</p>\n * <p>Note that reconfiguring a Store potentially invalidates objects which may\n * refer to Fields or Records which no longer exist.</p>\n * <p>To use this facility you would create the JsonReader like this:</p><pre><code>\nvar myReader = new Ext.data.JsonReader();\n</code></pre>\n * <p>The first data packet from the server would configure the reader by\n * containing a <b><tt>metaData</tt></b> property <b>and</b> the data. For\n * example, the JSON data object might take the form:</p><pre><code>\n{\n    metaData: {\n        \"{@link #idProperty}\": \"id\",\n        \"{@link #root}\": \"rows\",\n        \"{@link #totalProperty}\": \"results\"\n        \"{@link #successProperty}\": \"success\",\n        \"{@link Ext.data.DataReader#fields fields}\": [\n            {\"name\": \"name\"},\n            {\"name\": \"job\", \"mapping\": \"occupation\"}\n        ],\n        // used by store to set its sortInfo\n        \"sortInfo\":{\n           \"field\": \"name\",\n           \"direction\": \"ASC\"\n        },\n        // {@link Ext.PagingToolbar paging data} (if applicable)\n        \"start\": 0,\n        \"limit\": 2,\n        // custom property\n        \"foo\": \"bar\"\n    },\n    // Reader&#39;s configured {@link #successProperty}\n    \"success\": true,\n    // Reader&#39;s configured {@link #totalProperty}\n    \"results\": 2000,\n    // Reader&#39;s configured {@link #root}\n    // (this data simulates 2 results {@link Ext.PagingToolbar per page})\n    \"rows\": [ // <b>*Note:</b> this must be an Array\n        { \"id\": 1, \"name\": \"Bill\", \"occupation\": \"Gardener\" },\n        { \"id\": 2, \"name\":  \"Ben\", \"occupation\": \"Horticulturalist\" }\n    ]\n}\n * </code></pre>\n * <p>The <b><tt>metaData</tt></b> property in the JSON data object should contain:</p>\n * <div class=\"mdetail-params\"><ul>\n * <li>any of the configuration options for this class</li>\n * <li>a <b><tt>{@link Ext.data.Record#fields fields}</tt></b> property which\n * the JsonReader will use as an argument to the\n * {@link Ext.data.Record#create data Record create method} in order to\n * configure the layout of the Records it will produce.</li>\n * <li>a <b><tt>{@link Ext.data.Store#sortInfo sortInfo}</tt></b> property\n * which the JsonReader will use to set the {@link Ext.data.Store}'s\n * {@link Ext.data.Store#sortInfo sortInfo} property</li>\n * <li>any custom properties needed</li>\n * </ul></div>\n *\n * @constructor\n * Create a new JsonReader\n * @param {Object} meta Metadata configuration options.\n * @param {Array/Object} recordType\n * <p>Either an Array of {@link Ext.data.Field Field} definition objects (which\n * will be passed to {@link Ext.data.Record#create}, or a {@link Ext.data.Record Record}\n * constructor created from {@link Ext.data.Record#create}.</p>\n */\nExt.data.JsonReader = function(meta, recordType){\n    meta = meta || {};\n    /**\n     * @cfg {String} idProperty [id] Name of the property within a row object\n     * that contains a record identifier value.  Defaults to <tt>id</tt>\n     */\n    /**\n     * @cfg {String} successProperty [success] Name of the property from which to\n     * retrieve the success attribute. Defaults to <tt>success</tt>.  See\n     * {@link Ext.data.DataProxy}.{@link Ext.data.DataProxy#exception exception}\n     * for additional information.\n     */\n    /**\n     * @cfg {String} totalProperty [total] Name of the property from which to\n     * retrieve the total number of records in the dataset. This is only needed\n     * if the whole dataset is not passed in one go, but is being paged from\n     * the remote server.  Defaults to <tt>total</tt>.\n     */\n    /**\n     * @cfg {String} root [undefined] <b>Required</b>.  The name of the property\n     * which contains the Array of row objects.  Defaults to <tt>undefined</tt>.\n     * An exception will be thrown if the root property is undefined. The data\n     * packet value for this property should be an empty array to clear the data\n     * or show no data.\n     */\n    Ext.applyIf(meta, {\n        idProperty: 'id',\n        successProperty: 'success',\n        totalProperty: 'total'\n    });\n\n    Ext.data.JsonReader.superclass.constructor.call(this, meta, recordType || meta.fields);\n};\nExt.extend(Ext.data.JsonReader, Ext.data.DataReader, {\n    /**\n     * This JsonReader's metadata as passed to the constructor, or as passed in\n     * the last data packet's <b><tt>metaData</tt></b> property.\n     * @type Mixed\n     * @property meta\n     */\n    /**\n     * This method is only used by a DataProxy which has retrieved data from a remote server.\n     * @param {Object} response The XHR object which contains the JSON data in its responseText.\n     * @return {Object} data A data block which is used by an Ext.data.Store object as\n     * a cache of Ext.data.Records.\n     */\n    read : function(response){\n        var json = response.responseText;\n        var o = Ext.decode(json);\n        if(!o) {\n            throw {message: 'JsonReader.read: Json object not found'};\n        }\n        return this.readRecords(o);\n    },\n\n    /*\n     * TODO: refactor code between JsonReader#readRecords, #readResponse into 1 method.\n     * there's ugly duplication going on due to maintaining backwards compat. with 2.0.  It's time to do this.\n     */\n    /**\n     * Decode a JSON response from server.\n     * @param {String} action [Ext.data.Api.actions.create|read|update|destroy]\n     * @param {Object} response The XHR object returned through an Ajax server request.\n     * @return {Response} A {@link Ext.data.Response Response} object containing the data response, and also status information.\n     */\n    readResponse : function(action, response) {\n        var o = (response.responseText !== undefined) ? Ext.decode(response.responseText) : response;\n        if(!o) {\n            throw new Ext.data.JsonReader.Error('response');\n        }\n\n        var root = this.getRoot(o),\n            success = this.getSuccess(o);\n        if (success && action === Ext.data.Api.actions.create) {\n            var def = Ext.isDefined(root);\n            if (def && Ext.isEmpty(root)) {\n                throw new Ext.data.JsonReader.Error('root-empty', this.meta.root);\n            }\n            else if (!def) {\n                throw new Ext.data.JsonReader.Error('root-undefined-response', this.meta.root);\n            }\n        }\n\n        // instantiate response object\n        var res = new Ext.data.Response({\n            action: action,\n            success: success,\n            data: (root) ? this.extractData(root, false) : [],\n            message: this.getMessage(o),\n            raw: o\n        });\n\n        // blow up if no successProperty\n        if (Ext.isEmpty(res.success)) {\n            throw new Ext.data.JsonReader.Error('successProperty-response', this.meta.successProperty);\n        }\n        return res;\n    },\n\n    /**\n     * Create a data block containing Ext.data.Records from a JSON object.\n     * @param {Object} o An object which contains an Array of row objects in the property specified\n     * in the config as 'root, and optionally a property, specified in the config as 'totalProperty'\n     * which contains the total size of the dataset.\n     * @return {Object} data A data block which is used by an Ext.data.Store object as\n     * a cache of Ext.data.Records.\n     */\n    readRecords : function(o){\n        /**\n         * After any data loads, the raw JSON data is available for further custom processing.  If no data is\n         * loaded or there is a load exception this property will be undefined.\n         * @type Object\n         */\n        this.jsonData = o;\n        if(o.metaData){\n            this.onMetaChange(o.metaData);\n        }\n        var s = this.meta, Record = this.recordType,\n            f = Record.prototype.fields, fi = f.items, fl = f.length, v;\n\n        var root = this.getRoot(o), c = root.length, totalRecords = c, success = true;\n        if(s.totalProperty){\n            v = parseInt(this.getTotal(o), 10);\n            if(!isNaN(v)){\n                totalRecords = v;\n            }\n        }\n        if(s.successProperty){\n            v = this.getSuccess(o);\n            if(v === false || v === 'false'){\n                success = false;\n            }\n        }\n\n        // TODO return Ext.data.Response instance instead.  @see #readResponse\n        return {\n            success : success,\n            records : this.extractData(root, true), // <-- true to return [Ext.data.Record]\n            totalRecords : totalRecords\n        };\n    },\n\n    // private\n    buildExtractors : function() {\n        if(this.ef){\n            return;\n        }\n        var s = this.meta, Record = this.recordType,\n            f = Record.prototype.fields, fi = f.items, fl = f.length;\n\n        if(s.totalProperty) {\n            this.getTotal = this.createAccessor(s.totalProperty);\n        }\n        if(s.successProperty) {\n            this.getSuccess = this.createAccessor(s.successProperty);\n        }\n        if (s.messageProperty) {\n            this.getMessage = this.createAccessor(s.messageProperty);\n        }\n        this.getRoot = s.root ? this.createAccessor(s.root) : function(p){return p;};\n        if (s.id || s.idProperty) {\n            var g = this.createAccessor(s.id || s.idProperty);\n            this.getId = function(rec) {\n                var r = g(rec);\n                return (r === undefined || r === '') ? null : r;\n            };\n        } else {\n            this.getId = function(){return null;};\n        }\n        var ef = [];\n        for(var i = 0; i < fl; i++){\n            f = fi[i];\n            var map = (f.mapping !== undefined && f.mapping !== null) ? f.mapping : f.name;\n            ef.push(this.createAccessor(map));\n        }\n        this.ef = ef;\n    },\n\n    /**\n     * @ignore\n     * TODO This isn't used anywhere??  Don't we want to use this where possible instead of complex #createAccessor?\n     */\n    simpleAccess : function(obj, subsc) {\n        return obj[subsc];\n    },\n\n    /**\n     * @ignore\n     */\n    createAccessor : function(){\n        var re = /[\\[\\.]/;\n        return function(expr) {\n            if(Ext.isEmpty(expr)){\n                return Ext.emptyFn;\n            }\n            if(Ext.isFunction(expr)){\n                return expr;\n            }\n            var i = String(expr).search(re);\n            if(i >= 0){\n                return new Function('obj', 'return obj' + (i > 0 ? '.' : '') + expr);\n            }\n            return function(obj){\n                return obj[expr];\n            };\n\n        };\n    }(),\n\n    /**\n     * type-casts a single row of raw-data from server\n     * @param {Object} data\n     * @param {Array} items\n     * @param {Integer} len\n     * @private\n     */\n    extractValues : function(data, items, len) {\n        var f, values = {};\n        for(var j = 0; j < len; j++){\n            f = items[j];\n            var v = this.ef[j](data);\n            values[f.name] = f.convert((v !== undefined) ? v : f.defaultValue, data);\n        }\n        return values;\n    }\n});\n\n/**\n * @class Ext.data.JsonReader.Error\n * Error class for JsonReader\n */\nExt.data.JsonReader.Error = Ext.extend(Ext.Error, {\n    constructor : function(message, arg) {\n        this.arg = arg;\n        Ext.Error.call(this, message);\n    },\n    name : 'Ext.data.JsonReader'\n});\nExt.apply(Ext.data.JsonReader.Error.prototype, {\n    lang: {\n        'response': 'An error occurred while json-decoding your server response',\n        'successProperty-response': 'Could not locate your \"successProperty\" in your server response.  Please review your JsonReader config to ensure the config-property \"successProperty\" matches the property in your server-response.  See the JsonReader docs.',\n        'root-undefined-config': 'Your JsonReader was configured without a \"root\" property.  Please review your JsonReader config and make sure to define the root property.  See the JsonReader docs.',\n        'idProperty-undefined' : 'Your JsonReader was configured without an \"idProperty\"  Please review your JsonReader configuration and ensure the \"idProperty\" is set (e.g.: \"id\").  See the JsonReader docs.',\n        'root-empty': 'Data was expected to be returned by the server in the \"root\" property of the response.  Please review your JsonReader configuration to ensure the \"root\" property matches that returned in the server-response.  See JsonReader docs.'\n    }\n});\n/**\n * @class Ext.data.ArrayReader\n * @extends Ext.data.JsonReader\n * <p>Data reader class to create an Array of {@link Ext.data.Record} objects from an Array.\n * Each element of that Array represents a row of data fields. The\n * fields are pulled into a Record object using as a subscript, the <code>mapping</code> property\n * of the field definition if it exists, or the field's ordinal position in the definition.</p>\n * <p>Example code:</p>\n * <pre><code>\nvar Employee = Ext.data.Record.create([\n    {name: 'name', mapping: 1},         // \"mapping\" only needed if an \"id\" field is present which\n    {name: 'occupation', mapping: 2}    // precludes using the ordinal position as the index.\n]);\nvar myReader = new Ext.data.ArrayReader({\n    {@link #idIndex}: 0\n}, Employee);\n</code></pre>\n * <p>This would consume an Array like this:</p>\n * <pre><code>\n[ [1, 'Bill', 'Gardener'], [2, 'Ben', 'Horticulturalist'] ]\n * </code></pre>\n * @constructor\n * Create a new ArrayReader\n * @param {Object} meta Metadata configuration options.\n * @param {Array/Object} recordType\n * <p>Either an Array of {@link Ext.data.Field Field} definition objects (which\n * will be passed to {@link Ext.data.Record#create}, or a {@link Ext.data.Record Record}\n * constructor created from {@link Ext.data.Record#create}.</p>\n */\nExt.data.ArrayReader = Ext.extend(Ext.data.JsonReader, {\n    /**\n     * @cfg {String} successProperty\n     * @hide\n     */\n    /**\n     * @cfg {Number} id (optional) The subscript within row Array that provides an ID for the Record.\n     * Deprecated. Use {@link #idIndex} instead.\n     */\n    /**\n     * @cfg {Number} idIndex (optional) The subscript within row Array that provides an ID for the Record.\n     */\n    /**\n     * Create a data block containing Ext.data.Records from an Array.\n     * @param {Object} o An Array of row objects which represents the dataset.\n     * @return {Object} data A data block which is used by an Ext.data.Store object as\n     * a cache of Ext.data.Records.\n     */\n    readRecords : function(o){\n        this.arrayData = o;\n        var s = this.meta,\n            sid = s ? Ext.num(s.idIndex, s.id) : null,\n            recordType = this.recordType,\n            fields = recordType.prototype.fields,\n            records = [],\n            success = true,\n            v;\n\n        var root = this.getRoot(o);\n\n        for(var i = 0, len = root.length; i < len; i++) {\n            var n = root[i],\n                values = {},\n                id = ((sid || sid === 0) && n[sid] !== undefined && n[sid] !== \"\" ? n[sid] : null);\n            for(var j = 0, jlen = fields.length; j < jlen; j++) {\n                var f = fields.items[j],\n                    k = f.mapping !== undefined && f.mapping !== null ? f.mapping : j;\n                v = n[k] !== undefined ? n[k] : f.defaultValue;\n                v = f.convert(v, n);\n                values[f.name] = v;\n            }\n            var record = new recordType(values, id);\n            record.json = n;\n            records[records.length] = record;\n        }\n\n        var totalRecords = records.length;\n\n        if(s.totalProperty) {\n            v = parseInt(this.getTotal(o), 10);\n            if(!isNaN(v)) {\n                totalRecords = v;\n            }\n        }\n        if(s.successProperty){\n            v = this.getSuccess(o);\n            if(v === false || v === 'false'){\n                success = false;\n            }\n        }\n\n        return {\n            success : success,\n            records : records,\n            totalRecords : totalRecords\n        };\n    }\n});/**\n * @class Ext.data.ArrayStore\n * @extends Ext.data.Store\n * <p>Formerly known as \"SimpleStore\".</p>\n * <p>Small helper class to make creating {@link Ext.data.Store}s from Array data easier.\n * An ArrayStore will be automatically configured with a {@link Ext.data.ArrayReader}.</p>\n * <p>A store configuration would be something like:<pre><code>\nvar store = new Ext.data.ArrayStore({\n    // store configs\n    autoDestroy: true,\n    storeId: 'myStore',\n    // reader configs\n    idIndex: 0,  \n    fields: [\n       'company',\n       {name: 'price', type: 'float'},\n       {name: 'change', type: 'float'},\n       {name: 'pctChange', type: 'float'},\n       {name: 'lastChange', type: 'date', dateFormat: 'n/j h:ia'}\n    ]\n});\n * </code></pre></p>\n * <p>This store is configured to consume a returned object of the form:<pre><code>\nvar myData = [\n    ['3m Co',71.72,0.02,0.03,'9/1 12:00am'],\n    ['Alcoa Inc',29.01,0.42,1.47,'9/1 12:00am'],\n    ['Boeing Co.',75.43,0.53,0.71,'9/1 12:00am'],\n    ['Hewlett-Packard Co.',36.53,-0.03,-0.08,'9/1 12:00am'],\n    ['Wal-Mart Stores, Inc.',45.45,0.73,1.63,'9/1 12:00am']\n];\n * </code></pre>\n * An object literal of this form could also be used as the {@link #data} config option.</p>\n * <p><b>*Note:</b> Although not listed here, this class accepts all of the configuration options of \n * <b>{@link Ext.data.ArrayReader ArrayReader}</b>.</p>\n * @constructor\n * @param {Object} config\n * @xtype arraystore\n */\nExt.data.ArrayStore = Ext.extend(Ext.data.Store, {\n    /**\n     * @cfg {Ext.data.DataReader} reader @hide\n     */\n    constructor: function(config){\n        Ext.data.ArrayStore.superclass.constructor.call(this, Ext.apply(config, {\n            reader: new Ext.data.ArrayReader(config)\n        }));\n    },\n\n    loadData : function(data, append){\n        if(this.expandData === true){\n            var r = [];\n            for(var i = 0, len = data.length; i < len; i++){\n                r[r.length] = [data[i]];\n            }\n            data = r;\n        }\n        Ext.data.ArrayStore.superclass.loadData.call(this, data, append);\n    }\n});\nExt.reg('arraystore', Ext.data.ArrayStore);\n\n// backwards compat\nExt.data.SimpleStore = Ext.data.ArrayStore;\nExt.reg('simplestore', Ext.data.SimpleStore);/**\n * @class Ext.data.JsonStore\n * @extends Ext.data.Store\n * <p>Small helper class to make creating {@link Ext.data.Store}s from JSON data easier.\n * A JsonStore will be automatically configured with a {@link Ext.data.JsonReader}.</p>\n * <p>A store configuration would be something like:<pre><code>\nvar store = new Ext.data.JsonStore({\n    // store configs\n    autoDestroy: true,\n    url: 'get-images.php',\n    storeId: 'myStore',\n    // reader configs\n    root: 'images',\n    idProperty: 'name',\n    fields: ['name', 'url', {name:'size', type: 'float'}, {name:'lastmod', type:'date'}]\n});\n * </code></pre></p>\n * <p>This store is configured to consume a returned object of the form:<pre><code>\n{\n    images: [\n        {name: 'Image one', url:'/GetImage.php?id=1', size:46.5, lastmod: new Date(2007, 10, 29)},\n        {name: 'Image Two', url:'/GetImage.php?id=2', size:43.2, lastmod: new Date(2007, 10, 30)}\n    ]\n}\n * </code></pre>\n * An object literal of this form could also be used as the {@link #data} config option.</p>\n * <p><b>*Note:</b> Although not listed here, this class accepts all of the configuration options of\n * <b>{@link Ext.data.JsonReader JsonReader}</b>.</p>\n * @constructor\n * @param {Object} config\n * @xtype jsonstore\n */\nExt.data.JsonStore = Ext.extend(Ext.data.Store, {\n    /**\n     * @cfg {Ext.data.DataReader} reader @hide\n     */\n    constructor: function(config){\n        Ext.data.JsonStore.superclass.constructor.call(this, Ext.apply(config, {\n            reader: new Ext.data.JsonReader(config)\n        }));\n    }\n});\nExt.reg('jsonstore', Ext.data.JsonStore);/**\n * @class Ext.data.XmlWriter\n * @extends Ext.data.DataWriter\n * DataWriter extension for writing an array or single {@link Ext.data.Record} object(s) in preparation for executing a remote CRUD action via XML.\n * XmlWriter uses an instance of {@link Ext.XTemplate} for maximum flexibility in defining your own custom XML schema if the default schema is not appropriate for your needs.\n * See the {@link #tpl} configuration-property.\n */\nExt.data.XmlWriter = function(params) {\n    Ext.data.XmlWriter.superclass.constructor.apply(this, arguments);\n    // compile the XTemplate for rendering XML documents.\n    this.tpl = (typeof(this.tpl) === 'string') ? new Ext.XTemplate(this.tpl).compile() : this.tpl.compile();\n};\nExt.extend(Ext.data.XmlWriter, Ext.data.DataWriter, {\n    /**\n     * @cfg {String} documentRoot [xrequest] (Optional) The name of the XML document root-node.  <b>Note:</b>\n     * this parameter is required </b>only when</b> sending extra {@link Ext.data.Store#baseParams baseParams} to the server\n     * during a write-request -- if no baseParams are set, the {@link Ext.data.XmlReader#record} meta-property can\n     * suffice as the XML document root-node for write-actions involving just a <b>single record</b>.  For requests\n     * involving <b>multiple</b> records and <b>NO</b> baseParams, the {@link Ext.data.XmlWriter#root} property can\n     * act as the XML document root.\n     */\n    documentRoot: 'xrequest',\n    /**\n     * @cfg {Boolean} forceDocumentRoot [false] Set to <tt>true</tt> to force XML documents having a root-node as defined\n     * by {@link #documentRoot}, even with no baseParams defined.\n     */\n    forceDocumentRoot: false,\n    /**\n     * @cfg {String} root [records] The name of the containing element which will contain the nodes of an write-action involving <b>multiple</b> records.  Each\n     * xml-record written to the server will be wrapped in an element named after {@link Ext.data.XmlReader#record} property.\n     * eg:\n<code><pre>\n&lt;?xml version=\"1.0\" encoding=\"UTF-8\"?>\n&lt;user>&lt;first>Barney&lt;/first>&lt;/user>\n</code></pre>\n     * However, when <b>multiple</b> records are written in a batch-operation, these records must be wrapped in a containing\n     * Element.\n     * eg:\n<code><pre>\n&lt;?xml version=\"1.0\" encoding=\"UTF-8\"?>\n    &lt;records>\n        &lt;first>Barney&lt;/first>&lt;/user>\n        &lt;records>&lt;first>Barney&lt;/first>&lt;/user>\n    &lt;/records>\n</code></pre>\n     * Defaults to <tt>records</tt>.  Do not confuse the nature of this property with that of {@link #documentRoot}\n     */\n    root: 'records',\n    /**\n     * @cfg {String} xmlVersion [1.0] The <tt>version</tt> written to header of xml documents.\n<code><pre>&lt;?xml version=\"1.0\" encoding=\"ISO-8859-15\"?></pre></code>\n     */\n    xmlVersion : '1.0',\n    /**\n     * @cfg {String} xmlEncoding [ISO-8859-15] The <tt>encoding</tt> written to header of xml documents.\n<code><pre>&lt;?xml version=\"1.0\" encoding=\"ISO-8859-15\"?></pre></code>\n     */\n    xmlEncoding: 'ISO-8859-15',\n    /**\n     * @cfg {String/Ext.XTemplate} tpl The XML template used to render {@link Ext.data.Api#actions write-actions} to your server.\n     * <p>One can easily provide his/her own custom {@link Ext.XTemplate#constructor template-definition} if the default does not suffice.</p>\n     * <p>Defaults to:</p>\n<code><pre>\n&lt;?xml version=\"{version}\" encoding=\"{encoding}\"?>\n    &lt;tpl if=\"documentRoot\">&lt;{documentRoot}>\n    &lt;tpl for=\"baseParams\">\n        &lt;tpl for=\".\">\n            &lt;{name}>{value}&lt;/{name}>\n        &lt;/tpl>\n    &lt;/tpl>\n    &lt;tpl if=\"records.length &gt; 1\">&lt;{root}>',\n    &lt;tpl for=\"records\">\n        &lt;{parent.record}>\n        &lt;tpl for=\".\">\n            &lt;{name}>{value}&lt;/{name}>\n        &lt;/tpl>\n        &lt;/{parent.record}>\n    &lt;/tpl>\n    &lt;tpl if=\"records.length &gt; 1\">&lt;/{root}>&lt;/tpl>\n    &lt;tpl if=\"documentRoot\">&lt;/{documentRoot}>&lt;/tpl>\n</pre></code>\n     * <p>Templates will be called with the following API</p>\n     * <ul>\n     * <li>{String} version [1.0] The xml version.</li>\n     * <li>{String} encoding [ISO-8859-15] The xml encoding.</li>\n     * <li>{String/false} documentRoot The XML document root-node name or <tt>false</tt> if not required.  See {@link #documentRoot} and {@link #forceDocumentRoot}.</li>\n     * <li>{String} record The meta-data parameter defined on your {@link Ext.data.XmlReader#record} configuration represents the name of the xml-tag containing each record.</li>\n     * <li>{String} root The meta-data parameter defined by {@link Ext.data.XmlWriter#root} configuration-parameter.  Represents the name of the xml root-tag when sending <b>multiple</b> records to the server.</li>\n     * <li>{Array} records The records being sent to the server, ie: the subject of the write-action being performed.  The records parameter will be always be an array, even when only a single record is being acted upon.\n     *     Each item within the records array will contain an array of field objects having the following properties:\n     *     <ul>\n     *         <li>{String} name The field-name of the record as defined by your {@link Ext.data.Record#create Ext.data.Record definition}.  The \"mapping\" property will be used, otherwise it will match the \"name\" property.  Use this parameter to define the XML tag-name of the property.</li>\n     *         <li>{Mixed} value The record value of the field enclosed within XML tags specified by name property above.</li>\n     *     </ul></li>\n     * <li>{Array} baseParams.  The baseParams as defined upon {@link Ext.data.Store#baseParams}.  Note that the baseParams have been converted into an array of [{name : \"foo\", value: \"bar\"}, ...] pairs in the same manner as the <b>records</b> parameter above.  See {@link #documentRoot} and {@link #forceDocumentRoot}.</li>\n     * </ul>\n     */\n    // Encoding the ? here in case it's being included by some kind of page that will parse it (eg. PHP)\n    tpl: '<tpl for=\".\"><\\u003fxml version=\"{version}\" encoding=\"{encoding}\"\\u003f><tpl if=\"documentRoot\"><{documentRoot}><tpl for=\"baseParams\"><tpl for=\".\"><{name}>{value}</{name}></tpl></tpl></tpl><tpl if=\"records.length&gt;1\"><{root}></tpl><tpl for=\"records\"><{parent.record}><tpl for=\".\"><{name}>{value}</{name}></tpl></{parent.record}></tpl><tpl if=\"records.length&gt;1\"></{root}></tpl><tpl if=\"documentRoot\"></{documentRoot}></tpl></tpl>',\n\n\n    /**\n     * XmlWriter implementation of the final stage of a write action.\n     * @param {Object} params Transport-proxy's (eg: {@link Ext.Ajax#request}) params-object to write-to.\n     * @param {Object} baseParams as defined by {@link Ext.data.Store#baseParams}.  The baseParms must be encoded by the extending class, eg: {@link Ext.data.JsonWriter}, {@link Ext.data.XmlWriter}.\n     * @param {Object/Object[]} data Data-object representing the compiled Store-recordset.\n     */\n    render : function(params, baseParams, data) {\n        baseParams = this.toArray(baseParams);\n        params.xmlData = this.tpl.applyTemplate({\n            version: this.xmlVersion,\n            encoding: this.xmlEncoding,\n            documentRoot: (baseParams.length > 0 || this.forceDocumentRoot === true) ? this.documentRoot : false,\n            record: this.meta.record,\n            root: this.root,\n            baseParams: baseParams,\n            records: (Ext.isArray(data[0])) ? data : [data]\n        });\n    },\n\n    /**\n     * createRecord\n     * @protected\n     * @param {Ext.data.Record} rec\n     * @return {Array} Array of <tt>name:value</tt> pairs for attributes of the {@link Ext.data.Record}.  See {@link Ext.data.DataWriter#toHash}.\n     */\n    createRecord : function(rec) {\n        return this.toArray(this.toHash(rec));\n    },\n\n    /**\n     * updateRecord\n     * @protected\n     * @param {Ext.data.Record} rec\n     * @return {Array} Array of {name:value} pairs for attributes of the {@link Ext.data.Record}.  See {@link Ext.data.DataWriter#toHash}.\n     */\n    updateRecord : function(rec) {\n        return this.toArray(this.toHash(rec));\n\n    },\n    /**\n     * destroyRecord\n     * @protected\n     * @param {Ext.data.Record} rec\n     * @return {Array} Array containing a attribute-object (name/value pair) representing the {@link Ext.data.DataReader#idProperty idProperty}.\n     */\n    destroyRecord : function(rec) {\n        var data = {};\n        data[this.meta.idProperty] = rec.id;\n        return this.toArray(data);\n    }\n});\n/**\n * @class Ext.data.XmlReader\n * @extends Ext.data.DataReader\n * <p>Data reader class to create an Array of {@link Ext.data.Record} objects from an XML document\n * based on mappings in a provided {@link Ext.data.Record} constructor.</p>\n * <p><b>Note</b>: that in order for the browser to parse a returned XML document, the Content-Type\n * header in the HTTP response must be set to \"text/xml\" or \"application/xml\".</p>\n * <p>Example code:</p>\n * <pre><code>\nvar Employee = Ext.data.Record.create([\n   {name: 'name', mapping: 'name'},     // \"mapping\" property not needed if it is the same as \"name\"\n   {name: 'occupation'}                 // This field will use \"occupation\" as the mapping.\n]);\nvar myReader = new Ext.data.XmlReader({\n   totalProperty: \"results\", // The element which contains the total dataset size (optional)\n   record: \"row\",           // The repeated element which contains row information\n   idProperty: \"id\"         // The element within the row that provides an ID for the record (optional)\n   messageProperty: \"msg\"   // The element within the response that provides a user-feedback message (optional)\n}, Employee);\n</code></pre>\n * <p>\n * This would consume an XML file like this:\n * <pre><code>\n&lt;?xml version=\"1.0\" encoding=\"UTF-8\"?>\n&lt;dataset>\n &lt;results>2&lt;/results>\n &lt;row>\n   &lt;id>1&lt;/id>\n   &lt;name>Bill&lt;/name>\n   &lt;occupation>Gardener&lt;/occupation>\n &lt;/row>\n &lt;row>\n   &lt;id>2&lt;/id>\n   &lt;name>Ben&lt;/name>\n   &lt;occupation>Horticulturalist&lt;/occupation>\n &lt;/row>\n&lt;/dataset>\n</code></pre>\n * @cfg {String} totalProperty The DomQuery path from which to retrieve the total number of records\n * in the dataset. This is only needed if the whole dataset is not passed in one go, but is being\n * paged from the remote server.\n * @cfg {String} record The DomQuery path to the repeated element which contains record information.\n * @cfg {String} successProperty The DomQuery path to the success attribute used by forms.\n * @cfg {String} idPath The DomQuery path relative from the record element to the element that contains\n * a record identifier value.\n * @constructor\n * Create a new XmlReader.\n * @param {Object} meta Metadata configuration options\n * @param {Object} recordType Either an Array of field definition objects as passed to\n * {@link Ext.data.Record#create}, or a Record constructor object created using {@link Ext.data.Record#create}.\n */\nExt.data.XmlReader = function(meta, recordType){\n    meta = meta || {};\n\n    // backwards compat, convert idPath or id / success\n    Ext.applyIf(meta, {\n        idProperty: meta.idProperty || meta.idPath || meta.id,\n        successProperty: meta.successProperty || meta.success\n    });\n\n    Ext.data.XmlReader.superclass.constructor.call(this, meta, recordType || meta.fields);\n};\nExt.extend(Ext.data.XmlReader, Ext.data.DataReader, {\n    /**\n     * This method is only used by a DataProxy which has retrieved data from a remote server.\n     * @param {Object} response The XHR object which contains the parsed XML document.  The response is expected\n     * to contain a property called <tt>responseXML</tt> which refers to an XML document object.\n     * @return {Object} records A data block which is used by an {@link Ext.data.Store} as\n     * a cache of Ext.data.Records.\n     */\n    read : function(response){\n        var doc = response.responseXML;\n        if(!doc) {\n            throw {message: \"XmlReader.read: XML Document not available\"};\n        }\n        return this.readRecords(doc);\n    },\n\n    /**\n     * Create a data block containing Ext.data.Records from an XML document.\n     * @param {Object} doc A parsed XML document.\n     * @return {Object} records A data block which is used by an {@link Ext.data.Store} as\n     * a cache of Ext.data.Records.\n     */\n    readRecords : function(doc){\n        /**\n         * After any data loads/reads, the raw XML Document is available for further custom processing.\n         * @type XMLDocument\n         */\n        this.xmlData = doc;\n\n        var root    = doc.documentElement || doc,\n            q       = Ext.DomQuery,\n            totalRecords = 0,\n            success = true;\n\n        if(this.meta.totalProperty){\n            totalRecords = this.getTotal(root, 0);\n        }\n        if(this.meta.successProperty){\n            success = this.getSuccess(root);\n        }\n\n        var records = this.extractData(q.select(this.meta.record, root), true); // <-- true to return Ext.data.Record[]\n\n        // TODO return Ext.data.Response instance.  @see #readResponse\n        return {\n            success : success,\n            records : records,\n            totalRecords : totalRecords || records.length\n        };\n    },\n\n    /**\n     * Decode an XML response from server.\n     * @param {String} action [{@link Ext.data.Api#actions} create|read|update|destroy]\n     * @param {Object} response HTTP Response object from browser.\n     * @return {Ext.data.Response} An instance of {@link Ext.data.Response}\n     */\n    readResponse : function(action, response) {\n        var q = Ext.DomQuery,\n            doc = response.responseXML,\n            root = doc.documentElement || doc;\n\n        // create general Response instance.\n        var res = new Ext.data.Response({\n            action: action,\n            success : this.getSuccess(root),\n            message: this.getMessage(root),\n            data: this.extractData(q.select(this.meta.record, root) || q.select(this.meta.root, root), false),\n            raw: doc\n        });\n\n        if (Ext.isEmpty(res.success)) {\n            throw new Ext.data.DataReader.Error('successProperty-response', this.meta.successProperty);\n        }\n\n        // Create actions from a response having status 200 must return pk\n        if (action === Ext.data.Api.actions.create) {\n            var def = Ext.isDefined(res.data);\n            if (def && Ext.isEmpty(res.data)) {\n                throw new Ext.data.JsonReader.Error('root-empty', this.meta.root);\n            }\n            else if (!def) {\n                throw new Ext.data.JsonReader.Error('root-undefined-response', this.meta.root);\n            }\n        }\n        return res;\n    },\n\n    getSuccess : function() {\n        return true;\n    },\n\n    /**\n     * build response-data extractor functions.\n     * @private\n     * @ignore\n     */\n    buildExtractors : function() {\n        if(this.ef){\n            return;\n        }\n        var s       = this.meta,\n            Record  = this.recordType,\n            f       = Record.prototype.fields,\n            fi      = f.items,\n            fl      = f.length;\n\n        if(s.totalProperty) {\n            this.getTotal = this.createAccessor(s.totalProperty);\n        }\n        if(s.successProperty) {\n            this.getSuccess = this.createAccessor(s.successProperty);\n        }\n        if (s.messageProperty) {\n            this.getMessage = this.createAccessor(s.messageProperty);\n        }\n        this.getRoot = function(res) {\n            return (!Ext.isEmpty(res[this.meta.record])) ? res[this.meta.record] : res[this.meta.root];\n        };\n        if (s.idPath || s.idProperty) {\n            var g = this.createAccessor(s.idPath || s.idProperty);\n            this.getId = function(rec) {\n                var id = g(rec) || rec.id;\n                return (id === undefined || id === '') ? null : id;\n            };\n        } else {\n            this.getId = function(){return null;};\n        }\n        var ef = [];\n        for(var i = 0; i < fl; i++){\n            f = fi[i];\n            var map = (f.mapping !== undefined && f.mapping !== null) ? f.mapping : f.name;\n            ef.push(this.createAccessor(map));\n        }\n        this.ef = ef;\n    },\n\n    /**\n     * Creates a function to return some particular key of data from a response.\n     * @param {String} key\n     * @return {Function}\n     * @private\n     * @ignore\n     */\n    createAccessor : function(){\n        var q = Ext.DomQuery;\n        return function(key) {\n            if (Ext.isFunction(key)) {\n                return key;\n            }\n            switch(key) {\n                case this.meta.totalProperty:\n                    return function(root, def){\n                        return q.selectNumber(key, root, def);\n                    };\n                    break;\n                case this.meta.successProperty:\n                    return function(root, def) {\n                        var sv = q.selectValue(key, root, true);\n                        var success = sv !== false && sv !== 'false';\n                        return success;\n                    };\n                    break;\n                default:\n                    return function(root, def) {\n                        return q.selectValue(key, root, def);\n                    };\n                    break;\n            }\n        };\n    }(),\n\n    /**\n     * extracts values and type-casts a row of data from server, extracted by #extractData\n     * @param {Hash} data\n     * @param {Ext.data.Field[]} items\n     * @param {Number} len\n     * @private\n     * @ignore\n     */\n    extractValues : function(data, items, len) {\n        var f, values = {};\n        for(var j = 0; j < len; j++){\n            f = items[j];\n            var v = this.ef[j](data);\n            values[f.name] = f.convert((v !== undefined) ? v : f.defaultValue, data);\n        }\n        return values;\n    }\n});/**\n * @class Ext.data.XmlStore\n * @extends Ext.data.Store\n * <p>Small helper class to make creating {@link Ext.data.Store}s from XML data easier.\n * A XmlStore will be automatically configured with a {@link Ext.data.XmlReader}.</p>\n * <p>A store configuration would be something like:<pre><code>\nvar store = new Ext.data.XmlStore({\n    // store configs\n    autoDestroy: true,\n    storeId: 'myStore',\n    url: 'sheldon.xml', // automatically configures a HttpProxy\n    // reader configs\n    record: 'Item', // records will have an \"Item\" tag\n    idPath: 'ASIN',\n    totalRecords: '@TotalResults'\n    fields: [\n        // set up the fields mapping into the xml doc\n        // The first needs mapping, the others are very basic\n        {name: 'Author', mapping: 'ItemAttributes > Author'},\n        'Title', 'Manufacturer', 'ProductGroup'\n    ]\n});\n * </code></pre></p>\n * <p>This store is configured to consume a returned object of the form:<pre><code>\n&#60?xml version=\"1.0\" encoding=\"UTF-8\"?>\n&#60ItemSearchResponse xmlns=\"http://webservices.amazon.com/AWSECommerceService/2009-05-15\">\n    &#60Items>\n        &#60Request>\n            &#60IsValid>True&#60/IsValid>\n            &#60ItemSearchRequest>\n                &#60Author>Sidney Sheldon&#60/Author>\n                &#60SearchIndex>Books&#60/SearchIndex>\n            &#60/ItemSearchRequest>\n        &#60/Request>\n        &#60TotalResults>203&#60/TotalResults>\n        &#60TotalPages>21&#60/TotalPages>\n        &#60Item>\n            &#60ASIN>0446355453&#60/ASIN>\n            &#60DetailPageURL>\n                http://www.amazon.com/\n            &#60/DetailPageURL>\n            &#60ItemAttributes>\n                &#60Author>Sidney Sheldon&#60/Author>\n                &#60Manufacturer>Warner Books&#60/Manufacturer>\n                &#60ProductGroup>Book&#60/ProductGroup>\n                &#60Title>Master of the Game&#60/Title>\n            &#60/ItemAttributes>\n        &#60/Item>\n    &#60/Items>\n&#60/ItemSearchResponse>\n * </code></pre>\n * An object literal of this form could also be used as the {@link #data} config option.</p>\n * <p><b>Note:</b> Although not listed here, this class accepts all of the configuration options of \n * <b>{@link Ext.data.XmlReader XmlReader}</b>.</p>\n * @constructor\n * @param {Object} config\n * @xtype xmlstore\n */\nExt.data.XmlStore = Ext.extend(Ext.data.Store, {\n    /**\n     * @cfg {Ext.data.DataReader} reader @hide\n     */\n    constructor: function(config){\n        Ext.data.XmlStore.superclass.constructor.call(this, Ext.apply(config, {\n            reader: new Ext.data.XmlReader(config)\n        }));\n    }\n});\nExt.reg('xmlstore', Ext.data.XmlStore);/**\n * @class Ext.data.GroupingStore\n * @extends Ext.data.Store\n * A specialized store implementation that provides for grouping records by one of the available fields. This\n * is usually used in conjunction with an {@link Ext.grid.GroupingView} to provide the data model for\n * a grouped GridPanel.\n *\n * Internally, GroupingStore is simply a normal Store with multi sorting enabled from the start. The grouping field\n * and direction are always injected as the first sorter pair. GroupingView picks up on the configured groupField and\n * builds grid rows appropriately.\n *\n * @constructor\n * Creates a new GroupingStore.\n * @param {Object} config A config object containing the objects needed for the Store to access data,\n * and read the data into Records.\n * @xtype groupingstore\n */\nExt.data.GroupingStore = Ext.extend(Ext.data.Store, {\n\n    //inherit docs\n    constructor: function(config) {\n        config = config || {};\n\n        //We do some preprocessing here to massage the grouping + sorting options into a single\n        //multi sort array. If grouping and sorting options are both presented to the constructor,\n        //the sorters array consists of the grouping sorter object followed by the sorting sorter object\n        //see Ext.data.Store's sorting functions for details about how multi sorting works\n        this.hasMultiSort  = true;\n        this.multiSortInfo = this.multiSortInfo || {sorters: []};\n\n        var sorters    = this.multiSortInfo.sorters,\n            groupField = config.groupField || this.groupField,\n            sortInfo   = config.sortInfo || this.sortInfo,\n            groupDir   = config.groupDir || this.groupDir;\n\n        //add the grouping sorter object first\n        if(groupField){\n            sorters.push({\n                field    : groupField,\n                direction: groupDir\n            });\n        }\n\n        //add the sorting sorter object if it is present\n        if (sortInfo) {\n            sorters.push(sortInfo);\n        }\n\n        Ext.data.GroupingStore.superclass.constructor.call(this, config);\n\n        this.addEvents(\n          /**\n           * @event groupchange\n           * Fired whenever a call to store.groupBy successfully changes the grouping on the store\n           * @param {Ext.data.GroupingStore} store The grouping store\n           * @param {String} groupField The field that the store is now grouped by\n           */\n          'groupchange'\n        );\n\n        this.applyGroupField();\n    },\n\n    /**\n     * @cfg {String} groupField\n     * The field name by which to sort the store's data (defaults to '').\n     */\n    /**\n     * @cfg {Boolean} remoteGroup\n     * True if the grouping should apply on the server side, false if it is local only (defaults to false).  If the\n     * grouping is local, it can be applied immediately to the data.  If it is remote, then it will simply act as a\n     * helper, automatically sending the grouping field name as the 'groupBy' param with each XHR call.\n     */\n    remoteGroup : false,\n    /**\n     * @cfg {Boolean} groupOnSort\n     * True to sort the data on the grouping field when a grouping operation occurs, false to sort based on the\n     * existing sort info (defaults to false).\n     */\n    groupOnSort:false,\n\n    /**\n     * @cfg {String} groupDir\n     * The direction to sort the groups. Defaults to <tt>'ASC'</tt>.\n     */\n    groupDir : 'ASC',\n\n    /**\n     * Clears any existing grouping and refreshes the data using the default sort.\n     */\n    clearGrouping : function(){\n        this.groupField = false;\n\n        if(this.remoteGroup){\n            if(this.baseParams){\n                delete this.baseParams.groupBy;\n                delete this.baseParams.groupDir;\n            }\n            var lo = this.lastOptions;\n            if(lo && lo.params){\n                delete lo.params.groupBy;\n                delete lo.params.groupDir;\n            }\n\n            this.reload();\n        }else{\n            this.sort();\n            this.fireEvent('datachanged', this);\n        }\n    },\n\n    /**\n     * Groups the data by the specified field.\n     * @param {String} field The field name by which to sort the store's data\n     * @param {Boolean} forceRegroup (optional) True to force the group to be refreshed even if the field passed\n     * in is the same as the current grouping field, false to skip grouping on the same field (defaults to false)\n     */\n    groupBy : function(field, forceRegroup, direction) {\n        direction = direction ? (String(direction).toUpperCase() == 'DESC' ? 'DESC' : 'ASC') : this.groupDir;\n\n        if (this.groupField == field && this.groupDir == direction && !forceRegroup) {\n            return; // already grouped by this field\n        }\n\n        //check the contents of the first sorter. If the field matches the CURRENT groupField (before it is set to the new one),\n        //remove the sorter as it is actually the grouper. The new grouper is added back in by this.sort\n        var sorters = this.multiSortInfo.sorters;\n        if (sorters.length > 0 && sorters[0].field == this.groupField) {\n            sorters.shift();\n        }\n\n        this.groupField = field;\n        this.groupDir = direction;\n        this.applyGroupField();\n\n        var fireGroupEvent = function() {\n            this.fireEvent('groupchange', this, this.getGroupState());\n        };\n\n        if (this.groupOnSort) {\n            this.sort(field, direction);\n            fireGroupEvent.call(this);\n            return;\n        }\n\n        if (this.remoteGroup) {\n            this.on('load', fireGroupEvent, this, {single: true});\n            this.reload();\n        } else {\n            this.sort(sorters);\n            fireGroupEvent.call(this);\n        }\n    },\n\n    //GroupingStore always uses multisorting so we intercept calls to sort here to make sure that our grouping sorter object\n    //is always injected first.\n    sort : function(fieldName, dir) {\n        if (this.remoteSort) {\n            return Ext.data.GroupingStore.superclass.sort.call(this, fieldName, dir);\n        }\n\n        var sorters = [];\n\n        //cater for any existing valid arguments to this.sort, massage them into an array of sorter objects\n        if (Ext.isArray(arguments[0])) {\n            sorters = arguments[0];\n        } else if (fieldName == undefined) {\n            //we preserve the existing sortInfo here because this.sort is called after\n            //clearGrouping and there may be existing sorting\n            sorters = this.sortInfo ? [this.sortInfo] : [];\n        } else {\n            //TODO: this is lifted straight from Ext.data.Store's singleSort function. It should instead be\n            //refactored into a common method if possible\n            var field = this.fields.get(fieldName);\n            if (!field) return false;\n\n            var name       = field.name,\n                sortInfo   = this.sortInfo || null,\n                sortToggle = this.sortToggle ? this.sortToggle[name] : null;\n\n            if (!dir) {\n                if (sortInfo && sortInfo.field == name) { // toggle sort dir\n                    dir = (this.sortToggle[name] || 'ASC').toggle('ASC', 'DESC');\n                } else {\n                    dir = field.sortDir;\n                }\n            }\n\n            this.sortToggle[name] = dir;\n            this.sortInfo = {field: name, direction: dir};\n\n            sorters = [this.sortInfo];\n        }\n\n        //add the grouping sorter object as the first multisort sorter\n        if (this.groupField) {\n            sorters.unshift({direction: this.groupDir, field: this.groupField});\n        }\n\n        return this.multiSort.call(this, sorters, dir);\n    },\n\n    /**\n     * @private\n     * Saves the current grouping field and direction to this.baseParams and this.lastOptions.params\n     * if we're using remote grouping. Does not actually perform any grouping - just stores values\n     */\n    applyGroupField: function(){\n        if (this.remoteGroup) {\n            if(!this.baseParams){\n                this.baseParams = {};\n            }\n\n            Ext.apply(this.baseParams, {\n                groupBy : this.groupField,\n                groupDir: this.groupDir\n            });\n\n            var lo = this.lastOptions;\n            if (lo && lo.params) {\n                lo.params.groupDir = this.groupDir;\n\n                //this is deleted because of a bug reported at http://www.extjs.com/forum/showthread.php?t=82907\n                delete lo.params.groupBy;\n            }\n        }\n    },\n\n    /**\n     * @private\n     * TODO: This function is apparently never invoked anywhere in the framework. It has no documentation\n     * and should be considered for deletion\n     */\n    applyGrouping : function(alwaysFireChange){\n        if(this.groupField !== false){\n            this.groupBy(this.groupField, true, this.groupDir);\n            return true;\n        }else{\n            if(alwaysFireChange === true){\n                this.fireEvent('datachanged', this);\n            }\n            return false;\n        }\n    },\n\n    /**\n     * @private\n     * Returns the grouping field that should be used. If groupOnSort is used this will be sortInfo's field,\n     * otherwise it will be this.groupField\n     * @return {String} The group field\n     */\n    getGroupState : function(){\n        return this.groupOnSort && this.groupField !== false ?\n               (this.sortInfo ? this.sortInfo.field : undefined) : this.groupField;\n    }\n});\nExt.reg('groupingstore', Ext.data.GroupingStore);\n/**\n * @class Ext.data.DirectProxy\n * @extends Ext.data.DataProxy\n */\nExt.data.DirectProxy = function(config){\n    Ext.apply(this, config);\n    if(typeof this.paramOrder == 'string'){\n        this.paramOrder = this.paramOrder.split(/[\\s,|]/);\n    }\n    Ext.data.DirectProxy.superclass.constructor.call(this, config);\n};\n\nExt.extend(Ext.data.DirectProxy, Ext.data.DataProxy, {\n    /**\n     * @cfg {Array/String} paramOrder Defaults to <tt>undefined</tt>. A list of params to be executed\n     * server side.  Specify the params in the order in which they must be executed on the server-side\n     * as either (1) an Array of String values, or (2) a String of params delimited by either whitespace,\n     * comma, or pipe. For example,\n     * any of the following would be acceptable:<pre><code>\nparamOrder: ['param1','param2','param3']\nparamOrder: 'param1 param2 param3'\nparamOrder: 'param1,param2,param3'\nparamOrder: 'param1|param2|param'\n     </code></pre>\n     */\n    paramOrder: undefined,\n\n    /**\n     * @cfg {Boolean} paramsAsHash\n     * Send parameters as a collection of named arguments (defaults to <tt>true</tt>). Providing a\n     * <tt>{@link #paramOrder}</tt> nullifies this configuration.\n     */\n    paramsAsHash: true,\n\n    /**\n     * @cfg {Function} directFn\n     * Function to call when executing a request.  directFn is a simple alternative to defining the api configuration-parameter\n     * for Store's which will not implement a full CRUD api.\n     */\n    directFn : undefined,\n\n    /**\n     * DirectProxy implementation of {@link Ext.data.DataProxy#doRequest}\n     * @param {String} action The crud action type (create, read, update, destroy)\n     * @param {Ext.data.Record/Ext.data.Record[]} rs If action is load, rs will be null\n     * @param {Object} params An object containing properties which are to be used as HTTP parameters\n     * for the request to the remote server.\n     * @param {Ext.data.DataReader} reader The Reader object which converts the data\n     * object into a block of Ext.data.Records.\n     * @param {Function} callback\n     * <div class=\"sub-desc\"><p>A function to be called after the request.\n     * The <tt>callback</tt> is passed the following arguments:<ul>\n     * <li><tt>r</tt> : Ext.data.Record[] The block of Ext.data.Records.</li>\n     * <li><tt>options</tt>: Options object from the action request</li>\n     * <li><tt>success</tt>: Boolean success indicator</li></ul></p></div>\n     * @param {Object} scope The scope (<code>this</code> reference) in which the callback function is executed. Defaults to the browser window.\n     * @param {Object} arg An optional argument which is passed to the callback as its second parameter.\n     * @protected\n     */\n    doRequest : function(action, rs, params, reader, callback, scope, options) {\n        var args = [],\n            directFn = this.api[action] || this.directFn;\n\n        switch (action) {\n            case Ext.data.Api.actions.create:\n                args.push(params.jsonData);\t\t// <-- create(Hash)\n                break;\n            case Ext.data.Api.actions.read:\n                // If the method has no parameters, ignore the paramOrder/paramsAsHash.\n                if(directFn.directCfg.method.len > 0){\n                    if(this.paramOrder){\n                        for(var i = 0, len = this.paramOrder.length; i < len; i++){\n                            args.push(params[this.paramOrder[i]]);\n                        }\n                    }else if(this.paramsAsHash){\n                        args.push(params);\n                    }\n                }\n                break;\n            case Ext.data.Api.actions.update:\n                args.push(params.jsonData);        // <-- update(Hash/Hash[])\n                break;\n            case Ext.data.Api.actions.destroy:\n                args.push(params.jsonData);        // <-- destroy(Int/Int[])\n                break;\n        }\n\n        var trans = {\n            params : params || {},\n            request: {\n                callback : callback,\n                scope : scope,\n                arg : options\n            },\n            reader: reader\n        };\n\n        args.push(this.createCallback(action, rs, trans), this);\n        directFn.apply(window, args);\n    },\n\n    // private\n    createCallback : function(action, rs, trans) {\n        var me = this;\n        return function(result, res) {\n            if (!res.status) {\n                // @deprecated fire loadexception\n                if (action === Ext.data.Api.actions.read) {\n                    me.fireEvent(\"loadexception\", me, trans, res, null);\n                }\n                me.fireEvent('exception', me, 'remote', action, trans, res, null);\n                trans.request.callback.call(trans.request.scope, null, trans.request.arg, false);\n                return;\n            }\n            if (action === Ext.data.Api.actions.read) {\n                me.onRead(action, trans, result, res);\n            } else {\n                me.onWrite(action, trans, result, res, rs);\n            }\n        };\n    },\n\n    /**\n     * Callback for read actions\n     * @param {String} action [Ext.data.Api.actions.create|read|update|destroy]\n     * @param {Object} trans The request transaction object\n     * @param {Object} result Data object picked out of the server-response.\n     * @param {Object} res The server response\n     * @protected\n     */\n    onRead : function(action, trans, result, res) {\n        var records;\n        try {\n            records = trans.reader.readRecords(result);\n        }\n        catch (ex) {\n            // @deprecated: Fire old loadexception for backwards-compat.\n            this.fireEvent(\"loadexception\", this, trans, res, ex);\n\n            this.fireEvent('exception', this, 'response', action, trans, res, ex);\n            trans.request.callback.call(trans.request.scope, null, trans.request.arg, false);\n            return;\n        }\n        this.fireEvent(\"load\", this, res, trans.request.arg);\n        trans.request.callback.call(trans.request.scope, records, trans.request.arg, true);\n    },\n    /**\n     * Callback for write actions\n     * @param {String} action [{@link Ext.data.Api#actions create|read|update|destroy}]\n     * @param {Object} trans The request transaction object\n     * @param {Object} result Data object picked out of the server-response.\n     * @param {Object} res The server response\n     * @param {Ext.data.Record/Ext.data.Record[]} rs The Store resultset associated with the action.\n     * @protected\n     */\n    onWrite : function(action, trans, result, res, rs) {\n        var data = trans.reader.extractData(trans.reader.getRoot(result), false);\n        var success = trans.reader.getSuccess(result);\n        success = (success !== false);\n        if (success){\n            this.fireEvent(\"write\", this, action, data, res, rs, trans.request.arg);\n        }else{\n            this.fireEvent('exception', this, 'remote', action, trans, result, rs);\n        }\n        trans.request.callback.call(trans.request.scope, data, res, success);\n    }\n});\n/**\n * @class Ext.data.DirectStore\n * @extends Ext.data.Store\n * <p>Small helper class to create an {@link Ext.data.Store} configured with an\n * {@link Ext.data.DirectProxy} and {@link Ext.data.JsonReader} to make interacting\n * with an {@link Ext.Direct} Server-side {@link Ext.direct.Provider Provider} easier.\n * To create a different proxy/reader combination create a basic {@link Ext.data.Store}\n * configured as needed.</p>\n *\n * <p><b>*Note:</b> Although they are not listed, this class inherits all of the config options of:</p>\n * <div><ul class=\"mdetail-params\">\n * <li><b>{@link Ext.data.Store Store}</b></li>\n * <div class=\"sub-desc\"><ul class=\"mdetail-params\">\n *\n * </ul></div>\n * <li><b>{@link Ext.data.JsonReader JsonReader}</b></li>\n * <div class=\"sub-desc\"><ul class=\"mdetail-params\">\n * <li><tt><b>{@link Ext.data.JsonReader#root root}</b></tt></li>\n * <li><tt><b>{@link Ext.data.JsonReader#idProperty idProperty}</b></tt></li>\n * <li><tt><b>{@link Ext.data.JsonReader#totalProperty totalProperty}</b></tt></li>\n * </ul></div>\n *\n * <li><b>{@link Ext.data.DirectProxy DirectProxy}</b></li>\n * <div class=\"sub-desc\"><ul class=\"mdetail-params\">\n * <li><tt><b>{@link Ext.data.DirectProxy#directFn directFn}</b></tt></li>\n * <li><tt><b>{@link Ext.data.DirectProxy#paramOrder paramOrder}</b></tt></li>\n * <li><tt><b>{@link Ext.data.DirectProxy#paramsAsHash paramsAsHash}</b></tt></li>\n * </ul></div>\n * </ul></div>\n *\n * @xtype directstore\n *\n * @constructor\n * @param {Object} config\n */\nExt.data.DirectStore = Ext.extend(Ext.data.Store, {\n    constructor : function(config){\n        // each transaction upon a singe record will generate a distinct Direct transaction since Direct queues them into one Ajax request.\n        var c = Ext.apply({}, {\n            batchTransactions: false\n        }, config);\n        Ext.data.DirectStore.superclass.constructor.call(this, Ext.apply(c, {\n            proxy: Ext.isDefined(c.proxy) ? c.proxy : new Ext.data.DirectProxy(Ext.copyTo({}, c, 'paramOrder,paramsAsHash,directFn,api')),\n            reader: (!Ext.isDefined(c.reader) && c.fields) ? new Ext.data.JsonReader(Ext.copyTo({}, c, 'totalProperty,root,idProperty'), c.fields) : c.reader\n        }));\n    }\n});\nExt.reg('directstore', Ext.data.DirectStore);\n/**\n * @class Ext.Direct\n * @extends Ext.util.Observable\n * <p><b><u>Overview</u></b></p>\n *\n * <p>Ext.Direct aims to streamline communication between the client and server\n * by providing a single interface that reduces the amount of common code\n * typically required to validate data and handle returned data packets\n * (reading data, error conditions, etc).</p>\n *\n * <p>The Ext.direct namespace includes several classes for a closer integration\n * with the server-side. The Ext.data namespace also includes classes for working\n * with Ext.data.Stores which are backed by data from an Ext.Direct method.</p>\n *\n * <p><b><u>Specification</u></b></p>\n *\n * <p>For additional information consult the\n * <a href=\"http://extjs.com/products/extjs/direct.php\">Ext.Direct Specification</a>.</p>\n *\n * <p><b><u>Providers</u></b></p>\n *\n * <p>Ext.Direct uses a provider architecture, where one or more providers are\n * used to transport data to and from the server. There are several providers\n * that exist in the core at the moment:</p><div class=\"mdetail-params\"><ul>\n *\n * <li>{@link Ext.direct.JsonProvider JsonProvider} for simple JSON operations</li>\n * <li>{@link Ext.direct.PollingProvider PollingProvider} for repeated requests</li>\n * <li>{@link Ext.direct.RemotingProvider RemotingProvider} exposes server side\n * on the client.</li>\n * </ul></div>\n *\n * <p>A provider does not need to be invoked directly, providers are added via\n * {@link Ext.Direct}.{@link Ext.Direct#add add}.</p>\n *\n * <p><b><u>Router</u></b></p>\n *\n * <p>Ext.Direct utilizes a \"router\" on the server to direct requests from the client\n * to the appropriate server-side method. Because the Ext.Direct API is completely\n * platform-agnostic, you could completely swap out a Java based server solution\n * and replace it with one that uses C# without changing the client side JavaScript\n * at all.</p>\n *\n * <p><b><u>Server side events</u></b></p>\n *\n * <p>Custom events from the server may be handled by the client by adding\n * listeners, for example:</p>\n * <pre><code>\n{\"type\":\"event\",\"name\":\"message\",\"data\":\"Successfully polled at: 11:19:30 am\"}\n\n// add a handler for a 'message' event sent by the server\nExt.Direct.on('message', function(e){\n    out.append(String.format('&lt;p>&lt;i>{0}&lt;/i>&lt;/p>', e.data));\n            out.el.scrollTo('t', 100000, true);\n});\n * </code></pre>\n * @singleton\n */\nExt.Direct = Ext.extend(Ext.util.Observable, {\n    /**\n     * Each event type implements a getData() method. The default event types are:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b><tt>event</tt></b> : Ext.Direct.Event</li>\n     * <li><b><tt>exception</tt></b> : Ext.Direct.ExceptionEvent</li>\n     * <li><b><tt>rpc</tt></b> : Ext.Direct.RemotingEvent</li>\n     * </ul></div>\n     * @property eventTypes\n     * @type Object\n     */\n\n    /**\n     * Four types of possible exceptions which can occur:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b><tt>Ext.Direct.exceptions.TRANSPORT</tt></b> : 'xhr'</li>\n     * <li><b><tt>Ext.Direct.exceptions.PARSE</tt></b> : 'parse'</li>\n     * <li><b><tt>Ext.Direct.exceptions.LOGIN</tt></b> : 'login'</li>\n     * <li><b><tt>Ext.Direct.exceptions.SERVER</tt></b> : 'exception'</li>\n     * </ul></div>\n     * @property exceptions\n     * @type Object\n     */\n    exceptions: {\n        TRANSPORT: 'xhr',\n        PARSE: 'parse',\n        LOGIN: 'login',\n        SERVER: 'exception'\n    },\n\n    // private\n    constructor: function(){\n        this.addEvents(\n            /**\n             * @event event\n             * Fires after an event.\n             * @param {event} e The {@link Ext.Direct#eventTypes Ext.Direct.Event type} that occurred.\n             * @param {Ext.direct.Provider} provider The {@link Ext.direct.Provider Provider}.\n             */\n            'event',\n            /**\n             * @event exception\n             * Fires after an event exception.\n             * @param {event} e The {@link Ext.Direct#eventTypes Ext.Direct.Event type} that occurred.\n             */\n            'exception'\n        );\n        this.transactions = {};\n        this.providers = {};\n    },\n\n    /**\n     * Adds an Ext.Direct Provider and creates the proxy or stub methods to execute server-side methods.\n     * If the provider is not already connected, it will auto-connect.\n     * <pre><code>\nvar pollProv = new Ext.direct.PollingProvider({\n    url: 'php/poll2.php'\n});\n\nExt.Direct.addProvider(\n    {\n        \"type\":\"remoting\",       // create a {@link Ext.direct.RemotingProvider}\n        \"url\":\"php\\/router.php\", // url to connect to the Ext.Direct server-side router.\n        \"actions\":{              // each property within the actions object represents a Class\n            \"TestAction\":[       // array of methods within each server side Class\n            {\n                \"name\":\"doEcho\", // name of method\n                \"len\":1\n            },{\n                \"name\":\"multiply\",\n                \"len\":1\n            },{\n                \"name\":\"doForm\",\n                \"formHandler\":true, // handle form on server with Ext.Direct.Transaction\n                \"len\":1\n            }]\n        },\n        \"namespace\":\"myApplication\",// namespace to create the Remoting Provider in\n    },{\n        type: 'polling', // create a {@link Ext.direct.PollingProvider}\n        url:  'php/poll.php'\n    },\n    pollProv // reference to previously created instance\n);\n     * </code></pre>\n     * @param {Object/Array} provider Accepts either an Array of Provider descriptions (an instance\n     * or config object for a Provider) or any number of Provider descriptions as arguments.  Each\n     * Provider description instructs Ext.Direct how to create client-side stub methods.\n     */\n    addProvider : function(provider){\n        var a = arguments;\n        if(a.length > 1){\n            for(var i = 0, len = a.length; i < len; i++){\n                this.addProvider(a[i]);\n            }\n            return;\n        }\n\n        // if provider has not already been instantiated\n        if(!provider.events){\n            provider = new Ext.Direct.PROVIDERS[provider.type](provider);\n        }\n        provider.id = provider.id || Ext.id();\n        this.providers[provider.id] = provider;\n\n        provider.on('data', this.onProviderData, this);\n        provider.on('exception', this.onProviderException, this);\n\n\n        if(!provider.isConnected()){\n            provider.connect();\n        }\n\n        return provider;\n    },\n\n    /**\n     * Retrieve a {@link Ext.direct.Provider provider} by the\n     * <b><tt>{@link Ext.direct.Provider#id id}</tt></b> specified when the provider is\n     * {@link #addProvider added}.\n     * @param {String} id Unique identifier assigned to the provider when calling {@link #addProvider}\n     */\n    getProvider : function(id){\n        return this.providers[id];\n    },\n\n    removeProvider : function(id){\n        var provider = id.id ? id : this.providers[id];\n        provider.un('data', this.onProviderData, this);\n        provider.un('exception', this.onProviderException, this);\n        delete this.providers[provider.id];\n        return provider;\n    },\n\n    addTransaction: function(t){\n        this.transactions[t.tid] = t;\n        return t;\n    },\n\n    removeTransaction: function(t){\n        delete this.transactions[t.tid || t];\n        return t;\n    },\n\n    getTransaction: function(tid){\n        return this.transactions[tid.tid || tid];\n    },\n\n    onProviderData : function(provider, e){\n        if(Ext.isArray(e)){\n            for(var i = 0, len = e.length; i < len; i++){\n                this.onProviderData(provider, e[i]);\n            }\n            return;\n        }\n        if(e.name && e.name != 'event' && e.name != 'exception'){\n            this.fireEvent(e.name, e);\n        }else if(e.type == 'exception'){\n            this.fireEvent('exception', e);\n        }\n        this.fireEvent('event', e, provider);\n    },\n\n    createEvent : function(response, extraProps){\n        return new Ext.Direct.eventTypes[response.type](Ext.apply(response, extraProps));\n    }\n});\n// overwrite impl. with static instance\nExt.Direct = new Ext.Direct();\n\nExt.Direct.TID = 1;\nExt.Direct.PROVIDERS = {};/**\n * @class Ext.Direct.Transaction\n * @extends Object\n * <p>Supporting Class for Ext.Direct (not intended to be used directly).</p>\n * @constructor\n * @param {Object} config\n */\nExt.Direct.Transaction = function(config){\n    Ext.apply(this, config);\n    this.tid = ++Ext.Direct.TID;\n    this.retryCount = 0;\n};\nExt.Direct.Transaction.prototype = {\n    send: function(){\n        this.provider.queueTransaction(this);\n    },\n\n    retry: function(){\n        this.retryCount++;\n        this.send();\n    },\n\n    getProvider: function(){\n        return this.provider;\n    }\n};Ext.Direct.Event = function(config){\n    Ext.apply(this, config);\n};\n\nExt.Direct.Event.prototype = {\n    status: true,\n    getData: function(){\n        return this.data;\n    }\n};\n\nExt.Direct.RemotingEvent = Ext.extend(Ext.Direct.Event, {\n    type: 'rpc',\n    getTransaction: function(){\n        return this.transaction || Ext.Direct.getTransaction(this.tid);\n    }\n});\n\nExt.Direct.ExceptionEvent = Ext.extend(Ext.Direct.RemotingEvent, {\n    status: false,\n    type: 'exception'\n});\n\nExt.Direct.eventTypes = {\n    'rpc':  Ext.Direct.RemotingEvent,\n    'event':  Ext.Direct.Event,\n    'exception':  Ext.Direct.ExceptionEvent\n};\n/**\n * @class Ext.direct.Provider\n * @extends Ext.util.Observable\n * <p>Ext.direct.Provider is an abstract class meant to be extended.</p>\n * \n * <p>For example ExtJs implements the following subclasses:</p>\n * <pre><code>\nProvider\n|\n+---{@link Ext.direct.JsonProvider JsonProvider} \n    |\n    +---{@link Ext.direct.PollingProvider PollingProvider}   \n    |\n    +---{@link Ext.direct.RemotingProvider RemotingProvider}   \n * </code></pre>\n * @abstract\n */\nExt.direct.Provider = Ext.extend(Ext.util.Observable, {    \n    /**\n     * @cfg {String} id\n     * The unique id of the provider (defaults to an {@link Ext#id auto-assigned id}).\n     * You should assign an id if you need to be able to access the provider later and you do\n     * not have an object reference available, for example:\n     * <pre><code>\nExt.Direct.addProvider(\n    {\n        type: 'polling',\n        url:  'php/poll.php',\n        id:   'poll-provider'\n    }\n);\n     \nvar p = {@link Ext.Direct Ext.Direct}.{@link Ext.Direct#getProvider getProvider}('poll-provider');\np.disconnect();\n     * </code></pre>\n     */\n        \n    /**\n     * @cfg {Number} priority\n     * Priority of the request. Lower is higher priority, <tt>0</tt> means \"duplex\" (always on).\n     * All Providers default to <tt>1</tt> except for PollingProvider which defaults to <tt>3</tt>.\n     */    \n    priority: 1,\n\n    /**\n     * @cfg {String} type\n     * <b>Required</b>, <tt>undefined</tt> by default.  The <tt>type</tt> of provider specified\n     * to {@link Ext.Direct Ext.Direct}.{@link Ext.Direct#addProvider addProvider} to create a\n     * new Provider. Acceptable values by default are:<div class=\"mdetail-params\"><ul>\n     * <li><b><tt>polling</tt></b> : {@link Ext.direct.PollingProvider PollingProvider}</li>\n     * <li><b><tt>remoting</tt></b> : {@link Ext.direct.RemotingProvider RemotingProvider}</li>\n     * </ul></div>\n     */    \n \n    // private\n    constructor : function(config){\n        Ext.apply(this, config);\n        this.addEvents(\n            /**\n             * @event connect\n             * Fires when the Provider connects to the server-side\n             * @param {Ext.direct.Provider} provider The {@link Ext.direct.Provider Provider}.\n             */            \n            'connect',\n            /**\n             * @event disconnect\n             * Fires when the Provider disconnects from the server-side\n             * @param {Ext.direct.Provider} provider The {@link Ext.direct.Provider Provider}.\n             */            \n            'disconnect',\n            /**\n             * @event data\n             * Fires when the Provider receives data from the server-side\n             * @param {Ext.direct.Provider} provider The {@link Ext.direct.Provider Provider}.\n             * @param {event} e The {@link Ext.Direct#eventTypes Ext.Direct.Event type} that occurred.\n             */            \n            'data',\n            /**\n             * @event exception\n             * Fires when the Provider receives an exception from the server-side\n             */                        \n            'exception'\n        );\n        Ext.direct.Provider.superclass.constructor.call(this, config);\n    },\n\n    /**\n     * Returns whether or not the server-side is currently connected.\n     * Abstract method for subclasses to implement.\n     */\n    isConnected: function(){\n        return false;\n    },\n\n    /**\n     * Abstract methods for subclasses to implement.\n     */\n    connect: Ext.emptyFn,\n    \n    /**\n     * Abstract methods for subclasses to implement.\n     */\n    disconnect: Ext.emptyFn\n});\n/**\n * @class Ext.direct.JsonProvider\n * @extends Ext.direct.Provider\n */\nExt.direct.JsonProvider = Ext.extend(Ext.direct.Provider, {\n    parseResponse: function(xhr){\n        if(!Ext.isEmpty(xhr.responseText)){\n            if(typeof xhr.responseText == 'object'){\n                return xhr.responseText;\n            }\n            return Ext.decode(xhr.responseText);\n        }\n        return null;\n    },\n\n    getEvents: function(xhr){\n        var data = null;\n        try{\n            data = this.parseResponse(xhr);\n        }catch(e){\n            var event = new Ext.Direct.ExceptionEvent({\n                data: e,\n                xhr: xhr,\n                code: Ext.Direct.exceptions.PARSE,\n                message: 'Error parsing json response: \\n\\n ' + data\n            });\n            return [event];\n        }\n        var events = [];\n        if(Ext.isArray(data)){\n            for(var i = 0, len = data.length; i < len; i++){\n                events.push(Ext.Direct.createEvent(data[i]));\n            }\n        }else{\n            events.push(Ext.Direct.createEvent(data));\n        }\n        return events;\n    }\n});/**\n * @class Ext.direct.PollingProvider\n * @extends Ext.direct.JsonProvider\n *\n * <p>Provides for repetitive polling of the server at distinct {@link #interval intervals}.\n * The initial request for data originates from the client, and then is responded to by the\n * server.</p>\n *\n * <p>All configurations for the PollingProvider should be generated by the server-side\n * API portion of the Ext.Direct stack.</p>\n *\n * <p>An instance of PollingProvider may be created directly via the new keyword or by simply\n * specifying <tt>type = 'polling'</tt>.  For example:</p>\n * <pre><code>\nvar pollA = new Ext.direct.PollingProvider({\n    type:'polling',\n    url: 'php/pollA.php',\n});\nExt.Direct.addProvider(pollA);\npollA.disconnect();\n\nExt.Direct.addProvider(\n    {\n        type:'polling',\n        url: 'php/pollB.php',\n        id: 'pollB-provider'\n    }\n);\nvar pollB = Ext.Direct.getProvider('pollB-provider');\n * </code></pre>\n */\nExt.direct.PollingProvider = Ext.extend(Ext.direct.JsonProvider, {\n    /**\n     * @cfg {Number} priority\n     * Priority of the request (defaults to <tt>3</tt>). See {@link Ext.direct.Provider#priority}.\n     */\n    // override default priority\n    priority: 3,\n\n    /**\n     * @cfg {Number} interval\n     * How often to poll the server-side in milliseconds (defaults to <tt>3000</tt> - every\n     * 3 seconds).\n     */\n    interval: 3000,\n\n    /**\n     * @cfg {Object} baseParams An object containing properties which are to be sent as parameters\n     * on every polling request\n     */\n\n    /**\n     * @cfg {String/Function} url\n     * The url which the PollingProvider should contact with each request. This can also be\n     * an imported Ext.Direct method which will accept the baseParams as its only argument.\n     */\n\n    // private\n    constructor : function(config){\n        Ext.direct.PollingProvider.superclass.constructor.call(this, config);\n        this.addEvents(\n            /**\n             * @event beforepoll\n             * Fired immediately before a poll takes place, an event handler can return false\n             * in order to cancel the poll.\n             * @param {Ext.direct.PollingProvider} this\n             */\n            'beforepoll',\n            /**\n             * @event poll\n             * This event has not yet been implemented.\n             * @param {Ext.direct.PollingProvider} this\n             */\n            'poll'\n        );\n    },\n\n    // inherited\n    isConnected: function(){\n        return !!this.pollTask;\n    },\n\n    /**\n     * Connect to the server-side and begin the polling process. To handle each\n     * response subscribe to the data event.\n     */\n    connect: function(){\n        if(this.url && !this.pollTask){\n            this.pollTask = Ext.TaskMgr.start({\n                run: function(){\n                    if(this.fireEvent('beforepoll', this) !== false){\n                        if(typeof this.url == 'function'){\n                            this.url(this.baseParams);\n                        }else{\n                            Ext.Ajax.request({\n                                url: this.url,\n                                callback: this.onData,\n                                scope: this,\n                                params: this.baseParams\n                            });\n                        }\n                    }\n                },\n                interval: this.interval,\n                scope: this\n            });\n            this.fireEvent('connect', this);\n        }else if(!this.url){\n            throw 'Error initializing PollingProvider, no url configured.';\n        }\n    },\n\n    /**\n     * Disconnect from the server-side and stop the polling process. The disconnect\n     * event will be fired on a successful disconnect.\n     */\n    disconnect: function(){\n        if(this.pollTask){\n            Ext.TaskMgr.stop(this.pollTask);\n            delete this.pollTask;\n            this.fireEvent('disconnect', this);\n        }\n    },\n\n    // private\n    onData: function(opt, success, xhr){\n        if(success){\n            var events = this.getEvents(xhr);\n            for(var i = 0, len = events.length; i < len; i++){\n                var e = events[i];\n                this.fireEvent('data', this, e);\n            }\n        }else{\n            var e = new Ext.Direct.ExceptionEvent({\n                data: e,\n                code: Ext.Direct.exceptions.TRANSPORT,\n                message: 'Unable to connect to the server.',\n                xhr: xhr\n            });\n            this.fireEvent('data', this, e);\n        }\n    }\n});\n\nExt.Direct.PROVIDERS['polling'] = Ext.direct.PollingProvider;/**\n * @class Ext.direct.RemotingProvider\n * @extends Ext.direct.JsonProvider\n * \n * <p>The {@link Ext.direct.RemotingProvider RemotingProvider} exposes access to\n * server side methods on the client (a remote procedure call (RPC) type of\n * connection where the client can initiate a procedure on the server).</p>\n * \n * <p>This allows for code to be organized in a fashion that is maintainable,\n * while providing a clear path between client and server, something that is\n * not always apparent when using URLs.</p>\n * \n * <p>To accomplish this the server-side needs to describe what classes and methods\n * are available on the client-side. This configuration will typically be\n * outputted by the server-side Ext.Direct stack when the API description is built.</p>\n */\nExt.direct.RemotingProvider = Ext.extend(Ext.direct.JsonProvider, {       \n    /**\n     * @cfg {Object} actions\n     * Object literal defining the server side actions and methods. For example, if\n     * the Provider is configured with:\n     * <pre><code>\n\"actions\":{ // each property within the 'actions' object represents a server side Class \n    \"TestAction\":[ // array of methods within each server side Class to be   \n    {              // stubbed out on client\n        \"name\":\"doEcho\", \n        \"len\":1            \n    },{\n        \"name\":\"multiply\",// name of method\n        \"len\":2           // The number of parameters that will be used to create an\n                          // array of data to send to the server side function.\n                          // Ensure the server sends back a Number, not a String. \n    },{\n        \"name\":\"doForm\",\n        \"formHandler\":true, // direct the client to use specialized form handling method \n        \"len\":1\n    }]\n}\n     * </code></pre>\n     * <p>Note that a Store is not required, a server method can be called at any time.\n     * In the following example a <b>client side</b> handler is used to call the\n     * server side method \"multiply\" in the server-side \"TestAction\" Class:</p>\n     * <pre><code>\nTestAction.multiply(\n    2, 4, // pass two arguments to server, so specify len=2\n    // callback function after the server is called\n    // result: the result returned by the server\n    //      e: Ext.Direct.RemotingEvent object\n    function(result, e){\n        var t = e.getTransaction();\n        var action = t.action; // server side Class called\n        var method = t.method; // server side method called\n        if(e.status){\n            var answer = Ext.encode(result); // 8\n    \n        }else{\n            var msg = e.message; // failure message\n        }\n    }\n);\n     * </code></pre>\n     * In the example above, the server side \"multiply\" function will be passed two\n     * arguments (2 and 4).  The \"multiply\" method should return the value 8 which will be\n     * available as the <tt>result</tt> in the example above. \n     */\n    \n    /**\n     * @cfg {String/Object} namespace\n     * Namespace for the Remoting Provider (defaults to the browser global scope of <i>window</i>).\n     * Explicitly specify the namespace Object, or specify a String to have a\n     * {@link Ext#namespace namespace created} implicitly.\n     */\n    \n    /**\n     * @cfg {String} url\n     * <b>Required<b>. The url to connect to the {@link Ext.Direct} server-side router. \n     */\n    \n    /**\n     * @cfg {String} enableUrlEncode\n     * Specify which param will hold the arguments for the method.\n     * Defaults to <tt>'data'</tt>.\n     */\n    \n    /**\n     * @cfg {Number/Boolean} enableBuffer\n     * <p><tt>true</tt> or <tt>false</tt> to enable or disable combining of method\n     * calls. If a number is specified this is the amount of time in milliseconds\n     * to wait before sending a batched request (defaults to <tt>10</tt>).</p>\n     * <br><p>Calls which are received within the specified timeframe will be\n     * concatenated together and sent in a single request, optimizing the\n     * application by reducing the amount of round trips that have to be made\n     * to the server.</p>\n     */\n    enableBuffer: 10,\n    \n    /**\n     * @cfg {Number} maxRetries\n     * Number of times to re-attempt delivery on failure of a call. Defaults to <tt>1</tt>.\n     */\n    maxRetries: 1,\n    \n    /**\n     * @cfg {Number} timeout\n     * The timeout to use for each request. Defaults to <tt>undefined</tt>.\n     */\n    timeout: undefined,\n\n    constructor : function(config){\n        Ext.direct.RemotingProvider.superclass.constructor.call(this, config);\n        this.addEvents(\n            /**\n             * @event beforecall\n             * Fires immediately before the client-side sends off the RPC call.\n             * By returning false from an event handler you can prevent the call from\n             * executing.\n             * @param {Ext.direct.RemotingProvider} provider\n             * @param {Ext.Direct.Transaction} transaction\n             * @param {Object} meta The meta data\n             */            \n            'beforecall',            \n            /**\n             * @event call\n             * Fires immediately after the request to the server-side is sent. This does\n             * NOT fire after the response has come back from the call.\n             * @param {Ext.direct.RemotingProvider} provider\n             * @param {Ext.Direct.Transaction} transaction\n             * @param {Object} meta The meta data\n             */            \n            'call'\n        );\n        this.namespace = (Ext.isString(this.namespace)) ? Ext.ns(this.namespace) : this.namespace || window;\n        this.transactions = {};\n        this.callBuffer = [];\n    },\n\n    // private\n    initAPI : function(){\n        var o = this.actions;\n        for(var c in o){\n            var cls = this.namespace[c] || (this.namespace[c] = {}),\n                ms = o[c];\n            for(var i = 0, len = ms.length; i < len; i++){\n                var m = ms[i];\n                cls[m.name] = this.createMethod(c, m);\n            }\n        }\n    },\n\n    // inherited\n    isConnected: function(){\n        return !!this.connected;\n    },\n\n    connect: function(){\n        if(this.url){\n            this.initAPI();\n            this.connected = true;\n            this.fireEvent('connect', this);\n        }else if(!this.url){\n            throw 'Error initializing RemotingProvider, no url configured.';\n        }\n    },\n\n    disconnect: function(){\n        if(this.connected){\n            this.connected = false;\n            this.fireEvent('disconnect', this);\n        }\n    },\n\n    onData: function(opt, success, xhr){\n        if(success){\n            var events = this.getEvents(xhr);\n            for(var i = 0, len = events.length; i < len; i++){\n                var e = events[i],\n                    t = this.getTransaction(e);\n                this.fireEvent('data', this, e);\n                if(t){\n                    this.doCallback(t, e, true);\n                    Ext.Direct.removeTransaction(t);\n                }\n            }\n        }else{\n            var ts = [].concat(opt.ts);\n            for(var i = 0, len = ts.length; i < len; i++){\n                var t = this.getTransaction(ts[i]);\n                if(t && t.retryCount < this.maxRetries){\n                    t.retry();\n                }else{\n                    var e = new Ext.Direct.ExceptionEvent({\n                        data: e,\n                        transaction: t,\n                        code: Ext.Direct.exceptions.TRANSPORT,\n                        message: 'Unable to connect to the server.',\n                        xhr: xhr\n                    });\n                    this.fireEvent('data', this, e);\n                    if(t){\n                        this.doCallback(t, e, false);\n                        Ext.Direct.removeTransaction(t);\n                    }\n                }\n            }\n        }\n    },\n\n    getCallData: function(t){\n        return {\n            action: t.action,\n            method: t.method,\n            data: t.data,\n            type: 'rpc',\n            tid: t.tid\n        };\n    },\n\n    doSend : function(data){\n        var o = {\n            url: this.url,\n            callback: this.onData,\n            scope: this,\n            ts: data,\n            timeout: this.timeout\n        }, callData;\n\n        if(Ext.isArray(data)){\n            callData = [];\n            for(var i = 0, len = data.length; i < len; i++){\n                callData.push(this.getCallData(data[i]));\n            }\n        }else{\n            callData = this.getCallData(data);\n        }\n\n        if(this.enableUrlEncode){\n            var params = {};\n            params[Ext.isString(this.enableUrlEncode) ? this.enableUrlEncode : 'data'] = Ext.encode(callData);\n            o.params = params;\n        }else{\n            o.jsonData = callData;\n        }\n        Ext.Ajax.request(o);\n    },\n\n    combineAndSend : function(){\n        var len = this.callBuffer.length;\n        if(len > 0){\n            this.doSend(len == 1 ? this.callBuffer[0] : this.callBuffer);\n            this.callBuffer = [];\n        }\n    },\n\n    queueTransaction: function(t){\n        if(t.form){\n            this.processForm(t);\n            return;\n        }\n        this.callBuffer.push(t);\n        if(this.enableBuffer){\n            if(!this.callTask){\n                this.callTask = new Ext.util.DelayedTask(this.combineAndSend, this);\n            }\n            this.callTask.delay(Ext.isNumber(this.enableBuffer) ? this.enableBuffer : 10);\n        }else{\n            this.combineAndSend();\n        }\n    },\n\n    doCall : function(c, m, args){\n        var data = null, hs = args[m.len], scope = args[m.len+1];\n\n        if(m.len !== 0){\n            data = args.slice(0, m.len);\n        }\n\n        var t = new Ext.Direct.Transaction({\n            provider: this,\n            args: args,\n            action: c,\n            method: m.name,\n            data: data,\n            cb: scope && Ext.isFunction(hs) ? hs.createDelegate(scope) : hs\n        });\n\n        if(this.fireEvent('beforecall', this, t, m) !== false){\n            Ext.Direct.addTransaction(t);\n            this.queueTransaction(t);\n            this.fireEvent('call', this, t, m);\n        }\n    },\n\n    doForm : function(c, m, form, callback, scope){\n        var t = new Ext.Direct.Transaction({\n            provider: this,\n            action: c,\n            method: m.name,\n            args:[form, callback, scope],\n            cb: scope && Ext.isFunction(callback) ? callback.createDelegate(scope) : callback,\n            isForm: true\n        });\n\n        if(this.fireEvent('beforecall', this, t, m) !== false){\n            Ext.Direct.addTransaction(t);\n            var isUpload = String(form.getAttribute(\"enctype\")).toLowerCase() == 'multipart/form-data',\n                params = {\n                    extTID: t.tid,\n                    extAction: c,\n                    extMethod: m.name,\n                    extType: 'rpc',\n                    extUpload: String(isUpload)\n                };\n            \n            // change made from typeof callback check to callback.params\n            // to support addl param passing in DirectSubmit EAC 6/2\n            Ext.apply(t, {\n                form: Ext.getDom(form),\n                isUpload: isUpload,\n                params: callback && Ext.isObject(callback.params) ? Ext.apply(params, callback.params) : params\n            });\n            this.fireEvent('call', this, t, m);\n            this.processForm(t);\n        }\n    },\n    \n    processForm: function(t){\n        Ext.Ajax.request({\n            url: this.url,\n            params: t.params,\n            callback: this.onData,\n            scope: this,\n            form: t.form,\n            isUpload: t.isUpload,\n            ts: t\n        });\n    },\n\n    createMethod : function(c, m){\n        var f;\n        if(!m.formHandler){\n            f = function(){\n                this.doCall(c, m, Array.prototype.slice.call(arguments, 0));\n            }.createDelegate(this);\n        }else{\n            f = function(form, callback, scope){\n                this.doForm(c, m, form, callback, scope);\n            }.createDelegate(this);\n        }\n        f.directCfg = {\n            action: c,\n            method: m\n        };\n        return f;\n    },\n\n    getTransaction: function(opt){\n        return opt && opt.tid ? Ext.Direct.getTransaction(opt.tid) : null;\n    },\n\n    doCallback: function(t, e){\n        var fn = e.status ? 'success' : 'failure';\n        if(t && t.cb){\n            var hs = t.cb,\n                result = Ext.isDefined(e.result) ? e.result : e.data;\n            if(Ext.isFunction(hs)){\n                hs(result, e);\n            } else{\n                Ext.callback(hs[fn], hs.scope, [result, e]);\n                Ext.callback(hs.callback, hs.scope, [result, e]);\n            }\n        }\n    }\n});\nExt.Direct.PROVIDERS['remoting'] = Ext.direct.RemotingProvider;/**\n * @class Ext.Resizable\n * @extends Ext.util.Observable\n * <p>Applies drag handles to an element to make it resizable. The drag handles are inserted into the element\n * and positioned absolute. Some elements, such as a textarea or image, don't support this. To overcome that, you can wrap\n * the textarea in a div and set 'resizeChild' to true (or to the id of the element), <b>or</b> set wrap:true in your config and\n * the element will be wrapped for you automatically.</p>\n * <p>Here is the list of valid resize handles:</p>\n * <pre>\nValue   Description\n------  -------------------\n 'n'     north\n 's'     south\n 'e'     east\n 'w'     west\n 'nw'    northwest\n 'sw'    southwest\n 'se'    southeast\n 'ne'    northeast\n 'all'   all\n</pre>\n * <p>Here's an example showing the creation of a typical Resizable:</p>\n * <pre><code>\nvar resizer = new Ext.Resizable('element-id', {\n    handles: 'all',\n    minWidth: 200,\n    minHeight: 100,\n    maxWidth: 500,\n    maxHeight: 400,\n    pinned: true\n});\nresizer.on('resize', myHandler);\n</code></pre>\n * <p>To hide a particular handle, set its display to none in CSS, or through script:<br>\n * resizer.east.setDisplayed(false);</p>\n * @constructor\n * Create a new resizable component\n * @param {Mixed} el The id or element to resize\n * @param {Object} config configuration options\n  */\nExt.Resizable = Ext.extend(Ext.util.Observable, {\n\n    constructor: function(el, config){\n        this.el = Ext.get(el);\n        if(config && config.wrap){\n            config.resizeChild = this.el;\n            this.el = this.el.wrap(typeof config.wrap == 'object' ? config.wrap : {cls:'xresizable-wrap'});\n            this.el.id = this.el.dom.id = config.resizeChild.id + '-rzwrap';\n            this.el.setStyle('overflow', 'hidden');\n            this.el.setPositioning(config.resizeChild.getPositioning());\n            config.resizeChild.clearPositioning();\n            if(!config.width || !config.height){\n                var csize = config.resizeChild.getSize();\n                this.el.setSize(csize.width, csize.height);\n            }\n            if(config.pinned && !config.adjustments){\n                config.adjustments = 'auto';\n            }\n        }\n\n        /**\n         * The proxy Element that is resized in place of the real Element during the resize operation.\n         * This may be queried using {@link Ext.Element#getBox} to provide the new area to resize to.\n         * Read only.\n         * @type Ext.Element\n         * @property proxy\n         */\n        this.proxy = this.el.createProxy({tag: 'div', cls: 'x-resizable-proxy', id: this.el.id + '-rzproxy'}, Ext.getBody());\n        this.proxy.unselectable();\n        this.proxy.enableDisplayMode('block');\n\n        Ext.apply(this, config);\n\n        if(this.pinned){\n            this.disableTrackOver = true;\n            this.el.addClass('x-resizable-pinned');\n        }\n        // if the element isn't positioned, make it relative\n        var position = this.el.getStyle('position');\n        if(position != 'absolute' && position != 'fixed'){\n            this.el.setStyle('position', 'relative');\n        }\n        if(!this.handles){ // no handles passed, must be legacy style\n            this.handles = 's,e,se';\n            if(this.multiDirectional){\n                this.handles += ',n,w';\n            }\n        }\n        if(this.handles == 'all'){\n            this.handles = 'n s e w ne nw se sw';\n        }\n        var hs = this.handles.split(/\\s*?[,;]\\s*?| /);\n        var ps = Ext.Resizable.positions;\n        for(var i = 0, len = hs.length; i < len; i++){\n            if(hs[i] && ps[hs[i]]){\n                var pos = ps[hs[i]];\n                this[pos] = new Ext.Resizable.Handle(this, pos, this.disableTrackOver, this.transparent, this.handleCls);\n            }\n        }\n        // legacy\n        this.corner = this.southeast;\n\n        if(this.handles.indexOf('n') != -1 || this.handles.indexOf('w') != -1){\n            this.updateBox = true;\n        }\n\n        this.activeHandle = null;\n\n        if(this.resizeChild){\n            if(typeof this.resizeChild == 'boolean'){\n                this.resizeChild = Ext.get(this.el.dom.firstChild, true);\n            }else{\n                this.resizeChild = Ext.get(this.resizeChild, true);\n            }\n        }\n\n        if(this.adjustments == 'auto'){\n            var rc = this.resizeChild;\n            var hw = this.west, he = this.east, hn = this.north, hs = this.south;\n            if(rc && (hw || hn)){\n                rc.position('relative');\n                rc.setLeft(hw ? hw.el.getWidth() : 0);\n                rc.setTop(hn ? hn.el.getHeight() : 0);\n            }\n            this.adjustments = [\n                (he ? -he.el.getWidth() : 0) + (hw ? -hw.el.getWidth() : 0),\n                (hn ? -hn.el.getHeight() : 0) + (hs ? -hs.el.getHeight() : 0) -1\n            ];\n        }\n\n        if(this.draggable){\n            this.dd = this.dynamic ?\n                this.el.initDD(null) : this.el.initDDProxy(null, {dragElId: this.proxy.id});\n            this.dd.setHandleElId(this.resizeChild ? this.resizeChild.id : this.el.id);\n            if(this.constrainTo){\n                this.dd.constrainTo(this.constrainTo);\n            }\n        }\n\n        this.addEvents(\n            /**\n             * @event beforeresize\n             * Fired before resize is allowed. Set {@link #enabled} to false to cancel resize.\n             * @param {Ext.Resizable} this\n             * @param {Ext.EventObject} e The mousedown event\n             */\n            'beforeresize',\n            /**\n             * @event resize\n             * Fired after a resize.\n             * @param {Ext.Resizable} this\n             * @param {Number} width The new width\n             * @param {Number} height The new height\n             * @param {Ext.EventObject} e The mouseup event\n             */\n            'resize'\n        );\n\n        if(this.width !== null && this.height !== null){\n            this.resizeTo(this.width, this.height);\n        }else{\n            this.updateChildSize();\n        }\n        if(Ext.isIE){\n            this.el.dom.style.zoom = 1;\n        }\n        Ext.Resizable.superclass.constructor.call(this);\n    },\n\n    /**\n     * @cfg {Array/String} adjustments String 'auto' or an array [width, height] with values to be <b>added</b> to the\n     * resize operation's new size (defaults to <tt>[0, 0]</tt>)\n     */\n    adjustments : [0, 0],\n    /**\n     * @cfg {Boolean} animate True to animate the resize (not compatible with dynamic sizing, defaults to false)\n     */\n    animate : false,\n    /**\n     * @cfg {Mixed} constrainTo Constrain the resize to a particular element\n     */\n    /**\n     * @cfg {Boolean} disableTrackOver True to disable mouse tracking. This is only applied at config time. (defaults to false)\n     */\n    disableTrackOver : false,\n    /**\n     * @cfg {Boolean} draggable Convenience to initialize drag drop (defaults to false)\n     */\n    draggable: false,\n    /**\n     * @cfg {Number} duration Animation duration if animate = true (defaults to 0.35)\n     */\n    duration : 0.35,\n    /**\n     * @cfg {Boolean} dynamic True to resize the element while dragging instead of using a proxy (defaults to false)\n     */\n    dynamic : false,\n    /**\n     * @cfg {String} easing Animation easing if animate = true (defaults to <tt>'easingOutStrong'</tt>)\n     */\n    easing : 'easeOutStrong',\n    /**\n     * @cfg {Boolean} enabled False to disable resizing (defaults to true)\n     */\n    enabled : true,\n    /**\n     * @property enabled Writable. False if resizing is disabled.\n     * @type Boolean\n     */\n    /**\n     * @cfg {String} handles String consisting of the resize handles to display (defaults to undefined).\n     * Specify either <tt>'all'</tt> or any of <tt>'n s e w ne nw se sw'</tt>.\n     */\n    handles : false,\n    /**\n     * @cfg {Boolean} multiDirectional <b>Deprecated</b>.  Deprecated style of adding multi-direction resize handles.\n     */\n    multiDirectional : false,\n    /**\n     * @cfg {Number} height The height of the element in pixels (defaults to null)\n     */\n    height : null,\n    /**\n     * @cfg {Number} width The width of the element in pixels (defaults to null)\n     */\n    width : null,\n    /**\n     * @cfg {Number} heightIncrement The increment to snap the height resize in pixels\n     * (only applies if <code>{@link #dynamic}==true</code>). Defaults to <tt>0</tt>.\n     */\n    heightIncrement : 0,\n    /**\n     * @cfg {Number} widthIncrement The increment to snap the width resize in pixels\n     * (only applies if <code>{@link #dynamic}==true</code>). Defaults to <tt>0</tt>.\n     */\n    widthIncrement : 0,\n    /**\n     * @cfg {Number} minHeight The minimum height for the element (defaults to 5)\n     */\n    minHeight : 5,\n    /**\n     * @cfg {Number} minWidth The minimum width for the element (defaults to 5)\n     */\n    minWidth : 5,\n    /**\n     * @cfg {Number} maxHeight The maximum height for the element (defaults to 10000)\n     */\n    maxHeight : 10000,\n    /**\n     * @cfg {Number} maxWidth The maximum width for the element (defaults to 10000)\n     */\n    maxWidth : 10000,\n    /**\n     * @cfg {Number} minX The minimum x for the element (defaults to 0)\n     */\n    minX: 0,\n    /**\n     * @cfg {Number} minY The minimum x for the element (defaults to 0)\n     */\n    minY: 0,\n    /**\n     * @cfg {Boolean} pinned True to ensure that the resize handles are always visible, false to display them only when the\n     * user mouses over the resizable borders. This is only applied at config time. (defaults to false)\n     */\n    pinned : false,\n    /**\n     * @cfg {Boolean} preserveRatio True to preserve the original ratio between height\n     * and width during resize (defaults to false)\n     */\n    preserveRatio : false,\n    /**\n     * @cfg {Boolean/String/Element} resizeChild True to resize the first child, or id/element to resize (defaults to false)\n     */\n    resizeChild : false,\n    /**\n     * @cfg {Boolean} transparent True for transparent handles. This is only applied at config time. (defaults to false)\n     */\n    transparent: false,\n    /**\n     * @cfg {Ext.lib.Region} resizeRegion Constrain the resize to a particular region\n     */\n    /**\n     * @cfg {Boolean} wrap True to wrap an element with a div if needed (required for textareas and images, defaults to false)\n     * in favor of the handles config option (defaults to false)\n     */\n    /**\n     * @cfg {String} handleCls A css class to add to each handle. Defaults to <tt>''</tt>.\n     */\n\n\n    /**\n     * Perform a manual resize and fires the 'resize' event.\n     * @param {Number} width\n     * @param {Number} height\n     */\n    resizeTo : function(width, height){\n        this.el.setSize(width, height);\n        this.updateChildSize();\n        this.fireEvent('resize', this, width, height, null);\n    },\n\n    // private\n    startSizing : function(e, handle){\n        this.fireEvent('beforeresize', this, e);\n        if(this.enabled){ // 2nd enabled check in case disabled before beforeresize handler\n\n            if(!this.overlay){\n                this.overlay = this.el.createProxy({tag: 'div', cls: 'x-resizable-overlay', html: '&#160;'}, Ext.getBody());\n                this.overlay.unselectable();\n                this.overlay.enableDisplayMode('block');\n                this.overlay.on({\n                    scope: this,\n                    mousemove: this.onMouseMove,\n                    mouseup: this.onMouseUp\n                });\n            }\n            this.overlay.setStyle('cursor', handle.el.getStyle('cursor'));\n\n            this.resizing = true;\n            this.startBox = this.el.getBox();\n            this.startPoint = e.getXY();\n            this.offsets = [(this.startBox.x + this.startBox.width) - this.startPoint[0],\n                            (this.startBox.y + this.startBox.height) - this.startPoint[1]];\n\n            this.overlay.setSize(Ext.lib.Dom.getViewWidth(true), Ext.lib.Dom.getViewHeight(true));\n            this.overlay.show();\n\n            if(this.constrainTo) {\n                var ct = Ext.get(this.constrainTo);\n                this.resizeRegion = ct.getRegion().adjust(\n                    ct.getFrameWidth('t'),\n                    ct.getFrameWidth('l'),\n                    -ct.getFrameWidth('b'),\n                    -ct.getFrameWidth('r')\n                );\n            }\n\n            this.proxy.setStyle('visibility', 'hidden'); // workaround display none\n            this.proxy.show();\n            this.proxy.setBox(this.startBox);\n            if(!this.dynamic){\n                this.proxy.setStyle('visibility', 'visible');\n            }\n        }\n    },\n\n    // private\n    onMouseDown : function(handle, e){\n        if(this.enabled){\n            e.stopEvent();\n            this.activeHandle = handle;\n            this.startSizing(e, handle);\n        }\n    },\n\n    // private\n    onMouseUp : function(e){\n        this.activeHandle = null;\n        var size = this.resizeElement();\n        this.resizing = false;\n        this.handleOut();\n        this.overlay.hide();\n        this.proxy.hide();\n        this.fireEvent('resize', this, size.width, size.height, e);\n    },\n\n    // private\n    updateChildSize : function(){\n        if(this.resizeChild){\n            var el = this.el;\n            var child = this.resizeChild;\n            var adj = this.adjustments;\n            if(el.dom.offsetWidth){\n                var b = el.getSize(true);\n                child.setSize(b.width+adj[0], b.height+adj[1]);\n            }\n            // Second call here for IE\n            // The first call enables instant resizing and\n            // the second call corrects scroll bars if they\n            // exist\n            if(Ext.isIE9m){\n                setTimeout(function(){\n                    if(el.dom.offsetWidth){\n                        var b = el.getSize(true);\n                        child.setSize(b.width+adj[0], b.height+adj[1]);\n                    }\n                }, 10);\n            }\n        }\n    },\n\n    // private\n    snap : function(value, inc, min){\n        if(!inc || !value){\n            return value;\n        }\n        var newValue = value;\n        var m = value % inc;\n        if(m > 0){\n            if(m > (inc/2)){\n                newValue = value + (inc-m);\n            }else{\n                newValue = value - m;\n            }\n        }\n        return Math.max(min, newValue);\n    },\n\n    /**\n     * <p>Performs resizing of the associated Element. This method is called internally by this\n     * class, and should not be called by user code.</p>\n     * <p>If a Resizable is being used to resize an Element which encapsulates a more complex UI\n     * component such as a Panel, this method may be overridden by specifying an implementation\n     * as a config option to provide appropriate behaviour at the end of the resize operation on\n     * mouseup, for example resizing the Panel, and relaying the Panel's content.</p>\n     * <p>The new area to be resized to is available by examining the state of the {@link #proxy}\n     * Element. Example:\n<pre><code>\nnew Ext.Panel({\n    title: 'Resize me',\n    x: 100,\n    y: 100,\n    renderTo: Ext.getBody(),\n    floating: true,\n    frame: true,\n    width: 400,\n    height: 200,\n    listeners: {\n        render: function(p) {\n            new Ext.Resizable(p.getEl(), {\n                handles: 'all',\n                pinned: true,\n                transparent: true,\n                resizeElement: function() {\n                    var box = this.proxy.getBox();\n                    p.updateBox(box);\n                    if (p.layout) {\n                        p.doLayout();\n                    }\n                    return box;\n                }\n           });\n       }\n    }\n}).show();\n</code></pre>\n     */\n    resizeElement : function(){\n        var box = this.proxy.getBox();\n        if(this.updateBox){\n            this.el.setBox(box, false, this.animate, this.duration, null, this.easing);\n        }else{\n            this.el.setSize(box.width, box.height, this.animate, this.duration, null, this.easing);\n        }\n        this.updateChildSize();\n        if(!this.dynamic){\n            this.proxy.hide();\n        }\n        if(this.draggable && this.constrainTo){\n            this.dd.resetConstraints();\n            this.dd.constrainTo(this.constrainTo);\n        }\n        return box;\n    },\n\n    // private\n    constrain : function(v, diff, m, mx){\n        if(v - diff < m){\n            diff = v - m;\n        }else if(v - diff > mx){\n            diff = v - mx;\n        }\n        return diff;\n    },\n\n    // private\n    onMouseMove : function(e){\n        if(this.enabled && this.activeHandle){\n            try{// try catch so if something goes wrong the user doesn't get hung\n\n            if(this.resizeRegion && !this.resizeRegion.contains(e.getPoint())) {\n                return;\n            }\n\n            //var curXY = this.startPoint;\n            var curSize = this.curSize || this.startBox,\n                x = this.startBox.x, y = this.startBox.y,\n                ox = x,\n                oy = y,\n                w = curSize.width,\n                h = curSize.height,\n                ow = w,\n                oh = h,\n                mw = this.minWidth,\n                mh = this.minHeight,\n                mxw = this.maxWidth,\n                mxh = this.maxHeight,\n                wi = this.widthIncrement,\n                hi = this.heightIncrement,\n                eventXY = e.getXY(),\n                diffX = -(this.startPoint[0] - Math.max(this.minX, eventXY[0])),\n                diffY = -(this.startPoint[1] - Math.max(this.minY, eventXY[1])),\n                pos = this.activeHandle.position,\n                tw,\n                th;\n\n            switch(pos){\n                case 'east':\n                    w += diffX;\n                    w = Math.min(Math.max(mw, w), mxw);\n                    break;\n                case 'south':\n                    h += diffY;\n                    h = Math.min(Math.max(mh, h), mxh);\n                    break;\n                case 'southeast':\n                    w += diffX;\n                    h += diffY;\n                    w = Math.min(Math.max(mw, w), mxw);\n                    h = Math.min(Math.max(mh, h), mxh);\n                    break;\n                case 'north':\n                    diffY = this.constrain(h, diffY, mh, mxh);\n                    y += diffY;\n                    h -= diffY;\n                    break;\n                case 'west':\n                    diffX = this.constrain(w, diffX, mw, mxw);\n                    x += diffX;\n                    w -= diffX;\n                    break;\n                case 'northeast':\n                    w += diffX;\n                    w = Math.min(Math.max(mw, w), mxw);\n                    diffY = this.constrain(h, diffY, mh, mxh);\n                    y += diffY;\n                    h -= diffY;\n                    break;\n                case 'northwest':\n                    diffX = this.constrain(w, diffX, mw, mxw);\n                    diffY = this.constrain(h, diffY, mh, mxh);\n                    y += diffY;\n                    h -= diffY;\n                    x += diffX;\n                    w -= diffX;\n                    break;\n               case 'southwest':\n                    diffX = this.constrain(w, diffX, mw, mxw);\n                    h += diffY;\n                    h = Math.min(Math.max(mh, h), mxh);\n                    x += diffX;\n                    w -= diffX;\n                    break;\n            }\n\n            var sw = this.snap(w, wi, mw);\n            var sh = this.snap(h, hi, mh);\n            if(sw != w || sh != h){\n                switch(pos){\n                    case 'northeast':\n                        y -= sh - h;\n                    break;\n                    case 'north':\n                        y -= sh - h;\n                        break;\n                    case 'southwest':\n                        x -= sw - w;\n                    break;\n                    case 'west':\n                        x -= sw - w;\n                        break;\n                    case 'northwest':\n                        x -= sw - w;\n                        y -= sh - h;\n                    break;\n                }\n                w = sw;\n                h = sh;\n            }\n\n            if(this.preserveRatio){\n                switch(pos){\n                    case 'southeast':\n                    case 'east':\n                        h = oh * (w/ow);\n                        h = Math.min(Math.max(mh, h), mxh);\n                        w = ow * (h/oh);\n                       break;\n                    case 'south':\n                        w = ow * (h/oh);\n                        w = Math.min(Math.max(mw, w), mxw);\n                        h = oh * (w/ow);\n                        break;\n                    case 'northeast':\n                        w = ow * (h/oh);\n                        w = Math.min(Math.max(mw, w), mxw);\n                        h = oh * (w/ow);\n                    break;\n                    case 'north':\n                        tw = w;\n                        w = ow * (h/oh);\n                        w = Math.min(Math.max(mw, w), mxw);\n                        h = oh * (w/ow);\n                        x += (tw - w) / 2;\n                        break;\n                    case 'southwest':\n                        h = oh * (w/ow);\n                        h = Math.min(Math.max(mh, h), mxh);\n                        tw = w;\n                        w = ow * (h/oh);\n                        x += tw - w;\n                        break;\n                    case 'west':\n                        th = h;\n                        h = oh * (w/ow);\n                        h = Math.min(Math.max(mh, h), mxh);\n                        y += (th - h) / 2;\n                        tw = w;\n                        w = ow * (h/oh);\n                        x += tw - w;\n                       break;\n                    case 'northwest':\n                        tw = w;\n                        th = h;\n                        h = oh * (w/ow);\n                        h = Math.min(Math.max(mh, h), mxh);\n                        w = ow * (h/oh);\n                        y += th - h;\n                        x += tw - w;\n                        break;\n\n                }\n            }\n            this.proxy.setBounds(x, y, w, h);\n            if(this.dynamic){\n                this.resizeElement();\n            }\n            }catch(ex){}\n        }\n    },\n\n    // private\n    handleOver : function(){\n        if(this.enabled){\n            this.el.addClass('x-resizable-over');\n        }\n    },\n\n    // private\n    handleOut : function(){\n        if(!this.resizing){\n            this.el.removeClass('x-resizable-over');\n        }\n    },\n\n    /**\n     * Returns the element this component is bound to.\n     * @return {Ext.Element}\n     */\n    getEl : function(){\n        return this.el;\n    },\n\n    /**\n     * Returns the resizeChild element (or null).\n     * @return {Ext.Element}\n     */\n    getResizeChild : function(){\n        return this.resizeChild;\n    },\n\n    /**\n     * Destroys this resizable. If the element was wrapped and\n     * removeEl is not true then the element remains.\n     * @param {Boolean} removeEl (optional) true to remove the element from the DOM\n     */\n    destroy : function(removeEl){\n        Ext.destroy(this.dd, this.overlay, this.proxy);\n        this.overlay = null;\n        this.proxy = null;\n\n        var ps = Ext.Resizable.positions;\n        for(var k in ps){\n            if(typeof ps[k] != 'function' && this[ps[k]]){\n                this[ps[k]].destroy();\n            }\n        }\n        if(removeEl){\n            this.el.update('');\n            Ext.destroy(this.el);\n            this.el = null;\n        }\n        this.purgeListeners();\n    },\n\n    syncHandleHeight : function(){\n        var h = this.el.getHeight(true);\n        if(this.west){\n            this.west.el.setHeight(h);\n        }\n        if(this.east){\n            this.east.el.setHeight(h);\n        }\n    }\n});\n\n// private\n// hash to map config positions to true positions\nExt.Resizable.positions = {\n    n: 'north', s: 'south', e: 'east', w: 'west', se: 'southeast', sw: 'southwest', nw: 'northwest', ne: 'northeast'\n};\n\nExt.Resizable.Handle = Ext.extend(Object, {\n    constructor : function(rz, pos, disableTrackOver, transparent, cls){\n       if(!this.tpl){\n            // only initialize the template if resizable is used\n            var tpl = Ext.DomHelper.createTemplate(\n                {tag: 'div', cls: 'x-resizable-handle x-resizable-handle-{0}'}\n            );\n            tpl.compile();\n            Ext.Resizable.Handle.prototype.tpl = tpl;\n        }\n        this.position = pos;\n        this.rz = rz;\n        this.el = this.tpl.append(rz.el.dom, [this.position], true);\n        this.el.unselectable();\n        if(transparent){\n            this.el.setOpacity(0);\n        }\n        if(!Ext.isEmpty(cls)){\n            this.el.addClass(cls);\n        }\n        this.el.on('mousedown', this.onMouseDown, this);\n        if(!disableTrackOver){\n            this.el.on({\n                scope: this,\n                mouseover: this.onMouseOver,\n                mouseout: this.onMouseOut\n            });\n        }\n    },\n\n    // private\n    afterResize : function(rz){\n        // do nothing\n    },\n    // private\n    onMouseDown : function(e){\n        this.rz.onMouseDown(this, e);\n    },\n    // private\n    onMouseOver : function(e){\n        this.rz.handleOver(this, e);\n    },\n    // private\n    onMouseOut : function(e){\n        this.rz.handleOut(this, e);\n    },\n    // private\n    destroy : function(){\n        Ext.destroy(this.el);\n        this.el = null;\n    }\n});\n/**\n * @class Ext.Window\n * @extends Ext.Panel\n * <p>A specialized panel intended for use as an application window.  Windows are floated, {@link #resizable}, and\n * {@link #draggable} by default.  Windows can be {@link #maximizable maximized} to fill the viewport,\n * restored to their prior size, and can be {@link #minimize}d.</p>\n * <p>Windows can also be linked to a {@link Ext.WindowGroup} or managed by the {@link Ext.WindowMgr} to provide\n * grouping, activation, to front, to back and other application-specific behavior.</p>\n * <p>By default, Windows will be rendered to document.body. To {@link #constrain} a Window to another element\n * specify {@link Ext.Component#renderTo renderTo}.</p>\n * <p><b>Note:</b> By default, the <code>{@link #closable close}</code> header tool <i>destroys</i> the Window resulting in\n * destruction of any child Components. This makes the Window object, and all its descendants <b>unusable</b>. To enable\n * re-use of a Window, use <b><code>{@link #closeAction closeAction: 'hide'}</code></b>.</p>\n * @constructor\n * @param {Object} config The config object\n * @xtype window\n */\nExt.Window = Ext.extend(Ext.Panel, {\n    /**\n     * @cfg {Number} x\n     * The X position of the left edge of the window on initial showing. Defaults to centering the Window within\n     * the width of the Window's container {@link Ext.Element Element) (The Element that the Window is rendered to).\n     */\n    /**\n     * @cfg {Number} y\n     * The Y position of the top edge of the window on initial showing. Defaults to centering the Window within\n     * the height of the Window's container {@link Ext.Element Element) (The Element that the Window is rendered to).\n     */\n    /**\n     * @cfg {Boolean} modal\n     * True to make the window modal and mask everything behind it when displayed, false to display it without\n     * restricting access to other UI elements (defaults to false).\n     */\n    /**\n     * @cfg {String/Element} animateTarget\n     * Id or element from which the window should animate while opening (defaults to null with no animation).\n     */\n    /**\n     * @cfg {String} resizeHandles\n     * A valid {@link Ext.Resizable} handles config string (defaults to 'all').  Only applies when resizable = true.\n     */\n    /**\n     * @cfg {Ext.WindowGroup} manager\n     * A reference to the WindowGroup that should manage this window (defaults to {@link Ext.WindowMgr}).\n     */\n    /**\n    * @cfg {String/Number/Component} defaultButton\n    * <p>Specifies a Component to receive focus when this Window is focussed.</p>\n    * <p>This may be one of:</p><div class=\"mdetail-params\"><ul>\n    * <li>The index of a footer Button.</li>\n    * <li>The id of a Component.</li>\n    * <li>A Component.</li>\n    * </ul></div>\n    */\n    /**\n    * @cfg {Function} onEsc\n    * Allows override of the built-in processing for the escape key. Default action\n    * is to close the Window (performing whatever action is specified in {@link #closeAction}.\n    * To prevent the Window closing when the escape key is pressed, specify this as\n    * Ext.emptyFn (See {@link Ext#emptyFn}).\n    */\n    /**\n     * @cfg {Boolean} collapsed\n     * True to render the window collapsed, false to render it expanded (defaults to false). Note that if\n     * {@link #expandOnShow} is true (the default) it will override the <tt>collapsed</tt> config and the window\n     * will always be expanded when shown.\n     */\n    /**\n     * @cfg {Boolean} maximized\n     * True to initially display the window in a maximized state. (Defaults to false).\n     */\n\n    /**\n    * @cfg {String} baseCls\n    * The base CSS class to apply to this panel's element (defaults to 'x-window').\n    */\n    baseCls : 'x-window',\n    /**\n     * @cfg {Boolean} resizable\n     * True to allow user resizing at each edge and corner of the window, false to disable resizing (defaults to true).\n     */\n    resizable : true,\n    /**\n     * @cfg {Boolean} draggable\n     * True to allow the window to be dragged by the header bar, false to disable dragging (defaults to true).  Note\n     * that by default the window will be centered in the viewport, so if dragging is disabled the window may need\n     * to be positioned programmatically after render (e.g., myWindow.setPosition(100, 100);).\n     */\n    draggable : true,\n    /**\n     * @cfg {Boolean} closable\n     * <p>True to display the 'close' tool button and allow the user to close the window, false to\n     * hide the button and disallow closing the window (defaults to true).</p>\n     * <p>By default, when close is requested by either clicking the close button in the header\n     * or pressing ESC when the Window has focus, the {@link #close} method will be called. This\n     * will <i>{@link Ext.Component#destroy destroy}</i> the Window and its content meaning that\n     * it may not be reused.</p>\n     * <p>To make closing a Window <i>hide</i> the Window so that it may be reused, set\n     * {@link #closeAction} to 'hide'.\n     */\n    closable : true,\n    /**\n     * @cfg {String} closeAction\n     * <p>The action to take when the close header tool is clicked:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b><code>'{@link #close}'</code></b> : <b>Default</b><div class=\"sub-desc\">\n     * {@link #close remove} the window from the DOM and {@link Ext.Component#destroy destroy}\n     * it and all descendant Components. The window will <b>not</b> be available to be\n     * redisplayed via the {@link #show} method.\n     * </div></li>\n     * <li><b><code>'{@link #hide}'</code></b> : <div class=\"sub-desc\">\n     * {@link #hide} the window by setting visibility to hidden and applying negative offsets.\n     * The window will be available to be redisplayed via the {@link #show} method.\n     * </div></li>\n     * </ul></div>\n     * <p><b>Note:</b> This setting does not affect the {@link #close} method\n     * which will always {@link Ext.Component#destroy destroy} the window. To\n     * programatically <i>hide</i> a window, call {@link #hide}.</p>\n     */\n    closeAction : 'close',\n    /**\n     * @cfg {Boolean} constrain\n     * True to constrain the window within its containing element, false to allow it to fall outside of its\n     * containing element. By default the window will be rendered to document.body.  To render and constrain the\n     * window within another element specify {@link #renderTo}.\n     * (defaults to false).  Optionally the header only can be constrained using {@link #constrainHeader}.\n     */\n    constrain : false,\n    /**\n     * @cfg {Boolean} constrainHeader\n     * True to constrain the window header within its containing element (allowing the window body to fall outside\n     * of its containing element) or false to allow the header to fall outside its containing element (defaults to\n     * false). Optionally the entire window can be constrained using {@link #constrain}.\n     */\n    constrainHeader : false,\n    /**\n     * @cfg {Boolean} plain\n     * True to render the window body with a transparent background so that it will blend into the framing\n     * elements, false to add a lighter background color to visually highlight the body element and separate it\n     * more distinctly from the surrounding frame (defaults to false).\n     */\n    plain : false,\n    /**\n     * @cfg {Boolean} minimizable\n     * True to display the 'minimize' tool button and allow the user to minimize the window, false to hide the button\n     * and disallow minimizing the window (defaults to false).  Note that this button provides no implementation --\n     * the behavior of minimizing a window is implementation-specific, so the minimize event must be handled and a\n     * custom minimize behavior implemented for this option to be useful.\n     */\n    minimizable : false,\n    /**\n     * @cfg {Boolean} maximizable\n     * True to display the 'maximize' tool button and allow the user to maximize the window, false to hide the button\n     * and disallow maximizing the window (defaults to false).  Note that when a window is maximized, the tool button\n     * will automatically change to a 'restore' button with the appropriate behavior already built-in that will\n     * restore the window to its previous size.\n     */\n    maximizable : false,\n    /**\n     * @cfg {Number} minHeight\n     * The minimum height in pixels allowed for this window (defaults to 100).  Only applies when resizable = true.\n     */\n    minHeight : 100,\n    /**\n     * @cfg {Number} minWidth\n     * The minimum width in pixels allowed for this window (defaults to 200).  Only applies when resizable = true.\n     */\n    minWidth : 200,\n    /**\n     * @cfg {Boolean} expandOnShow\n     * True to always expand the window when it is displayed, false to keep it in its current state (which may be\n     * {@link #collapsed}) when displayed (defaults to true).\n     */\n    expandOnShow : true,\n    \n    /**\n     * @cfg {Number} showAnimDuration The number of seconds that the window show animation takes if enabled.\n     * Defaults to 0.25\n     */\n    showAnimDuration: 0.25,\n    \n    /**\n     * @cfg {Number} hideAnimDuration The number of seconds that the window hide animation takes if enabled.\n     * Defaults to 0.25\n     */\n    hideAnimDuration: 0.25,\n\n    // inherited docs, same default\n    collapsible : false,\n\n    /**\n     * @cfg {Boolean} initHidden\n     * True to hide the window until show() is explicitly called (defaults to true).\n     * @deprecated\n     */\n    initHidden : undefined,\n\n    /**\n     * @cfg {Boolean} hidden\n     * Render this component hidden (default is <tt>true</tt>). If <tt>true</tt>, the\n     * {@link #hide} method will be called internally.\n     */\n    hidden : true,\n\n    // The following configs are set to provide the basic functionality of a window.\n    // Changing them would require additional code to handle correctly and should\n    // usually only be done in subclasses that can provide custom behavior.  Changing them\n    // may have unexpected or undesirable results.\n    /** @cfg {String} elements @hide */\n    elements : 'header,body',\n    /** @cfg {Boolean} frame @hide */\n    frame : true,\n    /** @cfg {Boolean} floating @hide */\n    floating : true,\n\n    // private\n    initComponent : function(){\n        this.initTools();\n        Ext.Window.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event activate\n             * Fires after the window has been visually activated via {@link #setActive}.\n             * @param {Ext.Window} this\n             */\n            /**\n             * @event deactivate\n             * Fires after the window has been visually deactivated via {@link #setActive}.\n             * @param {Ext.Window} this\n             */\n            /**\n             * @event resize\n             * Fires after the window has been resized.\n             * @param {Ext.Window} this\n             * @param {Number} width The window's new width\n             * @param {Number} height The window's new height\n             */\n            'resize',\n            /**\n             * @event maximize\n             * Fires after the window has been maximized.\n             * @param {Ext.Window} this\n             */\n            'maximize',\n            /**\n             * @event minimize\n             * Fires after the window has been minimized.\n             * @param {Ext.Window} this\n             */\n            'minimize',\n            /**\n             * @event restore\n             * Fires after the window has been restored to its original size after being maximized.\n             * @param {Ext.Window} this\n             */\n            'restore'\n        );\n        // for backwards compat, this should be removed at some point\n        if(Ext.isDefined(this.initHidden)){\n            this.hidden = this.initHidden;\n        }\n        if(this.hidden === false){\n            this.hidden = true;\n            this.show();\n        }\n    },\n\n    // private\n    getState : function(){\n        return Ext.apply(Ext.Window.superclass.getState.call(this) || {}, this.getBox(true));\n    },\n\n    // private\n    onRender : function(ct, position){\n        Ext.Window.superclass.onRender.call(this, ct, position);\n\n        if(this.plain){\n            this.el.addClass('x-window-plain');\n        }\n\n        // this element allows the Window to be focused for keyboard events\n        this.focusEl = this.el.createChild({\n                    tag: 'a', href:'#', cls:'x-dlg-focus',\n                    tabIndex:'-1', html: '&#160;'});\n        this.focusEl.swallowEvent('click', true);\n\n        this.proxy = this.el.createProxy('x-window-proxy');\n        this.proxy.enableDisplayMode('block');\n\n        if(this.modal){\n            this.mask = this.container.createChild({cls:'ext-el-mask'}, this.el.dom);\n            this.mask.enableDisplayMode('block');\n            this.mask.hide();\n            this.mon(this.mask, 'click', this.focus, this);\n        }\n        if(this.maximizable){\n            this.mon(this.header, 'dblclick', this.toggleMaximize, this);\n        }\n    },\n\n    // private\n    initEvents : function(){\n        Ext.Window.superclass.initEvents.call(this);\n        if(this.animateTarget){\n            this.setAnimateTarget(this.animateTarget);\n        }\n\n        if(this.resizable){\n            this.resizer = new Ext.Resizable(this.el, {\n                minWidth: this.minWidth,\n                minHeight:this.minHeight,\n                handles: this.resizeHandles || 'all',\n                pinned: true,\n                resizeElement : this.resizerAction,\n                handleCls: 'x-window-handle'\n            });\n            this.resizer.window = this;\n            this.mon(this.resizer, 'beforeresize', this.beforeResize, this);\n        }\n\n        if(this.draggable){\n            this.header.addClass('x-window-draggable');\n        }\n        this.mon(this.el, 'mousedown', this.toFront, this);\n        this.manager = this.manager || Ext.WindowMgr;\n        this.manager.register(this);\n        if(this.maximized){\n            this.maximized = false;\n            this.maximize();\n        }\n        if(this.closable){\n            var km = this.getKeyMap();\n            km.on(27, this.onEsc, this);\n            km.disable();\n        }\n    },\n\n    initDraggable : function(){\n        /**\n         * <p>If this Window is configured {@link #draggable}, this property will contain\n         * an instance of {@link Ext.dd.DD} which handles dragging the Window's DOM Element.</p>\n         * <p>This has implementations of <code>startDrag</code>, <code>onDrag</code> and <code>endDrag</code>\n         * which perform the dragging action. If extra logic is needed at these points, use\n         * {@link Function#createInterceptor createInterceptor} or {@link Function#createSequence createSequence} to\n         * augment the existing implementations.</p>\n         * @type Ext.dd.DD\n         * @property dd\n         */\n        this.dd = new Ext.Window.DD(this);\n    },\n\n   // private\n    onEsc : function(k, e){\n        if (this.activeGhost) {\n            this.unghost();\n        }\n        e.stopEvent();\n        this[this.closeAction]();\n    },\n\n    // private\n    beforeDestroy : function(){\n        if(this.rendered){\n            this.hide();\n            this.clearAnchor();\n            Ext.destroy(\n                this.focusEl,\n                this.resizer,\n                this.dd,\n                this.proxy,\n                this.mask\n            );\n        }\n        Ext.Window.superclass.beforeDestroy.call(this);\n    },\n\n    // private\n    onDestroy : function(){\n        if(this.manager){\n            this.manager.unregister(this);\n        }\n        Ext.Window.superclass.onDestroy.call(this);\n    },\n\n    // private\n    initTools : function(){\n        if(this.minimizable){\n            this.addTool({\n                id: 'minimize',\n                handler: this.minimize.createDelegate(this, [])\n            });\n        }\n        if(this.maximizable){\n            this.addTool({\n                id: 'maximize',\n                handler: this.maximize.createDelegate(this, [])\n            });\n            this.addTool({\n                id: 'restore',\n                handler: this.restore.createDelegate(this, []),\n                hidden:true\n            });\n        }\n        if(this.closable){\n            this.addTool({\n                id: 'close',\n                handler: this[this.closeAction].createDelegate(this, [])\n            });\n        }\n    },\n\n    // private\n    resizerAction : function(){\n        var box = this.proxy.getBox();\n        this.proxy.hide();\n        this.window.handleResize(box);\n        return box;\n    },\n\n    // private\n    beforeResize : function(){\n        this.resizer.minHeight = Math.max(this.minHeight, this.getFrameHeight() + 40); // 40 is a magic minimum content size?\n        this.resizer.minWidth = Math.max(this.minWidth, this.getFrameWidth() + 40);\n        this.resizeBox = this.el.getBox();\n    },\n\n    // private\n    updateHandles : function(){\n        if(Ext.isIE9m && this.resizer){\n            this.resizer.syncHandleHeight();\n            this.el.repaint();\n        }\n    },\n\n    // private\n    handleResize : function(box){\n        var rz = this.resizeBox;\n        if(rz.x != box.x || rz.y != box.y){\n            this.updateBox(box);\n        }else{\n            this.setSize(box);\n            if (Ext.isIE6 && Ext.isStrict) {\n                this.doLayout();\n            }\n        }\n        this.focus();\n        this.updateHandles();\n        this.saveState();\n    },\n\n    /**\n     * Focuses the window.  If a defaultButton is set, it will receive focus, otherwise the\n     * window itself will receive focus.\n     */\n    focus : function(){\n        var f = this.focusEl,\n            db = this.defaultButton,\n            t = typeof db,\n            el,\n            ct;\n        if(Ext.isDefined(db)){\n            if(Ext.isNumber(db) && this.fbar){\n                f = this.fbar.items.get(db);\n            }else if(Ext.isString(db)){\n                f = Ext.getCmp(db);\n            }else{\n                f = db;\n            }\n            el = f.getEl();\n            ct = Ext.getDom(this.container);\n            if (el && ct) {\n                if (ct != document.body && !Ext.lib.Region.getRegion(ct).contains(Ext.lib.Region.getRegion(el.dom))){\n                    return;\n                }\n            }\n        }\n        f = f || this.focusEl;\n        f.focus.defer(10, f);\n    },\n\n    /**\n     * Sets the target element from which the window should animate while opening.\n     * @param {String/Element} el The target element or id\n     */\n    setAnimateTarget : function(el){\n        el = Ext.get(el);\n        this.animateTarget = el;\n    },\n\n    // private\n    beforeShow : function(){\n        delete this.el.lastXY;\n        delete this.el.lastLT;\n        if(this.x === undefined || this.y === undefined){\n            var xy = this.el.getAlignToXY(this.container, 'c-c');\n            var pos = this.el.translatePoints(xy[0], xy[1]);\n            this.x = this.x === undefined? pos.left : this.x;\n            this.y = this.y === undefined? pos.top : this.y;\n        }\n        this.el.setLeftTop(this.x, this.y);\n\n        if(this.expandOnShow){\n            this.expand(false);\n        }\n\n        if(this.modal){\n            Ext.getBody().addClass('x-body-masked');\n            this.mask.setSize(Ext.lib.Dom.getViewWidth(true), Ext.lib.Dom.getViewHeight(true));\n            this.mask.show();\n        }\n    },\n\n    /**\n     * Shows the window, rendering it first if necessary, or activates it and brings it to front if hidden.\n     * @param {String/Element} animateTarget (optional) The target element or id from which the window should\n     * animate while opening (defaults to null with no animation)\n     * @param {Function} callback (optional) A callback function to call after the window is displayed\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the callback is executed. Defaults to this Window.\n     * @return {Ext.Window} this\n     */\n    show : function(animateTarget, cb, scope){\n        if(!this.rendered){\n            this.render(Ext.getBody());\n        }\n        if(this.hidden === false){\n            this.toFront();\n            return this;\n        }\n        if(this.fireEvent('beforeshow', this) === false){\n            return this;\n        }\n        if(cb){\n            this.on('show', cb, scope, {single:true});\n        }\n        this.hidden = false;\n        if(Ext.isDefined(animateTarget)){\n            this.setAnimateTarget(animateTarget);\n        }\n        this.beforeShow();\n        if(this.animateTarget){\n            this.animShow();\n        }else{\n            this.afterShow();\n        }\n        return this;\n    },\n\n    // private\n    afterShow : function(isAnim){\n        if (this.isDestroyed){\n            return false;\n        }\n        this.proxy.hide();\n        this.el.setStyle('display', 'block');\n        this.el.show();\n        if(this.maximized){\n            this.fitContainer();\n        }\n        if(Ext.isMac && Ext.isGecko2){ // work around stupid FF 2.0/Mac scroll bar bug\n            this.cascade(this.setAutoScroll);\n        }\n\n        if(this.monitorResize || this.modal || this.constrain || this.constrainHeader){\n            Ext.EventManager.onWindowResize(this.onWindowResize, this);\n        }\n        this.doConstrain();\n        this.doLayout();\n        if(this.keyMap){\n            this.keyMap.enable();\n        }\n        this.toFront();\n        this.updateHandles();\n        if(isAnim && (Ext.isIE || Ext.isWebKit)){\n            var sz = this.getSize();\n            this.onResize(sz.width, sz.height);\n        }\n        this.onShow();\n        this.fireEvent('show', this);\n    },\n\n    // private\n    animShow : function(){\n        this.proxy.show();\n        this.proxy.setBox(this.animateTarget.getBox());\n        this.proxy.setOpacity(0);\n        var b = this.getBox();\n        this.el.setStyle('display', 'none');\n        this.proxy.shift(Ext.apply(b, {\n            callback: this.afterShow.createDelegate(this, [true], false),\n            scope: this,\n            easing: 'easeNone',\n            duration: this.showAnimDuration,\n            opacity: 0.5\n        }));\n    },\n\n    /**\n     * Hides the window, setting it to invisible and applying negative offsets.\n     * @param {String/Element} animateTarget (optional) The target element or id to which the window should\n     * animate while hiding (defaults to null with no animation)\n     * @param {Function} callback (optional) A callback function to call after the window is hidden\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the callback is executed. Defaults to this Window.\n     * @return {Ext.Window} this\n     */\n    hide : function(animateTarget, cb, scope){\n        if(this.hidden || this.fireEvent('beforehide', this) === false){\n            return this;\n        }\n        if(cb){\n            this.on('hide', cb, scope, {single:true});\n        }\n        this.hidden = true;\n        if(animateTarget !== undefined){\n            this.setAnimateTarget(animateTarget);\n        }\n        if(this.modal){\n            this.mask.hide();\n            Ext.getBody().removeClass('x-body-masked');\n        }\n        if(this.animateTarget){\n            this.animHide();\n        }else{\n            this.el.hide();\n            this.afterHide();\n        }\n        return this;\n    },\n\n    // private\n    afterHide : function(){\n        this.proxy.hide();\n        if(this.monitorResize || this.modal || this.constrain || this.constrainHeader){\n            Ext.EventManager.removeResizeListener(this.onWindowResize, this);\n        }\n        if(this.keyMap){\n            this.keyMap.disable();\n        }\n        this.onHide();\n        this.fireEvent('hide', this);\n    },\n\n    // private\n    animHide : function(){\n        this.proxy.setOpacity(0.5);\n        this.proxy.show();\n        var tb = this.getBox(false);\n        this.proxy.setBox(tb);\n        this.el.hide();\n        this.proxy.shift(Ext.apply(this.animateTarget.getBox(), {\n            callback: this.afterHide,\n            scope: this,\n            duration: this.hideAnimDuration,\n            easing: 'easeNone',\n            opacity: 0\n        }));\n    },\n\n    /**\n     * Method that is called immediately before the <code>show</code> event is fired.\n     * Defaults to <code>Ext.emptyFn</code>.\n     */\n    onShow : Ext.emptyFn,\n\n    /**\n     * Method that is called immediately before the <code>hide</code> event is fired.\n     * Defaults to <code>Ext.emptyFn</code>.\n     */\n    onHide : Ext.emptyFn,\n\n    // private\n    onWindowResize : function(){\n        if(this.maximized){\n            this.fitContainer();\n        }\n        if(this.modal){\n            this.mask.setSize('100%', '100%');\n            var force = this.mask.dom.offsetHeight;\n            this.mask.setSize(Ext.lib.Dom.getViewWidth(true), Ext.lib.Dom.getViewHeight(true));\n        }\n        this.doConstrain();\n    },\n\n    // private\n    doConstrain : function(){\n        if(this.constrain || this.constrainHeader){\n            var offsets;\n            if(this.constrain){\n                offsets = {\n                    right:this.el.shadowOffset,\n                    left:this.el.shadowOffset,\n                    bottom:this.el.shadowOffset\n                };\n            }else {\n                var s = this.getSize();\n                offsets = {\n                    right:-(s.width - 100),\n                    bottom:-(s.height - 25 + this.el.getConstrainOffset())\n                };\n            }\n\n            var xy = this.el.getConstrainToXY(this.container, true, offsets);\n            if(xy){\n                this.setPosition(xy[0], xy[1]);\n            }\n        }\n    },\n\n    // private - used for dragging\n    ghost : function(cls){\n        var ghost = this.createGhost(cls);\n        var box = this.getBox(true);\n        ghost.setLeftTop(box.x, box.y);\n        ghost.setWidth(box.width);\n        this.el.hide();\n        this.activeGhost = ghost;\n        return ghost;\n    },\n\n    // private\n    unghost : function(show, matchPosition){\n        if(!this.activeGhost) {\n            return;\n        }\n        if(show !== false){\n            this.el.show();\n            this.focus.defer(10, this);\n            if(Ext.isMac && Ext.isGecko2){ // work around stupid FF 2.0/Mac scroll bar bug\n                this.cascade(this.setAutoScroll);\n            }\n        }\n        if(matchPosition !== false){\n            this.setPosition(this.activeGhost.getLeft(true), this.activeGhost.getTop(true));\n        }\n        this.activeGhost.hide();\n        this.activeGhost.remove();\n        delete this.activeGhost;\n    },\n\n    /**\n     * Placeholder method for minimizing the window.  By default, this method simply fires the {@link #minimize} event\n     * since the behavior of minimizing a window is application-specific.  To implement custom minimize behavior,\n     * either the minimize event can be handled or this method can be overridden.\n     * @return {Ext.Window} this\n     */\n    minimize : function(){\n        this.fireEvent('minimize', this);\n        return this;\n    },\n\n    /**\n     * <p>Closes the Window, removes it from the DOM, {@link Ext.Component#destroy destroy}s\n     * the Window object and all its descendant Components. The {@link Ext.Panel#beforeclose beforeclose}\n     * event is fired before the close happens and will cancel the close action if it returns false.<p>\n     * <p><b>Note:</b> This method is not affected by the {@link #closeAction} setting which\n     * only affects the action triggered when clicking the {@link #closable 'close' tool in the header}.\n     * To hide the Window without destroying it, call {@link #hide}.</p>\n     */\n    close : function(){\n        if(this.fireEvent('beforeclose', this) !== false){\n            if(this.hidden){\n                this.doClose();\n            }else{\n                this.hide(null, this.doClose, this);\n            }\n        }\n    },\n\n    // private\n    doClose : function(){\n        this.fireEvent('close', this);\n        this.destroy();\n    },\n\n    /**\n     * Fits the window within its current container and automatically replaces\n     * the {@link #maximizable 'maximize' tool button} with the 'restore' tool button.\n     * Also see {@link #toggleMaximize}.\n     * @return {Ext.Window} this\n     */\n    maximize : function(){\n        if(!this.maximized){\n            this.expand(false);\n            this.restoreSize = this.getSize();\n            this.restorePos = this.getPosition(true);\n            if (this.maximizable){\n                this.tools.maximize.hide();\n                this.tools.restore.show();\n            }\n            this.maximized = true;\n            this.el.disableShadow();\n\n            if(this.dd){\n                this.dd.lock();\n            }\n            if(this.collapsible){\n                this.tools.toggle.hide();\n            }\n            this.el.addClass('x-window-maximized');\n            this.container.addClass('x-window-maximized-ct');\n\n            this.setPosition(0, 0);\n            this.fitContainer();\n            this.fireEvent('maximize', this);\n        }\n        return this;\n    },\n\n    /**\n     * Restores a {@link #maximizable maximized}  window back to its original\n     * size and position prior to being maximized and also replaces\n     * the 'restore' tool button with the 'maximize' tool button.\n     * Also see {@link #toggleMaximize}.\n     * @return {Ext.Window} this\n     */\n    restore : function(){\n        if(this.maximized){\n            var t = this.tools;\n            this.el.removeClass('x-window-maximized');\n            if(t.restore){\n                t.restore.hide();\n            }\n            if(t.maximize){\n                t.maximize.show();\n            }\n            this.setPosition(this.restorePos[0], this.restorePos[1]);\n            this.setSize(this.restoreSize.width, this.restoreSize.height);\n            delete this.restorePos;\n            delete this.restoreSize;\n            this.maximized = false;\n            this.el.enableShadow(true);\n\n            if(this.dd){\n                this.dd.unlock();\n            }\n            if(this.collapsible && t.toggle){\n                t.toggle.show();\n            }\n            this.container.removeClass('x-window-maximized-ct');\n\n            this.doConstrain();\n            this.fireEvent('restore', this);\n        }\n        return this;\n    },\n\n    /**\n     * A shortcut method for toggling between {@link #maximize} and {@link #restore} based on the current maximized\n     * state of the window.\n     * @return {Ext.Window} this\n     */\n    toggleMaximize : function(){\n        return this[this.maximized ? 'restore' : 'maximize']();\n    },\n\n    // private\n    fitContainer : function(){\n        var vs = this.container.getViewSize(false);\n        this.setSize(vs.width, vs.height);\n    },\n\n    // private\n    // z-index is managed by the WindowManager and may be overwritten at any time\n    setZIndex : function(index){\n        if(this.modal){\n            this.mask.setStyle('z-index', index);\n        }\n        this.el.setZIndex(++index);\n        index += 5;\n\n        if(this.resizer){\n            this.resizer.proxy.setStyle('z-index', ++index);\n        }\n\n        this.lastZIndex = index;\n    },\n\n    /**\n     * Aligns the window to the specified element\n     * @param {Mixed} element The element to align to.\n     * @param {String} position (optional, defaults to \"tl-bl?\") The position to align to (see {@link Ext.Element#alignTo} for more details).\n     * @param {Array} offsets (optional) Offset the positioning by [x, y]\n     * @return {Ext.Window} this\n     */\n    alignTo : function(element, position, offsets){\n        var xy = this.el.getAlignToXY(element, position, offsets);\n        this.setPagePosition(xy[0], xy[1]);\n        return this;\n    },\n\n    /**\n     * Anchors this window to another element and realigns it when the window is resized or scrolled.\n     * @param {Mixed} element The element to align to.\n     * @param {String} position The position to align to (see {@link Ext.Element#alignTo} for more details)\n     * @param {Array} offsets (optional) Offset the positioning by [x, y]\n     * @param {Boolean/Number} monitorScroll (optional) true to monitor body scroll and reposition. If this parameter\n     * is a number, it is used as the buffer delay (defaults to 50ms).\n     * @return {Ext.Window} this\n     */\n    anchorTo : function(el, alignment, offsets, monitorScroll){\n        this.clearAnchor();\n        this.anchorTarget = {\n            el: el,\n            alignment: alignment,\n            offsets: offsets\n        };\n\n        Ext.EventManager.onWindowResize(this.doAnchor, this);\n        var tm = typeof monitorScroll;\n        if(tm != 'undefined'){\n            Ext.EventManager.on(window, 'scroll', this.doAnchor, this,\n                {buffer: tm == 'number' ? monitorScroll : 50});\n        }\n        return this.doAnchor();\n    },\n\n    /**\n     * Performs the anchor, using the saved anchorTarget property.\n     * @return {Ext.Window} this\n     * @private\n     */\n    doAnchor : function(){\n        var o = this.anchorTarget;\n        this.alignTo(o.el, o.alignment, o.offsets);\n        return this;\n    },\n\n    /**\n     * Removes any existing anchor from this window. See {@link #anchorTo}.\n     * @return {Ext.Window} this\n     */\n    clearAnchor : function(){\n        if(this.anchorTarget){\n            Ext.EventManager.removeResizeListener(this.doAnchor, this);\n            Ext.EventManager.un(window, 'scroll', this.doAnchor, this);\n            delete this.anchorTarget;\n        }\n        return this;\n    },\n\n    /**\n     * Brings this window to the front of any other visible windows\n     * @param {Boolean} e (optional) Specify <tt>false</tt> to prevent the window from being focused.\n     * @return {Ext.Window} this\n     */\n    toFront : function(e){\n        if(this.manager.bringToFront(this)){\n            if(!e || !e.getTarget().focus){\n                this.focus();\n            }\n        }\n        return this;\n    },\n\n    /**\n     * Makes this the active window by showing its shadow, or deactivates it by hiding its shadow.  This method also\n     * fires the {@link #activate} or {@link #deactivate} event depending on which action occurred. This method is\n     * called internally by {@link Ext.WindowMgr}.\n     * @param {Boolean} active True to activate the window, false to deactivate it (defaults to false)\n     */\n    setActive : function(active){\n        if(active){\n            if(!this.maximized){\n                this.el.enableShadow(true);\n            }\n            this.fireEvent('activate', this);\n        }else{\n            this.el.disableShadow();\n            this.fireEvent('deactivate', this);\n        }\n    },\n\n    /**\n     * Sends this window to the back of (lower z-index than) any other visible windows\n     * @return {Ext.Window} this\n     */\n    toBack : function(){\n        this.manager.sendToBack(this);\n        return this;\n    },\n\n    /**\n     * Centers this window in the viewport\n     * @return {Ext.Window} this\n     */\n    center : function(){\n        var xy = this.el.getAlignToXY(this.container, 'c-c');\n        this.setPagePosition(xy[0], xy[1]);\n        return this;\n    }\n\n    /**\n     * @cfg {Boolean} autoWidth @hide\n     **/\n});\nExt.reg('window', Ext.Window);\n\n// private - custom Window DD implementation\nExt.Window.DD = Ext.extend(Ext.dd.DD, {\n    \n    constructor : function(win){\n        this.win = win;\n        Ext.Window.DD.superclass.constructor.call(this, win.el.id, 'WindowDD-'+win.id);\n        this.setHandleElId(win.header.id);\n        this.scroll = false;        \n    },\n    \n    moveOnly:true,\n    headerOffsets:[100, 25],\n    startDrag : function(){\n        var w = this.win;\n        this.proxy = w.ghost(w.initialConfig.cls);\n        if(w.constrain !== false){\n            var so = w.el.shadowOffset;\n            this.constrainTo(w.container, {right: so, left: so, bottom: so});\n        }else if(w.constrainHeader !== false){\n            var s = this.proxy.getSize();\n            this.constrainTo(w.container, {right: -(s.width-this.headerOffsets[0]), bottom: -(s.height-this.headerOffsets[1])});\n        }\n    },\n    b4Drag : Ext.emptyFn,\n\n    onDrag : function(e){\n        this.alignElWithMouse(this.proxy, e.getPageX(), e.getPageY());\n    },\n\n    endDrag : function(e){\n        this.win.unghost();\n        this.win.saveState();\n    }\n});\n/**\n * @class Ext.WindowGroup\n * An object that manages a group of {@link Ext.Window} instances and provides z-order management\n * and window activation behavior.\n * @constructor\n */\nExt.WindowGroup = function(){\n    var list = {};\n    var accessList = [];\n    var front = null;\n\n    // private\n    var sortWindows = function(d1, d2){\n        return (!d1._lastAccess || d1._lastAccess < d2._lastAccess) ? -1 : 1;\n    };\n\n    // private\n    var orderWindows = function(){\n        var a = accessList, len = a.length;\n        if(len > 0){\n            a.sort(sortWindows);\n            var seed = a[0].manager.zseed;\n            for(var i = 0; i < len; i++){\n                var win = a[i];\n                if(win && !win.hidden){\n                    win.setZIndex(seed + (i*10));\n                }\n            }\n        }\n        activateLast();\n    };\n\n    // private\n    var setActiveWin = function(win){\n        if(win != front){\n            if(front){\n                front.setActive(false);\n            }\n            front = win;\n            if(win){\n                win.setActive(true);\n            }\n        }\n    };\n\n    // private\n    var activateLast = function(){\n        for(var i = accessList.length-1; i >=0; --i) {\n            if(!accessList[i].hidden){\n                setActiveWin(accessList[i]);\n                return;\n            }\n        }\n        // none to activate\n        setActiveWin(null);\n    };\n\n    return {\n        /**\n         * The starting z-index for windows in this WindowGroup (defaults to 9000)\n         * @type Number The z-index value\n         */\n        zseed : 9000,\n\n        /**\n         * <p>Registers a {@link Ext.Window Window} with this WindowManager. This should not\n         * need to be called under normal circumstances. Windows are automatically registered\n         * with a {@link Ext.Window#manager manager} at construction time.</p>\n         * <p>Where this may be useful is moving Windows between two WindowManagers. For example,\n         * to bring the Ext.MessageBox dialog under the same manager as the Desktop's\n         * WindowManager in the desktop sample app:</p><code><pre>\nvar msgWin = Ext.MessageBox.getDialog();\nMyDesktop.getDesktop().getManager().register(msgWin);\n</pre></code>\n         * @param {Window} win The Window to register.\n         */\n        register : function(win){\n            if(win.manager){\n                win.manager.unregister(win);\n            }\n            win.manager = this;\n\n            list[win.id] = win;\n            accessList.push(win);\n            win.on('hide', activateLast);\n        },\n\n        /**\n         * <p>Unregisters a {@link Ext.Window Window} from this WindowManager. This should not\n         * need to be called. Windows are automatically unregistered upon destruction.\n         * See {@link #register}.</p>\n         * @param {Window} win The Window to unregister.\n         */\n        unregister : function(win){\n            delete win.manager;\n            delete list[win.id];\n            win.un('hide', activateLast);\n            accessList.remove(win);\n        },\n\n        /**\n         * Gets a registered window by id.\n         * @param {String/Object} id The id of the window or a {@link Ext.Window} instance\n         * @return {Ext.Window}\n         */\n        get : function(id){\n            return typeof id == \"object\" ? id : list[id];\n        },\n\n        /**\n         * Brings the specified window to the front of any other active windows in this WindowGroup.\n         * @param {String/Object} win The id of the window or a {@link Ext.Window} instance\n         * @return {Boolean} True if the dialog was brought to the front, else false\n         * if it was already in front\n         */\n        bringToFront : function(win){\n            win = this.get(win);\n            if(win != front){\n                win._lastAccess = new Date().getTime();\n                orderWindows();\n                return true;\n            }\n            return false;\n        },\n\n        /**\n         * Sends the specified window to the back of other active windows in this WindowGroup.\n         * @param {String/Object} win The id of the window or a {@link Ext.Window} instance\n         * @return {Ext.Window} The window\n         */\n        sendToBack : function(win){\n            win = this.get(win);\n            win._lastAccess = -(new Date().getTime());\n            orderWindows();\n            return win;\n        },\n\n        /**\n         * Hides all windows in this WindowGroup.\n         */\n        hideAll : function(){\n            for(var id in list){\n                if(list[id] && typeof list[id] != \"function\" && list[id].isVisible()){\n                    list[id].hide();\n                }\n            }\n        },\n\n        /**\n         * Gets the currently-active window in this WindowGroup.\n         * @return {Ext.Window} The active window\n         */\n        getActive : function(){\n            return front;\n        },\n\n        /**\n         * Returns zero or more windows in this WindowGroup using the custom search function passed to this method.\n         * The function should accept a single {@link Ext.Window} reference as its only argument and should\n         * return true if the window matches the search criteria, otherwise it should return false.\n         * @param {Function} fn The search function\n         * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to the Window being tested.\n         * that gets passed to the function if not specified)\n         * @return {Array} An array of zero or more matching windows\n         */\n        getBy : function(fn, scope){\n            var r = [];\n            for(var i = accessList.length-1; i >=0; --i) {\n                var win = accessList[i];\n                if(fn.call(scope||win, win) !== false){\n                    r.push(win);\n                }\n            }\n            return r;\n        },\n\n        /**\n         * Executes the specified function once for every window in this WindowGroup, passing each\n         * window as the only parameter. Returning false from the function will stop the iteration.\n         * @param {Function} fn The function to execute for each item\n         * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to the current Window in the iteration.\n         */\n        each : function(fn, scope){\n            for(var id in list){\n                if(list[id] && typeof list[id] != \"function\"){\n                    if(fn.call(scope || list[id], list[id]) === false){\n                        return;\n                    }\n                }\n            }\n        }\n    };\n};\n\n\n/**\n * @class Ext.WindowMgr\n * @extends Ext.WindowGroup\n * The default global window group that is available automatically.  To have more than one group of windows\n * with separate z-order stacks, create additional instances of {@link Ext.WindowGroup} as needed.\n * @singleton\n */\nExt.WindowMgr = new Ext.WindowGroup();/**\n * @class Ext.MessageBox\n * <p>Utility class for generating different styles of message boxes.  The alias Ext.Msg can also be used.<p/>\n * <p>Note that the MessageBox is asynchronous.  Unlike a regular JavaScript <code>alert</code> (which will halt\n * browser execution), showing a MessageBox will not cause the code to stop.  For this reason, if you have code\n * that should only run <em>after</em> some user feedback from the MessageBox, you must use a callback function\n * (see the <code>function</code> parameter for {@link #show} for more details).</p>\n * <p>Example usage:</p>\n *<pre><code>\n// Basic alert:\nExt.Msg.alert('Status', 'Changes saved successfully.');\n\n// Prompt for user data and process the result using a callback:\nExt.Msg.prompt('Name', 'Please enter your name:', function(btn, text){\n    if (btn == 'ok'){\n        // process text value and close...\n    }\n});\n\n// Show a dialog using config options:\nExt.Msg.show({\n   title:'Save Changes?',\n   msg: 'You are closing a tab that has unsaved changes. Would you like to save your changes?',\n   buttons: Ext.Msg.YESNOCANCEL,\n   fn: processResult,\n   animEl: 'elId',\n   icon: Ext.MessageBox.QUESTION\n});\n</code></pre>\n * @singleton\n */\nExt.MessageBox = function(){\n    var dlg, opt, mask, waitTimer,\n        bodyEl, msgEl, textboxEl, textareaEl, progressBar, pp, iconEl, spacerEl,\n        buttons, activeTextEl, bwidth, bufferIcon = '', iconCls = '',\n        buttonNames = ['ok', 'yes', 'no', 'cancel'];\n\n    // private\n    var handleButton = function(button){\n        buttons[button].blur();\n        if(dlg.isVisible()){\n            dlg.hide();\n            handleHide();\n            Ext.callback(opt.fn, opt.scope||window, [button, activeTextEl.dom.value, opt], 1);\n        }\n    };\n\n    // private\n    var handleHide = function(){\n        if(opt && opt.cls){\n            dlg.el.removeClass(opt.cls);\n        }\n        progressBar.reset();        \n    };\n\n    // private\n    var handleEsc = function(d, k, e){\n        if(opt && opt.closable !== false){\n            dlg.hide();\n            handleHide();\n        }\n        if(e){\n            e.stopEvent();\n        }\n    };\n\n    // private\n    var updateButtons = function(b){\n        var width = 0,\n            cfg;\n        if(!b){\n            Ext.each(buttonNames, function(name){\n                buttons[name].hide();\n            });\n            return width;\n        }\n        dlg.footer.dom.style.display = '';\n        Ext.iterate(buttons, function(name, btn){\n            cfg = b[name];\n            if(cfg){\n                btn.show();\n                btn.setText(Ext.isString(cfg) ? cfg : Ext.MessageBox.buttonText[name]);\n                width += btn.getEl().getWidth() + 15;\n            }else{\n                btn.hide();\n            }\n        });\n        return width;\n    };\n\n    return {\n        /**\n         * Returns a reference to the underlying {@link Ext.Window} element\n         * @return {Ext.Window} The window\n         */\n        getDialog : function(titleText){\n           if(!dlg){\n                var btns = [];\n                \n                buttons = {};\n                Ext.each(buttonNames, function(name){\n                    btns.push(buttons[name] = new Ext.Button({\n                        text: this.buttonText[name],\n                        handler: handleButton.createCallback(name),\n                        hideMode: 'offsets'\n                    }));\n                }, this);\n                dlg = new Ext.Window({\n                    autoCreate : true,\n                    title:titleText,\n                    resizable:false,\n                    constrain:true,\n                    constrainHeader:true,\n                    minimizable : false,\n                    maximizable : false,\n                    stateful: false,\n                    modal: true,\n                    shim:true,\n                    buttonAlign:\"center\",\n                    width:400,\n                    height:100,\n                    minHeight: 80,\n                    plain:true,\n                    footer:true,\n                    closable:true,\n                    close : function(){\n                        if(opt && opt.buttons && opt.buttons.no && !opt.buttons.cancel){\n                            handleButton(\"no\");\n                        }else{\n                            handleButton(\"cancel\");\n                        }\n                    },\n                    fbar: new Ext.Toolbar({\n                        items: btns,\n                        enableOverflow: false\n                    })\n                });\n                dlg.render(document.body);\n                dlg.getEl().addClass('x-window-dlg');\n                mask = dlg.mask;\n                bodyEl = dlg.body.createChild({\n                    html:'<div class=\"ext-mb-icon\"></div><div class=\"ext-mb-content\"><span class=\"ext-mb-text\"></span><br /><div class=\"ext-mb-fix-cursor\"><input type=\"text\" class=\"ext-mb-input\" /><textarea class=\"ext-mb-textarea\"></textarea></div></div>'\n                });\n                iconEl = Ext.get(bodyEl.dom.firstChild);\n                var contentEl = bodyEl.dom.childNodes[1];\n                msgEl = Ext.get(contentEl.firstChild);\n                textboxEl = Ext.get(contentEl.childNodes[2].firstChild);\n                textboxEl.enableDisplayMode();\n                textboxEl.addKeyListener([10,13], function(){\n                    if(dlg.isVisible() && opt && opt.buttons){\n                        if(opt.buttons.ok){\n                            handleButton(\"ok\");\n                        }else if(opt.buttons.yes){\n                            handleButton(\"yes\");\n                        }\n                    }\n                });\n                textareaEl = Ext.get(contentEl.childNodes[2].childNodes[1]);\n                textareaEl.enableDisplayMode();\n                progressBar = new Ext.ProgressBar({\n                    renderTo:bodyEl\n                });\n               bodyEl.createChild({cls:'x-clear'});\n            }\n            return dlg;\n        },\n\n        /**\n         * Updates the message box body text\n         * @param {String} text (optional) Replaces the message box element's innerHTML with the specified string (defaults to\n         * the XHTML-compliant non-breaking space character '&amp;#160;')\n         * @return {Ext.MessageBox} this\n         */\n        updateText : function(text){\n            if(!dlg.isVisible() && !opt.width){\n                dlg.setSize(this.maxWidth, 100); // resize first so content is never clipped from previous shows\n            }\n            // Append a space here for sizing. In IE, for some reason, it wraps text incorrectly without one in some cases\n            msgEl.update(text ? text + ' ' : '&#160;');\n\n            var iw = iconCls != '' ? (iconEl.getWidth() + iconEl.getMargins('lr')) : 0,\n                mw = msgEl.getWidth() + msgEl.getMargins('lr'),\n                fw = dlg.getFrameWidth('lr'),\n                bw = dlg.body.getFrameWidth('lr'),\n                w;\n                \n            w = Math.max(Math.min(opt.width || iw+mw+fw+bw, opt.maxWidth || this.maxWidth),\n                    Math.max(opt.minWidth || this.minWidth, bwidth || 0));\n\n            if(opt.prompt === true){\n                activeTextEl.setWidth(w-iw-fw-bw);\n            }\n            if(opt.progress === true || opt.wait === true){\n                progressBar.setSize(w-iw-fw-bw);\n            }\n            if(Ext.isIE9m && w == bwidth){\n                w += 4; //Add offset when the content width is smaller than the buttons.    \n            }\n            msgEl.update(text || '&#160;');\n            dlg.setSize(w, 'auto').center();\n            return this;\n        },\n\n        /**\n         * Updates a progress-style message box's text and progress bar. Only relevant on message boxes\n         * initiated via {@link Ext.MessageBox#progress} or {@link Ext.MessageBox#wait},\n         * or by calling {@link Ext.MessageBox#show} with progress: true.\n         * @param {Number} value Any number between 0 and 1 (e.g., .5, defaults to 0)\n         * @param {String} progressText The progress text to display inside the progress bar (defaults to '')\n         * @param {String} msg The message box's body text is replaced with the specified string (defaults to undefined\n         * so that any existing body text will not get overwritten by default unless a new value is passed in)\n         * @return {Ext.MessageBox} this\n         */\n        updateProgress : function(value, progressText, msg){\n            progressBar.updateProgress(value, progressText);\n            if(msg){\n                this.updateText(msg);\n            }\n            return this;\n        },\n\n        /**\n         * Returns true if the message box is currently displayed\n         * @return {Boolean} True if the message box is visible, else false\n         */\n        isVisible : function(){\n            return dlg && dlg.isVisible();\n        },\n\n        /**\n         * Hides the message box if it is displayed\n         * @return {Ext.MessageBox} this\n         */\n        hide : function(){\n            var proxy = dlg ? dlg.activeGhost : null;\n            if(this.isVisible() || proxy){\n                dlg.hide();\n                handleHide();\n                if (proxy){\n                    // unghost is a private function, but i saw no better solution\n                    // to fix the locking problem when dragging while it closes\n                    dlg.unghost(false, false);\n                } \n            }\n            return this;\n        },\n\n        /**\n         * Displays a new message box, or reinitializes an existing message box, based on the config options\n         * passed in. All display functions (e.g. prompt, alert, etc.) on MessageBox call this function internally,\n         * although those calls are basic shortcuts and do not support all of the config options allowed here.\n         * @param {Object} config The following config options are supported: <ul>\n         * <li><b>animEl</b> : String/Element<div class=\"sub-desc\">An id or Element from which the message box should animate as it\n         * opens and closes (defaults to undefined)</div></li>\n         * <li><b>buttons</b> : Object/Boolean<div class=\"sub-desc\">A button config object (e.g., Ext.MessageBox.OKCANCEL or {ok:'Foo',\n         * cancel:'Bar'}), or false to not show any buttons (defaults to false)</div></li>\n         * <li><b>closable</b> : Boolean<div class=\"sub-desc\">False to hide the top-right close button (defaults to true). Note that\n         * progress and wait dialogs will ignore this property and always hide the close button as they can only\n         * be closed programmatically.</div></li>\n         * <li><b>cls</b> : String<div class=\"sub-desc\">A custom CSS class to apply to the message box's container element</div></li>\n         * <li><b>defaultTextHeight</b> : Number<div class=\"sub-desc\">The default height in pixels of the message box's multiline textarea\n         * if displayed (defaults to 75)</div></li>\n         * <li><b>fn</b> : Function<div class=\"sub-desc\">A callback function which is called when the dialog is dismissed either\n         * by clicking on the configured buttons, or on the dialog close button, or by pressing\n         * the return button to enter input.\n         * <p>Progress and wait dialogs will ignore this option since they do not respond to user\n         * actions and can only be closed programmatically, so any required function should be called\n         * by the same code after it closes the dialog. Parameters passed:<ul>\n         * <li><b>buttonId</b> : String<div class=\"sub-desc\">The ID of the button pressed, one of:<div class=\"sub-desc\"><ul>\n         * <li><tt>ok</tt></li>\n         * <li><tt>yes</tt></li>\n         * <li><tt>no</tt></li>\n         * <li><tt>cancel</tt></li>\n         * </ul></div></div></li>\n         * <li><b>text</b> : String<div class=\"sub-desc\">Value of the input field if either <tt><a href=\"#show-option-prompt\" ext:member=\"show-option-prompt\" ext:cls=\"Ext.MessageBox\">prompt</a></tt>\n         * or <tt><a href=\"#show-option-multiline\" ext:member=\"show-option-multiline\" ext:cls=\"Ext.MessageBox\">multiline</a></tt> is true</div></li>\n         * <li><b>opt</b> : Object<div class=\"sub-desc\">The config object passed to show.</div></li>\n         * </ul></p></div></li>\n         * <li><b>scope</b> : Object<div class=\"sub-desc\">The scope of the callback function</div></li>\n         * <li><b>icon</b> : String<div class=\"sub-desc\">A CSS class that provides a background image to be used as the body icon for the\n         * dialog (e.g. Ext.MessageBox.WARNING or 'custom-class') (defaults to '')</div></li>\n         * <li><b>iconCls</b> : String<div class=\"sub-desc\">The standard {@link Ext.Window#iconCls} to\n         * add an optional header icon (defaults to '')</div></li>\n         * <li><b>maxWidth</b> : Number<div class=\"sub-desc\">The maximum width in pixels of the message box (defaults to 600)</div></li>\n         * <li><b>minWidth</b> : Number<div class=\"sub-desc\">The minimum width in pixels of the message box (defaults to 100)</div></li>\n         * <li><b>modal</b> : Boolean<div class=\"sub-desc\">False to allow user interaction with the page while the message box is\n         * displayed (defaults to true)</div></li>\n         * <li><b>msg</b> : String<div class=\"sub-desc\">A string that will replace the existing message box body text (defaults to the\n         * XHTML-compliant non-breaking space character '&amp;#160;')</div></li>\n         * <li><a id=\"show-option-multiline\"></a><b>multiline</b> : Boolean<div class=\"sub-desc\">\n         * True to prompt the user to enter multi-line text (defaults to false)</div></li>\n         * <li><b>progress</b> : Boolean<div class=\"sub-desc\">True to display a progress bar (defaults to false)</div></li>\n         * <li><b>progressText</b> : String<div class=\"sub-desc\">The text to display inside the progress bar if progress = true (defaults to '')</div></li>\n         * <li><a id=\"show-option-prompt\"></a><b>prompt</b> : Boolean<div class=\"sub-desc\">True to prompt the user to enter single-line text (defaults to false)</div></li>\n         * <li><b>proxyDrag</b> : Boolean<div class=\"sub-desc\">True to display a lightweight proxy while dragging (defaults to false)</div></li>\n         * <li><b>title</b> : String<div class=\"sub-desc\">The title text</div></li>\n         * <li><b>value</b> : String<div class=\"sub-desc\">The string value to set into the active textbox element if displayed</div></li>\n         * <li><b>wait</b> : Boolean<div class=\"sub-desc\">True to display a progress bar (defaults to false)</div></li>\n         * <li><b>waitConfig</b> : Object<div class=\"sub-desc\">A {@link Ext.ProgressBar#waitConfig} object (applies only if wait = true)</div></li>\n         * <li><b>width</b> : Number<div class=\"sub-desc\">The width of the dialog in pixels</div></li>\n         * </ul>\n         * Example usage:\n         * <pre><code>\nExt.Msg.show({\n   title: 'Address',\n   msg: 'Please enter your address:',\n   width: 300,\n   buttons: Ext.MessageBox.OKCANCEL,\n   multiline: true,\n   fn: saveAddress,\n   animEl: 'addAddressBtn',\n   icon: Ext.MessageBox.INFO\n});\n</code></pre>\n         * @return {Ext.MessageBox} this\n         */\n        show : function(options){\n            if(this.isVisible()){\n                this.hide();\n            }\n            opt = options;\n            var d = this.getDialog(opt.title || \"&#160;\");\n\n            d.setTitle(opt.title || \"&#160;\");\n            var allowClose = (opt.closable !== false && opt.progress !== true && opt.wait !== true);\n            d.tools.close.setDisplayed(allowClose);\n            activeTextEl = textboxEl;\n            opt.prompt = opt.prompt || (opt.multiline ? true : false);\n            if(opt.prompt){\n                if(opt.multiline){\n                    textboxEl.hide();\n                    textareaEl.show();\n                    textareaEl.setHeight(Ext.isNumber(opt.multiline) ? opt.multiline : this.defaultTextHeight);\n                    activeTextEl = textareaEl;\n                }else{\n                    textboxEl.show();\n                    textareaEl.hide();\n                }\n            }else{\n                textboxEl.hide();\n                textareaEl.hide();\n            }\n            activeTextEl.dom.value = opt.value || \"\";\n            if(opt.prompt){\n                d.focusEl = activeTextEl;\n            }else{\n                var bs = opt.buttons;\n                var db = null;\n                if(bs && bs.ok){\n                    db = buttons[\"ok\"];\n                }else if(bs && bs.yes){\n                    db = buttons[\"yes\"];\n                }\n                if (db){\n                    d.focusEl = db;\n                }\n            }\n            if(Ext.isDefined(opt.iconCls)){\n              d.setIconClass(opt.iconCls);\n            }\n            this.setIcon(Ext.isDefined(opt.icon) ? opt.icon : bufferIcon);\n            bwidth = updateButtons(opt.buttons);\n            progressBar.setVisible(opt.progress === true || opt.wait === true);\n            this.updateProgress(0, opt.progressText);\n            this.updateText(opt.msg);\n            if(opt.cls){\n                d.el.addClass(opt.cls);\n            }\n            d.proxyDrag = opt.proxyDrag === true;\n            d.modal = opt.modal !== false;\n            d.mask = opt.modal !== false ? mask : false;\n            if(!d.isVisible()){\n                // force it to the end of the z-index stack so it gets a cursor in FF\n                document.body.appendChild(dlg.el.dom);\n                d.setAnimateTarget(opt.animEl);\n                //workaround for window internally enabling keymap in afterShow\n                d.on('show', function(){\n                    if(allowClose === true){\n                        d.keyMap.enable();\n                    }else{\n                        d.keyMap.disable();\n                    }\n                }, this, {single:true});\n                d.show(opt.animEl);\n            }\n            if(opt.wait === true){\n                progressBar.wait(opt.waitConfig);\n            }\n            return this;\n        },\n\n        /**\n         * Adds the specified icon to the dialog.  By default, the class 'ext-mb-icon' is applied for default\n         * styling, and the class passed in is expected to supply the background image url. Pass in empty string ('')\n         * to clear any existing icon. This method must be called before the MessageBox is shown.\n         * The following built-in icon classes are supported, but you can also pass in a custom class name:\n         * <pre>\nExt.MessageBox.INFO\nExt.MessageBox.WARNING\nExt.MessageBox.QUESTION\nExt.MessageBox.ERROR\n         *</pre>\n         * @param {String} icon A CSS classname specifying the icon's background image url, or empty string to clear the icon\n         * @return {Ext.MessageBox} this\n         */\n        setIcon : function(icon){\n            if(!dlg){\n                bufferIcon = icon;\n                return;\n            }\n            bufferIcon = undefined;\n            if(icon && icon != ''){\n                iconEl.removeClass('x-hidden');\n                iconEl.replaceClass(iconCls, icon);\n                bodyEl.addClass('x-dlg-icon');\n                iconCls = icon;\n            }else{\n                iconEl.replaceClass(iconCls, 'x-hidden');\n                bodyEl.removeClass('x-dlg-icon');\n                iconCls = '';\n            }\n            return this;\n        },\n\n        /**\n         * Displays a message box with a progress bar.  This message box has no buttons and is not closeable by\n         * the user.  You are responsible for updating the progress bar as needed via {@link Ext.MessageBox#updateProgress}\n         * and closing the message box when the process is complete.\n         * @param {String} title The title bar text\n         * @param {String} msg The message box body text\n         * @param {String} progressText (optional) The text to display inside the progress bar (defaults to '')\n         * @return {Ext.MessageBox} this\n         */\n        progress : function(title, msg, progressText){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: false,\n                progress:true,\n                closable:false,\n                minWidth: this.minProgressWidth,\n                progressText: progressText\n            });\n            return this;\n        },\n\n        /**\n         * Displays a message box with an infinitely auto-updating progress bar.  This can be used to block user\n         * interaction while waiting for a long-running process to complete that does not have defined intervals.\n         * You are responsible for closing the message box when the process is complete.\n         * @param {String} msg The message box body text\n         * @param {String} title (optional) The title bar text\n         * @param {Object} config (optional) A {@link Ext.ProgressBar#waitConfig} object\n         * @return {Ext.MessageBox} this\n         */\n        wait : function(msg, title, config){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: false,\n                closable:false,\n                wait:true,\n                modal:true,\n                minWidth: this.minProgressWidth,\n                waitConfig: config\n            });\n            return this;\n        },\n\n        /**\n         * Displays a standard read-only message box with an OK button (comparable to the basic JavaScript alert prompt).\n         * If a callback function is passed it will be called after the user clicks the button, and the\n         * id of the button that was clicked will be passed as the only parameter to the callback\n         * (could also be the top-right close button).\n         * @param {String} title The title bar text\n         * @param {String} msg The message box body text\n         * @param {Function} fn (optional) The callback function invoked after the message box is closed\n         * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the callback is executed. Defaults to the browser wnidow.\n         * @return {Ext.MessageBox} this\n         */\n        alert : function(title, msg, fn, scope){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: this.OK,\n                fn: fn,\n                scope : scope,\n                minWidth: this.minWidth\n            });\n            return this;\n        },\n\n        /**\n         * Displays a confirmation message box with Yes and No buttons (comparable to JavaScript's confirm).\n         * If a callback function is passed it will be called after the user clicks either button,\n         * and the id of the button that was clicked will be passed as the only parameter to the callback\n         * (could also be the top-right close button).\n         * @param {String} title The title bar text\n         * @param {String} msg The message box body text\n         * @param {Function} fn (optional) The callback function invoked after the message box is closed\n         * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the callback is executed. Defaults to the browser wnidow.\n         * @return {Ext.MessageBox} this\n         */\n        confirm : function(title, msg, fn, scope){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: this.YESNO,\n                fn: fn,\n                scope : scope,\n                icon: this.QUESTION,\n                minWidth: this.minWidth\n            });\n            return this;\n        },\n\n        /**\n         * Displays a message box with OK and Cancel buttons prompting the user to enter some text (comparable to JavaScript's prompt).\n         * The prompt can be a single-line or multi-line textbox.  If a callback function is passed it will be called after the user\n         * clicks either button, and the id of the button that was clicked (could also be the top-right\n         * close button) and the text that was entered will be passed as the two parameters to the callback.\n         * @param {String} title The title bar text\n         * @param {String} msg The message box body text\n         * @param {Function} fn (optional) The callback function invoked after the message box is closed\n         * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the callback is executed. Defaults to the browser wnidow.\n         * @param {Boolean/Number} multiline (optional) True to create a multiline textbox using the defaultTextHeight\n         * property, or the height in pixels to create the textbox (defaults to false / single-line)\n         * @param {String} value (optional) Default value of the text input element (defaults to '')\n         * @return {Ext.MessageBox} this\n         */\n        prompt : function(title, msg, fn, scope, multiline, value){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: this.OKCANCEL,\n                fn: fn,\n                minWidth: this.minPromptWidth,\n                scope : scope,\n                prompt:true,\n                multiline: multiline,\n                value: value\n            });\n            return this;\n        },\n\n        /**\n         * Button config that displays a single OK button\n         * @type Object\n         */\n        OK : {ok:true},\n        /**\n         * Button config that displays a single Cancel button\n         * @type Object\n         */\n        CANCEL : {cancel:true},\n        /**\n         * Button config that displays OK and Cancel buttons\n         * @type Object\n         */\n        OKCANCEL : {ok:true, cancel:true},\n        /**\n         * Button config that displays Yes and No buttons\n         * @type Object\n         */\n        YESNO : {yes:true, no:true},\n        /**\n         * Button config that displays Yes, No and Cancel buttons\n         * @type Object\n         */\n        YESNOCANCEL : {yes:true, no:true, cancel:true},\n        /**\n         * The CSS class that provides the INFO icon image\n         * @type String\n         */\n        INFO : 'ext-mb-info',\n        /**\n         * The CSS class that provides the WARNING icon image\n         * @type String\n         */\n        WARNING : 'ext-mb-warning',\n        /**\n         * The CSS class that provides the QUESTION icon image\n         * @type String\n         */\n        QUESTION : 'ext-mb-question',\n        /**\n         * The CSS class that provides the ERROR icon image\n         * @type String\n         */\n        ERROR : 'ext-mb-error',\n\n        /**\n         * The default height in pixels of the message box's multiline textarea if displayed (defaults to 75)\n         * @type Number\n         */\n        defaultTextHeight : 75,\n        /**\n         * The maximum width in pixels of the message box (defaults to 600)\n         * @type Number\n         */\n        maxWidth : 600,\n        /**\n         * The minimum width in pixels of the message box (defaults to 100)\n         * @type Number\n         */\n        minWidth : 100,\n        /**\n         * The minimum width in pixels of the message box if it is a progress-style dialog.  This is useful\n         * for setting a different minimum width than text-only dialogs may need (defaults to 250).\n         * @type Number\n         */\n        minProgressWidth : 250,\n        /**\n         * The minimum width in pixels of the message box if it is a prompt dialog.  This is useful\n         * for setting a different minimum width than text-only dialogs may need (defaults to 250).\n         * @type Number\n         */\n        minPromptWidth: 250,\n        /**\n         * An object containing the default button text strings that can be overriden for localized language support.\n         * Supported properties are: ok, cancel, yes and no.  Generally you should include a locale-specific\n         * resource file for handling language support across the framework.\n         * Customize the default text like so: Ext.MessageBox.buttonText.yes = \"oui\"; //french\n         * @type Object\n         */\n        buttonText : {\n            ok : \"OK\",\n            cancel : \"Cancel\",\n            yes : \"Yes\",\n            no : \"No\"\n        }\n    };\n}();\n\n/**\n * Shorthand for {@link Ext.MessageBox}\n */\nExt.Msg = Ext.MessageBox;/**\n * @class Ext.dd.PanelProxy\n * A custom drag proxy implementation specific to {@link Ext.Panel}s. This class is primarily used internally\n * for the Panel's drag drop implementation, and should never need to be created directly.\n * @constructor\n * @param panel The {@link Ext.Panel} to proxy for\n * @param config Configuration options\n */\nExt.dd.PanelProxy  = Ext.extend(Object, {\n    \n    constructor : function(panel, config){\n        this.panel = panel;\n        this.id = this.panel.id +'-ddproxy';\n        Ext.apply(this, config);        \n    },\n    \n    /**\n     * @cfg {Boolean} insertProxy True to insert a placeholder proxy element while dragging the panel,\n     * false to drag with no proxy (defaults to true).\n     */\n    insertProxy : true,\n\n    // private overrides\n    setStatus : Ext.emptyFn,\n    reset : Ext.emptyFn,\n    update : Ext.emptyFn,\n    stop : Ext.emptyFn,\n    sync: Ext.emptyFn,\n\n    /**\n     * Gets the proxy's element\n     * @return {Element} The proxy's element\n     */\n    getEl : function(){\n        return this.ghost;\n    },\n\n    /**\n     * Gets the proxy's ghost element\n     * @return {Element} The proxy's ghost element\n     */\n    getGhost : function(){\n        return this.ghost;\n    },\n\n    /**\n     * Gets the proxy's element\n     * @return {Element} The proxy's element\n     */\n    getProxy : function(){\n        return this.proxy;\n    },\n\n    /**\n     * Hides the proxy\n     */\n    hide : function(){\n        if(this.ghost){\n            if(this.proxy){\n                this.proxy.remove();\n                delete this.proxy;\n            }\n            this.panel.el.dom.style.display = '';\n            this.ghost.remove();\n            delete this.ghost;\n        }\n    },\n\n    /**\n     * Shows the proxy\n     */\n    show : function(){\n        if(!this.ghost){\n            this.ghost = this.panel.createGhost(this.panel.initialConfig.cls, undefined, Ext.getBody());\n            this.ghost.setXY(this.panel.el.getXY());\n            if(this.insertProxy){\n                this.proxy = this.panel.el.insertSibling({cls:'x-panel-dd-spacer'});\n                this.proxy.setSize(this.panel.getSize());\n            }\n            this.panel.el.dom.style.display = 'none';\n        }\n    },\n\n    // private\n    repair : function(xy, callback, scope){\n        this.hide();\n        if(typeof callback == \"function\"){\n            callback.call(scope || this);\n        }\n    },\n\n    /**\n     * Moves the proxy to a different position in the DOM.  This is typically called while dragging the Panel\n     * to keep the proxy sync'd to the Panel's location.\n     * @param {HTMLElement} parentNode The proxy's parent DOM node\n     * @param {HTMLElement} before (optional) The sibling node before which the proxy should be inserted (defaults\n     * to the parent's last child if not specified)\n     */\n    moveProxy : function(parentNode, before){\n        if(this.proxy){\n            parentNode.insertBefore(this.proxy.dom, before);\n        }\n    }\n});\n\n// private - DD implementation for Panels\nExt.Panel.DD = Ext.extend(Ext.dd.DragSource, {\n    \n    constructor : function(panel, cfg){\n        this.panel = panel;\n        this.dragData = {panel: panel};\n        this.proxy = new Ext.dd.PanelProxy(panel, cfg);\n        Ext.Panel.DD.superclass.constructor.call(this, panel.el, cfg);\n        var h = panel.header,\n            el = panel.body;\n        if(h){\n            this.setHandleElId(h.id);\n            el = panel.header;\n        }\n        el.setStyle('cursor', 'move');\n        this.scroll = false;        \n    },\n    \n    showFrame: Ext.emptyFn,\n    startDrag: Ext.emptyFn,\n    b4StartDrag: function(x, y) {\n        this.proxy.show();\n    },\n    b4MouseDown: function(e) {\n        var x = e.getPageX(),\n            y = e.getPageY();\n        this.autoOffset(x, y);\n    },\n    onInitDrag : function(x, y){\n        this.onStartDrag(x, y);\n        return true;\n    },\n    createFrame : Ext.emptyFn,\n    getDragEl : function(e){\n        return this.proxy.ghost.dom;\n    },\n    endDrag : function(e){\n        this.proxy.hide();\n        this.panel.saveState();\n    },\n\n    autoOffset : function(x, y) {\n        x -= this.startPageX;\n        y -= this.startPageY;\n        this.setDelta(x, y);\n    }\n});/**\n * @class Ext.state.Provider\n * Abstract base class for state provider implementations. This class provides methods\n * for encoding and decoding <b>typed</b> variables including dates and defines the\n * Provider interface.\n */\nExt.state.Provider = Ext.extend(Ext.util.Observable, {\n    \n    constructor : function(){\n        /**\n         * @event statechange\n         * Fires when a state change occurs.\n         * @param {Provider} this This state provider\n         * @param {String} key The state key which was changed\n         * @param {String} value The encoded value for the state\n         */\n        this.addEvents(\"statechange\");\n        this.state = {};\n        Ext.state.Provider.superclass.constructor.call(this);\n    },\n    \n    /**\n     * Returns the current value for a key\n     * @param {String} name The key name\n     * @param {Mixed} defaultValue A default value to return if the key's value is not found\n     * @return {Mixed} The state data\n     */\n    get : function(name, defaultValue){\n        return typeof this.state[name] == \"undefined\" ?\n            defaultValue : this.state[name];\n    },\n\n    /**\n     * Clears a value from the state\n     * @param {String} name The key name\n     */\n    clear : function(name){\n        delete this.state[name];\n        this.fireEvent(\"statechange\", this, name, null);\n    },\n\n    /**\n     * Sets the value for a key\n     * @param {String} name The key name\n     * @param {Mixed} value The value to set\n     */\n    set : function(name, value){\n        this.state[name] = value;\n        this.fireEvent(\"statechange\", this, name, value);\n    },\n\n    /**\n     * Decodes a string previously encoded with {@link #encodeValue}.\n     * @param {String} value The value to decode\n     * @return {Mixed} The decoded value\n     */\n    decodeValue : function(cookie){\n        /**\n         * a -> Array\n         * n -> Number\n         * d -> Date\n         * b -> Boolean\n         * s -> String\n         * o -> Object\n         * -> Empty (null)\n         */\n        var re = /^(a|n|d|b|s|o|e)\\:(.*)$/,\n            matches = re.exec(unescape(cookie)),\n            all,\n            type,\n            v,\n            kv;\n        if(!matches || !matches[1]){\n            return; // non state cookie\n        }\n        type = matches[1];\n        v = matches[2];\n        switch(type){\n            case 'e':\n                return null;\n            case 'n':\n                return parseFloat(v);\n            case 'd':\n                return new Date(Date.parse(v));\n            case 'b':\n                return (v == '1');\n            case 'a':\n                all = [];\n                if(v != ''){\n                    Ext.each(v.split('^'), function(val){\n                        all.push(this.decodeValue(val));\n                    }, this);\n                }\n                return all;\n           case 'o':\n                all = {};\n                if(v != ''){\n                    Ext.each(v.split('^'), function(val){\n                        kv = val.split('=');\n                        all[kv[0]] = this.decodeValue(kv[1]);\n                    }, this);\n                }\n                return all;\n           default:\n                return v;\n        }\n    },\n\n    /**\n     * Encodes a value including type information.  Decode with {@link #decodeValue}.\n     * @param {Mixed} value The value to encode\n     * @return {String} The encoded value\n     */\n    encodeValue : function(v){\n        var enc,\n            flat = '',\n            i = 0,\n            len,\n            key;\n        if(v == null){\n            return 'e:1';    \n        }else if(typeof v == 'number'){\n            enc = 'n:' + v;\n        }else if(typeof v == 'boolean'){\n            enc = 'b:' + (v ? '1' : '0');\n        }else if(Ext.isDate(v)){\n            enc = 'd:' + v.toGMTString();\n        }else if(Ext.isArray(v)){\n            for(len = v.length; i < len; i++){\n                flat += this.encodeValue(v[i]);\n                if(i != len - 1){\n                    flat += '^';\n                }\n            }\n            enc = 'a:' + flat;\n        }else if(typeof v == 'object'){\n            for(key in v){\n                if(typeof v[key] != 'function' && v[key] !== undefined){\n                    flat += key + '=' + this.encodeValue(v[key]) + '^';\n                }\n            }\n            enc = 'o:' + flat.substring(0, flat.length-1);\n        }else{\n            enc = 's:' + v;\n        }\n        return escape(enc);\n    }\n});\n/**\n * @class Ext.state.Manager\n * This is the global state manager. By default all components that are \"state aware\" check this class\n * for state information if you don't pass them a custom state provider. In order for this class\n * to be useful, it must be initialized with a provider when your application initializes. Example usage:\n <pre><code>\n// in your initialization function\ninit : function(){\n   Ext.state.Manager.setProvider(new Ext.state.CookieProvider());\n   var win = new Window(...);\n   win.restoreState();\n}\n </code></pre>\n * @singleton\n */\nExt.state.Manager = function(){\n    var provider = new Ext.state.Provider();\n\n    return {\n        /**\n         * Configures the default state provider for your application\n         * @param {Provider} stateProvider The state provider to set\n         */\n        setProvider : function(stateProvider){\n            provider = stateProvider;\n        },\n\n        /**\n         * Returns the current value for a key\n         * @param {String} name The key name\n         * @param {Mixed} defaultValue The default value to return if the key lookup does not match\n         * @return {Mixed} The state data\n         */\n        get : function(key, defaultValue){\n            return provider.get(key, defaultValue);\n        },\n\n        /**\n         * Sets the value for a key\n         * @param {String} name The key name\n         * @param {Mixed} value The state data\n         */\n         set : function(key, value){\n            provider.set(key, value);\n        },\n\n        /**\n         * Clears a value from the state\n         * @param {String} name The key name\n         */\n        clear : function(key){\n            provider.clear(key);\n        },\n\n        /**\n         * Gets the currently configured state provider\n         * @return {Provider} The state provider\n         */\n        getProvider : function(){\n            return provider;\n        }\n    };\n}();\n/**\n * @class Ext.state.CookieProvider\n * @extends Ext.state.Provider\n * The default Provider implementation which saves state via cookies.\n * <br />Usage:\n <pre><code>\n   var cp = new Ext.state.CookieProvider({\n       path: \"/cgi-bin/\",\n       expires: new Date(new Date().getTime()+(1000*60*60*24*30)), //30 days\n       domain: \"extjs.com\"\n   });\n   Ext.state.Manager.setProvider(cp);\n </code></pre>\n * @cfg {String} path The path for which the cookie is active (defaults to root '/' which makes it active for all pages in the site)\n * @cfg {Date} expires The cookie expiration date (defaults to 7 days from now)\n * @cfg {String} domain The domain to save the cookie for.  Note that you cannot specify a different domain than\n * your page is on, but you can specify a sub-domain, or simply the domain itself like 'extjs.com' to include\n * all sub-domains if you need to access cookies across different sub-domains (defaults to null which uses the same\n * domain the page is running on including the 'www' like 'www.extjs.com')\n * @cfg {Boolean} secure True if the site is using SSL (defaults to false)\n * @constructor\n * Create a new CookieProvider\n * @param {Object} config The configuration object\n */\nExt.state.CookieProvider = Ext.extend(Ext.state.Provider, {\n    \n    constructor : function(config){\n        Ext.state.CookieProvider.superclass.constructor.call(this);\n        this.path = \"/\";\n        this.expires = new Date(new Date().getTime()+(1000*60*60*24*7)); //7 days\n        this.domain = null;\n        this.secure = false;\n        Ext.apply(this, config);\n        this.state = this.readCookies();\n    },\n    \n    // private\n    set : function(name, value){\n        if(typeof value == \"undefined\" || value === null){\n            this.clear(name);\n            return;\n        }\n        this.setCookie(name, value);\n        Ext.state.CookieProvider.superclass.set.call(this, name, value);\n    },\n\n    // private\n    clear : function(name){\n        this.clearCookie(name);\n        Ext.state.CookieProvider.superclass.clear.call(this, name);\n    },\n\n    // private\n    readCookies : function(){\n        var cookies = {},\n            c = document.cookie + \";\",\n            re = /\\s?(.*?)=(.*?);/g,\n    \t    matches,\n            name,\n            value;\n    \twhile((matches = re.exec(c)) != null){\n            name = matches[1];\n            value = matches[2];\n            if(name && name.substring(0,3) == \"ys-\"){\n                cookies[name.substr(3)] = this.decodeValue(value);\n            }\n        }\n        return cookies;\n    },\n\n    // private\n    setCookie : function(name, value){\n        document.cookie = \"ys-\"+ name + \"=\" + this.encodeValue(value) +\n           ((this.expires == null) ? \"\" : (\"; expires=\" + this.expires.toGMTString())) +\n           ((this.path == null) ? \"\" : (\"; path=\" + this.path)) +\n           ((this.domain == null) ? \"\" : (\"; domain=\" + this.domain)) +\n           ((this.secure == true) ? \"; secure\" : \"\");\n    },\n\n    // private\n    clearCookie : function(name){\n        document.cookie = \"ys-\" + name + \"=null; expires=Thu, 01-Jan-70 00:00:01 GMT\" +\n           ((this.path == null) ? \"\" : (\"; path=\" + this.path)) +\n           ((this.domain == null) ? \"\" : (\"; domain=\" + this.domain)) +\n           ((this.secure == true) ? \"; secure\" : \"\");\n    }\n});/**\n * @class Ext.DataView\n * @extends Ext.BoxComponent\n * A mechanism for displaying data using custom layout templates and formatting. DataView uses an {@link Ext.XTemplate}\n * as its internal templating mechanism, and is bound to an {@link Ext.data.Store}\n * so that as the data in the store changes the view is automatically updated to reflect the changes.  The view also\n * provides built-in behavior for many common events that can occur for its contained items including click, doubleclick,\n * mouseover, mouseout, etc. as well as a built-in selection model. <b>In order to use these features, an {@link #itemSelector}\n * config must be provided for the DataView to determine what nodes it will be working with.</b>\n *\n * <p>The example below binds a DataView to a {@link Ext.data.Store} and renders it into an {@link Ext.Panel}.</p>\n * <pre><code>\nvar store = new Ext.data.JsonStore({\n    url: 'get-images.php',\n    root: 'images',\n    fields: [\n        'name', 'url',\n        {name:'size', type: 'float'},\n        {name:'lastmod', type:'date', dateFormat:'timestamp'}\n    ]\n});\nstore.load();\n\nvar tpl = new Ext.XTemplate(\n    '&lt;tpl for=\".\"&gt;',\n        '&lt;div class=\"thumb-wrap\" id=\"{name}\"&gt;',\n        '&lt;div class=\"thumb\"&gt;&lt;img src=\"{url}\" title=\"{name}\"&gt;&lt;/div&gt;',\n        '&lt;span class=\"x-editable\"&gt;{shortName}&lt;/span&gt;&lt;/div&gt;',\n    '&lt;/tpl&gt;',\n    '&lt;div class=\"x-clear\"&gt;&lt;/div&gt;'\n);\n\nvar panel = new Ext.Panel({\n    id:'images-view',\n    frame:true,\n    width:535,\n    autoHeight:true,\n    collapsible:true,\n    layout:'fit',\n    title:'Simple DataView',\n\n    items: new Ext.DataView({\n        store: store,\n        tpl: tpl,\n        autoHeight:true,\n        multiSelect: true,\n        overClass:'x-view-over',\n        itemSelector:'div.thumb-wrap',\n        emptyText: 'No images to display'\n    })\n});\npanel.render(document.body);\n</code></pre>\n * @constructor\n * Create a new DataView\n * @param {Object} config The config object\n * @xtype dataview\n */\nExt.DataView = Ext.extend(Ext.BoxComponent, {\n    /**\n     * @cfg {String/Array} tpl\n     * The HTML fragment or an array of fragments that will make up the template used by this DataView.  This should\n     * be specified in the same format expected by the constructor of {@link Ext.XTemplate}.\n     */\n    /**\n     * @cfg {Ext.data.Store} store\n     * The {@link Ext.data.Store} to bind this DataView to.\n     */\n    /**\n     * @cfg {String} itemSelector\n     * <b>This is a required setting</b>. A simple CSS selector (e.g. <tt>div.some-class</tt> or \n     * <tt>span:first-child</tt>) that will be used to determine what nodes this DataView will be\n     * working with.\n     */\n    /**\n     * @cfg {Boolean} multiSelect\n     * True to allow selection of more than one item at a time, false to allow selection of only a single item\n     * at a time or no selection at all, depending on the value of {@link #singleSelect} (defaults to false).\n     */\n    /**\n     * @cfg {Boolean} singleSelect\n     * True to allow selection of exactly one item at a time, false to allow no selection at all (defaults to false).\n     * Note that if {@link #multiSelect} = true, this value will be ignored.\n     */\n    /**\n     * @cfg {Boolean} simpleSelect\n     * True to enable multiselection by clicking on multiple items without requiring the user to hold Shift or Ctrl,\n     * false to force the user to hold Ctrl or Shift to select more than on item (defaults to false).\n     */\n    /**\n     * @cfg {String} overClass\n     * A CSS class to apply to each item in the view on mouseover (defaults to undefined).\n     */\n    /**\n     * @cfg {String} loadingText\n     * A string to display during data load operations (defaults to undefined).  If specified, this text will be\n     * displayed in a loading div and the view's contents will be cleared while loading, otherwise the view's\n     * contents will continue to display normally until the new data is loaded and the contents are replaced.\n     */\n    /**\n     * @cfg {String} selectedClass\n     * A CSS class to apply to each selected item in the view (defaults to 'x-view-selected').\n     */\n    selectedClass : \"x-view-selected\",\n    /**\n     * @cfg {String} emptyText\n     * The text to display in the view when there is no data to display (defaults to '').\n     */\n    emptyText : \"\",\n\n    /**\n     * @cfg {Boolean} deferEmptyText True to defer emptyText being applied until the store's first load\n     */\n    deferEmptyText: true,\n    /**\n     * @cfg {Boolean} trackOver True to enable mouseenter and mouseleave events\n     */\n    trackOver: false,\n    \n    /**\n     * @cfg {Boolean} blockRefresh Set this to true to ignore datachanged events on the bound store. This is useful if\n     * you wish to provide custom transition animations via a plugin (defaults to false)\n     */\n    blockRefresh: false,\n\n    //private\n    last: false,\n\n    // private\n    initComponent : function(){\n        Ext.DataView.superclass.initComponent.call(this);\n        if(Ext.isString(this.tpl) || Ext.isArray(this.tpl)){\n            this.tpl = new Ext.XTemplate(this.tpl);\n        }\n\n        this.addEvents(\n            /**\n             * @event beforeclick\n             * Fires before a click is processed. Returns false to cancel the default action.\n             * @param {Ext.DataView} this\n             * @param {Number} index The index of the target node\n             * @param {HTMLElement} node The target node\n             * @param {Ext.EventObject} e The raw event object\n             */\n            \"beforeclick\",\n            /**\n             * @event click\n             * Fires when a template node is clicked.\n             * @param {Ext.DataView} this\n             * @param {Number} index The index of the target node\n             * @param {HTMLElement} node The target node\n             * @param {Ext.EventObject} e The raw event object\n             */\n            \"click\",\n            /**\n             * @event mouseenter\n             * Fires when the mouse enters a template node. trackOver:true or an overClass must be set to enable this event.\n             * @param {Ext.DataView} this\n             * @param {Number} index The index of the target node\n             * @param {HTMLElement} node The target node\n             * @param {Ext.EventObject} e The raw event object\n             */\n            \"mouseenter\",\n            /**\n             * @event mouseleave\n             * Fires when the mouse leaves a template node. trackOver:true or an overClass must be set to enable this event.\n             * @param {Ext.DataView} this\n             * @param {Number} index The index of the target node\n             * @param {HTMLElement} node The target node\n             * @param {Ext.EventObject} e The raw event object\n             */\n            \"mouseleave\",\n            /**\n             * @event containerclick\n             * Fires when a click occurs and it is not on a template node.\n             * @param {Ext.DataView} this\n             * @param {Ext.EventObject} e The raw event object\n             */\n            \"containerclick\",\n            /**\n             * @event dblclick\n             * Fires when a template node is double clicked.\n             * @param {Ext.DataView} this\n             * @param {Number} index The index of the target node\n             * @param {HTMLElement} node The target node\n             * @param {Ext.EventObject} e The raw event object\n             */\n            \"dblclick\",\n            /**\n             * @event contextmenu\n             * Fires when a template node is right clicked.\n             * @param {Ext.DataView} this\n             * @param {Number} index The index of the target node\n             * @param {HTMLElement} node The target node\n             * @param {Ext.EventObject} e The raw event object\n             */\n            \"contextmenu\",\n            /**\n             * @event containercontextmenu\n             * Fires when a right click occurs that is not on a template node.\n             * @param {Ext.DataView} this\n             * @param {Ext.EventObject} e The raw event object\n             */\n            \"containercontextmenu\",\n            /**\n             * @event selectionchange\n             * Fires when the selected nodes change.\n             * @param {Ext.DataView} this\n             * @param {Array} selections Array of the selected nodes\n             */\n            \"selectionchange\",\n\n            /**\n             * @event beforeselect\n             * Fires before a selection is made. If any handlers return false, the selection is cancelled.\n             * @param {Ext.DataView} this\n             * @param {HTMLElement} node The node to be selected\n             * @param {Array} selections Array of currently selected nodes\n             */\n            \"beforeselect\"\n        );\n\n        this.store = Ext.StoreMgr.lookup(this.store);\n        this.all = new Ext.CompositeElementLite();\n        this.selected = new Ext.CompositeElementLite();\n    },\n\n    // private\n    afterRender : function(){\n        Ext.DataView.superclass.afterRender.call(this);\n\n\t\tthis.mon(this.getTemplateTarget(), {\n            \"click\": this.onClick,\n            \"dblclick\": this.onDblClick,\n            \"contextmenu\": this.onContextMenu,\n            scope:this\n        });\n\n        if(this.overClass || this.trackOver){\n            this.mon(this.getTemplateTarget(), {\n                \"mouseover\": this.onMouseOver,\n                \"mouseout\": this.onMouseOut,\n                scope:this\n            });\n        }\n\n        if(this.store){\n            this.bindStore(this.store, true);\n        }\n    },\n\n    /**\n     * Refreshes the view by reloading the data from the store and re-rendering the template.\n     */\n    refresh : function() {\n        this.clearSelections(false, true);\n        var el = this.getTemplateTarget(),\n            records = this.store.getRange();\n            \n        el.update('');\n        if(records.length < 1){\n            if(!this.deferEmptyText || this.hasSkippedEmptyText){\n                el.update(this.emptyText);\n            }\n            this.all.clear();\n        }else{\n            this.tpl.overwrite(el, this.collectData(records, 0));\n            this.all.fill(Ext.query(this.itemSelector, el.dom));\n            this.updateIndexes(0);\n        }\n        this.hasSkippedEmptyText = true;\n    },\n\n    getTemplateTarget: function(){\n        return this.el;\n    },\n\n    /**\n     * Function which can be overridden to provide custom formatting for each Record that is used by this\n     * DataView's {@link #tpl template} to render each node.\n     * @param {Array/Object} data The raw data object that was used to create the Record.\n     * @param {Number} recordIndex the index number of the Record being prepared for rendering.\n     * @param {Record} record The Record being prepared for rendering.\n     * @return {Array/Object} The formatted data in a format expected by the internal {@link #tpl template}'s overwrite() method.\n     * (either an array if your params are numeric (i.e. {0}) or an object (i.e. {foo: 'bar'}))\n     */\n    prepareData : function(data){\n        return data;\n    },\n\n    /**\n     * <p>Function which can be overridden which returns the data object passed to this\n     * DataView's {@link #tpl template} to render the whole DataView.</p>\n     * <p>This is usually an Array of data objects, each element of which is processed by an\n     * {@link Ext.XTemplate XTemplate} which uses <tt>'&lt;tpl for=\".\"&gt;'</tt> to iterate over its supplied\n     * data object as an Array. However, <i>named</i> properties may be placed into the data object to\n     * provide non-repeating data such as headings, totals etc.</p>\n     * @param {Array} records An Array of {@link Ext.data.Record}s to be rendered into the DataView.\n     * @param {Number} startIndex the index number of the Record being prepared for rendering.\n     * @return {Array} An Array of data objects to be processed by a repeating XTemplate. May also\n     * contain <i>named</i> properties.\n     */\n    collectData : function(records, startIndex){\n        var r = [],\n            i = 0,\n            len = records.length;\n        for(; i < len; i++){\n            r[r.length] = this.prepareData(records[i].data, startIndex + i, records[i]);\n        }\n        return r;\n    },\n\n    // private\n    bufferRender : function(records, index){\n        var div = document.createElement('div');\n        this.tpl.overwrite(div, this.collectData(records, index));\n        return Ext.query(this.itemSelector, div);\n    },\n\n    // private\n    onUpdate : function(ds, record){\n        var index = this.store.indexOf(record);\n        if(index > -1){\n            var sel = this.isSelected(index),\n                original = this.all.elements[index],\n                node = this.bufferRender([record], index)[0];\n\n            this.all.replaceElement(index, node, true);\n            if(sel){\n                this.selected.replaceElement(original, node);\n                this.all.item(index).addClass(this.selectedClass);\n            }\n            this.updateIndexes(index, index);\n        }\n    },\n\n    // private\n    onAdd : function(ds, records, index){\n        if(this.all.getCount() === 0){\n            this.refresh();\n            return;\n        }\n        var nodes = this.bufferRender(records, index), n, a = this.all.elements;\n        if(index < this.all.getCount()){\n            n = this.all.item(index).insertSibling(nodes, 'before', true);\n            a.splice.apply(a, [index, 0].concat(nodes));\n        }else{\n            n = this.all.last().insertSibling(nodes, 'after', true);\n            a.push.apply(a, nodes);\n        }\n        this.updateIndexes(index);\n    },\n\n    // private\n    onRemove : function(ds, record, index){\n        this.deselect(index);\n        this.all.removeElement(index, true);\n        this.updateIndexes(index);\n        if (this.store.getCount() === 0){\n            this.refresh();\n        }\n    },\n\n    /**\n     * Refreshes an individual node's data from the store.\n     * @param {Number} index The item's data index in the store\n     */\n    refreshNode : function(index){\n        this.onUpdate(this.store, this.store.getAt(index));\n    },\n\n    // private\n    updateIndexes : function(startIndex, endIndex){\n        var ns = this.all.elements;\n        startIndex = startIndex || 0;\n        endIndex = endIndex || ((endIndex === 0) ? 0 : (ns.length - 1));\n        for(var i = startIndex; i <= endIndex; i++){\n            ns[i].viewIndex = i;\n        }\n    },\n    \n    /**\n     * Returns the store associated with this DataView.\n     * @return {Ext.data.Store} The store\n     */\n    getStore : function(){\n        return this.store;\n    },\n\n    /**\n     * Changes the data store bound to this view and refreshes it.\n     * @param {Store} store The store to bind to this view\n     */\n    bindStore : function(store, initial){\n        if(!initial && this.store){\n            if(store !== this.store && this.store.autoDestroy){\n                this.store.destroy();\n            }else{\n                this.store.un(\"beforeload\", this.onBeforeLoad, this);\n                this.store.un(\"datachanged\", this.onDataChanged, this);\n                this.store.un(\"add\", this.onAdd, this);\n                this.store.un(\"remove\", this.onRemove, this);\n                this.store.un(\"update\", this.onUpdate, this);\n                this.store.un(\"clear\", this.refresh, this);\n            }\n            if(!store){\n                this.store = null;\n            }\n        }\n        if(store){\n            store = Ext.StoreMgr.lookup(store);\n            store.on({\n                scope: this,\n                beforeload: this.onBeforeLoad,\n                datachanged: this.onDataChanged,\n                add: this.onAdd,\n                remove: this.onRemove,\n                update: this.onUpdate,\n                clear: this.refresh\n            });\n        }\n        this.store = store;\n        if(store){\n            this.refresh();\n        }\n    },\n    \n    /**\n     * @private\n     * Calls this.refresh if this.blockRefresh is not true\n     */\n    onDataChanged: function() {\n        if (this.blockRefresh !== true) {\n            this.refresh.apply(this, arguments);\n        }\n    },\n\n    /**\n     * Returns the template node the passed child belongs to, or null if it doesn't belong to one.\n     * @param {HTMLElement} node\n     * @return {HTMLElement} The template node\n     */\n    findItemFromChild : function(node){\n        return Ext.fly(node).findParent(this.itemSelector, this.getTemplateTarget());\n    },\n\n    // private\n    onClick : function(e){\n        var item = e.getTarget(this.itemSelector, this.getTemplateTarget()),\n            index;\n        if(item){\n            index = this.indexOf(item);\n            if(this.onItemClick(item, index, e) !== false){\n                this.fireEvent(\"click\", this, index, item, e);\n            }\n        }else{\n            if(this.fireEvent(\"containerclick\", this, e) !== false){\n                this.onContainerClick(e);\n            }\n        }\n    },\n\n    onContainerClick : function(e){\n        this.clearSelections();\n    },\n\n    // private\n    onContextMenu : function(e){\n        var item = e.getTarget(this.itemSelector, this.getTemplateTarget());\n        if(item){\n            this.fireEvent(\"contextmenu\", this, this.indexOf(item), item, e);\n        }else{\n            this.fireEvent(\"containercontextmenu\", this, e);\n        }\n    },\n\n    // private\n    onDblClick : function(e){\n        var item = e.getTarget(this.itemSelector, this.getTemplateTarget());\n        if(item){\n            this.fireEvent(\"dblclick\", this, this.indexOf(item), item, e);\n        }\n    },\n\n    // private\n    onMouseOver : function(e){\n        var item = e.getTarget(this.itemSelector, this.getTemplateTarget());\n        if(item && item !== this.lastItem){\n            this.lastItem = item;\n            Ext.fly(item).addClass(this.overClass);\n            this.fireEvent(\"mouseenter\", this, this.indexOf(item), item, e);\n        }\n    },\n\n    // private\n    onMouseOut : function(e){\n        if(this.lastItem){\n            if(!e.within(this.lastItem, true, true)){\n                Ext.fly(this.lastItem).removeClass(this.overClass);\n                this.fireEvent(\"mouseleave\", this, this.indexOf(this.lastItem), this.lastItem, e);\n                delete this.lastItem;\n            }\n        }\n    },\n\n    // private\n    onItemClick : function(item, index, e){\n        if(this.fireEvent(\"beforeclick\", this, index, item, e) === false){\n            return false;\n        }\n        if(this.multiSelect){\n            this.doMultiSelection(item, index, e);\n            e.preventDefault();\n        }else if(this.singleSelect){\n            this.doSingleSelection(item, index, e);\n            e.preventDefault();\n        }\n        return true;\n    },\n\n    // private\n    doSingleSelection : function(item, index, e){\n        if(e.ctrlKey && this.isSelected(index)){\n            this.deselect(index);\n        }else{\n            this.select(index, false);\n        }\n    },\n\n    // private\n    doMultiSelection : function(item, index, e){\n        if(e.shiftKey && this.last !== false){\n            var last = this.last;\n            this.selectRange(last, index, e.ctrlKey);\n            this.last = last; // reset the last\n        }else{\n            if((e.ctrlKey||this.simpleSelect) && this.isSelected(index)){\n                this.deselect(index);\n            }else{\n                this.select(index, e.ctrlKey || e.shiftKey || this.simpleSelect);\n            }\n        }\n    },\n\n    /**\n     * Gets the number of selected nodes.\n     * @return {Number} The node count\n     */\n    getSelectionCount : function(){\n        return this.selected.getCount();\n    },\n\n    /**\n     * Gets the currently selected nodes.\n     * @return {Array} An array of HTMLElements\n     */\n    getSelectedNodes : function(){\n        return this.selected.elements;\n    },\n\n    /**\n     * Gets the indexes of the selected nodes.\n     * @return {Array} An array of numeric indexes\n     */\n    getSelectedIndexes : function(){\n        var indexes = [], \n            selected = this.selected.elements,\n            i = 0,\n            len = selected.length;\n            \n        for(; i < len; i++){\n            indexes.push(selected[i].viewIndex);\n        }\n        return indexes;\n    },\n\n    /**\n     * Gets an array of the selected records\n     * @return {Array} An array of {@link Ext.data.Record} objects\n     */\n    getSelectedRecords : function(){\n        return this.getRecords(this.selected.elements);\n    },\n\n    /**\n     * Gets an array of the records from an array of nodes\n     * @param {Array} nodes The nodes to evaluate\n     * @return {Array} records The {@link Ext.data.Record} objects\n     */\n    getRecords : function(nodes){\n        var records = [], \n            i = 0,\n            len = nodes.length;\n            \n        for(; i < len; i++){\n            records[records.length] = this.store.getAt(nodes[i].viewIndex);\n        }\n        return records;\n    },\n\n    /**\n     * Gets a record from a node\n     * @param {HTMLElement} node The node to evaluate\n     * @return {Record} record The {@link Ext.data.Record} object\n     */\n    getRecord : function(node){\n        return this.store.getAt(node.viewIndex);\n    },\n\n    /**\n     * Clears all selections.\n     * @param {Boolean} suppressEvent (optional) True to skip firing of the selectionchange event\n     */\n    clearSelections : function(suppressEvent, skipUpdate){\n        if((this.multiSelect || this.singleSelect) && this.selected.getCount() > 0){\n            if(!skipUpdate){\n                this.selected.removeClass(this.selectedClass);\n            }\n            this.selected.clear();\n            this.last = false;\n            if(!suppressEvent){\n                this.fireEvent(\"selectionchange\", this, this.selected.elements);\n            }\n        }\n    },\n\n    /**\n     * Returns true if the passed node is selected, else false.\n     * @param {HTMLElement/Number/Ext.data.Record} node The node, node index or record to check\n     * @return {Boolean} True if selected, else false\n     */\n    isSelected : function(node){\n        return this.selected.contains(this.getNode(node));\n    },\n\n    /**\n     * Deselects a node.\n     * @param {HTMLElement/Number/Record} node The node, node index or record to deselect\n     */\n    deselect : function(node){\n        if(this.isSelected(node)){\n            node = this.getNode(node);\n            this.selected.removeElement(node);\n            if(this.last == node.viewIndex){\n                this.last = false;\n            }\n            Ext.fly(node).removeClass(this.selectedClass);\n            this.fireEvent(\"selectionchange\", this, this.selected.elements);\n        }\n    },\n\n    /**\n     * Selects a set of nodes.\n     * @param {Array/HTMLElement/String/Number/Ext.data.Record} nodeInfo An HTMLElement template node, index of a template node,\n     * id of a template node, record associated with a node or an array of any of those to select\n     * @param {Boolean} keepExisting (optional) true to keep existing selections\n     * @param {Boolean} suppressEvent (optional) true to skip firing of the selectionchange vent\n     */\n    select : function(nodeInfo, keepExisting, suppressEvent){\n        if(Ext.isArray(nodeInfo)){\n            if(!keepExisting){\n                this.clearSelections(true);\n            }\n            for(var i = 0, len = nodeInfo.length; i < len; i++){\n                this.select(nodeInfo[i], true, true);\n            }\n            if(!suppressEvent){\n                this.fireEvent(\"selectionchange\", this, this.selected.elements);\n            }\n        } else{\n            var node = this.getNode(nodeInfo);\n            if(!keepExisting){\n                this.clearSelections(true);\n            }\n            if(node && !this.isSelected(node)){\n                if(this.fireEvent(\"beforeselect\", this, node, this.selected.elements) !== false){\n                    Ext.fly(node).addClass(this.selectedClass);\n                    this.selected.add(node);\n                    this.last = node.viewIndex;\n                    if(!suppressEvent){\n                        this.fireEvent(\"selectionchange\", this, this.selected.elements);\n                    }\n                }\n            }\n        }\n    },\n\n    /**\n     * Selects a range of nodes. All nodes between start and end are selected.\n     * @param {Number} start The index of the first node in the range\n     * @param {Number} end The index of the last node in the range\n     * @param {Boolean} keepExisting (optional) True to retain existing selections\n     */\n    selectRange : function(start, end, keepExisting){\n        if(!keepExisting){\n            this.clearSelections(true);\n        }\n        this.select(this.getNodes(start, end), true);\n    },\n\n    /**\n     * Gets a template node.\n     * @param {HTMLElement/String/Number/Ext.data.Record} nodeInfo An HTMLElement template node, index of a template node, \n     * the id of a template node or the record associated with the node.\n     * @return {HTMLElement} The node or null if it wasn't found\n     */\n    getNode : function(nodeInfo){\n        if(Ext.isString(nodeInfo)){\n            return document.getElementById(nodeInfo);\n        }else if(Ext.isNumber(nodeInfo)){\n            return this.all.elements[nodeInfo];\n        }else if(nodeInfo instanceof Ext.data.Record){\n            var idx = this.store.indexOf(nodeInfo);\n            return this.all.elements[idx];\n        }\n        return nodeInfo;\n    },\n\n    /**\n     * Gets a range nodes.\n     * @param {Number} start (optional) The index of the first node in the range\n     * @param {Number} end (optional) The index of the last node in the range\n     * @return {Array} An array of nodes\n     */\n    getNodes : function(start, end){\n        var ns = this.all.elements,\n            nodes = [],\n            i;\n            \n        start = start || 0;\n        end = !Ext.isDefined(end) ? Math.max(ns.length - 1, 0) : end;\n        if(start <= end){\n            for(i = start; i <= end && ns[i]; i++){\n                nodes.push(ns[i]);\n            }\n        } else{\n            for(i = start; i >= end && ns[i]; i--){\n                nodes.push(ns[i]);\n            }\n        }\n        return nodes;\n    },\n\n    /**\n     * Finds the index of the passed node.\n     * @param {HTMLElement/String/Number/Record} nodeInfo An HTMLElement template node, index of a template node, the id of a template node\n     * or a record associated with a node.\n     * @return {Number} The index of the node or -1\n     */\n    indexOf : function(node){\n        node = this.getNode(node);\n        if(Ext.isNumber(node.viewIndex)){\n            return node.viewIndex;\n        }\n        return this.all.indexOf(node);\n    },\n\n    // private\n    onBeforeLoad : function(){\n        if(this.loadingText){\n            this.clearSelections(false, true);\n            this.getTemplateTarget().update('<div class=\"loading-indicator\">'+this.loadingText+'</div>');\n            this.all.clear();\n        }\n    },\n\n    onDestroy : function(){\n        this.all.clear();\n        this.selected.clear();\n        Ext.DataView.superclass.onDestroy.call(this);\n        this.bindStore(null);\n    }\n});\n\n/**\n * Changes the data store bound to this view and refreshes it. (deprecated in favor of bindStore)\n * @param {Store} store The store to bind to this view\n */\nExt.DataView.prototype.setStore = Ext.DataView.prototype.bindStore;\n\nExt.reg('dataview', Ext.DataView);\n/**\n * @class Ext.list.ListView\n * @extends Ext.DataView\n * <p>Ext.list.ListView is a fast and light-weight implentation of a\n * {@link Ext.grid.GridPanel Grid} like view with the following characteristics:</p>\n * <div class=\"mdetail-params\"><ul>\n * <li>resizable columns</li>\n * <li>selectable</li>\n * <li>column widths are initially proportioned by percentage based on the container\n * width and number of columns</li>\n * <li>uses templates to render the data in any required format</li>\n * <li>no horizontal scrolling</li>\n * <li>no editing</li>\n * </ul></div>\n * <p>Example usage:</p>\n * <pre><code>\n// consume JSON of this form:\n{\n   \"images\":[\n      {\n         \"name\":\"dance_fever.jpg\",\n         \"size\":2067,\n         \"lastmod\":1236974993000,\n         \"url\":\"images\\/thumbs\\/dance_fever.jpg\"\n      },\n      {\n         \"name\":\"zack_sink.jpg\",\n         \"size\":2303,\n         \"lastmod\":1236974993000,\n         \"url\":\"images\\/thumbs\\/zack_sink.jpg\"\n      }\n   ]\n}\nvar store = new Ext.data.JsonStore({\n    url: 'get-images.php',\n    root: 'images',\n    fields: [\n        'name', 'url',\n        {name:'size', type: 'float'},\n        {name:'lastmod', type:'date', dateFormat:'timestamp'}\n    ]\n});\nstore.load();\n\nvar listView = new Ext.list.ListView({\n    store: store,\n    multiSelect: true,\n    emptyText: 'No images to display',\n    reserveScrollOffset: true,\n    columns: [{\n        header: 'File',\n        width: .5,\n        dataIndex: 'name'\n    },{\n        header: 'Last Modified',\n        width: .35,\n        dataIndex: 'lastmod',\n        tpl: '{lastmod:date(\"m-d h:i a\")}'\n    },{\n        header: 'Size',\n        dataIndex: 'size',\n        tpl: '{size:fileSize}', // format using Ext.util.Format.fileSize()\n        align: 'right'\n    }]\n});\n\n// put it in a Panel so it looks pretty\nvar panel = new Ext.Panel({\n    id:'images-view',\n    width:425,\n    height:250,\n    collapsible:true,\n    layout:'fit',\n    title:'Simple ListView <i>(0 items selected)</i>',\n    items: listView\n});\npanel.render(document.body);\n\n// little bit of feedback\nlistView.on('selectionchange', function(view, nodes){\n    var l = nodes.length;\n    var s = l != 1 ? 's' : '';\n    panel.setTitle('Simple ListView <i>('+l+' item'+s+' selected)</i>');\n});\n * </code></pre>\n * @constructor\n * @param {Object} config\n * @xtype listview\n */\nExt.list.ListView = Ext.extend(Ext.DataView, {\n    /**\n     * Set this property to <tt>true</tt> to disable the header click handler disabling sort\n     * (defaults to <tt>false</tt>).\n     * @type Boolean\n     * @property disableHeaders\n     */\n    /**\n     * @cfg {Boolean} hideHeaders\n     * <tt>true</tt> to hide the {@link #internalTpl header row} (defaults to <tt>false</tt> so\n     * the {@link #internalTpl header row} will be shown).\n     */\n    /**\n     * @cfg {String} itemSelector\n     * Defaults to <tt>'dl'</tt> to work with the preconfigured <b><tt>{@link Ext.DataView#tpl tpl}</tt></b>.\n     * This setting specifies the CSS selector (e.g. <tt>div.some-class</tt> or <tt>span:first-child</tt>)\n     * that will be used to determine what nodes the ListView will be working with.\n     */\n    itemSelector: 'dl',\n    /**\n     * @cfg {String} selectedClass The CSS class applied to a selected row (defaults to\n     * <tt>'x-list-selected'</tt>). An example overriding the default styling:\n    <pre><code>\n    .x-list-selected {background-color: yellow;}\n    </code></pre>\n     * @type String\n     */\n    selectedClass:'x-list-selected',\n    /**\n     * @cfg {String} overClass The CSS class applied when over a row (defaults to\n     * <tt>'x-list-over'</tt>). An example overriding the default styling:\n    <pre><code>\n    .x-list-over {background-color: orange;}\n    </code></pre>\n     * @type String\n     */\n    overClass:'x-list-over',\n    /**\n     * @cfg {Boolean} reserveScrollOffset\n     * By default will defer accounting for the configured <b><tt>{@link #scrollOffset}</tt></b>\n     * for 10 milliseconds.  Specify <tt>true</tt> to account for the configured\n     * <b><tt>{@link #scrollOffset}</tt></b> immediately.\n     */\n    /**\n     * @cfg {Number} scrollOffset The amount of space to reserve for the scrollbar (defaults to\n     * <tt>undefined</tt>). If an explicit value isn't specified, this will be automatically\n     * calculated.\n     */\n    scrollOffset : undefined,\n    /**\n     * @cfg {Boolean/Object} columnResize\n     * Specify <tt>true</tt> or specify a configuration object for {@link Ext.list.ListView.ColumnResizer}\n     * to enable the columns to be resizable (defaults to <tt>true</tt>).\n     */\n    columnResize: true,\n    /**\n     * @cfg {Array} columns An array of column configuration objects, for example:\n     * <pre><code>\n{\n    align: 'right',\n    dataIndex: 'size',\n    header: 'Size',\n    tpl: '{size:fileSize}',\n    width: .35\n}\n     * </code></pre>\n     * Acceptable properties for each column configuration object are:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b><tt>align</tt></b> : String<div class=\"sub-desc\">Set the CSS text-align property\n     * of the column. Defaults to <tt>'left'</tt>.</div></li>\n     * <li><b><tt>dataIndex</tt></b> : String<div class=\"sub-desc\">See {@link Ext.grid.Column}.\n     * {@link Ext.grid.Column#dataIndex dataIndex} for details.</div></li>\n     * <li><b><tt>header</tt></b> : String<div class=\"sub-desc\">See {@link Ext.grid.Column}.\n     * {@link Ext.grid.Column#header header} for details.</div></li>\n     * <li><b><tt>tpl</tt></b> : String<div class=\"sub-desc\">Specify a string to pass as the\n     * configuration string for {@link Ext.XTemplate}.  By default an {@link Ext.XTemplate}\n     * will be implicitly created using the <tt>dataIndex</tt>.</div></li>\n     * <li><b><tt>width</tt></b> : Number<div class=\"sub-desc\">Percentage of the container width\n     * this column should be allocated.  Columns that have no width specified will be\n     * allocated with an equal percentage to fill 100% of the container width.  To easily take\n     * advantage of the full container width, leave the width of at least one column undefined.\n     * Note that if you do not want to take up the full width of the container, the width of\n     * every column needs to be explicitly defined.</div></li>\n     * </ul></div>\n     */\n    /**\n     * @cfg {Boolean/Object} columnSort\n     * Specify <tt>true</tt> or specify a configuration object for {@link Ext.list.ListView.Sorter}\n     * to enable the columns to be sortable (defaults to <tt>true</tt>).\n     */\n    columnSort: true,\n    /**\n     * @cfg {String/Array} internalTpl\n     * The template to be used for the header row.  See {@link #tpl} for more details.\n     */\n\n    /*\n     * IE has issues when setting percentage based widths to 100%. Default to 99.\n     */\n    maxColumnWidth: Ext.isIE9m ? 99 : 100,\n\n    initComponent : function(){\n        if(this.columnResize){\n            this.colResizer = new Ext.list.ColumnResizer(this.colResizer);\n            this.colResizer.init(this);\n        }\n        if(this.columnSort){\n            this.colSorter = new Ext.list.Sorter(this.columnSort);\n            this.colSorter.init(this);\n        }\n        if(!this.internalTpl){\n            this.internalTpl = new Ext.XTemplate(\n                '<div class=\"x-list-header\"><div class=\"x-list-header-inner\">',\n                    '<tpl for=\"columns\">',\n                    '<div style=\"width:{[values.width*100]}%;text-align:{align};\"><em class=\"x-unselectable\" unselectable=\"on\" id=\"',this.id, '-xlhd-{#}\">',\n                        '{header}',\n                    '</em></div>',\n                    '</tpl>',\n                    '<div class=\"x-clear\"></div>',\n                '</div></div>',\n                '<div class=\"x-list-body\"><div class=\"x-list-body-inner\">',\n                '</div></div>'\n            );\n        }\n        if(!this.tpl){\n            this.tpl = new Ext.XTemplate(\n                '<tpl for=\"rows\">',\n                    '<dl>',\n                        '<tpl for=\"parent.columns\">',\n                        '<dt style=\"width:{[values.width*100]}%;text-align:{align};\">',\n                        '<em unselectable=\"on\"<tpl if=\"cls\"> class=\"{cls}</tpl>\">',\n                            '{[values.tpl.apply(parent)]}',\n                        '</em></dt>',\n                        '</tpl>',\n                        '<div class=\"x-clear\"></div>',\n                    '</dl>',\n                '</tpl>'\n            );\n        };\n\n        var cs = this.columns,\n            allocatedWidth = 0,\n            colsWithWidth = 0,\n            len = cs.length,\n            columns = [];\n\n        for(var i = 0; i < len; i++){\n            var c = cs[i];\n            if(!c.isColumn) {\n                c.xtype = c.xtype ? (/^lv/.test(c.xtype) ? c.xtype : 'lv' + c.xtype) : 'lvcolumn';\n                c = Ext.create(c);\n            }\n            if(c.width) {\n                allocatedWidth += c.width*100;\n                if(allocatedWidth > this.maxColumnWidth){\n                    c.width -= (allocatedWidth - this.maxColumnWidth) / 100;\n                }\n                colsWithWidth++;\n            }\n            columns.push(c);\n        }\n\n        cs = this.columns = columns;\n\n        // auto calculate missing column widths\n        if(colsWithWidth < len){\n            var remaining = len - colsWithWidth;\n            if(allocatedWidth < this.maxColumnWidth){\n                var perCol = ((this.maxColumnWidth-allocatedWidth) / remaining)/100;\n                for(var j = 0; j < len; j++){\n                    var c = cs[j];\n                    if(!c.width){\n                        c.width = perCol;\n                    }\n                }\n            }\n        }\n        Ext.list.ListView.superclass.initComponent.call(this);\n    },\n\n    onRender : function(){\n        this.autoEl = {\n            cls: 'x-list-wrap'\n        };\n        Ext.list.ListView.superclass.onRender.apply(this, arguments);\n\n        this.internalTpl.overwrite(this.el, {columns: this.columns});\n\n        this.innerBody = Ext.get(this.el.dom.childNodes[1].firstChild);\n        this.innerHd = Ext.get(this.el.dom.firstChild.firstChild);\n\n        if(this.hideHeaders){\n            this.el.dom.firstChild.style.display = 'none';\n        }\n    },\n\n    getTemplateTarget : function(){\n        return this.innerBody;\n    },\n\n    /**\n     * <p>Function which can be overridden which returns the data object passed to this\n     * view's {@link #tpl template} to render the whole ListView. The returned object\n     * shall contain the following properties:</p>\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>columns</b> : String<div class=\"sub-desc\">See <tt>{@link #columns}</tt></div></li>\n     * <li><b>rows</b> : String<div class=\"sub-desc\">See\n     * <tt>{@link Ext.DataView}.{@link Ext.DataView#collectData collectData}</div></li>\n     * </ul></div>\n     * @param {Array} records An Array of {@link Ext.data.Record}s to be rendered into the DataView.\n     * @param {Number} startIndex the index number of the Record being prepared for rendering.\n     * @return {Object} A data object containing properties to be processed by a repeating\n     * XTemplate as described above.\n     */\n    collectData : function(){\n        var rs = Ext.list.ListView.superclass.collectData.apply(this, arguments);\n        return {\n            columns: this.columns,\n            rows: rs\n        };\n    },\n\n    verifyInternalSize : function(){\n        if(this.lastSize){\n            this.onResize(this.lastSize.width, this.lastSize.height);\n        }\n    },\n\n    // private\n    onResize : function(w, h){\n        var body = this.innerBody.dom,\n            header = this.innerHd.dom,\n            scrollWidth = w - Ext.num(this.scrollOffset, Ext.getScrollBarWidth()) + 'px',\n            parentNode;\n            \n        if(!body){\n            return;\n        }\n        parentNode = body.parentNode;\n        if(Ext.isNumber(w)){\n            if(this.reserveScrollOffset || ((parentNode.offsetWidth - parentNode.clientWidth) > 10)){\n                body.style.width = scrollWidth;\n                header.style.width = scrollWidth;\n            }else{\n                body.style.width = w + 'px';\n                header.style.width = w + 'px';\n                setTimeout(function(){\n                    if((parentNode.offsetWidth - parentNode.clientWidth) > 10){\n                        body.style.width = scrollWidth;\n                        header.style.width = scrollWidth;\n                    }\n                }, 10);\n            }\n        }\n        if(Ext.isNumber(h)){\n            parentNode.style.height = Math.max(0, h - header.parentNode.offsetHeight) + 'px';\n        }\n    },\n\n    updateIndexes : function(){\n        Ext.list.ListView.superclass.updateIndexes.apply(this, arguments);\n        this.verifyInternalSize();\n    },\n\n    findHeaderIndex : function(header){\n        header = header.dom || header;\n        var parentNode = header.parentNode, \n            children = parentNode.parentNode.childNodes,\n            i = 0,\n            c;\n        for(; c = children[i]; i++){\n            if(c == parentNode){\n                return i;\n            }\n        }\n        return -1;\n    },\n\n    setHdWidths : function(){\n        var els = this.innerHd.dom.getElementsByTagName('div'),\n            i = 0,\n            columns = this.columns,\n            len = columns.length;\n            \n        for(; i < len; i++){\n            els[i].style.width = (columns[i].width*100) + '%';\n        }\n    }\n});\n\nExt.reg('listview', Ext.list.ListView);\n\n// Backwards compatibility alias\nExt.ListView = Ext.list.ListView;/**\n * @class Ext.list.Column\n * <p>This class encapsulates column configuration data to be used in the initialization of a\n * {@link Ext.list.ListView ListView}.</p>\n * <p>While subclasses are provided to render data in different ways, this class renders a passed\n * data field unchanged and is usually used for textual columns.</p>\n */\nExt.list.Column = Ext.extend(Object, {\n    /**\n     * @private\n     * @cfg {Boolean} isColumn\n     * Used by ListView constructor method to avoid reprocessing a Column\n     * if <code>isColumn</code> is not set ListView will recreate a new Ext.list.Column\n     * Defaults to true.\n     */\n    isColumn: true,\n    \n    /**\n     * @cfg {String} align\n     * Set the CSS text-align property of the column. Defaults to <tt>'left'</tt>.\n     */        \n    align: 'left',\n    /**\n     * @cfg {String} header Optional. The header text to be used as innerHTML\n     * (html tags are accepted) to display in the ListView.  <b>Note</b>: to\n     * have a clickable header with no text displayed use <tt>'&#160;'</tt>.\n     */    \n    header: '',\n    \n    /**\n     * @cfg {Number} width Optional. Percentage of the container width\n     * this column should be allocated.  Columns that have no width specified will be\n     * allocated with an equal percentage to fill 100% of the container width.  To easily take\n     * advantage of the full container width, leave the width of at least one column undefined.\n     * Note that if you do not want to take up the full width of the container, the width of\n     * every column needs to be explicitly defined.\n     */    \n    width: null,\n\n    /**\n     * @cfg {String} cls Optional. This option can be used to add a CSS class to the cell of each\n     * row for this column.\n     */\n    cls: '',\n    \n    /**\n     * @cfg {String} tpl Optional. Specify a string to pass as the\n     * configuration string for {@link Ext.XTemplate}.  By default an {@link Ext.XTemplate}\n     * will be implicitly created using the <tt>dataIndex</tt>.\n     */\n\n    /**\n     * @cfg {String} dataIndex <p><b>Required</b>. The name of the field in the\n     * ListViews's {@link Ext.data.Store}'s {@link Ext.data.Record} definition from\n     * which to draw the column's value.</p>\n     */\n    \n    constructor : function(c){\n        if(!c.tpl){\n            c.tpl = new Ext.XTemplate('{' + c.dataIndex + '}');\n        }\n        else if(Ext.isString(c.tpl)){\n            c.tpl = new Ext.XTemplate(c.tpl);\n        }\n        \n        Ext.apply(this, c);\n    }\n});\n\nExt.reg('lvcolumn', Ext.list.Column);\n\n/**\n * @class Ext.list.NumberColumn\n * @extends Ext.list.Column\n * <p>A Column definition class which renders a numeric data field according to a {@link #format} string.  See the\n * {@link Ext.list.Column#xtype xtype} config option of {@link Ext.list.Column} for more details.</p>\n */\nExt.list.NumberColumn = Ext.extend(Ext.list.Column, {\n    /**\n     * @cfg {String} format\n     * A formatting string as used by {@link Ext.util.Format#number} to format a numeric value for this Column\n     * (defaults to <tt>'0,000.00'</tt>).\n     */    \n    format: '0,000.00',\n    \n    constructor : function(c) {\n        c.tpl = c.tpl || new Ext.XTemplate('{' + c.dataIndex + ':number(\"' + (c.format || this.format) + '\")}');       \n        Ext.list.NumberColumn.superclass.constructor.call(this, c);\n    }\n});\n\nExt.reg('lvnumbercolumn', Ext.list.NumberColumn);\n\n/**\n * @class Ext.list.DateColumn\n * @extends Ext.list.Column\n * <p>A Column definition class which renders a passed date according to the default locale, or a configured\n * {@link #format}. See the {@link Ext.list.Column#xtype xtype} config option of {@link Ext.list.Column}\n * for more details.</p>\n */\nExt.list.DateColumn = Ext.extend(Ext.list.Column, {\n    format: 'm/d/Y',\n    constructor : function(c) {\n        c.tpl = c.tpl || new Ext.XTemplate('{' + c.dataIndex + ':date(\"' + (c.format || this.format) + '\")}');      \n        Ext.list.DateColumn.superclass.constructor.call(this, c);\n    }\n});\nExt.reg('lvdatecolumn', Ext.list.DateColumn);\n\n/**\n * @class Ext.list.BooleanColumn\n * @extends Ext.list.Column\n * <p>A Column definition class which renders boolean data fields.  See the {@link Ext.list.Column#xtype xtype}\n * config option of {@link Ext.list.Column} for more details.</p>\n */\nExt.list.BooleanColumn = Ext.extend(Ext.list.Column, {\n    /**\n     * @cfg {String} trueText\n     * The string returned by the renderer when the column value is not falsey (defaults to <tt>'true'</tt>).\n     */\n    trueText: 'true',\n    /**\n     * @cfg {String} falseText\n     * The string returned by the renderer when the column value is falsey (but not undefined) (defaults to\n     * <tt>'false'</tt>).\n     */\n    falseText: 'false',\n    /**\n     * @cfg {String} undefinedText\n     * The string returned by the renderer when the column value is undefined (defaults to <tt>'&#160;'</tt>).\n     */\n    undefinedText: '&#160;',\n    \n    constructor : function(c) {\n        c.tpl = c.tpl || new Ext.XTemplate('{' + c.dataIndex + ':this.format}');\n        \n        var t = this.trueText, f = this.falseText, u = this.undefinedText;\n        c.tpl.format = function(v){\n            if(v === undefined){\n                return u;\n            }\n            if(!v || v === 'false'){\n                return f;\n            }\n            return t;\n        };\n        \n        Ext.list.DateColumn.superclass.constructor.call(this, c);\n    }\n});\n\nExt.reg('lvbooleancolumn', Ext.list.BooleanColumn);/**\n * @class Ext.list.ColumnResizer\n * @extends Ext.util.Observable\n * <p>Supporting Class for Ext.list.ListView</p>\n * @constructor\n * @param {Object} config\n */\nExt.list.ColumnResizer = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Number} minPct The minimum percentage to allot for any column (defaults to <tt>.05</tt>)\n     */\n    minPct: .05,\n\n    constructor: function(config){\n        Ext.apply(this, config);\n        Ext.list.ColumnResizer.superclass.constructor.call(this);\n    },\n    init : function(listView){\n        this.view = listView;\n        listView.on('render', this.initEvents, this);\n    },\n\n    initEvents : function(view){\n        view.mon(view.innerHd, 'mousemove', this.handleHdMove, this);\n        this.tracker = new Ext.dd.DragTracker({\n            onBeforeStart: this.onBeforeStart.createDelegate(this),\n            onStart: this.onStart.createDelegate(this),\n            onDrag: this.onDrag.createDelegate(this),\n            onEnd: this.onEnd.createDelegate(this),\n            tolerance: 3,\n            autoStart: 300\n        });\n        this.tracker.initEl(view.innerHd);\n        view.on('beforedestroy', this.tracker.destroy, this.tracker);\n    },\n\n    handleHdMove : function(e, t){\n        var handleWidth = 5,\n            x = e.getPageX(),\n            header = e.getTarget('em', 3, true);\n        if(header){\n            var region = header.getRegion(),\n                style = header.dom.style,\n                parentNode = header.dom.parentNode;\n\n            if(x - region.left <= handleWidth && parentNode != parentNode.parentNode.firstChild){\n                this.activeHd = Ext.get(parentNode.previousSibling.firstChild);\n                style.cursor = Ext.isWebKit ? 'e-resize' : 'col-resize';\n            } else if(region.right - x <= handleWidth && parentNode != parentNode.parentNode.lastChild.previousSibling){\n                this.activeHd = header;\n                style.cursor = Ext.isWebKit ? 'w-resize' : 'col-resize';\n            } else{\n                delete this.activeHd;\n                style.cursor = '';\n            }\n        }\n    },\n\n    onBeforeStart : function(e){\n        this.dragHd = this.activeHd;\n        return !!this.dragHd;\n    },\n\n    onStart: function(e){\n        \n        var me = this,\n            view = me.view,\n            dragHeader = me.dragHd,\n            x = me.tracker.getXY()[0];            \n        \n        me.proxy = view.el.createChild({cls:'x-list-resizer'});\n        me.dragX = dragHeader.getX();\n        me.headerIndex = view.findHeaderIndex(dragHeader);\n        \n        me.headersDisabled = view.disableHeaders;\n        view.disableHeaders = true;\n        \n        me.proxy.setHeight(view.el.getHeight());\n        me.proxy.setX(me.dragX);\n        me.proxy.setWidth(x - me.dragX);\n        \n        this.setBoundaries();\n        \n    },\n    \n    // Sets up the boundaries for the drag/drop operation\n    setBoundaries: function(relativeX){\n        var view = this.view,\n            headerIndex = this.headerIndex,\n            width = view.innerHd.getWidth(),\n            relativeX = view.innerHd.getX(),\n            minWidth = Math.ceil(width * this.minPct),\n            maxWidth = width - minWidth,\n            numColumns = view.columns.length,\n            headers = view.innerHd.select('em', true),\n            minX = minWidth + relativeX,\n            maxX = maxWidth + relativeX,\n            header;\n          \n        if (numColumns == 2) {\n            this.minX = minX;\n            this.maxX = maxX;\n        }else{\n            header = headers.item(headerIndex + 2);\n            this.minX = headers.item(headerIndex).getX() + minWidth;\n            this.maxX = header ? header.getX() - minWidth : maxX;\n            if (headerIndex == 0) {\n                // First\n                this.minX = minX;\n            } else if (headerIndex == numColumns - 2) {\n                // Last\n                this.maxX = maxX;\n            }\n        }\n    },\n\n    onDrag: function(e){\n        var me = this,\n            cursorX = me.tracker.getXY()[0].constrain(me.minX, me.maxX);\n            \n        me.proxy.setWidth(cursorX - this.dragX);\n    },\n\n    onEnd: function(e){\n        /* calculate desired width by measuring proxy and then remove it */\n        var newWidth = this.proxy.getWidth(),\n            index = this.headerIndex,\n            view = this.view,\n            columns = view.columns,\n            width = view.innerHd.getWidth(),\n            newPercent = Math.ceil(newWidth * view.maxColumnWidth / width) / 100,\n            disabled = this.headersDisabled,\n            headerCol = columns[index],\n            otherCol = columns[index + 1],\n            totalPercent = headerCol.width + otherCol.width;\n\n        this.proxy.remove();\n\n        headerCol.width = newPercent;\n        otherCol.width = totalPercent - newPercent;\n      \n        delete this.dragHd;\n        view.setHdWidths();\n        view.refresh();\n        \n        setTimeout(function(){\n            view.disableHeaders = disabled;\n        }, 100);\n    }\n});\n\n// Backwards compatibility alias\nExt.ListView.ColumnResizer = Ext.list.ColumnResizer;/**\n * @class Ext.list.Sorter\n * @extends Ext.util.Observable\n * <p>Supporting Class for Ext.list.ListView</p>\n * @constructor\n * @param {Object} config\n */\nExt.list.Sorter = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Array} sortClasses\n     * The CSS classes applied to a header when it is sorted. (defaults to <tt>[\"sort-asc\", \"sort-desc\"]</tt>)\n     */\n    sortClasses : [\"sort-asc\", \"sort-desc\"],\n\n    constructor: function(config){\n        Ext.apply(this, config);\n        Ext.list.Sorter.superclass.constructor.call(this);\n    },\n\n    init : function(listView){\n        this.view = listView;\n        listView.on('render', this.initEvents, this);\n    },\n\n    initEvents : function(view){\n        view.mon(view.innerHd, 'click', this.onHdClick, this);\n        view.innerHd.setStyle('cursor', 'pointer');\n        view.mon(view.store, 'datachanged', this.updateSortState, this);\n        this.updateSortState.defer(10, this, [view.store]);\n    },\n\n    updateSortState : function(store){\n        var state = store.getSortState();\n        if(!state){\n            return;\n        }\n        this.sortState = state;\n        var cs = this.view.columns, sortColumn = -1;\n        for(var i = 0, len = cs.length; i < len; i++){\n            if(cs[i].dataIndex == state.field){\n                sortColumn = i;\n                break;\n            }\n        }\n        if(sortColumn != -1){\n            var sortDir = state.direction;\n            this.updateSortIcon(sortColumn, sortDir);\n        }\n    },\n\n    updateSortIcon : function(col, dir){\n        var sc = this.sortClasses;\n        var hds = this.view.innerHd.select('em').removeClass(sc);\n        hds.item(col).addClass(sc[dir == \"DESC\" ? 1 : 0]);\n    },\n\n    onHdClick : function(e){\n        var hd = e.getTarget('em', 3);\n        if(hd && !this.view.disableHeaders){\n            var index = this.view.findHeaderIndex(hd);\n            this.view.store.sort(this.view.columns[index].dataIndex);\n        }\n    }\n});\n\n// Backwards compatibility alias\nExt.ListView.Sorter = Ext.list.Sorter;/**\n * @class Ext.TabPanel\n * <p>A basic tab container. TabPanels can be used exactly like a standard {@link Ext.Panel}\n * for layout purposes, but also have special support for containing child Components\n * (<tt>{@link Ext.Container#items items}</tt>) that are managed using a\n * {@link Ext.layout.CardLayout CardLayout layout manager}, and displayed as separate tabs.</p>\n *\n * <b>Note:</b> By default, a tab's close tool <i>destroys</i> the child tab Component\n * and all its descendants. This makes the child tab Component, and all its descendants <b>unusable</b>. To enable\n * re-use of a tab, configure the TabPanel with <b><code>{@link #autoDestroy autoDestroy: false}</code></b>.\n *\n * <p><b><u>TabPanel header/footer elements</u></b></p>\n * <p>TabPanels use their {@link Ext.Panel#header header} or {@link Ext.Panel#footer footer} element\n * (depending on the {@link #tabPosition} configuration) to accommodate the tab selector buttons.\n * This means that a TabPanel will not display any configured title, and will not display any\n * configured header {@link Ext.Panel#tools tools}.</p>\n * <p>To display a header, embed the TabPanel in a {@link Ext.Panel Panel} which uses\n * <b><tt>{@link Ext.Container#layout layout:'fit'}</tt></b>.</p>\n *\n * <p><b><u>Tab Events</u></b></p>\n * <p>There is no actual tab class &mdash; each tab is simply a {@link Ext.BoxComponent Component}\n * such as a {@link Ext.Panel Panel}. However, when rendered in a TabPanel, each child Component\n * can fire additional events that only exist for tabs and are not available from other Components.\n * These events are:</p>\n * <div><ul class=\"mdetail-params\">\n * <li><tt><b>{@link Ext.Panel#activate activate}</b></tt> : Fires when this Component becomes\n * the active tab.</li>\n * <li><tt><b>{@link Ext.Panel#deactivate deactivate}</b></tt> : Fires when the Component that\n * was the active tab becomes deactivated.</li>\n * <li><tt><b>{@link Ext.Panel#beforeclose beforeclose}</b></tt> : Fires when the user clicks on the close tool of a closeable tab.\n * May be vetoed by returning <code>false</code> from a handler.</li>\n * <li><tt><b>{@link Ext.Panel#close close}</b></tt> : Fires a closeable tab has been closed by the user.</li>\n * </ul></div>\n * <p><b><u>Creating TabPanels from Code</u></b></p>\n * <p>TabPanels can be created and rendered completely in code, as in this example:</p>\n * <pre><code>\nvar tabs = new Ext.TabPanel({\n    renderTo: Ext.getBody(),\n    activeTab: 0,\n    items: [{\n        title: 'Tab 1',\n        html: 'A simple tab'\n    },{\n        title: 'Tab 2',\n        html: 'Another one'\n    }]\n});\n</code></pre>\n * <p><b><u>Creating TabPanels from Existing Markup</u></b></p>\n * <p>TabPanels can also be rendered from pre-existing markup in a couple of ways.</p>\n * <div><ul class=\"mdetail-params\">\n *\n * <li>Pre-Structured Markup</li>\n * <div class=\"sub-desc\">\n * <p>A container div with one or more nested tab divs with class <tt>'x-tab'</tt> can be rendered entirely\n * from existing markup (See the {@link #autoTabs} example).</p>\n * </div>\n *\n * <li>Un-Structured Markup</li>\n * <div class=\"sub-desc\">\n * <p>A TabPanel can also be rendered from markup that is not strictly structured by simply specifying by id\n * which elements should be the container and the tabs. Using this method tab content can be pulled from different\n * elements within the page by id regardless of page structure. For example:</p>\n * <pre><code>\nvar tabs = new Ext.TabPanel({\n    renderTo: 'my-tabs',\n    activeTab: 0,\n    items:[\n        {contentEl:'tab1', title:'Tab 1'},\n        {contentEl:'tab2', title:'Tab 2'}\n    ]\n});\n\n// Note that the tabs do not have to be nested within the container (although they can be)\n&lt;div id=\"my-tabs\">&lt;/div>\n&lt;div id=\"tab1\" class=\"x-hide-display\">A simple tab&lt;/div>\n&lt;div id=\"tab2\" class=\"x-hide-display\">Another one&lt;/div>\n</code></pre>\n * Note that the tab divs in this example contain the class <tt>'x-hide-display'</tt> so that they can be rendered\n * deferred without displaying outside the tabs. You could alternately set <tt>{@link #deferredRender} = false </tt>\n * to render all content tabs on page load.\n * </div>\n *\n * </ul></div>\n *\n * @extends Ext.Panel\n * @constructor\n * @param {Object} config The configuration options\n * @xtype tabpanel\n */\nExt.TabPanel = Ext.extend(Ext.Panel,  {\n    /**\n     * @cfg {Boolean} layoutOnTabChange\n     * Set to true to force a layout of the active tab when the tab is changed. Defaults to false.\n     * See {@link Ext.layout.CardLayout}.<code>{@link Ext.layout.CardLayout#layoutOnCardChange layoutOnCardChange}</code>.\n     */\n    /**\n     * @cfg {String} tabCls <b>This config option is used on <u>child Components</u> of ths TabPanel.</b> A CSS\n     * class name applied to the tab strip item representing the child Component, allowing special\n     * styling to be applied.\n     */\n    /**\n     * @cfg {Boolean} deferredRender\n     * <p><tt>true</tt> by default to defer the rendering of child <tt>{@link Ext.Container#items items}</tt>\n     * to the browsers DOM until a tab is activated. <tt>false</tt> will render all contained\n     * <tt>{@link Ext.Container#items items}</tt> as soon as the {@link Ext.layout.CardLayout layout}\n     * is rendered. If there is a significant amount of content or a lot of heavy controls being\n     * rendered into panels that are not displayed by default, setting this to <tt>true</tt> might\n     * improve performance.</p>\n     * <br><p>The <tt>deferredRender</tt> property is internally passed to the layout manager for\n     * TabPanels ({@link Ext.layout.CardLayout}) as its {@link Ext.layout.CardLayout#deferredRender}\n     * configuration value.</p>\n     * <br><p><b>Note</b>: leaving <tt>deferredRender</tt> as <tt>true</tt> means that the content\n     * within an unactivated tab will not be available. For example, this means that if the TabPanel\n     * is within a {@link Ext.form.FormPanel form}, then until a tab is activated, any Fields within\n     * unactivated tabs will not be rendered, and will therefore not be submitted and will not be\n     * available to either {@link Ext.form.BasicForm#getValues getValues} or\n     * {@link Ext.form.BasicForm#setValues setValues}.</p>\n     */\n    deferredRender : true,\n    /**\n     * @cfg {Number} tabWidth The initial width in pixels of each new tab (defaults to 120).\n     */\n    tabWidth : 120,\n    /**\n     * @cfg {Number} minTabWidth The minimum width in pixels for each tab when {@link #resizeTabs} = true (defaults to 30).\n     */\n    minTabWidth : 30,\n    /**\n     * @cfg {Boolean} resizeTabs True to automatically resize each tab so that the tabs will completely fill the\n     * tab strip (defaults to false).  Setting this to true may cause specific widths that might be set per tab to\n     * be overridden in order to fit them all into view (although {@link #minTabWidth} will always be honored).\n     */\n    resizeTabs : false,\n    /**\n     * @cfg {Boolean} enableTabScroll True to enable scrolling to tabs that may be invisible due to overflowing the\n     * overall TabPanel width. Only available with tabPosition:'top' (defaults to false).\n     */\n    enableTabScroll : false,\n    /**\n     * @cfg {Number} scrollIncrement The number of pixels to scroll each time a tab scroll button is pressed\n     * (defaults to <tt>100</tt>, or if <tt>{@link #resizeTabs} = true</tt>, the calculated tab width).  Only\n     * applies when <tt>{@link #enableTabScroll} = true</tt>.\n     */\n    scrollIncrement : 0,\n    /**\n     * @cfg {Number} scrollRepeatInterval Number of milliseconds between each scroll while a tab scroll button is\n     * continuously pressed (defaults to <tt>400</tt>).\n     */\n    scrollRepeatInterval : 400,\n    /**\n     * @cfg {Float} scrollDuration The number of milliseconds that each scroll animation should last (defaults\n     * to <tt>.35</tt>). Only applies when <tt>{@link #animScroll} = true</tt>.\n     */\n    scrollDuration : 0.35,\n    /**\n     * @cfg {Boolean} animScroll True to animate tab scrolling so that hidden tabs slide smoothly into view (defaults\n     * to <tt>true</tt>).  Only applies when <tt>{@link #enableTabScroll} = true</tt>.\n     */\n    animScroll : true,\n    /**\n     * @cfg {String} tabPosition The position where the tab strip should be rendered (defaults to <tt>'top'</tt>).\n     * The only other supported value is <tt>'bottom'</tt>.  <b>Note</b>: tab scrolling is only supported for\n     * <tt>tabPosition: 'top'</tt>.\n     */\n    tabPosition : 'top',\n    /**\n     * @cfg {String} baseCls The base CSS class applied to the panel (defaults to <tt>'x-tab-panel'</tt>).\n     */\n    baseCls : 'x-tab-panel',\n    /**\n     * @cfg {Boolean} autoTabs\n     * <p><tt>true</tt> to query the DOM for any divs with a class of 'x-tab' to be automatically converted\n     * to tabs and added to this panel (defaults to <tt>false</tt>).  Note that the query will be executed within\n     * the scope of the container element only (so that multiple tab panels from markup can be supported via this\n     * method).</p>\n     * <p>This method is only possible when the markup is structured correctly as a container with nested divs\n     * containing the class <tt>'x-tab'</tt>. To create TabPanels without these limitations, or to pull tab content\n     * from other elements on the page, see the example at the top of the class for generating tabs from markup.</p>\n     * <p>There are a couple of things to note when using this method:<ul>\n     * <li>When using the <tt>autoTabs</tt> config (as opposed to passing individual tab configs in the TabPanel's\n     * {@link #items} collection), you must use <tt>{@link #applyTo}</tt> to correctly use the specified <tt>id</tt>\n     * as the tab container. The <tt>autoTabs</tt> method <em>replaces</em> existing content with the TabPanel\n     * components.</li>\n     * <li>Make sure that you set <tt>{@link #deferredRender}: false</tt> so that the content elements for each\n     * tab will be rendered into the TabPanel immediately upon page load, otherwise they will not be transformed\n     * until each tab is activated and will be visible outside the TabPanel.</li>\n     * </ul>Example usage:</p>\n     * <pre><code>\nvar tabs = new Ext.TabPanel({\n    applyTo: 'my-tabs',\n    activeTab: 0,\n    deferredRender: false,\n    autoTabs: true\n});\n\n// This markup will be converted to a TabPanel from the code above\n&lt;div id=\"my-tabs\">\n    &lt;div class=\"x-tab\" title=\"Tab 1\">A simple tab&lt;/div>\n    &lt;div class=\"x-tab\" title=\"Tab 2\">Another one&lt;/div>\n&lt;/div>\n</code></pre>\n     */\n    autoTabs : false,\n    /**\n     * @cfg {String} autoTabSelector The CSS selector used to search for tabs in existing markup when\n     * <tt>{@link #autoTabs} = true</tt> (defaults to <tt>'div.x-tab'</tt>).  This can be any valid selector\n     * supported by {@link Ext.DomQuery#select}. Note that the query will be executed within the scope of this\n     * tab panel only (so that multiple tab panels from markup can be supported on a page).\n     */\n    autoTabSelector : 'div.x-tab',\n    /**\n     * @cfg {String/Number} activeTab A string id or the numeric index of the tab that should be initially\n     * activated on render (defaults to undefined).\n     */\n    activeTab : undefined,\n    /**\n     * @cfg {Number} tabMargin The number of pixels of space to calculate into the sizing and scrolling of\n     * tabs. If you change the margin in CSS, you will need to update this value so calculations are correct\n     * with either <tt>{@link #resizeTabs}</tt> or scrolling tabs. (defaults to <tt>2</tt>)\n     */\n    tabMargin : 2,\n    /**\n     * @cfg {Boolean} plain </tt>true</tt> to render the tab strip without a background container image\n     * (defaults to <tt>false</tt>).\n     */\n    plain : false,\n    /**\n     * @cfg {Number} wheelIncrement For scrolling tabs, the number of pixels to increment on mouse wheel\n     * scrolling (defaults to <tt>20</tt>).\n     */\n    wheelIncrement : 20,\n\n    /*\n     * This is a protected property used when concatenating tab ids to the TabPanel id for internal uniqueness.\n     * It does not generally need to be changed, but can be if external code also uses an id scheme that can\n     * potentially clash with this one.\n     */\n    idDelimiter : '__',\n\n    // private\n    itemCls : 'x-tab-item',\n\n    // private config overrides\n    elements : 'body',\n    headerAsText : false,\n    frame : false,\n    hideBorders :true,\n\n    // private\n    initComponent : function(){\n        this.frame = false;\n        Ext.TabPanel.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event beforetabchange\n             * Fires before the active tab changes. Handlers can <tt>return false</tt> to cancel the tab change.\n             * @param {TabPanel} this\n             * @param {Panel} newTab The tab being activated\n             * @param {Panel} currentTab The current active tab\n             */\n            'beforetabchange',\n            /**\n             * @event tabchange\n             * Fires after the active tab has changed.\n             * @param {TabPanel} this\n             * @param {Panel} tab The new active tab\n             */\n            'tabchange',\n            /**\n             * @event contextmenu\n             * Relays the contextmenu event from a tab selector element in the tab strip.\n             * @param {TabPanel} this\n             * @param {Panel} tab The target tab\n             * @param {EventObject} e\n             */\n            'contextmenu'\n        );\n        /**\n         * @cfg {Object} layoutConfig\n         * TabPanel implicitly uses {@link Ext.layout.CardLayout} as its layout manager.\n         * <code>layoutConfig</code> may be used to configure this layout manager.\n         * <code>{@link #deferredRender}</code> and <code>{@link #layoutOnTabChange}</code>\n         * configured on the TabPanel will be applied as configs to the layout manager.\n         */\n        this.setLayout(new Ext.layout.CardLayout(Ext.apply({\n            layoutOnCardChange: this.layoutOnTabChange,\n            deferredRender: this.deferredRender\n        }, this.layoutConfig)));\n\n        if(this.tabPosition == 'top'){\n            this.elements += ',header';\n            this.stripTarget = 'header';\n        }else {\n            this.elements += ',footer';\n            this.stripTarget = 'footer';\n        }\n        if(!this.stack){\n            this.stack = Ext.TabPanel.AccessStack();\n        }\n        this.initItems();\n    },\n\n    // private\n    onRender : function(ct, position){\n        Ext.TabPanel.superclass.onRender.call(this, ct, position);\n\n        if(this.plain){\n            var pos = this.tabPosition == 'top' ? 'header' : 'footer';\n            this[pos].addClass('x-tab-panel-'+pos+'-plain');\n        }\n\n        var st = this[this.stripTarget];\n\n        this.stripWrap = st.createChild({cls:'x-tab-strip-wrap', cn:{\n            tag:'ul', cls:'x-tab-strip x-tab-strip-'+this.tabPosition}});\n\n        var beforeEl = (this.tabPosition=='bottom' ? this.stripWrap : null);\n        st.createChild({cls:'x-tab-strip-spacer'}, beforeEl);\n        this.strip = new Ext.Element(this.stripWrap.dom.firstChild);\n\n        // create an empty span with class x-tab-strip-text to force the height of the header element when there's no tabs.\n        this.edge = this.strip.createChild({tag:'li', cls:'x-tab-edge', cn: [{tag: 'span', cls: 'x-tab-strip-text', cn: '&#160;'}]});\n        this.strip.createChild({cls:'x-clear'});\n\n        this.body.addClass('x-tab-panel-body-'+this.tabPosition);\n\n        /**\n         * @cfg {Template/XTemplate} itemTpl <p>(Optional) A {@link Ext.Template Template} or\n         * {@link Ext.XTemplate XTemplate} which may be provided to process the data object returned from\n         * <tt>{@link #getTemplateArgs}</tt> to produce a clickable selector element in the tab strip.</p>\n         * <p>The main element created should be a <tt>&lt;li></tt> element. In order for a click event on\n         * a selector element to be connected to its item, it must take its <i>id</i> from the TabPanel's\n         * native <tt>{@link #getTemplateArgs}</tt>.</p>\n         * <p>The child element which contains the title text must be marked by the CSS class\n         * <tt>x-tab-strip-inner</tt>.</p>\n         * <p>To enable closability, the created element should contain an element marked by the CSS class\n         * <tt>x-tab-strip-close</tt>.</p>\n         * <p>If a custom <tt>itemTpl</tt> is supplied, it is the developer's responsibility to create CSS\n         * style rules to create the desired appearance.</p>\n         * Below is an example of how to create customized tab selector items:<pre><code>\nnew Ext.TabPanel({\n    renderTo: document.body,\n    minTabWidth: 115,\n    tabWidth: 135,\n    enableTabScroll: true,\n    width: 600,\n    height: 250,\n    defaults: {autoScroll:true},\n    itemTpl: new Ext.XTemplate(\n    '&lt;li class=\"{cls}\" id=\"{id}\" style=\"overflow:hidden\">',\n         '&lt;tpl if=\"closable\">',\n            '&lt;a class=\"x-tab-strip-close\">&lt;/a>',\n         '&lt;/tpl>',\n         '&lt;a class=\"x-tab-right\" href=\"#\" style=\"padding-left:6px\">',\n            '&lt;em class=\"x-tab-left\">',\n                '&lt;span class=\"x-tab-strip-inner\">',\n                    '&lt;img src=\"{src}\" style=\"float:left;margin:3px 3px 0 0\">',\n                    '&lt;span style=\"margin-left:20px\" class=\"x-tab-strip-text {iconCls}\">{text} {extra}&lt;/span>',\n                '&lt;/span>',\n            '&lt;/em>',\n        '&lt;/a>',\n    '&lt;/li>'\n    ),\n    getTemplateArgs: function(item) {\n//      Call the native method to collect the base data. Like the ID!\n        var result = Ext.TabPanel.prototype.getTemplateArgs.call(this, item);\n\n//      Add stuff used in our template\n        return Ext.apply(result, {\n            closable: item.closable,\n            src: item.iconSrc,\n            extra: item.extraText || ''\n        });\n    },\n    items: [{\n        title: 'New Tab 1',\n        iconSrc: '../shared/icons/fam/grid.png',\n        html: 'Tab Body 1',\n        closable: true\n    }, {\n        title: 'New Tab 2',\n        iconSrc: '../shared/icons/fam/grid.png',\n        html: 'Tab Body 2',\n        extraText: 'Extra stuff in the tab button'\n    }]\n});\n</code></pre>\n         */\n        if(!this.itemTpl){\n            var tt = new Ext.Template(\n                 '<li class=\"{cls}\" id=\"{id}\"><a class=\"x-tab-strip-close\"></a>',\n                 '<a class=\"x-tab-right\" href=\"#\"><em class=\"x-tab-left\">',\n                 '<span class=\"x-tab-strip-inner\"><span class=\"x-tab-strip-text {iconCls}\">{text}</span></span>',\n                 '</em></a></li>'\n            );\n            tt.disableFormats = true;\n            tt.compile();\n            Ext.TabPanel.prototype.itemTpl = tt;\n        }\n\n        this.items.each(this.initTab, this);\n    },\n\n    // private\n    afterRender : function(){\n        Ext.TabPanel.superclass.afterRender.call(this);\n        if(this.autoTabs){\n            this.readTabs(false);\n        }\n        if(this.activeTab !== undefined){\n            var item = Ext.isObject(this.activeTab) ? this.activeTab : this.items.get(this.activeTab);\n            delete this.activeTab;\n            this.setActiveTab(item);\n        }\n    },\n\n    // private\n    initEvents : function(){\n        Ext.TabPanel.superclass.initEvents.call(this);\n        this.mon(this.strip, {\n            scope: this,\n            mousedown: this.onStripMouseDown,\n            contextmenu: this.onStripContextMenu\n        });\n        if(this.enableTabScroll){\n            this.mon(this.strip, 'mousewheel', this.onWheel, this);\n        }\n    },\n\n    // private\n    findTargets : function(e){\n        var item = null,\n            itemEl = e.getTarget('li:not(.x-tab-edge)', this.strip);\n\n        if(itemEl){\n            item = this.getComponent(itemEl.id.split(this.idDelimiter)[1]);\n            if(item.disabled){\n                return {\n                    close : null,\n                    item : null,\n                    el : null\n                };\n            }\n        }\n        return {\n            close : e.getTarget('.x-tab-strip-close', this.strip),\n            item : item,\n            el : itemEl\n        };\n    },\n\n    // private\n    onStripMouseDown : function(e){\n        if(e.button !== 0){\n            return;\n        }\n        e.preventDefault();\n        var t = this.findTargets(e);\n        if(t.close){\n            if (t.item.fireEvent('beforeclose', t.item) !== false) {\n                t.item.fireEvent('close', t.item);\n                this.remove(t.item);\n            }\n            return;\n        }\n        if(t.item && t.item != this.activeTab){\n            this.setActiveTab(t.item);\n        }\n    },\n\n    // private\n    onStripContextMenu : function(e){\n        e.preventDefault();\n        var t = this.findTargets(e);\n        if(t.item){\n            this.fireEvent('contextmenu', this, t.item, e);\n        }\n    },\n\n    /**\n     * True to scan the markup in this tab panel for <tt>{@link #autoTabs}</tt> using the\n     * <tt>{@link #autoTabSelector}</tt>\n     * @param {Boolean} removeExisting True to remove existing tabs\n     */\n    readTabs : function(removeExisting){\n        if(removeExisting === true){\n            this.items.each(function(item){\n                this.remove(item);\n            }, this);\n        }\n        var tabs = this.el.query(this.autoTabSelector);\n        for(var i = 0, len = tabs.length; i < len; i++){\n            var tab = tabs[i],\n                title = tab.getAttribute('title');\n            tab.removeAttribute('title');\n            this.add({\n                title: title,\n                contentEl: tab\n            });\n        }\n    },\n\n    // private\n    initTab : function(item, index){\n        var before = this.strip.dom.childNodes[index],\n            p = this.getTemplateArgs(item),\n            el = before ?\n                 this.itemTpl.insertBefore(before, p) :\n                 this.itemTpl.append(this.strip, p),\n            cls = 'x-tab-strip-over',\n            tabEl = Ext.get(el);\n\n        tabEl.hover(function(){\n            if(!item.disabled){\n                tabEl.addClass(cls);\n            }\n        }, function(){\n            tabEl.removeClass(cls);\n        });\n\n        if(item.tabTip){\n            tabEl.child('span.x-tab-strip-text', true).qtip = item.tabTip;\n        }\n        item.tabEl = el;\n\n        // Route *keyboard triggered* click events to the tab strip mouse handler.\n        tabEl.select('a').on('click', function(e){\n            if(!e.getPageX()){\n                this.onStripMouseDown(e);\n            }\n        }, this, {preventDefault: true});\n\n        item.on({\n            scope: this,\n            disable: this.onItemDisabled,\n            enable: this.onItemEnabled,\n            titlechange: this.onItemTitleChanged,\n            iconchange: this.onItemIconChanged,\n            beforeshow: this.onBeforeShowItem\n        });\n    },\n\n\n\n    /**\n     * <p>Provides template arguments for rendering a tab selector item in the tab strip.</p>\n     * <p>This method returns an object hash containing properties used by the TabPanel's <tt>{@link #itemTpl}</tt>\n     * to create a formatted, clickable tab selector element. The properties which must be returned\n     * are:</p><div class=\"mdetail-params\"><ul>\n     * <li><b>id</b> : String<div class=\"sub-desc\">A unique identifier which links to the item</div></li>\n     * <li><b>text</b> : String<div class=\"sub-desc\">The text to display</div></li>\n     * <li><b>cls</b> : String<div class=\"sub-desc\">The CSS class name</div></li>\n     * <li><b>iconCls</b> : String<div class=\"sub-desc\">A CSS class to provide appearance for an icon.</div></li>\n     * </ul></div>\n     * @param {Ext.BoxComponent} item The {@link Ext.BoxComponent BoxComponent} for which to create a selector element in the tab strip.\n     * @return {Object} An object hash containing the properties required to render the selector element.\n     */\n    getTemplateArgs : function(item) {\n        var cls = item.closable ? 'x-tab-strip-closable' : '';\n        if(item.disabled){\n            cls += ' x-item-disabled';\n        }\n        if(item.iconCls){\n            cls += ' x-tab-with-icon';\n        }\n        if(item.tabCls){\n            cls += ' ' + item.tabCls;\n        }\n\n        return {\n            id: this.id + this.idDelimiter + item.getItemId(),\n            text: item.title,\n            cls: cls,\n            iconCls: item.iconCls || ''\n        };\n    },\n\n    // private\n    onAdd : function(c){\n        Ext.TabPanel.superclass.onAdd.call(this, c);\n        if(this.rendered){\n            var items = this.items;\n            this.initTab(c, items.indexOf(c));\n            this.delegateUpdates();\n        }\n    },\n\n    // private\n    onBeforeAdd : function(item){\n        var existing = item.events ? (this.items.containsKey(item.getItemId()) ? item : null) : this.items.get(item);\n        if(existing){\n            this.setActiveTab(item);\n            return false;\n        }\n        Ext.TabPanel.superclass.onBeforeAdd.apply(this, arguments);\n        var es = item.elements;\n        item.elements = es ? es.replace(',header', '') : es;\n        item.border = (item.border === true);\n    },\n\n    // private\n    onRemove : function(c){\n        var te = Ext.get(c.tabEl);\n        // check if the tabEl exists, it won't if the tab isn't rendered\n        if(te){\n            te.select('a').removeAllListeners();\n            Ext.destroy(te);\n        }\n        Ext.TabPanel.superclass.onRemove.call(this, c);\n        this.stack.remove(c);\n        delete c.tabEl;\n        c.un('disable', this.onItemDisabled, this);\n        c.un('enable', this.onItemEnabled, this);\n        c.un('titlechange', this.onItemTitleChanged, this);\n        c.un('iconchange', this.onItemIconChanged, this);\n        c.un('beforeshow', this.onBeforeShowItem, this);\n        if(c == this.activeTab){\n            var next = this.stack.next();\n            if(next){\n                this.setActiveTab(next);\n            }else if(this.items.getCount() > 0){\n                this.setActiveTab(0);\n            }else{\n                this.setActiveTab(null);\n            }\n        }\n        if(!this.destroying){\n            this.delegateUpdates();\n        }\n    },\n\n    // private\n    onBeforeShowItem : function(item){\n        if(item != this.activeTab){\n            this.setActiveTab(item);\n            return false;\n        }\n    },\n\n    // private\n    onItemDisabled : function(item){\n        var el = this.getTabEl(item);\n        if(el){\n            Ext.fly(el).addClass('x-item-disabled');\n        }\n        this.stack.remove(item);\n    },\n\n    // private\n    onItemEnabled : function(item){\n        var el = this.getTabEl(item);\n        if(el){\n            Ext.fly(el).removeClass('x-item-disabled');\n        }\n    },\n\n    // private\n    onItemTitleChanged : function(item){\n        var el = this.getTabEl(item);\n        if(el){\n            Ext.fly(el).child('span.x-tab-strip-text', true).innerHTML = item.title;\n            this.delegateUpdates();\n        }\n    },\n\n    //private\n    onItemIconChanged : function(item, iconCls, oldCls){\n        var el = this.getTabEl(item);\n        if(el){\n            el = Ext.get(el);\n            el.child('span.x-tab-strip-text').replaceClass(oldCls, iconCls);\n            el[Ext.isEmpty(iconCls) ? 'removeClass' : 'addClass']('x-tab-with-icon');\n            this.delegateUpdates();\n        }\n    },\n\n    /**\n     * Gets the DOM element for the tab strip item which activates the child panel with the specified\n     * ID. Access this to change the visual treatment of the item, for example by changing the CSS class name.\n     * @param {Panel/Number/String} tab The tab component, or the tab's index, or the tabs id or itemId.\n     * @return {HTMLElement} The DOM node\n     */\n    getTabEl : function(item){\n        var c = this.getComponent(item);\n        return c ? c.tabEl : null;\n    },\n\n    // private\n    onResize : function(){\n        Ext.TabPanel.superclass.onResize.apply(this, arguments);\n        this.delegateUpdates();\n    },\n\n    /**\n     * Suspends any internal calculations or scrolling while doing a bulk operation. See {@link #endUpdate}\n     */\n    beginUpdate : function(){\n        this.suspendUpdates = true;\n    },\n\n    /**\n     * Resumes calculations and scrolling at the end of a bulk operation. See {@link #beginUpdate}\n     */\n    endUpdate : function(){\n        this.suspendUpdates = false;\n        this.delegateUpdates();\n    },\n\n    /**\n     * Hides the tab strip item for the passed tab\n     * @param {Number/String/Panel} item The tab index, id or item\n     */\n    hideTabStripItem : function(item){\n        item = this.getComponent(item);\n        var el = this.getTabEl(item);\n        if(el){\n            el.style.display = 'none';\n            this.delegateUpdates();\n        }\n        this.stack.remove(item);\n    },\n\n    /**\n     * Unhides the tab strip item for the passed tab\n     * @param {Number/String/Panel} item The tab index, id or item\n     */\n    unhideTabStripItem : function(item){\n        item = this.getComponent(item);\n        var el = this.getTabEl(item);\n        if(el){\n            el.style.display = '';\n            this.delegateUpdates();\n        }\n    },\n\n    // private\n    delegateUpdates : function(){\n        var rendered = this.rendered;\n        if(this.suspendUpdates){\n            return;\n        }\n        if(this.resizeTabs && rendered){\n            this.autoSizeTabs();\n        }\n        if(this.enableTabScroll && rendered){\n            this.autoScrollTabs();\n        }\n    },\n\n    // private\n    autoSizeTabs : function(){\n        var count = this.items.length,\n            ce = this.tabPosition != 'bottom' ? 'header' : 'footer',\n            ow = this[ce].dom.offsetWidth,\n            aw = this[ce].dom.clientWidth;\n\n        if(!this.resizeTabs || count < 1 || !aw){ // !aw for display:none\n            return;\n        }\n\n        var each = Math.max(Math.min(Math.floor((aw-4) / count) - this.tabMargin, this.tabWidth), this.minTabWidth); // -4 for float errors in IE\n        this.lastTabWidth = each;\n        var lis = this.strip.query('li:not(.x-tab-edge)');\n        for(var i = 0, len = lis.length; i < len; i++) {\n            var li = lis[i],\n                inner = Ext.fly(li).child('.x-tab-strip-inner', true),\n                tw = li.offsetWidth,\n                iw = inner.offsetWidth;\n            inner.style.width = (each - (tw-iw)) + 'px';\n        }\n    },\n\n    // private\n    adjustBodyWidth : function(w){\n        if(this.header){\n            this.header.setWidth(w);\n        }\n        if(this.footer){\n            this.footer.setWidth(w);\n        }\n        return w;\n    },\n\n    /**\n     * Sets the specified tab as the active tab. This method fires the {@link #beforetabchange} event which\n     * can <tt>return false</tt> to cancel the tab change.\n     * @param {String/Number} item\n     * The id or tab Panel to activate. This parameter may be any of the following:\n     * <div><ul class=\"mdetail-params\">\n     * <li>a <b><tt>String</tt></b> : representing the <code>{@link Ext.Component#itemId itemId}</code>\n     * or <code>{@link Ext.Component#id id}</code> of the child component </li>\n     * <li>a <b><tt>Number</tt></b> : representing the position of the child component\n     * within the <code>{@link Ext.Container#items items}</code> <b>property</b></li>\n     * </ul></div>\n     * <p>For additional information see {@link Ext.util.MixedCollection#get}.\n     */\n    setActiveTab : function(item){\n        item = this.getComponent(item);\n        if(this.fireEvent('beforetabchange', this, item, this.activeTab) === false){\n            return;\n        }\n        if(!this.rendered){\n            this.activeTab = item;\n            return;\n        }\n        if(this.activeTab != item){\n            if(this.activeTab){\n                var oldEl = this.getTabEl(this.activeTab);\n                if(oldEl){\n                    Ext.fly(oldEl).removeClass('x-tab-strip-active');\n                }\n            }\n            this.activeTab = item;\n            if(item){\n                var el = this.getTabEl(item);\n                Ext.fly(el).addClass('x-tab-strip-active');\n                this.stack.add(item);\n\n                this.layout.setActiveItem(item);\n                // Need to do this here, since setting the active tab slightly changes the size\n                this.delegateUpdates();\n                if(this.scrolling){\n                    this.scrollToTab(item, this.animScroll);\n                }\n            }\n            this.fireEvent('tabchange', this, item);\n        }\n    },\n\n    /**\n     * Returns the Component which is the currently active tab. <b>Note that before the TabPanel\n     * first activates a child Component, this method will return whatever was configured in the\n     * {@link #activeTab} config option.</b>\n     * @return {BoxComponent} The currently active child Component if one <i>is</i> active, or the {@link #activeTab} config value.\n     */\n    getActiveTab : function(){\n        return this.activeTab || null;\n    },\n\n    /**\n     * Gets the specified tab by id.\n     * @param {String} id The tab id\n     * @return {Panel} The tab\n     */\n    getItem : function(item){\n        return this.getComponent(item);\n    },\n\n    // private\n    autoScrollTabs : function(){\n        this.pos = this.tabPosition=='bottom' ? this.footer : this.header;\n        var count = this.items.length,\n            ow = this.pos.dom.offsetWidth,\n            tw = this.pos.dom.clientWidth,\n            wrap = this.stripWrap,\n            wd = wrap.dom,\n            cw = wd.offsetWidth,\n            pos = this.getScrollPos(),\n            l = this.edge.getOffsetsTo(this.stripWrap)[0] + pos;\n\n        if(!this.enableTabScroll || cw < 20){ // 20 to prevent display:none issues\n            return;\n        }\n        if(count == 0 || l <= tw){\n            // ensure the width is set if there's no tabs\n            wd.scrollLeft = 0;\n            wrap.setWidth(tw);\n            if(this.scrolling){\n                this.scrolling = false;\n                this.pos.removeClass('x-tab-scrolling');\n                this.scrollLeft.hide();\n                this.scrollRight.hide();\n                // See here: http://extjs.com/forum/showthread.php?t=49308&highlight=isSafari\n                if(Ext.isAir || Ext.isWebKit){\n                    wd.style.marginLeft = '';\n                    wd.style.marginRight = '';\n                }\n            }\n        }else{\n            if(!this.scrolling){\n                this.pos.addClass('x-tab-scrolling');\n                // See here: http://extjs.com/forum/showthread.php?t=49308&highlight=isSafari\n                if(Ext.isAir || Ext.isWebKit){\n                    wd.style.marginLeft = '18px';\n                    wd.style.marginRight = '18px';\n                }\n            }\n            tw -= wrap.getMargins('lr');\n            wrap.setWidth(tw > 20 ? tw : 20);\n            if(!this.scrolling){\n                if(!this.scrollLeft){\n                    this.createScrollers();\n                }else{\n                    this.scrollLeft.show();\n                    this.scrollRight.show();\n                }\n            }\n            this.scrolling = true;\n            if(pos > (l-tw)){ // ensure it stays within bounds\n                wd.scrollLeft = l-tw;\n            }else{ // otherwise, make sure the active tab is still visible\n                this.scrollToTab(this.activeTab, false);\n            }\n            this.updateScrollButtons();\n        }\n    },\n\n    // private\n    createScrollers : function(){\n        this.pos.addClass('x-tab-scrolling-' + this.tabPosition);\n        var h = this.stripWrap.dom.offsetHeight;\n\n        // left\n        var sl = this.pos.insertFirst({\n            cls:'x-tab-scroller-left'\n        });\n        sl.setHeight(h);\n        sl.addClassOnOver('x-tab-scroller-left-over');\n        this.leftRepeater = new Ext.util.ClickRepeater(sl, {\n            interval : this.scrollRepeatInterval,\n            handler: this.onScrollLeft,\n            scope: this\n        });\n        this.scrollLeft = sl;\n\n        // right\n        var sr = this.pos.insertFirst({\n            cls:'x-tab-scroller-right'\n        });\n        sr.setHeight(h);\n        sr.addClassOnOver('x-tab-scroller-right-over');\n        this.rightRepeater = new Ext.util.ClickRepeater(sr, {\n            interval : this.scrollRepeatInterval,\n            handler: this.onScrollRight,\n            scope: this\n        });\n        this.scrollRight = sr;\n    },\n\n    // private\n    getScrollWidth : function(){\n        return this.edge.getOffsetsTo(this.stripWrap)[0] + this.getScrollPos();\n    },\n\n    // private\n    getScrollPos : function(){\n        return parseInt(this.stripWrap.dom.scrollLeft, 10) || 0;\n    },\n\n    // private\n    getScrollArea : function(){\n        return parseInt(this.stripWrap.dom.clientWidth, 10) || 0;\n    },\n\n    // private\n    getScrollAnim : function(){\n        return {duration:this.scrollDuration, callback: this.updateScrollButtons, scope: this};\n    },\n\n    // private\n    getScrollIncrement : function(){\n        return this.scrollIncrement || (this.resizeTabs ? this.lastTabWidth+2 : 100);\n    },\n\n    /**\n     * Scrolls to a particular tab if tab scrolling is enabled\n     * @param {Panel} item The item to scroll to\n     * @param {Boolean} animate True to enable animations\n     */\n\n    scrollToTab : function(item, animate){\n        if(!item){\n            return;\n        }\n        var el = this.getTabEl(item),\n            pos = this.getScrollPos(),\n            area = this.getScrollArea(),\n            left = Ext.fly(el).getOffsetsTo(this.stripWrap)[0] + pos,\n            right = left + el.offsetWidth;\n        if(left < pos){\n            this.scrollTo(left, animate);\n        }else if(right > (pos + area)){\n            this.scrollTo(right - area, animate);\n        }\n    },\n\n    // private\n    scrollTo : function(pos, animate){\n        this.stripWrap.scrollTo('left', pos, animate ? this.getScrollAnim() : false);\n        if(!animate){\n            this.updateScrollButtons();\n        }\n    },\n\n    onWheel : function(e){\n        var d = e.getWheelDelta()*this.wheelIncrement*-1;\n        e.stopEvent();\n\n        var pos = this.getScrollPos(),\n            newpos = pos + d,\n            sw = this.getScrollWidth()-this.getScrollArea();\n\n        var s = Math.max(0, Math.min(sw, newpos));\n        if(s != pos){\n            this.scrollTo(s, false);\n        }\n    },\n\n    // private\n    onScrollRight : function(){\n        var sw = this.getScrollWidth()-this.getScrollArea(),\n            pos = this.getScrollPos(),\n            s = Math.min(sw, pos + this.getScrollIncrement());\n        if(s != pos){\n            this.scrollTo(s, this.animScroll);\n        }\n    },\n\n    // private\n    onScrollLeft : function(){\n        var pos = this.getScrollPos(),\n            s = Math.max(0, pos - this.getScrollIncrement());\n        if(s != pos){\n            this.scrollTo(s, this.animScroll);\n        }\n    },\n\n    // private\n    updateScrollButtons : function(){\n        var pos = this.getScrollPos();\n        this.scrollLeft[pos === 0 ? 'addClass' : 'removeClass']('x-tab-scroller-left-disabled');\n        this.scrollRight[pos >= (this.getScrollWidth()-this.getScrollArea()) ? 'addClass' : 'removeClass']('x-tab-scroller-right-disabled');\n    },\n\n    // private\n    beforeDestroy : function() {\n        Ext.destroy(this.leftRepeater, this.rightRepeater);\n        this.deleteMembers('strip', 'edge', 'scrollLeft', 'scrollRight', 'stripWrap');\n        this.activeTab = null;\n        Ext.TabPanel.superclass.beforeDestroy.apply(this);\n    }\n\n    /**\n     * @cfg {Boolean} collapsible\n     * @hide\n     */\n    /**\n     * @cfg {String} header\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} headerAsText\n     * @hide\n     */\n    /**\n     * @property header\n     * @hide\n     */\n    /**\n     * @cfg title\n     * @hide\n     */\n    /**\n     * @cfg {Array} tools\n     * @hide\n     */\n    /**\n     * @cfg {Array} toolTemplate\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} hideCollapseTool\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} titleCollapse\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} collapsed\n     * @hide\n     */\n    /**\n     * @cfg {String} layout\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} preventBodyReset\n     * @hide\n     */\n});\nExt.reg('tabpanel', Ext.TabPanel);\n\n/**\n * See {@link #setActiveTab}. Sets the specified tab as the active tab. This method fires\n * the {@link #beforetabchange} event which can <tt>return false</tt> to cancel the tab change.\n * @param {String/Panel} tab The id or tab Panel to activate\n * @method activate\n */\nExt.TabPanel.prototype.activate = Ext.TabPanel.prototype.setActiveTab;\n\n// private utility class used by TabPanel\nExt.TabPanel.AccessStack = function(){\n    var items = [];\n    return {\n        add : function(item){\n            items.push(item);\n            if(items.length > 10){\n                items.shift();\n            }\n        },\n\n        remove : function(item){\n            var s = [];\n            for(var i = 0, len = items.length; i < len; i++) {\n                if(items[i] != item){\n                    s.push(items[i]);\n                }\n            }\n            items = s;\n        },\n\n        next : function(){\n            return items.pop();\n        }\n    };\n};\n/**\n * @class Ext.Button\n * @extends Ext.BoxComponent\n * Simple Button class\n * @cfg {String} text The button text to be used as innerHTML (html tags are accepted)\n * @cfg {String} icon The path to an image to display in the button (the image will be set as the background-image\n * CSS property of the button by default, so if you want a mixed icon/text button, set cls:'x-btn-text-icon')\n * @cfg {Function} handler A function called when the button is clicked (can be used instead of click event).\n * The handler is passed the following parameters:<div class=\"mdetail-params\"><ul>\n * <li><code>b</code> : Button<div class=\"sub-desc\">This Button.</div></li>\n * <li><code>e</code> : EventObject<div class=\"sub-desc\">The click event.</div></li>\n * </ul></div>\n * @cfg {Number} minWidth The minimum width for this button (used to give a set of buttons a common width).\n * See also {@link Ext.Panel}.<tt>{@link Ext.Panel#minButtonWidth minButtonWidth}</tt>.\n * @cfg {String/Object} tooltip The tooltip for the button - can be a string to be used as innerHTML (html tags are accepted) or QuickTips config object\n * @cfg {Boolean} hidden True to start hidden (defaults to false)\n * @cfg {Boolean} disabled True to start disabled (defaults to false)\n * @cfg {Boolean} pressed True to start pressed (only if enableToggle = true)\n * @cfg {String} toggleGroup The group this toggle button is a member of (only 1 per group can be pressed)\n * @cfg {Boolean/Object} repeat True to repeat fire the click event while the mouse is down. This can also be\n * a {@link Ext.util.ClickRepeater ClickRepeater} config object (defaults to false).\n * @constructor\n * Create a new button\n * @param {Object} config The config object\n * @xtype button\n */\nExt.Button = Ext.extend(Ext.BoxComponent, {\n    /**\n     * Read-only. True if this button is hidden\n     * @type Boolean\n     */\n    hidden : false,\n    /**\n     * Read-only. True if this button is disabled\n     * @type Boolean\n     */\n    disabled : false,\n    /**\n     * Read-only. True if this button is pressed (only if enableToggle = true)\n     * @type Boolean\n     */\n    pressed : false,\n\n    /**\n     * @cfg {Number} tabIndex Set a DOM tabIndex for this button (defaults to undefined)\n     */\n\n    /**\n     * @cfg {Boolean} allowDepress\n     * False to not allow a pressed Button to be depressed (defaults to undefined). Only valid when {@link #enableToggle} is true.\n     */\n\n    /**\n     * @cfg {Boolean} enableToggle\n     * True to enable pressed/not pressed toggling (defaults to false)\n     */\n    enableToggle : false,\n    /**\n     * @cfg {Function} toggleHandler\n     * Function called when a Button with {@link #enableToggle} set to true is clicked. Two arguments are passed:<ul class=\"mdetail-params\">\n     * <li><b>button</b> : Ext.Button<div class=\"sub-desc\">this Button object</div></li>\n     * <li><b>state</b> : Boolean<div class=\"sub-desc\">The next state of the Button, true means pressed.</div></li>\n     * </ul>\n     */\n    /**\n     * @cfg {Mixed} menu\n     * Standard menu attribute consisting of a reference to a menu object, a menu id or a menu config blob (defaults to undefined).\n     */\n    /**\n     * @cfg {String} menuAlign\n     * The position to align the menu to (see {@link Ext.Element#alignTo} for more details, defaults to 'tl-bl?').\n     */\n    menuAlign : 'tl-bl?',\n\n    /**\n     * @cfg {String} overflowText If used in a {@link Ext.Toolbar Toolbar}, the\n     * text to be used if this item is shown in the overflow menu. See also\n     * {@link Ext.Toolbar.Item}.<code>{@link Ext.Toolbar.Item#overflowText overflowText}</code>.\n     */\n    /**\n     * @cfg {String} iconCls\n     * A css class which sets a background image to be used as the icon for this button\n     */\n    /**\n     * @cfg {String} type\n     * submit, reset or button - defaults to 'button'\n     */\n    type : 'button',\n\n    // private\n    menuClassTarget : 'tr:nth(2)',\n\n    /**\n     * @cfg {String} clickEvent\n     * The DOM event that will fire the handler of the button. This can be any valid event name (dblclick, contextmenu).\n     * Defaults to <tt>'click'</tt>.\n     */\n    clickEvent : 'click',\n\n    /**\n     * @cfg {Boolean} handleMouseEvents\n     * False to disable visual cues on mouseover, mouseout and mousedown (defaults to true)\n     */\n    handleMouseEvents : true,\n\n    /**\n     * @cfg {String} tooltipType\n     * The type of tooltip to use. Either 'qtip' (default) for QuickTips or 'title' for title attribute.\n     */\n    tooltipType : 'qtip',\n\n    /**\n     * @cfg {String} buttonSelector\n     * <p>(Optional) A {@link Ext.DomQuery DomQuery} selector which is used to extract the active, clickable element from the\n     * DOM structure created.</p>\n     * <p>When a custom {@link #template} is used, you  must ensure that this selector results in the selection of\n     * a focussable element.</p>\n     * <p>Defaults to <b><tt>'button:first-child'</tt></b>.</p>\n     */\n    buttonSelector : 'button:first-child',\n\n    /**\n     * @cfg {String} scale\n     * <p>(Optional) The size of the Button. Three values are allowed:</p>\n     * <ul class=\"mdetail-params\">\n     * <li>'small'<div class=\"sub-desc\">Results in the button element being 16px high.</div></li>\n     * <li>'medium'<div class=\"sub-desc\">Results in the button element being 24px high.</div></li>\n     * <li>'large'<div class=\"sub-desc\">Results in the button element being 32px high.</div></li>\n     * </ul>\n     * <p>Defaults to <b><tt>'small'</tt></b>.</p>\n     */\n    scale : 'small',\n\n    /**\n     * @cfg {Object} scope The scope (<tt><b>this</b></tt> reference) in which the\n     * <code>{@link #handler}</code> and <code>{@link #toggleHandler}</code> is\n     * executed. Defaults to this Button.\n     */\n\n    /**\n     * @cfg {String} iconAlign\n     * <p>(Optional) The side of the Button box to render the icon. Four values are allowed:</p>\n     * <ul class=\"mdetail-params\">\n     * <li>'top'<div class=\"sub-desc\"></div></li>\n     * <li>'right'<div class=\"sub-desc\"></div></li>\n     * <li>'bottom'<div class=\"sub-desc\"></div></li>\n     * <li>'left'<div class=\"sub-desc\"></div></li>\n     * </ul>\n     * <p>Defaults to <b><tt>'left'</tt></b>.</p>\n     */\n    iconAlign : 'left',\n\n    /**\n     * @cfg {String} arrowAlign\n     * <p>(Optional) The side of the Button box to render the arrow if the button has an associated {@link #menu}.\n     * Two values are allowed:</p>\n     * <ul class=\"mdetail-params\">\n     * <li>'right'<div class=\"sub-desc\"></div></li>\n     * <li>'bottom'<div class=\"sub-desc\"></div></li>\n     * </ul>\n     * <p>Defaults to <b><tt>'right'</tt></b>.</p>\n     */\n    arrowAlign : 'right',\n\n    /**\n     * @cfg {Ext.Template} template (Optional)\n     * <p>A {@link Ext.Template Template} used to create the Button's DOM structure.</p>\n     * Instances, or subclasses which need a different DOM structure may provide a different\n     * template layout in conjunction with an implementation of {@link #getTemplateArgs}.\n     * @type Ext.Template\n     * @property template\n     */\n    /**\n     * @cfg {String} cls\n     * A CSS class string to apply to the button's main element.\n     */\n    /**\n     * @property menu\n     * @type Menu\n     * The {@link Ext.menu.Menu Menu} object associated with this Button when configured with the {@link #menu} config option.\n     */\n    /**\n     * @cfg {Boolean} autoWidth\n     * By default, if a width is not specified the button will attempt to stretch horizontally to fit its content.\n     * If the button is being managed by a width sizing layout (hbox, fit, anchor), set this to false to prevent\n     * the button from doing this automatic sizing.\n     * Defaults to <tt>undefined</tt>.\n     */\n\n    initComponent : function(){\n        if(this.menu){\n            // If array of items, turn it into an object config so we\n            // can set the ownerCt property in the config\n            if (Ext.isArray(this.menu)){\n                this.menu = { items: this.menu };\n            }\n            \n            // An object config will work here, but an instance of a menu\n            // will have already setup its ref's and have no effect\n            if (Ext.isObject(this.menu)){\n                this.menu.ownerCt = this;\n            }\n            \n            this.menu = Ext.menu.MenuMgr.get(this.menu);\n            this.menu.ownerCt = undefined;\n        }\n        \n        Ext.Button.superclass.initComponent.call(this);\n\n        this.addEvents(\n            /**\n             * @event click\n             * Fires when this button is clicked\n             * @param {Button} this\n             * @param {EventObject} e The click event\n             */\n            'click',\n            /**\n             * @event toggle\n             * Fires when the 'pressed' state of this button changes (only if enableToggle = true)\n             * @param {Button} this\n             * @param {Boolean} pressed\n             */\n            'toggle',\n            /**\n             * @event mouseover\n             * Fires when the mouse hovers over the button\n             * @param {Button} this\n             * @param {Event} e The event object\n             */\n            'mouseover',\n            /**\n             * @event mouseout\n             * Fires when the mouse exits the button\n             * @param {Button} this\n             * @param {Event} e The event object\n             */\n            'mouseout',\n            /**\n             * @event menushow\n             * If this button has a menu, this event fires when it is shown\n             * @param {Button} this\n             * @param {Menu} menu\n             */\n            'menushow',\n            /**\n             * @event menuhide\n             * If this button has a menu, this event fires when it is hidden\n             * @param {Button} this\n             * @param {Menu} menu\n             */\n            'menuhide',\n            /**\n             * @event menutriggerover\n             * If this button has a menu, this event fires when the mouse enters the menu triggering element\n             * @param {Button} this\n             * @param {Menu} menu\n             * @param {EventObject} e\n             */\n            'menutriggerover',\n            /**\n             * @event menutriggerout\n             * If this button has a menu, this event fires when the mouse leaves the menu triggering element\n             * @param {Button} this\n             * @param {Menu} menu\n             * @param {EventObject} e\n             */\n            'menutriggerout'\n        );\n        \n        if(Ext.isString(this.toggleGroup)){\n            this.enableToggle = true;\n        }\n    },\n\n/**\n  * <p>This method returns an Array which provides substitution parameters for the {@link #template Template} used\n  * to create this Button's DOM structure.</p>\n  * <p>Instances or subclasses which use a different Template to create a different DOM structure may need to provide their\n  * own implementation of this method.</p>\n  * <p>The default implementation which provides data for the default {@link #template} returns an Array containing the\n  * following items:</p><div class=\"mdetail-params\"><ul>\n  * <li>The &lt;button&gt;'s {@link #type}</li>\n  * <li>A CSS class name applied to the Button's main &lt;tbody&gt; element which determines the button's scale and icon alignment.</li>\n  * <li>A CSS class to determine the presence and position of an arrow icon. (<code>'x-btn-arrow'</code> or <code>'x-btn-arrow-bottom'</code> or <code>''</code>)</li>\n  * <li>The {@link #cls} CSS class name applied to the button's wrapping &lt;table&gt; element.</li>\n  * <li>The Component id which is applied to the button's wrapping &lt;table&gt; element.</li>\n  * </ul></div>\n  * @return {Array} Substitution data for a Template.\n */\n    getTemplateArgs : function(){\n        return [this.type, 'x-btn-' + this.scale + ' x-btn-icon-' + this.scale + '-' + this.iconAlign, this.getMenuClass(), this.cls, this.id];\n    },\n\n    // private\n    setButtonClass : function(){\n        if(this.useSetClass){\n            if(!Ext.isEmpty(this.oldCls)){\n                this.el.removeClass([this.oldCls, 'x-btn-pressed']);\n            }\n            this.oldCls = (this.iconCls || this.icon) ? (this.text ? 'x-btn-text-icon' : 'x-btn-icon') : 'x-btn-noicon';\n            this.el.addClass([this.oldCls, this.pressed ? 'x-btn-pressed' : null]);\n        }\n    },\n\n    // protected\n    getMenuClass : function(){\n        return this.menu ? (this.arrowAlign != 'bottom' ? 'x-btn-arrow' : 'x-btn-arrow-bottom') : '';\n    },\n\n    // private\n    onRender : function(ct, position){\n        if(!this.template){\n            if(!Ext.Button.buttonTemplate){\n                // hideous table template\n                Ext.Button.buttonTemplate = new Ext.Template(\n                    '<table id=\"{4}\" cellspacing=\"0\" class=\"x-btn {3}\"><tbody class=\"{1}\">',\n                    '<tr><td class=\"x-btn-tl\"><i>&#160;</i></td><td class=\"x-btn-tc\"></td><td class=\"x-btn-tr\"><i>&#160;</i></td></tr>',\n                    '<tr><td class=\"x-btn-ml\"><i>&#160;</i></td><td class=\"x-btn-mc\"><em class=\"{2} x-unselectable\" unselectable=\"on\"><button type=\"{0}\"></button></em></td><td class=\"x-btn-mr\"><i>&#160;</i></td></tr>',\n                    '<tr><td class=\"x-btn-bl\"><i>&#160;</i></td><td class=\"x-btn-bc\"></td><td class=\"x-btn-br\"><i>&#160;</i></td></tr>',\n                    '</tbody></table>');\n                Ext.Button.buttonTemplate.compile();\n            }\n            this.template = Ext.Button.buttonTemplate;\n        }\n\n        var btn, targs = this.getTemplateArgs();\n\n        if(position){\n            btn = this.template.insertBefore(position, targs, true);\n        }else{\n            btn = this.template.append(ct, targs, true);\n        }\n        /**\n         * An {@link Ext.Element Element} encapsulating the Button's clickable element. By default,\n         * this references a <tt>&lt;button&gt;</tt> element. Read only.\n         * @type Ext.Element\n         * @property btnEl\n         */\n        this.btnEl = btn.child(this.buttonSelector);\n        this.mon(this.btnEl, {\n            scope: this,\n            focus: this.onFocus,\n            blur: this.onBlur\n        });\n\n        this.initButtonEl(btn, this.btnEl);\n\n        Ext.ButtonToggleMgr.register(this);\n    },\n\n    // private\n    initButtonEl : function(btn, btnEl){\n        this.el = btn;\n        this.setIcon(this.icon);\n        this.setText(this.text);\n        this.setIconClass(this.iconCls);\n        if(Ext.isDefined(this.tabIndex)){\n            btnEl.dom.tabIndex = this.tabIndex;\n        }\n        if(this.tooltip){\n            this.setTooltip(this.tooltip, true);\n        }\n\n        if(this.handleMouseEvents){\n            this.mon(btn, {\n                scope: this,\n                mouseover: this.onMouseOver,\n                mousedown: this.onMouseDown\n            });\n\n            // new functionality for monitoring on the document level\n            //this.mon(btn, 'mouseout', this.onMouseOut, this);\n        }\n\n        if(this.menu){\n            this.mon(this.menu, {\n                scope: this,\n                show: this.onMenuShow,\n                hide: this.onMenuHide\n            });\n        }\n\n        if(this.repeat){\n            var repeater = new Ext.util.ClickRepeater(btn, Ext.isObject(this.repeat) ? this.repeat : {});\n            this.mon(repeater, 'click', this.onRepeatClick, this);\n        }else{\n            this.mon(btn, this.clickEvent, this.onClick, this);\n        }\n    },\n\n    // private\n    afterRender : function(){\n        Ext.Button.superclass.afterRender.call(this);\n        this.useSetClass = true;\n        this.setButtonClass();\n        this.doc = Ext.getDoc();\n        this.doAutoWidth();\n    },\n\n    /**\n     * Sets the CSS class that provides a background image to use as the button's icon.  This method also changes\n     * the value of the {@link iconCls} config internally.\n     * @param {String} cls The CSS class providing the icon image\n     * @return {Ext.Button} this\n     */\n    setIconClass : function(cls){\n        this.iconCls = cls;\n        if(this.el){\n            this.btnEl.dom.className = '';\n            this.btnEl.addClass(['x-btn-text', cls || '']);\n            this.setButtonClass();\n        }\n        return this;\n    },\n\n    /**\n     * Sets the tooltip for this Button.\n     * @param {String/Object} tooltip. This may be:<div class=\"mdesc-details\"><ul>\n     * <li><b>String</b> : A string to be used as innerHTML (html tags are accepted) to show in a tooltip</li>\n     * <li><b>Object</b> : A configuration object for {@link Ext.QuickTips#register}.</li>\n     * </ul></div>\n     * @return {Ext.Button} this\n     */\n    setTooltip : function(tooltip, /* private */ initial){\n        if(this.rendered){\n            if(!initial){\n                this.clearTip();\n            }\n            if(Ext.isObject(tooltip)){\n                Ext.QuickTips.register(Ext.apply({\n                      target: this.btnEl.id\n                }, tooltip));\n                this.tooltip = tooltip;\n            }else{\n                this.btnEl.dom[this.tooltipType] = tooltip;\n            }\n        }else{\n            this.tooltip = tooltip;\n        }\n        return this;\n    },\n\n    // private\n    clearTip : function(){\n        if(Ext.isObject(this.tooltip)){\n            Ext.QuickTips.unregister(this.btnEl);\n        }\n    },\n\n    // private\n    beforeDestroy : function(){\n        if(this.rendered){\n            this.clearTip();\n        }\n        if(this.menu && this.destroyMenu !== false) {\n            Ext.destroy(this.btnEl, this.menu);\n        }\n        Ext.destroy(this.repeater);\n    },\n\n    // private\n    onDestroy : function(){\n        if(this.rendered){\n            this.doc.un('mouseover', this.monitorMouseOver, this);\n            this.doc.un('mouseup', this.onMouseUp, this);\n            delete this.doc;\n            delete this.btnEl;\n            Ext.ButtonToggleMgr.unregister(this);\n        }\n        Ext.Button.superclass.onDestroy.call(this);\n    },\n\n    // private\n    doAutoWidth : function(){\n        if(this.autoWidth !== false && this.el && this.text && this.width === undefined){\n            this.el.setWidth('auto');\n            if(Ext.isIE7 && Ext.isStrict){\n                var ib = this.btnEl;\n                if(ib && ib.getWidth() > 20){\n                    ib.clip();\n                    ib.setWidth(Ext.util.TextMetrics.measure(ib, this.text).width+ib.getFrameWidth('lr'));\n                }\n            }\n            if(this.minWidth){\n                if(this.el.getWidth() < this.minWidth){\n                    this.el.setWidth(this.minWidth);\n                }\n            }\n        }\n    },\n\n    /**\n     * Assigns this Button's click handler\n     * @param {Function} handler The function to call when the button is clicked\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the handler function is executed.\n     * Defaults to this Button.\n     * @return {Ext.Button} this\n     */\n    setHandler : function(handler, scope){\n        this.handler = handler;\n        this.scope = scope;\n        return this;\n    },\n\n    /**\n     * Sets this Button's text\n     * @param {String} text The button text\n     * @return {Ext.Button} this\n     */\n    setText : function(text){\n        this.text = text;\n        if(this.el){\n            this.btnEl.update(text || '&#160;');\n            this.setButtonClass();\n        }\n        this.doAutoWidth();\n        return this;\n    },\n\n    /**\n     * Sets the background image (inline style) of the button.  This method also changes\n     * the value of the {@link icon} config internally.\n     * @param {String} icon The path to an image to display in the button\n     * @return {Ext.Button} this\n     */\n    setIcon : function(icon){\n        this.icon = icon;\n        if(this.el){\n            this.btnEl.setStyle('background-image', icon ? 'url(' + icon + ')' : '');\n            this.setButtonClass();\n        }\n        return this;\n    },\n\n    /**\n     * Gets the text for this Button\n     * @return {String} The button text\n     */\n    getText : function(){\n        return this.text;\n    },\n\n    /**\n     * If a state it passed, it becomes the pressed state otherwise the current state is toggled.\n     * @param {Boolean} state (optional) Force a particular state\n     * @param {Boolean} supressEvent (optional) True to stop events being fired when calling this method.\n     * @return {Ext.Button} this\n     */\n    toggle : function(state, suppressEvent){\n        state = state === undefined ? !this.pressed : !!state;\n        if(state != this.pressed){\n            if(this.rendered){\n                this.el[state ? 'addClass' : 'removeClass']('x-btn-pressed');\n            }\n            this.pressed = state;\n            if(!suppressEvent){\n                this.fireEvent('toggle', this, state);\n                if(this.toggleHandler){\n                    this.toggleHandler.call(this.scope || this, this, state);\n                }\n            }\n        }\n        return this;\n    },\n\n    // private\n    onDisable : function(){\n        this.onDisableChange(true);\n    },\n\n    // private\n    onEnable : function(){\n        this.onDisableChange(false);\n    },\n\n    onDisableChange : function(disabled){\n        if(this.el){\n            if(!Ext.isIE6 || !this.text){\n                this.el[disabled ? 'addClass' : 'removeClass'](this.disabledClass);\n            }\n            this.el.dom.disabled = disabled;\n        }\n        this.disabled = disabled;\n    },\n\n    /**\n     * Show this button's menu (if it has one)\n     */\n    showMenu : function(){\n        if(this.rendered && this.menu){\n            if(this.tooltip){\n                Ext.QuickTips.getQuickTip().cancelShow(this.btnEl);\n            }\n            if(this.menu.isVisible()){\n                this.menu.hide();\n            }\n            this.menu.ownerCt = this;\n            this.menu.show(this.el, this.menuAlign);\n        }\n        return this;\n    },\n\n    /**\n     * Hide this button's menu (if it has one)\n     */\n    hideMenu : function(){\n        if(this.hasVisibleMenu()){\n            this.menu.hide();\n        }\n        return this;\n    },\n\n    /**\n     * Returns true if the button has a menu and it is visible\n     * @return {Boolean}\n     */\n    hasVisibleMenu : function(){\n        return this.menu && this.menu.ownerCt == this && this.menu.isVisible();\n    },\n    \n    // private\n    onRepeatClick : function(repeat, e){\n        this.onClick(e);\n    },\n\n    // private\n    onClick : function(e){\n        if(e){\n            e.preventDefault();\n        }\n        if(e.button !== 0){\n            return;\n        }\n        if(!this.disabled){\n            this.doToggle();\n            if(this.menu && !this.hasVisibleMenu() && !this.ignoreNextClick){\n                this.showMenu();\n            }\n            this.fireEvent('click', this, e);\n            if(this.handler){\n                //this.el.removeClass('x-btn-over');\n                this.handler.call(this.scope || this, this, e);\n            }\n        }\n    },\n    \n    // private\n    doToggle: function(){\n        if (this.enableToggle && (this.allowDepress !== false || !this.pressed)) {\n            this.toggle();\n        }\n    },\n\n    // private\n    isMenuTriggerOver : function(e, internal){\n        return this.menu && !internal;\n    },\n\n    // private\n    isMenuTriggerOut : function(e, internal){\n        return this.menu && !internal;\n    },\n\n    // private\n    onMouseOver : function(e){\n        if(!this.disabled){\n            var internal = e.within(this.el,  true);\n            if(!internal){\n                this.el.addClass('x-btn-over');\n                if(!this.monitoringMouseOver){\n                    this.doc.on('mouseover', this.monitorMouseOver, this);\n                    this.monitoringMouseOver = true;\n                }\n                this.fireEvent('mouseover', this, e);\n            }\n            if(this.isMenuTriggerOver(e, internal)){\n                this.fireEvent('menutriggerover', this, this.menu, e);\n            }\n        }\n    },\n\n    // private\n    monitorMouseOver : function(e){\n        if(e.target != this.el.dom && !e.within(this.el)){\n            if(this.monitoringMouseOver){\n                this.doc.un('mouseover', this.monitorMouseOver, this);\n                this.monitoringMouseOver = false;\n            }\n            this.onMouseOut(e);\n        }\n    },\n\n    // private\n    onMouseOut : function(e){\n        var internal = e.within(this.el) && e.target != this.el.dom;\n        this.el.removeClass('x-btn-over');\n        this.fireEvent('mouseout', this, e);\n        if(this.isMenuTriggerOut(e, internal)){\n            this.fireEvent('menutriggerout', this, this.menu, e);\n        }\n    },\n\n    focus : function() {\n        this.btnEl.focus();\n    },\n\n    blur : function() {\n        this.btnEl.blur();\n    },\n\n    // private\n    onFocus : function(e){\n        if(!this.disabled){\n            this.el.addClass('x-btn-focus');\n        }\n    },\n    // private\n    onBlur : function(e){\n        this.el.removeClass('x-btn-focus');\n    },\n\n    // private\n    getClickEl : function(e, isUp){\n       return this.el;\n    },\n\n    // private\n    onMouseDown : function(e){\n        if(!this.disabled && e.button === 0){\n            this.getClickEl(e).addClass('x-btn-click');\n            this.doc.on('mouseup', this.onMouseUp, this);\n        }\n    },\n    // private\n    onMouseUp : function(e){\n        if(e.button === 0){\n            this.getClickEl(e, true).removeClass('x-btn-click');\n            this.doc.un('mouseup', this.onMouseUp, this);\n        }\n    },\n    // private\n    onMenuShow : function(e){\n        if(this.menu.ownerCt == this){\n            this.menu.ownerCt = this;\n            this.ignoreNextClick = 0;\n            this.el.addClass('x-btn-menu-active');\n            this.fireEvent('menushow', this, this.menu);\n        }\n    },\n    // private\n    onMenuHide : function(e){\n        if(this.menu.ownerCt == this){\n            this.el.removeClass('x-btn-menu-active');\n            this.ignoreNextClick = this.restoreClick.defer(250, this);\n            this.fireEvent('menuhide', this, this.menu);\n            delete this.menu.ownerCt;\n        }\n    },\n\n    // private\n    restoreClick : function(){\n        this.ignoreNextClick = 0;\n    }\n\n    /**\n     * @cfg {String} autoEl @hide\n     */\n    /**\n     * @cfg {String/Object} html @hide\n     */\n    /**\n     * @cfg {String} contentEl  @hide\n     */\n    /**\n     * @cfg {Mixed} data  @hide\n     */\n    /**\n     * @cfg {Mixed} tpl  @hide\n     */\n    /**\n     * @cfg {String} tplWriteMode  @hide\n     */\n});\nExt.reg('button', Ext.Button);\n\n// Private utility class used by Button\nExt.ButtonToggleMgr = function(){\n   var groups = {};\n\n   function toggleGroup(btn, state){\n       if(state){\n           var g = groups[btn.toggleGroup];\n           for(var i = 0, l = g.length; i < l; i++){\n               if(g[i] != btn){\n                   g[i].toggle(false);\n               }\n           }\n       }\n   }\n\n   return {\n       register : function(btn){\n           if(!btn.toggleGroup){\n               return;\n           }\n           var g = groups[btn.toggleGroup];\n           if(!g){\n               g = groups[btn.toggleGroup] = [];\n           }\n           g.push(btn);\n           btn.on('toggle', toggleGroup);\n       },\n\n       unregister : function(btn){\n           if(!btn.toggleGroup){\n               return;\n           }\n           var g = groups[btn.toggleGroup];\n           if(g){\n               g.remove(btn);\n               btn.un('toggle', toggleGroup);\n           }\n       },\n\n       /**\n        * Gets the pressed button in the passed group or null\n        * @param {String} group\n        * @return Button\n        */\n       getPressed : function(group){\n           var g = groups[group];\n           if(g){\n               for(var i = 0, len = g.length; i < len; i++){\n                   if(g[i].pressed === true){\n                       return g[i];\n                   }\n               }\n           }\n           return null;\n       }\n   };\n}();\n/**\n * @class Ext.SplitButton\n * @extends Ext.Button\n * A split button that provides a built-in dropdown arrow that can fire an event separately from the default\n * click event of the button.  Typically this would be used to display a dropdown menu that provides additional\n * options to the primary button action, but any custom handler can provide the arrowclick implementation.  Example usage:\n * <pre><code>\n// display a dropdown menu:\nnew Ext.SplitButton({\n\trenderTo: 'button-ct', // the container id\n   \ttext: 'Options',\n   \thandler: optionsHandler, // handle a click on the button itself\n   \tmenu: new Ext.menu.Menu({\n        items: [\n        \t// these items will render as dropdown menu items when the arrow is clicked:\n\t        {text: 'Item 1', handler: item1Handler},\n\t        {text: 'Item 2', handler: item2Handler}\n        ]\n   \t})\n});\n\n// Instead of showing a menu, you provide any type of custom\n// functionality you want when the dropdown arrow is clicked:\nnew Ext.SplitButton({\n\trenderTo: 'button-ct',\n   \ttext: 'Options',\n   \thandler: optionsHandler,\n   \tarrowHandler: myCustomHandler\n});\n</code></pre>\n * @cfg {Function} arrowHandler A function called when the arrow button is clicked (can be used instead of click event)\n * @cfg {String} arrowTooltip The title attribute of the arrow\n * @constructor\n * Create a new menu button\n * @param {Object} config The config object\n * @xtype splitbutton\n */\nExt.SplitButton = Ext.extend(Ext.Button, {\n\t// private\n    arrowSelector : 'em',\n    split: true,\n\n    // private\n    initComponent : function(){\n        Ext.SplitButton.superclass.initComponent.call(this);\n        /**\n         * @event arrowclick\n         * Fires when this button's arrow is clicked\n         * @param {MenuButton} this\n         * @param {EventObject} e The click event\n         */\n        this.addEvents(\"arrowclick\");\n    },\n\n    // private\n    onRender : function(){\n        Ext.SplitButton.superclass.onRender.apply(this, arguments);\n        if(this.arrowTooltip){\n            this.el.child(this.arrowSelector).dom[this.tooltipType] = this.arrowTooltip;\n        }\n    },\n\n    /**\n     * Sets this button's arrow click handler.\n     * @param {Function} handler The function to call when the arrow is clicked\n     * @param {Object} scope (optional) Scope for the function passed above\n     */\n    setArrowHandler : function(handler, scope){\n        this.arrowHandler = handler;\n        this.scope = scope;\n    },\n\n    getMenuClass : function(){\n        return 'x-btn-split' + (this.arrowAlign == 'bottom' ? '-bottom' : '');\n    },\n\n    isClickOnArrow : function(e){\n\tif (this.arrowAlign != 'bottom') {\n\t    var visBtn = this.el.child('em.x-btn-split');\n\t    var right = visBtn.getRegion().right - visBtn.getPadding('r');\n\t    return e.getPageX() > right;\n\t} else {\n\t    return e.getPageY() > this.btnEl.getRegion().bottom;\n\t}\n    },\n\n    // private\n    onClick : function(e, t){\n        e.preventDefault();\n        if(!this.disabled){\n            if(this.isClickOnArrow(e)){\n                if(this.menu && !this.menu.isVisible() && !this.ignoreNextClick){\n                    this.showMenu();\n                }\n                this.fireEvent(\"arrowclick\", this, e);\n                if(this.arrowHandler){\n                    this.arrowHandler.call(this.scope || this, this, e);\n                }\n            }else{\n                this.doToggle();\n                this.fireEvent(\"click\", this, e);\n                if(this.handler){\n                    this.handler.call(this.scope || this, this, e);\n                }\n            }\n        }\n    },\n\n    // private\n    isMenuTriggerOver : function(e){\n        return this.menu && e.target.tagName == this.arrowSelector;\n    },\n\n    // private\n    isMenuTriggerOut : function(e, internal){\n        return this.menu && e.target.tagName != this.arrowSelector;\n    }\n});\n\nExt.reg('splitbutton', Ext.SplitButton);/**\n * @class Ext.CycleButton\n * @extends Ext.SplitButton\n * A specialized SplitButton that contains a menu of {@link Ext.menu.CheckItem} elements.  The button automatically\n * cycles through each menu item on click, raising the button's {@link #change} event (or calling the button's\n * {@link #changeHandler} function, if supplied) for the active menu item. Clicking on the arrow section of the\n * button displays the dropdown menu just like a normal SplitButton.  Example usage:\n * <pre><code>\nvar btn = new Ext.CycleButton({\n    showText: true,\n    prependText: 'View as ',\n    items: [{\n        text:'text only',\n        iconCls:'view-text',\n        checked:true\n    },{\n        text:'HTML',\n        iconCls:'view-html'\n    }],\n    changeHandler:function(btn, item){\n        Ext.Msg.alert('Change View', item.text);\n    }\n});\n</code></pre>\n * @constructor\n * Create a new split button\n * @param {Object} config The config object\n * @xtype cycle\n */\nExt.CycleButton = Ext.extend(Ext.SplitButton, {\n    /**\n     * @cfg {Array} items An array of {@link Ext.menu.CheckItem} <b>config</b> objects to be used when creating the\n     * button's menu items (e.g., {text:'Foo', iconCls:'foo-icon'})\n     */\n    /**\n     * @cfg {Boolean} showText True to display the active item's text as the button text (defaults to false)\n     */\n    /**\n     * @cfg {String} prependText A static string to prepend before the active item's text when displayed as the\n     * button's text (only applies when showText = true, defaults to '')\n     */\n    /**\n     * @cfg {Function} changeHandler A callback function that will be invoked each time the active menu\n     * item in the button's menu has changed.  If this callback is not supplied, the SplitButton will instead\n     * fire the {@link #change} event on active item change.  The changeHandler function will be called with the\n     * following argument list: (SplitButton this, Ext.menu.CheckItem item)\n     */\n    /**\n     * @cfg {String} forceIcon A css class which sets an image to be used as the static icon for this button.  This\n     * icon will always be displayed regardless of which item is selected in the dropdown list.  This overrides the \n     * default behavior of changing the button's icon to match the selected item's icon on change.\n     */\n    /**\n     * @property menu\n     * @type Menu\n     * The {@link Ext.menu.Menu Menu} object used to display the {@link Ext.menu.CheckItem CheckItems} representing the available choices.\n     */\n\n    // private\n    getItemText : function(item){\n        if(item && this.showText === true){\n            var text = '';\n            if(this.prependText){\n                text += this.prependText;\n            }\n            text += item.text;\n            return text;\n        }\n        return undefined;\n    },\n\n    /**\n     * Sets the button's active menu item.\n     * @param {Ext.menu.CheckItem} item The item to activate\n     * @param {Boolean} suppressEvent True to prevent the button's change event from firing (defaults to false)\n     */\n    setActiveItem : function(item, suppressEvent){\n        if(!Ext.isObject(item)){\n            item = this.menu.getComponent(item);\n        }\n        if(item){\n            if(!this.rendered){\n                this.text = this.getItemText(item);\n                this.iconCls = item.iconCls;\n            }else{\n                var t = this.getItemText(item);\n                if(t){\n                    this.setText(t);\n                }\n                this.setIconClass(item.iconCls);\n            }\n            this.activeItem = item;\n            if(!item.checked){\n                item.setChecked(true, suppressEvent);\n            }\n            if(this.forceIcon){\n                this.setIconClass(this.forceIcon);\n            }\n            if(!suppressEvent){\n                this.fireEvent('change', this, item);\n            }\n        }\n    },\n\n    /**\n     * Gets the currently active menu item.\n     * @return {Ext.menu.CheckItem} The active item\n     */\n    getActiveItem : function(){\n        return this.activeItem;\n    },\n\n    // private\n    initComponent : function(){\n        this.addEvents(\n            /**\n             * @event change\n             * Fires after the button's active menu item has changed.  Note that if a {@link #changeHandler} function\n             * is set on this CycleButton, it will be called instead on active item change and this change event will\n             * not be fired.\n             * @param {Ext.CycleButton} this\n             * @param {Ext.menu.CheckItem} item The menu item that was selected\n             */\n            \"change\"\n        );\n\n        if(this.changeHandler){\n            this.on('change', this.changeHandler, this.scope||this);\n            delete this.changeHandler;\n        }\n\n        this.itemCount = this.items.length;\n\n        this.menu = {cls:'x-cycle-menu', items:[]};\n        var checked = 0;\n        Ext.each(this.items, function(item, i){\n            Ext.apply(item, {\n                group: item.group || this.id,\n                itemIndex: i,\n                checkHandler: this.checkHandler,\n                scope: this,\n                checked: item.checked || false\n            });\n            this.menu.items.push(item);\n            if(item.checked){\n                checked = i;\n            }\n        }, this);\n        Ext.CycleButton.superclass.initComponent.call(this);\n        this.on('click', this.toggleSelected, this);\n        this.setActiveItem(checked, true);\n    },\n\n    // private\n    checkHandler : function(item, pressed){\n        if(pressed){\n            this.setActiveItem(item);\n        }\n    },\n\n    /**\n     * This is normally called internally on button click, but can be called externally to advance the button's\n     * active item programmatically to the next one in the menu.  If the current item is the last one in the menu\n     * the active item will be set to the first item in the menu.\n     */\n    toggleSelected : function(){\n        var m = this.menu;\n        m.render();\n        // layout if we haven't before so the items are active\n        if(!m.hasLayout){\n            m.doLayout();\n        }\n        \n        var nextIdx, checkItem;\n        for (var i = 1; i < this.itemCount; i++) {\n            nextIdx = (this.activeItem.itemIndex + i) % this.itemCount;\n            // check the potential item\n            checkItem = m.items.itemAt(nextIdx);\n            // if its not disabled then check it.\n            if (!checkItem.disabled) {\n                checkItem.setChecked(true);\n                break;\n            }\n        }\n    }\n});\nExt.reg('cycle', Ext.CycleButton);/**\n * @class Ext.Toolbar\n * @extends Ext.Container\n * <p>Basic Toolbar class. Although the <tt>{@link Ext.Container#defaultType defaultType}</tt> for Toolbar\n * is <tt>{@link Ext.Button button}</tt>, Toolbar elements (child items for the Toolbar container) may\n * be virtually any type of Component. Toolbar elements can be created explicitly via their constructors,\n * or implicitly via their xtypes, and can be <tt>{@link #add}</tt>ed dynamically.</p>\n * <p>Some items have shortcut strings for creation:</p>\n * <pre>\n<u>Shortcut</u>  <u>xtype</u>          <u>Class</u>                  <u>Description</u>\n'->'      'tbfill'       {@link Ext.Toolbar.Fill}       begin using the right-justified button container\n'-'       'tbseparator'  {@link Ext.Toolbar.Separator}  add a vertical separator bar between toolbar items\n' '       'tbspacer'     {@link Ext.Toolbar.Spacer}     add horiztonal space between elements\n * </pre>\n *\n * Example usage of various elements:\n * <pre><code>\nvar tb = new Ext.Toolbar({\n    renderTo: document.body,\n    width: 600,\n    height: 100,\n    items: [\n        {\n            // xtype: 'button', // default for Toolbars, same as 'tbbutton'\n            text: 'Button'\n        },\n        {\n            xtype: 'splitbutton', // same as 'tbsplitbutton'\n            text: 'Split Button'\n        },\n        // begin using the right-justified button container\n        '->', // same as {xtype: 'tbfill'}, // Ext.Toolbar.Fill\n        {\n            xtype: 'textfield',\n            name: 'field1',\n            emptyText: 'enter search term'\n        },\n        // add a vertical separator bar between toolbar items\n        '-', // same as {xtype: 'tbseparator'} to create Ext.Toolbar.Separator\n        'text 1', // same as {xtype: 'tbtext', text: 'text1'} to create Ext.Toolbar.TextItem\n        {xtype: 'tbspacer'},// same as ' ' to create Ext.Toolbar.Spacer\n        'text 2',\n        {xtype: 'tbspacer', width: 50}, // add a 50px space\n        'text 3'\n    ]\n});\n * </code></pre>\n * Example adding a ComboBox within a menu of a button:\n * <pre><code>\n// ComboBox creation\nvar combo = new Ext.form.ComboBox({\n    store: new Ext.data.ArrayStore({\n        autoDestroy: true,\n        fields: ['initials', 'fullname'],\n        data : [\n            ['FF', 'Fred Flintstone'],\n            ['BR', 'Barney Rubble']\n        ]\n    }),\n    displayField: 'fullname',\n    typeAhead: true,\n    mode: 'local',\n    forceSelection: true,\n    triggerAction: 'all',\n    emptyText: 'Select a name...',\n    selectOnFocus: true,\n    width: 135,\n    getListParent: function() {\n        return this.el.up('.x-menu');\n    },\n    iconCls: 'no-icon' //use iconCls if placing within menu to shift to right side of menu\n});\n\n// put ComboBox in a Menu\nvar menu = new Ext.menu.Menu({\n    id: 'mainMenu',\n    items: [\n        combo // A Field in a Menu\n    ]\n});\n\n// add a Button with the menu\ntb.add({\n        text:'Button w/ Menu',\n        menu: menu  // assign menu by instance\n    });\ntb.doLayout();\n * </code></pre>\n * @constructor\n * Creates a new Toolbar\n * @param {Object/Array} config A config object or an array of buttons to <tt>{@link #add}</tt>\n * @xtype toolbar\n */\nExt.Toolbar = function(config){\n    if(Ext.isArray(config)){\n        config = {items: config, layout: 'toolbar'};\n    } else {\n        config = Ext.apply({\n            layout: 'toolbar'\n        }, config);\n        if(config.buttons) {\n            config.items = config.buttons;\n        }\n    }\n    Ext.Toolbar.superclass.constructor.call(this, config);\n};\n\n(function(){\n\nvar T = Ext.Toolbar;\n\nExt.extend(T, Ext.Container, {\n\n    defaultType: 'button',\n\n    /**\n     * @cfg {String/Object} layout\n     * This class assigns a default layout (<code>layout:'<b>toolbar</b>'</code>).\n     * Developers <i>may</i> override this configuration option if another layout\n     * is required (the constructor must be passed a configuration object in this\n     * case instead of an array).\n     * See {@link Ext.Container#layout} for additional information.\n     */\n\n    enableOverflow : false,\n\n    /**\n     * @cfg {Boolean} enableOverflow\n     * Defaults to false. Configure <tt>true</tt> to make the toolbar provide a button\n     * which activates a dropdown Menu to show items which overflow the Toolbar's width.\n     */\n    /**\n     * @cfg {String} buttonAlign\n     * <p>The default position at which to align child items. Defaults to <code>\"left\"</code></p>\n     * <p>May be specified as <code>\"center\"</code> to cause items added before a Fill (A <code>\"->\"</code>) item\n     * to be centered in the Toolbar. Items added after a Fill are still right-aligned.</p>\n     * <p>Specify as <code>\"right\"</code> to right align all child items.</p>\n     */\n\n    trackMenus : true,\n    internalDefaults: {removeMode: 'container', hideParent: true},\n    toolbarCls: 'x-toolbar',\n\n    initComponent : function(){\n        T.superclass.initComponent.call(this);\n\n        /**\n         * @event overflowchange\n         * Fires after the overflow state has changed.\n         * @param {Object} c The Container\n         * @param {Boolean} lastOverflow overflow state\n         */\n        this.addEvents('overflowchange');\n    },\n\n    // private\n    onRender : function(ct, position){\n        if(!this.el){\n            if(!this.autoCreate){\n                this.autoCreate = {\n                    cls: this.toolbarCls + ' x-small-editor'\n                };\n            }\n            this.el = ct.createChild(Ext.apply({ id: this.id },this.autoCreate), position);\n            Ext.Toolbar.superclass.onRender.apply(this, arguments);\n        }\n    },\n\n    /**\n     * <p>Adds element(s) to the toolbar -- this function takes a variable number of\n     * arguments of mixed type and adds them to the toolbar.</p>\n     * <br><p><b>Note</b>: See the notes within {@link Ext.Container#add}.</p>\n     * @param {Mixed} arg1 The following types of arguments are all valid:<br />\n     * <ul>\n     * <li>{@link Ext.Button} config: A valid button config object (equivalent to {@link #addButton})</li>\n     * <li>HtmlElement: Any standard HTML element (equivalent to {@link #addElement})</li>\n     * <li>Field: Any form field (equivalent to {@link #addField})</li>\n     * <li>Item: Any subclass of {@link Ext.Toolbar.Item} (equivalent to {@link #addItem})</li>\n     * <li>String: Any generic string (gets wrapped in a {@link Ext.Toolbar.TextItem}, equivalent to {@link #addText}).\n     * Note that there are a few special strings that are treated differently as explained next.</li>\n     * <li>'-': Creates a separator element (equivalent to {@link #addSeparator})</li>\n     * <li>' ': Creates a spacer element (equivalent to {@link #addSpacer})</li>\n     * <li>'->': Creates a fill element (equivalent to {@link #addFill})</li>\n     * </ul>\n     * @param {Mixed} arg2\n     * @param {Mixed} etc.\n     * @method add\n     */\n\n    // private\n    lookupComponent : function(c){\n        if(Ext.isString(c)){\n            if(c == '-'){\n                c = new T.Separator();\n            }else if(c == ' '){\n                c = new T.Spacer();\n            }else if(c == '->'){\n                c = new T.Fill();\n            }else{\n                c = new T.TextItem(c);\n            }\n            this.applyDefaults(c);\n        }else{\n            if(c.isFormField || c.render){ // some kind of form field, some kind of Toolbar.Item\n                c = this.createComponent(c);\n            }else if(c.tag){ // DomHelper spec\n                c = new T.Item({autoEl: c});\n            }else if(c.tagName){ // element\n                c = new T.Item({el:c});\n            }else if(Ext.isObject(c)){ // must be button config?\n                c = c.xtype ? this.createComponent(c) : this.constructButton(c);\n            }\n        }\n        return c;\n    },\n\n    // private\n    applyDefaults : function(c){\n        if(!Ext.isString(c)){\n            c = Ext.Toolbar.superclass.applyDefaults.call(this, c);\n            var d = this.internalDefaults;\n            if(c.events){\n                Ext.applyIf(c.initialConfig, d);\n                Ext.apply(c, d);\n            }else{\n                Ext.applyIf(c, d);\n            }\n        }\n        return c;\n    },\n\n    /**\n     * Adds a separator\n     * <br><p><b>Note</b>: See the notes within {@link Ext.Container#add}.</p>\n     * @return {Ext.Toolbar.Item} The separator {@link Ext.Toolbar.Item item}\n     */\n    addSeparator : function(){\n        return this.add(new T.Separator());\n    },\n\n    /**\n     * Adds a spacer element\n     * <br><p><b>Note</b>: See the notes within {@link Ext.Container#add}.</p>\n     * @return {Ext.Toolbar.Spacer} The spacer item\n     */\n    addSpacer : function(){\n        return this.add(new T.Spacer());\n    },\n\n    /**\n     * Forces subsequent additions into the float:right toolbar\n     * <br><p><b>Note</b>: See the notes within {@link Ext.Container#add}.</p>\n     */\n    addFill : function(){\n        this.add(new T.Fill());\n    },\n\n    /**\n     * Adds any standard HTML element to the toolbar\n     * <br><p><b>Note</b>: See the notes within {@link Ext.Container#add}.</p>\n     * @param {Mixed} el The element or id of the element to add\n     * @return {Ext.Toolbar.Item} The element's item\n     */\n    addElement : function(el){\n        return this.addItem(new T.Item({el:el}));\n    },\n\n    /**\n     * Adds any Toolbar.Item or subclass\n     * <br><p><b>Note</b>: See the notes within {@link Ext.Container#add}.</p>\n     * @param {Ext.Toolbar.Item} item\n     * @return {Ext.Toolbar.Item} The item\n     */\n    addItem : function(item){\n        return this.add.apply(this, arguments);\n    },\n\n    /**\n     * Adds a button (or buttons). See {@link Ext.Button} for more info on the config.\n     * <br><p><b>Note</b>: See the notes within {@link Ext.Container#add}.</p>\n     * @param {Object/Array} config A button config or array of configs\n     * @return {Ext.Button/Array}\n     */\n    addButton : function(config){\n        if(Ext.isArray(config)){\n            var buttons = [];\n            for(var i = 0, len = config.length; i < len; i++) {\n                buttons.push(this.addButton(config[i]));\n            }\n            return buttons;\n        }\n        return this.add(this.constructButton(config));\n    },\n\n    /**\n     * Adds text to the toolbar\n     * <br><p><b>Note</b>: See the notes within {@link Ext.Container#add}.</p>\n     * @param {String} text The text to add\n     * @return {Ext.Toolbar.Item} The element's item\n     */\n    addText : function(text){\n        return this.addItem(new T.TextItem(text));\n    },\n\n    /**\n     * Adds a new element to the toolbar from the passed {@link Ext.DomHelper} config\n     * <br><p><b>Note</b>: See the notes within {@link Ext.Container#add}.</p>\n     * @param {Object} config\n     * @return {Ext.Toolbar.Item} The element's item\n     */\n    addDom : function(config){\n        return this.add(new T.Item({autoEl: config}));\n    },\n\n    /**\n     * Adds a dynamically rendered Ext.form field (TextField, ComboBox, etc). Note: the field should not have\n     * been rendered yet. For a field that has already been rendered, use {@link #addElement}.\n     * <br><p><b>Note</b>: See the notes within {@link Ext.Container#add}.</p>\n     * @param {Ext.form.Field} field\n     * @return {Ext.Toolbar.Item}\n     */\n    addField : function(field){\n        return this.add(field);\n    },\n\n    /**\n     * Inserts any {@link Ext.Toolbar.Item}/{@link Ext.Button} at the specified index.\n     * <br><p><b>Note</b>: See the notes within {@link Ext.Container#add}.</p>\n     * @param {Number} index The index where the item is to be inserted\n     * @param {Object/Ext.Toolbar.Item/Ext.Button/Array} item The button, or button config object to be\n     * inserted, or an array of buttons/configs.\n     * @return {Ext.Button/Item}\n     */\n    insertButton : function(index, item){\n        if(Ext.isArray(item)){\n            var buttons = [];\n            for(var i = 0, len = item.length; i < len; i++) {\n               buttons.push(this.insertButton(index + i, item[i]));\n            }\n            return buttons;\n        }\n        return Ext.Toolbar.superclass.insert.call(this, index, item);\n    },\n\n    // private\n    trackMenu : function(item, remove){\n        if(this.trackMenus && item.menu){\n            var method = remove ? 'mun' : 'mon';\n            this[method](item, 'menutriggerover', this.onButtonTriggerOver, this);\n            this[method](item, 'menushow', this.onButtonMenuShow, this);\n            this[method](item, 'menuhide', this.onButtonMenuHide, this);\n        }\n    },\n\n    // private\n    constructButton : function(item){\n        var b = item.events ? item : this.createComponent(item, item.split ? 'splitbutton' : this.defaultType);\n        return b;\n    },\n\n    // private\n    onAdd : function(c){\n        Ext.Toolbar.superclass.onAdd.call(this);\n        this.trackMenu(c);\n        if(this.disabled){\n            c.disable();\n        }\n    },\n\n    // private\n    onRemove : function(c){\n        Ext.Toolbar.superclass.onRemove.call(this);\n        if (c == this.activeMenuBtn) {\n            delete this.activeMenuBtn;\n        }\n        this.trackMenu(c, true);\n    },\n\n    // private\n    onDisable : function(){\n        this.items.each(function(item){\n             if(item.disable){\n                 item.disable();\n             }\n        });\n    },\n\n    // private\n    onEnable : function(){\n        this.items.each(function(item){\n             if(item.enable){\n                 item.enable();\n             }\n        });\n    },\n\n    // private\n    onButtonTriggerOver : function(btn){\n        if(this.activeMenuBtn && this.activeMenuBtn != btn){\n            this.activeMenuBtn.hideMenu();\n            btn.showMenu();\n            this.activeMenuBtn = btn;\n        }\n    },\n\n    // private\n    onButtonMenuShow : function(btn){\n        this.activeMenuBtn = btn;\n    },\n\n    // private\n    onButtonMenuHide : function(btn){\n        delete this.activeMenuBtn;\n    }\n});\nExt.reg('toolbar', Ext.Toolbar);\n\n/**\n * @class Ext.Toolbar.Item\n * @extends Ext.BoxComponent\n * The base class that other non-interacting Toolbar Item classes should extend in order to\n * get some basic common toolbar item functionality.\n * @constructor\n * Creates a new Item\n * @param {HTMLElement} el\n * @xtype tbitem\n */\nT.Item = Ext.extend(Ext.BoxComponent, {\n    hideParent: true, //  Hiding a Toolbar.Item hides its containing TD\n    enable:Ext.emptyFn,\n    disable:Ext.emptyFn,\n    focus:Ext.emptyFn\n    /**\n     * @cfg {String} overflowText Text to be used for the menu if the item is overflowed.\n     */\n});\nExt.reg('tbitem', T.Item);\n\n/**\n * @class Ext.Toolbar.Separator\n * @extends Ext.Toolbar.Item\n * A simple class that adds a vertical separator bar between toolbar items\n * (css class:<tt>'xtb-sep'</tt>). Example usage:\n * <pre><code>\nnew Ext.Panel({\n    tbar : [\n        'Item 1',\n        {xtype: 'tbseparator'}, // or '-'\n        'Item 2'\n    ]\n});\n</code></pre>\n * @constructor\n * Creates a new Separator\n * @xtype tbseparator\n */\nT.Separator = Ext.extend(T.Item, {\n    onRender : function(ct, position){\n        this.el = ct.createChild({tag:'span', cls:'xtb-sep'}, position);\n    }\n});\nExt.reg('tbseparator', T.Separator);\n\n/**\n * @class Ext.Toolbar.Spacer\n * @extends Ext.Toolbar.Item\n * A simple element that adds extra horizontal space between items in a toolbar.\n * By default a 2px wide space is added via css specification:<pre><code>\n.x-toolbar .xtb-spacer {\n    width:2px;\n}\n * </code></pre>\n * <p>Example usage:</p>\n * <pre><code>\nnew Ext.Panel({\n    tbar : [\n        'Item 1',\n        {xtype: 'tbspacer'}, // or ' '\n        'Item 2',\n        // space width is also configurable via javascript\n        {xtype: 'tbspacer', width: 50}, // add a 50px space\n        'Item 3'\n    ]\n});\n</code></pre>\n * @constructor\n * Creates a new Spacer\n * @xtype tbspacer\n */\nT.Spacer = Ext.extend(T.Item, {\n    /**\n     * @cfg {Number} width\n     * The width of the spacer in pixels (defaults to 2px via css style <tt>.x-toolbar .xtb-spacer</tt>).\n     */\n\n    onRender : function(ct, position){\n        this.el = ct.createChild({tag:'div', cls:'xtb-spacer', style: this.width?'width:'+this.width+'px':''}, position);\n    }\n});\nExt.reg('tbspacer', T.Spacer);\n\n/**\n * @class Ext.Toolbar.Fill\n * @extends Ext.Toolbar.Spacer\n * A non-rendering placeholder item which instructs the Toolbar's Layout to begin using\n * the right-justified button container.\n * <pre><code>\nnew Ext.Panel({\n    tbar : [\n        'Item 1',\n        {xtype: 'tbfill'}, // or '->'\n        'Item 2'\n    ]\n});\n</code></pre>\n * @constructor\n * Creates a new Fill\n * @xtype tbfill\n */\nT.Fill = Ext.extend(T.Item, {\n    // private\n    render : Ext.emptyFn,\n    isFill : true\n});\nExt.reg('tbfill', T.Fill);\n\n/**\n * @class Ext.Toolbar.TextItem\n * @extends Ext.Toolbar.Item\n * A simple class that renders text directly into a toolbar\n * (with css class:<tt>'xtb-text'</tt>). Example usage:\n * <pre><code>\nnew Ext.Panel({\n    tbar : [\n        {xtype: 'tbtext', text: 'Item 1'} // or simply 'Item 1'\n    ]\n});\n</code></pre>\n * @constructor\n * Creates a new TextItem\n * @param {String/Object} text A text string, or a config object containing a <tt>text</tt> property\n * @xtype tbtext\n */\nT.TextItem = Ext.extend(T.Item, {\n    /**\n     * @cfg {String} text The text to be used as innerHTML (html tags are accepted)\n     */\n\n    constructor: function(config){\n        T.TextItem.superclass.constructor.call(this, Ext.isString(config) ? {text: config} : config);\n    },\n\n    // private\n    onRender : function(ct, position) {\n        this.autoEl = {cls: 'xtb-text', html: this.text || ''};\n        T.TextItem.superclass.onRender.call(this, ct, position);\n    },\n\n    /**\n     * Updates this item's text, setting the text to be used as innerHTML.\n     * @param {String} t The text to display (html accepted).\n     */\n    setText : function(t) {\n        if(this.rendered){\n            this.el.update(t);\n        }else{\n            this.text = t;\n        }\n    }\n});\nExt.reg('tbtext', T.TextItem);\n\n// backwards compat\nT.Button = Ext.extend(Ext.Button, {});\nT.SplitButton = Ext.extend(Ext.SplitButton, {});\nExt.reg('tbbutton', T.Button);\nExt.reg('tbsplit', T.SplitButton);\n\n})();\n/**\n * @class Ext.ButtonGroup\n * @extends Ext.Panel\n * Container for a group of buttons. Example usage:\n * <pre><code>\nvar p = new Ext.Panel({\n    title: 'Panel with Button Group',\n    width: 300,\n    height:200,\n    renderTo: document.body,\n    html: 'whatever',\n    tbar: [{\n        xtype: 'buttongroup',\n        {@link #columns}: 3,\n        title: 'Clipboard',\n        items: [{\n            text: 'Paste',\n            scale: 'large',\n            rowspan: 3, iconCls: 'add',\n            iconAlign: 'top',\n            cls: 'x-btn-as-arrow'\n        },{\n            xtype:'splitbutton',\n            text: 'Menu Button',\n            scale: 'large',\n            rowspan: 3,\n            iconCls: 'add',\n            iconAlign: 'top',\n            arrowAlign:'bottom',\n            menu: [{text: 'Menu Item 1'}]\n        },{\n            xtype:'splitbutton', text: 'Cut', iconCls: 'add16', menu: [{text: 'Cut Menu Item'}]\n        },{\n            text: 'Copy', iconCls: 'add16'\n        },{\n            text: 'Format', iconCls: 'add16'\n        }]\n    }]\n});\n * </code></pre>\n * @constructor\n * Create a new ButtonGroup.\n * @param {Object} config The config object\n * @xtype buttongroup\n */\nExt.ButtonGroup = Ext.extend(Ext.Panel, {\n    /**\n     * @cfg {Number} columns The <tt>columns</tt> configuration property passed to the\n     * {@link #layout configured layout manager}. See {@link Ext.layout.TableLayout#columns}.\n     */\n    /**\n     * @cfg {String} baseCls  Defaults to <tt>'x-btn-group'</tt>.  See {@link Ext.Panel#baseCls}.\n     */\n    baseCls: 'x-btn-group',\n    /**\n     * @cfg {String} layout  Defaults to <tt>'table'</tt>.  See {@link Ext.Container#layout}.\n     */\n    layout:'table',\n    defaultType: 'button',\n    /**\n     * @cfg {Boolean} frame  Defaults to <tt>true</tt>.  See {@link Ext.Panel#frame}.\n     */\n    frame: true,\n    internalDefaults: {removeMode: 'container', hideParent: true},\n\n    initComponent : function(){\n        this.layoutConfig = this.layoutConfig || {};\n        Ext.applyIf(this.layoutConfig, {\n            columns : this.columns\n        });\n        if(!this.title){\n            this.addClass('x-btn-group-notitle');\n        }\n        this.on('afterlayout', this.onAfterLayout, this);\n        Ext.ButtonGroup.superclass.initComponent.call(this);\n    },\n\n    applyDefaults : function(c){\n        c = Ext.ButtonGroup.superclass.applyDefaults.call(this, c);\n        var d = this.internalDefaults;\n        if(c.events){\n            Ext.applyIf(c.initialConfig, d);\n            Ext.apply(c, d);\n        }else{\n            Ext.applyIf(c, d);\n        }\n        return c;\n    },\n\n    onAfterLayout : function(){\n        var bodyWidth = this.body.getFrameWidth('lr') + this.body.dom.firstChild.offsetWidth;\n        this.body.setWidth(bodyWidth);\n        this.el.setWidth(bodyWidth + this.getFrameWidth());\n    }\n    /**\n     * @cfg {Array} tools  @hide\n     */\n});\n\nExt.reg('buttongroup', Ext.ButtonGroup);\n/**\n * @class Ext.PagingToolbar\n * @extends Ext.Toolbar\n * <p>As the amount of records increases, the time required for the browser to render\n * them increases. Paging is used to reduce the amount of data exchanged with the client.\n * Note: if there are more records/rows than can be viewed in the available screen area, vertical\n * scrollbars will be added.</p>\n * <p>Paging is typically handled on the server side (see exception below). The client sends\n * parameters to the server side, which the server needs to interpret and then respond with the\n * approprate data.</p>\n * <p><b>Ext.PagingToolbar</b> is a specialized toolbar that is bound to a {@link Ext.data.Store}\n * and provides automatic paging control. This Component {@link Ext.data.Store#load load}s blocks\n * of data into the <tt>{@link #store}</tt> by passing {@link Ext.data.Store#paramNames paramNames} used for\n * paging criteria.</p>\n * <p>PagingToolbar is typically used as one of the Grid's toolbars:</p>\n * <pre><code>\nExt.QuickTips.init(); // to display button quicktips\n\nvar myStore = new Ext.data.Store({\n    reader: new Ext.data.JsonReader({\n        {@link Ext.data.JsonReader#totalProperty totalProperty}: 'results', \n        ...\n    }),\n    ...\n});\n\nvar myPageSize = 25;  // server script should only send back 25 items at a time\n\nvar grid = new Ext.grid.GridPanel({\n    ...\n    store: myStore,\n    bbar: new Ext.PagingToolbar({\n        {@link #store}: myStore,       // grid and PagingToolbar using same store\n        {@link #displayInfo}: true,\n        {@link #pageSize}: myPageSize,\n        {@link #prependButtons}: true,\n        items: [\n            'text 1'\n        ]\n    })\n});\n * </code></pre>\n *\n * <p>To use paging, pass the paging requirements to the server when the store is first loaded.</p>\n * <pre><code>\nstore.load({\n    params: {\n        // specify params for the first page load if using paging\n        start: 0,          \n        limit: myPageSize,\n        // other params\n        foo:   'bar'\n    }\n});\n * </code></pre>\n * \n * <p>If using {@link Ext.data.Store#autoLoad store's autoLoad} configuration:</p>\n * <pre><code>\nvar myStore = new Ext.data.Store({\n    {@link Ext.data.Store#autoLoad autoLoad}: {params:{start: 0, limit: 25}},\n    ...\n});\n * </code></pre>\n * \n * <p>The packet sent back from the server would have this form:</p>\n * <pre><code>\n{\n    \"success\": true,\n    \"results\": 2000, \n    \"rows\": [ // <b>*Note:</b> this must be an Array \n        { \"id\":  1, \"name\": \"Bill\", \"occupation\": \"Gardener\" },\n        { \"id\":  2, \"name\":  \"Ben\", \"occupation\": \"Horticulturalist\" },\n        ...\n        { \"id\": 25, \"name\":  \"Sue\", \"occupation\": \"Botanist\" }\n    ]\n}\n * </code></pre>\n * <p><u>Paging with Local Data</u></p>\n * <p>Paging can also be accomplished with local data using extensions:</p>\n * <div class=\"mdetail-params\"><ul>\n * <li><a href=\"http://extjs.com/forum/showthread.php?t=71532\">Ext.ux.data.PagingStore</a></li>\n * <li>Paging Memory Proxy (examples/ux/PagingMemoryProxy.js)</li>\n * </ul></div>\n * @constructor Create a new PagingToolbar\n * @param {Object} config The config object\n * @xtype paging\n */\n(function() {\n\nvar T = Ext.Toolbar;\n\nExt.PagingToolbar = Ext.extend(Ext.Toolbar, {\n    /**\n     * @cfg {Ext.data.Store} store\n     * The {@link Ext.data.Store} the paging toolbar should use as its data source (required).\n     */\n    /**\n     * @cfg {Boolean} displayInfo\n     * <tt>true</tt> to display the displayMsg (defaults to <tt>false</tt>)\n     */\n    /**\n     * @cfg {Number} pageSize\n     * The number of records to display per page (defaults to <tt>20</tt>)\n     */\n    pageSize : 20,\n    /**\n     * @cfg {Boolean} prependButtons\n     * <tt>true</tt> to insert any configured <tt>items</tt> <i>before</i> the paging buttons.\n     * Defaults to <tt>false</tt>.\n     */\n    /**\n     * @cfg {String} displayMsg\n     * The paging status message to display (defaults to <tt>'Displaying {0} - {1} of {2}'</tt>).\n     * Note that this string is formatted using the braced numbers <tt>{0}-{2}</tt> as tokens\n     * that are replaced by the values for start, end and total respectively. These tokens should\n     * be preserved when overriding this string if showing those values is desired.\n     */\n    displayMsg : 'Displaying {0} - {1} of {2}',\n    /**\n     * @cfg {String} emptyMsg\n     * The message to display when no records are found (defaults to 'No data to display')\n     */\n    emptyMsg : 'No data to display',\n    /**\n     * @cfg {String} beforePageText\n     * The text displayed before the input item (defaults to <tt>'Page'</tt>).\n     */\n    beforePageText : 'Page',\n    /**\n     * @cfg {String} afterPageText\n     * Customizable piece of the default paging text (defaults to <tt>'of {0}'</tt>). Note that\n     * this string is formatted using <tt>{0}</tt> as a token that is replaced by the number of\n     * total pages. This token should be preserved when overriding this string if showing the\n     * total page count is desired.\n     */\n    afterPageText : 'of {0}',\n    /**\n     * @cfg {String} firstText\n     * The quicktip text displayed for the first page button (defaults to <tt>'First Page'</tt>).\n     * <b>Note</b>: quick tips must be initialized for the quicktip to show.\n     */\n    firstText : 'First Page',\n    /**\n     * @cfg {String} prevText\n     * The quicktip text displayed for the previous page button (defaults to <tt>'Previous Page'</tt>).\n     * <b>Note</b>: quick tips must be initialized for the quicktip to show.\n     */\n    prevText : 'Previous Page',\n    /**\n     * @cfg {String} nextText\n     * The quicktip text displayed for the next page button (defaults to <tt>'Next Page'</tt>).\n     * <b>Note</b>: quick tips must be initialized for the quicktip to show.\n     */\n    nextText : 'Next Page',\n    /**\n     * @cfg {String} lastText\n     * The quicktip text displayed for the last page button (defaults to <tt>'Last Page'</tt>).\n     * <b>Note</b>: quick tips must be initialized for the quicktip to show.\n     */\n    lastText : 'Last Page',\n    /**\n     * @cfg {String} refreshText\n     * The quicktip text displayed for the Refresh button (defaults to <tt>'Refresh'</tt>).\n     * <b>Note</b>: quick tips must be initialized for the quicktip to show.\n     */\n    refreshText : 'Refresh',\n\n    /**\n     * <p><b>Deprecated</b>. <code>paramNames</code> should be set in the <b>data store</b>\n     * (see {@link Ext.data.Store#paramNames}).</p>\n     * <br><p>Object mapping of parameter names used for load calls, initially set to:</p>\n     * <pre>{start: 'start', limit: 'limit'}</pre>\n     * @type Object\n     * @property paramNames\n     * @deprecated\n     */\n\n    /**\n     * The number of records to display per page.  See also <tt>{@link #cursor}</tt>.\n     * @type Number\n     * @property pageSize\n     */\n\n    /**\n     * Indicator for the record position.  This property might be used to get the active page\n     * number for example:<pre><code>\n     * // t is reference to the paging toolbar instance\n     * var activePage = Math.ceil((t.cursor + t.pageSize) / t.pageSize);\n     * </code></pre>\n     * @type Number\n     * @property cursor\n     */\n\n    initComponent : function(){\n        var pagingItems = [this.first = new T.Button({\n            tooltip: this.firstText,\n            overflowText: this.firstText,\n            iconCls: 'x-tbar-page-first',\n            disabled: true,\n            handler: this.moveFirst,\n            scope: this\n        }), this.prev = new T.Button({\n            tooltip: this.prevText,\n            overflowText: this.prevText,\n            iconCls: 'x-tbar-page-prev',\n            disabled: true,\n            handler: this.movePrevious,\n            scope: this\n        }), '-', this.beforePageText,\n        this.inputItem = new Ext.form.NumberField({\n            cls: 'x-tbar-page-number',\n            allowDecimals: false,\n            allowNegative: false,\n            enableKeyEvents: true,\n            selectOnFocus: true,\n            submitValue: false,\n            listeners: {\n                scope: this,\n                keydown: this.onPagingKeyDown,\n                blur: this.onPagingBlur\n            }\n        }), this.afterTextItem = new T.TextItem({\n            text: String.format(this.afterPageText, 1)\n        }), '-', this.next = new T.Button({\n            tooltip: this.nextText,\n            overflowText: this.nextText,\n            iconCls: 'x-tbar-page-next',\n            disabled: true,\n            handler: this.moveNext,\n            scope: this\n        }), this.last = new T.Button({\n            tooltip: this.lastText,\n            overflowText: this.lastText,\n            iconCls: 'x-tbar-page-last',\n            disabled: true,\n            handler: this.moveLast,\n            scope: this\n        }), '-', this.refresh = new T.Button({\n            tooltip: this.refreshText,\n            overflowText: this.refreshText,\n            iconCls: 'x-tbar-loading',\n            handler: this.doRefresh,\n            scope: this\n        })];\n\n\n        var userItems = this.items || this.buttons || [];\n        if (this.prependButtons) {\n            this.items = userItems.concat(pagingItems);\n        }else{\n            this.items = pagingItems.concat(userItems);\n        }\n        delete this.buttons;\n        if(this.displayInfo){\n            this.items.push('->');\n            this.items.push(this.displayItem = new T.TextItem({}));\n        }\n        Ext.PagingToolbar.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event change\n             * Fires after the active page has been changed.\n             * @param {Ext.PagingToolbar} this\n             * @param {Object} pageData An object that has these properties:<ul>\n             * <li><code>total</code> : Number <div class=\"sub-desc\">The total number of records in the dataset as\n             * returned by the server</div></li>\n             * <li><code>activePage</code> : Number <div class=\"sub-desc\">The current page number</div></li>\n             * <li><code>pages</code> : Number <div class=\"sub-desc\">The total number of pages (calculated from\n             * the total number of records in the dataset as returned by the server and the current {@link #pageSize})</div></li>\n             * </ul>\n             */\n            'change',\n            /**\n             * @event beforechange\n             * Fires just before the active page is changed.\n             * Return false to prevent the active page from being changed.\n             * @param {Ext.PagingToolbar} this\n             * @param {Object} params An object hash of the parameters which the PagingToolbar will send when\n             * loading the required page. This will contain:<ul>\n             * <li><code>start</code> : Number <div class=\"sub-desc\">The starting row number for the next page of records to\n             * be retrieved from the server</div></li>\n             * <li><code>limit</code> : Number <div class=\"sub-desc\">The number of records to be retrieved from the server</div></li>\n             * </ul>\n             * <p>(note: the names of the <b>start</b> and <b>limit</b> properties are determined\n             * by the store's {@link Ext.data.Store#paramNames paramNames} property.)</p>\n             * <p>Parameters may be added as required in the event handler.</p>\n             */\n            'beforechange'\n        );\n        this.on('afterlayout', this.onFirstLayout, this, {single: true});\n        this.cursor = 0;\n        this.bindStore(this.store, true);\n    },\n\n    // private\n    onFirstLayout : function(){\n        if(this.dsLoaded){\n            this.onLoad.apply(this, this.dsLoaded);\n        }\n    },\n\n    // private\n    updateInfo : function(){\n        if(this.displayItem){\n            var count = this.store.getCount();\n            var msg = count == 0 ?\n                this.emptyMsg :\n                String.format(\n                    this.displayMsg,\n                    this.cursor+1, this.cursor+count, this.store.getTotalCount()\n                );\n            this.displayItem.setText(msg);\n        }\n    },\n\n    // private\n    onLoad : function(store, r, o){\n        if(!this.rendered){\n            this.dsLoaded = [store, r, o];\n            return;\n        }\n        var p = this.getParams();\n        this.cursor = (o.params && o.params[p.start]) ? o.params[p.start] : 0;\n        var d = this.getPageData(), ap = d.activePage, ps = d.pages;\n\n        this.afterTextItem.setText(String.format(this.afterPageText, d.pages));\n        this.inputItem.setValue(ap);\n        this.first.setDisabled(ap == 1);\n        this.prev.setDisabled(ap == 1);\n        this.next.setDisabled(ap == ps);\n        this.last.setDisabled(ap == ps);\n        this.refresh.enable();\n        this.updateInfo();\n        this.fireEvent('change', this, d);\n    },\n\n    // private\n    getPageData : function(){\n        var total = this.store.getTotalCount();\n        return {\n            total : total,\n            activePage : Math.ceil((this.cursor+this.pageSize)/this.pageSize),\n            pages :  total < this.pageSize ? 1 : Math.ceil(total/this.pageSize)\n        };\n    },\n\n    /**\n     * Change the active page\n     * @param {Integer} page The page to display\n     */\n    changePage : function(page){\n        this.doLoad(((page-1) * this.pageSize).constrain(0, this.store.getTotalCount()));\n    },\n\n    // private\n    onLoadError : function(){\n        if(!this.rendered){\n            return;\n        }\n        this.refresh.enable();\n    },\n\n    // private\n    readPage : function(d){\n        var v = this.inputItem.getValue(), pageNum;\n        if (!v || isNaN(pageNum = parseInt(v, 10))) {\n            this.inputItem.setValue(d.activePage);\n            return false;\n        }\n        return pageNum;\n    },\n\n    onPagingFocus : function(){\n        this.inputItem.select();\n    },\n\n    //private\n    onPagingBlur : function(e){\n        this.inputItem.setValue(this.getPageData().activePage);\n    },\n\n    // private\n    onPagingKeyDown : function(field, e){\n        var k = e.getKey(), d = this.getPageData(), pageNum;\n        if (k == e.RETURN) {\n            e.stopEvent();\n            pageNum = this.readPage(d);\n            if(pageNum !== false){\n                pageNum = Math.min(Math.max(1, pageNum), d.pages) - 1;\n                this.doLoad(pageNum * this.pageSize);\n            }\n        }else if (k == e.HOME || k == e.END){\n            e.stopEvent();\n            pageNum = k == e.HOME ? 1 : d.pages;\n            field.setValue(pageNum);\n        }else if (k == e.UP || k == e.PAGEUP || k == e.DOWN || k == e.PAGEDOWN){\n            e.stopEvent();\n            if((pageNum = this.readPage(d))){\n                var increment = e.shiftKey ? 10 : 1;\n                if(k == e.DOWN || k == e.PAGEDOWN){\n                    increment *= -1;\n                }\n                pageNum += increment;\n                if(pageNum >= 1 & pageNum <= d.pages){\n                    field.setValue(pageNum);\n                }\n            }\n        }\n    },\n\n    // private\n    getParams : function(){\n        //retain backwards compat, allow params on the toolbar itself, if they exist.\n        return this.paramNames || this.store.paramNames;\n    },\n\n    // private\n    beforeLoad : function(){\n        if(this.rendered && this.refresh){\n            this.refresh.disable();\n        }\n    },\n\n    // private\n    doLoad : function(start){\n        var o = {}, pn = this.getParams();\n        o[pn.start] = start;\n        o[pn.limit] = this.pageSize;\n        if(this.fireEvent('beforechange', this, o) !== false){\n            this.store.load({params:o});\n        }\n    },\n\n    /**\n     * Move to the first page, has the same effect as clicking the 'first' button.\n     */\n    moveFirst : function(){\n        this.doLoad(0);\n    },\n\n    /**\n     * Move to the previous page, has the same effect as clicking the 'previous' button.\n     */\n    movePrevious : function(){\n        this.doLoad(Math.max(0, this.cursor-this.pageSize));\n    },\n\n    /**\n     * Move to the next page, has the same effect as clicking the 'next' button.\n     */\n    moveNext : function(){\n        this.doLoad(this.cursor+this.pageSize);\n    },\n\n    /**\n     * Move to the last page, has the same effect as clicking the 'last' button.\n     */\n    moveLast : function(){\n        var total = this.store.getTotalCount(),\n            extra = total % this.pageSize;\n\n        this.doLoad(extra ? (total - extra) : total - this.pageSize);\n    },\n\n    /**\n     * Refresh the current page, has the same effect as clicking the 'refresh' button.\n     */\n    doRefresh : function(){\n        this.doLoad(this.cursor);\n    },\n\n    /**\n     * Binds the paging toolbar to the specified {@link Ext.data.Store}\n     * @param {Store} store The store to bind to this toolbar\n     * @param {Boolean} initial (Optional) true to not remove listeners\n     */\n    bindStore : function(store, initial){\n        var doLoad;\n        if(!initial && this.store){\n            if(store !== this.store && this.store.autoDestroy){\n                this.store.destroy();\n            }else{\n                this.store.un('beforeload', this.beforeLoad, this);\n                this.store.un('load', this.onLoad, this);\n                this.store.un('exception', this.onLoadError, this);\n            }\n            if(!store){\n                this.store = null;\n            }\n        }\n        if(store){\n            store = Ext.StoreMgr.lookup(store);\n            store.on({\n                scope: this,\n                beforeload: this.beforeLoad,\n                load: this.onLoad,\n                exception: this.onLoadError\n            });\n            doLoad = true;\n        }\n        this.store = store;\n        if(doLoad){\n            this.onLoad(store, null, {});\n        }\n    },\n\n    /**\n     * Unbinds the paging toolbar from the specified {@link Ext.data.Store} <b>(deprecated)</b>\n     * @param {Ext.data.Store} store The data store to unbind\n     */\n    unbind : function(store){\n        this.bindStore(null);\n    },\n\n    /**\n     * Binds the paging toolbar to the specified {@link Ext.data.Store} <b>(deprecated)</b>\n     * @param {Ext.data.Store} store The data store to bind\n     */\n    bind : function(store){\n        this.bindStore(store);\n    },\n\n    // private\n    onDestroy : function(){\n        this.bindStore(null);\n        Ext.PagingToolbar.superclass.onDestroy.call(this);\n    }\n});\n\n})();\nExt.reg('paging', Ext.PagingToolbar);/**\n * @class Ext.History\n * @extends Ext.util.Observable\n * History management component that allows you to register arbitrary tokens that signify application\n * history state on navigation actions.  You can then handle the history {@link #change} event in order\n * to reset your application UI to the appropriate state when the user navigates forward or backward through\n * the browser history stack.\n * @singleton\n */\nExt.History = (function () {\n    var iframe, hiddenField;\n    var ready = false;\n    var currentToken;\n\n    function getHash() {\n        var href = location.href, i = href.indexOf(\"#\"),\n            hash = i >= 0 ? href.substr(i + 1) : null;\n             \n        if (Ext.isGecko) {\n            hash = decodeURIComponent(hash);\n        }\n        return hash;\n    }\n\n    function doSave() {\n        hiddenField.value = currentToken;\n    }\n\n    function handleStateChange(token) {\n        currentToken = token;\n        Ext.History.fireEvent('change', token);\n    }\n\n    function updateIFrame (token) {\n        var html = ['<html><body><div id=\"state\">',Ext.util.Format.htmlEncode(token),'</div></body></html>'].join('');\n        try {\n            var doc = iframe.contentWindow.document;\n            doc.open();\n            doc.write(html);\n            doc.close();\n            return true;\n        } catch (e) {\n            return false;\n        }\n    }\n\n    function checkIFrame() {\n        if (!iframe.contentWindow || !iframe.contentWindow.document) {\n            setTimeout(checkIFrame, 10);\n            return;\n        }\n\n        var doc = iframe.contentWindow.document;\n        var elem = doc.getElementById(\"state\");\n        var token = elem ? elem.innerText : null;\n\n        var hash = getHash();\n\n        setInterval(function () {\n\n            doc = iframe.contentWindow.document;\n            elem = doc.getElementById(\"state\");\n\n            var newtoken = elem ? elem.innerText : null;\n\n            var newHash = getHash();\n\n            if (newtoken !== token) {\n                token = newtoken;\n                handleStateChange(token);\n                location.hash = token;\n                hash = token;\n                doSave();\n            } else if (newHash !== hash) {\n                hash = newHash;\n                updateIFrame(newHash);\n            }\n\n        }, 50);\n\n        ready = true;\n\n        Ext.History.fireEvent('ready', Ext.History);\n    }\n\n    function startUp() {\n        currentToken = hiddenField.value ? hiddenField.value : getHash();\n\n        if (Ext.isIE) {\n            checkIFrame();\n        } else {\n            var hash = getHash();\n            setInterval(function () {\n                var newHash = getHash();\n                if (newHash !== hash) {\n                    hash = newHash;\n                    handleStateChange(hash);\n                    doSave();\n                }\n            }, 50);\n            ready = true;\n            Ext.History.fireEvent('ready', Ext.History);\n        }\n    }\n\n    return {\n        /**\n         * The id of the hidden field required for storing the current history token.\n         * @type String\n         * @property\n         */\n        fieldId: 'x-history-field',\n        /**\n         * The id of the iframe required by IE to manage the history stack.\n         * @type String\n         * @property\n         */\n        iframeId: 'x-history-frame',\n\n        events:{},\n\n        /**\n         * Initialize the global History instance.\n         * @param {Boolean} onReady (optional) A callback function that will be called once the history\n         * component is fully initialized.\n         * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the callback is executed. Defaults to the browser window.\n         */\n        init: function (onReady, scope) {\n            if(ready) {\n                Ext.callback(onReady, scope, [this]);\n                return;\n            }\n            if(!Ext.isReady){\n                Ext.onReady(function(){\n                    Ext.History.init(onReady, scope);\n                });\n                return;\n            }\n            hiddenField = Ext.getDom(Ext.History.fieldId);\n            if (Ext.isIE) {\n                iframe = Ext.getDom(Ext.History.iframeId);\n            }\n            this.addEvents(\n                /**\n                 * @event ready\n                 * Fires when the Ext.History singleton has been initialized and is ready for use.\n                 * @param {Ext.History} The Ext.History singleton.\n                 */\n                'ready',\n                /**\n                 * @event change\n                 * Fires when navigation back or forwards within the local page's history occurs.\n                 * @param {String} token An identifier associated with the page state at that point in its history.\n                 */\n                'change'\n            );\n            if(onReady){\n                this.on('ready', onReady, scope, {single:true});\n            }\n            startUp();\n        },\n\n        /**\n         * Add a new token to the history stack. This can be any arbitrary value, although it would\n         * commonly be the concatenation of a component id and another id marking the specifc history\n         * state of that component.  Example usage:\n         * <pre><code>\n// Handle tab changes on a TabPanel\ntabPanel.on('tabchange', function(tabPanel, tab){\n    Ext.History.add(tabPanel.id + ':' + tab.id);\n});\n</code></pre>\n         * @param {String} token The value that defines a particular application-specific history state\n         * @param {Boolean} preventDuplicates When true, if the passed token matches the current token\n         * it will not save a new history step. Set to false if the same state can be saved more than once\n         * at the same history stack location (defaults to true).\n         */\n        add: function (token, preventDup) {\n            if(preventDup !== false){\n                if(this.getToken() == token){\n                    return true;\n                }\n            }\n            if (Ext.isIE) {\n                return updateIFrame(token);\n            } else {\n                location.hash = token;\n                return true;\n            }\n        },\n\n        /**\n         * Programmatically steps back one step in browser history (equivalent to the user pressing the Back button).\n         */\n        back: function(){\n            history.go(-1);\n        },\n\n        /**\n         * Programmatically steps forward one step in browser history (equivalent to the user pressing the Forward button).\n         */\n        forward: function(){\n            history.go(1);\n        },\n\n        /**\n         * Retrieves the currently-active history token.\n         * @return {String} The token\n         */\n        getToken: function() {\n            return ready ? currentToken : getHash();\n        }\n    };\n})();\nExt.apply(Ext.History, new Ext.util.Observable());/**\n * @class Ext.Tip\n * @extends Ext.Panel\n * @xtype tip\n * This is the base class for {@link Ext.QuickTip} and {@link Ext.Tooltip} that provides the basic layout and\n * positioning that all tip-based classes require. This class can be used directly for simple, statically-positioned\n * tips that are displayed programmatically, or it can be extended to provide custom tip implementations.\n * @constructor\n * Create a new Tip\n * @param {Object} config The configuration options\n */\nExt.Tip = Ext.extend(Ext.Panel, {\n    /**\n     * @cfg {Boolean} closable True to render a close tool button into the tooltip header (defaults to false).\n     */\n    /**\n     * @cfg {Number} width\n     * Width in pixels of the tip (defaults to auto).  Width will be ignored if it exceeds the bounds of\n     * {@link #minWidth} or {@link #maxWidth}.  The maximum supported value is 500.\n     */\n    /**\n     * @cfg {Number} minWidth The minimum width of the tip in pixels (defaults to 40).\n     */\n    minWidth : 40,\n    /**\n     * @cfg {Number} maxWidth The maximum width of the tip in pixels (defaults to 300).  The maximum supported value is 500.\n     */\n    maxWidth : 300,\n    /**\n     * @cfg {Boolean/String} shadow True or \"sides\" for the default effect, \"frame\" for 4-way shadow, and \"drop\"\n     * for bottom-right shadow (defaults to \"sides\").\n     */\n    shadow : \"sides\",\n    /**\n     * @cfg {String} defaultAlign <b>Experimental</b>. The default {@link Ext.Element#alignTo} anchor position value\n     * for this tip relative to its element of origin (defaults to \"tl-bl?\").\n     */\n    defaultAlign : \"tl-bl?\",\n    autoRender: true,\n    quickShowInterval : 250,\n\n    // private panel overrides\n    frame:true,\n    hidden:true,\n    baseCls: 'x-tip',\n    floating:{shadow:true,shim:true,useDisplay:true,constrain:false},\n    autoHeight:true,\n\n    closeAction: 'hide',\n\n    // private\n    initComponent : function(){\n        Ext.Tip.superclass.initComponent.call(this);\n        if(this.closable && !this.title){\n            this.elements += ',header';\n        }\n    },\n\n    // private\n    afterRender : function(){\n        Ext.Tip.superclass.afterRender.call(this);\n        if(this.closable){\n            this.addTool({\n                id: 'close',\n                handler: this[this.closeAction],\n                scope: this\n            });\n        }\n    },\n\n    /**\n     * Shows this tip at the specified XY position.  Example usage:\n     * <pre><code>\n// Show the tip at x:50 and y:100\ntip.showAt([50,100]);\n</code></pre>\n     * @param {Array} xy An array containing the x and y coordinates\n     */\n    showAt : function(xy){\n        Ext.Tip.superclass.show.call(this);\n        if(this.measureWidth !== false && (!this.initialConfig || typeof this.initialConfig.width != 'number')){\n            this.doAutoWidth();\n        }\n        if(this.constrainPosition){\n            xy = this.el.adjustForConstraints(xy);\n        }\n        this.setPagePosition(xy[0], xy[1]);\n    },\n\n    // protected\n    doAutoWidth : function(adjust){\n        adjust = adjust || 0;\n        var bw = this.body.getTextWidth();\n        if(this.title){\n            bw = Math.max(bw, this.header.child('span').getTextWidth(this.title));\n        }\n        bw += this.getFrameWidth() + (this.closable ? 20 : 0) + this.body.getPadding(\"lr\") + adjust;\n        this.setWidth(bw.constrain(this.minWidth, this.maxWidth));\n        \n        // IE7 repaint bug on initial show\n        if(Ext.isIE7 && !this.repainted){\n            this.el.repaint();\n            this.repainted = true;\n        }\n    },\n\n    /**\n     * <b>Experimental</b>. Shows this tip at a position relative to another element using a standard {@link Ext.Element#alignTo}\n     * anchor position value.  Example usage:\n     * <pre><code>\n// Show the tip at the default position ('tl-br?')\ntip.showBy('my-el');\n\n// Show the tip's top-left corner anchored to the element's top-right corner\ntip.showBy('my-el', 'tl-tr');\n</code></pre>\n     * @param {Mixed} el An HTMLElement, Ext.Element or string id of the target element to align to\n     * @param {String} position (optional) A valid {@link Ext.Element#alignTo} anchor position (defaults to 'tl-br?' or\n     * {@link #defaultAlign} if specified).\n     */\n    showBy : function(el, pos){\n        if(!this.rendered){\n            this.render(Ext.getBody());\n        }\n        this.showAt(this.el.getAlignToXY(el, pos || this.defaultAlign));\n    },\n\n    initDraggable : function(){\n        this.dd = new Ext.Tip.DD(this, typeof this.draggable == 'boolean' ? null : this.draggable);\n        this.header.addClass('x-tip-draggable');\n    }\n});\n\nExt.reg('tip', Ext.Tip);\n\n// private - custom Tip DD implementation\nExt.Tip.DD = function(tip, config){\n    Ext.apply(this, config);\n    this.tip = tip;\n    Ext.Tip.DD.superclass.constructor.call(this, tip.el.id, 'WindowDD-'+tip.id);\n    this.setHandleElId(tip.header.id);\n    this.scroll = false;\n};\n\nExt.extend(Ext.Tip.DD, Ext.dd.DD, {\n    moveOnly:true,\n    scroll:false,\n    headerOffsets:[100, 25],\n    startDrag : function(){\n        this.tip.el.disableShadow();\n    },\n    endDrag : function(e){\n        this.tip.el.enableShadow(true);\n    }\n});/**\n * @class Ext.ToolTip\n * @extends Ext.Tip\n * A standard tooltip implementation for providing additional information when hovering over a target element.\n * @xtype tooltip\n * @constructor\n * Create a new Tooltip\n * @param {Object} config The configuration options\n */\nExt.ToolTip = Ext.extend(Ext.Tip, {\n    /**\n     * When a Tooltip is configured with the <code>{@link #delegate}</code>\n     * option to cause selected child elements of the <code>{@link #target}</code>\n     * Element to each trigger a seperate show event, this property is set to\n     * the DOM element which triggered the show.\n     * @type DOMElement\n     * @property triggerElement\n     */\n    /**\n     * @cfg {Mixed} target The target HTMLElement, Ext.Element or id to monitor\n     * for mouseover events to trigger showing this ToolTip.\n     */\n    /**\n     * @cfg {Boolean} autoHide True to automatically hide the tooltip after the\n     * mouse exits the target element or after the <code>{@link #dismissDelay}</code>\n     * has expired if set (defaults to true).  If <code>{@link closable} = true</code>\n     * a close tool button will be rendered into the tooltip header.\n     */\n    /**\n     * @cfg {Number} showDelay Delay in milliseconds before the tooltip displays\n     * after the mouse enters the target element (defaults to 500)\n     */\n    showDelay : 500,\n    /**\n     * @cfg {Number} hideDelay Delay in milliseconds after the mouse exits the\n     * target element but before the tooltip actually hides (defaults to 200).\n     * Set to 0 for the tooltip to hide immediately.\n     */\n    hideDelay : 200,\n    /**\n     * @cfg {Number} dismissDelay Delay in milliseconds before the tooltip\n     * automatically hides (defaults to 5000). To disable automatic hiding, set\n     * dismissDelay = 0.\n     */\n    dismissDelay : 5000,\n    /**\n     * @cfg {Array} mouseOffset An XY offset from the mouse position where the\n     * tooltip should be shown (defaults to [15,18]).\n     */\n    /**\n     * @cfg {Boolean} trackMouse True to have the tooltip follow the mouse as it\n     * moves over the target element (defaults to false).\n     */\n    trackMouse : false,\n    /**\n     * @cfg {Boolean} anchorToTarget True to anchor the tooltip to the target\n     * element, false to anchor it relative to the mouse coordinates (defaults\n     * to true).  When <code>anchorToTarget</code> is true, use\n     * <code>{@link #defaultAlign}</code> to control tooltip alignment to the\n     * target element.  When <code>anchorToTarget</code> is false, use\n     * <code>{@link #anchorPosition}</code> instead to control alignment.\n     */\n    anchorToTarget : true,\n    /**\n     * @cfg {Number} anchorOffset A numeric pixel value used to offset the\n     * default position of the anchor arrow (defaults to 0).  When the anchor\n     * position is on the top or bottom of the tooltip, <code>anchorOffset</code>\n     * will be used as a horizontal offset.  Likewise, when the anchor position\n     * is on the left or right side, <code>anchorOffset</code> will be used as\n     * a vertical offset.\n     */\n    anchorOffset : 0,\n    /**\n     * @cfg {String} delegate <p>Optional. A {@link Ext.DomQuery DomQuery}\n     * selector which allows selection of individual elements within the\n     * <code>{@link #target}</code> element to trigger showing and hiding the\n     * ToolTip as the mouse moves within the target.</p>\n     * <p>When specified, the child element of the target which caused a show\n     * event is placed into the <code>{@link #triggerElement}</code> property\n     * before the ToolTip is shown.</p>\n     * <p>This may be useful when a Component has regular, repeating elements\n     * in it, each of which need a Tooltip which contains information specific\n     * to that element. For example:</p><pre><code>\nvar myGrid = new Ext.grid.gridPanel(gridConfig);\nmyGrid.on('render', function(grid) {\n    var store = grid.getStore();  // Capture the Store.\n    var view = grid.getView();    // Capture the GridView.\n    myGrid.tip = new Ext.ToolTip({\n        target: view.mainBody,    // The overall target element.\n        delegate: '.x-grid3-row', // Each grid row causes its own seperate show and hide.\n        trackMouse: true,         // Moving within the row should not hide the tip.\n        renderTo: document.body,  // Render immediately so that tip.body can be\n                                  //  referenced prior to the first show.\n        listeners: {              // Change content dynamically depending on which element\n                                  //  triggered the show.\n            beforeshow: function updateTipBody(tip) {\n                var rowIndex = view.findRowIndex(tip.triggerElement);\n                tip.body.dom.innerHTML = 'Over Record ID ' + store.getAt(rowIndex).id;\n            }\n        }\n    });\n});\n     *</code></pre>\n     */\n\n    // private\n    targetCounter : 0,\n\n    constrainPosition : false,\n\n    // private\n    initComponent : function(){\n        Ext.ToolTip.superclass.initComponent.call(this);\n        this.lastActive = new Date();\n        this.initTarget(this.target);\n        this.origAnchor = this.anchor;\n    },\n\n    // private\n    onRender : function(ct, position){\n        Ext.ToolTip.superclass.onRender.call(this, ct, position);\n        this.anchorCls = 'x-tip-anchor-' + this.getAnchorPosition();\n        this.anchorEl = this.el.createChild({\n            cls: 'x-tip-anchor ' + this.anchorCls\n        });\n    },\n\n    // private\n    afterRender : function(){\n        Ext.ToolTip.superclass.afterRender.call(this);\n        this.anchorEl.setStyle('z-index', this.el.getZIndex() + 1).setVisibilityMode(Ext.Element.DISPLAY);\n    },\n\n    /**\n     * Binds this ToolTip to the specified element. The tooltip will be displayed when the mouse moves over the element.\n     * @param {Mixed} t The Element, HtmlElement, or ID of an element to bind to\n     */\n    initTarget : function(target){\n        var t;\n        if((t = Ext.get(target))){\n            if(this.target){\n                var tg = Ext.get(this.target);\n                this.mun(tg, 'mouseover', this.onTargetOver, this);\n                this.mun(tg, 'mouseout', this.onTargetOut, this);\n                this.mun(tg, 'mousemove', this.onMouseMove, this);\n            }\n            this.mon(t, {\n                mouseover: this.onTargetOver,\n                mouseout: this.onTargetOut,\n                mousemove: this.onMouseMove,\n                scope: this\n            });\n            this.target = t;\n        }\n        if(this.anchor){\n            this.anchorTarget = this.target;\n        }\n    },\n\n    // private\n    onMouseMove : function(e){\n        var t = this.delegate ? e.getTarget(this.delegate) : this.triggerElement = true;\n        if (t) {\n            this.targetXY = e.getXY();\n            if (t === this.triggerElement) {\n                if(!this.hidden && this.trackMouse){\n                    this.setPagePosition(this.getTargetXY());\n                }\n            } else {\n                this.hide();\n                this.lastActive = new Date(0);\n                this.onTargetOver(e);\n            }\n        } else if (!this.closable && this.isVisible()) {\n            this.hide();\n        }\n    },\n\n    // private\n    getTargetXY : function(){\n        if(this.delegate){\n            this.anchorTarget = this.triggerElement;\n        }\n        if(this.anchor){\n            this.targetCounter++;\n            var offsets = this.getOffsets(),\n                xy = (this.anchorToTarget && !this.trackMouse) ? this.el.getAlignToXY(this.anchorTarget, this.getAnchorAlign()) : this.targetXY,\n                dw = Ext.lib.Dom.getViewWidth() - 5,\n                dh = Ext.lib.Dom.getViewHeight() - 5,\n                de = document.documentElement,\n                bd = document.body,\n                scrollX = (de.scrollLeft || bd.scrollLeft || 0) + 5,\n                scrollY = (de.scrollTop || bd.scrollTop || 0) + 5,\n                axy = [xy[0] + offsets[0], xy[1] + offsets[1]],\n                sz = this.getSize();\n                \n            this.anchorEl.removeClass(this.anchorCls);\n\n            if(this.targetCounter < 2){\n                if(axy[0] < scrollX){\n                    if(this.anchorToTarget){\n                        this.defaultAlign = 'l-r';\n                        if(this.mouseOffset){this.mouseOffset[0] *= -1;}\n                    }\n                    this.anchor = 'left';\n                    return this.getTargetXY();\n                }\n                if(axy[0]+sz.width > dw){\n                    if(this.anchorToTarget){\n                        this.defaultAlign = 'r-l';\n                        if(this.mouseOffset){this.mouseOffset[0] *= -1;}\n                    }\n                    this.anchor = 'right';\n                    return this.getTargetXY();\n                }\n                if(axy[1] < scrollY){\n                    if(this.anchorToTarget){\n                        this.defaultAlign = 't-b';\n                        if(this.mouseOffset){this.mouseOffset[1] *= -1;}\n                    }\n                    this.anchor = 'top';\n                    return this.getTargetXY();\n                }\n                if(axy[1]+sz.height > dh){\n                    if(this.anchorToTarget){\n                        this.defaultAlign = 'b-t';\n                        if(this.mouseOffset){this.mouseOffset[1] *= -1;}\n                    }\n                    this.anchor = 'bottom';\n                    return this.getTargetXY();\n                }\n            }\n\n            this.anchorCls = 'x-tip-anchor-'+this.getAnchorPosition();\n            this.anchorEl.addClass(this.anchorCls);\n            this.targetCounter = 0;\n            return axy;\n        }else{\n            var mouseOffset = this.getMouseOffset();\n            return [this.targetXY[0]+mouseOffset[0], this.targetXY[1]+mouseOffset[1]];\n        }\n    },\n\n    getMouseOffset : function(){\n        var offset = this.anchor ? [0,0] : [15,18];\n        if(this.mouseOffset){\n            offset[0] += this.mouseOffset[0];\n            offset[1] += this.mouseOffset[1];\n        }\n        return offset;\n    },\n\n    // private\n    getAnchorPosition : function(){\n        if(this.anchor){\n            this.tipAnchor = this.anchor.charAt(0);\n        }else{\n            var m = this.defaultAlign.match(/^([a-z]+)-([a-z]+)(\\?)?$/);\n            if(!m){\n               throw 'AnchorTip.defaultAlign is invalid';\n            }\n            this.tipAnchor = m[1].charAt(0);\n        }\n\n        switch(this.tipAnchor){\n            case 't': return 'top';\n            case 'b': return 'bottom';\n            case 'r': return 'right';\n        }\n        return 'left';\n    },\n\n    // private\n    getAnchorAlign : function(){\n        switch(this.anchor){\n            case 'top'  : return 'tl-bl';\n            case 'left' : return 'tl-tr';\n            case 'right': return 'tr-tl';\n            default     : return 'bl-tl';\n        }\n    },\n\n    // private\n    getOffsets : function(){\n        var offsets, \n            ap = this.getAnchorPosition().charAt(0);\n        if(this.anchorToTarget && !this.trackMouse){\n            switch(ap){\n                case 't':\n                    offsets = [0, 9];\n                    break;\n                case 'b':\n                    offsets = [0, -13];\n                    break;\n                case 'r':\n                    offsets = [-13, 0];\n                    break;\n                default:\n                    offsets = [9, 0];\n                    break;\n            }\n        }else{\n            switch(ap){\n                case 't':\n                    offsets = [-15-this.anchorOffset, 30];\n                    break;\n                case 'b':\n                    offsets = [-19-this.anchorOffset, -13-this.el.dom.offsetHeight];\n                    break;\n                case 'r':\n                    offsets = [-15-this.el.dom.offsetWidth, -13-this.anchorOffset];\n                    break;\n                default:\n                    offsets = [25, -13-this.anchorOffset];\n                    break;\n            }\n        }\n        var mouseOffset = this.getMouseOffset();\n        offsets[0] += mouseOffset[0];\n        offsets[1] += mouseOffset[1];\n\n        return offsets;\n    },\n\n    // private\n    onTargetOver : function(e){\n        if(this.disabled || e.within(this.target.dom, true)){\n            return;\n        }\n        var t = e.getTarget(this.delegate);\n        if (t) {\n            this.triggerElement = t;\n            this.clearTimer('hide');\n            this.targetXY = e.getXY();\n            this.delayShow();\n        }\n    },\n\n    // private\n    delayShow : function(){\n        if(this.hidden && !this.showTimer){\n            if(this.lastActive.getElapsed() < this.quickShowInterval){\n                this.show();\n            }else{\n                this.showTimer = this.show.defer(this.showDelay, this);\n            }\n        }else if(!this.hidden && this.autoHide !== false){\n            this.show();\n        }\n    },\n\n    // private\n    onTargetOut : function(e){\n        if(this.disabled || e.within(this.target.dom, true)){\n            return;\n        }\n        this.clearTimer('show');\n        if(this.autoHide !== false){\n            this.delayHide();\n        }\n    },\n\n    // private\n    delayHide : function(){\n        if(!this.hidden && !this.hideTimer){\n            this.hideTimer = this.hide.defer(this.hideDelay, this);\n        }\n    },\n\n    /**\n     * Hides this tooltip if visible.\n     */\n    hide: function(){\n        this.clearTimer('dismiss');\n        this.lastActive = new Date();\n        if(this.anchorEl){\n            this.anchorEl.hide();\n        }\n        Ext.ToolTip.superclass.hide.call(this);\n        delete this.triggerElement;\n    },\n\n    /**\n     * Shows this tooltip at the current event target XY position.\n     */\n    show : function(){\n        if(this.anchor){\n            // pre-show it off screen so that the el will have dimensions\n            // for positioning calcs when getting xy next\n            this.showAt([-1000,-1000]);\n            this.origConstrainPosition = this.constrainPosition;\n            this.constrainPosition = false;\n            this.anchor = this.origAnchor;\n        }\n        this.showAt(this.getTargetXY());\n\n        if(this.anchor){\n            this.anchorEl.show();\n            this.syncAnchor();\n            this.constrainPosition = this.origConstrainPosition;\n        }else{\n            this.anchorEl.hide();\n        }\n    },\n\n    // inherit docs\n    showAt : function(xy){\n        this.lastActive = new Date();\n        this.clearTimers();\n        Ext.ToolTip.superclass.showAt.call(this, xy);\n        if(this.dismissDelay && this.autoHide !== false){\n            this.dismissTimer = this.hide.defer(this.dismissDelay, this);\n        }\n        if(this.anchor && !this.anchorEl.isVisible()){\n            this.syncAnchor();\n            this.anchorEl.show();\n        }else{\n            this.anchorEl.hide();\n        }\n    },\n\n    // private\n    syncAnchor : function(){\n        var anchorPos, targetPos, offset;\n        switch(this.tipAnchor.charAt(0)){\n            case 't':\n                anchorPos = 'b';\n                targetPos = 'tl';\n                offset = [20+this.anchorOffset, 2];\n                break;\n            case 'r':\n                anchorPos = 'l';\n                targetPos = 'tr';\n                offset = [-2, 11+this.anchorOffset];\n                break;\n            case 'b':\n                anchorPos = 't';\n                targetPos = 'bl';\n                offset = [20+this.anchorOffset, -2];\n                break;\n            default:\n                anchorPos = 'r';\n                targetPos = 'tl';\n                offset = [2, 11+this.anchorOffset];\n                break;\n        }\n        this.anchorEl.alignTo(this.el, anchorPos+'-'+targetPos, offset);\n    },\n\n    // private\n    setPagePosition : function(x, y){\n        Ext.ToolTip.superclass.setPagePosition.call(this, x, y);\n        if(this.anchor){\n            this.syncAnchor();\n        }\n    },\n\n    // private\n    clearTimer : function(name){\n        name = name + 'Timer';\n        clearTimeout(this[name]);\n        delete this[name];\n    },\n\n    // private\n    clearTimers : function(){\n        this.clearTimer('show');\n        this.clearTimer('dismiss');\n        this.clearTimer('hide');\n    },\n\n    // private\n    onShow : function(){\n        Ext.ToolTip.superclass.onShow.call(this);\n        Ext.getDoc().on('mousedown', this.onDocMouseDown, this);\n    },\n\n    // private\n    onHide : function(){\n        Ext.ToolTip.superclass.onHide.call(this);\n        Ext.getDoc().un('mousedown', this.onDocMouseDown, this);\n    },\n\n    // private\n    onDocMouseDown : function(e){\n        if(this.autoHide !== true && !this.closable && !e.within(this.el.dom)){\n            this.disable();\n            this.doEnable.defer(100, this);\n        }\n    },\n    \n    // private\n    doEnable : function(){\n        if(!this.isDestroyed){\n            this.enable();\n        }\n    },\n\n    // private\n    onDisable : function(){\n        this.clearTimers();\n        this.hide();\n    },\n\n    // private\n    adjustPosition : function(x, y){\n        if(this.constrainPosition){\n            var ay = this.targetXY[1], h = this.getSize().height;\n            if(y <= ay && (y+h) >= ay){\n                y = ay-h-5;\n            }\n        }\n        return {x : x, y: y};\n    },\n    \n    beforeDestroy : function(){\n        this.clearTimers();\n        Ext.destroy(this.anchorEl);\n        delete this.anchorEl;\n        delete this.target;\n        delete this.anchorTarget;\n        delete this.triggerElement;\n        Ext.ToolTip.superclass.beforeDestroy.call(this);    \n    },\n\n    // private\n    onDestroy : function(){\n        Ext.getDoc().un('mousedown', this.onDocMouseDown, this);\n        Ext.ToolTip.superclass.onDestroy.call(this);\n    }\n});\n\nExt.reg('tooltip', Ext.ToolTip);/**\n * @class Ext.QuickTip\n * @extends Ext.ToolTip\n * @xtype quicktip\n * A specialized tooltip class for tooltips that can be specified in markup and automatically managed by the global\n * {@link Ext.QuickTips} instance.  See the QuickTips class header for additional usage details and examples.\n * @constructor\n * Create a new Tip\n * @param {Object} config The configuration options\n */\nExt.QuickTip = Ext.extend(Ext.ToolTip, {\n    /**\n     * @cfg {Mixed} target The target HTMLElement, Ext.Element or id to associate with this quicktip (defaults to the document).\n     */\n    /**\n     * @cfg {Boolean} interceptTitles True to automatically use the element's DOM title value if available (defaults to false).\n     */\n    interceptTitles : false,\n\n    // private\n    tagConfig : {\n        namespace : \"ext\",\n        attribute : \"qtip\",\n        width : \"qwidth\",\n        target : \"target\",\n        title : \"qtitle\",\n        hide : \"hide\",\n        cls : \"qclass\",\n        align : \"qalign\",\n        anchor : \"anchor\"\n    },\n\n    // private\n    initComponent : function(){\n        this.target = this.target || Ext.getDoc();\n        this.targets = this.targets || {};\n        Ext.QuickTip.superclass.initComponent.call(this);\n    },\n\n    /**\n     * Configures a new quick tip instance and assigns it to a target element.  The following config values are\n     * supported (for example usage, see the {@link Ext.QuickTips} class header):\n     * <div class=\"mdetail-params\"><ul>\n     * <li>autoHide</li>\n     * <li>cls</li>\n     * <li>dismissDelay (overrides the singleton value)</li>\n     * <li>target (required)</li>\n     * <li>text (required)</li>\n     * <li>title</li>\n     * <li>width</li></ul></div>\n     * @param {Object} config The config object\n     */\n    register : function(config){\n        var cs = Ext.isArray(config) ? config : arguments;\n        for(var i = 0, len = cs.length; i < len; i++){\n            var c = cs[i];\n            var target = c.target;\n            if(target){\n                if(Ext.isArray(target)){\n                    for(var j = 0, jlen = target.length; j < jlen; j++){\n                        this.targets[Ext.id(target[j])] = c;\n                    }\n                } else{\n                    this.targets[Ext.id(target)] = c;\n                }\n            }\n        }\n    },\n\n    /**\n     * Removes this quick tip from its element and destroys it.\n     * @param {String/HTMLElement/Element} el The element from which the quick tip is to be removed.\n     */\n    unregister : function(el){\n        delete this.targets[Ext.id(el)];\n    },\n    \n    /**\n     * Hides a visible tip or cancels an impending show for a particular element.\n     * @param {String/HTMLElement/Element} el The element that is the target of the tip.\n     */\n    cancelShow: function(el){\n        var at = this.activeTarget;\n        el = Ext.get(el).dom;\n        if(this.isVisible()){\n            if(at && at.el == el){\n                this.hide();\n            }\n        }else if(at && at.el == el){\n            this.clearTimer('show');\n        }\n    },\n    \n    getTipCfg: function(e) {\n        var t = e.getTarget(), \n            ttp, \n            cfg;\n        if(this.interceptTitles && t.title && Ext.isString(t.title)){\n            ttp = t.title;\n            t.qtip = ttp;\n            t.removeAttribute(\"title\");\n            e.preventDefault();\n        }else{\n            cfg = this.tagConfig;\n            ttp = t.qtip || Ext.fly(t).getAttribute(cfg.attribute, cfg.namespace);\n        }\n        return ttp;\n    },\n\n    // private\n    onTargetOver : function(e){\n        if(this.disabled){\n            return;\n        }\n        this.targetXY = e.getXY();\n        var t = e.getTarget();\n        if(!t || t.nodeType !== 1 || t == document || t == document.body){\n            return;\n        }\n        if(this.activeTarget && ((t == this.activeTarget.el) || Ext.fly(this.activeTarget.el).contains(t))){\n            this.clearTimer('hide');\n            this.show();\n            return;\n        }\n        if(t && this.targets[t.id]){\n            this.activeTarget = this.targets[t.id];\n            this.activeTarget.el = t;\n            this.anchor = this.activeTarget.anchor;\n            if(this.anchor){\n                this.anchorTarget = t;\n            }\n            this.delayShow();\n            return;\n        }\n        var ttp, et = Ext.fly(t), cfg = this.tagConfig, ns = cfg.namespace;\n        if(ttp = this.getTipCfg(e)){\n            var autoHide = et.getAttribute(cfg.hide, ns);\n            this.activeTarget = {\n                el: t,\n                text: ttp,\n                width: et.getAttribute(cfg.width, ns),\n                autoHide: autoHide != \"user\" && autoHide !== 'false',\n                title: et.getAttribute(cfg.title, ns),\n                cls: et.getAttribute(cfg.cls, ns),\n                align: et.getAttribute(cfg.align, ns)\n                \n            };\n            this.anchor = et.getAttribute(cfg.anchor, ns);\n            if(this.anchor){\n                this.anchorTarget = t;\n            }\n            this.delayShow();\n        }\n    },\n\n    // private\n    onTargetOut : function(e){\n\n        // If moving within the current target, and it does not have a new tip, ignore the mouseout\n        if (this.activeTarget && e.within(this.activeTarget.el) && !this.getTipCfg(e)) {\n            return;\n        }\n\n        this.clearTimer('show');\n        if(this.autoHide !== false){\n            this.delayHide();\n        }\n    },\n\n    // inherit docs\n    showAt : function(xy){\n        var t = this.activeTarget;\n        if(t){\n            if(!this.rendered){\n                this.render(Ext.getBody());\n                this.activeTarget = t;\n            }\n            if(t.width){\n                this.setWidth(t.width);\n                this.body.setWidth(this.adjustBodyWidth(t.width - this.getFrameWidth()));\n                this.measureWidth = false;\n            } else{\n                this.measureWidth = true;\n            }\n            this.setTitle(t.title || '');\n            this.body.update(t.text);\n            this.autoHide = t.autoHide;\n            this.dismissDelay = t.dismissDelay || this.dismissDelay;\n            if(this.lastCls){\n                this.el.removeClass(this.lastCls);\n                delete this.lastCls;\n            }\n            if(t.cls){\n                this.el.addClass(t.cls);\n                this.lastCls = t.cls;\n            }\n            if(this.anchor){\n                this.constrainPosition = false;\n            }else if(t.align){ // TODO: this doesn't seem to work consistently\n                xy = this.el.getAlignToXY(t.el, t.align);\n                this.constrainPosition = false;\n            }else{\n                this.constrainPosition = true;\n            }\n        }\n        Ext.QuickTip.superclass.showAt.call(this, xy);\n    },\n\n    // inherit docs\n    hide: function(){\n        delete this.activeTarget;\n        Ext.QuickTip.superclass.hide.call(this);\n    }\n});\nExt.reg('quicktip', Ext.QuickTip);/**\n * @class Ext.QuickTips\n * <p>Provides attractive and customizable tooltips for any element. The QuickTips\n * singleton is used to configure and manage tooltips globally for multiple elements\n * in a generic manner.  To create individual tooltips with maximum customizability,\n * you should consider either {@link Ext.Tip} or {@link Ext.ToolTip}.</p>\n * <p>Quicktips can be configured via tag attributes directly in markup, or by\n * registering quick tips programmatically via the {@link #register} method.</p>\n * <p>The singleton's instance of {@link Ext.QuickTip} is available via\n * {@link #getQuickTip}, and supports all the methods, and all the all the\n * configuration properties of Ext.QuickTip. These settings will apply to all\n * tooltips shown by the singleton.</p>\n * <p>Below is the summary of the configuration properties which can be used.\n * For detailed descriptions see the config options for the {@link Ext.QuickTip QuickTip} class</p>\n * <p><b>QuickTips singleton configs (all are optional)</b></p>\n * <div class=\"mdetail-params\"><ul><li>dismissDelay</li>\n * <li>hideDelay</li>\n * <li>maxWidth</li>\n * <li>minWidth</li>\n * <li>showDelay</li>\n * <li>trackMouse</li></ul></div>\n * <p><b>Target element configs (optional unless otherwise noted)</b></p>\n * <div class=\"mdetail-params\"><ul><li>autoHide</li>\n * <li>cls</li>\n * <li>dismissDelay (overrides singleton value)</li>\n * <li>target (required)</li>\n * <li>text (required)</li>\n * <li>title</li>\n * <li>width</li></ul></div>\n * <p>Here is an example showing how some of these config options could be used:</p>\n * <pre><code>\n// Init the singleton.  Any tag-based quick tips will start working.\nExt.QuickTips.init();\n\n// Apply a set of config properties to the singleton\nExt.apply(Ext.QuickTips.getQuickTip(), {\n    maxWidth: 200,\n    minWidth: 100,\n    showDelay: 50,      // Show 50ms after entering target\n    trackMouse: true\n});\n\n// Manually register a quick tip for a specific element\nExt.QuickTips.register({\n    target: 'my-div',\n    title: 'My Tooltip',\n    text: 'This tooltip was added in code',\n    width: 100,\n    dismissDelay: 10000 // Hide after 10 seconds hover\n});\n</code></pre>\n * <p>To register a quick tip in markup, you simply add one or more of the valid QuickTip attributes prefixed with\n * the <b>ext:</b> namespace.  The HTML element itself is automatically set as the quick tip target. Here is the summary\n * of supported attributes (optional unless otherwise noted):</p>\n * <ul><li><b>hide</b>: Specifying \"user\" is equivalent to setting autoHide = false.  Any other value will be the\n * same as autoHide = true.</li>\n * <li><b>qclass</b>: A CSS class to be applied to the quick tip (equivalent to the 'cls' target element config).</li>\n * <li><b>qtip (required)</b>: The quick tip text (equivalent to the 'text' target element config).</li>\n * <li><b>qtitle</b>: The quick tip title (equivalent to the 'title' target element config).</li>\n * <li><b>qwidth</b>: The quick tip width (equivalent to the 'width' target element config).</li></ul>\n * <p>Here is an example of configuring an HTML element to display a tooltip from markup:</p>\n * <pre><code>\n// Add a quick tip to an HTML button\n&lt;input type=\"button\" value=\"OK\" ext:qtitle=\"OK Button\" ext:qwidth=\"100\"\n     ext:qtip=\"This is a quick tip from markup!\">&lt;/input>\n</code></pre>\n * @singleton\n */\nExt.QuickTips = function(){\n    var tip,\n        disabled = false;\n        \n    return {\n        /**\n         * Initialize the global QuickTips instance and prepare any quick tips.\n         * @param {Boolean} autoRender True to render the QuickTips container immediately to preload images. (Defaults to true) \n         */\n        init : function(autoRender){\n            if(!tip){\n                if(!Ext.isReady){\n                    Ext.onReady(function(){\n                        Ext.QuickTips.init(autoRender);\n                    });\n                    return;\n                }\n                tip = new Ext.QuickTip({\n                    elements:'header,body', \n                    disabled: disabled\n                });\n                if(autoRender !== false){\n                    tip.render(Ext.getBody());\n                }\n            }\n        },\n        \n        // Protected method called by the dd classes\n        ddDisable : function(){\n            // don't disable it if we don't need to\n            if(tip && !disabled){\n                tip.disable();\n            }    \n        },\n        \n        // Protected method called by the dd classes\n        ddEnable : function(){\n            // only enable it if it hasn't been disabled\n            if(tip && !disabled){\n                tip.enable();\n            }\n        },\n\n        /**\n         * Enable quick tips globally.\n         */\n        enable : function(){\n            if(tip){\n                tip.enable();\n            }\n            disabled = false;\n        },\n\n        /**\n         * Disable quick tips globally.\n         */\n        disable : function(){\n            if(tip){\n                tip.disable();\n            }\n            disabled = true;\n        },\n\n        /**\n         * Returns true if quick tips are enabled, else false.\n         * @return {Boolean}\n         */\n        isEnabled : function(){\n            return tip !== undefined && !tip.disabled;\n        },\n\n        /**\n         * Gets the single {@link Ext.QuickTip QuickTip} instance used to show tips from all registered elements.\n         * @return {Ext.QuickTip}\n         */\n        getQuickTip : function(){\n            return tip;\n        },\n\n        /**\n         * Configures a new quick tip instance and assigns it to a target element.  See\n         * {@link Ext.QuickTip#register} for details.\n         * @param {Object} config The config object\n         */\n        register : function(){\n            tip.register.apply(tip, arguments);\n        },\n\n        /**\n         * Removes any registered quick tip from the target element and destroys it.\n         * @param {String/HTMLElement/Element} el The element from which the quick tip is to be removed.\n         */\n        unregister : function(){\n            tip.unregister.apply(tip, arguments);\n        },\n\n        /**\n         * Alias of {@link #register}.\n         * @param {Object} config The config object\n         */\n        tips : function(){\n            tip.register.apply(tip, arguments);\n        }\n    };\n}();/**\n * @class Ext.slider.Tip\n * @extends Ext.Tip\n * Simple plugin for using an Ext.Tip with a slider to show the slider value. Example usage:\n<pre>\nnew Ext.Slider({\n    width: 214,\n    minValue: 0,\n    maxValue: 100,\n    plugins: new Ext.slider.Tip()\n});\n</pre>\n * Optionally provide your own tip text by overriding getText:\n <pre>\n new Ext.Slider({\n     width: 214,\n     minValue: 0,\n     maxValue: 100,\n     plugins: new Ext.slider.Tip({\n         getText: function(thumb){\n             return String.format('<b>{0}% complete</b>', thumb.value);\n         }\n     })\n });\n </pre>\n */\nExt.slider.Tip = Ext.extend(Ext.Tip, {\n    minWidth: 10,\n    offsets : [0, -10],\n    \n    init: function(slider) {\n        slider.on({\n            scope    : this,\n            dragstart: this.onSlide,\n            drag     : this.onSlide,\n            dragend  : this.hide,\n            destroy  : this.destroy\n        });\n    },\n    \n    /**\n     * @private\n     * Called whenever a dragstart or drag event is received on the associated Thumb. \n     * Aligns the Tip with the Thumb's new position.\n     * @param {Ext.slider.MultiSlider} slider The slider\n     * @param {Ext.EventObject} e The Event object\n     * @param {Ext.slider.Thumb} thumb The thumb that the Tip is attached to\n     */\n    onSlide : function(slider, e, thumb) {\n        this.show();\n        this.body.update(this.getText(thumb));\n        this.doAutoWidth();\n        this.el.alignTo(thumb.el, 'b-t?', this.offsets);\n    },\n\n    /**\n     * Used to create the text that appears in the Tip's body. By default this just returns\n     * the value of the Slider Thumb that the Tip is attached to. Override to customize.\n     * @param {Ext.slider.Thumb} thumb The Thumb that the Tip is attached to\n     * @return {String} The text to display in the tip\n     */\n    getText : function(thumb) {\n        return String(thumb.value);\n    }\n});\n\n//backwards compatibility - SliderTip used to be a ux before 3.2\nExt.ux.SliderTip = Ext.slider.Tip;/**\n * @class Ext.tree.TreePanel\n * @extends Ext.Panel\n * <p>The TreePanel provides tree-structured UI representation of tree-structured data.</p>\n * <p>{@link Ext.tree.TreeNode TreeNode}s added to the TreePanel may each contain metadata\n * used by your application in their {@link Ext.tree.TreeNode#attributes attributes} property.</p>\n * <p><b>A TreePanel must have a {@link #root} node before it is rendered.</b> This may either be\n * specified using the {@link #root} config option, or using the {@link #setRootNode} method.\n * <p>An example of tree rendered to an existing div:</p><pre><code>\nvar tree = new Ext.tree.TreePanel({\n    renderTo: 'tree-div',\n    useArrows: true,\n    autoScroll: true,\n    animate: true,\n    enableDD: true,\n    containerScroll: true,\n    border: false,\n    // auto create TreeLoader\n    dataUrl: 'get-nodes.php',\n\n    root: {\n        nodeType: 'async',\n        text: 'Ext JS',\n        draggable: false,\n        id: 'source'\n    }\n});\n\ntree.getRootNode().expand();\n * </code></pre>\n * <p>The example above would work with a data packet similar to this:</p><pre><code>\n[{\n    \"text\": \"adapter\",\n    \"id\": \"source\\/adapter\",\n    \"cls\": \"folder\"\n}, {\n    \"text\": \"dd\",\n    \"id\": \"source\\/dd\",\n    \"cls\": \"folder\"\n}, {\n    \"text\": \"debug.js\",\n    \"id\": \"source\\/debug.js\",\n    \"leaf\": true,\n    \"cls\": \"file\"\n}]\n * </code></pre>\n * <p>An example of tree within a Viewport:</p><pre><code>\nnew Ext.Viewport({\n    layout: 'border',\n    items: [{\n        region: 'west',\n        collapsible: true,\n        title: 'Navigation',\n        xtype: 'treepanel',\n        width: 200,\n        autoScroll: true,\n        split: true,\n        loader: new Ext.tree.TreeLoader(),\n        root: new Ext.tree.AsyncTreeNode({\n            expanded: true,\n            children: [{\n                text: 'Menu Option 1',\n                leaf: true\n            }, {\n                text: 'Menu Option 2',\n                leaf: true\n            }, {\n                text: 'Menu Option 3',\n                leaf: true\n            }]\n        }),\n        rootVisible: false,\n        listeners: {\n            click: function(n) {\n                Ext.Msg.alert('Navigation Tree Click', 'You clicked: \"' + n.attributes.text + '\"');\n            }\n        }\n    }, {\n        region: 'center',\n        xtype: 'tabpanel',\n        // remaining code not shown ...\n    }]\n});\n</code></pre>\n *\n * @cfg {Ext.tree.TreeNode} root The root node for the tree.\n * @cfg {Boolean} rootVisible <tt>false</tt> to hide the root node (defaults to <tt>true</tt>)\n * @cfg {Boolean} lines <tt>false</tt> to disable tree lines (defaults to <tt>true</tt>)\n * @cfg {Boolean} enableDD <tt>true</tt> to enable drag and drop\n * @cfg {Boolean} enableDrag <tt>true</tt> to enable just drag\n * @cfg {Boolean} enableDrop <tt>true</tt> to enable just drop\n * @cfg {Object} dragConfig Custom config to pass to the {@link Ext.tree.TreeDragZone} instance\n * @cfg {Object} dropConfig Custom config to pass to the {@link Ext.tree.TreeDropZone} instance\n * @cfg {String} ddGroup The DD group this TreePanel belongs to\n * @cfg {Boolean} ddAppendOnly <tt>true</tt> if the tree should only allow append drops (use for trees which are sorted)\n * @cfg {Boolean} ddScroll <tt>true</tt> to enable body scrolling\n * @cfg {Boolean} containerScroll <tt>true</tt> to register this container with ScrollManager\n * @cfg {Boolean} hlDrop <tt>false</tt> to disable node highlight on drop (defaults to the value of {@link Ext#enableFx})\n * @cfg {String} hlColor The color of the node highlight (defaults to <tt>'C3DAF9'</tt>)\n * @cfg {Boolean} animate <tt>true</tt> to enable animated expand/collapse (defaults to the value of {@link Ext#enableFx})\n * @cfg {Boolean} singleExpand <tt>true</tt> if only 1 node per branch may be expanded\n * @cfg {Object} selModel A tree selection model to use with this TreePanel (defaults to an {@link Ext.tree.DefaultSelectionModel})\n * @cfg {Boolean} trackMouseOver <tt>false</tt> to disable mouse over highlighting\n * @cfg {Ext.tree.TreeLoader} loader A {@link Ext.tree.TreeLoader} for use with this TreePanel\n * @cfg {String} pathSeparator The token used to separate sub-paths in path strings (defaults to <tt>'/'</tt>)\n * @cfg {Boolean} useArrows <tt>true</tt> to use Vista-style arrows in the tree (defaults to <tt>false</tt>)\n * @cfg {String} requestMethod The HTTP request method for loading data (defaults to the value of {@link Ext.Ajax#method}).\n *\n * @constructor\n * @param {Object} config\n * @xtype treepanel\n */\nExt.tree.TreePanel = Ext.extend(Ext.Panel, {\n    rootVisible : true,\n    animate : Ext.enableFx,\n    lines : true,\n    enableDD : false,\n    hlDrop : Ext.enableFx,\n    pathSeparator : '/',\n\n    /**\n     * @cfg {Array} bubbleEvents\n     * <p>An array of events that, when fired, should be bubbled to any parent container.\n     * See {@link Ext.util.Observable#enableBubble}.\n     * Defaults to <tt>[]</tt>.\n     */\n    bubbleEvents : [],\n\n    initComponent : function(){\n        Ext.tree.TreePanel.superclass.initComponent.call(this);\n\n        if(!this.eventModel){\n            this.eventModel = new Ext.tree.TreeEventModel(this);\n        }\n\n        // initialize the loader\n        var l = this.loader;\n        if(!l){\n            l = new Ext.tree.TreeLoader({\n                dataUrl: this.dataUrl,\n                requestMethod: this.requestMethod\n            });\n        }else if(Ext.isObject(l) && !l.load){\n            l = new Ext.tree.TreeLoader(l);\n        }\n        this.loader = l;\n\n        this.nodeHash = {};\n\n        /**\n        * The root node of this tree.\n        * @type Ext.tree.TreeNode\n        * @property root\n        */\n        if(this.root){\n            var r = this.root;\n            delete this.root;\n            this.setRootNode(r);\n        }\n\n\n        this.addEvents(\n\n            /**\n            * @event append\n            * Fires when a new child node is appended to a node in this tree.\n            * @param {Tree} tree The owner tree\n            * @param {Node} parent The parent node\n            * @param {Node} node The newly appended node\n            * @param {Number} index The index of the newly appended node\n            */\n           'append',\n           /**\n            * @event remove\n            * Fires when a child node is removed from a node in this tree.\n            * @param {Tree} tree The owner tree\n            * @param {Node} parent The parent node\n            * @param {Node} node The child node removed\n            */\n           'remove',\n           /**\n            * @event movenode\n            * Fires when a node is moved to a new location in the tree\n            * @param {Tree} tree The owner tree\n            * @param {Node} node The node moved\n            * @param {Node} oldParent The old parent of this node\n            * @param {Node} newParent The new parent of this node\n            * @param {Number} index The index it was moved to\n            */\n           'movenode',\n           /**\n            * @event insert\n            * Fires when a new child node is inserted in a node in this tree.\n            * @param {Tree} tree The owner tree\n            * @param {Node} parent The parent node\n            * @param {Node} node The child node inserted\n            * @param {Node} refNode The child node the node was inserted before\n            */\n           'insert',\n           /**\n            * @event beforeappend\n            * Fires before a new child is appended to a node in this tree, return false to cancel the append.\n            * @param {Tree} tree The owner tree\n            * @param {Node} parent The parent node\n            * @param {Node} node The child node to be appended\n            */\n           'beforeappend',\n           /**\n            * @event beforeremove\n            * Fires before a child is removed from a node in this tree, return false to cancel the remove.\n            * @param {Tree} tree The owner tree\n            * @param {Node} parent The parent node\n            * @param {Node} node The child node to be removed\n            */\n           'beforeremove',\n           /**\n            * @event beforemovenode\n            * Fires before a node is moved to a new location in the tree. Return false to cancel the move.\n            * @param {Tree} tree The owner tree\n            * @param {Node} node The node being moved\n            * @param {Node} oldParent The parent of the node\n            * @param {Node} newParent The new parent the node is moving to\n            * @param {Number} index The index it is being moved to\n            */\n           'beforemovenode',\n           /**\n            * @event beforeinsert\n            * Fires before a new child is inserted in a node in this tree, return false to cancel the insert.\n            * @param {Tree} tree The owner tree\n            * @param {Node} parent The parent node\n            * @param {Node} node The child node to be inserted\n            * @param {Node} refNode The child node the node is being inserted before\n            */\n            'beforeinsert',\n\n            /**\n            * @event beforeload\n            * Fires before a node is loaded, return false to cancel\n            * @param {Node} node The node being loaded\n            */\n            'beforeload',\n            /**\n            * @event load\n            * Fires when a node is loaded\n            * @param {Node} node The node that was loaded\n            */\n            'load',\n            /**\n            * @event textchange\n            * Fires when the text for a node is changed\n            * @param {Node} node The node\n            * @param {String} text The new text\n            * @param {String} oldText The old text\n            */\n            'textchange',\n            /**\n            * @event beforeexpandnode\n            * Fires before a node is expanded, return false to cancel.\n            * @param {Node} node The node\n            * @param {Boolean} deep\n            * @param {Boolean} anim\n            */\n            'beforeexpandnode',\n            /**\n            * @event beforecollapsenode\n            * Fires before a node is collapsed, return false to cancel.\n            * @param {Node} node The node\n            * @param {Boolean} deep\n            * @param {Boolean} anim\n            */\n            'beforecollapsenode',\n            /**\n            * @event expandnode\n            * Fires when a node is expanded\n            * @param {Node} node The node\n            */\n            'expandnode',\n            /**\n            * @event disabledchange\n            * Fires when the disabled status of a node changes\n            * @param {Node} node The node\n            * @param {Boolean} disabled\n            */\n            'disabledchange',\n            /**\n            * @event collapsenode\n            * Fires when a node is collapsed\n            * @param {Node} node The node\n            */\n            'collapsenode',\n            /**\n            * @event beforeclick\n            * Fires before click processing on a node. Return false to cancel the default action.\n            * @param {Node} node The node\n            * @param {Ext.EventObject} e The event object\n            */\n            'beforeclick',\n            /**\n            * @event click\n            * Fires when a node is clicked\n            * @param {Node} node The node\n            * @param {Ext.EventObject} e The event object\n            */\n            'click',\n            /**\n            * @event containerclick\n            * Fires when the tree container is clicked\n            * @param {Tree} this\n            * @param {Ext.EventObject} e The event object\n            */\n            'containerclick',\n            /**\n            * @event checkchange\n            * Fires when a node with a checkbox's checked property changes\n            * @param {Node} this This node\n            * @param {Boolean} checked\n            */\n            'checkchange',\n            /**\n            * @event beforedblclick\n            * Fires before double click processing on a node. Return false to cancel the default action.\n            * @param {Node} node The node\n            * @param {Ext.EventObject} e The event object\n            */\n            'beforedblclick',\n            /**\n            * @event dblclick\n            * Fires when a node is double clicked\n            * @param {Node} node The node\n            * @param {Ext.EventObject} e The event object\n            */\n            'dblclick',\n            /**\n            * @event containerdblclick\n            * Fires when the tree container is double clicked\n            * @param {Tree} this\n            * @param {Ext.EventObject} e The event object\n            */\n            'containerdblclick',\n            /**\n            * @event contextmenu\n            * Fires when a node is right clicked. To display a context menu in response to this\n            * event, first create a Menu object (see {@link Ext.menu.Menu} for details), then add\n            * a handler for this event:<pre><code>\nnew Ext.tree.TreePanel({\n    title: 'My TreePanel',\n    root: new Ext.tree.AsyncTreeNode({\n        text: 'The Root',\n        children: [\n            { text: 'Child node 1', leaf: true },\n            { text: 'Child node 2', leaf: true }\n        ]\n    }),\n    contextMenu: new Ext.menu.Menu({\n        items: [{\n            id: 'delete-node',\n            text: 'Delete Node'\n        }],\n        listeners: {\n            itemclick: function(item) {\n                switch (item.id) {\n                    case 'delete-node':\n                        var n = item.parentMenu.contextNode;\n                        if (n.parentNode) {\n                            n.remove();\n                        }\n                        break;\n                }\n            }\n        }\n    }),\n    listeners: {\n        contextmenu: function(node, e) {\n//          Register the context node with the menu so that a Menu Item's handler function can access\n//          it via its {@link Ext.menu.BaseItem#parentMenu parentMenu} property.\n            node.select();\n            var c = node.getOwnerTree().contextMenu;\n            c.contextNode = node;\n            c.showAt(e.getXY());\n        }\n    }\n});\n</code></pre>\n            * @param {Node} node The node\n            * @param {Ext.EventObject} e The event object\n            */\n            'contextmenu',\n            /**\n            * @event containercontextmenu\n            * Fires when the tree container is right clicked\n            * @param {Tree} this\n            * @param {Ext.EventObject} e The event object\n            */\n            'containercontextmenu',\n            /**\n            * @event beforechildrenrendered\n            * Fires right before the child nodes for a node are rendered\n            * @param {Node} node The node\n            */\n            'beforechildrenrendered',\n           /**\n             * @event startdrag\n             * Fires when a node starts being dragged\n             * @param {Ext.tree.TreePanel} this\n             * @param {Ext.tree.TreeNode} node\n             * @param {event} e The raw browser event\n             */\n            'startdrag',\n            /**\n             * @event enddrag\n             * Fires when a drag operation is complete\n             * @param {Ext.tree.TreePanel} this\n             * @param {Ext.tree.TreeNode} node\n             * @param {event} e The raw browser event\n             */\n            'enddrag',\n            /**\n             * @event dragdrop\n             * Fires when a dragged node is dropped on a valid DD target\n             * @param {Ext.tree.TreePanel} this\n             * @param {Ext.tree.TreeNode} node\n             * @param {DD} dd The dd it was dropped on\n             * @param {event} e The raw browser event\n             */\n            'dragdrop',\n            /**\n             * @event beforenodedrop\n             * Fires when a DD object is dropped on a node in this tree for preprocessing. Return false to cancel the drop. The dropEvent\n             * passed to handlers has the following properties:<br />\n             * <ul style=\"padding:5px;padding-left:16px;\">\n             * <li>tree - The TreePanel</li>\n             * <li>target - The node being targeted for the drop</li>\n             * <li>data - The drag data from the drag source</li>\n             * <li>point - The point of the drop - append, above or below</li>\n             * <li>source - The drag source</li>\n             * <li>rawEvent - Raw mouse event</li>\n             * <li>dropNode - Drop node(s) provided by the source <b>OR</b> you can supply node(s)\n             * to be inserted by setting them on this object.</li>\n             * <li>cancel - Set this to true to cancel the drop.</li>\n             * <li>dropStatus - If the default drop action is cancelled but the drop is valid, setting this to true\n             * will prevent the animated 'repair' from appearing.</li>\n             * </ul>\n             * @param {Object} dropEvent\n             */\n            'beforenodedrop',\n            /**\n             * @event nodedrop\n             * Fires after a DD object is dropped on a node in this tree. The dropEvent\n             * passed to handlers has the following properties:<br />\n             * <ul style=\"padding:5px;padding-left:16px;\">\n             * <li>tree - The TreePanel</li>\n             * <li>target - The node being targeted for the drop</li>\n             * <li>data - The drag data from the drag source</li>\n             * <li>point - The point of the drop - append, above or below</li>\n             * <li>source - The drag source</li>\n             * <li>rawEvent - Raw mouse event</li>\n             * <li>dropNode - Dropped node(s).</li>\n             * </ul>\n             * @param {Object} dropEvent\n             */\n            'nodedrop',\n             /**\n             * @event nodedragover\n             * Fires when a tree node is being targeted for a drag drop, return false to signal drop not allowed. The dragOverEvent\n             * passed to handlers has the following properties:<br />\n             * <ul style=\"padding:5px;padding-left:16px;\">\n             * <li>tree - The TreePanel</li>\n             * <li>target - The node being targeted for the drop</li>\n             * <li>data - The drag data from the drag source</li>\n             * <li>point - The point of the drop - append, above or below</li>\n             * <li>source - The drag source</li>\n             * <li>rawEvent - Raw mouse event</li>\n             * <li>dropNode - Drop node(s) provided by the source.</li>\n             * <li>cancel - Set this to true to signal drop not allowed.</li>\n             * </ul>\n             * @param {Object} dragOverEvent\n             */\n            'nodedragover'\n        );\n        if(this.singleExpand){\n            this.on('beforeexpandnode', this.restrictExpand, this);\n        }\n    },\n\n    // private\n    proxyNodeEvent : function(ename, a1, a2, a3, a4, a5, a6){\n        if(ename == 'collapse' || ename == 'expand' || ename == 'beforecollapse' || ename == 'beforeexpand' || ename == 'move' || ename == 'beforemove'){\n            ename = ename+'node';\n        }\n        // args inline for performance while bubbling events\n        return this.fireEvent(ename, a1, a2, a3, a4, a5, a6);\n    },\n\n\n    /**\n     * Returns this root node for this tree\n     * @return {Node}\n     */\n    getRootNode : function(){\n        return this.root;\n    },\n\n    /**\n     * Sets the root node for this tree. If the TreePanel has already rendered a root node, the\n     * previous root node (and all of its descendants) are destroyed before the new root node is rendered.\n     * @param {Node} node\n     * @return {Node}\n     */\n    setRootNode : function(node){\n        this.destroyRoot();\n        if(!node.render){ // attributes passed\n            node = this.loader.createNode(node);\n        }\n        this.root = node;\n        node.ownerTree = this;\n        node.isRoot = true;\n        this.registerNode(node);\n        if(!this.rootVisible){\n            var uiP = node.attributes.uiProvider;\n            node.ui = uiP ? new uiP(node) : new Ext.tree.RootTreeNodeUI(node);\n        }\n        if(this.innerCt){\n            this.clearInnerCt();\n            this.renderRoot();\n        }\n        return node;\n    },\n    \n    clearInnerCt : function(){\n        this.innerCt.update('');    \n    },\n    \n    // private\n    renderRoot : function(){\n        this.root.render();\n        if(!this.rootVisible){\n            this.root.renderChildren();\n        }\n    },\n\n    /**\n     * Gets a node in this tree by its id\n     * @param {String} id\n     * @return {Node}\n     */\n    getNodeById : function(id){\n        return this.nodeHash[id];\n    },\n\n    // private\n    registerNode : function(node){\n        this.nodeHash[node.id] = node;\n    },\n\n    // private\n    unregisterNode : function(node){\n        delete this.nodeHash[node.id];\n    },\n\n    // private\n    toString : function(){\n        return '[Tree'+(this.id?' '+this.id:'')+']';\n    },\n\n    // private\n    restrictExpand : function(node){\n        var p = node.parentNode;\n        if(p){\n            if(p.expandedChild && p.expandedChild.parentNode == p){\n                p.expandedChild.collapse();\n            }\n            p.expandedChild = node;\n        }\n    },\n\n    /**\n     * Retrieve an array of checked nodes, or an array of a specific attribute of checked nodes (e.g. 'id')\n     * @param {String} attribute (optional) Defaults to null (return the actual nodes)\n     * @param {TreeNode} startNode (optional) The node to start from, defaults to the root\n     * @return {Array}\n     */\n    getChecked : function(a, startNode){\n        startNode = startNode || this.root;\n        var r = [];\n        var f = function(){\n            if(this.attributes.checked){\n                r.push(!a ? this : (a == 'id' ? this.id : this.attributes[a]));\n            }\n        };\n        startNode.cascade(f);\n        return r;\n    },\n\n    /**\n     * Returns the default {@link Ext.tree.TreeLoader} for this TreePanel.\n     * @return {Ext.tree.TreeLoader} The TreeLoader for this TreePanel.\n     */\n    getLoader : function(){\n        return this.loader;\n    },\n\n    /**\n     * Expand all nodes\n     */\n    expandAll : function(){\n        this.root.expand(true);\n    },\n\n    /**\n     * Collapse all nodes\n     */\n    collapseAll : function(){\n        this.root.collapse(true);\n    },\n\n    /**\n     * Returns the selection model used by this TreePanel.\n     * @return {TreeSelectionModel} The selection model used by this TreePanel\n     */\n    getSelectionModel : function(){\n        if(!this.selModel){\n            this.selModel = new Ext.tree.DefaultSelectionModel();\n        }\n        return this.selModel;\n    },\n\n    /**\n     * Expands a specified path in this TreePanel. A path can be retrieved from a node with {@link Ext.data.Node#getPath}\n     * @param {String} path\n     * @param {String} attr (optional) The attribute used in the path (see {@link Ext.data.Node#getPath} for more info)\n     * @param {Function} callback (optional) The callback to call when the expand is complete. The callback will be called with\n     * (bSuccess, oLastNode) where bSuccess is if the expand was successful and oLastNode is the last node that was expanded.\n     */\n    expandPath : function(path, attr, callback){\n        if(Ext.isEmpty(path)){\n            if(callback){\n                callback(false, undefined);\n            }\n            return;\n        }\n        attr = attr || 'id';\n        var keys = path.split(this.pathSeparator);\n        var curNode = this.root;\n        if(curNode.attributes[attr] != keys[1]){ // invalid root\n            if(callback){\n                callback(false, null);\n            }\n            return;\n        }\n        var index = 1;\n        var f = function(){\n            if(++index == keys.length){\n                if(callback){\n                    callback(true, curNode);\n                }\n                return;\n            }\n            var c = curNode.findChild(attr, keys[index]);\n            if(!c){\n                if(callback){\n                    callback(false, curNode);\n                }\n                return;\n            }\n            curNode = c;\n            c.expand(false, false, f);\n        };\n        curNode.expand(false, false, f);\n    },\n\n    /**\n     * Selects the node in this tree at the specified path. A path can be retrieved from a node with {@link Ext.data.Node#getPath}\n     * @param {String} path\n     * @param {String} attr (optional) The attribute used in the path (see {@link Ext.data.Node#getPath} for more info)\n     * @param {Function} callback (optional) The callback to call when the selection is complete. The callback will be called with\n     * (bSuccess, oSelNode) where bSuccess is if the selection was successful and oSelNode is the selected node.\n     */\n    selectPath : function(path, attr, callback){\n        if(Ext.isEmpty(path)){\n            if(callback){\n                callback(false, undefined);\n            }\n            return;\n        }\n        attr = attr || 'id';\n        var keys = path.split(this.pathSeparator),\n            v = keys.pop();\n        if(keys.length > 1){\n            var f = function(success, node){\n                if(success && node){\n                    var n = node.findChild(attr, v);\n                    if(n){\n                        n.select();\n                        if(callback){\n                            callback(true, n);\n                        }\n                    }else if(callback){\n                        callback(false, n);\n                    }\n                }else{\n                    if(callback){\n                        callback(false, n);\n                    }\n                }\n            };\n            this.expandPath(keys.join(this.pathSeparator), attr, f);\n        }else{\n            this.root.select();\n            if(callback){\n                callback(true, this.root);\n            }\n        }\n    },\n\n    /**\n     * Returns the underlying Element for this tree\n     * @return {Ext.Element} The Element\n     */\n    getTreeEl : function(){\n        return this.body;\n    },\n\n    // private\n    onRender : function(ct, position){\n        Ext.tree.TreePanel.superclass.onRender.call(this, ct, position);\n        this.el.addClass('x-tree');\n        this.innerCt = this.body.createChild({tag:'ul',\n               cls:'x-tree-root-ct ' +\n               (this.useArrows ? 'x-tree-arrows' : this.lines ? 'x-tree-lines' : 'x-tree-no-lines')});\n    },\n\n    // private\n    initEvents : function(){\n        Ext.tree.TreePanel.superclass.initEvents.call(this);\n\n        if(this.containerScroll){\n            Ext.dd.ScrollManager.register(this.body);\n        }\n        if((this.enableDD || this.enableDrop) && !this.dropZone){\n           /**\n            * The dropZone used by this tree if drop is enabled (see {@link #enableDD} or {@link #enableDrop})\n            * @property dropZone\n            * @type Ext.tree.TreeDropZone\n            */\n             this.dropZone = new Ext.tree.TreeDropZone(this, this.dropConfig || {\n               ddGroup: this.ddGroup || 'TreeDD', appendOnly: this.ddAppendOnly === true\n           });\n        }\n        if((this.enableDD || this.enableDrag) && !this.dragZone){\n           /**\n            * The dragZone used by this tree if drag is enabled (see {@link #enableDD} or {@link #enableDrag})\n            * @property dragZone\n            * @type Ext.tree.TreeDragZone\n            */\n            this.dragZone = new Ext.tree.TreeDragZone(this, this.dragConfig || {\n               ddGroup: this.ddGroup || 'TreeDD',\n               scroll: this.ddScroll\n           });\n        }\n        this.getSelectionModel().init(this);\n    },\n\n    // private\n    afterRender : function(){\n        Ext.tree.TreePanel.superclass.afterRender.call(this);\n        this.renderRoot();\n    },\n\n    beforeDestroy : function(){\n        if(this.rendered){\n            Ext.dd.ScrollManager.unregister(this.body);\n            Ext.destroy(this.dropZone, this.dragZone);\n        }\n        this.destroyRoot();\n        Ext.destroy(this.loader);\n        this.nodeHash = this.root = this.loader = null;\n        Ext.tree.TreePanel.superclass.beforeDestroy.call(this);\n    },\n    \n    /**\n     * Destroy the root node. Not included by itself because we need to pass the silent parameter.\n     * @private\n     */\n    destroyRoot : function(){\n        if(this.root && this.root.destroy){\n            this.root.destroy(true);\n        }\n    }\n\n    /**\n     * @cfg {String/Number} activeItem\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} autoDestroy\n     * @hide\n     */\n    /**\n     * @cfg {Object/String/Function} autoLoad\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} autoWidth\n     * @hide\n     */\n    /**\n     * @cfg {Boolean/Number} bufferResize\n     * @hide\n     */\n    /**\n     * @cfg {String} defaultType\n     * @hide\n     */\n    /**\n     * @cfg {Object} defaults\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} hideBorders\n     * @hide\n     */\n    /**\n     * @cfg {Mixed} items\n     * @hide\n     */\n    /**\n     * @cfg {String} layout\n     * @hide\n     */\n    /**\n     * @cfg {Object} layoutConfig\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} monitorResize\n     * @hide\n     */\n    /**\n     * @property items\n     * @hide\n     */\n    /**\n     * @method cascade\n     * @hide\n     */\n    /**\n     * @method doLayout\n     * @hide\n     */\n    /**\n     * @method find\n     * @hide\n     */\n    /**\n     * @method findBy\n     * @hide\n     */\n    /**\n     * @method findById\n     * @hide\n     */\n    /**\n     * @method findByType\n     * @hide\n     */\n    /**\n     * @method getComponent\n     * @hide\n     */\n    /**\n     * @method getLayout\n     * @hide\n     */\n    /**\n     * @method getUpdater\n     * @hide\n     */\n    /**\n     * @method insert\n     * @hide\n     */\n    /**\n     * @method load\n     * @hide\n     */\n    /**\n     * @method remove\n     * @hide\n     */\n    /**\n     * @event add\n     * @hide\n     */\n    /**\n     * @method removeAll\n     * @hide\n     */\n    /**\n     * @event afterLayout\n     * @hide\n     */\n    /**\n     * @event beforeadd\n     * @hide\n     */\n\n\n\n    /**\n     * @cfg {String} allowDomMove  @hide\n     */\n    /**\n     * @cfg {String} autoEl @hide\n     */\n    /**\n     * @cfg {String} applyTo  @hide\n     */\n    /**\n     * @cfg {String} contentEl  @hide\n     */\n    /**\n     * @cfg {Mixed} data  @hide\n     */\n    /**\n     * @cfg {Mixed} tpl  @hide\n     */\n    /**\n     * @cfg {String} tplWriteMode  @hide\n     */\n    /**\n     * @cfg {String} disabledClass  @hide\n     */\n    /**\n     * @cfg {String} elements  @hide\n     */\n    /**\n     * @cfg {String} html  @hide\n     */\n    /**\n     * @cfg {Boolean} preventBodyReset\n     * @hide\n     */\n    /**\n     * @property disabled\n     * @hide\n     */\n    /**\n     * @method applyToMarkup\n     * @hide\n     */\n    /**\n     * @method enable\n     * @hide\n     */\n    /**\n     * @method disable\n     * @hide\n     */\n    /**\n     * @method setDisabled\n     * @hide\n     */\n});\n\nExt.tree.TreePanel.nodeTypes = {};\n\nExt.reg('treepanel', Ext.tree.TreePanel);Ext.tree.TreeEventModel = function(tree){\n    this.tree = tree;\n    this.tree.on('render', this.initEvents, this);\n};\n\nExt.tree.TreeEventModel.prototype = {\n    initEvents : function(){\n        var t = this.tree;\n\n        if(t.trackMouseOver !== false){\n            t.mon(t.innerCt, {\n                scope: this,\n                mouseover: this.delegateOver,\n                mouseout: this.delegateOut\n            });\n        }\n        t.mon(t.getTreeEl(), {\n            scope: this,\n            click: this.delegateClick,\n            dblclick: this.delegateDblClick,\n            contextmenu: this.delegateContextMenu\n        });\n    },\n\n    getNode : function(e){\n        var t;\n        if(t = e.getTarget('.x-tree-node-el', 10)){\n            var id = Ext.fly(t, '_treeEvents').getAttribute('tree-node-id', 'ext');\n            if(id){\n                return this.tree.getNodeById(id);\n            }\n        }\n        return null;\n    },\n\n    getNodeTarget : function(e){\n        var t = e.getTarget('.x-tree-node-icon', 1);\n        if(!t){\n            t = e.getTarget('.x-tree-node-el', 6);\n        }\n        return t;\n    },\n\n    delegateOut : function(e, t){\n        if(!this.beforeEvent(e)){\n            return;\n        }\n        if(e.getTarget('.x-tree-ec-icon', 1)){\n            var n = this.getNode(e);\n            this.onIconOut(e, n);\n            if(n == this.lastEcOver){\n                delete this.lastEcOver;\n            }\n        }\n        if((t = this.getNodeTarget(e)) && !e.within(t, true)){\n            this.onNodeOut(e, this.getNode(e));\n        }\n    },\n\n    delegateOver : function(e, t){\n        if(!this.beforeEvent(e)){\n            return;\n        }\n        if(Ext.isGecko && !this.trackingDoc){ // prevent hanging in FF\n            Ext.getBody().on('mouseover', this.trackExit, this);\n            this.trackingDoc = true;\n        }\n        if(this.lastEcOver){ // prevent hung highlight\n            this.onIconOut(e, this.lastEcOver);\n            delete this.lastEcOver;\n        }\n        if(e.getTarget('.x-tree-ec-icon', 1)){\n            this.lastEcOver = this.getNode(e);\n            this.onIconOver(e, this.lastEcOver);\n        }\n        if(t = this.getNodeTarget(e)){\n            this.onNodeOver(e, this.getNode(e));\n        }\n    },\n\n    trackExit : function(e){\n        if(this.lastOverNode){\n            if(this.lastOverNode.ui && !e.within(this.lastOverNode.ui.getEl())){\n                this.onNodeOut(e, this.lastOverNode);\n            }\n            delete this.lastOverNode;\n            Ext.getBody().un('mouseover', this.trackExit, this);\n            this.trackingDoc = false;\n        }\n\n    },\n\n    delegateClick : function(e, t){\n        if(this.beforeEvent(e)){\n            if(e.getTarget('input[type=checkbox]', 1)){\n                this.onCheckboxClick(e, this.getNode(e));\n            }else if(e.getTarget('.x-tree-ec-icon', 1)){\n                this.onIconClick(e, this.getNode(e));\n            }else if(this.getNodeTarget(e)){\n                this.onNodeClick(e, this.getNode(e));\n            }\n        }else{\n            this.checkContainerEvent(e, 'click');\n        }\n    },\n\n    delegateDblClick : function(e, t){\n        if(this.beforeEvent(e)){\n            if(this.getNodeTarget(e)){\n                this.onNodeDblClick(e, this.getNode(e));\n            }\n        }else{\n            this.checkContainerEvent(e, 'dblclick');\n        }\n    },\n\n    delegateContextMenu : function(e, t){\n        if(this.beforeEvent(e)){\n            if(this.getNodeTarget(e)){\n                this.onNodeContextMenu(e, this.getNode(e));\n            }\n        }else{\n            this.checkContainerEvent(e, 'contextmenu');\n        }\n    },\n    \n    checkContainerEvent: function(e, type){\n        if(this.disabled){\n            e.stopEvent();\n            return false;\n        }\n        this.onContainerEvent(e, type);    \n    },\n\n    onContainerEvent: function(e, type){\n        this.tree.fireEvent('container' + type, this.tree, e);\n    },\n\n    onNodeClick : function(e, node){\n        node.ui.onClick(e);\n    },\n\n    onNodeOver : function(e, node){\n        this.lastOverNode = node;\n        node.ui.onOver(e);\n    },\n\n    onNodeOut : function(e, node){\n        node.ui.onOut(e);\n    },\n\n    onIconOver : function(e, node){\n        node.ui.addClass('x-tree-ec-over');\n    },\n\n    onIconOut : function(e, node){\n        node.ui.removeClass('x-tree-ec-over');\n    },\n\n    onIconClick : function(e, node){\n        node.ui.ecClick(e);\n    },\n\n    onCheckboxClick : function(e, node){\n        node.ui.onCheckChange(e);\n    },\n\n    onNodeDblClick : function(e, node){\n        node.ui.onDblClick(e);\n    },\n\n    onNodeContextMenu : function(e, node){\n        node.ui.onContextMenu(e);\n    },\n\n    beforeEvent : function(e){\n        var node = this.getNode(e);\n        if(this.disabled || !node || !node.ui){\n            e.stopEvent();\n            return false;\n        }\n        return true;\n    },\n\n    disable: function(){\n        this.disabled = true;\n    },\n\n    enable: function(){\n        this.disabled = false;\n    }\n};/**\n * @class Ext.tree.DefaultSelectionModel\n * @extends Ext.util.Observable\n * The default single selection for a TreePanel.\n */\nExt.tree.DefaultSelectionModel = Ext.extend(Ext.util.Observable, {\n    \n    constructor : function(config){\n        this.selNode = null;\n   \n        this.addEvents(\n            /**\n             * @event selectionchange\n             * Fires when the selected node changes\n             * @param {DefaultSelectionModel} this\n             * @param {TreeNode} node the new selection\n             */\n            'selectionchange',\n\n            /**\n             * @event beforeselect\n             * Fires before the selected node changes, return false to cancel the change\n             * @param {DefaultSelectionModel} this\n             * @param {TreeNode} newNode the new selection\n             * @param {TreeNode} oldNode the old selection\n             */\n            'beforeselect'\n        );\n\n        Ext.apply(this, config);\n        Ext.tree.DefaultSelectionModel.superclass.constructor.call(this);    \n    },\n    \n    init : function(tree){\n        this.tree = tree;\n        tree.mon(tree.getTreeEl(), 'keydown', this.onKeyDown, this);\n        tree.on('click', this.onNodeClick, this);\n    },\n    \n    onNodeClick : function(node, e){\n        this.select(node);\n    },\n    \n    /**\n     * Select a node.\n     * @param {TreeNode} node The node to select\n     * @return {TreeNode} The selected node\n     */\n    select : function(node, /* private*/ selectNextNode){\n        // If node is hidden, select the next node in whatever direction was being moved in.\n        if (!Ext.fly(node.ui.wrap).isVisible() && selectNextNode) {\n            return selectNextNode.call(this, node);\n        }\n        var last = this.selNode;\n        if(node == last){\n            node.ui.onSelectedChange(true);\n        }else if(this.fireEvent('beforeselect', this, node, last) !== false){\n            if(last && last.ui){\n                last.ui.onSelectedChange(false);\n            }\n            this.selNode = node;\n            node.ui.onSelectedChange(true);\n            this.fireEvent('selectionchange', this, node, last);\n        }\n        return node;\n    },\n    \n    /**\n     * Deselect a node.\n     * @param {TreeNode} node The node to unselect\n     * @param {Boolean} silent True to stop the selectionchange event from firing.\n     */\n    unselect : function(node, silent){\n        if(this.selNode == node){\n            this.clearSelections(silent);\n        }    \n    },\n    \n    /**\n     * Clear all selections\n     * @param {Boolean} silent True to stop the selectionchange event from firing.\n     */\n    clearSelections : function(silent){\n        var n = this.selNode;\n        if(n){\n            n.ui.onSelectedChange(false);\n            this.selNode = null;\n            if(silent !== true){\n                this.fireEvent('selectionchange', this, null);\n            }\n        }\n        return n;\n    },\n    \n    /**\n     * Get the selected node\n     * @return {TreeNode} The selected node\n     */\n    getSelectedNode : function(){\n        return this.selNode;    \n    },\n    \n    /**\n     * Returns true if the node is selected\n     * @param {TreeNode} node The node to check\n     * @return {Boolean}\n     */\n    isSelected : function(node){\n        return this.selNode == node;  \n    },\n\n    /**\n     * Selects the node above the selected node in the tree, intelligently walking the nodes\n     * @return TreeNode The new selection\n     */\n    selectPrevious : function(/* private */ s){\n        if(!(s = s || this.selNode || this.lastSelNode)){\n            return null;\n        }\n        // Here we pass in the current function to select to indicate the direction we're moving\n        var ps = s.previousSibling;\n        if(ps){\n            if(!ps.isExpanded() || ps.childNodes.length < 1){\n                return this.select(ps, this.selectPrevious);\n            } else{\n                var lc = ps.lastChild;\n                while(lc && lc.isExpanded() && Ext.fly(lc.ui.wrap).isVisible() && lc.childNodes.length > 0){\n                    lc = lc.lastChild;\n                }\n                return this.select(lc, this.selectPrevious);\n            }\n        } else if(s.parentNode && (this.tree.rootVisible || !s.parentNode.isRoot)){\n            return this.select(s.parentNode, this.selectPrevious);\n        }\n        return null;\n    },\n\n    /**\n     * Selects the node above the selected node in the tree, intelligently walking the nodes\n     * @return TreeNode The new selection\n     */\n    selectNext : function(/* private */ s){\n        if(!(s = s || this.selNode || this.lastSelNode)){\n            return null;\n        }\n        // Here we pass in the current function to select to indicate the direction we're moving\n        if(s.firstChild && s.isExpanded() && Ext.fly(s.ui.wrap).isVisible()){\n             return this.select(s.firstChild, this.selectNext);\n         }else if(s.nextSibling){\n             return this.select(s.nextSibling, this.selectNext);\n         }else if(s.parentNode){\n            var newS = null;\n            s.parentNode.bubble(function(){\n                if(this.nextSibling){\n                    newS = this.getOwnerTree().selModel.select(this.nextSibling, this.selectNext);\n                    return false;\n                }\n            });\n            return newS;\n         }\n        return null;\n    },\n\n    onKeyDown : function(e){\n        var s = this.selNode || this.lastSelNode;\n        // undesirable, but required\n        var sm = this;\n        if(!s){\n            return;\n        }\n        var k = e.getKey();\n        switch(k){\n             case e.DOWN:\n                 e.stopEvent();\n                 this.selectNext();\n             break;\n             case e.UP:\n                 e.stopEvent();\n                 this.selectPrevious();\n             break;\n             case e.RIGHT:\n                 e.preventDefault();\n                 if(s.hasChildNodes()){\n                     if(!s.isExpanded()){\n                         s.expand();\n                     }else if(s.firstChild){\n                         this.select(s.firstChild, e);\n                     }\n                 }\n             break;\n             case e.LEFT:\n                 e.preventDefault();\n                 if(s.hasChildNodes() && s.isExpanded()){\n                     s.collapse();\n                 }else if(s.parentNode && (this.tree.rootVisible || s.parentNode != this.tree.getRootNode())){\n                     this.select(s.parentNode, e);\n                 }\n             break;\n        };\n    }\n});\n\n/**\n * @class Ext.tree.MultiSelectionModel\n * @extends Ext.util.Observable\n * Multi selection for a TreePanel.\n */\nExt.tree.MultiSelectionModel = Ext.extend(Ext.util.Observable, {\n    \n    constructor : function(config){\n        this.selNodes = [];\n        this.selMap = {};\n        this.addEvents(\n            /**\n             * @event selectionchange\n             * Fires when the selected nodes change\n             * @param {MultiSelectionModel} this\n             * @param {Array} nodes Array of the selected nodes\n             */\n            'selectionchange'\n        );\n        Ext.apply(this, config);\n        Ext.tree.MultiSelectionModel.superclass.constructor.call(this);    \n    },\n    \n    init : function(tree){\n        this.tree = tree;\n        tree.mon(tree.getTreeEl(), 'keydown', this.onKeyDown, this);\n        tree.on('click', this.onNodeClick, this);\n    },\n    \n    onNodeClick : function(node, e){\n        if(e.ctrlKey && this.isSelected(node)){\n            this.unselect(node);\n        }else{\n            this.select(node, e, e.ctrlKey);\n        }\n    },\n    \n    /**\n     * Select a node.\n     * @param {TreeNode} node The node to select\n     * @param {EventObject} e (optional) An event associated with the selection\n     * @param {Boolean} keepExisting (optional) True to retain existing selections\n     * @return {TreeNode} The selected node\n     */\n    select : function(node, e, keepExisting){\n        if(keepExisting !== true){\n            this.clearSelections(true);\n        }\n        if(this.isSelected(node)){\n            this.lastSelNode = node;\n            return node;\n        }\n        this.selNodes.push(node);\n        this.selMap[node.id] = node;\n        this.lastSelNode = node;\n        node.ui.onSelectedChange(true);\n        this.fireEvent('selectionchange', this, this.selNodes);\n        return node;\n    },\n    \n    /**\n     * Deselect a node.\n     * @param {TreeNode} node The node to unselect\n     */\n    unselect : function(node){\n        if(this.selMap[node.id]){\n            node.ui.onSelectedChange(false);\n            var sn = this.selNodes;\n            var index = sn.indexOf(node);\n            if(index != -1){\n                this.selNodes.splice(index, 1);\n            }\n            delete this.selMap[node.id];\n            this.fireEvent('selectionchange', this, this.selNodes);\n        }\n    },\n    \n    /**\n     * Clear all selections\n     */\n    clearSelections : function(suppressEvent){\n        var sn = this.selNodes;\n        if(sn.length > 0){\n            for(var i = 0, len = sn.length; i < len; i++){\n                sn[i].ui.onSelectedChange(false);\n            }\n            this.selNodes = [];\n            this.selMap = {};\n            if(suppressEvent !== true){\n                this.fireEvent('selectionchange', this, this.selNodes);\n            }\n        }\n    },\n    \n    /**\n     * Returns true if the node is selected\n     * @param {TreeNode} node The node to check\n     * @return {Boolean}\n     */\n    isSelected : function(node){\n        return this.selMap[node.id] ? true : false;  \n    },\n    \n    /**\n     * Returns an array of the selected nodes\n     * @return {Array}\n     */\n    getSelectedNodes : function(){\n        return this.selNodes.concat([]);\n    },\n\n    onKeyDown : Ext.tree.DefaultSelectionModel.prototype.onKeyDown,\n\n    selectNext : Ext.tree.DefaultSelectionModel.prototype.selectNext,\n\n    selectPrevious : Ext.tree.DefaultSelectionModel.prototype.selectPrevious\n});/**\n * @class Ext.data.Tree\n * @extends Ext.util.Observable\n * Represents a tree data structure and bubbles all the events for its nodes. The nodes\n * in the tree have most standard DOM functionality.\n * @constructor\n * @param {Node} root (optional) The root node\n */\nExt.data.Tree = Ext.extend(Ext.util.Observable, {\n    \n    constructor: function(root){\n        this.nodeHash = {};\n        /**\n         * The root node for this tree\n         * @type Node\n         */\n        this.root = null;\n        if(root){\n            this.setRootNode(root);\n        }\n        this.addEvents(\n            /**\n             * @event append\n             * Fires when a new child node is appended to a node in this tree.\n             * @param {Tree} tree The owner tree\n             * @param {Node} parent The parent node\n             * @param {Node} node The newly appended node\n             * @param {Number} index The index of the newly appended node\n             */\n            \"append\",\n            /**\n             * @event remove\n             * Fires when a child node is removed from a node in this tree.\n             * @param {Tree} tree The owner tree\n             * @param {Node} parent The parent node\n             * @param {Node} node The child node removed\n             */\n            \"remove\",\n            /**\n             * @event move\n             * Fires when a node is moved to a new location in the tree\n             * @param {Tree} tree The owner tree\n             * @param {Node} node The node moved\n             * @param {Node} oldParent The old parent of this node\n             * @param {Node} newParent The new parent of this node\n             * @param {Number} index The index it was moved to\n             */\n            \"move\",\n            /**\n             * @event insert\n             * Fires when a new child node is inserted in a node in this tree.\n             * @param {Tree} tree The owner tree\n             * @param {Node} parent The parent node\n             * @param {Node} node The child node inserted\n             * @param {Node} refNode The child node the node was inserted before\n             */\n            \"insert\",\n            /**\n             * @event beforeappend\n             * Fires before a new child is appended to a node in this tree, return false to cancel the append.\n             * @param {Tree} tree The owner tree\n             * @param {Node} parent The parent node\n             * @param {Node} node The child node to be appended\n             */\n            \"beforeappend\",\n            /**\n             * @event beforeremove\n             * Fires before a child is removed from a node in this tree, return false to cancel the remove.\n             * @param {Tree} tree The owner tree\n             * @param {Node} parent The parent node\n             * @param {Node} node The child node to be removed\n             */\n            \"beforeremove\",\n            /**\n             * @event beforemove\n             * Fires before a node is moved to a new location in the tree. Return false to cancel the move.\n             * @param {Tree} tree The owner tree\n             * @param {Node} node The node being moved\n             * @param {Node} oldParent The parent of the node\n             * @param {Node} newParent The new parent the node is moving to\n             * @param {Number} index The index it is being moved to\n             */\n            \"beforemove\",\n            /**\n             * @event beforeinsert\n             * Fires before a new child is inserted in a node in this tree, return false to cancel the insert.\n             * @param {Tree} tree The owner tree\n             * @param {Node} parent The parent node\n             * @param {Node} node The child node to be inserted\n             * @param {Node} refNode The child node the node is being inserted before\n             */\n            \"beforeinsert\"\n        );\n        Ext.data.Tree.superclass.constructor.call(this);        \n    },\n    \n    /**\n     * @cfg {String} pathSeparator\n     * The token used to separate paths in node ids (defaults to '/').\n     */\n    pathSeparator: \"/\",\n\n    // private\n    proxyNodeEvent : function(){\n        return this.fireEvent.apply(this, arguments);\n    },\n\n    /**\n     * Returns the root node for this tree.\n     * @return {Node}\n     */\n    getRootNode : function(){\n        return this.root;\n    },\n\n    /**\n     * Sets the root node for this tree.\n     * @param {Node} node\n     * @return {Node}\n     */\n    setRootNode : function(node){\n        this.root = node;\n        node.ownerTree = this;\n        node.isRoot = true;\n        this.registerNode(node);\n        return node;\n    },\n\n    /**\n     * Gets a node in this tree by its id.\n     * @param {String} id\n     * @return {Node}\n     */\n    getNodeById : function(id){\n        return this.nodeHash[id];\n    },\n\n    // private\n    registerNode : function(node){\n        this.nodeHash[node.id] = node;\n    },\n\n    // private\n    unregisterNode : function(node){\n        delete this.nodeHash[node.id];\n    },\n\n    toString : function(){\n        return \"[Tree\"+(this.id?\" \"+this.id:\"\")+\"]\";\n    }\n});\n\n/**\n * @class Ext.data.Node\n * @extends Ext.util.Observable\n * @cfg {Boolean} leaf true if this node is a leaf and does not have children\n * @cfg {String} id The id for this node. If one is not specified, one is generated.\n * @constructor\n * @param {Object} attributes The attributes/config for the node\n */\nExt.data.Node = Ext.extend(Ext.util.Observable, {\n    \n    constructor: function(attributes){\n        /**\n         * The attributes supplied for the node. You can use this property to access any custom attributes you supplied.\n         * @type {Object}\n         */\n        this.attributes = attributes || {};\n        this.leaf = this.attributes.leaf;\n        /**\n         * The node id. @type String\n         */\n        this.id = this.attributes.id;\n        if(!this.id){\n            this.id = Ext.id(null, \"xnode-\");\n            this.attributes.id = this.id;\n        }\n        /**\n         * All child nodes of this node. @type Array\n         */\n        this.childNodes = [];\n        /**\n         * The parent node for this node. @type Node\n         */\n        this.parentNode = null;\n        /**\n         * The first direct child node of this node, or null if this node has no child nodes. @type Node\n         */\n        this.firstChild = null;\n        /**\n         * The last direct child node of this node, or null if this node has no child nodes. @type Node\n         */\n        this.lastChild = null;\n        /**\n         * The node immediately preceding this node in the tree, or null if there is no sibling node. @type Node\n         */\n        this.previousSibling = null;\n        /**\n         * The node immediately following this node in the tree, or null if there is no sibling node. @type Node\n         */\n        this.nextSibling = null;\n\n        this.addEvents({\n            /**\n             * @event append\n             * Fires when a new child node is appended\n             * @param {Tree} tree The owner tree\n             * @param {Node} this This node\n             * @param {Node} node The newly appended node\n             * @param {Number} index The index of the newly appended node\n             */\n            \"append\" : true,\n            /**\n             * @event remove\n             * Fires when a child node is removed\n             * @param {Tree} tree The owner tree\n             * @param {Node} this This node\n             * @param {Node} node The removed node\n             */\n            \"remove\" : true,\n            /**\n             * @event move\n             * Fires when this node is moved to a new location in the tree\n             * @param {Tree} tree The owner tree\n             * @param {Node} this This node\n             * @param {Node} oldParent The old parent of this node\n             * @param {Node} newParent The new parent of this node\n             * @param {Number} index The index it was moved to\n             */\n            \"move\" : true,\n            /**\n             * @event insert\n             * Fires when a new child node is inserted.\n             * @param {Tree} tree The owner tree\n             * @param {Node} this This node\n             * @param {Node} node The child node inserted\n             * @param {Node} refNode The child node the node was inserted before\n             */\n            \"insert\" : true,\n            /**\n             * @event beforeappend\n             * Fires before a new child is appended, return false to cancel the append.\n             * @param {Tree} tree The owner tree\n             * @param {Node} this This node\n             * @param {Node} node The child node to be appended\n             */\n            \"beforeappend\" : true,\n            /**\n             * @event beforeremove\n             * Fires before a child is removed, return false to cancel the remove.\n             * @param {Tree} tree The owner tree\n             * @param {Node} this This node\n             * @param {Node} node The child node to be removed\n             */\n            \"beforeremove\" : true,\n            /**\n             * @event beforemove\n             * Fires before this node is moved to a new location in the tree. Return false to cancel the move.\n             * @param {Tree} tree The owner tree\n             * @param {Node} this This node\n             * @param {Node} oldParent The parent of this node\n             * @param {Node} newParent The new parent this node is moving to\n             * @param {Number} index The index it is being moved to\n             */\n            \"beforemove\" : true,\n             /**\n              * @event beforeinsert\n              * Fires before a new child is inserted, return false to cancel the insert.\n              * @param {Tree} tree The owner tree\n              * @param {Node} this This node\n              * @param {Node} node The child node to be inserted\n              * @param {Node} refNode The child node the node is being inserted before\n              */\n            \"beforeinsert\" : true\n        });\n        this.listeners = this.attributes.listeners;\n        Ext.data.Node.superclass.constructor.call(this);    \n    },\n    \n    // private\n    fireEvent : function(evtName){\n        // first do standard event for this node\n        if(Ext.data.Node.superclass.fireEvent.apply(this, arguments) === false){\n            return false;\n        }\n        // then bubble it up to the tree if the event wasn't cancelled\n        var ot = this.getOwnerTree();\n        if(ot){\n            if(ot.proxyNodeEvent.apply(ot, arguments) === false){\n                return false;\n            }\n        }\n        return true;\n    },\n\n    /**\n     * Returns true if this node is a leaf\n     * @return {Boolean}\n     */\n    isLeaf : function(){\n        return this.leaf === true;\n    },\n\n    // private\n    setFirstChild : function(node){\n        this.firstChild = node;\n    },\n\n    //private\n    setLastChild : function(node){\n        this.lastChild = node;\n    },\n\n\n    /**\n     * Returns true if this node is the last child of its parent\n     * @return {Boolean}\n     */\n    isLast : function(){\n       return (!this.parentNode ? true : this.parentNode.lastChild == this);\n    },\n\n    /**\n     * Returns true if this node is the first child of its parent\n     * @return {Boolean}\n     */\n    isFirst : function(){\n       return (!this.parentNode ? true : this.parentNode.firstChild == this);\n    },\n\n    /**\n     * Returns true if this node has one or more child nodes, else false.\n     * @return {Boolean}\n     */\n    hasChildNodes : function(){\n        return !this.isLeaf() && this.childNodes.length > 0;\n    },\n\n    /**\n     * Returns true if this node has one or more child nodes, or if the <tt>expandable</tt>\n     * node attribute is explicitly specified as true (see {@link #attributes}), otherwise returns false.\n     * @return {Boolean}\n     */\n    isExpandable : function(){\n        return this.attributes.expandable || this.hasChildNodes();\n    },\n\n    /**\n     * Insert node(s) as the last child node of this node.\n     * @param {Node/Array} node The node or Array of nodes to append\n     * @return {Node} The appended node if single append, or null if an array was passed\n     */\n    appendChild : function(node){\n        var multi = false;\n        if(Ext.isArray(node)){\n            multi = node;\n        }else if(arguments.length > 1){\n            multi = arguments;\n        }\n        // if passed an array or multiple args do them one by one\n        if(multi){\n            for(var i = 0, len = multi.length; i < len; i++) {\n                this.appendChild(multi[i]);\n            }\n        }else{\n            if(this.fireEvent(\"beforeappend\", this.ownerTree, this, node) === false){\n                return false;\n            }\n            var index = this.childNodes.length;\n            var oldParent = node.parentNode;\n            // it's a move, make sure we move it cleanly\n            if(oldParent){\n                if(node.fireEvent(\"beforemove\", node.getOwnerTree(), node, oldParent, this, index) === false){\n                    return false;\n                }\n                oldParent.removeChild(node);\n            }\n            index = this.childNodes.length;\n            if(index === 0){\n                this.setFirstChild(node);\n            }\n            this.childNodes.push(node);\n            node.parentNode = this;\n            var ps = this.childNodes[index-1];\n            if(ps){\n                node.previousSibling = ps;\n                ps.nextSibling = node;\n            }else{\n                node.previousSibling = null;\n            }\n            node.nextSibling = null;\n            this.setLastChild(node);\n            node.setOwnerTree(this.getOwnerTree());\n            this.fireEvent(\"append\", this.ownerTree, this, node, index);\n            if(oldParent){\n                node.fireEvent(\"move\", this.ownerTree, node, oldParent, this, index);\n            }\n            return node;\n        }\n    },\n\n    /**\n     * Removes a child node from this node.\n     * @param {Node} node The node to remove\n     * @param {Boolean} destroy <tt>true</tt> to destroy the node upon removal. Defaults to <tt>false</tt>.\n     * @return {Node} The removed node\n     */\n    removeChild : function(node, destroy){\n        var index = this.childNodes.indexOf(node);\n        if(index == -1){\n            return false;\n        }\n        if(this.fireEvent(\"beforeremove\", this.ownerTree, this, node) === false){\n            return false;\n        }\n\n        // remove it from childNodes collection\n        this.childNodes.splice(index, 1);\n\n        // update siblings\n        if(node.previousSibling){\n            node.previousSibling.nextSibling = node.nextSibling;\n        }\n        if(node.nextSibling){\n            node.nextSibling.previousSibling = node.previousSibling;\n        }\n\n        // update child refs\n        if(this.firstChild == node){\n            this.setFirstChild(node.nextSibling);\n        }\n        if(this.lastChild == node){\n            this.setLastChild(node.previousSibling);\n        }\n\n        this.fireEvent(\"remove\", this.ownerTree, this, node);\n        if(destroy){\n            node.destroy(true);\n        }else{\n            node.clear();\n        }\n        return node;\n    },\n\n    // private\n    clear : function(destroy){\n        // clear any references from the node\n        this.setOwnerTree(null, destroy);\n        this.parentNode = this.previousSibling = this.nextSibling = null;\n        if(destroy){\n            this.firstChild = this.lastChild = null;\n        }\n    },\n\n    /**\n     * Destroys the node.\n     */\n    destroy : function(/* private */ silent){\n        /*\n         * Silent is to be used in a number of cases\n         * 1) When setRootNode is called.\n         * 2) When destroy on the tree is called\n         * 3) For destroying child nodes on a node\n         */\n        if(silent === true){\n            this.purgeListeners();\n            this.clear(true);\n            Ext.each(this.childNodes, function(n){\n                n.destroy(true);\n            });\n            this.childNodes = null;\n        }else{\n            this.remove(true);\n        }\n    },\n\n    /**\n     * Inserts the first node before the second node in this nodes childNodes collection.\n     * @param {Node} node The node to insert\n     * @param {Node} refNode The node to insert before (if null the node is appended)\n     * @return {Node} The inserted node\n     */\n    insertBefore : function(node, refNode){\n        if(!refNode){ // like standard Dom, refNode can be null for append\n            return this.appendChild(node);\n        }\n        // nothing to do\n        if(node == refNode){\n            return false;\n        }\n\n        if(this.fireEvent(\"beforeinsert\", this.ownerTree, this, node, refNode) === false){\n            return false;\n        }\n        var index = this.childNodes.indexOf(refNode);\n        var oldParent = node.parentNode;\n        var refIndex = index;\n\n        // when moving internally, indexes will change after remove\n        if(oldParent == this && this.childNodes.indexOf(node) < index){\n            refIndex--;\n        }\n\n        // it's a move, make sure we move it cleanly\n        if(oldParent){\n            if(node.fireEvent(\"beforemove\", node.getOwnerTree(), node, oldParent, this, index, refNode) === false){\n                return false;\n            }\n            oldParent.removeChild(node);\n        }\n        if(refIndex === 0){\n            this.setFirstChild(node);\n        }\n        this.childNodes.splice(refIndex, 0, node);\n        node.parentNode = this;\n        var ps = this.childNodes[refIndex-1];\n        if(ps){\n            node.previousSibling = ps;\n            ps.nextSibling = node;\n        }else{\n            node.previousSibling = null;\n        }\n        node.nextSibling = refNode;\n        refNode.previousSibling = node;\n        node.setOwnerTree(this.getOwnerTree());\n        this.fireEvent(\"insert\", this.ownerTree, this, node, refNode);\n        if(oldParent){\n            node.fireEvent(\"move\", this.ownerTree, node, oldParent, this, refIndex, refNode);\n        }\n        return node;\n    },\n\n    /**\n     * Removes this node from its parent\n     * @param {Boolean} destroy <tt>true</tt> to destroy the node upon removal. Defaults to <tt>false</tt>.\n     * @return {Node} this\n     */\n    remove : function(destroy){\n        if (this.parentNode) {\n            this.parentNode.removeChild(this, destroy);\n        }\n        return this;\n    },\n\n    /**\n     * Removes all child nodes from this node.\n     * @param {Boolean} destroy <tt>true</tt> to destroy the node upon removal. Defaults to <tt>false</tt>.\n     * @return {Node} this\n     */\n    removeAll : function(destroy){\n        var cn = this.childNodes,\n            n;\n        while((n = cn[0])){\n            this.removeChild(n, destroy);\n        }\n        return this;\n    },\n\n    /**\n     * Returns the child node at the specified index.\n     * @param {Number} index\n     * @return {Node}\n     */\n    item : function(index){\n        return this.childNodes[index];\n    },\n\n    /**\n     * Replaces one child node in this node with another.\n     * @param {Node} newChild The replacement node\n     * @param {Node} oldChild The node to replace\n     * @return {Node} The replaced node\n     */\n    replaceChild : function(newChild, oldChild){\n        var s = oldChild ? oldChild.nextSibling : null;\n        this.removeChild(oldChild);\n        this.insertBefore(newChild, s);\n        return oldChild;\n    },\n\n    /**\n     * Returns the index of a child node\n     * @param {Node} node\n     * @return {Number} The index of the node or -1 if it was not found\n     */\n    indexOf : function(child){\n        return this.childNodes.indexOf(child);\n    },\n\n    /**\n     * Returns the tree this node is in.\n     * @return {Tree}\n     */\n    getOwnerTree : function(){\n        // if it doesn't have one, look for one\n        if(!this.ownerTree){\n            var p = this;\n            while(p){\n                if(p.ownerTree){\n                    this.ownerTree = p.ownerTree;\n                    break;\n                }\n                p = p.parentNode;\n            }\n        }\n        return this.ownerTree;\n    },\n\n    /**\n     * Returns depth of this node (the root node has a depth of 0)\n     * @return {Number}\n     */\n    getDepth : function(){\n        var depth = 0;\n        var p = this;\n        while(p.parentNode){\n            ++depth;\n            p = p.parentNode;\n        }\n        return depth;\n    },\n\n    // private\n    setOwnerTree : function(tree, destroy){\n        // if it is a move, we need to update everyone\n        if(tree != this.ownerTree){\n            if(this.ownerTree){\n                this.ownerTree.unregisterNode(this);\n            }\n            this.ownerTree = tree;\n            // If we're destroying, we don't need to recurse since it will be called on each child node\n            if(destroy !== true){\n                Ext.each(this.childNodes, function(n){\n                    n.setOwnerTree(tree);\n                });\n            }\n            if(tree){\n                tree.registerNode(this);\n            }\n        }\n    },\n\n    /**\n     * Changes the id of this node.\n     * @param {String} id The new id for the node.\n     */\n    setId: function(id){\n        if(id !== this.id){\n            var t = this.ownerTree;\n            if(t){\n                t.unregisterNode(this);\n            }\n            this.id = this.attributes.id = id;\n            if(t){\n                t.registerNode(this);\n            }\n            this.onIdChange(id);\n        }\n    },\n\n    // private\n    onIdChange: Ext.emptyFn,\n\n    /**\n     * Returns the path for this node. The path can be used to expand or select this node programmatically.\n     * @param {String} attr (optional) The attr to use for the path (defaults to the node's id)\n     * @return {String} The path\n     */\n    getPath : function(attr){\n        attr = attr || \"id\";\n        var p = this.parentNode;\n        var b = [this.attributes[attr]];\n        while(p){\n            b.unshift(p.attributes[attr]);\n            p = p.parentNode;\n        }\n        var sep = this.getOwnerTree().pathSeparator;\n        return sep + b.join(sep);\n    },\n\n    /**\n     * Bubbles up the tree from this node, calling the specified function with each node. The arguments to the function\n     * will be the args provided or the current node. If the function returns false at any point,\n     * the bubble is stopped.\n     * @param {Function} fn The function to call\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to the current Node.\n     * @param {Array} args (optional) The args to call the function with (default to passing the current Node)\n     */\n    bubble : function(fn, scope, args){\n        var p = this;\n        while(p){\n            if(fn.apply(scope || p, args || [p]) === false){\n                break;\n            }\n            p = p.parentNode;\n        }\n    },\n\n    /**\n     * Cascades down the tree from this node, calling the specified function with each node. The arguments to the function\n     * will be the args provided or the current node. If the function returns false at any point,\n     * the cascade is stopped on that branch.\n     * @param {Function} fn The function to call\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to the current Node.\n     * @param {Array} args (optional) The args to call the function with (default to passing the current Node)\n     */\n    cascade : function(fn, scope, args){\n        if(fn.apply(scope || this, args || [this]) !== false){\n            var cs = this.childNodes;\n            for(var i = 0, len = cs.length; i < len; i++) {\n                cs[i].cascade(fn, scope, args);\n            }\n        }\n    },\n\n    /**\n     * Interates the child nodes of this node, calling the specified function with each node. The arguments to the function\n     * will be the args provided or the current node. If the function returns false at any point,\n     * the iteration stops.\n     * @param {Function} fn The function to call\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to the current Node in the iteration.\n     * @param {Array} args (optional) The args to call the function with (default to passing the current Node)\n     */\n    eachChild : function(fn, scope, args){\n        var cs = this.childNodes;\n        for(var i = 0, len = cs.length; i < len; i++) {\n            if(fn.apply(scope || cs[i], args || [cs[i]]) === false){\n                break;\n            }\n        }\n    },\n\n    /**\n     * Finds the first child that has the attribute with the specified value.\n     * @param {String} attribute The attribute name\n     * @param {Mixed} value The value to search for\n     * @param {Boolean} deep (Optional) True to search through nodes deeper than the immediate children\n     * @return {Node} The found child or null if none was found\n     */\n    findChild : function(attribute, value, deep){\n        return this.findChildBy(function(){\n            return this.attributes[attribute] == value;\n        }, null, deep);\n    },\n\n    /**\n     * Finds the first child by a custom function. The child matches if the function passed returns <code>true</code>.\n     * @param {Function} fn A function which must return <code>true</code> if the passed Node is the required Node.\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to the Node being tested.\n     * @param {Boolean} deep (Optional) True to search through nodes deeper than the immediate children\n     * @return {Node} The found child or null if none was found\n     */\n    findChildBy : function(fn, scope, deep){\n        var cs = this.childNodes,\n            len = cs.length,\n            i = 0,\n            n,\n            res;\n        for(; i < len; i++){\n            n = cs[i];\n            if(fn.call(scope || n, n) === true){\n                return n;\n            }else if (deep){\n                res = n.findChildBy(fn, scope, deep);\n                if(res != null){\n                    return res;\n                }\n            }\n            \n        }\n        return null;\n    },\n\n    /**\n     * Sorts this nodes children using the supplied sort function.\n     * @param {Function} fn A function which, when passed two Nodes, returns -1, 0 or 1 depending upon required sort order.\n     * @param {Object} scope (optional)The scope (<code>this</code> reference) in which the function is executed. Defaults to the browser window.\n     */\n    sort : function(fn, scope){\n        var cs = this.childNodes;\n        var len = cs.length;\n        if(len > 0){\n            var sortFn = scope ? function(){fn.apply(scope, arguments);} : fn;\n            cs.sort(sortFn);\n            for(var i = 0; i < len; i++){\n                var n = cs[i];\n                n.previousSibling = cs[i-1];\n                n.nextSibling = cs[i+1];\n                if(i === 0){\n                    this.setFirstChild(n);\n                }\n                if(i == len-1){\n                    this.setLastChild(n);\n                }\n            }\n        }\n    },\n\n    /**\n     * Returns true if this node is an ancestor (at any point) of the passed node.\n     * @param {Node} node\n     * @return {Boolean}\n     */\n    contains : function(node){\n        return node.isAncestor(this);\n    },\n\n    /**\n     * Returns true if the passed node is an ancestor (at any point) of this node.\n     * @param {Node} node\n     * @return {Boolean}\n     */\n    isAncestor : function(node){\n        var p = this.parentNode;\n        while(p){\n            if(p == node){\n                return true;\n            }\n            p = p.parentNode;\n        }\n        return false;\n    },\n\n    toString : function(){\n        return \"[Node\"+(this.id?\" \"+this.id:\"\")+\"]\";\n    }\n});/**\n * @class Ext.tree.TreeNode\n * @extends Ext.data.Node\n * @cfg {String} text The text for this node\n * @cfg {Boolean} expanded true to start the node expanded\n * @cfg {Boolean} allowDrag False to make this node undraggable if {@link #draggable} = true (defaults to true)\n * @cfg {Boolean} allowDrop False if this node cannot have child nodes dropped on it (defaults to true)\n * @cfg {Boolean} disabled true to start the node disabled\n * @cfg {String} icon The path to an icon for the node. The preferred way to do this\n * is to use the cls or iconCls attributes and add the icon via a CSS background image.\n * @cfg {String} cls A css class to be added to the node\n * @cfg {String} iconCls A css class to be added to the nodes icon element for applying css background images\n * @cfg {String} href URL of the link used for the node (defaults to #)\n * @cfg {String} hrefTarget target frame for the link\n * @cfg {Boolean} hidden True to render hidden. (Defaults to false).\n * @cfg {String} qtip An Ext QuickTip for the node\n * @cfg {Boolean} expandable If set to true, the node will always show a plus/minus icon, even when empty\n * @cfg {String} qtipCfg An Ext QuickTip config for the node (used instead of qtip)\n * @cfg {Boolean} singleClickExpand True for single click expand on this node\n * @cfg {Function} uiProvider A UI <b>class</b> to use for this node (defaults to Ext.tree.TreeNodeUI)\n * @cfg {Boolean} checked True to render a checked checkbox for this node, false to render an unchecked checkbox\n * (defaults to undefined with no checkbox rendered)\n * @cfg {Boolean} draggable True to make this node draggable (defaults to false)\n * @cfg {Boolean} isTarget False to not allow this node to act as a drop target (defaults to true)\n * @cfg {Boolean} allowChildren False to not allow this node to have child nodes (defaults to true)\n * @cfg {Boolean} editable False to not allow this node to be edited by an {@link Ext.tree.TreeEditor} (defaults to true)\n * @constructor\n * @param {Object/String} attributes The attributes/config for the node or just a string with the text for the node\n */\nExt.tree.TreeNode = Ext.extend(Ext.data.Node, {\n    \n    constructor : function(attributes){\n        attributes = attributes || {};\n        if(Ext.isString(attributes)){\n            attributes = {text: attributes};\n        }\n        this.childrenRendered = false;\n        this.rendered = false;\n        Ext.tree.TreeNode.superclass.constructor.call(this, attributes);\n        this.expanded = attributes.expanded === true;\n        this.isTarget = attributes.isTarget !== false;\n        this.draggable = attributes.draggable !== false && attributes.allowDrag !== false;\n        this.allowChildren = attributes.allowChildren !== false && attributes.allowDrop !== false;\n\n        /**\n         * Read-only. The text for this node. To change it use <code>{@link #setText}</code>.\n         * @type String\n         */\n        this.text = attributes.text;\n        /**\n         * True if this node is disabled.\n         * @type Boolean\n         */\n        this.disabled = attributes.disabled === true;\n        /**\n         * True if this node is hidden.\n         * @type Boolean\n         */\n        this.hidden = attributes.hidden === true;\n    \n        this.addEvents(\n            /**\n            * @event textchange\n            * Fires when the text for this node is changed\n            * @param {Node} this This node\n            * @param {String} text The new text\n            * @param {String} oldText The old text\n            */\n            'textchange',\n            /**\n            * @event beforeexpand\n            * Fires before this node is expanded, return false to cancel.\n            * @param {Node} this This node\n            * @param {Boolean} deep\n            * @param {Boolean} anim\n            */\n            'beforeexpand',\n            /**\n            * @event beforecollapse\n            * Fires before this node is collapsed, return false to cancel.\n            * @param {Node} this This node\n            * @param {Boolean} deep\n            * @param {Boolean} anim\n            */\n            'beforecollapse',\n            /**\n            * @event expand\n            * Fires when this node is expanded\n            * @param {Node} this This node\n            */\n            'expand',\n            /**\n            * @event disabledchange\n            * Fires when the disabled status of this node changes\n            * @param {Node} this This node\n            * @param {Boolean} disabled\n            */\n            'disabledchange',\n            /**\n            * @event collapse\n            * Fires when this node is collapsed\n            * @param {Node} this This node\n            */\n            'collapse',\n            /**\n            * @event beforeclick\n            * Fires before click processing. Return false to cancel the default action.\n            * @param {Node} this This node\n            * @param {Ext.EventObject} e The event object\n            */\n            'beforeclick',\n            /**\n            * @event click\n            * Fires when this node is clicked\n            * @param {Node} this This node\n            * @param {Ext.EventObject} e The event object\n            */\n            'click',\n            /**\n            * @event checkchange\n            * Fires when a node with a checkbox's checked property changes\n            * @param {Node} this This node\n            * @param {Boolean} checked\n            */\n            'checkchange',\n            /**\n            * @event beforedblclick\n            * Fires before double click processing. Return false to cancel the default action.\n            * @param {Node} this This node\n            * @param {Ext.EventObject} e The event object\n            */\n            'beforedblclick',\n            /**\n            * @event dblclick\n            * Fires when this node is double clicked\n            * @param {Node} this This node\n            * @param {Ext.EventObject} e The event object\n            */\n            'dblclick',\n            /**\n            * @event contextmenu\n            * Fires when this node is right clicked\n            * @param {Node} this This node\n            * @param {Ext.EventObject} e The event object\n            */\n            'contextmenu',\n            /**\n            * @event beforechildrenrendered\n            * Fires right before the child nodes for this node are rendered\n            * @param {Node} this This node\n            */\n            'beforechildrenrendered'\n        );\n    \n        var uiClass = this.attributes.uiProvider || this.defaultUI || Ext.tree.TreeNodeUI;\n    \n        /**\n         * Read-only. The UI for this node\n         * @type TreeNodeUI\n         */\n        this.ui = new uiClass(this);    \n    },\n    \n    preventHScroll : true,\n    /**\n     * Returns true if this node is expanded\n     * @return {Boolean}\n     */\n    isExpanded : function(){\n        return this.expanded;\n    },\n\n/**\n * Returns the UI object for this node.\n * @return {TreeNodeUI} The object which is providing the user interface for this tree\n * node. Unless otherwise specified in the {@link #uiProvider}, this will be an instance\n * of {@link Ext.tree.TreeNodeUI}\n */\n    getUI : function(){\n        return this.ui;\n    },\n\n    getLoader : function(){\n        var owner;\n        return this.loader || ((owner = this.getOwnerTree()) && owner.loader ? owner.loader : (this.loader = new Ext.tree.TreeLoader()));\n    },\n\n    // private override\n    setFirstChild : function(node){\n        var of = this.firstChild;\n        Ext.tree.TreeNode.superclass.setFirstChild.call(this, node);\n        if(this.childrenRendered && of && node != of){\n            of.renderIndent(true, true);\n        }\n        if(this.rendered){\n            this.renderIndent(true, true);\n        }\n    },\n\n    // private override\n    setLastChild : function(node){\n        var ol = this.lastChild;\n        Ext.tree.TreeNode.superclass.setLastChild.call(this, node);\n        if(this.childrenRendered && ol && node != ol){\n            ol.renderIndent(true, true);\n        }\n        if(this.rendered){\n            this.renderIndent(true, true);\n        }\n    },\n\n    // these methods are overridden to provide lazy rendering support\n    // private override\n    appendChild : function(n){\n        if(!n.render && !Ext.isArray(n)){\n            n = this.getLoader().createNode(n);\n        }\n        var node = Ext.tree.TreeNode.superclass.appendChild.call(this, n);\n        if(node && this.childrenRendered){\n            node.render();\n        }\n        this.ui.updateExpandIcon();\n        return node;\n    },\n\n    // private override\n    removeChild : function(node, destroy){\n        this.ownerTree.getSelectionModel().unselect(node);\n        Ext.tree.TreeNode.superclass.removeChild.apply(this, arguments);\n        // only update the ui if we're not destroying\n        if(!destroy){\n            var rendered = node.ui.rendered;\n            // if it's been rendered remove dom node\n            if(rendered){\n                node.ui.remove();\n            }\n            if(rendered && this.childNodes.length < 1){\n                this.collapse(false, false);\n            }else{\n                this.ui.updateExpandIcon();\n            }\n            if(!this.firstChild && !this.isHiddenRoot()){\n                this.childrenRendered = false;\n            }\n        }\n        return node;\n    },\n\n    // private override\n    insertBefore : function(node, refNode){\n        if(!node.render){\n            node = this.getLoader().createNode(node);\n        }\n        var newNode = Ext.tree.TreeNode.superclass.insertBefore.call(this, node, refNode);\n        if(newNode && refNode && this.childrenRendered){\n            node.render();\n        }\n        this.ui.updateExpandIcon();\n        return newNode;\n    },\n\n    /**\n     * Sets the text for this node\n     * @param {String} text\n     */\n    setText : function(text){\n        var oldText = this.text;\n        this.text = this.attributes.text = text;\n        if(this.rendered){ // event without subscribing\n            this.ui.onTextChange(this, text, oldText);\n        }\n        this.fireEvent('textchange', this, text, oldText);\n    },\n    \n    /**\n     * Sets the icon class for this node.\n     * @param {String} cls\n     */\n    setIconCls : function(cls){\n        var old = this.attributes.iconCls;\n        this.attributes.iconCls = cls;\n        if(this.rendered){\n            this.ui.onIconClsChange(this, cls, old);\n        }\n    },\n    \n    /**\n     * Sets the tooltip for this node.\n     * @param {String} tip The text for the tip\n     * @param {String} title (Optional) The title for the tip\n     */\n    setTooltip : function(tip, title){\n        this.attributes.qtip = tip;\n        this.attributes.qtipTitle = title;\n        if(this.rendered){\n            this.ui.onTipChange(this, tip, title);\n        }\n    },\n    \n    /**\n     * Sets the icon for this node.\n     * @param {String} icon\n     */\n    setIcon : function(icon){\n        this.attributes.icon = icon;\n        if(this.rendered){\n            this.ui.onIconChange(this, icon);\n        }\n    },\n    \n    /**\n     * Sets the href for the node.\n     * @param {String} href The href to set\n     * @param {String} (Optional) target The target of the href\n     */\n    setHref : function(href, target){\n        this.attributes.href = href;\n        this.attributes.hrefTarget = target;\n        if(this.rendered){\n            this.ui.onHrefChange(this, href, target);\n        }\n    },\n    \n    /**\n     * Sets the class on this node.\n     * @param {String} cls\n     */\n    setCls : function(cls){\n        var old = this.attributes.cls;\n        this.attributes.cls = cls;\n        if(this.rendered){\n            this.ui.onClsChange(this, cls, old);\n        }\n    },\n\n    /**\n     * Triggers selection of this node\n     */\n    select : function(){\n        var t = this.getOwnerTree();\n        if(t){\n            t.getSelectionModel().select(this);\n        }\n    },\n\n    /**\n     * Triggers deselection of this node\n     * @param {Boolean} silent (optional) True to stop selection change events from firing.\n     */\n    unselect : function(silent){\n        var t = this.getOwnerTree();\n        if(t){\n            t.getSelectionModel().unselect(this, silent);\n        }\n    },\n\n    /**\n     * Returns true if this node is selected\n     * @return {Boolean}\n     */\n    isSelected : function(){\n        var t = this.getOwnerTree();\n        return t ? t.getSelectionModel().isSelected(this) : false;\n    },\n\n    /**\n     * Expand this node.\n     * @param {Boolean} deep (optional) True to expand all children as well\n     * @param {Boolean} anim (optional) false to cancel the default animation\n     * @param {Function} callback (optional) A callback to be called when\n     * expanding this node completes (does not wait for deep expand to complete).\n     * Called with 1 parameter, this node.\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the callback is executed. Defaults to this TreeNode.\n     */\n    expand : function(deep, anim, callback, scope){\n        if(!this.expanded){\n            if(this.fireEvent('beforeexpand', this, deep, anim) === false){\n                return;\n            }\n            if(!this.childrenRendered){\n                this.renderChildren();\n            }\n            this.expanded = true;\n            if(!this.isHiddenRoot() && (this.getOwnerTree().animate && anim !== false) || anim){\n                this.ui.animExpand(function(){\n                    this.fireEvent('expand', this);\n                    this.runCallback(callback, scope || this, [this]);\n                    if(deep === true){\n                        this.expandChildNodes(true, true);\n                    }\n                }.createDelegate(this));\n                return;\n            }else{\n                this.ui.expand();\n                this.fireEvent('expand', this);\n                this.runCallback(callback, scope || this, [this]);\n            }\n        }else{\n           this.runCallback(callback, scope || this, [this]);\n        }\n        if(deep === true){\n            this.expandChildNodes(true);\n        }\n    },\n\n    runCallback : function(cb, scope, args){\n        if(Ext.isFunction(cb)){\n            cb.apply(scope, args);\n        }\n    },\n\n    isHiddenRoot : function(){\n        return this.isRoot && !this.getOwnerTree().rootVisible;\n    },\n\n    /**\n     * Collapse this node.\n     * @param {Boolean} deep (optional) True to collapse all children as well\n     * @param {Boolean} anim (optional) false to cancel the default animation\n     * @param {Function} callback (optional) A callback to be called when\n     * expanding this node completes (does not wait for deep expand to complete).\n     * Called with 1 parameter, this node.\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the callback is executed. Defaults to this TreeNode.\n     */\n    collapse : function(deep, anim, callback, scope){\n        if(this.expanded && !this.isHiddenRoot()){\n            if(this.fireEvent('beforecollapse', this, deep, anim) === false){\n                return;\n            }\n            this.expanded = false;\n            if((this.getOwnerTree().animate && anim !== false) || anim){\n                this.ui.animCollapse(function(){\n                    this.fireEvent('collapse', this);\n                    this.runCallback(callback, scope || this, [this]);\n                    if(deep === true){\n                        this.collapseChildNodes(true);\n                    }\n                }.createDelegate(this));\n                return;\n            }else{\n                this.ui.collapse();\n                this.fireEvent('collapse', this);\n                this.runCallback(callback, scope || this, [this]);\n            }\n        }else if(!this.expanded){\n            this.runCallback(callback, scope || this, [this]);\n        }\n        if(deep === true){\n            var cs = this.childNodes;\n            for(var i = 0, len = cs.length; i < len; i++) {\n            \tcs[i].collapse(true, false);\n            }\n        }\n    },\n\n    // private\n    delayedExpand : function(delay){\n        if(!this.expandProcId){\n            this.expandProcId = this.expand.defer(delay, this);\n        }\n    },\n\n    // private\n    cancelExpand : function(){\n        if(this.expandProcId){\n            clearTimeout(this.expandProcId);\n        }\n        this.expandProcId = false;\n    },\n\n    /**\n     * Toggles expanded/collapsed state of the node\n     */\n    toggle : function(){\n        if(this.expanded){\n            this.collapse();\n        }else{\n            this.expand();\n        }\n    },\n\n    /**\n     * Ensures all parent nodes are expanded, and if necessary, scrolls\n     * the node into view.\n     * @param {Function} callback (optional) A function to call when the node has been made visible.\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the callback is executed. Defaults to this TreeNode.\n     */\n    ensureVisible : function(callback, scope){\n        var tree = this.getOwnerTree();\n        tree.expandPath(this.parentNode ? this.parentNode.getPath() : this.getPath(), false, function(){\n            var node = tree.getNodeById(this.id);  // Somehow if we don't do this, we lose changes that happened to node in the meantime\n            tree.getTreeEl().scrollChildIntoView(node.ui.anchor);\n            this.runCallback(callback, scope || this, [this]);\n        }.createDelegate(this));\n    },\n\n    /**\n     * Expand all child nodes\n     * @param {Boolean} deep (optional) true if the child nodes should also expand their child nodes\n     */\n    expandChildNodes : function(deep, anim) {\n        var cs = this.childNodes,\n            i,\n            len = cs.length;\n        for (i = 0; i < len; i++) {\n        \tcs[i].expand(deep, anim);\n        }\n    },\n\n    /**\n     * Collapse all child nodes\n     * @param {Boolean} deep (optional) true if the child nodes should also collapse their child nodes\n     */\n    collapseChildNodes : function(deep){\n        var cs = this.childNodes;\n        for(var i = 0, len = cs.length; i < len; i++) {\n        \tcs[i].collapse(deep);\n        }\n    },\n\n    /**\n     * Disables this node\n     */\n    disable : function(){\n        this.disabled = true;\n        this.unselect();\n        if(this.rendered && this.ui.onDisableChange){ // event without subscribing\n            this.ui.onDisableChange(this, true);\n        }\n        this.fireEvent('disabledchange', this, true);\n    },\n\n    /**\n     * Enables this node\n     */\n    enable : function(){\n        this.disabled = false;\n        if(this.rendered && this.ui.onDisableChange){ // event without subscribing\n            this.ui.onDisableChange(this, false);\n        }\n        this.fireEvent('disabledchange', this, false);\n    },\n\n    // private\n    renderChildren : function(suppressEvent){\n        if(suppressEvent !== false){\n            this.fireEvent('beforechildrenrendered', this);\n        }\n        var cs = this.childNodes;\n        for(var i = 0, len = cs.length; i < len; i++){\n            cs[i].render(true);\n        }\n        this.childrenRendered = true;\n    },\n\n    // private\n    sort : function(fn, scope){\n        Ext.tree.TreeNode.superclass.sort.apply(this, arguments);\n        if(this.childrenRendered){\n            var cs = this.childNodes;\n            for(var i = 0, len = cs.length; i < len; i++){\n                cs[i].render(true);\n            }\n        }\n    },\n\n    // private\n    render : function(bulkRender){\n        this.ui.render(bulkRender);\n        if(!this.rendered){\n            // make sure it is registered\n            this.getOwnerTree().registerNode(this);\n            this.rendered = true;\n            if(this.expanded){\n                this.expanded = false;\n                this.expand(false, false);\n            }\n        }\n    },\n\n    // private\n    renderIndent : function(deep, refresh){\n        if(refresh){\n            this.ui.childIndent = null;\n        }\n        this.ui.renderIndent();\n        if(deep === true && this.childrenRendered){\n            var cs = this.childNodes;\n            for(var i = 0, len = cs.length; i < len; i++){\n                cs[i].renderIndent(true, refresh);\n            }\n        }\n    },\n\n    beginUpdate : function(){\n        this.childrenRendered = false;\n    },\n\n    endUpdate : function(){\n        if(this.expanded && this.rendered){\n            this.renderChildren();\n        }\n    },\n\n    //inherit docs\n    destroy : function(silent){\n        if(silent === true){\n            this.unselect(true);\n        }\n        Ext.tree.TreeNode.superclass.destroy.call(this, silent);\n        Ext.destroy(this.ui, this.loader);\n        this.ui = this.loader = null;\n    },\n\n    // private\n    onIdChange : function(id){\n        this.ui.onIdChange(id);\n    }\n});\n\nExt.tree.TreePanel.nodeTypes.node = Ext.tree.TreeNode;/**\n * @class Ext.tree.AsyncTreeNode\n * @extends Ext.tree.TreeNode\n * @cfg {TreeLoader} loader A TreeLoader to be used by this node (defaults to the loader defined on the tree)\n * @constructor\n * @param {Object/String} attributes The attributes/config for the node or just a string with the text for the node \n */\n Ext.tree.AsyncTreeNode = function(config){\n    this.loaded = config && config.loaded === true;\n    this.loading = false;\n    Ext.tree.AsyncTreeNode.superclass.constructor.apply(this, arguments);\n    /**\n    * @event beforeload\n    * Fires before this node is loaded, return false to cancel\n    * @param {Node} this This node\n    */\n    this.addEvents('beforeload', 'load');\n    /**\n    * @event load\n    * Fires when this node is loaded\n    * @param {Node} this This node\n    */\n    /**\n     * The loader used by this node (defaults to using the tree's defined loader)\n     * @type TreeLoader\n     * @property loader\n     */\n};\nExt.extend(Ext.tree.AsyncTreeNode, Ext.tree.TreeNode, {\n    expand : function(deep, anim, callback, scope){\n        if(this.loading){ // if an async load is already running, waiting til it's done\n            var timer;\n            var f = function(){\n                if(!this.loading){ // done loading\n                    clearInterval(timer);\n                    this.expand(deep, anim, callback, scope);\n                }\n            }.createDelegate(this);\n            timer = setInterval(f, 200);\n            return;\n        }\n        if(!this.loaded){\n            if(this.fireEvent(\"beforeload\", this) === false){\n                return;\n            }\n            this.loading = true;\n            this.ui.beforeLoad(this);\n            var loader = this.loader || this.attributes.loader || this.getOwnerTree().getLoader();\n            if(loader){\n                loader.load(this, this.loadComplete.createDelegate(this, [deep, anim, callback, scope]), this);\n                return;\n            }\n        }\n        Ext.tree.AsyncTreeNode.superclass.expand.call(this, deep, anim, callback, scope);\n    },\n    \n    /**\n     * Returns true if this node is currently loading\n     * @return {Boolean}\n     */\n    isLoading : function(){\n        return this.loading;  \n    },\n    \n    loadComplete : function(deep, anim, callback, scope){\n        this.loading = false;\n        this.loaded = true;\n        this.ui.afterLoad(this);\n        this.fireEvent(\"load\", this);\n        this.expand(deep, anim, callback, scope);\n    },\n    \n    /**\n     * Returns true if this node has been loaded\n     * @return {Boolean}\n     */\n    isLoaded : function(){\n        return this.loaded;\n    },\n    \n    hasChildNodes : function(){\n        if(!this.isLeaf() && !this.loaded){\n            return true;\n        }else{\n            return Ext.tree.AsyncTreeNode.superclass.hasChildNodes.call(this);\n        }\n    },\n\n    /**\n     * Trigger a reload for this node\n     * @param {Function} callback\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the callback is executed. Defaults to this Node.\n     */\n    reload : function(callback, scope){\n        this.collapse(false, false);\n        while(this.firstChild){\n            this.removeChild(this.firstChild).destroy();\n        }\n        this.childrenRendered = false;\n        this.loaded = false;\n        if(this.isHiddenRoot()){\n            this.expanded = false;\n        }\n        this.expand(false, false, callback, scope);\n    }\n});\n\nExt.tree.TreePanel.nodeTypes.async = Ext.tree.AsyncTreeNode;/**\n * @class Ext.tree.TreeNodeUI\n * This class provides the default UI implementation for Ext TreeNodes.\n * The TreeNode UI implementation is separate from the\n * tree implementation, and allows customizing of the appearance of\n * tree nodes.<br>\n * <p>\n * If you are customizing the Tree's user interface, you\n * may need to extend this class, but you should never need to instantiate this class.<br>\n * <p>\n * This class provides access to the user interface components of an Ext TreeNode, through\n * {@link Ext.tree.TreeNode#getUI}\n */\nExt.tree.TreeNodeUI = Ext.extend(Object, {\n    \n    constructor : function(node){\n        Ext.apply(this, {\n            node: node,\n            rendered: false,\n            animating: false,\n            wasLeaf: true,\n            ecc: 'x-tree-ec-icon x-tree-elbow',\n            emptyIcon: Ext.BLANK_IMAGE_URL    \n        });\n    },\n    \n    // private\n    removeChild : function(node){\n        if(this.rendered){\n            this.ctNode.removeChild(node.ui.getEl());\n        }\n    },\n\n    // private\n    beforeLoad : function(){\n         this.addClass(\"x-tree-node-loading\");\n    },\n\n    // private\n    afterLoad : function(){\n         this.removeClass(\"x-tree-node-loading\");\n    },\n\n    // private\n    onTextChange : function(node, text, oldText){\n        if(this.rendered){\n            this.textNode.innerHTML = text;\n        }\n    },\n    \n    // private\n    onIconClsChange : function(node, cls, oldCls){\n        if(this.rendered){\n            Ext.fly(this.iconNode).replaceClass(oldCls, cls);\n        }\n    },\n    \n    // private\n    onIconChange : function(node, icon){\n        if(this.rendered){\n            //'<img src=\"', a.icon || this.emptyIcon, '\" class=\"x-tree-node-icon',(a.icon ? \" x-tree-node-inline-icon\" : \"\"),(a.iconCls ? \" \"+a.iconCls : \"\"),'\" unselectable=\"on\" />',\n            var empty = Ext.isEmpty(icon);\n            this.iconNode.src = empty ? this.emptyIcon : icon;\n            Ext.fly(this.iconNode)[empty ? 'removeClass' : 'addClass']('x-tree-node-inline-icon');\n        }\n    },\n    \n    // private\n    onTipChange : function(node, tip, title){\n        if(this.rendered){\n            var hasTitle = Ext.isDefined(title);\n            if(this.textNode.setAttributeNS){\n                this.textNode.setAttributeNS(\"ext\", \"qtip\", tip);\n                if(hasTitle){\n                    this.textNode.setAttributeNS(\"ext\", \"qtitle\", title);\n                }\n            }else{\n                this.textNode.setAttribute(\"ext:qtip\", tip);\n                if(hasTitle){\n                    this.textNode.setAttribute(\"ext:qtitle\", title);\n                }\n            }\n        }\n    },\n    \n    // private\n    onHrefChange : function(node, href, target){\n        if(this.rendered){\n            this.anchor.href = this.getHref(href);\n            if(Ext.isDefined(target)){\n                this.anchor.target = target;\n            }\n        }\n    },\n    \n    // private\n    onClsChange : function(node, cls, oldCls){\n        if(this.rendered){\n            Ext.fly(this.elNode).replaceClass(oldCls, cls);\n        }    \n    },\n\n    // private\n    onDisableChange : function(node, state){\n        this.disabled = state;\n        if (this.checkbox) {\n            this.checkbox.disabled = state;\n        }\n        this[state ? 'addClass' : 'removeClass']('x-tree-node-disabled');\n    },\n\n    // private\n    onSelectedChange : function(state){\n        if(state){\n            this.focus();\n            this.addClass(\"x-tree-selected\");\n        }else{\n            //this.blur();\n            this.removeClass(\"x-tree-selected\");\n        }\n    },\n\n    // private\n    onMove : function(tree, node, oldParent, newParent, index, refNode){\n        this.childIndent = null;\n        if(this.rendered){\n            var targetNode = newParent.ui.getContainer();\n            if(!targetNode){//target not rendered\n                this.holder = document.createElement(\"div\");\n                this.holder.appendChild(this.wrap);\n                return;\n            }\n            var insertBefore = refNode ? refNode.ui.getEl() : null;\n            if(insertBefore){\n                targetNode.insertBefore(this.wrap, insertBefore);\n            }else{\n                targetNode.appendChild(this.wrap);\n            }\n            this.node.renderIndent(true, oldParent != newParent);\n        }\n    },\n\n/**\n * Adds one or more CSS classes to the node's UI element.\n * Duplicate classes are automatically filtered out.\n * @param {String/Array} className The CSS class to add, or an array of classes\n */\n    addClass : function(cls){\n        if(this.elNode){\n            Ext.fly(this.elNode).addClass(cls);\n        }\n    },\n\n/**\n * Removes one or more CSS classes from the node's UI element.\n * @param {String/Array} className The CSS class to remove, or an array of classes\n */\n    removeClass : function(cls){\n        if(this.elNode){\n            Ext.fly(this.elNode).removeClass(cls);\n        }\n    },\n\n    // private\n    remove : function(){\n        if(this.rendered){\n            this.holder = document.createElement(\"div\");\n            this.holder.appendChild(this.wrap);\n        }\n    },\n\n    // private\n    fireEvent : function(){\n        return this.node.fireEvent.apply(this.node, arguments);\n    },\n\n    // private\n    initEvents : function(){\n        this.node.on(\"move\", this.onMove, this);\n\n        if(this.node.disabled){\n            this.onDisableChange(this.node, true);\n        }\n        if(this.node.hidden){\n            this.hide();\n        }\n        var ot = this.node.getOwnerTree();\n        var dd = ot.enableDD || ot.enableDrag || ot.enableDrop;\n        if(dd && (!this.node.isRoot || ot.rootVisible)){\n            Ext.dd.Registry.register(this.elNode, {\n                node: this.node,\n                handles: this.getDDHandles(),\n                isHandle: false\n            });\n        }\n    },\n\n    // private\n    getDDHandles : function(){\n        return [this.iconNode, this.textNode, this.elNode];\n    },\n\n/**\n * Hides this node.\n */\n    hide : function(){\n        this.node.hidden = true;\n        if(this.wrap){\n            this.wrap.style.display = \"none\";\n        }\n    },\n\n/**\n * Shows this node.\n */\n    show : function(){\n        this.node.hidden = false;\n        if(this.wrap){\n            this.wrap.style.display = \"\";\n        }\n    },\n\n    // private\n    onContextMenu : function(e){\n        if (this.node.hasListener(\"contextmenu\") || this.node.getOwnerTree().hasListener(\"contextmenu\")) {\n            e.preventDefault();\n            this.focus();\n            this.fireEvent(\"contextmenu\", this.node, e);\n        }\n    },\n\n    // private\n    onClick : function(e){\n        if(this.dropping){\n            e.stopEvent();\n            return;\n        }\n        if(this.fireEvent(\"beforeclick\", this.node, e) !== false){\n            var a = e.getTarget('a');\n            if(!this.disabled && this.node.attributes.href && a){\n                this.fireEvent(\"click\", this.node, e);\n                return;\n            }else if(a && e.ctrlKey){\n                e.stopEvent();\n            }\n            e.preventDefault();\n            if(this.disabled){\n                return;\n            }\n\n            if(this.node.attributes.singleClickExpand && !this.animating && this.node.isExpandable()){\n                this.node.toggle();\n            }\n\n            this.fireEvent(\"click\", this.node, e);\n        }else{\n            e.stopEvent();\n        }\n    },\n\n    // private\n    onDblClick : function(e){\n        e.preventDefault();\n        if(this.disabled){\n            return;\n        }\n        if(this.fireEvent(\"beforedblclick\", this.node, e) !== false){\n            if(this.checkbox){\n                this.toggleCheck();\n            }\n            if(!this.animating && this.node.isExpandable()){\n                this.node.toggle();\n            }\n            this.fireEvent(\"dblclick\", this.node, e);\n        }\n    },\n\n    onOver : function(e){\n        this.addClass('x-tree-node-over');\n    },\n\n    onOut : function(e){\n        this.removeClass('x-tree-node-over');\n    },\n\n    // private\n    onCheckChange : function(){\n        var checked = this.checkbox.checked;\n        // fix for IE6\n        this.checkbox.defaultChecked = checked;\n        this.node.attributes.checked = checked;\n        this.fireEvent('checkchange', this.node, checked);\n    },\n\n    // private\n    ecClick : function(e){\n        if(!this.animating && this.node.isExpandable()){\n            this.node.toggle();\n        }\n    },\n\n    // private\n    startDrop : function(){\n        this.dropping = true;\n    },\n\n    // delayed drop so the click event doesn't get fired on a drop\n    endDrop : function(){\n       setTimeout(function(){\n           this.dropping = false;\n       }.createDelegate(this), 50);\n    },\n\n    // private\n    expand : function(){\n        this.updateExpandIcon();\n        this.ctNode.style.display = \"\";\n    },\n\n    // private\n    focus : function(){\n        if(!this.node.preventHScroll){\n            try{this.anchor.focus();\n            }catch(e){}\n        }else{\n            try{\n                var noscroll = this.node.getOwnerTree().getTreeEl().dom;\n                var l = noscroll.scrollLeft;\n                this.anchor.focus();\n                noscroll.scrollLeft = l;\n            }catch(e){}\n        }\n    },\n\n/**\n * Sets the checked status of the tree node to the passed value, or, if no value was passed,\n * toggles the checked status. If the node was rendered with no checkbox, this has no effect.\n * @param {Boolean} value (optional) The new checked status.\n */\n    toggleCheck : function(value){\n        var cb = this.checkbox;\n        if(cb){\n            cb.checked = (value === undefined ? !cb.checked : value);\n            this.onCheckChange();\n        }\n    },\n\n    // private\n    blur : function(){\n        try{\n            this.anchor.blur();\n        }catch(e){}\n    },\n\n    // private\n    animExpand : function(callback){\n        var ct = Ext.get(this.ctNode);\n        ct.stopFx();\n        if(!this.node.isExpandable()){\n            this.updateExpandIcon();\n            this.ctNode.style.display = \"\";\n            Ext.callback(callback);\n            return;\n        }\n        this.animating = true;\n        this.updateExpandIcon();\n\n        ct.slideIn('t', {\n           callback : function(){\n               this.animating = false;\n               Ext.callback(callback);\n            },\n            scope: this,\n            duration: this.node.ownerTree.duration || .25\n        });\n    },\n\n    // private\n    highlight : function(){\n        var tree = this.node.getOwnerTree();\n        Ext.fly(this.wrap).highlight(\n            tree.hlColor || \"C3DAF9\",\n            {endColor: tree.hlBaseColor}\n        );\n    },\n\n    // private\n    collapse : function(){\n        this.updateExpandIcon();\n        this.ctNode.style.display = \"none\";\n    },\n\n    // private\n    animCollapse : function(callback){\n        var ct = Ext.get(this.ctNode);\n        ct.enableDisplayMode('block');\n        ct.stopFx();\n\n        this.animating = true;\n        this.updateExpandIcon();\n\n        ct.slideOut('t', {\n            callback : function(){\n               this.animating = false;\n               Ext.callback(callback);\n            },\n            scope: this,\n            duration: this.node.ownerTree.duration || .25\n        });\n    },\n\n    // private\n    getContainer : function(){\n        return this.ctNode;\n    },\n\n/**\n * Returns the element which encapsulates this node.\n * @return {HtmlElement} The DOM element. The default implementation uses a <code>&lt;li></code>.\n */\n    getEl : function(){\n        return this.wrap;\n    },\n\n    // private\n    appendDDGhost : function(ghostNode){\n        ghostNode.appendChild(this.elNode.cloneNode(true));\n    },\n\n    // private\n    getDDRepairXY : function(){\n        return Ext.lib.Dom.getXY(this.iconNode);\n    },\n\n    // private\n    onRender : function(){\n        this.render();\n    },\n\n    // private\n    render : function(bulkRender){\n        var n = this.node, a = n.attributes;\n        var targetNode = n.parentNode ?\n              n.parentNode.ui.getContainer() : n.ownerTree.innerCt.dom;\n\n        if(!this.rendered){\n            this.rendered = true;\n\n            this.renderElements(n, a, targetNode, bulkRender);\n\n            if(a.qtip){\n                this.onTipChange(n, a.qtip, a.qtipTitle);\n            }else if(a.qtipCfg){\n                a.qtipCfg.target = Ext.id(this.textNode);\n                Ext.QuickTips.register(a.qtipCfg);\n            }\n            this.initEvents();\n            if(!this.node.expanded){\n                this.updateExpandIcon(true);\n            }\n        }else{\n            if(bulkRender === true) {\n                targetNode.appendChild(this.wrap);\n            }\n        }\n    },\n\n    // private\n    renderElements : function(n, a, targetNode, bulkRender){\n        // add some indent caching, this helps performance when rendering a large tree\n        this.indentMarkup = n.parentNode ? n.parentNode.ui.getChildIndent() : '';\n\n        var cb = Ext.isBoolean(a.checked),\n            nel,\n            href = this.getHref(a.href),\n            buf = ['<li class=\"x-tree-node\"><div ext:tree-node-id=\"',n.id,'\" class=\"x-tree-node-el x-tree-node-leaf x-unselectable ', a.cls,'\" unselectable=\"on\">',\n            '<span class=\"x-tree-node-indent\">',this.indentMarkup,\"</span>\",\n            '<img alt=\"\" src=\"', this.emptyIcon, '\" class=\"x-tree-ec-icon x-tree-elbow\" />',\n            '<img alt=\"\" src=\"', a.icon || this.emptyIcon, '\" class=\"x-tree-node-icon',(a.icon ? \" x-tree-node-inline-icon\" : \"\"),(a.iconCls ? \" \"+a.iconCls : \"\"),'\" unselectable=\"on\" />',\n            cb ? ('<input class=\"x-tree-node-cb\" type=\"checkbox\" ' + (a.checked ? 'checked=\"checked\" />' : '/>')) : '',\n            '<a hidefocus=\"on\" class=\"x-tree-node-anchor\" href=\"',href,'\" tabIndex=\"1\" ',\n             a.hrefTarget ? ' target=\"'+a.hrefTarget+'\"' : \"\", '><span unselectable=\"on\">',n.text,\"</span></a></div>\",\n            '<ul class=\"x-tree-node-ct\" style=\"display:none;\"></ul>',\n            \"</li>\"].join('');\n\n        if(bulkRender !== true && n.nextSibling && (nel = n.nextSibling.ui.getEl())){\n            this.wrap = Ext.DomHelper.insertHtml(\"beforeBegin\", nel, buf);\n        }else{\n            this.wrap = Ext.DomHelper.insertHtml(\"beforeEnd\", targetNode, buf);\n        }\n\n        this.elNode = this.wrap.childNodes[0];\n        this.ctNode = this.wrap.childNodes[1];\n        var cs = this.elNode.childNodes;\n        this.indentNode = cs[0];\n        this.ecNode = cs[1];\n        this.iconNode = cs[2];\n        var index = 3;\n        if(cb){\n            this.checkbox = cs[3];\n            // fix for IE6\n            this.checkbox.defaultChecked = this.checkbox.checked;\n            index++;\n        }\n        this.anchor = cs[index];\n        this.textNode = cs[index].firstChild;\n    },\n    \n    /**\n     * @private Gets a normalized href for the node.\n     * @param {String} href\n     */\n    getHref : function(href){\n        return Ext.isEmpty(href) ? (Ext.isGecko ? '' : '#') : href;\n    },\n\n/**\n * Returns the &lt;a> element that provides focus for the node's UI.\n * @return {HtmlElement} The DOM anchor element.\n */\n    getAnchor : function(){\n        return this.anchor;\n    },\n\n/**\n * Returns the text node.\n * @return {HtmlNode} The DOM text node.\n */\n    getTextEl : function(){\n        return this.textNode;\n    },\n\n/**\n * Returns the icon &lt;img> element.\n * @return {HtmlElement} The DOM image element.\n */\n    getIconEl : function(){\n        return this.iconNode;\n    },\n\n/**\n * Returns the checked status of the node. If the node was rendered with no\n * checkbox, it returns false.\n * @return {Boolean} The checked flag.\n */\n    isChecked : function(){\n        return this.checkbox ? this.checkbox.checked : false;\n    },\n\n    // private\n    updateExpandIcon : function(){\n        if(this.rendered){\n            var n = this.node,\n                c1,\n                c2,\n                cls = n.isLast() ? \"x-tree-elbow-end\" : \"x-tree-elbow\",\n                hasChild = n.hasChildNodes();\n            if(hasChild || n.attributes.expandable){\n                if(n.expanded){\n                    cls += \"-minus\";\n                    c1 = \"x-tree-node-collapsed\";\n                    c2 = \"x-tree-node-expanded\";\n                }else{\n                    cls += \"-plus\";\n                    c1 = \"x-tree-node-expanded\";\n                    c2 = \"x-tree-node-collapsed\";\n                }\n                if(this.wasLeaf){\n                    this.removeClass(\"x-tree-node-leaf\");\n                    this.wasLeaf = false;\n                }\n                if(this.c1 != c1 || this.c2 != c2){\n                    Ext.fly(this.elNode).replaceClass(c1, c2);\n                    this.c1 = c1; this.c2 = c2;\n                }\n            }else{\n                if(!this.wasLeaf){\n                    Ext.fly(this.elNode).replaceClass(\"x-tree-node-expanded\", \"x-tree-node-collapsed\");\n                    delete this.c1;\n                    delete this.c2;\n                    this.wasLeaf = true;\n                }\n            }\n            var ecc = \"x-tree-ec-icon \"+cls;\n            if(this.ecc != ecc){\n                this.ecNode.className = ecc;\n                this.ecc = ecc;\n            }\n        }\n    },\n\n    // private\n    onIdChange: function(id){\n        if(this.rendered){\n            this.elNode.setAttribute('ext:tree-node-id', id);\n        }\n    },\n\n    // private\n    getChildIndent : function(){\n        if(!this.childIndent){\n            var buf = [],\n                p = this.node;\n            while(p){\n                if(!p.isRoot || (p.isRoot && p.ownerTree.rootVisible)){\n                    if(!p.isLast()) {\n                        buf.unshift('<img alt=\"\" src=\"'+this.emptyIcon+'\" class=\"x-tree-elbow-line\" />');\n                    } else {\n                        buf.unshift('<img alt=\"\" src=\"'+this.emptyIcon+'\" class=\"x-tree-icon\" />');\n                    }\n                }\n                p = p.parentNode;\n            }\n            this.childIndent = buf.join(\"\");\n        }\n        return this.childIndent;\n    },\n\n    // private\n    renderIndent : function(){\n        if(this.rendered){\n            var indent = \"\",\n                p = this.node.parentNode;\n            if(p){\n                indent = p.ui.getChildIndent();\n            }\n            if(this.indentMarkup != indent){ // don't rerender if not required\n                this.indentNode.innerHTML = indent;\n                this.indentMarkup = indent;\n            }\n            this.updateExpandIcon();\n        }\n    },\n\n    destroy : function(){\n        if(this.elNode){\n            Ext.dd.Registry.unregister(this.elNode.id);\n        }\n\n        Ext.each(['textnode', 'anchor', 'checkbox', 'indentNode', 'ecNode', 'iconNode', 'elNode', 'ctNode', 'wrap', 'holder'], function(el){\n            if(this[el]){\n                Ext.fly(this[el]).remove();\n                delete this[el];\n            }\n        }, this);\n        delete this.node;\n    }\n});\n\n/**\n * @class Ext.tree.RootTreeNodeUI\n * This class provides the default UI implementation for <b>root</b> Ext TreeNodes.\n * The RootTreeNode UI implementation allows customizing the appearance of the root tree node.<br>\n * <p>\n * If you are customizing the Tree's user interface, you\n * may need to extend this class, but you should never need to instantiate this class.<br>\n */\nExt.tree.RootTreeNodeUI = Ext.extend(Ext.tree.TreeNodeUI, {\n    // private\n    render : function(){\n        if(!this.rendered){\n            var targetNode = this.node.ownerTree.innerCt.dom;\n            this.node.expanded = true;\n            targetNode.innerHTML = '<div class=\"x-tree-root-node\"></div>';\n            this.wrap = this.ctNode = targetNode.firstChild;\n        }\n    },\n    collapse : Ext.emptyFn,\n    expand : Ext.emptyFn\n});/**\n * @class Ext.tree.TreeLoader\n * @extends Ext.util.Observable\n * A TreeLoader provides for lazy loading of an {@link Ext.tree.TreeNode}'s child\n * nodes from a specified URL. The response must be a JavaScript Array definition\n * whose elements are node definition objects. e.g.:\n * <pre><code>\n    [{\n        id: 1,\n        text: 'A leaf Node',\n        leaf: true\n    },{\n        id: 2,\n        text: 'A folder Node',\n        children: [{\n            id: 3,\n            text: 'A child Node',\n            leaf: true\n        }]\n   }]\n</code></pre>\n * <br><br>\n * A server request is sent, and child nodes are loaded only when a node is expanded.\n * The loading node's id is passed to the server under the parameter name \"node\" to\n * enable the server to produce the correct child nodes.\n * <br><br>\n * To pass extra parameters, an event handler may be attached to the \"beforeload\"\n * event, and the parameters specified in the TreeLoader's baseParams property:\n * <pre><code>\n    myTreeLoader.on(\"beforeload\", function(treeLoader, node) {\n        this.baseParams.category = node.attributes.category;\n    }, this);\n</code></pre>\n * This would pass an HTTP parameter called \"category\" to the server containing\n * the value of the Node's \"category\" attribute.\n * @constructor\n * Creates a new Treeloader.\n * @param {Object} config A config object containing config properties.\n */\nExt.tree.TreeLoader = function(config){\n    this.baseParams = {};\n    Ext.apply(this, config);\n\n    this.addEvents(\n        /**\n         * @event beforeload\n         * Fires before a network request is made to retrieve the Json text which specifies a node's children.\n         * @param {Object} This TreeLoader object.\n         * @param {Object} node The {@link Ext.tree.TreeNode} object being loaded.\n         * @param {Object} callback The callback function specified in the {@link #load} call.\n         */\n        \"beforeload\",\n        /**\n         * @event load\n         * Fires when the node has been successfuly loaded.\n         * @param {Object} This TreeLoader object.\n         * @param {Object} node The {@link Ext.tree.TreeNode} object being loaded.\n         * @param {Object} response The response object containing the data from the server.\n         */\n        \"load\",\n        /**\n         * @event loadexception\n         * Fires if the network request failed.\n         * @param {Object} This TreeLoader object.\n         * @param {Object} node The {@link Ext.tree.TreeNode} object being loaded.\n         * @param {Object} response The response object containing the data from the server.\n         */\n        \"loadexception\"\n    );\n    Ext.tree.TreeLoader.superclass.constructor.call(this);\n    if(Ext.isString(this.paramOrder)){\n        this.paramOrder = this.paramOrder.split(/[\\s,|]/);\n    }\n};\n\nExt.extend(Ext.tree.TreeLoader, Ext.util.Observable, {\n    /**\n    * @cfg {String} dataUrl The URL from which to request a Json string which\n    * specifies an array of node definition objects representing the child nodes\n    * to be loaded.\n    */\n    /**\n     * @cfg {String} requestMethod The HTTP request method for loading data (defaults to the value of {@link Ext.Ajax#method}).\n     */\n    /**\n     * @cfg {String} url Equivalent to {@link #dataUrl}.\n     */\n    /**\n     * @cfg {Boolean} preloadChildren If set to true, the loader recursively loads \"children\" attributes when doing the first load on nodes.\n     */\n    /**\n    * @cfg {Object} baseParams (optional) An object containing properties which\n    * specify HTTP parameters to be passed to each request for child nodes.\n    */\n    /**\n    * @cfg {Object} baseAttrs (optional) An object containing attributes to be added to all nodes\n    * created by this loader. If the attributes sent by the server have an attribute in this object,\n    * they take priority.\n    */\n    /**\n    * @cfg {Object} uiProviders (optional) An object containing properties which\n    * specify custom {@link Ext.tree.TreeNodeUI} implementations. If the optional\n    * <i>uiProvider</i> attribute of a returned child node is a string rather\n    * than a reference to a TreeNodeUI implementation, then that string value\n    * is used as a property name in the uiProviders object.\n    */\n    uiProviders : {},\n\n    /**\n    * @cfg {Boolean} clearOnLoad (optional) Default to true. Remove previously existing\n    * child nodes before loading.\n    */\n    clearOnLoad : true,\n\n    /**\n     * @cfg {Array/String} paramOrder Defaults to <tt>undefined</tt>. Only used when using directFn.\n     * Specifies the params in the order in which they must be passed to the server-side Direct method\n     * as either (1) an Array of String values, or (2) a String of params delimited by either whitespace,\n     * comma, or pipe. For example,\n     * any of the following would be acceptable:<pre><code>\nnodeParameter: 'node',\nparamOrder: ['param1','param2','param3']\nparamOrder: 'node param1 param2 param3'\nparamOrder: 'param1,node,param2,param3'\nparamOrder: 'param1|param2|param|node'\n     </code></pre>\n     */\n    paramOrder: undefined,\n\n    /**\n     * @cfg {Boolean} paramsAsHash Only used when using directFn.\n     * Send parameters as a collection of named arguments (defaults to <tt>false</tt>). Providing a\n     * <tt>{@link #paramOrder}</tt> nullifies this configuration.\n     */\n    paramsAsHash: false,\n\n    /**\n     * @cfg {String} nodeParameter The name of the parameter sent to the server which contains\n     * the identifier of the node. Defaults to <tt>'node'</tt>.\n     */\n    nodeParameter: 'node',\n\n    /**\n     * @cfg {Function} directFn\n     * Function to call when executing a request.\n     */\n    directFn : undefined,\n\n    /**\n     * Load an {@link Ext.tree.TreeNode} from the URL specified in the constructor.\n     * This is called automatically when a node is expanded, but may be used to reload\n     * a node (or append new children if the {@link #clearOnLoad} option is false.)\n     * @param {Ext.tree.TreeNode} node\n     * @param {Function} callback Function to call after the node has been loaded. The\n     * function is passed the TreeNode which was requested to be loaded.\n     * @param {Object} scope The scope (<code>this</code> reference) in which the callback is executed.\n     * defaults to the loaded TreeNode.\n     */\n    load : function(node, callback, scope){\n        if(this.clearOnLoad){\n            while(node.firstChild){\n                node.removeChild(node.firstChild);\n            }\n        }\n        if(this.doPreload(node)){ // preloaded json children\n            this.runCallback(callback, scope || node, [node]);\n        }else if(this.directFn || this.dataUrl || this.url){\n            this.requestData(node, callback, scope || node);\n        }\n    },\n\n    doPreload : function(node){\n        if(node.attributes.children){\n            if(node.childNodes.length < 1){ // preloaded?\n                var cs = node.attributes.children;\n                node.beginUpdate();\n                for(var i = 0, len = cs.length; i < len; i++){\n                    var cn = node.appendChild(this.createNode(cs[i]));\n                    if(this.preloadChildren){\n                        this.doPreload(cn);\n                    }\n                }\n                node.endUpdate();\n            }\n            return true;\n        }\n        return false;\n    },\n\n    getParams: function(node){\n        var bp = Ext.apply({}, this.baseParams),\n            np = this.nodeParameter,\n            po = this.paramOrder;\n\n        np && (bp[ np ] = node.id);\n\n        if(this.directFn){\n            var buf = [node.id];\n            if(po){\n                // reset 'buf' if the nodeParameter was included in paramOrder\n                if(np && po.indexOf(np) > -1){\n                    buf = [];\n                }\n\n                for(var i = 0, len = po.length; i < len; i++){\n                    buf.push(bp[ po[i] ]);\n                }\n            }else if(this.paramsAsHash){\n                buf = [bp];\n            }\n            return buf;\n        }else{\n            return bp;\n        }\n    },\n\n    requestData : function(node, callback, scope){\n        if(this.fireEvent(\"beforeload\", this, node, callback) !== false){\n            if(this.directFn){\n                var args = this.getParams(node);\n                args.push(this.processDirectResponse.createDelegate(this, [{callback: callback, node: node, scope: scope}], true));\n                this.directFn.apply(window, args);\n            }else{\n                this.transId = Ext.Ajax.request({\n                    method:this.requestMethod,\n                    url: this.dataUrl||this.url,\n                    success: this.handleResponse,\n                    failure: this.handleFailure,\n                    scope: this,\n                    argument: {callback: callback, node: node, scope: scope},\n                    params: this.getParams(node)\n                });\n            }\n        }else{\n            // if the load is cancelled, make sure we notify\n            // the node that we are done\n            this.runCallback(callback, scope || node, []);\n        }\n    },\n\n    processDirectResponse: function(result, response, args){\n        if(response.status){\n            this.handleResponse({\n                responseData: Ext.isArray(result) ? result : null,\n                responseText: result,\n                argument: args\n            });\n        }else{\n            this.handleFailure({\n                argument: args\n            });\n        }\n    },\n\n    // private\n    runCallback: function(cb, scope, args){\n        if(Ext.isFunction(cb)){\n            cb.apply(scope, args);\n        }\n    },\n\n    isLoading : function(){\n        return !!this.transId;\n    },\n\n    abort : function(){\n        if(this.isLoading()){\n            Ext.Ajax.abort(this.transId);\n        }\n    },\n\n    /**\n    * <p>Override this function for custom TreeNode node implementation, or to\n    * modify the attributes at creation time.</p>\n    * Example:<pre><code>\nnew Ext.tree.TreePanel({\n    ...\n    loader: new Ext.tree.TreeLoader({\n        url: 'dataUrl',\n        createNode: function(attr) {\n//          Allow consolidation consignments to have\n//          consignments dropped into them.\n            if (attr.isConsolidation) {\n                attr.iconCls = 'x-consol',\n                attr.allowDrop = true;\n            }\n            return Ext.tree.TreeLoader.prototype.createNode.call(this, attr);\n        }\n    }),\n    ...\n});\n</code></pre>\n    * @param attr {Object} The attributes from which to create the new node.\n    */\n    createNode : function(attr){\n        // apply baseAttrs, nice idea Corey!\n        if(this.baseAttrs){\n            Ext.applyIf(attr, this.baseAttrs);\n        }\n        if(this.applyLoader !== false && !attr.loader){\n            attr.loader = this;\n        }\n        if(Ext.isString(attr.uiProvider)){\n           attr.uiProvider = this.uiProviders[attr.uiProvider] || eval(attr.uiProvider);\n        }\n        if(attr.nodeType){\n            return new Ext.tree.TreePanel.nodeTypes[attr.nodeType](attr);\n        }else{\n            return attr.leaf ?\n                        new Ext.tree.TreeNode(attr) :\n                        new Ext.tree.AsyncTreeNode(attr);\n        }\n    },\n\n    processResponse : function(response, node, callback, scope){\n        var json = response.responseText;\n        try {\n            var o = response.responseData || Ext.decode(json);\n            node.beginUpdate();\n            for(var i = 0, len = o.length; i < len; i++){\n                var n = this.createNode(o[i]);\n                if(n){\n                    node.appendChild(n);\n                }\n            }\n            node.endUpdate();\n            this.runCallback(callback, scope || node, [node]);\n        }catch(e){\n            this.handleFailure(response);\n        }\n    },\n\n    handleResponse : function(response){\n        this.transId = false;\n        var a = response.argument;\n        this.processResponse(response, a.node, a.callback, a.scope);\n        this.fireEvent(\"load\", this, a.node, response);\n    },\n\n    handleFailure : function(response){\n        this.transId = false;\n        var a = response.argument;\n        this.fireEvent(\"loadexception\", this, a.node, response);\n        this.runCallback(a.callback, a.scope || a.node, [a.node]);\n    },\n\n    destroy : function(){\n        this.abort();\n        this.purgeListeners();\n    }\n});/**\n * @class Ext.tree.TreeFilter\n * Note this class is experimental and doesn't update the indent (lines) or expand collapse icons of the nodes\n * @param {TreePanel} tree\n * @param {Object} config (optional)\n */\nExt.tree.TreeFilter = function(tree, config){\n    this.tree = tree;\n    this.filtered = {};\n    Ext.apply(this, config);\n};\n\nExt.tree.TreeFilter.prototype = {\n    clearBlank:false,\n    reverse:false,\n    autoClear:false,\n    remove:false,\n\n     /**\n     * Filter the data by a specific attribute.\n     * @param {String/RegExp} value Either string that the attribute value\n     * should start with or a RegExp to test against the attribute\n     * @param {String} attr (optional) The attribute passed in your node's attributes collection. Defaults to \"text\".\n     * @param {TreeNode} startNode (optional) The node to start the filter at.\n     */\n    filter : function(value, attr, startNode){\n        attr = attr || \"text\";\n        var f;\n        if(typeof value == \"string\"){\n            var vlen = value.length;\n            // auto clear empty filter\n            if(vlen == 0 && this.clearBlank){\n                this.clear();\n                return;\n            }\n            value = value.toLowerCase();\n            f = function(n){\n                return n.attributes[attr].substr(0, vlen).toLowerCase() == value;\n            };\n        }else if(value.exec){ // regex?\n            f = function(n){\n                return value.test(n.attributes[attr]);\n            };\n        }else{\n            throw 'Illegal filter type, must be string or regex';\n        }\n        this.filterBy(f, null, startNode);\n\t},\n\n    /**\n     * Filter by a function. The passed function will be called with each\n     * node in the tree (or from the startNode). If the function returns true, the node is kept\n     * otherwise it is filtered. If a node is filtered, its children are also filtered.\n     * @param {Function} fn The filter function\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to the current Node.\n     */\n    filterBy : function(fn, scope, startNode){\n        startNode = startNode || this.tree.root;\n        if(this.autoClear){\n            this.clear();\n        }\n        var af = this.filtered, rv = this.reverse;\n        var f = function(n){\n            if(n == startNode){\n                return true;\n            }\n            if(af[n.id]){\n                return false;\n            }\n            var m = fn.call(scope || n, n);\n            if(!m || rv){\n                af[n.id] = n;\n                n.ui.hide();\n                return false;\n            }\n            return true;\n        };\n        startNode.cascade(f);\n        if(this.remove){\n           for(var id in af){\n               if(typeof id != \"function\"){\n                   var n = af[id];\n                   if(n && n.parentNode){\n                       n.parentNode.removeChild(n);\n                   }\n               }\n           }\n        }\n    },\n\n    /**\n     * Clears the current filter. Note: with the \"remove\" option\n     * set a filter cannot be cleared.\n     */\n    clear : function(){\n        var t = this.tree;\n        var af = this.filtered;\n        for(var id in af){\n            if(typeof id != \"function\"){\n                var n = af[id];\n                if(n){\n                    n.ui.show();\n                }\n            }\n        }\n        this.filtered = {};\n    }\n};\n/**\n * @class Ext.tree.TreeSorter\n * Provides sorting of nodes in a {@link Ext.tree.TreePanel}.  The TreeSorter automatically monitors events on the\n * associated TreePanel that might affect the tree's sort order (beforechildrenrendered, append, insert and textchange).\n * Example usage:<br />\n * <pre><code>\nnew Ext.tree.TreeSorter(myTree, {\n    folderSort: true,\n    dir: \"desc\",\n    sortType: function(value, node) {\n        // sort by a custom, typed attribute:\n        return parseInt(node.id, 10);\n    }\n});\n</code></pre>\n * @constructor\n * @param {TreePanel} tree\n * @param {Object} config\n */\nExt.tree.TreeSorter = Ext.extend(Object, {\n    \n    constructor: function(tree, config){\n        /**\n     * @cfg {Boolean} folderSort True to sort leaf nodes under non-leaf nodes (defaults to false)\n     */\n    /**\n     * @cfg {String} property The named attribute on the node to sort by (defaults to \"text\").  Note that this\n     * property is only used if no {@link #sortType} function is specified, otherwise it is ignored.\n     */\n    /**\n     * @cfg {String} dir The direction to sort (\"asc\" or \"desc,\" case-insensitive, defaults to \"asc\")\n     */\n    /**\n     * @cfg {String} leafAttr The attribute used to determine leaf nodes when {@link #folderSort} = true (defaults to \"leaf\")\n     */\n    /**\n     * @cfg {Boolean} caseSensitive true for case-sensitive sort (defaults to false)\n     */\n    /**\n     * @cfg {Function} sortType A custom \"casting\" function used to convert node values before sorting.  The function\n     * will be called with a two parameters, the {@link #property} value for the node and the {@link Ext.tree.TreeNode} being evaluated. \n     * It is expected to return the node's sort value cast to the specific data type required for sorting.  This could be used, for example, when\n     * a node's text (or other attribute) should be sorted as a date or numeric value.  See the class description for\n     * example usage.\n     */\n\n    Ext.apply(this, config);\n    tree.on({\n        scope: this,\n        beforechildrenrendered: this.doSort,\n        append: this.updateSort,\n        insert: this.updateSort,\n        textchange: this.updateSortParent\n    });\n\n    var desc = this.dir && this.dir.toLowerCase() == 'desc',\n        prop = this.property || 'text',\n        sortType = this.sortType,\n        folderSort = this.folderSort,\n        caseSensitive = this.caseSensitive === true,\n        leafAttr = this.leafAttr || 'leaf';\n\n    if(Ext.isString(sortType)){\n        sortType = Ext.data.SortTypes[sortType];\n    }\n    this.sortFn = function(n1, n2){\n        var attr1 = n1.attributes,\n            attr2 = n2.attributes;\n            \n        if(folderSort){\n            if(attr1[leafAttr] && !attr2[leafAttr]){\n                return 1;\n            }\n            if(!attr1[leafAttr] && attr2[leafAttr]){\n                return -1;\n            }\n        }\n        var prop1 = attr1[prop],\n            prop2 = attr2[prop],\n            v1 = sortType ? sortType(prop1, n1) : (caseSensitive ? prop1 : prop1.toUpperCase()),\n            v2 = sortType ? sortType(prop2, n2) : (caseSensitive ? prop2 : prop2.toUpperCase());\n            \n        if(v1 < v2){\n            return desc ? 1 : -1;\n        }else if(v1 > v2){\n            return desc ? -1 : 1;\n        }\n        return 0;\n    };\n    },\n    \n    doSort : function(node){\n        node.sort(this.sortFn);\n    },\n\n    updateSort : function(tree, node){\n        if(node.childrenRendered){\n            this.doSort.defer(1, this, [node]);\n        }\n    },\n\n    updateSortParent : function(node){\n        var p = node.parentNode;\n        if(p && p.childrenRendered){\n            this.doSort.defer(1, this, [p]);\n        }\n    }    \n});\n/**\n * @class Ext.tree.TreeDropZone\n * @extends Ext.dd.DropZone\n * @constructor\n * @param {String/HTMLElement/Element} tree The {@link Ext.tree.TreePanel} for which to enable dropping\n * @param {Object} config\n */\nif(Ext.dd.DropZone){\n    \nExt.tree.TreeDropZone = function(tree, config){\n    /**\n     * @cfg {Boolean} allowParentInsert\n     * Allow inserting a dragged node between an expanded parent node and its first child that will become a\n     * sibling of the parent when dropped (defaults to false)\n     */\n    this.allowParentInsert = config.allowParentInsert || false;\n    /**\n     * @cfg {String} allowContainerDrop\n     * True if drops on the tree container (outside of a specific tree node) are allowed (defaults to false)\n     */\n    this.allowContainerDrop = config.allowContainerDrop || false;\n    /**\n     * @cfg {String} appendOnly\n     * True if the tree should only allow append drops (use for trees which are sorted, defaults to false)\n     */\n    this.appendOnly = config.appendOnly || false;\n\n    Ext.tree.TreeDropZone.superclass.constructor.call(this, tree.getTreeEl(), config);\n    /**\n    * The TreePanel for this drop zone\n    * @type Ext.tree.TreePanel\n    * @property\n    */\n    this.tree = tree;\n    /**\n    * Arbitrary data that can be associated with this tree and will be included in the event object that gets\n    * passed to any nodedragover event handler (defaults to {})\n    * @type Ext.tree.TreePanel\n    * @property\n    */\n    this.dragOverData = {};\n    // private\n    this.lastInsertClass = \"x-tree-no-status\";\n};\n\nExt.extend(Ext.tree.TreeDropZone, Ext.dd.DropZone, {\n    /**\n     * @cfg {String} ddGroup\n     * A named drag drop group to which this object belongs.  If a group is specified, then this object will only\n     * interact with other drag drop objects in the same group (defaults to 'TreeDD').\n     */\n    ddGroup : \"TreeDD\",\n\n    /**\n     * @cfg {String} expandDelay\n     * The delay in milliseconds to wait before expanding a target tree node while dragging a droppable node\n     * over the target (defaults to 1000)\n     */\n    expandDelay : 1000,\n\n    // private\n    expandNode : function(node){\n        if(node.hasChildNodes() && !node.isExpanded()){\n            node.expand(false, null, this.triggerCacheRefresh.createDelegate(this));\n        }\n    },\n\n    // private\n    queueExpand : function(node){\n        this.expandProcId = this.expandNode.defer(this.expandDelay, this, [node]);\n    },\n\n    // private\n    cancelExpand : function(){\n        if(this.expandProcId){\n            clearTimeout(this.expandProcId);\n            this.expandProcId = false;\n        }\n    },\n\n    // private\n    isValidDropPoint : function(n, pt, dd, e, data){\n        if(!n || !data){ return false; }\n        var targetNode = n.node;\n        var dropNode = data.node;\n        // default drop rules\n        if(!(targetNode && targetNode.isTarget && pt)){\n            return false;\n        }\n        if(pt == \"append\" && targetNode.allowChildren === false){\n            return false;\n        }\n        if((pt == \"above\" || pt == \"below\") && (targetNode.parentNode && targetNode.parentNode.allowChildren === false)){\n            return false;\n        }\n        if(dropNode && (targetNode == dropNode || dropNode.contains(targetNode))){\n            return false;\n        }\n        // reuse the object\n        var overEvent = this.dragOverData;\n        overEvent.tree = this.tree;\n        overEvent.target = targetNode;\n        overEvent.data = data;\n        overEvent.point = pt;\n        overEvent.source = dd;\n        overEvent.rawEvent = e;\n        overEvent.dropNode = dropNode;\n        overEvent.cancel = false;  \n        var result = this.tree.fireEvent(\"nodedragover\", overEvent);\n        return overEvent.cancel === false && result !== false;\n    },\n\n    // private\n    getDropPoint : function(e, n, dd){\n        var tn = n.node;\n        if(tn.isRoot){\n            return tn.allowChildren !== false ? \"append\" : false; // always append for root\n        }\n        var dragEl = n.ddel;\n        var t = Ext.lib.Dom.getY(dragEl), b = t + dragEl.offsetHeight;\n        var y = Ext.lib.Event.getPageY(e);\n        var noAppend = tn.allowChildren === false || tn.isLeaf();\n        if(this.appendOnly || tn.parentNode.allowChildren === false){\n            return noAppend ? false : \"append\";\n        }\n        var noBelow = false;\n        if(!this.allowParentInsert){\n            noBelow = tn.hasChildNodes() && tn.isExpanded();\n        }\n        var q = (b - t) / (noAppend ? 2 : 3);\n        if(y >= t && y < (t + q)){\n            return \"above\";\n        }else if(!noBelow && (noAppend || y >= b-q && y <= b)){\n            return \"below\";\n        }else{\n            return \"append\";\n        }\n    },\n\n    // private\n    onNodeEnter : function(n, dd, e, data){\n        this.cancelExpand();\n    },\n    \n    onContainerOver : function(dd, e, data) {\n        if (this.allowContainerDrop && this.isValidDropPoint({ ddel: this.tree.getRootNode().ui.elNode, node: this.tree.getRootNode() }, \"append\", dd, e, data)) {\n            return this.dropAllowed;\n        }\n        return this.dropNotAllowed;\n    },\n\n    // private\n    onNodeOver : function(n, dd, e, data){\n        var pt = this.getDropPoint(e, n, dd);\n        var node = n.node;\n        \n        // auto node expand check\n        if(!this.expandProcId && pt == \"append\" && node.hasChildNodes() && !n.node.isExpanded()){\n            this.queueExpand(node);\n        }else if(pt != \"append\"){\n            this.cancelExpand();\n        }\n        \n        // set the insert point style on the target node\n        var returnCls = this.dropNotAllowed;\n        if(this.isValidDropPoint(n, pt, dd, e, data)){\n           if(pt){\n               var el = n.ddel;\n               var cls;\n               if(pt == \"above\"){\n                   returnCls = n.node.isFirst() ? \"x-tree-drop-ok-above\" : \"x-tree-drop-ok-between\";\n                   cls = \"x-tree-drag-insert-above\";\n               }else if(pt == \"below\"){\n                   returnCls = n.node.isLast() ? \"x-tree-drop-ok-below\" : \"x-tree-drop-ok-between\";\n                   cls = \"x-tree-drag-insert-below\";\n               }else{\n                   returnCls = \"x-tree-drop-ok-append\";\n                   cls = \"x-tree-drag-append\";\n               }\n               if(this.lastInsertClass != cls){\n                   Ext.fly(el).replaceClass(this.lastInsertClass, cls);\n                   this.lastInsertClass = cls;\n               }\n           }\n       }\n       return returnCls;\n    },\n\n    // private\n    onNodeOut : function(n, dd, e, data){\n        this.cancelExpand();\n        this.removeDropIndicators(n);\n    },\n\n    // private\n    onNodeDrop : function(n, dd, e, data){\n        var point = this.getDropPoint(e, n, dd);\n        var targetNode = n.node;\n        targetNode.ui.startDrop();\n        if(!this.isValidDropPoint(n, point, dd, e, data)){\n            targetNode.ui.endDrop();\n            return false;\n        }\n        // first try to find the drop node\n        var dropNode = data.node || (dd.getTreeNode ? dd.getTreeNode(data, targetNode, point, e) : null);\n        return this.processDrop(targetNode, data, point, dd, e, dropNode);\n    },\n    \n    onContainerDrop : function(dd, e, data){\n        if (this.allowContainerDrop && this.isValidDropPoint({ ddel: this.tree.getRootNode().ui.elNode, node: this.tree.getRootNode() }, \"append\", dd, e, data)) {\n            var targetNode = this.tree.getRootNode();       \n            targetNode.ui.startDrop();\n            var dropNode = data.node || (dd.getTreeNode ? dd.getTreeNode(data, targetNode, 'append', e) : null);\n            return this.processDrop(targetNode, data, 'append', dd, e, dropNode);\n        }\n        return false;\n    },\n    \n    // private\n    processDrop: function(target, data, point, dd, e, dropNode){\n        var dropEvent = {\n            tree : this.tree,\n            target: target,\n            data: data,\n            point: point,\n            source: dd,\n            rawEvent: e,\n            dropNode: dropNode,\n            cancel: !dropNode,\n            dropStatus: false\n        };\n        var retval = this.tree.fireEvent(\"beforenodedrop\", dropEvent);\n        if(retval === false || dropEvent.cancel === true || !dropEvent.dropNode){\n            target.ui.endDrop();\n            return dropEvent.dropStatus;\n        }\n    \n        target = dropEvent.target;\n        if(point == 'append' && !target.isExpanded()){\n            target.expand(false, null, function(){\n                this.completeDrop(dropEvent);\n            }.createDelegate(this));\n        }else{\n            this.completeDrop(dropEvent);\n        }\n        return true;\n    },\n\n    // private\n    completeDrop : function(de){\n        var ns = de.dropNode, p = de.point, t = de.target;\n        if(!Ext.isArray(ns)){\n            ns = [ns];\n        }\n        var n;\n        for(var i = 0, len = ns.length; i < len; i++){\n            n = ns[i];\n            if(p == \"above\"){\n                t.parentNode.insertBefore(n, t);\n            }else if(p == \"below\"){\n                t.parentNode.insertBefore(n, t.nextSibling);\n            }else{\n                t.appendChild(n);\n            }\n        }\n        n.ui.focus();\n        if(Ext.enableFx && this.tree.hlDrop){\n            n.ui.highlight();\n        }\n        t.ui.endDrop();\n        this.tree.fireEvent(\"nodedrop\", de);\n    },\n\n    // private\n    afterNodeMoved : function(dd, data, e, targetNode, dropNode){\n        if(Ext.enableFx && this.tree.hlDrop){\n            dropNode.ui.focus();\n            dropNode.ui.highlight();\n        }\n        this.tree.fireEvent(\"nodedrop\", this.tree, targetNode, data, dd, e);\n    },\n\n    // private\n    getTree : function(){\n        return this.tree;\n    },\n\n    // private\n    removeDropIndicators : function(n){\n        if(n && n.ddel){\n            var el = n.ddel;\n            Ext.fly(el).removeClass([\n                    \"x-tree-drag-insert-above\",\n                    \"x-tree-drag-insert-below\",\n                    \"x-tree-drag-append\"]);\n            this.lastInsertClass = \"_noclass\";\n        }\n    },\n\n    // private\n    beforeDragDrop : function(target, e, id){\n        this.cancelExpand();\n        return true;\n    },\n\n    // private\n    afterRepair : function(data){\n        if(data && Ext.enableFx){\n            data.node.ui.highlight();\n        }\n        this.hideProxy();\n    }    \n});\n\n}/**\n * @class Ext.tree.TreeDragZone\n * @extends Ext.dd.DragZone\n * @constructor\n * @param {String/HTMLElement/Element} tree The {@link Ext.tree.TreePanel} for which to enable dragging\n * @param {Object} config\n */\nif(Ext.dd.DragZone){\nExt.tree.TreeDragZone = function(tree, config){\n    Ext.tree.TreeDragZone.superclass.constructor.call(this, tree.innerCt, config);\n    /**\n    * The TreePanel for this drag zone\n    * @type Ext.tree.TreePanel\n    * @property\n    */\n    this.tree = tree;\n};\n\nExt.extend(Ext.tree.TreeDragZone, Ext.dd.DragZone, {\n    /**\n     * @cfg {String} ddGroup\n     * A named drag drop group to which this object belongs.  If a group is specified, then this object will only\n     * interact with other drag drop objects in the same group (defaults to 'TreeDD').\n     */\n    ddGroup : \"TreeDD\",\n\n    // private\n    onBeforeDrag : function(data, e){\n        var n = data.node;\n        return n && n.draggable && !n.disabled;\n    },\n\n    // private\n    onInitDrag : function(e){\n        var data = this.dragData;\n        this.tree.getSelectionModel().select(data.node);\n        this.tree.eventModel.disable();\n        this.proxy.update(\"\");\n        data.node.ui.appendDDGhost(this.proxy.ghost.dom);\n        this.tree.fireEvent(\"startdrag\", this.tree, data.node, e);\n    },\n\n    // private\n    getRepairXY : function(e, data){\n        return data.node.ui.getDDRepairXY();\n    },\n\n    // private\n    onEndDrag : function(data, e){\n        this.tree.eventModel.enable.defer(100, this.tree.eventModel);\n        this.tree.fireEvent(\"enddrag\", this.tree, data.node, e);\n    },\n\n    // private\n    onValidDrop : function(dd, e, id){\n        this.tree.fireEvent(\"dragdrop\", this.tree, this.dragData.node, dd, e);\n        this.hideProxy();\n    },\n\n    // private\n    beforeInvalidDrop : function(e, id){\n        // this scrolls the original position back into view\n        var sm = this.tree.getSelectionModel();\n        sm.clearSelections();\n        sm.select(this.dragData.node);\n    },\n    \n    // private\n    afterRepair : function(){\n        if (Ext.enableFx && this.tree.hlDrop) {\n            Ext.Element.fly(this.dragData.ddel).highlight(this.hlColor || \"c3daf9\");\n        }\n        this.dragging = false;\n    }\n});\n}/**\n * @class Ext.tree.TreeEditor\n * @extends Ext.Editor\n * Provides editor functionality for inline tree node editing.  Any valid {@link Ext.form.Field} subclass can be used\n * as the editor field.\n * @constructor\n * @param {TreePanel} tree\n * @param {Object} fieldConfig (optional) Either a prebuilt {@link Ext.form.Field} instance or a Field config object\n * that will be applied to the default field instance (defaults to a {@link Ext.form.TextField}).\n * @param {Object} config (optional) A TreeEditor config object\n */\nExt.tree.TreeEditor = function(tree, fc, config){\n    fc = fc || {};\n    var field = fc.events ? fc : new Ext.form.TextField(fc);\n    \n    Ext.tree.TreeEditor.superclass.constructor.call(this, field, config);\n\n    this.tree = tree;\n\n    if(!tree.rendered){\n        tree.on('render', this.initEditor, this);\n    }else{\n        this.initEditor(tree);\n    }\n};\n\nExt.extend(Ext.tree.TreeEditor, Ext.Editor, {\n    /**\n     * @cfg {String} alignment\n     * The position to align to (see {@link Ext.Element#alignTo} for more details, defaults to \"l-l\").\n     */\n    alignment: \"l-l\",\n    // inherit\n    autoSize: false,\n    /**\n     * @cfg {Boolean} hideEl\n     * True to hide the bound element while the editor is displayed (defaults to false)\n     */\n    hideEl : false,\n    /**\n     * @cfg {String} cls\n     * CSS class to apply to the editor (defaults to \"x-small-editor x-tree-editor\")\n     */\n    cls: \"x-small-editor x-tree-editor\",\n    /**\n     * @cfg {Boolean} shim\n     * True to shim the editor if selects/iframes could be displayed beneath it (defaults to false)\n     */\n    shim:false,\n    // inherit\n    shadow:\"frame\",\n    /**\n     * @cfg {Number} maxWidth\n     * The maximum width in pixels of the editor field (defaults to 250).  Note that if the maxWidth would exceed\n     * the containing tree element's size, it will be automatically limited for you to the container width, taking\n     * scroll and client offsets into account prior to each edit.\n     */\n    maxWidth: 250,\n    /**\n     * @cfg {Number} editDelay The number of milliseconds between clicks to register a double-click that will trigger\n     * editing on the current node (defaults to 350).  If two clicks occur on the same node within this time span,\n     * the editor for the node will display, otherwise it will be processed as a regular click.\n     */\n    editDelay : 350,\n\n    initEditor : function(tree){\n        tree.on({\n            scope      : this,\n            beforeclick: this.beforeNodeClick,\n            dblclick   : this.onNodeDblClick\n        });\n        \n        this.on({\n            scope          : this,\n            complete       : this.updateNode,\n            beforestartedit: this.fitToTree,\n            specialkey     : this.onSpecialKey\n        });\n        \n        this.on('startedit', this.bindScroll, this, {delay:10});\n    },\n\n    // private\n    fitToTree : function(ed, el){\n        var td = this.tree.getTreeEl().dom, nd = el.dom;\n        if(td.scrollLeft >  nd.offsetLeft){ // ensure the node left point is visible\n            td.scrollLeft = nd.offsetLeft;\n        }\n        var w = Math.min(\n                this.maxWidth,\n                (td.clientWidth > 20 ? td.clientWidth : td.offsetWidth) - Math.max(0, nd.offsetLeft-td.scrollLeft) - /*cushion*/5);\n        this.setSize(w, '');\n    },\n\n    /**\n     * Edit the text of the passed {@link Ext.tree.TreeNode TreeNode}.\n     * @param node {Ext.tree.TreeNode} The TreeNode to edit. The TreeNode must be {@link Ext.tree.TreeNode#editable editable}.\n     */\n    triggerEdit : function(node, defer){\n        this.completeEdit();\n\t\tif(node.attributes.editable !== false){\n           /**\n            * The {@link Ext.tree.TreeNode TreeNode} this editor is bound to. Read-only.\n            * @type Ext.tree.TreeNode\n            * @property editNode\n            */\n\t\t\tthis.editNode = node;\n            if(this.tree.autoScroll){\n                Ext.fly(node.ui.getEl()).scrollIntoView(this.tree.body);\n            }\n            var value = node.text || '';\n            if (!Ext.isGecko && Ext.isEmpty(node.text)){\n                node.setText('&#160;');\n            }\n            this.autoEditTimer = this.startEdit.defer(this.editDelay, this, [node.ui.textNode, value]);\n            return false;\n        }\n    },\n\n    // private\n    bindScroll : function(){\n        this.tree.getTreeEl().on('scroll', this.cancelEdit, this);\n    },\n\n    // private\n    beforeNodeClick : function(node, e){\n        clearTimeout(this.autoEditTimer);\n        if(this.tree.getSelectionModel().isSelected(node)){\n            e.stopEvent();\n            return this.triggerEdit(node);\n        }\n    },\n\n    onNodeDblClick : function(node, e){\n        clearTimeout(this.autoEditTimer);\n    },\n\n    // private\n    updateNode : function(ed, value){\n        this.tree.getTreeEl().un('scroll', this.cancelEdit, this);\n        this.editNode.setText(value);\n    },\n\n    // private\n    onHide : function(){\n        Ext.tree.TreeEditor.superclass.onHide.call(this);\n        if(this.editNode){\n            this.editNode.ui.focus.defer(50, this.editNode.ui);\n        }\n    },\n\n    // private\n    onSpecialKey : function(field, e){\n        var k = e.getKey();\n        if(k == e.ESC){\n            e.stopEvent();\n            this.cancelEdit();\n        }else if(k == e.ENTER && !e.hasModifier()){\n            e.stopEvent();\n            this.completeEdit();\n        }\n    },\n    \n    onDestroy : function(){\n        clearTimeout(this.autoEditTimer);\n        Ext.tree.TreeEditor.superclass.onDestroy.call(this);\n        var tree = this.tree;\n        tree.un('beforeclick', this.beforeNodeClick, this);\n        tree.un('dblclick', this.onNodeDblClick, this);\n    }\n});/*! SWFObject v2.2 <http://code.google.com/p/swfobject/> \n    is released under the MIT License <http://www.opensource.org/licenses/mit-license.php> \n*/\n\nvar swfobject = function() {\n    \n    var UNDEF = \"undefined\",\n        OBJECT = \"object\",\n        SHOCKWAVE_FLASH = \"Shockwave Flash\",\n        SHOCKWAVE_FLASH_AX = \"ShockwaveFlash.ShockwaveFlash\",\n        FLASH_MIME_TYPE = \"application/x-shockwave-flash\",\n        EXPRESS_INSTALL_ID = \"SWFObjectExprInst\",\n        ON_READY_STATE_CHANGE = \"onreadystatechange\",\n        \n        win = window,\n        doc = document,\n        nav = navigator,\n        \n        plugin = false,\n        domLoadFnArr = [main],\n        regObjArr = [],\n        objIdArr = [],\n        listenersArr = [],\n        storedAltContent,\n        storedAltContentId,\n        storedCallbackFn,\n        storedCallbackObj,\n        isDomLoaded = false,\n        isExpressInstallActive = false,\n        dynamicStylesheet,\n        dynamicStylesheetMedia,\n        autoHideShow = true,\n    \n    /* Centralized function for browser feature detection\n        - User agent string detection is only used when no good alternative is possible\n        - Is executed directly for optimal performance\n    */  \n    ua = function() {\n        var w3cdom = typeof doc.getElementById != UNDEF && typeof doc.getElementsByTagName != UNDEF && typeof doc.createElement != UNDEF,\n            u = nav.userAgent.toLowerCase(),\n            p = nav.platform.toLowerCase(),\n            windows = p ? (/win/).test(p) : /win/.test(u),\n            mac = p ? (/mac/).test(p) : /mac/.test(u),\n            webkit = /webkit/.test(u) ? parseFloat(u.replace(/^.*webkit\\/(\\d+(\\.\\d+)?).*$/, \"$1\")) : false, // returns either the webkit version or false if not webkit\n            ie = !+\"\\v1\", // feature detection based on Andrea Giammarchi's solution: http://webreflection.blogspot.com/2009/01/32-bytes-to-know-if-your-browser-is-ie.html\n            playerVersion = [0,0,0],\n            d = null;\n        if (typeof nav.plugins != UNDEF && typeof nav.plugins[SHOCKWAVE_FLASH] == OBJECT) {\n            d = nav.plugins[SHOCKWAVE_FLASH].description;\n            if (d && !(typeof nav.mimeTypes != UNDEF && nav.mimeTypes[FLASH_MIME_TYPE] && !nav.mimeTypes[FLASH_MIME_TYPE].enabledPlugin)) { // navigator.mimeTypes[\"application/x-shockwave-flash\"].enabledPlugin indicates whether plug-ins are enabled or disabled in Safari 3+\n                plugin = true;\n                ie = false; // cascaded feature detection for Internet Explorer\n                d = d.replace(/^.*\\s+(\\S+\\s+\\S+$)/, \"$1\");\n                playerVersion[0] = parseInt(d.replace(/^(.*)\\..*$/, \"$1\"), 10);\n                playerVersion[1] = parseInt(d.replace(/^.*\\.(.*)\\s.*$/, \"$1\"), 10);\n                playerVersion[2] = /[a-zA-Z]/.test(d) ? parseInt(d.replace(/^.*[a-zA-Z]+(.*)$/, \"$1\"), 10) : 0;\n            }\n        }\n        else if (typeof win.ActiveXObject != UNDEF) {\n            try {\n                var a = new ActiveXObject(SHOCKWAVE_FLASH_AX);\n                if (a) { // a will return null when ActiveX is disabled\n                    d = a.GetVariable(\"$version\");\n                    if (d) {\n                        ie = true; // cascaded feature detection for Internet Explorer\n                        d = d.split(\" \")[1].split(\",\");\n                        playerVersion = [parseInt(d[0], 10), parseInt(d[1], 10), parseInt(d[2], 10)];\n                    }\n                }\n            }\n            catch(e) {}\n        }\n        return { w3:w3cdom, pv:playerVersion, wk:webkit, ie:ie, win:windows, mac:mac };\n    }(),\n    \n    /* Cross-browser onDomLoad\n        - Will fire an event as soon as the DOM of a web page is loaded\n        - Internet Explorer workaround based on Diego Perini's solution: http://javascript.nwbox.com/IEContentLoaded/\n        - Regular onload serves as fallback\n    */ \n    onDomLoad = function() {\n        if (!ua.w3) { return; }\n        if ((typeof doc.readyState != UNDEF && doc.readyState == \"complete\") || (typeof doc.readyState == UNDEF && (doc.getElementsByTagName(\"body\")[0] || doc.body))) { // function is fired after onload, e.g. when script is inserted dynamically \n            callDomLoadFunctions();\n        }\n        if (!isDomLoaded) {\n            if (typeof doc.addEventListener != UNDEF) {\n                doc.addEventListener(\"DOMContentLoaded\", callDomLoadFunctions, false);\n            }       \n            if (ua.ie && ua.win) {\n                doc.attachEvent(ON_READY_STATE_CHANGE, function() {\n                    if (doc.readyState == \"complete\") {\n                        doc.detachEvent(ON_READY_STATE_CHANGE, arguments.callee);\n                        callDomLoadFunctions();\n                    }\n                });\n                if (win == top) { // if not inside an iframe\n                    (function(){\n                        if (isDomLoaded) { return; }\n                        try {\n                            doc.documentElement.doScroll(\"left\");\n                        }\n                        catch(e) {\n                            setTimeout(arguments.callee, 0);\n                            return;\n                        }\n                        callDomLoadFunctions();\n                    })();\n                }\n            }\n            if (ua.wk) {\n                (function(){\n                    if (isDomLoaded) { return; }\n                    if (!(/loaded|complete/).test(doc.readyState)) {\n                        setTimeout(arguments.callee, 0);\n                        return;\n                    }\n                    callDomLoadFunctions();\n                })();\n            }\n            addLoadEvent(callDomLoadFunctions);\n        }\n    }();\n    \n    function callDomLoadFunctions() {\n        if (isDomLoaded) { return; }\n        try { // test if we can really add/remove elements to/from the DOM; we don't want to fire it too early\n            var t = doc.getElementsByTagName(\"body\")[0].appendChild(createElement(\"span\"));\n            t.parentNode.removeChild(t);\n        }\n        catch (e) { return; }\n        isDomLoaded = true;\n        var dl = domLoadFnArr.length;\n        for (var i = 0; i < dl; i++) {\n            domLoadFnArr[i]();\n        }\n    }\n    \n    function addDomLoadEvent(fn) {\n        if (isDomLoaded) {\n            fn();\n        }\n        else { \n            domLoadFnArr[domLoadFnArr.length] = fn; // Array.push() is only available in IE5.5+\n        }\n    }\n    \n    /* Cross-browser onload\n        - Based on James Edwards' solution: http://brothercake.com/site/resources/scripts/onload/\n        - Will fire an event as soon as a web page including all of its assets are loaded \n     */\n    function addLoadEvent(fn) {\n        if (typeof win.addEventListener != UNDEF) {\n            win.addEventListener(\"load\", fn, false);\n        }\n        else if (typeof doc.addEventListener != UNDEF) {\n            doc.addEventListener(\"load\", fn, false);\n        }\n        else if (typeof win.attachEvent != UNDEF) {\n            addListener(win, \"onload\", fn);\n        }\n        else if (typeof win.onload == \"function\") {\n            var fnOld = win.onload;\n            win.onload = function() {\n                fnOld();\n                fn();\n            };\n        }\n        else {\n            win.onload = fn;\n        }\n    }\n    \n    /* Main function\n        - Will preferably execute onDomLoad, otherwise onload (as a fallback)\n    */\n    function main() { \n        if (plugin) {\n            testPlayerVersion();\n        }\n        else {\n            matchVersions();\n        }\n    }\n    \n    /* Detect the Flash Player version for non-Internet Explorer browsers\n        - Detecting the plug-in version via the object element is more precise than using the plugins collection item's description:\n          a. Both release and build numbers can be detected\n          b. Avoid wrong descriptions by corrupt installers provided by Adobe\n          c. Avoid wrong descriptions by multiple Flash Player entries in the plugin Array, caused by incorrect browser imports\n        - Disadvantage of this method is that it depends on the availability of the DOM, while the plugins collection is immediately available\n    */\n    function testPlayerVersion() {\n        var b = doc.getElementsByTagName(\"body\")[0];\n        var o = createElement(OBJECT);\n        o.setAttribute(\"type\", FLASH_MIME_TYPE);\n        var t = b.appendChild(o);\n        if (t) {\n            var counter = 0;\n            (function(){\n                if (typeof t.GetVariable != UNDEF) {\n                    var d = t.GetVariable(\"$version\");\n                    if (d) {\n                        d = d.split(\" \")[1].split(\",\");\n                        ua.pv = [parseInt(d[0], 10), parseInt(d[1], 10), parseInt(d[2], 10)];\n                    }\n                }\n                else if (counter < 10) {\n                    counter++;\n                    setTimeout(arguments.callee, 10);\n                    return;\n                }\n                b.removeChild(o);\n                t = null;\n                matchVersions();\n            })();\n        }\n        else {\n            matchVersions();\n        }\n    }\n    \n    /* Perform Flash Player and SWF version matching; static publishing only\n    */\n    function matchVersions() {\n        var rl = regObjArr.length;\n        if (rl > 0) {\n            for (var i = 0; i < rl; i++) { // for each registered object element\n                var id = regObjArr[i].id;\n                var cb = regObjArr[i].callbackFn;\n                var cbObj = {success:false, id:id};\n                if (ua.pv[0] > 0) {\n                    var obj = getElementById(id);\n                    if (obj) {\n                        if (hasPlayerVersion(regObjArr[i].swfVersion) && !(ua.wk && ua.wk < 312)) { // Flash Player version >= published SWF version: Houston, we have a match!\n                            setVisibility(id, true);\n                            if (cb) {\n                                cbObj.success = true;\n                                cbObj.ref = getObjectById(id);\n                                cb(cbObj);\n                            }\n                        }\n                        else if (regObjArr[i].expressInstall && canExpressInstall()) { // show the Adobe Express Install dialog if set by the web page author and if supported\n                            var att = {};\n                            att.data = regObjArr[i].expressInstall;\n                            att.width = obj.getAttribute(\"width\") || \"0\";\n                            att.height = obj.getAttribute(\"height\") || \"0\";\n                            if (obj.getAttribute(\"class\")) { att.styleclass = obj.getAttribute(\"class\"); }\n                            if (obj.getAttribute(\"align\")) { att.align = obj.getAttribute(\"align\"); }\n                            // parse HTML object param element's name-value pairs\n                            var par = {};\n                            var p = obj.getElementsByTagName(\"param\");\n                            var pl = p.length;\n                            for (var j = 0; j < pl; j++) {\n                                if (p[j].getAttribute(\"name\").toLowerCase() != \"movie\") {\n                                    par[p[j].getAttribute(\"name\")] = p[j].getAttribute(\"value\");\n                                }\n                            }\n                            showExpressInstall(att, par, id, cb);\n                        }\n                        else { // Flash Player and SWF version mismatch or an older Webkit engine that ignores the HTML object element's nested param elements: display alternative content instead of SWF\n                            displayAltContent(obj);\n                            if (cb) { cb(cbObj); }\n                        }\n                    }\n                }\n                else {  // if no Flash Player is installed or the fp version cannot be detected we let the HTML object element do its job (either show a SWF or alternative content)\n                    setVisibility(id, true);\n                    if (cb) {\n                        var o = getObjectById(id); // test whether there is an HTML object element or not\n                        if (o && typeof o.SetVariable != UNDEF) { \n                            cbObj.success = true;\n                            cbObj.ref = o;\n                        }\n                        cb(cbObj);\n                    }\n                }\n            }\n        }\n    }\n    \n    function getObjectById(objectIdStr) {\n        var r = null;\n        var o = getElementById(objectIdStr);\n        if (o && o.nodeName == \"OBJECT\") {\n            if (typeof o.SetVariable != UNDEF) {\n                r = o;\n            }\n            else {\n                var n = o.getElementsByTagName(OBJECT)[0];\n                if (n) {\n                    r = n;\n                }\n            }\n        }\n        return r;\n    }\n    \n    /* Requirements for Adobe Express Install\n        - only one instance can be active at a time\n        - fp 6.0.65 or higher\n        - Win/Mac OS only\n        - no Webkit engines older than version 312\n    */\n    function canExpressInstall() {\n        return !isExpressInstallActive && hasPlayerVersion(\"6.0.65\") && (ua.win || ua.mac) && !(ua.wk && ua.wk < 312);\n    }\n    \n    /* Show the Adobe Express Install dialog\n        - Reference: http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=6a253b75\n    */\n    function showExpressInstall(att, par, replaceElemIdStr, callbackFn) {\n        isExpressInstallActive = true;\n        storedCallbackFn = callbackFn || null;\n        storedCallbackObj = {success:false, id:replaceElemIdStr};\n        var obj = getElementById(replaceElemIdStr);\n        if (obj) {\n            if (obj.nodeName == \"OBJECT\") { // static publishing\n                storedAltContent = abstractAltContent(obj);\n                storedAltContentId = null;\n            }\n            else { // dynamic publishing\n                storedAltContent = obj;\n                storedAltContentId = replaceElemIdStr;\n            }\n            att.id = EXPRESS_INSTALL_ID;\n            if (typeof att.width == UNDEF || (!(/%$/).test(att.width) && parseInt(att.width, 10) < 310)) {\n                att.width = \"310\";\n            }\n            \n            if (typeof att.height == UNDEF || (!(/%$/).test(att.height) && parseInt(att.height, 10) < 137)) {\n                att.height = \"137\";\n            }\n            doc.title = doc.title.slice(0, 47) + \" - Flash Player Installation\";\n            var pt = ua.ie && ua.win ? \"ActiveX\" : \"PlugIn\",\n                fv = \"MMredirectURL=\" + win.location.toString().replace(/&/g,\"%26\") + \"&MMplayerType=\" + pt + \"&MMdoctitle=\" + doc.title;\n            if (typeof par.flashvars != UNDEF) {\n                par.flashvars += \"&\" + fv;\n            }\n            else {\n                par.flashvars = fv;\n            }\n            // IE only: when a SWF is loading (AND: not available in cache) wait for the readyState of the object element to become 4 before removing it,\n            // because you cannot properly cancel a loading SWF file without breaking browser load references, also obj.onreadystatechange doesn't work\n            if (ua.ie && ua.win && obj.readyState != 4) {\n                var newObj = createElement(\"div\");\n                replaceElemIdStr += \"SWFObjectNew\";\n                newObj.setAttribute(\"id\", replaceElemIdStr);\n                obj.parentNode.insertBefore(newObj, obj); // insert placeholder div that will be replaced by the object element that loads expressinstall.swf\n                obj.style.display = \"none\";\n                (function(){\n                    if (obj.readyState == 4) {\n                        obj.parentNode.removeChild(obj);\n                    }\n                    else {\n                        setTimeout(arguments.callee, 10);\n                    }\n                })();\n            }\n            createSWF(att, par, replaceElemIdStr);\n        }\n    }\n    \n    /* Functions to abstract and display alternative content\n    */\n    function displayAltContent(obj) {\n        if (ua.ie && ua.win && obj.readyState != 4) {\n            // IE only: when a SWF is loading (AND: not available in cache) wait for the readyState of the object element to become 4 before removing it,\n            // because you cannot properly cancel a loading SWF file without breaking browser load references, also obj.onreadystatechange doesn't work\n            var el = createElement(\"div\");\n            obj.parentNode.insertBefore(el, obj); // insert placeholder div that will be replaced by the alternative content\n            el.parentNode.replaceChild(abstractAltContent(obj), el);\n            obj.style.display = \"none\";\n            (function(){\n                if (obj.readyState == 4) {\n                    obj.parentNode.removeChild(obj);\n                }\n                else {\n                    setTimeout(arguments.callee, 10);\n                }\n            })();\n        }\n        else {\n            obj.parentNode.replaceChild(abstractAltContent(obj), obj);\n        }\n    } \n\n    function abstractAltContent(obj) {\n        var ac = createElement(\"div\");\n        if (ua.win && ua.ie) {\n            ac.innerHTML = obj.innerHTML;\n        }\n        else {\n            var nestedObj = obj.getElementsByTagName(OBJECT)[0];\n            if (nestedObj) {\n                var c = nestedObj.childNodes;\n                if (c) {\n                    var cl = c.length;\n                    for (var i = 0; i < cl; i++) {\n                        if (!(c[i].nodeType == 1 && c[i].nodeName == \"PARAM\") && !(c[i].nodeType == 8)) {\n                            ac.appendChild(c[i].cloneNode(true));\n                        }\n                    }\n                }\n            }\n        }\n        return ac;\n    }\n    \n    /* Cross-browser dynamic SWF creation\n    */\n    function createSWF(attObj, parObj, id) {\n        var r, el = getElementById(id);\n        if (ua.wk && ua.wk < 312) { return r; }\n        if (el) {\n            if (typeof attObj.id == UNDEF) { // if no 'id' is defined for the object element, it will inherit the 'id' from the alternative content\n                attObj.id = id;\n            }\n            if (ua.ie && ua.win) { // Internet Explorer + the HTML object element + W3C DOM methods do not combine: fall back to outerHTML\n                var att = \"\";\n                for (var i in attObj) {\n                    if (attObj[i] != Object.prototype[i]) { // filter out prototype additions from other potential libraries\n                        if (i.toLowerCase() == \"data\") {\n                            parObj.movie = attObj[i];\n                        }\n                        else if (i.toLowerCase() == \"styleclass\") { // 'class' is an ECMA4 reserved keyword\n                            att += ' class=\"' + attObj[i] + '\"';\n                        }\n                        else if (i.toLowerCase() != \"classid\") {\n                            att += ' ' + i + '=\"' + attObj[i] + '\"';\n                        }\n                    }\n                }\n                var par = \"\";\n                for (var j in parObj) {\n                    if (parObj[j] != Object.prototype[j]) { // filter out prototype additions from other potential libraries\n                        par += '<param name=\"' + j + '\" value=\"' + parObj[j] + '\" />';\n                    }\n                }\n                el.outerHTML = '<object classid=\"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000\"' + att + '>' + par + '</object>';\n                objIdArr[objIdArr.length] = attObj.id; // stored to fix object 'leaks' on unload (dynamic publishing only)\n                r = getElementById(attObj.id);  \n            }\n            else { // well-behaving browsers\n                var o = createElement(OBJECT);\n                o.setAttribute(\"type\", FLASH_MIME_TYPE);\n                for (var m in attObj) {\n                    if (attObj[m] != Object.prototype[m]) { // filter out prototype additions from other potential libraries\n                        if (m.toLowerCase() == \"styleclass\") { // 'class' is an ECMA4 reserved keyword\n                            o.setAttribute(\"class\", attObj[m]);\n                        }\n                        else if (m.toLowerCase() != \"classid\") { // filter out IE specific attribute\n                            o.setAttribute(m, attObj[m]);\n                        }\n                    }\n                }\n                for (var n in parObj) {\n                    if (parObj[n] != Object.prototype[n] && n.toLowerCase() != \"movie\") { // filter out prototype additions from other potential libraries and IE specific param element\n                        createObjParam(o, n, parObj[n]);\n                    }\n                }\n                el.parentNode.replaceChild(o, el);\n                r = o;\n            }\n        }\n        return r;\n    }\n    \n    function createObjParam(el, pName, pValue) {\n        var p = createElement(\"param\");\n        p.setAttribute(\"name\", pName);  \n        p.setAttribute(\"value\", pValue);\n        el.appendChild(p);\n    }\n    \n    /* Cross-browser SWF removal\n        - Especially needed to safely and completely remove a SWF in Internet Explorer\n    */\n    function removeSWF(id) {\n        var obj = getElementById(id);\n        if (obj && obj.nodeName == \"OBJECT\") {\n            if (ua.ie && ua.win) {\n                obj.style.display = \"none\";\n                (function(){\n                    if (obj.readyState == 4) {\n                        removeObjectInIE(id);\n                    }\n                    else {\n                        setTimeout(arguments.callee, 10);\n                    }\n                })();\n            }\n            else {\n                obj.parentNode.removeChild(obj);\n            }\n        }\n    }\n    \n    function removeObjectInIE(id) {\n        var obj = getElementById(id);\n        if (obj) {\n            for (var i in obj) {\n                if (typeof obj[i] == \"function\") {\n                    obj[i] = null;\n                }\n            }\n            obj.parentNode.removeChild(obj);\n        }\n    }\n    \n    /* Functions to optimize JavaScript compression\n    */\n    function getElementById(id) {\n        var el = null;\n        try {\n            el = doc.getElementById(id);\n        }\n        catch (e) {}\n        return el;\n    }\n    \n    function createElement(el) {\n        return doc.createElement(el);\n    }\n    \n    /* Updated attachEvent function for Internet Explorer\n        - Stores attachEvent information in an Array, so on unload the detachEvent functions can be called to avoid memory leaks\n    */  \n    function addListener(target, eventType, fn) {\n        target.attachEvent(eventType, fn);\n        listenersArr[listenersArr.length] = [target, eventType, fn];\n    }\n    \n    /* Flash Player and SWF content version matching\n    */\n    function hasPlayerVersion(rv) {\n        var pv = ua.pv, v = rv.split(\".\");\n        v[0] = parseInt(v[0], 10);\n        v[1] = parseInt(v[1], 10) || 0; // supports short notation, e.g. \"9\" instead of \"9.0.0\"\n        v[2] = parseInt(v[2], 10) || 0;\n        return (pv[0] > v[0] || (pv[0] == v[0] && pv[1] > v[1]) || (pv[0] == v[0] && pv[1] == v[1] && pv[2] >= v[2])) ? true : false;\n    }\n    \n    /* Cross-browser dynamic CSS creation\n        - Based on Bobby van der Sluis' solution: http://www.bobbyvandersluis.com/articles/dynamicCSS.php\n    */  \n    function createCSS(sel, decl, media, newStyle) {\n        if (ua.ie && ua.mac) { return; }\n        var h = doc.getElementsByTagName(\"head\")[0];\n        if (!h) { return; } // to also support badly authored HTML pages that lack a head element\n        var m = (media && typeof media == \"string\") ? media : \"screen\";\n        if (newStyle) {\n            dynamicStylesheet = null;\n            dynamicStylesheetMedia = null;\n        }\n        if (!dynamicStylesheet || dynamicStylesheetMedia != m) { \n            // create dynamic stylesheet + get a global reference to it\n            var s = createElement(\"style\");\n            s.setAttribute(\"type\", \"text/css\");\n            s.setAttribute(\"media\", m);\n            dynamicStylesheet = h.appendChild(s);\n            if (ua.ie && ua.win && typeof doc.styleSheets != UNDEF && doc.styleSheets.length > 0) {\n                dynamicStylesheet = doc.styleSheets[doc.styleSheets.length - 1];\n            }\n            dynamicStylesheetMedia = m;\n        }\n        // add style rule\n        if (ua.ie && ua.win) {\n            if (dynamicStylesheet && typeof dynamicStylesheet.addRule == OBJECT) {\n                dynamicStylesheet.addRule(sel, decl);\n            }\n        }\n        else {\n            if (dynamicStylesheet && typeof doc.createTextNode != UNDEF) {\n                dynamicStylesheet.appendChild(doc.createTextNode(sel + \" {\" + decl + \"}\"));\n            }\n        }\n    }\n    \n    function setVisibility(id, isVisible) {\n        if (!autoHideShow) { return; }\n        var v = isVisible ? \"visible\" : \"hidden\";\n        if (isDomLoaded && getElementById(id)) {\n            getElementById(id).style.visibility = v;\n        }\n        else {\n            createCSS(\"#\" + id, \"visibility:\" + v);\n        }\n    }\n\n    /* Filter to avoid XSS attacks\n    */\n    function urlEncodeIfNecessary(s) {\n        var regex = /[\\\\\\\"<>\\.;]/;\n        var hasBadChars = regex.exec(s) != null;\n        return hasBadChars && typeof encodeURIComponent != UNDEF ? encodeURIComponent(s) : s;\n    }\n    \n    /* Release memory to avoid memory leaks caused by closures, fix hanging audio/video threads and force open sockets/NetConnections to disconnect (Internet Explorer only)\n    */\n    var cleanup = function() {\n        if (ua.ie && ua.win) {\n            window.attachEvent(\"onunload\", function() {\n                // remove listeners to avoid memory leaks\n                var ll = listenersArr.length;\n                for (var i = 0; i < ll; i++) {\n                    listenersArr[i][0].detachEvent(listenersArr[i][1], listenersArr[i][2]);\n                }\n                // cleanup dynamically embedded objects to fix audio/video threads and force open sockets and NetConnections to disconnect\n                var il = objIdArr.length;\n                for (var j = 0; j < il; j++) {\n                    removeSWF(objIdArr[j]);\n                }\n                // cleanup library's main closures to avoid memory leaks\n                for (var k in ua) {\n                    ua[k] = null;\n                }\n                ua = null;\n                for (var l in swfobject) {\n                    swfobject[l] = null;\n                }\n                swfobject = null;\n                window.detachEvent('onunload', arguments.callee);\n            });\n        }\n    }();\n    \n    return {\n        /* Public API\n            - Reference: http://code.google.com/p/swfobject/wiki/documentation\n        */ \n        registerObject: function(objectIdStr, swfVersionStr, xiSwfUrlStr, callbackFn) {\n            if (ua.w3 && objectIdStr && swfVersionStr) {\n                var regObj = {};\n                regObj.id = objectIdStr;\n                regObj.swfVersion = swfVersionStr;\n                regObj.expressInstall = xiSwfUrlStr;\n                regObj.callbackFn = callbackFn;\n                regObjArr[regObjArr.length] = regObj;\n                setVisibility(objectIdStr, false);\n            }\n            else if (callbackFn) {\n                callbackFn({success:false, id:objectIdStr});\n            }\n        },\n        \n        getObjectById: function(objectIdStr) {\n            if (ua.w3) {\n                return getObjectById(objectIdStr);\n            }\n        },\n        \n        embedSWF: function(swfUrlStr, replaceElemIdStr, widthStr, heightStr, swfVersionStr, xiSwfUrlStr, flashvarsObj, parObj, attObj, callbackFn) {\n            var callbackObj = {success:false, id:replaceElemIdStr};\n            if (ua.w3 && !(ua.wk && ua.wk < 312) && swfUrlStr && replaceElemIdStr && widthStr && heightStr && swfVersionStr) {\n                setVisibility(replaceElemIdStr, false);\n                addDomLoadEvent(function() {\n                    widthStr += \"\"; // auto-convert to string\n                    heightStr += \"\";\n                    var att = {};\n                    if (attObj && typeof attObj === OBJECT) {\n                        for (var i in attObj) { // copy object to avoid the use of references, because web authors often reuse attObj for multiple SWFs\n                            att[i] = attObj[i];\n                        }\n                    }\n                    att.data = swfUrlStr;\n                    att.width = widthStr;\n                    att.height = heightStr;\n                    var par = {}; \n                    if (parObj && typeof parObj === OBJECT) {\n                        for (var j in parObj) { // copy object to avoid the use of references, because web authors often reuse parObj for multiple SWFs\n                            par[j] = parObj[j];\n                        }\n                    }\n                    if (flashvarsObj && typeof flashvarsObj === OBJECT) {\n                        for (var k in flashvarsObj) { // copy object to avoid the use of references, because web authors often reuse flashvarsObj for multiple SWFs\n                            if (typeof par.flashvars != UNDEF) {\n                                par.flashvars += \"&\" + k + \"=\" + flashvarsObj[k];\n                            }\n                            else {\n                                par.flashvars = k + \"=\" + flashvarsObj[k];\n                            }\n                        }\n                    }\n                    if (hasPlayerVersion(swfVersionStr)) { // create SWF\n                        var obj = createSWF(att, par, replaceElemIdStr);\n                        if (att.id == replaceElemIdStr) {\n                            setVisibility(replaceElemIdStr, true);\n                        }\n                        callbackObj.success = true;\n                        callbackObj.ref = obj;\n                    }\n                    else if (xiSwfUrlStr && canExpressInstall()) { // show Adobe Express Install\n                        att.data = xiSwfUrlStr;\n                        showExpressInstall(att, par, replaceElemIdStr, callbackFn);\n                        return;\n                    }\n                    else { // show alternative content\n                        setVisibility(replaceElemIdStr, true);\n                    }\n                    if (callbackFn) { callbackFn(callbackObj); }\n                });\n            }\n            else if (callbackFn) { callbackFn(callbackObj); }\n        },\n        \n        switchOffAutoHideShow: function() {\n            autoHideShow = false;\n        },\n        \n        ua: ua,\n        \n        getFlashPlayerVersion: function() {\n            return { major:ua.pv[0], minor:ua.pv[1], release:ua.pv[2] };\n        },\n        \n        hasFlashPlayerVersion: hasPlayerVersion,\n        \n        createSWF: function(attObj, parObj, replaceElemIdStr) {\n            if (ua.w3) {\n                return createSWF(attObj, parObj, replaceElemIdStr);\n            }\n            else {\n                return undefined;\n            }\n        },\n        \n        showExpressInstall: function(att, par, replaceElemIdStr, callbackFn) {\n            if (ua.w3 && canExpressInstall()) {\n                showExpressInstall(att, par, replaceElemIdStr, callbackFn);\n            }\n        },\n        \n        removeSWF: function(objElemIdStr) {\n            if (ua.w3) {\n                removeSWF(objElemIdStr);\n            }\n        },\n        \n        createCSS: function(selStr, declStr, mediaStr, newStyleBoolean) {\n            if (ua.w3) {\n                createCSS(selStr, declStr, mediaStr, newStyleBoolean);\n            }\n        },\n        \n        addDomLoadEvent: addDomLoadEvent,\n        \n        addLoadEvent: addLoadEvent,\n        \n        getQueryParamValue: function(param) {\n            var q = doc.location.search || doc.location.hash;\n            if (q) {\n                if (/\\?/.test(q)) { q = q.split(\"?\")[1]; } // strip question mark\n                if (param == null) {\n                    return urlEncodeIfNecessary(q);\n                }\n                var pairs = q.split(\"&\");\n                for (var i = 0; i < pairs.length; i++) {\n                    if (pairs[i].substring(0, pairs[i].indexOf(\"=\")) == param) {\n                        return urlEncodeIfNecessary(pairs[i].substring((pairs[i].indexOf(\"=\") + 1)));\n                    }\n                }\n            }\n            return \"\";\n        },\n        \n        // For internal usage only\n        expressInstallCallback: function() {\n            if (isExpressInstallActive) {\n                var obj = getElementById(EXPRESS_INSTALL_ID);\n                if (obj && storedAltContent) {\n                    obj.parentNode.replaceChild(storedAltContent, obj);\n                    if (storedAltContentId) {\n                        setVisibility(storedAltContentId, true);\n                        if (ua.ie && ua.win) { storedAltContent.style.display = \"block\"; }\n                    }\n                    if (storedCallbackFn) { storedCallbackFn(storedCallbackObj); }\n                }\n                isExpressInstallActive = false;\n            } \n        }\n    };\n}();\n/**\n * @class Ext.FlashComponent\n * @extends Ext.BoxComponent\n * @constructor\n * @xtype flash\n */\nExt.FlashComponent = Ext.extend(Ext.BoxComponent, {\n    /**\n     * @cfg {String} flashVersion\n     * Indicates the version the flash content was published for. Defaults to <tt>'9.0.115'</tt>.\n     */\n    flashVersion : '9.0.115',\n\n    /**\n     * @cfg {String} backgroundColor\n     * The background color of the chart. Defaults to <tt>'#ffffff'</tt>.\n     */\n    backgroundColor: '#ffffff',\n\n    /**\n     * @cfg {String} wmode\n     * The wmode of the flash object. This can be used to control layering. Defaults to <tt>'opaque'</tt>.\n     */\n    wmode: 'opaque',\n\n    /**\n     * @cfg {Object} flashVars\n     * A set of key value pairs to be passed to the flash object as flash variables. Defaults to <tt>undefined</tt>.\n     */\n    flashVars: undefined,\n\n    /**\n     * @cfg {Object} flashParams\n     * A set of key value pairs to be passed to the flash object as parameters. Possible parameters can be found here:\n     * http://kb2.adobe.com/cps/127/tn_12701.html Defaults to <tt>undefined</tt>.\n     */\n    flashParams: undefined,\n\n    /**\n     * @cfg {String} url\n     * The URL of the chart to include. Defaults to <tt>undefined</tt>.\n     */\n    url: undefined,\n    swfId : undefined,\n    swfWidth: '100%',\n    swfHeight: '100%',\n\n    /**\n     * @cfg {Boolean} expressInstall\n     * True to prompt the user to install flash if not installed. Note that this uses\n     * Ext.FlashComponent.EXPRESS_INSTALL_URL, which should be set to the local resource. Defaults to <tt>false</tt>.\n     */\n    expressInstall: false,\n\n    initComponent : function(){\n        Ext.FlashComponent.superclass.initComponent.call(this);\n\n        this.addEvents(\n            /**\n             * @event initialize\n             *\n             * @param {Chart} this\n             */\n            'initialize'\n        );\n    },\n\n    onRender : function(){\n        Ext.FlashComponent.superclass.onRender.apply(this, arguments);\n\n        var params = Ext.apply({\n            allowScriptAccess: 'always',\n            bgcolor: this.backgroundColor,\n            wmode: this.wmode\n        }, this.flashParams), vars = Ext.apply({\n            allowedDomain: document.location.hostname,\n            YUISwfId: this.getId(),\n            YUIBridgeCallback: 'Ext.FlashEventProxy.onEvent'\n        }, this.flashVars);\n\n        new swfobject.embedSWF(this.url, this.id, this.swfWidth, this.swfHeight, this.flashVersion,\n            this.expressInstall ? Ext.FlashComponent.EXPRESS_INSTALL_URL : undefined, vars, params);\n\n        this.swf = Ext.getDom(this.id);\n        this.el = Ext.get(this.swf);\n    },\n\n    getSwfId : function(){\n        return this.swfId || (this.swfId = \"extswf\" + (++Ext.Component.AUTO_ID));\n    },\n\n    getId : function(){\n        return this.id || (this.id = \"extflashcmp\" + (++Ext.Component.AUTO_ID));\n    },\n\n    onFlashEvent : function(e){\n        switch(e.type){\n            case \"swfReady\":\n                this.initSwf();\n                return;\n            case \"log\":\n                return;\n        }\n        e.component = this;\n        this.fireEvent(e.type.toLowerCase().replace(/event$/, ''), e);\n    },\n\n    initSwf : function(){\n        this.onSwfReady(!!this.isInitialized);\n        this.isInitialized = true;\n        this.fireEvent('initialize', this);\n    },\n\n    beforeDestroy: function(){\n        if(this.rendered){\n            swfobject.removeSWF(this.swf.id);\n        }\n        Ext.FlashComponent.superclass.beforeDestroy.call(this);\n    },\n\n    onSwfReady : Ext.emptyFn\n});\n\n/**\n * Sets the url for installing flash if it doesn't exist. This should be set to a local resource.\n * @static\n * @type String\n */\nExt.FlashComponent.EXPRESS_INSTALL_URL = 'http:/' + '/swfobject.googlecode.com/svn/trunk/swfobject/expressInstall.swf';\n\nExt.reg('flash', Ext.FlashComponent);/**\n * @class Ext.FlashProxy\n * @singleton\n */\nExt.FlashEventProxy = {\n    onEvent : function(id, e){\n        var fp = Ext.getCmp(id);\n        if(fp){\n            fp.onFlashEvent(e);\n        }else{\n            arguments.callee.defer(10, this, [id, e]);\n        }\n    }\n};/**\n * @class Ext.chart.Chart\n * @extends Ext.FlashComponent\n * The Ext.chart package provides the capability to visualize data with flash based charting.\n * Each chart binds directly to an Ext.data.Store enabling automatic updates of the chart.\n * To change the look and feel of a chart, see the {@link #chartStyle} and {@link #extraStyle} config options.\n * @constructor\n * @xtype chart\n */\n\n Ext.chart.Chart = Ext.extend(Ext.FlashComponent, {\n    refreshBuffer: 100,\n\n    /**\n     * @cfg {String} backgroundColor\n     * @hide\n     */\n\n    /**\n     * @cfg {Object} chartStyle\n     * Sets styles for this chart. This contains default styling, so modifying this property will <b>override</b>\n     * the built in styles of the chart. Use {@link #extraStyle} to add customizations to the default styling.\n     */\n    chartStyle: {\n        padding: 10,\n        animationEnabled: true,\n        font: {\n            name: 'Tahoma',\n            color: 0x444444,\n            size: 11\n        },\n        dataTip: {\n            padding: 5,\n            border: {\n                color: 0x99bbe8,\n                size:1\n            },\n            background: {\n                color: 0xDAE7F6,\n                alpha: .9\n            },\n            font: {\n                name: 'Tahoma',\n                color: 0x15428B,\n                size: 10,\n                bold: true\n            }\n        }\n    },\n\n    /**\n     * @cfg {String} url\n     * The url to load the chart from. This defaults to Ext.chart.Chart.CHART_URL, which should\n     * be modified to point to the local charts resource.\n     */\n\n    /**\n     * @cfg {Object} extraStyle\n     * Contains extra styles that will be added or overwritten to the default chartStyle. Defaults to <tt>null</tt>.\n     * For a detailed list of the options available, visit the YUI Charts site\n     * at <a href=\"http://developer.yahoo.com/yui/charts/#basicstyles\">http://developer.yahoo.com/yui/charts/#basicstyles</a><br/>\n     * Some of the options availabe:<br />\n     * <ul style=\"padding:5px;padding-left:16px;list-style-type:inherit;\">\n     * <li><b>padding</b> - The space around the edge of the chart's contents. Padding does not increase the size of the chart.</li>\n     * <li><b>animationEnabled</b> - A Boolean value that specifies whether marker animations are enabled or not. Enabled by default.</li>\n     * <li><b>font</b> - An Object defining the font style to be used in the chart. Defaults to <tt>{ name: 'Tahoma', color: 0x444444, size: 11 }</tt><br/>\n     *  <ul style=\"padding:5px;padding-left:26px;list-style-type:circle;\">\n     *      <li><b>name</b> - font name</li>\n     *      <li><b>color</b> - font color (hex code, ie: \"#ff0000\", \"ff0000\" or 0xff0000)</li>\n     *      <li><b>size</b> - font size in points (numeric portion only, ie: 11)</li>\n     *      <li><b>bold</b> - boolean</li>\n     *      <li><b>italic</b> - boolean</li>\n     *      <li><b>underline</b> - boolean</li>\n     *  </ul>\n     * </li>\n     * <li><b>border</b> - An object defining the border style around the chart. The chart itself will decrease in dimensions to accomodate the border.<br/>\n     *  <ul style=\"padding:5px;padding-left:26px;list-style-type:circle;\">\n     *      <li><b>color</b> - border color (hex code, ie: \"#ff0000\", \"ff0000\" or 0xff0000)</li>\n     *      <li><b>size</b> - border size in pixels (numeric portion only, ie: 1)</li>\n     *  </ul>\n     * </li>\n     * <li><b>background</b> - An object defining the background style of the chart.<br/>\n     *  <ul style=\"padding:5px;padding-left:26px;list-style-type:circle;\">\n     *      <li><b>color</b> - border color (hex code, ie: \"#ff0000\", \"ff0000\" or 0xff0000)</li>\n     *      <li><b>image</b> - an image URL. May be relative to the current document or absolute.</li>\n     *  </ul>\n     * </li>\n     * <li><b>legend</b> - An object defining the legend style<br/>\n     *  <ul style=\"padding:5px;padding-left:26px;list-style-type:circle;\">\n     *      <li><b>display</b> - location of the legend. Possible values are \"none\", \"left\", \"right\", \"top\", and \"bottom\".</li>\n     *      <li><b>spacing</b> - an image URL. May be relative to the current document or absolute.</li>\n     *      <li><b>padding, border, background, font</b> - same options as described above.</li>\n     *  </ul></li>\n     * <li><b>dataTip</b> - An object defining the style of the data tip (tooltip).<br/>\n     *  <ul style=\"padding:5px;padding-left:26px;list-style-type:circle;\">\n     *      <li><b>padding, border, background, font</b> - same options as described above.</li>\n     *  </ul></li>\n     * <li><b>xAxis and yAxis</b> - An object defining the style of the style of either axis.<br/>\n     *  <ul style=\"padding:5px;padding-left:26px;list-style-type:circle;\">\n     *      <li><b>color</b> - same option as described above.</li>\n     *      <li><b>size</b> - same option as described above.</li>\n     *      <li><b>showLabels</b> - boolean</li>\n     *      <li><b>labelRotation</b> - a value in degrees from -90 through 90. Default is zero.</li>\n     *  </ul></li>\n     * <li><b>majorGridLines and minorGridLines</b> - An object defining the style of the style of the grid lines.<br/>\n     *  <ul style=\"padding:5px;padding-left:26px;list-style-type:circle;\">\n     *      <li><b>color, size</b> - same options as described above.</li>\n     *  </ul></li></li>\n     * <li><b>zeroGridLine</b> - An object defining the style of the style of the zero grid line.<br/>\n     *  <ul style=\"padding:5px;padding-left:26px;list-style-type:circle;\">\n     *      <li><b>color, size</b> - same options as described above.</li>\n     *  </ul></li></li>\n     * <li><b>majorTicks and minorTicks</b> - An object defining the style of the style of ticks in the chart.<br/>\n     *  <ul style=\"padding:5px;padding-left:26px;list-style-type:circle;\">\n     *      <li><b>color, size</b> - same options as described above.</li>\n     *      <li><b>length</b> - the length of each tick in pixels extending from the axis.</li>\n     *      <li><b>display</b> - how the ticks are drawn. Possible values are \"none\", \"inside\", \"outside\", and \"cross\".</li>\n     *  </ul></li></li>\n     * </ul>\n     */\n    extraStyle: null,\n\n    /**\n     * @cfg {Object} seriesStyles\n     * Contains styles to apply to the series after a refresh. Defaults to <tt>null</tt>.\n     */\n    seriesStyles: null,\n\n    /**\n     * @cfg {Boolean} disableCaching\n     * True to add a \"cache buster\" to the end of the chart url. Defaults to true for Opera and IE.\n     */\n    disableCaching: Ext.isIE || Ext.isOpera,\n    disableCacheParam: '_dc',\n\n    initComponent : function(){\n        Ext.chart.Chart.superclass.initComponent.call(this);\n        if(!this.url){\n            this.url = Ext.chart.Chart.CHART_URL;\n        }\n        if(this.disableCaching){\n            this.url = Ext.urlAppend(this.url, String.format('{0}={1}', this.disableCacheParam, new Date().getTime()));\n        }\n        this.addEvents(\n            'itemmouseover',\n            'itemmouseout',\n            'itemclick',\n            'itemdoubleclick',\n            'itemdragstart',\n            'itemdrag',\n            'itemdragend',\n            /**\n             * @event beforerefresh\n             * Fires before a refresh to the chart data is called.  If the beforerefresh handler returns\n             * <tt>false</tt> the {@link #refresh} action will be cancelled.\n             * @param {Chart} this\n             */\n            'beforerefresh',\n            /**\n             * @event refresh\n             * Fires after the chart data has been refreshed.\n             * @param {Chart} this\n             */\n            'refresh'\n        );\n        this.store = Ext.StoreMgr.lookup(this.store);\n    },\n\n    /**\n     * Sets a single style value on the Chart instance.\n     *\n     * @param name {String} Name of the Chart style value to change.\n     * @param value {Object} New value to pass to the Chart style.\n     */\n     setStyle: function(name, value){\n         this.swf.setStyle(name, Ext.encode(value));\n     },\n\n    /**\n     * Resets all styles on the Chart instance.\n     *\n     * @param styles {Object} Initializer for all Chart styles.\n     */\n    setStyles: function(styles){\n        this.swf.setStyles(Ext.encode(styles));\n    },\n\n    /**\n     * Sets the styles on all series in the Chart.\n     *\n     * @param styles {Array} Initializer for all Chart series styles.\n     */\n    setSeriesStyles: function(styles){\n        this.seriesStyles = styles;\n        var s = [];\n        Ext.each(styles, function(style){\n            s.push(Ext.encode(style));\n        });\n        this.swf.setSeriesStyles(s);\n    },\n\n    setCategoryNames : function(names){\n        this.swf.setCategoryNames(names);\n    },\n\n    setLegendRenderer : function(fn, scope){\n        var chart = this;\n        scope = scope || chart;\n        chart.removeFnProxy(chart.legendFnName);\n        chart.legendFnName = chart.createFnProxy(function(name){\n            return fn.call(scope, name);\n        });\n        chart.swf.setLegendLabelFunction(chart.legendFnName);\n    },\n\n    setTipRenderer : function(fn, scope){\n        var chart = this;\n        scope = scope || chart;\n        chart.removeFnProxy(chart.tipFnName);\n        chart.tipFnName = chart.createFnProxy(function(item, index, series){\n            var record = chart.store.getAt(index);\n            return fn.call(scope, chart, record, index, series);\n        });\n        chart.swf.setDataTipFunction(chart.tipFnName);\n    },\n\n    setSeries : function(series){\n        this.series = series;\n        this.refresh();\n    },\n\n    /**\n     * Changes the data store bound to this chart and refreshes it.\n     * @param {Store} store The store to bind to this chart\n     */\n    bindStore : function(store, initial){\n        if(!initial && this.store){\n            if(store !== this.store && this.store.autoDestroy){\n                this.store.destroy();\n            }else{\n                this.store.un(\"datachanged\", this.refresh, this);\n                this.store.un(\"add\", this.delayRefresh, this);\n                this.store.un(\"remove\", this.delayRefresh, this);\n                this.store.un(\"update\", this.delayRefresh, this);\n                this.store.un(\"clear\", this.refresh, this);\n            }\n        }\n        if(store){\n            store = Ext.StoreMgr.lookup(store);\n            store.on({\n                scope: this,\n                datachanged: this.refresh,\n                add: this.delayRefresh,\n                remove: this.delayRefresh,\n                update: this.delayRefresh,\n                clear: this.refresh\n            });\n        }\n        this.store = store;\n        if(store && !initial){\n            this.refresh();\n        }\n    },\n\n    onSwfReady : function(isReset){\n        Ext.chart.Chart.superclass.onSwfReady.call(this, isReset);\n        var ref;\n        this.swf.setType(this.type);\n\n        if(this.chartStyle){\n            this.setStyles(Ext.apply({}, this.extraStyle, this.chartStyle));\n        }\n\n        if(this.categoryNames){\n            this.setCategoryNames(this.categoryNames);\n        }\n\n        if(this.tipRenderer){\n            ref = this.getFunctionRef(this.tipRenderer);\n            this.setTipRenderer(ref.fn, ref.scope);\n        }\n        if(this.legendRenderer){\n            ref = this.getFunctionRef(this.legendRenderer);\n            this.setLegendRenderer(ref.fn, ref.scope);\n        }\n        if(!isReset){\n            this.bindStore(this.store, true);\n        }\n        this.refresh.defer(10, this);\n    },\n\n    delayRefresh : function(){\n        if(!this.refreshTask){\n            this.refreshTask = new Ext.util.DelayedTask(this.refresh, this);\n        }\n        this.refreshTask.delay(this.refreshBuffer);\n    },\n\n    refresh : function(){\n        if(this.fireEvent('beforerefresh', this) !== false){\n            var styleChanged = false;\n            // convert the store data into something YUI charts can understand\n            var data = [], rs = this.store.data.items;\n            for(var j = 0, len = rs.length; j < len; j++){\n                data[j] = rs[j].data;\n            }\n            //make a copy of the series definitions so that we aren't\n            //editing them directly.\n            var dataProvider = [];\n            var seriesCount = 0;\n            var currentSeries = null;\n            var i = 0;\n            if(this.series){\n                seriesCount = this.series.length;\n                for(i = 0; i < seriesCount; i++){\n                    currentSeries = this.series[i];\n                    var clonedSeries = {};\n                    for(var prop in currentSeries){\n                        if(prop == \"style\" && currentSeries.style !== null){\n                            clonedSeries.style = Ext.encode(currentSeries.style);\n                            styleChanged = true;\n                            //we don't want to modify the styles again next time\n                            //so null out the style property.\n                            // this causes issues\n                            // currentSeries.style = null;\n                        } else{\n                            clonedSeries[prop] = currentSeries[prop];\n                        }\n                    }\n                    dataProvider.push(clonedSeries);\n                }\n            }\n\n            if(seriesCount > 0){\n                for(i = 0; i < seriesCount; i++){\n                    currentSeries = dataProvider[i];\n                    if(!currentSeries.type){\n                        currentSeries.type = this.type;\n                    }\n                    currentSeries.dataProvider = data;\n                }\n            } else{\n                dataProvider.push({type: this.type, dataProvider: data});\n            }\n            this.swf.setDataProvider(dataProvider);\n            if(this.seriesStyles){\n                this.setSeriesStyles(this.seriesStyles);\n            }\n            this.fireEvent('refresh', this);\n        }\n    },\n\n    // private\n    createFnProxy : function(fn){\n        var fnName = 'extFnProxy' + (++Ext.chart.Chart.PROXY_FN_ID);\n        Ext.chart.Chart.proxyFunction[fnName] = fn;\n        return 'Ext.chart.Chart.proxyFunction.' + fnName;\n    },\n\n    // private\n    removeFnProxy : function(fn){\n        if(!Ext.isEmpty(fn)){\n            fn = fn.replace('Ext.chart.Chart.proxyFunction.', '');\n            delete Ext.chart.Chart.proxyFunction[fn];\n        }\n    },\n\n    // private\n    getFunctionRef : function(val){\n        if(Ext.isFunction(val)){\n            return {\n                fn: val,\n                scope: this\n            };\n        }else{\n            return {\n                fn: val.fn,\n                scope: val.scope || this\n            };\n        }\n    },\n\n    // private\n    onDestroy: function(){\n        if (this.refreshTask && this.refreshTask.cancel){\n            this.refreshTask.cancel();\n        }\n        Ext.chart.Chart.superclass.onDestroy.call(this);\n        this.bindStore(null);\n        this.removeFnProxy(this.tipFnName);\n        this.removeFnProxy(this.legendFnName);\n    }\n});\nExt.reg('chart', Ext.chart.Chart);\nExt.chart.Chart.PROXY_FN_ID = 0;\nExt.chart.Chart.proxyFunction = {};\n\n/**\n * Sets the url to load the chart from. This should be set to a local resource.\n * @static\n * @type String\n */\nExt.chart.Chart.CHART_URL = 'http:/' + '/yui.yahooapis.com/2.8.2/build/charts/assets/charts.swf';\n\n/**\n * @class Ext.chart.PieChart\n * @extends Ext.chart.Chart\n * @constructor\n * @xtype piechart\n */\nExt.chart.PieChart = Ext.extend(Ext.chart.Chart, {\n    type: 'pie',\n\n    onSwfReady : function(isReset){\n        Ext.chart.PieChart.superclass.onSwfReady.call(this, isReset);\n\n        this.setDataField(this.dataField);\n        this.setCategoryField(this.categoryField);\n    },\n\n    setDataField : function(field){\n        this.dataField = field;\n        this.swf.setDataField(field);\n    },\n\n    setCategoryField : function(field){\n        this.categoryField = field;\n        this.swf.setCategoryField(field);\n    }\n});\nExt.reg('piechart', Ext.chart.PieChart);\n\n/**\n * @class Ext.chart.CartesianChart\n * @extends Ext.chart.Chart\n * @constructor\n * @xtype cartesianchart\n */\nExt.chart.CartesianChart = Ext.extend(Ext.chart.Chart, {\n    onSwfReady : function(isReset){\n        Ext.chart.CartesianChart.superclass.onSwfReady.call(this, isReset);\n        this.labelFn = [];\n        if(this.xField){\n            this.setXField(this.xField);\n        }\n        if(this.yField){\n            this.setYField(this.yField);\n        }\n        if(this.xAxis){\n            this.setXAxis(this.xAxis);\n        }\n        if(this.xAxes){\n            this.setXAxes(this.xAxes);\n        }\n        if(this.yAxis){\n            this.setYAxis(this.yAxis);\n        }\n        if(this.yAxes){\n            this.setYAxes(this.yAxes);\n        }\n        if(Ext.isDefined(this.constrainViewport)){\n            this.swf.setConstrainViewport(this.constrainViewport);\n        }\n    },\n\n    setXField : function(value){\n        this.xField = value;\n        this.swf.setHorizontalField(value);\n    },\n\n    setYField : function(value){\n        this.yField = value;\n        this.swf.setVerticalField(value);\n    },\n\n    setXAxis : function(value){\n        this.xAxis = this.createAxis('xAxis', value);\n        this.swf.setHorizontalAxis(this.xAxis);\n    },\n\n    setXAxes : function(value){\n        var axis;\n        for(var i = 0; i < value.length; i++) {\n            axis = this.createAxis('xAxis' + i, value[i]);\n            this.swf.setHorizontalAxis(axis);\n        }\n    },\n\n    setYAxis : function(value){\n        this.yAxis = this.createAxis('yAxis', value);\n        this.swf.setVerticalAxis(this.yAxis);\n    },\n\n    setYAxes : function(value){\n        var axis;\n        for(var i = 0; i < value.length; i++) {\n            axis = this.createAxis('yAxis' + i, value[i]);\n            this.swf.setVerticalAxis(axis);\n        }\n    },\n\n    createAxis : function(axis, value){\n        var o = Ext.apply({}, value),\n            ref,\n            old;\n\n        if(this[axis]){\n            old = this[axis].labelFunction;\n            this.removeFnProxy(old);\n            this.labelFn.remove(old);\n        }\n        if(o.labelRenderer){\n            ref = this.getFunctionRef(o.labelRenderer);\n            o.labelFunction = this.createFnProxy(function(v){\n                return ref.fn.call(ref.scope, v);\n            });\n            delete o.labelRenderer;\n            this.labelFn.push(o.labelFunction);\n        }\n        if(axis.indexOf('xAxis') > -1 && o.position == 'left'){\n            o.position = 'bottom';\n        }\n        return o;\n    },\n\n    onDestroy : function(){\n        Ext.chart.CartesianChart.superclass.onDestroy.call(this);\n        Ext.each(this.labelFn, function(fn){\n            this.removeFnProxy(fn);\n        }, this);\n    }\n});\nExt.reg('cartesianchart', Ext.chart.CartesianChart);\n\n/**\n * @class Ext.chart.LineChart\n * @extends Ext.chart.CartesianChart\n * @constructor\n * @xtype linechart\n */\nExt.chart.LineChart = Ext.extend(Ext.chart.CartesianChart, {\n    type: 'line'\n});\nExt.reg('linechart', Ext.chart.LineChart);\n\n/**\n * @class Ext.chart.ColumnChart\n * @extends Ext.chart.CartesianChart\n * @constructor\n * @xtype columnchart\n */\nExt.chart.ColumnChart = Ext.extend(Ext.chart.CartesianChart, {\n    type: 'column'\n});\nExt.reg('columnchart', Ext.chart.ColumnChart);\n\n/**\n * @class Ext.chart.StackedColumnChart\n * @extends Ext.chart.CartesianChart\n * @constructor\n * @xtype stackedcolumnchart\n */\nExt.chart.StackedColumnChart = Ext.extend(Ext.chart.CartesianChart, {\n    type: 'stackcolumn'\n});\nExt.reg('stackedcolumnchart', Ext.chart.StackedColumnChart);\n\n/**\n * @class Ext.chart.BarChart\n * @extends Ext.chart.CartesianChart\n * @constructor\n * @xtype barchart\n */\nExt.chart.BarChart = Ext.extend(Ext.chart.CartesianChart, {\n    type: 'bar'\n});\nExt.reg('barchart', Ext.chart.BarChart);\n\n/**\n * @class Ext.chart.StackedBarChart\n * @extends Ext.chart.CartesianChart\n * @constructor\n * @xtype stackedbarchart\n */\nExt.chart.StackedBarChart = Ext.extend(Ext.chart.CartesianChart, {\n    type: 'stackbar'\n});\nExt.reg('stackedbarchart', Ext.chart.StackedBarChart);\n\n\n\n/**\n * @class Ext.chart.Axis\n * Defines a CartesianChart's vertical or horizontal axis.\n * @constructor\n */\nExt.chart.Axis = function(config){\n    Ext.apply(this, config);\n};\n\nExt.chart.Axis.prototype =\n{\n    /**\n     * The type of axis.\n     *\n     * @property type\n     * @type String\n     */\n    type: null,\n\n    /**\n     * The direction in which the axis is drawn. May be \"horizontal\" or \"vertical\".\n     *\n     * @property orientation\n     * @type String\n     */\n    orientation: \"horizontal\",\n\n    /**\n     * If true, the items on the axis will be drawn in opposite direction.\n     *\n     * @property reverse\n     * @type Boolean\n     */\n    reverse: false,\n\n    /**\n     * A string reference to the globally-accessible function that may be called to\n     * determine each of the label values for this axis.\n     *\n     * @property labelFunction\n     * @type String\n     */\n    labelFunction: null,\n\n    /**\n     * If true, labels that overlap previously drawn labels on the axis will be hidden.\n     *\n     * @property hideOverlappingLabels\n     * @type Boolean\n     */\n    hideOverlappingLabels: true,\n\n    /**\n     * The space, in pixels, between labels on an axis.\n     *\n     * @property labelSpacing\n     * @type Number\n     */\n    labelSpacing: 2\n};\n\n/**\n * @class Ext.chart.NumericAxis\n * @extends Ext.chart.Axis\n * A type of axis whose units are measured in numeric values.\n * @constructor\n */\nExt.chart.NumericAxis = Ext.extend(Ext.chart.Axis, {\n    type: \"numeric\",\n\n    /**\n     * The minimum value drawn by the axis. If not set explicitly, the axis\n     * minimum will be calculated automatically.\n     *\n     * @property minimum\n     * @type Number\n     */\n    minimum: NaN,\n\n    /**\n     * The maximum value drawn by the axis. If not set explicitly, the axis\n     * maximum will be calculated automatically.\n     *\n     * @property maximum\n     * @type Number\n     */\n    maximum: NaN,\n\n    /**\n     * The spacing between major intervals on this axis.\n     *\n     * @property majorUnit\n     * @type Number\n     */\n    majorUnit: NaN,\n\n    /**\n     * The spacing between minor intervals on this axis.\n     *\n     * @property minorUnit\n     * @type Number\n     */\n    minorUnit: NaN,\n\n    /**\n     * If true, the labels, ticks, gridlines, and other objects will snap to the\n     * nearest major or minor unit. If false, their position will be based on\n     * the minimum value.\n     *\n     * @property snapToUnits\n     * @type Boolean\n     */\n    snapToUnits: true,\n\n    /**\n     * If true, and the bounds are calculated automatically, either the minimum\n     * or maximum will be set to zero.\n     *\n     * @property alwaysShowZero\n     * @type Boolean\n     */\n    alwaysShowZero: true,\n\n    /**\n     * The scaling algorithm to use on this axis. May be \"linear\" or\n     * \"logarithmic\".\n     *\n     * @property scale\n     * @type String\n     */\n    scale: \"linear\",\n\n    /**\n     * Indicates whether to round the major unit.\n     *\n     * @property roundMajorUnit\n     * @type Boolean\n     */\n    roundMajorUnit: true,\n\n    /**\n     * Indicates whether to factor in the size of the labels when calculating a\n     * major unit.\n     *\n     * @property calculateByLabelSize\n     * @type Boolean\n     */\n    calculateByLabelSize: true,\n\n    /**\n     * Indicates the position of the axis relative to the chart\n     *\n     * @property position\n     * @type String\n     */\n    position: 'left',\n\n    /**\n     * Indicates whether to extend maximum beyond data's maximum to the nearest\n     * majorUnit.\n     *\n     * @property adjustMaximumByMajorUnit\n     * @type Boolean\n     */\n    adjustMaximumByMajorUnit: true,\n\n    /**\n     * Indicates whether to extend the minimum beyond data's minimum to the\n     * nearest majorUnit.\n     *\n     * @property adjustMinimumByMajorUnit\n     * @type Boolean\n     */\n    adjustMinimumByMajorUnit: true\n\n});\n\n/**\n * @class Ext.chart.TimeAxis\n * @extends Ext.chart.Axis\n * A type of axis whose units are measured in time-based values.\n * @constructor\n */\nExt.chart.TimeAxis = Ext.extend(Ext.chart.Axis, {\n    type: \"time\",\n\n    /**\n     * The minimum value drawn by the axis. If not set explicitly, the axis\n     * minimum will be calculated automatically.\n     *\n     * @property minimum\n     * @type Date\n     */\n    minimum: null,\n\n    /**\n     * The maximum value drawn by the axis. If not set explicitly, the axis\n     * maximum will be calculated automatically.\n     *\n     * @property maximum\n     * @type Number\n     */\n    maximum: null,\n\n    /**\n     * The spacing between major intervals on this axis.\n     *\n     * @property majorUnit\n     * @type Number\n     */\n    majorUnit: NaN,\n\n    /**\n     * The time unit used by the majorUnit.\n     *\n     * @property majorTimeUnit\n     * @type String\n     */\n    majorTimeUnit: null,\n\n    /**\n     * The spacing between minor intervals on this axis.\n     *\n     * @property minorUnit\n     * @type Number\n     */\n    minorUnit: NaN,\n\n    /**\n     * The time unit used by the minorUnit.\n     *\n     * @property minorTimeUnit\n     * @type String\n     */\n    minorTimeUnit: null,\n\n    /**\n     * If true, the labels, ticks, gridlines, and other objects will snap to the\n     * nearest major or minor unit. If false, their position will be based on\n     * the minimum value.\n     *\n     * @property snapToUnits\n     * @type Boolean\n     */\n    snapToUnits: true,\n\n    /**\n     * Series that are stackable will only stack when this value is set to true.\n     *\n     * @property stackingEnabled\n     * @type Boolean\n     */\n    stackingEnabled: false,\n\n    /**\n     * Indicates whether to factor in the size of the labels when calculating a\n     * major unit.\n     *\n     * @property calculateByLabelSize\n     * @type Boolean\n     */\n    calculateByLabelSize: true\n\n});\n\n/**\n * @class Ext.chart.CategoryAxis\n * @extends Ext.chart.Axis\n * A type of axis that displays items in categories.\n * @constructor\n */\nExt.chart.CategoryAxis = Ext.extend(Ext.chart.Axis, {\n    type: \"category\",\n\n    /**\n     * A list of category names to display along this axis.\n     *\n     * @property categoryNames\n     * @type Array\n     */\n    categoryNames: null,\n\n    /**\n     * Indicates whether or not to calculate the number of categories (ticks and\n     * labels) when there is not enough room to display all labels on the axis.\n     * If set to true, the axis will determine the number of categories to plot.\n     * If not, all categories will be plotted.\n     *\n     * @property calculateCategoryCount\n     * @type Boolean\n     */\n    calculateCategoryCount: false\n\n});\n\n/**\n * @class Ext.chart.Series\n * Series class for the charts widget.\n * @constructor\n */\nExt.chart.Series = function(config) { Ext.apply(this, config); };\n\nExt.chart.Series.prototype =\n{\n    /**\n     * The type of series.\n     *\n     * @property type\n     * @type String\n     */\n    type: null,\n\n    /**\n     * The human-readable name of the series.\n     *\n     * @property displayName\n     * @type String\n     */\n    displayName: null\n};\n\n/**\n * @class Ext.chart.CartesianSeries\n * @extends Ext.chart.Series\n * CartesianSeries class for the charts widget.\n * @constructor\n */\nExt.chart.CartesianSeries = Ext.extend(Ext.chart.Series, {\n    /**\n     * The field used to access the x-axis value from the items from the data\n     * source.\n     *\n     * @property xField\n     * @type String\n     */\n    xField: null,\n\n    /**\n     * The field used to access the y-axis value from the items from the data\n     * source.\n     *\n     * @property yField\n     * @type String\n     */\n    yField: null,\n\n    /**\n     * False to not show this series in the legend. Defaults to <tt>true</tt>.\n     *\n     * @property showInLegend\n     * @type Boolean\n     */\n    showInLegend: true,\n\n    /**\n     * Indicates which axis the series will bind to\n     *\n     * @property axis\n     * @type String\n     */\n    axis: 'primary'\n});\n\n/**\n * @class Ext.chart.ColumnSeries\n * @extends Ext.chart.CartesianSeries\n * ColumnSeries class for the charts widget.\n * @constructor\n */\nExt.chart.ColumnSeries = Ext.extend(Ext.chart.CartesianSeries, {\n    type: \"column\"\n});\n\n/**\n * @class Ext.chart.LineSeries\n * @extends Ext.chart.CartesianSeries\n * LineSeries class for the charts widget.\n * @constructor\n */\nExt.chart.LineSeries = Ext.extend(Ext.chart.CartesianSeries, {\n    type: \"line\"\n});\n\n/**\n * @class Ext.chart.BarSeries\n * @extends Ext.chart.CartesianSeries\n * BarSeries class for the charts widget.\n * @constructor\n */\nExt.chart.BarSeries = Ext.extend(Ext.chart.CartesianSeries, {\n    type: \"bar\"\n});\n\n\n/**\n * @class Ext.chart.PieSeries\n * @extends Ext.chart.Series\n * PieSeries class for the charts widget.\n * @constructor\n */\nExt.chart.PieSeries = Ext.extend(Ext.chart.Series, {\n    type: \"pie\",\n    dataField: null,\n    categoryField: null\n});/**\n * @class Ext.menu.Menu\n * @extends Ext.Container\n * <p>A menu object.  This is the container to which you may add menu items.  Menu can also serve as a base class\n * when you want a specialized menu based off of another component (like {@link Ext.menu.DateMenu} for example).</p>\n * <p>Menus may contain either {@link Ext.menu.Item menu items}, or general {@link Ext.Component Component}s.</p>\n * <p>To make a contained general {@link Ext.Component Component} line up with other {@link Ext.menu.Item menu items}\n * specify <tt>iconCls: 'no-icon'</tt>.  This reserves a space for an icon, and indents the Component in line\n * with the other menu items.  See {@link Ext.form.ComboBox}.{@link Ext.form.ComboBox#getListParent getListParent}\n * for an example.</p>\n * <p>By default, Menus are absolutely positioned, floating Components. By configuring a Menu with\n * <b><tt>{@link #floating}:false</tt></b>, a Menu may be used as child of a Container.</p>\n *\n * @xtype menu\n */\nExt.menu.Menu = Ext.extend(Ext.Container, {\n    /**\n     * @cfg {Object} defaults\n     * A config object that will be applied to all items added to this container either via the {@link #items}\n     * config or via the {@link #add} method.  The defaults config can contain any number of\n     * name/value property pairs to be added to each item, and should be valid for the types of items\n     * being added to the menu.\n     */\n    /**\n     * @cfg {Mixed} items\n     * An array of items to be added to this menu. Menus may contain either {@link Ext.menu.Item menu items},\n     * or general {@link Ext.Component Component}s.\n     */\n    /**\n     * @cfg {Number} minWidth The minimum width of the menu in pixels (defaults to 120)\n     */\n    minWidth : 120,\n    /**\n     * @cfg {Boolean/String} shadow True or 'sides' for the default effect, 'frame' for 4-way shadow, and 'drop'\n     * for bottom-right shadow (defaults to 'sides')\n     */\n    shadow : 'sides',\n    /**\n     * @cfg {String} subMenuAlign The {@link Ext.Element#alignTo} anchor position value to use for submenus of\n     * this menu (defaults to 'tl-tr?')\n     */\n    subMenuAlign : 'tl-tr?',\n    /**\n     * @cfg {String} defaultAlign The default {@link Ext.Element#alignTo} anchor position value for this menu\n     * relative to its element of origin (defaults to 'tl-bl?')\n     */\n    defaultAlign : 'tl-bl?',\n    /**\n     * @cfg {Boolean} allowOtherMenus True to allow multiple menus to be displayed at the same time (defaults to false)\n     */\n    allowOtherMenus : false,\n    /**\n     * @cfg {Boolean} ignoreParentClicks True to ignore clicks on any item in this menu that is a parent item (displays\n     * a submenu) so that the submenu is not dismissed when clicking the parent item (defaults to false).\n     */\n    ignoreParentClicks : false,\n    /**\n     * @cfg {Boolean} enableScrolling True to allow the menu container to have scroller controls if the menu is too long (defaults to true).\n     */\n    enableScrolling : true,\n    /**\n     * @cfg {Number} maxHeight The maximum height of the menu. Only applies when enableScrolling is set to True (defaults to null).\n     */\n    maxHeight : null,\n    /**\n     * @cfg {Number} scrollIncrement The amount to scroll the menu. Only applies when enableScrolling is set to True (defaults to 24).\n     */\n    scrollIncrement : 24,\n    /**\n     * @cfg {Boolean} showSeparator True to show the icon separator. (defaults to true).\n     */\n    showSeparator : true,\n    /**\n     * @cfg {Array} defaultOffsets An array specifying the [x, y] offset in pixels by which to\n     * change the default Menu popup position after aligning according to the {@link #defaultAlign}\n     * configuration. Defaults to <tt>[0, 0]</tt>.\n     */\n    defaultOffsets : [0, 0],\n\n    /**\n     * @cfg {Boolean} plain\n     * True to remove the incised line down the left side of the menu. Defaults to <tt>false</tt>.\n     */\n    plain : false,\n\n    /**\n     * @cfg {Boolean} floating\n     * <p>By default, a Menu configured as <b><code>floating:true</code></b>\n     * will be rendered as an {@link Ext.Layer} (an absolutely positioned,\n     * floating Component with zindex=15000).\n     * If configured as <b><code>floating:false</code></b>, the Menu may be\n     * used as child item of another Container instead of a free-floating\n     * {@link Ext.Layer Layer}.\n     */\n    floating : true,\n\n\n    /**\n     * @cfg {Number} zIndex\n     * zIndex to use when the menu is floating.\n     */\n    zIndex: 15000,\n\n    // private\n    hidden : true,\n\n    /**\n     * @cfg {String/Object} layout\n     * This class assigns a default layout (<code>layout:'<b>menu</b>'</code>).\n     * Developers <i>may</i> override this configuration option if another layout is required.\n     * See {@link Ext.Container#layout} for additional information.\n     */\n    layout : 'menu',\n    hideMode : 'offsets',    // Important for laying out Components\n    scrollerHeight : 8,\n    autoLayout : true,       // Provided for backwards compat\n    defaultType : 'menuitem',\n    bufferResize : false,\n\n    initComponent : function(){\n        if(Ext.isArray(this.initialConfig)){\n            Ext.apply(this, {items:this.initialConfig});\n        }\n        this.addEvents(\n            /**\n             * @event click\n             * Fires when this menu is clicked (or when the enter key is pressed while it is active)\n             * @param {Ext.menu.Menu} this\n            * @param {Ext.menu.Item} menuItem The menu item that was clicked\n             * @param {Ext.EventObject} e\n             */\n            'click',\n            /**\n             * @event mouseover\n             * Fires when the mouse is hovering over this menu\n             * @param {Ext.menu.Menu} this\n             * @param {Ext.EventObject} e\n             * @param {Ext.menu.Item} menuItem The menu item that was clicked\n             */\n            'mouseover',\n            /**\n             * @event mouseout\n             * Fires when the mouse exits this menu\n             * @param {Ext.menu.Menu} this\n             * @param {Ext.EventObject} e\n             * @param {Ext.menu.Item} menuItem The menu item that was clicked\n             */\n            'mouseout',\n            /**\n             * @event itemclick\n             * Fires when a menu item contained in this menu is clicked\n             * @param {Ext.menu.BaseItem} baseItem The BaseItem that was clicked\n             * @param {Ext.EventObject} e\n             */\n            'itemclick'\n        );\n        Ext.menu.MenuMgr.register(this);\n        if(this.floating){\n            Ext.EventManager.onWindowResize(this.hide, this);\n        }else{\n            if(this.initialConfig.hidden !== false){\n                this.hidden = false;\n            }\n            this.internalDefaults = {hideOnClick: false};\n        }\n        Ext.menu.Menu.superclass.initComponent.call(this);\n        if(this.autoLayout){\n            var fn = this.doLayout.createDelegate(this, []);\n            this.on({\n                add: fn,\n                remove: fn\n            });\n        }\n    },\n\n    //private\n    getLayoutTarget : function() {\n        return this.ul;\n    },\n\n    // private\n    onRender : function(ct, position){\n        if(!ct){\n            ct = Ext.getBody();\n        }\n\n        var dh = {\n            id: this.getId(),\n            cls: 'x-menu ' + ((this.floating) ? 'x-menu-floating x-layer ' : '') + (this.cls || '') + (this.plain ? ' x-menu-plain' : '') + (this.showSeparator ? '' : ' x-menu-nosep'),\n            style: this.style,\n            cn: [\n                {tag: 'a', cls: 'x-menu-focus', href: '#', onclick: 'return false;', tabIndex: '-1'},\n                {tag: 'ul', cls: 'x-menu-list'}\n            ]\n        };\n        if(this.floating){\n            this.el = new Ext.Layer({\n                shadow: this.shadow,\n                dh: dh,\n                constrain: false,\n                parentEl: ct,\n                zindex: this.zIndex\n            });\n        }else{\n            this.el = ct.createChild(dh);\n        }\n        Ext.menu.Menu.superclass.onRender.call(this, ct, position);\n\n        if(!this.keyNav){\n            this.keyNav = new Ext.menu.MenuNav(this);\n        }\n        // generic focus element\n        this.focusEl = this.el.child('a.x-menu-focus');\n        this.ul = this.el.child('ul.x-menu-list');\n        this.mon(this.ul, {\n            scope: this,\n            click: this.onClick,\n            mouseover: this.onMouseOver,\n            mouseout: this.onMouseOut\n        });\n        if(this.enableScrolling){\n            this.mon(this.el, {\n                scope: this,\n                delegate: '.x-menu-scroller',\n                click: this.onScroll,\n                mouseover: this.deactivateActive\n            });\n        }\n    },\n\n    // private\n    findTargetItem : function(e){\n        var t = e.getTarget('.x-menu-list-item', this.ul, true);\n        if(t && t.menuItemId){\n            return this.items.get(t.menuItemId);\n        }\n    },\n\n    // private\n    onClick : function(e){\n        var t = this.findTargetItem(e);\n        if(t){\n            if(t.isFormField){\n                this.setActiveItem(t);\n            }else if(t instanceof Ext.menu.BaseItem){\n                if(t.menu && this.ignoreParentClicks){\n                    t.expandMenu();\n                    e.preventDefault();\n                }else if(t.onClick){\n                    t.onClick(e);\n                    this.fireEvent('click', this, t, e);\n                }\n            }\n        }\n    },\n\n    // private\n    setActiveItem : function(item, autoExpand){\n        if(item != this.activeItem){\n            this.deactivateActive();\n            if((this.activeItem = item).isFormField){\n                item.focus();\n            }else{\n                item.activate(autoExpand);\n            }\n        }else if(autoExpand){\n            item.expandMenu();\n        }\n    },\n\n    deactivateActive : function(){\n        var a = this.activeItem;\n        if(a){\n            if(a.isFormField){\n                //Fields cannot deactivate, but Combos must collapse\n                if(a.collapse){\n                    a.collapse();\n                }\n            }else{\n                a.deactivate();\n            }\n            delete this.activeItem;\n        }\n    },\n\n    // private\n    tryActivate : function(start, step){\n        var items = this.items;\n        for(var i = start, len = items.length; i >= 0 && i < len; i+= step){\n            var item = items.get(i);\n            if(item.isVisible() && !item.disabled && (item.canActivate || item.isFormField)){\n                this.setActiveItem(item, false);\n                return item;\n            }\n        }\n        return false;\n    },\n\n    // private\n    onMouseOver : function(e){\n        var t = this.findTargetItem(e);\n        if(t){\n            if(t.canActivate && !t.disabled){\n                this.setActiveItem(t, true);\n            }\n        }\n        this.over = true;\n        this.fireEvent('mouseover', this, e, t);\n    },\n\n    // private\n    onMouseOut : function(e){\n        var t = this.findTargetItem(e);\n        if(t){\n            if(t == this.activeItem && t.shouldDeactivate && t.shouldDeactivate(e)){\n                this.activeItem.deactivate();\n                delete this.activeItem;\n            }\n        }\n        this.over = false;\n        this.fireEvent('mouseout', this, e, t);\n    },\n\n    // private\n    onScroll : function(e, t){\n        if(e){\n            e.stopEvent();\n        }\n        var ul = this.ul.dom, top = Ext.fly(t).is('.x-menu-scroller-top');\n        ul.scrollTop += this.scrollIncrement * (top ? -1 : 1);\n        if(top ? ul.scrollTop <= 0 : ul.scrollTop + this.activeMax >= ul.scrollHeight){\n           this.onScrollerOut(null, t);\n        }\n    },\n\n    // private\n    onScrollerIn : function(e, t){\n        var ul = this.ul.dom, top = Ext.fly(t).is('.x-menu-scroller-top');\n        if(top ? ul.scrollTop > 0 : ul.scrollTop + this.activeMax < ul.scrollHeight){\n            Ext.fly(t).addClass(['x-menu-item-active', 'x-menu-scroller-active']);\n        }\n    },\n\n    // private\n    onScrollerOut : function(e, t){\n        Ext.fly(t).removeClass(['x-menu-item-active', 'x-menu-scroller-active']);\n    },\n\n    /**\n     * If <code>{@link #floating}=true</code>, shows this menu relative to\n     * another element using {@link #showat}, otherwise uses {@link Ext.Component#show}.\n     * @param {Mixed} element The element to align to\n     * @param {String} position (optional) The {@link Ext.Element#alignTo} anchor position to use in aligning to\n     * the element (defaults to this.defaultAlign)\n     * @param {Ext.menu.Menu} parentMenu (optional) This menu's parent menu, if applicable (defaults to undefined)\n     */\n    show : function(el, pos, parentMenu){\n        if(this.floating){\n            this.parentMenu = parentMenu;\n            if(!this.el){\n                this.render();\n                this.doLayout(false, true);\n            }\n            this.showAt(this.el.getAlignToXY(el, pos || this.defaultAlign, this.defaultOffsets), parentMenu);\n        }else{\n            Ext.menu.Menu.superclass.show.call(this);\n        }\n    },\n\n    /**\n     * Displays this menu at a specific xy position and fires the 'show' event if a\n     * handler for the 'beforeshow' event does not return false cancelling the operation.\n     * @param {Array} xyPosition Contains X & Y [x, y] values for the position at which to show the menu (coordinates are page-based)\n     * @param {Ext.menu.Menu} parentMenu (optional) This menu's parent menu, if applicable (defaults to undefined)\n     */\n    showAt : function(xy, parentMenu){\n        if(this.fireEvent('beforeshow', this) !== false){\n            this.parentMenu = parentMenu;\n            if(!this.el){\n                this.render();\n            }\n            if(this.enableScrolling){\n                // set the position so we can figure out the constrain value.\n                this.el.setXY(xy);\n                //constrain the value, keep the y coordinate the same\n                xy[1] = this.constrainScroll(xy[1]);\n                xy = [this.el.adjustForConstraints(xy)[0], xy[1]];\n            }else{\n                //constrain to the viewport.\n                xy = this.el.adjustForConstraints(xy);\n            }\n            this.el.setXY(xy);\n            this.el.show();\n            Ext.menu.Menu.superclass.onShow.call(this);\n            if(Ext.isIE9m){\n                // internal event, used so we don't couple the layout to the menu\n                this.fireEvent('autosize', this);\n                if(!Ext.isIE8){\n                    this.el.repaint();\n                }\n            }\n            this.hidden = false;\n            this.focus();\n            this.fireEvent('show', this);\n        }\n    },\n\n    constrainScroll : function(y){\n        var max, full = this.ul.setHeight('auto').getHeight(),\n            returnY = y, normalY, parentEl, scrollTop, viewHeight;\n        if(this.floating){\n            parentEl = Ext.fly(this.el.dom.parentNode);\n            scrollTop = parentEl.getScroll().top;\n            viewHeight = parentEl.getViewSize().height;\n            //Normalize y by the scroll position for the parent element.  Need to move it into the coordinate space\n            //of the view.\n            normalY = y - scrollTop;\n            max = this.maxHeight ? this.maxHeight : viewHeight - normalY;\n            if(full > viewHeight) {\n                max = viewHeight;\n                //Set returnY equal to (0,0) in view space by reducing y by the value of normalY\n                returnY = y - normalY;\n            } else if(max < full) {\n                returnY = y - (full - max);\n                max = full;\n            }\n        }else{\n            max = this.getHeight();\n        }\n        // Always respect maxHeight \n        if (this.maxHeight){\n            max = Math.min(this.maxHeight, max);\n        }\n        if(full > max && max > 0){\n            this.activeMax = max - this.scrollerHeight * 2 - this.el.getFrameWidth('tb') - Ext.num(this.el.shadowOffset, 0);\n            this.ul.setHeight(this.activeMax);\n            this.createScrollers();\n            this.el.select('.x-menu-scroller').setDisplayed('');\n        }else{\n            this.ul.setHeight(full);\n            this.el.select('.x-menu-scroller').setDisplayed('none');\n        }\n        this.ul.dom.scrollTop = 0;\n        return returnY;\n    },\n\n    createScrollers : function(){\n        if(!this.scroller){\n            this.scroller = {\n                pos: 0,\n                top: this.el.insertFirst({\n                    tag: 'div',\n                    cls: 'x-menu-scroller x-menu-scroller-top',\n                    html: '&#160;'\n                }),\n                bottom: this.el.createChild({\n                    tag: 'div',\n                    cls: 'x-menu-scroller x-menu-scroller-bottom',\n                    html: '&#160;'\n                })\n            };\n            this.scroller.top.hover(this.onScrollerIn, this.onScrollerOut, this);\n            this.scroller.topRepeater = new Ext.util.ClickRepeater(this.scroller.top, {\n                listeners: {\n                    click: this.onScroll.createDelegate(this, [null, this.scroller.top], false)\n                }\n            });\n            this.scroller.bottom.hover(this.onScrollerIn, this.onScrollerOut, this);\n            this.scroller.bottomRepeater = new Ext.util.ClickRepeater(this.scroller.bottom, {\n                listeners: {\n                    click: this.onScroll.createDelegate(this, [null, this.scroller.bottom], false)\n                }\n            });\n        }\n    },\n\n    onLayout : function(){\n        if(this.isVisible()){\n            if(this.enableScrolling){\n                this.constrainScroll(this.el.getTop());\n            }\n            if(this.floating){\n                this.el.sync();\n            }\n        }\n    },\n\n    focus : function(){\n        if(!this.hidden){\n            this.doFocus.defer(50, this);\n        }\n    },\n\n    doFocus : function(){\n        if(!this.hidden){\n            this.focusEl.focus();\n        }\n    },\n\n    /**\n     * Hides this menu and optionally all parent menus\n     * @param {Boolean} deep (optional) True to hide all parent menus recursively, if any (defaults to false)\n     */\n    hide : function(deep){\n        if (!this.isDestroyed) {\n            this.deepHide = deep;\n            Ext.menu.Menu.superclass.hide.call(this);\n            delete this.deepHide;\n        }\n    },\n\n    // private\n    onHide : function(){\n        Ext.menu.Menu.superclass.onHide.call(this);\n        this.deactivateActive();\n        if(this.el && this.floating){\n            this.el.hide();\n        }\n        var pm = this.parentMenu;\n        if(this.deepHide === true && pm){\n            if(pm.floating){\n                pm.hide(true);\n            }else{\n                pm.deactivateActive();\n            }\n        }\n    },\n\n    // private\n    lookupComponent : function(c){\n         if(Ext.isString(c)){\n            c = (c == 'separator' || c == '-') ? new Ext.menu.Separator() : new Ext.menu.TextItem(c);\n             this.applyDefaults(c);\n         }else{\n            if(Ext.isObject(c)){\n                c = this.getMenuItem(c);\n            }else if(c.tagName || c.el){ // element. Wrap it.\n                c = new Ext.BoxComponent({\n                    el: c\n                });\n            }\n         }\n         return c;\n    },\n\n    applyDefaults : function(c) {\n        if (!Ext.isString(c)) {\n            c = Ext.menu.Menu.superclass.applyDefaults.call(this, c);\n            var d = this.internalDefaults;\n            if(d){\n                if(c.events){\n                    Ext.applyIf(c.initialConfig, d);\n                    Ext.apply(c, d);\n                }else{\n                    Ext.applyIf(c, d);\n                }\n            }\n        }\n        return c;\n    },\n\n    // private\n    getMenuItem : function(config) {\n        config.ownerCt = this;\n        \n        if (!config.isXType) {\n            if (!config.xtype && Ext.isBoolean(config.checked)) {\n                return new Ext.menu.CheckItem(config);\n            }\n            return Ext.create(config, this.defaultType);\n        }\n        return config;\n    },\n\n    /**\n     * Adds a separator bar to the menu\n     * @return {Ext.menu.Item} The menu item that was added\n     */\n    addSeparator : function() {\n        return this.add(new Ext.menu.Separator());\n    },\n\n    /**\n     * Adds an {@link Ext.Element} object to the menu\n     * @param {Mixed} el The element or DOM node to add, or its id\n     * @return {Ext.menu.Item} The menu item that was added\n     */\n    addElement : function(el) {\n        return this.add(new Ext.menu.BaseItem({\n            el: el\n        }));\n    },\n\n    /**\n     * Adds an existing object based on {@link Ext.menu.BaseItem} to the menu\n     * @param {Ext.menu.Item} item The menu item to add\n     * @return {Ext.menu.Item} The menu item that was added\n     */\n    addItem : function(item) {\n        return this.add(item);\n    },\n\n    /**\n     * Creates a new {@link Ext.menu.Item} based an the supplied config object and adds it to the menu\n     * @param {Object} config A MenuItem config object\n     * @return {Ext.menu.Item} The menu item that was added\n     */\n    addMenuItem : function(config) {\n        return this.add(this.getMenuItem(config));\n    },\n\n    /**\n     * Creates a new {@link Ext.menu.TextItem} with the supplied text and adds it to the menu\n     * @param {String} text The text to display in the menu item\n     * @return {Ext.menu.Item} The menu item that was added\n     */\n    addText : function(text){\n        return this.add(new Ext.menu.TextItem(text));\n    },\n\n    //private\n    onDestroy : function(){\n        Ext.EventManager.removeResizeListener(this.hide, this);\n        var pm = this.parentMenu;\n        if(pm && pm.activeChild == this){\n            delete pm.activeChild;\n        }\n        delete this.parentMenu;\n        Ext.menu.Menu.superclass.onDestroy.call(this);\n        Ext.menu.MenuMgr.unregister(this);\n        if(this.keyNav) {\n            this.keyNav.disable();\n        }\n        var s = this.scroller;\n        if(s){\n            Ext.destroy(s.topRepeater, s.bottomRepeater, s.top, s.bottom);\n        }\n        Ext.destroy(\n            this.el,\n            this.focusEl,\n            this.ul\n        );\n    }\n});\n\nExt.reg('menu', Ext.menu.Menu);\n\n// MenuNav is a private utility class used internally by the Menu\nExt.menu.MenuNav = Ext.extend(Ext.KeyNav, function(){\n    function up(e, m){\n        if(!m.tryActivate(m.items.indexOf(m.activeItem)-1, -1)){\n            m.tryActivate(m.items.length-1, -1);\n        }\n    }\n    function down(e, m){\n        if(!m.tryActivate(m.items.indexOf(m.activeItem)+1, 1)){\n            m.tryActivate(0, 1);\n        }\n    }\n    return {\n        constructor : function(menu){\n            Ext.menu.MenuNav.superclass.constructor.call(this, menu.el);\n            this.scope = this.menu = menu;\n        },\n\n        doRelay : function(e, h){\n            var k = e.getKey();\n//          Keystrokes within a form Field (e.g.: down in a Combo) do not navigate. Allow only TAB\n            if (this.menu.activeItem && this.menu.activeItem.isFormField && k != e.TAB) {\n                return false;\n            }\n            if(!this.menu.activeItem && e.isNavKeyPress() && k != e.SPACE && k != e.RETURN){\n                this.menu.tryActivate(0, 1);\n                return false;\n            }\n            return h.call(this.scope || this, e, this.menu);\n        },\n\n        tab: function(e, m) {\n            e.stopEvent();\n            if (e.shiftKey) {\n                up(e, m);\n            } else {\n                down(e, m);\n            }\n        },\n\n        up : up,\n\n        down : down,\n\n        right : function(e, m){\n            if(m.activeItem){\n                m.activeItem.expandMenu(true);\n            }\n        },\n\n        left : function(e, m){\n            m.hide();\n            if(m.parentMenu && m.parentMenu.activeItem){\n                m.parentMenu.activeItem.activate();\n            }\n        },\n\n        enter : function(e, m){\n            if(m.activeItem){\n                e.stopPropagation();\n                m.activeItem.onClick(e);\n                m.fireEvent('click', this, m.activeItem);\n                return true;\n            }\n        }\n    };\n}());\n/**\n * @class Ext.menu.MenuMgr\n * Provides a common registry of all menu items on a page so that they can be easily accessed by id.\n * @singleton\n */\nExt.menu.MenuMgr = function(){\n   var menus, \n       active, \n       map,\n       groups = {}, \n       attached = false, \n       lastShow = new Date();\n   \n\n   // private - called when first menu is created\n   function init(){\n       menus = {};\n       active = new Ext.util.MixedCollection();\n       map = Ext.getDoc().addKeyListener(27, hideAll);\n       map.disable();\n   }\n\n   // private\n   function hideAll(){\n       if(active && active.length > 0){\n           var c = active.clone();\n           c.each(function(m){\n               m.hide();\n           });\n           return true;\n       }\n       return false;\n   }\n\n   // private\n   function onHide(m){\n       active.remove(m);\n       if(active.length < 1){\n           map.disable();\n           Ext.getDoc().un(\"mousedown\", onMouseDown);\n           attached = false;\n       }\n   }\n\n   // private\n   function onShow(m){\n       var last = active.last();\n       lastShow = new Date();\n       active.add(m);\n       if(!attached){\n           map.enable();\n           Ext.getDoc().on(\"mousedown\", onMouseDown);\n           attached = true;\n       }\n       if(m.parentMenu){\n          m.getEl().setZIndex(parseInt(m.parentMenu.getEl().getStyle(\"z-index\"), 10) + 3);\n          m.parentMenu.activeChild = m;\n       }else if(last && !last.isDestroyed && last.isVisible()){\n          m.getEl().setZIndex(parseInt(last.getEl().getStyle(\"z-index\"), 10) + 3);\n       }\n   }\n\n   // private\n   function onBeforeHide(m){\n       if(m.activeChild){\n           m.activeChild.hide();\n       }\n       if(m.autoHideTimer){\n           clearTimeout(m.autoHideTimer);\n           delete m.autoHideTimer;\n       }\n   }\n\n   // private\n   function onBeforeShow(m){\n       var pm = m.parentMenu;\n       if(!pm && !m.allowOtherMenus){\n           hideAll();\n       }else if(pm && pm.activeChild){\n           pm.activeChild.hide();\n       }\n   }\n\n   // private\n   function onMouseDown(e){\n       if(lastShow.getElapsed() > 50 && active.length > 0 && !e.getTarget(\".x-menu\")){\n           hideAll();\n       }\n   }\n\n   return {\n\n       /**\n        * Hides all menus that are currently visible\n        * @return {Boolean} success True if any active menus were hidden.\n        */\n       hideAll : function(){\n            return hideAll();\n       },\n\n       // private\n       register : function(menu){\n           if(!menus){\n               init();\n           }\n           menus[menu.id] = menu;\n           menu.on({\n               beforehide: onBeforeHide,\n               hide: onHide,\n               beforeshow: onBeforeShow,\n               show: onShow\n           });\n       },\n\n        /**\n         * Returns a {@link Ext.menu.Menu} object\n         * @param {String/Object} menu The string menu id, an existing menu object reference, or a Menu config that will\n         * be used to generate and return a new Menu instance.\n         * @return {Ext.menu.Menu} The specified menu, or null if none are found\n         */\n       get : function(menu){\n           if(typeof menu == \"string\"){ // menu id\n               if(!menus){  // not initialized, no menus to return\n                   return null;\n               }\n               return menus[menu];\n           }else if(menu.events){  // menu instance\n               return menu;\n           }else if(typeof menu.length == 'number'){ // array of menu items?\n               return new Ext.menu.Menu({items:menu});\n           }else{ // otherwise, must be a config\n               return Ext.create(menu, 'menu');\n           }\n       },\n\n       // private\n       unregister : function(menu){\n           delete menus[menu.id];\n           menu.un(\"beforehide\", onBeforeHide);\n           menu.un(\"hide\", onHide);\n           menu.un(\"beforeshow\", onBeforeShow);\n           menu.un(\"show\", onShow);\n       },\n\n       // private\n       registerCheckable : function(menuItem){\n           var g = menuItem.group;\n           if(g){\n               if(!groups[g]){\n                   groups[g] = [];\n               }\n               groups[g].push(menuItem);\n           }\n       },\n\n       // private\n       unregisterCheckable : function(menuItem){\n           var g = menuItem.group;\n           if(g){\n               groups[g].remove(menuItem);\n           }\n       },\n       \n       // private\n       onCheckChange: function(item, state){\n           if(item.group && state){\n               var group = groups[item.group],\n                   i = 0,\n                   len = group.length,\n                   current;\n                   \n               for(; i < len; i++){\n                   current = group[i];\n                   if(current != item){\n                       current.setChecked(false);\n                   }\n               }\n           }\n       },\n\n       getCheckedItem : function(groupId){\n           var g = groups[groupId];\n           if(g){\n               for(var i = 0, l = g.length; i < l; i++){\n                   if(g[i].checked){\n                       return g[i];\n                   }\n               }\n           }\n           return null;\n       },\n\n       setCheckedItem : function(groupId, itemId){\n           var g = groups[groupId];\n           if(g){\n               for(var i = 0, l = g.length; i < l; i++){\n                   if(g[i].id == itemId){\n                       g[i].setChecked(true);\n                   }\n               }\n           }\n           return null;\n       }\n   };\n}();\n/**\n * @class Ext.menu.BaseItem\n * @extends Ext.Component\n * The base class for all items that render into menus.  BaseItem provides default rendering, activated state\n * management and base configuration options shared by all menu components.\n * @constructor\n * Creates a new BaseItem\n * @param {Object} config Configuration options\n * @xtype menubaseitem\n */\nExt.menu.BaseItem = Ext.extend(Ext.Component, {\n    /**\n     * @property parentMenu\n     * @type Ext.menu.Menu\n     * The parent Menu of this Item.\n     */\n    /**\n     * @cfg {Function} handler\n     * A function that will handle the click event of this menu item (optional).\n     * The handler is passed the following parameters:<div class=\"mdetail-params\"><ul>\n     * <li><code>b</code> : Item<div class=\"sub-desc\">This menu Item.</div></li>\n     * <li><code>e</code> : EventObject<div class=\"sub-desc\">The click event.</div></li>\n     * </ul></div>\n     */\n    /**\n     * @cfg {Object} scope\n     * The scope (<tt><b>this</b></tt> reference) in which the handler function will be called.\n     */\n    /**\n     * @cfg {Boolean} canActivate True if this item can be visually activated (defaults to false)\n     */\n    canActivate : false,\n    /**\n     * @cfg {String} activeClass The CSS class to use when the item becomes activated (defaults to \"x-menu-item-active\")\n     */\n    activeClass : \"x-menu-item-active\",\n    /**\n     * @cfg {Boolean} hideOnClick True to hide the containing menu after this item is clicked (defaults to true)\n     */\n    hideOnClick : true,\n    /**\n     * @cfg {Number} clickHideDelay Length of time in milliseconds to wait before hiding after a click (defaults to 1)\n     */\n    clickHideDelay : 1,\n\n    // private\n    ctype : \"Ext.menu.BaseItem\",\n\n    // private\n    actionMode : \"container\",\n\n    initComponent : function(){\n        Ext.menu.BaseItem.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event click\n             * Fires when this item is clicked\n             * @param {Ext.menu.BaseItem} this\n             * @param {Ext.EventObject} e\n             */\n            'click',\n            /**\n             * @event activate\n             * Fires when this item is activated\n             * @param {Ext.menu.BaseItem} this\n             */\n            'activate',\n            /**\n             * @event deactivate\n             * Fires when this item is deactivated\n             * @param {Ext.menu.BaseItem} this\n             */\n            'deactivate'\n        );\n        if(this.handler){\n            this.on(\"click\", this.handler, this.scope);\n        }\n    },\n\n    // private\n    onRender : function(container, position){\n        Ext.menu.BaseItem.superclass.onRender.apply(this, arguments);\n        if(this.ownerCt && this.ownerCt instanceof Ext.menu.Menu){\n            this.parentMenu = this.ownerCt;\n        }else{\n            this.container.addClass('x-menu-list-item');\n            this.mon(this.el, {\n                scope: this,\n                click: this.onClick,\n                mouseenter: this.activate,\n                mouseleave: this.deactivate\n            });\n        }\n    },\n\n    /**\n     * Sets the function that will handle click events for this item (equivalent to passing in the {@link #handler}\n     * config property).  If an existing handler is already registered, it will be unregistered for you.\n     * @param {Function} handler The function that should be called on click\n     * @param {Object} scope The scope (<code>this</code> reference) in which the handler function is executed. Defaults to this menu item.\n     */\n    setHandler : function(handler, scope){\n        if(this.handler){\n            this.un(\"click\", this.handler, this.scope);\n        }\n        this.on(\"click\", this.handler = handler, this.scope = scope);\n    },\n\n    // private\n    onClick : function(e){\n        if(!this.disabled && this.fireEvent(\"click\", this, e) !== false\n                && (this.parentMenu && this.parentMenu.fireEvent(\"itemclick\", this, e) !== false)){\n            this.handleClick(e);\n        }else{\n            e.stopEvent();\n        }\n    },\n\n    // private\n    activate : function(){\n        if(this.disabled){\n            return false;\n        }\n        var li = this.container;\n        li.addClass(this.activeClass);\n        this.region = li.getRegion().adjust(2, 2, -2, -2);\n        this.fireEvent(\"activate\", this);\n        return true;\n    },\n\n    // private\n    deactivate : function(){\n        this.container.removeClass(this.activeClass);\n        this.fireEvent(\"deactivate\", this);\n    },\n\n    // private\n    shouldDeactivate : function(e){\n        return !this.region || !this.region.contains(e.getPoint());\n    },\n\n    // private\n    handleClick : function(e){\n        var pm = this.parentMenu;\n        if(this.hideOnClick){\n            if(pm.floating){\n                this.clickHideDelayTimer = pm.hide.defer(this.clickHideDelay, pm, [true]);\n            }else{\n                pm.deactivateActive();\n            }\n        }\n    },\n    \n    beforeDestroy: function(){\n        clearTimeout(this.clickHideDelayTimer);\n        Ext.menu.BaseItem.superclass.beforeDestroy.call(this);    \n    },\n\n    // private. Do nothing\n    expandMenu : Ext.emptyFn,\n\n    // private. Do nothing\n    hideMenu : Ext.emptyFn\n});\nExt.reg('menubaseitem', Ext.menu.BaseItem);/**\n * @class Ext.menu.TextItem\n * @extends Ext.menu.BaseItem\n * Adds a static text string to a menu, usually used as either a heading or group separator.\n * @constructor\n * Creates a new TextItem\n * @param {Object/String} config If config is a string, it is used as the text to display, otherwise it\n * is applied as a config object (and should contain a <tt>text</tt> property).\n * @xtype menutextitem\n */\nExt.menu.TextItem = Ext.extend(Ext.menu.BaseItem, {\n    /**\n     * @cfg {String} text The text to display for this item (defaults to '')\n     */\n    /**\n     * @cfg {Boolean} hideOnClick True to hide the containing menu after this item is clicked (defaults to false)\n     */\n    hideOnClick : false,\n    /**\n     * @cfg {String} itemCls The default CSS class to use for text items (defaults to \"x-menu-text\")\n     */\n    itemCls : \"x-menu-text\",\n    \n    constructor : function(config) {\n        if (typeof config == 'string') {\n            config = {\n                text: config\n            };\n        }\n        Ext.menu.TextItem.superclass.constructor.call(this, config);\n    },\n\n    // private\n    onRender : function() {\n        var s = document.createElement(\"span\");\n        s.className = this.itemCls;\n        s.innerHTML = this.text;\n        this.el = s;\n        Ext.menu.TextItem.superclass.onRender.apply(this, arguments);\n    }\n});\nExt.reg('menutextitem', Ext.menu.TextItem);/**\n * @class Ext.menu.Separator\n * @extends Ext.menu.BaseItem\n * Adds a separator bar to a menu, used to divide logical groups of menu items. Generally you will\n * add one of these by using \"-\" in you call to add() or in your items config rather than creating one directly.\n * @constructor\n * @param {Object} config Configuration options\n * @xtype menuseparator\n */\nExt.menu.Separator = Ext.extend(Ext.menu.BaseItem, {\n    /**\n     * @cfg {String} itemCls The default CSS class to use for separators (defaults to \"x-menu-sep\")\n     */\n    itemCls : \"x-menu-sep\",\n    /**\n     * @cfg {Boolean} hideOnClick True to hide the containing menu after this item is clicked (defaults to false)\n     */\n    hideOnClick : false,\n    \n    /** \n     * @cfg {String} activeClass\n     * @hide \n     */\n    activeClass: '',\n\n    // private\n    onRender : function(li){\n        var s = document.createElement(\"span\");\n        s.className = this.itemCls;\n        s.innerHTML = \"&#160;\";\n        this.el = s;\n        li.addClass(\"x-menu-sep-li\");\n        Ext.menu.Separator.superclass.onRender.apply(this, arguments);\n    }\n});\nExt.reg('menuseparator', Ext.menu.Separator);/**\n * @class Ext.menu.Item\n * @extends Ext.menu.BaseItem\n * A base class for all menu items that require menu-related functionality (like sub-menus) and are not static\n * display items.  Item extends the base functionality of {@link Ext.menu.BaseItem} by adding menu-specific\n * activation and click handling.\n * @constructor\n * Creates a new Item\n * @param {Object} config Configuration options\n * @xtype menuitem\n */\nExt.menu.Item = Ext.extend(Ext.menu.BaseItem, {\n    /**\n     * @property menu\n     * @type Ext.menu.Menu\n     * The submenu associated with this Item if one was configured.\n     */\n    /**\n     * @cfg {Mixed} menu (optional) Either an instance of {@link Ext.menu.Menu} or the config object for an\n     * {@link Ext.menu.Menu} which acts as the submenu when this item is activated.\n     */\n    /**\n     * @cfg {String} icon The path to an icon to display in this item (defaults to Ext.BLANK_IMAGE_URL).  If\n     * icon is specified {@link #iconCls} should not be.\n     */\n    /**\n     * @cfg {String} iconCls A CSS class that specifies a background image that will be used as the icon for\n     * this item (defaults to '').  If iconCls is specified {@link #icon} should not be.\n     */\n    /**\n     * @cfg {String} text The text to display in this item (defaults to '').\n     */\n    /**\n     * @cfg {String} href The href attribute to use for the underlying anchor link (defaults to '#').\n     */\n    /**\n     * @cfg {String} hrefTarget The target attribute to use for the underlying anchor link (defaults to '').\n     */\n    /**\n     * @cfg {String} itemCls The default CSS class to use for menu items (defaults to 'x-menu-item')\n     */\n    itemCls : 'x-menu-item',\n    /**\n     * @cfg {Boolean} canActivate True if this item can be visually activated (defaults to true)\n     */\n    canActivate : true,\n    /**\n     * @cfg {Number} showDelay Length of time in milliseconds to wait before showing this item (defaults to 200)\n     */\n    showDelay: 200,\n    \n    /**\n     * @cfg {String} altText The altText to use for the icon, if it exists. Defaults to <tt>''</tt>.\n     */\n    altText: '',\n    \n    // doc'd in BaseItem\n    hideDelay: 200,\n\n    // private\n    ctype: 'Ext.menu.Item',\n\n    initComponent : function(){\n        Ext.menu.Item.superclass.initComponent.call(this);\n        if(this.menu){\n            // If array of items, turn it into an object config so we\n            // can set the ownerCt property in the config\n            if (Ext.isArray(this.menu)){\n                this.menu = { items: this.menu };\n            }\n            \n            // An object config will work here, but an instance of a menu\n            // will have already setup its ref's and have no effect\n            if (Ext.isObject(this.menu)){\n                this.menu.ownerCt = this;\n            }\n            \n            this.menu = Ext.menu.MenuMgr.get(this.menu);\n            this.menu.ownerCt = undefined;\n        }\n    },\n\n    // private\n    onRender : function(container, position){\n        if (!this.itemTpl) {\n            this.itemTpl = Ext.menu.Item.prototype.itemTpl = new Ext.XTemplate(\n                '<a id=\"{id}\" class=\"{cls} x-unselectable\" hidefocus=\"true\" unselectable=\"on\" href=\"{href}\"',\n                    '<tpl if=\"hrefTarget\">',\n                        ' target=\"{hrefTarget}\"',\n                    '</tpl>',\n                 '>',\n                     '<img alt=\"{altText}\" src=\"{icon}\" class=\"x-menu-item-icon {iconCls}\"/>',\n                     '<span class=\"x-menu-item-text\">{text}</span>',\n                 '</a>'\n             );\n        }\n        var a = this.getTemplateArgs();\n        this.el = position ? this.itemTpl.insertBefore(position, a, true) : this.itemTpl.append(container, a, true);\n        this.iconEl = this.el.child('img.x-menu-item-icon');\n        this.textEl = this.el.child('.x-menu-item-text');\n        if(!this.href) { // if no link defined, prevent the default anchor event\n            this.mon(this.el, 'click', Ext.emptyFn, null, { preventDefault: true });\n        }\n        Ext.menu.Item.superclass.onRender.call(this, container, position);\n    },\n\n    getTemplateArgs: function() {\n        return {\n            id: this.id,\n            cls: this.itemCls + (this.menu ?  ' x-menu-item-arrow' : '') + (this.cls ?  ' ' + this.cls : ''),\n            href: this.href || '#',\n            hrefTarget: this.hrefTarget,\n            icon: this.icon || Ext.BLANK_IMAGE_URL,\n            iconCls: this.iconCls || '',\n            text: this.itemText||this.text||'&#160;',\n            altText: this.altText || ''\n        };\n    },\n\n    /**\n     * Sets the text to display in this menu item\n     * @param {String} text The text to display\n     */\n    setText : function(text){\n        this.text = text||'&#160;';\n        if(this.rendered){\n            this.textEl.update(this.text);\n            this.parentMenu.layout.doAutoSize();\n        }\n    },\n\n    /**\n     * Sets the CSS class to apply to the item's icon element\n     * @param {String} cls The CSS class to apply\n     */\n    setIconClass : function(cls){\n        var oldCls = this.iconCls;\n        this.iconCls = cls;\n        if(this.rendered){\n            this.iconEl.replaceClass(oldCls, this.iconCls);\n        }\n    },\n\n    //private\n    beforeDestroy: function(){\n        clearTimeout(this.showTimer);\n        clearTimeout(this.hideTimer);\n        if (this.menu){\n            delete this.menu.ownerCt;\n            this.menu.destroy();\n        }\n        Ext.menu.Item.superclass.beforeDestroy.call(this);\n    },\n\n    // private\n    handleClick : function(e){\n        if(!this.href){ // if no link defined, stop the event automatically\n            e.stopEvent();\n        }\n        Ext.menu.Item.superclass.handleClick.apply(this, arguments);\n    },\n\n    // private\n    activate : function(autoExpand){\n        if(Ext.menu.Item.superclass.activate.apply(this, arguments)){\n            this.focus();\n            if(autoExpand){\n                this.expandMenu();\n            }\n        }\n        return true;\n    },\n\n    // private\n    shouldDeactivate : function(e){\n        if(Ext.menu.Item.superclass.shouldDeactivate.call(this, e)){\n            if(this.menu && this.menu.isVisible()){\n                return !this.menu.getEl().getRegion().contains(e.getPoint());\n            }\n            return true;\n        }\n        return false;\n    },\n\n    // private\n    deactivate : function(){\n        Ext.menu.Item.superclass.deactivate.apply(this, arguments);\n        this.hideMenu();\n    },\n\n    // private\n    expandMenu : function(autoActivate){\n        if(!this.disabled && this.menu){\n            clearTimeout(this.hideTimer);\n            delete this.hideTimer;\n            if(!this.menu.isVisible() && !this.showTimer){\n                this.showTimer = this.deferExpand.defer(this.showDelay, this, [autoActivate]);\n            }else if (this.menu.isVisible() && autoActivate){\n                this.menu.tryActivate(0, 1);\n            }\n        }\n    },\n\n    // private\n    deferExpand : function(autoActivate){\n        delete this.showTimer;\n        this.menu.show(this.container, this.parentMenu.subMenuAlign || 'tl-tr?', this.parentMenu);\n        if(autoActivate){\n            this.menu.tryActivate(0, 1);\n        }\n    },\n\n    // private\n    hideMenu : function(){\n        clearTimeout(this.showTimer);\n        delete this.showTimer;\n        if(!this.hideTimer && this.menu && this.menu.isVisible()){\n            this.hideTimer = this.deferHide.defer(this.hideDelay, this);\n        }\n    },\n\n    // private\n    deferHide : function(){\n        delete this.hideTimer;\n        if(this.menu.over){\n            this.parentMenu.setActiveItem(this, false);\n        }else{\n            this.menu.hide();\n        }\n    }\n});\nExt.reg('menuitem', Ext.menu.Item);/**\n * @class Ext.menu.CheckItem\n * @extends Ext.menu.Item\n * Adds a menu item that contains a checkbox by default, but can also be part of a radio group.\n * @constructor\n * Creates a new CheckItem\n * @param {Object} config Configuration options\n * @xtype menucheckitem\n */\nExt.menu.CheckItem = Ext.extend(Ext.menu.Item, {\n    /**\n     * @cfg {String} group\n     * All check items with the same group name will automatically be grouped into a single-select\n     * radio button group (defaults to '')\n     */\n    /**\n     * @cfg {String} itemCls The default CSS class to use for check items (defaults to \"x-menu-item x-menu-check-item\")\n     */\n    itemCls : \"x-menu-item x-menu-check-item\",\n    /**\n     * @cfg {String} groupClass The default CSS class to use for radio group check items (defaults to \"x-menu-group-item\")\n     */\n    groupClass : \"x-menu-group-item\",\n\n    /**\n     * @cfg {Boolean} checked True to initialize this checkbox as checked (defaults to false).  Note that\n     * if this checkbox is part of a radio group (group = true) only the first item in the group that is\n     * initialized with checked = true will be rendered as checked.\n     */\n    checked: false,\n\n    // private\n    ctype: \"Ext.menu.CheckItem\",\n    \n    initComponent : function(){\n        Ext.menu.CheckItem.superclass.initComponent.call(this);\n\t    this.addEvents(\n\t        /**\n\t         * @event beforecheckchange\n\t         * Fires before the checked value is set, providing an opportunity to cancel if needed\n\t         * @param {Ext.menu.CheckItem} this\n\t         * @param {Boolean} checked The new checked value that will be set\n\t         */\n\t        \"beforecheckchange\" ,\n\t        /**\n\t         * @event checkchange\n\t         * Fires after the checked value has been set\n\t         * @param {Ext.menu.CheckItem} this\n\t         * @param {Boolean} checked The checked value that was set\n\t         */\n\t        \"checkchange\"\n\t    );\n\t    /**\n\t     * A function that handles the checkchange event.  The function is undefined by default, but if an implementation\n\t     * is provided, it will be called automatically when the checkchange event fires.\n\t     * @param {Ext.menu.CheckItem} this\n\t     * @param {Boolean} checked The checked value that was set\n\t     * @method checkHandler\n\t     */\n\t    if(this.checkHandler){\n\t        this.on('checkchange', this.checkHandler, this.scope);\n\t    }\n\t    Ext.menu.MenuMgr.registerCheckable(this);\n    },\n\n    // private\n    onRender : function(c){\n        Ext.menu.CheckItem.superclass.onRender.apply(this, arguments);\n        if(this.group){\n            this.el.addClass(this.groupClass);\n        }\n        if(this.checked){\n            this.checked = false;\n            this.setChecked(true, true);\n        }\n    },\n\n    // private\n    destroy : function(){\n        Ext.menu.MenuMgr.unregisterCheckable(this);\n        Ext.menu.CheckItem.superclass.destroy.apply(this, arguments);\n    },\n\n    /**\n     * Set the checked state of this item\n     * @param {Boolean} checked The new checked value\n     * @param {Boolean} suppressEvent (optional) True to prevent the checkchange event from firing (defaults to false)\n     */\n    setChecked : function(state, suppressEvent){\n        var suppress = suppressEvent === true;\n        if(this.checked != state && (suppress || this.fireEvent(\"beforecheckchange\", this, state) !== false)){\n            Ext.menu.MenuMgr.onCheckChange(this, state);\n            if(this.container){\n                this.container[state ? \"addClass\" : \"removeClass\"](\"x-menu-item-checked\");\n            }\n            this.checked = state;\n            if(!suppress){\n                this.fireEvent(\"checkchange\", this, state);\n            }\n        }\n    },\n\n    // private\n    handleClick : function(e){\n       if(!this.disabled && !(this.checked && this.group)){// disable unselect on radio item\n           this.setChecked(!this.checked);\n       }\n       Ext.menu.CheckItem.superclass.handleClick.apply(this, arguments);\n    }\n});\nExt.reg('menucheckitem', Ext.menu.CheckItem);/**\n * @class Ext.menu.DateMenu\n * @extends Ext.menu.Menu\n * <p>A menu containing an {@link Ext.DatePicker} Component.</p>\n * <p>Notes:</p><div class=\"mdetail-params\"><ul>\n * <li>Although not listed here, the <b>constructor</b> for this class\n * accepts all of the configuration options of <b>{@link Ext.DatePicker}</b>.</li>\n * <li>If subclassing DateMenu, any configuration options for the DatePicker must be\n * applied to the <tt><b>initialConfig</b></tt> property of the DateMenu.\n * Applying {@link Ext.DatePicker DatePicker} configuration settings to\n * <b><tt>this</tt></b> will <b>not</b> affect the DatePicker's configuration.</li>\n * </ul></div>\n * @xtype datemenu\n */\n Ext.menu.DateMenu = Ext.extend(Ext.menu.Menu, {\n    /** \n     * @cfg {Boolean} enableScrolling\n     * @hide \n     */\n    enableScrolling : false,\n    /**\n     * @cfg {Function} handler\n     * Optional. A function that will handle the select event of this menu.\n     * The handler is passed the following parameters:<div class=\"mdetail-params\"><ul>\n     * <li><code>picker</code> : DatePicker<div class=\"sub-desc\">The Ext.DatePicker.</div></li>\n     * <li><code>date</code> : Date<div class=\"sub-desc\">The selected date.</div></li>\n     * </ul></div>\n     */\n    /**\n     * @cfg {Object} scope\n     * The scope (<tt><b>this</b></tt> reference) in which the <code>{@link #handler}</code>\n     * function will be called.  Defaults to this DateMenu instance.\n     */    \n    /** \n     * @cfg {Boolean} hideOnClick\n     * False to continue showing the menu after a date is selected, defaults to true.\n     */\n    hideOnClick : true,\n    \n    /** \n     * @cfg {String} pickerId\n     * An id to assign to the underlying date picker. Defaults to <tt>null</tt>.\n     */\n    pickerId : null,\n    \n    /** \n     * @cfg {Number} maxHeight\n     * @hide \n     */\n    /** \n     * @cfg {Number} scrollIncrement\n     * @hide \n     */\n    /**\n     * The {@link Ext.DatePicker} instance for this DateMenu\n     * @property picker\n     * @type DatePicker\n     */\n    cls : 'x-date-menu',\n    \n    /**\n     * @event click\n     * @hide\n     */\n    \n    /**\n     * @event itemclick\n     * @hide\n     */\n\n    initComponent : function(){\n        this.on('beforeshow', this.onBeforeShow, this);\n        if(this.strict = (Ext.isIE7 && Ext.isStrict)){\n            this.on('show', this.onShow, this, {single: true, delay: 20});\n        }\n        Ext.apply(this, {\n            plain: true,\n            showSeparator: false,\n            items: this.picker = new Ext.DatePicker(Ext.applyIf({\n                internalRender: this.strict || !Ext.isIE9m,\n                ctCls: 'x-menu-date-item',\n                id: this.pickerId\n            }, this.initialConfig))\n        });\n        this.picker.purgeListeners();\n        Ext.menu.DateMenu.superclass.initComponent.call(this);\n        /**\n         * @event select\n         * Fires when a date is selected from the {@link #picker Ext.DatePicker}\n         * @param {DatePicker} picker The {@link #picker Ext.DatePicker}\n         * @param {Date} date The selected date\n         */\n        this.relayEvents(this.picker, ['select']);\n        this.on('show', this.picker.focus, this.picker);\n        this.on('select', this.menuHide, this);\n        if(this.handler){\n            this.on('select', this.handler, this.scope || this);\n        }\n    },\n\n    menuHide : function() {\n        if(this.hideOnClick){\n            this.hide(true);\n        }\n    },\n\n    onBeforeShow : function(){\n        if(this.picker){\n            this.picker.hideMonthPicker(true);\n        }\n    },\n\n    onShow : function(){\n        var el = this.picker.getEl();\n        el.setWidth(el.getWidth()); //nasty hack for IE7 strict mode\n    }\n });\n Ext.reg('datemenu', Ext.menu.DateMenu);\n /**\n * @class Ext.menu.ColorMenu\n * @extends Ext.menu.Menu\n * <p>A menu containing a {@link Ext.ColorPalette} Component.</p>\n * <p>Notes:</p><div class=\"mdetail-params\"><ul>\n * <li>Although not listed here, the <b>constructor</b> for this class\n * accepts all of the configuration options of <b>{@link Ext.ColorPalette}</b>.</li>\n * <li>If subclassing ColorMenu, any configuration options for the ColorPalette must be\n * applied to the <tt><b>initialConfig</b></tt> property of the ColorMenu.\n * Applying {@link Ext.ColorPalette ColorPalette} configuration settings to\n * <b><tt>this</tt></b> will <b>not</b> affect the ColorPalette's configuration.</li>\n * </ul></div> * \n * @xtype colormenu\n */\n Ext.menu.ColorMenu = Ext.extend(Ext.menu.Menu, {\n    /** \n     * @cfg {Boolean} enableScrolling\n     * @hide \n     */\n    enableScrolling : false,\n    /**\n     * @cfg {Function} handler\n     * Optional. A function that will handle the select event of this menu.\n     * The handler is passed the following parameters:<div class=\"mdetail-params\"><ul>\n     * <li><code>palette</code> : ColorPalette<div class=\"sub-desc\">The {@link #palette Ext.ColorPalette}.</div></li>\n     * <li><code>color</code> : String<div class=\"sub-desc\">The 6-digit color hex code (without the # symbol).</div></li>\n     * </ul></div>\n     */\n    /**\n     * @cfg {Object} scope\n     * The scope (<tt><b>this</b></tt> reference) in which the <code>{@link #handler}</code>\n     * function will be called.  Defaults to this ColorMenu instance.\n     */    \n    \n    /** \n     * @cfg {Boolean} hideOnClick\n     * False to continue showing the menu after a color is selected, defaults to true.\n     */\n    hideOnClick : true,\n    \n    cls : 'x-color-menu',\n    \n    /** \n     * @cfg {String} paletteId\n     * An id to assign to the underlying color palette. Defaults to <tt>null</tt>.\n     */\n    paletteId : null,\n    \n    /** \n     * @cfg {Number} maxHeight\n     * @hide \n     */\n    /** \n     * @cfg {Number} scrollIncrement\n     * @hide \n     */\n    /**\n     * @property palette\n     * @type ColorPalette\n     * The {@link Ext.ColorPalette} instance for this ColorMenu\n     */\n    \n    \n    /**\n     * @event click\n     * @hide\n     */\n    \n    /**\n     * @event itemclick\n     * @hide\n     */\n    \n    initComponent : function(){\n        Ext.apply(this, {\n            plain: true,\n            showSeparator: false,\n            items: this.palette = new Ext.ColorPalette(Ext.applyIf({\n                id: this.paletteId\n            }, this.initialConfig))\n        });\n        this.palette.purgeListeners();\n        Ext.menu.ColorMenu.superclass.initComponent.call(this);\n        /**\n         * @event select\n         * Fires when a color is selected from the {@link #palette Ext.ColorPalette}\n         * @param {Ext.ColorPalette} palette The {@link #palette Ext.ColorPalette}\n\t     * @param {String} color The 6-digit color hex code (without the # symbol)\n         */\n        this.relayEvents(this.palette, ['select']);\n        this.on('select', this.menuHide, this);\n        if(this.handler){\n            this.on('select', this.handler, this.scope || this);\n        }\n    },\n\n    menuHide : function(){\n        if(this.hideOnClick){\n            this.hide(true);\n        }\n    }\n});\nExt.reg('colormenu', Ext.menu.ColorMenu);\n/**\n * @class Ext.form.Field\n * @extends Ext.BoxComponent\n * Base class for form fields that provides default event handling, sizing, value handling and other functionality.\n * @constructor\n * Creates a new Field\n * @param {Object} config Configuration options\n * @xtype field\n */\nExt.form.Field = Ext.extend(Ext.BoxComponent,  {\n    /**\n     * <p>The label Element associated with this Field. <b>Only available after this Field has been rendered by a\n     * {@link form Ext.layout.FormLayout} layout manager.</b></p>\n     * @type Ext.Element\n     * @property label\n     */\n    /**\n     * @cfg {String} inputType The type attribute for input fields -- e.g. radio, text, password, file (defaults\n     * to 'text'). The types 'file' and 'password' must be used to render those field types currently -- there are\n     * no separate Ext components for those. Note that if you use <tt>inputType:'file'</tt>, {@link #emptyText}\n     * is not supported and should be avoided.\n     */\n    /**\n     * @cfg {Number} tabIndex The tabIndex for this field. Note this only applies to fields that are rendered,\n     * not those which are built via applyTo (defaults to undefined).\n     */\n    /**\n     * @cfg {Mixed} value A value to initialize this field with (defaults to undefined).\n     */\n    /**\n     * @cfg {String} name The field's HTML name attribute (defaults to '').\n     * <b>Note</b>: this property must be set if this field is to be automatically included with\n     * {@link Ext.form.BasicForm#submit form submit()}.\n     */\n    /**\n     * @cfg {String} cls A custom CSS class to apply to the field's underlying element (defaults to '').\n     */\n\n    /**\n     * @cfg {String} invalidClass The CSS class to use when marking a field invalid (defaults to 'x-form-invalid')\n     */\n    invalidClass : 'x-form-invalid',\n    /**\n     * @cfg {String} invalidText The error text to use when marking a field invalid and no message is provided\n     * (defaults to 'The value in this field is invalid')\n     */\n    invalidText : 'The value in this field is invalid',\n    /**\n     * @cfg {String} focusClass The CSS class to use when the field receives focus (defaults to 'x-form-focus')\n     */\n    focusClass : 'x-form-focus',\n    /**\n     * @cfg {Boolean} preventMark\n     * <tt>true</tt> to disable {@link #markInvalid marking the field invalid}.\n     * Defaults to <tt>false</tt>.\n     */\n    /**\n     * @cfg {String/Boolean} validationEvent The event that should initiate field validation. Set to false to disable\n      automatic validation (defaults to 'keyup').\n     */\n    validationEvent : 'keyup',\n    /**\n     * @cfg {Boolean} validateOnBlur Whether the field should validate when it loses focus (defaults to true).\n     */\n    validateOnBlur : true,\n    /**\n     * @cfg {Number} validationDelay The length of time in milliseconds after user input begins until validation\n     * is initiated (defaults to 250)\n     */\n    validationDelay : 250,\n    /**\n     * @cfg {String/Object} autoCreate <p>A {@link Ext.DomHelper DomHelper} element spec, or true for a default\n     * element spec. Used to create the {@link Ext.Component#getEl Element} which will encapsulate this Component.\n     * See <tt>{@link Ext.Component#autoEl autoEl}</tt> for details.  Defaults to:</p>\n     * <pre><code>{tag: 'input', type: 'text', size: '20', autocomplete: 'off'}</code></pre>\n     */\n    defaultAutoCreate : {tag: 'input', type: 'text', size: '20', autocomplete: 'off'},\n    /**\n     * @cfg {String} fieldClass The default CSS class for the field (defaults to 'x-form-field')\n     */\n    fieldClass : 'x-form-field',\n    /**\n     * @cfg {String} msgTarget <p>The location where the message text set through {@link #markInvalid} should display.\n     * Must be one of the following values:</p>\n     * <div class=\"mdetail-params\"><ul>\n     * <li><code>qtip</code> Display a quick tip containing the message when the user hovers over the field. This is the default.\n     * <div class=\"subdesc\"><b>{@link Ext.QuickTips#init Ext.QuickTips.init} must have been called for this setting to work.</b></div</li>\n     * <li><code>title</code> Display the message in a default browser title attribute popup.</li>\n     * <li><code>under</code> Add a block div beneath the field containing the error message.</li>\n     * <li><code>side</code> Add an error icon to the right of the field, displaying the message in a popup on hover.</li>\n     * <li><code>[element id]</code> Add the error message directly to the innerHTML of the specified element.</li>\n     * </ul></div>\n     */\n    msgTarget : 'qtip',\n    /**\n     * @cfg {String} msgFx <b>Experimental</b> The effect used when displaying a validation message under the field\n     * (defaults to 'normal').\n     */\n    msgFx : 'normal',\n    /**\n     * @cfg {Boolean} readOnly <tt>true</tt> to mark the field as readOnly in HTML\n     * (defaults to <tt>false</tt>).\n     * <br><p><b>Note</b>: this only sets the element's readOnly DOM attribute.\n     * Setting <code>readOnly=true</code>, for example, will not disable triggering a\n     * ComboBox or DateField; it gives you the option of forcing the user to choose\n     * via the trigger without typing in the text box. To hide the trigger use\n     * <code>{@link Ext.form.TriggerField#hideTrigger hideTrigger}</code>.</p>\n     */\n    readOnly : false,\n    /**\n     * @cfg {Boolean} disabled True to disable the field (defaults to false).\n     * <p>Be aware that conformant with the <a href=\"http://www.w3.org/TR/html401/interact/forms.html#h-17.12.1\">HTML specification</a>,\n     * disabled Fields will not be {@link Ext.form.BasicForm#submit submitted}.</p>\n     */\n    disabled : false,\n    /**\n     * @cfg {Boolean} submitValue False to clear the name attribute on the field so that it is not submitted during a form post.\n     * Defaults to <tt>true</tt>.\n     */\n    submitValue: true,\n\n    // private\n    isFormField : true,\n\n    // private\n    msgDisplay: '',\n\n    // private\n    hasFocus : false,\n\n    // private\n    initComponent : function(){\n        Ext.form.Field.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event focus\n             * Fires when this field receives input focus.\n             * @param {Ext.form.Field} this\n             */\n            'focus',\n            /**\n             * @event blur\n             * Fires when this field loses input focus.\n             * @param {Ext.form.Field} this\n             */\n            'blur',\n            /**\n             * @event specialkey\n             * Fires when any key related to navigation (arrows, tab, enter, esc, etc.) is pressed.\n             * To handle other keys see {@link Ext.Panel#keys} or {@link Ext.KeyMap}.\n             * You can check {@link Ext.EventObject#getKey} to determine which key was pressed.\n             * For example: <pre><code>\nvar form = new Ext.form.FormPanel({\n    ...\n    items: [{\n            fieldLabel: 'Field 1',\n            name: 'field1',\n            allowBlank: false\n        },{\n            fieldLabel: 'Field 2',\n            name: 'field2',\n            listeners: {\n                specialkey: function(field, e){\n                    // e.HOME, e.END, e.PAGE_UP, e.PAGE_DOWN,\n                    // e.TAB, e.ESC, arrow keys: e.LEFT, e.RIGHT, e.UP, e.DOWN\n                    if (e.{@link Ext.EventObject#getKey getKey()} == e.ENTER) {\n                        var form = field.ownerCt.getForm();\n                        form.submit();\n                    }\n                }\n            }\n        }\n    ],\n    ...\n});\n             * </code></pre>\n             * @param {Ext.form.Field} this\n             * @param {Ext.EventObject} e The event object\n             */\n            'specialkey',\n            /**\n             * @event change\n             * Fires just before the field blurs if the field value has changed.\n             * @param {Ext.form.Field} this\n             * @param {Mixed} newValue The new value\n             * @param {Mixed} oldValue The original value\n             */\n            'change',\n            /**\n             * @event invalid\n             * Fires after the field has been marked as invalid.\n             * @param {Ext.form.Field} this\n             * @param {String} msg The validation message\n             */\n            'invalid',\n            /**\n             * @event valid\n             * Fires after the field has been validated with no errors.\n             * @param {Ext.form.Field} this\n             */\n            'valid'\n        );\n    },\n\n    /**\n     * Returns the {@link Ext.form.Field#name name} or {@link Ext.form.ComboBox#hiddenName hiddenName}\n     * attribute of the field if available.\n     * @return {String} name The field {@link Ext.form.Field#name name} or {@link Ext.form.ComboBox#hiddenName hiddenName}\n     */\n    getName : function(){\n        return this.rendered && this.el.dom.name ? this.el.dom.name : this.name || this.id || '';\n    },\n\n    // private\n    onRender : function(ct, position){\n        if(!this.el){\n            var cfg = this.getAutoCreate();\n\n            if(!cfg.name){\n                cfg.name = this.name || this.id;\n            }\n            if(this.inputType){\n                cfg.type = this.inputType;\n            }\n            this.autoEl = cfg;\n        }\n        Ext.form.Field.superclass.onRender.call(this, ct, position);\n        if(this.submitValue === false){\n            this.el.dom.removeAttribute('name');\n        }\n        var type = this.el.dom.type;\n        if(type){\n            if(type == 'password'){\n                type = 'text';\n            }\n            this.el.addClass('x-form-'+type);\n        }\n        if(this.readOnly){\n            this.setReadOnly(true);\n        }\n        if(this.tabIndex !== undefined){\n            this.el.dom.setAttribute('tabIndex', this.tabIndex);\n        }\n\n        this.el.addClass([this.fieldClass, this.cls]);\n    },\n\n    // private\n    getItemCt : function(){\n        return this.itemCt;\n    },\n\n    // private\n    initValue : function(){\n        if(this.value !== undefined){\n            this.setValue(this.value);\n        }else if(!Ext.isEmpty(this.el.dom.value) && this.el.dom.value != this.emptyText){\n            this.setValue(this.el.dom.value);\n        }\n        /**\n         * The original value of the field as configured in the {@link #value} configuration, or\n         * as loaded by the last form load operation if the form's {@link Ext.form.BasicForm#trackResetOnLoad trackResetOnLoad}\n         * setting is <code>true</code>.\n         * @type mixed\n         * @property originalValue\n         */\n        this.originalValue = this.getValue();\n    },\n\n    /**\n     * <p>Returns true if the value of this Field has been changed from its original value.\n     * Will return false if the field is disabled or has not been rendered yet.</p>\n     * <p>Note that if the owning {@link Ext.form.BasicForm form} was configured with\n     * {@link Ext.form.BasicForm}.{@link Ext.form.BasicForm#trackResetOnLoad trackResetOnLoad}\n     * then the <i>original value</i> is updated when the values are loaded by\n     * {@link Ext.form.BasicForm}.{@link Ext.form.BasicForm#setValues setValues}.</p>\n     * @return {Boolean} True if this field has been changed from its original value (and\n     * is not disabled), false otherwise.\n     */\n    isDirty : function() {\n        if(this.disabled || !this.rendered) {\n            return false;\n        }\n        return String(this.getValue()) !== String(this.originalValue);\n    },\n\n    /**\n     * Sets the read only state of this field.\n     * @param {Boolean} readOnly Whether the field should be read only.\n     */\n    setReadOnly : function(readOnly){\n        if(this.rendered){\n            this.el.dom.readOnly = readOnly;\n        }\n        this.readOnly = readOnly;\n    },\n\n    // private\n    afterRender : function(){\n        Ext.form.Field.superclass.afterRender.call(this);\n        this.initEvents();\n        this.initValue();\n    },\n\n    // private\n    fireKey : function(e){\n        if(e.isSpecialKey()){\n            this.fireEvent('specialkey', this, e);\n        }\n    },\n\n    /**\n     * Resets the current field value to the originally loaded value and clears any validation messages.\n     * See {@link Ext.form.BasicForm}.{@link Ext.form.BasicForm#trackResetOnLoad trackResetOnLoad}\n     */\n    reset : function(){\n        this.setValue(this.originalValue);\n        this.clearInvalid();\n    },\n\n    // private\n    initEvents : function(){\n        this.mon(this.el, Ext.EventManager.getKeyEvent(), this.fireKey,  this);\n        this.mon(this.el, 'focus', this.onFocus, this);\n\n        // standardise buffer across all browsers + OS-es for consistent event order.\n        // (the 10ms buffer for Editors fixes a weird FF/Win editor issue when changing OS window focus)\n        this.mon(this.el, 'blur', this.onBlur, this, this.inEditor ? {buffer:10} : null);\n    },\n\n    // private\n    preFocus: Ext.emptyFn,\n\n    // private\n    onFocus : function(){\n        this.preFocus();\n        if(this.focusClass){\n            this.el.addClass(this.focusClass);\n        }\n        if(!this.hasFocus){\n            this.hasFocus = true;\n            /**\n             * <p>The value that the Field had at the time it was last focused. This is the value that is passed\n             * to the {@link #change} event which is fired if the value has been changed when the Field is blurred.</p>\n             * <p><b>This will be undefined until the Field has been visited.</b> Compare {@link #originalValue}.</p>\n             * @type mixed\n             * @property startValue\n             */\n            this.startValue = this.getValue();\n            this.fireEvent('focus', this);\n        }\n    },\n\n    // private\n    beforeBlur : Ext.emptyFn,\n\n    // private\n    onBlur : function(){\n        this.beforeBlur();\n        if(this.focusClass){\n            this.el.removeClass(this.focusClass);\n        }\n        this.hasFocus = false;\n        if(this.validationEvent !== false && (this.validateOnBlur || this.validationEvent == 'blur')){\n            this.validate();\n        }\n        var v = this.getValue();\n        if(String(v) !== String(this.startValue)){\n            this.fireEvent('change', this, v, this.startValue);\n        }\n        this.fireEvent('blur', this);\n        this.postBlur();\n    },\n\n    // private\n    postBlur : Ext.emptyFn,\n\n    /**\n     * Returns whether or not the field value is currently valid by\n     * {@link #validateValue validating} the {@link #processValue processed value}\n     * of the field. <b>Note</b>: {@link #disabled} fields are ignored.\n     * @param {Boolean} preventMark True to disable marking the field invalid\n     * @return {Boolean} True if the value is valid, else false\n     */\n    isValid : function(preventMark){\n        if(this.disabled){\n            return true;\n        }\n        var restore = this.preventMark;\n        this.preventMark = preventMark === true;\n        var v = this.validateValue(this.processValue(this.getRawValue()), preventMark);\n        this.preventMark = restore;\n        return v;\n    },\n\n    /**\n     * Validates the field value\n     * @return {Boolean} True if the value is valid, else false\n     */\n    validate : function(){\n        if(this.disabled || this.validateValue(this.processValue(this.getRawValue()))){\n            this.clearInvalid();\n            return true;\n        }\n        return false;\n    },\n\n    /**\n     * This method should only be overridden if necessary to prepare raw values\n     * for validation (see {@link #validate} and {@link #isValid}).  This method\n     * is expected to return the processed value for the field which will\n     * be used for validation (see validateValue method).\n     * @param {Mixed} value\n     */\n    processValue : function(value){\n        return value;\n    },\n\n    /**\n     * Uses getErrors to build an array of validation errors. If any errors are found, markInvalid is called\n     * with the first and false is returned, otherwise true is returned. Previously, subclasses were invited\n     * to provide an implementation of this to process validations - from 3.2 onwards getErrors should be\n     * overridden instead.\n     * @param {Mixed} The current value of the field\n     * @return {Boolean} True if all validations passed, false if one or more failed\n     */\n     validateValue : function(value) {\n         //currently, we only show 1 error at a time for a field, so just use the first one\n         var error = this.getErrors(value)[0];\n\n         if (error == undefined) {\n             return true;\n         } else {\n             this.markInvalid(error);\n             return false;\n         }\n     },\n    \n    /**\n     * Runs this field's validators and returns an array of error messages for any validation failures.\n     * This is called internally during validation and would not usually need to be used manually.\n     * Each subclass should override or augment the return value to provide their own errors\n     * @return {Array} All error messages for this field\n     */\n    getErrors: function() {\n        return [];\n    },\n\n    /**\n     * Gets the active error message for this field.\n     * @return {String} Returns the active error message on the field, if there is no error, an empty string is returned.\n     */\n    getActiveError : function(){\n        return this.activeError || '';\n    },\n\n    /**\n     * <p>Display an error message associated with this field, using {@link #msgTarget} to determine how to\n     * display the message and applying {@link #invalidClass} to the field's UI element.</p>\n     * <p><b>Note</b>: this method does not cause the Field's {@link #validate} method to return <code>false</code>\n     * if the value does <i>pass</i> validation. So simply marking a Field as invalid will not prevent\n     * submission of forms submitted with the {@link Ext.form.Action.Submit#clientValidation} option set.</p>\n     * {@link #isValid invalid}.\n     * @param {String} msg (optional) The validation message (defaults to {@link #invalidText})\n     */\n    markInvalid : function(msg){\n        //don't set the error icon if we're not rendered or marking is prevented\n        if (this.rendered && !this.preventMark) {\n            msg = msg || this.invalidText;\n\n            var mt = this.getMessageHandler();\n            if(mt){\n                mt.mark(this, msg);\n            }else if(this.msgTarget){\n                this.el.addClass(this.invalidClass);\n                var t = Ext.getDom(this.msgTarget);\n                if(t){\n                    t.innerHTML = msg;\n                    t.style.display = this.msgDisplay;\n                }\n            }\n        }\n        \n        this.setActiveError(msg);\n    },\n    \n    /**\n     * Clear any invalid styles/messages for this field\n     */\n    clearInvalid : function(){\n        //don't remove the error icon if we're not rendered or marking is prevented\n        if (this.rendered && !this.preventMark) {\n            this.el.removeClass(this.invalidClass);\n            var mt = this.getMessageHandler();\n            if(mt){\n                mt.clear(this);\n            }else if(this.msgTarget){\n                this.el.removeClass(this.invalidClass);\n                var t = Ext.getDom(this.msgTarget);\n                if(t){\n                    t.innerHTML = '';\n                    t.style.display = 'none';\n                }\n            }\n        }\n        \n        this.unsetActiveError();\n    },\n\n    /**\n     * Sets the current activeError to the given string. Fires the 'invalid' event.\n     * This does not set up the error icon, only sets the message and fires the event. To show the error icon,\n     * use markInvalid instead, which calls this method internally\n     * @param {String} msg The error message\n     * @param {Boolean} suppressEvent True to suppress the 'invalid' event from being fired\n     */\n    setActiveError: function(msg, suppressEvent) {\n        this.activeError = msg;\n        if (suppressEvent !== true) this.fireEvent('invalid', this, msg);\n    },\n    \n    /**\n     * Clears the activeError and fires the 'valid' event. This is called internally by clearInvalid and would not\n     * usually need to be called manually\n     * @param {Boolean} suppressEvent True to suppress the 'invalid' event from being fired\n     */\n    unsetActiveError: function(suppressEvent) {\n        delete this.activeError;\n        if (suppressEvent !== true) this.fireEvent('valid', this);\n    },\n\n    // private\n    getMessageHandler : function(){\n        return Ext.form.MessageTargets[this.msgTarget];\n    },\n\n    // private\n    getErrorCt : function(){\n        return this.el.findParent('.x-form-element', 5, true) || // use form element wrap if available\n            this.el.findParent('.x-form-field-wrap', 5, true);   // else direct field wrap\n    },\n\n    // Alignment for 'under' target\n    alignErrorEl : function(){\n        this.errorEl.setWidth(this.getErrorCt().getWidth(true) - 20);\n    },\n\n    // Alignment for 'side' target\n    alignErrorIcon : function(){\n        this.errorIcon.alignTo(this.el, 'tl-tr', [2, 0]);\n    },\n\n    /**\n     * Returns the raw data value which may or may not be a valid, defined value.  To return a normalized value see {@link #getValue}.\n     * @return {Mixed} value The field value\n     */\n    getRawValue : function(){\n        var v = this.rendered ? this.el.getValue() : Ext.value(this.value, '');\n        if(v === this.emptyText){\n            v = '';\n        }\n        return v;\n    },\n\n    /**\n     * Returns the normalized data value (undefined or emptyText will be returned as '').  To return the raw value see {@link #getRawValue}.\n     * @return {Mixed} value The field value\n     */\n    getValue : function(){\n        if(!this.rendered) {\n            return this.value;\n        }\n        var v = this.el.getValue();\n        if(v === this.emptyText || v === undefined){\n            v = '';\n        }\n        return v;\n    },\n\n    /**\n     * Sets the underlying DOM field's value directly, bypassing validation.  To set the value with validation see {@link #setValue}.\n     * @param {Mixed} value The value to set\n     * @return {Mixed} value The field value that is set\n     */\n    setRawValue : function(v){\n        return this.rendered ? (this.el.dom.value = (Ext.isEmpty(v) ? '' : v)) : '';\n    },\n\n    /**\n     * Sets a data value into the field and validates it.  To set the value directly without validation see {@link #setRawValue}.\n     * @param {Mixed} value The value to set\n     * @return {Ext.form.Field} this\n     */\n    setValue : function(v){\n        this.value = v;\n        if(this.rendered){\n            this.el.dom.value = (Ext.isEmpty(v) ? '' : v);\n            this.validate();\n        }\n        return this;\n    },\n\n    // private, does not work for all fields\n    append : function(v){\n         this.setValue([this.getValue(), v].join(''));\n    }\n\n    /**\n     * @cfg {Boolean} autoWidth @hide\n     */\n    /**\n     * @cfg {Boolean} autoHeight @hide\n     */\n\n    /**\n     * @cfg {String} autoEl @hide\n     */\n});\n\n\nExt.form.MessageTargets = {\n    'qtip' : {\n        mark: function(field, msg){\n            field.el.addClass(field.invalidClass);\n            field.el.dom.qtip = msg;\n            field.el.dom.qclass = 'x-form-invalid-tip';\n            if(Ext.QuickTips){ // fix for floating editors interacting with DND\n                Ext.QuickTips.enable();\n            }\n        },\n        clear: function(field){\n            field.el.removeClass(field.invalidClass);\n            field.el.dom.qtip = '';\n        }\n    },\n    'title' : {\n        mark: function(field, msg){\n            field.el.addClass(field.invalidClass);\n            field.el.dom.title = msg;\n        },\n        clear: function(field){\n            field.el.dom.title = '';\n        }\n    },\n    'under' : {\n        mark: function(field, msg){\n            field.el.addClass(field.invalidClass);\n            if(!field.errorEl){\n                var elp = field.getErrorCt();\n                if(!elp){ // field has no container el\n                    field.el.dom.title = msg;\n                    return;\n                }\n                field.errorEl = elp.createChild({cls:'x-form-invalid-msg'});\n                field.on('resize', field.alignErrorEl, field);\n                field.on('destroy', function(){\n                    Ext.destroy(this.errorEl);\n                }, field);\n            }\n            field.alignErrorEl();\n            field.errorEl.update(msg);\n            Ext.form.Field.msgFx[field.msgFx].show(field.errorEl, field);\n        },\n        clear: function(field){\n            field.el.removeClass(field.invalidClass);\n            if(field.errorEl){\n                Ext.form.Field.msgFx[field.msgFx].hide(field.errorEl, field);\n            }else{\n                field.el.dom.title = '';\n            }\n        }\n    },\n    'side' : {\n        mark: function(field, msg){\n            field.el.addClass(field.invalidClass);\n            if(!field.errorIcon){\n                var elp = field.getErrorCt();\n                // field has no container el\n                if(!elp){\n                    field.el.dom.title = msg;\n                    return;\n                }\n                field.errorIcon = elp.createChild({cls:'x-form-invalid-icon'});\n                if (field.ownerCt) {\n                    field.ownerCt.on('afterlayout', field.alignErrorIcon, field);\n                    field.ownerCt.on('expand', field.alignErrorIcon, field);\n                }\n                field.on('resize', field.alignErrorIcon, field);\n                field.on('destroy', function(){\n                    Ext.destroy(this.errorIcon);\n                }, field);\n            }\n            field.alignErrorIcon();\n            field.errorIcon.dom.qtip = msg;\n            field.errorIcon.dom.qclass = 'x-form-invalid-tip';\n            field.errorIcon.show();\n        },\n        clear: function(field){\n            field.el.removeClass(field.invalidClass);\n            if(field.errorIcon){\n                field.errorIcon.dom.qtip = '';\n                field.errorIcon.hide();\n            }else{\n                field.el.dom.title = '';\n            }\n        }\n    }\n};\n\n// anything other than normal should be considered experimental\nExt.form.Field.msgFx = {\n    normal : {\n        show: function(msgEl, f){\n            msgEl.setDisplayed('block');\n        },\n\n        hide : function(msgEl, f){\n            msgEl.setDisplayed(false).update('');\n        }\n    },\n\n    slide : {\n        show: function(msgEl, f){\n            msgEl.slideIn('t', {stopFx:true});\n        },\n\n        hide : function(msgEl, f){\n            msgEl.slideOut('t', {stopFx:true,useDisplay:true});\n        }\n    },\n\n    slideRight : {\n        show: function(msgEl, f){\n            msgEl.fixDisplay();\n            msgEl.alignTo(f.el, 'tl-tr');\n            msgEl.slideIn('l', {stopFx:true});\n        },\n\n        hide : function(msgEl, f){\n            msgEl.slideOut('l', {stopFx:true,useDisplay:true});\n        }\n    }\n};\nExt.reg('field', Ext.form.Field);\n/**\n * @class Ext.form.TextField\n * @extends Ext.form.Field\n * <p>Basic text field.  Can be used as a direct replacement for traditional text inputs,\n * or as the base class for more sophisticated input controls (like {@link Ext.form.TextArea}\n * and {@link Ext.form.ComboBox}).</p>\n * <p><b><u>Validation</u></b></p>\n * <p>The validation procedure is described in the documentation for {@link #validateValue}.</p>\n * <p><b><u>Alter Validation Behavior</u></b></p>\n * <p>Validation behavior for each field can be configured:</p>\n * <div class=\"mdetail-params\"><ul>\n * <li><code>{@link Ext.form.TextField#invalidText invalidText}</code> : the default validation message to\n * show if any validation step above does not provide a message when invalid</li>\n * <li><code>{@link Ext.form.TextField#maskRe maskRe}</code> : filter out keystrokes before any validation occurs</li>\n * <li><code>{@link Ext.form.TextField#stripCharsRe stripCharsRe}</code> : filter characters after being typed in,\n * but before being validated</li>\n * <li><code>{@link Ext.form.Field#invalidClass invalidClass}</code> : alternate style when invalid</li>\n * <li><code>{@link Ext.form.Field#validateOnBlur validateOnBlur}</code>,\n * <code>{@link Ext.form.Field#validationDelay validationDelay}</code>, and\n * <code>{@link Ext.form.Field#validationEvent validationEvent}</code> : modify how/when validation is triggered</li>\n * </ul></div>\n * \n * @constructor Creates a new TextField\n * @param {Object} config Configuration options\n * \n * @xtype textfield\n */\nExt.form.TextField = Ext.extend(Ext.form.Field,  {\n    /**\n     * @cfg {String} vtypeText A custom error message to display in place of the default message provided\n     * for the <b><code>{@link #vtype}</code></b> currently set for this field (defaults to <tt>''</tt>).  <b>Note</b>:\n     * only applies if <b><code>{@link #vtype}</code></b> is set, else ignored.\n     */\n    /**\n     * @cfg {RegExp} stripCharsRe A JavaScript RegExp object used to strip unwanted content from the value\n     * before validation (defaults to <tt>null</tt>).\n     */\n    /**\n     * @cfg {Boolean} grow <tt>true</tt> if this field should automatically grow and shrink to its content\n     * (defaults to <tt>false</tt>)\n     */\n    grow : false,\n    /**\n     * @cfg {Number} growMin The minimum width to allow when <code><b>{@link #grow}</b> = true</code> (defaults\n     * to <tt>30</tt>)\n     */\n    growMin : 30,\n    /**\n     * @cfg {Number} growMax The maximum width to allow when <code><b>{@link #grow}</b> = true</code> (defaults\n     * to <tt>800</tt>)\n     */\n    growMax : 800,\n    /**\n     * @cfg {String} vtype A validation type name as defined in {@link Ext.form.VTypes} (defaults to <tt>null</tt>)\n     */\n    vtype : null,\n    /**\n     * @cfg {RegExp} maskRe An input mask regular expression that will be used to filter keystrokes that do\n     * not match (defaults to <tt>null</tt>). The maskRe will not operate on any paste events.\n     */\n    maskRe : null,\n    /**\n     * @cfg {Boolean} disableKeyFilter Specify <tt>true</tt> to disable input keystroke filtering (defaults\n     * to <tt>false</tt>)\n     */\n    disableKeyFilter : false,\n    /**\n     * @cfg {Boolean} allowBlank Specify <tt>false</tt> to validate that the value's length is > 0 (defaults to\n     * <tt>true</tt>)\n     */\n    allowBlank : true,\n    /**\n     * @cfg {Number} minLength Minimum input field length required (defaults to <tt>0</tt>)\n     */\n    minLength : 0,\n    /**\n     * @cfg {Number} maxLength Maximum input field length allowed by validation (defaults to Number.MAX_VALUE).\n     * This behavior is intended to provide instant feedback to the user by improving usability to allow pasting\n     * and editing or overtyping and back tracking. To restrict the maximum number of characters that can be\n     * entered into the field use <tt><b>{@link Ext.form.Field#autoCreate autoCreate}</b></tt> to add\n     * any attributes you want to a field, for example:<pre><code>\nvar myField = new Ext.form.NumberField({\n    id: 'mobile',\n    anchor:'90%',\n    fieldLabel: 'Mobile',\n    maxLength: 16, // for validation\n    autoCreate: {tag: 'input', type: 'text', size: '20', autocomplete: 'off', maxlength: '10'}\n});\n</code></pre>\n     */\n    maxLength : Number.MAX_VALUE,\n    /**\n     * @cfg {String} minLengthText Error text to display if the <b><tt>{@link #minLength minimum length}</tt></b>\n     * validation fails (defaults to <tt>'The minimum length for this field is {minLength}'</tt>)\n     */\n    minLengthText : 'The minimum length for this field is {0}',\n    /**\n     * @cfg {String} maxLengthText Error text to display if the <b><tt>{@link #maxLength maximum length}</tt></b>\n     * validation fails (defaults to <tt>'The maximum length for this field is {maxLength}'</tt>)\n     */\n    maxLengthText : 'The maximum length for this field is {0}',\n    /**\n     * @cfg {Boolean} selectOnFocus <tt>true</tt> to automatically select any existing field text when the field\n     * receives input focus (defaults to <tt>false</tt>)\n     */\n    selectOnFocus : false,\n    /**\n     * @cfg {String} blankText The error text to display if the <b><tt>{@link #allowBlank}</tt></b> validation\n     * fails (defaults to <tt>'This field is required'</tt>)\n     */\n    blankText : 'This field is required',\n    /**\n     * @cfg {Function} validator\n     * <p>A custom validation function to be called during field validation ({@link #validateValue})\n     * (defaults to <tt>null</tt>). If specified, this function will be called first, allowing the\n     * developer to override the default validation process.</p>\n     * <br><p>This function will be passed the following Parameters:</p>\n     * <div class=\"mdetail-params\"><ul>\n     * <li><code>value</code>: <i>Mixed</i>\n     * <div class=\"sub-desc\">The current field value</div></li>\n     * </ul></div>\n     * <br><p>This function is to Return:</p>\n     * <div class=\"mdetail-params\"><ul>\n     * <li><code>true</code>: <i>Boolean</i>\n     * <div class=\"sub-desc\"><code>true</code> if the value is valid</div></li>\n     * <li><code>msg</code>: <i>String</i>\n     * <div class=\"sub-desc\">An error message if the value is invalid</div></li>\n     * </ul></div>\n     */\n    validator : null,\n    /**\n     * @cfg {RegExp} regex A JavaScript RegExp object to be tested against the field value during validation\n     * (defaults to <tt>null</tt>). If the test fails, the field will be marked invalid using\n     * <b><tt>{@link #regexText}</tt></b>.\n     */\n    regex : null,\n    /**\n     * @cfg {String} regexText The error text to display if <b><tt>{@link #regex}</tt></b> is used and the\n     * test fails during validation (defaults to <tt>''</tt>)\n     */\n    regexText : '',\n    /**\n     * @cfg {String} emptyText The default text to place into an empty field (defaults to <tt>null</tt>).\n     * <b>Note</b>: that this value will be submitted to the server if this field is enabled and configured\n     * with a {@link #name}.\n     */\n    emptyText : null,\n    /**\n     * @cfg {String} emptyClass The CSS class to apply to an empty field to style the <b><tt>{@link #emptyText}</tt></b>\n     * (defaults to <tt>'x-form-empty-field'</tt>).  This class is automatically added and removed as needed\n     * depending on the current field value.\n     */\n    emptyClass : 'x-form-empty-field',\n\n    /**\n     * @cfg {Boolean} enableKeyEvents <tt>true</tt> to enable the proxying of key events for the HTML input\n     * field (defaults to <tt>false</tt>)\n     */\n\n    initComponent : function(){\n        Ext.form.TextField.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event autosize\n             * Fires when the <tt><b>{@link #autoSize}</b></tt> function is triggered. The field may or\n             * may not have actually changed size according to the default logic, but this event provides\n             * a hook for the developer to apply additional logic at runtime to resize the field if needed.\n             * @param {Ext.form.Field} this This text field\n             * @param {Number} width The new field width\n             */\n            'autosize',\n\n            /**\n             * @event keydown\n             * Keydown input field event. This event only fires if <tt><b>{@link #enableKeyEvents}</b></tt>\n             * is set to true.\n             * @param {Ext.form.TextField} this This text field\n             * @param {Ext.EventObject} e\n             */\n            'keydown',\n            /**\n             * @event keyup\n             * Keyup input field event. This event only fires if <tt><b>{@link #enableKeyEvents}</b></tt>\n             * is set to true.\n             * @param {Ext.form.TextField} this This text field\n             * @param {Ext.EventObject} e\n             */\n            'keyup',\n            /**\n             * @event keypress\n             * Keypress input field event. This event only fires if <tt><b>{@link #enableKeyEvents}</b></tt>\n             * is set to true.\n             * @param {Ext.form.TextField} this This text field\n             * @param {Ext.EventObject} e\n             */\n            'keypress'\n        );\n    },\n\n    // private\n    initEvents : function(){\n        Ext.form.TextField.superclass.initEvents.call(this);\n        if(this.validationEvent == 'keyup'){\n            this.validationTask = new Ext.util.DelayedTask(this.validate, this);\n            this.mon(this.el, 'keyup', this.filterValidation, this);\n        }\n        else if(this.validationEvent !== false && this.validationEvent != 'blur'){\n        \tthis.mon(this.el, this.validationEvent, this.validate, this, {buffer: this.validationDelay});\n        }\n        if(this.selectOnFocus || this.emptyText){            \n            this.mon(this.el, 'mousedown', this.onMouseDown, this);\n            \n            if(this.emptyText){\n                this.applyEmptyText();\n            }\n        }\n        if(this.maskRe || (this.vtype && this.disableKeyFilter !== true && (this.maskRe = Ext.form.VTypes[this.vtype+'Mask']))){\n        \tthis.mon(this.el, 'keypress', this.filterKeys, this);\n        }\n        if(this.grow){\n        \tthis.mon(this.el, 'keyup', this.onKeyUpBuffered, this, {buffer: 50});\n\t\t\tthis.mon(this.el, 'click', this.autoSize, this);\n        }\n        if(this.enableKeyEvents){\n            this.mon(this.el, {\n                scope: this,\n                keyup: this.onKeyUp,\n                keydown: this.onKeyDown,\n                keypress: this.onKeyPress\n            });\n        }\n    },\n    \n    onMouseDown: function(e){\n        if(!this.hasFocus){\n            this.mon(this.el, 'mouseup', Ext.emptyFn, this, { single: true, preventDefault: true });\n        }\n    },\n\n    processValue : function(value){\n        if(this.stripCharsRe){\n            var newValue = value.replace(this.stripCharsRe, '');\n            if(newValue !== value){\n                this.setRawValue(newValue);\n                return newValue;\n            }\n        }\n        return value;\n    },\n\n    filterValidation : function(e){\n        if(!e.isNavKeyPress()){\n            this.validationTask.delay(this.validationDelay);\n        }\n    },\n    \n    //private\n    onDisable: function(){\n        Ext.form.TextField.superclass.onDisable.call(this);\n        if(Ext.isIE){\n            this.el.dom.unselectable = 'on';\n        }\n    },\n    \n    //private\n    onEnable: function(){\n        Ext.form.TextField.superclass.onEnable.call(this);\n        if(Ext.isIE){\n            this.el.dom.unselectable = '';\n        }\n    },\n\n    // private\n    onKeyUpBuffered : function(e){\n        if(this.doAutoSize(e)){\n            this.autoSize();\n        }\n    },\n    \n    // private\n    doAutoSize : function(e){\n        return !e.isNavKeyPress();\n    },\n\n    // private\n    onKeyUp : function(e){\n        this.fireEvent('keyup', this, e);\n    },\n\n    // private\n    onKeyDown : function(e){\n        this.fireEvent('keydown', this, e);\n    },\n\n    // private\n    onKeyPress : function(e){\n        this.fireEvent('keypress', this, e);\n    },\n\n    /**\n     * Resets the current field value to the originally-loaded value and clears any validation messages.\n     * Also adds <tt><b>{@link #emptyText}</b></tt> and <tt><b>{@link #emptyClass}</b></tt> if the\n     * original value was blank.\n     */\n    reset : function(){\n        Ext.form.TextField.superclass.reset.call(this);\n        this.applyEmptyText();\n    },\n\n    applyEmptyText : function(){\n        if(this.rendered && this.emptyText && this.getRawValue().length < 1 && !this.hasFocus){\n            this.setRawValue(this.emptyText);\n            this.el.addClass(this.emptyClass);\n        }\n    },\n\n    // private\n    preFocus : function(){\n        var el = this.el,\n            isEmpty;\n        if(this.emptyText){\n            if(el.dom.value == this.emptyText){\n                this.setRawValue('');\n                isEmpty = true;\n            }\n            el.removeClass(this.emptyClass);\n        }\n        if(this.selectOnFocus || isEmpty){\n            el.dom.select();\n        }\n    },\n\n    // private\n    postBlur : function(){\n        this.applyEmptyText();\n    },\n\n    // private\n    filterKeys : function(e){\n        if(e.ctrlKey){\n            return;\n        }\n        var k = e.getKey();\n        if(Ext.isGecko && (e.isNavKeyPress() || k == e.BACKSPACE || (k == e.DELETE && e.button == -1))){\n            return;\n        }\n        var cc = String.fromCharCode(e.getCharCode());\n        if(!Ext.isGecko && e.isSpecialKey() && !cc){\n            return;\n        }\n        if(!this.maskRe.test(cc)){\n            e.stopEvent();\n        }\n    },\n\n    setValue : function(v){\n        if(this.emptyText && this.el && !Ext.isEmpty(v)){\n            this.el.removeClass(this.emptyClass);\n        }\n        Ext.form.TextField.superclass.setValue.apply(this, arguments);\n        this.applyEmptyText();\n        this.autoSize();\n        return this;\n    },\n\n    /**\n     * <p>Validates a value according to the field's validation rules and returns an array of errors\n     * for any failing validations. Validation rules are processed in the following order:</p>\n     * <div class=\"mdetail-params\"><ul>\n     * \n     * <li><b>1. Field specific validator</b>\n     * <div class=\"sub-desc\">\n     * <p>A validator offers a way to customize and reuse a validation specification.\n     * If a field is configured with a <code>{@link #validator}</code>\n     * function, it will be passed the current field value.  The <code>{@link #validator}</code>\n     * function is expected to return either:\n     * <div class=\"mdetail-params\"><ul>\n     * <li>Boolean <tt>true</tt> if the value is valid (validation continues).</li>\n     * <li>a String to represent the invalid message if invalid (validation halts).</li>\n     * </ul></div>\n     * </div></li>\n     * \n     * <li><b>2. Basic Validation</b>\n     * <div class=\"sub-desc\">\n     * <p>If the <code>{@link #validator}</code> has not halted validation,\n     * basic validation proceeds as follows:</p>\n     * \n     * <div class=\"mdetail-params\"><ul>\n     * \n     * <li><code>{@link #allowBlank}</code> : (Invalid message =\n     * <code>{@link #emptyText}</code>)<div class=\"sub-desc\">\n     * Depending on the configuration of <code>{@link #allowBlank}</code>, a\n     * blank field will cause validation to halt at this step and return\n     * Boolean true or false accordingly.  \n     * </div></li>\n     * \n     * <li><code>{@link #minLength}</code> : (Invalid message =\n     * <code>{@link #minLengthText}</code>)<div class=\"sub-desc\">\n     * If the passed value does not satisfy the <code>{@link #minLength}</code>\n     * specified, validation halts.\n     * </div></li>\n     * \n     * <li><code>{@link #maxLength}</code> : (Invalid message =\n     * <code>{@link #maxLengthText}</code>)<div class=\"sub-desc\">\n     * If the passed value does not satisfy the <code>{@link #maxLength}</code>\n     * specified, validation halts.\n     * </div></li>\n     * \n     * </ul></div>\n     * </div></li>\n     * \n     * <li><b>3. Preconfigured Validation Types (VTypes)</b>\n     * <div class=\"sub-desc\">\n     * <p>If none of the prior validation steps halts validation, a field\n     * configured with a <code>{@link #vtype}</code> will utilize the\n     * corresponding {@link Ext.form.VTypes VTypes} validation function.\n     * If invalid, either the field's <code>{@link #vtypeText}</code> or\n     * the VTypes vtype Text property will be used for the invalid message.\n     * Keystrokes on the field will be filtered according to the VTypes\n     * vtype Mask property.</p>\n     * </div></li>\n     * \n     * <li><b>4. Field specific regex test</b>\n     * <div class=\"sub-desc\">\n     * <p>If none of the prior validation steps halts validation, a field's\n     * configured <code>{@link #regex}</code> test will be processed.\n     * The invalid message for this test is configured with\n     * <code>{@link #regexText}</code>.</p>\n     * </div></li>\n     * \n     * @param {Mixed} value The value to validate. The processed raw value will be used if nothing is passed\n     * @return {Array} Array of any validation errors\n     */\n    getErrors: function(value) {\n        var errors = Ext.form.TextField.superclass.getErrors.apply(this, arguments);\n        \n        value = Ext.isDefined(value) ? value : this.processValue(this.getRawValue());        \n        \n        if (Ext.isFunction(this.validator)) {\n            var msg = this.validator(value);\n            if (msg !== true) {\n                errors.push(msg);\n            }\n        }\n        \n        if (value.length < 1 || value === this.emptyText) {\n            if (this.allowBlank) {\n                //if value is blank and allowBlank is true, there cannot be any additional errors\n                return errors;\n            } else {\n                errors.push(this.blankText);\n            }\n        }\n        \n        if (!this.allowBlank && (value.length < 1 || value === this.emptyText)) { // if it's blank\n            errors.push(this.blankText);\n        }\n        \n        if (value.length < this.minLength) {\n            errors.push(String.format(this.minLengthText, this.minLength));\n        }\n        \n        if (value.length > this.maxLength) {\n            errors.push(String.format(this.maxLengthText, this.maxLength));\n        }\n        \n        if (this.vtype) {\n            var vt = Ext.form.VTypes;\n            if(!vt[this.vtype](value, this)){\n                errors.push(this.vtypeText || vt[this.vtype +'Text']);\n            }\n        }\n        \n        if (this.regex && !this.regex.test(value)) {\n            errors.push(this.regexText);\n        }\n        \n        return errors;\n    },\n\n    /**\n     * Selects text in this field\n     * @param {Number} start (optional) The index where the selection should start (defaults to 0)\n     * @param {Number} end (optional) The index where the selection should end (defaults to the text length)\n     */\n    selectText : function(start, end){\n        var v = this.getRawValue();\n        var doFocus = false;\n        if(v.length > 0){\n            start = start === undefined ? 0 : start;\n            end = end === undefined ? v.length : end;\n            var d = this.el.dom;\n            if(d.setSelectionRange){\n                d.setSelectionRange(start, end);\n            }else if(d.createTextRange){\n                var range = d.createTextRange();\n                range.moveStart('character', start);\n                range.moveEnd('character', end-v.length);\n                range.select();\n            }\n            doFocus = Ext.isGecko || Ext.isOpera;\n        }else{\n            doFocus = true;\n        }\n        if(doFocus){\n            this.focus();\n        }\n    },\n\n    /**\n     * Automatically grows the field to accomodate the width of the text up to the maximum field width allowed.\n     * This only takes effect if <tt><b>{@link #grow}</b> = true</tt>, and fires the {@link #autosize} event.\n     */\n    autoSize : function(){\n        if(!this.grow || !this.rendered){\n            return;\n        }\n        if(!this.metrics){\n            this.metrics = Ext.util.TextMetrics.createInstance(this.el);\n        }\n        var el = this.el;\n        var v = el.dom.value;\n        var d = document.createElement('div');\n        d.appendChild(document.createTextNode(v));\n        v = d.innerHTML;\n        Ext.removeNode(d);\n        d = null;\n        v += '&#160;';\n        var w = Math.min(this.growMax, Math.max(this.metrics.getWidth(v) + /* add extra padding */ 10, this.growMin));\n        this.el.setWidth(w);\n        this.fireEvent('autosize', this, w);\n    },\n\t\n\tonDestroy: function(){\n\t\tif(this.validationTask){\n\t\t\tthis.validationTask.cancel();\n\t\t\tthis.validationTask = null;\n\t\t}\n\t\tExt.form.TextField.superclass.onDestroy.call(this);\n\t}\n});\nExt.reg('textfield', Ext.form.TextField);\n/**\n * @class Ext.form.TriggerField\n * @extends Ext.form.TextField\n * Provides a convenient wrapper for TextFields that adds a clickable trigger button (looks like a combobox by default).\n * The trigger has no default action, so you must assign a function to implement the trigger click handler by\n * overriding {@link #onTriggerClick}. You can create a TriggerField directly, as it renders exactly like a combobox\n * for which you can provide a custom implementation.  For example:\n * <pre><code>\nvar trigger = new Ext.form.TriggerField();\ntrigger.onTriggerClick = myTriggerFn;\ntrigger.applyToMarkup('my-field');\n</code></pre>\n *\n * However, in general you will most likely want to use TriggerField as the base class for a reusable component.\n * {@link Ext.form.DateField} and {@link Ext.form.ComboBox} are perfect examples of this.\n *\n * @constructor\n * Create a new TriggerField.\n * @param {Object} config Configuration options (valid {@Ext.form.TextField} config options will also be applied\n * to the base TextField)\n * @xtype trigger\n */\nExt.form.TriggerField = Ext.extend(Ext.form.TextField,  {\n    /**\n     * @cfg {String} triggerClass\n     * An additional CSS class used to style the trigger button.  The trigger will always get the\n     * class <tt>'x-form-trigger'</tt> by default and <tt>triggerClass</tt> will be <b>appended</b> if specified.\n     */\n    /**\n     * @cfg {Mixed} triggerConfig\n     * <p>A {@link Ext.DomHelper DomHelper} config object specifying the structure of the\n     * trigger element for this Field. (Optional).</p>\n     * <p>Specify this when you need a customized element to act as the trigger button for a TriggerField.</p>\n     * <p>Note that when using this option, it is the developer's responsibility to ensure correct sizing, positioning\n     * and appearance of the trigger.  Defaults to:</p>\n     * <pre><code>{tag: \"img\", src: Ext.BLANK_IMAGE_URL, cls: \"x-form-trigger \" + this.triggerClass}</code></pre>\n     */\n    /**\n     * @cfg {String/Object} autoCreate <p>A {@link Ext.DomHelper DomHelper} element spec, or true for a default\n     * element spec. Used to create the {@link Ext.Component#getEl Element} which will encapsulate this Component.\n     * See <tt>{@link Ext.Component#autoEl autoEl}</tt> for details.  Defaults to:</p>\n     * <pre><code>{tag: \"input\", type: \"text\", size: \"16\", autocomplete: \"off\"}</code></pre>\n     */\n    defaultAutoCreate : {tag: \"input\", type: \"text\", size: \"16\", autocomplete: \"off\"},\n    /**\n     * @cfg {Boolean} hideTrigger <tt>true</tt> to hide the trigger element and display only the base\n     * text field (defaults to <tt>false</tt>)\n     */\n    hideTrigger:false,\n    /**\n     * @cfg {Boolean} editable <tt>false</tt> to prevent the user from typing text directly into the field,\n     * the field will only respond to a click on the trigger to set the value. (defaults to <tt>true</tt>).\n     */\n    editable: true,\n    /**\n     * @cfg {Boolean} readOnly <tt>true</tt> to prevent the user from changing the field, and\n     * hides the trigger.  Superceeds the editable and hideTrigger options if the value is true.\n     * (defaults to <tt>false</tt>)\n     */\n    readOnly: false,\n    /**\n     * @cfg {String} wrapFocusClass The class added to the to the wrap of the trigger element. Defaults to\n     * <tt>x-trigger-wrap-focus</tt>.\n     */\n    wrapFocusClass: 'x-trigger-wrap-focus',\n    /**\n     * @hide\n     * @method autoSize\n     */\n    autoSize: Ext.emptyFn,\n    // private\n    monitorTab : true,\n    // private\n    deferHeight : true,\n    // private\n    mimicing : false,\n\n    actionMode: 'wrap',\n\n    defaultTriggerWidth: 17,\n\n    // private\n    onResize : function(w, h){\n        Ext.form.TriggerField.superclass.onResize.call(this, w, h);\n        var tw = this.getTriggerWidth();\n        if(Ext.isNumber(w)){\n            this.el.setWidth(w - tw);\n        }\n        this.wrap.setWidth(this.el.getWidth() + tw);\n    },\n\n    getTriggerWidth: function(){\n        var tw = this.trigger.getWidth();\n        if(!this.hideTrigger && !this.readOnly && tw === 0){\n            tw = this.defaultTriggerWidth;\n        }\n        return tw;\n    },\n\n    // private\n    alignErrorIcon : function(){\n        if(this.wrap){\n            this.errorIcon.alignTo(this.wrap, 'tl-tr', [2, 0]);\n        }\n    },\n\n    // private\n    onRender : function(ct, position){\n        this.doc = Ext.isIE ? Ext.getBody() : Ext.getDoc();\n        Ext.form.TriggerField.superclass.onRender.call(this, ct, position);\n\n        this.wrap = this.el.wrap({cls: 'x-form-field-wrap x-form-field-trigger-wrap'});\n        this.trigger = this.wrap.createChild(this.triggerConfig ||\n                {tag: \"img\", src: Ext.BLANK_IMAGE_URL, alt: \"\", cls: \"x-form-trigger \" + this.triggerClass});\n        this.initTrigger();\n        if(!this.width){\n            this.wrap.setWidth(this.el.getWidth()+this.trigger.getWidth());\n        }\n        this.resizeEl = this.positionEl = this.wrap;\n    },\n\n    getWidth: function() {\n        return(this.el.getWidth() + this.trigger.getWidth());\n    },\n\n    updateEditState: function(){\n        if(this.rendered){\n            if (this.readOnly) {\n                this.el.dom.readOnly = true;\n                this.el.addClass('x-trigger-noedit');\n                this.mun(this.el, 'click', this.onTriggerClick, this);\n                this.trigger.setDisplayed(false);\n            } else {\n                if (!this.editable) {\n                    this.el.dom.readOnly = true;\n                    this.el.addClass('x-trigger-noedit');\n                    this.mon(this.el, 'click', this.onTriggerClick, this);\n                } else {\n                    this.el.dom.readOnly = false;\n                    this.el.removeClass('x-trigger-noedit');\n                    this.mun(this.el, 'click', this.onTriggerClick, this);\n                }\n                this.trigger.setDisplayed(!this.hideTrigger);\n            }\n            this.onResize(this.width || this.wrap.getWidth());\n        }\n    },\n\n    /**\n     * Changes the hidden status of the trigger.\n     * @param {Boolean} hideTrigger True to hide the trigger, false to show it.\n     */\n    setHideTrigger: function(hideTrigger){\n        if(hideTrigger != this.hideTrigger){\n            this.hideTrigger = hideTrigger;\n            this.updateEditState();\n        }\n    },\n\n    /**\n     * Allow or prevent the user from directly editing the field text.  If false is passed,\n     * the user will only be able to modify the field using the trigger.  Will also add\n     * a click event to the text field which will call the trigger. This method\n     * is the runtime equivalent of setting the {@link #editable} config option at config time.\n     * @param {Boolean} value True to allow the user to directly edit the field text.\n     */\n    setEditable: function(editable){\n        if(editable != this.editable){\n            this.editable = editable;\n            this.updateEditState();\n        }\n    },\n\n    /**\n     * Setting this to true will supersede settings {@link #editable} and {@link #hideTrigger}.\n     * Setting this to false will defer back to {@link #editable} and {@link #hideTrigger}. This method\n     * is the runtime equivalent of setting the {@link #readOnly} config option at config time.\n     * @param {Boolean} value True to prevent the user changing the field and explicitly\n     * hide the trigger.\n     */\n    setReadOnly: function(readOnly){\n        if(readOnly != this.readOnly){\n            this.readOnly = readOnly;\n            this.updateEditState();\n        }\n    },\n\n    afterRender : function(){\n        Ext.form.TriggerField.superclass.afterRender.call(this);\n        this.updateEditState();\n    },\n\n    // private\n    initTrigger : function(){\n        this.mon(this.trigger, 'click', this.onTriggerClick, this, {preventDefault:true});\n        this.trigger.addClassOnOver('x-form-trigger-over');\n        this.trigger.addClassOnClick('x-form-trigger-click');\n    },\n\n    // private\n    onDestroy : function(){\n        Ext.destroy(this.trigger, this.wrap);\n        if (this.mimicing){\n            this.doc.un('mousedown', this.mimicBlur, this);\n        }\n        delete this.doc;\n        Ext.form.TriggerField.superclass.onDestroy.call(this);\n    },\n\n    // private\n    onFocus : function(){\n        Ext.form.TriggerField.superclass.onFocus.call(this);\n        if(!this.mimicing){\n            this.wrap.addClass(this.wrapFocusClass);\n            this.mimicing = true;\n            this.doc.on('mousedown', this.mimicBlur, this, {delay: 10});\n            if(this.monitorTab){\n                this.on('specialkey', this.checkTab, this);\n            }\n        }\n    },\n\n    // private\n    checkTab : function(me, e){\n        if(e.getKey() == e.TAB){\n            this.triggerBlur();\n        }\n    },\n\n    // private\n    onBlur : Ext.emptyFn,\n\n    // private\n    mimicBlur : function(e){\n        if(!this.isDestroyed && !this.wrap.contains(e.target) && this.validateBlur(e)){\n            this.triggerBlur();\n        }\n    },\n\n    // private\n    triggerBlur : function(){\n        this.mimicing = false;\n        this.doc.un('mousedown', this.mimicBlur, this);\n        if(this.monitorTab && this.el){\n            this.un('specialkey', this.checkTab, this);\n        }\n        Ext.form.TriggerField.superclass.onBlur.call(this);\n        if(this.wrap){\n            this.wrap.removeClass(this.wrapFocusClass);\n        }\n    },\n\n    beforeBlur : Ext.emptyFn,\n\n    // private\n    // This should be overriden by any subclass that needs to check whether or not the field can be blurred.\n    validateBlur : function(e){\n        return true;\n    },\n\n    /**\n     * The function that should handle the trigger's click event.  This method does nothing by default\n     * until overridden by an implementing function.  See Ext.form.ComboBox and Ext.form.DateField for\n     * sample implementations.\n     * @method\n     * @param {EventObject} e\n     */\n    onTriggerClick : Ext.emptyFn\n\n    /**\n     * @cfg {Boolean} grow @hide\n     */\n    /**\n     * @cfg {Number} growMin @hide\n     */\n    /**\n     * @cfg {Number} growMax @hide\n     */\n});\n\n/**\n * @class Ext.form.TwinTriggerField\n * @extends Ext.form.TriggerField\n * TwinTriggerField is not a public class to be used directly.  It is meant as an abstract base class\n * to be extended by an implementing class.  For an example of implementing this class, see the custom\n * SearchField implementation here:\n * <a href=\"http://extjs.com/deploy/ext/examples/form/custom.html\">http://extjs.com/deploy/ext/examples/form/custom.html</a>\n */\nExt.form.TwinTriggerField = Ext.extend(Ext.form.TriggerField, {\n    /**\n     * @cfg {Mixed} triggerConfig\n     * <p>A {@link Ext.DomHelper DomHelper} config object specifying the structure of the trigger elements\n     * for this Field. (Optional).</p>\n     * <p>Specify this when you need a customized element to contain the two trigger elements for this Field.\n     * Each trigger element must be marked by the CSS class <tt>x-form-trigger</tt> (also see\n     * <tt>{@link #trigger1Class}</tt> and <tt>{@link #trigger2Class}</tt>).</p>\n     * <p>Note that when using this option, it is the developer's responsibility to ensure correct sizing,\n     * positioning and appearance of the triggers.</p>\n     */\n    /**\n     * @cfg {String} trigger1Class\n     * An additional CSS class used to style the trigger button.  The trigger will always get the\n     * class <tt>'x-form-trigger'</tt> by default and <tt>triggerClass</tt> will be <b>appended</b> if specified.\n     */\n    /**\n     * @cfg {String} trigger2Class\n     * An additional CSS class used to style the trigger button.  The trigger will always get the\n     * class <tt>'x-form-trigger'</tt> by default and <tt>triggerClass</tt> will be <b>appended</b> if specified.\n     */\n\n    initComponent : function(){\n        Ext.form.TwinTriggerField.superclass.initComponent.call(this);\n\n        this.triggerConfig = {\n            tag:'span', cls:'x-form-twin-triggers', cn:[\n            {tag: \"img\", src: Ext.BLANK_IMAGE_URL, alt: \"\", cls: \"x-form-trigger \" + this.trigger1Class},\n            {tag: \"img\", src: Ext.BLANK_IMAGE_URL, alt: \"\", cls: \"x-form-trigger \" + this.trigger2Class}\n        ]};\n    },\n\n    getTrigger : function(index){\n        return this.triggers[index];\n    },\n    \n    afterRender: function(){\n        Ext.form.TwinTriggerField.superclass.afterRender.call(this);\n        var triggers = this.triggers,\n            i = 0,\n            len = triggers.length;\n            \n        for(; i < len; ++i){\n            if(this['hideTrigger' + (i + 1)]){\n                    triggers[i].hide();\n                }\n\n        }    \n    },\n\n    initTrigger : function(){\n        var ts = this.trigger.select('.x-form-trigger', true),\n            triggerField = this;\n            \n        ts.each(function(t, all, index){\n            var triggerIndex = 'Trigger'+(index+1);\n            t.hide = function(){\n                var w = triggerField.wrap.getWidth();\n                this.dom.style.display = 'none';\n                triggerField.el.setWidth(w-triggerField.trigger.getWidth());\n                triggerField['hidden' + triggerIndex] = true;\n            };\n            t.show = function(){\n                var w = triggerField.wrap.getWidth();\n                this.dom.style.display = '';\n                triggerField.el.setWidth(w-triggerField.trigger.getWidth());\n                triggerField['hidden' + triggerIndex] = false;\n            };\n            this.mon(t, 'click', this['on'+triggerIndex+'Click'], this, {preventDefault:true});\n            t.addClassOnOver('x-form-trigger-over');\n            t.addClassOnClick('x-form-trigger-click');\n        }, this);\n        this.triggers = ts.elements;\n    },\n\n    getTriggerWidth: function(){\n        var tw = 0;\n        Ext.each(this.triggers, function(t, index){\n            var triggerIndex = 'Trigger' + (index + 1),\n                w = t.getWidth();\n            if(w === 0 && !this['hidden' + triggerIndex]){\n                tw += this.defaultTriggerWidth;\n            }else{\n                tw += w;\n            }\n        }, this);\n        return tw;\n    },\n\n    // private\n    onDestroy : function() {\n        Ext.destroy(this.triggers);\n        Ext.form.TwinTriggerField.superclass.onDestroy.call(this);\n    },\n\n    /**\n     * The function that should handle the trigger's click event.  This method does nothing by default\n     * until overridden by an implementing function. See {@link Ext.form.TriggerField#onTriggerClick}\n     * for additional information.\n     * @method\n     * @param {EventObject} e\n     */\n    onTrigger1Click : Ext.emptyFn,\n    /**\n     * The function that should handle the trigger's click event.  This method does nothing by default\n     * until overridden by an implementing function. See {@link Ext.form.TriggerField#onTriggerClick}\n     * for additional information.\n     * @method\n     * @param {EventObject} e\n     */\n    onTrigger2Click : Ext.emptyFn\n});\nExt.reg('trigger', Ext.form.TriggerField);\nExt.reg('twintrigger', Ext.form.TwinTriggerField);/**\n * @class Ext.form.TextArea\n * @extends Ext.form.TextField\n * Multiline text field.  Can be used as a direct replacement for traditional textarea fields, plus adds\n * support for auto-sizing.\n * @constructor\n * Creates a new TextArea\n * @param {Object} config Configuration options\n * @xtype textarea\n */\nExt.form.TextArea = Ext.extend(Ext.form.TextField,  {\n    /**\n     * @cfg {Number} growMin The minimum height to allow when <tt>{@link Ext.form.TextField#grow grow}=true</tt>\n     * (defaults to <tt>60</tt>)\n     */\n    growMin : 60,\n    /**\n     * @cfg {Number} growMax The maximum height to allow when <tt>{@link Ext.form.TextField#grow grow}=true</tt>\n     * (defaults to <tt>1000</tt>)\n     */\n    growMax: 1000,\n    growAppend : '&#160;\\n&#160;',\n\n    enterIsSpecial : false,\n\n    /**\n     * @cfg {Boolean} preventScrollbars <tt>true</tt> to prevent scrollbars from appearing regardless of how much text is\n     * in the field. This option is only relevant when {@link #grow} is <tt>true</tt>. Equivalent to setting overflow: hidden, defaults to \n     * <tt>false</tt>.\n     */\n    preventScrollbars: false,\n    /**\n     * @cfg {String/Object} autoCreate <p>A {@link Ext.DomHelper DomHelper} element spec, or true for a default\n     * element spec. Used to create the {@link Ext.Component#getEl Element} which will encapsulate this Component.\n     * See <tt>{@link Ext.Component#autoEl autoEl}</tt> for details.  Defaults to:</p>\n     * <pre><code>{tag: \"textarea\", style: \"width:100px;height:60px;\", autocomplete: \"off\"}</code></pre>\n     */\n\n    // private\n    onRender : function(ct, position){\n        if(!this.el){\n            this.defaultAutoCreate = {\n                tag: \"textarea\",\n                style:\"width:100px;height:60px;\",\n                autocomplete: \"off\"\n            };\n        }\n        Ext.form.TextArea.superclass.onRender.call(this, ct, position);\n        if(this.grow){\n            this.textSizeEl = Ext.DomHelper.append(document.body, {\n                tag: \"pre\", cls: \"x-form-grow-sizer\"\n            });\n            if(this.preventScrollbars){\n                this.el.setStyle(\"overflow\", \"hidden\");\n            }\n            this.el.setHeight(this.growMin);\n        }\n    },\n\n    onDestroy : function(){\n        Ext.removeNode(this.textSizeEl);\n        Ext.form.TextArea.superclass.onDestroy.call(this);\n    },\n\n    fireKey : function(e){\n        if(e.isSpecialKey() && (this.enterIsSpecial || (e.getKey() != e.ENTER || e.hasModifier()))){\n            this.fireEvent(\"specialkey\", this, e);\n        }\n    },\n    \n    // private\n    doAutoSize : function(e){\n        return !e.isNavKeyPress() || e.getKey() == e.ENTER;\n    },\n    \n    // inherit docs\n    filterValidation: function(e) {            \n        if(!e.isNavKeyPress() || (!this.enterIsSpecial && e.keyCode == e.ENTER)){\n            this.validationTask.delay(this.validationDelay);\n        }\n    },\n\n    /**\n     * Automatically grows the field to accomodate the height of the text up to the maximum field height allowed.\n     * This only takes effect if grow = true, and fires the {@link #autosize} event if the height changes.\n     */\n    autoSize: function(){\n        if(!this.grow || !this.textSizeEl){\n            return;\n        }\n        var el = this.el,\n            v = Ext.util.Format.htmlEncode(el.dom.value),\n            ts = this.textSizeEl,\n            h;\n            \n        Ext.fly(ts).setWidth(this.el.getWidth());\n        if(v.length < 1){\n            v = \"&#160;&#160;\";\n        }else{\n            v += this.growAppend;\n            if(Ext.isIE){\n                v = v.replace(/\\n/g, '&#160;<br />');\n            }\n        }\n        ts.innerHTML = v;\n        h = Math.min(this.growMax, Math.max(ts.offsetHeight, this.growMin));\n        if(h != this.lastHeight){\n            this.lastHeight = h;\n            this.el.setHeight(h);\n            this.fireEvent(\"autosize\", this, h);\n        }\n    }\n});\nExt.reg('textarea', Ext.form.TextArea);/**\n * @class Ext.form.NumberField\n * @extends Ext.form.TextField\n * Numeric text field that provides automatic keystroke filtering and numeric validation.\n * @constructor\n * Creates a new NumberField\n * @param {Object} config Configuration options\n * @xtype numberfield\n */\nExt.form.NumberField = Ext.extend(Ext.form.TextField,  {\n    /**\n     * @cfg {RegExp} stripCharsRe @hide\n     */\n    /**\n     * @cfg {RegExp} maskRe @hide\n     */\n    /**\n     * @cfg {String} fieldClass The default CSS class for the field (defaults to \"x-form-field x-form-num-field\")\n     */\n    fieldClass: \"x-form-field x-form-num-field\",\n    \n    /**\n     * @cfg {Boolean} allowDecimals False to disallow decimal values (defaults to true)\n     */\n    allowDecimals : true,\n    \n    /**\n     * @cfg {String} decimalSeparator Character(s) to allow as the decimal separator (defaults to '.')\n     */\n    decimalSeparator : \".\",\n    \n    /**\n     * @cfg {Number} decimalPrecision The maximum precision to display after the decimal separator (defaults to 2)\n     */\n    decimalPrecision : 2,\n    \n    /**\n     * @cfg {Boolean} allowNegative False to prevent entering a negative sign (defaults to true)\n     */\n    allowNegative : true,\n    \n    /**\n     * @cfg {Number} minValue The minimum allowed value (defaults to Number.NEGATIVE_INFINITY)\n     */\n    minValue : Number.NEGATIVE_INFINITY,\n    \n    /**\n     * @cfg {Number} maxValue The maximum allowed value (defaults to Number.MAX_VALUE)\n     */\n    maxValue : Number.MAX_VALUE,\n    \n    /**\n     * @cfg {String} minText Error text to display if the minimum value validation fails (defaults to \"The minimum value for this field is {minValue}\")\n     */\n    minText : \"The minimum value for this field is {0}\",\n    \n    /**\n     * @cfg {String} maxText Error text to display if the maximum value validation fails (defaults to \"The maximum value for this field is {maxValue}\")\n     */\n    maxText : \"The maximum value for this field is {0}\",\n    \n    /**\n     * @cfg {String} nanText Error text to display if the value is not a valid number.  For example, this can happen\n     * if a valid character like '.' or '-' is left in the field with no number (defaults to \"{value} is not a valid number\")\n     */\n    nanText : \"{0} is not a valid number\",\n    \n    /**\n     * @cfg {String} baseChars The base set of characters to evaluate as valid numbers (defaults to '0123456789').\n     */\n    baseChars : \"0123456789\",\n    \n    /**\n     * @cfg {Boolean} autoStripChars True to automatically strip not allowed characters from the field. Defaults to <tt>false</tt>\n     */\n    autoStripChars: false,\n\n    // private\n    initEvents : function() {\n        var allowed = this.baseChars + '';\n        if (this.allowDecimals) {\n            allowed += this.decimalSeparator;\n        }\n        if (this.allowNegative) {\n            allowed += '-';\n        }\n        allowed = Ext.escapeRe(allowed);\n        this.maskRe = new RegExp('[' + allowed + ']');\n        if (this.autoStripChars) {\n            this.stripCharsRe = new RegExp('[^' + allowed + ']', 'gi');\n        }\n        \n        Ext.form.NumberField.superclass.initEvents.call(this);\n    },\n    \n    /**\n     * Runs all of NumberFields validations and returns an array of any errors. Note that this first\n     * runs TextField's validations, so the returned array is an amalgamation of all field errors.\n     * The additional validations run test that the value is a number, and that it is within the\n     * configured min and max values.\n     * @param {Mixed} value The value to get errors for (defaults to the current field value)\n     * @return {Array} All validation errors for this field\n     */\n    getErrors: function(value) {\n        var errors = Ext.form.NumberField.superclass.getErrors.apply(this, arguments);\n        \n        value = Ext.isDefined(value) ? value : this.processValue(this.getRawValue());\n        \n        if (value.length < 1) { // if it's blank and textfield didn't flag it then it's valid\n             return errors;\n        }\n        \n        value = String(value).replace(this.decimalSeparator, \".\");\n        \n        if(isNaN(value)){\n            errors.push(String.format(this.nanText, value));\n        }\n        \n        var num = this.parseValue(value);\n        \n        if (num < this.minValue) {\n            errors.push(String.format(this.minText, this.minValue));\n        }\n        \n        if (num > this.maxValue) {\n            errors.push(String.format(this.maxText, this.maxValue));\n        }\n        \n        return errors;\n    },\n\n    getValue : function() {\n        return this.fixPrecision(this.parseValue(Ext.form.NumberField.superclass.getValue.call(this)));\n    },\n\n    setValue : function(v) {\n    \tv = Ext.isNumber(v) ? v : parseFloat(String(v).replace(this.decimalSeparator, \".\"));\n        v = this.fixPrecision(v);\n        v = isNaN(v) ? '' : String(v).replace(\".\", this.decimalSeparator);\n        return Ext.form.NumberField.superclass.setValue.call(this, v);\n    },\n    \n    /**\n     * Replaces any existing {@link #minValue} with the new value.\n     * @param {Number} value The minimum value\n     */\n    setMinValue : function(value) {\n        this.minValue = Ext.num(value, Number.NEGATIVE_INFINITY);\n    },\n    \n    /**\n     * Replaces any existing {@link #maxValue} with the new value.\n     * @param {Number} value The maximum value\n     */\n    setMaxValue : function(value) {\n        this.maxValue = Ext.num(value, Number.MAX_VALUE);    \n    },\n\n    // private\n    parseValue : function(value) {\n        value = parseFloat(String(value).replace(this.decimalSeparator, \".\"));\n        return isNaN(value) ? '' : value;\n    },\n\n    /**\n     * @private\n     * \n     */\n    fixPrecision : function(value) {\n        var nan = isNaN(value);\n        \n        if (!this.allowDecimals || this.decimalPrecision == -1 || nan || !value) {\n            return nan ? '' : value;\n        }\n        \n        return parseFloat(parseFloat(value).toFixed(this.decimalPrecision));\n    },\n\n    beforeBlur : function() {\n        var v = this.parseValue(this.getRawValue());\n        \n        if (!Ext.isEmpty(v)) {\n            this.setValue(v);\n        }\n    }\n});\n\nExt.reg('numberfield', Ext.form.NumberField);\n/**\n * @class Ext.form.DateField\n * @extends Ext.form.TriggerField\n * Provides a date input field with a {@link Ext.DatePicker} dropdown and automatic date validation.\n * @constructor\n * Create a new DateField\n * @param {Object} config\n * @xtype datefield\n */\nExt.form.DateField = Ext.extend(Ext.form.TriggerField,  {\n    /**\n     * @cfg {String} format\n     * The default date format string which can be overriden for localization support.  The format must be\n     * valid according to {@link Date#parseDate} (defaults to <tt>'m/d/Y'</tt>).\n     */\n    format : \"m/d/Y\",\n    /**\n     * @cfg {String} altFormats\n     * Multiple date formats separated by \"<tt>|</tt>\" to try when parsing a user input value and it\n     * does not match the defined format (defaults to\n     * <tt>'m/d/Y|n/j/Y|n/j/y|m/j/y|n/d/y|m/j/Y|n/d/Y|m-d-y|m-d-Y|m/d|m-d|md|mdy|mdY|d|Y-m-d|n-j|n/j'</tt>).\n     */\n    altFormats : \"m/d/Y|n/j/Y|n/j/y|m/j/y|n/d/y|m/j/Y|n/d/Y|m-d-y|m-d-Y|m/d|m-d|md|mdy|mdY|d|Y-m-d|n-j|n/j\",\n    /**\n     * @cfg {String} disabledDaysText\n     * The tooltip to display when the date falls on a disabled day (defaults to <tt>'Disabled'</tt>)\n     */\n    disabledDaysText : \"Disabled\",\n    /**\n     * @cfg {String} disabledDatesText\n     * The tooltip text to display when the date falls on a disabled date (defaults to <tt>'Disabled'</tt>)\n     */\n    disabledDatesText : \"Disabled\",\n    /**\n     * @cfg {String} minText\n     * The error text to display when the date in the cell is before <tt>{@link #minValue}</tt> (defaults to\n     * <tt>'The date in this field must be after {minValue}'</tt>).\n     */\n    minText : \"The date in this field must be equal to or after {0}\",\n    /**\n     * @cfg {String} maxText\n     * The error text to display when the date in the cell is after <tt>{@link #maxValue}</tt> (defaults to\n     * <tt>'The date in this field must be before {maxValue}'</tt>).\n     */\n    maxText : \"The date in this field must be equal to or before {0}\",\n    /**\n     * @cfg {String} invalidText\n     * The error text to display when the date in the field is invalid (defaults to\n     * <tt>'{value} is not a valid date - it must be in the format {format}'</tt>).\n     */\n    invalidText : \"{0} is not a valid date - it must be in the format {1}\",\n    /**\n     * @cfg {String} triggerClass\n     * An additional CSS class used to style the trigger button.  The trigger will always get the\n     * class <tt>'x-form-trigger'</tt> and <tt>triggerClass</tt> will be <b>appended</b> if specified\n     * (defaults to <tt>'x-form-date-trigger'</tt> which displays a calendar icon).\n     */\n    triggerClass : 'x-form-date-trigger',\n    /**\n     * @cfg {Boolean} showToday\n     * <tt>false</tt> to hide the footer area of the DatePicker containing the Today button and disable\n     * the keyboard handler for spacebar that selects the current date (defaults to <tt>true</tt>).\n     */\n    showToday : true,\n    \n    /**\n     * @cfg {Number} startDay\n     * Day index at which the week should begin, 0-based (defaults to 0, which is Sunday)\n     */\n    startDay : 0,\n    \n    /**\n     * @cfg {Date/String} minValue\n     * The minimum allowed date. Can be either a Javascript date object or a string date in a\n     * valid format (defaults to null).\n     */\n    /**\n     * @cfg {Date/String} maxValue\n     * The maximum allowed date. Can be either a Javascript date object or a string date in a\n     * valid format (defaults to null).\n     */\n    /**\n     * @cfg {Array} disabledDays\n     * An array of days to disable, 0 based (defaults to null). Some examples:<pre><code>\n// disable Sunday and Saturday:\ndisabledDays:  [0, 6]\n// disable weekdays:\ndisabledDays: [1,2,3,4,5]\n     * </code></pre>\n     */\n    /**\n     * @cfg {Array} disabledDates\n     * An array of \"dates\" to disable, as strings. These strings will be used to build a dynamic regular\n     * expression so they are very powerful. Some examples:<pre><code>\n// disable these exact dates:\ndisabledDates: [\"03/08/2003\", \"09/16/2003\"]\n// disable these days for every year:\ndisabledDates: [\"03/08\", \"09/16\"]\n// only match the beginning (useful if you are using short years):\ndisabledDates: [\"^03/08\"]\n// disable every day in March 2006:\ndisabledDates: [\"03/../2006\"]\n// disable every day in every March:\ndisabledDates: [\"^03\"]\n     * </code></pre>\n     * Note that the format of the dates included in the array should exactly match the {@link #format} config.\n     * In order to support regular expressions, if you are using a {@link #format date format} that has \".\" in\n     * it, you will have to escape the dot when restricting dates. For example: <tt>[\"03\\\\.08\\\\.03\"]</tt>.\n     */\n    /**\n     * @cfg {String/Object} autoCreate\n     * A {@link Ext.DomHelper DomHelper element specification object}, or <tt>true</tt> for the default element\n     * specification object:<pre><code>\n     * autoCreate: {tag: \"input\", type: \"text\", size: \"10\", autocomplete: \"off\"}\n     * </code></pre>\n     */\n\n    // private\n    defaultAutoCreate : {tag: \"input\", type: \"text\", size: \"10\", autocomplete: \"off\"},\n\n    // in the absence of a time value, a default value of 12 noon will be used\n    // (note: 12 noon was chosen because it steers well clear of all DST timezone changes)\n    initTime: '12', // 24 hour format\n\n    initTimeFormat: 'H',\n\n    // PUBLIC -- to be documented\n    safeParse : function(value, format) {\n        if (Date.formatContainsHourInfo(format)) {\n            // if parse format contains hour information, no DST adjustment is necessary\n            return Date.parseDate(value, format);\n        } else {\n            // set time to 12 noon, then clear the time\n            var parsedDate = Date.parseDate(value + ' ' + this.initTime, format + ' ' + this.initTimeFormat);\n \n            if (parsedDate) {\n                return parsedDate.clearTime();\n            }\n        }\n    },\n\n    initComponent : function(){\n        Ext.form.DateField.superclass.initComponent.call(this);\n\n        this.addEvents(\n            /**\n             * @event select\n             * Fires when a date is selected via the date picker.\n             * @param {Ext.form.DateField} this\n             * @param {Date} date The date that was selected\n             */\n            'select'\n        );\n\n        if(Ext.isString(this.minValue)){\n            this.minValue = this.parseDate(this.minValue);\n        }\n        if(Ext.isString(this.maxValue)){\n            this.maxValue = this.parseDate(this.maxValue);\n        }\n        this.disabledDatesRE = null;\n        this.initDisabledDays();\n    },\n\n    initEvents: function() {\n        Ext.form.DateField.superclass.initEvents.call(this);\n        this.keyNav = new Ext.KeyNav(this.el, {\n            \"down\": function(e) {\n                this.onTriggerClick();\n            },\n            scope: this,\n            forceKeyDown: true\n        });\n    },\n\n\n    // private\n    initDisabledDays : function(){\n        if(this.disabledDates){\n            var dd = this.disabledDates,\n                len = dd.length - 1,\n                re = \"(?:\";\n\n            Ext.each(dd, function(d, i){\n                re += Ext.isDate(d) ? '^' + Ext.escapeRe(d.dateFormat(this.format)) + '$' : dd[i];\n                if(i != len){\n                    re += '|';\n                }\n            }, this);\n            this.disabledDatesRE = new RegExp(re + ')');\n        }\n    },\n\n    /**\n     * Replaces any existing disabled dates with new values and refreshes the DatePicker.\n     * @param {Array} disabledDates An array of date strings (see the <tt>{@link #disabledDates}</tt> config\n     * for details on supported values) used to disable a pattern of dates.\n     */\n    setDisabledDates : function(dd){\n        this.disabledDates = dd;\n        this.initDisabledDays();\n        if(this.menu){\n            this.menu.picker.setDisabledDates(this.disabledDatesRE);\n        }\n    },\n\n    /**\n     * Replaces any existing disabled days (by index, 0-6) with new values and refreshes the DatePicker.\n     * @param {Array} disabledDays An array of disabled day indexes. See the <tt>{@link #disabledDays}</tt>\n     * config for details on supported values.\n     */\n    setDisabledDays : function(dd){\n        this.disabledDays = dd;\n        if(this.menu){\n            this.menu.picker.setDisabledDays(dd);\n        }\n    },\n\n    /**\n     * Replaces any existing <tt>{@link #minValue}</tt> with the new value and refreshes the DatePicker.\n     * @param {Date} value The minimum date that can be selected\n     */\n    setMinValue : function(dt){\n        this.minValue = (Ext.isString(dt) ? this.parseDate(dt) : dt);\n        if(this.menu){\n            this.menu.picker.setMinDate(this.minValue);\n        }\n    },\n\n    /**\n     * Replaces any existing <tt>{@link #maxValue}</tt> with the new value and refreshes the DatePicker.\n     * @param {Date} value The maximum date that can be selected\n     */\n    setMaxValue : function(dt){\n        this.maxValue = (Ext.isString(dt) ? this.parseDate(dt) : dt);\n        if(this.menu){\n            this.menu.picker.setMaxDate(this.maxValue);\n        }\n    },\n\n    /**\n     * Runs all of NumberFields validations and returns an array of any errors. Note that this first\n     * runs TextField's validations, so the returned array is an amalgamation of all field errors.\n     * The additional validation checks are testing that the date format is valid, that the chosen\n     * date is within the min and max date constraints set, that the date chosen is not in the disabledDates\n     * regex and that the day chosed is not one of the disabledDays.\n     * @param {Mixed} value The value to get errors for (defaults to the current field value)\n     * @return {Array} All validation errors for this field\n     */\n    getErrors: function(value) {\n        var errors = Ext.form.DateField.superclass.getErrors.apply(this, arguments);\n\n        value = this.formatDate(value || this.processValue(this.getRawValue()));\n\n        if (value.length < 1) { // if it's blank and textfield didn't flag it then it's valid\n             return errors;\n        }\n\n        var svalue = value;\n        value = this.parseDate(value);\n        if (!value) {\n            errors.push(String.format(this.invalidText, svalue, this.format));\n            return errors;\n        }\n\n        var time = value.getTime();\n        if (this.minValue && time < this.minValue.clearTime().getTime()) {\n            errors.push(String.format(this.minText, this.formatDate(this.minValue)));\n        }\n\n        if (this.maxValue && time > this.maxValue.clearTime().getTime()) {\n            errors.push(String.format(this.maxText, this.formatDate(this.maxValue)));\n        }\n\n        if (this.disabledDays) {\n            var day = value.getDay();\n\n            for(var i = 0; i < this.disabledDays.length; i++) {\n                if (day === this.disabledDays[i]) {\n                    errors.push(this.disabledDaysText);\n                    break;\n                }\n            }\n        }\n\n        var fvalue = this.formatDate(value);\n        if (this.disabledDatesRE && this.disabledDatesRE.test(fvalue)) {\n            errors.push(String.format(this.disabledDatesText, fvalue));\n        }\n\n        return errors;\n    },\n\n    // private\n    // Provides logic to override the default TriggerField.validateBlur which just returns true\n    validateBlur : function(){\n        return !this.menu || !this.menu.isVisible();\n    },\n\n    /**\n     * Returns the current date value of the date field.\n     * @return {Date} The date value\n     */\n    getValue : function(){\n        return this.parseDate(Ext.form.DateField.superclass.getValue.call(this)) || \"\";\n    },\n\n    /**\n     * Sets the value of the date field.  You can pass a date object or any string that can be\n     * parsed into a valid date, using <tt>{@link #format}</tt> as the date format, according\n     * to the same rules as {@link Date#parseDate} (the default format used is <tt>\"m/d/Y\"</tt>).\n     * <br />Usage:\n     * <pre><code>\n//All of these calls set the same date value (May 4, 2006)\n\n//Pass a date object:\nvar dt = new Date('5/4/2006');\ndateField.setValue(dt);\n\n//Pass a date string (default format):\ndateField.setValue('05/04/2006');\n\n//Pass a date string (custom format):\ndateField.format = 'Y-m-d';\ndateField.setValue('2006-05-04');\n</code></pre>\n     * @param {String/Date} date The date or valid date string\n     * @return {Ext.form.Field} this\n     */\n    setValue : function(date){\n        return Ext.form.DateField.superclass.setValue.call(this, this.formatDate(this.parseDate(date)));\n    },\n\n    // private\n    parseDate : function(value) {\n        if(!value || Ext.isDate(value)){\n            return value;\n        }\n\n        var v = this.safeParse(value, this.format),\n            af = this.altFormats,\n            afa = this.altFormatsArray;\n\n        if (!v && af) {\n            afa = afa || af.split(\"|\");\n\n            for (var i = 0, len = afa.length; i < len && !v; i++) {\n                v = this.safeParse(value, afa[i]);\n            }\n        }\n        return v;\n    },\n\n    // private\n    onDestroy : function(){\n        Ext.destroy(this.menu, this.keyNav);\n        Ext.form.DateField.superclass.onDestroy.call(this);\n    },\n\n    // private\n    formatDate : function(date){\n        return Ext.isDate(date) ? date.dateFormat(this.format) : date;\n    },\n\n    /**\n     * @method onTriggerClick\n     * @hide\n     */\n    // private\n    // Implements the default empty TriggerField.onTriggerClick function to display the DatePicker\n    onTriggerClick : function(){\n        if(this.disabled){\n            return;\n        }\n        if(this.menu == null){\n            this.menu = new Ext.menu.DateMenu({\n                hideOnClick: false,\n                focusOnSelect: false\n            });\n        }\n        this.onFocus();\n        Ext.apply(this.menu.picker,  {\n            minDate : this.minValue,\n            maxDate : this.maxValue,\n            disabledDatesRE : this.disabledDatesRE,\n            disabledDatesText : this.disabledDatesText,\n            disabledDays : this.disabledDays,\n            disabledDaysText : this.disabledDaysText,\n            format : this.format,\n            showToday : this.showToday,\n            startDay: this.startDay,\n            minText : String.format(this.minText, this.formatDate(this.minValue)),\n            maxText : String.format(this.maxText, this.formatDate(this.maxValue))\n        });\n        this.menu.picker.setValue(this.getValue() || new Date());\n        this.menu.show(this.el, \"tl-bl?\");\n        this.menuEvents('on');\n    },\n\n    //private\n    menuEvents: function(method){\n        this.menu[method]('select', this.onSelect, this);\n        this.menu[method]('hide', this.onMenuHide, this);\n        this.menu[method]('show', this.onFocus, this);\n    },\n\n    onSelect: function(m, d){\n        this.setValue(d);\n        this.fireEvent('select', this, d);\n        this.menu.hide();\n    },\n\n    onMenuHide: function(){\n        this.focus(false, 60);\n        this.menuEvents('un');\n    },\n\n    // private\n    beforeBlur : function(){\n        var v = this.parseDate(this.getRawValue());\n        if(v){\n            this.setValue(v);\n        }\n    }\n\n    /**\n     * @cfg {Boolean} grow @hide\n     */\n    /**\n     * @cfg {Number} growMin @hide\n     */\n    /**\n     * @cfg {Number} growMax @hide\n     */\n    /**\n     * @hide\n     * @method autoSize\n     */\n});\nExt.reg('datefield', Ext.form.DateField);\n/**\n * @class Ext.form.DisplayField\n * @extends Ext.form.Field\n * A display-only text field which is not validated and not submitted.\n * @constructor\n * Creates a new DisplayField.\n * @param {Object} config Configuration options\n * @xtype displayfield\n */\nExt.form.DisplayField = Ext.extend(Ext.form.Field,  {\n    validationEvent : false,\n    validateOnBlur : false,\n    defaultAutoCreate : {tag: \"div\"},\n    /**\n     * @cfg {String} fieldClass The default CSS class for the field (defaults to <tt>\"x-form-display-field\"</tt>)\n     */\n    fieldClass : \"x-form-display-field\",\n    /**\n     * @cfg {Boolean} htmlEncode <tt>false</tt> to skip HTML-encoding the text when rendering it (defaults to\n     * <tt>false</tt>). This might be useful if you want to include tags in the field's innerHTML rather than\n     * rendering them as string literals per the default logic.\n     */\n    htmlEncode: false,\n\n    // private\n    initEvents : Ext.emptyFn,\n\n    isValid : function(){\n        return true;\n    },\n\n    validate : function(){\n        return true;\n    },\n\n    getRawValue : function(){\n        var v = this.rendered ? this.el.dom.innerHTML : Ext.value(this.value, '');\n        if(v === this.emptyText){\n            v = '';\n        }\n        if(this.htmlEncode){\n            v = Ext.util.Format.htmlDecode(v);\n        }\n        return v;\n    },\n\n    getValue : function(){\n        return this.getRawValue();\n    },\n    \n    getName: function() {\n        return this.name;\n    },\n\n    setRawValue : function(v){\n        if(this.htmlEncode){\n            v = Ext.util.Format.htmlEncode(v);\n        }\n        return this.rendered ? (this.el.dom.innerHTML = (Ext.isEmpty(v) ? '' : v)) : (this.value = v);\n    },\n\n    setValue : function(v){\n        this.setRawValue(v);\n        return this;\n    }\n    /** \n     * @cfg {String} inputType \n     * @hide\n     */\n    /** \n     * @cfg {Boolean} disabled \n     * @hide\n     */\n    /** \n     * @cfg {Boolean} readOnly \n     * @hide\n     */\n    /** \n     * @cfg {Boolean} validateOnBlur \n     * @hide\n     */\n    /** \n     * @cfg {Number} validationDelay \n     * @hide\n     */\n    /** \n     * @cfg {String/Boolean} validationEvent \n     * @hide\n     */\n});\n\nExt.reg('displayfield', Ext.form.DisplayField);\n/**\n * @class Ext.form.ComboBox\n * @extends Ext.form.TriggerField\n * <p>A combobox control with support for autocomplete, remote-loading, paging and many other features.</p>\n * <p>A ComboBox works in a similar manner to a traditional HTML &lt;select> field. The difference is\n * that to submit the {@link #valueField}, you must specify a {@link #hiddenName} to create a hidden input\n * field to hold the value of the valueField. The <i>{@link #displayField}</i> is shown in the text field\n * which is named according to the {@link #name}.</p>\n * <p><b><u>Events</u></b></p>\n * <p>To do something when something in ComboBox is selected, configure the select event:<pre><code>\nvar cb = new Ext.form.ComboBox({\n    // all of your config options\n    listeners:{\n         scope: yourScope,\n         'select': yourFunction\n    }\n});\n\n// Alternatively, you can assign events after the object is created:\nvar cb = new Ext.form.ComboBox(yourOptions);\ncb.on('select', yourFunction, yourScope);\n * </code></pre></p>\n *\n * <p><b><u>ComboBox in Grid</u></b></p>\n * <p>If using a ComboBox in an {@link Ext.grid.EditorGridPanel Editor Grid} a {@link Ext.grid.Column#renderer renderer}\n * will be needed to show the displayField when the editor is not active.  Set up the renderer manually, or implement\n * a reusable render, for example:<pre><code>\n// create reusable renderer\nExt.util.Format.comboRenderer = function(combo){\n    return function(value){\n        var record = combo.findRecord(combo.{@link #valueField}, value);\n        return record ? record.get(combo.{@link #displayField}) : combo.{@link #valueNotFoundText};\n    }\n}\n\n// create the combo instance\nvar combo = new Ext.form.ComboBox({\n    {@link #typeAhead}: true,\n    {@link #triggerAction}: 'all',\n    {@link #lazyRender}:true,\n    {@link #mode}: 'local',\n    {@link #store}: new Ext.data.ArrayStore({\n        id: 0,\n        fields: [\n            'myId',\n            'displayText'\n        ],\n        data: [[1, 'item1'], [2, 'item2']]\n    }),\n    {@link #valueField}: 'myId',\n    {@link #displayField}: 'displayText'\n});\n\n// snippet of column model used within grid\nvar cm = new Ext.grid.ColumnModel([{\n       ...\n    },{\n       header: \"Some Header\",\n       dataIndex: 'whatever',\n       width: 130,\n       editor: combo, // specify reference to combo instance\n       renderer: Ext.util.Format.comboRenderer(combo) // pass combo instance to reusable renderer\n    },\n    ...\n]);\n * </code></pre></p>\n *\n * <p><b><u>Filtering</u></b></p>\n * <p>A ComboBox {@link #doQuery uses filtering itself}, for information about filtering the ComboBox\n * store manually see <tt>{@link #lastQuery}</tt>.</p>\n * @constructor\n * Create a new ComboBox.\n * @param {Object} config Configuration options\n * @xtype combo\n */\nExt.form.ComboBox = Ext.extend(Ext.form.TriggerField, {\n    /**\n     * @cfg {Mixed} transform The id, DOM node or element of an existing HTML SELECT to convert to a ComboBox.\n     * Note that if you specify this and the combo is going to be in an {@link Ext.form.BasicForm} or\n     * {@link Ext.form.FormPanel}, you must also set <tt>{@link #lazyRender} = true</tt>.\n     */\n    /**\n     * @cfg {Boolean} lazyRender <tt>true</tt> to prevent the ComboBox from rendering until requested\n     * (should always be used when rendering into an {@link Ext.Editor} (e.g. {@link Ext.grid.EditorGridPanel Grids}),\n     * defaults to <tt>false</tt>).\n     */\n    /**\n     * @cfg {String/Object} autoCreate <p>A {@link Ext.DomHelper DomHelper} element spec, or <tt>true</tt> for a default\n     * element spec. Used to create the {@link Ext.Component#getEl Element} which will encapsulate this Component.\n     * See <tt>{@link Ext.Component#autoEl autoEl}</tt> for details.  Defaults to:</p>\n     * <pre><code>{tag: \"input\", type: \"text\", size: \"24\", autocomplete: \"off\"}</code></pre>\n     */\n    /**\n     * @cfg {Ext.data.Store/Array} store The data source to which this combo is bound (defaults to <tt>undefined</tt>).\n     * Acceptable values for this property are:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>any {@link Ext.data.Store Store} subclass</b></li>\n     * <li><b>an Array</b> : Arrays will be converted to a {@link Ext.data.ArrayStore} internally,\n     * automatically generating {@link Ext.data.Field#name field names} to work with all data components.\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>1-dimensional array</b> : (e.g., <tt>['Foo','Bar']</tt>)<div class=\"sub-desc\">\n     * A 1-dimensional array will automatically be expanded (each array item will be used for both the combo\n     * {@link #valueField} and {@link #displayField})</div></li>\n     * <li><b>2-dimensional array</b> : (e.g., <tt>[['f','Foo'],['b','Bar']]</tt>)<div class=\"sub-desc\">\n     * For a multi-dimensional array, the value in index 0 of each item will be assumed to be the combo\n     * {@link #valueField}, while the value at index 1 is assumed to be the combo {@link #displayField}.\n     * </div></li></ul></div></li></ul></div>\n     * <p>See also <tt>{@link #mode}</tt>.</p>\n     */\n    /**\n     * @cfg {String} title If supplied, a header element is created containing this text and added into the top of\n     * the dropdown list (defaults to undefined, with no header element)\n     */\n\n    // private\n    defaultAutoCreate : {tag: \"input\", type: \"text\", size: \"24\", autocomplete: \"off\"},\n    /**\n     * @cfg {Number} listWidth The width (used as a parameter to {@link Ext.Element#setWidth}) of the dropdown\n     * list (defaults to the width of the ComboBox field).  See also <tt>{@link #minListWidth}</tt>\n     */\n    /**\n     * @cfg {String} displayField The underlying {@link Ext.data.Field#name data field name} to bind to this\n     * ComboBox (defaults to undefined if <tt>{@link #mode} = 'remote'</tt> or <tt>'field1'</tt> if\n     * {@link #transform transforming a select} or if the {@link #store field name is autogenerated based on\n     * the store configuration}).\n     * <p>See also <tt>{@link #valueField}</tt>.</p>\n     * <p><b>Note</b>: if using a ComboBox in an {@link Ext.grid.EditorGridPanel Editor Grid} a\n     * {@link Ext.grid.Column#renderer renderer} will be needed to show the displayField when the editor is not\n     * active.</p>\n     */\n    /**\n     * @cfg {String} valueField The underlying {@link Ext.data.Field#name data value name} to bind to this\n     * ComboBox (defaults to undefined if <tt>{@link #mode} = 'remote'</tt> or <tt>'field2'</tt> if\n     * {@link #transform transforming a select} or if the {@link #store field name is autogenerated based on\n     * the store configuration}).\n     * <p><b>Note</b>: use of a <tt>valueField</tt> requires the user to make a selection in order for a value to be\n     * mapped.  See also <tt>{@link #hiddenName}</tt>, <tt>{@link #hiddenValue}</tt>, and <tt>{@link #displayField}</tt>.</p>\n     */\n    /**\n     * @cfg {String} hiddenName If specified, a hidden form field with this name is dynamically generated to store the\n     * field's data value (defaults to the underlying DOM element's name). Required for the combo's value to automatically\n     * post during a form submission.  See also {@link #valueField}.\n     */\n    /**\n     * @cfg {String} hiddenId If <tt>{@link #hiddenName}</tt> is specified, <tt>hiddenId</tt> can also be provided\n     * to give the hidden field a unique id.  The <tt>hiddenId</tt> and combo {@link Ext.Component#id id} should be\n     * different, since no two DOM nodes should share the same id.\n     */\n    /**\n     * @cfg {String} hiddenValue Sets the initial value of the hidden field if {@link #hiddenName} is\n     * specified to contain the selected {@link #valueField}, from the Store. Defaults to the configured\n     * <tt>{@link Ext.form.Field#value value}</tt>.\n     */\n    /**\n     * @cfg {String} listClass The CSS class to add to the predefined <tt>'x-combo-list'</tt> class\n     * applied the dropdown list element (defaults to '').\n     */\n    listClass : '',\n    /**\n     * @cfg {String} selectedClass CSS class to apply to the selected item in the dropdown list\n     * (defaults to <tt>'x-combo-selected'</tt>)\n     */\n    selectedClass : 'x-combo-selected',\n    /**\n     * @cfg {String} listEmptyText The empty text to display in the data view if no items are found.\n     * (defaults to '')\n     */\n    listEmptyText: '',\n    /**\n     * @cfg {String} triggerClass An additional CSS class used to style the trigger button.  The trigger will always\n     * get the class <tt>'x-form-trigger'</tt> and <tt>triggerClass</tt> will be <b>appended</b> if specified\n     * (defaults to <tt>'x-form-arrow-trigger'</tt> which displays a downward arrow icon).\n     */\n    triggerClass : 'x-form-arrow-trigger',\n    /**\n     * @cfg {Boolean/String} shadow <tt>true</tt> or <tt>\"sides\"</tt> for the default effect, <tt>\"frame\"</tt> for\n     * 4-way shadow, and <tt>\"drop\"</tt> for bottom-right\n     */\n    shadow : 'sides',\n    /**\n     * @cfg {String/Array} listAlign A valid anchor position value. See <tt>{@link Ext.Element#alignTo}</tt> for details\n     * on supported anchor positions and offsets. To specify x/y offsets as well, this value\n     * may be specified as an Array of <tt>{@link Ext.Element#alignTo}</tt> method arguments.</p>\n     * <pre><code>[ 'tl-bl?', [6,0] ]</code></pre>(defaults to <tt>'tl-bl?'</tt>)\n     */\n    listAlign : 'tl-bl?',\n    /**\n     * @cfg {Number} maxHeight The maximum height in pixels of the dropdown list before scrollbars are shown\n     * (defaults to <tt>300</tt>)\n     */\n    maxHeight : 300,\n    /**\n     * @cfg {Number} minHeight The minimum height in pixels of the dropdown list when the list is constrained by its\n     * distance to the viewport edges (defaults to <tt>90</tt>)\n     */\n    minHeight : 90,\n    /**\n     * @cfg {String} triggerAction The action to execute when the trigger is clicked.\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b><tt>'query'</tt></b> : <b>Default</b>\n     * <p class=\"sub-desc\">{@link #doQuery run the query} using the {@link Ext.form.Field#getRawValue raw value}.</p></li>\n     * <li><b><tt>'all'</tt></b> :\n     * <p class=\"sub-desc\">{@link #doQuery run the query} specified by the <tt>{@link #allQuery}</tt> config option</p></li>\n     * </ul></div>\n     * <p>See also <code>{@link #queryParam}</code>.</p>\n     */\n    triggerAction : 'query',\n    /**\n     * @cfg {Number} minChars The minimum number of characters the user must type before autocomplete and\n     * {@link #typeAhead} activate (defaults to <tt>4</tt> if <tt>{@link #mode} = 'remote'</tt> or <tt>0</tt> if\n     * <tt>{@link #mode} = 'local'</tt>, does not apply if\n     * <tt>{@link Ext.form.TriggerField#editable editable} = false</tt>).\n     */\n    minChars : 4,\n    /**\n     * @cfg {Boolean} autoSelect <tt>true</tt> to select the first result gathered by the data store (defaults\n     * to <tt>true</tt>).  A false value would require a manual selection from the dropdown list to set the components value\n     * unless the value of ({@link #typeAheadDelay}) were true.\n     */\n    autoSelect : true,\n    /**\n     * @cfg {Boolean} typeAhead <tt>true</tt> to populate and autoselect the remainder of the text being\n     * typed after a configurable delay ({@link #typeAheadDelay}) if it matches a known value (defaults\n     * to <tt>false</tt>)\n     */\n    typeAhead : false,\n    /**\n     * @cfg {Number} queryDelay The length of time in milliseconds to delay between the start of typing and\n     * sending the query to filter the dropdown list (defaults to <tt>500</tt> if <tt>{@link #mode} = 'remote'</tt>\n     * or <tt>10</tt> if <tt>{@link #mode} = 'local'</tt>)\n     */\n    queryDelay : 500,\n    /**\n     * @cfg {Number} pageSize If greater than <tt>0</tt>, a {@link Ext.PagingToolbar} is displayed in the\n     * footer of the dropdown list and the {@link #doQuery filter queries} will execute with page start and\n     * {@link Ext.PagingToolbar#pageSize limit} parameters. Only applies when <tt>{@link #mode} = 'remote'</tt>\n     * (defaults to <tt>0</tt>).\n     */\n    pageSize : 0,\n    /**\n     * @cfg {Boolean} selectOnFocus <tt>true</tt> to select any existing text in the field immediately on focus.\n     * Only applies when <tt>{@link Ext.form.TriggerField#editable editable} = true</tt> (defaults to\n     * <tt>false</tt>).\n     */\n    selectOnFocus : false,\n    /**\n     * @cfg {String} queryParam Name of the query ({@link Ext.data.Store#baseParam baseParam} name for the store)\n     * as it will be passed on the querystring (defaults to <tt>'query'</tt>)\n     */\n    queryParam : 'query',\n    /**\n     * @cfg {String} loadingText The text to display in the dropdown list while data is loading.  Only applies\n     * when <tt>{@link #mode} = 'remote'</tt> (defaults to <tt>'Loading...'</tt>)\n     */\n    loadingText : 'Loading...',\n    /**\n     * @cfg {Boolean} resizable <tt>true</tt> to add a resize handle to the bottom of the dropdown list\n     * (creates an {@link Ext.Resizable} with 'se' {@link Ext.Resizable#pinned pinned} handles).\n     * Defaults to <tt>false</tt>.\n     */\n    resizable : false,\n    /**\n     * @cfg {Number} handleHeight The height in pixels of the dropdown list resize handle if\n     * <tt>{@link #resizable} = true</tt> (defaults to <tt>8</tt>)\n     */\n    handleHeight : 8,\n    /**\n     * @cfg {String} allQuery The text query to send to the server to return all records for the list\n     * with no filtering (defaults to '')\n     */\n    allQuery: '',\n    /**\n     * @cfg {String} mode Acceptable values are:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b><tt>'remote'</tt></b> : <b>Default</b>\n     * <p class=\"sub-desc\">Automatically loads the <tt>{@link #store}</tt> the <b>first</b> time the trigger\n     * is clicked. If you do not want the store to be automatically loaded the first time the trigger is\n     * clicked, set to <tt>'local'</tt> and manually load the store.  To force a requery of the store\n     * <b>every</b> time the trigger is clicked see <tt>{@link #lastQuery}</tt>.</p></li>\n     * <li><b><tt>'local'</tt></b> :\n     * <p class=\"sub-desc\">ComboBox loads local data</p>\n     * <pre><code>\nvar combo = new Ext.form.ComboBox({\n    renderTo: document.body,\n    mode: 'local',\n    store: new Ext.data.ArrayStore({\n        id: 0,\n        fields: [\n            'myId',  // numeric value is the key\n            'displayText'\n        ],\n        data: [[1, 'item1'], [2, 'item2']]  // data is local\n    }),\n    valueField: 'myId',\n    displayField: 'displayText',\n    triggerAction: 'all'\n});\n     * </code></pre></li>\n     * </ul></div>\n     */\n    mode: 'remote',\n    /**\n     * @cfg {Number} minListWidth The minimum width of the dropdown list in pixels (defaults to <tt>70</tt>, will\n     * be ignored if <tt>{@link #listWidth}</tt> has a higher value)\n     */\n    minListWidth : 70,\n    /**\n     * @cfg {Boolean} forceSelection <tt>true</tt> to restrict the selected value to one of the values in the list,\n     * <tt>false</tt> to allow the user to set arbitrary text into the field (defaults to <tt>false</tt>)\n     */\n    forceSelection : false,\n    /**\n     * @cfg {Number} typeAheadDelay The length of time in milliseconds to wait until the typeahead text is displayed\n     * if <tt>{@link #typeAhead} = true</tt> (defaults to <tt>250</tt>)\n     */\n    typeAheadDelay : 250,\n    /**\n     * @cfg {String} valueNotFoundText When using a name/value combo, if the value passed to setValue is not found in\n     * the store, valueNotFoundText will be displayed as the field text if defined (defaults to undefined). If this\n     * default text is used, it means there is no value set and no validation will occur on this field.\n     */\n\n    /**\n     * @cfg {Boolean} lazyInit <tt>true</tt> to not initialize the list for this combo until the field is focused\n     * (defaults to <tt>true</tt>)\n     */\n    lazyInit : true,\n\n    /**\n     * @cfg {Boolean} clearFilterOnReset <tt>true</tt> to clear any filters on the store (when in local mode) when reset is called\n     * (defaults to <tt>true</tt>)\n     */\n    clearFilterOnReset : true,\n\n    /**\n     * @cfg {Boolean} submitValue False to clear the name attribute on the field so that it is not submitted during a form post.\n     * If a hiddenName is specified, setting this to true will cause both the hidden field and the element to be submitted.\n     * Defaults to <tt>undefined</tt>.\n     */\n    submitValue: undefined,\n\n    /**\n     * The value of the match string used to filter the store. Delete this property to force a requery.\n     * Example use:\n     * <pre><code>\nvar combo = new Ext.form.ComboBox({\n    ...\n    mode: 'remote',\n    ...\n    listeners: {\n        // delete the previous query in the beforequery event or set\n        // combo.lastQuery = null (this will reload the store the next time it expands)\n        beforequery: function(qe){\n            delete qe.combo.lastQuery;\n        }\n    }\n});\n     * </code></pre>\n     * To make sure the filter in the store is not cleared the first time the ComboBox trigger is used\n     * configure the combo with <tt>lastQuery=''</tt>. Example use:\n     * <pre><code>\nvar combo = new Ext.form.ComboBox({\n    ...\n    mode: 'local',\n    triggerAction: 'all',\n    lastQuery: ''\n});\n     * </code></pre>\n     * @property lastQuery\n     * @type String\n     */\n\n    // private\n    initComponent : function(){\n        Ext.form.ComboBox.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event expand\n             * Fires when the dropdown list is expanded\n             * @param {Ext.form.ComboBox} combo This combo box\n             */\n            'expand',\n            /**\n             * @event collapse\n             * Fires when the dropdown list is collapsed\n             * @param {Ext.form.ComboBox} combo This combo box\n             */\n            'collapse',\n\n            /**\n             * @event beforeselect\n             * Fires before a list item is selected. Return false to cancel the selection.\n             * @param {Ext.form.ComboBox} combo This combo box\n             * @param {Ext.data.Record} record The data record returned from the underlying store\n             * @param {Number} index The index of the selected item in the dropdown list\n             */\n            'beforeselect',\n            /**\n             * @event select\n             * Fires when a list item is selected\n             * @param {Ext.form.ComboBox} combo This combo box\n             * @param {Ext.data.Record} record The data record returned from the underlying store\n             * @param {Number} index The index of the selected item in the dropdown list\n             */\n            'select',\n            /**\n             * @event beforequery\n             * Fires before all queries are processed. Return false to cancel the query or set the queryEvent's\n             * cancel property to true.\n             * @param {Object} queryEvent An object that has these properties:<ul>\n             * <li><code>combo</code> : Ext.form.ComboBox <div class=\"sub-desc\">This combo box</div></li>\n             * <li><code>query</code> : String <div class=\"sub-desc\">The query</div></li>\n             * <li><code>forceAll</code> : Boolean <div class=\"sub-desc\">True to force \"all\" query</div></li>\n             * <li><code>cancel</code> : Boolean <div class=\"sub-desc\">Set to true to cancel the query</div></li>\n             * </ul>\n             */\n            'beforequery'\n        );\n        if(this.transform){\n            var s = Ext.getDom(this.transform);\n            if(!this.hiddenName){\n                this.hiddenName = s.name;\n            }\n            if(!this.store){\n                this.mode = 'local';\n                var d = [], opts = s.options;\n                for(var i = 0, len = opts.length;i < len; i++){\n                    var o = opts[i],\n                        value = (o.hasAttribute ? o.hasAttribute('value') : o.getAttributeNode('value').specified) ? o.value : o.text;\n                    if(o.selected && Ext.isEmpty(this.value, true)) {\n                        this.value = value;\n                    }\n                    d.push([value, o.text]);\n                }\n                this.store = new Ext.data.ArrayStore({\n                    idIndex: 0,\n                    fields: ['value', 'text'],\n                    data : d,\n                    autoDestroy: true\n                });\n                this.valueField = 'value';\n                this.displayField = 'text';\n            }\n            s.name = Ext.id(); // wipe out the name in case somewhere else they have a reference\n            if(!this.lazyRender){\n                this.target = true;\n                this.el = Ext.DomHelper.insertBefore(s, this.autoCreate || this.defaultAutoCreate);\n                this.render(this.el.parentNode, s);\n            }\n            Ext.removeNode(s);\n        }\n        //auto-configure store from local array data\n        else if(this.store){\n            this.store = Ext.StoreMgr.lookup(this.store);\n            if(this.store.autoCreated){\n                this.displayField = this.valueField = 'field1';\n                if(!this.store.expandData){\n                    this.displayField = 'field2';\n                }\n                this.mode = 'local';\n            }\n        }\n\n        this.selectedIndex = -1;\n        if(this.mode == 'local'){\n            if(!Ext.isDefined(this.initialConfig.queryDelay)){\n                this.queryDelay = 10;\n            }\n            if(!Ext.isDefined(this.initialConfig.minChars)){\n                this.minChars = 0;\n            }\n        }\n    },\n\n    // private\n    onRender : function(ct, position){\n        if(this.hiddenName && !Ext.isDefined(this.submitValue)){\n            this.submitValue = false;\n        }\n        Ext.form.ComboBox.superclass.onRender.call(this, ct, position);\n        if(this.hiddenName){\n            this.hiddenField = this.el.insertSibling({tag:'input', type:'hidden', name: this.hiddenName,\n                    id: (this.hiddenId || Ext.id())}, 'before', true);\n\n        }\n        if(Ext.isGecko){\n            this.el.dom.setAttribute('autocomplete', 'off');\n        }\n\n        if(!this.lazyInit){\n            this.initList();\n        }else{\n            this.on('focus', this.initList, this, {single: true});\n        }\n    },\n\n    // private\n    initValue : function(){\n        Ext.form.ComboBox.superclass.initValue.call(this);\n        if(this.hiddenField){\n            this.hiddenField.value =\n                Ext.value(Ext.isDefined(this.hiddenValue) ? this.hiddenValue : this.value, '');\n        }\n    },\n\n    getParentZIndex : function(){\n        var zindex;\n        if (this.ownerCt){\n            this.findParentBy(function(ct){\n                zindex = parseInt(ct.getPositionEl().getStyle('z-index'), 10);\n                return !!zindex;\n            });\n        }\n        return zindex;\n    },\n\n    getZIndex : function(listParent){\n        listParent = listParent || Ext.getDom(this.getListParent() || Ext.getBody());\n        var zindex = parseInt(Ext.fly(listParent).getStyle('z-index'), 10);\n        if(!zindex){\n            zindex = this.getParentZIndex();\n        }\n        return (zindex || 12000) + 5;\n    },\n\n    // private\n    initList : function(){\n        if(!this.list){\n            var cls = 'x-combo-list',\n                listParent = Ext.getDom(this.getListParent() || Ext.getBody());\n\n            this.list = new Ext.Layer({\n                parentEl: listParent,\n                shadow: this.shadow,\n                cls: [cls, this.listClass].join(' '),\n                constrain:false,\n                zindex: this.getZIndex(listParent)\n            });\n\n            var lw = this.listWidth || Math.max(this.wrap.getWidth(), this.minListWidth);\n            this.list.setSize(lw, 0);\n            this.list.swallowEvent('mousewheel');\n            this.assetHeight = 0;\n            if(this.syncFont !== false){\n                this.list.setStyle('font-size', this.el.getStyle('font-size'));\n            }\n            if(this.title){\n                this.header = this.list.createChild({cls:cls+'-hd', html: this.title});\n                this.assetHeight += this.header.getHeight();\n            }\n\n            this.innerList = this.list.createChild({cls:cls+'-inner'});\n            this.mon(this.innerList, 'mouseover', this.onViewOver, this);\n            this.mon(this.innerList, 'mousemove', this.onViewMove, this);\n            this.innerList.setWidth(lw - this.list.getFrameWidth('lr'));\n\n            if(this.pageSize){\n                this.footer = this.list.createChild({cls:cls+'-ft'});\n                this.pageTb = new Ext.PagingToolbar({\n                    store: this.store,\n                    pageSize: this.pageSize,\n                    renderTo:this.footer\n                });\n                this.assetHeight += this.footer.getHeight();\n            }\n\n            if(!this.tpl){\n                /**\n                * @cfg {String/Ext.XTemplate} tpl <p>The template string, or {@link Ext.XTemplate} instance to\n                * use to display each item in the dropdown list. The dropdown list is displayed in a\n                * DataView. See {@link #view}.</p>\n                * <p>The default template string is:</p><pre><code>\n                  '&lt;tpl for=\".\">&lt;div class=\"x-combo-list-item\">{' + this.displayField + '}&lt;/div>&lt;/tpl>'\n                * </code></pre>\n                * <p>Override the default value to create custom UI layouts for items in the list.\n                * For example:</p><pre><code>\n                  '&lt;tpl for=\".\">&lt;div ext:qtip=\"{state}. {nick}\" class=\"x-combo-list-item\">{state}&lt;/div>&lt;/tpl>'\n                * </code></pre>\n                * <p>The template <b>must</b> contain one or more substitution parameters using field\n                * names from the Combo's</b> {@link #store Store}. In the example above an\n                * <pre>ext:qtip</pre> attribute is added to display other fields from the Store.</p>\n                * <p>To preserve the default visual look of list items, add the CSS class name\n                * <pre>x-combo-list-item</pre> to the template's container element.</p>\n                * <p>Also see {@link #itemSelector} for additional details.</p>\n                */\n                this.tpl = '<tpl for=\".\"><div class=\"'+cls+'-item\">{' + this.displayField + '}</div></tpl>';\n                /**\n                 * @cfg {String} itemSelector\n                 * <p>A simple CSS selector (e.g. div.some-class or span:first-child) that will be\n                 * used to determine what nodes the {@link #view Ext.DataView} which handles the dropdown\n                 * display will be working with.</p>\n                 * <p><b>Note</b>: this setting is <b>required</b> if a custom XTemplate has been\n                 * specified in {@link #tpl} which assigns a class other than <pre>'x-combo-list-item'</pre>\n                 * to dropdown list items</b>\n                 */\n            }\n\n            /**\n            * The {@link Ext.DataView DataView} used to display the ComboBox's options.\n            * @type Ext.DataView\n            */\n            this.view = new Ext.DataView({\n                applyTo: this.innerList,\n                tpl: this.tpl,\n                singleSelect: true,\n                selectedClass: this.selectedClass,\n                itemSelector: this.itemSelector || '.' + cls + '-item',\n                emptyText: this.listEmptyText,\n                deferEmptyText: false\n            });\n\n            this.mon(this.view, {\n                containerclick : this.onViewClick,\n                click : this.onViewClick,\n                scope :this\n            });\n\n            this.bindStore(this.store, true);\n\n            if(this.resizable){\n                this.resizer = new Ext.Resizable(this.list,  {\n                   pinned:true, handles:'se'\n                });\n                this.mon(this.resizer, 'resize', function(r, w, h){\n                    this.maxHeight = h-this.handleHeight-this.list.getFrameWidth('tb')-this.assetHeight;\n                    this.listWidth = w;\n                    this.innerList.setWidth(w - this.list.getFrameWidth('lr'));\n                    this.restrictHeight();\n                }, this);\n\n                this[this.pageSize?'footer':'innerList'].setStyle('margin-bottom', this.handleHeight+'px');\n            }\n        }\n    },\n\n    /**\n     * <p>Returns the element used to house this ComboBox's pop-up list. Defaults to the document body.</p>\n     * A custom implementation may be provided as a configuration option if the floating list needs to be rendered\n     * to a different Element. An example might be rendering the list inside a Menu so that clicking\n     * the list does not hide the Menu:<pre><code>\nvar store = new Ext.data.ArrayStore({\n    autoDestroy: true,\n    fields: ['initials', 'fullname'],\n    data : [\n        ['FF', 'Fred Flintstone'],\n        ['BR', 'Barney Rubble']\n    ]\n});\n\nvar combo = new Ext.form.ComboBox({\n    store: store,\n    displayField: 'fullname',\n    emptyText: 'Select a name...',\n    forceSelection: true,\n    getListParent: function() {\n        return this.el.up('.x-menu');\n    },\n    iconCls: 'no-icon', //use iconCls if placing within menu to shift to right side of menu\n    mode: 'local',\n    selectOnFocus: true,\n    triggerAction: 'all',\n    typeAhead: true,\n    width: 135\n});\n\nvar menu = new Ext.menu.Menu({\n    id: 'mainMenu',\n    items: [\n        combo // A Field in a Menu\n    ]\n});\n</code></pre>\n     */\n    getListParent : function() {\n        return document.body;\n    },\n\n    /**\n     * Returns the store associated with this combo.\n     * @return {Ext.data.Store} The store\n     */\n    getStore : function(){\n        return this.store;\n    },\n\n    // private\n    bindStore : function(store, initial){\n        if(this.store && !initial){\n            if(this.store !== store && this.store.autoDestroy){\n                this.store.destroy();\n            }else{\n                this.store.un('beforeload', this.onBeforeLoad, this);\n                this.store.un('load', this.onLoad, this);\n                this.store.un('exception', this.collapse, this);\n            }\n            if(!store){\n                this.store = null;\n                if(this.view){\n                    this.view.bindStore(null);\n                }\n                if(this.pageTb){\n                    this.pageTb.bindStore(null);\n                }\n            }\n        }\n        if(store){\n            if(!initial) {\n                this.lastQuery = null;\n                if(this.pageTb) {\n                    this.pageTb.bindStore(store);\n                }\n            }\n\n            this.store = Ext.StoreMgr.lookup(store);\n            this.store.on({\n                scope: this,\n                beforeload: this.onBeforeLoad,\n                load: this.onLoad,\n                exception: this.collapse\n            });\n\n            if(this.view){\n                this.view.bindStore(store);\n            }\n        }\n    },\n\n    reset : function(){\n        if(this.clearFilterOnReset && this.mode == 'local'){\n            this.store.clearFilter();\n        }\n        Ext.form.ComboBox.superclass.reset.call(this);\n    },\n\n    // private\n    initEvents : function(){\n        Ext.form.ComboBox.superclass.initEvents.call(this);\n\n        /**\n         * @property keyNav\n         * @type Ext.KeyNav\n         * <p>A {@link Ext.KeyNav KeyNav} object which handles navigation keys for this ComboBox. This performs actions\n         * based on keystrokes typed when the input field is focused.</p>\n         * <p><b>After the ComboBox has been rendered</b>, you may override existing navigation key functionality,\n         * or add your own based upon key names as specified in the {@link Ext.KeyNav KeyNav} class.</p>\n         * <p>The function is executed in the scope (<code>this</code> reference of the ComboBox. Example:</p><pre><code>\nmyCombo.keyNav.esc = function(e) {  // Override ESC handling function\n    this.collapse();                // Standard behaviour of Ext's ComboBox.\n    this.setValue(this.startValue); // We reset to starting value on ESC\n};\nmyCombo.keyNav.tab = function() {   // Override TAB handling function\n    this.onViewClick(false);        // Select the currently highlighted row\n};\n</code></pre>\n         */\n        this.keyNav = new Ext.KeyNav(this.el, {\n            \"up\" : function(e){\n                this.inKeyMode = true;\n                this.selectPrev();\n            },\n\n            \"down\" : function(e){\n                if(!this.isExpanded()){\n                    this.onTriggerClick();\n                }else{\n                    this.inKeyMode = true;\n                    this.selectNext();\n                }\n            },\n\n            \"enter\" : function(e){\n                this.onViewClick();\n            },\n\n            \"esc\" : function(e){\n                this.collapse();\n            },\n\n            \"tab\" : function(e){\n                if (this.forceSelection === true) {\n                    this.collapse();\n                } else {\n                    this.onViewClick(false);\n                }\n                return true;\n            },\n\n            scope : this,\n\n            doRelay : function(e, h, hname){\n                if(hname == 'down' || this.scope.isExpanded()){\n                    // this MUST be called before ComboBox#fireKey()\n                    var relay = Ext.KeyNav.prototype.doRelay.apply(this, arguments);\n                    if((((Ext.isIE9 && Ext.isStrict) || Ext.isIE10p) || !Ext.isIE) && Ext.EventManager.useKeydown){\n                        // call Combo#fireKey() for browsers which use keydown event (except IE)\n                        this.scope.fireKey(e);\n                    }\n                    return relay;\n                }\n                return true;\n            },\n\n            forceKeyDown : true,\n            defaultEventAction: 'stopEvent'\n        });\n        this.queryDelay = Math.max(this.queryDelay || 10,\n                this.mode == 'local' ? 10 : 250);\n        this.dqTask = new Ext.util.DelayedTask(this.initQuery, this);\n        if(this.typeAhead){\n            this.taTask = new Ext.util.DelayedTask(this.onTypeAhead, this);\n        }\n        if(!this.enableKeyEvents){\n            this.mon(this.el, 'keyup', this.onKeyUp, this);\n        }\n    },\n\n\n    // private\n    onDestroy : function(){\n        if (this.dqTask){\n            this.dqTask.cancel();\n            this.dqTask = null;\n        }\n        this.bindStore(null);\n        Ext.destroy(\n            this.resizer,\n            this.view,\n            this.pageTb,\n            this.list\n        );\n        Ext.destroyMembers(this, 'hiddenField');\n        Ext.form.ComboBox.superclass.onDestroy.call(this);\n    },\n\n    // private\n    fireKey : function(e){\n        if (!this.isExpanded()) {\n            Ext.form.ComboBox.superclass.fireKey.call(this, e);\n        }\n    },\n\n    // private\n    onResize : function(w, h){\n        Ext.form.ComboBox.superclass.onResize.apply(this, arguments);\n        if(!isNaN(w) && this.isVisible() && this.list){\n            this.doResize(w);\n        }else{\n            this.bufferSize = w;\n        }\n    },\n\n    doResize: function(w){\n        if(!Ext.isDefined(this.listWidth)){\n            var lw = Math.max(w, this.minListWidth);\n            this.list.setWidth(lw);\n            this.innerList.setWidth(lw - this.list.getFrameWidth('lr'));\n        }\n    },\n\n    // private\n    onEnable : function(){\n        Ext.form.ComboBox.superclass.onEnable.apply(this, arguments);\n        if(this.hiddenField){\n            this.hiddenField.disabled = false;\n        }\n    },\n\n    // private\n    onDisable : function(){\n        Ext.form.ComboBox.superclass.onDisable.apply(this, arguments);\n        if(this.hiddenField){\n            this.hiddenField.disabled = true;\n        }\n    },\n\n    // private\n    onBeforeLoad : function(){\n        if(!this.hasFocus){\n            return;\n        }\n        this.innerList.update(this.loadingText ?\n               '<div class=\"loading-indicator\">'+this.loadingText+'</div>' : '');\n        this.restrictHeight();\n        this.selectedIndex = -1;\n    },\n\n    // private\n    onLoad : function(){\n        if(!this.hasFocus){\n            return;\n        }\n        if(this.store.getCount() > 0 || this.listEmptyText){\n            this.expand();\n            this.restrictHeight();\n            if(this.lastQuery == this.allQuery){\n                if(this.editable){\n                    this.el.dom.select();\n                }\n\n                if(this.autoSelect !== false && !this.selectByValue(this.value, true)){\n                    this.select(0, true);\n                }\n            }else{\n                if(this.autoSelect !== false){\n                    this.selectNext();\n                }\n                if(this.typeAhead && this.lastKey != Ext.EventObject.BACKSPACE && this.lastKey != Ext.EventObject.DELETE){\n                    this.taTask.delay(this.typeAheadDelay);\n                }\n            }\n        }else{\n            this.collapse();\n        }\n\n    },\n\n    // private\n    onTypeAhead : function(){\n        if(this.store.getCount() > 0){\n            var r = this.store.getAt(0);\n            var newValue = r.data[this.displayField];\n            var len = newValue.length;\n            var selStart = this.getRawValue().length;\n            if(selStart != len){\n                this.setRawValue(newValue);\n                this.selectText(selStart, newValue.length);\n            }\n        }\n    },\n\n    // private\n    assertValue : function(){\n        var val = this.getRawValue(),\n            rec;\n\n        if(this.valueField && Ext.isDefined(this.value)){\n            rec = this.findRecord(this.valueField, this.value);\n        }\n        if(!rec || rec.get(this.displayField) != val){\n            rec = this.findRecord(this.displayField, val);\n        }\n        if(!rec && this.forceSelection){\n            if(val.length > 0 && val != this.emptyText){\n                this.el.dom.value = Ext.value(this.lastSelectionText, '');\n                this.applyEmptyText();\n            }else{\n                this.clearValue();\n            }\n        }else{\n            if(rec && this.valueField){\n                // onSelect may have already set the value and by doing so\n                // set the display field properly.  Let's not wipe out the\n                // valueField here by just sending the displayField.\n                if (this.value == val){\n                    return;\n                }\n                val = rec.get(this.valueField || this.displayField);\n            }\n            this.setValue(val);\n        }\n    },\n\n    // private\n    onSelect : function(record, index){\n        if(this.fireEvent('beforeselect', this, record, index) !== false){\n            this.setValue(record.data[this.valueField || this.displayField]);\n            this.collapse();\n            this.fireEvent('select', this, record, index);\n        }\n    },\n\n    // inherit docs\n    getName: function(){\n        var hf = this.hiddenField;\n        return hf && hf.name ? hf.name : this.hiddenName || Ext.form.ComboBox.superclass.getName.call(this);\n    },\n\n    /**\n     * Returns the currently selected field value or empty string if no value is set.\n     * @return {String} value The selected value\n     */\n    getValue : function(){\n        if(this.valueField){\n            return Ext.isDefined(this.value) ? this.value : '';\n        }else{\n            return Ext.form.ComboBox.superclass.getValue.call(this);\n        }\n    },\n\n    /**\n     * Clears any text/value currently set in the field\n     */\n    clearValue : function(){\n        if(this.hiddenField){\n            this.hiddenField.value = '';\n        }\n        this.setRawValue('');\n        this.lastSelectionText = '';\n        this.applyEmptyText();\n        this.value = '';\n    },\n\n    /**\n     * Sets the specified value into the field.  If the value finds a match, the corresponding record text\n     * will be displayed in the field.  If the value does not match the data value of an existing item,\n     * and the valueNotFoundText config option is defined, it will be displayed as the default field text.\n     * Otherwise the field will be blank (although the value will still be set).\n     * @param {String} value The value to match\n     * @return {Ext.form.Field} this\n     */\n    setValue : function(v){\n        var text = v;\n        if(this.valueField){\n            var r = this.findRecord(this.valueField, v);\n            if(r){\n                text = r.data[this.displayField];\n            }else if(Ext.isDefined(this.valueNotFoundText)){\n                text = this.valueNotFoundText;\n            }\n        }\n        this.lastSelectionText = text;\n        if(this.hiddenField){\n            this.hiddenField.value = Ext.value(v, '');\n        }\n        Ext.form.ComboBox.superclass.setValue.call(this, text);\n        this.value = v;\n        return this;\n    },\n\n    // private\n    findRecord : function(prop, value){\n        var record;\n        if(this.store.getCount() > 0){\n            this.store.each(function(r){\n                if(r.data[prop] == value){\n                    record = r;\n                    return false;\n                }\n            });\n        }\n        return record;\n    },\n\n    // private\n    onViewMove : function(e, t){\n        this.inKeyMode = false;\n    },\n\n    // private\n    onViewOver : function(e, t){\n        if(this.inKeyMode){ // prevent key nav and mouse over conflicts\n            return;\n        }\n        var item = this.view.findItemFromChild(t);\n        if(item){\n            var index = this.view.indexOf(item);\n            this.select(index, false);\n        }\n    },\n\n    // private\n    onViewClick : function(doFocus){\n        var index = this.view.getSelectedIndexes()[0],\n            s = this.store,\n            r = s.getAt(index);\n        if(r){\n            this.onSelect(r, index);\n        }else {\n            this.collapse();\n        }\n        if(doFocus !== false){\n            this.el.focus();\n        }\n    },\n\n\n    // private\n    restrictHeight : function(){\n        this.innerList.dom.style.height = '';\n        var inner = this.innerList.dom,\n            pad = this.list.getFrameWidth('tb') + (this.resizable ? this.handleHeight : 0) + this.assetHeight,\n            h = Math.max(inner.clientHeight, inner.offsetHeight, inner.scrollHeight),\n            ha = this.getPosition()[1]-Ext.getBody().getScroll().top,\n            hb = Ext.lib.Dom.getViewHeight()-ha-this.getSize().height,\n            space = Math.max(ha, hb, this.minHeight || 0)-this.list.shadowOffset-pad-5;\n\n        h = Math.min(h, space, this.maxHeight);\n\n        this.innerList.setHeight(h);\n        this.list.beginUpdate();\n        this.list.setHeight(h+pad);\n        this.list.alignTo.apply(this.list, [this.el].concat(this.listAlign));\n        this.list.endUpdate();\n    },\n\n    /**\n     * Returns true if the dropdown list is expanded, else false.\n     */\n    isExpanded : function(){\n        return this.list && this.list.isVisible();\n    },\n\n    /**\n     * Select an item in the dropdown list by its data value. This function does NOT cause the select event to fire.\n     * The store must be loaded and the list expanded for this function to work, otherwise use setValue.\n     * @param {String} value The data value of the item to select\n     * @param {Boolean} scrollIntoView False to prevent the dropdown list from autoscrolling to display the\n     * selected item if it is not currently in view (defaults to true)\n     * @return {Boolean} True if the value matched an item in the list, else false\n     */\n    selectByValue : function(v, scrollIntoView){\n        if(!Ext.isEmpty(v, true)){\n            var r = this.findRecord(this.valueField || this.displayField, v);\n            if(r){\n                this.select(this.store.indexOf(r), scrollIntoView);\n                return true;\n            }\n        }\n        return false;\n    },\n\n    /**\n     * Select an item in the dropdown list by its numeric index in the list. This function does NOT cause the select event to fire.\n     * The store must be loaded and the list expanded for this function to work, otherwise use setValue.\n     * @param {Number} index The zero-based index of the list item to select\n     * @param {Boolean} scrollIntoView False to prevent the dropdown list from autoscrolling to display the\n     * selected item if it is not currently in view (defaults to true)\n     */\n    select : function(index, scrollIntoView){\n        this.selectedIndex = index;\n        this.view.select(index);\n        if(scrollIntoView !== false){\n            var el = this.view.getNode(index);\n            if(el){\n                this.innerList.scrollChildIntoView(el, false);\n            }\n        }\n\n    },\n\n    // private\n    selectNext : function(){\n        var ct = this.store.getCount();\n        if(ct > 0){\n            if(this.selectedIndex == -1){\n                this.select(0);\n            }else if(this.selectedIndex < ct-1){\n                this.select(this.selectedIndex+1);\n            }\n        }\n    },\n\n    // private\n    selectPrev : function(){\n        var ct = this.store.getCount();\n        if(ct > 0){\n            if(this.selectedIndex == -1){\n                this.select(0);\n            }else if(this.selectedIndex !== 0){\n                this.select(this.selectedIndex-1);\n            }\n        }\n    },\n\n    // private\n    onKeyUp : function(e){\n        var k = e.getKey();\n        if(this.editable !== false && this.readOnly !== true && (k == e.BACKSPACE || !e.isSpecialKey())){\n\n            this.lastKey = k;\n            this.dqTask.delay(this.queryDelay);\n        }\n        Ext.form.ComboBox.superclass.onKeyUp.call(this, e);\n    },\n\n    // private\n    validateBlur : function(){\n        return !this.list || !this.list.isVisible();\n    },\n\n    // private\n    initQuery : function(){\n        this.doQuery(this.getRawValue());\n    },\n\n    // private\n    beforeBlur : function(){\n        this.assertValue();\n    },\n\n    // private\n    postBlur  : function(){\n        Ext.form.ComboBox.superclass.postBlur.call(this);\n        this.collapse();\n        this.inKeyMode = false;\n    },\n\n    /**\n     * Execute a query to filter the dropdown list.  Fires the {@link #beforequery} event prior to performing the\n     * query allowing the query action to be canceled if needed.\n     * @param {String} query The SQL query to execute\n     * @param {Boolean} forceAll <tt>true</tt> to force the query to execute even if there are currently fewer\n     * characters in the field than the minimum specified by the <tt>{@link #minChars}</tt> config option.  It\n     * also clears any filter previously saved in the current store (defaults to <tt>false</tt>)\n     */\n    doQuery : function(q, forceAll){\n        q = Ext.isEmpty(q) ? '' : q;\n        var qe = {\n            query: q,\n            forceAll: forceAll,\n            combo: this,\n            cancel:false\n        };\n        if(this.fireEvent('beforequery', qe)===false || qe.cancel){\n            return false;\n        }\n        q = qe.query;\n        forceAll = qe.forceAll;\n        if(forceAll === true || (q.length >= this.minChars)){\n            if(this.lastQuery !== q){\n                this.lastQuery = q;\n                if(this.mode == 'local'){\n                    this.selectedIndex = -1;\n                    if(forceAll){\n                        this.store.clearFilter();\n                    }else{\n                        this.store.filter(this.displayField, q);\n                    }\n                    this.onLoad();\n                }else{\n                    this.store.baseParams[this.queryParam] = q;\n                    this.store.load({\n                        params: this.getParams(q)\n                    });\n                    this.expand();\n                }\n            }else{\n                this.selectedIndex = -1;\n                this.onLoad();\n            }\n        }\n    },\n\n    // private\n    getParams : function(q){\n        var params = {},\n            paramNames = this.store.paramNames;\n        if(this.pageSize){\n            params[paramNames.start] = 0;\n            params[paramNames.limit] = this.pageSize;\n        }\n        return params;\n    },\n\n    /**\n     * Hides the dropdown list if it is currently expanded. Fires the {@link #collapse} event on completion.\n     */\n    collapse : function(){\n        if(!this.isExpanded()){\n            return;\n        }\n        this.list.hide();\n        Ext.getDoc().un('mousewheel', this.collapseIf, this);\n        Ext.getDoc().un('mousedown', this.collapseIf, this);\n        this.fireEvent('collapse', this);\n    },\n\n    // private\n    collapseIf : function(e){\n        if(!this.isDestroyed && !e.within(this.wrap) && !e.within(this.list)){\n            this.collapse();\n        }\n    },\n\n    /**\n     * Expands the dropdown list if it is currently hidden. Fires the {@link #expand} event on completion.\n     */\n    expand : function(){\n        if(this.isExpanded() || !this.hasFocus){\n            return;\n        }\n\n        if(this.title || this.pageSize){\n            this.assetHeight = 0;\n            if(this.title){\n                this.assetHeight += this.header.getHeight();\n            }\n            if(this.pageSize){\n                this.assetHeight += this.footer.getHeight();\n            }\n        }\n\n        if(this.bufferSize){\n            this.doResize(this.bufferSize);\n            delete this.bufferSize;\n        }\n        this.list.alignTo.apply(this.list, [this.el].concat(this.listAlign));\n\n        // zindex can change, re-check it and set it if necessary\n        this.list.setZIndex(this.getZIndex());\n        this.list.show();\n        if(Ext.isGecko2){\n            this.innerList.setOverflow('auto'); // necessary for FF 2.0/Mac\n        }\n        this.mon(Ext.getDoc(), {\n            scope: this,\n            mousewheel: this.collapseIf,\n            mousedown: this.collapseIf\n        });\n        this.fireEvent('expand', this);\n    },\n\n    /**\n     * @method onTriggerClick\n     * @hide\n     */\n    // private\n    // Implements the default empty TriggerField.onTriggerClick function\n    onTriggerClick : function(){\n        if(this.readOnly || this.disabled){\n            return;\n        }\n        if(this.isExpanded()){\n            this.collapse();\n            this.el.focus();\n        }else {\n            this.onFocus({});\n            if(this.triggerAction == 'all') {\n                this.doQuery(this.allQuery, true);\n            } else {\n                this.doQuery(this.getRawValue());\n            }\n            this.el.focus();\n        }\n    }\n\n    /**\n     * @hide\n     * @method autoSize\n     */\n    /**\n     * @cfg {Boolean} grow @hide\n     */\n    /**\n     * @cfg {Number} growMin @hide\n     */\n    /**\n     * @cfg {Number} growMax @hide\n     */\n\n});\nExt.reg('combo', Ext.form.ComboBox);\n/**\n * @class Ext.form.Checkbox\n * @extends Ext.form.Field\n * Single checkbox field.  Can be used as a direct replacement for traditional checkbox fields.\n * @constructor\n * Creates a new Checkbox\n * @param {Object} config Configuration options\n * @xtype checkbox\n */\nExt.form.Checkbox = Ext.extend(Ext.form.Field,  {\n    /**\n     * @cfg {String} focusClass The CSS class to use when the checkbox receives focus (defaults to undefined)\n     */\n    focusClass : undefined,\n    /**\n     * @cfg {String} fieldClass The default CSS class for the checkbox (defaults to 'x-form-field')\n     */\n    fieldClass : 'x-form-field',\n    /**\n     * @cfg {Boolean} checked <tt>true</tt> if the checkbox should render initially checked (defaults to <tt>false</tt>)\n     */\n    checked : false,\n    /**\n     * @cfg {String} boxLabel The text that appears beside the checkbox\n     */\n    boxLabel: '&#160;',\n    /**\n     * @cfg {String/Object} autoCreate A DomHelper element spec, or true for a default element spec (defaults to\n     * {tag: 'input', type: 'checkbox', autocomplete: 'off'})\n     */\n    defaultAutoCreate : { tag: 'input', type: 'checkbox', autocomplete: 'off'},\n    /**\n     * @cfg {String} inputValue The value that should go into the generated input element's value attribute\n     */\n    /**\n     * @cfg {Function} handler A function called when the {@link #checked} value changes (can be used instead of\n     * handling the check event). The handler is passed the following parameters:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>checkbox</b> : Ext.form.Checkbox<div class=\"sub-desc\">The Checkbox being toggled.</div></li>\n     * <li><b>checked</b> : Boolean<div class=\"sub-desc\">The new checked state of the checkbox.</div></li>\n     * </ul></div>\n     */\n    /**\n     * @cfg {Object} scope An object to use as the scope ('this' reference) of the {@link #handler} function\n     * (defaults to this Checkbox).\n     */\n\n    // private\n    actionMode : 'wrap',\n\n\t// private\n    initComponent : function(){\n        Ext.form.Checkbox.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event check\n             * Fires when the checkbox is checked or unchecked.\n             * @param {Ext.form.Checkbox} this This checkbox\n             * @param {Boolean} checked The new checked value\n             */\n            'check'\n        );\n    },\n\n    // private\n    onResize : function(){\n        Ext.form.Checkbox.superclass.onResize.apply(this, arguments);\n        if(!this.boxLabel && !this.fieldLabel){\n            this.el.alignTo(this.wrap, 'c-c');\n        }\n    },\n\n    // private\n    initEvents : function(){\n        Ext.form.Checkbox.superclass.initEvents.call(this);\n        this.mon(this.el, {\n            scope: this,\n            click: this.onClick,\n            change: this.onClick\n        });\n    },\n\n    /**\n     * @hide\n     * Overridden and disabled. The editor element does not support standard valid/invalid marking.\n     * @method\n     */\n    markInvalid : Ext.emptyFn,\n    /**\n     * @hide\n     * Overridden and disabled. The editor element does not support standard valid/invalid marking.\n     * @method\n     */\n    clearInvalid : Ext.emptyFn,\n\n    // private\n    onRender : function(ct, position){\n        Ext.form.Checkbox.superclass.onRender.call(this, ct, position);\n        if(this.inputValue !== undefined){\n            this.el.dom.value = this.inputValue;\n        }\n        this.wrap = this.el.wrap({cls: 'x-form-check-wrap'});\n        if(this.boxLabel){\n            this.wrap.createChild({tag: 'label', htmlFor: this.el.id, cls: 'x-form-cb-label', html: this.boxLabel});\n        }\n        if(this.checked){\n            this.setValue(true);\n        }else{\n            this.checked = this.el.dom.checked;\n        }\n        // Need to repaint for IE, otherwise positioning is broken\n        if (Ext.isIEQuirks) {\n            this.wrap.repaint();\n        }\n        this.resizeEl = this.positionEl = this.wrap;\n    },\n\n    // private\n    onDestroy : function(){\n        Ext.destroy(this.wrap);\n        Ext.form.Checkbox.superclass.onDestroy.call(this);\n    },\n\n    // private\n    initValue : function() {\n        this.originalValue = this.getValue();\n    },\n\n    /**\n     * Returns the checked state of the checkbox.\n     * @return {Boolean} True if checked, else false\n     */\n    getValue : function(){\n        if(this.rendered){\n            return this.el.dom.checked;\n        }\n        return this.checked;\n    },\n\n\t// private\n    onClick : function(){\n        if(this.el.dom.checked != this.checked){\n            this.setValue(this.el.dom.checked);\n        }\n    },\n\n    /**\n     * Sets the checked state of the checkbox, fires the 'check' event, and calls a\n     * <code>{@link #handler}</code> (if configured).\n     * @param {Boolean/String} checked The following values will check the checkbox:\n     * <code>true, 'true', '1', or 'on'</code>. Any other value will uncheck the checkbox.\n     * @return {Ext.form.Field} this\n     */\n    setValue : function(v){\n        var checked = this.checked,\n            inputVal = this.inputValue;\n            \n        if (v === false) {\n            this.checked = false;\n        } else {\n            this.checked = (v === true || v === 'true' || v == '1' || (inputVal ? v == inputVal : String(v).toLowerCase() == 'on'));\n        }\n        \n        if(this.rendered){\n            this.el.dom.checked = this.checked;\n            this.el.dom.defaultChecked = this.checked;\n        }\n        if(checked != this.checked){\n            this.fireEvent('check', this, this.checked);\n            if(this.handler){\n                this.handler.call(this.scope || this, this, this.checked);\n            }\n        }\n        return this;\n    }\n});\nExt.reg('checkbox', Ext.form.Checkbox);\n/**\n * @class Ext.form.CheckboxGroup\n * @extends Ext.form.Field\n * <p>A grouping container for {@link Ext.form.Checkbox} controls.</p>\n * <p>Sample usage:</p>\n * <pre><code>\nvar myCheckboxGroup = new Ext.form.CheckboxGroup({\n    id:'myGroup',\n    xtype: 'checkboxgroup',\n    fieldLabel: 'Single Column',\n    itemCls: 'x-check-group-alt',\n    // Put all controls in a single column with width 100%\n    columns: 1,\n    items: [\n        {boxLabel: 'Item 1', name: 'cb-col-1'},\n        {boxLabel: 'Item 2', name: 'cb-col-2', checked: true},\n        {boxLabel: 'Item 3', name: 'cb-col-3'}\n    ]\n});\n * </code></pre>\n * @constructor\n * Creates a new CheckboxGroup\n * @param {Object} config Configuration options\n * @xtype checkboxgroup\n */\nExt.form.CheckboxGroup = Ext.extend(Ext.form.Field, {\n    /**\n     * @cfg {Array} items An Array of {@link Ext.form.Checkbox Checkbox}es or Checkbox config objects\n     * to arrange in the group.\n     */\n    /**\n     * @cfg {String/Number/Array} columns Specifies the number of columns to use when displaying grouped\n     * checkbox/radio controls using automatic layout.  This config can take several types of values:\n     * <ul><li><b>'auto'</b> : <p class=\"sub-desc\">The controls will be rendered one per column on one row and the width\n     * of each column will be evenly distributed based on the width of the overall field container. This is the default.</p></li>\n     * <li><b>Number</b> : <p class=\"sub-desc\">If you specific a number (e.g., 3) that number of columns will be\n     * created and the contained controls will be automatically distributed based on the value of {@link #vertical}.</p></li>\n     * <li><b>Array</b> : Object<p class=\"sub-desc\">You can also specify an array of column widths, mixing integer\n     * (fixed width) and float (percentage width) values as needed (e.g., [100, .25, .75]). Any integer values will\n     * be rendered first, then any float values will be calculated as a percentage of the remaining space. Float\n     * values do not have to add up to 1 (100%) although if you want the controls to take up the entire field\n     * container you should do so.</p></li></ul>\n     */\n    columns : 'auto',\n    /**\n     * @cfg {Boolean} vertical True to distribute contained controls across columns, completely filling each column\n     * top to bottom before starting on the next column.  The number of controls in each column will be automatically\n     * calculated to keep columns as even as possible.  The default value is false, so that controls will be added\n     * to columns one at a time, completely filling each row left to right before starting on the next row.\n     */\n    vertical : false,\n    /**\n     * @cfg {Boolean} allowBlank False to validate that at least one item in the group is checked (defaults to true).\n     * If no items are selected at validation time, {@link @blankText} will be used as the error text.\n     */\n    allowBlank : true,\n    /**\n     * @cfg {String} blankText Error text to display if the {@link #allowBlank} validation fails (defaults to \"You must\n     * select at least one item in this group\")\n     */\n    blankText : \"You must select at least one item in this group\",\n\n    // private\n    defaultType : 'checkbox',\n\n    // private\n    groupCls : 'x-form-check-group',\n\n    // private\n    initComponent: function(){\n        this.addEvents(\n            /**\n             * @event change\n             * Fires when the state of a child checkbox changes.\n             * @param {Ext.form.CheckboxGroup} this\n             * @param {Array} checked An array containing the checked boxes.\n             */\n            'change'\n        );\n        this.on('change', this.validate, this);\n        Ext.form.CheckboxGroup.superclass.initComponent.call(this);\n    },\n\n    // private\n    onRender : function(ct, position){\n        if(!this.el){\n            var panelCfg = {\n                autoEl: {\n                    id: this.id\n                },\n                cls: this.groupCls,\n                layout: 'column',\n                renderTo: ct,\n                bufferResize: false // Default this to false, since it doesn't really have a proper ownerCt.\n            };\n            var colCfg = {\n                xtype: 'container',\n                defaultType: this.defaultType,\n                layout: 'form',\n                defaults: {\n                    hideLabel: true,\n                    anchor: '100%'\n                }\n            };\n\n            if(this.items[0].items){\n\n                // The container has standard ColumnLayout configs, so pass them in directly\n\n                Ext.apply(panelCfg, {\n                    layoutConfig: {columns: this.items.length},\n                    defaults: this.defaults,\n                    items: this.items\n                });\n                for(var i=0, len=this.items.length; i<len; i++){\n                    Ext.applyIf(this.items[i], colCfg);\n                }\n\n            }else{\n\n                // The container has field item configs, so we have to generate the column\n                // panels first then move the items into the columns as needed.\n\n                var numCols, cols = [];\n\n                if(typeof this.columns == 'string'){ // 'auto' so create a col per item\n                    this.columns = this.items.length;\n                }\n                if(!Ext.isArray(this.columns)){\n                    var cs = [];\n                    for(var i=0; i<this.columns; i++){\n                        cs.push((100/this.columns)*.01); // distribute by even %\n                    }\n                    this.columns = cs;\n                }\n\n                numCols = this.columns.length;\n\n                // Generate the column configs with the correct width setting\n                for(var i=0; i<numCols; i++){\n                    var cc = Ext.apply({items:[]}, colCfg);\n                    cc[this.columns[i] <= 1 ? 'columnWidth' : 'width'] = this.columns[i];\n                    if(this.defaults){\n                        cc.defaults = Ext.apply(cc.defaults || {}, this.defaults);\n                    }\n                    cols.push(cc);\n                };\n\n                // Distribute the original items into the columns\n                if(this.vertical){\n                    var rows = Math.ceil(this.items.length / numCols), ri = 0;\n                    for(var i=0, len=this.items.length; i<len; i++){\n                        if(i>0 && i%rows==0){\n                            ri++;\n                        }\n                        if(this.items[i].fieldLabel){\n                            this.items[i].hideLabel = false;\n                        }\n                        cols[ri].items.push(this.items[i]);\n                    };\n                }else{\n                    for(var i=0, len=this.items.length; i<len; i++){\n                        var ci = i % numCols;\n                        if(this.items[i].fieldLabel){\n                            this.items[i].hideLabel = false;\n                        }\n                        cols[ci].items.push(this.items[i]);\n                    };\n                }\n\n                Ext.apply(panelCfg, {\n                    layoutConfig: {columns: numCols},\n                    items: cols\n                });\n            }\n\n            this.panel = new Ext.Container(panelCfg);\n            this.panel.ownerCt = this;\n            this.el = this.panel.getEl();\n\n            if(this.forId && this.itemCls){\n                var l = this.el.up(this.itemCls).child('label', true);\n                if(l){\n                    l.setAttribute('htmlFor', this.forId);\n                }\n            }\n\n            var fields = this.panel.findBy(function(c){\n                return c.isFormField;\n            }, this);\n\n            this.items = new Ext.util.MixedCollection();\n            this.items.addAll(fields);\n        }\n        Ext.form.CheckboxGroup.superclass.onRender.call(this, ct, position);\n    },\n\n    initValue : function(){\n        if(this.value){\n            this.setValue.apply(this, this.buffered ? this.value : [this.value]);\n            delete this.buffered;\n            delete this.value;\n        }\n    },\n\n    afterRender : function(){\n        Ext.form.CheckboxGroup.superclass.afterRender.call(this);\n        this.eachItem(function(item){\n            item.on('check', this.fireChecked, this);\n            item.inGroup = true;\n        });\n    },\n\n    // private\n    doLayout: function(){\n        //ugly method required to layout hidden items\n        if(this.rendered){\n            this.panel.forceLayout = this.ownerCt.forceLayout;\n            this.panel.doLayout();\n        }\n    },\n\n    // private\n    fireChecked: function(){\n        var arr = [];\n        this.eachItem(function(item){\n            if(item.checked){\n                arr.push(item);\n            }\n        });\n        this.fireEvent('change', this, arr);\n    },\n    \n    /**\n     * Runs CheckboxGroup's validations and returns an array of any errors. The only error by default\n     * is if allowBlank is set to true and no items are checked.\n     * @return {Array} Array of all validation errors\n     */\n    getErrors: function() {\n        var errors = Ext.form.CheckboxGroup.superclass.getErrors.apply(this, arguments);\n        \n        if (!this.allowBlank) {\n            var blank = true;\n            \n            this.eachItem(function(f){\n                if (f.checked) {\n                    return (blank = false);\n                }\n            });\n            \n            if (blank) errors.push(this.blankText);\n        }\n        \n        return errors;\n    },\n\n    // private\n    isDirty: function(){\n        //override the behaviour to check sub items.\n        if (this.disabled || !this.rendered) {\n            return false;\n        }\n\n        var dirty = false;\n        \n        this.eachItem(function(item){\n            if(item.isDirty()){\n                dirty = true;\n                return false;\n            }\n        });\n        \n        return dirty;\n    },\n\n    // private\n    setReadOnly : function(readOnly){\n        if(this.rendered){\n            this.eachItem(function(item){\n                item.setReadOnly(readOnly);\n            });\n        }\n        this.readOnly = readOnly;\n    },\n\n    // private\n    onDisable : function(){\n        this.eachItem(function(item){\n            item.disable();\n        });\n    },\n\n    // private\n    onEnable : function(){\n        this.eachItem(function(item){\n            item.enable();\n        });\n    },\n\n    // private\n    onResize : function(w, h){\n        this.panel.setSize(w, h);\n        this.panel.doLayout();\n    },\n\n    // inherit docs from Field\n    reset : function(){\n        if (this.originalValue) {\n            // Clear all items\n            this.eachItem(function(c){\n                if(c.setValue){\n                    c.setValue(false);\n                    c.originalValue = c.getValue();\n                }\n            });\n            // Set items stored in originalValue, ugly - set a flag to reset the originalValue\n            // during the horrible onSetValue.  This will allow trackResetOnLoad to function.\n            this.resetOriginal = true;\n            this.setValue(this.originalValue);\n            delete this.resetOriginal;\n        } else {\n            this.eachItem(function(c){\n                if(c.reset){\n                    c.reset();\n                }\n            });\n        }\n        // Defer the clearInvalid so if BaseForm's collection is being iterated it will be called AFTER it is complete.\n        // Important because reset is being called on both the group and the individual items.\n        (function() {\n            this.clearInvalid();\n        }).defer(50, this);\n    },\n\n    /**\n     * {@link Ext.form.Checkbox#setValue Set the value(s)} of an item or items\n     * in the group. Examples illustrating how this method may be called:\n     * <pre><code>\n// call with name and value\nmyCheckboxGroup.setValue('cb-col-1', true);\n// call with an array of boolean values\nmyCheckboxGroup.setValue([true, false, false]);\n// call with an object literal specifying item:value pairs\nmyCheckboxGroup.setValue({\n    'cb-col-2': false,\n    'cb-col-3': true\n});\n// use comma separated string to set items with name to true (checked)\nmyCheckboxGroup.setValue('cb-col-1,cb-col-3');\n     * </code></pre>\n     * See {@link Ext.form.Checkbox#setValue} for additional information.\n     * @param {Mixed} id The checkbox to check, or as described by example shown.\n     * @param {Boolean} value (optional) The value to set the item.\n     * @return {Ext.form.CheckboxGroup} this\n     */\n    setValue: function(){\n        if(this.rendered){\n            this.onSetValue.apply(this, arguments);\n        }else{\n            this.buffered = true;\n            this.value = arguments;\n        }\n        return this;\n    },\n\n    /**\n     * @private\n     * Sets the values of one or more of the items within the CheckboxGroup\n     * @param {String|Array|Object} id Can take multiple forms. Can be optionally:\n     * <ul>\n     *   <li>An ID string to be used with a second argument</li>\n     *   <li>An array of the form ['some', 'list', 'of', 'ids', 'to', 'mark', 'checked']</li>\n     *   <li>An array in the form [true, true, false, true, false] etc, where each item relates to the check status of\n     *       the checkbox at the same index</li>\n     *   <li>An object containing ids of the checkboxes as keys and check values as properties</li>\n     * </ul>\n     * @param {String} value The value to set the field to if the first argument was a string\n     */\n    onSetValue: function(id, value){\n        if(arguments.length == 1){\n            if(Ext.isArray(id)){\n                Ext.each(id, function(val, idx){\n                    if (Ext.isObject(val) && val.setValue){ // array of checkbox components to be checked\n                        val.setValue(true);\n                        if (this.resetOriginal === true) {\n                            val.originalValue = val.getValue();\n                        }\n                    } else { // an array of boolean values\n                        var item = this.items.itemAt(idx);\n                        if(item){\n                            item.setValue(val);\n                        }\n                    }\n                }, this);\n            }else if(Ext.isObject(id)){\n                // set of name/value pairs\n                for(var i in id){\n                    var f = this.getBox(i);\n                    if(f){\n                        f.setValue(id[i]);\n                    }\n                }\n            }else{\n                this.setValueForItem(id);\n            }\n        }else{\n            var f = this.getBox(id);\n            if(f){\n                f.setValue(value);\n            }\n        }\n    },\n\n    // private\n    beforeDestroy: function(){\n        Ext.destroy(this.panel);\n        if (!this.rendered) {\n            Ext.destroy(this.items);\n        }\n        Ext.form.CheckboxGroup.superclass.beforeDestroy.call(this);\n\n    },\n\n    setValueForItem : function(val){\n        val = String(val).split(',');\n        this.eachItem(function(item){\n            if(val.indexOf(item.inputValue)> -1){\n                item.setValue(true);\n            }\n        });\n    },\n\n    // private\n    getBox : function(id){\n        var box = null;\n        this.eachItem(function(f){\n            if(id == f || f.dataIndex == id || f.id == id || f.getName() == id){\n                box = f;\n                return false;\n            }\n        });\n        return box;\n    },\n\n    /**\n     * Gets an array of the selected {@link Ext.form.Checkbox} in the group.\n     * @return {Array} An array of the selected checkboxes.\n     */\n    getValue : function(){\n        var out = [];\n        this.eachItem(function(item){\n            if(item.checked){\n                out.push(item);\n            }\n        });\n        return out;\n    },\n\n    /**\n     * @private\n     * Convenience function which passes the given function to every item in the composite\n     * @param {Function} fn The function to call\n     * @param {Object} scope Optional scope object\n     */\n    eachItem: function(fn, scope) {\n        if(this.items && this.items.each){\n            this.items.each(fn, scope || this);\n        }\n    },\n\n    /**\n     * @cfg {String} name\n     * @hide\n     */\n\n    /**\n     * @method getRawValue\n     * @hide\n     */\n    getRawValue : Ext.emptyFn,\n\n    /**\n     * @method setRawValue\n     * @hide\n     */\n    setRawValue : Ext.emptyFn\n\n});\n\nExt.reg('checkboxgroup', Ext.form.CheckboxGroup);\n/**\n * @class Ext.form.CompositeField\n * @extends Ext.form.Field\n * Composite field allowing a number of form Fields to be rendered on the same row. The fields are rendered\n * using an hbox layout internally, so all of the normal HBox layout config items are available. Example usage:\n * <pre>\n{\n    xtype: 'compositefield',\n    labelWidth: 120\n    items: [\n        {\n            xtype     : 'textfield',\n            fieldLabel: 'Title',\n            width     : 20\n        },\n        {\n            xtype     : 'textfield',\n            fieldLabel: 'First',\n            flex      : 1\n        },\n        {\n            xtype     : 'textfield',\n            fieldLabel: 'Last',\n            flex      : 1\n        }\n    ]\n}\n * </pre>\n * In the example above the composite's fieldLabel will be set to 'Title, First, Last' as it groups the fieldLabels\n * of each of its children. This can be overridden by setting a fieldLabel on the compositefield itself:\n * <pre>\n{\n    xtype: 'compositefield',\n    fieldLabel: 'Custom label',\n    items: [...]\n}\n * </pre>\n * Any Ext.form.* component can be placed inside a composite field.\n */\nExt.form.CompositeField = Ext.extend(Ext.form.Field, {\n\n    /**\n     * @property defaultMargins\n     * @type String\n     * The margins to apply by default to each field in the composite\n     */\n    defaultMargins: '0 5 0 0',\n\n    /**\n     * @property skipLastItemMargin\n     * @type Boolean\n     * If true, the defaultMargins are not applied to the last item in the composite field set (defaults to true)\n     */\n    skipLastItemMargin: true,\n\n    /**\n     * @property isComposite\n     * @type Boolean\n     * Signifies that this is a Composite field\n     */\n    isComposite: true,\n\n    /**\n     * @property combineErrors\n     * @type Boolean\n     * True to combine errors from the individual fields into a single error message at the CompositeField level (defaults to true)\n     */\n    combineErrors: true,\n    \n    /**\n     * @cfg {String} labelConnector The string to use when joining segments of the built label together (defaults to ', ')\n     */\n    labelConnector: ', ',\n    \n    /**\n     * @cfg {Object} defaults Any default properties to assign to the child fields.\n     */\n\n    //inherit docs\n    //Builds the composite field label\n    initComponent: function() {\n        var labels = [],\n            items  = this.items,\n            item;\n\n        for (var i=0, j = items.length; i < j; i++) {\n            item = items[i];\n            \n            if (!Ext.isEmpty(item.ref)){\n                item.ref = '../' + item.ref;\n            }\n\n            labels.push(item.fieldLabel);\n\n            //apply any defaults\n            Ext.applyIf(item, this.defaults);\n\n            //apply default margins to each item except the last\n            if (!(i == j - 1 && this.skipLastItemMargin)) {\n                Ext.applyIf(item, {margins: this.defaultMargins});\n            }\n        }\n\n        this.fieldLabel = this.fieldLabel || this.buildLabel(labels);\n\n        /**\n         * @property fieldErrors\n         * @type Ext.util.MixedCollection\n         * MixedCollection of current errors on the Composite's subfields. This is used internally to track when\n         * to show and hide error messages at the Composite level. Listeners are attached to the MixedCollection's\n         * add, remove and replace events to update the error icon in the UI as errors are added or removed.\n         */\n        this.fieldErrors = new Ext.util.MixedCollection(true, function(item) {\n            return item.field;\n        });\n\n        this.fieldErrors.on({\n            scope  : this,\n            add    : this.updateInvalidMark,\n            remove : this.updateInvalidMark,\n            replace: this.updateInvalidMark\n        });\n\n        Ext.form.CompositeField.superclass.initComponent.apply(this, arguments);\n        \n        this.innerCt = new Ext.Container({\n            layout  : 'hbox',\n            items   : this.items,\n            cls     : 'x-form-composite',\n            defaultMargins: '0 3 0 0',\n            ownerCt: this\n        });\n        delete this.innerCt.ownerCt;\n\n        var fields = this.innerCt.findBy(function(c) {\n            return c.isFormField;\n        }, this);\n\n        /**\n         * @property items\n         * @type Ext.util.MixedCollection\n         * Internal collection of all of the subfields in this Composite\n         */\n        this.items = new Ext.util.MixedCollection();\n        this.items.addAll(fields);\n        \n    },\n\n    /**\n     * @private\n     * Creates an internal container using hbox and renders the fields to it\n     */\n    onRender: function(ct, position) {\n        if (!this.el) {\n            /**\n             * @property innerCt\n             * @type Ext.Container\n             * A container configured with hbox layout which is responsible for laying out the subfields\n             */\n            var innerCt = this.innerCt;\n            innerCt.render(ct);\n            this.innerCt.ownerCt = this;\n\n            this.el = innerCt.getEl();\n\n            //if we're combining subfield errors into a single message, override the markInvalid and clearInvalid\n            //methods of each subfield and show them at the Composite level instead\n            if (this.combineErrors) {\n                this.eachItem(function(field) {\n                    Ext.apply(field, {\n                        markInvalid : this.onFieldMarkInvalid.createDelegate(this, [field], 0),\n                        clearInvalid: this.onFieldClearInvalid.createDelegate(this, [field], 0)\n                    });\n                });\n            }\n\n            //set the label 'for' to the first item\n            var l = this.el.parent().parent().child('label', true);\n            if (l) {\n                l.setAttribute('for', this.items.items[0].id);\n            }\n        }\n\n        Ext.form.CompositeField.superclass.onRender.apply(this, arguments);\n    },\n\n    /**\n     * Called if combineErrors is true and a subfield's markInvalid method is called.\n     * By default this just adds the subfield's error to the internal fieldErrors MixedCollection\n     * @param {Ext.form.Field} field The field that was marked invalid\n     * @param {String} message The error message\n     */\n    onFieldMarkInvalid: function(field, message) {\n        var name  = field.getName(),\n            error = {\n                field: name, \n                errorName: field.fieldLabel || name,\n                error: message\n            };\n\n        this.fieldErrors.replace(name, error);\n\n        if (!field.preventMark) {\n            field.el.addClass(field.invalidClass);\n        }\n    },\n\n    /**\n     * Called if combineErrors is true and a subfield's clearInvalid method is called.\n     * By default this just updates the internal fieldErrors MixedCollection.\n     * @param {Ext.form.Field} field The field that was marked invalid\n     */\n    onFieldClearInvalid: function(field) {\n        this.fieldErrors.removeKey(field.getName());\n\n        field.el.removeClass(field.invalidClass);\n    },\n\n    /**\n     * @private\n     * Called after a subfield is marked valid or invalid, this checks to see if any of the subfields are\n     * currently invalid. If any subfields are invalid it builds a combined error message marks the composite\n     * invalid, otherwise clearInvalid is called\n     */\n    updateInvalidMark: function() {\n        var ieStrict = Ext.isIE6 && Ext.isStrict;\n\n        if (this.fieldErrors.length == 0) {\n            this.clearInvalid();\n\n            //IE6 in strict mode has a layout bug when using 'under' as the error message target. This fixes it\n            if (ieStrict) {\n                this.clearInvalid.defer(50, this);\n            }\n        } else {\n            var message = this.buildCombinedErrorMessage(this.fieldErrors.items);\n\n            this.sortErrors();\n            this.markInvalid(message);\n\n            //IE6 in strict mode has a layout bug when using 'under' as the error message target. This fixes it\n            if (ieStrict) {\n                this.markInvalid(message);\n            }\n        }\n    },\n\n    /**\n     * Performs validation checks on each subfield and returns false if any of them fail validation.\n     * @return {Boolean} False if any subfield failed validation\n     */\n    validateValue: function(value, preventMark) {\n        var valid = true;\n\n        this.eachItem(function(field) {\n            if (!field.isValid(preventMark)) {\n                valid = false;\n            }\n        });\n\n        return valid;\n    },\n\n    /**\n     * Takes an object containing error messages for contained fields, returning a combined error\n     * string (defaults to just placing each item on a new line). This can be overridden to provide\n     * custom combined error message handling.\n     * @param {Array} errors Array of errors in format: [{field: 'title', error: 'some error'}]\n     * @return {String} The combined error message\n     */\n    buildCombinedErrorMessage: function(errors) {\n        var combined = [],\n            error;\n\n        for (var i = 0, j = errors.length; i < j; i++) {\n            error = errors[i];\n\n            combined.push(String.format(\"{0}: {1}\", error.errorName, error.error));\n        }\n\n        return combined.join(\"<br />\");\n    },\n\n    /**\n     * Sorts the internal fieldErrors MixedCollection by the order in which the fields are defined.\n     * This is called before displaying errors to ensure that the errors are presented in the expected order.\n     * This function can be overridden to provide a custom sorting order if needed.\n     */\n    sortErrors: function() {\n        var fields = this.items;\n\n        this.fieldErrors.sort(\"ASC\", function(a, b) {\n            var findByName = function(key) {\n                return function(field) {\n                    return field.getName() == key;\n                };\n            };\n\n            var aIndex = fields.findIndexBy(findByName(a.field)),\n                bIndex = fields.findIndexBy(findByName(b.field));\n\n            return aIndex < bIndex ? -1 : 1;\n        });\n    },\n\n    /**\n     * Resets each field in the composite to their previous value\n     */\n    reset: function() {\n        this.eachItem(function(item) {\n            item.reset();\n        });\n\n        // Defer the clearInvalid so if BaseForm's collection is being iterated it will be called AFTER it is complete.\n        // Important because reset is being called on both the group and the individual items.\n        (function() {\n            this.clearInvalid();\n        }).defer(50, this);\n    },\n    \n    /**\n     * Calls clearInvalid on all child fields. This is a convenience function and should not often need to be called\n     * as fields usually take care of clearing themselves\n     */\n    clearInvalidChildren: function() {\n        this.eachItem(function(item) {\n            item.clearInvalid();\n        });\n    },\n\n    /**\n     * Builds a label string from an array of subfield labels.\n     * By default this just joins the labels together with a comma\n     * @param {Array} segments Array of each of the labels in the composite field's subfields\n     * @return {String} The built label\n     */\n    buildLabel: function(segments) {\n        return Ext.clean(segments).join(this.labelConnector);\n    },\n\n    /**\n     * Checks each field in the composite and returns true if any is dirty\n     * @return {Boolean} True if any field is dirty\n     */\n    isDirty: function(){\n        //override the behaviour to check sub items.\n        if (this.disabled || !this.rendered) {\n            return false;\n        }\n\n        var dirty = false;\n        this.eachItem(function(item){\n            if(item.isDirty()){\n                dirty = true;\n                return false;\n            }\n        });\n        return dirty;\n    },\n\n    /**\n     * @private\n     * Convenience function which passes the given function to every item in the composite\n     * @param {Function} fn The function to call\n     * @param {Object} scope Optional scope object\n     */\n    eachItem: function(fn, scope) {\n        if(this.items && this.items.each){\n            this.items.each(fn, scope || this);\n        }\n    },\n\n    /**\n     * @private\n     * Passes the resize call through to the inner panel\n     */\n    onResize: function(adjWidth, adjHeight, rawWidth, rawHeight) {\n        var innerCt = this.innerCt;\n\n        if (this.rendered && innerCt.rendered) {\n            innerCt.setSize(adjWidth, adjHeight);\n        }\n\n        Ext.form.CompositeField.superclass.onResize.apply(this, arguments);\n    },\n\n    /**\n     * @private\n     * Forces the internal container to be laid out again\n     */\n    doLayout: function(shallow, force) {\n        if (this.rendered) {\n            var innerCt = this.innerCt;\n\n            innerCt.forceLayout = this.ownerCt.forceLayout;\n            innerCt.doLayout(shallow, force);\n        }\n    },\n\n    /**\n     * @private\n     */\n    beforeDestroy: function(){\n        Ext.destroy(this.innerCt);\n\n        Ext.form.CompositeField.superclass.beforeDestroy.call(this);\n    },\n\n    //override the behaviour to check sub items.\n    setReadOnly : function(readOnly) {\n        if (readOnly == undefined) {\n            readOnly = true;\n        }\n        readOnly = !!readOnly;\n\n        if(this.rendered){\n            this.eachItem(function(item){\n                item.setReadOnly(readOnly);\n            });\n        }\n        this.readOnly = readOnly;\n    },\n\n    onShow : function() {\n        Ext.form.CompositeField.superclass.onShow.call(this);\n        this.doLayout();\n    },\n\n    //override the behaviour to check sub items.\n    onDisable : function(){\n        this.eachItem(function(item){\n            item.disable();\n        });\n    },\n\n    //override the behaviour to check sub items.\n    onEnable : function(){\n        this.eachItem(function(item){\n            item.enable();\n        });\n    }\n});\n\nExt.reg('compositefield', Ext.form.CompositeField);/**\n * @class Ext.form.Radio\n * @extends Ext.form.Checkbox\n * Single radio field.  Same as Checkbox, but provided as a convenience for automatically setting the input type.\n * Radio grouping is handled automatically by the browser if you give each radio in a group the same name.\n * @constructor\n * Creates a new Radio\n * @param {Object} config Configuration options\n * @xtype radio\n */\nExt.form.Radio = Ext.extend(Ext.form.Checkbox, {\n    inputType: 'radio',\n\n    /**\n     * Overridden and disabled. The editor element does not support standard valid/invalid marking. @hide\n     * @method\n     */\n    markInvalid : Ext.emptyFn,\n    /**\n     * Overridden and disabled. The editor element does not support standard valid/invalid marking. @hide\n     * @method\n     */\n    clearInvalid : Ext.emptyFn,\n\n    /**\n     * If this radio is part of a group, it will return the selected value\n     * @return {String}\n     */\n    getGroupValue : function(){\n    \tvar p = this.el.up('form') || Ext.getBody();\n        var c = p.child('input[name=\"'+this.el.dom.name+'\"]:checked', true);\n        return c ? c.value : null;\n    },\n\n    /**\n     * Sets either the checked/unchecked status of this Radio, or, if a string value\n     * is passed, checks a sibling Radio of the same name whose value is the value specified.\n     * @param value {String/Boolean} Checked value, or the value of the sibling radio button to check.\n     * @return {Ext.form.Field} this\n     */\n    setValue : function(v){\n    \tvar checkEl,\n            els,\n            radio;\n    \tif (typeof v == 'boolean') {\n            Ext.form.Radio.superclass.setValue.call(this, v);\n        } else if (this.rendered) {\n            checkEl = this.getCheckEl();\n            radio = checkEl.child('input[name=\"' + this.el.dom.name + '\"][value=\"' + v + '\"]', true);\n            if(radio){\n                Ext.getCmp(radio.id).setValue(true);\n            }\n        }\n        if(this.rendered && this.checked){\n            checkEl = checkEl || this.getCheckEl();\n            els = this.getCheckEl().select('input[name=\"' + this.el.dom.name + '\"]');\n\t\t\tels.each(function(el){\n\t\t\t\tif(el.dom.id != this.id){\n\t\t\t\t\tExt.getCmp(el.dom.id).setValue(false);\n\t\t\t\t}\n\t\t\t}, this);\n        }\n        return this;\n    },\n\n    // private\n    getCheckEl: function(){\n        if(this.inGroup){\n            return this.el.up('.x-form-radio-group');\n        }\n        return this.el.up('form') || Ext.getBody();\n    }\n});\nExt.reg('radio', Ext.form.Radio);\n/**\n * @class Ext.form.RadioGroup\n * @extends Ext.form.CheckboxGroup\n * A grouping container for {@link Ext.form.Radio} controls.\n * @constructor\n * Creates a new RadioGroup\n * @param {Object} config Configuration options\n * @xtype radiogroup\n */\nExt.form.RadioGroup = Ext.extend(Ext.form.CheckboxGroup, {\n    /**\n     * @cfg {Array} items An Array of {@link Ext.form.Radio Radio}s or Radio config objects\n     * to arrange in the group.\n     */\n    /**\n     * @cfg {Boolean} allowBlank True to allow every item in the group to be blank (defaults to true).\n     * If allowBlank = false and no items are selected at validation time, {@link @blankText} will\n     * be used as the error text.\n     */\n    allowBlank : true,\n    /**\n     * @cfg {String} blankText Error text to display if the {@link #allowBlank} validation fails\n     * (defaults to 'You must select one item in this group')\n     */\n    blankText : 'You must select one item in this group',\n    \n    // private\n    defaultType : 'radio',\n    \n    // private\n    groupCls : 'x-form-radio-group',\n    \n    /**\n     * @event change\n     * Fires when the state of a child radio changes.\n     * @param {Ext.form.RadioGroup} this\n     * @param {Ext.form.Radio} checked The checked radio\n     */\n    \n    /**\n     * Gets the selected {@link Ext.form.Radio} in the group, if it exists.\n     * @return {Ext.form.Radio} The selected radio.\n     */\n    getValue : function(){\n        var out = null;\n        this.eachItem(function(item){\n            if(item.checked){\n                out = item;\n                return false;\n            }\n        });\n        return out;\n    },\n    \n    /**\n     * Sets the checked radio in the group.\n     * @param {String/Ext.form.Radio} id The radio to check.\n     * @param {Boolean} value The value to set the radio.\n     * @return {Ext.form.RadioGroup} this\n     */\n    onSetValue : function(id, value){\n        if(arguments.length > 1){\n            var f = this.getBox(id);\n            if(f){\n                f.setValue(value);\n                if(f.checked){\n                    this.eachItem(function(item){\n                        if (item !== f){\n                            item.setValue(false);\n                        }\n                    });\n                }\n            }\n        }else{\n            this.setValueForItem(id);\n        }\n    },\n    \n    setValueForItem : function(val){\n        val = String(val).split(',')[0];\n        this.eachItem(function(item){\n            item.setValue(val == item.inputValue);\n        });\n    },\n    \n    // private\n    fireChecked : function(){\n        if(!this.checkTask){\n            this.checkTask = new Ext.util.DelayedTask(this.bufferChecked, this);\n        }\n        this.checkTask.delay(10);\n    },\n    \n    // private\n    bufferChecked : function(){\n        var out = null;\n        this.eachItem(function(item){\n            if(item.checked){\n                out = item;\n                return false;\n            }\n        });\n        this.fireEvent('change', this, out);\n    },\n    \n    onDestroy : function(){\n        if(this.checkTask){\n            this.checkTask.cancel();\n            this.checkTask = null;\n        }\n        Ext.form.RadioGroup.superclass.onDestroy.call(this);\n    }\n\n});\n\nExt.reg('radiogroup', Ext.form.RadioGroup);\n/**\n * @class Ext.form.Hidden\n * @extends Ext.form.Field\n * A basic hidden field for storing hidden values in forms that need to be passed in the form submit.\n * @constructor\n * Create a new Hidden field.\n * @param {Object} config Configuration options\n * @xtype hidden\n */\nExt.form.Hidden = Ext.extend(Ext.form.Field, {\n    // private\n    inputType : 'hidden',\n    \n    shouldLayout: false,\n\n    // private\n    onRender : function(){\n        Ext.form.Hidden.superclass.onRender.apply(this, arguments);\n    },\n\n    // private\n    initEvents : function(){\n        this.originalValue = this.getValue();\n    },\n\n    // These are all private overrides\n    setSize : Ext.emptyFn,\n    setWidth : Ext.emptyFn,\n    setHeight : Ext.emptyFn,\n    setPosition : Ext.emptyFn,\n    setPagePosition : Ext.emptyFn,\n    markInvalid : Ext.emptyFn,\n    clearInvalid : Ext.emptyFn\n});\nExt.reg('hidden', Ext.form.Hidden);/**\n * @class Ext.form.BasicForm\n * @extends Ext.util.Observable\n * <p>Encapsulates the DOM &lt;form> element at the heart of the {@link Ext.form.FormPanel FormPanel} class, and provides\n * input field management, validation, submission, and form loading services.</p>\n * <p>By default, Ext Forms are submitted through Ajax, using an instance of {@link Ext.form.Action.Submit}.\n * To enable normal browser submission of an Ext Form, use the {@link #standardSubmit} config option.</p>\n * <p><b><u>File Uploads</u></b></p>\n * <p>{@link #fileUpload File uploads} are not performed using Ajax submission, that\n * is they are <b>not</b> performed using XMLHttpRequests. Instead the form is submitted in the standard\n * manner with the DOM <tt>&lt;form></tt> element temporarily modified to have its\n * <a href=\"http://www.w3.org/TR/REC-html40/present/frames.html#adef-target\">target</a> set to refer\n * to a dynamically generated, hidden <tt>&lt;iframe></tt> which is inserted into the document\n * but removed after the return data has been gathered.</p>\n * <p>The server response is parsed by the browser to create the document for the IFRAME. If the\n * server is using JSON to send the return object, then the\n * <a href=\"http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.17\">Content-Type</a> header\n * must be set to \"text/html\" in order to tell the browser to insert the text unchanged into the document body.</p>\n * <p>Characters which are significant to an HTML parser must be sent as HTML entities, so encode\n * \"&lt;\" as \"&amp;lt;\", \"&amp;\" as \"&amp;amp;\" etc.</p>\n * <p>The response text is retrieved from the document, and a fake XMLHttpRequest object\n * is created containing a <tt>responseText</tt> property in order to conform to the\n * requirements of event handlers and callbacks.</p>\n * <p>Be aware that file upload packets are sent with the content type <a href=\"http://www.faqs.org/rfcs/rfc2388.html\">multipart/form</a>\n * and some server technologies (notably JEE) may require some custom processing in order to\n * retrieve parameter names and parameter values from the packet content.</p>\n * @constructor\n * @param {Mixed} el The form element or its id\n * @param {Object} config Configuration options\n */\nExt.form.BasicForm = Ext.extend(Ext.util.Observable, {\n\n    constructor: function(el, config){\n        Ext.apply(this, config);\n        if(Ext.isString(this.paramOrder)){\n            this.paramOrder = this.paramOrder.split(/[\\s,|]/);\n        }\n        /**\n         * A {@link Ext.util.MixedCollection MixedCollection} containing all the Ext.form.Fields in this form.\n         * @type MixedCollection\n         * @property items\n         */\n        this.items = new Ext.util.MixedCollection(false, function(o){\n            return o.getItemId();\n        });\n        this.addEvents(\n            /**\n             * @event beforeaction\n             * Fires before any action is performed. Return false to cancel the action.\n             * @param {Form} this\n             * @param {Action} action The {@link Ext.form.Action} to be performed\n             */\n            'beforeaction',\n            /**\n             * @event actionfailed\n             * Fires when an action fails.\n             * @param {Form} this\n             * @param {Action} action The {@link Ext.form.Action} that failed\n             */\n            'actionfailed',\n            /**\n             * @event actioncomplete\n             * Fires when an action is completed.\n             * @param {Form} this\n             * @param {Action} action The {@link Ext.form.Action} that completed\n             */\n            'actioncomplete'\n        );\n\n        if(el){\n            this.initEl(el);\n        }\n        Ext.form.BasicForm.superclass.constructor.call(this);\n    },\n\n    /**\n     * @cfg {String} method\n     * The request method to use (GET or POST) for form actions if one isn't supplied in the action options.\n     */\n    /**\n     * @cfg {DataReader} reader\n     * An Ext.data.DataReader (e.g. {@link Ext.data.XmlReader}) to be used to read\n     * data when executing 'load' actions. This is optional as there is built-in\n     * support for processing JSON.  For additional information on using an XMLReader\n     * see the example provided in examples/form/xml-form.html.\n     */\n    /**\n     * @cfg {DataReader} errorReader\n     * <p>An Ext.data.DataReader (e.g. {@link Ext.data.XmlReader}) to be used to\n     * read field error messages returned from 'submit' actions. This is optional\n     * as there is built-in support for processing JSON.</p>\n     * <p>The Records which provide messages for the invalid Fields must use the\n     * Field name (or id) as the Record ID, and must contain a field called 'msg'\n     * which contains the error message.</p>\n     * <p>The errorReader does not have to be a full-blown implementation of a\n     * DataReader. It simply needs to implement a <tt>read(xhr)</tt> function\n     * which returns an Array of Records in an object with the following\n     * structure:</p><pre><code>\n{\n    records: recordArray\n}\n</code></pre>\n     */\n    /**\n     * @cfg {String} url\n     * The URL to use for form actions if one isn't supplied in the\n     * <code>{@link #doAction doAction} options</code>.\n     */\n    /**\n     * @cfg {Boolean} fileUpload\n     * Set to true if this form is a file upload.\n     * <p>File uploads are not performed using normal 'Ajax' techniques, that is they are <b>not</b>\n     * performed using XMLHttpRequests. Instead the form is submitted in the standard manner with the\n     * DOM <tt>&lt;form></tt> element temporarily modified to have its\n     * <a href=\"http://www.w3.org/TR/REC-html40/present/frames.html#adef-target\">target</a> set to refer\n     * to a dynamically generated, hidden <tt>&lt;iframe></tt> which is inserted into the document\n     * but removed after the return data has been gathered.</p>\n     * <p>The server response is parsed by the browser to create the document for the IFRAME. If the\n     * server is using JSON to send the return object, then the\n     * <a href=\"http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.17\">Content-Type</a> header\n     * must be set to \"text/html\" in order to tell the browser to insert the text unchanged into the document body.</p>\n     * <p>Characters which are significant to an HTML parser must be sent as HTML entities, so encode\n     * \"&lt;\" as \"&amp;lt;\", \"&amp;\" as \"&amp;amp;\" etc.</p>\n     * <p>The response text is retrieved from the document, and a fake XMLHttpRequest object\n     * is created containing a <tt>responseText</tt> property in order to conform to the\n     * requirements of event handlers and callbacks.</p>\n     * <p>Be aware that file upload packets are sent with the content type <a href=\"http://www.faqs.org/rfcs/rfc2388.html\">multipart/form</a>\n     * and some server technologies (notably JEE) may require some custom processing in order to\n     * retrieve parameter names and parameter values from the packet content.</p>\n     */\n    /**\n     * @cfg {Object} baseParams\n     * <p>Parameters to pass with all requests. e.g. baseParams: {id: '123', foo: 'bar'}.</p>\n     * <p>Parameters are encoded as standard HTTP parameters using {@link Ext#urlEncode}.</p>\n     */\n    /**\n     * @cfg {Number} timeout Timeout for form actions in seconds (default is 30 seconds).\n     */\n    timeout: 30,\n\n    /**\n     * @cfg {Object} api (Optional) If specified load and submit actions will be handled\n     * with {@link Ext.form.Action.DirectLoad} and {@link Ext.form.Action.DirectSubmit}.\n     * Methods which have been imported by Ext.Direct can be specified here to load and submit\n     * forms.\n     * Such as the following:<pre><code>\napi: {\n    load: App.ss.MyProfile.load,\n    submit: App.ss.MyProfile.submit\n}\n</code></pre>\n     * <p>Load actions can use <code>{@link #paramOrder}</code> or <code>{@link #paramsAsHash}</code>\n     * to customize how the load method is invoked.\n     * Submit actions will always use a standard form submit. The formHandler configuration must\n     * be set on the associated server-side method which has been imported by Ext.Direct</p>\n     */\n\n    /**\n     * @cfg {Array/String} paramOrder <p>A list of params to be executed server side.\n     * Defaults to <tt>undefined</tt>. Only used for the <code>{@link #api}</code>\n     * <code>load</code> configuration.</p>\n     * <br><p>Specify the params in the order in which they must be executed on the\n     * server-side as either (1) an Array of String values, or (2) a String of params\n     * delimited by either whitespace, comma, or pipe. For example,\n     * any of the following would be acceptable:</p><pre><code>\nparamOrder: ['param1','param2','param3']\nparamOrder: 'param1 param2 param3'\nparamOrder: 'param1,param2,param3'\nparamOrder: 'param1|param2|param'\n     </code></pre>\n     */\n    paramOrder: undefined,\n\n    /**\n     * @cfg {Boolean} paramsAsHash Only used for the <code>{@link #api}</code>\n     * <code>load</code> configuration. Send parameters as a collection of named\n     * arguments (defaults to <tt>false</tt>). Providing a\n     * <tt>{@link #paramOrder}</tt> nullifies this configuration.\n     */\n    paramsAsHash: false,\n\n    /**\n     * @cfg {String} waitTitle\n     * The default title to show for the waiting message box (defaults to <tt>'Please Wait...'</tt>)\n     */\n    waitTitle: 'Please Wait...',\n\n    // private\n    activeAction : null,\n\n    /**\n     * @cfg {Boolean} trackResetOnLoad If set to <tt>true</tt>, {@link #reset}() resets to the last loaded\n     * or {@link #setValues}() data instead of when the form was first created.  Defaults to <tt>false</tt>.\n     */\n    trackResetOnLoad : false,\n\n    /**\n     * @cfg {Boolean} standardSubmit\n     * <p>If set to <tt>true</tt>, standard HTML form submits are used instead\n     * of XHR (Ajax) style form submissions. Defaults to <tt>false</tt>.</p>\n     * <br><p><b>Note:</b> When using <code>standardSubmit</code>, the\n     * <code>options</code> to <code>{@link #submit}</code> are ignored because\n     * Ext's Ajax infrastracture is bypassed. To pass extra parameters (e.g.\n     * <code>baseParams</code> and <code>params</code>), utilize hidden fields\n     * to submit extra data, for example:</p>\n     * <pre><code>\nnew Ext.FormPanel({\n    standardSubmit: true,\n    baseParams: {\n        foo: 'bar'\n    },\n    {@link url}: 'myProcess.php',\n    items: [{\n        xtype: 'textfield',\n        name: 'userName'\n    }],\n    buttons: [{\n        text: 'Save',\n        handler: function(){\n            var fp = this.ownerCt.ownerCt,\n                form = fp.getForm();\n            if (form.isValid()) {\n                // check if there are baseParams and if\n                // hiddent items have been added already\n                if (fp.baseParams && !fp.paramsAdded) {\n                    // add hidden items for all baseParams\n                    for (i in fp.baseParams) {\n                        fp.add({\n                            xtype: 'hidden',\n                            name: i,\n                            value: fp.baseParams[i]\n                        });\n                    }\n                    fp.doLayout();\n                    // set a custom flag to prevent re-adding\n                    fp.paramsAdded = true;\n                }\n                form.{@link #submit}();\n            }\n        }\n    }]\n});\n     * </code></pre>\n     */\n    /**\n     * By default wait messages are displayed with Ext.MessageBox.wait. You can target a specific\n     * element by passing it or its id or mask the form itself by passing in true.\n     * @type Mixed\n     * @property waitMsgTarget\n     */\n\n    // private\n    initEl : function(el){\n        this.el = Ext.get(el);\n        this.id = this.el.id || Ext.id();\n        if(!this.standardSubmit){\n            this.el.on('submit', this.onSubmit, this);\n        }\n        this.el.addClass('x-form');\n    },\n\n    /**\n     * Get the HTML form Element\n     * @return Ext.Element\n     */\n    getEl: function(){\n        return this.el;\n    },\n\n    // private\n    onSubmit : function(e){\n        e.stopEvent();\n    },\n\n    /**\n     * Destroys this object.\n     * @private\n     * @param {Boolean} bound true if the object is bound to a form panel. If this is the case\n     * the FormPanel will take care of destroying certain things, so we're just doubling up.\n     */\n    destroy: function(bound){\n        if(bound !== true){\n            this.items.each(function(f){\n                Ext.destroy(f);\n            });\n            Ext.destroy(this.el);\n        }\n        this.items.clear();\n        this.purgeListeners();\n    },\n\n    /**\n     * Returns true if client-side validation on the form is successful.\n     * @return Boolean\n     */\n    isValid : function(){\n        var valid = true;\n        this.items.each(function(f){\n           if(!f.validate()){\n               valid = false;\n           }\n        });\n        return valid;\n    },\n\n    /**\n     * <p>Returns true if any fields in this form have changed from their original values.</p>\n     * <p>Note that if this BasicForm was configured with {@link #trackResetOnLoad} then the\n     * Fields' <i>original values</i> are updated when the values are loaded by {@link #setValues}\n     * or {@link #loadRecord}.</p>\n     * @return Boolean\n     */\n    isDirty : function(){\n        var dirty = false;\n        this.items.each(function(f){\n           if(f.isDirty()){\n               dirty = true;\n               return false;\n           }\n        });\n        return dirty;\n    },\n\n    /**\n     * Performs a predefined action ({@link Ext.form.Action.Submit} or\n     * {@link Ext.form.Action.Load}) or a custom extension of {@link Ext.form.Action}\n     * to perform application-specific processing.\n     * @param {String/Object} actionName The name of the predefined action type,\n     * or instance of {@link Ext.form.Action} to perform.\n     * @param {Object} options (optional) The options to pass to the {@link Ext.form.Action}.\n     * All of the config options listed below are supported by both the\n     * {@link Ext.form.Action.Submit submit} and {@link Ext.form.Action.Load load}\n     * actions unless otherwise noted (custom actions could also accept\n     * other config options):<ul>\n     *\n     * <li><b>url</b> : String<div class=\"sub-desc\">The url for the action (defaults\n     * to the form's {@link #url}.)</div></li>\n     *\n     * <li><b>method</b> : String<div class=\"sub-desc\">The form method to use (defaults\n     * to the form's method, or POST if not defined)</div></li>\n     *\n     * <li><b>params</b> : String/Object<div class=\"sub-desc\"><p>The params to pass\n     * (defaults to the form's baseParams, or none if not defined)</p>\n     * <p>Parameters are encoded as standard HTTP parameters using {@link Ext#urlEncode}.</p></div></li>\n     *\n     * <li><b>headers</b> : Object<div class=\"sub-desc\">Request headers to set for the action\n     * (defaults to the form's default headers)</div></li>\n     *\n     * <li><b>success</b> : Function<div class=\"sub-desc\">The callback that will\n     * be invoked after a successful response (see top of\n     * {@link Ext.form.Action.Submit submit} and {@link Ext.form.Action.Load load}\n     * for a description of what constitutes a successful response).\n     * The function is passed the following parameters:<ul>\n     * <li><tt>form</tt> : Ext.form.BasicForm<div class=\"sub-desc\">The form that requested the action</div></li>\n     * <li><tt>action</tt> : The {@link Ext.form.Action Action} object which performed the operation.\n     * <div class=\"sub-desc\">The action object contains these properties of interest:<ul>\n     * <li><tt>{@link Ext.form.Action#response response}</tt></li>\n     * <li><tt>{@link Ext.form.Action#result result}</tt> : interrogate for custom postprocessing</li>\n     * <li><tt>{@link Ext.form.Action#type type}</tt></li>\n     * </ul></div></li></ul></div></li>\n     *\n     * <li><b>failure</b> : Function<div class=\"sub-desc\">The callback that will be invoked after a\n     * failed transaction attempt. The function is passed the following parameters:<ul>\n     * <li><tt>form</tt> : The {@link Ext.form.BasicForm} that requested the action.</li>\n     * <li><tt>action</tt> : The {@link Ext.form.Action Action} object which performed the operation.\n     * <div class=\"sub-desc\">The action object contains these properties of interest:<ul>\n     * <li><tt>{@link Ext.form.Action#failureType failureType}</tt></li>\n     * <li><tt>{@link Ext.form.Action#response response}</tt></li>\n     * <li><tt>{@link Ext.form.Action#result result}</tt> : interrogate for custom postprocessing</li>\n     * <li><tt>{@link Ext.form.Action#type type}</tt></li>\n     * </ul></div></li></ul></div></li>\n     *\n     * <li><b>scope</b> : Object<div class=\"sub-desc\">The scope in which to call the\n     * callback functions (The <tt>this</tt> reference for the callback functions).</div></li>\n     *\n     * <li><b>clientValidation</b> : Boolean<div class=\"sub-desc\">Submit Action only.\n     * Determines whether a Form's fields are validated in a final call to\n     * {@link Ext.form.BasicForm#isValid isValid} prior to submission. Set to <tt>false</tt>\n     * to prevent this. If undefined, pre-submission field validation is performed.</div></li></ul>\n     *\n     * @return {BasicForm} this\n     */\n    doAction : function(action, options){\n        if(Ext.isString(action)){\n            action = new Ext.form.Action.ACTION_TYPES[action](this, options);\n        }\n        if(this.fireEvent('beforeaction', this, action) !== false){\n            this.beforeAction(action);\n            action.run.defer(100, action);\n        }\n        return this;\n    },\n\n    /**\n     * Shortcut to {@link #doAction do} a {@link Ext.form.Action.Submit submit action}.\n     * @param {Object} options The options to pass to the action (see {@link #doAction} for details).<br>\n     * <p><b>Note:</b> this is ignored when using the {@link #standardSubmit} option.</p>\n     * <p>The following code:</p><pre><code>\nmyFormPanel.getForm().submit({\n    clientValidation: true,\n    url: 'updateConsignment.php',\n    params: {\n        newStatus: 'delivered'\n    },\n    success: function(form, action) {\n       Ext.Msg.alert('Success', action.result.msg);\n    },\n    failure: function(form, action) {\n        switch (action.failureType) {\n            case Ext.form.Action.CLIENT_INVALID:\n                Ext.Msg.alert('Failure', 'Form fields may not be submitted with invalid values');\n                break;\n            case Ext.form.Action.CONNECT_FAILURE:\n                Ext.Msg.alert('Failure', 'Ajax communication failed');\n                break;\n            case Ext.form.Action.SERVER_INVALID:\n               Ext.Msg.alert('Failure', action.result.msg);\n       }\n    }\n});\n</code></pre>\n     * would process the following server response for a successful submission:<pre><code>\n{\n    \"success\":true, // note this is Boolean, not string\n    \"msg\":\"Consignment updated\"\n}\n</code></pre>\n     * and the following server response for a failed submission:<pre><code>\n{\n    \"success\":false, // note this is Boolean, not string\n    \"msg\":\"You do not have permission to perform this operation\"\n}\n</code></pre>\n     * @return {BasicForm} this\n     */\n    submit : function(options){\n        options = options || {};\n        if(this.standardSubmit){\n            var v = options.clientValidation === false || this.isValid();\n            if(v){\n                var el = this.el.dom;\n                if(this.url && Ext.isEmpty(el.action)){\n                    el.action = this.url;\n                }\n                el.submit();\n            }\n            return v;\n        }\n        var submitAction = String.format('{0}submit', this.api ? 'direct' : '');\n        this.doAction(submitAction, options);\n        return this;\n    },\n\n    /**\n     * Shortcut to {@link #doAction do} a {@link Ext.form.Action.Load load action}.\n     * @param {Object} options The options to pass to the action (see {@link #doAction} for details)\n     * @return {BasicForm} this\n     */\n    load : function(options){\n        var loadAction = String.format('{0}load', this.api ? 'direct' : '');\n        this.doAction(loadAction, options);\n        return this;\n    },\n\n    /**\n     * Persists the values in this form into the passed {@link Ext.data.Record} object in a beginEdit/endEdit block.\n     * @param {Record} record The record to edit\n     * @return {BasicForm} this\n     */\n    updateRecord : function(record){\n        record.beginEdit();\n        var fs = record.fields,\n            field,\n            value;\n        fs.each(function(f){\n            field = this.findField(f.name);\n            if(field){\n                value = field.getValue();\n                if (Ext.type(value) !== false && value.getGroupValue) {\n                    value = value.getGroupValue();\n                } else if ( field.eachItem ) {\n                    value = [];\n                    field.eachItem(function(item){\n                        value.push(item.getValue());\n                    });\n                }\n                record.set(f.name, value);\n            }\n        }, this);\n        record.endEdit();\n        return this;\n    },\n\n    /**\n     * Loads an {@link Ext.data.Record} into this form by calling {@link #setValues} with the\n     * {@link Ext.data.Record#data record data}.\n     * See also {@link #trackResetOnLoad}.\n     * @param {Record} record The record to load\n     * @return {BasicForm} this\n     */\n    loadRecord : function(record){\n        this.setValues(record.data);\n        return this;\n    },\n\n    // private\n    beforeAction : function(action){\n        // Call HtmlEditor's syncValue before actions\n        this.items.each(function(f){\n            if(f.isFormField && f.syncValue){\n                f.syncValue();\n            }\n        });\n        var o = action.options;\n        if(o.waitMsg){\n            if(this.waitMsgTarget === true){\n                this.el.mask(o.waitMsg, 'x-mask-loading');\n            }else if(this.waitMsgTarget){\n                this.waitMsgTarget = Ext.get(this.waitMsgTarget);\n                this.waitMsgTarget.mask(o.waitMsg, 'x-mask-loading');\n            }else{\n                Ext.MessageBox.wait(o.waitMsg, o.waitTitle || this.waitTitle);\n            }\n        }\n    },\n\n    // private\n    afterAction : function(action, success){\n        this.activeAction = null;\n        var o = action.options;\n        if(o.waitMsg){\n            if(this.waitMsgTarget === true){\n                this.el.unmask();\n            }else if(this.waitMsgTarget){\n                this.waitMsgTarget.unmask();\n            }else{\n                Ext.MessageBox.updateProgress(1);\n                Ext.MessageBox.hide();\n            }\n        }\n        if(success){\n            if(o.reset){\n                this.reset();\n            }\n            Ext.callback(o.success, o.scope, [this, action]);\n            this.fireEvent('actioncomplete', this, action);\n        }else{\n            Ext.callback(o.failure, o.scope, [this, action]);\n            this.fireEvent('actionfailed', this, action);\n        }\n    },\n\n    /**\n     * Find a {@link Ext.form.Field} in this form.\n     * @param {String} id The value to search for (specify either a {@link Ext.Component#id id},\n     * {@link Ext.grid.Column#dataIndex dataIndex}, {@link Ext.form.Field#getName name or hiddenName}).\n     * @return Field\n     */\n    findField : function(id) {\n        var field = this.items.get(id);\n\n        if (!Ext.isObject(field)) {\n            //searches for the field corresponding to the given id. Used recursively for composite fields\n            var findMatchingField = function(f) {\n                if (f.isFormField) {\n                    if (f.dataIndex == id || f.id == id || f.getName() == id) {\n                        field = f;\n                        return false;\n                    } else if (f.isComposite) {\n                        return f.items.each(findMatchingField);\n                    } else if (f instanceof Ext.form.CheckboxGroup && f.rendered) {\n                        return f.eachItem(findMatchingField);\n                    }\n                }\n            };\n\n            this.items.each(findMatchingField);\n        }\n        return field || null;\n    },\n\n\n    /**\n     * Mark fields in this form invalid in bulk.\n     * @param {Array/Object} errors Either an array in the form [{id:'fieldId', msg:'The message'},...] or an object hash of {id: msg, id2: msg2}\n     * @return {BasicForm} this\n     */\n    markInvalid : function(errors){\n        if (Ext.isArray(errors)) {\n            for(var i = 0, len = errors.length; i < len; i++){\n                var fieldError = errors[i];\n                var f = this.findField(fieldError.id);\n                if(f){\n                    f.markInvalid(fieldError.msg);\n                }\n            }\n        } else {\n            var field, id;\n            for(id in errors){\n                if(!Ext.isFunction(errors[id]) && (field = this.findField(id))){\n                    field.markInvalid(errors[id]);\n                }\n            }\n        }\n\n        return this;\n    },\n\n    /**\n     * Set values for fields in this form in bulk.\n     * @param {Array/Object} values Either an array in the form:<pre><code>\n[{id:'clientName', value:'Fred. Olsen Lines'},\n {id:'portOfLoading', value:'FXT'},\n {id:'portOfDischarge', value:'OSL'} ]</code></pre>\n     * or an object hash of the form:<pre><code>\n{\n    clientName: 'Fred. Olsen Lines',\n    portOfLoading: 'FXT',\n    portOfDischarge: 'OSL'\n}</code></pre>\n     * @return {BasicForm} this\n     */\n    setValues : function(values){\n        if(Ext.isArray(values)){ // array of objects\n            for(var i = 0, len = values.length; i < len; i++){\n                var v = values[i];\n                var f = this.findField(v.id);\n                if(f){\n                    f.setValue(v.value);\n                    if(this.trackResetOnLoad){\n                        f.originalValue = f.getValue();\n                    }\n                }\n            }\n        }else{ // object hash\n            var field, id;\n            for(id in values){\n                if(!Ext.isFunction(values[id]) && (field = this.findField(id))){\n                    field.setValue(values[id]);\n                    if(this.trackResetOnLoad){\n                        field.originalValue = field.getValue();\n                    }\n                }\n            }\n        }\n        return this;\n    },\n\n    /**\n     * <p>Returns the fields in this form as an object with key/value pairs as they would be submitted using a standard form submit.\n     * If multiple fields exist with the same name they are returned as an array.</p>\n     * <p><b>Note:</b> The values are collected from all enabled HTML input elements within the form, <u>not</u> from\n     * the Ext Field objects. This means that all returned values are Strings (or Arrays of Strings) and that the\n     * value can potentially be the emptyText of a field.</p>\n     * @param {Boolean} asString (optional) Pass true to return the values as a string. (defaults to false, returning an Object)\n     * @return {String/Object}\n     */\n    getValues : function(asString){\n        var fs = Ext.lib.Ajax.serializeForm(this.el.dom);\n        if(asString === true){\n            return fs;\n        }\n        return Ext.urlDecode(fs);\n    },\n\n    /**\n     * Retrieves the fields in the form as a set of key/value pairs, using the {@link Ext.form.Field#getValue getValue()} method.\n     * If multiple fields exist with the same name they are returned as an array.\n     * @param {Boolean} dirtyOnly (optional) True to return only fields that are dirty.\n     * @return {Object} The values in the form\n     */\n    getFieldValues : function(dirtyOnly){\n        var o = {},\n            n,\n            key,\n            val;\n        this.items.each(function(f) {\n            if (!f.disabled && (dirtyOnly !== true || f.isDirty())) {\n                n = f.getName();\n                key = o[n];\n                val = f.getValue();\n\n                if(Ext.isDefined(key)){\n                    if(Ext.isArray(key)){\n                        o[n].push(val);\n                    }else{\n                        o[n] = [key, val];\n                    }\n                }else{\n                    o[n] = val;\n                }\n            }\n        });\n        return o;\n    },\n\n    /**\n     * Clears all invalid messages in this form.\n     * @return {BasicForm} this\n     */\n    clearInvalid : function(){\n        this.items.each(function(f){\n           f.clearInvalid();\n        });\n        return this;\n    },\n\n    /**\n     * Resets this form.\n     * @return {BasicForm} this\n     */\n    reset : function(){\n        this.items.each(function(f){\n            f.reset();\n        });\n        return this;\n    },\n\n    /**\n     * Add Ext.form Components to this form's Collection. This does not result in rendering of\n     * the passed Component, it just enables the form to validate Fields, and distribute values to\n     * Fields.\n     * <p><b>You will not usually call this function. In order to be rendered, a Field must be added\n     * to a {@link Ext.Container Container}, usually an {@link Ext.form.FormPanel FormPanel}.\n     * The FormPanel to which the field is added takes care of adding the Field to the BasicForm's\n     * collection.</b></p>\n     * @param {Field} field1\n     * @param {Field} field2 (optional)\n     * @param {Field} etc (optional)\n     * @return {BasicForm} this\n     */\n    add : function(){\n        this.items.addAll(Array.prototype.slice.call(arguments, 0));\n        return this;\n    },\n\n    /**\n     * Removes a field from the items collection (does NOT remove its markup).\n     * @param {Field} field\n     * @return {BasicForm} this\n     */\n    remove : function(field){\n        this.items.remove(field);\n        return this;\n    },\n\n    /**\n     * Removes all fields from the collection that have been destroyed.\n     */\n    cleanDestroyed : function() {\n        this.items.filterBy(function(o) { return !!o.isDestroyed; }).each(this.remove, this);\n    },\n\n    /**\n     * Iterates through the {@link Ext.form.Field Field}s which have been {@link #add add}ed to this BasicForm,\n     * checks them for an id attribute, and calls {@link Ext.form.Field#applyToMarkup} on the existing dom element with that id.\n     * @return {BasicForm} this\n     */\n    render : function(){\n        this.items.each(function(f){\n            if(f.isFormField && !f.rendered && document.getElementById(f.id)){ // if the element exists\n                f.applyToMarkup(f.id);\n            }\n        });\n        return this;\n    },\n\n    /**\n     * Calls {@link Ext#apply} for all fields in this form with the passed object.\n     * @param {Object} values\n     * @return {BasicForm} this\n     */\n    applyToFields : function(o){\n        this.items.each(function(f){\n           Ext.apply(f, o);\n        });\n        return this;\n    },\n\n    /**\n     * Calls {@link Ext#applyIf} for all field in this form with the passed object.\n     * @param {Object} values\n     * @return {BasicForm} this\n     */\n    applyIfToFields : function(o){\n        this.items.each(function(f){\n           Ext.applyIf(f, o);\n        });\n        return this;\n    },\n\n    callFieldMethod : function(fnName, args){\n        args = args || [];\n        this.items.each(function(f){\n            if(Ext.isFunction(f[fnName])){\n                f[fnName].apply(f, args);\n            }\n        });\n        return this;\n    }\n});\n\n// back compat\nExt.BasicForm = Ext.form.BasicForm;\n/**\n * @class Ext.form.FormPanel\n * @extends Ext.Panel\n * <p>Standard form container.</p>\n *\n * <p><b><u>Layout</u></b></p>\n * <p>By default, FormPanel is configured with <tt>layout:'form'</tt> to use an {@link Ext.layout.FormLayout}\n * layout manager, which styles and renders fields and labels correctly. When nesting additional Containers\n * within a FormPanel, you should ensure that any descendant Containers which host input Fields use the\n * {@link Ext.layout.FormLayout} layout manager.</p>\n *\n * <p><b><u>BasicForm</u></b></p>\n * <p>Although <b>not listed</b> as configuration options of FormPanel, the FormPanel class accepts all\n * of the config options required to configure its internal {@link Ext.form.BasicForm} for:\n * <div class=\"mdetail-params\"><ul>\n * <li>{@link Ext.form.BasicForm#fileUpload file uploads}</li>\n * <li>functionality for {@link Ext.form.BasicForm#doAction loading, validating and submitting} the form</li>\n * </ul></div>\n *\n * <p><b>Note</b>: If subclassing FormPanel, any configuration options for the BasicForm must be applied to\n * the <tt><b>initialConfig</b></tt> property of the FormPanel. Applying {@link Ext.form.BasicForm BasicForm}\n * configuration settings to <b><tt>this</tt></b> will <b>not</b> affect the BasicForm's configuration.</p>\n *\n * <p><b><u>Form Validation</u></b></p>\n * <p>For information on form validation see the following:</p>\n * <div class=\"mdetail-params\"><ul>\n * <li>{@link Ext.form.TextField}</li>\n * <li>{@link Ext.form.VTypes}</li>\n * <li>{@link Ext.form.BasicForm#doAction BasicForm.doAction <b>clientValidation</b> notes}</li>\n * <li><tt>{@link Ext.form.FormPanel#monitorValid monitorValid}</tt></li>\n * </ul></div>\n *\n * <p><b><u>Form Submission</u></b></p>\n * <p>By default, Ext Forms are submitted through Ajax, using {@link Ext.form.Action}. To enable normal browser\n * submission of the {@link Ext.form.BasicForm BasicForm} contained in this FormPanel, see the\n * <tt><b>{@link Ext.form.BasicForm#standardSubmit standardSubmit}</b></tt> option.</p>\n *\n * @constructor\n * @param {Object} config Configuration options\n * @xtype form\n */\nExt.FormPanel = Ext.extend(Ext.Panel, {\n    /**\n     * @cfg {String} formId (optional) The id of the FORM tag (defaults to an auto-generated id).\n     */\n    /**\n     * @cfg {Boolean} hideLabels\n     * <p><tt>true</tt> to hide field labels by default (sets <tt>display:none</tt>). Defaults to\n     * <tt>false</tt>.</p>\n     * <p>Also see {@link Ext.Component}.<tt>{@link Ext.Component#hideLabel hideLabel}</tt>.\n     */\n    /**\n     * @cfg {Number} labelPad\n     * The default padding in pixels for field labels (defaults to <tt>5</tt>). <tt>labelPad</tt> only\n     * applies if <tt>{@link #labelWidth}</tt> is also specified, otherwise it will be ignored.\n     */\n    /**\n     * @cfg {String} labelSeparator\n     * See {@link Ext.Component}.<tt>{@link Ext.Component#labelSeparator labelSeparator}</tt>\n     */\n    /**\n     * @cfg {Number} labelWidth The width of labels in pixels. This property cascades to child containers\n     * and can be overridden on any child container (e.g., a fieldset can specify a different <tt>labelWidth</tt>\n     * for its fields) (defaults to <tt>100</tt>).\n     */\n    /**\n     * @cfg {String} itemCls A css class to apply to the x-form-item of fields. This property cascades to child containers.\n     */\n    /**\n     * @cfg {Array} buttons\n     * An array of {@link Ext.Button}s or {@link Ext.Button} configs used to add buttons to the footer of this FormPanel.<br>\n     * <p>Buttons in the footer of a FormPanel may be configured with the option <tt>formBind: true</tt>. This causes\n     * the form's {@link #monitorValid valid state monitor task} to enable/disable those Buttons depending on\n     * the form's valid/invalid state.</p>\n     */\n\n\n    /**\n     * @cfg {Number} minButtonWidth Minimum width of all buttons in pixels (defaults to <tt>75</tt>).\n     */\n    minButtonWidth : 75,\n\n    /**\n     * @cfg {String} labelAlign The label alignment value used for the <tt>text-align</tt> specification\n     * for the <b>container</b>. Valid values are <tt>\"left</tt>\", <tt>\"top\"</tt> or <tt>\"right\"</tt>\n     * (defaults to <tt>\"left\"</tt>). This property cascades to child <b>containers</b> and can be\n     * overridden on any child <b>container</b> (e.g., a fieldset can specify a different <tt>labelAlign</tt>\n     * for its fields).\n     */\n    labelAlign : 'left',\n\n    /**\n     * @cfg {Boolean} monitorValid If <tt>true</tt>, the form monitors its valid state <b>client-side</b> and\n     * regularly fires the {@link #clientvalidation} event passing that state.<br>\n     * <p>When monitoring valid state, the FormPanel enables/disables any of its configured\n     * {@link #buttons} which have been configured with <code>formBind: true</code> depending\n     * on whether the {@link Ext.form.BasicForm#isValid form is valid} or not. Defaults to <tt>false</tt></p>\n     */\n    monitorValid : false,\n\n    /**\n     * @cfg {Number} monitorPoll The milliseconds to poll valid state, ignored if monitorValid is not true (defaults to 200)\n     */\n    monitorPoll : 200,\n\n    /**\n     * @cfg {String} layout Defaults to <tt>'form'</tt>.  Normally this configuration property should not be altered.\n     * For additional details see {@link Ext.layout.FormLayout} and {@link Ext.Container#layout Ext.Container.layout}.\n     */\n    layout : 'form',\n\n    // private\n    initComponent : function(){\n        this.form = this.createForm();\n        Ext.FormPanel.superclass.initComponent.call(this);\n\n        this.bodyCfg = {\n            tag: 'form',\n            cls: this.baseCls + '-body',\n            method : this.method || 'POST',\n            id : this.formId || Ext.id()\n        };\n        if(this.fileUpload) {\n            this.bodyCfg.enctype = 'multipart/form-data';\n        }\n        this.initItems();\n\n        this.addEvents(\n            /**\n             * @event clientvalidation\n             * If the monitorValid config option is true, this event fires repetitively to notify of valid state\n             * @param {Ext.form.FormPanel} this\n             * @param {Boolean} valid true if the form has passed client-side validation\n             */\n            'clientvalidation'\n        );\n\n        this.relayEvents(this.form, ['beforeaction', 'actionfailed', 'actioncomplete']);\n    },\n\n    // private\n    createForm : function(){\n        var config = Ext.applyIf({listeners: {}}, this.initialConfig);\n        return new Ext.form.BasicForm(null, config);\n    },\n\n    // private\n    initFields : function(){\n        var f = this.form;\n        var formPanel = this;\n        var fn = function(c){\n            if(formPanel.isField(c)){\n                f.add(c);\n            }else if(c.findBy && c != formPanel){\n                formPanel.applySettings(c);\n                //each check required for check/radio groups.\n                if(c.items && c.items.each){\n                    c.items.each(fn, this);\n                }\n            }\n        };\n        this.items.each(fn, this);\n    },\n\n    // private\n    applySettings: function(c){\n        var ct = c.ownerCt;\n        Ext.applyIf(c, {\n            labelAlign: ct.labelAlign,\n            labelWidth: ct.labelWidth,\n            itemCls: ct.itemCls\n        });\n    },\n\n    // private\n    getLayoutTarget : function(){\n        return this.form.el;\n    },\n\n    /**\n     * Provides access to the {@link Ext.form.BasicForm Form} which this Panel contains.\n     * @return {Ext.form.BasicForm} The {@link Ext.form.BasicForm Form} which this Panel contains.\n     */\n    getForm : function(){\n        return this.form;\n    },\n\n    // private\n    onRender : function(ct, position){\n        this.initFields();\n        Ext.FormPanel.superclass.onRender.call(this, ct, position);\n        this.form.initEl(this.body);\n    },\n\n    // private\n    beforeDestroy : function(){\n        this.stopMonitoring();\n        this.form.destroy(true);\n        Ext.FormPanel.superclass.beforeDestroy.call(this);\n    },\n\n    // Determine if a Component is usable as a form Field.\n    isField : function(c) {\n        return !!c.setValue && !!c.getValue && !!c.markInvalid && !!c.clearInvalid;\n    },\n\n    // private\n    initEvents : function(){\n        Ext.FormPanel.superclass.initEvents.call(this);\n        // Listeners are required here to catch bubbling events from children.\n        this.on({\n            scope: this,\n            add: this.onAddEvent,\n            remove: this.onRemoveEvent\n        });\n        if(this.monitorValid){ // initialize after render\n            this.startMonitoring();\n        }\n    },\n\n    // private\n    onAdd: function(c){\n        Ext.FormPanel.superclass.onAdd.call(this, c);\n        this.processAdd(c);\n    },\n\n    // private\n    onAddEvent: function(ct, c){\n        if(ct !== this){\n            this.processAdd(c);\n        }\n    },\n\n    // private\n    processAdd : function(c){\n        // If a single form Field, add it\n        if(this.isField(c)){\n            this.form.add(c);\n        // If a Container, add any Fields it might contain\n        }else if(c.findBy){\n            this.applySettings(c);\n            this.form.add.apply(this.form, c.findBy(this.isField));\n        }\n    },\n\n    // private\n    onRemove: function(c){\n        Ext.FormPanel.superclass.onRemove.call(this, c);\n        this.processRemove(c);\n    },\n\n    onRemoveEvent: function(ct, c){\n        if(ct !== this){\n            this.processRemove(c);\n        }\n    },\n\n    // private\n    processRemove: function(c){\n        if(!this.destroying){\n            // If a single form Field, remove it\n            if(this.isField(c)){\n                this.form.remove(c);\n            // If a Container, its already destroyed by the time it gets here.  Remove any references to destroyed fields.\n            }else if (c.findBy){\n                Ext.each(c.findBy(this.isField), this.form.remove, this.form);\n                /*\n                 * This isn't the most efficient way of getting rid of the items, however it's the most\n                 * correct, which in this case is most important.\n                 */\n                this.form.cleanDestroyed();\n            }\n        }\n    },\n\n    /**\n     * Starts monitoring of the valid state of this form. Usually this is done by passing the config\n     * option \"monitorValid\"\n     */\n    startMonitoring : function(){\n        if(!this.validTask){\n            this.validTask = new Ext.util.TaskRunner();\n            this.validTask.start({\n                run : this.bindHandler,\n                interval : this.monitorPoll || 200,\n                scope: this\n            });\n        }\n    },\n\n    /**\n     * Stops monitoring of the valid state of this form\n     */\n    stopMonitoring : function(){\n        if(this.validTask){\n            this.validTask.stopAll();\n            this.validTask = null;\n        }\n    },\n\n    /**\n     * This is a proxy for the underlying BasicForm's {@link Ext.form.BasicForm#load} call.\n     * @param {Object} options The options to pass to the action (see {@link Ext.form.BasicForm#doAction} for details)\n     */\n    load : function(){\n        this.form.load.apply(this.form, arguments);\n    },\n\n    // private\n    onDisable : function(){\n        Ext.FormPanel.superclass.onDisable.call(this);\n        if(this.form){\n            this.form.items.each(function(){\n                 this.disable();\n            });\n        }\n    },\n\n    // private\n    onEnable : function(){\n        Ext.FormPanel.superclass.onEnable.call(this);\n        if(this.form){\n            this.form.items.each(function(){\n                 this.enable();\n            });\n        }\n    },\n\n    // private\n    bindHandler : function(){\n        var valid = true;\n        this.form.items.each(function(f){\n            if(!f.isValid(true)){\n                valid = false;\n                return false;\n            }\n        });\n        if(this.fbar){\n            var fitems = this.fbar.items.items;\n            for(var i = 0, len = fitems.length; i < len; i++){\n                var btn = fitems[i];\n                if(btn.formBind === true && btn.disabled === valid){\n                    btn.setDisabled(!valid);\n                }\n            }\n        }\n        this.fireEvent('clientvalidation', this, valid);\n    }\n});\nExt.reg('form', Ext.FormPanel);\n\nExt.form.FormPanel = Ext.FormPanel;\n/**\n * @class Ext.form.FieldSet\n * @extends Ext.Panel\n * Standard container used for grouping items within a {@link Ext.form.FormPanel form}.\n * <pre><code>\nvar form = new Ext.FormPanel({\n    title: 'Simple Form with FieldSets',\n    labelWidth: 75, // label settings here cascade unless overridden\n    url: 'save-form.php',\n    frame:true,\n    bodyStyle:'padding:5px 5px 0',\n    width: 700,\n    renderTo: document.body,\n    layout:'column', // arrange items in columns\n    defaults: {      // defaults applied to items\n        layout: 'form',\n        border: false,\n        bodyStyle: 'padding:4px'\n    },\n    items: [{\n        // Fieldset in Column 1\n        xtype:'fieldset',\n        columnWidth: 0.5,\n        title: 'Fieldset 1',\n        collapsible: true,\n        autoHeight:true,\n        defaults: {\n            anchor: '-20' // leave room for error icon\n        },\n        defaultType: 'textfield',\n        items :[{\n                fieldLabel: 'Field 1'\n            }, {\n                fieldLabel: 'Field 2'\n            }, {\n                fieldLabel: 'Field 3'\n            }\n        ]\n    },{\n        // Fieldset in Column 2 - Panel inside\n        xtype:'fieldset',\n        title: 'Show Panel', // title, header, or checkboxToggle creates fieldset header\n        autoHeight:true,\n        columnWidth: 0.5,\n        checkboxToggle: true,\n        collapsed: true, // fieldset initially collapsed\n        layout:'anchor',\n        items :[{\n            xtype: 'panel',\n            anchor: '100%',\n            title: 'Panel inside a fieldset',\n            frame: true,\n            height: 100\n        }]\n    }]\n});\n * </code></pre>\n * @constructor\n * @param {Object} config Configuration options\n * @xtype fieldset\n */\nExt.form.FieldSet = Ext.extend(Ext.Panel, {\n    /**\n     * @cfg {Mixed} checkboxToggle <tt>true</tt> to render a checkbox into the fieldset frame just\n     * in front of the legend to expand/collapse the fieldset when the checkbox is toggled. (defaults\n     * to <tt>false</tt>).\n     * <p>A {@link Ext.DomHelper DomHelper} element spec may also be specified to create the checkbox.\n     * If <tt>true</tt> is specified, the default DomHelper config object used to create the element\n     * is:</p><pre><code>\n     * {tag: 'input', type: 'checkbox', name: this.checkboxName || this.id+'-checkbox'}\n     * </code></pre>\n     */\n    /**\n     * @cfg {String} checkboxName The name to assign to the fieldset's checkbox if <tt>{@link #checkboxToggle} = true</tt>\n     * (defaults to <tt>'[checkbox id]-checkbox'</tt>).\n     */\n    /**\n     * @cfg {Boolean} collapsible\n     * <tt>true</tt> to make the fieldset collapsible and have the expand/collapse toggle button automatically\n     * rendered into the legend element, <tt>false</tt> to keep the fieldset statically sized with no collapse\n     * button (defaults to <tt>false</tt>). Another option is to configure <tt>{@link #checkboxToggle}</tt>.\n     */\n    /**\n     * @cfg {Number} labelWidth The width of labels. This property cascades to child containers.\n     */\n    /**\n     * @cfg {String} itemCls A css class to apply to the <tt>x-form-item</tt> of fields (see\n     * {@link Ext.layout.FormLayout}.{@link Ext.layout.FormLayout#fieldTpl fieldTpl} for details).\n     * This property cascades to child containers.\n     */\n    /**\n     * @cfg {String} baseCls The base CSS class applied to the fieldset (defaults to <tt>'x-fieldset'</tt>).\n     */\n    baseCls : 'x-fieldset',\n    /**\n     * @cfg {String} layout The {@link Ext.Container#layout} to use inside the fieldset (defaults to <tt>'form'</tt>).\n     */\n    layout : 'form',\n    /**\n     * @cfg {Boolean} animCollapse\n     * <tt>true</tt> to animate the transition when the panel is collapsed, <tt>false</tt> to skip the\n     * animation (defaults to <tt>false</tt>).\n     */\n    animCollapse : false,\n\n    // private\n    onRender : function(ct, position){\n        if(!this.el){\n            this.el = document.createElement('fieldset');\n            this.el.id = this.id;\n            if (this.title || this.header || this.checkboxToggle) {\n                this.el.appendChild(document.createElement('legend')).className = this.baseCls + '-header';\n            }\n        }\n\n        Ext.form.FieldSet.superclass.onRender.call(this, ct, position);\n\n        if(this.checkboxToggle){\n            var o = typeof this.checkboxToggle == 'object' ?\n                    this.checkboxToggle :\n                    {tag: 'input', type: 'checkbox', name: this.checkboxName || this.id+'-checkbox'};\n            this.checkbox = this.header.insertFirst(o);\n            this.checkbox.dom.checked = !this.collapsed;\n            this.mon(this.checkbox, 'click', this.onCheckClick, this);\n        }\n    },\n\n    // private\n    onCollapse : function(doAnim, animArg){\n        if(this.checkbox){\n            this.checkbox.dom.checked = false;\n        }\n        Ext.form.FieldSet.superclass.onCollapse.call(this, doAnim, animArg);\n\n    },\n\n    // private\n    onExpand : function(doAnim, animArg){\n        if(this.checkbox){\n            this.checkbox.dom.checked = true;\n        }\n        Ext.form.FieldSet.superclass.onExpand.call(this, doAnim, animArg);\n    },\n\n    /**\n     * This function is called by the fieldset's checkbox when it is toggled (only applies when\n     * checkboxToggle = true).  This method should never be called externally, but can be\n     * overridden to provide custom behavior when the checkbox is toggled if needed.\n     */\n    onCheckClick : function(){\n        this[this.checkbox.dom.checked ? 'expand' : 'collapse']();\n    }\n\n    /**\n     * @cfg {String/Number} activeItem\n     * @hide\n     */\n    /**\n     * @cfg {Mixed} applyTo\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} bodyBorder\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} border\n     * @hide\n     */\n    /**\n     * @cfg {Boolean/Number} bufferResize\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} collapseFirst\n     * @hide\n     */\n    /**\n     * @cfg {String} defaultType\n     * @hide\n     */\n    /**\n     * @cfg {String} disabledClass\n     * @hide\n     */\n    /**\n     * @cfg {String} elements\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} floating\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} footer\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} frame\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} header\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} headerAsText\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} hideCollapseTool\n     * @hide\n     */\n    /**\n     * @cfg {String} iconCls\n     * @hide\n     */\n    /**\n     * @cfg {Boolean/String} shadow\n     * @hide\n     */\n    /**\n     * @cfg {Number} shadowOffset\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} shim\n     * @hide\n     */\n    /**\n     * @cfg {Object/Array} tbar\n     * @hide\n     */\n    /**\n     * @cfg {Array} tools\n     * @hide\n     */\n    /**\n     * @cfg {Ext.Template/Ext.XTemplate} toolTemplate\n     * @hide\n     */\n    /**\n     * @cfg {String} xtype\n     * @hide\n     */\n    /**\n     * @property header\n     * @hide\n     */\n    /**\n     * @property footer\n     * @hide\n     */\n    /**\n     * @method focus\n     * @hide\n     */\n    /**\n     * @method getBottomToolbar\n     * @hide\n     */\n    /**\n     * @method getTopToolbar\n     * @hide\n     */\n    /**\n     * @method setIconClass\n     * @hide\n     */\n    /**\n     * @event activate\n     * @hide\n     */\n    /**\n     * @event beforeclose\n     * @hide\n     */\n    /**\n     * @event bodyresize\n     * @hide\n     */\n    /**\n     * @event close\n     * @hide\n     */\n    /**\n     * @event deactivate\n     * @hide\n     */\n});\nExt.reg('fieldset', Ext.form.FieldSet);/**\n * @class Ext.form.HtmlEditor\n * @extends Ext.form.Field\n * Provides a lightweight HTML Editor component. Some toolbar features are not supported by Safari and will be\n * automatically hidden when needed.  These are noted in the config options where appropriate.\n * <br><br>The editor's toolbar buttons have tooltips defined in the {@link #buttonTips} property, but they are not\n * enabled by default unless the global {@link Ext.QuickTips} singleton is {@link Ext.QuickTips#init initialized}.\n * <br><br><b>Note: The focus/blur and validation marking functionality inherited from Ext.form.Field is NOT\n * supported by this editor.</b>\n * <br><br>An Editor is a sensitive component that can't be used in all spots standard fields can be used. Putting an Editor within\n * any element that has display set to 'none' can cause problems in Safari and Firefox due to their default iframe reloading bugs.\n * <br><br>Example usage:\n * <pre><code>\n// Simple example rendered with default options:\nExt.QuickTips.init();  // enable tooltips\nnew Ext.form.HtmlEditor({\n    renderTo: Ext.getBody(),\n    width: 800,\n    height: 300\n});\n\n// Passed via xtype into a container and with custom options:\nExt.QuickTips.init();  // enable tooltips\nnew Ext.Panel({\n    title: 'HTML Editor',\n    renderTo: Ext.getBody(),\n    width: 600,\n    height: 300,\n    frame: true,\n    layout: 'fit',\n    items: {\n        xtype: 'htmleditor',\n        enableColors: false,\n        enableAlignments: false\n    }\n});\n</code></pre>\n * @constructor\n * Create a new HtmlEditor\n * @param {Object} config\n * @xtype htmleditor\n */\n\nExt.form.HtmlEditor = Ext.extend(Ext.form.Field, {\n    /**\n     * @cfg {Boolean} enableFormat Enable the bold, italic and underline buttons (defaults to true)\n     */\n    enableFormat : true,\n    /**\n     * @cfg {Boolean} enableFontSize Enable the increase/decrease font size buttons (defaults to true)\n     */\n    enableFontSize : true,\n    /**\n     * @cfg {Boolean} enableColors Enable the fore/highlight color buttons (defaults to true)\n     */\n    enableColors : true,\n    /**\n     * @cfg {Boolean} enableAlignments Enable the left, center, right alignment buttons (defaults to true)\n     */\n    enableAlignments : true,\n    /**\n     * @cfg {Boolean} enableLists Enable the bullet and numbered list buttons. Not available in Safari. (defaults to true)\n     */\n    enableLists : true,\n    /**\n     * @cfg {Boolean} enableSourceEdit Enable the switch to source edit button. Not available in Safari. (defaults to true)\n     */\n    enableSourceEdit : true,\n    /**\n     * @cfg {Boolean} enableLinks Enable the create link button. Not available in Safari. (defaults to true)\n     */\n    enableLinks : true,\n    /**\n     * @cfg {Boolean} enableFont Enable font selection. Not available in Safari. (defaults to true)\n     */\n    enableFont : true,\n    /**\n     * @cfg {String} createLinkText The default text for the create link prompt\n     */\n    createLinkText : 'Please enter the URL for the link:',\n    /**\n     * @cfg {String} defaultLinkValue The default value for the create link prompt (defaults to http:/ /)\n     */\n    defaultLinkValue : 'http:/'+'/',\n    /**\n     * @cfg {Array} fontFamilies An array of available font families\n     */\n    fontFamilies : [\n        'Arial',\n        'Courier New',\n        'Tahoma',\n        'Times New Roman',\n        'Verdana'\n    ],\n    defaultFont: 'tahoma',\n    /**\n     * @cfg {String} defaultValue A default value to be put into the editor to resolve focus issues (defaults to &#160; (Non-breaking space) in Opera and IE6, &#8203; (Zero-width space) in all other browsers).\n     */\n    defaultValue: (Ext.isOpera || Ext.isIE6) ? '&#160;' : '&#8203;',\n\n    // private properties\n    actionMode: 'wrap',\n    validationEvent : false,\n    deferHeight: true,\n    initialized : false,\n    activated : false,\n    sourceEditMode : false,\n    onFocus : Ext.emptyFn,\n    iframePad:3,\n    hideMode:'offsets',\n    defaultAutoCreate : {\n        tag: \"textarea\",\n        style:\"width:500px;height:300px;\",\n        autocomplete: \"off\"\n    },\n\n    // private\n    initComponent : function(){\n        this.addEvents(\n            /**\n             * @event initialize\n             * Fires when the editor is fully initialized (including the iframe)\n             * @param {HtmlEditor} this\n             */\n            'initialize',\n            /**\n             * @event activate\n             * Fires when the editor is first receives the focus. Any insertion must wait\n             * until after this event.\n             * @param {HtmlEditor} this\n             */\n            'activate',\n             /**\n             * @event beforesync\n             * Fires before the textarea is updated with content from the editor iframe. Return false\n             * to cancel the sync.\n             * @param {HtmlEditor} this\n             * @param {String} html\n             */\n            'beforesync',\n             /**\n             * @event beforepush\n             * Fires before the iframe editor is updated with content from the textarea. Return false\n             * to cancel the push.\n             * @param {HtmlEditor} this\n             * @param {String} html\n             */\n            'beforepush',\n             /**\n             * @event sync\n             * Fires when the textarea is updated with content from the editor iframe.\n             * @param {HtmlEditor} this\n             * @param {String} html\n             */\n            'sync',\n             /**\n             * @event push\n             * Fires when the iframe editor is updated with content from the textarea.\n             * @param {HtmlEditor} this\n             * @param {String} html\n             */\n            'push',\n             /**\n             * @event editmodechange\n             * Fires when the editor switches edit modes\n             * @param {HtmlEditor} this\n             * @param {Boolean} sourceEdit True if source edit, false if standard editing.\n             */\n            'editmodechange'\n        );\n        Ext.form.HtmlEditor.superclass.initComponent.call(this);\n    },\n\n    // private\n    createFontOptions : function(){\n        var buf = [], fs = this.fontFamilies, ff, lc;\n        for(var i = 0, len = fs.length; i< len; i++){\n            ff = fs[i];\n            lc = ff.toLowerCase();\n            buf.push(\n                '<option value=\"',lc,'\" style=\"font-family:',ff,';\"',\n                    (this.defaultFont == lc ? ' selected=\"true\">' : '>'),\n                    ff,\n                '</option>'\n            );\n        }\n        return buf.join('');\n    },\n\n    /*\n     * Protected method that will not generally be called directly. It\n     * is called when the editor creates its toolbar. Override this method if you need to\n     * add custom toolbar buttons.\n     * @param {HtmlEditor} editor\n     */\n    createToolbar : function(editor){\n        var items = [];\n        var tipsEnabled = Ext.QuickTips && Ext.QuickTips.isEnabled();\n\n\n        function btn(id, toggle, handler){\n            return {\n                itemId : id,\n                cls : 'x-btn-icon',\n                iconCls: 'x-edit-'+id,\n                enableToggle:toggle !== false,\n                scope: editor,\n                handler:handler||editor.relayBtnCmd,\n                clickEvent:'mousedown',\n                tooltip: tipsEnabled ? editor.buttonTips[id] || undefined : undefined,\n                overflowText: editor.buttonTips[id].title || undefined,\n                tabIndex:-1\n            };\n        }\n\n\n        if(this.enableFont && !Ext.isSafari2){\n            var fontSelectItem = new Ext.Toolbar.Item({\n               autoEl: {\n                    tag:'select',\n                    cls:'x-font-select',\n                    html: this.createFontOptions()\n               }\n            });\n\n            items.push(\n                fontSelectItem,\n                '-'\n            );\n        }\n\n        if(this.enableFormat){\n            items.push(\n                btn('bold'),\n                btn('italic'),\n                btn('underline')\n            );\n        }\n\n        if(this.enableFontSize){\n            items.push(\n                '-',\n                btn('increasefontsize', false, this.adjustFont),\n                btn('decreasefontsize', false, this.adjustFont)\n            );\n        }\n\n        if(this.enableColors){\n            items.push(\n                '-', {\n                    itemId:'forecolor',\n                    cls:'x-btn-icon',\n                    iconCls: 'x-edit-forecolor',\n                    clickEvent:'mousedown',\n                    tooltip: tipsEnabled ? editor.buttonTips.forecolor || undefined : undefined,\n                    tabIndex:-1,\n                    menu : new Ext.menu.ColorMenu({\n                        allowReselect: true,\n                        focus: Ext.emptyFn,\n                        value:'000000',\n                        plain:true,\n                        listeners: {\n                            scope: this,\n                            select: function(cp, color){\n                                this.execCmd('forecolor', Ext.isWebKit || Ext.isIE ? '#'+color : color);\n                                this.deferFocus();\n                            }\n                        },\n                        clickEvent:'mousedown'\n                    })\n                }, {\n                    itemId:'backcolor',\n                    cls:'x-btn-icon',\n                    iconCls: 'x-edit-backcolor',\n                    clickEvent:'mousedown',\n                    tooltip: tipsEnabled ? editor.buttonTips.backcolor || undefined : undefined,\n                    tabIndex:-1,\n                    menu : new Ext.menu.ColorMenu({\n                        focus: Ext.emptyFn,\n                        value:'FFFFFF',\n                        plain:true,\n                        allowReselect: true,\n                        listeners: {\n                            scope: this,\n                            select: function(cp, color){\n                                if(Ext.isGecko){\n                                    this.execCmd('useCSS', false);\n                                    this.execCmd('hilitecolor', color);\n                                    this.execCmd('useCSS', true);\n                                    this.deferFocus();\n                                }else{\n                                    this.execCmd(Ext.isOpera ? 'hilitecolor' : 'backcolor', Ext.isWebKit || Ext.isIE ? '#'+color : color);\n                                    this.deferFocus();\n                                }\n                            }\n                        },\n                        clickEvent:'mousedown'\n                    })\n                }\n            );\n        }\n\n        if(this.enableAlignments){\n            items.push(\n                '-',\n                btn('justifyleft'),\n                btn('justifycenter'),\n                btn('justifyright')\n            );\n        }\n\n        if(!Ext.isSafari2){\n            if(this.enableLinks){\n                items.push(\n                    '-',\n                    btn('createlink', false, this.createLink)\n                );\n            }\n\n            if(this.enableLists){\n                items.push(\n                    '-',\n                    btn('insertorderedlist'),\n                    btn('insertunorderedlist')\n                );\n            }\n            if(this.enableSourceEdit){\n                items.push(\n                    '-',\n                    btn('sourceedit', true, function(btn){\n                        this.toggleSourceEdit(!this.sourceEditMode);\n                    })\n                );\n            }\n        }\n\n        // build the toolbar\n        var tb = new Ext.Toolbar({\n            renderTo: this.wrap.dom.firstChild,\n            items: items\n        });\n\n        if (fontSelectItem) {\n            this.fontSelect = fontSelectItem.el;\n\n            this.mon(this.fontSelect, 'change', function(){\n                var font = this.fontSelect.dom.value;\n                this.relayCmd('fontname', font);\n                this.deferFocus();\n            }, this);\n        }\n\n        // stop form submits\n        this.mon(tb.el, 'click', function(e){\n            e.preventDefault();\n        });\n\n        this.tb = tb;\n        this.tb.doLayout();\n    },\n\n    onDisable: function(){\n        this.wrap.mask();\n        Ext.form.HtmlEditor.superclass.onDisable.call(this);\n    },\n\n    onEnable: function(){\n        this.wrap.unmask();\n        Ext.form.HtmlEditor.superclass.onEnable.call(this);\n    },\n\n    setReadOnly: function(readOnly){\n\n        Ext.form.HtmlEditor.superclass.setReadOnly.call(this, readOnly);\n        if(this.initialized){\n            if(Ext.isIE){\n                this.getEditorBody().contentEditable = !readOnly;\n            }else{\n                this.setDesignMode(!readOnly);\n            }\n            var bd = this.getEditorBody();\n            if(bd){\n                bd.style.cursor = this.readOnly ? 'default' : 'text';\n            }\n            this.disableItems(readOnly);\n        }\n    },\n\n    /**\n     * Protected method that will not generally be called directly. It\n     * is called when the editor initializes the iframe with HTML contents. Override this method if you\n     * want to change the initialization markup of the iframe (e.g. to add stylesheets).\n     *\n     * Note: IE8-Standards has unwanted scroller behavior, so the default meta tag forces IE7 compatibility\n     */\n    getDocMarkup : function(){\n        var h = Ext.fly(this.iframe).getHeight() - this.iframePad * 2;\n        return String.format('<html><head><style type=\"text/css\">body{border: 0; margin: 0; padding: {0}px; height: {1}px; cursor: text}</style></head><body></body></html>', this.iframePad, h);\n    },\n\n    // private\n    getEditorBody : function(){\n        var doc = this.getDoc();\n        return doc.body || doc.documentElement;\n    },\n\n    // private\n    getDoc : function(){\n        return Ext.isIE ? this.getWin().document : (this.iframe.contentDocument || this.getWin().document);\n    },\n\n    // private\n    getWin : function(){\n        return Ext.isIE ? this.iframe.contentWindow : window.frames[this.iframe.name];\n    },\n\n    // private\n    onRender : function(ct, position){\n        Ext.form.HtmlEditor.superclass.onRender.call(this, ct, position);\n        this.el.dom.style.border = '0 none';\n        this.el.dom.setAttribute('tabIndex', -1);\n        this.el.addClass('x-hidden');\n        if(Ext.isIE){ // fix IE 1px bogus margin\n            this.el.applyStyles('margin-top:-1px;margin-bottom:-1px;');\n        }\n        this.wrap = this.el.wrap({\n            cls:'x-html-editor-wrap', cn:{cls:'x-html-editor-tb'}\n        });\n\n        this.createToolbar(this);\n\n        this.disableItems(true);\n\n        this.tb.doLayout();\n\n        this.createIFrame();\n\n        if(!this.width){\n            var sz = this.el.getSize();\n            this.setSize(sz.width, this.height || sz.height);\n        }\n        this.resizeEl = this.positionEl = this.wrap;\n    },\n\n    createIFrame: function(){\n        var iframe = document.createElement('iframe');\n        iframe.name = Ext.id();\n        iframe.frameBorder = '0';\n        iframe.style.overflow = 'auto';\n        iframe.src = Ext.SSL_SECURE_URL;\n\n        this.wrap.dom.appendChild(iframe);\n        this.iframe = iframe;\n\n        this.monitorTask = Ext.TaskMgr.start({\n            run: this.checkDesignMode,\n            scope: this,\n            interval:100\n        });\n    },\n\n    initFrame : function(){\n        Ext.TaskMgr.stop(this.monitorTask);\n        var doc = this.getDoc();\n        this.win = this.getWin();\n\n        doc.open();\n        doc.write(this.getDocMarkup());\n        doc.close();\n\n        this.readyTask = { // must defer to wait for browser to be ready\n            run : function(){\n                var doc = this.getDoc();\n                if(doc.body || doc.readyState == 'complete'){\n                    Ext.TaskMgr.stop(this.readyTask);\n                    this.setDesignMode(true);\n                    this.initEditor.defer(10, this);\n                }\n            },\n            interval : 10,\n            duration:10000,\n            scope: this\n        };\n        Ext.TaskMgr.start(this.readyTask);\n    },\n\n\n    checkDesignMode : function(){\n        if(this.wrap && this.wrap.dom.offsetWidth){\n            var doc = this.getDoc();\n            if(!doc){\n                return;\n            }\n            if(!doc.editorInitialized || this.getDesignMode() != 'on'){\n                this.initFrame();\n            }\n        }\n    },\n\n    /* private\n     * set current design mode. To enable, mode can be true or 'on', off otherwise\n     */\n    setDesignMode : function(mode){\n        var doc = this.getDoc();\n        if (doc) {\n            if(this.readOnly){\n                mode = false;\n            }\n            doc.designMode = (/on|true/i).test(String(mode).toLowerCase()) ?'on':'off';\n        }\n\n    },\n\n    // private\n    getDesignMode : function(){\n        var doc = this.getDoc();\n        if(!doc){ return ''; }\n        return String(doc.designMode).toLowerCase();\n\n    },\n\n    disableItems: function(disabled){\n        if(this.fontSelect){\n            this.fontSelect.dom.disabled = disabled;\n        }\n        this.tb.items.each(function(item){\n            if(item.getItemId() != 'sourceedit'){\n                item.setDisabled(disabled);\n            }\n        });\n    },\n\n    // private\n    onResize : function(w, h){\n        Ext.form.HtmlEditor.superclass.onResize.apply(this, arguments);\n        if(this.el && this.iframe){\n            if(Ext.isNumber(w)){\n                var aw = w - this.wrap.getFrameWidth('lr');\n                this.el.setWidth(aw);\n                this.tb.setWidth(aw);\n                this.iframe.style.width = Math.max(aw, 0) + 'px';\n            }\n            if(Ext.isNumber(h)){\n                var ah = h - this.wrap.getFrameWidth('tb') - this.tb.el.getHeight();\n                this.el.setHeight(ah);\n                this.iframe.style.height = Math.max(ah, 0) + 'px';\n                var bd = this.getEditorBody();\n                if(bd){\n                    bd.style.height = Math.max((ah - (this.iframePad*2)), 0) + 'px';\n                }\n            }\n        }\n    },\n\n    /**\n     * Toggles the editor between standard and source edit mode.\n     * @param {Boolean} sourceEdit (optional) True for source edit, false for standard\n     */\n    toggleSourceEdit : function(sourceEditMode){\n        var iframeHeight,\n            elHeight;\n\n        if (sourceEditMode === undefined) {\n            sourceEditMode = !this.sourceEditMode;\n        }\n        this.sourceEditMode = sourceEditMode === true;\n        var btn = this.tb.getComponent('sourceedit');\n\n        if (btn.pressed !== this.sourceEditMode) {\n            btn.toggle(this.sourceEditMode);\n            if (!btn.xtbHidden) {\n                return;\n            }\n        }\n        if (this.sourceEditMode) {\n            // grab the height of the containing panel before we hide the iframe\n            this.previousSize = this.getSize();\n\n            iframeHeight = Ext.get(this.iframe).getHeight();\n\n            this.disableItems(true);\n            this.syncValue();\n            this.iframe.className = 'x-hidden';\n            this.el.removeClass('x-hidden');\n            this.el.dom.removeAttribute('tabIndex');\n            this.el.focus();\n            this.el.dom.style.height = iframeHeight + 'px';\n        }\n        else {\n            elHeight = parseInt(this.el.dom.style.height, 10);\n            if (this.initialized) {\n                this.disableItems(this.readOnly);\n            }\n            this.pushValue();\n            this.iframe.className = '';\n            this.el.addClass('x-hidden');\n            this.el.dom.setAttribute('tabIndex', -1);\n            this.deferFocus();\n\n            this.setSize(this.previousSize);\n            delete this.previousSize;\n            this.iframe.style.height = elHeight + 'px';\n        }\n        this.fireEvent('editmodechange', this, this.sourceEditMode);\n    },\n\n    // private used internally\n    createLink : function() {\n        var url = prompt(this.createLinkText, this.defaultLinkValue);\n        if(url && url != 'http:/'+'/'){\n            this.relayCmd('createlink', url);\n        }\n    },\n\n    // private\n    initEvents : function(){\n        this.originalValue = this.getValue();\n    },\n\n    /**\n     * Overridden and disabled. The editor element does not support standard valid/invalid marking. @hide\n     * @method\n     */\n    markInvalid : Ext.emptyFn,\n\n    /**\n     * Overridden and disabled. The editor element does not support standard valid/invalid marking. @hide\n     * @method\n     */\n    clearInvalid : Ext.emptyFn,\n\n    // docs inherit from Field\n    setValue : function(v){\n        Ext.form.HtmlEditor.superclass.setValue.call(this, v);\n        this.pushValue();\n        return this;\n    },\n\n    /**\n     * Protected method that will not generally be called directly. If you need/want\n     * custom HTML cleanup, this is the method you should override.\n     * @param {String} html The HTML to be cleaned\n     * @return {String} The cleaned HTML\n     */\n    cleanHtml: function(html) {\n        html = String(html);\n        if(Ext.isWebKit){ // strip safari nonsense\n            html = html.replace(/\\sclass=\"(?:Apple-style-span|khtml-block-placeholder)\"/gi, '');\n        }\n\n        /*\n         * Neat little hack. Strips out all the non-digit characters from the default\n         * value and compares it to the character code of the first character in the string\n         * because it can cause encoding issues when posted to the server.\n         */\n        if(html.charCodeAt(0) == this.defaultValue.replace(/\\D/g, '')){\n            html = html.substring(1);\n        }\n        return html;\n    },\n\n    /**\n     * Protected method that will not generally be called directly. Syncs the contents\n     * of the editor iframe with the textarea.\n     */\n    syncValue : function(){\n        if(this.initialized){\n            var bd = this.getEditorBody();\n            var html = bd.innerHTML;\n            if(Ext.isWebKit){\n                var bs = bd.getAttribute('style'); // Safari puts text-align styles on the body element!\n                var m = bs.match(/text-align:(.*?);/i);\n                if(m && m[1]){\n                    html = '<div style=\"'+m[0]+'\">' + html + '</div>';\n                }\n            }\n            html = this.cleanHtml(html);\n            if(this.fireEvent('beforesync', this, html) !== false){\n                this.el.dom.value = html;\n                this.fireEvent('sync', this, html);\n            }\n        }\n    },\n\n    //docs inherit from Field\n    getValue : function() {\n        this[this.sourceEditMode ? 'pushValue' : 'syncValue']();\n        return Ext.form.HtmlEditor.superclass.getValue.call(this);\n    },\n\n    /**\n     * Protected method that will not generally be called directly. Pushes the value of the textarea\n     * into the iframe editor.\n     */\n    pushValue : function(){\n        if(this.initialized){\n            var v = this.el.dom.value;\n            if(!this.activated && v.length < 1){\n                v = this.defaultValue;\n            }\n            if(this.fireEvent('beforepush', this, v) !== false){\n                this.getEditorBody().innerHTML = v;\n                if(Ext.isGecko){\n                    // Gecko hack, see: https://bugzilla.mozilla.org/show_bug.cgi?id=232791#c8\n                    this.setDesignMode(false);  //toggle off first\n                    this.setDesignMode(true);\n                }\n                this.fireEvent('push', this, v);\n            }\n\n        }\n    },\n\n    // private\n    deferFocus : function(){\n        this.focus.defer(10, this);\n    },\n\n    // docs inherit from Field\n    focus : function(){\n        if(this.win && !this.sourceEditMode){\n            this.win.focus();\n        }else{\n            this.el.focus();\n        }\n    },\n\n    // private\n    initEditor : function(){\n        //Destroying the component during/before initEditor can cause issues.\n        try{\n            var dbody = this.getEditorBody(),\n                ss = this.el.getStyles('font-size', 'font-family', 'background-image', 'background-repeat', 'background-color', 'color'),\n                doc,\n                fn;\n\n            ss['background-attachment'] = 'fixed'; // w3c\n            dbody.bgProperties = 'fixed'; // ie\n\n            Ext.DomHelper.applyStyles(dbody, ss);\n\n            doc = this.getDoc();\n\n            if(doc){\n                try{\n                    Ext.EventManager.removeAll(doc);\n                }catch(e){}\n            }\n\n            /*\n             * We need to use createDelegate here, because when using buffer, the delayed task is added\n             * as a property to the function. When the listener is removed, the task is deleted from the function.\n             * Since onEditorEvent is shared on the prototype, if we have multiple html editors, the first time one of the editors\n             * is destroyed, it causes the fn to be deleted from the prototype, which causes errors. Essentially, we're just anonymizing the function.\n             */\n            fn = this.onEditorEvent.createDelegate(this);\n            Ext.EventManager.on(doc, {\n                mousedown: fn,\n                dblclick: fn,\n                click: fn,\n                keyup: fn,\n                buffer:100\n            });\n\n            if(Ext.isGecko){\n                Ext.EventManager.on(doc, 'keypress', this.applyCommand, this);\n            }\n            if(Ext.isIE || Ext.isWebKit || Ext.isOpera){\n                Ext.EventManager.on(doc, 'keydown', this.fixKeys, this);\n            }\n            doc.editorInitialized = true;\n            this.initialized = true;\n            this.pushValue();\n            this.setReadOnly(this.readOnly);\n            this.fireEvent('initialize', this);\n        }catch(e){}\n    },\n\n    // private\n    beforeDestroy : function(){\n        if(this.monitorTask){\n            Ext.TaskMgr.stop(this.monitorTask);\n        }\n        if(this.readyTask){\n            Ext.TaskMgr.stop(this.readyTask);\n        }\n        if(this.rendered){\n            Ext.destroy(this.tb);\n            var doc = this.getDoc();\n            Ext.EventManager.removeFromSpecialCache(doc);\n            if(doc){\n                try{\n                    Ext.EventManager.removeAll(doc);\n                    for (var prop in doc){\n                        delete doc[prop];\n                    }\n                }catch(e){}\n            }\n            if(this.wrap){\n                this.wrap.dom.innerHTML = '';\n                this.wrap.remove();\n            }\n        }\n        Ext.form.HtmlEditor.superclass.beforeDestroy.call(this);\n    },\n\n    // private\n    onFirstFocus : function(){\n        this.activated = true;\n        this.disableItems(this.readOnly);\n        if(Ext.isGecko){ // prevent silly gecko errors\n            this.win.focus();\n            var s = this.win.getSelection();\n            if(!s.focusNode || s.focusNode.nodeType != 3){\n                var r = s.getRangeAt(0);\n                r.selectNodeContents(this.getEditorBody());\n                r.collapse(true);\n                this.deferFocus();\n            }\n            try{\n                this.execCmd('useCSS', true);\n                this.execCmd('styleWithCSS', false);\n            }catch(e){}\n        }\n        this.fireEvent('activate', this);\n    },\n\n    // private\n    adjustFont: function(btn){\n        var adjust = btn.getItemId() == 'increasefontsize' ? 1 : -1,\n            doc = this.getDoc(),\n            v = parseInt(doc.queryCommandValue('FontSize') || 2, 10);\n        if((Ext.isSafari && !Ext.isSafari2) || Ext.isChrome || Ext.isAir){\n            // Safari 3 values\n            // 1 = 10px, 2 = 13px, 3 = 16px, 4 = 18px, 5 = 24px, 6 = 32px\n            if(v <= 10){\n                v = 1 + adjust;\n            }else if(v <= 13){\n                v = 2 + adjust;\n            }else if(v <= 16){\n                v = 3 + adjust;\n            }else if(v <= 18){\n                v = 4 + adjust;\n            }else if(v <= 24){\n                v = 5 + adjust;\n            }else {\n                v = 6 + adjust;\n            }\n            v = v.constrain(1, 6);\n        }else{\n            if(Ext.isSafari){ // safari\n                adjust *= 2;\n            }\n            v = Math.max(1, v+adjust) + (Ext.isSafari ? 'px' : 0);\n        }\n        this.execCmd('FontSize', v);\n    },\n\n    // private\n    onEditorEvent : function(e){\n        this.updateToolbar();\n    },\n\n\n    /**\n     * Protected method that will not generally be called directly. It triggers\n     * a toolbar update by reading the markup state of the current selection in the editor.\n     */\n    updateToolbar: function(){\n\n        if(this.readOnly){\n            return;\n        }\n\n        if(!this.activated){\n            this.onFirstFocus();\n            return;\n        }\n\n        var btns = this.tb.items.map,\n            doc = this.getDoc();\n\n        if(this.enableFont && !Ext.isSafari2){\n            var name = (doc.queryCommandValue('FontName')||this.defaultFont).toLowerCase();\n            if(name != this.fontSelect.dom.value){\n                this.fontSelect.dom.value = name;\n            }\n        }\n        if(this.enableFormat){\n            btns.bold.toggle(doc.queryCommandState('bold'));\n            btns.italic.toggle(doc.queryCommandState('italic'));\n            btns.underline.toggle(doc.queryCommandState('underline'));\n        }\n        if(this.enableAlignments){\n            btns.justifyleft.toggle(doc.queryCommandState('justifyleft'));\n            btns.justifycenter.toggle(doc.queryCommandState('justifycenter'));\n            btns.justifyright.toggle(doc.queryCommandState('justifyright'));\n        }\n        if(!Ext.isSafari2 && this.enableLists){\n            btns.insertorderedlist.toggle(doc.queryCommandState('insertorderedlist'));\n            btns.insertunorderedlist.toggle(doc.queryCommandState('insertunorderedlist'));\n        }\n\n        Ext.menu.MenuMgr.hideAll();\n\n        this.syncValue();\n    },\n\n    // private\n    relayBtnCmd : function(btn){\n        this.relayCmd(btn.getItemId());\n    },\n\n    /**\n     * Executes a Midas editor command on the editor document and performs necessary focus and\n     * toolbar updates. <b>This should only be called after the editor is initialized.</b>\n     * @param {String} cmd The Midas command\n     * @param {String/Boolean} value (optional) The value to pass to the command (defaults to null)\n     */\n    relayCmd : function(cmd, value){\n        (function(){\n            this.focus();\n            this.execCmd(cmd, value);\n            this.updateToolbar();\n        }).defer(10, this);\n    },\n\n    /**\n     * Executes a Midas editor command directly on the editor document.\n     * For visual commands, you should use {@link #relayCmd} instead.\n     * <b>This should only be called after the editor is initialized.</b>\n     * @param {String} cmd The Midas command\n     * @param {String/Boolean} value (optional) The value to pass to the command (defaults to null)\n     */\n    execCmd : function(cmd, value){\n        var doc = this.getDoc();\n        doc.execCommand(cmd, false, value === undefined ? null : value);\n        this.syncValue();\n    },\n\n    // private\n    applyCommand : function(e){\n        if(e.ctrlKey){\n            var c = e.getCharCode(), cmd;\n            if(c > 0){\n                c = String.fromCharCode(c);\n                switch(c){\n                    case 'b':\n                        cmd = 'bold';\n                    break;\n                    case 'i':\n                        cmd = 'italic';\n                    break;\n                    case 'u':\n                        cmd = 'underline';\n                    break;\n                }\n                if(cmd){\n                    this.win.focus();\n                    this.execCmd(cmd);\n                    this.deferFocus();\n                    e.preventDefault();\n                }\n            }\n        }\n    },\n\n    /**\n     * Inserts the passed text at the current cursor position. Note: the editor must be initialized and activated\n     * to insert text.\n     * @param {String} text\n     */\n    insertAtCursor : function(text){\n        if(!this.activated){\n            return;\n        }\n        if(Ext.isIE){\n            this.win.focus();\n            var doc = this.getDoc(),\n                r = doc.selection.createRange();\n            if(r){\n                r.pasteHTML(text);\n                this.syncValue();\n                this.deferFocus();\n            }\n        }else{\n            this.win.focus();\n            this.execCmd('InsertHTML', text);\n            this.deferFocus();\n        }\n    },\n\n    // private\n    fixKeys : function(){ // load time branching for fastest keydown performance\n        if(Ext.isIE){\n            return function(e){\n                var k = e.getKey(),\n                    doc = this.getDoc(),\n                        r;\n                if(k == e.TAB){\n                    e.stopEvent();\n                    r = doc.selection.createRange();\n                    if(r){\n                        r.collapse(true);\n                        r.pasteHTML('&nbsp;&nbsp;&nbsp;&nbsp;');\n                        this.deferFocus();\n                    }\n                }else if(k == e.ENTER){\n                    r = doc.selection.createRange();\n                    if(r){\n                        var target = r.parentElement();\n                        if(!target || target.tagName.toLowerCase() != 'li'){\n                            e.stopEvent();\n                            r.pasteHTML('<br />');\n                            r.collapse(false);\n                            r.select();\n                        }\n                    }\n                }\n            };\n        }else if(Ext.isOpera){\n            return function(e){\n                var k = e.getKey();\n                if(k == e.TAB){\n                    e.stopEvent();\n                    this.win.focus();\n                    this.execCmd('InsertHTML','&nbsp;&nbsp;&nbsp;&nbsp;');\n                    this.deferFocus();\n                }\n            };\n        }else if(Ext.isWebKit){\n            return function(e){\n                var k = e.getKey();\n                if(k == e.TAB){\n                    e.stopEvent();\n                    this.execCmd('InsertText','\\t');\n                    this.deferFocus();\n                }else if(k == e.ENTER){\n                    e.stopEvent();\n                    this.execCmd('InsertHtml','<br /><br />');\n                    this.deferFocus();\n                }\n             };\n        }\n    }(),\n\n    /**\n     * Returns the editor's toolbar. <b>This is only available after the editor has been rendered.</b>\n     * @return {Ext.Toolbar}\n     */\n    getToolbar : function(){\n        return this.tb;\n    },\n\n    /**\n     * Object collection of toolbar tooltips for the buttons in the editor. The key\n     * is the command id associated with that button and the value is a valid QuickTips object.\n     * For example:\n<pre><code>\n{\n    bold : {\n        title: 'Bold (Ctrl+B)',\n        text: 'Make the selected text bold.',\n        cls: 'x-html-editor-tip'\n    },\n    italic : {\n        title: 'Italic (Ctrl+I)',\n        text: 'Make the selected text italic.',\n        cls: 'x-html-editor-tip'\n    },\n    ...\n</code></pre>\n    * @type Object\n     */\n    buttonTips : {\n        bold : {\n            title: 'Bold (Ctrl+B)',\n            text: 'Make the selected text bold.',\n            cls: 'x-html-editor-tip'\n        },\n        italic : {\n            title: 'Italic (Ctrl+I)',\n            text: 'Make the selected text italic.',\n            cls: 'x-html-editor-tip'\n        },\n        underline : {\n            title: 'Underline (Ctrl+U)',\n            text: 'Underline the selected text.',\n            cls: 'x-html-editor-tip'\n        },\n        increasefontsize : {\n            title: 'Grow Text',\n            text: 'Increase the font size.',\n            cls: 'x-html-editor-tip'\n        },\n        decreasefontsize : {\n            title: 'Shrink Text',\n            text: 'Decrease the font size.',\n            cls: 'x-html-editor-tip'\n        },\n        backcolor : {\n            title: 'Text Highlight Color',\n            text: 'Change the background color of the selected text.',\n            cls: 'x-html-editor-tip'\n        },\n        forecolor : {\n            title: 'Font Color',\n            text: 'Change the color of the selected text.',\n            cls: 'x-html-editor-tip'\n        },\n        justifyleft : {\n            title: 'Align Text Left',\n            text: 'Align text to the left.',\n            cls: 'x-html-editor-tip'\n        },\n        justifycenter : {\n            title: 'Center Text',\n            text: 'Center text in the editor.',\n            cls: 'x-html-editor-tip'\n        },\n        justifyright : {\n            title: 'Align Text Right',\n            text: 'Align text to the right.',\n            cls: 'x-html-editor-tip'\n        },\n        insertunorderedlist : {\n            title: 'Bullet List',\n            text: 'Start a bulleted list.',\n            cls: 'x-html-editor-tip'\n        },\n        insertorderedlist : {\n            title: 'Numbered List',\n            text: 'Start a numbered list.',\n            cls: 'x-html-editor-tip'\n        },\n        createlink : {\n            title: 'Hyperlink',\n            text: 'Make the selected text a hyperlink.',\n            cls: 'x-html-editor-tip'\n        },\n        sourceedit : {\n            title: 'Source Edit',\n            text: 'Switch to source editing mode.',\n            cls: 'x-html-editor-tip'\n        }\n    }\n\n    // hide stuff that is not compatible\n    /**\n     * @event blur\n     * @hide\n     */\n    /**\n     * @event change\n     * @hide\n     */\n    /**\n     * @event focus\n     * @hide\n     */\n    /**\n     * @event specialkey\n     * @hide\n     */\n    /**\n     * @cfg {String} fieldClass @hide\n     */\n    /**\n     * @cfg {String} focusClass @hide\n     */\n    /**\n     * @cfg {String} autoCreate @hide\n     */\n    /**\n     * @cfg {String} inputType @hide\n     */\n    /**\n     * @cfg {String} invalidClass @hide\n     */\n    /**\n     * @cfg {String} invalidText @hide\n     */\n    /**\n     * @cfg {String} msgFx @hide\n     */\n    /**\n     * @cfg {String} validateOnBlur @hide\n     */\n    /**\n     * @cfg {Boolean} allowDomMove  @hide\n     */\n    /**\n     * @cfg {String} applyTo @hide\n     */\n    /**\n     * @cfg {String} autoHeight  @hide\n     */\n    /**\n     * @cfg {String} autoWidth  @hide\n     */\n    /**\n     * @cfg {String} cls  @hide\n     */\n    /**\n     * @cfg {String} disabled  @hide\n     */\n    /**\n     * @cfg {String} disabledClass  @hide\n     */\n    /**\n     * @cfg {String} msgTarget  @hide\n     */\n    /**\n     * @cfg {String} readOnly  @hide\n     */\n    /**\n     * @cfg {String} style  @hide\n     */\n    /**\n     * @cfg {String} validationDelay  @hide\n     */\n    /**\n     * @cfg {String} validationEvent  @hide\n     */\n    /**\n     * @cfg {String} tabIndex  @hide\n     */\n    /**\n     * @property disabled\n     * @hide\n     */\n    /**\n     * @method applyToMarkup\n     * @hide\n     */\n    /**\n     * @method disable\n     * @hide\n     */\n    /**\n     * @method enable\n     * @hide\n     */\n    /**\n     * @method validate\n     * @hide\n     */\n    /**\n     * @event valid\n     * @hide\n     */\n    /**\n     * @method setDisabled\n     * @hide\n     */\n    /**\n     * @cfg keys\n     * @hide\n     */\n});\nExt.reg('htmleditor', Ext.form.HtmlEditor);\n/**\n * @class Ext.form.TimeField\n * @extends Ext.form.ComboBox\n * Provides a time input field with a time dropdown and automatic time validation.  Example usage:\n * <pre><code>\nnew Ext.form.TimeField({\n    minValue: '9:00 AM',\n    maxValue: '6:00 PM',\n    increment: 30\n});\n</code></pre>\n * @constructor\n * Create a new TimeField\n * @param {Object} config\n * @xtype timefield\n */\nExt.form.TimeField = Ext.extend(Ext.form.ComboBox, {\n    /**\n     * @cfg {Date/String} minValue\n     * The minimum allowed time. Can be either a Javascript date object with a valid time value or a string\n     * time in a valid format -- see {@link #format} and {@link #altFormats} (defaults to undefined).\n     */\n    minValue : undefined,\n    /**\n     * @cfg {Date/String} maxValue\n     * The maximum allowed time. Can be either a Javascript date object with a valid time value or a string\n     * time in a valid format -- see {@link #format} and {@link #altFormats} (defaults to undefined).\n     */\n    maxValue : undefined,\n    /**\n     * @cfg {String} minText\n     * The error text to display when the date in the cell is before minValue (defaults to\n     * 'The time in this field must be equal to or after {0}').\n     */\n    minText : \"The time in this field must be equal to or after {0}\",\n    /**\n     * @cfg {String} maxText\n     * The error text to display when the time is after maxValue (defaults to\n     * 'The time in this field must be equal to or before {0}').\n     */\n    maxText : \"The time in this field must be equal to or before {0}\",\n    /**\n     * @cfg {String} invalidText\n     * The error text to display when the time in the field is invalid (defaults to\n     * '{value} is not a valid time').\n     */\n    invalidText : \"{0} is not a valid time\",\n    /**\n     * @cfg {String} format\n     * The default time format string which can be overriden for localization support.  The format must be\n     * valid according to {@link Date#parseDate} (defaults to 'g:i A', e.g., '3:15 PM').  For 24-hour time\n     * format try 'H:i' instead.\n     */\n    format : \"g:i A\",\n    /**\n     * @cfg {String} altFormats\n     * Multiple date formats separated by \"|\" to try when parsing a user input value and it doesn't match the defined\n     * format (defaults to 'g:ia|g:iA|g:i a|g:i A|h:i|g:i|H:i|ga|ha|gA|h a|g a|g A|gi|hi|gia|hia|g|H|gi a|hi a|giA|hiA|gi A|hi A').\n     */\n    altFormats : \"g:ia|g:iA|g:i a|g:i A|h:i|g:i|H:i|ga|ha|gA|h a|g a|g A|gi|hi|gia|hia|g|H|gi a|hi a|giA|hiA|gi A|hi A\",\n    /**\n     * @cfg {Number} increment\n     * The number of minutes between each time value in the list (defaults to 15).\n     */\n    increment: 15,\n\n    // private override\n    mode: 'local',\n    // private override\n    triggerAction: 'all',\n    // private override\n    typeAhead: false,\n\n    // private - This is the date to use when generating time values in the absence of either minValue\n    // or maxValue.  Using the current date causes DST issues on DST boundary dates, so this is an\n    // arbitrary \"safe\" date that can be any date aside from DST boundary dates.\n    initDate: '1/1/2008',\n\n    initDateFormat: 'j/n/Y',\n\n    // private\n    initComponent : function(){\n        if(Ext.isDefined(this.minValue)){\n            this.setMinValue(this.minValue, true);\n        }\n        if(Ext.isDefined(this.maxValue)){\n            this.setMaxValue(this.maxValue, true);\n        }\n        if(!this.store){\n            this.generateStore(true);\n        }\n        Ext.form.TimeField.superclass.initComponent.call(this);\n    },\n\n    /**\n     * Replaces any existing {@link #minValue} with the new time and refreshes the store.\n     * @param {Date/String} value The minimum time that can be selected\n     */\n    setMinValue: function(value, /* private */ initial){\n        this.setLimit(value, true, initial);\n        return this;\n    },\n\n    /**\n     * Replaces any existing {@link #maxValue} with the new time and refreshes the store.\n     * @param {Date/String} value The maximum time that can be selected\n     */\n    setMaxValue: function(value, /* private */ initial){\n        this.setLimit(value, false, initial);\n        return this;\n    },\n\n    // private\n    generateStore: function(initial){\n        var min = this.minValue || new Date(this.initDate).clearTime(),\n            max = this.maxValue || new Date(this.initDate).clearTime().add('mi', (24 * 60) - 1),\n            times = [];\n\n        while(min <= max){\n            times.push(min.dateFormat(this.format));\n            min = min.add('mi', this.increment);\n        }\n        this.bindStore(times, initial);\n    },\n\n    // private\n    setLimit: function(value, isMin, initial){\n        var d;\n        if(Ext.isString(value)){\n            d = this.parseDate(value);\n        }else if(Ext.isDate(value)){\n            d = value;\n        }\n        if(d){\n            var val = new Date(this.initDate).clearTime();\n            val.setHours(d.getHours(), d.getMinutes(), d.getSeconds(), d.getMilliseconds());\n            this[isMin ? 'minValue' : 'maxValue'] = val;\n            if(!initial){\n                this.generateStore();\n            }\n        }\n    },\n\n    // inherited docs\n    getValue : function(){\n        var v = Ext.form.TimeField.superclass.getValue.call(this);\n        return this.formatDate(this.parseDate(v)) || '';\n    },\n\n    // inherited docs\n    setValue : function(value){\n        return Ext.form.TimeField.superclass.setValue.call(this, this.formatDate(this.parseDate(value)));\n    },\n\n    // private overrides\n    validateValue : Ext.form.DateField.prototype.validateValue,\n\n    formatDate : Ext.form.DateField.prototype.formatDate,\n\n    parseDate: function(value) {\n        if (!value || Ext.isDate(value)) {\n            return value;\n        }\n\n        var id = this.initDate + ' ',\n            idf = this.initDateFormat + ' ',\n            v = Date.parseDate(id + value, idf + this.format), // *** handle DST. note: this.format is a TIME-only format\n            af = this.altFormats;\n\n        if (!v && af) {\n            if (!this.altFormatsArray) {\n                this.altFormatsArray = af.split(\"|\");\n            }\n            for (var i = 0, afa = this.altFormatsArray, len = afa.length; i < len && !v; i++) {\n                v = Date.parseDate(id + value, idf + afa[i]);\n            }\n        }\n\n        return v;\n    }\n});\nExt.reg('timefield', Ext.form.TimeField);/**\n * @class Ext.form.SliderField\n * @extends Ext.form.Field\n * Wraps a {@link Ext.slider.MultiSlider Slider} so it can be used as a form field.\n * @constructor\n * Creates a new SliderField\n * @param {Object} config Configuration options. Note that you can pass in any slider configuration options, as well as\n * as any field configuration options.\n * @xtype sliderfield\n */\nExt.form.SliderField = Ext.extend(Ext.form.Field, {\n    \n    /**\n     * @cfg {Boolean} useTips\n     * True to use an Ext.slider.Tip to display tips for the value. Defaults to <tt>true</tt>.\n     */\n    useTips : true,\n    \n    /**\n     * @cfg {Function} tipText\n     * A function used to display custom text for the slider tip. Defaults to <tt>null</tt>, which will\n     * use the default on the plugin.\n     */\n    tipText : null,\n    \n    // private override\n    actionMode: 'wrap',\n    \n    /**\n     * Initialize the component.\n     * @private\n     */\n    initComponent : function() {\n        var cfg = Ext.copyTo({\n            id: this.id + '-slider'\n        }, this.initialConfig, ['vertical', 'minValue', 'maxValue', 'decimalPrecision', 'keyIncrement', 'increment', 'clickToChange', 'animate']);\n        \n        // only can use it if it exists.\n        if (this.useTips) {\n            var plug = this.tipText ? {getText: this.tipText} : {};\n            cfg.plugins = [new Ext.slider.Tip(plug)];\n        }\n        this.slider = new Ext.Slider(cfg);\n        Ext.form.SliderField.superclass.initComponent.call(this);\n    },    \n    \n    /**\n     * Set up the hidden field\n     * @param {Object} ct The container to render to.\n     * @param {Object} position The position in the container to render to.\n     * @private\n     */\n    onRender : function(ct, position){\n        this.autoCreate = {\n            id: this.id,\n            name: this.name,\n            type: 'hidden',\n            tag: 'input'    \n        };\n        Ext.form.SliderField.superclass.onRender.call(this, ct, position);\n        this.wrap = this.el.wrap({cls: 'x-form-field-wrap'});\n        this.resizeEl = this.positionEl = this.wrap;\n        this.slider.render(this.wrap);\n    },\n    \n    /**\n     * Ensure that the slider size is set automatically when the field resizes.\n     * @param {Object} w The width\n     * @param {Object} h The height\n     * @param {Object} aw The adjusted width\n     * @param {Object} ah The adjusted height\n     * @private\n     */\n    onResize : function(w, h, aw, ah){\n        Ext.form.SliderField.superclass.onResize.call(this, w, h, aw, ah);\n        this.slider.setSize(w, h);    \n    },\n    \n    /**\n     * Initialize any events for this class.\n     * @private\n     */\n    initEvents : function(){\n        Ext.form.SliderField.superclass.initEvents.call(this);\n        this.slider.on('change', this.onChange, this);   \n    },\n    \n    /**\n     * Utility method to set the value of the field when the slider changes.\n     * @param {Object} slider The slider object.\n     * @param {Object} v The new value.\n     * @private\n     */\n    onChange : function(slider, v){\n        this.setValue(v, undefined, true);\n    },\n    \n    /**\n     * Enable the slider when the field is enabled.\n     * @private\n     */\n    onEnable : function(){\n        Ext.form.SliderField.superclass.onEnable.call(this);\n        this.slider.enable();\n    },\n    \n    /**\n     * Disable the slider when the field is disabled.\n     * @private\n     */\n    onDisable : function(){\n        Ext.form.SliderField.superclass.onDisable.call(this);\n        this.slider.disable();    \n    },\n    \n    /**\n     * Ensure the slider is destroyed when the field is destroyed.\n     * @private\n     */\n    beforeDestroy : function(){\n        Ext.destroy(this.slider);\n        Ext.form.SliderField.superclass.beforeDestroy.call(this);\n    },\n    \n    /**\n     * If a side icon is shown, do alignment to the slider\n     * @private\n     */\n    alignErrorIcon : function(){\n        this.errorIcon.alignTo(this.slider.el, 'tl-tr', [2, 0]);\n    },\n    \n    /**\n     * Sets the minimum field value.\n     * @param {Number} v The new minimum value.\n     * @return {Ext.form.SliderField} this\n     */\n    setMinValue : function(v){\n        this.slider.setMinValue(v);\n        return this;    \n    },\n    \n    /**\n     * Sets the maximum field value.\n     * @param {Number} v The new maximum value.\n     * @return {Ext.form.SliderField} this\n     */\n    setMaxValue : function(v){\n        this.slider.setMaxValue(v);\n        return this;    \n    },\n    \n    /**\n     * Sets the value for this field.\n     * @param {Number} v The new value.\n     * @param {Boolean} animate (optional) Whether to animate the transition. If not specified, it will default to the animate config.\n     * @return {Ext.form.SliderField} this\n     */\n    setValue : function(v, animate, /* private */ silent){\n        // silent is used if the setValue method is invoked by the slider\n        // which means we don't need to set the value on the slider.\n        if(!silent){\n            this.slider.setValue(v, animate);\n        }\n        return Ext.form.SliderField.superclass.setValue.call(this, this.slider.getValue());\n    },\n    \n    /**\n     * Gets the current value for this field.\n     * @return {Number} The current value.\n     */\n    getValue : function(){\n        return this.slider.getValue();    \n    }\n});\n\nExt.reg('sliderfield', Ext.form.SliderField);/**\n * @class Ext.form.Label\n * @extends Ext.BoxComponent\n * Basic Label field.\n * @constructor\n * Creates a new Label\n * @param {Ext.Element/String/Object} config The configuration options.  If an element is passed, it is set as the internal\n * element and its id used as the component id.  If a string is passed, it is assumed to be the id of an existing element\n * and is used as the component id.  Otherwise, it is assumed to be a standard config object and is applied to the component.\n * @xtype label\n */\nExt.form.Label = Ext.extend(Ext.BoxComponent, {\n    /**\n     * @cfg {String} text The plain text to display within the label (defaults to ''). If you need to include HTML\n     * tags within the label's innerHTML, use the {@link #html} config instead.\n     */\n    /**\n     * @cfg {String} forId The id of the input element to which this label will be bound via the standard HTML 'for'\n     * attribute. If not specified, the attribute will not be added to the label.\n     */\n    /**\n     * @cfg {String} html An HTML fragment that will be used as the label's innerHTML (defaults to '').\n     * Note that if {@link #text} is specified it will take precedence and this value will be ignored.\n     */\n\n    // private\n    onRender : function(ct, position){\n        if(!this.el){\n            this.el = document.createElement('label');\n            this.el.id = this.getId();\n            this.el.innerHTML = this.text ? Ext.util.Format.htmlEncode(this.text) : (this.html || '');\n            if(this.forId){\n                this.el.setAttribute('for', this.forId);\n            }\n        }\n        Ext.form.Label.superclass.onRender.call(this, ct, position);\n    },\n\n    /**\n     * Updates the label's innerHTML with the specified string.\n     * @param {String} text The new label text\n     * @param {Boolean} encode (optional) False to skip HTML-encoding the text when rendering it\n     * to the label (defaults to true which encodes the value). This might be useful if you want to include\n     * tags in the label's innerHTML rather than rendering them as string literals per the default logic.\n     * @return {Label} this\n     */\n    setText : function(t, encode){\n        var e = encode === false;\n        this[!e ? 'text' : 'html'] = t;\n        delete this[e ? 'text' : 'html'];\n        if(this.rendered){\n            this.el.dom.innerHTML = encode !== false ? Ext.util.Format.htmlEncode(t) : t;\n        }\n        return this;\n    }\n});\n\nExt.reg('label', Ext.form.Label);/**\n * @class Ext.form.Action\n * <p>The subclasses of this class provide actions to perform upon {@link Ext.form.BasicForm Form}s.</p>\n * <p>Instances of this class are only created by a {@link Ext.form.BasicForm Form} when\n * the Form needs to perform an action such as submit or load. The Configuration options\n * listed for this class are set through the Form's action methods: {@link Ext.form.BasicForm#submit submit},\n * {@link Ext.form.BasicForm#load load} and {@link Ext.form.BasicForm#doAction doAction}</p>\n * <p>The instance of Action which performed the action is passed to the success\n * and failure callbacks of the Form's action methods ({@link Ext.form.BasicForm#submit submit},\n * {@link Ext.form.BasicForm#load load} and {@link Ext.form.BasicForm#doAction doAction}),\n * and to the {@link Ext.form.BasicForm#actioncomplete actioncomplete} and\n * {@link Ext.form.BasicForm#actionfailed actionfailed} event handlers.</p>\n */\nExt.form.Action = function(form, options){\n    this.form = form;\n    this.options = options || {};\n};\n\n/**\n * Failure type returned when client side validation of the Form fails\n * thus aborting a submit action. Client side validation is performed unless\n * {@link #clientValidation} is explicitly set to <tt>false</tt>.\n * @type {String}\n * @static\n */\nExt.form.Action.CLIENT_INVALID = 'client';\n/**\n * <p>Failure type returned when server side processing fails and the {@link #result}'s\n * <tt style=\"font-weight:bold\">success</tt> property is set to <tt>false</tt>.</p>\n * <p>In the case of a form submission, field-specific error messages may be returned in the\n * {@link #result}'s <tt style=\"font-weight:bold\">errors</tt> property.</p>\n * @type {String}\n * @static\n */\nExt.form.Action.SERVER_INVALID = 'server';\n/**\n * Failure type returned when a communication error happens when attempting\n * to send a request to the remote server. The {@link #response} may be examined to\n * provide further information.\n * @type {String}\n * @static\n */\nExt.form.Action.CONNECT_FAILURE = 'connect';\n/**\n * Failure type returned when the response's <tt style=\"font-weight:bold\">success</tt>\n * property is set to <tt>false</tt>, or no field values are returned in the response's\n * <tt style=\"font-weight:bold\">data</tt> property.\n * @type {String}\n * @static\n */\nExt.form.Action.LOAD_FAILURE = 'load';\n\nExt.form.Action.prototype = {\n/**\n * @cfg {String} url The URL that the Action is to invoke.\n */\n/**\n * @cfg {Boolean} reset When set to <tt><b>true</b></tt>, causes the Form to be\n * {@link Ext.form.BasicForm.reset reset} on Action success. If specified, this happens\n * <b>before</b> the {@link #success} callback is called and before the Form's\n * {@link Ext.form.BasicForm.actioncomplete actioncomplete} event fires.\n */\n/**\n * @cfg {String} method The HTTP method to use to access the requested URL. Defaults to the\n * {@link Ext.form.BasicForm}'s method, or if that is not specified, the underlying DOM form's method.\n */\n/**\n * @cfg {Mixed} params <p>Extra parameter values to pass. These are added to the Form's\n * {@link Ext.form.BasicForm#baseParams} and passed to the specified URL along with the Form's\n * input fields.</p>\n * <p>Parameters are encoded as standard HTTP parameters using {@link Ext#urlEncode}.</p>\n */\n/**\n * @cfg {Number} timeout The number of seconds to wait for a server response before\n * failing with the {@link #failureType} as {@link #Action.CONNECT_FAILURE}. If not specified,\n * defaults to the configured <tt>{@link Ext.form.BasicForm#timeout timeout}</tt> of the\n * {@link Ext.form.BasicForm form}.\n */\n/**\n * @cfg {Function} success The function to call when a valid success return packet is recieved.\n * The function is passed the following parameters:<ul class=\"mdetail-params\">\n * <li><b>form</b> : Ext.form.BasicForm<div class=\"sub-desc\">The form that requested the action</div></li>\n * <li><b>action</b> : Ext.form.Action<div class=\"sub-desc\">The Action class. The {@link #result}\n * property of this object may be examined to perform custom postprocessing.</div></li>\n * </ul>\n */\n/**\n * @cfg {Function} failure The function to call when a failure packet was recieved, or when an\n * error ocurred in the Ajax communication.\n * The function is passed the following parameters:<ul class=\"mdetail-params\">\n * <li><b>form</b> : Ext.form.BasicForm<div class=\"sub-desc\">The form that requested the action</div></li>\n * <li><b>action</b> : Ext.form.Action<div class=\"sub-desc\">The Action class. If an Ajax\n * error ocurred, the failure type will be in {@link #failureType}. The {@link #result}\n * property of this object may be examined to perform custom postprocessing.</div></li>\n * </ul>\n */\n/**\n * @cfg {Object} scope The scope in which to call the callback functions (The <tt>this</tt> reference\n * for the callback functions).\n */\n/**\n * @cfg {String} waitMsg The message to be displayed by a call to {@link Ext.MessageBox#wait}\n * during the time the action is being processed.\n */\n/**\n * @cfg {String} waitTitle The title to be displayed by a call to {@link Ext.MessageBox#wait}\n * during the time the action is being processed.\n */\n\n/**\n * @cfg {Boolean} submitEmptyText If set to <tt>true</tt>, the emptyText value will be sent with the form\n * when it is submitted.  Defaults to <tt>true</tt>.\n */\n\n/**\n * The type of action this Action instance performs.\n * Currently only \"submit\" and \"load\" are supported.\n * @type {String}\n */\n    type : 'default',\n/**\n * The type of failure detected will be one of these: {@link #CLIENT_INVALID},\n * {@link #SERVER_INVALID}, {@link #CONNECT_FAILURE}, or {@link #LOAD_FAILURE}.  Usage:\n * <pre><code>\nvar fp = new Ext.form.FormPanel({\n...\nbuttons: [{\n    text: 'Save',\n    formBind: true,\n    handler: function(){\n        if(fp.getForm().isValid()){\n            fp.getForm().submit({\n                url: 'form-submit.php',\n                waitMsg: 'Submitting your data...',\n                success: function(form, action){\n                    // server responded with success = true\n                    var result = action.{@link #result};\n                },\n                failure: function(form, action){\n                    if (action.{@link #failureType} === Ext.form.Action.{@link #CONNECT_FAILURE}) {\n                        Ext.Msg.alert('Error',\n                            'Status:'+action.{@link #response}.status+': '+\n                            action.{@link #response}.statusText);\n                    }\n                    if (action.failureType === Ext.form.Action.{@link #SERVER_INVALID}){\n                        // server responded with success = false\n                        Ext.Msg.alert('Invalid', action.{@link #result}.errormsg);\n                    }\n                }\n            });\n        }\n    }\n},{\n    text: 'Reset',\n    handler: function(){\n        fp.getForm().reset();\n    }\n}]\n * </code></pre>\n * @property failureType\n * @type {String}\n */\n /**\n * The XMLHttpRequest object used to perform the action.\n * @property response\n * @type {Object}\n */\n /**\n * The decoded response object containing a boolean <tt style=\"font-weight:bold\">success</tt> property and\n * other, action-specific properties.\n * @property result\n * @type {Object}\n */\n\n    // interface method\n    run : function(options){\n\n    },\n\n    // interface method\n    success : function(response){\n\n    },\n\n    // interface method\n    handleResponse : function(response){\n\n    },\n\n    // default connection failure\n    failure : function(response){\n        this.response = response;\n        this.failureType = Ext.form.Action.CONNECT_FAILURE;\n        this.form.afterAction(this, false);\n    },\n\n    // private\n    // shared code among all Actions to validate that there was a response\n    // with either responseText or responseXml\n    processResponse : function(response){\n        this.response = response;\n        if(!response.responseText && !response.responseXML){\n            return true;\n        }\n        this.result = this.handleResponse(response);\n        return this.result;\n    },\n    \n    decodeResponse: function(response) {\n        try {\n            return Ext.decode(response.responseText);\n        } catch(e) {\n            return false;\n        } \n    },\n\n    // utility functions used internally\n    getUrl : function(appendParams){\n        var url = this.options.url || this.form.url || this.form.el.dom.action;\n        if(appendParams){\n            var p = this.getParams();\n            if(p){\n                url = Ext.urlAppend(url, p);\n            }\n        }\n        return url;\n    },\n\n    // private\n    getMethod : function(){\n        return (this.options.method || this.form.method || this.form.el.dom.method || 'POST').toUpperCase();\n    },\n\n    // private\n    getParams : function(){\n        var bp = this.form.baseParams;\n        var p = this.options.params;\n        if(p){\n            if(typeof p == \"object\"){\n                p = Ext.urlEncode(Ext.applyIf(p, bp));\n            }else if(typeof p == 'string' && bp){\n                p += '&' + Ext.urlEncode(bp);\n            }\n        }else if(bp){\n            p = Ext.urlEncode(bp);\n        }\n        return p;\n    },\n\n    // private\n    createCallback : function(opts){\n        var opts = opts || {};\n        return {\n            success: this.success,\n            failure: this.failure,\n            scope: this,\n            timeout: (opts.timeout*1000) || (this.form.timeout*1000),\n            upload: this.form.fileUpload ? this.success : undefined\n        };\n    }\n};\n\n/**\n * @class Ext.form.Action.Submit\n * @extends Ext.form.Action\n * <p>A class which handles submission of data from {@link Ext.form.BasicForm Form}s\n * and processes the returned response.</p>\n * <p>Instances of this class are only created by a {@link Ext.form.BasicForm Form} when\n * {@link Ext.form.BasicForm#submit submit}ting.</p>\n * <p><u><b>Response Packet Criteria</b></u></p>\n * <p>A response packet may contain:\n * <div class=\"mdetail-params\"><ul>\n * <li><b><code>success</code></b> property : Boolean\n * <div class=\"sub-desc\">The <code>success</code> property is required.</div></li>\n * <li><b><code>errors</code></b> property : Object\n * <div class=\"sub-desc\"><div class=\"sub-desc\">The <code>errors</code> property,\n * which is optional, contains error messages for invalid fields.</div></li>\n * </ul></div>\n * <p><u><b>JSON Packets</b></u></p>\n * <p>By default, response packets are assumed to be JSON, so a typical response\n * packet may look like this:</p><pre><code>\n{\n    success: false,\n    errors: {\n        clientCode: \"Client not found\",\n        portOfLoading: \"This field must not be null\"\n    }\n}</code></pre>\n * <p>Other data may be placed into the response for processing by the {@link Ext.form.BasicForm}'s callback\n * or event handler methods. The object decoded from this JSON is available in the\n * {@link Ext.form.Action#result result} property.</p>\n * <p>Alternatively, if an {@link #errorReader} is specified as an {@link Ext.data.XmlReader XmlReader}:</p><pre><code>\n    errorReader: new Ext.data.XmlReader({\n            record : 'field',\n            success: '@success'\n        }, [\n            'id', 'msg'\n        ]\n    )\n</code></pre>\n * <p>then the results may be sent back in XML format:</p><pre><code>\n&lt;?xml version=\"1.0\" encoding=\"UTF-8\"?&gt;\n&lt;message success=\"false\"&gt;\n&lt;errors&gt;\n    &lt;field&gt;\n        &lt;id&gt;clientCode&lt;/id&gt;\n        &lt;msg&gt;&lt;![CDATA[Code not found. &lt;br /&gt;&lt;i&gt;This is a test validation message from the server &lt;/i&gt;]]&gt;&lt;/msg&gt;\n    &lt;/field&gt;\n    &lt;field&gt;\n        &lt;id&gt;portOfLoading&lt;/id&gt;\n        &lt;msg&gt;&lt;![CDATA[Port not found. &lt;br /&gt;&lt;i&gt;This is a test validation message from the server &lt;/i&gt;]]&gt;&lt;/msg&gt;\n    &lt;/field&gt;\n&lt;/errors&gt;\n&lt;/message&gt;\n</code></pre>\n * <p>Other elements may be placed into the response XML for processing by the {@link Ext.form.BasicForm}'s callback\n * or event handler methods. The XML document is available in the {@link #errorReader}'s {@link Ext.data.XmlReader#xmlData xmlData} property.</p>\n */\nExt.form.Action.Submit = function(form, options){\n    Ext.form.Action.Submit.superclass.constructor.call(this, form, options);\n};\n\nExt.extend(Ext.form.Action.Submit, Ext.form.Action, {\n    /**\n     * @cfg {Ext.data.DataReader} errorReader <p><b>Optional. JSON is interpreted with\n     * no need for an errorReader.</b></p>\n     * <p>A Reader which reads a single record from the returned data. The DataReader's\n     * <b>success</b> property specifies how submission success is determined. The Record's\n     * data provides the error messages to apply to any invalid form Fields.</p>\n     */\n    /**\n     * @cfg {boolean} clientValidation Determines whether a Form's fields are validated\n     * in a final call to {@link Ext.form.BasicForm#isValid isValid} prior to submission.\n     * Pass <tt>false</tt> in the Form's submit options to prevent this. If not defined, pre-submission field validation\n     * is performed.\n     */\n    type : 'submit',\n\n    // private\n    run : function(){\n        var o = this.options,\n            method = this.getMethod(),\n            isGet = method == 'GET';\n        if(o.clientValidation === false || this.form.isValid()){\n            if (o.submitEmptyText === false) {\n                var fields = this.form.items,\n                    emptyFields = [],\n                    setupEmptyFields = function(f){\n                        if (f.el.getValue() == f.emptyText) {\n                            emptyFields.push(f);\n                            f.el.dom.value = \"\";\n                        }\n                        if(f.isComposite && f.rendered){\n                            f.items.each(setupEmptyFields);\n                        }\n                    };\n                    \n                fields.each(setupEmptyFields);\n            }\n            Ext.Ajax.request(Ext.apply(this.createCallback(o), {\n                form:this.form.el.dom,\n                url:this.getUrl(isGet),\n                method: method,\n                headers: o.headers,\n                params:!isGet ? this.getParams() : null,\n                isUpload: this.form.fileUpload\n            }));\n            if (o.submitEmptyText === false) {\n                Ext.each(emptyFields, function(f) {\n                    if (f.applyEmptyText) {\n                        f.applyEmptyText();\n                    }\n                });\n            }\n        }else if (o.clientValidation !== false){ // client validation failed\n            this.failureType = Ext.form.Action.CLIENT_INVALID;\n            this.form.afterAction(this, false);\n        }\n    },\n\n    // private\n    success : function(response){\n        var result = this.processResponse(response);\n        if(result === true || result.success){\n            this.form.afterAction(this, true);\n            return;\n        }\n        if(result.errors){\n            this.form.markInvalid(result.errors);\n        }\n        this.failureType = Ext.form.Action.SERVER_INVALID;\n        this.form.afterAction(this, false);\n    },\n\n    // private\n    handleResponse : function(response){\n        if(this.form.errorReader){\n            var rs = this.form.errorReader.read(response);\n            var errors = [];\n            if(rs.records){\n                for(var i = 0, len = rs.records.length; i < len; i++) {\n                    var r = rs.records[i];\n                    errors[i] = r.data;\n                }\n            }\n            if(errors.length < 1){\n                errors = null;\n            }\n            return {\n                success : rs.success,\n                errors : errors\n            };\n        }\n        return this.decodeResponse(response);\n    }\n});\n\n\n/**\n * @class Ext.form.Action.Load\n * @extends Ext.form.Action\n * <p>A class which handles loading of data from a server into the Fields of an {@link Ext.form.BasicForm}.</p>\n * <p>Instances of this class are only created by a {@link Ext.form.BasicForm Form} when\n * {@link Ext.form.BasicForm#load load}ing.</p>\n * <p><u><b>Response Packet Criteria</b></u></p>\n * <p>A response packet <b>must</b> contain:\n * <div class=\"mdetail-params\"><ul>\n * <li><b><code>success</code></b> property : Boolean</li>\n * <li><b><code>data</code></b> property : Object</li>\n * <div class=\"sub-desc\">The <code>data</code> property contains the values of Fields to load.\n * The individual value object for each Field is passed to the Field's\n * {@link Ext.form.Field#setValue setValue} method.</div></li>\n * </ul></div>\n * <p><u><b>JSON Packets</b></u></p>\n * <p>By default, response packets are assumed to be JSON, so for the following form load call:<pre><code>\nvar myFormPanel = new Ext.form.FormPanel({\n    title: 'Client and routing info',\n    items: [{\n        fieldLabel: 'Client',\n        name: 'clientName'\n    }, {\n        fieldLabel: 'Port of loading',\n        name: 'portOfLoading'\n    }, {\n        fieldLabel: 'Port of discharge',\n        name: 'portOfDischarge'\n    }]\n});\nmyFormPanel.{@link Ext.form.FormPanel#getForm getForm}().{@link Ext.form.BasicForm#load load}({\n    url: '/getRoutingInfo.php',\n    params: {\n        consignmentRef: myConsignmentRef\n    },\n    failure: function(form, action) {\n        Ext.Msg.alert(\"Load failed\", action.result.errorMessage);\n    }\n});\n</code></pre>\n * a <b>success response</b> packet may look like this:</p><pre><code>\n{\n    success: true,\n    data: {\n        clientName: \"Fred. Olsen Lines\",\n        portOfLoading: \"FXT\",\n        portOfDischarge: \"OSL\"\n    }\n}</code></pre>\n * while a <b>failure response</b> packet may look like this:</p><pre><code>\n{\n    success: false,\n    errorMessage: \"Consignment reference not found\"\n}</code></pre>\n * <p>Other data may be placed into the response for processing the {@link Ext.form.BasicForm Form}'s\n * callback or event handler methods. The object decoded from this JSON is available in the\n * {@link Ext.form.Action#result result} property.</p>\n */\nExt.form.Action.Load = function(form, options){\n    Ext.form.Action.Load.superclass.constructor.call(this, form, options);\n    this.reader = this.form.reader;\n};\n\nExt.extend(Ext.form.Action.Load, Ext.form.Action, {\n    // private\n    type : 'load',\n\n    // private\n    run : function(){\n        Ext.Ajax.request(Ext.apply(\n                this.createCallback(this.options), {\n                    method:this.getMethod(),\n                    url:this.getUrl(false),\n                    headers: this.options.headers,\n                    params:this.getParams()\n        }));\n    },\n\n    // private\n    success : function(response){\n        var result = this.processResponse(response);\n        if(result === true || !result.success || !result.data){\n            this.failureType = Ext.form.Action.LOAD_FAILURE;\n            this.form.afterAction(this, false);\n            return;\n        }\n        this.form.clearInvalid();\n        this.form.setValues(result.data);\n        this.form.afterAction(this, true);\n    },\n\n    // private\n    handleResponse : function(response){\n        if(this.form.reader){\n            var rs = this.form.reader.read(response);\n            var data = rs.records && rs.records[0] ? rs.records[0].data : null;\n            return {\n                success : rs.success,\n                data : data\n            };\n        }\n        return this.decodeResponse(response);\n    }\n});\n\n\n\n/**\n * @class Ext.form.Action.DirectLoad\n * @extends Ext.form.Action.Load\n * <p>Provides Ext.direct support for loading form data.</p>\n * <p>This example illustrates usage of Ext.Direct to <b>load</b> a form through Ext.Direct.</p>\n * <pre><code>\nvar myFormPanel = new Ext.form.FormPanel({\n    // configs for FormPanel\n    title: 'Basic Information',\n    renderTo: document.body,\n    width: 300, height: 160,\n    padding: 10,\n\n    // configs apply to child items\n    defaults: {anchor: '100%'},\n    defaultType: 'textfield',\n    items: [{\n        fieldLabel: 'Name',\n        name: 'name'\n    },{\n        fieldLabel: 'Email',\n        name: 'email'\n    },{\n        fieldLabel: 'Company',\n        name: 'company'\n    }],\n\n    // configs for BasicForm\n    api: {\n        // The server-side method to call for load() requests\n        load: Profile.getBasicInfo,\n        // The server-side must mark the submit handler as a 'formHandler'\n        submit: Profile.updateBasicInfo\n    },\n    // specify the order for the passed params\n    paramOrder: ['uid', 'foo']\n});\n\n// load the form\nmyFormPanel.getForm().load({\n    // pass 2 arguments to server side getBasicInfo method (len=2)\n    params: {\n        foo: 'bar',\n        uid: 34\n    }\n});\n * </code></pre>\n * The data packet sent to the server will resemble something like:\n * <pre><code>\n[\n    {\n        \"action\":\"Profile\",\"method\":\"getBasicInfo\",\"type\":\"rpc\",\"tid\":2,\n        \"data\":[34,\"bar\"] // note the order of the params\n    }\n]\n * </code></pre>\n * The form will process a data packet returned by the server that is similar\n * to the following format:\n * <pre><code>\n[\n    {\n        \"action\":\"Profile\",\"method\":\"getBasicInfo\",\"type\":\"rpc\",\"tid\":2,\n        \"result\":{\n            \"success\":true,\n            \"data\":{\n                \"name\":\"Fred Flintstone\",\n                \"company\":\"Slate Rock and Gravel\",\n                \"email\":\"fred.flintstone@slaterg.com\"\n            }\n        }\n    }\n]\n * </code></pre>\n */\nExt.form.Action.DirectLoad = Ext.extend(Ext.form.Action.Load, {\n    constructor: function(form, opts) {\n        Ext.form.Action.DirectLoad.superclass.constructor.call(this, form, opts);\n    },\n    type : 'directload',\n\n    run : function(){\n        var args = this.getParams();\n        args.push(this.success, this);\n        this.form.api.load.apply(window, args);\n    },\n\n    getParams : function() {\n        var buf = [], o = {};\n        var bp = this.form.baseParams;\n        var p = this.options.params;\n        Ext.apply(o, p, bp);\n        var paramOrder = this.form.paramOrder;\n        if(paramOrder){\n            for(var i = 0, len = paramOrder.length; i < len; i++){\n                buf.push(o[paramOrder[i]]);\n            }\n        }else if(this.form.paramsAsHash){\n            buf.push(o);\n        }\n        return buf;\n    },\n    // Direct actions have already been processed and therefore\n    // we can directly set the result; Direct Actions do not have\n    // a this.response property.\n    processResponse : function(result) {\n        this.result = result;\n        return result;\n    },\n\n    success : function(response, trans){\n        if(trans.type == Ext.Direct.exceptions.SERVER){\n            response = {};\n        }\n        Ext.form.Action.DirectLoad.superclass.success.call(this, response);\n    }\n});\n\n/**\n * @class Ext.form.Action.DirectSubmit\n * @extends Ext.form.Action.Submit\n * <p>Provides Ext.direct support for submitting form data.</p>\n * <p>This example illustrates usage of Ext.Direct to <b>submit</b> a form through Ext.Direct.</p>\n * <pre><code>\nvar myFormPanel = new Ext.form.FormPanel({\n    // configs for FormPanel\n    title: 'Basic Information',\n    renderTo: document.body,\n    width: 300, height: 160,\n    padding: 10,\n    buttons:[{\n        text: 'Submit',\n        handler: function(){\n            myFormPanel.getForm().submit({\n                params: {\n                    foo: 'bar',\n                    uid: 34\n                }\n            });\n        }\n    }],\n\n    // configs apply to child items\n    defaults: {anchor: '100%'},\n    defaultType: 'textfield',\n    items: [{\n        fieldLabel: 'Name',\n        name: 'name'\n    },{\n        fieldLabel: 'Email',\n        name: 'email'\n    },{\n        fieldLabel: 'Company',\n        name: 'company'\n    }],\n\n    // configs for BasicForm\n    api: {\n        // The server-side method to call for load() requests\n        load: Profile.getBasicInfo,\n        // The server-side must mark the submit handler as a 'formHandler'\n        submit: Profile.updateBasicInfo\n    },\n    // specify the order for the passed params\n    paramOrder: ['uid', 'foo']\n});\n * </code></pre>\n * The data packet sent to the server will resemble something like:\n * <pre><code>\n{\n    \"action\":\"Profile\",\"method\":\"updateBasicInfo\",\"type\":\"rpc\",\"tid\":\"6\",\n    \"result\":{\n        \"success\":true,\n        \"id\":{\n            \"extAction\":\"Profile\",\"extMethod\":\"updateBasicInfo\",\n            \"extType\":\"rpc\",\"extTID\":\"6\",\"extUpload\":\"false\",\n            \"name\":\"Aaron Conran\",\"email\":\"aaron@extjs.com\",\"company\":\"Ext JS, LLC\"\n        }\n    }\n}\n * </code></pre>\n * The form will process a data packet returned by the server that is similar\n * to the following:\n * <pre><code>\n// sample success packet (batched requests)\n[\n    {\n        \"action\":\"Profile\",\"method\":\"updateBasicInfo\",\"type\":\"rpc\",\"tid\":3,\n        \"result\":{\n            \"success\":true\n        }\n    }\n]\n\n// sample failure packet (one request)\n{\n        \"action\":\"Profile\",\"method\":\"updateBasicInfo\",\"type\":\"rpc\",\"tid\":\"6\",\n        \"result\":{\n            \"errors\":{\n                \"email\":\"already taken\"\n            },\n            \"success\":false,\n            \"foo\":\"bar\"\n        }\n}\n * </code></pre>\n * Also see the discussion in {@link Ext.form.Action.DirectLoad}.\n */\nExt.form.Action.DirectSubmit = Ext.extend(Ext.form.Action.Submit, {\n    constructor : function(form, opts) {\n        Ext.form.Action.DirectSubmit.superclass.constructor.call(this, form, opts);\n    },\n    type : 'directsubmit',\n    // override of Submit\n    run : function(){\n        var o = this.options;\n        if(o.clientValidation === false || this.form.isValid()){\n            // tag on any additional params to be posted in the\n            // form scope\n            this.success.params = this.getParams();\n            this.form.api.submit(this.form.el.dom, this.success, this);\n        }else if (o.clientValidation !== false){ // client validation failed\n            this.failureType = Ext.form.Action.CLIENT_INVALID;\n            this.form.afterAction(this, false);\n        }\n    },\n\n    getParams : function() {\n        var o = {};\n        var bp = this.form.baseParams;\n        var p = this.options.params;\n        Ext.apply(o, p, bp);\n        return o;\n    },\n    // Direct actions have already been processed and therefore\n    // we can directly set the result; Direct Actions do not have\n    // a this.response property.\n    processResponse : function(result) {\n        this.result = result;\n        return result;\n    },\n\n    success : function(response, trans){\n        if(trans.type == Ext.Direct.exceptions.SERVER){\n            response = {};\n        }\n        Ext.form.Action.DirectSubmit.superclass.success.call(this, response);\n    }\n});\n\nExt.form.Action.ACTION_TYPES = {\n    'load' : Ext.form.Action.Load,\n    'submit' : Ext.form.Action.Submit,\n    'directload' : Ext.form.Action.DirectLoad,\n    'directsubmit' : Ext.form.Action.DirectSubmit\n};\n/**\n * @class Ext.form.VTypes\n * <p>This is a singleton object which contains a set of commonly used field validation functions.\n * The validations provided are basic and intended to be easily customizable and extended.</p>\n * <p>To add custom VTypes specify the <code>{@link Ext.form.TextField#vtype vtype}</code> validation\n * test function, and optionally specify any corresponding error text to display and any keystroke\n * filtering mask to apply. For example:</p>\n * <pre><code>\n// custom Vtype for vtype:'time'\nvar timeTest = /^([1-9]|1[0-9]):([0-5][0-9])(\\s[a|p]m)$/i;\nExt.apply(Ext.form.VTypes, {\n    //  vtype validation function\n    time: function(val, field) {\n        return timeTest.test(val);\n    },\n    // vtype Text property: The error text to display when the validation function returns false\n    timeText: 'Not a valid time.  Must be in the format \"12:34 PM\".',\n    // vtype Mask property: The keystroke filter mask\n    timeMask: /[\\d\\s:amp]/i\n});\n * </code></pre>\n * Another example:\n * <pre><code>\n// custom Vtype for vtype:'IPAddress'\nExt.apply(Ext.form.VTypes, {\n    IPAddress:  function(v) {\n        return /^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$/.test(v);\n    },\n    IPAddressText: 'Must be a numeric IP address',\n    IPAddressMask: /[\\d\\.]/i\n});\n * </code></pre>\n * @singleton\n */\nExt.form.VTypes = function(){\n    // closure these in so they are only created once.\n    var alpha = /^[a-zA-Z_]+$/,\n        alphanum = /^[a-zA-Z0-9_]+$/,\n        email = /^(\\w+)([\\-+.\\'][\\w]+)*@(\\w[\\-\\w]*\\.){1,5}([A-Za-z]){2,6}$/,\n        url = /(((^https?)|(^ftp)):\\/\\/([\\-\\w]+\\.)+\\w{2,3}(\\/[%\\-\\w]+(\\.\\w{2,})?)*(([\\w\\-\\.\\?\\\\\\/+@&#;`~=%!]*)(\\.\\w{2,})?)*\\/?)/i;\n\n    // All these messages and functions are configurable\n    return {\n        /**\n         * The function used to validate email addresses.  Note that this is a very basic validation -- complete\n         * validation per the email RFC specifications is very complex and beyond the scope of this class, although\n         * this function can be overridden if a more comprehensive validation scheme is desired.  See the validation\n         * section of the <a href=\"http://en.wikipedia.org/wiki/E-mail_address\">Wikipedia article on email addresses</a>\n         * for additional information.  This implementation is intended to validate the following emails:<tt>\n         * 'barney@example.de', 'barney.rubble@example.com', 'barney-rubble@example.coop', 'barney+rubble@example.com'\n         * </tt>.\n         * @param {String} value The email address\n         * @return {Boolean} true if the RegExp test passed, and false if not.\n         */\n        'email' : function(v){\n            return email.test(v);\n        },\n        /**\n         * The error text to display when the email validation function returns false.  Defaults to:\n         * <tt>'This field should be an e-mail address in the format \"user@example.com\"'</tt>\n         * @type String\n         */\n        'emailText' : 'This field should be an e-mail address in the format \"user@example.com\"',\n        /**\n         * The keystroke filter mask to be applied on email input.  See the {@link #email} method for\n         * information about more complex email validation. Defaults to:\n         * <tt>/[a-z0-9_\\.\\-\\+\\'@]/i</tt>\n         * @type RegExp\n         */\n        'emailMask' : /[a-z0-9_\\.\\-\\+\\'@]/i,\n\n        /**\n         * The function used to validate URLs\n         * @param {String} value The URL\n         * @return {Boolean} true if the RegExp test passed, and false if not.\n         */\n        'url' : function(v){\n            return url.test(v);\n        },\n        /**\n         * The error text to display when the url validation function returns false.  Defaults to:\n         * <tt>'This field should be a URL in the format \"http:/'+'/www.example.com\"'</tt>\n         * @type String\n         */\n        'urlText' : 'This field should be a URL in the format \"http:/'+'/www.example.com\"',\n\n        /**\n         * The function used to validate alpha values\n         * @param {String} value The value\n         * @return {Boolean} true if the RegExp test passed, and false if not.\n         */\n        'alpha' : function(v){\n            return alpha.test(v);\n        },\n        /**\n         * The error text to display when the alpha validation function returns false.  Defaults to:\n         * <tt>'This field should only contain letters and _'</tt>\n         * @type String\n         */\n        'alphaText' : 'This field should only contain letters and _',\n        /**\n         * The keystroke filter mask to be applied on alpha input.  Defaults to:\n         * <tt>/[a-z_]/i</tt>\n         * @type RegExp\n         */\n        'alphaMask' : /[a-z_]/i,\n\n        /**\n         * The function used to validate alphanumeric values\n         * @param {String} value The value\n         * @return {Boolean} true if the RegExp test passed, and false if not.\n         */\n        'alphanum' : function(v){\n            return alphanum.test(v);\n        },\n        /**\n         * The error text to display when the alphanumeric validation function returns false.  Defaults to:\n         * <tt>'This field should only contain letters, numbers and _'</tt>\n         * @type String\n         */\n        'alphanumText' : 'This field should only contain letters, numbers and _',\n        /**\n         * The keystroke filter mask to be applied on alphanumeric input.  Defaults to:\n         * <tt>/[a-z0-9_]/i</tt>\n         * @type RegExp\n         */\n        'alphanumMask' : /[a-z0-9_]/i\n    };\n}();\n/**\n * @class Ext.grid.GridPanel\n * @extends Ext.Panel\n * <p>This class represents the primary interface of a component based grid control to represent data\n * in a tabular format of rows and columns. The GridPanel is composed of the following:</p>\n * <div class=\"mdetail-params\"><ul>\n * <li><b>{@link Ext.data.Store Store}</b> : The Model holding the data records (rows)\n * <div class=\"sub-desc\"></div></li>\n * <li><b>{@link Ext.grid.ColumnModel Column model}</b> : Column makeup\n * <div class=\"sub-desc\"></div></li>\n * <li><b>{@link Ext.grid.GridView View}</b> : Encapsulates the user interface\n * <div class=\"sub-desc\"></div></li>\n * <li><b>{@link Ext.grid.AbstractSelectionModel selection model}</b> : Selection behavior\n * <div class=\"sub-desc\"></div></li>\n * </ul></div>\n * <p>Example usage:</p>\n * <pre><code>\nvar grid = new Ext.grid.GridPanel({\n    {@link #store}: new {@link Ext.data.Store}({\n        {@link Ext.data.Store#autoDestroy autoDestroy}: true,\n        {@link Ext.data.Store#reader reader}: reader,\n        {@link Ext.data.Store#data data}: xg.dummyData\n    }),\n    {@link #colModel}: new {@link Ext.grid.ColumnModel}({\n        {@link Ext.grid.ColumnModel#defaults defaults}: {\n            width: 120,\n            sortable: true\n        },\n        {@link Ext.grid.ColumnModel#columns columns}: [\n            {id: 'company', header: 'Company', width: 200, sortable: true, dataIndex: 'company'},\n            {header: 'Price', renderer: Ext.util.Format.usMoney, dataIndex: 'price'},\n            {header: 'Change', dataIndex: 'change'},\n            {header: '% Change', dataIndex: 'pctChange'},\n            // instead of specifying renderer: Ext.util.Format.dateRenderer('m/d/Y') use xtype\n            {\n                header: 'Last Updated', width: 135, dataIndex: 'lastChange',\n                xtype: 'datecolumn', format: 'M d, Y'\n            }\n        ]\n    }),\n    {@link #viewConfig}: {\n        {@link Ext.grid.GridView#forceFit forceFit}: true,\n\n//      Return CSS class to apply to rows depending upon data values\n        {@link Ext.grid.GridView#getRowClass getRowClass}: function(record, index) {\n            var c = record.{@link Ext.data.Record#get get}('change');\n            if (c < 0) {\n                return 'price-fall';\n            } else if (c > 0) {\n                return 'price-rise';\n            }\n        }\n    },\n    {@link #sm}: new Ext.grid.RowSelectionModel({singleSelect:true}),\n    width: 600,\n    height: 300,\n    frame: true,\n    title: 'Framed with Row Selection and Horizontal Scrolling',\n    iconCls: 'icon-grid'\n});\n * </code></pre>\n * <p><b><u>Notes:</u></b></p>\n * <div class=\"mdetail-params\"><ul>\n * <li>Although this class inherits many configuration options from base classes, some of them\n * (such as autoScroll, autoWidth, layout, items, etc) are not used by this class, and will\n * have no effect.</li>\n * <li>A grid <b>requires</b> a width in which to scroll its columns, and a height in which to\n * scroll its rows. These dimensions can either be set explicitly through the\n * <tt>{@link Ext.BoxComponent#height height}</tt> and <tt>{@link Ext.BoxComponent#width width}</tt>\n * configuration options or implicitly set by using the grid as a child item of a\n * {@link Ext.Container Container} which will have a {@link Ext.Container#layout layout manager}\n * provide the sizing of its child items (for example the Container of the Grid may specify\n * <tt>{@link Ext.Container#layout layout}:'fit'</tt>).</li>\n * <li>To access the data in a Grid, it is necessary to use the data model encapsulated\n * by the {@link #store Store}. See the {@link #cellclick} event for more details.</li>\n * </ul></div>\n * @constructor\n * @param {Object} config The config object\n * @xtype grid\n */\nExt.grid.GridPanel = Ext.extend(Ext.Panel, {\n    /**\n     * @cfg {String} autoExpandColumn\n     * <p>The <tt>{@link Ext.grid.Column#id id}</tt> of a {@link Ext.grid.Column column} in\n     * this grid that should expand to fill unused space. This value specified here can not\n     * be <tt>0</tt>.</p>\n     * <br><p><b>Note</b>: If the Grid's {@link Ext.grid.GridView view} is configured with\n     * <tt>{@link Ext.grid.GridView#forceFit forceFit}=true</tt> the <tt>autoExpandColumn</tt>\n     * is ignored. See {@link Ext.grid.Column}.<tt>{@link Ext.grid.Column#width width}</tt>\n     * for additional details.</p>\n     * <p>See <tt>{@link #autoExpandMax}</tt> and <tt>{@link #autoExpandMin}</tt> also.</p>\n     */\n    autoExpandColumn : false,\n    \n    /**\n     * @cfg {Number} autoExpandMax The maximum width the <tt>{@link #autoExpandColumn}</tt>\n     * can have (if enabled). Defaults to <tt>1000</tt>.\n     */\n    autoExpandMax : 1000,\n    \n    /**\n     * @cfg {Number} autoExpandMin The minimum width the <tt>{@link #autoExpandColumn}</tt>\n     * can have (if enabled). Defaults to <tt>50</tt>.\n     */\n    autoExpandMin : 50,\n    \n    /**\n     * @cfg {Boolean} columnLines <tt>true</tt> to add css for column separation lines.\n     * Default is <tt>false</tt>.\n     */\n    columnLines : false,\n    \n    /**\n     * @cfg {Object} cm Shorthand for <tt>{@link #colModel}</tt>.\n     */\n    /**\n     * @cfg {Object} colModel The {@link Ext.grid.ColumnModel} to use when rendering the grid (required).\n     */\n    /**\n     * @cfg {Array} columns An array of {@link Ext.grid.Column columns} to auto create a\n     * {@link Ext.grid.ColumnModel}.  The ColumnModel may be explicitly created via the\n     * <tt>{@link #colModel}</tt> configuration property.\n     */\n    /**\n     * @cfg {String} ddGroup The DD group this GridPanel belongs to. Defaults to <tt>'GridDD'</tt> if not specified.\n     */\n    /**\n     * @cfg {String} ddText\n     * Configures the text in the drag proxy.  Defaults to:\n     * <pre><code>\n     * ddText : '{0} selected row{1}'\n     * </code></pre>\n     * <tt>{0}</tt> is replaced with the number of selected rows.\n     */\n    ddText : '{0} selected row{1}',\n\n    /**\n     * @cfg {Boolean} dragCell Defaults to <code>false</code>. If using {@link #enableDragDrop} with a CellSelectionModel,\n     * set this to true to have the {@link #getView view}'s {@link Ext.grid.GridView#dragZone dragZone}'s <code>getDragData</code>\n     * method reference the selected <b>cell</b> using <code>[rowIndex, cellIndex]</code>\n     */\n\n    /**\n     * @cfg {Boolean} deferRowRender <P>Defaults to <tt>true</tt> to enable deferred row rendering.</p>\n     * <p>This allows the GridPanel to be initially rendered empty, with the expensive update of the row\n     * structure deferred so that layouts with GridPanels appear more quickly.</p>\n     */\n    deferRowRender : true,\n    \n    /**\n     * @cfg {Boolean} disableSelection <p><tt>true</tt> to disable selections in the grid. Defaults to <tt>false</tt>.</p>\n     * <p>Ignored if a {@link #selModel SelectionModel} is specified.</p>\n     */\n    /**\n     * @cfg {Boolean} enableColumnResize <tt>false</tt> to turn off column resizing for the whole grid. Defaults to <tt>true</tt>.\n     */\n    /**\n     * @cfg {Boolean} enableColumnHide\n     * Defaults to <tt>true</tt> to enable {@link Ext.grid.Column#hidden hiding of columns}\n     * with the {@link #enableHdMenu header menu}.\n     */\n    enableColumnHide : true,\n    \n    /**\n     * @cfg {Boolean} enableColumnMove Defaults to <tt>true</tt> to enable drag and drop reorder of columns. <tt>false</tt>\n     * to turn off column reordering via drag drop.\n     */\n    enableColumnMove : true,\n    \n    /**\n     * @cfg {Boolean} enableDragDrop <p>Enables dragging of the selected rows of the GridPanel. Defaults to <tt>false</tt>.</p>\n     * <p>Setting this to <b><tt>true</tt></b> causes this GridPanel's {@link #getView GridView} to\n     * create an instance of {@link Ext.grid.GridDragZone}. <b>Note</b>: this is available only <b>after</b>\n     * the Grid has been rendered as the GridView's <tt>{@link Ext.grid.GridView#dragZone dragZone}</tt>\n     * property.</p>\n     * <p>A cooperating {@link Ext.dd.DropZone DropZone} must be created who's implementations of\n     * {@link Ext.dd.DropZone#onNodeEnter onNodeEnter}, {@link Ext.dd.DropZone#onNodeOver onNodeOver},\n     * {@link Ext.dd.DropZone#onNodeOut onNodeOut} and {@link Ext.dd.DropZone#onNodeDrop onNodeDrop} are able\n     * to process the {@link Ext.grid.GridDragZone#getDragData data} which is provided.</p>\n     */\n    enableDragDrop : false,\n    \n    /**\n     * @cfg {Boolean} enableHdMenu Defaults to <tt>true</tt> to enable the drop down button for menu in the headers.\n     */\n    enableHdMenu : true,\n    \n    /**\n     * @cfg {Boolean} hideHeaders True to hide the grid's header. Defaults to <code>false</code>.\n     */\n    /**\n     * @cfg {Object} loadMask An {@link Ext.LoadMask} config or true to mask the grid while\n     * loading. Defaults to <code>false</code>.\n     */\n    loadMask : false,\n    \n    /**\n     * @cfg {Number} maxHeight Sets the maximum height of the grid - ignored if <tt>autoHeight</tt> is not on.\n     */\n    /**\n     * @cfg {Number} minColumnWidth The minimum width a column can be resized to. Defaults to <tt>25</tt>.\n     */\n    minColumnWidth : 25,\n    \n    /**\n     * @cfg {Object} sm Shorthand for <tt>{@link #selModel}</tt>.\n     */\n    /**\n     * @cfg {Object} selModel Any subclass of {@link Ext.grid.AbstractSelectionModel} that will provide\n     * the selection model for the grid (defaults to {@link Ext.grid.RowSelectionModel} if not specified).\n     */\n    /**\n     * @cfg {Ext.data.Store} store The {@link Ext.data.Store} the grid should use as its data source (required).\n     */\n    /**\n     * @cfg {Boolean} stripeRows <tt>true</tt> to stripe the rows. Default is <tt>false</tt>.\n     * <p>This causes the CSS class <tt><b>x-grid3-row-alt</b></tt> to be added to alternate rows of\n     * the grid. A default CSS rule is provided which sets a background colour, but you can override this\n     * with a rule which either overrides the <b>background-color</b> style using the '!important'\n     * modifier, or which uses a CSS selector of higher specificity.</p>\n     */\n    stripeRows : false,\n    \n    /**\n     * @cfg {Boolean} trackMouseOver True to highlight rows when the mouse is over. Default is <tt>true</tt>\n     * for GridPanel, but <tt>false</tt> for EditorGridPanel.\n     */\n    trackMouseOver : true,\n    \n    /**\n     * @cfg {Array} stateEvents\n     * An array of events that, when fired, should trigger this component to save its state.\n     * Defaults to:<pre><code>\n     * stateEvents: ['columnmove', 'columnresize', 'sortchange', 'groupchange']\n     * </code></pre>\n     * <p>These can be any types of events supported by this component, including browser or\n     * custom events (e.g., <tt>['click', 'customerchange']</tt>).</p>\n     * <p>See {@link Ext.Component#stateful} for an explanation of saving and restoring\n     * Component state.</p>\n     */\n    stateEvents : ['columnmove', 'columnresize', 'sortchange', 'groupchange'],\n    \n    /**\n     * @cfg {Object} view The {@link Ext.grid.GridView} used by the grid. This can be set\n     * before a call to {@link Ext.Component#render render()}.\n     */\n    view : null,\n\n    /**\n     * @cfg {Array} bubbleEvents\n     * <p>An array of events that, when fired, should be bubbled to any parent container.\n     * See {@link Ext.util.Observable#enableBubble}.\n     * Defaults to <tt>[]</tt>.\n     */\n    bubbleEvents: [],\n\n    /**\n     * @cfg {Object} viewConfig A config object that will be applied to the grid's UI view.  Any of\n     * the config options available for {@link Ext.grid.GridView} can be specified here. This option\n     * is ignored if <tt>{@link #view}</tt> is specified.\n     */\n\n    // private\n    rendered : false,\n    \n    // private\n    viewReady : false,\n\n    // private\n    initComponent : function() {\n        Ext.grid.GridPanel.superclass.initComponent.call(this);\n\n        if (this.columnLines) {\n            this.cls = (this.cls || '') + ' x-grid-with-col-lines';\n        }\n        // override any provided value since it isn't valid\n        // and is causing too many bug reports ;)\n        this.autoScroll = false;\n        this.autoWidth = false;\n\n        if(Ext.isArray(this.columns)){\n            this.colModel = new Ext.grid.ColumnModel(this.columns);\n            delete this.columns;\n        }\n\n        // check and correct shorthanded configs\n        if(this.ds){\n            this.store = this.ds;\n            delete this.ds;\n        }\n        if(this.cm){\n            this.colModel = this.cm;\n            delete this.cm;\n        }\n        if(this.sm){\n            this.selModel = this.sm;\n            delete this.sm;\n        }\n        this.store = Ext.StoreMgr.lookup(this.store);\n\n        this.addEvents(\n            // raw events\n            /**\n             * @event click\n             * The raw click event for the entire grid.\n             * @param {Ext.EventObject} e\n             */\n            'click',\n            /**\n             * @event dblclick\n             * The raw dblclick event for the entire grid.\n             * @param {Ext.EventObject} e\n             */\n            'dblclick',\n            /**\n             * @event contextmenu\n             * The raw contextmenu event for the entire grid.\n             * @param {Ext.EventObject} e\n             */\n            'contextmenu',\n            /**\n             * @event mousedown\n             * The raw mousedown event for the entire grid.\n             * @param {Ext.EventObject} e\n             */\n            'mousedown',\n            /**\n             * @event mouseup\n             * The raw mouseup event for the entire grid.\n             * @param {Ext.EventObject} e\n             */\n            'mouseup',\n            /**\n             * @event mouseover\n             * The raw mouseover event for the entire grid.\n             * @param {Ext.EventObject} e\n             */\n            'mouseover',\n            /**\n             * @event mouseout\n             * The raw mouseout event for the entire grid.\n             * @param {Ext.EventObject} e\n             */\n            'mouseout',\n            /**\n             * @event keypress\n             * The raw keypress event for the entire grid.\n             * @param {Ext.EventObject} e\n             */\n            'keypress',\n            /**\n             * @event keydown\n             * The raw keydown event for the entire grid.\n             * @param {Ext.EventObject} e\n             */\n            'keydown',\n\n            // custom events\n            /**\n             * @event cellmousedown\n             * Fires before a cell is clicked\n             * @param {Grid} this\n             * @param {Number} rowIndex\n             * @param {Number} columnIndex\n             * @param {Ext.EventObject} e\n             */\n            'cellmousedown',\n            /**\n             * @event rowmousedown\n             * Fires before a row is clicked\n             * @param {Grid} this\n             * @param {Number} rowIndex\n             * @param {Ext.EventObject} e\n             */\n            'rowmousedown',\n            /**\n             * @event headermousedown\n             * Fires before a header is clicked\n             * @param {Grid} this\n             * @param {Number} columnIndex\n             * @param {Ext.EventObject} e\n             */\n            'headermousedown',\n\n            /**\n             * @event groupmousedown\n             * Fires before a group header is clicked. <b>Only applies for grids with a {@link Ext.grid.GroupingView GroupingView}</b>.\n             * @param {Grid} this\n             * @param {String} groupField\n             * @param {String} groupValue\n             * @param {Ext.EventObject} e\n             */\n            'groupmousedown',\n\n            /**\n             * @event rowbodymousedown\n             * Fires before the row body is clicked. <b>Only applies for grids with {@link Ext.grid.GridView#enableRowBody enableRowBody} configured.</b>\n             * @param {Grid} this\n             * @param {Number} rowIndex\n             * @param {Ext.EventObject} e\n             */\n            'rowbodymousedown',\n\n            /**\n             * @event containermousedown\n             * Fires before the container is clicked. The container consists of any part of the grid body that is not covered by a row.\n             * @param {Grid} this\n             * @param {Ext.EventObject} e\n             */\n            'containermousedown',\n\n            /**\n             * @event cellclick\n             * Fires when a cell is clicked.\n             * The data for the cell is drawn from the {@link Ext.data.Record Record}\n             * for this row. To access the data in the listener function use the\n             * following technique:\n             * <pre><code>\nfunction(grid, rowIndex, columnIndex, e) {\n    var record = grid.getStore().getAt(rowIndex);  // Get the Record\n    var fieldName = grid.getColumnModel().getDataIndex(columnIndex); // Get field name\n    var data = record.get(fieldName);\n}\n</code></pre>\n             * @param {Grid} this\n             * @param {Number} rowIndex\n             * @param {Number} columnIndex\n             * @param {Ext.EventObject} e\n             */\n            'cellclick',\n            /**\n             * @event celldblclick\n             * Fires when a cell is double clicked\n             * @param {Grid} this\n             * @param {Number} rowIndex\n             * @param {Number} columnIndex\n             * @param {Ext.EventObject} e\n             */\n            'celldblclick',\n            /**\n             * @event rowclick\n             * Fires when a row is clicked\n             * @param {Grid} this\n             * @param {Number} rowIndex\n             * @param {Ext.EventObject} e\n             */\n            'rowclick',\n            /**\n             * @event rowdblclick\n             * Fires when a row is double clicked\n             * @param {Grid} this\n             * @param {Number} rowIndex\n             * @param {Ext.EventObject} e\n             */\n            'rowdblclick',\n            /**\n             * @event headerclick\n             * Fires when a header is clicked\n             * @param {Grid} this\n             * @param {Number} columnIndex\n             * @param {Ext.EventObject} e\n             */\n            'headerclick',\n            /**\n             * @event headerdblclick\n             * Fires when a header cell is double clicked\n             * @param {Grid} this\n             * @param {Number} columnIndex\n             * @param {Ext.EventObject} e\n             */\n            'headerdblclick',\n            /**\n             * @event groupclick\n             * Fires when group header is clicked. <b>Only applies for grids with a {@link Ext.grid.GroupingView GroupingView}</b>.\n             * @param {Grid} this\n             * @param {String} groupField\n             * @param {String} groupValue\n             * @param {Ext.EventObject} e\n             */\n            'groupclick',\n            /**\n             * @event groupdblclick\n             * Fires when group header is double clicked. <b>Only applies for grids with a {@link Ext.grid.GroupingView GroupingView}</b>.\n             * @param {Grid} this\n             * @param {String} groupField\n             * @param {String} groupValue\n             * @param {Ext.EventObject} e\n             */\n            'groupdblclick',\n            /**\n             * @event containerclick\n             * Fires when the container is clicked. The container consists of any part of the grid body that is not covered by a row.\n             * @param {Grid} this\n             * @param {Ext.EventObject} e\n             */\n            'containerclick',\n            /**\n             * @event containerdblclick\n             * Fires when the container is double clicked. The container consists of any part of the grid body that is not covered by a row.\n             * @param {Grid} this\n             * @param {Ext.EventObject} e\n             */\n            'containerdblclick',\n\n            /**\n             * @event rowbodyclick\n             * Fires when the row body is clicked. <b>Only applies for grids with {@link Ext.grid.GridView#enableRowBody enableRowBody} configured.</b>\n             * @param {Grid} this\n             * @param {Number} rowIndex\n             * @param {Ext.EventObject} e\n             */\n            'rowbodyclick',\n            /**\n             * @event rowbodydblclick\n             * Fires when the row body is double clicked. <b>Only applies for grids with {@link Ext.grid.GridView#enableRowBody enableRowBody} configured.</b>\n             * @param {Grid} this\n             * @param {Number} rowIndex\n             * @param {Ext.EventObject} e\n             */\n            'rowbodydblclick',\n\n            /**\n             * @event rowcontextmenu\n             * Fires when a row is right clicked\n             * @param {Grid} this\n             * @param {Number} rowIndex\n             * @param {Ext.EventObject} e\n             */\n            'rowcontextmenu',\n            /**\n             * @event cellcontextmenu\n             * Fires when a cell is right clicked\n             * @param {Grid} this\n             * @param {Number} rowIndex\n             * @param {Number} cellIndex\n             * @param {Ext.EventObject} e\n             */\n            'cellcontextmenu',\n            /**\n             * @event headercontextmenu\n             * Fires when a header is right clicked\n             * @param {Grid} this\n             * @param {Number} columnIndex\n             * @param {Ext.EventObject} e\n             */\n            'headercontextmenu',\n            /**\n             * @event groupcontextmenu\n             * Fires when group header is right clicked. <b>Only applies for grids with a {@link Ext.grid.GroupingView GroupingView}</b>.\n             * @param {Grid} this\n             * @param {String} groupField\n             * @param {String} groupValue\n             * @param {Ext.EventObject} e\n             */\n            'groupcontextmenu',\n            /**\n             * @event containercontextmenu\n             * Fires when the container is right clicked. The container consists of any part of the grid body that is not covered by a row.\n             * @param {Grid} this\n             * @param {Ext.EventObject} e\n             */\n            'containercontextmenu',\n            /**\n             * @event rowbodycontextmenu\n             * Fires when the row body is right clicked. <b>Only applies for grids with {@link Ext.grid.GridView#enableRowBody enableRowBody} configured.</b>\n             * @param {Grid} this\n             * @param {Number} rowIndex\n             * @param {Ext.EventObject} e\n             */\n            'rowbodycontextmenu',\n            /**\n             * @event bodyscroll\n             * Fires when the body element is scrolled\n             * @param {Number} scrollLeft\n             * @param {Number} scrollTop\n             */\n            'bodyscroll',\n            /**\n             * @event columnresize\n             * Fires when the user resizes a column\n             * @param {Number} columnIndex\n             * @param {Number} newSize\n             */\n            'columnresize',\n            /**\n             * @event columnmove\n             * Fires when the user moves a column\n             * @param {Number} oldIndex\n             * @param {Number} newIndex\n             */\n            'columnmove',\n            /**\n             * @event sortchange\n             * Fires when the grid's store sort changes\n             * @param {Grid} this\n             * @param {Object} sortInfo An object with the keys field and direction\n             */\n            'sortchange',\n            /**\n             * @event groupchange\n             * Fires when the grid's grouping changes (only applies for grids with a {@link Ext.grid.GroupingView GroupingView})\n             * @param {Grid} this\n             * @param {String} groupField A string with the grouping field, null if the store is not grouped.\n             */\n            'groupchange',\n            /**\n             * @event reconfigure\n             * Fires when the grid is reconfigured with a new store and/or column model.\n             * @param {Grid} this\n             * @param {Ext.data.Store} store The new store\n             * @param {Ext.grid.ColumnModel} colModel The new column model\n             */\n            'reconfigure',\n            /**\n             * @event viewready\n             * Fires when the grid view is available (use this for selecting a default row).\n             * @param {Grid} this\n             */\n            'viewready'\n        );\n    },\n\n    // private\n    onRender : function(ct, position){\n        Ext.grid.GridPanel.superclass.onRender.apply(this, arguments);\n\n        var c = this.getGridEl();\n\n        this.el.addClass('x-grid-panel');\n\n        this.mon(c, {\n            scope: this,\n            mousedown: this.onMouseDown,\n            click: this.onClick,\n            dblclick: this.onDblClick,\n            contextmenu: this.onContextMenu\n        });\n\n        this.relayEvents(c, ['mousedown','mouseup','mouseover','mouseout','keypress', 'keydown']);\n\n        var view = this.getView();\n        view.init(this);\n        view.render();\n        this.getSelectionModel().init(this);\n    },\n\n    // private\n    initEvents : function(){\n        Ext.grid.GridPanel.superclass.initEvents.call(this);\n\n        if(this.loadMask){\n            this.loadMask = new Ext.LoadMask(this.bwrap,\n                    Ext.apply({store:this.store}, this.loadMask));\n        }\n    },\n\n    initStateEvents : function(){\n        Ext.grid.GridPanel.superclass.initStateEvents.call(this);\n        this.mon(this.colModel, 'hiddenchange', this.saveState, this, {delay: 100});\n    },\n\n    applyState : function(state){\n        var cm = this.colModel,\n            cs = state.columns,\n            store = this.store,\n            s,\n            c,\n            colIndex;\n\n        if(cs){\n            for(var i = 0, len = cs.length; i < len; i++){\n                s = cs[i];\n                c = cm.getColumnById(s.id);\n                if(c){\n                    colIndex = cm.getIndexById(s.id);\n                    cm.setState(colIndex, {\n                        hidden: s.hidden,\n                        width: s.width,\n                        sortable: c.sortable,\n                        editable: c.editable\n                    });\n                    if(colIndex != i){\n                        cm.moveColumn(colIndex, i);\n                    }\n                }\n            }\n        }\n        if(store){\n            s = state.sort;\n            if(s){\n                store[store.remoteSort ? 'setDefaultSort' : 'sort'](s.field, s.direction);\n            }\n            s = state.group;\n            if(store.groupBy){\n                if(s){\n                    store.groupBy(s);\n                }else{\n                    store.clearGrouping();\n                }\n            }\n\n        }\n        var o = Ext.apply({}, state);\n        delete o.columns;\n        delete o.sort;\n        Ext.grid.GridPanel.superclass.applyState.call(this, o);\n    },\n\n    getState : function(){\n        var o = {columns: []},\n            store = this.store,\n            ss,\n            gs;\n\n        for(var i = 0, c; (c = this.colModel.config[i]); i++){\n            o.columns[i] = {\n                id: c.id,\n                width: c.width\n            };\n            if(c.hidden){\n                o.columns[i].hidden = true;\n            }\n        }\n        if(store){\n            ss = store.getSortState();\n            if(ss){\n                o.sort = ss;\n            }\n            if(store.getGroupState){\n                gs = store.getGroupState();\n                if(gs){\n                    o.group = gs;\n                }\n            }\n        }\n        return o;\n    },\n\n    // private\n    afterRender : function(){\n        Ext.grid.GridPanel.superclass.afterRender.call(this);\n        var v = this.view;\n        this.on('bodyresize', v.layout, v);\n        v.layout(true);\n        if(this.deferRowRender){\n            if (!this.deferRowRenderTask){\n                this.deferRowRenderTask = new Ext.util.DelayedTask(v.afterRender, this.view);\n            }\n            this.deferRowRenderTask.delay(10);\n        }else{\n            v.afterRender();\n        }\n        this.viewReady = true;\n    },\n\n    /**\n     * <p>Reconfigures the grid to use a different Store and Column Model\n     * and fires the 'reconfigure' event. The View will be bound to the new\n     * objects and refreshed.</p>\n     * <p>Be aware that upon reconfiguring a GridPanel, certain existing settings <i>may</i> become\n     * invalidated. For example the configured {@link #autoExpandColumn} may no longer exist in the\n     * new ColumnModel. Also, an existing {@link Ext.PagingToolbar PagingToolbar} will still be bound\n     * to the old Store, and will need rebinding. Any {@link #plugins} might also need reconfiguring\n     * with the new data.</p>\n     * @param {Ext.data.Store} store The new {@link Ext.data.Store} object\n     * @param {Ext.grid.ColumnModel} colModel The new {@link Ext.grid.ColumnModel} object\n     */\n    reconfigure : function(store, colModel){\n        var rendered = this.rendered;\n        if(rendered){\n            if(this.loadMask){\n                this.loadMask.destroy();\n                this.loadMask = new Ext.LoadMask(this.bwrap,\n                        Ext.apply({}, {store:store}, this.initialConfig.loadMask));\n            }\n        }\n        if(this.view){\n            this.view.initData(store, colModel);\n        }\n        this.store = store;\n        this.colModel = colModel;\n        if(rendered){\n            this.view.refresh(true);\n        }\n        this.fireEvent('reconfigure', this, store, colModel);\n    },\n\n    // private\n    onDestroy : function(){\n        if (this.deferRowRenderTask && this.deferRowRenderTask.cancel){\n            this.deferRowRenderTask.cancel();\n        }\n        if(this.rendered){\n            Ext.destroy(this.view, this.loadMask);\n        }else if(this.store && this.store.autoDestroy){\n            this.store.destroy();\n        }\n        Ext.destroy(this.colModel, this.selModel);\n        this.store = this.selModel = this.colModel = this.view = this.loadMask = null;\n        Ext.grid.GridPanel.superclass.onDestroy.call(this);\n    },\n\n    // private\n    processEvent : function(name, e){\n        this.view.processEvent(name, e);\n    },\n\n    // private\n    onClick : function(e){\n        this.processEvent('click', e);\n    },\n\n    // private\n    onMouseDown : function(e){\n        this.processEvent('mousedown', e);\n    },\n\n    // private\n    onContextMenu : function(e, t){\n        this.processEvent('contextmenu', e);\n    },\n\n    // private\n    onDblClick : function(e){\n        this.processEvent('dblclick', e);\n    },\n\n    // private\n    walkCells : function(row, col, step, fn, scope){\n        var cm    = this.colModel,\n            clen  = cm.getColumnCount(),\n            ds    = this.store,\n            rlen  = ds.getCount(),\n            first = true;\n\n        if(step < 0){\n            if(col < 0){\n                row--;\n                first = false;\n            }\n            while(row >= 0){\n                if(!first){\n                    col = clen-1;\n                }\n                first = false;\n                while(col >= 0){\n                    if(fn.call(scope || this, row, col, cm) === true){\n                        return [row, col];\n                    }\n                    col--;\n                }\n                row--;\n            }\n        } else {\n            if(col >= clen){\n                row++;\n                first = false;\n            }\n            while(row < rlen){\n                if(!first){\n                    col = 0;\n                }\n                first = false;\n                while(col < clen){\n                    if(fn.call(scope || this, row, col, cm) === true){\n                        return [row, col];\n                    }\n                    col++;\n                }\n                row++;\n            }\n        }\n        return null;\n    },\n\n    /**\n     * Returns the grid's underlying element.\n     * @return {Element} The element\n     */\n    getGridEl : function(){\n        return this.body;\n    },\n\n    // private for compatibility, overridden by editor grid\n    stopEditing : Ext.emptyFn,\n\n    /**\n     * Returns the grid's selection model configured by the <code>{@link #selModel}</code>\n     * configuration option. If no selection model was configured, this will create\n     * and return a {@link Ext.grid.RowSelectionModel RowSelectionModel}.\n     * @return {SelectionModel}\n     */\n    getSelectionModel : function(){\n        if(!this.selModel){\n            this.selModel = new Ext.grid.RowSelectionModel(\n                    this.disableSelection ? {selectRow: Ext.emptyFn} : null);\n        }\n        return this.selModel;\n    },\n\n    /**\n     * Returns the grid's data store.\n     * @return {Ext.data.Store} The store\n     */\n    getStore : function(){\n        return this.store;\n    },\n\n    /**\n     * Returns the grid's ColumnModel.\n     * @return {Ext.grid.ColumnModel} The column model\n     */\n    getColumnModel : function(){\n        return this.colModel;\n    },\n\n    /**\n     * Returns the grid's GridView object.\n     * @return {Ext.grid.GridView} The grid view\n     */\n    getView : function() {\n        if (!this.view) {\n            this.view = new Ext.grid.GridView(this.viewConfig);\n        }\n        \n        return this.view;\n    },\n    /**\n     * Called to get grid's drag proxy text, by default returns this.ddText.\n     * @return {String} The text\n     */\n    getDragDropText : function(){\n        var count = this.selModel.getCount ? this.selModel.getCount() : 1;\n        return String.format(this.ddText, count, count == 1 ? '' : 's');\n    }\n\n    /**\n     * @cfg {String/Number} activeItem\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} autoDestroy\n     * @hide\n     */\n    /**\n     * @cfg {Object/String/Function} autoLoad\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} autoWidth\n     * @hide\n     */\n    /**\n     * @cfg {Boolean/Number} bufferResize\n     * @hide\n     */\n    /**\n     * @cfg {String} defaultType\n     * @hide\n     */\n    /**\n     * @cfg {Object} defaults\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} hideBorders\n     * @hide\n     */\n    /**\n     * @cfg {Mixed} items\n     * @hide\n     */\n    /**\n     * @cfg {String} layout\n     * @hide\n     */\n    /**\n     * @cfg {Object} layoutConfig\n     * @hide\n     */\n    /**\n     * @cfg {Boolean} monitorResize\n     * @hide\n     */\n    /**\n     * @property items\n     * @hide\n     */\n    /**\n     * @method add\n     * @hide\n     */\n    /**\n     * @method cascade\n     * @hide\n     */\n    /**\n     * @method doLayout\n     * @hide\n     */\n    /**\n     * @method find\n     * @hide\n     */\n    /**\n     * @method findBy\n     * @hide\n     */\n    /**\n     * @method findById\n     * @hide\n     */\n    /**\n     * @method findByType\n     * @hide\n     */\n    /**\n     * @method getComponent\n     * @hide\n     */\n    /**\n     * @method getLayout\n     * @hide\n     */\n    /**\n     * @method getUpdater\n     * @hide\n     */\n    /**\n     * @method insert\n     * @hide\n     */\n    /**\n     * @method load\n     * @hide\n     */\n    /**\n     * @method remove\n     * @hide\n     */\n    /**\n     * @event add\n     * @hide\n     */\n    /**\n     * @event afterlayout\n     * @hide\n     */\n    /**\n     * @event beforeadd\n     * @hide\n     */\n    /**\n     * @event beforeremove\n     * @hide\n     */\n    /**\n     * @event remove\n     * @hide\n     */\n\n\n\n    /**\n     * @cfg {String} allowDomMove  @hide\n     */\n    /**\n     * @cfg {String} autoEl @hide\n     */\n    /**\n     * @cfg {String} applyTo  @hide\n     */\n    /**\n     * @cfg {String} autoScroll  @hide\n     */\n    /**\n     * @cfg {String} bodyBorder  @hide\n     */\n    /**\n     * @cfg {String} bodyStyle  @hide\n     */\n    /**\n     * @cfg {String} contentEl  @hide\n     */\n    /**\n     * @cfg {String} disabledClass  @hide\n     */\n    /**\n     * @cfg {String} elements  @hide\n     */\n    /**\n     * @cfg {String} html  @hide\n     */\n    /**\n     * @cfg {Boolean} preventBodyReset\n     * @hide\n     */\n    /**\n     * @property disabled\n     * @hide\n     */\n    /**\n     * @method applyToMarkup\n     * @hide\n     */\n    /**\n     * @method enable\n     * @hide\n     */\n    /**\n     * @method disable\n     * @hide\n     */\n    /**\n     * @method setDisabled\n     * @hide\n     */\n});\nExt.reg('grid', Ext.grid.GridPanel);/**\n * @class Ext.grid.PivotGrid\n * @extends Ext.grid.GridPanel\n * <p>The PivotGrid component enables rapid summarization of large data sets. It provides a way to reduce a large set of\n * data down into a format where trends and insights become more apparent. A classic example is in sales data; a company\n * will often have a record of all sales it makes for a given period - this will often encompass thousands of rows of\n * data. The PivotGrid allows you to see how well each salesperson performed, which cities generate the most revenue, \n * how products perform between cities and so on.</p>\n * <p>A PivotGrid is composed of two axes (left and top), one {@link #measure} and one {@link #aggregator aggregation}\n * function. Each axis can contain one or more {@link #dimension}, which are ordered into a hierarchy. Dimensions on the \n * left axis can also specify a width. Each dimension in each axis can specify its sort ordering, defaulting to \"ASC\", \n * and must specify one of the fields in the {@link Ext.data.Record Record} used by the PivotGrid's \n * {@link Ext.data.Store Store}.</p>\n<pre><code>\n// This is the record representing a single sale\nvar SaleRecord = Ext.data.Record.create([\n    {name: 'person',   type: 'string'},\n    {name: 'product',  type: 'string'},\n    {name: 'city',     type: 'string'},\n    {name: 'state',    type: 'string'},\n    {name: 'year',     type: 'int'},\n    {name: 'value',    type: 'int'}\n]);\n\n// A simple store that loads SaleRecord data from a url\nvar myStore = new Ext.data.Store({\n    url: 'data.json',\n    autoLoad: true,\n    reader: new Ext.data.JsonReader({\n        root: 'rows',\n        idProperty: 'id'\n    }, SaleRecord)\n});\n\n// Create the PivotGrid itself, referencing the store\nvar pivot = new Ext.grid.PivotGrid({\n    store     : myStore,\n    aggregator: 'sum',\n    measure   : 'value',\n\n    leftAxis: [\n        {\n            width: 60,\n            dataIndex: 'product'\n        },\n        {\n            width: 120,\n            dataIndex: 'person',\n            direction: 'DESC'\n        }\n    ],\n\n    topAxis: [\n        {\n            dataIndex: 'year'\n        }\n    ]\n});\n</code></pre>\n * <p>The specified {@link #measure} is the field from SaleRecord that is extracted from each combination\n * of product and person (on the left axis) and year on the top axis. There may be several SaleRecords in the \n * data set that share this combination, so an array of measure fields is produced. This array is then \n * aggregated using the {@link #aggregator} function.</p>\n * <p>The default aggregator function is sum, which simply adds up all of the extracted measure values. Other\n * built-in aggregator functions are count, avg, min and max. In addition, you can specify your own function.\n * In this example we show the code used to sum the measures, but you can return any value you like. See\n * {@link #aggregator} for more details.</p>\n<pre><code>\nnew Ext.grid.PivotGrid({\n    aggregator: function(records, measure) {\n        var length = records.length,\n            total  = 0,\n            i;\n\n        for (i = 0; i < length; i++) {\n            total += records[i].get(measure);\n        }\n\n        return total;\n    },\n    \n    renderer: function(value) {\n        return Math.round(value);\n    },\n    \n    //your normal config here\n});\n</code></pre>\n * <p><u>Renderers</u></p>\n * <p>PivotGrid optionally accepts a {@link #renderer} function which can modify the data in each cell before it\n * is rendered. The renderer is passed the value that would usually be placed in the cell and is expected to return\n * the new value. For example let's imagine we had height data expressed as a decimal - here's how we might use a\n * renderer to display the data in feet and inches notation:</p>\n<pre><code>\nnew Ext.grid.PivotGrid({\n    //in each case the value is a decimal number of feet\n    renderer  : function(value) {\n        var feet   = Math.floor(value),\n            inches = Math.round((value - feet) * 12);\n\n        return String.format(\"{0}' {1}\\\"\", feet, inches);\n    },\n    //normal config here\n});\n</code></pre>\n * <p><u>Reconfiguring</u></p>\n * <p>All aspects PivotGrid's configuration can be updated at runtime. It is easy to change the {@link #setMeasure measure}, \n * {@link #setAggregator aggregation function}, {@link #setLeftAxis left} and {@link #setTopAxis top} axes and refresh the grid.</p>\n * <p>In this case we reconfigure the PivotGrid to have city and year as the top axis dimensions, rendering the average sale\n * value into the cells:</p>\n<pre><code>\n//the left axis can also be changed\npivot.topAxis.setDimensions([\n    {dataIndex: 'city', direction: 'DESC'},\n    {dataIndex: 'year', direction: 'ASC'}\n]);\n\npivot.setMeasure('value');\npivot.setAggregator('avg');\n\npivot.view.refresh(true);\n</code></pre>\n * <p>See the {@link Ext.grid.PivotAxis PivotAxis} documentation for further detail on reconfiguring axes.</p>\n */\nExt.grid.PivotGrid = Ext.extend(Ext.grid.GridPanel, {\n    \n    /**\n     * @cfg {String|Function} aggregator The aggregation function to use to combine the measures extracted\n     * for each dimension combination. Can be any of the built-in aggregators (sum, count, avg, min, max).\n     * Can also be a function which accepts two arguments (an array of Records to aggregate, and the measure \n     * to aggregate them on) and should return a String.\n     */\n    aggregator: 'sum',\n    \n    /**\n     * @cfg {Function} renderer Optional renderer to pass values through before they are rendered to the dom. This\n     * gives an opportunity to modify cell contents after the value has been computed.\n     */\n    renderer: undefined,\n    \n    /**\n     * @cfg {String} measure The field to extract from each Record when pivoting around the two axes. See the class\n     * introduction docs for usage\n     */\n    \n    /**\n     * @cfg {Array|Ext.grid.PivotAxis} leftAxis Either and array of {@link #dimension} to use on the left axis, or\n     * a {@link Ext.grid.PivotAxis} instance. If an array is passed, it is turned into a PivotAxis internally.\n     */\n    \n    /**\n     * @cfg {Array|Ext.grid.PivotAxis} topAxis Either and array of {@link #dimension} to use on the top axis, or\n     * a {@link Ext.grid.PivotAxis} instance. If an array is passed, it is turned into a PivotAxis internally.\n     */\n    \n    //inherit docs\n    initComponent: function() {\n        Ext.grid.PivotGrid.superclass.initComponent.apply(this, arguments);\n        \n        this.initAxes();\n        \n        //no resizing of columns is allowed yet in PivotGrid\n        this.enableColumnResize = false;\n        \n        this.viewConfig = Ext.apply(this.viewConfig || {}, {\n            forceFit: true\n        });\n        \n        //TODO: dummy col model that is never used - GridView is too tightly integrated with ColumnModel\n        //in 3.x to remove this altogether.\n        this.colModel = new Ext.grid.ColumnModel({});\n    },\n    \n    /**\n     * Returns the function currently used to aggregate the records in each Pivot cell\n     * @return {Function} The current aggregator function\n     */\n    getAggregator: function() {\n        if (typeof this.aggregator == 'string') {\n            return Ext.grid.PivotAggregatorMgr.types[this.aggregator];\n        } else {\n            return this.aggregator;\n        }\n    },\n    \n    /**\n     * Sets the function to use when aggregating data for each cell.\n     * @param {String|Function} aggregator The new aggregator function or named function string\n     */\n    setAggregator: function(aggregator) {\n        this.aggregator = aggregator;\n    },\n    \n    /**\n     * Sets the field name to use as the Measure in this Pivot Grid\n     * @param {String} measure The field to make the measure\n     */\n    setMeasure: function(measure) {\n        this.measure = measure;\n    },\n    \n    /**\n     * Sets the left axis of this pivot grid. Optionally refreshes the grid afterwards.\n     * @param {Ext.grid.PivotAxis} axis The pivot axis\n     * @param {Boolean} refresh True to immediately refresh the grid and its axes (defaults to false)\n     */\n    setLeftAxis: function(axis, refresh) {\n        /**\n         * The configured {@link Ext.grid.PivotAxis} used as the left Axis for this Pivot Grid\n         * @property leftAxis\n         * @type Ext.grid.PivotAxis\n         */\n        this.leftAxis = axis;\n        \n        if (refresh) {\n            this.view.refresh();\n        }\n    },\n    \n    /**\n     * Sets the top axis of this pivot grid. Optionally refreshes the grid afterwards.\n     * @param {Ext.grid.PivotAxis} axis The pivot axis\n     * @param {Boolean} refresh True to immediately refresh the grid and its axes (defaults to false)\n     */\n    setTopAxis: function(axis, refresh) {\n        /**\n         * The configured {@link Ext.grid.PivotAxis} used as the top Axis for this Pivot Grid\n         * @property topAxis\n         * @type Ext.grid.PivotAxis\n         */\n        this.topAxis = axis;\n        \n        if (refresh) {\n            this.view.refresh();\n        }\n    },\n    \n    /**\n     * @private\n     * Creates the top and left axes. Should usually only need to be called once from initComponent\n     */\n    initAxes: function() {\n        var PivotAxis = Ext.grid.PivotAxis;\n        \n        if (!(this.leftAxis instanceof PivotAxis)) {\n            this.setLeftAxis(new PivotAxis({\n                orientation: 'vertical',\n                dimensions : this.leftAxis || [],\n                store      : this.store\n            }));\n        };\n        \n        if (!(this.topAxis instanceof PivotAxis)) {\n            this.setTopAxis(new PivotAxis({\n                orientation: 'horizontal',\n                dimensions : this.topAxis || [],\n                store      : this.store\n            }));\n        };\n    },\n    \n    /**\n     * @private\n     * @return {Array} 2-dimensional array of cell data\n     */\n    extractData: function() {\n        var records  = this.store.data.items,\n            recCount = records.length,\n            cells    = [],\n            record, i, j, k;\n        \n        if (recCount == 0) {\n            return [];\n        }\n        \n        var leftTuples = this.leftAxis.getTuples(),\n            leftCount  = leftTuples.length,\n            topTuples  = this.topAxis.getTuples(),\n            topCount   = topTuples.length,\n            aggregator = this.getAggregator();\n        \n        for (i = 0; i < recCount; i++) {\n            record = records[i];\n            \n            for (j = 0; j < leftCount; j++) {\n                cells[j] = cells[j] || [];\n                \n                if (leftTuples[j].matcher(record) === true) {\n                    for (k = 0; k < topCount; k++) {\n                        cells[j][k] = cells[j][k] || [];\n                        \n                        if (topTuples[k].matcher(record)) {\n                            cells[j][k].push(record);\n                        }\n                    }\n                }\n            }\n        }\n        \n        var rowCount = cells.length,\n            colCount, row;\n        \n        for (i = 0; i < rowCount; i++) {\n            row = cells[i];\n            colCount = row.length;\n            \n            for (j = 0; j < colCount; j++) {\n                cells[i][j] = aggregator(cells[i][j], this.measure);\n            }\n        }\n        \n        return cells;\n    },\n    \n    /**\n     * Returns the grid's GridView object.\n     * @return {Ext.grid.PivotGridView} The grid view\n     */\n    getView: function() {\n        if (!this.view) {\n            this.view = new Ext.grid.PivotGridView(this.viewConfig);\n        }\n        \n        return this.view;\n    }\n});\n\nExt.reg('pivotgrid', Ext.grid.PivotGrid);\n\n\nExt.grid.PivotAggregatorMgr = new Ext.AbstractManager();\n\nExt.grid.PivotAggregatorMgr.registerType('sum', function(records, measure) {\n    var length = records.length,\n        total  = 0,\n        i;\n    \n    for (i = 0; i < length; i++) {\n        total += records[i].get(measure);\n    }\n    \n    return total;\n});\n\nExt.grid.PivotAggregatorMgr.registerType('avg', function(records, measure) {\n    var length = records.length,\n        total  = 0,\n        i;\n    \n    for (i = 0; i < length; i++) {\n        total += records[i].get(measure);\n    }\n    \n    return (total / length) || 'n/a';\n});\n\nExt.grid.PivotAggregatorMgr.registerType('min', function(records, measure) {\n    var data   = [],\n        length = records.length,\n        i;\n    \n    for (i = 0; i < length; i++) {\n        data.push(records[i].get(measure));\n    }\n    \n    return Math.min.apply(this, data) || 'n/a';\n});\n\nExt.grid.PivotAggregatorMgr.registerType('max', function(records, measure) {\n    var data   = [],\n        length = records.length,\n        i;\n    \n    for (i = 0; i < length; i++) {\n        data.push(records[i].get(measure));\n    }\n    \n    return Math.max.apply(this, data) || 'n/a';\n});\n\nExt.grid.PivotAggregatorMgr.registerType('count', function(records, measure) {\n    return records.length;\n});/**\n * @class Ext.grid.GridView\n * @extends Ext.util.Observable\n * <p>This class encapsulates the user interface of an {@link Ext.grid.GridPanel}.\n * Methods of this class may be used to access user interface elements to enable\n * special display effects. Do not change the DOM structure of the user interface.</p>\n * <p>This class does not provide ways to manipulate the underlying data. The data\n * model of a Grid is held in an {@link Ext.data.Store}.</p>\n * @constructor\n * @param {Object} config\n */\nExt.grid.GridView = Ext.extend(Ext.util.Observable, {\n    /**\n     * Override this function to apply custom CSS classes to rows during rendering.  You can also supply custom\n     * parameters to the row template for the current row to customize how it is rendered using the <b>rowParams</b>\n     * parameter.  This function should return the CSS class name (or empty string '' for none) that will be added\n     * to the row's wrapping div.  To apply multiple class names, simply return them space-delimited within the string\n     * (e.g., 'my-class another-class'). Example usage:\n    <pre><code>\nviewConfig: {\n    forceFit: true,\n    showPreview: true, // custom property\n    enableRowBody: true, // required to create a second, full-width row to show expanded Record data\n    getRowClass: function(record, rowIndex, rp, ds){ // rp = rowParams\n        if(this.showPreview){\n            rp.body = '&lt;p>'+record.data.excerpt+'&lt;/p>';\n            return 'x-grid3-row-expanded';\n        }\n        return 'x-grid3-row-collapsed';\n    }\n},\n    </code></pre>\n     * @param {Record} record The {@link Ext.data.Record} corresponding to the current row.\n     * @param {Number} index The row index.\n     * @param {Object} rowParams A config object that is passed to the row template during rendering that allows\n     * customization of various aspects of a grid row.\n     * <p>If {@link #enableRowBody} is configured <b><tt></tt>true</b>, then the following properties may be set\n     * by this function, and will be used to render a full-width expansion row below each grid row:</p>\n     * <ul>\n     * <li><code>body</code> : String <div class=\"sub-desc\">An HTML fragment to be used as the expansion row's body content (defaults to '').</div></li>\n     * <li><code>bodyStyle</code> : String <div class=\"sub-desc\">A CSS style specification that will be applied to the expansion row's &lt;tr> element. (defaults to '').</div></li>\n     * </ul>\n     * The following property will be passed in, and may be appended to:\n     * <ul>\n     * <li><code>tstyle</code> : String <div class=\"sub-desc\">A CSS style specification that willl be applied to the &lt;table> element which encapsulates\n     * both the standard grid row, and any expansion row.</div></li>\n     * </ul>\n     * @param {Store} store The {@link Ext.data.Store} this grid is bound to\n     * @method getRowClass\n     * @return {String} a CSS class name to add to the row.\n     */\n\n    /**\n     * @cfg {Boolean} enableRowBody True to add a second TR element per row that can be used to provide a row body\n     * that spans beneath the data row.  Use the {@link #getRowClass} method's rowParams config to customize the row body.\n     */\n\n    /**\n     * @cfg {String} emptyText Default text (html tags are accepted) to display in the grid body when no rows\n     * are available (defaults to ''). This value will be used to update the <tt>{@link #mainBody}</tt>:\n    <pre><code>\n    this.mainBody.update('&lt;div class=\"x-grid-empty\">' + this.emptyText + '&lt;/div>');\n    </code></pre>\n     */\n\n    /**\n     * @cfg {Boolean} headersDisabled True to disable the grid column headers (defaults to <tt>false</tt>).\n     * Use the {@link Ext.grid.ColumnModel ColumnModel} <tt>{@link Ext.grid.ColumnModel#menuDisabled menuDisabled}</tt>\n     * config to disable the <i>menu</i> for individual columns.  While this config is true the\n     * following will be disabled:<div class=\"mdetail-params\"><ul>\n     * <li>clicking on header to sort</li>\n     * <li>the trigger to reveal the menu.</li>\n     * </ul></div>\n     */\n\n    /**\n     * <p>A customized implementation of a {@link Ext.dd.DragZone DragZone} which provides default implementations\n     * of the template methods of DragZone to enable dragging of the selected rows of a GridPanel.\n     * See {@link Ext.grid.GridDragZone} for details.</p>\n     * <p>This will <b>only</b> be present:<div class=\"mdetail-params\"><ul>\n     * <li><i>if</i> the owning GridPanel was configured with {@link Ext.grid.GridPanel#enableDragDrop enableDragDrop}: <tt>true</tt>.</li>\n     * <li><i>after</i> the owning GridPanel has been rendered.</li>\n     * </ul></div>\n     * @property dragZone\n     * @type {Ext.grid.GridDragZone}\n     */\n\n    /**\n     * @cfg {Boolean} deferEmptyText True to defer <tt>{@link #emptyText}</tt> being applied until the store's\n     * first load (defaults to <tt>true</tt>).\n     */\n    deferEmptyText : true,\n\n    /**\n     * @cfg {Number} scrollOffset The amount of space to reserve for the vertical scrollbar\n     * (defaults to <tt>undefined</tt>). If an explicit value isn't specified, this will be automatically\n     * calculated.\n     */\n    scrollOffset : undefined,\n\n    /**\n     * @cfg {Boolean} autoFill\n     * Defaults to <tt>false</tt>.  Specify <tt>true</tt> to have the column widths re-proportioned\n     * when the grid is <b>initially rendered</b>.  The\n     * {@link Ext.grid.Column#width initially configured width}</tt> of each column will be adjusted\n     * to fit the grid width and prevent horizontal scrolling. If columns are later resized (manually\n     * or programmatically), the other columns in the grid will <b>not</b> be resized to fit the grid width.\n     * See <tt>{@link #forceFit}</tt> also.\n     */\n    autoFill : false,\n\n    /**\n     * @cfg {Boolean} forceFit\n     * <p>Defaults to <tt>false</tt>.  Specify <tt>true</tt> to have the column widths re-proportioned\n     * at <b>all times</b>.</p>\n     * <p>The {@link Ext.grid.Column#width initially configured width}</tt> of each\n     * column will be adjusted to fit the grid width and prevent horizontal scrolling. If columns are\n     * later resized (manually or programmatically), the other columns in the grid <b>will</b> be resized\n     * to fit the grid width.</p>\n     * <p>Columns which are configured with <code>fixed: true</code> are omitted from being resized.</p>\n     * <p>See <tt>{@link #autoFill}</tt>.</p>\n     */\n    forceFit : false,\n\n    /**\n     * @cfg {Array} sortClasses The CSS classes applied to a header when it is sorted. (defaults to <tt>['sort-asc', 'sort-desc']</tt>)\n     */\n    sortClasses : ['sort-asc', 'sort-desc'],\n\n    /**\n     * @cfg {String} sortAscText The text displayed in the 'Sort Ascending' menu item (defaults to <tt>'Sort Ascending'</tt>)\n     */\n    sortAscText : 'Sort Ascending',\n\n    /**\n     * @cfg {String} sortDescText The text displayed in the 'Sort Descending' menu item (defaults to <tt>'Sort Descending'</tt>)\n     */\n    sortDescText : 'Sort Descending',\n    \n    /**\n     * @cfg {Boolean} hideSortIcons True to hide the sorting icons if sorting is disabled for a column. Defaults to <tt>false</tt>\n     */\n    hideSortIcons: false,\n\n    /**\n     * @cfg {String} columnsText The text displayed in the 'Columns' menu item (defaults to <tt>'Columns'</tt>)\n     */\n    columnsText : 'Columns',\n\n    /**\n     * @cfg {String} selectedRowClass The CSS class applied to a selected row (defaults to <tt>'x-grid3-row-selected'</tt>). An\n     * example overriding the default styling:\n    <pre><code>\n    .x-grid3-row-selected {background-color: yellow;}\n    </code></pre>\n     * Note that this only controls the row, and will not do anything for the text inside it.  To style inner\n     * facets (like text) use something like:\n    <pre><code>\n    .x-grid3-row-selected .x-grid3-cell-inner {\n        color: #FFCC00;\n    }\n    </code></pre>\n     * @type String\n     */\n    selectedRowClass : 'x-grid3-row-selected',\n\n    // private\n    borderWidth : 2,\n    tdClass : 'x-grid3-cell',\n    hdCls : 'x-grid3-hd',\n    \n    \n    /**\n     * @cfg {Boolean} markDirty True to show the dirty cell indicator when a cell has been modified. Defaults to <tt>true</tt>.\n     */\n    markDirty : true,\n\n    /**\n     * @cfg {Number} cellSelectorDepth The number of levels to search for cells in event delegation (defaults to <tt>4</tt>)\n     */\n    cellSelectorDepth : 4,\n    \n    /**\n     * @cfg {Number} rowSelectorDepth The number of levels to search for rows in event delegation (defaults to <tt>10</tt>)\n     */\n    rowSelectorDepth : 10,\n\n    /**\n     * @cfg {Number} rowBodySelectorDepth The number of levels to search for row bodies in event delegation (defaults to <tt>10</tt>)\n     */\n    rowBodySelectorDepth : 10,\n\n    /**\n     * @cfg {String} cellSelector The selector used to find cells internally (defaults to <tt>'td.x-grid3-cell'</tt>)\n     */\n    cellSelector : 'td.x-grid3-cell',\n    \n    /**\n     * @cfg {String} rowSelector The selector used to find rows internally (defaults to <tt>'div.x-grid3-row'</tt>)\n     */\n    rowSelector : 'div.x-grid3-row',\n\n    /**\n     * @cfg {String} rowBodySelector The selector used to find row bodies internally (defaults to <tt>'div.x-grid3-row'</tt>)\n     */\n    rowBodySelector : 'div.x-grid3-row-body',\n\n    // private\n    firstRowCls: 'x-grid3-row-first',\n    lastRowCls: 'x-grid3-row-last',\n    rowClsRe: /(?:^|\\s+)x-grid3-row-(first|last|alt)(?:\\s+|$)/g,\n    \n    /**\n     * @cfg {String} headerMenuOpenCls The CSS class to add to the header cell when its menu is visible. Defaults to 'x-grid3-hd-menu-open'\n     */\n    headerMenuOpenCls: 'x-grid3-hd-menu-open',\n    \n    /**\n     * @cfg {String} rowOverCls The CSS class added to each row when it is hovered over. Defaults to 'x-grid3-row-over'\n     */\n    rowOverCls: 'x-grid3-row-over',\n\n    constructor : function(config) {\n        Ext.apply(this, config);\n        \n        // These events are only used internally by the grid components\n        this.addEvents(\n            /**\n             * @event beforerowremoved\n             * Internal UI Event. Fired before a row is removed.\n             * @param {Ext.grid.GridView} view\n             * @param {Number} rowIndex The index of the row to be removed.\n             * @param {Ext.data.Record} record The Record to be removed\n             */\n            'beforerowremoved',\n            \n            /**\n             * @event beforerowsinserted\n             * Internal UI Event. Fired before rows are inserted.\n             * @param {Ext.grid.GridView} view\n             * @param {Number} firstRow The index of the first row to be inserted.\n             * @param {Number} lastRow The index of the last row to be inserted.\n             */\n            'beforerowsinserted',\n            \n            /**\n             * @event beforerefresh\n             * Internal UI Event. Fired before the view is refreshed.\n             * @param {Ext.grid.GridView} view\n             */\n            'beforerefresh',\n            \n            /**\n             * @event rowremoved\n             * Internal UI Event. Fired after a row is removed.\n             * @param {Ext.grid.GridView} view\n             * @param {Number} rowIndex The index of the row that was removed.\n             * @param {Ext.data.Record} record The Record that was removed\n             */\n            'rowremoved',\n            \n            /**\n             * @event rowsinserted\n             * Internal UI Event. Fired after rows are inserted.\n             * @param {Ext.grid.GridView} view\n             * @param {Number} firstRow The index of the first inserted.\n             * @param {Number} lastRow The index of the last row inserted.\n             */\n            'rowsinserted',\n            \n            /**\n             * @event rowupdated\n             * Internal UI Event. Fired after a row has been updated.\n             * @param {Ext.grid.GridView} view\n             * @param {Number} firstRow The index of the row updated.\n             * @param {Ext.data.record} record The Record backing the row updated.\n             */\n            'rowupdated',\n            \n            /**\n             * @event refresh\n             * Internal UI Event. Fired after the GridView's body has been refreshed.\n             * @param {Ext.grid.GridView} view\n             */\n            'refresh'\n        );\n        \n        Ext.grid.GridView.superclass.constructor.call(this);\n    },\n\n    /* -------------------------------- UI Specific ----------------------------- */\n    \n    /**\n     * The master template to use when rendering the GridView. Has a default template\n     * @property Ext.Template\n     * @type masterTpl\n     */\n    masterTpl: new Ext.Template(\n        '<div class=\"x-grid3\" hidefocus=\"true\">',\n            '<div class=\"x-grid3-viewport\">',\n                '<div class=\"x-grid3-header\">',\n                    '<div class=\"x-grid3-header-inner\">',\n                        '<div class=\"x-grid3-header-offset\" style=\"{ostyle}\">{header}</div>',\n                    '</div>',\n                    '<div class=\"x-clear\"></div>',\n                '</div>',\n                '<div class=\"x-grid3-scroller\">',\n                    '<div class=\"x-grid3-body\" style=\"{bstyle}\">{body}</div>',\n                    '<a href=\"#\" class=\"x-grid3-focus\" tabIndex=\"-1\"></a>',\n                '</div>',\n            '</div>',\n            '<div class=\"x-grid3-resize-marker\">&#160;</div>',\n            '<div class=\"x-grid3-resize-proxy\">&#160;</div>',\n        '</div>'\n    ),\n    \n    /**\n     * The template to use when rendering headers. Has a default template\n     * @property headerTpl\n     * @type Ext.Template\n     */\n    headerTpl: new Ext.Template(\n        '<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\" style=\"{tstyle}\">',\n            '<thead>',\n                '<tr class=\"x-grid3-hd-row\">{cells}</tr>',\n            '</thead>',\n        '</table>'\n    ),\n    \n    /**\n     * The template to use when rendering the body. Has a default template\n     * @property bodyTpl\n     * @type Ext.Template\n     */\n    bodyTpl: new Ext.Template('{rows}'),\n    \n    /**\n     * The template to use to render each cell. Has a default template\n     * @property cellTpl\n     * @type Ext.Template\n     */\n    cellTpl: new Ext.Template(\n        '<td class=\"x-grid3-col x-grid3-cell x-grid3-td-{id} {css}\" style=\"{style}\" tabIndex=\"0\" {cellAttr}>',\n            '<div class=\"x-grid3-cell-inner x-grid3-col-{id} x-unselectable\" unselectable=\"on\" {attr}>{value}</div>',\n        '</td>'\n    ),\n    \n    /**\n     * @private\n     * Provides default templates if they are not given for this particular instance. Most of the templates are defined on\n     * the prototype, the ones defined inside this function are done so because they are based on Grid or GridView configuration\n     */\n    initTemplates : function() {\n        var templates = this.templates || {},\n            template, name,\n            \n            headerCellTpl = new Ext.Template(\n                '<td class=\"x-grid3-hd x-grid3-cell x-grid3-td-{id} {css}\" style=\"{style}\">',\n                    '<div {tooltip} {attr} class=\"x-grid3-hd-inner x-grid3-hd-{id}\" unselectable=\"on\" style=\"{istyle}\">', \n                        this.grid.enableHdMenu ? '<a class=\"x-grid3-hd-btn\" href=\"#\"></a>' : '',\n                        '{value}',\n                        '<img alt=\"\" class=\"x-grid3-sort-icon\" src=\"', Ext.BLANK_IMAGE_URL, '\" />',\n                    '</div>',\n                '</td>'\n            ),\n        \n            rowBodyText = [\n                '<tr class=\"x-grid3-row-body-tr\" style=\"{bodyStyle}\">',\n                    '<td colspan=\"{cols}\" class=\"x-grid3-body-cell\" tabIndex=\"0\" hidefocus=\"on\">',\n                        '<div class=\"x-grid3-row-body\">{body}</div>',\n                    '</td>',\n                '</tr>'\n            ].join(\"\"),\n        \n            innerText = [\n                '<table class=\"x-grid3-row-table\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\" style=\"{tstyle}\">',\n                     '<tbody>',\n                        '<tr>{cells}</tr>',\n                        this.enableRowBody ? rowBodyText : '',\n                     '</tbody>',\n                '</table>'\n            ].join(\"\");\n        \n        Ext.applyIf(templates, {\n            hcell   : headerCellTpl,\n            cell    : this.cellTpl,\n            body    : this.bodyTpl,\n            header  : this.headerTpl,\n            master  : this.masterTpl,\n            row     : new Ext.Template('<div class=\"x-grid3-row {alt}\" style=\"{tstyle}\">' + innerText + '</div>'),\n            rowInner: new Ext.Template(innerText)\n        });\n\n        for (name in templates) {\n            template = templates[name];\n            \n            if (template && Ext.isFunction(template.compile) && !template.compiled) {\n                template.disableFormats = true;\n                template.compile();\n            }\n        }\n\n        this.templates = templates;\n        this.colRe = new RegExp('x-grid3-td-([^\\\\s]+)', '');\n    },\n\n    /**\n     * @private\n     * Each GridView has its own private flyweight, accessed through this method\n     */\n    fly : function(el) {\n        if (!this._flyweight) {\n            this._flyweight = new Ext.Element.Flyweight(document.body);\n        }\n        this._flyweight.dom = el;\n        return this._flyweight;\n    },\n\n    // private\n    getEditorParent : function() {\n        return this.scroller.dom;\n    },\n\n    /**\n     * @private\n     * Finds and stores references to important elements\n     */\n    initElements : function() {\n        var Element  = Ext.Element,\n            el       = Ext.get(this.grid.getGridEl().dom.firstChild),\n            mainWrap = new Element(el.child('div.x-grid3-viewport')),\n            mainHd   = new Element(mainWrap.child('div.x-grid3-header')),\n            scroller = new Element(mainWrap.child('div.x-grid3-scroller'));\n        \n        if (this.grid.hideHeaders) {\n            mainHd.setDisplayed(false);\n        }\n        \n        if (this.forceFit) {\n            scroller.setStyle('overflow-x', 'hidden');\n        }\n        \n        /**\n         * <i>Read-only</i>. The GridView's body Element which encapsulates all rows in the Grid.\n         * This {@link Ext.Element Element} is only available after the GridPanel has been rendered.\n         * @type Ext.Element\n         * @property mainBody\n         */\n        \n        Ext.apply(this, {\n            el      : el,\n            mainWrap: mainWrap,\n            scroller: scroller,\n            mainHd  : mainHd,\n            innerHd : mainHd.child('div.x-grid3-header-inner').dom,\n            mainBody: new Element(Element.fly(scroller).child('div.x-grid3-body')),\n            focusEl : new Element(Element.fly(scroller).child('a')),\n            \n            resizeMarker: new Element(el.child('div.x-grid3-resize-marker')),\n            resizeProxy : new Element(el.child('div.x-grid3-resize-proxy'))\n        });\n        \n        this.focusEl.swallowEvent('click', true);\n    },\n\n    // private\n    getRows : function() {\n        return this.hasRows() ? this.mainBody.dom.childNodes : [];\n    },\n\n    // finder methods, used with delegation\n\n    // private\n    findCell : function(el) {\n        if (!el) {\n            return false;\n        }\n        return this.fly(el).findParent(this.cellSelector, this.cellSelectorDepth);\n    },\n\n    /**\n     * <p>Return the index of the grid column which contains the passed HTMLElement.</p>\n     * See also {@link #findRowIndex}\n     * @param {HTMLElement} el The target element\n     * @return {Number} The column index, or <b>false</b> if the target element is not within a row of this GridView.\n     */\n    findCellIndex : function(el, requiredCls) {\n        var cell = this.findCell(el),\n            hasCls;\n        \n        if (cell) {\n            hasCls = this.fly(cell).hasClass(requiredCls);\n            if (!requiredCls || hasCls) {\n                return this.getCellIndex(cell);\n            }\n        }\n        return false;\n    },\n\n    // private\n    getCellIndex : function(el) {\n        if (el) {\n            var match = el.className.match(this.colRe);\n            \n            if (match && match[1]) {\n                return this.cm.getIndexById(match[1]);\n            }\n        }\n        return false;\n    },\n\n    // private\n    findHeaderCell : function(el) {\n        var cell = this.findCell(el);\n        return cell && this.fly(cell).hasClass(this.hdCls) ? cell : null;\n    },\n\n    // private\n    findHeaderIndex : function(el){\n        return this.findCellIndex(el, this.hdCls);\n    },\n\n    /**\n     * Return the HtmlElement representing the grid row which contains the passed element.\n     * @param {HTMLElement} el The target HTMLElement\n     * @return {HTMLElement} The row element, or null if the target element is not within a row of this GridView.\n     */\n    findRow : function(el) {\n        if (!el) {\n            return false;\n        }\n        return this.fly(el).findParent(this.rowSelector, this.rowSelectorDepth);\n    },\n\n    /**\n     * Return the index of the grid row which contains the passed HTMLElement.\n     * See also {@link #findCellIndex}\n     * @param {HTMLElement} el The target HTMLElement\n     * @return {Number} The row index, or <b>false</b> if the target element is not within a row of this GridView.\n     */\n    findRowIndex : function(el) {\n        var row = this.findRow(el);\n        return row ? row.rowIndex : false;\n    },\n\n    /**\n     * Return the HtmlElement representing the grid row body which contains the passed element.\n     * @param {HTMLElement} el The target HTMLElement\n     * @return {HTMLElement} The row body element, or null if the target element is not within a row body of this GridView.\n     */\n    findRowBody : function(el) {\n        if (!el) {\n            return false;\n        }\n        \n        return this.fly(el).findParent(this.rowBodySelector, this.rowBodySelectorDepth);\n    },\n\n    // getter methods for fetching elements dynamically in the grid\n\n    /**\n     * Return the <tt>&lt;div></tt> HtmlElement which represents a Grid row for the specified index.\n     * @param {Number} index The row index\n     * @return {HtmlElement} The div element.\n     */\n    getRow : function(row) {\n        return this.getRows()[row];\n    },\n\n    /**\n     * Returns the grid's <tt>&lt;td></tt> HtmlElement at the specified coordinates.\n     * @param {Number} row The row index in which to find the cell.\n     * @param {Number} col The column index of the cell.\n     * @return {HtmlElement} The td at the specified coordinates.\n     */\n    getCell : function(row, col) {\n        return Ext.fly(this.getRow(row)).query(this.cellSelector)[col]; \n    },\n\n    /**\n     * Return the <tt>&lt;td></tt> HtmlElement which represents the Grid's header cell for the specified column index.\n     * @param {Number} index The column index\n     * @return {HtmlElement} The td element.\n     */\n    getHeaderCell : function(index) {\n        return this.mainHd.dom.getElementsByTagName('td')[index];\n    },\n\n    // manipulating elements\n\n    // private - use getRowClass to apply custom row classes\n    addRowClass : function(rowId, cls) {\n        var row = this.getRow(rowId);\n        if (row) {\n            this.fly(row).addClass(cls);\n        }\n    },\n\n    // private\n    removeRowClass : function(row, cls) {\n        var r = this.getRow(row);\n        if(r){\n            this.fly(r).removeClass(cls);\n        }\n    },\n\n    // private\n    removeRow : function(row) {\n        Ext.removeNode(this.getRow(row));\n        this.syncFocusEl(row);\n    },\n\n    // private\n    removeRows : function(firstRow, lastRow) {\n        var bd = this.mainBody.dom,\n            rowIndex;\n            \n        for (rowIndex = firstRow; rowIndex <= lastRow; rowIndex++){\n            Ext.removeNode(bd.childNodes[firstRow]);\n        }\n        \n        this.syncFocusEl(firstRow);\n    },\n\n    /* ----------------------------------- Scrolling functions -------------------------------------------*/\n    \n    // private\n    getScrollState : function() {\n        var sb = this.scroller.dom;\n        \n        return {\n            left: sb.scrollLeft, \n            top : sb.scrollTop\n        };\n    },\n\n    // private\n    restoreScroll : function(state) {\n        var sb = this.scroller.dom;\n        sb.scrollLeft = state.left;\n        sb.scrollTop  = state.top;\n    },\n\n    /**\n     * Scrolls the grid to the top\n     */\n    scrollToTop : function() {\n        var dom = this.scroller.dom;\n        \n        dom.scrollTop  = 0;\n        dom.scrollLeft = 0;\n    },\n\n    // private\n    syncScroll : function() {\n        this.syncHeaderScroll();\n        var mb = this.scroller.dom;\n        this.grid.fireEvent('bodyscroll', mb.scrollLeft, mb.scrollTop);\n    },\n\n    // private\n    syncHeaderScroll : function() {\n        var innerHd    = this.innerHd,\n            scrollLeft = this.scroller.dom.scrollLeft;\n        \n        innerHd.scrollLeft = scrollLeft;\n        innerHd.scrollLeft = scrollLeft; // second time for IE (1/2 time first fails, other browsers ignore)\n    },\n    \n    /**\n     * @private\n     * Ensures the given column has the given icon class\n     */\n    updateSortIcon : function(col, dir) {\n        var sortClasses = this.sortClasses,\n            sortClass   = sortClasses[dir == \"DESC\" ? 1 : 0],\n            headers     = this.mainHd.select('td').removeClass(sortClasses);\n        \n        headers.item(col).addClass(sortClass);\n    },\n\n    /**\n     * @private\n     * Updates the size of every column and cell in the grid\n     */\n    updateAllColumnWidths : function() {\n        var totalWidth = this.getTotalWidth(),\n            colCount   = this.cm.getColumnCount(),\n            rows       = this.getRows(),\n            rowCount   = rows.length,\n            widths     = [],\n            row, rowFirstChild, trow, i, j;\n        \n        for (i = 0; i < colCount; i++) {\n            widths[i] = this.getColumnWidth(i);\n            this.getHeaderCell(i).style.width = widths[i];\n        }\n        \n        this.updateHeaderWidth();\n        \n        for (i = 0; i < rowCount; i++) {\n            row = rows[i];\n            row.style.width = totalWidth;\n            rowFirstChild = row.firstChild;\n            \n            if (rowFirstChild) {\n                rowFirstChild.style.width = totalWidth;\n                trow = rowFirstChild.rows[0];\n                \n                for (j = 0; j < colCount; j++) {\n                    trow.childNodes[j].style.width = widths[j];\n                }\n            }\n        }\n        \n        this.onAllColumnWidthsUpdated(widths, totalWidth);\n    },\n\n    /**\n     * @private\n     * Called after a column's width has been updated, this resizes all of the cells for that column in each row\n     * @param {Number} column The column index\n     */\n    updateColumnWidth : function(column, width) {\n        var columnWidth = this.getColumnWidth(column),\n            totalWidth  = this.getTotalWidth(),\n            headerCell  = this.getHeaderCell(column),\n            nodes       = this.getRows(),\n            nodeCount   = nodes.length,\n            row, i, firstChild;\n        \n        this.updateHeaderWidth();\n        headerCell.style.width = columnWidth;\n        \n        for (i = 0; i < nodeCount; i++) {\n            row = nodes[i];\n            firstChild = row.firstChild;\n            \n            row.style.width = totalWidth;\n            if (firstChild) {\n                firstChild.style.width = totalWidth;\n                firstChild.rows[0].childNodes[column].style.width = columnWidth;\n            }\n        }\n        \n        this.onColumnWidthUpdated(column, columnWidth, totalWidth);\n    },\n    \n    /**\n     * @private\n     * Sets the hidden status of a given column.\n     * @param {Number} col The column index\n     * @param {Boolean} hidden True to make the column hidden\n     */\n    updateColumnHidden : function(col, hidden) {\n        var totalWidth = this.getTotalWidth(),\n            display    = hidden ? 'none' : '',\n            headerCell = this.getHeaderCell(col),\n            nodes      = this.getRows(),\n            nodeCount  = nodes.length,\n            row, rowFirstChild, i;\n        \n        this.updateHeaderWidth();\n        headerCell.style.display = display;\n        \n        for (i = 0; i < nodeCount; i++) {\n            row = nodes[i];\n            row.style.width = totalWidth;\n            rowFirstChild = row.firstChild;\n            \n            if (rowFirstChild) {\n                rowFirstChild.style.width = totalWidth;\n                rowFirstChild.rows[0].childNodes[col].style.display = display;\n            }\n        }\n        \n        this.onColumnHiddenUpdated(col, hidden, totalWidth);\n        delete this.lastViewWidth; //recalc\n        this.layout();\n    },\n\n    /**\n     * @private\n     * Renders all of the rows to a string buffer and returns the string. This is called internally\n     * by renderRows and performs the actual string building for the rows - it does not inject HTML into the DOM.\n     * @param {Array} columns The column data acquired from getColumnData.\n     * @param {Array} records The array of records to render\n     * @param {Ext.data.Store} store The store to render the rows from\n     * @param {Number} startRow The index of the first row being rendered. Sometimes we only render a subset of\n     * the rows so this is used to maintain logic for striping etc\n     * @param {Number} colCount The total number of columns in the column model\n     * @param {Boolean} stripe True to stripe the rows\n     * @return {String} A string containing the HTML for the rendered rows\n     */\n    doRender : function(columns, records, store, startRow, colCount, stripe) {\n        var templates = this.templates,\n            cellTemplate = templates.cell,\n            rowTemplate = templates.row,\n            last = colCount - 1,\n            tstyle = 'width:' + this.getTotalWidth() + ';',\n            // buffers\n            rowBuffer = [],\n            colBuffer = [],\n            rowParams = {tstyle: tstyle},\n            meta = {},\n            len  = records.length,\n            alt,\n            column,\n            record, i, j, rowIndex;\n\n        //build up each row's HTML\n        for (j = 0; j < len; j++) {\n            record    = records[j];\n            colBuffer = [];\n\n            rowIndex = j + startRow;\n\n            //build up each column's HTML\n            for (i = 0; i < colCount; i++) {\n                column = columns[i];\n                \n                meta.id    = column.id;\n                meta.css   = i === 0 ? 'x-grid3-cell-first ' : (i == last ? 'x-grid3-cell-last ' : '');\n                meta.attr  = meta.cellAttr = '';\n                meta.style = column.style;\n                meta.value = column.renderer.call(column.scope, record.data[column.name], meta, record, rowIndex, i, store);\n\n                if (Ext.isEmpty(meta.value)) {\n                    meta.value = '&#160;';\n                }\n\n                if (this.markDirty && record.dirty && typeof record.modified[column.name] != 'undefined') {\n                    meta.css += ' x-grid3-dirty-cell';\n                }\n\n                colBuffer[colBuffer.length] = cellTemplate.apply(meta);\n            }\n\n            alt = [];\n            //set up row striping and row dirtiness CSS classes\n            if (stripe && ((rowIndex + 1) % 2 === 0)) {\n                alt[0] = 'x-grid3-row-alt';\n            }\n\n            if (record.dirty) {\n                alt[1] = ' x-grid3-dirty-row';\n            }\n\n            rowParams.cols = colCount;\n\n            if (this.getRowClass) {\n                alt[2] = this.getRowClass(record, rowIndex, rowParams, store);\n            }\n\n            rowParams.alt   = alt.join(' ');\n            rowParams.cells = colBuffer.join('');\n\n            rowBuffer[rowBuffer.length] = rowTemplate.apply(rowParams);\n        }\n\n        return rowBuffer.join('');\n    },\n\n    /**\n     * @private\n     * Adds CSS classes and rowIndex to each row\n     * @param {Number} startRow The row to start from (defaults to 0)\n     */\n    processRows : function(startRow, skipStripe) {\n        if (!this.ds || this.ds.getCount() < 1) {\n            return;\n        }\n\n        var rows   = this.getRows(),\n            length = rows.length,\n            row, i;\n\n        skipStripe = skipStripe || !this.grid.stripeRows;\n        startRow   = startRow   || 0;\n\n        for (i = 0; i < length; i++) {\n            row = rows[i];\n            if (row) {\n                row.rowIndex = i;\n                if (!skipStripe) {\n                    row.className = row.className.replace(this.rowClsRe, ' ');\n                    if ((i + 1) % 2 === 0){\n                        row.className += ' x-grid3-row-alt';\n                    }\n                }\n            }\n        }\n\n        // add first/last-row classes\n        if (startRow === 0) {\n            Ext.fly(rows[0]).addClass(this.firstRowCls);\n        }\n\n        Ext.fly(rows[length - 1]).addClass(this.lastRowCls);\n    },\n    \n    /**\n     * @private\n     */\n    afterRender : function() {\n        if (!this.ds || !this.cm) {\n            return;\n        }\n        \n        this.mainBody.dom.innerHTML = this.renderBody() || '&#160;';\n        this.processRows(0, true);\n\n        if (this.deferEmptyText !== true) {\n            this.applyEmptyText();\n        }\n        \n        this.grid.fireEvent('viewready', this.grid);\n    },\n    \n    /**\n     * @private\n     * This is always intended to be called after renderUI. Sets up listeners on the UI elements\n     * and sets up options like column menus, moving and resizing.\n     */\n    afterRenderUI: function() {\n        var grid = this.grid;\n        \n        this.initElements();\n\n        // get mousedowns early\n        Ext.fly(this.innerHd).on('click', this.handleHdDown, this);\n\n        this.mainHd.on({\n            scope    : this,\n            mouseover: this.handleHdOver,\n            mouseout : this.handleHdOut,\n            mousemove: this.handleHdMove\n        });\n\n        this.scroller.on('scroll', this.syncScroll,  this);\n        \n        if (grid.enableColumnResize !== false) {\n            this.splitZone = new Ext.grid.GridView.SplitDragZone(grid, this.mainHd.dom);\n        }\n\n        if (grid.enableColumnMove) {\n            this.columnDrag = new Ext.grid.GridView.ColumnDragZone(grid, this.innerHd);\n            this.columnDrop = new Ext.grid.HeaderDropZone(grid, this.mainHd.dom);\n        }\n\n        if (grid.enableHdMenu !== false) {\n            this.hmenu = new Ext.menu.Menu({id: grid.id + '-hctx'});\n            this.hmenu.add(\n                {itemId:'asc',  text: this.sortAscText,  cls: 'xg-hmenu-sort-asc'},\n                {itemId:'desc', text: this.sortDescText, cls: 'xg-hmenu-sort-desc'}\n            );\n\n            if (grid.enableColumnHide !== false) {\n                this.colMenu = new Ext.menu.Menu({id:grid.id + '-hcols-menu'});\n                this.colMenu.on({\n                    scope     : this,\n                    beforeshow: this.beforeColMenuShow,\n                    itemclick : this.handleHdMenuClick\n                });\n                this.hmenu.add({\n                    itemId: 'sortSep',\n                    xtype: 'menuseparator'\n                }, {\n                    itemId:'columns',\n                    hideOnClick: false,\n                    text: this.columnsText,\n                    menu: this.colMenu,\n                    iconCls: 'x-cols-icon'\n                });\n            }\n\n            this.hmenu.on('itemclick', this.handleHdMenuClick, this);\n        }\n\n        if (grid.trackMouseOver) {\n            this.mainBody.on({\n                scope    : this,\n                mouseover: this.onRowOver,\n                mouseout : this.onRowOut\n            });\n        }\n\n        if (grid.enableDragDrop || grid.enableDrag) {\n            this.dragZone = new Ext.grid.GridDragZone(grid, {\n                ddGroup : grid.ddGroup || 'GridDD'\n            });\n        }\n\n        this.updateHeaderSortState();\n    },\n\n    /**\n     * @private\n     * Renders each of the UI elements in turn. This is called internally, once, by this.render. It does not\n     * render rows from the store, just the surrounding UI elements.\n     */\n    renderUI : function() {\n        var templates = this.templates;\n\n        return templates.master.apply({\n            body  : templates.body.apply({rows:'&#160;'}),\n            header: this.renderHeaders(),\n            ostyle: 'width:' + this.getOffsetWidth() + ';',\n            bstyle: 'width:' + this.getTotalWidth()  + ';'\n        });\n    },\n\n    // private\n    processEvent : function(name, e) {\n        var target = e.getTarget(),\n            grid   = this.grid,\n            header = this.findHeaderIndex(target),\n            row, cell, col, body;\n\n        grid.fireEvent(name, e);\n\n        if (header !== false) {\n            grid.fireEvent('header' + name, grid, header, e);\n        } else {\n            row = this.findRowIndex(target);\n\n//          Grid's value-added events must bubble correctly to allow cancelling via returning false: cell->column->row\n//          We must allow a return of false at any of these levels to cancel the event processing.\n//          Particularly allowing rowmousedown to be cancellable by prior handlers which need to prevent selection.\n            if (row !== false) {\n                cell = this.findCellIndex(target);\n                if (cell !== false) {\n                    col = grid.colModel.getColumnAt(cell);\n                    if (grid.fireEvent('cell' + name, grid, row, cell, e) !== false) {\n                        if (!col || (col.processEvent && (col.processEvent(name, e, grid, row, cell) !== false))) {\n                            grid.fireEvent('row' + name, grid, row, e);\n                        }\n                    }\n                } else {\n                    if (grid.fireEvent('row' + name, grid, row, e) !== false) {\n                        (body = this.findRowBody(target)) && grid.fireEvent('rowbody' + name, grid, row, e);\n                    }\n                }\n            } else {\n                grid.fireEvent('container' + name, grid, e);\n            }\n        }\n    },\n\n    /**\n     * @private\n     * Sizes the grid's header and body elements\n     */\n    layout : function(initial) {\n        if (!this.mainBody) {\n            return; // not rendered\n        }\n\n        var grid       = this.grid,\n            gridEl     = grid.getGridEl(),\n            gridSize   = gridEl.getSize(true),\n            gridWidth  = gridSize.width,\n            gridHeight = gridSize.height,\n            scroller   = this.scroller,\n            scrollStyle, headerHeight, scrollHeight;\n        \n        if (gridWidth < 20 || gridHeight < 20) {\n            return;\n        }\n        \n        if (grid.autoHeight) {\n            scrollStyle = scroller.dom.style;\n            scrollStyle.overflow = 'visible';\n            \n            if (Ext.isWebKit) {\n                scrollStyle.position = 'static';\n            }\n        } else {\n            this.el.setSize(gridWidth, gridHeight);\n            \n            headerHeight = this.mainHd.getHeight();\n            scrollHeight = gridHeight - headerHeight;\n            \n            scroller.setSize(gridWidth, scrollHeight);\n            \n            if (this.innerHd) {\n                this.innerHd.style.width = (gridWidth) + \"px\";\n            }\n        }\n        \n        if (this.forceFit || (initial === true && this.autoFill)) {\n            if (this.lastViewWidth != gridWidth) {\n                this.fitColumns(false, false);\n                this.lastViewWidth = gridWidth;\n            }\n        } else {\n            this.autoExpand();\n            this.syncHeaderScroll();\n        }\n        \n        this.onLayout(gridWidth, scrollHeight);\n    },\n\n    // template functions for subclasses and plugins\n    // these functions include precalculated values\n    onLayout : function(vw, vh) {\n        // do nothing\n    },\n\n    onColumnWidthUpdated : function(col, w, tw) {\n        //template method\n    },\n\n    onAllColumnWidthsUpdated : function(ws, tw) {\n        //template method\n    },\n\n    onColumnHiddenUpdated : function(col, hidden, tw) {\n        // template method\n    },\n\n    updateColumnText : function(col, text) {\n        // template method\n    },\n\n    afterMove : function(colIndex) {\n        // template method\n    },\n\n    /* ----------------------------------- Core Specific -------------------------------------------*/\n    // private\n    init : function(grid) {\n        this.grid = grid;\n\n        this.initTemplates();\n        this.initData(grid.store, grid.colModel);\n        this.initUI(grid);\n    },\n\n    // private\n    getColumnId : function(index){\n        return this.cm.getColumnId(index);\n    },\n\n    // private\n    getOffsetWidth : function() {\n        return (this.cm.getTotalWidth() + this.getScrollOffset()) + 'px';\n    },\n\n    // private\n    getScrollOffset: function() {\n        return Ext.num(this.scrollOffset, Ext.getScrollBarWidth());\n    },\n\n    /**\n     * @private\n     * Renders the header row using the 'header' template. Does not inject the HTML into the DOM, just\n     * returns a string.\n     * @return {String} Rendered header row\n     */\n    renderHeaders : function() {\n        var colModel   = this.cm,\n            templates  = this.templates,\n            headerTpl  = templates.hcell,\n            properties = {},\n            colCount   = colModel.getColumnCount(),\n            last       = colCount - 1,\n            cells      = [],\n            i, cssCls;\n        \n        for (i = 0; i < colCount; i++) {\n            if (i == 0) {\n                cssCls = 'x-grid3-cell-first ';\n            } else {\n                cssCls = i == last ? 'x-grid3-cell-last ' : '';\n            }\n            \n            properties = {\n                id     : colModel.getColumnId(i),\n                value  : colModel.getColumnHeader(i) || '',\n                style  : this.getColumnStyle(i, true),\n                css    : cssCls,\n                tooltip: this.getColumnTooltip(i)\n            };\n            \n            if (colModel.config[i].align == 'right') {\n                properties.istyle = 'padding-right: 16px;';\n            } else {\n                delete properties.istyle;\n            }\n            \n            cells[i] = headerTpl.apply(properties);\n        }\n        \n        return templates.header.apply({\n            cells : cells.join(\"\"),\n            tstyle: String.format(\"width: {0};\", this.getTotalWidth())\n        });\n    },\n\n    /**\n     * @private\n     */\n    getColumnTooltip : function(i) {\n        var tooltip = this.cm.getColumnTooltip(i);\n        if (tooltip) {\n            if (Ext.QuickTips.isEnabled()) {\n                return 'ext:qtip=\"' + tooltip + '\"';\n            } else {\n                return 'title=\"' + tooltip + '\"';\n            }\n        }\n        \n        return '';\n    },\n\n    // private\n    beforeUpdate : function() {\n        this.grid.stopEditing(true);\n    },\n\n    /**\n     * @private\n     * Re-renders the headers and ensures they are sized correctly\n     */\n    updateHeaders : function() {\n        this.innerHd.firstChild.innerHTML = this.renderHeaders();\n        \n        this.updateHeaderWidth(false);\n    },\n    \n    /**\n     * @private\n     * Ensures that the header is sized to the total width available to it\n     * @param {Boolean} updateMain True to update the mainBody's width also (defaults to true)\n     */\n    updateHeaderWidth: function(updateMain) {\n        var innerHdChild = this.innerHd.firstChild,\n            totalWidth   = this.getTotalWidth();\n        \n        innerHdChild.style.width = this.getOffsetWidth();\n        innerHdChild.firstChild.style.width = totalWidth;\n        \n        if (updateMain !== false) {\n            this.mainBody.dom.style.width = totalWidth;\n        }\n    },\n\n    /**\n     * Focuses the specified row.\n     * @param {Number} row The row index\n     */\n    focusRow : function(row) {\n        this.focusCell(row, 0, false);\n    },\n\n    /**\n     * Focuses the specified cell.\n     * @param {Number} row The row index\n     * @param {Number} col The column index\n     */\n    focusCell : function(row, col, hscroll) {\n        this.syncFocusEl(this.ensureVisible(row, col, hscroll));\n        \n        var focusEl = this.focusEl;\n        \n        if (Ext.isGecko) {\n            focusEl.focus();\n        } else {\n            focusEl.focus.defer(1, focusEl);\n        }\n    },\n\n    /**\n     * @private\n     * Finds the Elements corresponding to the given row and column indexes\n     */\n    resolveCell : function(row, col, hscroll) {\n        if (!Ext.isNumber(row)) {\n            row = row.rowIndex;\n        }\n        \n        if (!this.ds) {\n            return null;\n        }\n        \n        if (row < 0 || row >= this.ds.getCount()) {\n            return null;\n        }\n        col = (col !== undefined ? col : 0);\n\n        var rowEl    = this.getRow(row),\n            colModel = this.cm,\n            colCount = colModel.getColumnCount(),\n            cellEl;\n            \n        if (!(hscroll === false && col === 0)) {\n            while (col < colCount && colModel.isHidden(col)) {\n                col++;\n            }\n            \n            cellEl = this.getCell(row, col);\n        }\n\n        return {row: rowEl, cell: cellEl};\n    },\n\n    /**\n     * @private\n     * Returns the XY co-ordinates of a given row/cell resolution (see {@link #resolveCell})\n     * @return {Array} X and Y coords\n     */\n    getResolvedXY : function(resolved) {\n        if (!resolved) {\n            return null;\n        }\n        \n        var cell = resolved.cell,\n            row  = resolved.row;\n        \n        if (cell) {\n            return Ext.fly(cell).getXY();\n        } else {\n            return [this.el.getX(), Ext.fly(row).getY()];\n        }\n    },\n\n    /**\n     * @private\n     * Moves the focus element to the x and y co-ordinates of the given row and column\n     */\n    syncFocusEl : function(row, col, hscroll) {\n        var xy = row;\n        \n        if (!Ext.isArray(xy)) {\n            row = Math.min(row, Math.max(0, this.getRows().length-1));\n            \n            if (isNaN(row)) {\n                return;\n            }\n            \n            xy = this.getResolvedXY(this.resolveCell(row, col, hscroll));\n        }\n        \n        this.focusEl.setXY(xy || this.scroller.getXY());\n    },\n\n    /**\n     * @private\n     */\n    ensureVisible : function(row, col, hscroll) {\n        var resolved = this.resolveCell(row, col, hscroll);\n        \n        if (!resolved || !resolved.row) {\n            return null;\n        }\n\n        var rowEl  = resolved.row,\n            cellEl = resolved.cell,\n            c = this.scroller.dom,\n            p = rowEl,\n            ctop = 0,\n            stop = this.el.dom;\n\n        while (p && p != stop) {\n            ctop += p.offsetTop;\n            p = p.offsetParent;\n        }\n\n        ctop -= this.mainHd.dom.offsetHeight;\n        stop = parseInt(c.scrollTop, 10);\n\n        var cbot = ctop + rowEl.offsetHeight,\n            ch = c.clientHeight,\n            sbot = stop + ch;\n\n\n        if (ctop < stop) {\n          c.scrollTop = ctop;\n        } else if(cbot > sbot) {\n            c.scrollTop = cbot-ch;\n        }\n\n        if (hscroll !== false) {\n            var cleft  = parseInt(cellEl.offsetLeft, 10),\n                cright = cleft + cellEl.offsetWidth,\n                sleft  = parseInt(c.scrollLeft, 10),\n                sright = sleft + c.clientWidth;\n                \n            if (cleft < sleft) {\n                c.scrollLeft = cleft;\n            } else if(cright > sright) {\n                c.scrollLeft = cright-c.clientWidth;\n            }\n        }\n        \n        return this.getResolvedXY(resolved);\n    },\n\n    // private\n    insertRows : function(dm, firstRow, lastRow, isUpdate) {\n        var last = dm.getCount() - 1;\n        if( !isUpdate && firstRow === 0 && lastRow >= last) {\n            this.fireEvent('beforerowsinserted', this, firstRow, lastRow);\n                this.refresh();\n            this.fireEvent('rowsinserted', this, firstRow, lastRow);\n        } else {\n            if (!isUpdate) {\n                this.fireEvent('beforerowsinserted', this, firstRow, lastRow);\n            }\n            var html = this.renderRows(firstRow, lastRow),\n                before = this.getRow(firstRow);\n            if (before) {\n                if(firstRow === 0){\n                    Ext.fly(this.getRow(0)).removeClass(this.firstRowCls);\n                }\n                Ext.DomHelper.insertHtml('beforeBegin', before, html);\n            } else {\n                var r = this.getRow(last - 1);\n                if(r){\n                    Ext.fly(r).removeClass(this.lastRowCls);\n                }\n                Ext.DomHelper.insertHtml('beforeEnd', this.mainBody.dom, html);\n            }\n            if (!isUpdate) {\n                this.processRows(firstRow);\n                this.fireEvent('rowsinserted', this, firstRow, lastRow);\n            } else if (firstRow === 0 || firstRow >= last) {\n                //ensure first/last row is kept after an update.\n                Ext.fly(this.getRow(firstRow)).addClass(firstRow === 0 ? this.firstRowCls : this.lastRowCls);\n            }\n        }\n        this.syncFocusEl(firstRow);\n    },\n\n    /**\n     * @private\n     * DEPRECATED - this doesn't appear to be called anywhere in the library, remove in 4.0. \n     */\n    deleteRows : function(dm, firstRow, lastRow) {\n        if (dm.getRowCount() < 1) {\n            this.refresh();\n        } else {\n            this.fireEvent('beforerowsdeleted', this, firstRow, lastRow);\n\n            this.removeRows(firstRow, lastRow);\n\n            this.processRows(firstRow);\n            this.fireEvent('rowsdeleted', this, firstRow, lastRow);\n        }\n    },\n\n    /**\n     * @private\n     * Builds a CSS string for the given column index\n     * @param {Number} colIndex The column index\n     * @param {Boolean} isHeader True if getting the style for the column's header\n     * @return {String} The CSS string\n     */\n    getColumnStyle : function(colIndex, isHeader) {\n        var colModel  = this.cm,\n            colConfig = colModel.config,\n            style     = isHeader ? '' : colConfig[colIndex].css || '',\n            align     = colConfig[colIndex].align;\n        \n        style += String.format(\"width: {0};\", this.getColumnWidth(colIndex));\n        \n        if (colModel.isHidden(colIndex)) {\n            style += 'display: none; ';\n        }\n        \n        if (align) {\n            style += String.format(\"text-align: {0};\", align);\n        }\n        \n        return style;\n    },\n\n    /**\n     * @private\n     * Returns the width of a given column minus its border width\n     * @return {Number} The column index\n     * @return {String|Number} The width in pixels\n     */\n    getColumnWidth : function(column) {\n        var columnWidth = this.cm.getColumnWidth(column),\n            borderWidth = this.borderWidth;\n        \n        if (Ext.isNumber(columnWidth)) {\n            if (Ext.isBorderBox) {\n                return columnWidth + \"px\";\n            } else {\n                return Math.max(columnWidth - borderWidth, 0) + \"px\";\n            }\n        } else {\n            return columnWidth;\n        }\n    },\n\n    /**\n     * @private\n     * Returns the total width of all visible columns\n     * @return {String} \n     */\n    getTotalWidth : function() {\n        return this.cm.getTotalWidth() + 'px';\n    },\n\n    /**\n     * @private\n     * Resizes each column to fit the available grid width.\n     * TODO: The second argument isn't even used, remove it in 4.0\n     * @param {Boolean} preventRefresh True to prevent resizing of each row to the new column sizes (defaults to false)\n     * @param {null} onlyExpand NOT USED, will be removed in 4.0\n     * @param {Number} omitColumn The index of a column to leave at its current width. Defaults to undefined\n     * @return {Boolean} True if the operation succeeded, false if not or undefined if the grid view is not yet initialized\n     */\n    fitColumns : function(preventRefresh, onlyExpand, omitColumn) {\n        var grid          = this.grid,\n            colModel      = this.cm,\n            totalColWidth = colModel.getTotalWidth(false),\n            gridWidth     = this.getGridInnerWidth(),\n            extraWidth    = gridWidth - totalColWidth,\n            columns       = [],\n            extraCol      = 0,\n            width         = 0,\n            colWidth, fraction, i;\n        \n        // not initialized, so don't screw up the default widths\n        if (gridWidth < 20 || extraWidth === 0) {\n            return false;\n        }\n        \n        var visibleColCount = colModel.getColumnCount(true),\n            totalColCount   = colModel.getColumnCount(false),\n            adjCount        = visibleColCount - (Ext.isNumber(omitColumn) ? 1 : 0);\n        \n        if (adjCount === 0) {\n            adjCount = 1;\n            omitColumn = undefined;\n        }\n        \n        //FIXME: the algorithm used here is odd and potentially confusing. Includes this for loop and the while after it.\n        for (i = 0; i < totalColCount; i++) {\n            if (!colModel.isFixed(i) && i !== omitColumn) {\n                colWidth = colModel.getColumnWidth(i);\n                columns.push(i, colWidth);\n                \n                if (!colModel.isHidden(i)) {\n                    extraCol = i;\n                    width += colWidth;\n                }\n            }\n        }\n        \n        fraction = (gridWidth - colModel.getTotalWidth()) / width;\n        \n        while (columns.length) {\n            colWidth = columns.pop();\n            i        = columns.pop();\n            \n            colModel.setColumnWidth(i, Math.max(grid.minColumnWidth, Math.floor(colWidth + colWidth * fraction)), true);\n        }\n        \n        //this has been changed above so remeasure now\n        totalColWidth = colModel.getTotalWidth(false);\n        \n        if (totalColWidth > gridWidth) {\n            var adjustCol = (adjCount == visibleColCount) ? extraCol : omitColumn,\n                newWidth  = Math.max(1, colModel.getColumnWidth(adjustCol) - (totalColWidth - gridWidth));\n            \n            colModel.setColumnWidth(adjustCol, newWidth, true);\n        }\n        \n        if (preventRefresh !== true) {\n            this.updateAllColumnWidths();\n        }\n        \n        return true;\n    },\n\n    /**\n     * @private\n     * Resizes the configured autoExpandColumn to take the available width after the other columns have \n     * been accounted for\n     * @param {Boolean} preventUpdate True to prevent the resizing of all rows (defaults to false)\n     */\n    autoExpand : function(preventUpdate) {\n        var grid             = this.grid,\n            colModel         = this.cm,\n            gridWidth        = this.getGridInnerWidth(),\n            totalColumnWidth = colModel.getTotalWidth(false),\n            autoExpandColumn = grid.autoExpandColumn;\n        \n        if (!this.userResized && autoExpandColumn) {\n            if (gridWidth != totalColumnWidth) {\n                //if we are not already using all available width, resize the autoExpandColumn\n                var colIndex     = colModel.getIndexById(autoExpandColumn),\n                    currentWidth = colModel.getColumnWidth(colIndex),\n                    desiredWidth = gridWidth - totalColumnWidth + currentWidth,\n                    newWidth     = Math.min(Math.max(desiredWidth, grid.autoExpandMin), grid.autoExpandMax);\n                \n                if (currentWidth != newWidth) {\n                    colModel.setColumnWidth(colIndex, newWidth, true);\n                    \n                    if (preventUpdate !== true) {\n                        this.updateColumnWidth(colIndex, newWidth);\n                    }\n                }\n            }\n        }\n    },\n    \n    /**\n     * Returns the total internal width available to the grid, taking the scrollbar into account\n     * @return {Number} The total width\n     */\n    getGridInnerWidth: function() {\n        return this.grid.getGridEl().getWidth(true) - this.getScrollOffset();\n    },\n\n    /**\n     * @private\n     * Returns an array of column configurations - one for each column\n     * @return {Array} Array of column config objects. This includes the column name, renderer, id style and renderer\n     */\n    getColumnData : function() {\n        var columns  = [],\n            colModel = this.cm,\n            colCount = colModel.getColumnCount(),\n            fields   = this.ds.fields,\n            i, name;\n        \n        for (i = 0; i < colCount; i++) {\n            name = colModel.getDataIndex(i);\n            \n            columns[i] = {\n                name    : Ext.isDefined(name) ? name : (fields.get(i) ? fields.get(i).name : undefined),\n                renderer: colModel.getRenderer(i),\n                scope   : colModel.getRendererScope(i),\n                id      : colModel.getColumnId(i),\n                style   : this.getColumnStyle(i)\n            };\n        }\n        \n        return columns;\n    },\n\n    /**\n     * @private\n     * Renders rows between start and end indexes\n     * @param {Number} startRow Index of the first row to render\n     * @param {Number} endRow Index of the last row to render\n     */\n    renderRows : function(startRow, endRow) {\n        var grid     = this.grid,\n            store    = grid.store,\n            stripe   = grid.stripeRows,\n            colModel = grid.colModel,\n            colCount = colModel.getColumnCount(),\n            rowCount = store.getCount(),\n            records;\n        \n        if (rowCount < 1) {\n            return '';\n        }\n        \n        startRow = startRow || 0;\n        endRow   = Ext.isDefined(endRow) ? endRow : rowCount - 1;\n        records  = store.getRange(startRow, endRow);\n        \n        return this.doRender(this.getColumnData(), records, store, startRow, colCount, stripe);\n    },\n\n    // private\n    renderBody : function(){\n        var markup = this.renderRows() || '&#160;';\n        return this.templates.body.apply({rows: markup});\n    },\n\n    /**\n     * @private\n     * Refreshes a row by re-rendering it. Fires the rowupdated event when done\n     */\n    refreshRow: function(record) {\n        var store     = this.ds,\n            colCount  = this.cm.getColumnCount(),\n            columns   = this.getColumnData(),\n            last      = colCount - 1,\n            cls       = ['x-grid3-row'],\n            rowParams = {\n                tstyle: String.format(\"width: {0};\", this.getTotalWidth())\n            },\n            colBuffer = [],\n            cellTpl   = this.templates.cell,\n            rowIndex, row, column, meta, css, i;\n        \n        if (Ext.isNumber(record)) {\n            rowIndex = record;\n            record   = store.getAt(rowIndex);\n        } else {\n            rowIndex = store.indexOf(record);\n        }\n        \n        //the record could not be found\n        if (!record || rowIndex < 0) {\n            return;\n        }\n        \n        //builds each column in this row\n        for (i = 0; i < colCount; i++) {\n            column = columns[i];\n            \n            if (i == 0) {\n                css = 'x-grid3-cell-first';\n            } else {\n                css = (i == last) ? 'x-grid3-cell-last ' : '';\n            }\n            \n            meta = {\n                id      : column.id,\n                style   : column.style,\n                css     : css,\n                attr    : \"\",\n                cellAttr: \"\"\n            };\n            // Need to set this after, because we pass meta to the renderer\n            meta.value = column.renderer.call(column.scope, record.data[column.name], meta, record, rowIndex, i, store);\n            \n            if (Ext.isEmpty(meta.value)) {\n                meta.value = '&#160;';\n            }\n            \n            if (this.markDirty && record.dirty && typeof record.modified[column.name] != 'undefined') {\n                meta.css += ' x-grid3-dirty-cell';\n            }\n            \n            colBuffer[i] = cellTpl.apply(meta);\n        }\n        \n        row = this.getRow(rowIndex);\n        row.className = '';\n        \n        if (this.grid.stripeRows && ((rowIndex + 1) % 2 === 0)) {\n            cls.push('x-grid3-row-alt');\n        }\n        \n        if (this.getRowClass) {\n            rowParams.cols = colCount;\n            cls.push(this.getRowClass(record, rowIndex, rowParams, store));\n        }\n        \n        this.fly(row).addClass(cls).setStyle(rowParams.tstyle);\n        rowParams.cells = colBuffer.join(\"\");\n        row.innerHTML = this.templates.rowInner.apply(rowParams);\n        \n        this.fireEvent('rowupdated', this, rowIndex, record);\n    },\n\n    /**\n     * Refreshs the grid UI\n     * @param {Boolean} headersToo (optional) True to also refresh the headers\n     */\n    refresh : function(headersToo) {\n        this.fireEvent('beforerefresh', this);\n        this.grid.stopEditing(true);\n\n        var result = this.renderBody();\n        this.mainBody.update(result).setWidth(this.getTotalWidth());\n        if (headersToo === true) {\n            this.updateHeaders();\n            this.updateHeaderSortState();\n        }\n        this.processRows(0, true);\n        this.layout();\n        this.applyEmptyText();\n        this.fireEvent('refresh', this);\n    },\n\n    /**\n     * @private\n     * Displays the configured emptyText if there are currently no rows to display\n     */\n    applyEmptyText : function() {\n        if (this.emptyText && !this.hasRows()) {\n            this.mainBody.update('<div class=\"x-grid-empty\">' + this.emptyText + '</div>');\n        }\n    },\n\n    /**\n     * @private\n     * Adds sorting classes to the column headers based on the bound store's sortInfo. Fires the 'sortchange' event\n     * if the sorting has changed since this function was last run.\n     */\n    updateHeaderSortState : function() {\n        var state = this.ds.getSortState();\n        if (!state) {\n            return;\n        }\n\n        if (!this.sortState || (this.sortState.field != state.field || this.sortState.direction != state.direction)) {\n            this.grid.fireEvent('sortchange', this.grid, state);\n        }\n\n        this.sortState = state;\n\n        var sortColumn = this.cm.findColumnIndex(state.field);\n        if (sortColumn != -1) {\n            var sortDir = state.direction;\n            this.updateSortIcon(sortColumn, sortDir);\n        }\n    },\n\n    /**\n     * @private\n     * Removes any sorting indicator classes from the column headers\n     */\n    clearHeaderSortState : function() {\n        if (!this.sortState) {\n            return;\n        }\n        this.grid.fireEvent('sortchange', this.grid, null);\n        this.mainHd.select('td').removeClass(this.sortClasses);\n        delete this.sortState;\n    },\n\n    /**\n     * @private\n     * Destroys all objects associated with the GridView\n     */\n    destroy : function() {\n        var me              = this,\n            grid            = me.grid,\n            gridEl          = grid.getGridEl(),\n            dragZone        = me.dragZone,\n            splitZone       = me.splitZone,\n            columnDrag      = me.columnDrag,\n            columnDrop      = me.columnDrop,\n            scrollToTopTask = me.scrollToTopTask,\n            columnDragData,\n            columnDragProxy;\n        \n        if (scrollToTopTask && scrollToTopTask.cancel) {\n            scrollToTopTask.cancel();\n        }\n        \n        Ext.destroyMembers(me, 'colMenu', 'hmenu');\n\n        me.initData(null, null);\n        me.purgeListeners();\n        \n        Ext.fly(me.innerHd).un(\"click\", me.handleHdDown, me);\n\n        if (grid.enableColumnMove) {\n            columnDragData = columnDrag.dragData;\n            columnDragProxy = columnDrag.proxy;\n            Ext.destroy(\n                columnDrag.el,\n                columnDragProxy.ghost,\n                columnDragProxy.el,\n                columnDrop.el,\n                columnDrop.proxyTop,\n                columnDrop.proxyBottom,\n                columnDragData.ddel,\n                columnDragData.header\n            );\n            \n            if (columnDragProxy.anim) {\n                Ext.destroy(columnDragProxy.anim);\n            }\n            \n            delete columnDragProxy.ghost;\n            delete columnDragData.ddel;\n            delete columnDragData.header;\n            columnDrag.destroy();\n            \n            delete Ext.dd.DDM.locationCache[columnDrag.id];\n            delete columnDrag._domRef;\n\n            delete columnDrop.proxyTop;\n            delete columnDrop.proxyBottom;\n            columnDrop.destroy();\n            delete Ext.dd.DDM.locationCache[\"gridHeader\" + gridEl.id];\n            delete columnDrop._domRef;\n            delete Ext.dd.DDM.ids[columnDrop.ddGroup];\n        }\n\n        if (splitZone) { // enableColumnResize\n            splitZone.destroy();\n            delete splitZone._domRef;\n            delete Ext.dd.DDM.ids[\"gridSplitters\" + gridEl.id];\n        }\n\n        Ext.fly(me.innerHd).removeAllListeners();\n        Ext.removeNode(me.innerHd);\n        delete me.innerHd;\n\n        Ext.destroy(\n            me.el,\n            me.mainWrap,\n            me.mainHd,\n            me.scroller,\n            me.mainBody,\n            me.focusEl,\n            me.resizeMarker,\n            me.resizeProxy,\n            me.activeHdBtn,\n            me._flyweight,\n            dragZone,\n            splitZone\n        );\n\n        delete grid.container;\n\n        if (dragZone) {\n            dragZone.destroy();\n        }\n\n        Ext.dd.DDM.currentTarget = null;\n        delete Ext.dd.DDM.locationCache[gridEl.id];\n\n        Ext.EventManager.removeResizeListener(me.onWindowResize, me);\n    },\n\n    // private\n    onDenyColumnHide : function() {\n\n    },\n\n    // private\n    render : function() {\n        if (this.autoFill) {\n            var ct = this.grid.ownerCt;\n            \n            if (ct && ct.getLayout()) {\n                ct.on('afterlayout', function() {\n                    this.fitColumns(true, true);\n                    this.updateHeaders();\n                    this.updateHeaderSortState();\n                }, this, {single: true});\n            }\n        } else if (this.forceFit) {\n            this.fitColumns(true, false);\n        } else if (this.grid.autoExpandColumn) {\n            this.autoExpand(true);\n        }\n        \n        this.grid.getGridEl().dom.innerHTML = this.renderUI();\n        \n        this.afterRenderUI();\n    },\n\n    /* --------------------------------- Model Events and Handlers --------------------------------*/\n    \n    /**\n     * @private\n     * Binds a new Store and ColumnModel to this GridView. Removes any listeners from the old objects (if present)\n     * and adds listeners to the new ones\n     * @param {Ext.data.Store} newStore The new Store instance\n     * @param {Ext.grid.ColumnModel} newColModel The new ColumnModel instance\n     */\n    initData : function(newStore, newColModel) {\n        var me = this;\n        \n        if (me.ds) {\n            var oldStore = me.ds;\n            \n            oldStore.un('add', me.onAdd, me);\n            oldStore.un('load', me.onLoad, me);\n            oldStore.un('clear', me.onClear, me);\n            oldStore.un('remove', me.onRemove, me);\n            oldStore.un('update', me.onUpdate, me);\n            oldStore.un('datachanged', me.onDataChange, me);\n            \n            if (oldStore !== newStore && oldStore.autoDestroy) {\n                oldStore.destroy();\n            }\n        }\n        \n        if (newStore) {\n            newStore.on({\n                scope      : me,\n                load       : me.onLoad,\n                add        : me.onAdd,\n                remove     : me.onRemove,\n                update     : me.onUpdate,\n                clear      : me.onClear,\n                datachanged: me.onDataChange\n            });\n        }\n        \n        if (me.cm) {\n            var oldColModel = me.cm;\n            \n            oldColModel.un('configchange', me.onColConfigChange, me);\n            oldColModel.un('widthchange',  me.onColWidthChange, me);\n            oldColModel.un('headerchange', me.onHeaderChange, me);\n            oldColModel.un('hiddenchange', me.onHiddenChange, me);\n            oldColModel.un('columnmoved',  me.onColumnMove, me);\n        }\n        \n        if (newColModel) {\n            delete me.lastViewWidth;\n            \n            newColModel.on({\n                scope       : me,\n                configchange: me.onColConfigChange,\n                widthchange : me.onColWidthChange,\n                headerchange: me.onHeaderChange,\n                hiddenchange: me.onHiddenChange,\n                columnmoved : me.onColumnMove\n            });\n        }\n        \n        me.ds = newStore;\n        me.cm = newColModel;\n    },\n\n    // private\n    onDataChange : function(){\n        this.refresh(true);\n        this.updateHeaderSortState();\n        this.syncFocusEl(0);\n    },\n\n    // private\n    onClear : function() {\n        this.refresh();\n        this.syncFocusEl(0);\n    },\n\n    // private\n    onUpdate : function(store, record) {\n        this.refreshRow(record);\n    },\n\n    // private\n    onAdd : function(store, records, index) {\n        this.insertRows(store, index, index + (records.length-1));\n    },\n\n    // private\n    onRemove : function(store, record, index, isUpdate) {\n        if (isUpdate !== true) {\n            this.fireEvent('beforerowremoved', this, index, record);\n        }\n        \n        this.removeRow(index);\n        \n        if (isUpdate !== true) {\n            this.processRows(index);\n            this.applyEmptyText();\n            this.fireEvent('rowremoved', this, index, record);\n        }\n    },\n\n    /**\n     * @private\n     * Called when a store is loaded, scrolls to the top row\n     */\n    onLoad : function() {\n        if (Ext.isGecko) {\n            if (!this.scrollToTopTask) {\n                this.scrollToTopTask = new Ext.util.DelayedTask(this.scrollToTop, this);\n            }\n            this.scrollToTopTask.delay(1);\n        } else {\n            this.scrollToTop();\n        }\n    },\n\n    // private\n    onColWidthChange : function(cm, col, width) {\n        this.updateColumnWidth(col, width);\n    },\n\n    // private\n    onHeaderChange : function(cm, col, text) {\n        this.updateHeaders();\n    },\n\n    // private\n    onHiddenChange : function(cm, col, hidden) {\n        this.updateColumnHidden(col, hidden);\n    },\n\n    // private\n    onColumnMove : function(cm, oldIndex, newIndex) {\n        this.indexMap = null;\n        this.refresh(true);\n        this.restoreScroll(this.getScrollState());\n        \n        this.afterMove(newIndex);\n        this.grid.fireEvent('columnmove', oldIndex, newIndex);\n    },\n\n    // private\n    onColConfigChange : function() {\n        delete this.lastViewWidth;\n        this.indexMap = null;\n        this.refresh(true);\n    },\n\n    /* -------------------- UI Events and Handlers ------------------------------ */\n    // private\n    initUI : function(grid) {\n        grid.on('headerclick', this.onHeaderClick, this);\n    },\n\n    // private\n    initEvents : Ext.emptyFn,\n\n    // private\n    onHeaderClick : function(g, index) {\n        if (this.headersDisabled || !this.cm.isSortable(index)) {\n            return;\n        }\n        g.stopEditing(true);\n        g.store.sort(this.cm.getDataIndex(index));\n    },\n\n    /**\n     * @private\n     * Adds the hover class to a row when hovered over\n     */\n    onRowOver : function(e, target) {\n        var row = this.findRowIndex(target);\n        \n        if (row !== false) {\n            this.addRowClass(row, this.rowOverCls);\n        }\n    },\n\n    /**\n     * @private\n     * Removes the hover class from a row on mouseout\n     */\n    onRowOut : function(e, target) {\n        var row = this.findRowIndex(target);\n        \n        if (row !== false && !e.within(this.getRow(row), true)) {\n            this.removeRowClass(row, this.rowOverCls);\n        }\n    },\n\n    // private\n    onRowSelect : function(row) {\n        this.addRowClass(row, this.selectedRowClass);\n    },\n\n    // private\n    onRowDeselect : function(row) {\n        this.removeRowClass(row, this.selectedRowClass);\n    },\n\n    // private\n    onCellSelect : function(row, col) {\n        var cell = this.getCell(row, col);\n        if (cell) {\n            this.fly(cell).addClass('x-grid3-cell-selected');\n        }\n    },\n\n    // private\n    onCellDeselect : function(row, col) {\n        var cell = this.getCell(row, col);\n        if (cell) {\n            this.fly(cell).removeClass('x-grid3-cell-selected');\n        }\n    },\n\n    // private\n    handleWheel : function(e) {\n        e.stopPropagation();\n    },\n\n    /**\n     * @private\n     * Called by the SplitDragZone when a drag has been completed. Resizes the columns\n     */\n    onColumnSplitterMoved : function(cellIndex, width) {\n        this.userResized = true;\n        this.grid.colModel.setColumnWidth(cellIndex, width, true);\n\n        if (this.forceFit) {\n            this.fitColumns(true, false, cellIndex);\n            this.updateAllColumnWidths();\n        } else {\n            this.updateColumnWidth(cellIndex, width);\n            this.syncHeaderScroll();\n        }\n\n        this.grid.fireEvent('columnresize', cellIndex, width);\n    },\n\n    /**\n     * @private\n     * Click handler for the shared column dropdown menu, called on beforeshow. Builds the menu\n     * which displays the list of columns for the user to show or hide.\n     */\n    beforeColMenuShow : function() {\n        var colModel = this.cm,\n            colCount = colModel.getColumnCount(),\n            colMenu  = this.colMenu,\n            i;\n\n        colMenu.removeAll();\n\n        for (i = 0; i < colCount; i++) {\n            if (colModel.config[i].hideable !== false) {\n                colMenu.add(new Ext.menu.CheckItem({\n                    text       : colModel.getColumnHeader(i),\n                    itemId     : 'col-' + colModel.getColumnId(i),\n                    checked    : !colModel.isHidden(i),\n                    disabled   : colModel.config[i].hideable === false,\n                    hideOnClick: false\n                }));\n            }\n        }\n    },\n    \n    /**\n     * @private\n     * Attached as the 'itemclick' handler to the header menu and the column show/hide submenu (if available).\n     * Performs sorting if the sorter buttons were clicked, otherwise hides/shows the column that was clicked.\n     */\n    handleHdMenuClick : function(item) {\n        var store     = this.ds,\n            dataIndex = this.cm.getDataIndex(this.hdCtxIndex);\n\n        switch (item.getItemId()) {\n            case 'asc':\n                store.sort(dataIndex, 'ASC');\n                break;\n            case 'desc':\n                store.sort(dataIndex, 'DESC');\n                break;\n            default:\n                this.handleHdMenuClickDefault(item);\n        }\n        return true;\n    },\n    \n    /**\n     * Called by handleHdMenuClick if any button except a sort ASC/DESC button was clicked. The default implementation provides\n     * the column hide/show functionality based on the check state of the menu item. A different implementation can be provided\n     * if needed.\n     * @param {Ext.menu.BaseItem} item The menu item that was clicked\n     */\n    handleHdMenuClickDefault: function(item) {\n        var colModel = this.cm,\n            itemId   = item.getItemId(),\n            index    = colModel.getIndexById(itemId.substr(4));\n\n        if (index != -1) {\n            if (item.checked && colModel.getColumnsBy(this.isHideableColumn, this).length <= 1) {\n                this.onDenyColumnHide();\n                return;\n            }\n            colModel.setHidden(index, item.checked);\n        }\n    },\n\n    /**\n     * @private\n     * Called when a header cell is clicked - shows the menu if the click happened over a trigger button\n     */\n    handleHdDown : function(e, target) {\n        if (Ext.fly(target).hasClass('x-grid3-hd-btn')) {\n            e.stopEvent();\n            \n            var colModel  = this.cm,\n                header    = this.findHeaderCell(target),\n                index     = this.getCellIndex(header),\n                sortable  = colModel.isSortable(index),\n                menu      = this.hmenu,\n                menuItems = menu.items,\n                menuCls   = this.headerMenuOpenCls,\n                sep;\n            \n            this.hdCtxIndex = index;\n            \n            Ext.fly(header).addClass(menuCls);\n            if (this.hideSortIcons) {\n                menuItems.get('asc').setVisible(sortable);\n                menuItems.get('desc').setVisible(sortable);\n                sep = menuItems.get('sortSep');\n                if (sep) {\n                    sep.setVisible(sortable);    \n                }\n            } else {\n                menuItems.get('asc').setDisabled(!sortable);\n                menuItems.get('desc').setDisabled(!sortable);\n            }\n            \n            menu.on('hide', function() {\n                Ext.fly(header).removeClass(menuCls);\n            }, this, {single:true});\n            \n            menu.show(target, 'tl-bl?');\n        }\n    },\n\n    /**\n     * @private\n     * Attached to the headers' mousemove event. This figures out the CSS cursor to use based on where the mouse is currently\n     * pointed. If the mouse is currently hovered over the extreme left or extreme right of any header cell and the cell next \n     * to it is resizable it is given the resize cursor, otherwise the cursor is set to an empty string.\n     */\n    handleHdMove : function(e) {\n        var header = this.findHeaderCell(this.activeHdRef);\n        \n        if (header && !this.headersDisabled) {\n            var handleWidth  = this.splitHandleWidth || 5,\n                activeRegion = this.activeHdRegion,\n                headerStyle  = header.style,\n                colModel     = this.cm,\n                cursor       = '',\n                pageX        = e.getPageX();\n                \n            if (this.grid.enableColumnResize !== false) {\n                var activeHeaderIndex = this.activeHdIndex,\n                    previousVisible   = this.getPreviousVisible(activeHeaderIndex),\n                    currentResizable  = colModel.isResizable(activeHeaderIndex),\n                    previousResizable = previousVisible && colModel.isResizable(previousVisible),\n                    inLeftResizer     = pageX - activeRegion.left <= handleWidth,\n                    inRightResizer    = activeRegion.right - pageX <= (!this.activeHdBtn ? handleWidth : 2);\n                \n                if (inLeftResizer && previousResizable) {\n                    cursor = Ext.isAir ? 'move' : Ext.isWebKit ? 'e-resize' : 'col-resize'; // col-resize not always supported\n                } else if (inRightResizer && currentResizable) {\n                    cursor = Ext.isAir ? 'move' : Ext.isWebKit ? 'w-resize' : 'col-resize';\n                }\n            }\n            \n            headerStyle.cursor = cursor;\n        }\n    },\n    \n    /**\n     * @private\n     * Returns the index of the nearest currently visible header to the left of the given index.\n     * @param {Number} index The header index\n     * @return {Number/undefined} The index of the nearest visible header\n     */\n    getPreviousVisible: function(index) {\n        while (index > 0) {\n            if (!this.cm.isHidden(index - 1)) {\n                return index;\n            }\n            index--;\n        }\n        return undefined;\n    },\n\n    /**\n     * @private\n     * Tied to the header element's mouseover event - adds the over class to the header cell if the menu is not disabled\n     * for that cell\n     */\n    handleHdOver : function(e, target) {\n        var header = this.findHeaderCell(target);\n        \n        if (header && !this.headersDisabled) {\n            var fly = this.fly(header);\n            \n            this.activeHdRef = target;\n            this.activeHdIndex = this.getCellIndex(header);\n            this.activeHdRegion = fly.getRegion();\n            \n            if (!this.isMenuDisabled(this.activeHdIndex, fly)) {\n                fly.addClass('x-grid3-hd-over');\n                this.activeHdBtn = fly.child('.x-grid3-hd-btn');\n                \n                if (this.activeHdBtn) {\n                    this.activeHdBtn.dom.style.height = (header.firstChild.offsetHeight - 1) + 'px';\n                }\n            }\n        }\n    },\n\n    /**\n     * @private\n     * Tied to the header element's mouseout event. Removes the hover class from the header cell\n     */\n    handleHdOut : function(e, target) {\n        var header = this.findHeaderCell(target);\n        \n        if (header && (!Ext.isIE9m || !e.within(header, true))) {\n            this.activeHdRef = null;\n            this.fly(header).removeClass('x-grid3-hd-over');\n            header.style.cursor = '';\n        }\n    },\n    \n    /**\n     * @private\n     * Used by {@link #handleHdOver} to determine whether or not to show the header menu class on cell hover\n     * @param {Number} cellIndex The header cell index\n     * @param {Ext.Element} el The cell element currently being hovered over\n     */\n    isMenuDisabled: function(cellIndex, el) {\n        return this.cm.isMenuDisabled(cellIndex);\n    },\n\n    /**\n     * @private\n     * Returns true if there are any rows rendered into the GridView\n     * @return {Boolean} True if any rows have been rendered\n     */\n    hasRows : function() {\n        var fc = this.mainBody.dom.firstChild;\n        return fc && fc.nodeType == 1 && fc.className != 'x-grid-empty';\n    },\n    \n    /**\n     * @private\n     */\n    isHideableColumn : function(c) {\n        return !c.hidden;\n    },\n\n    /**\n     * @private\n     * DEPRECATED - will be removed in Ext JS 5.0\n     */\n    bind : function(d, c) {\n        this.initData(d, c);\n    }\n});\n\n\n// private\n// This is a support class used internally by the Grid components\nExt.grid.GridView.SplitDragZone = Ext.extend(Ext.dd.DDProxy, {\n\n    constructor: function(grid, hd){\n        this.grid = grid;\n        this.view = grid.getView();\n        this.marker = this.view.resizeMarker;\n        this.proxy = this.view.resizeProxy;\n        Ext.grid.GridView.SplitDragZone.superclass.constructor.call(this, hd,\n            'gridSplitters' + this.grid.getGridEl().id, {\n            dragElId : Ext.id(this.proxy.dom), resizeFrame:false\n        });\n        this.scroll = false;\n        this.hw = this.view.splitHandleWidth || 5;\n    },\n\n    b4StartDrag : function(x, y){\n        this.dragHeadersDisabled = this.view.headersDisabled;\n        this.view.headersDisabled = true;\n        var h = this.view.mainWrap.getHeight();\n        this.marker.setHeight(h);\n        this.marker.show();\n        this.marker.alignTo(this.view.getHeaderCell(this.cellIndex), 'tl-tl', [-2, 0]);\n        this.proxy.setHeight(h);\n        var w = this.cm.getColumnWidth(this.cellIndex),\n            minw = Math.max(w-this.grid.minColumnWidth, 0);\n        this.resetConstraints();\n        this.setXConstraint(minw, 1000);\n        this.setYConstraint(0, 0);\n        this.minX = x - minw;\n        this.maxX = x + 1000;\n        this.startPos = x;\n        Ext.dd.DDProxy.prototype.b4StartDrag.call(this, x, y);\n    },\n\n    allowHeaderDrag : function(e){\n        return true;\n    },\n\n    handleMouseDown : function(e){\n        var t = this.view.findHeaderCell(e.getTarget());\n        if(t && this.allowHeaderDrag(e)){\n            var xy = this.view.fly(t).getXY(), \n                x = xy[0],\n                exy = e.getXY(), \n                ex = exy[0],\n                w = t.offsetWidth, \n                adjust = false;\n                \n            if((ex - x) <= this.hw){\n                adjust = -1;\n            }else if((x+w) - ex <= this.hw){\n                adjust = 0;\n            }\n            if(adjust !== false){\n                this.cm = this.grid.colModel;\n                var ci = this.view.getCellIndex(t);\n                if(adjust == -1){\n                  if (ci + adjust < 0) {\n                    return;\n                  }\n                    while(this.cm.isHidden(ci+adjust)){\n                        --adjust;\n                        if(ci+adjust < 0){\n                            return;\n                        }\n                    }\n                }\n                this.cellIndex = ci+adjust;\n                this.split = t.dom;\n                if(this.cm.isResizable(this.cellIndex) && !this.cm.isFixed(this.cellIndex)){\n                    Ext.grid.GridView.SplitDragZone.superclass.handleMouseDown.apply(this, arguments);\n                }\n            }else if(this.view.columnDrag){\n                this.view.columnDrag.callHandleMouseDown(e);\n            }\n        }\n    },\n\n    endDrag : function(e){\n        this.marker.hide();\n        var v = this.view,\n            endX = Math.max(this.minX, e.getPageX()),\n            diff = endX - this.startPos,\n            disabled = this.dragHeadersDisabled;\n            \n        v.onColumnSplitterMoved(this.cellIndex, this.cm.getColumnWidth(this.cellIndex)+diff);\n        setTimeout(function(){\n            v.headersDisabled = disabled;\n        }, 50);\n    },\n\n    autoOffset : function(){\n        this.setDelta(0,0);\n    }\n});\n/**\n * @class Ext.grid.PivotGridView\n * @extends Ext.grid.GridView\n * Specialised GridView for rendering Pivot Grid components. Config can be passed to the PivotGridView via the PivotGrid constructor's\n * viewConfig option:\n<pre><code>\nnew Ext.grid.PivotGrid({\n    viewConfig: {\n        title: 'My Pivot Grid',\n        getCellCls: function(value) {\n            return value > 10 'red' : 'green';\n        }\n    }\n});\n</code></pre>\n * <p>Currently {@link #title} and {@link #getCellCls} are the only configuration options accepted by PivotGridView. All other \n * interaction is performed via the {@link Ext.grid.PivotGrid PivotGrid} class.</p>\n */\nExt.grid.PivotGridView = Ext.extend(Ext.grid.GridView, {\n    \n    /**\n     * The CSS class added to all group header cells. Defaults to 'grid-hd-group-cell'\n     * @property colHeaderCellCls\n     * @type String\n     */\n    colHeaderCellCls: 'grid-hd-group-cell',\n    \n    /**\n     * @cfg {String} title Optional title to be placed in the top left corner of the PivotGrid. Defaults to an empty string.\n     */\n    title: '',\n    \n    /**\n     * @cfg {Function} getCellCls Optional function which should return a CSS class name for each cell value. This is useful when\n     * color coding cells based on their value. Defaults to undefined.\n     */\n    \n    /**\n     * Returns the headers to be rendered at the top of the grid. Should be a 2-dimensional array, where each item specifies the number\n     * of columns it groups (column in this case refers to normal grid columns). In the example below we have 5 city groups, which are\n     * each part of a continent supergroup. The colspan for each city group refers to the number of normal grid columns that group spans,\n     * so in this case the grid would be expected to have a total of 12 columns:\n<pre><code>\n[\n    {\n        items: [\n            {header: 'England',   colspan: 5},\n            {header: 'USA',       colspan: 3}\n        ]\n    },\n    {\n        items: [\n            {header: 'London',    colspan: 2},\n            {header: 'Cambridge', colspan: 3},\n            {header: 'Palo Alto', colspan: 3}\n        ]\n    }\n]\n</code></pre>\n     * In the example above we have cities nested under countries. The nesting could be deeper if desired - e.g. Continent -> Country ->\n     * State -> City, or any other structure. The only constaint is that the same depth must be used throughout the structure.\n     * @return {Array} A tree structure containing the headers to be rendered. Must include the colspan property at each level, which should\n     * be the sum of all child nodes beneath this node.\n     */\n    getColumnHeaders: function() {\n        return this.grid.topAxis.buildHeaders();;\n    },\n    \n    /**\n     * Returns the headers to be rendered on the left of the grid. Should be a 2-dimensional array, where each item specifies the number\n     * of rows it groups. In the example below we have 5 city groups, which are each part of a continent supergroup. The rowspan for each \n     * city group refers to the number of normal grid columns that group spans, so in this case the grid would be expected to have a \n     * total of 12 rows:\n<pre><code>\n[\n    {\n        width: 90,\n        items: [\n            {header: 'England',   rowspan: 5},\n            {header: 'USA',       rowspan: 3}\n        ]\n    },\n    {\n        width: 50,\n        items: [\n            {header: 'London',    rowspan: 2},\n            {header: 'Cambridge', rowspan: 3},\n            {header: 'Palo Alto', rowspan: 3}\n        ]\n    }\n]\n</code></pre>\n     * In the example above we have cities nested under countries. The nesting could be deeper if desired - e.g. Continent -> Country ->\n     * State -> City, or any other structure. The only constaint is that the same depth must be used throughout the structure.\n     * @return {Array} A tree structure containing the headers to be rendered. Must include the colspan property at each level, which should\n     * be the sum of all child nodes beneath this node.\n     * Each group may specify the width it should be rendered with.\n     * @return {Array} The row groups\n     */\n    getRowHeaders: function() {\n        return this.grid.leftAxis.buildHeaders();\n    },\n    \n    /**\n     * @private\n     * Renders rows between start and end indexes\n     * @param {Number} startRow Index of the first row to render\n     * @param {Number} endRow Index of the last row to render\n     */\n    renderRows : function(startRow, endRow) {\n        var grid          = this.grid,\n            rows          = grid.extractData(),\n            rowCount      = rows.length,\n            templates     = this.templates,\n            renderer      = grid.renderer,\n            hasRenderer   = typeof renderer == 'function',\n            getCellCls    = this.getCellCls,\n            hasGetCellCls = typeof getCellCls == 'function',\n            cellTemplate  = templates.cell,\n            rowTemplate   = templates.row,\n            rowBuffer     = [],\n            meta          = {},\n            tstyle        = 'width:' + this.getGridInnerWidth() + 'px;',\n            colBuffer, colCount, column, i, row;\n        \n        startRow = startRow || 0;\n        endRow   = Ext.isDefined(endRow) ? endRow : rowCount - 1;\n        \n        for (i = 0; i < rowCount; i++) {\n            row = rows[i];\n            colCount  = row.length;\n            colBuffer = [];\n            \n            //build up each column's HTML\n            for (var j = 0; j < colCount; j++) {\n                \n                meta.id    = i + '-' + j;\n                meta.css   = j === 0 ? 'x-grid3-cell-first ' : (j == (colCount - 1) ? 'x-grid3-cell-last ' : '');\n                meta.attr  = meta.cellAttr = '';\n                meta.value = row[j];\n\n                if (Ext.isEmpty(meta.value)) {\n                    meta.value = '&#160;';\n                }\n                \n                if (hasRenderer) {\n                    meta.value = renderer(meta.value);\n                }\n                \n                if (hasGetCellCls) {\n                    meta.css += getCellCls(meta.value) + ' ';\n                }\n\n                colBuffer[colBuffer.length] = cellTemplate.apply(meta);\n            }\n            \n            rowBuffer[rowBuffer.length] = rowTemplate.apply({\n                tstyle: tstyle,\n                cols  : colCount,\n                cells : colBuffer.join(\"\"),\n                alt   : ''\n            });\n        }\n        \n        return rowBuffer.join(\"\");\n    },\n    \n    /**\n     * The master template to use when rendering the GridView. Has a default template\n     * @property Ext.Template\n     * @type masterTpl\n     */\n    masterTpl: new Ext.Template(\n        '<div class=\"x-grid3 x-pivotgrid\" hidefocus=\"true\">',\n            '<div class=\"x-grid3-viewport\">',\n                '<div class=\"x-grid3-header\">',\n                    '<div class=\"x-grid3-header-title\"><span>{title}</span></div>',\n                    '<div class=\"x-grid3-header-inner\">',\n                        '<div class=\"x-grid3-header-offset\" style=\"{ostyle}\"></div>',\n                    '</div>',\n                    '<div class=\"x-clear\"></div>',\n                '</div>',\n                '<div class=\"x-grid3-scroller\">',\n                    '<div class=\"x-grid3-row-headers\"></div>',\n                    '<div class=\"x-grid3-body\" style=\"{bstyle}\">{body}</div>',\n                    '<a href=\"#\" class=\"x-grid3-focus\" tabIndex=\"-1\"></a>',\n                '</div>',\n            '</div>',\n            '<div class=\"x-grid3-resize-marker\">&#160;</div>',\n            '<div class=\"x-grid3-resize-proxy\">&#160;</div>',\n        '</div>'\n    ),\n    \n    /**\n     * @private\n     * Adds a gcell template to the internal templates object. This is used to render the headers in a multi-level column header.\n     */\n    initTemplates: function() {\n        Ext.grid.PivotGridView.superclass.initTemplates.apply(this, arguments);\n        \n        var templates = this.templates || {};\n        if (!templates.gcell) {\n            templates.gcell = new Ext.XTemplate(\n                '<td class=\"x-grid3-hd x-grid3-gcell x-grid3-td-{id} ux-grid-hd-group-row-{row} ' + this.colHeaderCellCls + '\" style=\"{style}\">',\n                    '<div {tooltip} class=\"x-grid3-hd-inner x-grid3-hd-{id} x-unselectable\" unselectable=\"on\" style=\"{istyle}\">', \n                        this.grid.enableHdMenu ? '<a class=\"x-grid3-hd-btn\" href=\"#\"></a>' : '', '{value}',\n                    '</div>',\n                '</td>'\n            );\n        }\n        \n        this.templates = templates;\n        this.hrowRe = new RegExp(\"ux-grid-hd-group-row-(\\\\d+)\", \"\");\n    },\n    \n    /**\n     * @private\n     * Sets up the reference to the row headers element\n     */\n    initElements: function() {\n        Ext.grid.PivotGridView.superclass.initElements.apply(this, arguments);\n        \n        /**\n         * @property rowHeadersEl\n         * @type Ext.Element\n         * The element containing all row headers\n         */\n        this.rowHeadersEl = new Ext.Element(this.scroller.child('div.x-grid3-row-headers'));\n        \n        /**\n         * @property headerTitleEl\n         * @type Ext.Element\n         * The element that contains the optional title (top left section of the pivot grid)\n         */\n        this.headerTitleEl = new Ext.Element(this.mainHd.child('div.x-grid3-header-title'));\n    },\n    \n    /**\n     * @private\n     * Takes row headers into account when calculating total available width\n     */\n    getGridInnerWidth: function() {\n        var previousWidth = Ext.grid.PivotGridView.superclass.getGridInnerWidth.apply(this, arguments);\n        \n        return previousWidth - this.getTotalRowHeaderWidth();\n    },\n    \n    /**\n     * Returns the total width of all row headers as specified by {@link #getRowHeaders}\n     * @return {Number} The total width\n     */\n    getTotalRowHeaderWidth: function() {\n        var headers = this.getRowHeaders(),\n            length  = headers.length,\n            total   = 0,\n            i;\n        \n        for (i = 0; i< length; i++) {\n            total += headers[i].width;\n        }\n        \n        return total;\n    },\n    \n    /**\n     * @private\n     * Returns the total height of all column headers\n     * @return {Number} The total height\n     */\n    getTotalColumnHeaderHeight: function() {\n        return this.getColumnHeaders().length * 21;\n    },\n    \n    /**\n     * Inherit docs\n     * @private\n     * @param {HTMLElement} el\n     */\n    getCellIndex : function(el) {\n        if (el) {\n            var match = el.className.match(this.colRe),\n                data;\n \n            if (match && (data = match[1])) {\n                return parseInt(data.split('-')[1], 10);\n            }\n        }\n        return false;\n    },\n    \n    \n    /**\n     * @private\n     * Slight specialisation of the GridView renderUI - just adds the row headers\n     */\n    renderUI : function() {\n        var templates  = this.templates,\n            innerWidth = this.getGridInnerWidth();\n            \n        return templates.master.apply({\n            body  : templates.body.apply({rows:'&#160;'}),\n            ostyle: 'width:' + innerWidth + 'px',\n            bstyle: 'width:' + innerWidth + 'px'\n        });\n    },\n    \n    /**\n     * @private\n     * Make sure that the headers and rows are all sized correctly during layout\n     */\n    onLayout: function(width, height) {\n        Ext.grid.PivotGridView.superclass.onLayout.apply(this, arguments);\n        \n        var width = this.getGridInnerWidth();\n        \n        this.resizeColumnHeaders(width);\n        this.resizeAllRows(width);\n    },\n    \n    /**\n     * Refreshs the grid UI\n     * @param {Boolean} headersToo (optional) True to also refresh the headers\n     */\n    refresh : function(headersToo) {\n        this.fireEvent('beforerefresh', this);\n        this.grid.stopEditing(true);\n        \n        var result = this.renderBody();\n        this.mainBody.update(result).setWidth(this.getGridInnerWidth());\n        if (headersToo === true) {\n            this.updateHeaders();\n            this.updateHeaderSortState();\n        }\n        this.processRows(0, true);\n        this.layout();\n        this.applyEmptyText();\n        this.fireEvent('refresh', this);\n    },\n    \n    /**\n     * @private\n     * Bypasses GridView's renderHeaders as they are taken care of separately by the PivotAxis instances\n     */\n    renderHeaders: Ext.emptyFn,\n    \n    /**\n     * @private\n     * Taken care of by PivotAxis\n     */\n    fitColumns: Ext.emptyFn,\n    \n    /**\n     * @private\n     * Called on layout, ensures that the width of each column header is correct. Omitting this can lead to faulty\n     * layouts when nested in a container.\n     * @param {Number} width The new width\n     */\n    resizeColumnHeaders: function(width) {\n        var topAxis = this.grid.topAxis;\n        \n        if (topAxis.rendered) {\n            topAxis.el.setWidth(width);\n        }\n    },\n    \n    /**\n     * @private\n     * Sets the row header div to the correct width. Should be called after rendering and reconfiguration of headers\n     */\n    resizeRowHeaders: function() {\n        var rowHeaderWidth = this.getTotalRowHeaderWidth(),\n            marginStyle    = String.format(\"margin-left: {0}px;\", rowHeaderWidth);\n        \n        this.rowHeadersEl.setWidth(rowHeaderWidth);\n        this.mainBody.applyStyles(marginStyle);\n        Ext.fly(this.innerHd).applyStyles(marginStyle);\n        \n        this.headerTitleEl.setWidth(rowHeaderWidth);\n        this.headerTitleEl.setHeight(this.getTotalColumnHeaderHeight());\n    },\n    \n    /**\n     * @private\n     * Resizes all rendered rows to the given width. Usually called by onLayout\n     * @param {Number} width The new width\n     */\n    resizeAllRows: function(width) {\n        var rows   = this.getRows(),\n            length = rows.length,\n            i;\n        \n        for (i = 0; i < length; i++) {\n            Ext.fly(rows[i]).setWidth(width);\n            Ext.fly(rows[i]).child('table').setWidth(width);\n        }\n    },\n    \n    /**\n     * @private\n     * Updates the Row Headers, deferring the updating of Column Headers to GridView\n     */\n    updateHeaders: function() {\n        this.renderGroupRowHeaders();\n        this.renderGroupColumnHeaders();\n    },\n    \n    /**\n     * @private\n     * Renders all row header groups at all levels based on the structure fetched from {@link #getGroupRowHeaders}\n     */\n    renderGroupRowHeaders: function() {\n        var leftAxis = this.grid.leftAxis;\n        \n        this.resizeRowHeaders();\n        leftAxis.rendered = false;\n        leftAxis.render(this.rowHeadersEl);\n        \n        this.setTitle(this.title);\n    },\n    \n    /**\n     * Sets the title text in the top left segment of the PivotGridView\n     * @param {String} title The title\n     */\n    setTitle: function(title) {\n        this.headerTitleEl.child('span').dom.innerHTML = title;\n    },\n    \n    /**\n     * @private\n     * Renders all column header groups at all levels based on the structure fetched from {@link #getColumnHeaders}\n     */\n    renderGroupColumnHeaders: function() {\n        var topAxis = this.grid.topAxis;\n        \n        topAxis.rendered = false;\n        topAxis.render(this.innerHd.firstChild);\n    },\n    \n    /**\n     * @private\n     * Overridden to test whether the user is hovering over a group cell, in which case we don't show the menu\n     */\n    isMenuDisabled: function(cellIndex, el) {\n        return true;\n    }\n});/**\n * @class Ext.grid.PivotAxis\n * @extends Ext.Component\n * <p>PivotAxis is a class that supports a {@link Ext.grid.PivotGrid}. Each PivotGrid contains two PivotAxis instances - the left\n * axis and the top axis. Each PivotAxis defines an ordered set of dimensions, each of which should correspond to a field in a\n * Store's Record (see {@link Ext.grid.PivotGrid} documentation for further explanation).</p>\n * <p>Developers should have little interaction with the PivotAxis instances directly as most of their management is performed by\n * the PivotGrid. An exception is the dynamic reconfiguration of axes at run time - to achieve this we use PivotAxis's \n * {@link #setDimensions} function and refresh the grid:</p>\n<pre><code>\nvar pivotGrid = new Ext.grid.PivotGrid({\n    //some PivotGrid config here\n});\n\n//change the left axis dimensions\npivotGrid.leftAxis.setDimensions([\n    {\n        dataIndex: 'person',\n        direction: 'DESC',\n        width    : 100\n    },\n    {\n        dataIndex: 'product',\n        direction: 'ASC',\n        width    : 80\n    }\n]);\n\npivotGrid.view.refresh(true);\n</code></pre>\n * This clears the previous dimensions on the axis and redraws the grid with the new dimensions.\n */\nExt.grid.PivotAxis = Ext.extend(Ext.Component, {\n    /**\n     * @cfg {String} orientation One of 'vertical' or 'horizontal'. Defaults to horizontal\n     */\n    orientation: 'horizontal',\n    \n    /**\n     * @cfg {Number} defaultHeaderWidth The width to render each row header that does not have a width specified via \n     {@link #getRowGroupHeaders}. Defaults to 80.\n     */\n    defaultHeaderWidth: 80,\n    \n    /**\n     * @private\n     * @cfg {Number} paddingWidth The amount of padding used by each cell.\n     * TODO: From 4.x onwards this can be removed as it won't be needed. For now it is used to account for the differences between\n     * the content box and border box measurement models\n     */\n    paddingWidth: 7,\n    \n    /**\n     * Updates the dimensions used by this axis\n     * @param {Array} dimensions The new dimensions\n     */\n    setDimensions: function(dimensions) {\n        this.dimensions = dimensions;\n    },\n    \n    /**\n     * @private\n     * Builds the html table that contains the dimensions for this axis. This branches internally between vertical\n     * and horizontal orientations because the table structure is slightly different in each case\n     */\n    onRender: function(ct, position) {\n        var rows = this.orientation == 'horizontal'\n                 ? this.renderHorizontalRows()\n                 : this.renderVerticalRows();\n        \n        this.el = Ext.DomHelper.overwrite(ct.dom, {tag: 'table', cn: rows}, true);\n    },\n    \n    /**\n     * @private\n     * Specialised renderer for horizontal oriented axes\n     * @return {Object} The HTML Domspec for a horizontal oriented axis\n     */\n    renderHorizontalRows: function() {\n        var headers  = this.buildHeaders(),\n            rowCount = headers.length,\n            rows     = [],\n            cells, cols, colCount, i, j;\n        \n        for (i = 0; i < rowCount; i++) {\n            cells = [];\n            cols  = headers[i].items;\n            colCount = cols.length;\n\n            for (j = 0; j < colCount; j++) {\n                cells.push({\n                    tag: 'td',\n                    html: cols[j].header,\n                    colspan: cols[j].span\n                });\n            }\n\n            rows[i] = {\n                tag: 'tr',\n                cn: cells\n            };\n        }\n        \n        return rows;\n    },\n    \n    /**\n     * @private\n     * Specialised renderer for vertical oriented axes\n     * @return {Object} The HTML Domspec for a vertical oriented axis\n     */\n    renderVerticalRows: function() {\n        var headers  = this.buildHeaders(),\n            colCount = headers.length,\n            rowCells = [],\n            rows     = [],\n            rowCount, col, row, colWidth, i, j;\n        \n        for (i = 0; i < colCount; i++) {\n            col = headers[i];\n            colWidth = col.width || 80;\n            rowCount = col.items.length;\n            \n            for (j = 0; j < rowCount; j++) {\n                row = col.items[j];\n                \n                rowCells[row.start] = rowCells[row.start] || [];\n                rowCells[row.start].push({\n                    tag    : 'td',\n                    html   : row.header,\n                    rowspan: row.span,\n                    width  : Ext.isBorderBox ? colWidth : colWidth - this.paddingWidth\n                });\n            }\n        }\n        \n        rowCount = rowCells.length;\n        for (i = 0; i < rowCount; i++) {\n            rows[i] = {\n                tag: 'tr',\n                cn : rowCells[i]\n            };\n        }\n        \n        return rows;\n    },\n    \n    /**\n     * @private\n     * Returns the set of all unique tuples based on the bound store and dimension definitions.\n     * Internally we construct a new, temporary store to make use of the multi-sort capabilities of Store. In\n     * 4.x this functionality should have been moved to MixedCollection so this step should not be needed.\n     * @return {Array} All unique tuples\n     */\n    getTuples: function() {\n        var newStore = new Ext.data.Store({});\n        \n        newStore.data = this.store.data.clone();\n        newStore.fields = this.store.fields;\n        \n        var sorters    = [],\n            dimensions = this.dimensions,\n            length     = dimensions.length,\n            i;\n        \n        for (i = 0; i < length; i++) {\n            sorters.push({\n                field    : dimensions[i].dataIndex,\n                direction: dimensions[i].direction || 'ASC'\n            });\n        }\n        \n        newStore.sort(sorters);\n        \n        var records = newStore.data.items,\n            hashes  = [],\n            tuples  = [],\n            recData, hash, info, data, key;\n        \n        length = records.length;\n        \n        for (i = 0; i < length; i++) {\n            info = this.getRecordInfo(records[i]);\n            data = info.data;\n            hash = \"\";\n            \n            for (key in data) {\n                hash += data[key] + '---';\n            }\n            \n            if (hashes.indexOf(hash) == -1) {\n                hashes.push(hash);\n                tuples.push(info);\n            }\n        }\n        \n        newStore.destroy();\n        \n        return tuples;\n    },\n    \n    /**\n     * @private\n     */\n    getRecordInfo: function(record) {\n        var dimensions = this.dimensions,\n            length  = dimensions.length,\n            data    = {},\n            dimension, dataIndex, i;\n        \n        //get an object containing just the data we are interested in based on the configured dimensions\n        for (i = 0; i < length; i++) {\n            dimension = dimensions[i];\n            dataIndex = dimension.dataIndex;\n            \n            data[dataIndex] = record.get(dataIndex);\n        }\n        \n        //creates a specialised matcher function for a given tuple. The returned function will return\n        //true if the record passed to it matches the dataIndex values of each dimension in this axis\n        var createMatcherFunction = function(data) {\n            return function(record) {\n                for (var dataIndex in data) {\n                    if (record.get(dataIndex) != data[dataIndex]) {\n                        return false;\n                    }\n                }\n                \n                return true;\n            };\n        };\n        \n        return {\n            data: data,\n            matcher: createMatcherFunction(data)\n        };\n    },\n    \n    /**\n     * @private\n     * Uses the calculated set of tuples to build an array of headers that can be rendered into a table using rowspan or\n     * colspan. Basically this takes the set of tuples and spans any cells that run into one another, so if we had dimensions\n     * of Person and Product and several tuples containing different Products for the same Person, those Products would be\n     * spanned.\n     * @return {Array} The headers\n     */\n    buildHeaders: function() {\n        var tuples     = this.getTuples(),\n            rowCount   = tuples.length,\n            dimensions = this.dimensions,\n            dimension,\n            colCount   = dimensions.length,\n            headers    = [],\n            tuple, rows, currentHeader, previousHeader, span, start, isLast, changed, i, j;\n        \n        for (i = 0; i < colCount; i++) {\n            dimension = dimensions[i];\n            rows  = [];\n            span  = 0;\n            start = 0;\n            \n            for (j = 0; j < rowCount; j++) {\n                tuple  = tuples[j];\n                isLast = j == (rowCount - 1);\n                currentHeader = tuple.data[dimension.dataIndex];\n                \n                /*\n                 * 'changed' indicates that we need to create a new cell. This should be true whenever the cell\n                 * above (previousHeader) is different from this cell, or when the cell on the previous dimension\n                 * changed (e.g. if the current dimension is Product and the previous was Person, we need to start\n                 * a new cell if Product is the same but Person changed, so we check the previous dimension and tuple)\n                 */\n                changed = previousHeader != undefined && previousHeader != currentHeader;\n                if (i > 0 && j > 0) {\n                    changed = changed || tuple.data[dimensions[i-1].dataIndex] != tuples[j-1].data[dimensions[i-1].dataIndex];\n                }\n                \n                if (changed) {                    \n                    rows.push({\n                        header: previousHeader,\n                        span  : span,\n                        start : start\n                    });\n                    \n                    start += span;\n                    span = 0;\n                }\n                \n                if (isLast) {\n                    rows.push({\n                        header: currentHeader,\n                        span  : span + 1,\n                        start : start\n                    });\n                    \n                    start += span;\n                    span = 0;\n                }\n                \n                previousHeader = currentHeader;\n                span++;\n            }\n            \n            headers.push({\n                items: rows,\n                width: dimension.width || this.defaultHeaderWidth\n            });\n            \n            previousHeader = undefined;\n        }\n        \n        return headers;\n    }\n});\n// private\n// This is a support class used internally by the Grid components\nExt.grid.HeaderDragZone = Ext.extend(Ext.dd.DragZone, {\n    maxDragWidth: 120,\n    \n    constructor : function(grid, hd, hd2){\n        this.grid = grid;\n        this.view = grid.getView();\n        this.ddGroup = \"gridHeader\" + this.grid.getGridEl().id;\n        Ext.grid.HeaderDragZone.superclass.constructor.call(this, hd);\n        if(hd2){\n            this.setHandleElId(Ext.id(hd));\n            this.setOuterHandleElId(Ext.id(hd2));\n        }\n        this.scroll = false;\n    },\n    \n    getDragData : function(e){\n        var t = Ext.lib.Event.getTarget(e),\n            h = this.view.findHeaderCell(t);\n        if(h){\n            return {ddel: h.firstChild, header:h};\n        }\n        return false;\n    },\n\n    onInitDrag : function(e){\n        // keep the value here so we can restore it;\n        this.dragHeadersDisabled = this.view.headersDisabled;\n        this.view.headersDisabled = true;\n        var clone = this.dragData.ddel.cloneNode(true);\n        clone.id = Ext.id();\n        clone.style.width = Math.min(this.dragData.header.offsetWidth,this.maxDragWidth) + \"px\";\n        this.proxy.update(clone);\n        return true;\n    },\n\n    afterValidDrop : function(){\n        this.completeDrop();\n    },\n\n    afterInvalidDrop : function(){\n        this.completeDrop();\n    },\n    \n    completeDrop: function(){\n        var v = this.view,\n            disabled = this.dragHeadersDisabled;\n        setTimeout(function(){\n            v.headersDisabled = disabled;\n        }, 50);\n    }\n});\n\n// private\n// This is a support class used internally by the Grid components\nExt.grid.HeaderDropZone = Ext.extend(Ext.dd.DropZone, {\n    proxyOffsets : [-4, -9],\n    fly: Ext.Element.fly,\n    \n    constructor : function(grid, hd, hd2){\n        this.grid = grid;\n        this.view = grid.getView();\n        // split the proxies so they don't interfere with mouse events\n        this.proxyTop = Ext.DomHelper.append(document.body, {\n            cls:\"col-move-top\", html:\"&#160;\"\n        }, true);\n        this.proxyBottom = Ext.DomHelper.append(document.body, {\n            cls:\"col-move-bottom\", html:\"&#160;\"\n        }, true);\n        this.proxyTop.hide = this.proxyBottom.hide = function(){\n            this.setLeftTop(-100,-100);\n            this.setStyle(\"visibility\", \"hidden\");\n        };\n        this.ddGroup = \"gridHeader\" + this.grid.getGridEl().id;\n        // temporarily disabled\n        //Ext.dd.ScrollManager.register(this.view.scroller.dom);\n        Ext.grid.HeaderDropZone.superclass.constructor.call(this, grid.getGridEl().dom);\n    },\n\n    getTargetFromEvent : function(e){\n        var t = Ext.lib.Event.getTarget(e),\n            cindex = this.view.findCellIndex(t);\n        if(cindex !== false){\n            return this.view.getHeaderCell(cindex);\n        }\n    },\n\n    nextVisible : function(h){\n        var v = this.view, cm = this.grid.colModel;\n        h = h.nextSibling;\n        while(h){\n            if(!cm.isHidden(v.getCellIndex(h))){\n                return h;\n            }\n            h = h.nextSibling;\n        }\n        return null;\n    },\n\n    prevVisible : function(h){\n        var v = this.view, cm = this.grid.colModel;\n        h = h.prevSibling;\n        while(h){\n            if(!cm.isHidden(v.getCellIndex(h))){\n                return h;\n            }\n            h = h.prevSibling;\n        }\n        return null;\n    },\n\n    positionIndicator : function(h, n, e){\n        var x = Ext.lib.Event.getPageX(e),\n            r = Ext.lib.Dom.getRegion(n.firstChild),\n            px, \n            pt, \n            py = r.top + this.proxyOffsets[1];\n        if((r.right - x) <= (r.right-r.left)/2){\n            px = r.right+this.view.borderWidth;\n            pt = \"after\";\n        }else{\n            px = r.left;\n            pt = \"before\";\n        }\n\n        if(this.grid.colModel.isFixed(this.view.getCellIndex(n))){\n            return false;\n        }\n\n        px +=  this.proxyOffsets[0];\n        this.proxyTop.setLeftTop(px, py);\n        this.proxyTop.show();\n        if(!this.bottomOffset){\n            this.bottomOffset = this.view.mainHd.getHeight();\n        }\n        this.proxyBottom.setLeftTop(px, py+this.proxyTop.dom.offsetHeight+this.bottomOffset);\n        this.proxyBottom.show();\n        return pt;\n    },\n\n    onNodeEnter : function(n, dd, e, data){\n        if(data.header != n){\n            this.positionIndicator(data.header, n, e);\n        }\n    },\n\n    onNodeOver : function(n, dd, e, data){\n        var result = false;\n        if(data.header != n){\n            result = this.positionIndicator(data.header, n, e);\n        }\n        if(!result){\n            this.proxyTop.hide();\n            this.proxyBottom.hide();\n        }\n        return result ? this.dropAllowed : this.dropNotAllowed;\n    },\n\n    onNodeOut : function(n, dd, e, data){\n        this.proxyTop.hide();\n        this.proxyBottom.hide();\n    },\n\n    onNodeDrop : function(n, dd, e, data){\n        var h = data.header;\n        if(h != n){\n            var cm = this.grid.colModel,\n                x = Ext.lib.Event.getPageX(e),\n                r = Ext.lib.Dom.getRegion(n.firstChild),\n                pt = (r.right - x) <= ((r.right-r.left)/2) ? \"after\" : \"before\",\n                oldIndex = this.view.getCellIndex(h),\n                newIndex = this.view.getCellIndex(n);\n            if(pt == \"after\"){\n                newIndex++;\n            }\n            if(oldIndex < newIndex){\n                newIndex--;\n            }\n            cm.moveColumn(oldIndex, newIndex);\n            return true;\n        }\n        return false;\n    }\n});\n\nExt.grid.GridView.ColumnDragZone = Ext.extend(Ext.grid.HeaderDragZone, {\n    \n    constructor : function(grid, hd){\n        Ext.grid.GridView.ColumnDragZone.superclass.constructor.call(this, grid, hd, null);\n        this.proxy.el.addClass('x-grid3-col-dd');\n    },\n    \n    handleMouseDown : function(e){\n    },\n\n    callHandleMouseDown : function(e){\n        Ext.grid.GridView.ColumnDragZone.superclass.handleMouseDown.call(this, e);\n    }\n});// private\n// This is a support class used internally by the Grid components\nExt.grid.SplitDragZone = Ext.extend(Ext.dd.DDProxy, {\n    fly: Ext.Element.fly,\n    \n    constructor : function(grid, hd, hd2){\n        this.grid = grid;\n        this.view = grid.getView();\n        this.proxy = this.view.resizeProxy;\n        Ext.grid.SplitDragZone.superclass.constructor.call(this, hd,\n            \"gridSplitters\" + this.grid.getGridEl().id, {\n            dragElId : Ext.id(this.proxy.dom), resizeFrame:false\n        });\n        this.setHandleElId(Ext.id(hd));\n        this.setOuterHandleElId(Ext.id(hd2));\n        this.scroll = false;\n    },\n\n    b4StartDrag : function(x, y){\n        this.view.headersDisabled = true;\n        this.proxy.setHeight(this.view.mainWrap.getHeight());\n        var w = this.cm.getColumnWidth(this.cellIndex);\n        var minw = Math.max(w-this.grid.minColumnWidth, 0);\n        this.resetConstraints();\n        this.setXConstraint(minw, 1000);\n        this.setYConstraint(0, 0);\n        this.minX = x - minw;\n        this.maxX = x + 1000;\n        this.startPos = x;\n        Ext.dd.DDProxy.prototype.b4StartDrag.call(this, x, y);\n    },\n\n\n    handleMouseDown : function(e){\n        var ev = Ext.EventObject.setEvent(e);\n        var t = this.fly(ev.getTarget());\n        if(t.hasClass(\"x-grid-split\")){\n            this.cellIndex = this.view.getCellIndex(t.dom);\n            this.split = t.dom;\n            this.cm = this.grid.colModel;\n            if(this.cm.isResizable(this.cellIndex) && !this.cm.isFixed(this.cellIndex)){\n                Ext.grid.SplitDragZone.superclass.handleMouseDown.apply(this, arguments);\n            }\n        }\n    },\n\n    endDrag : function(e){\n        this.view.headersDisabled = false;\n        var endX = Math.max(this.minX, Ext.lib.Event.getPageX(e));\n        var diff = endX - this.startPos;\n        this.view.onColumnSplitterMoved(this.cellIndex, this.cm.getColumnWidth(this.cellIndex)+diff);\n    },\n\n    autoOffset : function(){\n        this.setDelta(0,0);\n    }\n});/**\n * @class Ext.grid.GridDragZone\n * @extends Ext.dd.DragZone\n * <p>A customized implementation of a {@link Ext.dd.DragZone DragZone} which provides default implementations of two of the\n * template methods of DragZone to enable dragging of the selected rows of a GridPanel.</p>\n * <p>A cooperating {@link Ext.dd.DropZone DropZone} must be created who's template method implementations of\n * {@link Ext.dd.DropZone#onNodeEnter onNodeEnter}, {@link Ext.dd.DropZone#onNodeOver onNodeOver},\n * {@link Ext.dd.DropZone#onNodeOut onNodeOut} and {@link Ext.dd.DropZone#onNodeDrop onNodeDrop}</p> are able\n * to process the {@link #getDragData data} which is provided.\n */\nExt.grid.GridDragZone = function(grid, config){\n    this.view = grid.getView();\n    Ext.grid.GridDragZone.superclass.constructor.call(this, this.view.mainBody.dom, config);\n    this.scroll = false;\n    this.grid = grid;\n    this.ddel = document.createElement('div');\n    this.ddel.className = 'x-grid-dd-wrap';\n    // prevent the default action, but don't stop propagation\n    this.preventDefault = true;\n};\n\nExt.extend(Ext.grid.GridDragZone, Ext.dd.DragZone, {\n    ddGroup : \"GridDD\",\n\n    /**\n     * <p>The provided implementation of the getDragData method which collects the data to be dragged from the GridPanel on mousedown.</p>\n     * <p>This data is available for processing in the {@link Ext.dd.DropZone#onNodeEnter onNodeEnter}, {@link Ext.dd.DropZone#onNodeOver onNodeOver},\n     * {@link Ext.dd.DropZone#onNodeOut onNodeOut} and {@link Ext.dd.DropZone#onNodeDrop onNodeDrop} methods of a cooperating {@link Ext.dd.DropZone DropZone}.</p>\n     * <p>The data object contains the following properties:<ul>\n     * <li><b>grid</b> : Ext.Grid.GridPanel<div class=\"sub-desc\">The GridPanel from which the data is being dragged.</div></li>\n     * <li><b>ddel</b> : htmlElement<div class=\"sub-desc\">An htmlElement which provides the \"picture\" of the data being dragged.</div></li>\n     * <li><b>rowIndex</b> : Number<div class=\"sub-desc\">The index of the row which receieved the mousedown gesture which triggered the drag.</div></li>\n     * <li><b>selections</b> : Array<div class=\"sub-desc\">Array of the selected Records which are being dragged from the GridPanel.\n     * Unless a CellSelectionModel is being used and the grid is configured <code>dragCell: true</code>, in which case, this will be\n     * an Array containing the single selected cell data as <code>[rowIndex, cellIndex]</code>.</div></li>\n     * </ul></p>\n     */\n    getDragData : function(e){\n        var t = Ext.lib.Event.getTarget(e),\n            sm,\n            rowIndex = this.view.findRowIndex(t),\n            cellIndex,\n            selectedCell,\n            selection;\n\n        if (rowIndex !== false){\n            sm = this.grid.selModel;\n\n            // Handle mousedown on unselected items (depending on what kind of selection we are using)\n            // Select the mousedowned item\n            if (sm.getSelectedCell) {\n                cellIndex = this.view.findCellIndex(t);\n                selectedCell = sm.getSelectedCell();\n                if (!selectedCell || selectedCell[0] !== rowIndex || selectedCell[1] !== cellIndex) {\n                    sm.handleMouseDown(this.grid, rowIndex, cellIndex, e);\n                }\n                if (this.grid.dragCell) {\n                    // Selection is the cell coordinates\n                    selection = sm.getSelectedCell();\n                    if (!this.grid.hasOwnProperty('ddText')) {\n                        this.grid.ddText = '{0} selected cell{1}';\n                    }\n                } else {\n                    // Selection is the mousedowned row\n                    selection = [this.grid.store.getAt(rowIndex)];\n                }\n            } else {\n                if(!sm.isSelected(rowIndex) || e.hasModifier()){\n                    sm.handleMouseDown(this.grid, rowIndex, e);\n                }\n                selection = sm.getSelections();\n            }\n            return {grid: this.grid, ddel: this.ddel, rowIndex: rowIndex, selections: selection};\n        }\n        return false;\n    },\n\n    /**\n     * <p>The provided implementation of the onInitDrag method. Sets the <tt>innerHTML</tt> of the drag proxy which provides the \"picture\"\n     * of the data being dragged.</p>\n     * <p>The <tt>innerHTML</tt> data is found by calling the owning GridPanel's {@link Ext.grid.GridPanel#getDragDropText getDragDropText}.</p>\n     */\n    onInitDrag : function(e){\n        var data = this.dragData;\n        this.ddel.innerHTML = this.grid.getDragDropText();\n        this.proxy.update(this.ddel);\n        // fire start drag?\n    },\n\n    /**\n     * An empty immplementation. Implement this to provide behaviour after a repair of an invalid drop. An implementation might highlight\n     * the selected rows to show that they have not been dragged.\n     */\n    afterRepair : function(){\n        this.dragging = false;\n    },\n\n    /**\n     * <p>An empty implementation. Implement this to provide coordinates for the drag proxy to slide back to after an invalid drop.</p>\n     * <p>Called before a repair of an invalid drop to get the XY to animate to.</p>\n     * @param {EventObject} e The mouse up event\n     * @return {Array} The xy location (e.g. [100, 200])\n     */\n    getRepairXY : function(e, data){\n        return false;\n    },\n\n    onEndDrag : function(data, e){\n        // fire end drag?\n    },\n\n    onValidDrop : function(dd, e, id){\n        // fire drag drop?\n        this.hideProxy();\n    },\n\n    beforeInvalidDrop : function(e, id){\n\n    }\n});\n/**\n * @class Ext.grid.ColumnModel\n * @extends Ext.util.Observable\n * <p>After the data has been read into the client side cache (<b>{@link Ext.data.Store Store}</b>),\n * the ColumnModel is used to configure how and what parts of that data will be displayed in the\n * vertical slices (columns) of the grid. The Ext.grid.ColumnModel Class is the default implementation\n * of a ColumnModel used by implentations of {@link Ext.grid.GridPanel GridPanel}.</p>\n * <p>Data is mapped into the store's records and then indexed into the ColumnModel using the\n * <tt>{@link Ext.grid.Column#dataIndex dataIndex}</tt>:</p>\n * <pre><code>\n{data source} == mapping ==> {data store} == <b><tt>{@link Ext.grid.Column#dataIndex dataIndex}</tt></b> ==> {ColumnModel}\n * </code></pre>\n * <p>Each {@link Ext.grid.Column Column} in the grid's ColumnModel is configured with a\n * <tt>{@link Ext.grid.Column#dataIndex dataIndex}</tt> to specify how the data within\n * each record in the store is indexed into the ColumnModel.</p>\n * <p>There are two ways to initialize the ColumnModel class:</p>\n * <p><u>Initialization Method 1: an Array</u></p>\n<pre><code>\n var colModel = new Ext.grid.ColumnModel([\n    { header: \"Ticker\", width: 60, sortable: true},\n    { header: \"Company Name\", width: 150, sortable: true, id: 'company'},\n    { header: \"Market Cap.\", width: 100, sortable: true},\n    { header: \"$ Sales\", width: 100, sortable: true, renderer: money},\n    { header: \"Employees\", width: 100, sortable: true, resizable: false}\n ]);\n </code></pre>\n * <p>The ColumnModel may be initialized with an Array of {@link Ext.grid.Column} column configuration\n * objects to define the initial layout / display of the columns in the Grid. The order of each\n * {@link Ext.grid.Column} column configuration object within the specified Array defines the initial\n * order of the column display.  A Column's display may be initially hidden using the\n * <tt>{@link Ext.grid.Column#hidden hidden}</tt></b> config property (and then shown using the column\n * header menu).  Fields that are not included in the ColumnModel will not be displayable at all.</p>\n * <p>How each column in the grid correlates (maps) to the {@link Ext.data.Record} field in the\n * {@link Ext.data.Store Store} the column draws its data from is configured through the\n * <b><tt>{@link Ext.grid.Column#dataIndex dataIndex}</tt></b>.  If the\n * <b><tt>{@link Ext.grid.Column#dataIndex dataIndex}</tt></b> is not explicitly defined (as shown in the\n * example above) it will use the column configuration's index in the Array as the index.</p>\n * <p>See <b><tt>{@link Ext.grid.Column}</tt></b> for additional configuration options for each column.</p>\n * <p><u>Initialization Method 2: an Object</u></p>\n * <p>In order to use configuration options from <tt>Ext.grid.ColumnModel</tt>, an Object may be used to\n * initialize the ColumnModel.  The column configuration Array will be specified in the <tt><b>{@link #columns}</b></tt>\n * config property. The <tt><b>{@link #defaults}</b></tt> config property can be used to apply defaults\n * for all columns, e.g.:</p><pre><code>\n var colModel = new Ext.grid.ColumnModel({\n    columns: [\n        { header: \"Ticker\", width: 60, menuDisabled: false},\n        { header: \"Company Name\", width: 150, id: 'company'},\n        { header: \"Market Cap.\"},\n        { header: \"$ Sales\", renderer: money},\n        { header: \"Employees\", resizable: false}\n    ],\n    defaults: {\n        sortable: true,\n        menuDisabled: true,\n        width: 100\n    },\n    listeners: {\n        {@link #hiddenchange}: function(cm, colIndex, hidden) {\n            saveConfig(colIndex, hidden);\n        }\n    }\n});\n </code></pre>\n * <p>In both examples above, the ability to apply a CSS class to all cells in a column (including the\n * header) is demonstrated through the use of the <b><tt>{@link Ext.grid.Column#id id}</tt></b> config\n * option. This column could be styled by including the following css:</p><pre><code>\n //add this css *after* the core css is loaded\n.x-grid3-td-company {\n    color: red; // entire column will have red font\n}\n// modify the header row only, adding an icon to the column header\n.x-grid3-hd-company {\n    background: transparent\n        url(../../resources/images/icons/silk/building.png)\n        no-repeat 3px 3px ! important;\n        padding-left:20px;\n}\n </code></pre>\n * Note that the \"Company Name\" column could be specified as the\n * <b><tt>{@link Ext.grid.GridPanel}.{@link Ext.grid.GridPanel#autoExpandColumn autoExpandColumn}</tt></b>.\n * @constructor\n * @param {Mixed} config Specify either an Array of {@link Ext.grid.Column} configuration objects or specify\n * a configuration Object (see introductory section discussion utilizing Initialization Method 2 above).\n */\nExt.grid.ColumnModel = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Number} defaultWidth (optional) The width of columns which have no <tt>{@link #width}</tt>\n     * specified (defaults to <tt>100</tt>).  This property shall preferably be configured through the\n     * <tt><b>{@link #defaults}</b></tt> config property.\n     */\n    defaultWidth: 100,\n\n    /**\n     * @cfg {Boolean} defaultSortable (optional) Default sortable of columns which have no\n     * sortable specified (defaults to <tt>false</tt>).  This property shall preferably be configured\n     * through the <tt><b>{@link #defaults}</b></tt> config property.\n     */\n    defaultSortable: false,\n\n    /**\n     * @cfg {Array} columns An Array of object literals.  The config options defined by\n     * <b>{@link Ext.grid.Column}</b> are the options which may appear in the object literal for each\n     * individual column definition.\n     */\n\n    /**\n     * @cfg {Object} defaults Object literal which will be used to apply {@link Ext.grid.Column}\n     * configuration options to all <tt><b>{@link #columns}</b></tt>.  Configuration options specified with\n     * individual {@link Ext.grid.Column column} configs will supersede these <tt><b>{@link #defaults}</b></tt>.\n     */\n\n    constructor : function(config) {\n        /**\n\t     * An Array of {@link Ext.grid.Column Column definition} objects representing the configuration\n\t     * of this ColumnModel.  See {@link Ext.grid.Column} for the configuration properties that may\n\t     * be specified.\n\t     * @property config\n\t     * @type Array\n\t     */\n\t    if (config.columns) {\n\t        Ext.apply(this, config);\n\t        this.setConfig(config.columns, true);\n\t    } else {\n\t        this.setConfig(config, true);\n\t    }\n\t    \n\t    this.addEvents(\n\t        /**\n\t         * @event widthchange\n\t         * Fires when the width of a column is programmaticially changed using\n\t         * <code>{@link #setColumnWidth}</code>.\n\t         * Note internal resizing suppresses the event from firing. See also\n\t         * {@link Ext.grid.GridPanel}.<code>{@link #columnresize}</code>.\n\t         * @param {ColumnModel} this\n\t         * @param {Number} columnIndex The column index\n\t         * @param {Number} newWidth The new width\n\t         */\n\t        \"widthchange\",\n\t        \n\t        /**\n\t         * @event headerchange\n\t         * Fires when the text of a header changes.\n\t         * @param {ColumnModel} this\n\t         * @param {Number} columnIndex The column index\n\t         * @param {String} newText The new header text\n\t         */\n\t        \"headerchange\",\n\t        \n\t        /**\n\t         * @event hiddenchange\n\t         * Fires when a column is hidden or \"unhidden\".\n\t         * @param {ColumnModel} this\n\t         * @param {Number} columnIndex The column index\n\t         * @param {Boolean} hidden true if hidden, false otherwise\n\t         */\n\t        \"hiddenchange\",\n\t        \n\t        /**\n\t         * @event columnmoved\n\t         * Fires when a column is moved.\n\t         * @param {ColumnModel} this\n\t         * @param {Number} oldIndex\n\t         * @param {Number} newIndex\n\t         */\n\t        \"columnmoved\",\n\t        \n\t        /**\n\t         * @event configchange\n\t         * Fires when the configuration is changed\n\t         * @param {ColumnModel} this\n\t         */\n\t        \"configchange\"\n\t    );\n\t    \n\t    Ext.grid.ColumnModel.superclass.constructor.call(this);\n    },\n\n    /**\n     * Returns the id of the column at the specified index.\n     * @param {Number} index The column index\n     * @return {String} the id\n     */\n    getColumnId : function(index) {\n        return this.config[index].id;\n    },\n\n    getColumnAt : function(index) {\n        return this.config[index];\n    },\n\n    /**\n     * <p>Reconfigures this column model according to the passed Array of column definition objects.\n     * For a description of the individual properties of a column definition object, see the\n     * <a href=\"#Ext.grid.ColumnModel-configs\">Config Options</a>.</p>\n     * <p>Causes the {@link #configchange} event to be fired. A {@link Ext.grid.GridPanel GridPanel}\n     * using this ColumnModel will listen for this event and refresh its UI automatically.</p>\n     * @param {Array} config Array of Column definition objects.\n     * @param {Boolean} initial Specify <tt>true</tt> to bypass cleanup which deletes the <tt>totalWidth</tt>\n     * and destroys existing editors.\n     */\n    setConfig : function(config, initial) {\n        var i, c, len;\n        \n        if (!initial) { // cleanup\n            delete this.totalWidth;\n            \n            for (i = 0, len = this.config.length; i < len; i++) {\n                c = this.config[i];\n                \n                if (c.setEditor) {\n                    //check here, in case we have a special column like a CheckboxSelectionModel\n                    c.setEditor(null);\n                }\n            }\n        }\n\n        // backward compatibility\n        this.defaults = Ext.apply({\n            width: this.defaultWidth,\n            sortable: this.defaultSortable\n        }, this.defaults);\n\n        this.config = config;\n        this.lookup = {};\n\n        for (i = 0, len = config.length; i < len; i++) {\n            c = Ext.applyIf(config[i], this.defaults);\n            \n            // if no id, create one using column's ordinal position\n            if (Ext.isEmpty(c.id)) {\n                c.id = i;\n            }\n            \n            if (!c.isColumn) {\n                var Cls = Ext.grid.Column.types[c.xtype || 'gridcolumn'];\n                c = new Cls(c);\n                config[i] = c;\n            }\n            \n            this.lookup[c.id] = c;\n        }\n        \n        if (!initial) {\n            this.fireEvent('configchange', this);\n        }\n    },\n\n    /**\n     * Returns the column for a specified id.\n     * @param {String} id The column id\n     * @return {Object} the column\n     */\n    getColumnById : function(id) {\n        return this.lookup[id];\n    },\n\n    /**\n     * Returns the index for a specified column id.\n     * @param {String} id The column id\n     * @return {Number} the index, or -1 if not found\n     */\n    getIndexById : function(id) {\n        for (var i = 0, len = this.config.length; i < len; i++) {\n            if (this.config[i].id == id) {\n                return i;\n            }\n        }\n        return -1;\n    },\n\n    /**\n     * Moves a column from one position to another.\n     * @param {Number} oldIndex The index of the column to move.\n     * @param {Number} newIndex The position at which to reinsert the coolumn.\n     */\n    moveColumn : function(oldIndex, newIndex) {\n        var config = this.config,\n            c      = config[oldIndex];\n            \n        config.splice(oldIndex, 1);\n        config.splice(newIndex, 0, c);\n        this.dataMap = null;\n        this.fireEvent(\"columnmoved\", this, oldIndex, newIndex);\n    },\n\n    /**\n     * Returns the number of columns.\n     * @param {Boolean} visibleOnly Optional. Pass as true to only include visible columns.\n     * @return {Number}\n     */\n    getColumnCount : function(visibleOnly) {\n        var length = this.config.length,\n            c = 0,\n            i;\n        \n        if (visibleOnly === true) {\n            for (i = 0; i < length; i++) {\n                if (!this.isHidden(i)) {\n                    c++;\n                }\n            }\n            \n            return c;\n        }\n        \n        return length;\n    },\n\n    /**\n     * Returns the column configs that return true by the passed function that is called\n     * with (columnConfig, index)\n<pre><code>\n// returns an array of column config objects for all hidden columns\nvar columns = grid.getColumnModel().getColumnsBy(function(c){\n  return c.hidden;\n});\n</code></pre>\n     * @param {Function} fn A function which, when passed a {@link Ext.grid.Column Column} object, must\n     * return <code>true</code> if the column is to be included in the returned Array.\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function\n     * is executed. Defaults to this ColumnModel.\n     * @return {Array} result\n     */\n    getColumnsBy : function(fn, scope) {\n        var config = this.config,\n            length = config.length,\n            result = [],\n            i, c;\n            \n        for (i = 0; i < length; i++){\n            c = config[i];\n            \n            if (fn.call(scope || this, c, i) === true) {\n                result[result.length] = c;\n            }\n        }\n        \n        return result;\n    },\n\n    /**\n     * Returns true if the specified column is sortable.\n     * @param {Number} col The column index\n     * @return {Boolean}\n     */\n    isSortable : function(col) {\n        return !!this.config[col].sortable;\n    },\n\n    /**\n     * Returns true if the specified column menu is disabled.\n     * @param {Number} col The column index\n     * @return {Boolean}\n     */\n    isMenuDisabled : function(col) {\n        return !!this.config[col].menuDisabled;\n    },\n\n    /**\n     * Returns the rendering (formatting) function defined for the column.\n     * @param {Number} col The column index.\n     * @return {Function} The function used to render the cell. See {@link #setRenderer}.\n     */\n    getRenderer : function(col) {\n        return this.config[col].renderer || Ext.grid.ColumnModel.defaultRenderer;\n    },\n\n    getRendererScope : function(col) {\n        return this.config[col].scope;\n    },\n\n    /**\n     * Sets the rendering (formatting) function for a column.  See {@link Ext.util.Format} for some\n     * default formatting functions.\n     * @param {Number} col The column index\n     * @param {Function} fn The function to use to process the cell's raw data\n     * to return HTML markup for the grid view. The render function is called with\n     * the following parameters:<ul>\n     * <li><b>value</b> : Object<p class=\"sub-desc\">The data value for the cell.</p></li>\n     * <li><b>metadata</b> : Object<p class=\"sub-desc\">An object in which you may set the following attributes:<ul>\n     * <li><b>css</b> : String<p class=\"sub-desc\">A CSS class name to add to the cell's TD element.</p></li>\n     * <li><b>attr</b> : String<p class=\"sub-desc\">An HTML attribute definition string to apply to the data container element <i>within</i> the table cell\n     * (e.g. 'style=\"color:red;\"').</p></li></ul></p></li>\n     * <li><b>record</b> : Ext.data.record<p class=\"sub-desc\">The {@link Ext.data.Record} from which the data was extracted.</p></li>\n     * <li><b>rowIndex</b> : Number<p class=\"sub-desc\">Row index</p></li>\n     * <li><b>colIndex</b> : Number<p class=\"sub-desc\">Column index</p></li>\n     * <li><b>store</b> : Ext.data.Store<p class=\"sub-desc\">The {@link Ext.data.Store} object from which the Record was extracted.</p></li></ul>\n     */\n    setRenderer : function(col, fn) {\n        this.config[col].renderer = fn;\n    },\n\n    /**\n     * Returns the width for the specified column.\n     * @param {Number} col The column index\n     * @return {Number}\n     */\n    getColumnWidth : function(col) {\n        var width = this.config[col].width;\n        if(typeof width != 'number'){\n            width = this.defaultWidth;\n        }\n        return width;\n    },\n\n    /**\n     * Sets the width for a column.\n     * @param {Number} col The column index\n     * @param {Number} width The new width\n     * @param {Boolean} suppressEvent True to suppress firing the <code>{@link #widthchange}</code>\n     * event. Defaults to false.\n     */\n    setColumnWidth : function(col, width, suppressEvent) {\n        this.config[col].width = width;\n        this.totalWidth = null;\n        \n        if (!suppressEvent) {\n             this.fireEvent(\"widthchange\", this, col, width);\n        }\n    },\n\n    /**\n     * Returns the total width of all columns.\n     * @param {Boolean} includeHidden True to include hidden column widths\n     * @return {Number}\n     */\n    getTotalWidth : function(includeHidden) {\n        if (!this.totalWidth) {\n            this.totalWidth = 0;\n            for (var i = 0, len = this.config.length; i < len; i++) {\n                if (includeHidden || !this.isHidden(i)) {\n                    this.totalWidth += this.getColumnWidth(i);\n                }\n            }\n        }\n        return this.totalWidth;\n    },\n\n    /**\n     * Returns the header for the specified column.\n     * @param {Number} col The column index\n     * @return {String}\n     */\n    getColumnHeader : function(col) {\n        return this.config[col].header;\n    },\n\n    /**\n     * Sets the header for a column.\n     * @param {Number} col The column index\n     * @param {String} header The new header\n     */\n    setColumnHeader : function(col, header) {\n        this.config[col].header = header;\n        this.fireEvent(\"headerchange\", this, col, header);\n    },\n\n    /**\n     * Returns the tooltip for the specified column.\n     * @param {Number} col The column index\n     * @return {String}\n     */\n    getColumnTooltip : function(col) {\n            return this.config[col].tooltip;\n    },\n    /**\n     * Sets the tooltip for a column.\n     * @param {Number} col The column index\n     * @param {String} tooltip The new tooltip\n     */\n    setColumnTooltip : function(col, tooltip) {\n            this.config[col].tooltip = tooltip;\n    },\n\n    /**\n     * Returns the dataIndex for the specified column.\n<pre><code>\n// Get field name for the column\nvar fieldName = grid.getColumnModel().getDataIndex(columnIndex);\n</code></pre>\n     * @param {Number} col The column index\n     * @return {String} The column's dataIndex\n     */\n    getDataIndex : function(col) {\n        return this.config[col].dataIndex;\n    },\n\n    /**\n     * Sets the dataIndex for a column.\n     * @param {Number} col The column index\n     * @param {String} dataIndex The new dataIndex\n     */\n    setDataIndex : function(col, dataIndex) {\n        this.config[col].dataIndex = dataIndex;\n    },\n\n    /**\n     * Finds the index of the first matching column for the given dataIndex.\n     * @param {String} col The dataIndex to find\n     * @return {Number} The column index, or -1 if no match was found\n     */\n    findColumnIndex : function(dataIndex) {\n        var c = this.config;\n        for(var i = 0, len = c.length; i < len; i++){\n            if(c[i].dataIndex == dataIndex){\n                return i;\n            }\n        }\n        return -1;\n    },\n\n    /**\n     * Returns true if the cell is editable.\n<pre><code>\nvar store = new Ext.data.Store({...});\nvar colModel = new Ext.grid.ColumnModel({\n  columns: [...],\n  isCellEditable: function(col, row) {\n    var record = store.getAt(row);\n    if (record.get('readonly')) { // replace with your condition\n      return false;\n    }\n    return Ext.grid.ColumnModel.prototype.isCellEditable.call(this, col, row);\n  }\n});\nvar grid = new Ext.grid.GridPanel({\n  store: store,\n  colModel: colModel,\n  ...\n});\n</code></pre>\n     * @param {Number} colIndex The column index\n     * @param {Number} rowIndex The row index\n     * @return {Boolean}\n     */\n    isCellEditable : function(colIndex, rowIndex) {\n        var c = this.config[colIndex],\n            ed = c.editable;\n\n        //force boolean\n        return !!(ed || (!Ext.isDefined(ed) && c.editor));\n    },\n\n    /**\n     * Returns the editor defined for the cell/column.\n     * @param {Number} colIndex The column index\n     * @param {Number} rowIndex The row index\n     * @return {Ext.Editor} The {@link Ext.Editor Editor} that was created to wrap\n     * the {@link Ext.form.Field Field} used to edit the cell.\n     */\n    getCellEditor : function(colIndex, rowIndex) {\n        return this.config[colIndex].getCellEditor(rowIndex);\n    },\n\n    /**\n     * Sets if a column is editable.\n     * @param {Number} col The column index\n     * @param {Boolean} editable True if the column is editable\n     */\n    setEditable : function(col, editable) {\n        this.config[col].editable = editable;\n    },\n\n    /**\n     * Returns <tt>true</tt> if the column is <code>{@link Ext.grid.Column#hidden hidden}</code>,\n     * <tt>false</tt> otherwise.\n     * @param {Number} colIndex The column index\n     * @return {Boolean}\n     */\n    isHidden : function(colIndex) {\n        return !!this.config[colIndex].hidden; // ensure returns boolean\n    },\n\n    /**\n     * Returns <tt>true</tt> if the column is <code>{@link Ext.grid.Column#fixed fixed}</code>,\n     * <tt>false</tt> otherwise.\n     * @param {Number} colIndex The column index\n     * @return {Boolean}\n     */\n    isFixed : function(colIndex) {\n        return !!this.config[colIndex].fixed;\n    },\n\n    /**\n     * Returns true if the column can be resized\n     * @return {Boolean}\n     */\n    isResizable : function(colIndex) {\n        return colIndex >= 0 && this.config[colIndex].resizable !== false && this.config[colIndex].fixed !== true;\n    },\n    \n    /**\n     * Sets if a column is hidden.\n<pre><code>\nmyGrid.getColumnModel().setHidden(0, true); // hide column 0 (0 = the first column).\n</code></pre>\n     * @param {Number} colIndex The column index\n     * @param {Boolean} hidden True if the column is hidden\n     */\n    setHidden : function(colIndex, hidden) {\n        var c = this.config[colIndex];\n        if(c.hidden !== hidden){\n            c.hidden = hidden;\n            this.totalWidth = null;\n            this.fireEvent(\"hiddenchange\", this, colIndex, hidden);\n        }\n    },\n\n    /**\n     * Sets the editor for a column and destroys the prior editor.\n     * @param {Number} col The column index\n     * @param {Object} editor The editor object\n     */\n    setEditor : function(col, editor) {\n        this.config[col].setEditor(editor);\n    },\n\n    /**\n     * Destroys this column model by purging any event listeners. Destroys and dereferences all Columns.\n     */\n    destroy : function() {\n        var length = this.config.length,\n            i = 0;\n\n        for (; i < length; i++){\n            this.config[i].destroy(); // Column's destroy encapsulates all cleanup.\n        }\n        delete this.config;\n        delete this.lookup;\n        this.purgeListeners();\n    },\n\n    /**\n     * @private\n     * Setup any saved state for the column, ensures that defaults are applied.\n     */\n    setState : function(col, state) {\n        state = Ext.applyIf(state, this.defaults);\n        Ext.apply(this.config[col], state);\n    }\n});\n\n// private\nExt.grid.ColumnModel.defaultRenderer = function(value) {\n    if (typeof value == \"string\" && value.length < 1) {\n        return \"&#160;\";\n    }\n    return value;\n};/**\n * @class Ext.grid.AbstractSelectionModel\n * @extends Ext.util.Observable\n * Abstract base class for grid SelectionModels.  It provides the interface that should be\n * implemented by descendant classes.  This class should not be directly instantiated.\n * @constructor\n */\nExt.grid.AbstractSelectionModel = Ext.extend(Ext.util.Observable,  {\n    /**\n     * The GridPanel for which this SelectionModel is handling selection. Read-only.\n     * @type Object\n     * @property grid\n     */\n\n    constructor : function(){\n        this.locked = false;\n        Ext.grid.AbstractSelectionModel.superclass.constructor.call(this);\n    },\n\n    /** @ignore Called by the grid automatically. Do not call directly. */\n    init : function(grid){\n        this.grid = grid;\n        if(this.lockOnInit){\n            delete this.lockOnInit;\n            this.locked = false;\n            this.lock();\n        }\n        this.initEvents();\n    },\n\n    /**\n     * Locks the selections.\n     */\n    lock : function(){\n        if(!this.locked){\n            this.locked = true;\n            // If the grid has been set, then the view is already initialized.\n            var g = this.grid;\n            if(g){\n                g.getView().on({\n                    scope: this,\n                    beforerefresh: this.sortUnLock,\n                    refresh: this.sortLock\n                });\n            }else{\n                this.lockOnInit = true;\n            }\n        }\n    },\n\n    // set the lock states before and after a view refresh\n    sortLock : function() {\n        this.locked = true;\n    },\n\n    // set the lock states before and after a view refresh\n    sortUnLock : function() {\n        this.locked = false;\n    },\n\n    /**\n     * Unlocks the selections.\n     */\n    unlock : function(){\n        if(this.locked){\n            this.locked = false;\n            var g = this.grid,\n                gv;\n                \n            // If the grid has been set, then the view is already initialized.\n            if(g){\n                gv = g.getView();\n                gv.un('beforerefresh', this.sortUnLock, this);\n                gv.un('refresh', this.sortLock, this);    \n            }else{\n                delete this.lockOnInit;\n            }\n        }\n    },\n\n    /**\n     * Returns true if the selections are locked.\n     * @return {Boolean}\n     */\n    isLocked : function(){\n        return this.locked;\n    },\n\n    destroy: function(){\n        this.unlock();\n        this.purgeListeners();\n    }\n});/**\n * @class Ext.grid.RowSelectionModel\n * @extends Ext.grid.AbstractSelectionModel\n * The default SelectionModel used by {@link Ext.grid.GridPanel}.\n * It supports multiple selections and keyboard selection/navigation. The objects stored\n * as selections and returned by {@link #getSelected}, and {@link #getSelections} are\n * the {@link Ext.data.Record Record}s which provide the data for the selected rows.\n * @constructor\n * @param {Object} config\n */\nExt.grid.RowSelectionModel = Ext.extend(Ext.grid.AbstractSelectionModel,  {\n    /**\n     * @cfg {Boolean} singleSelect\n     * <tt>true</tt> to allow selection of only one row at a time (defaults to <tt>false</tt>\n     * allowing multiple selections)\n     */\n    singleSelect : false,\n    \n    constructor : function(config){\n        Ext.apply(this, config);\n        this.selections = new Ext.util.MixedCollection(false, function(o){\n            return o.id;\n        });\n\n        this.last = false;\n        this.lastActive = false;\n\n        this.addEvents(\n\t        /**\n\t         * @event selectionchange\n\t         * Fires when the selection changes\n\t         * @param {SelectionModel} this\n\t         */\n\t        'selectionchange',\n\t        /**\n\t         * @event beforerowselect\n\t         * Fires before a row is selected, return false to cancel the selection.\n\t         * @param {SelectionModel} this\n\t         * @param {Number} rowIndex The index to be selected\n\t         * @param {Boolean} keepExisting False if other selections will be cleared\n\t         * @param {Record} record The record to be selected\n\t         */\n\t        'beforerowselect',\n\t        /**\n\t         * @event rowselect\n\t         * Fires when a row is selected.\n\t         * @param {SelectionModel} this\n\t         * @param {Number} rowIndex The selected index\n\t         * @param {Ext.data.Record} r The selected record\n\t         */\n\t        'rowselect',\n\t        /**\n\t         * @event rowdeselect\n\t         * Fires when a row is deselected.  To prevent deselection\n\t         * {@link Ext.grid.AbstractSelectionModel#lock lock the selections}. \n\t         * @param {SelectionModel} this\n\t         * @param {Number} rowIndex\n\t         * @param {Record} record\n\t         */\n\t        'rowdeselect'\n        );\n        Ext.grid.RowSelectionModel.superclass.constructor.call(this);\n    },\n\n    /**\n     * @cfg {Boolean} moveEditorOnEnter\n     * <tt>false</tt> to turn off moving the editor to the next row down when the enter key is pressed\n     * or the next row up when shift + enter keys are pressed.\n     */\n    // private\n    initEvents : function(){\n\n        if(!this.grid.enableDragDrop && !this.grid.enableDrag){\n            this.grid.on('rowmousedown', this.handleMouseDown, this);\n        }\n\n        this.rowNav = new Ext.KeyNav(this.grid.getGridEl(), {\n            up: this.onKeyPress, \n            down: this.onKeyPress,\n            scope: this\n        });\n\n        this.grid.getView().on({\n            scope: this,\n            refresh: this.onRefresh,\n            rowupdated: this.onRowUpdated,\n            rowremoved: this.onRemove\n        });\n    },\n    \n    onKeyPress : function(e, name){\n        var up = name == 'up',\n            method = up ? 'selectPrevious' : 'selectNext',\n            add = up ? -1 : 1,\n            last;\n        if(!e.shiftKey || this.singleSelect){\n            this[method](false);\n        }else if(this.last !== false && this.lastActive !== false){\n            last = this.last;\n            this.selectRange(this.last,  this.lastActive + add);\n            this.grid.getView().focusRow(this.lastActive);\n            if(last !== false){\n                this.last = last;\n            }\n        }else{\n           this.selectFirstRow();\n        }\n    },\n\n    // private\n    onRefresh : function(){\n        var ds = this.grid.store,\n            s = this.getSelections(),\n            i = 0,\n            len = s.length, \n            index, r;\n            \n        this.silent = true;\n        this.clearSelections(true);\n        for(; i < len; i++){\n            r = s[i];\n            if((index = ds.indexOfId(r.id)) != -1){\n                this.selectRow(index, true);\n            }\n        }\n        if(s.length != this.selections.getCount()){\n            this.fireEvent('selectionchange', this);\n        }\n        this.silent = false;\n    },\n\n    // private\n    onRemove : function(v, index, r){\n        if(this.selections.remove(r) !== false){\n            this.fireEvent('selectionchange', this);\n        }\n    },\n\n    // private\n    onRowUpdated : function(v, index, r){\n        if(this.isSelected(r)){\n            v.onRowSelect(index);\n        }\n    },\n\n    /**\n     * Select records.\n     * @param {Array} records The records to select\n     * @param {Boolean} keepExisting (optional) <tt>true</tt> to keep existing selections\n     */\n    selectRecords : function(records, keepExisting){\n        if(!keepExisting){\n            this.clearSelections();\n        }\n        var ds = this.grid.store,\n            i = 0,\n            len = records.length;\n        for(; i < len; i++){\n            this.selectRow(ds.indexOf(records[i]), true);\n        }\n    },\n\n    /**\n     * Gets the number of selected rows.\n     * @return {Number}\n     */\n    getCount : function(){\n        return this.selections.length;\n    },\n\n    /**\n     * Selects the first row in the grid.\n     */\n    selectFirstRow : function(){\n        this.selectRow(0);\n    },\n\n    /**\n     * Select the last row.\n     * @param {Boolean} keepExisting (optional) <tt>true</tt> to keep existing selections\n     */\n    selectLastRow : function(keepExisting){\n        this.selectRow(this.grid.store.getCount() - 1, keepExisting);\n    },\n\n    /**\n     * Selects the row immediately following the last selected row.\n     * @param {Boolean} keepExisting (optional) <tt>true</tt> to keep existing selections\n     * @return {Boolean} <tt>true</tt> if there is a next row, else <tt>false</tt>\n     */\n    selectNext : function(keepExisting){\n        if(this.hasNext()){\n            this.selectRow(this.last+1, keepExisting);\n            this.grid.getView().focusRow(this.last);\n            return true;\n        }\n        return false;\n    },\n\n    /**\n     * Selects the row that precedes the last selected row.\n     * @param {Boolean} keepExisting (optional) <tt>true</tt> to keep existing selections\n     * @return {Boolean} <tt>true</tt> if there is a previous row, else <tt>false</tt>\n     */\n    selectPrevious : function(keepExisting){\n        if(this.hasPrevious()){\n            this.selectRow(this.last-1, keepExisting);\n            this.grid.getView().focusRow(this.last);\n            return true;\n        }\n        return false;\n    },\n\n    /**\n     * Returns true if there is a next record to select\n     * @return {Boolean}\n     */\n    hasNext : function(){\n        return this.last !== false && (this.last+1) < this.grid.store.getCount();\n    },\n\n    /**\n     * Returns true if there is a previous record to select\n     * @return {Boolean}\n     */\n    hasPrevious : function(){\n        return !!this.last;\n    },\n\n\n    /**\n     * Returns the selected records\n     * @return {Array} Array of selected records\n     */\n    getSelections : function(){\n        return [].concat(this.selections.items);\n    },\n\n    /**\n     * Returns the first selected record.\n     * @return {Record}\n     */\n    getSelected : function(){\n        return this.selections.itemAt(0);\n    },\n\n    /**\n     * Calls the passed function with each selection. If the function returns\n     * <tt>false</tt>, iteration is stopped and this function returns\n     * <tt>false</tt>. Otherwise it returns <tt>true</tt>.\n     * @param {Function} fn The function to call upon each iteration. It is passed the selected {@link Ext.data.Record Record}.\n     * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the function is executed. Defaults to this RowSelectionModel.\n     * @return {Boolean} true if all selections were iterated\n     */\n    each : function(fn, scope){\n        var s = this.getSelections(),\n            i = 0,\n            len = s.length;\n            \n        for(; i < len; i++){\n            if(fn.call(scope || this, s[i], i) === false){\n                return false;\n            }\n        }\n        return true;\n    },\n\n    /**\n     * Clears all selections if the selection model\n     * {@link Ext.grid.AbstractSelectionModel#isLocked is not locked}.\n     * @param {Boolean} fast (optional) <tt>true</tt> to bypass the\n     * conditional checks and events described in {@link #deselectRow}.\n     */\n    clearSelections : function(fast){\n        if(this.isLocked()){\n            return;\n        }\n        if(fast !== true){\n            var ds = this.grid.store,\n                s = this.selections;\n            s.each(function(r){\n                this.deselectRow(ds.indexOfId(r.id));\n            }, this);\n            s.clear();\n        }else{\n            this.selections.clear();\n        }\n        this.last = false;\n    },\n\n\n    /**\n     * Selects all rows if the selection model\n     * {@link Ext.grid.AbstractSelectionModel#isLocked is not locked}. \n     */\n    selectAll : function(){\n        if(this.isLocked()){\n            return;\n        }\n        this.selections.clear();\n        for(var i = 0, len = this.grid.store.getCount(); i < len; i++){\n            this.selectRow(i, true);\n        }\n    },\n\n    /**\n     * Returns <tt>true</tt> if there is a selection.\n     * @return {Boolean}\n     */\n    hasSelection : function(){\n        return this.selections.length > 0;\n    },\n\n    /**\n     * Returns <tt>true</tt> if the specified row is selected.\n     * @param {Number/Record} index The record or index of the record to check\n     * @return {Boolean}\n     */\n    isSelected : function(index){\n        var r = Ext.isNumber(index) ? this.grid.store.getAt(index) : index;\n        return (r && this.selections.key(r.id) ? true : false);\n    },\n\n    /**\n     * Returns <tt>true</tt> if the specified record id is selected.\n     * @param {String} id The id of record to check\n     * @return {Boolean}\n     */\n    isIdSelected : function(id){\n        return (this.selections.key(id) ? true : false);\n    },\n\n    // private\n    handleMouseDown : function(g, rowIndex, e){\n        if(e.button !== 0 || this.isLocked()){\n            return;\n        }\n        var view = this.grid.getView();\n        if(e.shiftKey && !this.singleSelect && this.last !== false){\n            var last = this.last;\n            this.selectRange(last, rowIndex, e.ctrlKey);\n            this.last = last; // reset the last\n            view.focusRow(rowIndex);\n        }else{\n            var isSelected = this.isSelected(rowIndex);\n            if(e.ctrlKey && isSelected){\n                this.deselectRow(rowIndex);\n            }else if(!isSelected || this.getCount() > 1){\n                this.selectRow(rowIndex, e.ctrlKey || e.shiftKey);\n                view.focusRow(rowIndex);\n            }\n        }\n    },\n\n    /**\n     * Selects multiple rows.\n     * @param {Array} rows Array of the indexes of the row to select\n     * @param {Boolean} keepExisting (optional) <tt>true</tt> to keep\n     * existing selections (defaults to <tt>false</tt>)\n     */\n    selectRows : function(rows, keepExisting){\n        if(!keepExisting){\n            this.clearSelections();\n        }\n        for(var i = 0, len = rows.length; i < len; i++){\n            this.selectRow(rows[i], true);\n        }\n    },\n\n    /**\n     * Selects a range of rows if the selection model\n     * {@link Ext.grid.AbstractSelectionModel#isLocked is not locked}.\n     * All rows in between startRow and endRow are also selected.\n     * @param {Number} startRow The index of the first row in the range\n     * @param {Number} endRow The index of the last row in the range\n     * @param {Boolean} keepExisting (optional) True to retain existing selections\n     */\n    selectRange : function(startRow, endRow, keepExisting){\n        var i;\n        if(this.isLocked()){\n            return;\n        }\n        if(!keepExisting){\n            this.clearSelections();\n        }\n        if(startRow <= endRow){\n            for(i = startRow; i <= endRow; i++){\n                this.selectRow(i, true);\n            }\n        }else{\n            for(i = startRow; i >= endRow; i--){\n                this.selectRow(i, true);\n            }\n        }\n    },\n\n    /**\n     * Deselects a range of rows if the selection model\n     * {@link Ext.grid.AbstractSelectionModel#isLocked is not locked}.  \n     * All rows in between startRow and endRow are also deselected.\n     * @param {Number} startRow The index of the first row in the range\n     * @param {Number} endRow The index of the last row in the range\n     */\n    deselectRange : function(startRow, endRow, preventViewNotify){\n        if(this.isLocked()){\n            return;\n        }\n        for(var i = startRow; i <= endRow; i++){\n            this.deselectRow(i, preventViewNotify);\n        }\n    },\n\n    /**\n     * Selects a row.  Before selecting a row, checks if the selection model\n     * {@link Ext.grid.AbstractSelectionModel#isLocked is locked} and fires the\n     * {@link #beforerowselect} event.  If these checks are satisfied the row\n     * will be selected and followed up by  firing the {@link #rowselect} and\n     * {@link #selectionchange} events.\n     * @param {Number} row The index of the row to select\n     * @param {Boolean} keepExisting (optional) <tt>true</tt> to keep existing selections\n     * @param {Boolean} preventViewNotify (optional) Specify <tt>true</tt> to\n     * prevent notifying the view (disables updating the selected appearance)\n     */\n    selectRow : function(index, keepExisting, preventViewNotify){\n        if(this.isLocked() || (index < 0 || index >= this.grid.store.getCount()) || (keepExisting && this.isSelected(index))){\n            return;\n        }\n        var r = this.grid.store.getAt(index);\n        if(r && this.fireEvent('beforerowselect', this, index, keepExisting, r) !== false){\n            if(!keepExisting || this.singleSelect){\n                this.clearSelections();\n            }\n            this.selections.add(r);\n            this.last = this.lastActive = index;\n            if(!preventViewNotify){\n                this.grid.getView().onRowSelect(index);\n            }\n            if(!this.silent){\n                this.fireEvent('rowselect', this, index, r);\n                this.fireEvent('selectionchange', this);\n            }\n        }\n    },\n\n    /**\n     * Deselects a row.  Before deselecting a row, checks if the selection model\n     * {@link Ext.grid.AbstractSelectionModel#isLocked is locked}.\n     * If this check is satisfied the row will be deselected and followed up by\n     * firing the {@link #rowdeselect} and {@link #selectionchange} events.\n     * @param {Number} row The index of the row to deselect\n     * @param {Boolean} preventViewNotify (optional) Specify <tt>true</tt> to\n     * prevent notifying the view (disables updating the selected appearance)\n     */\n    deselectRow : function(index, preventViewNotify){\n        if(this.isLocked()){\n            return;\n        }\n        if(this.last == index){\n            this.last = false;\n        }\n        if(this.lastActive == index){\n            this.lastActive = false;\n        }\n        var r = this.grid.store.getAt(index);\n        if(r){\n            this.selections.remove(r);\n            if(!preventViewNotify){\n                this.grid.getView().onRowDeselect(index);\n            }\n            this.fireEvent('rowdeselect', this, index, r);\n            this.fireEvent('selectionchange', this);\n        }\n    },\n\n    // private\n    acceptsNav : function(row, col, cm){\n        return !cm.isHidden(col) && cm.isCellEditable(col, row);\n    },\n\n    // private\n    onEditorKey : function(field, e){\n        var k = e.getKey(), \n            newCell, \n            g = this.grid, \n            last = g.lastEdit,\n            ed = g.activeEditor,\n            shift = e.shiftKey,\n            ae, last, r, c;\n            \n        if(k == e.TAB){\n            e.stopEvent();\n            ed.completeEdit();\n            if(shift){\n                newCell = g.walkCells(ed.row, ed.col-1, -1, this.acceptsNav, this);\n            }else{\n                newCell = g.walkCells(ed.row, ed.col+1, 1, this.acceptsNav, this);\n            }\n        }else if(k == e.ENTER){\n            if(this.moveEditorOnEnter !== false){\n                if(shift){\n                    newCell = g.walkCells(last.row - 1, last.col, -1, this.acceptsNav, this);\n                }else{\n                    newCell = g.walkCells(last.row + 1, last.col, 1, this.acceptsNav, this);\n                }\n            }\n        }\n        if(newCell){\n            r = newCell[0];\n            c = newCell[1];\n\n            this.onEditorSelect(r, last.row);\n\n            if(g.isEditor && g.editing){ // *** handle tabbing while editorgrid is in edit mode\n                ae = g.activeEditor;\n                if(ae && ae.field.triggerBlur){\n                    // *** if activeEditor is a TriggerField, explicitly call its triggerBlur() method\n                    ae.field.triggerBlur();\n                }\n            }\n            g.startEditing(r, c);\n        }\n    },\n    \n    onEditorSelect: function(row, lastRow){\n        if(lastRow != row){\n            this.selectRow(row); // *** highlight newly-selected cell and update selection\n        }\n    },\n    \n    destroy : function(){\n        Ext.destroy(this.rowNav);\n        this.rowNav = null;\n        Ext.grid.RowSelectionModel.superclass.destroy.call(this);\n    }\n});\n/**\n * @class Ext.grid.Column\n * <p>This class encapsulates column configuration data to be used in the initialization of a\n * {@link Ext.grid.ColumnModel ColumnModel}.</p>\n * <p>While subclasses are provided to render data in different ways, this class renders a passed\n * data field unchanged and is usually used for textual columns.</p>\n */\nExt.grid.Column = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Boolean} editable Optional. Defaults to <tt>true</tt>, enabling the configured\n     * <tt>{@link #editor}</tt>.  Set to <tt>false</tt> to initially disable editing on this column.\n     * The initial configuration may be dynamically altered using\n     * {@link Ext.grid.ColumnModel}.{@link Ext.grid.ColumnModel#setEditable setEditable()}.\n     */\n    /**\n     * @cfg {String} id Optional. A name which identifies this column (defaults to the column's initial\n     * ordinal position.) The <tt>id</tt> is used to create a CSS <b>class</b> name which is applied to all\n     * table cells (including headers) in that column (in this context the <tt>id</tt> does not need to be\n     * unique). The class name takes the form of <pre>x-grid3-td-<b>id</b></pre>\n     * Header cells will also receive this class name, but will also have the class <pre>x-grid3-hd</pre>\n     * So, to target header cells, use CSS selectors such as:<pre>.x-grid3-hd-row .x-grid3-td-<b>id</b></pre>\n     * The {@link Ext.grid.GridPanel#autoExpandColumn} grid config option references the column via this\n     * unique identifier.\n     */\n    /**\n     * @cfg {String} header Optional. The header text to be used as innerHTML\n     * (html tags are accepted) to display in the Grid view.  <b>Note</b>: to\n     * have a clickable header with no text displayed use <tt>'&amp;#160;'</tt>.\n     */\n    /**\n     * @cfg {Boolean} groupable Optional. If the grid is being rendered by an {@link Ext.grid.GroupingView}, this option\n     * may be used to disable the header menu item to group by the column selected. Defaults to <tt>true</tt>,\n     * which enables the header menu group option.  Set to <tt>false</tt> to disable (but still show) the\n     * group option in the header menu for the column. See also <code>{@link #groupName}</code>.\n     */\n    /**\n     * @cfg {String} groupName Optional. If the grid is being rendered by an {@link Ext.grid.GroupingView}, this option\n     * may be used to specify the text with which to prefix the group field value in the group header line.\n     * See also {@link #groupRenderer} and\n     * {@link Ext.grid.GroupingView}.{@link Ext.grid.GroupingView#showGroupName showGroupName}.\n     */\n    /**\n     * @cfg {Function} groupRenderer <p>Optional. If the grid is being rendered by an {@link Ext.grid.GroupingView}, this option\n     * may be used to specify the function used to format the grouping field value for display in the group\n     * {@link #groupName header}.  If a <tt><b>groupRenderer</b></tt> is not specified, the configured\n     * <tt><b>{@link #renderer}</b></tt> will be called; if a <tt><b>{@link #renderer}</b></tt> is also not specified\n     * the new value of the group field will be used.</p>\n     * <p>The called function (either the <tt><b>groupRenderer</b></tt> or <tt><b>{@link #renderer}</b></tt>) will be\n     * passed the following parameters:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>v</b> : Object<p class=\"sub-desc\">The new value of the group field.</p></li>\n     * <li><b>unused</b> : undefined<p class=\"sub-desc\">Unused parameter.</p></li>\n     * <li><b>r</b> : Ext.data.Record<p class=\"sub-desc\">The Record providing the data\n     * for the row which caused group change.</p></li>\n     * <li><b>rowIndex</b> : Number<p class=\"sub-desc\">The row index of the Record which caused group change.</p></li>\n     * <li><b>colIndex</b> : Number<p class=\"sub-desc\">The column index of the group field.</p></li>\n     * <li><b>ds</b> : Ext.data.Store<p class=\"sub-desc\">The Store which is providing the data Model.</p></li>\n     * </ul></div></p>\n     * <p>The function should return a string value.</p>\n     */\n    /**\n     * @cfg {String} emptyGroupText Optional. If the grid is being rendered by an {@link Ext.grid.GroupingView}, this option\n     * may be used to specify the text to display when there is an empty group value. Defaults to the\n     * {@link Ext.grid.GroupingView}.{@link Ext.grid.GroupingView#emptyGroupText emptyGroupText}.\n     */\n    /**\n     * @cfg {String} dataIndex <p><b>Required</b>. The name of the field in the\n     * grid's {@link Ext.data.Store}'s {@link Ext.data.Record} definition from\n     * which to draw the column's value.</p>\n     */\n    /**\n     * @cfg {Number} width\n     * Optional. The initial width in pixels of the column.\n     * The width of each column can also be affected if any of the following are configured:\n     * <div class=\"mdetail-params\"><ul>\n     * <li>{@link Ext.grid.GridPanel}.<tt>{@link Ext.grid.GridPanel#autoExpandColumn autoExpandColumn}</tt></li>\n     * <li>{@link Ext.grid.GridView}.<tt>{@link Ext.grid.GridView#forceFit forceFit}</tt>\n     * <div class=\"sub-desc\">\n     * <p>By specifying <tt>forceFit:true</tt>, {@link #fixed non-fixed width} columns will be\n     * re-proportioned (based on the relative initial widths) to fill the width of the grid so\n     * that no horizontal scrollbar is shown.</p>\n     * </div></li>\n     * <li>{@link Ext.grid.GridView}.<tt>{@link Ext.grid.GridView#autoFill autoFill}</tt></li>\n     * <li>{@link Ext.grid.GridPanel}.<tt>{@link Ext.grid.GridPanel#minColumnWidth minColumnWidth}</tt></li>\n     * <br><p><b>Note</b>: when the width of each column is determined, a space on the right side\n     * is reserved for the vertical scrollbar.  The\n     * {@link Ext.grid.GridView}.<tt>{@link Ext.grid.GridView#scrollOffset scrollOffset}</tt>\n     * can be modified to reduce or eliminate the reserved offset.</p>\n     */\n    /**\n     * @cfg {Boolean} sortable Optional. <tt>true</tt> if sorting is to be allowed on this column.\n     * Defaults to the value of the <code>{@link Ext.grid.ColumnModel#defaultSortable}</code> property.\n     * Whether local/remote sorting is used is specified in <code>{@link Ext.data.Store#remoteSort}</code>.\n     */\n    /**\n     * @cfg {Boolean} fixed Optional. <tt>true</tt> if the column width cannot be changed.  Defaults to <tt>false</tt>.\n     */\n    /**\n     * @cfg {Boolean} resizable Optional. <tt>false</tt> to disable column resizing. Defaults to <tt>true</tt>.\n     */\n    /**\n     * @cfg {Boolean} menuDisabled Optional. <tt>true</tt> to disable the column menu. Defaults to <tt>false</tt>.\n     */\n    /**\n     * @cfg {Boolean} hidden\n     * Optional. <tt>true</tt> to initially hide this column. Defaults to <tt>false</tt>.\n     * A hidden column {@link Ext.grid.GridPanel#enableColumnHide may be shown via the header row menu}.\n     * If a column is never to be shown, simply do not include this column in the Column Model at all.\n     */\n    /**\n     * @cfg {String} tooltip Optional. A text string to use as the column header's tooltip.  If Quicktips\n     * are enabled, this value will be used as the text of the quick tip, otherwise it will be set as the\n     * header's HTML title attribute. Defaults to ''.\n     */\n    /**\n     * @cfg {Mixed} renderer\n     * <p>For an alternative to specifying a renderer see <code>{@link #xtype}</code></p>\n     * <p>Optional. A renderer is an 'interceptor' method which can be used transform data (value,\n     * appearance, etc.) before it is rendered). This may be specified in either of three ways:\n     * <div class=\"mdetail-params\"><ul>\n     * <li>A renderer function used to return HTML markup for a cell given the cell's data value.</li>\n     * <li>A string which references a property name of the {@link Ext.util.Format} class which\n     * provides a renderer function.</li>\n     * <li>An object specifying both the renderer function, and its execution scope (<tt><b>this</b></tt>\n     * reference) e.g.:<pre style=\"margin-left:1.2em\"><code>\n{\n    fn: this.gridRenderer,\n    scope: this\n}\n</code></pre></li></ul></div>\n     * If not specified, the default renderer uses the raw data value.</p>\n     * <p>For information about the renderer function (passed parameters, etc.), see\n     * {@link Ext.grid.ColumnModel#setRenderer}. An example of specifying renderer function inline:</p><pre><code>\nvar companyColumn = {\n   header: 'Company Name',\n   dataIndex: 'company',\n   renderer: function(value, metaData, record, rowIndex, colIndex, store) {\n      // provide the logic depending on business rules\n      // name of your own choosing to manipulate the cell depending upon\n      // the data in the underlying Record object.\n      if (value == 'whatever') {\n          //metaData.css : String : A CSS class name to add to the TD element of the cell.\n          //metaData.attr : String : An html attribute definition string to apply to\n          //                         the data container element within the table\n          //                         cell (e.g. 'style=\"color:red;\"').\n          metaData.css = 'name-of-css-class-you-will-define';\n      }\n      return value;\n   }\n}\n     * </code></pre>\n     * See also {@link #scope}.\n     */\n    /**\n     * @cfg {String} xtype Optional. A String which references a predefined {@link Ext.grid.Column} subclass\n     * type which is preconfigured with an appropriate <code>{@link #renderer}</code> to be easily\n     * configured into a ColumnModel. The predefined {@link Ext.grid.Column} subclass types are:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b><tt>gridcolumn</tt></b> : {@link Ext.grid.Column} (<b>Default</b>)<p class=\"sub-desc\"></p></li>\n     * <li><b><tt>booleancolumn</tt></b> : {@link Ext.grid.BooleanColumn}<p class=\"sub-desc\"></p></li>\n     * <li><b><tt>numbercolumn</tt></b> : {@link Ext.grid.NumberColumn}<p class=\"sub-desc\"></p></li>\n     * <li><b><tt>datecolumn</tt></b> : {@link Ext.grid.DateColumn}<p class=\"sub-desc\"></p></li>\n     * <li><b><tt>templatecolumn</tt></b> : {@link Ext.grid.TemplateColumn}<p class=\"sub-desc\"></p></li>\n     * </ul></div>\n     * <p>Configuration properties for the specified <code>xtype</code> may be specified with\n     * the Column configuration properties, for example:</p>\n     * <pre><code>\nvar grid = new Ext.grid.GridPanel({\n    ...\n    columns: [{\n        header: 'Last Updated',\n        dataIndex: 'lastChange',\n        width: 85,\n        sortable: true,\n        //renderer: Ext.util.Format.dateRenderer('m/d/Y'),\n        xtype: 'datecolumn', // use xtype instead of renderer\n        format: 'M/d/Y' // configuration property for {@link Ext.grid.DateColumn}\n    }, {\n        ...\n    }]\n});\n     * </code></pre>\n     */\n    /**\n     * @cfg {Object} scope Optional. The scope (<tt><b>this</b></tt> reference) in which to execute the\n     * renderer.  Defaults to the Column configuration object.\n     */\n    /**\n     * @cfg {String} align Optional. Set the CSS text-align property of the column.  Defaults to undefined.\n     */\n    /**\n     * @cfg {String} css Optional. An inline style definition string which is applied to all table cells in the column\n     * (excluding headers). Defaults to undefined.\n     */\n    /**\n     * @cfg {Boolean} hideable Optional. Specify as <tt>false</tt> to prevent the user from hiding this column\n     * (defaults to true).  To disallow column hiding globally for all columns in the grid, use\n     * {@link Ext.grid.GridPanel#enableColumnHide} instead.\n     */\n    /**\n     * @cfg {Ext.form.Field} editor Optional. The {@link Ext.form.Field} to use when editing values in this column\n     * if editing is supported by the grid. See <tt>{@link #editable}</tt> also.\n     */\n\n    /**\n     * @private\n     * @cfg {Boolean} isColumn\n     * Used by ColumnModel setConfig method to avoid reprocessing a Column\n     * if <code>isColumn</code> is not set ColumnModel will recreate a new Ext.grid.Column\n     * Defaults to true.\n     */\n    isColumn : true,\n\n    constructor : function(config){\n        Ext.apply(this, config);\n\n        if(Ext.isString(this.renderer)){\n            this.renderer = Ext.util.Format[this.renderer];\n        }else if(Ext.isObject(this.renderer)){\n            this.scope = this.renderer.scope;\n            this.renderer = this.renderer.fn;\n        }\n        if(!this.scope){\n            this.scope = this;\n        }\n\n        var ed = this.editor;\n        delete this.editor;\n        this.setEditor(ed);\n        this.addEvents(\n            /**\n             * @event click\n             * Fires when this Column is clicked.\n             * @param {Column} this\n             * @param {Grid} The owning GridPanel\n             * @param {Number} rowIndex\n             * @param {Ext.EventObject} e\n             */\n            'click',\n            /**\n             * @event contextmenu\n             * Fires when this Column is right clicked.\n             * @param {Column} this\n             * @param {Grid} The owning GridPanel\n             * @param {Number} rowIndex\n             * @param {Ext.EventObject} e\n             */\n            'contextmenu',\n            /**\n             * @event dblclick\n             * Fires when this Column is double clicked.\n             * @param {Column} this\n             * @param {Grid} The owning GridPanel\n             * @param {Number} rowIndex\n             * @param {Ext.EventObject} e\n             */\n            'dblclick',\n            /**\n             * @event mousedown\n             * Fires when this Column receives a mousedown event.\n             * @param {Column} this\n             * @param {Grid} The owning GridPanel\n             * @param {Number} rowIndex\n             * @param {Ext.EventObject} e\n             */\n            'mousedown'\n        );\n        Ext.grid.Column.superclass.constructor.call(this);\n    },\n\n    /**\n     * @private\n     * Process and refire events routed from the GridView's processEvent method.\n     * Returns the event handler's status to allow cancelling of GridView's bubbling process.\n     */\n    processEvent : function(name, e, grid, rowIndex, colIndex){\n        return this.fireEvent(name, this, grid, rowIndex, e);\n    },\n\n    /**\n     * @private\n     * Clean up. Remove any Editor. Remove any listeners.\n     */\n    destroy: function() {\n        if(this.setEditor){\n            this.setEditor(null);\n        }\n        this.purgeListeners();\n    },\n\n    /**\n     * Optional. A function which returns displayable data when passed the following parameters:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>value</b> : Object<p class=\"sub-desc\">The data value for the cell.</p></li>\n     * <li><b>metadata</b> : Object<p class=\"sub-desc\">An object in which you may set the following attributes:<ul>\n     * <li><b>css</b> : String<p class=\"sub-desc\">A CSS class name to add to the cell's TD element.</p></li>\n     * <li><b>attr</b> : String<p class=\"sub-desc\">An HTML attribute definition string to apply to the data container\n     * element <i>within</i> the table cell (e.g. 'style=\"color:red;\"').</p></li></ul></p></li>\n     * <li><b>record</b> : Ext.data.record<p class=\"sub-desc\">The {@link Ext.data.Record} from which the data was\n     * extracted.</p></li>\n     * <li><b>rowIndex</b> : Number<p class=\"sub-desc\">Row index</p></li>\n     * <li><b>colIndex</b> : Number<p class=\"sub-desc\">Column index</p></li>\n     * <li><b>store</b> : Ext.data.Store<p class=\"sub-desc\">The {@link Ext.data.Store} object from which the Record\n     * was extracted.</p></li>\n     * </ul></div>\n     * @property renderer\n     * @type Function\n     */\n    renderer : function(value){\n        return value;\n    },\n\n    // private\n    getEditor: function(rowIndex){\n        return this.editable !== false ? this.editor : null;\n    },\n\n    /**\n     * Sets a new editor for this column.\n     * @param {Ext.Editor/Ext.form.Field} editor The editor to set\n     */\n    setEditor : function(editor){\n        var ed = this.editor;\n        if(ed){\n            if(ed.gridEditor){\n                ed.gridEditor.destroy();\n                delete ed.gridEditor;\n            }else{\n                ed.destroy();\n            }\n        }\n        this.editor = null;\n        if(editor){\n            //not an instance, create it\n            if(!editor.isXType){\n                editor = Ext.create(editor, 'textfield');\n            }\n            this.editor = editor;\n        }\n    },\n\n    /**\n     * Returns the {@link Ext.Editor editor} defined for this column that was created to wrap the {@link Ext.form.Field Field}\n     * used to edit the cell.\n     * @param {Number} rowIndex The row index\n     * @return {Ext.Editor}\n     */\n    getCellEditor: function(rowIndex){\n        var ed = this.getEditor(rowIndex);\n        if(ed){\n            if(!ed.startEdit){\n                if(!ed.gridEditor){\n                    ed.gridEditor = new Ext.grid.GridEditor(ed);\n                }\n                ed = ed.gridEditor;\n            }\n        }\n        return ed;\n    }\n});\n\n/**\n * @class Ext.grid.BooleanColumn\n * @extends Ext.grid.Column\n * <p>A Column definition class which renders boolean data fields.  See the {@link Ext.grid.Column#xtype xtype}\n * config option of {@link Ext.grid.Column} for more details.</p>\n */\nExt.grid.BooleanColumn = Ext.extend(Ext.grid.Column, {\n    /**\n     * @cfg {String} trueText\n     * The string returned by the renderer when the column value is not falsy (defaults to <tt>'true'</tt>).\n     */\n    trueText: 'true',\n    /**\n     * @cfg {String} falseText\n     * The string returned by the renderer when the column value is falsy (but not undefined) (defaults to\n     * <tt>'false'</tt>).\n     */\n    falseText: 'false',\n    /**\n     * @cfg {String} undefinedText\n     * The string returned by the renderer when the column value is undefined (defaults to <tt>'&amp;#160;'</tt>).\n     */\n    undefinedText: '&#160;',\n\n    constructor: function(cfg){\n        Ext.grid.BooleanColumn.superclass.constructor.call(this, cfg);\n        var t = this.trueText, f = this.falseText, u = this.undefinedText;\n        this.renderer = function(v){\n            if(v === undefined){\n                return u;\n            }\n            if(!v || v === 'false'){\n                return f;\n            }\n            return t;\n        };\n    }\n});\n\n/**\n * @class Ext.grid.NumberColumn\n * @extends Ext.grid.Column\n * <p>A Column definition class which renders a numeric data field according to a {@link #format} string.  See the\n * {@link Ext.grid.Column#xtype xtype} config option of {@link Ext.grid.Column} for more details.</p>\n */\nExt.grid.NumberColumn = Ext.extend(Ext.grid.Column, {\n    /**\n     * @cfg {String} format\n     * A formatting string as used by {@link Ext.util.Format#number} to format a numeric value for this Column\n     * (defaults to <tt>'0,000.00'</tt>).\n     */\n    format : '0,000.00',\n    constructor: function(cfg){\n        Ext.grid.NumberColumn.superclass.constructor.call(this, cfg);\n        this.renderer = Ext.util.Format.numberRenderer(this.format);\n    }\n});\n\n/**\n * @class Ext.grid.DateColumn\n * @extends Ext.grid.Column\n * <p>A Column definition class which renders a passed date according to the default locale, or a configured\n * {@link #format}. See the {@link Ext.grid.Column#xtype xtype} config option of {@link Ext.grid.Column}\n * for more details.</p>\n */\nExt.grid.DateColumn = Ext.extend(Ext.grid.Column, {\n    /**\n     * @cfg {String} format\n     * A formatting string as used by {@link Date#format} to format a Date for this Column\n     * (defaults to <tt>'m/d/Y'</tt>).\n     */\n    format : 'm/d/Y',\n    constructor: function(cfg){\n        Ext.grid.DateColumn.superclass.constructor.call(this, cfg);\n        this.renderer = Ext.util.Format.dateRenderer(this.format);\n    }\n});\n\n/**\n * @class Ext.grid.TemplateColumn\n * @extends Ext.grid.Column\n * <p>A Column definition class which renders a value by processing a {@link Ext.data.Record Record}'s\n * {@link Ext.data.Record#data data} using a {@link #tpl configured} {@link Ext.XTemplate XTemplate}.\n * See the {@link Ext.grid.Column#xtype xtype} config option of {@link Ext.grid.Column} for more\n * details.</p>\n */\nExt.grid.TemplateColumn = Ext.extend(Ext.grid.Column, {\n    /**\n     * @cfg {String/XTemplate} tpl\n     * An {@link Ext.XTemplate XTemplate}, or an XTemplate <i>definition string</i> to use to process a\n     * {@link Ext.data.Record Record}'s {@link Ext.data.Record#data data} to produce a column's rendered value.\n     */\n    constructor: function(cfg){\n        Ext.grid.TemplateColumn.superclass.constructor.call(this, cfg);\n        var tpl = (!Ext.isPrimitive(this.tpl) && this.tpl.compile) ? this.tpl : new Ext.XTemplate(this.tpl);\n        this.renderer = function(value, p, r){\n            return tpl.apply(r.data);\n        };\n        this.tpl = tpl;\n    }\n});\n\n/**\n * @class Ext.grid.ActionColumn\n * @extends Ext.grid.Column\n * <p>A Grid column type which renders an icon, or a series of icons in a grid cell, and offers a scoped click\n * handler for each icon. Example usage:</p>\n<pre><code>\nnew Ext.grid.GridPanel({\n    store: myStore,\n    columns: [\n        {\n            xtype: 'actioncolumn',\n            width: 50,\n            items: [\n                {\n                    icon   : 'sell.gif',                // Use a URL in the icon config\n                    tooltip: 'Sell stock',\n                    handler: function(grid, rowIndex, colIndex) {\n                        var rec = store.getAt(rowIndex);\n                        alert(\"Sell \" + rec.get('company'));\n                    }\n                },\n                {\n                    getClass: function(v, meta, rec) {  // Or return a class from a function\n                        if (rec.get('change') < 0) {\n                            this.items[1].tooltip = 'Do not buy!';\n                            return 'alert-col';\n                        } else {\n                            this.items[1].tooltip = 'Buy stock';\n                            return 'buy-col';\n                        }\n                    },\n                    handler: function(grid, rowIndex, colIndex) {\n                        var rec = store.getAt(rowIndex);\n                        alert(\"Buy \" + rec.get('company'));\n                    }\n                }\n            ]\n        }\n        //any other columns here\n    ]\n});\n</pre></code>\n * <p>The action column can be at any index in the columns array, and a grid can have any number of\n * action columns. </p>\n */\nExt.grid.ActionColumn = Ext.extend(Ext.grid.Column, {\n    /**\n     * @cfg {String} icon\n     * The URL of an image to display as the clickable element in the column. \n     * Optional - defaults to <code>{@link Ext#BLANK_IMAGE_URL Ext.BLANK_IMAGE_URL}</code>.\n     */\n    /**\n     * @cfg {String} iconCls\n     * A CSS class to apply to the icon image. To determine the class dynamically, configure the Column with a <code>{@link #getClass}</code> function.\n     */\n    /**\n     * @cfg {Function} handler A function called when the icon is clicked.\n     * The handler is passed the following parameters:<div class=\"mdetail-params\"><ul>\n     * <li><code>grid</code> : GridPanel<div class=\"sub-desc\">The owning GridPanel.</div></li>\n     * <li><code>rowIndex</code> : Number<div class=\"sub-desc\">The row index clicked on.</div></li>\n     * <li><code>colIndex</code> : Number<div class=\"sub-desc\">The column index clicked on.</div></li>\n     * <li><code>item</code> : Object<div class=\"sub-desc\">The clicked item (or this Column if multiple \n     * {@link #items} were not configured).</div></li>\n     * <li><code>e</code> : Event<div class=\"sub-desc\">The click event.</div></li>\n     * </ul></div>\n     */\n    /**\n     * @cfg {Object} scope The scope (<tt><b>this</b></tt> reference) in which the <code>{@link #handler}</code>\n     * and <code>{@link #getClass}</code> fuctions are executed. Defaults to this Column.\n     */\n    /**\n     * @cfg {String} tooltip A tooltip message to be displayed on hover. {@link Ext.QuickTips#init Ext.QuickTips} must have \n     * been initialized.\n     */\n    /**\n     * @cfg {Boolean} stopSelection Defaults to <code>true</code>. Prevent grid <i>row</i> selection upon mousedown.\n     */\n    /**\n     * @cfg {Function} getClass A function which returns the CSS class to apply to the icon image.\n     * The function is passed the following parameters:<div class=\"mdetail-params\"><ul>\n     *     <li><b>v</b> : Object<p class=\"sub-desc\">The value of the column's configured field (if any).</p></li>\n     *     <li><b>metadata</b> : Object<p class=\"sub-desc\">An object in which you may set the following attributes:<ul>\n     *         <li><b>css</b> : String<p class=\"sub-desc\">A CSS class name to add to the cell's TD element.</p></li>\n     *         <li><b>attr</b> : String<p class=\"sub-desc\">An HTML attribute definition string to apply to the data container element <i>within</i> the table cell\n     *         (e.g. 'style=\"color:red;\"').</p></li>\n     *     </ul></p></li>\n     *     <li><b>r</b> : Ext.data.Record<p class=\"sub-desc\">The Record providing the data.</p></li>\n     *     <li><b>rowIndex</b> : Number<p class=\"sub-desc\">The row index..</p></li>\n     *     <li><b>colIndex</b> : Number<p class=\"sub-desc\">The column index.</p></li>\n     *     <li><b>store</b> : Ext.data.Store<p class=\"sub-desc\">The Store which is providing the data Model.</p></li>\n     * </ul></div>\n     */\n    /**\n     * @cfg {Array} items An Array which may contain multiple icon definitions, each element of which may contain:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><code>icon</code> : String<div class=\"sub-desc\">The url of an image to display as the clickable element \n     * in the column.</div></li>\n     * <li><code>iconCls</code> : String<div class=\"sub-desc\">A CSS class to apply to the icon image.\n     * To determine the class dynamically, configure the item with a <code>getClass</code> function.</div></li>\n     * <li><code>getClass</code> : Function<div class=\"sub-desc\">A function which returns the CSS class to apply to the icon image.\n     * The function is passed the following parameters:<ul>\n     *     <li><b>v</b> : Object<p class=\"sub-desc\">The value of the column's configured field (if any).</p></li>\n     *     <li><b>metadata</b> : Object<p class=\"sub-desc\">An object in which you may set the following attributes:<ul>\n     *         <li><b>css</b> : String<p class=\"sub-desc\">A CSS class name to add to the cell's TD element.</p></li>\n     *         <li><b>attr</b> : String<p class=\"sub-desc\">An HTML attribute definition string to apply to the data container element <i>within</i> the table cell\n     *         (e.g. 'style=\"color:red;\"').</p></li>\n     *     </ul></p></li>\n     *     <li><b>r</b> : Ext.data.Record<p class=\"sub-desc\">The Record providing the data.</p></li>\n     *     <li><b>rowIndex</b> : Number<p class=\"sub-desc\">The row index..</p></li>\n     *     <li><b>colIndex</b> : Number<p class=\"sub-desc\">The column index.</p></li>\n     *     <li><b>store</b> : Ext.data.Store<p class=\"sub-desc\">The Store which is providing the data Model.</p></li>\n     * </ul></div></li>\n     * <li><code>handler</code> : Function<div class=\"sub-desc\">A function called when the icon is clicked.</div></li>\n     * <li><code>scope</code> : Scope<div class=\"sub-desc\">The scope (<code><b>this</b></code> reference) in which the \n     * <code>handler</code> and <code>getClass</code> functions are executed. Fallback defaults are this Column's\n     * configured scope, then this Column.</div></li>\n     * <li><code>tooltip</code> : String<div class=\"sub-desc\">A tooltip message to be displayed on hover. \n     * {@link Ext.QuickTips#init Ext.QuickTips} must have been initialized.</div></li>\n     * </ul></div>\n     */\n    header: '&#160;',\n\n    actionIdRe: /x-action-col-(\\d+)/,\n    \n    /**\n     * @cfg {String} altText The alt text to use for the image element. Defaults to <tt>''</tt>.\n     */\n    altText: '',\n\n    constructor: function(cfg) {\n        var me = this,\n            items = cfg.items || (me.items = [me]),\n            l = items.length,\n            i,\n            item;\n\n        Ext.grid.ActionColumn.superclass.constructor.call(me, cfg);\n\n//      Renderer closure iterates through items creating an <img> element for each and tagging with an identifying \n//      class name x-action-col-{n}\n        me.renderer = function(v, meta) {\n//          Allow a configured renderer to create initial value (And set the other values in the \"metadata\" argument!)\n            v = Ext.isFunction(cfg.renderer) ? cfg.renderer.apply(this, arguments)||'' : '';\n\n            meta.css += ' x-action-col-cell';\n            for (i = 0; i < l; i++) {\n                item = items[i];\n                v += '<img alt=\"' + (item.altText || me.altText) + '\" src=\"' + (item.icon || Ext.BLANK_IMAGE_URL) +\n                    '\" class=\"x-action-col-icon x-action-col-' + String(i) + ' ' + (item.iconCls || '') +\n                    ' ' + (Ext.isFunction(item.getClass) ? item.getClass.apply(item.scope||this.scope||this, arguments) : '') + '\"' +\n                    ((item.tooltip) ? ' ext:qtip=\"' + item.tooltip + '\"' : '') + ' />';\n            }\n            return v;\n        };\n    },\n\n    destroy: function() {\n        delete this.items;\n        delete this.renderer;\n        return Ext.grid.ActionColumn.superclass.destroy.apply(this, arguments);\n    },\n\n    /**\n     * @private\n     * Process and refire events routed from the GridView's processEvent method.\n     * Also fires any configured click handlers. By default, cancels the mousedown event to prevent selection.\n     * Returns the event handler's status to allow cancelling of GridView's bubbling process.\n     */\n    processEvent : function(name, e, grid, rowIndex, colIndex){\n        var m = e.getTarget().className.match(this.actionIdRe),\n            item, fn;\n        if (m && (item = this.items[parseInt(m[1], 10)])) {\n            if (name == 'click') {\n                (fn = item.handler || this.handler) && fn.call(item.scope||this.scope||this, grid, rowIndex, colIndex, item, e);\n            } else if ((name == 'mousedown') && (item.stopSelection !== false)) {\n                return false;\n            }\n        }\n        return Ext.grid.ActionColumn.superclass.processEvent.apply(this, arguments);\n    }\n});\n\n/*\n * @property types\n * @type Object\n * @member Ext.grid.Column\n * @static\n * <p>An object containing predefined Column classes keyed by a mnemonic code which may be referenced\n * by the {@link Ext.grid.ColumnModel#xtype xtype} config option of ColumnModel.</p>\n * <p>This contains the following properties</p><div class=\"mdesc-details\"><ul>\n * <li>gridcolumn : <b>{@link Ext.grid.Column Column constructor}</b></li>\n * <li>booleancolumn : <b>{@link Ext.grid.BooleanColumn BooleanColumn constructor}</b></li>\n * <li>numbercolumn : <b>{@link Ext.grid.NumberColumn NumberColumn constructor}</b></li>\n * <li>datecolumn : <b>{@link Ext.grid.DateColumn DateColumn constructor}</b></li>\n * <li>templatecolumn : <b>{@link Ext.grid.TemplateColumn TemplateColumn constructor}</b></li>\n * </ul></div>\n */\nExt.grid.Column.types = {\n    gridcolumn : Ext.grid.Column,\n    booleancolumn: Ext.grid.BooleanColumn,\n    numbercolumn: Ext.grid.NumberColumn,\n    datecolumn: Ext.grid.DateColumn,\n    templatecolumn: Ext.grid.TemplateColumn,\n    actioncolumn: Ext.grid.ActionColumn\n};/**\n * @class Ext.grid.RowNumberer\n * This is a utility class that can be passed into a {@link Ext.grid.ColumnModel} as a column config that provides\n * an automatic row numbering column.\n * <br>Usage:<br>\n <pre><code>\n // This is a typical column config with the first column providing row numbers\n var colModel = new Ext.grid.ColumnModel([\n    new Ext.grid.RowNumberer(),\n    {header: \"Name\", width: 80, sortable: true},\n    {header: \"Code\", width: 50, sortable: true},\n    {header: \"Description\", width: 200, sortable: true}\n ]);\n </code></pre>\n * @constructor\n * @param {Object} config The configuration options\n */\nExt.grid.RowNumberer = Ext.extend(Object, {\n    /**\n     * @cfg {String} header Any valid text or HTML fragment to display in the header cell for the row\n     * number column (defaults to '').\n     */\n    header: \"\",\n    /**\n     * @cfg {Number} width The default width in pixels of the row number column (defaults to 23).\n     */\n    width: 23,\n    /**\n     * @cfg {Boolean} sortable True if the row number column is sortable (defaults to false).\n     * @hide\n     */\n    sortable: false,\n    \n    constructor : function(config){\n        Ext.apply(this, config);\n        if(this.rowspan){\n            this.renderer = this.renderer.createDelegate(this);\n        }\n    },\n\n    // private\n    fixed:true,\n    hideable: false,\n    menuDisabled:true,\n    dataIndex: '',\n    id: 'numberer',\n    rowspan: undefined,\n\n    // private\n    renderer : function(v, p, record, rowIndex){\n        if(this.rowspan){\n            p.cellAttr = 'rowspan=\"'+this.rowspan+'\"';\n        }\n        return rowIndex+1;\n    }\n});/**\n * @class Ext.grid.CheckboxSelectionModel\n * @extends Ext.grid.RowSelectionModel\n * A custom selection model that renders a column of checkboxes that can be toggled to select or deselect rows.\n * @constructor\n * @param {Object} config The configuration options\n */\nExt.grid.CheckboxSelectionModel = Ext.extend(Ext.grid.RowSelectionModel, {\n\n    /**\n     * @cfg {Boolean} checkOnly <tt>true</tt> if rows can only be selected by clicking on the\n     * checkbox column (defaults to <tt>false</tt>).\n     */\n    /**\n     * @cfg {String} header Any valid text or HTML fragment to display in the header cell for the\n     * checkbox column.  Defaults to:<pre><code>\n     * '&lt;div class=\"x-grid3-hd-checker\">&#38;#160;&lt;/div>'</tt>\n     * </code></pre>\n     * The default CSS class of <tt>'x-grid3-hd-checker'</tt> displays a checkbox in the header\n     * and provides support for automatic check all/none behavior on header click. This string\n     * can be replaced by any valid HTML fragment, including a simple text string (e.g.,\n     * <tt>'Select Rows'</tt>), but the automatic check all/none behavior will only work if the\n     * <tt>'x-grid3-hd-checker'</tt> class is supplied.\n     */\n    header : '<div class=\"x-grid3-hd-checker\">&#160;</div>',\n    /**\n     * @cfg {Number} width The default width in pixels of the checkbox column (defaults to <tt>20</tt>).\n     */\n    width : 20,\n    /**\n     * @cfg {Boolean} sortable <tt>true</tt> if the checkbox column is sortable (defaults to\n     * <tt>false</tt>).\n     */\n    sortable : false,\n\n    // private\n    menuDisabled : true,\n    fixed : true,\n    hideable: false,\n    dataIndex : '',\n    id : 'checker',\n    isColumn: true, // So that ColumnModel doesn't feed this through the Column constructor\n\n    constructor : function(){\n        Ext.grid.CheckboxSelectionModel.superclass.constructor.apply(this, arguments);\n        if(this.checkOnly){\n            this.handleMouseDown = Ext.emptyFn;\n        }\n    },\n\n    // private\n    initEvents : function(){\n        Ext.grid.CheckboxSelectionModel.superclass.initEvents.call(this);\n        this.grid.on('render', function(){\n            Ext.fly(this.grid.getView().innerHd).on('mousedown', this.onHdMouseDown, this);\n        }, this);\n    },\n\n    /**\n     * @private\n     * Process and refire events routed from the GridView's processEvent method.\n     */\n    processEvent : function(name, e, grid, rowIndex, colIndex){\n        if (name == 'mousedown') {\n            this.onMouseDown(e, e.getTarget());\n            return false;\n        } else {\n            return Ext.grid.Column.prototype.processEvent.apply(this, arguments);\n        }\n    },\n\n    // private\n    onMouseDown : function(e, t){\n        if(e.button === 0 && t.className == 'x-grid3-row-checker'){ // Only fire if left-click\n            e.stopEvent();\n            var row = e.getTarget('.x-grid3-row');\n            if(row){\n                var index = row.rowIndex;\n                if(this.isSelected(index)){\n                    this.deselectRow(index);\n                }else{\n                    this.selectRow(index, true);\n                    this.grid.getView().focusRow(index);\n                }\n            }\n        }\n    },\n\n    // private\n    onHdMouseDown : function(e, t) {\n        if(t.className == 'x-grid3-hd-checker'){\n            e.stopEvent();\n            var hd = Ext.fly(t.parentNode);\n            var isChecked = hd.hasClass('x-grid3-hd-checker-on');\n            if(isChecked){\n                hd.removeClass('x-grid3-hd-checker-on');\n                this.clearSelections();\n            }else{\n                hd.addClass('x-grid3-hd-checker-on');\n                this.selectAll();\n            }\n        }\n    },\n\n    // private\n    renderer : function(v, p, record){\n        return '<div class=\"x-grid3-row-checker\">&#160;</div>';\n    },\n    \n    onEditorSelect: function(row, lastRow){\n        if(lastRow != row && !this.checkOnly){\n            this.selectRow(row); // *** highlight newly-selected cell and update selection\n        }\n    }\n});/**\n * @class Ext.grid.CellSelectionModel\n * @extends Ext.grid.AbstractSelectionModel\n * This class provides the basic implementation for <i>single</i> <b>cell</b> selection in a grid.\n * The object stored as the selection contains the following properties:\n * <div class=\"mdetail-params\"><ul>\n * <li><b>cell</b> : see {@link #getSelectedCell} \n * <li><b>record</b> : Ext.data.record The {@link Ext.data.Record Record}\n * which provides the data for the row containing the selection</li>\n * </ul></div>\n * @constructor\n * @param {Object} config The object containing the configuration of this model.\n */\nExt.grid.CellSelectionModel = Ext.extend(Ext.grid.AbstractSelectionModel,  {\n    \n    constructor : function(config){\n        Ext.apply(this, config);\n\n\t    this.selection = null;\n\t\n\t    this.addEvents(\n\t        /**\n\t         * @event beforecellselect\n\t         * Fires before a cell is selected, return false to cancel the selection.\n\t         * @param {SelectionModel} this\n\t         * @param {Number} rowIndex The selected row index\n\t         * @param {Number} colIndex The selected cell index\n\t         */\n\t        \"beforecellselect\",\n\t        /**\n\t         * @event cellselect\n\t         * Fires when a cell is selected.\n\t         * @param {SelectionModel} this\n\t         * @param {Number} rowIndex The selected row index\n\t         * @param {Number} colIndex The selected cell index\n\t         */\n\t        \"cellselect\",\n\t        /**\n\t         * @event selectionchange\n\t         * Fires when the active selection changes.\n\t         * @param {SelectionModel} this\n\t         * @param {Object} selection null for no selection or an object with two properties\n\t         * <div class=\"mdetail-params\"><ul>\n\t         * <li><b>cell</b> : see {@link #getSelectedCell} \n\t         * <li><b>record</b> : Ext.data.record<p class=\"sub-desc\">The {@link Ext.data.Record Record}\n\t         * which provides the data for the row containing the selection</p></li>\n\t         * </ul></div>\n\t         */\n\t        \"selectionchange\"\n\t    );\n\t\n\t    Ext.grid.CellSelectionModel.superclass.constructor.call(this);\n    },\n\n    /** @ignore */\n    initEvents : function(){\n        this.grid.on('cellmousedown', this.handleMouseDown, this);\n        this.grid.on(Ext.EventManager.getKeyEvent(), this.handleKeyDown, this);\n        this.grid.getView().on({\n            scope: this,\n            refresh: this.onViewChange,\n            rowupdated: this.onRowUpdated,\n            beforerowremoved: this.clearSelections,\n            beforerowsinserted: this.clearSelections\n        });\n        if(this.grid.isEditor){\n            this.grid.on('beforeedit', this.beforeEdit,  this);\n        }\n    },\n\n\t//private\n    beforeEdit : function(e){\n        this.select(e.row, e.column, false, true, e.record);\n    },\n\n\t//private\n    onRowUpdated : function(v, index, r){\n        if(this.selection && this.selection.record == r){\n            v.onCellSelect(index, this.selection.cell[1]);\n        }\n    },\n\n\t//private\n    onViewChange : function(){\n        this.clearSelections(true);\n    },\n\n\t/**\n     * Returns an array containing the row and column indexes of the currently selected cell\n     * (e.g., [0, 0]), or null if none selected. The array has elements:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>rowIndex</b> : Number<p class=\"sub-desc\">The index of the selected row</p></li>\n     * <li><b>cellIndex</b> : Number<p class=\"sub-desc\">The index of the selected cell. \n     * Due to possible column reordering, the cellIndex should <b>not</b> be used as an\n     * index into the Record's data. Instead, use the cellIndex to determine the <i>name</i>\n     * of the selected cell and use the field name to retrieve the data value from the record:<pre><code>\n// get name\nvar fieldName = grid.getColumnModel().getDataIndex(cellIndex);\n// get data value based on name\nvar data = record.get(fieldName);\n     * </code></pre></p></li>\n     * </ul></div>\n     * @return {Array} An array containing the row and column indexes of the selected cell, or null if none selected.\n\t */\n    getSelectedCell : function(){\n        return this.selection ? this.selection.cell : null;\n    },\n\n    /**\n     * If anything is selected, clears all selections and fires the selectionchange event.\n     * @param {Boolean} preventNotify <tt>true</tt> to prevent the gridview from\n     * being notified about the change.\n     */\n    clearSelections : function(preventNotify){\n        var s = this.selection;\n        if(s){\n            if(preventNotify !== true){\n                this.grid.view.onCellDeselect(s.cell[0], s.cell[1]);\n            }\n            this.selection = null;\n            this.fireEvent(\"selectionchange\", this, null);\n        }\n    },\n\n    /**\n     * Returns <tt>true</tt> if there is a selection.\n     * @return {Boolean}\n     */\n    hasSelection : function(){\n        return this.selection ? true : false;\n    },\n\n    /** @ignore */\n    handleMouseDown : function(g, row, cell, e){\n        if(e.button !== 0 || this.isLocked()){\n            return;\n        }\n        this.select(row, cell);\n    },\n\n    /**\n     * Selects a cell.  Before selecting a cell, fires the\n     * {@link #beforecellselect} event.  If this check is satisfied the cell\n     * will be selected and followed up by  firing the {@link #cellselect} and\n     * {@link #selectionchange} events.\n     * @param {Number} rowIndex The index of the row to select\n     * @param {Number} colIndex The index of the column to select\n     * @param {Boolean} preventViewNotify (optional) Specify <tt>true</tt> to\n     * prevent notifying the view (disables updating the selected appearance)\n     * @param {Boolean} preventFocus (optional) Whether to prevent the cell at\n     * the specified rowIndex / colIndex from being focused.\n     * @param {Ext.data.Record} r (optional) The record to select\n     */\n    select : function(rowIndex, colIndex, preventViewNotify, preventFocus, /*internal*/ r){\n        if(this.fireEvent(\"beforecellselect\", this, rowIndex, colIndex) !== false){\n            this.clearSelections();\n            r = r || this.grid.store.getAt(rowIndex);\n            this.selection = {\n                record : r,\n                cell : [rowIndex, colIndex]\n            };\n            if(!preventViewNotify){\n                var v = this.grid.getView();\n                v.onCellSelect(rowIndex, colIndex);\n                if(preventFocus !== true){\n                    v.focusCell(rowIndex, colIndex);\n                }\n            }\n            this.fireEvent(\"cellselect\", this, rowIndex, colIndex);\n            this.fireEvent(\"selectionchange\", this, this.selection);\n        }\n    },\n\n\t//private\n    isSelectable : function(rowIndex, colIndex, cm){\n        return !cm.isHidden(colIndex);\n    },\n    \n    // private\n    onEditorKey: function(field, e){\n        if(e.getKey() == e.TAB){\n            this.handleKeyDown(e);\n        }\n    },\n\n    /** @ignore */\n    handleKeyDown : function(e){\n        if(!e.isNavKeyPress()){\n            return;\n        }\n        \n        var k = e.getKey(),\n            g = this.grid,\n            s = this.selection,\n            sm = this,\n            walk = function(row, col, step){\n                return g.walkCells(\n                    row,\n                    col,\n                    step,\n                    g.isEditor && g.editing ? sm.acceptsNav : sm.isSelectable, // *** handle tabbing while editorgrid is in edit mode\n                    sm\n                );\n            },\n            cell, newCell, r, c, ae;\n\n        switch(k){\n            case e.ESC:\n            case e.PAGE_UP:\n            case e.PAGE_DOWN:\n                // do nothing\n                break;\n            default:\n                // *** call e.stopEvent() only for non ESC, PAGE UP/DOWN KEYS\n                e.stopEvent();\n                break;\n        }\n\n        if(!s){\n            cell = walk(0, 0, 1); // *** use private walk() function defined above\n            if(cell){\n                this.select(cell[0], cell[1]);\n            }\n            return;\n        }\n\n        cell = s.cell;  // currently selected cell\n        r = cell[0];    // current row\n        c = cell[1];    // current column\n        \n        switch(k){\n            case e.TAB:\n                if(e.shiftKey){\n                    newCell = walk(r, c - 1, -1);\n                }else{\n                    newCell = walk(r, c + 1, 1);\n                }\n                break;\n            case e.DOWN:\n                newCell = walk(r + 1, c, 1);\n                break;\n            case e.UP:\n                newCell = walk(r - 1, c, -1);\n                break;\n            case e.RIGHT:\n                newCell = walk(r, c + 1, 1);\n                break;\n            case e.LEFT:\n                newCell = walk(r, c - 1, -1);\n                break;\n            case e.ENTER:\n                if (g.isEditor && !g.editing) {\n                    g.startEditing(r, c);\n                    return;\n                }\n                break;\n        }\n\n        if(newCell){\n            // *** reassign r & c variables to newly-selected cell's row and column\n            r = newCell[0];\n            c = newCell[1];\n\n            this.select(r, c); // *** highlight newly-selected cell and update selection\n\n            if(g.isEditor && g.editing){ // *** handle tabbing while editorgrid is in edit mode\n                ae = g.activeEditor;\n                if(ae && ae.field.triggerBlur){\n                    // *** if activeEditor is a TriggerField, explicitly call its triggerBlur() method\n                    ae.field.triggerBlur();\n                }\n                g.startEditing(r, c);\n            }\n        }\n    },\n\n    acceptsNav : function(row, col, cm){\n        return !cm.isHidden(col) && cm.isCellEditable(col, row);\n    }\n});/**\n * @class Ext.grid.EditorGridPanel\n * @extends Ext.grid.GridPanel\n * <p>This class extends the {@link Ext.grid.GridPanel GridPanel Class} to provide cell editing\n * on selected {@link Ext.grid.Column columns}. The editable columns are specified by providing\n * an {@link Ext.grid.ColumnModel#editor editor} in the {@link Ext.grid.Column column configuration}.</p>\n * <p>Editability of columns may be controlled programatically by inserting an implementation\n * of {@link Ext.grid.ColumnModel#isCellEditable isCellEditable} into the\n * {@link Ext.grid.ColumnModel ColumnModel}.</p>\n * <p>Editing is performed on the value of the <i>field</i> specified by the column's\n * <tt>{@link Ext.grid.ColumnModel#dataIndex dataIndex}</tt> in the backing {@link Ext.data.Store Store}\n * (so if you are using a {@link Ext.grid.ColumnModel#setRenderer renderer} in order to display\n * transformed data, this must be accounted for).</p>\n * <p>If a value-to-description mapping is used to render a column, then a {@link Ext.form.Field#ComboBox ComboBox}\n * which uses the same {@link Ext.form.Field#valueField value}-to-{@link Ext.form.Field#displayFieldField description}\n * mapping would be an appropriate editor.</p>\n * If there is a more complex mismatch between the visible data in the grid, and the editable data in\n * the {@link Edt.data.Store Store}, then code to transform the data both before and after editing can be\n * injected using the {@link #beforeedit} and {@link #afteredit} events.\n * @constructor\n * @param {Object} config The config object\n * @xtype editorgrid\n */\nExt.grid.EditorGridPanel = Ext.extend(Ext.grid.GridPanel, {\n    /**\n     * @cfg {Number} clicksToEdit\n     * <p>The number of clicks on a cell required to display the cell's editor (defaults to 2).</p>\n     * <p>Setting this option to 'auto' means that mousedown <i>on the selected cell</i> starts\n     * editing that cell.</p>\n     */\n    clicksToEdit: 2,\n\n    /**\n    * @cfg {Boolean} forceValidation\n    * True to force validation even if the value is unmodified (defaults to false)\n    */\n    forceValidation: false,\n\n    // private\n    isEditor : true,\n    // private\n    detectEdit: false,\n\n    /**\n     * @cfg {Boolean} autoEncode\n     * True to automatically HTML encode and decode values pre and post edit (defaults to false)\n     */\n    autoEncode : false,\n\n    /**\n     * @cfg {Boolean} trackMouseOver @hide\n     */\n    // private\n    trackMouseOver: false, // causes very odd FF errors\n\n    // private\n    initComponent : function(){\n        Ext.grid.EditorGridPanel.superclass.initComponent.call(this);\n\n        if(!this.selModel){\n            /**\n             * @cfg {Object} selModel Any subclass of AbstractSelectionModel that will provide the selection model for\n             * the grid (defaults to {@link Ext.grid.CellSelectionModel} if not specified).\n             */\n            this.selModel = new Ext.grid.CellSelectionModel();\n        }\n\n        this.activeEditor = null;\n\n        this.addEvents(\n            /**\n             * @event beforeedit\n             * Fires before cell editing is triggered. The edit event object has the following properties <br />\n             * <ul style=\"padding:5px;padding-left:16px;\">\n             * <li>grid - This grid</li>\n             * <li>record - The record being edited</li>\n             * <li>field - The field name being edited</li>\n             * <li>value - The value for the field being edited.</li>\n             * <li>row - The grid row index</li>\n             * <li>column - The grid column index</li>\n             * <li>cancel - Set this to true to cancel the edit or return false from your handler.</li>\n             * </ul>\n             * @param {Object} e An edit event (see above for description)\n             */\n            \"beforeedit\",\n            /**\n             * @event afteredit\n             * Fires after a cell is edited. The edit event object has the following properties <br />\n             * <ul style=\"padding:5px;padding-left:16px;\">\n             * <li>grid - This grid</li>\n             * <li>record - The record being edited</li>\n             * <li>field - The field name being edited</li>\n             * <li>value - The value being set</li>\n             * <li>originalValue - The original value for the field, before the edit.</li>\n             * <li>row - The grid row index</li>\n             * <li>column - The grid column index</li>\n             * </ul>\n             *\n             * <pre><code>\ngrid.on('afteredit', afterEdit, this );\n\nfunction afterEdit(e) {\n    // execute an XHR to send/commit data to the server, in callback do (if successful):\n    e.record.commit();\n};\n             * </code></pre>\n             * @param {Object} e An edit event (see above for description)\n             */\n            \"afteredit\",\n            /**\n             * @event validateedit\n             * Fires after a cell is edited, but before the value is set in the record. Return false\n             * to cancel the change. The edit event object has the following properties <br />\n             * <ul style=\"padding:5px;padding-left:16px;\">\n             * <li>grid - This grid</li>\n             * <li>record - The record being edited</li>\n             * <li>field - The field name being edited</li>\n             * <li>value - The value being set</li>\n             * <li>originalValue - The original value for the field, before the edit.</li>\n             * <li>row - The grid row index</li>\n             * <li>column - The grid column index</li>\n             * <li>cancel - Set this to true to cancel the edit or return false from your handler.</li>\n             * </ul>\n             * Usage example showing how to remove the red triangle (dirty record indicator) from some\n             * records (not all).  By observing the grid's validateedit event, it can be cancelled if\n             * the edit occurs on a targeted row (for example) and then setting the field's new value\n             * in the Record directly:\n             * <pre><code>\ngrid.on('validateedit', function(e) {\n  var myTargetRow = 6;\n\n  if (e.row == myTargetRow) {\n    e.cancel = true;\n    e.record.data[e.field] = e.value;\n  }\n});\n             * </code></pre>\n             * @param {Object} e An edit event (see above for description)\n             */\n            \"validateedit\"\n        );\n    },\n\n    // private\n    initEvents : function(){\n        Ext.grid.EditorGridPanel.superclass.initEvents.call(this);\n\n        this.getGridEl().on('mousewheel', this.stopEditing.createDelegate(this, [true]), this);\n        this.on('columnresize', this.stopEditing, this, [true]);\n\n        if(this.clicksToEdit == 1){\n            this.on(\"cellclick\", this.onCellDblClick, this);\n        }else {\n            var view = this.getView();\n            if(this.clicksToEdit == 'auto' && view.mainBody){\n                view.mainBody.on('mousedown', this.onAutoEditClick, this);\n            }\n            this.on('celldblclick', this.onCellDblClick, this);\n        }\n    },\n\n    onResize : function(){\n        Ext.grid.EditorGridPanel.superclass.onResize.apply(this, arguments);\n        var ae = this.activeEditor;\n        if(this.editing && ae){\n            ae.realign(true);\n        }\n    },\n\n    // private\n    onCellDblClick : function(g, row, col){\n        this.startEditing(row, col);\n    },\n\n    // private\n    onAutoEditClick : function(e, t){\n        if(e.button !== 0){\n            return;\n        }\n        var row = this.view.findRowIndex(t),\n            col = this.view.findCellIndex(t);\n        if(row !== false && col !== false){\n            this.stopEditing();\n            if(this.selModel.getSelectedCell){ // cell sm\n                var sc = this.selModel.getSelectedCell();\n                if(sc && sc[0] === row && sc[1] === col){\n                    this.startEditing(row, col);\n                }\n            }else{\n                if(this.selModel.isSelected(row)){\n                    this.startEditing(row, col);\n                }\n            }\n        }\n    },\n\n    // private\n    onEditComplete : function(ed, value, startValue){\n        this.editing = false;\n        this.lastActiveEditor = this.activeEditor;\n        this.activeEditor = null;\n\n        var r = ed.record,\n            field = this.colModel.getDataIndex(ed.col);\n        value = this.postEditValue(value, startValue, r, field);\n        if(this.forceValidation === true || String(value) !== String(startValue)){\n            var e = {\n                grid: this,\n                record: r,\n                field: field,\n                originalValue: startValue,\n                value: value,\n                row: ed.row,\n                column: ed.col,\n                cancel:false\n            };\n            if(this.fireEvent(\"validateedit\", e) !== false && !e.cancel && String(value) !== String(startValue)){\n                r.set(field, e.value);\n                delete e.cancel;\n                this.fireEvent(\"afteredit\", e);\n            }\n        }\n        this.view.focusCell(ed.row, ed.col);\n    },\n\n    /**\n     * Starts editing the specified for the specified row/column\n     * @param {Number} rowIndex\n     * @param {Number} colIndex\n     */\n    startEditing : function(row, col){\n        this.stopEditing();\n        if(this.colModel.isCellEditable(col, row)){\n            this.view.ensureVisible(row, col, true);\n            var r = this.store.getAt(row),\n                field = this.colModel.getDataIndex(col),\n                e = {\n                    grid: this,\n                    record: r,\n                    field: field,\n                    value: r.data[field],\n                    row: row,\n                    column: col,\n                    cancel:false\n                };\n            if(this.fireEvent(\"beforeedit\", e) !== false && !e.cancel){\n                this.editing = true;\n                var ed = this.colModel.getCellEditor(col, row);\n                if(!ed){\n                    return;\n                }\n                if(!ed.rendered){\n                    ed.parentEl = this.view.getEditorParent(ed);\n                    ed.on({\n                        scope: this,\n                        render: {\n                            fn: function(c){\n                                c.field.focus(false, true);\n                            },\n                            single: true,\n                            scope: this\n                        },\n                        specialkey: function(field, e){\n                            this.getSelectionModel().onEditorKey(field, e);\n                        },\n                        complete: this.onEditComplete,\n                        canceledit: this.stopEditing.createDelegate(this, [true])\n                    });\n                }\n                Ext.apply(ed, {\n                    row     : row,\n                    col     : col,\n                    record  : r\n                });\n                this.lastEdit = {\n                    row: row,\n                    col: col\n                };\n                this.activeEditor = ed;\n                if (ed.field.isXType('checkbox')) {\n                    ed.allowBlur = false;\n                    this.setupCheckbox(ed.field);    \n                }\n                // Set the selectSameEditor flag if we are reusing the same editor again and\n                // need to prevent the editor from firing onBlur on itself.\n                ed.selectSameEditor = (this.activeEditor == this.lastActiveEditor);\n                var v = this.preEditValue(r, field);\n                ed.startEdit(this.view.getCell(row, col).firstChild, Ext.isDefined(v) ? v : '');\n\n                // Clear the selectSameEditor flag\n                (function(){\n                    delete ed.selectSameEditor;\n                }).defer(50);\n            }\n        }\n    },\n    \n    setupCheckbox: function(field){\n        var me = this,\n            fn = function() {\n                field.el.on('click', me.onCheckClick, me, {single: true});\n            };\n        if (field.rendered) {\n            fn();\n        } else {\n            field.on('render', fn, null, {single: true});\n        }\n    },\n    \n    onCheckClick: function(){\n        var ed = this.activeEditor;\n        ed.allowBlur = true;\n        ed.field.focus(false, 10);   \n    },\n\n    // private\n    preEditValue : function(r, field){\n        var value = r.data[field];\n        return this.autoEncode && Ext.isString(value) ? Ext.util.Format.htmlDecode(value) : value;\n    },\n\n    // private\n    postEditValue : function(value, originalValue, r, field){\n        return this.autoEncode && Ext.isString(value) ? Ext.util.Format.htmlEncode(value) : value;\n    },\n\n    /**\n     * Stops any active editing\n     * @param {Boolean} cancel (optional) True to cancel any changes\n     */\n    stopEditing : function(cancel){\n        if(this.editing){\n            // Store the lastActiveEditor to check if it is changing\n            var ae = this.lastActiveEditor = this.activeEditor;\n            if(ae){\n                ae[cancel === true ? 'cancelEdit' : 'completeEdit']();\n                this.view.focusCell(ae.row, ae.col);\n            }\n            this.activeEditor = null;\n        }\n        this.editing = false;\n    }\n});\nExt.reg('editorgrid', Ext.grid.EditorGridPanel);// private\n// This is a support class used internally by the Grid components\nExt.grid.GridEditor = function(field, config){\n    Ext.grid.GridEditor.superclass.constructor.call(this, field, config);\n    field.monitorTab = false;\n};\n\nExt.extend(Ext.grid.GridEditor, Ext.Editor, {\n    alignment: \"tl-tl\",\n    autoSize: \"width\",\n    hideEl : false,\n    cls: \"x-small-editor x-grid-editor\",\n    shim:false,\n    shadow:false\n});/**\n * @class Ext.grid.PropertyRecord\n * A specific {@link Ext.data.Record} type that represents a name/value pair and is made to work with the\n * {@link Ext.grid.PropertyGrid}.  Typically, PropertyRecords do not need to be created directly as they can be\n * created implicitly by simply using the appropriate data configs either via the {@link Ext.grid.PropertyGrid#source}\n * config property or by calling {@link Ext.grid.PropertyGrid#setSource}.  However, if the need arises, these records\n * can also be created explicitly as shwon below.  Example usage:\n * <pre><code>\nvar rec = new Ext.grid.PropertyRecord({\n    name: 'Birthday',\n    value: new Date(Date.parse('05/26/1972'))\n});\n// Add record to an already populated grid\ngrid.store.addSorted(rec);\n</code></pre>\n * @constructor\n * @param {Object} config A data object in the format: {name: [name], value: [value]}.  The specified value's type\n * will be read automatically by the grid to determine the type of editor to use when displaying it.\n */\nExt.grid.PropertyRecord = Ext.data.Record.create([\n    {name:'name',type:'string'}, 'value'\n]);\n\n/**\n * @class Ext.grid.PropertyStore\n * @extends Ext.util.Observable\n * A custom wrapper for the {@link Ext.grid.PropertyGrid}'s {@link Ext.data.Store}. This class handles the mapping\n * between the custom data source objects supported by the grid and the {@link Ext.grid.PropertyRecord} format\n * required for compatibility with the underlying store. Generally this class should not need to be used directly --\n * the grid's data should be accessed from the underlying store via the {@link #store} property.\n * @constructor\n * @param {Ext.grid.Grid} grid The grid this store will be bound to\n * @param {Object} source The source data config object\n */\nExt.grid.PropertyStore = Ext.extend(Ext.util.Observable, {\n    \n    constructor : function(grid, source){\n        this.grid = grid;\n        this.store = new Ext.data.Store({\n            recordType : Ext.grid.PropertyRecord\n        });\n        this.store.on('update', this.onUpdate,  this);\n        if(source){\n            this.setSource(source);\n        }\n        Ext.grid.PropertyStore.superclass.constructor.call(this);    \n    },\n    \n    // protected - should only be called by the grid.  Use grid.setSource instead.\n    setSource : function(o){\n        this.source = o;\n        this.store.removeAll();\n        var data = [];\n        for(var k in o){\n            if(this.isEditableValue(o[k])){\n                data.push(new Ext.grid.PropertyRecord({name: k, value: o[k]}, k));\n            }\n        }\n        this.store.loadRecords({records: data}, {}, true);\n    },\n\n    // private\n    onUpdate : function(ds, record, type){\n        if(type == Ext.data.Record.EDIT){\n            var v = record.data.value;\n            var oldValue = record.modified.value;\n            if(this.grid.fireEvent('beforepropertychange', this.source, record.id, v, oldValue) !== false){\n                this.source[record.id] = v;\n                record.commit();\n                this.grid.fireEvent('propertychange', this.source, record.id, v, oldValue);\n            }else{\n                record.reject();\n            }\n        }\n    },\n\n    // private\n    getProperty : function(row){\n       return this.store.getAt(row);\n    },\n\n    // private\n    isEditableValue: function(val){\n        return Ext.isPrimitive(val) || Ext.isDate(val);\n    },\n\n    // private\n    setValue : function(prop, value, create){\n        var r = this.getRec(prop);\n        if(r){\n            r.set('value', value);\n            this.source[prop] = value;\n        }else if(create){\n            // only create if specified.\n            this.source[prop] = value;\n            r = new Ext.grid.PropertyRecord({name: prop, value: value}, prop);\n            this.store.add(r);\n\n        }\n    },\n    \n    // private\n    remove : function(prop){\n        var r = this.getRec(prop);\n        if(r){\n            this.store.remove(r);\n            delete this.source[prop];\n        }\n    },\n    \n    // private\n    getRec : function(prop){\n        return this.store.getById(prop);\n    },\n\n    // protected - should only be called by the grid.  Use grid.getSource instead.\n    getSource : function(){\n        return this.source;\n    }\n});\n\n/**\n * @class Ext.grid.PropertyColumnModel\n * @extends Ext.grid.ColumnModel\n * A custom column model for the {@link Ext.grid.PropertyGrid}.  Generally it should not need to be used directly.\n * @constructor\n * @param {Ext.grid.Grid} grid The grid this store will be bound to\n * @param {Object} source The source data config object\n */\nExt.grid.PropertyColumnModel = Ext.extend(Ext.grid.ColumnModel, {\n    // private - strings used for locale support\n    nameText : 'Name',\n    valueText : 'Value',\n    dateFormat : 'm/j/Y',\n    trueText: 'true',\n    falseText: 'false',\n    \n    constructor : function(grid, store){\n        var g = Ext.grid,\n\t        f = Ext.form;\n\t        \n\t    this.grid = grid;\n\t    g.PropertyColumnModel.superclass.constructor.call(this, [\n\t        {header: this.nameText, width:50, sortable: true, dataIndex:'name', id: 'name', menuDisabled:true},\n\t        {header: this.valueText, width:50, resizable:false, dataIndex: 'value', id: 'value', menuDisabled:true}\n\t    ]);\n\t    this.store = store;\n\t\n\t    var bfield = new f.Field({\n\t        autoCreate: {tag: 'select', children: [\n\t            {tag: 'option', value: 'true', html: this.trueText},\n\t            {tag: 'option', value: 'false', html: this.falseText}\n\t        ]},\n\t        getValue : function(){\n\t            return this.el.dom.value == 'true';\n\t        }\n\t    });\n\t    this.editors = {\n\t        'date' : new g.GridEditor(new f.DateField({selectOnFocus:true})),\n\t        'string' : new g.GridEditor(new f.TextField({selectOnFocus:true})),\n\t        'number' : new g.GridEditor(new f.NumberField({selectOnFocus:true, style:'text-align:left;'})),\n\t        'boolean' : new g.GridEditor(bfield, {\n\t            autoSize: 'both'\n\t        })\n\t    };\n\t    this.renderCellDelegate = this.renderCell.createDelegate(this);\n\t    this.renderPropDelegate = this.renderProp.createDelegate(this);\n    },\n\n    // private\n    renderDate : function(dateVal){\n        return dateVal.dateFormat(this.dateFormat);\n    },\n\n    // private\n    renderBool : function(bVal){\n        return this[bVal ? 'trueText' : 'falseText'];\n    },\n\n    // private\n    isCellEditable : function(colIndex, rowIndex){\n        return colIndex == 1;\n    },\n\n    // private\n    getRenderer : function(col){\n        return col == 1 ?\n            this.renderCellDelegate : this.renderPropDelegate;\n    },\n\n    // private\n    renderProp : function(v){\n        return this.getPropertyName(v);\n    },\n\n    // private\n    renderCell : function(val, meta, rec){\n        var renderer = this.grid.customRenderers[rec.get('name')];\n        if(renderer){\n            return renderer.apply(this, arguments);\n        }\n        var rv = val;\n        if(Ext.isDate(val)){\n            rv = this.renderDate(val);\n        }else if(typeof val == 'boolean'){\n            rv = this.renderBool(val);\n        }\n        return Ext.util.Format.htmlEncode(rv);\n    },\n\n    // private\n    getPropertyName : function(name){\n        var pn = this.grid.propertyNames;\n        return pn && pn[name] ? pn[name] : name;\n    },\n\n    // private\n    getCellEditor : function(colIndex, rowIndex){\n        var p = this.store.getProperty(rowIndex),\n            n = p.data.name, \n            val = p.data.value;\n        if(this.grid.customEditors[n]){\n            return this.grid.customEditors[n];\n        }\n        if(Ext.isDate(val)){\n            return this.editors.date;\n        }else if(typeof val == 'number'){\n            return this.editors.number;\n        }else if(typeof val == 'boolean'){\n            return this.editors['boolean'];\n        }else{\n            return this.editors.string;\n        }\n    },\n\n    // inherit docs\n    destroy : function(){\n        Ext.grid.PropertyColumnModel.superclass.destroy.call(this);\n        this.destroyEditors(this.editors);\n        this.destroyEditors(this.grid.customEditors);\n    },\n    \n    destroyEditors: function(editors){\n        for(var ed in editors){\n            Ext.destroy(editors[ed]);\n        }\n    }\n});\n\n/**\n * @class Ext.grid.PropertyGrid\n * @extends Ext.grid.EditorGridPanel\n * A specialized grid implementation intended to mimic the traditional property grid as typically seen in\n * development IDEs.  Each row in the grid represents a property of some object, and the data is stored\n * as a set of name/value pairs in {@link Ext.grid.PropertyRecord}s.  Example usage:\n * <pre><code>\nvar grid = new Ext.grid.PropertyGrid({\n    title: 'Properties Grid',\n    autoHeight: true,\n    width: 300,\n    renderTo: 'grid-ct',\n    source: {\n        \"(name)\": \"My Object\",\n        \"Created\": new Date(Date.parse('10/15/2006')),\n        \"Available\": false,\n        \"Version\": .01,\n        \"Description\": \"A test object\"\n    }\n});\n</code></pre>\n * @constructor\n * @param {Object} config The grid config object\n */\nExt.grid.PropertyGrid = Ext.extend(Ext.grid.EditorGridPanel, {\n    /**\n    * @cfg {Object} propertyNames An object containing property name/display name pairs.\n    * If specified, the display name will be shown in the name column instead of the property name.\n    */\n    /**\n    * @cfg {Object} source A data object to use as the data source of the grid (see {@link #setSource} for details).\n    */\n    /**\n    * @cfg {Object} customEditors An object containing name/value pairs of custom editor type definitions that allow\n    * the grid to support additional types of editable fields.  By default, the grid supports strongly-typed editing\n    * of strings, dates, numbers and booleans using built-in form editors, but any custom type can be supported and\n    * associated with a custom input control by specifying a custom editor.  The name of the editor\n    * type should correspond with the name of the property that will use the editor.  Example usage:\n    * <pre><code>\nvar grid = new Ext.grid.PropertyGrid({\n    ...\n    customEditors: {\n        'Start Time': new Ext.grid.GridEditor(new Ext.form.TimeField({selectOnFocus:true}))\n    },\n    source: {\n        'Start Time': '10:00 AM'\n    }\n});\n</code></pre>\n    */\n    /**\n    * @cfg {Object} customRenderers An object containing name/value pairs of custom renderer type definitions that allow\n    * the grid to support custom rendering of fields.  By default, the grid supports strongly-typed rendering\n    * of strings, dates, numbers and booleans using built-in form editors, but any custom type can be supported and\n    * associated with the type of the value.  The name of the renderer type should correspond with the name of the property\n    * that it will render.  Example usage:\n    * <pre><code>\nvar grid = new Ext.grid.PropertyGrid({\n    ...\n    customRenderers: {\n        Available: function(v){\n            if(v){\n                return '<span style=\"color: green;\">Yes</span>';\n            }else{\n                return '<span style=\"color: red;\">No</span>';\n            }\n        }\n    },\n    source: {\n        Available: true\n    }\n});\n</code></pre>\n    */\n\n    // private config overrides\n    enableColumnMove:false,\n    stripeRows:false,\n    trackMouseOver: false,\n    clicksToEdit:1,\n    enableHdMenu : false,\n    viewConfig : {\n        forceFit:true\n    },\n\n    // private\n    initComponent : function(){\n        this.customRenderers = this.customRenderers || {};\n        this.customEditors = this.customEditors || {};\n        this.lastEditRow = null;\n        var store = new Ext.grid.PropertyStore(this);\n        this.propStore = store;\n        var cm = new Ext.grid.PropertyColumnModel(this, store);\n        store.store.sort('name', 'ASC');\n        this.addEvents(\n            /**\n             * @event beforepropertychange\n             * Fires before a property value changes.  Handlers can return false to cancel the property change\n             * (this will internally call {@link Ext.data.Record#reject} on the property's record).\n             * @param {Object} source The source data object for the grid (corresponds to the same object passed in\n             * as the {@link #source} config property).\n             * @param {String} recordId The record's id in the data store\n             * @param {Mixed} value The current edited property value\n             * @param {Mixed} oldValue The original property value prior to editing\n             */\n            'beforepropertychange',\n            /**\n             * @event propertychange\n             * Fires after a property value has changed.\n             * @param {Object} source The source data object for the grid (corresponds to the same object passed in\n             * as the {@link #source} config property).\n             * @param {String} recordId The record's id in the data store\n             * @param {Mixed} value The current edited property value\n             * @param {Mixed} oldValue The original property value prior to editing\n             */\n            'propertychange'\n        );\n        this.cm = cm;\n        this.ds = store.store;\n        Ext.grid.PropertyGrid.superclass.initComponent.call(this);\n\n\t\tthis.mon(this.selModel, 'beforecellselect', function(sm, rowIndex, colIndex){\n            if(colIndex === 0){\n                this.startEditing.defer(200, this, [rowIndex, 1]);\n                return false;\n            }\n        }, this);\n    },\n\n    // private\n    onRender : function(){\n        Ext.grid.PropertyGrid.superclass.onRender.apply(this, arguments);\n\n        this.getGridEl().addClass('x-props-grid');\n    },\n\n    // private\n    afterRender: function(){\n        Ext.grid.PropertyGrid.superclass.afterRender.apply(this, arguments);\n        if(this.source){\n            this.setSource(this.source);\n        }\n    },\n\n    /**\n     * Sets the source data object containing the property data.  The data object can contain one or more name/value\n     * pairs representing all of the properties of an object to display in the grid, and this data will automatically\n     * be loaded into the grid's {@link #store}.  The values should be supplied in the proper data type if needed,\n     * otherwise string type will be assumed.  If the grid already contains data, this method will replace any\n     * existing data.  See also the {@link #source} config value.  Example usage:\n     * <pre><code>\ngrid.setSource({\n    \"(name)\": \"My Object\",\n    \"Created\": new Date(Date.parse('10/15/2006')),  // date type\n    \"Available\": false,  // boolean type\n    \"Version\": .01,      // decimal type\n    \"Description\": \"A test object\"\n});\n</code></pre>\n     * @param {Object} source The data object\n     */\n    setSource : function(source){\n        this.propStore.setSource(source);\n    },\n\n    /**\n     * Gets the source data object containing the property data.  See {@link #setSource} for details regarding the\n     * format of the data object.\n     * @return {Object} The data object\n     */\n    getSource : function(){\n        return this.propStore.getSource();\n    },\n    \n    /**\n     * Sets the value of a property.\n     * @param {String} prop The name of the property to set\n     * @param {Mixed} value The value to test\n     * @param {Boolean} create (Optional) True to create the property if it doesn't already exist. Defaults to <tt>false</tt>.\n     */\n    setProperty : function(prop, value, create){\n        this.propStore.setValue(prop, value, create);    \n    },\n    \n    /**\n     * Removes a property from the grid.\n     * @param {String} prop The name of the property to remove\n     */\n    removeProperty : function(prop){\n        this.propStore.remove(prop);\n    }\n\n    /**\n     * @cfg store\n     * @hide\n     */\n    /**\n     * @cfg colModel\n     * @hide\n     */\n    /**\n     * @cfg cm\n     * @hide\n     */\n    /**\n     * @cfg columns\n     * @hide\n     */\n});\nExt.reg(\"propertygrid\", Ext.grid.PropertyGrid);\n/**\n * @class Ext.grid.GroupingView\n * @extends Ext.grid.GridView\n * Adds the ability for single level grouping to the grid. A {@link Ext.data.GroupingStore GroupingStore}\n * must be used to enable grouping.  Some grouping characteristics may also be configured at the\n * {@link Ext.grid.Column Column level}<div class=\"mdetail-params\"><ul>\n * <li><code>{@link Ext.grid.Column#emptyGroupText emptyGroupText}</code></li>\n * <li><code>{@link Ext.grid.Column#groupable groupable}</code></li>\n * <li><code>{@link Ext.grid.Column#groupName groupName}</code></li>\n * <li><code>{@link Ext.grid.Column#groupRender groupRender}</code></li>\n * </ul></div>\n * <p>Sample usage:</p>\n * <pre><code>\nvar grid = new Ext.grid.GridPanel({\n    // A groupingStore is required for a GroupingView\n    store: new {@link Ext.data.GroupingStore}({\n        autoDestroy: true,\n        reader: reader,\n        data: xg.dummyData,\n        sortInfo: {field: 'company', direction: 'ASC'},\n        {@link Ext.data.GroupingStore#groupOnSort groupOnSort}: true,\n        {@link Ext.data.GroupingStore#remoteGroup remoteGroup}: true,\n        {@link Ext.data.GroupingStore#groupField groupField}: 'industry'\n    }),\n    colModel: new {@link Ext.grid.ColumnModel}({\n        columns:[\n            {id:'company',header: 'Company', width: 60, dataIndex: 'company'},\n            // {@link Ext.grid.Column#groupable groupable}, {@link Ext.grid.Column#groupName groupName}, {@link Ext.grid.Column#groupRender groupRender} are also configurable at column level\n            {header: 'Price', renderer: Ext.util.Format.usMoney, dataIndex: 'price', {@link Ext.grid.Column#groupable groupable}: false},\n            {header: 'Change', dataIndex: 'change', renderer: Ext.util.Format.usMoney},\n            {header: 'Industry', dataIndex: 'industry'},\n            {header: 'Last Updated', renderer: Ext.util.Format.dateRenderer('m/d/Y'), dataIndex: 'lastChange'}\n        ],\n        defaults: {\n            sortable: true,\n            menuDisabled: false,\n            width: 20\n        }\n    }),\n\n    view: new Ext.grid.GroupingView({\n        {@link Ext.grid.GridView#forceFit forceFit}: true,\n        // custom grouping text template to display the number of items per group\n        {@link #groupTextTpl}: '{text} ({[values.rs.length]} {[values.rs.length > 1 ? \"Items\" : \"Item\"]})'\n    }),\n\n    frame:true,\n    width: 700,\n    height: 450,\n    collapsible: true,\n    animCollapse: false,\n    title: 'Grouping Example',\n    iconCls: 'icon-grid',\n    renderTo: document.body\n});\n * </code></pre>\n * @constructor\n * @param {Object} config\n */\nExt.grid.GroupingView = Ext.extend(Ext.grid.GridView, {\n\n    /**\n     * @cfg {String} groupByText Text displayed in the grid header menu for grouping by a column\n     * (defaults to 'Group By This Field').\n     */\n    groupByText : 'Group By This Field',\n    /**\n     * @cfg {String} showGroupsText Text displayed in the grid header for enabling/disabling grouping\n     * (defaults to 'Show in Groups').\n     */\n    showGroupsText : 'Show in Groups',\n    /**\n     * @cfg {Boolean} hideGroupedColumn <tt>true</tt> to hide the column that is currently grouped (defaults to <tt>false</tt>)\n     */\n    hideGroupedColumn : false,\n    /**\n     * @cfg {Boolean} showGroupName If <tt>true</tt> will display a prefix plus a ': ' before the group field value\n     * in the group header line.  The prefix will consist of the <tt><b>{@link Ext.grid.Column#groupName groupName}</b></tt>\n     * (or the configured <tt><b>{@link Ext.grid.Column#header header}</b></tt> if not provided) configured in the\n     * {@link Ext.grid.Column} for each set of grouped rows (defaults to <tt>true</tt>).\n     */\n    showGroupName : true,\n    /**\n     * @cfg {Boolean} startCollapsed <tt>true</tt> to start all groups collapsed (defaults to <tt>false</tt>)\n     */\n    startCollapsed : false,\n    /**\n     * @cfg {Boolean} enableGrouping <tt>false</tt> to disable grouping functionality (defaults to <tt>true</tt>)\n     */\n    enableGrouping : true,\n    /**\n     * @cfg {Boolean} enableGroupingMenu <tt>true</tt> to enable the grouping control in the column menu (defaults to <tt>true</tt>)\n     */\n    enableGroupingMenu : true,\n    /**\n     * @cfg {Boolean} enableNoGroups <tt>true</tt> to allow the user to turn off grouping (defaults to <tt>true</tt>)\n     */\n    enableNoGroups : true,\n    /**\n     * @cfg {String} emptyGroupText The text to display when there is an empty group value (defaults to <tt>'(None)'</tt>).\n     * May also be specified per column, see {@link Ext.grid.Column}.{@link Ext.grid.Column#emptyGroupText emptyGroupText}.\n     */\n    emptyGroupText : '(None)',\n    /**\n     * @cfg {Boolean} ignoreAdd <tt>true</tt> to skip refreshing the view when new rows are added (defaults to <tt>false</tt>)\n     */\n    ignoreAdd : false,\n    /**\n     * @cfg {String} groupTextTpl The template used to render the group header (defaults to <tt>'{text}'</tt>).\n     * This is used to format an object which contains the following properties:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>group</b> : String<p class=\"sub-desc\">The <i>rendered</i> value of the group field.\n     * By default this is the unchanged value of the group field. If a <tt><b>{@link Ext.grid.Column#groupRenderer groupRenderer}</b></tt>\n     * is specified, it is the result of a call to that function.</p></li>\n     * <li><b>gvalue</b> : Object<p class=\"sub-desc\">The <i>raw</i> value of the group field.</p></li>\n     * <li><b>text</b> : String<p class=\"sub-desc\">The configured header (as described in <tt>{@link #showGroupName})</tt>\n     * if <tt>{@link #showGroupName}</tt> is <tt>true</tt>) plus the <i>rendered</i> group field value.</p></li>\n     * <li><b>groupId</b> : String<p class=\"sub-desc\">A unique, generated ID which is applied to the\n     * View Element which contains the group.</p></li>\n     * <li><b>startRow</b> : Number<p class=\"sub-desc\">The row index of the Record which caused group change.</p></li>\n     * <li><b>rs</b> : Array<p class=\"sub-desc\">Contains a single element: The Record providing the data\n     * for the row which caused group change.</p></li>\n     * <li><b>cls</b> : String<p class=\"sub-desc\">The generated class name string to apply to the group header Element.</p></li>\n     * <li><b>style</b> : String<p class=\"sub-desc\">The inline style rules to apply to the group header Element.</p></li>\n     * </ul></div></p>\n     * See {@link Ext.XTemplate} for information on how to format data using a template. Possible usage:<pre><code>\nvar grid = new Ext.grid.GridPanel({\n    ...\n    view: new Ext.grid.GroupingView({\n        groupTextTpl: '{text} ({[values.rs.length]} {[values.rs.length > 1 ? \"Items\" : \"Item\"]})'\n    }),\n});\n     * </code></pre>\n     */\n    groupTextTpl : '{text}',\n\n    /**\n     * @cfg {String} groupMode Indicates how to construct the group identifier. <tt>'value'</tt> constructs the id using\n     * raw value, <tt>'display'</tt> constructs the id using the rendered value. Defaults to <tt>'value'</tt>.\n     */\n    groupMode: 'value',\n\n    /**\n     * @cfg {Function} groupRenderer This property must be configured in the {@link Ext.grid.Column} for\n     * each column.\n     */\n    \n    /**\n     * @cfg {Boolean} cancelEditOnToggle True to cancel any editing when the group header is toggled. Defaults to <tt>true</tt>.\n     */\n    cancelEditOnToggle: true,\n\n    // private\n    initTemplates : function(){\n        Ext.grid.GroupingView.superclass.initTemplates.call(this);\n        this.state = {};\n\n        var sm = this.grid.getSelectionModel();\n        sm.on(sm.selectRow ? 'beforerowselect' : 'beforecellselect',\n                this.onBeforeRowSelect, this);\n\n        if(!this.startGroup){\n            this.startGroup = new Ext.XTemplate(\n                '<div id=\"{groupId}\" class=\"x-grid-group {cls}\">',\n                    '<div id=\"{groupId}-hd\" class=\"x-grid-group-hd\" style=\"{style}\"><div class=\"x-grid-group-title\">', this.groupTextTpl ,'</div></div>',\n                    '<div id=\"{groupId}-bd\" class=\"x-grid-group-body\">'\n            );\n        }\n        this.startGroup.compile();\n\n        if (!this.endGroup) {\n            this.endGroup = '</div></div>';\n        }\n    },\n\n    // private\n    findGroup : function(el){\n        return Ext.fly(el).up('.x-grid-group', this.mainBody.dom);\n    },\n\n    // private\n    getGroups : function(){\n        return this.hasRows() ? this.mainBody.dom.childNodes : [];\n    },\n\n    // private\n    onAdd : function(ds, records, index) {\n        if (this.canGroup() && !this.ignoreAdd) {\n            var ss = this.getScrollState();\n            this.fireEvent('beforerowsinserted', ds, index, index + (records.length-1));\n            this.refresh();\n            this.restoreScroll(ss);\n            this.fireEvent('rowsinserted', ds, index, index + (records.length-1));\n        } else if (!this.canGroup()) {\n            Ext.grid.GroupingView.superclass.onAdd.apply(this, arguments);\n        }\n    },\n\n    // private\n    onRemove : function(ds, record, index, isUpdate){\n        Ext.grid.GroupingView.superclass.onRemove.apply(this, arguments);\n        var g = document.getElementById(record._groupId);\n        if(g && g.childNodes[1].childNodes.length < 1){\n            Ext.removeNode(g);\n        }\n        this.applyEmptyText();\n    },\n\n    // private\n    refreshRow : function(record){\n        if(this.ds.getCount()==1){\n            this.refresh();\n        }else{\n            this.isUpdating = true;\n            Ext.grid.GroupingView.superclass.refreshRow.apply(this, arguments);\n            this.isUpdating = false;\n        }\n    },\n\n    // private\n    beforeMenuShow : function(){\n        var item, items = this.hmenu.items, disabled = this.cm.config[this.hdCtxIndex].groupable === false;\n        if((item = items.get('groupBy'))){\n            item.setDisabled(disabled);\n        }\n        if((item = items.get('showGroups'))){\n            item.setDisabled(disabled);\n            item.setChecked(this.canGroup(), true);\n        }\n    },\n\n    // private\n    renderUI : function(){\n        var markup = Ext.grid.GroupingView.superclass.renderUI.call(this);\n\n        if(this.enableGroupingMenu && this.hmenu){\n            this.hmenu.add('-',{\n                itemId:'groupBy',\n                text: this.groupByText,\n                handler: this.onGroupByClick,\n                scope: this,\n                iconCls:'x-group-by-icon'\n            });\n            if(this.enableNoGroups){\n                this.hmenu.add({\n                    itemId:'showGroups',\n                    text: this.showGroupsText,\n                    checked: true,\n                    checkHandler: this.onShowGroupsClick,\n                    scope: this\n                });\n            }\n            this.hmenu.on('beforeshow', this.beforeMenuShow, this);\n        }\n        return markup;\n    },\n\n    processEvent: function(name, e){\n        Ext.grid.GroupingView.superclass.processEvent.call(this, name, e);\n        var hd = e.getTarget('.x-grid-group-hd', this.mainBody);\n        if(hd){\n            // group value is at the end of the string\n            var field = this.getGroupField(),\n                prefix = this.getPrefix(field),\n                groupValue = hd.id.substring(prefix.length),\n                emptyRe = new RegExp('gp-' + Ext.escapeRe(field) + '--hd');\n\n            // remove trailing '-hd'\n            groupValue = groupValue.substr(0, groupValue.length - 3);\n            \n            // also need to check for empty groups\n            if(groupValue || emptyRe.test(hd.id)){\n                this.grid.fireEvent('group' + name, this.grid, field, groupValue, e);\n            }\n            if(name == 'mousedown' && e.button == 0){\n                this.toggleGroup(hd.parentNode);\n            }\n        }\n\n    },\n\n    // private\n    onGroupByClick : function(){\n        var grid = this.grid;\n        this.enableGrouping = true;\n        grid.store.groupBy(this.cm.getDataIndex(this.hdCtxIndex));\n        grid.fireEvent('groupchange', grid, grid.store.getGroupState());\n        this.beforeMenuShow(); // Make sure the checkboxes get properly set when changing groups\n        this.refresh();\n    },\n\n    // private\n    onShowGroupsClick : function(mi, checked){\n        this.enableGrouping = checked;\n        if(checked){\n            this.onGroupByClick();\n        }else{\n            this.grid.store.clearGrouping();\n            this.grid.fireEvent('groupchange', this, null);\n        }\n    },\n\n    /**\n     * Toggle the group that contains the specific row.\n     * @param {Number} rowIndex The row inside the group\n     * @param {Boolean} expanded (optional)\n     */\n    toggleRowIndex : function(rowIndex, expanded){\n        if(!this.canGroup()){\n            return;\n        }\n        var row = this.getRow(rowIndex);\n        if(row){\n            this.toggleGroup(this.findGroup(row), expanded);\n        }\n    },\n\n    /**\n     * Toggles the specified group if no value is passed, otherwise sets the expanded state of the group to the value passed.\n     * @param {String} groupId The groupId assigned to the group (see getGroupId)\n     * @param {Boolean} expanded (optional)\n     */\n    toggleGroup : function(group, expanded){\n        var gel = Ext.get(group),\n            id = Ext.util.Format.htmlEncode(gel.id);\n \n        expanded = Ext.isDefined(expanded) ? expanded : gel.hasClass('x-grid-group-collapsed');\n        if(this.state[id] !== expanded){\n            if (this.cancelEditOnToggle !== false) {\n                this.grid.stopEditing(true);\n            }\n            this.state[id] = expanded;\n            gel[expanded ? 'removeClass' : 'addClass']('x-grid-group-collapsed');\n        }\n    },\n\n    /**\n     * Toggles all groups if no value is passed, otherwise sets the expanded state of all groups to the value passed.\n     * @param {Boolean} expanded (optional)\n     */\n    toggleAllGroups : function(expanded){\n        var groups = this.getGroups();\n        for(var i = 0, len = groups.length; i < len; i++){\n            this.toggleGroup(groups[i], expanded);\n        }\n    },\n\n    /**\n     * Expands all grouped rows.\n     */\n    expandAllGroups : function(){\n        this.toggleAllGroups(true);\n    },\n\n    /**\n     * Collapses all grouped rows.\n     */\n    collapseAllGroups : function(){\n        this.toggleAllGroups(false);\n    },\n\n    // private\n    getGroup : function(v, r, groupRenderer, rowIndex, colIndex, ds){\n        var column = this.cm.config[colIndex],\n            g = groupRenderer ? groupRenderer.call(column.scope, v, {}, r, rowIndex, colIndex, ds) : String(v);\n        if(g === '' || g === '&#160;'){\n            g = column.emptyGroupText || this.emptyGroupText;\n        }\n        return g;\n    },\n\n    // private\n    getGroupField : function(){\n        return this.grid.store.getGroupState();\n    },\n\n    // private\n    afterRender : function(){\n        if(!this.ds || !this.cm){\n            return;\n        }\n        Ext.grid.GroupingView.superclass.afterRender.call(this);\n        if(this.grid.deferRowRender){\n            this.updateGroupWidths();\n        }\n    },\n    \n    afterRenderUI: function () {\n        Ext.grid.GroupingView.superclass.afterRenderUI.call(this);\n\n        if (this.enableGroupingMenu && this.hmenu) {\n            this.hmenu.add('-',{\n                itemId:'groupBy',\n                text: this.groupByText,\n                handler: this.onGroupByClick,\n                scope: this,\n                iconCls:'x-group-by-icon'\n            });\n            \n            if (this.enableNoGroups) {\n                this.hmenu.add({\n                    itemId:'showGroups',\n                    text: this.showGroupsText,\n                    checked: true,\n                    checkHandler: this.onShowGroupsClick,\n                    scope: this\n                });\n            }\n            \n            this.hmenu.on('beforeshow', this.beforeMenuShow, this);\n        }\n    },\n\n    // private\n    renderRows : function(){\n        var groupField = this.getGroupField();\n        var eg = !!groupField;\n        // if they turned off grouping and the last grouped field is hidden\n        if(this.hideGroupedColumn) {\n            var colIndex = this.cm.findColumnIndex(groupField),\n                hasLastGroupField = Ext.isDefined(this.lastGroupField);\n            if(!eg && hasLastGroupField){\n                this.mainBody.update('');\n                this.cm.setHidden(this.cm.findColumnIndex(this.lastGroupField), false);\n                delete this.lastGroupField;\n            }else if (eg && !hasLastGroupField){\n                this.lastGroupField = groupField;\n                this.cm.setHidden(colIndex, true);\n            }else if (eg && hasLastGroupField && groupField !== this.lastGroupField) {\n                this.mainBody.update('');\n                var oldIndex = this.cm.findColumnIndex(this.lastGroupField);\n                this.cm.setHidden(oldIndex, false);\n                this.lastGroupField = groupField;\n                this.cm.setHidden(colIndex, true);\n            }\n        }\n        return Ext.grid.GroupingView.superclass.renderRows.apply(\n                    this, arguments);\n    },\n\n    // private\n    doRender : function(cs, rs, ds, startRow, colCount, stripe){\n        if(rs.length < 1){\n            return '';\n        }\n\n        if(!this.canGroup() || this.isUpdating){\n            return Ext.grid.GroupingView.superclass.doRender.apply(this, arguments);\n        }\n\n        var groupField = this.getGroupField(),\n            colIndex = this.cm.findColumnIndex(groupField),\n            g,\n            gstyle = 'width:' + this.getTotalWidth() + ';',\n            cfg = this.cm.config[colIndex],\n            groupRenderer = cfg.groupRenderer || cfg.renderer,\n            prefix = this.showGroupName ? (cfg.groupName || cfg.header)+': ' : '',\n            groups = [],\n            curGroup, i, len, gid;\n\n        for(i = 0, len = rs.length; i < len; i++){\n            var rowIndex = startRow + i,\n                r = rs[i],\n                gvalue = r.data[groupField];\n\n                g = this.getGroup(gvalue, r, groupRenderer, rowIndex, colIndex, ds);\n            if(!curGroup || curGroup.group != g){\n                gid = this.constructId(gvalue, groupField, colIndex);\n                // if state is defined use it, however state is in terms of expanded\n                // so negate it, otherwise use the default.\n                this.state[gid] = !(Ext.isDefined(this.state[gid]) ? !this.state[gid] : this.startCollapsed);\n                curGroup = {\n                    group: g,\n                    gvalue: gvalue,\n                    text: prefix + g,\n                    groupId: gid,\n                    startRow: rowIndex,\n                    rs: [r],\n                    cls: this.state[gid] ? '' : 'x-grid-group-collapsed',\n                    style: gstyle\n                };\n                groups.push(curGroup);\n            }else{\n                curGroup.rs.push(r);\n            }\n            r._groupId = gid;\n        }\n\n        var buf = [];\n        for(i = 0, len = groups.length; i < len; i++){\n            g = groups[i];\n            this.doGroupStart(buf, g, cs, ds, colCount);\n            buf[buf.length] = Ext.grid.GroupingView.superclass.doRender.call(\n                    this, cs, g.rs, ds, g.startRow, colCount, stripe);\n\n            this.doGroupEnd(buf, g, cs, ds, colCount);\n        }\n        return buf.join('');\n    },\n\n    /**\n     * Dynamically tries to determine the groupId of a specific value\n     * @param {String} value\n     * @return {String} The group id\n     */\n    getGroupId : function(value){\n        var field = this.getGroupField();\n        return this.constructId(value, field, this.cm.findColumnIndex(field));\n    },\n\n    // private\n    constructId : function(value, field, idx){\n        var cfg = this.cm.config[idx],\n            groupRenderer = cfg.groupRenderer || cfg.renderer,\n            val = (this.groupMode == 'value') ? value : this.getGroup(value, {data:{}}, groupRenderer, 0, idx, this.ds);\n\n        return this.getPrefix(field) + Ext.util.Format.htmlEncode(val);\n    },\n\n    // private\n    canGroup  : function(){\n        return this.enableGrouping && !!this.getGroupField();\n    },\n\n    // private\n    getPrefix: function(field){\n        return this.grid.getGridEl().id + '-gp-' + field + '-';\n    },\n\n    // private\n    doGroupStart : function(buf, g, cs, ds, colCount){\n        buf[buf.length] = this.startGroup.apply(g);\n    },\n\n    // private\n    doGroupEnd : function(buf, g, cs, ds, colCount){\n        buf[buf.length] = this.endGroup;\n    },\n\n    // private\n    getRows : function(){\n        if(!this.canGroup()){\n            return Ext.grid.GroupingView.superclass.getRows.call(this);\n        }\n        var r = [],\n            gs = this.getGroups(),\n            g,\n            i = 0,\n            len = gs.length,\n            j,\n            jlen;\n        for(; i < len; ++i){\n            g = gs[i].childNodes[1];\n            if(g){\n                g = g.childNodes;\n                for(j = 0, jlen = g.length; j < jlen; ++j){\n                    r[r.length] = g[j];\n                }\n            }\n        }\n        return r;\n    },\n\n    // private\n    updateGroupWidths : function(){\n        if(!this.canGroup() || !this.hasRows()){\n            return;\n        }\n        var tw = Math.max(this.cm.getTotalWidth(), this.el.dom.offsetWidth-this.getScrollOffset()) +'px';\n        var gs = this.getGroups();\n        for(var i = 0, len = gs.length; i < len; i++){\n            gs[i].firstChild.style.width = tw;\n        }\n    },\n\n    // private\n    onColumnWidthUpdated : function(col, w, tw){\n        Ext.grid.GroupingView.superclass.onColumnWidthUpdated.call(this, col, w, tw);\n        this.updateGroupWidths();\n    },\n\n    // private\n    onAllColumnWidthsUpdated : function(ws, tw){\n        Ext.grid.GroupingView.superclass.onAllColumnWidthsUpdated.call(this, ws, tw);\n        this.updateGroupWidths();\n    },\n\n    // private\n    onColumnHiddenUpdated : function(col, hidden, tw){\n        Ext.grid.GroupingView.superclass.onColumnHiddenUpdated.call(this, col, hidden, tw);\n        this.updateGroupWidths();\n    },\n\n    // private\n    onLayout : function(){\n        this.updateGroupWidths();\n    },\n\n    // private\n    onBeforeRowSelect : function(sm, rowIndex){\n        this.toggleRowIndex(rowIndex, true);\n    }\n});\n// private\nExt.grid.GroupingView.GROUP_ID = 1000;"
  },
  {
    "path": "client/src/ext/ext-all-debug.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n(function(){\n\nvar EXTUTIL = Ext.util,\n    EACH = Ext.each,\n    TRUE = true,\n    FALSE = false;\n\nEXTUTIL.Observable = function(){\n    \n    var me = this, e = me.events;\n    if(me.listeners){\n        me.on(me.listeners);\n        delete me.listeners;\n    }\n    me.events = e || {};\n};\n\nEXTUTIL.Observable.prototype = {\n    \n    filterOptRe : /^(?:scope|delay|buffer|single)$/,\n\n    \n    fireEvent : function(){\n        var a = Array.prototype.slice.call(arguments, 0),\n            ename = a[0].toLowerCase(),\n            me = this,\n            ret = TRUE,\n            ce = me.events[ename],\n            cc,\n            q,\n            c;\n        if (me.eventsSuspended === TRUE) {\n            if (q = me.eventQueue) {\n                q.push(a);\n            }\n        }\n        else if(typeof ce == 'object') {\n            if (ce.bubble){\n                if(ce.fire.apply(ce, a.slice(1)) === FALSE) {\n                    return FALSE;\n                }\n                c = me.getBubbleTarget && me.getBubbleTarget();\n                if(c && c.enableBubble) {\n                    cc = c.events[ename];\n                    if(!cc || typeof cc != 'object' || !cc.bubble) {\n                        c.enableBubble(ename);\n                    }\n                    return c.fireEvent.apply(c, a);\n                }\n            }\n            else {\n                a.shift();\n                ret = ce.fire.apply(ce, a);\n            }\n        }\n        return ret;\n    },\n\n    \n    addListener : function(eventName, fn, scope, o){\n        var me = this,\n            e,\n            oe,\n            ce;\n            \n        if (typeof eventName == 'object') {\n            o = eventName;\n            for (e in o) {\n                oe = o[e];\n                if (!me.filterOptRe.test(e)) {\n                    me.addListener(e, oe.fn || oe, oe.scope || o.scope, oe.fn ? oe : o);\n                }\n            }\n        } else {\n            eventName = eventName.toLowerCase();\n            ce = me.events[eventName] || TRUE;\n            if (typeof ce == 'boolean') {\n                me.events[eventName] = ce = new EXTUTIL.Event(me, eventName);\n            }\n            ce.addListener(fn, scope, typeof o == 'object' ? o : {});\n        }\n    },\n\n    \n    removeListener : function(eventName, fn, scope){\n        var ce = this.events[eventName.toLowerCase()];\n        if (typeof ce == 'object') {\n            ce.removeListener(fn, scope);\n        }\n    },\n\n    \n    purgeListeners : function(){\n        var events = this.events,\n            evt,\n            key;\n        for(key in events){\n            evt = events[key];\n            if(typeof evt == 'object'){\n                evt.clearListeners();\n            }\n        }\n    },\n\n    \n    addEvents : function(o){\n        var me = this;\n        me.events = me.events || {};\n        if (typeof o == 'string') {\n            var a = arguments,\n                i = a.length;\n            while(i--) {\n                me.events[a[i]] = me.events[a[i]] || TRUE;\n            }\n        } else {\n            Ext.applyIf(me.events, o);\n        }\n    },\n\n    \n    hasListener : function(eventName){\n        var e = this.events[eventName.toLowerCase()];\n        return typeof e == 'object' && e.listeners.length > 0;\n    },\n\n    \n    suspendEvents : function(queueSuspended){\n        this.eventsSuspended = TRUE;\n        if(queueSuspended && !this.eventQueue){\n            this.eventQueue = [];\n        }\n    },\n\n    \n    resumeEvents : function(){\n        var me = this,\n            queued = me.eventQueue || [];\n        me.eventsSuspended = FALSE;\n        delete me.eventQueue;\n        EACH(queued, function(e) {\n            me.fireEvent.apply(me, e);\n        });\n    }\n};\n\nvar OBSERVABLE = EXTUTIL.Observable.prototype;\n\nOBSERVABLE.on = OBSERVABLE.addListener;\n\nOBSERVABLE.un = OBSERVABLE.removeListener;\n\n\nEXTUTIL.Observable.releaseCapture = function(o){\n    o.fireEvent = OBSERVABLE.fireEvent;\n};\n\nfunction createTargeted(h, o, scope){\n    return function(){\n        if(o.target == arguments[0]){\n            h.apply(scope, Array.prototype.slice.call(arguments, 0));\n        }\n    };\n};\n\nfunction createBuffered(h, o, l, scope){\n    l.task = new EXTUTIL.DelayedTask();\n    return function(){\n        l.task.delay(o.buffer, h, scope, Array.prototype.slice.call(arguments, 0));\n    };\n};\n\nfunction createSingle(h, e, fn, scope){\n    return function(){\n        e.removeListener(fn, scope);\n        return h.apply(scope, arguments);\n    };\n};\n\nfunction createDelayed(h, o, l, scope){\n    return function(){\n        var task = new EXTUTIL.DelayedTask(),\n            args = Array.prototype.slice.call(arguments, 0);\n        if(!l.tasks) {\n            l.tasks = [];\n        }\n        l.tasks.push(task);\n        task.delay(o.delay || 10, function(){\n            l.tasks.remove(task);\n            h.apply(scope, args);\n        }, scope);\n    };\n};\n\nEXTUTIL.Event = function(obj, name){\n    this.name = name;\n    this.obj = obj;\n    this.listeners = [];\n};\n\nEXTUTIL.Event.prototype = {\n    addListener : function(fn, scope, options){\n        var me = this,\n            l;\n        scope = scope || me.obj;\n        if(!me.isListening(fn, scope)){\n            l = me.createListener(fn, scope, options);\n            if(me.firing){ \n                me.listeners = me.listeners.slice(0);\n            }\n            me.listeners.push(l);\n        }\n    },\n\n    createListener: function(fn, scope, o){\n        o = o || {};\n        scope = scope || this.obj;\n        var l = {\n            fn: fn,\n            scope: scope,\n            options: o\n        }, h = fn;\n        if(o.target){\n            h = createTargeted(h, o, scope);\n        }\n        if(o.delay){\n            h = createDelayed(h, o, l, scope);\n        }\n        if(o.single){\n            h = createSingle(h, this, fn, scope);\n        }\n        if(o.buffer){\n            h = createBuffered(h, o, l, scope);\n        }\n        l.fireFn = h;\n        return l;\n    },\n\n    findListener : function(fn, scope){\n        var list = this.listeners,\n            i = list.length,\n            l;\n\n        scope = scope || this.obj;\n        while(i--){\n            l = list[i];\n            if(l){\n                if(l.fn == fn && l.scope == scope){\n                    return i;\n                }\n            }\n        }\n        return -1;\n    },\n\n    isListening : function(fn, scope){\n        return this.findListener(fn, scope) != -1;\n    },\n\n    removeListener : function(fn, scope){\n        var index,\n            l,\n            k,\n            me = this,\n            ret = FALSE;\n        if((index = me.findListener(fn, scope)) != -1){\n            if (me.firing) {\n                me.listeners = me.listeners.slice(0);\n            }\n            l = me.listeners[index];\n            if(l.task) {\n                l.task.cancel();\n                delete l.task;\n            }\n            k = l.tasks && l.tasks.length;\n            if(k) {\n                while(k--) {\n                    l.tasks[k].cancel();\n                }\n                delete l.tasks;\n            }\n            me.listeners.splice(index, 1);\n            ret = TRUE;\n        }\n        return ret;\n    },\n\n    \n    clearListeners : function(){\n        var me = this,\n            l = me.listeners,\n            i = l.length;\n        while(i--) {\n            me.removeListener(l[i].fn, l[i].scope);\n        }\n    },\n\n    fire : function(){\n        var me = this,\n            listeners = me.listeners,\n            len = listeners.length,\n            i = 0,\n            l;\n\n        if(len > 0){\n            me.firing = TRUE;\n            var args = Array.prototype.slice.call(arguments, 0);\n            for (; i < len; i++) {\n                l = listeners[i];\n                if(l && l.fireFn.apply(l.scope || me.obj || window, args) === FALSE) {\n                    return (me.firing = FALSE);\n                }\n            }\n        }\n        me.firing = FALSE;\n        return TRUE;\n    }\n\n};\n})();\n\nExt.DomHelper = function(){\n    var tempTableEl = null,\n        emptyTags = /^(?:br|frame|hr|img|input|link|meta|range|spacer|wbr|area|param|col)$/i,\n        tableRe = /^table|tbody|tr|td$/i,\n        confRe = /tag|children|cn|html$/i,\n        tableElRe = /td|tr|tbody/i,\n        cssRe = /([a-z0-9-]+)\\s*:\\s*([^;\\s]+(?:\\s*[^;\\s]+)*);?/gi,\n        endRe = /end/i,\n        pub,\n        \n        afterbegin = 'afterbegin',\n        afterend = 'afterend',\n        beforebegin = 'beforebegin',\n        beforeend = 'beforeend',\n        ts = '<table>',\n        te = '</table>',\n        tbs = ts+'<tbody>',\n        tbe = '</tbody>'+te,\n        trs = tbs + '<tr>',\n        tre = '</tr>'+tbe;\n\n    \n    function doInsert(el, o, returnElement, pos, sibling, append){\n        var newNode = pub.insertHtml(pos, Ext.getDom(el), createHtml(o));\n        return returnElement ? Ext.get(newNode, true) : newNode;\n    }\n\n    \n    function createHtml(o){\n        var b = '',\n            attr,\n            val,\n            key,\n            cn;\n\n        if(typeof o == \"string\"){\n            b = o;\n        } else if (Ext.isArray(o)) {\n            for (var i=0; i < o.length; i++) {\n                if(o[i]) {\n                    b += createHtml(o[i]);\n                }\n            };\n        } else {\n            b += '<' + (o.tag = o.tag || 'div');\n            for (attr in o) {\n                val = o[attr];\n                if(!confRe.test(attr)){\n                    if (typeof val == \"object\") {\n                        b += ' ' + attr + '=\"';\n                        for (key in val) {\n                            b += key + ':' + val[key] + ';';\n                        };\n                        b += '\"';\n                    }else{\n                        b += ' ' + ({cls : 'class', htmlFor : 'for'}[attr] || attr) + '=\"' + val + '\"';\n                    }\n                }\n            };\n            \n            if (emptyTags.test(o.tag)) {\n                b += '/>';\n            } else {\n                b += '>';\n                if ((cn = o.children || o.cn)) {\n                    b += createHtml(cn);\n                } else if(o.html){\n                    b += o.html;\n                }\n                b += '</' + o.tag + '>';\n            }\n        }\n        return b;\n    }\n\n    function ieTable(depth, s, h, e){\n        tempTableEl.innerHTML = [s, h, e].join('');\n        var i = -1,\n            el = tempTableEl,\n            ns;\n        while(++i < depth){\n            el = el.firstChild;\n        }\n\n        if(ns = el.nextSibling){\n            var df = document.createDocumentFragment();\n            while(el){\n                ns = el.nextSibling;\n                df.appendChild(el);\n                el = ns;\n            }\n            el = df;\n        }\n        return el;\n    }\n\n    \n    function insertIntoTable(tag, where, el, html) {\n        var node,\n            before;\n\n        tempTableEl = tempTableEl || document.createElement('div');\n\n        if(tag == 'td' && (where == afterbegin || where == beforeend) ||\n           !tableElRe.test(tag) && (where == beforebegin || where == afterend)) {\n            return;\n        }\n        before = where == beforebegin ? el :\n                 where == afterend ? el.nextSibling :\n                 where == afterbegin ? el.firstChild : null;\n\n        if (where == beforebegin || where == afterend) {\n            el = el.parentNode;\n        }\n\n        if (tag == 'td' || (tag == 'tr' && (where == beforeend || where == afterbegin))) {\n            node = ieTable(4, trs, html, tre);\n        } else if ((tag == 'tbody' && (where == beforeend || where == afterbegin)) ||\n                   (tag == 'tr' && (where == beforebegin || where == afterend))) {\n            node = ieTable(3, tbs, html, tbe);\n        } else {\n            node = ieTable(2, ts, html, te);\n        }\n        el.insertBefore(node, before);\n        return node;\n    }\n\n       \n    function createContextualFragment(html){\n        var div = document.createElement(\"div\"),\n            fragment = document.createDocumentFragment(),\n            i = 0,\n            length, childNodes;\n        \n        div.innerHTML = html;\n        childNodes = div.childNodes;\n        length = childNodes.length;\n        \n        for (; i < length; i++) {\n            fragment.appendChild(childNodes[i].cloneNode(true));\n        }\n        \n        return fragment;\n    }\n    \n    pub = {\n        \n        markup : function(o){\n            return createHtml(o);\n        },\n\n        \n        applyStyles : function(el, styles){\n            if (styles) {\n                var matches;\n\n                el = Ext.fly(el);\n                if (typeof styles == \"function\") {\n                    styles = styles.call();\n                }\n                if (typeof styles == \"string\") {\n                    \n                    cssRe.lastIndex = 0;\n                    while ((matches = cssRe.exec(styles))) {\n                        el.setStyle(matches[1], matches[2]);\n                    }\n                } else if (typeof styles == \"object\") {\n                    el.setStyle(styles);\n                }\n            }\n        },\n        \n        insertHtml : function(where, el, html){\n            var hash = {},\n                hashVal,\n                range,\n                rangeEl,\n                setStart,\n                frag,\n                rs;\n\n            where = where.toLowerCase();\n            \n            hash[beforebegin] = ['BeforeBegin', 'previousSibling'];\n            hash[afterend] = ['AfterEnd', 'nextSibling'];\n\n            if (el.insertAdjacentHTML) {\n                if(tableRe.test(el.tagName) && (rs = insertIntoTable(el.tagName.toLowerCase(), where, el, html))){\n                    return rs;\n                }\n                \n                hash[afterbegin] = ['AfterBegin', 'firstChild'];\n                hash[beforeend] = ['BeforeEnd', 'lastChild'];\n                if ((hashVal = hash[where])) {\n                    el.insertAdjacentHTML(hashVal[0], html);\n                    return el[hashVal[1]];\n                }\n            } else {\n                range = el.ownerDocument.createRange();\n                setStart = 'setStart' + (endRe.test(where) ? 'After' : 'Before');\n                if (hash[where]) {\n                    range[setStart](el);\n                    if (!range.createContextualFragment) {\n                        frag = createContextualFragment(html);\n                    }\n                    else {\n                        frag = range.createContextualFragment(html);\n                    }\n                    el.parentNode.insertBefore(frag, where == beforebegin ? el : el.nextSibling);\n                    return el[(where == beforebegin ? 'previous' : 'next') + 'Sibling'];\n                } else {\n                    rangeEl = (where == afterbegin ? 'first' : 'last') + 'Child';\n                    if (el.firstChild) {\n                        range[setStart](el[rangeEl]);\n                        if (!range.createContextualFragment) {\n                            frag = createContextualFragment(html);\n                        }\n                        else {\n                            frag = range.createContextualFragment(html);\n                        }\n                        if(where == afterbegin){\n                            el.insertBefore(frag, el.firstChild);\n                        }else{\n                            el.appendChild(frag);\n                        }\n                    } else {\n                        el.innerHTML = html;\n                    }\n                    return el[rangeEl];\n                }\n            }\n            throw 'Illegal insertion point -> \"' + where + '\"';\n        },\n\n        \n        insertBefore : function(el, o, returnElement){\n            return doInsert(el, o, returnElement, beforebegin);\n        },\n\n        \n        insertAfter : function(el, o, returnElement){\n            return doInsert(el, o, returnElement, afterend, 'nextSibling');\n        },\n\n        \n        insertFirst : function(el, o, returnElement){\n            return doInsert(el, o, returnElement, afterbegin, 'firstChild');\n        },\n\n        \n        append : function(el, o, returnElement){\n            return doInsert(el, o, returnElement, beforeend, '', true);\n        },\n\n        \n        overwrite : function(el, o, returnElement){\n            el = Ext.getDom(el);\n            el.innerHTML = createHtml(o);\n            return returnElement ? Ext.get(el.firstChild) : el.firstChild;\n        },\n\n        createHtml : createHtml\n    };\n    return pub;\n}();\n\nExt.Template = function(html){\n    var me = this,\n        a = arguments,\n        buf = [],\n        v;\n\n    if (Ext.isArray(html)) {\n        html = html.join(\"\");\n    } else if (a.length > 1) {\n        for(var i = 0, len = a.length; i < len; i++){\n            v = a[i];\n            if(typeof v == 'object'){\n                Ext.apply(me, v);\n            } else {\n                buf.push(v);\n            }\n        };\n        html = buf.join('');\n    }\n\n    \n    me.html = html;\n    \n    if (me.compiled) {\n        me.compile();\n    }\n};\nExt.Template.prototype = {\n    \n    re : /\\{([\\w\\-]+)\\}/g,\n    \n\n    \n    applyTemplate : function(values){\n        var me = this;\n\n        return me.compiled ?\n                me.compiled(values) :\n                me.html.replace(me.re, function(m, name){\n                    return values[name] !== undefined ? values[name] : \"\";\n                });\n    },\n\n    \n    set : function(html, compile){\n        var me = this;\n        me.html = html;\n        me.compiled = null;\n        return compile ? me.compile() : me;\n    },\n\n    \n    compile : function(){\n        var me = this,\n            sep = Ext.isGecko ? \"+\" : \",\";\n\n        function fn(m, name){\n            name = \"values['\" + name + \"']\";\n            return \"'\"+ sep + '(' + name + \" == undefined ? '' : \" + name + ')' + sep + \"'\";\n        }\n\n        eval(\"this.compiled = function(values){ return \" + (Ext.isGecko ? \"'\" : \"['\") +\n             me.html.replace(/\\\\/g, '\\\\\\\\').replace(/(\\r\\n|\\n)/g, '\\\\n').replace(/'/g, \"\\\\'\").replace(this.re, fn) +\n             (Ext.isGecko ?  \"';};\" : \"'].join('');};\"));\n        return me;\n    },\n\n    \n    insertFirst: function(el, values, returnElement){\n        return this.doInsert('afterBegin', el, values, returnElement);\n    },\n\n    \n    insertBefore: function(el, values, returnElement){\n        return this.doInsert('beforeBegin', el, values, returnElement);\n    },\n\n    \n    insertAfter : function(el, values, returnElement){\n        return this.doInsert('afterEnd', el, values, returnElement);\n    },\n\n    \n    append : function(el, values, returnElement){\n        return this.doInsert('beforeEnd', el, values, returnElement);\n    },\n\n    doInsert : function(where, el, values, returnEl){\n        el = Ext.getDom(el);\n        var newNode = Ext.DomHelper.insertHtml(where, el, this.applyTemplate(values));\n        return returnEl ? Ext.get(newNode, true) : newNode;\n    },\n\n    \n    overwrite : function(el, values, returnElement){\n        el = Ext.getDom(el);\n        el.innerHTML = this.applyTemplate(values);\n        return returnElement ? Ext.get(el.firstChild, true) : el.firstChild;\n    }\n};\n\nExt.Template.prototype.apply = Ext.Template.prototype.applyTemplate;\n\n\nExt.Template.from = function(el, config){\n    el = Ext.getDom(el);\n    return new Ext.Template(el.value || el.innerHTML, config || '');\n};\n\n\nExt.DomQuery = function(){\n    var cache = {}, \n    \tsimpleCache = {}, \n    \tvalueCache = {},\n    \tnonSpace = /\\S/,\n    \ttrimRe = /^\\s+|\\s+$/g,\n    \ttplRe = /\\{(\\d+)\\}/g,\n    \tmodeRe = /^(\\s?[\\/>+~]\\s?|\\s|$)/,\n    \ttagTokenRe = /^(#)?([\\w\\-\\*]+)/,\n    \tnthRe = /(\\d*)n\\+?(\\d*)/, \n    \tnthRe2 = /\\D/,\n    \t\n\t\n\t\n\tisIE = window.ActiveXObject ? true : false,\n\tkey = 30803;\n    \n    \n    \n    eval(\"var batch = 30803;\");    \t\n\n    \n    \n    function child(parent, index){\n        var i = 0,\n            n = parent.firstChild;\n        while(n){\n            if(n.nodeType == 1){\n               if(++i == index){\n                   return n;\n               }\n            }\n            n = n.nextSibling;\n        }\n        return null;\n    }\n\n    \n    function next(n){\t\n        while((n = n.nextSibling) && n.nodeType != 1);\n        return n;\n    }\n\n    \n    function prev(n){\n        while((n = n.previousSibling) && n.nodeType != 1);\n        return n;\n    }\n\n    \n    \n    function children(parent){\n        var n = parent.firstChild,\n\t    nodeIndex = -1,\n\t    nextNode;\n\twhile(n){\n\t    nextNode = n.nextSibling;\n\t    \n\t    if(n.nodeType == 3 && !nonSpace.test(n.nodeValue)){\n\t\tparent.removeChild(n);\n\t    }else{\n\t\t\n\t\tn.nodeIndex = ++nodeIndex;\n\t    }\n\t    n = nextNode;\n\t}\n\treturn this;\n    }\n\n\n    \n    \n    function byClassName(nodeSet, cls){\n        if(!cls){\n            return nodeSet;\n        }\n        var result = [], ri = -1;\n        for(var i = 0, ci; ci = nodeSet[i]; i++){\n            if((' '+ci.className+' ').indexOf(cls) != -1){\n                result[++ri] = ci;\n            }\n        }\n        return result;\n    };\n\n    function attrValue(n, attr){\n\t\n        if(!n.tagName && typeof n.length != \"undefined\"){\n            n = n[0];\n        }\n        if(!n){\n            return null;\n        }\n\n        if(attr == \"for\"){\n            return n.htmlFor;\n        }\n        if(attr == \"class\" || attr == \"className\"){\n            return n.className;\n        }\n        return n.getAttribute(attr) || n[attr];\n\n    };\n\n\n    \n    \n    \n    function getNodes(ns, mode, tagName){\n        var result = [], ri = -1, cs;\n        if(!ns){\n            return result;\n        }\n        tagName = tagName || \"*\";\n\t\n        if(typeof ns.getElementsByTagName != \"undefined\"){\n            ns = [ns];\n        }\n\t\n\t\n\t\n        if(!mode){\n            for(var i = 0, ni; ni = ns[i]; i++){\n                cs = ni.getElementsByTagName(tagName);\n                for(var j = 0, ci; ci = cs[j]; j++){\n                    result[++ri] = ci;\n                }\n            }\n\t\n\t\n        } else if(mode == \"/\" || mode == \">\"){\n            var utag = tagName.toUpperCase();\n            for(var i = 0, ni, cn; ni = ns[i]; i++){\n                cn = ni.childNodes;\n                for(var j = 0, cj; cj = cn[j]; j++){\n                    if(cj.nodeName == utag || cj.nodeName == tagName  || tagName == '*'){\n                        result[++ri] = cj;\n                    }\n                }\n            }\n\t\n\t\n        }else if(mode == \"+\"){\n            var utag = tagName.toUpperCase();\n            for(var i = 0, n; n = ns[i]; i++){\n                while((n = n.nextSibling) && n.nodeType != 1);\n                if(n && (n.nodeName == utag || n.nodeName == tagName || tagName == '*')){\n                    result[++ri] = n;\n                }\n            }\n\t\n\t\n        }else if(mode == \"~\"){\n            var utag = tagName.toUpperCase();\n            for(var i = 0, n; n = ns[i]; i++){\n                while((n = n.nextSibling)){\n                    if (n.nodeName == utag || n.nodeName == tagName || tagName == '*'){\n                        result[++ri] = n;\n                    }\n                }\n            }\n        }\n        return result;\n    }\n\n    function concat(a, b){\n        if(b.slice){\n            return a.concat(b);\n        }\n        for(var i = 0, l = b.length; i < l; i++){\n            a[a.length] = b[i];\n        }\n        return a;\n    }\n\n    function byTag(cs, tagName){\n        if(cs.tagName || cs == document){\n            cs = [cs];\n        }\n        if(!tagName){\n            return cs;\n        }\n        var result = [], ri = -1;\n        tagName = tagName.toLowerCase();\n        for(var i = 0, ci; ci = cs[i]; i++){\n            if(ci.nodeType == 1 && ci.tagName.toLowerCase() == tagName){\n                result[++ri] = ci;\n            }\n        }\n        return result;\n    }\n\n    function byId(cs, id){\n        if(cs.tagName || cs == document){\n            cs = [cs];\n        }\n        if(!id){\n            return cs;\n        }\n        var result = [], ri = -1;\n        for(var i = 0, ci; ci = cs[i]; i++){\n            if(ci && ci.id == id){\n                result[++ri] = ci;\n                return result;\n            }\n        }\n        return result;\n    }\n\n    \n    \n    function byAttribute(cs, attr, value, op, custom){\n        var result = [], \n            ri = -1, \n            useGetStyle = custom == \"{\",\t    \n            fn = Ext.DomQuery.operators[op],\t    \n            a,\n            xml,\n            hasXml;\n            \n        for(var i = 0, ci; ci = cs[i]; i++){\n\t    \n            if(ci.nodeType != 1){\n                continue;\n            }\n            \n            if(!hasXml){\n                xml = Ext.DomQuery.isXml(ci);\n                hasXml = true;\n            }\n\t    \n            \n            if(!xml){\n                if(useGetStyle){\n                    a = Ext.DomQuery.getStyle(ci, attr);\n                } else if (attr == \"class\" || attr == \"className\"){\n                    a = ci.className;\n                } else if (attr == \"for\"){\n                    a = ci.htmlFor;\n                } else if (attr == \"href\"){\n\t\t    \n\t\t    \n                    a = ci.getAttribute(\"href\", 2);\n                } else{\n                    a = ci.getAttribute(attr);\n                }\n            }else{\n                a = ci.getAttribute(attr);\n            }\n            if((fn && fn(a, value)) || (!fn && a)){\n                result[++ri] = ci;\n            }\n        }\n        return result;\n    }\n\n    function byPseudo(cs, name, value){\n        return Ext.DomQuery.pseudos[name](cs, value);\n    }\n\n    function nodupIEXml(cs){\n        var d = ++key, \n            r;\n        cs[0].setAttribute(\"_nodup\", d);\n        r = [cs[0]];\n        for(var i = 1, len = cs.length; i < len; i++){\n            var c = cs[i];\n            if(!c.getAttribute(\"_nodup\") != d){\n                c.setAttribute(\"_nodup\", d);\n                r[r.length] = c;\n            }\n        }\n        for(var i = 0, len = cs.length; i < len; i++){\n            cs[i].removeAttribute(\"_nodup\");\n        }\n        return r;\n    }\n\n    function nodup(cs){\n        if(!cs){\n            return [];\n        }\n        var len = cs.length, c, i, r = cs, cj, ri = -1;\n        if(!len || typeof cs.nodeType != \"undefined\" || len == 1){\n            return cs;\n        }\n        if(isIE && typeof cs[0].selectSingleNode != \"undefined\"){\n            return nodupIEXml(cs);\n        }\n        var d = ++key;\n        cs[0]._nodup = d;\n        for(i = 1; c = cs[i]; i++){\n            if(c._nodup != d){\n                c._nodup = d;\n            }else{\n                r = [];\n                for(var j = 0; j < i; j++){\n                    r[++ri] = cs[j];\n                }\n                for(j = i+1; cj = cs[j]; j++){\n                    if(cj._nodup != d){\n                        cj._nodup = d;\n                        r[++ri] = cj;\n                    }\n                }\n                return r;\n            }\n        }\n        return r;\n    }\n\n    function quickDiffIEXml(c1, c2){\n        var d = ++key,\n            r = [];\n        for(var i = 0, len = c1.length; i < len; i++){\n            c1[i].setAttribute(\"_qdiff\", d);\n        }        \n        for(var i = 0, len = c2.length; i < len; i++){\n            if(c2[i].getAttribute(\"_qdiff\") != d){\n                r[r.length] = c2[i];\n            }\n        }\n        for(var i = 0, len = c1.length; i < len; i++){\n           c1[i].removeAttribute(\"_qdiff\");\n        }\n        return r;\n    }\n\n    function quickDiff(c1, c2){\n        var len1 = c1.length,\n        \td = ++key,\n        \tr = [];\n        if(!len1){\n            return c2;\n        }\n        if(isIE && typeof c1[0].selectSingleNode != \"undefined\"){\n            return quickDiffIEXml(c1, c2);\n        }        \n        for(var i = 0; i < len1; i++){\n            c1[i]._qdiff = d;\n        }        \n        for(var i = 0, len = c2.length; i < len; i++){\n            if(c2[i]._qdiff != d){\n                r[r.length] = c2[i];\n            }\n        }\n        return r;\n    }\n\n    function quickId(ns, mode, root, id){\n        if(ns == root){\n           var d = root.ownerDocument || root;\n           return d.getElementById(id);\n        }\n        ns = getNodes(ns, mode, \"*\");\n        return byId(ns, id);\n    }\n\n    return {\n        getStyle : function(el, name){\n            return Ext.fly(el).getStyle(name);\n        },\n        \n        compile : function(path, type){\n            type = type || \"select\";\n\n    \t    \n            var fn = [\"var f = function(root){\\n var mode; ++batch; var n = root || document;\\n\"],\n        \t\tmode,\t\t\n        \t\tlastPath,\n            \tmatchers = Ext.DomQuery.matchers,\n            \tmatchersLn = matchers.length,\n            \tmodeMatch,\n            \t\n            \tlmode = path.match(modeRe);\n            \n            if(lmode && lmode[1]){\n                fn[fn.length] = 'mode=\"'+lmode[1].replace(trimRe, \"\")+'\";';\n                path = path.replace(lmode[1], \"\");\n            }\n\t    \n            \n            while(path.substr(0, 1)==\"/\"){\n                path = path.substr(1);\n            }\n\n            while(path && lastPath != path){\n                lastPath = path;\n                var tokenMatch = path.match(tagTokenRe);\n                if(type == \"select\"){\n                    if(tokenMatch){\n\t\t\t\n                        if(tokenMatch[1] == \"#\"){\n                            fn[fn.length] = 'n = quickId(n, mode, root, \"'+tokenMatch[2]+'\");';\t\t\t\n                        }else{\n                            fn[fn.length] = 'n = getNodes(n, mode, \"'+tokenMatch[2]+'\");';\n                        }\n                        path = path.replace(tokenMatch[0], \"\");\n                    }else if(path.substr(0, 1) != '@'){\n                        fn[fn.length] = 'n = getNodes(n, mode, \"*\");';\n                    }\n\t\t\n                }else{\n                    if(tokenMatch){\n                        if(tokenMatch[1] == \"#\"){\n                            fn[fn.length] = 'n = byId(n, \"'+tokenMatch[2]+'\");';\n                        }else{\n                            fn[fn.length] = 'n = byTag(n, \"'+tokenMatch[2]+'\");';\n                        }\n                        path = path.replace(tokenMatch[0], \"\");\n                    }\n                }\n                while(!(modeMatch = path.match(modeRe))){\n                    var matched = false;\n                    for(var j = 0; j < matchersLn; j++){\n                        var t = matchers[j];\n                        var m = path.match(t.re);\n                        if(m){\n                            fn[fn.length] = t.select.replace(tplRe, function(x, i){\n\t\t\t\treturn m[i];\n\t\t\t    });\n                            path = path.replace(m[0], \"\");\n                            matched = true;\n                            break;\n                        }\n                    }\n                    \n                    if(!matched){\n                        throw 'Error parsing selector, parsing failed at \"' + path + '\"';\n                    }\n                }\n                if(modeMatch[1]){\n                    fn[fn.length] = 'mode=\"'+modeMatch[1].replace(trimRe, \"\")+'\";';\n                    path = path.replace(modeMatch[1], \"\");\n                }\n            }\n\t    \n            fn[fn.length] = \"return nodup(n);\\n}\";\n\t    \n\t    \n            eval(fn.join(\"\"));\n            return f;\n        },\n\n        \n\tjsSelect: function(path, root, type){\n\t    \n\t    root = root || document;\n\t    \n            if(typeof root == \"string\"){\n                root = document.getElementById(root);\n            }\n            var paths = path.split(\",\"),\n            \tresults = [];\n\t\t\n\t    \n            for(var i = 0, len = paths.length; i < len; i++){\t\t\n                var subPath = paths[i].replace(trimRe, \"\");\n\t\t\n                if(!cache[subPath]){\n                    cache[subPath] = Ext.DomQuery.compile(subPath);\n                    if(!cache[subPath]){\n                        throw subPath + \" is not a valid selector\";\n                    }\n                }\n                var result = cache[subPath](root);\n                if(result && result != document){\n                    results = results.concat(result);\n                }\n            }\n\t    \n\t    \n\t    \n            if(paths.length > 1){\n                return nodup(results);\n            }\n            return results;\n        },\n\tisXml: function(el) {\n\t    var docEl = (el ? el.ownerDocument || el : 0).documentElement;\n\t    return docEl ? docEl.nodeName !== \"HTML\" : false;\n\t},\n        select : document.querySelectorAll ? function(path, root, type) {\n\t    root = root || document;\n\t    if (!Ext.DomQuery.isXml(root)) {\n\t\ttry {\n\t\t    var cs = root.querySelectorAll(path);\n\t\t    return Ext.toArray(cs);\n\t\t}\n\t\tcatch (ex) {}\t\t\n\t    }\t    \n\t    return Ext.DomQuery.jsSelect.call(this, path, root, type);\n\t} : function(path, root, type) {\n\t    return Ext.DomQuery.jsSelect.call(this, path, root, type);\n\t},\n\n        \n        selectNode : function(path, root){\n            return Ext.DomQuery.select(path, root)[0];\n        },\n\n        \n        selectValue : function(path, root, defaultValue){\n            path = path.replace(trimRe, \"\");\n            if(!valueCache[path]){\n                valueCache[path] = Ext.DomQuery.compile(path, \"select\");\n            }\n            var n = valueCache[path](root), v;\n            n = n[0] ? n[0] : n;\n            \t    \n\t    \n\t    \n\t    \n\t    \n            if (typeof n.normalize == 'function') n.normalize();\n            \n            v = (n && n.firstChild ? n.firstChild.nodeValue : null);\n            return ((v === null||v === undefined||v==='') ? defaultValue : v);\n        },\n\n        \n        selectNumber : function(path, root, defaultValue){\n            var v = Ext.DomQuery.selectValue(path, root, defaultValue || 0);\n            return parseFloat(v);\n        },\n\n        \n        is : function(el, ss){\n            if(typeof el == \"string\"){\n                el = document.getElementById(el);\n            }\n            var isArray = Ext.isArray(el),\n            \tresult = Ext.DomQuery.filter(isArray ? el : [el], ss);\n            return isArray ? (result.length == el.length) : (result.length > 0);\n        },\n\n        \n        filter : function(els, ss, nonMatches){\n            ss = ss.replace(trimRe, \"\");\n            if(!simpleCache[ss]){\n                simpleCache[ss] = Ext.DomQuery.compile(ss, \"simple\");\n            }\n            var result = simpleCache[ss](els);\n            return nonMatches ? quickDiff(result, els) : result;\n        },\n\n        \n        matchers : [{\n                re: /^\\.([\\w\\-]+)/,\n                select: 'n = byClassName(n, \" {1} \");'\n            }, {\n                re: /^\\:([\\w\\-]+)(?:\\(((?:[^\\s>\\/]*|.*?))\\))?/,\n                select: 'n = byPseudo(n, \"{1}\", \"{2}\");'\n            },{\n                re: /^(?:([\\[\\{])(?:@)?([\\w\\-]+)\\s?(?:(=|.=)\\s?([\"']?)(.*?)\\4)?[\\]\\}])/,\n                select: 'n = byAttribute(n, \"{2}\", \"{5}\", \"{3}\", \"{1}\");'\n            }, {\n                re: /^#([\\w\\-]+)/,\n                select: 'n = byId(n, \"{1}\");'\n            },{\n                re: /^@([\\w\\-]+)/,\n                select: 'return {firstChild:{nodeValue:attrValue(n, \"{1}\")}};'\n            }\n        ],\n\n        /**\n         * Collection of operator comparison functions. The default operators are =, !=, ^=, $=, *=, %=, |= and ~=.\n         * New operators can be added as long as the match the format <i>c</i>= where <i>c</i> is any character other than space, &gt; &lt;.\n         */\n        operators : {\n            \"=\" : function(a, v){\n                return a == v;\n            },\n            \"!=\" : function(a, v){\n                return a != v;\n            },\n            \"^=\" : function(a, v){\n                return a && a.substr(0, v.length) == v;\n            },\n            \"$=\" : function(a, v){\n                return a && a.substr(a.length-v.length) == v;\n            },\n            \"*=\" : function(a, v){\n                return a && a.indexOf(v) !== -1;\n            },\n            \"%=\" : function(a, v){\n                return (a % v) == 0;\n            },\n            \"|=\" : function(a, v){\n                return a && (a == v || a.substr(0, v.length+1) == v+'-');\n            },\n            \"~=\" : function(a, v){\n                return a && (' '+a+' ').indexOf(' '+v+' ') != -1;\n            }\n        },\n\n        /**\n         * <p>Object hash of \"pseudo class\" filter functions which are used when filtering selections. Each function is passed\n         * two parameters:</p><div class=\"mdetail-params\"><ul>\n         * <li><b>c</b> : Array<div class=\"sub-desc\">An Array of DOM elements to filter.</div></li>\n         * <li><b>v</b> : String<div class=\"sub-desc\">The argument (if any) supplied in the selector.</div></li>\n         * </ul></div>\n         * <p>A filter function returns an Array of DOM elements which conform to the pseudo class.</p>\n         * <p>In addition to the provided pseudo classes listed above such as <code>first-child</code> and <code>nth-child</code>,\n         * developers may add additional, custom psuedo class filters to select elements according to application-specific requirements.</p>\n         * <p>For example, to filter <code>&lt;a></code> elements to only return links to <i>external</i> resources:</p>\n         * <code><pre>\nExt.DomQuery.pseudos.external = function(c, v){\n    var r = [], ri = -1;\n    for(var i = 0, ci; ci = c[i]; i++){\n//      Include in result set only if it's a link to an external resource\n        if(ci.hostname != location.hostname){\n            r[++ri] = ci;\n        }\n    }\n    return r;\n};</pre></code>\n         * Then external links could be gathered with the following statement:<code><pre>\nvar externalLinks = Ext.select(\"a:external\");\n</code></pre>\n         */\n        pseudos : {\n            \"first-child\" : function(c){\n                var r = [], ri = -1, n;\n                for(var i = 0, ci; ci = n = c[i]; i++){\n                    while((n = n.previousSibling) && n.nodeType != 1);\n                    if(!n){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"last-child\" : function(c){\n                var r = [], ri = -1, n;\n                for(var i = 0, ci; ci = n = c[i]; i++){\n                    while((n = n.nextSibling) && n.nodeType != 1);\n                    if(!n){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"nth-child\" : function(c, a) {\n                var r = [], ri = -1,\n                \tm = nthRe.exec(a == \"even\" && \"2n\" || a == \"odd\" && \"2n+1\" || !nthRe2.test(a) && \"n+\" + a || a),\n                \tf = (m[1] || 1) - 0, l = m[2] - 0;\n                for(var i = 0, n; n = c[i]; i++){\n                    var pn = n.parentNode;\n                    if (batch != pn._batch) {\n                        var j = 0;\n                        for(var cn = pn.firstChild; cn; cn = cn.nextSibling){\n                            if(cn.nodeType == 1){\n                               cn.nodeIndex = ++j;\n                            }\n                        }\n                        pn._batch = batch;\n                    }\n                    if (f == 1) {\n                        if (l == 0 || n.nodeIndex == l){\n                            r[++ri] = n;\n                        }\n                    } else if ((n.nodeIndex + l) % f == 0){\n                        r[++ri] = n;\n                    }\n                }\n\n                return r;\n            },\n\n            \"only-child\" : function(c){\n                var r = [], ri = -1;;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    if(!prev(ci) && !next(ci)){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"empty\" : function(c){\n                var r = [], ri = -1;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    var cns = ci.childNodes, j = 0, cn, empty = true;\n                    while(cn = cns[j]){\n                        ++j;\n                        if(cn.nodeType == 1 || cn.nodeType == 3){\n                            empty = false;\n                            break;\n                        }\n                    }\n                    if(empty){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"contains\" : function(c, v){\n                var r = [], ri = -1;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    if((ci.textContent||ci.innerText||'').indexOf(v) != -1){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"nodeValue\" : function(c, v){\n                var r = [], ri = -1;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    if(ci.firstChild && ci.firstChild.nodeValue == v){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"checked\" : function(c){\n                var r = [], ri = -1;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    if(ci.checked == true){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"not\" : function(c, ss){\n                return Ext.DomQuery.filter(c, ss, true);\n            },\n\n            \"any\" : function(c, selectors){\n                var ss = selectors.split('|'),\n                \tr = [], ri = -1, s;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    for(var j = 0; s = ss[j]; j++){\n                        if(Ext.DomQuery.is(ci, s)){\n                            r[++ri] = ci;\n                            break;\n                        }\n                    }\n                }\n                return r;\n            },\n\n            \"odd\" : function(c){\n                return this[\"nth-child\"](c, \"odd\");\n            },\n\n            \"even\" : function(c){\n                return this[\"nth-child\"](c, \"even\");\n            },\n\n            \"nth\" : function(c, a){\n                return c[a-1] || [];\n            },\n\n            \"first\" : function(c){\n                return c[0] || [];\n            },\n\n            \"last\" : function(c){\n                return c[c.length-1] || [];\n            },\n\n            \"has\" : function(c, ss){\n                var s = Ext.DomQuery.select,\n                \tr = [], ri = -1;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    if(s(ss, ci).length > 0){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"next\" : function(c, ss){\n                var is = Ext.DomQuery.is,\n                \tr = [], ri = -1;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    var n = next(ci);\n                    if(n && is(n, ss)){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            },\n\n            \"prev\" : function(c, ss){\n                var is = Ext.DomQuery.is,\n                \tr = [], ri = -1;\n                for(var i = 0, ci; ci = c[i]; i++){\n                    var n = prev(ci);\n                    if(n && is(n, ss)){\n                        r[++ri] = ci;\n                    }\n                }\n                return r;\n            }\n        }\n    };\n}();\n\n/**\n * Selects an array of DOM nodes by CSS/XPath selector. Shorthand of {@link Ext.DomQuery#select}\n * @param {String} path The selector/xpath query\n * @param {Node} root (optional) The start of the query (defaults to document).\n * @return {Array}\n * @member Ext\n * @method query\n */\nExt.query = Ext.DomQuery.select;\n/**\n * @class Ext.util.DelayedTask\n * <p> The DelayedTask class provides a convenient way to \"buffer\" the execution of a method,\n * performing setTimeout where a new timeout cancels the old timeout. When called, the\n * task will wait the specified time period before executing. If durng that time period,\n * the task is called again, the original call will be cancelled. This continues so that\n * the function is only called a single time for each iteration.</p>\n * <p>This method is especially useful for things like detecting whether a user has finished\n * typing in a text field. An example would be performing validation on a keypress. You can\n * use this class to buffer the keypress events for a certain number of milliseconds, and\n * perform only if they stop for that amount of time.  Usage:</p><pre><code>\nvar task = new Ext.util.DelayedTask(function(){\n    alert(Ext.getDom('myInputField').value.length);\n});\n// Wait 500ms before calling our function. If the user presses another key \n// during that 500ms, it will be cancelled and we'll wait another 500ms.\nExt.get('myInputField').on('keypress', function(){\n    task.{@link #delay}(500); \n});\n * </code></pre> \n * <p>Note that we are using a DelayedTask here to illustrate a point. The configuration\n * option <tt>buffer</tt> for {@link Ext.util.Observable#addListener addListener/on} will\n * also setup a delayed task for you to buffer events.</p> \n * @constructor The parameters to this constructor serve as defaults and are not required.\n * @param {Function} fn (optional) The default function to call.\n * @param {Object} scope (optional) The default scope (The <code><b>this</b></code> reference) in which the\n * function is called. If not specified, <code>this</code> will refer to the browser window.\n * @param {Array} args (optional) The default Array of arguments.\n */\nExt.util.DelayedTask = function(fn, scope, args){\n    var me = this,\n    \tid,    \t\n    \tcall = function(){\n    \t\tclearInterval(id);\n\t        id = null;\n\t        fn.apply(scope, args || []);\n\t    };\n\t    \n    /**\n     * Cancels any pending timeout and queues a new one\n     * @param {Number} delay The milliseconds to delay\n     * @param {Function} newFn (optional) Overrides function passed to constructor\n     * @param {Object} newScope (optional) Overrides scope passed to constructor. Remember that if no scope\n     * is specified, <code>this</code> will refer to the browser window.\n     * @param {Array} newArgs (optional) Overrides args passed to constructor\n     */\n    me.delay = function(delay, newFn, newScope, newArgs){\n        me.cancel();\n        fn = newFn || fn;\n        scope = newScope || scope;\n        args = newArgs || args;\n        id = setInterval(call, delay);\n    };\n\n    /**\n     * Cancel the last queued timeout\n     */\n    me.cancel = function(){\n        if(id){\n            clearInterval(id);\n            id = null;\n        }\n    };\n};/**\n * @class Ext.Element\n * <p>Encapsulates a DOM element, adding simple DOM manipulation facilities, normalizing for browser differences.</p>\n * <p>All instances of this class inherit the methods of {@link Ext.Fx} making visual effects easily available to all DOM elements.</p>\n * <p>Note that the events documented in this class are not Ext events, they encapsulate browser events. To\n * access the underlying browser event, see {@link Ext.EventObject#browserEvent}. Some older\n * browsers may not support the full range of events. Which events are supported is beyond the control of ExtJs.</p>\n * Usage:<br>\n<pre><code>\n// by id\nvar el = Ext.get(\"my-div\");\n\n// by DOM element reference\nvar el = Ext.get(myDivElement);\n</code></pre>\n * <b>Animations</b><br />\n * <p>When an element is manipulated, by default there is no animation.</p>\n * <pre><code>\nvar el = Ext.get(\"my-div\");\n\n// no animation\nel.setWidth(100);\n * </code></pre>\n * <p>Many of the functions for manipulating an element have an optional \"animate\" parameter.  This\n * parameter can be specified as boolean (<tt>true</tt>) for default animation effects.</p>\n * <pre><code>\n// default animation\nel.setWidth(100, true);\n * </code></pre>\n *\n * <p>To configure the effects, an object literal with animation options to use as the Element animation\n * configuration object can also be specified. Note that the supported Element animation configuration\n * options are a subset of the {@link Ext.Fx} animation options specific to Fx effects.  The supported\n * Element animation configuration options are:</p>\n<pre>\nOption    Default   Description\n--------- --------  ---------------------------------------------\n{@link Ext.Fx#duration duration}  .35       The duration of the animation in seconds\n{@link Ext.Fx#easing easing}    easeOut   The easing method\n{@link Ext.Fx#callback callback}  none      A function to execute when the anim completes\n{@link Ext.Fx#scope scope}     this      The scope (this) of the callback function\n</pre>\n *\n * <pre><code>\n// Element animation options object\nvar opt = {\n    {@link Ext.Fx#duration duration}: 1,\n    {@link Ext.Fx#easing easing}: 'elasticIn',\n    {@link Ext.Fx#callback callback}: this.foo,\n    {@link Ext.Fx#scope scope}: this\n};\n// animation with some options set\nel.setWidth(100, opt);\n * </code></pre>\n * <p>The Element animation object being used for the animation will be set on the options\n * object as \"anim\", which allows you to stop or manipulate the animation. Here is an example:</p>\n * <pre><code>\n// using the \"anim\" property to get the Anim object\nif(opt.anim.isAnimated()){\n    opt.anim.stop();\n}\n * </code></pre>\n * <p>Also see the <tt>{@link #animate}</tt> method for another animation technique.</p>\n * <p><b> Composite (Collections of) Elements</b></p>\n * <p>For working with collections of Elements, see {@link Ext.CompositeElement}</p>\n * @constructor Create a new Element directly.\n * @param {String/HTMLElement} element\n * @param {Boolean} forceNew (optional) By default the constructor checks to see if there is already an instance of this element in the cache and if there is it returns the same instance. This will skip that check (useful for extending this class).\n */\n(function(){\nvar DOC = document;\n\nExt.Element = function(element, forceNew){\n    var dom = typeof element == \"string\" ?\n              DOC.getElementById(element) : element,\n        id;\n\n    if(!dom) return null;\n\n    id = dom.id;\n\n    if(!forceNew && id && Ext.elCache[id]){ // element object already exists\n        return Ext.elCache[id].el;\n    }\n\n    /**\n     * The DOM element\n     * @type HTMLElement\n     */\n    this.dom = dom;\n\n    /**\n     * The DOM element ID\n     * @type String\n     */\n    this.id = id || Ext.id(dom);\n};\n\nvar DH = Ext.DomHelper,\n    El = Ext.Element,\n    EC = Ext.elCache;\n\nEl.prototype = {\n    /**\n     * Sets the passed attributes as attributes of this element (a style attribute can be a string, object or function)\n     * @param {Object} o The object with the attributes\n     * @param {Boolean} useSet (optional) false to override the default setAttribute to use expandos.\n     * @return {Ext.Element} this\n     */\n    set : function(o, useSet){\n        var el = this.dom,\n            attr,\n            val,\n            useSet = (useSet !== false) && !!el.setAttribute;\n\n        for (attr in o) {\n            if (o.hasOwnProperty(attr)) {\n                val = o[attr];\n                if (attr == 'style') {\n                    DH.applyStyles(el, val);\n                } else if (attr == 'cls') {\n                    el.className = val;\n                } else if (useSet) {\n                    el.setAttribute(attr, val);\n                } else {\n                    el[attr] = val;\n                }\n            }\n        }\n        return this;\n    },\n\n//  Mouse events\n    /**\n     * @event click\n     * Fires when a mouse click is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event contextmenu\n     * Fires when a right click is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event dblclick\n     * Fires when a mouse double click is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event mousedown\n     * Fires when a mousedown is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event mouseup\n     * Fires when a mouseup is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event mouseover\n     * Fires when a mouseover is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event mousemove\n     * Fires when a mousemove is detected with the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event mouseout\n     * Fires when a mouseout is detected with the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event mouseenter\n     * Fires when the mouse enters the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event mouseleave\n     * Fires when the mouse leaves the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n\n//  Keyboard events\n    /**\n     * @event keypress\n     * Fires when a keypress is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event keydown\n     * Fires when a keydown is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event keyup\n     * Fires when a keyup is detected within the element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n\n\n//  HTML frame/object events\n    /**\n     * @event load\n     * Fires when the user agent finishes loading all content within the element. Only supported by window, frames, objects and images.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event unload\n     * Fires when the user agent removes all content from a window or frame. For elements, it fires when the target element or any of its content has been removed.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event abort\n     * Fires when an object/image is stopped from loading before completely loaded.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event error\n     * Fires when an object/image/frame cannot be loaded properly.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event resize\n     * Fires when a document view is resized.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event scroll\n     * Fires when a document view is scrolled.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n\n//  Form events\n    /**\n     * @event select\n     * Fires when a user selects some text in a text field, including input and textarea.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event change\n     * Fires when a control loses the input focus and its value has been modified since gaining focus.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event submit\n     * Fires when a form is submitted.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event reset\n     * Fires when a form is reset.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event focus\n     * Fires when an element receives focus either via the pointing device or by tab navigation.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event blur\n     * Fires when an element loses focus either via the pointing device or by tabbing navigation.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n\n//  User Interface events\n    /**\n     * @event DOMFocusIn\n     * Where supported. Similar to HTML focus event, but can be applied to any focusable element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMFocusOut\n     * Where supported. Similar to HTML blur event, but can be applied to any focusable element.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMActivate\n     * Where supported. Fires when an element is activated, for instance, through a mouse click or a keypress.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n\n//  DOM Mutation events\n    /**\n     * @event DOMSubtreeModified\n     * Where supported. Fires when the subtree is modified.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMNodeInserted\n     * Where supported. Fires when a node has been added as a child of another node.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMNodeRemoved\n     * Where supported. Fires when a descendant node of the element is removed.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMNodeRemovedFromDocument\n     * Where supported. Fires when a node is being removed from a document.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMNodeInsertedIntoDocument\n     * Where supported. Fires when a node is being inserted into a document.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMAttrModified\n     * Where supported. Fires when an attribute has been modified.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n    /**\n     * @event DOMCharacterDataModified\n     * Where supported. Fires when the character data has been modified.\n     * @param {Ext.EventObject} e The {@link Ext.EventObject} encapsulating the DOM event.\n     * @param {HtmlElement} t The target of the event.\n     * @param {Object} o The options configuration passed to the {@link #addListener} call.\n     */\n\n    /**\n     * The default unit to append to CSS values where a unit isn't provided (defaults to px).\n     * @type String\n     */\n    defaultUnit : \"px\",\n\n    /**\n     * Returns true if this element matches the passed simple selector (e.g. div.some-class or span:first-child)\n     * @param {String} selector The simple selector to test\n     * @return {Boolean} True if this element matches the selector, else false\n     */\n    is : function(simpleSelector){\n        return Ext.DomQuery.is(this.dom, simpleSelector);\n    },\n\n    /**\n     * Tries to focus the element. Any exceptions are caught and ignored.\n     * @param {Number} defer (optional) Milliseconds to defer the focus\n     * @return {Ext.Element} this\n     */\n    focus : function(defer, /* private */ dom) {\n        var me = this,\n            dom = dom || me.dom;\n        try{\n            if(Number(defer)){\n                me.focus.defer(defer, null, [null, dom]);\n            }else{\n                dom.focus();\n            }\n        }catch(e){}\n        return me;\n    },\n\n    /**\n     * Tries to blur the element. Any exceptions are caught and ignored.\n     * @return {Ext.Element} this\n     */\n    blur : function() {\n        try{\n            this.dom.blur();\n        }catch(e){}\n        return this;\n    },\n\n    /**\n     * Returns the value of the \"value\" attribute\n     * @param {Boolean} asNumber true to parse the value as a number\n     * @return {String/Number}\n     */\n    getValue : function(asNumber){\n        var val = this.dom.value;\n        return asNumber ? parseInt(val, 10) : val;\n    },\n\n    /**\n     * Appends an event handler to this element.  The shorthand version {@link #on} is equivalent.\n     * @param {String} eventName The name of event to handle.\n     * @param {Function} fn The handler function the event invokes. This function is passed\n     * the following parameters:<ul>\n     * <li><b>evt</b> : EventObject<div class=\"sub-desc\">The {@link Ext.EventObject EventObject} describing the event.</div></li>\n     * <li><b>el</b> : HtmlElement<div class=\"sub-desc\">The DOM element which was the target of the event.\n     * Note that this may be filtered by using the <tt>delegate</tt> option.</div></li>\n     * <li><b>o</b> : Object<div class=\"sub-desc\">The options object from the addListener call.</div></li>\n     * </ul>\n     * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the handler function is executed.\n     * <b>If omitted, defaults to this Element.</b>.\n     * @param {Object} options (optional) An object containing handler configuration properties.\n     * This may contain any of the following properties:<ul>\n     * <li><b>scope</b> Object : <div class=\"sub-desc\">The scope (<code><b>this</b></code> reference) in which the handler function is executed.\n     * <b>If omitted, defaults to this Element.</b></div></li>\n     * <li><b>delegate</b> String: <div class=\"sub-desc\">A simple selector to filter the target or look for a descendant of the target. See below for additional details.</div></li>\n     * <li><b>stopEvent</b> Boolean: <div class=\"sub-desc\">True to stop the event. That is stop propagation, and prevent the default action.</div></li>\n     * <li><b>preventDefault</b> Boolean: <div class=\"sub-desc\">True to prevent the default action</div></li>\n     * <li><b>stopPropagation</b> Boolean: <div class=\"sub-desc\">True to prevent event propagation</div></li>\n     * <li><b>normalized</b> Boolean: <div class=\"sub-desc\">False to pass a browser event to the handler function instead of an Ext.EventObject</div></li>\n     * <li><b>target</b> Ext.Element: <div class=\"sub-desc\">Only call the handler if the event was fired on the target Element, <i>not</i> if the event was bubbled up from a child node.</div></li>\n     * <li><b>delay</b> Number: <div class=\"sub-desc\">The number of milliseconds to delay the invocation of the handler after the event fires.</div></li>\n     * <li><b>single</b> Boolean: <div class=\"sub-desc\">True to add a handler to handle just the next firing of the event, and then remove itself.</div></li>\n     * <li><b>buffer</b> Number: <div class=\"sub-desc\">Causes the handler to be scheduled to run in an {@link Ext.util.DelayedTask} delayed\n     * by the specified number of milliseconds. If the event fires again within that time, the original\n     * handler is <em>not</em> invoked, but the new handler is scheduled in its place.</div></li>\n     * </ul><br>\n     * <p>\n     * <b>Combining Options</b><br>\n     * In the following examples, the shorthand form {@link #on} is used rather than the more verbose\n     * addListener.  The two are equivalent.  Using the options argument, it is possible to combine different\n     * types of listeners:<br>\n     * <br>\n     * A delayed, one-time listener that auto stops the event and adds a custom argument (forumId) to the\n     * options object. The options object is available as the third parameter in the handler function.<div style=\"margin: 5px 20px 20px;\">\n     * Code:<pre><code>\nel.on('click', this.onClick, this, {\n    single: true,\n    delay: 100,\n    stopEvent : true,\n    forumId: 4\n});</code></pre></p>\n     * <p>\n     * <b>Attaching multiple handlers in 1 call</b><br>\n     * The method also allows for a single argument to be passed which is a config object containing properties\n     * which specify multiple handlers.</p>\n     * <p>\n     * Code:<pre><code>\nel.on({\n    'click' : {\n        fn: this.onClick,\n        scope: this,\n        delay: 100\n    },\n    'mouseover' : {\n        fn: this.onMouseOver,\n        scope: this\n    },\n    'mouseout' : {\n        fn: this.onMouseOut,\n        scope: this\n    }\n});</code></pre>\n     * <p>\n     * Or a shorthand syntax:<br>\n     * Code:<pre><code></p>\nel.on({\n    'click' : this.onClick,\n    'mouseover' : this.onMouseOver,\n    'mouseout' : this.onMouseOut,\n    scope: this\n});\n     * </code></pre></p>\n     * <p><b>delegate</b></p>\n     * <p>This is a configuration option that you can pass along when registering a handler for\n     * an event to assist with event delegation. Event delegation is a technique that is used to\n     * reduce memory consumption and prevent exposure to memory-leaks. By registering an event\n     * for a container element as opposed to each element within a container. By setting this\n     * configuration option to a simple selector, the target element will be filtered to look for\n     * a descendant of the target.\n     * For example:<pre><code>\n// using this markup:\n&lt;div id='elId'>\n    &lt;p id='p1'>paragraph one&lt;/p>\n    &lt;p id='p2' class='clickable'>paragraph two&lt;/p>\n    &lt;p id='p3'>paragraph three&lt;/p>\n&lt;/div>\n// utilize event delegation to registering just one handler on the container element:\nel = Ext.get('elId');\nel.on(\n    'click',\n    function(e,t) {\n        // handle click\n        console.info(t.id); // 'p2'\n    },\n    this,\n    {\n        // filter the target element to be a descendant with the class 'clickable'\n        delegate: '.clickable'\n    }\n);\n     * </code></pre></p>\n     * @return {Ext.Element} this\n     */\n    addListener : function(eventName, fn, scope, options){\n        Ext.EventManager.on(this.dom,  eventName, fn, scope || this, options);\n        return this;\n    },\n\n    /**\n     * Removes an event handler from this element.  The shorthand version {@link #un} is equivalent.\n     * <b>Note</b>: if a <i>scope</i> was explicitly specified when {@link #addListener adding} the\n     * listener, the same scope must be specified here.\n     * Example:\n     * <pre><code>\nel.removeListener('click', this.handlerFn);\n// or\nel.un('click', this.handlerFn);\n</code></pre>\n     * @param {String} eventName The name of the event from which to remove the handler.\n     * @param {Function} fn The handler function to remove. <b>This must be a reference to the function passed into the {@link #addListener} call.</b>\n     * @param {Object} scope If a scope (<b><code>this</code></b> reference) was specified when the listener was added,\n     * then this must refer to the same object.\n     * @return {Ext.Element} this\n     */\n    removeListener : function(eventName, fn, scope){\n        Ext.EventManager.removeListener(this.dom,  eventName, fn, scope || this);\n        return this;\n    },\n\n    /**\n     * Removes all previous added listeners from this element\n     * @return {Ext.Element} this\n     */\n    removeAllListeners : function(){\n        Ext.EventManager.removeAll(this.dom);\n        return this;\n    },\n\n    /**\n     * Recursively removes all previous added listeners from this element and its children\n     * @return {Ext.Element} this\n     */\n    purgeAllListeners : function() {\n        Ext.EventManager.purgeElement(this, true);\n        return this;\n    },\n    /**\n     * @private Test if size has a unit, otherwise appends the default\n     */\n    addUnits : function(size){\n        if(size === \"\" || size == \"auto\" || size === undefined){\n            size = size || '';\n        } else if(!isNaN(size) || !unitPattern.test(size)){\n            size = size + (this.defaultUnit || 'px');\n        }\n        return size;\n    },\n\n    /**\n     * <p>Updates the <a href=\"http:\n     * from a specified URL. Note that this is subject to the <a href=\"http://en.wikipedia.org/wiki/Same_origin_policy\">Same Origin Policy</a></p>\n     * <p>Updating innerHTML of an element will <b>not</b> execute embedded <tt>&lt;script></tt> elements. This is a browser restriction.</p>\n     * @param {Mixed} options. Either a sring containing the URL from which to load the HTML, or an {@link Ext.Ajax#request} options object specifying\n     * exactly how to request the HTML.\n     * @return {Ext.Element} this\n     */\n    load : function(url, params, cb){\n        Ext.Ajax.request(Ext.apply({\n            params: params,\n            url: url.url || url,\n            callback: cb,\n            el: this.dom,\n            indicatorText: url.indicatorText || ''\n        }, Ext.isObject(url) ? url : {}));\n        return this;\n    },\n\n    \n    isBorderBox : function(){\n        return Ext.isBorderBox || Ext.isForcedBorderBox || noBoxAdjust[(this.dom.tagName || \"\").toLowerCase()];\n    },\n\n    \n    remove : function(){\n        var me = this,\n            dom = me.dom;\n\n        if (dom) {\n            delete me.dom;\n            Ext.removeNode(dom);\n        }\n    },\n\n    \n    hover : function(overFn, outFn, scope, options){\n        var me = this;\n        me.on('mouseenter', overFn, scope || me.dom, options);\n        me.on('mouseleave', outFn, scope || me.dom, options);\n        return me;\n    },\n\n    \n    contains : function(el){\n        return !el ? false : Ext.lib.Dom.isAncestor(this.dom, el.dom ? el.dom : el);\n    },\n\n    \n    getAttributeNS : function(ns, name){\n        return this.getAttribute(name, ns);\n    },\n\n    \n    getAttribute: (function(){\n        var test = document.createElement('table'),\n            isBrokenOnTable = false,\n            hasGetAttribute = 'getAttribute' in test,\n            unknownRe = /undefined|unknown/;\n\n        if (hasGetAttribute) {\n\n            try {\n                test.getAttribute('ext:qtip');\n            } catch (e) {\n                isBrokenOnTable = true;\n            }\n\n            return function(name, ns) {\n                var el = this.dom,\n                    value;\n\n                if (el.getAttributeNS) {\n                    value  = el.getAttributeNS(ns, name) || null;\n                }\n\n                if (value == null) {\n                    if (ns) {\n                        if (isBrokenOnTable && el.tagName.toUpperCase() == 'TABLE') {\n                            try {\n                                value = el.getAttribute(ns + ':' + name);\n                            } catch (e) {\n                                value = '';\n                            }\n                        } else {\n                            value = el.getAttribute(ns + ':' + name);\n                        }\n                    } else {\n                        value = el.getAttribute(name) || el[name];\n                    }\n                }\n                return value || '';\n            };\n        } else {\n            return function(name, ns) {\n                var el = this.om,\n                    value,\n                    attribute;\n\n                if (ns) {\n                    attribute = el[ns + ':' + name];\n                    value = unknownRe.test(typeof attribute) ? undefined : attribute;\n                } else {\n                    value = el[name];\n                }\n                return value || '';\n            };\n        }\n        test = null;\n    })(),\n\n    \n    update : function(html) {\n        if (this.dom) {\n            this.dom.innerHTML = html;\n        }\n        return this;\n    }\n};\n\nvar ep = El.prototype;\n\nEl.addMethods = function(o){\n   Ext.apply(ep, o);\n};\n\n\nep.on = ep.addListener;\n\n\nep.un = ep.removeListener;\n\n\nep.autoBoxAdjust = true;\n\n\nvar unitPattern = /\\d+(px|em|%|en|ex|pt|in|cm|mm|pc)$/i,\n    docEl;\n\n\nEl.get = function(el){\n    var ex,\n        elm,\n        id;\n    if(!el){ return null; }\n    if (typeof el == \"string\") { \n        if (!(elm = DOC.getElementById(el))) {\n            return null;\n        }\n        if (EC[el] && EC[el].el) {\n            ex = EC[el].el;\n            ex.dom = elm;\n        } else {\n            ex = El.addToCache(new El(elm));\n        }\n        return ex;\n    } else if (el.tagName) { \n        if(!(id = el.id)){\n            id = Ext.id(el);\n        }\n        if (EC[id] && EC[id].el) {\n            ex = EC[id].el;\n            ex.dom = el;\n        } else {\n            ex = El.addToCache(new El(el));\n        }\n        return ex;\n    } else if (el instanceof El) {\n        if(el != docEl){\n            \n            \n\n            \n            if (Ext.isIE && (el.id == undefined || el.id == '')) {\n                el.dom = el.dom;\n            } else {\n                el.dom = DOC.getElementById(el.id) || el.dom;\n            }\n        }\n        return el;\n    } else if(el.isComposite) {\n        return el;\n    } else if(Ext.isArray(el)) {\n        return El.select(el);\n    } else if(el == DOC) {\n        \n        if(!docEl){\n            var f = function(){};\n            f.prototype = El.prototype;\n            docEl = new f();\n            docEl.dom = DOC;\n        }\n        return docEl;\n    }\n    return null;\n};\n\nEl.addToCache = function(el, id){\n    id = id || el.id;\n    EC[id] = {\n        el:  el,\n        data: {},\n        events: {}\n    };\n    return el;\n};\n\n\nEl.data = function(el, key, value){\n    el = El.get(el);\n    if (!el) {\n        return null;\n    }\n    var c = EC[el.id].data;\n    if(arguments.length == 2){\n        return c[key];\n    }else{\n        return (c[key] = value);\n    }\n};\n\n\n\n\nfunction garbageCollect(){\n    if(!Ext.enableGarbageCollector){\n        clearInterval(El.collectorThreadId);\n    } else {\n        var eid,\n            el,\n            d,\n            o;\n\n        for(eid in EC){\n            o = EC[eid];\n            if(o.skipGC){\n                Ext.EventManager.removeFromSpecialCache(o.el);\n                continue;\n            }\n            el = o.el;\n            d = el.dom;\n            \n            \n            \n            \n            \n            \n            \n            \n            \n            \n            \n            \n            \n            \n            \n            \n            \n            if(!d || !d.parentNode || (!d.offsetParent && !DOC.getElementById(eid))){\n                if(Ext.enableListenerCollection){\n                    Ext.EventManager.removeAll(d);\n                }\n                delete EC[eid];\n            }\n        }\n        \n        if (Ext.isIE) {\n            var t = {};\n            for (eid in EC) {\n                t[eid] = EC[eid];\n            }\n            EC = Ext.elCache = t;\n        }\n    }\n}\nEl.collectorThreadId = setInterval(garbageCollect, 30000);\n\nvar flyFn = function(){};\nflyFn.prototype = El.prototype;\n\n\nEl.Flyweight = function(dom){\n    this.dom = dom;\n};\n\nEl.Flyweight.prototype = new flyFn();\nEl.Flyweight.prototype.isFlyweight = true;\nEl._flyweights = {};\n\n\nEl.fly = function(el, named){\n    var ret = null;\n    named = named || '_global';\n\n    if (el = Ext.getDom(el)) {\n        (El._flyweights[named] = El._flyweights[named] || new El.Flyweight()).dom = el;\n        ret = El._flyweights[named];\n    }\n    return ret;\n};\n\n\nExt.get = El.get;\n\n\nExt.fly = El.fly;\n\n\nvar noBoxAdjust = Ext.isStrict ? {\n    select:1\n} : {\n    input:1, select:1, textarea:1\n};\nif(Ext.isIE || Ext.isGecko){\n    noBoxAdjust['button'] = 1;\n}\n\n})();\n\nExt.Element.addMethods(function(){\n\tvar PARENTNODE = 'parentNode',\n\t\tNEXTSIBLING = 'nextSibling',\n\t\tPREVIOUSSIBLING = 'previousSibling',\n\t\tDQ = Ext.DomQuery,\n\t\tGET = Ext.get;\n\t\n\treturn {\n\t\t\n\t    findParent : function(simpleSelector, maxDepth, returnEl){\n\t        var p = this.dom,\n\t        \tb = document.body, \n\t        \tdepth = 0, \t        \t\n\t        \tstopEl;\t        \n            if(Ext.isGecko && Object.prototype.toString.call(p) == '[object XULElement]') {\n                return null;\n            }\n\t        maxDepth = maxDepth || 50;\n\t        if (isNaN(maxDepth)) {\n\t            stopEl = Ext.getDom(maxDepth);\n\t            maxDepth = Number.MAX_VALUE;\n\t        }\n\t        while(p && p.nodeType == 1 && depth < maxDepth && p != b && p != stopEl){\n\t            if(DQ.is(p, simpleSelector)){\n\t                return returnEl ? GET(p) : p;\n\t            }\n\t            depth++;\n\t            p = p.parentNode;\n\t        }\n\t        return null;\n\t    },\n\t\n\t    \n\t    findParentNode : function(simpleSelector, maxDepth, returnEl){\n\t        var p = Ext.fly(this.dom.parentNode, '_internal');\n\t        return p ? p.findParent(simpleSelector, maxDepth, returnEl) : null;\n\t    },\n\t\n\t    \n\t    up : function(simpleSelector, maxDepth){\n\t        return this.findParentNode(simpleSelector, maxDepth, true);\n\t    },\n\t\n\t    \n\t    select : function(selector){\n\t        return Ext.Element.select(selector, this.dom);\n\t    },\n\t\n\t    \n\t    query : function(selector){\n\t        return DQ.select(selector, this.dom);\n\t    },\n\t\n\t    \n\t    child : function(selector, returnDom){\n\t        var n = DQ.selectNode(selector, this.dom);\n\t        return returnDom ? n : GET(n);\n\t    },\n\t\n\t    \n\t    down : function(selector, returnDom){\n\t        var n = DQ.selectNode(\" > \" + selector, this.dom);\n\t        return returnDom ? n : GET(n);\n\t    },\n\t\n\t\t \n\t    parent : function(selector, returnDom){\n\t        return this.matchNode(PARENTNODE, PARENTNODE, selector, returnDom);\n\t    },\n\t\n\t     \n\t    next : function(selector, returnDom){\n\t        return this.matchNode(NEXTSIBLING, NEXTSIBLING, selector, returnDom);\n\t    },\n\t\n\t    \n\t    prev : function(selector, returnDom){\n\t        return this.matchNode(PREVIOUSSIBLING, PREVIOUSSIBLING, selector, returnDom);\n\t    },\n\t\n\t\n\t    \n\t    first : function(selector, returnDom){\n\t        return this.matchNode(NEXTSIBLING, 'firstChild', selector, returnDom);\n\t    },\n\t\n\t    \n\t    last : function(selector, returnDom){\n\t        return this.matchNode(PREVIOUSSIBLING, 'lastChild', selector, returnDom);\n\t    },\n\t    \n\t    matchNode : function(dir, start, selector, returnDom){\n\t        var n = this.dom[start];\n\t        while(n){\n\t            if(n.nodeType == 1 && (!selector || DQ.is(n, selector))){\n\t                return !returnDom ? GET(n) : n;\n\t            }\n\t            n = n[dir];\n\t        }\n\t        return null;\n\t    }\t\n    };\n}());\nExt.Element.addMethods(\nfunction() {\n\tvar GETDOM = Ext.getDom,\n\t\tGET = Ext.get,\n\t\tDH = Ext.DomHelper;\n\t\n\treturn {\n\t    \n\t    appendChild: function(el){        \n\t        return GET(el).appendTo(this);        \n\t    },\n\t\n\t    \n\t    appendTo: function(el){        \n\t        GETDOM(el).appendChild(this.dom);        \n\t        return this;\n\t    },\n\t\n\t    \n\t    insertBefore: function(el){  \t          \n\t        (el = GETDOM(el)).parentNode.insertBefore(this.dom, el);\n\t        return this;\n\t    },\n\t\n\t    \n\t    insertAfter: function(el){\n\t        (el = GETDOM(el)).parentNode.insertBefore(this.dom, el.nextSibling);\n\t        return this;\n\t    },\n\t\n\t    \n\t    insertFirst: function(el, returnDom){\n            el = el || {};\n            if(el.nodeType || el.dom || typeof el == 'string'){ \n                el = GETDOM(el);\n                this.dom.insertBefore(el, this.dom.firstChild);\n                return !returnDom ? GET(el) : el;\n            }else{ \n                return this.createChild(el, this.dom.firstChild, returnDom);\n            }\n        },\n\t\n\t    \n\t    replace: function(el){\n\t        el = GET(el);\n\t        this.insertBefore(el);\n\t        el.remove();\n\t        return this;\n\t    },\n\t\n\t    \n\t    replaceWith: function(el){\n\t\t    var me = this;\n                \n            if(el.nodeType || el.dom || typeof el == 'string'){\n                el = GETDOM(el);\n                me.dom.parentNode.insertBefore(el, me.dom);\n            }else{\n                el = DH.insertBefore(me.dom, el);\n            }\n\t        \n\t        delete Ext.elCache[me.id];\n\t        Ext.removeNode(me.dom);      \n\t        me.id = Ext.id(me.dom = el);\n\t        Ext.Element.addToCache(me.isFlyweight ? new Ext.Element(me.dom) : me);     \n            return me;\n\t    },\n\t    \n\t\t\n\t\tcreateChild: function(config, insertBefore, returnDom){\n\t\t    config = config || {tag:'div'};\n\t\t    return insertBefore ? \n\t\t    \t   DH.insertBefore(insertBefore, config, returnDom !== true) :\t\n\t\t    \t   DH[!this.dom.firstChild ? 'overwrite' : 'append'](this.dom, config,  returnDom !== true);\n\t\t},\n\t\t\n\t\t\n\t\twrap: function(config, returnDom){        \n\t\t    var newEl = DH.insertBefore(this.dom, config || {tag: \"div\"}, !returnDom);\n\t\t    newEl.dom ? newEl.dom.appendChild(this.dom) : newEl.appendChild(this.dom);\n\t\t    return newEl;\n\t\t},\n\t\t\n\t\t\n\t\tinsertHtml : function(where, html, returnEl){\n\t\t    var el = DH.insertHtml(where, this.dom, html);\n\t\t    return returnEl ? Ext.get(el) : el;\n\t\t}\n\t};\n}());\nExt.Element.addMethods(function(){\n    \n    var supports = Ext.supports,\n        propCache = {},\n        camelRe = /(-[a-z])/gi,\n        view = document.defaultView,\n        opacityRe = /alpha\\(opacity=(.*)\\)/i,\n        trimRe = /^\\s+|\\s+$/g,\n        EL = Ext.Element,\n        spacesRe = /\\s+/,\n        wordsRe = /\\w/g,\n        PADDING = \"padding\",\n        MARGIN = \"margin\",\n        BORDER = \"border\",\n        LEFT = \"-left\",\n        RIGHT = \"-right\",\n        TOP = \"-top\",\n        BOTTOM = \"-bottom\",\n        WIDTH = \"-width\",\n        MATH = Math,\n        HIDDEN = 'hidden',\n        ISCLIPPED = 'isClipped',\n        OVERFLOW = 'overflow',\n        OVERFLOWX = 'overflow-x',\n        OVERFLOWY = 'overflow-y',\n        ORIGINALCLIP = 'originalClip',\n        \n        borders = {l: BORDER + LEFT + WIDTH, r: BORDER + RIGHT + WIDTH, t: BORDER + TOP + WIDTH, b: BORDER + BOTTOM + WIDTH},\n        paddings = {l: PADDING + LEFT, r: PADDING + RIGHT, t: PADDING + TOP, b: PADDING + BOTTOM},\n        margins = {l: MARGIN + LEFT, r: MARGIN + RIGHT, t: MARGIN + TOP, b: MARGIN + BOTTOM},\n        data = Ext.Element.data;\n\n\n    \n    function camelFn(m, a) {\n        return a.charAt(1).toUpperCase();\n    }\n\n    function chkCache(prop) {\n        return propCache[prop] || (propCache[prop] = prop == 'float' ? (supports.cssFloat ? 'cssFloat' : 'styleFloat') : prop.replace(camelRe, camelFn));\n    }\n\n    return {\n        \n        adjustWidth : function(width) {\n            var me = this;\n            var isNum = (typeof width == \"number\");\n            if(isNum && me.autoBoxAdjust && !me.isBorderBox()){\n               width -= (me.getBorderWidth(\"lr\") + me.getPadding(\"lr\"));\n            }\n            return (isNum && width < 0) ? 0 : width;\n        },\n\n        \n        adjustHeight : function(height) {\n            var me = this;\n            var isNum = (typeof height == \"number\");\n            if(isNum && me.autoBoxAdjust && !me.isBorderBox()){\n               height -= (me.getBorderWidth(\"tb\") + me.getPadding(\"tb\"));\n            }\n            return (isNum && height < 0) ? 0 : height;\n        },\n\n\n        \n        addClass : function(className){\n            var me = this,\n                i,\n                len,\n                v,\n                cls = [];\n            \n            if (!Ext.isArray(className)) {\n                if (typeof className == 'string' && !this.hasClass(className)) {\n                    me.dom.className += \" \" + className;\n                }\n            }\n            else {\n                for (i = 0, len = className.length; i < len; i++) {\n                    v = className[i];\n                    if (typeof v == 'string' && (' ' + me.dom.className + ' ').indexOf(' ' + v + ' ') == -1) {\n                        cls.push(v);\n                    }\n                }\n                if (cls.length) {\n                    me.dom.className += \" \" + cls.join(\" \");\n                }\n            }\n            return me;\n        },\n\n        \n        removeClass : function(className){\n            var me = this,\n                i,\n                idx,\n                len,\n                cls,\n                elClasses;\n            if (!Ext.isArray(className)){\n                className = [className];\n            }\n            if (me.dom && me.dom.className) {\n                elClasses = me.dom.className.replace(trimRe, '').split(spacesRe);\n                for (i = 0, len = className.length; i < len; i++) {\n                    cls = className[i];\n                    if (typeof cls == 'string') {\n                        cls = cls.replace(trimRe, '');\n                        idx = elClasses.indexOf(cls);\n                        if (idx != -1) {\n                            elClasses.splice(idx, 1);\n                        }\n                    }\n                }\n                me.dom.className = elClasses.join(\" \");\n            }\n            return me;\n        },\n\n        \n        radioClass : function(className){\n            var cn = this.dom.parentNode.childNodes,\n                v,\n                i,\n                len;\n            className = Ext.isArray(className) ? className : [className];\n            for (i = 0, len = cn.length; i < len; i++) {\n                v = cn[i];\n                if (v && v.nodeType == 1) {\n                    Ext.fly(v, '_internal').removeClass(className);\n                }\n            };\n            return this.addClass(className);\n        },\n\n        \n        toggleClass : function(className){\n            return this.hasClass(className) ? this.removeClass(className) : this.addClass(className);\n        },\n\n        \n        hasClass : function(className){\n            return className && (' '+this.dom.className+' ').indexOf(' '+className+' ') != -1;\n        },\n\n        \n        replaceClass : function(oldClassName, newClassName){\n            return this.removeClass(oldClassName).addClass(newClassName);\n        },\n\n        isStyle : function(style, val) {\n            return this.getStyle(style) == val;\n        },\n\n        \n        getStyle : function(){\n            return view && view.getComputedStyle ?\n                function(prop){\n                    var el = this.dom,\n                        v,\n                        cs,\n                        out,\n                        display;\n\n                    if(el == document){\n                        return null;\n                    }\n                    prop = chkCache(prop);\n                    out = (v = el.style[prop]) ? v :\n                           (cs = view.getComputedStyle(el, \"\")) ? cs[prop] : null;\n                           \n                    \n                    \n                    if(prop == 'marginRight' && out != '0px' && !supports.correctRightMargin){\n                        display = el.style.display;\n                        el.style.display = 'inline-block';\n                        out = view.getComputedStyle(el, '').marginRight;\n                        el.style.display = display;\n                    }\n                    \n                    if(prop == 'backgroundColor' && out == 'rgba(0, 0, 0, 0)' && !supports.correctTransparentColor){\n                        out = 'transparent';\n                    }\n                    return out;\n                } :\n                function(prop){\n                    var el = this.dom,\n                        m,\n                        cs;\n\n                    if(el == document) return null;\n                    if (prop == 'opacity') {\n                        if (el.style.filter.match) {\n                            if(m = el.style.filter.match(opacityRe)){\n                                var fv = parseFloat(m[1]);\n                                if(!isNaN(fv)){\n                                    return fv ? fv / 100 : 0;\n                                }\n                            }\n                        }\n                        return 1;\n                    }\n                    prop = chkCache(prop);\n                    return el.style[prop] || ((cs = el.currentStyle) ? cs[prop] : null);\n                };\n        }(),\n\n        \n        getColor : function(attr, defaultValue, prefix){\n            var v = this.getStyle(attr),\n                color = (typeof prefix != 'undefined') ? prefix : '#',\n                h;\n\n            if(!v || (/transparent|inherit/.test(v))) {\n                return defaultValue;\n            }\n            if(/^r/.test(v)){\n                Ext.each(v.slice(4, v.length -1).split(','), function(s){\n                    h = parseInt(s, 10);\n                    color += (h < 16 ? '0' : '') + h.toString(16);\n                });\n            }else{\n                v = v.replace('#', '');\n                color += v.length == 3 ? v.replace(/^(\\w)(\\w)(\\w)$/, '$1$1$2$2$3$3') : v;\n            }\n            return(color.length > 5 ? color.toLowerCase() : defaultValue);\n        },\n\n        \n        setStyle : function(prop, value){\n            var tmp, style;\n            \n            if (typeof prop != 'object') {\n                tmp = {};\n                tmp[prop] = value;\n                prop = tmp;\n            }\n            for (style in prop) {\n                value = prop[style];\n                style == 'opacity' ?\n                    this.setOpacity(value) :\n                    this.dom.style[chkCache(style)] = value;\n            }\n            return this;\n        },\n\n        \n         setOpacity : function(opacity, animate){\n            var me = this,\n                s = me.dom.style;\n\n            if(!animate || !me.anim){\n                if(Ext.isIE9m){\n                    var opac = opacity < 1 ? 'alpha(opacity=' + opacity * 100 + ')' : '',\n                    val = s.filter.replace(opacityRe, '').replace(trimRe, '');\n\n                    s.zoom = 1;\n                    s.filter = val + (val.length > 0 ? ' ' : '') + opac;\n                }else{\n                    s.opacity = opacity;\n                }\n            }else{\n                me.anim({opacity: {to: opacity}}, me.preanim(arguments, 1), null, .35, 'easeIn');\n            }\n            return me;\n        },\n\n        \n        clearOpacity : function(){\n            var style = this.dom.style;\n            if(Ext.isIE9m){\n                if(!Ext.isEmpty(style.filter)){\n                    style.filter = style.filter.replace(opacityRe, '').replace(trimRe, '');\n                }\n            }else{\n                style.opacity = style['-moz-opacity'] = style['-khtml-opacity'] = '';\n            }\n            return this;\n        },\n\n        \n        getHeight : function(contentHeight){\n            var me = this,\n                dom = me.dom,\n                hidden = Ext.isIE9m && me.isStyle('display', 'none'),\n                h = MATH.max(dom.offsetHeight, hidden ? 0 : dom.clientHeight) || 0;\n\n            h = !contentHeight ? h : h - me.getBorderWidth(\"tb\") - me.getPadding(\"tb\");\n            return h < 0 ? 0 : h;\n        },\n\n        \n        getWidth : function(contentWidth){\n            var me = this,\n                dom = me.dom,\n                hidden = Ext.isIE9m && me.isStyle('display', 'none'),\n                w = MATH.max(dom.offsetWidth, hidden ? 0 : dom.clientWidth) || 0;\n            w = !contentWidth ? w : w - me.getBorderWidth(\"lr\") - me.getPadding(\"lr\");\n            return w < 0 ? 0 : w;\n        },\n\n        \n        setWidth : function(width, animate){\n            var me = this;\n            width = me.adjustWidth(width);\n            !animate || !me.anim ?\n                me.dom.style.width = me.addUnits(width) :\n                me.anim({width : {to : width}}, me.preanim(arguments, 1));\n            return me;\n        },\n\n        \n         setHeight : function(height, animate){\n            var me = this;\n            height = me.adjustHeight(height);\n            !animate || !me.anim ?\n                me.dom.style.height = me.addUnits(height) :\n                me.anim({height : {to : height}}, me.preanim(arguments, 1));\n            return me;\n        },\n\n        \n        getBorderWidth : function(side){\n            return this.addStyles(side, borders);\n        },\n\n        \n        getPadding : function(side){\n            return this.addStyles(side, paddings);\n        },\n\n        \n        clip : function(){\n            var me = this,\n                dom = me.dom;\n\n            if(!data(dom, ISCLIPPED)){\n                data(dom, ISCLIPPED, true);\n                data(dom, ORIGINALCLIP, {\n                    o: me.getStyle(OVERFLOW),\n                    x: me.getStyle(OVERFLOWX),\n                    y: me.getStyle(OVERFLOWY)\n                });\n                me.setStyle(OVERFLOW, HIDDEN);\n                me.setStyle(OVERFLOWX, HIDDEN);\n                me.setStyle(OVERFLOWY, HIDDEN);\n            }\n            return me;\n        },\n\n        \n        unclip : function(){\n            var me = this,\n                dom = me.dom;\n\n            if(data(dom, ISCLIPPED)){\n                data(dom, ISCLIPPED, false);\n                var o = data(dom, ORIGINALCLIP);\n                if(o.o){\n                    me.setStyle(OVERFLOW, o.o);\n                }\n                if(o.x){\n                    me.setStyle(OVERFLOWX, o.x);\n                }\n                if(o.y){\n                    me.setStyle(OVERFLOWY, o.y);\n                }\n            }\n            return me;\n        },\n\n        \n        addStyles : function(sides, styles){\n            var ttlSize = 0,\n                sidesArr = sides.match(wordsRe),\n                side,\n                size,\n                i,\n                len = sidesArr.length;\n            for (i = 0; i < len; i++) {\n                side = sidesArr[i];\n                size = side && parseInt(this.getStyle(styles[side]), 10);\n                if (size) {\n                    ttlSize += MATH.abs(size);\n                }\n            }\n            return ttlSize;\n        },\n\n        margins : margins\n    };\n}()\n);\n\n(function(){\nvar D = Ext.lib.Dom,\n        LEFT = \"left\",\n        RIGHT = \"right\",\n        TOP = \"top\",\n        BOTTOM = \"bottom\",\n        POSITION = \"position\",\n        STATIC = \"static\",\n        RELATIVE = \"relative\",\n        AUTO = \"auto\",\n        ZINDEX = \"z-index\";\n\nExt.Element.addMethods({\n\t\n    getX : function(){\n        return D.getX(this.dom);\n    },\n\n    \n    getY : function(){\n        return D.getY(this.dom);\n    },\n\n    \n    getXY : function(){\n        return D.getXY(this.dom);\n    },\n\n    \n    getOffsetsTo : function(el){\n        var o = this.getXY(),\n        \te = Ext.fly(el, '_internal').getXY();\n        return [o[0]-e[0],o[1]-e[1]];\n    },\n\n    \n    setX : function(x, animate){\t    \n\t    return this.setXY([x, this.getY()], this.animTest(arguments, animate, 1));\n    },\n\n    \n    setY : function(y, animate){\t    \n\t    return this.setXY([this.getX(), y], this.animTest(arguments, animate, 1));\n    },\n\n    \n    setLeft : function(left){\n        this.setStyle(LEFT, this.addUnits(left));\n        return this;\n    },\n\n    \n    setTop : function(top){\n        this.setStyle(TOP, this.addUnits(top));\n        return this;\n    },\n\n    \n    setRight : function(right){\n        this.setStyle(RIGHT, this.addUnits(right));\n        return this;\n    },\n\n    \n    setBottom : function(bottom){\n        this.setStyle(BOTTOM, this.addUnits(bottom));\n        return this;\n    },\n\n    \n    setXY : function(pos, animate){\n\t    var me = this;\n        if(!animate || !me.anim){\n            D.setXY(me.dom, pos);\n        }else{\n            me.anim({points: {to: pos}}, me.preanim(arguments, 1), 'motion');\n        }\n        return me;\n    },\n\n    \n    setLocation : function(x, y, animate){\n        return this.setXY([x, y], this.animTest(arguments, animate, 2));\n    },\n\n    \n    moveTo : function(x, y, animate){\n        return this.setXY([x, y], this.animTest(arguments, animate, 2));        \n    },    \n    \n    \n    getLeft : function(local){\n\t    return !local ? this.getX() : parseInt(this.getStyle(LEFT), 10) || 0;\n    },\n\n    \n    getRight : function(local){\n\t    var me = this;\n\t    return !local ? me.getX() + me.getWidth() : (me.getLeft(true) + me.getWidth()) || 0;\n    },\n\n    \n    getTop : function(local) {\n\t    return !local ? this.getY() : parseInt(this.getStyle(TOP), 10) || 0;\n    },\n\n    \n    getBottom : function(local){\n\t    var me = this;\n\t    return !local ? me.getY() + me.getHeight() : (me.getTop(true) + me.getHeight()) || 0;\n    },\n\n    \n    position : function(pos, zIndex, x, y){\n\t    var me = this;\n\t    \n        if(!pos && me.isStyle(POSITION, STATIC)){           \n            me.setStyle(POSITION, RELATIVE);           \n        } else if(pos) {\n            me.setStyle(POSITION, pos);\n        }\n        if(zIndex){\n            me.setStyle(ZINDEX, zIndex);\n        }\n        if(x || y) me.setXY([x || false, y || false]);\n    },\n\n    \n    clearPositioning : function(value){\n        value = value || '';\n        this.setStyle({\n            left : value,\n            right : value,\n            top : value,\n            bottom : value,\n            \"z-index\" : \"\",\n            position : STATIC\n        });\n        return this;\n    },\n\n    \n    getPositioning : function(){\n        var l = this.getStyle(LEFT);\n        var t = this.getStyle(TOP);\n        return {\n            \"position\" : this.getStyle(POSITION),\n            \"left\" : l,\n            \"right\" : l ? \"\" : this.getStyle(RIGHT),\n            \"top\" : t,\n            \"bottom\" : t ? \"\" : this.getStyle(BOTTOM),\n            \"z-index\" : this.getStyle(ZINDEX)\n        };\n    },\n    \n    \n    setPositioning : function(pc){\n\t    var me = this,\n\t    \tstyle = me.dom.style;\n\t    \t\n        me.setStyle(pc);\n        \n        if(pc.right == AUTO){\n            style.right = \"\";\n        }\n        if(pc.bottom == AUTO){\n            style.bottom = \"\";\n        }\n        \n        return me;\n    },    \n\t\n    \n    translatePoints : function(x, y){        \t     \n\t    y = isNaN(x[1]) ? y : x[1];\n        x = isNaN(x[0]) ? x : x[0];\n        var me = this,\n        \trelative = me.isStyle(POSITION, RELATIVE),\n        \to = me.getXY(),\n        \tl = parseInt(me.getStyle(LEFT), 10),\n        \tt = parseInt(me.getStyle(TOP), 10);\n        \n        l = !isNaN(l) ? l : (relative ? 0 : me.dom.offsetLeft);\n        t = !isNaN(t) ? t : (relative ? 0 : me.dom.offsetTop);        \n\n        return {left: (x - o[0] + l), top: (y - o[1] + t)}; \n    },\n    \n    animTest : function(args, animate, i) {\n        return !!animate && this.preanim ? this.preanim(args, i) : false;\n    }\n});\n})();\nExt.Element.addMethods({\n    \n    isScrollable : function(){\n        var dom = this.dom;\n        return dom.scrollHeight > dom.clientHeight || dom.scrollWidth > dom.clientWidth;\n    },\n\n    \n    scrollTo : function(side, value){\n        this.dom[\"scroll\" + (/top/i.test(side) ? \"Top\" : \"Left\")] = value;\n        return this;\n    },\n\n    \n    getScroll : function(){\n        var d = this.dom, \n            doc = document,\n            body = doc.body,\n            docElement = doc.documentElement,\n            l,\n            t,\n            ret;\n\n        if(d == doc || d == body){\n            if(Ext.isIE && Ext.isStrict){\n                l = docElement.scrollLeft; \n                t = docElement.scrollTop;\n            }else{\n                l = window.pageXOffset;\n                t = window.pageYOffset;\n            }\n            ret = {left: l || (body ? body.scrollLeft : 0), top: t || (body ? body.scrollTop : 0)};\n        }else{\n            ret = {left: d.scrollLeft, top: d.scrollTop};\n        }\n        return ret;\n    }\n});\n\nExt.Element.VISIBILITY = 1;\n\nExt.Element.DISPLAY = 2;\n\n\nExt.Element.OFFSETS = 3;\n\n\nExt.Element.ASCLASS = 4;\n\n\nExt.Element.visibilityCls = 'x-hide-nosize';\n\nExt.Element.addMethods(function(){\n    var El = Ext.Element,\n        OPACITY = \"opacity\",\n        VISIBILITY = \"visibility\",\n        DISPLAY = \"display\",\n        HIDDEN = \"hidden\",\n        OFFSETS = \"offsets\",\n        ASCLASS = \"asclass\",\n        NONE = \"none\",\n        NOSIZE = 'nosize',\n        ORIGINALDISPLAY = 'originalDisplay',\n        VISMODE = 'visibilityMode',\n        ISVISIBLE = 'isVisible',\n        data = El.data,\n        getDisplay = function(dom){\n            var d = data(dom, ORIGINALDISPLAY);\n            if(d === undefined){\n                data(dom, ORIGINALDISPLAY, d = '');\n            }\n            return d;\n        },\n        getVisMode = function(dom){\n            var m = data(dom, VISMODE);\n            if(m === undefined){\n                data(dom, VISMODE, m = 1);\n            }\n            return m;\n        };\n\n    return {\n        \n        originalDisplay : \"\",\n        visibilityMode : 1,\n\n        \n        setVisibilityMode : function(visMode){\n            data(this.dom, VISMODE, visMode);\n            return this;\n        },\n\n        \n        animate : function(args, duration, onComplete, easing, animType){\n            this.anim(args, {duration: duration, callback: onComplete, easing: easing}, animType);\n            return this;\n        },\n\n        \n        anim : function(args, opt, animType, defaultDur, defaultEase, cb){\n            animType = animType || 'run';\n            opt = opt || {};\n            var me = this,\n                anim = Ext.lib.Anim[animType](\n                    me.dom,\n                    args,\n                    (opt.duration || defaultDur) || .35,\n                    (opt.easing || defaultEase) || 'easeOut',\n                    function(){\n                        if(cb) cb.call(me);\n                        if(opt.callback) opt.callback.call(opt.scope || me, me, opt);\n                    },\n                    me\n                );\n            opt.anim = anim;\n            return anim;\n        },\n\n        \n        preanim : function(a, i){\n            return !a[i] ? false : (typeof a[i] == 'object' ? a[i]: {duration: a[i+1], callback: a[i+2], easing: a[i+3]});\n        },\n\n        \n        isVisible : function() {\n            var me = this,\n                dom = me.dom,\n                visible = data(dom, ISVISIBLE);\n\n            if(typeof visible == 'boolean'){ \n                return visible;\n            }\n            \n            visible = !me.isStyle(VISIBILITY, HIDDEN) &&\n                      !me.isStyle(DISPLAY, NONE) &&\n                      !((getVisMode(dom) == El.ASCLASS) && me.hasClass(me.visibilityCls || El.visibilityCls));\n\n            data(dom, ISVISIBLE, visible);\n            return visible;\n        },\n\n        \n        setVisible : function(visible, animate){\n            var me = this, isDisplay, isVisibility, isOffsets, isNosize,\n                dom = me.dom,\n                visMode = getVisMode(dom);\n\n\n            \n            if (typeof animate == 'string'){\n                switch (animate) {\n                    case DISPLAY:\n                        visMode = El.DISPLAY;\n                        break;\n                    case VISIBILITY:\n                        visMode = El.VISIBILITY;\n                        break;\n                    case OFFSETS:\n                        visMode = El.OFFSETS;\n                        break;\n                    case NOSIZE:\n                    case ASCLASS:\n                        visMode = El.ASCLASS;\n                        break;\n                }\n                me.setVisibilityMode(visMode);\n                animate = false;\n            }\n\n            if (!animate || !me.anim) {\n                if(visMode == El.ASCLASS ){\n\n                    me[visible?'removeClass':'addClass'](me.visibilityCls || El.visibilityCls);\n\n                } else if (visMode == El.DISPLAY){\n\n                    return me.setDisplayed(visible);\n\n                } else if (visMode == El.OFFSETS){\n\n                    if (!visible){\n                        me.hideModeStyles = {\n                            position: me.getStyle('position'),\n                            top: me.getStyle('top'),\n                            left: me.getStyle('left')\n                        };\n                        me.applyStyles({position: 'absolute', top: '-10000px', left: '-10000px'});\n                    } else {\n                        me.applyStyles(me.hideModeStyles || {position: '', top: '', left: ''});\n                        delete me.hideModeStyles;\n                    }\n\n                }else{\n                    me.fixDisplay();\n                    dom.style.visibility = visible ? \"visible\" : HIDDEN;\n                }\n            }else{\n                \n                if(visible){\n                    me.setOpacity(.01);\n                    me.setVisible(true);\n                }\n                me.anim({opacity: { to: (visible?1:0) }},\n                        me.preanim(arguments, 1),\n                        null,\n                        .35,\n                        'easeIn',\n                        function(){\n                            visible || me.setVisible(false).setOpacity(1);\n                        });\n            }\n            data(dom, ISVISIBLE, visible);  \n            return me;\n        },\n\n\n        \n        hasMetrics  : function(){\n            var dom = this.dom;\n            return this.isVisible() || (getVisMode(dom) == El.VISIBILITY);\n        },\n\n        \n        toggle : function(animate){\n            var me = this;\n            me.setVisible(!me.isVisible(), me.preanim(arguments, 0));\n            return me;\n        },\n\n        \n        setDisplayed : function(value) {\n            if(typeof value == \"boolean\"){\n               value = value ? getDisplay(this.dom) : NONE;\n            }\n            this.setStyle(DISPLAY, value);\n            return this;\n        },\n\n        \n        fixDisplay : function(){\n            var me = this;\n            if(me.isStyle(DISPLAY, NONE)){\n                me.setStyle(VISIBILITY, HIDDEN);\n                me.setStyle(DISPLAY, getDisplay(this.dom)); \n                if(me.isStyle(DISPLAY, NONE)){ \n                    me.setStyle(DISPLAY, \"block\");\n                }\n            }\n        },\n\n        \n        hide : function(animate){\n            \n            if (typeof animate == 'string'){\n                this.setVisible(false, animate);\n                return this;\n            }\n            this.setVisible(false, this.preanim(arguments, 0));\n            return this;\n        },\n\n        \n        show : function(animate){\n            \n            if (typeof animate == 'string'){\n                this.setVisible(true, animate);\n                return this;\n            }\n            this.setVisible(true, this.preanim(arguments, 0));\n            return this;\n        }\n    };\n}());(function(){\n    \n    var NULL = null,\n        UNDEFINED = undefined,\n        TRUE = true,\n        FALSE = false,\n        SETX = \"setX\",\n        SETY = \"setY\",\n        SETXY = \"setXY\",\n        LEFT = \"left\",\n        BOTTOM = \"bottom\",\n        TOP = \"top\",\n        RIGHT = \"right\",\n        HEIGHT = \"height\",\n        WIDTH = \"width\",\n        POINTS = \"points\",\n        HIDDEN = \"hidden\",\n        ABSOLUTE = \"absolute\",\n        VISIBLE = \"visible\",\n        MOTION = \"motion\",\n        POSITION = \"position\",\n        EASEOUT = \"easeOut\",\n        \n        flyEl = new Ext.Element.Flyweight(),\n        queues = {},\n        getObject = function(o){\n            return o || {};\n        },\n        fly = function(dom){\n            flyEl.dom = dom;\n            flyEl.id = Ext.id(dom);\n            return flyEl;\n        },\n        \n        getQueue = function(id){\n            if(!queues[id]){\n                queues[id] = [];\n            }\n            return queues[id];\n        },\n        setQueue = function(id, value){\n            queues[id] = value;\n        };\n        \n\nExt.enableFx = TRUE;\n\n\nExt.Fx = {\n    \n    \n    \n    switchStatements : function(key, fn, argHash){\n        return fn.apply(this, argHash[key]);\n    },\n    \n    \n    slideIn : function(anchor, o){ \n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            st = dom.style,\n            xy,\n            r,\n            b,              \n            wrap,               \n            after,\n            st,\n            args, \n            pt,\n            bw,\n            bh;\n            \n        anchor = anchor || \"t\";\n\n        me.queueFx(o, function(){            \n            xy = fly(dom).getXY();\n            \n            fly(dom).fixDisplay();            \n            \n            \n            r = fly(dom).getFxRestore();      \n            b = {x: xy[0], y: xy[1], 0: xy[0], 1: xy[1], width: dom.offsetWidth, height: dom.offsetHeight};\n            b.right = b.x + b.width;\n            b.bottom = b.y + b.height;\n            \n            \n            fly(dom).setWidth(b.width).setHeight(b.height);            \n            \n            \n            wrap = fly(dom).fxWrap(r.pos, o, HIDDEN);\n            \n            st.visibility = VISIBLE;\n            st.position = ABSOLUTE;\n            \n            \n            function after(){\n                 fly(dom).fxUnwrap(wrap, r.pos, o);\n                 st.width = r.width;\n                 st.height = r.height;\n                 fly(dom).afterFx(o);\n            }\n            \n            \n            pt = {to: [b.x, b.y]}; \n            bw = {to: b.width};\n            bh = {to: b.height};\n                \n            function argCalc(wrap, style, ww, wh, sXY, sXYval, s1, s2, w, h, p){                    \n                var ret = {};\n                fly(wrap).setWidth(ww).setHeight(wh);\n                if(fly(wrap)[sXY]){\n                    fly(wrap)[sXY](sXYval);                  \n                }\n                style[s1] = style[s2] = \"0\";                    \n                if(w){\n                    ret.width = w;\n                }\n                if(h){\n                    ret.height = h;\n                }\n                if(p){\n                    ret.points = p;\n                }\n                return ret;\n            };\n\n            args = fly(dom).switchStatements(anchor.toLowerCase(), argCalc, {\n                    t  : [wrap, st, b.width, 0, NULL, NULL, LEFT, BOTTOM, NULL, bh, NULL],\n                    l  : [wrap, st, 0, b.height, NULL, NULL, RIGHT, TOP, bw, NULL, NULL],\n                    r  : [wrap, st, b.width, b.height, SETX, b.right, LEFT, TOP, NULL, NULL, pt],\n                    b  : [wrap, st, b.width, b.height, SETY, b.bottom, LEFT, TOP, NULL, bh, pt],\n                    tl : [wrap, st, 0, 0, NULL, NULL, RIGHT, BOTTOM, bw, bh, pt],\n                    bl : [wrap, st, 0, 0, SETY, b.y + b.height, RIGHT, TOP, bw, bh, pt],\n                    br : [wrap, st, 0, 0, SETXY, [b.right, b.bottom], LEFT, TOP, bw, bh, pt],\n                    tr : [wrap, st, 0, 0, SETX, b.x + b.width, LEFT, BOTTOM, bw, bh, pt]\n                });\n            \n            st.visibility = VISIBLE;\n            fly(wrap).show();\n\n            arguments.callee.anim = fly(wrap).fxanim(args,\n                o,\n                MOTION,\n                .5,\n                EASEOUT, \n                after);\n        });\n        return me;\n    },\n    \n    \n    slideOut : function(anchor, o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            st = dom.style,\n            xy = me.getXY(),\n            wrap,\n            r,\n            b,\n            a,\n            zero = {to: 0}; \n                    \n        anchor = anchor || \"t\";\n\n        me.queueFx(o, function(){\n            \n            \n            r = fly(dom).getFxRestore(); \n            b = {x: xy[0], y: xy[1], 0: xy[0], 1: xy[1], width: dom.offsetWidth, height: dom.offsetHeight};\n            b.right = b.x + b.width;\n            b.bottom = b.y + b.height;\n                \n            \n            fly(dom).setWidth(b.width).setHeight(b.height);\n\n            \n            wrap = fly(dom).fxWrap(r.pos, o, VISIBLE);\n                \n            st.visibility = VISIBLE;\n            st.position = ABSOLUTE;\n            fly(wrap).setWidth(b.width).setHeight(b.height);            \n\n            function after(){\n                o.useDisplay ? fly(dom).setDisplayed(FALSE) : fly(dom).hide();                \n                fly(dom).fxUnwrap(wrap, r.pos, o);\n                st.width = r.width;\n                st.height = r.height;\n                fly(dom).afterFx(o);\n            }            \n            \n            function argCalc(style, s1, s2, p1, v1, p2, v2, p3, v3){                    \n                var ret = {};\n                \n                style[s1] = style[s2] = \"0\";\n                ret[p1] = v1;               \n                if(p2){\n                    ret[p2] = v2;               \n                }\n                if(p3){\n                    ret[p3] = v3;\n                }\n                \n                return ret;\n            };\n            \n            a = fly(dom).switchStatements(anchor.toLowerCase(), argCalc, {\n                t  : [st, LEFT, BOTTOM, HEIGHT, zero],\n                l  : [st, RIGHT, TOP, WIDTH, zero],\n                r  : [st, LEFT, TOP, WIDTH, zero, POINTS, {to : [b.right, b.y]}],\n                b  : [st, LEFT, TOP, HEIGHT, zero, POINTS, {to : [b.x, b.bottom]}],\n                tl : [st, RIGHT, BOTTOM, WIDTH, zero, HEIGHT, zero],\n                bl : [st, RIGHT, TOP, WIDTH, zero, HEIGHT, zero, POINTS, {to : [b.x, b.bottom]}],\n                br : [st, LEFT, TOP, WIDTH, zero, HEIGHT, zero, POINTS, {to : [b.x + b.width, b.bottom]}],\n                tr : [st, LEFT, BOTTOM, WIDTH, zero, HEIGHT, zero, POINTS, {to : [b.right, b.y]}]\n            });\n            \n            arguments.callee.anim = fly(wrap).fxanim(a,\n                o,\n                MOTION,\n                .5,\n                EASEOUT, \n                after);\n        });\n        return me;\n    },\n\n    \n    puff : function(o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            st = dom.style,\n            width,\n            height,\n            r;\n\n        me.queueFx(o, function(){\n            width = fly(dom).getWidth();\n            height = fly(dom).getHeight();\n            fly(dom).clearOpacity();\n            fly(dom).show();\n\n            \n            r = fly(dom).getFxRestore();                   \n            \n            function after(){\n                o.useDisplay ? fly(dom).setDisplayed(FALSE) : fly(dom).hide();                  \n                fly(dom).clearOpacity();  \n                fly(dom).setPositioning(r.pos);\n                st.width = r.width;\n                st.height = r.height;\n                st.fontSize = '';\n                fly(dom).afterFx(o);\n            }   \n\n            arguments.callee.anim = fly(dom).fxanim({\n                    width : {to : fly(dom).adjustWidth(width * 2)},\n                    height : {to : fly(dom).adjustHeight(height * 2)},\n                    points : {by : [-width * .5, -height * .5]},\n                    opacity : {to : 0},\n                    fontSize: {to : 200, unit: \"%\"}\n                },\n                o,\n                MOTION,\n                .5,\n                EASEOUT,\n                 after);\n        });\n        return me;\n    },\n\n    \n    switchOff : function(o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            st = dom.style,\n            r;\n\n        me.queueFx(o, function(){\n            fly(dom).clearOpacity();\n            fly(dom).clip();\n\n            \n            r = fly(dom).getFxRestore();\n                \n            function after(){\n                o.useDisplay ? fly(dom).setDisplayed(FALSE) : fly(dom).hide();  \n                fly(dom).clearOpacity();\n                fly(dom).setPositioning(r.pos);\n                st.width = r.width;\n                st.height = r.height;   \n                fly(dom).afterFx(o);\n            };\n\n            fly(dom).fxanim({opacity : {to : 0.3}}, \n                NULL, \n                NULL, \n                .1, \n                NULL, \n                function(){                                 \n                    fly(dom).clearOpacity();\n                        (function(){                            \n                            fly(dom).fxanim({\n                                height : {to : 1},\n                                points : {by : [0, fly(dom).getHeight() * .5]}\n                            }, \n                            o, \n                            MOTION, \n                            0.3, \n                            'easeIn', \n                            after);\n                        }).defer(100);\n                });\n        });\n        return me;\n    },\n\n     \n    highlight : function(color, o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            attr = o.attr || \"backgroundColor\",\n            a = {},\n            restore;\n\n        me.queueFx(o, function(){\n            fly(dom).clearOpacity();\n            fly(dom).show();\n\n            function after(){\n                dom.style[attr] = restore;\n                fly(dom).afterFx(o);\n            }            \n            restore = dom.style[attr];\n            a[attr] = {from: color || \"ffff9c\", to: o.endColor || fly(dom).getColor(attr) || \"ffffff\"};\n            arguments.callee.anim = fly(dom).fxanim(a,\n                o,\n                'color',\n                1,\n                'easeIn', \n                after);\n        });\n        return me;\n    },\n\n   \n    frame : function(color, count, o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            proxy,\n            active;\n\n        me.queueFx(o, function(){\n            color = color || '#C3DAF9';\n            if(color.length == 6){\n                color = '#' + color;\n            }            \n            count = count || 1;\n            fly(dom).show();\n\n            var xy = fly(dom).getXY(),\n                b = {x: xy[0], y: xy[1], 0: xy[0], 1: xy[1], width: dom.offsetWidth, height: dom.offsetHeight},\n                queue = function(){\n                    proxy = fly(document.body || document.documentElement).createChild({\n                        style:{\n                            position : ABSOLUTE,\n                            'z-index': 35000, \n                            border : '0px solid ' + color\n                        }\n                    });\n                    return proxy.queueFx({}, animFn);\n                };\n            \n            \n            arguments.callee.anim = {\n                isAnimated: true,\n                stop: function() {\n                    count = 0;\n                    proxy.stopFx();\n                }\n            };\n            \n            function animFn(){\n                var scale = Ext.isBorderBox ? 2 : 1;\n                active = proxy.anim({\n                    top : {from : b.y, to : b.y - 20},\n                    left : {from : b.x, to : b.x - 20},\n                    borderWidth : {from : 0, to : 10},\n                    opacity : {from : 1, to : 0},\n                    height : {from : b.height, to : b.height + 20 * scale},\n                    width : {from : b.width, to : b.width + 20 * scale}\n                },{\n                    duration: o.duration || 1,\n                    callback: function() {\n                        proxy.remove();\n                        --count > 0 ? queue() : fly(dom).afterFx(o);\n                    }\n                });\n                arguments.callee.anim = {\n                    isAnimated: true,\n                    stop: function(){\n                        active.stop();\n                    }\n                };\n            };\n            queue();\n        });\n        return me;\n    },\n\n   \n    pause : function(seconds){        \n        var dom = this.dom,\n            t;\n\n        this.queueFx({}, function(){\n            t = setTimeout(function(){\n                fly(dom).afterFx({});\n            }, seconds * 1000);\n            arguments.callee.anim = {\n                isAnimated: true,\n                stop: function(){\n                    clearTimeout(t);\n                    fly(dom).afterFx({});\n                }\n            };\n        });\n        return this;\n    },\n\n   \n    fadeIn : function(o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            to = o.endOpacity || 1;\n        \n        me.queueFx(o, function(){\n            fly(dom).setOpacity(0);\n            fly(dom).fixDisplay();\n            dom.style.visibility = VISIBLE;\n            arguments.callee.anim = fly(dom).fxanim({opacity:{to:to}},\n                o, NULL, .5, EASEOUT, function(){\n                if(to == 1){\n                    fly(dom).clearOpacity();\n                }\n                fly(dom).afterFx(o);\n            });\n        });\n        return me;\n    },\n\n   \n    fadeOut : function(o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            style = dom.style,\n            to = o.endOpacity || 0;         \n        \n        me.queueFx(o, function(){  \n            arguments.callee.anim = fly(dom).fxanim({ \n                opacity : {to : to}},\n                o, \n                NULL, \n                .5, \n                EASEOUT, \n                function(){\n                    if(to == 0){\n                        Ext.Element.data(dom, 'visibilityMode') == Ext.Element.DISPLAY || o.useDisplay ? \n                            style.display = \"none\" :\n                            style.visibility = HIDDEN;\n                            \n                        fly(dom).clearOpacity();\n                    }\n                    fly(dom).afterFx(o);\n            });\n        });\n        return me;\n    },\n\n   \n    scale : function(w, h, o){\n        this.shift(Ext.apply({}, o, {\n            width: w,\n            height: h\n        }));\n        return this;\n    },\n\n   \n    shift : function(o){\n        o = getObject(o);\n        var dom = this.dom,\n            a = {};\n                \n        this.queueFx(o, function(){\n            for (var prop in o) {\n                if (o[prop] != UNDEFINED) {                                                 \n                    a[prop] = {to : o[prop]};                   \n                }\n            } \n            \n            a.width ? a.width.to = fly(dom).adjustWidth(o.width) : a;\n            a.height ? a.height.to = fly(dom).adjustWidth(o.height) : a;   \n            \n            if (a.x || a.y || a.xy) {\n                a.points = a.xy || \n                           {to : [ a.x ? a.x.to : fly(dom).getX(),\n                                   a.y ? a.y.to : fly(dom).getY()]};                  \n            }\n\n            arguments.callee.anim = fly(dom).fxanim(a,\n                o, \n                MOTION, \n                .35, \n                EASEOUT, \n                function(){\n                    fly(dom).afterFx(o);\n                });\n        });\n        return this;\n    },\n\n    \n    ghost : function(anchor, o){\n        o = getObject(o);\n        var me = this,\n            dom = me.dom,\n            st = dom.style,\n            a = {opacity: {to: 0}, points: {}},\n            pt = a.points,\n            r,\n            w,\n            h;\n            \n        anchor = anchor || \"b\";\n\n        me.queueFx(o, function(){\n            \n            r = fly(dom).getFxRestore();\n            w = fly(dom).getWidth();\n            h = fly(dom).getHeight();\n            \n            function after(){\n                o.useDisplay ? fly(dom).setDisplayed(FALSE) : fly(dom).hide();   \n                fly(dom).clearOpacity();\n                fly(dom).setPositioning(r.pos);\n                st.width = r.width;\n                st.height = r.height;\n                fly(dom).afterFx(o);\n            }\n                \n            pt.by = fly(dom).switchStatements(anchor.toLowerCase(), function(v1,v2){ return [v1, v2];}, {\n               t  : [0, -h],\n               l  : [-w, 0],\n               r  : [w, 0],\n               b  : [0, h],\n               tl : [-w, -h],\n               bl : [-w, h],\n               br : [w, h],\n               tr : [w, -h] \n            });\n                \n            arguments.callee.anim = fly(dom).fxanim(a,\n                o,\n                MOTION,\n                .5,\n                EASEOUT, after);\n        });\n        return me;\n    },\n\n    \n    syncFx : function(){\n        var me = this;\n        me.fxDefaults = Ext.apply(me.fxDefaults || {}, {\n            block : FALSE,\n            concurrent : TRUE,\n            stopFx : FALSE\n        });\n        return me;\n    },\n\n    \n    sequenceFx : function(){\n        var me = this;\n        me.fxDefaults = Ext.apply(me.fxDefaults || {}, {\n            block : FALSE,\n            concurrent : FALSE,\n            stopFx : FALSE\n        });\n        return me;\n    },\n\n    \n    nextFx : function(){        \n        var ef = getQueue(this.dom.id)[0];\n        if(ef){\n            ef.call(this);\n        }\n    },\n\n    \n    hasActiveFx : function(){\n        return getQueue(this.dom.id)[0];\n    },\n\n    \n    stopFx : function(finish){\n        var me = this,\n            id = me.dom.id;\n        if(me.hasActiveFx()){\n            var cur = getQueue(id)[0];\n            if(cur && cur.anim){\n                if(cur.anim.isAnimated){\n                    setQueue(id, [cur]); \n                    cur.anim.stop(finish !== undefined ? finish : TRUE);\n                }else{\n                    setQueue(id, []);\n                }\n            }\n        }\n        return me;\n    },\n\n    \n    beforeFx : function(o){\n        if(this.hasActiveFx() && !o.concurrent){\n           if(o.stopFx){\n               this.stopFx();\n               return TRUE;\n           }\n           return FALSE;\n        }\n        return TRUE;\n    },\n\n    \n    hasFxBlock : function(){\n        var q = getQueue(this.dom.id);\n        return q && q[0] && q[0].block;\n    },\n\n    \n    queueFx : function(o, fn){\n        var me = fly(this.dom);\n        if(!me.hasFxBlock()){\n            Ext.applyIf(o, me.fxDefaults);\n            if(!o.concurrent){\n                var run = me.beforeFx(o);\n                fn.block = o.block;\n                getQueue(me.dom.id).push(fn);\n                if(run){\n                    me.nextFx();\n                }\n            }else{\n                fn.call(me);\n            }\n        }\n        return me;\n    },\n\n    \n    fxWrap : function(pos, o, vis){ \n        var dom = this.dom,\n            wrap,\n            wrapXY;\n        if(!o.wrap || !(wrap = Ext.getDom(o.wrap))){            \n            if(o.fixPosition){\n                wrapXY = fly(dom).getXY();\n            }\n            var div = document.createElement(\"div\");\n            div.style.visibility = vis;\n            wrap = dom.parentNode.insertBefore(div, dom);\n            fly(wrap).setPositioning(pos);\n            if(fly(wrap).isStyle(POSITION, \"static\")){\n                fly(wrap).position(\"relative\");\n            }\n            fly(dom).clearPositioning('auto');\n            fly(wrap).clip();\n            wrap.appendChild(dom);\n            if(wrapXY){\n                fly(wrap).setXY(wrapXY);\n            }\n        }\n        return wrap;\n    },\n\n    \n    fxUnwrap : function(wrap, pos, o){      \n        var dom = this.dom;\n        fly(dom).clearPositioning();\n        fly(dom).setPositioning(pos);\n        if(!o.wrap){\n            var pn = fly(wrap).dom.parentNode;\n            pn.insertBefore(dom, wrap); \n            fly(wrap).remove();\n        }\n    },\n\n    \n    getFxRestore : function(){\n        var st = this.dom.style;\n        return {pos: this.getPositioning(), width: st.width, height : st.height};\n    },\n\n    \n    afterFx : function(o){\n        var dom = this.dom,\n            id = dom.id;\n        if(o.afterStyle){\n            fly(dom).setStyle(o.afterStyle);            \n        }\n        if(o.afterCls){\n            fly(dom).addClass(o.afterCls);\n        }\n        if(o.remove == TRUE){\n            fly(dom).remove();\n        }\n        if(o.callback){\n            o.callback.call(o.scope, fly(dom));\n        }\n        if(!o.concurrent){\n            getQueue(id).shift();\n            fly(dom).nextFx();\n        }\n    },\n\n    \n    fxanim : function(args, opt, animType, defaultDur, defaultEase, cb){\n        animType = animType || 'run';\n        opt = opt || {};\n        var anim = Ext.lib.Anim[animType](\n                this.dom, \n                args,\n                (opt.duration || defaultDur) || .35,\n                (opt.easing || defaultEase) || EASEOUT,\n                cb,            \n                this\n            );\n        opt.anim = anim;\n        return anim;\n    }\n};\n\n\nExt.Fx.resize = Ext.Fx.scale;\n\n\n\nExt.Element.addMethods(Ext.Fx);\n})();\n\nExt.CompositeElementLite = function(els, root){\n    \n    this.elements = [];\n    this.add(els, root);\n    this.el = new Ext.Element.Flyweight();\n};\n\nExt.CompositeElementLite.prototype = {\n    isComposite: true,\n\n    \n    getElement : function(el){\n        \n        var e = this.el;\n        e.dom = el;\n        e.id = el.id;\n        return e;\n    },\n\n    \n    transformElement : function(el){\n        return Ext.getDom(el);\n    },\n\n    \n    getCount : function(){\n        return this.elements.length;\n    },\n    \n    add : function(els, root){\n        var me = this,\n            elements = me.elements;\n        if(!els){\n            return this;\n        }\n        if(typeof els == \"string\"){\n            els = Ext.Element.selectorFunction(els, root);\n        }else if(els.isComposite){\n            els = els.elements;\n        }else if(!Ext.isIterable(els)){\n            els = [els];\n        }\n\n        for(var i = 0, len = els.length; i < len; ++i){\n            elements.push(me.transformElement(els[i]));\n        }\n        return me;\n    },\n\n    invoke : function(fn, args){\n        var me = this,\n            els = me.elements,\n            len = els.length,\n            e,\n            i;\n\n        for(i = 0; i < len; i++) {\n            e = els[i];\n            if(e){\n                Ext.Element.prototype[fn].apply(me.getElement(e), args);\n            }\n        }\n        return me;\n    },\n    \n    item : function(index){\n        var me = this,\n            el = me.elements[index],\n            out = null;\n\n        if(el){\n            out = me.getElement(el);\n        }\n        return out;\n    },\n\n    \n    addListener : function(eventName, handler, scope, opt){\n        var els = this.elements,\n            len = els.length,\n            i, e;\n\n        for(i = 0; i<len; i++) {\n            e = els[i];\n            if(e) {\n                Ext.EventManager.on(e, eventName, handler, scope || e, opt);\n            }\n        }\n        return this;\n    },\n    \n    each : function(fn, scope){\n        var me = this,\n            els = me.elements,\n            len = els.length,\n            i, e;\n\n        for(i = 0; i<len; i++) {\n            e = els[i];\n            if(e){\n                e = this.getElement(e);\n                if(fn.call(scope || e, e, me, i) === false){\n                    break;\n                }\n            }\n        }\n        return me;\n    },\n\n    \n    fill : function(els){\n        var me = this;\n        me.elements = [];\n        me.add(els);\n        return me;\n    },\n\n    \n    filter : function(selector){\n        var els = [],\n            me = this,\n            fn = Ext.isFunction(selector) ? selector\n                : function(el){\n                    return el.is(selector);\n                };\n\n        me.each(function(el, self, i) {\n            if (fn(el, i) !== false) {\n                els[els.length] = me.transformElement(el);\n            }\n        });\n        \n        me.elements = els;\n        return me;\n    },\n\n    \n    indexOf : function(el){\n        return this.elements.indexOf(this.transformElement(el));\n    },\n\n    \n    replaceElement : function(el, replacement, domReplace){\n        var index = !isNaN(el) ? el : this.indexOf(el),\n            d;\n        if(index > -1){\n            replacement = Ext.getDom(replacement);\n            if(domReplace){\n                d = this.elements[index];\n                d.parentNode.insertBefore(replacement, d);\n                Ext.removeNode(d);\n            }\n            this.elements.splice(index, 1, replacement);\n        }\n        return this;\n    },\n\n    \n    clear : function(){\n        this.elements = [];\n    }\n};\n\nExt.CompositeElementLite.prototype.on = Ext.CompositeElementLite.prototype.addListener;\n\n\nExt.CompositeElementLite.importElementMethods = function() {\n    var fnName,\n        ElProto = Ext.Element.prototype,\n        CelProto = Ext.CompositeElementLite.prototype;\n\n    for (fnName in ElProto) {\n        if (typeof ElProto[fnName] == 'function'){\n            (function(fnName) {\n                CelProto[fnName] = CelProto[fnName] || function() {\n                    return this.invoke(fnName, arguments);\n                };\n            }).call(CelProto, fnName);\n\n        }\n    }\n};\n\nExt.CompositeElementLite.importElementMethods();\n\nif(Ext.DomQuery){\n    Ext.Element.selectorFunction = Ext.DomQuery.select;\n}\n\n\nExt.Element.select = function(selector, root){\n    var els;\n    if(typeof selector == \"string\"){\n        els = Ext.Element.selectorFunction(selector, root);\n    }else if(selector.length !== undefined){\n        els = selector;\n    }else{\n        throw \"Invalid selector\";\n    }\n    return new Ext.CompositeElementLite(els);\n};\n\nExt.select = Ext.Element.select;\n(function(){\n    var BEFOREREQUEST = \"beforerequest\",\n        REQUESTCOMPLETE = \"requestcomplete\",\n        REQUESTEXCEPTION = \"requestexception\",\n        UNDEFINED = undefined,\n        LOAD = 'load',\n        POST = 'POST',\n        GET = 'GET',\n        WINDOW = window;\n\n    \n    Ext.data.Connection = function(config){\n        Ext.apply(this, config);\n        this.addEvents(\n            \n            BEFOREREQUEST,\n            \n            REQUESTCOMPLETE,\n            \n            REQUESTEXCEPTION\n        );\n        Ext.data.Connection.superclass.constructor.call(this);\n    };\n\n    Ext.extend(Ext.data.Connection, Ext.util.Observable, {\n        \n        \n        \n        \n        \n        timeout : 30000,\n        \n        autoAbort:false,\n\n        \n        disableCaching: true,\n\n        \n        disableCachingParam: '_dc',\n\n        \n        request : function(o){\n            var me = this;\n            if(me.fireEvent(BEFOREREQUEST, me, o)){\n                if (o.el) {\n                    if(!Ext.isEmpty(o.indicatorText)){\n                        me.indicatorText = '<div class=\"loading-indicator\">'+o.indicatorText+\"</div>\";\n                    }\n                    if(me.indicatorText) {\n                        Ext.getDom(o.el).innerHTML = me.indicatorText;\n                    }\n                    o.success = (Ext.isFunction(o.success) ? o.success : function(){}).createInterceptor(function(response) {\n                        Ext.getDom(o.el).innerHTML = response.responseText;\n                    });\n                }\n\n                var p = o.params,\n                    url = o.url || me.url,\n                    method,\n                    cb = {success: me.handleResponse,\n                          failure: me.handleFailure,\n                          scope: me,\n                          argument: {options: o},\n                          timeout : Ext.num(o.timeout, me.timeout)\n                    },\n                    form,\n                    serForm;\n\n\n                if (Ext.isFunction(p)) {\n                    p = p.call(o.scope||WINDOW, o);\n                }\n\n                p = Ext.urlEncode(me.extraParams, Ext.isObject(p) ? Ext.urlEncode(p) : p);\n\n                if (Ext.isFunction(url)) {\n                    url = url.call(o.scope || WINDOW, o);\n                }\n\n                if((form = Ext.getDom(o.form))){\n                    url = url || form.action;\n                     if(o.isUpload || (/multipart\\/form-data/i.test(form.getAttribute(\"enctype\")))) {\n                         return me.doFormUpload.call(me, o, p, url);\n                     }\n                    serForm = Ext.lib.Ajax.serializeForm(form);\n                    p = p ? (p + '&' + serForm) : serForm;\n                }\n\n                method = o.method || me.method || ((p || o.xmlData || o.jsonData) ? POST : GET);\n\n                if(method === GET && (me.disableCaching && o.disableCaching !== false) || o.disableCaching === true){\n                    var dcp = o.disableCachingParam || me.disableCachingParam;\n                    url = Ext.urlAppend(url, dcp + '=' + (new Date().getTime()));\n                }\n\n                o.headers = Ext.applyIf(o.headers || {}, me.defaultHeaders || {});\n\n                if(o.autoAbort === true || me.autoAbort) {\n                    me.abort();\n                }\n\n                if((method == GET || o.xmlData || o.jsonData) && p){\n                    url = Ext.urlAppend(url, p);\n                    p = '';\n                }\n                return (me.transId = Ext.lib.Ajax.request(method, url, cb, p, o));\n            }else{\n                return o.callback ? o.callback.apply(o.scope, [o,UNDEFINED,UNDEFINED]) : null;\n            }\n        },\n\n        \n        isLoading : function(transId){\n            return transId ? Ext.lib.Ajax.isCallInProgress(transId) : !! this.transId;\n        },\n\n        \n        abort : function(transId){\n            if(transId || this.isLoading()){\n                Ext.lib.Ajax.abort(transId || this.transId);\n            }\n        },\n\n        \n        handleResponse : function(response){\n            this.transId = false;\n            var options = response.argument.options;\n            response.argument = options ? options.argument : null;\n            this.fireEvent(REQUESTCOMPLETE, this, response, options);\n            if(options.success){\n                options.success.call(options.scope, response, options);\n            }\n            if(options.callback){\n                options.callback.call(options.scope, options, true, response);\n            }\n        },\n\n        \n        handleFailure : function(response, e){\n            this.transId = false;\n            var options = response.argument.options;\n            response.argument = options ? options.argument : null;\n            this.fireEvent(REQUESTEXCEPTION, this, response, options, e);\n            if(options.failure){\n                options.failure.call(options.scope, response, options);\n            }\n            if(options.callback){\n                options.callback.call(options.scope, options, false, response);\n            }\n        },\n\n        \n        doFormUpload : function(o, ps, url){\n            var id = Ext.id(),\n                doc = document,\n                frame = doc.createElement('iframe'),\n                form = Ext.getDom(o.form),\n                hiddens = [],\n                hd,\n                encoding = 'multipart/form-data',\n                buf = {\n                    target: form.target,\n                    method: form.method,\n                    encoding: form.encoding,\n                    enctype: form.enctype,\n                    action: form.action\n                };\n\n            \n            Ext.fly(frame).set({\n                id: id,\n                name: id,\n                cls: 'x-hidden',\n                src: Ext.SSL_SECURE_URL\n            }); \n\n            doc.body.appendChild(frame);\n\n            \n            if(Ext.isIE){\n               document.frames[id].name = id;\n            }\n\n\n            Ext.fly(form).set({\n                target: id,\n                method: POST,\n                enctype: encoding,\n                encoding: encoding,\n                action: url || buf.action\n            });\n\n            \n            Ext.iterate(Ext.urlDecode(ps, false), function(k, v){\n                hd = doc.createElement('input');\n                Ext.fly(hd).set({\n                    type: 'hidden',\n                    value: v,\n                    name: k\n                });\n                form.appendChild(hd);\n                hiddens.push(hd);\n            });\n\n            function cb(){\n                var me = this,\n                    \n                    r = {responseText : '',\n                         responseXML : null,\n                         argument : o.argument},\n                    doc,\n                    firstChild;\n\n                try{\n                    doc = frame.contentWindow.document || frame.contentDocument || WINDOW.frames[id].document;\n                    if(doc){\n                        if(doc.body){\n                            if(/textarea/i.test((firstChild = doc.body.firstChild || {}).tagName)){ \n                                r.responseText = firstChild.value;\n                            }else{\n                                r.responseText = doc.body.innerHTML;\n                            }\n                        }\n                        \n                        r.responseXML = doc.XMLDocument || doc;\n                    }\n                }\n                catch(e) {}\n\n                Ext.EventManager.removeListener(frame, LOAD, cb, me);\n\n                me.fireEvent(REQUESTCOMPLETE, me, r, o);\n\n                function runCallback(fn, scope, args){\n                    if(Ext.isFunction(fn)){\n                        fn.apply(scope, args);\n                    }\n                }\n\n                runCallback(o.success, o.scope, [r, o]);\n                runCallback(o.callback, o.scope, [o, true, r]);\n\n                if(!me.debugUploads){\n                    setTimeout(function(){Ext.removeNode(frame);}, 100);\n                }\n            }\n\n            Ext.EventManager.on(frame, LOAD, cb, this);\n            form.submit();\n\n            Ext.fly(form).set(buf);\n            Ext.each(hiddens, function(h) {\n                Ext.removeNode(h);\n            });\n        }\n    });\n})();\n\n\nExt.Ajax = new Ext.data.Connection({\n    \n    \n    \n    \n    \n    \n\n    \n\n    \n    \n    \n    \n    \n    \n\n    \n    autoAbort : false,\n\n    \n    serializeForm : function(form){\n        return Ext.lib.Ajax.serializeForm(form);\n    }\n});\n\nExt.util.JSON = new (function(){\n    var useHasOwn = !!{}.hasOwnProperty,\n        isNative = function() {\n            var useNative = null;\n\n            return function() {\n                if (useNative === null) {\n                    useNative = Ext.USE_NATIVE_JSON && window.JSON && JSON.toString() == '[object JSON]';\n                }\n        \n                return useNative;\n            };\n        }(),\n        pad = function(n) {\n            return n < 10 ? \"0\" + n : n;\n        },\n        doDecode = function(json){\n            return json ? eval(\"(\" + json + \")\") : \"\";    \n        },\n        doEncode = function(o){\n            if(!Ext.isDefined(o) || o === null){\n                return \"null\";\n            }else if(Ext.isArray(o)){\n                return encodeArray(o);\n            }else if(Ext.isDate(o)){\n                return Ext.util.JSON.encodeDate(o);\n            }else if(Ext.isString(o)){\n                return encodeString(o);\n            }else if(typeof o == \"number\"){\n                \n                return isFinite(o) ? String(o) : \"null\";\n            }else if(Ext.isBoolean(o)){\n                return String(o);\n            }else {\n                var a = [\"{\"], b, i, v;\n                for (i in o) {\n                    \n                    if(!o.getElementsByTagName){\n                        if(!useHasOwn || o.hasOwnProperty(i)) {\n                            v = o[i];\n                            switch (typeof v) {\n                            case \"undefined\":\n                            case \"function\":\n                            case \"unknown\":\n                                break;\n                            default:\n                                if(b){\n                                    a.push(',');\n                                }\n                                a.push(doEncode(i), \":\",\n                                        v === null ? \"null\" : doEncode(v));\n                                b = true;\n                            }\n                        }\n                    }\n                }\n                a.push(\"}\");\n                return a.join(\"\");\n            }    \n        },\n        m = {\n            \"\\b\": '\\\\b',\n            \"\\t\": '\\\\t',\n            \"\\n\": '\\\\n',\n            \"\\f\": '\\\\f',\n            \"\\r\": '\\\\r',\n            '\"' : '\\\\\"',\n            \"\\\\\": '\\\\\\\\'\n        },\n        encodeString = function(s){\n            if (/[\"\\\\\\x00-\\x1f]/.test(s)) {\n                return '\"' + s.replace(/([\\x00-\\x1f\\\\\"])/g, function(a, b) {\n                    var c = m[b];\n                    if(c){\n                        return c;\n                    }\n                    c = b.charCodeAt();\n                    return \"\\\\u00\" +\n                        Math.floor(c / 16).toString(16) +\n                        (c % 16).toString(16);\n                }) + '\"';\n            }\n            return '\"' + s + '\"';\n        },\n        encodeArray = function(o){\n            var a = [\"[\"], b, i, l = o.length, v;\n                for (i = 0; i < l; i += 1) {\n                    v = o[i];\n                    switch (typeof v) {\n                        case \"undefined\":\n                        case \"function\":\n                        case \"unknown\":\n                            break;\n                        default:\n                            if (b) {\n                                a.push(',');\n                            }\n                            a.push(v === null ? \"null\" : Ext.util.JSON.encode(v));\n                            b = true;\n                    }\n                }\n                a.push(\"]\");\n                return a.join(\"\");\n        };\n\n    \n    this.encodeDate = function(o){\n        return '\"' + o.getFullYear() + \"-\" +\n                pad(o.getMonth() + 1) + \"-\" +\n                pad(o.getDate()) + \"T\" +\n                pad(o.getHours()) + \":\" +\n                pad(o.getMinutes()) + \":\" +\n                pad(o.getSeconds()) + '\"';\n    };\n\n    \n    this.encode = function() {\n        var ec;\n        return function(o) {\n            if (!ec) {\n                \n                ec = isNative() ? JSON.stringify : doEncode;\n            }\n            return ec(o);\n        };\n    }();\n\n\n    \n    this.decode = function() {\n        var dc;\n        return function(json) {\n            if (!dc) {\n                \n                dc = isNative() ? JSON.parse : doDecode;\n            }\n            return dc(json);\n        };\n    }();\n\n})();\n\nExt.encode = Ext.util.JSON.encode;\n\nExt.decode = Ext.util.JSON.decode;\n\nExt.EventManager = function(){\n    var docReadyEvent,\n        docReadyProcId,\n        docReadyState = false,\n        DETECT_NATIVE = Ext.isGecko || Ext.isWebKit || Ext.isSafari || Ext.isIE10p,\n        E = Ext.lib.Event,\n        D = Ext.lib.Dom,\n        DOC = document,\n        WINDOW = window,\n        DOMCONTENTLOADED = \"DOMContentLoaded\",\n        COMPLETE = 'complete',\n        propRe = /^(?:scope|delay|buffer|single|stopEvent|preventDefault|stopPropagation|normalized|args|delegate)$/,\n        \n        specialElCache = [];\n\n     function getId(el){\n        var id = false,\n            i = 0,\n            len = specialElCache.length,\n            skip = false,\n            o;\n\n        if (el) {\n            if (el.getElementById || el.navigator) {\n                \n                for(; i < len; ++i){\n                    o = specialElCache[i];\n                    if(o.el === el){\n                        id = o.id;\n                        break;\n                    }\n                }\n                if(!id){\n                    \n                    id = Ext.id(el);\n                    specialElCache.push({\n                        id: id,\n                        el: el\n                    });\n                    skip = true;\n                }\n            }else{\n                id = Ext.id(el);\n            }\n            if(!Ext.elCache[id]){\n                Ext.Element.addToCache(new Ext.Element(el), id);\n                if(skip){\n                    Ext.elCache[id].skipGC = true;\n                }\n            }\n        }\n        return id;\n     }\n\n    \n    function addListener(el, ename, fn, task, wrap, scope){\n        el = Ext.getDom(el);\n        var id = getId(el),\n            es = Ext.elCache[id].events,\n            wfn;\n\n        wfn = E.on(el, ename, wrap);\n        es[ename] = es[ename] || [];\n\n        \n        es[ename].push([fn, wrap, scope, wfn, task]);\n\n        \n        \n\n        \n        if(el.addEventListener && ename == \"mousewheel\"){\n            var args = [\"DOMMouseScroll\", wrap, false];\n            el.addEventListener.apply(el, args);\n            Ext.EventManager.addListener(WINDOW, 'unload', function(){\n                el.removeEventListener.apply(el, args);\n            });\n        }\n\n        \n        if(el == DOC && ename == \"mousedown\"){\n            Ext.EventManager.stoppedMouseDownEvent.addListener(wrap);\n        }\n    }\n\n    function doScrollChk(){\n        \n        if(window != top){\n            return false;\n        }\n\n        try{\n            DOC.documentElement.doScroll('left');\n        }catch(e){\n             return false;\n        }\n\n        fireDocReady();\n        return true;\n    }\n    \n    function checkReadyState(e){\n\n        if(Ext.isIE9m && doScrollChk()){\n            return true;\n        }\n        if(DOC.readyState == COMPLETE){\n            fireDocReady();\n            return true;\n        }\n        docReadyState || (docReadyProcId = setTimeout(arguments.callee, 2));\n        return false;\n    }\n\n    var styles;\n    function checkStyleSheets(e){\n        styles || (styles = Ext.query('style, link[rel=stylesheet]'));\n        if(styles.length == DOC.styleSheets.length){\n            fireDocReady();\n            return true;\n        }\n        docReadyState || (docReadyProcId = setTimeout(arguments.callee, 2));\n        return false;\n    }\n\n    function OperaDOMContentLoaded(e){\n        DOC.removeEventListener(DOMCONTENTLOADED, arguments.callee, false);\n        checkStyleSheets();\n    }\n\n    function fireDocReady(e){\n        if(!docReadyState){\n            docReadyState = true; \n\n            if(docReadyProcId){\n                clearTimeout(docReadyProcId);\n            }\n            if(DETECT_NATIVE) {\n                DOC.removeEventListener(DOMCONTENTLOADED, fireDocReady, false);\n            }\n            if(Ext.isIE9m && checkReadyState.bindIE){  \n                DOC.detachEvent('onreadystatechange', checkReadyState);\n            }\n            E.un(WINDOW, \"load\", arguments.callee);\n        }\n        if(docReadyEvent && !Ext.isReady){\n            Ext.isReady = true;\n            docReadyEvent.fire();\n            docReadyEvent.listeners = [];\n        }\n\n    }\n\n    function initDocReady(){\n        docReadyEvent || (docReadyEvent = new Ext.util.Event());\n        if (DETECT_NATIVE) {\n            DOC.addEventListener(DOMCONTENTLOADED, fireDocReady, false);\n        }\n        \n        if (Ext.isIE9m){\n            \n            \n            if(!checkReadyState()){\n                checkReadyState.bindIE = true;\n                DOC.attachEvent('onreadystatechange', checkReadyState);\n            }\n\n        }else if(Ext.isOpera ){\n            \n\n            \n            (DOC.readyState == COMPLETE && checkStyleSheets()) ||\n                DOC.addEventListener(DOMCONTENTLOADED, OperaDOMContentLoaded, false);\n\n        }else if (Ext.isWebKit){\n            \n            checkReadyState();\n        }\n        \n        E.on(WINDOW, \"load\", fireDocReady);\n    }\n\n    function createTargeted(h, o){\n        return function(){\n            var args = Ext.toArray(arguments);\n            if(o.target == Ext.EventObject.setEvent(args[0]).target){\n                h.apply(this, args);\n            }\n        };\n    }\n\n    function createBuffered(h, o, task){\n        return function(e){\n            \n            task.delay(o.buffer, h, null, [new Ext.EventObjectImpl(e)]);\n        };\n    }\n\n    function createSingle(h, el, ename, fn, scope){\n        return function(e){\n            Ext.EventManager.removeListener(el, ename, fn, scope);\n            h(e);\n        };\n    }\n\n    function createDelayed(h, o, fn){\n        return function(e){\n            var task = new Ext.util.DelayedTask(h);\n            if(!fn.tasks) {\n                fn.tasks = [];\n            }\n            fn.tasks.push(task);\n            task.delay(o.delay || 10, h, null, [new Ext.EventObjectImpl(e)]);\n        };\n    }\n\n    function listen(element, ename, opt, fn, scope){\n        var o = (!opt || typeof opt == \"boolean\") ? {} : opt,\n            el = Ext.getDom(element), task;\n\n        fn = fn || o.fn;\n        scope = scope || o.scope;\n\n        if(!el){\n            throw \"Error listening for \\\"\" + ename + '\\\". Element \"' + element + '\" doesn\\'t exist.';\n        }\n        function h(e){\n            \n            if(!Ext){\n                return;\n            }\n            e = Ext.EventObject.setEvent(e);\n            var t;\n            if (o.delegate) {\n                if(!(t = e.getTarget(o.delegate, el))){\n                    return;\n                }\n            } else {\n                t = e.target;\n            }\n            if (o.stopEvent) {\n                e.stopEvent();\n            }\n            if (o.preventDefault) {\n               e.preventDefault();\n            }\n            if (o.stopPropagation) {\n                e.stopPropagation();\n            }\n            if (o.normalized === false) {\n                e = e.browserEvent;\n            }\n\n            fn.call(scope || el, e, t, o);\n        }\n        if(o.target){\n            h = createTargeted(h, o);\n        }\n        if(o.delay){\n            h = createDelayed(h, o, fn);\n        }\n        if(o.single){\n            h = createSingle(h, el, ename, fn, scope);\n        }\n        if(o.buffer){\n            task = new Ext.util.DelayedTask(h);\n            h = createBuffered(h, o, task);\n        }\n\n        addListener(el, ename, fn, task, h, scope);\n        return h;\n    }\n\n    var pub = {\n        \n        addListener : function(element, eventName, fn, scope, options){\n            if(typeof eventName == 'object'){\n                var o = eventName, e, val;\n                for(e in o){\n                    val = o[e];\n                    if(!propRe.test(e)){\n                        if(Ext.isFunction(val)){\n                            \n                            listen(element, e, o, val, o.scope);\n                        }else{\n                            \n                            listen(element, e, val);\n                        }\n                    }\n                }\n            } else {\n                listen(element, eventName, options, fn, scope);\n            }\n        },\n\n        \n        removeListener : function(el, eventName, fn, scope){\n            el = Ext.getDom(el);\n            var id = getId(el),\n                f = el && (Ext.elCache[id].events)[eventName] || [],\n                wrap, i, l, k, len, fnc;\n\n            for (i = 0, len = f.length; i < len; i++) {\n\n                \n                if (Ext.isArray(fnc = f[i]) && fnc[0] == fn && (!scope || fnc[2] == scope)) {\n                    if(fnc[4]) {\n                        fnc[4].cancel();\n                    }\n                    k = fn.tasks && fn.tasks.length;\n                    if(k) {\n                        while(k--) {\n                            fn.tasks[k].cancel();\n                        }\n                        delete fn.tasks;\n                    }\n                    wrap = fnc[1];\n                    E.un(el, eventName, E.extAdapter ? fnc[3] : wrap);\n\n                    \n                    if(wrap && el.addEventListener && eventName == \"mousewheel\"){\n                        el.removeEventListener(\"DOMMouseScroll\", wrap, false);\n                    }\n\n                    \n                    if(wrap && el == DOC && eventName == \"mousedown\"){\n                        Ext.EventManager.stoppedMouseDownEvent.removeListener(wrap);\n                    }\n\n                    f.splice(i, 1);\n                    if (f.length === 0) {\n                        delete Ext.elCache[id].events[eventName];\n                    }\n                    for (k in Ext.elCache[id].events) {\n                        return false;\n                    }\n                    Ext.elCache[id].events = {};\n                    return false;\n                }\n            }\n        },\n\n        \n        removeAll : function(el){\n            el = Ext.getDom(el);\n            var id = getId(el),\n                ec = Ext.elCache[id] || {},\n                es = ec.events || {},\n                f, i, len, ename, fn, k, wrap;\n\n            for(ename in es){\n                if(es.hasOwnProperty(ename)){\n                    f = es[ename];\n                    \n                    for (i = 0, len = f.length; i < len; i++) {\n                        fn = f[i];\n                        if(fn[4]) {\n                            fn[4].cancel();\n                        }\n                        if(fn[0].tasks && (k = fn[0].tasks.length)) {\n                            while(k--) {\n                                fn[0].tasks[k].cancel();\n                            }\n                            delete fn.tasks;\n                        }\n                        wrap =  fn[1];\n                        E.un(el, ename, E.extAdapter ? fn[3] : wrap);\n\n                        \n                        if(el.addEventListener && wrap && ename == \"mousewheel\"){\n                            el.removeEventListener(\"DOMMouseScroll\", wrap, false);\n                        }\n\n                        \n                        if(wrap && el == DOC &&  ename == \"mousedown\"){\n                            Ext.EventManager.stoppedMouseDownEvent.removeListener(wrap);\n                        }\n                    }\n                }\n            }\n            if (Ext.elCache[id]) {\n                Ext.elCache[id].events = {};\n            }\n        },\n\n        getListeners : function(el, eventName) {\n            el = Ext.getDom(el);\n            var id = getId(el),\n                ec = Ext.elCache[id] || {},\n                es = ec.events || {},\n                results = [];\n            if (es && es[eventName]) {\n                return es[eventName];\n            } else {\n                return null;\n            }\n        },\n        \n        removeFromSpecialCache: function(o) {\n            var i = 0,\n                len = specialElCache.length;\n                \n            for (; i < len; ++i) {\n                if (specialElCache[i].el == o) {\n                    specialElCache.splice(i, 1); \n                }\n            }\n        },\n\n        purgeElement : function(el, recurse, eventName) {\n            el = Ext.getDom(el);\n            var id = getId(el),\n                ec = Ext.elCache[id] || {},\n                es = ec.events || {},\n                i, f, len;\n            if (eventName) {\n                if (es && es.hasOwnProperty(eventName)) {\n                    f = es[eventName];\n                    for (i = 0, len = f.length; i < len; i++) {\n                        Ext.EventManager.removeListener(el, eventName, f[i][0]);\n                    }\n                }\n            } else {\n                Ext.EventManager.removeAll(el);\n            }\n            if (recurse && el && el.childNodes) {\n                for (i = 0, len = el.childNodes.length; i < len; i++) {\n                    Ext.EventManager.purgeElement(el.childNodes[i], recurse, eventName);\n                }\n            }\n        },\n\n        _unload : function() {\n            var el;\n            for (el in Ext.elCache) {\n                Ext.EventManager.removeAll(el);\n            }\n            delete Ext.elCache;\n            delete Ext.Element._flyweights;\n\n            \n            var c,\n                conn,\n                tid,\n                ajax = Ext.lib.Ajax;\n            (typeof ajax.conn == 'object') ? conn = ajax.conn : conn = {};\n            for (tid in conn) {\n                c = conn[tid];\n                if (c) {\n                    ajax.abort({conn: c, tId: tid});\n                }\n            }\n        },\n        \n        onDocumentReady : function(fn, scope, options){\n            if (Ext.isReady) { \n                docReadyEvent || (docReadyEvent = new Ext.util.Event());\n                docReadyEvent.addListener(fn, scope, options);\n                docReadyEvent.fire();\n                docReadyEvent.listeners = [];\n            } else {\n                if (!docReadyEvent) {\n                    initDocReady();\n                }\n                options = options || {};\n                options.delay = options.delay || 1;\n                docReadyEvent.addListener(fn, scope, options);\n            }\n        },\n\n        \n        fireDocReady  : fireDocReady\n    };\n     \n    pub.on = pub.addListener;\n    \n    pub.un = pub.removeListener;\n\n    pub.stoppedMouseDownEvent = new Ext.util.Event();\n    return pub;\n}();\n\nExt.onReady = Ext.EventManager.onDocumentReady;\n\n\n\n(function(){\n    var initExtCss = function() {\n        \n        var bd = document.body || document.getElementsByTagName('body')[0];\n        if (!bd) {\n            return false;\n        }\n\n        var cls = [];\n        \n        if (Ext.isIE) {\n            \n            if (!Ext.isIE10p) {\n                cls.push('ext-ie');\n            }\n            if (Ext.isIE6) {\n                cls.push('ext-ie6');\n            } else if (Ext.isIE7) {\n                cls.push('ext-ie7', 'ext-ie7m');\n            } else if (Ext.isIE8) {\n                cls.push('ext-ie8', 'ext-ie8m');\n            } else if (Ext.isIE9) {\n                cls.push('ext-ie9', 'ext-ie9m');\n            } else if (Ext.isIE10) {\n                cls.push('ext-ie10');\n            }\n        }\n        \n        if (Ext.isGecko) {\n            if (Ext.isGecko2) {\n                cls.push('ext-gecko2');\n            } else {\n                cls.push('ext-gecko3');\n            }\n        }\n        \n        if (Ext.isOpera) {\n            cls.push('ext-opera');\n        }\n        \n        if (Ext.isWebKit) {\n            cls.push('ext-webkit');\n        }\n\n        if (Ext.isSafari) {\n            cls.push(\"ext-safari \" + (Ext.isSafari2 ? 'ext-safari2' : (Ext.isSafari3 ? 'ext-safari3' : 'ext-safari4')));\n        } else if(Ext.isChrome) {\n            cls.push(\"ext-chrome\");\n        }\n\n        if (Ext.isMac) {\n            cls.push(\"ext-mac\");\n        }\n        if (Ext.isLinux) {\n            cls.push(\"ext-linux\");\n        }\n\n        \n        if (Ext.isStrict || Ext.isBorderBox) {\n            var p = bd.parentNode;\n            if (p) {\n                if (!Ext.isStrict) {\n                    Ext.fly(p, '_internal').addClass('x-quirks');\n                    if (Ext.isIE9m && !Ext.isStrict) {\n                        Ext.isIEQuirks = true;\n                    }\n                }\n                Ext.fly(p, '_internal').addClass(((Ext.isStrict && Ext.isIE ) || (!Ext.enableForcedBoxModel && !Ext.isIE)) ? ' ext-strict' : ' ext-border-box');\n            }\n        }\n        \n        \n        if (Ext.enableForcedBoxModel && !Ext.isIE) {\n            Ext.isForcedBorderBox = true;\n            cls.push(\"ext-forced-border-box\");\n        }\n\n        Ext.fly(bd, '_internal').addClass(cls);\n        return true;\n    };\n\n    if (!initExtCss()) {\n        Ext.onReady(initExtCss);\n    }\n})();\n\n\n(function(){\n    \n    var supports = Ext.apply(Ext.supports, {\n        \n        correctRightMargin: true,\n\n        \n        correctTransparentColor: true,\n\n        \n        cssFloat: true\n    });\n\n    var supportTests = function(){\n            var div = document.createElement('div'),\n                doc = document,\n                view,\n                last;\n\n            div.innerHTML = '<div style=\"height:30px;width:50px;\"><div style=\"height:20px;width:20px;\"></div></div><div style=\"float:left;background-color:transparent;\">';\n            doc.body.appendChild(div);\n            last = div.lastChild;\n\n            if((view = doc.defaultView)){\n                if(view.getComputedStyle(div.firstChild.firstChild, null).marginRight != '0px'){\n                    supports.correctRightMargin = false;\n                }\n                if(view.getComputedStyle(last, null).backgroundColor != 'transparent'){\n                    supports.correctTransparentColor = false;\n                }\n            }\n            supports.cssFloat = !!last.style.cssFloat;\n            doc.body.removeChild(div);\n    };\n\n    if (Ext.isReady) {\n        supportTests();\n    } else {\n        Ext.onReady(supportTests);\n    }\n})();\n\n\n\nExt.EventObject = function(){\n    var E = Ext.lib.Event,\n        clickRe = /(dbl)?click/,\n        \n        safariKeys = {\n            3 : 13, \n            63234 : 37, \n            63235 : 39, \n            63232 : 38, \n            63233 : 40, \n            63276 : 33, \n            63277 : 34, \n            63272 : 46, \n            63273 : 36, \n            63275 : 35  \n        },\n        \n        btnMap = Ext.isIE ? {1:0,4:1,2:2} : {0:0,1:1,2:2};\n\n    Ext.EventObjectImpl = function(e){\n        if(e){\n            this.setEvent(e.browserEvent || e);\n        }\n    };\n\n    Ext.EventObjectImpl.prototype = {\n           \n        setEvent : function(e){\n            var me = this;\n            if(e == me || (e && e.browserEvent)){ \n                return e;\n            }\n            me.browserEvent = e;\n            if(e){\n                \n                me.button = e.button ? btnMap[e.button] : (e.which ? e.which - 1 : -1);\n                if(clickRe.test(e.type) && me.button == -1){\n                    me.button = 0;\n                }\n                me.type = e.type;\n                me.shiftKey = e.shiftKey;\n                \n                me.ctrlKey = e.ctrlKey || e.metaKey || false;\n                me.altKey = e.altKey;\n                \n                me.keyCode = e.keyCode;\n                me.charCode = e.charCode;\n                \n                me.target = E.getTarget(e);\n                \n                me.xy = E.getXY(e);\n            }else{\n                me.button = -1;\n                me.shiftKey = false;\n                me.ctrlKey = false;\n                me.altKey = false;\n                me.keyCode = 0;\n                me.charCode = 0;\n                me.target = null;\n                me.xy = [0, 0];\n            }\n            return me;\n        },\n\n        \n        stopEvent : function(){\n            var me = this;\n            if(me.browserEvent){\n                if(me.browserEvent.type == 'mousedown'){\n                    Ext.EventManager.stoppedMouseDownEvent.fire(me);\n                }\n                E.stopEvent(me.browserEvent);\n            }\n        },\n\n        \n        preventDefault : function(){\n            if(this.browserEvent){\n                E.preventDefault(this.browserEvent);\n            }\n        },\n\n        \n        stopPropagation : function(){\n            var me = this;\n            if(me.browserEvent){\n                if(me.browserEvent.type == 'mousedown'){\n                    Ext.EventManager.stoppedMouseDownEvent.fire(me);\n                }\n                E.stopPropagation(me.browserEvent);\n            }\n        },\n\n        \n        getCharCode : function(){\n            return this.charCode || this.keyCode;\n        },\n\n        \n        getKey : function(){\n            return this.normalizeKey(this.keyCode || this.charCode);\n        },\n\n        \n        normalizeKey: function(k){\n            return Ext.isSafari ? (safariKeys[k] || k) : k;\n        },\n\n        \n        getPageX : function(){\n            return this.xy[0];\n        },\n\n        \n        getPageY : function(){\n            return this.xy[1];\n        },\n\n        \n        getXY : function(){\n            return this.xy;\n        },\n\n        \n        getTarget : function(selector, maxDepth, returnEl){\n            return selector ? Ext.fly(this.target).findParent(selector, maxDepth, returnEl) : (returnEl ? Ext.get(this.target) : this.target);\n        },\n\n        \n        getRelatedTarget : function(){\n            return this.browserEvent ? E.getRelatedTarget(this.browserEvent) : null;\n        },\n\n        \n        getWheelDelta : function(){\n            var e = this.browserEvent;\n            var delta = 0;\n            if(e.wheelDelta){ \n                delta = e.wheelDelta/120;\n            }else if(e.detail){ \n                delta = -e.detail/3;\n            }\n            return delta;\n        },\n\n        \n        within : function(el, related, allowEl){\n            if(el){\n                var t = this[related ? \"getRelatedTarget\" : \"getTarget\"]();\n                return t && ((allowEl ? (t == Ext.getDom(el)) : false) || Ext.fly(el).contains(t));\n            }\n            return false;\n        }\n     };\n\n    return new Ext.EventObjectImpl();\n}();\nExt.Loader = Ext.apply({}, {\n    \n    load: function(fileList, callback, scope, preserveOrder) {\n        var scope       = scope || this,\n            head        = document.getElementsByTagName(\"head\")[0],\n            fragment    = document.createDocumentFragment(),\n            numFiles    = fileList.length,\n            loadedFiles = 0,\n            me          = this;\n        \n        \n        var loadFileIndex = function(index) {\n            head.appendChild(\n                me.buildScriptTag(fileList[index], onFileLoaded)\n            );\n        };\n        \n        \n        var onFileLoaded = function() {\n            loadedFiles ++;\n            \n            \n            if (numFiles == loadedFiles && typeof callback == 'function') {\n                callback.call(scope);\n            } else {\n                if (preserveOrder === true) {\n                    loadFileIndex(loadedFiles);\n                }\n            }\n        };\n        \n        if (preserveOrder === true) {\n            loadFileIndex.call(this, 0);\n        } else {\n            \n            Ext.each(fileList, function(file, index) {\n                fragment.appendChild(\n                    this.buildScriptTag(file, onFileLoaded)\n                );  \n            }, this);\n            \n            head.appendChild(fragment);\n        }\n    },\n    \n    \n    buildScriptTag: function(filename, callback) {\n        var script  = document.createElement('script');\n        script.type = \"text/javascript\";\n        script.src  = filename;\n        \n        \n        if (script.readyState) {\n            script.onreadystatechange = function() {\n                if (script.readyState == \"loaded\" || script.readyState == \"complete\") {\n                    script.onreadystatechange = null;\n                    callback();\n                }\n            };\n        } else {\n            script.onload = callback;\n        }    \n        \n        return script;\n    }\n});\n\n\nExt.ns(\"Ext.grid\", \"Ext.list\", \"Ext.dd\", \"Ext.tree\", \"Ext.form\", \"Ext.menu\",\n       \"Ext.state\", \"Ext.layout.boxOverflow\", \"Ext.app\", \"Ext.ux\", \"Ext.chart\", \"Ext.direct\", \"Ext.slider\");\n    \n\nExt.apply(Ext, function(){\n    var E = Ext,\n        idSeed = 0,\n        scrollWidth = null;\n\n    return {\n        \n        emptyFn : function(){},\n\n        \n        BLANK_IMAGE_URL : Ext.isIE6 || Ext.isIE7 || Ext.isAir ?\n                            'http:/' + '/www.extjs.com/s.gif' :\n                            'data:image/gif;base64,R0lGODlhAQABAID/AMDAwAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==',\n\n        extendX : function(supr, fn){\n            return Ext.extend(supr, fn(supr.prototype));\n        },\n\n        \n        getDoc : function(){\n            return Ext.get(document);\n        },\n\n        \n        num : function(v, defaultValue){\n            v = Number(Ext.isEmpty(v) || Ext.isArray(v) || typeof v == 'boolean' || (typeof v == 'string' && v.trim().length == 0) ? NaN : v);\n            return isNaN(v) ? defaultValue : v;\n        },\n\n        \n        value : function(v, defaultValue, allowBlank){\n            return Ext.isEmpty(v, allowBlank) ? defaultValue : v;\n        },\n\n        \n        escapeRe : function(s) {\n            return s.replace(/([-.*+?^${}()|[\\]\\/\\\\])/g, \"\\\\$1\");\n        },\n\n        sequence : function(o, name, fn, scope){\n            o[name] = o[name].createSequence(fn, scope);\n        },\n\n        \n        addBehaviors : function(o){\n            if(!Ext.isReady){\n                Ext.onReady(function(){\n                    Ext.addBehaviors(o);\n                });\n            } else {\n                var cache = {}, \n                    parts,\n                    b,\n                    s;\n                for (b in o) {\n                    if ((parts = b.split('@'))[1]) { \n                        s = parts[0];\n                        if(!cache[s]){\n                            cache[s] = Ext.select(s);\n                        }\n                        cache[s].on(parts[1], o[b]);\n                    }\n                }\n                cache = null;\n            }\n        },\n\n        \n        getScrollBarWidth: function(force){\n            if(!Ext.isReady){\n                return 0;\n            }\n\n            if(force === true || scrollWidth === null){\n                    \n                var div = Ext.getBody().createChild('<div class=\"x-hide-offsets\" style=\"width:100px;height:50px;overflow:hidden;\"><div style=\"height:200px;\"></div></div>'),\n                    child = div.child('div', true);\n                var w1 = child.offsetWidth;\n                div.setStyle('overflow', (Ext.isWebKit || Ext.isGecko) ? 'auto' : 'scroll');\n                var w2 = child.offsetWidth;\n                div.remove();\n                \n                scrollWidth = w1 - w2 + 2;\n            }\n            return scrollWidth;\n        },\n\n\n        \n        combine : function(){\n            var as = arguments, l = as.length, r = [];\n            for(var i = 0; i < l; i++){\n                var a = as[i];\n                if(Ext.isArray(a)){\n                    r = r.concat(a);\n                }else if(a.length !== undefined && !a.substr){\n                    r = r.concat(Array.prototype.slice.call(a, 0));\n                }else{\n                    r.push(a);\n                }\n            }\n            return r;\n        },\n\n        \n        copyTo : function(dest, source, names){\n            if(typeof names == 'string'){\n                names = names.split(/[,;\\s]/);\n            }\n            Ext.each(names, function(name){\n                if(source.hasOwnProperty(name)){\n                    dest[name] = source[name];\n                }\n            }, this);\n            return dest;\n        },\n\n        \n        destroy : function(){\n            Ext.each(arguments, function(arg){\n                if(arg){\n                    if(Ext.isArray(arg)){\n                        this.destroy.apply(this, arg);\n                    }else if(typeof arg.destroy == 'function'){\n                        arg.destroy();\n                    }else if(arg.dom){\n                        arg.remove();\n                    }\n                }\n            }, this);\n        },\n\n        \n        destroyMembers : function(o, arg1, arg2, etc){\n            for(var i = 1, a = arguments, len = a.length; i < len; i++) {\n                Ext.destroy(o[a[i]]);\n                delete o[a[i]];\n            }\n        },\n\n        \n        clean : function(arr){\n            var ret = [];\n            Ext.each(arr, function(v){\n                if(!!v){\n                    ret.push(v);\n                }\n            });\n            return ret;\n        },\n\n        \n        unique : function(arr){\n            var ret = [],\n                collect = {};\n\n            Ext.each(arr, function(v) {\n                if(!collect[v]){\n                    ret.push(v);\n                }\n                collect[v] = true;\n            });\n            return ret;\n        },\n\n        \n        flatten : function(arr){\n            var worker = [];\n            function rFlatten(a) {\n                Ext.each(a, function(v) {\n                    if(Ext.isArray(v)){\n                        rFlatten(v);\n                    }else{\n                        worker.push(v);\n                    }\n                });\n                return worker;\n            }\n            return rFlatten(arr);\n        },\n\n        \n        min : function(arr, comp){\n            var ret = arr[0];\n            comp = comp || function(a,b){ return a < b ? -1 : 1; };\n            Ext.each(arr, function(v) {\n                ret = comp(ret, v) == -1 ? ret : v;\n            });\n            return ret;\n        },\n\n        \n        max : function(arr, comp){\n            var ret = arr[0];\n            comp = comp || function(a,b){ return a > b ? 1 : -1; };\n            Ext.each(arr, function(v) {\n                ret = comp(ret, v) == 1 ? ret : v;\n            });\n            return ret;\n        },\n\n        \n        mean : function(arr){\n           return arr.length > 0 ? Ext.sum(arr) / arr.length : undefined;\n        },\n\n        \n        sum : function(arr){\n           var ret = 0;\n           Ext.each(arr, function(v) {\n               ret += v;\n           });\n           return ret;\n        },\n\n        \n        partition : function(arr, truth){\n            var ret = [[],[]];\n            Ext.each(arr, function(v, i, a) {\n                ret[ (truth && truth(v, i, a)) || (!truth && v) ? 0 : 1].push(v);\n            });\n            return ret;\n        },\n\n        \n        invoke : function(arr, methodName){\n            var ret = [],\n                args = Array.prototype.slice.call(arguments, 2);\n            Ext.each(arr, function(v,i) {\n                if (v && typeof v[methodName] == 'function') {\n                    ret.push(v[methodName].apply(v, args));\n                } else {\n                    ret.push(undefined);\n                }\n            });\n            return ret;\n        },\n\n        \n        pluck : function(arr, prop){\n            var ret = [];\n            Ext.each(arr, function(v) {\n                ret.push( v[prop] );\n            });\n            return ret;\n        },\n\n        \n        zip : function(){\n            var parts = Ext.partition(arguments, function( val ){ return typeof val != 'function'; }),\n                arrs = parts[0],\n                fn = parts[1][0],\n                len = Ext.max(Ext.pluck(arrs, \"length\")),\n                ret = [];\n\n            for (var i = 0; i < len; i++) {\n                ret[i] = [];\n                if(fn){\n                    ret[i] = fn.apply(fn, Ext.pluck(arrs, i));\n                }else{\n                    for (var j = 0, aLen = arrs.length; j < aLen; j++){\n                        ret[i].push( arrs[j][i] );\n                    }\n                }\n            }\n            return ret;\n        },\n\n        \n        getCmp : function(id){\n            return Ext.ComponentMgr.get(id);\n        },\n\n        \n        useShims: E.isIE6 || (E.isMac && E.isGecko2),\n\n        \n        \n        type : function(o){\n            if(o === undefined || o === null){\n                return false;\n            }\n            if(o.htmlElement){\n                return 'element';\n            }\n            var t = typeof o;\n            if(t == 'object' && o.nodeName) {\n                switch(o.nodeType) {\n                    case 1: return 'element';\n                    case 3: return (/\\S/).test(o.nodeValue) ? 'textnode' : 'whitespace';\n                }\n            }\n            if(t == 'object' || t == 'function') {\n                switch(o.constructor) {\n                    case Array: return 'array';\n                    case RegExp: return 'regexp';\n                    case Date: return 'date';\n                }\n                if(typeof o.length == 'number' && typeof o.item == 'function') {\n                    return 'nodelist';\n                }\n            }\n            return t;\n        },\n\n        intercept : function(o, name, fn, scope){\n            o[name] = o[name].createInterceptor(fn, scope);\n        },\n\n        \n        callback : function(cb, scope, args, delay){\n            if(typeof cb == 'function'){\n                if(delay){\n                    cb.defer(delay, scope, args || []);\n                }else{\n                    cb.apply(scope, args || []);\n                }\n            }\n        }\n    };\n}());\n\n\nExt.apply(Function.prototype, {\n    \n    createSequence : function(fcn, scope){\n        var method = this;\n        return (typeof fcn != 'function') ?\n                this :\n                function(){\n                    var retval = method.apply(this || window, arguments);\n                    fcn.apply(scope || this || window, arguments);\n                    return retval;\n                };\n    }\n});\n\n\n\nExt.applyIf(String, {\n\n    \n    escape : function(string) {\n        return string.replace(/('|\\\\)/g, \"\\\\$1\");\n    },\n\n    \n    leftPad : function (val, size, ch) {\n        var result = String(val);\n        if(!ch) {\n            ch = \" \";\n        }\n        while (result.length < size) {\n            result = ch + result;\n        }\n        return result;\n    }\n});\n\n\nString.prototype.toggle = function(value, other){\n    return this == value ? other : value;\n};\n\n\nString.prototype.trim = function(){\n    var re = /^\\s+|\\s+$/g;\n    return function(){ return this.replace(re, \"\"); };\n}();\n\n\n\nDate.prototype.getElapsed = function(date) {\n    return Math.abs((date || new Date()).getTime()-this.getTime());\n};\n\n\n\nExt.applyIf(Number.prototype, {\n    \n    constrain : function(min, max){\n        return Math.min(Math.max(this, min), max);\n    }\n});\nExt.lib.Dom.getRegion = function(el) {\n    return Ext.lib.Region.getRegion(el);\n};\tExt.lib.Region = function(t, r, b, l) {\n\t\tvar me = this;\n        me.top = t;\n        me[1] = t;\n        me.right = r;\n        me.bottom = b;\n        me.left = l;\n        me[0] = l;\n    };\n\n    Ext.lib.Region.prototype = {\n        contains : function(region) {\n\t        var me = this;\n            return ( region.left >= me.left &&\n                     region.right <= me.right &&\n                     region.top >= me.top &&\n                     region.bottom <= me.bottom );\n\n        },\n\n        getArea : function() {\n\t        var me = this;\n            return ( (me.bottom - me.top) * (me.right - me.left) );\n        },\n\n        intersect : function(region) {\n            var me = this,\n            \tt = Math.max(me.top, region.top),\n            \tr = Math.min(me.right, region.right),\n            \tb = Math.min(me.bottom, region.bottom),\n            \tl = Math.max(me.left, region.left);\n\n            if (b >= t && r >= l) {\n                return new Ext.lib.Region(t, r, b, l);\n            }\n        },\n        \n        union : function(region) {\n\t        var me = this,\n            \tt = Math.min(me.top, region.top),\n            \tr = Math.max(me.right, region.right),\n            \tb = Math.max(me.bottom, region.bottom),\n            \tl = Math.min(me.left, region.left);\n\n            return new Ext.lib.Region(t, r, b, l);\n        },\n\n        constrainTo : function(r) {\n\t        var me = this;\n            me.top = me.top.constrain(r.top, r.bottom);\n            me.bottom = me.bottom.constrain(r.top, r.bottom);\n            me.left = me.left.constrain(r.left, r.right);\n            me.right = me.right.constrain(r.left, r.right);\n            return me;\n        },\n\n        adjust : function(t, l, b, r) {\n\t        var me = this;\n            me.top += t;\n            me.left += l;\n            me.right += r;\n            me.bottom += b;\n            return me;\n        }\n    };\n\n    Ext.lib.Region.getRegion = function(el) {\n        var p = Ext.lib.Dom.getXY(el),\n        \tt = p[1],\n        \tr = p[0] + el.offsetWidth,\n        \tb = p[1] + el.offsetHeight,\n        \tl = p[0];\n\n        return new Ext.lib.Region(t, r, b, l);\n    };\tExt.lib.Point = function(x, y) {\n        if (Ext.isArray(x)) {\n            y = x[1];\n            x = x[0];\n        }\n        var me = this;\n        me.x = me.right = me.left = me[0] = x;\n        me.y = me.top = me.bottom = me[1] = y;\n    };\n\n    Ext.lib.Point.prototype = new Ext.lib.Region();\n\nExt.apply(Ext.DomHelper,\nfunction(){\n    var pub,\n        afterbegin = 'afterbegin',\n        afterend = 'afterend',\n        beforebegin = 'beforebegin',\n        beforeend = 'beforeend',\n        confRe = /tag|children|cn|html$/i;\n\n    \n    function doInsert(el, o, returnElement, pos, sibling, append){\n        el = Ext.getDom(el);\n        var newNode;\n        if (pub.useDom) {\n            newNode = createDom(o, null);\n            if (append) {\n                el.appendChild(newNode);\n            } else {\n                (sibling == 'firstChild' ? el : el.parentNode).insertBefore(newNode, el[sibling] || el);\n            }\n        } else {\n            newNode = Ext.DomHelper.insertHtml(pos, el, Ext.DomHelper.createHtml(o));\n        }\n        return returnElement ? Ext.get(newNode, true) : newNode;\n    }\n\n    \n    \n    function createDom(o, parentNode){\n        var el,\n            doc = document,\n            useSet,\n            attr,\n            val,\n            cn;\n\n        if (Ext.isArray(o)) {                       \n            el = doc.createDocumentFragment(); \n            for (var i = 0, l = o.length; i < l; i++) {\n                createDom(o[i], el);\n            }\n        } else if (typeof o == 'string') {         \n            el = doc.createTextNode(o);\n        } else {\n            el = doc.createElement( o.tag || 'div' );\n            useSet = !!el.setAttribute; \n            for (var attr in o) {\n                if(!confRe.test(attr)){\n                    val = o[attr];\n                    if(attr == 'cls'){\n                        el.className = val;\n                    }else{\n                        if(useSet){\n                            el.setAttribute(attr, val);\n                        }else{\n                            el[attr] = val;\n                        }\n                    }\n                }\n            }\n            Ext.DomHelper.applyStyles(el, o.style);\n\n            if ((cn = o.children || o.cn)) {\n                createDom(cn, el);\n            } else if (o.html) {\n                el.innerHTML = o.html;\n            }\n        }\n        if(parentNode){\n           parentNode.appendChild(el);\n        }\n        return el;\n    }\n\n    pub = {\n        \n        createTemplate : function(o){\n            var html = Ext.DomHelper.createHtml(o);\n            return new Ext.Template(html);\n        },\n\n        \n        useDom : false,\n\n        \n        insertBefore : function(el, o, returnElement){\n            return doInsert(el, o, returnElement, beforebegin);\n        },\n\n        \n        insertAfter : function(el, o, returnElement){\n            return doInsert(el, o, returnElement, afterend, 'nextSibling');\n        },\n\n        \n        insertFirst : function(el, o, returnElement){\n            return doInsert(el, o, returnElement, afterbegin, 'firstChild');\n        },\n\n        \n        append: function(el, o, returnElement){\n            return doInsert(el, o, returnElement, beforeend, '', true);\n        },\n\n        \n        createDom: createDom\n    };\n    return pub;\n}());\n\nExt.apply(Ext.Template.prototype, {\n    \n    disableFormats : false,\n    \n\n    \n    re : /\\{([\\w\\-]+)(?:\\:([\\w\\.]*)(?:\\((.*?)?\\))?)?\\}/g,\n    argsRe : /^\\s*['\"](.*)[\"']\\s*$/,\n    compileARe : /\\\\/g,\n    compileBRe : /(\\r\\n|\\n)/g,\n    compileCRe : /'/g,\n\n    /**\n     * Returns an HTML fragment of this template with the specified values applied.\n     * @param {Object/Array} values The template values. Can be an array if your params are numeric (i.e. {0}) or an object (i.e. {foo: 'bar'})\n     * @return {String} The HTML fragment\n     * @hide repeat doc\n     */\n    applyTemplate : function(values){\n        var me = this,\n            useF = me.disableFormats !== true,\n            fm = Ext.util.Format,\n            tpl = me;\n\n        if(me.compiled){\n            return me.compiled(values);\n        }\n        function fn(m, name, format, args){\n            if (format && useF) {\n                if (format.substr(0, 5) == \"this.\") {\n                    return tpl.call(format.substr(5), values[name], values);\n                } else {\n                    if (args) {\n                        // quoted values are required for strings in compiled templates,\n                        // but for non compiled we need to strip them\n                        // quoted reversed for jsmin\n                        var re = me.argsRe;\n                        args = args.split(',');\n                        for(var i = 0, len = args.length; i < len; i++){\n                            args[i] = args[i].replace(re, \"$1\");\n                        }\n                        args = [values[name]].concat(args);\n                    } else {\n                        args = [values[name]];\n                    }\n                    return fm[format].apply(fm, args);\n                }\n            } else {\n                return values[name] !== undefined ? values[name] : \"\";\n            }\n        }\n        return me.html.replace(me.re, fn);\n    },\n\n    /**\n     * Compiles the template into an internal function, eliminating the RegEx overhead.\n     * @return {Ext.Template} this\n     * @hide repeat doc\n     */\n    compile : function(){\n        var me = this,\n            fm = Ext.util.Format,\n            useF = me.disableFormats !== true,\n            sep = Ext.isGecko ? \"+\" : \",\",\n            body;\n\n        function fn(m, name, format, args){\n            if(format && useF){\n                args = args ? ',' + args : \"\";\n                if(format.substr(0, 5) != \"this.\"){\n                    format = \"fm.\" + format + '(';\n                }else{\n                    format = 'this.call(\"'+ format.substr(5) + '\", ';\n                    args = \", values\";\n                }\n            }else{\n                args= ''; format = \"(values['\" + name + \"'] == undefined ? '' : \";\n            }\n            return \"'\"+ sep + format + \"values['\" + name + \"']\" + args + \")\"+sep+\"'\";\n        }\n\n        // branched to use + in gecko and [].join() in others\n        if(Ext.isGecko){\n            body = \"this.compiled = function(values){ return '\" +\n                   me.html.replace(me.compileARe, '\\\\\\\\').replace(me.compileBRe, '\\\\n').replace(me.compileCRe, \"\\\\'\").replace(me.re, fn) +\n                    \"';};\";\n        }else{\n            body = [\"this.compiled = function(values){ return ['\"];\n            body.push(me.html.replace(me.compileARe, '\\\\\\\\').replace(me.compileBRe, '\\\\n').replace(me.compileCRe, \"\\\\'\").replace(me.re, fn));\n            body.push(\"'].join('');};\");\n            body = body.join('');\n        }\n        eval(body);\n        return me;\n    },\n\n    // private function used to call members\n    call : function(fnName, value, allValues){\n        return this[fnName](value, allValues);\n    }\n});\nExt.Template.prototype.apply = Ext.Template.prototype.applyTemplate;\n/**\n * @class Ext.util.Functions\n * @singleton\n */\nExt.util.Functions = {\n    /**\n     * Creates an interceptor function. The passed function is called before the original one. If it returns false,\n     * the original one is not called. The resulting function returns the results of the original function.\n     * The passed function is called with the parameters of the original function. Example usage:\n     * <pre><code>\nvar sayHi = function(name){\n    alert('Hi, ' + name);\n}\n\nsayHi('Fred'); // alerts \"Hi, Fred\"\n\n// create a new function that validates input without\n// directly modifying the original function:\nvar sayHiToFriend = Ext.createInterceptor(sayHi, function(name){\n    return name == 'Brian';\n});\n\nsayHiToFriend('Fred');  // no alert\nsayHiToFriend('Brian'); // alerts \"Hi, Brian\"\n       </code></pre>\n     * @param {Function} origFn The original function.\n     * @param {Function} newFn The function to call before the original\n     * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the passed function is executed.\n     * <b>If omitted, defaults to the scope in which the original function is called or the browser window.</b>\n     * @return {Function} The new function\n     */\n    createInterceptor: function(origFn, newFn, scope) { \n        var method = origFn;\n        if (!Ext.isFunction(newFn)) {\n            return origFn;\n        }\n        else {\n            return function() {\n                var me = this,\n                    args = arguments;\n                newFn.target = me;\n                newFn.method = origFn;\n                return (newFn.apply(scope || me || window, args) !== false) ?\n                        origFn.apply(me || window, args) :\n                        null;\n            };\n        }\n    },\n\n    /**\n     * Creates a delegate (callback) that sets the scope to obj.\n     * Call directly on any function. Example: <code>Ext.createDelegate(this.myFunction, this, [arg1, arg2])</code>\n     * Will create a function that is automatically scoped to obj so that the <tt>this</tt> variable inside the\n     * callback points to obj. Example usage:\n     * <pre><code>\nvar sayHi = function(name){\n    // Note this use of \"this.text\" here.  This function expects to\n    // execute within a scope that contains a text property.  In this\n    // example, the \"this\" variable is pointing to the btn object that\n    // was passed in createDelegate below.\n    alert('Hi, ' + name + '. You clicked the \"' + this.text + '\" button.');\n}\n\nvar btn = new Ext.Button({\n    text: 'Say Hi',\n    renderTo: Ext.getBody()\n});\n\n// This callback will execute in the scope of the\n// button instance. Clicking the button alerts\n// \"Hi, Fred. You clicked the \"Say Hi\" button.\"\nbtn.on('click', Ext.createDelegate(sayHi, btn, ['Fred']));\n       </code></pre>\n     * @param {Function} fn The function to delegate.\n     * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the function is executed.\n     * <b>If omitted, defaults to the browser window.</b>\n     * @param {Array} args (optional) Overrides arguments for the call. (Defaults to the arguments passed by the caller)\n     * @param {Boolean/Number} appendArgs (optional) if True args are appended to call args instead of overriding,\n     * if a number the args are inserted at the specified position\n     * @return {Function} The new function\n     */\n    createDelegate: function(fn, obj, args, appendArgs) {\n        if (!Ext.isFunction(fn)) {\n            return fn;\n        }\n        return function() {\n            var callArgs = args || arguments;\n            if (appendArgs === true) {\n                callArgs = Array.prototype.slice.call(arguments, 0);\n                callArgs = callArgs.concat(args);\n            }\n            else if (Ext.isNumber(appendArgs)) {\n                callArgs = Array.prototype.slice.call(arguments, 0);\n                // copy arguments first\n                var applyArgs = [appendArgs, 0].concat(args);\n                // create method call params\n                Array.prototype.splice.apply(callArgs, applyArgs);\n                // splice them in\n            }\n            return fn.apply(obj || window, callArgs);\n        };\n    },\n\n    /**\n     * Calls this function after the number of millseconds specified, optionally in a specific scope. Example usage:\n     * <pre><code>\nvar sayHi = function(name){\n    alert('Hi, ' + name);\n}\n\n// executes immediately:\nsayHi('Fred');\n\n// executes after 2 seconds:\nExt.defer(sayHi, 2000, this, ['Fred']);\n\n// this syntax is sometimes useful for deferring\n// execution of an anonymous function:\nExt.defer(function(){\n    alert('Anonymous');\n}, 100);\n       </code></pre>\n     * @param {Function} fn The function to defer.\n     * @param {Number} millis The number of milliseconds for the setTimeout call (if less than or equal to 0 the function is executed immediately)\n     * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the function is executed.\n     * <b>If omitted, defaults to the browser window.</b>\n     * @param {Array} args (optional) Overrides arguments for the call. (Defaults to the arguments passed by the caller)\n     * @param {Boolean/Number} appendArgs (optional) if True args are appended to call args instead of overriding,\n     * if a number the args are inserted at the specified position\n     * @return {Number} The timeout id that can be used with clearTimeout\n     */\n    defer: function(fn, millis, obj, args, appendArgs) {\n        fn = Ext.util.Functions.createDelegate(fn, obj, args, appendArgs);\n        if (millis > 0) {\n            return setTimeout(fn, millis);\n        }\n        fn();\n        return 0;\n    },\n\n\n    /**\n     * Create a combined function call sequence of the original function + the passed function.\n     * The resulting function returns the results of the original function.\n     * The passed fcn is called with the parameters of the original function. Example usage:\n     * \n\nvar sayHi = function(name){\n    alert('Hi, ' + name);\n}\n\nsayHi('Fred'); // alerts \"Hi, Fred\"\n\nvar sayGoodbye = Ext.createSequence(sayHi, function(name){\n    alert('Bye, ' + name);\n});\n\nsayGoodbye('Fred'); // both alerts show\n\n     * @param {Function} origFn The original function.\n     * @param {Function} newFn The function to sequence\n     * @param {Object} scope (optional) The scope (this reference) in which the passed function is executed.\n     * If omitted, defaults to the scope in which the original function is called or the browser window.\n     * @return {Function} The new function\n     */\n    createSequence: function(origFn, newFn, scope) {\n        if (!Ext.isFunction(newFn)) {\n            return origFn;\n        }\n        else {\n            return function() {\n                var retval = origFn.apply(this || window, arguments);\n                newFn.apply(scope || this || window, arguments);\n                return retval;\n            };\n        }\n    }\n};\n\n/**\n * Shorthand for {@link Ext.util.Functions#defer}   \n * @param {Function} fn The function to defer.\n * @param {Number} millis The number of milliseconds for the setTimeout call (if less than or equal to 0 the function is executed immediately)\n * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the function is executed.\n * <b>If omitted, defaults to the browser window.</b>\n * @param {Array} args (optional) Overrides arguments for the call. (Defaults to the arguments passed by the caller)\n * @param {Boolean/Number} appendArgs (optional) if True args are appended to call args instead of overriding,\n * if a number the args are inserted at the specified position\n * @return {Number} The timeout id that can be used with clearTimeout\n * @member Ext\n * @method defer\n */\n\nExt.defer = Ext.util.Functions.defer;\n\n/**\n * Shorthand for {@link Ext.util.Functions#createInterceptor}   \n * @param {Function} origFn The original function.\n * @param {Function} newFn The function to call before the original\n * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the passed function is executed.\n * <b>If omitted, defaults to the scope in which the original function is called or the browser window.</b>\n * @return {Function} The new function\n * @member Ext\n * @method createInterceptor\n */\n\nExt.createInterceptor = Ext.util.Functions.createInterceptor;\n\n/**\n * Shorthand for {@link Ext.util.Functions#createSequence}\n * @param {Function} origFn The original function.\n * @param {Function} newFn The function to sequence\n * @param {Object} scope (optional) The scope (this reference) in which the passed function is executed.\n * If omitted, defaults to the scope in which the original function is called or the browser window.\n * @return {Function} The new function\n * @member Ext\n * @method createSequence\n */\n\nExt.createSequence = Ext.util.Functions.createSequence;\n\n/**\n * Shorthand for {@link Ext.util.Functions#createDelegate}\n * @param {Function} fn The function to delegate.\n * @param {Object} scope (optional) The scope (<code><b>this</b></code> reference) in which the function is executed.\n * <b>If omitted, defaults to the browser window.</b>\n * @param {Array} args (optional) Overrides arguments for the call. (Defaults to the arguments passed by the caller)\n * @param {Boolean/Number} appendArgs (optional) if True args are appended to call args instead of overriding,\n * if a number the args are inserted at the specified position\n * @return {Function} The new function\n * @member Ext\n * @method createDelegate\n */\nExt.createDelegate = Ext.util.Functions.createDelegate;\n/**\n * @class Ext.util.Observable\n */\nExt.apply(Ext.util.Observable.prototype, function(){\n    // this is considered experimental (along with beforeMethod, afterMethod, removeMethodListener?)\n    // allows for easier interceptor and sequences, including cancelling and overwriting the return value of the call\n    // private\n    function getMethodEvent(method){\n        var e = (this.methodEvents = this.methodEvents ||\n        {})[method], returnValue, v, cancel, obj = this;\n\n        if (!e) {\n            this.methodEvents[method] = e = {};\n            e.originalFn = this[method];\n            e.methodName = method;\n            e.before = [];\n            e.after = [];\n\n            var makeCall = function(fn, scope, args){\n                if((v = fn.apply(scope || obj, args)) !== undefined){\n                    if (typeof v == 'object') {\n                        if(v.returnValue !== undefined){\n                            returnValue = v.returnValue;\n                        }else{\n                            returnValue = v;\n                        }\n                        cancel = !!v.cancel;\n                    }\n                    else\n                        if (v === false) {\n                            cancel = true;\n                        }\n                        else {\n                            returnValue = v;\n                        }\n                }\n            };\n\n            this[method] = function(){\n                var args = Array.prototype.slice.call(arguments, 0),\n                    b;\n                returnValue = v = undefined;\n                cancel = false;\n\n                for(var i = 0, len = e.before.length; i < len; i++){\n                    b = e.before[i];\n                    makeCall(b.fn, b.scope, args);\n                    if (cancel) {\n                        return returnValue;\n                    }\n                }\n\n                if((v = e.originalFn.apply(obj, args)) !== undefined){\n                    returnValue = v;\n                }\n\n                for(var i = 0, len = e.after.length; i < len; i++){\n                    b = e.after[i];\n                    makeCall(b.fn, b.scope, args);\n                    if (cancel) {\n                        return returnValue;\n                    }\n                }\n                return returnValue;\n            };\n        }\n        return e;\n    }\n\n    return {\n        // these are considered experimental\n        // allows for easier interceptor and sequences, including cancelling and overwriting the return value of the call\n        // adds an 'interceptor' called before the original method\n        beforeMethod : function(method, fn, scope){\n            getMethodEvent.call(this, method).before.push({\n                fn: fn,\n                scope: scope\n            });\n        },\n\n        // adds a 'sequence' called after the original method\n        afterMethod : function(method, fn, scope){\n            getMethodEvent.call(this, method).after.push({\n                fn: fn,\n                scope: scope\n            });\n        },\n\n        removeMethodListener: function(method, fn, scope){\n            var e = this.getMethodEvent(method);\n            for(var i = 0, len = e.before.length; i < len; i++){\n                if(e.before[i].fn == fn && e.before[i].scope == scope){\n                    e.before.splice(i, 1);\n                    return;\n                }\n            }\n            for(var i = 0, len = e.after.length; i < len; i++){\n                if(e.after[i].fn == fn && e.after[i].scope == scope){\n                    e.after.splice(i, 1);\n                    return;\n                }\n            }\n        },\n\n        /**\n         * Relays selected events from the specified Observable as if the events were fired by <tt><b>this</b></tt>.\n         * @param {Object} o The Observable whose events this object is to relay.\n         * @param {Array} events Array of event names to relay.\n         */\n        relayEvents : function(o, events){\n            var me = this;\n            function createHandler(ename){\n                return function(){\n                    return me.fireEvent.apply(me, [ename].concat(Array.prototype.slice.call(arguments, 0)));\n                };\n            }\n            for(var i = 0, len = events.length; i < len; i++){\n                var ename = events[i];\n                me.events[ename] = me.events[ename] || true;\n                o.on(ename, createHandler(ename), me);\n            }\n        },\n\n        /**\n         * <p>Enables events fired by this Observable to bubble up an owner hierarchy by calling\n         * <code>this.getBubbleTarget()</code> if present. There is no implementation in the Observable base class.</p>\n         * <p>This is commonly used by Ext.Components to bubble events to owner Containers. See {@link Ext.Component.getBubbleTarget}. The default\n         * implementation in Ext.Component returns the Component's immediate owner. But if a known target is required, this can be overridden to\n         * access the required target more quickly.</p>\n         * <p>Example:</p><pre><code>\nExt.override(Ext.form.Field, {\n    \n    initComponent : Ext.form.Field.prototype.initComponent.createSequence(function() {\n        this.enableBubble('change');\n    }),\n\n    \n    getBubbleTarget : function() {\n        if (!this.formPanel) {\n            this.formPanel = this.findParentByType('form');\n        }\n        return this.formPanel;\n    }\n});\n\nvar myForm = new Ext.formPanel({\n    title: 'User Details',\n    items: [{\n        ...\n    }],\n    listeners: {\n        change: function() {\n            \n            myForm.header.setStyle('color', 'red');\n        }\n    }\n});\n</code></pre>\n         * @param {String/Array} events The event name to bubble, or an Array of event names.\n         */\n        enableBubble : function(events){\n            var me = this;\n            if(!Ext.isEmpty(events)){\n                events = Ext.isArray(events) ? events : Array.prototype.slice.call(arguments, 0);\n                for(var i = 0, len = events.length; i < len; i++){\n                    var ename = events[i];\n                    ename = ename.toLowerCase();\n                    var ce = me.events[ename] || true;\n                    if (typeof ce == 'boolean') {\n                        ce = new Ext.util.Event(me, ename);\n                        me.events[ename] = ce;\n                    }\n                    ce.bubble = true;\n                }\n            }\n        }\n    };\n}());\n\n\n\nExt.util.Observable.capture = function(o, fn, scope){\n    o.fireEvent = o.fireEvent.createInterceptor(fn, scope);\n};\n\n\n\nExt.util.Observable.observeClass = function(c, listeners){\n    if(c){\n      if(!c.fireEvent){\n          Ext.apply(c, new Ext.util.Observable());\n          Ext.util.Observable.capture(c.prototype, c.fireEvent, c);\n      }\n      if(typeof listeners == 'object'){\n          c.on(listeners);\n      }\n      return c;\n   }\n};\n\nExt.apply(Ext.EventManager, function(){\n   var resizeEvent,\n       resizeTask,\n       textEvent,\n       textSize,\n       D = Ext.lib.Dom,\n       propRe = /^(?:scope|delay|buffer|single|stopEvent|preventDefault|stopPropagation|normalized|args|delegate)$/,\n       unload = Ext.EventManager._unload,\n       curWidth = 0,\n       curHeight = 0,\n       \n       \n       \n       useKeydown = Ext.isWebKit ?\n                   Ext.num(navigator.userAgent.match(/AppleWebKit\\/(\\d+)/)[1]) >= 525 :\n                   !((Ext.isGecko && !Ext.isWindows) || Ext.isOpera);\n\n   return {\n       _unload: function(){\n           Ext.EventManager.un(window, \"resize\", this.fireWindowResize, this);\n           unload.call(Ext.EventManager);    \n       },\n       \n       \n       doResizeEvent: function(){\n           var h = D.getViewHeight(),\n               w = D.getViewWidth();\n\n            \n            if(curHeight != h || curWidth != w){\n               resizeEvent.fire(curWidth = w, curHeight = h);\n            }\n       },\n\n       \n       onWindowResize : function(fn, scope, options){\n           if(!resizeEvent){\n               resizeEvent = new Ext.util.Event();\n               resizeTask = new Ext.util.DelayedTask(this.doResizeEvent);\n               Ext.EventManager.on(window, \"resize\", this.fireWindowResize, this);\n           }\n           resizeEvent.addListener(fn, scope, options);\n       },\n\n       \n       fireWindowResize : function(){\n           if(resizeEvent){\n               resizeTask.delay(100);\n           }\n       },\n\n       \n       onTextResize : function(fn, scope, options){\n           if(!textEvent){\n               textEvent = new Ext.util.Event();\n               var textEl = new Ext.Element(document.createElement('div'));\n               textEl.dom.className = 'x-text-resize';\n               textEl.dom.innerHTML = 'X';\n               textEl.appendTo(document.body);\n               textSize = textEl.dom.offsetHeight;\n               setInterval(function(){\n                   if(textEl.dom.offsetHeight != textSize){\n                       textEvent.fire(textSize, textSize = textEl.dom.offsetHeight);\n                   }\n               }, this.textResizeInterval);\n           }\n           textEvent.addListener(fn, scope, options);\n       },\n\n       \n       removeResizeListener : function(fn, scope){\n           if(resizeEvent){\n               resizeEvent.removeListener(fn, scope);\n           }\n       },\n\n       \n       fireResize : function(){\n           if(resizeEvent){\n               resizeEvent.fire(D.getViewWidth(), D.getViewHeight());\n           }\n       },\n\n        \n       textResizeInterval : 50,\n\n       \n       ieDeferSrc : false,\n       \n       \n       getKeyEvent : function(){\n           return useKeydown ? 'keydown' : 'keypress';\n       },\n\n       \n       \n       useKeydown: useKeydown\n   };\n}());\n\nExt.EventManager.on = Ext.EventManager.addListener;\n\n\nExt.apply(Ext.EventObjectImpl.prototype, {\n   \n   BACKSPACE: 8,\n   \n   TAB: 9,\n   \n   NUM_CENTER: 12,\n   \n   ENTER: 13,\n   \n   RETURN: 13,\n   \n   SHIFT: 16,\n   \n   CTRL: 17,\n   CONTROL : 17, \n   \n   ALT: 18,\n   \n   PAUSE: 19,\n   \n   CAPS_LOCK: 20,\n   \n   ESC: 27,\n   \n   SPACE: 32,\n   \n   PAGE_UP: 33,\n   PAGEUP : 33, \n   \n   PAGE_DOWN: 34,\n   PAGEDOWN : 34, \n   \n   END: 35,\n   \n   HOME: 36,\n   \n   LEFT: 37,\n   \n   UP: 38,\n   \n   RIGHT: 39,\n   \n   DOWN: 40,\n   \n   PRINT_SCREEN: 44,\n   \n   INSERT: 45,\n   \n   DELETE: 46,\n   \n   ZERO: 48,\n   \n   ONE: 49,\n   \n   TWO: 50,\n   \n   THREE: 51,\n   \n   FOUR: 52,\n   \n   FIVE: 53,\n   \n   SIX: 54,\n   \n   SEVEN: 55,\n   \n   EIGHT: 56,\n   \n   NINE: 57,\n   \n   A: 65,\n   \n   B: 66,\n   \n   C: 67,\n   \n   D: 68,\n   \n   E: 69,\n   \n   F: 70,\n   \n   G: 71,\n   \n   H: 72,\n   \n   I: 73,\n   \n   J: 74,\n   \n   K: 75,\n   \n   L: 76,\n   \n   M: 77,\n   \n   N: 78,\n   \n   O: 79,\n   \n   P: 80,\n   \n   Q: 81,\n   \n   R: 82,\n   \n   S: 83,\n   \n   T: 84,\n   \n   U: 85,\n   \n   V: 86,\n   \n   W: 87,\n   \n   X: 88,\n   \n   Y: 89,\n   \n   Z: 90,\n   \n   CONTEXT_MENU: 93,\n   \n   NUM_ZERO: 96,\n   \n   NUM_ONE: 97,\n   \n   NUM_TWO: 98,\n   \n   NUM_THREE: 99,\n   \n   NUM_FOUR: 100,\n   \n   NUM_FIVE: 101,\n   \n   NUM_SIX: 102,\n   \n   NUM_SEVEN: 103,\n   \n   NUM_EIGHT: 104,\n   \n   NUM_NINE: 105,\n   \n   NUM_MULTIPLY: 106,\n   \n   NUM_PLUS: 107,\n   \n   NUM_MINUS: 109,\n   \n   NUM_PERIOD: 110,\n   \n   NUM_DIVISION: 111,\n   \n   F1: 112,\n   \n   F2: 113,\n   \n   F3: 114,\n   \n   F4: 115,\n   \n   F5: 116,\n   \n   F6: 117,\n   \n   F7: 118,\n   \n   F8: 119,\n   \n   F9: 120,\n   \n   F10: 121,\n   \n   F11: 122,\n   \n   F12: 123,\n\n   \n   isNavKeyPress : function(){\n       var me = this,\n           k = this.normalizeKey(me.keyCode);\n       return (k >= 33 && k <= 40) ||  \n       k == me.RETURN ||\n       k == me.TAB ||\n       k == me.ESC;\n   },\n\n   isSpecialKey : function(){\n       var k = this.normalizeKey(this.keyCode);\n       return (this.type == 'keypress' && this.ctrlKey) ||\n       this.isNavKeyPress() ||\n       (k == this.BACKSPACE) || \n       (k >= 16 && k <= 20) || \n       (k >= 44 && k <= 46);   \n   },\n\n   getPoint : function(){\n       return new Ext.lib.Point(this.xy[0], this.xy[1]);\n   },\n\n   \n   hasModifier : function(){\n       return ((this.ctrlKey || this.altKey) || this.shiftKey);\n   }\n});\nExt.Element.addMethods({\n    \n    swallowEvent : function(eventName, preventDefault) {\n        var me = this;\n        function fn(e) {\n            e.stopPropagation();\n            if (preventDefault) {\n                e.preventDefault();\n            }\n        }\n        \n        if (Ext.isArray(eventName)) {\n            Ext.each(eventName, function(e) {\n                 me.on(e, fn);\n            });\n            return me;\n        }\n        me.on(eventName, fn);\n        return me;\n    },\n\n    \n    relayEvent : function(eventName, observable) {\n        this.on(eventName, function(e) {\n            observable.fireEvent(eventName, e);\n        });\n    },\n\n    \n    clean : function(forceReclean) {\n        var me  = this,\n            dom = me.dom,\n            n   = dom.firstChild,\n            ni  = -1;\n\n        if (Ext.Element.data(dom, 'isCleaned') && forceReclean !== true) {\n            return me;\n        }\n\n        while (n) {\n            var nx = n.nextSibling;\n            if (n.nodeType == 3 && !(/\\S/.test(n.nodeValue))) {\n                dom.removeChild(n);\n            } else {\n                n.nodeIndex = ++ni;\n            }\n            n = nx;\n        }\n        \n        Ext.Element.data(dom, 'isCleaned', true);\n        return me;\n    },\n\n    \n    load : function() {\n        var updateManager = this.getUpdater();\n        updateManager.update.apply(updateManager, arguments);\n        \n        return this;\n    },\n\n    \n    getUpdater : function() {\n        return this.updateManager || (this.updateManager = new Ext.Updater(this));\n    },\n\n    \n    update : function(html, loadScripts, callback) {\n        if (!this.dom) {\n            return this;\n        }\n        html = html || \"\";\n\n        if (loadScripts !== true) {\n            this.dom.innerHTML = html;\n            if (typeof callback == 'function') {\n                callback();\n            }\n            return this;\n        }\n\n        var id  = Ext.id(),\n            dom = this.dom;\n\n        html += '<span id=\"' + id + '\"></span>';\n\n        Ext.lib.Event.onAvailable(id, function() {\n            var DOC    = document,\n                hd     = DOC.getElementsByTagName(\"head\")[0],\n                re     = /(?:<script([^>]*)?>)((\\n|\\r|.)*?)(?:<\\/script>)/ig,\n                srcRe  = /\\ssrc=([\\'\\\"])(.*?)\\1/i,\n                typeRe = /\\stype=([\\'\\\"])(.*?)\\1/i,\n                match,\n                attrs,\n                srcMatch,\n                typeMatch,\n                el,\n                s;\n\n            while ((match = re.exec(html))) {\n                attrs = match[1];\n                srcMatch = attrs ? attrs.match(srcRe) : false;\n                if (srcMatch && srcMatch[2]) {\n                   s = DOC.createElement(\"script\");\n                   s.src = srcMatch[2];\n                   typeMatch = attrs.match(typeRe);\n                   if (typeMatch && typeMatch[2]) {\n                       s.type = typeMatch[2];\n                   }\n                   hd.appendChild(s);\n                } else if (match[2] && match[2].length > 0) {\n                    if (window.execScript) {\n                       window.execScript(match[2]);\n                    } else {\n                       window.eval(match[2]);\n                    }\n                }\n            }\n            \n            el = DOC.getElementById(id);\n            if (el) {\n                Ext.removeNode(el);\n            }\n            \n            if (typeof callback == 'function') {\n                callback();\n            }\n        });\n        dom.innerHTML = html.replace(/(?:<script.*?>)((\\n|\\r|.)*?)(?:<\\/script>)/ig, \"\");\n        return this;\n    },\n\n    \n    removeAllListeners : function() {\n        this.removeAnchor();\n        Ext.EventManager.removeAll(this.dom);\n        return this;\n    },\n\n    \n    createProxy : function(config, renderTo, matchBox) {\n        config = (typeof config == 'object') ? config : {tag : \"div\", cls: config};\n\n        var me = this,\n            proxy = renderTo ? Ext.DomHelper.append(renderTo, config, true) :\n                               Ext.DomHelper.insertBefore(me.dom, config, true);\n\n        if (matchBox && me.setBox && me.getBox) { \n           proxy.setBox(me.getBox());\n        }\n        return proxy;\n    }\n});\n\nExt.Element.prototype.getUpdateManager = Ext.Element.prototype.getUpdater;\n\nExt.Element.addMethods({\n    \n    getAnchorXY : function(anchor, local, s){\n        \n        \n\t\tanchor = (anchor || \"tl\").toLowerCase();\n        s = s || {};\n        \n        var me = this,        \n        \tvp = me.dom == document.body || me.dom == document,\n        \tw = s.width || vp ? Ext.lib.Dom.getViewWidth() : me.getWidth(),\n        \th = s.height || vp ? Ext.lib.Dom.getViewHeight() : me.getHeight(),         \t        \t\n        \txy,       \t\n        \tr = Math.round,\n        \to = me.getXY(),\n        \tscroll = me.getScroll(),\n        \textraX = vp ? scroll.left : !local ? o[0] : 0,\n        \textraY = vp ? scroll.top : !local ? o[1] : 0,\n        \thash = {\n\t        \tc  : [r(w * 0.5), r(h * 0.5)],\n\t        \tt  : [r(w * 0.5), 0],\n\t        \tl  : [0, r(h * 0.5)],\n\t        \tr  : [w, r(h * 0.5)],\n\t        \tb  : [r(w * 0.5), h],\n\t        \ttl : [0, 0],\t\n\t        \tbl : [0, h],\n\t        \tbr : [w, h],\n\t        \ttr : [w, 0]\n        \t};\n        \n        xy = hash[anchor];\t\n        return [xy[0] + extraX, xy[1] + extraY]; \n    },\n\n    \n    anchorTo : function(el, alignment, offsets, animate, monitorScroll, callback){        \n\t    var me = this,\n            dom = me.dom,\n            scroll = !Ext.isEmpty(monitorScroll),\n            action = function(){\n                Ext.fly(dom).alignTo(el, alignment, offsets, animate);\n                Ext.callback(callback, Ext.fly(dom));\n            },\n            anchor = this.getAnchor();\n            \n        \n        this.removeAnchor();\n        Ext.apply(anchor, {\n            fn: action,\n            scroll: scroll\n        });\n\n        Ext.EventManager.onWindowResize(action, null);\n        \n        if(scroll){\n            Ext.EventManager.on(window, 'scroll', action, null,\n                {buffer: !isNaN(monitorScroll) ? monitorScroll : 50});\n        }\n        action.call(me); \n        return me;\n    },\n    \n    \n    removeAnchor : function(){\n        var me = this,\n            anchor = this.getAnchor();\n            \n        if(anchor && anchor.fn){\n            Ext.EventManager.removeResizeListener(anchor.fn);\n            if(anchor.scroll){\n                Ext.EventManager.un(window, 'scroll', anchor.fn);\n            }\n            delete anchor.fn;\n        }\n        return me;\n    },\n    \n    \n    getAnchor : function(){\n        var data = Ext.Element.data,\n            dom = this.dom;\n            if (!dom) {\n                return;\n            }\n            var anchor = data(dom, '_anchor');\n            \n        if(!anchor){\n            anchor = data(dom, '_anchor', {});\n        }\n        return anchor;\n    },\n\n    \n    getAlignToXY : function(el, p, o){\t    \n        el = Ext.get(el);\n        \n        if(!el || !el.dom){\n            throw \"Element.alignToXY with an element that doesn't exist\";\n        }\n        \n        o = o || [0,0];\n        p = (!p || p == \"?\" ? \"tl-bl?\" : (!(/-/).test(p) && p !== \"\" ? \"tl-\" + p : p || \"tl-bl\")).toLowerCase();       \n                \n        var me = this,\n        \td = me.dom,\n        \ta1,\n        \ta2,\n        \tx,\n        \ty,\n        \t\n        \tw,\n        \th,\n        \tr,\n        \tdw = Ext.lib.Dom.getViewWidth() -10, \n        \tdh = Ext.lib.Dom.getViewHeight()-10, \n        \tp1y,\n        \tp1x,        \t\n        \tp2y,\n        \tp2x,\n        \tswapY,\n        \tswapX,\n        \tdoc = document,\n        \tdocElement = doc.documentElement,\n        \tdocBody = doc.body,\n        \tscrollX = (docElement.scrollLeft || docBody.scrollLeft || 0)+5,\n        \tscrollY = (docElement.scrollTop || docBody.scrollTop || 0)+5,\n        \tc = false, \n        \tp1 = \"\", \n        \tp2 = \"\",\n        \tm = p.match(/^([a-z]+)-([a-z]+)(\\?)?$/);\n        \n        if(!m){\n           throw \"Element.alignTo with an invalid alignment \" + p;\n        }\n        \n        p1 = m[1]; \n        p2 = m[2]; \n        c = !!m[3];\n\n        \n        \n        a1 = me.getAnchorXY(p1, true);\n        a2 = el.getAnchorXY(p2, false);\n\n        x = a2[0] - a1[0] + o[0];\n        y = a2[1] - a1[1] + o[1];\n\n        if(c){    \n\t       w = me.getWidth();\n           h = me.getHeight();\n           r = el.getRegion();       \n           \n           \n           \n           p1y = p1.charAt(0);\n           p1x = p1.charAt(p1.length-1);\n           p2y = p2.charAt(0);\n           p2x = p2.charAt(p2.length-1);\n           swapY = ((p1y==\"t\" && p2y==\"b\") || (p1y==\"b\" && p2y==\"t\"));\n           swapX = ((p1x==\"r\" && p2x==\"l\") || (p1x==\"l\" && p2x==\"r\"));          \n           \n\n           if (x + w > dw + scrollX) {\n                x = swapX ? r.left-w : dw+scrollX-w;\n           }\n           if (x < scrollX) {\n               x = swapX ? r.right : scrollX;\n           }\n           if (y + h > dh + scrollY) {\n                y = swapY ? r.top-h : dh+scrollY-h;\n            }\n           if (y < scrollY){\n               y = swapY ? r.bottom : scrollY;\n           }\n        }\n        return [x,y];\n    },\n\n    \n    alignTo : function(element, position, offsets, animate){\n\t    var me = this;\n        return me.setXY(me.getAlignToXY(element, position, offsets),\n          \t\t        me.preanim && !!animate ? me.preanim(arguments, 3) : false);\n    },\n    \n    \n    adjustForConstraints : function(xy, parent, offsets){\n        return this.getConstrainToXY(parent || document, false, offsets, xy) ||  xy;\n    },\n\n    \n    getConstrainToXY : function(el, local, offsets, proposedXY){   \n\t    var os = {top:0, left:0, bottom:0, right: 0};\n\n        return function(el, local, offsets, proposedXY){\n            el = Ext.get(el);\n            offsets = offsets ? Ext.applyIf(offsets, os) : os;\n\n            var vw, vh, vx = 0, vy = 0;\n            if(el.dom == document.body || el.dom == document){\n                vw =Ext.lib.Dom.getViewWidth();\n                vh = Ext.lib.Dom.getViewHeight();\n            }else{\n                vw = el.dom.clientWidth;\n                vh = el.dom.clientHeight;\n                if(!local){\n                    var vxy = el.getXY();\n                    vx = vxy[0];\n                    vy = vxy[1];\n                }\n            }\n\n            var s = el.getScroll();\n\n            vx += offsets.left + s.left;\n            vy += offsets.top + s.top;\n\n            vw -= offsets.right;\n            vh -= offsets.bottom;\n\n            var vr = vx + vw,\n                vb = vy + vh,\n                xy = proposedXY || (!local ? this.getXY() : [this.getLeft(true), this.getTop(true)]),\n                x = xy[0], y = xy[1],\n                offset = this.getConstrainOffset(),\n                w = this.dom.offsetWidth + offset, \n                h = this.dom.offsetHeight + offset;\n\n            \n            var moved = false;\n\n            \n            if((x + w) > vr){\n                x = vr - w;\n                moved = true;\n            }\n            if((y + h) > vb){\n                y = vb - h;\n                moved = true;\n            }\n            \n            if(x < vx){\n                x = vx;\n                moved = true;\n            }\n            if(y < vy){\n                y = vy;\n                moved = true;\n            }\n            return moved ? [x, y] : false;\n        };\n    }(),\n\t    \n\t    \n\t        \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n    \n    getConstrainOffset : function(){\n        return 0;\n    },\n    \n    \n    getCenterXY : function(){\n        return this.getAlignToXY(document, 'c-c');\n    },\n\n    \n    center : function(centerIn){\n        return this.alignTo(centerIn || document, 'c-c');        \n    }    \n});\n\nExt.Element.addMethods({\n    \n    select : function(selector, unique){\n        return Ext.Element.select(selector, unique, this.dom);\n    }\n});\nExt.apply(Ext.Element.prototype, function() {\n\tvar GETDOM = Ext.getDom,\n\t\tGET = Ext.get,\n\t\tDH = Ext.DomHelper;\n\t\n\treturn {\t\n\t\t\n\t    insertSibling: function(el, where, returnDom){\n\t        var me = this,\n\t        \trt,\n                isAfter = (where || 'before').toLowerCase() == 'after',\n                insertEl;\n\t        \t\n\t        if(Ext.isArray(el)){\n                insertEl = me;\n\t            Ext.each(el, function(e) {\n\t\t            rt = Ext.fly(insertEl, '_internal').insertSibling(e, where, returnDom);\n                    if(isAfter){\n                        insertEl = rt;\n                    }\n\t            });\n\t            return rt;\n\t        }\n\t                \n\t        el = el || {};\n\t       \t\n            if(el.nodeType || el.dom){\n                rt = me.dom.parentNode.insertBefore(GETDOM(el), isAfter ? me.dom.nextSibling : me.dom);\n                if (!returnDom) {\n                    rt = GET(rt);\n                }\n            }else{\n                if (isAfter && !me.dom.nextSibling) {\n                    rt = DH.append(me.dom.parentNode, el, !returnDom);\n                } else {                    \n                    rt = DH[isAfter ? 'insertAfter' : 'insertBefore'](me.dom, el, !returnDom);\n                }\n            }\n\t        return rt;\n\t    }\n    };\n}());\n\n\nExt.Element.boxMarkup = '<div class=\"{0}-tl\"><div class=\"{0}-tr\"><div class=\"{0}-tc\"></div></div></div><div class=\"{0}-ml\"><div class=\"{0}-mr\"><div class=\"{0}-mc\"></div></div></div><div class=\"{0}-bl\"><div class=\"{0}-br\"><div class=\"{0}-bc\"></div></div></div>';\n\nExt.Element.addMethods(function(){\n    var INTERNAL = \"_internal\",\n        pxMatch = /(\\d+\\.?\\d+)px/;\n    return {\n        \n        applyStyles : function(style){\n            Ext.DomHelper.applyStyles(this.dom, style);\n            return this;\n        },\n\n        \n        getStyles : function(){\n            var ret = {};\n            Ext.each(arguments, function(v) {\n               ret[v] = this.getStyle(v);\n            },\n            this);\n            return ret;\n        },\n\n        \n        setOverflow : function(v){\n            var dom = this.dom;\n            if(v=='auto' && Ext.isMac && Ext.isGecko2){ \n                dom.style.overflow = 'hidden';\n                (function(){dom.style.overflow = 'auto';}).defer(1);\n            }else{\n                dom.style.overflow = v;\n            }\n        },\n\n       \n        boxWrap : function(cls){\n            cls = cls || 'x-box';\n            var el = Ext.get(this.insertHtml(\"beforeBegin\", \"<div class='\" + cls + \"'>\" + String.format(Ext.Element.boxMarkup, cls) + \"</div>\"));        \n            Ext.DomQuery.selectNode('.' + cls + '-mc', el.dom).appendChild(this.dom);\n            return el;\n        },\n\n        \n        setSize : function(width, height, animate){\n            var me = this;\n            if(typeof width == 'object'){ \n                height = width.height;\n                width = width.width;\n            }\n            width = me.adjustWidth(width);\n            height = me.adjustHeight(height);\n            if(!animate || !me.anim){\n                me.dom.style.width = me.addUnits(width);\n                me.dom.style.height = me.addUnits(height);\n            }else{\n                me.anim({width: {to: width}, height: {to: height}}, me.preanim(arguments, 2));\n            }\n            return me;\n        },\n\n        \n        getComputedHeight : function(){\n            var me = this,\n                h = Math.max(me.dom.offsetHeight, me.dom.clientHeight);\n            if(!h){\n                h = parseFloat(me.getStyle('height')) || 0;\n                if(!me.isBorderBox()){\n                    h += me.getFrameWidth('tb');\n                }\n            }\n            return h;\n        },\n\n        \n        getComputedWidth : function(){\n            var w = Math.max(this.dom.offsetWidth, this.dom.clientWidth);\n            if(!w){\n                w = parseFloat(this.getStyle('width')) || 0;\n                if(!this.isBorderBox()){\n                    w += this.getFrameWidth('lr');\n                }\n            }\n            return w;\n        },\n\n        \n        getFrameWidth : function(sides, onlyContentBox){\n            return onlyContentBox && this.isBorderBox() ? 0 : (this.getPadding(sides) + this.getBorderWidth(sides));\n        },\n\n        \n        addClassOnOver : function(className){\n            this.hover(\n                function(){\n                    Ext.fly(this, INTERNAL).addClass(className);\n                },\n                function(){\n                    Ext.fly(this, INTERNAL).removeClass(className);\n                }\n            );\n            return this;\n        },\n\n        \n        addClassOnFocus : function(className){\n            this.on(\"focus\", function(){\n                Ext.fly(this, INTERNAL).addClass(className);\n            }, this.dom);\n            this.on(\"blur\", function(){\n                Ext.fly(this, INTERNAL).removeClass(className);\n            }, this.dom);\n            return this;\n        },\n\n        \n        addClassOnClick : function(className){\n            var dom = this.dom;\n            this.on(\"mousedown\", function(){\n                Ext.fly(dom, INTERNAL).addClass(className);\n                var d = Ext.getDoc(),\n                    fn = function(){\n                        Ext.fly(dom, INTERNAL).removeClass(className);\n                        d.removeListener(\"mouseup\", fn);\n                    };\n                d.on(\"mouseup\", fn);\n            });\n            return this;\n        },\n\n        \n\n        getViewSize : function(){\n            var doc = document,\n                d = this.dom,\n                isDoc = (d == doc || d == doc.body);\n\n            \n            if (isDoc) {\n                var extdom = Ext.lib.Dom;\n                return {\n                    width : extdom.getViewWidth(),\n                    height : extdom.getViewHeight()\n                };\n\n            \n            } else {\n                return {\n                    width : d.clientWidth,\n                    height : d.clientHeight\n                };\n            }\n        },\n\n        \n\n        getStyleSize : function(){\n            var me = this,\n                w, h,\n                doc = document,\n                d = this.dom,\n                isDoc = (d == doc || d == doc.body),\n                s = d.style;\n\n            \n            if (isDoc) {\n                var extdom = Ext.lib.Dom;\n                return {\n                    width : extdom.getViewWidth(),\n                    height : extdom.getViewHeight()\n                };\n            }\n            \n            if(s.width && s.width != 'auto'){\n                w = parseFloat(s.width);\n                if(me.isBorderBox()){\n                   w -= me.getFrameWidth('lr');\n                }\n            }\n            \n            if(s.height && s.height != 'auto'){\n                h = parseFloat(s.height);\n                if(me.isBorderBox()){\n                   h -= me.getFrameWidth('tb');\n                }\n            }\n            \n            return {width: w || me.getWidth(true), height: h || me.getHeight(true)};\n        },\n\n        \n        getSize : function(contentSize){\n            return {width: this.getWidth(contentSize), height: this.getHeight(contentSize)};\n        },\n\n        \n        repaint : function(){\n            var dom = this.dom;\n            this.addClass(\"x-repaint\");\n            setTimeout(function(){\n                Ext.fly(dom).removeClass(\"x-repaint\");\n            }, 1);\n            return this;\n        },\n\n        \n        unselectable : function(){\n            this.dom.unselectable = \"on\";\n            return this.swallowEvent(\"selectstart\", true).\n                        addClass(\"x-unselectable\");\n        },\n\n        \n        getMargins : function(side){\n            var me = this,\n                key,\n                hash = {t:\"top\", l:\"left\", r:\"right\", b: \"bottom\"},\n                o = {};\n\n            if (!side) {\n                for (key in me.margins){\n                    o[hash[key]] = parseFloat(me.getStyle(me.margins[key])) || 0;\n                }\n                return o;\n            } else {\n                return me.addStyles.call(me, side, me.margins);\n            }\n        }\n    };\n}());\n\nExt.Element.addMethods({\n    \n    setBox : function(box, adjust, animate){\n        var me = this,\n        \tw = box.width, \n        \th = box.height;\n        if((adjust && !me.autoBoxAdjust) && !me.isBorderBox()){\n           w -= (me.getBorderWidth(\"lr\") + me.getPadding(\"lr\"));\n           h -= (me.getBorderWidth(\"tb\") + me.getPadding(\"tb\"));\n        }\n        me.setBounds(box.x, box.y, w, h, me.animTest.call(me, arguments, animate, 2));\n        return me;\n    },\n\n    \n\tgetBox : function(contentBox, local) {\t    \n\t    var me = this,\n        \txy,\n        \tleft,\n        \ttop,\n        \tgetBorderWidth = me.getBorderWidth,\n        \tgetPadding = me.getPadding, \n        \tl,\n        \tr,\n        \tt,\n        \tb;\n        if(!local){\n            xy = me.getXY();\n        }else{\n            left = parseInt(me.getStyle(\"left\"), 10) || 0;\n            top = parseInt(me.getStyle(\"top\"), 10) || 0;\n            xy = [left, top];\n        }\n        var el = me.dom, w = el.offsetWidth, h = el.offsetHeight, bx;\n        if(!contentBox){\n            bx = {x: xy[0], y: xy[1], 0: xy[0], 1: xy[1], width: w, height: h};\n        }else{\n            l = getBorderWidth.call(me, \"l\") + getPadding.call(me, \"l\");\n            r = getBorderWidth.call(me, \"r\") + getPadding.call(me, \"r\");\n            t = getBorderWidth.call(me, \"t\") + getPadding.call(me, \"t\");\n            b = getBorderWidth.call(me, \"b\") + getPadding.call(me, \"b\");\n            bx = {x: xy[0]+l, y: xy[1]+t, 0: xy[0]+l, 1: xy[1]+t, width: w-(l+r), height: h-(t+b)};\n        }\n        bx.right = bx.x + bx.width;\n        bx.bottom = bx.y + bx.height;\n        return bx;\n\t},\n\t\n    \n     move : function(direction, distance, animate){\n        var me = this,        \t\n        \txy = me.getXY(),\n        \tx = xy[0],\n        \ty = xy[1],        \t\n        \tleft = [x - distance, y],\n        \tright = [x + distance, y],\n        \ttop = [x, y - distance],\n        \tbottom = [x, y + distance],\n\t       \thash = {\n\t        \tl :\tleft,\n\t        \tleft : left,\n\t        \tr : right,\n\t        \tright : right,\n\t        \tt : top,\n\t        \ttop : top,\n\t        \tup : top,\n\t        \tb : bottom, \n\t        \tbottom : bottom,\n\t        \tdown : bottom\t        \t\t\n\t        };\n        \n \t    direction = direction.toLowerCase();    \n \t    me.moveTo(hash[direction][0], hash[direction][1], me.animTest.call(me, arguments, animate, 2));\n    },\n    \n    \n     setLeftTop : function(left, top){\n\t    var me = this,\n\t    \tstyle = me.dom.style;\n        style.left = me.addUnits(left);\n        style.top = me.addUnits(top);\n        return me;\n    },\n    \n    \n    getRegion : function(){\n        return Ext.lib.Dom.getRegion(this.dom);\n    },\n    \n    \n    setBounds : function(x, y, width, height, animate){\n\t    var me = this;\n        if (!animate || !me.anim) {\n            me.setSize(width, height);\n            me.setLocation(x, y);\n        } else {\n            me.anim({points: {to: [x, y]}, \n            \t\t width: {to: me.adjustWidth(width)}, \n            \t\t height: {to: me.adjustHeight(height)}},\n                     me.preanim(arguments, 4), \n                     'motion');\n        }\n        return me;\n    },\n\n    \n    setRegion : function(region, animate) {\n        return this.setBounds(region.left, region.top, region.right-region.left, region.bottom-region.top, this.animTest.call(this, arguments, animate, 1));\n    }\n});\nExt.Element.addMethods({\n    \n    scrollTo : function(side, value, animate) {\n        \n        var top = /top/i.test(side),\n            me = this,\n            dom = me.dom,\n            prop;\n        if (!animate || !me.anim) {\n            \n            prop = 'scroll' + (top ? 'Top' : 'Left');\n            dom[prop] = value;\n        }\n        else {\n            \n            prop = 'scroll' + (top ? 'Left' : 'Top');\n            me.anim({scroll: {to: top ? [dom[prop], value] : [value, dom[prop]]}}, me.preanim(arguments, 2), 'scroll');\n        }\n        return me;\n    },\n    \n    \n    scrollIntoView : function(container, hscroll) {\n        var c = Ext.getDom(container) || Ext.getBody().dom,\n            el = this.dom,\n            o = this.getOffsetsTo(c),\n            l = o[0] + c.scrollLeft,\n            t = o[1] + c.scrollTop,\n            b = t + el.offsetHeight,\n            r = l + el.offsetWidth,\n            ch = c.clientHeight,\n            ct = parseInt(c.scrollTop, 10),\n            cl = parseInt(c.scrollLeft, 10),\n            cb = ct + ch,\n            cr = cl + c.clientWidth;\n\n        if (el.offsetHeight > ch || t < ct) {\n            c.scrollTop = t;\n        }\n        else if (b > cb) {\n            c.scrollTop = b-ch;\n        }\n        \n        c.scrollTop = c.scrollTop;\n\n        if (hscroll !== false) {\n            if (el.offsetWidth > c.clientWidth || l < cl) {\n                c.scrollLeft = l;\n            }\n            else if (r > cr) {\n                c.scrollLeft = r - c.clientWidth;\n            }\n            c.scrollLeft = c.scrollLeft;\n        }\n        return this;\n    },\n\n    \n    scrollChildIntoView : function(child, hscroll) {\n        Ext.fly(child, '_scrollChildIntoView').scrollIntoView(this, hscroll);\n    },\n    \n    \n     scroll : function(direction, distance, animate) {\n        if (!this.isScrollable()) {\n            return false;\n        }\n        var el = this.dom,\n            l = el.scrollLeft, t = el.scrollTop,\n            w = el.scrollWidth, h = el.scrollHeight,\n            cw = el.clientWidth, ch = el.clientHeight,\n            scrolled = false, v,\n            hash = {\n                l: Math.min(l + distance, w-cw),\n                r: v = Math.max(l - distance, 0),\n                t: Math.max(t - distance, 0),\n                b: Math.min(t + distance, h-ch)\n            };\n            hash.d = hash.b;\n            hash.u = hash.t;\n        \n        direction = direction.substr(0, 1);\n        if ((v = hash[direction]) > -1) {\n            scrolled = true;\n            this.scrollTo(direction == 'l' || direction == 'r' ? 'left' : 'top', v, this.preanim(arguments, 2));\n        }\n        return scrolled;\n    }\n});\nExt.Element.addMethods(\n    function() {\n        var VISIBILITY      = \"visibility\",\n            DISPLAY         = \"display\",\n            HIDDEN          = \"hidden\",\n            NONE            = \"none\",\n            XMASKED         = \"x-masked\",\n            XMASKEDRELATIVE = \"x-masked-relative\",\n            data            = Ext.Element.data;\n\n        return {\n            \n            isVisible : function(deep) {\n                var vis = !this.isStyle(VISIBILITY, HIDDEN) && !this.isStyle(DISPLAY, NONE),\n                    p   = this.dom.parentNode;\n                \n                if (deep !== true || !vis) {\n                    return vis;\n                }\n                \n                while (p && !(/^body/i.test(p.tagName))) {\n                    if (!Ext.fly(p, '_isVisible').isVisible()) {\n                        return false;\n                    }\n                    p = p.parentNode;\n                }\n                return true;\n            },\n\n            \n            isDisplayed : function() {\n                return !this.isStyle(DISPLAY, NONE);\n            },\n\n            \n            enableDisplayMode : function(display) {\n                this.setVisibilityMode(Ext.Element.DISPLAY);\n                \n                if (!Ext.isEmpty(display)) {\n                    data(this.dom, 'originalDisplay', display);\n                }\n                \n                return this;\n            },\n\n            \n            mask : function(msg, msgCls) {\n                var me  = this,\n                    dom = me.dom,\n                    dh  = Ext.DomHelper,\n                    EXTELMASKMSG = \"ext-el-mask-msg\",\n                    el,\n                    mask;\n\n                if (!/^body/i.test(dom.tagName) && me.getStyle('position') == 'static') {\n                    me.addClass(XMASKEDRELATIVE);\n                }\n                if (el = data(dom, 'maskMsg')) {\n                    el.remove();\n                }\n                if (el = data(dom, 'mask')) {\n                    el.remove();\n                }\n\n                mask = dh.append(dom, {cls : \"ext-el-mask\"}, true);\n                data(dom, 'mask', mask);\n\n                me.addClass(XMASKED);\n                mask.setDisplayed(true);\n                \n                if (typeof msg == 'string') {\n                    var mm = dh.append(dom, {cls : EXTELMASKMSG, cn:{tag:'div'}}, true);\n                    data(dom, 'maskMsg', mm);\n                    mm.dom.className = msgCls ? EXTELMASKMSG + \" \" + msgCls : EXTELMASKMSG;\n                    mm.dom.firstChild.innerHTML = msg;\n                    mm.setDisplayed(true);\n                    mm.center(me);\n                }\n                \n                \n                if (Ext.isIE && !(Ext.isIE7 && Ext.isStrict) && me.getStyle('height') == 'auto') {\n                    mask.setSize(undefined, me.getHeight());\n                }\n                \n                return mask;\n            },\n\n            \n            unmask : function() {\n                var me      = this,\n                    dom     = me.dom,\n                    mask    = data(dom, 'mask'),\n                    maskMsg = data(dom, 'maskMsg');\n\n                if (mask) {\n                    if (maskMsg) {\n                        maskMsg.remove();\n                        data(dom, 'maskMsg', undefined);\n                    }\n                    \n                    mask.remove();\n                    data(dom, 'mask', undefined);\n                    me.removeClass([XMASKED, XMASKEDRELATIVE]);\n                }\n            },\n\n            \n            isMasked : function() {\n                var m = data(this.dom, 'mask');\n                return m && m.isVisible();\n            },\n\n            \n            createShim : function() {\n                var el = document.createElement('iframe'),\n                    shim;\n                \n                el.frameBorder = '0';\n                el.className = 'ext-shim';\n                el.src = Ext.SSL_SECURE_URL;\n                shim = Ext.get(this.dom.parentNode.insertBefore(el, this.dom));\n                shim.autoBoxAdjust = false;\n                return shim;\n            }\n        };\n    }()\n);\nExt.Element.addMethods({\n    \n    addKeyListener : function(key, fn, scope){\n        var config;\n        if(typeof key != 'object' || Ext.isArray(key)){\n            config = {\n                key: key,\n                fn: fn,\n                scope: scope\n            };\n        }else{\n            config = {\n                key : key.key,\n                shift : key.shift,\n                ctrl : key.ctrl,\n                alt : key.alt,\n                fn: fn,\n                scope: scope\n            };\n        }\n        return new Ext.KeyMap(this, config);\n    },\n\n    \n    addKeyMap : function(config){\n        return new Ext.KeyMap(this, config);\n    }\n});\n\n\n\nExt.CompositeElementLite.importElementMethods();\nExt.apply(Ext.CompositeElementLite.prototype, {\n    addElements : function(els, root){\n        if(!els){\n            return this;\n        }\n        if(typeof els == \"string\"){\n            els = Ext.Element.selectorFunction(els, root);\n        }\n        var yels = this.elements;\n        Ext.each(els, function(e) {\n            yels.push(Ext.get(e));\n        });\n        return this;\n    },\n\n    \n    first : function(){\n        return this.item(0);\n    },\n\n    \n    last : function(){\n        return this.item(this.getCount()-1);\n    },\n\n    \n    contains : function(el){\n        return this.indexOf(el) != -1;\n    },\n\n    \n    removeElement : function(keys, removeDom){\n        var me = this,\n            els = this.elements,\n            el;\n        Ext.each(keys, function(val){\n            if ((el = (els[val] || els[val = me.indexOf(val)]))) {\n                if(removeDom){\n                    if(el.dom){\n                        el.remove();\n                    }else{\n                        Ext.removeNode(el);\n                    }\n                }\n                els.splice(val, 1);\n            }\n        });\n        return this;\n    }\n});\n\nExt.CompositeElement = Ext.extend(Ext.CompositeElementLite, {\n\n    constructor : function(els, root){\n        this.elements = [];\n        this.add(els, root);\n    },\n\n    \n    getElement : function(el){\n        \n        return el;\n    },\n\n    \n    transformElement : function(el){\n        return Ext.get(el);\n    }\n\n    \n\n    \n\n    \n});\n\n\nExt.Element.select = function(selector, unique, root){\n    var els;\n    if(typeof selector == \"string\"){\n        els = Ext.Element.selectorFunction(selector, root);\n    }else if(selector.length !== undefined){\n        els = selector;\n    }else{\n        throw \"Invalid selector\";\n    }\n\n    return (unique === true) ? new Ext.CompositeElement(els) : new Ext.CompositeElementLite(els);\n};\n\n\nExt.select = Ext.Element.select;\nExt.UpdateManager = Ext.Updater = Ext.extend(Ext.util.Observable,\nfunction() {\n    var BEFOREUPDATE = \"beforeupdate\",\n        UPDATE = \"update\",\n        FAILURE = \"failure\";\n\n    \n    function processSuccess(response){\n        var me = this;\n        me.transaction = null;\n        if (response.argument.form && response.argument.reset) {\n            try { \n                response.argument.form.reset();\n            } catch(e){}\n        }\n        if (me.loadScripts) {\n            me.renderer.render(me.el, response, me,\n               updateComplete.createDelegate(me, [response]));\n        } else {\n            me.renderer.render(me.el, response, me);\n            updateComplete.call(me, response);\n        }\n    }\n\n    \n    function updateComplete(response, type, success){\n        this.fireEvent(type || UPDATE, this.el, response);\n        if(Ext.isFunction(response.argument.callback)){\n            response.argument.callback.call(response.argument.scope, this.el, Ext.isEmpty(success) ? true : false, response, response.argument.options);\n        }\n    }\n\n    \n    function processFailure(response){\n        updateComplete.call(this, response, FAILURE, !!(this.transaction = null));\n    }\n\n    return {\n        constructor: function(el, forceNew){\n            var me = this;\n            el = Ext.get(el);\n            if(!forceNew && el.updateManager){\n                return el.updateManager;\n            }\n            \n            me.el = el;\n            \n            me.defaultUrl = null;\n\n            me.addEvents(\n                \n                BEFOREUPDATE,\n                \n                UPDATE,\n                \n                FAILURE\n            );\n\n            Ext.apply(me, Ext.Updater.defaults);\n            \n            \n            \n            \n            \n            \n\n            \n            me.transaction = null;\n            \n            me.refreshDelegate = me.refresh.createDelegate(me);\n            \n            me.updateDelegate = me.update.createDelegate(me);\n            \n            me.formUpdateDelegate = (me.formUpdate || function(){}).createDelegate(me);\n\n            \n            me.renderer = me.renderer || me.getDefaultRenderer();\n\n            Ext.Updater.superclass.constructor.call(me);\n        },\n\n        \n        setRenderer : function(renderer){\n            this.renderer = renderer;\n        },\n\n        \n        getRenderer : function(){\n           return this.renderer;\n        },\n\n        \n        getDefaultRenderer: function() {\n            return new Ext.Updater.BasicRenderer();\n        },\n\n        \n        setDefaultUrl : function(defaultUrl){\n            this.defaultUrl = defaultUrl;\n        },\n\n        \n        getEl : function(){\n            return this.el;\n        },\n\n        \n        update : function(url, params, callback, discardUrl){\n            var me = this,\n                cfg,\n                callerScope;\n\n            if(me.fireEvent(BEFOREUPDATE, me.el, url, params) !== false){\n                if(Ext.isObject(url)){ \n                    cfg = url;\n                    url = cfg.url;\n                    params = params || cfg.params;\n                    callback = callback || cfg.callback;\n                    discardUrl = discardUrl || cfg.discardUrl;\n                    callerScope = cfg.scope;\n                    if(!Ext.isEmpty(cfg.nocache)){me.disableCaching = cfg.nocache;};\n                    if(!Ext.isEmpty(cfg.text)){me.indicatorText = '<div class=\"loading-indicator\">'+cfg.text+\"</div>\";};\n                    if(!Ext.isEmpty(cfg.scripts)){me.loadScripts = cfg.scripts;};\n                    if(!Ext.isEmpty(cfg.timeout)){me.timeout = cfg.timeout;};\n                }\n                me.showLoading();\n\n                if(!discardUrl){\n                    me.defaultUrl = url;\n                }\n                if(Ext.isFunction(url)){\n                    url = url.call(me);\n                }\n\n                var o = Ext.apply({}, {\n                    url : url,\n                    params: (Ext.isFunction(params) && callerScope) ? params.createDelegate(callerScope) : params,\n                    success: processSuccess,\n                    failure: processFailure,\n                    scope: me,\n                    callback: undefined,\n                    timeout: (me.timeout*1000),\n                    disableCaching: me.disableCaching,\n                    argument: {\n                        \"options\": cfg,\n                        \"url\": url,\n                        \"form\": null,\n                        \"callback\": callback,\n                        \"scope\": callerScope || window,\n                        \"params\": params\n                    }\n                }, cfg);\n\n                me.transaction = Ext.Ajax.request(o);\n            }\n        },\n\n        \n        formUpdate : function(form, url, reset, callback){\n            var me = this;\n            if(me.fireEvent(BEFOREUPDATE, me.el, form, url) !== false){\n                if(Ext.isFunction(url)){\n                    url = url.call(me);\n                }\n                form = Ext.getDom(form);\n                me.transaction = Ext.Ajax.request({\n                    form: form,\n                    url:url,\n                    success: processSuccess,\n                    failure: processFailure,\n                    scope: me,\n                    timeout: (me.timeout*1000),\n                    argument: {\n                        \"url\": url,\n                        \"form\": form,\n                        \"callback\": callback,\n                        \"reset\": reset\n                    }\n                });\n                me.showLoading.defer(1, me);\n            }\n        },\n\n        \n        startAutoRefresh : function(interval, url, params, callback, refreshNow){\n            var me = this;\n            if(refreshNow){\n                me.update(url || me.defaultUrl, params, callback, true);\n            }\n            if(me.autoRefreshProcId){\n                clearInterval(me.autoRefreshProcId);\n            }\n            me.autoRefreshProcId = setInterval(me.update.createDelegate(me, [url || me.defaultUrl, params, callback, true]), interval * 1000);\n        },\n\n        \n        stopAutoRefresh : function(){\n            if(this.autoRefreshProcId){\n                clearInterval(this.autoRefreshProcId);\n                delete this.autoRefreshProcId;\n            }\n        },\n\n        \n        isAutoRefreshing : function(){\n           return !!this.autoRefreshProcId;\n        },\n\n        \n        showLoading : function(){\n            if(this.showLoadIndicator){\n                this.el.dom.innerHTML = this.indicatorText;\n            }\n        },\n\n        \n        abort : function(){\n            if(this.transaction){\n                Ext.Ajax.abort(this.transaction);\n            }\n        },\n\n        \n        isUpdating : function(){\n            return this.transaction ? Ext.Ajax.isLoading(this.transaction) : false;\n        },\n\n        \n        refresh : function(callback){\n            if(this.defaultUrl){\n                this.update(this.defaultUrl, null, callback, true);\n            }\n        }\n    };\n}());\n\n\nExt.Updater.defaults = {\n   \n    timeout : 30,\n    \n    disableCaching : false,\n    \n    showLoadIndicator : true,\n    \n    indicatorText : '<div class=\"loading-indicator\">Loading...</div>',\n     \n    loadScripts : false,\n    \n    sslBlankUrl : Ext.SSL_SECURE_URL\n};\n\n\n\nExt.Updater.updateElement = function(el, url, params, options){\n    var um = Ext.get(el).getUpdater();\n    Ext.apply(um, options);\n    um.update(url, params, options ? options.callback : null);\n};\n\n\nExt.Updater.BasicRenderer = function(){};\n\nExt.Updater.BasicRenderer.prototype = {\n    \n     render : function(el, response, updateManager, callback){\n        el.update(response.responseText, updateManager.loadScripts, callback);\n    }\n};\n\n\n\n(function() {\n\n\nDate.useStrict = false;\n\n\n\n\n\nfunction xf(format) {\n    var args = Array.prototype.slice.call(arguments, 1);\n    return format.replace(/\\{(\\d+)\\}/g, function(m, i) {\n        return args[i];\n    });\n}\n\n\n\nDate.formatCodeToRegex = function(character, currentGroup) {\n    \n    var p = Date.parseCodes[character];\n\n    if (p) {\n      p = typeof p == 'function'? p() : p;\n      Date.parseCodes[character] = p; \n    }\n\n    return p ? Ext.applyIf({\n      c: p.c ? xf(p.c, currentGroup || \"{0}\") : p.c\n    }, p) : {\n        g:0,\n        c:null,\n        s:Ext.escapeRe(character) \n    };\n};\n\n\nvar $f = Date.formatCodeToRegex;\n\nExt.apply(Date, {\n    \n    parseFunctions: {\n        \"M$\": function(input, strict) {\n            \n            \n            var re = new RegExp('\\\\/Date\\\\(([-+])?(\\\\d+)(?:[+-]\\\\d{4})?\\\\)\\\\/');\n            var r = (input || '').match(re);\n            return r? new Date(((r[1] || '') + r[2]) * 1) : null;\n        }\n    },\n    parseRegexes: [],\n\n    \n    formatFunctions: {\n        \"M$\": function() {\n            \n            return '\\\\/Date(' + this.getTime() + ')\\\\/';\n        }\n    },\n\n    y2kYear : 50,\n\n    \n    MILLI : \"ms\",\n\n    \n    SECOND : \"s\",\n\n    \n    MINUTE : \"mi\",\n\n    \n    HOUR : \"h\",\n\n    \n    DAY : \"d\",\n\n    \n    MONTH : \"mo\",\n\n    \n    YEAR : \"y\",\n\n    \n    defaults: {},\n\n    \n    dayNames : [\n        \"Sunday\",\n        \"Monday\",\n        \"Tuesday\",\n        \"Wednesday\",\n        \"Thursday\",\n        \"Friday\",\n        \"Saturday\"\n    ],\n\n    \n    monthNames : [\n        \"January\",\n        \"February\",\n        \"March\",\n        \"April\",\n        \"May\",\n        \"June\",\n        \"July\",\n        \"August\",\n        \"September\",\n        \"October\",\n        \"November\",\n        \"December\"\n    ],\n\n    \n    monthNumbers : {\n        Jan:0,\n        Feb:1,\n        Mar:2,\n        Apr:3,\n        May:4,\n        Jun:5,\n        Jul:6,\n        Aug:7,\n        Sep:8,\n        Oct:9,\n        Nov:10,\n        Dec:11\n    },\n\n    \n    getShortMonthName : function(month) {\n        return Date.monthNames[month].substring(0, 3);\n    },\n\n    \n    getShortDayName : function(day) {\n        return Date.dayNames[day].substring(0, 3);\n    },\n\n    \n    getMonthNumber : function(name) {\n        \n        return Date.monthNumbers[name.substring(0, 1).toUpperCase() + name.substring(1, 3).toLowerCase()];\n    },\n    \n    \n    formatContainsHourInfo : (function(){\n        var stripEscapeRe = /(\\\\.)/g,\n            hourInfoRe = /([gGhHisucUOPZ]|M\\$)/;\n        return function(format){\n            return hourInfoRe.test(format.replace(stripEscapeRe, ''));\n        };\n    })(),\n\n    \n    formatCodes : {\n        d: \"String.leftPad(this.getDate(), 2, '0')\",\n        D: \"Date.getShortDayName(this.getDay())\", \n        j: \"this.getDate()\",\n        l: \"Date.dayNames[this.getDay()]\",\n        N: \"(this.getDay() ? this.getDay() : 7)\",\n        S: \"this.getSuffix()\",\n        w: \"this.getDay()\",\n        z: \"this.getDayOfYear()\",\n        W: \"String.leftPad(this.getWeekOfYear(), 2, '0')\",\n        F: \"Date.monthNames[this.getMonth()]\",\n        m: \"String.leftPad(this.getMonth() + 1, 2, '0')\",\n        M: \"Date.getShortMonthName(this.getMonth())\", \n        n: \"(this.getMonth() + 1)\",\n        t: \"this.getDaysInMonth()\",\n        L: \"(this.isLeapYear() ? 1 : 0)\",\n        o: \"(this.getFullYear() + (this.getWeekOfYear() == 1 && this.getMonth() > 0 ? +1 : (this.getWeekOfYear() >= 52 && this.getMonth() < 11 ? -1 : 0)))\",\n        Y: \"String.leftPad(this.getFullYear(), 4, '0')\",\n        y: \"('' + this.getFullYear()).substring(2, 4)\",\n        a: \"(this.getHours() < 12 ? 'am' : 'pm')\",\n        A: \"(this.getHours() < 12 ? 'AM' : 'PM')\",\n        g: \"((this.getHours() % 12) ? this.getHours() % 12 : 12)\",\n        G: \"this.getHours()\",\n        h: \"String.leftPad((this.getHours() % 12) ? this.getHours() % 12 : 12, 2, '0')\",\n        H: \"String.leftPad(this.getHours(), 2, '0')\",\n        i: \"String.leftPad(this.getMinutes(), 2, '0')\",\n        s: \"String.leftPad(this.getSeconds(), 2, '0')\",\n        u: \"String.leftPad(this.getMilliseconds(), 3, '0')\",\n        O: \"this.getGMTOffset()\",\n        P: \"this.getGMTOffset(true)\",\n        T: \"this.getTimezone()\",\n        Z: \"(this.getTimezoneOffset() * -60)\",\n\n        c: function() { \n            for (var c = \"Y-m-dTH:i:sP\", code = [], i = 0, l = c.length; i < l; ++i) {\n                var e = c.charAt(i);\n                code.push(e == \"T\" ? \"'T'\" : Date.getFormatCode(e)); \n            }\n            return code.join(\" + \");\n        },\n        \n\n        U: \"Math.round(this.getTime() / 1000)\"\n    },\n\n    \n    isValid : function(y, m, d, h, i, s, ms) {\n        \n        h = h || 0;\n        i = i || 0;\n        s = s || 0;\n        ms = ms || 0;\n\n        \n        var dt = new Date(y < 100 ? 100 : y, m - 1, d, h, i, s, ms).add(Date.YEAR, y < 100 ? y - 100 : 0);\n\n        return y == dt.getFullYear() &&\n            m == dt.getMonth() + 1 &&\n            d == dt.getDate() &&\n            h == dt.getHours() &&\n            i == dt.getMinutes() &&\n            s == dt.getSeconds() &&\n            ms == dt.getMilliseconds();\n    },\n\n    \n    parseDate : function(input, format, strict) {\n        var p = Date.parseFunctions;\n        if (p[format] == null) {\n            Date.createParser(format);\n        }\n        return p[format](input, Ext.isDefined(strict) ? strict : Date.useStrict);\n    },\n\n    \n    getFormatCode : function(character) {\n        var f = Date.formatCodes[character];\n\n        if (f) {\n          f = typeof f == 'function'? f() : f;\n          Date.formatCodes[character] = f; \n        }\n\n        \n        return f || (\"'\" + String.escape(character) + \"'\");\n    },\n\n    \n    createFormat : function(format) {\n        var code = [],\n            special = false,\n            ch = '';\n\n        for (var i = 0; i < format.length; ++i) {\n            ch = format.charAt(i);\n            if (!special && ch == \"\\\\\") {\n                special = true;\n            } else if (special) {\n                special = false;\n                code.push(\"'\" + String.escape(ch) + \"'\");\n            } else {\n                code.push(Date.getFormatCode(ch));\n            }\n        }\n        Date.formatFunctions[format] = new Function(\"return \" + code.join('+'));\n    },\n\n    \n    createParser : function() {\n        var code = [\n            \"var dt, y, m, d, h, i, s, ms, o, z, zz, u, v,\",\n                \"def = Date.defaults,\",\n                \"results = String(input).match(Date.parseRegexes[{0}]);\", \n\n            \"if(results){\",\n                \"{1}\",\n\n                \"if(u != null){\", \n                    \"v = new Date(u * 1000);\", \n                \"}else{\",\n                    \n                    \n                    \n                    \"dt = (new Date()).clearTime();\",\n\n                    \n                    \"y = Ext.num(y, Ext.num(def.y, dt.getFullYear()));\",\n                    \"m = Ext.num(m, Ext.num(def.m - 1, dt.getMonth()));\",\n                    \"d = Ext.num(d, Ext.num(def.d, dt.getDate()));\",\n\n                    \n                    \"h  = Ext.num(h, Ext.num(def.h, dt.getHours()));\",\n                    \"i  = Ext.num(i, Ext.num(def.i, dt.getMinutes()));\",\n                    \"s  = Ext.num(s, Ext.num(def.s, dt.getSeconds()));\",\n                    \"ms = Ext.num(ms, Ext.num(def.ms, dt.getMilliseconds()));\",\n\n                    \"if(z >= 0 && y >= 0){\",\n                        \n                        \n\n                        \n                        \n                        \"v = new Date(y < 100 ? 100 : y, 0, 1, h, i, s, ms).add(Date.YEAR, y < 100 ? y - 100 : 0);\",\n\n                        \n                        \"v = !strict? v : (strict === true && (z <= 364 || (v.isLeapYear() && z <= 365))? v.add(Date.DAY, z) : null);\",\n                    \"}else if(strict === true && !Date.isValid(y, m + 1, d, h, i, s, ms)){\", \n                        \"v = null;\", \n                    \"}else{\",\n                        \n                        \n                        \"v = new Date(y < 100 ? 100 : y, m, d, h, i, s, ms).add(Date.YEAR, y < 100 ? y - 100 : 0);\",\n                    \"}\",\n                \"}\",\n            \"}\",\n\n            \"if(v){\",\n                \n                \"if(zz != null){\",\n                    \n                    \"v = v.add(Date.SECOND, -v.getTimezoneOffset() * 60 - zz);\",\n                \"}else if(o){\",\n                    \n                    \"v = v.add(Date.MINUTE, -v.getTimezoneOffset() + (sn == '+'? -1 : 1) * (hr * 60 + mn));\",\n                \"}\",\n            \"}\",\n\n            \"return v;\"\n        ].join('\\n');\n\n        return function(format) {\n            var regexNum = Date.parseRegexes.length,\n                currentGroup = 1,\n                calc = [],\n                regex = [],\n                special = false,\n                ch = \"\",\n                i = 0,\n                obj,\n                last;\n\n            for (; i < format.length; ++i) {\n                ch = format.charAt(i);\n                if (!special && ch == \"\\\\\") {\n                    special = true;\n                } else if (special) {\n                    special = false;\n                    regex.push(String.escape(ch));\n                } else {\n                    obj = $f(ch, currentGroup);\n                    currentGroup += obj.g;\n                    regex.push(obj.s);\n                    if (obj.g && obj.c) {\n                        if (obj.calcLast) {\n                            last = obj.c;\n                        } else {\n                            calc.push(obj.c);\n                        }\n                    }\n                }\n            }\n            \n            if (last) {\n                calc.push(last);\n            }\n\n            Date.parseRegexes[regexNum] = new RegExp(\"^\" + regex.join('') + \"$\", 'i');\n            Date.parseFunctions[format] = new Function(\"input\", \"strict\", xf(code, regexNum, calc.join('')));\n        };\n    }(),\n\n    \n    parseCodes : {\n        \n        d: {\n            g:1,\n            c:\"d = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{2})\" \n        },\n        j: {\n            g:1,\n            c:\"d = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{1,2})\" \n        },\n        D: function() {\n            for (var a = [], i = 0; i < 7; a.push(Date.getShortDayName(i)), ++i); \n            return {\n                g:0,\n                c:null,\n                s:\"(?:\" + a.join(\"|\") +\")\"\n            };\n        },\n        l: function() {\n            return {\n                g:0,\n                c:null,\n                s:\"(?:\" + Date.dayNames.join(\"|\") + \")\"\n            };\n        },\n        N: {\n            g:0,\n            c:null,\n            s:\"[1-7]\" \n        },\n        S: {\n            g:0,\n            c:null,\n            s:\"(?:st|nd|rd|th)\"\n        },\n        w: {\n            g:0,\n            c:null,\n            s:\"[0-6]\" \n        },\n        z: {\n            g:1,\n            c:\"z = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{1,3})\" \n        },\n        W: {\n            g:0,\n            c:null,\n            s:\"(?:\\\\d{2})\" \n        },\n        F: function() {\n            return {\n                g:1,\n                c:\"m = parseInt(Date.getMonthNumber(results[{0}]), 10);\\n\", \n                s:\"(\" + Date.monthNames.join(\"|\") + \")\"\n            };\n        },\n        M: function() {\n            for (var a = [], i = 0; i < 12; a.push(Date.getShortMonthName(i)), ++i); \n            return Ext.applyIf({\n                s:\"(\" + a.join(\"|\") + \")\"\n            }, $f(\"F\"));\n        },\n        m: {\n            g:1,\n            c:\"m = parseInt(results[{0}], 10) - 1;\\n\",\n            s:\"(\\\\d{2})\" \n        },\n        n: {\n            g:1,\n            c:\"m = parseInt(results[{0}], 10) - 1;\\n\",\n            s:\"(\\\\d{1,2})\" \n        },\n        t: {\n            g:0,\n            c:null,\n            s:\"(?:\\\\d{2})\" \n        },\n        L: {\n            g:0,\n            c:null,\n            s:\"(?:1|0)\"\n        },\n        o: function() {\n            return $f(\"Y\");\n        },\n        Y: {\n            g:1,\n            c:\"y = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{4})\" \n        },\n        y: {\n            g:1,\n            c:\"var ty = parseInt(results[{0}], 10);\\n\"\n                + \"y = ty > Date.y2kYear ? 1900 + ty : 2000 + ty;\\n\", \n            s:\"(\\\\d{1,2})\"\n        },\n        \n        a: function(){\n            return $f(\"A\");\n        },\n        A: {\n            \n            calcLast: true,\n            g:1,\n            c:\"if (/(am)/i.test(results[{0}])) {\\n\"\n                + \"if (!h || h == 12) { h = 0; }\\n\"\n                + \"} else { if (!h || h < 12) { h = (h || 0) + 12; }}\",\n            s:\"(AM|PM|am|pm)\"\n        },\n        g: function() {\n            return $f(\"G\");\n        },\n        G: {\n            g:1,\n            c:\"h = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{1,2})\" \n        },\n        h: function() {\n            return $f(\"H\");\n        },\n        H: {\n            g:1,\n            c:\"h = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{2})\" \n        },\n        i: {\n            g:1,\n            c:\"i = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{2})\" \n        },\n        s: {\n            g:1,\n            c:\"s = parseInt(results[{0}], 10);\\n\",\n            s:\"(\\\\d{2})\" \n        },\n        u: {\n            g:1,\n            c:\"ms = results[{0}]; ms = parseInt(ms, 10)/Math.pow(10, ms.length - 3);\\n\",\n            s:\"(\\\\d+)\" \n        },\n        O: {\n            g:1,\n            c:[\n                \"o = results[{0}];\",\n                \"var sn = o.substring(0,1),\", \n                    \"hr = o.substring(1,3)*1 + Math.floor(o.substring(3,5) / 60),\", \n                    \"mn = o.substring(3,5) % 60;\", \n                \"o = ((-12 <= (hr*60 + mn)/60) && ((hr*60 + mn)/60 <= 14))? (sn + String.leftPad(hr, 2, '0') + String.leftPad(mn, 2, '0')) : null;\\n\" \n            ].join(\"\\n\"),\n            s: \"([+\\-]\\\\d{4})\" \n        },\n        P: {\n            g:1,\n            c:[\n                \"o = results[{0}];\",\n                \"var sn = o.substring(0,1),\", \n                    \"hr = o.substring(1,3)*1 + Math.floor(o.substring(4,6) / 60),\", \n                    \"mn = o.substring(4,6) % 60;\", \n                \"o = ((-12 <= (hr*60 + mn)/60) && ((hr*60 + mn)/60 <= 14))? (sn + String.leftPad(hr, 2, '0') + String.leftPad(mn, 2, '0')) : null;\\n\" \n            ].join(\"\\n\"),\n            s: \"([+\\-]\\\\d{2}:\\\\d{2})\" \n        },\n        T: {\n            g:0,\n            c:null,\n            s:\"[A-Z]{1,4}\" \n        },\n        Z: {\n            g:1,\n            c:\"zz = results[{0}] * 1;\\n\" \n                  + \"zz = (-43200 <= zz && zz <= 50400)? zz : null;\\n\",\n            s:\"([+\\-]?\\\\d{1,5})\" \n        },\n        c: function() {\n            var calc = [],\n                arr = [\n                    $f(\"Y\", 1), \n                    $f(\"m\", 2), \n                    $f(\"d\", 3), \n                    $f(\"h\", 4), \n                    $f(\"i\", 5), \n                    $f(\"s\", 6), \n                    {c:\"ms = results[7] || '0'; ms = parseInt(ms, 10)/Math.pow(10, ms.length - 3);\\n\"}, \n                    {c:[ \n                        \"if(results[8]) {\", \n                            \"if(results[8] == 'Z'){\",\n                                \"zz = 0;\", \n                            \"}else if (results[8].indexOf(':') > -1){\",\n                                $f(\"P\", 8).c, \n                            \"}else{\",\n                                $f(\"O\", 8).c, \n                            \"}\",\n                        \"}\"\n                    ].join('\\n')}\n                ];\n\n            for (var i = 0, l = arr.length; i < l; ++i) {\n                calc.push(arr[i].c);\n            }\n\n            return {\n                g:1,\n                c:calc.join(\"\"),\n                s:[\n                    arr[0].s, \n                    \"(?:\", \"-\", arr[1].s, \n                        \"(?:\", \"-\", arr[2].s, \n                            \"(?:\",\n                                \"(?:T| )?\", \n                                arr[3].s, \":\", arr[4].s,  \n                                \"(?::\", arr[5].s, \")?\", \n                                \"(?:(?:\\\\.|,)(\\\\d+))?\", \n                                \"(Z|(?:[-+]\\\\d{2}(?::)?\\\\d{2}))?\", \n                            \")?\",\n                        \")?\",\n                    \")?\"\n                ].join(\"\")\n            };\n        },\n        U: {\n            g:1,\n            c:\"u = parseInt(results[{0}], 10);\\n\",\n            s:\"(-?\\\\d+)\" \n        }\n    }\n});\n\n}());\n\nExt.apply(Date.prototype, {\n    \n    dateFormat : function(format) {\n        if (Date.formatFunctions[format] == null) {\n            Date.createFormat(format);\n        }\n        return Date.formatFunctions[format].call(this);\n    },\n\n    \n    getTimezone : function() {\n        \n        \n        \n        \n        \n        \n        \n        \n        \n        \n        \n        \n        return this.toString().replace(/^.* (?:\\((.*)\\)|([A-Z]{1,4})(?:[\\-+][0-9]{4})?(?: -?\\d+)?)$/, \"$1$2\").replace(/[^A-Z]/g, \"\");\n    },\n\n    \n    getGMTOffset : function(colon) {\n        return (this.getTimezoneOffset() > 0 ? \"-\" : \"+\")\n            + String.leftPad(Math.floor(Math.abs(this.getTimezoneOffset()) / 60), 2, \"0\")\n            + (colon ? \":\" : \"\")\n            + String.leftPad(Math.abs(this.getTimezoneOffset() % 60), 2, \"0\");\n    },\n\n    \n    getDayOfYear: function() {\n        var num = 0,\n            d = this.clone(),\n            m = this.getMonth(),\n            i;\n\n        for (i = 0, d.setDate(1), d.setMonth(0); i < m; d.setMonth(++i)) {\n            num += d.getDaysInMonth();\n        }\n        return num + this.getDate() - 1;\n    },\n\n    \n    getWeekOfYear : function() {\n        \n        var ms1d = 864e5, \n            ms7d = 7 * ms1d; \n\n        return function() { \n            var DC3 = Date.UTC(this.getFullYear(), this.getMonth(), this.getDate() + 3) / ms1d, \n                AWN = Math.floor(DC3 / 7), \n                Wyr = new Date(AWN * ms7d).getUTCFullYear();\n\n            return AWN - Math.floor(Date.UTC(Wyr, 0, 7) / ms7d) + 1;\n        };\n    }(),\n\n    \n    isLeapYear : function() {\n        var year = this.getFullYear();\n        return !!((year & 3) == 0 && (year % 100 || (year % 400 == 0 && year)));\n    },\n\n    \n    getFirstDayOfMonth : function() {\n        var day = (this.getDay() - (this.getDate() - 1)) % 7;\n        return (day < 0) ? (day + 7) : day;\n    },\n\n    \n    getLastDayOfMonth : function() {\n        return this.getLastDateOfMonth().getDay();\n    },\n\n\n    \n    getFirstDateOfMonth : function() {\n        return new Date(this.getFullYear(), this.getMonth(), 1);\n    },\n\n    \n    getLastDateOfMonth : function() {\n        return new Date(this.getFullYear(), this.getMonth(), this.getDaysInMonth());\n    },\n\n    \n    getDaysInMonth: function() {\n        var daysInMonth = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];\n\n        return function() { \n            var m = this.getMonth();\n\n            return m == 1 && this.isLeapYear() ? 29 : daysInMonth[m];\n        };\n    }(),\n\n    \n    getSuffix : function() {\n        switch (this.getDate()) {\n            case 1:\n            case 21:\n            case 31:\n                return \"st\";\n            case 2:\n            case 22:\n                return \"nd\";\n            case 3:\n            case 23:\n                return \"rd\";\n            default:\n                return \"th\";\n        }\n    },\n\n    \n    clone : function() {\n        return new Date(this.getTime());\n    },\n\n    \n    isDST : function() {\n        \n        \n        return new Date(this.getFullYear(), 0, 1).getTimezoneOffset() != this.getTimezoneOffset();\n    },\n\n    \n    clearTime : function(clone) {\n        if (clone) {\n            return this.clone().clearTime();\n        }\n\n        \n        var d = this.getDate();\n\n        \n        this.setHours(0);\n        this.setMinutes(0);\n        this.setSeconds(0);\n        this.setMilliseconds(0);\n\n        if (this.getDate() != d) { \n            \n            \n\n            \n            for (var hr = 1, c = this.add(Date.HOUR, hr); c.getDate() != d; hr++, c = this.add(Date.HOUR, hr));\n\n            this.setDate(d);\n            this.setHours(c.getHours());\n        }\n\n        return this;\n    },\n\n    \n    add : function(interval, value) {\n        var d = this.clone();\n        if (!interval || value === 0) return d;\n\n        switch(interval.toLowerCase()) {\n            case Date.MILLI:\n                d.setMilliseconds(this.getMilliseconds() + value);\n                break;\n            case Date.SECOND:\n                d.setSeconds(this.getSeconds() + value);\n                break;\n            case Date.MINUTE:\n                d.setMinutes(this.getMinutes() + value);\n                break;\n            case Date.HOUR:\n                d.setHours(this.getHours() + value);\n                break;\n            case Date.DAY:\n                d.setDate(this.getDate() + value);\n                break;\n            case Date.MONTH:\n                var day = this.getDate();\n                if (day > 28) {\n                    day = Math.min(day, this.getFirstDateOfMonth().add('mo', value).getLastDateOfMonth().getDate());\n                }\n                d.setDate(day);\n                d.setMonth(this.getMonth() + value);\n                break;\n            case Date.YEAR:\n                d.setFullYear(this.getFullYear() + value);\n                break;\n        }\n        return d;\n    },\n\n    \n    between : function(start, end) {\n        var t = this.getTime();\n        return start.getTime() <= t && t <= end.getTime();\n    }\n});\n\n\n\nDate.prototype.format = Date.prototype.dateFormat;\n\n\n\nif (Ext.isSafari && (navigator.userAgent.match(/WebKit\\/(\\d+)/)[1] || NaN) < 420) {\n    Ext.apply(Date.prototype, {\n        _xMonth : Date.prototype.setMonth,\n        _xDate  : Date.prototype.setDate,\n\n        \n        \n        setMonth : function(num) {\n            if (num <= -1) {\n                var n = Math.ceil(-num),\n                    back_year = Math.ceil(n / 12),\n                    month = (n % 12) ? 12 - n % 12 : 0;\n\n                this.setFullYear(this.getFullYear() - back_year);\n\n                return this._xMonth(month);\n            } else {\n                return this._xMonth(num);\n            }\n        },\n\n        \n        \n        \n        setDate : function(d) {\n            \n            \n            return this.setTime(this.getTime() - (this.getDate() - d) * 864e5);\n        }\n    });\n}\n\n\n\n\n\nExt.util.MixedCollection = function(allowFunctions, keyFn){\n    this.items = [];\n    this.map = {};\n    this.keys = [];\n    this.length = 0;\n    this.addEvents(\n        \n        'clear',\n        \n        'add',\n        \n        'replace',\n        \n        'remove',\n        'sort'\n    );\n    this.allowFunctions = allowFunctions === true;\n    if(keyFn){\n        this.getKey = keyFn;\n    }\n    Ext.util.MixedCollection.superclass.constructor.call(this);\n};\n\nExt.extend(Ext.util.MixedCollection, Ext.util.Observable, {\n\n    \n    allowFunctions : false,\n\n    \n    add : function(key, o){\n        if(arguments.length == 1){\n            o = arguments[0];\n            key = this.getKey(o);\n        }\n        if(typeof key != 'undefined' && key !== null){\n            var old = this.map[key];\n            if(typeof old != 'undefined'){\n                return this.replace(key, o);\n            }\n            this.map[key] = o;\n        }\n        this.length++;\n        this.items.push(o);\n        this.keys.push(key);\n        this.fireEvent('add', this.length-1, o, key);\n        return o;\n    },\n\n    \n    getKey : function(o){\n         return o.id;\n    },\n\n    \n    replace : function(key, o){\n        if(arguments.length == 1){\n            o = arguments[0];\n            key = this.getKey(o);\n        }\n        var old = this.map[key];\n        if(typeof key == 'undefined' || key === null || typeof old == 'undefined'){\n             return this.add(key, o);\n        }\n        var index = this.indexOfKey(key);\n        this.items[index] = o;\n        this.map[key] = o;\n        this.fireEvent('replace', key, old, o);\n        return o;\n    },\n\n    \n    addAll : function(objs){\n        if(arguments.length > 1 || Ext.isArray(objs)){\n            var args = arguments.length > 1 ? arguments : objs;\n            for(var i = 0, len = args.length; i < len; i++){\n                this.add(args[i]);\n            }\n        }else{\n            for(var key in objs){\n                if(this.allowFunctions || typeof objs[key] != 'function'){\n                    this.add(key, objs[key]);\n                }\n            }\n        }\n    },\n\n    \n    each : function(fn, scope){\n        var items = [].concat(this.items); \n        for(var i = 0, len = items.length; i < len; i++){\n            if(fn.call(scope || items[i], items[i], i, len) === false){\n                break;\n            }\n        }\n    },\n\n    \n    eachKey : function(fn, scope){\n        for(var i = 0, len = this.keys.length; i < len; i++){\n            fn.call(scope || window, this.keys[i], this.items[i], i, len);\n        }\n    },\n\n    \n    find : function(fn, scope){\n        for(var i = 0, len = this.items.length; i < len; i++){\n            if(fn.call(scope || window, this.items[i], this.keys[i])){\n                return this.items[i];\n            }\n        }\n        return null;\n    },\n\n    \n    insert : function(index, key, o){\n        if(arguments.length == 2){\n            o = arguments[1];\n            key = this.getKey(o);\n        }\n        if(this.containsKey(key)){\n            this.suspendEvents();\n            this.removeKey(key);\n            this.resumeEvents();\n        }\n        if(index >= this.length){\n            return this.add(key, o);\n        }\n        this.length++;\n        this.items.splice(index, 0, o);\n        if(typeof key != 'undefined' && key !== null){\n            this.map[key] = o;\n        }\n        this.keys.splice(index, 0, key);\n        this.fireEvent('add', index, o, key);\n        return o;\n    },\n\n    \n    remove : function(o){\n        return this.removeAt(this.indexOf(o));\n    },\n\n    \n    removeAt : function(index){\n        if(index < this.length && index >= 0){\n            this.length--;\n            var o = this.items[index];\n            this.items.splice(index, 1);\n            var key = this.keys[index];\n            if(typeof key != 'undefined'){\n                delete this.map[key];\n            }\n            this.keys.splice(index, 1);\n            this.fireEvent('remove', o, key);\n            return o;\n        }\n        return false;\n    },\n\n    \n    removeKey : function(key){\n        return this.removeAt(this.indexOfKey(key));\n    },\n\n    \n    getCount : function(){\n        return this.length;\n    },\n\n    \n    indexOf : function(o){\n        return this.items.indexOf(o);\n    },\n\n    \n    indexOfKey : function(key){\n        return this.keys.indexOf(key);\n    },\n\n    \n    item : function(key){\n        var mk = this.map[key],\n            item = mk !== undefined ? mk : (typeof key == 'number') ? this.items[key] : undefined;\n        return typeof item != 'function' || this.allowFunctions ? item : null; \n    },\n\n    \n    itemAt : function(index){\n        return this.items[index];\n    },\n\n    \n    key : function(key){\n        return this.map[key];\n    },\n\n    \n    contains : function(o){\n        return this.indexOf(o) != -1;\n    },\n\n    \n    containsKey : function(key){\n        return typeof this.map[key] != 'undefined';\n    },\n\n    \n    clear : function(){\n        this.length = 0;\n        this.items = [];\n        this.keys = [];\n        this.map = {};\n        this.fireEvent('clear');\n    },\n\n    \n    first : function(){\n        return this.items[0];\n    },\n\n    \n    last : function(){\n        return this.items[this.length-1];\n    },\n\n    \n    _sort : function(property, dir, fn){\n        var i, len,\n            dsc   = String(dir).toUpperCase() == 'DESC' ? -1 : 1,\n\n            \n            c     = [],\n            keys  = this.keys,\n            items = this.items;\n\n        \n        fn = fn || function(a, b) {\n            return a - b;\n        };\n\n        \n        for(i = 0, len = items.length; i < len; i++){\n            c[c.length] = {\n                key  : keys[i],\n                value: items[i],\n                index: i\n            };\n        }\n\n        \n        c.sort(function(a, b){\n            var v = fn(a[property], b[property]) * dsc;\n            if(v === 0){\n                v = (a.index < b.index ? -1 : 1);\n            }\n            return v;\n        });\n\n        \n        for(i = 0, len = c.length; i < len; i++){\n            items[i] = c[i].value;\n            keys[i]  = c[i].key;\n        }\n\n        this.fireEvent('sort', this);\n    },\n\n    \n    sort : function(dir, fn){\n        this._sort('value', dir, fn);\n    },\n\n    \n    reorder: function(mapping) {\n        this.suspendEvents();\n\n        var items = this.items,\n            index = 0,\n            length = items.length,\n            order = [],\n            remaining = [],\n            oldIndex;\n\n        \n        for (oldIndex in mapping) {\n            order[mapping[oldIndex]] = items[oldIndex];\n        }\n\n        for (index = 0; index < length; index++) {\n            if (mapping[index] == undefined) {\n                remaining.push(items[index]);\n            }\n        }\n\n        for (index = 0; index < length; index++) {\n            if (order[index] == undefined) {\n                order[index] = remaining.shift();\n            }\n        }\n\n        this.clear();\n        this.addAll(order);\n\n        this.resumeEvents();\n        this.fireEvent('sort', this);\n    },\n\n    \n    keySort : function(dir, fn){\n        this._sort('key', dir, fn || function(a, b){\n            var v1 = String(a).toUpperCase(), v2 = String(b).toUpperCase();\n            return v1 > v2 ? 1 : (v1 < v2 ? -1 : 0);\n        });\n    },\n\n    \n    getRange : function(start, end){\n        var items = this.items;\n        if(items.length < 1){\n            return [];\n        }\n        start = start || 0;\n        end = Math.min(typeof end == 'undefined' ? this.length-1 : end, this.length-1);\n        var i, r = [];\n        if(start <= end){\n            for(i = start; i <= end; i++) {\n                r[r.length] = items[i];\n            }\n        }else{\n            for(i = start; i >= end; i--) {\n                r[r.length] = items[i];\n            }\n        }\n        return r;\n    },\n\n    \n    filter : function(property, value, anyMatch, caseSensitive){\n        if(Ext.isEmpty(value, false)){\n            return this.clone();\n        }\n        value = this.createValueMatcher(value, anyMatch, caseSensitive);\n        return this.filterBy(function(o){\n            return o && value.test(o[property]);\n        });\n    },\n\n    \n    filterBy : function(fn, scope){\n        var r = new Ext.util.MixedCollection();\n        r.getKey = this.getKey;\n        var k = this.keys, it = this.items;\n        for(var i = 0, len = it.length; i < len; i++){\n            if(fn.call(scope||this, it[i], k[i])){\n                r.add(k[i], it[i]);\n            }\n        }\n        return r;\n    },\n\n    \n    findIndex : function(property, value, start, anyMatch, caseSensitive){\n        if(Ext.isEmpty(value, false)){\n            return -1;\n        }\n        value = this.createValueMatcher(value, anyMatch, caseSensitive);\n        return this.findIndexBy(function(o){\n            return o && value.test(o[property]);\n        }, null, start);\n    },\n\n    \n    findIndexBy : function(fn, scope, start){\n        var k = this.keys, it = this.items;\n        for(var i = (start||0), len = it.length; i < len; i++){\n            if(fn.call(scope||this, it[i], k[i])){\n                return i;\n            }\n        }\n        return -1;\n    },\n\n    \n    createValueMatcher : function(value, anyMatch, caseSensitive, exactMatch) {\n        if (!value.exec) { \n            var er = Ext.escapeRe;\n            value = String(value);\n\n            if (anyMatch === true) {\n                value = er(value);\n            } else {\n                value = '^' + er(value);\n                if (exactMatch === true) {\n                    value += '$';\n                }\n            }\n            value = new RegExp(value, caseSensitive ? '' : 'i');\n         }\n         return value;\n    },\n\n    \n    clone : function(){\n        var r = new Ext.util.MixedCollection();\n        var k = this.keys, it = this.items;\n        for(var i = 0, len = it.length; i < len; i++){\n            r.add(k[i], it[i]);\n        }\n        r.getKey = this.getKey;\n        return r;\n    }\n});\n\nExt.util.MixedCollection.prototype.get = Ext.util.MixedCollection.prototype.item;\n\nExt.AbstractManager = Ext.extend(Object, {\n    typeName: 'type',\n    \n    constructor: function(config) {\n        Ext.apply(this, config || {});\n        \n        \n        this.all = new Ext.util.MixedCollection();\n        \n        this.types = {};\n    },\n    \n    \n    get : function(id){\n        return this.all.get(id);\n    },\n    \n    \n    register: function(item) {\n        this.all.add(item);\n    },\n    \n    \n    unregister: function(item) {\n        this.all.remove(item);        \n    },\n    \n    \n    registerType : function(type, cls){\n        this.types[type] = cls;\n        cls[this.typeName] = type;\n    },\n    \n    \n    isRegistered : function(type){\n        return this.types[type] !== undefined;    \n    },\n    \n    \n    create: function(config, defaultType) {\n        var type        = config[this.typeName] || config.type || defaultType,\n            Constructor = this.types[type];\n        \n        if (Constructor == undefined) {\n            throw new Error(String.format(\"The '{0}' type has not been registered with this manager\", type));\n        }\n        \n        return new Constructor(config);\n    },\n    \n    \n    onAvailable : function(id, fn, scope){\n        var all = this.all;\n        \n        all.on(\"add\", function(index, o){\n            if (o.id == id) {\n                fn.call(scope || o, o);\n                all.un(\"add\", fn, scope);\n            }\n        });\n    }\n});\nExt.util.Format = function() {\n    var trimRe         = /^\\s+|\\s+$/g,\n        stripTagsRE    = /<\\/?[^>]+>/gi,\n        stripScriptsRe = /(?:<script.*?>)((\\n|\\r|.)*?)(?:<\\/script>)/ig,\n        nl2brRe        = /\\r?\\n/g;\n\n    return {\n        \n        ellipsis : function(value, len, word) {\n            if (value && value.length > len) {\n                if (word) {\n                    var vs    = value.substr(0, len - 2),\n                        index = Math.max(vs.lastIndexOf(' '), vs.lastIndexOf('.'), vs.lastIndexOf('!'), vs.lastIndexOf('?'));\n                    if (index == -1 || index < (len - 15)) {\n                        return value.substr(0, len - 3) + \"...\";\n                    } else {\n                        return vs.substr(0, index) + \"...\";\n                    }\n                } else {\n                    return value.substr(0, len - 3) + \"...\";\n                }\n            }\n            return value;\n        },\n\n        \n        undef : function(value) {\n            return value !== undefined ? value : \"\";\n        },\n\n        \n        defaultValue : function(value, defaultValue) {\n            if (!defaultValue && defaultValue !== 0) {\n                defaultValue = '';\n            }\n            return value !== undefined && value !== '' ? value : defaultValue;\n        },\n\n        \n        htmlEncode : function(value) {\n            return !value ? value : String(value).replace(/&/g, \"&amp;\").replace(/>/g, \"&gt;\").replace(/</g, \"&lt;\").replace(/\"/g, \"&quot;\");\n        },\n\n        \n        htmlDecode : function(value) {\n            return !value ? value : String(value).replace(/&gt;/g, \">\").replace(/&lt;/g, \"<\").replace(/&quot;/g, '\"').replace(/&amp;/g, \"&\");\n        },\n\n        \n        trim : function(value) {\n            return String(value).replace(trimRe, \"\");\n        },\n\n        \n        substr : function(value, start, length) {\n            return String(value).substr(start, length);\n        },\n\n        \n        lowercase : function(value) {\n            return String(value).toLowerCase();\n        },\n\n        \n        uppercase : function(value) {\n            return String(value).toUpperCase();\n        },\n\n        \n        capitalize : function(value) {\n            return !value ? value : value.charAt(0).toUpperCase() + value.substr(1).toLowerCase();\n        },\n\n        \n        call : function(value, fn) {\n            if (arguments.length > 2) {\n                var args = Array.prototype.slice.call(arguments, 2);\n                args.unshift(value);\n                return eval(fn).apply(window, args);\n            } else {\n                return eval(fn).call(window, value);\n            }\n        },\n\n        \n        usMoney : function(v) {\n            v = (Math.round((v-0)*100))/100;\n            v = (v == Math.floor(v)) ? v + \".00\" : ((v*10 == Math.floor(v*10)) ? v + \"0\" : v);\n            v = String(v);\n            var ps = v.split('.'),\n                whole = ps[0],\n                sub = ps[1] ? '.'+ ps[1] : '.00',\n                r = /(\\d+)(\\d{3})/;\n            while (r.test(whole)) {\n                whole = whole.replace(r, '$1' + ',' + '$2');\n            }\n            v = whole + sub;\n            if (v.charAt(0) == '-') {\n                return '-$' + v.substr(1);\n            }\n            return \"$\" +  v;\n        },\n\n        \n        date : function(v, format) {\n            if (!v) {\n                return \"\";\n            }\n            if (!Ext.isDate(v)) {\n                v = new Date(Date.parse(v));\n            }\n            return v.dateFormat(format || \"m/d/Y\");\n        },\n\n        \n        dateRenderer : function(format) {\n            return function(v) {\n                return Ext.util.Format.date(v, format);\n            };\n        },\n\n        \n        stripTags : function(v) {\n            return !v ? v : String(v).replace(stripTagsRE, \"\");\n        },\n\n        \n        stripScripts : function(v) {\n            return !v ? v : String(v).replace(stripScriptsRe, \"\");\n        },\n\n        \n        fileSize : function(size) {\n            if (size < 1024) {\n                return size + \" bytes\";\n            } else if (size < 1048576) {\n                return (Math.round(((size*10) / 1024))/10) + \" KB\";\n            } else {\n                return (Math.round(((size*10) / 1048576))/10) + \" MB\";\n            }\n        },\n\n        \n        math : function(){\n            var fns = {};\n            \n            return function(v, a){\n                if (!fns[a]) {\n                    fns[a] = new Function('v', 'return v ' + a + ';');\n                }\n                return fns[a](v);\n            };\n        }(),\n\n        \n        round : function(value, precision) {\n            var result = Number(value);\n            if (typeof precision == 'number') {\n                precision = Math.pow(10, precision);\n                result = Math.round(value * precision) / precision;\n            }\n            return result;\n        },\n\n        \n        number: function(v, format) {\n            if (!format) {\n                return v;\n            }\n            v = Ext.num(v, NaN);\n            if (isNaN(v)) {\n                return '';\n            }\n            var comma = ',',\n                dec   = '.',\n                i18n  = false,\n                neg   = v < 0;\n\n            v = Math.abs(v);\n            if (format.substr(format.length - 2) == '/i') {\n                format = format.substr(0, format.length - 2);\n                i18n   = true;\n                comma  = '.';\n                dec    = ',';\n            }\n\n            var hasComma = format.indexOf(comma) != -1,\n                psplit   = (i18n ? format.replace(/[^\\d\\,]/g, '') : format.replace(/[^\\d\\.]/g, '')).split(dec);\n\n            if (1 < psplit.length) {\n                v = v.toFixed(psplit[1].length);\n            } else if(2 < psplit.length) {\n                throw ('NumberFormatException: invalid format, formats should have no more than 1 period: ' + format);\n            } else {\n                v = v.toFixed(0);\n            }\n\n            var fnum = v.toString();\n\n            psplit = fnum.split('.');\n\n            if (hasComma) {\n                var cnum = psplit[0], \n                    parr = [], \n                    j    = cnum.length, \n                    m    = Math.floor(j / 3),\n                    n    = cnum.length % 3 || 3,\n                    i;\n\n                for (i = 0; i < j; i += n) {\n                    if (i != 0) {\n                        n = 3;\n                    }\n                    \n                    parr[parr.length] = cnum.substr(i, n);\n                    m -= 1;\n                }\n                fnum = parr.join(comma);\n                if (psplit[1]) {\n                    fnum += dec + psplit[1];\n                }\n            } else {\n                if (psplit[1]) {\n                    fnum = psplit[0] + dec + psplit[1];\n                }\n            }\n\n            return (neg ? '-' : '') + format.replace(/[\\d,?\\.?]+/, fnum);\n        },\n\n        \n        numberRenderer : function(format) {\n            return function(v) {\n                return Ext.util.Format.number(v, format);\n            };\n        },\n\n        \n        plural : function(v, s, p) {\n            return v +' ' + (v == 1 ? s : (p ? p : s+'s'));\n        },\n\n        \n        nl2br : function(v) {\n            return Ext.isEmpty(v) ? '' : v.replace(nl2brRe, '<br/>');\n        }\n    };\n}();\n\nExt.XTemplate = function(){\n    Ext.XTemplate.superclass.constructor.apply(this, arguments);\n\n    var me = this,\n        s = me.html,\n        re = /<tpl\\b[^>]*>((?:(?=([^<]+))\\2|<(?!tpl\\b[^>]*>))*?)<\\/tpl>/,\n        nameRe = /^<tpl\\b[^>]*?for=\"(.*?)\"/,\n        ifRe = /^<tpl\\b[^>]*?if=\"(.*?)\"/,\n        execRe = /^<tpl\\b[^>]*?exec=\"(.*?)\"/,\n        m,\n        id = 0,\n        tpls = [],\n        VALUES = 'values',\n        PARENT = 'parent',\n        XINDEX = 'xindex',\n        XCOUNT = 'xcount',\n        RETURN = 'return ',\n        WITHVALUES = 'with(values){ ';\n\n    s = ['<tpl>', s, '</tpl>'].join('');\n\n    while((m = s.match(re))){\n        var m2 = m[0].match(nameRe),\n            m3 = m[0].match(ifRe),\n            m4 = m[0].match(execRe),\n            exp = null,\n            fn = null,\n            exec = null,\n            name = m2 && m2[1] ? m2[1] : '';\n\n       if (m3) {\n           exp = m3 && m3[1] ? m3[1] : null;\n           if(exp){\n               fn = new Function(VALUES, PARENT, XINDEX, XCOUNT, WITHVALUES + RETURN +(Ext.util.Format.htmlDecode(exp))+'; }');\n           }\n       }\n       if (m4) {\n           exp = m4 && m4[1] ? m4[1] : null;\n           if(exp){\n               exec = new Function(VALUES, PARENT, XINDEX, XCOUNT, WITHVALUES +(Ext.util.Format.htmlDecode(exp))+'; }');\n           }\n       }\n       if(name){\n           switch(name){\n               case '.': name = new Function(VALUES, PARENT, WITHVALUES + RETURN + VALUES + '; }'); break;\n               case '..': name = new Function(VALUES, PARENT, WITHVALUES + RETURN + PARENT + '; }'); break;\n               default: name = new Function(VALUES, PARENT, WITHVALUES + RETURN + name + '; }');\n           }\n       }\n       tpls.push({\n            id: id,\n            target: name,\n            exec: exec,\n            test: fn,\n            body: m[1]||''\n        });\n       s = s.replace(m[0], '{xtpl'+ id + '}');\n       ++id;\n    }\n    for(var i = tpls.length-1; i >= 0; --i){\n        me.compileTpl(tpls[i]);\n    }\n    me.master = tpls[tpls.length-1];\n    me.tpls = tpls;\n};\nExt.extend(Ext.XTemplate, Ext.Template, {\n    \n    re : /\\{([\\w\\-\\.\\#]+)(?:\\:([\\w\\.]*)(?:\\((.*?)?\\))?)?(\\s?[\\+\\-\\*\\\\]\\s?[\\d\\.\\+\\-\\*\\\\\\(\\)]+)?\\}/g,\n    \n    codeRe : /\\{\\[((?:\\\\\\]|.|\\n)*?)\\]\\}/g,\n\n    \n    applySubTemplate : function(id, values, parent, xindex, xcount){\n        var me = this,\n            len,\n            t = me.tpls[id],\n            vs,\n            buf = [];\n        if ((t.test && !t.test.call(me, values, parent, xindex, xcount)) ||\n            (t.exec && t.exec.call(me, values, parent, xindex, xcount))) {\n            return '';\n        }\n        vs = t.target ? t.target.call(me, values, parent) : values;\n        len = vs.length;\n        parent = t.target ? values : parent;\n        if(t.target && Ext.isArray(vs)){\n            for(var i = 0, len = vs.length; i < len; i++){\n                buf[buf.length] = t.compiled.call(me, vs[i], parent, i+1, len);\n            }\n            return buf.join('');\n        }\n        return t.compiled.call(me, vs, parent, xindex, xcount);\n    },\n\n    \n    compileTpl : function(tpl){\n        var fm = Ext.util.Format,\n            useF = this.disableFormats !== true,\n            sep = Ext.isGecko ? \"+\" : \",\",\n            body;\n\n        function fn(m, name, format, args, math){\n            if(name.substr(0, 4) == 'xtpl'){\n                return \"'\"+ sep +'this.applySubTemplate('+name.substr(4)+', values, parent, xindex, xcount)'+sep+\"'\";\n            }\n            var v;\n            if(name === '.'){\n                v = 'values';\n            }else if(name === '#'){\n                v = 'xindex';\n            }else if(name.indexOf('.') != -1){\n                v = name;\n            }else{\n                v = \"values['\" + name + \"']\";\n            }\n            if(math){\n                v = '(' + v + math + ')';\n            }\n            if (format && useF) {\n                args = args ? ',' + args : \"\";\n                if(format.substr(0, 5) != \"this.\"){\n                    format = \"fm.\" + format + '(';\n                }else{\n                    format = 'this.call(\"'+ format.substr(5) + '\", ';\n                    args = \", values\";\n                }\n            } else {\n                args= ''; format = \"(\"+v+\" === undefined ? '' : \";\n            }\n            return \"'\"+ sep + format + v + args + \")\"+sep+\"'\";\n        }\n\n        function codeFn(m, code){\n            \n            return \"'\" + sep + '(' + code.replace(/\\\\'/g, \"'\") + ')' + sep + \"'\";\n        }\n\n        \n        if(Ext.isGecko){\n            body = \"tpl.compiled = function(values, parent, xindex, xcount){ return '\" +\n                   tpl.body.replace(/(\\r\\n|\\n)/g, '\\\\n').replace(/'/g, \"\\\\'\").replace(this.re, fn).replace(this.codeRe, codeFn) +\n                    \"';};\";\n        }else{\n            body = [\"tpl.compiled = function(values, parent, xindex, xcount){ return ['\"];\n            body.push(tpl.body.replace(/(\\r\\n|\\n)/g, '\\\\n').replace(/'/g, \"\\\\'\").replace(this.re, fn).replace(this.codeRe, codeFn));\n            body.push(\"'].join('');};\");\n            body = body.join('');\n        }\n        eval(body);\n        return this;\n    },\n\n    \n    applyTemplate : function(values){\n        return this.master.compiled.call(this, values, {}, 1, 1);\n    },\n\n    \n    compile : function(){return this;}\n\n    \n    \n    \n\n});\n\nExt.XTemplate.prototype.apply = Ext.XTemplate.prototype.applyTemplate;\n\n\nExt.XTemplate.from = function(el){\n    el = Ext.getDom(el);\n    return new Ext.XTemplate(el.value || el.innerHTML);\n};\n\nExt.util.CSS = function(){\n\tvar rules = null;\n   \tvar doc = document;\n\n    var camelRe = /(-[a-z])/gi;\n    var camelFn = function(m, a){ return a.charAt(1).toUpperCase(); };\n\n   return {\n   \n   createStyleSheet : function(cssText, id){\n       var ss;\n       var head = doc.getElementsByTagName(\"head\")[0];\n       var rules = doc.createElement(\"style\");\n       rules.setAttribute(\"type\", \"text/css\");\n       if(id){\n           rules.setAttribute(\"id\", id);\n       }\n       if(Ext.isIE){\n           head.appendChild(rules);\n           ss = rules.styleSheet;\n           ss.cssText = cssText;\n       }else{\n           try{\n                rules.appendChild(doc.createTextNode(cssText));\n           }catch(e){\n               rules.cssText = cssText;\n           }\n           head.appendChild(rules);\n           ss = rules.styleSheet ? rules.styleSheet : (rules.sheet || doc.styleSheets[doc.styleSheets.length-1]);\n       }\n       this.cacheStyleSheet(ss);\n       return ss;\n   },\n\n   \n   removeStyleSheet : function(id){\n       var existing = doc.getElementById(id);\n       if(existing){\n           existing.parentNode.removeChild(existing);\n       }\n   },\n\n   \n   swapStyleSheet : function(id, url){\n       this.removeStyleSheet(id);\n       var ss = doc.createElement(\"link\");\n       ss.setAttribute(\"rel\", \"stylesheet\");\n       ss.setAttribute(\"type\", \"text/css\");\n       ss.setAttribute(\"id\", id);\n       ss.setAttribute(\"href\", url);\n       doc.getElementsByTagName(\"head\")[0].appendChild(ss);\n   },\n   \n   \n   refreshCache : function(){\n       return this.getRules(true);\n   },\n\n   \n   cacheStyleSheet : function(ss){\n       if(!rules){\n           rules = {};\n       }\n       try{\n           var ssRules = ss.cssRules || ss.rules;\n           for(var j = ssRules.length-1; j >= 0; --j){\n               rules[ssRules[j].selectorText.toLowerCase()] = ssRules[j];\n           }\n       }catch(e){}\n   },\n   \n   \n   getRules : function(refreshCache){\n   \t\tif(rules === null || refreshCache){\n   \t\t\trules = {};\n   \t\t\tvar ds = doc.styleSheets;\n   \t\t\tfor(var i =0, len = ds.length; i < len; i++){\n   \t\t\t    try{\n    \t\t        this.cacheStyleSheet(ds[i]);\n    \t\t    }catch(e){} \n\t        }\n   \t\t}\n   \t\treturn rules;\n   \t},\n   \t\n   \t\n   getRule : function(selector, refreshCache){\n   \t\tvar rs = this.getRules(refreshCache);\n   \t\tif(!Ext.isArray(selector)){\n   \t\t    return rs[selector.toLowerCase()];\n   \t\t}\n   \t\tfor(var i = 0; i < selector.length; i++){\n\t\t\tif(rs[selector[i]]){\n\t\t\t\treturn rs[selector[i].toLowerCase()];\n\t\t\t}\n\t\t}\n\t\treturn null;\n   \t},\n   \t\n   \t\n   \t\n   updateRule : function(selector, property, value){\n   \t\tif(!Ext.isArray(selector)){\n   \t\t\tvar rule = this.getRule(selector);\n   \t\t\tif(rule){\n   \t\t\t\trule.style[property.replace(camelRe, camelFn)] = value;\n   \t\t\t\treturn true;\n   \t\t\t}\n   \t\t}else{\n   \t\t\tfor(var i = 0; i < selector.length; i++){\n   \t\t\t\tif(this.updateRule(selector[i], property, value)){\n   \t\t\t\t\treturn true;\n   \t\t\t\t}\n   \t\t\t}\n   \t\t}\n   \t\treturn false;\n   \t}\n   };\t\n}();\nExt.util.ClickRepeater = Ext.extend(Ext.util.Observable, {\n    \n    constructor : function(el, config){\n        this.el = Ext.get(el);\n        this.el.unselectable();\n\n        Ext.apply(this, config);\n\n        this.addEvents(\n        \n        \"mousedown\",\n        \n        \"click\",\n        \n        \"mouseup\"\n        );\n\n        if(!this.disabled){\n            this.disabled = true;\n            this.enable();\n        }\n\n        \n        if(this.handler){\n            this.on(\"click\", this.handler,  this.scope || this);\n        }\n\n        Ext.util.ClickRepeater.superclass.constructor.call(this);        \n    },\n    \n    interval : 20,\n    delay: 250,\n    preventDefault : true,\n    stopDefault : false,\n    timer : 0,\n\n    \n    enable: function(){\n        if(this.disabled){\n            this.el.on('mousedown', this.handleMouseDown, this);\n            if (Ext.isIE){\n                this.el.on('dblclick', this.handleDblClick, this);\n            }\n            if(this.preventDefault || this.stopDefault){\n                this.el.on('click', this.eventOptions, this);\n            }\n        }\n        this.disabled = false;\n    },\n\n    \n    disable: function( force){\n        if(force || !this.disabled){\n            clearTimeout(this.timer);\n            if(this.pressClass){\n                this.el.removeClass(this.pressClass);\n            }\n            Ext.getDoc().un('mouseup', this.handleMouseUp, this);\n            this.el.removeAllListeners();\n        }\n        this.disabled = true;\n    },\n\n    \n    setDisabled: function(disabled){\n        this[disabled ? 'disable' : 'enable']();\n    },\n\n    eventOptions: function(e){\n        if(this.preventDefault){\n            e.preventDefault();\n        }\n        if(this.stopDefault){\n            e.stopEvent();\n        }\n    },\n\n    \n    destroy : function() {\n        this.disable(true);\n        Ext.destroy(this.el);\n        this.purgeListeners();\n    },\n\n    handleDblClick : function(e){\n        clearTimeout(this.timer);\n        this.el.blur();\n\n        this.fireEvent(\"mousedown\", this, e);\n        this.fireEvent(\"click\", this, e);\n    },\n\n    \n    handleMouseDown : function(e){\n        clearTimeout(this.timer);\n        this.el.blur();\n        if(this.pressClass){\n            this.el.addClass(this.pressClass);\n        }\n        this.mousedownTime = new Date();\n\n        Ext.getDoc().on(\"mouseup\", this.handleMouseUp, this);\n        this.el.on(\"mouseout\", this.handleMouseOut, this);\n\n        this.fireEvent(\"mousedown\", this, e);\n        this.fireEvent(\"click\", this, e);\n\n        \n        if (this.accelerate) {\n            this.delay = 400;\n        }\n        this.timer = this.click.defer(this.delay || this.interval, this, [e]);\n    },\n\n    \n    click : function(e){\n        this.fireEvent(\"click\", this, e);\n        this.timer = this.click.defer(this.accelerate ?\n            this.easeOutExpo(this.mousedownTime.getElapsed(),\n                400,\n                -390,\n                12000) :\n            this.interval, this, [e]);\n    },\n\n    easeOutExpo : function (t, b, c, d) {\n        return (t==d) ? b+c : c * (-Math.pow(2, -10 * t/d) + 1) + b;\n    },\n\n    \n    handleMouseOut : function(){\n        clearTimeout(this.timer);\n        if(this.pressClass){\n            this.el.removeClass(this.pressClass);\n        }\n        this.el.on(\"mouseover\", this.handleMouseReturn, this);\n    },\n\n    \n    handleMouseReturn : function(){\n        this.el.un(\"mouseover\", this.handleMouseReturn, this);\n        if(this.pressClass){\n            this.el.addClass(this.pressClass);\n        }\n        this.click();\n    },\n\n    \n    handleMouseUp : function(e){\n        clearTimeout(this.timer);\n        this.el.un(\"mouseover\", this.handleMouseReturn, this);\n        this.el.un(\"mouseout\", this.handleMouseOut, this);\n        Ext.getDoc().un(\"mouseup\", this.handleMouseUp, this);\n        this.el.removeClass(this.pressClass);\n        this.fireEvent(\"mouseup\", this, e);\n    }\n});\nExt.KeyNav = function(el, config){\n    this.el = Ext.get(el);\n    Ext.apply(this, config);\n    if(!this.disabled){\n        this.disabled = true;\n        this.enable();\n    }\n};\n\nExt.KeyNav.prototype = {\n    \n    disabled : false,\n    \n    defaultEventAction: \"stopEvent\",\n    \n    forceKeyDown : false,\n\n    \n    relay : function(e){\n        var k = e.getKey(),\n            h = this.keyToHandler[k];\n        if(h && this[h]){\n            if(this.doRelay(e, this[h], h) !== true){\n                e[this.defaultEventAction]();\n            }\n        }\n    },\n\n    \n    doRelay : function(e, h, hname){\n        return h.call(this.scope || this, e, hname);\n    },\n\n    \n    enter : false,\n    left : false,\n    right : false,\n    up : false,\n    down : false,\n    tab : false,\n    esc : false,\n    pageUp : false,\n    pageDown : false,\n    del : false,\n    home : false,\n    end : false,\n    space : false,\n\n    \n    keyToHandler : {\n        37 : \"left\",\n        39 : \"right\",\n        38 : \"up\",\n        40 : \"down\",\n        33 : \"pageUp\",\n        34 : \"pageDown\",\n        46 : \"del\",\n        36 : \"home\",\n        35 : \"end\",\n        13 : \"enter\",\n        27 : \"esc\",\n        9  : \"tab\",\n        32 : \"space\"\n    },\n    \n    stopKeyUp: function(e) {\n        var k = e.getKey();\n\n        if (k >= 37 && k <= 40) {\n            \n            \n            e.stopEvent();\n        }\n    },\n    \n    \n    destroy: function(){\n        this.disable();    \n    },\n\n\t\n\tenable: function() {\n        if (this.disabled) {\n            if (Ext.isSafari2) {\n                \n                this.el.on('keyup', this.stopKeyUp, this);\n            }\n\n            this.el.on(this.isKeydown()? 'keydown' : 'keypress', this.relay, this);\n            this.disabled = false;\n        }\n    },\n\n\t\n\tdisable: function() {\n        if (!this.disabled) {\n            if (Ext.isSafari2) {\n                \n                this.el.un('keyup', this.stopKeyUp, this);\n            }\n\n            this.el.un(this.isKeydown()? 'keydown' : 'keypress', this.relay, this);\n            this.disabled = true;\n        }\n    },\n    \n    \n    setDisabled : function(disabled){\n        this[disabled ? \"disable\" : \"enable\"]();\n    },\n    \n    \n    isKeydown: function(){\n        return this.forceKeyDown || Ext.EventManager.useKeydown;\n    }\n};\n\nExt.KeyMap = function(el, config, eventName){\n    this.el  = Ext.get(el);\n    this.eventName = eventName || \"keydown\";\n    this.bindings = [];\n    if(config){\n        this.addBinding(config);\n    }\n    this.enable();\n};\n\nExt.KeyMap.prototype = {\n    \n    stopEvent : false,\n\n    \n\taddBinding : function(config){\n        if(Ext.isArray(config)){\n            Ext.each(config, function(c){\n                this.addBinding(c);\n            }, this);\n            return;\n        }\n        var keyCode = config.key,\n            fn = config.fn || config.handler,\n            scope = config.scope;\n\n\tif (config.stopEvent) {\n\t    this.stopEvent = config.stopEvent;    \n\t}\t\n\n        if(typeof keyCode == \"string\"){\n            var ks = [];\n            var keyString = keyCode.toUpperCase();\n            for(var j = 0, len = keyString.length; j < len; j++){\n                ks.push(keyString.charCodeAt(j));\n            }\n            keyCode = ks;\n        }\n        var keyArray = Ext.isArray(keyCode);\n        \n        var handler = function(e){\n            if(this.checkModifiers(config, e)){\n                var k = e.getKey();\n                if(keyArray){\n                    for(var i = 0, len = keyCode.length; i < len; i++){\n                        if(keyCode[i] == k){\n                          if(this.stopEvent){\n                              e.stopEvent();\n                          }\n                          fn.call(scope || window, k, e);\n                          return;\n                        }\n                    }\n                }else{\n                    if(k == keyCode){\n                        if(this.stopEvent){\n                           e.stopEvent();\n                        }\n                        fn.call(scope || window, k, e);\n                    }\n                }\n            }\n        };\n        this.bindings.push(handler);\n\t},\n    \n    \n    checkModifiers: function(config, e){\n        var val, key, keys = ['shift', 'ctrl', 'alt'];\n        for (var i = 0, len = keys.length; i < len; ++i){\n            key = keys[i];\n            val = config[key];\n            if(!(val === undefined || (val === e[key + 'Key']))){\n                return false;\n            }\n        }\n        return true;\n    },\n\n    \n    on : function(key, fn, scope){\n        var keyCode, shift, ctrl, alt;\n        if(typeof key == \"object\" && !Ext.isArray(key)){\n            keyCode = key.key;\n            shift = key.shift;\n            ctrl = key.ctrl;\n            alt = key.alt;\n        }else{\n            keyCode = key;\n        }\n        this.addBinding({\n            key: keyCode,\n            shift: shift,\n            ctrl: ctrl,\n            alt: alt,\n            fn: fn,\n            scope: scope\n        });\n    },\n\n    \n    handleKeyDown : function(e){\n\t    if(this.enabled){ \n    \t    var b = this.bindings;\n    \t    for(var i = 0, len = b.length; i < len; i++){\n    \t        b[i].call(this, e);\n    \t    }\n\t    }\n\t},\n\n\t\n\tisEnabled : function(){\n\t    return this.enabled;\n\t},\n\n\t\n\tenable: function(){\n\t\tif(!this.enabled){\n\t\t    this.el.on(this.eventName, this.handleKeyDown, this);\n\t\t    this.enabled = true;\n\t\t}\n\t},\n\n\t\n\tdisable: function(){\n\t\tif(this.enabled){\n\t\t    this.el.removeListener(this.eventName, this.handleKeyDown, this);\n\t\t    this.enabled = false;\n\t\t}\n\t},\n    \n    \n    setDisabled : function(disabled){\n        this[disabled ? \"disable\" : \"enable\"]();\n    }\n};\nExt.util.TextMetrics = function(){\n    var shared;\n    return {\n        \n        measure : function(el, text, fixedWidth){\n            if(!shared){\n                shared = Ext.util.TextMetrics.Instance(el, fixedWidth);\n            }\n            shared.bind(el);\n            shared.setFixedWidth(fixedWidth || 'auto');\n            return shared.getSize(text);\n        },\n\n        \n        createInstance : function(el, fixedWidth){\n            return Ext.util.TextMetrics.Instance(el, fixedWidth);\n        }\n    };\n}();\n\nExt.util.TextMetrics.Instance = function(bindTo, fixedWidth){\n    var ml = new Ext.Element(document.createElement('div'));\n    document.body.appendChild(ml.dom);\n    ml.position('absolute');\n    ml.setLeftTop(-1000, -1000);\n    ml.hide();\n\n    if(fixedWidth){\n        ml.setWidth(fixedWidth);\n    }\n\n    var instance = {\n        \n        getSize : function(text){\n            ml.update(text);\n            var s = ml.getSize();\n            ml.update('');\n            return s;\n        },\n\n        \n        bind : function(el){\n            ml.setStyle(\n                Ext.fly(el).getStyles('font-size','font-style', 'font-weight', 'font-family','line-height', 'text-transform', 'letter-spacing')\n            );\n        },\n\n        \n        setFixedWidth : function(width){\n            ml.setWidth(width);\n        },\n\n        \n        getWidth : function(text){\n            ml.dom.style.width = 'auto';\n            return this.getSize(text).width;\n        },\n\n        \n        getHeight : function(text){\n            return this.getSize(text).height;\n        }\n    };\n\n    instance.bind(bindTo);\n\n    return instance;\n};\n\nExt.Element.addMethods({\n    \n    getTextWidth : function(text, min, max){\n        return (Ext.util.TextMetrics.measure(this.dom, Ext.value(text, this.dom.innerHTML, true)).width).constrain(min || 0, max || 1000000);\n    }\n});\n\nExt.util.Cookies = {\n    \n    set : function(name, value){\n        var argv = arguments;\n        var argc = arguments.length;\n        var expires = (argc > 2) ? argv[2] : null;\n        var path = (argc > 3) ? argv[3] : '/';\n        var domain = (argc > 4) ? argv[4] : null;\n        var secure = (argc > 5) ? argv[5] : false;\n        document.cookie = name + \"=\" + escape(value) + ((expires === null) ? \"\" : (\"; expires=\" + expires.toGMTString())) + ((path === null) ? \"\" : (\"; path=\" + path)) + ((domain === null) ? \"\" : (\"; domain=\" + domain)) + ((secure === true) ? \"; secure\" : \"\");\n    },\n\n    \n    get : function(name){\n        var arg = name + \"=\";\n        var alen = arg.length;\n        var clen = document.cookie.length;\n        var i = 0;\n        var j = 0;\n        while(i < clen){\n            j = i + alen;\n            if(document.cookie.substring(i, j) == arg){\n                return Ext.util.Cookies.getCookieVal(j);\n            }\n            i = document.cookie.indexOf(\" \", i) + 1;\n            if(i === 0){\n                break;\n            }\n        }\n        return null;\n    },\n\n    \n    clear : function(name){\n        if(Ext.util.Cookies.get(name)){\n            document.cookie = name + \"=\" + \"; expires=Thu, 01-Jan-70 00:00:01 GMT\";\n        }\n    },\n    \n    getCookieVal : function(offset){\n        var endstr = document.cookie.indexOf(\";\", offset);\n        if(endstr == -1){\n            endstr = document.cookie.length;\n        }\n        return unescape(document.cookie.substring(offset, endstr));\n    }\n};\nExt.handleError = function(e) {\n    throw e;\n};\n\n\nExt.Error = function(message) {\n    \n    this.message = (this.lang[message]) ? this.lang[message] : message;\n};\n\nExt.Error.prototype = new Error();\nExt.apply(Ext.Error.prototype, {\n    \n    lang: {},\n\n    name: 'Ext.Error',\n    \n    getName : function() {\n        return this.name;\n    },\n    \n    getMessage : function() {\n        return this.message;\n    },\n    \n    toJson : function() {\n        return Ext.encode(this);\n    }\n});\n\nExt.ComponentMgr = function(){\n    var all = new Ext.util.MixedCollection();\n    var types = {};\n    var ptypes = {};\n\n    return {\n        \n        register : function(c){\n            all.add(c);\n        },\n\n        \n        unregister : function(c){\n            all.remove(c);\n        },\n\n        \n        get : function(id){\n            return all.get(id);\n        },\n\n        \n        onAvailable : function(id, fn, scope){\n            all.on(\"add\", function(index, o){\n                if(o.id == id){\n                    fn.call(scope || o, o);\n                    all.un(\"add\", fn, scope);\n                }\n            });\n        },\n\n        \n        all : all,\n        \n        \n        types : types,\n        \n        \n        ptypes: ptypes,\n        \n        \n        isRegistered : function(xtype){\n            return types[xtype] !== undefined;    \n        },\n        \n        \n        isPluginRegistered : function(ptype){\n            return ptypes[ptype] !== undefined;    \n        },        \n\n        \n        registerType : function(xtype, cls){\n            types[xtype] = cls;\n            cls.xtype = xtype;\n        },\n\n        \n        create : function(config, defaultType){\n            return config.render ? config : new types[config.xtype || defaultType](config);\n        },\n\n        \n        registerPlugin : function(ptype, cls){\n            ptypes[ptype] = cls;\n            cls.ptype = ptype;\n        },\n\n        \n        createPlugin : function(config, defaultType){\n            var PluginCls = ptypes[config.ptype || defaultType];\n            if (PluginCls.init) {\n                return PluginCls;                \n            } else {\n                return new PluginCls(config);\n            }            \n        }\n    };\n}();\n\n\nExt.reg = Ext.ComponentMgr.registerType; \n\nExt.preg = Ext.ComponentMgr.registerPlugin;\n\nExt.create = Ext.ComponentMgr.create;\nExt.Component = function(config){\n    config = config || {};\n    if(config.initialConfig){\n        if(config.isAction){           \n            this.baseAction = config;\n        }\n        config = config.initialConfig; \n    }else if(config.tagName || config.dom || Ext.isString(config)){ \n        config = {applyTo: config, id: config.id || config};\n    }\n\n    \n    this.initialConfig = config;\n\n    Ext.apply(this, config);\n    this.addEvents(\n        \n        'added',\n        \n        'disable',\n        \n        'enable',\n        \n        'beforeshow',\n        \n        'show',\n        \n        'beforehide',\n        \n        'hide',\n        \n        'removed',\n        \n        'beforerender',\n        \n        'render',\n        \n        'afterrender',\n        \n        'beforedestroy',\n        \n        'destroy',\n        \n        'beforestaterestore',\n        \n        'staterestore',\n        \n        'beforestatesave',\n        \n        'statesave'\n    );\n    this.getId();\n    Ext.ComponentMgr.register(this);\n    Ext.Component.superclass.constructor.call(this);\n\n    if(this.baseAction){\n        this.baseAction.addComponent(this);\n    }\n\n    this.initComponent();\n\n    if(this.plugins){\n        if(Ext.isArray(this.plugins)){\n            for(var i = 0, len = this.plugins.length; i < len; i++){\n                this.plugins[i] = this.initPlugin(this.plugins[i]);\n            }\n        }else{\n            this.plugins = this.initPlugin(this.plugins);\n        }\n    }\n\n    if(this.stateful !== false){\n        this.initState();\n    }\n\n    if(this.applyTo){\n        this.applyToMarkup(this.applyTo);\n        delete this.applyTo;\n    }else if(this.renderTo){\n        this.render(this.renderTo);\n        delete this.renderTo;\n    }\n};\n\n\nExt.Component.AUTO_ID = 1000;\n\nExt.extend(Ext.Component, Ext.util.Observable, {\n    \n    \n    \n    \n    \n    \n    \n\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    disabled : false,\n    \n    hidden : false,\n    \n    \n    \n    \n    \n    \n    \n    autoEl : 'div',\n\n    \n    disabledClass : 'x-item-disabled',\n    \n    allowDomMove : true,\n    \n    autoShow : false,\n    \n    hideMode : 'display',\n    \n    hideParent : false,\n    \n    \n    \n    \n    \n    rendered : false,\n\n    \n    \n\n    \n\n    \n    tplWriteMode : 'overwrite',\n\n    \n\n    \n    bubbleEvents: [],\n\n\n    \n    ctype : 'Ext.Component',\n\n    \n    actionMode : 'el',\n\n    \n    getActionEl : function(){\n        return this[this.actionMode];\n    },\n\n    initPlugin : function(p){\n        if(p.ptype && !Ext.isFunction(p.init)){\n            p = Ext.ComponentMgr.createPlugin(p);\n        }else if(Ext.isString(p)){\n            p = Ext.ComponentMgr.createPlugin({\n                ptype: p\n            });\n        }\n        p.init(this);\n        return p;\n    },\n\n    \n    initComponent : function(){\n        \n        if(this.listeners){\n            this.on(this.listeners);\n            delete this.listeners;\n        }\n        this.enableBubble(this.bubbleEvents);\n    },\n\n    \n    render : function(container, position){\n        if(!this.rendered && this.fireEvent('beforerender', this) !== false){\n            if(!container && this.el){\n                this.el = Ext.get(this.el);\n                container = this.el.dom.parentNode;\n                this.allowDomMove = false;\n            }\n            this.container = Ext.get(container);\n            if(this.ctCls){\n                this.container.addClass(this.ctCls);\n            }\n            this.rendered = true;\n            if(position !== undefined){\n                if(Ext.isNumber(position)){\n                    position = this.container.dom.childNodes[position];\n                }else{\n                    position = Ext.getDom(position);\n                }\n            }\n            this.onRender(this.container, position || null);\n            if(this.autoShow){\n                this.el.removeClass(['x-hidden','x-hide-' + this.hideMode]);\n            }\n            if(this.cls){\n                this.el.addClass(this.cls);\n                delete this.cls;\n            }\n            if(this.style){\n                this.el.applyStyles(this.style);\n                delete this.style;\n            }\n            if(this.overCls){\n                this.el.addClassOnOver(this.overCls);\n            }\n            this.fireEvent('render', this);\n\n\n            \n            \n            var contentTarget = this.getContentTarget();\n            if (this.html){\n                contentTarget.update(Ext.DomHelper.markup(this.html));\n                delete this.html;\n            }\n            if (this.contentEl){\n                var ce = Ext.getDom(this.contentEl);\n                Ext.fly(ce).removeClass(['x-hidden', 'x-hide-display']);\n                contentTarget.appendChild(ce);\n            }\n            if (this.tpl) {\n                if (!this.tpl.compile) {\n                    this.tpl = new Ext.XTemplate(this.tpl);\n                }\n                if (this.data) {\n                    this.tpl[this.tplWriteMode](contentTarget, this.data);\n                    delete this.data;\n                }\n            }\n            this.afterRender(this.container);\n\n\n            if(this.hidden){\n                \n                this.doHide();\n            }\n            if(this.disabled){\n                \n                this.disable(true);\n            }\n\n            if(this.stateful !== false){\n                this.initStateEvents();\n            }\n            this.fireEvent('afterrender', this);\n        }\n        return this;\n    },\n\n\n    \n    update: function(htmlOrData, loadScripts, cb) {\n        var contentTarget = this.getContentTarget();\n        if (this.tpl && typeof htmlOrData !== \"string\") {\n            this.tpl[this.tplWriteMode](contentTarget, htmlOrData || {});\n        } else {\n            var html = Ext.isObject(htmlOrData) ? Ext.DomHelper.markup(htmlOrData) : htmlOrData;\n            contentTarget.update(html, loadScripts, cb);\n        }\n    },\n\n\n    \n    onAdded : function(container, pos) {\n        this.ownerCt = container;\n        this.initRef();\n        this.fireEvent('added', this, container, pos);\n    },\n\n    \n    onRemoved : function() {\n        this.removeRef();\n        this.fireEvent('removed', this, this.ownerCt);\n        delete this.ownerCt;\n    },\n\n    \n    initRef : function() {\n        \n        if(this.ref && !this.refOwner){\n            var levels = this.ref.split('/'),\n                last = levels.length,\n                i = 0,\n                t = this;\n\n            while(t && i < last){\n                t = t.ownerCt;\n                ++i;\n            }\n            if(t){\n                t[this.refName = levels[--i]] = this;\n                \n                this.refOwner = t;\n            }\n        }\n    },\n\n    removeRef : function() {\n        if (this.refOwner && this.refName) {\n            delete this.refOwner[this.refName];\n            delete this.refOwner;\n        }\n    },\n\n    \n    initState : function(){\n        if(Ext.state.Manager){\n            var id = this.getStateId();\n            if(id){\n                var state = Ext.state.Manager.get(id);\n                if(state){\n                    if(this.fireEvent('beforestaterestore', this, state) !== false){\n                        this.applyState(Ext.apply({}, state));\n                        this.fireEvent('staterestore', this, state);\n                    }\n                }\n            }\n        }\n    },\n\n    \n    getStateId : function(){\n        return this.stateId || ((/^(ext-comp-|ext-gen)/).test(String(this.id)) ? null : this.id);\n    },\n\n    \n    initStateEvents : function(){\n        if(this.stateEvents){\n            for(var i = 0, e; e = this.stateEvents[i]; i++){\n                this.on(e, this.saveState, this, {delay:100});\n            }\n        }\n    },\n\n    \n    applyState : function(state){\n        if(state){\n            Ext.apply(this, state);\n        }\n    },\n\n    \n    getState : function(){\n        return null;\n    },\n\n    \n    saveState : function(){\n        if(Ext.state.Manager && this.stateful !== false){\n            var id = this.getStateId();\n            if(id){\n                var state = this.getState();\n                if(this.fireEvent('beforestatesave', this, state) !== false){\n                    Ext.state.Manager.set(id, state);\n                    this.fireEvent('statesave', this, state);\n                }\n            }\n        }\n    },\n\n    \n    applyToMarkup : function(el){\n        this.allowDomMove = false;\n        this.el = Ext.get(el);\n        this.render(this.el.dom.parentNode);\n    },\n\n    \n    addClass : function(cls){\n        if(this.el){\n            this.el.addClass(cls);\n        }else{\n            this.cls = this.cls ? this.cls + ' ' + cls : cls;\n        }\n        return this;\n    },\n\n    \n    removeClass : function(cls){\n        if(this.el){\n            this.el.removeClass(cls);\n        }else if(this.cls){\n            this.cls = this.cls.split(' ').remove(cls).join(' ');\n        }\n        return this;\n    },\n\n    \n    \n    onRender : function(ct, position){\n        if(!this.el && this.autoEl){\n            if(Ext.isString(this.autoEl)){\n                this.el = document.createElement(this.autoEl);\n            }else{\n                var div = document.createElement('div');\n                Ext.DomHelper.overwrite(div, this.autoEl);\n                this.el = div.firstChild;\n            }\n            if (!this.el.id) {\n                this.el.id = this.getId();\n            }\n        }\n        if(this.el){\n            this.el = Ext.get(this.el);\n            if(this.allowDomMove !== false){\n                ct.dom.insertBefore(this.el.dom, position);\n                if (div) {\n                    Ext.removeNode(div);\n                    div = null;\n                }\n            }\n        }\n    },\n\n    \n    getAutoCreate : function(){\n        var cfg = Ext.isObject(this.autoCreate) ?\n                      this.autoCreate : Ext.apply({}, this.defaultAutoCreate);\n        if(this.id && !cfg.id){\n            cfg.id = this.id;\n        }\n        return cfg;\n    },\n\n    \n    afterRender : Ext.emptyFn,\n\n    \n    destroy : function(){\n        if(!this.isDestroyed){\n            if(this.fireEvent('beforedestroy', this) !== false){\n                this.destroying = true;\n                this.beforeDestroy();\n                if(this.ownerCt && this.ownerCt.remove){\n                    this.ownerCt.remove(this, false);\n                }\n                if(this.rendered){\n                    this.el.remove();\n                    if(this.actionMode == 'container' || this.removeMode == 'container'){\n                        this.container.remove();\n                    }\n                }\n                \n                if(this.focusTask && this.focusTask.cancel){\n                    this.focusTask.cancel();\n                }\n                this.onDestroy();\n                Ext.ComponentMgr.unregister(this);\n                this.fireEvent('destroy', this);\n                this.purgeListeners();\n                this.destroying = false;\n                this.isDestroyed = true;\n            }\n        }\n    },\n\n    deleteMembers : function(){\n        var args = arguments;\n        for(var i = 0, len = args.length; i < len; ++i){\n            delete this[args[i]];\n        }\n    },\n\n    \n    beforeDestroy : Ext.emptyFn,\n\n    \n    onDestroy  : Ext.emptyFn,\n\n    \n    getEl : function(){\n        return this.el;\n    },\n\n    \n    getContentTarget : function(){\n        return this.el;\n    },\n\n    \n    getId : function(){\n        return this.id || (this.id = 'ext-comp-' + (++Ext.Component.AUTO_ID));\n    },\n\n    \n    getItemId : function(){\n        return this.itemId || this.getId();\n    },\n\n    \n    focus : function(selectText, delay){\n        if(delay){\n            this.focusTask = new Ext.util.DelayedTask(this.focus, this, [selectText, false]);\n            this.focusTask.delay(Ext.isNumber(delay) ? delay : 10);\n            return this;\n        }\n        if(this.rendered && !this.isDestroyed){\n            this.el.focus();\n            if(selectText === true){\n                this.el.dom.select();\n            }\n        }\n        return this;\n    },\n\n    \n    blur : function(){\n        if(this.rendered){\n            this.el.blur();\n        }\n        return this;\n    },\n\n    \n    disable : function( silent){\n        if(this.rendered){\n            this.onDisable();\n        }\n        this.disabled = true;\n        if(silent !== true){\n            this.fireEvent('disable', this);\n        }\n        return this;\n    },\n\n    \n    onDisable : function(){\n        this.getActionEl().addClass(this.disabledClass);\n        this.el.dom.disabled = true;\n    },\n\n    \n    enable : function(){\n        if(this.rendered){\n            this.onEnable();\n        }\n        this.disabled = false;\n        this.fireEvent('enable', this);\n        return this;\n    },\n\n    \n    onEnable : function(){\n        this.getActionEl().removeClass(this.disabledClass);\n        this.el.dom.disabled = false;\n    },\n\n    \n    setDisabled : function(disabled){\n        return this[disabled ? 'disable' : 'enable']();\n    },\n\n    \n    show : function(){\n        if(this.fireEvent('beforeshow', this) !== false){\n            this.hidden = false;\n            if(this.autoRender){\n                this.render(Ext.isBoolean(this.autoRender) ? Ext.getBody() : this.autoRender);\n            }\n            if(this.rendered){\n                this.onShow();\n            }\n            this.fireEvent('show', this);\n        }\n        return this;\n    },\n\n    \n    onShow : function(){\n        this.getVisibilityEl().removeClass('x-hide-' + this.hideMode);\n    },\n\n    \n    hide : function(){\n        if(this.fireEvent('beforehide', this) !== false){\n            this.doHide();\n            this.fireEvent('hide', this);\n        }\n        return this;\n    },\n\n    \n    doHide: function(){\n        this.hidden = true;\n        if(this.rendered){\n            this.onHide();\n        }\n    },\n\n    \n    onHide : function(){\n        this.getVisibilityEl().addClass('x-hide-' + this.hideMode);\n    },\n\n    \n    getVisibilityEl : function(){\n        return this.hideParent ? this.container : this.getActionEl();\n    },\n\n    \n    setVisible : function(visible){\n        return this[visible ? 'show' : 'hide']();\n    },\n\n    \n    isVisible : function(){\n        return this.rendered && this.getVisibilityEl().isVisible();\n    },\n\n    \n    cloneConfig : function(overrides){\n        overrides = overrides || {};\n        var id = overrides.id || Ext.id();\n        var cfg = Ext.applyIf(overrides, this.initialConfig);\n        cfg.id = id; \n        return new this.constructor(cfg);\n    },\n\n    \n    getXType : function(){\n        return this.constructor.xtype;\n    },\n\n    \n    isXType : function(xtype, shallow){\n        \n        if (Ext.isFunction(xtype)){\n            xtype = xtype.xtype; \n        }else if (Ext.isObject(xtype)){\n            xtype = xtype.constructor.xtype; \n        }\n\n        return !shallow ? ('/' + this.getXTypes() + '/').indexOf('/' + xtype + '/') != -1 : this.constructor.xtype == xtype;\n    },\n\n    \n    getXTypes : function(){\n        var tc = this.constructor;\n        if(!tc.xtypes){\n            var c = [], sc = this;\n            while(sc && sc.constructor.xtype){\n                c.unshift(sc.constructor.xtype);\n                sc = sc.constructor.superclass;\n            }\n            tc.xtypeChain = c;\n            tc.xtypes = c.join('/');\n        }\n        return tc.xtypes;\n    },\n\n    \n    findParentBy : function(fn) {\n        for (var p = this.ownerCt; (p != null) && !fn(p, this); p = p.ownerCt);\n        return p || null;\n    },\n\n    \n    findParentByType : function(xtype, shallow){\n        return this.findParentBy(function(c){\n            return c.isXType(xtype, shallow);\n        });\n    },\n\n    \n    bubble : function(fn, scope, args){\n        var p = this;\n        while(p){\n            if(fn.apply(scope || p, args || [p]) === false){\n                break;\n            }\n            p = p.ownerCt;\n        }\n        return this;\n    },\n\n    \n    getPositionEl : function(){\n        return this.positionEl || this.el;\n    },\n\n    \n    purgeListeners : function(){\n        Ext.Component.superclass.purgeListeners.call(this);\n        if(this.mons){\n            this.on('beforedestroy', this.clearMons, this, {single: true});\n        }\n    },\n\n    \n    clearMons : function(){\n        Ext.each(this.mons, function(m){\n            m.item.un(m.ename, m.fn, m.scope);\n        }, this);\n        this.mons = [];\n    },\n\n    \n    createMons: function(){\n        if(!this.mons){\n            this.mons = [];\n            this.on('beforedestroy', this.clearMons, this, {single: true});\n        }\n    },\n\n    \n    mon : function(item, ename, fn, scope, opt){\n        this.createMons();\n        if(Ext.isObject(ename)){\n            var propRe = /^(?:scope|delay|buffer|single|stopEvent|preventDefault|stopPropagation|normalized|args|delegate)$/;\n\n            var o = ename;\n            for(var e in o){\n                if(propRe.test(e)){\n                    continue;\n                }\n                if(Ext.isFunction(o[e])){\n                    \n                    this.mons.push({\n                        item: item, ename: e, fn: o[e], scope: o.scope\n                    });\n                    item.on(e, o[e], o.scope, o);\n                }else{\n                    \n                    this.mons.push({\n                        item: item, ename: e, fn: o[e], scope: o.scope\n                    });\n                    item.on(e, o[e]);\n                }\n            }\n            return;\n        }\n\n        this.mons.push({\n            item: item, ename: ename, fn: fn, scope: scope\n        });\n        item.on(ename, fn, scope, opt);\n    },\n\n    \n    mun : function(item, ename, fn, scope){\n        var found, mon;\n        this.createMons();\n        for(var i = 0, len = this.mons.length; i < len; ++i){\n            mon = this.mons[i];\n            if(item === mon.item && ename == mon.ename && fn === mon.fn && scope === mon.scope){\n                this.mons.splice(i, 1);\n                item.un(ename, fn, scope);\n                found = true;\n                break;\n            }\n        }\n        return found;\n    },\n\n    \n    nextSibling : function(){\n        if(this.ownerCt){\n            var index = this.ownerCt.items.indexOf(this);\n            if(index != -1 && index+1 < this.ownerCt.items.getCount()){\n                return this.ownerCt.items.itemAt(index+1);\n            }\n        }\n        return null;\n    },\n\n    \n    previousSibling : function(){\n        if(this.ownerCt){\n            var index = this.ownerCt.items.indexOf(this);\n            if(index > 0){\n                return this.ownerCt.items.itemAt(index-1);\n            }\n        }\n        return null;\n    },\n\n    \n    getBubbleTarget : function(){\n        return this.ownerCt;\n    }\n});\n\nExt.reg('component', Ext.Component);\n\nExt.Action = Ext.extend(Object, {\n    \n    \n    \n    \n    \n    \n    \n\n    constructor : function(config){\n        this.initialConfig = config;\n        this.itemId = config.itemId = (config.itemId || config.id || Ext.id());\n        this.items = [];\n    },\n    \n    \n    isAction : true,\n\n    \n    setText : function(text){\n        this.initialConfig.text = text;\n        this.callEach('setText', [text]);\n    },\n\n    \n    getText : function(){\n        return this.initialConfig.text;\n    },\n\n    \n    setIconClass : function(cls){\n        this.initialConfig.iconCls = cls;\n        this.callEach('setIconClass', [cls]);\n    },\n\n    \n    getIconClass : function(){\n        return this.initialConfig.iconCls;\n    },\n\n    \n    setDisabled : function(v){\n        this.initialConfig.disabled = v;\n        this.callEach('setDisabled', [v]);\n    },\n\n    \n    enable : function(){\n        this.setDisabled(false);\n    },\n\n    \n    disable : function(){\n        this.setDisabled(true);\n    },\n\n    \n    isDisabled : function(){\n        return this.initialConfig.disabled;\n    },\n\n    \n    setHidden : function(v){\n        this.initialConfig.hidden = v;\n        this.callEach('setVisible', [!v]);\n    },\n\n    \n    show : function(){\n        this.setHidden(false);\n    },\n\n    \n    hide : function(){\n        this.setHidden(true);\n    },\n\n    \n    isHidden : function(){\n        return this.initialConfig.hidden;\n    },\n\n    \n    setHandler : function(fn, scope){\n        this.initialConfig.handler = fn;\n        this.initialConfig.scope = scope;\n        this.callEach('setHandler', [fn, scope]);\n    },\n\n    \n    each : function(fn, scope){\n        Ext.each(this.items, fn, scope);\n    },\n\n    \n    callEach : function(fnName, args){\n        var cs = this.items;\n        for(var i = 0, len = cs.length; i < len; i++){\n            cs[i][fnName].apply(cs[i], args);\n        }\n    },\n\n    \n    addComponent : function(comp){\n        this.items.push(comp);\n        comp.on('destroy', this.removeComponent, this);\n    },\n\n    \n    removeComponent : function(comp){\n        this.items.remove(comp);\n    },\n\n    \n    execute : function(){\n        this.initialConfig.handler.apply(this.initialConfig.scope || window, arguments);\n    }\n});\n\n(function(){\nExt.Layer = function(config, existingEl){\n    config = config || {};\n    var dh = Ext.DomHelper,\n        cp = config.parentEl, pel = cp ? Ext.getDom(cp) : document.body;\n        \n    if (existingEl) {\n        this.dom = Ext.getDom(existingEl);\n    }\n    if(!this.dom){\n        var o = config.dh || {tag: 'div', cls: 'x-layer'};\n        this.dom = dh.append(pel, o);\n    }\n    if(config.cls){\n        this.addClass(config.cls);\n    }\n    this.constrain = config.constrain !== false;\n    this.setVisibilityMode(Ext.Element.VISIBILITY);\n    if(config.id){\n        this.id = this.dom.id = config.id;\n    }else{\n        this.id = Ext.id(this.dom);\n    }\n    this.zindex = config.zindex || this.getZIndex();\n    this.position('absolute', this.zindex);\n    if(config.shadow){\n        this.shadowOffset = config.shadowOffset || 4;\n        this.shadow = new Ext.Shadow({\n            offset : this.shadowOffset,\n            mode : config.shadow\n        });\n    }else{\n        this.shadowOffset = 0;\n    }\n    this.useShim = config.shim !== false && Ext.useShims;\n    this.useDisplay = config.useDisplay;\n    this.hide();\n};\n\nvar supr = Ext.Element.prototype;\n\n\nvar shims = [];\n\nExt.extend(Ext.Layer, Ext.Element, {\n\n    getZIndex : function(){\n        return this.zindex || parseInt((this.getShim() || this).getStyle('z-index'), 10) || 11000;\n    },\n\n    getShim : function(){\n        if(!this.useShim){\n            return null;\n        }\n        if(this.shim){\n            return this.shim;\n        }\n        var shim = shims.shift();\n        if(!shim){\n            shim = this.createShim();\n            shim.enableDisplayMode('block');\n            shim.dom.style.display = 'none';\n            shim.dom.style.visibility = 'visible';\n        }\n        var pn = this.dom.parentNode;\n        if(shim.dom.parentNode != pn){\n            pn.insertBefore(shim.dom, this.dom);\n        }\n        shim.setStyle('z-index', this.getZIndex()-2);\n        this.shim = shim;\n        return shim;\n    },\n\n    hideShim : function(){\n        if(this.shim){\n            this.shim.setDisplayed(false);\n            shims.push(this.shim);\n            delete this.shim;\n        }\n    },\n\n    disableShadow : function(){\n        if(this.shadow){\n            this.shadowDisabled = true;\n            this.shadow.hide();\n            this.lastShadowOffset = this.shadowOffset;\n            this.shadowOffset = 0;\n        }\n    },\n\n    enableShadow : function(show){\n        if(this.shadow){\n            this.shadowDisabled = false;\n            if(Ext.isDefined(this.lastShadowOffset)) {\n                this.shadowOffset = this.lastShadowOffset;\n                delete this.lastShadowOffset;\n            }\n            if(show){\n                this.sync(true);\n            }\n        }\n    },\n\n    \n    \n    \n    sync : function(doShow){\n        var shadow = this.shadow;\n        if(!this.updating && this.isVisible() && (shadow || this.useShim)){\n            var shim = this.getShim(),\n                w = this.getWidth(),\n                h = this.getHeight(),\n                l = this.getLeft(true),\n                t = this.getTop(true);\n\n            if(shadow && !this.shadowDisabled){\n                if(doShow && !shadow.isVisible()){\n                    shadow.show(this);\n                }else{\n                    shadow.realign(l, t, w, h);\n                }\n                if(shim){\n                    if(doShow){\n                       shim.show();\n                    }\n                    \n                    var shadowAdj = shadow.el.getXY(), shimStyle = shim.dom.style,\n                        shadowSize = shadow.el.getSize();\n                    shimStyle.left = (shadowAdj[0])+'px';\n                    shimStyle.top = (shadowAdj[1])+'px';\n                    shimStyle.width = (shadowSize.width)+'px';\n                    shimStyle.height = (shadowSize.height)+'px';\n                }\n            }else if(shim){\n                if(doShow){\n                   shim.show();\n                }\n                shim.setSize(w, h);\n                shim.setLeftTop(l, t);\n            }\n        }\n    },\n\n    \n    destroy : function(){\n        this.hideShim();\n        if(this.shadow){\n            this.shadow.hide();\n        }\n        this.removeAllListeners();\n        Ext.removeNode(this.dom);\n        delete this.dom;\n    },\n\n    remove : function(){\n        this.destroy();\n    },\n\n    \n    beginUpdate : function(){\n        this.updating = true;\n    },\n\n    \n    endUpdate : function(){\n        this.updating = false;\n        this.sync(true);\n    },\n\n    \n    hideUnders : function(negOffset){\n        if(this.shadow){\n            this.shadow.hide();\n        }\n        this.hideShim();\n    },\n\n    \n    constrainXY : function(){\n        if(this.constrain){\n            var vw = Ext.lib.Dom.getViewWidth(),\n                vh = Ext.lib.Dom.getViewHeight();\n            var s = Ext.getDoc().getScroll();\n\n            var xy = this.getXY();\n            var x = xy[0], y = xy[1];\n            var so = this.shadowOffset;\n            var w = this.dom.offsetWidth+so, h = this.dom.offsetHeight+so;\n            \n            var moved = false;\n            \n            if((x + w) > vw+s.left){\n                x = vw - w - so;\n                moved = true;\n            }\n            if((y + h) > vh+s.top){\n                y = vh - h - so;\n                moved = true;\n            }\n            \n            if(x < s.left){\n                x = s.left;\n                moved = true;\n            }\n            if(y < s.top){\n                y = s.top;\n                moved = true;\n            }\n            if(moved){\n                if(this.avoidY){\n                    var ay = this.avoidY;\n                    if(y <= ay && (y+h) >= ay){\n                        y = ay-h-5;\n                    }\n                }\n                xy = [x, y];\n                this.storeXY(xy);\n                supr.setXY.call(this, xy);\n                this.sync();\n            }\n        }\n        return this;\n    },\n    \n    getConstrainOffset : function(){\n        return this.shadowOffset;    \n    },\n\n    isVisible : function(){\n        return this.visible;\n    },\n\n    \n    showAction : function(){\n        this.visible = true; \n        if(this.useDisplay === true){\n            this.setDisplayed('');\n        }else if(this.lastXY){\n            supr.setXY.call(this, this.lastXY);\n        }else if(this.lastLT){\n            supr.setLeftTop.call(this, this.lastLT[0], this.lastLT[1]);\n        }\n    },\n\n    \n    hideAction : function(){\n        this.visible = false;\n        if(this.useDisplay === true){\n            this.setDisplayed(false);\n        }else{\n            this.setLeftTop(-10000,-10000);\n        }\n    },\n\n    \n    setVisible : function(v, a, d, c, e){\n        if(v){\n            this.showAction();\n        }\n        if(a && v){\n            var cb = function(){\n                this.sync(true);\n                if(c){\n                    c();\n                }\n            }.createDelegate(this);\n            supr.setVisible.call(this, true, true, d, cb, e);\n        }else{\n            if(!v){\n                this.hideUnders(true);\n            }\n            var cb = c;\n            if(a){\n                cb = function(){\n                    this.hideAction();\n                    if(c){\n                        c();\n                    }\n                }.createDelegate(this);\n            }\n            supr.setVisible.call(this, v, a, d, cb, e);\n            if(v){\n                this.sync(true);\n            }else if(!a){\n                this.hideAction();\n            }\n        }\n        return this;\n    },\n\n    storeXY : function(xy){\n        delete this.lastLT;\n        this.lastXY = xy;\n    },\n\n    storeLeftTop : function(left, top){\n        delete this.lastXY;\n        this.lastLT = [left, top];\n    },\n\n    \n    beforeFx : function(){\n        this.beforeAction();\n        return Ext.Layer.superclass.beforeFx.apply(this, arguments);\n    },\n\n    \n    afterFx : function(){\n        Ext.Layer.superclass.afterFx.apply(this, arguments);\n        this.sync(this.isVisible());\n    },\n\n    \n    beforeAction : function(){\n        if(!this.updating && this.shadow){\n            this.shadow.hide();\n        }\n    },\n\n    \n    setLeft : function(left){\n        this.storeLeftTop(left, this.getTop(true));\n        supr.setLeft.apply(this, arguments);\n        this.sync();\n        return this;\n    },\n\n    setTop : function(top){\n        this.storeLeftTop(this.getLeft(true), top);\n        supr.setTop.apply(this, arguments);\n        this.sync();\n        return this;\n    },\n\n    setLeftTop : function(left, top){\n        this.storeLeftTop(left, top);\n        supr.setLeftTop.apply(this, arguments);\n        this.sync();\n        return this;\n    },\n\n    setXY : function(xy, a, d, c, e){\n        this.fixDisplay();\n        this.beforeAction();\n        this.storeXY(xy);\n        var cb = this.createCB(c);\n        supr.setXY.call(this, xy, a, d, cb, e);\n        if(!a){\n            cb();\n        }\n        return this;\n    },\n\n    \n    createCB : function(c){\n        var el = this;\n        return function(){\n            el.constrainXY();\n            el.sync(true);\n            if(c){\n                c();\n            }\n        };\n    },\n\n    \n    setX : function(x, a, d, c, e){\n        this.setXY([x, this.getY()], a, d, c, e);\n        return this;\n    },\n\n    \n    setY : function(y, a, d, c, e){\n        this.setXY([this.getX(), y], a, d, c, e);\n        return this;\n    },\n\n    \n    setSize : function(w, h, a, d, c, e){\n        this.beforeAction();\n        var cb = this.createCB(c);\n        supr.setSize.call(this, w, h, a, d, cb, e);\n        if(!a){\n            cb();\n        }\n        return this;\n    },\n\n    \n    setWidth : function(w, a, d, c, e){\n        this.beforeAction();\n        var cb = this.createCB(c);\n        supr.setWidth.call(this, w, a, d, cb, e);\n        if(!a){\n            cb();\n        }\n        return this;\n    },\n\n    \n    setHeight : function(h, a, d, c, e){\n        this.beforeAction();\n        var cb = this.createCB(c);\n        supr.setHeight.call(this, h, a, d, cb, e);\n        if(!a){\n            cb();\n        }\n        return this;\n    },\n\n    \n    setBounds : function(x, y, w, h, a, d, c, e){\n        this.beforeAction();\n        var cb = this.createCB(c);\n        if(!a){\n            this.storeXY([x, y]);\n            supr.setXY.call(this, [x, y]);\n            supr.setSize.call(this, w, h, a, d, cb, e);\n            cb();\n        }else{\n            supr.setBounds.call(this, x, y, w, h, a, d, cb, e);\n        }\n        return this;\n    },\n\n    \n    setZIndex : function(zindex){\n        this.zindex = zindex;\n        this.setStyle('z-index', zindex + 2);\n        if(this.shadow){\n            this.shadow.setZIndex(zindex + 1);\n        }\n        if(this.shim){\n            this.shim.setStyle('z-index', zindex);\n        }\n        return this;\n    }\n});\n})();\n\nExt.Shadow = function(config) {\n    Ext.apply(this, config);\n    if (typeof this.mode != \"string\") {\n        this.mode = this.defaultMode;\n    }\n    var o = this.offset,\n        a = {\n            h: 0\n        },\n        rad = Math.floor(this.offset / 2);\n    switch (this.mode.toLowerCase()) {\n        \n        case \"drop\":\n            a.w = 0;\n            a.l = a.t = o;\n            a.t -= 1;\n            if (Ext.isIE9m) {\n                a.l -= this.offset + rad;\n                a.t -= this.offset + rad;\n                a.w -= rad;\n                a.h -= rad;\n                a.t += 1;\n            }\n        break;\n        case \"sides\":\n            a.w = (o * 2);\n            a.l = -o;\n            a.t = o - 1;\n            if (Ext.isIE9m) {\n                a.l -= (this.offset - rad);\n                a.t -= this.offset + rad;\n                a.l += 1;\n                a.w -= (this.offset - rad) * 2;\n                a.w -= rad + 1;\n                a.h -= 1;\n            }\n        break;\n        case \"frame\":\n            a.w = a.h = (o * 2);\n            a.l = a.t = -o;\n            a.t += 1;\n            a.h -= 2;\n            if (Ext.isIE9m) {\n                a.l -= (this.offset - rad);\n                a.t -= (this.offset - rad);\n                a.l += 1;\n                a.w -= (this.offset + rad + 1);\n                a.h -= (this.offset + rad);\n                a.h += 1;\n            }\n        break;\n    };\n\n    this.adjusts = a;\n};\n\nExt.Shadow.prototype = {\n    \n    \n    offset: 4,\n\n    \n    defaultMode: \"drop\",\n\n    \n    show: function(target) {\n        target = Ext.get(target);\n        if (!this.el) {\n            this.el = Ext.Shadow.Pool.pull();\n            if (this.el.dom.nextSibling != target.dom) {\n                this.el.insertBefore(target);\n            }\n        }\n        this.el.setStyle(\"z-index\", this.zIndex || parseInt(target.getStyle(\"z-index\"), 10) - 1);\n        if (Ext.isIE9m) {\n            this.el.dom.style.filter = \"progid:DXImageTransform.Microsoft.alpha(opacity=50) progid:DXImageTransform.Microsoft.Blur(pixelradius=\" + (this.offset) + \")\";\n        }\n        this.realign(\n        target.getLeft(true),\n        target.getTop(true),\n        target.getWidth(),\n        target.getHeight()\n        );\n        this.el.dom.style.display = \"block\";\n    },\n\n    \n    isVisible: function() {\n        return this.el ? true: false;\n    },\n\n    \n    realign: function(l, t, w, h) {\n        if (!this.el) {\n            return;\n        }\n        var a = this.adjusts,\n            d = this.el.dom,\n            s = d.style,\n            iea = 0,\n            sw = (w + a.w),\n            sh = (h + a.h),\n            sws = sw + \"px\",\n            shs = sh + \"px\",\n            cn,\n            sww;\n        s.left = (l + a.l) + \"px\";\n        s.top = (t + a.t) + \"px\";\n        if (s.width != sws || s.height != shs) {\n            s.width = sws;\n            s.height = shs;\n            if (!Ext.isIE9m) {\n                cn = d.childNodes;\n                sww = Math.max(0, (sw - 12)) + \"px\";\n                cn[0].childNodes[1].style.width = sww;\n                cn[1].childNodes[1].style.width = sww;\n                cn[2].childNodes[1].style.width = sww;\n                cn[1].style.height = Math.max(0, (sh - 12)) + \"px\";\n            }\n        }\n    },\n\n    \n    hide: function() {\n        if (this.el) {\n            this.el.dom.style.display = \"none\";\n            Ext.Shadow.Pool.push(this.el);\n            delete this.el;\n        }\n    },\n\n    \n    setZIndex: function(z) {\n        this.zIndex = z;\n        if (this.el) {\n            this.el.setStyle(\"z-index\", z);\n        }\n    }\n};\n\n\nExt.Shadow.Pool = function() {\n    var p = [],\n        markup = Ext.isIE9m ?\n            '<div class=\"x-ie-shadow\"></div>':\n            '<div class=\"x-shadow\"><div class=\"xst\"><div class=\"xstl\"></div><div class=\"xstc\"></div><div class=\"xstr\"></div></div><div class=\"xsc\"><div class=\"xsml\"></div><div class=\"xsmc\"></div><div class=\"xsmr\"></div></div><div class=\"xsb\"><div class=\"xsbl\"></div><div class=\"xsbc\"></div><div class=\"xsbr\"></div></div></div>';\n    return {\n        pull: function() {\n            var sh = p.shift();\n            if (!sh) {\n                sh = Ext.get(Ext.DomHelper.insertHtml(\"beforeBegin\", document.body.firstChild, markup));\n                sh.autoBoxAdjust = false;\n            }\n            return sh;\n        },\n\n        push: function(sh) {\n            p.push(sh);\n        }\n    };\n}();\nExt.BoxComponent = Ext.extend(Ext.Component, {\n\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n\n    \n\n    \n    initComponent : function(){\n        Ext.BoxComponent.superclass.initComponent.call(this);\n        this.addEvents(\n            \n            'resize',\n            \n            'move'\n        );\n    },\n\n    \n    boxReady : false,\n    \n    deferHeight: false,\n\n    \n    setSize : function(w, h){\n\n        \n        if(typeof w == 'object'){\n            h = w.height;\n            w = w.width;\n        }\n        if (Ext.isDefined(w) && Ext.isDefined(this.boxMinWidth) && (w < this.boxMinWidth)) {\n            w = this.boxMinWidth;\n        }\n        if (Ext.isDefined(h) && Ext.isDefined(this.boxMinHeight) && (h < this.boxMinHeight)) {\n            h = this.boxMinHeight;\n        }\n        if (Ext.isDefined(w) && Ext.isDefined(this.boxMaxWidth) && (w > this.boxMaxWidth)) {\n            w = this.boxMaxWidth;\n        }\n        if (Ext.isDefined(h) && Ext.isDefined(this.boxMaxHeight) && (h > this.boxMaxHeight)) {\n            h = this.boxMaxHeight;\n        }\n        \n        if(!this.boxReady){\n            this.width  = w;\n            this.height = h;\n            return this;\n        }\n\n        \n        if(this.cacheSizes !== false && this.lastSize && this.lastSize.width == w && this.lastSize.height == h){\n            return this;\n        }\n        this.lastSize = {width: w, height: h};\n        var adj = this.adjustSize(w, h),\n            aw = adj.width,\n            ah = adj.height,\n            rz;\n        if(aw !== undefined || ah !== undefined){ \n            rz = this.getResizeEl();\n            if(!this.deferHeight && aw !== undefined && ah !== undefined){\n                rz.setSize(aw, ah);\n            }else if(!this.deferHeight && ah !== undefined){\n                rz.setHeight(ah);\n            }else if(aw !== undefined){\n                rz.setWidth(aw);\n            }\n            this.onResize(aw, ah, w, h);\n            this.fireEvent('resize', this, aw, ah, w, h);\n        }\n        return this;\n    },\n\n    \n    setWidth : function(width){\n        return this.setSize(width);\n    },\n\n    \n    setHeight : function(height){\n        return this.setSize(undefined, height);\n    },\n\n    \n    getSize : function(){\n        return this.getResizeEl().getSize();\n    },\n\n    \n    getWidth : function(){\n        return this.getResizeEl().getWidth();\n    },\n\n    \n    getHeight : function(){\n        return this.getResizeEl().getHeight();\n    },\n\n    \n    getOuterSize : function(){\n        var el = this.getResizeEl();\n        return {width: el.getWidth() + el.getMargins('lr'),\n                height: el.getHeight() + el.getMargins('tb')};\n    },\n\n    \n    getPosition : function(local){\n        var el = this.getPositionEl();\n        if(local === true){\n            return [el.getLeft(true), el.getTop(true)];\n        }\n        return this.xy || el.getXY();\n    },\n\n    \n    getBox : function(local){\n        var pos = this.getPosition(local);\n        var s = this.getSize();\n        s.x = pos[0];\n        s.y = pos[1];\n        return s;\n    },\n\n    \n    updateBox : function(box){\n        this.setSize(box.width, box.height);\n        this.setPagePosition(box.x, box.y);\n        return this;\n    },\n\n    \n    getResizeEl : function(){\n        return this.resizeEl || this.el;\n    },\n\n    \n    setAutoScroll : function(scroll){\n        if(this.rendered){\n            this.getContentTarget().setOverflow(scroll ? 'auto' : '');\n        }\n        this.autoScroll = scroll;\n        return this;\n    },\n\n    \n    setPosition : function(x, y){\n        if(x && typeof x[1] == 'number'){\n            y = x[1];\n            x = x[0];\n        }\n        this.x = x;\n        this.y = y;\n        if(!this.boxReady){\n            return this;\n        }\n        var adj = this.adjustPosition(x, y);\n        var ax = adj.x, ay = adj.y;\n\n        var el = this.getPositionEl();\n        if(ax !== undefined || ay !== undefined){\n            if(ax !== undefined && ay !== undefined){\n                el.setLeftTop(ax, ay);\n            }else if(ax !== undefined){\n                el.setLeft(ax);\n            }else if(ay !== undefined){\n                el.setTop(ay);\n            }\n            this.onPosition(ax, ay);\n            this.fireEvent('move', this, ax, ay);\n        }\n        return this;\n    },\n\n    \n    setPagePosition : function(x, y){\n        if(x && typeof x[1] == 'number'){\n            y = x[1];\n            x = x[0];\n        }\n        this.pageX = x;\n        this.pageY = y;\n        if(!this.boxReady){\n            return;\n        }\n        if(x === undefined || y === undefined){ \n            return;\n        }\n        var p = this.getPositionEl().translatePoints(x, y);\n        this.setPosition(p.left, p.top);\n        return this;\n    },\n\n    \n    afterRender : function(){\n        Ext.BoxComponent.superclass.afterRender.call(this);\n        if(this.resizeEl){\n            this.resizeEl = Ext.get(this.resizeEl);\n        }\n        if(this.positionEl){\n            this.positionEl = Ext.get(this.positionEl);\n        }\n        this.boxReady = true;\n        Ext.isDefined(this.autoScroll) && this.setAutoScroll(this.autoScroll);\n        this.setSize(this.width, this.height);\n        if(this.x || this.y){\n            this.setPosition(this.x, this.y);\n        }else if(this.pageX || this.pageY){\n            this.setPagePosition(this.pageX, this.pageY);\n        }\n    },\n\n    \n    syncSize : function(){\n        delete this.lastSize;\n        this.setSize(this.autoWidth ? undefined : this.getResizeEl().getWidth(), this.autoHeight ? undefined : this.getResizeEl().getHeight());\n        return this;\n    },\n\n    \n    onResize : function(adjWidth, adjHeight, rawWidth, rawHeight){\n    },\n\n    \n    onPosition : function(x, y){\n\n    },\n\n    \n    adjustSize : function(w, h){\n        if(this.autoWidth){\n            w = 'auto';\n        }\n        if(this.autoHeight){\n            h = 'auto';\n        }\n        return {width : w, height: h};\n    },\n\n    \n    adjustPosition : function(x, y){\n        return {x : x, y: y};\n    }\n});\nExt.reg('box', Ext.BoxComponent);\n\n\n\nExt.Spacer = Ext.extend(Ext.BoxComponent, {\n    autoEl:'div'\n});\nExt.reg('spacer', Ext.Spacer);\nExt.SplitBar = function(dragElement, resizingElement, orientation, placement, existingProxy){\n\n    \n    this.el = Ext.get(dragElement, true);\n    this.el.unselectable();\n    \n    this.resizingEl = Ext.get(resizingElement, true);\n\n    \n    this.orientation = orientation || Ext.SplitBar.HORIZONTAL;\n\n    \n    \n    this.minSize = 0;\n\n    \n    this.maxSize = 2000;\n\n    \n    this.animate = false;\n\n    \n    this.useShim = false;\n\n    \n    this.shim = null;\n\n    if(!existingProxy){\n        \n        this.proxy = Ext.SplitBar.createProxy(this.orientation);\n    }else{\n        this.proxy = Ext.get(existingProxy).dom;\n    }\n    \n    this.dd = new Ext.dd.DDProxy(this.el.dom.id, \"XSplitBars\", {dragElId : this.proxy.id});\n\n    \n    this.dd.b4StartDrag = this.onStartProxyDrag.createDelegate(this);\n\n    \n    this.dd.endDrag = this.onEndProxyDrag.createDelegate(this);\n\n    \n    this.dragSpecs = {};\n\n    \n    this.adapter = new Ext.SplitBar.BasicLayoutAdapter();\n    this.adapter.init(this);\n\n    if(this.orientation == Ext.SplitBar.HORIZONTAL){\n        \n        this.placement = placement || (this.el.getX() > this.resizingEl.getX() ? Ext.SplitBar.LEFT : Ext.SplitBar.RIGHT);\n        this.el.addClass(\"x-splitbar-h\");\n    }else{\n        \n        this.placement = placement || (this.el.getY() > this.resizingEl.getY() ? Ext.SplitBar.TOP : Ext.SplitBar.BOTTOM);\n        this.el.addClass(\"x-splitbar-v\");\n    }\n\n    this.addEvents(\n        \n        \"resize\",\n        \n        \"moved\",\n        \n        \"beforeresize\",\n\n        \"beforeapply\"\n    );\n\n    Ext.SplitBar.superclass.constructor.call(this);\n};\n\nExt.extend(Ext.SplitBar, Ext.util.Observable, {\n    onStartProxyDrag : function(x, y){\n        this.fireEvent(\"beforeresize\", this);\n        this.overlay =  Ext.DomHelper.append(document.body,  {cls: \"x-drag-overlay\", html: \"&#160;\"}, true);\n        this.overlay.unselectable();\n        this.overlay.setSize(Ext.lib.Dom.getViewWidth(true), Ext.lib.Dom.getViewHeight(true));\n        this.overlay.show();\n        Ext.get(this.proxy).setDisplayed(\"block\");\n        var size = this.adapter.getElementSize(this);\n        this.activeMinSize = this.getMinimumSize();\n        this.activeMaxSize = this.getMaximumSize();\n        var c1 = size - this.activeMinSize;\n        var c2 = Math.max(this.activeMaxSize - size, 0);\n        if(this.orientation == Ext.SplitBar.HORIZONTAL){\n            this.dd.resetConstraints();\n            this.dd.setXConstraint(\n                this.placement == Ext.SplitBar.LEFT ? c1 : c2,\n                this.placement == Ext.SplitBar.LEFT ? c2 : c1,\n                this.tickSize\n            );\n            this.dd.setYConstraint(0, 0);\n        }else{\n            this.dd.resetConstraints();\n            this.dd.setXConstraint(0, 0);\n            this.dd.setYConstraint(\n                this.placement == Ext.SplitBar.TOP ? c1 : c2,\n                this.placement == Ext.SplitBar.TOP ? c2 : c1,\n                this.tickSize\n            );\n         }\n        this.dragSpecs.startSize = size;\n        this.dragSpecs.startPoint = [x, y];\n        Ext.dd.DDProxy.prototype.b4StartDrag.call(this.dd, x, y);\n    },\n\n    \n    onEndProxyDrag : function(e){\n        Ext.get(this.proxy).setDisplayed(false);\n        var endPoint = Ext.lib.Event.getXY(e);\n        if(this.overlay){\n            Ext.destroy(this.overlay);\n            delete this.overlay;\n        }\n        var newSize;\n        if(this.orientation == Ext.SplitBar.HORIZONTAL){\n            newSize = this.dragSpecs.startSize +\n                (this.placement == Ext.SplitBar.LEFT ?\n                    endPoint[0] - this.dragSpecs.startPoint[0] :\n                    this.dragSpecs.startPoint[0] - endPoint[0]\n                );\n        }else{\n            newSize = this.dragSpecs.startSize +\n                (this.placement == Ext.SplitBar.TOP ?\n                    endPoint[1] - this.dragSpecs.startPoint[1] :\n                    this.dragSpecs.startPoint[1] - endPoint[1]\n                );\n        }\n        newSize = Math.min(Math.max(newSize, this.activeMinSize), this.activeMaxSize);\n        if(newSize != this.dragSpecs.startSize){\n            if(this.fireEvent('beforeapply', this, newSize) !== false){\n                this.adapter.setElementSize(this, newSize);\n                this.fireEvent(\"moved\", this, newSize);\n                this.fireEvent(\"resize\", this, newSize);\n            }\n        }\n    },\n\n    \n    getAdapter : function(){\n        return this.adapter;\n    },\n\n    \n    setAdapter : function(adapter){\n        this.adapter = adapter;\n        this.adapter.init(this);\n    },\n\n    \n    getMinimumSize : function(){\n        return this.minSize;\n    },\n\n    \n    setMinimumSize : function(minSize){\n        this.minSize = minSize;\n    },\n\n    \n    getMaximumSize : function(){\n        return this.maxSize;\n    },\n\n    \n    setMaximumSize : function(maxSize){\n        this.maxSize = maxSize;\n    },\n\n    \n    setCurrentSize : function(size){\n        var oldAnimate = this.animate;\n        this.animate = false;\n        this.adapter.setElementSize(this, size);\n        this.animate = oldAnimate;\n    },\n\n    \n    destroy : function(removeEl){\n        Ext.destroy(this.shim, Ext.get(this.proxy));\n        this.dd.unreg();\n        if(removeEl){\n            this.el.remove();\n        }\n        this.purgeListeners();\n    }\n});\n\n\nExt.SplitBar.createProxy = function(dir){\n    var proxy = new Ext.Element(document.createElement(\"div\"));\n    document.body.appendChild(proxy.dom);\n    proxy.unselectable();\n    var cls = 'x-splitbar-proxy';\n    proxy.addClass(cls + ' ' + (dir == Ext.SplitBar.HORIZONTAL ? cls +'-h' : cls + '-v'));\n    return proxy.dom;\n};\n\n\nExt.SplitBar.BasicLayoutAdapter = function(){\n};\n\nExt.SplitBar.BasicLayoutAdapter.prototype = {\n    \n    init : function(s){\n\n    },\n    \n     getElementSize : function(s){\n        if(s.orientation == Ext.SplitBar.HORIZONTAL){\n            return s.resizingEl.getWidth();\n        }else{\n            return s.resizingEl.getHeight();\n        }\n    },\n\n    \n    setElementSize : function(s, newSize, onComplete){\n        if(s.orientation == Ext.SplitBar.HORIZONTAL){\n            if(!s.animate){\n                s.resizingEl.setWidth(newSize);\n                if(onComplete){\n                    onComplete(s, newSize);\n                }\n            }else{\n                s.resizingEl.setWidth(newSize, true, .1, onComplete, 'easeOut');\n            }\n        }else{\n\n            if(!s.animate){\n                s.resizingEl.setHeight(newSize);\n                if(onComplete){\n                    onComplete(s, newSize);\n                }\n            }else{\n                s.resizingEl.setHeight(newSize, true, .1, onComplete, 'easeOut');\n            }\n        }\n    }\n};\n\n\nExt.SplitBar.AbsoluteLayoutAdapter = function(container){\n    this.basic = new Ext.SplitBar.BasicLayoutAdapter();\n    this.container = Ext.get(container);\n};\n\nExt.SplitBar.AbsoluteLayoutAdapter.prototype = {\n    init : function(s){\n        this.basic.init(s);\n    },\n\n    getElementSize : function(s){\n        return this.basic.getElementSize(s);\n    },\n\n    setElementSize : function(s, newSize, onComplete){\n        this.basic.setElementSize(s, newSize, this.moveSplitter.createDelegate(this, [s]));\n    },\n\n    moveSplitter : function(s){\n        var yes = Ext.SplitBar;\n        switch(s.placement){\n            case yes.LEFT:\n                s.el.setX(s.resizingEl.getRight());\n                break;\n            case yes.RIGHT:\n                s.el.setStyle(\"right\", (this.container.getWidth() - s.resizingEl.getLeft()) + \"px\");\n                break;\n            case yes.TOP:\n                s.el.setY(s.resizingEl.getBottom());\n                break;\n            case yes.BOTTOM:\n                s.el.setY(s.resizingEl.getTop() - s.el.getHeight());\n                break;\n        }\n    }\n};\n\n\nExt.SplitBar.VERTICAL = 1;\n\n\nExt.SplitBar.HORIZONTAL = 2;\n\n\nExt.SplitBar.LEFT = 1;\n\n\nExt.SplitBar.RIGHT = 2;\n\n\nExt.SplitBar.TOP = 3;\n\n\nExt.SplitBar.BOTTOM = 4;\n\nExt.Container = Ext.extend(Ext.BoxComponent, {\n    \n    \n    \n    \n    bufferResize: 50,\n\n    \n    \n    \n\n\n    \n    autoDestroy : true,\n\n    \n    forceLayout: false,\n\n    \n    \n    defaultType : 'panel',\n\n    \n    resizeEvent: 'resize',\n\n    \n    bubbleEvents: ['add', 'remove'],\n\n    \n    initComponent : function(){\n        Ext.Container.superclass.initComponent.call(this);\n\n        this.addEvents(\n            \n            'afterlayout',\n            \n            'beforeadd',\n            \n            'beforeremove',\n            \n            'add',\n            \n            'remove'\n        );\n\n        \n        var items = this.items;\n        if(items){\n            delete this.items;\n            this.add(items);\n        }\n    },\n\n    \n    initItems : function(){\n        if(!this.items){\n            this.items = new Ext.util.MixedCollection(false, this.getComponentId);\n            this.getLayout(); \n        }\n    },\n\n    \n    setLayout : function(layout){\n        if(this.layout && this.layout != layout){\n            this.layout.setContainer(null);\n        }\n        this.layout = layout;\n        this.initItems();\n        layout.setContainer(this);\n    },\n\n    afterRender: function(){\n        \n        \n        Ext.Container.superclass.afterRender.call(this);\n        if(!this.layout){\n            this.layout = 'auto';\n        }\n        if(Ext.isObject(this.layout) && !this.layout.layout){\n            this.layoutConfig = this.layout;\n            this.layout = this.layoutConfig.type;\n        }\n        if(Ext.isString(this.layout)){\n            this.layout = new Ext.Container.LAYOUTS[this.layout.toLowerCase()](this.layoutConfig);\n        }\n        this.setLayout(this.layout);\n\n        \n        if(this.activeItem !== undefined && this.layout.setActiveItem){\n            var item = this.activeItem;\n            delete this.activeItem;\n            this.layout.setActiveItem(item);\n        }\n\n        \n        if(!this.ownerCt){\n            this.doLayout(false, true);\n        }\n\n        \n        \n        if(this.monitorResize === true){\n            Ext.EventManager.onWindowResize(this.doLayout, this, [false]);\n        }\n    },\n\n    \n    getLayoutTarget : function(){\n        return this.el;\n    },\n\n    \n    getComponentId : function(comp){\n        return comp.getItemId();\n    },\n\n    \n    add : function(comp){\n        this.initItems();\n        var args = arguments.length > 1;\n        if(args || Ext.isArray(comp)){\n            var result = [];\n            Ext.each(args ? arguments : comp, function(c){\n                result.push(this.add(c));\n            }, this);\n            return result;\n        }\n        var c = this.lookupComponent(this.applyDefaults(comp));\n        var index = this.items.length;\n        if(this.fireEvent('beforeadd', this, c, index) !== false && this.onBeforeAdd(c) !== false){\n            this.items.add(c);\n            \n            c.onAdded(this, index);\n            this.onAdd(c);\n            this.fireEvent('add', this, c, index);\n        }\n        return c;\n    },\n\n    onAdd : function(c){\n        \n    },\n\n    \n    onAdded : function(container, pos) {\n        \n        this.ownerCt = container;\n        this.initRef();\n        \n        this.cascade(function(c){\n            c.initRef();\n        });\n        this.fireEvent('added', this, container, pos);\n    },\n\n    \n    insert : function(index, comp) {\n        var args   = arguments,\n            length = args.length,\n            result = [],\n            i, c;\n        \n        this.initItems();\n        \n        if (length > 2) {\n            for (i = length - 1; i >= 1; --i) {\n                result.push(this.insert(index, args[i]));\n            }\n            return result;\n        }\n        \n        c = this.lookupComponent(this.applyDefaults(comp));\n        index = Math.min(index, this.items.length);\n        \n        if (this.fireEvent('beforeadd', this, c, index) !== false && this.onBeforeAdd(c) !== false) {\n            if (c.ownerCt == this) {\n                this.items.remove(c);\n            }\n            this.items.insert(index, c);\n            c.onAdded(this, index);\n            this.onAdd(c);\n            this.fireEvent('add', this, c, index);\n        }\n        \n        return c;\n    },\n\n    \n    applyDefaults : function(c){\n        var d = this.defaults;\n        if(d){\n            if(Ext.isFunction(d)){\n                d = d.call(this, c);\n            }\n            if(Ext.isString(c)){\n                c = Ext.ComponentMgr.get(c);\n                Ext.apply(c, d);\n            }else if(!c.events){\n                Ext.applyIf(c.isAction ? c.initialConfig : c, d);\n            }else{\n                Ext.apply(c, d);\n            }\n        }\n        return c;\n    },\n\n    \n    onBeforeAdd : function(item){\n        if(item.ownerCt){\n            item.ownerCt.remove(item, false);\n        }\n        if(this.hideBorders === true){\n            item.border = (item.border === true);\n        }\n    },\n\n    \n    remove : function(comp, autoDestroy){\n        this.initItems();\n        var c = this.getComponent(comp);\n        if(c && this.fireEvent('beforeremove', this, c) !== false){\n            this.doRemove(c, autoDestroy);\n            this.fireEvent('remove', this, c);\n        }\n        return c;\n    },\n\n    onRemove: function(c){\n        \n    },\n\n    \n    doRemove: function(c, autoDestroy){\n        var l = this.layout,\n            hasLayout = l && this.rendered;\n\n        if(hasLayout){\n            l.onRemove(c);\n        }\n        this.items.remove(c);\n        c.onRemoved();\n        this.onRemove(c);\n        if(autoDestroy === true || (autoDestroy !== false && this.autoDestroy)){\n            c.destroy();\n        }\n        if(hasLayout){\n            l.afterRemove(c);\n        }\n    },\n\n    \n    removeAll: function(autoDestroy){\n        this.initItems();\n        var item, rem = [], items = [];\n        this.items.each(function(i){\n            rem.push(i);\n        });\n        for (var i = 0, len = rem.length; i < len; ++i){\n            item = rem[i];\n            this.remove(item, autoDestroy);\n            if(item.ownerCt !== this){\n                items.push(item);\n            }\n        }\n        return items;\n    },\n\n    \n    getComponent : function(comp){\n        if(Ext.isObject(comp)){\n            comp = comp.getItemId();\n        }\n        return this.items.get(comp);\n    },\n\n    \n    lookupComponent : function(comp){\n        if(Ext.isString(comp)){\n            return Ext.ComponentMgr.get(comp);\n        }else if(!comp.events){\n            return this.createComponent(comp);\n        }\n        return comp;\n    },\n\n    \n    createComponent : function(config, defaultType){\n        if (config.render) {\n            return config;\n        }\n        \n        \n        var c = Ext.create(Ext.apply({\n            ownerCt: this\n        }, config), defaultType || this.defaultType);\n        delete c.initialConfig.ownerCt;\n        delete c.ownerCt;\n        return c;\n    },\n\n    \n    canLayout : function() {\n        var el = this.getVisibilityEl();\n        return el && el.dom && !el.isStyle(\"display\", \"none\");\n    },\n\n    \n\n    doLayout : function(shallow, force){\n        var rendered = this.rendered,\n            forceLayout = force || this.forceLayout;\n\n        if(this.collapsed || !this.canLayout()){\n            this.deferLayout = this.deferLayout || !shallow;\n            if(!forceLayout){\n                return;\n            }\n            shallow = shallow && !this.deferLayout;\n        } else {\n            delete this.deferLayout;\n        }\n        if(rendered && this.layout){\n            this.layout.layout();\n        }\n        if(shallow !== true && this.items){\n            var cs = this.items.items;\n            for(var i = 0, len = cs.length; i < len; i++){\n                var c = cs[i];\n                if(c.doLayout){\n                    c.doLayout(false, forceLayout);\n                }\n            }\n        }\n        if(rendered){\n            this.onLayout(shallow, forceLayout);\n        }\n        \n        this.hasLayout = true;\n        delete this.forceLayout;\n    },\n\n    onLayout : Ext.emptyFn,\n\n    \n    shouldBufferLayout: function(){\n        \n        var hl = this.hasLayout;\n        if(this.ownerCt){\n            \n            return hl ? !this.hasLayoutPending() : false;\n        }\n        \n        return hl;\n    },\n\n    \n    hasLayoutPending: function(){\n        \n        var pending = false;\n        this.ownerCt.bubble(function(c){\n            if(c.layoutPending){\n                pending = true;\n                return false;\n            }\n        });\n        return pending;\n    },\n\n    onShow : function(){\n        \n        Ext.Container.superclass.onShow.call(this);\n        \n        if(Ext.isDefined(this.deferLayout)){\n            delete this.deferLayout;\n            this.doLayout(true);\n        }\n    },\n\n    \n    getLayout : function(){\n        if(!this.layout){\n            var layout = new Ext.layout.AutoLayout(this.layoutConfig);\n            this.setLayout(layout);\n        }\n        return this.layout;\n    },\n\n    \n    beforeDestroy : function(){\n        var c;\n        if(this.items){\n            while(c = this.items.first()){\n                this.doRemove(c, true);\n            }\n        }\n        if(this.monitorResize){\n            Ext.EventManager.removeResizeListener(this.doLayout, this);\n        }\n        Ext.destroy(this.layout);\n        Ext.Container.superclass.beforeDestroy.call(this);\n    },\n\n    \n    cascade : function(fn, scope, args){\n        if(fn.apply(scope || this, args || [this]) !== false){\n            if(this.items){\n                var cs = this.items.items;\n                for(var i = 0, len = cs.length; i < len; i++){\n                    if(cs[i].cascade){\n                        cs[i].cascade(fn, scope, args);\n                    }else{\n                        fn.apply(scope || cs[i], args || [cs[i]]);\n                    }\n                }\n            }\n        }\n        return this;\n    },\n\n    \n    findById : function(id){\n        var m = null, \n            ct = this;\n        this.cascade(function(c){\n            if(ct != c && c.id === id){\n                m = c;\n                return false;\n            }\n        });\n        return m;\n    },\n\n    \n    findByType : function(xtype, shallow){\n        return this.findBy(function(c){\n            return c.isXType(xtype, shallow);\n        });\n    },\n\n    \n    find : function(prop, value){\n        return this.findBy(function(c){\n            return c[prop] === value;\n        });\n    },\n\n    \n    findBy : function(fn, scope){\n        var m = [], ct = this;\n        this.cascade(function(c){\n            if(ct != c && fn.call(scope || c, c, ct) === true){\n                m.push(c);\n            }\n        });\n        return m;\n    },\n\n    \n    get : function(key){\n        return this.getComponent(key);\n    }\n});\n\nExt.Container.LAYOUTS = {};\nExt.reg('container', Ext.Container);\n\nExt.layout.ContainerLayout = Ext.extend(Object, {\n    \n    \n\n    \n\n    \n    monitorResize:false,\n    \n    activeItem : null,\n\n    constructor : function(config){\n        this.id = Ext.id(null, 'ext-layout-');\n        Ext.apply(this, config);\n    },\n\n    type: 'container',\n\n    \n    IEMeasureHack : function(target, viewFlag) {\n        var tChildren = target.dom.childNodes, tLen = tChildren.length, c, d = [], e, i, ret;\n        for (i = 0 ; i < tLen ; i++) {\n            c = tChildren[i];\n            e = Ext.get(c);\n            if (e) {\n                d[i] = e.getStyle('display');\n                e.setStyle({display: 'none'});\n            }\n        }\n        ret = target ? target.getViewSize(viewFlag) : {};\n        for (i = 0 ; i < tLen ; i++) {\n            c = tChildren[i];\n            e = Ext.get(c);\n            if (e) {\n                e.setStyle({display: d[i]});\n            }\n        }\n        return ret;\n    },\n\n    \n    getLayoutTargetSize : Ext.EmptyFn,\n\n    \n    layout : function(){\n        var ct = this.container, target = ct.getLayoutTarget();\n        if(!(this.hasLayout || Ext.isEmpty(this.targetCls))){\n            target.addClass(this.targetCls);\n        }\n        this.onLayout(ct, target);\n        ct.fireEvent('afterlayout', ct, this);\n    },\n\n    \n    onLayout : function(ct, target){\n        this.renderAll(ct, target);\n    },\n\n    \n    isValidParent : function(c, target){\n        return target && c.getPositionEl().dom.parentNode == (target.dom || target);\n    },\n\n    \n    renderAll : function(ct, target){\n        var items = ct.items.items, i, c, len = items.length;\n        for(i = 0; i < len; i++) {\n            c = items[i];\n            if(c && (!c.rendered || !this.isValidParent(c, target))){\n                this.renderItem(c, i, target);\n            }\n        }\n    },\n\n    \n    renderItem : function(c, position, target){\n        if (c) {\n            if (!c.rendered) {\n                c.render(target, position);\n                this.configureItem(c);\n            } else if (!this.isValidParent(c, target)) {\n                if (Ext.isNumber(position)) {\n                    position = target.dom.childNodes[position];\n                }\n\n                target.dom.insertBefore(c.getPositionEl().dom, position || null);\n                c.container = target;\n                this.configureItem(c);\n            }\n        }\n    },\n\n    \n    \n    getRenderedItems: function(ct){\n        var t = ct.getLayoutTarget(), cti = ct.items.items, len = cti.length, i, c, items = [];\n        for (i = 0; i < len; i++) {\n            if((c = cti[i]).rendered && this.isValidParent(c, t) && c.shouldLayout !== false){\n                items.push(c);\n            }\n        };\n        return items;\n    },\n\n    \n    configureItem: function(c){\n        if (this.extraCls) {\n            var t = c.getPositionEl ? c.getPositionEl() : c;\n            t.addClass(this.extraCls);\n        }\n\n        \n        if (c.doLayout && this.forceLayout) {\n            c.doLayout();\n        }\n        if (this.renderHidden && c != this.activeItem) {\n            c.hide();\n        }\n    },\n\n    onRemove: function(c){\n        if(this.activeItem == c){\n            delete this.activeItem;\n        }\n        if(c.rendered && this.extraCls){\n            var t = c.getPositionEl ? c.getPositionEl() : c;\n            t.removeClass(this.extraCls);\n        }\n    },\n\n    afterRemove: function(c){\n        if(c.removeRestore){\n            c.removeMode = 'container';\n            delete c.removeRestore;\n        }\n    },\n\n    \n    onResize: function(){\n        var ct = this.container,\n            b;\n        if(ct.collapsed){\n            return;\n        }\n        if(b = ct.bufferResize && ct.shouldBufferLayout()){\n            if(!this.resizeTask){\n                this.resizeTask = new Ext.util.DelayedTask(this.runLayout, this);\n                this.resizeBuffer = Ext.isNumber(b) ? b : 50;\n            }\n            ct.layoutPending = true;\n            this.resizeTask.delay(this.resizeBuffer);\n        }else{\n            this.runLayout();\n        }\n    },\n\n    runLayout: function(){\n        var ct = this.container;\n        this.layout();\n        ct.onLayout();\n        delete ct.layoutPending;\n    },\n\n    \n    setContainer : function(ct){\n        \n        if(this.monitorResize && ct != this.container){\n            var old = this.container;\n            if(old){\n                old.un(old.resizeEvent, this.onResize, this);\n            }\n            if(ct){\n                ct.on(ct.resizeEvent, this.onResize, this);\n            }\n        }\n        this.container = ct;\n    },\n\n    \n    parseMargins : function(v){\n        if (Ext.isNumber(v)) {\n            v = v.toString();\n        }\n        var ms  = v.split(' '),\n            len = ms.length;\n\n        if (len == 1) {\n            ms[1] = ms[2] = ms[3] = ms[0];\n        } else if(len == 2) {\n            ms[2] = ms[0];\n            ms[3] = ms[1];\n        } else if(len == 3) {\n            ms[3] = ms[1];\n        }\n\n        return {\n            top   :parseInt(ms[0], 10) || 0,\n            right :parseInt(ms[1], 10) || 0,\n            bottom:parseInt(ms[2], 10) || 0,\n            left  :parseInt(ms[3], 10) || 0\n        };\n    },\n\n    \n    fieldTpl: (function() {\n        var t = new Ext.Template(\n            '<div class=\"x-form-item {itemCls}\" tabIndex=\"-1\">',\n                '<label for=\"{id}\" style=\"{labelStyle}\" class=\"x-form-item-label\">{label}{labelSeparator}</label>',\n                '<div class=\"x-form-element\" id=\"x-form-el-{id}\" style=\"{elementStyle}\">',\n                '</div><div class=\"{clearCls}\"></div>',\n            '</div>'\n        );\n        t.disableFormats = true;\n        return t.compile();\n    })(),\n\n    \n    destroy : function(){\n        \n        if(this.resizeTask && this.resizeTask.cancel){\n            this.resizeTask.cancel();\n        }\n        if(this.container) {\n            this.container.un(this.container.resizeEvent, this.onResize, this);\n        }\n        if(!Ext.isEmpty(this.targetCls)){\n            var target = this.container.getLayoutTarget();\n            if(target){\n                target.removeClass(this.targetCls);\n            }\n        }\n    }\n});\nExt.layout.AutoLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    type: 'auto',\n\n    monitorResize: true,\n\n    onLayout : function(ct, target){\n        Ext.layout.AutoLayout.superclass.onLayout.call(this, ct, target);\n        var cs = this.getRenderedItems(ct), len = cs.length, i, c;\n        for(i = 0; i < len; i++){\n            c = cs[i];\n            if (c.doLayout){\n                \n                c.doLayout(true);\n            }\n        }\n    }\n});\n\nExt.Container.LAYOUTS['auto'] = Ext.layout.AutoLayout;\n\nExt.layout.FitLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    \n    monitorResize:true,\n\n    type: 'fit',\n\n    getLayoutTargetSize : function() {\n        var target = this.container.getLayoutTarget();\n        if (!target) {\n            return {};\n        }\n        \n        return target.getStyleSize();\n    },\n\n    \n    onLayout : function(ct, target){\n        Ext.layout.FitLayout.superclass.onLayout.call(this, ct, target);\n        if(!ct.collapsed){\n            this.setItemSize(this.activeItem || ct.items.itemAt(0), this.getLayoutTargetSize());\n        }\n    },\n\n    \n    setItemSize : function(item, size){\n        if(item && size.height > 0){ \n            item.setSize(size);\n        }\n    }\n});\nExt.Container.LAYOUTS['fit'] = Ext.layout.FitLayout;\nExt.layout.CardLayout = Ext.extend(Ext.layout.FitLayout, {\n    \n    deferredRender : false,\n\n    \n    layoutOnCardChange : false,\n\n    \n    \n    renderHidden : true,\n\n    type: 'card',\n\n    \n    setActiveItem : function(item){\n        var ai = this.activeItem,\n            ct = this.container;\n        item = ct.getComponent(item);\n\n        \n        if(item && ai != item){\n\n            \n            if(ai){\n                ai.hide();\n                if (ai.hidden !== true) {\n                    return false;\n                }\n                ai.fireEvent('deactivate', ai);\n            }\n\n            var layout = item.doLayout && (this.layoutOnCardChange || !item.rendered);\n\n            \n            this.activeItem = item;\n\n            \n            \n            delete item.deferLayout;\n\n            \n            item.show();\n\n            this.layout();\n\n            if(layout){\n                item.doLayout();\n            }\n            item.fireEvent('activate', item);\n        }\n    },\n\n    \n    renderAll : function(ct, target){\n        if(this.deferredRender){\n            this.renderItem(this.activeItem, undefined, target);\n        }else{\n            Ext.layout.CardLayout.superclass.renderAll.call(this, ct, target);\n        }\n    }\n});\nExt.Container.LAYOUTS['card'] = Ext.layout.CardLayout;\n\nExt.layout.AnchorLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    \n\n    \n    monitorResize : true,\n\n    type : 'anchor',\n\n    \n    defaultAnchor : '100%',\n\n    parseAnchorRE : /^(r|right|b|bottom)$/i,\n\n\n    getLayoutTargetSize : function() {\n        var target = this.container.getLayoutTarget(), ret = {};\n        if (target) {\n            ret = target.getViewSize();\n\n            \n            \n            \n            if (Ext.isIE9m && Ext.isStrict && ret.width == 0){\n                ret =  target.getStyleSize();\n            }\n            ret.width -= target.getPadding('lr');\n            ret.height -= target.getPadding('tb');\n        }\n        return ret;\n    },\n\n    \n    onLayout : function(container, target) {\n        Ext.layout.AnchorLayout.superclass.onLayout.call(this, container, target);\n\n        var size = this.getLayoutTargetSize(),\n            containerWidth = size.width,\n            containerHeight = size.height,\n            overflow = target.getStyle('overflow'),\n            components = this.getRenderedItems(container),\n            len = components.length,\n            boxes = [],\n            box,\n            anchorWidth,\n            anchorHeight,\n            component,\n            anchorSpec,\n            calcWidth,\n            calcHeight,\n            anchorsArray,\n            totalHeight = 0,\n            i,\n            el;\n\n        if(containerWidth < 20 && containerHeight < 20){\n            return;\n        }\n\n        \n        if(container.anchorSize) {\n            if(typeof container.anchorSize == 'number') {\n                anchorWidth = container.anchorSize;\n            } else {\n                anchorWidth = container.anchorSize.width;\n                anchorHeight = container.anchorSize.height;\n            }\n        } else {\n            anchorWidth = container.initialConfig.width;\n            anchorHeight = container.initialConfig.height;\n        }\n\n        for(i = 0; i < len; i++) {\n            component = components[i];\n            el = component.getPositionEl();\n\n            \n            if (!component.anchor && component.items && !Ext.isNumber(component.width) && !(Ext.isIE6 && Ext.isStrict)){\n                component.anchor = this.defaultAnchor;\n            }\n\n            if(component.anchor) {\n                anchorSpec = component.anchorSpec;\n                \n                if(!anchorSpec){\n                    anchorsArray = component.anchor.split(' ');\n                    component.anchorSpec = anchorSpec = {\n                        right: this.parseAnchor(anchorsArray[0], component.initialConfig.width, anchorWidth),\n                        bottom: this.parseAnchor(anchorsArray[1], component.initialConfig.height, anchorHeight)\n                    };\n                }\n                calcWidth = anchorSpec.right ? this.adjustWidthAnchor(anchorSpec.right(containerWidth) - el.getMargins('lr'), component) : undefined;\n                calcHeight = anchorSpec.bottom ? this.adjustHeightAnchor(anchorSpec.bottom(containerHeight) - el.getMargins('tb'), component) : undefined;\n\n                if(calcWidth || calcHeight) {\n                    boxes.push({\n                        component: component,\n                        width: calcWidth || undefined,\n                        height: calcHeight || undefined\n                    });\n                }\n            }\n        }\n        for (i = 0, len = boxes.length; i < len; i++) {\n            box = boxes[i];\n            box.component.setSize(box.width, box.height);\n        }\n\n        if (overflow && overflow != 'hidden' && !this.adjustmentPass) {\n            var newTargetSize = this.getLayoutTargetSize();\n            if (newTargetSize.width != size.width || newTargetSize.height != size.height){\n                this.adjustmentPass = true;\n                this.onLayout(container, target);\n            }\n        }\n\n        delete this.adjustmentPass;\n    },\n\n    \n    parseAnchor : function(a, start, cstart) {\n        if (a && a != 'none') {\n            var last;\n            \n            if (this.parseAnchorRE.test(a)) {\n                var diff = cstart - start;\n                return function(v){\n                    if(v !== last){\n                        last = v;\n                        return v - diff;\n                    }\n                };\n            \n            } else if(a.indexOf('%') != -1) {\n                var ratio = parseFloat(a.replace('%', ''))*.01;\n                return function(v){\n                    if(v !== last){\n                        last = v;\n                        return Math.floor(v*ratio);\n                    }\n                };\n            \n            } else {\n                a = parseInt(a, 10);\n                if (!isNaN(a)) {\n                    return function(v) {\n                        if (v !== last) {\n                            last = v;\n                            return v + a;\n                        }\n                    };\n                }\n            }\n        }\n        return false;\n    },\n\n    \n    adjustWidthAnchor : function(value, comp){\n        return value;\n    },\n\n    \n    adjustHeightAnchor : function(value, comp){\n        return value;\n    }\n\n    \n});\nExt.Container.LAYOUTS['anchor'] = Ext.layout.AnchorLayout;\n\nExt.layout.ColumnLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    \n    monitorResize:true,\n\n    type: 'column',\n\n    extraCls: 'x-column',\n\n    scrollOffset : 0,\n\n    \n\n    targetCls: 'x-column-layout-ct',\n\n    isValidParent : function(c, target){\n        return this.innerCt && c.getPositionEl().dom.parentNode == this.innerCt.dom;\n    },\n\n    getLayoutTargetSize : function() {\n        var target = this.container.getLayoutTarget(), ret;\n        if (target) {\n            ret = target.getViewSize();\n\n            \n            \n            \n            if (Ext.isIE9m && Ext.isStrict && ret.width == 0){\n                ret =  target.getStyleSize();\n            }\n\n            ret.width -= target.getPadding('lr');\n            ret.height -= target.getPadding('tb');\n        }\n        return ret;\n    },\n\n    renderAll : function(ct, target) {\n        if(!this.innerCt){\n            \n            \n            this.innerCt = target.createChild({cls:'x-column-inner'});\n            this.innerCt.createChild({cls:'x-clear'});\n        }\n        Ext.layout.ColumnLayout.superclass.renderAll.call(this, ct, this.innerCt);\n    },\n\n    \n    onLayout : function(ct, target){\n        var cs = ct.items.items,\n            len = cs.length,\n            c,\n            i,\n            m,\n            margins = [];\n\n        this.renderAll(ct, target);\n\n        var size = this.getLayoutTargetSize();\n\n        if (Ext.isIE9m && (size.width < 1 && size.height < 1)) { \n            return;\n        }\n\n        var w = size.width - this.scrollOffset,\n            h = size.height,\n            pw = w;\n\n        this.innerCt.setWidth(w);\n\n        \n        \n\n        for(i = 0; i < len; i++){\n            c = cs[i];\n            m = c.getPositionEl().getMargins('lr');\n            margins[i] = m;\n            if(!c.columnWidth){\n                pw -= (c.getWidth() + m);\n            }\n        }\n\n        pw = pw < 0 ? 0 : pw;\n\n        for(i = 0; i < len; i++){\n            c = cs[i];\n            m = margins[i];\n            if(c.columnWidth){\n                c.setSize(Math.floor(c.columnWidth * pw) - m);\n            }\n        }\n\n        \n        \n        if (Ext.isIE9m) {\n            if (i = target.getStyle('overflow') && i != 'hidden' && !this.adjustmentPass) {\n                var ts = this.getLayoutTargetSize();\n                if (ts.width != size.width){\n                    this.adjustmentPass = true;\n                    this.onLayout(ct, target);\n                }\n            }\n        }\n        delete this.adjustmentPass;\n    }\n\n    \n});\n\nExt.Container.LAYOUTS['column'] = Ext.layout.ColumnLayout;\n\nExt.layout.BorderLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    \n    monitorResize:true,\n    \n    rendered : false,\n\n    type: 'border',\n\n    targetCls: 'x-border-layout-ct',\n\n    getLayoutTargetSize : function() {\n        var target = this.container.getLayoutTarget();\n        return target ? target.getViewSize() : {};\n    },\n\n    \n    onLayout : function(ct, target){\n        var collapsed, i, c, pos, items = ct.items.items, len = items.length;\n        if(!this.rendered){\n            collapsed = [];\n            for(i = 0; i < len; i++) {\n                c = items[i];\n                pos = c.region;\n                if(c.collapsed){\n                    collapsed.push(c);\n                }\n                c.collapsed = false;\n                if(!c.rendered){\n                    c.render(target, i);\n                    c.getPositionEl().addClass('x-border-panel');\n                }\n                this[pos] = pos != 'center' && c.split ?\n                    new Ext.layout.BorderLayout.SplitRegion(this, c.initialConfig, pos) :\n                    new Ext.layout.BorderLayout.Region(this, c.initialConfig, pos);\n                this[pos].render(target, c);\n            }\n            this.rendered = true;\n        }\n\n        var size = this.getLayoutTargetSize();\n        if(size.width < 20 || size.height < 20){ \n            if(collapsed){\n                this.restoreCollapsed = collapsed;\n            }\n            return;\n        }else if(this.restoreCollapsed){\n            collapsed = this.restoreCollapsed;\n            delete this.restoreCollapsed;\n        }\n\n        var w = size.width, h = size.height,\n            centerW = w, centerH = h, centerY = 0, centerX = 0,\n            n = this.north, s = this.south, west = this.west, e = this.east, c = this.center,\n            b, m, totalWidth, totalHeight;\n        if(!c && Ext.layout.BorderLayout.WARN !== false){\n            throw 'No center region defined in BorderLayout ' + ct.id;\n        }\n\n        if(n && n.isVisible()){\n            b = n.getSize();\n            m = n.getMargins();\n            b.width = w - (m.left+m.right);\n            b.x = m.left;\n            b.y = m.top;\n            centerY = b.height + b.y + m.bottom;\n            centerH -= centerY;\n            n.applyLayout(b);\n        }\n        if(s && s.isVisible()){\n            b = s.getSize();\n            m = s.getMargins();\n            b.width = w - (m.left+m.right);\n            b.x = m.left;\n            totalHeight = (b.height + m.top + m.bottom);\n            b.y = h - totalHeight + m.top;\n            centerH -= totalHeight;\n            s.applyLayout(b);\n        }\n        if(west && west.isVisible()){\n            b = west.getSize();\n            m = west.getMargins();\n            b.height = centerH - (m.top+m.bottom);\n            b.x = m.left;\n            b.y = centerY + m.top;\n            totalWidth = (b.width + m.left + m.right);\n            centerX += totalWidth;\n            centerW -= totalWidth;\n            west.applyLayout(b);\n        }\n        if(e && e.isVisible()){\n            b = e.getSize();\n            m = e.getMargins();\n            b.height = centerH - (m.top+m.bottom);\n            totalWidth = (b.width + m.left + m.right);\n            b.x = w - totalWidth + m.left;\n            b.y = centerY + m.top;\n            centerW -= totalWidth;\n            e.applyLayout(b);\n        }\n        if(c){\n            m = c.getMargins();\n            var centerBox = {\n                x: centerX + m.left,\n                y: centerY + m.top,\n                width: centerW - (m.left+m.right),\n                height: centerH - (m.top+m.bottom)\n            };\n            c.applyLayout(centerBox);\n        }\n        if(collapsed){\n            for(i = 0, len = collapsed.length; i < len; i++){\n                collapsed[i].collapse(false);\n            }\n        }\n        if(Ext.isIE9m && Ext.isStrict){ \n            target.repaint();\n        }\n        \n        if (i = target.getStyle('overflow') && i != 'hidden' && !this.adjustmentPass) {\n            var ts = this.getLayoutTargetSize();\n            if (ts.width != size.width || ts.height != size.height){\n                this.adjustmentPass = true;\n                this.onLayout(ct, target);\n            }\n        }\n        delete this.adjustmentPass;\n    },\n\n    destroy: function() {\n        var r = ['north', 'south', 'east', 'west'], i, region;\n        for (i = 0; i < r.length; i++) {\n            region = this[r[i]];\n            if(region){\n                if(region.destroy){\n                    region.destroy();\n                }else if (region.split){\n                    region.split.destroy(true);\n                }\n            }\n        }\n        Ext.layout.BorderLayout.superclass.destroy.call(this);\n    }\n\n    \n});\n\n\nExt.layout.BorderLayout.Region = function(layout, config, pos){\n    Ext.apply(this, config);\n    this.layout = layout;\n    this.position = pos;\n    this.state = {};\n    if(typeof this.margins == 'string'){\n        this.margins = this.layout.parseMargins(this.margins);\n    }\n    this.margins = Ext.applyIf(this.margins || {}, this.defaultMargins);\n    if(this.collapsible){\n        if(typeof this.cmargins == 'string'){\n            this.cmargins = this.layout.parseMargins(this.cmargins);\n        }\n        if(this.collapseMode == 'mini' && !this.cmargins){\n            this.cmargins = {left:0,top:0,right:0,bottom:0};\n        }else{\n            this.cmargins = Ext.applyIf(this.cmargins || {},\n                pos == 'north' || pos == 'south' ? this.defaultNSCMargins : this.defaultEWCMargins);\n        }\n    }\n};\n\nExt.layout.BorderLayout.Region.prototype = {\n    \n    \n    \n    \n    \n    \n    collapsible : false,\n    \n    split:false,\n    \n    floatable: true,\n    \n    minWidth:50,\n    \n    minHeight:50,\n\n    \n    defaultMargins : {left:0,top:0,right:0,bottom:0},\n    \n    defaultNSCMargins : {left:5,top:5,right:5,bottom:5},\n    \n    defaultEWCMargins : {left:5,top:0,right:5,bottom:0},\n    floatingZIndex: 100,\n\n    \n    isCollapsed : false,\n\n    \n    \n    \n\n    \n    render : function(ct, p){\n        this.panel = p;\n        p.el.enableDisplayMode();\n        this.targetEl = ct;\n        this.el = p.el;\n\n        var gs = p.getState, ps = this.position;\n        p.getState = function(){\n            return Ext.apply(gs.call(p) || {}, this.state);\n        }.createDelegate(this);\n\n        if(ps != 'center'){\n            p.allowQueuedExpand = false;\n            p.on({\n                beforecollapse: this.beforeCollapse,\n                collapse: this.onCollapse,\n                beforeexpand: this.beforeExpand,\n                expand: this.onExpand,\n                hide: this.onHide,\n                show: this.onShow,\n                scope: this\n            });\n            if(this.collapsible || this.floatable){\n                p.collapseEl = 'el';\n                p.slideAnchor = this.getSlideAnchor();\n            }\n            if(p.tools && p.tools.toggle){\n                p.tools.toggle.addClass('x-tool-collapse-'+ps);\n                p.tools.toggle.addClassOnOver('x-tool-collapse-'+ps+'-over');\n            }\n        }\n    },\n\n    \n    getCollapsedEl : function(){\n        if(!this.collapsedEl){\n            if(!this.toolTemplate){\n                var tt = new Ext.Template(\n                     '<div class=\"x-tool x-tool-{id}\">&#160;</div>'\n                );\n                tt.disableFormats = true;\n                tt.compile();\n                Ext.layout.BorderLayout.Region.prototype.toolTemplate = tt;\n            }\n            this.collapsedEl = this.targetEl.createChild({\n                cls: \"x-layout-collapsed x-layout-collapsed-\"+this.position,\n                id: this.panel.id + '-xcollapsed'\n            });\n            this.collapsedEl.enableDisplayMode('block');\n\n            if(this.collapseMode == 'mini'){\n                this.collapsedEl.addClass('x-layout-cmini-'+this.position);\n                this.miniCollapsedEl = this.collapsedEl.createChild({\n                    cls: \"x-layout-mini x-layout-mini-\"+this.position, html: \"&#160;\"\n                });\n                this.miniCollapsedEl.addClassOnOver('x-layout-mini-over');\n                this.collapsedEl.addClassOnOver(\"x-layout-collapsed-over\");\n                this.collapsedEl.on('click', this.onExpandClick, this, {stopEvent:true});\n            }else {\n                if(this.collapsible !== false && !this.hideCollapseTool) {\n                    var t = this.expandToolEl = this.toolTemplate.append(\n                            this.collapsedEl.dom,\n                            {id:'expand-'+this.position}, true);\n                    t.addClassOnOver('x-tool-expand-'+this.position+'-over');\n                    t.on('click', this.onExpandClick, this, {stopEvent:true});\n                }\n                if(this.floatable !== false || this.titleCollapse){\n                   this.collapsedEl.addClassOnOver(\"x-layout-collapsed-over\");\n                   this.collapsedEl.on(\"click\", this[this.floatable ? 'collapseClick' : 'onExpandClick'], this);\n                }\n            }\n        }\n        return this.collapsedEl;\n    },\n\n    \n    onExpandClick : function(e){\n        if(this.isSlid){\n            this.panel.expand(false);\n        }else{\n            this.panel.expand();\n        }\n    },\n\n    \n    onCollapseClick : function(e){\n        this.panel.collapse();\n    },\n\n    \n    beforeCollapse : function(p, animate){\n        this.lastAnim = animate;\n        if(this.splitEl){\n            this.splitEl.hide();\n        }\n        this.getCollapsedEl().show();\n        var el = this.panel.getEl();\n        this.originalZIndex = el.getStyle('z-index');\n        el.setStyle('z-index', 100);\n        this.isCollapsed = true;\n        this.layout.layout();\n    },\n\n    \n    onCollapse : function(animate){\n        this.panel.el.setStyle('z-index', 1);\n        if(this.lastAnim === false || this.panel.animCollapse === false){\n            this.getCollapsedEl().dom.style.visibility = 'visible';\n        }else{\n            this.getCollapsedEl().slideIn(this.panel.slideAnchor, {duration:.2});\n        }\n        this.state.collapsed = true;\n        this.panel.saveState();\n    },\n\n    \n    beforeExpand : function(animate){\n        if(this.isSlid){\n            this.afterSlideIn();\n        }\n        var c = this.getCollapsedEl();\n        this.el.show();\n        if(this.position == 'east' || this.position == 'west'){\n            this.panel.setSize(undefined, c.getHeight());\n        }else{\n            this.panel.setSize(c.getWidth(), undefined);\n        }\n        c.hide();\n        c.dom.style.visibility = 'hidden';\n        this.panel.el.setStyle('z-index', this.floatingZIndex);\n    },\n\n    \n    onExpand : function(){\n        this.isCollapsed = false;\n        if(this.splitEl){\n            this.splitEl.show();\n        }\n        this.layout.layout();\n        this.panel.el.setStyle('z-index', this.originalZIndex);\n        this.state.collapsed = false;\n        this.panel.saveState();\n    },\n\n    \n    collapseClick : function(e){\n        if(this.isSlid){\n           e.stopPropagation();\n           this.slideIn();\n        }else{\n           e.stopPropagation();\n           this.slideOut();\n        }\n    },\n\n    \n    onHide : function(){\n        if(this.isCollapsed){\n            this.getCollapsedEl().hide();\n        }else if(this.splitEl){\n            this.splitEl.hide();\n        }\n    },\n\n    \n    onShow : function(){\n        if(this.isCollapsed){\n            this.getCollapsedEl().show();\n        }else if(this.splitEl){\n            this.splitEl.show();\n        }\n    },\n\n    \n    isVisible : function(){\n        return !this.panel.hidden;\n    },\n\n    \n    getMargins : function(){\n        return this.isCollapsed && this.cmargins ? this.cmargins : this.margins;\n    },\n\n    \n    getSize : function(){\n        return this.isCollapsed ? this.getCollapsedEl().getSize() : this.panel.getSize();\n    },\n\n    \n    setPanel : function(panel){\n        this.panel = panel;\n    },\n\n    \n    getMinWidth: function(){\n        return this.minWidth;\n    },\n\n    \n    getMinHeight: function(){\n        return this.minHeight;\n    },\n\n    \n    applyLayoutCollapsed : function(box){\n        var ce = this.getCollapsedEl();\n        ce.setLeftTop(box.x, box.y);\n        ce.setSize(box.width, box.height);\n    },\n\n    \n    applyLayout : function(box){\n        if(this.isCollapsed){\n            this.applyLayoutCollapsed(box);\n        }else{\n            this.panel.setPosition(box.x, box.y);\n            this.panel.setSize(box.width, box.height);\n        }\n    },\n\n    \n    beforeSlide: function(){\n        this.panel.beforeEffect();\n    },\n\n    \n    afterSlide : function(){\n        this.panel.afterEffect();\n    },\n\n    \n    initAutoHide : function(){\n        if(this.autoHide !== false){\n            if(!this.autoHideHd){\n                this.autoHideSlideTask = new Ext.util.DelayedTask(this.slideIn, this);\n                this.autoHideHd = {\n                    \"mouseout\": function(e){\n                        if(!e.within(this.el, true)){\n                            this.autoHideSlideTask.delay(500);\n                        }\n                    },\n                    \"mouseover\" : function(e){\n                        this.autoHideSlideTask.cancel();\n                    },\n                    scope : this\n                };\n            }\n            this.el.on(this.autoHideHd);\n            this.collapsedEl.on(this.autoHideHd);\n        }\n    },\n\n    \n    clearAutoHide : function(){\n        if(this.autoHide !== false){\n            this.el.un(\"mouseout\", this.autoHideHd.mouseout);\n            this.el.un(\"mouseover\", this.autoHideHd.mouseover);\n            this.collapsedEl.un(\"mouseout\", this.autoHideHd.mouseout);\n            this.collapsedEl.un(\"mouseover\", this.autoHideHd.mouseover);\n        }\n    },\n\n    \n    clearMonitor : function(){\n        Ext.getDoc().un(\"click\", this.slideInIf, this);\n    },\n\n    \n    slideOut : function(){\n        if(this.isSlid || this.el.hasActiveFx()){\n            return;\n        }\n        this.isSlid = true;\n        var ts = this.panel.tools, dh, pc;\n        if(ts && ts.toggle){\n            ts.toggle.hide();\n        }\n        this.el.show();\n\n        \n        pc = this.panel.collapsed;\n        this.panel.collapsed = false;\n\n        if(this.position == 'east' || this.position == 'west'){\n            \n            dh = this.panel.deferHeight;\n            this.panel.deferHeight = false;\n\n            this.panel.setSize(undefined, this.collapsedEl.getHeight());\n\n            \n            this.panel.deferHeight = dh;\n        }else{\n            this.panel.setSize(this.collapsedEl.getWidth(), undefined);\n        }\n\n        \n        this.panel.collapsed = pc;\n\n        this.restoreLT = [this.el.dom.style.left, this.el.dom.style.top];\n        this.el.alignTo(this.collapsedEl, this.getCollapseAnchor());\n        this.el.setStyle(\"z-index\", this.floatingZIndex+2);\n        this.panel.el.replaceClass('x-panel-collapsed', 'x-panel-floating');\n        if(this.animFloat !== false){\n            this.beforeSlide();\n            this.el.slideIn(this.getSlideAnchor(), {\n                callback: function(){\n                    this.afterSlide();\n                    this.initAutoHide();\n                    Ext.getDoc().on(\"click\", this.slideInIf, this);\n                },\n                scope: this,\n                block: true\n            });\n        }else{\n            this.initAutoHide();\n             Ext.getDoc().on(\"click\", this.slideInIf, this);\n        }\n    },\n\n    \n    afterSlideIn : function(){\n        this.clearAutoHide();\n        this.isSlid = false;\n        this.clearMonitor();\n        this.el.setStyle(\"z-index\", \"\");\n        this.panel.el.replaceClass('x-panel-floating', 'x-panel-collapsed');\n        this.el.dom.style.left = this.restoreLT[0];\n        this.el.dom.style.top = this.restoreLT[1];\n\n        var ts = this.panel.tools;\n        if(ts && ts.toggle){\n            ts.toggle.show();\n        }\n    },\n\n    \n    slideIn : function(cb){\n        if(!this.isSlid || this.el.hasActiveFx()){\n            Ext.callback(cb);\n            return;\n        }\n        this.isSlid = false;\n        if(this.animFloat !== false){\n            this.beforeSlide();\n            this.el.slideOut(this.getSlideAnchor(), {\n                callback: function(){\n                    this.el.hide();\n                    this.afterSlide();\n                    this.afterSlideIn();\n                    Ext.callback(cb);\n                },\n                scope: this,\n                block: true\n            });\n        }else{\n            this.el.hide();\n            this.afterSlideIn();\n        }\n    },\n\n    \n    slideInIf : function(e){\n        if(!e.within(this.el)){\n            this.slideIn();\n        }\n    },\n\n    \n    anchors : {\n        \"west\" : \"left\",\n        \"east\" : \"right\",\n        \"north\" : \"top\",\n        \"south\" : \"bottom\"\n    },\n\n    \n    sanchors : {\n        \"west\" : \"l\",\n        \"east\" : \"r\",\n        \"north\" : \"t\",\n        \"south\" : \"b\"\n    },\n\n    \n    canchors : {\n        \"west\" : \"tl-tr\",\n        \"east\" : \"tr-tl\",\n        \"north\" : \"tl-bl\",\n        \"south\" : \"bl-tl\"\n    },\n\n    \n    getAnchor : function(){\n        return this.anchors[this.position];\n    },\n\n    \n    getCollapseAnchor : function(){\n        return this.canchors[this.position];\n    },\n\n    \n    getSlideAnchor : function(){\n        return this.sanchors[this.position];\n    },\n\n    \n    getAlignAdj : function(){\n        var cm = this.cmargins;\n        switch(this.position){\n            case \"west\":\n                return [0, 0];\n            break;\n            case \"east\":\n                return [0, 0];\n            break;\n            case \"north\":\n                return [0, 0];\n            break;\n            case \"south\":\n                return [0, 0];\n            break;\n        }\n    },\n\n    \n    getExpandAdj : function(){\n        var c = this.collapsedEl, cm = this.cmargins;\n        switch(this.position){\n            case \"west\":\n                return [-(cm.right+c.getWidth()+cm.left), 0];\n            break;\n            case \"east\":\n                return [cm.right+c.getWidth()+cm.left, 0];\n            break;\n            case \"north\":\n                return [0, -(cm.top+cm.bottom+c.getHeight())];\n            break;\n            case \"south\":\n                return [0, cm.top+cm.bottom+c.getHeight()];\n            break;\n        }\n    },\n\n    destroy : function(){\n        if (this.autoHideSlideTask && this.autoHideSlideTask.cancel){\n            this.autoHideSlideTask.cancel();\n        }\n        Ext.destroyMembers(this, 'miniCollapsedEl', 'collapsedEl', 'expandToolEl');\n    }\n};\n\n\nExt.layout.BorderLayout.SplitRegion = function(layout, config, pos){\n    Ext.layout.BorderLayout.SplitRegion.superclass.constructor.call(this, layout, config, pos);\n    \n    this.applyLayout = this.applyFns[pos];\n};\n\nExt.extend(Ext.layout.BorderLayout.SplitRegion, Ext.layout.BorderLayout.Region, {\n    \n    \n    splitTip : \"Drag to resize.\",\n    \n    collapsibleSplitTip : \"Drag to resize. Double click to hide.\",\n    \n    useSplitTips : false,\n\n    \n    splitSettings : {\n        north : {\n            orientation: Ext.SplitBar.VERTICAL,\n            placement: Ext.SplitBar.TOP,\n            maxFn : 'getVMaxSize',\n            minProp: 'minHeight',\n            maxProp: 'maxHeight'\n        },\n        south : {\n            orientation: Ext.SplitBar.VERTICAL,\n            placement: Ext.SplitBar.BOTTOM,\n            maxFn : 'getVMaxSize',\n            minProp: 'minHeight',\n            maxProp: 'maxHeight'\n        },\n        east : {\n            orientation: Ext.SplitBar.HORIZONTAL,\n            placement: Ext.SplitBar.RIGHT,\n            maxFn : 'getHMaxSize',\n            minProp: 'minWidth',\n            maxProp: 'maxWidth'\n        },\n        west : {\n            orientation: Ext.SplitBar.HORIZONTAL,\n            placement: Ext.SplitBar.LEFT,\n            maxFn : 'getHMaxSize',\n            minProp: 'minWidth',\n            maxProp: 'maxWidth'\n        }\n    },\n\n    \n    applyFns : {\n        west : function(box){\n            if(this.isCollapsed){\n                return this.applyLayoutCollapsed(box);\n            }\n            var sd = this.splitEl.dom, s = sd.style;\n            this.panel.setPosition(box.x, box.y);\n            var sw = sd.offsetWidth;\n            s.left = (box.x+box.width-sw)+'px';\n            s.top = (box.y)+'px';\n            s.height = Math.max(0, box.height)+'px';\n            this.panel.setSize(box.width-sw, box.height);\n        },\n        east : function(box){\n            if(this.isCollapsed){\n                return this.applyLayoutCollapsed(box);\n            }\n            var sd = this.splitEl.dom, s = sd.style;\n            var sw = sd.offsetWidth;\n            this.panel.setPosition(box.x+sw, box.y);\n            s.left = (box.x)+'px';\n            s.top = (box.y)+'px';\n            s.height = Math.max(0, box.height)+'px';\n            this.panel.setSize(box.width-sw, box.height);\n        },\n        north : function(box){\n            if(this.isCollapsed){\n                return this.applyLayoutCollapsed(box);\n            }\n            var sd = this.splitEl.dom, s = sd.style;\n            var sh = sd.offsetHeight;\n            this.panel.setPosition(box.x, box.y);\n            s.left = (box.x)+'px';\n            s.top = (box.y+box.height-sh)+'px';\n            s.width = Math.max(0, box.width)+'px';\n            this.panel.setSize(box.width, box.height-sh);\n        },\n        south : function(box){\n            if(this.isCollapsed){\n                return this.applyLayoutCollapsed(box);\n            }\n            var sd = this.splitEl.dom, s = sd.style;\n            var sh = sd.offsetHeight;\n            this.panel.setPosition(box.x, box.y+sh);\n            s.left = (box.x)+'px';\n            s.top = (box.y)+'px';\n            s.width = Math.max(0, box.width)+'px';\n            this.panel.setSize(box.width, box.height-sh);\n        }\n    },\n\n    \n    render : function(ct, p){\n        Ext.layout.BorderLayout.SplitRegion.superclass.render.call(this, ct, p);\n\n        var ps = this.position;\n\n        this.splitEl = ct.createChild({\n            cls: \"x-layout-split x-layout-split-\"+ps, html: \"&#160;\",\n            id: this.panel.id + '-xsplit'\n        });\n\n        if(this.collapseMode == 'mini'){\n            this.miniSplitEl = this.splitEl.createChild({\n                cls: \"x-layout-mini x-layout-mini-\"+ps, html: \"&#160;\"\n            });\n            this.miniSplitEl.addClassOnOver('x-layout-mini-over');\n            this.miniSplitEl.on('click', this.onCollapseClick, this, {stopEvent:true});\n        }\n\n        var s = this.splitSettings[ps];\n\n        this.split = new Ext.SplitBar(this.splitEl.dom, p.el, s.orientation);\n        this.split.tickSize = this.tickSize;\n        this.split.placement = s.placement;\n        this.split.getMaximumSize = this[s.maxFn].createDelegate(this);\n        this.split.minSize = this.minSize || this[s.minProp];\n        this.split.on(\"beforeapply\", this.onSplitMove, this);\n        this.split.useShim = this.useShim === true;\n        this.maxSize = this.maxSize || this[s.maxProp];\n\n        if(p.hidden){\n            this.splitEl.hide();\n        }\n\n        if(this.useSplitTips){\n            this.splitEl.dom.title = this.collapsible ? this.collapsibleSplitTip : this.splitTip;\n        }\n        if(this.collapsible){\n            this.splitEl.on(\"dblclick\", this.onCollapseClick,  this);\n        }\n    },\n\n    \n    getSize : function(){\n        if(this.isCollapsed){\n            return this.collapsedEl.getSize();\n        }\n        var s = this.panel.getSize();\n        if(this.position == 'north' || this.position == 'south'){\n            s.height += this.splitEl.dom.offsetHeight;\n        }else{\n            s.width += this.splitEl.dom.offsetWidth;\n        }\n        return s;\n    },\n\n    \n    getHMaxSize : function(){\n         var cmax = this.maxSize || 10000;\n         var center = this.layout.center;\n         return Math.min(cmax, (this.el.getWidth()+center.el.getWidth())-center.getMinWidth());\n    },\n\n    \n    getVMaxSize : function(){\n        var cmax = this.maxSize || 10000;\n        var center = this.layout.center;\n        return Math.min(cmax, (this.el.getHeight()+center.el.getHeight())-center.getMinHeight());\n    },\n\n    \n    onSplitMove : function(split, newSize){\n        var s = this.panel.getSize();\n        this.lastSplitSize = newSize;\n        if(this.position == 'north' || this.position == 'south'){\n            this.panel.setSize(s.width, newSize);\n            this.state.height = newSize;\n        }else{\n            this.panel.setSize(newSize, s.height);\n            this.state.width = newSize;\n        }\n        this.layout.layout();\n        this.panel.saveState();\n        return false;\n    },\n\n    \n    getSplitBar : function(){\n        return this.split;\n    },\n\n    \n    destroy : function() {\n        Ext.destroy(this.miniSplitEl, this.split, this.splitEl);\n        Ext.layout.BorderLayout.SplitRegion.superclass.destroy.call(this);\n    }\n});\n\nExt.Container.LAYOUTS['border'] = Ext.layout.BorderLayout;\n\nExt.layout.FormLayout = Ext.extend(Ext.layout.AnchorLayout, {\n\n    \n    labelSeparator : ':',\n\n    \n\n    \n    trackLabels: true,\n\n    type: 'form',\n\n    onRemove: function(c){\n        Ext.layout.FormLayout.superclass.onRemove.call(this, c);\n        if(this.trackLabels){\n            c.un('show', this.onFieldShow, this);\n            c.un('hide', this.onFieldHide, this);\n        }\n        \n        var el = c.getPositionEl(),\n            ct = c.getItemCt && c.getItemCt();\n        if (c.rendered && ct) {\n            if (el && el.dom) {\n                el.insertAfter(ct);\n            }\n            Ext.destroy(ct);\n            Ext.destroyMembers(c, 'label', 'itemCt');\n            if (c.customItemCt) {\n                Ext.destroyMembers(c, 'getItemCt', 'customItemCt');\n            }\n        }\n    },\n\n    \n    setContainer : function(ct){\n        Ext.layout.FormLayout.superclass.setContainer.call(this, ct);\n        ct.labelAlign = ct.labelAlign || this.labelAlign;\n        if (ct.labelAlign) {\n            ct.addClass('x-form-label-' + ct.labelAlign);\n        }\n\n        if (ct.hideLabels || this.hideLabels) { \n            Ext.apply(this, {\n                labelStyle: 'display:none',\n                elementStyle: 'padding-left:0;',\n                labelAdjust: 0\n            });\n        } else {\n            this.labelSeparator = Ext.isDefined(ct.labelSeparator) ? ct.labelSeparator : this.labelSeparator;\n            ct.labelWidth = ct.labelWidth || this.labelWidth || 100;\n            if(Ext.isNumber(ct.labelWidth)){\n                var pad = ct.labelPad || this.labelPad;\n                pad = Ext.isNumber(pad) ? pad : 5;\n                Ext.apply(this, {\n                    labelAdjust: ct.labelWidth + pad,\n                    labelStyle: 'width:' + ct.labelWidth + 'px;',\n                    elementStyle: 'padding-left:' + (ct.labelWidth + pad) + 'px'\n                });\n            }\n            if(ct.labelAlign == 'top'){\n                Ext.apply(this, {\n                    labelStyle: 'width:auto;',\n                    labelAdjust: 0,\n                    elementStyle: 'padding-left:0;'\n                });\n            }\n        }\n    },\n\n    \n    isHide: function(c){\n        return c.hideLabel || this.container.hideLabels;\n    },\n\n    onFieldShow: function(c){\n        c.getItemCt().removeClass('x-hide-' + c.hideMode);\n\n        \n        if (c.isComposite) {\n            c.doLayout();\n        }\n    },\n\n    onFieldHide: function(c){\n        c.getItemCt().addClass('x-hide-' + c.hideMode);\n    },\n\n    \n    getLabelStyle: function(s){\n        var ls = '', items = [this.labelStyle, s];\n        for (var i = 0, len = items.length; i < len; ++i){\n            if (items[i]){\n                ls += items[i];\n                if (ls.substr(-1, 1) != ';'){\n                    ls += ';';\n                }\n            }\n        }\n        return ls;\n    },\n\n    \n\n    \n    renderItem : function(c, position, target){\n        if(c && (c.isFormField || c.fieldLabel) && c.inputType != 'hidden'){\n            var args = this.getTemplateArgs(c);\n            if(Ext.isNumber(position)){\n                position = target.dom.childNodes[position] || null;\n            }\n            if(position){\n                c.itemCt = this.fieldTpl.insertBefore(position, args, true);\n            }else{\n                c.itemCt = this.fieldTpl.append(target, args, true);\n            }\n            if(!c.getItemCt){\n                \n                \n                Ext.apply(c, {\n                    getItemCt: function(){\n                        return c.itemCt;\n                    },\n                    customItemCt: true\n                });\n            }\n            c.label = c.getItemCt().child('label.x-form-item-label');\n            if(!c.rendered){\n                c.render('x-form-el-' + c.id);\n            }else if(!this.isValidParent(c, target)){\n                Ext.fly('x-form-el-' + c.id).appendChild(c.getPositionEl());\n            }\n            if(this.trackLabels){\n                if(c.hidden){\n                    this.onFieldHide(c);\n                }\n                c.on({\n                    scope: this,\n                    show: this.onFieldShow,\n                    hide: this.onFieldHide\n                });\n            }\n            this.configureItem(c);\n        }else {\n            Ext.layout.FormLayout.superclass.renderItem.apply(this, arguments);\n        }\n    },\n\n    \n    getTemplateArgs: function(field) {\n        var noLabelSep = !field.fieldLabel || field.hideLabel,\n            itemCls = (field.itemCls || this.container.itemCls || '') + (field.hideLabel ? ' x-hide-label' : '');\n\n        \n        if (Ext.isIE9 && Ext.isIEQuirks && field instanceof Ext.form.TextField) {\n            itemCls += ' x-input-wrapper';\n        }\n\n        return {\n            id            : field.id,\n            label         : field.fieldLabel,\n            itemCls       : itemCls,\n            clearCls      : field.clearCls || 'x-form-clear-left',\n            labelStyle    : this.getLabelStyle(field.labelStyle),\n            elementStyle  : this.elementStyle || '',\n            labelSeparator: noLabelSep ? '' : (Ext.isDefined(field.labelSeparator) ? field.labelSeparator : this.labelSeparator)\n        };\n    },\n\n    \n    adjustWidthAnchor: function(value, c){\n        if(c.label && !this.isHide(c) && (this.container.labelAlign != 'top')){\n            var adjust = Ext.isIE6 || Ext.isIEQuirks;\n            return value - this.labelAdjust + (adjust ? -3 : 0);\n        }\n        return value;\n    },\n\n    adjustHeightAnchor : function(value, c){\n        if(c.label && !this.isHide(c) && (this.container.labelAlign == 'top')){\n            return value - c.label.getHeight();\n        }\n        return value;\n    },\n\n    \n    isValidParent : function(c, target){\n        return target && this.container.getEl().contains(c.getPositionEl());\n    }\n\n    \n});\n\nExt.Container.LAYOUTS['form'] = Ext.layout.FormLayout;\n\nExt.layout.AccordionLayout = Ext.extend(Ext.layout.FitLayout, {\n    \n    fill : true,\n    \n    autoWidth : true,\n    \n    titleCollapse : true,\n    \n    hideCollapseTool : false,\n    \n    collapseFirst : false,\n    \n    animate : false,\n    \n    sequence : false,\n    \n    activeOnTop : false,\n\n    type: 'accordion',\n\n    renderItem : function(c){\n        if(this.animate === false){\n            c.animCollapse = false;\n        }\n        c.collapsible = true;\n        if(this.autoWidth){\n            c.autoWidth = true;\n        }\n        if(this.titleCollapse){\n            c.titleCollapse = true;\n        }\n        if(this.hideCollapseTool){\n            c.hideCollapseTool = true;\n        }\n        if(this.collapseFirst !== undefined){\n            c.collapseFirst = this.collapseFirst;\n        }\n        if(!this.activeItem && !c.collapsed){\n            this.setActiveItem(c, true);\n        }else if(this.activeItem && this.activeItem != c){\n            c.collapsed = true;\n        }\n        Ext.layout.AccordionLayout.superclass.renderItem.apply(this, arguments);\n        c.header.addClass('x-accordion-hd');\n        c.on('beforeexpand', this.beforeExpand, this);\n    },\n\n    onRemove: function(c){\n        Ext.layout.AccordionLayout.superclass.onRemove.call(this, c);\n        if(c.rendered){\n            c.header.removeClass('x-accordion-hd');\n        }\n        c.un('beforeexpand', this.beforeExpand, this);\n    },\n\n    \n    beforeExpand : function(p, anim){\n        var ai = this.activeItem;\n        if(ai){\n            if(this.sequence){\n                delete this.activeItem;\n                if (!ai.collapsed){\n                    ai.collapse({callback:function(){\n                        p.expand(anim || true);\n                    }, scope: this});\n                    return false;\n                }\n            }else{\n                ai.collapse(this.animate);\n            }\n        }\n        this.setActive(p);\n        if(this.activeOnTop){\n            p.el.dom.parentNode.insertBefore(p.el.dom, p.el.dom.parentNode.firstChild);\n        }\n        \n        this.layout();\n    },\n\n    \n    setItemSize : function(item, size){\n        if(this.fill && item){\n            var hh = 0, i, ct = this.getRenderedItems(this.container), len = ct.length, p;\n            \n            for (i = 0; i < len; i++) {\n                if((p = ct[i]) != item && !p.hidden){\n                    hh += p.header.getHeight();\n                }\n            };\n            \n            size.height -= hh;\n            \n            \n            item.setSize(size);\n        }\n    },\n\n    \n    setActiveItem : function(item){\n        this.setActive(item, true);\n    },\n\n    \n    setActive : function(item, expand){\n        var ai = this.activeItem;\n        item = this.container.getComponent(item);\n        if(ai != item){\n            if(item.rendered && item.collapsed && expand){\n                item.expand();\n            }else{\n                if(ai){\n                   ai.fireEvent('deactivate', ai);\n                }\n                this.activeItem = item;\n                item.fireEvent('activate', item);\n            }\n        }\n    }\n});\nExt.Container.LAYOUTS.accordion = Ext.layout.AccordionLayout;\n\n\nExt.layout.Accordion = Ext.layout.AccordionLayout;\nExt.layout.TableLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    \n\n    \n    monitorResize:false,\n\n    type: 'table',\n\n    targetCls: 'x-table-layout-ct',\n\n    \n    tableAttrs:null,\n\n    \n    setContainer : function(ct){\n        Ext.layout.TableLayout.superclass.setContainer.call(this, ct);\n\n        this.currentRow = 0;\n        this.currentColumn = 0;\n        this.cells = [];\n    },\n    \n    \n    onLayout : function(ct, target){\n        var cs = ct.items.items, len = cs.length, c, i;\n\n        if(!this.table){\n            target.addClass('x-table-layout-ct');\n\n            this.table = target.createChild(\n                Ext.apply({tag:'table', cls:'x-table-layout', cellspacing: 0, cn: {tag: 'tbody'}}, this.tableAttrs), null, true);\n        }\n        this.renderAll(ct, target);\n    },\n\n    \n    getRow : function(index){\n        var row = this.table.tBodies[0].childNodes[index];\n        if(!row){\n            row = document.createElement('tr');\n            this.table.tBodies[0].appendChild(row);\n        }\n        return row;\n    },\n\n    \n    getNextCell : function(c){\n        var cell = this.getNextNonSpan(this.currentColumn, this.currentRow);\n        var curCol = this.currentColumn = cell[0], curRow = this.currentRow = cell[1];\n        for(var rowIndex = curRow; rowIndex < curRow + (c.rowspan || 1); rowIndex++){\n            if(!this.cells[rowIndex]){\n                this.cells[rowIndex] = [];\n            }\n            for(var colIndex = curCol; colIndex < curCol + (c.colspan || 1); colIndex++){\n                this.cells[rowIndex][colIndex] = true;\n            }\n        }\n        var td = document.createElement('td');\n        if(c.cellId){\n            td.id = c.cellId;\n        }\n        var cls = 'x-table-layout-cell';\n        if(c.cellCls){\n            cls += ' ' + c.cellCls;\n        }\n        td.className = cls;\n        if(c.colspan){\n            td.colSpan = c.colspan;\n        }\n        if(c.rowspan){\n            td.rowSpan = c.rowspan;\n        }\n        this.getRow(curRow).appendChild(td);\n        return td;\n    },\n\n    \n    getNextNonSpan: function(colIndex, rowIndex){\n        var cols = this.columns;\n        while((cols && colIndex >= cols) || (this.cells[rowIndex] && this.cells[rowIndex][colIndex])) {\n            if(cols && colIndex >= cols){\n                rowIndex++;\n                colIndex = 0;\n            }else{\n                colIndex++;\n            }\n        }\n        return [colIndex, rowIndex];\n    },\n\n    \n    renderItem : function(c, position, target){\n        \n        if(!this.table){\n            this.table = target.createChild(\n                Ext.apply({tag:'table', cls:'x-table-layout', cellspacing: 0, cn: {tag: 'tbody'}}, this.tableAttrs), null, true);\n        }\n        if(c && !c.rendered){\n            c.render(this.getNextCell(c));\n            this.configureItem(c);\n        }else if(c && !this.isValidParent(c, target)){\n            var container = this.getNextCell(c);\n            container.insertBefore(c.getPositionEl().dom, null);\n            c.container = Ext.get(container);\n            this.configureItem(c);\n        }\n    },\n\n    \n    isValidParent : function(c, target){\n        return c.getPositionEl().up('table', 5).dom.parentNode === (target.dom || target);\n    },\n    \n    destroy: function(){\n        delete this.table;\n        Ext.layout.TableLayout.superclass.destroy.call(this);\n    }\n\n    \n});\n\nExt.Container.LAYOUTS['table'] = Ext.layout.TableLayout;\nExt.layout.AbsoluteLayout = Ext.extend(Ext.layout.AnchorLayout, {\n\n    extraCls: 'x-abs-layout-item',\n\n    type: 'absolute',\n\n    onLayout : function(ct, target){\n        target.position();\n        this.paddingLeft = target.getPadding('l');\n        this.paddingTop = target.getPadding('t');\n        Ext.layout.AbsoluteLayout.superclass.onLayout.call(this, ct, target);\n    },\n\n    \n    adjustWidthAnchor : function(value, comp){\n        return value ? value - comp.getPosition(true)[0] + this.paddingLeft : value;\n    },\n\n    \n    adjustHeightAnchor : function(value, comp){\n        return  value ? value - comp.getPosition(true)[1] + this.paddingTop : value;\n    }\n    \n});\nExt.Container.LAYOUTS['absolute'] = Ext.layout.AbsoluteLayout;\n\nExt.layout.BoxLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    \n    defaultMargins : {left:0,top:0,right:0,bottom:0},\n    \n    padding : '0',\n    \n    pack : 'start',\n\n    \n    monitorResize : true,\n    type: 'box',\n    scrollOffset : 0,\n    extraCls : 'x-box-item',\n    targetCls : 'x-box-layout-ct',\n    innerCls : 'x-box-inner',\n\n    constructor : function(config){\n        Ext.layout.BoxLayout.superclass.constructor.call(this, config);\n\n        if (Ext.isString(this.defaultMargins)) {\n            this.defaultMargins = this.parseMargins(this.defaultMargins);\n        }\n        \n        var handler = this.overflowHandler;\n        \n        if (typeof handler == 'string') {\n            handler = {\n                type: handler\n            };\n        }\n        \n        var handlerType = 'none';\n        if (handler && handler.type != undefined) {\n            handlerType = handler.type;\n        }\n        \n        var constructor = Ext.layout.boxOverflow[handlerType];\n        if (constructor[this.type]) {\n            constructor = constructor[this.type];\n        }\n        \n        this.overflowHandler = new constructor(this, handler);\n    },\n\n    \n    onLayout: function(container, target) {\n        Ext.layout.BoxLayout.superclass.onLayout.call(this, container, target);\n\n        var tSize = this.getLayoutTargetSize(),\n            items = this.getVisibleItems(container),\n            calcs = this.calculateChildBoxes(items, tSize),\n            boxes = calcs.boxes,\n            meta  = calcs.meta;\n        \n        \n        if (tSize.width > 0) {\n            var handler = this.overflowHandler,\n                method  = meta.tooNarrow ? 'handleOverflow' : 'clearOverflow';\n            \n            var results = handler[method](calcs, tSize);\n            \n            if (results) {\n                if (results.targetSize) {\n                    tSize = results.targetSize;\n                }\n                \n                if (results.recalculate) {\n                    items = this.getVisibleItems(container);\n                    calcs = this.calculateChildBoxes(items, tSize);\n                    boxes = calcs.boxes;\n                }\n            }\n        }\n        \n        \n        this.layoutTargetLastSize = tSize;\n        \n        \n        this.childBoxCache = calcs;\n        \n        this.updateInnerCtSize(tSize, calcs);\n        this.updateChildBoxes(boxes);\n\n        \n        this.handleTargetOverflow(tSize, container, target);\n    },\n\n    \n    updateChildBoxes: function(boxes) {\n        for (var i = 0, length = boxes.length; i < length; i++) {\n            var box  = boxes[i],\n                comp = box.component;\n            \n            if (box.dirtySize) {\n                comp.setSize(box.width, box.height);\n            }\n            \n            if (isNaN(box.left) || isNaN(box.top)) {\n                continue;\n            }\n            \n            comp.setPosition(box.left, box.top);\n        }\n    },\n\n    \n    updateInnerCtSize: function(tSize, calcs) {\n        var align   = this.align,\n            padding = this.padding,\n            width   = tSize.width,\n            height  = tSize.height;\n        \n        if (this.type == 'hbox') {\n            var innerCtWidth  = width,\n                innerCtHeight = calcs.meta.maxHeight + padding.top + padding.bottom;\n\n            if (align == 'stretch') {\n                innerCtHeight = height;\n            } else if (align == 'middle') {\n                innerCtHeight = Math.max(height, innerCtHeight);\n            }\n        } else {\n            var innerCtHeight = height,\n                innerCtWidth  = calcs.meta.maxWidth + padding.left + padding.right;\n\n            if (align == 'stretch') {\n                innerCtWidth = width;\n            } else if (align == 'center') {\n                innerCtWidth = Math.max(width, innerCtWidth);\n            }\n        }\n\n        this.innerCt.setSize(innerCtWidth || undefined, innerCtHeight || undefined);\n    },\n\n    \n    handleTargetOverflow: function(previousTargetSize, container, target) {\n        var overflow = target.getStyle('overflow');\n\n        if (overflow && overflow != 'hidden' &&!this.adjustmentPass) {\n            var newTargetSize = this.getLayoutTargetSize();\n            if (newTargetSize.width != previousTargetSize.width || newTargetSize.height != previousTargetSize.height){\n                this.adjustmentPass = true;\n                this.onLayout(container, target);\n            }\n        }\n\n        delete this.adjustmentPass;\n    },\n\n    \n    isValidParent : function(c, target) {\n        return this.innerCt && c.getPositionEl().dom.parentNode == this.innerCt.dom;\n    },\n\n    \n    getVisibleItems: function(ct) {\n        var ct  = ct || this.container,\n            t   = ct.getLayoutTarget(),\n            cti = ct.items.items,\n            len = cti.length,\n\n            i, c, items = [];\n\n        for (i = 0; i < len; i++) {\n            if((c = cti[i]).rendered && this.isValidParent(c, t) && c.hidden !== true  && c.collapsed !== true && c.shouldLayout !== false){\n                items.push(c);\n            }\n        }\n\n        return items;\n    },\n\n    \n    renderAll : function(ct, target) {\n        if (!this.innerCt) {\n            \n            this.innerCt = target.createChild({cls:this.innerCls});\n            this.padding = this.parseMargins(this.padding);\n        }\n        Ext.layout.BoxLayout.superclass.renderAll.call(this, ct, this.innerCt);\n    },\n\n    getLayoutTargetSize : function() {\n        var target = this.container.getLayoutTarget(), ret;\n        \n        if (target) {\n            ret = target.getViewSize();\n\n            \n            \n            \n            if (Ext.isIE9m && Ext.isStrict && ret.width == 0){\n                ret =  target.getStyleSize();\n            }\n\n            ret.width  -= target.getPadding('lr');\n            ret.height -= target.getPadding('tb');\n        }\n        \n        return ret;\n    },\n\n    \n    renderItem : function(c) {\n        if(Ext.isString(c.margins)){\n            c.margins = this.parseMargins(c.margins);\n        }else if(!c.margins){\n            c.margins = this.defaultMargins;\n        }\n        Ext.layout.BoxLayout.superclass.renderItem.apply(this, arguments);\n    },\n    \n    \n    destroy: function() {\n        Ext.destroy(this.overflowHandler);\n        \n        Ext.layout.BoxLayout.superclass.destroy.apply(this, arguments);\n    }\n});\n\n\n\nExt.layout.boxOverflow.None = Ext.extend(Object, {\n    constructor: function(layout, config) {\n        this.layout = layout;\n        \n        Ext.apply(this, config || {});\n    },\n    \n    handleOverflow: Ext.emptyFn,\n    \n    clearOverflow: Ext.emptyFn\n});\n\n\nExt.layout.boxOverflow.none = Ext.layout.boxOverflow.None;\n\nExt.layout.boxOverflow.Menu = Ext.extend(Ext.layout.boxOverflow.None, {\n    \n    afterCls: 'x-strip-right',\n    \n    \n    noItemsMenuText : '<div class=\"x-toolbar-no-items\">(None)</div>',\n    \n    constructor: function(layout) {\n        Ext.layout.boxOverflow.Menu.superclass.constructor.apply(this, arguments);\n        \n        \n        this.menuItems = [];\n    },\n    \n    \n    createInnerElements: function() {\n        if (!this.afterCt) {\n            this.afterCt  = this.layout.innerCt.insertSibling({cls: this.afterCls},  'before');\n        }\n    },\n    \n    \n    clearOverflow: function(calculations, targetSize) {\n        var newWidth = targetSize.width + (this.afterCt ? this.afterCt.getWidth() : 0),\n            items    = this.menuItems;\n        \n        this.hideTrigger();\n        \n        for (var index = 0, length = items.length; index < length; index++) {\n            items.pop().component.show();\n        }\n        \n        return {\n            targetSize: {\n                height: targetSize.height,\n                width : newWidth\n            }\n        };\n    },\n    \n    \n    showTrigger: function() {\n        this.createMenu();\n        this.menuTrigger.show();\n    },\n    \n    \n    hideTrigger: function() {\n        if (this.menuTrigger != undefined) {\n            this.menuTrigger.hide();\n        }\n    },\n    \n    \n    beforeMenuShow: function(menu) {\n        var items = this.menuItems,\n            len   = items.length,\n            item,\n            prev;\n\n        var needsSep = function(group, item){\n            return group.isXType('buttongroup') && !(item instanceof Ext.Toolbar.Separator);\n        };\n        \n        this.clearMenu();\n        menu.removeAll();\n        \n        for (var i = 0; i < len; i++) {\n            item = items[i].component;\n            \n            if (prev && (needsSep(item, prev) || needsSep(prev, item))) {\n                menu.add('-');\n            }\n            \n            this.addComponentToMenu(menu, item);\n            prev = item;\n        }\n\n        \n        if (menu.items.length < 1) {\n            menu.add(this.noItemsMenuText);\n        }\n    },\n    \n    \n    createMenuConfig : function(component, hideOnClick){\n        var config = Ext.apply({}, component.initialConfig),\n            group  = component.toggleGroup;\n\n        Ext.copyTo(config, component, [\n            'iconCls', 'icon', 'itemId', 'disabled', 'handler', 'scope', 'menu'\n        ]);\n\n        Ext.apply(config, {\n            text       : component.overflowText || component.text,\n            hideOnClick: hideOnClick\n        });\n\n        if (group || component.enableToggle) {\n            Ext.apply(config, {\n                group  : group,\n                checked: component.pressed,\n                listeners: {\n                    checkchange: function(item, checked){\n                        component.toggle(checked);\n                    }\n                }\n            });\n        }\n\n        delete config.ownerCt;\n        delete config.xtype;\n        delete config.id;\n\n        return config;\n    },\n\n    \n    addComponentToMenu : function(menu, component) {\n        if (component instanceof Ext.Toolbar.Separator) {\n            menu.add('-');\n\n        } else if (Ext.isFunction(component.isXType)) {\n            if (component.isXType('splitbutton')) {\n                menu.add(this.createMenuConfig(component, true));\n\n            } else if (component.isXType('button')) {\n                menu.add(this.createMenuConfig(component, !component.menu));\n\n            } else if (component.isXType('buttongroup')) {\n                component.items.each(function(item){\n                     this.addComponentToMenu(menu, item);\n                }, this);\n            }\n        }\n    },\n    \n    \n    clearMenu : function(){\n        var menu = this.moreMenu;\n        if (menu && menu.items) {\n            menu.items.each(function(item){\n                delete item.menu;\n            });\n        }\n    },\n    \n    \n    createMenu: function() {\n        if (!this.menuTrigger) {\n            this.createInnerElements();\n            \n            \n            this.menu = new Ext.menu.Menu({\n                ownerCt : this.layout.container,\n                listeners: {\n                    scope: this,\n                    beforeshow: this.beforeMenuShow\n                }\n            });\n\n            \n            this.menuTrigger = new Ext.Button({\n                iconCls : 'x-toolbar-more-icon',\n                cls     : 'x-toolbar-more',\n                menu    : this.menu,\n                renderTo: this.afterCt\n            });\n        }\n    },\n    \n    \n    destroy: function() {\n        Ext.destroy(this.menu, this.menuTrigger);\n    }\n});\n\nExt.layout.boxOverflow.menu = Ext.layout.boxOverflow.Menu;\n\n\n\nExt.layout.boxOverflow.HorizontalMenu = Ext.extend(Ext.layout.boxOverflow.Menu, {\n    \n    constructor: function() {\n        Ext.layout.boxOverflow.HorizontalMenu.superclass.constructor.apply(this, arguments);\n        \n        var me = this,\n            layout = me.layout,\n            origFunction = layout.calculateChildBoxes;\n        \n        layout.calculateChildBoxes = function(visibleItems, targetSize) {\n            var calcs = origFunction.apply(layout, arguments),\n                meta  = calcs.meta,\n                items = me.menuItems;\n            \n            \n            \n            var hiddenWidth = 0;\n            for (var index = 0, length = items.length; index < length; index++) {\n                hiddenWidth += items[index].width;\n            }\n            \n            meta.minimumWidth += hiddenWidth;\n            meta.tooNarrow = meta.minimumWidth > targetSize.width;\n            \n            return calcs;\n        };        \n    },\n    \n    handleOverflow: function(calculations, targetSize) {\n        this.showTrigger();\n        \n        var newWidth    = targetSize.width - this.afterCt.getWidth(),\n            boxes       = calculations.boxes,\n            usedWidth   = 0,\n            recalculate = false;\n        \n        \n        for (var index = 0, length = boxes.length; index < length; index++) {\n            usedWidth += boxes[index].width;\n        }\n        \n        var spareWidth = newWidth - usedWidth,\n            showCount  = 0;\n        \n        \n        for (var index = 0, length = this.menuItems.length; index < length; index++) {\n            var hidden = this.menuItems[index],\n                comp   = hidden.component,\n                width  = hidden.width;\n            \n            if (width < spareWidth) {\n                comp.show();\n                \n                spareWidth -= width;\n                showCount ++;\n                recalculate = true;\n            } else {\n                break;\n            }\n        }\n                \n        if (recalculate) {\n            this.menuItems = this.menuItems.slice(showCount);\n        } else {\n            for (var i = boxes.length - 1; i >= 0; i--) {\n                var item  = boxes[i].component,\n                    right = boxes[i].left + boxes[i].width;\n\n                if (right >= newWidth) {\n                    this.menuItems.unshift({\n                        component: item,\n                        width    : boxes[i].width\n                    });\n\n                    item.hide();\n                } else {\n                    break;\n                }\n            }\n        }\n        \n        if (this.menuItems.length == 0) {\n            this.hideTrigger();\n        }\n        \n        return {\n            targetSize: {\n                height: targetSize.height,\n                width : newWidth\n            },\n            recalculate: recalculate\n        };\n    }\n});\n\nExt.layout.boxOverflow.menu.hbox = Ext.layout.boxOverflow.HorizontalMenu;\nExt.layout.boxOverflow.Scroller = Ext.extend(Ext.layout.boxOverflow.None, {\n    \n    animateScroll: true,\n    \n    \n    scrollIncrement: 100,\n    \n    \n    wheelIncrement: 3,\n    \n    \n    scrollRepeatInterval: 400,\n    \n    \n    scrollDuration: 0.4,\n    \n    \n    beforeCls: 'x-strip-left',\n    \n    \n    afterCls: 'x-strip-right',\n    \n    \n    scrollerCls: 'x-strip-scroller',\n    \n    \n    beforeScrollerCls: 'x-strip-scroller-left',\n    \n    \n    afterScrollerCls: 'x-strip-scroller-right',\n    \n    \n    createWheelListener: function() {\n        this.layout.innerCt.on({\n            scope     : this,\n            mousewheel: function(e) {\n                e.stopEvent();\n\n                this.scrollBy(e.getWheelDelta() * this.wheelIncrement * -1, false);\n            }\n        });\n    },\n    \n    \n    handleOverflow: function(calculations, targetSize) {\n        this.createInnerElements();\n        this.showScrollers();\n    },\n    \n    \n    clearOverflow: function() {\n        this.hideScrollers();\n    },\n    \n    \n    showScrollers: function() {\n        this.createScrollers();\n        \n        this.beforeScroller.show();\n        this.afterScroller.show();\n        \n        this.updateScrollButtons();\n    },\n    \n    \n    hideScrollers: function() {\n        if (this.beforeScroller != undefined) {\n            this.beforeScroller.hide();\n            this.afterScroller.hide();          \n        }\n    },\n    \n    \n    createScrollers: function() {\n        if (!this.beforeScroller && !this.afterScroller) {\n            var before = this.beforeCt.createChild({\n                cls: String.format(\"{0} {1} \", this.scrollerCls, this.beforeScrollerCls)\n            });\n            \n            var after = this.afterCt.createChild({\n                cls: String.format(\"{0} {1}\", this.scrollerCls, this.afterScrollerCls)\n            });\n            \n            before.addClassOnOver(this.beforeScrollerCls + '-hover');\n            after.addClassOnOver(this.afterScrollerCls + '-hover');\n            \n            before.setVisibilityMode(Ext.Element.DISPLAY);\n            after.setVisibilityMode(Ext.Element.DISPLAY);\n            \n            this.beforeRepeater = new Ext.util.ClickRepeater(before, {\n                interval: this.scrollRepeatInterval,\n                handler : this.scrollLeft,\n                scope   : this\n            });\n            \n            this.afterRepeater = new Ext.util.ClickRepeater(after, {\n                interval: this.scrollRepeatInterval,\n                handler : this.scrollRight,\n                scope   : this\n            });\n            \n            \n            this.beforeScroller = before;\n            \n            \n            this.afterScroller = after;\n        }\n    },\n    \n    \n    destroy: function() {\n        Ext.destroy(this.beforeScroller, this.afterScroller, this.beforeRepeater, this.afterRepeater, this.beforeCt, this.afterCt);\n    },\n    \n    \n    scrollBy: function(delta, animate) {\n        this.scrollTo(this.getScrollPosition() + delta, animate);\n    },\n    \n    \n    getItem: function(item) {\n        if (Ext.isString(item)) {\n            item = Ext.getCmp(item);\n        } else if (Ext.isNumber(item)) {\n            item = this.items[item];\n        }\n        \n        return item;\n    },\n    \n    \n    getScrollAnim: function() {\n        return {\n            duration: this.scrollDuration, \n            callback: this.updateScrollButtons, \n            scope   : this\n        };\n    },\n    \n    \n    updateScrollButtons: function() {\n        if (this.beforeScroller == undefined || this.afterScroller == undefined) {\n            return;\n        }\n        \n        var beforeMeth = this.atExtremeBefore()  ? 'addClass' : 'removeClass',\n            afterMeth  = this.atExtremeAfter() ? 'addClass' : 'removeClass',\n            beforeCls  = this.beforeScrollerCls + '-disabled',\n            afterCls   = this.afterScrollerCls  + '-disabled';\n        \n        this.beforeScroller[beforeMeth](beforeCls);\n        this.afterScroller[afterMeth](afterCls);\n        this.scrolling = false;\n    },\n    \n    \n    atExtremeBefore: function() {\n        return this.getScrollPosition() === 0;\n    },\n    \n    \n    scrollLeft: function(animate) {\n        this.scrollBy(-this.scrollIncrement, animate);\n    },\n    \n    \n    scrollRight: function(animate) {\n        this.scrollBy(this.scrollIncrement, animate);\n    },\n    \n    \n    scrollToItem: function(item, animate) {\n        item = this.getItem(item);\n        \n        if (item != undefined) {\n            var visibility = this.getItemVisibility(item);\n            \n            if (!visibility.fullyVisible) {\n                var box  = item.getBox(true, true),\n                    newX = box.x;\n                    \n                if (visibility.hiddenRight) {\n                    newX -= (this.layout.innerCt.getWidth() - box.width);\n                }\n                \n                this.scrollTo(newX, animate);\n            }\n        }\n    },\n    \n    \n    getItemVisibility: function(item) {\n        var box         = this.getItem(item).getBox(true, true),\n            itemLeft    = box.x,\n            itemRight   = box.x + box.width,\n            scrollLeft  = this.getScrollPosition(),\n            scrollRight = this.layout.innerCt.getWidth() + scrollLeft;\n        \n        return {\n            hiddenLeft  : itemLeft < scrollLeft,\n            hiddenRight : itemRight > scrollRight,\n            fullyVisible: itemLeft > scrollLeft && itemRight < scrollRight\n        };\n    }\n});\n\nExt.layout.boxOverflow.scroller = Ext.layout.boxOverflow.Scroller;\n\n\n\r\nExt.layout.boxOverflow.VerticalScroller = Ext.extend(Ext.layout.boxOverflow.Scroller, {\n    scrollIncrement: 75,\n    wheelIncrement : 2,\n    \n    handleOverflow: function(calculations, targetSize) {\n        Ext.layout.boxOverflow.VerticalScroller.superclass.handleOverflow.apply(this, arguments);\n        \n        return {\n            targetSize: {\n                height: targetSize.height - (this.beforeCt.getHeight() + this.afterCt.getHeight()),\n                width : targetSize.width\n            }\n        };\n    },\n    \n    \n    createInnerElements: function() {\n        var target = this.layout.innerCt;\n        \n        \n        \n        if (!this.beforeCt) {\n            this.beforeCt = target.insertSibling({cls: this.beforeCls}, 'before');\n            this.afterCt  = target.insertSibling({cls: this.afterCls},  'after');\n\n            this.createWheelListener();\n        }\n    },\n    \n    \n    scrollTo: function(position, animate) {\n        var oldPosition = this.getScrollPosition(),\n            newPosition = position.constrain(0, this.getMaxScrollBottom());\n        \n        if (newPosition != oldPosition && !this.scrolling) {\n            if (animate == undefined) {\n                animate = this.animateScroll;\n            }\n            \n            this.layout.innerCt.scrollTo('top', newPosition, animate ? this.getScrollAnim() : false);\n            \n            if (animate) {\n                this.scrolling = true;\n            } else {\n                this.scrolling = false;\n                this.updateScrollButtons();\n            }\n        }\n    },\n    \n    \n    getScrollPosition: function(){\n        return parseInt(this.layout.innerCt.dom.scrollTop, 10) || 0;\n    },\n    \n    \n    getMaxScrollBottom: function() {\n        return this.layout.innerCt.dom.scrollHeight - this.layout.innerCt.getHeight();\n    },\n    \n    \n    atExtremeAfter: function() {\n        return this.getScrollPosition() >= this.getMaxScrollBottom();\n    }\n});\n\nExt.layout.boxOverflow.scroller.vbox = Ext.layout.boxOverflow.VerticalScroller;\n\n\n\nExt.layout.boxOverflow.HorizontalScroller = Ext.extend(Ext.layout.boxOverflow.Scroller, {\n    handleOverflow: function(calculations, targetSize) {\n        Ext.layout.boxOverflow.HorizontalScroller.superclass.handleOverflow.apply(this, arguments);\n        \n        return {\n            targetSize: {\n                height: targetSize.height,\n                width : targetSize.width - (this.beforeCt.getWidth() + this.afterCt.getWidth())\n            }\n        };\n    },\n    \n    \n    createInnerElements: function() {\n        var target = this.layout.innerCt;\n        \n        \n        \n        if (!this.beforeCt) {\n            this.afterCt  = target.insertSibling({cls: this.afterCls},  'before');\n            this.beforeCt = target.insertSibling({cls: this.beforeCls}, 'before');\n            \n            this.createWheelListener();\n        }\n    },\n    \n    \n    scrollTo: function(position, animate) {\n        var oldPosition = this.getScrollPosition(),\n            newPosition = position.constrain(0, this.getMaxScrollRight());\n        \n        if (newPosition != oldPosition && !this.scrolling) {\n            if (animate == undefined) {\n                animate = this.animateScroll;\n            }\n            \n            this.layout.innerCt.scrollTo('left', newPosition, animate ? this.getScrollAnim() : false);\n            \n            if (animate) {\n                this.scrolling = true;\n            } else {\n                this.scrolling = false;\n                this.updateScrollButtons();\n            }\n        }\n    },\n    \n    \n    getScrollPosition: function(){\n        return parseInt(this.layout.innerCt.dom.scrollLeft, 10) || 0;\n    },\n    \n    \n    getMaxScrollRight: function() {\n        return this.layout.innerCt.dom.scrollWidth - this.layout.innerCt.getWidth();\n    },\n    \n    \n    atExtremeAfter: function() {\n        return this.getScrollPosition() >= this.getMaxScrollRight();\n    }\n});\n\nExt.layout.boxOverflow.scroller.hbox = Ext.layout.boxOverflow.HorizontalScroller;\nExt.layout.HBoxLayout = Ext.extend(Ext.layout.BoxLayout, {\n    \n    align: 'top', \n\n    type : 'hbox',\n\n    \n    \n\n    \n    calculateChildBoxes: function(visibleItems, targetSize) {\n        var visibleCount = visibleItems.length,\n\n            padding      = this.padding,\n            topOffset    = padding.top,\n            leftOffset   = padding.left,\n            paddingVert  = topOffset  + padding.bottom,\n            paddingHoriz = leftOffset + padding.right,\n\n            width        = targetSize.width - this.scrollOffset,\n            height       = targetSize.height,\n            availHeight  = Math.max(0, height - paddingVert),\n\n            isStart      = this.pack == 'start',\n            isCenter     = this.pack == 'center',\n            isEnd        = this.pack == 'end',\n\n            nonFlexWidth = 0,\n            maxHeight    = 0,\n            totalFlex    = 0,\n            desiredWidth = 0,\n            minimumWidth = 0,\n\n            \n            boxes        = [],\n\n            \n            child, childWidth, childHeight, childSize, childMargins, canLayout, i, calcs, flexedWidth,\n            horizMargins, vertMargins, stretchHeight;\n\n        \n        for (i = 0; i < visibleCount; i++) {\n            child       = visibleItems[i];\n            childHeight = child.height;\n            childWidth  = child.width;\n            canLayout   = !child.hasLayout && typeof child.doLayout == 'function';\n\n            \n            if (typeof childWidth != 'number') {\n\n                \n                if (child.flex && !childWidth) {\n                    totalFlex += child.flex;\n\n                \n                } else {\n                    \n                    \n                    if (!childWidth && canLayout) {\n                        child.doLayout();\n                    }\n\n                    childSize   = child.getSize();\n                    childWidth  = childSize.width;\n                    childHeight = childSize.height;\n                }\n            }\n\n            childMargins = child.margins;\n            horizMargins = childMargins.left + childMargins.right;\n\n            nonFlexWidth += horizMargins + (childWidth || 0);\n            desiredWidth += horizMargins + (child.flex ? child.minWidth || 0 : childWidth);\n            minimumWidth += horizMargins + (child.minWidth || childWidth || 0);\n\n            \n            if (typeof childHeight != 'number') {\n                if (canLayout) {\n                    child.doLayout();\n                }\n                childHeight = child.getHeight();\n            }\n\n            maxHeight = Math.max(maxHeight, childHeight + childMargins.top + childMargins.bottom);\n\n            \n            boxes.push({\n                component: child,\n                height   : childHeight || undefined,\n                width    : childWidth  || undefined\n            });\n        }\n\n        var shortfall = desiredWidth - width,\n            tooNarrow = minimumWidth > width;\n\n        \n        var availableWidth = Math.max(0, width - nonFlexWidth - paddingHoriz);\n\n        if (tooNarrow) {\n            for (i = 0; i < visibleCount; i++) {\n                boxes[i].width = visibleItems[i].minWidth || visibleItems[i].width || boxes[i].width;\n            }\n        } else {\n            \n            \n            if (shortfall > 0) {\n                var minWidths = [];\n\n                \n                \n                \n                for (var index = 0, length = visibleCount; index < length; index++) {\n                    var item     = visibleItems[index],\n                        minWidth = item.minWidth || 0;\n\n                    \n                    \n                    if (item.flex) {\n                        boxes[index].width = minWidth;\n                    } else {\n                        minWidths.push({\n                            minWidth : minWidth,\n                            available: boxes[index].width - minWidth,\n                            index    : index\n                        });\n                    }\n                }\n\n                \n                minWidths.sort(function(a, b) {\n                    return a.available > b.available ? 1 : -1;\n                });\n\n                \n                for (var i = 0, length = minWidths.length; i < length; i++) {\n                    var itemIndex = minWidths[i].index;\n\n                    if (itemIndex == undefined) {\n                        continue;\n                    }\n\n                    var item      = visibleItems[itemIndex],\n                        box       = boxes[itemIndex],\n                        oldWidth  = box.width,\n                        minWidth  = item.minWidth,\n                        newWidth  = Math.max(minWidth, oldWidth - Math.ceil(shortfall / (length - i))),\n                        reduction = oldWidth - newWidth;\n\n                    boxes[itemIndex].width = newWidth;\n                    shortfall -= reduction;\n                }\n            } else {\n                \n                var remainingWidth = availableWidth,\n                    remainingFlex  = totalFlex;\n\n                \n                for (i = 0; i < visibleCount; i++) {\n                    child = visibleItems[i];\n                    calcs = boxes[i];\n\n                    childMargins = child.margins;\n                    vertMargins  = childMargins.top + childMargins.bottom;\n\n                    if (isStart && child.flex && !child.width) {\n                        flexedWidth     = Math.ceil((child.flex / remainingFlex) * remainingWidth);\n                        remainingWidth -= flexedWidth;\n                        remainingFlex  -= child.flex;\n\n                        calcs.width = flexedWidth;\n                        calcs.dirtySize = true;\n                    }\n                }\n            }\n        }\n\n        if (isCenter) {\n            leftOffset += availableWidth / 2;\n        } else if (isEnd) {\n            leftOffset += availableWidth;\n        }\n\n        \n        for (i = 0; i < visibleCount; i++) {\n            child = visibleItems[i];\n            calcs = boxes[i];\n\n            childMargins = child.margins;\n            leftOffset  += childMargins.left;\n            vertMargins  = childMargins.top + childMargins.bottom;\n\n            calcs.left = leftOffset;\n            calcs.top  = topOffset + childMargins.top;\n\n            switch (this.align) {\n                case 'stretch':\n                    stretchHeight = availHeight - vertMargins;\n                    calcs.height  = stretchHeight.constrain(child.minHeight || 0, child.maxHeight || 1000000);\n                    calcs.dirtySize = true;\n                    break;\n                case 'stretchmax':\n                    stretchHeight = maxHeight - vertMargins;\n                    calcs.height  = stretchHeight.constrain(child.minHeight || 0, child.maxHeight || 1000000);\n                    calcs.dirtySize = true;\n                    break;\n                case 'middle':\n                    var diff = availHeight - calcs.height - vertMargins;\n                    if (diff > 0) {\n                        calcs.top = topOffset + vertMargins + (diff / 2);\n                    }\n            }\n\n            leftOffset += calcs.width + childMargins.right;\n        }\n\n        return {\n            boxes: boxes,\n            meta : {\n                maxHeight   : maxHeight,\n                nonFlexWidth: nonFlexWidth,\n                desiredWidth: desiredWidth,\n                minimumWidth: minimumWidth,\n                shortfall   : desiredWidth - width,\n                tooNarrow   : tooNarrow\n            }\n        };\n    }\n});\n\nExt.Container.LAYOUTS.hbox = Ext.layout.HBoxLayout;\nExt.layout.VBoxLayout = Ext.extend(Ext.layout.BoxLayout, {\n    \n    align : 'left', \n    type: 'vbox',\n\n    \n\n    \n\n    \n    calculateChildBoxes: function(visibleItems, targetSize) {\n        var visibleCount = visibleItems.length,\n\n            padding      = this.padding,\n            topOffset    = padding.top,\n            leftOffset   = padding.left,\n            paddingVert  = topOffset  + padding.bottom,\n            paddingHoriz = leftOffset + padding.right,\n\n            width        = targetSize.width - this.scrollOffset,\n            height       = targetSize.height,\n            availWidth   = Math.max(0, width - paddingHoriz),\n\n            isStart      = this.pack == 'start',\n            isCenter     = this.pack == 'center',\n            isEnd        = this.pack == 'end',\n\n            nonFlexHeight= 0,\n            maxWidth     = 0,\n            totalFlex    = 0,\n            desiredHeight= 0,\n            minimumHeight= 0,\n\n            \n            boxes        = [],\n\n            \n            child, childWidth, childHeight, childSize, childMargins, canLayout, i, calcs, flexedHeight,\n            horizMargins, vertMargins, stretchWidth, length;\n\n        \n        for (i = 0; i < visibleCount; i++) {\n            child = visibleItems[i];\n            childHeight = child.height;\n            childWidth  = child.width;\n            canLayout   = !child.hasLayout && typeof child.doLayout == 'function';\n\n            \n            if (typeof childHeight != 'number') {\n\n                \n                if (child.flex && !childHeight) {\n                    totalFlex += child.flex;\n\n                \n                } else {\n                    \n                    \n                    if (!childHeight && canLayout) {\n                        child.doLayout();\n                    }\n\n                    childSize = child.getSize();\n                    childWidth = childSize.width;\n                    childHeight = childSize.height;\n                }\n            }\n\n            childMargins = child.margins;\n            vertMargins  = childMargins.top + childMargins.bottom;\n\n            nonFlexHeight += vertMargins + (childHeight || 0);\n            desiredHeight += vertMargins + (child.flex ? child.minHeight || 0 : childHeight);\n            minimumHeight += vertMargins + (child.minHeight || childHeight || 0);\n\n            \n            if (typeof childWidth != 'number') {\n                if (canLayout) {\n                    child.doLayout();\n                }\n                childWidth = child.getWidth();\n            }\n\n            maxWidth = Math.max(maxWidth, childWidth + childMargins.left + childMargins.right);\n\n            \n            boxes.push({\n                component: child,\n                height   : childHeight || undefined,\n                width    : childWidth || undefined\n            });\n        }\n\n        var shortfall = desiredHeight - height,\n            tooNarrow = minimumHeight > height;\n\n        \n        var availableHeight = Math.max(0, (height - nonFlexHeight - paddingVert));\n\n        if (tooNarrow) {\n            for (i = 0, length = visibleCount; i < length; i++) {\n                boxes[i].height = visibleItems[i].minHeight || visibleItems[i].height || boxes[i].height;\n            }\n        } else {\n            \n            \n            if (shortfall > 0) {\n                var minHeights = [];\n\n                \n                \n                \n                for (var index = 0, length = visibleCount; index < length; index++) {\n                    var item      = visibleItems[index],\n                        minHeight = item.minHeight || 0;\n\n                    \n                    \n                    if (item.flex) {\n                        boxes[index].height = minHeight;\n                    } else {\n                        minHeights.push({\n                            minHeight: minHeight,\n                            available: boxes[index].height - minHeight,\n                            index    : index\n                        });\n                    }\n                }\n\n                \n                minHeights.sort(function(a, b) {\n                    return a.available > b.available ? 1 : -1;\n                });\n\n                \n                for (var i = 0, length = minHeights.length; i < length; i++) {\n                    var itemIndex = minHeights[i].index;\n\n                    if (itemIndex == undefined) {\n                        continue;\n                    }\n\n                    var item      = visibleItems[itemIndex],\n                        box       = boxes[itemIndex],\n                        oldHeight  = box.height,\n                        minHeight  = item.minHeight,\n                        newHeight  = Math.max(minHeight, oldHeight - Math.ceil(shortfall / (length - i))),\n                        reduction = oldHeight - newHeight;\n\n                    boxes[itemIndex].height = newHeight;\n                    shortfall -= reduction;\n                }\n            } else {\n                \n                var remainingHeight = availableHeight,\n                    remainingFlex   = totalFlex;\n\n                \n                for (i = 0; i < visibleCount; i++) {\n                    child = visibleItems[i];\n                    calcs = boxes[i];\n\n                    childMargins = child.margins;\n                    horizMargins = childMargins.left + childMargins.right;\n\n                    if (isStart && child.flex && !child.height) {\n                        flexedHeight     = Math.ceil((child.flex / remainingFlex) * remainingHeight);\n                        remainingHeight -= flexedHeight;\n                        remainingFlex   -= child.flex;\n\n                        calcs.height = flexedHeight;\n                        calcs.dirtySize = true;\n                    }\n                }\n            }\n        }\n\n        if (isCenter) {\n            topOffset += availableHeight / 2;\n        } else if (isEnd) {\n            topOffset += availableHeight;\n        }\n\n        \n        for (i = 0; i < visibleCount; i++) {\n            child = visibleItems[i];\n            calcs = boxes[i];\n\n            childMargins = child.margins;\n            topOffset   += childMargins.top;\n            horizMargins = childMargins.left + childMargins.right;\n\n\n            calcs.left = leftOffset + childMargins.left;\n            calcs.top  = topOffset;\n\n            switch (this.align) {\n                case 'stretch':\n                    stretchWidth = availWidth - horizMargins;\n                    calcs.width  = stretchWidth.constrain(child.minWidth || 0, child.maxWidth || 1000000);\n                    calcs.dirtySize = true;\n                    break;\n                case 'stretchmax':\n                    stretchWidth = maxWidth - horizMargins;\n                    calcs.width  = stretchWidth.constrain(child.minWidth || 0, child.maxWidth || 1000000);\n                    calcs.dirtySize = true;\n                    break;\n                case 'center':\n                    var diff = availWidth - calcs.width - horizMargins;\n                    if (diff > 0) {\n                        calcs.left = leftOffset + horizMargins + (diff / 2);\n                    }\n            }\n\n            topOffset += calcs.height + childMargins.bottom;\n        }\n\n        return {\n            boxes: boxes,\n            meta : {\n                maxWidth     : maxWidth,\n                nonFlexHeight: nonFlexHeight,\n                desiredHeight: desiredHeight,\n                minimumHeight: minimumHeight,\n                shortfall    : desiredHeight - height,\n                tooNarrow    : tooNarrow\n            }\n        };\n    }\n});\n\nExt.Container.LAYOUTS.vbox = Ext.layout.VBoxLayout;\n\nExt.layout.ToolbarLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    monitorResize : true,\n\n    type: 'toolbar',\n\n    \n    triggerWidth: 18,\n\n    \n    noItemsMenuText : '<div class=\"x-toolbar-no-items\">(None)</div>',\n\n    \n    lastOverflow: false,\n\n    \n    tableHTML: [\n        '<table cellspacing=\"0\" class=\"x-toolbar-ct\">',\n            '<tbody>',\n                '<tr>',\n                    '<td class=\"x-toolbar-left\" align=\"{0}\">',\n                        '<table cellspacing=\"0\">',\n                            '<tbody>',\n                                '<tr class=\"x-toolbar-left-row\"></tr>',\n                            '</tbody>',\n                        '</table>',\n                    '</td>',\n                    '<td class=\"x-toolbar-right\" align=\"right\">',\n                        '<table cellspacing=\"0\" class=\"x-toolbar-right-ct\">',\n                            '<tbody>',\n                                '<tr>',\n                                    '<td>',\n                                        '<table cellspacing=\"0\">',\n                                            '<tbody>',\n                                                '<tr class=\"x-toolbar-right-row\"></tr>',\n                                            '</tbody>',\n                                        '</table>',\n                                    '</td>',\n                                    '<td>',\n                                        '<table cellspacing=\"0\">',\n                                            '<tbody>',\n                                                '<tr class=\"x-toolbar-extras-row\"></tr>',\n                                            '</tbody>',\n                                        '</table>',\n                                    '</td>',\n                                '</tr>',\n                            '</tbody>',\n                        '</table>',\n                    '</td>',\n                '</tr>',\n            '</tbody>',\n        '</table>'\n    ].join(\"\"),\n\n    \n    onLayout : function(ct, target) {\n        \n        if (!this.leftTr) {\n            var align = ct.buttonAlign == 'center' ? 'center' : 'left';\n\n            target.addClass('x-toolbar-layout-ct');\n            target.insertHtml('beforeEnd', String.format(this.tableHTML, align));\n\n            this.leftTr   = target.child('tr.x-toolbar-left-row', true);\n            this.rightTr  = target.child('tr.x-toolbar-right-row', true);\n            this.extrasTr = target.child('tr.x-toolbar-extras-row', true);\n\n            if (this.hiddenItem == undefined) {\n                \n                this.hiddenItems = [];\n            }\n        }\n\n        var side     = ct.buttonAlign == 'right' ? this.rightTr : this.leftTr,\n            items    = ct.items.items,\n            position = 0;\n\n        \n        for (var i = 0, len = items.length, c; i < len; i++, position++) {\n            c = items[i];\n\n            if (c.isFill) {\n                side   = this.rightTr;\n                position = -1;\n            } else if (!c.rendered) {\n                c.render(this.insertCell(c, side, position));\n                this.configureItem(c);\n            } else {\n                if (!c.xtbHidden && !this.isValidParent(c, side.childNodes[position])) {\n                    var td = this.insertCell(c, side, position);\n                    td.appendChild(c.getPositionEl().dom);\n                    c.container = Ext.get(td);\n                }\n            }\n        }\n\n        \n        this.cleanup(this.leftTr);\n        this.cleanup(this.rightTr);\n        this.cleanup(this.extrasTr);\n        this.fitToSize(target);\n    },\n\n    \n    cleanup : function(el) {\n        var cn = el.childNodes, i, c;\n\n        for (i = cn.length-1; i >= 0 && (c = cn[i]); i--) {\n            if (!c.firstChild) {\n                el.removeChild(c);\n            }\n        }\n    },\n\n    \n    insertCell : function(c, target, position) {\n        var td = document.createElement('td');\n        td.className = 'x-toolbar-cell';\n\n        target.insertBefore(td, target.childNodes[position] || null);\n\n        return td;\n    },\n\n    \n    hideItem : function(item) {\n        this.hiddenItems.push(item);\n\n        item.xtbHidden = true;\n        item.xtbWidth = item.getPositionEl().dom.parentNode.offsetWidth;\n        item.hide();\n    },\n\n    \n    unhideItem : function(item) {\n        item.show();\n        item.xtbHidden = false;\n        this.hiddenItems.remove(item);\n    },\n\n    \n    getItemWidth : function(c) {\n        return c.hidden ? (c.xtbWidth || 0) : c.getPositionEl().dom.parentNode.offsetWidth;\n    },\n\n    \n    fitToSize : function(target) {\n        if (this.container.enableOverflow === false) {\n            return;\n        }\n\n        var width       = target.dom.clientWidth,\n            tableWidth  = target.dom.firstChild.offsetWidth,\n            clipWidth   = width - this.triggerWidth,\n            lastWidth   = this.lastWidth || 0,\n\n            hiddenItems = this.hiddenItems,\n            hasHiddens  = hiddenItems.length != 0,\n            isLarger    = width >= lastWidth;\n\n        this.lastWidth  = width;\n\n        if (tableWidth > width || (hasHiddens && isLarger)) {\n            var items     = this.container.items.items,\n                len       = items.length,\n                loopWidth = 0,\n                item;\n\n            for (var i = 0; i < len; i++) {\n                item = items[i];\n\n                if (!item.isFill) {\n                    loopWidth += this.getItemWidth(item);\n                    if (loopWidth > clipWidth) {\n                        if (!(item.hidden || item.xtbHidden)) {\n                            this.hideItem(item);\n                        }\n                    } else if (item.xtbHidden) {\n                        this.unhideItem(item);\n                    }\n                }\n            }\n        }\n\n        \n        hasHiddens = hiddenItems.length != 0;\n\n        if (hasHiddens) {\n            this.initMore();\n\n            if (!this.lastOverflow) {\n                this.container.fireEvent('overflowchange', this.container, true);\n                this.lastOverflow = true;\n            }\n        } else if (this.more) {\n            this.clearMenu();\n            this.more.destroy();\n            delete this.more;\n\n            if (this.lastOverflow) {\n                this.container.fireEvent('overflowchange', this.container, false);\n                this.lastOverflow = false;\n            }\n        }\n    },\n\n    \n    createMenuConfig : function(component, hideOnClick){\n        var config = Ext.apply({}, component.initialConfig),\n            group  = component.toggleGroup;\n\n        Ext.copyTo(config, component, [\n            'iconCls', 'icon', 'itemId', 'disabled', 'handler', 'scope', 'menu'\n        ]);\n\n        Ext.apply(config, {\n            text       : component.overflowText || component.text,\n            hideOnClick: hideOnClick\n        });\n\n        if (group || component.enableToggle) {\n            Ext.apply(config, {\n                group  : group,\n                checked: component.pressed,\n                listeners: {\n                    checkchange: function(item, checked){\n                        component.toggle(checked);\n                    }\n                }\n            });\n        }\n\n        delete config.ownerCt;\n        delete config.xtype;\n        delete config.id;\n\n        return config;\n    },\n\n    \n    addComponentToMenu : function(menu, component) {\n        if (component instanceof Ext.Toolbar.Separator) {\n            menu.add('-');\n\n        } else if (Ext.isFunction(component.isXType)) {\n            if (component.isXType('splitbutton')) {\n                menu.add(this.createMenuConfig(component, true));\n\n            } else if (component.isXType('button')) {\n                menu.add(this.createMenuConfig(component, !component.menu));\n\n            } else if (component.isXType('buttongroup')) {\n                component.items.each(function(item){\n                     this.addComponentToMenu(menu, item);\n                }, this);\n            }\n        }\n    },\n\n    \n    clearMenu : function(){\n        var menu = this.moreMenu;\n        if (menu && menu.items) {\n            menu.items.each(function(item){\n                delete item.menu;\n            });\n        }\n    },\n\n    \n    beforeMoreShow : function(menu) {\n        var items = this.container.items.items,\n            len   = items.length,\n            item,\n            prev;\n\n        var needsSep = function(group, item){\n            return group.isXType('buttongroup') && !(item instanceof Ext.Toolbar.Separator);\n        };\n\n        this.clearMenu();\n        menu.removeAll();\n        for (var i = 0; i < len; i++) {\n            item = items[i];\n            if (item.xtbHidden) {\n                if (prev && (needsSep(item, prev) || needsSep(prev, item))) {\n                    menu.add('-');\n                }\n                this.addComponentToMenu(menu, item);\n                prev = item;\n            }\n        }\n\n        \n        if (menu.items.length < 1) {\n            menu.add(this.noItemsMenuText);\n        }\n    },\n\n    \n    initMore : function(){\n        if (!this.more) {\n            \n            this.moreMenu = new Ext.menu.Menu({\n                ownerCt : this.container,\n                listeners: {\n                    beforeshow: this.beforeMoreShow,\n                    scope: this\n                }\n            });\n\n            \n            this.more = new Ext.Button({\n                iconCls: 'x-toolbar-more-icon',\n                cls    : 'x-toolbar-more',\n                menu   : this.moreMenu,\n                ownerCt: this.container\n            });\n\n            var td = this.insertCell(this.more, this.extrasTr, 100);\n            this.more.render(td);\n        }\n    },\n\n    destroy : function(){\n        Ext.destroy(this.more, this.moreMenu);\n        delete this.leftTr;\n        delete this.rightTr;\n        delete this.extrasTr;\n        Ext.layout.ToolbarLayout.superclass.destroy.call(this);\n    }\n});\n\nExt.Container.LAYOUTS.toolbar = Ext.layout.ToolbarLayout;\n\n Ext.layout.MenuLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    monitorResize : true,\n\n    type: 'menu',\n\n    setContainer : function(ct){\n        this.monitorResize = !ct.floating;\n        \n        \n        ct.on('autosize', this.doAutoSize, this);\n        Ext.layout.MenuLayout.superclass.setContainer.call(this, ct);\n    },\n\n    renderItem : function(c, position, target){\n        if (!this.itemTpl) {\n            this.itemTpl = Ext.layout.MenuLayout.prototype.itemTpl = new Ext.XTemplate(\n                '<li id=\"{itemId}\" class=\"{itemCls}\">',\n                    '<tpl if=\"needsIcon\">',\n                        '<img alt=\"{altText}\" src=\"{icon}\" class=\"{iconCls}\"/>',\n                    '</tpl>',\n                '</li>'\n            );\n        }\n\n        if(c && !c.rendered){\n            if(Ext.isNumber(position)){\n                position = target.dom.childNodes[position];\n            }\n            var a = this.getItemArgs(c);\n\n\n            c.render(c.positionEl = position ?\n                this.itemTpl.insertBefore(position, a, true) :\n                this.itemTpl.append(target, a, true));\n\n\n            c.positionEl.menuItemId = c.getItemId();\n\n\n\n            if (!a.isMenuItem && a.needsIcon) {\n                c.positionEl.addClass('x-menu-list-item-indent');\n            }\n            this.configureItem(c);\n        }else if(c && !this.isValidParent(c, target)){\n            if(Ext.isNumber(position)){\n                position = target.dom.childNodes[position];\n            }\n            target.dom.insertBefore(c.getActionEl().dom, position || null);\n        }\n    },\n\n    getItemArgs : function(c) {\n        var isMenuItem = c instanceof Ext.menu.Item,\n            canHaveIcon = !(isMenuItem || c instanceof Ext.menu.Separator);\n\n        return {\n            isMenuItem: isMenuItem,\n            needsIcon: canHaveIcon && (c.icon || c.iconCls),\n            icon: c.icon || Ext.BLANK_IMAGE_URL,\n            iconCls: 'x-menu-item-icon ' + (c.iconCls || ''),\n            itemId: 'x-menu-el-' + c.id,\n            itemCls: 'x-menu-list-item ',\n            altText: c.altText || ''\n        };\n    },\n\n    \n    isValidParent : function(c, target) {\n        return c.el.up('li.x-menu-list-item', 5).dom.parentNode === (target.dom || target);\n    },\n\n    onLayout : function(ct, target){\n        Ext.layout.MenuLayout.superclass.onLayout.call(this, ct, target);\n        this.doAutoSize();\n    },\n\n    doAutoSize : function(){\n        var ct = this.container, w = ct.width;\n        if(ct.floating){\n            if(w){\n                ct.setWidth(w);\n            }else if(Ext.isIE9m){\n                ct.setWidth(Ext.isStrict && (Ext.isIE7 || Ext.isIE8 || Ext.isIE9) ? 'auto' : ct.minWidth);\n                var el = ct.getEl(), t = el.dom.offsetWidth; \n                ct.setWidth(ct.getLayoutTarget().getWidth() + el.getFrameWidth('lr'));\n            }\n        }\n    }\n});\nExt.Container.LAYOUTS['menu'] = Ext.layout.MenuLayout;\n\nExt.Viewport = Ext.extend(Ext.Container, {\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n\n    initComponent : function() {\n        Ext.Viewport.superclass.initComponent.call(this);\n        document.getElementsByTagName('html')[0].className += ' x-viewport';\n        this.el = Ext.getBody();\n        this.el.setHeight = Ext.emptyFn;\n        this.el.setWidth = Ext.emptyFn;\n        this.el.setSize = Ext.emptyFn;\n        this.el.dom.scroll = 'no';\n        this.allowDomMove = false;\n        this.autoWidth = true;\n        this.autoHeight = true;\n        Ext.EventManager.onWindowResize(this.fireResize, this);\n        this.renderTo = this.el;\n    },\n\n    fireResize : function(w, h){\n        this.fireEvent('resize', this, w, h, w, h);\n    }\n});\nExt.reg('viewport', Ext.Viewport);\n\nExt.Panel = Ext.extend(Ext.Container, {\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n\n    \n    \n    \n    \n    \n    \n    \n    \n\n\n    \n    baseCls : 'x-panel',\n    \n    collapsedCls : 'x-panel-collapsed',\n    \n    maskDisabled : true,\n    \n    animCollapse : Ext.enableFx,\n    \n    headerAsText : true,\n    \n    buttonAlign : 'right',\n    \n    collapsed : false,\n    \n    collapseFirst : true,\n    \n    minButtonWidth : 75,\n    \n    \n    elements : 'body',\n    \n    preventBodyReset : false,\n\n    \n    padding: undefined,\n\n    \n    resizeEvent: 'bodyresize',\n\n    \n    \n    \n    toolTarget : 'header',\n    collapseEl : 'bwrap',\n    slideAnchor : 't',\n    disabledClass : '',\n\n    \n    deferHeight : true,\n    \n    expandDefaults: {\n        duration : 0.25\n    },\n    \n    collapseDefaults : {\n        duration : 0.25\n    },\n\n    \n    initComponent : function(){\n        Ext.Panel.superclass.initComponent.call(this);\n\n        this.addEvents(\n            \n            'bodyresize',\n            \n            'titlechange',\n            \n            'iconchange',\n            \n            'collapse',\n            \n            'expand',\n            \n            'beforecollapse',\n            \n            'beforeexpand',\n            \n            'beforeclose',\n            \n            'close',\n            \n            'activate',\n            \n            'deactivate'\n        );\n\n        if(this.unstyled){\n            this.baseCls = 'x-plain';\n        }\n\n\n        this.toolbars = [];\n        \n        if(this.tbar){\n            this.elements += ',tbar';\n            this.topToolbar = this.createToolbar(this.tbar);\n            this.tbar = null;\n\n        }\n        if(this.bbar){\n            this.elements += ',bbar';\n            this.bottomToolbar = this.createToolbar(this.bbar);\n            this.bbar = null;\n        }\n\n        if(this.header === true){\n            this.elements += ',header';\n            this.header = null;\n        }else if(this.headerCfg || (this.title && this.header !== false)){\n            this.elements += ',header';\n        }\n\n        if(this.footerCfg || this.footer === true){\n            this.elements += ',footer';\n            this.footer = null;\n        }\n\n        if(this.buttons){\n            this.fbar = this.buttons;\n            this.buttons = null;\n        }\n        if(this.fbar){\n            this.createFbar(this.fbar);\n        }\n        if(this.autoLoad){\n            this.on('render', this.doAutoLoad, this, {delay:10});\n        }\n    },\n\n    \n    createFbar : function(fbar){\n        var min = this.minButtonWidth;\n        this.elements += ',footer';\n        this.fbar = this.createToolbar(fbar, {\n            buttonAlign: this.buttonAlign,\n            toolbarCls: 'x-panel-fbar',\n            enableOverflow: false,\n            defaults: function(c){\n                return {\n                    minWidth: c.minWidth || min\n                };\n            }\n        });\n        \n        \n        \n        this.fbar.items.each(function(c){\n            c.minWidth = c.minWidth || this.minButtonWidth;\n        }, this);\n        this.buttons = this.fbar.items.items;\n    },\n\n    \n    createToolbar: function(tb, options){\n        var result;\n        \n        if(Ext.isArray(tb)){\n            tb = {\n                items: tb\n            };\n        }\n        result = tb.events ? Ext.apply(tb, options) : this.createComponent(Ext.apply({}, tb, options), 'toolbar');\n        this.toolbars.push(result);\n        return result;\n    },\n\n    \n    createElement : function(name, pnode){\n        if(this[name]){\n            pnode.appendChild(this[name].dom);\n            return;\n        }\n\n        if(name === 'bwrap' || this.elements.indexOf(name) != -1){\n            if(this[name+'Cfg']){\n                this[name] = Ext.fly(pnode).createChild(this[name+'Cfg']);\n            }else{\n                var el = document.createElement('div');\n                el.className = this[name+'Cls'];\n                this[name] = Ext.get(pnode.appendChild(el));\n            }\n            if(this[name+'CssClass']){\n                this[name].addClass(this[name+'CssClass']);\n            }\n            if(this[name+'Style']){\n                this[name].applyStyles(this[name+'Style']);\n            }\n        }\n    },\n\n    \n    onRender : function(ct, position){\n        Ext.Panel.superclass.onRender.call(this, ct, position);\n        this.createClasses();\n\n        var el = this.el,\n            d = el.dom,\n            bw,\n            ts;\n\n\n        if(this.collapsible && !this.hideCollapseTool){\n            this.tools = this.tools ? this.tools.slice(0) : [];\n            this.tools[this.collapseFirst?'unshift':'push']({\n                id: 'toggle',\n                handler : this.toggleCollapse,\n                scope: this\n            });\n        }\n\n        if(this.tools){\n            ts = this.tools;\n            this.elements += (this.header !== false) ? ',header' : '';\n        }\n        this.tools = {};\n\n        el.addClass(this.baseCls);\n        if(d.firstChild){ \n            this.header = el.down('.'+this.headerCls);\n            this.bwrap = el.down('.'+this.bwrapCls);\n            var cp = this.bwrap ? this.bwrap : el;\n            this.tbar = cp.down('.'+this.tbarCls);\n            this.body = cp.down('.'+this.bodyCls);\n            this.bbar = cp.down('.'+this.bbarCls);\n            this.footer = cp.down('.'+this.footerCls);\n            this.fromMarkup = true;\n        }\n        if (this.preventBodyReset === true) {\n            el.addClass('x-panel-reset');\n        }\n        if(this.cls){\n            el.addClass(this.cls);\n        }\n\n        if(this.buttons){\n            this.elements += ',footer';\n        }\n\n        \n\n        \n        if(this.frame){\n            el.insertHtml('afterBegin', String.format(Ext.Element.boxMarkup, this.baseCls));\n\n            this.createElement('header', d.firstChild.firstChild.firstChild);\n            this.createElement('bwrap', d);\n\n            \n            bw = this.bwrap.dom;\n            var ml = d.childNodes[1], bl = d.childNodes[2];\n            bw.appendChild(ml);\n            bw.appendChild(bl);\n\n            var mc = bw.firstChild.firstChild.firstChild;\n            this.createElement('tbar', mc);\n            this.createElement('body', mc);\n            this.createElement('bbar', mc);\n            this.createElement('footer', bw.lastChild.firstChild.firstChild);\n\n            if(!this.footer){\n                this.bwrap.dom.lastChild.className += ' x-panel-nofooter';\n            }\n            \n            this.ft = Ext.get(this.bwrap.dom.lastChild);\n            this.mc = Ext.get(mc);\n        }else{\n            this.createElement('header', d);\n            this.createElement('bwrap', d);\n\n            \n            bw = this.bwrap.dom;\n            this.createElement('tbar', bw);\n            this.createElement('body', bw);\n            this.createElement('bbar', bw);\n            this.createElement('footer', bw);\n\n            if(!this.header){\n                this.body.addClass(this.bodyCls + '-noheader');\n                if(this.tbar){\n                    this.tbar.addClass(this.tbarCls + '-noheader');\n                }\n            }\n        }\n\n        if(Ext.isDefined(this.padding)){\n            this.body.setStyle('padding', this.body.addUnits(this.padding));\n        }\n\n        if(this.border === false){\n            this.el.addClass(this.baseCls + '-noborder');\n            this.body.addClass(this.bodyCls + '-noborder');\n            if(this.header){\n                this.header.addClass(this.headerCls + '-noborder');\n            }\n            if(this.footer){\n                this.footer.addClass(this.footerCls + '-noborder');\n            }\n            if(this.tbar){\n                this.tbar.addClass(this.tbarCls + '-noborder');\n            }\n            if(this.bbar){\n                this.bbar.addClass(this.bbarCls + '-noborder');\n            }\n        }\n\n        if(this.bodyBorder === false){\n           this.body.addClass(this.bodyCls + '-noborder');\n        }\n\n        this.bwrap.enableDisplayMode('block');\n\n        if(this.header){\n            this.header.unselectable();\n\n            \n            if(this.headerAsText){\n                this.header.dom.innerHTML =\n                    '<span class=\"' + this.headerTextCls + '\">'+this.header.dom.innerHTML+'</span>';\n\n                if(this.iconCls){\n                    this.setIconClass(this.iconCls);\n                }\n            }\n        }\n\n        if(this.floating){\n            this.makeFloating(this.floating);\n        }\n\n        if(this.collapsible && this.titleCollapse && this.header){\n            this.mon(this.header, 'click', this.toggleCollapse, this);\n            this.header.setStyle('cursor', 'pointer');\n        }\n        if(ts){\n            this.addTool.apply(this, ts);\n        }\n\n        \n        if(this.fbar){\n            this.footer.addClass('x-panel-btns');\n            this.fbar.ownerCt = this;\n            this.fbar.render(this.footer);\n            this.footer.createChild({cls:'x-clear'});\n        }\n        if(this.tbar && this.topToolbar){\n            this.topToolbar.ownerCt = this;\n            this.topToolbar.render(this.tbar);\n        }\n        if(this.bbar && this.bottomToolbar){\n            this.bottomToolbar.ownerCt = this;\n            this.bottomToolbar.render(this.bbar);\n        }\n    },\n\n    \n    setIconClass : function(cls){\n        var old = this.iconCls;\n        this.iconCls = cls;\n        if(this.rendered && this.header){\n            if(this.frame){\n                this.header.addClass('x-panel-icon');\n                this.header.replaceClass(old, this.iconCls);\n            }else{\n                var hd = this.header,\n                    img = hd.child('img.x-panel-inline-icon');\n                if(img){\n                    Ext.fly(img).replaceClass(old, this.iconCls);\n                }else{\n                    var hdspan = hd.child('span.' + this.headerTextCls);\n                    if (hdspan) {\n                        Ext.DomHelper.insertBefore(hdspan.dom, {\n                            tag:'img', alt: '', src: Ext.BLANK_IMAGE_URL, cls:'x-panel-inline-icon '+this.iconCls\n                        });\n                    }\n                 }\n            }\n        }\n        this.fireEvent('iconchange', this, cls, old);\n    },\n\n    \n    makeFloating : function(cfg){\n        this.floating = true;\n        this.el = new Ext.Layer(Ext.apply({}, cfg, {\n            shadow: Ext.isDefined(this.shadow) ? this.shadow : 'sides',\n            shadowOffset: this.shadowOffset,\n            constrain:false,\n            shim: this.shim === false ? false : undefined\n        }), this.el);\n    },\n\n    \n    getTopToolbar : function(){\n        return this.topToolbar;\n    },\n\n    \n    getBottomToolbar : function(){\n        return this.bottomToolbar;\n    },\n\n    \n    getFooterToolbar : function() {\n        return this.fbar;\n    },\n\n    \n    addButton : function(config, handler, scope){\n        if(!this.fbar){\n            this.createFbar([]);\n        }\n        if(handler){\n            if(Ext.isString(config)){\n                config = {text: config};\n            }\n            config = Ext.apply({\n                handler: handler,\n                scope: scope\n            }, config);\n        }\n        return this.fbar.add(config);\n    },\n\n    \n    addTool : function(){\n        if(!this.rendered){\n            if(!this.tools){\n                this.tools = [];\n            }\n            Ext.each(arguments, function(arg){\n                this.tools.push(arg);\n            }, this);\n            return;\n        }\n         \n        if(!this[this.toolTarget]){\n            return;\n        }\n        if(!this.toolTemplate){\n            \n            var tt = new Ext.Template(\n                 '<div class=\"x-tool x-tool-{id}\">&#160;</div>'\n            );\n            tt.disableFormats = true;\n            tt.compile();\n            Ext.Panel.prototype.toolTemplate = tt;\n        }\n        for(var i = 0, a = arguments, len = a.length; i < len; i++) {\n            var tc = a[i];\n            if(!this.tools[tc.id]){\n                var overCls = 'x-tool-'+tc.id+'-over';\n                var t = this.toolTemplate.insertFirst(this[this.toolTarget], tc, true);\n                this.tools[tc.id] = t;\n                t.enableDisplayMode('block');\n                this.mon(t, 'click',  this.createToolHandler(t, tc, overCls, this));\n                if(tc.on){\n                    this.mon(t, tc.on);\n                }\n                if(tc.hidden){\n                    t.hide();\n                }\n                if(tc.qtip){\n                    if(Ext.isObject(tc.qtip)){\n                        Ext.QuickTips.register(Ext.apply({\n                              target: t.id\n                        }, tc.qtip));\n                    } else {\n                        t.dom.qtip = tc.qtip;\n                    }\n                }\n                t.addClassOnOver(overCls);\n            }\n        }\n    },\n\n    onLayout : function(shallow, force){\n        Ext.Panel.superclass.onLayout.apply(this, arguments);\n        if(this.hasLayout && this.toolbars.length > 0){\n            Ext.each(this.toolbars, function(tb){\n                tb.doLayout(undefined, force);\n            });\n            this.syncHeight();\n        }\n    },\n\n    syncHeight : function(){\n        var h = this.toolbarHeight,\n                bd = this.body,\n                lsh = this.lastSize.height,\n                sz;\n\n        if(this.autoHeight || !Ext.isDefined(lsh) || lsh == 'auto'){\n            return;\n        }\n\n\n        if(h != this.getToolbarHeight()){\n            h = Math.max(0, lsh - this.getFrameHeight());\n            bd.setHeight(h);\n            sz = bd.getSize();\n            this.toolbarHeight = this.getToolbarHeight();\n            this.onBodyResize(sz.width, sz.height);\n        }\n    },\n\n    \n    onShow : function(){\n        if(this.floating){\n            return this.el.show();\n        }\n        Ext.Panel.superclass.onShow.call(this);\n    },\n\n    \n    onHide : function(){\n        if(this.floating){\n            return this.el.hide();\n        }\n        Ext.Panel.superclass.onHide.call(this);\n    },\n\n    \n    createToolHandler : function(t, tc, overCls, panel){\n        return function(e){\n            t.removeClass(overCls);\n            if(tc.stopEvent !== false){\n                e.stopEvent();\n            }\n            if(tc.handler){\n                tc.handler.call(tc.scope || t, e, t, panel, tc);\n            }\n        };\n    },\n\n    \n    afterRender : function(){\n        if(this.floating && !this.hidden){\n            this.el.show();\n        }\n        if(this.title){\n            this.setTitle(this.title);\n        }\n        Ext.Panel.superclass.afterRender.call(this); \n        if (this.collapsed) {\n            this.collapsed = false;\n            this.collapse(false);\n        }\n        this.initEvents();\n    },\n\n    \n    getKeyMap : function(){\n        if(!this.keyMap){\n            this.keyMap = new Ext.KeyMap(this.el, this.keys);\n        }\n        return this.keyMap;\n    },\n\n    \n    initEvents : function(){\n        if(this.keys){\n            this.getKeyMap();\n        }\n        if(this.draggable){\n            this.initDraggable();\n        }\n        if(this.toolbars.length > 0){\n            Ext.each(this.toolbars, function(tb){\n                tb.doLayout();\n                tb.on({\n                    scope: this,\n                    afterlayout: this.syncHeight,\n                    remove: this.syncHeight\n                });\n            }, this);\n            this.syncHeight();\n        }\n\n    },\n\n    \n    initDraggable : function(){\n        \n        this.dd = new Ext.Panel.DD(this, Ext.isBoolean(this.draggable) ? null : this.draggable);\n    },\n\n    \n    beforeEffect : function(anim){\n        if(this.floating){\n            this.el.beforeAction();\n        }\n        if(anim !== false){\n            this.el.addClass('x-panel-animated');\n        }\n    },\n\n    \n    afterEffect : function(anim){\n        this.syncShadow();\n        this.el.removeClass('x-panel-animated');\n    },\n\n    \n    createEffect : function(a, cb, scope){\n        var o = {\n            scope:scope,\n            block:true\n        };\n        if(a === true){\n            o.callback = cb;\n            return o;\n        }else if(!a.callback){\n            o.callback = cb;\n        }else { \n            o.callback = function(){\n                cb.call(scope);\n                Ext.callback(a.callback, a.scope);\n            };\n        }\n        return Ext.applyIf(o, a);\n    },\n\n    \n    collapse : function(animate){\n        if(this.collapsed || this.el.hasFxBlock() || this.fireEvent('beforecollapse', this, animate) === false){\n            return;\n        }\n        var doAnim = animate === true || (animate !== false && this.animCollapse);\n        this.beforeEffect(doAnim);\n        this.onCollapse(doAnim, animate);\n        return this;\n    },\n\n    \n    onCollapse : function(doAnim, animArg){\n        if(doAnim){\n            this[this.collapseEl].slideOut(this.slideAnchor,\n                    Ext.apply(this.createEffect(animArg||true, this.afterCollapse, this),\n                        this.collapseDefaults));\n        }else{\n            this[this.collapseEl].hide(this.hideMode);\n            this.afterCollapse(false);\n        }\n    },\n\n    \n    afterCollapse : function(anim){\n        this.collapsed = true;\n        this.el.addClass(this.collapsedCls);\n        if(anim !== false){\n            this[this.collapseEl].hide(this.hideMode);\n        }\n        this.afterEffect(anim);\n\n        \n        this.cascade(function(c) {\n            if (c.lastSize) {\n                c.lastSize = { width: undefined, height: undefined };\n            }\n        });\n        this.fireEvent('collapse', this);\n    },\n\n    \n    expand : function(animate){\n        if(!this.collapsed || this.el.hasFxBlock() || this.fireEvent('beforeexpand', this, animate) === false){\n            return;\n        }\n        var doAnim = animate === true || (animate !== false && this.animCollapse);\n        this.el.removeClass(this.collapsedCls);\n        this.beforeEffect(doAnim);\n        this.onExpand(doAnim, animate);\n        return this;\n    },\n\n    \n    onExpand : function(doAnim, animArg){\n        if(doAnim){\n            this[this.collapseEl].slideIn(this.slideAnchor,\n                    Ext.apply(this.createEffect(animArg||true, this.afterExpand, this),\n                        this.expandDefaults));\n        }else{\n            this[this.collapseEl].show(this.hideMode);\n            this.afterExpand(false);\n        }\n    },\n\n    \n    afterExpand : function(anim){\n        this.collapsed = false;\n        if(anim !== false){\n            this[this.collapseEl].show(this.hideMode);\n        }\n        this.afterEffect(anim);\n        if (this.deferLayout) {\n            delete this.deferLayout;\n            this.doLayout(true);\n        }\n        this.fireEvent('expand', this);\n    },\n\n    \n    toggleCollapse : function(animate){\n        this[this.collapsed ? 'expand' : 'collapse'](animate);\n        return this;\n    },\n\n    \n    onDisable : function(){\n        if(this.rendered && this.maskDisabled){\n            this.el.mask();\n        }\n        Ext.Panel.superclass.onDisable.call(this);\n    },\n\n    \n    onEnable : function(){\n        if(this.rendered && this.maskDisabled){\n            this.el.unmask();\n        }\n        Ext.Panel.superclass.onEnable.call(this);\n    },\n\n    \n    onResize : function(adjWidth, adjHeight, rawWidth, rawHeight){\n        var w = adjWidth,\n            h = adjHeight;\n\n        if(Ext.isDefined(w) || Ext.isDefined(h)){\n            if(!this.collapsed){\n                \n                \n                \n\n                if(Ext.isNumber(w)){\n                    this.body.setWidth(w = this.adjustBodyWidth(w - this.getFrameWidth()));\n                } else if (w == 'auto') {\n                    w = this.body.setWidth('auto').dom.offsetWidth;\n                } else {\n                    w = this.body.dom.offsetWidth;\n                }\n\n                if(this.tbar){\n                    this.tbar.setWidth(w);\n                    if(this.topToolbar){\n                        this.topToolbar.setSize(w);\n                    }\n                }\n                if(this.bbar){\n                    this.bbar.setWidth(w);\n                    if(this.bottomToolbar){\n                        this.bottomToolbar.setSize(w);\n                        \n                        if (Ext.isIE9m) {\n                            this.bbar.setStyle('position', 'static');\n                            this.bbar.setStyle('position', '');\n                        }\n                    }\n                }\n                if(this.footer){\n                    this.footer.setWidth(w);\n                    if(this.fbar){\n                        this.fbar.setSize(Ext.isIE9m ? (w - this.footer.getFrameWidth('lr')) : 'auto');\n                    }\n                }\n\n                \n                if(Ext.isNumber(h)){\n                    h = Math.max(0, h - this.getFrameHeight());\n                    \n                    this.body.setHeight(h);\n                }else if(h == 'auto'){\n                    this.body.setHeight(h);\n                }\n\n                if(this.disabled && this.el._mask){\n                    this.el._mask.setSize(this.el.dom.clientWidth, this.el.getHeight());\n                }\n            }else{\n                \n                this.queuedBodySize = {width: w, height: h};\n                if(!this.queuedExpand && this.allowQueuedExpand !== false){\n                    this.queuedExpand = true;\n                    this.on('expand', function(){\n                        delete this.queuedExpand;\n                        this.onResize(this.queuedBodySize.width, this.queuedBodySize.height);\n                    }, this, {single:true});\n                }\n            }\n            this.onBodyResize(w, h);\n        }\n        this.syncShadow();\n        Ext.Panel.superclass.onResize.call(this, adjWidth, adjHeight, rawWidth, rawHeight);\n\n    },\n\n    \n    onBodyResize: function(w, h){\n        this.fireEvent('bodyresize', this, w, h);\n    },\n\n    \n    getToolbarHeight: function(){\n        var h = 0;\n        if(this.rendered){\n            Ext.each(this.toolbars, function(tb){\n                h += tb.getHeight();\n            }, this);\n        }\n        return h;\n    },\n\n    \n    adjustBodyHeight : function(h){\n        return h;\n    },\n\n    \n    adjustBodyWidth : function(w){\n        return w;\n    },\n\n    \n    onPosition : function(){\n        this.syncShadow();\n    },\n\n    \n    getFrameWidth : function(){\n        var w = this.el.getFrameWidth('lr') + this.bwrap.getFrameWidth('lr');\n\n        if(this.frame){\n            var l = this.bwrap.dom.firstChild;\n            w += (Ext.fly(l).getFrameWidth('l') + Ext.fly(l.firstChild).getFrameWidth('r'));\n            w += this.mc.getFrameWidth('lr');\n        }\n        return w;\n    },\n\n    \n    getFrameHeight : function() {\n        var h  = this.el.getFrameWidth('tb') + this.bwrap.getFrameWidth('tb');\n        h += (this.tbar ? this.tbar.getHeight() : 0) +\n             (this.bbar ? this.bbar.getHeight() : 0);\n\n        if(this.frame){\n            h += this.el.dom.firstChild.offsetHeight + this.ft.dom.offsetHeight + this.mc.getFrameWidth('tb');\n        }else{\n            h += (this.header ? this.header.getHeight() : 0) +\n                (this.footer ? this.footer.getHeight() : 0);\n        }\n        return h;\n    },\n\n    \n    getInnerWidth : function(){\n        return this.getSize().width - this.getFrameWidth();\n    },\n\n    \n    getInnerHeight : function(){\n        return this.body.getHeight();\n        \n    },\n\n    \n    syncShadow : function(){\n        if(this.floating){\n            this.el.sync(true);\n        }\n    },\n\n    \n    getLayoutTarget : function(){\n        return this.body;\n    },\n\n    \n    getContentTarget : function(){\n        return this.body;\n    },\n\n    \n    setTitle : function(title, iconCls){\n        this.title = title;\n        if(this.header && this.headerAsText){\n            this.header.child('span').update(title);\n        }\n        if(iconCls){\n            this.setIconClass(iconCls);\n        }\n        this.fireEvent('titlechange', this, title);\n        return this;\n    },\n\n    \n    getUpdater : function(){\n        return this.body.getUpdater();\n    },\n\n     \n    load : function(){\n        var um = this.body.getUpdater();\n        um.update.apply(um, arguments);\n        return this;\n    },\n\n    \n    beforeDestroy : function(){\n        Ext.Panel.superclass.beforeDestroy.call(this);\n        if(this.header){\n            this.header.removeAllListeners();\n        }\n        if(this.tools){\n            for(var k in this.tools){\n                Ext.destroy(this.tools[k]);\n            }\n        }\n        if(this.toolbars.length > 0){\n            Ext.each(this.toolbars, function(tb){\n                tb.un('afterlayout', this.syncHeight, this);\n                tb.un('remove', this.syncHeight, this);\n            }, this);\n        }\n        if(Ext.isArray(this.buttons)){\n            while(this.buttons.length) {\n                Ext.destroy(this.buttons[0]);\n            }\n        }\n        if(this.rendered){\n            Ext.destroy(\n                this.ft,\n                this.header,\n                this.footer,\n                this.tbar,\n                this.bbar,\n                this.body,\n                this.mc,\n                this.bwrap,\n                this.dd\n            );\n            if (this.fbar) {\n                Ext.destroy(\n                    this.fbar,\n                    this.fbar.el\n                );\n            }\n        }\n        Ext.destroy(this.toolbars);\n    },\n\n    \n    createClasses : function(){\n        this.headerCls = this.baseCls + '-header';\n        this.headerTextCls = this.baseCls + '-header-text';\n        this.bwrapCls = this.baseCls + '-bwrap';\n        this.tbarCls = this.baseCls + '-tbar';\n        this.bodyCls = this.baseCls + '-body';\n        this.bbarCls = this.baseCls + '-bbar';\n        this.footerCls = this.baseCls + '-footer';\n    },\n\n    \n    createGhost : function(cls, useShim, appendTo){\n        var el = document.createElement('div');\n        el.className = 'x-panel-ghost ' + (cls ? cls : '');\n        if(this.header){\n            el.appendChild(this.el.dom.firstChild.cloneNode(true));\n        }\n        Ext.fly(el.appendChild(document.createElement('ul'))).setHeight(this.bwrap.getHeight());\n        el.style.width = this.el.dom.offsetWidth + 'px';;\n        if(!appendTo){\n            this.container.dom.appendChild(el);\n        }else{\n            Ext.getDom(appendTo).appendChild(el);\n        }\n        if(useShim !== false && this.el.useShim !== false){\n            var layer = new Ext.Layer({shadow:false, useDisplay:true, constrain:false}, el);\n            layer.show();\n            return layer;\n        }else{\n            return new Ext.Element(el);\n        }\n    },\n\n    \n    doAutoLoad : function(){\n        var u = this.body.getUpdater();\n        if(this.renderer){\n            u.setRenderer(this.renderer);\n        }\n        u.update(Ext.isObject(this.autoLoad) ? this.autoLoad : {url: this.autoLoad});\n    },\n\n    \n    getTool : function(id) {\n        return this.tools[id];\n    }\n\n\n});\nExt.reg('panel', Ext.Panel);\n\nExt.Editor = function(field, config){\n    if(field.field){\n        this.field = Ext.create(field.field, 'textfield');\n        config = Ext.apply({}, field); \n        delete config.field;\n    }else{\n        this.field = field;\n    }\n    Ext.Editor.superclass.constructor.call(this, config);\n};\n\nExt.extend(Ext.Editor, Ext.Component, {\n    \n    \n    allowBlur: true,\n    \n    \n    \n    \n    \n    value : \"\",\n    \n    alignment: \"c-c?\",\n    \n    offsets: [0, 0],\n    \n    shadow : \"frame\",\n    \n    constrain : false,\n    \n    swallowKeys : true,\n    \n    completeOnEnter : true,\n    \n    cancelOnEsc : true,\n    \n    updateEl : false,\n\n    initComponent : function(){\n        Ext.Editor.superclass.initComponent.call(this);\n        this.addEvents(\n            \n            \"beforestartedit\",\n            \n            \"startedit\",\n            \n            \"beforecomplete\",\n            \n            \"complete\",\n            \n            \"canceledit\",\n            \n            \"specialkey\"\n        );\n    },\n\n    \n    onRender : function(ct, position){\n        this.el = new Ext.Layer({\n            shadow: this.shadow,\n            cls: \"x-editor\",\n            parentEl : ct,\n            shim : this.shim,\n            shadowOffset: this.shadowOffset || 4,\n            id: this.id,\n            constrain: this.constrain\n        });\n        if(this.zIndex){\n            this.el.setZIndex(this.zIndex);\n        }\n        this.el.setStyle(\"overflow\", Ext.isGecko ? \"auto\" : \"hidden\");\n        if(this.field.msgTarget != 'title'){\n            this.field.msgTarget = 'qtip';\n        }\n        this.field.inEditor = true;\n        this.mon(this.field, {\n            scope: this,\n            blur: this.onBlur,\n            specialkey: this.onSpecialKey\n        });\n        if(this.field.grow){\n            this.mon(this.field, \"autosize\", this.el.sync,  this.el, {delay:1});\n        }\n        this.field.render(this.el).show();\n        this.field.getEl().dom.name = '';\n        if(this.swallowKeys){\n            this.field.el.swallowEvent([\n                'keypress', \n                'keydown'   \n            ]);\n        }\n    },\n\n    \n    onSpecialKey : function(field, e){\n        var key = e.getKey(),\n            complete = this.completeOnEnter && key == e.ENTER,\n            cancel = this.cancelOnEsc && key == e.ESC;\n        if(complete || cancel){\n            e.stopEvent();\n            if(complete){\n                this.completeEdit();\n            }else{\n                this.cancelEdit();\n            }\n            if(field.triggerBlur){\n                field.triggerBlur();\n            }\n        }\n        this.fireEvent('specialkey', field, e);\n    },\n\n    \n    startEdit : function(el, value){\n        if(this.editing){\n            this.completeEdit();\n        }\n        this.boundEl = Ext.get(el);\n        var v = value !== undefined ? value : this.boundEl.dom.innerHTML;\n        if(!this.rendered){\n            this.render(this.parentEl || document.body);\n        }\n        if(this.fireEvent(\"beforestartedit\", this, this.boundEl, v) !== false){\n            this.startValue = v;\n            this.field.reset();\n            this.field.setValue(v);\n            this.realign(true);\n            this.editing = true;\n            this.show();\n        }\n    },\n\n    \n    doAutoSize : function(){\n        if(this.autoSize){\n            var sz = this.boundEl.getSize(),\n                fs = this.field.getSize();\n\n            switch(this.autoSize){\n                case \"width\":\n                    this.setSize(sz.width, fs.height);\n                    break;\n                case \"height\":\n                    this.setSize(fs.width, sz.height);\n                    break;\n                case \"none\":\n                    this.setSize(fs.width, fs.height);\n                    break;\n                default:\n                    this.setSize(sz.width, sz.height);\n            }\n        }\n    },\n\n    \n    setSize : function(w, h){\n        delete this.field.lastSize;\n        this.field.setSize(w, h);\n        if(this.el){\n            \n            if(Ext.isGecko2 || Ext.isOpera || (Ext.isIE7 && Ext.isStrict)){\n                \n                this.el.setSize(w, h);\n            }\n            this.el.sync();\n        }\n    },\n\n    \n    realign : function(autoSize){\n        if(autoSize === true){\n            this.doAutoSize();\n        }\n        this.el.alignTo(this.boundEl, this.alignment, this.offsets);\n    },\n\n    \n    completeEdit : function(remainVisible){\n        if(!this.editing){\n            return;\n        }\n        \n        if (this.field.assertValue) {\n            this.field.assertValue();\n        }\n        var v = this.getValue();\n        if(!this.field.isValid()){\n            if(this.revertInvalid !== false){\n                this.cancelEdit(remainVisible);\n            }\n            return;\n        }\n        if(String(v) === String(this.startValue) && this.ignoreNoChange){\n            this.hideEdit(remainVisible);\n            return;\n        }\n        if(this.fireEvent(\"beforecomplete\", this, v, this.startValue) !== false){\n            v = this.getValue();\n            if(this.updateEl && this.boundEl){\n                this.boundEl.update(v);\n            }\n            this.hideEdit(remainVisible);\n            this.fireEvent(\"complete\", this, v, this.startValue);\n        }\n    },\n\n    \n    onShow : function(){\n        this.el.show();\n        if(this.hideEl !== false){\n            this.boundEl.hide();\n        }\n        this.field.show().focus(false, true);\n        this.fireEvent(\"startedit\", this.boundEl, this.startValue);\n    },\n\n    \n    cancelEdit : function(remainVisible){\n        if(this.editing){\n            var v = this.getValue();\n            this.setValue(this.startValue);\n            this.hideEdit(remainVisible);\n            this.fireEvent(\"canceledit\", this, v, this.startValue);\n        }\n    },\n\n    \n    hideEdit: function(remainVisible){\n        if(remainVisible !== true){\n            this.editing = false;\n            this.hide();\n        }\n    },\n\n    \n    onBlur : function(){\n        \n        if(this.allowBlur === true && this.editing && this.selectSameEditor !== true){\n            this.completeEdit();\n        }\n    },\n\n    \n    onHide : function(){\n        if(this.editing){\n            this.completeEdit();\n            return;\n        }\n        this.field.blur();\n        if(this.field.collapse){\n            this.field.collapse();\n        }\n        this.el.hide();\n        if(this.hideEl !== false){\n            this.boundEl.show();\n        }\n    },\n\n    \n    setValue : function(v){\n        this.field.setValue(v);\n    },\n\n    \n    getValue : function(){\n        return this.field.getValue();\n    },\n\n    beforeDestroy : function(){\n        Ext.destroyMembers(this, 'field');\n\n        delete this.parentEl;\n        delete this.boundEl;\n    }\n});\nExt.reg('editor', Ext.Editor);\n\nExt.ColorPalette = Ext.extend(Ext.Component, {\n\t\n    \n    itemCls : 'x-color-palette',\n    \n    value : null,\n    \n    clickEvent :'click',\n    \n    ctype : 'Ext.ColorPalette',\n\n    \n    allowReselect : false,\n\n    \n    colors : [\n        '000000', '993300', '333300', '003300', '003366', '000080', '333399', '333333',\n        '800000', 'FF6600', '808000', '008000', '008080', '0000FF', '666699', '808080',\n        'FF0000', 'FF9900', '99CC00', '339966', '33CCCC', '3366FF', '800080', '969696',\n        'FF00FF', 'FFCC00', 'FFFF00', '00FF00', '00FFFF', '00CCFF', '993366', 'C0C0C0',\n        'FF99CC', 'FFCC99', 'FFFF99', 'CCFFCC', 'CCFFFF', '99CCFF', 'CC99FF', 'FFFFFF'\n    ],\n\n    \n    \n    \n    \n    initComponent : function(){\n        Ext.ColorPalette.superclass.initComponent.call(this);\n        this.addEvents(\n            \n            'select'\n        );\n\n        if(this.handler){\n            this.on('select', this.handler, this.scope, true);\n        }    \n    },\n\n    \n    onRender : function(container, position){\n        this.autoEl = {\n            tag: 'div',\n            cls: this.itemCls\n        };\n        Ext.ColorPalette.superclass.onRender.call(this, container, position);\n        var t = this.tpl || new Ext.XTemplate(\n            '<tpl for=\".\"><a href=\"#\" class=\"color-{.}\" hidefocus=\"on\"><em><span style=\"background:#{.}\" class=\"x-unselectable\" unselectable=\"on\">&#160;</span></em></a></tpl>'\n        );\n        t.overwrite(this.el, this.colors);\n        this.mon(this.el, this.clickEvent, this.handleClick, this, {delegate: 'a'});\n        if(this.clickEvent != 'click'){\n        \tthis.mon(this.el, 'click', Ext.emptyFn, this, {delegate: 'a', preventDefault: true});\n        }\n    },\n\n    \n    afterRender : function(){\n        Ext.ColorPalette.superclass.afterRender.call(this);\n        if(this.value){\n            var s = this.value;\n            this.value = null;\n            this.select(s, true);\n        }\n    },\n\n    \n    handleClick : function(e, t){\n        e.preventDefault();\n        if(!this.disabled){\n            var c = t.className.match(/(?:^|\\s)color-(.{6})(?:\\s|$)/)[1];\n            this.select(c.toUpperCase());\n        }\n    },\n\n    \n    select : function(color, suppressEvent){\n        color = color.replace('#', '');\n        if(color != this.value || this.allowReselect){\n            var el = this.el;\n            if(this.value){\n                el.child('a.color-'+this.value).removeClass('x-color-palette-sel');\n            }\n            el.child('a.color-'+color).addClass('x-color-palette-sel');\n            this.value = color;\n            if(suppressEvent !== true){\n                this.fireEvent('select', this, color);\n            }\n        }\n    }\n\n    \n});\nExt.reg('colorpalette', Ext.ColorPalette);\nExt.DatePicker = Ext.extend(Ext.BoxComponent, {\n    \n    todayText : 'Today',\n    \n    okText : '&#160;OK&#160;',\n    \n    cancelText : 'Cancel',\n    \n    \n    \n    todayTip : '{0} (Spacebar)',\n    \n    minText : 'This date is before the minimum date',\n    \n    maxText : 'This date is after the maximum date',\n    \n    format : 'm/d/y',\n    \n    disabledDaysText : 'Disabled',\n    \n    disabledDatesText : 'Disabled',\n    \n    monthNames : Date.monthNames,\n    \n    dayNames : Date.dayNames,\n    \n    nextText : 'Next Month (Control+Right)',\n    \n    prevText : 'Previous Month (Control+Left)',\n    \n    monthYearText : 'Choose a month (Control+Up/Down to move years)',\n    \n    startDay : 0,\n    \n    showToday : true,\n    \n    \n    \n    \n    \n\n    \n    \n    focusOnSelect: true,\n\n    \n    \n    initHour: 12, \n\n    \n    initComponent : function(){\n        Ext.DatePicker.superclass.initComponent.call(this);\n\n        this.value = this.value ?\n                 this.value.clearTime(true) : new Date().clearTime();\n\n        this.addEvents(\n            \n            'select'\n        );\n\n        if(this.handler){\n            this.on('select', this.handler,  this.scope || this);\n        }\n\n        this.initDisabledDays();\n    },\n\n    \n    initDisabledDays : function(){\n        if(!this.disabledDatesRE && this.disabledDates){\n            var dd = this.disabledDates,\n                len = dd.length - 1,\n                re = '(?:';\n\n            Ext.each(dd, function(d, i){\n                re += Ext.isDate(d) ? '^' + Ext.escapeRe(d.dateFormat(this.format)) + '$' : dd[i];\n                if(i != len){\n                    re += '|';\n                }\n            }, this);\n            this.disabledDatesRE = new RegExp(re + ')');\n        }\n    },\n\n    \n    setDisabledDates : function(dd){\n        if(Ext.isArray(dd)){\n            this.disabledDates = dd;\n            this.disabledDatesRE = null;\n        }else{\n            this.disabledDatesRE = dd;\n        }\n        this.initDisabledDays();\n        this.update(this.value, true);\n    },\n\n    \n    setDisabledDays : function(dd){\n        this.disabledDays = dd;\n        this.update(this.value, true);\n    },\n\n    \n    setMinDate : function(dt){\n        this.minDate = dt;\n        this.update(this.value, true);\n    },\n\n    \n    setMaxDate : function(dt){\n        this.maxDate = dt;\n        this.update(this.value, true);\n    },\n\n    \n    setValue : function(value){\n        this.value = value.clearTime(true);\n        this.update(this.value);\n    },\n\n    \n    getValue : function(){\n        return this.value;\n    },\n\n    \n    focus : function(){\n        this.update(this.activeDate);\n    },\n\n    \n    onEnable: function(initial){\n        Ext.DatePicker.superclass.onEnable.call(this);\n        this.doDisabled(false);\n        this.update(initial ? this.value : this.activeDate);\n        if(Ext.isIE9m){\n            this.el.repaint();\n        }\n\n    },\n\n    \n    onDisable : function(){\n        Ext.DatePicker.superclass.onDisable.call(this);\n        this.doDisabled(true);\n        if(Ext.isIE9m && !Ext.isIE8){\n            \n             Ext.each([].concat(this.textNodes, this.el.query('th span')), function(el){\n                 Ext.fly(el).repaint();\n             });\n        }\n    },\n\n    \n    doDisabled : function(disabled){\n        this.keyNav.setDisabled(disabled);\n        this.prevRepeater.setDisabled(disabled);\n        this.nextRepeater.setDisabled(disabled);\n        if(this.showToday){\n            this.todayKeyListener.setDisabled(disabled);\n            this.todayBtn.setDisabled(disabled);\n        }\n    },\n\n    \n    onRender : function(container, position){\n        var m = [\n             '<table cellspacing=\"0\">',\n                '<tr><td class=\"x-date-left\"><a href=\"#\" title=\"', this.prevText ,'\">&#160;</a></td><td class=\"x-date-middle\" align=\"center\"></td><td class=\"x-date-right\"><a href=\"#\" title=\"', this.nextText ,'\">&#160;</a></td></tr>',\n                '<tr><td colspan=\"3\"><table class=\"x-date-inner\" cellspacing=\"0\"><thead><tr>'],\n                dn = this.dayNames,\n                i;\n        for(i = 0; i < 7; i++){\n            var d = this.startDay+i;\n            if(d > 6){\n                d = d-7;\n            }\n            m.push('<th><span>', dn[d].substr(0,1), '</span></th>');\n        }\n        m[m.length] = '</tr></thead><tbody><tr>';\n        for(i = 0; i < 42; i++) {\n            if(i % 7 === 0 && i !== 0){\n                m[m.length] = '</tr><tr>';\n            }\n            m[m.length] = '<td><a href=\"#\" hidefocus=\"on\" class=\"x-date-date\" tabIndex=\"1\"><em><span></span></em></a></td>';\n        }\n        m.push('</tr></tbody></table></td></tr>',\n                this.showToday ? '<tr><td colspan=\"3\" class=\"x-date-bottom\" align=\"center\"></td></tr>' : '',\n                '</table><div class=\"x-date-mp\"></div>');\n\n        var el = document.createElement('div');\n        el.className = 'x-date-picker';\n        el.innerHTML = m.join('');\n\n        container.dom.insertBefore(el, position);\n\n        this.el = Ext.get(el);\n        this.eventEl = Ext.get(el.firstChild);\n\n        this.prevRepeater = new Ext.util.ClickRepeater(this.el.child('td.x-date-left a'), {\n            handler: this.showPrevMonth,\n            scope: this,\n            preventDefault:true,\n            stopDefault:true\n        });\n\n        this.nextRepeater = new Ext.util.ClickRepeater(this.el.child('td.x-date-right a'), {\n            handler: this.showNextMonth,\n            scope: this,\n            preventDefault:true,\n            stopDefault:true\n        });\n\n        this.monthPicker = this.el.down('div.x-date-mp');\n        this.monthPicker.enableDisplayMode('block');\n\n        this.keyNav = new Ext.KeyNav(this.eventEl, {\n            'left' : function(e){\n                if(e.ctrlKey){\n                    this.showPrevMonth();\n                }else{\n                    this.update(this.activeDate.add('d', -1));\n                }\n            },\n\n            'right' : function(e){\n                if(e.ctrlKey){\n                    this.showNextMonth();\n                }else{\n                    this.update(this.activeDate.add('d', 1));\n                }\n            },\n\n            'up' : function(e){\n                if(e.ctrlKey){\n                    this.showNextYear();\n                }else{\n                    this.update(this.activeDate.add('d', -7));\n                }\n            },\n\n            'down' : function(e){\n                if(e.ctrlKey){\n                    this.showPrevYear();\n                }else{\n                    this.update(this.activeDate.add('d', 7));\n                }\n            },\n\n            'pageUp' : function(e){\n                this.showNextMonth();\n            },\n\n            'pageDown' : function(e){\n                this.showPrevMonth();\n            },\n\n            'enter' : function(e){\n                e.stopPropagation();\n                return true;\n            },\n\n            scope : this\n        });\n\n        this.el.unselectable();\n\n        this.cells = this.el.select('table.x-date-inner tbody td');\n        this.textNodes = this.el.query('table.x-date-inner tbody span');\n\n        this.mbtn = new Ext.Button({\n            text: '&#160;',\n            tooltip: this.monthYearText,\n            renderTo: this.el.child('td.x-date-middle', true)\n        });\n        this.mbtn.el.child('em').addClass('x-btn-arrow');\n\n        if(this.showToday){\n            this.todayKeyListener = this.eventEl.addKeyListener(Ext.EventObject.SPACE, this.selectToday,  this);\n            var today = (new Date()).dateFormat(this.format);\n            this.todayBtn = new Ext.Button({\n                renderTo: this.el.child('td.x-date-bottom', true),\n                text: String.format(this.todayText, today),\n                tooltip: String.format(this.todayTip, today),\n                handler: this.selectToday,\n                scope: this\n            });\n        }\n        this.mon(this.eventEl, 'mousewheel', this.handleMouseWheel, this);\n        this.mon(this.eventEl, 'click', this.handleDateClick,  this, {delegate: 'a.x-date-date'});\n        this.mon(this.mbtn, 'click', this.showMonthPicker, this);\n        this.onEnable(true);\n    },\n\n    \n    createMonthPicker : function(){\n        if(!this.monthPicker.dom.firstChild){\n            var buf = ['<table border=\"0\" cellspacing=\"0\">'];\n            for(var i = 0; i < 6; i++){\n                buf.push(\n                    '<tr><td class=\"x-date-mp-month\"><a href=\"#\">', Date.getShortMonthName(i), '</a></td>',\n                    '<td class=\"x-date-mp-month x-date-mp-sep\"><a href=\"#\">', Date.getShortMonthName(i + 6), '</a></td>',\n                    i === 0 ?\n                    '<td class=\"x-date-mp-ybtn\" align=\"center\"><a class=\"x-date-mp-prev\"></a></td><td class=\"x-date-mp-ybtn\" align=\"center\"><a class=\"x-date-mp-next\"></a></td></tr>' :\n                    '<td class=\"x-date-mp-year\"><a href=\"#\"></a></td><td class=\"x-date-mp-year\"><a href=\"#\"></a></td></tr>'\n                );\n            }\n            buf.push(\n                '<tr class=\"x-date-mp-btns\"><td colspan=\"4\"><button type=\"button\" class=\"x-date-mp-ok\">',\n                    this.okText,\n                    '</button><button type=\"button\" class=\"x-date-mp-cancel\">',\n                    this.cancelText,\n                    '</button></td></tr>',\n                '</table>'\n            );\n            this.monthPicker.update(buf.join(''));\n\n            this.mon(this.monthPicker, 'click', this.onMonthClick, this);\n            this.mon(this.monthPicker, 'dblclick', this.onMonthDblClick, this);\n\n            this.mpMonths = this.monthPicker.select('td.x-date-mp-month');\n            this.mpYears = this.monthPicker.select('td.x-date-mp-year');\n\n            this.mpMonths.each(function(m, a, i){\n                i += 1;\n                if((i%2) === 0){\n                    m.dom.xmonth = 5 + Math.round(i * 0.5);\n                }else{\n                    m.dom.xmonth = Math.round((i-1) * 0.5);\n                }\n            });\n        }\n    },\n\n    \n    showMonthPicker : function(){\n        if(!this.disabled){\n            this.createMonthPicker();\n            var size = this.el.getSize();\n            this.monthPicker.setSize(size);\n            this.monthPicker.child('table').setSize(size);\n\n            this.mpSelMonth = (this.activeDate || this.value).getMonth();\n            this.updateMPMonth(this.mpSelMonth);\n            this.mpSelYear = (this.activeDate || this.value).getFullYear();\n            this.updateMPYear(this.mpSelYear);\n\n            this.monthPicker.slideIn('t', {duration:0.2});\n        }\n    },\n\n    \n    updateMPYear : function(y){\n        this.mpyear = y;\n        var ys = this.mpYears.elements;\n        for(var i = 1; i <= 10; i++){\n            var td = ys[i-1], y2;\n            if((i%2) === 0){\n                y2 = y + Math.round(i * 0.5);\n                td.firstChild.innerHTML = y2;\n                td.xyear = y2;\n            }else{\n                y2 = y - (5-Math.round(i * 0.5));\n                td.firstChild.innerHTML = y2;\n                td.xyear = y2;\n            }\n            this.mpYears.item(i-1)[y2 == this.mpSelYear ? 'addClass' : 'removeClass']('x-date-mp-sel');\n        }\n    },\n\n    \n    updateMPMonth : function(sm){\n        this.mpMonths.each(function(m, a, i){\n            m[m.dom.xmonth == sm ? 'addClass' : 'removeClass']('x-date-mp-sel');\n        });\n    },\n\n    \n    selectMPMonth : function(m){\n\n    },\n\n    \n    onMonthClick : function(e, t){\n        e.stopEvent();\n        var el = new Ext.Element(t), pn;\n        if(el.is('button.x-date-mp-cancel')){\n            this.hideMonthPicker();\n        }\n        else if(el.is('button.x-date-mp-ok')){\n            var d = new Date(this.mpSelYear, this.mpSelMonth, (this.activeDate || this.value).getDate());\n            if(d.getMonth() != this.mpSelMonth){\n                \n                d = new Date(this.mpSelYear, this.mpSelMonth, 1).getLastDateOfMonth();\n            }\n            this.update(d);\n            this.hideMonthPicker();\n        }\n        else if((pn = el.up('td.x-date-mp-month', 2))){\n            this.mpMonths.removeClass('x-date-mp-sel');\n            pn.addClass('x-date-mp-sel');\n            this.mpSelMonth = pn.dom.xmonth;\n        }\n        else if((pn = el.up('td.x-date-mp-year', 2))){\n            this.mpYears.removeClass('x-date-mp-sel');\n            pn.addClass('x-date-mp-sel');\n            this.mpSelYear = pn.dom.xyear;\n        }\n        else if(el.is('a.x-date-mp-prev')){\n            this.updateMPYear(this.mpyear-10);\n        }\n        else if(el.is('a.x-date-mp-next')){\n            this.updateMPYear(this.mpyear+10);\n        }\n    },\n\n    \n    onMonthDblClick : function(e, t){\n        e.stopEvent();\n        var el = new Ext.Element(t), pn;\n        if((pn = el.up('td.x-date-mp-month', 2))){\n            this.update(new Date(this.mpSelYear, pn.dom.xmonth, (this.activeDate || this.value).getDate()));\n            this.hideMonthPicker();\n        }\n        else if((pn = el.up('td.x-date-mp-year', 2))){\n            this.update(new Date(pn.dom.xyear, this.mpSelMonth, (this.activeDate || this.value).getDate()));\n            this.hideMonthPicker();\n        }\n    },\n\n    \n    hideMonthPicker : function(disableAnim){\n        if(this.monthPicker){\n            if(disableAnim === true){\n                this.monthPicker.hide();\n            }else{\n                this.monthPicker.slideOut('t', {duration:0.2});\n            }\n        }\n    },\n\n    \n    showPrevMonth : function(e){\n        this.update(this.activeDate.add('mo', -1));\n    },\n\n    \n    showNextMonth : function(e){\n        this.update(this.activeDate.add('mo', 1));\n    },\n\n    \n    showPrevYear : function(){\n        this.update(this.activeDate.add('y', -1));\n    },\n\n    \n    showNextYear : function(){\n        this.update(this.activeDate.add('y', 1));\n    },\n\n    \n    handleMouseWheel : function(e){\n        e.stopEvent();\n        if(!this.disabled){\n            var delta = e.getWheelDelta();\n            if(delta > 0){\n                this.showPrevMonth();\n            } else if(delta < 0){\n                this.showNextMonth();\n            }\n        }\n    },\n\n    \n    handleDateClick : function(e, t){\n        e.stopEvent();\n        if(!this.disabled && t.dateValue && !Ext.fly(t.parentNode).hasClass('x-date-disabled')){\n            this.cancelFocus = this.focusOnSelect === false;\n            this.setValue(new Date(t.dateValue));\n            delete this.cancelFocus;\n            this.fireEvent('select', this, this.value);\n        }\n    },\n\n    \n    selectToday : function(){\n        if(this.todayBtn && !this.todayBtn.disabled){\n            this.setValue(new Date().clearTime());\n            this.fireEvent('select', this, this.value);\n        }\n    },\n\n    \n    update : function(date, forceRefresh){\n        if(this.rendered){\n            var vd = this.activeDate, vis = this.isVisible();\n            this.activeDate = date;\n            if(!forceRefresh && vd && this.el){\n                var t = date.getTime();\n                if(vd.getMonth() == date.getMonth() && vd.getFullYear() == date.getFullYear()){\n                    this.cells.removeClass('x-date-selected');\n                    this.cells.each(function(c){\n                       if(c.dom.firstChild.dateValue == t){\n                           c.addClass('x-date-selected');\n                           if(vis && !this.cancelFocus){\n                               Ext.fly(c.dom.firstChild).focus(50);\n                           }\n                           return false;\n                       }\n                    }, this);\n                    return;\n                }\n            }\n            var days = date.getDaysInMonth(),\n                firstOfMonth = date.getFirstDateOfMonth(),\n                startingPos = firstOfMonth.getDay()-this.startDay;\n\n            if(startingPos < 0){\n                startingPos += 7;\n            }\n            days += startingPos;\n\n            var pm = date.add('mo', -1),\n                prevStart = pm.getDaysInMonth()-startingPos,\n                cells = this.cells.elements,\n                textEls = this.textNodes,\n                \n                d = (new Date(pm.getFullYear(), pm.getMonth(), prevStart, this.initHour)),\n                today = new Date().clearTime().getTime(),\n                sel = date.clearTime(true).getTime(),\n                min = this.minDate ? this.minDate.clearTime(true) : Number.NEGATIVE_INFINITY,\n                max = this.maxDate ? this.maxDate.clearTime(true) : Number.POSITIVE_INFINITY,\n                ddMatch = this.disabledDatesRE,\n                ddText = this.disabledDatesText,\n                ddays = this.disabledDays ? this.disabledDays.join('') : false,\n                ddaysText = this.disabledDaysText,\n                format = this.format;\n\n            if(this.showToday){\n                var td = new Date().clearTime(),\n                    disable = (td < min || td > max ||\n                    (ddMatch && format && ddMatch.test(td.dateFormat(format))) ||\n                    (ddays && ddays.indexOf(td.getDay()) != -1));\n\n                if(!this.disabled){\n                    this.todayBtn.setDisabled(disable);\n                    this.todayKeyListener[disable ? 'disable' : 'enable']();\n                }\n            }\n\n            var setCellClass = function(cal, cell){\n                cell.title = '';\n                var t = d.clearTime(true).getTime();\n                cell.firstChild.dateValue = t;\n                if(t == today){\n                    cell.className += ' x-date-today';\n                    cell.title = cal.todayText;\n                }\n                if(t == sel){\n                    cell.className += ' x-date-selected';\n                    if(vis){\n                        Ext.fly(cell.firstChild).focus(50);\n                    }\n                }\n                \n                if(t < min) {\n                    cell.className = ' x-date-disabled';\n                    cell.title = cal.minText;\n                    return;\n                }\n                if(t > max) {\n                    cell.className = ' x-date-disabled';\n                    cell.title = cal.maxText;\n                    return;\n                }\n                if(ddays){\n                    if(ddays.indexOf(d.getDay()) != -1){\n                        cell.title = ddaysText;\n                        cell.className = ' x-date-disabled';\n                    }\n                }\n                if(ddMatch && format){\n                    var fvalue = d.dateFormat(format);\n                    if(ddMatch.test(fvalue)){\n                        cell.title = ddText.replace('%0', fvalue);\n                        cell.className = ' x-date-disabled';\n                    }\n                }\n            };\n\n            var i = 0;\n            for(; i < startingPos; i++) {\n                textEls[i].innerHTML = (++prevStart);\n                d.setDate(d.getDate()+1);\n                cells[i].className = 'x-date-prevday';\n                setCellClass(this, cells[i]);\n            }\n            for(; i < days; i++){\n                var intDay = i - startingPos + 1;\n                textEls[i].innerHTML = (intDay);\n                d.setDate(d.getDate()+1);\n                cells[i].className = 'x-date-active';\n                setCellClass(this, cells[i]);\n            }\n            var extraDays = 0;\n            for(; i < 42; i++) {\n                 textEls[i].innerHTML = (++extraDays);\n                 d.setDate(d.getDate()+1);\n                 cells[i].className = 'x-date-nextday';\n                 setCellClass(this, cells[i]);\n            }\n\n            this.mbtn.setText(this.monthNames[date.getMonth()] + ' ' + date.getFullYear());\n\n            if(!this.internalRender){\n                var main = this.el.dom.firstChild,\n                    w = main.offsetWidth;\n                this.el.setWidth(w + this.el.getBorderWidth('lr'));\n                Ext.fly(main).setWidth(w);\n                this.internalRender = true;\n                \n                \n                \n                if(Ext.isOpera && !this.secondPass){\n                    main.rows[0].cells[1].style.width = (w - (main.rows[0].cells[0].offsetWidth+main.rows[0].cells[2].offsetWidth)) + 'px';\n                    this.secondPass = true;\n                    this.update.defer(10, this, [date]);\n                }\n            }\n        }\n    },\n\n    \n    beforeDestroy : function() {\n        if(this.rendered){\n            Ext.destroy(\n                this.keyNav,\n                this.monthPicker,\n                this.eventEl,\n                this.mbtn,\n                this.nextRepeater,\n                this.prevRepeater,\n                this.cells.el,\n                this.todayBtn\n            );\n            delete this.textNodes;\n            delete this.cells.elements;\n        }\n    }\n\n    \n});\n\nExt.reg('datepicker', Ext.DatePicker);\n\nExt.LoadMask = function(el, config){\n    this.el = Ext.get(el);\n    Ext.apply(this, config);\n    if(this.store){\n        this.store.on({\n            scope: this,\n            beforeload: this.onBeforeLoad,\n            load: this.onLoad,\n            exception: this.onLoad\n        });\n        this.removeMask = Ext.value(this.removeMask, false);\n    }else{\n        var um = this.el.getUpdater();\n        um.showLoadIndicator = false; \n        um.on({\n            scope: this,\n            beforeupdate: this.onBeforeLoad,\n            update: this.onLoad,\n            failure: this.onLoad\n        });\n        this.removeMask = Ext.value(this.removeMask, true);\n    }\n};\n\nExt.LoadMask.prototype = {\n    \n    \n    \n    msg : 'Loading...',\n    \n    msgCls : 'x-mask-loading',\n\n    \n    disabled: false,\n\n    \n    disable : function(){\n       this.disabled = true;\n    },\n\n    \n    enable : function(){\n        this.disabled = false;\n    },\n\n    \n    onLoad : function(){\n        this.el.unmask(this.removeMask);\n    },\n\n    \n    onBeforeLoad : function(){\n        if(!this.disabled){\n            this.el.mask(this.msg, this.msgCls);\n        }\n    },\n\n    \n    show: function(){\n        this.onBeforeLoad();\n    },\n\n    \n    hide: function(){\n        this.onLoad();\n    },\n\n    \n    destroy : function(){\n        if(this.store){\n            this.store.un('beforeload', this.onBeforeLoad, this);\n            this.store.un('load', this.onLoad, this);\n            this.store.un('exception', this.onLoad, this);\n        }else{\n            var um = this.el.getUpdater();\n            um.un('beforeupdate', this.onBeforeLoad, this);\n            um.un('update', this.onLoad, this);\n            um.un('failure', this.onLoad, this);\n        }\n    }\n};\nExt.slider.Thumb = Ext.extend(Object, {\n    \n    \n    dragging: false,\n\n    \n    constructor: function(config) {\n        \n        Ext.apply(this, config || {}, {\n            cls: 'x-slider-thumb',\n\n            \n            constrain: false\n        });\n\n        Ext.slider.Thumb.superclass.constructor.call(this, config);\n\n        if (this.slider.vertical) {\n            Ext.apply(this, Ext.slider.Thumb.Vertical);\n        }\n    },\n\n    \n    render: function() {\n        this.el = this.slider.innerEl.insertFirst({cls: this.cls});\n\n        this.initEvents();\n    },\n\n    \n    enable: function() {\n        this.disabled = false;\n        this.el.removeClass(this.slider.disabledClass);\n    },\n\n    \n    disable: function() {\n        this.disabled = true;\n        this.el.addClass(this.slider.disabledClass);\n    },\n\n    \n    initEvents: function() {\n        var el = this.el;\n\n        el.addClassOnOver('x-slider-thumb-over');\n\n        this.tracker = new Ext.dd.DragTracker({\n            onBeforeStart: this.onBeforeDragStart.createDelegate(this),\n            onStart      : this.onDragStart.createDelegate(this),\n            onDrag       : this.onDrag.createDelegate(this),\n            onEnd        : this.onDragEnd.createDelegate(this),\n            tolerance    : 3,\n            autoStart    : 300\n        });\n\n        this.tracker.initEl(el);\n    },\n\n    \n    onBeforeDragStart : function(e) {\n        if (this.disabled) {\n            return false;\n        } else {\n            this.slider.promoteThumb(this);\n            return true;\n        }\n    },\n\n    \n    onDragStart: function(e){\n        this.el.addClass('x-slider-thumb-drag');\n        this.dragging = true;\n        this.dragStartValue = this.value;\n\n        this.slider.fireEvent('dragstart', this.slider, e, this);\n    },\n\n    \n    onDrag: function(e) {\n        var slider   = this.slider,\n            index    = this.index,\n            newValue = this.getNewValue();\n\n        if (this.constrain) {\n            var above = slider.thumbs[index + 1],\n                below = slider.thumbs[index - 1];\n\n            if (below != undefined && newValue <= below.value) newValue = below.value;\n            if (above != undefined && newValue >= above.value) newValue = above.value;\n        }\n\n        slider.setValue(index, newValue, false);\n        slider.fireEvent('drag', slider, e, this);\n    },\n\n    getNewValue: function() {\n        var slider   = this.slider,\n            pos      = slider.innerEl.translatePoints(this.tracker.getXY());\n\n        return Ext.util.Format.round(slider.reverseValue(pos.left), slider.decimalPrecision);\n    },\n\n    \n    onDragEnd: function(e) {\n        var slider = this.slider,\n            value  = this.value;\n\n        this.el.removeClass('x-slider-thumb-drag');\n\n        this.dragging = false;\n        slider.fireEvent('dragend', slider, e);\n\n        if (this.dragStartValue != value) {\n            slider.fireEvent('changecomplete', slider, value, this);\n        }\n    },\n    \n    \n    destroy: function(){\n        Ext.destroyMembers(this, 'tracker', 'el');\n    }\n});\n\n\nExt.slider.MultiSlider = Ext.extend(Ext.BoxComponent, {\n    \n    \n    vertical: false,\n    \n    minValue: 0,\n    \n    maxValue: 100,\n    \n    decimalPrecision: 0,\n    \n    keyIncrement: 1,\n    \n    increment: 0,\n\n    \n    clickRange: [5,15],\n\n    \n    clickToChange : true,\n    \n    animate: true,\n    \n    constrainThumbs: true,\n\n    \n    topThumbZIndex: 10000,\n\n    \n    initComponent : function(){\n        if(!Ext.isDefined(this.value)){\n            this.value = this.minValue;\n        }\n\n        \n        this.thumbs = [];\n\n        Ext.slider.MultiSlider.superclass.initComponent.call(this);\n\n        this.keyIncrement = Math.max(this.increment, this.keyIncrement);\n        this.addEvents(\n            \n            'beforechange',\n\n            \n            'change',\n\n            \n            'changecomplete',\n\n            \n            'dragstart',\n\n            \n            'drag',\n\n            \n            'dragend'\n        );\n\n        \n        if (this.values == undefined || Ext.isEmpty(this.values)) this.values = [0];\n\n        var values = this.values;\n\n        for (var i=0; i < values.length; i++) {\n            this.addThumb(values[i]);\n        }\n\n        if(this.vertical){\n            Ext.apply(this, Ext.slider.Vertical);\n        }\n    },\n\n    \n    addThumb: function(value) {\n        var thumb = new Ext.slider.Thumb({\n            value    : value,\n            slider   : this,\n            index    : this.thumbs.length,\n            constrain: this.constrainThumbs\n        });\n        this.thumbs.push(thumb);\n\n        \n        if (this.rendered) thumb.render();\n    },\n\n    \n    promoteThumb: function(topThumb) {\n        var thumbs = this.thumbs,\n            zIndex, thumb;\n\n        for (var i = 0, j = thumbs.length; i < j; i++) {\n            thumb = thumbs[i];\n\n            if (thumb == topThumb) {\n                zIndex = this.topThumbZIndex;\n            } else {\n                zIndex = '';\n            }\n\n            thumb.el.setStyle('zIndex', zIndex);\n        }\n    },\n\n    \n    onRender : function() {\n        this.autoEl = {\n            cls: 'x-slider ' + (this.vertical ? 'x-slider-vert' : 'x-slider-horz'),\n            cn : {\n                cls: 'x-slider-end',\n                cn : {\n                    cls:'x-slider-inner',\n                    cn : [{tag:'a', cls:'x-slider-focus', href:\"#\", tabIndex: '-1', hidefocus:'on'}]\n                }\n            }\n        };\n\n        Ext.slider.MultiSlider.superclass.onRender.apply(this, arguments);\n\n        this.endEl   = this.el.first();\n        this.innerEl = this.endEl.first();\n        this.focusEl = this.innerEl.child('.x-slider-focus');\n\n        \n        for (var i=0; i < this.thumbs.length; i++) {\n            this.thumbs[i].render();\n        }\n\n        \n        var thumb      = this.innerEl.child('.x-slider-thumb');\n        this.halfThumb = (this.vertical ? thumb.getHeight() : thumb.getWidth()) / 2;\n\n        this.initEvents();\n    },\n\n    \n    initEvents : function(){\n        this.mon(this.el, {\n            scope    : this,\n            mousedown: this.onMouseDown,\n            keydown  : this.onKeyDown\n        });\n\n        this.focusEl.swallowEvent(\"click\", true);\n    },\n\n    \n    onMouseDown : function(e){\n        if(this.disabled){\n            return;\n        }\n\n        \n        var thumbClicked = false;\n        for (var i=0; i < this.thumbs.length; i++) {\n            thumbClicked = thumbClicked || e.target == this.thumbs[i].el.dom;\n        }\n\n        if (this.clickToChange && !thumbClicked) {\n            var local = this.innerEl.translatePoints(e.getXY());\n            this.onClickChange(local);\n        }\n        this.focus();\n    },\n\n    \n    onClickChange : function(local) {\n        if (local.top > this.clickRange[0] && local.top < this.clickRange[1]) {\n            \n            var thumb = this.getNearest(local, 'left'),\n                index = thumb.index;\n\n            this.setValue(index, Ext.util.Format.round(this.reverseValue(local.left), this.decimalPrecision), undefined, true);\n        }\n    },\n\n    \n    getNearest: function(local, prop) {\n        var localValue = prop == 'top' ? this.innerEl.getHeight() - local[prop] : local[prop],\n            clickValue = this.reverseValue(localValue),\n            nearestDistance = (this.maxValue - this.minValue) + 5, \n            index = 0,\n            nearest = null;\n\n        for (var i=0; i < this.thumbs.length; i++) {\n            var thumb = this.thumbs[i],\n                value = thumb.value,\n                dist  = Math.abs(value - clickValue);\n\n            if (Math.abs(dist <= nearestDistance)) {\n                nearest = thumb;\n                index = i;\n                nearestDistance = dist;\n            }\n        }\n        return nearest;\n    },\n\n    \n    onKeyDown : function(e){\n        \n        if(this.disabled || this.thumbs.length !== 1){\n            e.preventDefault();\n            return;\n        }\n        var k = e.getKey(),\n            val;\n        switch(k){\n            case e.UP:\n            case e.RIGHT:\n                e.stopEvent();\n                val = e.ctrlKey ? this.maxValue : this.getValue(0) + this.keyIncrement;\n                this.setValue(0, val, undefined, true);\n            break;\n            case e.DOWN:\n            case e.LEFT:\n                e.stopEvent();\n                val = e.ctrlKey ? this.minValue : this.getValue(0) - this.keyIncrement;\n                this.setValue(0, val, undefined, true);\n            break;\n            default:\n                e.preventDefault();\n        }\n    },\n\n    \n    doSnap : function(value){\n        if (!(this.increment && value)) {\n            return value;\n        }\n        var newValue = value,\n            inc = this.increment,\n            m = value % inc;\n        if (m != 0) {\n            newValue -= m;\n            if (m * 2 >= inc) {\n                newValue += inc;\n            } else if (m * 2 < -inc) {\n                newValue -= inc;\n            }\n        }\n        return newValue.constrain(this.minValue,  this.maxValue);\n    },\n\n    \n    afterRender : function(){\n        Ext.slider.MultiSlider.superclass.afterRender.apply(this, arguments);\n\n        for (var i=0; i < this.thumbs.length; i++) {\n            var thumb = this.thumbs[i];\n\n            if (thumb.value !== undefined) {\n                var v = this.normalizeValue(thumb.value);\n\n                if (v !== thumb.value) {\n                    \n                    this.setValue(i, v, false);\n                } else {\n                    this.moveThumb(i, this.translateValue(v), false);\n                }\n            }\n        };\n    },\n\n    \n    getRatio : function(){\n        var w = this.innerEl.getWidth(),\n            v = this.maxValue - this.minValue;\n        return v == 0 ? w : (w/v);\n    },\n\n    \n    normalizeValue : function(v){\n        v = this.doSnap(v);\n        v = Ext.util.Format.round(v, this.decimalPrecision);\n        v = v.constrain(this.minValue, this.maxValue);\n        return v;\n    },\n\n    \n    setMinValue : function(val){\n        this.minValue = val;\n        var i = 0,\n            thumbs = this.thumbs,\n            len = thumbs.length,\n            t;\n            \n        for(; i < len; ++i){\n            t = thumbs[i];\n            t.value = t.value < val ? val : t.value;\n        }\n        this.syncThumb();\n    },\n\n    \n    setMaxValue : function(val){\n        this.maxValue = val;\n        var i = 0,\n            thumbs = this.thumbs,\n            len = thumbs.length,\n            t;\n            \n        for(; i < len; ++i){\n            t = thumbs[i];\n            t.value = t.value > val ? val : t.value;\n        }\n        this.syncThumb();\n    },\n\n    \n    setValue : function(index, v, animate, changeComplete) {\n        var thumb = this.thumbs[index],\n            el    = thumb.el;\n\n        v = this.normalizeValue(v);\n\n        if (v !== thumb.value && this.fireEvent('beforechange', this, v, thumb.value, thumb) !== false) {\n            thumb.value = v;\n            if(this.rendered){\n                this.moveThumb(index, this.translateValue(v), animate !== false);\n                this.fireEvent('change', this, v, thumb);\n                if(changeComplete){\n                    this.fireEvent('changecomplete', this, v, thumb);\n                }\n            }\n        }\n    },\n\n    \n    translateValue : function(v) {\n        var ratio = this.getRatio();\n        return (v * ratio) - (this.minValue * ratio) - this.halfThumb;\n    },\n\n    \n    reverseValue : function(pos){\n        var ratio = this.getRatio();\n        return (pos + (this.minValue * ratio)) / ratio;\n    },\n\n    \n    moveThumb: function(index, v, animate){\n        var thumb = this.thumbs[index].el;\n\n        if(!animate || this.animate === false){\n            thumb.setLeft(v);\n        }else{\n            thumb.shift({left: v, stopFx: true, duration:.35});\n        }\n    },\n\n    \n    focus : function(){\n        this.focusEl.focus(10);\n    },\n\n    \n    onResize : function(w, h){\n        var thumbs = this.thumbs,\n            len = thumbs.length,\n            i = 0;\n            \n        \n        for(; i < len; ++i){\n            thumbs[i].el.stopFx();    \n        }\n        \n        if(Ext.isNumber(w)){\n            this.innerEl.setWidth(w - (this.el.getPadding('l') + this.endEl.getPadding('r')));\n        }\n        this.syncThumb();\n        Ext.slider.MultiSlider.superclass.onResize.apply(this, arguments);\n    },\n\n    \n    onDisable: function(){\n        Ext.slider.MultiSlider.superclass.onDisable.call(this);\n\n        for (var i=0; i < this.thumbs.length; i++) {\n            var thumb = this.thumbs[i],\n                el    = thumb.el;\n\n            thumb.disable();\n\n            if(Ext.isIE){\n                \n                \n                var xy = el.getXY();\n                el.hide();\n\n                this.innerEl.addClass(this.disabledClass).dom.disabled = true;\n\n                if (!this.thumbHolder) {\n                    this.thumbHolder = this.endEl.createChild({cls: 'x-slider-thumb ' + this.disabledClass});\n                }\n\n                this.thumbHolder.show().setXY(xy);\n            }\n        }\n    },\n\n    \n    onEnable: function(){\n        Ext.slider.MultiSlider.superclass.onEnable.call(this);\n\n        for (var i=0; i < this.thumbs.length; i++) {\n            var thumb = this.thumbs[i],\n                el    = thumb.el;\n\n            thumb.enable();\n\n            if (Ext.isIE) {\n                this.innerEl.removeClass(this.disabledClass).dom.disabled = false;\n\n                if (this.thumbHolder) this.thumbHolder.hide();\n\n                el.show();\n                this.syncThumb();\n            }\n        }\n    },\n\n    \n    syncThumb : function() {\n        if (this.rendered) {\n            for (var i=0; i < this.thumbs.length; i++) {\n                this.moveThumb(i, this.translateValue(this.thumbs[i].value));\n            }\n        }\n    },\n\n    \n    getValue : function(index) {\n        return this.thumbs[index].value;\n    },\n\n    \n    getValues: function() {\n        var values = [];\n\n        for (var i=0; i < this.thumbs.length; i++) {\n            values.push(this.thumbs[i].value);\n        }\n\n        return values;\n    },\n\n    \n    beforeDestroy : function(){\n        var thumbs = this.thumbs;\n        for(var i = 0, len = thumbs.length; i < len; ++i){\n            thumbs[i].destroy();\n            thumbs[i] = null;\n        }\n        Ext.destroyMembers(this, 'endEl', 'innerEl', 'focusEl', 'thumbHolder');\n        Ext.slider.MultiSlider.superclass.beforeDestroy.call(this);\n    }\n});\n\nExt.reg('multislider', Ext.slider.MultiSlider);\n\n\nExt.slider.SingleSlider = Ext.extend(Ext.slider.MultiSlider, {\n    constructor: function(config) {\n      config = config || {};\n\n      Ext.applyIf(config, {\n          values: [config.value || 0]\n      });\n\n      Ext.slider.SingleSlider.superclass.constructor.call(this, config);\n    },\n\n    \n    getValue: function() {\n        \n        return Ext.slider.SingleSlider.superclass.getValue.call(this, 0);\n    },\n\n    \n    setValue: function(value, animate) {\n        var args = Ext.toArray(arguments),\n            len  = args.length;\n\n        \n        \n        \n        if (len == 1 || (len <= 3 && typeof arguments[1] != 'number')) {\n            args.unshift(0);\n        }\n\n        return Ext.slider.SingleSlider.superclass.setValue.apply(this, args);\n    },\n\n    \n    syncThumb : function() {\n        return Ext.slider.SingleSlider.superclass.syncThumb.apply(this, [0].concat(arguments));\n    },\n    \n    \n    getNearest : function(){\n        \n        return this.thumbs[0];    \n    }\n});\n\n\nExt.Slider = Ext.slider.SingleSlider;\n\nExt.reg('slider', Ext.slider.SingleSlider);\n\n\nExt.slider.Vertical = {\n    onResize : function(w, h){\n        this.innerEl.setHeight(h - (this.el.getPadding('t') + this.endEl.getPadding('b')));\n        this.syncThumb();\n    },\n\n    getRatio : function(){\n        var h = this.innerEl.getHeight(),\n            v = this.maxValue - this.minValue;\n        return h/v;\n    },\n\n    moveThumb: function(index, v, animate) {\n        var thumb = this.thumbs[index],\n            el    = thumb.el;\n\n        if (!animate || this.animate === false) {\n            el.setBottom(v);\n        } else {\n            el.shift({bottom: v, stopFx: true, duration:.35});\n        }\n    },\n\n    onClickChange : function(local) {\n        if (local.left > this.clickRange[0] && local.left < this.clickRange[1]) {\n            var thumb = this.getNearest(local, 'top'),\n                index = thumb.index,\n                value = this.minValue + this.reverseValue(this.innerEl.getHeight() - local.top);\n\n            this.setValue(index, Ext.util.Format.round(value, this.decimalPrecision), undefined, true);\n        }\n    }\n};\n\n\nExt.slider.Thumb.Vertical = {\n    getNewValue: function() {\n        var slider   = this.slider,\n            innerEl  = slider.innerEl,\n            pos      = innerEl.translatePoints(this.tracker.getXY()),\n            bottom   = innerEl.getHeight() - pos.top;\n\n        return slider.minValue + Ext.util.Format.round(bottom / slider.getRatio(), slider.decimalPrecision);\n    }\n};\n\nExt.ProgressBar = Ext.extend(Ext.BoxComponent, {\n   \n    baseCls : 'x-progress',\n    \n    \n    animate : false,\n\n    \n    waitTimer : null,\n\n    \n    initComponent : function(){\n        Ext.ProgressBar.superclass.initComponent.call(this);\n        this.addEvents(\n            \n            \"update\"\n        );\n    },\n\n    \n    onRender : function(ct, position){\n        var tpl = new Ext.Template(\n            '<div class=\"{cls}-wrap\">',\n                '<div class=\"{cls}-inner\">',\n                    '<div class=\"{cls}-bar\">',\n                        '<div class=\"{cls}-text\">',\n                            '<div>&#160;</div>',\n                        '</div>',\n                    '</div>',\n                    '<div class=\"{cls}-text {cls}-text-back\">',\n                        '<div>&#160;</div>',\n                    '</div>',\n                '</div>',\n            '</div>'\n        );\n\n        this.el = position ? tpl.insertBefore(position, {cls: this.baseCls}, true)\n            : tpl.append(ct, {cls: this.baseCls}, true);\n                \n        if(this.id){\n            this.el.dom.id = this.id;\n        }\n        var inner = this.el.dom.firstChild;\n        this.progressBar = Ext.get(inner.firstChild);\n\n        if(this.textEl){\n            \n            this.textEl = Ext.get(this.textEl);\n            delete this.textTopEl;\n        }else{\n            \n            this.textTopEl = Ext.get(this.progressBar.dom.firstChild);\n            var textBackEl = Ext.get(inner.childNodes[1]);\n            this.textTopEl.setStyle(\"z-index\", 99).addClass('x-hidden');\n            this.textEl = new Ext.CompositeElement([this.textTopEl.dom.firstChild, textBackEl.dom.firstChild]);\n            this.textEl.setWidth(inner.offsetWidth);\n        }\n        this.progressBar.setHeight(inner.offsetHeight);\n    },\n    \n    \n    afterRender : function(){\n        Ext.ProgressBar.superclass.afterRender.call(this);\n        if(this.value){\n            this.updateProgress(this.value, this.text);\n        }else{\n            this.updateText(this.text);\n        }\n    },\n\n    \n    updateProgress : function(value, text, animate){\n        this.value = value || 0;\n        if(text){\n            this.updateText(text);\n        }\n        if(this.rendered && !this.isDestroyed){\n            var w = Math.floor(value*this.el.dom.firstChild.offsetWidth);\n            this.progressBar.setWidth(w, animate === true || (animate !== false && this.animate));\n            if(this.textTopEl){\n                \n                this.textTopEl.removeClass('x-hidden').setWidth(w);\n            }\n        }\n        this.fireEvent('update', this, value, text);\n        return this;\n    },\n\n    \n    wait : function(o){\n        if(!this.waitTimer){\n            var scope = this;\n            o = o || {};\n            this.updateText(o.text);\n            this.waitTimer = Ext.TaskMgr.start({\n                run: function(i){\n                    var inc = o.increment || 10;\n                    i -= 1;\n                    this.updateProgress(((((i+inc)%inc)+1)*(100/inc))*0.01, null, o.animate);\n                },\n                interval: o.interval || 1000,\n                duration: o.duration,\n                onStop: function(){\n                    if(o.fn){\n                        o.fn.apply(o.scope || this);\n                    }\n                    this.reset();\n                },\n                scope: scope\n            });\n        }\n        return this;\n    },\n\n    \n    isWaiting : function(){\n        return this.waitTimer !== null;\n    },\n\n    \n    updateText : function(text){\n        this.text = text || '&#160;';\n        if(this.rendered){\n            this.textEl.update(this.text);\n        }\n        return this;\n    },\n    \n    \n    syncProgressBar : function(){\n        if(this.value){\n            this.updateProgress(this.value, this.text);\n        }\n        return this;\n    },\n\n    \n    setSize : function(w, h){\n        Ext.ProgressBar.superclass.setSize.call(this, w, h);\n        if(this.textTopEl){\n            var inner = this.el.dom.firstChild;\n            this.textEl.setSize(inner.offsetWidth, inner.offsetHeight);\n        }\n        this.syncProgressBar();\n        return this;\n    },\n\n    \n    reset : function(hide){\n        this.updateProgress(0);\n        if(this.textTopEl){\n            this.textTopEl.addClass('x-hidden');\n        }\n        this.clearTimer();\n        if(hide === true){\n            this.hide();\n        }\n        return this;\n    },\n    \n    \n    clearTimer : function(){\n        if(this.waitTimer){\n            this.waitTimer.onStop = null; \n            Ext.TaskMgr.stop(this.waitTimer);\n            this.waitTimer = null;\n        }\n    },\n    \n    onDestroy: function(){\n        this.clearTimer();\n        if(this.rendered){\n            if(this.textEl.isComposite){\n                this.textEl.clear();\n            }\n            Ext.destroyMembers(this, 'textEl', 'progressBar', 'textTopEl');\n        }\n        Ext.ProgressBar.superclass.onDestroy.call(this);\n    }\n});\nExt.reg('progress', Ext.ProgressBar);\n\n(function() {\n\nvar Event=Ext.EventManager;\nvar Dom=Ext.lib.Dom;\n\n\nExt.dd.DragDrop = function(id, sGroup, config) {\n    if(id) {\n        this.init(id, sGroup, config);\n    }\n};\n\nExt.dd.DragDrop.prototype = {\n\n    \n\n    \n    id: null,\n\n    \n    config: null,\n\n    \n    dragElId: null,\n\n    \n    handleElId: null,\n\n    \n    invalidHandleTypes: null,\n\n    \n    invalidHandleIds: null,\n\n    \n    invalidHandleClasses: null,\n\n    \n    startPageX: 0,\n\n    \n    startPageY: 0,\n\n    \n    groups: null,\n\n    \n    locked: false,\n\n    \n    lock: function() {\n        this.locked = true;\n    },\n\n    \n    moveOnly: false,\n\n    \n    unlock: function() {\n        this.locked = false;\n    },\n\n    \n    isTarget: true,\n\n    \n    padding: null,\n\n    \n    _domRef: null,\n\n    \n    __ygDragDrop: true,\n\n    \n    constrainX: false,\n\n    \n    constrainY: false,\n\n    \n    minX: 0,\n\n    \n    maxX: 0,\n\n    \n    minY: 0,\n\n    \n    maxY: 0,\n\n    \n    maintainOffset: false,\n\n    \n    xTicks: null,\n\n    \n    yTicks: null,\n\n    \n    primaryButtonOnly: true,\n\n    \n    available: false,\n\n    \n    hasOuterHandles: false,\n\n    \n    b4StartDrag: function(x, y) { },\n\n    \n    startDrag: function(x, y) {  },\n\n    \n    b4Drag: function(e) { },\n\n    \n    onDrag: function(e) {  },\n\n    \n    onDragEnter: function(e, id) {  },\n\n    \n    b4DragOver: function(e) { },\n\n    \n    onDragOver: function(e, id) {  },\n\n    \n    b4DragOut: function(e) { },\n\n    \n    onDragOut: function(e, id) {  },\n\n    \n    b4DragDrop: function(e) { },\n\n    \n    onDragDrop: function(e, id) {  },\n\n    \n    onInvalidDrop: function(e) {  },\n\n    \n    b4EndDrag: function(e) { },\n\n    \n    endDrag: function(e) {  },\n\n    \n    b4MouseDown: function(e) {  },\n\n    \n    onMouseDown: function(e) {  },\n\n    \n    onMouseUp: function(e) {  },\n\n    \n    onAvailable: function () {\n    },\n\n    \n    defaultPadding : {left:0, right:0, top:0, bottom:0},\n\n    \n    constrainTo : function(constrainTo, pad, inContent){\n        if(Ext.isNumber(pad)){\n            pad = {left: pad, right:pad, top:pad, bottom:pad};\n        }\n        pad = pad || this.defaultPadding;\n        var b = Ext.get(this.getEl()).getBox(),\n            ce = Ext.get(constrainTo),\n            s = ce.getScroll(),\n            c, \n            cd = ce.dom;\n        if(cd == document.body){\n            c = { x: s.left, y: s.top, width: Ext.lib.Dom.getViewWidth(), height: Ext.lib.Dom.getViewHeight()};\n        }else{\n            var xy = ce.getXY();\n            c = {x : xy[0], y: xy[1], width: cd.clientWidth, height: cd.clientHeight};\n        }\n\n\n        var topSpace = b.y - c.y,\n            leftSpace = b.x - c.x;\n\n        this.resetConstraints();\n        this.setXConstraint(leftSpace - (pad.left||0), \n                c.width - leftSpace - b.width - (pad.right||0), \n\t\t\t\tthis.xTickSize\n        );\n        this.setYConstraint(topSpace - (pad.top||0), \n                c.height - topSpace - b.height - (pad.bottom||0), \n\t\t\t\tthis.yTickSize\n        );\n    },\n\n    \n    getEl: function() {\n        if (!this._domRef) {\n            this._domRef = Ext.getDom(this.id);\n        }\n\n        return this._domRef;\n    },\n\n    \n    getDragEl: function() {\n        return Ext.getDom(this.dragElId);\n    },\n\n    \n    init: function(id, sGroup, config) {\n        this.initTarget(id, sGroup, config);\n        Event.on(this.id, \"mousedown\", this.handleMouseDown, this);\n        \n    },\n\n    \n    initTarget: function(id, sGroup, config) {\n\n        \n        this.config = config || {};\n\n        \n        this.DDM = Ext.dd.DDM;\n        \n        this.groups = {};\n\n        \n        \n        if (typeof id !== \"string\") {\n            id = Ext.id(id);\n        }\n\n        \n        this.id = id;\n\n        \n        this.addToGroup((sGroup) ? sGroup : \"default\");\n\n        \n        \n        this.handleElId = id;\n\n        \n        this.setDragElId(id);\n\n        \n        this.invalidHandleTypes = { A: \"A\" };\n        this.invalidHandleIds = {};\n        this.invalidHandleClasses = [];\n\n        this.applyConfig();\n\n        this.handleOnAvailable();\n    },\n\n    \n    applyConfig: function() {\n\n        \n        \n        this.padding           = this.config.padding || [0, 0, 0, 0];\n        this.isTarget          = (this.config.isTarget !== false);\n        this.maintainOffset    = (this.config.maintainOffset);\n        this.primaryButtonOnly = (this.config.primaryButtonOnly !== false);\n\n    },\n\n    \n    handleOnAvailable: function() {\n        this.available = true;\n        this.resetConstraints();\n        this.onAvailable();\n    },\n\n     \n    setPadding: function(iTop, iRight, iBot, iLeft) {\n        \n        if (!iRight && 0 !== iRight) {\n            this.padding = [iTop, iTop, iTop, iTop];\n        } else if (!iBot && 0 !== iBot) {\n            this.padding = [iTop, iRight, iTop, iRight];\n        } else {\n            this.padding = [iTop, iRight, iBot, iLeft];\n        }\n    },\n\n    \n    setInitPosition: function(diffX, diffY) {\n        var el = this.getEl();\n\n        if (!this.DDM.verifyEl(el)) {\n            return;\n        }\n\n        var dx = diffX || 0;\n        var dy = diffY || 0;\n\n        var p = Dom.getXY( el );\n\n        this.initPageX = p[0] - dx;\n        this.initPageY = p[1] - dy;\n\n        this.lastPageX = p[0];\n        this.lastPageY = p[1];\n\n        this.setStartPosition(p);\n    },\n\n    \n    setStartPosition: function(pos) {\n        var p = pos || Dom.getXY( this.getEl() );\n        this.deltaSetXY = null;\n\n        this.startPageX = p[0];\n        this.startPageY = p[1];\n    },\n\n    \n    addToGroup: function(sGroup) {\n        this.groups[sGroup] = true;\n        this.DDM.regDragDrop(this, sGroup);\n    },\n\n    \n    removeFromGroup: function(sGroup) {\n        if (this.groups[sGroup]) {\n            delete this.groups[sGroup];\n        }\n\n        this.DDM.removeDDFromGroup(this, sGroup);\n    },\n\n    \n    setDragElId: function(id) {\n        this.dragElId = id;\n    },\n\n    \n    setHandleElId: function(id) {\n        if (typeof id !== \"string\") {\n            id = Ext.id(id);\n        }\n        this.handleElId = id;\n        this.DDM.regHandle(this.id, id);\n    },\n\n    \n    setOuterHandleElId: function(id) {\n        if (typeof id !== \"string\") {\n            id = Ext.id(id);\n        }\n        Event.on(id, \"mousedown\",\n                this.handleMouseDown, this);\n        this.setHandleElId(id);\n\n        this.hasOuterHandles = true;\n    },\n\n    \n    unreg: function() {\n        Event.un(this.id, \"mousedown\",\n                this.handleMouseDown);\n        this._domRef = null;\n        this.DDM._remove(this);\n    },\n\n    destroy : function(){\n        this.unreg();\n    },\n\n    \n    isLocked: function() {\n        return (this.DDM.isLocked() || this.locked);\n    },\n\n    \n    handleMouseDown: function(e, oDD){\n        if (this.primaryButtonOnly && e.button != 0) {\n            return;\n        }\n\n        if (this.isLocked()) {\n            return;\n        }\n\n        this.DDM.refreshCache(this.groups);\n\n        var pt = new Ext.lib.Point(Ext.lib.Event.getPageX(e), Ext.lib.Event.getPageY(e));\n        if (!this.hasOuterHandles && !this.DDM.isOverTarget(pt, this) )  {\n        } else {\n            if (this.clickValidator(e)) {\n\n                \n                this.setStartPosition();\n\n                this.b4MouseDown(e);\n                this.onMouseDown(e);\n\n                this.DDM.handleMouseDown(e, this);\n\n                if (this.preventDefault || this.stopPropagation) {\n                    if (this.preventDefault) {\n                        e.preventDefault();\n                    }\n                    if (this.stopPropagation) {\n                        e.stopPropagation();\n                    }\n                } else {\n                    this.DDM.stopEvent(e);\n                }\n            } else {\n\n\n            }\n        }\n    },\n\n    clickValidator: function(e) {\n        var target = e.getTarget();\n        return ( this.isValidHandleChild(target) &&\n                    (this.id == this.handleElId ||\n                        this.DDM.handleWasClicked(target, this.id)) );\n    },\n\n    \n    addInvalidHandleType: function(tagName) {\n        var type = tagName.toUpperCase();\n        this.invalidHandleTypes[type] = type;\n    },\n\n    \n    addInvalidHandleId: function(id) {\n        if (typeof id !== \"string\") {\n            id = Ext.id(id);\n        }\n        this.invalidHandleIds[id] = id;\n    },\n\n    \n    addInvalidHandleClass: function(cssClass) {\n        this.invalidHandleClasses.push(cssClass);\n    },\n\n    \n    removeInvalidHandleType: function(tagName) {\n        var type = tagName.toUpperCase();\n        \n        delete this.invalidHandleTypes[type];\n    },\n\n    \n    removeInvalidHandleId: function(id) {\n        if (typeof id !== \"string\") {\n            id = Ext.id(id);\n        }\n        delete this.invalidHandleIds[id];\n    },\n\n    \n    removeInvalidHandleClass: function(cssClass) {\n        for (var i=0, len=this.invalidHandleClasses.length; i<len; ++i) {\n            if (this.invalidHandleClasses[i] == cssClass) {\n                delete this.invalidHandleClasses[i];\n            }\n        }\n    },\n\n    \n    isValidHandleChild: function(node) {\n\n        var valid = true;\n        \n        var nodeName;\n        try {\n            nodeName = node.nodeName.toUpperCase();\n        } catch(e) {\n            nodeName = node.nodeName;\n        }\n        valid = valid && !this.invalidHandleTypes[nodeName];\n        valid = valid && !this.invalidHandleIds[node.id];\n\n        for (var i=0, len=this.invalidHandleClasses.length; valid && i<len; ++i) {\n            valid = !Ext.fly(node).hasClass(this.invalidHandleClasses[i]);\n        }\n\n\n        return valid;\n\n    },\n\n    \n    setXTicks: function(iStartX, iTickSize) {\n        this.xTicks = [];\n        this.xTickSize = iTickSize;\n\n        var tickMap = {};\n\n        for (var i = this.initPageX; i >= this.minX; i = i - iTickSize) {\n            if (!tickMap[i]) {\n                this.xTicks[this.xTicks.length] = i;\n                tickMap[i] = true;\n            }\n        }\n\n        for (i = this.initPageX; i <= this.maxX; i = i + iTickSize) {\n            if (!tickMap[i]) {\n                this.xTicks[this.xTicks.length] = i;\n                tickMap[i] = true;\n            }\n        }\n\n        this.xTicks.sort(this.DDM.numericSort) ;\n    },\n\n    \n    setYTicks: function(iStartY, iTickSize) {\n        this.yTicks = [];\n        this.yTickSize = iTickSize;\n\n        var tickMap = {};\n\n        for (var i = this.initPageY; i >= this.minY; i = i - iTickSize) {\n            if (!tickMap[i]) {\n                this.yTicks[this.yTicks.length] = i;\n                tickMap[i] = true;\n            }\n        }\n\n        for (i = this.initPageY; i <= this.maxY; i = i + iTickSize) {\n            if (!tickMap[i]) {\n                this.yTicks[this.yTicks.length] = i;\n                tickMap[i] = true;\n            }\n        }\n\n        this.yTicks.sort(this.DDM.numericSort) ;\n    },\n\n    \n    setXConstraint: function(iLeft, iRight, iTickSize) {\n        this.leftConstraint = iLeft;\n        this.rightConstraint = iRight;\n\n        this.minX = this.initPageX - iLeft;\n        this.maxX = this.initPageX + iRight;\n        if (iTickSize) { this.setXTicks(this.initPageX, iTickSize); }\n\n        this.constrainX = true;\n    },\n\n    \n    clearConstraints: function() {\n        this.constrainX = false;\n        this.constrainY = false;\n        this.clearTicks();\n    },\n\n    \n    clearTicks: function() {\n        this.xTicks = null;\n        this.yTicks = null;\n        this.xTickSize = 0;\n        this.yTickSize = 0;\n    },\n\n    \n    setYConstraint: function(iUp, iDown, iTickSize) {\n        this.topConstraint = iUp;\n        this.bottomConstraint = iDown;\n\n        this.minY = this.initPageY - iUp;\n        this.maxY = this.initPageY + iDown;\n        if (iTickSize) { this.setYTicks(this.initPageY, iTickSize); }\n\n        this.constrainY = true;\n\n    },\n\n    \n    resetConstraints: function() {\n        \n        if (this.initPageX || this.initPageX === 0) {\n            \n            var dx = (this.maintainOffset) ? this.lastPageX - this.initPageX : 0;\n            var dy = (this.maintainOffset) ? this.lastPageY - this.initPageY : 0;\n\n            this.setInitPosition(dx, dy);\n\n        \n        } else {\n            this.setInitPosition();\n        }\n\n        if (this.constrainX) {\n            this.setXConstraint( this.leftConstraint,\n                                 this.rightConstraint,\n                                 this.xTickSize        );\n        }\n\n        if (this.constrainY) {\n            this.setYConstraint( this.topConstraint,\n                                 this.bottomConstraint,\n                                 this.yTickSize         );\n        }\n    },\n\n    \n    getTick: function(val, tickArray) {\n        if (!tickArray) {\n            \n            \n            return val;\n        } else if (tickArray[0] >= val) {\n            \n            \n            return tickArray[0];\n        } else {\n            for (var i=0, len=tickArray.length; i<len; ++i) {\n                var next = i + 1;\n                if (tickArray[next] && tickArray[next] >= val) {\n                    var diff1 = val - tickArray[i];\n                    var diff2 = tickArray[next] - val;\n                    return (diff2 > diff1) ? tickArray[i] : tickArray[next];\n                }\n            }\n\n            \n            \n            return tickArray[tickArray.length - 1];\n        }\n    },\n\n    \n    toString: function() {\n        return (\"DragDrop \" + this.id);\n    }\n\n};\n\n})();\n\n\n\n\nif (!Ext.dd.DragDropMgr) {\n\n\nExt.dd.DragDropMgr = function() {\n\n    var Event = Ext.EventManager;\n\n    return {\n\n        \n        ids: {},\n\n        \n        handleIds: {},\n\n        \n        dragCurrent: null,\n\n        \n        dragOvers: {},\n\n        \n        deltaX: 0,\n\n        \n        deltaY: 0,\n\n        \n        preventDefault: true,\n\n        \n        stopPropagation: true,\n\n        \n        initialized: false,\n\n        \n        locked: false,\n\n        \n        init: function() {\n            this.initialized = true;\n        },\n\n        \n        POINT: 0,\n\n        \n        INTERSECT: 1,\n\n        \n        mode: 0,\n        \n        \n        notifyOccluded: false,\n\n        \n        _execOnAll: function(sMethod, args) {\n            for (var i in this.ids) {\n                for (var j in this.ids[i]) {\n                    var oDD = this.ids[i][j];\n                    if (! this.isTypeOfDD(oDD)) {\n                        continue;\n                    }\n                    oDD[sMethod].apply(oDD, args);\n                }\n            }\n        },\n\n        \n        _onLoad: function() {\n\n            this.init();\n\n\n            Event.on(document, \"mouseup\",   this.handleMouseUp, this, true);\n            Event.on(document, \"mousemove\", this.handleMouseMove, this, true);\n            Event.on(window,   \"unload\",    this._onUnload, this, true);\n            Event.on(window,   \"resize\",    this._onResize, this, true);\n            \n\n        },\n\n        \n        _onResize: function(e) {\n            this._execOnAll(\"resetConstraints\", []);\n        },\n\n        \n        lock: function() { this.locked = true; },\n\n        \n        unlock: function() { this.locked = false; },\n\n        \n        isLocked: function() { return this.locked; },\n\n        \n        locationCache: {},\n\n        \n        useCache: true,\n\n        \n        clickPixelThresh: 3,\n\n        \n        clickTimeThresh: 350,\n\n        \n        dragThreshMet: false,\n\n        \n        clickTimeout: null,\n\n        \n        startX: 0,\n\n        \n        startY: 0,\n\n        \n        regDragDrop: function(oDD, sGroup) {\n            if (!this.initialized) { this.init(); }\n\n            if (!this.ids[sGroup]) {\n                this.ids[sGroup] = {};\n            }\n            this.ids[sGroup][oDD.id] = oDD;\n        },\n\n        \n        removeDDFromGroup: function(oDD, sGroup) {\n            if (!this.ids[sGroup]) {\n                this.ids[sGroup] = {};\n            }\n\n            var obj = this.ids[sGroup];\n            if (obj && obj[oDD.id]) {\n                delete obj[oDD.id];\n            }\n        },\n\n        \n        _remove: function(oDD) {\n            for (var g in oDD.groups) {\n                if (g && this.ids[g] && this.ids[g][oDD.id]) {\n                    delete this.ids[g][oDD.id];\n                }\n            }\n            delete this.handleIds[oDD.id];\n        },\n\n        \n        regHandle: function(sDDId, sHandleId) {\n            if (!this.handleIds[sDDId]) {\n                this.handleIds[sDDId] = {};\n            }\n            this.handleIds[sDDId][sHandleId] = sHandleId;\n        },\n\n        \n        isDragDrop: function(id) {\n            return ( this.getDDById(id) ) ? true : false;\n        },\n\n        \n        getRelated: function(p_oDD, bTargetsOnly) {\n            var oDDs = [];\n            for (var i in p_oDD.groups) {\n                for (var j in this.ids[i]) {\n                    var dd = this.ids[i][j];\n                    if (! this.isTypeOfDD(dd)) {\n                        continue;\n                    }\n                    if (!bTargetsOnly || dd.isTarget) {\n                        oDDs[oDDs.length] = dd;\n                    }\n                }\n            }\n\n            return oDDs;\n        },\n\n        \n        isLegalTarget: function (oDD, oTargetDD) {\n            var targets = this.getRelated(oDD, true);\n            for (var i=0, len=targets.length;i<len;++i) {\n                if (targets[i].id == oTargetDD.id) {\n                    return true;\n                }\n            }\n\n            return false;\n        },\n\n        \n        isTypeOfDD: function (oDD) {\n            return (oDD && oDD.__ygDragDrop);\n        },\n\n        \n        isHandle: function(sDDId, sHandleId) {\n            return ( this.handleIds[sDDId] &&\n                            this.handleIds[sDDId][sHandleId] );\n        },\n\n        \n        getDDById: function(id) {\n            for (var i in this.ids) {\n                if (this.ids[i][id]) {\n                    return this.ids[i][id];\n                }\n            }\n            return null;\n        },\n\n        \n        handleMouseDown: function(e, oDD) {\n            if(Ext.QuickTips){\n                Ext.QuickTips.ddDisable();\n            }\n            if(this.dragCurrent){\n                \n                \n                this.handleMouseUp(e);\n            }\n            \n            this.currentTarget = e.getTarget();\n            this.dragCurrent = oDD;\n\n            var el = oDD.getEl();\n\n            \n            this.startX = e.getPageX();\n            this.startY = e.getPageY();\n\n            this.deltaX = this.startX - el.offsetLeft;\n            this.deltaY = this.startY - el.offsetTop;\n\n            this.dragThreshMet = false;\n\n            this.clickTimeout = setTimeout(\n                    function() {\n                        var DDM = Ext.dd.DDM;\n                        DDM.startDrag(DDM.startX, DDM.startY);\n                    },\n                    this.clickTimeThresh );\n        },\n\n        \n        startDrag: function(x, y) {\n            clearTimeout(this.clickTimeout);\n            if (this.dragCurrent) {\n                this.dragCurrent.b4StartDrag(x, y);\n                this.dragCurrent.startDrag(x, y);\n            }\n            this.dragThreshMet = true;\n        },\n\n        \n        handleMouseUp: function(e) {\n\n            if(Ext.QuickTips){\n                Ext.QuickTips.ddEnable();\n            }\n            if (! this.dragCurrent) {\n                return;\n            }\n\n            clearTimeout(this.clickTimeout);\n\n            if (this.dragThreshMet) {\n                this.fireEvents(e, true);\n            } else {\n            }\n\n            this.stopDrag(e);\n\n            this.stopEvent(e);\n        },\n\n        \n        stopEvent: function(e){\n            if(this.stopPropagation) {\n                e.stopPropagation();\n            }\n\n            if (this.preventDefault) {\n                e.preventDefault();\n            }\n        },\n\n        \n        stopDrag: function(e) {\n            \n            if (this.dragCurrent) {\n                if (this.dragThreshMet) {\n                    this.dragCurrent.b4EndDrag(e);\n                    this.dragCurrent.endDrag(e);\n                }\n\n                this.dragCurrent.onMouseUp(e);\n            }\n\n            this.dragCurrent = null;\n            this.dragOvers = {};\n        },\n\n        \n        handleMouseMove: function(e) {\n            if (! this.dragCurrent) {\n                return true;\n            }\n            \n\n            \n            if (Ext.isIE && (e.button !== 0 && e.button !== 1 && e.button !== 2)) {\n                this.stopEvent(e);\n                return this.handleMouseUp(e);\n            }\n\n            if (!this.dragThreshMet) {\n                var diffX = Math.abs(this.startX - e.getPageX());\n                var diffY = Math.abs(this.startY - e.getPageY());\n                if (diffX > this.clickPixelThresh ||\n                            diffY > this.clickPixelThresh) {\n                    this.startDrag(this.startX, this.startY);\n                }\n            }\n\n            if (this.dragThreshMet) {\n                this.dragCurrent.b4Drag(e);\n                this.dragCurrent.onDrag(e);\n                if(!this.dragCurrent.moveOnly){\n                    this.fireEvents(e, false);\n                }\n            }\n\n            this.stopEvent(e);\n\n            return true;\n        },\n\n        \n        fireEvents: function(e, isDrop) {\n            var me = this,\n                dragCurrent = me.dragCurrent,\n                mousePoint = e.getPoint(),\n                overTarget,\n                overTargetEl,\n                allTargets = [],\n                oldOvers  = [],  \n                outEvts   = [],\n                overEvts  = [],\n                dropEvts  = [],\n                enterEvts = [],\n                needsSort,\n                i,\n                len,\n                sGroup;\n\n            \n            \n            if (!dragCurrent || dragCurrent.isLocked()) {\n                return;\n            }\n\n            \n            \n            for (i in me.dragOvers) {\n                overTarget = me.dragOvers[i];\n\n                if (! me.isTypeOfDD(overTarget)) {\n                    continue;\n                }\n\n                if (! this.isOverTarget(mousePoint, overTarget, me.mode)) {\n                    outEvts.push( overTarget );\n                }\n\n                oldOvers[i] = true;\n                delete me.dragOvers[i];\n            }\n\n            \n            \n            \n            for (sGroup in dragCurrent.groups) {\n\n                if (\"string\" != typeof sGroup) {\n                    continue;\n                }\n\n                \n                for (i in me.ids[sGroup]) {\n                    overTarget = me.ids[sGroup][i];\n\n                    \n                    \n                    \n                    \n                    \n                    if (me.isTypeOfDD(overTarget) &&\n                        (overTargetEl = overTarget.getEl()) &&\n                        (overTarget.isTarget) &&\n                        (!overTarget.isLocked()) &&\n                        ((overTarget != dragCurrent) || (dragCurrent.ignoreSelf === false))) {\n\n                        \n                        if ((overTarget.zIndex = me.getZIndex(overTargetEl)) !== -1) {\n                            needsSort = true;\n                        }\n                        allTargets.push(overTarget);\n                    }\n                }\n            }\n\n            \n            if (needsSort) {\n                allTargets.sort(me.byZIndex);\n            }\n\n            \n            \n            for (i = 0, len = allTargets.length; i < len; i++) {\n                overTarget = allTargets[i];\n\n                \n                if (me.isOverTarget(mousePoint, overTarget, me.mode)) {\n                    \n                    if (isDrop) {\n                        dropEvts.push( overTarget );\n                    \n                    } else {\n                        \n                        if (!oldOvers[overTarget.id]) {\n                            enterEvts.push( overTarget );\n                        \n                        } else {\n                            overEvts.push( overTarget );\n                        }\n                        me.dragOvers[overTarget.id] = overTarget;\n                    }\n\n                    \n                    if (!me.notifyOccluded) {\n                        break;\n                    }\n                }\n            }\n\n            if (me.mode) {\n                if (outEvts.length) {\n                    dragCurrent.b4DragOut(e, outEvts);\n                    dragCurrent.onDragOut(e, outEvts);\n                }\n    \n                if (enterEvts.length) {\n                    dragCurrent.onDragEnter(e, enterEvts);\n                }\n\n                if (overEvts.length) {\n                    dragCurrent.b4DragOver(e, overEvts);\n                    dragCurrent.onDragOver(e, overEvts);\n                }\n\n                if (dropEvts.length) {\n                    dragCurrent.b4DragDrop(e, dropEvts);\n                    dragCurrent.onDragDrop(e, dropEvts);\n                }\n\n            } else {\n                \n                for (i=0, len=outEvts.length; i<len; ++i) {\n                    dragCurrent.b4DragOut(e, outEvts[i].id);\n                    dragCurrent.onDragOut(e, outEvts[i].id);\n                }\n\n                \n                for (i=0,len=enterEvts.length; i<len; ++i) {\n                    \n                    dragCurrent.onDragEnter(e, enterEvts[i].id);\n                }\n\n                \n                for (i=0,len=overEvts.length; i<len; ++i) {\n                    dragCurrent.b4DragOver(e, overEvts[i].id);\n                    dragCurrent.onDragOver(e, overEvts[i].id);\n                }   \n\n                \n                for (i=0, len=dropEvts.length; i<len; ++i) {\n                    dragCurrent.b4DragDrop(e, dropEvts[i].id);\n                    dragCurrent.onDragDrop(e, dropEvts[i].id);\n                }\n\n            }\n\n            \n            if (isDrop && !dropEvts.length) {\n                dragCurrent.onInvalidDrop(e);\n            }\n        },\n        \n        \n        getZIndex: function(element) {\n            var body = document.body,\n                z,\n                zIndex = -1;\n\n            element = Ext.getDom(element);\n            while (element !== body) {\n                if (!isNaN(z = Number(Ext.fly(element).getStyle('zIndex')))) {\n                    zIndex = z;\n                }\n                element = element.parentNode;\n            }\n            return zIndex;\n        },\n\n        \n        byZIndex: function(d1, d2) {\n            return d1.zIndex < d2.zIndex;\n        },\n\n        \n        getBestMatch: function(dds) {\n            var winner = null;\n            \n            \n               \n            \n            \n\n            var len = dds.length;\n\n            if (len == 1) {\n                winner = dds[0];\n            } else {\n                \n                for (var i=0; i<len; ++i) {\n                    var dd = dds[i];\n                    \n                    \n                    \n                    if (dd.cursorIsOver) {\n                        winner = dd;\n                        break;\n                    \n                    } else {\n                        if (!winner ||\n                            winner.overlap.getArea() < dd.overlap.getArea()) {\n                            winner = dd;\n                        }\n                    }\n                }\n            }\n\n            return winner;\n        },\n\n        \n        refreshCache: function(groups) {\n            for (var sGroup in groups) {\n                if (\"string\" != typeof sGroup) {\n                    continue;\n                }\n                for (var i in this.ids[sGroup]) {\n                    var oDD = this.ids[sGroup][i];\n\n                    if (this.isTypeOfDD(oDD)) {\n                    \n                        var loc = this.getLocation(oDD);\n                        if (loc) {\n                            this.locationCache[oDD.id] = loc;\n                        } else {\n                            delete this.locationCache[oDD.id];\n                            \n                            \n                            \n                        }\n                    }\n                }\n            }\n        },\n\n        \n        verifyEl: function(el) {\n            if (el) {\n                var parent;\n                if(Ext.isIE){\n                    try{\n                        parent = el.offsetParent;\n                    }catch(e){}\n                }else{\n                    parent = el.offsetParent;\n                }\n                if (parent) {\n                    return true;\n                }\n            }\n\n            return false;\n        },\n\n        \n        getLocation: function(oDD) {\n            if (! this.isTypeOfDD(oDD)) {\n                return null;\n            }\n\n            var el = oDD.getEl(), pos, x1, x2, y1, y2, t, r, b, l, region;\n\n            try {\n                pos= Ext.lib.Dom.getXY(el);\n            } catch (e) { }\n\n            if (!pos) {\n                return null;\n            }\n\n            x1 = pos[0];\n            x2 = x1 + el.offsetWidth;\n            y1 = pos[1];\n            y2 = y1 + el.offsetHeight;\n\n            t = y1 - oDD.padding[0];\n            r = x2 + oDD.padding[1];\n            b = y2 + oDD.padding[2];\n            l = x1 - oDD.padding[3];\n\n            return new Ext.lib.Region( t, r, b, l );\n        },\n\n        \n        isOverTarget: function(pt, oTarget, intersect) {\n            \n            var loc = this.locationCache[oTarget.id];\n            if (!loc || !this.useCache) {\n                loc = this.getLocation(oTarget);\n                this.locationCache[oTarget.id] = loc;\n\n            }\n\n            if (!loc) {\n                return false;\n            }\n\n            oTarget.cursorIsOver = loc.contains( pt );\n\n            \n            \n            \n            \n            \n            var dc = this.dragCurrent;\n            if (!dc || !dc.getTargetCoord ||\n                    (!intersect && !dc.constrainX && !dc.constrainY)) {\n                return oTarget.cursorIsOver;\n            }\n\n            oTarget.overlap = null;\n\n            \n            \n            \n            \n            var pos = dc.getTargetCoord(pt.x, pt.y);\n\n            var el = dc.getDragEl();\n            var curRegion = new Ext.lib.Region( pos.y,\n                                                   pos.x + el.offsetWidth,\n                                                   pos.y + el.offsetHeight,\n                                                   pos.x );\n\n            var overlap = curRegion.intersect(loc);\n\n            if (overlap) {\n                oTarget.overlap = overlap;\n                return (intersect) ? true : oTarget.cursorIsOver;\n            } else {\n                return false;\n            }\n        },\n\n        \n        _onUnload: function(e, me) {\n            Event.removeListener(document, \"mouseup\",   this.handleMouseUp, this);\n            Event.removeListener(document, \"mousemove\", this.handleMouseMove, this);\n            Event.removeListener(window,   \"resize\",    this._onResize, this);\n            Ext.dd.DragDropMgr.unregAll();\n        },\n\n        \n        unregAll: function() {\n\n            if (this.dragCurrent) {\n                this.stopDrag();\n                this.dragCurrent = null;\n            }\n\n            this._execOnAll(\"unreg\", []);\n\n            for (var i in this.elementCache) {\n                delete this.elementCache[i];\n            }\n\n            this.elementCache = {};\n            this.ids = {};\n        },\n\n        \n        elementCache: {},\n\n        \n        getElWrapper: function(id) {\n            var oWrapper = this.elementCache[id];\n            if (!oWrapper || !oWrapper.el) {\n                oWrapper = this.elementCache[id] =\n                    new this.ElementWrapper(Ext.getDom(id));\n            }\n            return oWrapper;\n        },\n\n        \n        getElement: function(id) {\n            return Ext.getDom(id);\n        },\n\n        \n        getCss: function(id) {\n            var el = Ext.getDom(id);\n            return (el) ? el.style : null;\n        },\n\n        \n        ElementWrapper: function(el) {\n                \n                this.el = el || null;\n                \n                this.id = this.el && el.id;\n                \n                this.css = this.el && el.style;\n            },\n\n        \n        getPosX: function(el) {\n            return Ext.lib.Dom.getX(el);\n        },\n\n        \n        getPosY: function(el) {\n            return Ext.lib.Dom.getY(el);\n        },\n\n        \n        swapNode: function(n1, n2) {\n            if (n1.swapNode) {\n                n1.swapNode(n2);\n            } else {\n                var p = n2.parentNode;\n                var s = n2.nextSibling;\n\n                if (s == n1) {\n                    p.insertBefore(n1, n2);\n                } else if (n2 == n1.nextSibling) {\n                    p.insertBefore(n2, n1);\n                } else {\n                    n1.parentNode.replaceChild(n2, n1);\n                    p.insertBefore(n1, s);\n                }\n            }\n        },\n\n        \n        getScroll: function () {\n            var t, l, dde=document.documentElement, db=document.body;\n            if (dde && (dde.scrollTop || dde.scrollLeft)) {\n                t = dde.scrollTop;\n                l = dde.scrollLeft;\n            } else if (db) {\n                t = db.scrollTop;\n                l = db.scrollLeft;\n            } else {\n\n            }\n            return { top: t, left: l };\n        },\n\n        \n        getStyle: function(el, styleProp) {\n            return Ext.fly(el).getStyle(styleProp);\n        },\n\n        \n        getScrollTop: function () {\n            return this.getScroll().top;\n        },\n\n        \n        getScrollLeft: function () {\n            return this.getScroll().left;\n        },\n\n        \n        moveToEl: function (moveEl, targetEl) {\n            var aCoord = Ext.lib.Dom.getXY(targetEl);\n            Ext.lib.Dom.setXY(moveEl, aCoord);\n        },\n\n        \n        numericSort: function(a, b) {\n            return (a - b);\n        },\n\n        \n        _timeoutCount: 0,\n\n        \n        _addListeners: function() {\n            var DDM = Ext.dd.DDM;\n            if ( Ext.lib.Event && document ) {\n                DDM._onLoad();\n            } else {\n                if (DDM._timeoutCount > 2000) {\n                } else {\n                    setTimeout(DDM._addListeners, 10);\n                    if (document && document.body) {\n                        DDM._timeoutCount += 1;\n                    }\n                }\n            }\n        },\n\n        \n        handleWasClicked: function(node, id) {\n            if (this.isHandle(id, node.id)) {\n                return true;\n            } else {\n                \n                var p = node.parentNode;\n\n                while (p) {\n                    if (this.isHandle(id, p.id)) {\n                        return true;\n                    } else {\n                        p = p.parentNode;\n                    }\n                }\n            }\n\n            return false;\n        }\n\n    };\n\n}();\n\n\nExt.dd.DDM = Ext.dd.DragDropMgr;\nExt.dd.DDM._addListeners();\n\n}\n\n\nExt.dd.DD = function(id, sGroup, config) {\n    if (id) {\n        this.init(id, sGroup, config);\n    }\n};\n\nExt.extend(Ext.dd.DD, Ext.dd.DragDrop, {\n\n    \n    scroll: true,\n\n    \n    autoOffset: function(iPageX, iPageY) {\n        var x = iPageX - this.startPageX;\n        var y = iPageY - this.startPageY;\n        this.setDelta(x, y);\n    },\n\n    \n    setDelta: function(iDeltaX, iDeltaY) {\n        this.deltaX = iDeltaX;\n        this.deltaY = iDeltaY;\n    },\n\n    \n    setDragElPos: function(iPageX, iPageY) {\n        \n        \n\n        var el = this.getDragEl();\n        this.alignElWithMouse(el, iPageX, iPageY);\n    },\n\n    \n    alignElWithMouse: function(el, iPageX, iPageY) {\n        var oCoord = this.getTargetCoord(iPageX, iPageY);\n        var fly = el.dom ? el : Ext.fly(el, '_dd');\n        if (!this.deltaSetXY) {\n            var aCoord = [oCoord.x, oCoord.y];\n            fly.setXY(aCoord);\n            var newLeft = fly.getLeft(true);\n            var newTop  = fly.getTop(true);\n            this.deltaSetXY = [ newLeft - oCoord.x, newTop - oCoord.y ];\n        } else {\n            fly.setLeftTop(oCoord.x + this.deltaSetXY[0], oCoord.y + this.deltaSetXY[1]);\n        }\n\n        this.cachePosition(oCoord.x, oCoord.y);\n        this.autoScroll(oCoord.x, oCoord.y, el.offsetHeight, el.offsetWidth);\n        return oCoord;\n    },\n\n    \n    cachePosition: function(iPageX, iPageY) {\n        if (iPageX) {\n            this.lastPageX = iPageX;\n            this.lastPageY = iPageY;\n        } else {\n            var aCoord = Ext.lib.Dom.getXY(this.getEl());\n            this.lastPageX = aCoord[0];\n            this.lastPageY = aCoord[1];\n        }\n    },\n\n    \n    autoScroll: function(x, y, h, w) {\n\n        if (this.scroll) {\n            \n            var clientH = Ext.lib.Dom.getViewHeight();\n\n            \n            var clientW = Ext.lib.Dom.getViewWidth();\n\n            \n            var st = this.DDM.getScrollTop();\n\n            \n            var sl = this.DDM.getScrollLeft();\n\n            \n            var bot = h + y;\n\n            \n            var right = w + x;\n\n            \n            \n            \n            var toBot = (clientH + st - y - this.deltaY);\n\n            \n            var toRight = (clientW + sl - x - this.deltaX);\n\n\n            \n            \n            var thresh = 40;\n\n            \n            \n            \n            var scrAmt = (document.all) ? 80 : 30;\n\n            \n            \n            if ( bot > clientH && toBot < thresh ) {\n                window.scrollTo(sl, st + scrAmt);\n            }\n\n            \n            \n            if ( y < st && st > 0 && y - st < thresh ) {\n                window.scrollTo(sl, st - scrAmt);\n            }\n\n            \n            \n            if ( right > clientW && toRight < thresh ) {\n                window.scrollTo(sl + scrAmt, st);\n            }\n\n            \n            \n            if ( x < sl && sl > 0 && x - sl < thresh ) {\n                window.scrollTo(sl - scrAmt, st);\n            }\n        }\n    },\n\n    \n    getTargetCoord: function(iPageX, iPageY) {\n        var x = iPageX - this.deltaX;\n        var y = iPageY - this.deltaY;\n\n        if (this.constrainX) {\n            if (x < this.minX) { x = this.minX; }\n            if (x > this.maxX) { x = this.maxX; }\n        }\n\n        if (this.constrainY) {\n            if (y < this.minY) { y = this.minY; }\n            if (y > this.maxY) { y = this.maxY; }\n        }\n\n        x = this.getTick(x, this.xTicks);\n        y = this.getTick(y, this.yTicks);\n\n\n        return {x:x, y:y};\n    },\n\n    \n    applyConfig: function() {\n        Ext.dd.DD.superclass.applyConfig.call(this);\n        this.scroll = (this.config.scroll !== false);\n    },\n\n    \n    b4MouseDown: function(e) {\n        \n        this.autoOffset(e.getPageX(),\n                            e.getPageY());\n    },\n\n    \n    b4Drag: function(e) {\n        this.setDragElPos(e.getPageX(),\n                            e.getPageY());\n    },\n\n    toString: function() {\n        return (\"DD \" + this.id);\n    }\n\n    \n    \n    \n    \n\n});\n\nExt.dd.DDProxy = function(id, sGroup, config) {\n    if (id) {\n        this.init(id, sGroup, config);\n        this.initFrame();\n    }\n};\n\n\nExt.dd.DDProxy.dragElId = \"ygddfdiv\";\n\nExt.extend(Ext.dd.DDProxy, Ext.dd.DD, {\n\n    \n    resizeFrame: true,\n\n    \n    centerFrame: false,\n\n    \n    createFrame: function() {\n        var self = this;\n        var body = document.body;\n\n        if (!body || !body.firstChild) {\n            setTimeout( function() { self.createFrame(); }, 50 );\n            return;\n        }\n\n        var div = this.getDragEl();\n\n        if (!div) {\n            div    = document.createElement(\"div\");\n            div.id = this.dragElId;\n            var s  = div.style;\n\n            s.position   = \"absolute\";\n            s.visibility = \"hidden\";\n            s.cursor     = \"move\";\n            s.border     = \"2px solid #aaa\";\n            s.zIndex     = 999;\n\n            \n            \n            \n            body.insertBefore(div, body.firstChild);\n        }\n    },\n\n    \n    initFrame: function() {\n        this.createFrame();\n    },\n\n    applyConfig: function() {\n        Ext.dd.DDProxy.superclass.applyConfig.call(this);\n\n        this.resizeFrame = (this.config.resizeFrame !== false);\n        this.centerFrame = (this.config.centerFrame);\n        this.setDragElId(this.config.dragElId || Ext.dd.DDProxy.dragElId);\n    },\n\n    \n    showFrame: function(iPageX, iPageY) {\n        var el = this.getEl();\n        var dragEl = this.getDragEl();\n        var s = dragEl.style;\n\n        this._resizeProxy();\n\n        if (this.centerFrame) {\n            this.setDelta( Math.round(parseInt(s.width,  10)/2),\n                           Math.round(parseInt(s.height, 10)/2) );\n        }\n\n        this.setDragElPos(iPageX, iPageY);\n\n        Ext.fly(dragEl).show();\n    },\n\n    \n    _resizeProxy: function() {\n        if (this.resizeFrame) {\n            var el = this.getEl();\n            Ext.fly(this.getDragEl()).setSize(el.offsetWidth, el.offsetHeight);\n        }\n    },\n\n    \n    b4MouseDown: function(e) {\n        var x = e.getPageX();\n        var y = e.getPageY();\n        this.autoOffset(x, y);\n        this.setDragElPos(x, y);\n    },\n\n    \n    b4StartDrag: function(x, y) {\n        \n        this.showFrame(x, y);\n    },\n\n    \n    b4EndDrag: function(e) {\n        Ext.fly(this.getDragEl()).hide();\n    },\n\n    \n    \n    \n    endDrag: function(e) {\n\n        var lel = this.getEl();\n        var del = this.getDragEl();\n\n        \n        del.style.visibility = \"\";\n\n        this.beforeMove();\n        \n        \n        lel.style.visibility = \"hidden\";\n        Ext.dd.DDM.moveToEl(lel, del);\n        del.style.visibility = \"hidden\";\n        lel.style.visibility = \"\";\n\n        this.afterDrag();\n    },\n\n    beforeMove : function(){\n\n    },\n\n    afterDrag : function(){\n\n    },\n\n    toString: function() {\n        return (\"DDProxy \" + this.id);\n    }\n\n});\n\nExt.dd.DDTarget = function(id, sGroup, config) {\n    if (id) {\n        this.initTarget(id, sGroup, config);\n    }\n};\n\n\nExt.extend(Ext.dd.DDTarget, Ext.dd.DragDrop, {\n    \n    getDragEl: Ext.emptyFn,\n    \n    isValidHandleChild: Ext.emptyFn,\n    \n    startDrag: Ext.emptyFn,\n    \n    endDrag: Ext.emptyFn,\n    \n    onDrag: Ext.emptyFn,\n    \n    onDragDrop: Ext.emptyFn,\n    \n    onDragEnter: Ext.emptyFn,\n    \n    onDragOut: Ext.emptyFn,\n    \n    onDragOver: Ext.emptyFn,\n    \n    onInvalidDrop: Ext.emptyFn,\n    \n    onMouseDown: Ext.emptyFn,\n    \n    onMouseUp: Ext.emptyFn,\n    \n    setXConstraint: Ext.emptyFn,\n    \n    setYConstraint: Ext.emptyFn,\n    \n    resetConstraints: Ext.emptyFn,\n    \n    clearConstraints: Ext.emptyFn,\n    \n    clearTicks: Ext.emptyFn,\n    \n    setInitPosition: Ext.emptyFn,\n    \n    setDragElId: Ext.emptyFn,\n    \n    setHandleElId: Ext.emptyFn,\n    \n    setOuterHandleElId: Ext.emptyFn,\n    \n    addInvalidHandleClass: Ext.emptyFn,\n    \n    addInvalidHandleId: Ext.emptyFn,\n    \n    addInvalidHandleType: Ext.emptyFn,\n    \n    removeInvalidHandleClass: Ext.emptyFn,\n    \n    removeInvalidHandleId: Ext.emptyFn,\n    \n    removeInvalidHandleType: Ext.emptyFn,\n\n    toString: function() {\n        return (\"DDTarget \" + this.id);\n    }\n});\nExt.dd.DragTracker = Ext.extend(Ext.util.Observable,  {    \n    \t\n    active: false,\n    \t\n    tolerance: 5,\n    \t\n    autoStart: false,\n    \n    constructor : function(config){\n        Ext.apply(this, config);\n\t    this.addEvents(\n\t        \n\t        'mousedown',\n\t        \n\t        'mouseup',\n\t        \n\t        'mousemove',\n\t        \n\t        'dragstart',\n\t        \n\t        'dragend',\n\t        \n\t        'drag'\n\t    );\n\t\n\t    this.dragRegion = new Ext.lib.Region(0,0,0,0);\n\t\n\t    if(this.el){\n\t        this.initEl(this.el);\n\t    }\n        Ext.dd.DragTracker.superclass.constructor.call(this, config);\n    },\n\n    initEl: function(el){\n        this.el = Ext.get(el);\n        el.on('mousedown', this.onMouseDown, this,\n                this.delegate ? {delegate: this.delegate} : undefined);\n    },\n\n    destroy : function(){\n        this.el.un('mousedown', this.onMouseDown, this);\n        delete this.el;\n    },\n\n    onMouseDown: function(e, target){\n        if(this.fireEvent('mousedown', this, e) !== false && this.onBeforeStart(e) !== false){\n            this.startXY = this.lastXY = e.getXY();\n            this.dragTarget = this.delegate ? target : this.el.dom;\n            if(this.preventDefault !== false){\n                e.preventDefault();\n            }\n            Ext.getDoc().on({\n                scope: this,\n                mouseup: this.onMouseUp,\n                mousemove: this.onMouseMove,\n                selectstart: this.stopSelect\n            });\n            if(this.autoStart){\n                this.timer = this.triggerStart.defer(this.autoStart === true ? 1000 : this.autoStart, this, [e]);\n            }\n        }\n    },\n\n    onMouseMove: function(e, target){\n        \n        var ieCheck = Ext.isIE6 || Ext.isIE7 || Ext.isIE8;\n        if(this.active && ieCheck && !e.browserEvent.button){\n            e.preventDefault();\n            this.onMouseUp(e);\n            return;\n        }\n\n        e.preventDefault();\n        var xy = e.getXY(), s = this.startXY;\n        this.lastXY = xy;\n        if(!this.active){\n            if(Math.abs(s[0]-xy[0]) > this.tolerance || Math.abs(s[1]-xy[1]) > this.tolerance){\n                this.triggerStart(e);\n            }else{\n                return;\n            }\n        }\n        this.fireEvent('mousemove', this, e);\n        this.onDrag(e);\n        this.fireEvent('drag', this, e);\n    },\n\n    onMouseUp: function(e) {\n        var doc = Ext.getDoc(),\n            wasActive = this.active;\n            \n        doc.un('mousemove', this.onMouseMove, this);\n        doc.un('mouseup', this.onMouseUp, this);\n        doc.un('selectstart', this.stopSelect, this);\n        e.preventDefault();\n        this.clearStart();\n        this.active = false;\n        delete this.elRegion;\n        this.fireEvent('mouseup', this, e);\n        if(wasActive){\n            this.onEnd(e);\n            this.fireEvent('dragend', this, e);\n        }\n    },\n\n    triggerStart: function(e) {\n        this.clearStart();\n        this.active = true;\n        this.onStart(e);\n        this.fireEvent('dragstart', this, e);\n    },\n\n    clearStart : function() {\n        if(this.timer){\n            clearTimeout(this.timer);\n            delete this.timer;\n        }\n    },\n\n    stopSelect : function(e) {\n        e.stopEvent();\n        return false;\n    },\n    \n    \n    onBeforeStart : function(e) {\n\n    },\n\n    \n    onStart : function(xy) {\n\n    },\n\n    \n    onDrag : function(e) {\n\n    },\n\n    \n    onEnd : function(e) {\n\n    },\n\n    \n    getDragTarget : function(){\n        return this.dragTarget;\n    },\n\n    getDragCt : function(){\n        return this.el;\n    },\n\n    getXY : function(constrain){\n        return constrain ?\n               this.constrainModes[constrain].call(this, this.lastXY) : this.lastXY;\n    },\n\n    getOffset : function(constrain){\n        var xy = this.getXY(constrain),\n            s = this.startXY;\n        return [s[0]-xy[0], s[1]-xy[1]];\n    },\n\n    constrainModes: {\n        'point' : function(xy){\n\n            if(!this.elRegion){\n                this.elRegion = this.getDragCt().getRegion();\n            }\n\n            var dr = this.dragRegion;\n\n            dr.left = xy[0];\n            dr.top = xy[1];\n            dr.right = xy[0];\n            dr.bottom = xy[1];\n\n            dr.constrainTo(this.elRegion);\n\n            return [dr.left, dr.top];\n        }\n    }\n});\nExt.dd.ScrollManager = function(){\n    var ddm = Ext.dd.DragDropMgr;\n    var els = {};\n    var dragEl = null;\n    var proc = {};\n    \n    var onStop = function(e){\n        dragEl = null;\n        clearProc();\n    };\n    \n    var triggerRefresh = function(){\n        if(ddm.dragCurrent){\n             ddm.refreshCache(ddm.dragCurrent.groups);\n        }\n    };\n    \n    var doScroll = function(){\n        if(ddm.dragCurrent){\n            var dds = Ext.dd.ScrollManager;\n            var inc = proc.el.ddScrollConfig ?\n                      proc.el.ddScrollConfig.increment : dds.increment;\n            if(!dds.animate){\n                if(proc.el.scroll(proc.dir, inc)){\n                    triggerRefresh();\n                }\n            }else{\n                proc.el.scroll(proc.dir, inc, true, dds.animDuration, triggerRefresh);\n            }\n        }\n    };\n    \n    var clearProc = function(){\n        if(proc.id){\n            clearInterval(proc.id);\n        }\n        proc.id = 0;\n        proc.el = null;\n        proc.dir = \"\";\n    };\n\n    var startProc = function(el, dir){\n        clearProc();\n        proc.el = el;\n        proc.dir = dir;\n        var group = el.ddScrollConfig ? el.ddScrollConfig.ddGroup : undefined,\n            freq  = (el.ddScrollConfig && el.ddScrollConfig.frequency)\n                  ? el.ddScrollConfig.frequency\n                  : Ext.dd.ScrollManager.frequency;\n\n        if (group === undefined || ddm.dragCurrent.ddGroup == group) {\n            proc.id = setInterval(doScroll, freq);\n        }\n    };\n    \n    var onFire = function(e, isDrop){\n        if(isDrop || !ddm.dragCurrent){ return; }\n        var dds = Ext.dd.ScrollManager;\n        if(!dragEl || dragEl != ddm.dragCurrent){\n            dragEl = ddm.dragCurrent;\n            \n            dds.refreshCache();\n        }\n        \n        var xy = Ext.lib.Event.getXY(e);\n        var pt = new Ext.lib.Point(xy[0], xy[1]);\n        for(var id in els){\n            var el = els[id], r = el._region;\n            var c = el.ddScrollConfig ? el.ddScrollConfig : dds;\n            if(r && r.contains(pt) && el.isScrollable()){\n                if(r.bottom - pt.y <= c.vthresh){\n                    if(proc.el != el){\n                        startProc(el, \"down\");\n                    }\n                    return;\n                }else if(r.right - pt.x <= c.hthresh){\n                    if(proc.el != el){\n                        startProc(el, \"left\");\n                    }\n                    return;\n                }else if(pt.y - r.top <= c.vthresh){\n                    if(proc.el != el){\n                        startProc(el, \"up\");\n                    }\n                    return;\n                }else if(pt.x - r.left <= c.hthresh){\n                    if(proc.el != el){\n                        startProc(el, \"right\");\n                    }\n                    return;\n                }\n            }\n        }\n        clearProc();\n    };\n    \n    ddm.fireEvents = ddm.fireEvents.createSequence(onFire, ddm);\n    ddm.stopDrag = ddm.stopDrag.createSequence(onStop, ddm);\n    \n    return {\n        \n        register : function(el){\n            if(Ext.isArray(el)){\n                for(var i = 0, len = el.length; i < len; i++) {\n                \tthis.register(el[i]);\n                }\n            }else{\n                el = Ext.get(el);\n                els[el.id] = el;\n            }\n        },\n        \n        \n        unregister : function(el){\n            if(Ext.isArray(el)){\n                for(var i = 0, len = el.length; i < len; i++) {\n                \tthis.unregister(el[i]);\n                }\n            }else{\n                el = Ext.get(el);\n                delete els[el.id];\n            }\n        },\n        \n        \n        vthresh : 25,\n        \n        hthresh : 25,\n\n        \n        increment : 100,\n        \n        \n        frequency : 500,\n        \n        \n        animate: true,\n        \n        \n        animDuration: .4,\n        \n        \n        ddGroup: undefined,\n        \n        \n        refreshCache : function(){\n            for(var id in els){\n                if(typeof els[id] == 'object'){ \n                    els[id]._region = els[id].getRegion();\n                }\n            }\n        }\n    };\n}();\nExt.dd.Registry = function(){\n    var elements = {}; \n    var handles = {}; \n    var autoIdSeed = 0;\n\n    var getId = function(el, autogen){\n        if(typeof el == \"string\"){\n            return el;\n        }\n        var id = el.id;\n        if(!id && autogen !== false){\n            id = \"extdd-\" + (++autoIdSeed);\n            el.id = id;\n        }\n        return id;\n    };\n    \n    return {\n    \n        register : function(el, data){\n            data = data || {};\n            if(typeof el == \"string\"){\n                el = document.getElementById(el);\n            }\n            data.ddel = el;\n            elements[getId(el)] = data;\n            if(data.isHandle !== false){\n                handles[data.ddel.id] = data;\n            }\n            if(data.handles){\n                var hs = data.handles;\n                for(var i = 0, len = hs.length; i < len; i++){\n                \thandles[getId(hs[i])] = data;\n                }\n            }\n        },\n\n    \n        unregister : function(el){\n            var id = getId(el, false);\n            var data = elements[id];\n            if(data){\n                delete elements[id];\n                if(data.handles){\n                    var hs = data.handles;\n                    for(var i = 0, len = hs.length; i < len; i++){\n                    \tdelete handles[getId(hs[i], false)];\n                    }\n                }\n            }\n        },\n\n    \n        getHandle : function(id){\n            if(typeof id != \"string\"){ \n                id = id.id;\n            }\n            return handles[id];\n        },\n\n    \n        getHandleFromEvent : function(e){\n            var t = Ext.lib.Event.getTarget(e);\n            return t ? handles[t.id] : null;\n        },\n\n    \n        getTarget : function(id){\n            if(typeof id != \"string\"){ \n                id = id.id;\n            }\n            return elements[id];\n        },\n\n    \n        getTargetFromEvent : function(e){\n            var t = Ext.lib.Event.getTarget(e);\n            return t ? elements[t.id] || handles[t.id] : null;\n        }\n    };\n}();\nExt.dd.StatusProxy = function(config){\n    Ext.apply(this, config);\n    this.id = this.id || Ext.id();\n    this.el = new Ext.Layer({\n        dh: {\n            id: this.id, tag: \"div\", cls: \"x-dd-drag-proxy \"+this.dropNotAllowed, children: [\n                {tag: \"div\", cls: \"x-dd-drop-icon\"},\n                {tag: \"div\", cls: \"x-dd-drag-ghost\"}\n            ]\n        }, \n        shadow: !config || config.shadow !== false\n    });\n    this.ghost = Ext.get(this.el.dom.childNodes[1]);\n    this.dropStatus = this.dropNotAllowed;\n};\n\nExt.dd.StatusProxy.prototype = {\n    \n    dropAllowed : \"x-dd-drop-ok\",\n    \n    dropNotAllowed : \"x-dd-drop-nodrop\",\n\n    \n    setStatus : function(cssClass){\n        cssClass = cssClass || this.dropNotAllowed;\n        if(this.dropStatus != cssClass){\n            this.el.replaceClass(this.dropStatus, cssClass);\n            this.dropStatus = cssClass;\n        }\n    },\n\n    \n    reset : function(clearGhost){\n        this.el.dom.className = \"x-dd-drag-proxy \" + this.dropNotAllowed;\n        this.dropStatus = this.dropNotAllowed;\n        if(clearGhost){\n            this.ghost.update(\"\");\n        }\n    },\n\n    \n    update : function(html){\n        if(typeof html == \"string\"){\n            this.ghost.update(html);\n        }else{\n            this.ghost.update(\"\");\n            html.style.margin = \"0\";\n            this.ghost.dom.appendChild(html);\n        }\n        var el = this.ghost.dom.firstChild; \n        if(el){\n            Ext.fly(el).setStyle('float', 'none');\n        }\n    },\n\n    \n    getEl : function(){\n        return this.el;\n    },\n\n    \n    getGhost : function(){\n        return this.ghost;\n    },\n\n    \n    hide : function(clear){\n        this.el.hide();\n        if(clear){\n            this.reset(true);\n        }\n    },\n\n    \n    stop : function(){\n        if(this.anim && this.anim.isAnimated && this.anim.isAnimated()){\n            this.anim.stop();\n        }\n    },\n\n    \n    show : function(){\n        this.el.show();\n    },\n\n    \n    sync : function(){\n        this.el.sync();\n    },\n\n    \n    repair : function(xy, callback, scope){\n        this.callback = callback;\n        this.scope = scope;\n        if(xy && this.animRepair !== false){\n            this.el.addClass(\"x-dd-drag-repair\");\n            this.el.hideUnders(true);\n            this.anim = this.el.shift({\n                duration: this.repairDuration || .5,\n                easing: 'easeOut',\n                xy: xy,\n                stopFx: true,\n                callback: this.afterRepair,\n                scope: this\n            });\n        }else{\n            this.afterRepair();\n        }\n    },\n\n    \n    afterRepair : function(){\n        this.hide(true);\n        if(typeof this.callback == \"function\"){\n            this.callback.call(this.scope || this);\n        }\n        this.callback = null;\n        this.scope = null;\n    },\n    \n    destroy: function(){\n        Ext.destroy(this.ghost, this.el);    \n    }\n};\nExt.dd.DragSource = function(el, config){\n    this.el = Ext.get(el);\n    if(!this.dragData){\n        this.dragData = {};\n    }\n    \n    Ext.apply(this, config);\n    \n    if(!this.proxy){\n        this.proxy = new Ext.dd.StatusProxy();\n    }\n    Ext.dd.DragSource.superclass.constructor.call(this, this.el.dom, this.ddGroup || this.group, \n          {dragElId : this.proxy.id, resizeFrame: false, isTarget: false, scroll: this.scroll === true});\n    \n    this.dragging = false;\n};\n\nExt.extend(Ext.dd.DragSource, Ext.dd.DDProxy, {\n    \n    \n    dropAllowed : \"x-dd-drop-ok\",\n    \n    dropNotAllowed : \"x-dd-drop-nodrop\",\n\n    \n    getDragData : function(e){\n        return this.dragData;\n    },\n\n    \n    onDragEnter : function(e, id){\n        var target = Ext.dd.DragDropMgr.getDDById(id);\n        this.cachedTarget = target;\n        if(this.beforeDragEnter(target, e, id) !== false){\n            if(target.isNotifyTarget){\n                var status = target.notifyEnter(this, e, this.dragData);\n                this.proxy.setStatus(status);\n            }else{\n                this.proxy.setStatus(this.dropAllowed);\n            }\n            \n            if(this.afterDragEnter){\n                \n                this.afterDragEnter(target, e, id);\n            }\n        }\n    },\n\n    \n    beforeDragEnter : function(target, e, id){\n        return true;\n    },\n\n    \n    alignElWithMouse: function() {\n        Ext.dd.DragSource.superclass.alignElWithMouse.apply(this, arguments);\n        this.proxy.sync();\n    },\n\n    \n    onDragOver : function(e, id){\n        var target = this.cachedTarget || Ext.dd.DragDropMgr.getDDById(id);\n        if(this.beforeDragOver(target, e, id) !== false){\n            if(target.isNotifyTarget){\n                var status = target.notifyOver(this, e, this.dragData);\n                this.proxy.setStatus(status);\n            }\n\n            if(this.afterDragOver){\n                \n                this.afterDragOver(target, e, id);\n            }\n        }\n    },\n\n    \n    beforeDragOver : function(target, e, id){\n        return true;\n    },\n\n    \n    onDragOut : function(e, id){\n        var target = this.cachedTarget || Ext.dd.DragDropMgr.getDDById(id);\n        if(this.beforeDragOut(target, e, id) !== false){\n            if(target.isNotifyTarget){\n                target.notifyOut(this, e, this.dragData);\n            }\n            this.proxy.reset();\n            if(this.afterDragOut){\n                \n                this.afterDragOut(target, e, id);\n            }\n        }\n        this.cachedTarget = null;\n    },\n\n    \n    beforeDragOut : function(target, e, id){\n        return true;\n    },\n    \n    \n    onDragDrop : function(e, id){\n        var target = this.cachedTarget || Ext.dd.DragDropMgr.getDDById(id);\n        if(this.beforeDragDrop(target, e, id) !== false){\n            if(target.isNotifyTarget){\n                if(target.notifyDrop(this, e, this.dragData)){ \n                    this.onValidDrop(target, e, id);\n                }else{\n                    this.onInvalidDrop(target, e, id);\n                }\n            }else{\n                this.onValidDrop(target, e, id);\n            }\n            \n            if(this.afterDragDrop){\n                \n                this.afterDragDrop(target, e, id);\n            }\n        }\n        delete this.cachedTarget;\n    },\n\n    \n    beforeDragDrop : function(target, e, id){\n        return true;\n    },\n\n    \n    onValidDrop : function(target, e, id){\n        this.hideProxy();\n        if(this.afterValidDrop){\n            \n            this.afterValidDrop(target, e, id);\n        }\n    },\n\n    \n    getRepairXY : function(e, data){\n        return this.el.getXY();  \n    },\n\n    \n    onInvalidDrop : function(target, e, id){\n        this.beforeInvalidDrop(target, e, id);\n        if(this.cachedTarget){\n            if(this.cachedTarget.isNotifyTarget){\n                this.cachedTarget.notifyOut(this, e, this.dragData);\n            }\n            this.cacheTarget = null;\n        }\n        this.proxy.repair(this.getRepairXY(e, this.dragData), this.afterRepair, this);\n\n        if(this.afterInvalidDrop){\n            \n            this.afterInvalidDrop(e, id);\n        }\n    },\n\n    \n    afterRepair : function(){\n        if(Ext.enableFx){\n            this.el.highlight(this.hlColor || \"c3daf9\");\n        }\n        this.dragging = false;\n    },\n\n    \n    beforeInvalidDrop : function(target, e, id){\n        return true;\n    },\n\n    \n    handleMouseDown : function(e){\n        if(this.dragging) {\n            return;\n        }\n        var data = this.getDragData(e);\n        if(data && this.onBeforeDrag(data, e) !== false){\n            this.dragData = data;\n            this.proxy.stop();\n            Ext.dd.DragSource.superclass.handleMouseDown.apply(this, arguments);\n        } \n    },\n\n    \n    onBeforeDrag : function(data, e){\n        return true;\n    },\n\n    \n    onStartDrag : Ext.emptyFn,\n\n    \n    startDrag : function(x, y){\n        this.proxy.reset();\n        this.dragging = true;\n        this.proxy.update(\"\");\n        this.onInitDrag(x, y);\n        this.proxy.show();\n    },\n\n    \n    onInitDrag : function(x, y){\n        var clone = this.el.dom.cloneNode(true);\n        clone.id = Ext.id(); \n        this.proxy.update(clone);\n        this.onStartDrag(x, y);\n        return true;\n    },\n\n    \n    getProxy : function(){\n        return this.proxy;  \n    },\n\n    \n    hideProxy : function(){\n        this.proxy.hide();  \n        this.proxy.reset(true);\n        this.dragging = false;\n    },\n\n    \n    triggerCacheRefresh : function(){\n        Ext.dd.DDM.refreshCache(this.groups);\n    },\n\n    \n    b4EndDrag: function(e) {\n    },\n\n    \n    endDrag : function(e){\n        this.onEndDrag(this.dragData, e);\n    },\n\n    \n    onEndDrag : function(data, e){\n    },\n    \n    \n    autoOffset : function(x, y) {\n        this.setDelta(-12, -20);\n    },\n    \n    destroy: function(){\n        Ext.dd.DragSource.superclass.destroy.call(this);\n        Ext.destroy(this.proxy);\n    }\n});\nExt.dd.DropTarget = Ext.extend(Ext.dd.DDTarget, {\n    \n    constructor : function(el, config){\n        this.el = Ext.get(el);\n    \n        Ext.apply(this, config);\n    \n        if(this.containerScroll){\n            Ext.dd.ScrollManager.register(this.el);\n        }\n    \n        Ext.dd.DropTarget.superclass.constructor.call(this, this.el.dom, this.ddGroup || this.group, \n              {isTarget: true});        \n    },\n    \n    \n    \n    \n    dropAllowed : \"x-dd-drop-ok\",\n    \n    dropNotAllowed : \"x-dd-drop-nodrop\",\n\n    \n    isTarget : true,\n\n    \n    isNotifyTarget : true,\n\n    \n    notifyEnter : function(dd, e, data){\n        if(this.overClass){\n            this.el.addClass(this.overClass);\n        }\n        return this.dropAllowed;\n    },\n\n    \n    notifyOver : function(dd, e, data){\n        return this.dropAllowed;\n    },\n\n    \n    notifyOut : function(dd, e, data){\n        if(this.overClass){\n            this.el.removeClass(this.overClass);\n        }\n    },\n\n    \n    notifyDrop : function(dd, e, data){\n        return false;\n    },\n    \n    destroy : function(){\n        Ext.dd.DropTarget.superclass.destroy.call(this);\n        if(this.containerScroll){\n            Ext.dd.ScrollManager.unregister(this.el);\n        }\n    }\n});\nExt.dd.DragZone = Ext.extend(Ext.dd.DragSource, {\n    \n    constructor : function(el, config){\n        Ext.dd.DragZone.superclass.constructor.call(this, el, config);\n        if(this.containerScroll){\n            Ext.dd.ScrollManager.register(this.el);\n        }\n    },\n    \n    \n    \n    \n\n    \n    getDragData : function(e){\n        return Ext.dd.Registry.getHandleFromEvent(e);\n    },\n    \n    \n    onInitDrag : function(x, y){\n        this.proxy.update(this.dragData.ddel.cloneNode(true));\n        this.onStartDrag(x, y);\n        return true;\n    },\n    \n    \n    afterRepair : function(){\n        if(Ext.enableFx){\n            Ext.Element.fly(this.dragData.ddel).highlight(this.hlColor || \"c3daf9\");\n        }\n        this.dragging = false;\n    },\n\n    \n    getRepairXY : function(e){\n        return Ext.Element.fly(this.dragData.ddel).getXY();  \n    },\n    \n    destroy : function(){\n        Ext.dd.DragZone.superclass.destroy.call(this);\n        if(this.containerScroll){\n            Ext.dd.ScrollManager.unregister(this.el);\n        }\n    }\n});\nExt.dd.DropZone = function(el, config){\n    Ext.dd.DropZone.superclass.constructor.call(this, el, config);\n};\n\nExt.extend(Ext.dd.DropZone, Ext.dd.DropTarget, {\n    \n    getTargetFromEvent : function(e){\n        return Ext.dd.Registry.getTargetFromEvent(e);\n    },\n\n    \n    onNodeEnter : function(n, dd, e, data){\n        \n    },\n\n    \n    onNodeOver : function(n, dd, e, data){\n        return this.dropAllowed;\n    },\n\n    \n    onNodeOut : function(n, dd, e, data){\n        \n    },\n\n    \n    onNodeDrop : function(n, dd, e, data){\n        return false;\n    },\n\n    \n    onContainerOver : function(dd, e, data){\n        return this.dropNotAllowed;\n    },\n\n    \n    onContainerDrop : function(dd, e, data){\n        return false;\n    },\n\n    \n    notifyEnter : function(dd, e, data){\n        return this.dropNotAllowed;\n    },\n\n    \n    notifyOver : function(dd, e, data){\n        var n = this.getTargetFromEvent(e);\n        if(!n){ \n            if(this.lastOverNode){\n                this.onNodeOut(this.lastOverNode, dd, e, data);\n                this.lastOverNode = null;\n            }\n            return this.onContainerOver(dd, e, data);\n        }\n        if(this.lastOverNode != n){\n            if(this.lastOverNode){\n                this.onNodeOut(this.lastOverNode, dd, e, data);\n            }\n            this.onNodeEnter(n, dd, e, data);\n            this.lastOverNode = n;\n        }\n        return this.onNodeOver(n, dd, e, data);\n    },\n\n    \n    notifyOut : function(dd, e, data){\n        if(this.lastOverNode){\n            this.onNodeOut(this.lastOverNode, dd, e, data);\n            this.lastOverNode = null;\n        }\n    },\n\n    \n    notifyDrop : function(dd, e, data){\n        if(this.lastOverNode){\n            this.onNodeOut(this.lastOverNode, dd, e, data);\n            this.lastOverNode = null;\n        }\n        var n = this.getTargetFromEvent(e);\n        return n ?\n            this.onNodeDrop(n, dd, e, data) :\n            this.onContainerDrop(dd, e, data);\n    },\n\n    \n    triggerCacheRefresh : function(){\n        Ext.dd.DDM.refreshCache(this.groups);\n    }  \n});\nExt.Element.addMethods({\n    \n    initDD : function(group, config, overrides){\n        var dd = new Ext.dd.DD(Ext.id(this.dom), group, config);\n        return Ext.apply(dd, overrides);\n    },\n\n    \n    initDDProxy : function(group, config, overrides){\n        var dd = new Ext.dd.DDProxy(Ext.id(this.dom), group, config);\n        return Ext.apply(dd, overrides);\n    },\n\n    \n    initDDTarget : function(group, config, overrides){\n        var dd = new Ext.dd.DDTarget(Ext.id(this.dom), group, config);\n        return Ext.apply(dd, overrides);\n    }\n});\n\nExt.data.Api = (function() {\n\n    \n    \n    \n    \n    var validActions = {};\n\n    return {\n        \n        actions : {\n            create  : 'create',\n            read    : 'read',\n            update  : 'update',\n            destroy : 'destroy'\n        },\n\n        \n        restActions : {\n            create  : 'POST',\n            read    : 'GET',\n            update  : 'PUT',\n            destroy : 'DELETE'\n        },\n\n        \n        isAction : function(action) {\n            return (Ext.data.Api.actions[action]) ? true : false;\n        },\n\n        \n        getVerb : function(name) {\n            if (validActions[name]) {\n                return validActions[name];  \n            }\n            for (var verb in this.actions) {\n                if (this.actions[verb] === name) {\n                    validActions[name] = verb;\n                    break;\n                }\n            }\n            return (validActions[name] !== undefined) ? validActions[name] : null;\n        },\n\n        \n        isValid : function(api){\n            var invalid = [];\n            var crud = this.actions; \n            for (var action in api) {\n                if (!(action in crud)) {\n                    invalid.push(action);\n                }\n            }\n            return (!invalid.length) ? true : invalid;\n        },\n\n        \n        hasUniqueUrl : function(proxy, verb) {\n            var url = (proxy.api[verb]) ? proxy.api[verb].url : null;\n            var unique = true;\n            for (var action in proxy.api) {\n                if ((unique = (action === verb) ? true : (proxy.api[action].url != url) ? true : false) === false) {\n                    break;\n                }\n            }\n            return unique;\n        },\n\n        \n        prepare : function(proxy) {\n            if (!proxy.api) {\n                proxy.api = {}; \n            }\n            for (var verb in this.actions) {\n                var action = this.actions[verb];\n                proxy.api[action] = proxy.api[action] || proxy.url || proxy.directFn;\n                if (typeof(proxy.api[action]) == 'string') {\n                    proxy.api[action] = {\n                        url: proxy.api[action],\n                        method: (proxy.restful === true) ? Ext.data.Api.restActions[action] : undefined\n                    };\n                }\n            }\n        },\n\n        \n        restify : function(proxy) {\n            proxy.restful = true;\n            for (var verb in this.restActions) {\n                proxy.api[this.actions[verb]].method ||\n                    (proxy.api[this.actions[verb]].method = this.restActions[verb]);\n            }\n            \n            \n            proxy.onWrite = proxy.onWrite.createInterceptor(function(action, o, response, rs) {\n                var reader = o.reader;\n                var res = new Ext.data.Response({\n                    action: action,\n                    raw: response\n                });\n\n                switch (response.status) {\n                    case 200:   \n                        return true;\n                        break;\n                    case 201:   \n                        if (Ext.isEmpty(res.raw.responseText)) {\n                          res.success = true;\n                        } else {\n                          \n                          return true;\n                        }\n                        break;\n                    case 204:  \n                        res.success = true;\n                        res.data = null;\n                        break;\n                    default:\n                        return true;\n                        break;\n                }\n                if (res.success === true) {\n                    this.fireEvent(\"write\", this, action, res.data, res, rs, o.request.arg);\n                } else {\n                    this.fireEvent('exception', this, 'remote', action, o, res, rs);\n                }\n                o.request.callback.call(o.request.scope, res.data, res, res.success);\n\n                return false;   \n            }, proxy);\n        }\n    };\n})();\n\n\nExt.data.Response = function(params, response) {\n    Ext.apply(this, params, {\n        raw: response\n    });\n};\nExt.data.Response.prototype = {\n    message : null,\n    success : false,\n    status : null,\n    root : null,\n    raw : null,\n\n    getMessage : function() {\n        return this.message;\n    },\n    getSuccess : function() {\n        return this.success;\n    },\n    getStatus : function() {\n        return this.status;\n    },\n    getRoot : function() {\n        return this.root;\n    },\n    getRawResponse : function() {\n        return this.raw;\n    }\n};\n\n\nExt.data.Api.Error = Ext.extend(Ext.Error, {\n    constructor : function(message, arg) {\n        this.arg = arg;\n        Ext.Error.call(this, message);\n    },\n    name: 'Ext.data.Api'\n});\nExt.apply(Ext.data.Api.Error.prototype, {\n    lang: {\n        'action-url-undefined': 'No fallback url defined for this action.  When defining a DataProxy api, please be sure to define an url for each CRUD action in Ext.data.Api.actions or define a default url in addition to your api-configuration.',\n        'invalid': 'received an invalid API-configuration.  Please ensure your proxy API-configuration contains only the actions defined in Ext.data.Api.actions',\n        'invalid-url': 'Invalid url.  Please review your proxy configuration.',\n        'execute': 'Attempted to execute an unknown action.  Valid API actions are defined in Ext.data.Api.actions\"'\n    }\n});\n\n\n\n\nExt.data.SortTypes = {\n    \n    none : function(s){\n        return s;\n    },\n    \n    \n    stripTagsRE : /<\\/?[^>]+>/gi,\n    \n    \n    asText : function(s){\n        return String(s).replace(this.stripTagsRE, \"\");\n    },\n    \n    \n    asUCText : function(s){\n        return String(s).toUpperCase().replace(this.stripTagsRE, \"\");\n    },\n    \n    \n    asUCString : function(s) {\n    \treturn String(s).toUpperCase();\n    },\n    \n    \n    asDate : function(s) {\n        if(!s){\n            return 0;\n        }\n        if(Ext.isDate(s)){\n            return s.getTime();\n        }\n    \treturn Date.parse(String(s));\n    },\n    \n    \n    asFloat : function(s) {\n    \tvar val = parseFloat(String(s).replace(/,/g, \"\"));\n    \treturn isNaN(val) ? 0 : val;\n    },\n    \n    \n    asInt : function(s) {\n        var val = parseInt(String(s).replace(/,/g, \"\"), 10);\n        return isNaN(val) ? 0 : val;\n    }\n};\nExt.data.Record = function(data, id){\n    \n    this.id = (id || id === 0) ? id : Ext.data.Record.id(this);\n    this.data = data || {};\n};\n\n\nExt.data.Record.create = function(o){\n    var f = Ext.extend(Ext.data.Record, {});\n    var p = f.prototype;\n    p.fields = new Ext.util.MixedCollection(false, function(field){\n        return field.name;\n    });\n    for(var i = 0, len = o.length; i < len; i++){\n        p.fields.add(new Ext.data.Field(o[i]));\n    }\n    f.getField = function(name){\n        return p.fields.get(name);\n    };\n    return f;\n};\n\nExt.data.Record.PREFIX = 'ext-record';\nExt.data.Record.AUTO_ID = 1;\nExt.data.Record.EDIT = 'edit';\nExt.data.Record.REJECT = 'reject';\nExt.data.Record.COMMIT = 'commit';\n\n\n\nExt.data.Record.id = function(rec) {\n    rec.phantom = true;\n    return [Ext.data.Record.PREFIX, '-', Ext.data.Record.AUTO_ID++].join('');\n};\n\nExt.data.Record.prototype = {\n    \n    \n    \n    \n    \n    \n    dirty : false,\n    editing : false,\n    error : null,\n    \n    modified : null,\n    \n    phantom : false,\n\n    \n    join : function(store){\n        \n        this.store = store;\n    },\n\n    \n    set : function(name, value){\n        var encode = Ext.isPrimitive(value) ? String : Ext.encode;\n        if(encode(this.data[name]) == encode(value)) {\n            return;\n        }        \n        this.dirty = true;\n        if(!this.modified){\n            this.modified = {};\n        }\n        if(this.modified[name] === undefined){\n            this.modified[name] = this.data[name];\n        }\n        this.data[name] = value;\n        if(!this.editing){\n            this.afterEdit();\n        }\n    },\n\n    \n    afterEdit : function(){\n        if (this.store != undefined && typeof this.store.afterEdit == \"function\") {\n            this.store.afterEdit(this);\n        }\n    },\n\n    \n    afterReject : function(){\n        if(this.store){\n            this.store.afterReject(this);\n        }\n    },\n\n    \n    afterCommit : function(){\n        if(this.store){\n            this.store.afterCommit(this);\n        }\n    },\n\n    \n    get : function(name){\n        return this.data[name];\n    },\n\n    \n    beginEdit : function(){\n        this.editing = true;\n        this.modified = this.modified || {};\n    },\n\n    \n    cancelEdit : function(){\n        this.editing = false;\n        delete this.modified;\n    },\n\n    \n    endEdit : function(){\n        this.editing = false;\n        if(this.dirty){\n            this.afterEdit();\n        }\n    },\n\n    \n    reject : function(silent){\n        var m = this.modified;\n        for(var n in m){\n            if(typeof m[n] != \"function\"){\n                this.data[n] = m[n];\n            }\n        }\n        this.dirty = false;\n        delete this.modified;\n        this.editing = false;\n        if(silent !== true){\n            this.afterReject();\n        }\n    },\n\n    \n    commit : function(silent){\n        this.dirty = false;\n        delete this.modified;\n        this.editing = false;\n        if(silent !== true){\n            this.afterCommit();\n        }\n    },\n\n    \n    getChanges : function(){\n        var m = this.modified, cs = {};\n        for(var n in m){\n            if(m.hasOwnProperty(n)){\n                cs[n] = this.data[n];\n            }\n        }\n        return cs;\n    },\n\n    \n    hasError : function(){\n        return this.error !== null;\n    },\n\n    \n    clearError : function(){\n        this.error = null;\n    },\n\n    \n    copy : function(newId) {\n        return new this.constructor(Ext.apply({}, this.data), newId || this.id);\n    },\n\n    \n    isModified : function(fieldName){\n        return !!(this.modified && this.modified.hasOwnProperty(fieldName));\n    },\n\n    \n    isValid : function() {\n        return this.fields.find(function(f) {\n            return (f.allowBlank === false && Ext.isEmpty(this.data[f.name])) ? true : false;\n        },this) ? false : true;\n    },\n\n    \n    markDirty : function(){\n        this.dirty = true;\n        if(!this.modified){\n            this.modified = {};\n        }\n        this.fields.each(function(f) {\n            this.modified[f.name] = this.data[f.name];\n        },this);\n    }\n};\n\nExt.StoreMgr = Ext.apply(new Ext.util.MixedCollection(), {\n    \n\n    \n    register : function(){\n        for(var i = 0, s; (s = arguments[i]); i++){\n            this.add(s);\n        }\n    },\n\n    \n    unregister : function(){\n        for(var i = 0, s; (s = arguments[i]); i++){\n            this.remove(this.lookup(s));\n        }\n    },\n\n    \n    lookup : function(id){\n        if(Ext.isArray(id)){\n            var fields = ['field1'], expand = !Ext.isArray(id[0]);\n            if(!expand){\n                for(var i = 2, len = id[0].length; i <= len; ++i){\n                    fields.push('field' + i);\n                }\n            }\n            return new Ext.data.ArrayStore({\n                fields: fields,\n                data: id,\n                expandData: expand,\n                autoDestroy: true,\n                autoCreated: true\n\n            });\n        }\n        return Ext.isObject(id) ? (id.events ? id : Ext.create(id, 'store')) : this.get(id);\n    },\n\n    \n    getKey : function(o){\n         return o.storeId;\n    }\n});\nExt.data.Store = Ext.extend(Ext.util.Observable, {\n    \n    \n    \n    \n    \n    \n    \n    writer : undefined,\n    \n    \n    \n    remoteSort : false,\n\n    \n    autoDestroy : false,\n\n    \n    pruneModifiedRecords : false,\n\n    \n    lastOptions : null,\n\n    \n    autoSave : true,\n\n    \n    batch : true,\n\n    \n    restful: false,\n\n    \n    paramNames : undefined,\n\n    \n    defaultParamNames : {\n        start : 'start',\n        limit : 'limit',\n        sort : 'sort',\n        dir : 'dir'\n    },\n\n    isDestroyed: false,\n    hasMultiSort: false,\n\n    \n    batchKey : '_ext_batch_',\n\n    constructor : function(config){\n        \n\n        \n\n        this.data = new Ext.util.MixedCollection(false);\n        this.data.getKey = function(o){\n            return o.id;\n        };\n\n\n        \n        this.removed = [];\n\n        if(config && config.data){\n            this.inlineData = config.data;\n            delete config.data;\n        }\n\n        Ext.apply(this, config);\n\n        \n        this.baseParams = Ext.isObject(this.baseParams) ? this.baseParams : {};\n\n        this.paramNames = Ext.applyIf(this.paramNames || {}, this.defaultParamNames);\n\n        if((this.url || this.api) && !this.proxy){\n            this.proxy = new Ext.data.HttpProxy({url: this.url, api: this.api});\n        }\n        \n        if (this.restful === true && this.proxy) {\n            \n            \n            this.batch = false;\n            Ext.data.Api.restify(this.proxy);\n        }\n\n        if(this.reader){ \n            if(!this.recordType){\n                this.recordType = this.reader.recordType;\n            }\n            if(this.reader.onMetaChange){\n                this.reader.onMetaChange = this.reader.onMetaChange.createSequence(this.onMetaChange, this);\n            }\n            if (this.writer) { \n                if (this.writer instanceof(Ext.data.DataWriter) === false) {    \n                    this.writer = this.buildWriter(this.writer);\n                }\n                this.writer.meta = this.reader.meta;\n                this.pruneModifiedRecords = true;\n            }\n        }\n\n        \n\n        if(this.recordType){\n            \n            this.fields = this.recordType.prototype.fields;\n        }\n        this.modified = [];\n\n        this.addEvents(\n            \n            'datachanged',\n            \n            'metachange',\n            \n            'add',\n            \n            'remove',\n            \n            'update',\n            \n            'clear',\n            \n            'exception',\n            \n            'beforeload',\n            \n            'load',\n            \n            'loadexception',\n            \n            'beforewrite',\n            \n            'write',\n            \n            'beforesave',\n            \n            'save'\n\n        );\n\n        if(this.proxy){\n            \n            this.relayEvents(this.proxy,  ['loadexception', 'exception']);\n        }\n        \n        if (this.writer) {\n            this.on({\n                scope: this,\n                add: this.createRecords,\n                remove: this.destroyRecord,\n                update: this.updateRecord,\n                clear: this.onClear\n            });\n        }\n\n        this.sortToggle = {};\n        if(this.sortField){\n            this.setDefaultSort(this.sortField, this.sortDir);\n        }else if(this.sortInfo){\n            this.setDefaultSort(this.sortInfo.field, this.sortInfo.direction);\n        }\n\n        Ext.data.Store.superclass.constructor.call(this);\n\n        if(this.id){\n            this.storeId = this.id;\n            delete this.id;\n        }\n        if(this.storeId){\n            Ext.StoreMgr.register(this);\n        }\n        if(this.inlineData){\n            this.loadData(this.inlineData);\n            delete this.inlineData;\n        }else if(this.autoLoad){\n            this.load.defer(10, this, [\n                typeof this.autoLoad == 'object' ?\n                    this.autoLoad : undefined]);\n        }\n        \n        this.batchCounter = 0;\n        this.batches = {};\n    },\n\n    \n    buildWriter : function(config) {\n        var klass = undefined,\n            type = (config.format || 'json').toLowerCase();\n        switch (type) {\n            case 'json':\n                klass = Ext.data.JsonWriter;\n                break;\n            case 'xml':\n                klass = Ext.data.XmlWriter;\n                break;\n            default:\n                klass = Ext.data.JsonWriter;\n        }\n        return new klass(config);\n    },\n\n    \n    destroy : function(){\n        if(!this.isDestroyed){\n            if(this.storeId){\n                Ext.StoreMgr.unregister(this);\n            }\n            this.clearData();\n            this.data = null;\n            Ext.destroy(this.proxy);\n            this.reader = this.writer = null;\n            this.purgeListeners();\n            this.isDestroyed = true;\n        }\n    },\n\n    \n    add : function(records) {\n        var i, len, record, index;\n\n        records = [].concat(records);\n        if (records.length < 1) {\n            return;\n        }\n\n        for (i = 0, len = records.length; i < len; i++) {\n            record = records[i];\n\n            record.join(this);\n\n            if (record.dirty || record.phantom) {\n                this.modified.push(record);\n            }\n        }\n\n        index = this.data.length;\n        this.data.addAll(records);\n\n        if (this.snapshot) {\n            this.snapshot.addAll(records);\n        }\n\n        this.fireEvent('add', this, records, index);\n    },\n\n    \n    addSorted : function(record){\n        var index = this.findInsertIndex(record);\n        this.insert(index, record);\n    },\n\n    \n    doUpdate: function(rec){\n        var id = rec.id;\n        \n        this.getById(id).join(null);\n\n        this.data.replace(id, rec);\n        if (this.snapshot) {\n            this.snapshot.replace(id, rec);\n        }\n        rec.join(this);\n        this.fireEvent('update', this, rec, Ext.data.Record.COMMIT);\n    },\n\n    \n    remove : function(record){\n        if(Ext.isArray(record)){\n            Ext.each(record, function(r){\n                this.remove(r);\n            }, this);\n            return;\n        }\n        var index = this.data.indexOf(record);\n        if(index > -1){\n            record.join(null);\n            this.data.removeAt(index);\n        }\n        if(this.pruneModifiedRecords){\n            this.modified.remove(record);\n        }\n        if(this.snapshot){\n            this.snapshot.remove(record);\n        }\n        if(index > -1){\n            this.fireEvent('remove', this, record, index);\n        }\n    },\n\n    \n    removeAt : function(index){\n        this.remove(this.getAt(index));\n    },\n\n    \n    removeAll : function(silent){\n        var items = [];\n        this.each(function(rec){\n            items.push(rec);\n        });\n        this.clearData();\n        if(this.snapshot){\n            this.snapshot.clear();\n        }\n        if(this.pruneModifiedRecords){\n            this.modified = [];\n        }\n        if (silent !== true) {  \n            this.fireEvent('clear', this, items);\n        }\n    },\n\n    \n    onClear: function(store, records){\n        Ext.each(records, function(rec, index){\n            this.destroyRecord(this, rec, index);\n        }, this);\n    },\n\n    \n    insert : function(index, records) {\n        var i, len, record;\n\n        records = [].concat(records);\n        for (i = 0, len = records.length; i < len; i++) {\n            record = records[i];\n\n            this.data.insert(index + i, record);\n            record.join(this);\n\n            if (record.dirty || record.phantom) {\n                this.modified.push(record);\n            }\n        }\n\n        if (this.snapshot) {\n            this.snapshot.addAll(records);\n        }\n\n        this.fireEvent('add', this, records, index);\n    },\n\n    \n    indexOf : function(record){\n        return this.data.indexOf(record);\n    },\n\n    \n    indexOfId : function(id){\n        return this.data.indexOfKey(id);\n    },\n\n    \n    getById : function(id){\n        return (this.snapshot || this.data).key(id);\n    },\n\n    \n    getAt : function(index){\n        return this.data.itemAt(index);\n    },\n\n    \n    getRange : function(start, end){\n        return this.data.getRange(start, end);\n    },\n\n    \n    storeOptions : function(o){\n        o = Ext.apply({}, o);\n        delete o.callback;\n        delete o.scope;\n        this.lastOptions = o;\n    },\n\n    \n    clearData: function(){\n        this.data.each(function(rec) {\n            rec.join(null);\n        });\n        this.data.clear();\n    },\n\n    \n    load : function(options) {\n        options = Ext.apply({}, options);\n        this.storeOptions(options);\n        if(this.sortInfo && this.remoteSort){\n            var pn = this.paramNames;\n            options.params = Ext.apply({}, options.params);\n            options.params[pn.sort] = this.sortInfo.field;\n            options.params[pn.dir] = this.sortInfo.direction;\n        }\n        try {\n            return this.execute('read', null, options); \n        } catch(e) {\n            this.handleException(e);\n            return false;\n        }\n    },\n\n    \n    updateRecord : function(store, record, action) {\n        if (action == Ext.data.Record.EDIT && this.autoSave === true && (!record.phantom || (record.phantom && record.isValid()))) {\n            this.save();\n        }\n    },\n\n    \n    createRecords : function(store, records, index) {\n        var modified = this.modified,\n            length   = records.length,\n            record, i;\n\n        for (i = 0; i < length; i++) {\n            record = records[i];\n\n            if (record.phantom && record.isValid()) {\n                record.markDirty();  \n\n                if (modified.indexOf(record) == -1) {\n                    modified.push(record);\n                }\n            }\n        }\n        if (this.autoSave === true) {\n            this.save();\n        }\n    },\n\n    \n    destroyRecord : function(store, record, index) {\n        if (this.modified.indexOf(record) != -1) {  \n            this.modified.remove(record);\n        }\n        if (!record.phantom) {\n            this.removed.push(record);\n\n            \n            \n            \n            record.lastIndex = index;\n\n            if (this.autoSave === true) {\n                this.save();\n            }\n        }\n    },\n\n    \n    execute : function(action, rs, options,  batch) {\n        \n        if (!Ext.data.Api.isAction(action)) {\n            throw new Ext.data.Api.Error('execute', action);\n        }\n        \n        options = Ext.applyIf(options||{}, {\n            params: {}\n        });\n        if(batch !== undefined){\n            this.addToBatch(batch);\n        }\n        \n        \n        var doRequest = true;\n\n        if (action === 'read') {\n            doRequest = this.fireEvent('beforeload', this, options);\n            Ext.applyIf(options.params, this.baseParams);\n        }\n        else {\n            \n            \n            if (this.writer.listful === true && this.restful !== true) {\n                rs = (Ext.isArray(rs)) ? rs : [rs];\n            }\n            \n            else if (Ext.isArray(rs) && rs.length == 1) {\n                rs = rs.shift();\n            }\n            \n            if ((doRequest = this.fireEvent('beforewrite', this, action, rs, options)) !== false) {\n                this.writer.apply(options.params, this.baseParams, action, rs);\n            }\n        }\n        if (doRequest !== false) {\n            \n            if (this.writer && this.proxy.url && !this.proxy.restful && !Ext.data.Api.hasUniqueUrl(this.proxy, action)) {\n                options.params.xaction = action;    \n            }\n            \n            \n            \n            \n            \n            this.proxy.request(Ext.data.Api.actions[action], rs, options.params, this.reader, this.createCallback(action, rs, batch), this, options);\n        }\n        return doRequest;\n    },\n\n    \n    save : function() {\n        if (!this.writer) {\n            throw new Ext.data.Store.Error('writer-undefined');\n        }\n\n        var queue = [],\n            len,\n            trans,\n            batch,\n            data = {},\n            i;\n        \n        if(this.removed.length){\n            queue.push(['destroy', this.removed]);\n        }\n\n        \n        var rs = [].concat(this.getModifiedRecords());\n        if(rs.length){\n            \n            var phantoms = [];\n            for(i = rs.length-1; i >= 0; i--){\n                if(rs[i].phantom === true){\n                    var rec = rs.splice(i, 1).shift();\n                    if(rec.isValid()){\n                        phantoms.push(rec);\n                    }\n                }else if(!rs[i].isValid()){ \n                    rs.splice(i,1);\n                }\n            }\n            \n            if(phantoms.length){\n                queue.push(['create', phantoms]);\n            }\n\n            \n            if(rs.length){\n                queue.push(['update', rs]);\n            }\n        }\n        len = queue.length;\n        if(len){\n            batch = ++this.batchCounter;\n            for(i = 0; i < len; ++i){\n                trans = queue[i];\n                data[trans[0]] = trans[1];\n            }\n            if(this.fireEvent('beforesave', this, data) !== false){\n                for(i = 0; i < len; ++i){\n                    trans = queue[i];\n                    this.doTransaction(trans[0], trans[1], batch);\n                }\n                return batch;\n            }\n        }\n        return -1;\n    },\n\n    \n    doTransaction : function(action, rs, batch) {\n        function transaction(records) {\n            try{\n                this.execute(action, records, undefined, batch);\n            }catch (e){\n                this.handleException(e);\n            }\n        }\n        if(this.batch === false){\n            for(var i = 0, len = rs.length; i < len; i++){\n                transaction.call(this, rs[i]);\n            }\n        }else{\n            transaction.call(this, rs);\n        }\n    },\n\n    \n    addToBatch : function(batch){\n        var b = this.batches,\n            key = this.batchKey + batch,\n            o = b[key];\n\n        if(!o){\n            b[key] = o = {\n                id: batch,\n                count: 0,\n                data: {}\n            };\n        }\n        ++o.count;\n    },\n\n    removeFromBatch : function(batch, action, data){\n        var b = this.batches,\n            key = this.batchKey + batch,\n            o = b[key],\n            arr;\n\n\n        if(o){\n            arr = o.data[action] || [];\n            o.data[action] = arr.concat(data);\n            if(o.count === 1){\n                data = o.data;\n                delete b[key];\n                this.fireEvent('save', this, batch, data);\n            }else{\n                --o.count;\n            }\n        }\n    },\n\n    \n    \n    createCallback : function(action, rs, batch) {\n        var actions = Ext.data.Api.actions;\n        return (action == 'read') ? this.loadRecords : function(data, response, success) {\n            \n            this['on' + Ext.util.Format.capitalize(action) + 'Records'](success, rs, [].concat(data));\n            \n            if (success === true) {\n                this.fireEvent('write', this, action, data, response, rs);\n            }\n            this.removeFromBatch(batch, action, data);\n        };\n    },\n\n    \n    \n    \n    clearModified : function(rs) {\n        if (Ext.isArray(rs)) {\n            for (var n=rs.length-1;n>=0;n--) {\n                this.modified.splice(this.modified.indexOf(rs[n]), 1);\n            }\n        } else {\n            this.modified.splice(this.modified.indexOf(rs), 1);\n        }\n    },\n\n    \n    reMap : function(record) {\n        if (Ext.isArray(record)) {\n            for (var i = 0, len = record.length; i < len; i++) {\n                this.reMap(record[i]);\n            }\n        } else {\n            delete this.data.map[record._phid];\n            this.data.map[record.id] = record;\n            var index = this.data.keys.indexOf(record._phid);\n            this.data.keys.splice(index, 1, record.id);\n            delete record._phid;\n        }\n    },\n\n    \n    onCreateRecords : function(success, rs, data) {\n        if (success === true) {\n            try {\n                this.reader.realize(rs, data);\n            }\n            catch (e) {\n                this.handleException(e);\n                if (Ext.isArray(rs)) {\n                    \n                    this.onCreateRecords(success, rs, data);\n                }\n            }\n        }\n    },\n\n    \n    onUpdateRecords : function(success, rs, data) {\n        if (success === true) {\n            try {\n                this.reader.update(rs, data);\n            } catch (e) {\n                this.handleException(e);\n                if (Ext.isArray(rs)) {\n                    \n                    this.onUpdateRecords(success, rs, data);\n                }\n            }\n        }\n    },\n\n    \n    onDestroyRecords : function(success, rs, data) {\n        \n        rs = (rs instanceof Ext.data.Record) ? [rs] : [].concat(rs);\n        for (var i=0,len=rs.length;i<len;i++) {\n            this.removed.splice(this.removed.indexOf(rs[i]), 1);\n        }\n        if (success === false) {\n            \n            \n            for (i=rs.length-1;i>=0;i--) {\n                this.insert(rs[i].lastIndex, rs[i]);    \n            }\n        }\n    },\n\n    \n    handleException : function(e) {\n        \n        Ext.handleError(e);\n    },\n\n    \n    reload : function(options){\n        this.load(Ext.applyIf(options||{}, this.lastOptions));\n    },\n\n    \n    \n    loadRecords : function(o, options, success){\n        var i, len;\n\n        if (this.isDestroyed === true) {\n            return;\n        }\n        if(!o || success === false){\n            if(success !== false){\n                this.fireEvent('load', this, [], options);\n            }\n            if(options.callback){\n                options.callback.call(options.scope || this, [], options, false, o);\n            }\n            return;\n        }\n        var r = o.records, t = o.totalRecords || r.length;\n        if(!options || options.add !== true){\n            if(this.pruneModifiedRecords){\n                this.modified = [];\n            }\n            for(i = 0, len = r.length; i < len; i++){\n                r[i].join(this);\n            }\n            if(this.snapshot){\n                this.data = this.snapshot;\n                delete this.snapshot;\n            }\n            this.clearData();\n            this.data.addAll(r);\n            this.totalLength = t;\n            this.applySort();\n            this.fireEvent('datachanged', this);\n        }else{\n            var toAdd = [],\n                rec,\n                cnt = 0;\n            for(i = 0, len = r.length; i < len; ++i){\n                rec = r[i];\n                if(this.indexOfId(rec.id) > -1){\n                    this.doUpdate(rec);\n                }else{\n                    toAdd.push(rec);\n                    ++cnt;\n                }\n            }\n            this.totalLength = Math.max(t, this.data.length + cnt);\n            this.add(toAdd);\n        }\n        this.fireEvent('load', this, r, options);\n        if(options.callback){\n            options.callback.call(options.scope || this, r, options, true);\n        }\n    },\n\n    \n    loadData : function(o, append){\n        var r = this.reader.readRecords(o);\n        this.loadRecords(r, {add: append}, true);\n    },\n\n    \n    getCount : function(){\n        return this.data.length || 0;\n    },\n\n    \n    getTotalCount : function(){\n        return this.totalLength || 0;\n    },\n\n    \n    getSortState : function(){\n        return this.sortInfo;\n    },\n\n    \n    applySort : function(){\n        if ((this.sortInfo || this.multiSortInfo) && !this.remoteSort) {\n            this.sortData();\n        }\n    },\n\n    \n    sortData : function() {\n        var sortInfo  = this.hasMultiSort ? this.multiSortInfo : this.sortInfo,\n            direction = sortInfo.direction || \"ASC\",\n            sorters   = sortInfo.sorters,\n            sortFns   = [];\n\n        \n        if (!this.hasMultiSort) {\n            sorters = [{direction: direction, field: sortInfo.field}];\n        }\n\n        \n        for (var i=0, j = sorters.length; i < j; i++) {\n            sortFns.push(this.createSortFunction(sorters[i].field, sorters[i].direction));\n        }\n\n        if (sortFns.length == 0) {\n            return;\n        }\n\n        \n        \n        var directionModifier = direction.toUpperCase() == \"DESC\" ? -1 : 1;\n\n        \n        var fn = function(r1, r2) {\n          var result = sortFns[0].call(this, r1, r2);\n\n          \n          if (sortFns.length > 1) {\n              for (var i=1, j = sortFns.length; i < j; i++) {\n                  result = result || sortFns[i].call(this, r1, r2);\n              }\n          }\n\n          return directionModifier * result;\n        };\n\n        \n        this.data.sort(direction, fn);\n        if (this.snapshot && this.snapshot != this.data) {\n            this.snapshot.sort(direction, fn);\n        }\n    },\n\n    \n    createSortFunction: function(field, direction) {\n        direction = direction || \"ASC\";\n        var directionModifier = direction.toUpperCase() == \"DESC\" ? -1 : 1;\n\n        var sortType = this.fields.get(field).sortType;\n\n        \n        \n        return function(r1, r2) {\n            var v1 = sortType(r1.data[field]),\n                v2 = sortType(r2.data[field]);\n\n            return directionModifier * (v1 > v2 ? 1 : (v1 < v2 ? -1 : 0));\n        };\n    },\n\n    \n    setDefaultSort : function(field, dir) {\n        dir = dir ? dir.toUpperCase() : 'ASC';\n        this.sortInfo = {field: field, direction: dir};\n        this.sortToggle[field] = dir;\n    },\n\n    \n    sort : function(fieldName, dir) {\n        if (Ext.isArray(arguments[0])) {\n            return this.multiSort.call(this, fieldName, dir);\n        } else {\n            return this.singleSort(fieldName, dir);\n        }\n    },\n\n    \n    singleSort: function(fieldName, dir) {\n        var field = this.fields.get(fieldName);\n        if (!field) {\n            return false;\n        }\n\n        var name       = field.name,\n            sortInfo   = this.sortInfo || null,\n            sortToggle = this.sortToggle ? this.sortToggle[name] : null;\n\n        if (!dir) {\n            if (sortInfo && sortInfo.field == name) { \n                dir = (this.sortToggle[name] || 'ASC').toggle('ASC', 'DESC');\n            } else {\n                dir = field.sortDir;\n            }\n        }\n\n        this.sortToggle[name] = dir;\n        this.sortInfo = {field: name, direction: dir};\n        this.hasMultiSort = false;\n\n        if (this.remoteSort) {\n            if (!this.load(this.lastOptions)) {\n                if (sortToggle) {\n                    this.sortToggle[name] = sortToggle;\n                }\n                if (sortInfo) {\n                    this.sortInfo = sortInfo;\n                }\n            }\n        } else {\n            this.applySort();\n            this.fireEvent('datachanged', this);\n        }\n        return true;\n    },\n\n    \n    multiSort: function(sorters, direction) {\n        this.hasMultiSort = true;\n        direction = direction || \"ASC\";\n\n        \n        if (this.multiSortInfo && direction == this.multiSortInfo.direction) {\n            direction = direction.toggle(\"ASC\", \"DESC\");\n        }\n\n        \n        this.multiSortInfo = {\n            sorters  : sorters,\n            direction: direction\n        };\n\n        if (this.remoteSort) {\n            this.singleSort(sorters[0].field, sorters[0].direction);\n\n        } else {\n            this.applySort();\n            this.fireEvent('datachanged', this);\n        }\n    },\n\n    \n    each : function(fn, scope){\n        this.data.each(fn, scope);\n    },\n\n    \n    getModifiedRecords : function(){\n        return this.modified;\n    },\n\n    \n    sum : function(property, start, end){\n        var rs = this.data.items, v = 0;\n        start = start || 0;\n        end = (end || end === 0) ? end : rs.length-1;\n\n        for(var i = start; i <= end; i++){\n            v += (rs[i].data[property] || 0);\n        }\n        return v;\n    },\n\n    \n    createFilterFn : function(property, value, anyMatch, caseSensitive, exactMatch){\n        if(Ext.isEmpty(value, false)){\n            return false;\n        }\n        value = this.data.createValueMatcher(value, anyMatch, caseSensitive, exactMatch);\n        return function(r) {\n            return value.test(r.data[property]);\n        };\n    },\n\n    \n    createMultipleFilterFn: function(filters) {\n        return function(record) {\n            var isMatch = true;\n\n            for (var i=0, j = filters.length; i < j; i++) {\n                var filter = filters[i],\n                    fn     = filter.fn,\n                    scope  = filter.scope;\n\n                isMatch = isMatch && fn.call(scope, record);\n            }\n\n            return isMatch;\n        };\n    },\n\n    \n    filter : function(property, value, anyMatch, caseSensitive, exactMatch){\n        var fn;\n        \n        if (Ext.isObject(property)) {\n            property = [property];\n        }\n\n        if (Ext.isArray(property)) {\n            var filters = [];\n\n            \n            for (var i=0, j = property.length; i < j; i++) {\n                var filter = property[i],\n                    func   = filter.fn,\n                    scope  = filter.scope || this;\n\n                \n                if (!Ext.isFunction(func)) {\n                    func = this.createFilterFn(filter.property, filter.value, filter.anyMatch, filter.caseSensitive, filter.exactMatch);\n                }\n\n                filters.push({fn: func, scope: scope});\n            }\n\n            fn = this.createMultipleFilterFn(filters);\n        } else {\n            \n            fn = this.createFilterFn(property, value, anyMatch, caseSensitive, exactMatch);\n        }\n\n        return fn ? this.filterBy(fn) : this.clearFilter();\n    },\n\n    \n    filterBy : function(fn, scope){\n        this.snapshot = this.snapshot || this.data;\n        this.data = this.queryBy(fn, scope || this);\n        this.fireEvent('datachanged', this);\n    },\n\n    \n    clearFilter : function(suppressEvent){\n        if(this.isFiltered()){\n            this.data = this.snapshot;\n            delete this.snapshot;\n            if(suppressEvent !== true){\n                this.fireEvent('datachanged', this);\n            }\n        }\n    },\n\n    \n    isFiltered : function(){\n        return !!this.snapshot && this.snapshot != this.data;\n    },\n\n    \n    query : function(property, value, anyMatch, caseSensitive){\n        var fn = this.createFilterFn(property, value, anyMatch, caseSensitive);\n        return fn ? this.queryBy(fn) : this.data.clone();\n    },\n\n    \n    queryBy : function(fn, scope){\n        var data = this.snapshot || this.data;\n        return data.filterBy(fn, scope||this);\n    },\n\n    \n    find : function(property, value, start, anyMatch, caseSensitive){\n        var fn = this.createFilterFn(property, value, anyMatch, caseSensitive);\n        return fn ? this.data.findIndexBy(fn, null, start) : -1;\n    },\n\n    \n    findExact: function(property, value, start){\n        return this.data.findIndexBy(function(rec){\n            return rec.get(property) === value;\n        }, this, start);\n    },\n\n    \n    findBy : function(fn, scope, start){\n        return this.data.findIndexBy(fn, scope, start);\n    },\n\n    \n    collect : function(dataIndex, allowNull, bypassFilter){\n        var d = (bypassFilter === true && this.snapshot) ?\n                this.snapshot.items : this.data.items;\n        var v, sv, r = [], l = {};\n        for(var i = 0, len = d.length; i < len; i++){\n            v = d[i].data[dataIndex];\n            sv = String(v);\n            if((allowNull || !Ext.isEmpty(v)) && !l[sv]){\n                l[sv] = true;\n                r[r.length] = v;\n            }\n        }\n        return r;\n    },\n\n    \n    afterEdit : function(record){\n        if(this.modified.indexOf(record) == -1){\n            this.modified.push(record);\n        }\n        this.fireEvent('update', this, record, Ext.data.Record.EDIT);\n    },\n\n    \n    afterReject : function(record){\n        this.modified.remove(record);\n        this.fireEvent('update', this, record, Ext.data.Record.REJECT);\n    },\n\n    \n    afterCommit : function(record){\n        this.modified.remove(record);\n        this.fireEvent('update', this, record, Ext.data.Record.COMMIT);\n    },\n\n    \n    commitChanges : function(){\n        var modified = this.modified.slice(0),\n            length   = modified.length,\n            i;\n\n        for (i = 0; i < length; i++){\n            modified[i].commit();\n        }\n\n        this.modified = [];\n        this.removed  = [];\n    },\n\n    \n    rejectChanges : function() {\n        var modified = this.modified.slice(0),\n            removed  = this.removed.slice(0).reverse(),\n            mLength  = modified.length,\n            rLength  = removed.length,\n            i;\n\n        for (i = 0; i < mLength; i++) {\n            modified[i].reject();\n        }\n\n        for (i = 0; i < rLength; i++) {\n            this.insert(removed[i].lastIndex || 0, removed[i]);\n            removed[i].reject();\n        }\n\n        this.modified = [];\n        this.removed  = [];\n    },\n\n    \n    onMetaChange : function(meta){\n        this.recordType = this.reader.recordType;\n        this.fields = this.recordType.prototype.fields;\n        delete this.snapshot;\n        if(this.reader.meta.sortInfo){\n            this.sortInfo = this.reader.meta.sortInfo;\n        }else if(this.sortInfo  && !this.fields.get(this.sortInfo.field)){\n            delete this.sortInfo;\n        }\n        if(this.writer){\n            this.writer.meta = this.reader.meta;\n        }\n        this.modified = [];\n        this.fireEvent('metachange', this, this.reader.meta);\n    },\n\n    \n    findInsertIndex : function(record){\n        this.suspendEvents();\n        var data = this.data.clone();\n        this.data.add(record);\n        this.applySort();\n        var index = this.data.indexOf(record);\n        this.data = data;\n        this.resumeEvents();\n        return index;\n    },\n\n    \n    setBaseParam : function (name, value){\n        this.baseParams = this.baseParams || {};\n        this.baseParams[name] = value;\n    }\n});\n\nExt.reg('store', Ext.data.Store);\n\n\nExt.data.Store.Error = Ext.extend(Ext.Error, {\n    name: 'Ext.data.Store'\n});\nExt.apply(Ext.data.Store.Error.prototype, {\n    lang: {\n        'writer-undefined' : 'Attempted to execute a write-action without a DataWriter installed.'\n    }\n});\n\nExt.data.Field = Ext.extend(Object, {\n    \n    constructor : function(config){\n        if(Ext.isString(config)){\n            config = {name: config};\n        }\n        Ext.apply(this, config);\n        \n        var types = Ext.data.Types,\n            st = this.sortType,\n            t;\n\n        if(this.type){\n            if(Ext.isString(this.type)){\n                this.type = Ext.data.Types[this.type.toUpperCase()] || types.AUTO;\n            }\n        }else{\n            this.type = types.AUTO;\n        }\n\n        \n        if(Ext.isString(st)){\n            this.sortType = Ext.data.SortTypes[st];\n        }else if(Ext.isEmpty(st)){\n            this.sortType = this.type.sortType;\n        }\n\n        if(!this.convert){\n            this.convert = this.type.convert;\n        }\n    },\n    \n    \n    \n    \n    \n    dateFormat: null,\n    \n    \n    useNull: false,\n    \n    \n    defaultValue: \"\",\n    \n    mapping: null,\n    \n    sortType : null,\n    \n    sortDir : \"ASC\",\n    \n    allowBlank : true\n});\n\nExt.data.DataReader = function(meta, recordType){\n    \n    this.meta = meta;\n    \n    this.recordType = Ext.isArray(recordType) ?\n        Ext.data.Record.create(recordType) : recordType;\n\n    \n    if (this.recordType){\n        this.buildExtractors();\n    }\n};\n\nExt.data.DataReader.prototype = {\n    \n    \n    getTotal: Ext.emptyFn,\n    \n    getRoot: Ext.emptyFn,\n    \n    getMessage: Ext.emptyFn,\n    \n    getSuccess: Ext.emptyFn,\n    \n    getId: Ext.emptyFn,\n    \n    buildExtractors : Ext.emptyFn,\n    \n    extractValues : Ext.emptyFn,\n\n    \n    realize: function(rs, data){\n        if (Ext.isArray(rs)) {\n            for (var i = rs.length - 1; i >= 0; i--) {\n                \n                if (Ext.isArray(data)) {\n                    this.realize(rs.splice(i,1).shift(), data.splice(i,1).shift());\n                }\n                else {\n                    \n                    \n                    this.realize(rs.splice(i,1).shift(), data);\n                }\n            }\n        }\n        else {\n            \n            if (Ext.isArray(data) && data.length == 1) {\n                data = data.shift();\n            }\n            if (!this.isData(data)) {\n                \n                \n                throw new Ext.data.DataReader.Error('realize', rs);\n            }\n            rs.phantom = false; \n            rs._phid = rs.id;  \n            rs.id = this.getId(data);\n            rs.data = data;\n\n            rs.commit();\n            rs.store.reMap(rs);\n        }\n    },\n\n    \n    update : function(rs, data) {\n        if (Ext.isArray(rs)) {\n            for (var i=rs.length-1; i >= 0; i--) {\n                if (Ext.isArray(data)) {\n                    this.update(rs.splice(i,1).shift(), data.splice(i,1).shift());\n                }\n                else {\n                    \n                    \n                    this.update(rs.splice(i,1).shift(), data);\n                }\n            }\n        }\n        else {\n            \n            if (Ext.isArray(data) && data.length == 1) {\n                data = data.shift();\n            }\n            if (this.isData(data)) {\n                rs.data = Ext.apply(rs.data, data);\n            }\n            rs.commit();\n        }\n    },\n\n    \n    extractData : function(root, returnRecords) {\n        \n        var rawName = (this instanceof Ext.data.JsonReader) ? 'json' : 'node';\n\n        var rs = [];\n\n        \n        \n        if (this.isData(root) && !(this instanceof Ext.data.XmlReader)) {\n            root = [root];\n        }\n        var f       = this.recordType.prototype.fields,\n            fi      = f.items,\n            fl      = f.length,\n            rs      = [];\n        if (returnRecords === true) {\n            var Record = this.recordType;\n            for (var i = 0; i < root.length; i++) {\n                var n = root[i];\n                var record = new Record(this.extractValues(n, fi, fl), this.getId(n));\n                record[rawName] = n;    \n                rs.push(record);\n            }\n        }\n        else {\n            for (var i = 0; i < root.length; i++) {\n                var data = this.extractValues(root[i], fi, fl);\n                data[this.meta.idProperty] = this.getId(root[i]);\n                rs.push(data);\n            }\n        }\n        return rs;\n    },\n\n    \n    isData : function(data) {\n        return (data && Ext.isObject(data) && !Ext.isEmpty(this.getId(data))) ? true : false;\n    },\n\n    \n    onMetaChange : function(meta){\n        delete this.ef;\n        this.meta = meta;\n        this.recordType = Ext.data.Record.create(meta.fields);\n        this.buildExtractors();\n    }\n};\n\n\nExt.data.DataReader.Error = Ext.extend(Ext.Error, {\n    constructor : function(message, arg) {\n        this.arg = arg;\n        Ext.Error.call(this, message);\n    },\n    name: 'Ext.data.DataReader'\n});\nExt.apply(Ext.data.DataReader.Error.prototype, {\n    lang : {\n        'update': \"#update received invalid data from server.  Please see docs for DataReader#update and review your DataReader configuration.\",\n        'realize': \"#realize was called with invalid remote-data.  Please see the docs for DataReader#realize and review your DataReader configuration.\",\n        'invalid-response': \"#readResponse received an invalid response from the server.\"\n    }\n});\n\nExt.data.DataWriter = function(config){\n    Ext.apply(this, config);\n};\nExt.data.DataWriter.prototype = {\n\n    \n    writeAllFields : false,\n    \n    listful : false,    \n\n    \n    apply : function(params, baseParams, action, rs) {\n        var data    = [],\n        renderer    = action + 'Record';\n        \n        if (Ext.isArray(rs)) {\n            Ext.each(rs, function(rec){\n                data.push(this[renderer](rec));\n            }, this);\n        }\n        else if (rs instanceof Ext.data.Record) {\n            data = this[renderer](rs);\n        }\n        this.render(params, baseParams, data);\n    },\n\n    \n    render : Ext.emptyFn,\n\n    \n    updateRecord : Ext.emptyFn,\n\n    \n    createRecord : Ext.emptyFn,\n\n    \n    destroyRecord : Ext.emptyFn,\n\n    \n    toHash : function(rec, config) {\n        var map = rec.fields.map,\n            data = {},\n            raw = (this.writeAllFields === false && rec.phantom === false) ? rec.getChanges() : rec.data,\n            m;\n        Ext.iterate(raw, function(prop, value){\n            if((m = map[prop])){\n                data[m.mapping ? m.mapping : m.name] = value;\n            }\n        });\n        \n        \n        \n        if (rec.phantom) {\n            if (rec.fields.containsKey(this.meta.idProperty) && Ext.isEmpty(rec.data[this.meta.idProperty])) {\n                delete data[this.meta.idProperty];\n            }\n        } else {\n            data[this.meta.idProperty] = rec.id;\n        }\n        return data;\n    },\n\n    \n    toArray : function(data) {\n        var fields = [];\n        Ext.iterate(data, function(k, v) {fields.push({name: k, value: v});},this);\n        return fields;\n    }\n};\nExt.data.DataProxy = function(conn){\n    \n    \n    conn = conn || {};\n\n    \n    \n    \n\n    this.api     = conn.api;\n    this.url     = conn.url;\n    this.restful = conn.restful;\n    this.listeners = conn.listeners;\n\n    \n    this.prettyUrls = conn.prettyUrls;\n\n    \n\n    this.addEvents(\n        \n        'exception',\n        \n        'beforeload',\n        \n        'load',\n        \n        'loadexception',\n        \n        'beforewrite',\n        \n        'write'\n    );\n    Ext.data.DataProxy.superclass.constructor.call(this);\n\n    \n    try {\n        Ext.data.Api.prepare(this);\n    } catch (e) {\n        if (e instanceof Ext.data.Api.Error) {\n            e.toConsole();\n        }\n    }\n    \n    Ext.data.DataProxy.relayEvents(this, ['beforewrite', 'write', 'exception']);\n};\n\nExt.extend(Ext.data.DataProxy, Ext.util.Observable, {\n    \n    restful: false,\n\n    \n    setApi : function() {\n        if (arguments.length == 1) {\n            var valid = Ext.data.Api.isValid(arguments[0]);\n            if (valid === true) {\n                this.api = arguments[0];\n            }\n            else {\n                throw new Ext.data.Api.Error('invalid', valid);\n            }\n        }\n        else if (arguments.length == 2) {\n            if (!Ext.data.Api.isAction(arguments[0])) {\n                throw new Ext.data.Api.Error('invalid', arguments[0]);\n            }\n            this.api[arguments[0]] = arguments[1];\n        }\n        Ext.data.Api.prepare(this);\n    },\n\n    \n    isApiAction : function(action) {\n        return (this.api[action]) ? true : false;\n    },\n\n    \n    request : function(action, rs, params, reader, callback, scope, options) {\n        if (!this.api[action] && !this.load) {\n            throw new Ext.data.DataProxy.Error('action-undefined', action);\n        }\n        params = params || {};\n        if ((action === Ext.data.Api.actions.read) ? this.fireEvent(\"beforeload\", this, params) : this.fireEvent(\"beforewrite\", this, action, rs, params) !== false) {\n            this.doRequest.apply(this, arguments);\n        }\n        else {\n            callback.call(scope || this, null, options, false);\n        }\n    },\n\n\n    \n    load : null,\n\n    \n    doRequest : function(action, rs, params, reader, callback, scope, options) {\n        \n        \n        \n        this.load(params, reader, callback, scope, options);\n    },\n\n    \n    onRead : Ext.emptyFn,\n    \n    onWrite : Ext.emptyFn,\n    \n    buildUrl : function(action, record) {\n        record = record || null;\n\n        \n        \n        \n        var url = (this.conn && this.conn.url) ? this.conn.url : (this.api[action]) ? this.api[action].url : this.url;\n        if (!url) {\n            throw new Ext.data.Api.Error('invalid-url', action);\n        }\n\n        \n        \n        \n        \n        \n        \n        var provides = null;\n        var m = url.match(/(.*)(\\.json|\\.xml|\\.html)$/);\n        if (m) {\n            provides = m[2];    \n            url      = m[1];    \n        }\n        \n        if ((this.restful === true || this.prettyUrls === true) && record instanceof Ext.data.Record && !record.phantom) {\n            url += '/' + record.id;\n        }\n        return (provides === null) ? url : url + provides;\n    },\n\n    \n    destroy: function(){\n        this.purgeListeners();\n    }\n});\n\n\n\nExt.apply(Ext.data.DataProxy, Ext.util.Observable.prototype);\nExt.util.Observable.call(Ext.data.DataProxy);\n\n\nExt.data.DataProxy.Error = Ext.extend(Ext.Error, {\n    constructor : function(message, arg) {\n        this.arg = arg;\n        Ext.Error.call(this, message);\n    },\n    name: 'Ext.data.DataProxy'\n});\nExt.apply(Ext.data.DataProxy.Error.prototype, {\n    lang: {\n        'action-undefined': \"DataProxy attempted to execute an API-action but found an undefined url / function.  Please review your Proxy url/api-configuration.\",\n        'api-invalid': 'Recieved an invalid API-configuration.  Please ensure your proxy API-configuration contains only the actions from Ext.data.Api.actions.'\n    }\n});\n\n\n\nExt.data.Request = function(params) {\n    Ext.apply(this, params);\n};\nExt.data.Request.prototype = {\n    \n    action : undefined,\n    \n    rs : undefined,\n    \n    params: undefined,\n    \n    callback : Ext.emptyFn,\n    \n    scope : undefined,\n    \n    reader : undefined\n};\n\nExt.data.Response = function(params) {\n    Ext.apply(this, params);\n};\nExt.data.Response.prototype = {\n    \n    action: undefined,\n    \n    success : undefined,\n    \n    message : undefined,\n    \n    data: undefined,\n    \n    raw: undefined,\n    \n    records: undefined\n};\n\nExt.data.ScriptTagProxy = function(config){\n    Ext.apply(this, config);\n\n    Ext.data.ScriptTagProxy.superclass.constructor.call(this, config);\n\n    this.head = document.getElementsByTagName(\"head\")[0];\n\n    \n};\n\nExt.data.ScriptTagProxy.TRANS_ID = 1000;\n\nExt.extend(Ext.data.ScriptTagProxy, Ext.data.DataProxy, {\n    \n    \n    timeout : 30000,\n    \n    callbackParam : \"callback\",\n    \n    nocache : true,\n\n    \n    doRequest : function(action, rs, params, reader, callback, scope, arg) {\n        var p = Ext.urlEncode(Ext.apply(params, this.extraParams));\n\n        var url = this.buildUrl(action, rs);\n        if (!url) {\n            throw new Ext.data.Api.Error('invalid-url', url);\n        }\n        url = Ext.urlAppend(url, p);\n\n        if(this.nocache){\n            url = Ext.urlAppend(url, '_dc=' + (new Date().getTime()));\n        }\n        var transId = ++Ext.data.ScriptTagProxy.TRANS_ID;\n        var trans = {\n            id : transId,\n            action: action,\n            cb : \"stcCallback\"+transId,\n            scriptId : \"stcScript\"+transId,\n            params : params,\n            arg : arg,\n            url : url,\n            callback : callback,\n            scope : scope,\n            reader : reader\n        };\n        window[trans.cb] = this.createCallback(action, rs, trans);\n        url += String.format(\"&{0}={1}\", this.callbackParam, trans.cb);\n        if(this.autoAbort !== false){\n            this.abort();\n        }\n\n        trans.timeoutId = this.handleFailure.defer(this.timeout, this, [trans]);\n\n        var script = document.createElement(\"script\");\n        script.setAttribute(\"src\", url);\n        script.setAttribute(\"type\", \"text/javascript\");\n        script.setAttribute(\"id\", trans.scriptId);\n        this.head.appendChild(script);\n\n        this.trans = trans;\n    },\n\n    \n    createCallback : function(action, rs, trans) {\n        var self = this;\n        return function(res) {\n            self.trans = false;\n            self.destroyTrans(trans, true);\n            if (action === Ext.data.Api.actions.read) {\n                self.onRead.call(self, action, trans, res);\n            } else {\n                self.onWrite.call(self, action, trans, res, rs);\n            }\n        };\n    },\n    \n    onRead : function(action, trans, res) {\n        var result;\n        try {\n            result = trans.reader.readRecords(res);\n        }catch(e){\n            \n            this.fireEvent(\"loadexception\", this, trans, res, e);\n\n            this.fireEvent('exception', this, 'response', action, trans, res, e);\n            trans.callback.call(trans.scope||window, null, trans.arg, false);\n            return;\n        }\n        if (result.success === false) {\n            \n            this.fireEvent('loadexception', this, trans, res);\n\n            this.fireEvent('exception', this, 'remote', action, trans, res, null);\n        } else {\n            this.fireEvent(\"load\", this, res, trans.arg);\n        }\n        trans.callback.call(trans.scope||window, result, trans.arg, result.success);\n    },\n    \n    onWrite : function(action, trans, response, rs) {\n        var reader = trans.reader;\n        try {\n            \n            var res = reader.readResponse(action, response);\n        } catch (e) {\n            this.fireEvent('exception', this, 'response', action, trans, res, e);\n            trans.callback.call(trans.scope||window, null, res, false);\n            return;\n        }\n        if(!res.success === true){\n            this.fireEvent('exception', this, 'remote', action, trans, res, rs);\n            trans.callback.call(trans.scope||window, null, res, false);\n            return;\n        }\n        this.fireEvent(\"write\", this, action, res.data, res, rs, trans.arg );\n        trans.callback.call(trans.scope||window, res.data, res, true);\n    },\n\n    \n    isLoading : function(){\n        return this.trans ? true : false;\n    },\n\n    \n    abort : function(){\n        if(this.isLoading()){\n            this.destroyTrans(this.trans);\n        }\n    },\n\n    \n    destroyTrans : function(trans, isLoaded){\n        this.head.removeChild(document.getElementById(trans.scriptId));\n        clearTimeout(trans.timeoutId);\n        if(isLoaded){\n            window[trans.cb] = undefined;\n            try{\n                delete window[trans.cb];\n            }catch(e){}\n        }else{\n            \n            window[trans.cb] = function(){\n                window[trans.cb] = undefined;\n                try{\n                    delete window[trans.cb];\n                }catch(e){}\n            };\n        }\n    },\n\n    \n    handleFailure : function(trans){\n        this.trans = false;\n        this.destroyTrans(trans, false);\n        if (trans.action === Ext.data.Api.actions.read) {\n            \n            this.fireEvent(\"loadexception\", this, null, trans.arg);\n        }\n\n        this.fireEvent('exception', this, 'response', trans.action, {\n            response: null,\n            options: trans.arg\n        });\n        trans.callback.call(trans.scope||window, null, trans.arg, false);\n    },\n\n    \n    destroy: function(){\n        this.abort();\n        Ext.data.ScriptTagProxy.superclass.destroy.call(this);\n    }\n});\nExt.data.HttpProxy = function(conn){\n    Ext.data.HttpProxy.superclass.constructor.call(this, conn);\n\n    \n    this.conn = conn;\n\n    \n    \n    \n    \n    this.conn.url = null;\n\n    this.useAjax = !conn || !conn.events;\n\n    \n    var actions = Ext.data.Api.actions;\n    this.activeRequest = {};\n    for (var verb in actions) {\n        this.activeRequest[actions[verb]] = undefined;\n    }\n};\n\nExt.extend(Ext.data.HttpProxy, Ext.data.DataProxy, {\n    \n    getConnection : function() {\n        return this.useAjax ? Ext.Ajax : this.conn;\n    },\n\n    \n    setUrl : function(url, makePermanent) {\n        this.conn.url = url;\n        if (makePermanent === true) {\n            this.url = url;\n            this.api = null;\n            Ext.data.Api.prepare(this);\n        }\n    },\n\n    \n    doRequest : function(action, rs, params, reader, cb, scope, arg) {\n        var  o = {\n            method: (this.api[action]) ? this.api[action]['method'] : undefined,\n            request: {\n                callback : cb,\n                scope : scope,\n                arg : arg\n            },\n            reader: reader,\n            callback : this.createCallback(action, rs),\n            scope: this\n        };\n\n        \n        \n        if (params.jsonData) {\n            o.jsonData = params.jsonData;\n        } else if (params.xmlData) {\n            o.xmlData = params.xmlData;\n        } else {\n            o.params = params || {};\n        }\n        \n        \n        \n        this.conn.url = this.buildUrl(action, rs);\n\n        if(this.useAjax){\n\n            Ext.applyIf(o, this.conn);\n\n            \n            if (action == Ext.data.Api.actions.read && this.activeRequest[action]) {\n                Ext.Ajax.abort(this.activeRequest[action]);\n            }\n            this.activeRequest[action] = Ext.Ajax.request(o);\n        }else{\n            this.conn.request(o);\n        }\n        \n        this.conn.url = null;\n    },\n\n    \n    createCallback : function(action, rs) {\n        return function(o, success, response) {\n            this.activeRequest[action] = undefined;\n            if (!success) {\n                if (action === Ext.data.Api.actions.read) {\n                    \n                    \n                    this.fireEvent('loadexception', this, o, response);\n                }\n                this.fireEvent('exception', this, 'response', action, o, response);\n                o.request.callback.call(o.request.scope, null, o.request.arg, false);\n                return;\n            }\n            if (action === Ext.data.Api.actions.read) {\n                this.onRead(action, o, response);\n            } else {\n                this.onWrite(action, o, response, rs);\n            }\n        };\n    },\n\n    \n    onRead : function(action, o, response) {\n        var result;\n        try {\n            result = o.reader.read(response);\n        }catch(e){\n            \n            \n            this.fireEvent('loadexception', this, o, response, e);\n\n            this.fireEvent('exception', this, 'response', action, o, response, e);\n            o.request.callback.call(o.request.scope, null, o.request.arg, false);\n            return;\n        }\n        if (result.success === false) {\n            \n            \n            this.fireEvent('loadexception', this, o, response);\n\n            \n            var res = o.reader.readResponse(action, response);\n            this.fireEvent('exception', this, 'remote', action, o, res, null);\n        }\n        else {\n            this.fireEvent('load', this, o, o.request.arg);\n        }\n        \n        \n        \n        o.request.callback.call(o.request.scope, result, o.request.arg, result.success);\n    },\n    \n    onWrite : function(action, o, response, rs) {\n        var reader = o.reader;\n        var res;\n        try {\n            res = reader.readResponse(action, response);\n        } catch (e) {\n            this.fireEvent('exception', this, 'response', action, o, response, e);\n            o.request.callback.call(o.request.scope, null, o.request.arg, false);\n            return;\n        }\n        if (res.success === true) {\n            this.fireEvent('write', this, action, res.data, res, rs, o.request.arg);\n        } else {\n            this.fireEvent('exception', this, 'remote', action, o, res, rs);\n        }\n        \n        \n        \n        o.request.callback.call(o.request.scope, res.data, res, res.success);\n    },\n\n    \n    destroy: function(){\n        if(!this.useAjax){\n            this.conn.abort();\n        }else if(this.activeRequest){\n            var actions = Ext.data.Api.actions;\n            for (var verb in actions) {\n                if(this.activeRequest[actions[verb]]){\n                    Ext.Ajax.abort(this.activeRequest[actions[verb]]);\n                }\n            }\n        }\n        Ext.data.HttpProxy.superclass.destroy.call(this);\n    }\n});\nExt.data.MemoryProxy = function(data){\n    \n    var api = {};\n    api[Ext.data.Api.actions.read] = true;\n    Ext.data.MemoryProxy.superclass.constructor.call(this, {\n        api: api\n    });\n    this.data = data;\n};\n\nExt.extend(Ext.data.MemoryProxy, Ext.data.DataProxy, {\n    \n\n       \n    doRequest : function(action, rs, params, reader, callback, scope, arg) {\n        \n        params = params || {};\n        var result;\n        try {\n            result = reader.readRecords(this.data);\n        }catch(e){\n            \n            this.fireEvent(\"loadexception\", this, null, arg, e);\n\n            this.fireEvent('exception', this, 'response', action, arg, null, e);\n            callback.call(scope, null, arg, false);\n            return;\n        }\n        callback.call(scope, result, arg, true);\n    }\n});\nExt.data.Types = new function(){\n    var st = Ext.data.SortTypes;\n    Ext.apply(this, {\n        \n        stripRe: /[\\$,%]/g,\n        \n        \n        AUTO: {\n            convert: function(v){ return v; },\n            sortType: st.none,\n            type: 'auto'\n        },\n\n        \n        STRING: {\n            convert: function(v){ return (v === undefined || v === null) ? '' : String(v); },\n            sortType: st.asUCString,\n            type: 'string'\n        },\n\n        \n        INT: {\n            convert: function(v){\n                return v !== undefined && v !== null && v !== '' ?\n                    parseInt(String(v).replace(Ext.data.Types.stripRe, ''), 10) : (this.useNull ? null : 0);\n            },\n            sortType: st.none,\n            type: 'int'\n        },\n        \n        \n        FLOAT: {\n            convert: function(v){\n                return v !== undefined && v !== null && v !== '' ?\n                    parseFloat(String(v).replace(Ext.data.Types.stripRe, ''), 10) : (this.useNull ? null : 0);\n            },\n            sortType: st.none,\n            type: 'float'\n        },\n        \n        \n        BOOL: {\n            convert: function(v){ return v === true || v === 'true' || v == 1; },\n            sortType: st.none,\n            type: 'bool'\n        },\n        \n        \n        DATE: {\n            convert: function(v){\n                var df = this.dateFormat;\n                if(!v){\n                    return null;\n                }\n                if(Ext.isDate(v)){\n                    return v;\n                }\n                if(df){\n                    if(df == 'timestamp'){\n                        return new Date(v*1000);\n                    }\n                    if(df == 'time'){\n                        return new Date(parseInt(v, 10));\n                    }\n                    return Date.parseDate(v, df);\n                }\n                var parsed = Date.parse(v);\n                return parsed ? new Date(parsed) : null;\n            },\n            sortType: st.asDate,\n            type: 'date'\n        }\n    });\n    \n    Ext.apply(this, {\n        \n        BOOLEAN: this.BOOL,\n        \n        INTEGER: this.INT,\n        \n        NUMBER: this.FLOAT    \n    });\n};\nExt.data.JsonWriter = Ext.extend(Ext.data.DataWriter, {\n    \n    encode : true,\n    \n    encodeDelete: false,\n    \n    constructor : function(config){\n        Ext.data.JsonWriter.superclass.constructor.call(this, config);    \n    },\n\n    \n    render : function(params, baseParams, data) {\n        if (this.encode === true) {\n            \n            Ext.apply(params, baseParams);\n            params[this.meta.root] = Ext.encode(data);\n        } else {\n            \n            var jdata = Ext.apply({}, baseParams);\n            jdata[this.meta.root] = data;\n            params.jsonData = jdata;\n        }\n    },\n    \n    createRecord : function(rec) {\n       return this.toHash(rec);\n    },\n    \n    updateRecord : function(rec) {\n        return this.toHash(rec);\n\n    },\n    \n    destroyRecord : function(rec){\n        if(this.encodeDelete){\n            var data = {};\n            data[this.meta.idProperty] = rec.id;\n            return data;\n        }else{\n            return rec.id;\n        }\n    }\n});\nExt.data.JsonReader = function(meta, recordType){\n    meta = meta || {};\n    \n    \n    \n    \n    Ext.applyIf(meta, {\n        idProperty: 'id',\n        successProperty: 'success',\n        totalProperty: 'total'\n    });\n\n    Ext.data.JsonReader.superclass.constructor.call(this, meta, recordType || meta.fields);\n};\nExt.extend(Ext.data.JsonReader, Ext.data.DataReader, {\n    \n    \n    read : function(response){\n        var json = response.responseText;\n        var o = Ext.decode(json);\n        if(!o) {\n            throw {message: 'JsonReader.read: Json object not found'};\n        }\n        return this.readRecords(o);\n    },\n\n    \n    \n    readResponse : function(action, response) {\n        var o = (response.responseText !== undefined) ? Ext.decode(response.responseText) : response;\n        if(!o) {\n            throw new Ext.data.JsonReader.Error('response');\n        }\n\n        var root = this.getRoot(o),\n            success = this.getSuccess(o);\n        if (success && action === Ext.data.Api.actions.create) {\n            var def = Ext.isDefined(root);\n            if (def && Ext.isEmpty(root)) {\n                throw new Ext.data.JsonReader.Error('root-empty', this.meta.root);\n            }\n            else if (!def) {\n                throw new Ext.data.JsonReader.Error('root-undefined-response', this.meta.root);\n            }\n        }\n\n        \n        var res = new Ext.data.Response({\n            action: action,\n            success: success,\n            data: (root) ? this.extractData(root, false) : [],\n            message: this.getMessage(o),\n            raw: o\n        });\n\n        \n        if (Ext.isEmpty(res.success)) {\n            throw new Ext.data.JsonReader.Error('successProperty-response', this.meta.successProperty);\n        }\n        return res;\n    },\n\n    \n    readRecords : function(o){\n        \n        this.jsonData = o;\n        if(o.metaData){\n            this.onMetaChange(o.metaData);\n        }\n        var s = this.meta, Record = this.recordType,\n            f = Record.prototype.fields, fi = f.items, fl = f.length, v;\n\n        var root = this.getRoot(o), c = root.length, totalRecords = c, success = true;\n        if(s.totalProperty){\n            v = parseInt(this.getTotal(o), 10);\n            if(!isNaN(v)){\n                totalRecords = v;\n            }\n        }\n        if(s.successProperty){\n            v = this.getSuccess(o);\n            if(v === false || v === 'false'){\n                success = false;\n            }\n        }\n\n        \n        return {\n            success : success,\n            records : this.extractData(root, true), \n            totalRecords : totalRecords\n        };\n    },\n\n    \n    buildExtractors : function() {\n        if(this.ef){\n            return;\n        }\n        var s = this.meta, Record = this.recordType,\n            f = Record.prototype.fields, fi = f.items, fl = f.length;\n\n        if(s.totalProperty) {\n            this.getTotal = this.createAccessor(s.totalProperty);\n        }\n        if(s.successProperty) {\n            this.getSuccess = this.createAccessor(s.successProperty);\n        }\n        if (s.messageProperty) {\n            this.getMessage = this.createAccessor(s.messageProperty);\n        }\n        this.getRoot = s.root ? this.createAccessor(s.root) : function(p){return p;};\n        if (s.id || s.idProperty) {\n            var g = this.createAccessor(s.id || s.idProperty);\n            this.getId = function(rec) {\n                var r = g(rec);\n                return (r === undefined || r === '') ? null : r;\n            };\n        } else {\n            this.getId = function(){return null;};\n        }\n        var ef = [];\n        for(var i = 0; i < fl; i++){\n            f = fi[i];\n            var map = (f.mapping !== undefined && f.mapping !== null) ? f.mapping : f.name;\n            ef.push(this.createAccessor(map));\n        }\n        this.ef = ef;\n    },\n\n    \n    simpleAccess : function(obj, subsc) {\n        return obj[subsc];\n    },\n\n    \n    createAccessor : function(){\n        var re = /[\\[\\.]/;\n        return function(expr) {\n            if(Ext.isEmpty(expr)){\n                return Ext.emptyFn;\n            }\n            if(Ext.isFunction(expr)){\n                return expr;\n            }\n            var i = String(expr).search(re);\n            if(i >= 0){\n                return new Function('obj', 'return obj' + (i > 0 ? '.' : '') + expr);\n            }\n            return function(obj){\n                return obj[expr];\n            };\n\n        };\n    }(),\n\n    \n    extractValues : function(data, items, len) {\n        var f, values = {};\n        for(var j = 0; j < len; j++){\n            f = items[j];\n            var v = this.ef[j](data);\n            values[f.name] = f.convert((v !== undefined) ? v : f.defaultValue, data);\n        }\n        return values;\n    }\n});\n\n\nExt.data.JsonReader.Error = Ext.extend(Ext.Error, {\n    constructor : function(message, arg) {\n        this.arg = arg;\n        Ext.Error.call(this, message);\n    },\n    name : 'Ext.data.JsonReader'\n});\nExt.apply(Ext.data.JsonReader.Error.prototype, {\n    lang: {\n        'response': 'An error occurred while json-decoding your server response',\n        'successProperty-response': 'Could not locate your \"successProperty\" in your server response.  Please review your JsonReader config to ensure the config-property \"successProperty\" matches the property in your server-response.  See the JsonReader docs.',\n        'root-undefined-config': 'Your JsonReader was configured without a \"root\" property.  Please review your JsonReader config and make sure to define the root property.  See the JsonReader docs.',\n        'idProperty-undefined' : 'Your JsonReader was configured without an \"idProperty\"  Please review your JsonReader configuration and ensure the \"idProperty\" is set (e.g.: \"id\").  See the JsonReader docs.',\n        'root-empty': 'Data was expected to be returned by the server in the \"root\" property of the response.  Please review your JsonReader configuration to ensure the \"root\" property matches that returned in the server-response.  See JsonReader docs.'\n    }\n});\n\nExt.data.ArrayReader = Ext.extend(Ext.data.JsonReader, {\n    \n    \n    \n    \n    readRecords : function(o){\n        this.arrayData = o;\n        var s = this.meta,\n            sid = s ? Ext.num(s.idIndex, s.id) : null,\n            recordType = this.recordType,\n            fields = recordType.prototype.fields,\n            records = [],\n            success = true,\n            v;\n\n        var root = this.getRoot(o);\n\n        for(var i = 0, len = root.length; i < len; i++) {\n            var n = root[i],\n                values = {},\n                id = ((sid || sid === 0) && n[sid] !== undefined && n[sid] !== \"\" ? n[sid] : null);\n            for(var j = 0, jlen = fields.length; j < jlen; j++) {\n                var f = fields.items[j],\n                    k = f.mapping !== undefined && f.mapping !== null ? f.mapping : j;\n                v = n[k] !== undefined ? n[k] : f.defaultValue;\n                v = f.convert(v, n);\n                values[f.name] = v;\n            }\n            var record = new recordType(values, id);\n            record.json = n;\n            records[records.length] = record;\n        }\n\n        var totalRecords = records.length;\n\n        if(s.totalProperty) {\n            v = parseInt(this.getTotal(o), 10);\n            if(!isNaN(v)) {\n                totalRecords = v;\n            }\n        }\n        if(s.successProperty){\n            v = this.getSuccess(o);\n            if(v === false || v === 'false'){\n                success = false;\n            }\n        }\n\n        return {\n            success : success,\n            records : records,\n            totalRecords : totalRecords\n        };\n    }\n});\nExt.data.ArrayStore = Ext.extend(Ext.data.Store, {\n    \n    constructor: function(config){\n        Ext.data.ArrayStore.superclass.constructor.call(this, Ext.apply(config, {\n            reader: new Ext.data.ArrayReader(config)\n        }));\n    },\n\n    loadData : function(data, append){\n        if(this.expandData === true){\n            var r = [];\n            for(var i = 0, len = data.length; i < len; i++){\n                r[r.length] = [data[i]];\n            }\n            data = r;\n        }\n        Ext.data.ArrayStore.superclass.loadData.call(this, data, append);\n    }\n});\nExt.reg('arraystore', Ext.data.ArrayStore);\n\n\nExt.data.SimpleStore = Ext.data.ArrayStore;\nExt.reg('simplestore', Ext.data.SimpleStore);\nExt.data.JsonStore = Ext.extend(Ext.data.Store, {\n    \n    constructor: function(config){\n        Ext.data.JsonStore.superclass.constructor.call(this, Ext.apply(config, {\n            reader: new Ext.data.JsonReader(config)\n        }));\n    }\n});\nExt.reg('jsonstore', Ext.data.JsonStore);\nExt.data.XmlWriter = function(params) {\n    Ext.data.XmlWriter.superclass.constructor.apply(this, arguments);\n    \n    this.tpl = (typeof(this.tpl) === 'string') ? new Ext.XTemplate(this.tpl).compile() : this.tpl.compile();\n};\nExt.extend(Ext.data.XmlWriter, Ext.data.DataWriter, {\n    \n    documentRoot: 'xrequest',\n    \n    forceDocumentRoot: false,\n    \n    root: 'records',\n    \n    xmlVersion : '1.0',\n    \n    xmlEncoding: 'ISO-8859-15',\n    \n    \n    tpl: '<tpl for=\".\"><\\u003fxml version=\"{version}\" encoding=\"{encoding}\"\\u003f><tpl if=\"documentRoot\"><{documentRoot}><tpl for=\"baseParams\"><tpl for=\".\"><{name}>{value}</{name}></tpl></tpl></tpl><tpl if=\"records.length&gt;1\"><{root}></tpl><tpl for=\"records\"><{parent.record}><tpl for=\".\"><{name}>{value}</{name}></tpl></{parent.record}></tpl><tpl if=\"records.length&gt;1\"></{root}></tpl><tpl if=\"documentRoot\"></{documentRoot}></tpl></tpl>',\n\n\n    \n    render : function(params, baseParams, data) {\n        baseParams = this.toArray(baseParams);\n        params.xmlData = this.tpl.applyTemplate({\n            version: this.xmlVersion,\n            encoding: this.xmlEncoding,\n            documentRoot: (baseParams.length > 0 || this.forceDocumentRoot === true) ? this.documentRoot : false,\n            record: this.meta.record,\n            root: this.root,\n            baseParams: baseParams,\n            records: (Ext.isArray(data[0])) ? data : [data]\n        });\n    },\n\n    \n    createRecord : function(rec) {\n        return this.toArray(this.toHash(rec));\n    },\n\n    \n    updateRecord : function(rec) {\n        return this.toArray(this.toHash(rec));\n\n    },\n    \n    destroyRecord : function(rec) {\n        var data = {};\n        data[this.meta.idProperty] = rec.id;\n        return this.toArray(data);\n    }\n});\n\nExt.data.XmlReader = function(meta, recordType){\n    meta = meta || {};\n\n    \n    Ext.applyIf(meta, {\n        idProperty: meta.idProperty || meta.idPath || meta.id,\n        successProperty: meta.successProperty || meta.success\n    });\n\n    Ext.data.XmlReader.superclass.constructor.call(this, meta, recordType || meta.fields);\n};\nExt.extend(Ext.data.XmlReader, Ext.data.DataReader, {\n    \n    read : function(response){\n        var doc = response.responseXML;\n        if(!doc) {\n            throw {message: \"XmlReader.read: XML Document not available\"};\n        }\n        return this.readRecords(doc);\n    },\n\n    \n    readRecords : function(doc){\n        \n        this.xmlData = doc;\n\n        var root    = doc.documentElement || doc,\n            q       = Ext.DomQuery,\n            totalRecords = 0,\n            success = true;\n\n        if(this.meta.totalProperty){\n            totalRecords = this.getTotal(root, 0);\n        }\n        if(this.meta.successProperty){\n            success = this.getSuccess(root);\n        }\n\n        var records = this.extractData(q.select(this.meta.record, root), true); \n\n        \n        return {\n            success : success,\n            records : records,\n            totalRecords : totalRecords || records.length\n        };\n    },\n\n    \n    readResponse : function(action, response) {\n        var q = Ext.DomQuery,\n            doc = response.responseXML,\n            root = doc.documentElement || doc;\n\n        \n        var res = new Ext.data.Response({\n            action: action,\n            success : this.getSuccess(root),\n            message: this.getMessage(root),\n            data: this.extractData(q.select(this.meta.record, root) || q.select(this.meta.root, root), false),\n            raw: doc\n        });\n\n        if (Ext.isEmpty(res.success)) {\n            throw new Ext.data.DataReader.Error('successProperty-response', this.meta.successProperty);\n        }\n\n        \n        if (action === Ext.data.Api.actions.create) {\n            var def = Ext.isDefined(res.data);\n            if (def && Ext.isEmpty(res.data)) {\n                throw new Ext.data.JsonReader.Error('root-empty', this.meta.root);\n            }\n            else if (!def) {\n                throw new Ext.data.JsonReader.Error('root-undefined-response', this.meta.root);\n            }\n        }\n        return res;\n    },\n\n    getSuccess : function() {\n        return true;\n    },\n\n    \n    buildExtractors : function() {\n        if(this.ef){\n            return;\n        }\n        var s       = this.meta,\n            Record  = this.recordType,\n            f       = Record.prototype.fields,\n            fi      = f.items,\n            fl      = f.length;\n\n        if(s.totalProperty) {\n            this.getTotal = this.createAccessor(s.totalProperty);\n        }\n        if(s.successProperty) {\n            this.getSuccess = this.createAccessor(s.successProperty);\n        }\n        if (s.messageProperty) {\n            this.getMessage = this.createAccessor(s.messageProperty);\n        }\n        this.getRoot = function(res) {\n            return (!Ext.isEmpty(res[this.meta.record])) ? res[this.meta.record] : res[this.meta.root];\n        };\n        if (s.idPath || s.idProperty) {\n            var g = this.createAccessor(s.idPath || s.idProperty);\n            this.getId = function(rec) {\n                var id = g(rec) || rec.id;\n                return (id === undefined || id === '') ? null : id;\n            };\n        } else {\n            this.getId = function(){return null;};\n        }\n        var ef = [];\n        for(var i = 0; i < fl; i++){\n            f = fi[i];\n            var map = (f.mapping !== undefined && f.mapping !== null) ? f.mapping : f.name;\n            ef.push(this.createAccessor(map));\n        }\n        this.ef = ef;\n    },\n\n    \n    createAccessor : function(){\n        var q = Ext.DomQuery;\n        return function(key) {\n            if (Ext.isFunction(key)) {\n                return key;\n            }\n            switch(key) {\n                case this.meta.totalProperty:\n                    return function(root, def){\n                        return q.selectNumber(key, root, def);\n                    };\n                    break;\n                case this.meta.successProperty:\n                    return function(root, def) {\n                        var sv = q.selectValue(key, root, true);\n                        var success = sv !== false && sv !== 'false';\n                        return success;\n                    };\n                    break;\n                default:\n                    return function(root, def) {\n                        return q.selectValue(key, root, def);\n                    };\n                    break;\n            }\n        };\n    }(),\n\n    \n    extractValues : function(data, items, len) {\n        var f, values = {};\n        for(var j = 0; j < len; j++){\n            f = items[j];\n            var v = this.ef[j](data);\n            values[f.name] = f.convert((v !== undefined) ? v : f.defaultValue, data);\n        }\n        return values;\n    }\n});\nExt.data.XmlStore = Ext.extend(Ext.data.Store, {\n    \n    constructor: function(config){\n        Ext.data.XmlStore.superclass.constructor.call(this, Ext.apply(config, {\n            reader: new Ext.data.XmlReader(config)\n        }));\n    }\n});\nExt.reg('xmlstore', Ext.data.XmlStore);\nExt.data.GroupingStore = Ext.extend(Ext.data.Store, {\n\n    \n    constructor: function(config) {\n        config = config || {};\n\n        \n        \n        \n        \n        this.hasMultiSort  = true;\n        this.multiSortInfo = this.multiSortInfo || {sorters: []};\n\n        var sorters    = this.multiSortInfo.sorters,\n            groupField = config.groupField || this.groupField,\n            sortInfo   = config.sortInfo || this.sortInfo,\n            groupDir   = config.groupDir || this.groupDir;\n\n        \n        if(groupField){\n            sorters.push({\n                field    : groupField,\n                direction: groupDir\n            });\n        }\n\n        \n        if (sortInfo) {\n            sorters.push(sortInfo);\n        }\n\n        Ext.data.GroupingStore.superclass.constructor.call(this, config);\n\n        this.addEvents(\n          \n          'groupchange'\n        );\n\n        this.applyGroupField();\n    },\n\n    \n    \n    remoteGroup : false,\n    \n    groupOnSort:false,\n\n    \n    groupDir : 'ASC',\n\n    \n    clearGrouping : function(){\n        this.groupField = false;\n\n        if(this.remoteGroup){\n            if(this.baseParams){\n                delete this.baseParams.groupBy;\n                delete this.baseParams.groupDir;\n            }\n            var lo = this.lastOptions;\n            if(lo && lo.params){\n                delete lo.params.groupBy;\n                delete lo.params.groupDir;\n            }\n\n            this.reload();\n        }else{\n            this.sort();\n            this.fireEvent('datachanged', this);\n        }\n    },\n\n    \n    groupBy : function(field, forceRegroup, direction) {\n        direction = direction ? (String(direction).toUpperCase() == 'DESC' ? 'DESC' : 'ASC') : this.groupDir;\n\n        if (this.groupField == field && this.groupDir == direction && !forceRegroup) {\n            return; \n        }\n\n        \n        \n        var sorters = this.multiSortInfo.sorters;\n        if (sorters.length > 0 && sorters[0].field == this.groupField) {\n            sorters.shift();\n        }\n\n        this.groupField = field;\n        this.groupDir = direction;\n        this.applyGroupField();\n\n        var fireGroupEvent = function() {\n            this.fireEvent('groupchange', this, this.getGroupState());\n        };\n\n        if (this.groupOnSort) {\n            this.sort(field, direction);\n            fireGroupEvent.call(this);\n            return;\n        }\n\n        if (this.remoteGroup) {\n            this.on('load', fireGroupEvent, this, {single: true});\n            this.reload();\n        } else {\n            this.sort(sorters);\n            fireGroupEvent.call(this);\n        }\n    },\n\n    \n    \n    sort : function(fieldName, dir) {\n        if (this.remoteSort) {\n            return Ext.data.GroupingStore.superclass.sort.call(this, fieldName, dir);\n        }\n\n        var sorters = [];\n\n        \n        if (Ext.isArray(arguments[0])) {\n            sorters = arguments[0];\n        } else if (fieldName == undefined) {\n            \n            \n            sorters = this.sortInfo ? [this.sortInfo] : [];\n        } else {\n            \n            \n            var field = this.fields.get(fieldName);\n            if (!field) return false;\n\n            var name       = field.name,\n                sortInfo   = this.sortInfo || null,\n                sortToggle = this.sortToggle ? this.sortToggle[name] : null;\n\n            if (!dir) {\n                if (sortInfo && sortInfo.field == name) { \n                    dir = (this.sortToggle[name] || 'ASC').toggle('ASC', 'DESC');\n                } else {\n                    dir = field.sortDir;\n                }\n            }\n\n            this.sortToggle[name] = dir;\n            this.sortInfo = {field: name, direction: dir};\n\n            sorters = [this.sortInfo];\n        }\n\n        \n        if (this.groupField) {\n            sorters.unshift({direction: this.groupDir, field: this.groupField});\n        }\n\n        return this.multiSort.call(this, sorters, dir);\n    },\n\n    \n    applyGroupField: function(){\n        if (this.remoteGroup) {\n            if(!this.baseParams){\n                this.baseParams = {};\n            }\n\n            Ext.apply(this.baseParams, {\n                groupBy : this.groupField,\n                groupDir: this.groupDir\n            });\n\n            var lo = this.lastOptions;\n            if (lo && lo.params) {\n                lo.params.groupDir = this.groupDir;\n\n                \n                delete lo.params.groupBy;\n            }\n        }\n    },\n\n    \n    applyGrouping : function(alwaysFireChange){\n        if(this.groupField !== false){\n            this.groupBy(this.groupField, true, this.groupDir);\n            return true;\n        }else{\n            if(alwaysFireChange === true){\n                this.fireEvent('datachanged', this);\n            }\n            return false;\n        }\n    },\n\n    \n    getGroupState : function(){\n        return this.groupOnSort && this.groupField !== false ?\n               (this.sortInfo ? this.sortInfo.field : undefined) : this.groupField;\n    }\n});\nExt.reg('groupingstore', Ext.data.GroupingStore);\n\nExt.data.DirectProxy = function(config){\n    Ext.apply(this, config);\n    if(typeof this.paramOrder == 'string'){\n        this.paramOrder = this.paramOrder.split(/[\\s,|]/);\n    }\n    Ext.data.DirectProxy.superclass.constructor.call(this, config);\n};\n\nExt.extend(Ext.data.DirectProxy, Ext.data.DataProxy, {\n    \n    paramOrder: undefined,\n\n    \n    paramsAsHash: true,\n\n    \n    directFn : undefined,\n\n    \n    doRequest : function(action, rs, params, reader, callback, scope, options) {\n        var args = [],\n            directFn = this.api[action] || this.directFn;\n\n        switch (action) {\n            case Ext.data.Api.actions.create:\n                args.push(params.jsonData);\t\t\n                break;\n            case Ext.data.Api.actions.read:\n                \n                if(directFn.directCfg.method.len > 0){\n                    if(this.paramOrder){\n                        for(var i = 0, len = this.paramOrder.length; i < len; i++){\n                            args.push(params[this.paramOrder[i]]);\n                        }\n                    }else if(this.paramsAsHash){\n                        args.push(params);\n                    }\n                }\n                break;\n            case Ext.data.Api.actions.update:\n                args.push(params.jsonData);        \n                break;\n            case Ext.data.Api.actions.destroy:\n                args.push(params.jsonData);        \n                break;\n        }\n\n        var trans = {\n            params : params || {},\n            request: {\n                callback : callback,\n                scope : scope,\n                arg : options\n            },\n            reader: reader\n        };\n\n        args.push(this.createCallback(action, rs, trans), this);\n        directFn.apply(window, args);\n    },\n\n    \n    createCallback : function(action, rs, trans) {\n        var me = this;\n        return function(result, res) {\n            if (!res.status) {\n                \n                if (action === Ext.data.Api.actions.read) {\n                    me.fireEvent(\"loadexception\", me, trans, res, null);\n                }\n                me.fireEvent('exception', me, 'remote', action, trans, res, null);\n                trans.request.callback.call(trans.request.scope, null, trans.request.arg, false);\n                return;\n            }\n            if (action === Ext.data.Api.actions.read) {\n                me.onRead(action, trans, result, res);\n            } else {\n                me.onWrite(action, trans, result, res, rs);\n            }\n        };\n    },\n\n    \n    onRead : function(action, trans, result, res) {\n        var records;\n        try {\n            records = trans.reader.readRecords(result);\n        }\n        catch (ex) {\n            \n            this.fireEvent(\"loadexception\", this, trans, res, ex);\n\n            this.fireEvent('exception', this, 'response', action, trans, res, ex);\n            trans.request.callback.call(trans.request.scope, null, trans.request.arg, false);\n            return;\n        }\n        this.fireEvent(\"load\", this, res, trans.request.arg);\n        trans.request.callback.call(trans.request.scope, records, trans.request.arg, true);\n    },\n    \n    onWrite : function(action, trans, result, res, rs) {\n        var data = trans.reader.extractData(trans.reader.getRoot(result), false);\n        var success = trans.reader.getSuccess(result);\n        success = (success !== false);\n        if (success){\n            this.fireEvent(\"write\", this, action, data, res, rs, trans.request.arg);\n        }else{\n            this.fireEvent('exception', this, 'remote', action, trans, result, rs);\n        }\n        trans.request.callback.call(trans.request.scope, data, res, success);\n    }\n});\n\nExt.data.DirectStore = Ext.extend(Ext.data.Store, {\n    constructor : function(config){\n        \n        var c = Ext.apply({}, {\n            batchTransactions: false\n        }, config);\n        Ext.data.DirectStore.superclass.constructor.call(this, Ext.apply(c, {\n            proxy: Ext.isDefined(c.proxy) ? c.proxy : new Ext.data.DirectProxy(Ext.copyTo({}, c, 'paramOrder,paramsAsHash,directFn,api')),\n            reader: (!Ext.isDefined(c.reader) && c.fields) ? new Ext.data.JsonReader(Ext.copyTo({}, c, 'totalProperty,root,idProperty'), c.fields) : c.reader\n        }));\n    }\n});\nExt.reg('directstore', Ext.data.DirectStore);\n\nExt.Direct = Ext.extend(Ext.util.Observable, {\n    \n\n    \n    exceptions: {\n        TRANSPORT: 'xhr',\n        PARSE: 'parse',\n        LOGIN: 'login',\n        SERVER: 'exception'\n    },\n\n    \n    constructor: function(){\n        this.addEvents(\n            \n            'event',\n            \n            'exception'\n        );\n        this.transactions = {};\n        this.providers = {};\n    },\n\n    \n    addProvider : function(provider){\n        var a = arguments;\n        if(a.length > 1){\n            for(var i = 0, len = a.length; i < len; i++){\n                this.addProvider(a[i]);\n            }\n            return;\n        }\n\n        \n        if(!provider.events){\n            provider = new Ext.Direct.PROVIDERS[provider.type](provider);\n        }\n        provider.id = provider.id || Ext.id();\n        this.providers[provider.id] = provider;\n\n        provider.on('data', this.onProviderData, this);\n        provider.on('exception', this.onProviderException, this);\n\n\n        if(!provider.isConnected()){\n            provider.connect();\n        }\n\n        return provider;\n    },\n\n    \n    getProvider : function(id){\n        return this.providers[id];\n    },\n\n    removeProvider : function(id){\n        var provider = id.id ? id : this.providers[id];\n        provider.un('data', this.onProviderData, this);\n        provider.un('exception', this.onProviderException, this);\n        delete this.providers[provider.id];\n        return provider;\n    },\n\n    addTransaction: function(t){\n        this.transactions[t.tid] = t;\n        return t;\n    },\n\n    removeTransaction: function(t){\n        delete this.transactions[t.tid || t];\n        return t;\n    },\n\n    getTransaction: function(tid){\n        return this.transactions[tid.tid || tid];\n    },\n\n    onProviderData : function(provider, e){\n        if(Ext.isArray(e)){\n            for(var i = 0, len = e.length; i < len; i++){\n                this.onProviderData(provider, e[i]);\n            }\n            return;\n        }\n        if(e.name && e.name != 'event' && e.name != 'exception'){\n            this.fireEvent(e.name, e);\n        }else if(e.type == 'exception'){\n            this.fireEvent('exception', e);\n        }\n        this.fireEvent('event', e, provider);\n    },\n\n    createEvent : function(response, extraProps){\n        return new Ext.Direct.eventTypes[response.type](Ext.apply(response, extraProps));\n    }\n});\n\nExt.Direct = new Ext.Direct();\n\nExt.Direct.TID = 1;\nExt.Direct.PROVIDERS = {};\nExt.Direct.Transaction = function(config){\n    Ext.apply(this, config);\n    this.tid = ++Ext.Direct.TID;\n    this.retryCount = 0;\n};\nExt.Direct.Transaction.prototype = {\n    send: function(){\n        this.provider.queueTransaction(this);\n    },\n\n    retry: function(){\n        this.retryCount++;\n        this.send();\n    },\n\n    getProvider: function(){\n        return this.provider;\n    }\n};Ext.Direct.Event = function(config){\n    Ext.apply(this, config);\n};\n\nExt.Direct.Event.prototype = {\n    status: true,\n    getData: function(){\n        return this.data;\n    }\n};\n\nExt.Direct.RemotingEvent = Ext.extend(Ext.Direct.Event, {\n    type: 'rpc',\n    getTransaction: function(){\n        return this.transaction || Ext.Direct.getTransaction(this.tid);\n    }\n});\n\nExt.Direct.ExceptionEvent = Ext.extend(Ext.Direct.RemotingEvent, {\n    status: false,\n    type: 'exception'\n});\n\nExt.Direct.eventTypes = {\n    'rpc':  Ext.Direct.RemotingEvent,\n    'event':  Ext.Direct.Event,\n    'exception':  Ext.Direct.ExceptionEvent\n};\n\nExt.direct.Provider = Ext.extend(Ext.util.Observable, {    \n    \n        \n        \n    priority: 1,\n\n        \n \n    \n    constructor : function(config){\n        Ext.apply(this, config);\n        this.addEvents(\n                        \n            'connect',\n                        \n            'disconnect',\n                        \n            'data',\n                                    \n            'exception'\n        );\n        Ext.direct.Provider.superclass.constructor.call(this, config);\n    },\n\n    \n    isConnected: function(){\n        return false;\n    },\n\n    \n    connect: Ext.emptyFn,\n    \n    \n    disconnect: Ext.emptyFn\n});\n\nExt.direct.JsonProvider = Ext.extend(Ext.direct.Provider, {\n    parseResponse: function(xhr){\n        if(!Ext.isEmpty(xhr.responseText)){\n            if(typeof xhr.responseText == 'object'){\n                return xhr.responseText;\n            }\n            return Ext.decode(xhr.responseText);\n        }\n        return null;\n    },\n\n    getEvents: function(xhr){\n        var data = null;\n        try{\n            data = this.parseResponse(xhr);\n        }catch(e){\n            var event = new Ext.Direct.ExceptionEvent({\n                data: e,\n                xhr: xhr,\n                code: Ext.Direct.exceptions.PARSE,\n                message: 'Error parsing json response: \\n\\n ' + data\n            });\n            return [event];\n        }\n        var events = [];\n        if(Ext.isArray(data)){\n            for(var i = 0, len = data.length; i < len; i++){\n                events.push(Ext.Direct.createEvent(data[i]));\n            }\n        }else{\n            events.push(Ext.Direct.createEvent(data));\n        }\n        return events;\n    }\n});\nExt.direct.PollingProvider = Ext.extend(Ext.direct.JsonProvider, {\n    \n    \n    priority: 3,\n\n    \n    interval: 3000,\n\n    \n\n    \n\n    \n    constructor : function(config){\n        Ext.direct.PollingProvider.superclass.constructor.call(this, config);\n        this.addEvents(\n            \n            'beforepoll',\n            \n            'poll'\n        );\n    },\n\n    \n    isConnected: function(){\n        return !!this.pollTask;\n    },\n\n    \n    connect: function(){\n        if(this.url && !this.pollTask){\n            this.pollTask = Ext.TaskMgr.start({\n                run: function(){\n                    if(this.fireEvent('beforepoll', this) !== false){\n                        if(typeof this.url == 'function'){\n                            this.url(this.baseParams);\n                        }else{\n                            Ext.Ajax.request({\n                                url: this.url,\n                                callback: this.onData,\n                                scope: this,\n                                params: this.baseParams\n                            });\n                        }\n                    }\n                },\n                interval: this.interval,\n                scope: this\n            });\n            this.fireEvent('connect', this);\n        }else if(!this.url){\n            throw 'Error initializing PollingProvider, no url configured.';\n        }\n    },\n\n    \n    disconnect: function(){\n        if(this.pollTask){\n            Ext.TaskMgr.stop(this.pollTask);\n            delete this.pollTask;\n            this.fireEvent('disconnect', this);\n        }\n    },\n\n    \n    onData: function(opt, success, xhr){\n        if(success){\n            var events = this.getEvents(xhr);\n            for(var i = 0, len = events.length; i < len; i++){\n                var e = events[i];\n                this.fireEvent('data', this, e);\n            }\n        }else{\n            var e = new Ext.Direct.ExceptionEvent({\n                data: e,\n                code: Ext.Direct.exceptions.TRANSPORT,\n                message: 'Unable to connect to the server.',\n                xhr: xhr\n            });\n            this.fireEvent('data', this, e);\n        }\n    }\n});\n\nExt.Direct.PROVIDERS['polling'] = Ext.direct.PollingProvider;\nExt.direct.RemotingProvider = Ext.extend(Ext.direct.JsonProvider, {       \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    enableBuffer: 10,\n    \n    \n    maxRetries: 1,\n    \n    \n    timeout: undefined,\n\n    constructor : function(config){\n        Ext.direct.RemotingProvider.superclass.constructor.call(this, config);\n        this.addEvents(\n                        \n            'beforecall',            \n                        \n            'call'\n        );\n        this.namespace = (Ext.isString(this.namespace)) ? Ext.ns(this.namespace) : this.namespace || window;\n        this.transactions = {};\n        this.callBuffer = [];\n    },\n\n    \n    initAPI : function(){\n        var o = this.actions;\n        for(var c in o){\n            var cls = this.namespace[c] || (this.namespace[c] = {}),\n                ms = o[c];\n            for(var i = 0, len = ms.length; i < len; i++){\n                var m = ms[i];\n                cls[m.name] = this.createMethod(c, m);\n            }\n        }\n    },\n\n    \n    isConnected: function(){\n        return !!this.connected;\n    },\n\n    connect: function(){\n        if(this.url){\n            this.initAPI();\n            this.connected = true;\n            this.fireEvent('connect', this);\n        }else if(!this.url){\n            throw 'Error initializing RemotingProvider, no url configured.';\n        }\n    },\n\n    disconnect: function(){\n        if(this.connected){\n            this.connected = false;\n            this.fireEvent('disconnect', this);\n        }\n    },\n\n    onData: function(opt, success, xhr){\n        if(success){\n            var events = this.getEvents(xhr);\n            for(var i = 0, len = events.length; i < len; i++){\n                var e = events[i],\n                    t = this.getTransaction(e);\n                this.fireEvent('data', this, e);\n                if(t){\n                    this.doCallback(t, e, true);\n                    Ext.Direct.removeTransaction(t);\n                }\n            }\n        }else{\n            var ts = [].concat(opt.ts);\n            for(var i = 0, len = ts.length; i < len; i++){\n                var t = this.getTransaction(ts[i]);\n                if(t && t.retryCount < this.maxRetries){\n                    t.retry();\n                }else{\n                    var e = new Ext.Direct.ExceptionEvent({\n                        data: e,\n                        transaction: t,\n                        code: Ext.Direct.exceptions.TRANSPORT,\n                        message: 'Unable to connect to the server.',\n                        xhr: xhr\n                    });\n                    this.fireEvent('data', this, e);\n                    if(t){\n                        this.doCallback(t, e, false);\n                        Ext.Direct.removeTransaction(t);\n                    }\n                }\n            }\n        }\n    },\n\n    getCallData: function(t){\n        return {\n            action: t.action,\n            method: t.method,\n            data: t.data,\n            type: 'rpc',\n            tid: t.tid\n        };\n    },\n\n    doSend : function(data){\n        var o = {\n            url: this.url,\n            callback: this.onData,\n            scope: this,\n            ts: data,\n            timeout: this.timeout\n        }, callData;\n\n        if(Ext.isArray(data)){\n            callData = [];\n            for(var i = 0, len = data.length; i < len; i++){\n                callData.push(this.getCallData(data[i]));\n            }\n        }else{\n            callData = this.getCallData(data);\n        }\n\n        if(this.enableUrlEncode){\n            var params = {};\n            params[Ext.isString(this.enableUrlEncode) ? this.enableUrlEncode : 'data'] = Ext.encode(callData);\n            o.params = params;\n        }else{\n            o.jsonData = callData;\n        }\n        Ext.Ajax.request(o);\n    },\n\n    combineAndSend : function(){\n        var len = this.callBuffer.length;\n        if(len > 0){\n            this.doSend(len == 1 ? this.callBuffer[0] : this.callBuffer);\n            this.callBuffer = [];\n        }\n    },\n\n    queueTransaction: function(t){\n        if(t.form){\n            this.processForm(t);\n            return;\n        }\n        this.callBuffer.push(t);\n        if(this.enableBuffer){\n            if(!this.callTask){\n                this.callTask = new Ext.util.DelayedTask(this.combineAndSend, this);\n            }\n            this.callTask.delay(Ext.isNumber(this.enableBuffer) ? this.enableBuffer : 10);\n        }else{\n            this.combineAndSend();\n        }\n    },\n\n    doCall : function(c, m, args){\n        var data = null, hs = args[m.len], scope = args[m.len+1];\n\n        if(m.len !== 0){\n            data = args.slice(0, m.len);\n        }\n\n        var t = new Ext.Direct.Transaction({\n            provider: this,\n            args: args,\n            action: c,\n            method: m.name,\n            data: data,\n            cb: scope && Ext.isFunction(hs) ? hs.createDelegate(scope) : hs\n        });\n\n        if(this.fireEvent('beforecall', this, t, m) !== false){\n            Ext.Direct.addTransaction(t);\n            this.queueTransaction(t);\n            this.fireEvent('call', this, t, m);\n        }\n    },\n\n    doForm : function(c, m, form, callback, scope){\n        var t = new Ext.Direct.Transaction({\n            provider: this,\n            action: c,\n            method: m.name,\n            args:[form, callback, scope],\n            cb: scope && Ext.isFunction(callback) ? callback.createDelegate(scope) : callback,\n            isForm: true\n        });\n\n        if(this.fireEvent('beforecall', this, t, m) !== false){\n            Ext.Direct.addTransaction(t);\n            var isUpload = String(form.getAttribute(\"enctype\")).toLowerCase() == 'multipart/form-data',\n                params = {\n                    extTID: t.tid,\n                    extAction: c,\n                    extMethod: m.name,\n                    extType: 'rpc',\n                    extUpload: String(isUpload)\n                };\n            \n            \n            \n            Ext.apply(t, {\n                form: Ext.getDom(form),\n                isUpload: isUpload,\n                params: callback && Ext.isObject(callback.params) ? Ext.apply(params, callback.params) : params\n            });\n            this.fireEvent('call', this, t, m);\n            this.processForm(t);\n        }\n    },\n    \n    processForm: function(t){\n        Ext.Ajax.request({\n            url: this.url,\n            params: t.params,\n            callback: this.onData,\n            scope: this,\n            form: t.form,\n            isUpload: t.isUpload,\n            ts: t\n        });\n    },\n\n    createMethod : function(c, m){\n        var f;\n        if(!m.formHandler){\n            f = function(){\n                this.doCall(c, m, Array.prototype.slice.call(arguments, 0));\n            }.createDelegate(this);\n        }else{\n            f = function(form, callback, scope){\n                this.doForm(c, m, form, callback, scope);\n            }.createDelegate(this);\n        }\n        f.directCfg = {\n            action: c,\n            method: m\n        };\n        return f;\n    },\n\n    getTransaction: function(opt){\n        return opt && opt.tid ? Ext.Direct.getTransaction(opt.tid) : null;\n    },\n\n    doCallback: function(t, e){\n        var fn = e.status ? 'success' : 'failure';\n        if(t && t.cb){\n            var hs = t.cb,\n                result = Ext.isDefined(e.result) ? e.result : e.data;\n            if(Ext.isFunction(hs)){\n                hs(result, e);\n            } else{\n                Ext.callback(hs[fn], hs.scope, [result, e]);\n                Ext.callback(hs.callback, hs.scope, [result, e]);\n            }\n        }\n    }\n});\nExt.Direct.PROVIDERS['remoting'] = Ext.direct.RemotingProvider;\nExt.Resizable = Ext.extend(Ext.util.Observable, {\n\n    constructor: function(el, config){\n        this.el = Ext.get(el);\n        if(config && config.wrap){\n            config.resizeChild = this.el;\n            this.el = this.el.wrap(typeof config.wrap == 'object' ? config.wrap : {cls:'xresizable-wrap'});\n            this.el.id = this.el.dom.id = config.resizeChild.id + '-rzwrap';\n            this.el.setStyle('overflow', 'hidden');\n            this.el.setPositioning(config.resizeChild.getPositioning());\n            config.resizeChild.clearPositioning();\n            if(!config.width || !config.height){\n                var csize = config.resizeChild.getSize();\n                this.el.setSize(csize.width, csize.height);\n            }\n            if(config.pinned && !config.adjustments){\n                config.adjustments = 'auto';\n            }\n        }\n\n        \n        this.proxy = this.el.createProxy({tag: 'div', cls: 'x-resizable-proxy', id: this.el.id + '-rzproxy'}, Ext.getBody());\n        this.proxy.unselectable();\n        this.proxy.enableDisplayMode('block');\n\n        Ext.apply(this, config);\n\n        if(this.pinned){\n            this.disableTrackOver = true;\n            this.el.addClass('x-resizable-pinned');\n        }\n        \n        var position = this.el.getStyle('position');\n        if(position != 'absolute' && position != 'fixed'){\n            this.el.setStyle('position', 'relative');\n        }\n        if(!this.handles){ \n            this.handles = 's,e,se';\n            if(this.multiDirectional){\n                this.handles += ',n,w';\n            }\n        }\n        if(this.handles == 'all'){\n            this.handles = 'n s e w ne nw se sw';\n        }\n        var hs = this.handles.split(/\\s*?[,;]\\s*?| /);\n        var ps = Ext.Resizable.positions;\n        for(var i = 0, len = hs.length; i < len; i++){\n            if(hs[i] && ps[hs[i]]){\n                var pos = ps[hs[i]];\n                this[pos] = new Ext.Resizable.Handle(this, pos, this.disableTrackOver, this.transparent, this.handleCls);\n            }\n        }\n        \n        this.corner = this.southeast;\n\n        if(this.handles.indexOf('n') != -1 || this.handles.indexOf('w') != -1){\n            this.updateBox = true;\n        }\n\n        this.activeHandle = null;\n\n        if(this.resizeChild){\n            if(typeof this.resizeChild == 'boolean'){\n                this.resizeChild = Ext.get(this.el.dom.firstChild, true);\n            }else{\n                this.resizeChild = Ext.get(this.resizeChild, true);\n            }\n        }\n\n        if(this.adjustments == 'auto'){\n            var rc = this.resizeChild;\n            var hw = this.west, he = this.east, hn = this.north, hs = this.south;\n            if(rc && (hw || hn)){\n                rc.position('relative');\n                rc.setLeft(hw ? hw.el.getWidth() : 0);\n                rc.setTop(hn ? hn.el.getHeight() : 0);\n            }\n            this.adjustments = [\n                (he ? -he.el.getWidth() : 0) + (hw ? -hw.el.getWidth() : 0),\n                (hn ? -hn.el.getHeight() : 0) + (hs ? -hs.el.getHeight() : 0) -1\n            ];\n        }\n\n        if(this.draggable){\n            this.dd = this.dynamic ?\n                this.el.initDD(null) : this.el.initDDProxy(null, {dragElId: this.proxy.id});\n            this.dd.setHandleElId(this.resizeChild ? this.resizeChild.id : this.el.id);\n            if(this.constrainTo){\n                this.dd.constrainTo(this.constrainTo);\n            }\n        }\n\n        this.addEvents(\n            \n            'beforeresize',\n            \n            'resize'\n        );\n\n        if(this.width !== null && this.height !== null){\n            this.resizeTo(this.width, this.height);\n        }else{\n            this.updateChildSize();\n        }\n        if(Ext.isIE){\n            this.el.dom.style.zoom = 1;\n        }\n        Ext.Resizable.superclass.constructor.call(this);\n    },\n\n    \n    adjustments : [0, 0],\n    \n    animate : false,\n    \n    \n    disableTrackOver : false,\n    \n    draggable: false,\n    \n    duration : 0.35,\n    \n    dynamic : false,\n    \n    easing : 'easeOutStrong',\n    \n    enabled : true,\n    \n    \n    handles : false,\n    \n    multiDirectional : false,\n    \n    height : null,\n    \n    width : null,\n    \n    heightIncrement : 0,\n    \n    widthIncrement : 0,\n    \n    minHeight : 5,\n    \n    minWidth : 5,\n    \n    maxHeight : 10000,\n    \n    maxWidth : 10000,\n    \n    minX: 0,\n    \n    minY: 0,\n    \n    pinned : false,\n    \n    preserveRatio : false,\n    \n    resizeChild : false,\n    \n    transparent: false,\n    \n    \n    \n\n\n    \n    resizeTo : function(width, height){\n        this.el.setSize(width, height);\n        this.updateChildSize();\n        this.fireEvent('resize', this, width, height, null);\n    },\n\n    \n    startSizing : function(e, handle){\n        this.fireEvent('beforeresize', this, e);\n        if(this.enabled){ \n\n            if(!this.overlay){\n                this.overlay = this.el.createProxy({tag: 'div', cls: 'x-resizable-overlay', html: '&#160;'}, Ext.getBody());\n                this.overlay.unselectable();\n                this.overlay.enableDisplayMode('block');\n                this.overlay.on({\n                    scope: this,\n                    mousemove: this.onMouseMove,\n                    mouseup: this.onMouseUp\n                });\n            }\n            this.overlay.setStyle('cursor', handle.el.getStyle('cursor'));\n\n            this.resizing = true;\n            this.startBox = this.el.getBox();\n            this.startPoint = e.getXY();\n            this.offsets = [(this.startBox.x + this.startBox.width) - this.startPoint[0],\n                            (this.startBox.y + this.startBox.height) - this.startPoint[1]];\n\n            this.overlay.setSize(Ext.lib.Dom.getViewWidth(true), Ext.lib.Dom.getViewHeight(true));\n            this.overlay.show();\n\n            if(this.constrainTo) {\n                var ct = Ext.get(this.constrainTo);\n                this.resizeRegion = ct.getRegion().adjust(\n                    ct.getFrameWidth('t'),\n                    ct.getFrameWidth('l'),\n                    -ct.getFrameWidth('b'),\n                    -ct.getFrameWidth('r')\n                );\n            }\n\n            this.proxy.setStyle('visibility', 'hidden'); \n            this.proxy.show();\n            this.proxy.setBox(this.startBox);\n            if(!this.dynamic){\n                this.proxy.setStyle('visibility', 'visible');\n            }\n        }\n    },\n\n    \n    onMouseDown : function(handle, e){\n        if(this.enabled){\n            e.stopEvent();\n            this.activeHandle = handle;\n            this.startSizing(e, handle);\n        }\n    },\n\n    \n    onMouseUp : function(e){\n        this.activeHandle = null;\n        var size = this.resizeElement();\n        this.resizing = false;\n        this.handleOut();\n        this.overlay.hide();\n        this.proxy.hide();\n        this.fireEvent('resize', this, size.width, size.height, e);\n    },\n\n    \n    updateChildSize : function(){\n        if(this.resizeChild){\n            var el = this.el;\n            var child = this.resizeChild;\n            var adj = this.adjustments;\n            if(el.dom.offsetWidth){\n                var b = el.getSize(true);\n                child.setSize(b.width+adj[0], b.height+adj[1]);\n            }\n            \n            \n            \n            \n            if(Ext.isIE9m){\n                setTimeout(function(){\n                    if(el.dom.offsetWidth){\n                        var b = el.getSize(true);\n                        child.setSize(b.width+adj[0], b.height+adj[1]);\n                    }\n                }, 10);\n            }\n        }\n    },\n\n    \n    snap : function(value, inc, min){\n        if(!inc || !value){\n            return value;\n        }\n        var newValue = value;\n        var m = value % inc;\n        if(m > 0){\n            if(m > (inc/2)){\n                newValue = value + (inc-m);\n            }else{\n                newValue = value - m;\n            }\n        }\n        return Math.max(min, newValue);\n    },\n\n    \n    resizeElement : function(){\n        var box = this.proxy.getBox();\n        if(this.updateBox){\n            this.el.setBox(box, false, this.animate, this.duration, null, this.easing);\n        }else{\n            this.el.setSize(box.width, box.height, this.animate, this.duration, null, this.easing);\n        }\n        this.updateChildSize();\n        if(!this.dynamic){\n            this.proxy.hide();\n        }\n        if(this.draggable && this.constrainTo){\n            this.dd.resetConstraints();\n            this.dd.constrainTo(this.constrainTo);\n        }\n        return box;\n    },\n\n    \n    constrain : function(v, diff, m, mx){\n        if(v - diff < m){\n            diff = v - m;\n        }else if(v - diff > mx){\n            diff = v - mx;\n        }\n        return diff;\n    },\n\n    \n    onMouseMove : function(e){\n        if(this.enabled && this.activeHandle){\n            try{\n\n            if(this.resizeRegion && !this.resizeRegion.contains(e.getPoint())) {\n                return;\n            }\n\n            \n            var curSize = this.curSize || this.startBox,\n                x = this.startBox.x, y = this.startBox.y,\n                ox = x,\n                oy = y,\n                w = curSize.width,\n                h = curSize.height,\n                ow = w,\n                oh = h,\n                mw = this.minWidth,\n                mh = this.minHeight,\n                mxw = this.maxWidth,\n                mxh = this.maxHeight,\n                wi = this.widthIncrement,\n                hi = this.heightIncrement,\n                eventXY = e.getXY(),\n                diffX = -(this.startPoint[0] - Math.max(this.minX, eventXY[0])),\n                diffY = -(this.startPoint[1] - Math.max(this.minY, eventXY[1])),\n                pos = this.activeHandle.position,\n                tw,\n                th;\n\n            switch(pos){\n                case 'east':\n                    w += diffX;\n                    w = Math.min(Math.max(mw, w), mxw);\n                    break;\n                case 'south':\n                    h += diffY;\n                    h = Math.min(Math.max(mh, h), mxh);\n                    break;\n                case 'southeast':\n                    w += diffX;\n                    h += diffY;\n                    w = Math.min(Math.max(mw, w), mxw);\n                    h = Math.min(Math.max(mh, h), mxh);\n                    break;\n                case 'north':\n                    diffY = this.constrain(h, diffY, mh, mxh);\n                    y += diffY;\n                    h -= diffY;\n                    break;\n                case 'west':\n                    diffX = this.constrain(w, diffX, mw, mxw);\n                    x += diffX;\n                    w -= diffX;\n                    break;\n                case 'northeast':\n                    w += diffX;\n                    w = Math.min(Math.max(mw, w), mxw);\n                    diffY = this.constrain(h, diffY, mh, mxh);\n                    y += diffY;\n                    h -= diffY;\n                    break;\n                case 'northwest':\n                    diffX = this.constrain(w, diffX, mw, mxw);\n                    diffY = this.constrain(h, diffY, mh, mxh);\n                    y += diffY;\n                    h -= diffY;\n                    x += diffX;\n                    w -= diffX;\n                    break;\n               case 'southwest':\n                    diffX = this.constrain(w, diffX, mw, mxw);\n                    h += diffY;\n                    h = Math.min(Math.max(mh, h), mxh);\n                    x += diffX;\n                    w -= diffX;\n                    break;\n            }\n\n            var sw = this.snap(w, wi, mw);\n            var sh = this.snap(h, hi, mh);\n            if(sw != w || sh != h){\n                switch(pos){\n                    case 'northeast':\n                        y -= sh - h;\n                    break;\n                    case 'north':\n                        y -= sh - h;\n                        break;\n                    case 'southwest':\n                        x -= sw - w;\n                    break;\n                    case 'west':\n                        x -= sw - w;\n                        break;\n                    case 'northwest':\n                        x -= sw - w;\n                        y -= sh - h;\n                    break;\n                }\n                w = sw;\n                h = sh;\n            }\n\n            if(this.preserveRatio){\n                switch(pos){\n                    case 'southeast':\n                    case 'east':\n                        h = oh * (w/ow);\n                        h = Math.min(Math.max(mh, h), mxh);\n                        w = ow * (h/oh);\n                       break;\n                    case 'south':\n                        w = ow * (h/oh);\n                        w = Math.min(Math.max(mw, w), mxw);\n                        h = oh * (w/ow);\n                        break;\n                    case 'northeast':\n                        w = ow * (h/oh);\n                        w = Math.min(Math.max(mw, w), mxw);\n                        h = oh * (w/ow);\n                    break;\n                    case 'north':\n                        tw = w;\n                        w = ow * (h/oh);\n                        w = Math.min(Math.max(mw, w), mxw);\n                        h = oh * (w/ow);\n                        x += (tw - w) / 2;\n                        break;\n                    case 'southwest':\n                        h = oh * (w/ow);\n                        h = Math.min(Math.max(mh, h), mxh);\n                        tw = w;\n                        w = ow * (h/oh);\n                        x += tw - w;\n                        break;\n                    case 'west':\n                        th = h;\n                        h = oh * (w/ow);\n                        h = Math.min(Math.max(mh, h), mxh);\n                        y += (th - h) / 2;\n                        tw = w;\n                        w = ow * (h/oh);\n                        x += tw - w;\n                       break;\n                    case 'northwest':\n                        tw = w;\n                        th = h;\n                        h = oh * (w/ow);\n                        h = Math.min(Math.max(mh, h), mxh);\n                        w = ow * (h/oh);\n                        y += th - h;\n                        x += tw - w;\n                        break;\n\n                }\n            }\n            this.proxy.setBounds(x, y, w, h);\n            if(this.dynamic){\n                this.resizeElement();\n            }\n            }catch(ex){}\n        }\n    },\n\n    \n    handleOver : function(){\n        if(this.enabled){\n            this.el.addClass('x-resizable-over');\n        }\n    },\n\n    \n    handleOut : function(){\n        if(!this.resizing){\n            this.el.removeClass('x-resizable-over');\n        }\n    },\n\n    \n    getEl : function(){\n        return this.el;\n    },\n\n    \n    getResizeChild : function(){\n        return this.resizeChild;\n    },\n\n    \n    destroy : function(removeEl){\n        Ext.destroy(this.dd, this.overlay, this.proxy);\n        this.overlay = null;\n        this.proxy = null;\n\n        var ps = Ext.Resizable.positions;\n        for(var k in ps){\n            if(typeof ps[k] != 'function' && this[ps[k]]){\n                this[ps[k]].destroy();\n            }\n        }\n        if(removeEl){\n            this.el.update('');\n            Ext.destroy(this.el);\n            this.el = null;\n        }\n        this.purgeListeners();\n    },\n\n    syncHandleHeight : function(){\n        var h = this.el.getHeight(true);\n        if(this.west){\n            this.west.el.setHeight(h);\n        }\n        if(this.east){\n            this.east.el.setHeight(h);\n        }\n    }\n});\n\n\n\nExt.Resizable.positions = {\n    n: 'north', s: 'south', e: 'east', w: 'west', se: 'southeast', sw: 'southwest', nw: 'northwest', ne: 'northeast'\n};\n\nExt.Resizable.Handle = Ext.extend(Object, {\n    constructor : function(rz, pos, disableTrackOver, transparent, cls){\n       if(!this.tpl){\n            \n            var tpl = Ext.DomHelper.createTemplate(\n                {tag: 'div', cls: 'x-resizable-handle x-resizable-handle-{0}'}\n            );\n            tpl.compile();\n            Ext.Resizable.Handle.prototype.tpl = tpl;\n        }\n        this.position = pos;\n        this.rz = rz;\n        this.el = this.tpl.append(rz.el.dom, [this.position], true);\n        this.el.unselectable();\n        if(transparent){\n            this.el.setOpacity(0);\n        }\n        if(!Ext.isEmpty(cls)){\n            this.el.addClass(cls);\n        }\n        this.el.on('mousedown', this.onMouseDown, this);\n        if(!disableTrackOver){\n            this.el.on({\n                scope: this,\n                mouseover: this.onMouseOver,\n                mouseout: this.onMouseOut\n            });\n        }\n    },\n\n    \n    afterResize : function(rz){\n        \n    },\n    \n    onMouseDown : function(e){\n        this.rz.onMouseDown(this, e);\n    },\n    \n    onMouseOver : function(e){\n        this.rz.handleOver(this, e);\n    },\n    \n    onMouseOut : function(e){\n        this.rz.handleOut(this, e);\n    },\n    \n    destroy : function(){\n        Ext.destroy(this.el);\n        this.el = null;\n    }\n});\n\nExt.Window = Ext.extend(Ext.Panel, {\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n\n    \n    baseCls : 'x-window',\n    \n    resizable : true,\n    \n    draggable : true,\n    \n    closable : true,\n    \n    closeAction : 'close',\n    \n    constrain : false,\n    \n    constrainHeader : false,\n    \n    plain : false,\n    \n    minimizable : false,\n    \n    maximizable : false,\n    \n    minHeight : 100,\n    \n    minWidth : 200,\n    \n    expandOnShow : true,\n    \n    \n    showAnimDuration: 0.25,\n    \n    \n    hideAnimDuration: 0.25,\n\n    \n    collapsible : false,\n\n    \n    initHidden : undefined,\n\n    \n    hidden : true,\n\n    \n    \n    \n    \n    \n    elements : 'header,body',\n    \n    frame : true,\n    \n    floating : true,\n\n    \n    initComponent : function(){\n        this.initTools();\n        Ext.Window.superclass.initComponent.call(this);\n        this.addEvents(\n            \n            \n            \n            'resize',\n            \n            'maximize',\n            \n            'minimize',\n            \n            'restore'\n        );\n        \n        if(Ext.isDefined(this.initHidden)){\n            this.hidden = this.initHidden;\n        }\n        if(this.hidden === false){\n            this.hidden = true;\n            this.show();\n        }\n    },\n\n    \n    getState : function(){\n        return Ext.apply(Ext.Window.superclass.getState.call(this) || {}, this.getBox(true));\n    },\n\n    \n    onRender : function(ct, position){\n        Ext.Window.superclass.onRender.call(this, ct, position);\n\n        if(this.plain){\n            this.el.addClass('x-window-plain');\n        }\n\n        \n        this.focusEl = this.el.createChild({\n                    tag: 'a', href:'#', cls:'x-dlg-focus',\n                    tabIndex:'-1', html: '&#160;'});\n        this.focusEl.swallowEvent('click', true);\n\n        this.proxy = this.el.createProxy('x-window-proxy');\n        this.proxy.enableDisplayMode('block');\n\n        if(this.modal){\n            this.mask = this.container.createChild({cls:'ext-el-mask'}, this.el.dom);\n            this.mask.enableDisplayMode('block');\n            this.mask.hide();\n            this.mon(this.mask, 'click', this.focus, this);\n        }\n        if(this.maximizable){\n            this.mon(this.header, 'dblclick', this.toggleMaximize, this);\n        }\n    },\n\n    \n    initEvents : function(){\n        Ext.Window.superclass.initEvents.call(this);\n        if(this.animateTarget){\n            this.setAnimateTarget(this.animateTarget);\n        }\n\n        if(this.resizable){\n            this.resizer = new Ext.Resizable(this.el, {\n                minWidth: this.minWidth,\n                minHeight:this.minHeight,\n                handles: this.resizeHandles || 'all',\n                pinned: true,\n                resizeElement : this.resizerAction,\n                handleCls: 'x-window-handle'\n            });\n            this.resizer.window = this;\n            this.mon(this.resizer, 'beforeresize', this.beforeResize, this);\n        }\n\n        if(this.draggable){\n            this.header.addClass('x-window-draggable');\n        }\n        this.mon(this.el, 'mousedown', this.toFront, this);\n        this.manager = this.manager || Ext.WindowMgr;\n        this.manager.register(this);\n        if(this.maximized){\n            this.maximized = false;\n            this.maximize();\n        }\n        if(this.closable){\n            var km = this.getKeyMap();\n            km.on(27, this.onEsc, this);\n            km.disable();\n        }\n    },\n\n    initDraggable : function(){\n        \n        this.dd = new Ext.Window.DD(this);\n    },\n\n   \n    onEsc : function(k, e){\n        if (this.activeGhost) {\n            this.unghost();\n        }\n        e.stopEvent();\n        this[this.closeAction]();\n    },\n\n    \n    beforeDestroy : function(){\n        if(this.rendered){\n            this.hide();\n            this.clearAnchor();\n            Ext.destroy(\n                this.focusEl,\n                this.resizer,\n                this.dd,\n                this.proxy,\n                this.mask\n            );\n        }\n        Ext.Window.superclass.beforeDestroy.call(this);\n    },\n\n    \n    onDestroy : function(){\n        if(this.manager){\n            this.manager.unregister(this);\n        }\n        Ext.Window.superclass.onDestroy.call(this);\n    },\n\n    \n    initTools : function(){\n        if(this.minimizable){\n            this.addTool({\n                id: 'minimize',\n                handler: this.minimize.createDelegate(this, [])\n            });\n        }\n        if(this.maximizable){\n            this.addTool({\n                id: 'maximize',\n                handler: this.maximize.createDelegate(this, [])\n            });\n            this.addTool({\n                id: 'restore',\n                handler: this.restore.createDelegate(this, []),\n                hidden:true\n            });\n        }\n        if(this.closable){\n            this.addTool({\n                id: 'close',\n                handler: this[this.closeAction].createDelegate(this, [])\n            });\n        }\n    },\n\n    \n    resizerAction : function(){\n        var box = this.proxy.getBox();\n        this.proxy.hide();\n        this.window.handleResize(box);\n        return box;\n    },\n\n    \n    beforeResize : function(){\n        this.resizer.minHeight = Math.max(this.minHeight, this.getFrameHeight() + 40); \n        this.resizer.minWidth = Math.max(this.minWidth, this.getFrameWidth() + 40);\n        this.resizeBox = this.el.getBox();\n    },\n\n    \n    updateHandles : function(){\n        if(Ext.isIE9m && this.resizer){\n            this.resizer.syncHandleHeight();\n            this.el.repaint();\n        }\n    },\n\n    \n    handleResize : function(box){\n        var rz = this.resizeBox;\n        if(rz.x != box.x || rz.y != box.y){\n            this.updateBox(box);\n        }else{\n            this.setSize(box);\n            if (Ext.isIE6 && Ext.isStrict) {\n                this.doLayout();\n            }\n        }\n        this.focus();\n        this.updateHandles();\n        this.saveState();\n    },\n\n    \n    focus : function(){\n        var f = this.focusEl,\n            db = this.defaultButton,\n            t = typeof db,\n            el,\n            ct;\n        if(Ext.isDefined(db)){\n            if(Ext.isNumber(db) && this.fbar){\n                f = this.fbar.items.get(db);\n            }else if(Ext.isString(db)){\n                f = Ext.getCmp(db);\n            }else{\n                f = db;\n            }\n            el = f.getEl();\n            ct = Ext.getDom(this.container);\n            if (el && ct) {\n                if (ct != document.body && !Ext.lib.Region.getRegion(ct).contains(Ext.lib.Region.getRegion(el.dom))){\n                    return;\n                }\n            }\n        }\n        f = f || this.focusEl;\n        f.focus.defer(10, f);\n    },\n\n    \n    setAnimateTarget : function(el){\n        el = Ext.get(el);\n        this.animateTarget = el;\n    },\n\n    \n    beforeShow : function(){\n        delete this.el.lastXY;\n        delete this.el.lastLT;\n        if(this.x === undefined || this.y === undefined){\n            var xy = this.el.getAlignToXY(this.container, 'c-c');\n            var pos = this.el.translatePoints(xy[0], xy[1]);\n            this.x = this.x === undefined? pos.left : this.x;\n            this.y = this.y === undefined? pos.top : this.y;\n        }\n        this.el.setLeftTop(this.x, this.y);\n\n        if(this.expandOnShow){\n            this.expand(false);\n        }\n\n        if(this.modal){\n            Ext.getBody().addClass('x-body-masked');\n            this.mask.setSize(Ext.lib.Dom.getViewWidth(true), Ext.lib.Dom.getViewHeight(true));\n            this.mask.show();\n        }\n    },\n\n    \n    show : function(animateTarget, cb, scope){\n        if(!this.rendered){\n            this.render(Ext.getBody());\n        }\n        if(this.hidden === false){\n            this.toFront();\n            return this;\n        }\n        if(this.fireEvent('beforeshow', this) === false){\n            return this;\n        }\n        if(cb){\n            this.on('show', cb, scope, {single:true});\n        }\n        this.hidden = false;\n        if(Ext.isDefined(animateTarget)){\n            this.setAnimateTarget(animateTarget);\n        }\n        this.beforeShow();\n        if(this.animateTarget){\n            this.animShow();\n        }else{\n            this.afterShow();\n        }\n        return this;\n    },\n\n    \n    afterShow : function(isAnim){\n        if (this.isDestroyed){\n            return false;\n        }\n        this.proxy.hide();\n        this.el.setStyle('display', 'block');\n        this.el.show();\n        if(this.maximized){\n            this.fitContainer();\n        }\n        if(Ext.isMac && Ext.isGecko2){ \n            this.cascade(this.setAutoScroll);\n        }\n\n        if(this.monitorResize || this.modal || this.constrain || this.constrainHeader){\n            Ext.EventManager.onWindowResize(this.onWindowResize, this);\n        }\n        this.doConstrain();\n        this.doLayout();\n        if(this.keyMap){\n            this.keyMap.enable();\n        }\n        this.toFront();\n        this.updateHandles();\n        if(isAnim && (Ext.isIE || Ext.isWebKit)){\n            var sz = this.getSize();\n            this.onResize(sz.width, sz.height);\n        }\n        this.onShow();\n        this.fireEvent('show', this);\n    },\n\n    \n    animShow : function(){\n        this.proxy.show();\n        this.proxy.setBox(this.animateTarget.getBox());\n        this.proxy.setOpacity(0);\n        var b = this.getBox();\n        this.el.setStyle('display', 'none');\n        this.proxy.shift(Ext.apply(b, {\n            callback: this.afterShow.createDelegate(this, [true], false),\n            scope: this,\n            easing: 'easeNone',\n            duration: this.showAnimDuration,\n            opacity: 0.5\n        }));\n    },\n\n    \n    hide : function(animateTarget, cb, scope){\n        if(this.hidden || this.fireEvent('beforehide', this) === false){\n            return this;\n        }\n        if(cb){\n            this.on('hide', cb, scope, {single:true});\n        }\n        this.hidden = true;\n        if(animateTarget !== undefined){\n            this.setAnimateTarget(animateTarget);\n        }\n        if(this.modal){\n            this.mask.hide();\n            Ext.getBody().removeClass('x-body-masked');\n        }\n        if(this.animateTarget){\n            this.animHide();\n        }else{\n            this.el.hide();\n            this.afterHide();\n        }\n        return this;\n    },\n\n    \n    afterHide : function(){\n        this.proxy.hide();\n        if(this.monitorResize || this.modal || this.constrain || this.constrainHeader){\n            Ext.EventManager.removeResizeListener(this.onWindowResize, this);\n        }\n        if(this.keyMap){\n            this.keyMap.disable();\n        }\n        this.onHide();\n        this.fireEvent('hide', this);\n    },\n\n    \n    animHide : function(){\n        this.proxy.setOpacity(0.5);\n        this.proxy.show();\n        var tb = this.getBox(false);\n        this.proxy.setBox(tb);\n        this.el.hide();\n        this.proxy.shift(Ext.apply(this.animateTarget.getBox(), {\n            callback: this.afterHide,\n            scope: this,\n            duration: this.hideAnimDuration,\n            easing: 'easeNone',\n            opacity: 0\n        }));\n    },\n\n    \n    onShow : Ext.emptyFn,\n\n    \n    onHide : Ext.emptyFn,\n\n    \n    onWindowResize : function(){\n        if(this.maximized){\n            this.fitContainer();\n        }\n        if(this.modal){\n            this.mask.setSize('100%', '100%');\n            var force = this.mask.dom.offsetHeight;\n            this.mask.setSize(Ext.lib.Dom.getViewWidth(true), Ext.lib.Dom.getViewHeight(true));\n        }\n        this.doConstrain();\n    },\n\n    \n    doConstrain : function(){\n        if(this.constrain || this.constrainHeader){\n            var offsets;\n            if(this.constrain){\n                offsets = {\n                    right:this.el.shadowOffset,\n                    left:this.el.shadowOffset,\n                    bottom:this.el.shadowOffset\n                };\n            }else {\n                var s = this.getSize();\n                offsets = {\n                    right:-(s.width - 100),\n                    bottom:-(s.height - 25 + this.el.getConstrainOffset())\n                };\n            }\n\n            var xy = this.el.getConstrainToXY(this.container, true, offsets);\n            if(xy){\n                this.setPosition(xy[0], xy[1]);\n            }\n        }\n    },\n\n    \n    ghost : function(cls){\n        var ghost = this.createGhost(cls);\n        var box = this.getBox(true);\n        ghost.setLeftTop(box.x, box.y);\n        ghost.setWidth(box.width);\n        this.el.hide();\n        this.activeGhost = ghost;\n        return ghost;\n    },\n\n    \n    unghost : function(show, matchPosition){\n        if(!this.activeGhost) {\n            return;\n        }\n        if(show !== false){\n            this.el.show();\n            this.focus.defer(10, this);\n            if(Ext.isMac && Ext.isGecko2){ \n                this.cascade(this.setAutoScroll);\n            }\n        }\n        if(matchPosition !== false){\n            this.setPosition(this.activeGhost.getLeft(true), this.activeGhost.getTop(true));\n        }\n        this.activeGhost.hide();\n        this.activeGhost.remove();\n        delete this.activeGhost;\n    },\n\n    \n    minimize : function(){\n        this.fireEvent('minimize', this);\n        return this;\n    },\n\n    \n    close : function(){\n        if(this.fireEvent('beforeclose', this) !== false){\n            if(this.hidden){\n                this.doClose();\n            }else{\n                this.hide(null, this.doClose, this);\n            }\n        }\n    },\n\n    \n    doClose : function(){\n        this.fireEvent('close', this);\n        this.destroy();\n    },\n\n    \n    maximize : function(){\n        if(!this.maximized){\n            this.expand(false);\n            this.restoreSize = this.getSize();\n            this.restorePos = this.getPosition(true);\n            if (this.maximizable){\n                this.tools.maximize.hide();\n                this.tools.restore.show();\n            }\n            this.maximized = true;\n            this.el.disableShadow();\n\n            if(this.dd){\n                this.dd.lock();\n            }\n            if(this.collapsible){\n                this.tools.toggle.hide();\n            }\n            this.el.addClass('x-window-maximized');\n            this.container.addClass('x-window-maximized-ct');\n\n            this.setPosition(0, 0);\n            this.fitContainer();\n            this.fireEvent('maximize', this);\n        }\n        return this;\n    },\n\n    \n    restore : function(){\n        if(this.maximized){\n            var t = this.tools;\n            this.el.removeClass('x-window-maximized');\n            if(t.restore){\n                t.restore.hide();\n            }\n            if(t.maximize){\n                t.maximize.show();\n            }\n            this.setPosition(this.restorePos[0], this.restorePos[1]);\n            this.setSize(this.restoreSize.width, this.restoreSize.height);\n            delete this.restorePos;\n            delete this.restoreSize;\n            this.maximized = false;\n            this.el.enableShadow(true);\n\n            if(this.dd){\n                this.dd.unlock();\n            }\n            if(this.collapsible && t.toggle){\n                t.toggle.show();\n            }\n            this.container.removeClass('x-window-maximized-ct');\n\n            this.doConstrain();\n            this.fireEvent('restore', this);\n        }\n        return this;\n    },\n\n    \n    toggleMaximize : function(){\n        return this[this.maximized ? 'restore' : 'maximize']();\n    },\n\n    \n    fitContainer : function(){\n        var vs = this.container.getViewSize(false);\n        this.setSize(vs.width, vs.height);\n    },\n\n    \n    \n    setZIndex : function(index){\n        if(this.modal){\n            this.mask.setStyle('z-index', index);\n        }\n        this.el.setZIndex(++index);\n        index += 5;\n\n        if(this.resizer){\n            this.resizer.proxy.setStyle('z-index', ++index);\n        }\n\n        this.lastZIndex = index;\n    },\n\n    \n    alignTo : function(element, position, offsets){\n        var xy = this.el.getAlignToXY(element, position, offsets);\n        this.setPagePosition(xy[0], xy[1]);\n        return this;\n    },\n\n    \n    anchorTo : function(el, alignment, offsets, monitorScroll){\n        this.clearAnchor();\n        this.anchorTarget = {\n            el: el,\n            alignment: alignment,\n            offsets: offsets\n        };\n\n        Ext.EventManager.onWindowResize(this.doAnchor, this);\n        var tm = typeof monitorScroll;\n        if(tm != 'undefined'){\n            Ext.EventManager.on(window, 'scroll', this.doAnchor, this,\n                {buffer: tm == 'number' ? monitorScroll : 50});\n        }\n        return this.doAnchor();\n    },\n\n    \n    doAnchor : function(){\n        var o = this.anchorTarget;\n        this.alignTo(o.el, o.alignment, o.offsets);\n        return this;\n    },\n\n    \n    clearAnchor : function(){\n        if(this.anchorTarget){\n            Ext.EventManager.removeResizeListener(this.doAnchor, this);\n            Ext.EventManager.un(window, 'scroll', this.doAnchor, this);\n            delete this.anchorTarget;\n        }\n        return this;\n    },\n\n    \n    toFront : function(e){\n        if(this.manager.bringToFront(this)){\n            if(!e || !e.getTarget().focus){\n                this.focus();\n            }\n        }\n        return this;\n    },\n\n    \n    setActive : function(active){\n        if(active){\n            if(!this.maximized){\n                this.el.enableShadow(true);\n            }\n            this.fireEvent('activate', this);\n        }else{\n            this.el.disableShadow();\n            this.fireEvent('deactivate', this);\n        }\n    },\n\n    \n    toBack : function(){\n        this.manager.sendToBack(this);\n        return this;\n    },\n\n    \n    center : function(){\n        var xy = this.el.getAlignToXY(this.container, 'c-c');\n        this.setPagePosition(xy[0], xy[1]);\n        return this;\n    }\n\n    \n});\nExt.reg('window', Ext.Window);\n\n\nExt.Window.DD = Ext.extend(Ext.dd.DD, {\n    \n    constructor : function(win){\n        this.win = win;\n        Ext.Window.DD.superclass.constructor.call(this, win.el.id, 'WindowDD-'+win.id);\n        this.setHandleElId(win.header.id);\n        this.scroll = false;        \n    },\n    \n    moveOnly:true,\n    headerOffsets:[100, 25],\n    startDrag : function(){\n        var w = this.win;\n        this.proxy = w.ghost(w.initialConfig.cls);\n        if(w.constrain !== false){\n            var so = w.el.shadowOffset;\n            this.constrainTo(w.container, {right: so, left: so, bottom: so});\n        }else if(w.constrainHeader !== false){\n            var s = this.proxy.getSize();\n            this.constrainTo(w.container, {right: -(s.width-this.headerOffsets[0]), bottom: -(s.height-this.headerOffsets[1])});\n        }\n    },\n    b4Drag : Ext.emptyFn,\n\n    onDrag : function(e){\n        this.alignElWithMouse(this.proxy, e.getPageX(), e.getPageY());\n    },\n\n    endDrag : function(e){\n        this.win.unghost();\n        this.win.saveState();\n    }\n});\n\nExt.WindowGroup = function(){\n    var list = {};\n    var accessList = [];\n    var front = null;\n\n    \n    var sortWindows = function(d1, d2){\n        return (!d1._lastAccess || d1._lastAccess < d2._lastAccess) ? -1 : 1;\n    };\n\n    \n    var orderWindows = function(){\n        var a = accessList, len = a.length;\n        if(len > 0){\n            a.sort(sortWindows);\n            var seed = a[0].manager.zseed;\n            for(var i = 0; i < len; i++){\n                var win = a[i];\n                if(win && !win.hidden){\n                    win.setZIndex(seed + (i*10));\n                }\n            }\n        }\n        activateLast();\n    };\n\n    \n    var setActiveWin = function(win){\n        if(win != front){\n            if(front){\n                front.setActive(false);\n            }\n            front = win;\n            if(win){\n                win.setActive(true);\n            }\n        }\n    };\n\n    \n    var activateLast = function(){\n        for(var i = accessList.length-1; i >=0; --i) {\n            if(!accessList[i].hidden){\n                setActiveWin(accessList[i]);\n                return;\n            }\n        }\n        \n        setActiveWin(null);\n    };\n\n    return {\n        \n        zseed : 9000,\n\n        \n        register : function(win){\n            if(win.manager){\n                win.manager.unregister(win);\n            }\n            win.manager = this;\n\n            list[win.id] = win;\n            accessList.push(win);\n            win.on('hide', activateLast);\n        },\n\n        \n        unregister : function(win){\n            delete win.manager;\n            delete list[win.id];\n            win.un('hide', activateLast);\n            accessList.remove(win);\n        },\n\n        \n        get : function(id){\n            return typeof id == \"object\" ? id : list[id];\n        },\n\n        \n        bringToFront : function(win){\n            win = this.get(win);\n            if(win != front){\n                win._lastAccess = new Date().getTime();\n                orderWindows();\n                return true;\n            }\n            return false;\n        },\n\n        \n        sendToBack : function(win){\n            win = this.get(win);\n            win._lastAccess = -(new Date().getTime());\n            orderWindows();\n            return win;\n        },\n\n        \n        hideAll : function(){\n            for(var id in list){\n                if(list[id] && typeof list[id] != \"function\" && list[id].isVisible()){\n                    list[id].hide();\n                }\n            }\n        },\n\n        \n        getActive : function(){\n            return front;\n        },\n\n        \n        getBy : function(fn, scope){\n            var r = [];\n            for(var i = accessList.length-1; i >=0; --i) {\n                var win = accessList[i];\n                if(fn.call(scope||win, win) !== false){\n                    r.push(win);\n                }\n            }\n            return r;\n        },\n\n        \n        each : function(fn, scope){\n            for(var id in list){\n                if(list[id] && typeof list[id] != \"function\"){\n                    if(fn.call(scope || list[id], list[id]) === false){\n                        return;\n                    }\n                }\n            }\n        }\n    };\n};\n\n\n\nExt.WindowMgr = new Ext.WindowGroup();\nExt.MessageBox = function(){\n    var dlg, opt, mask, waitTimer,\n        bodyEl, msgEl, textboxEl, textareaEl, progressBar, pp, iconEl, spacerEl,\n        buttons, activeTextEl, bwidth, bufferIcon = '', iconCls = '',\n        buttonNames = ['ok', 'yes', 'no', 'cancel'];\n\n    \n    var handleButton = function(button){\n        buttons[button].blur();\n        if(dlg.isVisible()){\n            dlg.hide();\n            handleHide();\n            Ext.callback(opt.fn, opt.scope||window, [button, activeTextEl.dom.value, opt], 1);\n        }\n    };\n\n    \n    var handleHide = function(){\n        if(opt && opt.cls){\n            dlg.el.removeClass(opt.cls);\n        }\n        progressBar.reset();        \n    };\n\n    \n    var handleEsc = function(d, k, e){\n        if(opt && opt.closable !== false){\n            dlg.hide();\n            handleHide();\n        }\n        if(e){\n            e.stopEvent();\n        }\n    };\n\n    \n    var updateButtons = function(b){\n        var width = 0,\n            cfg;\n        if(!b){\n            Ext.each(buttonNames, function(name){\n                buttons[name].hide();\n            });\n            return width;\n        }\n        dlg.footer.dom.style.display = '';\n        Ext.iterate(buttons, function(name, btn){\n            cfg = b[name];\n            if(cfg){\n                btn.show();\n                btn.setText(Ext.isString(cfg) ? cfg : Ext.MessageBox.buttonText[name]);\n                width += btn.getEl().getWidth() + 15;\n            }else{\n                btn.hide();\n            }\n        });\n        return width;\n    };\n\n    return {\n        \n        getDialog : function(titleText){\n           if(!dlg){\n                var btns = [];\n                \n                buttons = {};\n                Ext.each(buttonNames, function(name){\n                    btns.push(buttons[name] = new Ext.Button({\n                        text: this.buttonText[name],\n                        handler: handleButton.createCallback(name),\n                        hideMode: 'offsets'\n                    }));\n                }, this);\n                dlg = new Ext.Window({\n                    autoCreate : true,\n                    title:titleText,\n                    resizable:false,\n                    constrain:true,\n                    constrainHeader:true,\n                    minimizable : false,\n                    maximizable : false,\n                    stateful: false,\n                    modal: true,\n                    shim:true,\n                    buttonAlign:\"center\",\n                    width:400,\n                    height:100,\n                    minHeight: 80,\n                    plain:true,\n                    footer:true,\n                    closable:true,\n                    close : function(){\n                        if(opt && opt.buttons && opt.buttons.no && !opt.buttons.cancel){\n                            handleButton(\"no\");\n                        }else{\n                            handleButton(\"cancel\");\n                        }\n                    },\n                    fbar: new Ext.Toolbar({\n                        items: btns,\n                        enableOverflow: false\n                    })\n                });\n                dlg.render(document.body);\n                dlg.getEl().addClass('x-window-dlg');\n                mask = dlg.mask;\n                bodyEl = dlg.body.createChild({\n                    html:'<div class=\"ext-mb-icon\"></div><div class=\"ext-mb-content\"><span class=\"ext-mb-text\"></span><br /><div class=\"ext-mb-fix-cursor\"><input type=\"text\" class=\"ext-mb-input\" /><textarea class=\"ext-mb-textarea\"></textarea></div></div>'\n                });\n                iconEl = Ext.get(bodyEl.dom.firstChild);\n                var contentEl = bodyEl.dom.childNodes[1];\n                msgEl = Ext.get(contentEl.firstChild);\n                textboxEl = Ext.get(contentEl.childNodes[2].firstChild);\n                textboxEl.enableDisplayMode();\n                textboxEl.addKeyListener([10,13], function(){\n                    if(dlg.isVisible() && opt && opt.buttons){\n                        if(opt.buttons.ok){\n                            handleButton(\"ok\");\n                        }else if(opt.buttons.yes){\n                            handleButton(\"yes\");\n                        }\n                    }\n                });\n                textareaEl = Ext.get(contentEl.childNodes[2].childNodes[1]);\n                textareaEl.enableDisplayMode();\n                progressBar = new Ext.ProgressBar({\n                    renderTo:bodyEl\n                });\n               bodyEl.createChild({cls:'x-clear'});\n            }\n            return dlg;\n        },\n\n        \n        updateText : function(text){\n            if(!dlg.isVisible() && !opt.width){\n                dlg.setSize(this.maxWidth, 100); \n            }\n            \n            msgEl.update(text ? text + ' ' : '&#160;');\n\n            var iw = iconCls != '' ? (iconEl.getWidth() + iconEl.getMargins('lr')) : 0,\n                mw = msgEl.getWidth() + msgEl.getMargins('lr'),\n                fw = dlg.getFrameWidth('lr'),\n                bw = dlg.body.getFrameWidth('lr'),\n                w;\n                \n            w = Math.max(Math.min(opt.width || iw+mw+fw+bw, opt.maxWidth || this.maxWidth),\n                    Math.max(opt.minWidth || this.minWidth, bwidth || 0));\n\n            if(opt.prompt === true){\n                activeTextEl.setWidth(w-iw-fw-bw);\n            }\n            if(opt.progress === true || opt.wait === true){\n                progressBar.setSize(w-iw-fw-bw);\n            }\n            if(Ext.isIE9m && w == bwidth){\n                w += 4; \n            }\n            msgEl.update(text || '&#160;');\n            dlg.setSize(w, 'auto').center();\n            return this;\n        },\n\n        \n        updateProgress : function(value, progressText, msg){\n            progressBar.updateProgress(value, progressText);\n            if(msg){\n                this.updateText(msg);\n            }\n            return this;\n        },\n\n        \n        isVisible : function(){\n            return dlg && dlg.isVisible();\n        },\n\n        \n        hide : function(){\n            var proxy = dlg ? dlg.activeGhost : null;\n            if(this.isVisible() || proxy){\n                dlg.hide();\n                handleHide();\n                if (proxy){\n                    \n                    \n                    dlg.unghost(false, false);\n                } \n            }\n            return this;\n        },\n\n        \n        show : function(options){\n            if(this.isVisible()){\n                this.hide();\n            }\n            opt = options;\n            var d = this.getDialog(opt.title || \"&#160;\");\n\n            d.setTitle(opt.title || \"&#160;\");\n            var allowClose = (opt.closable !== false && opt.progress !== true && opt.wait !== true);\n            d.tools.close.setDisplayed(allowClose);\n            activeTextEl = textboxEl;\n            opt.prompt = opt.prompt || (opt.multiline ? true : false);\n            if(opt.prompt){\n                if(opt.multiline){\n                    textboxEl.hide();\n                    textareaEl.show();\n                    textareaEl.setHeight(Ext.isNumber(opt.multiline) ? opt.multiline : this.defaultTextHeight);\n                    activeTextEl = textareaEl;\n                }else{\n                    textboxEl.show();\n                    textareaEl.hide();\n                }\n            }else{\n                textboxEl.hide();\n                textareaEl.hide();\n            }\n            activeTextEl.dom.value = opt.value || \"\";\n            if(opt.prompt){\n                d.focusEl = activeTextEl;\n            }else{\n                var bs = opt.buttons;\n                var db = null;\n                if(bs && bs.ok){\n                    db = buttons[\"ok\"];\n                }else if(bs && bs.yes){\n                    db = buttons[\"yes\"];\n                }\n                if (db){\n                    d.focusEl = db;\n                }\n            }\n            if(Ext.isDefined(opt.iconCls)){\n              d.setIconClass(opt.iconCls);\n            }\n            this.setIcon(Ext.isDefined(opt.icon) ? opt.icon : bufferIcon);\n            bwidth = updateButtons(opt.buttons);\n            progressBar.setVisible(opt.progress === true || opt.wait === true);\n            this.updateProgress(0, opt.progressText);\n            this.updateText(opt.msg);\n            if(opt.cls){\n                d.el.addClass(opt.cls);\n            }\n            d.proxyDrag = opt.proxyDrag === true;\n            d.modal = opt.modal !== false;\n            d.mask = opt.modal !== false ? mask : false;\n            if(!d.isVisible()){\n                \n                document.body.appendChild(dlg.el.dom);\n                d.setAnimateTarget(opt.animEl);\n                \n                d.on('show', function(){\n                    if(allowClose === true){\n                        d.keyMap.enable();\n                    }else{\n                        d.keyMap.disable();\n                    }\n                }, this, {single:true});\n                d.show(opt.animEl);\n            }\n            if(opt.wait === true){\n                progressBar.wait(opt.waitConfig);\n            }\n            return this;\n        },\n\n        \n        setIcon : function(icon){\n            if(!dlg){\n                bufferIcon = icon;\n                return;\n            }\n            bufferIcon = undefined;\n            if(icon && icon != ''){\n                iconEl.removeClass('x-hidden');\n                iconEl.replaceClass(iconCls, icon);\n                bodyEl.addClass('x-dlg-icon');\n                iconCls = icon;\n            }else{\n                iconEl.replaceClass(iconCls, 'x-hidden');\n                bodyEl.removeClass('x-dlg-icon');\n                iconCls = '';\n            }\n            return this;\n        },\n\n        \n        progress : function(title, msg, progressText){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: false,\n                progress:true,\n                closable:false,\n                minWidth: this.minProgressWidth,\n                progressText: progressText\n            });\n            return this;\n        },\n\n        \n        wait : function(msg, title, config){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: false,\n                closable:false,\n                wait:true,\n                modal:true,\n                minWidth: this.minProgressWidth,\n                waitConfig: config\n            });\n            return this;\n        },\n\n        \n        alert : function(title, msg, fn, scope){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: this.OK,\n                fn: fn,\n                scope : scope,\n                minWidth: this.minWidth\n            });\n            return this;\n        },\n\n        \n        confirm : function(title, msg, fn, scope){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: this.YESNO,\n                fn: fn,\n                scope : scope,\n                icon: this.QUESTION,\n                minWidth: this.minWidth\n            });\n            return this;\n        },\n\n        \n        prompt : function(title, msg, fn, scope, multiline, value){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: this.OKCANCEL,\n                fn: fn,\n                minWidth: this.minPromptWidth,\n                scope : scope,\n                prompt:true,\n                multiline: multiline,\n                value: value\n            });\n            return this;\n        },\n\n        \n        OK : {ok:true},\n        \n        CANCEL : {cancel:true},\n        \n        OKCANCEL : {ok:true, cancel:true},\n        \n        YESNO : {yes:true, no:true},\n        \n        YESNOCANCEL : {yes:true, no:true, cancel:true},\n        \n        INFO : 'ext-mb-info',\n        \n        WARNING : 'ext-mb-warning',\n        \n        QUESTION : 'ext-mb-question',\n        \n        ERROR : 'ext-mb-error',\n\n        \n        defaultTextHeight : 75,\n        \n        maxWidth : 600,\n        \n        minWidth : 100,\n        \n        minProgressWidth : 250,\n        \n        minPromptWidth: 250,\n        \n        buttonText : {\n            ok : \"OK\",\n            cancel : \"Cancel\",\n            yes : \"Yes\",\n            no : \"No\"\n        }\n    };\n}();\n\n\nExt.Msg = Ext.MessageBox;\nExt.dd.PanelProxy  = Ext.extend(Object, {\n    \n    constructor : function(panel, config){\n        this.panel = panel;\n        this.id = this.panel.id +'-ddproxy';\n        Ext.apply(this, config);        \n    },\n    \n    \n    insertProxy : true,\n\n    \n    setStatus : Ext.emptyFn,\n    reset : Ext.emptyFn,\n    update : Ext.emptyFn,\n    stop : Ext.emptyFn,\n    sync: Ext.emptyFn,\n\n    \n    getEl : function(){\n        return this.ghost;\n    },\n\n    \n    getGhost : function(){\n        return this.ghost;\n    },\n\n    \n    getProxy : function(){\n        return this.proxy;\n    },\n\n    \n    hide : function(){\n        if(this.ghost){\n            if(this.proxy){\n                this.proxy.remove();\n                delete this.proxy;\n            }\n            this.panel.el.dom.style.display = '';\n            this.ghost.remove();\n            delete this.ghost;\n        }\n    },\n\n    \n    show : function(){\n        if(!this.ghost){\n            this.ghost = this.panel.createGhost(this.panel.initialConfig.cls, undefined, Ext.getBody());\n            this.ghost.setXY(this.panel.el.getXY());\n            if(this.insertProxy){\n                this.proxy = this.panel.el.insertSibling({cls:'x-panel-dd-spacer'});\n                this.proxy.setSize(this.panel.getSize());\n            }\n            this.panel.el.dom.style.display = 'none';\n        }\n    },\n\n    \n    repair : function(xy, callback, scope){\n        this.hide();\n        if(typeof callback == \"function\"){\n            callback.call(scope || this);\n        }\n    },\n\n    \n    moveProxy : function(parentNode, before){\n        if(this.proxy){\n            parentNode.insertBefore(this.proxy.dom, before);\n        }\n    }\n});\n\n\nExt.Panel.DD = Ext.extend(Ext.dd.DragSource, {\n    \n    constructor : function(panel, cfg){\n        this.panel = panel;\n        this.dragData = {panel: panel};\n        this.proxy = new Ext.dd.PanelProxy(panel, cfg);\n        Ext.Panel.DD.superclass.constructor.call(this, panel.el, cfg);\n        var h = panel.header,\n            el = panel.body;\n        if(h){\n            this.setHandleElId(h.id);\n            el = panel.header;\n        }\n        el.setStyle('cursor', 'move');\n        this.scroll = false;        \n    },\n    \n    showFrame: Ext.emptyFn,\n    startDrag: Ext.emptyFn,\n    b4StartDrag: function(x, y) {\n        this.proxy.show();\n    },\n    b4MouseDown: function(e) {\n        var x = e.getPageX(),\n            y = e.getPageY();\n        this.autoOffset(x, y);\n    },\n    onInitDrag : function(x, y){\n        this.onStartDrag(x, y);\n        return true;\n    },\n    createFrame : Ext.emptyFn,\n    getDragEl : function(e){\n        return this.proxy.ghost.dom;\n    },\n    endDrag : function(e){\n        this.proxy.hide();\n        this.panel.saveState();\n    },\n\n    autoOffset : function(x, y) {\n        x -= this.startPageX;\n        y -= this.startPageY;\n        this.setDelta(x, y);\n    }\n});\nExt.state.Provider = Ext.extend(Ext.util.Observable, {\n    \n    constructor : function(){\n        \n        this.addEvents(\"statechange\");\n        this.state = {};\n        Ext.state.Provider.superclass.constructor.call(this);\n    },\n    \n    \n    get : function(name, defaultValue){\n        return typeof this.state[name] == \"undefined\" ?\n            defaultValue : this.state[name];\n    },\n\n    \n    clear : function(name){\n        delete this.state[name];\n        this.fireEvent(\"statechange\", this, name, null);\n    },\n\n    \n    set : function(name, value){\n        this.state[name] = value;\n        this.fireEvent(\"statechange\", this, name, value);\n    },\n\n    \n    decodeValue : function(cookie){\n        \n        var re = /^(a|n|d|b|s|o|e)\\:(.*)$/,\n            matches = re.exec(unescape(cookie)),\n            all,\n            type,\n            v,\n            kv;\n        if(!matches || !matches[1]){\n            return; \n        }\n        type = matches[1];\n        v = matches[2];\n        switch(type){\n            case 'e':\n                return null;\n            case 'n':\n                return parseFloat(v);\n            case 'd':\n                return new Date(Date.parse(v));\n            case 'b':\n                return (v == '1');\n            case 'a':\n                all = [];\n                if(v != ''){\n                    Ext.each(v.split('^'), function(val){\n                        all.push(this.decodeValue(val));\n                    }, this);\n                }\n                return all;\n           case 'o':\n                all = {};\n                if(v != ''){\n                    Ext.each(v.split('^'), function(val){\n                        kv = val.split('=');\n                        all[kv[0]] = this.decodeValue(kv[1]);\n                    }, this);\n                }\n                return all;\n           default:\n                return v;\n        }\n    },\n\n    \n    encodeValue : function(v){\n        var enc,\n            flat = '',\n            i = 0,\n            len,\n            key;\n        if(v == null){\n            return 'e:1';    \n        }else if(typeof v == 'number'){\n            enc = 'n:' + v;\n        }else if(typeof v == 'boolean'){\n            enc = 'b:' + (v ? '1' : '0');\n        }else if(Ext.isDate(v)){\n            enc = 'd:' + v.toGMTString();\n        }else if(Ext.isArray(v)){\n            for(len = v.length; i < len; i++){\n                flat += this.encodeValue(v[i]);\n                if(i != len - 1){\n                    flat += '^';\n                }\n            }\n            enc = 'a:' + flat;\n        }else if(typeof v == 'object'){\n            for(key in v){\n                if(typeof v[key] != 'function' && v[key] !== undefined){\n                    flat += key + '=' + this.encodeValue(v[key]) + '^';\n                }\n            }\n            enc = 'o:' + flat.substring(0, flat.length-1);\n        }else{\n            enc = 's:' + v;\n        }\n        return escape(enc);\n    }\n});\n\nExt.state.Manager = function(){\n    var provider = new Ext.state.Provider();\n\n    return {\n        \n        setProvider : function(stateProvider){\n            provider = stateProvider;\n        },\n\n        \n        get : function(key, defaultValue){\n            return provider.get(key, defaultValue);\n        },\n\n        \n         set : function(key, value){\n            provider.set(key, value);\n        },\n\n        \n        clear : function(key){\n            provider.clear(key);\n        },\n\n        \n        getProvider : function(){\n            return provider;\n        }\n    };\n}();\n\nExt.state.CookieProvider = Ext.extend(Ext.state.Provider, {\n    \n    constructor : function(config){\n        Ext.state.CookieProvider.superclass.constructor.call(this);\n        this.path = \"/\";\n        this.expires = new Date(new Date().getTime()+(1000*60*60*24*7)); \n        this.domain = null;\n        this.secure = false;\n        Ext.apply(this, config);\n        this.state = this.readCookies();\n    },\n    \n    \n    set : function(name, value){\n        if(typeof value == \"undefined\" || value === null){\n            this.clear(name);\n            return;\n        }\n        this.setCookie(name, value);\n        Ext.state.CookieProvider.superclass.set.call(this, name, value);\n    },\n\n    \n    clear : function(name){\n        this.clearCookie(name);\n        Ext.state.CookieProvider.superclass.clear.call(this, name);\n    },\n\n    \n    readCookies : function(){\n        var cookies = {},\n            c = document.cookie + \";\",\n            re = /\\s?(.*?)=(.*?);/g,\n    \t    matches,\n            name,\n            value;\n    \twhile((matches = re.exec(c)) != null){\n            name = matches[1];\n            value = matches[2];\n            if(name && name.substring(0,3) == \"ys-\"){\n                cookies[name.substr(3)] = this.decodeValue(value);\n            }\n        }\n        return cookies;\n    },\n\n    \n    setCookie : function(name, value){\n        document.cookie = \"ys-\"+ name + \"=\" + this.encodeValue(value) +\n           ((this.expires == null) ? \"\" : (\"; expires=\" + this.expires.toGMTString())) +\n           ((this.path == null) ? \"\" : (\"; path=\" + this.path)) +\n           ((this.domain == null) ? \"\" : (\"; domain=\" + this.domain)) +\n           ((this.secure == true) ? \"; secure\" : \"\");\n    },\n\n    \n    clearCookie : function(name){\n        document.cookie = \"ys-\" + name + \"=null; expires=Thu, 01-Jan-70 00:00:01 GMT\" +\n           ((this.path == null) ? \"\" : (\"; path=\" + this.path)) +\n           ((this.domain == null) ? \"\" : (\"; domain=\" + this.domain)) +\n           ((this.secure == true) ? \"; secure\" : \"\");\n    }\n});\nExt.DataView = Ext.extend(Ext.BoxComponent, {\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    selectedClass : \"x-view-selected\",\n    \n    emptyText : \"\",\n\n    \n    deferEmptyText: true,\n    \n    trackOver: false,\n    \n    \n    blockRefresh: false,\n\n    \n    last: false,\n\n    \n    initComponent : function(){\n        Ext.DataView.superclass.initComponent.call(this);\n        if(Ext.isString(this.tpl) || Ext.isArray(this.tpl)){\n            this.tpl = new Ext.XTemplate(this.tpl);\n        }\n\n        this.addEvents(\n            \n            \"beforeclick\",\n            \n            \"click\",\n            \n            \"mouseenter\",\n            \n            \"mouseleave\",\n            \n            \"containerclick\",\n            \n            \"dblclick\",\n            \n            \"contextmenu\",\n            \n            \"containercontextmenu\",\n            \n            \"selectionchange\",\n\n            \n            \"beforeselect\"\n        );\n\n        this.store = Ext.StoreMgr.lookup(this.store);\n        this.all = new Ext.CompositeElementLite();\n        this.selected = new Ext.CompositeElementLite();\n    },\n\n    \n    afterRender : function(){\n        Ext.DataView.superclass.afterRender.call(this);\n\n\t\tthis.mon(this.getTemplateTarget(), {\n            \"click\": this.onClick,\n            \"dblclick\": this.onDblClick,\n            \"contextmenu\": this.onContextMenu,\n            scope:this\n        });\n\n        if(this.overClass || this.trackOver){\n            this.mon(this.getTemplateTarget(), {\n                \"mouseover\": this.onMouseOver,\n                \"mouseout\": this.onMouseOut,\n                scope:this\n            });\n        }\n\n        if(this.store){\n            this.bindStore(this.store, true);\n        }\n    },\n\n    \n    refresh : function() {\n        this.clearSelections(false, true);\n        var el = this.getTemplateTarget(),\n            records = this.store.getRange();\n            \n        el.update('');\n        if(records.length < 1){\n            if(!this.deferEmptyText || this.hasSkippedEmptyText){\n                el.update(this.emptyText);\n            }\n            this.all.clear();\n        }else{\n            this.tpl.overwrite(el, this.collectData(records, 0));\n            this.all.fill(Ext.query(this.itemSelector, el.dom));\n            this.updateIndexes(0);\n        }\n        this.hasSkippedEmptyText = true;\n    },\n\n    getTemplateTarget: function(){\n        return this.el;\n    },\n\n    \n    prepareData : function(data){\n        return data;\n    },\n\n    \n    collectData : function(records, startIndex){\n        var r = [],\n            i = 0,\n            len = records.length;\n        for(; i < len; i++){\n            r[r.length] = this.prepareData(records[i].data, startIndex + i, records[i]);\n        }\n        return r;\n    },\n\n    \n    bufferRender : function(records, index){\n        var div = document.createElement('div');\n        this.tpl.overwrite(div, this.collectData(records, index));\n        return Ext.query(this.itemSelector, div);\n    },\n\n    \n    onUpdate : function(ds, record){\n        var index = this.store.indexOf(record);\n        if(index > -1){\n            var sel = this.isSelected(index),\n                original = this.all.elements[index],\n                node = this.bufferRender([record], index)[0];\n\n            this.all.replaceElement(index, node, true);\n            if(sel){\n                this.selected.replaceElement(original, node);\n                this.all.item(index).addClass(this.selectedClass);\n            }\n            this.updateIndexes(index, index);\n        }\n    },\n\n    \n    onAdd : function(ds, records, index){\n        if(this.all.getCount() === 0){\n            this.refresh();\n            return;\n        }\n        var nodes = this.bufferRender(records, index), n, a = this.all.elements;\n        if(index < this.all.getCount()){\n            n = this.all.item(index).insertSibling(nodes, 'before', true);\n            a.splice.apply(a, [index, 0].concat(nodes));\n        }else{\n            n = this.all.last().insertSibling(nodes, 'after', true);\n            a.push.apply(a, nodes);\n        }\n        this.updateIndexes(index);\n    },\n\n    \n    onRemove : function(ds, record, index){\n        this.deselect(index);\n        this.all.removeElement(index, true);\n        this.updateIndexes(index);\n        if (this.store.getCount() === 0){\n            this.refresh();\n        }\n    },\n\n    \n    refreshNode : function(index){\n        this.onUpdate(this.store, this.store.getAt(index));\n    },\n\n    \n    updateIndexes : function(startIndex, endIndex){\n        var ns = this.all.elements;\n        startIndex = startIndex || 0;\n        endIndex = endIndex || ((endIndex === 0) ? 0 : (ns.length - 1));\n        for(var i = startIndex; i <= endIndex; i++){\n            ns[i].viewIndex = i;\n        }\n    },\n    \n    \n    getStore : function(){\n        return this.store;\n    },\n\n    \n    bindStore : function(store, initial){\n        if(!initial && this.store){\n            if(store !== this.store && this.store.autoDestroy){\n                this.store.destroy();\n            }else{\n                this.store.un(\"beforeload\", this.onBeforeLoad, this);\n                this.store.un(\"datachanged\", this.onDataChanged, this);\n                this.store.un(\"add\", this.onAdd, this);\n                this.store.un(\"remove\", this.onRemove, this);\n                this.store.un(\"update\", this.onUpdate, this);\n                this.store.un(\"clear\", this.refresh, this);\n            }\n            if(!store){\n                this.store = null;\n            }\n        }\n        if(store){\n            store = Ext.StoreMgr.lookup(store);\n            store.on({\n                scope: this,\n                beforeload: this.onBeforeLoad,\n                datachanged: this.onDataChanged,\n                add: this.onAdd,\n                remove: this.onRemove,\n                update: this.onUpdate,\n                clear: this.refresh\n            });\n        }\n        this.store = store;\n        if(store){\n            this.refresh();\n        }\n    },\n    \n    \n    onDataChanged: function() {\n        if (this.blockRefresh !== true) {\n            this.refresh.apply(this, arguments);\n        }\n    },\n\n    \n    findItemFromChild : function(node){\n        return Ext.fly(node).findParent(this.itemSelector, this.getTemplateTarget());\n    },\n\n    \n    onClick : function(e){\n        var item = e.getTarget(this.itemSelector, this.getTemplateTarget()),\n            index;\n        if(item){\n            index = this.indexOf(item);\n            if(this.onItemClick(item, index, e) !== false){\n                this.fireEvent(\"click\", this, index, item, e);\n            }\n        }else{\n            if(this.fireEvent(\"containerclick\", this, e) !== false){\n                this.onContainerClick(e);\n            }\n        }\n    },\n\n    onContainerClick : function(e){\n        this.clearSelections();\n    },\n\n    \n    onContextMenu : function(e){\n        var item = e.getTarget(this.itemSelector, this.getTemplateTarget());\n        if(item){\n            this.fireEvent(\"contextmenu\", this, this.indexOf(item), item, e);\n        }else{\n            this.fireEvent(\"containercontextmenu\", this, e);\n        }\n    },\n\n    \n    onDblClick : function(e){\n        var item = e.getTarget(this.itemSelector, this.getTemplateTarget());\n        if(item){\n            this.fireEvent(\"dblclick\", this, this.indexOf(item), item, e);\n        }\n    },\n\n    \n    onMouseOver : function(e){\n        var item = e.getTarget(this.itemSelector, this.getTemplateTarget());\n        if(item && item !== this.lastItem){\n            this.lastItem = item;\n            Ext.fly(item).addClass(this.overClass);\n            this.fireEvent(\"mouseenter\", this, this.indexOf(item), item, e);\n        }\n    },\n\n    \n    onMouseOut : function(e){\n        if(this.lastItem){\n            if(!e.within(this.lastItem, true, true)){\n                Ext.fly(this.lastItem).removeClass(this.overClass);\n                this.fireEvent(\"mouseleave\", this, this.indexOf(this.lastItem), this.lastItem, e);\n                delete this.lastItem;\n            }\n        }\n    },\n\n    \n    onItemClick : function(item, index, e){\n        if(this.fireEvent(\"beforeclick\", this, index, item, e) === false){\n            return false;\n        }\n        if(this.multiSelect){\n            this.doMultiSelection(item, index, e);\n            e.preventDefault();\n        }else if(this.singleSelect){\n            this.doSingleSelection(item, index, e);\n            e.preventDefault();\n        }\n        return true;\n    },\n\n    \n    doSingleSelection : function(item, index, e){\n        if(e.ctrlKey && this.isSelected(index)){\n            this.deselect(index);\n        }else{\n            this.select(index, false);\n        }\n    },\n\n    \n    doMultiSelection : function(item, index, e){\n        if(e.shiftKey && this.last !== false){\n            var last = this.last;\n            this.selectRange(last, index, e.ctrlKey);\n            this.last = last; \n        }else{\n            if((e.ctrlKey||this.simpleSelect) && this.isSelected(index)){\n                this.deselect(index);\n            }else{\n                this.select(index, e.ctrlKey || e.shiftKey || this.simpleSelect);\n            }\n        }\n    },\n\n    \n    getSelectionCount : function(){\n        return this.selected.getCount();\n    },\n\n    \n    getSelectedNodes : function(){\n        return this.selected.elements;\n    },\n\n    \n    getSelectedIndexes : function(){\n        var indexes = [], \n            selected = this.selected.elements,\n            i = 0,\n            len = selected.length;\n            \n        for(; i < len; i++){\n            indexes.push(selected[i].viewIndex);\n        }\n        return indexes;\n    },\n\n    \n    getSelectedRecords : function(){\n        return this.getRecords(this.selected.elements);\n    },\n\n    \n    getRecords : function(nodes){\n        var records = [], \n            i = 0,\n            len = nodes.length;\n            \n        for(; i < len; i++){\n            records[records.length] = this.store.getAt(nodes[i].viewIndex);\n        }\n        return records;\n    },\n\n    \n    getRecord : function(node){\n        return this.store.getAt(node.viewIndex);\n    },\n\n    \n    clearSelections : function(suppressEvent, skipUpdate){\n        if((this.multiSelect || this.singleSelect) && this.selected.getCount() > 0){\n            if(!skipUpdate){\n                this.selected.removeClass(this.selectedClass);\n            }\n            this.selected.clear();\n            this.last = false;\n            if(!suppressEvent){\n                this.fireEvent(\"selectionchange\", this, this.selected.elements);\n            }\n        }\n    },\n\n    \n    isSelected : function(node){\n        return this.selected.contains(this.getNode(node));\n    },\n\n    \n    deselect : function(node){\n        if(this.isSelected(node)){\n            node = this.getNode(node);\n            this.selected.removeElement(node);\n            if(this.last == node.viewIndex){\n                this.last = false;\n            }\n            Ext.fly(node).removeClass(this.selectedClass);\n            this.fireEvent(\"selectionchange\", this, this.selected.elements);\n        }\n    },\n\n    \n    select : function(nodeInfo, keepExisting, suppressEvent){\n        if(Ext.isArray(nodeInfo)){\n            if(!keepExisting){\n                this.clearSelections(true);\n            }\n            for(var i = 0, len = nodeInfo.length; i < len; i++){\n                this.select(nodeInfo[i], true, true);\n            }\n            if(!suppressEvent){\n                this.fireEvent(\"selectionchange\", this, this.selected.elements);\n            }\n        } else{\n            var node = this.getNode(nodeInfo);\n            if(!keepExisting){\n                this.clearSelections(true);\n            }\n            if(node && !this.isSelected(node)){\n                if(this.fireEvent(\"beforeselect\", this, node, this.selected.elements) !== false){\n                    Ext.fly(node).addClass(this.selectedClass);\n                    this.selected.add(node);\n                    this.last = node.viewIndex;\n                    if(!suppressEvent){\n                        this.fireEvent(\"selectionchange\", this, this.selected.elements);\n                    }\n                }\n            }\n        }\n    },\n\n    \n    selectRange : function(start, end, keepExisting){\n        if(!keepExisting){\n            this.clearSelections(true);\n        }\n        this.select(this.getNodes(start, end), true);\n    },\n\n    \n    getNode : function(nodeInfo){\n        if(Ext.isString(nodeInfo)){\n            return document.getElementById(nodeInfo);\n        }else if(Ext.isNumber(nodeInfo)){\n            return this.all.elements[nodeInfo];\n        }else if(nodeInfo instanceof Ext.data.Record){\n            var idx = this.store.indexOf(nodeInfo);\n            return this.all.elements[idx];\n        }\n        return nodeInfo;\n    },\n\n    \n    getNodes : function(start, end){\n        var ns = this.all.elements,\n            nodes = [],\n            i;\n            \n        start = start || 0;\n        end = !Ext.isDefined(end) ? Math.max(ns.length - 1, 0) : end;\n        if(start <= end){\n            for(i = start; i <= end && ns[i]; i++){\n                nodes.push(ns[i]);\n            }\n        } else{\n            for(i = start; i >= end && ns[i]; i--){\n                nodes.push(ns[i]);\n            }\n        }\n        return nodes;\n    },\n\n    \n    indexOf : function(node){\n        node = this.getNode(node);\n        if(Ext.isNumber(node.viewIndex)){\n            return node.viewIndex;\n        }\n        return this.all.indexOf(node);\n    },\n\n    \n    onBeforeLoad : function(){\n        if(this.loadingText){\n            this.clearSelections(false, true);\n            this.getTemplateTarget().update('<div class=\"loading-indicator\">'+this.loadingText+'</div>');\n            this.all.clear();\n        }\n    },\n\n    onDestroy : function(){\n        this.all.clear();\n        this.selected.clear();\n        Ext.DataView.superclass.onDestroy.call(this);\n        this.bindStore(null);\n    }\n});\n\n\nExt.DataView.prototype.setStore = Ext.DataView.prototype.bindStore;\n\nExt.reg('dataview', Ext.DataView);\n\nExt.list.ListView = Ext.extend(Ext.DataView, {\n    \n    \n    \n    itemSelector: 'dl',\n    \n    selectedClass:'x-list-selected',\n    \n    overClass:'x-list-over',\n    \n    \n    scrollOffset : undefined,\n    \n    columnResize: true,\n    \n    \n    columnSort: true,\n    \n\n    \n    maxColumnWidth: Ext.isIE9m ? 99 : 100,\n\n    initComponent : function(){\n        if(this.columnResize){\n            this.colResizer = new Ext.list.ColumnResizer(this.colResizer);\n            this.colResizer.init(this);\n        }\n        if(this.columnSort){\n            this.colSorter = new Ext.list.Sorter(this.columnSort);\n            this.colSorter.init(this);\n        }\n        if(!this.internalTpl){\n            this.internalTpl = new Ext.XTemplate(\n                '<div class=\"x-list-header\"><div class=\"x-list-header-inner\">',\n                    '<tpl for=\"columns\">',\n                    '<div style=\"width:{[values.width*100]}%;text-align:{align};\"><em class=\"x-unselectable\" unselectable=\"on\" id=\"',this.id, '-xlhd-{#}\">',\n                        '{header}',\n                    '</em></div>',\n                    '</tpl>',\n                    '<div class=\"x-clear\"></div>',\n                '</div></div>',\n                '<div class=\"x-list-body\"><div class=\"x-list-body-inner\">',\n                '</div></div>'\n            );\n        }\n        if(!this.tpl){\n            this.tpl = new Ext.XTemplate(\n                '<tpl for=\"rows\">',\n                    '<dl>',\n                        '<tpl for=\"parent.columns\">',\n                        '<dt style=\"width:{[values.width*100]}%;text-align:{align};\">',\n                        '<em unselectable=\"on\"<tpl if=\"cls\"> class=\"{cls}</tpl>\">',\n                            '{[values.tpl.apply(parent)]}',\n                        '</em></dt>',\n                        '</tpl>',\n                        '<div class=\"x-clear\"></div>',\n                    '</dl>',\n                '</tpl>'\n            );\n        };\n\n        var cs = this.columns,\n            allocatedWidth = 0,\n            colsWithWidth = 0,\n            len = cs.length,\n            columns = [];\n\n        for(var i = 0; i < len; i++){\n            var c = cs[i];\n            if(!c.isColumn) {\n                c.xtype = c.xtype ? (/^lv/.test(c.xtype) ? c.xtype : 'lv' + c.xtype) : 'lvcolumn';\n                c = Ext.create(c);\n            }\n            if(c.width) {\n                allocatedWidth += c.width*100;\n                if(allocatedWidth > this.maxColumnWidth){\n                    c.width -= (allocatedWidth - this.maxColumnWidth) / 100;\n                }\n                colsWithWidth++;\n            }\n            columns.push(c);\n        }\n\n        cs = this.columns = columns;\n\n        \n        if(colsWithWidth < len){\n            var remaining = len - colsWithWidth;\n            if(allocatedWidth < this.maxColumnWidth){\n                var perCol = ((this.maxColumnWidth-allocatedWidth) / remaining)/100;\n                for(var j = 0; j < len; j++){\n                    var c = cs[j];\n                    if(!c.width){\n                        c.width = perCol;\n                    }\n                }\n            }\n        }\n        Ext.list.ListView.superclass.initComponent.call(this);\n    },\n\n    onRender : function(){\n        this.autoEl = {\n            cls: 'x-list-wrap'\n        };\n        Ext.list.ListView.superclass.onRender.apply(this, arguments);\n\n        this.internalTpl.overwrite(this.el, {columns: this.columns});\n\n        this.innerBody = Ext.get(this.el.dom.childNodes[1].firstChild);\n        this.innerHd = Ext.get(this.el.dom.firstChild.firstChild);\n\n        if(this.hideHeaders){\n            this.el.dom.firstChild.style.display = 'none';\n        }\n    },\n\n    getTemplateTarget : function(){\n        return this.innerBody;\n    },\n\n    \n    collectData : function(){\n        var rs = Ext.list.ListView.superclass.collectData.apply(this, arguments);\n        return {\n            columns: this.columns,\n            rows: rs\n        };\n    },\n\n    verifyInternalSize : function(){\n        if(this.lastSize){\n            this.onResize(this.lastSize.width, this.lastSize.height);\n        }\n    },\n\n    \n    onResize : function(w, h){\n        var body = this.innerBody.dom,\n            header = this.innerHd.dom,\n            scrollWidth = w - Ext.num(this.scrollOffset, Ext.getScrollBarWidth()) + 'px',\n            parentNode;\n            \n        if(!body){\n            return;\n        }\n        parentNode = body.parentNode;\n        if(Ext.isNumber(w)){\n            if(this.reserveScrollOffset || ((parentNode.offsetWidth - parentNode.clientWidth) > 10)){\n                body.style.width = scrollWidth;\n                header.style.width = scrollWidth;\n            }else{\n                body.style.width = w + 'px';\n                header.style.width = w + 'px';\n                setTimeout(function(){\n                    if((parentNode.offsetWidth - parentNode.clientWidth) > 10){\n                        body.style.width = scrollWidth;\n                        header.style.width = scrollWidth;\n                    }\n                }, 10);\n            }\n        }\n        if(Ext.isNumber(h)){\n            parentNode.style.height = Math.max(0, h - header.parentNode.offsetHeight) + 'px';\n        }\n    },\n\n    updateIndexes : function(){\n        Ext.list.ListView.superclass.updateIndexes.apply(this, arguments);\n        this.verifyInternalSize();\n    },\n\n    findHeaderIndex : function(header){\n        header = header.dom || header;\n        var parentNode = header.parentNode, \n            children = parentNode.parentNode.childNodes,\n            i = 0,\n            c;\n        for(; c = children[i]; i++){\n            if(c == parentNode){\n                return i;\n            }\n        }\n        return -1;\n    },\n\n    setHdWidths : function(){\n        var els = this.innerHd.dom.getElementsByTagName('div'),\n            i = 0,\n            columns = this.columns,\n            len = columns.length;\n            \n        for(; i < len; i++){\n            els[i].style.width = (columns[i].width*100) + '%';\n        }\n    }\n});\n\nExt.reg('listview', Ext.list.ListView);\n\n\nExt.ListView = Ext.list.ListView;\nExt.list.Column = Ext.extend(Object, {\n    \n    isColumn: true,\n    \n            \n    align: 'left',\n        \n    header: '',\n    \n        \n    width: null,\n\n    \n    cls: '',\n    \n    \n\n    \n    \n    constructor : function(c){\n        if(!c.tpl){\n            c.tpl = new Ext.XTemplate('{' + c.dataIndex + '}');\n        }\n        else if(Ext.isString(c.tpl)){\n            c.tpl = new Ext.XTemplate(c.tpl);\n        }\n        \n        Ext.apply(this, c);\n    }\n});\n\nExt.reg('lvcolumn', Ext.list.Column);\n\n\nExt.list.NumberColumn = Ext.extend(Ext.list.Column, {\n        \n    format: '0,000.00',\n    \n    constructor : function(c) {\n        c.tpl = c.tpl || new Ext.XTemplate('{' + c.dataIndex + ':number(\"' + (c.format || this.format) + '\")}');       \n        Ext.list.NumberColumn.superclass.constructor.call(this, c);\n    }\n});\n\nExt.reg('lvnumbercolumn', Ext.list.NumberColumn);\n\n\nExt.list.DateColumn = Ext.extend(Ext.list.Column, {\n    format: 'm/d/Y',\n    constructor : function(c) {\n        c.tpl = c.tpl || new Ext.XTemplate('{' + c.dataIndex + ':date(\"' + (c.format || this.format) + '\")}');      \n        Ext.list.DateColumn.superclass.constructor.call(this, c);\n    }\n});\nExt.reg('lvdatecolumn', Ext.list.DateColumn);\n\n\nExt.list.BooleanColumn = Ext.extend(Ext.list.Column, {\n    \n    trueText: 'true',\n    \n    falseText: 'false',\n    \n    undefinedText: '&#160;',\n    \n    constructor : function(c) {\n        c.tpl = c.tpl || new Ext.XTemplate('{' + c.dataIndex + ':this.format}');\n        \n        var t = this.trueText, f = this.falseText, u = this.undefinedText;\n        c.tpl.format = function(v){\n            if(v === undefined){\n                return u;\n            }\n            if(!v || v === 'false'){\n                return f;\n            }\n            return t;\n        };\n        \n        Ext.list.DateColumn.superclass.constructor.call(this, c);\n    }\n});\n\nExt.reg('lvbooleancolumn', Ext.list.BooleanColumn);\nExt.list.ColumnResizer = Ext.extend(Ext.util.Observable, {\n    \n    minPct: .05,\n\n    constructor: function(config){\n        Ext.apply(this, config);\n        Ext.list.ColumnResizer.superclass.constructor.call(this);\n    },\n    init : function(listView){\n        this.view = listView;\n        listView.on('render', this.initEvents, this);\n    },\n\n    initEvents : function(view){\n        view.mon(view.innerHd, 'mousemove', this.handleHdMove, this);\n        this.tracker = new Ext.dd.DragTracker({\n            onBeforeStart: this.onBeforeStart.createDelegate(this),\n            onStart: this.onStart.createDelegate(this),\n            onDrag: this.onDrag.createDelegate(this),\n            onEnd: this.onEnd.createDelegate(this),\n            tolerance: 3,\n            autoStart: 300\n        });\n        this.tracker.initEl(view.innerHd);\n        view.on('beforedestroy', this.tracker.destroy, this.tracker);\n    },\n\n    handleHdMove : function(e, t){\n        var handleWidth = 5,\n            x = e.getPageX(),\n            header = e.getTarget('em', 3, true);\n        if(header){\n            var region = header.getRegion(),\n                style = header.dom.style,\n                parentNode = header.dom.parentNode;\n\n            if(x - region.left <= handleWidth && parentNode != parentNode.parentNode.firstChild){\n                this.activeHd = Ext.get(parentNode.previousSibling.firstChild);\n                style.cursor = Ext.isWebKit ? 'e-resize' : 'col-resize';\n            } else if(region.right - x <= handleWidth && parentNode != parentNode.parentNode.lastChild.previousSibling){\n                this.activeHd = header;\n                style.cursor = Ext.isWebKit ? 'w-resize' : 'col-resize';\n            } else{\n                delete this.activeHd;\n                style.cursor = '';\n            }\n        }\n    },\n\n    onBeforeStart : function(e){\n        this.dragHd = this.activeHd;\n        return !!this.dragHd;\n    },\n\n    onStart: function(e){\n        \n        var me = this,\n            view = me.view,\n            dragHeader = me.dragHd,\n            x = me.tracker.getXY()[0];            \n        \n        me.proxy = view.el.createChild({cls:'x-list-resizer'});\n        me.dragX = dragHeader.getX();\n        me.headerIndex = view.findHeaderIndex(dragHeader);\n        \n        me.headersDisabled = view.disableHeaders;\n        view.disableHeaders = true;\n        \n        me.proxy.setHeight(view.el.getHeight());\n        me.proxy.setX(me.dragX);\n        me.proxy.setWidth(x - me.dragX);\n        \n        this.setBoundaries();\n        \n    },\n    \n    \n    setBoundaries: function(relativeX){\n        var view = this.view,\n            headerIndex = this.headerIndex,\n            width = view.innerHd.getWidth(),\n            relativeX = view.innerHd.getX(),\n            minWidth = Math.ceil(width * this.minPct),\n            maxWidth = width - minWidth,\n            numColumns = view.columns.length,\n            headers = view.innerHd.select('em', true),\n            minX = minWidth + relativeX,\n            maxX = maxWidth + relativeX,\n            header;\n          \n        if (numColumns == 2) {\n            this.minX = minX;\n            this.maxX = maxX;\n        }else{\n            header = headers.item(headerIndex + 2);\n            this.minX = headers.item(headerIndex).getX() + minWidth;\n            this.maxX = header ? header.getX() - minWidth : maxX;\n            if (headerIndex == 0) {\n                \n                this.minX = minX;\n            } else if (headerIndex == numColumns - 2) {\n                \n                this.maxX = maxX;\n            }\n        }\n    },\n\n    onDrag: function(e){\n        var me = this,\n            cursorX = me.tracker.getXY()[0].constrain(me.minX, me.maxX);\n            \n        me.proxy.setWidth(cursorX - this.dragX);\n    },\n\n    onEnd: function(e){\n        \n        var newWidth = this.proxy.getWidth(),\n            index = this.headerIndex,\n            view = this.view,\n            columns = view.columns,\n            width = view.innerHd.getWidth(),\n            newPercent = Math.ceil(newWidth * view.maxColumnWidth / width) / 100,\n            disabled = this.headersDisabled,\n            headerCol = columns[index],\n            otherCol = columns[index + 1],\n            totalPercent = headerCol.width + otherCol.width;\n\n        this.proxy.remove();\n\n        headerCol.width = newPercent;\n        otherCol.width = totalPercent - newPercent;\n      \n        delete this.dragHd;\n        view.setHdWidths();\n        view.refresh();\n        \n        setTimeout(function(){\n            view.disableHeaders = disabled;\n        }, 100);\n    }\n});\n\n\nExt.ListView.ColumnResizer = Ext.list.ColumnResizer;\nExt.list.Sorter = Ext.extend(Ext.util.Observable, {\n    \n    sortClasses : [\"sort-asc\", \"sort-desc\"],\n\n    constructor: function(config){\n        Ext.apply(this, config);\n        Ext.list.Sorter.superclass.constructor.call(this);\n    },\n\n    init : function(listView){\n        this.view = listView;\n        listView.on('render', this.initEvents, this);\n    },\n\n    initEvents : function(view){\n        view.mon(view.innerHd, 'click', this.onHdClick, this);\n        view.innerHd.setStyle('cursor', 'pointer');\n        view.mon(view.store, 'datachanged', this.updateSortState, this);\n        this.updateSortState.defer(10, this, [view.store]);\n    },\n\n    updateSortState : function(store){\n        var state = store.getSortState();\n        if(!state){\n            return;\n        }\n        this.sortState = state;\n        var cs = this.view.columns, sortColumn = -1;\n        for(var i = 0, len = cs.length; i < len; i++){\n            if(cs[i].dataIndex == state.field){\n                sortColumn = i;\n                break;\n            }\n        }\n        if(sortColumn != -1){\n            var sortDir = state.direction;\n            this.updateSortIcon(sortColumn, sortDir);\n        }\n    },\n\n    updateSortIcon : function(col, dir){\n        var sc = this.sortClasses;\n        var hds = this.view.innerHd.select('em').removeClass(sc);\n        hds.item(col).addClass(sc[dir == \"DESC\" ? 1 : 0]);\n    },\n\n    onHdClick : function(e){\n        var hd = e.getTarget('em', 3);\n        if(hd && !this.view.disableHeaders){\n            var index = this.view.findHeaderIndex(hd);\n            this.view.store.sort(this.view.columns[index].dataIndex);\n        }\n    }\n});\n\n\nExt.ListView.Sorter = Ext.list.Sorter;\nExt.TabPanel = Ext.extend(Ext.Panel,  {\n    \n    \n    \n    deferredRender : true,\n    \n    tabWidth : 120,\n    \n    minTabWidth : 30,\n    \n    resizeTabs : false,\n    \n    enableTabScroll : false,\n    \n    scrollIncrement : 0,\n    \n    scrollRepeatInterval : 400,\n    \n    scrollDuration : 0.35,\n    \n    animScroll : true,\n    \n    tabPosition : 'top',\n    \n    baseCls : 'x-tab-panel',\n    \n    autoTabs : false,\n    \n    autoTabSelector : 'div.x-tab',\n    \n    activeTab : undefined,\n    \n    tabMargin : 2,\n    \n    plain : false,\n    \n    wheelIncrement : 20,\n\n    \n    idDelimiter : '__',\n\n    \n    itemCls : 'x-tab-item',\n\n    \n    elements : 'body',\n    headerAsText : false,\n    frame : false,\n    hideBorders :true,\n\n    \n    initComponent : function(){\n        this.frame = false;\n        Ext.TabPanel.superclass.initComponent.call(this);\n        this.addEvents(\n            \n            'beforetabchange',\n            \n            'tabchange',\n            \n            'contextmenu'\n        );\n        \n        this.setLayout(new Ext.layout.CardLayout(Ext.apply({\n            layoutOnCardChange: this.layoutOnTabChange,\n            deferredRender: this.deferredRender\n        }, this.layoutConfig)));\n\n        if(this.tabPosition == 'top'){\n            this.elements += ',header';\n            this.stripTarget = 'header';\n        }else {\n            this.elements += ',footer';\n            this.stripTarget = 'footer';\n        }\n        if(!this.stack){\n            this.stack = Ext.TabPanel.AccessStack();\n        }\n        this.initItems();\n    },\n\n    \n    onRender : function(ct, position){\n        Ext.TabPanel.superclass.onRender.call(this, ct, position);\n\n        if(this.plain){\n            var pos = this.tabPosition == 'top' ? 'header' : 'footer';\n            this[pos].addClass('x-tab-panel-'+pos+'-plain');\n        }\n\n        var st = this[this.stripTarget];\n\n        this.stripWrap = st.createChild({cls:'x-tab-strip-wrap', cn:{\n            tag:'ul', cls:'x-tab-strip x-tab-strip-'+this.tabPosition}});\n\n        var beforeEl = (this.tabPosition=='bottom' ? this.stripWrap : null);\n        st.createChild({cls:'x-tab-strip-spacer'}, beforeEl);\n        this.strip = new Ext.Element(this.stripWrap.dom.firstChild);\n\n        \n        this.edge = this.strip.createChild({tag:'li', cls:'x-tab-edge', cn: [{tag: 'span', cls: 'x-tab-strip-text', cn: '&#160;'}]});\n        this.strip.createChild({cls:'x-clear'});\n\n        this.body.addClass('x-tab-panel-body-'+this.tabPosition);\n\n        \n        if(!this.itemTpl){\n            var tt = new Ext.Template(\n                 '<li class=\"{cls}\" id=\"{id}\"><a class=\"x-tab-strip-close\"></a>',\n                 '<a class=\"x-tab-right\" href=\"#\"><em class=\"x-tab-left\">',\n                 '<span class=\"x-tab-strip-inner\"><span class=\"x-tab-strip-text {iconCls}\">{text}</span></span>',\n                 '</em></a></li>'\n            );\n            tt.disableFormats = true;\n            tt.compile();\n            Ext.TabPanel.prototype.itemTpl = tt;\n        }\n\n        this.items.each(this.initTab, this);\n    },\n\n    \n    afterRender : function(){\n        Ext.TabPanel.superclass.afterRender.call(this);\n        if(this.autoTabs){\n            this.readTabs(false);\n        }\n        if(this.activeTab !== undefined){\n            var item = Ext.isObject(this.activeTab) ? this.activeTab : this.items.get(this.activeTab);\n            delete this.activeTab;\n            this.setActiveTab(item);\n        }\n    },\n\n    \n    initEvents : function(){\n        Ext.TabPanel.superclass.initEvents.call(this);\n        this.mon(this.strip, {\n            scope: this,\n            mousedown: this.onStripMouseDown,\n            contextmenu: this.onStripContextMenu\n        });\n        if(this.enableTabScroll){\n            this.mon(this.strip, 'mousewheel', this.onWheel, this);\n        }\n    },\n\n    \n    findTargets : function(e){\n        var item = null,\n            itemEl = e.getTarget('li:not(.x-tab-edge)', this.strip);\n\n        if(itemEl){\n            item = this.getComponent(itemEl.id.split(this.idDelimiter)[1]);\n            if(item.disabled){\n                return {\n                    close : null,\n                    item : null,\n                    el : null\n                };\n            }\n        }\n        return {\n            close : e.getTarget('.x-tab-strip-close', this.strip),\n            item : item,\n            el : itemEl\n        };\n    },\n\n    \n    onStripMouseDown : function(e){\n        if(e.button !== 0){\n            return;\n        }\n        e.preventDefault();\n        var t = this.findTargets(e);\n        if(t.close){\n            if (t.item.fireEvent('beforeclose', t.item) !== false) {\n                t.item.fireEvent('close', t.item);\n                this.remove(t.item);\n            }\n            return;\n        }\n        if(t.item && t.item != this.activeTab){\n            this.setActiveTab(t.item);\n        }\n    },\n\n    \n    onStripContextMenu : function(e){\n        e.preventDefault();\n        var t = this.findTargets(e);\n        if(t.item){\n            this.fireEvent('contextmenu', this, t.item, e);\n        }\n    },\n\n    \n    readTabs : function(removeExisting){\n        if(removeExisting === true){\n            this.items.each(function(item){\n                this.remove(item);\n            }, this);\n        }\n        var tabs = this.el.query(this.autoTabSelector);\n        for(var i = 0, len = tabs.length; i < len; i++){\n            var tab = tabs[i],\n                title = tab.getAttribute('title');\n            tab.removeAttribute('title');\n            this.add({\n                title: title,\n                contentEl: tab\n            });\n        }\n    },\n\n    \n    initTab : function(item, index){\n        var before = this.strip.dom.childNodes[index],\n            p = this.getTemplateArgs(item),\n            el = before ?\n                 this.itemTpl.insertBefore(before, p) :\n                 this.itemTpl.append(this.strip, p),\n            cls = 'x-tab-strip-over',\n            tabEl = Ext.get(el);\n\n        tabEl.hover(function(){\n            if(!item.disabled){\n                tabEl.addClass(cls);\n            }\n        }, function(){\n            tabEl.removeClass(cls);\n        });\n\n        if(item.tabTip){\n            tabEl.child('span.x-tab-strip-text', true).qtip = item.tabTip;\n        }\n        item.tabEl = el;\n\n        \n        tabEl.select('a').on('click', function(e){\n            if(!e.getPageX()){\n                this.onStripMouseDown(e);\n            }\n        }, this, {preventDefault: true});\n\n        item.on({\n            scope: this,\n            disable: this.onItemDisabled,\n            enable: this.onItemEnabled,\n            titlechange: this.onItemTitleChanged,\n            iconchange: this.onItemIconChanged,\n            beforeshow: this.onBeforeShowItem\n        });\n    },\n\n\n\n    \n    getTemplateArgs : function(item) {\n        var cls = item.closable ? 'x-tab-strip-closable' : '';\n        if(item.disabled){\n            cls += ' x-item-disabled';\n        }\n        if(item.iconCls){\n            cls += ' x-tab-with-icon';\n        }\n        if(item.tabCls){\n            cls += ' ' + item.tabCls;\n        }\n\n        return {\n            id: this.id + this.idDelimiter + item.getItemId(),\n            text: item.title,\n            cls: cls,\n            iconCls: item.iconCls || ''\n        };\n    },\n\n    \n    onAdd : function(c){\n        Ext.TabPanel.superclass.onAdd.call(this, c);\n        if(this.rendered){\n            var items = this.items;\n            this.initTab(c, items.indexOf(c));\n            this.delegateUpdates();\n        }\n    },\n\n    \n    onBeforeAdd : function(item){\n        var existing = item.events ? (this.items.containsKey(item.getItemId()) ? item : null) : this.items.get(item);\n        if(existing){\n            this.setActiveTab(item);\n            return false;\n        }\n        Ext.TabPanel.superclass.onBeforeAdd.apply(this, arguments);\n        var es = item.elements;\n        item.elements = es ? es.replace(',header', '') : es;\n        item.border = (item.border === true);\n    },\n\n    \n    onRemove : function(c){\n        var te = Ext.get(c.tabEl);\n        \n        if(te){\n            te.select('a').removeAllListeners();\n            Ext.destroy(te);\n        }\n        Ext.TabPanel.superclass.onRemove.call(this, c);\n        this.stack.remove(c);\n        delete c.tabEl;\n        c.un('disable', this.onItemDisabled, this);\n        c.un('enable', this.onItemEnabled, this);\n        c.un('titlechange', this.onItemTitleChanged, this);\n        c.un('iconchange', this.onItemIconChanged, this);\n        c.un('beforeshow', this.onBeforeShowItem, this);\n        if(c == this.activeTab){\n            var next = this.stack.next();\n            if(next){\n                this.setActiveTab(next);\n            }else if(this.items.getCount() > 0){\n                this.setActiveTab(0);\n            }else{\n                this.setActiveTab(null);\n            }\n        }\n        if(!this.destroying){\n            this.delegateUpdates();\n        }\n    },\n\n    \n    onBeforeShowItem : function(item){\n        if(item != this.activeTab){\n            this.setActiveTab(item);\n            return false;\n        }\n    },\n\n    \n    onItemDisabled : function(item){\n        var el = this.getTabEl(item);\n        if(el){\n            Ext.fly(el).addClass('x-item-disabled');\n        }\n        this.stack.remove(item);\n    },\n\n    \n    onItemEnabled : function(item){\n        var el = this.getTabEl(item);\n        if(el){\n            Ext.fly(el).removeClass('x-item-disabled');\n        }\n    },\n\n    \n    onItemTitleChanged : function(item){\n        var el = this.getTabEl(item);\n        if(el){\n            Ext.fly(el).child('span.x-tab-strip-text', true).innerHTML = item.title;\n            this.delegateUpdates();\n        }\n    },\n\n    \n    onItemIconChanged : function(item, iconCls, oldCls){\n        var el = this.getTabEl(item);\n        if(el){\n            el = Ext.get(el);\n            el.child('span.x-tab-strip-text').replaceClass(oldCls, iconCls);\n            el[Ext.isEmpty(iconCls) ? 'removeClass' : 'addClass']('x-tab-with-icon');\n            this.delegateUpdates();\n        }\n    },\n\n    \n    getTabEl : function(item){\n        var c = this.getComponent(item);\n        return c ? c.tabEl : null;\n    },\n\n    \n    onResize : function(){\n        Ext.TabPanel.superclass.onResize.apply(this, arguments);\n        this.delegateUpdates();\n    },\n\n    \n    beginUpdate : function(){\n        this.suspendUpdates = true;\n    },\n\n    \n    endUpdate : function(){\n        this.suspendUpdates = false;\n        this.delegateUpdates();\n    },\n\n    \n    hideTabStripItem : function(item){\n        item = this.getComponent(item);\n        var el = this.getTabEl(item);\n        if(el){\n            el.style.display = 'none';\n            this.delegateUpdates();\n        }\n        this.stack.remove(item);\n    },\n\n    \n    unhideTabStripItem : function(item){\n        item = this.getComponent(item);\n        var el = this.getTabEl(item);\n        if(el){\n            el.style.display = '';\n            this.delegateUpdates();\n        }\n    },\n\n    \n    delegateUpdates : function(){\n        var rendered = this.rendered;\n        if(this.suspendUpdates){\n            return;\n        }\n        if(this.resizeTabs && rendered){\n            this.autoSizeTabs();\n        }\n        if(this.enableTabScroll && rendered){\n            this.autoScrollTabs();\n        }\n    },\n\n    \n    autoSizeTabs : function(){\n        var count = this.items.length,\n            ce = this.tabPosition != 'bottom' ? 'header' : 'footer',\n            ow = this[ce].dom.offsetWidth,\n            aw = this[ce].dom.clientWidth;\n\n        if(!this.resizeTabs || count < 1 || !aw){ \n            return;\n        }\n\n        var each = Math.max(Math.min(Math.floor((aw-4) / count) - this.tabMargin, this.tabWidth), this.minTabWidth); \n        this.lastTabWidth = each;\n        var lis = this.strip.query('li:not(.x-tab-edge)');\n        for(var i = 0, len = lis.length; i < len; i++) {\n            var li = lis[i],\n                inner = Ext.fly(li).child('.x-tab-strip-inner', true),\n                tw = li.offsetWidth,\n                iw = inner.offsetWidth;\n            inner.style.width = (each - (tw-iw)) + 'px';\n        }\n    },\n\n    \n    adjustBodyWidth : function(w){\n        if(this.header){\n            this.header.setWidth(w);\n        }\n        if(this.footer){\n            this.footer.setWidth(w);\n        }\n        return w;\n    },\n\n    \n    setActiveTab : function(item){\n        item = this.getComponent(item);\n        if(this.fireEvent('beforetabchange', this, item, this.activeTab) === false){\n            return;\n        }\n        if(!this.rendered){\n            this.activeTab = item;\n            return;\n        }\n        if(this.activeTab != item){\n            if(this.activeTab){\n                var oldEl = this.getTabEl(this.activeTab);\n                if(oldEl){\n                    Ext.fly(oldEl).removeClass('x-tab-strip-active');\n                }\n            }\n            this.activeTab = item;\n            if(item){\n                var el = this.getTabEl(item);\n                Ext.fly(el).addClass('x-tab-strip-active');\n                this.stack.add(item);\n\n                this.layout.setActiveItem(item);\n                \n                this.delegateUpdates();\n                if(this.scrolling){\n                    this.scrollToTab(item, this.animScroll);\n                }\n            }\n            this.fireEvent('tabchange', this, item);\n        }\n    },\n\n    \n    getActiveTab : function(){\n        return this.activeTab || null;\n    },\n\n    \n    getItem : function(item){\n        return this.getComponent(item);\n    },\n\n    \n    autoScrollTabs : function(){\n        this.pos = this.tabPosition=='bottom' ? this.footer : this.header;\n        var count = this.items.length,\n            ow = this.pos.dom.offsetWidth,\n            tw = this.pos.dom.clientWidth,\n            wrap = this.stripWrap,\n            wd = wrap.dom,\n            cw = wd.offsetWidth,\n            pos = this.getScrollPos(),\n            l = this.edge.getOffsetsTo(this.stripWrap)[0] + pos;\n\n        if(!this.enableTabScroll || cw < 20){ \n            return;\n        }\n        if(count == 0 || l <= tw){\n            \n            wd.scrollLeft = 0;\n            wrap.setWidth(tw);\n            if(this.scrolling){\n                this.scrolling = false;\n                this.pos.removeClass('x-tab-scrolling');\n                this.scrollLeft.hide();\n                this.scrollRight.hide();\n                \n                if(Ext.isAir || Ext.isWebKit){\n                    wd.style.marginLeft = '';\n                    wd.style.marginRight = '';\n                }\n            }\n        }else{\n            if(!this.scrolling){\n                this.pos.addClass('x-tab-scrolling');\n                \n                if(Ext.isAir || Ext.isWebKit){\n                    wd.style.marginLeft = '18px';\n                    wd.style.marginRight = '18px';\n                }\n            }\n            tw -= wrap.getMargins('lr');\n            wrap.setWidth(tw > 20 ? tw : 20);\n            if(!this.scrolling){\n                if(!this.scrollLeft){\n                    this.createScrollers();\n                }else{\n                    this.scrollLeft.show();\n                    this.scrollRight.show();\n                }\n            }\n            this.scrolling = true;\n            if(pos > (l-tw)){ \n                wd.scrollLeft = l-tw;\n            }else{ \n                this.scrollToTab(this.activeTab, false);\n            }\n            this.updateScrollButtons();\n        }\n    },\n\n    \n    createScrollers : function(){\n        this.pos.addClass('x-tab-scrolling-' + this.tabPosition);\n        var h = this.stripWrap.dom.offsetHeight;\n\n        \n        var sl = this.pos.insertFirst({\n            cls:'x-tab-scroller-left'\n        });\n        sl.setHeight(h);\n        sl.addClassOnOver('x-tab-scroller-left-over');\n        this.leftRepeater = new Ext.util.ClickRepeater(sl, {\n            interval : this.scrollRepeatInterval,\n            handler: this.onScrollLeft,\n            scope: this\n        });\n        this.scrollLeft = sl;\n\n        \n        var sr = this.pos.insertFirst({\n            cls:'x-tab-scroller-right'\n        });\n        sr.setHeight(h);\n        sr.addClassOnOver('x-tab-scroller-right-over');\n        this.rightRepeater = new Ext.util.ClickRepeater(sr, {\n            interval : this.scrollRepeatInterval,\n            handler: this.onScrollRight,\n            scope: this\n        });\n        this.scrollRight = sr;\n    },\n\n    \n    getScrollWidth : function(){\n        return this.edge.getOffsetsTo(this.stripWrap)[0] + this.getScrollPos();\n    },\n\n    \n    getScrollPos : function(){\n        return parseInt(this.stripWrap.dom.scrollLeft, 10) || 0;\n    },\n\n    \n    getScrollArea : function(){\n        return parseInt(this.stripWrap.dom.clientWidth, 10) || 0;\n    },\n\n    \n    getScrollAnim : function(){\n        return {duration:this.scrollDuration, callback: this.updateScrollButtons, scope: this};\n    },\n\n    \n    getScrollIncrement : function(){\n        return this.scrollIncrement || (this.resizeTabs ? this.lastTabWidth+2 : 100);\n    },\n\n    \n\n    scrollToTab : function(item, animate){\n        if(!item){\n            return;\n        }\n        var el = this.getTabEl(item),\n            pos = this.getScrollPos(),\n            area = this.getScrollArea(),\n            left = Ext.fly(el).getOffsetsTo(this.stripWrap)[0] + pos,\n            right = left + el.offsetWidth;\n        if(left < pos){\n            this.scrollTo(left, animate);\n        }else if(right > (pos + area)){\n            this.scrollTo(right - area, animate);\n        }\n    },\n\n    \n    scrollTo : function(pos, animate){\n        this.stripWrap.scrollTo('left', pos, animate ? this.getScrollAnim() : false);\n        if(!animate){\n            this.updateScrollButtons();\n        }\n    },\n\n    onWheel : function(e){\n        var d = e.getWheelDelta()*this.wheelIncrement*-1;\n        e.stopEvent();\n\n        var pos = this.getScrollPos(),\n            newpos = pos + d,\n            sw = this.getScrollWidth()-this.getScrollArea();\n\n        var s = Math.max(0, Math.min(sw, newpos));\n        if(s != pos){\n            this.scrollTo(s, false);\n        }\n    },\n\n    \n    onScrollRight : function(){\n        var sw = this.getScrollWidth()-this.getScrollArea(),\n            pos = this.getScrollPos(),\n            s = Math.min(sw, pos + this.getScrollIncrement());\n        if(s != pos){\n            this.scrollTo(s, this.animScroll);\n        }\n    },\n\n    \n    onScrollLeft : function(){\n        var pos = this.getScrollPos(),\n            s = Math.max(0, pos - this.getScrollIncrement());\n        if(s != pos){\n            this.scrollTo(s, this.animScroll);\n        }\n    },\n\n    \n    updateScrollButtons : function(){\n        var pos = this.getScrollPos();\n        this.scrollLeft[pos === 0 ? 'addClass' : 'removeClass']('x-tab-scroller-left-disabled');\n        this.scrollRight[pos >= (this.getScrollWidth()-this.getScrollArea()) ? 'addClass' : 'removeClass']('x-tab-scroller-right-disabled');\n    },\n\n    \n    beforeDestroy : function() {\n        Ext.destroy(this.leftRepeater, this.rightRepeater);\n        this.deleteMembers('strip', 'edge', 'scrollLeft', 'scrollRight', 'stripWrap');\n        this.activeTab = null;\n        Ext.TabPanel.superclass.beforeDestroy.apply(this);\n    }\n\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n});\nExt.reg('tabpanel', Ext.TabPanel);\n\n\nExt.TabPanel.prototype.activate = Ext.TabPanel.prototype.setActiveTab;\n\n\nExt.TabPanel.AccessStack = function(){\n    var items = [];\n    return {\n        add : function(item){\n            items.push(item);\n            if(items.length > 10){\n                items.shift();\n            }\n        },\n\n        remove : function(item){\n            var s = [];\n            for(var i = 0, len = items.length; i < len; i++) {\n                if(items[i] != item){\n                    s.push(items[i]);\n                }\n            }\n            items = s;\n        },\n\n        next : function(){\n            return items.pop();\n        }\n    };\n};\n\nExt.Button = Ext.extend(Ext.BoxComponent, {\n    \n    hidden : false,\n    \n    disabled : false,\n    \n    pressed : false,\n\n    \n\n    \n\n    \n    enableToggle : false,\n    \n    \n    \n    menuAlign : 'tl-bl?',\n\n    \n    \n    \n    type : 'button',\n\n    \n    menuClassTarget : 'tr:nth(2)',\n\n    \n    clickEvent : 'click',\n\n    \n    handleMouseEvents : true,\n\n    \n    tooltipType : 'qtip',\n\n    \n    buttonSelector : 'button:first-child',\n\n    \n    scale : 'small',\n\n    \n\n    \n    iconAlign : 'left',\n\n    \n    arrowAlign : 'right',\n\n    \n    \n    \n    \n\n    initComponent : function(){\n        if(this.menu){\n            \n            \n            if (Ext.isArray(this.menu)){\n                this.menu = { items: this.menu };\n            }\n            \n            \n            \n            if (Ext.isObject(this.menu)){\n                this.menu.ownerCt = this;\n            }\n            \n            this.menu = Ext.menu.MenuMgr.get(this.menu);\n            this.menu.ownerCt = undefined;\n        }\n        \n        Ext.Button.superclass.initComponent.call(this);\n\n        this.addEvents(\n            \n            'click',\n            \n            'toggle',\n            \n            'mouseover',\n            \n            'mouseout',\n            \n            'menushow',\n            \n            'menuhide',\n            \n            'menutriggerover',\n            \n            'menutriggerout'\n        );\n        \n        if(Ext.isString(this.toggleGroup)){\n            this.enableToggle = true;\n        }\n    },\n\n\n    getTemplateArgs : function(){\n        return [this.type, 'x-btn-' + this.scale + ' x-btn-icon-' + this.scale + '-' + this.iconAlign, this.getMenuClass(), this.cls, this.id];\n    },\n\n    \n    setButtonClass : function(){\n        if(this.useSetClass){\n            if(!Ext.isEmpty(this.oldCls)){\n                this.el.removeClass([this.oldCls, 'x-btn-pressed']);\n            }\n            this.oldCls = (this.iconCls || this.icon) ? (this.text ? 'x-btn-text-icon' : 'x-btn-icon') : 'x-btn-noicon';\n            this.el.addClass([this.oldCls, this.pressed ? 'x-btn-pressed' : null]);\n        }\n    },\n\n    \n    getMenuClass : function(){\n        return this.menu ? (this.arrowAlign != 'bottom' ? 'x-btn-arrow' : 'x-btn-arrow-bottom') : '';\n    },\n\n    \n    onRender : function(ct, position){\n        if(!this.template){\n            if(!Ext.Button.buttonTemplate){\n                \n                Ext.Button.buttonTemplate = new Ext.Template(\n                    '<table id=\"{4}\" cellspacing=\"0\" class=\"x-btn {3}\"><tbody class=\"{1}\">',\n                    '<tr><td class=\"x-btn-tl\"><i>&#160;</i></td><td class=\"x-btn-tc\"></td><td class=\"x-btn-tr\"><i>&#160;</i></td></tr>',\n                    '<tr><td class=\"x-btn-ml\"><i>&#160;</i></td><td class=\"x-btn-mc\"><em class=\"{2} x-unselectable\" unselectable=\"on\"><button type=\"{0}\"></button></em></td><td class=\"x-btn-mr\"><i>&#160;</i></td></tr>',\n                    '<tr><td class=\"x-btn-bl\"><i>&#160;</i></td><td class=\"x-btn-bc\"></td><td class=\"x-btn-br\"><i>&#160;</i></td></tr>',\n                    '</tbody></table>');\n                Ext.Button.buttonTemplate.compile();\n            }\n            this.template = Ext.Button.buttonTemplate;\n        }\n\n        var btn, targs = this.getTemplateArgs();\n\n        if(position){\n            btn = this.template.insertBefore(position, targs, true);\n        }else{\n            btn = this.template.append(ct, targs, true);\n        }\n        \n        this.btnEl = btn.child(this.buttonSelector);\n        this.mon(this.btnEl, {\n            scope: this,\n            focus: this.onFocus,\n            blur: this.onBlur\n        });\n\n        this.initButtonEl(btn, this.btnEl);\n\n        Ext.ButtonToggleMgr.register(this);\n    },\n\n    \n    initButtonEl : function(btn, btnEl){\n        this.el = btn;\n        this.setIcon(this.icon);\n        this.setText(this.text);\n        this.setIconClass(this.iconCls);\n        if(Ext.isDefined(this.tabIndex)){\n            btnEl.dom.tabIndex = this.tabIndex;\n        }\n        if(this.tooltip){\n            this.setTooltip(this.tooltip, true);\n        }\n\n        if(this.handleMouseEvents){\n            this.mon(btn, {\n                scope: this,\n                mouseover: this.onMouseOver,\n                mousedown: this.onMouseDown\n            });\n\n            \n            \n        }\n\n        if(this.menu){\n            this.mon(this.menu, {\n                scope: this,\n                show: this.onMenuShow,\n                hide: this.onMenuHide\n            });\n        }\n\n        if(this.repeat){\n            var repeater = new Ext.util.ClickRepeater(btn, Ext.isObject(this.repeat) ? this.repeat : {});\n            this.mon(repeater, 'click', this.onRepeatClick, this);\n        }else{\n            this.mon(btn, this.clickEvent, this.onClick, this);\n        }\n    },\n\n    \n    afterRender : function(){\n        Ext.Button.superclass.afterRender.call(this);\n        this.useSetClass = true;\n        this.setButtonClass();\n        this.doc = Ext.getDoc();\n        this.doAutoWidth();\n    },\n\n    \n    setIconClass : function(cls){\n        this.iconCls = cls;\n        if(this.el){\n            this.btnEl.dom.className = '';\n            this.btnEl.addClass(['x-btn-text', cls || '']);\n            this.setButtonClass();\n        }\n        return this;\n    },\n\n    \n    setTooltip : function(tooltip,  initial){\n        if(this.rendered){\n            if(!initial){\n                this.clearTip();\n            }\n            if(Ext.isObject(tooltip)){\n                Ext.QuickTips.register(Ext.apply({\n                      target: this.btnEl.id\n                }, tooltip));\n                this.tooltip = tooltip;\n            }else{\n                this.btnEl.dom[this.tooltipType] = tooltip;\n            }\n        }else{\n            this.tooltip = tooltip;\n        }\n        return this;\n    },\n\n    \n    clearTip : function(){\n        if(Ext.isObject(this.tooltip)){\n            Ext.QuickTips.unregister(this.btnEl);\n        }\n    },\n\n    \n    beforeDestroy : function(){\n        if(this.rendered){\n            this.clearTip();\n        }\n        if(this.menu && this.destroyMenu !== false) {\n            Ext.destroy(this.btnEl, this.menu);\n        }\n        Ext.destroy(this.repeater);\n    },\n\n    \n    onDestroy : function(){\n        if(this.rendered){\n            this.doc.un('mouseover', this.monitorMouseOver, this);\n            this.doc.un('mouseup', this.onMouseUp, this);\n            delete this.doc;\n            delete this.btnEl;\n            Ext.ButtonToggleMgr.unregister(this);\n        }\n        Ext.Button.superclass.onDestroy.call(this);\n    },\n\n    \n    doAutoWidth : function(){\n        if(this.autoWidth !== false && this.el && this.text && this.width === undefined){\n            this.el.setWidth('auto');\n            if(Ext.isIE7 && Ext.isStrict){\n                var ib = this.btnEl;\n                if(ib && ib.getWidth() > 20){\n                    ib.clip();\n                    ib.setWidth(Ext.util.TextMetrics.measure(ib, this.text).width+ib.getFrameWidth('lr'));\n                }\n            }\n            if(this.minWidth){\n                if(this.el.getWidth() < this.minWidth){\n                    this.el.setWidth(this.minWidth);\n                }\n            }\n        }\n    },\n\n    \n    setHandler : function(handler, scope){\n        this.handler = handler;\n        this.scope = scope;\n        return this;\n    },\n\n    \n    setText : function(text){\n        this.text = text;\n        if(this.el){\n            this.btnEl.update(text || '&#160;');\n            this.setButtonClass();\n        }\n        this.doAutoWidth();\n        return this;\n    },\n\n    \n    setIcon : function(icon){\n        this.icon = icon;\n        if(this.el){\n            this.btnEl.setStyle('background-image', icon ? 'url(' + icon + ')' : '');\n            this.setButtonClass();\n        }\n        return this;\n    },\n\n    \n    getText : function(){\n        return this.text;\n    },\n\n    \n    toggle : function(state, suppressEvent){\n        state = state === undefined ? !this.pressed : !!state;\n        if(state != this.pressed){\n            if(this.rendered){\n                this.el[state ? 'addClass' : 'removeClass']('x-btn-pressed');\n            }\n            this.pressed = state;\n            if(!suppressEvent){\n                this.fireEvent('toggle', this, state);\n                if(this.toggleHandler){\n                    this.toggleHandler.call(this.scope || this, this, state);\n                }\n            }\n        }\n        return this;\n    },\n\n    \n    onDisable : function(){\n        this.onDisableChange(true);\n    },\n\n    \n    onEnable : function(){\n        this.onDisableChange(false);\n    },\n\n    onDisableChange : function(disabled){\n        if(this.el){\n            if(!Ext.isIE6 || !this.text){\n                this.el[disabled ? 'addClass' : 'removeClass'](this.disabledClass);\n            }\n            this.el.dom.disabled = disabled;\n        }\n        this.disabled = disabled;\n    },\n\n    \n    showMenu : function(){\n        if(this.rendered && this.menu){\n            if(this.tooltip){\n                Ext.QuickTips.getQuickTip().cancelShow(this.btnEl);\n            }\n            if(this.menu.isVisible()){\n                this.menu.hide();\n            }\n            this.menu.ownerCt = this;\n            this.menu.show(this.el, this.menuAlign);\n        }\n        return this;\n    },\n\n    \n    hideMenu : function(){\n        if(this.hasVisibleMenu()){\n            this.menu.hide();\n        }\n        return this;\n    },\n\n    \n    hasVisibleMenu : function(){\n        return this.menu && this.menu.ownerCt == this && this.menu.isVisible();\n    },\n    \n    \n    onRepeatClick : function(repeat, e){\n        this.onClick(e);\n    },\n\n    \n    onClick : function(e){\n        if(e){\n            e.preventDefault();\n        }\n        if(e.button !== 0){\n            return;\n        }\n        if(!this.disabled){\n            this.doToggle();\n            if(this.menu && !this.hasVisibleMenu() && !this.ignoreNextClick){\n                this.showMenu();\n            }\n            this.fireEvent('click', this, e);\n            if(this.handler){\n                \n                this.handler.call(this.scope || this, this, e);\n            }\n        }\n    },\n    \n    \n    doToggle: function(){\n        if (this.enableToggle && (this.allowDepress !== false || !this.pressed)) {\n            this.toggle();\n        }\n    },\n\n    \n    isMenuTriggerOver : function(e, internal){\n        return this.menu && !internal;\n    },\n\n    \n    isMenuTriggerOut : function(e, internal){\n        return this.menu && !internal;\n    },\n\n    \n    onMouseOver : function(e){\n        if(!this.disabled){\n            var internal = e.within(this.el,  true);\n            if(!internal){\n                this.el.addClass('x-btn-over');\n                if(!this.monitoringMouseOver){\n                    this.doc.on('mouseover', this.monitorMouseOver, this);\n                    this.monitoringMouseOver = true;\n                }\n                this.fireEvent('mouseover', this, e);\n            }\n            if(this.isMenuTriggerOver(e, internal)){\n                this.fireEvent('menutriggerover', this, this.menu, e);\n            }\n        }\n    },\n\n    \n    monitorMouseOver : function(e){\n        if(e.target != this.el.dom && !e.within(this.el)){\n            if(this.monitoringMouseOver){\n                this.doc.un('mouseover', this.monitorMouseOver, this);\n                this.monitoringMouseOver = false;\n            }\n            this.onMouseOut(e);\n        }\n    },\n\n    \n    onMouseOut : function(e){\n        var internal = e.within(this.el) && e.target != this.el.dom;\n        this.el.removeClass('x-btn-over');\n        this.fireEvent('mouseout', this, e);\n        if(this.isMenuTriggerOut(e, internal)){\n            this.fireEvent('menutriggerout', this, this.menu, e);\n        }\n    },\n\n    focus : function() {\n        this.btnEl.focus();\n    },\n\n    blur : function() {\n        this.btnEl.blur();\n    },\n\n    \n    onFocus : function(e){\n        if(!this.disabled){\n            this.el.addClass('x-btn-focus');\n        }\n    },\n    \n    onBlur : function(e){\n        this.el.removeClass('x-btn-focus');\n    },\n\n    \n    getClickEl : function(e, isUp){\n       return this.el;\n    },\n\n    \n    onMouseDown : function(e){\n        if(!this.disabled && e.button === 0){\n            this.getClickEl(e).addClass('x-btn-click');\n            this.doc.on('mouseup', this.onMouseUp, this);\n        }\n    },\n    \n    onMouseUp : function(e){\n        if(e.button === 0){\n            this.getClickEl(e, true).removeClass('x-btn-click');\n            this.doc.un('mouseup', this.onMouseUp, this);\n        }\n    },\n    \n    onMenuShow : function(e){\n        if(this.menu.ownerCt == this){\n            this.menu.ownerCt = this;\n            this.ignoreNextClick = 0;\n            this.el.addClass('x-btn-menu-active');\n            this.fireEvent('menushow', this, this.menu);\n        }\n    },\n    \n    onMenuHide : function(e){\n        if(this.menu.ownerCt == this){\n            this.el.removeClass('x-btn-menu-active');\n            this.ignoreNextClick = this.restoreClick.defer(250, this);\n            this.fireEvent('menuhide', this, this.menu);\n            delete this.menu.ownerCt;\n        }\n    },\n\n    \n    restoreClick : function(){\n        this.ignoreNextClick = 0;\n    }\n\n    \n    \n    \n    \n    \n    \n});\nExt.reg('button', Ext.Button);\n\n\nExt.ButtonToggleMgr = function(){\n   var groups = {};\n\n   function toggleGroup(btn, state){\n       if(state){\n           var g = groups[btn.toggleGroup];\n           for(var i = 0, l = g.length; i < l; i++){\n               if(g[i] != btn){\n                   g[i].toggle(false);\n               }\n           }\n       }\n   }\n\n   return {\n       register : function(btn){\n           if(!btn.toggleGroup){\n               return;\n           }\n           var g = groups[btn.toggleGroup];\n           if(!g){\n               g = groups[btn.toggleGroup] = [];\n           }\n           g.push(btn);\n           btn.on('toggle', toggleGroup);\n       },\n\n       unregister : function(btn){\n           if(!btn.toggleGroup){\n               return;\n           }\n           var g = groups[btn.toggleGroup];\n           if(g){\n               g.remove(btn);\n               btn.un('toggle', toggleGroup);\n           }\n       },\n\n       \n       getPressed : function(group){\n           var g = groups[group];\n           if(g){\n               for(var i = 0, len = g.length; i < len; i++){\n                   if(g[i].pressed === true){\n                       return g[i];\n                   }\n               }\n           }\n           return null;\n       }\n   };\n}();\n\nExt.SplitButton = Ext.extend(Ext.Button, {\n\t\n    arrowSelector : 'em',\n    split: true,\n\n    \n    initComponent : function(){\n        Ext.SplitButton.superclass.initComponent.call(this);\n        \n        this.addEvents(\"arrowclick\");\n    },\n\n    \n    onRender : function(){\n        Ext.SplitButton.superclass.onRender.apply(this, arguments);\n        if(this.arrowTooltip){\n            this.el.child(this.arrowSelector).dom[this.tooltipType] = this.arrowTooltip;\n        }\n    },\n\n    \n    setArrowHandler : function(handler, scope){\n        this.arrowHandler = handler;\n        this.scope = scope;\n    },\n\n    getMenuClass : function(){\n        return 'x-btn-split' + (this.arrowAlign == 'bottom' ? '-bottom' : '');\n    },\n\n    isClickOnArrow : function(e){\n\tif (this.arrowAlign != 'bottom') {\n\t    var visBtn = this.el.child('em.x-btn-split');\n\t    var right = visBtn.getRegion().right - visBtn.getPadding('r');\n\t    return e.getPageX() > right;\n\t} else {\n\t    return e.getPageY() > this.btnEl.getRegion().bottom;\n\t}\n    },\n\n    \n    onClick : function(e, t){\n        e.preventDefault();\n        if(!this.disabled){\n            if(this.isClickOnArrow(e)){\n                if(this.menu && !this.menu.isVisible() && !this.ignoreNextClick){\n                    this.showMenu();\n                }\n                this.fireEvent(\"arrowclick\", this, e);\n                if(this.arrowHandler){\n                    this.arrowHandler.call(this.scope || this, this, e);\n                }\n            }else{\n                this.doToggle();\n                this.fireEvent(\"click\", this, e);\n                if(this.handler){\n                    this.handler.call(this.scope || this, this, e);\n                }\n            }\n        }\n    },\n\n    \n    isMenuTriggerOver : function(e){\n        return this.menu && e.target.tagName == this.arrowSelector;\n    },\n\n    \n    isMenuTriggerOut : function(e, internal){\n        return this.menu && e.target.tagName != this.arrowSelector;\n    }\n});\n\nExt.reg('splitbutton', Ext.SplitButton);\nExt.CycleButton = Ext.extend(Ext.SplitButton, {\n    \n    \n    \n    \n    \n    \n\n    \n    getItemText : function(item){\n        if(item && this.showText === true){\n            var text = '';\n            if(this.prependText){\n                text += this.prependText;\n            }\n            text += item.text;\n            return text;\n        }\n        return undefined;\n    },\n\n    \n    setActiveItem : function(item, suppressEvent){\n        if(!Ext.isObject(item)){\n            item = this.menu.getComponent(item);\n        }\n        if(item){\n            if(!this.rendered){\n                this.text = this.getItemText(item);\n                this.iconCls = item.iconCls;\n            }else{\n                var t = this.getItemText(item);\n                if(t){\n                    this.setText(t);\n                }\n                this.setIconClass(item.iconCls);\n            }\n            this.activeItem = item;\n            if(!item.checked){\n                item.setChecked(true, suppressEvent);\n            }\n            if(this.forceIcon){\n                this.setIconClass(this.forceIcon);\n            }\n            if(!suppressEvent){\n                this.fireEvent('change', this, item);\n            }\n        }\n    },\n\n    \n    getActiveItem : function(){\n        return this.activeItem;\n    },\n\n    \n    initComponent : function(){\n        this.addEvents(\n            \n            \"change\"\n        );\n\n        if(this.changeHandler){\n            this.on('change', this.changeHandler, this.scope||this);\n            delete this.changeHandler;\n        }\n\n        this.itemCount = this.items.length;\n\n        this.menu = {cls:'x-cycle-menu', items:[]};\n        var checked = 0;\n        Ext.each(this.items, function(item, i){\n            Ext.apply(item, {\n                group: item.group || this.id,\n                itemIndex: i,\n                checkHandler: this.checkHandler,\n                scope: this,\n                checked: item.checked || false\n            });\n            this.menu.items.push(item);\n            if(item.checked){\n                checked = i;\n            }\n        }, this);\n        Ext.CycleButton.superclass.initComponent.call(this);\n        this.on('click', this.toggleSelected, this);\n        this.setActiveItem(checked, true);\n    },\n\n    \n    checkHandler : function(item, pressed){\n        if(pressed){\n            this.setActiveItem(item);\n        }\n    },\n\n    \n    toggleSelected : function(){\n        var m = this.menu;\n        m.render();\n        \n        if(!m.hasLayout){\n            m.doLayout();\n        }\n        \n        var nextIdx, checkItem;\n        for (var i = 1; i < this.itemCount; i++) {\n            nextIdx = (this.activeItem.itemIndex + i) % this.itemCount;\n            \n            checkItem = m.items.itemAt(nextIdx);\n            \n            if (!checkItem.disabled) {\n                checkItem.setChecked(true);\n                break;\n            }\n        }\n    }\n});\nExt.reg('cycle', Ext.CycleButton);\nExt.Toolbar = function(config){\n    if(Ext.isArray(config)){\n        config = {items: config, layout: 'toolbar'};\n    } else {\n        config = Ext.apply({\n            layout: 'toolbar'\n        }, config);\n        if(config.buttons) {\n            config.items = config.buttons;\n        }\n    }\n    Ext.Toolbar.superclass.constructor.call(this, config);\n};\n\n(function(){\n\nvar T = Ext.Toolbar;\n\nExt.extend(T, Ext.Container, {\n\n    defaultType: 'button',\n\n    \n\n    enableOverflow : false,\n\n    \n    \n\n    trackMenus : true,\n    internalDefaults: {removeMode: 'container', hideParent: true},\n    toolbarCls: 'x-toolbar',\n\n    initComponent : function(){\n        T.superclass.initComponent.call(this);\n\n        \n        this.addEvents('overflowchange');\n    },\n\n    \n    onRender : function(ct, position){\n        if(!this.el){\n            if(!this.autoCreate){\n                this.autoCreate = {\n                    cls: this.toolbarCls + ' x-small-editor'\n                };\n            }\n            this.el = ct.createChild(Ext.apply({ id: this.id },this.autoCreate), position);\n            Ext.Toolbar.superclass.onRender.apply(this, arguments);\n        }\n    },\n\n    \n\n    \n    lookupComponent : function(c){\n        if(Ext.isString(c)){\n            if(c == '-'){\n                c = new T.Separator();\n            }else if(c == ' '){\n                c = new T.Spacer();\n            }else if(c == '->'){\n                c = new T.Fill();\n            }else{\n                c = new T.TextItem(c);\n            }\n            this.applyDefaults(c);\n        }else{\n            if(c.isFormField || c.render){ \n                c = this.createComponent(c);\n            }else if(c.tag){ \n                c = new T.Item({autoEl: c});\n            }else if(c.tagName){ \n                c = new T.Item({el:c});\n            }else if(Ext.isObject(c)){ \n                c = c.xtype ? this.createComponent(c) : this.constructButton(c);\n            }\n        }\n        return c;\n    },\n\n    \n    applyDefaults : function(c){\n        if(!Ext.isString(c)){\n            c = Ext.Toolbar.superclass.applyDefaults.call(this, c);\n            var d = this.internalDefaults;\n            if(c.events){\n                Ext.applyIf(c.initialConfig, d);\n                Ext.apply(c, d);\n            }else{\n                Ext.applyIf(c, d);\n            }\n        }\n        return c;\n    },\n\n    \n    addSeparator : function(){\n        return this.add(new T.Separator());\n    },\n\n    \n    addSpacer : function(){\n        return this.add(new T.Spacer());\n    },\n\n    \n    addFill : function(){\n        this.add(new T.Fill());\n    },\n\n    \n    addElement : function(el){\n        return this.addItem(new T.Item({el:el}));\n    },\n\n    \n    addItem : function(item){\n        return this.add.apply(this, arguments);\n    },\n\n    \n    addButton : function(config){\n        if(Ext.isArray(config)){\n            var buttons = [];\n            for(var i = 0, len = config.length; i < len; i++) {\n                buttons.push(this.addButton(config[i]));\n            }\n            return buttons;\n        }\n        return this.add(this.constructButton(config));\n    },\n\n    \n    addText : function(text){\n        return this.addItem(new T.TextItem(text));\n    },\n\n    \n    addDom : function(config){\n        return this.add(new T.Item({autoEl: config}));\n    },\n\n    \n    addField : function(field){\n        return this.add(field);\n    },\n\n    \n    insertButton : function(index, item){\n        if(Ext.isArray(item)){\n            var buttons = [];\n            for(var i = 0, len = item.length; i < len; i++) {\n               buttons.push(this.insertButton(index + i, item[i]));\n            }\n            return buttons;\n        }\n        return Ext.Toolbar.superclass.insert.call(this, index, item);\n    },\n\n    \n    trackMenu : function(item, remove){\n        if(this.trackMenus && item.menu){\n            var method = remove ? 'mun' : 'mon';\n            this[method](item, 'menutriggerover', this.onButtonTriggerOver, this);\n            this[method](item, 'menushow', this.onButtonMenuShow, this);\n            this[method](item, 'menuhide', this.onButtonMenuHide, this);\n        }\n    },\n\n    \n    constructButton : function(item){\n        var b = item.events ? item : this.createComponent(item, item.split ? 'splitbutton' : this.defaultType);\n        return b;\n    },\n\n    \n    onAdd : function(c){\n        Ext.Toolbar.superclass.onAdd.call(this);\n        this.trackMenu(c);\n        if(this.disabled){\n            c.disable();\n        }\n    },\n\n    \n    onRemove : function(c){\n        Ext.Toolbar.superclass.onRemove.call(this);\n        if (c == this.activeMenuBtn) {\n            delete this.activeMenuBtn;\n        }\n        this.trackMenu(c, true);\n    },\n\n    \n    onDisable : function(){\n        this.items.each(function(item){\n             if(item.disable){\n                 item.disable();\n             }\n        });\n    },\n\n    \n    onEnable : function(){\n        this.items.each(function(item){\n             if(item.enable){\n                 item.enable();\n             }\n        });\n    },\n\n    \n    onButtonTriggerOver : function(btn){\n        if(this.activeMenuBtn && this.activeMenuBtn != btn){\n            this.activeMenuBtn.hideMenu();\n            btn.showMenu();\n            this.activeMenuBtn = btn;\n        }\n    },\n\n    \n    onButtonMenuShow : function(btn){\n        this.activeMenuBtn = btn;\n    },\n\n    \n    onButtonMenuHide : function(btn){\n        delete this.activeMenuBtn;\n    }\n});\nExt.reg('toolbar', Ext.Toolbar);\n\n\nT.Item = Ext.extend(Ext.BoxComponent, {\n    hideParent: true, \n    enable:Ext.emptyFn,\n    disable:Ext.emptyFn,\n    focus:Ext.emptyFn\n    \n});\nExt.reg('tbitem', T.Item);\n\n\nT.Separator = Ext.extend(T.Item, {\n    onRender : function(ct, position){\n        this.el = ct.createChild({tag:'span', cls:'xtb-sep'}, position);\n    }\n});\nExt.reg('tbseparator', T.Separator);\n\n\nT.Spacer = Ext.extend(T.Item, {\n    \n\n    onRender : function(ct, position){\n        this.el = ct.createChild({tag:'div', cls:'xtb-spacer', style: this.width?'width:'+this.width+'px':''}, position);\n    }\n});\nExt.reg('tbspacer', T.Spacer);\n\n\nT.Fill = Ext.extend(T.Item, {\n    \n    render : Ext.emptyFn,\n    isFill : true\n});\nExt.reg('tbfill', T.Fill);\n\n\nT.TextItem = Ext.extend(T.Item, {\n    \n\n    constructor: function(config){\n        T.TextItem.superclass.constructor.call(this, Ext.isString(config) ? {text: config} : config);\n    },\n\n    \n    onRender : function(ct, position) {\n        this.autoEl = {cls: 'xtb-text', html: this.text || ''};\n        T.TextItem.superclass.onRender.call(this, ct, position);\n    },\n\n    \n    setText : function(t) {\n        if(this.rendered){\n            this.el.update(t);\n        }else{\n            this.text = t;\n        }\n    }\n});\nExt.reg('tbtext', T.TextItem);\n\n\nT.Button = Ext.extend(Ext.Button, {});\nT.SplitButton = Ext.extend(Ext.SplitButton, {});\nExt.reg('tbbutton', T.Button);\nExt.reg('tbsplit', T.SplitButton);\n\n})();\n\nExt.ButtonGroup = Ext.extend(Ext.Panel, {\n    \n    \n    baseCls: 'x-btn-group',\n    \n    layout:'table',\n    defaultType: 'button',\n    \n    frame: true,\n    internalDefaults: {removeMode: 'container', hideParent: true},\n\n    initComponent : function(){\n        this.layoutConfig = this.layoutConfig || {};\n        Ext.applyIf(this.layoutConfig, {\n            columns : this.columns\n        });\n        if(!this.title){\n            this.addClass('x-btn-group-notitle');\n        }\n        this.on('afterlayout', this.onAfterLayout, this);\n        Ext.ButtonGroup.superclass.initComponent.call(this);\n    },\n\n    applyDefaults : function(c){\n        c = Ext.ButtonGroup.superclass.applyDefaults.call(this, c);\n        var d = this.internalDefaults;\n        if(c.events){\n            Ext.applyIf(c.initialConfig, d);\n            Ext.apply(c, d);\n        }else{\n            Ext.applyIf(c, d);\n        }\n        return c;\n    },\n\n    onAfterLayout : function(){\n        var bodyWidth = this.body.getFrameWidth('lr') + this.body.dom.firstChild.offsetWidth;\n        this.body.setWidth(bodyWidth);\n        this.el.setWidth(bodyWidth + this.getFrameWidth());\n    }\n    \n});\n\nExt.reg('buttongroup', Ext.ButtonGroup);\n\n(function() {\n\nvar T = Ext.Toolbar;\n\nExt.PagingToolbar = Ext.extend(Ext.Toolbar, {\n    \n    \n    \n    pageSize : 20,\n    \n    \n    displayMsg : 'Displaying {0} - {1} of {2}',\n    \n    emptyMsg : 'No data to display',\n    \n    beforePageText : 'Page',\n    \n    afterPageText : 'of {0}',\n    \n    firstText : 'First Page',\n    \n    prevText : 'Previous Page',\n    \n    nextText : 'Next Page',\n    \n    lastText : 'Last Page',\n    \n    refreshText : 'Refresh',\n\n    \n\n    \n\n    \n\n    initComponent : function(){\n        var pagingItems = [this.first = new T.Button({\n            tooltip: this.firstText,\n            overflowText: this.firstText,\n            iconCls: 'x-tbar-page-first',\n            disabled: true,\n            handler: this.moveFirst,\n            scope: this\n        }), this.prev = new T.Button({\n            tooltip: this.prevText,\n            overflowText: this.prevText,\n            iconCls: 'x-tbar-page-prev',\n            disabled: true,\n            handler: this.movePrevious,\n            scope: this\n        }), '-', this.beforePageText,\n        this.inputItem = new Ext.form.NumberField({\n            cls: 'x-tbar-page-number',\n            allowDecimals: false,\n            allowNegative: false,\n            enableKeyEvents: true,\n            selectOnFocus: true,\n            submitValue: false,\n            listeners: {\n                scope: this,\n                keydown: this.onPagingKeyDown,\n                blur: this.onPagingBlur\n            }\n        }), this.afterTextItem = new T.TextItem({\n            text: String.format(this.afterPageText, 1)\n        }), '-', this.next = new T.Button({\n            tooltip: this.nextText,\n            overflowText: this.nextText,\n            iconCls: 'x-tbar-page-next',\n            disabled: true,\n            handler: this.moveNext,\n            scope: this\n        }), this.last = new T.Button({\n            tooltip: this.lastText,\n            overflowText: this.lastText,\n            iconCls: 'x-tbar-page-last',\n            disabled: true,\n            handler: this.moveLast,\n            scope: this\n        }), '-', this.refresh = new T.Button({\n            tooltip: this.refreshText,\n            overflowText: this.refreshText,\n            iconCls: 'x-tbar-loading',\n            handler: this.doRefresh,\n            scope: this\n        })];\n\n\n        var userItems = this.items || this.buttons || [];\n        if (this.prependButtons) {\n            this.items = userItems.concat(pagingItems);\n        }else{\n            this.items = pagingItems.concat(userItems);\n        }\n        delete this.buttons;\n        if(this.displayInfo){\n            this.items.push('->');\n            this.items.push(this.displayItem = new T.TextItem({}));\n        }\n        Ext.PagingToolbar.superclass.initComponent.call(this);\n        this.addEvents(\n            \n            'change',\n            \n            'beforechange'\n        );\n        this.on('afterlayout', this.onFirstLayout, this, {single: true});\n        this.cursor = 0;\n        this.bindStore(this.store, true);\n    },\n\n    \n    onFirstLayout : function(){\n        if(this.dsLoaded){\n            this.onLoad.apply(this, this.dsLoaded);\n        }\n    },\n\n    \n    updateInfo : function(){\n        if(this.displayItem){\n            var count = this.store.getCount();\n            var msg = count == 0 ?\n                this.emptyMsg :\n                String.format(\n                    this.displayMsg,\n                    this.cursor+1, this.cursor+count, this.store.getTotalCount()\n                );\n            this.displayItem.setText(msg);\n        }\n    },\n\n    \n    onLoad : function(store, r, o){\n        if(!this.rendered){\n            this.dsLoaded = [store, r, o];\n            return;\n        }\n        var p = this.getParams();\n        this.cursor = (o.params && o.params[p.start]) ? o.params[p.start] : 0;\n        var d = this.getPageData(), ap = d.activePage, ps = d.pages;\n\n        this.afterTextItem.setText(String.format(this.afterPageText, d.pages));\n        this.inputItem.setValue(ap);\n        this.first.setDisabled(ap == 1);\n        this.prev.setDisabled(ap == 1);\n        this.next.setDisabled(ap == ps);\n        this.last.setDisabled(ap == ps);\n        this.refresh.enable();\n        this.updateInfo();\n        this.fireEvent('change', this, d);\n    },\n\n    \n    getPageData : function(){\n        var total = this.store.getTotalCount();\n        return {\n            total : total,\n            activePage : Math.ceil((this.cursor+this.pageSize)/this.pageSize),\n            pages :  total < this.pageSize ? 1 : Math.ceil(total/this.pageSize)\n        };\n    },\n\n    \n    changePage : function(page){\n        this.doLoad(((page-1) * this.pageSize).constrain(0, this.store.getTotalCount()));\n    },\n\n    \n    onLoadError : function(){\n        if(!this.rendered){\n            return;\n        }\n        this.refresh.enable();\n    },\n\n    \n    readPage : function(d){\n        var v = this.inputItem.getValue(), pageNum;\n        if (!v || isNaN(pageNum = parseInt(v, 10))) {\n            this.inputItem.setValue(d.activePage);\n            return false;\n        }\n        return pageNum;\n    },\n\n    onPagingFocus : function(){\n        this.inputItem.select();\n    },\n\n    \n    onPagingBlur : function(e){\n        this.inputItem.setValue(this.getPageData().activePage);\n    },\n\n    \n    onPagingKeyDown : function(field, e){\n        var k = e.getKey(), d = this.getPageData(), pageNum;\n        if (k == e.RETURN) {\n            e.stopEvent();\n            pageNum = this.readPage(d);\n            if(pageNum !== false){\n                pageNum = Math.min(Math.max(1, pageNum), d.pages) - 1;\n                this.doLoad(pageNum * this.pageSize);\n            }\n        }else if (k == e.HOME || k == e.END){\n            e.stopEvent();\n            pageNum = k == e.HOME ? 1 : d.pages;\n            field.setValue(pageNum);\n        }else if (k == e.UP || k == e.PAGEUP || k == e.DOWN || k == e.PAGEDOWN){\n            e.stopEvent();\n            if((pageNum = this.readPage(d))){\n                var increment = e.shiftKey ? 10 : 1;\n                if(k == e.DOWN || k == e.PAGEDOWN){\n                    increment *= -1;\n                }\n                pageNum += increment;\n                if(pageNum >= 1 & pageNum <= d.pages){\n                    field.setValue(pageNum);\n                }\n            }\n        }\n    },\n\n    \n    getParams : function(){\n        \n        return this.paramNames || this.store.paramNames;\n    },\n\n    \n    beforeLoad : function(){\n        if(this.rendered && this.refresh){\n            this.refresh.disable();\n        }\n    },\n\n    \n    doLoad : function(start){\n        var o = {}, pn = this.getParams();\n        o[pn.start] = start;\n        o[pn.limit] = this.pageSize;\n        if(this.fireEvent('beforechange', this, o) !== false){\n            this.store.load({params:o});\n        }\n    },\n\n    \n    moveFirst : function(){\n        this.doLoad(0);\n    },\n\n    \n    movePrevious : function(){\n        this.doLoad(Math.max(0, this.cursor-this.pageSize));\n    },\n\n    \n    moveNext : function(){\n        this.doLoad(this.cursor+this.pageSize);\n    },\n\n    \n    moveLast : function(){\n        var total = this.store.getTotalCount(),\n            extra = total % this.pageSize;\n\n        this.doLoad(extra ? (total - extra) : total - this.pageSize);\n    },\n\n    \n    doRefresh : function(){\n        this.doLoad(this.cursor);\n    },\n\n    \n    bindStore : function(store, initial){\n        var doLoad;\n        if(!initial && this.store){\n            if(store !== this.store && this.store.autoDestroy){\n                this.store.destroy();\n            }else{\n                this.store.un('beforeload', this.beforeLoad, this);\n                this.store.un('load', this.onLoad, this);\n                this.store.un('exception', this.onLoadError, this);\n            }\n            if(!store){\n                this.store = null;\n            }\n        }\n        if(store){\n            store = Ext.StoreMgr.lookup(store);\n            store.on({\n                scope: this,\n                beforeload: this.beforeLoad,\n                load: this.onLoad,\n                exception: this.onLoadError\n            });\n            doLoad = true;\n        }\n        this.store = store;\n        if(doLoad){\n            this.onLoad(store, null, {});\n        }\n    },\n\n    \n    unbind : function(store){\n        this.bindStore(null);\n    },\n\n    \n    bind : function(store){\n        this.bindStore(store);\n    },\n\n    \n    onDestroy : function(){\n        this.bindStore(null);\n        Ext.PagingToolbar.superclass.onDestroy.call(this);\n    }\n});\n\n})();\nExt.reg('paging', Ext.PagingToolbar);\nExt.History = (function () {\n    var iframe, hiddenField;\n    var ready = false;\n    var currentToken;\n\n    function getHash() {\n        var href = location.href, i = href.indexOf(\"#\"),\n            hash = i >= 0 ? href.substr(i + 1) : null;\n             \n        if (Ext.isGecko) {\n            hash = decodeURIComponent(hash);\n        }\n        return hash;\n    }\n\n    function doSave() {\n        hiddenField.value = currentToken;\n    }\n\n    function handleStateChange(token) {\n        currentToken = token;\n        Ext.History.fireEvent('change', token);\n    }\n\n    function updateIFrame (token) {\n        var html = ['<html><body><div id=\"state\">',Ext.util.Format.htmlEncode(token),'</div></body></html>'].join('');\n        try {\n            var doc = iframe.contentWindow.document;\n            doc.open();\n            doc.write(html);\n            doc.close();\n            return true;\n        } catch (e) {\n            return false;\n        }\n    }\n\n    function checkIFrame() {\n        if (!iframe.contentWindow || !iframe.contentWindow.document) {\n            setTimeout(checkIFrame, 10);\n            return;\n        }\n\n        var doc = iframe.contentWindow.document;\n        var elem = doc.getElementById(\"state\");\n        var token = elem ? elem.innerText : null;\n\n        var hash = getHash();\n\n        setInterval(function () {\n\n            doc = iframe.contentWindow.document;\n            elem = doc.getElementById(\"state\");\n\n            var newtoken = elem ? elem.innerText : null;\n\n            var newHash = getHash();\n\n            if (newtoken !== token) {\n                token = newtoken;\n                handleStateChange(token);\n                location.hash = token;\n                hash = token;\n                doSave();\n            } else if (newHash !== hash) {\n                hash = newHash;\n                updateIFrame(newHash);\n            }\n\n        }, 50);\n\n        ready = true;\n\n        Ext.History.fireEvent('ready', Ext.History);\n    }\n\n    function startUp() {\n        currentToken = hiddenField.value ? hiddenField.value : getHash();\n\n        if (Ext.isIE) {\n            checkIFrame();\n        } else {\n            var hash = getHash();\n            setInterval(function () {\n                var newHash = getHash();\n                if (newHash !== hash) {\n                    hash = newHash;\n                    handleStateChange(hash);\n                    doSave();\n                }\n            }, 50);\n            ready = true;\n            Ext.History.fireEvent('ready', Ext.History);\n        }\n    }\n\n    return {\n        \n        fieldId: 'x-history-field',\n        \n        iframeId: 'x-history-frame',\n\n        events:{},\n\n        \n        init: function (onReady, scope) {\n            if(ready) {\n                Ext.callback(onReady, scope, [this]);\n                return;\n            }\n            if(!Ext.isReady){\n                Ext.onReady(function(){\n                    Ext.History.init(onReady, scope);\n                });\n                return;\n            }\n            hiddenField = Ext.getDom(Ext.History.fieldId);\n            if (Ext.isIE) {\n                iframe = Ext.getDom(Ext.History.iframeId);\n            }\n            this.addEvents(\n                \n                'ready',\n                \n                'change'\n            );\n            if(onReady){\n                this.on('ready', onReady, scope, {single:true});\n            }\n            startUp();\n        },\n\n        \n        add: function (token, preventDup) {\n            if(preventDup !== false){\n                if(this.getToken() == token){\n                    return true;\n                }\n            }\n            if (Ext.isIE) {\n                return updateIFrame(token);\n            } else {\n                location.hash = token;\n                return true;\n            }\n        },\n\n        \n        back: function(){\n            history.go(-1);\n        },\n\n        \n        forward: function(){\n            history.go(1);\n        },\n\n        \n        getToken: function() {\n            return ready ? currentToken : getHash();\n        }\n    };\n})();\nExt.apply(Ext.History, new Ext.util.Observable());\nExt.Tip = Ext.extend(Ext.Panel, {\n    \n    \n    \n    minWidth : 40,\n    \n    maxWidth : 300,\n    \n    shadow : \"sides\",\n    \n    defaultAlign : \"tl-bl?\",\n    autoRender: true,\n    quickShowInterval : 250,\n\n    \n    frame:true,\n    hidden:true,\n    baseCls: 'x-tip',\n    floating:{shadow:true,shim:true,useDisplay:true,constrain:false},\n    autoHeight:true,\n\n    closeAction: 'hide',\n\n    \n    initComponent : function(){\n        Ext.Tip.superclass.initComponent.call(this);\n        if(this.closable && !this.title){\n            this.elements += ',header';\n        }\n    },\n\n    \n    afterRender : function(){\n        Ext.Tip.superclass.afterRender.call(this);\n        if(this.closable){\n            this.addTool({\n                id: 'close',\n                handler: this[this.closeAction],\n                scope: this\n            });\n        }\n    },\n\n    \n    showAt : function(xy){\n        Ext.Tip.superclass.show.call(this);\n        if(this.measureWidth !== false && (!this.initialConfig || typeof this.initialConfig.width != 'number')){\n            this.doAutoWidth();\n        }\n        if(this.constrainPosition){\n            xy = this.el.adjustForConstraints(xy);\n        }\n        this.setPagePosition(xy[0], xy[1]);\n    },\n\n    \n    doAutoWidth : function(adjust){\n        adjust = adjust || 0;\n        var bw = this.body.getTextWidth();\n        if(this.title){\n            bw = Math.max(bw, this.header.child('span').getTextWidth(this.title));\n        }\n        bw += this.getFrameWidth() + (this.closable ? 20 : 0) + this.body.getPadding(\"lr\") + adjust;\n        this.setWidth(bw.constrain(this.minWidth, this.maxWidth));\n        \n        \n        if(Ext.isIE7 && !this.repainted){\n            this.el.repaint();\n            this.repainted = true;\n        }\n    },\n\n    \n    showBy : function(el, pos){\n        if(!this.rendered){\n            this.render(Ext.getBody());\n        }\n        this.showAt(this.el.getAlignToXY(el, pos || this.defaultAlign));\n    },\n\n    initDraggable : function(){\n        this.dd = new Ext.Tip.DD(this, typeof this.draggable == 'boolean' ? null : this.draggable);\n        this.header.addClass('x-tip-draggable');\n    }\n});\n\nExt.reg('tip', Ext.Tip);\n\n\nExt.Tip.DD = function(tip, config){\n    Ext.apply(this, config);\n    this.tip = tip;\n    Ext.Tip.DD.superclass.constructor.call(this, tip.el.id, 'WindowDD-'+tip.id);\n    this.setHandleElId(tip.header.id);\n    this.scroll = false;\n};\n\nExt.extend(Ext.Tip.DD, Ext.dd.DD, {\n    moveOnly:true,\n    scroll:false,\n    headerOffsets:[100, 25],\n    startDrag : function(){\n        this.tip.el.disableShadow();\n    },\n    endDrag : function(e){\n        this.tip.el.enableShadow(true);\n    }\n});\nExt.ToolTip = Ext.extend(Ext.Tip, {\n    \n    \n    \n    \n    showDelay : 500,\n    \n    hideDelay : 200,\n    \n    dismissDelay : 5000,\n    \n    \n    trackMouse : false,\n    \n    anchorToTarget : true,\n    \n    anchorOffset : 0,\n    \n\n    \n    targetCounter : 0,\n\n    constrainPosition : false,\n\n    \n    initComponent : function(){\n        Ext.ToolTip.superclass.initComponent.call(this);\n        this.lastActive = new Date();\n        this.initTarget(this.target);\n        this.origAnchor = this.anchor;\n    },\n\n    \n    onRender : function(ct, position){\n        Ext.ToolTip.superclass.onRender.call(this, ct, position);\n        this.anchorCls = 'x-tip-anchor-' + this.getAnchorPosition();\n        this.anchorEl = this.el.createChild({\n            cls: 'x-tip-anchor ' + this.anchorCls\n        });\n    },\n\n    \n    afterRender : function(){\n        Ext.ToolTip.superclass.afterRender.call(this);\n        this.anchorEl.setStyle('z-index', this.el.getZIndex() + 1).setVisibilityMode(Ext.Element.DISPLAY);\n    },\n\n    \n    initTarget : function(target){\n        var t;\n        if((t = Ext.get(target))){\n            if(this.target){\n                var tg = Ext.get(this.target);\n                this.mun(tg, 'mouseover', this.onTargetOver, this);\n                this.mun(tg, 'mouseout', this.onTargetOut, this);\n                this.mun(tg, 'mousemove', this.onMouseMove, this);\n            }\n            this.mon(t, {\n                mouseover: this.onTargetOver,\n                mouseout: this.onTargetOut,\n                mousemove: this.onMouseMove,\n                scope: this\n            });\n            this.target = t;\n        }\n        if(this.anchor){\n            this.anchorTarget = this.target;\n        }\n    },\n\n    \n    onMouseMove : function(e){\n        var t = this.delegate ? e.getTarget(this.delegate) : this.triggerElement = true;\n        if (t) {\n            this.targetXY = e.getXY();\n            if (t === this.triggerElement) {\n                if(!this.hidden && this.trackMouse){\n                    this.setPagePosition(this.getTargetXY());\n                }\n            } else {\n                this.hide();\n                this.lastActive = new Date(0);\n                this.onTargetOver(e);\n            }\n        } else if (!this.closable && this.isVisible()) {\n            this.hide();\n        }\n    },\n\n    \n    getTargetXY : function(){\n        if(this.delegate){\n            this.anchorTarget = this.triggerElement;\n        }\n        if(this.anchor){\n            this.targetCounter++;\n            var offsets = this.getOffsets(),\n                xy = (this.anchorToTarget && !this.trackMouse) ? this.el.getAlignToXY(this.anchorTarget, this.getAnchorAlign()) : this.targetXY,\n                dw = Ext.lib.Dom.getViewWidth() - 5,\n                dh = Ext.lib.Dom.getViewHeight() - 5,\n                de = document.documentElement,\n                bd = document.body,\n                scrollX = (de.scrollLeft || bd.scrollLeft || 0) + 5,\n                scrollY = (de.scrollTop || bd.scrollTop || 0) + 5,\n                axy = [xy[0] + offsets[0], xy[1] + offsets[1]],\n                sz = this.getSize();\n                \n            this.anchorEl.removeClass(this.anchorCls);\n\n            if(this.targetCounter < 2){\n                if(axy[0] < scrollX){\n                    if(this.anchorToTarget){\n                        this.defaultAlign = 'l-r';\n                        if(this.mouseOffset){this.mouseOffset[0] *= -1;}\n                    }\n                    this.anchor = 'left';\n                    return this.getTargetXY();\n                }\n                if(axy[0]+sz.width > dw){\n                    if(this.anchorToTarget){\n                        this.defaultAlign = 'r-l';\n                        if(this.mouseOffset){this.mouseOffset[0] *= -1;}\n                    }\n                    this.anchor = 'right';\n                    return this.getTargetXY();\n                }\n                if(axy[1] < scrollY){\n                    if(this.anchorToTarget){\n                        this.defaultAlign = 't-b';\n                        if(this.mouseOffset){this.mouseOffset[1] *= -1;}\n                    }\n                    this.anchor = 'top';\n                    return this.getTargetXY();\n                }\n                if(axy[1]+sz.height > dh){\n                    if(this.anchorToTarget){\n                        this.defaultAlign = 'b-t';\n                        if(this.mouseOffset){this.mouseOffset[1] *= -1;}\n                    }\n                    this.anchor = 'bottom';\n                    return this.getTargetXY();\n                }\n            }\n\n            this.anchorCls = 'x-tip-anchor-'+this.getAnchorPosition();\n            this.anchorEl.addClass(this.anchorCls);\n            this.targetCounter = 0;\n            return axy;\n        }else{\n            var mouseOffset = this.getMouseOffset();\n            return [this.targetXY[0]+mouseOffset[0], this.targetXY[1]+mouseOffset[1]];\n        }\n    },\n\n    getMouseOffset : function(){\n        var offset = this.anchor ? [0,0] : [15,18];\n        if(this.mouseOffset){\n            offset[0] += this.mouseOffset[0];\n            offset[1] += this.mouseOffset[1];\n        }\n        return offset;\n    },\n\n    \n    getAnchorPosition : function(){\n        if(this.anchor){\n            this.tipAnchor = this.anchor.charAt(0);\n        }else{\n            var m = this.defaultAlign.match(/^([a-z]+)-([a-z]+)(\\?)?$/);\n            if(!m){\n               throw 'AnchorTip.defaultAlign is invalid';\n            }\n            this.tipAnchor = m[1].charAt(0);\n        }\n\n        switch(this.tipAnchor){\n            case 't': return 'top';\n            case 'b': return 'bottom';\n            case 'r': return 'right';\n        }\n        return 'left';\n    },\n\n    \n    getAnchorAlign : function(){\n        switch(this.anchor){\n            case 'top'  : return 'tl-bl';\n            case 'left' : return 'tl-tr';\n            case 'right': return 'tr-tl';\n            default     : return 'bl-tl';\n        }\n    },\n\n    \n    getOffsets : function(){\n        var offsets, \n            ap = this.getAnchorPosition().charAt(0);\n        if(this.anchorToTarget && !this.trackMouse){\n            switch(ap){\n                case 't':\n                    offsets = [0, 9];\n                    break;\n                case 'b':\n                    offsets = [0, -13];\n                    break;\n                case 'r':\n                    offsets = [-13, 0];\n                    break;\n                default:\n                    offsets = [9, 0];\n                    break;\n            }\n        }else{\n            switch(ap){\n                case 't':\n                    offsets = [-15-this.anchorOffset, 30];\n                    break;\n                case 'b':\n                    offsets = [-19-this.anchorOffset, -13-this.el.dom.offsetHeight];\n                    break;\n                case 'r':\n                    offsets = [-15-this.el.dom.offsetWidth, -13-this.anchorOffset];\n                    break;\n                default:\n                    offsets = [25, -13-this.anchorOffset];\n                    break;\n            }\n        }\n        var mouseOffset = this.getMouseOffset();\n        offsets[0] += mouseOffset[0];\n        offsets[1] += mouseOffset[1];\n\n        return offsets;\n    },\n\n    \n    onTargetOver : function(e){\n        if(this.disabled || e.within(this.target.dom, true)){\n            return;\n        }\n        var t = e.getTarget(this.delegate);\n        if (t) {\n            this.triggerElement = t;\n            this.clearTimer('hide');\n            this.targetXY = e.getXY();\n            this.delayShow();\n        }\n    },\n\n    \n    delayShow : function(){\n        if(this.hidden && !this.showTimer){\n            if(this.lastActive.getElapsed() < this.quickShowInterval){\n                this.show();\n            }else{\n                this.showTimer = this.show.defer(this.showDelay, this);\n            }\n        }else if(!this.hidden && this.autoHide !== false){\n            this.show();\n        }\n    },\n\n    \n    onTargetOut : function(e){\n        if(this.disabled || e.within(this.target.dom, true)){\n            return;\n        }\n        this.clearTimer('show');\n        if(this.autoHide !== false){\n            this.delayHide();\n        }\n    },\n\n    \n    delayHide : function(){\n        if(!this.hidden && !this.hideTimer){\n            this.hideTimer = this.hide.defer(this.hideDelay, this);\n        }\n    },\n\n    \n    hide: function(){\n        this.clearTimer('dismiss');\n        this.lastActive = new Date();\n        if(this.anchorEl){\n            this.anchorEl.hide();\n        }\n        Ext.ToolTip.superclass.hide.call(this);\n        delete this.triggerElement;\n    },\n\n    \n    show : function(){\n        if(this.anchor){\n            \n            \n            this.showAt([-1000,-1000]);\n            this.origConstrainPosition = this.constrainPosition;\n            this.constrainPosition = false;\n            this.anchor = this.origAnchor;\n        }\n        this.showAt(this.getTargetXY());\n\n        if(this.anchor){\n            this.anchorEl.show();\n            this.syncAnchor();\n            this.constrainPosition = this.origConstrainPosition;\n        }else{\n            this.anchorEl.hide();\n        }\n    },\n\n    \n    showAt : function(xy){\n        this.lastActive = new Date();\n        this.clearTimers();\n        Ext.ToolTip.superclass.showAt.call(this, xy);\n        if(this.dismissDelay && this.autoHide !== false){\n            this.dismissTimer = this.hide.defer(this.dismissDelay, this);\n        }\n        if(this.anchor && !this.anchorEl.isVisible()){\n            this.syncAnchor();\n            this.anchorEl.show();\n        }else{\n            this.anchorEl.hide();\n        }\n    },\n\n    \n    syncAnchor : function(){\n        var anchorPos, targetPos, offset;\n        switch(this.tipAnchor.charAt(0)){\n            case 't':\n                anchorPos = 'b';\n                targetPos = 'tl';\n                offset = [20+this.anchorOffset, 2];\n                break;\n            case 'r':\n                anchorPos = 'l';\n                targetPos = 'tr';\n                offset = [-2, 11+this.anchorOffset];\n                break;\n            case 'b':\n                anchorPos = 't';\n                targetPos = 'bl';\n                offset = [20+this.anchorOffset, -2];\n                break;\n            default:\n                anchorPos = 'r';\n                targetPos = 'tl';\n                offset = [2, 11+this.anchorOffset];\n                break;\n        }\n        this.anchorEl.alignTo(this.el, anchorPos+'-'+targetPos, offset);\n    },\n\n    \n    setPagePosition : function(x, y){\n        Ext.ToolTip.superclass.setPagePosition.call(this, x, y);\n        if(this.anchor){\n            this.syncAnchor();\n        }\n    },\n\n    \n    clearTimer : function(name){\n        name = name + 'Timer';\n        clearTimeout(this[name]);\n        delete this[name];\n    },\n\n    \n    clearTimers : function(){\n        this.clearTimer('show');\n        this.clearTimer('dismiss');\n        this.clearTimer('hide');\n    },\n\n    \n    onShow : function(){\n        Ext.ToolTip.superclass.onShow.call(this);\n        Ext.getDoc().on('mousedown', this.onDocMouseDown, this);\n    },\n\n    \n    onHide : function(){\n        Ext.ToolTip.superclass.onHide.call(this);\n        Ext.getDoc().un('mousedown', this.onDocMouseDown, this);\n    },\n\n    \n    onDocMouseDown : function(e){\n        if(this.autoHide !== true && !this.closable && !e.within(this.el.dom)){\n            this.disable();\n            this.doEnable.defer(100, this);\n        }\n    },\n    \n    \n    doEnable : function(){\n        if(!this.isDestroyed){\n            this.enable();\n        }\n    },\n\n    \n    onDisable : function(){\n        this.clearTimers();\n        this.hide();\n    },\n\n    \n    adjustPosition : function(x, y){\n        if(this.constrainPosition){\n            var ay = this.targetXY[1], h = this.getSize().height;\n            if(y <= ay && (y+h) >= ay){\n                y = ay-h-5;\n            }\n        }\n        return {x : x, y: y};\n    },\n    \n    beforeDestroy : function(){\n        this.clearTimers();\n        Ext.destroy(this.anchorEl);\n        delete this.anchorEl;\n        delete this.target;\n        delete this.anchorTarget;\n        delete this.triggerElement;\n        Ext.ToolTip.superclass.beforeDestroy.call(this);    \n    },\n\n    \n    onDestroy : function(){\n        Ext.getDoc().un('mousedown', this.onDocMouseDown, this);\n        Ext.ToolTip.superclass.onDestroy.call(this);\n    }\n});\n\nExt.reg('tooltip', Ext.ToolTip);\nExt.QuickTip = Ext.extend(Ext.ToolTip, {\n    \n    \n    interceptTitles : false,\n\n    \n    tagConfig : {\n        namespace : \"ext\",\n        attribute : \"qtip\",\n        width : \"qwidth\",\n        target : \"target\",\n        title : \"qtitle\",\n        hide : \"hide\",\n        cls : \"qclass\",\n        align : \"qalign\",\n        anchor : \"anchor\"\n    },\n\n    \n    initComponent : function(){\n        this.target = this.target || Ext.getDoc();\n        this.targets = this.targets || {};\n        Ext.QuickTip.superclass.initComponent.call(this);\n    },\n\n    \n    register : function(config){\n        var cs = Ext.isArray(config) ? config : arguments;\n        for(var i = 0, len = cs.length; i < len; i++){\n            var c = cs[i];\n            var target = c.target;\n            if(target){\n                if(Ext.isArray(target)){\n                    for(var j = 0, jlen = target.length; j < jlen; j++){\n                        this.targets[Ext.id(target[j])] = c;\n                    }\n                } else{\n                    this.targets[Ext.id(target)] = c;\n                }\n            }\n        }\n    },\n\n    \n    unregister : function(el){\n        delete this.targets[Ext.id(el)];\n    },\n    \n    \n    cancelShow: function(el){\n        var at = this.activeTarget;\n        el = Ext.get(el).dom;\n        if(this.isVisible()){\n            if(at && at.el == el){\n                this.hide();\n            }\n        }else if(at && at.el == el){\n            this.clearTimer('show');\n        }\n    },\n    \n    getTipCfg: function(e) {\n        var t = e.getTarget(), \n            ttp, \n            cfg;\n        if(this.interceptTitles && t.title && Ext.isString(t.title)){\n            ttp = t.title;\n            t.qtip = ttp;\n            t.removeAttribute(\"title\");\n            e.preventDefault();\n        }else{\n            cfg = this.tagConfig;\n            ttp = t.qtip || Ext.fly(t).getAttribute(cfg.attribute, cfg.namespace);\n        }\n        return ttp;\n    },\n\n    \n    onTargetOver : function(e){\n        if(this.disabled){\n            return;\n        }\n        this.targetXY = e.getXY();\n        var t = e.getTarget();\n        if(!t || t.nodeType !== 1 || t == document || t == document.body){\n            return;\n        }\n        if(this.activeTarget && ((t == this.activeTarget.el) || Ext.fly(this.activeTarget.el).contains(t))){\n            this.clearTimer('hide');\n            this.show();\n            return;\n        }\n        if(t && this.targets[t.id]){\n            this.activeTarget = this.targets[t.id];\n            this.activeTarget.el = t;\n            this.anchor = this.activeTarget.anchor;\n            if(this.anchor){\n                this.anchorTarget = t;\n            }\n            this.delayShow();\n            return;\n        }\n        var ttp, et = Ext.fly(t), cfg = this.tagConfig, ns = cfg.namespace;\n        if(ttp = this.getTipCfg(e)){\n            var autoHide = et.getAttribute(cfg.hide, ns);\n            this.activeTarget = {\n                el: t,\n                text: ttp,\n                width: et.getAttribute(cfg.width, ns),\n                autoHide: autoHide != \"user\" && autoHide !== 'false',\n                title: et.getAttribute(cfg.title, ns),\n                cls: et.getAttribute(cfg.cls, ns),\n                align: et.getAttribute(cfg.align, ns)\n                \n            };\n            this.anchor = et.getAttribute(cfg.anchor, ns);\n            if(this.anchor){\n                this.anchorTarget = t;\n            }\n            this.delayShow();\n        }\n    },\n\n    \n    onTargetOut : function(e){\n\n        \n        if (this.activeTarget && e.within(this.activeTarget.el) && !this.getTipCfg(e)) {\n            return;\n        }\n\n        this.clearTimer('show');\n        if(this.autoHide !== false){\n            this.delayHide();\n        }\n    },\n\n    \n    showAt : function(xy){\n        var t = this.activeTarget;\n        if(t){\n            if(!this.rendered){\n                this.render(Ext.getBody());\n                this.activeTarget = t;\n            }\n            if(t.width){\n                this.setWidth(t.width);\n                this.body.setWidth(this.adjustBodyWidth(t.width - this.getFrameWidth()));\n                this.measureWidth = false;\n            } else{\n                this.measureWidth = true;\n            }\n            this.setTitle(t.title || '');\n            this.body.update(t.text);\n            this.autoHide = t.autoHide;\n            this.dismissDelay = t.dismissDelay || this.dismissDelay;\n            if(this.lastCls){\n                this.el.removeClass(this.lastCls);\n                delete this.lastCls;\n            }\n            if(t.cls){\n                this.el.addClass(t.cls);\n                this.lastCls = t.cls;\n            }\n            if(this.anchor){\n                this.constrainPosition = false;\n            }else if(t.align){ \n                xy = this.el.getAlignToXY(t.el, t.align);\n                this.constrainPosition = false;\n            }else{\n                this.constrainPosition = true;\n            }\n        }\n        Ext.QuickTip.superclass.showAt.call(this, xy);\n    },\n\n    \n    hide: function(){\n        delete this.activeTarget;\n        Ext.QuickTip.superclass.hide.call(this);\n    }\n});\nExt.reg('quicktip', Ext.QuickTip);\nExt.QuickTips = function(){\n    var tip,\n        disabled = false;\n        \n    return {\n        \n        init : function(autoRender){\n            if(!tip){\n                if(!Ext.isReady){\n                    Ext.onReady(function(){\n                        Ext.QuickTips.init(autoRender);\n                    });\n                    return;\n                }\n                tip = new Ext.QuickTip({\n                    elements:'header,body', \n                    disabled: disabled\n                });\n                if(autoRender !== false){\n                    tip.render(Ext.getBody());\n                }\n            }\n        },\n        \n        \n        ddDisable : function(){\n            \n            if(tip && !disabled){\n                tip.disable();\n            }    \n        },\n        \n        \n        ddEnable : function(){\n            \n            if(tip && !disabled){\n                tip.enable();\n            }\n        },\n\n        \n        enable : function(){\n            if(tip){\n                tip.enable();\n            }\n            disabled = false;\n        },\n\n        \n        disable : function(){\n            if(tip){\n                tip.disable();\n            }\n            disabled = true;\n        },\n\n        \n        isEnabled : function(){\n            return tip !== undefined && !tip.disabled;\n        },\n\n        \n        getQuickTip : function(){\n            return tip;\n        },\n\n        \n        register : function(){\n            tip.register.apply(tip, arguments);\n        },\n\n        \n        unregister : function(){\n            tip.unregister.apply(tip, arguments);\n        },\n\n        \n        tips : function(){\n            tip.register.apply(tip, arguments);\n        }\n    };\n}();\nExt.slider.Tip = Ext.extend(Ext.Tip, {\n    minWidth: 10,\n    offsets : [0, -10],\n    \n    init: function(slider) {\n        slider.on({\n            scope    : this,\n            dragstart: this.onSlide,\n            drag     : this.onSlide,\n            dragend  : this.hide,\n            destroy  : this.destroy\n        });\n    },\n    \n    \n    onSlide : function(slider, e, thumb) {\n        this.show();\n        this.body.update(this.getText(thumb));\n        this.doAutoWidth();\n        this.el.alignTo(thumb.el, 'b-t?', this.offsets);\n    },\n\n    \n    getText : function(thumb) {\n        return String(thumb.value);\n    }\n});\n\n\nExt.ux.SliderTip = Ext.slider.Tip;\nExt.tree.TreePanel = Ext.extend(Ext.Panel, {\n    rootVisible : true,\n    animate : Ext.enableFx,\n    lines : true,\n    enableDD : false,\n    hlDrop : Ext.enableFx,\n    pathSeparator : '/',\n\n    \n    bubbleEvents : [],\n\n    initComponent : function(){\n        Ext.tree.TreePanel.superclass.initComponent.call(this);\n\n        if(!this.eventModel){\n            this.eventModel = new Ext.tree.TreeEventModel(this);\n        }\n\n        \n        var l = this.loader;\n        if(!l){\n            l = new Ext.tree.TreeLoader({\n                dataUrl: this.dataUrl,\n                requestMethod: this.requestMethod\n            });\n        }else if(Ext.isObject(l) && !l.load){\n            l = new Ext.tree.TreeLoader(l);\n        }\n        this.loader = l;\n\n        this.nodeHash = {};\n\n        \n        if(this.root){\n            var r = this.root;\n            delete this.root;\n            this.setRootNode(r);\n        }\n\n\n        this.addEvents(\n\n            \n           'append',\n           \n           'remove',\n           \n           'movenode',\n           \n           'insert',\n           \n           'beforeappend',\n           \n           'beforeremove',\n           \n           'beforemovenode',\n           \n            'beforeinsert',\n\n            \n            'beforeload',\n            \n            'load',\n            \n            'textchange',\n            \n            'beforeexpandnode',\n            \n            'beforecollapsenode',\n            \n            'expandnode',\n            \n            'disabledchange',\n            \n            'collapsenode',\n            \n            'beforeclick',\n            \n            'click',\n            \n            'containerclick',\n            \n            'checkchange',\n            \n            'beforedblclick',\n            \n            'dblclick',\n            \n            'containerdblclick',\n            \n            'contextmenu',\n            \n            'containercontextmenu',\n            \n            'beforechildrenrendered',\n           \n            'startdrag',\n            \n            'enddrag',\n            \n            'dragdrop',\n            \n            'beforenodedrop',\n            \n            'nodedrop',\n             \n            'nodedragover'\n        );\n        if(this.singleExpand){\n            this.on('beforeexpandnode', this.restrictExpand, this);\n        }\n    },\n\n    \n    proxyNodeEvent : function(ename, a1, a2, a3, a4, a5, a6){\n        if(ename == 'collapse' || ename == 'expand' || ename == 'beforecollapse' || ename == 'beforeexpand' || ename == 'move' || ename == 'beforemove'){\n            ename = ename+'node';\n        }\n        \n        return this.fireEvent(ename, a1, a2, a3, a4, a5, a6);\n    },\n\n\n    \n    getRootNode : function(){\n        return this.root;\n    },\n\n    \n    setRootNode : function(node){\n        this.destroyRoot();\n        if(!node.render){ \n            node = this.loader.createNode(node);\n        }\n        this.root = node;\n        node.ownerTree = this;\n        node.isRoot = true;\n        this.registerNode(node);\n        if(!this.rootVisible){\n            var uiP = node.attributes.uiProvider;\n            node.ui = uiP ? new uiP(node) : new Ext.tree.RootTreeNodeUI(node);\n        }\n        if(this.innerCt){\n            this.clearInnerCt();\n            this.renderRoot();\n        }\n        return node;\n    },\n    \n    clearInnerCt : function(){\n        this.innerCt.update('');    \n    },\n    \n    \n    renderRoot : function(){\n        this.root.render();\n        if(!this.rootVisible){\n            this.root.renderChildren();\n        }\n    },\n\n    \n    getNodeById : function(id){\n        return this.nodeHash[id];\n    },\n\n    \n    registerNode : function(node){\n        this.nodeHash[node.id] = node;\n    },\n\n    \n    unregisterNode : function(node){\n        delete this.nodeHash[node.id];\n    },\n\n    \n    toString : function(){\n        return '[Tree'+(this.id?' '+this.id:'')+']';\n    },\n\n    \n    restrictExpand : function(node){\n        var p = node.parentNode;\n        if(p){\n            if(p.expandedChild && p.expandedChild.parentNode == p){\n                p.expandedChild.collapse();\n            }\n            p.expandedChild = node;\n        }\n    },\n\n    \n    getChecked : function(a, startNode){\n        startNode = startNode || this.root;\n        var r = [];\n        var f = function(){\n            if(this.attributes.checked){\n                r.push(!a ? this : (a == 'id' ? this.id : this.attributes[a]));\n            }\n        };\n        startNode.cascade(f);\n        return r;\n    },\n\n    \n    getLoader : function(){\n        return this.loader;\n    },\n\n    \n    expandAll : function(){\n        this.root.expand(true);\n    },\n\n    \n    collapseAll : function(){\n        this.root.collapse(true);\n    },\n\n    \n    getSelectionModel : function(){\n        if(!this.selModel){\n            this.selModel = new Ext.tree.DefaultSelectionModel();\n        }\n        return this.selModel;\n    },\n\n    \n    expandPath : function(path, attr, callback){\n        if(Ext.isEmpty(path)){\n            if(callback){\n                callback(false, undefined);\n            }\n            return;\n        }\n        attr = attr || 'id';\n        var keys = path.split(this.pathSeparator);\n        var curNode = this.root;\n        if(curNode.attributes[attr] != keys[1]){ \n            if(callback){\n                callback(false, null);\n            }\n            return;\n        }\n        var index = 1;\n        var f = function(){\n            if(++index == keys.length){\n                if(callback){\n                    callback(true, curNode);\n                }\n                return;\n            }\n            var c = curNode.findChild(attr, keys[index]);\n            if(!c){\n                if(callback){\n                    callback(false, curNode);\n                }\n                return;\n            }\n            curNode = c;\n            c.expand(false, false, f);\n        };\n        curNode.expand(false, false, f);\n    },\n\n    \n    selectPath : function(path, attr, callback){\n        if(Ext.isEmpty(path)){\n            if(callback){\n                callback(false, undefined);\n            }\n            return;\n        }\n        attr = attr || 'id';\n        var keys = path.split(this.pathSeparator),\n            v = keys.pop();\n        if(keys.length > 1){\n            var f = function(success, node){\n                if(success && node){\n                    var n = node.findChild(attr, v);\n                    if(n){\n                        n.select();\n                        if(callback){\n                            callback(true, n);\n                        }\n                    }else if(callback){\n                        callback(false, n);\n                    }\n                }else{\n                    if(callback){\n                        callback(false, n);\n                    }\n                }\n            };\n            this.expandPath(keys.join(this.pathSeparator), attr, f);\n        }else{\n            this.root.select();\n            if(callback){\n                callback(true, this.root);\n            }\n        }\n    },\n\n    \n    getTreeEl : function(){\n        return this.body;\n    },\n\n    \n    onRender : function(ct, position){\n        Ext.tree.TreePanel.superclass.onRender.call(this, ct, position);\n        this.el.addClass('x-tree');\n        this.innerCt = this.body.createChild({tag:'ul',\n               cls:'x-tree-root-ct ' +\n               (this.useArrows ? 'x-tree-arrows' : this.lines ? 'x-tree-lines' : 'x-tree-no-lines')});\n    },\n\n    \n    initEvents : function(){\n        Ext.tree.TreePanel.superclass.initEvents.call(this);\n\n        if(this.containerScroll){\n            Ext.dd.ScrollManager.register(this.body);\n        }\n        if((this.enableDD || this.enableDrop) && !this.dropZone){\n           \n             this.dropZone = new Ext.tree.TreeDropZone(this, this.dropConfig || {\n               ddGroup: this.ddGroup || 'TreeDD', appendOnly: this.ddAppendOnly === true\n           });\n        }\n        if((this.enableDD || this.enableDrag) && !this.dragZone){\n           \n            this.dragZone = new Ext.tree.TreeDragZone(this, this.dragConfig || {\n               ddGroup: this.ddGroup || 'TreeDD',\n               scroll: this.ddScroll\n           });\n        }\n        this.getSelectionModel().init(this);\n    },\n\n    \n    afterRender : function(){\n        Ext.tree.TreePanel.superclass.afterRender.call(this);\n        this.renderRoot();\n    },\n\n    beforeDestroy : function(){\n        if(this.rendered){\n            Ext.dd.ScrollManager.unregister(this.body);\n            Ext.destroy(this.dropZone, this.dragZone);\n        }\n        this.destroyRoot();\n        Ext.destroy(this.loader);\n        this.nodeHash = this.root = this.loader = null;\n        Ext.tree.TreePanel.superclass.beforeDestroy.call(this);\n    },\n    \n    \n    destroyRoot : function(){\n        if(this.root && this.root.destroy){\n            this.root.destroy(true);\n        }\n    }\n\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n\n\n\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n});\n\nExt.tree.TreePanel.nodeTypes = {};\n\nExt.reg('treepanel', Ext.tree.TreePanel);Ext.tree.TreeEventModel = function(tree){\n    this.tree = tree;\n    this.tree.on('render', this.initEvents, this);\n};\n\nExt.tree.TreeEventModel.prototype = {\n    initEvents : function(){\n        var t = this.tree;\n\n        if(t.trackMouseOver !== false){\n            t.mon(t.innerCt, {\n                scope: this,\n                mouseover: this.delegateOver,\n                mouseout: this.delegateOut\n            });\n        }\n        t.mon(t.getTreeEl(), {\n            scope: this,\n            click: this.delegateClick,\n            dblclick: this.delegateDblClick,\n            contextmenu: this.delegateContextMenu\n        });\n    },\n\n    getNode : function(e){\n        var t;\n        if(t = e.getTarget('.x-tree-node-el', 10)){\n            var id = Ext.fly(t, '_treeEvents').getAttribute('tree-node-id', 'ext');\n            if(id){\n                return this.tree.getNodeById(id);\n            }\n        }\n        return null;\n    },\n\n    getNodeTarget : function(e){\n        var t = e.getTarget('.x-tree-node-icon', 1);\n        if(!t){\n            t = e.getTarget('.x-tree-node-el', 6);\n        }\n        return t;\n    },\n\n    delegateOut : function(e, t){\n        if(!this.beforeEvent(e)){\n            return;\n        }\n        if(e.getTarget('.x-tree-ec-icon', 1)){\n            var n = this.getNode(e);\n            this.onIconOut(e, n);\n            if(n == this.lastEcOver){\n                delete this.lastEcOver;\n            }\n        }\n        if((t = this.getNodeTarget(e)) && !e.within(t, true)){\n            this.onNodeOut(e, this.getNode(e));\n        }\n    },\n\n    delegateOver : function(e, t){\n        if(!this.beforeEvent(e)){\n            return;\n        }\n        if(Ext.isGecko && !this.trackingDoc){ \n            Ext.getBody().on('mouseover', this.trackExit, this);\n            this.trackingDoc = true;\n        }\n        if(this.lastEcOver){ \n            this.onIconOut(e, this.lastEcOver);\n            delete this.lastEcOver;\n        }\n        if(e.getTarget('.x-tree-ec-icon', 1)){\n            this.lastEcOver = this.getNode(e);\n            this.onIconOver(e, this.lastEcOver);\n        }\n        if(t = this.getNodeTarget(e)){\n            this.onNodeOver(e, this.getNode(e));\n        }\n    },\n\n    trackExit : function(e){\n        if(this.lastOverNode){\n            if(this.lastOverNode.ui && !e.within(this.lastOverNode.ui.getEl())){\n                this.onNodeOut(e, this.lastOverNode);\n            }\n            delete this.lastOverNode;\n            Ext.getBody().un('mouseover', this.trackExit, this);\n            this.trackingDoc = false;\n        }\n\n    },\n\n    delegateClick : function(e, t){\n        if(this.beforeEvent(e)){\n            if(e.getTarget('input[type=checkbox]', 1)){\n                this.onCheckboxClick(e, this.getNode(e));\n            }else if(e.getTarget('.x-tree-ec-icon', 1)){\n                this.onIconClick(e, this.getNode(e));\n            }else if(this.getNodeTarget(e)){\n                this.onNodeClick(e, this.getNode(e));\n            }\n        }else{\n            this.checkContainerEvent(e, 'click');\n        }\n    },\n\n    delegateDblClick : function(e, t){\n        if(this.beforeEvent(e)){\n            if(this.getNodeTarget(e)){\n                this.onNodeDblClick(e, this.getNode(e));\n            }\n        }else{\n            this.checkContainerEvent(e, 'dblclick');\n        }\n    },\n\n    delegateContextMenu : function(e, t){\n        if(this.beforeEvent(e)){\n            if(this.getNodeTarget(e)){\n                this.onNodeContextMenu(e, this.getNode(e));\n            }\n        }else{\n            this.checkContainerEvent(e, 'contextmenu');\n        }\n    },\n    \n    checkContainerEvent: function(e, type){\n        if(this.disabled){\n            e.stopEvent();\n            return false;\n        }\n        this.onContainerEvent(e, type);    \n    },\n\n    onContainerEvent: function(e, type){\n        this.tree.fireEvent('container' + type, this.tree, e);\n    },\n\n    onNodeClick : function(e, node){\n        node.ui.onClick(e);\n    },\n\n    onNodeOver : function(e, node){\n        this.lastOverNode = node;\n        node.ui.onOver(e);\n    },\n\n    onNodeOut : function(e, node){\n        node.ui.onOut(e);\n    },\n\n    onIconOver : function(e, node){\n        node.ui.addClass('x-tree-ec-over');\n    },\n\n    onIconOut : function(e, node){\n        node.ui.removeClass('x-tree-ec-over');\n    },\n\n    onIconClick : function(e, node){\n        node.ui.ecClick(e);\n    },\n\n    onCheckboxClick : function(e, node){\n        node.ui.onCheckChange(e);\n    },\n\n    onNodeDblClick : function(e, node){\n        node.ui.onDblClick(e);\n    },\n\n    onNodeContextMenu : function(e, node){\n        node.ui.onContextMenu(e);\n    },\n\n    beforeEvent : function(e){\n        var node = this.getNode(e);\n        if(this.disabled || !node || !node.ui){\n            e.stopEvent();\n            return false;\n        }\n        return true;\n    },\n\n    disable: function(){\n        this.disabled = true;\n    },\n\n    enable: function(){\n        this.disabled = false;\n    }\n};\nExt.tree.DefaultSelectionModel = Ext.extend(Ext.util.Observable, {\n    \n    constructor : function(config){\n        this.selNode = null;\n   \n        this.addEvents(\n            \n            'selectionchange',\n\n            \n            'beforeselect'\n        );\n\n        Ext.apply(this, config);\n        Ext.tree.DefaultSelectionModel.superclass.constructor.call(this);    \n    },\n    \n    init : function(tree){\n        this.tree = tree;\n        tree.mon(tree.getTreeEl(), 'keydown', this.onKeyDown, this);\n        tree.on('click', this.onNodeClick, this);\n    },\n    \n    onNodeClick : function(node, e){\n        this.select(node);\n    },\n    \n    \n    select : function(node,  selectNextNode){\n        \n        if (!Ext.fly(node.ui.wrap).isVisible() && selectNextNode) {\n            return selectNextNode.call(this, node);\n        }\n        var last = this.selNode;\n        if(node == last){\n            node.ui.onSelectedChange(true);\n        }else if(this.fireEvent('beforeselect', this, node, last) !== false){\n            if(last && last.ui){\n                last.ui.onSelectedChange(false);\n            }\n            this.selNode = node;\n            node.ui.onSelectedChange(true);\n            this.fireEvent('selectionchange', this, node, last);\n        }\n        return node;\n    },\n    \n    \n    unselect : function(node, silent){\n        if(this.selNode == node){\n            this.clearSelections(silent);\n        }    \n    },\n    \n    \n    clearSelections : function(silent){\n        var n = this.selNode;\n        if(n){\n            n.ui.onSelectedChange(false);\n            this.selNode = null;\n            if(silent !== true){\n                this.fireEvent('selectionchange', this, null);\n            }\n        }\n        return n;\n    },\n    \n    \n    getSelectedNode : function(){\n        return this.selNode;    \n    },\n    \n    \n    isSelected : function(node){\n        return this.selNode == node;  \n    },\n\n    \n    selectPrevious : function( s){\n        if(!(s = s || this.selNode || this.lastSelNode)){\n            return null;\n        }\n        \n        var ps = s.previousSibling;\n        if(ps){\n            if(!ps.isExpanded() || ps.childNodes.length < 1){\n                return this.select(ps, this.selectPrevious);\n            } else{\n                var lc = ps.lastChild;\n                while(lc && lc.isExpanded() && Ext.fly(lc.ui.wrap).isVisible() && lc.childNodes.length > 0){\n                    lc = lc.lastChild;\n                }\n                return this.select(lc, this.selectPrevious);\n            }\n        } else if(s.parentNode && (this.tree.rootVisible || !s.parentNode.isRoot)){\n            return this.select(s.parentNode, this.selectPrevious);\n        }\n        return null;\n    },\n\n    \n    selectNext : function( s){\n        if(!(s = s || this.selNode || this.lastSelNode)){\n            return null;\n        }\n        \n        if(s.firstChild && s.isExpanded() && Ext.fly(s.ui.wrap).isVisible()){\n             return this.select(s.firstChild, this.selectNext);\n         }else if(s.nextSibling){\n             return this.select(s.nextSibling, this.selectNext);\n         }else if(s.parentNode){\n            var newS = null;\n            s.parentNode.bubble(function(){\n                if(this.nextSibling){\n                    newS = this.getOwnerTree().selModel.select(this.nextSibling, this.selectNext);\n                    return false;\n                }\n            });\n            return newS;\n         }\n        return null;\n    },\n\n    onKeyDown : function(e){\n        var s = this.selNode || this.lastSelNode;\n        \n        var sm = this;\n        if(!s){\n            return;\n        }\n        var k = e.getKey();\n        switch(k){\n             case e.DOWN:\n                 e.stopEvent();\n                 this.selectNext();\n             break;\n             case e.UP:\n                 e.stopEvent();\n                 this.selectPrevious();\n             break;\n             case e.RIGHT:\n                 e.preventDefault();\n                 if(s.hasChildNodes()){\n                     if(!s.isExpanded()){\n                         s.expand();\n                     }else if(s.firstChild){\n                         this.select(s.firstChild, e);\n                     }\n                 }\n             break;\n             case e.LEFT:\n                 e.preventDefault();\n                 if(s.hasChildNodes() && s.isExpanded()){\n                     s.collapse();\n                 }else if(s.parentNode && (this.tree.rootVisible || s.parentNode != this.tree.getRootNode())){\n                     this.select(s.parentNode, e);\n                 }\n             break;\n        };\n    }\n});\n\n\nExt.tree.MultiSelectionModel = Ext.extend(Ext.util.Observable, {\n    \n    constructor : function(config){\n        this.selNodes = [];\n        this.selMap = {};\n        this.addEvents(\n            \n            'selectionchange'\n        );\n        Ext.apply(this, config);\n        Ext.tree.MultiSelectionModel.superclass.constructor.call(this);    \n    },\n    \n    init : function(tree){\n        this.tree = tree;\n        tree.mon(tree.getTreeEl(), 'keydown', this.onKeyDown, this);\n        tree.on('click', this.onNodeClick, this);\n    },\n    \n    onNodeClick : function(node, e){\n        if(e.ctrlKey && this.isSelected(node)){\n            this.unselect(node);\n        }else{\n            this.select(node, e, e.ctrlKey);\n        }\n    },\n    \n    \n    select : function(node, e, keepExisting){\n        if(keepExisting !== true){\n            this.clearSelections(true);\n        }\n        if(this.isSelected(node)){\n            this.lastSelNode = node;\n            return node;\n        }\n        this.selNodes.push(node);\n        this.selMap[node.id] = node;\n        this.lastSelNode = node;\n        node.ui.onSelectedChange(true);\n        this.fireEvent('selectionchange', this, this.selNodes);\n        return node;\n    },\n    \n    \n    unselect : function(node){\n        if(this.selMap[node.id]){\n            node.ui.onSelectedChange(false);\n            var sn = this.selNodes;\n            var index = sn.indexOf(node);\n            if(index != -1){\n                this.selNodes.splice(index, 1);\n            }\n            delete this.selMap[node.id];\n            this.fireEvent('selectionchange', this, this.selNodes);\n        }\n    },\n    \n    \n    clearSelections : function(suppressEvent){\n        var sn = this.selNodes;\n        if(sn.length > 0){\n            for(var i = 0, len = sn.length; i < len; i++){\n                sn[i].ui.onSelectedChange(false);\n            }\n            this.selNodes = [];\n            this.selMap = {};\n            if(suppressEvent !== true){\n                this.fireEvent('selectionchange', this, this.selNodes);\n            }\n        }\n    },\n    \n    \n    isSelected : function(node){\n        return this.selMap[node.id] ? true : false;  \n    },\n    \n    \n    getSelectedNodes : function(){\n        return this.selNodes.concat([]);\n    },\n\n    onKeyDown : Ext.tree.DefaultSelectionModel.prototype.onKeyDown,\n\n    selectNext : Ext.tree.DefaultSelectionModel.prototype.selectNext,\n\n    selectPrevious : Ext.tree.DefaultSelectionModel.prototype.selectPrevious\n});\nExt.data.Tree = Ext.extend(Ext.util.Observable, {\n    \n    constructor: function(root){\n        this.nodeHash = {};\n        \n        this.root = null;\n        if(root){\n            this.setRootNode(root);\n        }\n        this.addEvents(\n            \n            \"append\",\n            \n            \"remove\",\n            \n            \"move\",\n            \n            \"insert\",\n            \n            \"beforeappend\",\n            \n            \"beforeremove\",\n            \n            \"beforemove\",\n            \n            \"beforeinsert\"\n        );\n        Ext.data.Tree.superclass.constructor.call(this);        \n    },\n    \n    \n    pathSeparator: \"/\",\n\n    \n    proxyNodeEvent : function(){\n        return this.fireEvent.apply(this, arguments);\n    },\n\n    \n    getRootNode : function(){\n        return this.root;\n    },\n\n    \n    setRootNode : function(node){\n        this.root = node;\n        node.ownerTree = this;\n        node.isRoot = true;\n        this.registerNode(node);\n        return node;\n    },\n\n    \n    getNodeById : function(id){\n        return this.nodeHash[id];\n    },\n\n    \n    registerNode : function(node){\n        this.nodeHash[node.id] = node;\n    },\n\n    \n    unregisterNode : function(node){\n        delete this.nodeHash[node.id];\n    },\n\n    toString : function(){\n        return \"[Tree\"+(this.id?\" \"+this.id:\"\")+\"]\";\n    }\n});\n\n\nExt.data.Node = Ext.extend(Ext.util.Observable, {\n    \n    constructor: function(attributes){\n        \n        this.attributes = attributes || {};\n        this.leaf = this.attributes.leaf;\n        \n        this.id = this.attributes.id;\n        if(!this.id){\n            this.id = Ext.id(null, \"xnode-\");\n            this.attributes.id = this.id;\n        }\n        \n        this.childNodes = [];\n        \n        this.parentNode = null;\n        \n        this.firstChild = null;\n        \n        this.lastChild = null;\n        \n        this.previousSibling = null;\n        \n        this.nextSibling = null;\n\n        this.addEvents({\n            \n            \"append\" : true,\n            \n            \"remove\" : true,\n            \n            \"move\" : true,\n            \n            \"insert\" : true,\n            \n            \"beforeappend\" : true,\n            \n            \"beforeremove\" : true,\n            \n            \"beforemove\" : true,\n             \n            \"beforeinsert\" : true\n        });\n        this.listeners = this.attributes.listeners;\n        Ext.data.Node.superclass.constructor.call(this);    \n    },\n    \n    \n    fireEvent : function(evtName){\n        \n        if(Ext.data.Node.superclass.fireEvent.apply(this, arguments) === false){\n            return false;\n        }\n        \n        var ot = this.getOwnerTree();\n        if(ot){\n            if(ot.proxyNodeEvent.apply(ot, arguments) === false){\n                return false;\n            }\n        }\n        return true;\n    },\n\n    \n    isLeaf : function(){\n        return this.leaf === true;\n    },\n\n    \n    setFirstChild : function(node){\n        this.firstChild = node;\n    },\n\n    \n    setLastChild : function(node){\n        this.lastChild = node;\n    },\n\n\n    \n    isLast : function(){\n       return (!this.parentNode ? true : this.parentNode.lastChild == this);\n    },\n\n    \n    isFirst : function(){\n       return (!this.parentNode ? true : this.parentNode.firstChild == this);\n    },\n\n    \n    hasChildNodes : function(){\n        return !this.isLeaf() && this.childNodes.length > 0;\n    },\n\n    \n    isExpandable : function(){\n        return this.attributes.expandable || this.hasChildNodes();\n    },\n\n    \n    appendChild : function(node){\n        var multi = false;\n        if(Ext.isArray(node)){\n            multi = node;\n        }else if(arguments.length > 1){\n            multi = arguments;\n        }\n        \n        if(multi){\n            for(var i = 0, len = multi.length; i < len; i++) {\n                this.appendChild(multi[i]);\n            }\n        }else{\n            if(this.fireEvent(\"beforeappend\", this.ownerTree, this, node) === false){\n                return false;\n            }\n            var index = this.childNodes.length;\n            var oldParent = node.parentNode;\n            \n            if(oldParent){\n                if(node.fireEvent(\"beforemove\", node.getOwnerTree(), node, oldParent, this, index) === false){\n                    return false;\n                }\n                oldParent.removeChild(node);\n            }\n            index = this.childNodes.length;\n            if(index === 0){\n                this.setFirstChild(node);\n            }\n            this.childNodes.push(node);\n            node.parentNode = this;\n            var ps = this.childNodes[index-1];\n            if(ps){\n                node.previousSibling = ps;\n                ps.nextSibling = node;\n            }else{\n                node.previousSibling = null;\n            }\n            node.nextSibling = null;\n            this.setLastChild(node);\n            node.setOwnerTree(this.getOwnerTree());\n            this.fireEvent(\"append\", this.ownerTree, this, node, index);\n            if(oldParent){\n                node.fireEvent(\"move\", this.ownerTree, node, oldParent, this, index);\n            }\n            return node;\n        }\n    },\n\n    \n    removeChild : function(node, destroy){\n        var index = this.childNodes.indexOf(node);\n        if(index == -1){\n            return false;\n        }\n        if(this.fireEvent(\"beforeremove\", this.ownerTree, this, node) === false){\n            return false;\n        }\n\n        \n        this.childNodes.splice(index, 1);\n\n        \n        if(node.previousSibling){\n            node.previousSibling.nextSibling = node.nextSibling;\n        }\n        if(node.nextSibling){\n            node.nextSibling.previousSibling = node.previousSibling;\n        }\n\n        \n        if(this.firstChild == node){\n            this.setFirstChild(node.nextSibling);\n        }\n        if(this.lastChild == node){\n            this.setLastChild(node.previousSibling);\n        }\n\n        this.fireEvent(\"remove\", this.ownerTree, this, node);\n        if(destroy){\n            node.destroy(true);\n        }else{\n            node.clear();\n        }\n        return node;\n    },\n\n    \n    clear : function(destroy){\n        \n        this.setOwnerTree(null, destroy);\n        this.parentNode = this.previousSibling = this.nextSibling = null;\n        if(destroy){\n            this.firstChild = this.lastChild = null;\n        }\n    },\n\n    \n    destroy : function( silent){\n        \n        if(silent === true){\n            this.purgeListeners();\n            this.clear(true);\n            Ext.each(this.childNodes, function(n){\n                n.destroy(true);\n            });\n            this.childNodes = null;\n        }else{\n            this.remove(true);\n        }\n    },\n\n    \n    insertBefore : function(node, refNode){\n        if(!refNode){ \n            return this.appendChild(node);\n        }\n        \n        if(node == refNode){\n            return false;\n        }\n\n        if(this.fireEvent(\"beforeinsert\", this.ownerTree, this, node, refNode) === false){\n            return false;\n        }\n        var index = this.childNodes.indexOf(refNode);\n        var oldParent = node.parentNode;\n        var refIndex = index;\n\n        \n        if(oldParent == this && this.childNodes.indexOf(node) < index){\n            refIndex--;\n        }\n\n        \n        if(oldParent){\n            if(node.fireEvent(\"beforemove\", node.getOwnerTree(), node, oldParent, this, index, refNode) === false){\n                return false;\n            }\n            oldParent.removeChild(node);\n        }\n        if(refIndex === 0){\n            this.setFirstChild(node);\n        }\n        this.childNodes.splice(refIndex, 0, node);\n        node.parentNode = this;\n        var ps = this.childNodes[refIndex-1];\n        if(ps){\n            node.previousSibling = ps;\n            ps.nextSibling = node;\n        }else{\n            node.previousSibling = null;\n        }\n        node.nextSibling = refNode;\n        refNode.previousSibling = node;\n        node.setOwnerTree(this.getOwnerTree());\n        this.fireEvent(\"insert\", this.ownerTree, this, node, refNode);\n        if(oldParent){\n            node.fireEvent(\"move\", this.ownerTree, node, oldParent, this, refIndex, refNode);\n        }\n        return node;\n    },\n\n    \n    remove : function(destroy){\n        if (this.parentNode) {\n            this.parentNode.removeChild(this, destroy);\n        }\n        return this;\n    },\n\n    \n    removeAll : function(destroy){\n        var cn = this.childNodes,\n            n;\n        while((n = cn[0])){\n            this.removeChild(n, destroy);\n        }\n        return this;\n    },\n\n    \n    item : function(index){\n        return this.childNodes[index];\n    },\n\n    \n    replaceChild : function(newChild, oldChild){\n        var s = oldChild ? oldChild.nextSibling : null;\n        this.removeChild(oldChild);\n        this.insertBefore(newChild, s);\n        return oldChild;\n    },\n\n    \n    indexOf : function(child){\n        return this.childNodes.indexOf(child);\n    },\n\n    \n    getOwnerTree : function(){\n        \n        if(!this.ownerTree){\n            var p = this;\n            while(p){\n                if(p.ownerTree){\n                    this.ownerTree = p.ownerTree;\n                    break;\n                }\n                p = p.parentNode;\n            }\n        }\n        return this.ownerTree;\n    },\n\n    \n    getDepth : function(){\n        var depth = 0;\n        var p = this;\n        while(p.parentNode){\n            ++depth;\n            p = p.parentNode;\n        }\n        return depth;\n    },\n\n    \n    setOwnerTree : function(tree, destroy){\n        \n        if(tree != this.ownerTree){\n            if(this.ownerTree){\n                this.ownerTree.unregisterNode(this);\n            }\n            this.ownerTree = tree;\n            \n            if(destroy !== true){\n                Ext.each(this.childNodes, function(n){\n                    n.setOwnerTree(tree);\n                });\n            }\n            if(tree){\n                tree.registerNode(this);\n            }\n        }\n    },\n\n    \n    setId: function(id){\n        if(id !== this.id){\n            var t = this.ownerTree;\n            if(t){\n                t.unregisterNode(this);\n            }\n            this.id = this.attributes.id = id;\n            if(t){\n                t.registerNode(this);\n            }\n            this.onIdChange(id);\n        }\n    },\n\n    \n    onIdChange: Ext.emptyFn,\n\n    \n    getPath : function(attr){\n        attr = attr || \"id\";\n        var p = this.parentNode;\n        var b = [this.attributes[attr]];\n        while(p){\n            b.unshift(p.attributes[attr]);\n            p = p.parentNode;\n        }\n        var sep = this.getOwnerTree().pathSeparator;\n        return sep + b.join(sep);\n    },\n\n    \n    bubble : function(fn, scope, args){\n        var p = this;\n        while(p){\n            if(fn.apply(scope || p, args || [p]) === false){\n                break;\n            }\n            p = p.parentNode;\n        }\n    },\n\n    \n    cascade : function(fn, scope, args){\n        if(fn.apply(scope || this, args || [this]) !== false){\n            var cs = this.childNodes;\n            for(var i = 0, len = cs.length; i < len; i++) {\n                cs[i].cascade(fn, scope, args);\n            }\n        }\n    },\n\n    \n    eachChild : function(fn, scope, args){\n        var cs = this.childNodes;\n        for(var i = 0, len = cs.length; i < len; i++) {\n            if(fn.apply(scope || cs[i], args || [cs[i]]) === false){\n                break;\n            }\n        }\n    },\n\n    \n    findChild : function(attribute, value, deep){\n        return this.findChildBy(function(){\n            return this.attributes[attribute] == value;\n        }, null, deep);\n    },\n\n    \n    findChildBy : function(fn, scope, deep){\n        var cs = this.childNodes,\n            len = cs.length,\n            i = 0,\n            n,\n            res;\n        for(; i < len; i++){\n            n = cs[i];\n            if(fn.call(scope || n, n) === true){\n                return n;\n            }else if (deep){\n                res = n.findChildBy(fn, scope, deep);\n                if(res != null){\n                    return res;\n                }\n            }\n            \n        }\n        return null;\n    },\n\n    \n    sort : function(fn, scope){\n        var cs = this.childNodes;\n        var len = cs.length;\n        if(len > 0){\n            var sortFn = scope ? function(){fn.apply(scope, arguments);} : fn;\n            cs.sort(sortFn);\n            for(var i = 0; i < len; i++){\n                var n = cs[i];\n                n.previousSibling = cs[i-1];\n                n.nextSibling = cs[i+1];\n                if(i === 0){\n                    this.setFirstChild(n);\n                }\n                if(i == len-1){\n                    this.setLastChild(n);\n                }\n            }\n        }\n    },\n\n    \n    contains : function(node){\n        return node.isAncestor(this);\n    },\n\n    \n    isAncestor : function(node){\n        var p = this.parentNode;\n        while(p){\n            if(p == node){\n                return true;\n            }\n            p = p.parentNode;\n        }\n        return false;\n    },\n\n    toString : function(){\n        return \"[Node\"+(this.id?\" \"+this.id:\"\")+\"]\";\n    }\n});\nExt.tree.TreeNode = Ext.extend(Ext.data.Node, {\n    \n    constructor : function(attributes){\n        attributes = attributes || {};\n        if(Ext.isString(attributes)){\n            attributes = {text: attributes};\n        }\n        this.childrenRendered = false;\n        this.rendered = false;\n        Ext.tree.TreeNode.superclass.constructor.call(this, attributes);\n        this.expanded = attributes.expanded === true;\n        this.isTarget = attributes.isTarget !== false;\n        this.draggable = attributes.draggable !== false && attributes.allowDrag !== false;\n        this.allowChildren = attributes.allowChildren !== false && attributes.allowDrop !== false;\n\n        \n        this.text = attributes.text;\n        \n        this.disabled = attributes.disabled === true;\n        \n        this.hidden = attributes.hidden === true;\n    \n        this.addEvents(\n            \n            'textchange',\n            \n            'beforeexpand',\n            \n            'beforecollapse',\n            \n            'expand',\n            \n            'disabledchange',\n            \n            'collapse',\n            \n            'beforeclick',\n            \n            'click',\n            \n            'checkchange',\n            \n            'beforedblclick',\n            \n            'dblclick',\n            \n            'contextmenu',\n            \n            'beforechildrenrendered'\n        );\n    \n        var uiClass = this.attributes.uiProvider || this.defaultUI || Ext.tree.TreeNodeUI;\n    \n        \n        this.ui = new uiClass(this);    \n    },\n    \n    preventHScroll : true,\n    \n    isExpanded : function(){\n        return this.expanded;\n    },\n\n\n    getUI : function(){\n        return this.ui;\n    },\n\n    getLoader : function(){\n        var owner;\n        return this.loader || ((owner = this.getOwnerTree()) && owner.loader ? owner.loader : (this.loader = new Ext.tree.TreeLoader()));\n    },\n\n    \n    setFirstChild : function(node){\n        var of = this.firstChild;\n        Ext.tree.TreeNode.superclass.setFirstChild.call(this, node);\n        if(this.childrenRendered && of && node != of){\n            of.renderIndent(true, true);\n        }\n        if(this.rendered){\n            this.renderIndent(true, true);\n        }\n    },\n\n    \n    setLastChild : function(node){\n        var ol = this.lastChild;\n        Ext.tree.TreeNode.superclass.setLastChild.call(this, node);\n        if(this.childrenRendered && ol && node != ol){\n            ol.renderIndent(true, true);\n        }\n        if(this.rendered){\n            this.renderIndent(true, true);\n        }\n    },\n\n    \n    \n    appendChild : function(n){\n        if(!n.render && !Ext.isArray(n)){\n            n = this.getLoader().createNode(n);\n        }\n        var node = Ext.tree.TreeNode.superclass.appendChild.call(this, n);\n        if(node && this.childrenRendered){\n            node.render();\n        }\n        this.ui.updateExpandIcon();\n        return node;\n    },\n\n    \n    removeChild : function(node, destroy){\n        this.ownerTree.getSelectionModel().unselect(node);\n        Ext.tree.TreeNode.superclass.removeChild.apply(this, arguments);\n        \n        if(!destroy){\n            var rendered = node.ui.rendered;\n            \n            if(rendered){\n                node.ui.remove();\n            }\n            if(rendered && this.childNodes.length < 1){\n                this.collapse(false, false);\n            }else{\n                this.ui.updateExpandIcon();\n            }\n            if(!this.firstChild && !this.isHiddenRoot()){\n                this.childrenRendered = false;\n            }\n        }\n        return node;\n    },\n\n    \n    insertBefore : function(node, refNode){\n        if(!node.render){\n            node = this.getLoader().createNode(node);\n        }\n        var newNode = Ext.tree.TreeNode.superclass.insertBefore.call(this, node, refNode);\n        if(newNode && refNode && this.childrenRendered){\n            node.render();\n        }\n        this.ui.updateExpandIcon();\n        return newNode;\n    },\n\n    \n    setText : function(text){\n        var oldText = this.text;\n        this.text = this.attributes.text = text;\n        if(this.rendered){ \n            this.ui.onTextChange(this, text, oldText);\n        }\n        this.fireEvent('textchange', this, text, oldText);\n    },\n    \n    \n    setIconCls : function(cls){\n        var old = this.attributes.iconCls;\n        this.attributes.iconCls = cls;\n        if(this.rendered){\n            this.ui.onIconClsChange(this, cls, old);\n        }\n    },\n    \n    \n    setTooltip : function(tip, title){\n        this.attributes.qtip = tip;\n        this.attributes.qtipTitle = title;\n        if(this.rendered){\n            this.ui.onTipChange(this, tip, title);\n        }\n    },\n    \n    \n    setIcon : function(icon){\n        this.attributes.icon = icon;\n        if(this.rendered){\n            this.ui.onIconChange(this, icon);\n        }\n    },\n    \n    \n    setHref : function(href, target){\n        this.attributes.href = href;\n        this.attributes.hrefTarget = target;\n        if(this.rendered){\n            this.ui.onHrefChange(this, href, target);\n        }\n    },\n    \n    \n    setCls : function(cls){\n        var old = this.attributes.cls;\n        this.attributes.cls = cls;\n        if(this.rendered){\n            this.ui.onClsChange(this, cls, old);\n        }\n    },\n\n    \n    select : function(){\n        var t = this.getOwnerTree();\n        if(t){\n            t.getSelectionModel().select(this);\n        }\n    },\n\n    \n    unselect : function(silent){\n        var t = this.getOwnerTree();\n        if(t){\n            t.getSelectionModel().unselect(this, silent);\n        }\n    },\n\n    \n    isSelected : function(){\n        var t = this.getOwnerTree();\n        return t ? t.getSelectionModel().isSelected(this) : false;\n    },\n\n    \n    expand : function(deep, anim, callback, scope){\n        if(!this.expanded){\n            if(this.fireEvent('beforeexpand', this, deep, anim) === false){\n                return;\n            }\n            if(!this.childrenRendered){\n                this.renderChildren();\n            }\n            this.expanded = true;\n            if(!this.isHiddenRoot() && (this.getOwnerTree().animate && anim !== false) || anim){\n                this.ui.animExpand(function(){\n                    this.fireEvent('expand', this);\n                    this.runCallback(callback, scope || this, [this]);\n                    if(deep === true){\n                        this.expandChildNodes(true, true);\n                    }\n                }.createDelegate(this));\n                return;\n            }else{\n                this.ui.expand();\n                this.fireEvent('expand', this);\n                this.runCallback(callback, scope || this, [this]);\n            }\n        }else{\n           this.runCallback(callback, scope || this, [this]);\n        }\n        if(deep === true){\n            this.expandChildNodes(true);\n        }\n    },\n\n    runCallback : function(cb, scope, args){\n        if(Ext.isFunction(cb)){\n            cb.apply(scope, args);\n        }\n    },\n\n    isHiddenRoot : function(){\n        return this.isRoot && !this.getOwnerTree().rootVisible;\n    },\n\n    \n    collapse : function(deep, anim, callback, scope){\n        if(this.expanded && !this.isHiddenRoot()){\n            if(this.fireEvent('beforecollapse', this, deep, anim) === false){\n                return;\n            }\n            this.expanded = false;\n            if((this.getOwnerTree().animate && anim !== false) || anim){\n                this.ui.animCollapse(function(){\n                    this.fireEvent('collapse', this);\n                    this.runCallback(callback, scope || this, [this]);\n                    if(deep === true){\n                        this.collapseChildNodes(true);\n                    }\n                }.createDelegate(this));\n                return;\n            }else{\n                this.ui.collapse();\n                this.fireEvent('collapse', this);\n                this.runCallback(callback, scope || this, [this]);\n            }\n        }else if(!this.expanded){\n            this.runCallback(callback, scope || this, [this]);\n        }\n        if(deep === true){\n            var cs = this.childNodes;\n            for(var i = 0, len = cs.length; i < len; i++) {\n            \tcs[i].collapse(true, false);\n            }\n        }\n    },\n\n    \n    delayedExpand : function(delay){\n        if(!this.expandProcId){\n            this.expandProcId = this.expand.defer(delay, this);\n        }\n    },\n\n    \n    cancelExpand : function(){\n        if(this.expandProcId){\n            clearTimeout(this.expandProcId);\n        }\n        this.expandProcId = false;\n    },\n\n    \n    toggle : function(){\n        if(this.expanded){\n            this.collapse();\n        }else{\n            this.expand();\n        }\n    },\n\n    \n    ensureVisible : function(callback, scope){\n        var tree = this.getOwnerTree();\n        tree.expandPath(this.parentNode ? this.parentNode.getPath() : this.getPath(), false, function(){\n            var node = tree.getNodeById(this.id);  \n            tree.getTreeEl().scrollChildIntoView(node.ui.anchor);\n            this.runCallback(callback, scope || this, [this]);\n        }.createDelegate(this));\n    },\n\n    \n    expandChildNodes : function(deep, anim) {\n        var cs = this.childNodes,\n            i,\n            len = cs.length;\n        for (i = 0; i < len; i++) {\n        \tcs[i].expand(deep, anim);\n        }\n    },\n\n    \n    collapseChildNodes : function(deep){\n        var cs = this.childNodes;\n        for(var i = 0, len = cs.length; i < len; i++) {\n        \tcs[i].collapse(deep);\n        }\n    },\n\n    \n    disable : function(){\n        this.disabled = true;\n        this.unselect();\n        if(this.rendered && this.ui.onDisableChange){ \n            this.ui.onDisableChange(this, true);\n        }\n        this.fireEvent('disabledchange', this, true);\n    },\n\n    \n    enable : function(){\n        this.disabled = false;\n        if(this.rendered && this.ui.onDisableChange){ \n            this.ui.onDisableChange(this, false);\n        }\n        this.fireEvent('disabledchange', this, false);\n    },\n\n    \n    renderChildren : function(suppressEvent){\n        if(suppressEvent !== false){\n            this.fireEvent('beforechildrenrendered', this);\n        }\n        var cs = this.childNodes;\n        for(var i = 0, len = cs.length; i < len; i++){\n            cs[i].render(true);\n        }\n        this.childrenRendered = true;\n    },\n\n    \n    sort : function(fn, scope){\n        Ext.tree.TreeNode.superclass.sort.apply(this, arguments);\n        if(this.childrenRendered){\n            var cs = this.childNodes;\n            for(var i = 0, len = cs.length; i < len; i++){\n                cs[i].render(true);\n            }\n        }\n    },\n\n    \n    render : function(bulkRender){\n        this.ui.render(bulkRender);\n        if(!this.rendered){\n            \n            this.getOwnerTree().registerNode(this);\n            this.rendered = true;\n            if(this.expanded){\n                this.expanded = false;\n                this.expand(false, false);\n            }\n        }\n    },\n\n    \n    renderIndent : function(deep, refresh){\n        if(refresh){\n            this.ui.childIndent = null;\n        }\n        this.ui.renderIndent();\n        if(deep === true && this.childrenRendered){\n            var cs = this.childNodes;\n            for(var i = 0, len = cs.length; i < len; i++){\n                cs[i].renderIndent(true, refresh);\n            }\n        }\n    },\n\n    beginUpdate : function(){\n        this.childrenRendered = false;\n    },\n\n    endUpdate : function(){\n        if(this.expanded && this.rendered){\n            this.renderChildren();\n        }\n    },\n\n    \n    destroy : function(silent){\n        if(silent === true){\n            this.unselect(true);\n        }\n        Ext.tree.TreeNode.superclass.destroy.call(this, silent);\n        Ext.destroy(this.ui, this.loader);\n        this.ui = this.loader = null;\n    },\n\n    \n    onIdChange : function(id){\n        this.ui.onIdChange(id);\n    }\n});\n\nExt.tree.TreePanel.nodeTypes.node = Ext.tree.TreeNode;\n Ext.tree.AsyncTreeNode = function(config){\n    this.loaded = config && config.loaded === true;\n    this.loading = false;\n    Ext.tree.AsyncTreeNode.superclass.constructor.apply(this, arguments);\n    \n    this.addEvents('beforeload', 'load');\n    \n    \n};\nExt.extend(Ext.tree.AsyncTreeNode, Ext.tree.TreeNode, {\n    expand : function(deep, anim, callback, scope){\n        if(this.loading){ \n            var timer;\n            var f = function(){\n                if(!this.loading){ \n                    clearInterval(timer);\n                    this.expand(deep, anim, callback, scope);\n                }\n            }.createDelegate(this);\n            timer = setInterval(f, 200);\n            return;\n        }\n        if(!this.loaded){\n            if(this.fireEvent(\"beforeload\", this) === false){\n                return;\n            }\n            this.loading = true;\n            this.ui.beforeLoad(this);\n            var loader = this.loader || this.attributes.loader || this.getOwnerTree().getLoader();\n            if(loader){\n                loader.load(this, this.loadComplete.createDelegate(this, [deep, anim, callback, scope]), this);\n                return;\n            }\n        }\n        Ext.tree.AsyncTreeNode.superclass.expand.call(this, deep, anim, callback, scope);\n    },\n    \n    \n    isLoading : function(){\n        return this.loading;  \n    },\n    \n    loadComplete : function(deep, anim, callback, scope){\n        this.loading = false;\n        this.loaded = true;\n        this.ui.afterLoad(this);\n        this.fireEvent(\"load\", this);\n        this.expand(deep, anim, callback, scope);\n    },\n    \n    \n    isLoaded : function(){\n        return this.loaded;\n    },\n    \n    hasChildNodes : function(){\n        if(!this.isLeaf() && !this.loaded){\n            return true;\n        }else{\n            return Ext.tree.AsyncTreeNode.superclass.hasChildNodes.call(this);\n        }\n    },\n\n    \n    reload : function(callback, scope){\n        this.collapse(false, false);\n        while(this.firstChild){\n            this.removeChild(this.firstChild).destroy();\n        }\n        this.childrenRendered = false;\n        this.loaded = false;\n        if(this.isHiddenRoot()){\n            this.expanded = false;\n        }\n        this.expand(false, false, callback, scope);\n    }\n});\n\nExt.tree.TreePanel.nodeTypes.async = Ext.tree.AsyncTreeNode;\nExt.tree.TreeNodeUI = Ext.extend(Object, {\n    \n    constructor : function(node){\n        Ext.apply(this, {\n            node: node,\n            rendered: false,\n            animating: false,\n            wasLeaf: true,\n            ecc: 'x-tree-ec-icon x-tree-elbow',\n            emptyIcon: Ext.BLANK_IMAGE_URL    \n        });\n    },\n    \n    \n    removeChild : function(node){\n        if(this.rendered){\n            this.ctNode.removeChild(node.ui.getEl());\n        }\n    },\n\n    \n    beforeLoad : function(){\n         this.addClass(\"x-tree-node-loading\");\n    },\n\n    \n    afterLoad : function(){\n         this.removeClass(\"x-tree-node-loading\");\n    },\n\n    \n    onTextChange : function(node, text, oldText){\n        if(this.rendered){\n            this.textNode.innerHTML = text;\n        }\n    },\n    \n    \n    onIconClsChange : function(node, cls, oldCls){\n        if(this.rendered){\n            Ext.fly(this.iconNode).replaceClass(oldCls, cls);\n        }\n    },\n    \n    \n    onIconChange : function(node, icon){\n        if(this.rendered){\n            \n            var empty = Ext.isEmpty(icon);\n            this.iconNode.src = empty ? this.emptyIcon : icon;\n            Ext.fly(this.iconNode)[empty ? 'removeClass' : 'addClass']('x-tree-node-inline-icon');\n        }\n    },\n    \n    \n    onTipChange : function(node, tip, title){\n        if(this.rendered){\n            var hasTitle = Ext.isDefined(title);\n            if(this.textNode.setAttributeNS){\n                this.textNode.setAttributeNS(\"ext\", \"qtip\", tip);\n                if(hasTitle){\n                    this.textNode.setAttributeNS(\"ext\", \"qtitle\", title);\n                }\n            }else{\n                this.textNode.setAttribute(\"ext:qtip\", tip);\n                if(hasTitle){\n                    this.textNode.setAttribute(\"ext:qtitle\", title);\n                }\n            }\n        }\n    },\n    \n    \n    onHrefChange : function(node, href, target){\n        if(this.rendered){\n            this.anchor.href = this.getHref(href);\n            if(Ext.isDefined(target)){\n                this.anchor.target = target;\n            }\n        }\n    },\n    \n    \n    onClsChange : function(node, cls, oldCls){\n        if(this.rendered){\n            Ext.fly(this.elNode).replaceClass(oldCls, cls);\n        }    \n    },\n\n    \n    onDisableChange : function(node, state){\n        this.disabled = state;\n        if (this.checkbox) {\n            this.checkbox.disabled = state;\n        }\n        this[state ? 'addClass' : 'removeClass']('x-tree-node-disabled');\n    },\n\n    \n    onSelectedChange : function(state){\n        if(state){\n            this.focus();\n            this.addClass(\"x-tree-selected\");\n        }else{\n            \n            this.removeClass(\"x-tree-selected\");\n        }\n    },\n\n    \n    onMove : function(tree, node, oldParent, newParent, index, refNode){\n        this.childIndent = null;\n        if(this.rendered){\n            var targetNode = newParent.ui.getContainer();\n            if(!targetNode){\n                this.holder = document.createElement(\"div\");\n                this.holder.appendChild(this.wrap);\n                return;\n            }\n            var insertBefore = refNode ? refNode.ui.getEl() : null;\n            if(insertBefore){\n                targetNode.insertBefore(this.wrap, insertBefore);\n            }else{\n                targetNode.appendChild(this.wrap);\n            }\n            this.node.renderIndent(true, oldParent != newParent);\n        }\n    },\n\n\n    addClass : function(cls){\n        if(this.elNode){\n            Ext.fly(this.elNode).addClass(cls);\n        }\n    },\n\n\n    removeClass : function(cls){\n        if(this.elNode){\n            Ext.fly(this.elNode).removeClass(cls);\n        }\n    },\n\n    \n    remove : function(){\n        if(this.rendered){\n            this.holder = document.createElement(\"div\");\n            this.holder.appendChild(this.wrap);\n        }\n    },\n\n    \n    fireEvent : function(){\n        return this.node.fireEvent.apply(this.node, arguments);\n    },\n\n    \n    initEvents : function(){\n        this.node.on(\"move\", this.onMove, this);\n\n        if(this.node.disabled){\n            this.onDisableChange(this.node, true);\n        }\n        if(this.node.hidden){\n            this.hide();\n        }\n        var ot = this.node.getOwnerTree();\n        var dd = ot.enableDD || ot.enableDrag || ot.enableDrop;\n        if(dd && (!this.node.isRoot || ot.rootVisible)){\n            Ext.dd.Registry.register(this.elNode, {\n                node: this.node,\n                handles: this.getDDHandles(),\n                isHandle: false\n            });\n        }\n    },\n\n    \n    getDDHandles : function(){\n        return [this.iconNode, this.textNode, this.elNode];\n    },\n\n\n    hide : function(){\n        this.node.hidden = true;\n        if(this.wrap){\n            this.wrap.style.display = \"none\";\n        }\n    },\n\n\n    show : function(){\n        this.node.hidden = false;\n        if(this.wrap){\n            this.wrap.style.display = \"\";\n        }\n    },\n\n    \n    onContextMenu : function(e){\n        if (this.node.hasListener(\"contextmenu\") || this.node.getOwnerTree().hasListener(\"contextmenu\")) {\n            e.preventDefault();\n            this.focus();\n            this.fireEvent(\"contextmenu\", this.node, e);\n        }\n    },\n\n    \n    onClick : function(e){\n        if(this.dropping){\n            e.stopEvent();\n            return;\n        }\n        if(this.fireEvent(\"beforeclick\", this.node, e) !== false){\n            var a = e.getTarget('a');\n            if(!this.disabled && this.node.attributes.href && a){\n                this.fireEvent(\"click\", this.node, e);\n                return;\n            }else if(a && e.ctrlKey){\n                e.stopEvent();\n            }\n            e.preventDefault();\n            if(this.disabled){\n                return;\n            }\n\n            if(this.node.attributes.singleClickExpand && !this.animating && this.node.isExpandable()){\n                this.node.toggle();\n            }\n\n            this.fireEvent(\"click\", this.node, e);\n        }else{\n            e.stopEvent();\n        }\n    },\n\n    \n    onDblClick : function(e){\n        e.preventDefault();\n        if(this.disabled){\n            return;\n        }\n        if(this.fireEvent(\"beforedblclick\", this.node, e) !== false){\n            if(this.checkbox){\n                this.toggleCheck();\n            }\n            if(!this.animating && this.node.isExpandable()){\n                this.node.toggle();\n            }\n            this.fireEvent(\"dblclick\", this.node, e);\n        }\n    },\n\n    onOver : function(e){\n        this.addClass('x-tree-node-over');\n    },\n\n    onOut : function(e){\n        this.removeClass('x-tree-node-over');\n    },\n\n    \n    onCheckChange : function(){\n        var checked = this.checkbox.checked;\n        \n        this.checkbox.defaultChecked = checked;\n        this.node.attributes.checked = checked;\n        this.fireEvent('checkchange', this.node, checked);\n    },\n\n    \n    ecClick : function(e){\n        if(!this.animating && this.node.isExpandable()){\n            this.node.toggle();\n        }\n    },\n\n    \n    startDrop : function(){\n        this.dropping = true;\n    },\n\n    \n    endDrop : function(){\n       setTimeout(function(){\n           this.dropping = false;\n       }.createDelegate(this), 50);\n    },\n\n    \n    expand : function(){\n        this.updateExpandIcon();\n        this.ctNode.style.display = \"\";\n    },\n\n    \n    focus : function(){\n        if(!this.node.preventHScroll){\n            try{this.anchor.focus();\n            }catch(e){}\n        }else{\n            try{\n                var noscroll = this.node.getOwnerTree().getTreeEl().dom;\n                var l = noscroll.scrollLeft;\n                this.anchor.focus();\n                noscroll.scrollLeft = l;\n            }catch(e){}\n        }\n    },\n\n\n    toggleCheck : function(value){\n        var cb = this.checkbox;\n        if(cb){\n            cb.checked = (value === undefined ? !cb.checked : value);\n            this.onCheckChange();\n        }\n    },\n\n    \n    blur : function(){\n        try{\n            this.anchor.blur();\n        }catch(e){}\n    },\n\n    \n    animExpand : function(callback){\n        var ct = Ext.get(this.ctNode);\n        ct.stopFx();\n        if(!this.node.isExpandable()){\n            this.updateExpandIcon();\n            this.ctNode.style.display = \"\";\n            Ext.callback(callback);\n            return;\n        }\n        this.animating = true;\n        this.updateExpandIcon();\n\n        ct.slideIn('t', {\n           callback : function(){\n               this.animating = false;\n               Ext.callback(callback);\n            },\n            scope: this,\n            duration: this.node.ownerTree.duration || .25\n        });\n    },\n\n    \n    highlight : function(){\n        var tree = this.node.getOwnerTree();\n        Ext.fly(this.wrap).highlight(\n            tree.hlColor || \"C3DAF9\",\n            {endColor: tree.hlBaseColor}\n        );\n    },\n\n    \n    collapse : function(){\n        this.updateExpandIcon();\n        this.ctNode.style.display = \"none\";\n    },\n\n    \n    animCollapse : function(callback){\n        var ct = Ext.get(this.ctNode);\n        ct.enableDisplayMode('block');\n        ct.stopFx();\n\n        this.animating = true;\n        this.updateExpandIcon();\n\n        ct.slideOut('t', {\n            callback : function(){\n               this.animating = false;\n               Ext.callback(callback);\n            },\n            scope: this,\n            duration: this.node.ownerTree.duration || .25\n        });\n    },\n\n    \n    getContainer : function(){\n        return this.ctNode;\n    },\n\n\n    getEl : function(){\n        return this.wrap;\n    },\n\n    \n    appendDDGhost : function(ghostNode){\n        ghostNode.appendChild(this.elNode.cloneNode(true));\n    },\n\n    \n    getDDRepairXY : function(){\n        return Ext.lib.Dom.getXY(this.iconNode);\n    },\n\n    \n    onRender : function(){\n        this.render();\n    },\n\n    \n    render : function(bulkRender){\n        var n = this.node, a = n.attributes;\n        var targetNode = n.parentNode ?\n              n.parentNode.ui.getContainer() : n.ownerTree.innerCt.dom;\n\n        if(!this.rendered){\n            this.rendered = true;\n\n            this.renderElements(n, a, targetNode, bulkRender);\n\n            if(a.qtip){\n                this.onTipChange(n, a.qtip, a.qtipTitle);\n            }else if(a.qtipCfg){\n                a.qtipCfg.target = Ext.id(this.textNode);\n                Ext.QuickTips.register(a.qtipCfg);\n            }\n            this.initEvents();\n            if(!this.node.expanded){\n                this.updateExpandIcon(true);\n            }\n        }else{\n            if(bulkRender === true) {\n                targetNode.appendChild(this.wrap);\n            }\n        }\n    },\n\n    \n    renderElements : function(n, a, targetNode, bulkRender){\n        \n        this.indentMarkup = n.parentNode ? n.parentNode.ui.getChildIndent() : '';\n\n        var cb = Ext.isBoolean(a.checked),\n            nel,\n            href = this.getHref(a.href),\n            buf = ['<li class=\"x-tree-node\"><div ext:tree-node-id=\"',n.id,'\" class=\"x-tree-node-el x-tree-node-leaf x-unselectable ', a.cls,'\" unselectable=\"on\">',\n            '<span class=\"x-tree-node-indent\">',this.indentMarkup,\"</span>\",\n            '<img alt=\"\" src=\"', this.emptyIcon, '\" class=\"x-tree-ec-icon x-tree-elbow\" />',\n            '<img alt=\"\" src=\"', a.icon || this.emptyIcon, '\" class=\"x-tree-node-icon',(a.icon ? \" x-tree-node-inline-icon\" : \"\"),(a.iconCls ? \" \"+a.iconCls : \"\"),'\" unselectable=\"on\" />',\n            cb ? ('<input class=\"x-tree-node-cb\" type=\"checkbox\" ' + (a.checked ? 'checked=\"checked\" />' : '/>')) : '',\n            '<a hidefocus=\"on\" class=\"x-tree-node-anchor\" href=\"',href,'\" tabIndex=\"1\" ',\n             a.hrefTarget ? ' target=\"'+a.hrefTarget+'\"' : \"\", '><span unselectable=\"on\">',n.text,\"</span></a></div>\",\n            '<ul class=\"x-tree-node-ct\" style=\"display:none;\"></ul>',\n            \"</li>\"].join('');\n\n        if(bulkRender !== true && n.nextSibling && (nel = n.nextSibling.ui.getEl())){\n            this.wrap = Ext.DomHelper.insertHtml(\"beforeBegin\", nel, buf);\n        }else{\n            this.wrap = Ext.DomHelper.insertHtml(\"beforeEnd\", targetNode, buf);\n        }\n\n        this.elNode = this.wrap.childNodes[0];\n        this.ctNode = this.wrap.childNodes[1];\n        var cs = this.elNode.childNodes;\n        this.indentNode = cs[0];\n        this.ecNode = cs[1];\n        this.iconNode = cs[2];\n        var index = 3;\n        if(cb){\n            this.checkbox = cs[3];\n            \n            this.checkbox.defaultChecked = this.checkbox.checked;\n            index++;\n        }\n        this.anchor = cs[index];\n        this.textNode = cs[index].firstChild;\n    },\n    \n    \n    getHref : function(href){\n        return Ext.isEmpty(href) ? (Ext.isGecko ? '' : '#') : href;\n    },\n\n\n    getAnchor : function(){\n        return this.anchor;\n    },\n\n\n    getTextEl : function(){\n        return this.textNode;\n    },\n\n\n    getIconEl : function(){\n        return this.iconNode;\n    },\n\n\n    isChecked : function(){\n        return this.checkbox ? this.checkbox.checked : false;\n    },\n\n    \n    updateExpandIcon : function(){\n        if(this.rendered){\n            var n = this.node,\n                c1,\n                c2,\n                cls = n.isLast() ? \"x-tree-elbow-end\" : \"x-tree-elbow\",\n                hasChild = n.hasChildNodes();\n            if(hasChild || n.attributes.expandable){\n                if(n.expanded){\n                    cls += \"-minus\";\n                    c1 = \"x-tree-node-collapsed\";\n                    c2 = \"x-tree-node-expanded\";\n                }else{\n                    cls += \"-plus\";\n                    c1 = \"x-tree-node-expanded\";\n                    c2 = \"x-tree-node-collapsed\";\n                }\n                if(this.wasLeaf){\n                    this.removeClass(\"x-tree-node-leaf\");\n                    this.wasLeaf = false;\n                }\n                if(this.c1 != c1 || this.c2 != c2){\n                    Ext.fly(this.elNode).replaceClass(c1, c2);\n                    this.c1 = c1; this.c2 = c2;\n                }\n            }else{\n                if(!this.wasLeaf){\n                    Ext.fly(this.elNode).replaceClass(\"x-tree-node-expanded\", \"x-tree-node-collapsed\");\n                    delete this.c1;\n                    delete this.c2;\n                    this.wasLeaf = true;\n                }\n            }\n            var ecc = \"x-tree-ec-icon \"+cls;\n            if(this.ecc != ecc){\n                this.ecNode.className = ecc;\n                this.ecc = ecc;\n            }\n        }\n    },\n\n    \n    onIdChange: function(id){\n        if(this.rendered){\n            this.elNode.setAttribute('ext:tree-node-id', id);\n        }\n    },\n\n    \n    getChildIndent : function(){\n        if(!this.childIndent){\n            var buf = [],\n                p = this.node;\n            while(p){\n                if(!p.isRoot || (p.isRoot && p.ownerTree.rootVisible)){\n                    if(!p.isLast()) {\n                        buf.unshift('<img alt=\"\" src=\"'+this.emptyIcon+'\" class=\"x-tree-elbow-line\" />');\n                    } else {\n                        buf.unshift('<img alt=\"\" src=\"'+this.emptyIcon+'\" class=\"x-tree-icon\" />');\n                    }\n                }\n                p = p.parentNode;\n            }\n            this.childIndent = buf.join(\"\");\n        }\n        return this.childIndent;\n    },\n\n    \n    renderIndent : function(){\n        if(this.rendered){\n            var indent = \"\",\n                p = this.node.parentNode;\n            if(p){\n                indent = p.ui.getChildIndent();\n            }\n            if(this.indentMarkup != indent){ \n                this.indentNode.innerHTML = indent;\n                this.indentMarkup = indent;\n            }\n            this.updateExpandIcon();\n        }\n    },\n\n    destroy : function(){\n        if(this.elNode){\n            Ext.dd.Registry.unregister(this.elNode.id);\n        }\n\n        Ext.each(['textnode', 'anchor', 'checkbox', 'indentNode', 'ecNode', 'iconNode', 'elNode', 'ctNode', 'wrap', 'holder'], function(el){\n            if(this[el]){\n                Ext.fly(this[el]).remove();\n                delete this[el];\n            }\n        }, this);\n        delete this.node;\n    }\n});\n\n\nExt.tree.RootTreeNodeUI = Ext.extend(Ext.tree.TreeNodeUI, {\n    \n    render : function(){\n        if(!this.rendered){\n            var targetNode = this.node.ownerTree.innerCt.dom;\n            this.node.expanded = true;\n            targetNode.innerHTML = '<div class=\"x-tree-root-node\"></div>';\n            this.wrap = this.ctNode = targetNode.firstChild;\n        }\n    },\n    collapse : Ext.emptyFn,\n    expand : Ext.emptyFn\n});\nExt.tree.TreeLoader = function(config){\n    this.baseParams = {};\n    Ext.apply(this, config);\n\n    this.addEvents(\n        \n        \"beforeload\",\n        \n        \"load\",\n        \n        \"loadexception\"\n    );\n    Ext.tree.TreeLoader.superclass.constructor.call(this);\n    if(Ext.isString(this.paramOrder)){\n        this.paramOrder = this.paramOrder.split(/[\\s,|]/);\n    }\n};\n\nExt.extend(Ext.tree.TreeLoader, Ext.util.Observable, {\n    \n    \n    \n    \n    \n    \n    \n    uiProviders : {},\n\n    \n    clearOnLoad : true,\n\n    \n    paramOrder: undefined,\n\n    \n    paramsAsHash: false,\n\n    \n    nodeParameter: 'node',\n\n    \n    directFn : undefined,\n\n    \n    load : function(node, callback, scope){\n        if(this.clearOnLoad){\n            while(node.firstChild){\n                node.removeChild(node.firstChild);\n            }\n        }\n        if(this.doPreload(node)){ \n            this.runCallback(callback, scope || node, [node]);\n        }else if(this.directFn || this.dataUrl || this.url){\n            this.requestData(node, callback, scope || node);\n        }\n    },\n\n    doPreload : function(node){\n        if(node.attributes.children){\n            if(node.childNodes.length < 1){ \n                var cs = node.attributes.children;\n                node.beginUpdate();\n                for(var i = 0, len = cs.length; i < len; i++){\n                    var cn = node.appendChild(this.createNode(cs[i]));\n                    if(this.preloadChildren){\n                        this.doPreload(cn);\n                    }\n                }\n                node.endUpdate();\n            }\n            return true;\n        }\n        return false;\n    },\n\n    getParams: function(node){\n        var bp = Ext.apply({}, this.baseParams),\n            np = this.nodeParameter,\n            po = this.paramOrder;\n\n        np && (bp[ np ] = node.id);\n\n        if(this.directFn){\n            var buf = [node.id];\n            if(po){\n                \n                if(np && po.indexOf(np) > -1){\n                    buf = [];\n                }\n\n                for(var i = 0, len = po.length; i < len; i++){\n                    buf.push(bp[ po[i] ]);\n                }\n            }else if(this.paramsAsHash){\n                buf = [bp];\n            }\n            return buf;\n        }else{\n            return bp;\n        }\n    },\n\n    requestData : function(node, callback, scope){\n        if(this.fireEvent(\"beforeload\", this, node, callback) !== false){\n            if(this.directFn){\n                var args = this.getParams(node);\n                args.push(this.processDirectResponse.createDelegate(this, [{callback: callback, node: node, scope: scope}], true));\n                this.directFn.apply(window, args);\n            }else{\n                this.transId = Ext.Ajax.request({\n                    method:this.requestMethod,\n                    url: this.dataUrl||this.url,\n                    success: this.handleResponse,\n                    failure: this.handleFailure,\n                    scope: this,\n                    argument: {callback: callback, node: node, scope: scope},\n                    params: this.getParams(node)\n                });\n            }\n        }else{\n            \n            \n            this.runCallback(callback, scope || node, []);\n        }\n    },\n\n    processDirectResponse: function(result, response, args){\n        if(response.status){\n            this.handleResponse({\n                responseData: Ext.isArray(result) ? result : null,\n                responseText: result,\n                argument: args\n            });\n        }else{\n            this.handleFailure({\n                argument: args\n            });\n        }\n    },\n\n    \n    runCallback: function(cb, scope, args){\n        if(Ext.isFunction(cb)){\n            cb.apply(scope, args);\n        }\n    },\n\n    isLoading : function(){\n        return !!this.transId;\n    },\n\n    abort : function(){\n        if(this.isLoading()){\n            Ext.Ajax.abort(this.transId);\n        }\n    },\n\n    \n    createNode : function(attr){\n        \n        if(this.baseAttrs){\n            Ext.applyIf(attr, this.baseAttrs);\n        }\n        if(this.applyLoader !== false && !attr.loader){\n            attr.loader = this;\n        }\n        if(Ext.isString(attr.uiProvider)){\n           attr.uiProvider = this.uiProviders[attr.uiProvider] || eval(attr.uiProvider);\n        }\n        if(attr.nodeType){\n            return new Ext.tree.TreePanel.nodeTypes[attr.nodeType](attr);\n        }else{\n            return attr.leaf ?\n                        new Ext.tree.TreeNode(attr) :\n                        new Ext.tree.AsyncTreeNode(attr);\n        }\n    },\n\n    processResponse : function(response, node, callback, scope){\n        var json = response.responseText;\n        try {\n            var o = response.responseData || Ext.decode(json);\n            node.beginUpdate();\n            for(var i = 0, len = o.length; i < len; i++){\n                var n = this.createNode(o[i]);\n                if(n){\n                    node.appendChild(n);\n                }\n            }\n            node.endUpdate();\n            this.runCallback(callback, scope || node, [node]);\n        }catch(e){\n            this.handleFailure(response);\n        }\n    },\n\n    handleResponse : function(response){\n        this.transId = false;\n        var a = response.argument;\n        this.processResponse(response, a.node, a.callback, a.scope);\n        this.fireEvent(\"load\", this, a.node, response);\n    },\n\n    handleFailure : function(response){\n        this.transId = false;\n        var a = response.argument;\n        this.fireEvent(\"loadexception\", this, a.node, response);\n        this.runCallback(a.callback, a.scope || a.node, [a.node]);\n    },\n\n    destroy : function(){\n        this.abort();\n        this.purgeListeners();\n    }\n});\nExt.tree.TreeFilter = function(tree, config){\n    this.tree = tree;\n    this.filtered = {};\n    Ext.apply(this, config);\n};\n\nExt.tree.TreeFilter.prototype = {\n    clearBlank:false,\n    reverse:false,\n    autoClear:false,\n    remove:false,\n\n     \n    filter : function(value, attr, startNode){\n        attr = attr || \"text\";\n        var f;\n        if(typeof value == \"string\"){\n            var vlen = value.length;\n            \n            if(vlen == 0 && this.clearBlank){\n                this.clear();\n                return;\n            }\n            value = value.toLowerCase();\n            f = function(n){\n                return n.attributes[attr].substr(0, vlen).toLowerCase() == value;\n            };\n        }else if(value.exec){ \n            f = function(n){\n                return value.test(n.attributes[attr]);\n            };\n        }else{\n            throw 'Illegal filter type, must be string or regex';\n        }\n        this.filterBy(f, null, startNode);\n\t},\n\n    \n    filterBy : function(fn, scope, startNode){\n        startNode = startNode || this.tree.root;\n        if(this.autoClear){\n            this.clear();\n        }\n        var af = this.filtered, rv = this.reverse;\n        var f = function(n){\n            if(n == startNode){\n                return true;\n            }\n            if(af[n.id]){\n                return false;\n            }\n            var m = fn.call(scope || n, n);\n            if(!m || rv){\n                af[n.id] = n;\n                n.ui.hide();\n                return false;\n            }\n            return true;\n        };\n        startNode.cascade(f);\n        if(this.remove){\n           for(var id in af){\n               if(typeof id != \"function\"){\n                   var n = af[id];\n                   if(n && n.parentNode){\n                       n.parentNode.removeChild(n);\n                   }\n               }\n           }\n        }\n    },\n\n    \n    clear : function(){\n        var t = this.tree;\n        var af = this.filtered;\n        for(var id in af){\n            if(typeof id != \"function\"){\n                var n = af[id];\n                if(n){\n                    n.ui.show();\n                }\n            }\n        }\n        this.filtered = {};\n    }\n};\n\nExt.tree.TreeSorter = Ext.extend(Object, {\n    \n    constructor: function(tree, config){\n        \n    \n    \n    \n    \n    \n\n    Ext.apply(this, config);\n    tree.on({\n        scope: this,\n        beforechildrenrendered: this.doSort,\n        append: this.updateSort,\n        insert: this.updateSort,\n        textchange: this.updateSortParent\n    });\n\n    var desc = this.dir && this.dir.toLowerCase() == 'desc',\n        prop = this.property || 'text',\n        sortType = this.sortType,\n        folderSort = this.folderSort,\n        caseSensitive = this.caseSensitive === true,\n        leafAttr = this.leafAttr || 'leaf';\n\n    if(Ext.isString(sortType)){\n        sortType = Ext.data.SortTypes[sortType];\n    }\n    this.sortFn = function(n1, n2){\n        var attr1 = n1.attributes,\n            attr2 = n2.attributes;\n            \n        if(folderSort){\n            if(attr1[leafAttr] && !attr2[leafAttr]){\n                return 1;\n            }\n            if(!attr1[leafAttr] && attr2[leafAttr]){\n                return -1;\n            }\n        }\n        var prop1 = attr1[prop],\n            prop2 = attr2[prop],\n            v1 = sortType ? sortType(prop1, n1) : (caseSensitive ? prop1 : prop1.toUpperCase()),\n            v2 = sortType ? sortType(prop2, n2) : (caseSensitive ? prop2 : prop2.toUpperCase());\n            \n        if(v1 < v2){\n            return desc ? 1 : -1;\n        }else if(v1 > v2){\n            return desc ? -1 : 1;\n        }\n        return 0;\n    };\n    },\n    \n    doSort : function(node){\n        node.sort(this.sortFn);\n    },\n\n    updateSort : function(tree, node){\n        if(node.childrenRendered){\n            this.doSort.defer(1, this, [node]);\n        }\n    },\n\n    updateSortParent : function(node){\n        var p = node.parentNode;\n        if(p && p.childrenRendered){\n            this.doSort.defer(1, this, [p]);\n        }\n    }    \n});\n\nif(Ext.dd.DropZone){\n    \nExt.tree.TreeDropZone = function(tree, config){\n    \n    this.allowParentInsert = config.allowParentInsert || false;\n    \n    this.allowContainerDrop = config.allowContainerDrop || false;\n    \n    this.appendOnly = config.appendOnly || false;\n\n    Ext.tree.TreeDropZone.superclass.constructor.call(this, tree.getTreeEl(), config);\n    \n    this.tree = tree;\n    \n    this.dragOverData = {};\n    \n    this.lastInsertClass = \"x-tree-no-status\";\n};\n\nExt.extend(Ext.tree.TreeDropZone, Ext.dd.DropZone, {\n    \n    ddGroup : \"TreeDD\",\n\n    \n    expandDelay : 1000,\n\n    \n    expandNode : function(node){\n        if(node.hasChildNodes() && !node.isExpanded()){\n            node.expand(false, null, this.triggerCacheRefresh.createDelegate(this));\n        }\n    },\n\n    \n    queueExpand : function(node){\n        this.expandProcId = this.expandNode.defer(this.expandDelay, this, [node]);\n    },\n\n    \n    cancelExpand : function(){\n        if(this.expandProcId){\n            clearTimeout(this.expandProcId);\n            this.expandProcId = false;\n        }\n    },\n\n    \n    isValidDropPoint : function(n, pt, dd, e, data){\n        if(!n || !data){ return false; }\n        var targetNode = n.node;\n        var dropNode = data.node;\n        \n        if(!(targetNode && targetNode.isTarget && pt)){\n            return false;\n        }\n        if(pt == \"append\" && targetNode.allowChildren === false){\n            return false;\n        }\n        if((pt == \"above\" || pt == \"below\") && (targetNode.parentNode && targetNode.parentNode.allowChildren === false)){\n            return false;\n        }\n        if(dropNode && (targetNode == dropNode || dropNode.contains(targetNode))){\n            return false;\n        }\n        \n        var overEvent = this.dragOverData;\n        overEvent.tree = this.tree;\n        overEvent.target = targetNode;\n        overEvent.data = data;\n        overEvent.point = pt;\n        overEvent.source = dd;\n        overEvent.rawEvent = e;\n        overEvent.dropNode = dropNode;\n        overEvent.cancel = false;  \n        var result = this.tree.fireEvent(\"nodedragover\", overEvent);\n        return overEvent.cancel === false && result !== false;\n    },\n\n    \n    getDropPoint : function(e, n, dd){\n        var tn = n.node;\n        if(tn.isRoot){\n            return tn.allowChildren !== false ? \"append\" : false; \n        }\n        var dragEl = n.ddel;\n        var t = Ext.lib.Dom.getY(dragEl), b = t + dragEl.offsetHeight;\n        var y = Ext.lib.Event.getPageY(e);\n        var noAppend = tn.allowChildren === false || tn.isLeaf();\n        if(this.appendOnly || tn.parentNode.allowChildren === false){\n            return noAppend ? false : \"append\";\n        }\n        var noBelow = false;\n        if(!this.allowParentInsert){\n            noBelow = tn.hasChildNodes() && tn.isExpanded();\n        }\n        var q = (b - t) / (noAppend ? 2 : 3);\n        if(y >= t && y < (t + q)){\n            return \"above\";\n        }else if(!noBelow && (noAppend || y >= b-q && y <= b)){\n            return \"below\";\n        }else{\n            return \"append\";\n        }\n    },\n\n    \n    onNodeEnter : function(n, dd, e, data){\n        this.cancelExpand();\n    },\n    \n    onContainerOver : function(dd, e, data) {\n        if (this.allowContainerDrop && this.isValidDropPoint({ ddel: this.tree.getRootNode().ui.elNode, node: this.tree.getRootNode() }, \"append\", dd, e, data)) {\n            return this.dropAllowed;\n        }\n        return this.dropNotAllowed;\n    },\n\n    \n    onNodeOver : function(n, dd, e, data){\n        var pt = this.getDropPoint(e, n, dd);\n        var node = n.node;\n        \n        \n        if(!this.expandProcId && pt == \"append\" && node.hasChildNodes() && !n.node.isExpanded()){\n            this.queueExpand(node);\n        }else if(pt != \"append\"){\n            this.cancelExpand();\n        }\n        \n        \n        var returnCls = this.dropNotAllowed;\n        if(this.isValidDropPoint(n, pt, dd, e, data)){\n           if(pt){\n               var el = n.ddel;\n               var cls;\n               if(pt == \"above\"){\n                   returnCls = n.node.isFirst() ? \"x-tree-drop-ok-above\" : \"x-tree-drop-ok-between\";\n                   cls = \"x-tree-drag-insert-above\";\n               }else if(pt == \"below\"){\n                   returnCls = n.node.isLast() ? \"x-tree-drop-ok-below\" : \"x-tree-drop-ok-between\";\n                   cls = \"x-tree-drag-insert-below\";\n               }else{\n                   returnCls = \"x-tree-drop-ok-append\";\n                   cls = \"x-tree-drag-append\";\n               }\n               if(this.lastInsertClass != cls){\n                   Ext.fly(el).replaceClass(this.lastInsertClass, cls);\n                   this.lastInsertClass = cls;\n               }\n           }\n       }\n       return returnCls;\n    },\n\n    \n    onNodeOut : function(n, dd, e, data){\n        this.cancelExpand();\n        this.removeDropIndicators(n);\n    },\n\n    \n    onNodeDrop : function(n, dd, e, data){\n        var point = this.getDropPoint(e, n, dd);\n        var targetNode = n.node;\n        targetNode.ui.startDrop();\n        if(!this.isValidDropPoint(n, point, dd, e, data)){\n            targetNode.ui.endDrop();\n            return false;\n        }\n        \n        var dropNode = data.node || (dd.getTreeNode ? dd.getTreeNode(data, targetNode, point, e) : null);\n        return this.processDrop(targetNode, data, point, dd, e, dropNode);\n    },\n    \n    onContainerDrop : function(dd, e, data){\n        if (this.allowContainerDrop && this.isValidDropPoint({ ddel: this.tree.getRootNode().ui.elNode, node: this.tree.getRootNode() }, \"append\", dd, e, data)) {\n            var targetNode = this.tree.getRootNode();       \n            targetNode.ui.startDrop();\n            var dropNode = data.node || (dd.getTreeNode ? dd.getTreeNode(data, targetNode, 'append', e) : null);\n            return this.processDrop(targetNode, data, 'append', dd, e, dropNode);\n        }\n        return false;\n    },\n    \n    \n    processDrop: function(target, data, point, dd, e, dropNode){\n        var dropEvent = {\n            tree : this.tree,\n            target: target,\n            data: data,\n            point: point,\n            source: dd,\n            rawEvent: e,\n            dropNode: dropNode,\n            cancel: !dropNode,\n            dropStatus: false\n        };\n        var retval = this.tree.fireEvent(\"beforenodedrop\", dropEvent);\n        if(retval === false || dropEvent.cancel === true || !dropEvent.dropNode){\n            target.ui.endDrop();\n            return dropEvent.dropStatus;\n        }\n    \n        target = dropEvent.target;\n        if(point == 'append' && !target.isExpanded()){\n            target.expand(false, null, function(){\n                this.completeDrop(dropEvent);\n            }.createDelegate(this));\n        }else{\n            this.completeDrop(dropEvent);\n        }\n        return true;\n    },\n\n    \n    completeDrop : function(de){\n        var ns = de.dropNode, p = de.point, t = de.target;\n        if(!Ext.isArray(ns)){\n            ns = [ns];\n        }\n        var n;\n        for(var i = 0, len = ns.length; i < len; i++){\n            n = ns[i];\n            if(p == \"above\"){\n                t.parentNode.insertBefore(n, t);\n            }else if(p == \"below\"){\n                t.parentNode.insertBefore(n, t.nextSibling);\n            }else{\n                t.appendChild(n);\n            }\n        }\n        n.ui.focus();\n        if(Ext.enableFx && this.tree.hlDrop){\n            n.ui.highlight();\n        }\n        t.ui.endDrop();\n        this.tree.fireEvent(\"nodedrop\", de);\n    },\n\n    \n    afterNodeMoved : function(dd, data, e, targetNode, dropNode){\n        if(Ext.enableFx && this.tree.hlDrop){\n            dropNode.ui.focus();\n            dropNode.ui.highlight();\n        }\n        this.tree.fireEvent(\"nodedrop\", this.tree, targetNode, data, dd, e);\n    },\n\n    \n    getTree : function(){\n        return this.tree;\n    },\n\n    \n    removeDropIndicators : function(n){\n        if(n && n.ddel){\n            var el = n.ddel;\n            Ext.fly(el).removeClass([\n                    \"x-tree-drag-insert-above\",\n                    \"x-tree-drag-insert-below\",\n                    \"x-tree-drag-append\"]);\n            this.lastInsertClass = \"_noclass\";\n        }\n    },\n\n    \n    beforeDragDrop : function(target, e, id){\n        this.cancelExpand();\n        return true;\n    },\n\n    \n    afterRepair : function(data){\n        if(data && Ext.enableFx){\n            data.node.ui.highlight();\n        }\n        this.hideProxy();\n    }    \n});\n\n}\nif(Ext.dd.DragZone){\nExt.tree.TreeDragZone = function(tree, config){\n    Ext.tree.TreeDragZone.superclass.constructor.call(this, tree.innerCt, config);\n    \n    this.tree = tree;\n};\n\nExt.extend(Ext.tree.TreeDragZone, Ext.dd.DragZone, {\n    \n    ddGroup : \"TreeDD\",\n\n    \n    onBeforeDrag : function(data, e){\n        var n = data.node;\n        return n && n.draggable && !n.disabled;\n    },\n\n    \n    onInitDrag : function(e){\n        var data = this.dragData;\n        this.tree.getSelectionModel().select(data.node);\n        this.tree.eventModel.disable();\n        this.proxy.update(\"\");\n        data.node.ui.appendDDGhost(this.proxy.ghost.dom);\n        this.tree.fireEvent(\"startdrag\", this.tree, data.node, e);\n    },\n\n    \n    getRepairXY : function(e, data){\n        return data.node.ui.getDDRepairXY();\n    },\n\n    \n    onEndDrag : function(data, e){\n        this.tree.eventModel.enable.defer(100, this.tree.eventModel);\n        this.tree.fireEvent(\"enddrag\", this.tree, data.node, e);\n    },\n\n    \n    onValidDrop : function(dd, e, id){\n        this.tree.fireEvent(\"dragdrop\", this.tree, this.dragData.node, dd, e);\n        this.hideProxy();\n    },\n\n    \n    beforeInvalidDrop : function(e, id){\n        \n        var sm = this.tree.getSelectionModel();\n        sm.clearSelections();\n        sm.select(this.dragData.node);\n    },\n    \n    \n    afterRepair : function(){\n        if (Ext.enableFx && this.tree.hlDrop) {\n            Ext.Element.fly(this.dragData.ddel).highlight(this.hlColor || \"c3daf9\");\n        }\n        this.dragging = false;\n    }\n});\n}\nExt.tree.TreeEditor = function(tree, fc, config){\n    fc = fc || {};\n    var field = fc.events ? fc : new Ext.form.TextField(fc);\n    \n    Ext.tree.TreeEditor.superclass.constructor.call(this, field, config);\n\n    this.tree = tree;\n\n    if(!tree.rendered){\n        tree.on('render', this.initEditor, this);\n    }else{\n        this.initEditor(tree);\n    }\n};\n\nExt.extend(Ext.tree.TreeEditor, Ext.Editor, {\n    \n    alignment: \"l-l\",\n    \n    autoSize: false,\n    \n    hideEl : false,\n    \n    cls: \"x-small-editor x-tree-editor\",\n    \n    shim:false,\n    \n    shadow:\"frame\",\n    \n    maxWidth: 250,\n    \n    editDelay : 350,\n\n    initEditor : function(tree){\n        tree.on({\n            scope      : this,\n            beforeclick: this.beforeNodeClick,\n            dblclick   : this.onNodeDblClick\n        });\n        \n        this.on({\n            scope          : this,\n            complete       : this.updateNode,\n            beforestartedit: this.fitToTree,\n            specialkey     : this.onSpecialKey\n        });\n        \n        this.on('startedit', this.bindScroll, this, {delay:10});\n    },\n\n    \n    fitToTree : function(ed, el){\n        var td = this.tree.getTreeEl().dom, nd = el.dom;\n        if(td.scrollLeft >  nd.offsetLeft){ \n            td.scrollLeft = nd.offsetLeft;\n        }\n        var w = Math.min(\n                this.maxWidth,\n                (td.clientWidth > 20 ? td.clientWidth : td.offsetWidth) - Math.max(0, nd.offsetLeft-td.scrollLeft) - 5);\n        this.setSize(w, '');\n    },\n\n    \n    triggerEdit : function(node, defer){\n        this.completeEdit();\n\t\tif(node.attributes.editable !== false){\n           \n\t\t\tthis.editNode = node;\n            if(this.tree.autoScroll){\n                Ext.fly(node.ui.getEl()).scrollIntoView(this.tree.body);\n            }\n            var value = node.text || '';\n            if (!Ext.isGecko && Ext.isEmpty(node.text)){\n                node.setText('&#160;');\n            }\n            this.autoEditTimer = this.startEdit.defer(this.editDelay, this, [node.ui.textNode, value]);\n            return false;\n        }\n    },\n\n    \n    bindScroll : function(){\n        this.tree.getTreeEl().on('scroll', this.cancelEdit, this);\n    },\n\n    \n    beforeNodeClick : function(node, e){\n        clearTimeout(this.autoEditTimer);\n        if(this.tree.getSelectionModel().isSelected(node)){\n            e.stopEvent();\n            return this.triggerEdit(node);\n        }\n    },\n\n    onNodeDblClick : function(node, e){\n        clearTimeout(this.autoEditTimer);\n    },\n\n    \n    updateNode : function(ed, value){\n        this.tree.getTreeEl().un('scroll', this.cancelEdit, this);\n        this.editNode.setText(value);\n    },\n\n    \n    onHide : function(){\n        Ext.tree.TreeEditor.superclass.onHide.call(this);\n        if(this.editNode){\n            this.editNode.ui.focus.defer(50, this.editNode.ui);\n        }\n    },\n\n    \n    onSpecialKey : function(field, e){\n        var k = e.getKey();\n        if(k == e.ESC){\n            e.stopEvent();\n            this.cancelEdit();\n        }else if(k == e.ENTER && !e.hasModifier()){\n            e.stopEvent();\n            this.completeEdit();\n        }\n    },\n    \n    onDestroy : function(){\n        clearTimeout(this.autoEditTimer);\n        Ext.tree.TreeEditor.superclass.onDestroy.call(this);\n        var tree = this.tree;\n        tree.un('beforeclick', this.beforeNodeClick, this);\n        tree.un('dblclick', this.onNodeDblClick, this);\n    }\n});\n\nvar swfobject = function() {\n    \n    var UNDEF = \"undefined\",\n        OBJECT = \"object\",\n        SHOCKWAVE_FLASH = \"Shockwave Flash\",\n        SHOCKWAVE_FLASH_AX = \"ShockwaveFlash.ShockwaveFlash\",\n        FLASH_MIME_TYPE = \"application/x-shockwave-flash\",\n        EXPRESS_INSTALL_ID = \"SWFObjectExprInst\",\n        ON_READY_STATE_CHANGE = \"onreadystatechange\",\n        \n        win = window,\n        doc = document,\n        nav = navigator,\n        \n        plugin = false,\n        domLoadFnArr = [main],\n        regObjArr = [],\n        objIdArr = [],\n        listenersArr = [],\n        storedAltContent,\n        storedAltContentId,\n        storedCallbackFn,\n        storedCallbackObj,\n        isDomLoaded = false,\n        isExpressInstallActive = false,\n        dynamicStylesheet,\n        dynamicStylesheetMedia,\n        autoHideShow = true,\n    \n      \n    ua = function() {\n        var w3cdom = typeof doc.getElementById != UNDEF && typeof doc.getElementsByTagName != UNDEF && typeof doc.createElement != UNDEF,\n            u = nav.userAgent.toLowerCase(),\n            p = nav.platform.toLowerCase(),\n            windows = p ? (/win/).test(p) : /win/.test(u),\n            mac = p ? (/mac/).test(p) : /mac/.test(u),\n            webkit = /webkit/.test(u) ? parseFloat(u.replace(/^.*webkit\\/(\\d+(\\.\\d+)?).*$/, \"$1\")) : false, \n            ie = !+\"\\v1\", \n            playerVersion = [0,0,0],\n            d = null;\n        if (typeof nav.plugins != UNDEF && typeof nav.plugins[SHOCKWAVE_FLASH] == OBJECT) {\n            d = nav.plugins[SHOCKWAVE_FLASH].description;\n            if (d && !(typeof nav.mimeTypes != UNDEF && nav.mimeTypes[FLASH_MIME_TYPE] && !nav.mimeTypes[FLASH_MIME_TYPE].enabledPlugin)) { \n                plugin = true;\n                ie = false; \n                d = d.replace(/^.*\\s+(\\S+\\s+\\S+$)/, \"$1\");\n                playerVersion[0] = parseInt(d.replace(/^(.*)\\..*$/, \"$1\"), 10);\n                playerVersion[1] = parseInt(d.replace(/^.*\\.(.*)\\s.*$/, \"$1\"), 10);\n                playerVersion[2] = /[a-zA-Z]/.test(d) ? parseInt(d.replace(/^.*[a-zA-Z]+(.*)$/, \"$1\"), 10) : 0;\n            }\n        }\n        else if (typeof win.ActiveXObject != UNDEF) {\n            try {\n                var a = new ActiveXObject(SHOCKWAVE_FLASH_AX);\n                if (a) { \n                    d = a.GetVariable(\"$version\");\n                    if (d) {\n                        ie = true; \n                        d = d.split(\" \")[1].split(\",\");\n                        playerVersion = [parseInt(d[0], 10), parseInt(d[1], 10), parseInt(d[2], 10)];\n                    }\n                }\n            }\n            catch(e) {}\n        }\n        return { w3:w3cdom, pv:playerVersion, wk:webkit, ie:ie, win:windows, mac:mac };\n    }(),\n    \n     \n    onDomLoad = function() {\n        if (!ua.w3) { return; }\n        if ((typeof doc.readyState != UNDEF && doc.readyState == \"complete\") || (typeof doc.readyState == UNDEF && (doc.getElementsByTagName(\"body\")[0] || doc.body))) { \n            callDomLoadFunctions();\n        }\n        if (!isDomLoaded) {\n            if (typeof doc.addEventListener != UNDEF) {\n                doc.addEventListener(\"DOMContentLoaded\", callDomLoadFunctions, false);\n            }       \n            if (ua.ie && ua.win) {\n                doc.attachEvent(ON_READY_STATE_CHANGE, function() {\n                    if (doc.readyState == \"complete\") {\n                        doc.detachEvent(ON_READY_STATE_CHANGE, arguments.callee);\n                        callDomLoadFunctions();\n                    }\n                });\n                if (win == top) { \n                    (function(){\n                        if (isDomLoaded) { return; }\n                        try {\n                            doc.documentElement.doScroll(\"left\");\n                        }\n                        catch(e) {\n                            setTimeout(arguments.callee, 0);\n                            return;\n                        }\n                        callDomLoadFunctions();\n                    })();\n                }\n            }\n            if (ua.wk) {\n                (function(){\n                    if (isDomLoaded) { return; }\n                    if (!(/loaded|complete/).test(doc.readyState)) {\n                        setTimeout(arguments.callee, 0);\n                        return;\n                    }\n                    callDomLoadFunctions();\n                })();\n            }\n            addLoadEvent(callDomLoadFunctions);\n        }\n    }();\n    \n    function callDomLoadFunctions() {\n        if (isDomLoaded) { return; }\n        try { \n            var t = doc.getElementsByTagName(\"body\")[0].appendChild(createElement(\"span\"));\n            t.parentNode.removeChild(t);\n        }\n        catch (e) { return; }\n        isDomLoaded = true;\n        var dl = domLoadFnArr.length;\n        for (var i = 0; i < dl; i++) {\n            domLoadFnArr[i]();\n        }\n    }\n    \n    function addDomLoadEvent(fn) {\n        if (isDomLoaded) {\n            fn();\n        }\n        else { \n            domLoadFnArr[domLoadFnArr.length] = fn; \n        }\n    }\n    \n    \n    function addLoadEvent(fn) {\n        if (typeof win.addEventListener != UNDEF) {\n            win.addEventListener(\"load\", fn, false);\n        }\n        else if (typeof doc.addEventListener != UNDEF) {\n            doc.addEventListener(\"load\", fn, false);\n        }\n        else if (typeof win.attachEvent != UNDEF) {\n            addListener(win, \"onload\", fn);\n        }\n        else if (typeof win.onload == \"function\") {\n            var fnOld = win.onload;\n            win.onload = function() {\n                fnOld();\n                fn();\n            };\n        }\n        else {\n            win.onload = fn;\n        }\n    }\n    \n    \n    function main() { \n        if (plugin) {\n            testPlayerVersion();\n        }\n        else {\n            matchVersions();\n        }\n    }\n    \n    \n    function testPlayerVersion() {\n        var b = doc.getElementsByTagName(\"body\")[0];\n        var o = createElement(OBJECT);\n        o.setAttribute(\"type\", FLASH_MIME_TYPE);\n        var t = b.appendChild(o);\n        if (t) {\n            var counter = 0;\n            (function(){\n                if (typeof t.GetVariable != UNDEF) {\n                    var d = t.GetVariable(\"$version\");\n                    if (d) {\n                        d = d.split(\" \")[1].split(\",\");\n                        ua.pv = [parseInt(d[0], 10), parseInt(d[1], 10), parseInt(d[2], 10)];\n                    }\n                }\n                else if (counter < 10) {\n                    counter++;\n                    setTimeout(arguments.callee, 10);\n                    return;\n                }\n                b.removeChild(o);\n                t = null;\n                matchVersions();\n            })();\n        }\n        else {\n            matchVersions();\n        }\n    }\n    \n    \n    function matchVersions() {\n        var rl = regObjArr.length;\n        if (rl > 0) {\n            for (var i = 0; i < rl; i++) { \n                var id = regObjArr[i].id;\n                var cb = regObjArr[i].callbackFn;\n                var cbObj = {success:false, id:id};\n                if (ua.pv[0] > 0) {\n                    var obj = getElementById(id);\n                    if (obj) {\n                        if (hasPlayerVersion(regObjArr[i].swfVersion) && !(ua.wk && ua.wk < 312)) { \n                            setVisibility(id, true);\n                            if (cb) {\n                                cbObj.success = true;\n                                cbObj.ref = getObjectById(id);\n                                cb(cbObj);\n                            }\n                        }\n                        else if (regObjArr[i].expressInstall && canExpressInstall()) { \n                            var att = {};\n                            att.data = regObjArr[i].expressInstall;\n                            att.width = obj.getAttribute(\"width\") || \"0\";\n                            att.height = obj.getAttribute(\"height\") || \"0\";\n                            if (obj.getAttribute(\"class\")) { att.styleclass = obj.getAttribute(\"class\"); }\n                            if (obj.getAttribute(\"align\")) { att.align = obj.getAttribute(\"align\"); }\n                            \n                            var par = {};\n                            var p = obj.getElementsByTagName(\"param\");\n                            var pl = p.length;\n                            for (var j = 0; j < pl; j++) {\n                                if (p[j].getAttribute(\"name\").toLowerCase() != \"movie\") {\n                                    par[p[j].getAttribute(\"name\")] = p[j].getAttribute(\"value\");\n                                }\n                            }\n                            showExpressInstall(att, par, id, cb);\n                        }\n                        else { \n                            displayAltContent(obj);\n                            if (cb) { cb(cbObj); }\n                        }\n                    }\n                }\n                else {  \n                    setVisibility(id, true);\n                    if (cb) {\n                        var o = getObjectById(id); \n                        if (o && typeof o.SetVariable != UNDEF) { \n                            cbObj.success = true;\n                            cbObj.ref = o;\n                        }\n                        cb(cbObj);\n                    }\n                }\n            }\n        }\n    }\n    \n    function getObjectById(objectIdStr) {\n        var r = null;\n        var o = getElementById(objectIdStr);\n        if (o && o.nodeName == \"OBJECT\") {\n            if (typeof o.SetVariable != UNDEF) {\n                r = o;\n            }\n            else {\n                var n = o.getElementsByTagName(OBJECT)[0];\n                if (n) {\n                    r = n;\n                }\n            }\n        }\n        return r;\n    }\n    \n    \n    function canExpressInstall() {\n        return !isExpressInstallActive && hasPlayerVersion(\"6.0.65\") && (ua.win || ua.mac) && !(ua.wk && ua.wk < 312);\n    }\n    \n    \n    function showExpressInstall(att, par, replaceElemIdStr, callbackFn) {\n        isExpressInstallActive = true;\n        storedCallbackFn = callbackFn || null;\n        storedCallbackObj = {success:false, id:replaceElemIdStr};\n        var obj = getElementById(replaceElemIdStr);\n        if (obj) {\n            if (obj.nodeName == \"OBJECT\") { \n                storedAltContent = abstractAltContent(obj);\n                storedAltContentId = null;\n            }\n            else { \n                storedAltContent = obj;\n                storedAltContentId = replaceElemIdStr;\n            }\n            att.id = EXPRESS_INSTALL_ID;\n            if (typeof att.width == UNDEF || (!(/%$/).test(att.width) && parseInt(att.width, 10) < 310)) {\n                att.width = \"310\";\n            }\n            \n            if (typeof att.height == UNDEF || (!(/%$/).test(att.height) && parseInt(att.height, 10) < 137)) {\n                att.height = \"137\";\n            }\n            doc.title = doc.title.slice(0, 47) + \" - Flash Player Installation\";\n            var pt = ua.ie && ua.win ? \"ActiveX\" : \"PlugIn\",\n                fv = \"MMredirectURL=\" + win.location.toString().replace(/&/g,\"%26\") + \"&MMplayerType=\" + pt + \"&MMdoctitle=\" + doc.title;\n            if (typeof par.flashvars != UNDEF) {\n                par.flashvars += \"&\" + fv;\n            }\n            else {\n                par.flashvars = fv;\n            }\n            \n            \n            if (ua.ie && ua.win && obj.readyState != 4) {\n                var newObj = createElement(\"div\");\n                replaceElemIdStr += \"SWFObjectNew\";\n                newObj.setAttribute(\"id\", replaceElemIdStr);\n                obj.parentNode.insertBefore(newObj, obj); \n                obj.style.display = \"none\";\n                (function(){\n                    if (obj.readyState == 4) {\n                        obj.parentNode.removeChild(obj);\n                    }\n                    else {\n                        setTimeout(arguments.callee, 10);\n                    }\n                })();\n            }\n            createSWF(att, par, replaceElemIdStr);\n        }\n    }\n    \n    \n    function displayAltContent(obj) {\n        if (ua.ie && ua.win && obj.readyState != 4) {\n            \n            \n            var el = createElement(\"div\");\n            obj.parentNode.insertBefore(el, obj); \n            el.parentNode.replaceChild(abstractAltContent(obj), el);\n            obj.style.display = \"none\";\n            (function(){\n                if (obj.readyState == 4) {\n                    obj.parentNode.removeChild(obj);\n                }\n                else {\n                    setTimeout(arguments.callee, 10);\n                }\n            })();\n        }\n        else {\n            obj.parentNode.replaceChild(abstractAltContent(obj), obj);\n        }\n    } \n\n    function abstractAltContent(obj) {\n        var ac = createElement(\"div\");\n        if (ua.win && ua.ie) {\n            ac.innerHTML = obj.innerHTML;\n        }\n        else {\n            var nestedObj = obj.getElementsByTagName(OBJECT)[0];\n            if (nestedObj) {\n                var c = nestedObj.childNodes;\n                if (c) {\n                    var cl = c.length;\n                    for (var i = 0; i < cl; i++) {\n                        if (!(c[i].nodeType == 1 && c[i].nodeName == \"PARAM\") && !(c[i].nodeType == 8)) {\n                            ac.appendChild(c[i].cloneNode(true));\n                        }\n                    }\n                }\n            }\n        }\n        return ac;\n    }\n    \n    \n    function createSWF(attObj, parObj, id) {\n        var r, el = getElementById(id);\n        if (ua.wk && ua.wk < 312) { return r; }\n        if (el) {\n            if (typeof attObj.id == UNDEF) { \n                attObj.id = id;\n            }\n            if (ua.ie && ua.win) { \n                var att = \"\";\n                for (var i in attObj) {\n                    if (attObj[i] != Object.prototype[i]) { \n                        if (i.toLowerCase() == \"data\") {\n                            parObj.movie = attObj[i];\n                        }\n                        else if (i.toLowerCase() == \"styleclass\") { \n                            att += ' class=\"' + attObj[i] + '\"';\n                        }\n                        else if (i.toLowerCase() != \"classid\") {\n                            att += ' ' + i + '=\"' + attObj[i] + '\"';\n                        }\n                    }\n                }\n                var par = \"\";\n                for (var j in parObj) {\n                    if (parObj[j] != Object.prototype[j]) { \n                        par += '<param name=\"' + j + '\" value=\"' + parObj[j] + '\" />';\n                    }\n                }\n                el.outerHTML = '<object classid=\"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000\"' + att + '>' + par + '</object>';\n                objIdArr[objIdArr.length] = attObj.id; \n                r = getElementById(attObj.id);  \n            }\n            else { \n                var o = createElement(OBJECT);\n                o.setAttribute(\"type\", FLASH_MIME_TYPE);\n                for (var m in attObj) {\n                    if (attObj[m] != Object.prototype[m]) { \n                        if (m.toLowerCase() == \"styleclass\") { \n                            o.setAttribute(\"class\", attObj[m]);\n                        }\n                        else if (m.toLowerCase() != \"classid\") { \n                            o.setAttribute(m, attObj[m]);\n                        }\n                    }\n                }\n                for (var n in parObj) {\n                    if (parObj[n] != Object.prototype[n] && n.toLowerCase() != \"movie\") { \n                        createObjParam(o, n, parObj[n]);\n                    }\n                }\n                el.parentNode.replaceChild(o, el);\n                r = o;\n            }\n        }\n        return r;\n    }\n    \n    function createObjParam(el, pName, pValue) {\n        var p = createElement(\"param\");\n        p.setAttribute(\"name\", pName);  \n        p.setAttribute(\"value\", pValue);\n        el.appendChild(p);\n    }\n    \n    \n    function removeSWF(id) {\n        var obj = getElementById(id);\n        if (obj && obj.nodeName == \"OBJECT\") {\n            if (ua.ie && ua.win) {\n                obj.style.display = \"none\";\n                (function(){\n                    if (obj.readyState == 4) {\n                        removeObjectInIE(id);\n                    }\n                    else {\n                        setTimeout(arguments.callee, 10);\n                    }\n                })();\n            }\n            else {\n                obj.parentNode.removeChild(obj);\n            }\n        }\n    }\n    \n    function removeObjectInIE(id) {\n        var obj = getElementById(id);\n        if (obj) {\n            for (var i in obj) {\n                if (typeof obj[i] == \"function\") {\n                    obj[i] = null;\n                }\n            }\n            obj.parentNode.removeChild(obj);\n        }\n    }\n    \n    \n    function getElementById(id) {\n        var el = null;\n        try {\n            el = doc.getElementById(id);\n        }\n        catch (e) {}\n        return el;\n    }\n    \n    function createElement(el) {\n        return doc.createElement(el);\n    }\n    \n      \n    function addListener(target, eventType, fn) {\n        target.attachEvent(eventType, fn);\n        listenersArr[listenersArr.length] = [target, eventType, fn];\n    }\n    \n    \n    function hasPlayerVersion(rv) {\n        var pv = ua.pv, v = rv.split(\".\");\n        v[0] = parseInt(v[0], 10);\n        v[1] = parseInt(v[1], 10) || 0; \n        v[2] = parseInt(v[2], 10) || 0;\n        return (pv[0] > v[0] || (pv[0] == v[0] && pv[1] > v[1]) || (pv[0] == v[0] && pv[1] == v[1] && pv[2] >= v[2])) ? true : false;\n    }\n    \n      \n    function createCSS(sel, decl, media, newStyle) {\n        if (ua.ie && ua.mac) { return; }\n        var h = doc.getElementsByTagName(\"head\")[0];\n        if (!h) { return; } \n        var m = (media && typeof media == \"string\") ? media : \"screen\";\n        if (newStyle) {\n            dynamicStylesheet = null;\n            dynamicStylesheetMedia = null;\n        }\n        if (!dynamicStylesheet || dynamicStylesheetMedia != m) { \n            \n            var s = createElement(\"style\");\n            s.setAttribute(\"type\", \"text/css\");\n            s.setAttribute(\"media\", m);\n            dynamicStylesheet = h.appendChild(s);\n            if (ua.ie && ua.win && typeof doc.styleSheets != UNDEF && doc.styleSheets.length > 0) {\n                dynamicStylesheet = doc.styleSheets[doc.styleSheets.length - 1];\n            }\n            dynamicStylesheetMedia = m;\n        }\n        \n        if (ua.ie && ua.win) {\n            if (dynamicStylesheet && typeof dynamicStylesheet.addRule == OBJECT) {\n                dynamicStylesheet.addRule(sel, decl);\n            }\n        }\n        else {\n            if (dynamicStylesheet && typeof doc.createTextNode != UNDEF) {\n                dynamicStylesheet.appendChild(doc.createTextNode(sel + \" {\" + decl + \"}\"));\n            }\n        }\n    }\n    \n    function setVisibility(id, isVisible) {\n        if (!autoHideShow) { return; }\n        var v = isVisible ? \"visible\" : \"hidden\";\n        if (isDomLoaded && getElementById(id)) {\n            getElementById(id).style.visibility = v;\n        }\n        else {\n            createCSS(\"#\" + id, \"visibility:\" + v);\n        }\n    }\n\n    \n    function urlEncodeIfNecessary(s) {\n        var regex = /[\\\\\\\"<>\\.;]/;\n        var hasBadChars = regex.exec(s) != null;\n        return hasBadChars && typeof encodeURIComponent != UNDEF ? encodeURIComponent(s) : s;\n    }\n    \n    \n    var cleanup = function() {\n        if (ua.ie && ua.win) {\n            window.attachEvent(\"onunload\", function() {\n                \n                var ll = listenersArr.length;\n                for (var i = 0; i < ll; i++) {\n                    listenersArr[i][0].detachEvent(listenersArr[i][1], listenersArr[i][2]);\n                }\n                \n                var il = objIdArr.length;\n                for (var j = 0; j < il; j++) {\n                    removeSWF(objIdArr[j]);\n                }\n                \n                for (var k in ua) {\n                    ua[k] = null;\n                }\n                ua = null;\n                for (var l in swfobject) {\n                    swfobject[l] = null;\n                }\n                swfobject = null;\n                window.detachEvent('onunload', arguments.callee);\n            });\n        }\n    }();\n    \n    return {\n         \n        registerObject: function(objectIdStr, swfVersionStr, xiSwfUrlStr, callbackFn) {\n            if (ua.w3 && objectIdStr && swfVersionStr) {\n                var regObj = {};\n                regObj.id = objectIdStr;\n                regObj.swfVersion = swfVersionStr;\n                regObj.expressInstall = xiSwfUrlStr;\n                regObj.callbackFn = callbackFn;\n                regObjArr[regObjArr.length] = regObj;\n                setVisibility(objectIdStr, false);\n            }\n            else if (callbackFn) {\n                callbackFn({success:false, id:objectIdStr});\n            }\n        },\n        \n        getObjectById: function(objectIdStr) {\n            if (ua.w3) {\n                return getObjectById(objectIdStr);\n            }\n        },\n        \n        embedSWF: function(swfUrlStr, replaceElemIdStr, widthStr, heightStr, swfVersionStr, xiSwfUrlStr, flashvarsObj, parObj, attObj, callbackFn) {\n            var callbackObj = {success:false, id:replaceElemIdStr};\n            if (ua.w3 && !(ua.wk && ua.wk < 312) && swfUrlStr && replaceElemIdStr && widthStr && heightStr && swfVersionStr) {\n                setVisibility(replaceElemIdStr, false);\n                addDomLoadEvent(function() {\n                    widthStr += \"\"; \n                    heightStr += \"\";\n                    var att = {};\n                    if (attObj && typeof attObj === OBJECT) {\n                        for (var i in attObj) { \n                            att[i] = attObj[i];\n                        }\n                    }\n                    att.data = swfUrlStr;\n                    att.width = widthStr;\n                    att.height = heightStr;\n                    var par = {}; \n                    if (parObj && typeof parObj === OBJECT) {\n                        for (var j in parObj) { \n                            par[j] = parObj[j];\n                        }\n                    }\n                    if (flashvarsObj && typeof flashvarsObj === OBJECT) {\n                        for (var k in flashvarsObj) { \n                            if (typeof par.flashvars != UNDEF) {\n                                par.flashvars += \"&\" + k + \"=\" + flashvarsObj[k];\n                            }\n                            else {\n                                par.flashvars = k + \"=\" + flashvarsObj[k];\n                            }\n                        }\n                    }\n                    if (hasPlayerVersion(swfVersionStr)) { \n                        var obj = createSWF(att, par, replaceElemIdStr);\n                        if (att.id == replaceElemIdStr) {\n                            setVisibility(replaceElemIdStr, true);\n                        }\n                        callbackObj.success = true;\n                        callbackObj.ref = obj;\n                    }\n                    else if (xiSwfUrlStr && canExpressInstall()) { \n                        att.data = xiSwfUrlStr;\n                        showExpressInstall(att, par, replaceElemIdStr, callbackFn);\n                        return;\n                    }\n                    else { \n                        setVisibility(replaceElemIdStr, true);\n                    }\n                    if (callbackFn) { callbackFn(callbackObj); }\n                });\n            }\n            else if (callbackFn) { callbackFn(callbackObj); }\n        },\n        \n        switchOffAutoHideShow: function() {\n            autoHideShow = false;\n        },\n        \n        ua: ua,\n        \n        getFlashPlayerVersion: function() {\n            return { major:ua.pv[0], minor:ua.pv[1], release:ua.pv[2] };\n        },\n        \n        hasFlashPlayerVersion: hasPlayerVersion,\n        \n        createSWF: function(attObj, parObj, replaceElemIdStr) {\n            if (ua.w3) {\n                return createSWF(attObj, parObj, replaceElemIdStr);\n            }\n            else {\n                return undefined;\n            }\n        },\n        \n        showExpressInstall: function(att, par, replaceElemIdStr, callbackFn) {\n            if (ua.w3 && canExpressInstall()) {\n                showExpressInstall(att, par, replaceElemIdStr, callbackFn);\n            }\n        },\n        \n        removeSWF: function(objElemIdStr) {\n            if (ua.w3) {\n                removeSWF(objElemIdStr);\n            }\n        },\n        \n        createCSS: function(selStr, declStr, mediaStr, newStyleBoolean) {\n            if (ua.w3) {\n                createCSS(selStr, declStr, mediaStr, newStyleBoolean);\n            }\n        },\n        \n        addDomLoadEvent: addDomLoadEvent,\n        \n        addLoadEvent: addLoadEvent,\n        \n        getQueryParamValue: function(param) {\n            var q = doc.location.search || doc.location.hash;\n            if (q) {\n                if (/\\?/.test(q)) { q = q.split(\"?\")[1]; } \n                if (param == null) {\n                    return urlEncodeIfNecessary(q);\n                }\n                var pairs = q.split(\"&\");\n                for (var i = 0; i < pairs.length; i++) {\n                    if (pairs[i].substring(0, pairs[i].indexOf(\"=\")) == param) {\n                        return urlEncodeIfNecessary(pairs[i].substring((pairs[i].indexOf(\"=\") + 1)));\n                    }\n                }\n            }\n            return \"\";\n        },\n        \n        \n        expressInstallCallback: function() {\n            if (isExpressInstallActive) {\n                var obj = getElementById(EXPRESS_INSTALL_ID);\n                if (obj && storedAltContent) {\n                    obj.parentNode.replaceChild(storedAltContent, obj);\n                    if (storedAltContentId) {\n                        setVisibility(storedAltContentId, true);\n                        if (ua.ie && ua.win) { storedAltContent.style.display = \"block\"; }\n                    }\n                    if (storedCallbackFn) { storedCallbackFn(storedCallbackObj); }\n                }\n                isExpressInstallActive = false;\n            } \n        }\n    };\n}();\n\nExt.FlashComponent = Ext.extend(Ext.BoxComponent, {\n    \n    flashVersion : '9.0.115',\n\n    \n    backgroundColor: '#ffffff',\n\n    \n    wmode: 'opaque',\n\n    \n    flashVars: undefined,\n\n    \n    flashParams: undefined,\n\n    \n    url: undefined,\n    swfId : undefined,\n    swfWidth: '100%',\n    swfHeight: '100%',\n\n    \n    expressInstall: false,\n\n    initComponent : function(){\n        Ext.FlashComponent.superclass.initComponent.call(this);\n\n        this.addEvents(\n            \n            'initialize'\n        );\n    },\n\n    onRender : function(){\n        Ext.FlashComponent.superclass.onRender.apply(this, arguments);\n\n        var params = Ext.apply({\n            allowScriptAccess: 'always',\n            bgcolor: this.backgroundColor,\n            wmode: this.wmode\n        }, this.flashParams), vars = Ext.apply({\n            allowedDomain: document.location.hostname,\n            YUISwfId: this.getId(),\n            YUIBridgeCallback: 'Ext.FlashEventProxy.onEvent'\n        }, this.flashVars);\n\n        new swfobject.embedSWF(this.url, this.id, this.swfWidth, this.swfHeight, this.flashVersion,\n            this.expressInstall ? Ext.FlashComponent.EXPRESS_INSTALL_URL : undefined, vars, params);\n\n        this.swf = Ext.getDom(this.id);\n        this.el = Ext.get(this.swf);\n    },\n\n    getSwfId : function(){\n        return this.swfId || (this.swfId = \"extswf\" + (++Ext.Component.AUTO_ID));\n    },\n\n    getId : function(){\n        return this.id || (this.id = \"extflashcmp\" + (++Ext.Component.AUTO_ID));\n    },\n\n    onFlashEvent : function(e){\n        switch(e.type){\n            case \"swfReady\":\n                this.initSwf();\n                return;\n            case \"log\":\n                return;\n        }\n        e.component = this;\n        this.fireEvent(e.type.toLowerCase().replace(/event$/, ''), e);\n    },\n\n    initSwf : function(){\n        this.onSwfReady(!!this.isInitialized);\n        this.isInitialized = true;\n        this.fireEvent('initialize', this);\n    },\n\n    beforeDestroy: function(){\n        if(this.rendered){\n            swfobject.removeSWF(this.swf.id);\n        }\n        Ext.FlashComponent.superclass.beforeDestroy.call(this);\n    },\n\n    onSwfReady : Ext.emptyFn\n});\n\n\nExt.FlashComponent.EXPRESS_INSTALL_URL = 'http:/' + '/swfobject.googlecode.com/svn/trunk/swfobject/expressInstall.swf';\n\nExt.reg('flash', Ext.FlashComponent);\nExt.FlashEventProxy = {\n    onEvent : function(id, e){\n        var fp = Ext.getCmp(id);\n        if(fp){\n            fp.onFlashEvent(e);\n        }else{\n            arguments.callee.defer(10, this, [id, e]);\n        }\n    }\n};\n\n Ext.chart.Chart = Ext.extend(Ext.FlashComponent, {\n    refreshBuffer: 100,\n\n    \n\n    \n    chartStyle: {\n        padding: 10,\n        animationEnabled: true,\n        font: {\n            name: 'Tahoma',\n            color: 0x444444,\n            size: 11\n        },\n        dataTip: {\n            padding: 5,\n            border: {\n                color: 0x99bbe8,\n                size:1\n            },\n            background: {\n                color: 0xDAE7F6,\n                alpha: .9\n            },\n            font: {\n                name: 'Tahoma',\n                color: 0x15428B,\n                size: 10,\n                bold: true\n            }\n        }\n    },\n\n    \n\n    \n    extraStyle: null,\n\n    \n    seriesStyles: null,\n\n    \n    disableCaching: Ext.isIE || Ext.isOpera,\n    disableCacheParam: '_dc',\n\n    initComponent : function(){\n        Ext.chart.Chart.superclass.initComponent.call(this);\n        if(!this.url){\n            this.url = Ext.chart.Chart.CHART_URL;\n        }\n        if(this.disableCaching){\n            this.url = Ext.urlAppend(this.url, String.format('{0}={1}', this.disableCacheParam, new Date().getTime()));\n        }\n        this.addEvents(\n            'itemmouseover',\n            'itemmouseout',\n            'itemclick',\n            'itemdoubleclick',\n            'itemdragstart',\n            'itemdrag',\n            'itemdragend',\n            \n            'beforerefresh',\n            \n            'refresh'\n        );\n        this.store = Ext.StoreMgr.lookup(this.store);\n    },\n\n    \n     setStyle: function(name, value){\n         this.swf.setStyle(name, Ext.encode(value));\n     },\n\n    \n    setStyles: function(styles){\n        this.swf.setStyles(Ext.encode(styles));\n    },\n\n    \n    setSeriesStyles: function(styles){\n        this.seriesStyles = styles;\n        var s = [];\n        Ext.each(styles, function(style){\n            s.push(Ext.encode(style));\n        });\n        this.swf.setSeriesStyles(s);\n    },\n\n    setCategoryNames : function(names){\n        this.swf.setCategoryNames(names);\n    },\n\n    setLegendRenderer : function(fn, scope){\n        var chart = this;\n        scope = scope || chart;\n        chart.removeFnProxy(chart.legendFnName);\n        chart.legendFnName = chart.createFnProxy(function(name){\n            return fn.call(scope, name);\n        });\n        chart.swf.setLegendLabelFunction(chart.legendFnName);\n    },\n\n    setTipRenderer : function(fn, scope){\n        var chart = this;\n        scope = scope || chart;\n        chart.removeFnProxy(chart.tipFnName);\n        chart.tipFnName = chart.createFnProxy(function(item, index, series){\n            var record = chart.store.getAt(index);\n            return fn.call(scope, chart, record, index, series);\n        });\n        chart.swf.setDataTipFunction(chart.tipFnName);\n    },\n\n    setSeries : function(series){\n        this.series = series;\n        this.refresh();\n    },\n\n    \n    bindStore : function(store, initial){\n        if(!initial && this.store){\n            if(store !== this.store && this.store.autoDestroy){\n                this.store.destroy();\n            }else{\n                this.store.un(\"datachanged\", this.refresh, this);\n                this.store.un(\"add\", this.delayRefresh, this);\n                this.store.un(\"remove\", this.delayRefresh, this);\n                this.store.un(\"update\", this.delayRefresh, this);\n                this.store.un(\"clear\", this.refresh, this);\n            }\n        }\n        if(store){\n            store = Ext.StoreMgr.lookup(store);\n            store.on({\n                scope: this,\n                datachanged: this.refresh,\n                add: this.delayRefresh,\n                remove: this.delayRefresh,\n                update: this.delayRefresh,\n                clear: this.refresh\n            });\n        }\n        this.store = store;\n        if(store && !initial){\n            this.refresh();\n        }\n    },\n\n    onSwfReady : function(isReset){\n        Ext.chart.Chart.superclass.onSwfReady.call(this, isReset);\n        var ref;\n        this.swf.setType(this.type);\n\n        if(this.chartStyle){\n            this.setStyles(Ext.apply({}, this.extraStyle, this.chartStyle));\n        }\n\n        if(this.categoryNames){\n            this.setCategoryNames(this.categoryNames);\n        }\n\n        if(this.tipRenderer){\n            ref = this.getFunctionRef(this.tipRenderer);\n            this.setTipRenderer(ref.fn, ref.scope);\n        }\n        if(this.legendRenderer){\n            ref = this.getFunctionRef(this.legendRenderer);\n            this.setLegendRenderer(ref.fn, ref.scope);\n        }\n        if(!isReset){\n            this.bindStore(this.store, true);\n        }\n        this.refresh.defer(10, this);\n    },\n\n    delayRefresh : function(){\n        if(!this.refreshTask){\n            this.refreshTask = new Ext.util.DelayedTask(this.refresh, this);\n        }\n        this.refreshTask.delay(this.refreshBuffer);\n    },\n\n    refresh : function(){\n        if(this.fireEvent('beforerefresh', this) !== false){\n            var styleChanged = false;\n            \n            var data = [], rs = this.store.data.items;\n            for(var j = 0, len = rs.length; j < len; j++){\n                data[j] = rs[j].data;\n            }\n            \n            \n            var dataProvider = [];\n            var seriesCount = 0;\n            var currentSeries = null;\n            var i = 0;\n            if(this.series){\n                seriesCount = this.series.length;\n                for(i = 0; i < seriesCount; i++){\n                    currentSeries = this.series[i];\n                    var clonedSeries = {};\n                    for(var prop in currentSeries){\n                        if(prop == \"style\" && currentSeries.style !== null){\n                            clonedSeries.style = Ext.encode(currentSeries.style);\n                            styleChanged = true;\n                            \n                            \n                            \n                            \n                        } else{\n                            clonedSeries[prop] = currentSeries[prop];\n                        }\n                    }\n                    dataProvider.push(clonedSeries);\n                }\n            }\n\n            if(seriesCount > 0){\n                for(i = 0; i < seriesCount; i++){\n                    currentSeries = dataProvider[i];\n                    if(!currentSeries.type){\n                        currentSeries.type = this.type;\n                    }\n                    currentSeries.dataProvider = data;\n                }\n            } else{\n                dataProvider.push({type: this.type, dataProvider: data});\n            }\n            this.swf.setDataProvider(dataProvider);\n            if(this.seriesStyles){\n                this.setSeriesStyles(this.seriesStyles);\n            }\n            this.fireEvent('refresh', this);\n        }\n    },\n\n    \n    createFnProxy : function(fn){\n        var fnName = 'extFnProxy' + (++Ext.chart.Chart.PROXY_FN_ID);\n        Ext.chart.Chart.proxyFunction[fnName] = fn;\n        return 'Ext.chart.Chart.proxyFunction.' + fnName;\n    },\n\n    \n    removeFnProxy : function(fn){\n        if(!Ext.isEmpty(fn)){\n            fn = fn.replace('Ext.chart.Chart.proxyFunction.', '');\n            delete Ext.chart.Chart.proxyFunction[fn];\n        }\n    },\n\n    \n    getFunctionRef : function(val){\n        if(Ext.isFunction(val)){\n            return {\n                fn: val,\n                scope: this\n            };\n        }else{\n            return {\n                fn: val.fn,\n                scope: val.scope || this\n            };\n        }\n    },\n\n    \n    onDestroy: function(){\n        if (this.refreshTask && this.refreshTask.cancel){\n            this.refreshTask.cancel();\n        }\n        Ext.chart.Chart.superclass.onDestroy.call(this);\n        this.bindStore(null);\n        this.removeFnProxy(this.tipFnName);\n        this.removeFnProxy(this.legendFnName);\n    }\n});\nExt.reg('chart', Ext.chart.Chart);\nExt.chart.Chart.PROXY_FN_ID = 0;\nExt.chart.Chart.proxyFunction = {};\n\n\nExt.chart.Chart.CHART_URL = 'http:/' + '/yui.yahooapis.com/2.8.2/build/charts/assets/charts.swf';\n\n\nExt.chart.PieChart = Ext.extend(Ext.chart.Chart, {\n    type: 'pie',\n\n    onSwfReady : function(isReset){\n        Ext.chart.PieChart.superclass.onSwfReady.call(this, isReset);\n\n        this.setDataField(this.dataField);\n        this.setCategoryField(this.categoryField);\n    },\n\n    setDataField : function(field){\n        this.dataField = field;\n        this.swf.setDataField(field);\n    },\n\n    setCategoryField : function(field){\n        this.categoryField = field;\n        this.swf.setCategoryField(field);\n    }\n});\nExt.reg('piechart', Ext.chart.PieChart);\n\n\nExt.chart.CartesianChart = Ext.extend(Ext.chart.Chart, {\n    onSwfReady : function(isReset){\n        Ext.chart.CartesianChart.superclass.onSwfReady.call(this, isReset);\n        this.labelFn = [];\n        if(this.xField){\n            this.setXField(this.xField);\n        }\n        if(this.yField){\n            this.setYField(this.yField);\n        }\n        if(this.xAxis){\n            this.setXAxis(this.xAxis);\n        }\n        if(this.xAxes){\n            this.setXAxes(this.xAxes);\n        }\n        if(this.yAxis){\n            this.setYAxis(this.yAxis);\n        }\n        if(this.yAxes){\n            this.setYAxes(this.yAxes);\n        }\n        if(Ext.isDefined(this.constrainViewport)){\n            this.swf.setConstrainViewport(this.constrainViewport);\n        }\n    },\n\n    setXField : function(value){\n        this.xField = value;\n        this.swf.setHorizontalField(value);\n    },\n\n    setYField : function(value){\n        this.yField = value;\n        this.swf.setVerticalField(value);\n    },\n\n    setXAxis : function(value){\n        this.xAxis = this.createAxis('xAxis', value);\n        this.swf.setHorizontalAxis(this.xAxis);\n    },\n\n    setXAxes : function(value){\n        var axis;\n        for(var i = 0; i < value.length; i++) {\n            axis = this.createAxis('xAxis' + i, value[i]);\n            this.swf.setHorizontalAxis(axis);\n        }\n    },\n\n    setYAxis : function(value){\n        this.yAxis = this.createAxis('yAxis', value);\n        this.swf.setVerticalAxis(this.yAxis);\n    },\n\n    setYAxes : function(value){\n        var axis;\n        for(var i = 0; i < value.length; i++) {\n            axis = this.createAxis('yAxis' + i, value[i]);\n            this.swf.setVerticalAxis(axis);\n        }\n    },\n\n    createAxis : function(axis, value){\n        var o = Ext.apply({}, value),\n            ref,\n            old;\n\n        if(this[axis]){\n            old = this[axis].labelFunction;\n            this.removeFnProxy(old);\n            this.labelFn.remove(old);\n        }\n        if(o.labelRenderer){\n            ref = this.getFunctionRef(o.labelRenderer);\n            o.labelFunction = this.createFnProxy(function(v){\n                return ref.fn.call(ref.scope, v);\n            });\n            delete o.labelRenderer;\n            this.labelFn.push(o.labelFunction);\n        }\n        if(axis.indexOf('xAxis') > -1 && o.position == 'left'){\n            o.position = 'bottom';\n        }\n        return o;\n    },\n\n    onDestroy : function(){\n        Ext.chart.CartesianChart.superclass.onDestroy.call(this);\n        Ext.each(this.labelFn, function(fn){\n            this.removeFnProxy(fn);\n        }, this);\n    }\n});\nExt.reg('cartesianchart', Ext.chart.CartesianChart);\n\n\nExt.chart.LineChart = Ext.extend(Ext.chart.CartesianChart, {\n    type: 'line'\n});\nExt.reg('linechart', Ext.chart.LineChart);\n\n\nExt.chart.ColumnChart = Ext.extend(Ext.chart.CartesianChart, {\n    type: 'column'\n});\nExt.reg('columnchart', Ext.chart.ColumnChart);\n\n\nExt.chart.StackedColumnChart = Ext.extend(Ext.chart.CartesianChart, {\n    type: 'stackcolumn'\n});\nExt.reg('stackedcolumnchart', Ext.chart.StackedColumnChart);\n\n\nExt.chart.BarChart = Ext.extend(Ext.chart.CartesianChart, {\n    type: 'bar'\n});\nExt.reg('barchart', Ext.chart.BarChart);\n\n\nExt.chart.StackedBarChart = Ext.extend(Ext.chart.CartesianChart, {\n    type: 'stackbar'\n});\nExt.reg('stackedbarchart', Ext.chart.StackedBarChart);\n\n\n\n\nExt.chart.Axis = function(config){\n    Ext.apply(this, config);\n};\n\nExt.chart.Axis.prototype =\n{\n    \n    type: null,\n\n    \n    orientation: \"horizontal\",\n\n    \n    reverse: false,\n\n    \n    labelFunction: null,\n\n    \n    hideOverlappingLabels: true,\n\n    \n    labelSpacing: 2\n};\n\n\nExt.chart.NumericAxis = Ext.extend(Ext.chart.Axis, {\n    type: \"numeric\",\n\n    \n    minimum: NaN,\n\n    \n    maximum: NaN,\n\n    \n    majorUnit: NaN,\n\n    \n    minorUnit: NaN,\n\n    \n    snapToUnits: true,\n\n    \n    alwaysShowZero: true,\n\n    \n    scale: \"linear\",\n\n    \n    roundMajorUnit: true,\n\n    \n    calculateByLabelSize: true,\n\n    \n    position: 'left',\n\n    \n    adjustMaximumByMajorUnit: true,\n\n    \n    adjustMinimumByMajorUnit: true\n\n});\n\n\nExt.chart.TimeAxis = Ext.extend(Ext.chart.Axis, {\n    type: \"time\",\n\n    \n    minimum: null,\n\n    \n    maximum: null,\n\n    \n    majorUnit: NaN,\n\n    \n    majorTimeUnit: null,\n\n    \n    minorUnit: NaN,\n\n    \n    minorTimeUnit: null,\n\n    \n    snapToUnits: true,\n\n    \n    stackingEnabled: false,\n\n    \n    calculateByLabelSize: true\n\n});\n\n\nExt.chart.CategoryAxis = Ext.extend(Ext.chart.Axis, {\n    type: \"category\",\n\n    \n    categoryNames: null,\n\n    \n    calculateCategoryCount: false\n\n});\n\n\nExt.chart.Series = function(config) { Ext.apply(this, config); };\n\nExt.chart.Series.prototype =\n{\n    \n    type: null,\n\n    \n    displayName: null\n};\n\n\nExt.chart.CartesianSeries = Ext.extend(Ext.chart.Series, {\n    \n    xField: null,\n\n    \n    yField: null,\n\n    \n    showInLegend: true,\n\n    \n    axis: 'primary'\n});\n\n\nExt.chart.ColumnSeries = Ext.extend(Ext.chart.CartesianSeries, {\n    type: \"column\"\n});\n\n\nExt.chart.LineSeries = Ext.extend(Ext.chart.CartesianSeries, {\n    type: \"line\"\n});\n\n\nExt.chart.BarSeries = Ext.extend(Ext.chart.CartesianSeries, {\n    type: \"bar\"\n});\n\n\n\nExt.chart.PieSeries = Ext.extend(Ext.chart.Series, {\n    type: \"pie\",\n    dataField: null,\n    categoryField: null\n});\nExt.menu.Menu = Ext.extend(Ext.Container, {\n    \n    \n    \n    minWidth : 120,\n    \n    shadow : 'sides',\n    \n    subMenuAlign : 'tl-tr?',\n    \n    defaultAlign : 'tl-bl?',\n    \n    allowOtherMenus : false,\n    \n    ignoreParentClicks : false,\n    \n    enableScrolling : true,\n    \n    maxHeight : null,\n    \n    scrollIncrement : 24,\n    \n    showSeparator : true,\n    \n    defaultOffsets : [0, 0],\n\n    \n    plain : false,\n\n    \n    floating : true,\n\n\n    \n    zIndex: 15000,\n\n    \n    hidden : true,\n\n    \n    layout : 'menu',\n    hideMode : 'offsets',    \n    scrollerHeight : 8,\n    autoLayout : true,       \n    defaultType : 'menuitem',\n    bufferResize : false,\n\n    initComponent : function(){\n        if(Ext.isArray(this.initialConfig)){\n            Ext.apply(this, {items:this.initialConfig});\n        }\n        this.addEvents(\n            \n            'click',\n            \n            'mouseover',\n            \n            'mouseout',\n            \n            'itemclick'\n        );\n        Ext.menu.MenuMgr.register(this);\n        if(this.floating){\n            Ext.EventManager.onWindowResize(this.hide, this);\n        }else{\n            if(this.initialConfig.hidden !== false){\n                this.hidden = false;\n            }\n            this.internalDefaults = {hideOnClick: false};\n        }\n        Ext.menu.Menu.superclass.initComponent.call(this);\n        if(this.autoLayout){\n            var fn = this.doLayout.createDelegate(this, []);\n            this.on({\n                add: fn,\n                remove: fn\n            });\n        }\n    },\n\n    \n    getLayoutTarget : function() {\n        return this.ul;\n    },\n\n    \n    onRender : function(ct, position){\n        if(!ct){\n            ct = Ext.getBody();\n        }\n\n        var dh = {\n            id: this.getId(),\n            cls: 'x-menu ' + ((this.floating) ? 'x-menu-floating x-layer ' : '') + (this.cls || '') + (this.plain ? ' x-menu-plain' : '') + (this.showSeparator ? '' : ' x-menu-nosep'),\n            style: this.style,\n            cn: [\n                {tag: 'a', cls: 'x-menu-focus', href: '#', onclick: 'return false;', tabIndex: '-1'},\n                {tag: 'ul', cls: 'x-menu-list'}\n            ]\n        };\n        if(this.floating){\n            this.el = new Ext.Layer({\n                shadow: this.shadow,\n                dh: dh,\n                constrain: false,\n                parentEl: ct,\n                zindex: this.zIndex\n            });\n        }else{\n            this.el = ct.createChild(dh);\n        }\n        Ext.menu.Menu.superclass.onRender.call(this, ct, position);\n\n        if(!this.keyNav){\n            this.keyNav = new Ext.menu.MenuNav(this);\n        }\n        \n        this.focusEl = this.el.child('a.x-menu-focus');\n        this.ul = this.el.child('ul.x-menu-list');\n        this.mon(this.ul, {\n            scope: this,\n            click: this.onClick,\n            mouseover: this.onMouseOver,\n            mouseout: this.onMouseOut\n        });\n        if(this.enableScrolling){\n            this.mon(this.el, {\n                scope: this,\n                delegate: '.x-menu-scroller',\n                click: this.onScroll,\n                mouseover: this.deactivateActive\n            });\n        }\n    },\n\n    \n    findTargetItem : function(e){\n        var t = e.getTarget('.x-menu-list-item', this.ul, true);\n        if(t && t.menuItemId){\n            return this.items.get(t.menuItemId);\n        }\n    },\n\n    \n    onClick : function(e){\n        var t = this.findTargetItem(e);\n        if(t){\n            if(t.isFormField){\n                this.setActiveItem(t);\n            }else if(t instanceof Ext.menu.BaseItem){\n                if(t.menu && this.ignoreParentClicks){\n                    t.expandMenu();\n                    e.preventDefault();\n                }else if(t.onClick){\n                    t.onClick(e);\n                    this.fireEvent('click', this, t, e);\n                }\n            }\n        }\n    },\n\n    \n    setActiveItem : function(item, autoExpand){\n        if(item != this.activeItem){\n            this.deactivateActive();\n            if((this.activeItem = item).isFormField){\n                item.focus();\n            }else{\n                item.activate(autoExpand);\n            }\n        }else if(autoExpand){\n            item.expandMenu();\n        }\n    },\n\n    deactivateActive : function(){\n        var a = this.activeItem;\n        if(a){\n            if(a.isFormField){\n                \n                if(a.collapse){\n                    a.collapse();\n                }\n            }else{\n                a.deactivate();\n            }\n            delete this.activeItem;\n        }\n    },\n\n    \n    tryActivate : function(start, step){\n        var items = this.items;\n        for(var i = start, len = items.length; i >= 0 && i < len; i+= step){\n            var item = items.get(i);\n            if(item.isVisible() && !item.disabled && (item.canActivate || item.isFormField)){\n                this.setActiveItem(item, false);\n                return item;\n            }\n        }\n        return false;\n    },\n\n    \n    onMouseOver : function(e){\n        var t = this.findTargetItem(e);\n        if(t){\n            if(t.canActivate && !t.disabled){\n                this.setActiveItem(t, true);\n            }\n        }\n        this.over = true;\n        this.fireEvent('mouseover', this, e, t);\n    },\n\n    \n    onMouseOut : function(e){\n        var t = this.findTargetItem(e);\n        if(t){\n            if(t == this.activeItem && t.shouldDeactivate && t.shouldDeactivate(e)){\n                this.activeItem.deactivate();\n                delete this.activeItem;\n            }\n        }\n        this.over = false;\n        this.fireEvent('mouseout', this, e, t);\n    },\n\n    \n    onScroll : function(e, t){\n        if(e){\n            e.stopEvent();\n        }\n        var ul = this.ul.dom, top = Ext.fly(t).is('.x-menu-scroller-top');\n        ul.scrollTop += this.scrollIncrement * (top ? -1 : 1);\n        if(top ? ul.scrollTop <= 0 : ul.scrollTop + this.activeMax >= ul.scrollHeight){\n           this.onScrollerOut(null, t);\n        }\n    },\n\n    \n    onScrollerIn : function(e, t){\n        var ul = this.ul.dom, top = Ext.fly(t).is('.x-menu-scroller-top');\n        if(top ? ul.scrollTop > 0 : ul.scrollTop + this.activeMax < ul.scrollHeight){\n            Ext.fly(t).addClass(['x-menu-item-active', 'x-menu-scroller-active']);\n        }\n    },\n\n    \n    onScrollerOut : function(e, t){\n        Ext.fly(t).removeClass(['x-menu-item-active', 'x-menu-scroller-active']);\n    },\n\n    \n    show : function(el, pos, parentMenu){\n        if(this.floating){\n            this.parentMenu = parentMenu;\n            if(!this.el){\n                this.render();\n                this.doLayout(false, true);\n            }\n            this.showAt(this.el.getAlignToXY(el, pos || this.defaultAlign, this.defaultOffsets), parentMenu);\n        }else{\n            Ext.menu.Menu.superclass.show.call(this);\n        }\n    },\n\n    \n    showAt : function(xy, parentMenu){\n        if(this.fireEvent('beforeshow', this) !== false){\n            this.parentMenu = parentMenu;\n            if(!this.el){\n                this.render();\n            }\n            if(this.enableScrolling){\n                \n                this.el.setXY(xy);\n                \n                xy[1] = this.constrainScroll(xy[1]);\n                xy = [this.el.adjustForConstraints(xy)[0], xy[1]];\n            }else{\n                \n                xy = this.el.adjustForConstraints(xy);\n            }\n            this.el.setXY(xy);\n            this.el.show();\n            Ext.menu.Menu.superclass.onShow.call(this);\n            if(Ext.isIE9m){\n                \n                this.fireEvent('autosize', this);\n                if(!Ext.isIE8){\n                    this.el.repaint();\n                }\n            }\n            this.hidden = false;\n            this.focus();\n            this.fireEvent('show', this);\n        }\n    },\n\n    constrainScroll : function(y){\n        var max, full = this.ul.setHeight('auto').getHeight(),\n            returnY = y, normalY, parentEl, scrollTop, viewHeight;\n        if(this.floating){\n            parentEl = Ext.fly(this.el.dom.parentNode);\n            scrollTop = parentEl.getScroll().top;\n            viewHeight = parentEl.getViewSize().height;\n            \n            \n            normalY = y - scrollTop;\n            max = this.maxHeight ? this.maxHeight : viewHeight - normalY;\n            if(full > viewHeight) {\n                max = viewHeight;\n                \n                returnY = y - normalY;\n            } else if(max < full) {\n                returnY = y - (full - max);\n                max = full;\n            }\n        }else{\n            max = this.getHeight();\n        }\n        \n        if (this.maxHeight){\n            max = Math.min(this.maxHeight, max);\n        }\n        if(full > max && max > 0){\n            this.activeMax = max - this.scrollerHeight * 2 - this.el.getFrameWidth('tb') - Ext.num(this.el.shadowOffset, 0);\n            this.ul.setHeight(this.activeMax);\n            this.createScrollers();\n            this.el.select('.x-menu-scroller').setDisplayed('');\n        }else{\n            this.ul.setHeight(full);\n            this.el.select('.x-menu-scroller').setDisplayed('none');\n        }\n        this.ul.dom.scrollTop = 0;\n        return returnY;\n    },\n\n    createScrollers : function(){\n        if(!this.scroller){\n            this.scroller = {\n                pos: 0,\n                top: this.el.insertFirst({\n                    tag: 'div',\n                    cls: 'x-menu-scroller x-menu-scroller-top',\n                    html: '&#160;'\n                }),\n                bottom: this.el.createChild({\n                    tag: 'div',\n                    cls: 'x-menu-scroller x-menu-scroller-bottom',\n                    html: '&#160;'\n                })\n            };\n            this.scroller.top.hover(this.onScrollerIn, this.onScrollerOut, this);\n            this.scroller.topRepeater = new Ext.util.ClickRepeater(this.scroller.top, {\n                listeners: {\n                    click: this.onScroll.createDelegate(this, [null, this.scroller.top], false)\n                }\n            });\n            this.scroller.bottom.hover(this.onScrollerIn, this.onScrollerOut, this);\n            this.scroller.bottomRepeater = new Ext.util.ClickRepeater(this.scroller.bottom, {\n                listeners: {\n                    click: this.onScroll.createDelegate(this, [null, this.scroller.bottom], false)\n                }\n            });\n        }\n    },\n\n    onLayout : function(){\n        if(this.isVisible()){\n            if(this.enableScrolling){\n                this.constrainScroll(this.el.getTop());\n            }\n            if(this.floating){\n                this.el.sync();\n            }\n        }\n    },\n\n    focus : function(){\n        if(!this.hidden){\n            this.doFocus.defer(50, this);\n        }\n    },\n\n    doFocus : function(){\n        if(!this.hidden){\n            this.focusEl.focus();\n        }\n    },\n\n    \n    hide : function(deep){\n        if (!this.isDestroyed) {\n            this.deepHide = deep;\n            Ext.menu.Menu.superclass.hide.call(this);\n            delete this.deepHide;\n        }\n    },\n\n    \n    onHide : function(){\n        Ext.menu.Menu.superclass.onHide.call(this);\n        this.deactivateActive();\n        if(this.el && this.floating){\n            this.el.hide();\n        }\n        var pm = this.parentMenu;\n        if(this.deepHide === true && pm){\n            if(pm.floating){\n                pm.hide(true);\n            }else{\n                pm.deactivateActive();\n            }\n        }\n    },\n\n    \n    lookupComponent : function(c){\n         if(Ext.isString(c)){\n            c = (c == 'separator' || c == '-') ? new Ext.menu.Separator() : new Ext.menu.TextItem(c);\n             this.applyDefaults(c);\n         }else{\n            if(Ext.isObject(c)){\n                c = this.getMenuItem(c);\n            }else if(c.tagName || c.el){ \n                c = new Ext.BoxComponent({\n                    el: c\n                });\n            }\n         }\n         return c;\n    },\n\n    applyDefaults : function(c) {\n        if (!Ext.isString(c)) {\n            c = Ext.menu.Menu.superclass.applyDefaults.call(this, c);\n            var d = this.internalDefaults;\n            if(d){\n                if(c.events){\n                    Ext.applyIf(c.initialConfig, d);\n                    Ext.apply(c, d);\n                }else{\n                    Ext.applyIf(c, d);\n                }\n            }\n        }\n        return c;\n    },\n\n    \n    getMenuItem : function(config) {\n        config.ownerCt = this;\n        \n        if (!config.isXType) {\n            if (!config.xtype && Ext.isBoolean(config.checked)) {\n                return new Ext.menu.CheckItem(config);\n            }\n            return Ext.create(config, this.defaultType);\n        }\n        return config;\n    },\n\n    \n    addSeparator : function() {\n        return this.add(new Ext.menu.Separator());\n    },\n\n    \n    addElement : function(el) {\n        return this.add(new Ext.menu.BaseItem({\n            el: el\n        }));\n    },\n\n    \n    addItem : function(item) {\n        return this.add(item);\n    },\n\n    \n    addMenuItem : function(config) {\n        return this.add(this.getMenuItem(config));\n    },\n\n    \n    addText : function(text){\n        return this.add(new Ext.menu.TextItem(text));\n    },\n\n    \n    onDestroy : function(){\n        Ext.EventManager.removeResizeListener(this.hide, this);\n        var pm = this.parentMenu;\n        if(pm && pm.activeChild == this){\n            delete pm.activeChild;\n        }\n        delete this.parentMenu;\n        Ext.menu.Menu.superclass.onDestroy.call(this);\n        Ext.menu.MenuMgr.unregister(this);\n        if(this.keyNav) {\n            this.keyNav.disable();\n        }\n        var s = this.scroller;\n        if(s){\n            Ext.destroy(s.topRepeater, s.bottomRepeater, s.top, s.bottom);\n        }\n        Ext.destroy(\n            this.el,\n            this.focusEl,\n            this.ul\n        );\n    }\n});\n\nExt.reg('menu', Ext.menu.Menu);\n\n\nExt.menu.MenuNav = Ext.extend(Ext.KeyNav, function(){\n    function up(e, m){\n        if(!m.tryActivate(m.items.indexOf(m.activeItem)-1, -1)){\n            m.tryActivate(m.items.length-1, -1);\n        }\n    }\n    function down(e, m){\n        if(!m.tryActivate(m.items.indexOf(m.activeItem)+1, 1)){\n            m.tryActivate(0, 1);\n        }\n    }\n    return {\n        constructor : function(menu){\n            Ext.menu.MenuNav.superclass.constructor.call(this, menu.el);\n            this.scope = this.menu = menu;\n        },\n\n        doRelay : function(e, h){\n            var k = e.getKey();\n\n            if (this.menu.activeItem && this.menu.activeItem.isFormField && k != e.TAB) {\n                return false;\n            }\n            if(!this.menu.activeItem && e.isNavKeyPress() && k != e.SPACE && k != e.RETURN){\n                this.menu.tryActivate(0, 1);\n                return false;\n            }\n            return h.call(this.scope || this, e, this.menu);\n        },\n\n        tab: function(e, m) {\n            e.stopEvent();\n            if (e.shiftKey) {\n                up(e, m);\n            } else {\n                down(e, m);\n            }\n        },\n\n        up : up,\n\n        down : down,\n\n        right : function(e, m){\n            if(m.activeItem){\n                m.activeItem.expandMenu(true);\n            }\n        },\n\n        left : function(e, m){\n            m.hide();\n            if(m.parentMenu && m.parentMenu.activeItem){\n                m.parentMenu.activeItem.activate();\n            }\n        },\n\n        enter : function(e, m){\n            if(m.activeItem){\n                e.stopPropagation();\n                m.activeItem.onClick(e);\n                m.fireEvent('click', this, m.activeItem);\n                return true;\n            }\n        }\n    };\n}());\n\nExt.menu.MenuMgr = function(){\n   var menus, \n       active, \n       map,\n       groups = {}, \n       attached = false, \n       lastShow = new Date();\n   \n\n   \n   function init(){\n       menus = {};\n       active = new Ext.util.MixedCollection();\n       map = Ext.getDoc().addKeyListener(27, hideAll);\n       map.disable();\n   }\n\n   \n   function hideAll(){\n       if(active && active.length > 0){\n           var c = active.clone();\n           c.each(function(m){\n               m.hide();\n           });\n           return true;\n       }\n       return false;\n   }\n\n   \n   function onHide(m){\n       active.remove(m);\n       if(active.length < 1){\n           map.disable();\n           Ext.getDoc().un(\"mousedown\", onMouseDown);\n           attached = false;\n       }\n   }\n\n   \n   function onShow(m){\n       var last = active.last();\n       lastShow = new Date();\n       active.add(m);\n       if(!attached){\n           map.enable();\n           Ext.getDoc().on(\"mousedown\", onMouseDown);\n           attached = true;\n       }\n       if(m.parentMenu){\n          m.getEl().setZIndex(parseInt(m.parentMenu.getEl().getStyle(\"z-index\"), 10) + 3);\n          m.parentMenu.activeChild = m;\n       }else if(last && !last.isDestroyed && last.isVisible()){\n          m.getEl().setZIndex(parseInt(last.getEl().getStyle(\"z-index\"), 10) + 3);\n       }\n   }\n\n   \n   function onBeforeHide(m){\n       if(m.activeChild){\n           m.activeChild.hide();\n       }\n       if(m.autoHideTimer){\n           clearTimeout(m.autoHideTimer);\n           delete m.autoHideTimer;\n       }\n   }\n\n   \n   function onBeforeShow(m){\n       var pm = m.parentMenu;\n       if(!pm && !m.allowOtherMenus){\n           hideAll();\n       }else if(pm && pm.activeChild){\n           pm.activeChild.hide();\n       }\n   }\n\n   \n   function onMouseDown(e){\n       if(lastShow.getElapsed() > 50 && active.length > 0 && !e.getTarget(\".x-menu\")){\n           hideAll();\n       }\n   }\n\n   return {\n\n       \n       hideAll : function(){\n            return hideAll();\n       },\n\n       \n       register : function(menu){\n           if(!menus){\n               init();\n           }\n           menus[menu.id] = menu;\n           menu.on({\n               beforehide: onBeforeHide,\n               hide: onHide,\n               beforeshow: onBeforeShow,\n               show: onShow\n           });\n       },\n\n        \n       get : function(menu){\n           if(typeof menu == \"string\"){ \n               if(!menus){  \n                   return null;\n               }\n               return menus[menu];\n           }else if(menu.events){  \n               return menu;\n           }else if(typeof menu.length == 'number'){ \n               return new Ext.menu.Menu({items:menu});\n           }else{ \n               return Ext.create(menu, 'menu');\n           }\n       },\n\n       \n       unregister : function(menu){\n           delete menus[menu.id];\n           menu.un(\"beforehide\", onBeforeHide);\n           menu.un(\"hide\", onHide);\n           menu.un(\"beforeshow\", onBeforeShow);\n           menu.un(\"show\", onShow);\n       },\n\n       \n       registerCheckable : function(menuItem){\n           var g = menuItem.group;\n           if(g){\n               if(!groups[g]){\n                   groups[g] = [];\n               }\n               groups[g].push(menuItem);\n           }\n       },\n\n       \n       unregisterCheckable : function(menuItem){\n           var g = menuItem.group;\n           if(g){\n               groups[g].remove(menuItem);\n           }\n       },\n       \n       \n       onCheckChange: function(item, state){\n           if(item.group && state){\n               var group = groups[item.group],\n                   i = 0,\n                   len = group.length,\n                   current;\n                   \n               for(; i < len; i++){\n                   current = group[i];\n                   if(current != item){\n                       current.setChecked(false);\n                   }\n               }\n           }\n       },\n\n       getCheckedItem : function(groupId){\n           var g = groups[groupId];\n           if(g){\n               for(var i = 0, l = g.length; i < l; i++){\n                   if(g[i].checked){\n                       return g[i];\n                   }\n               }\n           }\n           return null;\n       },\n\n       setCheckedItem : function(groupId, itemId){\n           var g = groups[groupId];\n           if(g){\n               for(var i = 0, l = g.length; i < l; i++){\n                   if(g[i].id == itemId){\n                       g[i].setChecked(true);\n                   }\n               }\n           }\n           return null;\n       }\n   };\n}();\n\nExt.menu.BaseItem = Ext.extend(Ext.Component, {\n    \n    \n    \n    \n    canActivate : false,\n    \n    activeClass : \"x-menu-item-active\",\n    \n    hideOnClick : true,\n    \n    clickHideDelay : 1,\n\n    \n    ctype : \"Ext.menu.BaseItem\",\n\n    \n    actionMode : \"container\",\n\n    initComponent : function(){\n        Ext.menu.BaseItem.superclass.initComponent.call(this);\n        this.addEvents(\n            \n            'click',\n            \n            'activate',\n            \n            'deactivate'\n        );\n        if(this.handler){\n            this.on(\"click\", this.handler, this.scope);\n        }\n    },\n\n    \n    onRender : function(container, position){\n        Ext.menu.BaseItem.superclass.onRender.apply(this, arguments);\n        if(this.ownerCt && this.ownerCt instanceof Ext.menu.Menu){\n            this.parentMenu = this.ownerCt;\n        }else{\n            this.container.addClass('x-menu-list-item');\n            this.mon(this.el, {\n                scope: this,\n                click: this.onClick,\n                mouseenter: this.activate,\n                mouseleave: this.deactivate\n            });\n        }\n    },\n\n    \n    setHandler : function(handler, scope){\n        if(this.handler){\n            this.un(\"click\", this.handler, this.scope);\n        }\n        this.on(\"click\", this.handler = handler, this.scope = scope);\n    },\n\n    \n    onClick : function(e){\n        if(!this.disabled && this.fireEvent(\"click\", this, e) !== false\n                && (this.parentMenu && this.parentMenu.fireEvent(\"itemclick\", this, e) !== false)){\n            this.handleClick(e);\n        }else{\n            e.stopEvent();\n        }\n    },\n\n    \n    activate : function(){\n        if(this.disabled){\n            return false;\n        }\n        var li = this.container;\n        li.addClass(this.activeClass);\n        this.region = li.getRegion().adjust(2, 2, -2, -2);\n        this.fireEvent(\"activate\", this);\n        return true;\n    },\n\n    \n    deactivate : function(){\n        this.container.removeClass(this.activeClass);\n        this.fireEvent(\"deactivate\", this);\n    },\n\n    \n    shouldDeactivate : function(e){\n        return !this.region || !this.region.contains(e.getPoint());\n    },\n\n    \n    handleClick : function(e){\n        var pm = this.parentMenu;\n        if(this.hideOnClick){\n            if(pm.floating){\n                this.clickHideDelayTimer = pm.hide.defer(this.clickHideDelay, pm, [true]);\n            }else{\n                pm.deactivateActive();\n            }\n        }\n    },\n    \n    beforeDestroy: function(){\n        clearTimeout(this.clickHideDelayTimer);\n        Ext.menu.BaseItem.superclass.beforeDestroy.call(this);    \n    },\n\n    \n    expandMenu : Ext.emptyFn,\n\n    \n    hideMenu : Ext.emptyFn\n});\nExt.reg('menubaseitem', Ext.menu.BaseItem);\nExt.menu.TextItem = Ext.extend(Ext.menu.BaseItem, {\n    \n    \n    hideOnClick : false,\n    \n    itemCls : \"x-menu-text\",\n    \n    constructor : function(config) {\n        if (typeof config == 'string') {\n            config = {\n                text: config\n            };\n        }\n        Ext.menu.TextItem.superclass.constructor.call(this, config);\n    },\n\n    \n    onRender : function() {\n        var s = document.createElement(\"span\");\n        s.className = this.itemCls;\n        s.innerHTML = this.text;\n        this.el = s;\n        Ext.menu.TextItem.superclass.onRender.apply(this, arguments);\n    }\n});\nExt.reg('menutextitem', Ext.menu.TextItem);\nExt.menu.Separator = Ext.extend(Ext.menu.BaseItem, {\n    \n    itemCls : \"x-menu-sep\",\n    \n    hideOnClick : false,\n    \n    \n    activeClass: '',\n\n    \n    onRender : function(li){\n        var s = document.createElement(\"span\");\n        s.className = this.itemCls;\n        s.innerHTML = \"&#160;\";\n        this.el = s;\n        li.addClass(\"x-menu-sep-li\");\n        Ext.menu.Separator.superclass.onRender.apply(this, arguments);\n    }\n});\nExt.reg('menuseparator', Ext.menu.Separator);\nExt.menu.Item = Ext.extend(Ext.menu.BaseItem, {\n    \n    \n    \n    \n    \n    \n    \n    \n    itemCls : 'x-menu-item',\n    \n    canActivate : true,\n    \n    showDelay: 200,\n    \n    \n    altText: '',\n    \n    \n    hideDelay: 200,\n\n    \n    ctype: 'Ext.menu.Item',\n\n    initComponent : function(){\n        Ext.menu.Item.superclass.initComponent.call(this);\n        if(this.menu){\n            \n            \n            if (Ext.isArray(this.menu)){\n                this.menu = { items: this.menu };\n            }\n            \n            \n            \n            if (Ext.isObject(this.menu)){\n                this.menu.ownerCt = this;\n            }\n            \n            this.menu = Ext.menu.MenuMgr.get(this.menu);\n            this.menu.ownerCt = undefined;\n        }\n    },\n\n    \n    onRender : function(container, position){\n        if (!this.itemTpl) {\n            this.itemTpl = Ext.menu.Item.prototype.itemTpl = new Ext.XTemplate(\n                '<a id=\"{id}\" class=\"{cls} x-unselectable\" hidefocus=\"true\" unselectable=\"on\" href=\"{href}\"',\n                    '<tpl if=\"hrefTarget\">',\n                        ' target=\"{hrefTarget}\"',\n                    '</tpl>',\n                 '>',\n                     '<img alt=\"{altText}\" src=\"{icon}\" class=\"x-menu-item-icon {iconCls}\"/>',\n                     '<span class=\"x-menu-item-text\">{text}</span>',\n                 '</a>'\n             );\n        }\n        var a = this.getTemplateArgs();\n        this.el = position ? this.itemTpl.insertBefore(position, a, true) : this.itemTpl.append(container, a, true);\n        this.iconEl = this.el.child('img.x-menu-item-icon');\n        this.textEl = this.el.child('.x-menu-item-text');\n        if(!this.href) { \n            this.mon(this.el, 'click', Ext.emptyFn, null, { preventDefault: true });\n        }\n        Ext.menu.Item.superclass.onRender.call(this, container, position);\n    },\n\n    getTemplateArgs: function() {\n        return {\n            id: this.id,\n            cls: this.itemCls + (this.menu ?  ' x-menu-item-arrow' : '') + (this.cls ?  ' ' + this.cls : ''),\n            href: this.href || '#',\n            hrefTarget: this.hrefTarget,\n            icon: this.icon || Ext.BLANK_IMAGE_URL,\n            iconCls: this.iconCls || '',\n            text: this.itemText||this.text||'&#160;',\n            altText: this.altText || ''\n        };\n    },\n\n    \n    setText : function(text){\n        this.text = text||'&#160;';\n        if(this.rendered){\n            this.textEl.update(this.text);\n            this.parentMenu.layout.doAutoSize();\n        }\n    },\n\n    \n    setIconClass : function(cls){\n        var oldCls = this.iconCls;\n        this.iconCls = cls;\n        if(this.rendered){\n            this.iconEl.replaceClass(oldCls, this.iconCls);\n        }\n    },\n\n    \n    beforeDestroy: function(){\n        clearTimeout(this.showTimer);\n        clearTimeout(this.hideTimer);\n        if (this.menu){\n            delete this.menu.ownerCt;\n            this.menu.destroy();\n        }\n        Ext.menu.Item.superclass.beforeDestroy.call(this);\n    },\n\n    \n    handleClick : function(e){\n        if(!this.href){ \n            e.stopEvent();\n        }\n        Ext.menu.Item.superclass.handleClick.apply(this, arguments);\n    },\n\n    \n    activate : function(autoExpand){\n        if(Ext.menu.Item.superclass.activate.apply(this, arguments)){\n            this.focus();\n            if(autoExpand){\n                this.expandMenu();\n            }\n        }\n        return true;\n    },\n\n    \n    shouldDeactivate : function(e){\n        if(Ext.menu.Item.superclass.shouldDeactivate.call(this, e)){\n            if(this.menu && this.menu.isVisible()){\n                return !this.menu.getEl().getRegion().contains(e.getPoint());\n            }\n            return true;\n        }\n        return false;\n    },\n\n    \n    deactivate : function(){\n        Ext.menu.Item.superclass.deactivate.apply(this, arguments);\n        this.hideMenu();\n    },\n\n    \n    expandMenu : function(autoActivate){\n        if(!this.disabled && this.menu){\n            clearTimeout(this.hideTimer);\n            delete this.hideTimer;\n            if(!this.menu.isVisible() && !this.showTimer){\n                this.showTimer = this.deferExpand.defer(this.showDelay, this, [autoActivate]);\n            }else if (this.menu.isVisible() && autoActivate){\n                this.menu.tryActivate(0, 1);\n            }\n        }\n    },\n\n    \n    deferExpand : function(autoActivate){\n        delete this.showTimer;\n        this.menu.show(this.container, this.parentMenu.subMenuAlign || 'tl-tr?', this.parentMenu);\n        if(autoActivate){\n            this.menu.tryActivate(0, 1);\n        }\n    },\n\n    \n    hideMenu : function(){\n        clearTimeout(this.showTimer);\n        delete this.showTimer;\n        if(!this.hideTimer && this.menu && this.menu.isVisible()){\n            this.hideTimer = this.deferHide.defer(this.hideDelay, this);\n        }\n    },\n\n    \n    deferHide : function(){\n        delete this.hideTimer;\n        if(this.menu.over){\n            this.parentMenu.setActiveItem(this, false);\n        }else{\n            this.menu.hide();\n        }\n    }\n});\nExt.reg('menuitem', Ext.menu.Item);\nExt.menu.CheckItem = Ext.extend(Ext.menu.Item, {\n    \n    \n    itemCls : \"x-menu-item x-menu-check-item\",\n    \n    groupClass : \"x-menu-group-item\",\n\n    \n    checked: false,\n\n    \n    ctype: \"Ext.menu.CheckItem\",\n    \n    initComponent : function(){\n        Ext.menu.CheckItem.superclass.initComponent.call(this);\n\t    this.addEvents(\n\t        \n\t        \"beforecheckchange\" ,\n\t        \n\t        \"checkchange\"\n\t    );\n\t    \n\t    if(this.checkHandler){\n\t        this.on('checkchange', this.checkHandler, this.scope);\n\t    }\n\t    Ext.menu.MenuMgr.registerCheckable(this);\n    },\n\n    \n    onRender : function(c){\n        Ext.menu.CheckItem.superclass.onRender.apply(this, arguments);\n        if(this.group){\n            this.el.addClass(this.groupClass);\n        }\n        if(this.checked){\n            this.checked = false;\n            this.setChecked(true, true);\n        }\n    },\n\n    \n    destroy : function(){\n        Ext.menu.MenuMgr.unregisterCheckable(this);\n        Ext.menu.CheckItem.superclass.destroy.apply(this, arguments);\n    },\n\n    \n    setChecked : function(state, suppressEvent){\n        var suppress = suppressEvent === true;\n        if(this.checked != state && (suppress || this.fireEvent(\"beforecheckchange\", this, state) !== false)){\n            Ext.menu.MenuMgr.onCheckChange(this, state);\n            if(this.container){\n                this.container[state ? \"addClass\" : \"removeClass\"](\"x-menu-item-checked\");\n            }\n            this.checked = state;\n            if(!suppress){\n                this.fireEvent(\"checkchange\", this, state);\n            }\n        }\n    },\n\n    \n    handleClick : function(e){\n       if(!this.disabled && !(this.checked && this.group)){\n           this.setChecked(!this.checked);\n       }\n       Ext.menu.CheckItem.superclass.handleClick.apply(this, arguments);\n    }\n});\nExt.reg('menucheckitem', Ext.menu.CheckItem);\n Ext.menu.DateMenu = Ext.extend(Ext.menu.Menu, {\n    \n    enableScrolling : false,\n    \n        \n    \n    hideOnClick : true,\n    \n    \n    pickerId : null,\n    \n    \n    \n    \n    cls : 'x-date-menu',\n    \n    \n    \n    \n\n    initComponent : function(){\n        this.on('beforeshow', this.onBeforeShow, this);\n        if(this.strict = (Ext.isIE7 && Ext.isStrict)){\n            this.on('show', this.onShow, this, {single: true, delay: 20});\n        }\n        Ext.apply(this, {\n            plain: true,\n            showSeparator: false,\n            items: this.picker = new Ext.DatePicker(Ext.applyIf({\n                internalRender: this.strict || !Ext.isIE9m,\n                ctCls: 'x-menu-date-item',\n                id: this.pickerId\n            }, this.initialConfig))\n        });\n        this.picker.purgeListeners();\n        Ext.menu.DateMenu.superclass.initComponent.call(this);\n        \n        this.relayEvents(this.picker, ['select']);\n        this.on('show', this.picker.focus, this.picker);\n        this.on('select', this.menuHide, this);\n        if(this.handler){\n            this.on('select', this.handler, this.scope || this);\n        }\n    },\n\n    menuHide : function() {\n        if(this.hideOnClick){\n            this.hide(true);\n        }\n    },\n\n    onBeforeShow : function(){\n        if(this.picker){\n            this.picker.hideMonthPicker(true);\n        }\n    },\n\n    onShow : function(){\n        var el = this.picker.getEl();\n        el.setWidth(el.getWidth()); \n    }\n });\n Ext.reg('datemenu', Ext.menu.DateMenu);\n \n Ext.menu.ColorMenu = Ext.extend(Ext.menu.Menu, {\n    \n    enableScrolling : false,\n    \n        \n    \n    \n    hideOnClick : true,\n    \n    cls : 'x-color-menu',\n    \n    \n    paletteId : null,\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    initComponent : function(){\n        Ext.apply(this, {\n            plain: true,\n            showSeparator: false,\n            items: this.palette = new Ext.ColorPalette(Ext.applyIf({\n                id: this.paletteId\n            }, this.initialConfig))\n        });\n        this.palette.purgeListeners();\n        Ext.menu.ColorMenu.superclass.initComponent.call(this);\n        \n        this.relayEvents(this.palette, ['select']);\n        this.on('select', this.menuHide, this);\n        if(this.handler){\n            this.on('select', this.handler, this.scope || this);\n        }\n    },\n\n    menuHide : function(){\n        if(this.hideOnClick){\n            this.hide(true);\n        }\n    }\n});\nExt.reg('colormenu', Ext.menu.ColorMenu);\n\nExt.form.Field = Ext.extend(Ext.BoxComponent,  {\n    \n    \n    \n    \n    \n    \n\n    \n    invalidClass : 'x-form-invalid',\n    \n    invalidText : 'The value in this field is invalid',\n    \n    focusClass : 'x-form-focus',\n    \n    \n    validationEvent : 'keyup',\n    \n    validateOnBlur : true,\n    \n    validationDelay : 250,\n    \n    defaultAutoCreate : {tag: 'input', type: 'text', size: '20', autocomplete: 'off'},\n    \n    fieldClass : 'x-form-field',\n    \n    msgTarget : 'qtip',\n    \n    msgFx : 'normal',\n    \n    readOnly : false,\n    \n    disabled : false,\n    \n    submitValue: true,\n\n    \n    isFormField : true,\n\n    \n    msgDisplay: '',\n\n    \n    hasFocus : false,\n\n    \n    initComponent : function(){\n        Ext.form.Field.superclass.initComponent.call(this);\n        this.addEvents(\n            \n            'focus',\n            \n            'blur',\n            \n            'specialkey',\n            \n            'change',\n            \n            'invalid',\n            \n            'valid'\n        );\n    },\n\n    \n    getName : function(){\n        return this.rendered && this.el.dom.name ? this.el.dom.name : this.name || this.id || '';\n    },\n\n    \n    onRender : function(ct, position){\n        if(!this.el){\n            var cfg = this.getAutoCreate();\n\n            if(!cfg.name){\n                cfg.name = this.name || this.id;\n            }\n            if(this.inputType){\n                cfg.type = this.inputType;\n            }\n            this.autoEl = cfg;\n        }\n        Ext.form.Field.superclass.onRender.call(this, ct, position);\n        if(this.submitValue === false){\n            this.el.dom.removeAttribute('name');\n        }\n        var type = this.el.dom.type;\n        if(type){\n            if(type == 'password'){\n                type = 'text';\n            }\n            this.el.addClass('x-form-'+type);\n        }\n        if(this.readOnly){\n            this.setReadOnly(true);\n        }\n        if(this.tabIndex !== undefined){\n            this.el.dom.setAttribute('tabIndex', this.tabIndex);\n        }\n\n        this.el.addClass([this.fieldClass, this.cls]);\n    },\n\n    \n    getItemCt : function(){\n        return this.itemCt;\n    },\n\n    \n    initValue : function(){\n        if(this.value !== undefined){\n            this.setValue(this.value);\n        }else if(!Ext.isEmpty(this.el.dom.value) && this.el.dom.value != this.emptyText){\n            this.setValue(this.el.dom.value);\n        }\n        \n        this.originalValue = this.getValue();\n    },\n\n    \n    isDirty : function() {\n        if(this.disabled || !this.rendered) {\n            return false;\n        }\n        return String(this.getValue()) !== String(this.originalValue);\n    },\n\n    \n    setReadOnly : function(readOnly){\n        if(this.rendered){\n            this.el.dom.readOnly = readOnly;\n        }\n        this.readOnly = readOnly;\n    },\n\n    \n    afterRender : function(){\n        Ext.form.Field.superclass.afterRender.call(this);\n        this.initEvents();\n        this.initValue();\n    },\n\n    \n    fireKey : function(e){\n        if(e.isSpecialKey()){\n            this.fireEvent('specialkey', this, e);\n        }\n    },\n\n    \n    reset : function(){\n        this.setValue(this.originalValue);\n        this.clearInvalid();\n    },\n\n    \n    initEvents : function(){\n        this.mon(this.el, Ext.EventManager.getKeyEvent(), this.fireKey,  this);\n        this.mon(this.el, 'focus', this.onFocus, this);\n\n        \n        \n        this.mon(this.el, 'blur', this.onBlur, this, this.inEditor ? {buffer:10} : null);\n    },\n\n    \n    preFocus: Ext.emptyFn,\n\n    \n    onFocus : function(){\n        this.preFocus();\n        if(this.focusClass){\n            this.el.addClass(this.focusClass);\n        }\n        if(!this.hasFocus){\n            this.hasFocus = true;\n            \n            this.startValue = this.getValue();\n            this.fireEvent('focus', this);\n        }\n    },\n\n    \n    beforeBlur : Ext.emptyFn,\n\n    \n    onBlur : function(){\n        this.beforeBlur();\n        if(this.focusClass){\n            this.el.removeClass(this.focusClass);\n        }\n        this.hasFocus = false;\n        if(this.validationEvent !== false && (this.validateOnBlur || this.validationEvent == 'blur')){\n            this.validate();\n        }\n        var v = this.getValue();\n        if(String(v) !== String(this.startValue)){\n            this.fireEvent('change', this, v, this.startValue);\n        }\n        this.fireEvent('blur', this);\n        this.postBlur();\n    },\n\n    \n    postBlur : Ext.emptyFn,\n\n    \n    isValid : function(preventMark){\n        if(this.disabled){\n            return true;\n        }\n        var restore = this.preventMark;\n        this.preventMark = preventMark === true;\n        var v = this.validateValue(this.processValue(this.getRawValue()), preventMark);\n        this.preventMark = restore;\n        return v;\n    },\n\n    \n    validate : function(){\n        if(this.disabled || this.validateValue(this.processValue(this.getRawValue()))){\n            this.clearInvalid();\n            return true;\n        }\n        return false;\n    },\n\n    \n    processValue : function(value){\n        return value;\n    },\n\n    \n     validateValue : function(value) {\n         \n         var error = this.getErrors(value)[0];\n\n         if (error == undefined) {\n             return true;\n         } else {\n             this.markInvalid(error);\n             return false;\n         }\n     },\n    \n    \n    getErrors: function() {\n        return [];\n    },\n\n    \n    getActiveError : function(){\n        return this.activeError || '';\n    },\n\n    \n    markInvalid : function(msg){\n        \n        if (this.rendered && !this.preventMark) {\n            msg = msg || this.invalidText;\n\n            var mt = this.getMessageHandler();\n            if(mt){\n                mt.mark(this, msg);\n            }else if(this.msgTarget){\n                this.el.addClass(this.invalidClass);\n                var t = Ext.getDom(this.msgTarget);\n                if(t){\n                    t.innerHTML = msg;\n                    t.style.display = this.msgDisplay;\n                }\n            }\n        }\n        \n        this.setActiveError(msg);\n    },\n    \n    \n    clearInvalid : function(){\n        \n        if (this.rendered && !this.preventMark) {\n            this.el.removeClass(this.invalidClass);\n            var mt = this.getMessageHandler();\n            if(mt){\n                mt.clear(this);\n            }else if(this.msgTarget){\n                this.el.removeClass(this.invalidClass);\n                var t = Ext.getDom(this.msgTarget);\n                if(t){\n                    t.innerHTML = '';\n                    t.style.display = 'none';\n                }\n            }\n        }\n        \n        this.unsetActiveError();\n    },\n\n    \n    setActiveError: function(msg, suppressEvent) {\n        this.activeError = msg;\n        if (suppressEvent !== true) this.fireEvent('invalid', this, msg);\n    },\n    \n    \n    unsetActiveError: function(suppressEvent) {\n        delete this.activeError;\n        if (suppressEvent !== true) this.fireEvent('valid', this);\n    },\n\n    \n    getMessageHandler : function(){\n        return Ext.form.MessageTargets[this.msgTarget];\n    },\n\n    \n    getErrorCt : function(){\n        return this.el.findParent('.x-form-element', 5, true) || \n            this.el.findParent('.x-form-field-wrap', 5, true);   \n    },\n\n    \n    alignErrorEl : function(){\n        this.errorEl.setWidth(this.getErrorCt().getWidth(true) - 20);\n    },\n\n    \n    alignErrorIcon : function(){\n        this.errorIcon.alignTo(this.el, 'tl-tr', [2, 0]);\n    },\n\n    \n    getRawValue : function(){\n        var v = this.rendered ? this.el.getValue() : Ext.value(this.value, '');\n        if(v === this.emptyText){\n            v = '';\n        }\n        return v;\n    },\n\n    \n    getValue : function(){\n        if(!this.rendered) {\n            return this.value;\n        }\n        var v = this.el.getValue();\n        if(v === this.emptyText || v === undefined){\n            v = '';\n        }\n        return v;\n    },\n\n    \n    setRawValue : function(v){\n        return this.rendered ? (this.el.dom.value = (Ext.isEmpty(v) ? '' : v)) : '';\n    },\n\n    \n    setValue : function(v){\n        this.value = v;\n        if(this.rendered){\n            this.el.dom.value = (Ext.isEmpty(v) ? '' : v);\n            this.validate();\n        }\n        return this;\n    },\n\n    \n    append : function(v){\n         this.setValue([this.getValue(), v].join(''));\n    }\n\n    \n    \n\n    \n});\n\n\nExt.form.MessageTargets = {\n    'qtip' : {\n        mark: function(field, msg){\n            field.el.addClass(field.invalidClass);\n            field.el.dom.qtip = msg;\n            field.el.dom.qclass = 'x-form-invalid-tip';\n            if(Ext.QuickTips){ \n                Ext.QuickTips.enable();\n            }\n        },\n        clear: function(field){\n            field.el.removeClass(field.invalidClass);\n            field.el.dom.qtip = '';\n        }\n    },\n    'title' : {\n        mark: function(field, msg){\n            field.el.addClass(field.invalidClass);\n            field.el.dom.title = msg;\n        },\n        clear: function(field){\n            field.el.dom.title = '';\n        }\n    },\n    'under' : {\n        mark: function(field, msg){\n            field.el.addClass(field.invalidClass);\n            if(!field.errorEl){\n                var elp = field.getErrorCt();\n                if(!elp){ \n                    field.el.dom.title = msg;\n                    return;\n                }\n                field.errorEl = elp.createChild({cls:'x-form-invalid-msg'});\n                field.on('resize', field.alignErrorEl, field);\n                field.on('destroy', function(){\n                    Ext.destroy(this.errorEl);\n                }, field);\n            }\n            field.alignErrorEl();\n            field.errorEl.update(msg);\n            Ext.form.Field.msgFx[field.msgFx].show(field.errorEl, field);\n        },\n        clear: function(field){\n            field.el.removeClass(field.invalidClass);\n            if(field.errorEl){\n                Ext.form.Field.msgFx[field.msgFx].hide(field.errorEl, field);\n            }else{\n                field.el.dom.title = '';\n            }\n        }\n    },\n    'side' : {\n        mark: function(field, msg){\n            field.el.addClass(field.invalidClass);\n            if(!field.errorIcon){\n                var elp = field.getErrorCt();\n                \n                if(!elp){\n                    field.el.dom.title = msg;\n                    return;\n                }\n                field.errorIcon = elp.createChild({cls:'x-form-invalid-icon'});\n                if (field.ownerCt) {\n                    field.ownerCt.on('afterlayout', field.alignErrorIcon, field);\n                    field.ownerCt.on('expand', field.alignErrorIcon, field);\n                }\n                field.on('resize', field.alignErrorIcon, field);\n                field.on('destroy', function(){\n                    Ext.destroy(this.errorIcon);\n                }, field);\n            }\n            field.alignErrorIcon();\n            field.errorIcon.dom.qtip = msg;\n            field.errorIcon.dom.qclass = 'x-form-invalid-tip';\n            field.errorIcon.show();\n        },\n        clear: function(field){\n            field.el.removeClass(field.invalidClass);\n            if(field.errorIcon){\n                field.errorIcon.dom.qtip = '';\n                field.errorIcon.hide();\n            }else{\n                field.el.dom.title = '';\n            }\n        }\n    }\n};\n\n\nExt.form.Field.msgFx = {\n    normal : {\n        show: function(msgEl, f){\n            msgEl.setDisplayed('block');\n        },\n\n        hide : function(msgEl, f){\n            msgEl.setDisplayed(false).update('');\n        }\n    },\n\n    slide : {\n        show: function(msgEl, f){\n            msgEl.slideIn('t', {stopFx:true});\n        },\n\n        hide : function(msgEl, f){\n            msgEl.slideOut('t', {stopFx:true,useDisplay:true});\n        }\n    },\n\n    slideRight : {\n        show: function(msgEl, f){\n            msgEl.fixDisplay();\n            msgEl.alignTo(f.el, 'tl-tr');\n            msgEl.slideIn('l', {stopFx:true});\n        },\n\n        hide : function(msgEl, f){\n            msgEl.slideOut('l', {stopFx:true,useDisplay:true});\n        }\n    }\n};\nExt.reg('field', Ext.form.Field);\n\nExt.form.TextField = Ext.extend(Ext.form.Field,  {\n    \n    \n    \n    grow : false,\n    \n    growMin : 30,\n    \n    growMax : 800,\n    \n    vtype : null,\n    \n    maskRe : null,\n    \n    disableKeyFilter : false,\n    \n    allowBlank : true,\n    \n    minLength : 0,\n    \n    maxLength : Number.MAX_VALUE,\n    \n    minLengthText : 'The minimum length for this field is {0}',\n    \n    maxLengthText : 'The maximum length for this field is {0}',\n    \n    selectOnFocus : false,\n    \n    blankText : 'This field is required',\n    \n    validator : null,\n    \n    regex : null,\n    \n    regexText : '',\n    \n    emptyText : null,\n    \n    emptyClass : 'x-form-empty-field',\n\n    \n\n    initComponent : function(){\n        Ext.form.TextField.superclass.initComponent.call(this);\n        this.addEvents(\n            \n            'autosize',\n\n            \n            'keydown',\n            \n            'keyup',\n            \n            'keypress'\n        );\n    },\n\n    \n    initEvents : function(){\n        Ext.form.TextField.superclass.initEvents.call(this);\n        if(this.validationEvent == 'keyup'){\n            this.validationTask = new Ext.util.DelayedTask(this.validate, this);\n            this.mon(this.el, 'keyup', this.filterValidation, this);\n        }\n        else if(this.validationEvent !== false && this.validationEvent != 'blur'){\n        \tthis.mon(this.el, this.validationEvent, this.validate, this, {buffer: this.validationDelay});\n        }\n        if(this.selectOnFocus || this.emptyText){            \n            this.mon(this.el, 'mousedown', this.onMouseDown, this);\n            \n            if(this.emptyText){\n                this.applyEmptyText();\n            }\n        }\n        if(this.maskRe || (this.vtype && this.disableKeyFilter !== true && (this.maskRe = Ext.form.VTypes[this.vtype+'Mask']))){\n        \tthis.mon(this.el, 'keypress', this.filterKeys, this);\n        }\n        if(this.grow){\n        \tthis.mon(this.el, 'keyup', this.onKeyUpBuffered, this, {buffer: 50});\n\t\t\tthis.mon(this.el, 'click', this.autoSize, this);\n        }\n        if(this.enableKeyEvents){\n            this.mon(this.el, {\n                scope: this,\n                keyup: this.onKeyUp,\n                keydown: this.onKeyDown,\n                keypress: this.onKeyPress\n            });\n        }\n    },\n    \n    onMouseDown: function(e){\n        if(!this.hasFocus){\n            this.mon(this.el, 'mouseup', Ext.emptyFn, this, { single: true, preventDefault: true });\n        }\n    },\n\n    processValue : function(value){\n        if(this.stripCharsRe){\n            var newValue = value.replace(this.stripCharsRe, '');\n            if(newValue !== value){\n                this.setRawValue(newValue);\n                return newValue;\n            }\n        }\n        return value;\n    },\n\n    filterValidation : function(e){\n        if(!e.isNavKeyPress()){\n            this.validationTask.delay(this.validationDelay);\n        }\n    },\n    \n    \n    onDisable: function(){\n        Ext.form.TextField.superclass.onDisable.call(this);\n        if(Ext.isIE){\n            this.el.dom.unselectable = 'on';\n        }\n    },\n    \n    \n    onEnable: function(){\n        Ext.form.TextField.superclass.onEnable.call(this);\n        if(Ext.isIE){\n            this.el.dom.unselectable = '';\n        }\n    },\n\n    \n    onKeyUpBuffered : function(e){\n        if(this.doAutoSize(e)){\n            this.autoSize();\n        }\n    },\n    \n    \n    doAutoSize : function(e){\n        return !e.isNavKeyPress();\n    },\n\n    \n    onKeyUp : function(e){\n        this.fireEvent('keyup', this, e);\n    },\n\n    \n    onKeyDown : function(e){\n        this.fireEvent('keydown', this, e);\n    },\n\n    \n    onKeyPress : function(e){\n        this.fireEvent('keypress', this, e);\n    },\n\n    \n    reset : function(){\n        Ext.form.TextField.superclass.reset.call(this);\n        this.applyEmptyText();\n    },\n\n    applyEmptyText : function(){\n        if(this.rendered && this.emptyText && this.getRawValue().length < 1 && !this.hasFocus){\n            this.setRawValue(this.emptyText);\n            this.el.addClass(this.emptyClass);\n        }\n    },\n\n    \n    preFocus : function(){\n        var el = this.el,\n            isEmpty;\n        if(this.emptyText){\n            if(el.dom.value == this.emptyText){\n                this.setRawValue('');\n                isEmpty = true;\n            }\n            el.removeClass(this.emptyClass);\n        }\n        if(this.selectOnFocus || isEmpty){\n            el.dom.select();\n        }\n    },\n\n    \n    postBlur : function(){\n        this.applyEmptyText();\n    },\n\n    \n    filterKeys : function(e){\n        if(e.ctrlKey){\n            return;\n        }\n        var k = e.getKey();\n        if(Ext.isGecko && (e.isNavKeyPress() || k == e.BACKSPACE || (k == e.DELETE && e.button == -1))){\n            return;\n        }\n        var cc = String.fromCharCode(e.getCharCode());\n        if(!Ext.isGecko && e.isSpecialKey() && !cc){\n            return;\n        }\n        if(!this.maskRe.test(cc)){\n            e.stopEvent();\n        }\n    },\n\n    setValue : function(v){\n        if(this.emptyText && this.el && !Ext.isEmpty(v)){\n            this.el.removeClass(this.emptyClass);\n        }\n        Ext.form.TextField.superclass.setValue.apply(this, arguments);\n        this.applyEmptyText();\n        this.autoSize();\n        return this;\n    },\n\n    \n    getErrors: function(value) {\n        var errors = Ext.form.TextField.superclass.getErrors.apply(this, arguments);\n        \n        value = Ext.isDefined(value) ? value : this.processValue(this.getRawValue());        \n        \n        if (Ext.isFunction(this.validator)) {\n            var msg = this.validator(value);\n            if (msg !== true) {\n                errors.push(msg);\n            }\n        }\n        \n        if (value.length < 1 || value === this.emptyText) {\n            if (this.allowBlank) {\n                \n                return errors;\n            } else {\n                errors.push(this.blankText);\n            }\n        }\n        \n        if (!this.allowBlank && (value.length < 1 || value === this.emptyText)) { \n            errors.push(this.blankText);\n        }\n        \n        if (value.length < this.minLength) {\n            errors.push(String.format(this.minLengthText, this.minLength));\n        }\n        \n        if (value.length > this.maxLength) {\n            errors.push(String.format(this.maxLengthText, this.maxLength));\n        }\n        \n        if (this.vtype) {\n            var vt = Ext.form.VTypes;\n            if(!vt[this.vtype](value, this)){\n                errors.push(this.vtypeText || vt[this.vtype +'Text']);\n            }\n        }\n        \n        if (this.regex && !this.regex.test(value)) {\n            errors.push(this.regexText);\n        }\n        \n        return errors;\n    },\n\n    \n    selectText : function(start, end){\n        var v = this.getRawValue();\n        var doFocus = false;\n        if(v.length > 0){\n            start = start === undefined ? 0 : start;\n            end = end === undefined ? v.length : end;\n            var d = this.el.dom;\n            if(d.setSelectionRange){\n                d.setSelectionRange(start, end);\n            }else if(d.createTextRange){\n                var range = d.createTextRange();\n                range.moveStart('character', start);\n                range.moveEnd('character', end-v.length);\n                range.select();\n            }\n            doFocus = Ext.isGecko || Ext.isOpera;\n        }else{\n            doFocus = true;\n        }\n        if(doFocus){\n            this.focus();\n        }\n    },\n\n    \n    autoSize : function(){\n        if(!this.grow || !this.rendered){\n            return;\n        }\n        if(!this.metrics){\n            this.metrics = Ext.util.TextMetrics.createInstance(this.el);\n        }\n        var el = this.el;\n        var v = el.dom.value;\n        var d = document.createElement('div');\n        d.appendChild(document.createTextNode(v));\n        v = d.innerHTML;\n        Ext.removeNode(d);\n        d = null;\n        v += '&#160;';\n        var w = Math.min(this.growMax, Math.max(this.metrics.getWidth(v) +  10, this.growMin));\n        this.el.setWidth(w);\n        this.fireEvent('autosize', this, w);\n    },\n\t\n\tonDestroy: function(){\n\t\tif(this.validationTask){\n\t\t\tthis.validationTask.cancel();\n\t\t\tthis.validationTask = null;\n\t\t}\n\t\tExt.form.TextField.superclass.onDestroy.call(this);\n\t}\n});\nExt.reg('textfield', Ext.form.TextField);\n\nExt.form.TriggerField = Ext.extend(Ext.form.TextField,  {\n    \n    \n    \n    defaultAutoCreate : {tag: \"input\", type: \"text\", size: \"16\", autocomplete: \"off\"},\n    \n    hideTrigger:false,\n    \n    editable: true,\n    \n    readOnly: false,\n    \n    wrapFocusClass: 'x-trigger-wrap-focus',\n    \n    autoSize: Ext.emptyFn,\n    \n    monitorTab : true,\n    \n    deferHeight : true,\n    \n    mimicing : false,\n\n    actionMode: 'wrap',\n\n    defaultTriggerWidth: 17,\n\n    \n    onResize : function(w, h){\n        Ext.form.TriggerField.superclass.onResize.call(this, w, h);\n        var tw = this.getTriggerWidth();\n        if(Ext.isNumber(w)){\n            this.el.setWidth(w - tw);\n        }\n        this.wrap.setWidth(this.el.getWidth() + tw);\n    },\n\n    getTriggerWidth: function(){\n        var tw = this.trigger.getWidth();\n        if(!this.hideTrigger && !this.readOnly && tw === 0){\n            tw = this.defaultTriggerWidth;\n        }\n        return tw;\n    },\n\n    \n    alignErrorIcon : function(){\n        if(this.wrap){\n            this.errorIcon.alignTo(this.wrap, 'tl-tr', [2, 0]);\n        }\n    },\n\n    \n    onRender : function(ct, position){\n        this.doc = Ext.isIE ? Ext.getBody() : Ext.getDoc();\n        Ext.form.TriggerField.superclass.onRender.call(this, ct, position);\n\n        this.wrap = this.el.wrap({cls: 'x-form-field-wrap x-form-field-trigger-wrap'});\n        this.trigger = this.wrap.createChild(this.triggerConfig ||\n                {tag: \"img\", src: Ext.BLANK_IMAGE_URL, alt: \"\", cls: \"x-form-trigger \" + this.triggerClass});\n        this.initTrigger();\n        if(!this.width){\n            this.wrap.setWidth(this.el.getWidth()+this.trigger.getWidth());\n        }\n        this.resizeEl = this.positionEl = this.wrap;\n    },\n\n    getWidth: function() {\n        return(this.el.getWidth() + this.trigger.getWidth());\n    },\n\n    updateEditState: function(){\n        if(this.rendered){\n            if (this.readOnly) {\n                this.el.dom.readOnly = true;\n                this.el.addClass('x-trigger-noedit');\n                this.mun(this.el, 'click', this.onTriggerClick, this);\n                this.trigger.setDisplayed(false);\n            } else {\n                if (!this.editable) {\n                    this.el.dom.readOnly = true;\n                    this.el.addClass('x-trigger-noedit');\n                    this.mon(this.el, 'click', this.onTriggerClick, this);\n                } else {\n                    this.el.dom.readOnly = false;\n                    this.el.removeClass('x-trigger-noedit');\n                    this.mun(this.el, 'click', this.onTriggerClick, this);\n                }\n                this.trigger.setDisplayed(!this.hideTrigger);\n            }\n            this.onResize(this.width || this.wrap.getWidth());\n        }\n    },\n\n    \n    setHideTrigger: function(hideTrigger){\n        if(hideTrigger != this.hideTrigger){\n            this.hideTrigger = hideTrigger;\n            this.updateEditState();\n        }\n    },\n\n    \n    setEditable: function(editable){\n        if(editable != this.editable){\n            this.editable = editable;\n            this.updateEditState();\n        }\n    },\n\n    \n    setReadOnly: function(readOnly){\n        if(readOnly != this.readOnly){\n            this.readOnly = readOnly;\n            this.updateEditState();\n        }\n    },\n\n    afterRender : function(){\n        Ext.form.TriggerField.superclass.afterRender.call(this);\n        this.updateEditState();\n    },\n\n    \n    initTrigger : function(){\n        this.mon(this.trigger, 'click', this.onTriggerClick, this, {preventDefault:true});\n        this.trigger.addClassOnOver('x-form-trigger-over');\n        this.trigger.addClassOnClick('x-form-trigger-click');\n    },\n\n    \n    onDestroy : function(){\n        Ext.destroy(this.trigger, this.wrap);\n        if (this.mimicing){\n            this.doc.un('mousedown', this.mimicBlur, this);\n        }\n        delete this.doc;\n        Ext.form.TriggerField.superclass.onDestroy.call(this);\n    },\n\n    \n    onFocus : function(){\n        Ext.form.TriggerField.superclass.onFocus.call(this);\n        if(!this.mimicing){\n            this.wrap.addClass(this.wrapFocusClass);\n            this.mimicing = true;\n            this.doc.on('mousedown', this.mimicBlur, this, {delay: 10});\n            if(this.monitorTab){\n                this.on('specialkey', this.checkTab, this);\n            }\n        }\n    },\n\n    \n    checkTab : function(me, e){\n        if(e.getKey() == e.TAB){\n            this.triggerBlur();\n        }\n    },\n\n    \n    onBlur : Ext.emptyFn,\n\n    \n    mimicBlur : function(e){\n        if(!this.isDestroyed && !this.wrap.contains(e.target) && this.validateBlur(e)){\n            this.triggerBlur();\n        }\n    },\n\n    \n    triggerBlur : function(){\n        this.mimicing = false;\n        this.doc.un('mousedown', this.mimicBlur, this);\n        if(this.monitorTab && this.el){\n            this.un('specialkey', this.checkTab, this);\n        }\n        Ext.form.TriggerField.superclass.onBlur.call(this);\n        if(this.wrap){\n            this.wrap.removeClass(this.wrapFocusClass);\n        }\n    },\n\n    beforeBlur : Ext.emptyFn,\n\n    \n    \n    validateBlur : function(e){\n        return true;\n    },\n\n    \n    onTriggerClick : Ext.emptyFn\n\n    \n    \n    \n});\n\n\nExt.form.TwinTriggerField = Ext.extend(Ext.form.TriggerField, {\n    \n    \n    \n\n    initComponent : function(){\n        Ext.form.TwinTriggerField.superclass.initComponent.call(this);\n\n        this.triggerConfig = {\n            tag:'span', cls:'x-form-twin-triggers', cn:[\n            {tag: \"img\", src: Ext.BLANK_IMAGE_URL, alt: \"\", cls: \"x-form-trigger \" + this.trigger1Class},\n            {tag: \"img\", src: Ext.BLANK_IMAGE_URL, alt: \"\", cls: \"x-form-trigger \" + this.trigger2Class}\n        ]};\n    },\n\n    getTrigger : function(index){\n        return this.triggers[index];\n    },\n    \n    afterRender: function(){\n        Ext.form.TwinTriggerField.superclass.afterRender.call(this);\n        var triggers = this.triggers,\n            i = 0,\n            len = triggers.length;\n            \n        for(; i < len; ++i){\n            if(this['hideTrigger' + (i + 1)]){\n                    triggers[i].hide();\n                }\n\n        }    \n    },\n\n    initTrigger : function(){\n        var ts = this.trigger.select('.x-form-trigger', true),\n            triggerField = this;\n            \n        ts.each(function(t, all, index){\n            var triggerIndex = 'Trigger'+(index+1);\n            t.hide = function(){\n                var w = triggerField.wrap.getWidth();\n                this.dom.style.display = 'none';\n                triggerField.el.setWidth(w-triggerField.trigger.getWidth());\n                triggerField['hidden' + triggerIndex] = true;\n            };\n            t.show = function(){\n                var w = triggerField.wrap.getWidth();\n                this.dom.style.display = '';\n                triggerField.el.setWidth(w-triggerField.trigger.getWidth());\n                triggerField['hidden' + triggerIndex] = false;\n            };\n            this.mon(t, 'click', this['on'+triggerIndex+'Click'], this, {preventDefault:true});\n            t.addClassOnOver('x-form-trigger-over');\n            t.addClassOnClick('x-form-trigger-click');\n        }, this);\n        this.triggers = ts.elements;\n    },\n\n    getTriggerWidth: function(){\n        var tw = 0;\n        Ext.each(this.triggers, function(t, index){\n            var triggerIndex = 'Trigger' + (index + 1),\n                w = t.getWidth();\n            if(w === 0 && !this['hidden' + triggerIndex]){\n                tw += this.defaultTriggerWidth;\n            }else{\n                tw += w;\n            }\n        }, this);\n        return tw;\n    },\n\n    \n    onDestroy : function() {\n        Ext.destroy(this.triggers);\n        Ext.form.TwinTriggerField.superclass.onDestroy.call(this);\n    },\n\n    \n    onTrigger1Click : Ext.emptyFn,\n    \n    onTrigger2Click : Ext.emptyFn\n});\nExt.reg('trigger', Ext.form.TriggerField);\nExt.reg('twintrigger', Ext.form.TwinTriggerField);\nExt.form.TextArea = Ext.extend(Ext.form.TextField,  {\n    \n    growMin : 60,\n    \n    growMax: 1000,\n    growAppend : '&#160;\\n&#160;',\n\n    enterIsSpecial : false,\n\n    \n    preventScrollbars: false,\n    \n\n    \n    onRender : function(ct, position){\n        if(!this.el){\n            this.defaultAutoCreate = {\n                tag: \"textarea\",\n                style:\"width:100px;height:60px;\",\n                autocomplete: \"off\"\n            };\n        }\n        Ext.form.TextArea.superclass.onRender.call(this, ct, position);\n        if(this.grow){\n            this.textSizeEl = Ext.DomHelper.append(document.body, {\n                tag: \"pre\", cls: \"x-form-grow-sizer\"\n            });\n            if(this.preventScrollbars){\n                this.el.setStyle(\"overflow\", \"hidden\");\n            }\n            this.el.setHeight(this.growMin);\n        }\n    },\n\n    onDestroy : function(){\n        Ext.removeNode(this.textSizeEl);\n        Ext.form.TextArea.superclass.onDestroy.call(this);\n    },\n\n    fireKey : function(e){\n        if(e.isSpecialKey() && (this.enterIsSpecial || (e.getKey() != e.ENTER || e.hasModifier()))){\n            this.fireEvent(\"specialkey\", this, e);\n        }\n    },\n    \n    \n    doAutoSize : function(e){\n        return !e.isNavKeyPress() || e.getKey() == e.ENTER;\n    },\n    \n    \n    filterValidation: function(e) {            \n        if(!e.isNavKeyPress() || (!this.enterIsSpecial && e.keyCode == e.ENTER)){\n            this.validationTask.delay(this.validationDelay);\n        }\n    },\n\n    \n    autoSize: function(){\n        if(!this.grow || !this.textSizeEl){\n            return;\n        }\n        var el = this.el,\n            v = Ext.util.Format.htmlEncode(el.dom.value),\n            ts = this.textSizeEl,\n            h;\n            \n        Ext.fly(ts).setWidth(this.el.getWidth());\n        if(v.length < 1){\n            v = \"&#160;&#160;\";\n        }else{\n            v += this.growAppend;\n            if(Ext.isIE){\n                v = v.replace(/\\n/g, '&#160;<br />');\n            }\n        }\n        ts.innerHTML = v;\n        h = Math.min(this.growMax, Math.max(ts.offsetHeight, this.growMin));\n        if(h != this.lastHeight){\n            this.lastHeight = h;\n            this.el.setHeight(h);\n            this.fireEvent(\"autosize\", this, h);\n        }\n    }\n});\nExt.reg('textarea', Ext.form.TextArea);\nExt.form.NumberField = Ext.extend(Ext.form.TextField,  {\n    \n    \n    \n    fieldClass: \"x-form-field x-form-num-field\",\n    \n    \n    allowDecimals : true,\n    \n    \n    decimalSeparator : \".\",\n    \n    \n    decimalPrecision : 2,\n    \n    \n    allowNegative : true,\n    \n    \n    minValue : Number.NEGATIVE_INFINITY,\n    \n    \n    maxValue : Number.MAX_VALUE,\n    \n    \n    minText : \"The minimum value for this field is {0}\",\n    \n    \n    maxText : \"The maximum value for this field is {0}\",\n    \n    \n    nanText : \"{0} is not a valid number\",\n    \n    \n    baseChars : \"0123456789\",\n    \n    \n    autoStripChars: false,\n\n    \n    initEvents : function() {\n        var allowed = this.baseChars + '';\n        if (this.allowDecimals) {\n            allowed += this.decimalSeparator;\n        }\n        if (this.allowNegative) {\n            allowed += '-';\n        }\n        allowed = Ext.escapeRe(allowed);\n        this.maskRe = new RegExp('[' + allowed + ']');\n        if (this.autoStripChars) {\n            this.stripCharsRe = new RegExp('[^' + allowed + ']', 'gi');\n        }\n        \n        Ext.form.NumberField.superclass.initEvents.call(this);\n    },\n    \n    \n    getErrors: function(value) {\n        var errors = Ext.form.NumberField.superclass.getErrors.apply(this, arguments);\n        \n        value = Ext.isDefined(value) ? value : this.processValue(this.getRawValue());\n        \n        if (value.length < 1) { \n             return errors;\n        }\n        \n        value = String(value).replace(this.decimalSeparator, \".\");\n        \n        if(isNaN(value)){\n            errors.push(String.format(this.nanText, value));\n        }\n        \n        var num = this.parseValue(value);\n        \n        if (num < this.minValue) {\n            errors.push(String.format(this.minText, this.minValue));\n        }\n        \n        if (num > this.maxValue) {\n            errors.push(String.format(this.maxText, this.maxValue));\n        }\n        \n        return errors;\n    },\n\n    getValue : function() {\n        return this.fixPrecision(this.parseValue(Ext.form.NumberField.superclass.getValue.call(this)));\n    },\n\n    setValue : function(v) {\n    \tv = Ext.isNumber(v) ? v : parseFloat(String(v).replace(this.decimalSeparator, \".\"));\n        v = this.fixPrecision(v);\n        v = isNaN(v) ? '' : String(v).replace(\".\", this.decimalSeparator);\n        return Ext.form.NumberField.superclass.setValue.call(this, v);\n    },\n    \n    \n    setMinValue : function(value) {\n        this.minValue = Ext.num(value, Number.NEGATIVE_INFINITY);\n    },\n    \n    \n    setMaxValue : function(value) {\n        this.maxValue = Ext.num(value, Number.MAX_VALUE);    \n    },\n\n    \n    parseValue : function(value) {\n        value = parseFloat(String(value).replace(this.decimalSeparator, \".\"));\n        return isNaN(value) ? '' : value;\n    },\n\n    \n    fixPrecision : function(value) {\n        var nan = isNaN(value);\n        \n        if (!this.allowDecimals || this.decimalPrecision == -1 || nan || !value) {\n            return nan ? '' : value;\n        }\n        \n        return parseFloat(parseFloat(value).toFixed(this.decimalPrecision));\n    },\n\n    beforeBlur : function() {\n        var v = this.parseValue(this.getRawValue());\n        \n        if (!Ext.isEmpty(v)) {\n            this.setValue(v);\n        }\n    }\n});\n\nExt.reg('numberfield', Ext.form.NumberField);\n\nExt.form.DateField = Ext.extend(Ext.form.TriggerField,  {\n    \n    format : \"m/d/Y\",\n    \n    altFormats : \"m/d/Y|n/j/Y|n/j/y|m/j/y|n/d/y|m/j/Y|n/d/Y|m-d-y|m-d-Y|m/d|m-d|md|mdy|mdY|d|Y-m-d|n-j|n/j\",\n    \n    disabledDaysText : \"Disabled\",\n    \n    disabledDatesText : \"Disabled\",\n    \n    minText : \"The date in this field must be equal to or after {0}\",\n    \n    maxText : \"The date in this field must be equal to or before {0}\",\n    \n    invalidText : \"{0} is not a valid date - it must be in the format {1}\",\n    \n    triggerClass : 'x-form-date-trigger',\n    \n    showToday : true,\n    \n    \n    startDay : 0,\n    \n    \n    \n    \n    \n    \n\n    \n    defaultAutoCreate : {tag: \"input\", type: \"text\", size: \"10\", autocomplete: \"off\"},\n\n    \n    \n    initTime: '12', \n\n    initTimeFormat: 'H',\n\n    \n    safeParse : function(value, format) {\n        if (Date.formatContainsHourInfo(format)) {\n            \n            return Date.parseDate(value, format);\n        } else {\n            \n            var parsedDate = Date.parseDate(value + ' ' + this.initTime, format + ' ' + this.initTimeFormat);\n \n            if (parsedDate) {\n                return parsedDate.clearTime();\n            }\n        }\n    },\n\n    initComponent : function(){\n        Ext.form.DateField.superclass.initComponent.call(this);\n\n        this.addEvents(\n            \n            'select'\n        );\n\n        if(Ext.isString(this.minValue)){\n            this.minValue = this.parseDate(this.minValue);\n        }\n        if(Ext.isString(this.maxValue)){\n            this.maxValue = this.parseDate(this.maxValue);\n        }\n        this.disabledDatesRE = null;\n        this.initDisabledDays();\n    },\n\n    initEvents: function() {\n        Ext.form.DateField.superclass.initEvents.call(this);\n        this.keyNav = new Ext.KeyNav(this.el, {\n            \"down\": function(e) {\n                this.onTriggerClick();\n            },\n            scope: this,\n            forceKeyDown: true\n        });\n    },\n\n\n    \n    initDisabledDays : function(){\n        if(this.disabledDates){\n            var dd = this.disabledDates,\n                len = dd.length - 1,\n                re = \"(?:\";\n\n            Ext.each(dd, function(d, i){\n                re += Ext.isDate(d) ? '^' + Ext.escapeRe(d.dateFormat(this.format)) + '$' : dd[i];\n                if(i != len){\n                    re += '|';\n                }\n            }, this);\n            this.disabledDatesRE = new RegExp(re + ')');\n        }\n    },\n\n    \n    setDisabledDates : function(dd){\n        this.disabledDates = dd;\n        this.initDisabledDays();\n        if(this.menu){\n            this.menu.picker.setDisabledDates(this.disabledDatesRE);\n        }\n    },\n\n    \n    setDisabledDays : function(dd){\n        this.disabledDays = dd;\n        if(this.menu){\n            this.menu.picker.setDisabledDays(dd);\n        }\n    },\n\n    \n    setMinValue : function(dt){\n        this.minValue = (Ext.isString(dt) ? this.parseDate(dt) : dt);\n        if(this.menu){\n            this.menu.picker.setMinDate(this.minValue);\n        }\n    },\n\n    \n    setMaxValue : function(dt){\n        this.maxValue = (Ext.isString(dt) ? this.parseDate(dt) : dt);\n        if(this.menu){\n            this.menu.picker.setMaxDate(this.maxValue);\n        }\n    },\n\n    \n    getErrors: function(value) {\n        var errors = Ext.form.DateField.superclass.getErrors.apply(this, arguments);\n\n        value = this.formatDate(value || this.processValue(this.getRawValue()));\n\n        if (value.length < 1) { \n             return errors;\n        }\n\n        var svalue = value;\n        value = this.parseDate(value);\n        if (!value) {\n            errors.push(String.format(this.invalidText, svalue, this.format));\n            return errors;\n        }\n\n        var time = value.getTime();\n        if (this.minValue && time < this.minValue.clearTime().getTime()) {\n            errors.push(String.format(this.minText, this.formatDate(this.minValue)));\n        }\n\n        if (this.maxValue && time > this.maxValue.clearTime().getTime()) {\n            errors.push(String.format(this.maxText, this.formatDate(this.maxValue)));\n        }\n\n        if (this.disabledDays) {\n            var day = value.getDay();\n\n            for(var i = 0; i < this.disabledDays.length; i++) {\n                if (day === this.disabledDays[i]) {\n                    errors.push(this.disabledDaysText);\n                    break;\n                }\n            }\n        }\n\n        var fvalue = this.formatDate(value);\n        if (this.disabledDatesRE && this.disabledDatesRE.test(fvalue)) {\n            errors.push(String.format(this.disabledDatesText, fvalue));\n        }\n\n        return errors;\n    },\n\n    \n    \n    validateBlur : function(){\n        return !this.menu || !this.menu.isVisible();\n    },\n\n    \n    getValue : function(){\n        return this.parseDate(Ext.form.DateField.superclass.getValue.call(this)) || \"\";\n    },\n\n    \n    setValue : function(date){\n        return Ext.form.DateField.superclass.setValue.call(this, this.formatDate(this.parseDate(date)));\n    },\n\n    \n    parseDate : function(value) {\n        if(!value || Ext.isDate(value)){\n            return value;\n        }\n\n        var v = this.safeParse(value, this.format),\n            af = this.altFormats,\n            afa = this.altFormatsArray;\n\n        if (!v && af) {\n            afa = afa || af.split(\"|\");\n\n            for (var i = 0, len = afa.length; i < len && !v; i++) {\n                v = this.safeParse(value, afa[i]);\n            }\n        }\n        return v;\n    },\n\n    \n    onDestroy : function(){\n        Ext.destroy(this.menu, this.keyNav);\n        Ext.form.DateField.superclass.onDestroy.call(this);\n    },\n\n    \n    formatDate : function(date){\n        return Ext.isDate(date) ? date.dateFormat(this.format) : date;\n    },\n\n    \n    \n    \n    onTriggerClick : function(){\n        if(this.disabled){\n            return;\n        }\n        if(this.menu == null){\n            this.menu = new Ext.menu.DateMenu({\n                hideOnClick: false,\n                focusOnSelect: false\n            });\n        }\n        this.onFocus();\n        Ext.apply(this.menu.picker,  {\n            minDate : this.minValue,\n            maxDate : this.maxValue,\n            disabledDatesRE : this.disabledDatesRE,\n            disabledDatesText : this.disabledDatesText,\n            disabledDays : this.disabledDays,\n            disabledDaysText : this.disabledDaysText,\n            format : this.format,\n            showToday : this.showToday,\n            startDay: this.startDay,\n            minText : String.format(this.minText, this.formatDate(this.minValue)),\n            maxText : String.format(this.maxText, this.formatDate(this.maxValue))\n        });\n        this.menu.picker.setValue(this.getValue() || new Date());\n        this.menu.show(this.el, \"tl-bl?\");\n        this.menuEvents('on');\n    },\n\n    \n    menuEvents: function(method){\n        this.menu[method]('select', this.onSelect, this);\n        this.menu[method]('hide', this.onMenuHide, this);\n        this.menu[method]('show', this.onFocus, this);\n    },\n\n    onSelect: function(m, d){\n        this.setValue(d);\n        this.fireEvent('select', this, d);\n        this.menu.hide();\n    },\n\n    onMenuHide: function(){\n        this.focus(false, 60);\n        this.menuEvents('un');\n    },\n\n    \n    beforeBlur : function(){\n        var v = this.parseDate(this.getRawValue());\n        if(v){\n            this.setValue(v);\n        }\n    }\n\n    \n    \n    \n    \n});\nExt.reg('datefield', Ext.form.DateField);\n\nExt.form.DisplayField = Ext.extend(Ext.form.Field,  {\n    validationEvent : false,\n    validateOnBlur : false,\n    defaultAutoCreate : {tag: \"div\"},\n    \n    fieldClass : \"x-form-display-field\",\n    \n    htmlEncode: false,\n\n    \n    initEvents : Ext.emptyFn,\n\n    isValid : function(){\n        return true;\n    },\n\n    validate : function(){\n        return true;\n    },\n\n    getRawValue : function(){\n        var v = this.rendered ? this.el.dom.innerHTML : Ext.value(this.value, '');\n        if(v === this.emptyText){\n            v = '';\n        }\n        if(this.htmlEncode){\n            v = Ext.util.Format.htmlDecode(v);\n        }\n        return v;\n    },\n\n    getValue : function(){\n        return this.getRawValue();\n    },\n    \n    getName: function() {\n        return this.name;\n    },\n\n    setRawValue : function(v){\n        if(this.htmlEncode){\n            v = Ext.util.Format.htmlEncode(v);\n        }\n        return this.rendered ? (this.el.dom.innerHTML = (Ext.isEmpty(v) ? '' : v)) : (this.value = v);\n    },\n\n    setValue : function(v){\n        this.setRawValue(v);\n        return this;\n    }\n    \n    \n    \n    \n    \n    \n});\n\nExt.reg('displayfield', Ext.form.DisplayField);\n\nExt.form.ComboBox = Ext.extend(Ext.form.TriggerField, {\n    \n    \n    \n    \n    \n\n    \n    defaultAutoCreate : {tag: \"input\", type: \"text\", size: \"24\", autocomplete: \"off\"},\n    \n    \n    \n    \n    \n    \n    \n    listClass : '',\n    \n    selectedClass : 'x-combo-selected',\n    \n    listEmptyText: '',\n    \n    triggerClass : 'x-form-arrow-trigger',\n    \n    shadow : 'sides',\n    \n    listAlign : 'tl-bl?',\n    \n    maxHeight : 300,\n    \n    minHeight : 90,\n    \n    triggerAction : 'query',\n    \n    minChars : 4,\n    \n    autoSelect : true,\n    \n    typeAhead : false,\n    \n    queryDelay : 500,\n    \n    pageSize : 0,\n    \n    selectOnFocus : false,\n    \n    queryParam : 'query',\n    \n    loadingText : 'Loading...',\n    \n    resizable : false,\n    \n    handleHeight : 8,\n    \n    allQuery: '',\n    \n    mode: 'remote',\n    \n    minListWidth : 70,\n    \n    forceSelection : false,\n    \n    typeAheadDelay : 250,\n    \n\n    \n    lazyInit : true,\n\n    \n    clearFilterOnReset : true,\n\n    \n    submitValue: undefined,\n\n    \n\n    \n    initComponent : function(){\n        Ext.form.ComboBox.superclass.initComponent.call(this);\n        this.addEvents(\n            \n            'expand',\n            \n            'collapse',\n\n            \n            'beforeselect',\n            \n            'select',\n            \n            'beforequery'\n        );\n        if(this.transform){\n            var s = Ext.getDom(this.transform);\n            if(!this.hiddenName){\n                this.hiddenName = s.name;\n            }\n            if(!this.store){\n                this.mode = 'local';\n                var d = [], opts = s.options;\n                for(var i = 0, len = opts.length;i < len; i++){\n                    var o = opts[i],\n                        value = (o.hasAttribute ? o.hasAttribute('value') : o.getAttributeNode('value').specified) ? o.value : o.text;\n                    if(o.selected && Ext.isEmpty(this.value, true)) {\n                        this.value = value;\n                    }\n                    d.push([value, o.text]);\n                }\n                this.store = new Ext.data.ArrayStore({\n                    idIndex: 0,\n                    fields: ['value', 'text'],\n                    data : d,\n                    autoDestroy: true\n                });\n                this.valueField = 'value';\n                this.displayField = 'text';\n            }\n            s.name = Ext.id(); \n            if(!this.lazyRender){\n                this.target = true;\n                this.el = Ext.DomHelper.insertBefore(s, this.autoCreate || this.defaultAutoCreate);\n                this.render(this.el.parentNode, s);\n            }\n            Ext.removeNode(s);\n        }\n        \n        else if(this.store){\n            this.store = Ext.StoreMgr.lookup(this.store);\n            if(this.store.autoCreated){\n                this.displayField = this.valueField = 'field1';\n                if(!this.store.expandData){\n                    this.displayField = 'field2';\n                }\n                this.mode = 'local';\n            }\n        }\n\n        this.selectedIndex = -1;\n        if(this.mode == 'local'){\n            if(!Ext.isDefined(this.initialConfig.queryDelay)){\n                this.queryDelay = 10;\n            }\n            if(!Ext.isDefined(this.initialConfig.minChars)){\n                this.minChars = 0;\n            }\n        }\n    },\n\n    \n    onRender : function(ct, position){\n        if(this.hiddenName && !Ext.isDefined(this.submitValue)){\n            this.submitValue = false;\n        }\n        Ext.form.ComboBox.superclass.onRender.call(this, ct, position);\n        if(this.hiddenName){\n            this.hiddenField = this.el.insertSibling({tag:'input', type:'hidden', name: this.hiddenName,\n                    id: (this.hiddenId || Ext.id())}, 'before', true);\n\n        }\n        if(Ext.isGecko){\n            this.el.dom.setAttribute('autocomplete', 'off');\n        }\n\n        if(!this.lazyInit){\n            this.initList();\n        }else{\n            this.on('focus', this.initList, this, {single: true});\n        }\n    },\n\n    \n    initValue : function(){\n        Ext.form.ComboBox.superclass.initValue.call(this);\n        if(this.hiddenField){\n            this.hiddenField.value =\n                Ext.value(Ext.isDefined(this.hiddenValue) ? this.hiddenValue : this.value, '');\n        }\n    },\n\n    getParentZIndex : function(){\n        var zindex;\n        if (this.ownerCt){\n            this.findParentBy(function(ct){\n                zindex = parseInt(ct.getPositionEl().getStyle('z-index'), 10);\n                return !!zindex;\n            });\n        }\n        return zindex;\n    },\n\n    getZIndex : function(listParent){\n        listParent = listParent || Ext.getDom(this.getListParent() || Ext.getBody());\n        var zindex = parseInt(Ext.fly(listParent).getStyle('z-index'), 10);\n        if(!zindex){\n            zindex = this.getParentZIndex();\n        }\n        return (zindex || 12000) + 5;\n    },\n\n    \n    initList : function(){\n        if(!this.list){\n            var cls = 'x-combo-list',\n                listParent = Ext.getDom(this.getListParent() || Ext.getBody());\n\n            this.list = new Ext.Layer({\n                parentEl: listParent,\n                shadow: this.shadow,\n                cls: [cls, this.listClass].join(' '),\n                constrain:false,\n                zindex: this.getZIndex(listParent)\n            });\n\n            var lw = this.listWidth || Math.max(this.wrap.getWidth(), this.minListWidth);\n            this.list.setSize(lw, 0);\n            this.list.swallowEvent('mousewheel');\n            this.assetHeight = 0;\n            if(this.syncFont !== false){\n                this.list.setStyle('font-size', this.el.getStyle('font-size'));\n            }\n            if(this.title){\n                this.header = this.list.createChild({cls:cls+'-hd', html: this.title});\n                this.assetHeight += this.header.getHeight();\n            }\n\n            this.innerList = this.list.createChild({cls:cls+'-inner'});\n            this.mon(this.innerList, 'mouseover', this.onViewOver, this);\n            this.mon(this.innerList, 'mousemove', this.onViewMove, this);\n            this.innerList.setWidth(lw - this.list.getFrameWidth('lr'));\n\n            if(this.pageSize){\n                this.footer = this.list.createChild({cls:cls+'-ft'});\n                this.pageTb = new Ext.PagingToolbar({\n                    store: this.store,\n                    pageSize: this.pageSize,\n                    renderTo:this.footer\n                });\n                this.assetHeight += this.footer.getHeight();\n            }\n\n            if(!this.tpl){\n                \n                this.tpl = '<tpl for=\".\"><div class=\"'+cls+'-item\">{' + this.displayField + '}</div></tpl>';\n                \n            }\n\n            \n            this.view = new Ext.DataView({\n                applyTo: this.innerList,\n                tpl: this.tpl,\n                singleSelect: true,\n                selectedClass: this.selectedClass,\n                itemSelector: this.itemSelector || '.' + cls + '-item',\n                emptyText: this.listEmptyText,\n                deferEmptyText: false\n            });\n\n            this.mon(this.view, {\n                containerclick : this.onViewClick,\n                click : this.onViewClick,\n                scope :this\n            });\n\n            this.bindStore(this.store, true);\n\n            if(this.resizable){\n                this.resizer = new Ext.Resizable(this.list,  {\n                   pinned:true, handles:'se'\n                });\n                this.mon(this.resizer, 'resize', function(r, w, h){\n                    this.maxHeight = h-this.handleHeight-this.list.getFrameWidth('tb')-this.assetHeight;\n                    this.listWidth = w;\n                    this.innerList.setWidth(w - this.list.getFrameWidth('lr'));\n                    this.restrictHeight();\n                }, this);\n\n                this[this.pageSize?'footer':'innerList'].setStyle('margin-bottom', this.handleHeight+'px');\n            }\n        }\n    },\n\n    \n    getListParent : function() {\n        return document.body;\n    },\n\n    \n    getStore : function(){\n        return this.store;\n    },\n\n    \n    bindStore : function(store, initial){\n        if(this.store && !initial){\n            if(this.store !== store && this.store.autoDestroy){\n                this.store.destroy();\n            }else{\n                this.store.un('beforeload', this.onBeforeLoad, this);\n                this.store.un('load', this.onLoad, this);\n                this.store.un('exception', this.collapse, this);\n            }\n            if(!store){\n                this.store = null;\n                if(this.view){\n                    this.view.bindStore(null);\n                }\n                if(this.pageTb){\n                    this.pageTb.bindStore(null);\n                }\n            }\n        }\n        if(store){\n            if(!initial) {\n                this.lastQuery = null;\n                if(this.pageTb) {\n                    this.pageTb.bindStore(store);\n                }\n            }\n\n            this.store = Ext.StoreMgr.lookup(store);\n            this.store.on({\n                scope: this,\n                beforeload: this.onBeforeLoad,\n                load: this.onLoad,\n                exception: this.collapse\n            });\n\n            if(this.view){\n                this.view.bindStore(store);\n            }\n        }\n    },\n\n    reset : function(){\n        if(this.clearFilterOnReset && this.mode == 'local'){\n            this.store.clearFilter();\n        }\n        Ext.form.ComboBox.superclass.reset.call(this);\n    },\n\n    \n    initEvents : function(){\n        Ext.form.ComboBox.superclass.initEvents.call(this);\n\n        \n        this.keyNav = new Ext.KeyNav(this.el, {\n            \"up\" : function(e){\n                this.inKeyMode = true;\n                this.selectPrev();\n            },\n\n            \"down\" : function(e){\n                if(!this.isExpanded()){\n                    this.onTriggerClick();\n                }else{\n                    this.inKeyMode = true;\n                    this.selectNext();\n                }\n            },\n\n            \"enter\" : function(e){\n                this.onViewClick();\n            },\n\n            \"esc\" : function(e){\n                this.collapse();\n            },\n\n            \"tab\" : function(e){\n                if (this.forceSelection === true) {\n                    this.collapse();\n                } else {\n                    this.onViewClick(false);\n                }\n                return true;\n            },\n\n            scope : this,\n\n            doRelay : function(e, h, hname){\n                if(hname == 'down' || this.scope.isExpanded()){\n                    \n                    var relay = Ext.KeyNav.prototype.doRelay.apply(this, arguments);\n                    if((((Ext.isIE9 && Ext.isStrict) || Ext.isIE10p) || !Ext.isIE) && Ext.EventManager.useKeydown){\n                        \n                        this.scope.fireKey(e);\n                    }\n                    return relay;\n                }\n                return true;\n            },\n\n            forceKeyDown : true,\n            defaultEventAction: 'stopEvent'\n        });\n        this.queryDelay = Math.max(this.queryDelay || 10,\n                this.mode == 'local' ? 10 : 250);\n        this.dqTask = new Ext.util.DelayedTask(this.initQuery, this);\n        if(this.typeAhead){\n            this.taTask = new Ext.util.DelayedTask(this.onTypeAhead, this);\n        }\n        if(!this.enableKeyEvents){\n            this.mon(this.el, 'keyup', this.onKeyUp, this);\n        }\n    },\n\n\n    \n    onDestroy : function(){\n        if (this.dqTask){\n            this.dqTask.cancel();\n            this.dqTask = null;\n        }\n        this.bindStore(null);\n        Ext.destroy(\n            this.resizer,\n            this.view,\n            this.pageTb,\n            this.list\n        );\n        Ext.destroyMembers(this, 'hiddenField');\n        Ext.form.ComboBox.superclass.onDestroy.call(this);\n    },\n\n    \n    fireKey : function(e){\n        if (!this.isExpanded()) {\n            Ext.form.ComboBox.superclass.fireKey.call(this, e);\n        }\n    },\n\n    \n    onResize : function(w, h){\n        Ext.form.ComboBox.superclass.onResize.apply(this, arguments);\n        if(!isNaN(w) && this.isVisible() && this.list){\n            this.doResize(w);\n        }else{\n            this.bufferSize = w;\n        }\n    },\n\n    doResize: function(w){\n        if(!Ext.isDefined(this.listWidth)){\n            var lw = Math.max(w, this.minListWidth);\n            this.list.setWidth(lw);\n            this.innerList.setWidth(lw - this.list.getFrameWidth('lr'));\n        }\n    },\n\n    \n    onEnable : function(){\n        Ext.form.ComboBox.superclass.onEnable.apply(this, arguments);\n        if(this.hiddenField){\n            this.hiddenField.disabled = false;\n        }\n    },\n\n    \n    onDisable : function(){\n        Ext.form.ComboBox.superclass.onDisable.apply(this, arguments);\n        if(this.hiddenField){\n            this.hiddenField.disabled = true;\n        }\n    },\n\n    \n    onBeforeLoad : function(){\n        if(!this.hasFocus){\n            return;\n        }\n        this.innerList.update(this.loadingText ?\n               '<div class=\"loading-indicator\">'+this.loadingText+'</div>' : '');\n        this.restrictHeight();\n        this.selectedIndex = -1;\n    },\n\n    \n    onLoad : function(){\n        if(!this.hasFocus){\n            return;\n        }\n        if(this.store.getCount() > 0 || this.listEmptyText){\n            this.expand();\n            this.restrictHeight();\n            if(this.lastQuery == this.allQuery){\n                if(this.editable){\n                    this.el.dom.select();\n                }\n\n                if(this.autoSelect !== false && !this.selectByValue(this.value, true)){\n                    this.select(0, true);\n                }\n            }else{\n                if(this.autoSelect !== false){\n                    this.selectNext();\n                }\n                if(this.typeAhead && this.lastKey != Ext.EventObject.BACKSPACE && this.lastKey != Ext.EventObject.DELETE){\n                    this.taTask.delay(this.typeAheadDelay);\n                }\n            }\n        }else{\n            this.collapse();\n        }\n\n    },\n\n    \n    onTypeAhead : function(){\n        if(this.store.getCount() > 0){\n            var r = this.store.getAt(0);\n            var newValue = r.data[this.displayField];\n            var len = newValue.length;\n            var selStart = this.getRawValue().length;\n            if(selStart != len){\n                this.setRawValue(newValue);\n                this.selectText(selStart, newValue.length);\n            }\n        }\n    },\n\n    \n    assertValue : function(){\n        var val = this.getRawValue(),\n            rec;\n\n        if(this.valueField && Ext.isDefined(this.value)){\n            rec = this.findRecord(this.valueField, this.value);\n        }\n        if(!rec || rec.get(this.displayField) != val){\n            rec = this.findRecord(this.displayField, val);\n        }\n        if(!rec && this.forceSelection){\n            if(val.length > 0 && val != this.emptyText){\n                this.el.dom.value = Ext.value(this.lastSelectionText, '');\n                this.applyEmptyText();\n            }else{\n                this.clearValue();\n            }\n        }else{\n            if(rec && this.valueField){\n                \n                \n                \n                if (this.value == val){\n                    return;\n                }\n                val = rec.get(this.valueField || this.displayField);\n            }\n            this.setValue(val);\n        }\n    },\n\n    \n    onSelect : function(record, index){\n        if(this.fireEvent('beforeselect', this, record, index) !== false){\n            this.setValue(record.data[this.valueField || this.displayField]);\n            this.collapse();\n            this.fireEvent('select', this, record, index);\n        }\n    },\n\n    \n    getName: function(){\n        var hf = this.hiddenField;\n        return hf && hf.name ? hf.name : this.hiddenName || Ext.form.ComboBox.superclass.getName.call(this);\n    },\n\n    \n    getValue : function(){\n        if(this.valueField){\n            return Ext.isDefined(this.value) ? this.value : '';\n        }else{\n            return Ext.form.ComboBox.superclass.getValue.call(this);\n        }\n    },\n\n    \n    clearValue : function(){\n        if(this.hiddenField){\n            this.hiddenField.value = '';\n        }\n        this.setRawValue('');\n        this.lastSelectionText = '';\n        this.applyEmptyText();\n        this.value = '';\n    },\n\n    \n    setValue : function(v){\n        var text = v;\n        if(this.valueField){\n            var r = this.findRecord(this.valueField, v);\n            if(r){\n                text = r.data[this.displayField];\n            }else if(Ext.isDefined(this.valueNotFoundText)){\n                text = this.valueNotFoundText;\n            }\n        }\n        this.lastSelectionText = text;\n        if(this.hiddenField){\n            this.hiddenField.value = Ext.value(v, '');\n        }\n        Ext.form.ComboBox.superclass.setValue.call(this, text);\n        this.value = v;\n        return this;\n    },\n\n    \n    findRecord : function(prop, value){\n        var record;\n        if(this.store.getCount() > 0){\n            this.store.each(function(r){\n                if(r.data[prop] == value){\n                    record = r;\n                    return false;\n                }\n            });\n        }\n        return record;\n    },\n\n    \n    onViewMove : function(e, t){\n        this.inKeyMode = false;\n    },\n\n    \n    onViewOver : function(e, t){\n        if(this.inKeyMode){ \n            return;\n        }\n        var item = this.view.findItemFromChild(t);\n        if(item){\n            var index = this.view.indexOf(item);\n            this.select(index, false);\n        }\n    },\n\n    \n    onViewClick : function(doFocus){\n        var index = this.view.getSelectedIndexes()[0],\n            s = this.store,\n            r = s.getAt(index);\n        if(r){\n            this.onSelect(r, index);\n        }else {\n            this.collapse();\n        }\n        if(doFocus !== false){\n            this.el.focus();\n        }\n    },\n\n\n    \n    restrictHeight : function(){\n        this.innerList.dom.style.height = '';\n        var inner = this.innerList.dom,\n            pad = this.list.getFrameWidth('tb') + (this.resizable ? this.handleHeight : 0) + this.assetHeight,\n            h = Math.max(inner.clientHeight, inner.offsetHeight, inner.scrollHeight),\n            ha = this.getPosition()[1]-Ext.getBody().getScroll().top,\n            hb = Ext.lib.Dom.getViewHeight()-ha-this.getSize().height,\n            space = Math.max(ha, hb, this.minHeight || 0)-this.list.shadowOffset-pad-5;\n\n        h = Math.min(h, space, this.maxHeight);\n\n        this.innerList.setHeight(h);\n        this.list.beginUpdate();\n        this.list.setHeight(h+pad);\n        this.list.alignTo.apply(this.list, [this.el].concat(this.listAlign));\n        this.list.endUpdate();\n    },\n\n    \n    isExpanded : function(){\n        return this.list && this.list.isVisible();\n    },\n\n    \n    selectByValue : function(v, scrollIntoView){\n        if(!Ext.isEmpty(v, true)){\n            var r = this.findRecord(this.valueField || this.displayField, v);\n            if(r){\n                this.select(this.store.indexOf(r), scrollIntoView);\n                return true;\n            }\n        }\n        return false;\n    },\n\n    \n    select : function(index, scrollIntoView){\n        this.selectedIndex = index;\n        this.view.select(index);\n        if(scrollIntoView !== false){\n            var el = this.view.getNode(index);\n            if(el){\n                this.innerList.scrollChildIntoView(el, false);\n            }\n        }\n\n    },\n\n    \n    selectNext : function(){\n        var ct = this.store.getCount();\n        if(ct > 0){\n            if(this.selectedIndex == -1){\n                this.select(0);\n            }else if(this.selectedIndex < ct-1){\n                this.select(this.selectedIndex+1);\n            }\n        }\n    },\n\n    \n    selectPrev : function(){\n        var ct = this.store.getCount();\n        if(ct > 0){\n            if(this.selectedIndex == -1){\n                this.select(0);\n            }else if(this.selectedIndex !== 0){\n                this.select(this.selectedIndex-1);\n            }\n        }\n    },\n\n    \n    onKeyUp : function(e){\n        var k = e.getKey();\n        if(this.editable !== false && this.readOnly !== true && (k == e.BACKSPACE || !e.isSpecialKey())){\n\n            this.lastKey = k;\n            this.dqTask.delay(this.queryDelay);\n        }\n        Ext.form.ComboBox.superclass.onKeyUp.call(this, e);\n    },\n\n    \n    validateBlur : function(){\n        return !this.list || !this.list.isVisible();\n    },\n\n    \n    initQuery : function(){\n        this.doQuery(this.getRawValue());\n    },\n\n    \n    beforeBlur : function(){\n        this.assertValue();\n    },\n\n    \n    postBlur  : function(){\n        Ext.form.ComboBox.superclass.postBlur.call(this);\n        this.collapse();\n        this.inKeyMode = false;\n    },\n\n    \n    doQuery : function(q, forceAll){\n        q = Ext.isEmpty(q) ? '' : q;\n        var qe = {\n            query: q,\n            forceAll: forceAll,\n            combo: this,\n            cancel:false\n        };\n        if(this.fireEvent('beforequery', qe)===false || qe.cancel){\n            return false;\n        }\n        q = qe.query;\n        forceAll = qe.forceAll;\n        if(forceAll === true || (q.length >= this.minChars)){\n            if(this.lastQuery !== q){\n                this.lastQuery = q;\n                if(this.mode == 'local'){\n                    this.selectedIndex = -1;\n                    if(forceAll){\n                        this.store.clearFilter();\n                    }else{\n                        this.store.filter(this.displayField, q);\n                    }\n                    this.onLoad();\n                }else{\n                    this.store.baseParams[this.queryParam] = q;\n                    this.store.load({\n                        params: this.getParams(q)\n                    });\n                    this.expand();\n                }\n            }else{\n                this.selectedIndex = -1;\n                this.onLoad();\n            }\n        }\n    },\n\n    \n    getParams : function(q){\n        var params = {},\n            paramNames = this.store.paramNames;\n        if(this.pageSize){\n            params[paramNames.start] = 0;\n            params[paramNames.limit] = this.pageSize;\n        }\n        return params;\n    },\n\n    \n    collapse : function(){\n        if(!this.isExpanded()){\n            return;\n        }\n        this.list.hide();\n        Ext.getDoc().un('mousewheel', this.collapseIf, this);\n        Ext.getDoc().un('mousedown', this.collapseIf, this);\n        this.fireEvent('collapse', this);\n    },\n\n    \n    collapseIf : function(e){\n        if(!this.isDestroyed && !e.within(this.wrap) && !e.within(this.list)){\n            this.collapse();\n        }\n    },\n\n    \n    expand : function(){\n        if(this.isExpanded() || !this.hasFocus){\n            return;\n        }\n\n        if(this.title || this.pageSize){\n            this.assetHeight = 0;\n            if(this.title){\n                this.assetHeight += this.header.getHeight();\n            }\n            if(this.pageSize){\n                this.assetHeight += this.footer.getHeight();\n            }\n        }\n\n        if(this.bufferSize){\n            this.doResize(this.bufferSize);\n            delete this.bufferSize;\n        }\n        this.list.alignTo.apply(this.list, [this.el].concat(this.listAlign));\n\n        \n        this.list.setZIndex(this.getZIndex());\n        this.list.show();\n        if(Ext.isGecko2){\n            this.innerList.setOverflow('auto'); \n        }\n        this.mon(Ext.getDoc(), {\n            scope: this,\n            mousewheel: this.collapseIf,\n            mousedown: this.collapseIf\n        });\n        this.fireEvent('expand', this);\n    },\n\n    \n    \n    \n    onTriggerClick : function(){\n        if(this.readOnly || this.disabled){\n            return;\n        }\n        if(this.isExpanded()){\n            this.collapse();\n            this.el.focus();\n        }else {\n            this.onFocus({});\n            if(this.triggerAction == 'all') {\n                this.doQuery(this.allQuery, true);\n            } else {\n                this.doQuery(this.getRawValue());\n            }\n            this.el.focus();\n        }\n    }\n\n    \n    \n    \n    \n\n});\nExt.reg('combo', Ext.form.ComboBox);\n\nExt.form.Checkbox = Ext.extend(Ext.form.Field,  {\n    \n    focusClass : undefined,\n    \n    fieldClass : 'x-form-field',\n    \n    checked : false,\n    \n    boxLabel: '&#160;',\n    \n    defaultAutoCreate : { tag: 'input', type: 'checkbox', autocomplete: 'off'},\n    \n    \n    \n\n    \n    actionMode : 'wrap',\n\n\t\n    initComponent : function(){\n        Ext.form.Checkbox.superclass.initComponent.call(this);\n        this.addEvents(\n            \n            'check'\n        );\n    },\n\n    \n    onResize : function(){\n        Ext.form.Checkbox.superclass.onResize.apply(this, arguments);\n        if(!this.boxLabel && !this.fieldLabel){\n            this.el.alignTo(this.wrap, 'c-c');\n        }\n    },\n\n    \n    initEvents : function(){\n        Ext.form.Checkbox.superclass.initEvents.call(this);\n        this.mon(this.el, {\n            scope: this,\n            click: this.onClick,\n            change: this.onClick\n        });\n    },\n\n    \n    markInvalid : Ext.emptyFn,\n    \n    clearInvalid : Ext.emptyFn,\n\n    \n    onRender : function(ct, position){\n        Ext.form.Checkbox.superclass.onRender.call(this, ct, position);\n        if(this.inputValue !== undefined){\n            this.el.dom.value = this.inputValue;\n        }\n        this.wrap = this.el.wrap({cls: 'x-form-check-wrap'});\n        if(this.boxLabel){\n            this.wrap.createChild({tag: 'label', htmlFor: this.el.id, cls: 'x-form-cb-label', html: this.boxLabel});\n        }\n        if(this.checked){\n            this.setValue(true);\n        }else{\n            this.checked = this.el.dom.checked;\n        }\n        \n        if (Ext.isIEQuirks) {\n            this.wrap.repaint();\n        }\n        this.resizeEl = this.positionEl = this.wrap;\n    },\n\n    \n    onDestroy : function(){\n        Ext.destroy(this.wrap);\n        Ext.form.Checkbox.superclass.onDestroy.call(this);\n    },\n\n    \n    initValue : function() {\n        this.originalValue = this.getValue();\n    },\n\n    \n    getValue : function(){\n        if(this.rendered){\n            return this.el.dom.checked;\n        }\n        return this.checked;\n    },\n\n\t\n    onClick : function(){\n        if(this.el.dom.checked != this.checked){\n            this.setValue(this.el.dom.checked);\n        }\n    },\n\n    \n    setValue : function(v){\n        var checked = this.checked,\n            inputVal = this.inputValue;\n            \n        if (v === false) {\n            this.checked = false;\n        } else {\n            this.checked = (v === true || v === 'true' || v == '1' || (inputVal ? v == inputVal : String(v).toLowerCase() == 'on'));\n        }\n        \n        if(this.rendered){\n            this.el.dom.checked = this.checked;\n            this.el.dom.defaultChecked = this.checked;\n        }\n        if(checked != this.checked){\n            this.fireEvent('check', this, this.checked);\n            if(this.handler){\n                this.handler.call(this.scope || this, this, this.checked);\n            }\n        }\n        return this;\n    }\n});\nExt.reg('checkbox', Ext.form.Checkbox);\n\nExt.form.CheckboxGroup = Ext.extend(Ext.form.Field, {\n    \n    \n    columns : 'auto',\n    \n    vertical : false,\n    \n    allowBlank : true,\n    \n    blankText : \"You must select at least one item in this group\",\n\n    \n    defaultType : 'checkbox',\n\n    \n    groupCls : 'x-form-check-group',\n\n    \n    initComponent: function(){\n        this.addEvents(\n            \n            'change'\n        );\n        this.on('change', this.validate, this);\n        Ext.form.CheckboxGroup.superclass.initComponent.call(this);\n    },\n\n    \n    onRender : function(ct, position){\n        if(!this.el){\n            var panelCfg = {\n                autoEl: {\n                    id: this.id\n                },\n                cls: this.groupCls,\n                layout: 'column',\n                renderTo: ct,\n                bufferResize: false \n            };\n            var colCfg = {\n                xtype: 'container',\n                defaultType: this.defaultType,\n                layout: 'form',\n                defaults: {\n                    hideLabel: true,\n                    anchor: '100%'\n                }\n            };\n\n            if(this.items[0].items){\n\n                \n\n                Ext.apply(panelCfg, {\n                    layoutConfig: {columns: this.items.length},\n                    defaults: this.defaults,\n                    items: this.items\n                });\n                for(var i=0, len=this.items.length; i<len; i++){\n                    Ext.applyIf(this.items[i], colCfg);\n                }\n\n            }else{\n\n                \n                \n\n                var numCols, cols = [];\n\n                if(typeof this.columns == 'string'){ \n                    this.columns = this.items.length;\n                }\n                if(!Ext.isArray(this.columns)){\n                    var cs = [];\n                    for(var i=0; i<this.columns; i++){\n                        cs.push((100/this.columns)*.01); \n                    }\n                    this.columns = cs;\n                }\n\n                numCols = this.columns.length;\n\n                \n                for(var i=0; i<numCols; i++){\n                    var cc = Ext.apply({items:[]}, colCfg);\n                    cc[this.columns[i] <= 1 ? 'columnWidth' : 'width'] = this.columns[i];\n                    if(this.defaults){\n                        cc.defaults = Ext.apply(cc.defaults || {}, this.defaults);\n                    }\n                    cols.push(cc);\n                };\n\n                \n                if(this.vertical){\n                    var rows = Math.ceil(this.items.length / numCols), ri = 0;\n                    for(var i=0, len=this.items.length; i<len; i++){\n                        if(i>0 && i%rows==0){\n                            ri++;\n                        }\n                        if(this.items[i].fieldLabel){\n                            this.items[i].hideLabel = false;\n                        }\n                        cols[ri].items.push(this.items[i]);\n                    };\n                }else{\n                    for(var i=0, len=this.items.length; i<len; i++){\n                        var ci = i % numCols;\n                        if(this.items[i].fieldLabel){\n                            this.items[i].hideLabel = false;\n                        }\n                        cols[ci].items.push(this.items[i]);\n                    };\n                }\n\n                Ext.apply(panelCfg, {\n                    layoutConfig: {columns: numCols},\n                    items: cols\n                });\n            }\n\n            this.panel = new Ext.Container(panelCfg);\n            this.panel.ownerCt = this;\n            this.el = this.panel.getEl();\n\n            if(this.forId && this.itemCls){\n                var l = this.el.up(this.itemCls).child('label', true);\n                if(l){\n                    l.setAttribute('htmlFor', this.forId);\n                }\n            }\n\n            var fields = this.panel.findBy(function(c){\n                return c.isFormField;\n            }, this);\n\n            this.items = new Ext.util.MixedCollection();\n            this.items.addAll(fields);\n        }\n        Ext.form.CheckboxGroup.superclass.onRender.call(this, ct, position);\n    },\n\n    initValue : function(){\n        if(this.value){\n            this.setValue.apply(this, this.buffered ? this.value : [this.value]);\n            delete this.buffered;\n            delete this.value;\n        }\n    },\n\n    afterRender : function(){\n        Ext.form.CheckboxGroup.superclass.afterRender.call(this);\n        this.eachItem(function(item){\n            item.on('check', this.fireChecked, this);\n            item.inGroup = true;\n        });\n    },\n\n    \n    doLayout: function(){\n        \n        if(this.rendered){\n            this.panel.forceLayout = this.ownerCt.forceLayout;\n            this.panel.doLayout();\n        }\n    },\n\n    \n    fireChecked: function(){\n        var arr = [];\n        this.eachItem(function(item){\n            if(item.checked){\n                arr.push(item);\n            }\n        });\n        this.fireEvent('change', this, arr);\n    },\n    \n    \n    getErrors: function() {\n        var errors = Ext.form.CheckboxGroup.superclass.getErrors.apply(this, arguments);\n        \n        if (!this.allowBlank) {\n            var blank = true;\n            \n            this.eachItem(function(f){\n                if (f.checked) {\n                    return (blank = false);\n                }\n            });\n            \n            if (blank) errors.push(this.blankText);\n        }\n        \n        return errors;\n    },\n\n    \n    isDirty: function(){\n        \n        if (this.disabled || !this.rendered) {\n            return false;\n        }\n\n        var dirty = false;\n        \n        this.eachItem(function(item){\n            if(item.isDirty()){\n                dirty = true;\n                return false;\n            }\n        });\n        \n        return dirty;\n    },\n\n    \n    setReadOnly : function(readOnly){\n        if(this.rendered){\n            this.eachItem(function(item){\n                item.setReadOnly(readOnly);\n            });\n        }\n        this.readOnly = readOnly;\n    },\n\n    \n    onDisable : function(){\n        this.eachItem(function(item){\n            item.disable();\n        });\n    },\n\n    \n    onEnable : function(){\n        this.eachItem(function(item){\n            item.enable();\n        });\n    },\n\n    \n    onResize : function(w, h){\n        this.panel.setSize(w, h);\n        this.panel.doLayout();\n    },\n\n    \n    reset : function(){\n        if (this.originalValue) {\n            \n            this.eachItem(function(c){\n                if(c.setValue){\n                    c.setValue(false);\n                    c.originalValue = c.getValue();\n                }\n            });\n            \n            \n            this.resetOriginal = true;\n            this.setValue(this.originalValue);\n            delete this.resetOriginal;\n        } else {\n            this.eachItem(function(c){\n                if(c.reset){\n                    c.reset();\n                }\n            });\n        }\n        \n        \n        (function() {\n            this.clearInvalid();\n        }).defer(50, this);\n    },\n\n    \n    setValue: function(){\n        if(this.rendered){\n            this.onSetValue.apply(this, arguments);\n        }else{\n            this.buffered = true;\n            this.value = arguments;\n        }\n        return this;\n    },\n\n    \n    onSetValue: function(id, value){\n        if(arguments.length == 1){\n            if(Ext.isArray(id)){\n                Ext.each(id, function(val, idx){\n                    if (Ext.isObject(val) && val.setValue){ \n                        val.setValue(true);\n                        if (this.resetOriginal === true) {\n                            val.originalValue = val.getValue();\n                        }\n                    } else { \n                        var item = this.items.itemAt(idx);\n                        if(item){\n                            item.setValue(val);\n                        }\n                    }\n                }, this);\n            }else if(Ext.isObject(id)){\n                \n                for(var i in id){\n                    var f = this.getBox(i);\n                    if(f){\n                        f.setValue(id[i]);\n                    }\n                }\n            }else{\n                this.setValueForItem(id);\n            }\n        }else{\n            var f = this.getBox(id);\n            if(f){\n                f.setValue(value);\n            }\n        }\n    },\n\n    \n    beforeDestroy: function(){\n        Ext.destroy(this.panel);\n        if (!this.rendered) {\n            Ext.destroy(this.items);\n        }\n        Ext.form.CheckboxGroup.superclass.beforeDestroy.call(this);\n\n    },\n\n    setValueForItem : function(val){\n        val = String(val).split(',');\n        this.eachItem(function(item){\n            if(val.indexOf(item.inputValue)> -1){\n                item.setValue(true);\n            }\n        });\n    },\n\n    \n    getBox : function(id){\n        var box = null;\n        this.eachItem(function(f){\n            if(id == f || f.dataIndex == id || f.id == id || f.getName() == id){\n                box = f;\n                return false;\n            }\n        });\n        return box;\n    },\n\n    \n    getValue : function(){\n        var out = [];\n        this.eachItem(function(item){\n            if(item.checked){\n                out.push(item);\n            }\n        });\n        return out;\n    },\n\n    \n    eachItem: function(fn, scope) {\n        if(this.items && this.items.each){\n            this.items.each(fn, scope || this);\n        }\n    },\n\n    \n\n    \n    getRawValue : Ext.emptyFn,\n\n    \n    setRawValue : Ext.emptyFn\n\n});\n\nExt.reg('checkboxgroup', Ext.form.CheckboxGroup);\n\nExt.form.CompositeField = Ext.extend(Ext.form.Field, {\n\n    \n    defaultMargins: '0 5 0 0',\n\n    \n    skipLastItemMargin: true,\n\n    \n    isComposite: true,\n\n    \n    combineErrors: true,\n    \n    \n    labelConnector: ', ',\n    \n    \n\n    \n    \n    initComponent: function() {\n        var labels = [],\n            items  = this.items,\n            item;\n\n        for (var i=0, j = items.length; i < j; i++) {\n            item = items[i];\n            \n            if (!Ext.isEmpty(item.ref)){\n                item.ref = '../' + item.ref;\n            }\n\n            labels.push(item.fieldLabel);\n\n            \n            Ext.applyIf(item, this.defaults);\n\n            \n            if (!(i == j - 1 && this.skipLastItemMargin)) {\n                Ext.applyIf(item, {margins: this.defaultMargins});\n            }\n        }\n\n        this.fieldLabel = this.fieldLabel || this.buildLabel(labels);\n\n        \n        this.fieldErrors = new Ext.util.MixedCollection(true, function(item) {\n            return item.field;\n        });\n\n        this.fieldErrors.on({\n            scope  : this,\n            add    : this.updateInvalidMark,\n            remove : this.updateInvalidMark,\n            replace: this.updateInvalidMark\n        });\n\n        Ext.form.CompositeField.superclass.initComponent.apply(this, arguments);\n        \n        this.innerCt = new Ext.Container({\n            layout  : 'hbox',\n            items   : this.items,\n            cls     : 'x-form-composite',\n            defaultMargins: '0 3 0 0',\n            ownerCt: this\n        });\n        delete this.innerCt.ownerCt;\n\n        var fields = this.innerCt.findBy(function(c) {\n            return c.isFormField;\n        }, this);\n\n        \n        this.items = new Ext.util.MixedCollection();\n        this.items.addAll(fields);\n        \n    },\n\n    \n    onRender: function(ct, position) {\n        if (!this.el) {\n            \n            var innerCt = this.innerCt;\n            innerCt.render(ct);\n            this.innerCt.ownerCt = this;\n\n            this.el = innerCt.getEl();\n\n            \n            \n            if (this.combineErrors) {\n                this.eachItem(function(field) {\n                    Ext.apply(field, {\n                        markInvalid : this.onFieldMarkInvalid.createDelegate(this, [field], 0),\n                        clearInvalid: this.onFieldClearInvalid.createDelegate(this, [field], 0)\n                    });\n                });\n            }\n\n            \n            var l = this.el.parent().parent().child('label', true);\n            if (l) {\n                l.setAttribute('for', this.items.items[0].id);\n            }\n        }\n\n        Ext.form.CompositeField.superclass.onRender.apply(this, arguments);\n    },\n\n    \n    onFieldMarkInvalid: function(field, message) {\n        var name  = field.getName(),\n            error = {\n                field: name, \n                errorName: field.fieldLabel || name,\n                error: message\n            };\n\n        this.fieldErrors.replace(name, error);\n\n        if (!field.preventMark) {\n            field.el.addClass(field.invalidClass);\n        }\n    },\n\n    \n    onFieldClearInvalid: function(field) {\n        this.fieldErrors.removeKey(field.getName());\n\n        field.el.removeClass(field.invalidClass);\n    },\n\n    \n    updateInvalidMark: function() {\n        var ieStrict = Ext.isIE6 && Ext.isStrict;\n\n        if (this.fieldErrors.length == 0) {\n            this.clearInvalid();\n\n            \n            if (ieStrict) {\n                this.clearInvalid.defer(50, this);\n            }\n        } else {\n            var message = this.buildCombinedErrorMessage(this.fieldErrors.items);\n\n            this.sortErrors();\n            this.markInvalid(message);\n\n            \n            if (ieStrict) {\n                this.markInvalid(message);\n            }\n        }\n    },\n\n    \n    validateValue: function(value, preventMark) {\n        var valid = true;\n\n        this.eachItem(function(field) {\n            if (!field.isValid(preventMark)) {\n                valid = false;\n            }\n        });\n\n        return valid;\n    },\n\n    \n    buildCombinedErrorMessage: function(errors) {\n        var combined = [],\n            error;\n\n        for (var i = 0, j = errors.length; i < j; i++) {\n            error = errors[i];\n\n            combined.push(String.format(\"{0}: {1}\", error.errorName, error.error));\n        }\n\n        return combined.join(\"<br />\");\n    },\n\n    \n    sortErrors: function() {\n        var fields = this.items;\n\n        this.fieldErrors.sort(\"ASC\", function(a, b) {\n            var findByName = function(key) {\n                return function(field) {\n                    return field.getName() == key;\n                };\n            };\n\n            var aIndex = fields.findIndexBy(findByName(a.field)),\n                bIndex = fields.findIndexBy(findByName(b.field));\n\n            return aIndex < bIndex ? -1 : 1;\n        });\n    },\n\n    \n    reset: function() {\n        this.eachItem(function(item) {\n            item.reset();\n        });\n\n        \n        \n        (function() {\n            this.clearInvalid();\n        }).defer(50, this);\n    },\n    \n    \n    clearInvalidChildren: function() {\n        this.eachItem(function(item) {\n            item.clearInvalid();\n        });\n    },\n\n    \n    buildLabel: function(segments) {\n        return Ext.clean(segments).join(this.labelConnector);\n    },\n\n    \n    isDirty: function(){\n        \n        if (this.disabled || !this.rendered) {\n            return false;\n        }\n\n        var dirty = false;\n        this.eachItem(function(item){\n            if(item.isDirty()){\n                dirty = true;\n                return false;\n            }\n        });\n        return dirty;\n    },\n\n    \n    eachItem: function(fn, scope) {\n        if(this.items && this.items.each){\n            this.items.each(fn, scope || this);\n        }\n    },\n\n    \n    onResize: function(adjWidth, adjHeight, rawWidth, rawHeight) {\n        var innerCt = this.innerCt;\n\n        if (this.rendered && innerCt.rendered) {\n            innerCt.setSize(adjWidth, adjHeight);\n        }\n\n        Ext.form.CompositeField.superclass.onResize.apply(this, arguments);\n    },\n\n    \n    doLayout: function(shallow, force) {\n        if (this.rendered) {\n            var innerCt = this.innerCt;\n\n            innerCt.forceLayout = this.ownerCt.forceLayout;\n            innerCt.doLayout(shallow, force);\n        }\n    },\n\n    \n    beforeDestroy: function(){\n        Ext.destroy(this.innerCt);\n\n        Ext.form.CompositeField.superclass.beforeDestroy.call(this);\n    },\n\n    \n    setReadOnly : function(readOnly) {\n        if (readOnly == undefined) {\n            readOnly = true;\n        }\n        readOnly = !!readOnly;\n\n        if(this.rendered){\n            this.eachItem(function(item){\n                item.setReadOnly(readOnly);\n            });\n        }\n        this.readOnly = readOnly;\n    },\n\n    onShow : function() {\n        Ext.form.CompositeField.superclass.onShow.call(this);\n        this.doLayout();\n    },\n\n    \n    onDisable : function(){\n        this.eachItem(function(item){\n            item.disable();\n        });\n    },\n\n    \n    onEnable : function(){\n        this.eachItem(function(item){\n            item.enable();\n        });\n    }\n});\n\nExt.reg('compositefield', Ext.form.CompositeField);\nExt.form.Radio = Ext.extend(Ext.form.Checkbox, {\n    inputType: 'radio',\n\n    \n    markInvalid : Ext.emptyFn,\n    \n    clearInvalid : Ext.emptyFn,\n\n    \n    getGroupValue : function(){\n    \tvar p = this.el.up('form') || Ext.getBody();\n        var c = p.child('input[name=\"'+this.el.dom.name+'\"]:checked', true);\n        return c ? c.value : null;\n    },\n\n    \n    setValue : function(v){\n    \tvar checkEl,\n            els,\n            radio;\n    \tif (typeof v == 'boolean') {\n            Ext.form.Radio.superclass.setValue.call(this, v);\n        } else if (this.rendered) {\n            checkEl = this.getCheckEl();\n            radio = checkEl.child('input[name=\"' + this.el.dom.name + '\"][value=\"' + v + '\"]', true);\n            if(radio){\n                Ext.getCmp(radio.id).setValue(true);\n            }\n        }\n        if(this.rendered && this.checked){\n            checkEl = checkEl || this.getCheckEl();\n            els = this.getCheckEl().select('input[name=\"' + this.el.dom.name + '\"]');\n\t\t\tels.each(function(el){\n\t\t\t\tif(el.dom.id != this.id){\n\t\t\t\t\tExt.getCmp(el.dom.id).setValue(false);\n\t\t\t\t}\n\t\t\t}, this);\n        }\n        return this;\n    },\n\n    \n    getCheckEl: function(){\n        if(this.inGroup){\n            return this.el.up('.x-form-radio-group');\n        }\n        return this.el.up('form') || Ext.getBody();\n    }\n});\nExt.reg('radio', Ext.form.Radio);\n\nExt.form.RadioGroup = Ext.extend(Ext.form.CheckboxGroup, {\n    \n    \n    allowBlank : true,\n    \n    blankText : 'You must select one item in this group',\n    \n    \n    defaultType : 'radio',\n    \n    \n    groupCls : 'x-form-radio-group',\n    \n    \n    \n    \n    getValue : function(){\n        var out = null;\n        this.eachItem(function(item){\n            if(item.checked){\n                out = item;\n                return false;\n            }\n        });\n        return out;\n    },\n    \n    \n    onSetValue : function(id, value){\n        if(arguments.length > 1){\n            var f = this.getBox(id);\n            if(f){\n                f.setValue(value);\n                if(f.checked){\n                    this.eachItem(function(item){\n                        if (item !== f){\n                            item.setValue(false);\n                        }\n                    });\n                }\n            }\n        }else{\n            this.setValueForItem(id);\n        }\n    },\n    \n    setValueForItem : function(val){\n        val = String(val).split(',')[0];\n        this.eachItem(function(item){\n            item.setValue(val == item.inputValue);\n        });\n    },\n    \n    \n    fireChecked : function(){\n        if(!this.checkTask){\n            this.checkTask = new Ext.util.DelayedTask(this.bufferChecked, this);\n        }\n        this.checkTask.delay(10);\n    },\n    \n    \n    bufferChecked : function(){\n        var out = null;\n        this.eachItem(function(item){\n            if(item.checked){\n                out = item;\n                return false;\n            }\n        });\n        this.fireEvent('change', this, out);\n    },\n    \n    onDestroy : function(){\n        if(this.checkTask){\n            this.checkTask.cancel();\n            this.checkTask = null;\n        }\n        Ext.form.RadioGroup.superclass.onDestroy.call(this);\n    }\n\n});\n\nExt.reg('radiogroup', Ext.form.RadioGroup);\n\nExt.form.Hidden = Ext.extend(Ext.form.Field, {\n    \n    inputType : 'hidden',\n    \n    shouldLayout: false,\n\n    \n    onRender : function(){\n        Ext.form.Hidden.superclass.onRender.apply(this, arguments);\n    },\n\n    \n    initEvents : function(){\n        this.originalValue = this.getValue();\n    },\n\n    \n    setSize : Ext.emptyFn,\n    setWidth : Ext.emptyFn,\n    setHeight : Ext.emptyFn,\n    setPosition : Ext.emptyFn,\n    setPagePosition : Ext.emptyFn,\n    markInvalid : Ext.emptyFn,\n    clearInvalid : Ext.emptyFn\n});\nExt.reg('hidden', Ext.form.Hidden);\nExt.form.BasicForm = Ext.extend(Ext.util.Observable, {\n\n    constructor: function(el, config){\n        Ext.apply(this, config);\n        if(Ext.isString(this.paramOrder)){\n            this.paramOrder = this.paramOrder.split(/[\\s,|]/);\n        }\n        \n        this.items = new Ext.util.MixedCollection(false, function(o){\n            return o.getItemId();\n        });\n        this.addEvents(\n            \n            'beforeaction',\n            \n            'actionfailed',\n            \n            'actioncomplete'\n        );\n\n        if(el){\n            this.initEl(el);\n        }\n        Ext.form.BasicForm.superclass.constructor.call(this);\n    },\n\n    \n    \n    \n    \n    \n    \n    \n    timeout: 30,\n\n    \n\n    \n    paramOrder: undefined,\n\n    \n    paramsAsHash: false,\n\n    \n    waitTitle: 'Please Wait...',\n\n    \n    activeAction : null,\n\n    \n    trackResetOnLoad : false,\n\n    \n    \n\n    \n    initEl : function(el){\n        this.el = Ext.get(el);\n        this.id = this.el.id || Ext.id();\n        if(!this.standardSubmit){\n            this.el.on('submit', this.onSubmit, this);\n        }\n        this.el.addClass('x-form');\n    },\n\n    \n    getEl: function(){\n        return this.el;\n    },\n\n    \n    onSubmit : function(e){\n        e.stopEvent();\n    },\n\n    \n    destroy: function(bound){\n        if(bound !== true){\n            this.items.each(function(f){\n                Ext.destroy(f);\n            });\n            Ext.destroy(this.el);\n        }\n        this.items.clear();\n        this.purgeListeners();\n    },\n\n    \n    isValid : function(){\n        var valid = true;\n        this.items.each(function(f){\n           if(!f.validate()){\n               valid = false;\n           }\n        });\n        return valid;\n    },\n\n    \n    isDirty : function(){\n        var dirty = false;\n        this.items.each(function(f){\n           if(f.isDirty()){\n               dirty = true;\n               return false;\n           }\n        });\n        return dirty;\n    },\n\n    \n    doAction : function(action, options){\n        if(Ext.isString(action)){\n            action = new Ext.form.Action.ACTION_TYPES[action](this, options);\n        }\n        if(this.fireEvent('beforeaction', this, action) !== false){\n            this.beforeAction(action);\n            action.run.defer(100, action);\n        }\n        return this;\n    },\n\n    \n    submit : function(options){\n        options = options || {};\n        if(this.standardSubmit){\n            var v = options.clientValidation === false || this.isValid();\n            if(v){\n                var el = this.el.dom;\n                if(this.url && Ext.isEmpty(el.action)){\n                    el.action = this.url;\n                }\n                el.submit();\n            }\n            return v;\n        }\n        var submitAction = String.format('{0}submit', this.api ? 'direct' : '');\n        this.doAction(submitAction, options);\n        return this;\n    },\n\n    \n    load : function(options){\n        var loadAction = String.format('{0}load', this.api ? 'direct' : '');\n        this.doAction(loadAction, options);\n        return this;\n    },\n\n    \n    updateRecord : function(record){\n        record.beginEdit();\n        var fs = record.fields,\n            field,\n            value;\n        fs.each(function(f){\n            field = this.findField(f.name);\n            if(field){\n                value = field.getValue();\n                if (Ext.type(value) !== false && value.getGroupValue) {\n                    value = value.getGroupValue();\n                } else if ( field.eachItem ) {\n                    value = [];\n                    field.eachItem(function(item){\n                        value.push(item.getValue());\n                    });\n                }\n                record.set(f.name, value);\n            }\n        }, this);\n        record.endEdit();\n        return this;\n    },\n\n    \n    loadRecord : function(record){\n        this.setValues(record.data);\n        return this;\n    },\n\n    \n    beforeAction : function(action){\n        \n        this.items.each(function(f){\n            if(f.isFormField && f.syncValue){\n                f.syncValue();\n            }\n        });\n        var o = action.options;\n        if(o.waitMsg){\n            if(this.waitMsgTarget === true){\n                this.el.mask(o.waitMsg, 'x-mask-loading');\n            }else if(this.waitMsgTarget){\n                this.waitMsgTarget = Ext.get(this.waitMsgTarget);\n                this.waitMsgTarget.mask(o.waitMsg, 'x-mask-loading');\n            }else{\n                Ext.MessageBox.wait(o.waitMsg, o.waitTitle || this.waitTitle);\n            }\n        }\n    },\n\n    \n    afterAction : function(action, success){\n        this.activeAction = null;\n        var o = action.options;\n        if(o.waitMsg){\n            if(this.waitMsgTarget === true){\n                this.el.unmask();\n            }else if(this.waitMsgTarget){\n                this.waitMsgTarget.unmask();\n            }else{\n                Ext.MessageBox.updateProgress(1);\n                Ext.MessageBox.hide();\n            }\n        }\n        if(success){\n            if(o.reset){\n                this.reset();\n            }\n            Ext.callback(o.success, o.scope, [this, action]);\n            this.fireEvent('actioncomplete', this, action);\n        }else{\n            Ext.callback(o.failure, o.scope, [this, action]);\n            this.fireEvent('actionfailed', this, action);\n        }\n    },\n\n    \n    findField : function(id) {\n        var field = this.items.get(id);\n\n        if (!Ext.isObject(field)) {\n            \n            var findMatchingField = function(f) {\n                if (f.isFormField) {\n                    if (f.dataIndex == id || f.id == id || f.getName() == id) {\n                        field = f;\n                        return false;\n                    } else if (f.isComposite) {\n                        return f.items.each(findMatchingField);\n                    } else if (f instanceof Ext.form.CheckboxGroup && f.rendered) {\n                        return f.eachItem(findMatchingField);\n                    }\n                }\n            };\n\n            this.items.each(findMatchingField);\n        }\n        return field || null;\n    },\n\n\n    \n    markInvalid : function(errors){\n        if (Ext.isArray(errors)) {\n            for(var i = 0, len = errors.length; i < len; i++){\n                var fieldError = errors[i];\n                var f = this.findField(fieldError.id);\n                if(f){\n                    f.markInvalid(fieldError.msg);\n                }\n            }\n        } else {\n            var field, id;\n            for(id in errors){\n                if(!Ext.isFunction(errors[id]) && (field = this.findField(id))){\n                    field.markInvalid(errors[id]);\n                }\n            }\n        }\n\n        return this;\n    },\n\n    \n    setValues : function(values){\n        if(Ext.isArray(values)){ \n            for(var i = 0, len = values.length; i < len; i++){\n                var v = values[i];\n                var f = this.findField(v.id);\n                if(f){\n                    f.setValue(v.value);\n                    if(this.trackResetOnLoad){\n                        f.originalValue = f.getValue();\n                    }\n                }\n            }\n        }else{ \n            var field, id;\n            for(id in values){\n                if(!Ext.isFunction(values[id]) && (field = this.findField(id))){\n                    field.setValue(values[id]);\n                    if(this.trackResetOnLoad){\n                        field.originalValue = field.getValue();\n                    }\n                }\n            }\n        }\n        return this;\n    },\n\n    \n    getValues : function(asString){\n        var fs = Ext.lib.Ajax.serializeForm(this.el.dom);\n        if(asString === true){\n            return fs;\n        }\n        return Ext.urlDecode(fs);\n    },\n\n    \n    getFieldValues : function(dirtyOnly){\n        var o = {},\n            n,\n            key,\n            val;\n        this.items.each(function(f) {\n            if (!f.disabled && (dirtyOnly !== true || f.isDirty())) {\n                n = f.getName();\n                key = o[n];\n                val = f.getValue();\n\n                if(Ext.isDefined(key)){\n                    if(Ext.isArray(key)){\n                        o[n].push(val);\n                    }else{\n                        o[n] = [key, val];\n                    }\n                }else{\n                    o[n] = val;\n                }\n            }\n        });\n        return o;\n    },\n\n    \n    clearInvalid : function(){\n        this.items.each(function(f){\n           f.clearInvalid();\n        });\n        return this;\n    },\n\n    \n    reset : function(){\n        this.items.each(function(f){\n            f.reset();\n        });\n        return this;\n    },\n\n    \n    add : function(){\n        this.items.addAll(Array.prototype.slice.call(arguments, 0));\n        return this;\n    },\n\n    \n    remove : function(field){\n        this.items.remove(field);\n        return this;\n    },\n\n    \n    cleanDestroyed : function() {\n        this.items.filterBy(function(o) { return !!o.isDestroyed; }).each(this.remove, this);\n    },\n\n    \n    render : function(){\n        this.items.each(function(f){\n            if(f.isFormField && !f.rendered && document.getElementById(f.id)){ \n                f.applyToMarkup(f.id);\n            }\n        });\n        return this;\n    },\n\n    \n    applyToFields : function(o){\n        this.items.each(function(f){\n           Ext.apply(f, o);\n        });\n        return this;\n    },\n\n    \n    applyIfToFields : function(o){\n        this.items.each(function(f){\n           Ext.applyIf(f, o);\n        });\n        return this;\n    },\n\n    callFieldMethod : function(fnName, args){\n        args = args || [];\n        this.items.each(function(f){\n            if(Ext.isFunction(f[fnName])){\n                f[fnName].apply(f, args);\n            }\n        });\n        return this;\n    }\n});\n\n\nExt.BasicForm = Ext.form.BasicForm;\n\nExt.FormPanel = Ext.extend(Ext.Panel, {\n    \n    \n    \n    \n    \n    \n    \n\n\n    \n    minButtonWidth : 75,\n\n    \n    labelAlign : 'left',\n\n    \n    monitorValid : false,\n\n    \n    monitorPoll : 200,\n\n    \n    layout : 'form',\n\n    \n    initComponent : function(){\n        this.form = this.createForm();\n        Ext.FormPanel.superclass.initComponent.call(this);\n\n        this.bodyCfg = {\n            tag: 'form',\n            cls: this.baseCls + '-body',\n            method : this.method || 'POST',\n            id : this.formId || Ext.id()\n        };\n        if(this.fileUpload) {\n            this.bodyCfg.enctype = 'multipart/form-data';\n        }\n        this.initItems();\n\n        this.addEvents(\n            \n            'clientvalidation'\n        );\n\n        this.relayEvents(this.form, ['beforeaction', 'actionfailed', 'actioncomplete']);\n    },\n\n    \n    createForm : function(){\n        var config = Ext.applyIf({listeners: {}}, this.initialConfig);\n        return new Ext.form.BasicForm(null, config);\n    },\n\n    \n    initFields : function(){\n        var f = this.form;\n        var formPanel = this;\n        var fn = function(c){\n            if(formPanel.isField(c)){\n                f.add(c);\n            }else if(c.findBy && c != formPanel){\n                formPanel.applySettings(c);\n                \n                if(c.items && c.items.each){\n                    c.items.each(fn, this);\n                }\n            }\n        };\n        this.items.each(fn, this);\n    },\n\n    \n    applySettings: function(c){\n        var ct = c.ownerCt;\n        Ext.applyIf(c, {\n            labelAlign: ct.labelAlign,\n            labelWidth: ct.labelWidth,\n            itemCls: ct.itemCls\n        });\n    },\n\n    \n    getLayoutTarget : function(){\n        return this.form.el;\n    },\n\n    \n    getForm : function(){\n        return this.form;\n    },\n\n    \n    onRender : function(ct, position){\n        this.initFields();\n        Ext.FormPanel.superclass.onRender.call(this, ct, position);\n        this.form.initEl(this.body);\n    },\n\n    \n    beforeDestroy : function(){\n        this.stopMonitoring();\n        this.form.destroy(true);\n        Ext.FormPanel.superclass.beforeDestroy.call(this);\n    },\n\n    \n    isField : function(c) {\n        return !!c.setValue && !!c.getValue && !!c.markInvalid && !!c.clearInvalid;\n    },\n\n    \n    initEvents : function(){\n        Ext.FormPanel.superclass.initEvents.call(this);\n        \n        this.on({\n            scope: this,\n            add: this.onAddEvent,\n            remove: this.onRemoveEvent\n        });\n        if(this.monitorValid){ \n            this.startMonitoring();\n        }\n    },\n\n    \n    onAdd: function(c){\n        Ext.FormPanel.superclass.onAdd.call(this, c);\n        this.processAdd(c);\n    },\n\n    \n    onAddEvent: function(ct, c){\n        if(ct !== this){\n            this.processAdd(c);\n        }\n    },\n\n    \n    processAdd : function(c){\n        \n        if(this.isField(c)){\n            this.form.add(c);\n        \n        }else if(c.findBy){\n            this.applySettings(c);\n            this.form.add.apply(this.form, c.findBy(this.isField));\n        }\n    },\n\n    \n    onRemove: function(c){\n        Ext.FormPanel.superclass.onRemove.call(this, c);\n        this.processRemove(c);\n    },\n\n    onRemoveEvent: function(ct, c){\n        if(ct !== this){\n            this.processRemove(c);\n        }\n    },\n\n    \n    processRemove: function(c){\n        if(!this.destroying){\n            \n            if(this.isField(c)){\n                this.form.remove(c);\n            \n            }else if (c.findBy){\n                Ext.each(c.findBy(this.isField), this.form.remove, this.form);\n                \n                this.form.cleanDestroyed();\n            }\n        }\n    },\n\n    \n    startMonitoring : function(){\n        if(!this.validTask){\n            this.validTask = new Ext.util.TaskRunner();\n            this.validTask.start({\n                run : this.bindHandler,\n                interval : this.monitorPoll || 200,\n                scope: this\n            });\n        }\n    },\n\n    \n    stopMonitoring : function(){\n        if(this.validTask){\n            this.validTask.stopAll();\n            this.validTask = null;\n        }\n    },\n\n    \n    load : function(){\n        this.form.load.apply(this.form, arguments);\n    },\n\n    \n    onDisable : function(){\n        Ext.FormPanel.superclass.onDisable.call(this);\n        if(this.form){\n            this.form.items.each(function(){\n                 this.disable();\n            });\n        }\n    },\n\n    \n    onEnable : function(){\n        Ext.FormPanel.superclass.onEnable.call(this);\n        if(this.form){\n            this.form.items.each(function(){\n                 this.enable();\n            });\n        }\n    },\n\n    \n    bindHandler : function(){\n        var valid = true;\n        this.form.items.each(function(f){\n            if(!f.isValid(true)){\n                valid = false;\n                return false;\n            }\n        });\n        if(this.fbar){\n            var fitems = this.fbar.items.items;\n            for(var i = 0, len = fitems.length; i < len; i++){\n                var btn = fitems[i];\n                if(btn.formBind === true && btn.disabled === valid){\n                    btn.setDisabled(!valid);\n                }\n            }\n        }\n        this.fireEvent('clientvalidation', this, valid);\n    }\n});\nExt.reg('form', Ext.FormPanel);\n\nExt.form.FormPanel = Ext.FormPanel;\n\nExt.form.FieldSet = Ext.extend(Ext.Panel, {\n    \n    \n    \n    \n    \n    \n    baseCls : 'x-fieldset',\n    \n    layout : 'form',\n    \n    animCollapse : false,\n\n    \n    onRender : function(ct, position){\n        if(!this.el){\n            this.el = document.createElement('fieldset');\n            this.el.id = this.id;\n            if (this.title || this.header || this.checkboxToggle) {\n                this.el.appendChild(document.createElement('legend')).className = this.baseCls + '-header';\n            }\n        }\n\n        Ext.form.FieldSet.superclass.onRender.call(this, ct, position);\n\n        if(this.checkboxToggle){\n            var o = typeof this.checkboxToggle == 'object' ?\n                    this.checkboxToggle :\n                    {tag: 'input', type: 'checkbox', name: this.checkboxName || this.id+'-checkbox'};\n            this.checkbox = this.header.insertFirst(o);\n            this.checkbox.dom.checked = !this.collapsed;\n            this.mon(this.checkbox, 'click', this.onCheckClick, this);\n        }\n    },\n\n    \n    onCollapse : function(doAnim, animArg){\n        if(this.checkbox){\n            this.checkbox.dom.checked = false;\n        }\n        Ext.form.FieldSet.superclass.onCollapse.call(this, doAnim, animArg);\n\n    },\n\n    \n    onExpand : function(doAnim, animArg){\n        if(this.checkbox){\n            this.checkbox.dom.checked = true;\n        }\n        Ext.form.FieldSet.superclass.onExpand.call(this, doAnim, animArg);\n    },\n\n    \n    onCheckClick : function(){\n        this[this.checkbox.dom.checked ? 'expand' : 'collapse']();\n    }\n\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n});\nExt.reg('fieldset', Ext.form.FieldSet);\n\nExt.form.HtmlEditor = Ext.extend(Ext.form.Field, {\n    \n    enableFormat : true,\n    \n    enableFontSize : true,\n    \n    enableColors : true,\n    \n    enableAlignments : true,\n    \n    enableLists : true,\n    \n    enableSourceEdit : true,\n    \n    enableLinks : true,\n    \n    enableFont : true,\n    \n    createLinkText : 'Please enter the URL for the link:',\n    \n    defaultLinkValue : 'http:/'+'/',\n    \n    fontFamilies : [\n        'Arial',\n        'Courier New',\n        'Tahoma',\n        'Times New Roman',\n        'Verdana'\n    ],\n    defaultFont: 'tahoma',\n    \n    defaultValue: (Ext.isOpera || Ext.isIE6) ? '&#160;' : '&#8203;',\n\n    \n    actionMode: 'wrap',\n    validationEvent : false,\n    deferHeight: true,\n    initialized : false,\n    activated : false,\n    sourceEditMode : false,\n    onFocus : Ext.emptyFn,\n    iframePad:3,\n    hideMode:'offsets',\n    defaultAutoCreate : {\n        tag: \"textarea\",\n        style:\"width:500px;height:300px;\",\n        autocomplete: \"off\"\n    },\n\n    \n    initComponent : function(){\n        this.addEvents(\n            \n            'initialize',\n            \n            'activate',\n             \n            'beforesync',\n             \n            'beforepush',\n             \n            'sync',\n             \n            'push',\n             \n            'editmodechange'\n        );\n        Ext.form.HtmlEditor.superclass.initComponent.call(this);\n    },\n\n    \n    createFontOptions : function(){\n        var buf = [], fs = this.fontFamilies, ff, lc;\n        for(var i = 0, len = fs.length; i< len; i++){\n            ff = fs[i];\n            lc = ff.toLowerCase();\n            buf.push(\n                '<option value=\"',lc,'\" style=\"font-family:',ff,';\"',\n                    (this.defaultFont == lc ? ' selected=\"true\">' : '>'),\n                    ff,\n                '</option>'\n            );\n        }\n        return buf.join('');\n    },\n\n    \n    createToolbar : function(editor){\n        var items = [];\n        var tipsEnabled = Ext.QuickTips && Ext.QuickTips.isEnabled();\n\n\n        function btn(id, toggle, handler){\n            return {\n                itemId : id,\n                cls : 'x-btn-icon',\n                iconCls: 'x-edit-'+id,\n                enableToggle:toggle !== false,\n                scope: editor,\n                handler:handler||editor.relayBtnCmd,\n                clickEvent:'mousedown',\n                tooltip: tipsEnabled ? editor.buttonTips[id] || undefined : undefined,\n                overflowText: editor.buttonTips[id].title || undefined,\n                tabIndex:-1\n            };\n        }\n\n\n        if(this.enableFont && !Ext.isSafari2){\n            var fontSelectItem = new Ext.Toolbar.Item({\n               autoEl: {\n                    tag:'select',\n                    cls:'x-font-select',\n                    html: this.createFontOptions()\n               }\n            });\n\n            items.push(\n                fontSelectItem,\n                '-'\n            );\n        }\n\n        if(this.enableFormat){\n            items.push(\n                btn('bold'),\n                btn('italic'),\n                btn('underline')\n            );\n        }\n\n        if(this.enableFontSize){\n            items.push(\n                '-',\n                btn('increasefontsize', false, this.adjustFont),\n                btn('decreasefontsize', false, this.adjustFont)\n            );\n        }\n\n        if(this.enableColors){\n            items.push(\n                '-', {\n                    itemId:'forecolor',\n                    cls:'x-btn-icon',\n                    iconCls: 'x-edit-forecolor',\n                    clickEvent:'mousedown',\n                    tooltip: tipsEnabled ? editor.buttonTips.forecolor || undefined : undefined,\n                    tabIndex:-1,\n                    menu : new Ext.menu.ColorMenu({\n                        allowReselect: true,\n                        focus: Ext.emptyFn,\n                        value:'000000',\n                        plain:true,\n                        listeners: {\n                            scope: this,\n                            select: function(cp, color){\n                                this.execCmd('forecolor', Ext.isWebKit || Ext.isIE ? '#'+color : color);\n                                this.deferFocus();\n                            }\n                        },\n                        clickEvent:'mousedown'\n                    })\n                }, {\n                    itemId:'backcolor',\n                    cls:'x-btn-icon',\n                    iconCls: 'x-edit-backcolor',\n                    clickEvent:'mousedown',\n                    tooltip: tipsEnabled ? editor.buttonTips.backcolor || undefined : undefined,\n                    tabIndex:-1,\n                    menu : new Ext.menu.ColorMenu({\n                        focus: Ext.emptyFn,\n                        value:'FFFFFF',\n                        plain:true,\n                        allowReselect: true,\n                        listeners: {\n                            scope: this,\n                            select: function(cp, color){\n                                if(Ext.isGecko){\n                                    this.execCmd('useCSS', false);\n                                    this.execCmd('hilitecolor', color);\n                                    this.execCmd('useCSS', true);\n                                    this.deferFocus();\n                                }else{\n                                    this.execCmd(Ext.isOpera ? 'hilitecolor' : 'backcolor', Ext.isWebKit || Ext.isIE ? '#'+color : color);\n                                    this.deferFocus();\n                                }\n                            }\n                        },\n                        clickEvent:'mousedown'\n                    })\n                }\n            );\n        }\n\n        if(this.enableAlignments){\n            items.push(\n                '-',\n                btn('justifyleft'),\n                btn('justifycenter'),\n                btn('justifyright')\n            );\n        }\n\n        if(!Ext.isSafari2){\n            if(this.enableLinks){\n                items.push(\n                    '-',\n                    btn('createlink', false, this.createLink)\n                );\n            }\n\n            if(this.enableLists){\n                items.push(\n                    '-',\n                    btn('insertorderedlist'),\n                    btn('insertunorderedlist')\n                );\n            }\n            if(this.enableSourceEdit){\n                items.push(\n                    '-',\n                    btn('sourceedit', true, function(btn){\n                        this.toggleSourceEdit(!this.sourceEditMode);\n                    })\n                );\n            }\n        }\n\n        \n        var tb = new Ext.Toolbar({\n            renderTo: this.wrap.dom.firstChild,\n            items: items\n        });\n\n        if (fontSelectItem) {\n            this.fontSelect = fontSelectItem.el;\n\n            this.mon(this.fontSelect, 'change', function(){\n                var font = this.fontSelect.dom.value;\n                this.relayCmd('fontname', font);\n                this.deferFocus();\n            }, this);\n        }\n\n        \n        this.mon(tb.el, 'click', function(e){\n            e.preventDefault();\n        });\n\n        this.tb = tb;\n        this.tb.doLayout();\n    },\n\n    onDisable: function(){\n        this.wrap.mask();\n        Ext.form.HtmlEditor.superclass.onDisable.call(this);\n    },\n\n    onEnable: function(){\n        this.wrap.unmask();\n        Ext.form.HtmlEditor.superclass.onEnable.call(this);\n    },\n\n    setReadOnly: function(readOnly){\n\n        Ext.form.HtmlEditor.superclass.setReadOnly.call(this, readOnly);\n        if(this.initialized){\n            if(Ext.isIE){\n                this.getEditorBody().contentEditable = !readOnly;\n            }else{\n                this.setDesignMode(!readOnly);\n            }\n            var bd = this.getEditorBody();\n            if(bd){\n                bd.style.cursor = this.readOnly ? 'default' : 'text';\n            }\n            this.disableItems(readOnly);\n        }\n    },\n\n    \n    getDocMarkup : function(){\n        var h = Ext.fly(this.iframe).getHeight() - this.iframePad * 2;\n        return String.format('<html><head><style type=\"text/css\">body{border: 0; margin: 0; padding: {0}px; height: {1}px; cursor: text}</style></head><body></body></html>', this.iframePad, h);\n    },\n\n    \n    getEditorBody : function(){\n        var doc = this.getDoc();\n        return doc.body || doc.documentElement;\n    },\n\n    \n    getDoc : function(){\n        return Ext.isIE ? this.getWin().document : (this.iframe.contentDocument || this.getWin().document);\n    },\n\n    \n    getWin : function(){\n        return Ext.isIE ? this.iframe.contentWindow : window.frames[this.iframe.name];\n    },\n\n    \n    onRender : function(ct, position){\n        Ext.form.HtmlEditor.superclass.onRender.call(this, ct, position);\n        this.el.dom.style.border = '0 none';\n        this.el.dom.setAttribute('tabIndex', -1);\n        this.el.addClass('x-hidden');\n        if(Ext.isIE){ \n            this.el.applyStyles('margin-top:-1px;margin-bottom:-1px;');\n        }\n        this.wrap = this.el.wrap({\n            cls:'x-html-editor-wrap', cn:{cls:'x-html-editor-tb'}\n        });\n\n        this.createToolbar(this);\n\n        this.disableItems(true);\n\n        this.tb.doLayout();\n\n        this.createIFrame();\n\n        if(!this.width){\n            var sz = this.el.getSize();\n            this.setSize(sz.width, this.height || sz.height);\n        }\n        this.resizeEl = this.positionEl = this.wrap;\n    },\n\n    createIFrame: function(){\n        var iframe = document.createElement('iframe');\n        iframe.name = Ext.id();\n        iframe.frameBorder = '0';\n        iframe.style.overflow = 'auto';\n        iframe.src = Ext.SSL_SECURE_URL;\n\n        this.wrap.dom.appendChild(iframe);\n        this.iframe = iframe;\n\n        this.monitorTask = Ext.TaskMgr.start({\n            run: this.checkDesignMode,\n            scope: this,\n            interval:100\n        });\n    },\n\n    initFrame : function(){\n        Ext.TaskMgr.stop(this.monitorTask);\n        var doc = this.getDoc();\n        this.win = this.getWin();\n\n        doc.open();\n        doc.write(this.getDocMarkup());\n        doc.close();\n\n        this.readyTask = { \n            run : function(){\n                var doc = this.getDoc();\n                if(doc.body || doc.readyState == 'complete'){\n                    Ext.TaskMgr.stop(this.readyTask);\n                    this.setDesignMode(true);\n                    this.initEditor.defer(10, this);\n                }\n            },\n            interval : 10,\n            duration:10000,\n            scope: this\n        };\n        Ext.TaskMgr.start(this.readyTask);\n    },\n\n\n    checkDesignMode : function(){\n        if(this.wrap && this.wrap.dom.offsetWidth){\n            var doc = this.getDoc();\n            if(!doc){\n                return;\n            }\n            if(!doc.editorInitialized || this.getDesignMode() != 'on'){\n                this.initFrame();\n            }\n        }\n    },\n\n    \n    setDesignMode : function(mode){\n        var doc = this.getDoc();\n        if (doc) {\n            if(this.readOnly){\n                mode = false;\n            }\n            doc.designMode = (/on|true/i).test(String(mode).toLowerCase()) ?'on':'off';\n        }\n\n    },\n\n    \n    getDesignMode : function(){\n        var doc = this.getDoc();\n        if(!doc){ return ''; }\n        return String(doc.designMode).toLowerCase();\n\n    },\n\n    disableItems: function(disabled){\n        if(this.fontSelect){\n            this.fontSelect.dom.disabled = disabled;\n        }\n        this.tb.items.each(function(item){\n            if(item.getItemId() != 'sourceedit'){\n                item.setDisabled(disabled);\n            }\n        });\n    },\n\n    \n    onResize : function(w, h){\n        Ext.form.HtmlEditor.superclass.onResize.apply(this, arguments);\n        if(this.el && this.iframe){\n            if(Ext.isNumber(w)){\n                var aw = w - this.wrap.getFrameWidth('lr');\n                this.el.setWidth(aw);\n                this.tb.setWidth(aw);\n                this.iframe.style.width = Math.max(aw, 0) + 'px';\n            }\n            if(Ext.isNumber(h)){\n                var ah = h - this.wrap.getFrameWidth('tb') - this.tb.el.getHeight();\n                this.el.setHeight(ah);\n                this.iframe.style.height = Math.max(ah, 0) + 'px';\n                var bd = this.getEditorBody();\n                if(bd){\n                    bd.style.height = Math.max((ah - (this.iframePad*2)), 0) + 'px';\n                }\n            }\n        }\n    },\n\n    \n    toggleSourceEdit : function(sourceEditMode){\n        var iframeHeight,\n            elHeight;\n\n        if (sourceEditMode === undefined) {\n            sourceEditMode = !this.sourceEditMode;\n        }\n        this.sourceEditMode = sourceEditMode === true;\n        var btn = this.tb.getComponent('sourceedit');\n\n        if (btn.pressed !== this.sourceEditMode) {\n            btn.toggle(this.sourceEditMode);\n            if (!btn.xtbHidden) {\n                return;\n            }\n        }\n        if (this.sourceEditMode) {\n            \n            this.previousSize = this.getSize();\n\n            iframeHeight = Ext.get(this.iframe).getHeight();\n\n            this.disableItems(true);\n            this.syncValue();\n            this.iframe.className = 'x-hidden';\n            this.el.removeClass('x-hidden');\n            this.el.dom.removeAttribute('tabIndex');\n            this.el.focus();\n            this.el.dom.style.height = iframeHeight + 'px';\n        }\n        else {\n            elHeight = parseInt(this.el.dom.style.height, 10);\n            if (this.initialized) {\n                this.disableItems(this.readOnly);\n            }\n            this.pushValue();\n            this.iframe.className = '';\n            this.el.addClass('x-hidden');\n            this.el.dom.setAttribute('tabIndex', -1);\n            this.deferFocus();\n\n            this.setSize(this.previousSize);\n            delete this.previousSize;\n            this.iframe.style.height = elHeight + 'px';\n        }\n        this.fireEvent('editmodechange', this, this.sourceEditMode);\n    },\n\n    \n    createLink : function() {\n        var url = prompt(this.createLinkText, this.defaultLinkValue);\n        if(url && url != 'http:/'+'/'){\n            this.relayCmd('createlink', url);\n        }\n    },\n\n    \n    initEvents : function(){\n        this.originalValue = this.getValue();\n    },\n\n    \n    markInvalid : Ext.emptyFn,\n\n    \n    clearInvalid : Ext.emptyFn,\n\n    \n    setValue : function(v){\n        Ext.form.HtmlEditor.superclass.setValue.call(this, v);\n        this.pushValue();\n        return this;\n    },\n\n    \n    cleanHtml: function(html) {\n        html = String(html);\n        if(Ext.isWebKit){ \n            html = html.replace(/\\sclass=\"(?:Apple-style-span|khtml-block-placeholder)\"/gi, '');\n        }\n\n        \n        if(html.charCodeAt(0) == this.defaultValue.replace(/\\D/g, '')){\n            html = html.substring(1);\n        }\n        return html;\n    },\n\n    \n    syncValue : function(){\n        if(this.initialized){\n            var bd = this.getEditorBody();\n            var html = bd.innerHTML;\n            if(Ext.isWebKit){\n                var bs = bd.getAttribute('style'); \n                var m = bs.match(/text-align:(.*?);/i);\n                if(m && m[1]){\n                    html = '<div style=\"'+m[0]+'\">' + html + '</div>';\n                }\n            }\n            html = this.cleanHtml(html);\n            if(this.fireEvent('beforesync', this, html) !== false){\n                this.el.dom.value = html;\n                this.fireEvent('sync', this, html);\n            }\n        }\n    },\n\n    \n    getValue : function() {\n        this[this.sourceEditMode ? 'pushValue' : 'syncValue']();\n        return Ext.form.HtmlEditor.superclass.getValue.call(this);\n    },\n\n    \n    pushValue : function(){\n        if(this.initialized){\n            var v = this.el.dom.value;\n            if(!this.activated && v.length < 1){\n                v = this.defaultValue;\n            }\n            if(this.fireEvent('beforepush', this, v) !== false){\n                this.getEditorBody().innerHTML = v;\n                if(Ext.isGecko){\n                    \n                    this.setDesignMode(false);  \n                    this.setDesignMode(true);\n                }\n                this.fireEvent('push', this, v);\n            }\n\n        }\n    },\n\n    \n    deferFocus : function(){\n        this.focus.defer(10, this);\n    },\n\n    \n    focus : function(){\n        if(this.win && !this.sourceEditMode){\n            this.win.focus();\n        }else{\n            this.el.focus();\n        }\n    },\n\n    \n    initEditor : function(){\n        \n        try{\n            var dbody = this.getEditorBody(),\n                ss = this.el.getStyles('font-size', 'font-family', 'background-image', 'background-repeat', 'background-color', 'color'),\n                doc,\n                fn;\n\n            ss['background-attachment'] = 'fixed'; \n            dbody.bgProperties = 'fixed'; \n\n            Ext.DomHelper.applyStyles(dbody, ss);\n\n            doc = this.getDoc();\n\n            if(doc){\n                try{\n                    Ext.EventManager.removeAll(doc);\n                }catch(e){}\n            }\n\n            \n            fn = this.onEditorEvent.createDelegate(this);\n            Ext.EventManager.on(doc, {\n                mousedown: fn,\n                dblclick: fn,\n                click: fn,\n                keyup: fn,\n                buffer:100\n            });\n\n            if(Ext.isGecko){\n                Ext.EventManager.on(doc, 'keypress', this.applyCommand, this);\n            }\n            if(Ext.isIE || Ext.isWebKit || Ext.isOpera){\n                Ext.EventManager.on(doc, 'keydown', this.fixKeys, this);\n            }\n            doc.editorInitialized = true;\n            this.initialized = true;\n            this.pushValue();\n            this.setReadOnly(this.readOnly);\n            this.fireEvent('initialize', this);\n        }catch(e){}\n    },\n\n    \n    beforeDestroy : function(){\n        if(this.monitorTask){\n            Ext.TaskMgr.stop(this.monitorTask);\n        }\n        if(this.readyTask){\n            Ext.TaskMgr.stop(this.readyTask);\n        }\n        if(this.rendered){\n            Ext.destroy(this.tb);\n            var doc = this.getDoc();\n            Ext.EventManager.removeFromSpecialCache(doc);\n            if(doc){\n                try{\n                    Ext.EventManager.removeAll(doc);\n                    for (var prop in doc){\n                        delete doc[prop];\n                    }\n                }catch(e){}\n            }\n            if(this.wrap){\n                this.wrap.dom.innerHTML = '';\n                this.wrap.remove();\n            }\n        }\n        Ext.form.HtmlEditor.superclass.beforeDestroy.call(this);\n    },\n\n    \n    onFirstFocus : function(){\n        this.activated = true;\n        this.disableItems(this.readOnly);\n        if(Ext.isGecko){ \n            this.win.focus();\n            var s = this.win.getSelection();\n            if(!s.focusNode || s.focusNode.nodeType != 3){\n                var r = s.getRangeAt(0);\n                r.selectNodeContents(this.getEditorBody());\n                r.collapse(true);\n                this.deferFocus();\n            }\n            try{\n                this.execCmd('useCSS', true);\n                this.execCmd('styleWithCSS', false);\n            }catch(e){}\n        }\n        this.fireEvent('activate', this);\n    },\n\n    \n    adjustFont: function(btn){\n        var adjust = btn.getItemId() == 'increasefontsize' ? 1 : -1,\n            doc = this.getDoc(),\n            v = parseInt(doc.queryCommandValue('FontSize') || 2, 10);\n        if((Ext.isSafari && !Ext.isSafari2) || Ext.isChrome || Ext.isAir){\n            \n            \n            if(v <= 10){\n                v = 1 + adjust;\n            }else if(v <= 13){\n                v = 2 + adjust;\n            }else if(v <= 16){\n                v = 3 + adjust;\n            }else if(v <= 18){\n                v = 4 + adjust;\n            }else if(v <= 24){\n                v = 5 + adjust;\n            }else {\n                v = 6 + adjust;\n            }\n            v = v.constrain(1, 6);\n        }else{\n            if(Ext.isSafari){ \n                adjust *= 2;\n            }\n            v = Math.max(1, v+adjust) + (Ext.isSafari ? 'px' : 0);\n        }\n        this.execCmd('FontSize', v);\n    },\n\n    \n    onEditorEvent : function(e){\n        this.updateToolbar();\n    },\n\n\n    \n    updateToolbar: function(){\n\n        if(this.readOnly){\n            return;\n        }\n\n        if(!this.activated){\n            this.onFirstFocus();\n            return;\n        }\n\n        var btns = this.tb.items.map,\n            doc = this.getDoc();\n\n        if(this.enableFont && !Ext.isSafari2){\n            var name = (doc.queryCommandValue('FontName')||this.defaultFont).toLowerCase();\n            if(name != this.fontSelect.dom.value){\n                this.fontSelect.dom.value = name;\n            }\n        }\n        if(this.enableFormat){\n            btns.bold.toggle(doc.queryCommandState('bold'));\n            btns.italic.toggle(doc.queryCommandState('italic'));\n            btns.underline.toggle(doc.queryCommandState('underline'));\n        }\n        if(this.enableAlignments){\n            btns.justifyleft.toggle(doc.queryCommandState('justifyleft'));\n            btns.justifycenter.toggle(doc.queryCommandState('justifycenter'));\n            btns.justifyright.toggle(doc.queryCommandState('justifyright'));\n        }\n        if(!Ext.isSafari2 && this.enableLists){\n            btns.insertorderedlist.toggle(doc.queryCommandState('insertorderedlist'));\n            btns.insertunorderedlist.toggle(doc.queryCommandState('insertunorderedlist'));\n        }\n\n        Ext.menu.MenuMgr.hideAll();\n\n        this.syncValue();\n    },\n\n    \n    relayBtnCmd : function(btn){\n        this.relayCmd(btn.getItemId());\n    },\n\n    \n    relayCmd : function(cmd, value){\n        (function(){\n            this.focus();\n            this.execCmd(cmd, value);\n            this.updateToolbar();\n        }).defer(10, this);\n    },\n\n    \n    execCmd : function(cmd, value){\n        var doc = this.getDoc();\n        doc.execCommand(cmd, false, value === undefined ? null : value);\n        this.syncValue();\n    },\n\n    \n    applyCommand : function(e){\n        if(e.ctrlKey){\n            var c = e.getCharCode(), cmd;\n            if(c > 0){\n                c = String.fromCharCode(c);\n                switch(c){\n                    case 'b':\n                        cmd = 'bold';\n                    break;\n                    case 'i':\n                        cmd = 'italic';\n                    break;\n                    case 'u':\n                        cmd = 'underline';\n                    break;\n                }\n                if(cmd){\n                    this.win.focus();\n                    this.execCmd(cmd);\n                    this.deferFocus();\n                    e.preventDefault();\n                }\n            }\n        }\n    },\n\n    \n    insertAtCursor : function(text){\n        if(!this.activated){\n            return;\n        }\n        if(Ext.isIE){\n            this.win.focus();\n            var doc = this.getDoc(),\n                r = doc.selection.createRange();\n            if(r){\n                r.pasteHTML(text);\n                this.syncValue();\n                this.deferFocus();\n            }\n        }else{\n            this.win.focus();\n            this.execCmd('InsertHTML', text);\n            this.deferFocus();\n        }\n    },\n\n    \n    fixKeys : function(){ \n        if(Ext.isIE){\n            return function(e){\n                var k = e.getKey(),\n                    doc = this.getDoc(),\n                        r;\n                if(k == e.TAB){\n                    e.stopEvent();\n                    r = doc.selection.createRange();\n                    if(r){\n                        r.collapse(true);\n                        r.pasteHTML('&nbsp;&nbsp;&nbsp;&nbsp;');\n                        this.deferFocus();\n                    }\n                }else if(k == e.ENTER){\n                    r = doc.selection.createRange();\n                    if(r){\n                        var target = r.parentElement();\n                        if(!target || target.tagName.toLowerCase() != 'li'){\n                            e.stopEvent();\n                            r.pasteHTML('<br />');\n                            r.collapse(false);\n                            r.select();\n                        }\n                    }\n                }\n            };\n        }else if(Ext.isOpera){\n            return function(e){\n                var k = e.getKey();\n                if(k == e.TAB){\n                    e.stopEvent();\n                    this.win.focus();\n                    this.execCmd('InsertHTML','&nbsp;&nbsp;&nbsp;&nbsp;');\n                    this.deferFocus();\n                }\n            };\n        }else if(Ext.isWebKit){\n            return function(e){\n                var k = e.getKey();\n                if(k == e.TAB){\n                    e.stopEvent();\n                    this.execCmd('InsertText','\\t');\n                    this.deferFocus();\n                }else if(k == e.ENTER){\n                    e.stopEvent();\n                    this.execCmd('InsertHtml','<br /><br />');\n                    this.deferFocus();\n                }\n             };\n        }\n    }(),\n\n    \n    getToolbar : function(){\n        return this.tb;\n    },\n\n    \n    buttonTips : {\n        bold : {\n            title: 'Bold (Ctrl+B)',\n            text: 'Make the selected text bold.',\n            cls: 'x-html-editor-tip'\n        },\n        italic : {\n            title: 'Italic (Ctrl+I)',\n            text: 'Make the selected text italic.',\n            cls: 'x-html-editor-tip'\n        },\n        underline : {\n            title: 'Underline (Ctrl+U)',\n            text: 'Underline the selected text.',\n            cls: 'x-html-editor-tip'\n        },\n        increasefontsize : {\n            title: 'Grow Text',\n            text: 'Increase the font size.',\n            cls: 'x-html-editor-tip'\n        },\n        decreasefontsize : {\n            title: 'Shrink Text',\n            text: 'Decrease the font size.',\n            cls: 'x-html-editor-tip'\n        },\n        backcolor : {\n            title: 'Text Highlight Color',\n            text: 'Change the background color of the selected text.',\n            cls: 'x-html-editor-tip'\n        },\n        forecolor : {\n            title: 'Font Color',\n            text: 'Change the color of the selected text.',\n            cls: 'x-html-editor-tip'\n        },\n        justifyleft : {\n            title: 'Align Text Left',\n            text: 'Align text to the left.',\n            cls: 'x-html-editor-tip'\n        },\n        justifycenter : {\n            title: 'Center Text',\n            text: 'Center text in the editor.',\n            cls: 'x-html-editor-tip'\n        },\n        justifyright : {\n            title: 'Align Text Right',\n            text: 'Align text to the right.',\n            cls: 'x-html-editor-tip'\n        },\n        insertunorderedlist : {\n            title: 'Bullet List',\n            text: 'Start a bulleted list.',\n            cls: 'x-html-editor-tip'\n        },\n        insertorderedlist : {\n            title: 'Numbered List',\n            text: 'Start a numbered list.',\n            cls: 'x-html-editor-tip'\n        },\n        createlink : {\n            title: 'Hyperlink',\n            text: 'Make the selected text a hyperlink.',\n            cls: 'x-html-editor-tip'\n        },\n        sourceedit : {\n            title: 'Source Edit',\n            text: 'Switch to source editing mode.',\n            cls: 'x-html-editor-tip'\n        }\n    }\n\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n});\nExt.reg('htmleditor', Ext.form.HtmlEditor);\n\nExt.form.TimeField = Ext.extend(Ext.form.ComboBox, {\n    \n    minValue : undefined,\n    \n    maxValue : undefined,\n    \n    minText : \"The time in this field must be equal to or after {0}\",\n    \n    maxText : \"The time in this field must be equal to or before {0}\",\n    \n    invalidText : \"{0} is not a valid time\",\n    \n    format : \"g:i A\",\n    \n    altFormats : \"g:ia|g:iA|g:i a|g:i A|h:i|g:i|H:i|ga|ha|gA|h a|g a|g A|gi|hi|gia|hia|g|H|gi a|hi a|giA|hiA|gi A|hi A\",\n    \n    increment: 15,\n\n    \n    mode: 'local',\n    \n    triggerAction: 'all',\n    \n    typeAhead: false,\n\n    \n    \n    \n    initDate: '1/1/2008',\n\n    initDateFormat: 'j/n/Y',\n\n    \n    initComponent : function(){\n        if(Ext.isDefined(this.minValue)){\n            this.setMinValue(this.minValue, true);\n        }\n        if(Ext.isDefined(this.maxValue)){\n            this.setMaxValue(this.maxValue, true);\n        }\n        if(!this.store){\n            this.generateStore(true);\n        }\n        Ext.form.TimeField.superclass.initComponent.call(this);\n    },\n\n    \n    setMinValue: function(value,  initial){\n        this.setLimit(value, true, initial);\n        return this;\n    },\n\n    \n    setMaxValue: function(value,  initial){\n        this.setLimit(value, false, initial);\n        return this;\n    },\n\n    \n    generateStore: function(initial){\n        var min = this.minValue || new Date(this.initDate).clearTime(),\n            max = this.maxValue || new Date(this.initDate).clearTime().add('mi', (24 * 60) - 1),\n            times = [];\n\n        while(min <= max){\n            times.push(min.dateFormat(this.format));\n            min = min.add('mi', this.increment);\n        }\n        this.bindStore(times, initial);\n    },\n\n    \n    setLimit: function(value, isMin, initial){\n        var d;\n        if(Ext.isString(value)){\n            d = this.parseDate(value);\n        }else if(Ext.isDate(value)){\n            d = value;\n        }\n        if(d){\n            var val = new Date(this.initDate).clearTime();\n            val.setHours(d.getHours(), d.getMinutes(), d.getSeconds(), d.getMilliseconds());\n            this[isMin ? 'minValue' : 'maxValue'] = val;\n            if(!initial){\n                this.generateStore();\n            }\n        }\n    },\n\n    \n    getValue : function(){\n        var v = Ext.form.TimeField.superclass.getValue.call(this);\n        return this.formatDate(this.parseDate(v)) || '';\n    },\n\n    \n    setValue : function(value){\n        return Ext.form.TimeField.superclass.setValue.call(this, this.formatDate(this.parseDate(value)));\n    },\n\n    \n    validateValue : Ext.form.DateField.prototype.validateValue,\n\n    formatDate : Ext.form.DateField.prototype.formatDate,\n\n    parseDate: function(value) {\n        if (!value || Ext.isDate(value)) {\n            return value;\n        }\n\n        var id = this.initDate + ' ',\n            idf = this.initDateFormat + ' ',\n            v = Date.parseDate(id + value, idf + this.format), \n            af = this.altFormats;\n\n        if (!v && af) {\n            if (!this.altFormatsArray) {\n                this.altFormatsArray = af.split(\"|\");\n            }\n            for (var i = 0, afa = this.altFormatsArray, len = afa.length; i < len && !v; i++) {\n                v = Date.parseDate(id + value, idf + afa[i]);\n            }\n        }\n\n        return v;\n    }\n});\nExt.reg('timefield', Ext.form.TimeField);\nExt.form.SliderField = Ext.extend(Ext.form.Field, {\n    \n    \n    useTips : true,\n    \n    \n    tipText : null,\n    \n    \n    actionMode: 'wrap',\n    \n    \n    initComponent : function() {\n        var cfg = Ext.copyTo({\n            id: this.id + '-slider'\n        }, this.initialConfig, ['vertical', 'minValue', 'maxValue', 'decimalPrecision', 'keyIncrement', 'increment', 'clickToChange', 'animate']);\n        \n        \n        if (this.useTips) {\n            var plug = this.tipText ? {getText: this.tipText} : {};\n            cfg.plugins = [new Ext.slider.Tip(plug)];\n        }\n        this.slider = new Ext.Slider(cfg);\n        Ext.form.SliderField.superclass.initComponent.call(this);\n    },    \n    \n    \n    onRender : function(ct, position){\n        this.autoCreate = {\n            id: this.id,\n            name: this.name,\n            type: 'hidden',\n            tag: 'input'    \n        };\n        Ext.form.SliderField.superclass.onRender.call(this, ct, position);\n        this.wrap = this.el.wrap({cls: 'x-form-field-wrap'});\n        this.resizeEl = this.positionEl = this.wrap;\n        this.slider.render(this.wrap);\n    },\n    \n    \n    onResize : function(w, h, aw, ah){\n        Ext.form.SliderField.superclass.onResize.call(this, w, h, aw, ah);\n        this.slider.setSize(w, h);    \n    },\n    \n    \n    initEvents : function(){\n        Ext.form.SliderField.superclass.initEvents.call(this);\n        this.slider.on('change', this.onChange, this);   \n    },\n    \n    \n    onChange : function(slider, v){\n        this.setValue(v, undefined, true);\n    },\n    \n    \n    onEnable : function(){\n        Ext.form.SliderField.superclass.onEnable.call(this);\n        this.slider.enable();\n    },\n    \n    \n    onDisable : function(){\n        Ext.form.SliderField.superclass.onDisable.call(this);\n        this.slider.disable();    \n    },\n    \n    \n    beforeDestroy : function(){\n        Ext.destroy(this.slider);\n        Ext.form.SliderField.superclass.beforeDestroy.call(this);\n    },\n    \n    \n    alignErrorIcon : function(){\n        this.errorIcon.alignTo(this.slider.el, 'tl-tr', [2, 0]);\n    },\n    \n    \n    setMinValue : function(v){\n        this.slider.setMinValue(v);\n        return this;    \n    },\n    \n    \n    setMaxValue : function(v){\n        this.slider.setMaxValue(v);\n        return this;    \n    },\n    \n    \n    setValue : function(v, animate,  silent){\n        \n        \n        if(!silent){\n            this.slider.setValue(v, animate);\n        }\n        return Ext.form.SliderField.superclass.setValue.call(this, this.slider.getValue());\n    },\n    \n    \n    getValue : function(){\n        return this.slider.getValue();    \n    }\n});\n\nExt.reg('sliderfield', Ext.form.SliderField);\nExt.form.Label = Ext.extend(Ext.BoxComponent, {\n    \n    \n    \n\n    \n    onRender : function(ct, position){\n        if(!this.el){\n            this.el = document.createElement('label');\n            this.el.id = this.getId();\n            this.el.innerHTML = this.text ? Ext.util.Format.htmlEncode(this.text) : (this.html || '');\n            if(this.forId){\n                this.el.setAttribute('for', this.forId);\n            }\n        }\n        Ext.form.Label.superclass.onRender.call(this, ct, position);\n    },\n\n    \n    setText : function(t, encode){\n        var e = encode === false;\n        this[!e ? 'text' : 'html'] = t;\n        delete this[e ? 'text' : 'html'];\n        if(this.rendered){\n            this.el.dom.innerHTML = encode !== false ? Ext.util.Format.htmlEncode(t) : t;\n        }\n        return this;\n    }\n});\n\nExt.reg('label', Ext.form.Label);\nExt.form.Action = function(form, options){\n    this.form = form;\n    this.options = options || {};\n};\n\n\nExt.form.Action.CLIENT_INVALID = 'client';\n\nExt.form.Action.SERVER_INVALID = 'server';\n\nExt.form.Action.CONNECT_FAILURE = 'connect';\n\nExt.form.Action.LOAD_FAILURE = 'load';\n\nExt.form.Action.prototype = {\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n    type : 'default',\n\n \n \n\n    \n    run : function(options){\n\n    },\n\n    \n    success : function(response){\n\n    },\n\n    \n    handleResponse : function(response){\n\n    },\n\n    \n    failure : function(response){\n        this.response = response;\n        this.failureType = Ext.form.Action.CONNECT_FAILURE;\n        this.form.afterAction(this, false);\n    },\n\n    \n    \n    \n    processResponse : function(response){\n        this.response = response;\n        if(!response.responseText && !response.responseXML){\n            return true;\n        }\n        this.result = this.handleResponse(response);\n        return this.result;\n    },\n    \n    decodeResponse: function(response) {\n        try {\n            return Ext.decode(response.responseText);\n        } catch(e) {\n            return false;\n        } \n    },\n\n    \n    getUrl : function(appendParams){\n        var url = this.options.url || this.form.url || this.form.el.dom.action;\n        if(appendParams){\n            var p = this.getParams();\n            if(p){\n                url = Ext.urlAppend(url, p);\n            }\n        }\n        return url;\n    },\n\n    \n    getMethod : function(){\n        return (this.options.method || this.form.method || this.form.el.dom.method || 'POST').toUpperCase();\n    },\n\n    \n    getParams : function(){\n        var bp = this.form.baseParams;\n        var p = this.options.params;\n        if(p){\n            if(typeof p == \"object\"){\n                p = Ext.urlEncode(Ext.applyIf(p, bp));\n            }else if(typeof p == 'string' && bp){\n                p += '&' + Ext.urlEncode(bp);\n            }\n        }else if(bp){\n            p = Ext.urlEncode(bp);\n        }\n        return p;\n    },\n\n    \n    createCallback : function(opts){\n        var opts = opts || {};\n        return {\n            success: this.success,\n            failure: this.failure,\n            scope: this,\n            timeout: (opts.timeout*1000) || (this.form.timeout*1000),\n            upload: this.form.fileUpload ? this.success : undefined\n        };\n    }\n};\n\n\nExt.form.Action.Submit = function(form, options){\n    Ext.form.Action.Submit.superclass.constructor.call(this, form, options);\n};\n\nExt.extend(Ext.form.Action.Submit, Ext.form.Action, {\n    \n    \n    type : 'submit',\n\n    \n    run : function(){\n        var o = this.options,\n            method = this.getMethod(),\n            isGet = method == 'GET';\n        if(o.clientValidation === false || this.form.isValid()){\n            if (o.submitEmptyText === false) {\n                var fields = this.form.items,\n                    emptyFields = [],\n                    setupEmptyFields = function(f){\n                        if (f.el.getValue() == f.emptyText) {\n                            emptyFields.push(f);\n                            f.el.dom.value = \"\";\n                        }\n                        if(f.isComposite && f.rendered){\n                            f.items.each(setupEmptyFields);\n                        }\n                    };\n                    \n                fields.each(setupEmptyFields);\n            }\n            Ext.Ajax.request(Ext.apply(this.createCallback(o), {\n                form:this.form.el.dom,\n                url:this.getUrl(isGet),\n                method: method,\n                headers: o.headers,\n                params:!isGet ? this.getParams() : null,\n                isUpload: this.form.fileUpload\n            }));\n            if (o.submitEmptyText === false) {\n                Ext.each(emptyFields, function(f) {\n                    if (f.applyEmptyText) {\n                        f.applyEmptyText();\n                    }\n                });\n            }\n        }else if (o.clientValidation !== false){ \n            this.failureType = Ext.form.Action.CLIENT_INVALID;\n            this.form.afterAction(this, false);\n        }\n    },\n\n    \n    success : function(response){\n        var result = this.processResponse(response);\n        if(result === true || result.success){\n            this.form.afterAction(this, true);\n            return;\n        }\n        if(result.errors){\n            this.form.markInvalid(result.errors);\n        }\n        this.failureType = Ext.form.Action.SERVER_INVALID;\n        this.form.afterAction(this, false);\n    },\n\n    \n    handleResponse : function(response){\n        if(this.form.errorReader){\n            var rs = this.form.errorReader.read(response);\n            var errors = [];\n            if(rs.records){\n                for(var i = 0, len = rs.records.length; i < len; i++) {\n                    var r = rs.records[i];\n                    errors[i] = r.data;\n                }\n            }\n            if(errors.length < 1){\n                errors = null;\n            }\n            return {\n                success : rs.success,\n                errors : errors\n            };\n        }\n        return this.decodeResponse(response);\n    }\n});\n\n\n\nExt.form.Action.Load = function(form, options){\n    Ext.form.Action.Load.superclass.constructor.call(this, form, options);\n    this.reader = this.form.reader;\n};\n\nExt.extend(Ext.form.Action.Load, Ext.form.Action, {\n    \n    type : 'load',\n\n    \n    run : function(){\n        Ext.Ajax.request(Ext.apply(\n                this.createCallback(this.options), {\n                    method:this.getMethod(),\n                    url:this.getUrl(false),\n                    headers: this.options.headers,\n                    params:this.getParams()\n        }));\n    },\n\n    \n    success : function(response){\n        var result = this.processResponse(response);\n        if(result === true || !result.success || !result.data){\n            this.failureType = Ext.form.Action.LOAD_FAILURE;\n            this.form.afterAction(this, false);\n            return;\n        }\n        this.form.clearInvalid();\n        this.form.setValues(result.data);\n        this.form.afterAction(this, true);\n    },\n\n    \n    handleResponse : function(response){\n        if(this.form.reader){\n            var rs = this.form.reader.read(response);\n            var data = rs.records && rs.records[0] ? rs.records[0].data : null;\n            return {\n                success : rs.success,\n                data : data\n            };\n        }\n        return this.decodeResponse(response);\n    }\n});\n\n\n\n\nExt.form.Action.DirectLoad = Ext.extend(Ext.form.Action.Load, {\n    constructor: function(form, opts) {\n        Ext.form.Action.DirectLoad.superclass.constructor.call(this, form, opts);\n    },\n    type : 'directload',\n\n    run : function(){\n        var args = this.getParams();\n        args.push(this.success, this);\n        this.form.api.load.apply(window, args);\n    },\n\n    getParams : function() {\n        var buf = [], o = {};\n        var bp = this.form.baseParams;\n        var p = this.options.params;\n        Ext.apply(o, p, bp);\n        var paramOrder = this.form.paramOrder;\n        if(paramOrder){\n            for(var i = 0, len = paramOrder.length; i < len; i++){\n                buf.push(o[paramOrder[i]]);\n            }\n        }else if(this.form.paramsAsHash){\n            buf.push(o);\n        }\n        return buf;\n    },\n    \n    \n    \n    processResponse : function(result) {\n        this.result = result;\n        return result;\n    },\n\n    success : function(response, trans){\n        if(trans.type == Ext.Direct.exceptions.SERVER){\n            response = {};\n        }\n        Ext.form.Action.DirectLoad.superclass.success.call(this, response);\n    }\n});\n\n\nExt.form.Action.DirectSubmit = Ext.extend(Ext.form.Action.Submit, {\n    constructor : function(form, opts) {\n        Ext.form.Action.DirectSubmit.superclass.constructor.call(this, form, opts);\n    },\n    type : 'directsubmit',\n    \n    run : function(){\n        var o = this.options;\n        if(o.clientValidation === false || this.form.isValid()){\n            \n            \n            this.success.params = this.getParams();\n            this.form.api.submit(this.form.el.dom, this.success, this);\n        }else if (o.clientValidation !== false){ \n            this.failureType = Ext.form.Action.CLIENT_INVALID;\n            this.form.afterAction(this, false);\n        }\n    },\n\n    getParams : function() {\n        var o = {};\n        var bp = this.form.baseParams;\n        var p = this.options.params;\n        Ext.apply(o, p, bp);\n        return o;\n    },\n    \n    \n    \n    processResponse : function(result) {\n        this.result = result;\n        return result;\n    },\n\n    success : function(response, trans){\n        if(trans.type == Ext.Direct.exceptions.SERVER){\n            response = {};\n        }\n        Ext.form.Action.DirectSubmit.superclass.success.call(this, response);\n    }\n});\n\nExt.form.Action.ACTION_TYPES = {\n    'load' : Ext.form.Action.Load,\n    'submit' : Ext.form.Action.Submit,\n    'directload' : Ext.form.Action.DirectLoad,\n    'directsubmit' : Ext.form.Action.DirectSubmit\n};\n\nExt.form.VTypes = function(){\n    \n    var alpha = /^[a-zA-Z_]+$/,\n        alphanum = /^[a-zA-Z0-9_]+$/,\n        email = /^(\\w+)([\\-+.\\'][\\w]+)*@(\\w[\\-\\w]*\\.){1,5}([A-Za-z]){2,6}$/,\n        url = /(((^https?)|(^ftp)):\\/\\/([\\-\\w]+\\.)+\\w{2,3}(\\/[%\\-\\w]+(\\.\\w{2,})?)*(([\\w\\-\\.\\?\\\\\\/+@&#;`~=%!]*)(\\.\\w{2,})?)*\\/?)/i;\n\n    \n    return {\n        \n        'email' : function(v){\n            return email.test(v);\n        },\n        \n        'emailText' : 'This field should be an e-mail address in the format \"user@example.com\"',\n        \n        'emailMask' : /[a-z0-9_\\.\\-\\+\\'@]/i,\n\n        /**\n         * The function used to validate URLs\n         * @param {String} value The URL\n         * @return {Boolean} true if the RegExp test passed, and false if not.\n         */\n        'url' : function(v){\n            return url.test(v);\n        },\n        /**\n         * The error text to display when the url validation function returns false.  Defaults to:\n         * <tt>'This field should be a URL in the format \"http:/'+'/www.example.com\"'</tt>\n         * @type String\n         */\n        'urlText' : 'This field should be a URL in the format \"http:/'+'/www.example.com\"',\n\n        /**\n         * The function used to validate alpha values\n         * @param {String} value The value\n         * @return {Boolean} true if the RegExp test passed, and false if not.\n         */\n        'alpha' : function(v){\n            return alpha.test(v);\n        },\n        /**\n         * The error text to display when the alpha validation function returns false.  Defaults to:\n         * <tt>'This field should only contain letters and _'</tt>\n         * @type String\n         */\n        'alphaText' : 'This field should only contain letters and _',\n        /**\n         * The keystroke filter mask to be applied on alpha input.  Defaults to:\n         * <tt>/[a-z_]/i</tt>\n         * @type RegExp\n         */\n        'alphaMask' : /[a-z_]/i,\n\n        /**\n         * The function used to validate alphanumeric values\n         * @param {String} value The value\n         * @return {Boolean} true if the RegExp test passed, and false if not.\n         */\n        'alphanum' : function(v){\n            return alphanum.test(v);\n        },\n        /**\n         * The error text to display when the alphanumeric validation function returns false.  Defaults to:\n         * <tt>'This field should only contain letters, numbers and _'</tt>\n         * @type String\n         */\n        'alphanumText' : 'This field should only contain letters, numbers and _',\n        /**\n         * The keystroke filter mask to be applied on alphanumeric input.  Defaults to:\n         * <tt>/[a-z0-9_]/i</tt>\n         * @type RegExp\n         */\n        'alphanumMask' : /[a-z0-9_]/i\n    };\n}();\n/**\n * @class Ext.grid.GridPanel\n * @extends Ext.Panel\n * <p>This class represents the primary interface of a component based grid control to represent data\n * in a tabular format of rows and columns. The GridPanel is composed of the following:</p>\n * <div class=\"mdetail-params\"><ul>\n * <li><b>{@link Ext.data.Store Store}</b> : The Model holding the data records (rows)\n * <div class=\"sub-desc\"></div></li>\n * <li><b>{@link Ext.grid.ColumnModel Column model}</b> : Column makeup\n * <div class=\"sub-desc\"></div></li>\n * <li><b>{@link Ext.grid.GridView View}</b> : Encapsulates the user interface\n * <div class=\"sub-desc\"></div></li>\n * <li><b>{@link Ext.grid.AbstractSelectionModel selection model}</b> : Selection behavior\n * <div class=\"sub-desc\"></div></li>\n * </ul></div>\n * <p>Example usage:</p>\n * <pre><code>\nvar grid = new Ext.grid.GridPanel({\n    {@link #store}: new {@link Ext.data.Store}({\n        {@link Ext.data.Store#autoDestroy autoDestroy}: true,\n        {@link Ext.data.Store#reader reader}: reader,\n        {@link Ext.data.Store#data data}: xg.dummyData\n    }),\n    {@link #colModel}: new {@link Ext.grid.ColumnModel}({\n        {@link Ext.grid.ColumnModel#defaults defaults}: {\n            width: 120,\n            sortable: true\n        },\n        {@link Ext.grid.ColumnModel#columns columns}: [\n            {id: 'company', header: 'Company', width: 200, sortable: true, dataIndex: 'company'},\n            {header: 'Price', renderer: Ext.util.Format.usMoney, dataIndex: 'price'},\n            {header: 'Change', dataIndex: 'change'},\n            {header: '% Change', dataIndex: 'pctChange'},\n            // instead of specifying renderer: Ext.util.Format.dateRenderer('m/d/Y') use xtype\n            {\n                header: 'Last Updated', width: 135, dataIndex: 'lastChange',\n                xtype: 'datecolumn', format: 'M d, Y'\n            }\n        ]\n    }),\n    {@link #viewConfig}: {\n        {@link Ext.grid.GridView#forceFit forceFit}: true,\n\n//      Return CSS class to apply to rows depending upon data values\n        {@link Ext.grid.GridView#getRowClass getRowClass}: function(record, index) {\n            var c = record.{@link Ext.data.Record#get get}('change');\n            if (c < 0) {\n                return 'price-fall';\n            } else if (c > 0) {\n                return 'price-rise';\n            }\n        }\n    },\n    {@link #sm}: new Ext.grid.RowSelectionModel({singleSelect:true}),\n    width: 600,\n    height: 300,\n    frame: true,\n    title: 'Framed with Row Selection and Horizontal Scrolling',\n    iconCls: 'icon-grid'\n});\n * </code></pre>\n * <p><b><u>Notes:</u></b></p>\n * <div class=\"mdetail-params\"><ul>\n * <li>Although this class inherits many configuration options from base classes, some of them\n * (such as autoScroll, autoWidth, layout, items, etc) are not used by this class, and will\n * have no effect.</li>\n * <li>A grid <b>requires</b> a width in which to scroll its columns, and a height in which to\n * scroll its rows. These dimensions can either be set explicitly through the\n * <tt>{@link Ext.BoxComponent#height height}</tt> and <tt>{@link Ext.BoxComponent#width width}</tt>\n * configuration options or implicitly set by using the grid as a child item of a\n * {@link Ext.Container Container} which will have a {@link Ext.Container#layout layout manager}\n * provide the sizing of its child items (for example the Container of the Grid may specify\n * <tt>{@link Ext.Container#layout layout}:'fit'</tt>).</li>\n * <li>To access the data in a Grid, it is necessary to use the data model encapsulated\n * by the {@link #store Store}. See the {@link #cellclick} event for more details.</li>\n * </ul></div>\n * @constructor\n * @param {Object} config The config object\n * @xtype grid\n */\nExt.grid.GridPanel = Ext.extend(Ext.Panel, {\n    /**\n     * @cfg {String} autoExpandColumn\n     * <p>The <tt>{@link Ext.grid.Column#id id}</tt> of a {@link Ext.grid.Column column} in\n     * this grid that should expand to fill unused space. This value specified here can not\n     * be <tt>0</tt>.</p>\n     * <br><p><b>Note</b>: If the Grid's {@link Ext.grid.GridView view} is configured with\n     * <tt>{@link Ext.grid.GridView#forceFit forceFit}=true</tt> the <tt>autoExpandColumn</tt>\n     * is ignored. See {@link Ext.grid.Column}.<tt>{@link Ext.grid.Column#width width}</tt>\n     * for additional details.</p>\n     * <p>See <tt>{@link #autoExpandMax}</tt> and <tt>{@link #autoExpandMin}</tt> also.</p>\n     */\n    autoExpandColumn : false,\n    \n    \n    autoExpandMax : 1000,\n    \n    \n    autoExpandMin : 50,\n    \n    \n    columnLines : false,\n    \n    \n    \n    \n    \n    \n    ddText : '{0} selected row{1}',\n\n    \n\n    \n    deferRowRender : true,\n    \n    \n    \n    \n    enableColumnHide : true,\n    \n    \n    enableColumnMove : true,\n    \n    \n    enableDragDrop : false,\n    \n    \n    enableHdMenu : true,\n    \n    \n    \n    loadMask : false,\n    \n    \n    \n    minColumnWidth : 25,\n    \n    \n    \n    \n    \n    stripeRows : false,\n    \n    \n    trackMouseOver : true,\n    \n    \n    stateEvents : ['columnmove', 'columnresize', 'sortchange', 'groupchange'],\n    \n    \n    view : null,\n\n    \n    bubbleEvents: [],\n\n    \n\n    \n    rendered : false,\n    \n    \n    viewReady : false,\n\n    \n    initComponent : function() {\n        Ext.grid.GridPanel.superclass.initComponent.call(this);\n\n        if (this.columnLines) {\n            this.cls = (this.cls || '') + ' x-grid-with-col-lines';\n        }\n        \n        \n        this.autoScroll = false;\n        this.autoWidth = false;\n\n        if(Ext.isArray(this.columns)){\n            this.colModel = new Ext.grid.ColumnModel(this.columns);\n            delete this.columns;\n        }\n\n        \n        if(this.ds){\n            this.store = this.ds;\n            delete this.ds;\n        }\n        if(this.cm){\n            this.colModel = this.cm;\n            delete this.cm;\n        }\n        if(this.sm){\n            this.selModel = this.sm;\n            delete this.sm;\n        }\n        this.store = Ext.StoreMgr.lookup(this.store);\n\n        this.addEvents(\n            \n            \n            'click',\n            \n            'dblclick',\n            \n            'contextmenu',\n            \n            'mousedown',\n            \n            'mouseup',\n            \n            'mouseover',\n            \n            'mouseout',\n            \n            'keypress',\n            \n            'keydown',\n\n            \n            \n            'cellmousedown',\n            \n            'rowmousedown',\n            \n            'headermousedown',\n\n            \n            'groupmousedown',\n\n            \n            'rowbodymousedown',\n\n            \n            'containermousedown',\n\n            \n            'cellclick',\n            \n            'celldblclick',\n            \n            'rowclick',\n            \n            'rowdblclick',\n            \n            'headerclick',\n            \n            'headerdblclick',\n            \n            'groupclick',\n            \n            'groupdblclick',\n            \n            'containerclick',\n            \n            'containerdblclick',\n\n            \n            'rowbodyclick',\n            \n            'rowbodydblclick',\n\n            \n            'rowcontextmenu',\n            \n            'cellcontextmenu',\n            \n            'headercontextmenu',\n            \n            'groupcontextmenu',\n            \n            'containercontextmenu',\n            \n            'rowbodycontextmenu',\n            \n            'bodyscroll',\n            \n            'columnresize',\n            \n            'columnmove',\n            \n            'sortchange',\n            \n            'groupchange',\n            \n            'reconfigure',\n            \n            'viewready'\n        );\n    },\n\n    \n    onRender : function(ct, position){\n        Ext.grid.GridPanel.superclass.onRender.apply(this, arguments);\n\n        var c = this.getGridEl();\n\n        this.el.addClass('x-grid-panel');\n\n        this.mon(c, {\n            scope: this,\n            mousedown: this.onMouseDown,\n            click: this.onClick,\n            dblclick: this.onDblClick,\n            contextmenu: this.onContextMenu\n        });\n\n        this.relayEvents(c, ['mousedown','mouseup','mouseover','mouseout','keypress', 'keydown']);\n\n        var view = this.getView();\n        view.init(this);\n        view.render();\n        this.getSelectionModel().init(this);\n    },\n\n    \n    initEvents : function(){\n        Ext.grid.GridPanel.superclass.initEvents.call(this);\n\n        if(this.loadMask){\n            this.loadMask = new Ext.LoadMask(this.bwrap,\n                    Ext.apply({store:this.store}, this.loadMask));\n        }\n    },\n\n    initStateEvents : function(){\n        Ext.grid.GridPanel.superclass.initStateEvents.call(this);\n        this.mon(this.colModel, 'hiddenchange', this.saveState, this, {delay: 100});\n    },\n\n    applyState : function(state){\n        var cm = this.colModel,\n            cs = state.columns,\n            store = this.store,\n            s,\n            c,\n            colIndex;\n\n        if(cs){\n            for(var i = 0, len = cs.length; i < len; i++){\n                s = cs[i];\n                c = cm.getColumnById(s.id);\n                if(c){\n                    colIndex = cm.getIndexById(s.id);\n                    cm.setState(colIndex, {\n                        hidden: s.hidden,\n                        width: s.width,\n                        sortable: c.sortable,\n                        editable: c.editable\n                    });\n                    if(colIndex != i){\n                        cm.moveColumn(colIndex, i);\n                    }\n                }\n            }\n        }\n        if(store){\n            s = state.sort;\n            if(s){\n                store[store.remoteSort ? 'setDefaultSort' : 'sort'](s.field, s.direction);\n            }\n            s = state.group;\n            if(store.groupBy){\n                if(s){\n                    store.groupBy(s);\n                }else{\n                    store.clearGrouping();\n                }\n            }\n\n        }\n        var o = Ext.apply({}, state);\n        delete o.columns;\n        delete o.sort;\n        Ext.grid.GridPanel.superclass.applyState.call(this, o);\n    },\n\n    getState : function(){\n        var o = {columns: []},\n            store = this.store,\n            ss,\n            gs;\n\n        for(var i = 0, c; (c = this.colModel.config[i]); i++){\n            o.columns[i] = {\n                id: c.id,\n                width: c.width\n            };\n            if(c.hidden){\n                o.columns[i].hidden = true;\n            }\n        }\n        if(store){\n            ss = store.getSortState();\n            if(ss){\n                o.sort = ss;\n            }\n            if(store.getGroupState){\n                gs = store.getGroupState();\n                if(gs){\n                    o.group = gs;\n                }\n            }\n        }\n        return o;\n    },\n\n    \n    afterRender : function(){\n        Ext.grid.GridPanel.superclass.afterRender.call(this);\n        var v = this.view;\n        this.on('bodyresize', v.layout, v);\n        v.layout(true);\n        if(this.deferRowRender){\n            if (!this.deferRowRenderTask){\n                this.deferRowRenderTask = new Ext.util.DelayedTask(v.afterRender, this.view);\n            }\n            this.deferRowRenderTask.delay(10);\n        }else{\n            v.afterRender();\n        }\n        this.viewReady = true;\n    },\n\n    \n    reconfigure : function(store, colModel){\n        var rendered = this.rendered;\n        if(rendered){\n            if(this.loadMask){\n                this.loadMask.destroy();\n                this.loadMask = new Ext.LoadMask(this.bwrap,\n                        Ext.apply({}, {store:store}, this.initialConfig.loadMask));\n            }\n        }\n        if(this.view){\n            this.view.initData(store, colModel);\n        }\n        this.store = store;\n        this.colModel = colModel;\n        if(rendered){\n            this.view.refresh(true);\n        }\n        this.fireEvent('reconfigure', this, store, colModel);\n    },\n\n    \n    onDestroy : function(){\n        if (this.deferRowRenderTask && this.deferRowRenderTask.cancel){\n            this.deferRowRenderTask.cancel();\n        }\n        if(this.rendered){\n            Ext.destroy(this.view, this.loadMask);\n        }else if(this.store && this.store.autoDestroy){\n            this.store.destroy();\n        }\n        Ext.destroy(this.colModel, this.selModel);\n        this.store = this.selModel = this.colModel = this.view = this.loadMask = null;\n        Ext.grid.GridPanel.superclass.onDestroy.call(this);\n    },\n\n    \n    processEvent : function(name, e){\n        this.view.processEvent(name, e);\n    },\n\n    \n    onClick : function(e){\n        this.processEvent('click', e);\n    },\n\n    \n    onMouseDown : function(e){\n        this.processEvent('mousedown', e);\n    },\n\n    \n    onContextMenu : function(e, t){\n        this.processEvent('contextmenu', e);\n    },\n\n    \n    onDblClick : function(e){\n        this.processEvent('dblclick', e);\n    },\n\n    \n    walkCells : function(row, col, step, fn, scope){\n        var cm    = this.colModel,\n            clen  = cm.getColumnCount(),\n            ds    = this.store,\n            rlen  = ds.getCount(),\n            first = true;\n\n        if(step < 0){\n            if(col < 0){\n                row--;\n                first = false;\n            }\n            while(row >= 0){\n                if(!first){\n                    col = clen-1;\n                }\n                first = false;\n                while(col >= 0){\n                    if(fn.call(scope || this, row, col, cm) === true){\n                        return [row, col];\n                    }\n                    col--;\n                }\n                row--;\n            }\n        } else {\n            if(col >= clen){\n                row++;\n                first = false;\n            }\n            while(row < rlen){\n                if(!first){\n                    col = 0;\n                }\n                first = false;\n                while(col < clen){\n                    if(fn.call(scope || this, row, col, cm) === true){\n                        return [row, col];\n                    }\n                    col++;\n                }\n                row++;\n            }\n        }\n        return null;\n    },\n\n    \n    getGridEl : function(){\n        return this.body;\n    },\n\n    \n    stopEditing : Ext.emptyFn,\n\n    \n    getSelectionModel : function(){\n        if(!this.selModel){\n            this.selModel = new Ext.grid.RowSelectionModel(\n                    this.disableSelection ? {selectRow: Ext.emptyFn} : null);\n        }\n        return this.selModel;\n    },\n\n    \n    getStore : function(){\n        return this.store;\n    },\n\n    \n    getColumnModel : function(){\n        return this.colModel;\n    },\n\n    \n    getView : function() {\n        if (!this.view) {\n            this.view = new Ext.grid.GridView(this.viewConfig);\n        }\n        \n        return this.view;\n    },\n    \n    getDragDropText : function(){\n        var count = this.selModel.getCount ? this.selModel.getCount() : 1;\n        return String.format(this.ddText, count, count == 1 ? '' : 's');\n    }\n\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n\n\n\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n});\nExt.reg('grid', Ext.grid.GridPanel);\nExt.grid.PivotGrid = Ext.extend(Ext.grid.GridPanel, {\n    \n    \n    aggregator: 'sum',\n    \n    \n    renderer: undefined,\n    \n    \n    \n    \n    \n    \n    \n    \n    initComponent: function() {\n        Ext.grid.PivotGrid.superclass.initComponent.apply(this, arguments);\n        \n        this.initAxes();\n        \n        \n        this.enableColumnResize = false;\n        \n        this.viewConfig = Ext.apply(this.viewConfig || {}, {\n            forceFit: true\n        });\n        \n        \n        \n        this.colModel = new Ext.grid.ColumnModel({});\n    },\n    \n    \n    getAggregator: function() {\n        if (typeof this.aggregator == 'string') {\n            return Ext.grid.PivotAggregatorMgr.types[this.aggregator];\n        } else {\n            return this.aggregator;\n        }\n    },\n    \n    \n    setAggregator: function(aggregator) {\n        this.aggregator = aggregator;\n    },\n    \n    \n    setMeasure: function(measure) {\n        this.measure = measure;\n    },\n    \n    \n    setLeftAxis: function(axis, refresh) {\n        \n        this.leftAxis = axis;\n        \n        if (refresh) {\n            this.view.refresh();\n        }\n    },\n    \n    \n    setTopAxis: function(axis, refresh) {\n        \n        this.topAxis = axis;\n        \n        if (refresh) {\n            this.view.refresh();\n        }\n    },\n    \n    \n    initAxes: function() {\n        var PivotAxis = Ext.grid.PivotAxis;\n        \n        if (!(this.leftAxis instanceof PivotAxis)) {\n            this.setLeftAxis(new PivotAxis({\n                orientation: 'vertical',\n                dimensions : this.leftAxis || [],\n                store      : this.store\n            }));\n        };\n        \n        if (!(this.topAxis instanceof PivotAxis)) {\n            this.setTopAxis(new PivotAxis({\n                orientation: 'horizontal',\n                dimensions : this.topAxis || [],\n                store      : this.store\n            }));\n        };\n    },\n    \n    \n    extractData: function() {\n        var records  = this.store.data.items,\n            recCount = records.length,\n            cells    = [],\n            record, i, j, k;\n        \n        if (recCount == 0) {\n            return [];\n        }\n        \n        var leftTuples = this.leftAxis.getTuples(),\n            leftCount  = leftTuples.length,\n            topTuples  = this.topAxis.getTuples(),\n            topCount   = topTuples.length,\n            aggregator = this.getAggregator();\n        \n        for (i = 0; i < recCount; i++) {\n            record = records[i];\n            \n            for (j = 0; j < leftCount; j++) {\n                cells[j] = cells[j] || [];\n                \n                if (leftTuples[j].matcher(record) === true) {\n                    for (k = 0; k < topCount; k++) {\n                        cells[j][k] = cells[j][k] || [];\n                        \n                        if (topTuples[k].matcher(record)) {\n                            cells[j][k].push(record);\n                        }\n                    }\n                }\n            }\n        }\n        \n        var rowCount = cells.length,\n            colCount, row;\n        \n        for (i = 0; i < rowCount; i++) {\n            row = cells[i];\n            colCount = row.length;\n            \n            for (j = 0; j < colCount; j++) {\n                cells[i][j] = aggregator(cells[i][j], this.measure);\n            }\n        }\n        \n        return cells;\n    },\n    \n    \n    getView: function() {\n        if (!this.view) {\n            this.view = new Ext.grid.PivotGridView(this.viewConfig);\n        }\n        \n        return this.view;\n    }\n});\n\nExt.reg('pivotgrid', Ext.grid.PivotGrid);\n\n\nExt.grid.PivotAggregatorMgr = new Ext.AbstractManager();\n\nExt.grid.PivotAggregatorMgr.registerType('sum', function(records, measure) {\n    var length = records.length,\n        total  = 0,\n        i;\n    \n    for (i = 0; i < length; i++) {\n        total += records[i].get(measure);\n    }\n    \n    return total;\n});\n\nExt.grid.PivotAggregatorMgr.registerType('avg', function(records, measure) {\n    var length = records.length,\n        total  = 0,\n        i;\n    \n    for (i = 0; i < length; i++) {\n        total += records[i].get(measure);\n    }\n    \n    return (total / length) || 'n/a';\n});\n\nExt.grid.PivotAggregatorMgr.registerType('min', function(records, measure) {\n    var data   = [],\n        length = records.length,\n        i;\n    \n    for (i = 0; i < length; i++) {\n        data.push(records[i].get(measure));\n    }\n    \n    return Math.min.apply(this, data) || 'n/a';\n});\n\nExt.grid.PivotAggregatorMgr.registerType('max', function(records, measure) {\n    var data   = [],\n        length = records.length,\n        i;\n    \n    for (i = 0; i < length; i++) {\n        data.push(records[i].get(measure));\n    }\n    \n    return Math.max.apply(this, data) || 'n/a';\n});\n\nExt.grid.PivotAggregatorMgr.registerType('count', function(records, measure) {\n    return records.length;\n});\nExt.grid.GridView = Ext.extend(Ext.util.Observable, {\n    \n\n    \n\n    \n\n    \n\n    \n\n    \n    deferEmptyText : true,\n\n    \n    scrollOffset : undefined,\n\n    \n    autoFill : false,\n\n    \n    forceFit : false,\n\n    \n    sortClasses : ['sort-asc', 'sort-desc'],\n\n    \n    sortAscText : 'Sort Ascending',\n\n    \n    sortDescText : 'Sort Descending',\n    \n    \n    hideSortIcons: false,\n\n    \n    columnsText : 'Columns',\n\n    \n    selectedRowClass : 'x-grid3-row-selected',\n\n    \n    borderWidth : 2,\n    tdClass : 'x-grid3-cell',\n    hdCls : 'x-grid3-hd',\n    \n    \n    \n    markDirty : true,\n\n    \n    cellSelectorDepth : 4,\n    \n    \n    rowSelectorDepth : 10,\n\n    \n    rowBodySelectorDepth : 10,\n\n    \n    cellSelector : 'td.x-grid3-cell',\n    \n    \n    rowSelector : 'div.x-grid3-row',\n\n    \n    rowBodySelector : 'div.x-grid3-row-body',\n\n    \n    firstRowCls: 'x-grid3-row-first',\n    lastRowCls: 'x-grid3-row-last',\n    rowClsRe: /(?:^|\\s+)x-grid3-row-(first|last|alt)(?:\\s+|$)/g,\n    \n    \n    headerMenuOpenCls: 'x-grid3-hd-menu-open',\n    \n    \n    rowOverCls: 'x-grid3-row-over',\n\n    constructor : function(config) {\n        Ext.apply(this, config);\n        \n        \n        this.addEvents(\n            \n            'beforerowremoved',\n            \n            \n            'beforerowsinserted',\n            \n            \n            'beforerefresh',\n            \n            \n            'rowremoved',\n            \n            \n            'rowsinserted',\n            \n            \n            'rowupdated',\n            \n            \n            'refresh'\n        );\n        \n        Ext.grid.GridView.superclass.constructor.call(this);\n    },\n\n    \n    \n    \n    masterTpl: new Ext.Template(\n        '<div class=\"x-grid3\" hidefocus=\"true\">',\n            '<div class=\"x-grid3-viewport\">',\n                '<div class=\"x-grid3-header\">',\n                    '<div class=\"x-grid3-header-inner\">',\n                        '<div class=\"x-grid3-header-offset\" style=\"{ostyle}\">{header}</div>',\n                    '</div>',\n                    '<div class=\"x-clear\"></div>',\n                '</div>',\n                '<div class=\"x-grid3-scroller\">',\n                    '<div class=\"x-grid3-body\" style=\"{bstyle}\">{body}</div>',\n                    '<a href=\"#\" class=\"x-grid3-focus\" tabIndex=\"-1\"></a>',\n                '</div>',\n            '</div>',\n            '<div class=\"x-grid3-resize-marker\">&#160;</div>',\n            '<div class=\"x-grid3-resize-proxy\">&#160;</div>',\n        '</div>'\n    ),\n    \n    \n    headerTpl: new Ext.Template(\n        '<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\" style=\"{tstyle}\">',\n            '<thead>',\n                '<tr class=\"x-grid3-hd-row\">{cells}</tr>',\n            '</thead>',\n        '</table>'\n    ),\n    \n    \n    bodyTpl: new Ext.Template('{rows}'),\n    \n    \n    cellTpl: new Ext.Template(\n        '<td class=\"x-grid3-col x-grid3-cell x-grid3-td-{id} {css}\" style=\"{style}\" tabIndex=\"0\" {cellAttr}>',\n            '<div class=\"x-grid3-cell-inner x-grid3-col-{id} x-unselectable\" unselectable=\"on\" {attr}>{value}</div>',\n        '</td>'\n    ),\n    \n    \n    initTemplates : function() {\n        var templates = this.templates || {},\n            template, name,\n            \n            headerCellTpl = new Ext.Template(\n                '<td class=\"x-grid3-hd x-grid3-cell x-grid3-td-{id} {css}\" style=\"{style}\">',\n                    '<div {tooltip} {attr} class=\"x-grid3-hd-inner x-grid3-hd-{id}\" unselectable=\"on\" style=\"{istyle}\">', \n                        this.grid.enableHdMenu ? '<a class=\"x-grid3-hd-btn\" href=\"#\"></a>' : '',\n                        '{value}',\n                        '<img alt=\"\" class=\"x-grid3-sort-icon\" src=\"', Ext.BLANK_IMAGE_URL, '\" />',\n                    '</div>',\n                '</td>'\n            ),\n        \n            rowBodyText = [\n                '<tr class=\"x-grid3-row-body-tr\" style=\"{bodyStyle}\">',\n                    '<td colspan=\"{cols}\" class=\"x-grid3-body-cell\" tabIndex=\"0\" hidefocus=\"on\">',\n                        '<div class=\"x-grid3-row-body\">{body}</div>',\n                    '</td>',\n                '</tr>'\n            ].join(\"\"),\n        \n            innerText = [\n                '<table class=\"x-grid3-row-table\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\" style=\"{tstyle}\">',\n                     '<tbody>',\n                        '<tr>{cells}</tr>',\n                        this.enableRowBody ? rowBodyText : '',\n                     '</tbody>',\n                '</table>'\n            ].join(\"\");\n        \n        Ext.applyIf(templates, {\n            hcell   : headerCellTpl,\n            cell    : this.cellTpl,\n            body    : this.bodyTpl,\n            header  : this.headerTpl,\n            master  : this.masterTpl,\n            row     : new Ext.Template('<div class=\"x-grid3-row {alt}\" style=\"{tstyle}\">' + innerText + '</div>'),\n            rowInner: new Ext.Template(innerText)\n        });\n\n        for (name in templates) {\n            template = templates[name];\n            \n            if (template && Ext.isFunction(template.compile) && !template.compiled) {\n                template.disableFormats = true;\n                template.compile();\n            }\n        }\n\n        this.templates = templates;\n        this.colRe = new RegExp('x-grid3-td-([^\\\\s]+)', '');\n    },\n\n    \n    fly : function(el) {\n        if (!this._flyweight) {\n            this._flyweight = new Ext.Element.Flyweight(document.body);\n        }\n        this._flyweight.dom = el;\n        return this._flyweight;\n    },\n\n    \n    getEditorParent : function() {\n        return this.scroller.dom;\n    },\n\n    \n    initElements : function() {\n        var Element  = Ext.Element,\n            el       = Ext.get(this.grid.getGridEl().dom.firstChild),\n            mainWrap = new Element(el.child('div.x-grid3-viewport')),\n            mainHd   = new Element(mainWrap.child('div.x-grid3-header')),\n            scroller = new Element(mainWrap.child('div.x-grid3-scroller'));\n        \n        if (this.grid.hideHeaders) {\n            mainHd.setDisplayed(false);\n        }\n        \n        if (this.forceFit) {\n            scroller.setStyle('overflow-x', 'hidden');\n        }\n        \n        \n        \n        Ext.apply(this, {\n            el      : el,\n            mainWrap: mainWrap,\n            scroller: scroller,\n            mainHd  : mainHd,\n            innerHd : mainHd.child('div.x-grid3-header-inner').dom,\n            mainBody: new Element(Element.fly(scroller).child('div.x-grid3-body')),\n            focusEl : new Element(Element.fly(scroller).child('a')),\n            \n            resizeMarker: new Element(el.child('div.x-grid3-resize-marker')),\n            resizeProxy : new Element(el.child('div.x-grid3-resize-proxy'))\n        });\n        \n        this.focusEl.swallowEvent('click', true);\n    },\n\n    \n    getRows : function() {\n        return this.hasRows() ? this.mainBody.dom.childNodes : [];\n    },\n\n    \n\n    \n    findCell : function(el) {\n        if (!el) {\n            return false;\n        }\n        return this.fly(el).findParent(this.cellSelector, this.cellSelectorDepth);\n    },\n\n    \n    findCellIndex : function(el, requiredCls) {\n        var cell = this.findCell(el),\n            hasCls;\n        \n        if (cell) {\n            hasCls = this.fly(cell).hasClass(requiredCls);\n            if (!requiredCls || hasCls) {\n                return this.getCellIndex(cell);\n            }\n        }\n        return false;\n    },\n\n    \n    getCellIndex : function(el) {\n        if (el) {\n            var match = el.className.match(this.colRe);\n            \n            if (match && match[1]) {\n                return this.cm.getIndexById(match[1]);\n            }\n        }\n        return false;\n    },\n\n    \n    findHeaderCell : function(el) {\n        var cell = this.findCell(el);\n        return cell && this.fly(cell).hasClass(this.hdCls) ? cell : null;\n    },\n\n    \n    findHeaderIndex : function(el){\n        return this.findCellIndex(el, this.hdCls);\n    },\n\n    \n    findRow : function(el) {\n        if (!el) {\n            return false;\n        }\n        return this.fly(el).findParent(this.rowSelector, this.rowSelectorDepth);\n    },\n\n    \n    findRowIndex : function(el) {\n        var row = this.findRow(el);\n        return row ? row.rowIndex : false;\n    },\n\n    \n    findRowBody : function(el) {\n        if (!el) {\n            return false;\n        }\n        \n        return this.fly(el).findParent(this.rowBodySelector, this.rowBodySelectorDepth);\n    },\n\n    \n\n    \n    getRow : function(row) {\n        return this.getRows()[row];\n    },\n\n    \n    getCell : function(row, col) {\n        return Ext.fly(this.getRow(row)).query(this.cellSelector)[col]; \n    },\n\n    \n    getHeaderCell : function(index) {\n        return this.mainHd.dom.getElementsByTagName('td')[index];\n    },\n\n    \n\n    \n    addRowClass : function(rowId, cls) {\n        var row = this.getRow(rowId);\n        if (row) {\n            this.fly(row).addClass(cls);\n        }\n    },\n\n    \n    removeRowClass : function(row, cls) {\n        var r = this.getRow(row);\n        if(r){\n            this.fly(r).removeClass(cls);\n        }\n    },\n\n    \n    removeRow : function(row) {\n        Ext.removeNode(this.getRow(row));\n        this.syncFocusEl(row);\n    },\n\n    \n    removeRows : function(firstRow, lastRow) {\n        var bd = this.mainBody.dom,\n            rowIndex;\n            \n        for (rowIndex = firstRow; rowIndex <= lastRow; rowIndex++){\n            Ext.removeNode(bd.childNodes[firstRow]);\n        }\n        \n        this.syncFocusEl(firstRow);\n    },\n\n    \n    \n    \n    getScrollState : function() {\n        var sb = this.scroller.dom;\n        \n        return {\n            left: sb.scrollLeft, \n            top : sb.scrollTop\n        };\n    },\n\n    \n    restoreScroll : function(state) {\n        var sb = this.scroller.dom;\n        sb.scrollLeft = state.left;\n        sb.scrollTop  = state.top;\n    },\n\n    \n    scrollToTop : function() {\n        var dom = this.scroller.dom;\n        \n        dom.scrollTop  = 0;\n        dom.scrollLeft = 0;\n    },\n\n    \n    syncScroll : function() {\n        this.syncHeaderScroll();\n        var mb = this.scroller.dom;\n        this.grid.fireEvent('bodyscroll', mb.scrollLeft, mb.scrollTop);\n    },\n\n    \n    syncHeaderScroll : function() {\n        var innerHd    = this.innerHd,\n            scrollLeft = this.scroller.dom.scrollLeft;\n        \n        innerHd.scrollLeft = scrollLeft;\n        innerHd.scrollLeft = scrollLeft; \n    },\n    \n    \n    updateSortIcon : function(col, dir) {\n        var sortClasses = this.sortClasses,\n            sortClass   = sortClasses[dir == \"DESC\" ? 1 : 0],\n            headers     = this.mainHd.select('td').removeClass(sortClasses);\n        \n        headers.item(col).addClass(sortClass);\n    },\n\n    \n    updateAllColumnWidths : function() {\n        var totalWidth = this.getTotalWidth(),\n            colCount   = this.cm.getColumnCount(),\n            rows       = this.getRows(),\n            rowCount   = rows.length,\n            widths     = [],\n            row, rowFirstChild, trow, i, j;\n        \n        for (i = 0; i < colCount; i++) {\n            widths[i] = this.getColumnWidth(i);\n            this.getHeaderCell(i).style.width = widths[i];\n        }\n        \n        this.updateHeaderWidth();\n        \n        for (i = 0; i < rowCount; i++) {\n            row = rows[i];\n            row.style.width = totalWidth;\n            rowFirstChild = row.firstChild;\n            \n            if (rowFirstChild) {\n                rowFirstChild.style.width = totalWidth;\n                trow = rowFirstChild.rows[0];\n                \n                for (j = 0; j < colCount; j++) {\n                    trow.childNodes[j].style.width = widths[j];\n                }\n            }\n        }\n        \n        this.onAllColumnWidthsUpdated(widths, totalWidth);\n    },\n\n    \n    updateColumnWidth : function(column, width) {\n        var columnWidth = this.getColumnWidth(column),\n            totalWidth  = this.getTotalWidth(),\n            headerCell  = this.getHeaderCell(column),\n            nodes       = this.getRows(),\n            nodeCount   = nodes.length,\n            row, i, firstChild;\n        \n        this.updateHeaderWidth();\n        headerCell.style.width = columnWidth;\n        \n        for (i = 0; i < nodeCount; i++) {\n            row = nodes[i];\n            firstChild = row.firstChild;\n            \n            row.style.width = totalWidth;\n            if (firstChild) {\n                firstChild.style.width = totalWidth;\n                firstChild.rows[0].childNodes[column].style.width = columnWidth;\n            }\n        }\n        \n        this.onColumnWidthUpdated(column, columnWidth, totalWidth);\n    },\n    \n    \n    updateColumnHidden : function(col, hidden) {\n        var totalWidth = this.getTotalWidth(),\n            display    = hidden ? 'none' : '',\n            headerCell = this.getHeaderCell(col),\n            nodes      = this.getRows(),\n            nodeCount  = nodes.length,\n            row, rowFirstChild, i;\n        \n        this.updateHeaderWidth();\n        headerCell.style.display = display;\n        \n        for (i = 0; i < nodeCount; i++) {\n            row = nodes[i];\n            row.style.width = totalWidth;\n            rowFirstChild = row.firstChild;\n            \n            if (rowFirstChild) {\n                rowFirstChild.style.width = totalWidth;\n                rowFirstChild.rows[0].childNodes[col].style.display = display;\n            }\n        }\n        \n        this.onColumnHiddenUpdated(col, hidden, totalWidth);\n        delete this.lastViewWidth; \n        this.layout();\n    },\n\n    \n    doRender : function(columns, records, store, startRow, colCount, stripe) {\n        var templates = this.templates,\n            cellTemplate = templates.cell,\n            rowTemplate = templates.row,\n            last = colCount - 1,\n            tstyle = 'width:' + this.getTotalWidth() + ';',\n            \n            rowBuffer = [],\n            colBuffer = [],\n            rowParams = {tstyle: tstyle},\n            meta = {},\n            len  = records.length,\n            alt,\n            column,\n            record, i, j, rowIndex;\n\n        \n        for (j = 0; j < len; j++) {\n            record    = records[j];\n            colBuffer = [];\n\n            rowIndex = j + startRow;\n\n            \n            for (i = 0; i < colCount; i++) {\n                column = columns[i];\n                \n                meta.id    = column.id;\n                meta.css   = i === 0 ? 'x-grid3-cell-first ' : (i == last ? 'x-grid3-cell-last ' : '');\n                meta.attr  = meta.cellAttr = '';\n                meta.style = column.style;\n                meta.value = column.renderer.call(column.scope, record.data[column.name], meta, record, rowIndex, i, store);\n\n                if (Ext.isEmpty(meta.value)) {\n                    meta.value = '&#160;';\n                }\n\n                if (this.markDirty && record.dirty && typeof record.modified[column.name] != 'undefined') {\n                    meta.css += ' x-grid3-dirty-cell';\n                }\n\n                colBuffer[colBuffer.length] = cellTemplate.apply(meta);\n            }\n\n            alt = [];\n            \n            if (stripe && ((rowIndex + 1) % 2 === 0)) {\n                alt[0] = 'x-grid3-row-alt';\n            }\n\n            if (record.dirty) {\n                alt[1] = ' x-grid3-dirty-row';\n            }\n\n            rowParams.cols = colCount;\n\n            if (this.getRowClass) {\n                alt[2] = this.getRowClass(record, rowIndex, rowParams, store);\n            }\n\n            rowParams.alt   = alt.join(' ');\n            rowParams.cells = colBuffer.join('');\n\n            rowBuffer[rowBuffer.length] = rowTemplate.apply(rowParams);\n        }\n\n        return rowBuffer.join('');\n    },\n\n    \n    processRows : function(startRow, skipStripe) {\n        if (!this.ds || this.ds.getCount() < 1) {\n            return;\n        }\n\n        var rows   = this.getRows(),\n            length = rows.length,\n            row, i;\n\n        skipStripe = skipStripe || !this.grid.stripeRows;\n        startRow   = startRow   || 0;\n\n        for (i = 0; i < length; i++) {\n            row = rows[i];\n            if (row) {\n                row.rowIndex = i;\n                if (!skipStripe) {\n                    row.className = row.className.replace(this.rowClsRe, ' ');\n                    if ((i + 1) % 2 === 0){\n                        row.className += ' x-grid3-row-alt';\n                    }\n                }\n            }\n        }\n\n        \n        if (startRow === 0) {\n            Ext.fly(rows[0]).addClass(this.firstRowCls);\n        }\n\n        Ext.fly(rows[length - 1]).addClass(this.lastRowCls);\n    },\n    \n    \n    afterRender : function() {\n        if (!this.ds || !this.cm) {\n            return;\n        }\n        \n        this.mainBody.dom.innerHTML = this.renderBody() || '&#160;';\n        this.processRows(0, true);\n\n        if (this.deferEmptyText !== true) {\n            this.applyEmptyText();\n        }\n        \n        this.grid.fireEvent('viewready', this.grid);\n    },\n    \n    \n    afterRenderUI: function() {\n        var grid = this.grid;\n        \n        this.initElements();\n\n        \n        Ext.fly(this.innerHd).on('click', this.handleHdDown, this);\n\n        this.mainHd.on({\n            scope    : this,\n            mouseover: this.handleHdOver,\n            mouseout : this.handleHdOut,\n            mousemove: this.handleHdMove\n        });\n\n        this.scroller.on('scroll', this.syncScroll,  this);\n        \n        if (grid.enableColumnResize !== false) {\n            this.splitZone = new Ext.grid.GridView.SplitDragZone(grid, this.mainHd.dom);\n        }\n\n        if (grid.enableColumnMove) {\n            this.columnDrag = new Ext.grid.GridView.ColumnDragZone(grid, this.innerHd);\n            this.columnDrop = new Ext.grid.HeaderDropZone(grid, this.mainHd.dom);\n        }\n\n        if (grid.enableHdMenu !== false) {\n            this.hmenu = new Ext.menu.Menu({id: grid.id + '-hctx'});\n            this.hmenu.add(\n                {itemId:'asc',  text: this.sortAscText,  cls: 'xg-hmenu-sort-asc'},\n                {itemId:'desc', text: this.sortDescText, cls: 'xg-hmenu-sort-desc'}\n            );\n\n            if (grid.enableColumnHide !== false) {\n                this.colMenu = new Ext.menu.Menu({id:grid.id + '-hcols-menu'});\n                this.colMenu.on({\n                    scope     : this,\n                    beforeshow: this.beforeColMenuShow,\n                    itemclick : this.handleHdMenuClick\n                });\n                this.hmenu.add({\n                    itemId: 'sortSep',\n                    xtype: 'menuseparator'\n                }, {\n                    itemId:'columns',\n                    hideOnClick: false,\n                    text: this.columnsText,\n                    menu: this.colMenu,\n                    iconCls: 'x-cols-icon'\n                });\n            }\n\n            this.hmenu.on('itemclick', this.handleHdMenuClick, this);\n        }\n\n        if (grid.trackMouseOver) {\n            this.mainBody.on({\n                scope    : this,\n                mouseover: this.onRowOver,\n                mouseout : this.onRowOut\n            });\n        }\n\n        if (grid.enableDragDrop || grid.enableDrag) {\n            this.dragZone = new Ext.grid.GridDragZone(grid, {\n                ddGroup : grid.ddGroup || 'GridDD'\n            });\n        }\n\n        this.updateHeaderSortState();\n    },\n\n    \n    renderUI : function() {\n        var templates = this.templates;\n\n        return templates.master.apply({\n            body  : templates.body.apply({rows:'&#160;'}),\n            header: this.renderHeaders(),\n            ostyle: 'width:' + this.getOffsetWidth() + ';',\n            bstyle: 'width:' + this.getTotalWidth()  + ';'\n        });\n    },\n\n    \n    processEvent : function(name, e) {\n        var target = e.getTarget(),\n            grid   = this.grid,\n            header = this.findHeaderIndex(target),\n            row, cell, col, body;\n\n        grid.fireEvent(name, e);\n\n        if (header !== false) {\n            grid.fireEvent('header' + name, grid, header, e);\n        } else {\n            row = this.findRowIndex(target);\n\n\n\n\n            if (row !== false) {\n                cell = this.findCellIndex(target);\n                if (cell !== false) {\n                    col = grid.colModel.getColumnAt(cell);\n                    if (grid.fireEvent('cell' + name, grid, row, cell, e) !== false) {\n                        if (!col || (col.processEvent && (col.processEvent(name, e, grid, row, cell) !== false))) {\n                            grid.fireEvent('row' + name, grid, row, e);\n                        }\n                    }\n                } else {\n                    if (grid.fireEvent('row' + name, grid, row, e) !== false) {\n                        (body = this.findRowBody(target)) && grid.fireEvent('rowbody' + name, grid, row, e);\n                    }\n                }\n            } else {\n                grid.fireEvent('container' + name, grid, e);\n            }\n        }\n    },\n\n    \n    layout : function(initial) {\n        if (!this.mainBody) {\n            return; \n        }\n\n        var grid       = this.grid,\n            gridEl     = grid.getGridEl(),\n            gridSize   = gridEl.getSize(true),\n            gridWidth  = gridSize.width,\n            gridHeight = gridSize.height,\n            scroller   = this.scroller,\n            scrollStyle, headerHeight, scrollHeight;\n        \n        if (gridWidth < 20 || gridHeight < 20) {\n            return;\n        }\n        \n        if (grid.autoHeight) {\n            scrollStyle = scroller.dom.style;\n            scrollStyle.overflow = 'visible';\n            \n            if (Ext.isWebKit) {\n                scrollStyle.position = 'static';\n            }\n        } else {\n            this.el.setSize(gridWidth, gridHeight);\n            \n            headerHeight = this.mainHd.getHeight();\n            scrollHeight = gridHeight - headerHeight;\n            \n            scroller.setSize(gridWidth, scrollHeight);\n            \n            if (this.innerHd) {\n                this.innerHd.style.width = (gridWidth) + \"px\";\n            }\n        }\n        \n        if (this.forceFit || (initial === true && this.autoFill)) {\n            if (this.lastViewWidth != gridWidth) {\n                this.fitColumns(false, false);\n                this.lastViewWidth = gridWidth;\n            }\n        } else {\n            this.autoExpand();\n            this.syncHeaderScroll();\n        }\n        \n        this.onLayout(gridWidth, scrollHeight);\n    },\n\n    \n    \n    onLayout : function(vw, vh) {\n        \n    },\n\n    onColumnWidthUpdated : function(col, w, tw) {\n        \n    },\n\n    onAllColumnWidthsUpdated : function(ws, tw) {\n        \n    },\n\n    onColumnHiddenUpdated : function(col, hidden, tw) {\n        \n    },\n\n    updateColumnText : function(col, text) {\n        \n    },\n\n    afterMove : function(colIndex) {\n        \n    },\n\n    \n    \n    init : function(grid) {\n        this.grid = grid;\n\n        this.initTemplates();\n        this.initData(grid.store, grid.colModel);\n        this.initUI(grid);\n    },\n\n    \n    getColumnId : function(index){\n        return this.cm.getColumnId(index);\n    },\n\n    \n    getOffsetWidth : function() {\n        return (this.cm.getTotalWidth() + this.getScrollOffset()) + 'px';\n    },\n\n    \n    getScrollOffset: function() {\n        return Ext.num(this.scrollOffset, Ext.getScrollBarWidth());\n    },\n\n    \n    renderHeaders : function() {\n        var colModel   = this.cm,\n            templates  = this.templates,\n            headerTpl  = templates.hcell,\n            properties = {},\n            colCount   = colModel.getColumnCount(),\n            last       = colCount - 1,\n            cells      = [],\n            i, cssCls;\n        \n        for (i = 0; i < colCount; i++) {\n            if (i == 0) {\n                cssCls = 'x-grid3-cell-first ';\n            } else {\n                cssCls = i == last ? 'x-grid3-cell-last ' : '';\n            }\n            \n            properties = {\n                id     : colModel.getColumnId(i),\n                value  : colModel.getColumnHeader(i) || '',\n                style  : this.getColumnStyle(i, true),\n                css    : cssCls,\n                tooltip: this.getColumnTooltip(i)\n            };\n            \n            if (colModel.config[i].align == 'right') {\n                properties.istyle = 'padding-right: 16px;';\n            } else {\n                delete properties.istyle;\n            }\n            \n            cells[i] = headerTpl.apply(properties);\n        }\n        \n        return templates.header.apply({\n            cells : cells.join(\"\"),\n            tstyle: String.format(\"width: {0};\", this.getTotalWidth())\n        });\n    },\n\n    \n    getColumnTooltip : function(i) {\n        var tooltip = this.cm.getColumnTooltip(i);\n        if (tooltip) {\n            if (Ext.QuickTips.isEnabled()) {\n                return 'ext:qtip=\"' + tooltip + '\"';\n            } else {\n                return 'title=\"' + tooltip + '\"';\n            }\n        }\n        \n        return '';\n    },\n\n    \n    beforeUpdate : function() {\n        this.grid.stopEditing(true);\n    },\n\n    \n    updateHeaders : function() {\n        this.innerHd.firstChild.innerHTML = this.renderHeaders();\n        \n        this.updateHeaderWidth(false);\n    },\n    \n    \n    updateHeaderWidth: function(updateMain) {\n        var innerHdChild = this.innerHd.firstChild,\n            totalWidth   = this.getTotalWidth();\n        \n        innerHdChild.style.width = this.getOffsetWidth();\n        innerHdChild.firstChild.style.width = totalWidth;\n        \n        if (updateMain !== false) {\n            this.mainBody.dom.style.width = totalWidth;\n        }\n    },\n\n    \n    focusRow : function(row) {\n        this.focusCell(row, 0, false);\n    },\n\n    \n    focusCell : function(row, col, hscroll) {\n        this.syncFocusEl(this.ensureVisible(row, col, hscroll));\n        \n        var focusEl = this.focusEl;\n        \n        if (Ext.isGecko) {\n            focusEl.focus();\n        } else {\n            focusEl.focus.defer(1, focusEl);\n        }\n    },\n\n    \n    resolveCell : function(row, col, hscroll) {\n        if (!Ext.isNumber(row)) {\n            row = row.rowIndex;\n        }\n        \n        if (!this.ds) {\n            return null;\n        }\n        \n        if (row < 0 || row >= this.ds.getCount()) {\n            return null;\n        }\n        col = (col !== undefined ? col : 0);\n\n        var rowEl    = this.getRow(row),\n            colModel = this.cm,\n            colCount = colModel.getColumnCount(),\n            cellEl;\n            \n        if (!(hscroll === false && col === 0)) {\n            while (col < colCount && colModel.isHidden(col)) {\n                col++;\n            }\n            \n            cellEl = this.getCell(row, col);\n        }\n\n        return {row: rowEl, cell: cellEl};\n    },\n\n    \n    getResolvedXY : function(resolved) {\n        if (!resolved) {\n            return null;\n        }\n        \n        var cell = resolved.cell,\n            row  = resolved.row;\n        \n        if (cell) {\n            return Ext.fly(cell).getXY();\n        } else {\n            return [this.el.getX(), Ext.fly(row).getY()];\n        }\n    },\n\n    \n    syncFocusEl : function(row, col, hscroll) {\n        var xy = row;\n        \n        if (!Ext.isArray(xy)) {\n            row = Math.min(row, Math.max(0, this.getRows().length-1));\n            \n            if (isNaN(row)) {\n                return;\n            }\n            \n            xy = this.getResolvedXY(this.resolveCell(row, col, hscroll));\n        }\n        \n        this.focusEl.setXY(xy || this.scroller.getXY());\n    },\n\n    \n    ensureVisible : function(row, col, hscroll) {\n        var resolved = this.resolveCell(row, col, hscroll);\n        \n        if (!resolved || !resolved.row) {\n            return null;\n        }\n\n        var rowEl  = resolved.row,\n            cellEl = resolved.cell,\n            c = this.scroller.dom,\n            p = rowEl,\n            ctop = 0,\n            stop = this.el.dom;\n\n        while (p && p != stop) {\n            ctop += p.offsetTop;\n            p = p.offsetParent;\n        }\n\n        ctop -= this.mainHd.dom.offsetHeight;\n        stop = parseInt(c.scrollTop, 10);\n\n        var cbot = ctop + rowEl.offsetHeight,\n            ch = c.clientHeight,\n            sbot = stop + ch;\n\n\n        if (ctop < stop) {\n          c.scrollTop = ctop;\n        } else if(cbot > sbot) {\n            c.scrollTop = cbot-ch;\n        }\n\n        if (hscroll !== false) {\n            var cleft  = parseInt(cellEl.offsetLeft, 10),\n                cright = cleft + cellEl.offsetWidth,\n                sleft  = parseInt(c.scrollLeft, 10),\n                sright = sleft + c.clientWidth;\n                \n            if (cleft < sleft) {\n                c.scrollLeft = cleft;\n            } else if(cright > sright) {\n                c.scrollLeft = cright-c.clientWidth;\n            }\n        }\n        \n        return this.getResolvedXY(resolved);\n    },\n\n    \n    insertRows : function(dm, firstRow, lastRow, isUpdate) {\n        var last = dm.getCount() - 1;\n        if( !isUpdate && firstRow === 0 && lastRow >= last) {\n            this.fireEvent('beforerowsinserted', this, firstRow, lastRow);\n                this.refresh();\n            this.fireEvent('rowsinserted', this, firstRow, lastRow);\n        } else {\n            if (!isUpdate) {\n                this.fireEvent('beforerowsinserted', this, firstRow, lastRow);\n            }\n            var html = this.renderRows(firstRow, lastRow),\n                before = this.getRow(firstRow);\n            if (before) {\n                if(firstRow === 0){\n                    Ext.fly(this.getRow(0)).removeClass(this.firstRowCls);\n                }\n                Ext.DomHelper.insertHtml('beforeBegin', before, html);\n            } else {\n                var r = this.getRow(last - 1);\n                if(r){\n                    Ext.fly(r).removeClass(this.lastRowCls);\n                }\n                Ext.DomHelper.insertHtml('beforeEnd', this.mainBody.dom, html);\n            }\n            if (!isUpdate) {\n                this.processRows(firstRow);\n                this.fireEvent('rowsinserted', this, firstRow, lastRow);\n            } else if (firstRow === 0 || firstRow >= last) {\n                \n                Ext.fly(this.getRow(firstRow)).addClass(firstRow === 0 ? this.firstRowCls : this.lastRowCls);\n            }\n        }\n        this.syncFocusEl(firstRow);\n    },\n\n    \n    deleteRows : function(dm, firstRow, lastRow) {\n        if (dm.getRowCount() < 1) {\n            this.refresh();\n        } else {\n            this.fireEvent('beforerowsdeleted', this, firstRow, lastRow);\n\n            this.removeRows(firstRow, lastRow);\n\n            this.processRows(firstRow);\n            this.fireEvent('rowsdeleted', this, firstRow, lastRow);\n        }\n    },\n\n    \n    getColumnStyle : function(colIndex, isHeader) {\n        var colModel  = this.cm,\n            colConfig = colModel.config,\n            style     = isHeader ? '' : colConfig[colIndex].css || '',\n            align     = colConfig[colIndex].align;\n        \n        style += String.format(\"width: {0};\", this.getColumnWidth(colIndex));\n        \n        if (colModel.isHidden(colIndex)) {\n            style += 'display: none; ';\n        }\n        \n        if (align) {\n            style += String.format(\"text-align: {0};\", align);\n        }\n        \n        return style;\n    },\n\n    \n    getColumnWidth : function(column) {\n        var columnWidth = this.cm.getColumnWidth(column),\n            borderWidth = this.borderWidth;\n        \n        if (Ext.isNumber(columnWidth)) {\n            if (Ext.isBorderBox) {\n                return columnWidth + \"px\";\n            } else {\n                return Math.max(columnWidth - borderWidth, 0) + \"px\";\n            }\n        } else {\n            return columnWidth;\n        }\n    },\n\n    \n    getTotalWidth : function() {\n        return this.cm.getTotalWidth() + 'px';\n    },\n\n    \n    fitColumns : function(preventRefresh, onlyExpand, omitColumn) {\n        var grid          = this.grid,\n            colModel      = this.cm,\n            totalColWidth = colModel.getTotalWidth(false),\n            gridWidth     = this.getGridInnerWidth(),\n            extraWidth    = gridWidth - totalColWidth,\n            columns       = [],\n            extraCol      = 0,\n            width         = 0,\n            colWidth, fraction, i;\n        \n        \n        if (gridWidth < 20 || extraWidth === 0) {\n            return false;\n        }\n        \n        var visibleColCount = colModel.getColumnCount(true),\n            totalColCount   = colModel.getColumnCount(false),\n            adjCount        = visibleColCount - (Ext.isNumber(omitColumn) ? 1 : 0);\n        \n        if (adjCount === 0) {\n            adjCount = 1;\n            omitColumn = undefined;\n        }\n        \n        \n        for (i = 0; i < totalColCount; i++) {\n            if (!colModel.isFixed(i) && i !== omitColumn) {\n                colWidth = colModel.getColumnWidth(i);\n                columns.push(i, colWidth);\n                \n                if (!colModel.isHidden(i)) {\n                    extraCol = i;\n                    width += colWidth;\n                }\n            }\n        }\n        \n        fraction = (gridWidth - colModel.getTotalWidth()) / width;\n        \n        while (columns.length) {\n            colWidth = columns.pop();\n            i        = columns.pop();\n            \n            colModel.setColumnWidth(i, Math.max(grid.minColumnWidth, Math.floor(colWidth + colWidth * fraction)), true);\n        }\n        \n        \n        totalColWidth = colModel.getTotalWidth(false);\n        \n        if (totalColWidth > gridWidth) {\n            var adjustCol = (adjCount == visibleColCount) ? extraCol : omitColumn,\n                newWidth  = Math.max(1, colModel.getColumnWidth(adjustCol) - (totalColWidth - gridWidth));\n            \n            colModel.setColumnWidth(adjustCol, newWidth, true);\n        }\n        \n        if (preventRefresh !== true) {\n            this.updateAllColumnWidths();\n        }\n        \n        return true;\n    },\n\n    \n    autoExpand : function(preventUpdate) {\n        var grid             = this.grid,\n            colModel         = this.cm,\n            gridWidth        = this.getGridInnerWidth(),\n            totalColumnWidth = colModel.getTotalWidth(false),\n            autoExpandColumn = grid.autoExpandColumn;\n        \n        if (!this.userResized && autoExpandColumn) {\n            if (gridWidth != totalColumnWidth) {\n                \n                var colIndex     = colModel.getIndexById(autoExpandColumn),\n                    currentWidth = colModel.getColumnWidth(colIndex),\n                    desiredWidth = gridWidth - totalColumnWidth + currentWidth,\n                    newWidth     = Math.min(Math.max(desiredWidth, grid.autoExpandMin), grid.autoExpandMax);\n                \n                if (currentWidth != newWidth) {\n                    colModel.setColumnWidth(colIndex, newWidth, true);\n                    \n                    if (preventUpdate !== true) {\n                        this.updateColumnWidth(colIndex, newWidth);\n                    }\n                }\n            }\n        }\n    },\n    \n    \n    getGridInnerWidth: function() {\n        return this.grid.getGridEl().getWidth(true) - this.getScrollOffset();\n    },\n\n    \n    getColumnData : function() {\n        var columns  = [],\n            colModel = this.cm,\n            colCount = colModel.getColumnCount(),\n            fields   = this.ds.fields,\n            i, name;\n        \n        for (i = 0; i < colCount; i++) {\n            name = colModel.getDataIndex(i);\n            \n            columns[i] = {\n                name    : Ext.isDefined(name) ? name : (fields.get(i) ? fields.get(i).name : undefined),\n                renderer: colModel.getRenderer(i),\n                scope   : colModel.getRendererScope(i),\n                id      : colModel.getColumnId(i),\n                style   : this.getColumnStyle(i)\n            };\n        }\n        \n        return columns;\n    },\n\n    \n    renderRows : function(startRow, endRow) {\n        var grid     = this.grid,\n            store    = grid.store,\n            stripe   = grid.stripeRows,\n            colModel = grid.colModel,\n            colCount = colModel.getColumnCount(),\n            rowCount = store.getCount(),\n            records;\n        \n        if (rowCount < 1) {\n            return '';\n        }\n        \n        startRow = startRow || 0;\n        endRow   = Ext.isDefined(endRow) ? endRow : rowCount - 1;\n        records  = store.getRange(startRow, endRow);\n        \n        return this.doRender(this.getColumnData(), records, store, startRow, colCount, stripe);\n    },\n\n    \n    renderBody : function(){\n        var markup = this.renderRows() || '&#160;';\n        return this.templates.body.apply({rows: markup});\n    },\n\n    \n    refreshRow: function(record) {\n        var store     = this.ds,\n            colCount  = this.cm.getColumnCount(),\n            columns   = this.getColumnData(),\n            last      = colCount - 1,\n            cls       = ['x-grid3-row'],\n            rowParams = {\n                tstyle: String.format(\"width: {0};\", this.getTotalWidth())\n            },\n            colBuffer = [],\n            cellTpl   = this.templates.cell,\n            rowIndex, row, column, meta, css, i;\n        \n        if (Ext.isNumber(record)) {\n            rowIndex = record;\n            record   = store.getAt(rowIndex);\n        } else {\n            rowIndex = store.indexOf(record);\n        }\n        \n        \n        if (!record || rowIndex < 0) {\n            return;\n        }\n        \n        \n        for (i = 0; i < colCount; i++) {\n            column = columns[i];\n            \n            if (i == 0) {\n                css = 'x-grid3-cell-first';\n            } else {\n                css = (i == last) ? 'x-grid3-cell-last ' : '';\n            }\n            \n            meta = {\n                id      : column.id,\n                style   : column.style,\n                css     : css,\n                attr    : \"\",\n                cellAttr: \"\"\n            };\n            \n            meta.value = column.renderer.call(column.scope, record.data[column.name], meta, record, rowIndex, i, store);\n            \n            if (Ext.isEmpty(meta.value)) {\n                meta.value = '&#160;';\n            }\n            \n            if (this.markDirty && record.dirty && typeof record.modified[column.name] != 'undefined') {\n                meta.css += ' x-grid3-dirty-cell';\n            }\n            \n            colBuffer[i] = cellTpl.apply(meta);\n        }\n        \n        row = this.getRow(rowIndex);\n        row.className = '';\n        \n        if (this.grid.stripeRows && ((rowIndex + 1) % 2 === 0)) {\n            cls.push('x-grid3-row-alt');\n        }\n        \n        if (this.getRowClass) {\n            rowParams.cols = colCount;\n            cls.push(this.getRowClass(record, rowIndex, rowParams, store));\n        }\n        \n        this.fly(row).addClass(cls).setStyle(rowParams.tstyle);\n        rowParams.cells = colBuffer.join(\"\");\n        row.innerHTML = this.templates.rowInner.apply(rowParams);\n        \n        this.fireEvent('rowupdated', this, rowIndex, record);\n    },\n\n    \n    refresh : function(headersToo) {\n        this.fireEvent('beforerefresh', this);\n        this.grid.stopEditing(true);\n\n        var result = this.renderBody();\n        this.mainBody.update(result).setWidth(this.getTotalWidth());\n        if (headersToo === true) {\n            this.updateHeaders();\n            this.updateHeaderSortState();\n        }\n        this.processRows(0, true);\n        this.layout();\n        this.applyEmptyText();\n        this.fireEvent('refresh', this);\n    },\n\n    \n    applyEmptyText : function() {\n        if (this.emptyText && !this.hasRows()) {\n            this.mainBody.update('<div class=\"x-grid-empty\">' + this.emptyText + '</div>');\n        }\n    },\n\n    \n    updateHeaderSortState : function() {\n        var state = this.ds.getSortState();\n        if (!state) {\n            return;\n        }\n\n        if (!this.sortState || (this.sortState.field != state.field || this.sortState.direction != state.direction)) {\n            this.grid.fireEvent('sortchange', this.grid, state);\n        }\n\n        this.sortState = state;\n\n        var sortColumn = this.cm.findColumnIndex(state.field);\n        if (sortColumn != -1) {\n            var sortDir = state.direction;\n            this.updateSortIcon(sortColumn, sortDir);\n        }\n    },\n\n    \n    clearHeaderSortState : function() {\n        if (!this.sortState) {\n            return;\n        }\n        this.grid.fireEvent('sortchange', this.grid, null);\n        this.mainHd.select('td').removeClass(this.sortClasses);\n        delete this.sortState;\n    },\n\n    \n    destroy : function() {\n        var me              = this,\n            grid            = me.grid,\n            gridEl          = grid.getGridEl(),\n            dragZone        = me.dragZone,\n            splitZone       = me.splitZone,\n            columnDrag      = me.columnDrag,\n            columnDrop      = me.columnDrop,\n            scrollToTopTask = me.scrollToTopTask,\n            columnDragData,\n            columnDragProxy;\n        \n        if (scrollToTopTask && scrollToTopTask.cancel) {\n            scrollToTopTask.cancel();\n        }\n        \n        Ext.destroyMembers(me, 'colMenu', 'hmenu');\n\n        me.initData(null, null);\n        me.purgeListeners();\n        \n        Ext.fly(me.innerHd).un(\"click\", me.handleHdDown, me);\n\n        if (grid.enableColumnMove) {\n            columnDragData = columnDrag.dragData;\n            columnDragProxy = columnDrag.proxy;\n            Ext.destroy(\n                columnDrag.el,\n                columnDragProxy.ghost,\n                columnDragProxy.el,\n                columnDrop.el,\n                columnDrop.proxyTop,\n                columnDrop.proxyBottom,\n                columnDragData.ddel,\n                columnDragData.header\n            );\n            \n            if (columnDragProxy.anim) {\n                Ext.destroy(columnDragProxy.anim);\n            }\n            \n            delete columnDragProxy.ghost;\n            delete columnDragData.ddel;\n            delete columnDragData.header;\n            columnDrag.destroy();\n            \n            delete Ext.dd.DDM.locationCache[columnDrag.id];\n            delete columnDrag._domRef;\n\n            delete columnDrop.proxyTop;\n            delete columnDrop.proxyBottom;\n            columnDrop.destroy();\n            delete Ext.dd.DDM.locationCache[\"gridHeader\" + gridEl.id];\n            delete columnDrop._domRef;\n            delete Ext.dd.DDM.ids[columnDrop.ddGroup];\n        }\n\n        if (splitZone) { \n            splitZone.destroy();\n            delete splitZone._domRef;\n            delete Ext.dd.DDM.ids[\"gridSplitters\" + gridEl.id];\n        }\n\n        Ext.fly(me.innerHd).removeAllListeners();\n        Ext.removeNode(me.innerHd);\n        delete me.innerHd;\n\n        Ext.destroy(\n            me.el,\n            me.mainWrap,\n            me.mainHd,\n            me.scroller,\n            me.mainBody,\n            me.focusEl,\n            me.resizeMarker,\n            me.resizeProxy,\n            me.activeHdBtn,\n            me._flyweight,\n            dragZone,\n            splitZone\n        );\n\n        delete grid.container;\n\n        if (dragZone) {\n            dragZone.destroy();\n        }\n\n        Ext.dd.DDM.currentTarget = null;\n        delete Ext.dd.DDM.locationCache[gridEl.id];\n\n        Ext.EventManager.removeResizeListener(me.onWindowResize, me);\n    },\n\n    \n    onDenyColumnHide : function() {\n\n    },\n\n    \n    render : function() {\n        if (this.autoFill) {\n            var ct = this.grid.ownerCt;\n            \n            if (ct && ct.getLayout()) {\n                ct.on('afterlayout', function() {\n                    this.fitColumns(true, true);\n                    this.updateHeaders();\n                    this.updateHeaderSortState();\n                }, this, {single: true});\n            }\n        } else if (this.forceFit) {\n            this.fitColumns(true, false);\n        } else if (this.grid.autoExpandColumn) {\n            this.autoExpand(true);\n        }\n        \n        this.grid.getGridEl().dom.innerHTML = this.renderUI();\n        \n        this.afterRenderUI();\n    },\n\n    \n    \n    \n    initData : function(newStore, newColModel) {\n        var me = this;\n        \n        if (me.ds) {\n            var oldStore = me.ds;\n            \n            oldStore.un('add', me.onAdd, me);\n            oldStore.un('load', me.onLoad, me);\n            oldStore.un('clear', me.onClear, me);\n            oldStore.un('remove', me.onRemove, me);\n            oldStore.un('update', me.onUpdate, me);\n            oldStore.un('datachanged', me.onDataChange, me);\n            \n            if (oldStore !== newStore && oldStore.autoDestroy) {\n                oldStore.destroy();\n            }\n        }\n        \n        if (newStore) {\n            newStore.on({\n                scope      : me,\n                load       : me.onLoad,\n                add        : me.onAdd,\n                remove     : me.onRemove,\n                update     : me.onUpdate,\n                clear      : me.onClear,\n                datachanged: me.onDataChange\n            });\n        }\n        \n        if (me.cm) {\n            var oldColModel = me.cm;\n            \n            oldColModel.un('configchange', me.onColConfigChange, me);\n            oldColModel.un('widthchange',  me.onColWidthChange, me);\n            oldColModel.un('headerchange', me.onHeaderChange, me);\n            oldColModel.un('hiddenchange', me.onHiddenChange, me);\n            oldColModel.un('columnmoved',  me.onColumnMove, me);\n        }\n        \n        if (newColModel) {\n            delete me.lastViewWidth;\n            \n            newColModel.on({\n                scope       : me,\n                configchange: me.onColConfigChange,\n                widthchange : me.onColWidthChange,\n                headerchange: me.onHeaderChange,\n                hiddenchange: me.onHiddenChange,\n                columnmoved : me.onColumnMove\n            });\n        }\n        \n        me.ds = newStore;\n        me.cm = newColModel;\n    },\n\n    \n    onDataChange : function(){\n        this.refresh(true);\n        this.updateHeaderSortState();\n        this.syncFocusEl(0);\n    },\n\n    \n    onClear : function() {\n        this.refresh();\n        this.syncFocusEl(0);\n    },\n\n    \n    onUpdate : function(store, record) {\n        this.refreshRow(record);\n    },\n\n    \n    onAdd : function(store, records, index) {\n        this.insertRows(store, index, index + (records.length-1));\n    },\n\n    \n    onRemove : function(store, record, index, isUpdate) {\n        if (isUpdate !== true) {\n            this.fireEvent('beforerowremoved', this, index, record);\n        }\n        \n        this.removeRow(index);\n        \n        if (isUpdate !== true) {\n            this.processRows(index);\n            this.applyEmptyText();\n            this.fireEvent('rowremoved', this, index, record);\n        }\n    },\n\n    \n    onLoad : function() {\n        if (Ext.isGecko) {\n            if (!this.scrollToTopTask) {\n                this.scrollToTopTask = new Ext.util.DelayedTask(this.scrollToTop, this);\n            }\n            this.scrollToTopTask.delay(1);\n        } else {\n            this.scrollToTop();\n        }\n    },\n\n    \n    onColWidthChange : function(cm, col, width) {\n        this.updateColumnWidth(col, width);\n    },\n\n    \n    onHeaderChange : function(cm, col, text) {\n        this.updateHeaders();\n    },\n\n    \n    onHiddenChange : function(cm, col, hidden) {\n        this.updateColumnHidden(col, hidden);\n    },\n\n    \n    onColumnMove : function(cm, oldIndex, newIndex) {\n        this.indexMap = null;\n        this.refresh(true);\n        this.restoreScroll(this.getScrollState());\n        \n        this.afterMove(newIndex);\n        this.grid.fireEvent('columnmove', oldIndex, newIndex);\n    },\n\n    \n    onColConfigChange : function() {\n        delete this.lastViewWidth;\n        this.indexMap = null;\n        this.refresh(true);\n    },\n\n    \n    \n    initUI : function(grid) {\n        grid.on('headerclick', this.onHeaderClick, this);\n    },\n\n    \n    initEvents : Ext.emptyFn,\n\n    \n    onHeaderClick : function(g, index) {\n        if (this.headersDisabled || !this.cm.isSortable(index)) {\n            return;\n        }\n        g.stopEditing(true);\n        g.store.sort(this.cm.getDataIndex(index));\n    },\n\n    \n    onRowOver : function(e, target) {\n        var row = this.findRowIndex(target);\n        \n        if (row !== false) {\n            this.addRowClass(row, this.rowOverCls);\n        }\n    },\n\n    \n    onRowOut : function(e, target) {\n        var row = this.findRowIndex(target);\n        \n        if (row !== false && !e.within(this.getRow(row), true)) {\n            this.removeRowClass(row, this.rowOverCls);\n        }\n    },\n\n    \n    onRowSelect : function(row) {\n        this.addRowClass(row, this.selectedRowClass);\n    },\n\n    \n    onRowDeselect : function(row) {\n        this.removeRowClass(row, this.selectedRowClass);\n    },\n\n    \n    onCellSelect : function(row, col) {\n        var cell = this.getCell(row, col);\n        if (cell) {\n            this.fly(cell).addClass('x-grid3-cell-selected');\n        }\n    },\n\n    \n    onCellDeselect : function(row, col) {\n        var cell = this.getCell(row, col);\n        if (cell) {\n            this.fly(cell).removeClass('x-grid3-cell-selected');\n        }\n    },\n\n    \n    handleWheel : function(e) {\n        e.stopPropagation();\n    },\n\n    \n    onColumnSplitterMoved : function(cellIndex, width) {\n        this.userResized = true;\n        this.grid.colModel.setColumnWidth(cellIndex, width, true);\n\n        if (this.forceFit) {\n            this.fitColumns(true, false, cellIndex);\n            this.updateAllColumnWidths();\n        } else {\n            this.updateColumnWidth(cellIndex, width);\n            this.syncHeaderScroll();\n        }\n\n        this.grid.fireEvent('columnresize', cellIndex, width);\n    },\n\n    \n    beforeColMenuShow : function() {\n        var colModel = this.cm,\n            colCount = colModel.getColumnCount(),\n            colMenu  = this.colMenu,\n            i;\n\n        colMenu.removeAll();\n\n        for (i = 0; i < colCount; i++) {\n            if (colModel.config[i].hideable !== false) {\n                colMenu.add(new Ext.menu.CheckItem({\n                    text       : colModel.getColumnHeader(i),\n                    itemId     : 'col-' + colModel.getColumnId(i),\n                    checked    : !colModel.isHidden(i),\n                    disabled   : colModel.config[i].hideable === false,\n                    hideOnClick: false\n                }));\n            }\n        }\n    },\n    \n    \n    handleHdMenuClick : function(item) {\n        var store     = this.ds,\n            dataIndex = this.cm.getDataIndex(this.hdCtxIndex);\n\n        switch (item.getItemId()) {\n            case 'asc':\n                store.sort(dataIndex, 'ASC');\n                break;\n            case 'desc':\n                store.sort(dataIndex, 'DESC');\n                break;\n            default:\n                this.handleHdMenuClickDefault(item);\n        }\n        return true;\n    },\n    \n    \n    handleHdMenuClickDefault: function(item) {\n        var colModel = this.cm,\n            itemId   = item.getItemId(),\n            index    = colModel.getIndexById(itemId.substr(4));\n\n        if (index != -1) {\n            if (item.checked && colModel.getColumnsBy(this.isHideableColumn, this).length <= 1) {\n                this.onDenyColumnHide();\n                return;\n            }\n            colModel.setHidden(index, item.checked);\n        }\n    },\n\n    \n    handleHdDown : function(e, target) {\n        if (Ext.fly(target).hasClass('x-grid3-hd-btn')) {\n            e.stopEvent();\n            \n            var colModel  = this.cm,\n                header    = this.findHeaderCell(target),\n                index     = this.getCellIndex(header),\n                sortable  = colModel.isSortable(index),\n                menu      = this.hmenu,\n                menuItems = menu.items,\n                menuCls   = this.headerMenuOpenCls,\n                sep;\n            \n            this.hdCtxIndex = index;\n            \n            Ext.fly(header).addClass(menuCls);\n            if (this.hideSortIcons) {\n                menuItems.get('asc').setVisible(sortable);\n                menuItems.get('desc').setVisible(sortable);\n                sep = menuItems.get('sortSep');\n                if (sep) {\n                    sep.setVisible(sortable);    \n                }\n            } else {\n                menuItems.get('asc').setDisabled(!sortable);\n                menuItems.get('desc').setDisabled(!sortable);\n            }\n            \n            menu.on('hide', function() {\n                Ext.fly(header).removeClass(menuCls);\n            }, this, {single:true});\n            \n            menu.show(target, 'tl-bl?');\n        }\n    },\n\n    \n    handleHdMove : function(e) {\n        var header = this.findHeaderCell(this.activeHdRef);\n        \n        if (header && !this.headersDisabled) {\n            var handleWidth  = this.splitHandleWidth || 5,\n                activeRegion = this.activeHdRegion,\n                headerStyle  = header.style,\n                colModel     = this.cm,\n                cursor       = '',\n                pageX        = e.getPageX();\n                \n            if (this.grid.enableColumnResize !== false) {\n                var activeHeaderIndex = this.activeHdIndex,\n                    previousVisible   = this.getPreviousVisible(activeHeaderIndex),\n                    currentResizable  = colModel.isResizable(activeHeaderIndex),\n                    previousResizable = previousVisible && colModel.isResizable(previousVisible),\n                    inLeftResizer     = pageX - activeRegion.left <= handleWidth,\n                    inRightResizer    = activeRegion.right - pageX <= (!this.activeHdBtn ? handleWidth : 2);\n                \n                if (inLeftResizer && previousResizable) {\n                    cursor = Ext.isAir ? 'move' : Ext.isWebKit ? 'e-resize' : 'col-resize'; \n                } else if (inRightResizer && currentResizable) {\n                    cursor = Ext.isAir ? 'move' : Ext.isWebKit ? 'w-resize' : 'col-resize';\n                }\n            }\n            \n            headerStyle.cursor = cursor;\n        }\n    },\n    \n    \n    getPreviousVisible: function(index) {\n        while (index > 0) {\n            if (!this.cm.isHidden(index - 1)) {\n                return index;\n            }\n            index--;\n        }\n        return undefined;\n    },\n\n    \n    handleHdOver : function(e, target) {\n        var header = this.findHeaderCell(target);\n        \n        if (header && !this.headersDisabled) {\n            var fly = this.fly(header);\n            \n            this.activeHdRef = target;\n            this.activeHdIndex = this.getCellIndex(header);\n            this.activeHdRegion = fly.getRegion();\n            \n            if (!this.isMenuDisabled(this.activeHdIndex, fly)) {\n                fly.addClass('x-grid3-hd-over');\n                this.activeHdBtn = fly.child('.x-grid3-hd-btn');\n                \n                if (this.activeHdBtn) {\n                    this.activeHdBtn.dom.style.height = (header.firstChild.offsetHeight - 1) + 'px';\n                }\n            }\n        }\n    },\n\n    \n    handleHdOut : function(e, target) {\n        var header = this.findHeaderCell(target);\n        \n        if (header && (!Ext.isIE9m || !e.within(header, true))) {\n            this.activeHdRef = null;\n            this.fly(header).removeClass('x-grid3-hd-over');\n            header.style.cursor = '';\n        }\n    },\n    \n    \n    isMenuDisabled: function(cellIndex, el) {\n        return this.cm.isMenuDisabled(cellIndex);\n    },\n\n    \n    hasRows : function() {\n        var fc = this.mainBody.dom.firstChild;\n        return fc && fc.nodeType == 1 && fc.className != 'x-grid-empty';\n    },\n    \n    \n    isHideableColumn : function(c) {\n        return !c.hidden;\n    },\n\n    \n    bind : function(d, c) {\n        this.initData(d, c);\n    }\n});\n\n\n\n\nExt.grid.GridView.SplitDragZone = Ext.extend(Ext.dd.DDProxy, {\n\n    constructor: function(grid, hd){\n        this.grid = grid;\n        this.view = grid.getView();\n        this.marker = this.view.resizeMarker;\n        this.proxy = this.view.resizeProxy;\n        Ext.grid.GridView.SplitDragZone.superclass.constructor.call(this, hd,\n            'gridSplitters' + this.grid.getGridEl().id, {\n            dragElId : Ext.id(this.proxy.dom), resizeFrame:false\n        });\n        this.scroll = false;\n        this.hw = this.view.splitHandleWidth || 5;\n    },\n\n    b4StartDrag : function(x, y){\n        this.dragHeadersDisabled = this.view.headersDisabled;\n        this.view.headersDisabled = true;\n        var h = this.view.mainWrap.getHeight();\n        this.marker.setHeight(h);\n        this.marker.show();\n        this.marker.alignTo(this.view.getHeaderCell(this.cellIndex), 'tl-tl', [-2, 0]);\n        this.proxy.setHeight(h);\n        var w = this.cm.getColumnWidth(this.cellIndex),\n            minw = Math.max(w-this.grid.minColumnWidth, 0);\n        this.resetConstraints();\n        this.setXConstraint(minw, 1000);\n        this.setYConstraint(0, 0);\n        this.minX = x - minw;\n        this.maxX = x + 1000;\n        this.startPos = x;\n        Ext.dd.DDProxy.prototype.b4StartDrag.call(this, x, y);\n    },\n\n    allowHeaderDrag : function(e){\n        return true;\n    },\n\n    handleMouseDown : function(e){\n        var t = this.view.findHeaderCell(e.getTarget());\n        if(t && this.allowHeaderDrag(e)){\n            var xy = this.view.fly(t).getXY(), \n                x = xy[0],\n                exy = e.getXY(), \n                ex = exy[0],\n                w = t.offsetWidth, \n                adjust = false;\n                \n            if((ex - x) <= this.hw){\n                adjust = -1;\n            }else if((x+w) - ex <= this.hw){\n                adjust = 0;\n            }\n            if(adjust !== false){\n                this.cm = this.grid.colModel;\n                var ci = this.view.getCellIndex(t);\n                if(adjust == -1){\n                  if (ci + adjust < 0) {\n                    return;\n                  }\n                    while(this.cm.isHidden(ci+adjust)){\n                        --adjust;\n                        if(ci+adjust < 0){\n                            return;\n                        }\n                    }\n                }\n                this.cellIndex = ci+adjust;\n                this.split = t.dom;\n                if(this.cm.isResizable(this.cellIndex) && !this.cm.isFixed(this.cellIndex)){\n                    Ext.grid.GridView.SplitDragZone.superclass.handleMouseDown.apply(this, arguments);\n                }\n            }else if(this.view.columnDrag){\n                this.view.columnDrag.callHandleMouseDown(e);\n            }\n        }\n    },\n\n    endDrag : function(e){\n        this.marker.hide();\n        var v = this.view,\n            endX = Math.max(this.minX, e.getPageX()),\n            diff = endX - this.startPos,\n            disabled = this.dragHeadersDisabled;\n            \n        v.onColumnSplitterMoved(this.cellIndex, this.cm.getColumnWidth(this.cellIndex)+diff);\n        setTimeout(function(){\n            v.headersDisabled = disabled;\n        }, 50);\n    },\n\n    autoOffset : function(){\n        this.setDelta(0,0);\n    }\n});\n\nExt.grid.PivotGridView = Ext.extend(Ext.grid.GridView, {\n    \n    \n    colHeaderCellCls: 'grid-hd-group-cell',\n    \n    \n    title: '',\n    \n    \n    \n    \n    getColumnHeaders: function() {\n        return this.grid.topAxis.buildHeaders();;\n    },\n    \n    \n    getRowHeaders: function() {\n        return this.grid.leftAxis.buildHeaders();\n    },\n    \n    \n    renderRows : function(startRow, endRow) {\n        var grid          = this.grid,\n            rows          = grid.extractData(),\n            rowCount      = rows.length,\n            templates     = this.templates,\n            renderer      = grid.renderer,\n            hasRenderer   = typeof renderer == 'function',\n            getCellCls    = this.getCellCls,\n            hasGetCellCls = typeof getCellCls == 'function',\n            cellTemplate  = templates.cell,\n            rowTemplate   = templates.row,\n            rowBuffer     = [],\n            meta          = {},\n            tstyle        = 'width:' + this.getGridInnerWidth() + 'px;',\n            colBuffer, colCount, column, i, row;\n        \n        startRow = startRow || 0;\n        endRow   = Ext.isDefined(endRow) ? endRow : rowCount - 1;\n        \n        for (i = 0; i < rowCount; i++) {\n            row = rows[i];\n            colCount  = row.length;\n            colBuffer = [];\n            \n            \n            for (var j = 0; j < colCount; j++) {\n                \n                meta.id    = i + '-' + j;\n                meta.css   = j === 0 ? 'x-grid3-cell-first ' : (j == (colCount - 1) ? 'x-grid3-cell-last ' : '');\n                meta.attr  = meta.cellAttr = '';\n                meta.value = row[j];\n\n                if (Ext.isEmpty(meta.value)) {\n                    meta.value = '&#160;';\n                }\n                \n                if (hasRenderer) {\n                    meta.value = renderer(meta.value);\n                }\n                \n                if (hasGetCellCls) {\n                    meta.css += getCellCls(meta.value) + ' ';\n                }\n\n                colBuffer[colBuffer.length] = cellTemplate.apply(meta);\n            }\n            \n            rowBuffer[rowBuffer.length] = rowTemplate.apply({\n                tstyle: tstyle,\n                cols  : colCount,\n                cells : colBuffer.join(\"\"),\n                alt   : ''\n            });\n        }\n        \n        return rowBuffer.join(\"\");\n    },\n    \n    \n    masterTpl: new Ext.Template(\n        '<div class=\"x-grid3 x-pivotgrid\" hidefocus=\"true\">',\n            '<div class=\"x-grid3-viewport\">',\n                '<div class=\"x-grid3-header\">',\n                    '<div class=\"x-grid3-header-title\"><span>{title}</span></div>',\n                    '<div class=\"x-grid3-header-inner\">',\n                        '<div class=\"x-grid3-header-offset\" style=\"{ostyle}\"></div>',\n                    '</div>',\n                    '<div class=\"x-clear\"></div>',\n                '</div>',\n                '<div class=\"x-grid3-scroller\">',\n                    '<div class=\"x-grid3-row-headers\"></div>',\n                    '<div class=\"x-grid3-body\" style=\"{bstyle}\">{body}</div>',\n                    '<a href=\"#\" class=\"x-grid3-focus\" tabIndex=\"-1\"></a>',\n                '</div>',\n            '</div>',\n            '<div class=\"x-grid3-resize-marker\">&#160;</div>',\n            '<div class=\"x-grid3-resize-proxy\">&#160;</div>',\n        '</div>'\n    ),\n    \n    \n    initTemplates: function() {\n        Ext.grid.PivotGridView.superclass.initTemplates.apply(this, arguments);\n        \n        var templates = this.templates || {};\n        if (!templates.gcell) {\n            templates.gcell = new Ext.XTemplate(\n                '<td class=\"x-grid3-hd x-grid3-gcell x-grid3-td-{id} ux-grid-hd-group-row-{row} ' + this.colHeaderCellCls + '\" style=\"{style}\">',\n                    '<div {tooltip} class=\"x-grid3-hd-inner x-grid3-hd-{id} x-unselectable\" unselectable=\"on\" style=\"{istyle}\">', \n                        this.grid.enableHdMenu ? '<a class=\"x-grid3-hd-btn\" href=\"#\"></a>' : '', '{value}',\n                    '</div>',\n                '</td>'\n            );\n        }\n        \n        this.templates = templates;\n        this.hrowRe = new RegExp(\"ux-grid-hd-group-row-(\\\\d+)\", \"\");\n    },\n    \n    \n    initElements: function() {\n        Ext.grid.PivotGridView.superclass.initElements.apply(this, arguments);\n        \n        \n        this.rowHeadersEl = new Ext.Element(this.scroller.child('div.x-grid3-row-headers'));\n        \n        \n        this.headerTitleEl = new Ext.Element(this.mainHd.child('div.x-grid3-header-title'));\n    },\n    \n    \n    getGridInnerWidth: function() {\n        var previousWidth = Ext.grid.PivotGridView.superclass.getGridInnerWidth.apply(this, arguments);\n        \n        return previousWidth - this.getTotalRowHeaderWidth();\n    },\n    \n    \n    getTotalRowHeaderWidth: function() {\n        var headers = this.getRowHeaders(),\n            length  = headers.length,\n            total   = 0,\n            i;\n        \n        for (i = 0; i< length; i++) {\n            total += headers[i].width;\n        }\n        \n        return total;\n    },\n    \n    \n    getTotalColumnHeaderHeight: function() {\n        return this.getColumnHeaders().length * 21;\n    },\n    \n    \n    getCellIndex : function(el) {\n        if (el) {\n            var match = el.className.match(this.colRe),\n                data;\n \n            if (match && (data = match[1])) {\n                return parseInt(data.split('-')[1], 10);\n            }\n        }\n        return false;\n    },\n    \n    \n    \n    renderUI : function() {\n        var templates  = this.templates,\n            innerWidth = this.getGridInnerWidth();\n            \n        return templates.master.apply({\n            body  : templates.body.apply({rows:'&#160;'}),\n            ostyle: 'width:' + innerWidth + 'px',\n            bstyle: 'width:' + innerWidth + 'px'\n        });\n    },\n    \n    \n    onLayout: function(width, height) {\n        Ext.grid.PivotGridView.superclass.onLayout.apply(this, arguments);\n        \n        var width = this.getGridInnerWidth();\n        \n        this.resizeColumnHeaders(width);\n        this.resizeAllRows(width);\n    },\n    \n    \n    refresh : function(headersToo) {\n        this.fireEvent('beforerefresh', this);\n        this.grid.stopEditing(true);\n        \n        var result = this.renderBody();\n        this.mainBody.update(result).setWidth(this.getGridInnerWidth());\n        if (headersToo === true) {\n            this.updateHeaders();\n            this.updateHeaderSortState();\n        }\n        this.processRows(0, true);\n        this.layout();\n        this.applyEmptyText();\n        this.fireEvent('refresh', this);\n    },\n    \n    \n    renderHeaders: Ext.emptyFn,\n    \n    \n    fitColumns: Ext.emptyFn,\n    \n    \n    resizeColumnHeaders: function(width) {\n        var topAxis = this.grid.topAxis;\n        \n        if (topAxis.rendered) {\n            topAxis.el.setWidth(width);\n        }\n    },\n    \n    \n    resizeRowHeaders: function() {\n        var rowHeaderWidth = this.getTotalRowHeaderWidth(),\n            marginStyle    = String.format(\"margin-left: {0}px;\", rowHeaderWidth);\n        \n        this.rowHeadersEl.setWidth(rowHeaderWidth);\n        this.mainBody.applyStyles(marginStyle);\n        Ext.fly(this.innerHd).applyStyles(marginStyle);\n        \n        this.headerTitleEl.setWidth(rowHeaderWidth);\n        this.headerTitleEl.setHeight(this.getTotalColumnHeaderHeight());\n    },\n    \n    \n    resizeAllRows: function(width) {\n        var rows   = this.getRows(),\n            length = rows.length,\n            i;\n        \n        for (i = 0; i < length; i++) {\n            Ext.fly(rows[i]).setWidth(width);\n            Ext.fly(rows[i]).child('table').setWidth(width);\n        }\n    },\n    \n    \n    updateHeaders: function() {\n        this.renderGroupRowHeaders();\n        this.renderGroupColumnHeaders();\n    },\n    \n    \n    renderGroupRowHeaders: function() {\n        var leftAxis = this.grid.leftAxis;\n        \n        this.resizeRowHeaders();\n        leftAxis.rendered = false;\n        leftAxis.render(this.rowHeadersEl);\n        \n        this.setTitle(this.title);\n    },\n    \n    \n    setTitle: function(title) {\n        this.headerTitleEl.child('span').dom.innerHTML = title;\n    },\n    \n    \n    renderGroupColumnHeaders: function() {\n        var topAxis = this.grid.topAxis;\n        \n        topAxis.rendered = false;\n        topAxis.render(this.innerHd.firstChild);\n    },\n    \n    \n    isMenuDisabled: function(cellIndex, el) {\n        return true;\n    }\n});\nExt.grid.PivotAxis = Ext.extend(Ext.Component, {\n    \n    orientation: 'horizontal',\n    \n    \n    defaultHeaderWidth: 80,\n    \n    \n    paddingWidth: 7,\n    \n    \n    setDimensions: function(dimensions) {\n        this.dimensions = dimensions;\n    },\n    \n    \n    onRender: function(ct, position) {\n        var rows = this.orientation == 'horizontal'\n                 ? this.renderHorizontalRows()\n                 : this.renderVerticalRows();\n        \n        this.el = Ext.DomHelper.overwrite(ct.dom, {tag: 'table', cn: rows}, true);\n    },\n    \n    \n    renderHorizontalRows: function() {\n        var headers  = this.buildHeaders(),\n            rowCount = headers.length,\n            rows     = [],\n            cells, cols, colCount, i, j;\n        \n        for (i = 0; i < rowCount; i++) {\n            cells = [];\n            cols  = headers[i].items;\n            colCount = cols.length;\n\n            for (j = 0; j < colCount; j++) {\n                cells.push({\n                    tag: 'td',\n                    html: cols[j].header,\n                    colspan: cols[j].span\n                });\n            }\n\n            rows[i] = {\n                tag: 'tr',\n                cn: cells\n            };\n        }\n        \n        return rows;\n    },\n    \n    \n    renderVerticalRows: function() {\n        var headers  = this.buildHeaders(),\n            colCount = headers.length,\n            rowCells = [],\n            rows     = [],\n            rowCount, col, row, colWidth, i, j;\n        \n        for (i = 0; i < colCount; i++) {\n            col = headers[i];\n            colWidth = col.width || 80;\n            rowCount = col.items.length;\n            \n            for (j = 0; j < rowCount; j++) {\n                row = col.items[j];\n                \n                rowCells[row.start] = rowCells[row.start] || [];\n                rowCells[row.start].push({\n                    tag    : 'td',\n                    html   : row.header,\n                    rowspan: row.span,\n                    width  : Ext.isBorderBox ? colWidth : colWidth - this.paddingWidth\n                });\n            }\n        }\n        \n        rowCount = rowCells.length;\n        for (i = 0; i < rowCount; i++) {\n            rows[i] = {\n                tag: 'tr',\n                cn : rowCells[i]\n            };\n        }\n        \n        return rows;\n    },\n    \n    \n    getTuples: function() {\n        var newStore = new Ext.data.Store({});\n        \n        newStore.data = this.store.data.clone();\n        newStore.fields = this.store.fields;\n        \n        var sorters    = [],\n            dimensions = this.dimensions,\n            length     = dimensions.length,\n            i;\n        \n        for (i = 0; i < length; i++) {\n            sorters.push({\n                field    : dimensions[i].dataIndex,\n                direction: dimensions[i].direction || 'ASC'\n            });\n        }\n        \n        newStore.sort(sorters);\n        \n        var records = newStore.data.items,\n            hashes  = [],\n            tuples  = [],\n            recData, hash, info, data, key;\n        \n        length = records.length;\n        \n        for (i = 0; i < length; i++) {\n            info = this.getRecordInfo(records[i]);\n            data = info.data;\n            hash = \"\";\n            \n            for (key in data) {\n                hash += data[key] + '---';\n            }\n            \n            if (hashes.indexOf(hash) == -1) {\n                hashes.push(hash);\n                tuples.push(info);\n            }\n        }\n        \n        newStore.destroy();\n        \n        return tuples;\n    },\n    \n    \n    getRecordInfo: function(record) {\n        var dimensions = this.dimensions,\n            length  = dimensions.length,\n            data    = {},\n            dimension, dataIndex, i;\n        \n        \n        for (i = 0; i < length; i++) {\n            dimension = dimensions[i];\n            dataIndex = dimension.dataIndex;\n            \n            data[dataIndex] = record.get(dataIndex);\n        }\n        \n        \n        \n        var createMatcherFunction = function(data) {\n            return function(record) {\n                for (var dataIndex in data) {\n                    if (record.get(dataIndex) != data[dataIndex]) {\n                        return false;\n                    }\n                }\n                \n                return true;\n            };\n        };\n        \n        return {\n            data: data,\n            matcher: createMatcherFunction(data)\n        };\n    },\n    \n    \n    buildHeaders: function() {\n        var tuples     = this.getTuples(),\n            rowCount   = tuples.length,\n            dimensions = this.dimensions,\n            dimension,\n            colCount   = dimensions.length,\n            headers    = [],\n            tuple, rows, currentHeader, previousHeader, span, start, isLast, changed, i, j;\n        \n        for (i = 0; i < colCount; i++) {\n            dimension = dimensions[i];\n            rows  = [];\n            span  = 0;\n            start = 0;\n            \n            for (j = 0; j < rowCount; j++) {\n                tuple  = tuples[j];\n                isLast = j == (rowCount - 1);\n                currentHeader = tuple.data[dimension.dataIndex];\n                \n                \n                changed = previousHeader != undefined && previousHeader != currentHeader;\n                if (i > 0 && j > 0) {\n                    changed = changed || tuple.data[dimensions[i-1].dataIndex] != tuples[j-1].data[dimensions[i-1].dataIndex];\n                }\n                \n                if (changed) {                    \n                    rows.push({\n                        header: previousHeader,\n                        span  : span,\n                        start : start\n                    });\n                    \n                    start += span;\n                    span = 0;\n                }\n                \n                if (isLast) {\n                    rows.push({\n                        header: currentHeader,\n                        span  : span + 1,\n                        start : start\n                    });\n                    \n                    start += span;\n                    span = 0;\n                }\n                \n                previousHeader = currentHeader;\n                span++;\n            }\n            \n            headers.push({\n                items: rows,\n                width: dimension.width || this.defaultHeaderWidth\n            });\n            \n            previousHeader = undefined;\n        }\n        \n        return headers;\n    }\n});\n\n\nExt.grid.HeaderDragZone = Ext.extend(Ext.dd.DragZone, {\n    maxDragWidth: 120,\n    \n    constructor : function(grid, hd, hd2){\n        this.grid = grid;\n        this.view = grid.getView();\n        this.ddGroup = \"gridHeader\" + this.grid.getGridEl().id;\n        Ext.grid.HeaderDragZone.superclass.constructor.call(this, hd);\n        if(hd2){\n            this.setHandleElId(Ext.id(hd));\n            this.setOuterHandleElId(Ext.id(hd2));\n        }\n        this.scroll = false;\n    },\n    \n    getDragData : function(e){\n        var t = Ext.lib.Event.getTarget(e),\n            h = this.view.findHeaderCell(t);\n        if(h){\n            return {ddel: h.firstChild, header:h};\n        }\n        return false;\n    },\n\n    onInitDrag : function(e){\n        \n        this.dragHeadersDisabled = this.view.headersDisabled;\n        this.view.headersDisabled = true;\n        var clone = this.dragData.ddel.cloneNode(true);\n        clone.id = Ext.id();\n        clone.style.width = Math.min(this.dragData.header.offsetWidth,this.maxDragWidth) + \"px\";\n        this.proxy.update(clone);\n        return true;\n    },\n\n    afterValidDrop : function(){\n        this.completeDrop();\n    },\n\n    afterInvalidDrop : function(){\n        this.completeDrop();\n    },\n    \n    completeDrop: function(){\n        var v = this.view,\n            disabled = this.dragHeadersDisabled;\n        setTimeout(function(){\n            v.headersDisabled = disabled;\n        }, 50);\n    }\n});\n\n\n\nExt.grid.HeaderDropZone = Ext.extend(Ext.dd.DropZone, {\n    proxyOffsets : [-4, -9],\n    fly: Ext.Element.fly,\n    \n    constructor : function(grid, hd, hd2){\n        this.grid = grid;\n        this.view = grid.getView();\n        \n        this.proxyTop = Ext.DomHelper.append(document.body, {\n            cls:\"col-move-top\", html:\"&#160;\"\n        }, true);\n        this.proxyBottom = Ext.DomHelper.append(document.body, {\n            cls:\"col-move-bottom\", html:\"&#160;\"\n        }, true);\n        this.proxyTop.hide = this.proxyBottom.hide = function(){\n            this.setLeftTop(-100,-100);\n            this.setStyle(\"visibility\", \"hidden\");\n        };\n        this.ddGroup = \"gridHeader\" + this.grid.getGridEl().id;\n        \n        \n        Ext.grid.HeaderDropZone.superclass.constructor.call(this, grid.getGridEl().dom);\n    },\n\n    getTargetFromEvent : function(e){\n        var t = Ext.lib.Event.getTarget(e),\n            cindex = this.view.findCellIndex(t);\n        if(cindex !== false){\n            return this.view.getHeaderCell(cindex);\n        }\n    },\n\n    nextVisible : function(h){\n        var v = this.view, cm = this.grid.colModel;\n        h = h.nextSibling;\n        while(h){\n            if(!cm.isHidden(v.getCellIndex(h))){\n                return h;\n            }\n            h = h.nextSibling;\n        }\n        return null;\n    },\n\n    prevVisible : function(h){\n        var v = this.view, cm = this.grid.colModel;\n        h = h.prevSibling;\n        while(h){\n            if(!cm.isHidden(v.getCellIndex(h))){\n                return h;\n            }\n            h = h.prevSibling;\n        }\n        return null;\n    },\n\n    positionIndicator : function(h, n, e){\n        var x = Ext.lib.Event.getPageX(e),\n            r = Ext.lib.Dom.getRegion(n.firstChild),\n            px, \n            pt, \n            py = r.top + this.proxyOffsets[1];\n        if((r.right - x) <= (r.right-r.left)/2){\n            px = r.right+this.view.borderWidth;\n            pt = \"after\";\n        }else{\n            px = r.left;\n            pt = \"before\";\n        }\n\n        if(this.grid.colModel.isFixed(this.view.getCellIndex(n))){\n            return false;\n        }\n\n        px +=  this.proxyOffsets[0];\n        this.proxyTop.setLeftTop(px, py);\n        this.proxyTop.show();\n        if(!this.bottomOffset){\n            this.bottomOffset = this.view.mainHd.getHeight();\n        }\n        this.proxyBottom.setLeftTop(px, py+this.proxyTop.dom.offsetHeight+this.bottomOffset);\n        this.proxyBottom.show();\n        return pt;\n    },\n\n    onNodeEnter : function(n, dd, e, data){\n        if(data.header != n){\n            this.positionIndicator(data.header, n, e);\n        }\n    },\n\n    onNodeOver : function(n, dd, e, data){\n        var result = false;\n        if(data.header != n){\n            result = this.positionIndicator(data.header, n, e);\n        }\n        if(!result){\n            this.proxyTop.hide();\n            this.proxyBottom.hide();\n        }\n        return result ? this.dropAllowed : this.dropNotAllowed;\n    },\n\n    onNodeOut : function(n, dd, e, data){\n        this.proxyTop.hide();\n        this.proxyBottom.hide();\n    },\n\n    onNodeDrop : function(n, dd, e, data){\n        var h = data.header;\n        if(h != n){\n            var cm = this.grid.colModel,\n                x = Ext.lib.Event.getPageX(e),\n                r = Ext.lib.Dom.getRegion(n.firstChild),\n                pt = (r.right - x) <= ((r.right-r.left)/2) ? \"after\" : \"before\",\n                oldIndex = this.view.getCellIndex(h),\n                newIndex = this.view.getCellIndex(n);\n            if(pt == \"after\"){\n                newIndex++;\n            }\n            if(oldIndex < newIndex){\n                newIndex--;\n            }\n            cm.moveColumn(oldIndex, newIndex);\n            return true;\n        }\n        return false;\n    }\n});\n\nExt.grid.GridView.ColumnDragZone = Ext.extend(Ext.grid.HeaderDragZone, {\n    \n    constructor : function(grid, hd){\n        Ext.grid.GridView.ColumnDragZone.superclass.constructor.call(this, grid, hd, null);\n        this.proxy.el.addClass('x-grid3-col-dd');\n    },\n    \n    handleMouseDown : function(e){\n    },\n\n    callHandleMouseDown : function(e){\n        Ext.grid.GridView.ColumnDragZone.superclass.handleMouseDown.call(this, e);\n    }\n});\n\nExt.grid.SplitDragZone = Ext.extend(Ext.dd.DDProxy, {\n    fly: Ext.Element.fly,\n    \n    constructor : function(grid, hd, hd2){\n        this.grid = grid;\n        this.view = grid.getView();\n        this.proxy = this.view.resizeProxy;\n        Ext.grid.SplitDragZone.superclass.constructor.call(this, hd,\n            \"gridSplitters\" + this.grid.getGridEl().id, {\n            dragElId : Ext.id(this.proxy.dom), resizeFrame:false\n        });\n        this.setHandleElId(Ext.id(hd));\n        this.setOuterHandleElId(Ext.id(hd2));\n        this.scroll = false;\n    },\n\n    b4StartDrag : function(x, y){\n        this.view.headersDisabled = true;\n        this.proxy.setHeight(this.view.mainWrap.getHeight());\n        var w = this.cm.getColumnWidth(this.cellIndex);\n        var minw = Math.max(w-this.grid.minColumnWidth, 0);\n        this.resetConstraints();\n        this.setXConstraint(minw, 1000);\n        this.setYConstraint(0, 0);\n        this.minX = x - minw;\n        this.maxX = x + 1000;\n        this.startPos = x;\n        Ext.dd.DDProxy.prototype.b4StartDrag.call(this, x, y);\n    },\n\n\n    handleMouseDown : function(e){\n        var ev = Ext.EventObject.setEvent(e);\n        var t = this.fly(ev.getTarget());\n        if(t.hasClass(\"x-grid-split\")){\n            this.cellIndex = this.view.getCellIndex(t.dom);\n            this.split = t.dom;\n            this.cm = this.grid.colModel;\n            if(this.cm.isResizable(this.cellIndex) && !this.cm.isFixed(this.cellIndex)){\n                Ext.grid.SplitDragZone.superclass.handleMouseDown.apply(this, arguments);\n            }\n        }\n    },\n\n    endDrag : function(e){\n        this.view.headersDisabled = false;\n        var endX = Math.max(this.minX, Ext.lib.Event.getPageX(e));\n        var diff = endX - this.startPos;\n        this.view.onColumnSplitterMoved(this.cellIndex, this.cm.getColumnWidth(this.cellIndex)+diff);\n    },\n\n    autoOffset : function(){\n        this.setDelta(0,0);\n    }\n});\nExt.grid.GridDragZone = function(grid, config){\n    this.view = grid.getView();\n    Ext.grid.GridDragZone.superclass.constructor.call(this, this.view.mainBody.dom, config);\n    this.scroll = false;\n    this.grid = grid;\n    this.ddel = document.createElement('div');\n    this.ddel.className = 'x-grid-dd-wrap';\n    \n    this.preventDefault = true;\n};\n\nExt.extend(Ext.grid.GridDragZone, Ext.dd.DragZone, {\n    ddGroup : \"GridDD\",\n\n    \n    getDragData : function(e){\n        var t = Ext.lib.Event.getTarget(e),\n            sm,\n            rowIndex = this.view.findRowIndex(t),\n            cellIndex,\n            selectedCell,\n            selection;\n\n        if (rowIndex !== false){\n            sm = this.grid.selModel;\n\n            \n            \n            if (sm.getSelectedCell) {\n                cellIndex = this.view.findCellIndex(t);\n                selectedCell = sm.getSelectedCell();\n                if (!selectedCell || selectedCell[0] !== rowIndex || selectedCell[1] !== cellIndex) {\n                    sm.handleMouseDown(this.grid, rowIndex, cellIndex, e);\n                }\n                if (this.grid.dragCell) {\n                    \n                    selection = sm.getSelectedCell();\n                    if (!this.grid.hasOwnProperty('ddText')) {\n                        this.grid.ddText = '{0} selected cell{1}';\n                    }\n                } else {\n                    \n                    selection = [this.grid.store.getAt(rowIndex)];\n                }\n            } else {\n                if(!sm.isSelected(rowIndex) || e.hasModifier()){\n                    sm.handleMouseDown(this.grid, rowIndex, e);\n                }\n                selection = sm.getSelections();\n            }\n            return {grid: this.grid, ddel: this.ddel, rowIndex: rowIndex, selections: selection};\n        }\n        return false;\n    },\n\n    \n    onInitDrag : function(e){\n        var data = this.dragData;\n        this.ddel.innerHTML = this.grid.getDragDropText();\n        this.proxy.update(this.ddel);\n        \n    },\n\n    \n    afterRepair : function(){\n        this.dragging = false;\n    },\n\n    \n    getRepairXY : function(e, data){\n        return false;\n    },\n\n    onEndDrag : function(data, e){\n        \n    },\n\n    onValidDrop : function(dd, e, id){\n        \n        this.hideProxy();\n    },\n\n    beforeInvalidDrop : function(e, id){\n\n    }\n});\n\nExt.grid.ColumnModel = Ext.extend(Ext.util.Observable, {\n    \n    defaultWidth: 100,\n\n    \n    defaultSortable: false,\n\n    \n\n    \n\n    constructor : function(config) {\n        \n\t    if (config.columns) {\n\t        Ext.apply(this, config);\n\t        this.setConfig(config.columns, true);\n\t    } else {\n\t        this.setConfig(config, true);\n\t    }\n\t    \n\t    this.addEvents(\n\t        \n\t        \"widthchange\",\n\t        \n\t        \n\t        \"headerchange\",\n\t        \n\t        \n\t        \"hiddenchange\",\n\t        \n\t        \n\t        \"columnmoved\",\n\t        \n\t        \n\t        \"configchange\"\n\t    );\n\t    \n\t    Ext.grid.ColumnModel.superclass.constructor.call(this);\n    },\n\n    \n    getColumnId : function(index) {\n        return this.config[index].id;\n    },\n\n    getColumnAt : function(index) {\n        return this.config[index];\n    },\n\n    \n    setConfig : function(config, initial) {\n        var i, c, len;\n        \n        if (!initial) { \n            delete this.totalWidth;\n            \n            for (i = 0, len = this.config.length; i < len; i++) {\n                c = this.config[i];\n                \n                if (c.setEditor) {\n                    \n                    c.setEditor(null);\n                }\n            }\n        }\n\n        \n        this.defaults = Ext.apply({\n            width: this.defaultWidth,\n            sortable: this.defaultSortable\n        }, this.defaults);\n\n        this.config = config;\n        this.lookup = {};\n\n        for (i = 0, len = config.length; i < len; i++) {\n            c = Ext.applyIf(config[i], this.defaults);\n            \n            \n            if (Ext.isEmpty(c.id)) {\n                c.id = i;\n            }\n            \n            if (!c.isColumn) {\n                var Cls = Ext.grid.Column.types[c.xtype || 'gridcolumn'];\n                c = new Cls(c);\n                config[i] = c;\n            }\n            \n            this.lookup[c.id] = c;\n        }\n        \n        if (!initial) {\n            this.fireEvent('configchange', this);\n        }\n    },\n\n    \n    getColumnById : function(id) {\n        return this.lookup[id];\n    },\n\n    \n    getIndexById : function(id) {\n        for (var i = 0, len = this.config.length; i < len; i++) {\n            if (this.config[i].id == id) {\n                return i;\n            }\n        }\n        return -1;\n    },\n\n    \n    moveColumn : function(oldIndex, newIndex) {\n        var config = this.config,\n            c      = config[oldIndex];\n            \n        config.splice(oldIndex, 1);\n        config.splice(newIndex, 0, c);\n        this.dataMap = null;\n        this.fireEvent(\"columnmoved\", this, oldIndex, newIndex);\n    },\n\n    \n    getColumnCount : function(visibleOnly) {\n        var length = this.config.length,\n            c = 0,\n            i;\n        \n        if (visibleOnly === true) {\n            for (i = 0; i < length; i++) {\n                if (!this.isHidden(i)) {\n                    c++;\n                }\n            }\n            \n            return c;\n        }\n        \n        return length;\n    },\n\n    \n    getColumnsBy : function(fn, scope) {\n        var config = this.config,\n            length = config.length,\n            result = [],\n            i, c;\n            \n        for (i = 0; i < length; i++){\n            c = config[i];\n            \n            if (fn.call(scope || this, c, i) === true) {\n                result[result.length] = c;\n            }\n        }\n        \n        return result;\n    },\n\n    \n    isSortable : function(col) {\n        return !!this.config[col].sortable;\n    },\n\n    \n    isMenuDisabled : function(col) {\n        return !!this.config[col].menuDisabled;\n    },\n\n    \n    getRenderer : function(col) {\n        return this.config[col].renderer || Ext.grid.ColumnModel.defaultRenderer;\n    },\n\n    getRendererScope : function(col) {\n        return this.config[col].scope;\n    },\n\n    \n    setRenderer : function(col, fn) {\n        this.config[col].renderer = fn;\n    },\n\n    \n    getColumnWidth : function(col) {\n        var width = this.config[col].width;\n        if(typeof width != 'number'){\n            width = this.defaultWidth;\n        }\n        return width;\n    },\n\n    \n    setColumnWidth : function(col, width, suppressEvent) {\n        this.config[col].width = width;\n        this.totalWidth = null;\n        \n        if (!suppressEvent) {\n             this.fireEvent(\"widthchange\", this, col, width);\n        }\n    },\n\n    \n    getTotalWidth : function(includeHidden) {\n        if (!this.totalWidth) {\n            this.totalWidth = 0;\n            for (var i = 0, len = this.config.length; i < len; i++) {\n                if (includeHidden || !this.isHidden(i)) {\n                    this.totalWidth += this.getColumnWidth(i);\n                }\n            }\n        }\n        return this.totalWidth;\n    },\n\n    \n    getColumnHeader : function(col) {\n        return this.config[col].header;\n    },\n\n    \n    setColumnHeader : function(col, header) {\n        this.config[col].header = header;\n        this.fireEvent(\"headerchange\", this, col, header);\n    },\n\n    \n    getColumnTooltip : function(col) {\n            return this.config[col].tooltip;\n    },\n    \n    setColumnTooltip : function(col, tooltip) {\n            this.config[col].tooltip = tooltip;\n    },\n\n    \n    getDataIndex : function(col) {\n        return this.config[col].dataIndex;\n    },\n\n    \n    setDataIndex : function(col, dataIndex) {\n        this.config[col].dataIndex = dataIndex;\n    },\n\n    \n    findColumnIndex : function(dataIndex) {\n        var c = this.config;\n        for(var i = 0, len = c.length; i < len; i++){\n            if(c[i].dataIndex == dataIndex){\n                return i;\n            }\n        }\n        return -1;\n    },\n\n    \n    isCellEditable : function(colIndex, rowIndex) {\n        var c = this.config[colIndex],\n            ed = c.editable;\n\n        \n        return !!(ed || (!Ext.isDefined(ed) && c.editor));\n    },\n\n    \n    getCellEditor : function(colIndex, rowIndex) {\n        return this.config[colIndex].getCellEditor(rowIndex);\n    },\n\n    \n    setEditable : function(col, editable) {\n        this.config[col].editable = editable;\n    },\n\n    \n    isHidden : function(colIndex) {\n        return !!this.config[colIndex].hidden; \n    },\n\n    \n    isFixed : function(colIndex) {\n        return !!this.config[colIndex].fixed;\n    },\n\n    \n    isResizable : function(colIndex) {\n        return colIndex >= 0 && this.config[colIndex].resizable !== false && this.config[colIndex].fixed !== true;\n    },\n    \n    \n    setHidden : function(colIndex, hidden) {\n        var c = this.config[colIndex];\n        if(c.hidden !== hidden){\n            c.hidden = hidden;\n            this.totalWidth = null;\n            this.fireEvent(\"hiddenchange\", this, colIndex, hidden);\n        }\n    },\n\n    \n    setEditor : function(col, editor) {\n        this.config[col].setEditor(editor);\n    },\n\n    \n    destroy : function() {\n        var length = this.config.length,\n            i = 0;\n\n        for (; i < length; i++){\n            this.config[i].destroy(); \n        }\n        delete this.config;\n        delete this.lookup;\n        this.purgeListeners();\n    },\n\n    \n    setState : function(col, state) {\n        state = Ext.applyIf(state, this.defaults);\n        Ext.apply(this.config[col], state);\n    }\n});\n\n\nExt.grid.ColumnModel.defaultRenderer = function(value) {\n    if (typeof value == \"string\" && value.length < 1) {\n        return \"&#160;\";\n    }\n    return value;\n};\nExt.grid.AbstractSelectionModel = Ext.extend(Ext.util.Observable,  {\n    \n\n    constructor : function(){\n        this.locked = false;\n        Ext.grid.AbstractSelectionModel.superclass.constructor.call(this);\n    },\n\n    \n    init : function(grid){\n        this.grid = grid;\n        if(this.lockOnInit){\n            delete this.lockOnInit;\n            this.locked = false;\n            this.lock();\n        }\n        this.initEvents();\n    },\n\n    \n    lock : function(){\n        if(!this.locked){\n            this.locked = true;\n            \n            var g = this.grid;\n            if(g){\n                g.getView().on({\n                    scope: this,\n                    beforerefresh: this.sortUnLock,\n                    refresh: this.sortLock\n                });\n            }else{\n                this.lockOnInit = true;\n            }\n        }\n    },\n\n    \n    sortLock : function() {\n        this.locked = true;\n    },\n\n    \n    sortUnLock : function() {\n        this.locked = false;\n    },\n\n    \n    unlock : function(){\n        if(this.locked){\n            this.locked = false;\n            var g = this.grid,\n                gv;\n                \n            \n            if(g){\n                gv = g.getView();\n                gv.un('beforerefresh', this.sortUnLock, this);\n                gv.un('refresh', this.sortLock, this);    \n            }else{\n                delete this.lockOnInit;\n            }\n        }\n    },\n\n    \n    isLocked : function(){\n        return this.locked;\n    },\n\n    destroy: function(){\n        this.unlock();\n        this.purgeListeners();\n    }\n});\nExt.grid.RowSelectionModel = Ext.extend(Ext.grid.AbstractSelectionModel,  {\n    \n    singleSelect : false,\n    \n    constructor : function(config){\n        Ext.apply(this, config);\n        this.selections = new Ext.util.MixedCollection(false, function(o){\n            return o.id;\n        });\n\n        this.last = false;\n        this.lastActive = false;\n\n        this.addEvents(\n\t        \n\t        'selectionchange',\n\t        \n\t        'beforerowselect',\n\t        \n\t        'rowselect',\n\t        \n\t        'rowdeselect'\n        );\n        Ext.grid.RowSelectionModel.superclass.constructor.call(this);\n    },\n\n    \n    \n    initEvents : function(){\n\n        if(!this.grid.enableDragDrop && !this.grid.enableDrag){\n            this.grid.on('rowmousedown', this.handleMouseDown, this);\n        }\n\n        this.rowNav = new Ext.KeyNav(this.grid.getGridEl(), {\n            up: this.onKeyPress, \n            down: this.onKeyPress,\n            scope: this\n        });\n\n        this.grid.getView().on({\n            scope: this,\n            refresh: this.onRefresh,\n            rowupdated: this.onRowUpdated,\n            rowremoved: this.onRemove\n        });\n    },\n    \n    onKeyPress : function(e, name){\n        var up = name == 'up',\n            method = up ? 'selectPrevious' : 'selectNext',\n            add = up ? -1 : 1,\n            last;\n        if(!e.shiftKey || this.singleSelect){\n            this[method](false);\n        }else if(this.last !== false && this.lastActive !== false){\n            last = this.last;\n            this.selectRange(this.last,  this.lastActive + add);\n            this.grid.getView().focusRow(this.lastActive);\n            if(last !== false){\n                this.last = last;\n            }\n        }else{\n           this.selectFirstRow();\n        }\n    },\n\n    \n    onRefresh : function(){\n        var ds = this.grid.store,\n            s = this.getSelections(),\n            i = 0,\n            len = s.length, \n            index, r;\n            \n        this.silent = true;\n        this.clearSelections(true);\n        for(; i < len; i++){\n            r = s[i];\n            if((index = ds.indexOfId(r.id)) != -1){\n                this.selectRow(index, true);\n            }\n        }\n        if(s.length != this.selections.getCount()){\n            this.fireEvent('selectionchange', this);\n        }\n        this.silent = false;\n    },\n\n    \n    onRemove : function(v, index, r){\n        if(this.selections.remove(r) !== false){\n            this.fireEvent('selectionchange', this);\n        }\n    },\n\n    \n    onRowUpdated : function(v, index, r){\n        if(this.isSelected(r)){\n            v.onRowSelect(index);\n        }\n    },\n\n    \n    selectRecords : function(records, keepExisting){\n        if(!keepExisting){\n            this.clearSelections();\n        }\n        var ds = this.grid.store,\n            i = 0,\n            len = records.length;\n        for(; i < len; i++){\n            this.selectRow(ds.indexOf(records[i]), true);\n        }\n    },\n\n    \n    getCount : function(){\n        return this.selections.length;\n    },\n\n    \n    selectFirstRow : function(){\n        this.selectRow(0);\n    },\n\n    \n    selectLastRow : function(keepExisting){\n        this.selectRow(this.grid.store.getCount() - 1, keepExisting);\n    },\n\n    \n    selectNext : function(keepExisting){\n        if(this.hasNext()){\n            this.selectRow(this.last+1, keepExisting);\n            this.grid.getView().focusRow(this.last);\n            return true;\n        }\n        return false;\n    },\n\n    \n    selectPrevious : function(keepExisting){\n        if(this.hasPrevious()){\n            this.selectRow(this.last-1, keepExisting);\n            this.grid.getView().focusRow(this.last);\n            return true;\n        }\n        return false;\n    },\n\n    \n    hasNext : function(){\n        return this.last !== false && (this.last+1) < this.grid.store.getCount();\n    },\n\n    \n    hasPrevious : function(){\n        return !!this.last;\n    },\n\n\n    \n    getSelections : function(){\n        return [].concat(this.selections.items);\n    },\n\n    \n    getSelected : function(){\n        return this.selections.itemAt(0);\n    },\n\n    \n    each : function(fn, scope){\n        var s = this.getSelections(),\n            i = 0,\n            len = s.length;\n            \n        for(; i < len; i++){\n            if(fn.call(scope || this, s[i], i) === false){\n                return false;\n            }\n        }\n        return true;\n    },\n\n    \n    clearSelections : function(fast){\n        if(this.isLocked()){\n            return;\n        }\n        if(fast !== true){\n            var ds = this.grid.store,\n                s = this.selections;\n            s.each(function(r){\n                this.deselectRow(ds.indexOfId(r.id));\n            }, this);\n            s.clear();\n        }else{\n            this.selections.clear();\n        }\n        this.last = false;\n    },\n\n\n    \n    selectAll : function(){\n        if(this.isLocked()){\n            return;\n        }\n        this.selections.clear();\n        for(var i = 0, len = this.grid.store.getCount(); i < len; i++){\n            this.selectRow(i, true);\n        }\n    },\n\n    \n    hasSelection : function(){\n        return this.selections.length > 0;\n    },\n\n    \n    isSelected : function(index){\n        var r = Ext.isNumber(index) ? this.grid.store.getAt(index) : index;\n        return (r && this.selections.key(r.id) ? true : false);\n    },\n\n    \n    isIdSelected : function(id){\n        return (this.selections.key(id) ? true : false);\n    },\n\n    \n    handleMouseDown : function(g, rowIndex, e){\n        if(e.button !== 0 || this.isLocked()){\n            return;\n        }\n        var view = this.grid.getView();\n        if(e.shiftKey && !this.singleSelect && this.last !== false){\n            var last = this.last;\n            this.selectRange(last, rowIndex, e.ctrlKey);\n            this.last = last; \n            view.focusRow(rowIndex);\n        }else{\n            var isSelected = this.isSelected(rowIndex);\n            if(e.ctrlKey && isSelected){\n                this.deselectRow(rowIndex);\n            }else if(!isSelected || this.getCount() > 1){\n                this.selectRow(rowIndex, e.ctrlKey || e.shiftKey);\n                view.focusRow(rowIndex);\n            }\n        }\n    },\n\n    \n    selectRows : function(rows, keepExisting){\n        if(!keepExisting){\n            this.clearSelections();\n        }\n        for(var i = 0, len = rows.length; i < len; i++){\n            this.selectRow(rows[i], true);\n        }\n    },\n\n    \n    selectRange : function(startRow, endRow, keepExisting){\n        var i;\n        if(this.isLocked()){\n            return;\n        }\n        if(!keepExisting){\n            this.clearSelections();\n        }\n        if(startRow <= endRow){\n            for(i = startRow; i <= endRow; i++){\n                this.selectRow(i, true);\n            }\n        }else{\n            for(i = startRow; i >= endRow; i--){\n                this.selectRow(i, true);\n            }\n        }\n    },\n\n    \n    deselectRange : function(startRow, endRow, preventViewNotify){\n        if(this.isLocked()){\n            return;\n        }\n        for(var i = startRow; i <= endRow; i++){\n            this.deselectRow(i, preventViewNotify);\n        }\n    },\n\n    \n    selectRow : function(index, keepExisting, preventViewNotify){\n        if(this.isLocked() || (index < 0 || index >= this.grid.store.getCount()) || (keepExisting && this.isSelected(index))){\n            return;\n        }\n        var r = this.grid.store.getAt(index);\n        if(r && this.fireEvent('beforerowselect', this, index, keepExisting, r) !== false){\n            if(!keepExisting || this.singleSelect){\n                this.clearSelections();\n            }\n            this.selections.add(r);\n            this.last = this.lastActive = index;\n            if(!preventViewNotify){\n                this.grid.getView().onRowSelect(index);\n            }\n            if(!this.silent){\n                this.fireEvent('rowselect', this, index, r);\n                this.fireEvent('selectionchange', this);\n            }\n        }\n    },\n\n    \n    deselectRow : function(index, preventViewNotify){\n        if(this.isLocked()){\n            return;\n        }\n        if(this.last == index){\n            this.last = false;\n        }\n        if(this.lastActive == index){\n            this.lastActive = false;\n        }\n        var r = this.grid.store.getAt(index);\n        if(r){\n            this.selections.remove(r);\n            if(!preventViewNotify){\n                this.grid.getView().onRowDeselect(index);\n            }\n            this.fireEvent('rowdeselect', this, index, r);\n            this.fireEvent('selectionchange', this);\n        }\n    },\n\n    \n    acceptsNav : function(row, col, cm){\n        return !cm.isHidden(col) && cm.isCellEditable(col, row);\n    },\n\n    \n    onEditorKey : function(field, e){\n        var k = e.getKey(), \n            newCell, \n            g = this.grid, \n            last = g.lastEdit,\n            ed = g.activeEditor,\n            shift = e.shiftKey,\n            ae, last, r, c;\n            \n        if(k == e.TAB){\n            e.stopEvent();\n            ed.completeEdit();\n            if(shift){\n                newCell = g.walkCells(ed.row, ed.col-1, -1, this.acceptsNav, this);\n            }else{\n                newCell = g.walkCells(ed.row, ed.col+1, 1, this.acceptsNav, this);\n            }\n        }else if(k == e.ENTER){\n            if(this.moveEditorOnEnter !== false){\n                if(shift){\n                    newCell = g.walkCells(last.row - 1, last.col, -1, this.acceptsNav, this);\n                }else{\n                    newCell = g.walkCells(last.row + 1, last.col, 1, this.acceptsNav, this);\n                }\n            }\n        }\n        if(newCell){\n            r = newCell[0];\n            c = newCell[1];\n\n            this.onEditorSelect(r, last.row);\n\n            if(g.isEditor && g.editing){ \n                ae = g.activeEditor;\n                if(ae && ae.field.triggerBlur){\n                    \n                    ae.field.triggerBlur();\n                }\n            }\n            g.startEditing(r, c);\n        }\n    },\n    \n    onEditorSelect: function(row, lastRow){\n        if(lastRow != row){\n            this.selectRow(row); \n        }\n    },\n    \n    destroy : function(){\n        Ext.destroy(this.rowNav);\n        this.rowNav = null;\n        Ext.grid.RowSelectionModel.superclass.destroy.call(this);\n    }\n});\n\nExt.grid.Column = Ext.extend(Ext.util.Observable, {\n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n    \n\n    \n    isColumn : true,\n\n    constructor : function(config){\n        Ext.apply(this, config);\n\n        if(Ext.isString(this.renderer)){\n            this.renderer = Ext.util.Format[this.renderer];\n        }else if(Ext.isObject(this.renderer)){\n            this.scope = this.renderer.scope;\n            this.renderer = this.renderer.fn;\n        }\n        if(!this.scope){\n            this.scope = this;\n        }\n\n        var ed = this.editor;\n        delete this.editor;\n        this.setEditor(ed);\n        this.addEvents(\n            \n            'click',\n            \n            'contextmenu',\n            \n            'dblclick',\n            \n            'mousedown'\n        );\n        Ext.grid.Column.superclass.constructor.call(this);\n    },\n\n    \n    processEvent : function(name, e, grid, rowIndex, colIndex){\n        return this.fireEvent(name, this, grid, rowIndex, e);\n    },\n\n    \n    destroy: function() {\n        if(this.setEditor){\n            this.setEditor(null);\n        }\n        this.purgeListeners();\n    },\n\n    \n    renderer : function(value){\n        return value;\n    },\n\n    \n    getEditor: function(rowIndex){\n        return this.editable !== false ? this.editor : null;\n    },\n\n    \n    setEditor : function(editor){\n        var ed = this.editor;\n        if(ed){\n            if(ed.gridEditor){\n                ed.gridEditor.destroy();\n                delete ed.gridEditor;\n            }else{\n                ed.destroy();\n            }\n        }\n        this.editor = null;\n        if(editor){\n            \n            if(!editor.isXType){\n                editor = Ext.create(editor, 'textfield');\n            }\n            this.editor = editor;\n        }\n    },\n\n    \n    getCellEditor: function(rowIndex){\n        var ed = this.getEditor(rowIndex);\n        if(ed){\n            if(!ed.startEdit){\n                if(!ed.gridEditor){\n                    ed.gridEditor = new Ext.grid.GridEditor(ed);\n                }\n                ed = ed.gridEditor;\n            }\n        }\n        return ed;\n    }\n});\n\n\nExt.grid.BooleanColumn = Ext.extend(Ext.grid.Column, {\n    \n    trueText: 'true',\n    \n    falseText: 'false',\n    \n    undefinedText: '&#160;',\n\n    constructor: function(cfg){\n        Ext.grid.BooleanColumn.superclass.constructor.call(this, cfg);\n        var t = this.trueText, f = this.falseText, u = this.undefinedText;\n        this.renderer = function(v){\n            if(v === undefined){\n                return u;\n            }\n            if(!v || v === 'false'){\n                return f;\n            }\n            return t;\n        };\n    }\n});\n\n\nExt.grid.NumberColumn = Ext.extend(Ext.grid.Column, {\n    \n    format : '0,000.00',\n    constructor: function(cfg){\n        Ext.grid.NumberColumn.superclass.constructor.call(this, cfg);\n        this.renderer = Ext.util.Format.numberRenderer(this.format);\n    }\n});\n\n\nExt.grid.DateColumn = Ext.extend(Ext.grid.Column, {\n    \n    format : 'm/d/Y',\n    constructor: function(cfg){\n        Ext.grid.DateColumn.superclass.constructor.call(this, cfg);\n        this.renderer = Ext.util.Format.dateRenderer(this.format);\n    }\n});\n\n\nExt.grid.TemplateColumn = Ext.extend(Ext.grid.Column, {\n    \n    constructor: function(cfg){\n        Ext.grid.TemplateColumn.superclass.constructor.call(this, cfg);\n        var tpl = (!Ext.isPrimitive(this.tpl) && this.tpl.compile) ? this.tpl : new Ext.XTemplate(this.tpl);\n        this.renderer = function(value, p, r){\n            return tpl.apply(r.data);\n        };\n        this.tpl = tpl;\n    }\n});\n\n\nExt.grid.ActionColumn = Ext.extend(Ext.grid.Column, {\n    \n    \n    \n    \n    \n    \n    \n    \n    header: '&#160;',\n\n    actionIdRe: /x-action-col-(\\d+)/,\n    \n    \n    altText: '',\n\n    constructor: function(cfg) {\n        var me = this,\n            items = cfg.items || (me.items = [me]),\n            l = items.length,\n            i,\n            item;\n\n        Ext.grid.ActionColumn.superclass.constructor.call(me, cfg);\n\n\n\n        me.renderer = function(v, meta) {\n\n            v = Ext.isFunction(cfg.renderer) ? cfg.renderer.apply(this, arguments)||'' : '';\n\n            meta.css += ' x-action-col-cell';\n            for (i = 0; i < l; i++) {\n                item = items[i];\n                v += '<img alt=\"' + (item.altText || me.altText) + '\" src=\"' + (item.icon || Ext.BLANK_IMAGE_URL) +\n                    '\" class=\"x-action-col-icon x-action-col-' + String(i) + ' ' + (item.iconCls || '') +\n                    ' ' + (Ext.isFunction(item.getClass) ? item.getClass.apply(item.scope||this.scope||this, arguments) : '') + '\"' +\n                    ((item.tooltip) ? ' ext:qtip=\"' + item.tooltip + '\"' : '') + ' />';\n            }\n            return v;\n        };\n    },\n\n    destroy: function() {\n        delete this.items;\n        delete this.renderer;\n        return Ext.grid.ActionColumn.superclass.destroy.apply(this, arguments);\n    },\n\n    \n    processEvent : function(name, e, grid, rowIndex, colIndex){\n        var m = e.getTarget().className.match(this.actionIdRe),\n            item, fn;\n        if (m && (item = this.items[parseInt(m[1], 10)])) {\n            if (name == 'click') {\n                (fn = item.handler || this.handler) && fn.call(item.scope||this.scope||this, grid, rowIndex, colIndex, item, e);\n            } else if ((name == 'mousedown') && (item.stopSelection !== false)) {\n                return false;\n            }\n        }\n        return Ext.grid.ActionColumn.superclass.processEvent.apply(this, arguments);\n    }\n});\n\n\nExt.grid.Column.types = {\n    gridcolumn : Ext.grid.Column,\n    booleancolumn: Ext.grid.BooleanColumn,\n    numbercolumn: Ext.grid.NumberColumn,\n    datecolumn: Ext.grid.DateColumn,\n    templatecolumn: Ext.grid.TemplateColumn,\n    actioncolumn: Ext.grid.ActionColumn\n};\nExt.grid.RowNumberer = Ext.extend(Object, {\n    \n    header: \"\",\n    \n    width: 23,\n    \n    sortable: false,\n    \n    constructor : function(config){\n        Ext.apply(this, config);\n        if(this.rowspan){\n            this.renderer = this.renderer.createDelegate(this);\n        }\n    },\n\n    \n    fixed:true,\n    hideable: false,\n    menuDisabled:true,\n    dataIndex: '',\n    id: 'numberer',\n    rowspan: undefined,\n\n    \n    renderer : function(v, p, record, rowIndex){\n        if(this.rowspan){\n            p.cellAttr = 'rowspan=\"'+this.rowspan+'\"';\n        }\n        return rowIndex+1;\n    }\n});\nExt.grid.CheckboxSelectionModel = Ext.extend(Ext.grid.RowSelectionModel, {\n\n    \n    \n    header : '<div class=\"x-grid3-hd-checker\">&#160;</div>',\n    \n    width : 20,\n    \n    sortable : false,\n\n    \n    menuDisabled : true,\n    fixed : true,\n    hideable: false,\n    dataIndex : '',\n    id : 'checker',\n    isColumn: true, \n\n    constructor : function(){\n        Ext.grid.CheckboxSelectionModel.superclass.constructor.apply(this, arguments);\n        if(this.checkOnly){\n            this.handleMouseDown = Ext.emptyFn;\n        }\n    },\n\n    \n    initEvents : function(){\n        Ext.grid.CheckboxSelectionModel.superclass.initEvents.call(this);\n        this.grid.on('render', function(){\n            Ext.fly(this.grid.getView().innerHd).on('mousedown', this.onHdMouseDown, this);\n        }, this);\n    },\n\n    \n    processEvent : function(name, e, grid, rowIndex, colIndex){\n        if (name == 'mousedown') {\n            this.onMouseDown(e, e.getTarget());\n            return false;\n        } else {\n            return Ext.grid.Column.prototype.processEvent.apply(this, arguments);\n        }\n    },\n\n    \n    onMouseDown : function(e, t){\n        if(e.button === 0 && t.className == 'x-grid3-row-checker'){ \n            e.stopEvent();\n            var row = e.getTarget('.x-grid3-row');\n            if(row){\n                var index = row.rowIndex;\n                if(this.isSelected(index)){\n                    this.deselectRow(index);\n                }else{\n                    this.selectRow(index, true);\n                    this.grid.getView().focusRow(index);\n                }\n            }\n        }\n    },\n\n    \n    onHdMouseDown : function(e, t) {\n        if(t.className == 'x-grid3-hd-checker'){\n            e.stopEvent();\n            var hd = Ext.fly(t.parentNode);\n            var isChecked = hd.hasClass('x-grid3-hd-checker-on');\n            if(isChecked){\n                hd.removeClass('x-grid3-hd-checker-on');\n                this.clearSelections();\n            }else{\n                hd.addClass('x-grid3-hd-checker-on');\n                this.selectAll();\n            }\n        }\n    },\n\n    \n    renderer : function(v, p, record){\n        return '<div class=\"x-grid3-row-checker\">&#160;</div>';\n    },\n    \n    onEditorSelect: function(row, lastRow){\n        if(lastRow != row && !this.checkOnly){\n            this.selectRow(row); \n        }\n    }\n});\nExt.grid.CellSelectionModel = Ext.extend(Ext.grid.AbstractSelectionModel,  {\n    \n    constructor : function(config){\n        Ext.apply(this, config);\n\n\t    this.selection = null;\n\t\n\t    this.addEvents(\n\t        \n\t        \"beforecellselect\",\n\t        \n\t        \"cellselect\",\n\t        \n\t        \"selectionchange\"\n\t    );\n\t\n\t    Ext.grid.CellSelectionModel.superclass.constructor.call(this);\n    },\n\n    \n    initEvents : function(){\n        this.grid.on('cellmousedown', this.handleMouseDown, this);\n        this.grid.on(Ext.EventManager.getKeyEvent(), this.handleKeyDown, this);\n        this.grid.getView().on({\n            scope: this,\n            refresh: this.onViewChange,\n            rowupdated: this.onRowUpdated,\n            beforerowremoved: this.clearSelections,\n            beforerowsinserted: this.clearSelections\n        });\n        if(this.grid.isEditor){\n            this.grid.on('beforeedit', this.beforeEdit,  this);\n        }\n    },\n\n\t\n    beforeEdit : function(e){\n        this.select(e.row, e.column, false, true, e.record);\n    },\n\n\t\n    onRowUpdated : function(v, index, r){\n        if(this.selection && this.selection.record == r){\n            v.onCellSelect(index, this.selection.cell[1]);\n        }\n    },\n\n\t\n    onViewChange : function(){\n        this.clearSelections(true);\n    },\n\n\t\n    getSelectedCell : function(){\n        return this.selection ? this.selection.cell : null;\n    },\n\n    \n    clearSelections : function(preventNotify){\n        var s = this.selection;\n        if(s){\n            if(preventNotify !== true){\n                this.grid.view.onCellDeselect(s.cell[0], s.cell[1]);\n            }\n            this.selection = null;\n            this.fireEvent(\"selectionchange\", this, null);\n        }\n    },\n\n    \n    hasSelection : function(){\n        return this.selection ? true : false;\n    },\n\n    \n    handleMouseDown : function(g, row, cell, e){\n        if(e.button !== 0 || this.isLocked()){\n            return;\n        }\n        this.select(row, cell);\n    },\n\n    \n    select : function(rowIndex, colIndex, preventViewNotify, preventFocus,  r){\n        if(this.fireEvent(\"beforecellselect\", this, rowIndex, colIndex) !== false){\n            this.clearSelections();\n            r = r || this.grid.store.getAt(rowIndex);\n            this.selection = {\n                record : r,\n                cell : [rowIndex, colIndex]\n            };\n            if(!preventViewNotify){\n                var v = this.grid.getView();\n                v.onCellSelect(rowIndex, colIndex);\n                if(preventFocus !== true){\n                    v.focusCell(rowIndex, colIndex);\n                }\n            }\n            this.fireEvent(\"cellselect\", this, rowIndex, colIndex);\n            this.fireEvent(\"selectionchange\", this, this.selection);\n        }\n    },\n\n\t\n    isSelectable : function(rowIndex, colIndex, cm){\n        return !cm.isHidden(colIndex);\n    },\n    \n    \n    onEditorKey: function(field, e){\n        if(e.getKey() == e.TAB){\n            this.handleKeyDown(e);\n        }\n    },\n\n    \n    handleKeyDown : function(e){\n        if(!e.isNavKeyPress()){\n            return;\n        }\n        \n        var k = e.getKey(),\n            g = this.grid,\n            s = this.selection,\n            sm = this,\n            walk = function(row, col, step){\n                return g.walkCells(\n                    row,\n                    col,\n                    step,\n                    g.isEditor && g.editing ? sm.acceptsNav : sm.isSelectable, \n                    sm\n                );\n            },\n            cell, newCell, r, c, ae;\n\n        switch(k){\n            case e.ESC:\n            case e.PAGE_UP:\n            case e.PAGE_DOWN:\n                \n                break;\n            default:\n                \n                e.stopEvent();\n                break;\n        }\n\n        if(!s){\n            cell = walk(0, 0, 1); \n            if(cell){\n                this.select(cell[0], cell[1]);\n            }\n            return;\n        }\n\n        cell = s.cell;  \n        r = cell[0];    \n        c = cell[1];    \n        \n        switch(k){\n            case e.TAB:\n                if(e.shiftKey){\n                    newCell = walk(r, c - 1, -1);\n                }else{\n                    newCell = walk(r, c + 1, 1);\n                }\n                break;\n            case e.DOWN:\n                newCell = walk(r + 1, c, 1);\n                break;\n            case e.UP:\n                newCell = walk(r - 1, c, -1);\n                break;\n            case e.RIGHT:\n                newCell = walk(r, c + 1, 1);\n                break;\n            case e.LEFT:\n                newCell = walk(r, c - 1, -1);\n                break;\n            case e.ENTER:\n                if (g.isEditor && !g.editing) {\n                    g.startEditing(r, c);\n                    return;\n                }\n                break;\n        }\n\n        if(newCell){\n            \n            r = newCell[0];\n            c = newCell[1];\n\n            this.select(r, c); \n\n            if(g.isEditor && g.editing){ \n                ae = g.activeEditor;\n                if(ae && ae.field.triggerBlur){\n                    \n                    ae.field.triggerBlur();\n                }\n                g.startEditing(r, c);\n            }\n        }\n    },\n\n    acceptsNav : function(row, col, cm){\n        return !cm.isHidden(col) && cm.isCellEditable(col, row);\n    }\n});\nExt.grid.EditorGridPanel = Ext.extend(Ext.grid.GridPanel, {\n    \n    clicksToEdit: 2,\n\n    \n    forceValidation: false,\n\n    \n    isEditor : true,\n    \n    detectEdit: false,\n\n    \n    autoEncode : false,\n\n    \n    \n    trackMouseOver: false, \n\n    \n    initComponent : function(){\n        Ext.grid.EditorGridPanel.superclass.initComponent.call(this);\n\n        if(!this.selModel){\n            \n            this.selModel = new Ext.grid.CellSelectionModel();\n        }\n\n        this.activeEditor = null;\n\n        this.addEvents(\n            \n            \"beforeedit\",\n            \n            \"afteredit\",\n            \n            \"validateedit\"\n        );\n    },\n\n    \n    initEvents : function(){\n        Ext.grid.EditorGridPanel.superclass.initEvents.call(this);\n\n        this.getGridEl().on('mousewheel', this.stopEditing.createDelegate(this, [true]), this);\n        this.on('columnresize', this.stopEditing, this, [true]);\n\n        if(this.clicksToEdit == 1){\n            this.on(\"cellclick\", this.onCellDblClick, this);\n        }else {\n            var view = this.getView();\n            if(this.clicksToEdit == 'auto' && view.mainBody){\n                view.mainBody.on('mousedown', this.onAutoEditClick, this);\n            }\n            this.on('celldblclick', this.onCellDblClick, this);\n        }\n    },\n\n    onResize : function(){\n        Ext.grid.EditorGridPanel.superclass.onResize.apply(this, arguments);\n        var ae = this.activeEditor;\n        if(this.editing && ae){\n            ae.realign(true);\n        }\n    },\n\n    \n    onCellDblClick : function(g, row, col){\n        this.startEditing(row, col);\n    },\n\n    \n    onAutoEditClick : function(e, t){\n        if(e.button !== 0){\n            return;\n        }\n        var row = this.view.findRowIndex(t),\n            col = this.view.findCellIndex(t);\n        if(row !== false && col !== false){\n            this.stopEditing();\n            if(this.selModel.getSelectedCell){ \n                var sc = this.selModel.getSelectedCell();\n                if(sc && sc[0] === row && sc[1] === col){\n                    this.startEditing(row, col);\n                }\n            }else{\n                if(this.selModel.isSelected(row)){\n                    this.startEditing(row, col);\n                }\n            }\n        }\n    },\n\n    \n    onEditComplete : function(ed, value, startValue){\n        this.editing = false;\n        this.lastActiveEditor = this.activeEditor;\n        this.activeEditor = null;\n\n        var r = ed.record,\n            field = this.colModel.getDataIndex(ed.col);\n        value = this.postEditValue(value, startValue, r, field);\n        if(this.forceValidation === true || String(value) !== String(startValue)){\n            var e = {\n                grid: this,\n                record: r,\n                field: field,\n                originalValue: startValue,\n                value: value,\n                row: ed.row,\n                column: ed.col,\n                cancel:false\n            };\n            if(this.fireEvent(\"validateedit\", e) !== false && !e.cancel && String(value) !== String(startValue)){\n                r.set(field, e.value);\n                delete e.cancel;\n                this.fireEvent(\"afteredit\", e);\n            }\n        }\n        this.view.focusCell(ed.row, ed.col);\n    },\n\n    \n    startEditing : function(row, col){\n        this.stopEditing();\n        if(this.colModel.isCellEditable(col, row)){\n            this.view.ensureVisible(row, col, true);\n            var r = this.store.getAt(row),\n                field = this.colModel.getDataIndex(col),\n                e = {\n                    grid: this,\n                    record: r,\n                    field: field,\n                    value: r.data[field],\n                    row: row,\n                    column: col,\n                    cancel:false\n                };\n            if(this.fireEvent(\"beforeedit\", e) !== false && !e.cancel){\n                this.editing = true;\n                var ed = this.colModel.getCellEditor(col, row);\n                if(!ed){\n                    return;\n                }\n                if(!ed.rendered){\n                    ed.parentEl = this.view.getEditorParent(ed);\n                    ed.on({\n                        scope: this,\n                        render: {\n                            fn: function(c){\n                                c.field.focus(false, true);\n                            },\n                            single: true,\n                            scope: this\n                        },\n                        specialkey: function(field, e){\n                            this.getSelectionModel().onEditorKey(field, e);\n                        },\n                        complete: this.onEditComplete,\n                        canceledit: this.stopEditing.createDelegate(this, [true])\n                    });\n                }\n                Ext.apply(ed, {\n                    row     : row,\n                    col     : col,\n                    record  : r\n                });\n                this.lastEdit = {\n                    row: row,\n                    col: col\n                };\n                this.activeEditor = ed;\n                if (ed.field.isXType('checkbox')) {\n                    ed.allowBlur = false;\n                    this.setupCheckbox(ed.field);    \n                }\n                \n                \n                ed.selectSameEditor = (this.activeEditor == this.lastActiveEditor);\n                var v = this.preEditValue(r, field);\n                ed.startEdit(this.view.getCell(row, col).firstChild, Ext.isDefined(v) ? v : '');\n\n                \n                (function(){\n                    delete ed.selectSameEditor;\n                }).defer(50);\n            }\n        }\n    },\n    \n    setupCheckbox: function(field){\n        var me = this,\n            fn = function() {\n                field.el.on('click', me.onCheckClick, me, {single: true});\n            };\n        if (field.rendered) {\n            fn();\n        } else {\n            field.on('render', fn, null, {single: true});\n        }\n    },\n    \n    onCheckClick: function(){\n        var ed = this.activeEditor;\n        ed.allowBlur = true;\n        ed.field.focus(false, 10);   \n    },\n\n    \n    preEditValue : function(r, field){\n        var value = r.data[field];\n        return this.autoEncode && Ext.isString(value) ? Ext.util.Format.htmlDecode(value) : value;\n    },\n\n    \n    postEditValue : function(value, originalValue, r, field){\n        return this.autoEncode && Ext.isString(value) ? Ext.util.Format.htmlEncode(value) : value;\n    },\n\n    \n    stopEditing : function(cancel){\n        if(this.editing){\n            \n            var ae = this.lastActiveEditor = this.activeEditor;\n            if(ae){\n                ae[cancel === true ? 'cancelEdit' : 'completeEdit']();\n                this.view.focusCell(ae.row, ae.col);\n            }\n            this.activeEditor = null;\n        }\n        this.editing = false;\n    }\n});\nExt.reg('editorgrid', Ext.grid.EditorGridPanel);\n\nExt.grid.GridEditor = function(field, config){\n    Ext.grid.GridEditor.superclass.constructor.call(this, field, config);\n    field.monitorTab = false;\n};\n\nExt.extend(Ext.grid.GridEditor, Ext.Editor, {\n    alignment: \"tl-tl\",\n    autoSize: \"width\",\n    hideEl : false,\n    cls: \"x-small-editor x-grid-editor\",\n    shim:false,\n    shadow:false\n});\nExt.grid.PropertyRecord = Ext.data.Record.create([\n    {name:'name',type:'string'}, 'value'\n]);\n\n\nExt.grid.PropertyStore = Ext.extend(Ext.util.Observable, {\n    \n    constructor : function(grid, source){\n        this.grid = grid;\n        this.store = new Ext.data.Store({\n            recordType : Ext.grid.PropertyRecord\n        });\n        this.store.on('update', this.onUpdate,  this);\n        if(source){\n            this.setSource(source);\n        }\n        Ext.grid.PropertyStore.superclass.constructor.call(this);    \n    },\n    \n    \n    setSource : function(o){\n        this.source = o;\n        this.store.removeAll();\n        var data = [];\n        for(var k in o){\n            if(this.isEditableValue(o[k])){\n                data.push(new Ext.grid.PropertyRecord({name: k, value: o[k]}, k));\n            }\n        }\n        this.store.loadRecords({records: data}, {}, true);\n    },\n\n    \n    onUpdate : function(ds, record, type){\n        if(type == Ext.data.Record.EDIT){\n            var v = record.data.value;\n            var oldValue = record.modified.value;\n            if(this.grid.fireEvent('beforepropertychange', this.source, record.id, v, oldValue) !== false){\n                this.source[record.id] = v;\n                record.commit();\n                this.grid.fireEvent('propertychange', this.source, record.id, v, oldValue);\n            }else{\n                record.reject();\n            }\n        }\n    },\n\n    \n    getProperty : function(row){\n       return this.store.getAt(row);\n    },\n\n    \n    isEditableValue: function(val){\n        return Ext.isPrimitive(val) || Ext.isDate(val);\n    },\n\n    \n    setValue : function(prop, value, create){\n        var r = this.getRec(prop);\n        if(r){\n            r.set('value', value);\n            this.source[prop] = value;\n        }else if(create){\n            \n            this.source[prop] = value;\n            r = new Ext.grid.PropertyRecord({name: prop, value: value}, prop);\n            this.store.add(r);\n\n        }\n    },\n    \n    \n    remove : function(prop){\n        var r = this.getRec(prop);\n        if(r){\n            this.store.remove(r);\n            delete this.source[prop];\n        }\n    },\n    \n    \n    getRec : function(prop){\n        return this.store.getById(prop);\n    },\n\n    \n    getSource : function(){\n        return this.source;\n    }\n});\n\n\nExt.grid.PropertyColumnModel = Ext.extend(Ext.grid.ColumnModel, {\n    \n    nameText : 'Name',\n    valueText : 'Value',\n    dateFormat : 'm/j/Y',\n    trueText: 'true',\n    falseText: 'false',\n    \n    constructor : function(grid, store){\n        var g = Ext.grid,\n\t        f = Ext.form;\n\t        \n\t    this.grid = grid;\n\t    g.PropertyColumnModel.superclass.constructor.call(this, [\n\t        {header: this.nameText, width:50, sortable: true, dataIndex:'name', id: 'name', menuDisabled:true},\n\t        {header: this.valueText, width:50, resizable:false, dataIndex: 'value', id: 'value', menuDisabled:true}\n\t    ]);\n\t    this.store = store;\n\t\n\t    var bfield = new f.Field({\n\t        autoCreate: {tag: 'select', children: [\n\t            {tag: 'option', value: 'true', html: this.trueText},\n\t            {tag: 'option', value: 'false', html: this.falseText}\n\t        ]},\n\t        getValue : function(){\n\t            return this.el.dom.value == 'true';\n\t        }\n\t    });\n\t    this.editors = {\n\t        'date' : new g.GridEditor(new f.DateField({selectOnFocus:true})),\n\t        'string' : new g.GridEditor(new f.TextField({selectOnFocus:true})),\n\t        'number' : new g.GridEditor(new f.NumberField({selectOnFocus:true, style:'text-align:left;'})),\n\t        'boolean' : new g.GridEditor(bfield, {\n\t            autoSize: 'both'\n\t        })\n\t    };\n\t    this.renderCellDelegate = this.renderCell.createDelegate(this);\n\t    this.renderPropDelegate = this.renderProp.createDelegate(this);\n    },\n\n    \n    renderDate : function(dateVal){\n        return dateVal.dateFormat(this.dateFormat);\n    },\n\n    \n    renderBool : function(bVal){\n        return this[bVal ? 'trueText' : 'falseText'];\n    },\n\n    \n    isCellEditable : function(colIndex, rowIndex){\n        return colIndex == 1;\n    },\n\n    \n    getRenderer : function(col){\n        return col == 1 ?\n            this.renderCellDelegate : this.renderPropDelegate;\n    },\n\n    \n    renderProp : function(v){\n        return this.getPropertyName(v);\n    },\n\n    \n    renderCell : function(val, meta, rec){\n        var renderer = this.grid.customRenderers[rec.get('name')];\n        if(renderer){\n            return renderer.apply(this, arguments);\n        }\n        var rv = val;\n        if(Ext.isDate(val)){\n            rv = this.renderDate(val);\n        }else if(typeof val == 'boolean'){\n            rv = this.renderBool(val);\n        }\n        return Ext.util.Format.htmlEncode(rv);\n    },\n\n    \n    getPropertyName : function(name){\n        var pn = this.grid.propertyNames;\n        return pn && pn[name] ? pn[name] : name;\n    },\n\n    \n    getCellEditor : function(colIndex, rowIndex){\n        var p = this.store.getProperty(rowIndex),\n            n = p.data.name, \n            val = p.data.value;\n        if(this.grid.customEditors[n]){\n            return this.grid.customEditors[n];\n        }\n        if(Ext.isDate(val)){\n            return this.editors.date;\n        }else if(typeof val == 'number'){\n            return this.editors.number;\n        }else if(typeof val == 'boolean'){\n            return this.editors['boolean'];\n        }else{\n            return this.editors.string;\n        }\n    },\n\n    \n    destroy : function(){\n        Ext.grid.PropertyColumnModel.superclass.destroy.call(this);\n        this.destroyEditors(this.editors);\n        this.destroyEditors(this.grid.customEditors);\n    },\n    \n    destroyEditors: function(editors){\n        for(var ed in editors){\n            Ext.destroy(editors[ed]);\n        }\n    }\n});\n\n\nExt.grid.PropertyGrid = Ext.extend(Ext.grid.EditorGridPanel, {\n    \n    \n    \n    \n\n    \n    enableColumnMove:false,\n    stripeRows:false,\n    trackMouseOver: false,\n    clicksToEdit:1,\n    enableHdMenu : false,\n    viewConfig : {\n        forceFit:true\n    },\n\n    \n    initComponent : function(){\n        this.customRenderers = this.customRenderers || {};\n        this.customEditors = this.customEditors || {};\n        this.lastEditRow = null;\n        var store = new Ext.grid.PropertyStore(this);\n        this.propStore = store;\n        var cm = new Ext.grid.PropertyColumnModel(this, store);\n        store.store.sort('name', 'ASC');\n        this.addEvents(\n            \n            'beforepropertychange',\n            \n            'propertychange'\n        );\n        this.cm = cm;\n        this.ds = store.store;\n        Ext.grid.PropertyGrid.superclass.initComponent.call(this);\n\n\t\tthis.mon(this.selModel, 'beforecellselect', function(sm, rowIndex, colIndex){\n            if(colIndex === 0){\n                this.startEditing.defer(200, this, [rowIndex, 1]);\n                return false;\n            }\n        }, this);\n    },\n\n    \n    onRender : function(){\n        Ext.grid.PropertyGrid.superclass.onRender.apply(this, arguments);\n\n        this.getGridEl().addClass('x-props-grid');\n    },\n\n    \n    afterRender: function(){\n        Ext.grid.PropertyGrid.superclass.afterRender.apply(this, arguments);\n        if(this.source){\n            this.setSource(this.source);\n        }\n    },\n\n    \n    setSource : function(source){\n        this.propStore.setSource(source);\n    },\n\n    \n    getSource : function(){\n        return this.propStore.getSource();\n    },\n    \n    \n    setProperty : function(prop, value, create){\n        this.propStore.setValue(prop, value, create);    \n    },\n    \n    \n    removeProperty : function(prop){\n        this.propStore.remove(prop);\n    }\n\n    \n    \n    \n    \n});\nExt.reg(\"propertygrid\", Ext.grid.PropertyGrid);\n\nExt.grid.GroupingView = Ext.extend(Ext.grid.GridView, {\n\n    \n    groupByText : 'Group By This Field',\n    \n    showGroupsText : 'Show in Groups',\n    \n    hideGroupedColumn : false,\n    \n    showGroupName : true,\n    \n    startCollapsed : false,\n    \n    enableGrouping : true,\n    \n    enableGroupingMenu : true,\n    \n    enableNoGroups : true,\n    \n    emptyGroupText : '(None)',\n    \n    ignoreAdd : false,\n    \n    groupTextTpl : '{text}',\n\n    \n    groupMode: 'value',\n\n    \n    \n    \n    cancelEditOnToggle: true,\n\n    \n    initTemplates : function(){\n        Ext.grid.GroupingView.superclass.initTemplates.call(this);\n        this.state = {};\n\n        var sm = this.grid.getSelectionModel();\n        sm.on(sm.selectRow ? 'beforerowselect' : 'beforecellselect',\n                this.onBeforeRowSelect, this);\n\n        if(!this.startGroup){\n            this.startGroup = new Ext.XTemplate(\n                '<div id=\"{groupId}\" class=\"x-grid-group {cls}\">',\n                    '<div id=\"{groupId}-hd\" class=\"x-grid-group-hd\" style=\"{style}\"><div class=\"x-grid-group-title\">', this.groupTextTpl ,'</div></div>',\n                    '<div id=\"{groupId}-bd\" class=\"x-grid-group-body\">'\n            );\n        }\n        this.startGroup.compile();\n\n        if (!this.endGroup) {\n            this.endGroup = '</div></div>';\n        }\n    },\n\n    \n    findGroup : function(el){\n        return Ext.fly(el).up('.x-grid-group', this.mainBody.dom);\n    },\n\n    \n    getGroups : function(){\n        return this.hasRows() ? this.mainBody.dom.childNodes : [];\n    },\n\n    \n    onAdd : function(ds, records, index) {\n        if (this.canGroup() && !this.ignoreAdd) {\n            var ss = this.getScrollState();\n            this.fireEvent('beforerowsinserted', ds, index, index + (records.length-1));\n            this.refresh();\n            this.restoreScroll(ss);\n            this.fireEvent('rowsinserted', ds, index, index + (records.length-1));\n        } else if (!this.canGroup()) {\n            Ext.grid.GroupingView.superclass.onAdd.apply(this, arguments);\n        }\n    },\n\n    \n    onRemove : function(ds, record, index, isUpdate){\n        Ext.grid.GroupingView.superclass.onRemove.apply(this, arguments);\n        var g = document.getElementById(record._groupId);\n        if(g && g.childNodes[1].childNodes.length < 1){\n            Ext.removeNode(g);\n        }\n        this.applyEmptyText();\n    },\n\n    \n    refreshRow : function(record){\n        if(this.ds.getCount()==1){\n            this.refresh();\n        }else{\n            this.isUpdating = true;\n            Ext.grid.GroupingView.superclass.refreshRow.apply(this, arguments);\n            this.isUpdating = false;\n        }\n    },\n\n    \n    beforeMenuShow : function(){\n        var item, items = this.hmenu.items, disabled = this.cm.config[this.hdCtxIndex].groupable === false;\n        if((item = items.get('groupBy'))){\n            item.setDisabled(disabled);\n        }\n        if((item = items.get('showGroups'))){\n            item.setDisabled(disabled);\n            item.setChecked(this.canGroup(), true);\n        }\n    },\n\n    \n    renderUI : function(){\n        var markup = Ext.grid.GroupingView.superclass.renderUI.call(this);\n\n        if(this.enableGroupingMenu && this.hmenu){\n            this.hmenu.add('-',{\n                itemId:'groupBy',\n                text: this.groupByText,\n                handler: this.onGroupByClick,\n                scope: this,\n                iconCls:'x-group-by-icon'\n            });\n            if(this.enableNoGroups){\n                this.hmenu.add({\n                    itemId:'showGroups',\n                    text: this.showGroupsText,\n                    checked: true,\n                    checkHandler: this.onShowGroupsClick,\n                    scope: this\n                });\n            }\n            this.hmenu.on('beforeshow', this.beforeMenuShow, this);\n        }\n        return markup;\n    },\n\n    processEvent: function(name, e){\n        Ext.grid.GroupingView.superclass.processEvent.call(this, name, e);\n        var hd = e.getTarget('.x-grid-group-hd', this.mainBody);\n        if(hd){\n            \n            var field = this.getGroupField(),\n                prefix = this.getPrefix(field),\n                groupValue = hd.id.substring(prefix.length),\n                emptyRe = new RegExp('gp-' + Ext.escapeRe(field) + '--hd');\n\n            \n            groupValue = groupValue.substr(0, groupValue.length - 3);\n            \n            \n            if(groupValue || emptyRe.test(hd.id)){\n                this.grid.fireEvent('group' + name, this.grid, field, groupValue, e);\n            }\n            if(name == 'mousedown' && e.button == 0){\n                this.toggleGroup(hd.parentNode);\n            }\n        }\n\n    },\n\n    \n    onGroupByClick : function(){\n        var grid = this.grid;\n        this.enableGrouping = true;\n        grid.store.groupBy(this.cm.getDataIndex(this.hdCtxIndex));\n        grid.fireEvent('groupchange', grid, grid.store.getGroupState());\n        this.beforeMenuShow(); \n        this.refresh();\n    },\n\n    \n    onShowGroupsClick : function(mi, checked){\n        this.enableGrouping = checked;\n        if(checked){\n            this.onGroupByClick();\n        }else{\n            this.grid.store.clearGrouping();\n            this.grid.fireEvent('groupchange', this, null);\n        }\n    },\n\n    \n    toggleRowIndex : function(rowIndex, expanded){\n        if(!this.canGroup()){\n            return;\n        }\n        var row = this.getRow(rowIndex);\n        if(row){\n            this.toggleGroup(this.findGroup(row), expanded);\n        }\n    },\n\n    \n    toggleGroup : function(group, expanded){\n        var gel = Ext.get(group),\n            id = Ext.util.Format.htmlEncode(gel.id);\n \n        expanded = Ext.isDefined(expanded) ? expanded : gel.hasClass('x-grid-group-collapsed');\n        if(this.state[id] !== expanded){\n            if (this.cancelEditOnToggle !== false) {\n                this.grid.stopEditing(true);\n            }\n            this.state[id] = expanded;\n            gel[expanded ? 'removeClass' : 'addClass']('x-grid-group-collapsed');\n        }\n    },\n\n    \n    toggleAllGroups : function(expanded){\n        var groups = this.getGroups();\n        for(var i = 0, len = groups.length; i < len; i++){\n            this.toggleGroup(groups[i], expanded);\n        }\n    },\n\n    \n    expandAllGroups : function(){\n        this.toggleAllGroups(true);\n    },\n\n    \n    collapseAllGroups : function(){\n        this.toggleAllGroups(false);\n    },\n\n    \n    getGroup : function(v, r, groupRenderer, rowIndex, colIndex, ds){\n        var column = this.cm.config[colIndex],\n            g = groupRenderer ? groupRenderer.call(column.scope, v, {}, r, rowIndex, colIndex, ds) : String(v);\n        if(g === '' || g === '&#160;'){\n            g = column.emptyGroupText || this.emptyGroupText;\n        }\n        return g;\n    },\n\n    \n    getGroupField : function(){\n        return this.grid.store.getGroupState();\n    },\n\n    \n    afterRender : function(){\n        if(!this.ds || !this.cm){\n            return;\n        }\n        Ext.grid.GroupingView.superclass.afterRender.call(this);\n        if(this.grid.deferRowRender){\n            this.updateGroupWidths();\n        }\n    },\n    \n    afterRenderUI: function () {\n        Ext.grid.GroupingView.superclass.afterRenderUI.call(this);\n\n        if (this.enableGroupingMenu && this.hmenu) {\n            this.hmenu.add('-',{\n                itemId:'groupBy',\n                text: this.groupByText,\n                handler: this.onGroupByClick,\n                scope: this,\n                iconCls:'x-group-by-icon'\n            });\n            \n            if (this.enableNoGroups) {\n                this.hmenu.add({\n                    itemId:'showGroups',\n                    text: this.showGroupsText,\n                    checked: true,\n                    checkHandler: this.onShowGroupsClick,\n                    scope: this\n                });\n            }\n            \n            this.hmenu.on('beforeshow', this.beforeMenuShow, this);\n        }\n    },\n\n    \n    renderRows : function(){\n        var groupField = this.getGroupField();\n        var eg = !!groupField;\n        \n        if(this.hideGroupedColumn) {\n            var colIndex = this.cm.findColumnIndex(groupField),\n                hasLastGroupField = Ext.isDefined(this.lastGroupField);\n            if(!eg && hasLastGroupField){\n                this.mainBody.update('');\n                this.cm.setHidden(this.cm.findColumnIndex(this.lastGroupField), false);\n                delete this.lastGroupField;\n            }else if (eg && !hasLastGroupField){\n                this.lastGroupField = groupField;\n                this.cm.setHidden(colIndex, true);\n            }else if (eg && hasLastGroupField && groupField !== this.lastGroupField) {\n                this.mainBody.update('');\n                var oldIndex = this.cm.findColumnIndex(this.lastGroupField);\n                this.cm.setHidden(oldIndex, false);\n                this.lastGroupField = groupField;\n                this.cm.setHidden(colIndex, true);\n            }\n        }\n        return Ext.grid.GroupingView.superclass.renderRows.apply(\n                    this, arguments);\n    },\n\n    \n    doRender : function(cs, rs, ds, startRow, colCount, stripe){\n        if(rs.length < 1){\n            return '';\n        }\n\n        if(!this.canGroup() || this.isUpdating){\n            return Ext.grid.GroupingView.superclass.doRender.apply(this, arguments);\n        }\n\n        var groupField = this.getGroupField(),\n            colIndex = this.cm.findColumnIndex(groupField),\n            g,\n            gstyle = 'width:' + this.getTotalWidth() + ';',\n            cfg = this.cm.config[colIndex],\n            groupRenderer = cfg.groupRenderer || cfg.renderer,\n            prefix = this.showGroupName ? (cfg.groupName || cfg.header)+': ' : '',\n            groups = [],\n            curGroup, i, len, gid;\n\n        for(i = 0, len = rs.length; i < len; i++){\n            var rowIndex = startRow + i,\n                r = rs[i],\n                gvalue = r.data[groupField];\n\n                g = this.getGroup(gvalue, r, groupRenderer, rowIndex, colIndex, ds);\n            if(!curGroup || curGroup.group != g){\n                gid = this.constructId(gvalue, groupField, colIndex);\n                \n                \n                this.state[gid] = !(Ext.isDefined(this.state[gid]) ? !this.state[gid] : this.startCollapsed);\n                curGroup = {\n                    group: g,\n                    gvalue: gvalue,\n                    text: prefix + g,\n                    groupId: gid,\n                    startRow: rowIndex,\n                    rs: [r],\n                    cls: this.state[gid] ? '' : 'x-grid-group-collapsed',\n                    style: gstyle\n                };\n                groups.push(curGroup);\n            }else{\n                curGroup.rs.push(r);\n            }\n            r._groupId = gid;\n        }\n\n        var buf = [];\n        for(i = 0, len = groups.length; i < len; i++){\n            g = groups[i];\n            this.doGroupStart(buf, g, cs, ds, colCount);\n            buf[buf.length] = Ext.grid.GroupingView.superclass.doRender.call(\n                    this, cs, g.rs, ds, g.startRow, colCount, stripe);\n\n            this.doGroupEnd(buf, g, cs, ds, colCount);\n        }\n        return buf.join('');\n    },\n\n    \n    getGroupId : function(value){\n        var field = this.getGroupField();\n        return this.constructId(value, field, this.cm.findColumnIndex(field));\n    },\n\n    \n    constructId : function(value, field, idx){\n        var cfg = this.cm.config[idx],\n            groupRenderer = cfg.groupRenderer || cfg.renderer,\n            val = (this.groupMode == 'value') ? value : this.getGroup(value, {data:{}}, groupRenderer, 0, idx, this.ds);\n\n        return this.getPrefix(field) + Ext.util.Format.htmlEncode(val);\n    },\n\n    \n    canGroup  : function(){\n        return this.enableGrouping && !!this.getGroupField();\n    },\n\n    \n    getPrefix: function(field){\n        return this.grid.getGridEl().id + '-gp-' + field + '-';\n    },\n\n    \n    doGroupStart : function(buf, g, cs, ds, colCount){\n        buf[buf.length] = this.startGroup.apply(g);\n    },\n\n    \n    doGroupEnd : function(buf, g, cs, ds, colCount){\n        buf[buf.length] = this.endGroup;\n    },\n\n    \n    getRows : function(){\n        if(!this.canGroup()){\n            return Ext.grid.GroupingView.superclass.getRows.call(this);\n        }\n        var r = [],\n            gs = this.getGroups(),\n            g,\n            i = 0,\n            len = gs.length,\n            j,\n            jlen;\n        for(; i < len; ++i){\n            g = gs[i].childNodes[1];\n            if(g){\n                g = g.childNodes;\n                for(j = 0, jlen = g.length; j < jlen; ++j){\n                    r[r.length] = g[j];\n                }\n            }\n        }\n        return r;\n    },\n\n    \n    updateGroupWidths : function(){\n        if(!this.canGroup() || !this.hasRows()){\n            return;\n        }\n        var tw = Math.max(this.cm.getTotalWidth(), this.el.dom.offsetWidth-this.getScrollOffset()) +'px';\n        var gs = this.getGroups();\n        for(var i = 0, len = gs.length; i < len; i++){\n            gs[i].firstChild.style.width = tw;\n        }\n    },\n\n    \n    onColumnWidthUpdated : function(col, w, tw){\n        Ext.grid.GroupingView.superclass.onColumnWidthUpdated.call(this, col, w, tw);\n        this.updateGroupWidths();\n    },\n\n    \n    onAllColumnWidthsUpdated : function(ws, tw){\n        Ext.grid.GroupingView.superclass.onAllColumnWidthsUpdated.call(this, ws, tw);\n        this.updateGroupWidths();\n    },\n\n    \n    onColumnHiddenUpdated : function(col, hidden, tw){\n        Ext.grid.GroupingView.superclass.onColumnHiddenUpdated.call(this, col, hidden, tw);\n        this.updateGroupWidths();\n    },\n\n    \n    onLayout : function(){\n        this.updateGroupWidths();\n    },\n\n    \n    onBeforeRowSelect : function(sm, rowIndex){\n        this.toggleRowIndex(rowIndex, true);\n    }\n});\n\nExt.grid.GroupingView.GROUP_ID = 1000;\n"
  },
  {
    "path": "client/src/ext/ext-all.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n(function(){var h=Ext.util,j=Ext.each,g=true,i=false;h.Observable=function(){var k=this,l=k.events;if(k.listeners){k.on(k.listeners);delete k.listeners}k.events=l||{}};h.Observable.prototype={filterOptRe:/^(?:scope|delay|buffer|single)$/,fireEvent:function(){var k=Array.prototype.slice.call(arguments,0),m=k[0].toLowerCase(),n=this,l=g,p=n.events[m],s,o,r;if(n.eventsSuspended===g){if(o=n.eventQueue){o.push(k)}}else{if(typeof p==\"object\"){if(p.bubble){if(p.fire.apply(p,k.slice(1))===i){return i}r=n.getBubbleTarget&&n.getBubbleTarget();if(r&&r.enableBubble){s=r.events[m];if(!s||typeof s!=\"object\"||!s.bubble){r.enableBubble(m)}return r.fireEvent.apply(r,k)}}else{k.shift();l=p.fire.apply(p,k)}}}return l},addListener:function(k,m,l,r){var n=this,q,s,p;if(typeof k==\"object\"){r=k;for(q in r){s=r[q];if(!n.filterOptRe.test(q)){n.addListener(q,s.fn||s,s.scope||r.scope,s.fn?s:r)}}}else{k=k.toLowerCase();p=n.events[k]||g;if(typeof p==\"boolean\"){n.events[k]=p=new h.Event(n,k)}p.addListener(m,l,typeof r==\"object\"?r:{})}},removeListener:function(k,m,l){var n=this.events[k.toLowerCase()];if(typeof n==\"object\"){n.removeListener(m,l)}},purgeListeners:function(){var m=this.events,k,l;for(l in m){k=m[l];if(typeof k==\"object\"){k.clearListeners()}}},addEvents:function(n){var m=this;m.events=m.events||{};if(typeof n==\"string\"){var k=arguments,l=k.length;while(l--){m.events[k[l]]=m.events[k[l]]||g}}else{Ext.applyIf(m.events,n)}},hasListener:function(k){var l=this.events[k.toLowerCase()];return typeof l==\"object\"&&l.listeners.length>0},suspendEvents:function(k){this.eventsSuspended=g;if(k&&!this.eventQueue){this.eventQueue=[]}},resumeEvents:function(){var k=this,l=k.eventQueue||[];k.eventsSuspended=i;delete k.eventQueue;j(l,function(m){k.fireEvent.apply(k,m)})}};var d=h.Observable.prototype;d.on=d.addListener;d.un=d.removeListener;h.Observable.releaseCapture=function(k){k.fireEvent=d.fireEvent};function e(l,m,k){return function(){if(m.target==arguments[0]){l.apply(k,Array.prototype.slice.call(arguments,0))}}}function b(n,p,k,m){k.task=new h.DelayedTask();return function(){k.task.delay(p.buffer,n,m,Array.prototype.slice.call(arguments,0))}}function c(m,n,l,k){return function(){n.removeListener(l,k);return m.apply(k,arguments)}}function a(n,p,k,m){return function(){var l=new h.DelayedTask(),o=Array.prototype.slice.call(arguments,0);if(!k.tasks){k.tasks=[]}k.tasks.push(l);l.delay(p.delay||10,function(){k.tasks.remove(l);n.apply(m,o)},m)}}h.Event=function(l,k){this.name=k;this.obj=l;this.listeners=[]};h.Event.prototype={addListener:function(o,n,m){var p=this,k;n=n||p.obj;if(!p.isListening(o,n)){k=p.createListener(o,n,m);if(p.firing){p.listeners=p.listeners.slice(0)}p.listeners.push(k)}},createListener:function(p,n,q){q=q||{};n=n||this.obj;var k={fn:p,scope:n,options:q},m=p;if(q.target){m=e(m,q,n)}if(q.delay){m=a(m,q,k,n)}if(q.single){m=c(m,this,p,n)}if(q.buffer){m=b(m,q,k,n)}k.fireFn=m;return k},findListener:function(o,n){var p=this.listeners,m=p.length,k;n=n||this.obj;while(m--){k=p[m];if(k){if(k.fn==o&&k.scope==n){return m}}}return -1},isListening:function(l,k){return this.findListener(l,k)!=-1},removeListener:function(r,q){var p,m,n,s=this,o=i;if((p=s.findListener(r,q))!=-1){if(s.firing){s.listeners=s.listeners.slice(0)}m=s.listeners[p];if(m.task){m.task.cancel();delete m.task}n=m.tasks&&m.tasks.length;if(n){while(n--){m.tasks[n].cancel()}delete m.tasks}s.listeners.splice(p,1);o=g}return o},clearListeners:function(){var n=this,k=n.listeners,m=k.length;while(m--){n.removeListener(k[m].fn,k[m].scope)}},fire:function(){var q=this,p=q.listeners,k=p.length,o=0,m;if(k>0){q.firing=g;var n=Array.prototype.slice.call(arguments,0);for(;o<k;o++){m=p[o];if(m&&m.fireFn.apply(m.scope||q.obj||window,n)===i){return(q.firing=i)}}}q.firing=i;return g}}})();Ext.DomHelper=function(){var x=null,k=/^(?:br|frame|hr|img|input|link|meta|range|spacer|wbr|area|param|col)$/i,m=/^table|tbody|tr|td$/i,d=/tag|children|cn|html$/i,t=/td|tr|tbody/i,o=/([a-z0-9-]+)\\s*:\\s*([^;\\s]+(?:\\s*[^;\\s]+)*);?/gi,v=/end/i,r,n=\"afterbegin\",p=\"afterend\",c=\"beforebegin\",q=\"beforeend\",a=\"<table>\",i=\"</table>\",b=a+\"<tbody>\",j=\"</tbody>\"+i,l=b+\"<tr>\",w=\"</tr>\"+j;function h(B,D,C,E,A,y){var z=r.insertHtml(E,Ext.getDom(B),u(D));return C?Ext.get(z,true):z}function u(D){var z=\"\",y,C,B,E;if(typeof D==\"string\"){z=D}else{if(Ext.isArray(D)){for(var A=0;A<D.length;A++){if(D[A]){z+=u(D[A])}}}else{z+=\"<\"+(D.tag=D.tag||\"div\");for(y in D){C=D[y];if(!d.test(y)){if(typeof C==\"object\"){z+=\" \"+y+'=\"';for(B in C){z+=B+\":\"+C[B]+\";\"}z+='\"'}else{z+=\" \"+({cls:\"class\",htmlFor:\"for\"}[y]||y)+'=\"'+C+'\"'}}}if(k.test(D.tag)){z+=\"/>\"}else{z+=\">\";if((E=D.children||D.cn)){z+=u(E)}else{if(D.html){z+=D.html}}z+=\"</\"+D.tag+\">\"}}}return z}function g(F,C,B,D){x.innerHTML=[C,B,D].join(\"\");var y=-1,A=x,z;while(++y<F){A=A.firstChild}if(z=A.nextSibling){var E=document.createDocumentFragment();while(A){z=A.nextSibling;E.appendChild(A);A=z}A=E}return A}function e(y,z,B,A){var C,D;x=x||document.createElement(\"div\");if(y==\"td\"&&(z==n||z==q)||!t.test(y)&&(z==c||z==p)){return}D=z==c?B:z==p?B.nextSibling:z==n?B.firstChild:null;if(z==c||z==p){B=B.parentNode}if(y==\"td\"||(y==\"tr\"&&(z==q||z==n))){C=g(4,l,A,w)}else{if((y==\"tbody\"&&(z==q||z==n))||(y==\"tr\"&&(z==c||z==p))){C=g(3,b,A,j)}else{C=g(2,a,A,i)}}B.insertBefore(C,D);return C}function s(A){var D=document.createElement(\"div\"),y=document.createDocumentFragment(),z=0,B,C;D.innerHTML=A;C=D.childNodes;B=C.length;for(;z<B;z++){y.appendChild(C[z].cloneNode(true))}return y}r={markup:function(y){return u(y)},applyStyles:function(y,z){if(z){var A;y=Ext.fly(y);if(typeof z==\"function\"){z=z.call()}if(typeof z==\"string\"){o.lastIndex=0;while((A=o.exec(z))){y.setStyle(A[1],A[2])}}else{if(typeof z==\"object\"){y.setStyle(z)}}}},insertHtml:function(D,y,E){var B={},A,F,C,G,H,z;D=D.toLowerCase();B[c]=[\"BeforeBegin\",\"previousSibling\"];B[p]=[\"AfterEnd\",\"nextSibling\"];if(y.insertAdjacentHTML){if(m.test(y.tagName)&&(z=e(y.tagName.toLowerCase(),D,y,E))){return z}B[n]=[\"AfterBegin\",\"firstChild\"];B[q]=[\"BeforeEnd\",\"lastChild\"];if((A=B[D])){y.insertAdjacentHTML(A[0],E);return y[A[1]]}}else{F=y.ownerDocument.createRange();G=\"setStart\"+(v.test(D)?\"After\":\"Before\");if(B[D]){F[G](y);if(!F.createContextualFragment){H=s(E)}else{H=F.createContextualFragment(E)}y.parentNode.insertBefore(H,D==c?y:y.nextSibling);return y[(D==c?\"previous\":\"next\")+\"Sibling\"]}else{C=(D==n?\"first\":\"last\")+\"Child\";if(y.firstChild){F[G](y[C]);if(!F.createContextualFragment){H=s(E)}else{H=F.createContextualFragment(E)}if(D==n){y.insertBefore(H,y.firstChild)}else{y.appendChild(H)}}else{y.innerHTML=E}return y[C]}}throw'Illegal insertion point -> \"'+D+'\"'},insertBefore:function(y,A,z){return h(y,A,z,c)},insertAfter:function(y,A,z){return h(y,A,z,p,\"nextSibling\")},insertFirst:function(y,A,z){return h(y,A,z,n,\"firstChild\")},append:function(y,A,z){return h(y,A,z,q,\"\",true)},overwrite:function(y,A,z){y=Ext.getDom(y);y.innerHTML=u(A);return z?Ext.get(y.firstChild):y.firstChild},createHtml:u};return r}();Ext.Template=function(h){var j=this,c=arguments,e=[],d;if(Ext.isArray(h)){h=h.join(\"\")}else{if(c.length>1){for(var g=0,b=c.length;g<b;g++){d=c[g];if(typeof d==\"object\"){Ext.apply(j,d)}else{e.push(d)}}h=e.join(\"\")}}j.html=h;if(j.compiled){j.compile()}};Ext.Template.prototype={re:/\\{([\\w\\-]+)\\}/g,applyTemplate:function(a){var b=this;return b.compiled?b.compiled(a):b.html.replace(b.re,function(c,d){return a[d]!==undefined?a[d]:\"\"})},set:function(a,c){var b=this;b.html=a;b.compiled=null;return c?b.compile():b},compile:function(){var me=this,sep=Ext.isGecko?\"+\":\",\";function fn(m,name){name=\"values['\"+name+\"']\";return\"'\"+sep+\"(\"+name+\" == undefined ? '' : \"+name+\")\"+sep+\"'\"}eval(\"this.compiled = function(values){ return \"+(Ext.isGecko?\"'\":\"['\")+me.html.replace(/\\\\/g,\"\\\\\\\\\").replace(/(\\r\\n|\\n)/g,\"\\\\n\").replace(/'/g,\"\\\\'\").replace(this.re,fn)+(Ext.isGecko?\"';};\":\"'].join('');};\"));return me},insertFirst:function(b,a,c){return this.doInsert(\"afterBegin\",b,a,c)},insertBefore:function(b,a,c){return this.doInsert(\"beforeBegin\",b,a,c)},insertAfter:function(b,a,c){return this.doInsert(\"afterEnd\",b,a,c)},append:function(b,a,c){return this.doInsert(\"beforeEnd\",b,a,c)},doInsert:function(c,e,b,a){e=Ext.getDom(e);var d=Ext.DomHelper.insertHtml(c,e,this.applyTemplate(b));return a?Ext.get(d,true):d},overwrite:function(b,a,c){b=Ext.getDom(b);b.innerHTML=this.applyTemplate(a);return c?Ext.get(b.firstChild,true):b.firstChild}};Ext.Template.prototype.apply=Ext.Template.prototype.applyTemplate;Ext.Template.from=function(b,a){b=Ext.getDom(b);return new Ext.Template(b.value||b.innerHTML,a||\"\")};Ext.DomQuery=function(){var cache={},simpleCache={},valueCache={},nonSpace=/\\S/,trimRe=/^\\s+|\\s+$/g,tplRe=/\\{(\\d+)\\}/g,modeRe=/^(\\s?[\\/>+~]\\s?|\\s|$)/,tagTokenRe=/^(#)?([\\w\\-\\*]+)/,nthRe=/(\\d*)n\\+?(\\d*)/,nthRe2=/\\D/,isIE=window.ActiveXObject?true:false,key=30803;eval(\"var batch = 30803;\");function child(parent,index){var i=0,n=parent.firstChild;while(n){if(n.nodeType==1){if(++i==index){return n}}n=n.nextSibling}return null}function next(n){while((n=n.nextSibling)&&n.nodeType!=1){}return n}function prev(n){while((n=n.previousSibling)&&n.nodeType!=1){}return n}function children(parent){var n=parent.firstChild,nodeIndex=-1,nextNode;while(n){nextNode=n.nextSibling;if(n.nodeType==3&&!nonSpace.test(n.nodeValue)){parent.removeChild(n)}else{n.nodeIndex=++nodeIndex}n=nextNode}return this}function byClassName(nodeSet,cls){if(!cls){return nodeSet}var result=[],ri=-1;for(var i=0,ci;ci=nodeSet[i];i++){if((\" \"+ci.className+\" \").indexOf(cls)!=-1){result[++ri]=ci}}return result}function attrValue(n,attr){if(!n.tagName&&typeof n.length!=\"undefined\"){n=n[0]}if(!n){return null}if(attr==\"for\"){return n.htmlFor}if(attr==\"class\"||attr==\"className\"){return n.className}return n.getAttribute(attr)||n[attr]}function getNodes(ns,mode,tagName){var result=[],ri=-1,cs;if(!ns){return result}tagName=tagName||\"*\";if(typeof ns.getElementsByTagName!=\"undefined\"){ns=[ns]}if(!mode){for(var i=0,ni;ni=ns[i];i++){cs=ni.getElementsByTagName(tagName);for(var j=0,ci;ci=cs[j];j++){result[++ri]=ci}}}else{if(mode==\"/\"||mode==\">\"){var utag=tagName.toUpperCase();for(var i=0,ni,cn;ni=ns[i];i++){cn=ni.childNodes;for(var j=0,cj;cj=cn[j];j++){if(cj.nodeName==utag||cj.nodeName==tagName||tagName==\"*\"){result[++ri]=cj}}}}else{if(mode==\"+\"){var utag=tagName.toUpperCase();for(var i=0,n;n=ns[i];i++){while((n=n.nextSibling)&&n.nodeType!=1){}if(n&&(n.nodeName==utag||n.nodeName==tagName||tagName==\"*\")){result[++ri]=n}}}else{if(mode==\"~\"){var utag=tagName.toUpperCase();for(var i=0,n;n=ns[i];i++){while((n=n.nextSibling)){if(n.nodeName==utag||n.nodeName==tagName||tagName==\"*\"){result[++ri]=n}}}}}}}return result}function concat(a,b){if(b.slice){return a.concat(b)}for(var i=0,l=b.length;i<l;i++){a[a.length]=b[i]}return a}function byTag(cs,tagName){if(cs.tagName||cs==document){cs=[cs]}if(!tagName){return cs}var result=[],ri=-1;tagName=tagName.toLowerCase();for(var i=0,ci;ci=cs[i];i++){if(ci.nodeType==1&&ci.tagName.toLowerCase()==tagName){result[++ri]=ci}}return result}function byId(cs,id){if(cs.tagName||cs==document){cs=[cs]}if(!id){return cs}var result=[],ri=-1;for(var i=0,ci;ci=cs[i];i++){if(ci&&ci.id==id){result[++ri]=ci;return result}}return result}function byAttribute(cs,attr,value,op,custom){var result=[],ri=-1,useGetStyle=custom==\"{\",fn=Ext.DomQuery.operators[op],a,xml,hasXml;for(var i=0,ci;ci=cs[i];i++){if(ci.nodeType!=1){continue}if(!hasXml){xml=Ext.DomQuery.isXml(ci);hasXml=true}if(!xml){if(useGetStyle){a=Ext.DomQuery.getStyle(ci,attr)}else{if(attr==\"class\"||attr==\"className\"){a=ci.className}else{if(attr==\"for\"){a=ci.htmlFor}else{if(attr==\"href\"){a=ci.getAttribute(\"href\",2)}else{a=ci.getAttribute(attr)}}}}}else{a=ci.getAttribute(attr)}if((fn&&fn(a,value))||(!fn&&a)){result[++ri]=ci}}return result}function byPseudo(cs,name,value){return Ext.DomQuery.pseudos[name](cs,value)}function nodupIEXml(cs){var d=++key,r;cs[0].setAttribute(\"_nodup\",d);r=[cs[0]];for(var i=1,len=cs.length;i<len;i++){var c=cs[i];if(!c.getAttribute(\"_nodup\")!=d){c.setAttribute(\"_nodup\",d);r[r.length]=c}}for(var i=0,len=cs.length;i<len;i++){cs[i].removeAttribute(\"_nodup\")}return r}function nodup(cs){if(!cs){return[]}var len=cs.length,c,i,r=cs,cj,ri=-1;if(!len||typeof cs.nodeType!=\"undefined\"||len==1){return cs}if(isIE&&typeof cs[0].selectSingleNode!=\"undefined\"){return nodupIEXml(cs)}var d=++key;cs[0]._nodup=d;for(i=1;c=cs[i];i++){if(c._nodup!=d){c._nodup=d}else{r=[];for(var j=0;j<i;j++){r[++ri]=cs[j]}for(j=i+1;cj=cs[j];j++){if(cj._nodup!=d){cj._nodup=d;r[++ri]=cj}}return r}}return r}function quickDiffIEXml(c1,c2){var d=++key,r=[];for(var i=0,len=c1.length;i<len;i++){c1[i].setAttribute(\"_qdiff\",d)}for(var i=0,len=c2.length;i<len;i++){if(c2[i].getAttribute(\"_qdiff\")!=d){r[r.length]=c2[i]}}for(var i=0,len=c1.length;i<len;i++){c1[i].removeAttribute(\"_qdiff\")}return r}function quickDiff(c1,c2){var len1=c1.length,d=++key,r=[];if(!len1){return c2}if(isIE&&typeof c1[0].selectSingleNode!=\"undefined\"){return quickDiffIEXml(c1,c2)}for(var i=0;i<len1;i++){c1[i]._qdiff=d}for(var i=0,len=c2.length;i<len;i++){if(c2[i]._qdiff!=d){r[r.length]=c2[i]}}return r}function quickId(ns,mode,root,id){if(ns==root){var d=root.ownerDocument||root;return d.getElementById(id)}ns=getNodes(ns,mode,\"*\");return byId(ns,id)}return{getStyle:function(el,name){return Ext.fly(el).getStyle(name)},compile:function(path,type){type=type||\"select\";var fn=[\"var f = function(root){\\n var mode; ++batch; var n = root || document;\\n\"],mode,lastPath,matchers=Ext.DomQuery.matchers,matchersLn=matchers.length,modeMatch,lmode=path.match(modeRe);if(lmode&&lmode[1]){fn[fn.length]='mode=\"'+lmode[1].replace(trimRe,\"\")+'\";';path=path.replace(lmode[1],\"\")}while(path.substr(0,1)==\"/\"){path=path.substr(1)}while(path&&lastPath!=path){lastPath=path;var tokenMatch=path.match(tagTokenRe);if(type==\"select\"){if(tokenMatch){if(tokenMatch[1]==\"#\"){fn[fn.length]='n = quickId(n, mode, root, \"'+tokenMatch[2]+'\");'}else{fn[fn.length]='n = getNodes(n, mode, \"'+tokenMatch[2]+'\");'}path=path.replace(tokenMatch[0],\"\")}else{if(path.substr(0,1)!=\"@\"){fn[fn.length]='n = getNodes(n, mode, \"*\");'}}}else{if(tokenMatch){if(tokenMatch[1]==\"#\"){fn[fn.length]='n = byId(n, \"'+tokenMatch[2]+'\");'}else{fn[fn.length]='n = byTag(n, \"'+tokenMatch[2]+'\");'}path=path.replace(tokenMatch[0],\"\")}}while(!(modeMatch=path.match(modeRe))){var matched=false;for(var j=0;j<matchersLn;j++){var t=matchers[j];var m=path.match(t.re);if(m){fn[fn.length]=t.select.replace(tplRe,function(x,i){return m[i]});path=path.replace(m[0],\"\");matched=true;break}}if(!matched){throw'Error parsing selector, parsing failed at \"'+path+'\"'}}if(modeMatch[1]){fn[fn.length]='mode=\"'+modeMatch[1].replace(trimRe,\"\")+'\";';path=path.replace(modeMatch[1],\"\")}}fn[fn.length]=\"return nodup(n);\\n}\";eval(fn.join(\"\"));return f},jsSelect:function(path,root,type){root=root||document;if(typeof root==\"string\"){root=document.getElementById(root)}var paths=path.split(\",\"),results=[];for(var i=0,len=paths.length;i<len;i++){var subPath=paths[i].replace(trimRe,\"\");if(!cache[subPath]){cache[subPath]=Ext.DomQuery.compile(subPath);if(!cache[subPath]){throw subPath+\" is not a valid selector\"}}var result=cache[subPath](root);if(result&&result!=document){results=results.concat(result)}}if(paths.length>1){return nodup(results)}return results},isXml:function(el){var docEl=(el?el.ownerDocument||el:0).documentElement;return docEl?docEl.nodeName!==\"HTML\":false},select:document.querySelectorAll?function(path,root,type){root=root||document;if(!Ext.DomQuery.isXml(root)){try{var cs=root.querySelectorAll(path);return Ext.toArray(cs)}catch(ex){}}return Ext.DomQuery.jsSelect.call(this,path,root,type)}:function(path,root,type){return Ext.DomQuery.jsSelect.call(this,path,root,type)},selectNode:function(path,root){return Ext.DomQuery.select(path,root)[0]},selectValue:function(path,root,defaultValue){path=path.replace(trimRe,\"\");if(!valueCache[path]){valueCache[path]=Ext.DomQuery.compile(path,\"select\")}var n=valueCache[path](root),v;n=n[0]?n[0]:n;if(typeof n.normalize==\"function\"){n.normalize()}v=(n&&n.firstChild?n.firstChild.nodeValue:null);return((v===null||v===undefined||v===\"\")?defaultValue:v)},selectNumber:function(path,root,defaultValue){var v=Ext.DomQuery.selectValue(path,root,defaultValue||0);return parseFloat(v)},is:function(el,ss){if(typeof el==\"string\"){el=document.getElementById(el)}var isArray=Ext.isArray(el),result=Ext.DomQuery.filter(isArray?el:[el],ss);return isArray?(result.length==el.length):(result.length>0)},filter:function(els,ss,nonMatches){ss=ss.replace(trimRe,\"\");if(!simpleCache[ss]){simpleCache[ss]=Ext.DomQuery.compile(ss,\"simple\")}var result=simpleCache[ss](els);return nonMatches?quickDiff(result,els):result},matchers:[{re:/^\\.([\\w\\-]+)/,select:'n = byClassName(n, \" {1} \");'},{re:/^\\:([\\w\\-]+)(?:\\(((?:[^\\s>\\/]*|.*?))\\))?/,select:'n = byPseudo(n, \"{1}\", \"{2}\");'},{re:/^(?:([\\[\\{])(?:@)?([\\w\\-]+)\\s?(?:(=|.=)\\s?([\"']?)(.*?)\\4)?[\\]\\}])/,select:'n = byAttribute(n, \"{2}\", \"{5}\", \"{3}\", \"{1}\");'},{re:/^#([\\w\\-]+)/,select:'n = byId(n, \"{1}\");'},{re:/^@([\\w\\-]+)/,select:'return {firstChild:{nodeValue:attrValue(n, \"{1}\")}};'}],operators:{\"=\":function(a,v){return a==v},\"!=\":function(a,v){return a!=v},\"^=\":function(a,v){return a&&a.substr(0,v.length)==v},\"$=\":function(a,v){return a&&a.substr(a.length-v.length)==v},\"*=\":function(a,v){return a&&a.indexOf(v)!==-1},\"%=\":function(a,v){return(a%v)==0},\"|=\":function(a,v){return a&&(a==v||a.substr(0,v.length+1)==v+\"-\")},\"~=\":function(a,v){return a&&(\" \"+a+\" \").indexOf(\" \"+v+\" \")!=-1}},pseudos:{\"first-child\":function(c){var r=[],ri=-1,n;for(var i=0,ci;ci=n=c[i];i++){while((n=n.previousSibling)&&n.nodeType!=1){}if(!n){r[++ri]=ci}}return r},\"last-child\":function(c){var r=[],ri=-1,n;for(var i=0,ci;ci=n=c[i];i++){while((n=n.nextSibling)&&n.nodeType!=1){}if(!n){r[++ri]=ci}}return r},\"nth-child\":function(c,a){var r=[],ri=-1,m=nthRe.exec(a==\"even\"&&\"2n\"||a==\"odd\"&&\"2n+1\"||!nthRe2.test(a)&&\"n+\"+a||a),f=(m[1]||1)-0,l=m[2]-0;for(var i=0,n;n=c[i];i++){var pn=n.parentNode;if(batch!=pn._batch){var j=0;for(var cn=pn.firstChild;cn;cn=cn.nextSibling){if(cn.nodeType==1){cn.nodeIndex=++j}}pn._batch=batch}if(f==1){if(l==0||n.nodeIndex==l){r[++ri]=n}}else{if((n.nodeIndex+l)%f==0){r[++ri]=n}}}return r},\"only-child\":function(c){var r=[],ri=-1;for(var i=0,ci;ci=c[i];i++){if(!prev(ci)&&!next(ci)){r[++ri]=ci}}return r},empty:function(c){var r=[],ri=-1;for(var i=0,ci;ci=c[i];i++){var cns=ci.childNodes,j=0,cn,empty=true;while(cn=cns[j]){++j;if(cn.nodeType==1||cn.nodeType==3){empty=false;break}}if(empty){r[++ri]=ci}}return r},contains:function(c,v){var r=[],ri=-1;for(var i=0,ci;ci=c[i];i++){if((ci.textContent||ci.innerText||\"\").indexOf(v)!=-1){r[++ri]=ci}}return r},nodeValue:function(c,v){var r=[],ri=-1;for(var i=0,ci;ci=c[i];i++){if(ci.firstChild&&ci.firstChild.nodeValue==v){r[++ri]=ci}}return r},checked:function(c){var r=[],ri=-1;for(var i=0,ci;ci=c[i];i++){if(ci.checked==true){r[++ri]=ci}}return r},not:function(c,ss){return Ext.DomQuery.filter(c,ss,true)},any:function(c,selectors){var ss=selectors.split(\"|\"),r=[],ri=-1,s;for(var i=0,ci;ci=c[i];i++){for(var j=0;s=ss[j];j++){if(Ext.DomQuery.is(ci,s)){r[++ri]=ci;break}}}return r},odd:function(c){return this[\"nth-child\"](c,\"odd\")},even:function(c){return this[\"nth-child\"](c,\"even\")},nth:function(c,a){return c[a-1]||[]},first:function(c){return c[0]||[]},last:function(c){return c[c.length-1]||[]},has:function(c,ss){var s=Ext.DomQuery.select,r=[],ri=-1;for(var i=0,ci;ci=c[i];i++){if(s(ss,ci).length>0){r[++ri]=ci}}return r},next:function(c,ss){var is=Ext.DomQuery.is,r=[],ri=-1;for(var i=0,ci;ci=c[i];i++){var n=next(ci);if(n&&is(n,ss)){r[++ri]=ci}}return r},prev:function(c,ss){var is=Ext.DomQuery.is,r=[],ri=-1;for(var i=0,ci;ci=c[i];i++){var n=prev(ci);if(n&&is(n,ss)){r[++ri]=ci}}return r}}}}();Ext.query=Ext.DomQuery.select;Ext.util.DelayedTask=function(d,c,a){var e=this,g,b=function(){clearInterval(g);g=null;d.apply(c,a||[])};e.delay=function(i,k,j,h){e.cancel();d=k||d;c=j||c;a=h||a;g=setInterval(b,i)};e.cancel=function(){if(g){clearInterval(g);g=null}}};(function(){var h=document;Ext.Element=function(l,m){var n=typeof l==\"string\"?h.getElementById(l):l,o;if(!n){return null}o=n.id;if(!m&&o&&Ext.elCache[o]){return Ext.elCache[o].el}this.dom=n;this.id=o||Ext.id(n)};var d=Ext.DomHelper,e=Ext.Element,a=Ext.elCache;e.prototype={set:function(q,m){var n=this.dom,l,p,m=(m!==false)&&!!n.setAttribute;for(l in q){if(q.hasOwnProperty(l)){p=q[l];if(l==\"style\"){d.applyStyles(n,p)}else{if(l==\"cls\"){n.className=p}else{if(m){n.setAttribute(l,p)}else{n[l]=p}}}}}return this},defaultUnit:\"px\",is:function(l){return Ext.DomQuery.is(this.dom,l)},focus:function(o,n){var l=this,n=n||l.dom;try{if(Number(o)){l.focus.defer(o,null,[null,n])}else{n.focus()}}catch(m){}return l},blur:function(){try{this.dom.blur()}catch(l){}return this},getValue:function(l){var m=this.dom.value;return l?parseInt(m,10):m},addListener:function(l,o,n,m){Ext.EventManager.on(this.dom,l,o,n||this,m);return this},removeListener:function(l,n,m){Ext.EventManager.removeListener(this.dom,l,n,m||this);return this},removeAllListeners:function(){Ext.EventManager.removeAll(this.dom);return this},purgeAllListeners:function(){Ext.EventManager.purgeElement(this,true);return this},addUnits:function(l){if(l===\"\"||l==\"auto\"||l===undefined){l=l||\"\"}else{if(!isNaN(l)||!i.test(l)){l=l+(this.defaultUnit||\"px\")}}return l},load:function(m,n,l){Ext.Ajax.request(Ext.apply({params:n,url:m.url||m,callback:l,el:this.dom,indicatorText:m.indicatorText||\"\"},Ext.isObject(m)?m:{}));return this},isBorderBox:function(){return Ext.isBorderBox||Ext.isForcedBorderBox||g[(this.dom.tagName||\"\").toLowerCase()]},remove:function(){var l=this,m=l.dom;if(m){delete l.dom;Ext.removeNode(m)}},hover:function(m,l,o,n){var p=this;p.on(\"mouseenter\",m,o||p.dom,n);p.on(\"mouseleave\",l,o||p.dom,n);return p},contains:function(l){return !l?false:Ext.lib.Dom.isAncestor(this.dom,l.dom?l.dom:l)},getAttributeNS:function(m,l){return this.getAttribute(l,m)},getAttribute:(function(){var p=document.createElement(\"table\"),o=false,m=\"getAttribute\" in p,l=/undefined|unknown/;if(m){try{p.getAttribute(\"ext:qtip\")}catch(n){o=true}return function(q,s){var r=this.dom,t;if(r.getAttributeNS){t=r.getAttributeNS(s,q)||null}if(t==null){if(s){if(o&&r.tagName.toUpperCase()==\"TABLE\"){try{t=r.getAttribute(s+\":\"+q)}catch(u){t=\"\"}}else{t=r.getAttribute(s+\":\"+q)}}else{t=r.getAttribute(q)||r[q]}}return t||\"\"}}else{return function(q,s){var r=this.om,u,t;if(s){t=r[s+\":\"+q];u=l.test(typeof t)?undefined:t}else{u=r[q]}return u||\"\"}}p=null})(),update:function(l){if(this.dom){this.dom.innerHTML=l}return this}};var k=e.prototype;e.addMethods=function(l){Ext.apply(k,l)};k.on=k.addListener;k.un=k.removeListener;k.autoBoxAdjust=true;var i=/\\d+(px|em|%|en|ex|pt|in|cm|mm|pc)$/i,c;e.get=function(m){var l,p,o;if(!m){return null}if(typeof m==\"string\"){if(!(p=h.getElementById(m))){return null}if(a[m]&&a[m].el){l=a[m].el;l.dom=p}else{l=e.addToCache(new e(p))}return l}else{if(m.tagName){if(!(o=m.id)){o=Ext.id(m)}if(a[o]&&a[o].el){l=a[o].el;l.dom=m}else{l=e.addToCache(new e(m))}return l}else{if(m instanceof e){if(m!=c){if(Ext.isIE&&(m.id==undefined||m.id==\"\")){m.dom=m.dom}else{m.dom=h.getElementById(m.id)||m.dom}}return m}else{if(m.isComposite){return m}else{if(Ext.isArray(m)){return e.select(m)}else{if(m==h){if(!c){var n=function(){};n.prototype=e.prototype;c=new n();c.dom=h}return c}}}}}}return null};e.addToCache=function(l,m){m=m||l.id;a[m]={el:l,data:{},events:{}};return l};e.data=function(m,l,n){m=e.get(m);if(!m){return null}var o=a[m.id].data;if(arguments.length==2){return o[l]}else{return(o[l]=n)}};function j(){if(!Ext.enableGarbageCollector){clearInterval(e.collectorThreadId)}else{var l,n,q,p;for(l in a){p=a[l];if(p.skipGC){Ext.EventManager.removeFromSpecialCache(p.el);continue}n=p.el;q=n.dom;if(!q||!q.parentNode||(!q.offsetParent&&!h.getElementById(l))){if(Ext.enableListenerCollection){Ext.EventManager.removeAll(q)}delete a[l]}}if(Ext.isIE){var m={};for(l in a){m[l]=a[l]}a=Ext.elCache=m}}}e.collectorThreadId=setInterval(j,30000);var b=function(){};b.prototype=e.prototype;e.Flyweight=function(l){this.dom=l};e.Flyweight.prototype=new b();e.Flyweight.prototype.isFlyweight=true;e._flyweights={};e.fly=function(n,l){var m=null;l=l||\"_global\";if(n=Ext.getDom(n)){(e._flyweights[l]=e._flyweights[l]||new e.Flyweight()).dom=n;m=e._flyweights[l]}return m};Ext.get=e.get;Ext.fly=e.fly;var g=Ext.isStrict?{select:1}:{input:1,select:1,textarea:1};if(Ext.isIE||Ext.isGecko){g.button=1}})();Ext.Element.addMethods(function(){var d=\"parentNode\",b=\"nextSibling\",c=\"previousSibling\",e=Ext.DomQuery,a=Ext.get;return{findParent:function(m,l,h){var j=this.dom,g=document.body,k=0,i;if(Ext.isGecko&&Object.prototype.toString.call(j)==\"[object XULElement]\"){return null}l=l||50;if(isNaN(l)){i=Ext.getDom(l);l=Number.MAX_VALUE}while(j&&j.nodeType==1&&k<l&&j!=g&&j!=i){if(e.is(j,m)){return h?a(j):j}k++;j=j.parentNode}return null},findParentNode:function(j,i,g){var h=Ext.fly(this.dom.parentNode,\"_internal\");return h?h.findParent(j,i,g):null},up:function(h,g){return this.findParentNode(h,g,true)},select:function(g){return Ext.Element.select(g,this.dom)},query:function(g){return e.select(g,this.dom)},child:function(g,h){var i=e.selectNode(g,this.dom);return h?i:a(i)},down:function(g,h){var i=e.selectNode(\" > \"+g,this.dom);return h?i:a(i)},parent:function(g,h){return this.matchNode(d,d,g,h)},next:function(g,h){return this.matchNode(b,b,g,h)},prev:function(g,h){return this.matchNode(c,c,g,h)},first:function(g,h){return this.matchNode(b,\"firstChild\",g,h)},last:function(g,h){return this.matchNode(c,\"lastChild\",g,h)},matchNode:function(h,k,g,i){var j=this.dom[k];while(j){if(j.nodeType==1&&(!g||e.is(j,g))){return !i?a(j):j}j=j[h]}return null}}}());Ext.Element.addMethods(function(){var c=Ext.getDom,a=Ext.get,b=Ext.DomHelper;return{appendChild:function(d){return a(d).appendTo(this)},appendTo:function(d){c(d).appendChild(this.dom);return this},insertBefore:function(d){(d=c(d)).parentNode.insertBefore(this.dom,d);return this},insertAfter:function(d){(d=c(d)).parentNode.insertBefore(this.dom,d.nextSibling);return this},insertFirst:function(e,d){e=e||{};if(e.nodeType||e.dom||typeof e==\"string\"){e=c(e);this.dom.insertBefore(e,this.dom.firstChild);return !d?a(e):e}else{return this.createChild(e,this.dom.firstChild,d)}},replace:function(d){d=a(d);this.insertBefore(d);d.remove();return this},replaceWith:function(d){var e=this;if(d.nodeType||d.dom||typeof d==\"string\"){d=c(d);e.dom.parentNode.insertBefore(d,e.dom)}else{d=b.insertBefore(e.dom,d)}delete Ext.elCache[e.id];Ext.removeNode(e.dom);e.id=Ext.id(e.dom=d);Ext.Element.addToCache(e.isFlyweight?new Ext.Element(e.dom):e);return e},createChild:function(e,d,g){e=e||{tag:\"div\"};return d?b.insertBefore(d,e,g!==true):b[!this.dom.firstChild?\"overwrite\":\"append\"](this.dom,e,g!==true)},wrap:function(d,e){var g=b.insertBefore(this.dom,d||{tag:\"div\"},!e);g.dom?g.dom.appendChild(this.dom):g.appendChild(this.dom);return g},insertHtml:function(e,g,d){var h=b.insertHtml(e,this.dom,g);return d?Ext.get(h):h}}}());Ext.Element.addMethods(function(){var A=Ext.supports,h={},x=/(-[a-z])/gi,s=document.defaultView,D=/alpha\\(opacity=(.*)\\)/i,l=/^\\s+|\\s+$/g,B=Ext.Element,u=/\\s+/,b=/\\w/g,d=\"padding\",c=\"margin\",y=\"border\",t=\"-left\",q=\"-right\",w=\"-top\",o=\"-bottom\",j=\"-width\",r=Math,z=\"hidden\",e=\"isClipped\",k=\"overflow\",n=\"overflow-x\",m=\"overflow-y\",C=\"originalClip\",i={l:y+t+j,r:y+q+j,t:y+w+j,b:y+o+j},g={l:d+t,r:d+q,t:d+w,b:d+o},a={l:c+t,r:c+q,t:c+w,b:c+o},E=Ext.Element.data;function p(F,G){return G.charAt(1).toUpperCase()}function v(F){return h[F]||(h[F]=F==\"float\"?(A.cssFloat?\"cssFloat\":\"styleFloat\"):F.replace(x,p))}return{adjustWidth:function(F){var G=this;var H=(typeof F==\"number\");if(H&&G.autoBoxAdjust&&!G.isBorderBox()){F-=(G.getBorderWidth(\"lr\")+G.getPadding(\"lr\"))}return(H&&F<0)?0:F},adjustHeight:function(F){var G=this;var H=(typeof F==\"number\");if(H&&G.autoBoxAdjust&&!G.isBorderBox()){F-=(G.getBorderWidth(\"tb\")+G.getPadding(\"tb\"))}return(H&&F<0)?0:F},addClass:function(J){var K=this,I,F,H,G=[];if(!Ext.isArray(J)){if(typeof J==\"string\"&&!this.hasClass(J)){K.dom.className+=\" \"+J}}else{for(I=0,F=J.length;I<F;I++){H=J[I];if(typeof H==\"string\"&&(\" \"+K.dom.className+\" \").indexOf(\" \"+H+\" \")==-1){G.push(H)}}if(G.length){K.dom.className+=\" \"+G.join(\" \")}}return K},removeClass:function(K){var L=this,J,G,F,I,H;if(!Ext.isArray(K)){K=[K]}if(L.dom&&L.dom.className){H=L.dom.className.replace(l,\"\").split(u);for(J=0,F=K.length;J<F;J++){I=K[J];if(typeof I==\"string\"){I=I.replace(l,\"\");G=H.indexOf(I);if(G!=-1){H.splice(G,1)}}}L.dom.className=H.join(\" \")}return L},radioClass:function(I){var J=this.dom.parentNode.childNodes,G,H,F;I=Ext.isArray(I)?I:[I];for(H=0,F=J.length;H<F;H++){G=J[H];if(G&&G.nodeType==1){Ext.fly(G,\"_internal\").removeClass(I)}}return this.addClass(I)},toggleClass:function(F){return this.hasClass(F)?this.removeClass(F):this.addClass(F)},hasClass:function(F){return F&&(\" \"+this.dom.className+\" \").indexOf(\" \"+F+\" \")!=-1},replaceClass:function(G,F){return this.removeClass(G).addClass(F)},isStyle:function(F,G){return this.getStyle(F)==G},getStyle:function(){return s&&s.getComputedStyle?function(K){var I=this.dom,F,H,G,J;if(I==document){return null}K=v(K);G=(F=I.style[K])?F:(H=s.getComputedStyle(I,\"\"))?H[K]:null;if(K==\"marginRight\"&&G!=\"0px\"&&!A.correctRightMargin){J=I.style.display;I.style.display=\"inline-block\";G=s.getComputedStyle(I,\"\").marginRight;I.style.display=J}if(K==\"backgroundColor\"&&G==\"rgba(0, 0, 0, 0)\"&&!A.correctTransparentColor){G=\"transparent\"}return G}:function(J){var H=this.dom,F,G;if(H==document){return null}if(J==\"opacity\"){if(H.style.filter.match){if(F=H.style.filter.match(D)){var I=parseFloat(F[1]);if(!isNaN(I)){return I?I/100:0}}}return 1}J=v(J);return H.style[J]||((G=H.currentStyle)?G[J]:null)}}(),getColor:function(F,G,K){var I=this.getStyle(F),H=(typeof K!=\"undefined\")?K:\"#\",J;if(!I||(/transparent|inherit/.test(I))){return G}if(/^r/.test(I)){Ext.each(I.slice(4,I.length-1).split(\",\"),function(L){J=parseInt(L,10);H+=(J<16?\"0\":\"\")+J.toString(16)})}else{I=I.replace(\"#\",\"\");H+=I.length==3?I.replace(/^(\\w)(\\w)(\\w)$/,\"$1$1$2$2$3$3\"):I}return(H.length>5?H.toLowerCase():G)},setStyle:function(I,H){var F,G;if(typeof I!=\"object\"){F={};F[I]=H;I=F}for(G in I){H=I[G];G==\"opacity\"?this.setOpacity(H):this.dom.style[v(G)]=H}return this},setOpacity:function(G,F){var J=this,H=J.dom.style;if(!F||!J.anim){if(Ext.isIE9m){var I=G<1?\"alpha(opacity=\"+G*100+\")\":\"\",K=H.filter.replace(D,\"\").replace(l,\"\");H.zoom=1;H.filter=K+(K.length>0?\" \":\"\")+I}else{H.opacity=G}}else{J.anim({opacity:{to:G}},J.preanim(arguments,1),null,0.35,\"easeIn\")}return J},clearOpacity:function(){var F=this.dom.style;if(Ext.isIE9m){if(!Ext.isEmpty(F.filter)){F.filter=F.filter.replace(D,\"\").replace(l,\"\")}}else{F.opacity=F[\"-moz-opacity\"]=F[\"-khtml-opacity\"]=\"\"}return this},getHeight:function(H){var G=this,J=G.dom,I=Ext.isIE9m&&G.isStyle(\"display\",\"none\"),F=r.max(J.offsetHeight,I?0:J.clientHeight)||0;F=!H?F:F-G.getBorderWidth(\"tb\")-G.getPadding(\"tb\");return F<0?0:F},getWidth:function(G){var H=this,J=H.dom,I=Ext.isIE9m&&H.isStyle(\"display\",\"none\"),F=r.max(J.offsetWidth,I?0:J.clientWidth)||0;F=!G?F:F-H.getBorderWidth(\"lr\")-H.getPadding(\"lr\");return F<0?0:F},setWidth:function(G,F){var H=this;G=H.adjustWidth(G);!F||!H.anim?H.dom.style.width=H.addUnits(G):H.anim({width:{to:G}},H.preanim(arguments,1));return H},setHeight:function(F,G){var H=this;F=H.adjustHeight(F);!G||!H.anim?H.dom.style.height=H.addUnits(F):H.anim({height:{to:F}},H.preanim(arguments,1));return H},getBorderWidth:function(F){return this.addStyles(F,i)},getPadding:function(F){return this.addStyles(F,g)},clip:function(){var F=this,G=F.dom;if(!E(G,e)){E(G,e,true);E(G,C,{o:F.getStyle(k),x:F.getStyle(n),y:F.getStyle(m)});F.setStyle(k,z);F.setStyle(n,z);F.setStyle(m,z)}return F},unclip:function(){var F=this,H=F.dom;if(E(H,e)){E(H,e,false);var G=E(H,C);if(G.o){F.setStyle(k,G.o)}if(G.x){F.setStyle(n,G.x)}if(G.y){F.setStyle(m,G.y)}}return F},addStyles:function(M,L){var J=0,K=M.match(b),I,H,G,F=K.length;for(G=0;G<F;G++){I=K[G];H=I&&parseInt(this.getStyle(L[I]),10);if(H){J+=r.abs(H)}}return J},margins:a}}());(function(){var a=Ext.lib.Dom,b=\"left\",g=\"right\",d=\"top\",i=\"bottom\",h=\"position\",c=\"static\",e=\"relative\",j=\"auto\",k=\"z-index\";Ext.Element.addMethods({getX:function(){return a.getX(this.dom)},getY:function(){return a.getY(this.dom)},getXY:function(){return a.getXY(this.dom)},getOffsetsTo:function(l){var n=this.getXY(),m=Ext.fly(l,\"_internal\").getXY();return[n[0]-m[0],n[1]-m[1]]},setX:function(l,m){return this.setXY([l,this.getY()],this.animTest(arguments,m,1))},setY:function(m,l){return this.setXY([this.getX(),m],this.animTest(arguments,l,1))},setLeft:function(l){this.setStyle(b,this.addUnits(l));return this},setTop:function(l){this.setStyle(d,this.addUnits(l));return this},setRight:function(l){this.setStyle(g,this.addUnits(l));return this},setBottom:function(l){this.setStyle(i,this.addUnits(l));return this},setXY:function(n,l){var m=this;if(!l||!m.anim){a.setXY(m.dom,n)}else{m.anim({points:{to:n}},m.preanim(arguments,1),\"motion\")}return m},setLocation:function(l,n,m){return this.setXY([l,n],this.animTest(arguments,m,2))},moveTo:function(l,n,m){return this.setXY([l,n],this.animTest(arguments,m,2))},getLeft:function(l){return !l?this.getX():parseInt(this.getStyle(b),10)||0},getRight:function(l){var m=this;return !l?m.getX()+m.getWidth():(m.getLeft(true)+m.getWidth())||0},getTop:function(l){return !l?this.getY():parseInt(this.getStyle(d),10)||0},getBottom:function(l){var m=this;return !l?m.getY()+m.getHeight():(m.getTop(true)+m.getHeight())||0},position:function(p,o,l,n){var m=this;if(!p&&m.isStyle(h,c)){m.setStyle(h,e)}else{if(p){m.setStyle(h,p)}}if(o){m.setStyle(k,o)}if(l||n){m.setXY([l||false,n||false])}},clearPositioning:function(l){l=l||\"\";this.setStyle({left:l,right:l,top:l,bottom:l,\"z-index\":\"\",position:c});return this},getPositioning:function(){var m=this.getStyle(b);var n=this.getStyle(d);return{position:this.getStyle(h),left:m,right:m?\"\":this.getStyle(g),top:n,bottom:n?\"\":this.getStyle(i),\"z-index\":this.getStyle(k)}},setPositioning:function(l){var n=this,m=n.dom.style;n.setStyle(l);if(l.right==j){m.right=\"\"}if(l.bottom==j){m.bottom=\"\"}return n},translatePoints:function(m,u){u=isNaN(m[1])?u:m[1];m=isNaN(m[0])?m:m[0];var q=this,r=q.isStyle(h,e),s=q.getXY(),n=parseInt(q.getStyle(b),10),p=parseInt(q.getStyle(d),10);n=!isNaN(n)?n:(r?0:q.dom.offsetLeft);p=!isNaN(p)?p:(r?0:q.dom.offsetTop);return{left:(m-s[0]+n),top:(u-s[1]+p)}},animTest:function(m,l,n){return !!l&&this.preanim?this.preanim(m,n):false}})})();Ext.Element.addMethods({isScrollable:function(){var a=this.dom;return a.scrollHeight>a.clientHeight||a.scrollWidth>a.clientWidth},scrollTo:function(a,b){this.dom[\"scroll\"+(/top/i.test(a)?\"Top\":\"Left\")]=b;return this},getScroll:function(){var i=this.dom,h=document,a=h.body,c=h.documentElement,b,g,e;if(i==h||i==a){if(Ext.isIE&&Ext.isStrict){b=c.scrollLeft;g=c.scrollTop}else{b=window.pageXOffset;g=window.pageYOffset}e={left:b||(a?a.scrollLeft:0),top:g||(a?a.scrollTop:0)}}else{e={left:i.scrollLeft,top:i.scrollTop}}return e}});Ext.Element.VISIBILITY=1;Ext.Element.DISPLAY=2;Ext.Element.OFFSETS=3;Ext.Element.ASCLASS=4;Ext.Element.visibilityCls=\"x-hide-nosize\";Ext.Element.addMethods(function(){var e=Ext.Element,p=\"opacity\",j=\"visibility\",g=\"display\",d=\"hidden\",n=\"offsets\",k=\"asclass\",m=\"none\",a=\"nosize\",b=\"originalDisplay\",c=\"visibilityMode\",h=\"isVisible\",i=e.data,l=function(r){var q=i(r,b);if(q===undefined){i(r,b,q=\"\")}return q},o=function(r){var q=i(r,c);if(q===undefined){i(r,c,q=1)}return q};return{originalDisplay:\"\",visibilityMode:1,setVisibilityMode:function(q){i(this.dom,c,q);return this},animate:function(r,t,s,u,q){this.anim(r,{duration:t,callback:s,easing:u},q);return this},anim:function(t,u,r,w,s,q){r=r||\"run\";u=u||{};var v=this,x=Ext.lib.Anim[r](v.dom,t,(u.duration||w)||0.35,(u.easing||s)||\"easeOut\",function(){if(q){q.call(v)}if(u.callback){u.callback.call(u.scope||v,v,u)}},v);u.anim=x;return x},preanim:function(q,r){return !q[r]?false:(typeof q[r]==\"object\"?q[r]:{duration:q[r+1],callback:q[r+2],easing:q[r+3]})},isVisible:function(){var q=this,s=q.dom,r=i(s,h);if(typeof r==\"boolean\"){return r}r=!q.isStyle(j,d)&&!q.isStyle(g,m)&&!((o(s)==e.ASCLASS)&&q.hasClass(q.visibilityCls||e.visibilityCls));i(s,h,r);return r},setVisible:function(t,q){var w=this,r,y,x,v,u=w.dom,s=o(u);if(typeof q==\"string\"){switch(q){case g:s=e.DISPLAY;break;case j:s=e.VISIBILITY;break;case n:s=e.OFFSETS;break;case a:case k:s=e.ASCLASS;break}w.setVisibilityMode(s);q=false}if(!q||!w.anim){if(s==e.ASCLASS){w[t?\"removeClass\":\"addClass\"](w.visibilityCls||e.visibilityCls)}else{if(s==e.DISPLAY){return w.setDisplayed(t)}else{if(s==e.OFFSETS){if(!t){w.hideModeStyles={position:w.getStyle(\"position\"),top:w.getStyle(\"top\"),left:w.getStyle(\"left\")};w.applyStyles({position:\"absolute\",top:\"-10000px\",left:\"-10000px\"})}else{w.applyStyles(w.hideModeStyles||{position:\"\",top:\"\",left:\"\"});delete w.hideModeStyles}}else{w.fixDisplay();u.style.visibility=t?\"visible\":d}}}}else{if(t){w.setOpacity(0.01);w.setVisible(true)}w.anim({opacity:{to:(t?1:0)}},w.preanim(arguments,1),null,0.35,\"easeIn\",function(){t||w.setVisible(false).setOpacity(1)})}i(u,h,t);return w},hasMetrics:function(){var q=this.dom;return this.isVisible()||(o(q)==e.VISIBILITY)},toggle:function(q){var r=this;r.setVisible(!r.isVisible(),r.preanim(arguments,0));return r},setDisplayed:function(q){if(typeof q==\"boolean\"){q=q?l(this.dom):m}this.setStyle(g,q);return this},fixDisplay:function(){var q=this;if(q.isStyle(g,m)){q.setStyle(j,d);q.setStyle(g,l(this.dom));if(q.isStyle(g,m)){q.setStyle(g,\"block\")}}},hide:function(q){if(typeof q==\"string\"){this.setVisible(false,q);return this}this.setVisible(false,this.preanim(arguments,0));return this},show:function(q){if(typeof q==\"string\"){this.setVisible(true,q);return this}this.setVisible(true,this.preanim(arguments,0));return this}}}());(function(){var y=null,A=undefined,k=true,t=false,j=\"setX\",h=\"setY\",a=\"setXY\",n=\"left\",l=\"bottom\",s=\"top\",m=\"right\",q=\"height\",g=\"width\",i=\"points\",w=\"hidden\",z=\"absolute\",u=\"visible\",e=\"motion\",o=\"position\",r=\"easeOut\",d=new Ext.Element.Flyweight(),v={},x=function(B){return B||{}},p=function(B){d.dom=B;d.id=Ext.id(B);return d},c=function(B){if(!v[B]){v[B]=[]}return v[B]},b=function(C,B){v[C]=B};Ext.enableFx=k;Ext.Fx={switchStatements:function(C,D,B){return D.apply(this,B[C])},slideIn:function(H,E){E=x(E);var J=this,G=J.dom,M=G.style,O,B,L,D,C,M,I,N,K,F;H=H||\"t\";J.queueFx(E,function(){O=p(G).getXY();p(G).fixDisplay();B=p(G).getFxRestore();L={x:O[0],y:O[1],0:O[0],1:O[1],width:G.offsetWidth,height:G.offsetHeight};L.right=L.x+L.width;L.bottom=L.y+L.height;p(G).setWidth(L.width).setHeight(L.height);D=p(G).fxWrap(B.pos,E,w);M.visibility=u;M.position=z;function P(){p(G).fxUnwrap(D,B.pos,E);M.width=B.width;M.height=B.height;p(G).afterFx(E)}N={to:[L.x,L.y]};K={to:L.width};F={to:L.height};function Q(U,R,V,S,X,Z,ac,ab,aa,W,T){var Y={};p(U).setWidth(V).setHeight(S);if(p(U)[X]){p(U)[X](Z)}R[ac]=R[ab]=\"0\";if(aa){Y.width=aa}if(W){Y.height=W}if(T){Y.points=T}return Y}I=p(G).switchStatements(H.toLowerCase(),Q,{t:[D,M,L.width,0,y,y,n,l,y,F,y],l:[D,M,0,L.height,y,y,m,s,K,y,y],r:[D,M,L.width,L.height,j,L.right,n,s,y,y,N],b:[D,M,L.width,L.height,h,L.bottom,n,s,y,F,N],tl:[D,M,0,0,y,y,m,l,K,F,N],bl:[D,M,0,0,h,L.y+L.height,m,s,K,F,N],br:[D,M,0,0,a,[L.right,L.bottom],n,s,K,F,N],tr:[D,M,0,0,j,L.x+L.width,n,l,K,F,N]});M.visibility=u;p(D).show();arguments.callee.anim=p(D).fxanim(I,E,e,0.5,r,P)});return J},slideOut:function(F,D){D=x(D);var H=this,E=H.dom,K=E.style,L=H.getXY(),C,B,I,J,G={to:0};F=F||\"t\";H.queueFx(D,function(){B=p(E).getFxRestore();I={x:L[0],y:L[1],0:L[0],1:L[1],width:E.offsetWidth,height:E.offsetHeight};I.right=I.x+I.width;I.bottom=I.y+I.height;p(E).setWidth(I.width).setHeight(I.height);C=p(E).fxWrap(B.pos,D,u);K.visibility=u;K.position=z;p(C).setWidth(I.width).setHeight(I.height);function M(){D.useDisplay?p(E).setDisplayed(t):p(E).hide();p(E).fxUnwrap(C,B.pos,D);K.width=B.width;K.height=B.height;p(E).afterFx(D)}function N(O,W,U,X,S,V,R,T,Q){var P={};O[W]=O[U]=\"0\";P[X]=S;if(V){P[V]=R}if(T){P[T]=Q}return P}J=p(E).switchStatements(F.toLowerCase(),N,{t:[K,n,l,q,G],l:[K,m,s,g,G],r:[K,n,s,g,G,i,{to:[I.right,I.y]}],b:[K,n,s,q,G,i,{to:[I.x,I.bottom]}],tl:[K,m,l,g,G,q,G],bl:[K,m,s,g,G,q,G,i,{to:[I.x,I.bottom]}],br:[K,n,s,g,G,q,G,i,{to:[I.x+I.width,I.bottom]}],tr:[K,n,l,g,G,q,G,i,{to:[I.right,I.y]}]});arguments.callee.anim=p(C).fxanim(J,D,e,0.5,r,M)});return H},puff:function(H){H=x(H);var F=this,G=F.dom,C=G.style,D,B,E;F.queueFx(H,function(){D=p(G).getWidth();B=p(G).getHeight();p(G).clearOpacity();p(G).show();E=p(G).getFxRestore();function I(){H.useDisplay?p(G).setDisplayed(t):p(G).hide();p(G).clearOpacity();p(G).setPositioning(E.pos);C.width=E.width;C.height=E.height;C.fontSize=\"\";p(G).afterFx(H)}arguments.callee.anim=p(G).fxanim({width:{to:p(G).adjustWidth(D*2)},height:{to:p(G).adjustHeight(B*2)},points:{by:[-D*0.5,-B*0.5]},opacity:{to:0},fontSize:{to:200,unit:\"%\"}},H,e,0.5,r,I)});return F},switchOff:function(F){F=x(F);var D=this,E=D.dom,B=E.style,C;D.queueFx(F,function(){p(E).clearOpacity();p(E).clip();C=p(E).getFxRestore();function G(){F.useDisplay?p(E).setDisplayed(t):p(E).hide();p(E).clearOpacity();p(E).setPositioning(C.pos);B.width=C.width;B.height=C.height;p(E).afterFx(F)}p(E).fxanim({opacity:{to:0.3}},y,y,0.1,y,function(){p(E).clearOpacity();(function(){p(E).fxanim({height:{to:1},points:{by:[0,p(E).getHeight()*0.5]}},F,e,0.3,\"easeIn\",G)}).defer(100)})});return D},highlight:function(D,H){H=x(H);var F=this,G=F.dom,B=H.attr||\"backgroundColor\",C={},E;F.queueFx(H,function(){p(G).clearOpacity();p(G).show();function I(){G.style[B]=E;p(G).afterFx(H)}E=G.style[B];C[B]={from:D||\"ffff9c\",to:H.endColor||p(G).getColor(B)||\"ffffff\"};arguments.callee.anim=p(G).fxanim(C,H,\"color\",1,\"easeIn\",I)});return F},frame:function(B,E,H){H=x(H);var D=this,G=D.dom,C,F;D.queueFx(H,function(){B=B||\"#C3DAF9\";if(B.length==6){B=\"#\"+B}E=E||1;p(G).show();var L=p(G).getXY(),J={x:L[0],y:L[1],0:L[0],1:L[1],width:G.offsetWidth,height:G.offsetHeight},I=function(){C=p(document.body||document.documentElement).createChild({style:{position:z,\"z-index\":35000,border:\"0px solid \"+B}});return C.queueFx({},K)};arguments.callee.anim={isAnimated:true,stop:function(){E=0;C.stopFx()}};function K(){var M=Ext.isBorderBox?2:1;F=C.anim({top:{from:J.y,to:J.y-20},left:{from:J.x,to:J.x-20},borderWidth:{from:0,to:10},opacity:{from:1,to:0},height:{from:J.height,to:J.height+20*M},width:{from:J.width,to:J.width+20*M}},{duration:H.duration||1,callback:function(){C.remove();--E>0?I():p(G).afterFx(H)}});arguments.callee.anim={isAnimated:true,stop:function(){F.stop()}}}I()});return D},pause:function(D){var C=this.dom,B;this.queueFx({},function(){B=setTimeout(function(){p(C).afterFx({})},D*1000);arguments.callee.anim={isAnimated:true,stop:function(){clearTimeout(B);p(C).afterFx({})}}});return this},fadeIn:function(D){D=x(D);var B=this,C=B.dom,E=D.endOpacity||1;B.queueFx(D,function(){p(C).setOpacity(0);p(C).fixDisplay();C.style.visibility=u;arguments.callee.anim=p(C).fxanim({opacity:{to:E}},D,y,0.5,r,function(){if(E==1){p(C).clearOpacity()}p(C).afterFx(D)})});return B},fadeOut:function(E){E=x(E);var C=this,D=C.dom,B=D.style,F=E.endOpacity||0;C.queueFx(E,function(){arguments.callee.anim=p(D).fxanim({opacity:{to:F}},E,y,0.5,r,function(){if(F==0){Ext.Element.data(D,\"visibilityMode\")==Ext.Element.DISPLAY||E.useDisplay?B.display=\"none\":B.visibility=w;p(D).clearOpacity()}p(D).afterFx(E)})});return C},scale:function(B,C,D){this.shift(Ext.apply({},D,{width:B,height:C}));return this},shift:function(D){D=x(D);var C=this.dom,B={};this.queueFx(D,function(){for(var E in D){if(D[E]!=A){B[E]={to:D[E]}}}B.width?B.width.to=p(C).adjustWidth(D.width):B;B.height?B.height.to=p(C).adjustWidth(D.height):B;if(B.x||B.y||B.xy){B.points=B.xy||{to:[B.x?B.x.to:p(C).getX(),B.y?B.y.to:p(C).getY()]}}arguments.callee.anim=p(C).fxanim(B,D,e,0.35,r,function(){p(C).afterFx(D)})});return this},ghost:function(E,C){C=x(C);var G=this,D=G.dom,J=D.style,H={opacity:{to:0},points:{}},K=H.points,B,I,F;E=E||\"b\";G.queueFx(C,function(){B=p(D).getFxRestore();I=p(D).getWidth();F=p(D).getHeight();function L(){C.useDisplay?p(D).setDisplayed(t):p(D).hide();p(D).clearOpacity();p(D).setPositioning(B.pos);J.width=B.width;J.height=B.height;p(D).afterFx(C)}K.by=p(D).switchStatements(E.toLowerCase(),function(N,M){return[N,M]},{t:[0,-F],l:[-I,0],r:[I,0],b:[0,F],tl:[-I,-F],bl:[-I,F],br:[I,F],tr:[I,-F]});arguments.callee.anim=p(D).fxanim(H,C,e,0.5,r,L)});return G},syncFx:function(){var B=this;B.fxDefaults=Ext.apply(B.fxDefaults||{},{block:t,concurrent:k,stopFx:t});return B},sequenceFx:function(){var B=this;B.fxDefaults=Ext.apply(B.fxDefaults||{},{block:t,concurrent:t,stopFx:t});return B},nextFx:function(){var B=c(this.dom.id)[0];if(B){B.call(this)}},hasActiveFx:function(){return c(this.dom.id)[0]},stopFx:function(B){var C=this,E=C.dom.id;if(C.hasActiveFx()){var D=c(E)[0];if(D&&D.anim){if(D.anim.isAnimated){b(E,[D]);D.anim.stop(B!==undefined?B:k)}else{b(E,[])}}}return C},beforeFx:function(B){if(this.hasActiveFx()&&!B.concurrent){if(B.stopFx){this.stopFx();return k}return t}return k},hasFxBlock:function(){var B=c(this.dom.id);return B&&B[0]&&B[0].block},queueFx:function(E,B){var C=p(this.dom);if(!C.hasFxBlock()){Ext.applyIf(E,C.fxDefaults);if(!E.concurrent){var D=C.beforeFx(E);B.block=E.block;c(C.dom.id).push(B);if(D){C.nextFx()}}else{B.call(C)}}return C},fxWrap:function(H,F,D){var E=this.dom,C,B;if(!F.wrap||!(C=Ext.getDom(F.wrap))){if(F.fixPosition){B=p(E).getXY()}var G=document.createElement(\"div\");G.style.visibility=D;C=E.parentNode.insertBefore(G,E);p(C).setPositioning(H);if(p(C).isStyle(o,\"static\")){p(C).position(\"relative\")}p(E).clearPositioning(\"auto\");p(C).clip();C.appendChild(E);if(B){p(C).setXY(B)}}return C},fxUnwrap:function(C,F,E){var D=this.dom;p(D).clearPositioning();p(D).setPositioning(F);if(!E.wrap){var B=p(C).dom.parentNode;B.insertBefore(D,C);p(C).remove()}},getFxRestore:function(){var B=this.dom.style;return{pos:this.getPositioning(),width:B.width,height:B.height}},afterFx:function(C){var B=this.dom,D=B.id;if(C.afterStyle){p(B).setStyle(C.afterStyle)}if(C.afterCls){p(B).addClass(C.afterCls)}if(C.remove==k){p(B).remove()}if(C.callback){C.callback.call(C.scope,p(B))}if(!C.concurrent){c(D).shift();p(B).nextFx()}},fxanim:function(E,F,C,G,D,B){C=C||\"run\";F=F||{};var H=Ext.lib.Anim[C](this.dom,E,(F.duration||G)||0.35,(F.easing||D)||r,B,this);F.anim=H;return H}};Ext.Fx.resize=Ext.Fx.scale;Ext.Element.addMethods(Ext.Fx)})();Ext.CompositeElementLite=function(b,a){this.elements=[];this.add(b,a);this.el=new Ext.Element.Flyweight()};Ext.CompositeElementLite.prototype={isComposite:true,getElement:function(a){var b=this.el;b.dom=a;b.id=a.id;return b},transformElement:function(a){return Ext.getDom(a)},getCount:function(){return this.elements.length},add:function(d,b){var e=this,g=e.elements;if(!d){return this}if(typeof d==\"string\"){d=Ext.Element.selectorFunction(d,b)}else{if(d.isComposite){d=d.elements}else{if(!Ext.isIterable(d)){d=[d]}}}for(var c=0,a=d.length;c<a;++c){g.push(e.transformElement(d[c]))}return e},invoke:function(g,b){var h=this,d=h.elements,a=d.length,j,c;for(c=0;c<a;c++){j=d[c];if(j){Ext.Element.prototype[g].apply(h.getElement(j),b)}}return h},item:function(b){var d=this,c=d.elements[b],a=null;if(c){a=d.getElement(c)}return a},addListener:function(b,j,h,g){var d=this.elements,a=d.length,c,k;for(c=0;c<a;c++){k=d[c];if(k){Ext.EventManager.on(k,b,j,h||k,g)}}return this},each:function(g,d){var h=this,c=h.elements,a=c.length,b,j;for(b=0;b<a;b++){j=c[b];if(j){j=this.getElement(j);if(g.call(d||j,j,h,b)===false){break}}}return h},fill:function(a){var b=this;b.elements=[];b.add(a);return b},filter:function(a){var b=[],d=this,c=Ext.isFunction(a)?a:function(e){return e.is(a)};d.each(function(h,e,g){if(c(h,g)!==false){b[b.length]=d.transformElement(h)}});d.elements=b;return d},indexOf:function(a){return this.elements.indexOf(this.transformElement(a))},replaceElement:function(e,c,a){var b=!isNaN(e)?e:this.indexOf(e),g;if(b>-1){c=Ext.getDom(c);if(a){g=this.elements[b];g.parentNode.insertBefore(c,g);Ext.removeNode(g)}this.elements.splice(b,1,c)}return this},clear:function(){this.elements=[]}};Ext.CompositeElementLite.prototype.on=Ext.CompositeElementLite.prototype.addListener;Ext.CompositeElementLite.importElementMethods=function(){var c,b=Ext.Element.prototype,a=Ext.CompositeElementLite.prototype;for(c in b){if(typeof b[c]==\"function\"){(function(d){a[d]=a[d]||function(){return this.invoke(d,arguments)}}).call(a,c)}}};Ext.CompositeElementLite.importElementMethods();if(Ext.DomQuery){Ext.Element.selectorFunction=Ext.DomQuery.select}Ext.Element.select=function(a,b){var c;if(typeof a==\"string\"){c=Ext.Element.selectorFunction(a,b)}else{if(a.length!==undefined){c=a}else{throw\"Invalid selector\"}}return new Ext.CompositeElementLite(c)};Ext.select=Ext.Element.select;(function(){var b=\"beforerequest\",e=\"requestcomplete\",d=\"requestexception\",h=undefined,c=\"load\",i=\"POST\",a=\"GET\",g=window;Ext.data.Connection=function(j){Ext.apply(this,j);this.addEvents(b,e,d);Ext.data.Connection.superclass.constructor.call(this)};Ext.extend(Ext.data.Connection,Ext.util.Observable,{timeout:30000,autoAbort:false,disableCaching:true,disableCachingParam:\"_dc\",request:function(n){var s=this;if(s.fireEvent(b,s,n)){if(n.el){if(!Ext.isEmpty(n.indicatorText)){s.indicatorText='<div class=\"loading-indicator\">'+n.indicatorText+\"</div>\"}if(s.indicatorText){Ext.getDom(n.el).innerHTML=s.indicatorText}n.success=(Ext.isFunction(n.success)?n.success:function(){}).createInterceptor(function(o){Ext.getDom(n.el).innerHTML=o.responseText})}var l=n.params,k=n.url||s.url,j,q={success:s.handleResponse,failure:s.handleFailure,scope:s,argument:{options:n},timeout:Ext.num(n.timeout,s.timeout)},m,t;if(Ext.isFunction(l)){l=l.call(n.scope||g,n)}l=Ext.urlEncode(s.extraParams,Ext.isObject(l)?Ext.urlEncode(l):l);if(Ext.isFunction(k)){k=k.call(n.scope||g,n)}if((m=Ext.getDom(n.form))){k=k||m.action;if(n.isUpload||(/multipart\\/form-data/i.test(m.getAttribute(\"enctype\")))){return s.doFormUpload.call(s,n,l,k)}t=Ext.lib.Ajax.serializeForm(m);l=l?(l+\"&\"+t):t}j=n.method||s.method||((l||n.xmlData||n.jsonData)?i:a);if(j===a&&(s.disableCaching&&n.disableCaching!==false)||n.disableCaching===true){var r=n.disableCachingParam||s.disableCachingParam;k=Ext.urlAppend(k,r+\"=\"+(new Date().getTime()))}n.headers=Ext.applyIf(n.headers||{},s.defaultHeaders||{});if(n.autoAbort===true||s.autoAbort){s.abort()}if((j==a||n.xmlData||n.jsonData)&&l){k=Ext.urlAppend(k,l);l=\"\"}return(s.transId=Ext.lib.Ajax.request(j,k,q,l,n))}else{return n.callback?n.callback.apply(n.scope,[n,h,h]):null}},isLoading:function(j){return j?Ext.lib.Ajax.isCallInProgress(j):!!this.transId},abort:function(j){if(j||this.isLoading()){Ext.lib.Ajax.abort(j||this.transId)}},handleResponse:function(j){this.transId=false;var k=j.argument.options;j.argument=k?k.argument:null;this.fireEvent(e,this,j,k);if(k.success){k.success.call(k.scope,j,k)}if(k.callback){k.callback.call(k.scope,k,true,j)}},handleFailure:function(j,l){this.transId=false;var k=j.argument.options;j.argument=k?k.argument:null;this.fireEvent(d,this,j,k,l);if(k.failure){k.failure.call(k.scope,j,k)}if(k.callback){k.callback.call(k.scope,k,false,j)}},doFormUpload:function(q,j,k){var l=Ext.id(),v=document,r=v.createElement(\"iframe\"),m=Ext.getDom(q.form),u=[],t,p=\"multipart/form-data\",n={target:m.target,method:m.method,encoding:m.encoding,enctype:m.enctype,action:m.action};Ext.fly(r).set({id:l,name:l,cls:\"x-hidden\",src:Ext.SSL_SECURE_URL});v.body.appendChild(r);if(Ext.isIE){document.frames[l].name=l}Ext.fly(m).set({target:l,method:i,enctype:p,encoding:p,action:k||n.action});Ext.iterate(Ext.urlDecode(j,false),function(w,o){t=v.createElement(\"input\");Ext.fly(t).set({type:\"hidden\",value:o,name:w});m.appendChild(t);u.push(t)});function s(){var x=this,w={responseText:\"\",responseXML:null,argument:q.argument},A,z;try{A=r.contentWindow.document||r.contentDocument||g.frames[l].document;if(A){if(A.body){if(/textarea/i.test((z=A.body.firstChild||{}).tagName)){w.responseText=z.value}else{w.responseText=A.body.innerHTML}}w.responseXML=A.XMLDocument||A}}catch(y){}Ext.EventManager.removeListener(r,c,s,x);x.fireEvent(e,x,w,q);function o(D,C,B){if(Ext.isFunction(D)){D.apply(C,B)}}o(q.success,q.scope,[w,q]);o(q.callback,q.scope,[q,true,w]);if(!x.debugUploads){setTimeout(function(){Ext.removeNode(r)},100)}}Ext.EventManager.on(r,c,s,this);m.submit();Ext.fly(m).set(n);Ext.each(u,function(o){Ext.removeNode(o)})}})})();Ext.Ajax=new Ext.data.Connection({autoAbort:false,serializeForm:function(a){return Ext.lib.Ajax.serializeForm(a)}});Ext.util.JSON=new (function(){var useHasOwn=!!{}.hasOwnProperty,isNative=function(){var useNative=null;return function(){if(useNative===null){useNative=Ext.USE_NATIVE_JSON&&window.JSON&&JSON.toString()==\"[object JSON]\"}return useNative}}(),pad=function(n){return n<10?\"0\"+n:n},doDecode=function(json){return json?eval(\"(\"+json+\")\"):\"\"},doEncode=function(o){if(!Ext.isDefined(o)||o===null){return\"null\"}else{if(Ext.isArray(o)){return encodeArray(o)}else{if(Ext.isDate(o)){return Ext.util.JSON.encodeDate(o)}else{if(Ext.isString(o)){return encodeString(o)}else{if(typeof o==\"number\"){return isFinite(o)?String(o):\"null\"}else{if(Ext.isBoolean(o)){return String(o)}else{var a=[\"{\"],b,i,v;for(i in o){if(!o.getElementsByTagName){if(!useHasOwn||o.hasOwnProperty(i)){v=o[i];switch(typeof v){case\"undefined\":case\"function\":case\"unknown\":break;default:if(b){a.push(\",\")}a.push(doEncode(i),\":\",v===null?\"null\":doEncode(v));b=true}}}}a.push(\"}\");return a.join(\"\")}}}}}}},m={\"\\b\":\"\\\\b\",\"\\t\":\"\\\\t\",\"\\n\":\"\\\\n\",\"\\f\":\"\\\\f\",\"\\r\":\"\\\\r\",'\"':'\\\\\"',\"\\\\\":\"\\\\\\\\\"},encodeString=function(s){if(/[\"\\\\\\x00-\\x1f]/.test(s)){return'\"'+s.replace(/([\\x00-\\x1f\\\\\"])/g,function(a,b){var c=m[b];if(c){return c}c=b.charCodeAt();return\"\\\\u00\"+Math.floor(c/16).toString(16)+(c%16).toString(16)})+'\"'}return'\"'+s+'\"'},encodeArray=function(o){var a=[\"[\"],b,i,l=o.length,v;for(i=0;i<l;i+=1){v=o[i];switch(typeof v){case\"undefined\":case\"function\":case\"unknown\":break;default:if(b){a.push(\",\")}a.push(v===null?\"null\":Ext.util.JSON.encode(v));b=true}}a.push(\"]\");return a.join(\"\")};this.encodeDate=function(o){return'\"'+o.getFullYear()+\"-\"+pad(o.getMonth()+1)+\"-\"+pad(o.getDate())+\"T\"+pad(o.getHours())+\":\"+pad(o.getMinutes())+\":\"+pad(o.getSeconds())+'\"'};this.encode=function(){var ec;return function(o){if(!ec){ec=isNative()?JSON.stringify:doEncode}return ec(o)}}();this.decode=function(){var dc;return function(json){if(!dc){dc=isNative()?JSON.parse:doDecode}return dc(json)}}()})();Ext.encode=Ext.util.JSON.encode;Ext.decode=Ext.util.JSON.decode;Ext.EventManager=function(){var z,p,j=false,l=Ext.isGecko||Ext.isWebKit||Ext.isSafari||Ext.isIE10p,o=Ext.lib.Event,q=Ext.lib.Dom,c=document,A=window,r=\"DOMContentLoaded\",t=\"complete\",g=/^(?:scope|delay|buffer|single|stopEvent|preventDefault|stopPropagation|normalized|args|delegate)$/,u=[];function n(E){var H=false,D=0,C=u.length,F=false,G;if(E){if(E.getElementById||E.navigator){for(;D<C;++D){G=u[D];if(G.el===E){H=G.id;break}}if(!H){H=Ext.id(E);u.push({id:H,el:E});F=true}}else{H=Ext.id(E)}if(!Ext.elCache[H]){Ext.Element.addToCache(new Ext.Element(E),H);if(F){Ext.elCache[H].skipGC=true}}}return H}function m(E,G,J,F,D,L){E=Ext.getDom(E);var C=n(E),K=Ext.elCache[C].events,H;H=o.on(E,G,D);K[G]=K[G]||[];K[G].push([J,D,L,H,F]);if(E.addEventListener&&G==\"mousewheel\"){var I=[\"DOMMouseScroll\",D,false];E.addEventListener.apply(E,I);Ext.EventManager.addListener(A,\"unload\",function(){E.removeEventListener.apply(E,I)})}if(E==c&&G==\"mousedown\"){Ext.EventManager.stoppedMouseDownEvent.addListener(D)}}function d(){if(window!=top){return false}try{c.documentElement.doScroll(\"left\")}catch(C){return false}b();return true}function B(C){if(Ext.isIE9m&&d()){return true}if(c.readyState==t){b();return true}j||(p=setTimeout(arguments.callee,2));return false}var k;function i(C){k||(k=Ext.query(\"style, link[rel=stylesheet]\"));if(k.length==c.styleSheets.length){b();return true}j||(p=setTimeout(arguments.callee,2));return false}function y(C){c.removeEventListener(r,arguments.callee,false);i()}function b(C){if(!j){j=true;if(p){clearTimeout(p)}if(l){c.removeEventListener(r,b,false)}if(Ext.isIE9m&&B.bindIE){c.detachEvent(\"onreadystatechange\",B)}o.un(A,\"load\",arguments.callee)}if(z&&!Ext.isReady){Ext.isReady=true;z.fire();z.listeners=[]}}function a(){z||(z=new Ext.util.Event());if(l){c.addEventListener(r,b,false)}if(Ext.isIE9m){if(!B()){B.bindIE=true;c.attachEvent(\"onreadystatechange\",B)}}else{if(Ext.isOpera){(c.readyState==t&&i())||c.addEventListener(r,y,false)}else{if(Ext.isWebKit){B()}}}o.on(A,\"load\",b)}function x(C,D){return function(){var E=Ext.toArray(arguments);if(D.target==Ext.EventObject.setEvent(E[0]).target){C.apply(this,E)}}}function w(D,E,C){return function(F){C.delay(E.buffer,D,null,[new Ext.EventObjectImpl(F)])}}function s(G,F,C,E,D){return function(H){Ext.EventManager.removeListener(F,C,E,D);G(H)}}function e(D,E,C){return function(G){var F=new Ext.util.DelayedTask(D);if(!C.tasks){C.tasks=[]}C.tasks.push(F);F.delay(E.delay||10,D,null,[new Ext.EventObjectImpl(G)])}}function h(H,G,C,J,K){var D=(!C||typeof C==\"boolean\")?{}:C,E=Ext.getDom(H),F;J=J||D.fn;K=K||D.scope;if(!E){throw'Error listening for \"'+G+'\". Element \"'+H+\"\\\" doesn't exist.\"}function I(M){if(!Ext){return}M=Ext.EventObject.setEvent(M);var L;if(D.delegate){if(!(L=M.getTarget(D.delegate,E))){return}}else{L=M.target}if(D.stopEvent){M.stopEvent()}if(D.preventDefault){M.preventDefault()}if(D.stopPropagation){M.stopPropagation()}if(D.normalized===false){M=M.browserEvent}J.call(K||E,M,L,D)}if(D.target){I=x(I,D)}if(D.delay){I=e(I,D,J)}if(D.single){I=s(I,E,G,J,K)}if(D.buffer){F=new Ext.util.DelayedTask(I);I=w(I,D,F)}m(E,G,J,F,I,K);return I}var v={addListener:function(E,C,G,F,D){if(typeof C==\"object\"){var J=C,H,I;for(H in J){I=J[H];if(!g.test(H)){if(Ext.isFunction(I)){h(E,H,J,I,J.scope)}else{h(E,H,I)}}}}else{h(E,C,D,G,F)}},removeListener:function(E,I,M,N){E=Ext.getDom(E);var C=n(E),K=E&&(Ext.elCache[C].events)[I]||[],D,H,F,G,J,L;for(H=0,J=K.length;H<J;H++){if(Ext.isArray(L=K[H])&&L[0]==M&&(!N||L[2]==N)){if(L[4]){L[4].cancel()}G=M.tasks&&M.tasks.length;if(G){while(G--){M.tasks[G].cancel()}delete M.tasks}D=L[1];o.un(E,I,o.extAdapter?L[3]:D);if(D&&E.addEventListener&&I==\"mousewheel\"){E.removeEventListener(\"DOMMouseScroll\",D,false)}if(D&&E==c&&I==\"mousedown\"){Ext.EventManager.stoppedMouseDownEvent.removeListener(D)}K.splice(H,1);if(K.length===0){delete Ext.elCache[C].events[I]}for(G in Ext.elCache[C].events){return false}Ext.elCache[C].events={};return false}}},removeAll:function(E){E=Ext.getDom(E);var D=n(E),J=Ext.elCache[D]||{},M=J.events||{},I,H,K,F,L,G,C;for(F in M){if(M.hasOwnProperty(F)){I=M[F];for(H=0,K=I.length;H<K;H++){L=I[H];if(L[4]){L[4].cancel()}if(L[0].tasks&&(G=L[0].tasks.length)){while(G--){L[0].tasks[G].cancel()}delete L.tasks}C=L[1];o.un(E,F,o.extAdapter?L[3]:C);if(E.addEventListener&&C&&F==\"mousewheel\"){E.removeEventListener(\"DOMMouseScroll\",C,false)}if(C&&E==c&&F==\"mousedown\"){Ext.EventManager.stoppedMouseDownEvent.removeListener(C)}}}}if(Ext.elCache[D]){Ext.elCache[D].events={}}},getListeners:function(F,C){F=Ext.getDom(F);var H=n(F),D=Ext.elCache[H]||{},G=D.events||{},E=[];if(G&&G[C]){return G[C]}else{return null}},removeFromSpecialCache:function(E){var D=0,C=u.length;for(;D<C;++D){if(u[D].el==E){u.splice(D,1)}}},purgeElement:function(E,C,G){E=Ext.getDom(E);var D=n(E),J=Ext.elCache[D]||{},K=J.events||{},F,I,H;if(G){if(K&&K.hasOwnProperty(G)){I=K[G];for(F=0,H=I.length;F<H;F++){Ext.EventManager.removeListener(E,G,I[F][0])}}}else{Ext.EventManager.removeAll(E)}if(C&&E&&E.childNodes){for(F=0,H=E.childNodes.length;F<H;F++){Ext.EventManager.purgeElement(E.childNodes[F],C,G)}}},_unload:function(){var C;for(C in Ext.elCache){Ext.EventManager.removeAll(C)}delete Ext.elCache;delete Ext.Element._flyweights;var G,D,F,E=Ext.lib.Ajax;(typeof E.conn==\"object\")?D=E.conn:D={};for(F in D){G=D[F];if(G){E.abort({conn:G,tId:F})}}},onDocumentReady:function(E,D,C){if(Ext.isReady){z||(z=new Ext.util.Event());z.addListener(E,D,C);z.fire();z.listeners=[]}else{if(!z){a()}C=C||{};C.delay=C.delay||1;z.addListener(E,D,C)}},fireDocReady:b};v.on=v.addListener;v.un=v.removeListener;v.stoppedMouseDownEvent=new Ext.util.Event();return v}();Ext.onReady=Ext.EventManager.onDocumentReady;(function(){var a=function(){var c=document.body||document.getElementsByTagName(\"body\")[0];if(!c){return false}var b=[];if(Ext.isIE){if(!Ext.isIE10p){b.push(\"ext-ie\")}if(Ext.isIE6){b.push(\"ext-ie6\")}else{if(Ext.isIE7){b.push(\"ext-ie7\",\"ext-ie7m\")}else{if(Ext.isIE8){b.push(\"ext-ie8\",\"ext-ie8m\")}else{if(Ext.isIE9){b.push(\"ext-ie9\",\"ext-ie9m\")}else{if(Ext.isIE10){b.push(\"ext-ie10\")}}}}}}if(Ext.isGecko){if(Ext.isGecko2){b.push(\"ext-gecko2\")}else{b.push(\"ext-gecko3\")}}if(Ext.isOpera){b.push(\"ext-opera\")}if(Ext.isWebKit){b.push(\"ext-webkit\")}if(Ext.isSafari){b.push(\"ext-safari \"+(Ext.isSafari2?\"ext-safari2\":(Ext.isSafari3?\"ext-safari3\":\"ext-safari4\")))}else{if(Ext.isChrome){b.push(\"ext-chrome\")}}if(Ext.isMac){b.push(\"ext-mac\")}if(Ext.isLinux){b.push(\"ext-linux\")}if(Ext.isStrict||Ext.isBorderBox){var d=c.parentNode;if(d){if(!Ext.isStrict){Ext.fly(d,\"_internal\").addClass(\"x-quirks\");if(Ext.isIE9m&&!Ext.isStrict){Ext.isIEQuirks=true}}Ext.fly(d,\"_internal\").addClass(((Ext.isStrict&&Ext.isIE)||(!Ext.enableForcedBoxModel&&!Ext.isIE))?\" ext-strict\":\" ext-border-box\")}}if(Ext.enableForcedBoxModel&&!Ext.isIE){Ext.isForcedBorderBox=true;b.push(\"ext-forced-border-box\")}Ext.fly(c,\"_internal\").addClass(b);return true};if(!a()){Ext.onReady(a)}})();(function(){var b=Ext.apply(Ext.supports,{correctRightMargin:true,correctTransparentColor:true,cssFloat:true});var a=function(){var g=document.createElement(\"div\"),e=document,c,d;g.innerHTML='<div style=\"height:30px;width:50px;\"><div style=\"height:20px;width:20px;\"></div></div><div style=\"float:left;background-color:transparent;\">';e.body.appendChild(g);d=g.lastChild;if((c=e.defaultView)){if(c.getComputedStyle(g.firstChild.firstChild,null).marginRight!=\"0px\"){b.correctRightMargin=false}if(c.getComputedStyle(d,null).backgroundColor!=\"transparent\"){b.correctTransparentColor=false}}b.cssFloat=!!d.style.cssFloat;e.body.removeChild(g)};if(Ext.isReady){a()}else{Ext.onReady(a)}})();Ext.EventObject=function(){var b=Ext.lib.Event,c=/(dbl)?click/,a={3:13,63234:37,63235:39,63232:38,63233:40,63276:33,63277:34,63272:46,63273:36,63275:35},d=Ext.isIE?{1:0,4:1,2:2}:{0:0,1:1,2:2};Ext.EventObjectImpl=function(g){if(g){this.setEvent(g.browserEvent||g)}};Ext.EventObjectImpl.prototype={setEvent:function(h){var g=this;if(h==g||(h&&h.browserEvent)){return h}g.browserEvent=h;if(h){g.button=h.button?d[h.button]:(h.which?h.which-1:-1);if(c.test(h.type)&&g.button==-1){g.button=0}g.type=h.type;g.shiftKey=h.shiftKey;g.ctrlKey=h.ctrlKey||h.metaKey||false;g.altKey=h.altKey;g.keyCode=h.keyCode;g.charCode=h.charCode;g.target=b.getTarget(h);g.xy=b.getXY(h)}else{g.button=-1;g.shiftKey=false;g.ctrlKey=false;g.altKey=false;g.keyCode=0;g.charCode=0;g.target=null;g.xy=[0,0]}return g},stopEvent:function(){var e=this;if(e.browserEvent){if(e.browserEvent.type==\"mousedown\"){Ext.EventManager.stoppedMouseDownEvent.fire(e)}b.stopEvent(e.browserEvent)}},preventDefault:function(){if(this.browserEvent){b.preventDefault(this.browserEvent)}},stopPropagation:function(){var e=this;if(e.browserEvent){if(e.browserEvent.type==\"mousedown\"){Ext.EventManager.stoppedMouseDownEvent.fire(e)}b.stopPropagation(e.browserEvent)}},getCharCode:function(){return this.charCode||this.keyCode},getKey:function(){return this.normalizeKey(this.keyCode||this.charCode)},normalizeKey:function(e){return Ext.isSafari?(a[e]||e):e},getPageX:function(){return this.xy[0]},getPageY:function(){return this.xy[1]},getXY:function(){return this.xy},getTarget:function(g,h,e){return g?Ext.fly(this.target).findParent(g,h,e):(e?Ext.get(this.target):this.target)},getRelatedTarget:function(){return this.browserEvent?b.getRelatedTarget(this.browserEvent):null},getWheelDelta:function(){var g=this.browserEvent;var h=0;if(g.wheelDelta){h=g.wheelDelta/120}else{if(g.detail){h=-g.detail/3}}return h},within:function(h,i,e){if(h){var g=this[i?\"getRelatedTarget\":\"getTarget\"]();return g&&((e?(g==Ext.getDom(h)):false)||Ext.fly(h).contains(g))}return false}};return new Ext.EventObjectImpl()}();Ext.Loader=Ext.apply({},{load:function(j,i,k,c){var k=k||this,g=document.getElementsByTagName(\"head\")[0],b=document.createDocumentFragment(),a=j.length,h=0,e=this;var l=function(m){g.appendChild(e.buildScriptTag(j[m],d))};var d=function(){h++;if(a==h&&typeof i==\"function\"){i.call(k)}else{if(c===true){l(h)}}};if(c===true){l.call(this,0)}else{Ext.each(j,function(n,m){b.appendChild(this.buildScriptTag(n,d))},this);g.appendChild(b)}},buildScriptTag:function(b,c){var a=document.createElement(\"script\");a.type=\"text/javascript\";a.src=b;if(a.readyState){a.onreadystatechange=function(){if(a.readyState==\"loaded\"||a.readyState==\"complete\"){a.onreadystatechange=null;c()}}}else{a.onload=c}return a}});Ext.ns(\"Ext.grid\",\"Ext.list\",\"Ext.dd\",\"Ext.tree\",\"Ext.form\",\"Ext.menu\",\"Ext.state\",\"Ext.layout.boxOverflow\",\"Ext.app\",\"Ext.ux\",\"Ext.chart\",\"Ext.direct\",\"Ext.slider\");Ext.apply(Ext,function(){var c=Ext,a=0,b=null;return{emptyFn:function(){},BLANK_IMAGE_URL:Ext.isIE6||Ext.isIE7||Ext.isAir?\"http://www.extjs.com/s.gif\":\"data:image/gif;base64,R0lGODlhAQABAID/AMDAwAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==\",extendX:function(d,e){return Ext.extend(d,e(d.prototype))},getDoc:function(){return Ext.get(document)},num:function(e,d){e=Number(Ext.isEmpty(e)||Ext.isArray(e)||typeof e==\"boolean\"||(typeof e==\"string\"&&e.trim().length==0)?NaN:e);return isNaN(e)?d:e},value:function(g,d,e){return Ext.isEmpty(g,e)?d:g},escapeRe:function(d){return d.replace(/([-.*+?^${}()|[\\]\\/\\\\])/g,\"\\\\$1\")},sequence:function(h,d,g,e){h[d]=h[d].createSequence(g,e)},addBehaviors:function(i){if(!Ext.isReady){Ext.onReady(function(){Ext.addBehaviors(i)})}else{var e={},h,d,g;for(d in i){if((h=d.split(\"@\"))[1]){g=h[0];if(!e[g]){e[g]=Ext.select(g)}e[g].on(h[1],i[d])}}e=null}},getScrollBarWidth:function(g){if(!Ext.isReady){return 0}if(g===true||b===null){var i=Ext.getBody().createChild('<div class=\"x-hide-offsets\" style=\"width:100px;height:50px;overflow:hidden;\"><div style=\"height:200px;\"></div></div>'),h=i.child(\"div\",true);var e=h.offsetWidth;i.setStyle(\"overflow\",(Ext.isWebKit||Ext.isGecko)?\"auto\":\"scroll\");var d=h.offsetWidth;i.remove();b=e-d+2}return b},combine:function(){var g=arguments,e=g.length,j=[];for(var h=0;h<e;h++){var d=g[h];if(Ext.isArray(d)){j=j.concat(d)}else{if(d.length!==undefined&&!d.substr){j=j.concat(Array.prototype.slice.call(d,0))}else{j.push(d)}}}return j},copyTo:function(d,e,g){if(typeof g==\"string\"){g=g.split(/[,;\\s]/)}Ext.each(g,function(h){if(e.hasOwnProperty(h)){d[h]=e[h]}},this);return d},destroy:function(){Ext.each(arguments,function(d){if(d){if(Ext.isArray(d)){this.destroy.apply(this,d)}else{if(typeof d.destroy==\"function\"){d.destroy()}else{if(d.dom){d.remove()}}}}},this)},destroyMembers:function(l,j,g,h){for(var k=1,e=arguments,d=e.length;k<d;k++){Ext.destroy(l[e[k]]);delete l[e[k]]}},clean:function(d){var e=[];Ext.each(d,function(g){if(!!g){e.push(g)}});return e},unique:function(d){var e=[],g={};Ext.each(d,function(h){if(!g[h]){e.push(h)}g[h]=true});return e},flatten:function(d){var g=[];function e(h){Ext.each(h,function(i){if(Ext.isArray(i)){e(i)}else{g.push(i)}});return g}return e(d)},min:function(d,e){var g=d[0];e=e||function(i,h){return i<h?-1:1};Ext.each(d,function(h){g=e(g,h)==-1?g:h});return g},max:function(d,e){var g=d[0];e=e||function(i,h){return i>h?1:-1};Ext.each(d,function(h){g=e(g,h)==1?g:h});return g},mean:function(d){return d.length>0?Ext.sum(d)/d.length:undefined},sum:function(d){var e=0;Ext.each(d,function(g){e+=g});return e},partition:function(d,e){var g=[[],[]];Ext.each(d,function(j,k,h){g[(e&&e(j,k,h))||(!e&&j)?0:1].push(j)});return g},invoke:function(d,e){var h=[],g=Array.prototype.slice.call(arguments,2);Ext.each(d,function(j,k){if(j&&typeof j[e]==\"function\"){h.push(j[e].apply(j,g))}else{h.push(undefined)}});return h},pluck:function(d,g){var e=[];Ext.each(d,function(h){e.push(h[g])});return e},zip:function(){var n=Ext.partition(arguments,function(i){return typeof i!=\"function\"}),k=n[0],m=n[1][0],d=Ext.max(Ext.pluck(k,\"length\")),h=[];for(var l=0;l<d;l++){h[l]=[];if(m){h[l]=m.apply(m,Ext.pluck(k,l))}else{for(var g=0,e=k.length;g<e;g++){h[l].push(k[g][l])}}}return h},getCmp:function(d){return Ext.ComponentMgr.get(d)},useShims:c.isIE6||(c.isMac&&c.isGecko2),type:function(e){if(e===undefined||e===null){return false}if(e.htmlElement){return\"element\"}var d=typeof e;if(d==\"object\"&&e.nodeName){switch(e.nodeType){case 1:return\"element\";case 3:return(/\\S/).test(e.nodeValue)?\"textnode\":\"whitespace\"}}if(d==\"object\"||d==\"function\"){switch(e.constructor){case Array:return\"array\";case RegExp:return\"regexp\";case Date:return\"date\"}if(typeof e.length==\"number\"&&typeof e.item==\"function\"){return\"nodelist\"}}return d},intercept:function(h,d,g,e){h[d]=h[d].createInterceptor(g,e)},callback:function(d,h,g,e){if(typeof d==\"function\"){if(e){d.defer(e,h,g||[])}else{d.apply(h,g||[])}}}}}());Ext.apply(Function.prototype,{createSequence:function(b,a){var c=this;return(typeof b!=\"function\")?this:function(){var d=c.apply(this||window,arguments);b.apply(a||this||window,arguments);return d}}});Ext.applyIf(String,{escape:function(a){return a.replace(/('|\\\\)/g,\"\\\\$1\")},leftPad:function(d,b,c){var a=String(d);if(!c){c=\" \"}while(a.length<b){a=c+a}return a}});String.prototype.toggle=function(b,a){return this==b?a:b};String.prototype.trim=function(){var a=/^\\s+|\\s+$/g;return function(){return this.replace(a,\"\")}}();Date.prototype.getElapsed=function(a){return Math.abs((a||new Date()).getTime()-this.getTime())};Ext.applyIf(Number.prototype,{constrain:function(b,a){return Math.min(Math.max(this,b),a)}});Ext.lib.Dom.getRegion=function(a){return Ext.lib.Region.getRegion(a)};Ext.lib.Region=function(d,g,a,c){var e=this;e.top=d;e[1]=d;e.right=g;e.bottom=a;e.left=c;e[0]=c};Ext.lib.Region.prototype={contains:function(b){var a=this;return(b.left>=a.left&&b.right<=a.right&&b.top>=a.top&&b.bottom<=a.bottom)},getArea:function(){var a=this;return((a.bottom-a.top)*(a.right-a.left))},intersect:function(h){var g=this,d=Math.max(g.top,h.top),e=Math.min(g.right,h.right),a=Math.min(g.bottom,h.bottom),c=Math.max(g.left,h.left);if(a>=d&&e>=c){return new Ext.lib.Region(d,e,a,c)}},union:function(h){var g=this,d=Math.min(g.top,h.top),e=Math.max(g.right,h.right),a=Math.max(g.bottom,h.bottom),c=Math.min(g.left,h.left);return new Ext.lib.Region(d,e,a,c)},constrainTo:function(b){var a=this;a.top=a.top.constrain(b.top,b.bottom);a.bottom=a.bottom.constrain(b.top,b.bottom);a.left=a.left.constrain(b.left,b.right);a.right=a.right.constrain(b.left,b.right);return a},adjust:function(d,c,a,g){var e=this;e.top+=d;e.left+=c;e.right+=g;e.bottom+=a;return e}};Ext.lib.Region.getRegion=function(e){var h=Ext.lib.Dom.getXY(e),d=h[1],g=h[0]+e.offsetWidth,a=h[1]+e.offsetHeight,c=h[0];return new Ext.lib.Region(d,g,a,c)};Ext.lib.Point=function(a,c){if(Ext.isArray(a)){c=a[1];a=a[0]}var b=this;b.x=b.right=b.left=b[0]=a;b.y=b.top=b.bottom=b[1]=c};Ext.lib.Point.prototype=new Ext.lib.Region();Ext.apply(Ext.DomHelper,function(){var e,a=\"afterbegin\",h=\"afterend\",i=\"beforebegin\",d=\"beforeend\",b=/tag|children|cn|html$/i;function g(m,p,n,q,l,j){m=Ext.getDom(m);var k;if(e.useDom){k=c(p,null);if(j){m.appendChild(k)}else{(l==\"firstChild\"?m:m.parentNode).insertBefore(k,m[l]||m)}}else{k=Ext.DomHelper.insertHtml(q,m,Ext.DomHelper.createHtml(p))}return n?Ext.get(k,true):k}function c(j,r){var k,u=document,p,s,m,t;if(Ext.isArray(j)){k=u.createDocumentFragment();for(var q=0,n=j.length;q<n;q++){c(j[q],k)}}else{if(typeof j==\"string\"){k=u.createTextNode(j)}else{k=u.createElement(j.tag||\"div\");p=!!k.setAttribute;for(var s in j){if(!b.test(s)){m=j[s];if(s==\"cls\"){k.className=m}else{if(p){k.setAttribute(s,m)}else{k[s]=m}}}}Ext.DomHelper.applyStyles(k,j.style);if((t=j.children||j.cn)){c(t,k)}else{if(j.html){k.innerHTML=j.html}}}}if(r){r.appendChild(k)}return k}e={createTemplate:function(k){var j=Ext.DomHelper.createHtml(k);return new Ext.Template(j)},useDom:false,insertBefore:function(j,l,k){return g(j,l,k,i)},insertAfter:function(j,l,k){return g(j,l,k,h,\"nextSibling\")},insertFirst:function(j,l,k){return g(j,l,k,a,\"firstChild\")},append:function(j,l,k){return g(j,l,k,d,\"\",true)},createDom:c};return e}());Ext.apply(Ext.Template.prototype,{disableFormats:false,re:/\\{([\\w\\-]+)(?:\\:([\\w\\.]*)(?:\\((.*?)?\\))?)?\\}/g,argsRe:/^\\s*['\"](.*)[\"']\\s*$/,compileARe:/\\\\/g,compileBRe:/(\\r\\n|\\n)/g,compileCRe:/'/g,applyTemplate:function(b){var g=this,a=g.disableFormats!==true,e=Ext.util.Format,c=g;if(g.compiled){return g.compiled(b)}function d(j,l,p,k){if(p&&a){if(p.substr(0,5)==\"this.\"){return c.call(p.substr(5),b[l],b)}else{if(k){var o=g.argsRe;k=k.split(\",\");for(var n=0,h=k.length;n<h;n++){k[n]=k[n].replace(o,\"$1\")}k=[b[l]].concat(k)}else{k=[b[l]]}return e[p].apply(e,k)}}else{return b[l]!==undefined?b[l]:\"\"}}return g.html.replace(g.re,d)},compile:function(){var me=this,fm=Ext.util.Format,useF=me.disableFormats!==true,sep=Ext.isGecko?\"+\":\",\",body;function fn(m,name,format,args){if(format&&useF){args=args?\",\"+args:\"\";if(format.substr(0,5)!=\"this.\"){format=\"fm.\"+format+\"(\"}else{format='this.call(\"'+format.substr(5)+'\", ';args=\", values\"}}else{args=\"\";format=\"(values['\"+name+\"'] == undefined ? '' : \"}return\"'\"+sep+format+\"values['\"+name+\"']\"+args+\")\"+sep+\"'\"}if(Ext.isGecko){body=\"this.compiled = function(values){ return '\"+me.html.replace(me.compileARe,\"\\\\\\\\\").replace(me.compileBRe,\"\\\\n\").replace(me.compileCRe,\"\\\\'\").replace(me.re,fn)+\"';};\"}else{body=[\"this.compiled = function(values){ return ['\"];body.push(me.html.replace(me.compileARe,\"\\\\\\\\\").replace(me.compileBRe,\"\\\\n\").replace(me.compileCRe,\"\\\\'\").replace(me.re,fn));body.push(\"'].join('');};\");body=body.join(\"\")}eval(body);return me},call:function(c,b,a){return this[c](b,a)}});Ext.Template.prototype.apply=Ext.Template.prototype.applyTemplate;Ext.util.Functions={createInterceptor:function(c,b,a){var d=c;if(!Ext.isFunction(b)){return c}else{return function(){var g=this,e=arguments;b.target=g;b.method=c;return(b.apply(a||g||window,e)!==false)?c.apply(g||window,e):null}}},createDelegate:function(c,d,b,a){if(!Ext.isFunction(c)){return c}return function(){var g=b||arguments;if(a===true){g=Array.prototype.slice.call(arguments,0);g=g.concat(b)}else{if(Ext.isNumber(a)){g=Array.prototype.slice.call(arguments,0);var e=[a,0].concat(b);Array.prototype.splice.apply(g,e)}}return c.apply(d||window,g)}},defer:function(d,c,e,b,a){d=Ext.util.Functions.createDelegate(d,e,b,a);if(c>0){return setTimeout(d,c)}d();return 0},createSequence:function(c,b,a){if(!Ext.isFunction(b)){return c}else{return function(){var d=c.apply(this||window,arguments);b.apply(a||this||window,arguments);return d}}}};Ext.defer=Ext.util.Functions.defer;Ext.createInterceptor=Ext.util.Functions.createInterceptor;Ext.createSequence=Ext.util.Functions.createSequence;Ext.createDelegate=Ext.util.Functions.createDelegate;Ext.apply(Ext.util.Observable.prototype,function(){function a(j){var i=(this.methodEvents=this.methodEvents||{})[j],d,c,g,h=this;if(!i){this.methodEvents[j]=i={};i.originalFn=this[j];i.methodName=j;i.before=[];i.after=[];var b=function(l,k,e){if((c=l.apply(k||h,e))!==undefined){if(typeof c==\"object\"){if(c.returnValue!==undefined){d=c.returnValue}else{d=c}g=!!c.cancel}else{if(c===false){g=true}else{d=c}}}};this[j]=function(){var l=Array.prototype.slice.call(arguments,0),k;d=c=undefined;g=false;for(var m=0,e=i.before.length;m<e;m++){k=i.before[m];b(k.fn,k.scope,l);if(g){return d}}if((c=i.originalFn.apply(h,l))!==undefined){d=c}for(var m=0,e=i.after.length;m<e;m++){k=i.after[m];b(k.fn,k.scope,l);if(g){return d}}return d}}return i}return{beforeMethod:function(d,c,b){a.call(this,d).before.push({fn:c,scope:b})},afterMethod:function(d,c,b){a.call(this,d).after.push({fn:c,scope:b})},removeMethodListener:function(j,g,d){var h=this.getMethodEvent(j);for(var c=0,b=h.before.length;c<b;c++){if(h.before[c].fn==g&&h.before[c].scope==d){h.before.splice(c,1);return}}for(var c=0,b=h.after.length;c<b;c++){if(h.after[c].fn==g&&h.after[c].scope==d){h.after.splice(c,1);return}}},relayEvents:function(j,e){var h=this;function g(i){return function(){return h.fireEvent.apply(h,[i].concat(Array.prototype.slice.call(arguments,0)))}}for(var d=0,b=e.length;d<b;d++){var c=e[d];h.events[c]=h.events[c]||true;j.on(c,g(c),h)}},enableBubble:function(e){var g=this;if(!Ext.isEmpty(e)){e=Ext.isArray(e)?e:Array.prototype.slice.call(arguments,0);for(var d=0,b=e.length;d<b;d++){var c=e[d];c=c.toLowerCase();var h=g.events[c]||true;if(typeof h==\"boolean\"){h=new Ext.util.Event(g,c);g.events[c]=h}h.bubble=true}}}}}());Ext.util.Observable.capture=function(c,b,a){c.fireEvent=c.fireEvent.createInterceptor(b,a)};Ext.util.Observable.observeClass=function(b,a){if(b){if(!b.fireEvent){Ext.apply(b,new Ext.util.Observable());Ext.util.Observable.capture(b.prototype,b.fireEvent,b)}if(typeof a==\"object\"){b.on(a)}return b}};Ext.apply(Ext.EventManager,function(){var d,k,g,b,a=Ext.lib.Dom,j=/^(?:scope|delay|buffer|single|stopEvent|preventDefault|stopPropagation|normalized|args|delegate)$/,c=Ext.EventManager._unload,i=0,h=0,e=Ext.isWebKit?Ext.num(navigator.userAgent.match(/AppleWebKit\\/(\\d+)/)[1])>=525:!((Ext.isGecko&&!Ext.isWindows)||Ext.isOpera);return{_unload:function(){Ext.EventManager.un(window,\"resize\",this.fireWindowResize,this);c.call(Ext.EventManager)},doResizeEvent:function(){var m=a.getViewHeight(),l=a.getViewWidth();if(h!=m||i!=l){d.fire(i=l,h=m)}},onWindowResize:function(n,m,l){if(!d){d=new Ext.util.Event();k=new Ext.util.DelayedTask(this.doResizeEvent);Ext.EventManager.on(window,\"resize\",this.fireWindowResize,this)}d.addListener(n,m,l)},fireWindowResize:function(){if(d){k.delay(100)}},onTextResize:function(o,n,l){if(!g){g=new Ext.util.Event();var m=new Ext.Element(document.createElement(\"div\"));m.dom.className=\"x-text-resize\";m.dom.innerHTML=\"X\";m.appendTo(document.body);b=m.dom.offsetHeight;setInterval(function(){if(m.dom.offsetHeight!=b){g.fire(b,b=m.dom.offsetHeight)}},this.textResizeInterval)}g.addListener(o,n,l)},removeResizeListener:function(m,l){if(d){d.removeListener(m,l)}},fireResize:function(){if(d){d.fire(a.getViewWidth(),a.getViewHeight())}},textResizeInterval:50,ieDeferSrc:false,getKeyEvent:function(){return e?\"keydown\":\"keypress\"},useKeydown:e}}());Ext.EventManager.on=Ext.EventManager.addListener;Ext.apply(Ext.EventObjectImpl.prototype,{BACKSPACE:8,TAB:9,NUM_CENTER:12,ENTER:13,RETURN:13,SHIFT:16,CTRL:17,CONTROL:17,ALT:18,PAUSE:19,CAPS_LOCK:20,ESC:27,SPACE:32,PAGE_UP:33,PAGEUP:33,PAGE_DOWN:34,PAGEDOWN:34,END:35,HOME:36,LEFT:37,UP:38,RIGHT:39,DOWN:40,PRINT_SCREEN:44,INSERT:45,DELETE:46,ZERO:48,ONE:49,TWO:50,THREE:51,FOUR:52,FIVE:53,SIX:54,SEVEN:55,EIGHT:56,NINE:57,A:65,B:66,C:67,D:68,E:69,F:70,G:71,H:72,I:73,J:74,K:75,L:76,M:77,N:78,O:79,P:80,Q:81,R:82,S:83,T:84,U:85,V:86,W:87,X:88,Y:89,Z:90,CONTEXT_MENU:93,NUM_ZERO:96,NUM_ONE:97,NUM_TWO:98,NUM_THREE:99,NUM_FOUR:100,NUM_FIVE:101,NUM_SIX:102,NUM_SEVEN:103,NUM_EIGHT:104,NUM_NINE:105,NUM_MULTIPLY:106,NUM_PLUS:107,NUM_MINUS:109,NUM_PERIOD:110,NUM_DIVISION:111,F1:112,F2:113,F3:114,F4:115,F5:116,F6:117,F7:118,F8:119,F9:120,F10:121,F11:122,F12:123,isNavKeyPress:function(){var b=this,a=this.normalizeKey(b.keyCode);return(a>=33&&a<=40)||a==b.RETURN||a==b.TAB||a==b.ESC},isSpecialKey:function(){var a=this.normalizeKey(this.keyCode);return(this.type==\"keypress\"&&this.ctrlKey)||this.isNavKeyPress()||(a==this.BACKSPACE)||(a>=16&&a<=20)||(a>=44&&a<=46)},getPoint:function(){return new Ext.lib.Point(this.xy[0],this.xy[1])},hasModifier:function(){return((this.ctrlKey||this.altKey)||this.shiftKey)}});Ext.Element.addMethods({swallowEvent:function(a,b){var d=this;function c(g){g.stopPropagation();if(b){g.preventDefault()}}if(Ext.isArray(a)){Ext.each(a,function(g){d.on(g,c)});return d}d.on(a,c);return d},relayEvent:function(a,b){this.on(a,function(c){b.fireEvent(a,c)})},clean:function(b){var d=this,e=d.dom,g=e.firstChild,c=-1;if(Ext.Element.data(e,\"isCleaned\")&&b!==true){return d}while(g){var a=g.nextSibling;if(g.nodeType==3&&!(/\\S/.test(g.nodeValue))){e.removeChild(g)}else{g.nodeIndex=++c}g=a}Ext.Element.data(e,\"isCleaned\",true);return d},load:function(){var a=this.getUpdater();a.update.apply(a,arguments);return this},getUpdater:function(){return this.updateManager||(this.updateManager=new Ext.Updater(this))},update:function(html,loadScripts,callback){if(!this.dom){return this}html=html||\"\";if(loadScripts!==true){this.dom.innerHTML=html;if(typeof callback==\"function\"){callback()}return this}var id=Ext.id(),dom=this.dom;html+='<span id=\"'+id+'\"></span>';Ext.lib.Event.onAvailable(id,function(){var DOC=document,hd=DOC.getElementsByTagName(\"head\")[0],re=/(?:<script([^>]*)?>)((\\n|\\r|.)*?)(?:<\\/script>)/ig,srcRe=/\\ssrc=([\\'\\\"])(.*?)\\1/i,typeRe=/\\stype=([\\'\\\"])(.*?)\\1/i,match,attrs,srcMatch,typeMatch,el,s;while((match=re.exec(html))){attrs=match[1];srcMatch=attrs?attrs.match(srcRe):false;if(srcMatch&&srcMatch[2]){s=DOC.createElement(\"script\");s.src=srcMatch[2];typeMatch=attrs.match(typeRe);if(typeMatch&&typeMatch[2]){s.type=typeMatch[2]}hd.appendChild(s)}else{if(match[2]&&match[2].length>0){if(window.execScript){window.execScript(match[2])}else{window.eval(match[2])}}}}el=DOC.getElementById(id);if(el){Ext.removeNode(el)}if(typeof callback==\"function\"){callback()}});dom.innerHTML=html.replace(/(?:<script.*?>)((\\n|\\r|.)*?)(?:<\\/script>)/ig,\"\");return this},removeAllListeners:function(){this.removeAnchor();Ext.EventManager.removeAll(this.dom);return this},createProxy:function(a,e,d){a=(typeof a==\"object\")?a:{tag:\"div\",cls:a};var c=this,b=e?Ext.DomHelper.append(e,a,true):Ext.DomHelper.insertBefore(c.dom,a,true);if(d&&c.setBox&&c.getBox){b.setBox(c.getBox())}return b}});Ext.Element.prototype.getUpdateManager=Ext.Element.prototype.getUpdater;Ext.Element.addMethods({getAnchorXY:function(e,l,q){e=(e||\"tl\").toLowerCase();q=q||{};var k=this,b=k.dom==document.body||k.dom==document,n=q.width||b?Ext.lib.Dom.getViewWidth():k.getWidth(),i=q.height||b?Ext.lib.Dom.getViewHeight():k.getHeight(),p,a=Math.round,c=k.getXY(),m=k.getScroll(),j=b?m.left:!l?c[0]:0,g=b?m.top:!l?c[1]:0,d={c:[a(n*0.5),a(i*0.5)],t:[a(n*0.5),0],l:[0,a(i*0.5)],r:[n,a(i*0.5)],b:[a(n*0.5),i],tl:[0,0],bl:[0,i],br:[n,i],tr:[n,0]};p=d[e];return[p[0]+j,p[1]+g]},anchorTo:function(b,h,c,a,k,l){var i=this,e=i.dom,j=!Ext.isEmpty(k),d=function(){Ext.fly(e).alignTo(b,h,c,a);Ext.callback(l,Ext.fly(e))},g=this.getAnchor();this.removeAnchor();Ext.apply(g,{fn:d,scroll:j});Ext.EventManager.onWindowResize(d,null);if(j){Ext.EventManager.on(window,\"scroll\",d,null,{buffer:!isNaN(k)?k:50})}d.call(i);return i},removeAnchor:function(){var b=this,a=this.getAnchor();if(a&&a.fn){Ext.EventManager.removeResizeListener(a.fn);if(a.scroll){Ext.EventManager.un(window,\"scroll\",a.fn)}delete a.fn}return b},getAnchor:function(){var b=Ext.Element.data,c=this.dom;if(!c){return}var a=b(c,\"_anchor\");if(!a){a=b(c,\"_anchor\",{})}return a},getAlignToXY:function(g,A,B){g=Ext.get(g);if(!g||!g.dom){throw\"Element.alignToXY with an element that doesn't exist\"}B=B||[0,0];A=(!A||A==\"?\"?\"tl-bl?\":(!(/-/).test(A)&&A!==\"\"?\"tl-\"+A:A||\"tl-bl\")).toLowerCase();var K=this,H=K.dom,M,L,n,l,s,F,v,t=Ext.lib.Dom.getViewWidth()-10,G=Ext.lib.Dom.getViewHeight()-10,b,i,j,k,u,z,N=document,J=N.documentElement,q=N.body,E=(J.scrollLeft||q.scrollLeft||0)+5,D=(J.scrollTop||q.scrollTop||0)+5,I=false,e=\"\",a=\"\",C=A.match(/^([a-z]+)-([a-z]+)(\\?)?$/);if(!C){throw\"Element.alignTo with an invalid alignment \"+A}e=C[1];a=C[2];I=!!C[3];M=K.getAnchorXY(e,true);L=g.getAnchorXY(a,false);n=L[0]-M[0]+B[0];l=L[1]-M[1]+B[1];if(I){s=K.getWidth();F=K.getHeight();v=g.getRegion();b=e.charAt(0);i=e.charAt(e.length-1);j=a.charAt(0);k=a.charAt(a.length-1);u=((b==\"t\"&&j==\"b\")||(b==\"b\"&&j==\"t\"));z=((i==\"r\"&&k==\"l\")||(i==\"l\"&&k==\"r\"));if(n+s>t+E){n=z?v.left-s:t+E-s}if(n<E){n=z?v.right:E}if(l+F>G+D){l=u?v.top-F:G+D-F}if(l<D){l=u?v.bottom:D}}return[n,l]},alignTo:function(c,a,e,b){var d=this;return d.setXY(d.getAlignToXY(c,a,e),d.preanim&&!!b?d.preanim(arguments,3):false)},adjustForConstraints:function(c,a,b){return this.getConstrainToXY(a||document,false,b,c)||c},getConstrainToXY:function(b,a,c,e){var d={top:0,left:0,bottom:0,right:0};return function(i,A,l,n){i=Ext.get(i);l=l?Ext.applyIf(l,d):d;var z,D,v=0,u=0;if(i.dom==document.body||i.dom==document){z=Ext.lib.Dom.getViewWidth();D=Ext.lib.Dom.getViewHeight()}else{z=i.dom.clientWidth;D=i.dom.clientHeight;if(!A){var t=i.getXY();v=t[0];u=t[1]}}var r=i.getScroll();v+=l.left+r.left;u+=l.top+r.top;z-=l.right;D-=l.bottom;var B=v+z,g=u+D,j=n||(!A?this.getXY():[this.getLeft(true),this.getTop(true)]),p=j[0],o=j[1],k=this.getConstrainOffset(),q=this.dom.offsetWidth+k,C=this.dom.offsetHeight+k;var m=false;if((p+q)>B){p=B-q;m=true}if((o+C)>g){o=g-C;m=true}if(p<v){p=v;m=true}if(o<u){o=u;m=true}return m?[p,o]:false}}(),getConstrainOffset:function(){return 0},getCenterXY:function(){return this.getAlignToXY(document,\"c-c\")},center:function(a){return this.alignTo(a||document,\"c-c\")}});Ext.Element.addMethods({select:function(a,b){return Ext.Element.select(a,b,this.dom)}});Ext.apply(Ext.Element.prototype,function(){var c=Ext.getDom,a=Ext.get,b=Ext.DomHelper;return{insertSibling:function(i,g,h){var j=this,e,d=(g||\"before\").toLowerCase()==\"after\",k;if(Ext.isArray(i)){k=j;Ext.each(i,function(l){e=Ext.fly(k,\"_internal\").insertSibling(l,g,h);if(d){k=e}});return e}i=i||{};if(i.nodeType||i.dom){e=j.dom.parentNode.insertBefore(c(i),d?j.dom.nextSibling:j.dom);if(!h){e=a(e)}}else{if(d&&!j.dom.nextSibling){e=b.append(j.dom.parentNode,i,!h)}else{e=b[d?\"insertAfter\":\"insertBefore\"](j.dom,i,!h)}}return e}}}());Ext.Element.boxMarkup='<div class=\"{0}-tl\"><div class=\"{0}-tr\"><div class=\"{0}-tc\"></div></div></div><div class=\"{0}-ml\"><div class=\"{0}-mr\"><div class=\"{0}-mc\"></div></div></div><div class=\"{0}-bl\"><div class=\"{0}-br\"><div class=\"{0}-bc\"></div></div></div>';Ext.Element.addMethods(function(){var a=\"_internal\",b=/(\\d+\\.?\\d+)px/;return{applyStyles:function(c){Ext.DomHelper.applyStyles(this.dom,c);return this},getStyles:function(){var c={};Ext.each(arguments,function(d){c[d]=this.getStyle(d)},this);return c},setOverflow:function(c){var d=this.dom;if(c==\"auto\"&&Ext.isMac&&Ext.isGecko2){d.style.overflow=\"hidden\";(function(){d.style.overflow=\"auto\"}).defer(1)}else{d.style.overflow=c}},boxWrap:function(c){c=c||\"x-box\";var d=Ext.get(this.insertHtml(\"beforeBegin\",\"<div class='\"+c+\"'>\"+String.format(Ext.Element.boxMarkup,c)+\"</div>\"));Ext.DomQuery.selectNode(\".\"+c+\"-mc\",d.dom).appendChild(this.dom);return d},setSize:function(e,c,d){var g=this;if(typeof e==\"object\"){c=e.height;e=e.width}e=g.adjustWidth(e);c=g.adjustHeight(c);if(!d||!g.anim){g.dom.style.width=g.addUnits(e);g.dom.style.height=g.addUnits(c)}else{g.anim({width:{to:e},height:{to:c}},g.preanim(arguments,2))}return g},getComputedHeight:function(){var d=this,c=Math.max(d.dom.offsetHeight,d.dom.clientHeight);if(!c){c=parseFloat(d.getStyle(\"height\"))||0;if(!d.isBorderBox()){c+=d.getFrameWidth(\"tb\")}}return c},getComputedWidth:function(){var c=Math.max(this.dom.offsetWidth,this.dom.clientWidth);if(!c){c=parseFloat(this.getStyle(\"width\"))||0;if(!this.isBorderBox()){c+=this.getFrameWidth(\"lr\")}}return c},getFrameWidth:function(d,c){return c&&this.isBorderBox()?0:(this.getPadding(d)+this.getBorderWidth(d))},addClassOnOver:function(c){this.hover(function(){Ext.fly(this,a).addClass(c)},function(){Ext.fly(this,a).removeClass(c)});return this},addClassOnFocus:function(c){this.on(\"focus\",function(){Ext.fly(this,a).addClass(c)},this.dom);this.on(\"blur\",function(){Ext.fly(this,a).removeClass(c)},this.dom);return this},addClassOnClick:function(c){var d=this.dom;this.on(\"mousedown\",function(){Ext.fly(d,a).addClass(c);var g=Ext.getDoc(),e=function(){Ext.fly(d,a).removeClass(c);g.removeListener(\"mouseup\",e)};g.on(\"mouseup\",e)});return this},getViewSize:function(){var g=document,h=this.dom,c=(h==g||h==g.body);if(c){var e=Ext.lib.Dom;return{width:e.getViewWidth(),height:e.getViewHeight()}}else{return{width:h.clientWidth,height:h.clientHeight}}},getStyleSize:function(){var j=this,c,i,l=document,m=this.dom,e=(m==l||m==l.body),g=m.style;if(e){var k=Ext.lib.Dom;return{width:k.getViewWidth(),height:k.getViewHeight()}}if(g.width&&g.width!=\"auto\"){c=parseFloat(g.width);if(j.isBorderBox()){c-=j.getFrameWidth(\"lr\")}}if(g.height&&g.height!=\"auto\"){i=parseFloat(g.height);if(j.isBorderBox()){i-=j.getFrameWidth(\"tb\")}}return{width:c||j.getWidth(true),height:i||j.getHeight(true)}},getSize:function(c){return{width:this.getWidth(c),height:this.getHeight(c)}},repaint:function(){var c=this.dom;this.addClass(\"x-repaint\");setTimeout(function(){Ext.fly(c).removeClass(\"x-repaint\")},1);return this},unselectable:function(){this.dom.unselectable=\"on\";return this.swallowEvent(\"selectstart\",true).addClass(\"x-unselectable\")},getMargins:function(d){var e=this,c,g={t:\"top\",l:\"left\",r:\"right\",b:\"bottom\"},h={};if(!d){for(c in e.margins){h[g[c]]=parseFloat(e.getStyle(e.margins[c]))||0}return h}else{return e.addStyles.call(e,d,e.margins)}}}}());Ext.Element.addMethods({setBox:function(e,g,b){var d=this,a=e.width,c=e.height;if((g&&!d.autoBoxAdjust)&&!d.isBorderBox()){a-=(d.getBorderWidth(\"lr\")+d.getPadding(\"lr\"));c-=(d.getBorderWidth(\"tb\")+d.getPadding(\"tb\"))}d.setBounds(e.x,e.y,a,c,d.animTest.call(d,arguments,b,2));return d},getBox:function(j,p){var m=this,v,e,o,d=m.getBorderWidth,q=m.getPadding,g,a,u,n;if(!p){v=m.getXY()}else{e=parseInt(m.getStyle(\"left\"),10)||0;o=parseInt(m.getStyle(\"top\"),10)||0;v=[e,o]}var c=m.dom,s=c.offsetWidth,i=c.offsetHeight,k;if(!j){k={x:v[0],y:v[1],0:v[0],1:v[1],width:s,height:i}}else{g=d.call(m,\"l\")+q.call(m,\"l\");a=d.call(m,\"r\")+q.call(m,\"r\");u=d.call(m,\"t\")+q.call(m,\"t\");n=d.call(m,\"b\")+q.call(m,\"b\");k={x:v[0]+g,y:v[1]+u,0:v[0]+g,1:v[1]+u,width:s-(g+a),height:i-(u+n)}}k.right=k.x+k.width;k.bottom=k.y+k.height;return k},move:function(j,b,c){var g=this,m=g.getXY(),k=m[0],i=m[1],d=[k-b,i],l=[k+b,i],h=[k,i-b],a=[k,i+b],e={l:d,left:d,r:l,right:l,t:h,top:h,up:h,b:a,bottom:a,down:a};j=j.toLowerCase();g.moveTo(e[j][0],e[j][1],g.animTest.call(g,arguments,c,2))},setLeftTop:function(d,c){var b=this,a=b.dom.style;a.left=b.addUnits(d);a.top=b.addUnits(c);return b},getRegion:function(){return Ext.lib.Dom.getRegion(this.dom)},setBounds:function(b,g,d,a,c){var e=this;if(!c||!e.anim){e.setSize(d,a);e.setLocation(b,g)}else{e.anim({points:{to:[b,g]},width:{to:e.adjustWidth(d)},height:{to:e.adjustHeight(a)}},e.preanim(arguments,4),\"motion\")}return e},setRegion:function(b,a){return this.setBounds(b.left,b.top,b.right-b.left,b.bottom-b.top,this.animTest.call(this,arguments,a,1))}});Ext.Element.addMethods({scrollTo:function(b,d,a){var e=/top/i.test(b),c=this,g=c.dom,h;if(!a||!c.anim){h=\"scroll\"+(e?\"Top\":\"Left\");g[h]=d}else{h=\"scroll\"+(e?\"Left\":\"Top\");c.anim({scroll:{to:e?[g[h],d]:[d,g[h]]}},c.preanim(arguments,2),\"scroll\")}return c},scrollIntoView:function(e,i){var p=Ext.getDom(e)||Ext.getBody().dom,h=this.dom,g=this.getOffsetsTo(p),k=g[0]+p.scrollLeft,u=g[1]+p.scrollTop,q=u+h.offsetHeight,d=k+h.offsetWidth,a=p.clientHeight,m=parseInt(p.scrollTop,10),s=parseInt(p.scrollLeft,10),j=m+a,n=s+p.clientWidth;if(h.offsetHeight>a||u<m){p.scrollTop=u}else{if(q>j){p.scrollTop=q-a}}p.scrollTop=p.scrollTop;if(i!==false){if(h.offsetWidth>p.clientWidth||k<s){p.scrollLeft=k}else{if(d>n){p.scrollLeft=d-p.clientWidth}}p.scrollLeft=p.scrollLeft}return this},scrollChildIntoView:function(b,a){Ext.fly(b,\"_scrollChildIntoView\").scrollIntoView(this,a)},scroll:function(m,b,d){if(!this.isScrollable()){return false}var e=this.dom,g=e.scrollLeft,p=e.scrollTop,n=e.scrollWidth,k=e.scrollHeight,i=e.clientWidth,a=e.clientHeight,c=false,o,j={l:Math.min(g+b,n-i),r:o=Math.max(g-b,0),t:Math.max(p-b,0),b:Math.min(p+b,k-a)};j.d=j.b;j.u=j.t;m=m.substr(0,1);if((o=j[m])>-1){c=true;this.scrollTo(m==\"l\"||m==\"r\"?\"left\":\"top\",o,this.preanim(arguments,2))}return c}});Ext.Element.addMethods(function(){var d=\"visibility\",b=\"display\",a=\"hidden\",h=\"none\",c=\"x-masked\",g=\"x-masked-relative\",e=Ext.Element.data;return{isVisible:function(i){var j=!this.isStyle(d,a)&&!this.isStyle(b,h),k=this.dom.parentNode;if(i!==true||!j){return j}while(k&&!(/^body/i.test(k.tagName))){if(!Ext.fly(k,\"_isVisible\").isVisible()){return false}k=k.parentNode}return true},isDisplayed:function(){return !this.isStyle(b,h)},enableDisplayMode:function(i){this.setVisibilityMode(Ext.Element.DISPLAY);if(!Ext.isEmpty(i)){e(this.dom,\"originalDisplay\",i)}return this},mask:function(j,n){var p=this,l=p.dom,o=Ext.DomHelper,m=\"ext-el-mask-msg\",i,q;if(!/^body/i.test(l.tagName)&&p.getStyle(\"position\")==\"static\"){p.addClass(g)}if(i=e(l,\"maskMsg\")){i.remove()}if(i=e(l,\"mask\")){i.remove()}q=o.append(l,{cls:\"ext-el-mask\"},true);e(l,\"mask\",q);p.addClass(c);q.setDisplayed(true);if(typeof j==\"string\"){var k=o.append(l,{cls:m,cn:{tag:\"div\"}},true);e(l,\"maskMsg\",k);k.dom.className=n?m+\" \"+n:m;k.dom.firstChild.innerHTML=j;k.setDisplayed(true);k.center(p)}if(Ext.isIE&&!(Ext.isIE7&&Ext.isStrict)&&p.getStyle(\"height\")==\"auto\"){q.setSize(undefined,p.getHeight())}return q},unmask:function(){var k=this,l=k.dom,i=e(l,\"mask\"),j=e(l,\"maskMsg\");if(i){if(j){j.remove();e(l,\"maskMsg\",undefined)}i.remove();e(l,\"mask\",undefined);k.removeClass([c,g])}},isMasked:function(){var i=e(this.dom,\"mask\");return i&&i.isVisible()},createShim:function(){var i=document.createElement(\"iframe\"),j;i.frameBorder=\"0\";i.className=\"ext-shim\";i.src=Ext.SSL_SECURE_URL;j=Ext.get(this.dom.parentNode.insertBefore(i,this.dom));j.autoBoxAdjust=false;return j}}}());Ext.Element.addMethods({addKeyListener:function(b,d,c){var a;if(typeof b!=\"object\"||Ext.isArray(b)){a={key:b,fn:d,scope:c}}else{a={key:b.key,shift:b.shift,ctrl:b.ctrl,alt:b.alt,fn:d,scope:c}}return new Ext.KeyMap(this,a)},addKeyMap:function(a){return new Ext.KeyMap(this,a)}});Ext.CompositeElementLite.importElementMethods();Ext.apply(Ext.CompositeElementLite.prototype,{addElements:function(c,a){if(!c){return this}if(typeof c==\"string\"){c=Ext.Element.selectorFunction(c,a)}var b=this.elements;Ext.each(c,function(d){b.push(Ext.get(d))});return this},first:function(){return this.item(0)},last:function(){return this.item(this.getCount()-1)},contains:function(a){return this.indexOf(a)!=-1},removeElement:function(d,e){var c=this,a=this.elements,b;Ext.each(d,function(g){if((b=(a[g]||a[g=c.indexOf(g)]))){if(e){if(b.dom){b.remove()}else{Ext.removeNode(b)}}a.splice(g,1)}});return this}});Ext.CompositeElement=Ext.extend(Ext.CompositeElementLite,{constructor:function(b,a){this.elements=[];this.add(b,a)},getElement:function(a){return a},transformElement:function(a){return Ext.get(a)}});Ext.Element.select=function(a,d,b){var c;if(typeof a==\"string\"){c=Ext.Element.selectorFunction(a,b)}else{if(a.length!==undefined){c=a}else{throw\"Invalid selector\"}}return(d===true)?new Ext.CompositeElement(c):new Ext.CompositeElementLite(c)};Ext.select=Ext.Element.select;Ext.UpdateManager=Ext.Updater=Ext.extend(Ext.util.Observable,function(){var b=\"beforeupdate\",d=\"update\",c=\"failure\";function a(h){var i=this;i.transaction=null;if(h.argument.form&&h.argument.reset){try{h.argument.form.reset()}catch(j){}}if(i.loadScripts){i.renderer.render(i.el,h,i,g.createDelegate(i,[h]))}else{i.renderer.render(i.el,h,i);g.call(i,h)}}function g(h,i,j){this.fireEvent(i||d,this.el,h);if(Ext.isFunction(h.argument.callback)){h.argument.callback.call(h.argument.scope,this.el,Ext.isEmpty(j)?true:false,h,h.argument.options)}}function e(h){g.call(this,h,c,!!(this.transaction=null))}return{constructor:function(i,h){var j=this;i=Ext.get(i);if(!h&&i.updateManager){return i.updateManager}j.el=i;j.defaultUrl=null;j.addEvents(b,d,c);Ext.apply(j,Ext.Updater.defaults);j.transaction=null;j.refreshDelegate=j.refresh.createDelegate(j);j.updateDelegate=j.update.createDelegate(j);j.formUpdateDelegate=(j.formUpdate||function(){}).createDelegate(j);j.renderer=j.renderer||j.getDefaultRenderer();Ext.Updater.superclass.constructor.call(j)},setRenderer:function(h){this.renderer=h},getRenderer:function(){return this.renderer},getDefaultRenderer:function(){return new Ext.Updater.BasicRenderer()},setDefaultUrl:function(h){this.defaultUrl=h},getEl:function(){return this.el},update:function(i,n,p,l){var k=this,h,j;if(k.fireEvent(b,k.el,i,n)!==false){if(Ext.isObject(i)){h=i;i=h.url;n=n||h.params;p=p||h.callback;l=l||h.discardUrl;j=h.scope;if(!Ext.isEmpty(h.nocache)){k.disableCaching=h.nocache}if(!Ext.isEmpty(h.text)){k.indicatorText='<div class=\"loading-indicator\">'+h.text+\"</div>\"}if(!Ext.isEmpty(h.scripts)){k.loadScripts=h.scripts}if(!Ext.isEmpty(h.timeout)){k.timeout=h.timeout}}k.showLoading();if(!l){k.defaultUrl=i}if(Ext.isFunction(i)){i=i.call(k)}var m=Ext.apply({},{url:i,params:(Ext.isFunction(n)&&j)?n.createDelegate(j):n,success:a,failure:e,scope:k,callback:undefined,timeout:(k.timeout*1000),disableCaching:k.disableCaching,argument:{options:h,url:i,form:null,callback:p,scope:j||window,params:n}},h);k.transaction=Ext.Ajax.request(m)}},formUpdate:function(k,h,j,l){var i=this;if(i.fireEvent(b,i.el,k,h)!==false){if(Ext.isFunction(h)){h=h.call(i)}k=Ext.getDom(k);i.transaction=Ext.Ajax.request({form:k,url:h,success:a,failure:e,scope:i,timeout:(i.timeout*1000),argument:{url:h,form:k,callback:l,reset:j}});i.showLoading.defer(1,i)}},startAutoRefresh:function(i,j,l,m,h){var k=this;if(h){k.update(j||k.defaultUrl,l,m,true)}if(k.autoRefreshProcId){clearInterval(k.autoRefreshProcId)}k.autoRefreshProcId=setInterval(k.update.createDelegate(k,[j||k.defaultUrl,l,m,true]),i*1000)},stopAutoRefresh:function(){if(this.autoRefreshProcId){clearInterval(this.autoRefreshProcId);delete this.autoRefreshProcId}},isAutoRefreshing:function(){return !!this.autoRefreshProcId},showLoading:function(){if(this.showLoadIndicator){this.el.dom.innerHTML=this.indicatorText}},abort:function(){if(this.transaction){Ext.Ajax.abort(this.transaction)}},isUpdating:function(){return this.transaction?Ext.Ajax.isLoading(this.transaction):false},refresh:function(h){if(this.defaultUrl){this.update(this.defaultUrl,null,h,true)}}}}());Ext.Updater.defaults={timeout:30,disableCaching:false,showLoadIndicator:true,indicatorText:'<div class=\"loading-indicator\">Loading...</div>',loadScripts:false,sslBlankUrl:Ext.SSL_SECURE_URL};Ext.Updater.updateElement=function(d,c,e,b){var a=Ext.get(d).getUpdater();Ext.apply(a,b);a.update(c,e,b?b.callback:null)};Ext.Updater.BasicRenderer=function(){};Ext.Updater.BasicRenderer.prototype={render:function(c,a,b,d){c.update(a.responseText,b.loadScripts,d)}};(function(){Date.useStrict=false;function b(d){var c=Array.prototype.slice.call(arguments,1);return d.replace(/\\{(\\d+)\\}/g,function(e,g){return c[g]})}Date.formatCodeToRegex=function(d,c){var e=Date.parseCodes[d];if(e){e=typeof e==\"function\"?e():e;Date.parseCodes[d]=e}return e?Ext.applyIf({c:e.c?b(e.c,c||\"{0}\"):e.c},e):{g:0,c:null,s:Ext.escapeRe(d)}};var a=Date.formatCodeToRegex;Ext.apply(Date,{parseFunctions:{\"M$\":function(d,c){var e=new RegExp(\"\\\\/Date\\\\(([-+])?(\\\\d+)(?:[+-]\\\\d{4})?\\\\)\\\\/\");var g=(d||\"\").match(e);return g?new Date(((g[1]||\"\")+g[2])*1):null}},parseRegexes:[],formatFunctions:{\"M$\":function(){return\"\\\\/Date(\"+this.getTime()+\")\\\\/\"}},y2kYear:50,MILLI:\"ms\",SECOND:\"s\",MINUTE:\"mi\",HOUR:\"h\",DAY:\"d\",MONTH:\"mo\",YEAR:\"y\",defaults:{},dayNames:[\"Sunday\",\"Monday\",\"Tuesday\",\"Wednesday\",\"Thursday\",\"Friday\",\"Saturday\"],monthNames:[\"January\",\"February\",\"March\",\"April\",\"May\",\"June\",\"July\",\"August\",\"September\",\"October\",\"November\",\"December\"],monthNumbers:{Jan:0,Feb:1,Mar:2,Apr:3,May:4,Jun:5,Jul:6,Aug:7,Sep:8,Oct:9,Nov:10,Dec:11},getShortMonthName:function(c){return Date.monthNames[c].substring(0,3)},getShortDayName:function(c){return Date.dayNames[c].substring(0,3)},getMonthNumber:function(c){return Date.monthNumbers[c.substring(0,1).toUpperCase()+c.substring(1,3).toLowerCase()]},formatContainsHourInfo:(function(){var d=/(\\\\.)/g,c=/([gGhHisucUOPZ]|M\\$)/;return function(e){return c.test(e.replace(d,\"\"))}})(),formatCodes:{d:\"String.leftPad(this.getDate(), 2, '0')\",D:\"Date.getShortDayName(this.getDay())\",j:\"this.getDate()\",l:\"Date.dayNames[this.getDay()]\",N:\"(this.getDay() ? this.getDay() : 7)\",S:\"this.getSuffix()\",w:\"this.getDay()\",z:\"this.getDayOfYear()\",W:\"String.leftPad(this.getWeekOfYear(), 2, '0')\",F:\"Date.monthNames[this.getMonth()]\",m:\"String.leftPad(this.getMonth() + 1, 2, '0')\",M:\"Date.getShortMonthName(this.getMonth())\",n:\"(this.getMonth() + 1)\",t:\"this.getDaysInMonth()\",L:\"(this.isLeapYear() ? 1 : 0)\",o:\"(this.getFullYear() + (this.getWeekOfYear() == 1 && this.getMonth() > 0 ? +1 : (this.getWeekOfYear() >= 52 && this.getMonth() < 11 ? -1 : 0)))\",Y:\"String.leftPad(this.getFullYear(), 4, '0')\",y:\"('' + this.getFullYear()).substring(2, 4)\",a:\"(this.getHours() < 12 ? 'am' : 'pm')\",A:\"(this.getHours() < 12 ? 'AM' : 'PM')\",g:\"((this.getHours() % 12) ? this.getHours() % 12 : 12)\",G:\"this.getHours()\",h:\"String.leftPad((this.getHours() % 12) ? this.getHours() % 12 : 12, 2, '0')\",H:\"String.leftPad(this.getHours(), 2, '0')\",i:\"String.leftPad(this.getMinutes(), 2, '0')\",s:\"String.leftPad(this.getSeconds(), 2, '0')\",u:\"String.leftPad(this.getMilliseconds(), 3, '0')\",O:\"this.getGMTOffset()\",P:\"this.getGMTOffset(true)\",T:\"this.getTimezone()\",Z:\"(this.getTimezoneOffset() * -60)\",c:function(){for(var k=\"Y-m-dTH:i:sP\",h=[],g=0,d=k.length;g<d;++g){var j=k.charAt(g);h.push(j==\"T\"?\"'T'\":Date.getFormatCode(j))}return h.join(\" + \")},U:\"Math.round(this.getTime() / 1000)\"},isValid:function(o,c,n,k,g,j,e){k=k||0;g=g||0;j=j||0;e=e||0;var l=new Date(o<100?100:o,c-1,n,k,g,j,e).add(Date.YEAR,o<100?o-100:0);return o==l.getFullYear()&&c==l.getMonth()+1&&n==l.getDate()&&k==l.getHours()&&g==l.getMinutes()&&j==l.getSeconds()&&e==l.getMilliseconds()},parseDate:function(d,g,c){var e=Date.parseFunctions;if(e[g]==null){Date.createParser(g)}return e[g](d,Ext.isDefined(c)?c:Date.useStrict)},getFormatCode:function(d){var c=Date.formatCodes[d];if(c){c=typeof c==\"function\"?c():c;Date.formatCodes[d]=c}return c||(\"'\"+String.escape(d)+\"'\")},createFormat:function(h){var g=[],c=false,e=\"\";for(var d=0;d<h.length;++d){e=h.charAt(d);if(!c&&e==\"\\\\\"){c=true}else{if(c){c=false;g.push(\"'\"+String.escape(e)+\"'\")}else{g.push(Date.getFormatCode(e))}}}Date.formatFunctions[h]=new Function(\"return \"+g.join(\"+\"))},createParser:function(){var c=[\"var dt, y, m, d, h, i, s, ms, o, z, zz, u, v,\",\"def = Date.defaults,\",\"results = String(input).match(Date.parseRegexes[{0}]);\",\"if(results){\",\"{1}\",\"if(u != null){\",\"v = new Date(u * 1000);\",\"}else{\",\"dt = (new Date()).clearTime();\",\"y = Ext.num(y, Ext.num(def.y, dt.getFullYear()));\",\"m = Ext.num(m, Ext.num(def.m - 1, dt.getMonth()));\",\"d = Ext.num(d, Ext.num(def.d, dt.getDate()));\",\"h  = Ext.num(h, Ext.num(def.h, dt.getHours()));\",\"i  = Ext.num(i, Ext.num(def.i, dt.getMinutes()));\",\"s  = Ext.num(s, Ext.num(def.s, dt.getSeconds()));\",\"ms = Ext.num(ms, Ext.num(def.ms, dt.getMilliseconds()));\",\"if(z >= 0 && y >= 0){\",\"v = new Date(y < 100 ? 100 : y, 0, 1, h, i, s, ms).add(Date.YEAR, y < 100 ? y - 100 : 0);\",\"v = !strict? v : (strict === true && (z <= 364 || (v.isLeapYear() && z <= 365))? v.add(Date.DAY, z) : null);\",\"}else if(strict === true && !Date.isValid(y, m + 1, d, h, i, s, ms)){\",\"v = null;\",\"}else{\",\"v = new Date(y < 100 ? 100 : y, m, d, h, i, s, ms).add(Date.YEAR, y < 100 ? y - 100 : 0);\",\"}\",\"}\",\"}\",\"if(v){\",\"if(zz != null){\",\"v = v.add(Date.SECOND, -v.getTimezoneOffset() * 60 - zz);\",\"}else if(o){\",\"v = v.add(Date.MINUTE, -v.getTimezoneOffset() + (sn == '+'? -1 : 1) * (hr * 60 + mn));\",\"}\",\"}\",\"return v;\"].join(\"\\n\");return function(m){var e=Date.parseRegexes.length,o=1,g=[],l=[],k=false,d=\"\",j=0,h,n;for(;j<m.length;++j){d=m.charAt(j);if(!k&&d==\"\\\\\"){k=true}else{if(k){k=false;l.push(String.escape(d))}else{h=a(d,o);o+=h.g;l.push(h.s);if(h.g&&h.c){if(h.calcLast){n=h.c}else{g.push(h.c)}}}}}if(n){g.push(n)}Date.parseRegexes[e]=new RegExp(\"^\"+l.join(\"\")+\"$\",\"i\");Date.parseFunctions[m]=new Function(\"input\",\"strict\",b(c,e,g.join(\"\")))}}(),parseCodes:{d:{g:1,c:\"d = parseInt(results[{0}], 10);\\n\",s:\"(\\\\d{2})\"},j:{g:1,c:\"d = parseInt(results[{0}], 10);\\n\",s:\"(\\\\d{1,2})\"},D:function(){for(var c=[],d=0;d<7;c.push(Date.getShortDayName(d)),++d){}return{g:0,c:null,s:\"(?:\"+c.join(\"|\")+\")\"}},l:function(){return{g:0,c:null,s:\"(?:\"+Date.dayNames.join(\"|\")+\")\"}},N:{g:0,c:null,s:\"[1-7]\"},S:{g:0,c:null,s:\"(?:st|nd|rd|th)\"},w:{g:0,c:null,s:\"[0-6]\"},z:{g:1,c:\"z = parseInt(results[{0}], 10);\\n\",s:\"(\\\\d{1,3})\"},W:{g:0,c:null,s:\"(?:\\\\d{2})\"},F:function(){return{g:1,c:\"m = parseInt(Date.getMonthNumber(results[{0}]), 10);\\n\",s:\"(\"+Date.monthNames.join(\"|\")+\")\"}},M:function(){for(var c=[],d=0;d<12;c.push(Date.getShortMonthName(d)),++d){}return Ext.applyIf({s:\"(\"+c.join(\"|\")+\")\"},a(\"F\"))},m:{g:1,c:\"m = parseInt(results[{0}], 10) - 1;\\n\",s:\"(\\\\d{2})\"},n:{g:1,c:\"m = parseInt(results[{0}], 10) - 1;\\n\",s:\"(\\\\d{1,2})\"},t:{g:0,c:null,s:\"(?:\\\\d{2})\"},L:{g:0,c:null,s:\"(?:1|0)\"},o:function(){return a(\"Y\")},Y:{g:1,c:\"y = parseInt(results[{0}], 10);\\n\",s:\"(\\\\d{4})\"},y:{g:1,c:\"var ty = parseInt(results[{0}], 10);\\ny = ty > Date.y2kYear ? 1900 + ty : 2000 + ty;\\n\",s:\"(\\\\d{1,2})\"},a:function(){return a(\"A\")},A:{calcLast:true,g:1,c:\"if (/(am)/i.test(results[{0}])) {\\nif (!h || h == 12) { h = 0; }\\n} else { if (!h || h < 12) { h = (h || 0) + 12; }}\",s:\"(AM|PM|am|pm)\"},g:function(){return a(\"G\")},G:{g:1,c:\"h = parseInt(results[{0}], 10);\\n\",s:\"(\\\\d{1,2})\"},h:function(){return a(\"H\")},H:{g:1,c:\"h = parseInt(results[{0}], 10);\\n\",s:\"(\\\\d{2})\"},i:{g:1,c:\"i = parseInt(results[{0}], 10);\\n\",s:\"(\\\\d{2})\"},s:{g:1,c:\"s = parseInt(results[{0}], 10);\\n\",s:\"(\\\\d{2})\"},u:{g:1,c:\"ms = results[{0}]; ms = parseInt(ms, 10)/Math.pow(10, ms.length - 3);\\n\",s:\"(\\\\d+)\"},O:{g:1,c:[\"o = results[{0}];\",\"var sn = o.substring(0,1),\",\"hr = o.substring(1,3)*1 + Math.floor(o.substring(3,5) / 60),\",\"mn = o.substring(3,5) % 60;\",\"o = ((-12 <= (hr*60 + mn)/60) && ((hr*60 + mn)/60 <= 14))? (sn + String.leftPad(hr, 2, '0') + String.leftPad(mn, 2, '0')) : null;\\n\"].join(\"\\n\"),s:\"([+-]\\\\d{4})\"},P:{g:1,c:[\"o = results[{0}];\",\"var sn = o.substring(0,1),\",\"hr = o.substring(1,3)*1 + Math.floor(o.substring(4,6) / 60),\",\"mn = o.substring(4,6) % 60;\",\"o = ((-12 <= (hr*60 + mn)/60) && ((hr*60 + mn)/60 <= 14))? (sn + String.leftPad(hr, 2, '0') + String.leftPad(mn, 2, '0')) : null;\\n\"].join(\"\\n\"),s:\"([+-]\\\\d{2}:\\\\d{2})\"},T:{g:0,c:null,s:\"[A-Z]{1,4}\"},Z:{g:1,c:\"zz = results[{0}] * 1;\\nzz = (-43200 <= zz && zz <= 50400)? zz : null;\\n\",s:\"([+-]?\\\\d{1,5})\"},c:function(){var e=[],c=[a(\"Y\",1),a(\"m\",2),a(\"d\",3),a(\"h\",4),a(\"i\",5),a(\"s\",6),{c:\"ms = results[7] || '0'; ms = parseInt(ms, 10)/Math.pow(10, ms.length - 3);\\n\"},{c:[\"if(results[8]) {\",\"if(results[8] == 'Z'){\",\"zz = 0;\",\"}else if (results[8].indexOf(':') > -1){\",a(\"P\",8).c,\"}else{\",a(\"O\",8).c,\"}\",\"}\"].join(\"\\n\")}];for(var g=0,d=c.length;g<d;++g){e.push(c[g].c)}return{g:1,c:e.join(\"\"),s:[c[0].s,\"(?:\",\"-\",c[1].s,\"(?:\",\"-\",c[2].s,\"(?:\",\"(?:T| )?\",c[3].s,\":\",c[4].s,\"(?::\",c[5].s,\")?\",\"(?:(?:\\\\.|,)(\\\\d+))?\",\"(Z|(?:[-+]\\\\d{2}(?::)?\\\\d{2}))?\",\")?\",\")?\",\")?\"].join(\"\")}},U:{g:1,c:\"u = parseInt(results[{0}], 10);\\n\",s:\"(-?\\\\d+)\"}}})}());Ext.apply(Date.prototype,{dateFormat:function(a){if(Date.formatFunctions[a]==null){Date.createFormat(a)}return Date.formatFunctions[a].call(this)},getTimezone:function(){return this.toString().replace(/^.* (?:\\((.*)\\)|([A-Z]{1,4})(?:[\\-+][0-9]{4})?(?: -?\\d+)?)$/,\"$1$2\").replace(/[^A-Z]/g,\"\")},getGMTOffset:function(a){return(this.getTimezoneOffset()>0?\"-\":\"+\")+String.leftPad(Math.floor(Math.abs(this.getTimezoneOffset())/60),2,\"0\")+(a?\":\":\"\")+String.leftPad(Math.abs(this.getTimezoneOffset()%60),2,\"0\")},getDayOfYear:function(){var b=0,e=this.clone(),a=this.getMonth(),c;for(c=0,e.setDate(1),e.setMonth(0);c<a;e.setMonth(++c)){b+=e.getDaysInMonth()}return b+this.getDate()-1},getWeekOfYear:function(){var a=86400000,b=7*a;return function(){var d=Date.UTC(this.getFullYear(),this.getMonth(),this.getDate()+3)/a,c=Math.floor(d/7),e=new Date(c*b).getUTCFullYear();return c-Math.floor(Date.UTC(e,0,7)/b)+1}}(),isLeapYear:function(){var a=this.getFullYear();return !!((a&3)==0&&(a%100||(a%400==0&&a)))},getFirstDayOfMonth:function(){var a=(this.getDay()-(this.getDate()-1))%7;return(a<0)?(a+7):a},getLastDayOfMonth:function(){return this.getLastDateOfMonth().getDay()},getFirstDateOfMonth:function(){return new Date(this.getFullYear(),this.getMonth(),1)},getLastDateOfMonth:function(){return new Date(this.getFullYear(),this.getMonth(),this.getDaysInMonth())},getDaysInMonth:function(){var a=[31,28,31,30,31,30,31,31,30,31,30,31];return function(){var b=this.getMonth();return b==1&&this.isLeapYear()?29:a[b]}}(),getSuffix:function(){switch(this.getDate()){case 1:case 21:case 31:return\"st\";case 2:case 22:return\"nd\";case 3:case 23:return\"rd\";default:return\"th\"}},clone:function(){return new Date(this.getTime())},isDST:function(){return new Date(this.getFullYear(),0,1).getTimezoneOffset()!=this.getTimezoneOffset()},clearTime:function(g){if(g){return this.clone().clearTime()}var b=this.getDate();this.setHours(0);this.setMinutes(0);this.setSeconds(0);this.setMilliseconds(0);if(this.getDate()!=b){for(var a=1,e=this.add(Date.HOUR,a);e.getDate()!=b;a++,e=this.add(Date.HOUR,a)){}this.setDate(b);this.setHours(e.getHours())}return this},add:function(b,c){var e=this.clone();if(!b||c===0){return e}switch(b.toLowerCase()){case Date.MILLI:e.setMilliseconds(this.getMilliseconds()+c);break;case Date.SECOND:e.setSeconds(this.getSeconds()+c);break;case Date.MINUTE:e.setMinutes(this.getMinutes()+c);break;case Date.HOUR:e.setHours(this.getHours()+c);break;case Date.DAY:e.setDate(this.getDate()+c);break;case Date.MONTH:var a=this.getDate();if(a>28){a=Math.min(a,this.getFirstDateOfMonth().add(\"mo\",c).getLastDateOfMonth().getDate())}e.setDate(a);e.setMonth(this.getMonth()+c);break;case Date.YEAR:e.setFullYear(this.getFullYear()+c);break}return e},between:function(c,a){var b=this.getTime();return c.getTime()<=b&&b<=a.getTime()}});Date.prototype.format=Date.prototype.dateFormat;if(Ext.isSafari&&(navigator.userAgent.match(/WebKit\\/(\\d+)/)[1]||NaN)<420){Ext.apply(Date.prototype,{_xMonth:Date.prototype.setMonth,_xDate:Date.prototype.setDate,setMonth:function(a){if(a<=-1){var d=Math.ceil(-a),c=Math.ceil(d/12),b=(d%12)?12-d%12:0;this.setFullYear(this.getFullYear()-c);return this._xMonth(b)}else{return this._xMonth(a)}},setDate:function(a){return this.setTime(this.getTime()-(this.getDate()-a)*86400000)}})}Ext.util.MixedCollection=function(b,a){this.items=[];this.map={};this.keys=[];this.length=0;this.addEvents(\"clear\",\"add\",\"replace\",\"remove\",\"sort\");this.allowFunctions=b===true;if(a){this.getKey=a}Ext.util.MixedCollection.superclass.constructor.call(this)};Ext.extend(Ext.util.MixedCollection,Ext.util.Observable,{allowFunctions:false,add:function(b,c){if(arguments.length==1){c=arguments[0];b=this.getKey(c)}if(typeof b!=\"undefined\"&&b!==null){var a=this.map[b];if(typeof a!=\"undefined\"){return this.replace(b,c)}this.map[b]=c}this.length++;this.items.push(c);this.keys.push(b);this.fireEvent(\"add\",this.length-1,c,b);return c},getKey:function(a){return a.id},replace:function(c,d){if(arguments.length==1){d=arguments[0];c=this.getKey(d)}var a=this.map[c];if(typeof c==\"undefined\"||c===null||typeof a==\"undefined\"){return this.add(c,d)}var b=this.indexOfKey(c);this.items[b]=d;this.map[c]=d;this.fireEvent(\"replace\",c,a,d);return d},addAll:function(e){if(arguments.length>1||Ext.isArray(e)){var b=arguments.length>1?arguments:e;for(var d=0,a=b.length;d<a;d++){this.add(b[d])}}else{for(var c in e){if(this.allowFunctions||typeof e[c]!=\"function\"){this.add(c,e[c])}}}},each:function(e,d){var b=[].concat(this.items);for(var c=0,a=b.length;c<a;c++){if(e.call(d||b[c],b[c],c,a)===false){break}}},eachKey:function(d,c){for(var b=0,a=this.keys.length;b<a;b++){d.call(c||window,this.keys[b],this.items[b],b,a)}},find:function(d,c){for(var b=0,a=this.items.length;b<a;b++){if(d.call(c||window,this.items[b],this.keys[b])){return this.items[b]}}return null},insert:function(a,b,c){if(arguments.length==2){c=arguments[1];b=this.getKey(c)}if(this.containsKey(b)){this.suspendEvents();this.removeKey(b);this.resumeEvents()}if(a>=this.length){return this.add(b,c)}this.length++;this.items.splice(a,0,c);if(typeof b!=\"undefined\"&&b!==null){this.map[b]=c}this.keys.splice(a,0,b);this.fireEvent(\"add\",a,c,b);return c},remove:function(a){return this.removeAt(this.indexOf(a))},removeAt:function(a){if(a<this.length&&a>=0){this.length--;var c=this.items[a];this.items.splice(a,1);var b=this.keys[a];if(typeof b!=\"undefined\"){delete this.map[b]}this.keys.splice(a,1);this.fireEvent(\"remove\",c,b);return c}return false},removeKey:function(a){return this.removeAt(this.indexOfKey(a))},getCount:function(){return this.length},indexOf:function(a){return this.items.indexOf(a)},indexOfKey:function(a){return this.keys.indexOf(a)},item:function(b){var a=this.map[b],c=a!==undefined?a:(typeof b==\"number\")?this.items[b]:undefined;return typeof c!=\"function\"||this.allowFunctions?c:null},itemAt:function(a){return this.items[a]},key:function(a){return this.map[a]},contains:function(a){return this.indexOf(a)!=-1},containsKey:function(a){return typeof this.map[a]!=\"undefined\"},clear:function(){this.length=0;this.items=[];this.keys=[];this.map={};this.fireEvent(\"clear\")},first:function(){return this.items[0]},last:function(){return this.items[this.length-1]},_sort:function(k,a,j){var d,e,b=String(a).toUpperCase()==\"DESC\"?-1:1,h=[],l=this.keys,g=this.items;j=j||function(i,c){return i-c};for(d=0,e=g.length;d<e;d++){h[h.length]={key:l[d],value:g[d],index:d}}h.sort(function(i,c){var m=j(i[k],c[k])*b;if(m===0){m=(i.index<c.index?-1:1)}return m});for(d=0,e=h.length;d<e;d++){g[d]=h[d].value;l[d]=h[d].key}this.fireEvent(\"sort\",this)},sort:function(a,b){this._sort(\"value\",a,b)},reorder:function(d){this.suspendEvents();var b=this.items,c=0,g=b.length,a=[],e=[],h;for(h in d){a[d[h]]=b[h]}for(c=0;c<g;c++){if(d[c]==undefined){e.push(b[c])}}for(c=0;c<g;c++){if(a[c]==undefined){a[c]=e.shift()}}this.clear();this.addAll(a);this.resumeEvents();this.fireEvent(\"sort\",this)},keySort:function(a,b){this._sort(\"key\",a,b||function(d,c){var g=String(d).toUpperCase(),e=String(c).toUpperCase();return g>e?1:(g<e?-1:0)})},getRange:function(e,a){var b=this.items;if(b.length<1){return[]}e=e||0;a=Math.min(typeof a==\"undefined\"?this.length-1:a,this.length-1);var c,d=[];if(e<=a){for(c=e;c<=a;c++){d[d.length]=b[c]}}else{for(c=e;c>=a;c--){d[d.length]=b[c]}}return d},filter:function(c,b,d,a){if(Ext.isEmpty(b,false)){return this.clone()}b=this.createValueMatcher(b,d,a);return this.filterBy(function(e){return e&&b.test(e[c])})},filterBy:function(g,e){var h=new Ext.util.MixedCollection();h.getKey=this.getKey;var b=this.keys,d=this.items;for(var c=0,a=d.length;c<a;c++){if(g.call(e||this,d[c],b[c])){h.add(b[c],d[c])}}return h},findIndex:function(c,b,e,d,a){if(Ext.isEmpty(b,false)){return -1}b=this.createValueMatcher(b,d,a);return this.findIndexBy(function(g){return g&&b.test(g[c])},null,e)},findIndexBy:function(g,e,h){var b=this.keys,d=this.items;for(var c=(h||0),a=d.length;c<a;c++){if(g.call(e||this,d[c],b[c])){return c}}return -1},createValueMatcher:function(c,e,a,b){if(!c.exec){var d=Ext.escapeRe;c=String(c);if(e===true){c=d(c)}else{c=\"^\"+d(c);if(b===true){c+=\"$\"}}c=new RegExp(c,a?\"\":\"i\")}return c},clone:function(){var e=new Ext.util.MixedCollection();var b=this.keys,d=this.items;for(var c=0,a=d.length;c<a;c++){e.add(b[c],d[c])}e.getKey=this.getKey;return e}});Ext.util.MixedCollection.prototype.get=Ext.util.MixedCollection.prototype.item;Ext.AbstractManager=Ext.extend(Object,{typeName:\"type\",constructor:function(a){Ext.apply(this,a||{});this.all=new Ext.util.MixedCollection();this.types={}},get:function(a){return this.all.get(a)},register:function(a){this.all.add(a)},unregister:function(a){this.all.remove(a)},registerType:function(b,a){this.types[b]=a;a[this.typeName]=b},isRegistered:function(a){return this.types[a]!==undefined},create:function(a,d){var b=a[this.typeName]||a.type||d,c=this.types[b];if(c==undefined){throw new Error(String.format(\"The '{0}' type has not been registered with this manager\",b))}return new c(a)},onAvailable:function(d,c,b){var a=this.all;a.on(\"add\",function(e,g){if(g.id==d){c.call(b||g,g);a.un(\"add\",c,b)}})}});Ext.util.Format=function(){var trimRe=/^\\s+|\\s+$/g,stripTagsRE=/<\\/?[^>]+>/gi,stripScriptsRe=/(?:<script.*?>)((\\n|\\r|.)*?)(?:<\\/script>)/ig,nl2brRe=/\\r?\\n/g;return{ellipsis:function(value,len,word){if(value&&value.length>len){if(word){var vs=value.substr(0,len-2),index=Math.max(vs.lastIndexOf(\" \"),vs.lastIndexOf(\".\"),vs.lastIndexOf(\"!\"),vs.lastIndexOf(\"?\"));if(index==-1||index<(len-15)){return value.substr(0,len-3)+\"...\"}else{return vs.substr(0,index)+\"...\"}}else{return value.substr(0,len-3)+\"...\"}}return value},undef:function(value){return value!==undefined?value:\"\"},defaultValue:function(value,defaultValue){if(!defaultValue&&defaultValue!==0){defaultValue=\"\"}return value!==undefined&&value!==\"\"?value:defaultValue},htmlEncode:function(value){return !value?value:String(value).replace(/&/g,\"&amp;\").replace(/>/g,\"&gt;\").replace(/</g,\"&lt;\").replace(/\"/g,\"&quot;\")},htmlDecode:function(value){return !value?value:String(value).replace(/&gt;/g,\">\").replace(/&lt;/g,\"<\").replace(/&quot;/g,'\"').replace(/&amp;/g,\"&\")},trim:function(value){return String(value).replace(trimRe,\"\")},substr:function(value,start,length){return String(value).substr(start,length)},lowercase:function(value){return String(value).toLowerCase()},uppercase:function(value){return String(value).toUpperCase()},capitalize:function(value){return !value?value:value.charAt(0).toUpperCase()+value.substr(1).toLowerCase()},call:function(value,fn){if(arguments.length>2){var args=Array.prototype.slice.call(arguments,2);args.unshift(value);return eval(fn).apply(window,args)}else{return eval(fn).call(window,value)}},usMoney:function(v){v=(Math.round((v-0)*100))/100;v=(v==Math.floor(v))?v+\".00\":((v*10==Math.floor(v*10))?v+\"0\":v);v=String(v);var ps=v.split(\".\"),whole=ps[0],sub=ps[1]?\".\"+ps[1]:\".00\",r=/(\\d+)(\\d{3})/;while(r.test(whole)){whole=whole.replace(r,\"$1,$2\")}v=whole+sub;if(v.charAt(0)==\"-\"){return\"-$\"+v.substr(1)}return\"$\"+v},date:function(v,format){if(!v){return\"\"}if(!Ext.isDate(v)){v=new Date(Date.parse(v))}return v.dateFormat(format||\"m/d/Y\")},dateRenderer:function(format){return function(v){return Ext.util.Format.date(v,format)}},stripTags:function(v){return !v?v:String(v).replace(stripTagsRE,\"\")},stripScripts:function(v){return !v?v:String(v).replace(stripScriptsRe,\"\")},fileSize:function(size){if(size<1024){return size+\" bytes\"}else{if(size<1048576){return(Math.round(((size*10)/1024))/10)+\" KB\"}else{return(Math.round(((size*10)/1048576))/10)+\" MB\"}}},math:function(){var fns={};return function(v,a){if(!fns[a]){fns[a]=new Function(\"v\",\"return v \"+a+\";\")}return fns[a](v)}}(),round:function(value,precision){var result=Number(value);if(typeof precision==\"number\"){precision=Math.pow(10,precision);result=Math.round(value*precision)/precision}return result},number:function(v,format){if(!format){return v}v=Ext.num(v,NaN);if(isNaN(v)){return\"\"}var comma=\",\",dec=\".\",i18n=false,neg=v<0;v=Math.abs(v);if(format.substr(format.length-2)==\"/i\"){format=format.substr(0,format.length-2);i18n=true;comma=\".\";dec=\",\"}var hasComma=format.indexOf(comma)!=-1,psplit=(i18n?format.replace(/[^\\d\\,]/g,\"\"):format.replace(/[^\\d\\.]/g,\"\")).split(dec);if(1<psplit.length){v=v.toFixed(psplit[1].length)}else{if(2<psplit.length){throw (\"NumberFormatException: invalid format, formats should have no more than 1 period: \"+format)}else{v=v.toFixed(0)}}var fnum=v.toString();psplit=fnum.split(\".\");if(hasComma){var cnum=psplit[0],parr=[],j=cnum.length,m=Math.floor(j/3),n=cnum.length%3||3,i;for(i=0;i<j;i+=n){if(i!=0){n=3}parr[parr.length]=cnum.substr(i,n);m-=1}fnum=parr.join(comma);if(psplit[1]){fnum+=dec+psplit[1]}}else{if(psplit[1]){fnum=psplit[0]+dec+psplit[1]}}return(neg?\"-\":\"\")+format.replace(/[\\d,?\\.?]+/,fnum)},numberRenderer:function(format){return function(v){return Ext.util.Format.number(v,format)}},plural:function(v,s,p){return v+\" \"+(v==1?s:(p?p:s+\"s\"))},nl2br:function(v){return Ext.isEmpty(v)?\"\":v.replace(nl2brRe,\"<br/>\")}}}();Ext.XTemplate=function(){Ext.XTemplate.superclass.constructor.apply(this,arguments);var y=this,j=y.html,q=/<tpl\\b[^>]*>((?:(?=([^<]+))\\2|<(?!tpl\\b[^>]*>))*?)<\\/tpl>/,d=/^<tpl\\b[^>]*?for=\"(.*?)\"/,v=/^<tpl\\b[^>]*?if=\"(.*?)\"/,x=/^<tpl\\b[^>]*?exec=\"(.*?)\"/,r,p=0,k=[],o=\"values\",w=\"parent\",l=\"xindex\",n=\"xcount\",e=\"return \",c=\"with(values){ \";j=[\"<tpl>\",j,\"</tpl>\"].join(\"\");while((r=j.match(q))){var b=r[0].match(d),a=r[0].match(v),A=r[0].match(x),g=null,h=null,t=null,z=b&&b[1]?b[1]:\"\";if(a){g=a&&a[1]?a[1]:null;if(g){h=new Function(o,w,l,n,c+e+(Ext.util.Format.htmlDecode(g))+\"; }\")}}if(A){g=A&&A[1]?A[1]:null;if(g){t=new Function(o,w,l,n,c+(Ext.util.Format.htmlDecode(g))+\"; }\")}}if(z){switch(z){case\".\":z=new Function(o,w,c+e+o+\"; }\");break;case\"..\":z=new Function(o,w,c+e+w+\"; }\");break;default:z=new Function(o,w,c+e+z+\"; }\")}}k.push({id:p,target:z,exec:t,test:h,body:r[1]||\"\"});j=j.replace(r[0],\"{xtpl\"+p+\"}\");++p}for(var u=k.length-1;u>=0;--u){y.compileTpl(k[u])}y.master=k[k.length-1];y.tpls=k};Ext.extend(Ext.XTemplate,Ext.Template,{re:/\\{([\\w\\-\\.\\#]+)(?:\\:([\\w\\.]*)(?:\\((.*?)?\\))?)?(\\s?[\\+\\-\\*\\\\]\\s?[\\d\\.\\+\\-\\*\\\\\\(\\)]+)?\\}/g,codeRe:/\\{\\[((?:\\\\\\]|.|\\n)*?)\\]\\}/g,applySubTemplate:function(a,k,j,d,c){var h=this,g,m=h.tpls[a],l,b=[];if((m.test&&!m.test.call(h,k,j,d,c))||(m.exec&&m.exec.call(h,k,j,d,c))){return\"\"}l=m.target?m.target.call(h,k,j):k;g=l.length;j=m.target?k:j;if(m.target&&Ext.isArray(l)){for(var e=0,g=l.length;e<g;e++){b[b.length]=m.compiled.call(h,l[e],j,e+1,g)}return b.join(\"\")}return m.compiled.call(h,l,j,d,c)},compileTpl:function(tpl){var fm=Ext.util.Format,useF=this.disableFormats!==true,sep=Ext.isGecko?\"+\":\",\",body;function fn(m,name,format,args,math){if(name.substr(0,4)==\"xtpl\"){return\"'\"+sep+\"this.applySubTemplate(\"+name.substr(4)+\", values, parent, xindex, xcount)\"+sep+\"'\"}var v;if(name===\".\"){v=\"values\"}else{if(name===\"#\"){v=\"xindex\"}else{if(name.indexOf(\".\")!=-1){v=name}else{v=\"values['\"+name+\"']\"}}}if(math){v=\"(\"+v+math+\")\"}if(format&&useF){args=args?\",\"+args:\"\";if(format.substr(0,5)!=\"this.\"){format=\"fm.\"+format+\"(\"}else{format='this.call(\"'+format.substr(5)+'\", ';args=\", values\"}}else{args=\"\";format=\"(\"+v+\" === undefined ? '' : \"}return\"'\"+sep+format+v+args+\")\"+sep+\"'\"}function codeFn(m,code){return\"'\"+sep+\"(\"+code.replace(/\\\\'/g,\"'\")+\")\"+sep+\"'\"}if(Ext.isGecko){body=\"tpl.compiled = function(values, parent, xindex, xcount){ return '\"+tpl.body.replace(/(\\r\\n|\\n)/g,\"\\\\n\").replace(/'/g,\"\\\\'\").replace(this.re,fn).replace(this.codeRe,codeFn)+\"';};\"}else{body=[\"tpl.compiled = function(values, parent, xindex, xcount){ return ['\"];body.push(tpl.body.replace(/(\\r\\n|\\n)/g,\"\\\\n\").replace(/'/g,\"\\\\'\").replace(this.re,fn).replace(this.codeRe,codeFn));body.push(\"'].join('');};\");body=body.join(\"\")}eval(body);return this},applyTemplate:function(a){return this.master.compiled.call(this,a,{},1,1)},compile:function(){return this}});Ext.XTemplate.prototype.apply=Ext.XTemplate.prototype.applyTemplate;Ext.XTemplate.from=function(a){a=Ext.getDom(a);return new Ext.XTemplate(a.value||a.innerHTML)};Ext.util.CSS=function(){var d=null;var c=document;var b=/(-[a-z])/gi;var a=function(e,g){return g.charAt(1).toUpperCase()};return{createStyleSheet:function(i,l){var h;var g=c.getElementsByTagName(\"head\")[0];var k=c.createElement(\"style\");k.setAttribute(\"type\",\"text/css\");if(l){k.setAttribute(\"id\",l)}if(Ext.isIE){g.appendChild(k);h=k.styleSheet;h.cssText=i}else{try{k.appendChild(c.createTextNode(i))}catch(j){k.cssText=i}g.appendChild(k);h=k.styleSheet?k.styleSheet:(k.sheet||c.styleSheets[c.styleSheets.length-1])}this.cacheStyleSheet(h);return h},removeStyleSheet:function(g){var e=c.getElementById(g);if(e){e.parentNode.removeChild(e)}},swapStyleSheet:function(h,e){this.removeStyleSheet(h);var g=c.createElement(\"link\");g.setAttribute(\"rel\",\"stylesheet\");g.setAttribute(\"type\",\"text/css\");g.setAttribute(\"id\",h);g.setAttribute(\"href\",e);c.getElementsByTagName(\"head\")[0].appendChild(g)},refreshCache:function(){return this.getRules(true)},cacheStyleSheet:function(h){if(!d){d={}}try{var k=h.cssRules||h.rules;for(var g=k.length-1;g>=0;--g){d[k[g].selectorText.toLowerCase()]=k[g]}}catch(i){}},getRules:function(h){if(d===null||h){d={};var k=c.styleSheets;for(var j=0,g=k.length;j<g;j++){try{this.cacheStyleSheet(k[j])}catch(l){}}}return d},getRule:function(e,h){var g=this.getRules(h);if(!Ext.isArray(e)){return g[e.toLowerCase()]}for(var j=0;j<e.length;j++){if(g[e[j]]){return g[e[j].toLowerCase()]}}return null},updateRule:function(e,j,h){if(!Ext.isArray(e)){var k=this.getRule(e);if(k){k.style[j.replace(b,a)]=h;return true}}else{for(var g=0;g<e.length;g++){if(this.updateRule(e[g],j,h)){return true}}}return false}}}();Ext.util.ClickRepeater=Ext.extend(Ext.util.Observable,{constructor:function(b,a){this.el=Ext.get(b);this.el.unselectable();Ext.apply(this,a);this.addEvents(\"mousedown\",\"click\",\"mouseup\");if(!this.disabled){this.disabled=true;this.enable()}if(this.handler){this.on(\"click\",this.handler,this.scope||this)}Ext.util.ClickRepeater.superclass.constructor.call(this)},interval:20,delay:250,preventDefault:true,stopDefault:false,timer:0,enable:function(){if(this.disabled){this.el.on(\"mousedown\",this.handleMouseDown,this);if(Ext.isIE){this.el.on(\"dblclick\",this.handleDblClick,this)}if(this.preventDefault||this.stopDefault){this.el.on(\"click\",this.eventOptions,this)}}this.disabled=false},disable:function(a){if(a||!this.disabled){clearTimeout(this.timer);if(this.pressClass){this.el.removeClass(this.pressClass)}Ext.getDoc().un(\"mouseup\",this.handleMouseUp,this);this.el.removeAllListeners()}this.disabled=true},setDisabled:function(a){this[a?\"disable\":\"enable\"]()},eventOptions:function(a){if(this.preventDefault){a.preventDefault()}if(this.stopDefault){a.stopEvent()}},destroy:function(){this.disable(true);Ext.destroy(this.el);this.purgeListeners()},handleDblClick:function(a){clearTimeout(this.timer);this.el.blur();this.fireEvent(\"mousedown\",this,a);this.fireEvent(\"click\",this,a)},handleMouseDown:function(a){clearTimeout(this.timer);this.el.blur();if(this.pressClass){this.el.addClass(this.pressClass)}this.mousedownTime=new Date();Ext.getDoc().on(\"mouseup\",this.handleMouseUp,this);this.el.on(\"mouseout\",this.handleMouseOut,this);this.fireEvent(\"mousedown\",this,a);this.fireEvent(\"click\",this,a);if(this.accelerate){this.delay=400}this.timer=this.click.defer(this.delay||this.interval,this,[a])},click:function(a){this.fireEvent(\"click\",this,a);this.timer=this.click.defer(this.accelerate?this.easeOutExpo(this.mousedownTime.getElapsed(),400,-390,12000):this.interval,this,[a])},easeOutExpo:function(e,a,h,g){return(e==g)?a+h:h*(-Math.pow(2,-10*e/g)+1)+a},handleMouseOut:function(){clearTimeout(this.timer);if(this.pressClass){this.el.removeClass(this.pressClass)}this.el.on(\"mouseover\",this.handleMouseReturn,this)},handleMouseReturn:function(){this.el.un(\"mouseover\",this.handleMouseReturn,this);if(this.pressClass){this.el.addClass(this.pressClass)}this.click()},handleMouseUp:function(a){clearTimeout(this.timer);this.el.un(\"mouseover\",this.handleMouseReturn,this);this.el.un(\"mouseout\",this.handleMouseOut,this);Ext.getDoc().un(\"mouseup\",this.handleMouseUp,this);this.el.removeClass(this.pressClass);this.fireEvent(\"mouseup\",this,a)}});Ext.KeyNav=function(b,a){this.el=Ext.get(b);Ext.apply(this,a);if(!this.disabled){this.disabled=true;this.enable()}};Ext.KeyNav.prototype={disabled:false,defaultEventAction:\"stopEvent\",forceKeyDown:false,relay:function(c){var a=c.getKey(),b=this.keyToHandler[a];if(b&&this[b]){if(this.doRelay(c,this[b],b)!==true){c[this.defaultEventAction]()}}},doRelay:function(c,b,a){return b.call(this.scope||this,c,a)},enter:false,left:false,right:false,up:false,down:false,tab:false,esc:false,pageUp:false,pageDown:false,del:false,home:false,end:false,space:false,keyToHandler:{37:\"left\",39:\"right\",38:\"up\",40:\"down\",33:\"pageUp\",34:\"pageDown\",46:\"del\",36:\"home\",35:\"end\",13:\"enter\",27:\"esc\",9:\"tab\",32:\"space\"},stopKeyUp:function(b){var a=b.getKey();if(a>=37&&a<=40){b.stopEvent()}},destroy:function(){this.disable()},enable:function(){if(this.disabled){if(Ext.isSafari2){this.el.on(\"keyup\",this.stopKeyUp,this)}this.el.on(this.isKeydown()?\"keydown\":\"keypress\",this.relay,this);this.disabled=false}},disable:function(){if(!this.disabled){if(Ext.isSafari2){this.el.un(\"keyup\",this.stopKeyUp,this)}this.el.un(this.isKeydown()?\"keydown\":\"keypress\",this.relay,this);this.disabled=true}},setDisabled:function(a){this[a?\"disable\":\"enable\"]()},isKeydown:function(){return this.forceKeyDown||Ext.EventManager.useKeydown}};Ext.KeyMap=function(c,b,a){this.el=Ext.get(c);this.eventName=a||\"keydown\";this.bindings=[];if(b){this.addBinding(b)}this.enable()};Ext.KeyMap.prototype={stopEvent:false,addBinding:function(b){if(Ext.isArray(b)){Ext.each(b,function(j){this.addBinding(j)},this);return}var k=b.key,g=b.fn||b.handler,l=b.scope;if(b.stopEvent){this.stopEvent=b.stopEvent}if(typeof k==\"string\"){var h=[];var e=k.toUpperCase();for(var c=0,d=e.length;c<d;c++){h.push(e.charCodeAt(c))}k=h}var a=Ext.isArray(k);var i=function(o){if(this.checkModifiers(b,o)){var m=o.getKey();if(a){for(var n=0,j=k.length;n<j;n++){if(k[n]==m){if(this.stopEvent){o.stopEvent()}g.call(l||window,m,o);return}}}else{if(m==k){if(this.stopEvent){o.stopEvent()}g.call(l||window,m,o)}}}};this.bindings.push(i)},checkModifiers:function(b,h){var j,d,g=[\"shift\",\"ctrl\",\"alt\"];for(var c=0,a=g.length;c<a;++c){d=g[c];j=b[d];if(!(j===undefined||(j===h[d+\"Key\"]))){return false}}return true},on:function(b,d,c){var h,a,e,g;if(typeof b==\"object\"&&!Ext.isArray(b)){h=b.key;a=b.shift;e=b.ctrl;g=b.alt}else{h=b}this.addBinding({key:h,shift:a,ctrl:e,alt:g,fn:d,scope:c})},handleKeyDown:function(g){if(this.enabled){var c=this.bindings;for(var d=0,a=c.length;d<a;d++){c[d].call(this,g)}}},isEnabled:function(){return this.enabled},enable:function(){if(!this.enabled){this.el.on(this.eventName,this.handleKeyDown,this);this.enabled=true}},disable:function(){if(this.enabled){this.el.removeListener(this.eventName,this.handleKeyDown,this);this.enabled=false}},setDisabled:function(a){this[a?\"disable\":\"enable\"]()}};Ext.util.TextMetrics=function(){var a;return{measure:function(b,c,d){if(!a){a=Ext.util.TextMetrics.Instance(b,d)}a.bind(b);a.setFixedWidth(d||\"auto\");return a.getSize(c)},createInstance:function(b,c){return Ext.util.TextMetrics.Instance(b,c)}}}();Ext.util.TextMetrics.Instance=function(b,d){var c=new Ext.Element(document.createElement(\"div\"));document.body.appendChild(c.dom);c.position(\"absolute\");c.setLeftTop(-1000,-1000);c.hide();if(d){c.setWidth(d)}var a={getSize:function(g){c.update(g);var e=c.getSize();c.update(\"\");return e},bind:function(e){c.setStyle(Ext.fly(e).getStyles(\"font-size\",\"font-style\",\"font-weight\",\"font-family\",\"line-height\",\"text-transform\",\"letter-spacing\"))},setFixedWidth:function(e){c.setWidth(e)},getWidth:function(e){c.dom.style.width=\"auto\";return this.getSize(e).width},getHeight:function(e){return this.getSize(e).height}};a.bind(b);return a};Ext.Element.addMethods({getTextWidth:function(c,b,a){return(Ext.util.TextMetrics.measure(this.dom,Ext.value(c,this.dom.innerHTML,true)).width).constrain(b||0,a||1000000)}});Ext.util.Cookies={set:function(c,e){var a=arguments;var i=arguments.length;var b=(i>2)?a[2]:null;var h=(i>3)?a[3]:\"/\";var d=(i>4)?a[4]:null;var g=(i>5)?a[5]:false;document.cookie=c+\"=\"+escape(e)+((b===null)?\"\":(\"; expires=\"+b.toGMTString()))+((h===null)?\"\":(\"; path=\"+h))+((d===null)?\"\":(\"; domain=\"+d))+((g===true)?\"; secure\":\"\")},get:function(d){var b=d+\"=\";var g=b.length;var a=document.cookie.length;var e=0;var c=0;while(e<a){c=e+g;if(document.cookie.substring(e,c)==b){return Ext.util.Cookies.getCookieVal(c)}e=document.cookie.indexOf(\" \",e)+1;if(e===0){break}}return null},clear:function(a){if(Ext.util.Cookies.get(a)){document.cookie=a+\"=; expires=Thu, 01-Jan-70 00:00:01 GMT\"}},getCookieVal:function(b){var a=document.cookie.indexOf(\";\",b);if(a==-1){a=document.cookie.length}return unescape(document.cookie.substring(b,a))}};Ext.handleError=function(a){throw a};Ext.Error=function(a){this.message=(this.lang[a])?this.lang[a]:a};Ext.Error.prototype=new Error();Ext.apply(Ext.Error.prototype,{lang:{},name:\"Ext.Error\",getName:function(){return this.name},getMessage:function(){return this.message},toJson:function(){return Ext.encode(this)}});Ext.ComponentMgr=function(){var c=new Ext.util.MixedCollection();var b={};var a={};return{register:function(d){c.add(d)},unregister:function(d){c.remove(d)},get:function(d){return c.get(d)},onAvailable:function(g,e,d){c.on(\"add\",function(h,i){if(i.id==g){e.call(d||i,i);c.un(\"add\",e,d)}})},all:c,types:b,ptypes:a,isRegistered:function(d){return b[d]!==undefined},isPluginRegistered:function(d){return a[d]!==undefined},registerType:function(e,d){b[e]=d;d.xtype=e},create:function(d,e){return d.render?d:new b[d.xtype||e](d)},registerPlugin:function(e,d){a[e]=d;d.ptype=e},createPlugin:function(e,g){var d=a[e.ptype||g];if(d.init){return d}else{return new d(e)}}}}();Ext.reg=Ext.ComponentMgr.registerType;Ext.preg=Ext.ComponentMgr.registerPlugin;Ext.create=Ext.ComponentMgr.create;Ext.Component=function(b){b=b||{};if(b.initialConfig){if(b.isAction){this.baseAction=b}b=b.initialConfig}else{if(b.tagName||b.dom||Ext.isString(b)){b={applyTo:b,id:b.id||b}}}this.initialConfig=b;Ext.apply(this,b);this.addEvents(\"added\",\"disable\",\"enable\",\"beforeshow\",\"show\",\"beforehide\",\"hide\",\"removed\",\"beforerender\",\"render\",\"afterrender\",\"beforedestroy\",\"destroy\",\"beforestaterestore\",\"staterestore\",\"beforestatesave\",\"statesave\");this.getId();Ext.ComponentMgr.register(this);Ext.Component.superclass.constructor.call(this);if(this.baseAction){this.baseAction.addComponent(this)}this.initComponent();if(this.plugins){if(Ext.isArray(this.plugins)){for(var c=0,a=this.plugins.length;c<a;c++){this.plugins[c]=this.initPlugin(this.plugins[c])}}else{this.plugins=this.initPlugin(this.plugins)}}if(this.stateful!==false){this.initState()}if(this.applyTo){this.applyToMarkup(this.applyTo);delete this.applyTo}else{if(this.renderTo){this.render(this.renderTo);delete this.renderTo}}};Ext.Component.AUTO_ID=1000;Ext.extend(Ext.Component,Ext.util.Observable,{disabled:false,hidden:false,autoEl:\"div\",disabledClass:\"x-item-disabled\",allowDomMove:true,autoShow:false,hideMode:\"display\",hideParent:false,rendered:false,tplWriteMode:\"overwrite\",bubbleEvents:[],ctype:\"Ext.Component\",actionMode:\"el\",getActionEl:function(){return this[this.actionMode]},initPlugin:function(a){if(a.ptype&&!Ext.isFunction(a.init)){a=Ext.ComponentMgr.createPlugin(a)}else{if(Ext.isString(a)){a=Ext.ComponentMgr.createPlugin({ptype:a})}}a.init(this);return a},initComponent:function(){if(this.listeners){this.on(this.listeners);delete this.listeners}this.enableBubble(this.bubbleEvents)},render:function(b,a){if(!this.rendered&&this.fireEvent(\"beforerender\",this)!==false){if(!b&&this.el){this.el=Ext.get(this.el);b=this.el.dom.parentNode;this.allowDomMove=false}this.container=Ext.get(b);if(this.ctCls){this.container.addClass(this.ctCls)}this.rendered=true;if(a!==undefined){if(Ext.isNumber(a)){a=this.container.dom.childNodes[a]}else{a=Ext.getDom(a)}}this.onRender(this.container,a||null);if(this.autoShow){this.el.removeClass([\"x-hidden\",\"x-hide-\"+this.hideMode])}if(this.cls){this.el.addClass(this.cls);delete this.cls}if(this.style){this.el.applyStyles(this.style);delete this.style}if(this.overCls){this.el.addClassOnOver(this.overCls)}this.fireEvent(\"render\",this);var c=this.getContentTarget();if(this.html){c.update(Ext.DomHelper.markup(this.html));delete this.html}if(this.contentEl){var d=Ext.getDom(this.contentEl);Ext.fly(d).removeClass([\"x-hidden\",\"x-hide-display\"]);c.appendChild(d)}if(this.tpl){if(!this.tpl.compile){this.tpl=new Ext.XTemplate(this.tpl)}if(this.data){this.tpl[this.tplWriteMode](c,this.data);delete this.data}}this.afterRender(this.container);if(this.hidden){this.doHide()}if(this.disabled){this.disable(true)}if(this.stateful!==false){this.initStateEvents()}this.fireEvent(\"afterrender\",this)}return this},update:function(b,d,a){var c=this.getContentTarget();if(this.tpl&&typeof b!==\"string\"){this.tpl[this.tplWriteMode](c,b||{})}else{var e=Ext.isObject(b)?Ext.DomHelper.markup(b):b;c.update(e,d,a)}},onAdded:function(a,b){this.ownerCt=a;this.initRef();this.fireEvent(\"added\",this,a,b)},onRemoved:function(){this.removeRef();this.fireEvent(\"removed\",this,this.ownerCt);delete this.ownerCt},initRef:function(){if(this.ref&&!this.refOwner){var d=this.ref.split(\"/\"),c=d.length,b=0,a=this;while(a&&b<c){a=a.ownerCt;++b}if(a){a[this.refName=d[--b]]=this;this.refOwner=a}}},removeRef:function(){if(this.refOwner&&this.refName){delete this.refOwner[this.refName];delete this.refOwner}},initState:function(){if(Ext.state.Manager){var b=this.getStateId();if(b){var a=Ext.state.Manager.get(b);if(a){if(this.fireEvent(\"beforestaterestore\",this,a)!==false){this.applyState(Ext.apply({},a));this.fireEvent(\"staterestore\",this,a)}}}}},getStateId:function(){return this.stateId||((/^(ext-comp-|ext-gen)/).test(String(this.id))?null:this.id)},initStateEvents:function(){if(this.stateEvents){for(var a=0,b;b=this.stateEvents[a];a++){this.on(b,this.saveState,this,{delay:100})}}},applyState:function(a){if(a){Ext.apply(this,a)}},getState:function(){return null},saveState:function(){if(Ext.state.Manager&&this.stateful!==false){var b=this.getStateId();if(b){var a=this.getState();if(this.fireEvent(\"beforestatesave\",this,a)!==false){Ext.state.Manager.set(b,a);this.fireEvent(\"statesave\",this,a)}}}},applyToMarkup:function(a){this.allowDomMove=false;this.el=Ext.get(a);this.render(this.el.dom.parentNode)},addClass:function(a){if(this.el){this.el.addClass(a)}else{this.cls=this.cls?this.cls+\" \"+a:a}return this},removeClass:function(a){if(this.el){this.el.removeClass(a)}else{if(this.cls){this.cls=this.cls.split(\" \").remove(a).join(\" \")}}return this},onRender:function(b,a){if(!this.el&&this.autoEl){if(Ext.isString(this.autoEl)){this.el=document.createElement(this.autoEl)}else{var c=document.createElement(\"div\");Ext.DomHelper.overwrite(c,this.autoEl);this.el=c.firstChild}if(!this.el.id){this.el.id=this.getId()}}if(this.el){this.el=Ext.get(this.el);if(this.allowDomMove!==false){b.dom.insertBefore(this.el.dom,a);if(c){Ext.removeNode(c);c=null}}}},getAutoCreate:function(){var a=Ext.isObject(this.autoCreate)?this.autoCreate:Ext.apply({},this.defaultAutoCreate);if(this.id&&!a.id){a.id=this.id}return a},afterRender:Ext.emptyFn,destroy:function(){if(!this.isDestroyed){if(this.fireEvent(\"beforedestroy\",this)!==false){this.destroying=true;this.beforeDestroy();if(this.ownerCt&&this.ownerCt.remove){this.ownerCt.remove(this,false)}if(this.rendered){this.el.remove();if(this.actionMode==\"container\"||this.removeMode==\"container\"){this.container.remove()}}if(this.focusTask&&this.focusTask.cancel){this.focusTask.cancel()}this.onDestroy();Ext.ComponentMgr.unregister(this);this.fireEvent(\"destroy\",this);this.purgeListeners();this.destroying=false;this.isDestroyed=true}}},deleteMembers:function(){var b=arguments;for(var c=0,a=b.length;c<a;++c){delete this[b[c]]}},beforeDestroy:Ext.emptyFn,onDestroy:Ext.emptyFn,getEl:function(){return this.el},getContentTarget:function(){return this.el},getId:function(){return this.id||(this.id=\"ext-comp-\"+(++Ext.Component.AUTO_ID))},getItemId:function(){return this.itemId||this.getId()},focus:function(b,a){if(a){this.focusTask=new Ext.util.DelayedTask(this.focus,this,[b,false]);this.focusTask.delay(Ext.isNumber(a)?a:10);return this}if(this.rendered&&!this.isDestroyed){this.el.focus();if(b===true){this.el.dom.select()}}return this},blur:function(){if(this.rendered){this.el.blur()}return this},disable:function(a){if(this.rendered){this.onDisable()}this.disabled=true;if(a!==true){this.fireEvent(\"disable\",this)}return this},onDisable:function(){this.getActionEl().addClass(this.disabledClass);this.el.dom.disabled=true},enable:function(){if(this.rendered){this.onEnable()}this.disabled=false;this.fireEvent(\"enable\",this);return this},onEnable:function(){this.getActionEl().removeClass(this.disabledClass);this.el.dom.disabled=false},setDisabled:function(a){return this[a?\"disable\":\"enable\"]()},show:function(){if(this.fireEvent(\"beforeshow\",this)!==false){this.hidden=false;if(this.autoRender){this.render(Ext.isBoolean(this.autoRender)?Ext.getBody():this.autoRender)}if(this.rendered){this.onShow()}this.fireEvent(\"show\",this)}return this},onShow:function(){this.getVisibilityEl().removeClass(\"x-hide-\"+this.hideMode)},hide:function(){if(this.fireEvent(\"beforehide\",this)!==false){this.doHide();this.fireEvent(\"hide\",this)}return this},doHide:function(){this.hidden=true;if(this.rendered){this.onHide()}},onHide:function(){this.getVisibilityEl().addClass(\"x-hide-\"+this.hideMode)},getVisibilityEl:function(){return this.hideParent?this.container:this.getActionEl()},setVisible:function(a){return this[a?\"show\":\"hide\"]()},isVisible:function(){return this.rendered&&this.getVisibilityEl().isVisible()},cloneConfig:function(b){b=b||{};var c=b.id||Ext.id();var a=Ext.applyIf(b,this.initialConfig);a.id=c;return new this.constructor(a)},getXType:function(){return this.constructor.xtype},isXType:function(b,a){if(Ext.isFunction(b)){b=b.xtype}else{if(Ext.isObject(b)){b=b.constructor.xtype}}return !a?(\"/\"+this.getXTypes()+\"/\").indexOf(\"/\"+b+\"/\")!=-1:this.constructor.xtype==b},getXTypes:function(){var a=this.constructor;if(!a.xtypes){var d=[],b=this;while(b&&b.constructor.xtype){d.unshift(b.constructor.xtype);b=b.constructor.superclass}a.xtypeChain=d;a.xtypes=d.join(\"/\")}return a.xtypes},findParentBy:function(a){for(var b=this.ownerCt;(b!=null)&&!a(b,this);b=b.ownerCt){}return b||null},findParentByType:function(b,a){return this.findParentBy(function(d){return d.isXType(b,a)})},bubble:function(c,b,a){var d=this;while(d){if(c.apply(b||d,a||[d])===false){break}d=d.ownerCt}return this},getPositionEl:function(){return this.positionEl||this.el},purgeListeners:function(){Ext.Component.superclass.purgeListeners.call(this);if(this.mons){this.on(\"beforedestroy\",this.clearMons,this,{single:true})}},clearMons:function(){Ext.each(this.mons,function(a){a.item.un(a.ename,a.fn,a.scope)},this);this.mons=[]},createMons:function(){if(!this.mons){this.mons=[];this.on(\"beforedestroy\",this.clearMons,this,{single:true})}},mon:function(g,b,d,c,a){this.createMons();if(Ext.isObject(b)){var j=/^(?:scope|delay|buffer|single|stopEvent|preventDefault|stopPropagation|normalized|args|delegate)$/;var i=b;for(var h in i){if(j.test(h)){continue}if(Ext.isFunction(i[h])){this.mons.push({item:g,ename:h,fn:i[h],scope:i.scope});g.on(h,i[h],i.scope,i)}else{this.mons.push({item:g,ename:h,fn:i[h],scope:i.scope});g.on(h,i[h])}}return}this.mons.push({item:g,ename:b,fn:d,scope:c});g.on(b,d,c,a)},mun:function(h,c,g,e){var j,d;this.createMons();for(var b=0,a=this.mons.length;b<a;++b){d=this.mons[b];if(h===d.item&&c==d.ename&&g===d.fn&&e===d.scope){this.mons.splice(b,1);h.un(c,g,e);j=true;break}}return j},nextSibling:function(){if(this.ownerCt){var a=this.ownerCt.items.indexOf(this);if(a!=-1&&a+1<this.ownerCt.items.getCount()){return this.ownerCt.items.itemAt(a+1)}}return null},previousSibling:function(){if(this.ownerCt){var a=this.ownerCt.items.indexOf(this);if(a>0){return this.ownerCt.items.itemAt(a-1)}}return null},getBubbleTarget:function(){return this.ownerCt}});Ext.reg(\"component\",Ext.Component);Ext.Action=Ext.extend(Object,{constructor:function(a){this.initialConfig=a;this.itemId=a.itemId=(a.itemId||a.id||Ext.id());this.items=[]},isAction:true,setText:function(a){this.initialConfig.text=a;this.callEach(\"setText\",[a])},getText:function(){return this.initialConfig.text},setIconClass:function(a){this.initialConfig.iconCls=a;this.callEach(\"setIconClass\",[a])},getIconClass:function(){return this.initialConfig.iconCls},setDisabled:function(a){this.initialConfig.disabled=a;this.callEach(\"setDisabled\",[a])},enable:function(){this.setDisabled(false)},disable:function(){this.setDisabled(true)},isDisabled:function(){return this.initialConfig.disabled},setHidden:function(a){this.initialConfig.hidden=a;this.callEach(\"setVisible\",[!a])},show:function(){this.setHidden(false)},hide:function(){this.setHidden(true)},isHidden:function(){return this.initialConfig.hidden},setHandler:function(b,a){this.initialConfig.handler=b;this.initialConfig.scope=a;this.callEach(\"setHandler\",[b,a])},each:function(b,a){Ext.each(this.items,b,a)},callEach:function(e,b){var d=this.items;for(var c=0,a=d.length;c<a;c++){d[c][e].apply(d[c],b)}},addComponent:function(a){this.items.push(a);a.on(\"destroy\",this.removeComponent,this)},removeComponent:function(a){this.items.remove(a)},execute:function(){this.initialConfig.handler.apply(this.initialConfig.scope||window,arguments)}});(function(){Ext.Layer=function(d,c){d=d||{};var e=Ext.DomHelper,h=d.parentEl,g=h?Ext.getDom(h):document.body;if(c){this.dom=Ext.getDom(c)}if(!this.dom){var i=d.dh||{tag:\"div\",cls:\"x-layer\"};this.dom=e.append(g,i)}if(d.cls){this.addClass(d.cls)}this.constrain=d.constrain!==false;this.setVisibilityMode(Ext.Element.VISIBILITY);if(d.id){this.id=this.dom.id=d.id}else{this.id=Ext.id(this.dom)}this.zindex=d.zindex||this.getZIndex();this.position(\"absolute\",this.zindex);if(d.shadow){this.shadowOffset=d.shadowOffset||4;this.shadow=new Ext.Shadow({offset:this.shadowOffset,mode:d.shadow})}else{this.shadowOffset=0}this.useShim=d.shim!==false&&Ext.useShims;this.useDisplay=d.useDisplay;this.hide()};var a=Ext.Element.prototype;var b=[];Ext.extend(Ext.Layer,Ext.Element,{getZIndex:function(){return this.zindex||parseInt((this.getShim()||this).getStyle(\"z-index\"),10)||11000},getShim:function(){if(!this.useShim){return null}if(this.shim){return this.shim}var d=b.shift();if(!d){d=this.createShim();d.enableDisplayMode(\"block\");d.dom.style.display=\"none\";d.dom.style.visibility=\"visible\"}var c=this.dom.parentNode;if(d.dom.parentNode!=c){c.insertBefore(d.dom,this.dom)}d.setStyle(\"z-index\",this.getZIndex()-2);this.shim=d;return d},hideShim:function(){if(this.shim){this.shim.setDisplayed(false);b.push(this.shim);delete this.shim}},disableShadow:function(){if(this.shadow){this.shadowDisabled=true;this.shadow.hide();this.lastShadowOffset=this.shadowOffset;this.shadowOffset=0}},enableShadow:function(c){if(this.shadow){this.shadowDisabled=false;if(Ext.isDefined(this.lastShadowOffset)){this.shadowOffset=this.lastShadowOffset;delete this.lastShadowOffset}if(c){this.sync(true)}}},sync:function(d){var n=this.shadow;if(!this.updating&&this.isVisible()&&(n||this.useShim)){var i=this.getShim(),m=this.getWidth(),j=this.getHeight(),e=this.getLeft(true),o=this.getTop(true);if(n&&!this.shadowDisabled){if(d&&!n.isVisible()){n.show(this)}else{n.realign(e,o,m,j)}if(i){if(d){i.show()}var k=n.el.getXY(),g=i.dom.style,c=n.el.getSize();g.left=(k[0])+\"px\";g.top=(k[1])+\"px\";g.width=(c.width)+\"px\";g.height=(c.height)+\"px\"}}else{if(i){if(d){i.show()}i.setSize(m,j);i.setLeftTop(e,o)}}}},destroy:function(){this.hideShim();if(this.shadow){this.shadow.hide()}this.removeAllListeners();Ext.removeNode(this.dom);delete this.dom},remove:function(){this.destroy()},beginUpdate:function(){this.updating=true},endUpdate:function(){this.updating=false;this.sync(true)},hideUnders:function(c){if(this.shadow){this.shadow.hide()}this.hideShim()},constrainXY:function(){if(this.constrain){var j=Ext.lib.Dom.getViewWidth(),d=Ext.lib.Dom.getViewHeight();var o=Ext.getDoc().getScroll();var n=this.getXY();var k=n[0],i=n[1];var c=this.shadowOffset;var l=this.dom.offsetWidth+c,e=this.dom.offsetHeight+c;var g=false;if((k+l)>j+o.left){k=j-l-c;g=true}if((i+e)>d+o.top){i=d-e-c;g=true}if(k<o.left){k=o.left;g=true}if(i<o.top){i=o.top;g=true}if(g){if(this.avoidY){var m=this.avoidY;if(i<=m&&(i+e)>=m){i=m-e-5}}n=[k,i];this.storeXY(n);a.setXY.call(this,n);this.sync()}}return this},getConstrainOffset:function(){return this.shadowOffset},isVisible:function(){return this.visible},showAction:function(){this.visible=true;if(this.useDisplay===true){this.setDisplayed(\"\")}else{if(this.lastXY){a.setXY.call(this,this.lastXY)}else{if(this.lastLT){a.setLeftTop.call(this,this.lastLT[0],this.lastLT[1])}}}},hideAction:function(){this.visible=false;if(this.useDisplay===true){this.setDisplayed(false)}else{this.setLeftTop(-10000,-10000)}},setVisible:function(i,h,k,l,j){if(i){this.showAction()}if(h&&i){var g=function(){this.sync(true);if(l){l()}}.createDelegate(this);a.setVisible.call(this,true,true,k,g,j)}else{if(!i){this.hideUnders(true)}var g=l;if(h){g=function(){this.hideAction();if(l){l()}}.createDelegate(this)}a.setVisible.call(this,i,h,k,g,j);if(i){this.sync(true)}else{if(!h){this.hideAction()}}}return this},storeXY:function(c){delete this.lastLT;this.lastXY=c},storeLeftTop:function(d,c){delete this.lastXY;this.lastLT=[d,c]},beforeFx:function(){this.beforeAction();return Ext.Layer.superclass.beforeFx.apply(this,arguments)},afterFx:function(){Ext.Layer.superclass.afterFx.apply(this,arguments);this.sync(this.isVisible())},beforeAction:function(){if(!this.updating&&this.shadow){this.shadow.hide()}},setLeft:function(c){this.storeLeftTop(c,this.getTop(true));a.setLeft.apply(this,arguments);this.sync();return this},setTop:function(c){this.storeLeftTop(this.getLeft(true),c);a.setTop.apply(this,arguments);this.sync();return this},setLeftTop:function(d,c){this.storeLeftTop(d,c);a.setLeftTop.apply(this,arguments);this.sync();return this},setXY:function(j,h,k,l,i){this.fixDisplay();this.beforeAction();this.storeXY(j);var g=this.createCB(l);a.setXY.call(this,j,h,k,g,i);if(!h){g()}return this},createCB:function(e){var d=this;return function(){d.constrainXY();d.sync(true);if(e){e()}}},setX:function(g,h,j,k,i){this.setXY([g,this.getY()],h,j,k,i);return this},setY:function(k,g,i,j,h){this.setXY([this.getX(),k],g,i,j,h);return this},setSize:function(j,k,i,m,n,l){this.beforeAction();var g=this.createCB(n);a.setSize.call(this,j,k,i,m,g,l);if(!i){g()}return this},setWidth:function(i,h,k,l,j){this.beforeAction();var g=this.createCB(l);a.setWidth.call(this,i,h,k,g,j);if(!h){g()}return this},setHeight:function(j,i,l,m,k){this.beforeAction();var g=this.createCB(m);a.setHeight.call(this,j,i,l,g,k);if(!i){g()}return this},setBounds:function(o,m,p,i,n,k,l,j){this.beforeAction();var g=this.createCB(l);if(!n){this.storeXY([o,m]);a.setXY.call(this,[o,m]);a.setSize.call(this,p,i,n,k,g,j);g()}else{a.setBounds.call(this,o,m,p,i,n,k,g,j)}return this},setZIndex:function(c){this.zindex=c;this.setStyle(\"z-index\",c+2);if(this.shadow){this.shadow.setZIndex(c+1)}if(this.shim){this.shim.setStyle(\"z-index\",c)}return this}})})();Ext.Shadow=function(d){Ext.apply(this,d);if(typeof this.mode!=\"string\"){this.mode=this.defaultMode}var e=this.offset,c={h:0},b=Math.floor(this.offset/2);switch(this.mode.toLowerCase()){case\"drop\":c.w=0;c.l=c.t=e;c.t-=1;if(Ext.isIE9m){c.l-=this.offset+b;c.t-=this.offset+b;c.w-=b;c.h-=b;c.t+=1}break;case\"sides\":c.w=(e*2);c.l=-e;c.t=e-1;if(Ext.isIE9m){c.l-=(this.offset-b);c.t-=this.offset+b;c.l+=1;c.w-=(this.offset-b)*2;c.w-=b+1;c.h-=1}break;case\"frame\":c.w=c.h=(e*2);c.l=c.t=-e;c.t+=1;c.h-=2;if(Ext.isIE9m){c.l-=(this.offset-b);c.t-=(this.offset-b);c.l+=1;c.w-=(this.offset+b+1);c.h-=(this.offset+b);c.h+=1}break}this.adjusts=c};Ext.Shadow.prototype={offset:4,defaultMode:\"drop\",show:function(a){a=Ext.get(a);if(!this.el){this.el=Ext.Shadow.Pool.pull();if(this.el.dom.nextSibling!=a.dom){this.el.insertBefore(a)}}this.el.setStyle(\"z-index\",this.zIndex||parseInt(a.getStyle(\"z-index\"),10)-1);if(Ext.isIE9m){this.el.dom.style.filter=\"progid:DXImageTransform.Microsoft.alpha(opacity=50) progid:DXImageTransform.Microsoft.Blur(pixelradius=\"+(this.offset)+\")\"}this.realign(a.getLeft(true),a.getTop(true),a.getWidth(),a.getHeight());this.el.dom.style.display=\"block\"},isVisible:function(){return this.el?true:false},realign:function(b,r,q,g){if(!this.el){return}var n=this.adjusts,k=this.el.dom,u=k.style,i=0,p=(q+n.w),e=(g+n.h),j=p+\"px\",o=e+\"px\",m,c;u.left=(b+n.l)+\"px\";u.top=(r+n.t)+\"px\";if(u.width!=j||u.height!=o){u.width=j;u.height=o;if(!Ext.isIE9m){m=k.childNodes;c=Math.max(0,(p-12))+\"px\";m[0].childNodes[1].style.width=c;m[1].childNodes[1].style.width=c;m[2].childNodes[1].style.width=c;m[1].style.height=Math.max(0,(e-12))+\"px\"}}},hide:function(){if(this.el){this.el.dom.style.display=\"none\";Ext.Shadow.Pool.push(this.el);delete this.el}},setZIndex:function(a){this.zIndex=a;if(this.el){this.el.setStyle(\"z-index\",a)}}};Ext.Shadow.Pool=function(){var b=[],a=Ext.isIE9m?'<div class=\"x-ie-shadow\"></div>':'<div class=\"x-shadow\"><div class=\"xst\"><div class=\"xstl\"></div><div class=\"xstc\"></div><div class=\"xstr\"></div></div><div class=\"xsc\"><div class=\"xsml\"></div><div class=\"xsmc\"></div><div class=\"xsmr\"></div></div><div class=\"xsb\"><div class=\"xsbl\"></div><div class=\"xsbc\"></div><div class=\"xsbr\"></div></div></div>';return{pull:function(){var c=b.shift();if(!c){c=Ext.get(Ext.DomHelper.insertHtml(\"beforeBegin\",document.body.firstChild,a));c.autoBoxAdjust=false}return c},push:function(c){b.push(c)}}}();Ext.BoxComponent=Ext.extend(Ext.Component,{initComponent:function(){Ext.BoxComponent.superclass.initComponent.call(this);this.addEvents(\"resize\",\"move\")},boxReady:false,deferHeight:false,setSize:function(b,d){if(typeof b==\"object\"){d=b.height;b=b.width}if(Ext.isDefined(b)&&Ext.isDefined(this.boxMinWidth)&&(b<this.boxMinWidth)){b=this.boxMinWidth}if(Ext.isDefined(d)&&Ext.isDefined(this.boxMinHeight)&&(d<this.boxMinHeight)){d=this.boxMinHeight}if(Ext.isDefined(b)&&Ext.isDefined(this.boxMaxWidth)&&(b>this.boxMaxWidth)){b=this.boxMaxWidth}if(Ext.isDefined(d)&&Ext.isDefined(this.boxMaxHeight)&&(d>this.boxMaxHeight)){d=this.boxMaxHeight}if(!this.boxReady){this.width=b;this.height=d;return this}if(this.cacheSizes!==false&&this.lastSize&&this.lastSize.width==b&&this.lastSize.height==d){return this}this.lastSize={width:b,height:d};var c=this.adjustSize(b,d),g=c.width,a=c.height,e;if(g!==undefined||a!==undefined){e=this.getResizeEl();if(!this.deferHeight&&g!==undefined&&a!==undefined){e.setSize(g,a)}else{if(!this.deferHeight&&a!==undefined){e.setHeight(a)}else{if(g!==undefined){e.setWidth(g)}}}this.onResize(g,a,b,d);this.fireEvent(\"resize\",this,g,a,b,d)}return this},setWidth:function(a){return this.setSize(a)},setHeight:function(a){return this.setSize(undefined,a)},getSize:function(){return this.getResizeEl().getSize()},getWidth:function(){return this.getResizeEl().getWidth()},getHeight:function(){return this.getResizeEl().getHeight()},getOuterSize:function(){var a=this.getResizeEl();return{width:a.getWidth()+a.getMargins(\"lr\"),height:a.getHeight()+a.getMargins(\"tb\")}},getPosition:function(a){var b=this.getPositionEl();if(a===true){return[b.getLeft(true),b.getTop(true)]}return this.xy||b.getXY()},getBox:function(a){var c=this.getPosition(a);var b=this.getSize();b.x=c[0];b.y=c[1];return b},updateBox:function(a){this.setSize(a.width,a.height);this.setPagePosition(a.x,a.y);return this},getResizeEl:function(){return this.resizeEl||this.el},setAutoScroll:function(a){if(this.rendered){this.getContentTarget().setOverflow(a?\"auto\":\"\")}this.autoScroll=a;return this},setPosition:function(a,g){if(a&&typeof a[1]==\"number\"){g=a[1];a=a[0]}this.x=a;this.y=g;if(!this.boxReady){return this}var b=this.adjustPosition(a,g);var e=b.x,d=b.y;var c=this.getPositionEl();if(e!==undefined||d!==undefined){if(e!==undefined&&d!==undefined){c.setLeftTop(e,d)}else{if(e!==undefined){c.setLeft(e)}else{if(d!==undefined){c.setTop(d)}}}this.onPosition(e,d);this.fireEvent(\"move\",this,e,d)}return this},setPagePosition:function(a,c){if(a&&typeof a[1]==\"number\"){c=a[1];a=a[0]}this.pageX=a;this.pageY=c;if(!this.boxReady){return}if(a===undefined||c===undefined){return}var b=this.getPositionEl().translatePoints(a,c);this.setPosition(b.left,b.top);return this},afterRender:function(){Ext.BoxComponent.superclass.afterRender.call(this);if(this.resizeEl){this.resizeEl=Ext.get(this.resizeEl)}if(this.positionEl){this.positionEl=Ext.get(this.positionEl)}this.boxReady=true;Ext.isDefined(this.autoScroll)&&this.setAutoScroll(this.autoScroll);this.setSize(this.width,this.height);if(this.x||this.y){this.setPosition(this.x,this.y)}else{if(this.pageX||this.pageY){this.setPagePosition(this.pageX,this.pageY)}}},syncSize:function(){delete this.lastSize;this.setSize(this.autoWidth?undefined:this.getResizeEl().getWidth(),this.autoHeight?undefined:this.getResizeEl().getHeight());return this},onResize:function(d,b,a,c){},onPosition:function(a,b){},adjustSize:function(a,b){if(this.autoWidth){a=\"auto\"}if(this.autoHeight){b=\"auto\"}return{width:a,height:b}},adjustPosition:function(a,b){return{x:a,y:b}}});Ext.reg(\"box\",Ext.BoxComponent);Ext.Spacer=Ext.extend(Ext.BoxComponent,{autoEl:\"div\"});Ext.reg(\"spacer\",Ext.Spacer);Ext.SplitBar=function(c,e,b,d,a){this.el=Ext.get(c,true);this.el.unselectable();this.resizingEl=Ext.get(e,true);this.orientation=b||Ext.SplitBar.HORIZONTAL;this.minSize=0;this.maxSize=2000;this.animate=false;this.useShim=false;this.shim=null;if(!a){this.proxy=Ext.SplitBar.createProxy(this.orientation)}else{this.proxy=Ext.get(a).dom}this.dd=new Ext.dd.DDProxy(this.el.dom.id,\"XSplitBars\",{dragElId:this.proxy.id});this.dd.b4StartDrag=this.onStartProxyDrag.createDelegate(this);this.dd.endDrag=this.onEndProxyDrag.createDelegate(this);this.dragSpecs={};this.adapter=new Ext.SplitBar.BasicLayoutAdapter();this.adapter.init(this);if(this.orientation==Ext.SplitBar.HORIZONTAL){this.placement=d||(this.el.getX()>this.resizingEl.getX()?Ext.SplitBar.LEFT:Ext.SplitBar.RIGHT);this.el.addClass(\"x-splitbar-h\")}else{this.placement=d||(this.el.getY()>this.resizingEl.getY()?Ext.SplitBar.TOP:Ext.SplitBar.BOTTOM);this.el.addClass(\"x-splitbar-v\")}this.addEvents(\"resize\",\"moved\",\"beforeresize\",\"beforeapply\");Ext.SplitBar.superclass.constructor.call(this)};Ext.extend(Ext.SplitBar,Ext.util.Observable,{onStartProxyDrag:function(a,e){this.fireEvent(\"beforeresize\",this);this.overlay=Ext.DomHelper.append(document.body,{cls:\"x-drag-overlay\",html:\"&#160;\"},true);this.overlay.unselectable();this.overlay.setSize(Ext.lib.Dom.getViewWidth(true),Ext.lib.Dom.getViewHeight(true));this.overlay.show();Ext.get(this.proxy).setDisplayed(\"block\");var c=this.adapter.getElementSize(this);this.activeMinSize=this.getMinimumSize();this.activeMaxSize=this.getMaximumSize();var d=c-this.activeMinSize;var b=Math.max(this.activeMaxSize-c,0);if(this.orientation==Ext.SplitBar.HORIZONTAL){this.dd.resetConstraints();this.dd.setXConstraint(this.placement==Ext.SplitBar.LEFT?d:b,this.placement==Ext.SplitBar.LEFT?b:d,this.tickSize);this.dd.setYConstraint(0,0)}else{this.dd.resetConstraints();this.dd.setXConstraint(0,0);this.dd.setYConstraint(this.placement==Ext.SplitBar.TOP?d:b,this.placement==Ext.SplitBar.TOP?b:d,this.tickSize)}this.dragSpecs.startSize=c;this.dragSpecs.startPoint=[a,e];Ext.dd.DDProxy.prototype.b4StartDrag.call(this.dd,a,e)},onEndProxyDrag:function(c){Ext.get(this.proxy).setDisplayed(false);var b=Ext.lib.Event.getXY(c);if(this.overlay){Ext.destroy(this.overlay);delete this.overlay}var a;if(this.orientation==Ext.SplitBar.HORIZONTAL){a=this.dragSpecs.startSize+(this.placement==Ext.SplitBar.LEFT?b[0]-this.dragSpecs.startPoint[0]:this.dragSpecs.startPoint[0]-b[0])}else{a=this.dragSpecs.startSize+(this.placement==Ext.SplitBar.TOP?b[1]-this.dragSpecs.startPoint[1]:this.dragSpecs.startPoint[1]-b[1])}a=Math.min(Math.max(a,this.activeMinSize),this.activeMaxSize);if(a!=this.dragSpecs.startSize){if(this.fireEvent(\"beforeapply\",this,a)!==false){this.adapter.setElementSize(this,a);this.fireEvent(\"moved\",this,a);this.fireEvent(\"resize\",this,a)}}},getAdapter:function(){return this.adapter},setAdapter:function(a){this.adapter=a;this.adapter.init(this)},getMinimumSize:function(){return this.minSize},setMinimumSize:function(a){this.minSize=a},getMaximumSize:function(){return this.maxSize},setMaximumSize:function(a){this.maxSize=a},setCurrentSize:function(b){var a=this.animate;this.animate=false;this.adapter.setElementSize(this,b);this.animate=a},destroy:function(a){Ext.destroy(this.shim,Ext.get(this.proxy));this.dd.unreg();if(a){this.el.remove()}this.purgeListeners()}});Ext.SplitBar.createProxy=function(b){var c=new Ext.Element(document.createElement(\"div\"));document.body.appendChild(c.dom);c.unselectable();var a=\"x-splitbar-proxy\";c.addClass(a+\" \"+(b==Ext.SplitBar.HORIZONTAL?a+\"-h\":a+\"-v\"));return c.dom};Ext.SplitBar.BasicLayoutAdapter=function(){};Ext.SplitBar.BasicLayoutAdapter.prototype={init:function(a){},getElementSize:function(a){if(a.orientation==Ext.SplitBar.HORIZONTAL){return a.resizingEl.getWidth()}else{return a.resizingEl.getHeight()}},setElementSize:function(b,a,c){if(b.orientation==Ext.SplitBar.HORIZONTAL){if(!b.animate){b.resizingEl.setWidth(a);if(c){c(b,a)}}else{b.resizingEl.setWidth(a,true,0.1,c,\"easeOut\")}}else{if(!b.animate){b.resizingEl.setHeight(a);if(c){c(b,a)}}else{b.resizingEl.setHeight(a,true,0.1,c,\"easeOut\")}}}};Ext.SplitBar.AbsoluteLayoutAdapter=function(a){this.basic=new Ext.SplitBar.BasicLayoutAdapter();this.container=Ext.get(a)};Ext.SplitBar.AbsoluteLayoutAdapter.prototype={init:function(a){this.basic.init(a)},getElementSize:function(a){return this.basic.getElementSize(a)},setElementSize:function(b,a,c){this.basic.setElementSize(b,a,this.moveSplitter.createDelegate(this,[b]))},moveSplitter:function(a){var b=Ext.SplitBar;switch(a.placement){case b.LEFT:a.el.setX(a.resizingEl.getRight());break;case b.RIGHT:a.el.setStyle(\"right\",(this.container.getWidth()-a.resizingEl.getLeft())+\"px\");break;case b.TOP:a.el.setY(a.resizingEl.getBottom());break;case b.BOTTOM:a.el.setY(a.resizingEl.getTop()-a.el.getHeight());break}}};Ext.SplitBar.VERTICAL=1;Ext.SplitBar.HORIZONTAL=2;Ext.SplitBar.LEFT=1;Ext.SplitBar.RIGHT=2;Ext.SplitBar.TOP=3;Ext.SplitBar.BOTTOM=4;Ext.Container=Ext.extend(Ext.BoxComponent,{bufferResize:50,autoDestroy:true,forceLayout:false,defaultType:\"panel\",resizeEvent:\"resize\",bubbleEvents:[\"add\",\"remove\"],initComponent:function(){Ext.Container.superclass.initComponent.call(this);this.addEvents(\"afterlayout\",\"beforeadd\",\"beforeremove\",\"add\",\"remove\");var a=this.items;if(a){delete this.items;this.add(a)}},initItems:function(){if(!this.items){this.items=new Ext.util.MixedCollection(false,this.getComponentId);this.getLayout()}},setLayout:function(a){if(this.layout&&this.layout!=a){this.layout.setContainer(null)}this.layout=a;this.initItems();a.setContainer(this)},afterRender:function(){Ext.Container.superclass.afterRender.call(this);if(!this.layout){this.layout=\"auto\"}if(Ext.isObject(this.layout)&&!this.layout.layout){this.layoutConfig=this.layout;this.layout=this.layoutConfig.type}if(Ext.isString(this.layout)){this.layout=new Ext.Container.LAYOUTS[this.layout.toLowerCase()](this.layoutConfig)}this.setLayout(this.layout);if(this.activeItem!==undefined&&this.layout.setActiveItem){var a=this.activeItem;delete this.activeItem;this.layout.setActiveItem(a)}if(!this.ownerCt){this.doLayout(false,true)}if(this.monitorResize===true){Ext.EventManager.onWindowResize(this.doLayout,this,[false])}},getLayoutTarget:function(){return this.el},getComponentId:function(a){return a.getItemId()},add:function(b){this.initItems();var e=arguments.length>1;if(e||Ext.isArray(b)){var a=[];Ext.each(e?arguments:b,function(h){a.push(this.add(h))},this);return a}var g=this.lookupComponent(this.applyDefaults(b));var d=this.items.length;if(this.fireEvent(\"beforeadd\",this,g,d)!==false&&this.onBeforeAdd(g)!==false){this.items.add(g);g.onAdded(this,d);this.onAdd(g);this.fireEvent(\"add\",this,g,d)}return g},onAdd:function(a){},onAdded:function(a,b){this.ownerCt=a;this.initRef();this.cascade(function(d){d.initRef()});this.fireEvent(\"added\",this,a,b)},insert:function(e,b){var d=arguments,h=d.length,a=[],g,j;this.initItems();if(h>2){for(g=h-1;g>=1;--g){a.push(this.insert(e,d[g]))}return a}j=this.lookupComponent(this.applyDefaults(b));e=Math.min(e,this.items.length);if(this.fireEvent(\"beforeadd\",this,j,e)!==false&&this.onBeforeAdd(j)!==false){if(j.ownerCt==this){this.items.remove(j)}this.items.insert(e,j);j.onAdded(this,e);this.onAdd(j);this.fireEvent(\"add\",this,j,e)}return j},applyDefaults:function(b){var a=this.defaults;if(a){if(Ext.isFunction(a)){a=a.call(this,b)}if(Ext.isString(b)){b=Ext.ComponentMgr.get(b);Ext.apply(b,a)}else{if(!b.events){Ext.applyIf(b.isAction?b.initialConfig:b,a)}else{Ext.apply(b,a)}}}return b},onBeforeAdd:function(a){if(a.ownerCt){a.ownerCt.remove(a,false)}if(this.hideBorders===true){a.border=(a.border===true)}},remove:function(a,b){this.initItems();var d=this.getComponent(a);if(d&&this.fireEvent(\"beforeremove\",this,d)!==false){this.doRemove(d,b);this.fireEvent(\"remove\",this,d)}return d},onRemove:function(a){},doRemove:function(e,d){var b=this.layout,a=b&&this.rendered;if(a){b.onRemove(e)}this.items.remove(e);e.onRemoved();this.onRemove(e);if(d===true||(d!==false&&this.autoDestroy)){e.destroy()}if(a){b.afterRemove(e)}},removeAll:function(c){this.initItems();var e,g=[],b=[];this.items.each(function(h){g.push(h)});for(var d=0,a=g.length;d<a;++d){e=g[d];this.remove(e,c);if(e.ownerCt!==this){b.push(e)}}return b},getComponent:function(a){if(Ext.isObject(a)){a=a.getItemId()}return this.items.get(a)},lookupComponent:function(a){if(Ext.isString(a)){return Ext.ComponentMgr.get(a)}else{if(!a.events){return this.createComponent(a)}}return a},createComponent:function(a,d){if(a.render){return a}var b=Ext.create(Ext.apply({ownerCt:this},a),d||this.defaultType);delete b.initialConfig.ownerCt;delete b.ownerCt;return b},canLayout:function(){var a=this.getVisibilityEl();return a&&a.dom&&!a.isStyle(\"display\",\"none\")},doLayout:function(g,e){var k=this.rendered,j=e||this.forceLayout;if(this.collapsed||!this.canLayout()){this.deferLayout=this.deferLayout||!g;if(!j){return}g=g&&!this.deferLayout}else{delete this.deferLayout}if(k&&this.layout){this.layout.layout()}if(g!==true&&this.items){var d=this.items.items;for(var b=0,a=d.length;b<a;b++){var h=d[b];if(h.doLayout){h.doLayout(false,j)}}}if(k){this.onLayout(g,j)}this.hasLayout=true;delete this.forceLayout},onLayout:Ext.emptyFn,shouldBufferLayout:function(){var a=this.hasLayout;if(this.ownerCt){return a?!this.hasLayoutPending():false}return a},hasLayoutPending:function(){var a=false;this.ownerCt.bubble(function(b){if(b.layoutPending){a=true;return false}});return a},onShow:function(){Ext.Container.superclass.onShow.call(this);if(Ext.isDefined(this.deferLayout)){delete this.deferLayout;this.doLayout(true)}},getLayout:function(){if(!this.layout){var a=new Ext.layout.AutoLayout(this.layoutConfig);this.setLayout(a)}return this.layout},beforeDestroy:function(){var a;if(this.items){while(a=this.items.first()){this.doRemove(a,true)}}if(this.monitorResize){Ext.EventManager.removeResizeListener(this.doLayout,this)}Ext.destroy(this.layout);Ext.Container.superclass.beforeDestroy.call(this)},cascade:function(g,e,b){if(g.apply(e||this,b||[this])!==false){if(this.items){var d=this.items.items;for(var c=0,a=d.length;c<a;c++){if(d[c].cascade){d[c].cascade(g,e,b)}else{g.apply(e||d[c],b||[d[c]])}}}}return this},findById:function(c){var a=null,b=this;this.cascade(function(d){if(b!=d&&d.id===c){a=d;return false}});return a},findByType:function(b,a){return this.findBy(function(d){return d.isXType(b,a)})},find:function(b,a){return this.findBy(function(d){return d[b]===a})},findBy:function(d,c){var a=[],b=this;this.cascade(function(e){if(b!=e&&d.call(c||e,e,b)===true){a.push(e)}});return a},get:function(a){return this.getComponent(a)}});Ext.Container.LAYOUTS={};Ext.reg(\"container\",Ext.Container);Ext.layout.ContainerLayout=Ext.extend(Object,{monitorResize:false,activeItem:null,constructor:function(a){this.id=Ext.id(null,\"ext-layout-\");Ext.apply(this,a)},type:\"container\",IEMeasureHack:function(k,g){var a=k.dom.childNodes,b=a.length,n,m=[],l,h,j;for(h=0;h<b;h++){n=a[h];l=Ext.get(n);if(l){m[h]=l.getStyle(\"display\");l.setStyle({display:\"none\"})}}j=k?k.getViewSize(g):{};for(h=0;h<b;h++){n=a[h];l=Ext.get(n);if(l){l.setStyle({display:m[h]})}}return j},getLayoutTargetSize:Ext.EmptyFn,layout:function(){var a=this.container,b=a.getLayoutTarget();if(!(this.hasLayout||Ext.isEmpty(this.targetCls))){b.addClass(this.targetCls)}this.onLayout(a,b);a.fireEvent(\"afterlayout\",a,this)},onLayout:function(a,b){this.renderAll(a,b)},isValidParent:function(b,a){return a&&b.getPositionEl().dom.parentNode==(a.dom||a)},renderAll:function(e,g){var b=e.items.items,d,h,a=b.length;for(d=0;d<a;d++){h=b[d];if(h&&(!h.rendered||!this.isValidParent(h,g))){this.renderItem(h,d,g)}}},renderItem:function(d,a,b){if(d){if(!d.rendered){d.render(b,a);this.configureItem(d)}else{if(!this.isValidParent(d,b)){if(Ext.isNumber(a)){a=b.dom.childNodes[a]}b.dom.insertBefore(d.getPositionEl().dom,a||null);d.container=b;this.configureItem(d)}}}},getRenderedItems:function(g){var e=g.getLayoutTarget(),h=g.items.items,a=h.length,d,j,b=[];for(d=0;d<a;d++){if((j=h[d]).rendered&&this.isValidParent(j,e)&&j.shouldLayout!==false){b.push(j)}}return b},configureItem:function(b){if(this.extraCls){var a=b.getPositionEl?b.getPositionEl():b;a.addClass(this.extraCls)}if(b.doLayout&&this.forceLayout){b.doLayout()}if(this.renderHidden&&b!=this.activeItem){b.hide()}},onRemove:function(b){if(this.activeItem==b){delete this.activeItem}if(b.rendered&&this.extraCls){var a=b.getPositionEl?b.getPositionEl():b;a.removeClass(this.extraCls)}},afterRemove:function(a){if(a.removeRestore){a.removeMode=\"container\";delete a.removeRestore}},onResize:function(){var c=this.container,a;if(c.collapsed){return}if(a=c.bufferResize&&c.shouldBufferLayout()){if(!this.resizeTask){this.resizeTask=new Ext.util.DelayedTask(this.runLayout,this);this.resizeBuffer=Ext.isNumber(a)?a:50}c.layoutPending=true;this.resizeTask.delay(this.resizeBuffer)}else{this.runLayout()}},runLayout:function(){var a=this.container;this.layout();a.onLayout();delete a.layoutPending},setContainer:function(b){if(this.monitorResize&&b!=this.container){var a=this.container;if(a){a.un(a.resizeEvent,this.onResize,this)}if(b){b.on(b.resizeEvent,this.onResize,this)}}this.container=b},parseMargins:function(b){if(Ext.isNumber(b)){b=b.toString()}var c=b.split(\" \"),a=c.length;if(a==1){c[1]=c[2]=c[3]=c[0]}else{if(a==2){c[2]=c[0];c[3]=c[1]}else{if(a==3){c[3]=c[1]}}}return{top:parseInt(c[0],10)||0,right:parseInt(c[1],10)||0,bottom:parseInt(c[2],10)||0,left:parseInt(c[3],10)||0}},fieldTpl:(function(){var a=new Ext.Template('<div class=\"x-form-item {itemCls}\" tabIndex=\"-1\">','<label for=\"{id}\" style=\"{labelStyle}\" class=\"x-form-item-label\">{label}{labelSeparator}</label>','<div class=\"x-form-element\" id=\"x-form-el-{id}\" style=\"{elementStyle}\">','</div><div class=\"{clearCls}\"></div>',\"</div>\");a.disableFormats=true;return a.compile()})(),destroy:function(){if(this.resizeTask&&this.resizeTask.cancel){this.resizeTask.cancel()}if(this.container){this.container.un(this.container.resizeEvent,this.onResize,this)}if(!Ext.isEmpty(this.targetCls)){var a=this.container.getLayoutTarget();if(a){a.removeClass(this.targetCls)}}}});Ext.layout.AutoLayout=Ext.extend(Ext.layout.ContainerLayout,{type:\"auto\",monitorResize:true,onLayout:function(d,g){Ext.layout.AutoLayout.superclass.onLayout.call(this,d,g);var e=this.getRenderedItems(d),a=e.length,b,h;for(b=0;b<a;b++){h=e[b];if(h.doLayout){h.doLayout(true)}}}});Ext.Container.LAYOUTS.auto=Ext.layout.AutoLayout;Ext.layout.FitLayout=Ext.extend(Ext.layout.ContainerLayout,{monitorResize:true,type:\"fit\",getLayoutTargetSize:function(){var a=this.container.getLayoutTarget();if(!a){return{}}return a.getStyleSize()},onLayout:function(a,b){Ext.layout.FitLayout.superclass.onLayout.call(this,a,b);if(!a.collapsed){this.setItemSize(this.activeItem||a.items.itemAt(0),this.getLayoutTargetSize())}},setItemSize:function(b,a){if(b&&a.height>0){b.setSize(a)}}});Ext.Container.LAYOUTS.fit=Ext.layout.FitLayout;Ext.layout.CardLayout=Ext.extend(Ext.layout.FitLayout,{deferredRender:false,layoutOnCardChange:false,renderHidden:true,type:\"card\",setActiveItem:function(d){var a=this.activeItem,b=this.container;d=b.getComponent(d);if(d&&a!=d){if(a){a.hide();if(a.hidden!==true){return false}a.fireEvent(\"deactivate\",a)}var c=d.doLayout&&(this.layoutOnCardChange||!d.rendered);this.activeItem=d;delete d.deferLayout;d.show();this.layout();if(c){d.doLayout()}d.fireEvent(\"activate\",d)}},renderAll:function(a,b){if(this.deferredRender){this.renderItem(this.activeItem,undefined,b)}else{Ext.layout.CardLayout.superclass.renderAll.call(this,a,b)}}});Ext.Container.LAYOUTS.card=Ext.layout.CardLayout;Ext.layout.AnchorLayout=Ext.extend(Ext.layout.ContainerLayout,{monitorResize:true,type:\"anchor\",defaultAnchor:\"100%\",parseAnchorRE:/^(r|right|b|bottom)$/i,getLayoutTargetSize:function(){var b=this.container.getLayoutTarget(),a={};if(b){a=b.getViewSize();if(Ext.isIE9m&&Ext.isStrict&&a.width==0){a=b.getStyleSize()}a.width-=b.getPadding(\"lr\");a.height-=b.getPadding(\"tb\")}return a},onLayout:function(m,w){Ext.layout.AnchorLayout.superclass.onLayout.call(this,m,w);var p=this.getLayoutTargetSize(),k=p.width,o=p.height,q=w.getStyle(\"overflow\"),n=this.getRenderedItems(m),t=n.length,g=[],j,a,v,l,h,c,e,d,u=0,s,b;if(k<20&&o<20){return}if(m.anchorSize){if(typeof m.anchorSize==\"number\"){a=m.anchorSize}else{a=m.anchorSize.width;v=m.anchorSize.height}}else{a=m.initialConfig.width;v=m.initialConfig.height}for(s=0;s<t;s++){l=n[s];b=l.getPositionEl();if(!l.anchor&&l.items&&!Ext.isNumber(l.width)&&!(Ext.isIE6&&Ext.isStrict)){l.anchor=this.defaultAnchor}if(l.anchor){h=l.anchorSpec;if(!h){d=l.anchor.split(\" \");l.anchorSpec=h={right:this.parseAnchor(d[0],l.initialConfig.width,a),bottom:this.parseAnchor(d[1],l.initialConfig.height,v)}}c=h.right?this.adjustWidthAnchor(h.right(k)-b.getMargins(\"lr\"),l):undefined;e=h.bottom?this.adjustHeightAnchor(h.bottom(o)-b.getMargins(\"tb\"),l):undefined;if(c||e){g.push({component:l,width:c||undefined,height:e||undefined})}}}for(s=0,t=g.length;s<t;s++){j=g[s];j.component.setSize(j.width,j.height)}if(q&&q!=\"hidden\"&&!this.adjustmentPass){var r=this.getLayoutTargetSize();if(r.width!=p.width||r.height!=p.height){this.adjustmentPass=true;this.onLayout(m,w)}}delete this.adjustmentPass},parseAnchor:function(c,h,b){if(c&&c!=\"none\"){var e;if(this.parseAnchorRE.test(c)){var g=b-h;return function(a){if(a!==e){e=a;return a-g}}}else{if(c.indexOf(\"%\")!=-1){var d=parseFloat(c.replace(\"%\",\"\"))*0.01;return function(a){if(a!==e){e=a;return Math.floor(a*d)}}}else{c=parseInt(c,10);if(!isNaN(c)){return function(a){if(a!==e){e=a;return a+c}}}}}}return false},adjustWidthAnchor:function(b,a){return b},adjustHeightAnchor:function(b,a){return b}});Ext.Container.LAYOUTS.anchor=Ext.layout.AnchorLayout;Ext.layout.ColumnLayout=Ext.extend(Ext.layout.ContainerLayout,{monitorResize:true,type:\"column\",extraCls:\"x-column\",scrollOffset:0,targetCls:\"x-column-layout-ct\",isValidParent:function(b,a){return this.innerCt&&b.getPositionEl().dom.parentNode==this.innerCt.dom},getLayoutTargetSize:function(){var b=this.container.getLayoutTarget(),a;if(b){a=b.getViewSize();if(Ext.isIE9m&&Ext.isStrict&&a.width==0){a=b.getStyleSize()}a.width-=b.getPadding(\"lr\");a.height-=b.getPadding(\"tb\")}return a},renderAll:function(a,b){if(!this.innerCt){this.innerCt=b.createChild({cls:\"x-column-inner\"});this.innerCt.createChild({cls:\"x-clear\"})}Ext.layout.ColumnLayout.superclass.renderAll.call(this,a,this.innerCt)},onLayout:function(e,k){var g=e.items.items,j=g.length,n,b,a,o=[];this.renderAll(e,k);var r=this.getLayoutTargetSize();if(Ext.isIE9m&&(r.width<1&&r.height<1)){return}var p=r.width-this.scrollOffset,d=r.height,q=p;this.innerCt.setWidth(p);for(b=0;b<j;b++){n=g[b];a=n.getPositionEl().getMargins(\"lr\");o[b]=a;if(!n.columnWidth){q-=(n.getWidth()+a)}}q=q<0?0:q;for(b=0;b<j;b++){n=g[b];a=o[b];if(n.columnWidth){n.setSize(Math.floor(n.columnWidth*q)-a)}}if(Ext.isIE9m){if(b=k.getStyle(\"overflow\")&&b!=\"hidden\"&&!this.adjustmentPass){var l=this.getLayoutTargetSize();if(l.width!=r.width){this.adjustmentPass=true;this.onLayout(e,k)}}}delete this.adjustmentPass}});Ext.Container.LAYOUTS.column=Ext.layout.ColumnLayout;Ext.layout.BorderLayout=Ext.extend(Ext.layout.ContainerLayout,{monitorResize:true,rendered:false,type:\"border\",targetCls:\"x-border-layout-ct\",getLayoutTargetSize:function(){var a=this.container.getLayoutTarget();return a?a.getViewSize():{}},onLayout:function(g,I){var j,B,F,o,x=g.items.items,C=x.length;if(!this.rendered){j=[];for(B=0;B<C;B++){F=x[B];o=F.region;if(F.collapsed){j.push(F)}F.collapsed=false;if(!F.rendered){F.render(I,B);F.getPositionEl().addClass(\"x-border-panel\")}this[o]=o!=\"center\"&&F.split?new Ext.layout.BorderLayout.SplitRegion(this,F.initialConfig,o):new Ext.layout.BorderLayout.Region(this,F.initialConfig,o);this[o].render(I,F)}this.rendered=true}var v=this.getLayoutTargetSize();if(v.width<20||v.height<20){if(j){this.restoreCollapsed=j}return}else{if(this.restoreCollapsed){j=this.restoreCollapsed;delete this.restoreCollapsed}}var t=v.width,D=v.height,r=t,A=D,p=0,q=0,y=this.north,u=this.south,l=this.west,E=this.east,F=this.center,H,z,d,G;if(!F&&Ext.layout.BorderLayout.WARN!==false){throw\"No center region defined in BorderLayout \"+g.id}if(y&&y.isVisible()){H=y.getSize();z=y.getMargins();H.width=t-(z.left+z.right);H.x=z.left;H.y=z.top;p=H.height+H.y+z.bottom;A-=p;y.applyLayout(H)}if(u&&u.isVisible()){H=u.getSize();z=u.getMargins();H.width=t-(z.left+z.right);H.x=z.left;G=(H.height+z.top+z.bottom);H.y=D-G+z.top;A-=G;u.applyLayout(H)}if(l&&l.isVisible()){H=l.getSize();z=l.getMargins();H.height=A-(z.top+z.bottom);H.x=z.left;H.y=p+z.top;d=(H.width+z.left+z.right);q+=d;r-=d;l.applyLayout(H)}if(E&&E.isVisible()){H=E.getSize();z=E.getMargins();H.height=A-(z.top+z.bottom);d=(H.width+z.left+z.right);H.x=t-d+z.left;H.y=p+z.top;r-=d;E.applyLayout(H)}if(F){z=F.getMargins();var k={x:q+z.left,y:p+z.top,width:r-(z.left+z.right),height:A-(z.top+z.bottom)};F.applyLayout(k)}if(j){for(B=0,C=j.length;B<C;B++){j[B].collapse(false)}}if(Ext.isIE9m&&Ext.isStrict){I.repaint()}if(B=I.getStyle(\"overflow\")&&B!=\"hidden\"&&!this.adjustmentPass){var a=this.getLayoutTargetSize();if(a.width!=v.width||a.height!=v.height){this.adjustmentPass=true;this.onLayout(g,I)}}delete this.adjustmentPass},destroy:function(){var b=[\"north\",\"south\",\"east\",\"west\"],a,c;for(a=0;a<b.length;a++){c=this[b[a]];if(c){if(c.destroy){c.destroy()}else{if(c.split){c.split.destroy(true)}}}}Ext.layout.BorderLayout.superclass.destroy.call(this)}});Ext.layout.BorderLayout.Region=function(b,a,c){Ext.apply(this,a);this.layout=b;this.position=c;this.state={};if(typeof this.margins==\"string\"){this.margins=this.layout.parseMargins(this.margins)}this.margins=Ext.applyIf(this.margins||{},this.defaultMargins);if(this.collapsible){if(typeof this.cmargins==\"string\"){this.cmargins=this.layout.parseMargins(this.cmargins)}if(this.collapseMode==\"mini\"&&!this.cmargins){this.cmargins={left:0,top:0,right:0,bottom:0}}else{this.cmargins=Ext.applyIf(this.cmargins||{},c==\"north\"||c==\"south\"?this.defaultNSCMargins:this.defaultEWCMargins)}}};Ext.layout.BorderLayout.Region.prototype={collapsible:false,split:false,floatable:true,minWidth:50,minHeight:50,defaultMargins:{left:0,top:0,right:0,bottom:0},defaultNSCMargins:{left:5,top:5,right:5,bottom:5},defaultEWCMargins:{left:5,top:0,right:5,bottom:0},floatingZIndex:100,isCollapsed:false,render:function(b,c){this.panel=c;c.el.enableDisplayMode();this.targetEl=b;this.el=c.el;var a=c.getState,d=this.position;c.getState=function(){return Ext.apply(a.call(c)||{},this.state)}.createDelegate(this);if(d!=\"center\"){c.allowQueuedExpand=false;c.on({beforecollapse:this.beforeCollapse,collapse:this.onCollapse,beforeexpand:this.beforeExpand,expand:this.onExpand,hide:this.onHide,show:this.onShow,scope:this});if(this.collapsible||this.floatable){c.collapseEl=\"el\";c.slideAnchor=this.getSlideAnchor()}if(c.tools&&c.tools.toggle){c.tools.toggle.addClass(\"x-tool-collapse-\"+d);c.tools.toggle.addClassOnOver(\"x-tool-collapse-\"+d+\"-over\")}}},getCollapsedEl:function(){if(!this.collapsedEl){if(!this.toolTemplate){var b=new Ext.Template('<div class=\"x-tool x-tool-{id}\">&#160;</div>');b.disableFormats=true;b.compile();Ext.layout.BorderLayout.Region.prototype.toolTemplate=b}this.collapsedEl=this.targetEl.createChild({cls:\"x-layout-collapsed x-layout-collapsed-\"+this.position,id:this.panel.id+\"-xcollapsed\"});this.collapsedEl.enableDisplayMode(\"block\");if(this.collapseMode==\"mini\"){this.collapsedEl.addClass(\"x-layout-cmini-\"+this.position);this.miniCollapsedEl=this.collapsedEl.createChild({cls:\"x-layout-mini x-layout-mini-\"+this.position,html:\"&#160;\"});this.miniCollapsedEl.addClassOnOver(\"x-layout-mini-over\");this.collapsedEl.addClassOnOver(\"x-layout-collapsed-over\");this.collapsedEl.on(\"click\",this.onExpandClick,this,{stopEvent:true})}else{if(this.collapsible!==false&&!this.hideCollapseTool){var a=this.expandToolEl=this.toolTemplate.append(this.collapsedEl.dom,{id:\"expand-\"+this.position},true);a.addClassOnOver(\"x-tool-expand-\"+this.position+\"-over\");a.on(\"click\",this.onExpandClick,this,{stopEvent:true})}if(this.floatable!==false||this.titleCollapse){this.collapsedEl.addClassOnOver(\"x-layout-collapsed-over\");this.collapsedEl.on(\"click\",this[this.floatable?\"collapseClick\":\"onExpandClick\"],this)}}}return this.collapsedEl},onExpandClick:function(a){if(this.isSlid){this.panel.expand(false)}else{this.panel.expand()}},onCollapseClick:function(a){this.panel.collapse()},beforeCollapse:function(c,a){this.lastAnim=a;if(this.splitEl){this.splitEl.hide()}this.getCollapsedEl().show();var b=this.panel.getEl();this.originalZIndex=b.getStyle(\"z-index\");b.setStyle(\"z-index\",100);this.isCollapsed=true;this.layout.layout()},onCollapse:function(a){this.panel.el.setStyle(\"z-index\",1);if(this.lastAnim===false||this.panel.animCollapse===false){this.getCollapsedEl().dom.style.visibility=\"visible\"}else{this.getCollapsedEl().slideIn(this.panel.slideAnchor,{duration:0.2})}this.state.collapsed=true;this.panel.saveState()},beforeExpand:function(a){if(this.isSlid){this.afterSlideIn()}var b=this.getCollapsedEl();this.el.show();if(this.position==\"east\"||this.position==\"west\"){this.panel.setSize(undefined,b.getHeight())}else{this.panel.setSize(b.getWidth(),undefined)}b.hide();b.dom.style.visibility=\"hidden\";this.panel.el.setStyle(\"z-index\",this.floatingZIndex)},onExpand:function(){this.isCollapsed=false;if(this.splitEl){this.splitEl.show()}this.layout.layout();this.panel.el.setStyle(\"z-index\",this.originalZIndex);this.state.collapsed=false;this.panel.saveState()},collapseClick:function(a){if(this.isSlid){a.stopPropagation();this.slideIn()}else{a.stopPropagation();this.slideOut()}},onHide:function(){if(this.isCollapsed){this.getCollapsedEl().hide()}else{if(this.splitEl){this.splitEl.hide()}}},onShow:function(){if(this.isCollapsed){this.getCollapsedEl().show()}else{if(this.splitEl){this.splitEl.show()}}},isVisible:function(){return !this.panel.hidden},getMargins:function(){return this.isCollapsed&&this.cmargins?this.cmargins:this.margins},getSize:function(){return this.isCollapsed?this.getCollapsedEl().getSize():this.panel.getSize()},setPanel:function(a){this.panel=a},getMinWidth:function(){return this.minWidth},getMinHeight:function(){return this.minHeight},applyLayoutCollapsed:function(a){var b=this.getCollapsedEl();b.setLeftTop(a.x,a.y);b.setSize(a.width,a.height)},applyLayout:function(a){if(this.isCollapsed){this.applyLayoutCollapsed(a)}else{this.panel.setPosition(a.x,a.y);this.panel.setSize(a.width,a.height)}},beforeSlide:function(){this.panel.beforeEffect()},afterSlide:function(){this.panel.afterEffect()},initAutoHide:function(){if(this.autoHide!==false){if(!this.autoHideHd){this.autoHideSlideTask=new Ext.util.DelayedTask(this.slideIn,this);this.autoHideHd={mouseout:function(a){if(!a.within(this.el,true)){this.autoHideSlideTask.delay(500)}},mouseover:function(a){this.autoHideSlideTask.cancel()},scope:this}}this.el.on(this.autoHideHd);this.collapsedEl.on(this.autoHideHd)}},clearAutoHide:function(){if(this.autoHide!==false){this.el.un(\"mouseout\",this.autoHideHd.mouseout);this.el.un(\"mouseover\",this.autoHideHd.mouseover);this.collapsedEl.un(\"mouseout\",this.autoHideHd.mouseout);this.collapsedEl.un(\"mouseover\",this.autoHideHd.mouseover)}},clearMonitor:function(){Ext.getDoc().un(\"click\",this.slideInIf,this)},slideOut:function(){if(this.isSlid||this.el.hasActiveFx()){return}this.isSlid=true;var b=this.panel.tools,c,a;if(b&&b.toggle){b.toggle.hide()}this.el.show();a=this.panel.collapsed;this.panel.collapsed=false;if(this.position==\"east\"||this.position==\"west\"){c=this.panel.deferHeight;this.panel.deferHeight=false;this.panel.setSize(undefined,this.collapsedEl.getHeight());this.panel.deferHeight=c}else{this.panel.setSize(this.collapsedEl.getWidth(),undefined)}this.panel.collapsed=a;this.restoreLT=[this.el.dom.style.left,this.el.dom.style.top];this.el.alignTo(this.collapsedEl,this.getCollapseAnchor());this.el.setStyle(\"z-index\",this.floatingZIndex+2);this.panel.el.replaceClass(\"x-panel-collapsed\",\"x-panel-floating\");if(this.animFloat!==false){this.beforeSlide();this.el.slideIn(this.getSlideAnchor(),{callback:function(){this.afterSlide();this.initAutoHide();Ext.getDoc().on(\"click\",this.slideInIf,this)},scope:this,block:true})}else{this.initAutoHide();Ext.getDoc().on(\"click\",this.slideInIf,this)}},afterSlideIn:function(){this.clearAutoHide();this.isSlid=false;this.clearMonitor();this.el.setStyle(\"z-index\",\"\");this.panel.el.replaceClass(\"x-panel-floating\",\"x-panel-collapsed\");this.el.dom.style.left=this.restoreLT[0];this.el.dom.style.top=this.restoreLT[1];var a=this.panel.tools;if(a&&a.toggle){a.toggle.show()}},slideIn:function(a){if(!this.isSlid||this.el.hasActiveFx()){Ext.callback(a);return}this.isSlid=false;if(this.animFloat!==false){this.beforeSlide();this.el.slideOut(this.getSlideAnchor(),{callback:function(){this.el.hide();this.afterSlide();this.afterSlideIn();Ext.callback(a)},scope:this,block:true})}else{this.el.hide();this.afterSlideIn()}},slideInIf:function(a){if(!a.within(this.el)){this.slideIn()}},anchors:{west:\"left\",east:\"right\",north:\"top\",south:\"bottom\"},sanchors:{west:\"l\",east:\"r\",north:\"t\",south:\"b\"},canchors:{west:\"tl-tr\",east:\"tr-tl\",north:\"tl-bl\",south:\"bl-tl\"},getAnchor:function(){return this.anchors[this.position]},getCollapseAnchor:function(){return this.canchors[this.position]},getSlideAnchor:function(){return this.sanchors[this.position]},getAlignAdj:function(){var a=this.cmargins;switch(this.position){case\"west\":return[0,0];break;case\"east\":return[0,0];break;case\"north\":return[0,0];break;case\"south\":return[0,0];break}},getExpandAdj:function(){var b=this.collapsedEl,a=this.cmargins;switch(this.position){case\"west\":return[-(a.right+b.getWidth()+a.left),0];break;case\"east\":return[a.right+b.getWidth()+a.left,0];break;case\"north\":return[0,-(a.top+a.bottom+b.getHeight())];break;case\"south\":return[0,a.top+a.bottom+b.getHeight()];break}},destroy:function(){if(this.autoHideSlideTask&&this.autoHideSlideTask.cancel){this.autoHideSlideTask.cancel()}Ext.destroyMembers(this,\"miniCollapsedEl\",\"collapsedEl\",\"expandToolEl\")}};Ext.layout.BorderLayout.SplitRegion=function(b,a,c){Ext.layout.BorderLayout.SplitRegion.superclass.constructor.call(this,b,a,c);this.applyLayout=this.applyFns[c]};Ext.extend(Ext.layout.BorderLayout.SplitRegion,Ext.layout.BorderLayout.Region,{splitTip:\"Drag to resize.\",collapsibleSplitTip:\"Drag to resize. Double click to hide.\",useSplitTips:false,splitSettings:{north:{orientation:Ext.SplitBar.VERTICAL,placement:Ext.SplitBar.TOP,maxFn:\"getVMaxSize\",minProp:\"minHeight\",maxProp:\"maxHeight\"},south:{orientation:Ext.SplitBar.VERTICAL,placement:Ext.SplitBar.BOTTOM,maxFn:\"getVMaxSize\",minProp:\"minHeight\",maxProp:\"maxHeight\"},east:{orientation:Ext.SplitBar.HORIZONTAL,placement:Ext.SplitBar.RIGHT,maxFn:\"getHMaxSize\",minProp:\"minWidth\",maxProp:\"maxWidth\"},west:{orientation:Ext.SplitBar.HORIZONTAL,placement:Ext.SplitBar.LEFT,maxFn:\"getHMaxSize\",minProp:\"minWidth\",maxProp:\"maxWidth\"}},applyFns:{west:function(c){if(this.isCollapsed){return this.applyLayoutCollapsed(c)}var d=this.splitEl.dom,b=d.style;this.panel.setPosition(c.x,c.y);var a=d.offsetWidth;b.left=(c.x+c.width-a)+\"px\";b.top=(c.y)+\"px\";b.height=Math.max(0,c.height)+\"px\";this.panel.setSize(c.width-a,c.height)},east:function(c){if(this.isCollapsed){return this.applyLayoutCollapsed(c)}var d=this.splitEl.dom,b=d.style;var a=d.offsetWidth;this.panel.setPosition(c.x+a,c.y);b.left=(c.x)+\"px\";b.top=(c.y)+\"px\";b.height=Math.max(0,c.height)+\"px\";this.panel.setSize(c.width-a,c.height)},north:function(c){if(this.isCollapsed){return this.applyLayoutCollapsed(c)}var d=this.splitEl.dom,b=d.style;var a=d.offsetHeight;this.panel.setPosition(c.x,c.y);b.left=(c.x)+\"px\";b.top=(c.y+c.height-a)+\"px\";b.width=Math.max(0,c.width)+\"px\";this.panel.setSize(c.width,c.height-a)},south:function(c){if(this.isCollapsed){return this.applyLayoutCollapsed(c)}var d=this.splitEl.dom,b=d.style;var a=d.offsetHeight;this.panel.setPosition(c.x,c.y+a);b.left=(c.x)+\"px\";b.top=(c.y)+\"px\";b.width=Math.max(0,c.width)+\"px\";this.panel.setSize(c.width,c.height-a)}},render:function(a,c){Ext.layout.BorderLayout.SplitRegion.superclass.render.call(this,a,c);var d=this.position;this.splitEl=a.createChild({cls:\"x-layout-split x-layout-split-\"+d,html:\"&#160;\",id:this.panel.id+\"-xsplit\"});if(this.collapseMode==\"mini\"){this.miniSplitEl=this.splitEl.createChild({cls:\"x-layout-mini x-layout-mini-\"+d,html:\"&#160;\"});this.miniSplitEl.addClassOnOver(\"x-layout-mini-over\");this.miniSplitEl.on(\"click\",this.onCollapseClick,this,{stopEvent:true})}var b=this.splitSettings[d];this.split=new Ext.SplitBar(this.splitEl.dom,c.el,b.orientation);this.split.tickSize=this.tickSize;this.split.placement=b.placement;this.split.getMaximumSize=this[b.maxFn].createDelegate(this);this.split.minSize=this.minSize||this[b.minProp];this.split.on(\"beforeapply\",this.onSplitMove,this);this.split.useShim=this.useShim===true;this.maxSize=this.maxSize||this[b.maxProp];if(c.hidden){this.splitEl.hide()}if(this.useSplitTips){this.splitEl.dom.title=this.collapsible?this.collapsibleSplitTip:this.splitTip}if(this.collapsible){this.splitEl.on(\"dblclick\",this.onCollapseClick,this)}},getSize:function(){if(this.isCollapsed){return this.collapsedEl.getSize()}var a=this.panel.getSize();if(this.position==\"north\"||this.position==\"south\"){a.height+=this.splitEl.dom.offsetHeight}else{a.width+=this.splitEl.dom.offsetWidth}return a},getHMaxSize:function(){var b=this.maxSize||10000;var a=this.layout.center;return Math.min(b,(this.el.getWidth()+a.el.getWidth())-a.getMinWidth())},getVMaxSize:function(){var b=this.maxSize||10000;var a=this.layout.center;return Math.min(b,(this.el.getHeight()+a.el.getHeight())-a.getMinHeight())},onSplitMove:function(b,a){var c=this.panel.getSize();this.lastSplitSize=a;if(this.position==\"north\"||this.position==\"south\"){this.panel.setSize(c.width,a);this.state.height=a}else{this.panel.setSize(a,c.height);this.state.width=a}this.layout.layout();this.panel.saveState();return false},getSplitBar:function(){return this.split},destroy:function(){Ext.destroy(this.miniSplitEl,this.split,this.splitEl);Ext.layout.BorderLayout.SplitRegion.superclass.destroy.call(this)}});Ext.Container.LAYOUTS.border=Ext.layout.BorderLayout;Ext.layout.FormLayout=Ext.extend(Ext.layout.AnchorLayout,{labelSeparator:\":\",trackLabels:true,type:\"form\",onRemove:function(d){Ext.layout.FormLayout.superclass.onRemove.call(this,d);if(this.trackLabels){d.un(\"show\",this.onFieldShow,this);d.un(\"hide\",this.onFieldHide,this)}var b=d.getPositionEl(),a=d.getItemCt&&d.getItemCt();if(d.rendered&&a){if(b&&b.dom){b.insertAfter(a)}Ext.destroy(a);Ext.destroyMembers(d,\"label\",\"itemCt\");if(d.customItemCt){Ext.destroyMembers(d,\"getItemCt\",\"customItemCt\")}}},setContainer:function(a){Ext.layout.FormLayout.superclass.setContainer.call(this,a);a.labelAlign=a.labelAlign||this.labelAlign;if(a.labelAlign){a.addClass(\"x-form-label-\"+a.labelAlign)}if(a.hideLabels||this.hideLabels){Ext.apply(this,{labelStyle:\"display:none\",elementStyle:\"padding-left:0;\",labelAdjust:0})}else{this.labelSeparator=Ext.isDefined(a.labelSeparator)?a.labelSeparator:this.labelSeparator;a.labelWidth=a.labelWidth||this.labelWidth||100;if(Ext.isNumber(a.labelWidth)){var b=a.labelPad||this.labelPad;b=Ext.isNumber(b)?b:5;Ext.apply(this,{labelAdjust:a.labelWidth+b,labelStyle:\"width:\"+a.labelWidth+\"px;\",elementStyle:\"padding-left:\"+(a.labelWidth+b)+\"px\"})}if(a.labelAlign==\"top\"){Ext.apply(this,{labelStyle:\"width:auto;\",labelAdjust:0,elementStyle:\"padding-left:0;\"})}}},isHide:function(a){return a.hideLabel||this.container.hideLabels},onFieldShow:function(a){a.getItemCt().removeClass(\"x-hide-\"+a.hideMode);if(a.isComposite){a.doLayout()}},onFieldHide:function(a){a.getItemCt().addClass(\"x-hide-\"+a.hideMode)},getLabelStyle:function(e){var b=\"\",c=[this.labelStyle,e];for(var d=0,a=c.length;d<a;++d){if(c[d]){b+=c[d];if(b.substr(-1,1)!=\";\"){b+=\";\"}}}return b},renderItem:function(e,a,d){if(e&&(e.isFormField||e.fieldLabel)&&e.inputType!=\"hidden\"){var b=this.getTemplateArgs(e);if(Ext.isNumber(a)){a=d.dom.childNodes[a]||null}if(a){e.itemCt=this.fieldTpl.insertBefore(a,b,true)}else{e.itemCt=this.fieldTpl.append(d,b,true)}if(!e.getItemCt){Ext.apply(e,{getItemCt:function(){return e.itemCt},customItemCt:true})}e.label=e.getItemCt().child(\"label.x-form-item-label\");if(!e.rendered){e.render(\"x-form-el-\"+e.id)}else{if(!this.isValidParent(e,d)){Ext.fly(\"x-form-el-\"+e.id).appendChild(e.getPositionEl())}}if(this.trackLabels){if(e.hidden){this.onFieldHide(e)}e.on({scope:this,show:this.onFieldShow,hide:this.onFieldHide})}this.configureItem(e)}else{Ext.layout.FormLayout.superclass.renderItem.apply(this,arguments)}},getTemplateArgs:function(c){var a=!c.fieldLabel||c.hideLabel,b=(c.itemCls||this.container.itemCls||\"\")+(c.hideLabel?\" x-hide-label\":\"\");if(Ext.isIE9&&Ext.isIEQuirks&&c instanceof Ext.form.TextField){b+=\" x-input-wrapper\"}return{id:c.id,label:c.fieldLabel,itemCls:b,clearCls:c.clearCls||\"x-form-clear-left\",labelStyle:this.getLabelStyle(c.labelStyle),elementStyle:this.elementStyle||\"\",labelSeparator:a?\"\":(Ext.isDefined(c.labelSeparator)?c.labelSeparator:this.labelSeparator)}},adjustWidthAnchor:function(a,d){if(d.label&&!this.isHide(d)&&(this.container.labelAlign!=\"top\")){var b=Ext.isIE6||Ext.isIEQuirks;return a-this.labelAdjust+(b?-3:0)}return a},adjustHeightAnchor:function(a,b){if(b.label&&!this.isHide(b)&&(this.container.labelAlign==\"top\")){return a-b.label.getHeight()}return a},isValidParent:function(b,a){return a&&this.container.getEl().contains(b.getPositionEl())}});Ext.Container.LAYOUTS.form=Ext.layout.FormLayout;Ext.layout.AccordionLayout=Ext.extend(Ext.layout.FitLayout,{fill:true,autoWidth:true,titleCollapse:true,hideCollapseTool:false,collapseFirst:false,animate:false,sequence:false,activeOnTop:false,type:\"accordion\",renderItem:function(a){if(this.animate===false){a.animCollapse=false}a.collapsible=true;if(this.autoWidth){a.autoWidth=true}if(this.titleCollapse){a.titleCollapse=true}if(this.hideCollapseTool){a.hideCollapseTool=true}if(this.collapseFirst!==undefined){a.collapseFirst=this.collapseFirst}if(!this.activeItem&&!a.collapsed){this.setActiveItem(a,true)}else{if(this.activeItem&&this.activeItem!=a){a.collapsed=true}}Ext.layout.AccordionLayout.superclass.renderItem.apply(this,arguments);a.header.addClass(\"x-accordion-hd\");a.on(\"beforeexpand\",this.beforeExpand,this)},onRemove:function(a){Ext.layout.AccordionLayout.superclass.onRemove.call(this,a);if(a.rendered){a.header.removeClass(\"x-accordion-hd\")}a.un(\"beforeexpand\",this.beforeExpand,this)},beforeExpand:function(c,b){var a=this.activeItem;if(a){if(this.sequence){delete this.activeItem;if(!a.collapsed){a.collapse({callback:function(){c.expand(b||true)},scope:this});return false}}else{a.collapse(this.animate)}}this.setActive(c);if(this.activeOnTop){c.el.dom.parentNode.insertBefore(c.el.dom,c.el.dom.parentNode.firstChild)}this.layout()},setItemSize:function(g,e){if(this.fill&&g){var d=0,c,b=this.getRenderedItems(this.container),a=b.length,h;for(c=0;c<a;c++){if((h=b[c])!=g&&!h.hidden){d+=h.header.getHeight()}}e.height-=d;g.setSize(e)}},setActiveItem:function(a){this.setActive(a,true)},setActive:function(c,b){var a=this.activeItem;c=this.container.getComponent(c);if(a!=c){if(c.rendered&&c.collapsed&&b){c.expand()}else{if(a){a.fireEvent(\"deactivate\",a)}this.activeItem=c;c.fireEvent(\"activate\",c)}}}});Ext.Container.LAYOUTS.accordion=Ext.layout.AccordionLayout;Ext.layout.Accordion=Ext.layout.AccordionLayout;Ext.layout.TableLayout=Ext.extend(Ext.layout.ContainerLayout,{monitorResize:false,type:\"table\",targetCls:\"x-table-layout-ct\",tableAttrs:null,setContainer:function(a){Ext.layout.TableLayout.superclass.setContainer.call(this,a);this.currentRow=0;this.currentColumn=0;this.cells=[]},onLayout:function(d,g){var e=d.items.items,a=e.length,h,b;if(!this.table){g.addClass(\"x-table-layout-ct\");this.table=g.createChild(Ext.apply({tag:\"table\",cls:\"x-table-layout\",cellspacing:0,cn:{tag:\"tbody\"}},this.tableAttrs),null,true)}this.renderAll(d,g)},getRow:function(a){var b=this.table.tBodies[0].childNodes[a];if(!b){b=document.createElement(\"tr\");this.table.tBodies[0].appendChild(b)}return b},getNextCell:function(j){var a=this.getNextNonSpan(this.currentColumn,this.currentRow);var g=this.currentColumn=a[0],e=this.currentRow=a[1];for(var i=e;i<e+(j.rowspan||1);i++){if(!this.cells[i]){this.cells[i]=[]}for(var d=g;d<g+(j.colspan||1);d++){this.cells[i][d]=true}}var h=document.createElement(\"td\");if(j.cellId){h.id=j.cellId}var b=\"x-table-layout-cell\";if(j.cellCls){b+=\" \"+j.cellCls}h.className=b;if(j.colspan){h.colSpan=j.colspan}if(j.rowspan){h.rowSpan=j.rowspan}this.getRow(e).appendChild(h);return h},getNextNonSpan:function(a,c){var b=this.columns;while((b&&a>=b)||(this.cells[c]&&this.cells[c][a])){if(b&&a>=b){c++;a=0}else{a++}}return[a,c]},renderItem:function(e,a,d){if(!this.table){this.table=d.createChild(Ext.apply({tag:\"table\",cls:\"x-table-layout\",cellspacing:0,cn:{tag:\"tbody\"}},this.tableAttrs),null,true)}if(e&&!e.rendered){e.render(this.getNextCell(e));this.configureItem(e)}else{if(e&&!this.isValidParent(e,d)){var b=this.getNextCell(e);b.insertBefore(e.getPositionEl().dom,null);e.container=Ext.get(b);this.configureItem(e)}}},isValidParent:function(b,a){return b.getPositionEl().up(\"table\",5).dom.parentNode===(a.dom||a)},destroy:function(){delete this.table;Ext.layout.TableLayout.superclass.destroy.call(this)}});Ext.Container.LAYOUTS.table=Ext.layout.TableLayout;Ext.layout.AbsoluteLayout=Ext.extend(Ext.layout.AnchorLayout,{extraCls:\"x-abs-layout-item\",type:\"absolute\",onLayout:function(a,b){b.position();this.paddingLeft=b.getPadding(\"l\");this.paddingTop=b.getPadding(\"t\");Ext.layout.AbsoluteLayout.superclass.onLayout.call(this,a,b)},adjustWidthAnchor:function(b,a){return b?b-a.getPosition(true)[0]+this.paddingLeft:b},adjustHeightAnchor:function(b,a){return b?b-a.getPosition(true)[1]+this.paddingTop:b}});Ext.Container.LAYOUTS.absolute=Ext.layout.AbsoluteLayout;Ext.layout.BoxLayout=Ext.extend(Ext.layout.ContainerLayout,{defaultMargins:{left:0,top:0,right:0,bottom:0},padding:\"0\",pack:\"start\",monitorResize:true,type:\"box\",scrollOffset:0,extraCls:\"x-box-item\",targetCls:\"x-box-layout-ct\",innerCls:\"x-box-inner\",constructor:function(a){Ext.layout.BoxLayout.superclass.constructor.call(this,a);if(Ext.isString(this.defaultMargins)){this.defaultMargins=this.parseMargins(this.defaultMargins)}var d=this.overflowHandler;if(typeof d==\"string\"){d={type:d}}var c=\"none\";if(d&&d.type!=undefined){c=d.type}var b=Ext.layout.boxOverflow[c];if(b[this.type]){b=b[this.type]}this.overflowHandler=new b(this,d)},onLayout:function(b,h){Ext.layout.BoxLayout.superclass.onLayout.call(this,b,h);var d=this.getLayoutTargetSize(),i=this.getVisibleItems(b),c=this.calculateChildBoxes(i,d),g=c.boxes,j=c.meta;if(d.width>0){var k=this.overflowHandler,a=j.tooNarrow?\"handleOverflow\":\"clearOverflow\";var e=k[a](c,d);if(e){if(e.targetSize){d=e.targetSize}if(e.recalculate){i=this.getVisibleItems(b);c=this.calculateChildBoxes(i,d);g=c.boxes}}}this.layoutTargetLastSize=d;this.childBoxCache=c;this.updateInnerCtSize(d,c);this.updateChildBoxes(g);this.handleTargetOverflow(d,b,h)},updateChildBoxes:function(c){for(var b=0,e=c.length;b<e;b++){var d=c[b],a=d.component;if(d.dirtySize){a.setSize(d.width,d.height)}if(isNaN(d.left)||isNaN(d.top)){continue}a.setPosition(d.left,d.top)}},updateInnerCtSize:function(c,h){var i=this.align,g=this.padding,e=c.width,a=c.height;if(this.type==\"hbox\"){var b=e,d=h.meta.maxHeight+g.top+g.bottom;if(i==\"stretch\"){d=a}else{if(i==\"middle\"){d=Math.max(a,d)}}}else{var d=a,b=h.meta.maxWidth+g.left+g.right;if(i==\"stretch\"){b=e}else{if(i==\"center\"){b=Math.max(e,b)}}}this.innerCt.setSize(b||undefined,d||undefined)},handleTargetOverflow:function(d,a,c){var e=c.getStyle(\"overflow\");if(e&&e!=\"hidden\"&&!this.adjustmentPass){var b=this.getLayoutTargetSize();if(b.width!=d.width||b.height!=d.height){this.adjustmentPass=true;this.onLayout(a,c)}}delete this.adjustmentPass},isValidParent:function(b,a){return this.innerCt&&b.getPositionEl().dom.parentNode==this.innerCt.dom},getVisibleItems:function(g){var g=g||this.container,e=g.getLayoutTarget(),h=g.items.items,a=h.length,d,j,b=[];for(d=0;d<a;d++){if((j=h[d]).rendered&&this.isValidParent(j,e)&&j.hidden!==true&&j.collapsed!==true&&j.shouldLayout!==false){b.push(j)}}return b},renderAll:function(a,b){if(!this.innerCt){this.innerCt=b.createChild({cls:this.innerCls});this.padding=this.parseMargins(this.padding)}Ext.layout.BoxLayout.superclass.renderAll.call(this,a,this.innerCt)},getLayoutTargetSize:function(){var b=this.container.getLayoutTarget(),a;if(b){a=b.getViewSize();if(Ext.isIE9m&&Ext.isStrict&&a.width==0){a=b.getStyleSize()}a.width-=b.getPadding(\"lr\");a.height-=b.getPadding(\"tb\")}return a},renderItem:function(a){if(Ext.isString(a.margins)){a.margins=this.parseMargins(a.margins)}else{if(!a.margins){a.margins=this.defaultMargins}}Ext.layout.BoxLayout.superclass.renderItem.apply(this,arguments)},destroy:function(){Ext.destroy(this.overflowHandler);Ext.layout.BoxLayout.superclass.destroy.apply(this,arguments)}});Ext.layout.boxOverflow.None=Ext.extend(Object,{constructor:function(b,a){this.layout=b;Ext.apply(this,a||{})},handleOverflow:Ext.emptyFn,clearOverflow:Ext.emptyFn});Ext.layout.boxOverflow.none=Ext.layout.boxOverflow.None;Ext.layout.boxOverflow.Menu=Ext.extend(Ext.layout.boxOverflow.None,{afterCls:\"x-strip-right\",noItemsMenuText:'<div class=\"x-toolbar-no-items\">(None)</div>',constructor:function(a){Ext.layout.boxOverflow.Menu.superclass.constructor.apply(this,arguments);this.menuItems=[]},createInnerElements:function(){if(!this.afterCt){this.afterCt=this.layout.innerCt.insertSibling({cls:this.afterCls},\"before\")}},clearOverflow:function(a,g){var e=g.width+(this.afterCt?this.afterCt.getWidth():0),b=this.menuItems;this.hideTrigger();for(var c=0,d=b.length;c<d;c++){b.pop().component.show()}return{targetSize:{height:g.height,width:e}}},showTrigger:function(){this.createMenu();this.menuTrigger.show()},hideTrigger:function(){if(this.menuTrigger!=undefined){this.menuTrigger.hide()}},beforeMenuShow:function(h){var b=this.menuItems,a=b.length,g,e;var c=function(j,i){return j.isXType(\"buttongroup\")&&!(i instanceof Ext.Toolbar.Separator)};this.clearMenu();h.removeAll();for(var d=0;d<a;d++){g=b[d].component;if(e&&(c(g,e)||c(e,g))){h.add(\"-\")}this.addComponentToMenu(h,g);e=g}if(h.items.length<1){h.add(this.noItemsMenuText)}},createMenuConfig:function(c,a){var b=Ext.apply({},c.initialConfig),d=c.toggleGroup;Ext.copyTo(b,c,[\"iconCls\",\"icon\",\"itemId\",\"disabled\",\"handler\",\"scope\",\"menu\"]);Ext.apply(b,{text:c.overflowText||c.text,hideOnClick:a});if(d||c.enableToggle){Ext.apply(b,{group:d,checked:c.pressed,listeners:{checkchange:function(g,e){c.toggle(e)}}})}delete b.ownerCt;delete b.xtype;delete b.id;return b},addComponentToMenu:function(b,a){if(a instanceof Ext.Toolbar.Separator){b.add(\"-\")}else{if(Ext.isFunction(a.isXType)){if(a.isXType(\"splitbutton\")){b.add(this.createMenuConfig(a,true))}else{if(a.isXType(\"button\")){b.add(this.createMenuConfig(a,!a.menu))}else{if(a.isXType(\"buttongroup\")){a.items.each(function(c){this.addComponentToMenu(b,c)},this)}}}}}},clearMenu:function(){var a=this.moreMenu;if(a&&a.items){a.items.each(function(b){delete b.menu})}},createMenu:function(){if(!this.menuTrigger){this.createInnerElements();this.menu=new Ext.menu.Menu({ownerCt:this.layout.container,listeners:{scope:this,beforeshow:this.beforeMenuShow}});this.menuTrigger=new Ext.Button({iconCls:\"x-toolbar-more-icon\",cls:\"x-toolbar-more\",menu:this.menu,renderTo:this.afterCt})}},destroy:function(){Ext.destroy(this.menu,this.menuTrigger)}});Ext.layout.boxOverflow.menu=Ext.layout.boxOverflow.Menu;Ext.layout.boxOverflow.HorizontalMenu=Ext.extend(Ext.layout.boxOverflow.Menu,{constructor:function(){Ext.layout.boxOverflow.HorizontalMenu.superclass.constructor.apply(this,arguments);var c=this,b=c.layout,a=b.calculateChildBoxes;b.calculateChildBoxes=function(d,i){var l=a.apply(b,arguments),k=l.meta,e=c.menuItems;var j=0;for(var g=0,h=e.length;g<h;g++){j+=e[g].width}k.minimumWidth+=j;k.tooNarrow=k.minimumWidth>i.width;return l}},handleOverflow:function(d,h){this.showTrigger();var k=h.width-this.afterCt.getWidth(),l=d.boxes,e=0,r=false;for(var o=0,c=l.length;o<c;o++){e+=l[o].width}var a=k-e,g=0;for(var o=0,c=this.menuItems.length;o<c;o++){var n=this.menuItems[o],m=n.component,b=n.width;if(b<a){m.show();a-=b;g++;r=true}else{break}}if(r){this.menuItems=this.menuItems.slice(g)}else{for(var j=l.length-1;j>=0;j--){var q=l[j].component,p=l[j].left+l[j].width;if(p>=k){this.menuItems.unshift({component:q,width:l[j].width});q.hide()}else{break}}}if(this.menuItems.length==0){this.hideTrigger()}return{targetSize:{height:h.height,width:k},recalculate:r}}});Ext.layout.boxOverflow.menu.hbox=Ext.layout.boxOverflow.HorizontalMenu;Ext.layout.boxOverflow.Scroller=Ext.extend(Ext.layout.boxOverflow.None,{animateScroll:true,scrollIncrement:100,wheelIncrement:3,scrollRepeatInterval:400,scrollDuration:0.4,beforeCls:\"x-strip-left\",afterCls:\"x-strip-right\",scrollerCls:\"x-strip-scroller\",beforeScrollerCls:\"x-strip-scroller-left\",afterScrollerCls:\"x-strip-scroller-right\",createWheelListener:function(){this.layout.innerCt.on({scope:this,mousewheel:function(a){a.stopEvent();this.scrollBy(a.getWheelDelta()*this.wheelIncrement*-1,false)}})},handleOverflow:function(a,b){this.createInnerElements();this.showScrollers()},clearOverflow:function(){this.hideScrollers()},showScrollers:function(){this.createScrollers();this.beforeScroller.show();this.afterScroller.show();this.updateScrollButtons()},hideScrollers:function(){if(this.beforeScroller!=undefined){this.beforeScroller.hide();this.afterScroller.hide()}},createScrollers:function(){if(!this.beforeScroller&&!this.afterScroller){var a=this.beforeCt.createChild({cls:String.format(\"{0} {1} \",this.scrollerCls,this.beforeScrollerCls)});var b=this.afterCt.createChild({cls:String.format(\"{0} {1}\",this.scrollerCls,this.afterScrollerCls)});a.addClassOnOver(this.beforeScrollerCls+\"-hover\");b.addClassOnOver(this.afterScrollerCls+\"-hover\");a.setVisibilityMode(Ext.Element.DISPLAY);b.setVisibilityMode(Ext.Element.DISPLAY);this.beforeRepeater=new Ext.util.ClickRepeater(a,{interval:this.scrollRepeatInterval,handler:this.scrollLeft,scope:this});this.afterRepeater=new Ext.util.ClickRepeater(b,{interval:this.scrollRepeatInterval,handler:this.scrollRight,scope:this});this.beforeScroller=a;this.afterScroller=b}},destroy:function(){Ext.destroy(this.beforeScroller,this.afterScroller,this.beforeRepeater,this.afterRepeater,this.beforeCt,this.afterCt)},scrollBy:function(b,a){this.scrollTo(this.getScrollPosition()+b,a)},getItem:function(a){if(Ext.isString(a)){a=Ext.getCmp(a)}else{if(Ext.isNumber(a)){a=this.items[a]}}return a},getScrollAnim:function(){return{duration:this.scrollDuration,callback:this.updateScrollButtons,scope:this}},updateScrollButtons:function(){if(this.beforeScroller==undefined||this.afterScroller==undefined){return}var d=this.atExtremeBefore()?\"addClass\":\"removeClass\",c=this.atExtremeAfter()?\"addClass\":\"removeClass\",a=this.beforeScrollerCls+\"-disabled\",b=this.afterScrollerCls+\"-disabled\";this.beforeScroller[d](a);this.afterScroller[c](b);this.scrolling=false},atExtremeBefore:function(){return this.getScrollPosition()===0},scrollLeft:function(a){this.scrollBy(-this.scrollIncrement,a)},scrollRight:function(a){this.scrollBy(this.scrollIncrement,a)},scrollToItem:function(d,b){d=this.getItem(d);if(d!=undefined){var a=this.getItemVisibility(d);if(!a.fullyVisible){var c=d.getBox(true,true),e=c.x;if(a.hiddenRight){e-=(this.layout.innerCt.getWidth()-c.width)}this.scrollTo(e,b)}}},getItemVisibility:function(e){var d=this.getItem(e).getBox(true,true),a=d.x,c=d.x+d.width,g=this.getScrollPosition(),b=this.layout.innerCt.getWidth()+g;return{hiddenLeft:a<g,hiddenRight:c>b,fullyVisible:a>g&&c<b}}});Ext.layout.boxOverflow.scroller=Ext.layout.boxOverflow.Scroller;Ext.layout.boxOverflow.VerticalScroller=Ext.extend(Ext.layout.boxOverflow.Scroller,{scrollIncrement:75,wheelIncrement:2,handleOverflow:function(a,b){Ext.layout.boxOverflow.VerticalScroller.superclass.handleOverflow.apply(this,arguments);return{targetSize:{height:b.height-(this.beforeCt.getHeight()+this.afterCt.getHeight()),width:b.width}}},createInnerElements:function(){var a=this.layout.innerCt;if(!this.beforeCt){this.beforeCt=a.insertSibling({cls:this.beforeCls},\"before\");this.afterCt=a.insertSibling({cls:this.afterCls},\"after\");this.createWheelListener()}},scrollTo:function(a,b){var d=this.getScrollPosition(),c=a.constrain(0,this.getMaxScrollBottom());if(c!=d&&!this.scrolling){if(b==undefined){b=this.animateScroll}this.layout.innerCt.scrollTo(\"top\",c,b?this.getScrollAnim():false);if(b){this.scrolling=true}else{this.scrolling=false;this.updateScrollButtons()}}},getScrollPosition:function(){return parseInt(this.layout.innerCt.dom.scrollTop,10)||0},getMaxScrollBottom:function(){return this.layout.innerCt.dom.scrollHeight-this.layout.innerCt.getHeight()},atExtremeAfter:function(){return this.getScrollPosition()>=this.getMaxScrollBottom()}});Ext.layout.boxOverflow.scroller.vbox=Ext.layout.boxOverflow.VerticalScroller;Ext.layout.boxOverflow.HorizontalScroller=Ext.extend(Ext.layout.boxOverflow.Scroller,{handleOverflow:function(a,b){Ext.layout.boxOverflow.HorizontalScroller.superclass.handleOverflow.apply(this,arguments);return{targetSize:{height:b.height,width:b.width-(this.beforeCt.getWidth()+this.afterCt.getWidth())}}},createInnerElements:function(){var a=this.layout.innerCt;if(!this.beforeCt){this.afterCt=a.insertSibling({cls:this.afterCls},\"before\");this.beforeCt=a.insertSibling({cls:this.beforeCls},\"before\");this.createWheelListener()}},scrollTo:function(a,b){var d=this.getScrollPosition(),c=a.constrain(0,this.getMaxScrollRight());if(c!=d&&!this.scrolling){if(b==undefined){b=this.animateScroll}this.layout.innerCt.scrollTo(\"left\",c,b?this.getScrollAnim():false);if(b){this.scrolling=true}else{this.scrolling=false;this.updateScrollButtons()}}},getScrollPosition:function(){return parseInt(this.layout.innerCt.dom.scrollLeft,10)||0},getMaxScrollRight:function(){return this.layout.innerCt.dom.scrollWidth-this.layout.innerCt.getWidth()},atExtremeAfter:function(){return this.getScrollPosition()>=this.getMaxScrollRight()}});Ext.layout.boxOverflow.scroller.hbox=Ext.layout.boxOverflow.HorizontalScroller;Ext.layout.HBoxLayout=Ext.extend(Ext.layout.BoxLayout,{align:\"top\",type:\"hbox\",calculateChildBoxes:function(r,b){var F=r.length,R=this.padding,D=R.top,U=R.left,y=D+R.bottom,O=U+R.right,a=b.width-this.scrollOffset,e=b.height,o=Math.max(0,e-y),P=this.pack==\"start\",W=this.pack==\"center\",A=this.pack==\"end\",L=0,Q=0,T=0,l=0,X=0,H=[],k,J,M,V,w,j,S,I,c,x,q,N;for(S=0;S<F;S++){k=r[S];M=k.height;J=k.width;j=!k.hasLayout&&typeof k.doLayout==\"function\";if(typeof J!=\"number\"){if(k.flex&&!J){T+=k.flex}else{if(!J&&j){k.doLayout()}V=k.getSize();J=V.width;M=V.height}}w=k.margins;x=w.left+w.right;L+=x+(J||0);l+=x+(k.flex?k.minWidth||0:J);X+=x+(k.minWidth||J||0);if(typeof M!=\"number\"){if(j){k.doLayout()}M=k.getHeight()}Q=Math.max(Q,M+w.top+w.bottom);H.push({component:k,height:M||undefined,width:J||undefined})}var K=l-a,p=X>a;var n=Math.max(0,a-L-O);if(p){for(S=0;S<F;S++){H[S].width=r[S].minWidth||r[S].width||H[S].width}}else{if(K>0){var C=[];for(var E=0,v=F;E<v;E++){var B=r[E],t=B.minWidth||0;if(B.flex){H[E].width=t}else{C.push({minWidth:t,available:H[E].width-t,index:E})}}C.sort(function(Y,i){return Y.available>i.available?1:-1});for(var S=0,v=C.length;S<v;S++){var G=C[S].index;if(G==undefined){continue}var B=r[G],m=H[G],u=m.width,t=B.minWidth,d=Math.max(t,u-Math.ceil(K/(v-S))),g=u-d;H[G].width=d;K-=g}}else{var h=n,s=T;for(S=0;S<F;S++){k=r[S];I=H[S];w=k.margins;q=w.top+w.bottom;if(P&&k.flex&&!k.width){c=Math.ceil((k.flex/s)*h);h-=c;s-=k.flex;I.width=c;I.dirtySize=true}}}}if(W){U+=n/2}else{if(A){U+=n}}for(S=0;S<F;S++){k=r[S];I=H[S];w=k.margins;U+=w.left;q=w.top+w.bottom;I.left=U;I.top=D+w.top;switch(this.align){case\"stretch\":N=o-q;I.height=N.constrain(k.minHeight||0,k.maxHeight||1000000);I.dirtySize=true;break;case\"stretchmax\":N=Q-q;I.height=N.constrain(k.minHeight||0,k.maxHeight||1000000);I.dirtySize=true;break;case\"middle\":var z=o-I.height-q;if(z>0){I.top=D+q+(z/2)}}U+=I.width+w.right}return{boxes:H,meta:{maxHeight:Q,nonFlexWidth:L,desiredWidth:l,minimumWidth:X,shortfall:l-a,tooNarrow:p}}}});Ext.Container.LAYOUTS.hbox=Ext.layout.HBoxLayout;Ext.layout.VBoxLayout=Ext.extend(Ext.layout.BoxLayout,{align:\"left\",type:\"vbox\",calculateChildBoxes:function(o,b){var E=o.length,R=this.padding,C=R.top,V=R.left,x=C+R.bottom,O=V+R.right,a=b.width-this.scrollOffset,c=b.height,K=Math.max(0,a-O),P=this.pack==\"start\",X=this.pack==\"center\",z=this.pack==\"end\",k=0,u=0,U=0,L=0,m=0,G=[],h,I,N,W,t,g,T,H,S,w,n,d,r;for(T=0;T<E;T++){h=o[T];N=h.height;I=h.width;g=!h.hasLayout&&typeof h.doLayout==\"function\";if(typeof N!=\"number\"){if(h.flex&&!N){U+=h.flex}else{if(!N&&g){h.doLayout()}W=h.getSize();I=W.width;N=W.height}}t=h.margins;n=t.top+t.bottom;k+=n+(N||0);L+=n+(h.flex?h.minHeight||0:N);m+=n+(h.minHeight||N||0);if(typeof I!=\"number\"){if(g){h.doLayout()}I=h.getWidth()}u=Math.max(u,I+t.left+t.right);G.push({component:h,height:N||undefined,width:I||undefined})}var M=L-c,l=m>c;var q=Math.max(0,(c-k-x));if(l){for(T=0,r=E;T<r;T++){G[T].height=o[T].minHeight||o[T].height||G[T].height}}else{if(M>0){var J=[];for(var D=0,r=E;D<r;D++){var A=o[D],s=A.minHeight||0;if(A.flex){G[D].height=s}else{J.push({minHeight:s,available:G[D].height-s,index:D})}}J.sort(function(Y,i){return Y.available>i.available?1:-1});for(var T=0,r=J.length;T<r;T++){var F=J[T].index;if(F==undefined){continue}var A=o[F],j=G[F],v=j.height,s=A.minHeight,B=Math.max(s,v-Math.ceil(M/(r-T))),e=v-B;G[F].height=B;M-=e}}else{var Q=q,p=U;for(T=0;T<E;T++){h=o[T];H=G[T];t=h.margins;w=t.left+t.right;if(P&&h.flex&&!h.height){S=Math.ceil((h.flex/p)*Q);Q-=S;p-=h.flex;H.height=S;H.dirtySize=true}}}}if(X){C+=q/2}else{if(z){C+=q}}for(T=0;T<E;T++){h=o[T];H=G[T];t=h.margins;C+=t.top;w=t.left+t.right;H.left=V+t.left;H.top=C;switch(this.align){case\"stretch\":d=K-w;H.width=d.constrain(h.minWidth||0,h.maxWidth||1000000);H.dirtySize=true;break;case\"stretchmax\":d=u-w;H.width=d.constrain(h.minWidth||0,h.maxWidth||1000000);H.dirtySize=true;break;case\"center\":var y=K-H.width-w;if(y>0){H.left=V+w+(y/2)}}C+=H.height+t.bottom}return{boxes:G,meta:{maxWidth:u,nonFlexHeight:k,desiredHeight:L,minimumHeight:m,shortfall:L-c,tooNarrow:l}}}});Ext.Container.LAYOUTS.vbox=Ext.layout.VBoxLayout;Ext.layout.ToolbarLayout=Ext.extend(Ext.layout.ContainerLayout,{monitorResize:true,type:\"toolbar\",triggerWidth:18,noItemsMenuText:'<div class=\"x-toolbar-no-items\">(None)</div>',lastOverflow:false,tableHTML:['<table cellspacing=\"0\" class=\"x-toolbar-ct\">',\"<tbody>\",\"<tr>\",'<td class=\"x-toolbar-left\" align=\"{0}\">','<table cellspacing=\"0\">',\"<tbody>\",'<tr class=\"x-toolbar-left-row\"></tr>',\"</tbody>\",\"</table>\",\"</td>\",'<td class=\"x-toolbar-right\" align=\"right\">','<table cellspacing=\"0\" class=\"x-toolbar-right-ct\">',\"<tbody>\",\"<tr>\",\"<td>\",'<table cellspacing=\"0\">',\"<tbody>\",'<tr class=\"x-toolbar-right-row\"></tr>',\"</tbody>\",\"</table>\",\"</td>\",\"<td>\",'<table cellspacing=\"0\">',\"<tbody>\",'<tr class=\"x-toolbar-extras-row\"></tr>',\"</tbody>\",\"</table>\",\"</td>\",\"</tr>\",\"</tbody>\",\"</table>\",\"</td>\",\"</tr>\",\"</tbody>\",\"</table>\"].join(\"\"),onLayout:function(e,j){if(!this.leftTr){var h=e.buttonAlign==\"center\"?\"center\":\"left\";j.addClass(\"x-toolbar-layout-ct\");j.insertHtml(\"beforeEnd\",String.format(this.tableHTML,h));this.leftTr=j.child(\"tr.x-toolbar-left-row\",true);this.rightTr=j.child(\"tr.x-toolbar-right-row\",true);this.extrasTr=j.child(\"tr.x-toolbar-extras-row\",true);if(this.hiddenItem==undefined){this.hiddenItems=[]}}var k=e.buttonAlign==\"right\"?this.rightTr:this.leftTr,l=e.items.items,d=0;for(var b=0,g=l.length,m;b<g;b++,d++){m=l[b];if(m.isFill){k=this.rightTr;d=-1}else{if(!m.rendered){m.render(this.insertCell(m,k,d));this.configureItem(m)}else{if(!m.xtbHidden&&!this.isValidParent(m,k.childNodes[d])){var a=this.insertCell(m,k,d);a.appendChild(m.getPositionEl().dom);m.container=Ext.get(a)}}}}this.cleanup(this.leftTr);this.cleanup(this.rightTr);this.cleanup(this.extrasTr);this.fitToSize(j)},cleanup:function(b){var e=b.childNodes,a,d;for(a=e.length-1;a>=0&&(d=e[a]);a--){if(!d.firstChild){b.removeChild(d)}}},insertCell:function(e,b,a){var d=document.createElement(\"td\");d.className=\"x-toolbar-cell\";b.insertBefore(d,b.childNodes[a]||null);return d},hideItem:function(a){this.hiddenItems.push(a);a.xtbHidden=true;a.xtbWidth=a.getPositionEl().dom.parentNode.offsetWidth;a.hide()},unhideItem:function(a){a.show();a.xtbHidden=false;this.hiddenItems.remove(a)},getItemWidth:function(a){return a.hidden?(a.xtbWidth||0):a.getPositionEl().dom.parentNode.offsetWidth},fitToSize:function(k){if(this.container.enableOverflow===false){return}var b=k.dom.clientWidth,j=k.dom.firstChild.offsetWidth,m=b-this.triggerWidth,a=this.lastWidth||0,c=this.hiddenItems,e=c.length!=0,n=b>=a;this.lastWidth=b;if(j>b||(e&&n)){var l=this.container.items.items,h=l.length,d=0,o;for(var g=0;g<h;g++){o=l[g];if(!o.isFill){d+=this.getItemWidth(o);if(d>m){if(!(o.hidden||o.xtbHidden)){this.hideItem(o)}}else{if(o.xtbHidden){this.unhideItem(o)}}}}}e=c.length!=0;if(e){this.initMore();if(!this.lastOverflow){this.container.fireEvent(\"overflowchange\",this.container,true);this.lastOverflow=true}}else{if(this.more){this.clearMenu();this.more.destroy();delete this.more;if(this.lastOverflow){this.container.fireEvent(\"overflowchange\",this.container,false);this.lastOverflow=false}}}},createMenuConfig:function(c,a){var b=Ext.apply({},c.initialConfig),d=c.toggleGroup;Ext.copyTo(b,c,[\"iconCls\",\"icon\",\"itemId\",\"disabled\",\"handler\",\"scope\",\"menu\"]);Ext.apply(b,{text:c.overflowText||c.text,hideOnClick:a});if(d||c.enableToggle){Ext.apply(b,{group:d,checked:c.pressed,listeners:{checkchange:function(g,e){c.toggle(e)}}})}delete b.ownerCt;delete b.xtype;delete b.id;return b},addComponentToMenu:function(b,a){if(a instanceof Ext.Toolbar.Separator){b.add(\"-\")}else{if(Ext.isFunction(a.isXType)){if(a.isXType(\"splitbutton\")){b.add(this.createMenuConfig(a,true))}else{if(a.isXType(\"button\")){b.add(this.createMenuConfig(a,!a.menu))}else{if(a.isXType(\"buttongroup\")){a.items.each(function(c){this.addComponentToMenu(b,c)},this)}}}}}},clearMenu:function(){var a=this.moreMenu;if(a&&a.items){a.items.each(function(b){delete b.menu})}},beforeMoreShow:function(h){var b=this.container.items.items,a=b.length,g,e;var c=function(j,i){return j.isXType(\"buttongroup\")&&!(i instanceof Ext.Toolbar.Separator)};this.clearMenu();h.removeAll();for(var d=0;d<a;d++){g=b[d];if(g.xtbHidden){if(e&&(c(g,e)||c(e,g))){h.add(\"-\")}this.addComponentToMenu(h,g);e=g}}if(h.items.length<1){h.add(this.noItemsMenuText)}},initMore:function(){if(!this.more){this.moreMenu=new Ext.menu.Menu({ownerCt:this.container,listeners:{beforeshow:this.beforeMoreShow,scope:this}});this.more=new Ext.Button({iconCls:\"x-toolbar-more-icon\",cls:\"x-toolbar-more\",menu:this.moreMenu,ownerCt:this.container});var a=this.insertCell(this.more,this.extrasTr,100);this.more.render(a)}},destroy:function(){Ext.destroy(this.more,this.moreMenu);delete this.leftTr;delete this.rightTr;delete this.extrasTr;Ext.layout.ToolbarLayout.superclass.destroy.call(this)}});Ext.Container.LAYOUTS.toolbar=Ext.layout.ToolbarLayout;Ext.layout.MenuLayout=Ext.extend(Ext.layout.ContainerLayout,{monitorResize:true,type:\"menu\",setContainer:function(a){this.monitorResize=!a.floating;a.on(\"autosize\",this.doAutoSize,this);Ext.layout.MenuLayout.superclass.setContainer.call(this,a)},renderItem:function(g,b,e){if(!this.itemTpl){this.itemTpl=Ext.layout.MenuLayout.prototype.itemTpl=new Ext.XTemplate('<li id=\"{itemId}\" class=\"{itemCls}\">','<tpl if=\"needsIcon\">','<img alt=\"{altText}\" src=\"{icon}\" class=\"{iconCls}\"/>',\"</tpl>\",\"</li>\")}if(g&&!g.rendered){if(Ext.isNumber(b)){b=e.dom.childNodes[b]}var d=this.getItemArgs(g);g.render(g.positionEl=b?this.itemTpl.insertBefore(b,d,true):this.itemTpl.append(e,d,true));g.positionEl.menuItemId=g.getItemId();if(!d.isMenuItem&&d.needsIcon){g.positionEl.addClass(\"x-menu-list-item-indent\")}this.configureItem(g)}else{if(g&&!this.isValidParent(g,e)){if(Ext.isNumber(b)){b=e.dom.childNodes[b]}e.dom.insertBefore(g.getActionEl().dom,b||null)}}},getItemArgs:function(d){var a=d instanceof Ext.menu.Item,b=!(a||d instanceof Ext.menu.Separator);return{isMenuItem:a,needsIcon:b&&(d.icon||d.iconCls),icon:d.icon||Ext.BLANK_IMAGE_URL,iconCls:\"x-menu-item-icon \"+(d.iconCls||\"\"),itemId:\"x-menu-el-\"+d.id,itemCls:\"x-menu-list-item \",altText:d.altText||\"\"}},isValidParent:function(b,a){return b.el.up(\"li.x-menu-list-item\",5).dom.parentNode===(a.dom||a)},onLayout:function(a,b){Ext.layout.MenuLayout.superclass.onLayout.call(this,a,b);this.doAutoSize()},doAutoSize:function(){var c=this.container,a=c.width;if(c.floating){if(a){c.setWidth(a)}else{if(Ext.isIE9m){c.setWidth(Ext.isStrict&&(Ext.isIE7||Ext.isIE8||Ext.isIE9)?\"auto\":c.minWidth);var d=c.getEl(),b=d.dom.offsetWidth;c.setWidth(c.getLayoutTarget().getWidth()+d.getFrameWidth(\"lr\"))}}}}});Ext.Container.LAYOUTS.menu=Ext.layout.MenuLayout;Ext.Viewport=Ext.extend(Ext.Container,{initComponent:function(){Ext.Viewport.superclass.initComponent.call(this);document.getElementsByTagName(\"html\")[0].className+=\" x-viewport\";this.el=Ext.getBody();this.el.setHeight=Ext.emptyFn;this.el.setWidth=Ext.emptyFn;this.el.setSize=Ext.emptyFn;this.el.dom.scroll=\"no\";this.allowDomMove=false;this.autoWidth=true;this.autoHeight=true;Ext.EventManager.onWindowResize(this.fireResize,this);this.renderTo=this.el},fireResize:function(a,b){this.fireEvent(\"resize\",this,a,b,a,b)}});Ext.reg(\"viewport\",Ext.Viewport);Ext.Panel=Ext.extend(Ext.Container,{baseCls:\"x-panel\",collapsedCls:\"x-panel-collapsed\",maskDisabled:true,animCollapse:Ext.enableFx,headerAsText:true,buttonAlign:\"right\",collapsed:false,collapseFirst:true,minButtonWidth:75,elements:\"body\",preventBodyReset:false,padding:undefined,resizeEvent:\"bodyresize\",toolTarget:\"header\",collapseEl:\"bwrap\",slideAnchor:\"t\",disabledClass:\"\",deferHeight:true,expandDefaults:{duration:0.25},collapseDefaults:{duration:0.25},initComponent:function(){Ext.Panel.superclass.initComponent.call(this);this.addEvents(\"bodyresize\",\"titlechange\",\"iconchange\",\"collapse\",\"expand\",\"beforecollapse\",\"beforeexpand\",\"beforeclose\",\"close\",\"activate\",\"deactivate\");if(this.unstyled){this.baseCls=\"x-plain\"}this.toolbars=[];if(this.tbar){this.elements+=\",tbar\";this.topToolbar=this.createToolbar(this.tbar);this.tbar=null}if(this.bbar){this.elements+=\",bbar\";this.bottomToolbar=this.createToolbar(this.bbar);this.bbar=null}if(this.header===true){this.elements+=\",header\";this.header=null}else{if(this.headerCfg||(this.title&&this.header!==false)){this.elements+=\",header\"}}if(this.footerCfg||this.footer===true){this.elements+=\",footer\";this.footer=null}if(this.buttons){this.fbar=this.buttons;this.buttons=null}if(this.fbar){this.createFbar(this.fbar)}if(this.autoLoad){this.on(\"render\",this.doAutoLoad,this,{delay:10})}},createFbar:function(b){var a=this.minButtonWidth;this.elements+=\",footer\";this.fbar=this.createToolbar(b,{buttonAlign:this.buttonAlign,toolbarCls:\"x-panel-fbar\",enableOverflow:false,defaults:function(d){return{minWidth:d.minWidth||a}}});this.fbar.items.each(function(d){d.minWidth=d.minWidth||this.minButtonWidth},this);this.buttons=this.fbar.items.items},createToolbar:function(b,c){var a;if(Ext.isArray(b)){b={items:b}}a=b.events?Ext.apply(b,c):this.createComponent(Ext.apply({},b,c),\"toolbar\");this.toolbars.push(a);return a},createElement:function(a,c){if(this[a]){c.appendChild(this[a].dom);return}if(a===\"bwrap\"||this.elements.indexOf(a)!=-1){if(this[a+\"Cfg\"]){this[a]=Ext.fly(c).createChild(this[a+\"Cfg\"])}else{var b=document.createElement(\"div\");b.className=this[a+\"Cls\"];this[a]=Ext.get(c.appendChild(b))}if(this[a+\"CssClass\"]){this[a].addClass(this[a+\"CssClass\"])}if(this[a+\"Style\"]){this[a].applyStyles(this[a+\"Style\"])}}},onRender:function(g,e){Ext.Panel.superclass.onRender.call(this,g,e);this.createClasses();var a=this.el,h=a.dom,k,i;if(this.collapsible&&!this.hideCollapseTool){this.tools=this.tools?this.tools.slice(0):[];this.tools[this.collapseFirst?\"unshift\":\"push\"]({id:\"toggle\",handler:this.toggleCollapse,scope:this})}if(this.tools){i=this.tools;this.elements+=(this.header!==false)?\",header\":\"\"}this.tools={};a.addClass(this.baseCls);if(h.firstChild){this.header=a.down(\".\"+this.headerCls);this.bwrap=a.down(\".\"+this.bwrapCls);var j=this.bwrap?this.bwrap:a;this.tbar=j.down(\".\"+this.tbarCls);this.body=j.down(\".\"+this.bodyCls);this.bbar=j.down(\".\"+this.bbarCls);this.footer=j.down(\".\"+this.footerCls);this.fromMarkup=true}if(this.preventBodyReset===true){a.addClass(\"x-panel-reset\")}if(this.cls){a.addClass(this.cls)}if(this.buttons){this.elements+=\",footer\"}if(this.frame){a.insertHtml(\"afterBegin\",String.format(Ext.Element.boxMarkup,this.baseCls));this.createElement(\"header\",h.firstChild.firstChild.firstChild);this.createElement(\"bwrap\",h);k=this.bwrap.dom;var c=h.childNodes[1],b=h.childNodes[2];k.appendChild(c);k.appendChild(b);var l=k.firstChild.firstChild.firstChild;this.createElement(\"tbar\",l);this.createElement(\"body\",l);this.createElement(\"bbar\",l);this.createElement(\"footer\",k.lastChild.firstChild.firstChild);if(!this.footer){this.bwrap.dom.lastChild.className+=\" x-panel-nofooter\"}this.ft=Ext.get(this.bwrap.dom.lastChild);this.mc=Ext.get(l)}else{this.createElement(\"header\",h);this.createElement(\"bwrap\",h);k=this.bwrap.dom;this.createElement(\"tbar\",k);this.createElement(\"body\",k);this.createElement(\"bbar\",k);this.createElement(\"footer\",k);if(!this.header){this.body.addClass(this.bodyCls+\"-noheader\");if(this.tbar){this.tbar.addClass(this.tbarCls+\"-noheader\")}}}if(Ext.isDefined(this.padding)){this.body.setStyle(\"padding\",this.body.addUnits(this.padding))}if(this.border===false){this.el.addClass(this.baseCls+\"-noborder\");this.body.addClass(this.bodyCls+\"-noborder\");if(this.header){this.header.addClass(this.headerCls+\"-noborder\")}if(this.footer){this.footer.addClass(this.footerCls+\"-noborder\")}if(this.tbar){this.tbar.addClass(this.tbarCls+\"-noborder\")}if(this.bbar){this.bbar.addClass(this.bbarCls+\"-noborder\")}}if(this.bodyBorder===false){this.body.addClass(this.bodyCls+\"-noborder\")}this.bwrap.enableDisplayMode(\"block\");if(this.header){this.header.unselectable();if(this.headerAsText){this.header.dom.innerHTML='<span class=\"'+this.headerTextCls+'\">'+this.header.dom.innerHTML+\"</span>\";if(this.iconCls){this.setIconClass(this.iconCls)}}}if(this.floating){this.makeFloating(this.floating)}if(this.collapsible&&this.titleCollapse&&this.header){this.mon(this.header,\"click\",this.toggleCollapse,this);this.header.setStyle(\"cursor\",\"pointer\")}if(i){this.addTool.apply(this,i)}if(this.fbar){this.footer.addClass(\"x-panel-btns\");this.fbar.ownerCt=this;this.fbar.render(this.footer);this.footer.createChild({cls:\"x-clear\"})}if(this.tbar&&this.topToolbar){this.topToolbar.ownerCt=this;this.topToolbar.render(this.tbar)}if(this.bbar&&this.bottomToolbar){this.bottomToolbar.ownerCt=this;this.bottomToolbar.render(this.bbar)}},setIconClass:function(b){var a=this.iconCls;this.iconCls=b;if(this.rendered&&this.header){if(this.frame){this.header.addClass(\"x-panel-icon\");this.header.replaceClass(a,this.iconCls)}else{var e=this.header,c=e.child(\"img.x-panel-inline-icon\");if(c){Ext.fly(c).replaceClass(a,this.iconCls)}else{var d=e.child(\"span.\"+this.headerTextCls);if(d){Ext.DomHelper.insertBefore(d.dom,{tag:\"img\",alt:\"\",src:Ext.BLANK_IMAGE_URL,cls:\"x-panel-inline-icon \"+this.iconCls})}}}}this.fireEvent(\"iconchange\",this,b,a)},makeFloating:function(a){this.floating=true;this.el=new Ext.Layer(Ext.apply({},a,{shadow:Ext.isDefined(this.shadow)?this.shadow:\"sides\",shadowOffset:this.shadowOffset,constrain:false,shim:this.shim===false?false:undefined}),this.el)},getTopToolbar:function(){return this.topToolbar},getBottomToolbar:function(){return this.bottomToolbar},getFooterToolbar:function(){return this.fbar},addButton:function(a,c,b){if(!this.fbar){this.createFbar([])}if(c){if(Ext.isString(a)){a={text:a}}a=Ext.apply({handler:c,scope:b},a)}return this.fbar.add(a)},addTool:function(){if(!this.rendered){if(!this.tools){this.tools=[]}Ext.each(arguments,function(a){this.tools.push(a)},this);return}if(!this[this.toolTarget]){return}if(!this.toolTemplate){var h=new Ext.Template('<div class=\"x-tool x-tool-{id}\">&#160;</div>');h.disableFormats=true;h.compile();Ext.Panel.prototype.toolTemplate=h}for(var g=0,d=arguments,c=d.length;g<c;g++){var b=d[g];if(!this.tools[b.id]){var j=\"x-tool-\"+b.id+\"-over\";var e=this.toolTemplate.insertFirst(this[this.toolTarget],b,true);this.tools[b.id]=e;e.enableDisplayMode(\"block\");this.mon(e,\"click\",this.createToolHandler(e,b,j,this));if(b.on){this.mon(e,b.on)}if(b.hidden){e.hide()}if(b.qtip){if(Ext.isObject(b.qtip)){Ext.QuickTips.register(Ext.apply({target:e.id},b.qtip))}else{e.dom.qtip=b.qtip}}e.addClassOnOver(j)}}},onLayout:function(b,a){Ext.Panel.superclass.onLayout.apply(this,arguments);if(this.hasLayout&&this.toolbars.length>0){Ext.each(this.toolbars,function(c){c.doLayout(undefined,a)});this.syncHeight()}},syncHeight:function(){var b=this.toolbarHeight,c=this.body,a=this.lastSize.height,d;if(this.autoHeight||!Ext.isDefined(a)||a==\"auto\"){return}if(b!=this.getToolbarHeight()){b=Math.max(0,a-this.getFrameHeight());c.setHeight(b);d=c.getSize();this.toolbarHeight=this.getToolbarHeight();this.onBodyResize(d.width,d.height)}},onShow:function(){if(this.floating){return this.el.show()}Ext.Panel.superclass.onShow.call(this)},onHide:function(){if(this.floating){return this.el.hide()}Ext.Panel.superclass.onHide.call(this)},createToolHandler:function(c,a,d,b){return function(g){c.removeClass(d);if(a.stopEvent!==false){g.stopEvent()}if(a.handler){a.handler.call(a.scope||c,g,c,b,a)}}},afterRender:function(){if(this.floating&&!this.hidden){this.el.show()}if(this.title){this.setTitle(this.title)}Ext.Panel.superclass.afterRender.call(this);if(this.collapsed){this.collapsed=false;this.collapse(false)}this.initEvents()},getKeyMap:function(){if(!this.keyMap){this.keyMap=new Ext.KeyMap(this.el,this.keys)}return this.keyMap},initEvents:function(){if(this.keys){this.getKeyMap()}if(this.draggable){this.initDraggable()}if(this.toolbars.length>0){Ext.each(this.toolbars,function(a){a.doLayout();a.on({scope:this,afterlayout:this.syncHeight,remove:this.syncHeight})},this);this.syncHeight()}},initDraggable:function(){this.dd=new Ext.Panel.DD(this,Ext.isBoolean(this.draggable)?null:this.draggable)},beforeEffect:function(a){if(this.floating){this.el.beforeAction()}if(a!==false){this.el.addClass(\"x-panel-animated\")}},afterEffect:function(a){this.syncShadow();this.el.removeClass(\"x-panel-animated\")},createEffect:function(c,b,d){var e={scope:d,block:true};if(c===true){e.callback=b;return e}else{if(!c.callback){e.callback=b}else{e.callback=function(){b.call(d);Ext.callback(c.callback,c.scope)}}}return Ext.applyIf(e,c)},collapse:function(b){if(this.collapsed||this.el.hasFxBlock()||this.fireEvent(\"beforecollapse\",this,b)===false){return}var a=b===true||(b!==false&&this.animCollapse);this.beforeEffect(a);this.onCollapse(a,b);return this},onCollapse:function(a,b){if(a){this[this.collapseEl].slideOut(this.slideAnchor,Ext.apply(this.createEffect(b||true,this.afterCollapse,this),this.collapseDefaults))}else{this[this.collapseEl].hide(this.hideMode);this.afterCollapse(false)}},afterCollapse:function(a){this.collapsed=true;this.el.addClass(this.collapsedCls);if(a!==false){this[this.collapseEl].hide(this.hideMode)}this.afterEffect(a);this.cascade(function(b){if(b.lastSize){b.lastSize={width:undefined,height:undefined}}});this.fireEvent(\"collapse\",this)},expand:function(b){if(!this.collapsed||this.el.hasFxBlock()||this.fireEvent(\"beforeexpand\",this,b)===false){return}var a=b===true||(b!==false&&this.animCollapse);this.el.removeClass(this.collapsedCls);this.beforeEffect(a);this.onExpand(a,b);return this},onExpand:function(a,b){if(a){this[this.collapseEl].slideIn(this.slideAnchor,Ext.apply(this.createEffect(b||true,this.afterExpand,this),this.expandDefaults))}else{this[this.collapseEl].show(this.hideMode);this.afterExpand(false)}},afterExpand:function(a){this.collapsed=false;if(a!==false){this[this.collapseEl].show(this.hideMode)}this.afterEffect(a);if(this.deferLayout){delete this.deferLayout;this.doLayout(true)}this.fireEvent(\"expand\",this)},toggleCollapse:function(a){this[this.collapsed?\"expand\":\"collapse\"](a);return this},onDisable:function(){if(this.rendered&&this.maskDisabled){this.el.mask()}Ext.Panel.superclass.onDisable.call(this)},onEnable:function(){if(this.rendered&&this.maskDisabled){this.el.unmask()}Ext.Panel.superclass.onEnable.call(this)},onResize:function(g,d,c,e){var a=g,b=d;if(Ext.isDefined(a)||Ext.isDefined(b)){if(!this.collapsed){if(Ext.isNumber(a)){this.body.setWidth(a=this.adjustBodyWidth(a-this.getFrameWidth()))}else{if(a==\"auto\"){a=this.body.setWidth(\"auto\").dom.offsetWidth}else{a=this.body.dom.offsetWidth}}if(this.tbar){this.tbar.setWidth(a);if(this.topToolbar){this.topToolbar.setSize(a)}}if(this.bbar){this.bbar.setWidth(a);if(this.bottomToolbar){this.bottomToolbar.setSize(a);if(Ext.isIE9m){this.bbar.setStyle(\"position\",\"static\");this.bbar.setStyle(\"position\",\"\")}}}if(this.footer){this.footer.setWidth(a);if(this.fbar){this.fbar.setSize(Ext.isIE9m?(a-this.footer.getFrameWidth(\"lr\")):\"auto\")}}if(Ext.isNumber(b)){b=Math.max(0,b-this.getFrameHeight());this.body.setHeight(b)}else{if(b==\"auto\"){this.body.setHeight(b)}}if(this.disabled&&this.el._mask){this.el._mask.setSize(this.el.dom.clientWidth,this.el.getHeight())}}else{this.queuedBodySize={width:a,height:b};if(!this.queuedExpand&&this.allowQueuedExpand!==false){this.queuedExpand=true;this.on(\"expand\",function(){delete this.queuedExpand;this.onResize(this.queuedBodySize.width,this.queuedBodySize.height)},this,{single:true})}}this.onBodyResize(a,b)}this.syncShadow();Ext.Panel.superclass.onResize.call(this,g,d,c,e)},onBodyResize:function(a,b){this.fireEvent(\"bodyresize\",this,a,b)},getToolbarHeight:function(){var a=0;if(this.rendered){Ext.each(this.toolbars,function(b){a+=b.getHeight()},this)}return a},adjustBodyHeight:function(a){return a},adjustBodyWidth:function(a){return a},onPosition:function(){this.syncShadow()},getFrameWidth:function(){var b=this.el.getFrameWidth(\"lr\")+this.bwrap.getFrameWidth(\"lr\");if(this.frame){var a=this.bwrap.dom.firstChild;b+=(Ext.fly(a).getFrameWidth(\"l\")+Ext.fly(a.firstChild).getFrameWidth(\"r\"));b+=this.mc.getFrameWidth(\"lr\")}return b},getFrameHeight:function(){var a=this.el.getFrameWidth(\"tb\")+this.bwrap.getFrameWidth(\"tb\");a+=(this.tbar?this.tbar.getHeight():0)+(this.bbar?this.bbar.getHeight():0);if(this.frame){a+=this.el.dom.firstChild.offsetHeight+this.ft.dom.offsetHeight+this.mc.getFrameWidth(\"tb\")}else{a+=(this.header?this.header.getHeight():0)+(this.footer?this.footer.getHeight():0)}return a},getInnerWidth:function(){return this.getSize().width-this.getFrameWidth()},getInnerHeight:function(){return this.body.getHeight()},syncShadow:function(){if(this.floating){this.el.sync(true)}},getLayoutTarget:function(){return this.body},getContentTarget:function(){return this.body},setTitle:function(b,a){this.title=b;if(this.header&&this.headerAsText){this.header.child(\"span\").update(b)}if(a){this.setIconClass(a)}this.fireEvent(\"titlechange\",this,b);return this},getUpdater:function(){return this.body.getUpdater()},load:function(){var a=this.body.getUpdater();a.update.apply(a,arguments);return this},beforeDestroy:function(){Ext.Panel.superclass.beforeDestroy.call(this);if(this.header){this.header.removeAllListeners()}if(this.tools){for(var a in this.tools){Ext.destroy(this.tools[a])}}if(this.toolbars.length>0){Ext.each(this.toolbars,function(b){b.un(\"afterlayout\",this.syncHeight,this);b.un(\"remove\",this.syncHeight,this)},this)}if(Ext.isArray(this.buttons)){while(this.buttons.length){Ext.destroy(this.buttons[0])}}if(this.rendered){Ext.destroy(this.ft,this.header,this.footer,this.tbar,this.bbar,this.body,this.mc,this.bwrap,this.dd);if(this.fbar){Ext.destroy(this.fbar,this.fbar.el)}}Ext.destroy(this.toolbars)},createClasses:function(){this.headerCls=this.baseCls+\"-header\";this.headerTextCls=this.baseCls+\"-header-text\";this.bwrapCls=this.baseCls+\"-bwrap\";this.tbarCls=this.baseCls+\"-tbar\";this.bodyCls=this.baseCls+\"-body\";this.bbarCls=this.baseCls+\"-bbar\";this.footerCls=this.baseCls+\"-footer\"},createGhost:function(a,e,b){var d=document.createElement(\"div\");d.className=\"x-panel-ghost \"+(a?a:\"\");if(this.header){d.appendChild(this.el.dom.firstChild.cloneNode(true))}Ext.fly(d.appendChild(document.createElement(\"ul\"))).setHeight(this.bwrap.getHeight());d.style.width=this.el.dom.offsetWidth+\"px\";if(!b){this.container.dom.appendChild(d)}else{Ext.getDom(b).appendChild(d)}if(e!==false&&this.el.useShim!==false){var c=new Ext.Layer({shadow:false,useDisplay:true,constrain:false},d);c.show();return c}else{return new Ext.Element(d)}},doAutoLoad:function(){var a=this.body.getUpdater();if(this.renderer){a.setRenderer(this.renderer)}a.update(Ext.isObject(this.autoLoad)?this.autoLoad:{url:this.autoLoad})},getTool:function(a){return this.tools[a]}});Ext.reg(\"panel\",Ext.Panel);Ext.Editor=function(b,a){if(b.field){this.field=Ext.create(b.field,\"textfield\");a=Ext.apply({},b);delete a.field}else{this.field=b}Ext.Editor.superclass.constructor.call(this,a)};Ext.extend(Ext.Editor,Ext.Component,{allowBlur:true,value:\"\",alignment:\"c-c?\",offsets:[0,0],shadow:\"frame\",constrain:false,swallowKeys:true,completeOnEnter:true,cancelOnEsc:true,updateEl:false,initComponent:function(){Ext.Editor.superclass.initComponent.call(this);this.addEvents(\"beforestartedit\",\"startedit\",\"beforecomplete\",\"complete\",\"canceledit\",\"specialkey\")},onRender:function(b,a){this.el=new Ext.Layer({shadow:this.shadow,cls:\"x-editor\",parentEl:b,shim:this.shim,shadowOffset:this.shadowOffset||4,id:this.id,constrain:this.constrain});if(this.zIndex){this.el.setZIndex(this.zIndex)}this.el.setStyle(\"overflow\",Ext.isGecko?\"auto\":\"hidden\");if(this.field.msgTarget!=\"title\"){this.field.msgTarget=\"qtip\"}this.field.inEditor=true;this.mon(this.field,{scope:this,blur:this.onBlur,specialkey:this.onSpecialKey});if(this.field.grow){this.mon(this.field,\"autosize\",this.el.sync,this.el,{delay:1})}this.field.render(this.el).show();this.field.getEl().dom.name=\"\";if(this.swallowKeys){this.field.el.swallowEvent([\"keypress\",\"keydown\"])}},onSpecialKey:function(g,d){var b=d.getKey(),a=this.completeOnEnter&&b==d.ENTER,c=this.cancelOnEsc&&b==d.ESC;if(a||c){d.stopEvent();if(a){this.completeEdit()}else{this.cancelEdit()}if(g.triggerBlur){g.triggerBlur()}}this.fireEvent(\"specialkey\",g,d)},startEdit:function(b,c){if(this.editing){this.completeEdit()}this.boundEl=Ext.get(b);var a=c!==undefined?c:this.boundEl.dom.innerHTML;if(!this.rendered){this.render(this.parentEl||document.body)}if(this.fireEvent(\"beforestartedit\",this,this.boundEl,a)!==false){this.startValue=a;this.field.reset();this.field.setValue(a);this.realign(true);this.editing=true;this.show()}},doAutoSize:function(){if(this.autoSize){var b=this.boundEl.getSize(),a=this.field.getSize();switch(this.autoSize){case\"width\":this.setSize(b.width,a.height);break;case\"height\":this.setSize(a.width,b.height);break;case\"none\":this.setSize(a.width,a.height);break;default:this.setSize(b.width,b.height)}}},setSize:function(a,b){delete this.field.lastSize;this.field.setSize(a,b);if(this.el){if(Ext.isGecko2||Ext.isOpera||(Ext.isIE7&&Ext.isStrict)){this.el.setSize(a,b)}this.el.sync()}},realign:function(a){if(a===true){this.doAutoSize()}this.el.alignTo(this.boundEl,this.alignment,this.offsets)},completeEdit:function(a){if(!this.editing){return}if(this.field.assertValue){this.field.assertValue()}var b=this.getValue();if(!this.field.isValid()){if(this.revertInvalid!==false){this.cancelEdit(a)}return}if(String(b)===String(this.startValue)&&this.ignoreNoChange){this.hideEdit(a);return}if(this.fireEvent(\"beforecomplete\",this,b,this.startValue)!==false){b=this.getValue();if(this.updateEl&&this.boundEl){this.boundEl.update(b)}this.hideEdit(a);this.fireEvent(\"complete\",this,b,this.startValue)}},onShow:function(){this.el.show();if(this.hideEl!==false){this.boundEl.hide()}this.field.show().focus(false,true);this.fireEvent(\"startedit\",this.boundEl,this.startValue)},cancelEdit:function(a){if(this.editing){var b=this.getValue();this.setValue(this.startValue);this.hideEdit(a);this.fireEvent(\"canceledit\",this,b,this.startValue)}},hideEdit:function(a){if(a!==true){this.editing=false;this.hide()}},onBlur:function(){if(this.allowBlur===true&&this.editing&&this.selectSameEditor!==true){this.completeEdit()}},onHide:function(){if(this.editing){this.completeEdit();return}this.field.blur();if(this.field.collapse){this.field.collapse()}this.el.hide();if(this.hideEl!==false){this.boundEl.show()}},setValue:function(a){this.field.setValue(a)},getValue:function(){return this.field.getValue()},beforeDestroy:function(){Ext.destroyMembers(this,\"field\");delete this.parentEl;delete this.boundEl}});Ext.reg(\"editor\",Ext.Editor);Ext.ColorPalette=Ext.extend(Ext.Component,{itemCls:\"x-color-palette\",value:null,clickEvent:\"click\",ctype:\"Ext.ColorPalette\",allowReselect:false,colors:[\"000000\",\"993300\",\"333300\",\"003300\",\"003366\",\"000080\",\"333399\",\"333333\",\"800000\",\"FF6600\",\"808000\",\"008000\",\"008080\",\"0000FF\",\"666699\",\"808080\",\"FF0000\",\"FF9900\",\"99CC00\",\"339966\",\"33CCCC\",\"3366FF\",\"800080\",\"969696\",\"FF00FF\",\"FFCC00\",\"FFFF00\",\"00FF00\",\"00FFFF\",\"00CCFF\",\"993366\",\"C0C0C0\",\"FF99CC\",\"FFCC99\",\"FFFF99\",\"CCFFCC\",\"CCFFFF\",\"99CCFF\",\"CC99FF\",\"FFFFFF\"],initComponent:function(){Ext.ColorPalette.superclass.initComponent.call(this);this.addEvents(\"select\");if(this.handler){this.on(\"select\",this.handler,this.scope,true)}},onRender:function(b,a){this.autoEl={tag:\"div\",cls:this.itemCls};Ext.ColorPalette.superclass.onRender.call(this,b,a);var c=this.tpl||new Ext.XTemplate('<tpl for=\".\"><a href=\"#\" class=\"color-{.}\" hidefocus=\"on\"><em><span style=\"background:#{.}\" class=\"x-unselectable\" unselectable=\"on\">&#160;</span></em></a></tpl>');c.overwrite(this.el,this.colors);this.mon(this.el,this.clickEvent,this.handleClick,this,{delegate:\"a\"});if(this.clickEvent!=\"click\"){this.mon(this.el,\"click\",Ext.emptyFn,this,{delegate:\"a\",preventDefault:true})}},afterRender:function(){Ext.ColorPalette.superclass.afterRender.call(this);if(this.value){var a=this.value;this.value=null;this.select(a,true)}},handleClick:function(b,a){b.preventDefault();if(!this.disabled){var d=a.className.match(/(?:^|\\s)color-(.{6})(?:\\s|$)/)[1];this.select(d.toUpperCase())}},select:function(b,a){b=b.replace(\"#\",\"\");if(b!=this.value||this.allowReselect){var c=this.el;if(this.value){c.child(\"a.color-\"+this.value).removeClass(\"x-color-palette-sel\")}c.child(\"a.color-\"+b).addClass(\"x-color-palette-sel\");this.value=b;if(a!==true){this.fireEvent(\"select\",this,b)}}}});Ext.reg(\"colorpalette\",Ext.ColorPalette);Ext.DatePicker=Ext.extend(Ext.BoxComponent,{todayText:\"Today\",okText:\"&#160;OK&#160;\",cancelText:\"Cancel\",todayTip:\"{0} (Spacebar)\",minText:\"This date is before the minimum date\",maxText:\"This date is after the maximum date\",format:\"m/d/y\",disabledDaysText:\"Disabled\",disabledDatesText:\"Disabled\",monthNames:Date.monthNames,dayNames:Date.dayNames,nextText:\"Next Month (Control+Right)\",prevText:\"Previous Month (Control+Left)\",monthYearText:\"Choose a month (Control+Up/Down to move years)\",startDay:0,showToday:true,focusOnSelect:true,initHour:12,initComponent:function(){Ext.DatePicker.superclass.initComponent.call(this);this.value=this.value?this.value.clearTime(true):new Date().clearTime();this.addEvents(\"select\");if(this.handler){this.on(\"select\",this.handler,this.scope||this)}this.initDisabledDays()},initDisabledDays:function(){if(!this.disabledDatesRE&&this.disabledDates){var b=this.disabledDates,a=b.length-1,c=\"(?:\";Ext.each(b,function(g,e){c+=Ext.isDate(g)?\"^\"+Ext.escapeRe(g.dateFormat(this.format))+\"$\":b[e];if(e!=a){c+=\"|\"}},this);this.disabledDatesRE=new RegExp(c+\")\")}},setDisabledDates:function(a){if(Ext.isArray(a)){this.disabledDates=a;this.disabledDatesRE=null}else{this.disabledDatesRE=a}this.initDisabledDays();this.update(this.value,true)},setDisabledDays:function(a){this.disabledDays=a;this.update(this.value,true)},setMinDate:function(a){this.minDate=a;this.update(this.value,true)},setMaxDate:function(a){this.maxDate=a;this.update(this.value,true)},setValue:function(a){this.value=a.clearTime(true);this.update(this.value)},getValue:function(){return this.value},focus:function(){this.update(this.activeDate)},onEnable:function(a){Ext.DatePicker.superclass.onEnable.call(this);this.doDisabled(false);this.update(a?this.value:this.activeDate);if(Ext.isIE9m){this.el.repaint()}},onDisable:function(){Ext.DatePicker.superclass.onDisable.call(this);this.doDisabled(true);if(Ext.isIE9m&&!Ext.isIE8){Ext.each([].concat(this.textNodes,this.el.query(\"th span\")),function(a){Ext.fly(a).repaint()})}},doDisabled:function(a){this.keyNav.setDisabled(a);this.prevRepeater.setDisabled(a);this.nextRepeater.setDisabled(a);if(this.showToday){this.todayKeyListener.setDisabled(a);this.todayBtn.setDisabled(a)}},onRender:function(e,b){var a=['<table cellspacing=\"0\">','<tr><td class=\"x-date-left\"><a href=\"#\" title=\"',this.prevText,'\">&#160;</a></td><td class=\"x-date-middle\" align=\"center\"></td><td class=\"x-date-right\"><a href=\"#\" title=\"',this.nextText,'\">&#160;</a></td></tr>','<tr><td colspan=\"3\"><table class=\"x-date-inner\" cellspacing=\"0\"><thead><tr>'],c=this.dayNames,h;for(h=0;h<7;h++){var k=this.startDay+h;if(k>6){k=k-7}a.push(\"<th><span>\",c[k].substr(0,1),\"</span></th>\")}a[a.length]=\"</tr></thead><tbody><tr>\";for(h=0;h<42;h++){if(h%7===0&&h!==0){a[a.length]=\"</tr><tr>\"}a[a.length]='<td><a href=\"#\" hidefocus=\"on\" class=\"x-date-date\" tabIndex=\"1\"><em><span></span></em></a></td>'}a.push(\"</tr></tbody></table></td></tr>\",this.showToday?'<tr><td colspan=\"3\" class=\"x-date-bottom\" align=\"center\"></td></tr>':\"\",'</table><div class=\"x-date-mp\"></div>');var j=document.createElement(\"div\");j.className=\"x-date-picker\";j.innerHTML=a.join(\"\");e.dom.insertBefore(j,b);this.el=Ext.get(j);this.eventEl=Ext.get(j.firstChild);this.prevRepeater=new Ext.util.ClickRepeater(this.el.child(\"td.x-date-left a\"),{handler:this.showPrevMonth,scope:this,preventDefault:true,stopDefault:true});this.nextRepeater=new Ext.util.ClickRepeater(this.el.child(\"td.x-date-right a\"),{handler:this.showNextMonth,scope:this,preventDefault:true,stopDefault:true});this.monthPicker=this.el.down(\"div.x-date-mp\");this.monthPicker.enableDisplayMode(\"block\");this.keyNav=new Ext.KeyNav(this.eventEl,{left:function(d){if(d.ctrlKey){this.showPrevMonth()}else{this.update(this.activeDate.add(\"d\",-1))}},right:function(d){if(d.ctrlKey){this.showNextMonth()}else{this.update(this.activeDate.add(\"d\",1))}},up:function(d){if(d.ctrlKey){this.showNextYear()}else{this.update(this.activeDate.add(\"d\",-7))}},down:function(d){if(d.ctrlKey){this.showPrevYear()}else{this.update(this.activeDate.add(\"d\",7))}},pageUp:function(d){this.showNextMonth()},pageDown:function(d){this.showPrevMonth()},enter:function(d){d.stopPropagation();return true},scope:this});this.el.unselectable();this.cells=this.el.select(\"table.x-date-inner tbody td\");this.textNodes=this.el.query(\"table.x-date-inner tbody span\");this.mbtn=new Ext.Button({text:\"&#160;\",tooltip:this.monthYearText,renderTo:this.el.child(\"td.x-date-middle\",true)});this.mbtn.el.child(\"em\").addClass(\"x-btn-arrow\");if(this.showToday){this.todayKeyListener=this.eventEl.addKeyListener(Ext.EventObject.SPACE,this.selectToday,this);var g=(new Date()).dateFormat(this.format);this.todayBtn=new Ext.Button({renderTo:this.el.child(\"td.x-date-bottom\",true),text:String.format(this.todayText,g),tooltip:String.format(this.todayTip,g),handler:this.selectToday,scope:this})}this.mon(this.eventEl,\"mousewheel\",this.handleMouseWheel,this);this.mon(this.eventEl,\"click\",this.handleDateClick,this,{delegate:\"a.x-date-date\"});this.mon(this.mbtn,\"click\",this.showMonthPicker,this);this.onEnable(true)},createMonthPicker:function(){if(!this.monthPicker.dom.firstChild){var a=['<table border=\"0\" cellspacing=\"0\">'];for(var b=0;b<6;b++){a.push('<tr><td class=\"x-date-mp-month\"><a href=\"#\">',Date.getShortMonthName(b),\"</a></td>\",'<td class=\"x-date-mp-month x-date-mp-sep\"><a href=\"#\">',Date.getShortMonthName(b+6),\"</a></td>\",b===0?'<td class=\"x-date-mp-ybtn\" align=\"center\"><a class=\"x-date-mp-prev\"></a></td><td class=\"x-date-mp-ybtn\" align=\"center\"><a class=\"x-date-mp-next\"></a></td></tr>':'<td class=\"x-date-mp-year\"><a href=\"#\"></a></td><td class=\"x-date-mp-year\"><a href=\"#\"></a></td></tr>')}a.push('<tr class=\"x-date-mp-btns\"><td colspan=\"4\"><button type=\"button\" class=\"x-date-mp-ok\">',this.okText,'</button><button type=\"button\" class=\"x-date-mp-cancel\">',this.cancelText,\"</button></td></tr>\",\"</table>\");this.monthPicker.update(a.join(\"\"));this.mon(this.monthPicker,\"click\",this.onMonthClick,this);this.mon(this.monthPicker,\"dblclick\",this.onMonthDblClick,this);this.mpMonths=this.monthPicker.select(\"td.x-date-mp-month\");this.mpYears=this.monthPicker.select(\"td.x-date-mp-year\");this.mpMonths.each(function(c,d,e){e+=1;if((e%2)===0){c.dom.xmonth=5+Math.round(e*0.5)}else{c.dom.xmonth=Math.round((e-1)*0.5)}})}},showMonthPicker:function(){if(!this.disabled){this.createMonthPicker();var a=this.el.getSize();this.monthPicker.setSize(a);this.monthPicker.child(\"table\").setSize(a);this.mpSelMonth=(this.activeDate||this.value).getMonth();this.updateMPMonth(this.mpSelMonth);this.mpSelYear=(this.activeDate||this.value).getFullYear();this.updateMPYear(this.mpSelYear);this.monthPicker.slideIn(\"t\",{duration:0.2})}},updateMPYear:function(e){this.mpyear=e;var c=this.mpYears.elements;for(var b=1;b<=10;b++){var d=c[b-1],a;if((b%2)===0){a=e+Math.round(b*0.5);d.firstChild.innerHTML=a;d.xyear=a}else{a=e-(5-Math.round(b*0.5));d.firstChild.innerHTML=a;d.xyear=a}this.mpYears.item(b-1)[a==this.mpSelYear?\"addClass\":\"removeClass\"](\"x-date-mp-sel\")}},updateMPMonth:function(a){this.mpMonths.each(function(b,c,d){b[b.dom.xmonth==a?\"addClass\":\"removeClass\"](\"x-date-mp-sel\")})},selectMPMonth:function(a){},onMonthClick:function(g,b){g.stopEvent();var c=new Ext.Element(b),a;if(c.is(\"button.x-date-mp-cancel\")){this.hideMonthPicker()}else{if(c.is(\"button.x-date-mp-ok\")){var h=new Date(this.mpSelYear,this.mpSelMonth,(this.activeDate||this.value).getDate());if(h.getMonth()!=this.mpSelMonth){h=new Date(this.mpSelYear,this.mpSelMonth,1).getLastDateOfMonth()}this.update(h);this.hideMonthPicker()}else{if((a=c.up(\"td.x-date-mp-month\",2))){this.mpMonths.removeClass(\"x-date-mp-sel\");a.addClass(\"x-date-mp-sel\");this.mpSelMonth=a.dom.xmonth}else{if((a=c.up(\"td.x-date-mp-year\",2))){this.mpYears.removeClass(\"x-date-mp-sel\");a.addClass(\"x-date-mp-sel\");this.mpSelYear=a.dom.xyear}else{if(c.is(\"a.x-date-mp-prev\")){this.updateMPYear(this.mpyear-10)}else{if(c.is(\"a.x-date-mp-next\")){this.updateMPYear(this.mpyear+10)}}}}}}},onMonthDblClick:function(d,b){d.stopEvent();var c=new Ext.Element(b),a;if((a=c.up(\"td.x-date-mp-month\",2))){this.update(new Date(this.mpSelYear,a.dom.xmonth,(this.activeDate||this.value).getDate()));this.hideMonthPicker()}else{if((a=c.up(\"td.x-date-mp-year\",2))){this.update(new Date(a.dom.xyear,this.mpSelMonth,(this.activeDate||this.value).getDate()));this.hideMonthPicker()}}},hideMonthPicker:function(a){if(this.monthPicker){if(a===true){this.monthPicker.hide()}else{this.monthPicker.slideOut(\"t\",{duration:0.2})}}},showPrevMonth:function(a){this.update(this.activeDate.add(\"mo\",-1))},showNextMonth:function(a){this.update(this.activeDate.add(\"mo\",1))},showPrevYear:function(){this.update(this.activeDate.add(\"y\",-1))},showNextYear:function(){this.update(this.activeDate.add(\"y\",1))},handleMouseWheel:function(a){a.stopEvent();if(!this.disabled){var b=a.getWheelDelta();if(b>0){this.showPrevMonth()}else{if(b<0){this.showNextMonth()}}}},handleDateClick:function(b,a){b.stopEvent();if(!this.disabled&&a.dateValue&&!Ext.fly(a.parentNode).hasClass(\"x-date-disabled\")){this.cancelFocus=this.focusOnSelect===false;this.setValue(new Date(a.dateValue));delete this.cancelFocus;this.fireEvent(\"select\",this,this.value)}},selectToday:function(){if(this.todayBtn&&!this.todayBtn.disabled){this.setValue(new Date().clearTime());this.fireEvent(\"select\",this,this.value)}},update:function(G,A){if(this.rendered){var a=this.activeDate,p=this.isVisible();this.activeDate=G;if(!A&&a&&this.el){var o=G.getTime();if(a.getMonth()==G.getMonth()&&a.getFullYear()==G.getFullYear()){this.cells.removeClass(\"x-date-selected\");this.cells.each(function(d){if(d.dom.firstChild.dateValue==o){d.addClass(\"x-date-selected\");if(p&&!this.cancelFocus){Ext.fly(d.dom.firstChild).focus(50)}return false}},this);return}}var k=G.getDaysInMonth(),q=G.getFirstDateOfMonth(),g=q.getDay()-this.startDay;if(g<0){g+=7}k+=g;var B=G.add(\"mo\",-1),h=B.getDaysInMonth()-g,e=this.cells.elements,r=this.textNodes,D=(new Date(B.getFullYear(),B.getMonth(),h,this.initHour)),C=new Date().clearTime().getTime(),v=G.clearTime(true).getTime(),u=this.minDate?this.minDate.clearTime(true):Number.NEGATIVE_INFINITY,y=this.maxDate?this.maxDate.clearTime(true):Number.POSITIVE_INFINITY,F=this.disabledDatesRE,s=this.disabledDatesText,I=this.disabledDays?this.disabledDays.join(\"\"):false,E=this.disabledDaysText,z=this.format;if(this.showToday){var m=new Date().clearTime(),c=(m<u||m>y||(F&&z&&F.test(m.dateFormat(z)))||(I&&I.indexOf(m.getDay())!=-1));if(!this.disabled){this.todayBtn.setDisabled(c);this.todayKeyListener[c?\"disable\":\"enable\"]()}}var l=function(J,d){d.title=\"\";var i=D.clearTime(true).getTime();d.firstChild.dateValue=i;if(i==C){d.className+=\" x-date-today\";d.title=J.todayText}if(i==v){d.className+=\" x-date-selected\";if(p){Ext.fly(d.firstChild).focus(50)}}if(i<u){d.className=\" x-date-disabled\";d.title=J.minText;return}if(i>y){d.className=\" x-date-disabled\";d.title=J.maxText;return}if(I){if(I.indexOf(D.getDay())!=-1){d.title=E;d.className=\" x-date-disabled\"}}if(F&&z){var w=D.dateFormat(z);if(F.test(w)){d.title=s.replace(\"%0\",w);d.className=\" x-date-disabled\"}}};var x=0;for(;x<g;x++){r[x].innerHTML=(++h);D.setDate(D.getDate()+1);e[x].className=\"x-date-prevday\";l(this,e[x])}for(;x<k;x++){var b=x-g+1;r[x].innerHTML=(b);D.setDate(D.getDate()+1);e[x].className=\"x-date-active\";l(this,e[x])}var H=0;for(;x<42;x++){r[x].innerHTML=(++H);D.setDate(D.getDate()+1);e[x].className=\"x-date-nextday\";l(this,e[x])}this.mbtn.setText(this.monthNames[G.getMonth()]+\" \"+G.getFullYear());if(!this.internalRender){var j=this.el.dom.firstChild,n=j.offsetWidth;this.el.setWidth(n+this.el.getBorderWidth(\"lr\"));Ext.fly(j).setWidth(n);this.internalRender=true;if(Ext.isOpera&&!this.secondPass){j.rows[0].cells[1].style.width=(n-(j.rows[0].cells[0].offsetWidth+j.rows[0].cells[2].offsetWidth))+\"px\";this.secondPass=true;this.update.defer(10,this,[G])}}}},beforeDestroy:function(){if(this.rendered){Ext.destroy(this.keyNav,this.monthPicker,this.eventEl,this.mbtn,this.nextRepeater,this.prevRepeater,this.cells.el,this.todayBtn);delete this.textNodes;delete this.cells.elements}}});Ext.reg(\"datepicker\",Ext.DatePicker);Ext.LoadMask=function(c,b){this.el=Ext.get(c);Ext.apply(this,b);if(this.store){this.store.on({scope:this,beforeload:this.onBeforeLoad,load:this.onLoad,exception:this.onLoad});this.removeMask=Ext.value(this.removeMask,false)}else{var a=this.el.getUpdater();a.showLoadIndicator=false;a.on({scope:this,beforeupdate:this.onBeforeLoad,update:this.onLoad,failure:this.onLoad});this.removeMask=Ext.value(this.removeMask,true)}};Ext.LoadMask.prototype={msg:\"Loading...\",msgCls:\"x-mask-loading\",disabled:false,disable:function(){this.disabled=true},enable:function(){this.disabled=false},onLoad:function(){this.el.unmask(this.removeMask)},onBeforeLoad:function(){if(!this.disabled){this.el.mask(this.msg,this.msgCls)}},show:function(){this.onBeforeLoad()},hide:function(){this.onLoad()},destroy:function(){if(this.store){this.store.un(\"beforeload\",this.onBeforeLoad,this);this.store.un(\"load\",this.onLoad,this);this.store.un(\"exception\",this.onLoad,this)}else{var a=this.el.getUpdater();a.un(\"beforeupdate\",this.onBeforeLoad,this);a.un(\"update\",this.onLoad,this);a.un(\"failure\",this.onLoad,this)}}};Ext.slider.Thumb=Ext.extend(Object,{dragging:false,constructor:function(a){Ext.apply(this,a||{},{cls:\"x-slider-thumb\",constrain:false});Ext.slider.Thumb.superclass.constructor.call(this,a);if(this.slider.vertical){Ext.apply(this,Ext.slider.Thumb.Vertical)}},render:function(){this.el=this.slider.innerEl.insertFirst({cls:this.cls});this.initEvents()},enable:function(){this.disabled=false;this.el.removeClass(this.slider.disabledClass)},disable:function(){this.disabled=true;this.el.addClass(this.slider.disabledClass)},initEvents:function(){var a=this.el;a.addClassOnOver(\"x-slider-thumb-over\");this.tracker=new Ext.dd.DragTracker({onBeforeStart:this.onBeforeDragStart.createDelegate(this),onStart:this.onDragStart.createDelegate(this),onDrag:this.onDrag.createDelegate(this),onEnd:this.onDragEnd.createDelegate(this),tolerance:3,autoStart:300});this.tracker.initEl(a)},onBeforeDragStart:function(a){if(this.disabled){return false}else{this.slider.promoteThumb(this);return true}},onDragStart:function(a){this.el.addClass(\"x-slider-thumb-drag\");this.dragging=true;this.dragStartValue=this.value;this.slider.fireEvent(\"dragstart\",this.slider,a,this)},onDrag:function(g){var c=this.slider,b=this.index,d=this.getNewValue();if(this.constrain){var a=c.thumbs[b+1],h=c.thumbs[b-1];if(h!=undefined&&d<=h.value){d=h.value}if(a!=undefined&&d>=a.value){d=a.value}}c.setValue(b,d,false);c.fireEvent(\"drag\",c,g,this)},getNewValue:function(){var a=this.slider,b=a.innerEl.translatePoints(this.tracker.getXY());return Ext.util.Format.round(a.reverseValue(b.left),a.decimalPrecision)},onDragEnd:function(c){var a=this.slider,b=this.value;this.el.removeClass(\"x-slider-thumb-drag\");this.dragging=false;a.fireEvent(\"dragend\",a,c);if(this.dragStartValue!=b){a.fireEvent(\"changecomplete\",a,b,this)}},destroy:function(){Ext.destroyMembers(this,\"tracker\",\"el\")}});Ext.slider.MultiSlider=Ext.extend(Ext.BoxComponent,{vertical:false,minValue:0,maxValue:100,decimalPrecision:0,keyIncrement:1,increment:0,clickRange:[5,15],clickToChange:true,animate:true,constrainThumbs:true,topThumbZIndex:10000,initComponent:function(){if(!Ext.isDefined(this.value)){this.value=this.minValue}this.thumbs=[];Ext.slider.MultiSlider.superclass.initComponent.call(this);this.keyIncrement=Math.max(this.increment,this.keyIncrement);this.addEvents(\"beforechange\",\"change\",\"changecomplete\",\"dragstart\",\"drag\",\"dragend\");if(this.values==undefined||Ext.isEmpty(this.values)){this.values=[0]}var a=this.values;for(var b=0;b<a.length;b++){this.addThumb(a[b])}if(this.vertical){Ext.apply(this,Ext.slider.Vertical)}},addThumb:function(b){var a=new Ext.slider.Thumb({value:b,slider:this,index:this.thumbs.length,constrain:this.constrainThumbs});this.thumbs.push(a);if(this.rendered){a.render()}},promoteThumb:function(d){var a=this.thumbs,g,b;for(var e=0,c=a.length;e<c;e++){b=a[e];if(b==d){g=this.topThumbZIndex}else{g=\"\"}b.el.setStyle(\"zIndex\",g)}},onRender:function(){this.autoEl={cls:\"x-slider \"+(this.vertical?\"x-slider-vert\":\"x-slider-horz\"),cn:{cls:\"x-slider-end\",cn:{cls:\"x-slider-inner\",cn:[{tag:\"a\",cls:\"x-slider-focus\",href:\"#\",tabIndex:\"-1\",hidefocus:\"on\"}]}}};Ext.slider.MultiSlider.superclass.onRender.apply(this,arguments);this.endEl=this.el.first();this.innerEl=this.endEl.first();this.focusEl=this.innerEl.child(\".x-slider-focus\");for(var b=0;b<this.thumbs.length;b++){this.thumbs[b].render()}var a=this.innerEl.child(\".x-slider-thumb\");this.halfThumb=(this.vertical?a.getHeight():a.getWidth())/2;this.initEvents()},initEvents:function(){this.mon(this.el,{scope:this,mousedown:this.onMouseDown,keydown:this.onKeyDown});this.focusEl.swallowEvent(\"click\",true)},onMouseDown:function(d){if(this.disabled){return}var c=false;for(var b=0;b<this.thumbs.length;b++){c=c||d.target==this.thumbs[b].el.dom}if(this.clickToChange&&!c){var a=this.innerEl.translatePoints(d.getXY());this.onClickChange(a)}this.focus()},onClickChange:function(c){if(c.top>this.clickRange[0]&&c.top<this.clickRange[1]){var a=this.getNearest(c,\"left\"),b=a.index;this.setValue(b,Ext.util.Format.round(this.reverseValue(c.left),this.decimalPrecision),undefined,true)}},getNearest:function(k,b){var m=b==\"top\"?this.innerEl.getHeight()-k[b]:k[b],g=this.reverseValue(m),j=(this.maxValue-this.minValue)+5,e=0,c=null;for(var d=0;d<this.thumbs.length;d++){var a=this.thumbs[d],l=a.value,h=Math.abs(l-g);if(Math.abs(h<=j)){c=a;e=d;j=h}}return c},onKeyDown:function(b){if(this.disabled||this.thumbs.length!==1){b.preventDefault();return}var a=b.getKey(),c;switch(a){case b.UP:case b.RIGHT:b.stopEvent();c=b.ctrlKey?this.maxValue:this.getValue(0)+this.keyIncrement;this.setValue(0,c,undefined,true);break;case b.DOWN:case b.LEFT:b.stopEvent();c=b.ctrlKey?this.minValue:this.getValue(0)-this.keyIncrement;this.setValue(0,c,undefined,true);break;default:b.preventDefault()}},doSnap:function(b){if(!(this.increment&&b)){return b}var d=b,c=this.increment,a=b%c;if(a!=0){d-=a;if(a*2>=c){d+=c}else{if(a*2<-c){d-=c}}}return d.constrain(this.minValue,this.maxValue)},afterRender:function(){Ext.slider.MultiSlider.superclass.afterRender.apply(this,arguments);for(var c=0;c<this.thumbs.length;c++){var b=this.thumbs[c];if(b.value!==undefined){var a=this.normalizeValue(b.value);if(a!==b.value){this.setValue(c,a,false)}else{this.moveThumb(c,this.translateValue(a),false)}}}},getRatio:function(){var a=this.innerEl.getWidth(),b=this.maxValue-this.minValue;return b==0?a:(a/b)},normalizeValue:function(a){a=this.doSnap(a);a=Ext.util.Format.round(a,this.decimalPrecision);a=a.constrain(this.minValue,this.maxValue);return a},setMinValue:function(e){this.minValue=e;var d=0,b=this.thumbs,a=b.length,c;for(;d<a;++d){c=b[d];c.value=c.value<e?e:c.value}this.syncThumb()},setMaxValue:function(e){this.maxValue=e;var d=0,b=this.thumbs,a=b.length,c;for(;d<a;++d){c=b[d];c.value=c.value>e?e:c.value}this.syncThumb()},setValue:function(d,c,b,g){var a=this.thumbs[d],e=a.el;c=this.normalizeValue(c);if(c!==a.value&&this.fireEvent(\"beforechange\",this,c,a.value,a)!==false){a.value=c;if(this.rendered){this.moveThumb(d,this.translateValue(c),b!==false);this.fireEvent(\"change\",this,c,a);if(g){this.fireEvent(\"changecomplete\",this,c,a)}}}},translateValue:function(a){var b=this.getRatio();return(a*b)-(this.minValue*b)-this.halfThumb},reverseValue:function(b){var a=this.getRatio();return(b+(this.minValue*a))/a},moveThumb:function(d,c,b){var a=this.thumbs[d].el;if(!b||this.animate===false){a.setLeft(c)}else{a.shift({left:c,stopFx:true,duration:0.35})}},focus:function(){this.focusEl.focus(10)},onResize:function(c,e){var b=this.thumbs,a=b.length,d=0;for(;d<a;++d){b[d].el.stopFx()}if(Ext.isNumber(c)){this.innerEl.setWidth(c-(this.el.getPadding(\"l\")+this.endEl.getPadding(\"r\")))}this.syncThumb();Ext.slider.MultiSlider.superclass.onResize.apply(this,arguments)},onDisable:function(){Ext.slider.MultiSlider.superclass.onDisable.call(this);for(var b=0;b<this.thumbs.length;b++){var a=this.thumbs[b],c=a.el;a.disable();if(Ext.isIE){var d=c.getXY();c.hide();this.innerEl.addClass(this.disabledClass).dom.disabled=true;if(!this.thumbHolder){this.thumbHolder=this.endEl.createChild({cls:\"x-slider-thumb \"+this.disabledClass})}this.thumbHolder.show().setXY(d)}}},onEnable:function(){Ext.slider.MultiSlider.superclass.onEnable.call(this);for(var b=0;b<this.thumbs.length;b++){var a=this.thumbs[b],c=a.el;a.enable();if(Ext.isIE){this.innerEl.removeClass(this.disabledClass).dom.disabled=false;if(this.thumbHolder){this.thumbHolder.hide()}c.show();this.syncThumb()}}},syncThumb:function(){if(this.rendered){for(var a=0;a<this.thumbs.length;a++){this.moveThumb(a,this.translateValue(this.thumbs[a].value))}}},getValue:function(a){return this.thumbs[a].value},getValues:function(){var a=[];for(var b=0;b<this.thumbs.length;b++){a.push(this.thumbs[b].value)}return a},beforeDestroy:function(){var b=this.thumbs;for(var c=0,a=b.length;c<a;++c){b[c].destroy();b[c]=null}Ext.destroyMembers(this,\"endEl\",\"innerEl\",\"focusEl\",\"thumbHolder\");Ext.slider.MultiSlider.superclass.beforeDestroy.call(this)}});Ext.reg(\"multislider\",Ext.slider.MultiSlider);Ext.slider.SingleSlider=Ext.extend(Ext.slider.MultiSlider,{constructor:function(a){a=a||{};Ext.applyIf(a,{values:[a.value||0]});Ext.slider.SingleSlider.superclass.constructor.call(this,a)},getValue:function(){return Ext.slider.SingleSlider.superclass.getValue.call(this,0)},setValue:function(d,b){var c=Ext.toArray(arguments),a=c.length;if(a==1||(a<=3&&typeof arguments[1]!=\"number\")){c.unshift(0)}return Ext.slider.SingleSlider.superclass.setValue.apply(this,c)},syncThumb:function(){return Ext.slider.SingleSlider.superclass.syncThumb.apply(this,[0].concat(arguments))},getNearest:function(){return this.thumbs[0]}});Ext.Slider=Ext.slider.SingleSlider;Ext.reg(\"slider\",Ext.slider.SingleSlider);Ext.slider.Vertical={onResize:function(a,b){this.innerEl.setHeight(b-(this.el.getPadding(\"t\")+this.endEl.getPadding(\"b\")));this.syncThumb()},getRatio:function(){var b=this.innerEl.getHeight(),a=this.maxValue-this.minValue;return b/a},moveThumb:function(d,c,b){var a=this.thumbs[d],e=a.el;if(!b||this.animate===false){e.setBottom(c)}else{e.shift({bottom:c,stopFx:true,duration:0.35})}},onClickChange:function(c){if(c.left>this.clickRange[0]&&c.left<this.clickRange[1]){var a=this.getNearest(c,\"top\"),b=a.index,d=this.minValue+this.reverseValue(this.innerEl.getHeight()-c.top);this.setValue(b,Ext.util.Format.round(d,this.decimalPrecision),undefined,true)}}};Ext.slider.Thumb.Vertical={getNewValue:function(){var b=this.slider,c=b.innerEl,d=c.translatePoints(this.tracker.getXY()),a=c.getHeight()-d.top;return b.minValue+Ext.util.Format.round(a/b.getRatio(),b.decimalPrecision)}};Ext.ProgressBar=Ext.extend(Ext.BoxComponent,{baseCls:\"x-progress\",animate:false,waitTimer:null,initComponent:function(){Ext.ProgressBar.superclass.initComponent.call(this);this.addEvents(\"update\")},onRender:function(d,a){var c=new Ext.Template('<div class=\"{cls}-wrap\">','<div class=\"{cls}-inner\">','<div class=\"{cls}-bar\">','<div class=\"{cls}-text\">',\"<div>&#160;</div>\",\"</div>\",\"</div>\",'<div class=\"{cls}-text {cls}-text-back\">',\"<div>&#160;</div>\",\"</div>\",\"</div>\",\"</div>\");this.el=a?c.insertBefore(a,{cls:this.baseCls},true):c.append(d,{cls:this.baseCls},true);if(this.id){this.el.dom.id=this.id}var b=this.el.dom.firstChild;this.progressBar=Ext.get(b.firstChild);if(this.textEl){this.textEl=Ext.get(this.textEl);delete this.textTopEl}else{this.textTopEl=Ext.get(this.progressBar.dom.firstChild);var e=Ext.get(b.childNodes[1]);this.textTopEl.setStyle(\"z-index\",99).addClass(\"x-hidden\");this.textEl=new Ext.CompositeElement([this.textTopEl.dom.firstChild,e.dom.firstChild]);this.textEl.setWidth(b.offsetWidth)}this.progressBar.setHeight(b.offsetHeight)},afterRender:function(){Ext.ProgressBar.superclass.afterRender.call(this);if(this.value){this.updateProgress(this.value,this.text)}else{this.updateText(this.text)}},updateProgress:function(c,d,b){this.value=c||0;if(d){this.updateText(d)}if(this.rendered&&!this.isDestroyed){var a=Math.floor(c*this.el.dom.firstChild.offsetWidth);this.progressBar.setWidth(a,b===true||(b!==false&&this.animate));if(this.textTopEl){this.textTopEl.removeClass(\"x-hidden\").setWidth(a)}}this.fireEvent(\"update\",this,c,d);return this},wait:function(b){if(!this.waitTimer){var a=this;b=b||{};this.updateText(b.text);this.waitTimer=Ext.TaskMgr.start({run:function(c){var d=b.increment||10;c-=1;this.updateProgress(((((c+d)%d)+1)*(100/d))*0.01,null,b.animate)},interval:b.interval||1000,duration:b.duration,onStop:function(){if(b.fn){b.fn.apply(b.scope||this)}this.reset()},scope:a})}return this},isWaiting:function(){return this.waitTimer!==null},updateText:function(a){this.text=a||\"&#160;\";if(this.rendered){this.textEl.update(this.text)}return this},syncProgressBar:function(){if(this.value){this.updateProgress(this.value,this.text)}return this},setSize:function(a,c){Ext.ProgressBar.superclass.setSize.call(this,a,c);if(this.textTopEl){var b=this.el.dom.firstChild;this.textEl.setSize(b.offsetWidth,b.offsetHeight)}this.syncProgressBar();return this},reset:function(a){this.updateProgress(0);if(this.textTopEl){this.textTopEl.addClass(\"x-hidden\")}this.clearTimer();if(a===true){this.hide()}return this},clearTimer:function(){if(this.waitTimer){this.waitTimer.onStop=null;Ext.TaskMgr.stop(this.waitTimer);this.waitTimer=null}},onDestroy:function(){this.clearTimer();if(this.rendered){if(this.textEl.isComposite){this.textEl.clear()}Ext.destroyMembers(this,\"textEl\",\"progressBar\",\"textTopEl\")}Ext.ProgressBar.superclass.onDestroy.call(this)}});Ext.reg(\"progress\",Ext.ProgressBar);(function(){var a=Ext.EventManager;var b=Ext.lib.Dom;Ext.dd.DragDrop=function(e,c,d){if(e){this.init(e,c,d)}};Ext.dd.DragDrop.prototype={id:null,config:null,dragElId:null,handleElId:null,invalidHandleTypes:null,invalidHandleIds:null,invalidHandleClasses:null,startPageX:0,startPageY:0,groups:null,locked:false,lock:function(){this.locked=true},moveOnly:false,unlock:function(){this.locked=false},isTarget:true,padding:null,_domRef:null,__ygDragDrop:true,constrainX:false,constrainY:false,minX:0,maxX:0,minY:0,maxY:0,maintainOffset:false,xTicks:null,yTicks:null,primaryButtonOnly:true,available:false,hasOuterHandles:false,b4StartDrag:function(c,d){},startDrag:function(c,d){},b4Drag:function(c){},onDrag:function(c){},onDragEnter:function(c,d){},b4DragOver:function(c){},onDragOver:function(c,d){},b4DragOut:function(c){},onDragOut:function(c,d){},b4DragDrop:function(c){},onDragDrop:function(c,d){},onInvalidDrop:function(c){},b4EndDrag:function(c){},endDrag:function(c){},b4MouseDown:function(c){},onMouseDown:function(c){},onMouseUp:function(c){},onAvailable:function(){},defaultPadding:{left:0,right:0,top:0,bottom:0},constrainTo:function(j,h,o){if(Ext.isNumber(h)){h={left:h,right:h,top:h,bottom:h}}h=h||this.defaultPadding;var l=Ext.get(this.getEl()).getBox(),d=Ext.get(j),n=d.getScroll(),k,e=d.dom;if(e==document.body){k={x:n.left,y:n.top,width:Ext.lib.Dom.getViewWidth(),height:Ext.lib.Dom.getViewHeight()}}else{var m=d.getXY();k={x:m[0],y:m[1],width:e.clientWidth,height:e.clientHeight}}var i=l.y-k.y,g=l.x-k.x;this.resetConstraints();this.setXConstraint(g-(h.left||0),k.width-g-l.width-(h.right||0),this.xTickSize);this.setYConstraint(i-(h.top||0),k.height-i-l.height-(h.bottom||0),this.yTickSize)},getEl:function(){if(!this._domRef){this._domRef=Ext.getDom(this.id)}return this._domRef},getDragEl:function(){return Ext.getDom(this.dragElId)},init:function(e,c,d){this.initTarget(e,c,d);a.on(this.id,\"mousedown\",this.handleMouseDown,this)},initTarget:function(e,c,d){this.config=d||{};this.DDM=Ext.dd.DDM;this.groups={};if(typeof e!==\"string\"){e=Ext.id(e)}this.id=e;this.addToGroup((c)?c:\"default\");this.handleElId=e;this.setDragElId(e);this.invalidHandleTypes={A:\"A\"};this.invalidHandleIds={};this.invalidHandleClasses=[];this.applyConfig();this.handleOnAvailable()},applyConfig:function(){this.padding=this.config.padding||[0,0,0,0];this.isTarget=(this.config.isTarget!==false);this.maintainOffset=(this.config.maintainOffset);this.primaryButtonOnly=(this.config.primaryButtonOnly!==false)},handleOnAvailable:function(){this.available=true;this.resetConstraints();this.onAvailable()},setPadding:function(e,c,g,d){if(!c&&0!==c){this.padding=[e,e,e,e]}else{if(!g&&0!==g){this.padding=[e,c,e,c]}else{this.padding=[e,c,g,d]}}},setInitPosition:function(g,e){var h=this.getEl();if(!this.DDM.verifyEl(h)){return}var d=g||0;var c=e||0;var i=b.getXY(h);this.initPageX=i[0]-d;this.initPageY=i[1]-c;this.lastPageX=i[0];this.lastPageY=i[1];this.setStartPosition(i)},setStartPosition:function(d){var c=d||b.getXY(this.getEl());this.deltaSetXY=null;this.startPageX=c[0];this.startPageY=c[1]},addToGroup:function(c){this.groups[c]=true;this.DDM.regDragDrop(this,c)},removeFromGroup:function(c){if(this.groups[c]){delete this.groups[c]}this.DDM.removeDDFromGroup(this,c)},setDragElId:function(c){this.dragElId=c},setHandleElId:function(c){if(typeof c!==\"string\"){c=Ext.id(c)}this.handleElId=c;this.DDM.regHandle(this.id,c)},setOuterHandleElId:function(c){if(typeof c!==\"string\"){c=Ext.id(c)}a.on(c,\"mousedown\",this.handleMouseDown,this);this.setHandleElId(c);this.hasOuterHandles=true},unreg:function(){a.un(this.id,\"mousedown\",this.handleMouseDown);this._domRef=null;this.DDM._remove(this)},destroy:function(){this.unreg()},isLocked:function(){return(this.DDM.isLocked()||this.locked)},handleMouseDown:function(g,d){if(this.primaryButtonOnly&&g.button!=0){return}if(this.isLocked()){return}this.DDM.refreshCache(this.groups);var c=new Ext.lib.Point(Ext.lib.Event.getPageX(g),Ext.lib.Event.getPageY(g));if(!this.hasOuterHandles&&!this.DDM.isOverTarget(c,this)){}else{if(this.clickValidator(g)){this.setStartPosition();this.b4MouseDown(g);this.onMouseDown(g);this.DDM.handleMouseDown(g,this);if(this.preventDefault||this.stopPropagation){if(this.preventDefault){g.preventDefault()}if(this.stopPropagation){g.stopPropagation()}}else{this.DDM.stopEvent(g)}}else{}}},clickValidator:function(d){var c=d.getTarget();return(this.isValidHandleChild(c)&&(this.id==this.handleElId||this.DDM.handleWasClicked(c,this.id)))},addInvalidHandleType:function(c){var d=c.toUpperCase();this.invalidHandleTypes[d]=d},addInvalidHandleId:function(c){if(typeof c!==\"string\"){c=Ext.id(c)}this.invalidHandleIds[c]=c},addInvalidHandleClass:function(c){this.invalidHandleClasses.push(c)},removeInvalidHandleType:function(c){var d=c.toUpperCase();delete this.invalidHandleTypes[d]},removeInvalidHandleId:function(c){if(typeof c!==\"string\"){c=Ext.id(c)}delete this.invalidHandleIds[c]},removeInvalidHandleClass:function(d){for(var e=0,c=this.invalidHandleClasses.length;e<c;++e){if(this.invalidHandleClasses[e]==d){delete this.invalidHandleClasses[e]}}},isValidHandleChild:function(h){var g=true;var k;try{k=h.nodeName.toUpperCase()}catch(j){k=h.nodeName}g=g&&!this.invalidHandleTypes[k];g=g&&!this.invalidHandleIds[h.id];for(var d=0,c=this.invalidHandleClasses.length;g&&d<c;++d){g=!Ext.fly(h).hasClass(this.invalidHandleClasses[d])}return g},setXTicks:function(g,c){this.xTicks=[];this.xTickSize=c;var e={};for(var d=this.initPageX;d>=this.minX;d=d-c){if(!e[d]){this.xTicks[this.xTicks.length]=d;e[d]=true}}for(d=this.initPageX;d<=this.maxX;d=d+c){if(!e[d]){this.xTicks[this.xTicks.length]=d;e[d]=true}}this.xTicks.sort(this.DDM.numericSort)},setYTicks:function(g,c){this.yTicks=[];this.yTickSize=c;var e={};for(var d=this.initPageY;d>=this.minY;d=d-c){if(!e[d]){this.yTicks[this.yTicks.length]=d;e[d]=true}}for(d=this.initPageY;d<=this.maxY;d=d+c){if(!e[d]){this.yTicks[this.yTicks.length]=d;e[d]=true}}this.yTicks.sort(this.DDM.numericSort)},setXConstraint:function(e,d,c){this.leftConstraint=e;this.rightConstraint=d;this.minX=this.initPageX-e;this.maxX=this.initPageX+d;if(c){this.setXTicks(this.initPageX,c)}this.constrainX=true},clearConstraints:function(){this.constrainX=false;this.constrainY=false;this.clearTicks()},clearTicks:function(){this.xTicks=null;this.yTicks=null;this.xTickSize=0;this.yTickSize=0},setYConstraint:function(c,e,d){this.topConstraint=c;this.bottomConstraint=e;this.minY=this.initPageY-c;this.maxY=this.initPageY+e;if(d){this.setYTicks(this.initPageY,d)}this.constrainY=true},resetConstraints:function(){if(this.initPageX||this.initPageX===0){var d=(this.maintainOffset)?this.lastPageX-this.initPageX:0;var c=(this.maintainOffset)?this.lastPageY-this.initPageY:0;this.setInitPosition(d,c)}else{this.setInitPosition()}if(this.constrainX){this.setXConstraint(this.leftConstraint,this.rightConstraint,this.xTickSize)}if(this.constrainY){this.setYConstraint(this.topConstraint,this.bottomConstraint,this.yTickSize)}},getTick:function(k,g){if(!g){return k}else{if(g[0]>=k){return g[0]}else{for(var d=0,c=g.length;d<c;++d){var e=d+1;if(g[e]&&g[e]>=k){var j=k-g[d];var h=g[e]-k;return(h>j)?g[d]:g[e]}}return g[g.length-1]}}},toString:function(){return(\"DragDrop \"+this.id)}}})();if(!Ext.dd.DragDropMgr){Ext.dd.DragDropMgr=function(){var a=Ext.EventManager;return{ids:{},handleIds:{},dragCurrent:null,dragOvers:{},deltaX:0,deltaY:0,preventDefault:true,stopPropagation:true,initialized:false,locked:false,init:function(){this.initialized=true},POINT:0,INTERSECT:1,mode:0,notifyOccluded:false,_execOnAll:function(d,c){for(var e in this.ids){for(var b in this.ids[e]){var g=this.ids[e][b];if(!this.isTypeOfDD(g)){continue}g[d].apply(g,c)}}},_onLoad:function(){this.init();a.on(document,\"mouseup\",this.handleMouseUp,this,true);a.on(document,\"mousemove\",this.handleMouseMove,this,true);a.on(window,\"unload\",this._onUnload,this,true);a.on(window,\"resize\",this._onResize,this,true)},_onResize:function(b){this._execOnAll(\"resetConstraints\",[])},lock:function(){this.locked=true},unlock:function(){this.locked=false},isLocked:function(){return this.locked},locationCache:{},useCache:true,clickPixelThresh:3,clickTimeThresh:350,dragThreshMet:false,clickTimeout:null,startX:0,startY:0,regDragDrop:function(c,b){if(!this.initialized){this.init()}if(!this.ids[b]){this.ids[b]={}}this.ids[b][c.id]=c},removeDDFromGroup:function(d,b){if(!this.ids[b]){this.ids[b]={}}var c=this.ids[b];if(c&&c[d.id]){delete c[d.id]}},_remove:function(c){for(var b in c.groups){if(b&&this.ids[b]&&this.ids[b][c.id]){delete this.ids[b][c.id]}}delete this.handleIds[c.id]},regHandle:function(c,b){if(!this.handleIds[c]){this.handleIds[c]={}}this.handleIds[c][b]=b},isDragDrop:function(b){return(this.getDDById(b))?true:false},getRelated:function(h,c){var g=[];for(var e in h.groups){for(var d in this.ids[e]){var b=this.ids[e][d];if(!this.isTypeOfDD(b)){continue}if(!c||b.isTarget){g[g.length]=b}}}return g},isLegalTarget:function(g,e){var c=this.getRelated(g,true);for(var d=0,b=c.length;d<b;++d){if(c[d].id==e.id){return true}}return false},isTypeOfDD:function(b){return(b&&b.__ygDragDrop)},isHandle:function(c,b){return(this.handleIds[c]&&this.handleIds[c][b])},getDDById:function(c){for(var b in this.ids){if(this.ids[b][c]){return this.ids[b][c]}}return null},handleMouseDown:function(d,c){if(Ext.QuickTips){Ext.QuickTips.ddDisable()}if(this.dragCurrent){this.handleMouseUp(d)}this.currentTarget=d.getTarget();this.dragCurrent=c;var b=c.getEl();this.startX=d.getPageX();this.startY=d.getPageY();this.deltaX=this.startX-b.offsetLeft;this.deltaY=this.startY-b.offsetTop;this.dragThreshMet=false;this.clickTimeout=setTimeout(function(){var e=Ext.dd.DDM;e.startDrag(e.startX,e.startY)},this.clickTimeThresh)},startDrag:function(b,c){clearTimeout(this.clickTimeout);if(this.dragCurrent){this.dragCurrent.b4StartDrag(b,c);this.dragCurrent.startDrag(b,c)}this.dragThreshMet=true},handleMouseUp:function(b){if(Ext.QuickTips){Ext.QuickTips.ddEnable()}if(!this.dragCurrent){return}clearTimeout(this.clickTimeout);if(this.dragThreshMet){this.fireEvents(b,true)}else{}this.stopDrag(b);this.stopEvent(b)},stopEvent:function(b){if(this.stopPropagation){b.stopPropagation()}if(this.preventDefault){b.preventDefault()}},stopDrag:function(b){if(this.dragCurrent){if(this.dragThreshMet){this.dragCurrent.b4EndDrag(b);this.dragCurrent.endDrag(b)}this.dragCurrent.onMouseUp(b)}this.dragCurrent=null;this.dragOvers={}},handleMouseMove:function(d){if(!this.dragCurrent){return true}if(Ext.isIE&&(d.button!==0&&d.button!==1&&d.button!==2)){this.stopEvent(d);return this.handleMouseUp(d)}if(!this.dragThreshMet){var c=Math.abs(this.startX-d.getPageX());var b=Math.abs(this.startY-d.getPageY());if(c>this.clickPixelThresh||b>this.clickPixelThresh){this.startDrag(this.startX,this.startY)}}if(this.dragThreshMet){this.dragCurrent.b4Drag(d);this.dragCurrent.onDrag(d);if(!this.dragCurrent.moveOnly){this.fireEvents(d,false)}}this.stopEvent(d);return true},fireEvents:function(o,r){var q=this,l=q.dragCurrent,s=o.getPoint(),c,u,g=[],b=[],h=[],m=[],k=[],d=[],p,j,n,t;if(!l||l.isLocked()){return}for(j in q.dragOvers){c=q.dragOvers[j];if(!q.isTypeOfDD(c)){continue}if(!this.isOverTarget(s,c,q.mode)){h.push(c)}b[j]=true;delete q.dragOvers[j]}for(t in l.groups){if(\"string\"!=typeof t){continue}for(j in q.ids[t]){c=q.ids[t][j];if(q.isTypeOfDD(c)&&(u=c.getEl())&&(c.isTarget)&&(!c.isLocked())&&((c!=l)||(l.ignoreSelf===false))){if((c.zIndex=q.getZIndex(u))!==-1){p=true}g.push(c)}}}if(p){g.sort(q.byZIndex)}for(j=0,n=g.length;j<n;j++){c=g[j];if(q.isOverTarget(s,c,q.mode)){if(r){k.push(c)}else{if(!b[c.id]){d.push(c)}else{m.push(c)}q.dragOvers[c.id]=c}if(!q.notifyOccluded){break}}}if(q.mode){if(h.length){l.b4DragOut(o,h);l.onDragOut(o,h)}if(d.length){l.onDragEnter(o,d)}if(m.length){l.b4DragOver(o,m);l.onDragOver(o,m)}if(k.length){l.b4DragDrop(o,k);l.onDragDrop(o,k)}}else{for(j=0,n=h.length;j<n;++j){l.b4DragOut(o,h[j].id);l.onDragOut(o,h[j].id)}for(j=0,n=d.length;j<n;++j){l.onDragEnter(o,d[j].id)}for(j=0,n=m.length;j<n;++j){l.b4DragOver(o,m[j].id);l.onDragOver(o,m[j].id)}for(j=0,n=k.length;j<n;++j){l.b4DragDrop(o,k[j].id);l.onDragDrop(o,k[j].id)}}if(r&&!k.length){l.onInvalidDrop(o)}},getZIndex:function(c){var b=document.body,d,e=-1;c=Ext.getDom(c);while(c!==b){if(!isNaN(d=Number(Ext.fly(c).getStyle(\"zIndex\")))){e=d}c=c.parentNode}return e},byZIndex:function(c,b){return c.zIndex<b.zIndex},getBestMatch:function(d){var g=null;var c=d.length;if(c==1){g=d[0]}else{for(var e=0;e<c;++e){var b=d[e];if(b.cursorIsOver){g=b;break}else{if(!g||g.overlap.getArea()<b.overlap.getArea()){g=b}}}}return g},refreshCache:function(c){for(var b in c){if(\"string\"!=typeof b){continue}for(var d in this.ids[b]){var e=this.ids[b][d];if(this.isTypeOfDD(e)){var g=this.getLocation(e);if(g){this.locationCache[e.id]=g}else{delete this.locationCache[e.id]}}}}},verifyEl:function(c){if(c){var b;if(Ext.isIE){try{b=c.offsetParent}catch(d){}}else{b=c.offsetParent}if(b){return true}}return false},getLocation:function(j){if(!this.isTypeOfDD(j)){return null}var h=j.getEl(),o,g,d,q,p,s,c,n,i,m;try{o=Ext.lib.Dom.getXY(h)}catch(k){}if(!o){return null}g=o[0];d=g+h.offsetWidth;q=o[1];p=q+h.offsetHeight;s=q-j.padding[0];c=d+j.padding[1];n=p+j.padding[2];i=g-j.padding[3];return new Ext.lib.Region(s,c,n,i)},isOverTarget:function(k,b,d){var g=this.locationCache[b.id];if(!g||!this.useCache){g=this.getLocation(b);this.locationCache[b.id]=g}if(!g){return false}b.cursorIsOver=g.contains(k);var j=this.dragCurrent;if(!j||!j.getTargetCoord||(!d&&!j.constrainX&&!j.constrainY)){return b.cursorIsOver}b.overlap=null;var h=j.getTargetCoord(k.x,k.y);var c=j.getDragEl();var e=new Ext.lib.Region(h.y,h.x+c.offsetWidth,h.y+c.offsetHeight,h.x);var i=e.intersect(g);if(i){b.overlap=i;return(d)?true:b.cursorIsOver}else{return false}},_onUnload:function(c,b){a.removeListener(document,\"mouseup\",this.handleMouseUp,this);a.removeListener(document,\"mousemove\",this.handleMouseMove,this);a.removeListener(window,\"resize\",this._onResize,this);Ext.dd.DragDropMgr.unregAll()},unregAll:function(){if(this.dragCurrent){this.stopDrag();this.dragCurrent=null}this._execOnAll(\"unreg\",[]);for(var b in this.elementCache){delete this.elementCache[b]}this.elementCache={};this.ids={}},elementCache:{},getElWrapper:function(c){var b=this.elementCache[c];if(!b||!b.el){b=this.elementCache[c]=new this.ElementWrapper(Ext.getDom(c))}return b},getElement:function(b){return Ext.getDom(b)},getCss:function(c){var b=Ext.getDom(c);return(b)?b.style:null},ElementWrapper:function(b){this.el=b||null;this.id=this.el&&b.id;this.css=this.el&&b.style},getPosX:function(b){return Ext.lib.Dom.getX(b)},getPosY:function(b){return Ext.lib.Dom.getY(b)},swapNode:function(d,b){if(d.swapNode){d.swapNode(b)}else{var e=b.parentNode;var c=b.nextSibling;if(c==d){e.insertBefore(d,b)}else{if(b==d.nextSibling){e.insertBefore(b,d)}else{d.parentNode.replaceChild(b,d);e.insertBefore(d,c)}}}},getScroll:function(){var d,b,e=document.documentElement,c=document.body;if(e&&(e.scrollTop||e.scrollLeft)){d=e.scrollTop;b=e.scrollLeft}else{if(c){d=c.scrollTop;b=c.scrollLeft}else{}}return{top:d,left:b}},getStyle:function(c,b){return Ext.fly(c).getStyle(b)},getScrollTop:function(){return this.getScroll().top},getScrollLeft:function(){return this.getScroll().left},moveToEl:function(b,d){var c=Ext.lib.Dom.getXY(d);Ext.lib.Dom.setXY(b,c)},numericSort:function(d,c){return(d-c)},_timeoutCount:0,_addListeners:function(){var b=Ext.dd.DDM;if(Ext.lib.Event&&document){b._onLoad()}else{if(b._timeoutCount>2000){}else{setTimeout(b._addListeners,10);if(document&&document.body){b._timeoutCount+=1}}}},handleWasClicked:function(b,d){if(this.isHandle(d,b.id)){return true}else{var c=b.parentNode;while(c){if(this.isHandle(d,c.id)){return true}else{c=c.parentNode}}}return false}}}();Ext.dd.DDM=Ext.dd.DragDropMgr;Ext.dd.DDM._addListeners()}Ext.dd.DD=function(c,a,b){if(c){this.init(c,a,b)}};Ext.extend(Ext.dd.DD,Ext.dd.DragDrop,{scroll:true,autoOffset:function(c,b){var a=c-this.startPageX;var d=b-this.startPageY;this.setDelta(a,d)},setDelta:function(b,a){this.deltaX=b;this.deltaY=a},setDragElPos:function(c,b){var a=this.getDragEl();this.alignElWithMouse(a,c,b)},alignElWithMouse:function(c,h,g){var e=this.getTargetCoord(h,g);var b=c.dom?c:Ext.fly(c,\"_dd\");if(!this.deltaSetXY){var i=[e.x,e.y];b.setXY(i);var d=b.getLeft(true);var a=b.getTop(true);this.deltaSetXY=[d-e.x,a-e.y]}else{b.setLeftTop(e.x+this.deltaSetXY[0],e.y+this.deltaSetXY[1])}this.cachePosition(e.x,e.y);this.autoScroll(e.x,e.y,c.offsetHeight,c.offsetWidth);return e},cachePosition:function(b,a){if(b){this.lastPageX=b;this.lastPageY=a}else{var c=Ext.lib.Dom.getXY(this.getEl());this.lastPageX=c[0];this.lastPageY=c[1]}},autoScroll:function(l,k,e,m){if(this.scroll){var n=Ext.lib.Dom.getViewHeight();var b=Ext.lib.Dom.getViewWidth();var p=this.DDM.getScrollTop();var d=this.DDM.getScrollLeft();var j=e+k;var o=m+l;var i=(n+p-k-this.deltaY);var g=(b+d-l-this.deltaX);var c=40;var a=(document.all)?80:30;if(j>n&&i<c){window.scrollTo(d,p+a)}if(k<p&&p>0&&k-p<c){window.scrollTo(d,p-a)}if(o>b&&g<c){window.scrollTo(d+a,p)}if(l<d&&d>0&&l-d<c){window.scrollTo(d-a,p)}}},getTargetCoord:function(c,b){var a=c-this.deltaX;var d=b-this.deltaY;if(this.constrainX){if(a<this.minX){a=this.minX}if(a>this.maxX){a=this.maxX}}if(this.constrainY){if(d<this.minY){d=this.minY}if(d>this.maxY){d=this.maxY}}a=this.getTick(a,this.xTicks);d=this.getTick(d,this.yTicks);return{x:a,y:d}},applyConfig:function(){Ext.dd.DD.superclass.applyConfig.call(this);this.scroll=(this.config.scroll!==false)},b4MouseDown:function(a){this.autoOffset(a.getPageX(),a.getPageY())},b4Drag:function(a){this.setDragElPos(a.getPageX(),a.getPageY())},toString:function(){return(\"DD \"+this.id)}});Ext.dd.DDProxy=function(c,a,b){if(c){this.init(c,a,b);this.initFrame()}};Ext.dd.DDProxy.dragElId=\"ygddfdiv\";Ext.extend(Ext.dd.DDProxy,Ext.dd.DD,{resizeFrame:true,centerFrame:false,createFrame:function(){var b=this;var a=document.body;if(!a||!a.firstChild){setTimeout(function(){b.createFrame()},50);return}var d=this.getDragEl();if(!d){d=document.createElement(\"div\");d.id=this.dragElId;var c=d.style;c.position=\"absolute\";c.visibility=\"hidden\";c.cursor=\"move\";c.border=\"2px solid #aaa\";c.zIndex=999;a.insertBefore(d,a.firstChild)}},initFrame:function(){this.createFrame()},applyConfig:function(){Ext.dd.DDProxy.superclass.applyConfig.call(this);this.resizeFrame=(this.config.resizeFrame!==false);this.centerFrame=(this.config.centerFrame);this.setDragElId(this.config.dragElId||Ext.dd.DDProxy.dragElId)},showFrame:function(e,d){var c=this.getEl();var a=this.getDragEl();var b=a.style;this._resizeProxy();if(this.centerFrame){this.setDelta(Math.round(parseInt(b.width,10)/2),Math.round(parseInt(b.height,10)/2))}this.setDragElPos(e,d);Ext.fly(a).show()},_resizeProxy:function(){if(this.resizeFrame){var a=this.getEl();Ext.fly(this.getDragEl()).setSize(a.offsetWidth,a.offsetHeight)}},b4MouseDown:function(b){var a=b.getPageX();var c=b.getPageY();this.autoOffset(a,c);this.setDragElPos(a,c)},b4StartDrag:function(a,b){this.showFrame(a,b)},b4EndDrag:function(a){Ext.fly(this.getDragEl()).hide()},endDrag:function(c){var b=this.getEl();var a=this.getDragEl();a.style.visibility=\"\";this.beforeMove();b.style.visibility=\"hidden\";Ext.dd.DDM.moveToEl(b,a);a.style.visibility=\"hidden\";b.style.visibility=\"\";this.afterDrag()},beforeMove:function(){},afterDrag:function(){},toString:function(){return(\"DDProxy \"+this.id)}});Ext.dd.DDTarget=function(c,a,b){if(c){this.initTarget(c,a,b)}};Ext.extend(Ext.dd.DDTarget,Ext.dd.DragDrop,{getDragEl:Ext.emptyFn,isValidHandleChild:Ext.emptyFn,startDrag:Ext.emptyFn,endDrag:Ext.emptyFn,onDrag:Ext.emptyFn,onDragDrop:Ext.emptyFn,onDragEnter:Ext.emptyFn,onDragOut:Ext.emptyFn,onDragOver:Ext.emptyFn,onInvalidDrop:Ext.emptyFn,onMouseDown:Ext.emptyFn,onMouseUp:Ext.emptyFn,setXConstraint:Ext.emptyFn,setYConstraint:Ext.emptyFn,resetConstraints:Ext.emptyFn,clearConstraints:Ext.emptyFn,clearTicks:Ext.emptyFn,setInitPosition:Ext.emptyFn,setDragElId:Ext.emptyFn,setHandleElId:Ext.emptyFn,setOuterHandleElId:Ext.emptyFn,addInvalidHandleClass:Ext.emptyFn,addInvalidHandleId:Ext.emptyFn,addInvalidHandleType:Ext.emptyFn,removeInvalidHandleClass:Ext.emptyFn,removeInvalidHandleId:Ext.emptyFn,removeInvalidHandleType:Ext.emptyFn,toString:function(){return(\"DDTarget \"+this.id)}});Ext.dd.DragTracker=Ext.extend(Ext.util.Observable,{active:false,tolerance:5,autoStart:false,constructor:function(a){Ext.apply(this,a);this.addEvents(\"mousedown\",\"mouseup\",\"mousemove\",\"dragstart\",\"dragend\",\"drag\");this.dragRegion=new Ext.lib.Region(0,0,0,0);if(this.el){this.initEl(this.el)}Ext.dd.DragTracker.superclass.constructor.call(this,a)},initEl:function(a){this.el=Ext.get(a);a.on(\"mousedown\",this.onMouseDown,this,this.delegate?{delegate:this.delegate}:undefined)},destroy:function(){this.el.un(\"mousedown\",this.onMouseDown,this);delete this.el},onMouseDown:function(b,a){if(this.fireEvent(\"mousedown\",this,b)!==false&&this.onBeforeStart(b)!==false){this.startXY=this.lastXY=b.getXY();this.dragTarget=this.delegate?a:this.el.dom;if(this.preventDefault!==false){b.preventDefault()}Ext.getDoc().on({scope:this,mouseup:this.onMouseUp,mousemove:this.onMouseMove,selectstart:this.stopSelect});if(this.autoStart){this.timer=this.triggerStart.defer(this.autoStart===true?1000:this.autoStart,this,[b])}}},onMouseMove:function(g,d){var b=Ext.isIE6||Ext.isIE7||Ext.isIE8;if(this.active&&b&&!g.browserEvent.button){g.preventDefault();this.onMouseUp(g);return}g.preventDefault();var c=g.getXY(),a=this.startXY;this.lastXY=c;if(!this.active){if(Math.abs(a[0]-c[0])>this.tolerance||Math.abs(a[1]-c[1])>this.tolerance){this.triggerStart(g)}else{return}}this.fireEvent(\"mousemove\",this,g);this.onDrag(g);this.fireEvent(\"drag\",this,g)},onMouseUp:function(c){var b=Ext.getDoc(),a=this.active;b.un(\"mousemove\",this.onMouseMove,this);b.un(\"mouseup\",this.onMouseUp,this);b.un(\"selectstart\",this.stopSelect,this);c.preventDefault();this.clearStart();this.active=false;delete this.elRegion;this.fireEvent(\"mouseup\",this,c);if(a){this.onEnd(c);this.fireEvent(\"dragend\",this,c)}},triggerStart:function(a){this.clearStart();this.active=true;this.onStart(a);this.fireEvent(\"dragstart\",this,a)},clearStart:function(){if(this.timer){clearTimeout(this.timer);delete this.timer}},stopSelect:function(a){a.stopEvent();return false},onBeforeStart:function(a){},onStart:function(a){},onDrag:function(a){},onEnd:function(a){},getDragTarget:function(){return this.dragTarget},getDragCt:function(){return this.el},getXY:function(a){return a?this.constrainModes[a].call(this,this.lastXY):this.lastXY},getOffset:function(c){var b=this.getXY(c),a=this.startXY;return[a[0]-b[0],a[1]-b[1]]},constrainModes:{point:function(b){if(!this.elRegion){this.elRegion=this.getDragCt().getRegion()}var a=this.dragRegion;a.left=b[0];a.top=b[1];a.right=b[0];a.bottom=b[1];a.constrainTo(this.elRegion);return[a.left,a.top]}}});Ext.dd.ScrollManager=function(){var c=Ext.dd.DragDropMgr;var e={};var b=null;var i={};var h=function(l){b=null;a()};var j=function(){if(c.dragCurrent){c.refreshCache(c.dragCurrent.groups)}};var d=function(){if(c.dragCurrent){var l=Ext.dd.ScrollManager;var m=i.el.ddScrollConfig?i.el.ddScrollConfig.increment:l.increment;if(!l.animate){if(i.el.scroll(i.dir,m)){j()}}else{i.el.scroll(i.dir,m,true,l.animDuration,j)}}};var a=function(){if(i.id){clearInterval(i.id)}i.id=0;i.el=null;i.dir=\"\"};var g=function(m,l){a();i.el=m;i.dir=l;var o=m.ddScrollConfig?m.ddScrollConfig.ddGroup:undefined,n=(m.ddScrollConfig&&m.ddScrollConfig.frequency)?m.ddScrollConfig.frequency:Ext.dd.ScrollManager.frequency;if(o===undefined||c.dragCurrent.ddGroup==o){i.id=setInterval(d,n)}};var k=function(o,q){if(q||!c.dragCurrent){return}var s=Ext.dd.ScrollManager;if(!b||b!=c.dragCurrent){b=c.dragCurrent;s.refreshCache()}var t=Ext.lib.Event.getXY(o);var u=new Ext.lib.Point(t[0],t[1]);for(var m in e){var n=e[m],l=n._region;var p=n.ddScrollConfig?n.ddScrollConfig:s;if(l&&l.contains(u)&&n.isScrollable()){if(l.bottom-u.y<=p.vthresh){if(i.el!=n){g(n,\"down\")}return}else{if(l.right-u.x<=p.hthresh){if(i.el!=n){g(n,\"left\")}return}else{if(u.y-l.top<=p.vthresh){if(i.el!=n){g(n,\"up\")}return}else{if(u.x-l.left<=p.hthresh){if(i.el!=n){g(n,\"right\")}return}}}}}}a()};c.fireEvents=c.fireEvents.createSequence(k,c);c.stopDrag=c.stopDrag.createSequence(h,c);return{register:function(n){if(Ext.isArray(n)){for(var m=0,l=n.length;m<l;m++){this.register(n[m])}}else{n=Ext.get(n);e[n.id]=n}},unregister:function(n){if(Ext.isArray(n)){for(var m=0,l=n.length;m<l;m++){this.unregister(n[m])}}else{n=Ext.get(n);delete e[n.id]}},vthresh:25,hthresh:25,increment:100,frequency:500,animate:true,animDuration:0.4,ddGroup:undefined,refreshCache:function(){for(var l in e){if(typeof e[l]==\"object\"){e[l]._region=e[l].getRegion()}}}}}();Ext.dd.Registry=function(){var d={};var b={};var a=0;var c=function(g,e){if(typeof g==\"string\"){return g}var h=g.id;if(!h&&e!==false){h=\"extdd-\"+(++a);g.id=h}return h};return{register:function(j,k){k=k||{};if(typeof j==\"string\"){j=document.getElementById(j)}k.ddel=j;d[c(j)]=k;if(k.isHandle!==false){b[k.ddel.id]=k}if(k.handles){var h=k.handles;for(var g=0,e=h.length;g<e;g++){b[c(h[g])]=k}}},unregister:function(j){var l=c(j,false);var k=d[l];if(k){delete d[l];if(k.handles){var h=k.handles;for(var g=0,e=h.length;g<e;g++){delete b[c(h[g],false)]}}}},getHandle:function(e){if(typeof e!=\"string\"){e=e.id}return b[e]},getHandleFromEvent:function(h){var g=Ext.lib.Event.getTarget(h);return g?b[g.id]:null},getTarget:function(e){if(typeof e!=\"string\"){e=e.id}return d[e]},getTargetFromEvent:function(h){var g=Ext.lib.Event.getTarget(h);return g?d[g.id]||b[g.id]:null}}}();Ext.dd.StatusProxy=function(a){Ext.apply(this,a);this.id=this.id||Ext.id();this.el=new Ext.Layer({dh:{id:this.id,tag:\"div\",cls:\"x-dd-drag-proxy \"+this.dropNotAllowed,children:[{tag:\"div\",cls:\"x-dd-drop-icon\"},{tag:\"div\",cls:\"x-dd-drag-ghost\"}]},shadow:!a||a.shadow!==false});this.ghost=Ext.get(this.el.dom.childNodes[1]);this.dropStatus=this.dropNotAllowed};Ext.dd.StatusProxy.prototype={dropAllowed:\"x-dd-drop-ok\",dropNotAllowed:\"x-dd-drop-nodrop\",setStatus:function(a){a=a||this.dropNotAllowed;if(this.dropStatus!=a){this.el.replaceClass(this.dropStatus,a);this.dropStatus=a}},reset:function(a){this.el.dom.className=\"x-dd-drag-proxy \"+this.dropNotAllowed;this.dropStatus=this.dropNotAllowed;if(a){this.ghost.update(\"\")}},update:function(a){if(typeof a==\"string\"){this.ghost.update(a)}else{this.ghost.update(\"\");a.style.margin=\"0\";this.ghost.dom.appendChild(a)}var b=this.ghost.dom.firstChild;if(b){Ext.fly(b).setStyle(\"float\",\"none\")}},getEl:function(){return this.el},getGhost:function(){return this.ghost},hide:function(a){this.el.hide();if(a){this.reset(true)}},stop:function(){if(this.anim&&this.anim.isAnimated&&this.anim.isAnimated()){this.anim.stop()}},show:function(){this.el.show()},sync:function(){this.el.sync()},repair:function(b,c,a){this.callback=c;this.scope=a;if(b&&this.animRepair!==false){this.el.addClass(\"x-dd-drag-repair\");this.el.hideUnders(true);this.anim=this.el.shift({duration:this.repairDuration||0.5,easing:\"easeOut\",xy:b,stopFx:true,callback:this.afterRepair,scope:this})}else{this.afterRepair()}},afterRepair:function(){this.hide(true);if(typeof this.callback==\"function\"){this.callback.call(this.scope||this)}this.callback=null;this.scope=null},destroy:function(){Ext.destroy(this.ghost,this.el)}};Ext.dd.DragSource=function(b,a){this.el=Ext.get(b);if(!this.dragData){this.dragData={}}Ext.apply(this,a);if(!this.proxy){this.proxy=new Ext.dd.StatusProxy()}Ext.dd.DragSource.superclass.constructor.call(this,this.el.dom,this.ddGroup||this.group,{dragElId:this.proxy.id,resizeFrame:false,isTarget:false,scroll:this.scroll===true});this.dragging=false};Ext.extend(Ext.dd.DragSource,Ext.dd.DDProxy,{dropAllowed:\"x-dd-drop-ok\",dropNotAllowed:\"x-dd-drop-nodrop\",getDragData:function(a){return this.dragData},onDragEnter:function(c,d){var b=Ext.dd.DragDropMgr.getDDById(d);this.cachedTarget=b;if(this.beforeDragEnter(b,c,d)!==false){if(b.isNotifyTarget){var a=b.notifyEnter(this,c,this.dragData);this.proxy.setStatus(a)}else{this.proxy.setStatus(this.dropAllowed)}if(this.afterDragEnter){this.afterDragEnter(b,c,d)}}},beforeDragEnter:function(b,a,c){return true},alignElWithMouse:function(){Ext.dd.DragSource.superclass.alignElWithMouse.apply(this,arguments);this.proxy.sync()},onDragOver:function(c,d){var b=this.cachedTarget||Ext.dd.DragDropMgr.getDDById(d);if(this.beforeDragOver(b,c,d)!==false){if(b.isNotifyTarget){var a=b.notifyOver(this,c,this.dragData);this.proxy.setStatus(a)}if(this.afterDragOver){this.afterDragOver(b,c,d)}}},beforeDragOver:function(b,a,c){return true},onDragOut:function(b,c){var a=this.cachedTarget||Ext.dd.DragDropMgr.getDDById(c);if(this.beforeDragOut(a,b,c)!==false){if(a.isNotifyTarget){a.notifyOut(this,b,this.dragData)}this.proxy.reset();if(this.afterDragOut){this.afterDragOut(a,b,c)}}this.cachedTarget=null},beforeDragOut:function(b,a,c){return true},onDragDrop:function(b,c){var a=this.cachedTarget||Ext.dd.DragDropMgr.getDDById(c);if(this.beforeDragDrop(a,b,c)!==false){if(a.isNotifyTarget){if(a.notifyDrop(this,b,this.dragData)){this.onValidDrop(a,b,c)}else{this.onInvalidDrop(a,b,c)}}else{this.onValidDrop(a,b,c)}if(this.afterDragDrop){this.afterDragDrop(a,b,c)}}delete this.cachedTarget},beforeDragDrop:function(b,a,c){return true},onValidDrop:function(b,a,c){this.hideProxy();if(this.afterValidDrop){this.afterValidDrop(b,a,c)}},getRepairXY:function(b,a){return this.el.getXY()},onInvalidDrop:function(b,a,c){this.beforeInvalidDrop(b,a,c);if(this.cachedTarget){if(this.cachedTarget.isNotifyTarget){this.cachedTarget.notifyOut(this,a,this.dragData)}this.cacheTarget=null}this.proxy.repair(this.getRepairXY(a,this.dragData),this.afterRepair,this);if(this.afterInvalidDrop){this.afterInvalidDrop(a,c)}},afterRepair:function(){if(Ext.enableFx){this.el.highlight(this.hlColor||\"c3daf9\")}this.dragging=false},beforeInvalidDrop:function(b,a,c){return true},handleMouseDown:function(b){if(this.dragging){return}var a=this.getDragData(b);if(a&&this.onBeforeDrag(a,b)!==false){this.dragData=a;this.proxy.stop();Ext.dd.DragSource.superclass.handleMouseDown.apply(this,arguments)}},onBeforeDrag:function(a,b){return true},onStartDrag:Ext.emptyFn,startDrag:function(a,b){this.proxy.reset();this.dragging=true;this.proxy.update(\"\");this.onInitDrag(a,b);this.proxy.show()},onInitDrag:function(a,c){var b=this.el.dom.cloneNode(true);b.id=Ext.id();this.proxy.update(b);this.onStartDrag(a,c);return true},getProxy:function(){return this.proxy},hideProxy:function(){this.proxy.hide();this.proxy.reset(true);this.dragging=false},triggerCacheRefresh:function(){Ext.dd.DDM.refreshCache(this.groups)},b4EndDrag:function(a){},endDrag:function(a){this.onEndDrag(this.dragData,a)},onEndDrag:function(a,b){},autoOffset:function(a,b){this.setDelta(-12,-20)},destroy:function(){Ext.dd.DragSource.superclass.destroy.call(this);Ext.destroy(this.proxy)}});Ext.dd.DropTarget=Ext.extend(Ext.dd.DDTarget,{constructor:function(b,a){this.el=Ext.get(b);Ext.apply(this,a);if(this.containerScroll){Ext.dd.ScrollManager.register(this.el)}Ext.dd.DropTarget.superclass.constructor.call(this,this.el.dom,this.ddGroup||this.group,{isTarget:true})},dropAllowed:\"x-dd-drop-ok\",dropNotAllowed:\"x-dd-drop-nodrop\",isTarget:true,isNotifyTarget:true,notifyEnter:function(a,c,b){if(this.overClass){this.el.addClass(this.overClass)}return this.dropAllowed},notifyOver:function(a,c,b){return this.dropAllowed},notifyOut:function(a,c,b){if(this.overClass){this.el.removeClass(this.overClass)}},notifyDrop:function(a,c,b){return false},destroy:function(){Ext.dd.DropTarget.superclass.destroy.call(this);if(this.containerScroll){Ext.dd.ScrollManager.unregister(this.el)}}});Ext.dd.DragZone=Ext.extend(Ext.dd.DragSource,{constructor:function(b,a){Ext.dd.DragZone.superclass.constructor.call(this,b,a);if(this.containerScroll){Ext.dd.ScrollManager.register(this.el)}},getDragData:function(a){return Ext.dd.Registry.getHandleFromEvent(a)},onInitDrag:function(a,b){this.proxy.update(this.dragData.ddel.cloneNode(true));this.onStartDrag(a,b);return true},afterRepair:function(){if(Ext.enableFx){Ext.Element.fly(this.dragData.ddel).highlight(this.hlColor||\"c3daf9\")}this.dragging=false},getRepairXY:function(a){return Ext.Element.fly(this.dragData.ddel).getXY()},destroy:function(){Ext.dd.DragZone.superclass.destroy.call(this);if(this.containerScroll){Ext.dd.ScrollManager.unregister(this.el)}}});Ext.dd.DropZone=function(b,a){Ext.dd.DropZone.superclass.constructor.call(this,b,a)};Ext.extend(Ext.dd.DropZone,Ext.dd.DropTarget,{getTargetFromEvent:function(a){return Ext.dd.Registry.getTargetFromEvent(a)},onNodeEnter:function(d,a,c,b){},onNodeOver:function(d,a,c,b){return this.dropAllowed},onNodeOut:function(d,a,c,b){},onNodeDrop:function(d,a,c,b){return false},onContainerOver:function(a,c,b){return this.dropNotAllowed},onContainerDrop:function(a,c,b){return false},notifyEnter:function(a,c,b){return this.dropNotAllowed},notifyOver:function(a,c,b){var d=this.getTargetFromEvent(c);if(!d){if(this.lastOverNode){this.onNodeOut(this.lastOverNode,a,c,b);this.lastOverNode=null}return this.onContainerOver(a,c,b)}if(this.lastOverNode!=d){if(this.lastOverNode){this.onNodeOut(this.lastOverNode,a,c,b)}this.onNodeEnter(d,a,c,b);this.lastOverNode=d}return this.onNodeOver(d,a,c,b)},notifyOut:function(a,c,b){if(this.lastOverNode){this.onNodeOut(this.lastOverNode,a,c,b);this.lastOverNode=null}},notifyDrop:function(a,c,b){if(this.lastOverNode){this.onNodeOut(this.lastOverNode,a,c,b);this.lastOverNode=null}var d=this.getTargetFromEvent(c);return d?this.onNodeDrop(d,a,c,b):this.onContainerDrop(a,c,b)},triggerCacheRefresh:function(){Ext.dd.DDM.refreshCache(this.groups)}});Ext.Element.addMethods({initDD:function(c,b,d){var a=new Ext.dd.DD(Ext.id(this.dom),c,b);return Ext.apply(a,d)},initDDProxy:function(c,b,d){var a=new Ext.dd.DDProxy(Ext.id(this.dom),c,b);return Ext.apply(a,d)},initDDTarget:function(c,b,d){var a=new Ext.dd.DDTarget(Ext.id(this.dom),c,b);return Ext.apply(a,d)}});Ext.data.Api=(function(){var a={};return{actions:{create:\"create\",read:\"read\",update:\"update\",destroy:\"destroy\"},restActions:{create:\"POST\",read:\"GET\",update:\"PUT\",destroy:\"DELETE\"},isAction:function(b){return(Ext.data.Api.actions[b])?true:false},getVerb:function(b){if(a[b]){return a[b]}for(var c in this.actions){if(this.actions[c]===b){a[b]=c;break}}return(a[b]!==undefined)?a[b]:null},isValid:function(b){var e=[];var d=this.actions;for(var c in b){if(!(c in d)){e.push(c)}}return(!e.length)?true:e},hasUniqueUrl:function(c,g){var b=(c.api[g])?c.api[g].url:null;var e=true;for(var d in c.api){if((e=(d===g)?true:(c.api[d].url!=b)?true:false)===false){break}}return e},prepare:function(b){if(!b.api){b.api={}}for(var d in this.actions){var c=this.actions[d];b.api[c]=b.api[c]||b.url||b.directFn;if(typeof(b.api[c])==\"string\"){b.api[c]={url:b.api[c],method:(b.restful===true)?Ext.data.Api.restActions[c]:undefined}}}},restify:function(b){b.restful=true;for(var c in this.restActions){b.api[this.actions[c]].method||(b.api[this.actions[c]].method=this.restActions[c])}b.onWrite=b.onWrite.createInterceptor(function(i,j,g,e){var d=j.reader;var h=new Ext.data.Response({action:i,raw:g});switch(g.status){case 200:return true;break;case 201:if(Ext.isEmpty(h.raw.responseText)){h.success=true}else{return true}break;case 204:h.success=true;h.data=null;break;default:return true;break}if(h.success===true){this.fireEvent(\"write\",this,i,h.data,h,e,j.request.arg)}else{this.fireEvent(\"exception\",this,\"remote\",i,j,h,e)}j.request.callback.call(j.request.scope,h.data,h,h.success);return false},b)}}})();Ext.data.Response=function(b,a){Ext.apply(this,b,{raw:a})};Ext.data.Response.prototype={message:null,success:false,status:null,root:null,raw:null,getMessage:function(){return this.message},getSuccess:function(){return this.success},getStatus:function(){return this.status},getRoot:function(){return this.root},getRawResponse:function(){return this.raw}};Ext.data.Api.Error=Ext.extend(Ext.Error,{constructor:function(b,a){this.arg=a;Ext.Error.call(this,b)},name:\"Ext.data.Api\"});Ext.apply(Ext.data.Api.Error.prototype,{lang:{\"action-url-undefined\":\"No fallback url defined for this action.  When defining a DataProxy api, please be sure to define an url for each CRUD action in Ext.data.Api.actions or define a default url in addition to your api-configuration.\",invalid:\"received an invalid API-configuration.  Please ensure your proxy API-configuration contains only the actions defined in Ext.data.Api.actions\",\"invalid-url\":\"Invalid url.  Please review your proxy configuration.\",execute:'Attempted to execute an unknown action.  Valid API actions are defined in Ext.data.Api.actions\"'}});Ext.data.SortTypes={none:function(a){return a},stripTagsRE:/<\\/?[^>]+>/gi,asText:function(a){return String(a).replace(this.stripTagsRE,\"\")},asUCText:function(a){return String(a).toUpperCase().replace(this.stripTagsRE,\"\")},asUCString:function(a){return String(a).toUpperCase()},asDate:function(a){if(!a){return 0}if(Ext.isDate(a)){return a.getTime()}return Date.parse(String(a))},asFloat:function(a){var b=parseFloat(String(a).replace(/,/g,\"\"));return isNaN(b)?0:b},asInt:function(a){var b=parseInt(String(a).replace(/,/g,\"\"),10);return isNaN(b)?0:b}};Ext.data.Record=function(a,b){this.id=(b||b===0)?b:Ext.data.Record.id(this);this.data=a||{}};Ext.data.Record.create=function(e){var c=Ext.extend(Ext.data.Record,{});var d=c.prototype;d.fields=new Ext.util.MixedCollection(false,function(g){return g.name});for(var b=0,a=e.length;b<a;b++){d.fields.add(new Ext.data.Field(e[b]))}c.getField=function(g){return d.fields.get(g)};return c};Ext.data.Record.PREFIX=\"ext-record\";Ext.data.Record.AUTO_ID=1;Ext.data.Record.EDIT=\"edit\";Ext.data.Record.REJECT=\"reject\";Ext.data.Record.COMMIT=\"commit\";Ext.data.Record.id=function(a){a.phantom=true;return[Ext.data.Record.PREFIX,\"-\",Ext.data.Record.AUTO_ID++].join(\"\")};Ext.data.Record.prototype={dirty:false,editing:false,error:null,modified:null,phantom:false,join:function(a){this.store=a},set:function(a,c){var b=Ext.isPrimitive(c)?String:Ext.encode;if(b(this.data[a])==b(c)){return}this.dirty=true;if(!this.modified){this.modified={}}if(this.modified[a]===undefined){this.modified[a]=this.data[a]}this.data[a]=c;if(!this.editing){this.afterEdit()}},afterEdit:function(){if(this.store!=undefined&&typeof this.store.afterEdit==\"function\"){this.store.afterEdit(this)}},afterReject:function(){if(this.store){this.store.afterReject(this)}},afterCommit:function(){if(this.store){this.store.afterCommit(this)}},get:function(a){return this.data[a]},beginEdit:function(){this.editing=true;this.modified=this.modified||{}},cancelEdit:function(){this.editing=false;delete this.modified},endEdit:function(){this.editing=false;if(this.dirty){this.afterEdit()}},reject:function(b){var a=this.modified;for(var c in a){if(typeof a[c]!=\"function\"){this.data[c]=a[c]}}this.dirty=false;delete this.modified;this.editing=false;if(b!==true){this.afterReject()}},commit:function(a){this.dirty=false;delete this.modified;this.editing=false;if(a!==true){this.afterCommit()}},getChanges:function(){var a=this.modified,b={};for(var c in a){if(a.hasOwnProperty(c)){b[c]=this.data[c]}}return b},hasError:function(){return this.error!==null},clearError:function(){this.error=null},copy:function(a){return new this.constructor(Ext.apply({},this.data),a||this.id)},isModified:function(a){return !!(this.modified&&this.modified.hasOwnProperty(a))},isValid:function(){return this.fields.find(function(a){return(a.allowBlank===false&&Ext.isEmpty(this.data[a.name]))?true:false},this)?false:true},markDirty:function(){this.dirty=true;if(!this.modified){this.modified={}}this.fields.each(function(a){this.modified[a.name]=this.data[a.name]},this)}};Ext.StoreMgr=Ext.apply(new Ext.util.MixedCollection(),{register:function(){for(var a=0,b;(b=arguments[a]);a++){this.add(b)}},unregister:function(){for(var a=0,b;(b=arguments[a]);a++){this.remove(this.lookup(b))}},lookup:function(e){if(Ext.isArray(e)){var b=[\"field1\"],d=!Ext.isArray(e[0]);if(!d){for(var c=2,a=e[0].length;c<=a;++c){b.push(\"field\"+c)}}return new Ext.data.ArrayStore({fields:b,data:e,expandData:d,autoDestroy:true,autoCreated:true})}return Ext.isObject(e)?(e.events?e:Ext.create(e,\"store\")):this.get(e)},getKey:function(a){return a.storeId}});Ext.data.Store=Ext.extend(Ext.util.Observable,{writer:undefined,remoteSort:false,autoDestroy:false,pruneModifiedRecords:false,lastOptions:null,autoSave:true,batch:true,restful:false,paramNames:undefined,defaultParamNames:{start:\"start\",limit:\"limit\",sort:\"sort\",dir:\"dir\"},isDestroyed:false,hasMultiSort:false,batchKey:\"_ext_batch_\",constructor:function(a){this.data=new Ext.util.MixedCollection(false);this.data.getKey=function(b){return b.id};this.removed=[];if(a&&a.data){this.inlineData=a.data;delete a.data}Ext.apply(this,a);this.baseParams=Ext.isObject(this.baseParams)?this.baseParams:{};this.paramNames=Ext.applyIf(this.paramNames||{},this.defaultParamNames);if((this.url||this.api)&&!this.proxy){this.proxy=new Ext.data.HttpProxy({url:this.url,api:this.api})}if(this.restful===true&&this.proxy){this.batch=false;Ext.data.Api.restify(this.proxy)}if(this.reader){if(!this.recordType){this.recordType=this.reader.recordType}if(this.reader.onMetaChange){this.reader.onMetaChange=this.reader.onMetaChange.createSequence(this.onMetaChange,this)}if(this.writer){if(this.writer instanceof (Ext.data.DataWriter)===false){this.writer=this.buildWriter(this.writer)}this.writer.meta=this.reader.meta;this.pruneModifiedRecords=true}}if(this.recordType){this.fields=this.recordType.prototype.fields}this.modified=[];this.addEvents(\"datachanged\",\"metachange\",\"add\",\"remove\",\"update\",\"clear\",\"exception\",\"beforeload\",\"load\",\"loadexception\",\"beforewrite\",\"write\",\"beforesave\",\"save\");if(this.proxy){this.relayEvents(this.proxy,[\"loadexception\",\"exception\"])}if(this.writer){this.on({scope:this,add:this.createRecords,remove:this.destroyRecord,update:this.updateRecord,clear:this.onClear})}this.sortToggle={};if(this.sortField){this.setDefaultSort(this.sortField,this.sortDir)}else{if(this.sortInfo){this.setDefaultSort(this.sortInfo.field,this.sortInfo.direction)}}Ext.data.Store.superclass.constructor.call(this);if(this.id){this.storeId=this.id;delete this.id}if(this.storeId){Ext.StoreMgr.register(this)}if(this.inlineData){this.loadData(this.inlineData);delete this.inlineData}else{if(this.autoLoad){this.load.defer(10,this,[typeof this.autoLoad==\"object\"?this.autoLoad:undefined])}}this.batchCounter=0;this.batches={}},buildWriter:function(b){var a=undefined,c=(b.format||\"json\").toLowerCase();switch(c){case\"json\":a=Ext.data.JsonWriter;break;case\"xml\":a=Ext.data.XmlWriter;break;default:a=Ext.data.JsonWriter}return new a(b)},destroy:function(){if(!this.isDestroyed){if(this.storeId){Ext.StoreMgr.unregister(this)}this.clearData();this.data=null;Ext.destroy(this.proxy);this.reader=this.writer=null;this.purgeListeners();this.isDestroyed=true}},add:function(c){var e,a,b,d;c=[].concat(c);if(c.length<1){return}for(e=0,a=c.length;e<a;e++){b=c[e];b.join(this);if(b.dirty||b.phantom){this.modified.push(b)}}d=this.data.length;this.data.addAll(c);if(this.snapshot){this.snapshot.addAll(c)}this.fireEvent(\"add\",this,c,d)},addSorted:function(a){var b=this.findInsertIndex(a);this.insert(b,a)},doUpdate:function(a){var b=a.id;this.getById(b).join(null);this.data.replace(b,a);if(this.snapshot){this.snapshot.replace(b,a)}a.join(this);this.fireEvent(\"update\",this,a,Ext.data.Record.COMMIT)},remove:function(a){if(Ext.isArray(a)){Ext.each(a,function(c){this.remove(c)},this);return}var b=this.data.indexOf(a);if(b>-1){a.join(null);this.data.removeAt(b)}if(this.pruneModifiedRecords){this.modified.remove(a)}if(this.snapshot){this.snapshot.remove(a)}if(b>-1){this.fireEvent(\"remove\",this,a,b)}},removeAt:function(a){this.remove(this.getAt(a))},removeAll:function(b){var a=[];this.each(function(c){a.push(c)});this.clearData();if(this.snapshot){this.snapshot.clear()}if(this.pruneModifiedRecords){this.modified=[]}if(b!==true){this.fireEvent(\"clear\",this,a)}},onClear:function(b,a){Ext.each(a,function(d,c){this.destroyRecord(this,d,c)},this)},insert:function(d,c){var e,a,b;c=[].concat(c);for(e=0,a=c.length;e<a;e++){b=c[e];this.data.insert(d+e,b);b.join(this);if(b.dirty||b.phantom){this.modified.push(b)}}if(this.snapshot){this.snapshot.addAll(c)}this.fireEvent(\"add\",this,c,d)},indexOf:function(a){return this.data.indexOf(a)},indexOfId:function(a){return this.data.indexOfKey(a)},getById:function(a){return(this.snapshot||this.data).key(a)},getAt:function(a){return this.data.itemAt(a)},getRange:function(b,a){return this.data.getRange(b,a)},storeOptions:function(a){a=Ext.apply({},a);delete a.callback;delete a.scope;this.lastOptions=a},clearData:function(){this.data.each(function(a){a.join(null)});this.data.clear()},load:function(b){b=Ext.apply({},b);this.storeOptions(b);if(this.sortInfo&&this.remoteSort){var a=this.paramNames;b.params=Ext.apply({},b.params);b.params[a.sort]=this.sortInfo.field;b.params[a.dir]=this.sortInfo.direction}try{return this.execute(\"read\",null,b)}catch(c){this.handleException(c);return false}},updateRecord:function(b,a,c){if(c==Ext.data.Record.EDIT&&this.autoSave===true&&(!a.phantom||(a.phantom&&a.isValid()))){this.save()}},createRecords:function(c,b,e){var d=this.modified,h=b.length,a,g;for(g=0;g<h;g++){a=b[g];if(a.phantom&&a.isValid()){a.markDirty();if(d.indexOf(a)==-1){d.push(a)}}}if(this.autoSave===true){this.save()}},destroyRecord:function(b,a,c){if(this.modified.indexOf(a)!=-1){this.modified.remove(a)}if(!a.phantom){this.removed.push(a);a.lastIndex=c;if(this.autoSave===true){this.save()}}},execute:function(e,a,c,b){if(!Ext.data.Api.isAction(e)){throw new Ext.data.Api.Error(\"execute\",e)}c=Ext.applyIf(c||{},{params:{}});if(b!==undefined){this.addToBatch(b)}var d=true;if(e===\"read\"){d=this.fireEvent(\"beforeload\",this,c);Ext.applyIf(c.params,this.baseParams)}else{if(this.writer.listful===true&&this.restful!==true){a=(Ext.isArray(a))?a:[a]}else{if(Ext.isArray(a)&&a.length==1){a=a.shift()}}if((d=this.fireEvent(\"beforewrite\",this,e,a,c))!==false){this.writer.apply(c.params,this.baseParams,e,a)}}if(d!==false){if(this.writer&&this.proxy.url&&!this.proxy.restful&&!Ext.data.Api.hasUniqueUrl(this.proxy,e)){c.params.xaction=e}this.proxy.request(Ext.data.Api.actions[e],a,c.params,this.reader,this.createCallback(e,a,b),this,c)}return d},save:function(){if(!this.writer){throw new Ext.data.Store.Error(\"writer-undefined\")}var h=[],j,k,e,c={},d;if(this.removed.length){h.push([\"destroy\",this.removed])}var b=[].concat(this.getModifiedRecords());if(b.length){var g=[];for(d=b.length-1;d>=0;d--){if(b[d].phantom===true){var a=b.splice(d,1).shift();if(a.isValid()){g.push(a)}}else{if(!b[d].isValid()){b.splice(d,1)}}}if(g.length){h.push([\"create\",g])}if(b.length){h.push([\"update\",b])}}j=h.length;if(j){e=++this.batchCounter;for(d=0;d<j;++d){k=h[d];c[k[0]]=k[1]}if(this.fireEvent(\"beforesave\",this,c)!==false){for(d=0;d<j;++d){k=h[d];this.doTransaction(k[0],k[1],e)}return e}}return -1},doTransaction:function(e,b,c){function g(h){try{this.execute(e,h,undefined,c)}catch(i){this.handleException(i)}}if(this.batch===false){for(var d=0,a=b.length;d<a;d++){g.call(this,b[d])}}else{g.call(this,b)}},addToBatch:function(c){var a=this.batches,d=this.batchKey+c,e=a[d];if(!e){a[d]=e={id:c,count:0,data:{}}}++e.count},removeFromBatch:function(d,h,g){var c=this.batches,e=this.batchKey+d,i=c[e],a;if(i){a=i.data[h]||[];i.data[h]=a.concat(g);if(i.count===1){g=i.data;delete c[e];this.fireEvent(\"save\",this,d,g)}else{--i.count}}},createCallback:function(c,a,b){var d=Ext.data.Api.actions;return(c==\"read\")?this.loadRecords:function(g,e,h){this[\"on\"+Ext.util.Format.capitalize(c)+\"Records\"](h,a,[].concat(g));if(h===true){this.fireEvent(\"write\",this,c,g,e,a)}this.removeFromBatch(b,c,g)}},clearModified:function(a){if(Ext.isArray(a)){for(var b=a.length-1;b>=0;b--){this.modified.splice(this.modified.indexOf(a[b]),1)}}else{this.modified.splice(this.modified.indexOf(a),1)}},reMap:function(b){if(Ext.isArray(b)){for(var d=0,a=b.length;d<a;d++){this.reMap(b[d])}}else{delete this.data.map[b._phid];this.data.map[b.id]=b;var c=this.data.keys.indexOf(b._phid);this.data.keys.splice(c,1,b.id);delete b._phid}},onCreateRecords:function(d,a,b){if(d===true){try{this.reader.realize(a,b)}catch(c){this.handleException(c);if(Ext.isArray(a)){this.onCreateRecords(d,a,b)}}}},onUpdateRecords:function(d,a,b){if(d===true){try{this.reader.update(a,b)}catch(c){this.handleException(c);if(Ext.isArray(a)){this.onUpdateRecords(d,a,b)}}}},onDestroyRecords:function(e,b,d){b=(b instanceof Ext.data.Record)?[b]:[].concat(b);for(var c=0,a=b.length;c<a;c++){this.removed.splice(this.removed.indexOf(b[c]),1)}if(e===false){for(c=b.length-1;c>=0;c--){this.insert(b[c].lastIndex,b[c])}}},handleException:function(a){Ext.handleError(a)},reload:function(a){this.load(Ext.applyIf(a||{},this.lastOptions))},loadRecords:function(b,l,h){var e,g;if(this.isDestroyed===true){return}if(!b||h===false){if(h!==false){this.fireEvent(\"load\",this,[],l)}if(l.callback){l.callback.call(l.scope||this,[],l,false,b)}return}var a=b.records,j=b.totalRecords||a.length;if(!l||l.add!==true){if(this.pruneModifiedRecords){this.modified=[]}for(e=0,g=a.length;e<g;e++){a[e].join(this)}if(this.snapshot){this.data=this.snapshot;delete this.snapshot}this.clearData();this.data.addAll(a);this.totalLength=j;this.applySort();this.fireEvent(\"datachanged\",this)}else{var k=[],d,c=0;for(e=0,g=a.length;e<g;++e){d=a[e];if(this.indexOfId(d.id)>-1){this.doUpdate(d)}else{k.push(d);++c}}this.totalLength=Math.max(j,this.data.length+c);this.add(k)}this.fireEvent(\"load\",this,a,l);if(l.callback){l.callback.call(l.scope||this,a,l,true)}},loadData:function(c,a){var b=this.reader.readRecords(c);this.loadRecords(b,{add:a},true)},getCount:function(){return this.data.length||0},getTotalCount:function(){return this.totalLength||0},getSortState:function(){return this.sortInfo},applySort:function(){if((this.sortInfo||this.multiSortInfo)&&!this.remoteSort){this.sortData()}},sortData:function(){var a=this.hasMultiSort?this.multiSortInfo:this.sortInfo,k=a.direction||\"ASC\",h=a.sorters,c=[];if(!this.hasMultiSort){h=[{direction:k,field:a.field}]}for(var d=0,b=h.length;d<b;d++){c.push(this.createSortFunction(h[d].field,h[d].direction))}if(c.length==0){return}var g=k.toUpperCase()==\"DESC\"?-1:1;var e=function(n,m){var l=c[0].call(this,n,m);if(c.length>1){for(var p=1,o=c.length;p<o;p++){l=l||c[p].call(this,n,m)}}return g*l};this.data.sort(k,e);if(this.snapshot&&this.snapshot!=this.data){this.snapshot.sort(k,e)}},createSortFunction:function(c,b){b=b||\"ASC\";var a=b.toUpperCase()==\"DESC\"?-1:1;var d=this.fields.get(c).sortType;return function(g,e){var i=d(g.data[c]),h=d(e.data[c]);return a*(i>h?1:(i<h?-1:0))}},setDefaultSort:function(b,a){a=a?a.toUpperCase():\"ASC\";this.sortInfo={field:b,direction:a};this.sortToggle[b]=a},sort:function(b,a){if(Ext.isArray(arguments[0])){return this.multiSort.call(this,b,a)}else{return this.singleSort(b,a)}},singleSort:function(g,c){var e=this.fields.get(g);if(!e){return false}var b=e.name,a=this.sortInfo||null,d=this.sortToggle?this.sortToggle[b]:null;if(!c){if(a&&a.field==b){c=(this.sortToggle[b]||\"ASC\").toggle(\"ASC\",\"DESC\")}else{c=e.sortDir}}this.sortToggle[b]=c;this.sortInfo={field:b,direction:c};this.hasMultiSort=false;if(this.remoteSort){if(!this.load(this.lastOptions)){if(d){this.sortToggle[b]=d}if(a){this.sortInfo=a}}}else{this.applySort();this.fireEvent(\"datachanged\",this)}return true},multiSort:function(b,a){this.hasMultiSort=true;a=a||\"ASC\";if(this.multiSortInfo&&a==this.multiSortInfo.direction){a=a.toggle(\"ASC\",\"DESC\")}this.multiSortInfo={sorters:b,direction:a};if(this.remoteSort){this.singleSort(b[0].field,b[0].direction)}else{this.applySort();this.fireEvent(\"datachanged\",this)}},each:function(b,a){this.data.each(b,a)},getModifiedRecords:function(){return this.modified},sum:function(e,g,a){var c=this.data.items,b=0;g=g||0;a=(a||a===0)?a:c.length-1;for(var d=g;d<=a;d++){b+=(c[d].data[e]||0)}return b},createFilterFn:function(d,c,e,a,b){if(Ext.isEmpty(c,false)){return false}c=this.data.createValueMatcher(c,e,a,b);return function(g){return c.test(g.data[d])}},createMultipleFilterFn:function(a){return function(b){var k=true;for(var d=0,c=a.length;d<c;d++){var h=a[d],g=h.fn,e=h.scope;k=k&&g.call(e,b)}return k}},filter:function(n,m,h,k,e){var l;if(Ext.isObject(n)){n=[n]}if(Ext.isArray(n)){var b=[];for(var g=0,d=n.length;g<d;g++){var a=n[g],c=a.fn,o=a.scope||this;if(!Ext.isFunction(c)){c=this.createFilterFn(a.property,a.value,a.anyMatch,a.caseSensitive,a.exactMatch)}b.push({fn:c,scope:o})}l=this.createMultipleFilterFn(b)}else{l=this.createFilterFn(n,m,h,k,e)}return l?this.filterBy(l):this.clearFilter()},filterBy:function(b,a){this.snapshot=this.snapshot||this.data;this.data=this.queryBy(b,a||this);this.fireEvent(\"datachanged\",this)},clearFilter:function(a){if(this.isFiltered()){this.data=this.snapshot;delete this.snapshot;if(a!==true){this.fireEvent(\"datachanged\",this)}}},isFiltered:function(){return !!this.snapshot&&this.snapshot!=this.data},query:function(d,c,e,a){var b=this.createFilterFn(d,c,e,a);return b?this.queryBy(b):this.data.clone()},queryBy:function(b,a){var c=this.snapshot||this.data;return c.filterBy(b,a||this)},find:function(d,c,g,e,a){var b=this.createFilterFn(d,c,e,a);return b?this.data.findIndexBy(b,null,g):-1},findExact:function(b,a,c){return this.data.findIndexBy(function(d){return d.get(b)===a},this,c)},findBy:function(b,a,c){return this.data.findIndexBy(b,a,c)},collect:function(j,k,b){var h=(b===true&&this.snapshot)?this.snapshot.items:this.data.items;var m,n,a=[],c={};for(var e=0,g=h.length;e<g;e++){m=h[e].data[j];n=String(m);if((k||!Ext.isEmpty(m))&&!c[n]){c[n]=true;a[a.length]=m}}return a},afterEdit:function(a){if(this.modified.indexOf(a)==-1){this.modified.push(a)}this.fireEvent(\"update\",this,a,Ext.data.Record.EDIT)},afterReject:function(a){this.modified.remove(a);this.fireEvent(\"update\",this,a,Ext.data.Record.REJECT)},afterCommit:function(a){this.modified.remove(a);this.fireEvent(\"update\",this,a,Ext.data.Record.COMMIT)},commitChanges:function(){var a=this.modified.slice(0),c=a.length,b;for(b=0;b<c;b++){a[b].commit()}this.modified=[];this.removed=[]},rejectChanges:function(){var a=this.modified.slice(0),e=this.removed.slice(0).reverse(),c=a.length,d=e.length,b;for(b=0;b<c;b++){a[b].reject()}for(b=0;b<d;b++){this.insert(e[b].lastIndex||0,e[b]);e[b].reject()}this.modified=[];this.removed=[]},onMetaChange:function(a){this.recordType=this.reader.recordType;this.fields=this.recordType.prototype.fields;delete this.snapshot;if(this.reader.meta.sortInfo){this.sortInfo=this.reader.meta.sortInfo}else{if(this.sortInfo&&!this.fields.get(this.sortInfo.field)){delete this.sortInfo}}if(this.writer){this.writer.meta=this.reader.meta}this.modified=[];this.fireEvent(\"metachange\",this,this.reader.meta)},findInsertIndex:function(a){this.suspendEvents();var c=this.data.clone();this.data.add(a);this.applySort();var b=this.data.indexOf(a);this.data=c;this.resumeEvents();return b},setBaseParam:function(a,b){this.baseParams=this.baseParams||{};this.baseParams[a]=b}});Ext.reg(\"store\",Ext.data.Store);Ext.data.Store.Error=Ext.extend(Ext.Error,{name:\"Ext.data.Store\"});Ext.apply(Ext.data.Store.Error.prototype,{lang:{\"writer-undefined\":\"Attempted to execute a write-action without a DataWriter installed.\"}});Ext.data.Field=Ext.extend(Object,{constructor:function(b){if(Ext.isString(b)){b={name:b}}Ext.apply(this,b);var d=Ext.data.Types,a=this.sortType,c;if(this.type){if(Ext.isString(this.type)){this.type=Ext.data.Types[this.type.toUpperCase()]||d.AUTO}}else{this.type=d.AUTO}if(Ext.isString(a)){this.sortType=Ext.data.SortTypes[a]}else{if(Ext.isEmpty(a)){this.sortType=this.type.sortType}}if(!this.convert){this.convert=this.type.convert}},dateFormat:null,useNull:false,defaultValue:\"\",mapping:null,sortType:null,sortDir:\"ASC\",allowBlank:true});Ext.data.DataReader=function(a,b){this.meta=a;this.recordType=Ext.isArray(b)?Ext.data.Record.create(b):b;if(this.recordType){this.buildExtractors()}};Ext.data.DataReader.prototype={getTotal:Ext.emptyFn,getRoot:Ext.emptyFn,getMessage:Ext.emptyFn,getSuccess:Ext.emptyFn,getId:Ext.emptyFn,buildExtractors:Ext.emptyFn,extractValues:Ext.emptyFn,realize:function(a,c){if(Ext.isArray(a)){for(var b=a.length-1;b>=0;b--){if(Ext.isArray(c)){this.realize(a.splice(b,1).shift(),c.splice(b,1).shift())}else{this.realize(a.splice(b,1).shift(),c)}}}else{if(Ext.isArray(c)&&c.length==1){c=c.shift()}if(!this.isData(c)){throw new Ext.data.DataReader.Error(\"realize\",a)}a.phantom=false;a._phid=a.id;a.id=this.getId(c);a.data=c;a.commit();a.store.reMap(a)}},update:function(a,c){if(Ext.isArray(a)){for(var b=a.length-1;b>=0;b--){if(Ext.isArray(c)){this.update(a.splice(b,1).shift(),c.splice(b,1).shift())}else{this.update(a.splice(b,1).shift(),c)}}}else{if(Ext.isArray(c)&&c.length==1){c=c.shift()}if(this.isData(c)){a.data=Ext.apply(a.data,c)}a.commit()}},extractData:function(k,a){var j=(this instanceof Ext.data.JsonReader)?\"json\":\"node\";var c=[];if(this.isData(k)&&!(this instanceof Ext.data.XmlReader)){k=[k]}var h=this.recordType.prototype.fields,o=h.items,m=h.length,c=[];if(a===true){var l=this.recordType;for(var e=0;e<k.length;e++){var b=k[e];var g=new l(this.extractValues(b,o,m),this.getId(b));g[j]=b;c.push(g)}}else{for(var e=0;e<k.length;e++){var d=this.extractValues(k[e],o,m);d[this.meta.idProperty]=this.getId(k[e]);c.push(d)}}return c},isData:function(a){return(a&&Ext.isObject(a)&&!Ext.isEmpty(this.getId(a)))?true:false},onMetaChange:function(a){delete this.ef;this.meta=a;this.recordType=Ext.data.Record.create(a.fields);this.buildExtractors()}};Ext.data.DataReader.Error=Ext.extend(Ext.Error,{constructor:function(b,a){this.arg=a;Ext.Error.call(this,b)},name:\"Ext.data.DataReader\"});Ext.apply(Ext.data.DataReader.Error.prototype,{lang:{update:\"#update received invalid data from server.  Please see docs for DataReader#update and review your DataReader configuration.\",realize:\"#realize was called with invalid remote-data.  Please see the docs for DataReader#realize and review your DataReader configuration.\",\"invalid-response\":\"#readResponse received an invalid response from the server.\"}});Ext.data.DataWriter=function(a){Ext.apply(this,a)};Ext.data.DataWriter.prototype={writeAllFields:false,listful:false,apply:function(e,g,d,a){var c=[],b=d+\"Record\";if(Ext.isArray(a)){Ext.each(a,function(h){c.push(this[b](h))},this)}else{if(a instanceof Ext.data.Record){c=this[b](a)}}this.render(e,g,c)},render:Ext.emptyFn,updateRecord:Ext.emptyFn,createRecord:Ext.emptyFn,destroyRecord:Ext.emptyFn,toHash:function(g,c){var e=g.fields.map,d={},b=(this.writeAllFields===false&&g.phantom===false)?g.getChanges():g.data,a;Ext.iterate(b,function(i,h){if((a=e[i])){d[a.mapping?a.mapping:a.name]=h}});if(g.phantom){if(g.fields.containsKey(this.meta.idProperty)&&Ext.isEmpty(g.data[this.meta.idProperty])){delete d[this.meta.idProperty]}}else{d[this.meta.idProperty]=g.id}return d},toArray:function(b){var a=[];Ext.iterate(b,function(d,c){a.push({name:d,value:c})},this);return a}};Ext.data.DataProxy=function(a){a=a||{};this.api=a.api;this.url=a.url;this.restful=a.restful;this.listeners=a.listeners;this.prettyUrls=a.prettyUrls;this.addEvents(\"exception\",\"beforeload\",\"load\",\"loadexception\",\"beforewrite\",\"write\");Ext.data.DataProxy.superclass.constructor.call(this);try{Ext.data.Api.prepare(this)}catch(b){if(b instanceof Ext.data.Api.Error){b.toConsole()}}Ext.data.DataProxy.relayEvents(this,[\"beforewrite\",\"write\",\"exception\"])};Ext.extend(Ext.data.DataProxy,Ext.util.Observable,{restful:false,setApi:function(){if(arguments.length==1){var a=Ext.data.Api.isValid(arguments[0]);if(a===true){this.api=arguments[0]}else{throw new Ext.data.Api.Error(\"invalid\",a)}}else{if(arguments.length==2){if(!Ext.data.Api.isAction(arguments[0])){throw new Ext.data.Api.Error(\"invalid\",arguments[0])}this.api[arguments[0]]=arguments[1]}}Ext.data.Api.prepare(this)},isApiAction:function(a){return(this.api[a])?true:false},request:function(e,b,g,a,h,d,c){if(!this.api[e]&&!this.load){throw new Ext.data.DataProxy.Error(\"action-undefined\",e)}g=g||{};if((e===Ext.data.Api.actions.read)?this.fireEvent(\"beforeload\",this,g):this.fireEvent(\"beforewrite\",this,e,b,g)!==false){this.doRequest.apply(this,arguments)}else{h.call(d||this,null,c,false)}},load:null,doRequest:function(e,b,g,a,h,d,c){this.load(g,a,h,d,c)},onRead:Ext.emptyFn,onWrite:Ext.emptyFn,buildUrl:function(d,b){b=b||null;var c=(this.conn&&this.conn.url)?this.conn.url:(this.api[d])?this.api[d].url:this.url;if(!c){throw new Ext.data.Api.Error(\"invalid-url\",d)}var e=null;var a=c.match(/(.*)(\\.json|\\.xml|\\.html)$/);if(a){e=a[2];c=a[1]}if((this.restful===true||this.prettyUrls===true)&&b instanceof Ext.data.Record&&!b.phantom){c+=\"/\"+b.id}return(e===null)?c:c+e},destroy:function(){this.purgeListeners()}});Ext.apply(Ext.data.DataProxy,Ext.util.Observable.prototype);Ext.util.Observable.call(Ext.data.DataProxy);Ext.data.DataProxy.Error=Ext.extend(Ext.Error,{constructor:function(b,a){this.arg=a;Ext.Error.call(this,b)},name:\"Ext.data.DataProxy\"});Ext.apply(Ext.data.DataProxy.Error.prototype,{lang:{\"action-undefined\":\"DataProxy attempted to execute an API-action but found an undefined url / function.  Please review your Proxy url/api-configuration.\",\"api-invalid\":\"Recieved an invalid API-configuration.  Please ensure your proxy API-configuration contains only the actions from Ext.data.Api.actions.\"}});Ext.data.Request=function(a){Ext.apply(this,a)};Ext.data.Request.prototype={action:undefined,rs:undefined,params:undefined,callback:Ext.emptyFn,scope:undefined,reader:undefined};Ext.data.Response=function(a){Ext.apply(this,a)};Ext.data.Response.prototype={action:undefined,success:undefined,message:undefined,data:undefined,raw:undefined,records:undefined};Ext.data.ScriptTagProxy=function(a){Ext.apply(this,a);Ext.data.ScriptTagProxy.superclass.constructor.call(this,a);this.head=document.getElementsByTagName(\"head\")[0]};Ext.data.ScriptTagProxy.TRANS_ID=1000;Ext.extend(Ext.data.ScriptTagProxy,Ext.data.DataProxy,{timeout:30000,callbackParam:\"callback\",nocache:true,doRequest:function(e,g,d,h,j,k,l){var c=Ext.urlEncode(Ext.apply(d,this.extraParams));var b=this.buildUrl(e,g);if(!b){throw new Ext.data.Api.Error(\"invalid-url\",b)}b=Ext.urlAppend(b,c);if(this.nocache){b=Ext.urlAppend(b,\"_dc=\"+(new Date().getTime()))}var a=++Ext.data.ScriptTagProxy.TRANS_ID;var m={id:a,action:e,cb:\"stcCallback\"+a,scriptId:\"stcScript\"+a,params:d,arg:l,url:b,callback:j,scope:k,reader:h};window[m.cb]=this.createCallback(e,g,m);b+=String.format(\"&{0}={1}\",this.callbackParam,m.cb);if(this.autoAbort!==false){this.abort()}m.timeoutId=this.handleFailure.defer(this.timeout,this,[m]);var i=document.createElement(\"script\");i.setAttribute(\"src\",b);i.setAttribute(\"type\",\"text/javascript\");i.setAttribute(\"id\",m.scriptId);this.head.appendChild(i);this.trans=m},createCallback:function(d,b,c){var a=this;return function(e){a.trans=false;a.destroyTrans(c,true);if(d===Ext.data.Api.actions.read){a.onRead.call(a,d,c,e)}else{a.onWrite.call(a,d,c,e,b)}}},onRead:function(d,c,b){var a;try{a=c.reader.readRecords(b)}catch(g){this.fireEvent(\"loadexception\",this,c,b,g);this.fireEvent(\"exception\",this,\"response\",d,c,b,g);c.callback.call(c.scope||window,null,c.arg,false);return}if(a.success===false){this.fireEvent(\"loadexception\",this,c,b);this.fireEvent(\"exception\",this,\"remote\",d,c,b,null)}else{this.fireEvent(\"load\",this,b,c.arg)}c.callback.call(c.scope||window,a,c.arg,a.success)},onWrite:function(h,g,c,b){var a=g.reader;try{var d=a.readResponse(h,c)}catch(i){this.fireEvent(\"exception\",this,\"response\",h,g,d,i);g.callback.call(g.scope||window,null,d,false);return}if(!d.success===true){this.fireEvent(\"exception\",this,\"remote\",h,g,d,b);g.callback.call(g.scope||window,null,d,false);return}this.fireEvent(\"write\",this,h,d.data,d,b,g.arg);g.callback.call(g.scope||window,d.data,d,true)},isLoading:function(){return this.trans?true:false},abort:function(){if(this.isLoading()){this.destroyTrans(this.trans)}},destroyTrans:function(b,a){this.head.removeChild(document.getElementById(b.scriptId));clearTimeout(b.timeoutId);if(a){window[b.cb]=undefined;try{delete window[b.cb]}catch(c){}}else{window[b.cb]=function(){window[b.cb]=undefined;try{delete window[b.cb]}catch(d){}}}},handleFailure:function(a){this.trans=false;this.destroyTrans(a,false);if(a.action===Ext.data.Api.actions.read){this.fireEvent(\"loadexception\",this,null,a.arg)}this.fireEvent(\"exception\",this,\"response\",a.action,{response:null,options:a.arg});a.callback.call(a.scope||window,null,a.arg,false)},destroy:function(){this.abort();Ext.data.ScriptTagProxy.superclass.destroy.call(this)}});Ext.data.HttpProxy=function(a){Ext.data.HttpProxy.superclass.constructor.call(this,a);this.conn=a;this.conn.url=null;this.useAjax=!a||!a.events;var c=Ext.data.Api.actions;this.activeRequest={};for(var b in c){this.activeRequest[c[b]]=undefined}};Ext.extend(Ext.data.HttpProxy,Ext.data.DataProxy,{getConnection:function(){return this.useAjax?Ext.Ajax:this.conn},setUrl:function(a,b){this.conn.url=a;if(b===true){this.url=a;this.api=null;Ext.data.Api.prepare(this)}},doRequest:function(g,d,i,c,b,e,a){var h={method:(this.api[g])?this.api[g][\"method\"]:undefined,request:{callback:b,scope:e,arg:a},reader:c,callback:this.createCallback(g,d),scope:this};if(i.jsonData){h.jsonData=i.jsonData}else{if(i.xmlData){h.xmlData=i.xmlData}else{h.params=i||{}}}this.conn.url=this.buildUrl(g,d);if(this.useAjax){Ext.applyIf(h,this.conn);if(g==Ext.data.Api.actions.read&&this.activeRequest[g]){Ext.Ajax.abort(this.activeRequest[g])}this.activeRequest[g]=Ext.Ajax.request(h)}else{this.conn.request(h)}this.conn.url=null},createCallback:function(b,a){return function(e,d,c){this.activeRequest[b]=undefined;if(!d){if(b===Ext.data.Api.actions.read){this.fireEvent(\"loadexception\",this,e,c)}this.fireEvent(\"exception\",this,\"response\",b,e,c);e.request.callback.call(e.request.scope,null,e.request.arg,false);return}if(b===Ext.data.Api.actions.read){this.onRead(b,e,c)}else{this.onWrite(b,e,c,a)}}},onRead:function(d,h,b){var a;try{a=h.reader.read(b)}catch(g){this.fireEvent(\"loadexception\",this,h,b,g);this.fireEvent(\"exception\",this,\"response\",d,h,b,g);h.request.callback.call(h.request.scope,null,h.request.arg,false);return}if(a.success===false){this.fireEvent(\"loadexception\",this,h,b);var c=h.reader.readResponse(d,b);this.fireEvent(\"exception\",this,\"remote\",d,h,c,null)}else{this.fireEvent(\"load\",this,h,h.request.arg)}h.request.callback.call(h.request.scope,a,h.request.arg,a.success)},onWrite:function(g,i,c,b){var a=i.reader;var d;try{d=a.readResponse(g,c)}catch(h){this.fireEvent(\"exception\",this,\"response\",g,i,c,h);i.request.callback.call(i.request.scope,null,i.request.arg,false);return}if(d.success===true){this.fireEvent(\"write\",this,g,d.data,d,b,i.request.arg)}else{this.fireEvent(\"exception\",this,\"remote\",g,i,d,b)}i.request.callback.call(i.request.scope,d.data,d,d.success)},destroy:function(){if(!this.useAjax){this.conn.abort()}else{if(this.activeRequest){var b=Ext.data.Api.actions;for(var a in b){if(this.activeRequest[b[a]]){Ext.Ajax.abort(this.activeRequest[b[a]])}}}}Ext.data.HttpProxy.superclass.destroy.call(this)}});Ext.data.MemoryProxy=function(b){var a={};a[Ext.data.Api.actions.read]=true;Ext.data.MemoryProxy.superclass.constructor.call(this,{api:a});this.data=b};Ext.extend(Ext.data.MemoryProxy,Ext.data.DataProxy,{doRequest:function(b,c,a,d,h,i,j){a=a||{};var k;try{k=d.readRecords(this.data)}catch(g){this.fireEvent(\"loadexception\",this,null,j,g);this.fireEvent(\"exception\",this,\"response\",b,j,null,g);h.call(i,null,j,false);return}h.call(i,k,j,true)}});Ext.data.Types=new function(){var a=Ext.data.SortTypes;Ext.apply(this,{stripRe:/[\\$,%]/g,AUTO:{convert:function(b){return b},sortType:a.none,type:\"auto\"},STRING:{convert:function(b){return(b===undefined||b===null)?\"\":String(b)},sortType:a.asUCString,type:\"string\"},INT:{convert:function(b){return b!==undefined&&b!==null&&b!==\"\"?parseInt(String(b).replace(Ext.data.Types.stripRe,\"\"),10):(this.useNull?null:0)},sortType:a.none,type:\"int\"},FLOAT:{convert:function(b){return b!==undefined&&b!==null&&b!==\"\"?parseFloat(String(b).replace(Ext.data.Types.stripRe,\"\"),10):(this.useNull?null:0)},sortType:a.none,type:\"float\"},BOOL:{convert:function(b){return b===true||b===\"true\"||b==1},sortType:a.none,type:\"bool\"},DATE:{convert:function(c){var d=this.dateFormat;if(!c){return null}if(Ext.isDate(c)){return c}if(d){if(d==\"timestamp\"){return new Date(c*1000)}if(d==\"time\"){return new Date(parseInt(c,10))}return Date.parseDate(c,d)}var b=Date.parse(c);return b?new Date(b):null},sortType:a.asDate,type:\"date\"}});Ext.apply(this,{BOOLEAN:this.BOOL,INTEGER:this.INT,NUMBER:this.FLOAT})};Ext.data.JsonWriter=Ext.extend(Ext.data.DataWriter,{encode:true,encodeDelete:false,constructor:function(a){Ext.data.JsonWriter.superclass.constructor.call(this,a)},render:function(c,d,b){if(this.encode===true){Ext.apply(c,d);c[this.meta.root]=Ext.encode(b)}else{var a=Ext.apply({},d);a[this.meta.root]=b;c.jsonData=a}},createRecord:function(a){return this.toHash(a)},updateRecord:function(a){return this.toHash(a)},destroyRecord:function(b){if(this.encodeDelete){var a={};a[this.meta.idProperty]=b.id;return a}else{return b.id}}});Ext.data.JsonReader=function(a,b){a=a||{};Ext.applyIf(a,{idProperty:\"id\",successProperty:\"success\",totalProperty:\"total\"});Ext.data.JsonReader.superclass.constructor.call(this,a,b||a.fields)};Ext.extend(Ext.data.JsonReader,Ext.data.DataReader,{read:function(a){var b=a.responseText;var c=Ext.decode(b);if(!c){throw {message:\"JsonReader.read: Json object not found\"}}return this.readRecords(c)},readResponse:function(e,b){var h=(b.responseText!==undefined)?Ext.decode(b.responseText):b;if(!h){throw new Ext.data.JsonReader.Error(\"response\")}var a=this.getRoot(h),g=this.getSuccess(h);if(g&&e===Ext.data.Api.actions.create){var d=Ext.isDefined(a);if(d&&Ext.isEmpty(a)){throw new Ext.data.JsonReader.Error(\"root-empty\",this.meta.root)}else{if(!d){throw new Ext.data.JsonReader.Error(\"root-undefined-response\",this.meta.root)}}}var c=new Ext.data.Response({action:e,success:g,data:(a)?this.extractData(a,false):[],message:this.getMessage(h),raw:h});if(Ext.isEmpty(c.success)){throw new Ext.data.JsonReader.Error(\"successProperty-response\",this.meta.successProperty)}return c},readRecords:function(a){this.jsonData=a;if(a.metaData){this.onMetaChange(a.metaData)}var m=this.meta,h=this.recordType,b=h.prototype.fields,l=b.items,i=b.length,j;var g=this.getRoot(a),e=g.length,d=e,k=true;if(m.totalProperty){j=parseInt(this.getTotal(a),10);if(!isNaN(j)){d=j}}if(m.successProperty){j=this.getSuccess(a);if(j===false||j===\"false\"){k=false}}return{success:k,records:this.extractData(g,true),totalRecords:d}},buildExtractors:function(){if(this.ef){return}var l=this.meta,h=this.recordType,e=h.prototype.fields,k=e.items,j=e.length;if(l.totalProperty){this.getTotal=this.createAccessor(l.totalProperty)}if(l.successProperty){this.getSuccess=this.createAccessor(l.successProperty)}if(l.messageProperty){this.getMessage=this.createAccessor(l.messageProperty)}this.getRoot=l.root?this.createAccessor(l.root):function(g){return g};if(l.id||l.idProperty){var d=this.createAccessor(l.id||l.idProperty);this.getId=function(i){var g=d(i);return(g===undefined||g===\"\")?null:g}}else{this.getId=function(){return null}}var c=[];for(var b=0;b<j;b++){e=k[b];var a=(e.mapping!==undefined&&e.mapping!==null)?e.mapping:e.name;c.push(this.createAccessor(a))}this.ef=c},simpleAccess:function(b,a){return b[a]},createAccessor:function(){var a=/[\\[\\.]/;return function(c){if(Ext.isEmpty(c)){return Ext.emptyFn}if(Ext.isFunction(c)){return c}var b=String(c).search(a);if(b>=0){return new Function(\"obj\",\"return obj\"+(b>0?\".\":\"\")+c)}return function(d){return d[c]}}}(),extractValues:function(h,d,a){var g,c={};for(var e=0;e<a;e++){g=d[e];var b=this.ef[e](h);c[g.name]=g.convert((b!==undefined)?b:g.defaultValue,h)}return c}});Ext.data.JsonReader.Error=Ext.extend(Ext.Error,{constructor:function(b,a){this.arg=a;Ext.Error.call(this,b)},name:\"Ext.data.JsonReader\"});Ext.apply(Ext.data.JsonReader.Error.prototype,{lang:{response:\"An error occurred while json-decoding your server response\",\"successProperty-response\":'Could not locate your \"successProperty\" in your server response.  Please review your JsonReader config to ensure the config-property \"successProperty\" matches the property in your server-response.  See the JsonReader docs.',\"root-undefined-config\":'Your JsonReader was configured without a \"root\" property.  Please review your JsonReader config and make sure to define the root property.  See the JsonReader docs.',\"idProperty-undefined\":'Your JsonReader was configured without an \"idProperty\"  Please review your JsonReader configuration and ensure the \"idProperty\" is set (e.g.: \"id\").  See the JsonReader docs.',\"root-empty\":'Data was expected to be returned by the server in the \"root\" property of the response.  Please review your JsonReader configuration to ensure the \"root\" property matches that returned in the server-response.  See JsonReader docs.'}});Ext.data.ArrayReader=Ext.extend(Ext.data.JsonReader,{readRecords:function(r){this.arrayData=r;var l=this.meta,d=l?Ext.num(l.idIndex,l.id):null,b=this.recordType,q=b.prototype.fields,z=[],e=true,g;var u=this.getRoot(r);for(var y=0,A=u.length;y<A;y++){var t=u[y],a={},p=((d||d===0)&&t[d]!==undefined&&t[d]!==\"\"?t[d]:null);for(var x=0,m=q.length;x<m;x++){var B=q.items[x],w=B.mapping!==undefined&&B.mapping!==null?B.mapping:x;g=t[w]!==undefined?t[w]:B.defaultValue;g=B.convert(g,t);a[B.name]=g}var c=new b(a,p);c.json=t;z[z.length]=c}var h=z.length;if(l.totalProperty){g=parseInt(this.getTotal(r),10);if(!isNaN(g)){h=g}}if(l.successProperty){g=this.getSuccess(r);if(g===false||g===\"false\"){e=false}}return{success:e,records:z,totalRecords:h}}});Ext.data.ArrayStore=Ext.extend(Ext.data.Store,{constructor:function(a){Ext.data.ArrayStore.superclass.constructor.call(this,Ext.apply(a,{reader:new Ext.data.ArrayReader(a)}))},loadData:function(e,b){if(this.expandData===true){var d=[];for(var c=0,a=e.length;c<a;c++){d[d.length]=[e[c]]}e=d}Ext.data.ArrayStore.superclass.loadData.call(this,e,b)}});Ext.reg(\"arraystore\",Ext.data.ArrayStore);Ext.data.SimpleStore=Ext.data.ArrayStore;Ext.reg(\"simplestore\",Ext.data.SimpleStore);Ext.data.JsonStore=Ext.extend(Ext.data.Store,{constructor:function(a){Ext.data.JsonStore.superclass.constructor.call(this,Ext.apply(a,{reader:new Ext.data.JsonReader(a)}))}});Ext.reg(\"jsonstore\",Ext.data.JsonStore);Ext.data.XmlWriter=function(a){Ext.data.XmlWriter.superclass.constructor.apply(this,arguments);this.tpl=(typeof(this.tpl)===\"string\")?new Ext.XTemplate(this.tpl).compile():this.tpl.compile()};Ext.extend(Ext.data.XmlWriter,Ext.data.DataWriter,{documentRoot:\"xrequest\",forceDocumentRoot:false,root:\"records\",xmlVersion:\"1.0\",xmlEncoding:\"ISO-8859-15\",tpl:'<tpl for=\".\"><\\u003fxml version=\"{version}\" encoding=\"{encoding}\"\\u003f><tpl if=\"documentRoot\"><{documentRoot}><tpl for=\"baseParams\"><tpl for=\".\"><{name}>{value}</{name}></tpl></tpl></tpl><tpl if=\"records.length&gt;1\"><{root}></tpl><tpl for=\"records\"><{parent.record}><tpl for=\".\"><{name}>{value}</{name}></tpl></{parent.record}></tpl><tpl if=\"records.length&gt;1\"></{root}></tpl><tpl if=\"documentRoot\"></{documentRoot}></tpl></tpl>',render:function(b,c,a){c=this.toArray(c);b.xmlData=this.tpl.applyTemplate({version:this.xmlVersion,encoding:this.xmlEncoding,documentRoot:(c.length>0||this.forceDocumentRoot===true)?this.documentRoot:false,record:this.meta.record,root:this.root,baseParams:c,records:(Ext.isArray(a[0]))?a:[a]})},createRecord:function(a){return this.toArray(this.toHash(a))},updateRecord:function(a){return this.toArray(this.toHash(a))},destroyRecord:function(b){var a={};a[this.meta.idProperty]=b.id;return this.toArray(a)}});Ext.data.XmlReader=function(a,b){a=a||{};Ext.applyIf(a,{idProperty:a.idProperty||a.idPath||a.id,successProperty:a.successProperty||a.success});Ext.data.XmlReader.superclass.constructor.call(this,a,b||a.fields)};Ext.extend(Ext.data.XmlReader,Ext.data.DataReader,{read:function(a){var b=a.responseXML;if(!b){throw {message:\"XmlReader.read: XML Document not available\"}}return this.readRecords(b)},readRecords:function(d){this.xmlData=d;var a=d.documentElement||d,c=Ext.DomQuery,g=0,e=true;if(this.meta.totalProperty){g=this.getTotal(a,0)}if(this.meta.successProperty){e=this.getSuccess(a)}var b=this.extractData(c.select(this.meta.record,a),true);return{success:e,records:b,totalRecords:g||b.length}},readResponse:function(g,b){var e=Ext.DomQuery,h=b.responseXML,a=h.documentElement||h;var c=new Ext.data.Response({action:g,success:this.getSuccess(a),message:this.getMessage(a),data:this.extractData(e.select(this.meta.record,a)||e.select(this.meta.root,a),false),raw:h});if(Ext.isEmpty(c.success)){throw new Ext.data.DataReader.Error(\"successProperty-response\",this.meta.successProperty)}if(g===Ext.data.Api.actions.create){var d=Ext.isDefined(c.data);if(d&&Ext.isEmpty(c.data)){throw new Ext.data.JsonReader.Error(\"root-empty\",this.meta.root)}else{if(!d){throw new Ext.data.JsonReader.Error(\"root-undefined-response\",this.meta.root)}}}return c},getSuccess:function(){return true},buildExtractors:function(){if(this.ef){return}var l=this.meta,h=this.recordType,e=h.prototype.fields,k=e.items,j=e.length;if(l.totalProperty){this.getTotal=this.createAccessor(l.totalProperty)}if(l.successProperty){this.getSuccess=this.createAccessor(l.successProperty)}if(l.messageProperty){this.getMessage=this.createAccessor(l.messageProperty)}this.getRoot=function(g){return(!Ext.isEmpty(g[this.meta.record]))?g[this.meta.record]:g[this.meta.root]};if(l.idPath||l.idProperty){var d=this.createAccessor(l.idPath||l.idProperty);this.getId=function(g){var i=d(g)||g.id;return(i===undefined||i===\"\")?null:i}}else{this.getId=function(){return null}}var c=[];for(var b=0;b<j;b++){e=k[b];var a=(e.mapping!==undefined&&e.mapping!==null)?e.mapping:e.name;c.push(this.createAccessor(a))}this.ef=c},createAccessor:function(){var a=Ext.DomQuery;return function(b){if(Ext.isFunction(b)){return b}switch(b){case this.meta.totalProperty:return function(c,d){return a.selectNumber(b,c,d)};break;case this.meta.successProperty:return function(d,e){var c=a.selectValue(b,d,true);var g=c!==false&&c!==\"false\";return g};break;default:return function(c,d){return a.selectValue(b,c,d)};break}}}(),extractValues:function(h,d,a){var g,c={};for(var e=0;e<a;e++){g=d[e];var b=this.ef[e](h);c[g.name]=g.convert((b!==undefined)?b:g.defaultValue,h)}return c}});Ext.data.XmlStore=Ext.extend(Ext.data.Store,{constructor:function(a){Ext.data.XmlStore.superclass.constructor.call(this,Ext.apply(a,{reader:new Ext.data.XmlReader(a)}))}});Ext.reg(\"xmlstore\",Ext.data.XmlStore);Ext.data.GroupingStore=Ext.extend(Ext.data.Store,{constructor:function(d){d=d||{};this.hasMultiSort=true;this.multiSortInfo=this.multiSortInfo||{sorters:[]};var e=this.multiSortInfo.sorters,c=d.groupField||this.groupField,b=d.sortInfo||this.sortInfo,a=d.groupDir||this.groupDir;if(c){e.push({field:c,direction:a})}if(b){e.push(b)}Ext.data.GroupingStore.superclass.constructor.call(this,d);this.addEvents(\"groupchange\");this.applyGroupField()},remoteGroup:false,groupOnSort:false,groupDir:\"ASC\",clearGrouping:function(){this.groupField=false;if(this.remoteGroup){if(this.baseParams){delete this.baseParams.groupBy;delete this.baseParams.groupDir}var a=this.lastOptions;if(a&&a.params){delete a.params.groupBy;delete a.params.groupDir}this.reload()}else{this.sort();this.fireEvent(\"datachanged\",this)}},groupBy:function(e,a,d){d=d?(String(d).toUpperCase()==\"DESC\"?\"DESC\":\"ASC\"):this.groupDir;if(this.groupField==e&&this.groupDir==d&&!a){return}var c=this.multiSortInfo.sorters;if(c.length>0&&c[0].field==this.groupField){c.shift()}this.groupField=e;this.groupDir=d;this.applyGroupField();var b=function(){this.fireEvent(\"groupchange\",this,this.getGroupState())};if(this.groupOnSort){this.sort(e,d);b.call(this);return}if(this.remoteGroup){this.on(\"load\",b,this,{single:true});this.reload()}else{this.sort(c);b.call(this)}},sort:function(h,c){if(this.remoteSort){return Ext.data.GroupingStore.superclass.sort.call(this,h,c)}var g=[];if(Ext.isArray(arguments[0])){g=arguments[0]}else{if(h==undefined){g=this.sortInfo?[this.sortInfo]:[]}else{var e=this.fields.get(h);if(!e){return false}var b=e.name,a=this.sortInfo||null,d=this.sortToggle?this.sortToggle[b]:null;if(!c){if(a&&a.field==b){c=(this.sortToggle[b]||\"ASC\").toggle(\"ASC\",\"DESC\")}else{c=e.sortDir}}this.sortToggle[b]=c;this.sortInfo={field:b,direction:c};g=[this.sortInfo]}}if(this.groupField){g.unshift({direction:this.groupDir,field:this.groupField})}return this.multiSort.call(this,g,c)},applyGroupField:function(){if(this.remoteGroup){if(!this.baseParams){this.baseParams={}}Ext.apply(this.baseParams,{groupBy:this.groupField,groupDir:this.groupDir});var a=this.lastOptions;if(a&&a.params){a.params.groupDir=this.groupDir;delete a.params.groupBy}}},applyGrouping:function(a){if(this.groupField!==false){this.groupBy(this.groupField,true,this.groupDir);return true}else{if(a===true){this.fireEvent(\"datachanged\",this)}return false}},getGroupState:function(){return this.groupOnSort&&this.groupField!==false?(this.sortInfo?this.sortInfo.field:undefined):this.groupField}});Ext.reg(\"groupingstore\",Ext.data.GroupingStore);Ext.data.DirectProxy=function(a){Ext.apply(this,a);if(typeof this.paramOrder==\"string\"){this.paramOrder=this.paramOrder.split(/[\\s,|]/)}Ext.data.DirectProxy.superclass.constructor.call(this,a)};Ext.extend(Ext.data.DirectProxy,Ext.data.DataProxy,{paramOrder:undefined,paramsAsHash:true,directFn:undefined,doRequest:function(b,c,a,e,k,l,n){var j=[],h=this.api[b]||this.directFn;switch(b){case Ext.data.Api.actions.create:j.push(a.jsonData);break;case Ext.data.Api.actions.read:if(h.directCfg.method.len>0){if(this.paramOrder){for(var d=0,g=this.paramOrder.length;d<g;d++){j.push(a[this.paramOrder[d]])}}else{if(this.paramsAsHash){j.push(a)}}}break;case Ext.data.Api.actions.update:j.push(a.jsonData);break;case Ext.data.Api.actions.destroy:j.push(a.jsonData);break}var m={params:a||{},request:{callback:k,scope:l,arg:n},reader:e};j.push(this.createCallback(b,c,m),this);h.apply(window,j)},createCallback:function(d,a,b){var c=this;return function(e,g){if(!g.status){if(d===Ext.data.Api.actions.read){c.fireEvent(\"loadexception\",c,b,g,null)}c.fireEvent(\"exception\",c,\"remote\",d,b,g,null);b.request.callback.call(b.request.scope,null,b.request.arg,false);return}if(d===Ext.data.Api.actions.read){c.onRead(d,b,e,g)}else{c.onWrite(d,b,e,g,a)}}},onRead:function(g,e,a,d){var b;try{b=e.reader.readRecords(a)}catch(c){this.fireEvent(\"loadexception\",this,e,d,c);this.fireEvent(\"exception\",this,\"response\",g,e,d,c);e.request.callback.call(e.request.scope,null,e.request.arg,false);return}this.fireEvent(\"load\",this,d,e.request.arg);e.request.callback.call(e.request.scope,b,e.request.arg,true)},onWrite:function(g,d,a,c,b){var e=d.reader.extractData(d.reader.getRoot(a),false);var h=d.reader.getSuccess(a);h=(h!==false);if(h){this.fireEvent(\"write\",this,g,e,c,b,d.request.arg)}else{this.fireEvent(\"exception\",this,\"remote\",g,d,a,b)}d.request.callback.call(d.request.scope,e,c,h)}});Ext.data.DirectStore=Ext.extend(Ext.data.Store,{constructor:function(a){var b=Ext.apply({},{batchTransactions:false},a);Ext.data.DirectStore.superclass.constructor.call(this,Ext.apply(b,{proxy:Ext.isDefined(b.proxy)?b.proxy:new Ext.data.DirectProxy(Ext.copyTo({},b,\"paramOrder,paramsAsHash,directFn,api\")),reader:(!Ext.isDefined(b.reader)&&b.fields)?new Ext.data.JsonReader(Ext.copyTo({},b,\"totalProperty,root,idProperty\"),b.fields):b.reader}))}});Ext.reg(\"directstore\",Ext.data.DirectStore);Ext.Direct=Ext.extend(Ext.util.Observable,{exceptions:{TRANSPORT:\"xhr\",PARSE:\"parse\",LOGIN:\"login\",SERVER:\"exception\"},constructor:function(){this.addEvents(\"event\",\"exception\");this.transactions={};this.providers={}},addProvider:function(e){var c=arguments;if(c.length>1){for(var d=0,b=c.length;d<b;d++){this.addProvider(c[d])}return}if(!e.events){e=new Ext.Direct.PROVIDERS[e.type](e)}e.id=e.id||Ext.id();this.providers[e.id]=e;e.on(\"data\",this.onProviderData,this);e.on(\"exception\",this.onProviderException,this);if(!e.isConnected()){e.connect()}return e},getProvider:function(a){return this.providers[a]},removeProvider:function(b){var a=b.id?b:this.providers[b];a.un(\"data\",this.onProviderData,this);a.un(\"exception\",this.onProviderException,this);delete this.providers[a.id];return a},addTransaction:function(a){this.transactions[a.tid]=a;return a},removeTransaction:function(a){delete this.transactions[a.tid||a];return a},getTransaction:function(a){return this.transactions[a.tid||a]},onProviderData:function(d,c){if(Ext.isArray(c)){for(var b=0,a=c.length;b<a;b++){this.onProviderData(d,c[b])}return}if(c.name&&c.name!=\"event\"&&c.name!=\"exception\"){this.fireEvent(c.name,c)}else{if(c.type==\"exception\"){this.fireEvent(\"exception\",c)}}this.fireEvent(\"event\",c,d)},createEvent:function(a,b){return new Ext.Direct.eventTypes[a.type](Ext.apply(a,b))}});Ext.Direct=new Ext.Direct();Ext.Direct.TID=1;Ext.Direct.PROVIDERS={};Ext.Direct.Transaction=function(a){Ext.apply(this,a);this.tid=++Ext.Direct.TID;this.retryCount=0};Ext.Direct.Transaction.prototype={send:function(){this.provider.queueTransaction(this)},retry:function(){this.retryCount++;this.send()},getProvider:function(){return this.provider}};Ext.Direct.Event=function(a){Ext.apply(this,a)};Ext.Direct.Event.prototype={status:true,getData:function(){return this.data}};Ext.Direct.RemotingEvent=Ext.extend(Ext.Direct.Event,{type:\"rpc\",getTransaction:function(){return this.transaction||Ext.Direct.getTransaction(this.tid)}});Ext.Direct.ExceptionEvent=Ext.extend(Ext.Direct.RemotingEvent,{status:false,type:\"exception\"});Ext.Direct.eventTypes={rpc:Ext.Direct.RemotingEvent,event:Ext.Direct.Event,exception:Ext.Direct.ExceptionEvent};Ext.direct.Provider=Ext.extend(Ext.util.Observable,{priority:1,constructor:function(a){Ext.apply(this,a);this.addEvents(\"connect\",\"disconnect\",\"data\",\"exception\");Ext.direct.Provider.superclass.constructor.call(this,a)},isConnected:function(){return false},connect:Ext.emptyFn,disconnect:Ext.emptyFn});Ext.direct.JsonProvider=Ext.extend(Ext.direct.Provider,{parseResponse:function(a){if(!Ext.isEmpty(a.responseText)){if(typeof a.responseText==\"object\"){return a.responseText}return Ext.decode(a.responseText)}return null},getEvents:function(j){var g=null;try{g=this.parseResponse(j)}catch(h){var d=new Ext.Direct.ExceptionEvent({data:h,xhr:j,code:Ext.Direct.exceptions.PARSE,message:\"Error parsing json response: \\n\\n \"+g});return[d]}var c=[];if(Ext.isArray(g)){for(var b=0,a=g.length;b<a;b++){c.push(Ext.Direct.createEvent(g[b]))}}else{c.push(Ext.Direct.createEvent(g))}return c}});Ext.direct.PollingProvider=Ext.extend(Ext.direct.JsonProvider,{priority:3,interval:3000,constructor:function(a){Ext.direct.PollingProvider.superclass.constructor.call(this,a);this.addEvents(\"beforepoll\",\"poll\")},isConnected:function(){return !!this.pollTask},connect:function(){if(this.url&&!this.pollTask){this.pollTask=Ext.TaskMgr.start({run:function(){if(this.fireEvent(\"beforepoll\",this)!==false){if(typeof this.url==\"function\"){this.url(this.baseParams)}else{Ext.Ajax.request({url:this.url,callback:this.onData,scope:this,params:this.baseParams})}}},interval:this.interval,scope:this});this.fireEvent(\"connect\",this)}else{if(!this.url){throw\"Error initializing PollingProvider, no url configured.\"}}},disconnect:function(){if(this.pollTask){Ext.TaskMgr.stop(this.pollTask);delete this.pollTask;this.fireEvent(\"disconnect\",this)}},onData:function(d,j,h){if(j){var c=this.getEvents(h);for(var b=0,a=c.length;b<a;b++){var g=c[b];this.fireEvent(\"data\",this,g)}}else{var g=new Ext.Direct.ExceptionEvent({data:g,code:Ext.Direct.exceptions.TRANSPORT,message:\"Unable to connect to the server.\",xhr:h});this.fireEvent(\"data\",this,g)}}});Ext.Direct.PROVIDERS.polling=Ext.direct.PollingProvider;Ext.direct.RemotingProvider=Ext.extend(Ext.direct.JsonProvider,{enableBuffer:10,maxRetries:1,timeout:undefined,constructor:function(a){Ext.direct.RemotingProvider.superclass.constructor.call(this,a);this.addEvents(\"beforecall\",\"call\");this.namespace=(Ext.isString(this.namespace))?Ext.ns(this.namespace):this.namespace||window;this.transactions={};this.callBuffer=[]},initAPI:function(){var h=this.actions;for(var j in h){var d=this.namespace[j]||(this.namespace[j]={}),e=h[j];for(var g=0,b=e.length;g<b;g++){var a=e[g];d[a.name]=this.createMethod(j,a)}}},isConnected:function(){return !!this.connected},connect:function(){if(this.url){this.initAPI();this.connected=true;this.fireEvent(\"connect\",this)}else{if(!this.url){throw\"Error initializing RemotingProvider, no url configured.\"}}},disconnect:function(){if(this.connected){this.connected=false;this.fireEvent(\"disconnect\",this)}},onData:function(a,h,j){if(h){var k=this.getEvents(j);for(var b=0,c=k.length;b<c;b++){var d=k[b],l=this.getTransaction(d);this.fireEvent(\"data\",this,d);if(l){this.doCallback(l,d,true);Ext.Direct.removeTransaction(l)}}}else{var g=[].concat(a.ts);for(var b=0,c=g.length;b<c;b++){var l=this.getTransaction(g[b]);if(l&&l.retryCount<this.maxRetries){l.retry()}else{var d=new Ext.Direct.ExceptionEvent({data:d,transaction:l,code:Ext.Direct.exceptions.TRANSPORT,message:\"Unable to connect to the server.\",xhr:j});this.fireEvent(\"data\",this,d);if(l){this.doCallback(l,d,false);Ext.Direct.removeTransaction(l)}}}}},getCallData:function(a){return{action:a.action,method:a.method,data:a.data,type:\"rpc\",tid:a.tid}},doSend:function(d){var g={url:this.url,callback:this.onData,scope:this,ts:d,timeout:this.timeout},b;if(Ext.isArray(d)){b=[];for(var c=0,a=d.length;c<a;c++){b.push(this.getCallData(d[c]))}}else{b=this.getCallData(d)}if(this.enableUrlEncode){var e={};e[Ext.isString(this.enableUrlEncode)?this.enableUrlEncode:\"data\"]=Ext.encode(b);g.params=e}else{g.jsonData=b}Ext.Ajax.request(g)},combineAndSend:function(){var a=this.callBuffer.length;if(a>0){this.doSend(a==1?this.callBuffer[0]:this.callBuffer);this.callBuffer=[]}},queueTransaction:function(a){if(a.form){this.processForm(a);return}this.callBuffer.push(a);if(this.enableBuffer){if(!this.callTask){this.callTask=new Ext.util.DelayedTask(this.combineAndSend,this)}this.callTask.delay(Ext.isNumber(this.enableBuffer)?this.enableBuffer:10)}else{this.combineAndSend()}},doCall:function(i,a,b){var h=null,e=b[a.len],g=b[a.len+1];if(a.len!==0){h=b.slice(0,a.len)}var d=new Ext.Direct.Transaction({provider:this,args:b,action:i,method:a.name,data:h,cb:g&&Ext.isFunction(e)?e.createDelegate(g):e});if(this.fireEvent(\"beforecall\",this,d,a)!==false){Ext.Direct.addTransaction(d);this.queueTransaction(d);this.fireEvent(\"call\",this,d,a)}},doForm:function(j,b,g,i,e){var d=new Ext.Direct.Transaction({provider:this,action:j,method:b.name,args:[g,i,e],cb:e&&Ext.isFunction(i)?i.createDelegate(e):i,isForm:true});if(this.fireEvent(\"beforecall\",this,d,b)!==false){Ext.Direct.addTransaction(d);var a=String(g.getAttribute(\"enctype\")).toLowerCase()==\"multipart/form-data\",h={extTID:d.tid,extAction:j,extMethod:b.name,extType:\"rpc\",extUpload:String(a)};Ext.apply(d,{form:Ext.getDom(g),isUpload:a,params:i&&Ext.isObject(i.params)?Ext.apply(h,i.params):h});this.fireEvent(\"call\",this,d,b);this.processForm(d)}},processForm:function(a){Ext.Ajax.request({url:this.url,params:a.params,callback:this.onData,scope:this,form:a.form,isUpload:a.isUpload,ts:a})},createMethod:function(d,a){var b;if(!a.formHandler){b=function(){this.doCall(d,a,Array.prototype.slice.call(arguments,0))}.createDelegate(this)}else{b=function(e,g,c){this.doForm(d,a,e,g,c)}.createDelegate(this)}b.directCfg={action:d,method:a};return b},getTransaction:function(a){return a&&a.tid?Ext.Direct.getTransaction(a.tid):null},doCallback:function(c,g){var d=g.status?\"success\":\"failure\";if(c&&c.cb){var b=c.cb,a=Ext.isDefined(g.result)?g.result:g.data;if(Ext.isFunction(b)){b(a,g)}else{Ext.callback(b[d],b.scope,[a,g]);Ext.callback(b.callback,b.scope,[a,g])}}}});Ext.Direct.PROVIDERS.remoting=Ext.direct.RemotingProvider;Ext.Resizable=Ext.extend(Ext.util.Observable,{constructor:function(d,e){this.el=Ext.get(d);if(e&&e.wrap){e.resizeChild=this.el;this.el=this.el.wrap(typeof e.wrap==\"object\"?e.wrap:{cls:\"xresizable-wrap\"});this.el.id=this.el.dom.id=e.resizeChild.id+\"-rzwrap\";this.el.setStyle(\"overflow\",\"hidden\");this.el.setPositioning(e.resizeChild.getPositioning());e.resizeChild.clearPositioning();if(!e.width||!e.height){var g=e.resizeChild.getSize();this.el.setSize(g.width,g.height)}if(e.pinned&&!e.adjustments){e.adjustments=\"auto\"}}this.proxy=this.el.createProxy({tag:\"div\",cls:\"x-resizable-proxy\",id:this.el.id+\"-rzproxy\"},Ext.getBody());this.proxy.unselectable();this.proxy.enableDisplayMode(\"block\");Ext.apply(this,e);if(this.pinned){this.disableTrackOver=true;this.el.addClass(\"x-resizable-pinned\")}var k=this.el.getStyle(\"position\");if(k!=\"absolute\"&&k!=\"fixed\"){this.el.setStyle(\"position\",\"relative\")}if(!this.handles){this.handles=\"s,e,se\";if(this.multiDirectional){this.handles+=\",n,w\"}}if(this.handles==\"all\"){this.handles=\"n s e w ne nw se sw\"}var o=this.handles.split(/\\s*?[,;]\\s*?| /);var c=Ext.Resizable.positions;for(var j=0,l=o.length;j<l;j++){if(o[j]&&c[o[j]]){var n=c[o[j]];this[n]=new Ext.Resizable.Handle(this,n,this.disableTrackOver,this.transparent,this.handleCls)}}this.corner=this.southeast;if(this.handles.indexOf(\"n\")!=-1||this.handles.indexOf(\"w\")!=-1){this.updateBox=true}this.activeHandle=null;if(this.resizeChild){if(typeof this.resizeChild==\"boolean\"){this.resizeChild=Ext.get(this.el.dom.firstChild,true)}else{this.resizeChild=Ext.get(this.resizeChild,true)}}if(this.adjustments==\"auto\"){var b=this.resizeChild;var m=this.west,h=this.east,a=this.north,o=this.south;if(b&&(m||a)){b.position(\"relative\");b.setLeft(m?m.el.getWidth():0);b.setTop(a?a.el.getHeight():0)}this.adjustments=[(h?-h.el.getWidth():0)+(m?-m.el.getWidth():0),(a?-a.el.getHeight():0)+(o?-o.el.getHeight():0)-1]}if(this.draggable){this.dd=this.dynamic?this.el.initDD(null):this.el.initDDProxy(null,{dragElId:this.proxy.id});this.dd.setHandleElId(this.resizeChild?this.resizeChild.id:this.el.id);if(this.constrainTo){this.dd.constrainTo(this.constrainTo)}}this.addEvents(\"beforeresize\",\"resize\");if(this.width!==null&&this.height!==null){this.resizeTo(this.width,this.height)}else{this.updateChildSize()}if(Ext.isIE){this.el.dom.style.zoom=1}Ext.Resizable.superclass.constructor.call(this)},adjustments:[0,0],animate:false,disableTrackOver:false,draggable:false,duration:0.35,dynamic:false,easing:\"easeOutStrong\",enabled:true,handles:false,multiDirectional:false,height:null,width:null,heightIncrement:0,widthIncrement:0,minHeight:5,minWidth:5,maxHeight:10000,maxWidth:10000,minX:0,minY:0,pinned:false,preserveRatio:false,resizeChild:false,transparent:false,resizeTo:function(b,a){this.el.setSize(b,a);this.updateChildSize();this.fireEvent(\"resize\",this,b,a,null)},startSizing:function(c,b){this.fireEvent(\"beforeresize\",this,c);if(this.enabled){if(!this.overlay){this.overlay=this.el.createProxy({tag:\"div\",cls:\"x-resizable-overlay\",html:\"&#160;\"},Ext.getBody());this.overlay.unselectable();this.overlay.enableDisplayMode(\"block\");this.overlay.on({scope:this,mousemove:this.onMouseMove,mouseup:this.onMouseUp})}this.overlay.setStyle(\"cursor\",b.el.getStyle(\"cursor\"));this.resizing=true;this.startBox=this.el.getBox();this.startPoint=c.getXY();this.offsets=[(this.startBox.x+this.startBox.width)-this.startPoint[0],(this.startBox.y+this.startBox.height)-this.startPoint[1]];this.overlay.setSize(Ext.lib.Dom.getViewWidth(true),Ext.lib.Dom.getViewHeight(true));this.overlay.show();if(this.constrainTo){var a=Ext.get(this.constrainTo);this.resizeRegion=a.getRegion().adjust(a.getFrameWidth(\"t\"),a.getFrameWidth(\"l\"),-a.getFrameWidth(\"b\"),-a.getFrameWidth(\"r\"))}this.proxy.setStyle(\"visibility\",\"hidden\");this.proxy.show();this.proxy.setBox(this.startBox);if(!this.dynamic){this.proxy.setStyle(\"visibility\",\"visible\")}}},onMouseDown:function(a,b){if(this.enabled){b.stopEvent();this.activeHandle=a;this.startSizing(b,a)}},onMouseUp:function(b){this.activeHandle=null;var a=this.resizeElement();this.resizing=false;this.handleOut();this.overlay.hide();this.proxy.hide();this.fireEvent(\"resize\",this,a.width,a.height,b)},updateChildSize:function(){if(this.resizeChild){var d=this.el;var e=this.resizeChild;var c=this.adjustments;if(d.dom.offsetWidth){var a=d.getSize(true);e.setSize(a.width+c[0],a.height+c[1])}if(Ext.isIE9m){setTimeout(function(){if(d.dom.offsetWidth){var g=d.getSize(true);e.setSize(g.width+c[0],g.height+c[1])}},10)}}},snap:function(c,e,b){if(!e||!c){return c}var d=c;var a=c%e;if(a>0){if(a>(e/2)){d=c+(e-a)}else{d=c-a}}return Math.max(b,d)},resizeElement:function(){var a=this.proxy.getBox();if(this.updateBox){this.el.setBox(a,false,this.animate,this.duration,null,this.easing)}else{this.el.setSize(a.width,a.height,this.animate,this.duration,null,this.easing)}this.updateChildSize();if(!this.dynamic){this.proxy.hide()}if(this.draggable&&this.constrainTo){this.dd.resetConstraints();this.dd.constrainTo(this.constrainTo)}return a},constrain:function(b,c,a,d){if(b-c<a){c=b-a}else{if(b-c>d){c=b-d}}return c},onMouseMove:function(z){if(this.enabled&&this.activeHandle){try{if(this.resizeRegion&&!this.resizeRegion.contains(z.getPoint())){return}var t=this.curSize||this.startBox,l=this.startBox.x,k=this.startBox.y,c=l,b=k,m=t.width,u=t.height,d=m,o=u,n=this.minWidth,A=this.minHeight,s=this.maxWidth,D=this.maxHeight,i=this.widthIncrement,a=this.heightIncrement,B=z.getXY(),r=-(this.startPoint[0]-Math.max(this.minX,B[0])),p=-(this.startPoint[1]-Math.max(this.minY,B[1])),j=this.activeHandle.position,E,g;switch(j){case\"east\":m+=r;m=Math.min(Math.max(n,m),s);break;case\"south\":u+=p;u=Math.min(Math.max(A,u),D);break;case\"southeast\":m+=r;u+=p;m=Math.min(Math.max(n,m),s);u=Math.min(Math.max(A,u),D);break;case\"north\":p=this.constrain(u,p,A,D);k+=p;u-=p;break;case\"west\":r=this.constrain(m,r,n,s);l+=r;m-=r;break;case\"northeast\":m+=r;m=Math.min(Math.max(n,m),s);p=this.constrain(u,p,A,D);k+=p;u-=p;break;case\"northwest\":r=this.constrain(m,r,n,s);p=this.constrain(u,p,A,D);k+=p;u-=p;l+=r;m-=r;break;case\"southwest\":r=this.constrain(m,r,n,s);u+=p;u=Math.min(Math.max(A,u),D);l+=r;m-=r;break}var q=this.snap(m,i,n);var C=this.snap(u,a,A);if(q!=m||C!=u){switch(j){case\"northeast\":k-=C-u;break;case\"north\":k-=C-u;break;case\"southwest\":l-=q-m;break;case\"west\":l-=q-m;break;case\"northwest\":l-=q-m;k-=C-u;break}m=q;u=C}if(this.preserveRatio){switch(j){case\"southeast\":case\"east\":u=o*(m/d);u=Math.min(Math.max(A,u),D);m=d*(u/o);break;case\"south\":m=d*(u/o);m=Math.min(Math.max(n,m),s);u=o*(m/d);break;case\"northeast\":m=d*(u/o);m=Math.min(Math.max(n,m),s);u=o*(m/d);break;case\"north\":E=m;m=d*(u/o);m=Math.min(Math.max(n,m),s);u=o*(m/d);l+=(E-m)/2;break;case\"southwest\":u=o*(m/d);u=Math.min(Math.max(A,u),D);E=m;m=d*(u/o);l+=E-m;break;case\"west\":g=u;u=o*(m/d);u=Math.min(Math.max(A,u),D);k+=(g-u)/2;E=m;m=d*(u/o);l+=E-m;break;case\"northwest\":E=m;g=u;u=o*(m/d);u=Math.min(Math.max(A,u),D);m=d*(u/o);k+=g-u;l+=E-m;break}}this.proxy.setBounds(l,k,m,u);if(this.dynamic){this.resizeElement()}}catch(v){}}},handleOver:function(){if(this.enabled){this.el.addClass(\"x-resizable-over\")}},handleOut:function(){if(!this.resizing){this.el.removeClass(\"x-resizable-over\")}},getEl:function(){return this.el},getResizeChild:function(){return this.resizeChild},destroy:function(b){Ext.destroy(this.dd,this.overlay,this.proxy);this.overlay=null;this.proxy=null;var c=Ext.Resizable.positions;for(var a in c){if(typeof c[a]!=\"function\"&&this[c[a]]){this[c[a]].destroy()}}if(b){this.el.update(\"\");Ext.destroy(this.el);this.el=null}this.purgeListeners()},syncHandleHeight:function(){var a=this.el.getHeight(true);if(this.west){this.west.el.setHeight(a)}if(this.east){this.east.el.setHeight(a)}}});Ext.Resizable.positions={n:\"north\",s:\"south\",e:\"east\",w:\"west\",se:\"southeast\",sw:\"southwest\",nw:\"northwest\",ne:\"northeast\"};Ext.Resizable.Handle=Ext.extend(Object,{constructor:function(d,g,c,e,a){if(!this.tpl){var b=Ext.DomHelper.createTemplate({tag:\"div\",cls:\"x-resizable-handle x-resizable-handle-{0}\"});b.compile();Ext.Resizable.Handle.prototype.tpl=b}this.position=g;this.rz=d;this.el=this.tpl.append(d.el.dom,[this.position],true);this.el.unselectable();if(e){this.el.setOpacity(0)}if(!Ext.isEmpty(a)){this.el.addClass(a)}this.el.on(\"mousedown\",this.onMouseDown,this);if(!c){this.el.on({scope:this,mouseover:this.onMouseOver,mouseout:this.onMouseOut})}},afterResize:function(a){},onMouseDown:function(a){this.rz.onMouseDown(this,a)},onMouseOver:function(a){this.rz.handleOver(this,a)},onMouseOut:function(a){this.rz.handleOut(this,a)},destroy:function(){Ext.destroy(this.el);this.el=null}});Ext.Window=Ext.extend(Ext.Panel,{baseCls:\"x-window\",resizable:true,draggable:true,closable:true,closeAction:\"close\",constrain:false,constrainHeader:false,plain:false,minimizable:false,maximizable:false,minHeight:100,minWidth:200,expandOnShow:true,showAnimDuration:0.25,hideAnimDuration:0.25,collapsible:false,initHidden:undefined,hidden:true,elements:\"header,body\",frame:true,floating:true,initComponent:function(){this.initTools();Ext.Window.superclass.initComponent.call(this);this.addEvents(\"resize\",\"maximize\",\"minimize\",\"restore\");if(Ext.isDefined(this.initHidden)){this.hidden=this.initHidden}if(this.hidden===false){this.hidden=true;this.show()}},getState:function(){return Ext.apply(Ext.Window.superclass.getState.call(this)||{},this.getBox(true))},onRender:function(b,a){Ext.Window.superclass.onRender.call(this,b,a);if(this.plain){this.el.addClass(\"x-window-plain\")}this.focusEl=this.el.createChild({tag:\"a\",href:\"#\",cls:\"x-dlg-focus\",tabIndex:\"-1\",html:\"&#160;\"});this.focusEl.swallowEvent(\"click\",true);this.proxy=this.el.createProxy(\"x-window-proxy\");this.proxy.enableDisplayMode(\"block\");if(this.modal){this.mask=this.container.createChild({cls:\"ext-el-mask\"},this.el.dom);this.mask.enableDisplayMode(\"block\");this.mask.hide();this.mon(this.mask,\"click\",this.focus,this)}if(this.maximizable){this.mon(this.header,\"dblclick\",this.toggleMaximize,this)}},initEvents:function(){Ext.Window.superclass.initEvents.call(this);if(this.animateTarget){this.setAnimateTarget(this.animateTarget)}if(this.resizable){this.resizer=new Ext.Resizable(this.el,{minWidth:this.minWidth,minHeight:this.minHeight,handles:this.resizeHandles||\"all\",pinned:true,resizeElement:this.resizerAction,handleCls:\"x-window-handle\"});this.resizer.window=this;this.mon(this.resizer,\"beforeresize\",this.beforeResize,this)}if(this.draggable){this.header.addClass(\"x-window-draggable\")}this.mon(this.el,\"mousedown\",this.toFront,this);this.manager=this.manager||Ext.WindowMgr;this.manager.register(this);if(this.maximized){this.maximized=false;this.maximize()}if(this.closable){var a=this.getKeyMap();a.on(27,this.onEsc,this);a.disable()}},initDraggable:function(){this.dd=new Ext.Window.DD(this)},onEsc:function(a,b){if(this.activeGhost){this.unghost()}b.stopEvent();this[this.closeAction]()},beforeDestroy:function(){if(this.rendered){this.hide();this.clearAnchor();Ext.destroy(this.focusEl,this.resizer,this.dd,this.proxy,this.mask)}Ext.Window.superclass.beforeDestroy.call(this)},onDestroy:function(){if(this.manager){this.manager.unregister(this)}Ext.Window.superclass.onDestroy.call(this)},initTools:function(){if(this.minimizable){this.addTool({id:\"minimize\",handler:this.minimize.createDelegate(this,[])})}if(this.maximizable){this.addTool({id:\"maximize\",handler:this.maximize.createDelegate(this,[])});this.addTool({id:\"restore\",handler:this.restore.createDelegate(this,[]),hidden:true})}if(this.closable){this.addTool({id:\"close\",handler:this[this.closeAction].createDelegate(this,[])})}},resizerAction:function(){var a=this.proxy.getBox();this.proxy.hide();this.window.handleResize(a);return a},beforeResize:function(){this.resizer.minHeight=Math.max(this.minHeight,this.getFrameHeight()+40);this.resizer.minWidth=Math.max(this.minWidth,this.getFrameWidth()+40);this.resizeBox=this.el.getBox()},updateHandles:function(){if(Ext.isIE9m&&this.resizer){this.resizer.syncHandleHeight();this.el.repaint()}},handleResize:function(b){var a=this.resizeBox;if(a.x!=b.x||a.y!=b.y){this.updateBox(b)}else{this.setSize(b);if(Ext.isIE6&&Ext.isStrict){this.doLayout()}}this.focus();this.updateHandles();this.saveState()},focus:function(){var e=this.focusEl,a=this.defaultButton,c=typeof a,d,b;if(Ext.isDefined(a)){if(Ext.isNumber(a)&&this.fbar){e=this.fbar.items.get(a)}else{if(Ext.isString(a)){e=Ext.getCmp(a)}else{e=a}}d=e.getEl();b=Ext.getDom(this.container);if(d&&b){if(b!=document.body&&!Ext.lib.Region.getRegion(b).contains(Ext.lib.Region.getRegion(d.dom))){return}}}e=e||this.focusEl;e.focus.defer(10,e)},setAnimateTarget:function(a){a=Ext.get(a);this.animateTarget=a},beforeShow:function(){delete this.el.lastXY;delete this.el.lastLT;if(this.x===undefined||this.y===undefined){var a=this.el.getAlignToXY(this.container,\"c-c\");var b=this.el.translatePoints(a[0],a[1]);this.x=this.x===undefined?b.left:this.x;this.y=this.y===undefined?b.top:this.y}this.el.setLeftTop(this.x,this.y);if(this.expandOnShow){this.expand(false)}if(this.modal){Ext.getBody().addClass(\"x-body-masked\");this.mask.setSize(Ext.lib.Dom.getViewWidth(true),Ext.lib.Dom.getViewHeight(true));this.mask.show()}},show:function(c,a,b){if(!this.rendered){this.render(Ext.getBody())}if(this.hidden===false){this.toFront();return this}if(this.fireEvent(\"beforeshow\",this)===false){return this}if(a){this.on(\"show\",a,b,{single:true})}this.hidden=false;if(Ext.isDefined(c)){this.setAnimateTarget(c)}this.beforeShow();if(this.animateTarget){this.animShow()}else{this.afterShow()}return this},afterShow:function(b){if(this.isDestroyed){return false}this.proxy.hide();this.el.setStyle(\"display\",\"block\");this.el.show();if(this.maximized){this.fitContainer()}if(Ext.isMac&&Ext.isGecko2){this.cascade(this.setAutoScroll)}if(this.monitorResize||this.modal||this.constrain||this.constrainHeader){Ext.EventManager.onWindowResize(this.onWindowResize,this)}this.doConstrain();this.doLayout();if(this.keyMap){this.keyMap.enable()}this.toFront();this.updateHandles();if(b&&(Ext.isIE||Ext.isWebKit)){var a=this.getSize();this.onResize(a.width,a.height)}this.onShow();this.fireEvent(\"show\",this)},animShow:function(){this.proxy.show();this.proxy.setBox(this.animateTarget.getBox());this.proxy.setOpacity(0);var a=this.getBox();this.el.setStyle(\"display\",\"none\");this.proxy.shift(Ext.apply(a,{callback:this.afterShow.createDelegate(this,[true],false),scope:this,easing:\"easeNone\",duration:this.showAnimDuration,opacity:0.5}))},hide:function(c,a,b){if(this.hidden||this.fireEvent(\"beforehide\",this)===false){return this}if(a){this.on(\"hide\",a,b,{single:true})}this.hidden=true;if(c!==undefined){this.setAnimateTarget(c)}if(this.modal){this.mask.hide();Ext.getBody().removeClass(\"x-body-masked\")}if(this.animateTarget){this.animHide()}else{this.el.hide();this.afterHide()}return this},afterHide:function(){this.proxy.hide();if(this.monitorResize||this.modal||this.constrain||this.constrainHeader){Ext.EventManager.removeResizeListener(this.onWindowResize,this)}if(this.keyMap){this.keyMap.disable()}this.onHide();this.fireEvent(\"hide\",this)},animHide:function(){this.proxy.setOpacity(0.5);this.proxy.show();var a=this.getBox(false);this.proxy.setBox(a);this.el.hide();this.proxy.shift(Ext.apply(this.animateTarget.getBox(),{callback:this.afterHide,scope:this,duration:this.hideAnimDuration,easing:\"easeNone\",opacity:0}))},onShow:Ext.emptyFn,onHide:Ext.emptyFn,onWindowResize:function(){if(this.maximized){this.fitContainer()}if(this.modal){this.mask.setSize(\"100%\",\"100%\");var a=this.mask.dom.offsetHeight;this.mask.setSize(Ext.lib.Dom.getViewWidth(true),Ext.lib.Dom.getViewHeight(true))}this.doConstrain()},doConstrain:function(){if(this.constrain||this.constrainHeader){var b;if(this.constrain){b={right:this.el.shadowOffset,left:this.el.shadowOffset,bottom:this.el.shadowOffset}}else{var a=this.getSize();b={right:-(a.width-100),bottom:-(a.height-25+this.el.getConstrainOffset())}}var c=this.el.getConstrainToXY(this.container,true,b);if(c){this.setPosition(c[0],c[1])}}},ghost:function(a){var c=this.createGhost(a);var b=this.getBox(true);c.setLeftTop(b.x,b.y);c.setWidth(b.width);this.el.hide();this.activeGhost=c;return c},unghost:function(b,a){if(!this.activeGhost){return}if(b!==false){this.el.show();this.focus.defer(10,this);if(Ext.isMac&&Ext.isGecko2){this.cascade(this.setAutoScroll)}}if(a!==false){this.setPosition(this.activeGhost.getLeft(true),this.activeGhost.getTop(true))}this.activeGhost.hide();this.activeGhost.remove();delete this.activeGhost},minimize:function(){this.fireEvent(\"minimize\",this);return this},close:function(){if(this.fireEvent(\"beforeclose\",this)!==false){if(this.hidden){this.doClose()}else{this.hide(null,this.doClose,this)}}},doClose:function(){this.fireEvent(\"close\",this);this.destroy()},maximize:function(){if(!this.maximized){this.expand(false);this.restoreSize=this.getSize();this.restorePos=this.getPosition(true);if(this.maximizable){this.tools.maximize.hide();this.tools.restore.show()}this.maximized=true;this.el.disableShadow();if(this.dd){this.dd.lock()}if(this.collapsible){this.tools.toggle.hide()}this.el.addClass(\"x-window-maximized\");this.container.addClass(\"x-window-maximized-ct\");this.setPosition(0,0);this.fitContainer();this.fireEvent(\"maximize\",this)}return this},restore:function(){if(this.maximized){var a=this.tools;this.el.removeClass(\"x-window-maximized\");if(a.restore){a.restore.hide()}if(a.maximize){a.maximize.show()}this.setPosition(this.restorePos[0],this.restorePos[1]);this.setSize(this.restoreSize.width,this.restoreSize.height);delete this.restorePos;delete this.restoreSize;this.maximized=false;this.el.enableShadow(true);if(this.dd){this.dd.unlock()}if(this.collapsible&&a.toggle){a.toggle.show()}this.container.removeClass(\"x-window-maximized-ct\");this.doConstrain();this.fireEvent(\"restore\",this)}return this},toggleMaximize:function(){return this[this.maximized?\"restore\":\"maximize\"]()},fitContainer:function(){var a=this.container.getViewSize(false);this.setSize(a.width,a.height)},setZIndex:function(a){if(this.modal){this.mask.setStyle(\"z-index\",a)}this.el.setZIndex(++a);a+=5;if(this.resizer){this.resizer.proxy.setStyle(\"z-index\",++a)}this.lastZIndex=a},alignTo:function(b,a,c){var d=this.el.getAlignToXY(b,a,c);this.setPagePosition(d[0],d[1]);return this},anchorTo:function(c,e,d,b){this.clearAnchor();this.anchorTarget={el:c,alignment:e,offsets:d};Ext.EventManager.onWindowResize(this.doAnchor,this);var a=typeof b;if(a!=\"undefined\"){Ext.EventManager.on(window,\"scroll\",this.doAnchor,this,{buffer:a==\"number\"?b:50})}return this.doAnchor()},doAnchor:function(){var a=this.anchorTarget;this.alignTo(a.el,a.alignment,a.offsets);return this},clearAnchor:function(){if(this.anchorTarget){Ext.EventManager.removeResizeListener(this.doAnchor,this);Ext.EventManager.un(window,\"scroll\",this.doAnchor,this);delete this.anchorTarget}return this},toFront:function(a){if(this.manager.bringToFront(this)){if(!a||!a.getTarget().focus){this.focus()}}return this},setActive:function(a){if(a){if(!this.maximized){this.el.enableShadow(true)}this.fireEvent(\"activate\",this)}else{this.el.disableShadow();this.fireEvent(\"deactivate\",this)}},toBack:function(){this.manager.sendToBack(this);return this},center:function(){var a=this.el.getAlignToXY(this.container,\"c-c\");this.setPagePosition(a[0],a[1]);return this}});Ext.reg(\"window\",Ext.Window);Ext.Window.DD=Ext.extend(Ext.dd.DD,{constructor:function(a){this.win=a;Ext.Window.DD.superclass.constructor.call(this,a.el.id,\"WindowDD-\"+a.id);this.setHandleElId(a.header.id);this.scroll=false},moveOnly:true,headerOffsets:[100,25],startDrag:function(){var a=this.win;this.proxy=a.ghost(a.initialConfig.cls);if(a.constrain!==false){var c=a.el.shadowOffset;this.constrainTo(a.container,{right:c,left:c,bottom:c})}else{if(a.constrainHeader!==false){var b=this.proxy.getSize();this.constrainTo(a.container,{right:-(b.width-this.headerOffsets[0]),bottom:-(b.height-this.headerOffsets[1])})}}},b4Drag:Ext.emptyFn,onDrag:function(a){this.alignElWithMouse(this.proxy,a.getPageX(),a.getPageY())},endDrag:function(a){this.win.unghost();this.win.saveState()}});Ext.WindowGroup=function(){var g={};var d=[];var e=null;var c=function(j,i){return(!j._lastAccess||j._lastAccess<i._lastAccess)?-1:1};var h=function(){var l=d,j=l.length;if(j>0){l.sort(c);var k=l[0].manager.zseed;for(var m=0;m<j;m++){var n=l[m];if(n&&!n.hidden){n.setZIndex(k+(m*10))}}}a()};var b=function(i){if(i!=e){if(e){e.setActive(false)}e=i;if(i){i.setActive(true)}}};var a=function(){for(var j=d.length-1;j>=0;--j){if(!d[j].hidden){b(d[j]);return}}b(null)};return{zseed:9000,register:function(i){if(i.manager){i.manager.unregister(i)}i.manager=this;g[i.id]=i;d.push(i);i.on(\"hide\",a)},unregister:function(i){delete i.manager;delete g[i.id];i.un(\"hide\",a);d.remove(i)},get:function(i){return typeof i==\"object\"?i:g[i]},bringToFront:function(i){i=this.get(i);if(i!=e){i._lastAccess=new Date().getTime();h();return true}return false},sendToBack:function(i){i=this.get(i);i._lastAccess=-(new Date().getTime());h();return i},hideAll:function(){for(var i in g){if(g[i]&&typeof g[i]!=\"function\"&&g[i].isVisible()){g[i].hide()}}},getActive:function(){return e},getBy:function(l,k){var m=[];for(var j=d.length-1;j>=0;--j){var n=d[j];if(l.call(k||n,n)!==false){m.push(n)}}return m},each:function(j,i){for(var k in g){if(g[k]&&typeof g[k]!=\"function\"){if(j.call(i||g[k],g[k])===false){return}}}}}};Ext.WindowMgr=new Ext.WindowGroup();Ext.MessageBox=function(){var u,b,q,t,h,l,s,a,n,p,j,g,r,v,o,i=\"\",d=\"\",m=[\"ok\",\"yes\",\"no\",\"cancel\"];var c=function(x){r[x].blur();if(u.isVisible()){u.hide();w();Ext.callback(b.fn,b.scope||window,[x,v.dom.value,b],1)}};var w=function(){if(b&&b.cls){u.el.removeClass(b.cls)}n.reset()};var e=function(z,x,y){if(b&&b.closable!==false){u.hide();w()}if(y){y.stopEvent()}};var k=function(x){var z=0,y;if(!x){Ext.each(m,function(A){r[A].hide()});return z}u.footer.dom.style.display=\"\";Ext.iterate(r,function(A,B){y=x[A];if(y){B.show();B.setText(Ext.isString(y)?y:Ext.MessageBox.buttonText[A]);z+=B.getEl().getWidth()+15}else{B.hide()}});return z};return{getDialog:function(x){if(!u){var z=[];r={};Ext.each(m,function(A){z.push(r[A]=new Ext.Button({text:this.buttonText[A],handler:c.createCallback(A),hideMode:\"offsets\"}))},this);u=new Ext.Window({autoCreate:true,title:x,resizable:false,constrain:true,constrainHeader:true,minimizable:false,maximizable:false,stateful:false,modal:true,shim:true,buttonAlign:\"center\",width:400,height:100,minHeight:80,plain:true,footer:true,closable:true,close:function(){if(b&&b.buttons&&b.buttons.no&&!b.buttons.cancel){c(\"no\")}else{c(\"cancel\")}},fbar:new Ext.Toolbar({items:z,enableOverflow:false})});u.render(document.body);u.getEl().addClass(\"x-window-dlg\");q=u.mask;h=u.body.createChild({html:'<div class=\"ext-mb-icon\"></div><div class=\"ext-mb-content\"><span class=\"ext-mb-text\"></span><br /><div class=\"ext-mb-fix-cursor\"><input type=\"text\" class=\"ext-mb-input\" /><textarea class=\"ext-mb-textarea\"></textarea></div></div>'});j=Ext.get(h.dom.firstChild);var y=h.dom.childNodes[1];l=Ext.get(y.firstChild);s=Ext.get(y.childNodes[2].firstChild);s.enableDisplayMode();s.addKeyListener([10,13],function(){if(u.isVisible()&&b&&b.buttons){if(b.buttons.ok){c(\"ok\")}else{if(b.buttons.yes){c(\"yes\")}}}});a=Ext.get(y.childNodes[2].childNodes[1]);a.enableDisplayMode();n=new Ext.ProgressBar({renderTo:h});h.createChild({cls:\"x-clear\"})}return u},updateText:function(A){if(!u.isVisible()&&!b.width){u.setSize(this.maxWidth,100)}l.update(A?A+\" \":\"&#160;\");var y=d!=\"\"?(j.getWidth()+j.getMargins(\"lr\")):0,C=l.getWidth()+l.getMargins(\"lr\"),z=u.getFrameWidth(\"lr\"),B=u.body.getFrameWidth(\"lr\"),x;x=Math.max(Math.min(b.width||y+C+z+B,b.maxWidth||this.maxWidth),Math.max(b.minWidth||this.minWidth,o||0));if(b.prompt===true){v.setWidth(x-y-z-B)}if(b.progress===true||b.wait===true){n.setSize(x-y-z-B)}if(Ext.isIE9m&&x==o){x+=4}l.update(A||\"&#160;\");u.setSize(x,\"auto\").center();return this},updateProgress:function(y,x,z){n.updateProgress(y,x);if(z){this.updateText(z)}return this},isVisible:function(){return u&&u.isVisible()},hide:function(){var x=u?u.activeGhost:null;if(this.isVisible()||x){u.hide();w();if(x){u.unghost(false,false)}}return this},show:function(A){if(this.isVisible()){this.hide()}b=A;var B=this.getDialog(b.title||\"&#160;\");B.setTitle(b.title||\"&#160;\");var x=(b.closable!==false&&b.progress!==true&&b.wait!==true);B.tools.close.setDisplayed(x);v=s;b.prompt=b.prompt||(b.multiline?true:false);if(b.prompt){if(b.multiline){s.hide();a.show();a.setHeight(Ext.isNumber(b.multiline)?b.multiline:this.defaultTextHeight);v=a}else{s.show();a.hide()}}else{s.hide();a.hide()}v.dom.value=b.value||\"\";if(b.prompt){B.focusEl=v}else{var z=b.buttons;var y=null;if(z&&z.ok){y=r.ok}else{if(z&&z.yes){y=r.yes}}if(y){B.focusEl=y}}if(Ext.isDefined(b.iconCls)){B.setIconClass(b.iconCls)}this.setIcon(Ext.isDefined(b.icon)?b.icon:i);o=k(b.buttons);n.setVisible(b.progress===true||b.wait===true);this.updateProgress(0,b.progressText);this.updateText(b.msg);if(b.cls){B.el.addClass(b.cls)}B.proxyDrag=b.proxyDrag===true;B.modal=b.modal!==false;B.mask=b.modal!==false?q:false;if(!B.isVisible()){document.body.appendChild(u.el.dom);B.setAnimateTarget(b.animEl);B.on(\"show\",function(){if(x===true){B.keyMap.enable()}else{B.keyMap.disable()}},this,{single:true});B.show(b.animEl)}if(b.wait===true){n.wait(b.waitConfig)}return this},setIcon:function(x){if(!u){i=x;return}i=undefined;if(x&&x!=\"\"){j.removeClass(\"x-hidden\");j.replaceClass(d,x);h.addClass(\"x-dlg-icon\");d=x}else{j.replaceClass(d,\"x-hidden\");h.removeClass(\"x-dlg-icon\");d=\"\"}return this},progress:function(z,y,x){this.show({title:z,msg:y,buttons:false,progress:true,closable:false,minWidth:this.minProgressWidth,progressText:x});return this},wait:function(z,y,x){this.show({title:y,msg:z,buttons:false,closable:false,wait:true,modal:true,minWidth:this.minProgressWidth,waitConfig:x});return this},alert:function(A,z,y,x){this.show({title:A,msg:z,buttons:this.OK,fn:y,scope:x,minWidth:this.minWidth});return this},confirm:function(A,z,y,x){this.show({title:A,msg:z,buttons:this.YESNO,fn:y,scope:x,icon:this.QUESTION,minWidth:this.minWidth});return this},prompt:function(C,B,z,y,x,A){this.show({title:C,msg:B,buttons:this.OKCANCEL,fn:z,minWidth:this.minPromptWidth,scope:y,prompt:true,multiline:x,value:A});return this},OK:{ok:true},CANCEL:{cancel:true},OKCANCEL:{ok:true,cancel:true},YESNO:{yes:true,no:true},YESNOCANCEL:{yes:true,no:true,cancel:true},INFO:\"ext-mb-info\",WARNING:\"ext-mb-warning\",QUESTION:\"ext-mb-question\",ERROR:\"ext-mb-error\",defaultTextHeight:75,maxWidth:600,minWidth:100,minProgressWidth:250,minPromptWidth:250,buttonText:{ok:\"OK\",cancel:\"Cancel\",yes:\"Yes\",no:\"No\"}}}();Ext.Msg=Ext.MessageBox;Ext.dd.PanelProxy=Ext.extend(Object,{constructor:function(a,b){this.panel=a;this.id=this.panel.id+\"-ddproxy\";Ext.apply(this,b)},insertProxy:true,setStatus:Ext.emptyFn,reset:Ext.emptyFn,update:Ext.emptyFn,stop:Ext.emptyFn,sync:Ext.emptyFn,getEl:function(){return this.ghost},getGhost:function(){return this.ghost},getProxy:function(){return this.proxy},hide:function(){if(this.ghost){if(this.proxy){this.proxy.remove();delete this.proxy}this.panel.el.dom.style.display=\"\";this.ghost.remove();delete this.ghost}},show:function(){if(!this.ghost){this.ghost=this.panel.createGhost(this.panel.initialConfig.cls,undefined,Ext.getBody());this.ghost.setXY(this.panel.el.getXY());if(this.insertProxy){this.proxy=this.panel.el.insertSibling({cls:\"x-panel-dd-spacer\"});this.proxy.setSize(this.panel.getSize())}this.panel.el.dom.style.display=\"none\"}},repair:function(b,c,a){this.hide();if(typeof c==\"function\"){c.call(a||this)}},moveProxy:function(a,b){if(this.proxy){a.insertBefore(this.proxy.dom,b)}}});Ext.Panel.DD=Ext.extend(Ext.dd.DragSource,{constructor:function(b,a){this.panel=b;this.dragData={panel:b};this.proxy=new Ext.dd.PanelProxy(b,a);Ext.Panel.DD.superclass.constructor.call(this,b.el,a);var d=b.header,c=b.body;if(d){this.setHandleElId(d.id);c=b.header}c.setStyle(\"cursor\",\"move\");this.scroll=false},showFrame:Ext.emptyFn,startDrag:Ext.emptyFn,b4StartDrag:function(a,b){this.proxy.show()},b4MouseDown:function(b){var a=b.getPageX(),c=b.getPageY();this.autoOffset(a,c)},onInitDrag:function(a,b){this.onStartDrag(a,b);return true},createFrame:Ext.emptyFn,getDragEl:function(a){return this.proxy.ghost.dom},endDrag:function(a){this.proxy.hide();this.panel.saveState()},autoOffset:function(a,b){a-=this.startPageX;b-=this.startPageY;this.setDelta(a,b)}});Ext.state.Provider=Ext.extend(Ext.util.Observable,{constructor:function(){this.addEvents(\"statechange\");this.state={};Ext.state.Provider.superclass.constructor.call(this)},get:function(b,a){return typeof this.state[b]==\"undefined\"?a:this.state[b]},clear:function(a){delete this.state[a];this.fireEvent(\"statechange\",this,a,null)},set:function(a,b){this.state[a]=b;this.fireEvent(\"statechange\",this,a,b)},decodeValue:function(b){var e=/^(a|n|d|b|s|o|e)\\:(.*)$/,h=e.exec(unescape(b)),d,c,a,g;if(!h||!h[1]){return}c=h[1];a=h[2];switch(c){case\"e\":return null;case\"n\":return parseFloat(a);case\"d\":return new Date(Date.parse(a));case\"b\":return(a==\"1\");case\"a\":d=[];if(a!=\"\"){Ext.each(a.split(\"^\"),function(i){d.push(this.decodeValue(i))},this)}return d;case\"o\":d={};if(a!=\"\"){Ext.each(a.split(\"^\"),function(i){g=i.split(\"=\");d[g[0]]=this.decodeValue(g[1])},this)}return d;default:return a}},encodeValue:function(c){var b,g=\"\",e=0,a,d;if(c==null){return\"e:1\"}else{if(typeof c==\"number\"){b=\"n:\"+c}else{if(typeof c==\"boolean\"){b=\"b:\"+(c?\"1\":\"0\")}else{if(Ext.isDate(c)){b=\"d:\"+c.toGMTString()}else{if(Ext.isArray(c)){for(a=c.length;e<a;e++){g+=this.encodeValue(c[e]);if(e!=a-1){g+=\"^\"}}b=\"a:\"+g}else{if(typeof c==\"object\"){for(d in c){if(typeof c[d]!=\"function\"&&c[d]!==undefined){g+=d+\"=\"+this.encodeValue(c[d])+\"^\"}}b=\"o:\"+g.substring(0,g.length-1)}else{b=\"s:\"+c}}}}}}return escape(b)}});Ext.state.Manager=function(){var a=new Ext.state.Provider();return{setProvider:function(b){a=b},get:function(c,b){return a.get(c,b)},set:function(b,c){a.set(b,c)},clear:function(b){a.clear(b)},getProvider:function(){return a}}}();Ext.state.CookieProvider=Ext.extend(Ext.state.Provider,{constructor:function(a){Ext.state.CookieProvider.superclass.constructor.call(this);this.path=\"/\";this.expires=new Date(new Date().getTime()+(1000*60*60*24*7));this.domain=null;this.secure=false;Ext.apply(this,a);this.state=this.readCookies()},set:function(a,b){if(typeof b==\"undefined\"||b===null){this.clear(a);return}this.setCookie(a,b);Ext.state.CookieProvider.superclass.set.call(this,a,b)},clear:function(a){this.clearCookie(a);Ext.state.CookieProvider.superclass.clear.call(this,a)},readCookies:function(){var d={},h=document.cookie+\";\",b=/\\s?(.*?)=(.*?);/g,g,a,e;while((g=b.exec(h))!=null){a=g[1];e=g[2];if(a&&a.substring(0,3)==\"ys-\"){d[a.substr(3)]=this.decodeValue(e)}}return d},setCookie:function(a,b){document.cookie=\"ys-\"+a+\"=\"+this.encodeValue(b)+((this.expires==null)?\"\":(\"; expires=\"+this.expires.toGMTString()))+((this.path==null)?\"\":(\"; path=\"+this.path))+((this.domain==null)?\"\":(\"; domain=\"+this.domain))+((this.secure==true)?\"; secure\":\"\")},clearCookie:function(a){document.cookie=\"ys-\"+a+\"=null; expires=Thu, 01-Jan-70 00:00:01 GMT\"+((this.path==null)?\"\":(\"; path=\"+this.path))+((this.domain==null)?\"\":(\"; domain=\"+this.domain))+((this.secure==true)?\"; secure\":\"\")}});Ext.DataView=Ext.extend(Ext.BoxComponent,{selectedClass:\"x-view-selected\",emptyText:\"\",deferEmptyText:true,trackOver:false,blockRefresh:false,last:false,initComponent:function(){Ext.DataView.superclass.initComponent.call(this);if(Ext.isString(this.tpl)||Ext.isArray(this.tpl)){this.tpl=new Ext.XTemplate(this.tpl)}this.addEvents(\"beforeclick\",\"click\",\"mouseenter\",\"mouseleave\",\"containerclick\",\"dblclick\",\"contextmenu\",\"containercontextmenu\",\"selectionchange\",\"beforeselect\");this.store=Ext.StoreMgr.lookup(this.store);this.all=new Ext.CompositeElementLite();this.selected=new Ext.CompositeElementLite()},afterRender:function(){Ext.DataView.superclass.afterRender.call(this);this.mon(this.getTemplateTarget(),{click:this.onClick,dblclick:this.onDblClick,contextmenu:this.onContextMenu,scope:this});if(this.overClass||this.trackOver){this.mon(this.getTemplateTarget(),{mouseover:this.onMouseOver,mouseout:this.onMouseOut,scope:this})}if(this.store){this.bindStore(this.store,true)}},refresh:function(){this.clearSelections(false,true);var b=this.getTemplateTarget(),a=this.store.getRange();b.update(\"\");if(a.length<1){if(!this.deferEmptyText||this.hasSkippedEmptyText){b.update(this.emptyText)}this.all.clear()}else{this.tpl.overwrite(b,this.collectData(a,0));this.all.fill(Ext.query(this.itemSelector,b.dom));this.updateIndexes(0)}this.hasSkippedEmptyText=true},getTemplateTarget:function(){return this.el},prepareData:function(a){return a},collectData:function(b,e){var d=[],c=0,a=b.length;for(;c<a;c++){d[d.length]=this.prepareData(b[c].data,e+c,b[c])}return d},bufferRender:function(a,b){var c=document.createElement(\"div\");this.tpl.overwrite(c,this.collectData(a,b));return Ext.query(this.itemSelector,c)},onUpdate:function(g,a){var b=this.store.indexOf(a);if(b>-1){var e=this.isSelected(b),c=this.all.elements[b],d=this.bufferRender([a],b)[0];this.all.replaceElement(b,d,true);if(e){this.selected.replaceElement(c,d);this.all.item(b).addClass(this.selectedClass)}this.updateIndexes(b,b)}},onAdd:function(g,d,e){if(this.all.getCount()===0){this.refresh();return}var c=this.bufferRender(d,e),h,b=this.all.elements;if(e<this.all.getCount()){h=this.all.item(e).insertSibling(c,\"before\",true);b.splice.apply(b,[e,0].concat(c))}else{h=this.all.last().insertSibling(c,\"after\",true);b.push.apply(b,c)}this.updateIndexes(e)},onRemove:function(c,a,b){this.deselect(b);this.all.removeElement(b,true);this.updateIndexes(b);if(this.store.getCount()===0){this.refresh()}},refreshNode:function(a){this.onUpdate(this.store,this.store.getAt(a))},updateIndexes:function(d,c){var b=this.all.elements;d=d||0;c=c||((c===0)?0:(b.length-1));for(var a=d;a<=c;a++){b[a].viewIndex=a}},getStore:function(){return this.store},bindStore:function(a,b){if(!b&&this.store){if(a!==this.store&&this.store.autoDestroy){this.store.destroy()}else{this.store.un(\"beforeload\",this.onBeforeLoad,this);this.store.un(\"datachanged\",this.onDataChanged,this);this.store.un(\"add\",this.onAdd,this);this.store.un(\"remove\",this.onRemove,this);this.store.un(\"update\",this.onUpdate,this);this.store.un(\"clear\",this.refresh,this)}if(!a){this.store=null}}if(a){a=Ext.StoreMgr.lookup(a);a.on({scope:this,beforeload:this.onBeforeLoad,datachanged:this.onDataChanged,add:this.onAdd,remove:this.onRemove,update:this.onUpdate,clear:this.refresh})}this.store=a;if(a){this.refresh()}},onDataChanged:function(){if(this.blockRefresh!==true){this.refresh.apply(this,arguments)}},findItemFromChild:function(a){return Ext.fly(a).findParent(this.itemSelector,this.getTemplateTarget())},onClick:function(c){var b=c.getTarget(this.itemSelector,this.getTemplateTarget()),a;if(b){a=this.indexOf(b);if(this.onItemClick(b,a,c)!==false){this.fireEvent(\"click\",this,a,b,c)}}else{if(this.fireEvent(\"containerclick\",this,c)!==false){this.onContainerClick(c)}}},onContainerClick:function(a){this.clearSelections()},onContextMenu:function(b){var a=b.getTarget(this.itemSelector,this.getTemplateTarget());if(a){this.fireEvent(\"contextmenu\",this,this.indexOf(a),a,b)}else{this.fireEvent(\"containercontextmenu\",this,b)}},onDblClick:function(b){var a=b.getTarget(this.itemSelector,this.getTemplateTarget());if(a){this.fireEvent(\"dblclick\",this,this.indexOf(a),a,b)}},onMouseOver:function(b){var a=b.getTarget(this.itemSelector,this.getTemplateTarget());if(a&&a!==this.lastItem){this.lastItem=a;Ext.fly(a).addClass(this.overClass);this.fireEvent(\"mouseenter\",this,this.indexOf(a),a,b)}},onMouseOut:function(a){if(this.lastItem){if(!a.within(this.lastItem,true,true)){Ext.fly(this.lastItem).removeClass(this.overClass);this.fireEvent(\"mouseleave\",this,this.indexOf(this.lastItem),this.lastItem,a);delete this.lastItem}}},onItemClick:function(b,a,c){if(this.fireEvent(\"beforeclick\",this,a,b,c)===false){return false}if(this.multiSelect){this.doMultiSelection(b,a,c);c.preventDefault()}else{if(this.singleSelect){this.doSingleSelection(b,a,c);c.preventDefault()}}return true},doSingleSelection:function(b,a,c){if(c.ctrlKey&&this.isSelected(a)){this.deselect(a)}else{this.select(a,false)}},doMultiSelection:function(c,a,d){if(d.shiftKey&&this.last!==false){var b=this.last;this.selectRange(b,a,d.ctrlKey);this.last=b}else{if((d.ctrlKey||this.simpleSelect)&&this.isSelected(a)){this.deselect(a)}else{this.select(a,d.ctrlKey||d.shiftKey||this.simpleSelect)}}},getSelectionCount:function(){return this.selected.getCount()},getSelectedNodes:function(){return this.selected.elements},getSelectedIndexes:function(){var b=[],d=this.selected.elements,c=0,a=d.length;for(;c<a;c++){b.push(d[c].viewIndex)}return b},getSelectedRecords:function(){return this.getRecords(this.selected.elements)},getRecords:function(c){var b=[],d=0,a=c.length;for(;d<a;d++){b[b.length]=this.store.getAt(c[d].viewIndex)}return b},getRecord:function(a){return this.store.getAt(a.viewIndex)},clearSelections:function(a,b){if((this.multiSelect||this.singleSelect)&&this.selected.getCount()>0){if(!b){this.selected.removeClass(this.selectedClass)}this.selected.clear();this.last=false;if(!a){this.fireEvent(\"selectionchange\",this,this.selected.elements)}}},isSelected:function(a){return this.selected.contains(this.getNode(a))},deselect:function(a){if(this.isSelected(a)){a=this.getNode(a);this.selected.removeElement(a);if(this.last==a.viewIndex){this.last=false}Ext.fly(a).removeClass(this.selectedClass);this.fireEvent(\"selectionchange\",this,this.selected.elements)}},select:function(d,g,b){if(Ext.isArray(d)){if(!g){this.clearSelections(true)}for(var c=0,a=d.length;c<a;c++){this.select(d[c],true,true)}if(!b){this.fireEvent(\"selectionchange\",this,this.selected.elements)}}else{var e=this.getNode(d);if(!g){this.clearSelections(true)}if(e&&!this.isSelected(e)){if(this.fireEvent(\"beforeselect\",this,e,this.selected.elements)!==false){Ext.fly(e).addClass(this.selectedClass);this.selected.add(e);this.last=e.viewIndex;if(!b){this.fireEvent(\"selectionchange\",this,this.selected.elements)}}}}},selectRange:function(c,a,b){if(!b){this.clearSelections(true)}this.select(this.getNodes(c,a),true)},getNode:function(b){if(Ext.isString(b)){return document.getElementById(b)}else{if(Ext.isNumber(b)){return this.all.elements[b]}else{if(b instanceof Ext.data.Record){var a=this.store.indexOf(b);return this.all.elements[a]}}}return b},getNodes:function(e,a){var d=this.all.elements,b=[],c;e=e||0;a=!Ext.isDefined(a)?Math.max(d.length-1,0):a;if(e<=a){for(c=e;c<=a&&d[c];c++){b.push(d[c])}}else{for(c=e;c>=a&&d[c];c--){b.push(d[c])}}return b},indexOf:function(a){a=this.getNode(a);if(Ext.isNumber(a.viewIndex)){return a.viewIndex}return this.all.indexOf(a)},onBeforeLoad:function(){if(this.loadingText){this.clearSelections(false,true);this.getTemplateTarget().update('<div class=\"loading-indicator\">'+this.loadingText+\"</div>\");this.all.clear()}},onDestroy:function(){this.all.clear();this.selected.clear();Ext.DataView.superclass.onDestroy.call(this);this.bindStore(null)}});Ext.DataView.prototype.setStore=Ext.DataView.prototype.bindStore;Ext.reg(\"dataview\",Ext.DataView);Ext.list.ListView=Ext.extend(Ext.DataView,{itemSelector:\"dl\",selectedClass:\"x-list-selected\",overClass:\"x-list-over\",scrollOffset:undefined,columnResize:true,columnSort:true,maxColumnWidth:Ext.isIE9m?99:100,initComponent:function(){if(this.columnResize){this.colResizer=new Ext.list.ColumnResizer(this.colResizer);this.colResizer.init(this)}if(this.columnSort){this.colSorter=new Ext.list.Sorter(this.columnSort);this.colSorter.init(this)}if(!this.internalTpl){this.internalTpl=new Ext.XTemplate('<div class=\"x-list-header\"><div class=\"x-list-header-inner\">','<tpl for=\"columns\">','<div style=\"width:{[values.width*100]}%;text-align:{align};\"><em class=\"x-unselectable\" unselectable=\"on\" id=\"',this.id,'-xlhd-{#}\">',\"{header}\",\"</em></div>\",\"</tpl>\",'<div class=\"x-clear\"></div>',\"</div></div>\",'<div class=\"x-list-body\"><div class=\"x-list-body-inner\">',\"</div></div>\")}if(!this.tpl){this.tpl=new Ext.XTemplate('<tpl for=\"rows\">',\"<dl>\",'<tpl for=\"parent.columns\">','<dt style=\"width:{[values.width*100]}%;text-align:{align};\">','<em unselectable=\"on\"<tpl if=\"cls\"> class=\"{cls}</tpl>\">',\"{[values.tpl.apply(parent)]}\",\"</em></dt>\",\"</tpl>\",'<div class=\"x-clear\"></div>',\"</dl>\",\"</tpl>\")}var l=this.columns,h=0,k=0,m=l.length,b=[];for(var g=0;g<m;g++){var n=l[g];if(!n.isColumn){n.xtype=n.xtype?(/^lv/.test(n.xtype)?n.xtype:\"lv\"+n.xtype):\"lvcolumn\";n=Ext.create(n)}if(n.width){h+=n.width*100;if(h>this.maxColumnWidth){n.width-=(h-this.maxColumnWidth)/100}k++}b.push(n)}l=this.columns=b;if(k<m){var d=m-k;if(h<this.maxColumnWidth){var a=((this.maxColumnWidth-h)/d)/100;for(var e=0;e<m;e++){var n=l[e];if(!n.width){n.width=a}}}}Ext.list.ListView.superclass.initComponent.call(this)},onRender:function(){this.autoEl={cls:\"x-list-wrap\"};Ext.list.ListView.superclass.onRender.apply(this,arguments);this.internalTpl.overwrite(this.el,{columns:this.columns});this.innerBody=Ext.get(this.el.dom.childNodes[1].firstChild);this.innerHd=Ext.get(this.el.dom.firstChild.firstChild);if(this.hideHeaders){this.el.dom.firstChild.style.display=\"none\"}},getTemplateTarget:function(){return this.innerBody},collectData:function(){var a=Ext.list.ListView.superclass.collectData.apply(this,arguments);return{columns:this.columns,rows:a}},verifyInternalSize:function(){if(this.lastSize){this.onResize(this.lastSize.width,this.lastSize.height)}},onResize:function(c,e){var b=this.innerBody.dom,g=this.innerHd.dom,d=c-Ext.num(this.scrollOffset,Ext.getScrollBarWidth())+\"px\",a;if(!b){return}a=b.parentNode;if(Ext.isNumber(c)){if(this.reserveScrollOffset||((a.offsetWidth-a.clientWidth)>10)){b.style.width=d;g.style.width=d}else{b.style.width=c+\"px\";g.style.width=c+\"px\";setTimeout(function(){if((a.offsetWidth-a.clientWidth)>10){b.style.width=d;g.style.width=d}},10)}}if(Ext.isNumber(e)){a.style.height=Math.max(0,e-g.parentNode.offsetHeight)+\"px\"}},updateIndexes:function(){Ext.list.ListView.superclass.updateIndexes.apply(this,arguments);this.verifyInternalSize()},findHeaderIndex:function(g){g=g.dom||g;var a=g.parentNode,d=a.parentNode.childNodes,b=0,e;for(;e=d[b];b++){if(e==a){return b}}return -1},setHdWidths:function(){var d=this.innerHd.dom.getElementsByTagName(\"div\"),c=0,b=this.columns,a=b.length;for(;c<a;c++){d[c].style.width=(b[c].width*100)+\"%\"}}});Ext.reg(\"listview\",Ext.list.ListView);Ext.ListView=Ext.list.ListView;Ext.list.Column=Ext.extend(Object,{isColumn:true,align:\"left\",header:\"\",width:null,cls:\"\",constructor:function(a){if(!a.tpl){a.tpl=new Ext.XTemplate(\"{\"+a.dataIndex+\"}\")}else{if(Ext.isString(a.tpl)){a.tpl=new Ext.XTemplate(a.tpl)}}Ext.apply(this,a)}});Ext.reg(\"lvcolumn\",Ext.list.Column);Ext.list.NumberColumn=Ext.extend(Ext.list.Column,{format:\"0,000.00\",constructor:function(a){a.tpl=a.tpl||new Ext.XTemplate(\"{\"+a.dataIndex+':number(\"'+(a.format||this.format)+'\")}');Ext.list.NumberColumn.superclass.constructor.call(this,a)}});Ext.reg(\"lvnumbercolumn\",Ext.list.NumberColumn);Ext.list.DateColumn=Ext.extend(Ext.list.Column,{format:\"m/d/Y\",constructor:function(a){a.tpl=a.tpl||new Ext.XTemplate(\"{\"+a.dataIndex+':date(\"'+(a.format||this.format)+'\")}');Ext.list.DateColumn.superclass.constructor.call(this,a)}});Ext.reg(\"lvdatecolumn\",Ext.list.DateColumn);Ext.list.BooleanColumn=Ext.extend(Ext.list.Column,{trueText:\"true\",falseText:\"false\",undefinedText:\"&#160;\",constructor:function(e){e.tpl=e.tpl||new Ext.XTemplate(\"{\"+e.dataIndex+\":this.format}\");var b=this.trueText,d=this.falseText,a=this.undefinedText;e.tpl.format=function(c){if(c===undefined){return a}if(!c||c===\"false\"){return d}return b};Ext.list.DateColumn.superclass.constructor.call(this,e)}});Ext.reg(\"lvbooleancolumn\",Ext.list.BooleanColumn);Ext.list.ColumnResizer=Ext.extend(Ext.util.Observable,{minPct:0.05,constructor:function(a){Ext.apply(this,a);Ext.list.ColumnResizer.superclass.constructor.call(this)},init:function(a){this.view=a;a.on(\"render\",this.initEvents,this)},initEvents:function(a){a.mon(a.innerHd,\"mousemove\",this.handleHdMove,this);this.tracker=new Ext.dd.DragTracker({onBeforeStart:this.onBeforeStart.createDelegate(this),onStart:this.onStart.createDelegate(this),onDrag:this.onDrag.createDelegate(this),onEnd:this.onEnd.createDelegate(this),tolerance:3,autoStart:300});this.tracker.initEl(a.innerHd);a.on(\"beforedestroy\",this.tracker.destroy,this.tracker)},handleHdMove:function(i,d){var c=5,b=i.getPageX(),j=i.getTarget(\"em\",3,true);if(j){var h=j.getRegion(),g=j.dom.style,a=j.dom.parentNode;if(b-h.left<=c&&a!=a.parentNode.firstChild){this.activeHd=Ext.get(a.previousSibling.firstChild);g.cursor=Ext.isWebKit?\"e-resize\":\"col-resize\"}else{if(h.right-b<=c&&a!=a.parentNode.lastChild.previousSibling){this.activeHd=j;g.cursor=Ext.isWebKit?\"w-resize\":\"col-resize\"}else{delete this.activeHd;g.cursor=\"\"}}}},onBeforeStart:function(a){this.dragHd=this.activeHd;return !!this.dragHd},onStart:function(g){var d=this,b=d.view,c=d.dragHd,a=d.tracker.getXY()[0];d.proxy=b.el.createChild({cls:\"x-list-resizer\"});d.dragX=c.getX();d.headerIndex=b.findHeaderIndex(c);d.headersDisabled=b.disableHeaders;b.disableHeaders=true;d.proxy.setHeight(b.el.getHeight());d.proxy.setX(d.dragX);d.proxy.setWidth(a-d.dragX);this.setBoundaries()},setBoundaries:function(j){var k=this.view,h=this.headerIndex,c=k.innerHd.getWidth(),j=k.innerHd.getX(),b=Math.ceil(c*this.minPct),l=c-b,e=k.columns.length,d=k.innerHd.select(\"em\",true),g=b+j,a=l+j,i;if(e==2){this.minX=g;this.maxX=a}else{i=d.item(h+2);this.minX=d.item(h).getX()+b;this.maxX=i?i.getX()-b:a;if(h==0){this.minX=g}else{if(h==e-2){this.maxX=a}}}},onDrag:function(c){var b=this,a=b.tracker.getXY()[0].constrain(b.minX,b.maxX);b.proxy.setWidth(a-this.dragX)},onEnd:function(i){var g=this.proxy.getWidth(),h=this.headerIndex,l=this.view,c=l.columns,b=l.innerHd.getWidth(),k=Math.ceil(g*l.maxColumnWidth/b)/100,d=this.headersDisabled,m=c[h],j=c[h+1],a=m.width+j.width;this.proxy.remove();m.width=k;j.width=a-k;delete this.dragHd;l.setHdWidths();l.refresh();setTimeout(function(){l.disableHeaders=d},100)}});Ext.ListView.ColumnResizer=Ext.list.ColumnResizer;Ext.list.Sorter=Ext.extend(Ext.util.Observable,{sortClasses:[\"sort-asc\",\"sort-desc\"],constructor:function(a){Ext.apply(this,a);Ext.list.Sorter.superclass.constructor.call(this)},init:function(a){this.view=a;a.on(\"render\",this.initEvents,this)},initEvents:function(a){a.mon(a.innerHd,\"click\",this.onHdClick,this);a.innerHd.setStyle(\"cursor\",\"pointer\");a.mon(a.store,\"datachanged\",this.updateSortState,this);this.updateSortState.defer(10,this,[a.store])},updateSortState:function(c){var g=c.getSortState();if(!g){return}this.sortState=g;var e=this.view.columns,h=-1;for(var d=0,a=e.length;d<a;d++){if(e[d].dataIndex==g.field){h=d;break}}if(h!=-1){var b=g.direction;this.updateSortIcon(h,b)}},updateSortIcon:function(b,a){var d=this.sortClasses;var c=this.view.innerHd.select(\"em\").removeClass(d);c.item(b).addClass(d[a==\"DESC\"?1:0])},onHdClick:function(c){var b=c.getTarget(\"em\",3);if(b&&!this.view.disableHeaders){var a=this.view.findHeaderIndex(b);this.view.store.sort(this.view.columns[a].dataIndex)}}});Ext.ListView.Sorter=Ext.list.Sorter;Ext.TabPanel=Ext.extend(Ext.Panel,{deferredRender:true,tabWidth:120,minTabWidth:30,resizeTabs:false,enableTabScroll:false,scrollIncrement:0,scrollRepeatInterval:400,scrollDuration:0.35,animScroll:true,tabPosition:\"top\",baseCls:\"x-tab-panel\",autoTabs:false,autoTabSelector:\"div.x-tab\",activeTab:undefined,tabMargin:2,plain:false,wheelIncrement:20,idDelimiter:\"__\",itemCls:\"x-tab-item\",elements:\"body\",headerAsText:false,frame:false,hideBorders:true,initComponent:function(){this.frame=false;Ext.TabPanel.superclass.initComponent.call(this);this.addEvents(\"beforetabchange\",\"tabchange\",\"contextmenu\");this.setLayout(new Ext.layout.CardLayout(Ext.apply({layoutOnCardChange:this.layoutOnTabChange,deferredRender:this.deferredRender},this.layoutConfig)));if(this.tabPosition==\"top\"){this.elements+=\",header\";this.stripTarget=\"header\"}else{this.elements+=\",footer\";this.stripTarget=\"footer\"}if(!this.stack){this.stack=Ext.TabPanel.AccessStack()}this.initItems()},onRender:function(c,a){Ext.TabPanel.superclass.onRender.call(this,c,a);if(this.plain){var g=this.tabPosition==\"top\"?\"header\":\"footer\";this[g].addClass(\"x-tab-panel-\"+g+\"-plain\")}var b=this[this.stripTarget];this.stripWrap=b.createChild({cls:\"x-tab-strip-wrap\",cn:{tag:\"ul\",cls:\"x-tab-strip x-tab-strip-\"+this.tabPosition}});var e=(this.tabPosition==\"bottom\"?this.stripWrap:null);b.createChild({cls:\"x-tab-strip-spacer\"},e);this.strip=new Ext.Element(this.stripWrap.dom.firstChild);this.edge=this.strip.createChild({tag:\"li\",cls:\"x-tab-edge\",cn:[{tag:\"span\",cls:\"x-tab-strip-text\",cn:\"&#160;\"}]});this.strip.createChild({cls:\"x-clear\"});this.body.addClass(\"x-tab-panel-body-\"+this.tabPosition);if(!this.itemTpl){var d=new Ext.Template('<li class=\"{cls}\" id=\"{id}\"><a class=\"x-tab-strip-close\"></a>','<a class=\"x-tab-right\" href=\"#\"><em class=\"x-tab-left\">','<span class=\"x-tab-strip-inner\"><span class=\"x-tab-strip-text {iconCls}\">{text}</span></span>',\"</em></a></li>\");d.disableFormats=true;d.compile();Ext.TabPanel.prototype.itemTpl=d}this.items.each(this.initTab,this)},afterRender:function(){Ext.TabPanel.superclass.afterRender.call(this);if(this.autoTabs){this.readTabs(false)}if(this.activeTab!==undefined){var a=Ext.isObject(this.activeTab)?this.activeTab:this.items.get(this.activeTab);delete this.activeTab;this.setActiveTab(a)}},initEvents:function(){Ext.TabPanel.superclass.initEvents.call(this);this.mon(this.strip,{scope:this,mousedown:this.onStripMouseDown,contextmenu:this.onStripContextMenu});if(this.enableTabScroll){this.mon(this.strip,\"mousewheel\",this.onWheel,this)}},findTargets:function(c){var b=null,a=c.getTarget(\"li:not(.x-tab-edge)\",this.strip);if(a){b=this.getComponent(a.id.split(this.idDelimiter)[1]);if(b.disabled){return{close:null,item:null,el:null}}}return{close:c.getTarget(\".x-tab-strip-close\",this.strip),item:b,el:a}},onStripMouseDown:function(b){if(b.button!==0){return}b.preventDefault();var a=this.findTargets(b);if(a.close){if(a.item.fireEvent(\"beforeclose\",a.item)!==false){a.item.fireEvent(\"close\",a.item);this.remove(a.item)}return}if(a.item&&a.item!=this.activeTab){this.setActiveTab(a.item)}},onStripContextMenu:function(b){b.preventDefault();var a=this.findTargets(b);if(a.item){this.fireEvent(\"contextmenu\",this,a.item,b)}},readTabs:function(d){if(d===true){this.items.each(function(h){this.remove(h)},this)}var c=this.el.query(this.autoTabSelector);for(var b=0,a=c.length;b<a;b++){var e=c[b],g=e.getAttribute(\"title\");e.removeAttribute(\"title\");this.add({title:g,contentEl:e})}},initTab:function(d,b){var e=this.strip.dom.childNodes[b],g=this.getTemplateArgs(d),c=e?this.itemTpl.insertBefore(e,g):this.itemTpl.append(this.strip,g),a=\"x-tab-strip-over\",h=Ext.get(c);h.hover(function(){if(!d.disabled){h.addClass(a)}},function(){h.removeClass(a)});if(d.tabTip){h.child(\"span.x-tab-strip-text\",true).qtip=d.tabTip}d.tabEl=c;h.select(\"a\").on(\"click\",function(i){if(!i.getPageX()){this.onStripMouseDown(i)}},this,{preventDefault:true});d.on({scope:this,disable:this.onItemDisabled,enable:this.onItemEnabled,titlechange:this.onItemTitleChanged,iconchange:this.onItemIconChanged,beforeshow:this.onBeforeShowItem})},getTemplateArgs:function(b){var a=b.closable?\"x-tab-strip-closable\":\"\";if(b.disabled){a+=\" x-item-disabled\"}if(b.iconCls){a+=\" x-tab-with-icon\"}if(b.tabCls){a+=\" \"+b.tabCls}return{id:this.id+this.idDelimiter+b.getItemId(),text:b.title,cls:a,iconCls:b.iconCls||\"\"}},onAdd:function(b){Ext.TabPanel.superclass.onAdd.call(this,b);if(this.rendered){var a=this.items;this.initTab(b,a.indexOf(b));this.delegateUpdates()}},onBeforeAdd:function(b){var a=b.events?(this.items.containsKey(b.getItemId())?b:null):this.items.get(b);if(a){this.setActiveTab(b);return false}Ext.TabPanel.superclass.onBeforeAdd.apply(this,arguments);var c=b.elements;b.elements=c?c.replace(\",header\",\"\"):c;b.border=(b.border===true)},onRemove:function(d){var b=Ext.get(d.tabEl);if(b){b.select(\"a\").removeAllListeners();Ext.destroy(b)}Ext.TabPanel.superclass.onRemove.call(this,d);this.stack.remove(d);delete d.tabEl;d.un(\"disable\",this.onItemDisabled,this);d.un(\"enable\",this.onItemEnabled,this);d.un(\"titlechange\",this.onItemTitleChanged,this);d.un(\"iconchange\",this.onItemIconChanged,this);d.un(\"beforeshow\",this.onBeforeShowItem,this);if(d==this.activeTab){var a=this.stack.next();if(a){this.setActiveTab(a)}else{if(this.items.getCount()>0){this.setActiveTab(0)}else{this.setActiveTab(null)}}}if(!this.destroying){this.delegateUpdates()}},onBeforeShowItem:function(a){if(a!=this.activeTab){this.setActiveTab(a);return false}},onItemDisabled:function(b){var a=this.getTabEl(b);if(a){Ext.fly(a).addClass(\"x-item-disabled\")}this.stack.remove(b)},onItemEnabled:function(b){var a=this.getTabEl(b);if(a){Ext.fly(a).removeClass(\"x-item-disabled\")}},onItemTitleChanged:function(b){var a=this.getTabEl(b);if(a){Ext.fly(a).child(\"span.x-tab-strip-text\",true).innerHTML=b.title;this.delegateUpdates()}},onItemIconChanged:function(d,a,c){var b=this.getTabEl(d);if(b){b=Ext.get(b);b.child(\"span.x-tab-strip-text\").replaceClass(c,a);b[Ext.isEmpty(a)?\"removeClass\":\"addClass\"](\"x-tab-with-icon\");this.delegateUpdates()}},getTabEl:function(a){var b=this.getComponent(a);return b?b.tabEl:null},onResize:function(){Ext.TabPanel.superclass.onResize.apply(this,arguments);this.delegateUpdates()},beginUpdate:function(){this.suspendUpdates=true},endUpdate:function(){this.suspendUpdates=false;this.delegateUpdates()},hideTabStripItem:function(b){b=this.getComponent(b);var a=this.getTabEl(b);if(a){a.style.display=\"none\";this.delegateUpdates()}this.stack.remove(b)},unhideTabStripItem:function(b){b=this.getComponent(b);var a=this.getTabEl(b);if(a){a.style.display=\"\";this.delegateUpdates()}},delegateUpdates:function(){var a=this.rendered;if(this.suspendUpdates){return}if(this.resizeTabs&&a){this.autoSizeTabs()}if(this.enableTabScroll&&a){this.autoScrollTabs()}},autoSizeTabs:function(){var h=this.items.length,b=this.tabPosition!=\"bottom\"?\"header\":\"footer\",c=this[b].dom.offsetWidth,a=this[b].dom.clientWidth;if(!this.resizeTabs||h<1||!a){return}var k=Math.max(Math.min(Math.floor((a-4)/h)-this.tabMargin,this.tabWidth),this.minTabWidth);this.lastTabWidth=k;var m=this.strip.query(\"li:not(.x-tab-edge)\");for(var e=0,j=m.length;e<j;e++){var l=m[e],n=Ext.fly(l).child(\".x-tab-strip-inner\",true),g=l.offsetWidth,d=n.offsetWidth;n.style.width=(k-(g-d))+\"px\"}},adjustBodyWidth:function(a){if(this.header){this.header.setWidth(a)}if(this.footer){this.footer.setWidth(a)}return a},setActiveTab:function(c){c=this.getComponent(c);if(this.fireEvent(\"beforetabchange\",this,c,this.activeTab)===false){return}if(!this.rendered){this.activeTab=c;return}if(this.activeTab!=c){if(this.activeTab){var a=this.getTabEl(this.activeTab);if(a){Ext.fly(a).removeClass(\"x-tab-strip-active\")}}this.activeTab=c;if(c){var b=this.getTabEl(c);Ext.fly(b).addClass(\"x-tab-strip-active\");this.stack.add(c);this.layout.setActiveItem(c);this.delegateUpdates();if(this.scrolling){this.scrollToTab(c,this.animScroll)}}this.fireEvent(\"tabchange\",this,c)}},getActiveTab:function(){return this.activeTab||null},getItem:function(a){return this.getComponent(a)},autoScrollTabs:function(){this.pos=this.tabPosition==\"bottom\"?this.footer:this.header;var h=this.items.length,d=this.pos.dom.offsetWidth,c=this.pos.dom.clientWidth,g=this.stripWrap,e=g.dom,b=e.offsetWidth,i=this.getScrollPos(),a=this.edge.getOffsetsTo(this.stripWrap)[0]+i;if(!this.enableTabScroll||b<20){return}if(h==0||a<=c){e.scrollLeft=0;g.setWidth(c);if(this.scrolling){this.scrolling=false;this.pos.removeClass(\"x-tab-scrolling\");this.scrollLeft.hide();this.scrollRight.hide();if(Ext.isAir||Ext.isWebKit){e.style.marginLeft=\"\";e.style.marginRight=\"\"}}}else{if(!this.scrolling){this.pos.addClass(\"x-tab-scrolling\");if(Ext.isAir||Ext.isWebKit){e.style.marginLeft=\"18px\";e.style.marginRight=\"18px\"}}c-=g.getMargins(\"lr\");g.setWidth(c>20?c:20);if(!this.scrolling){if(!this.scrollLeft){this.createScrollers()}else{this.scrollLeft.show();this.scrollRight.show()}}this.scrolling=true;if(i>(a-c)){e.scrollLeft=a-c}else{this.scrollToTab(this.activeTab,false)}this.updateScrollButtons()}},createScrollers:function(){this.pos.addClass(\"x-tab-scrolling-\"+this.tabPosition);var c=this.stripWrap.dom.offsetHeight;var a=this.pos.insertFirst({cls:\"x-tab-scroller-left\"});a.setHeight(c);a.addClassOnOver(\"x-tab-scroller-left-over\");this.leftRepeater=new Ext.util.ClickRepeater(a,{interval:this.scrollRepeatInterval,handler:this.onScrollLeft,scope:this});this.scrollLeft=a;var b=this.pos.insertFirst({cls:\"x-tab-scroller-right\"});b.setHeight(c);b.addClassOnOver(\"x-tab-scroller-right-over\");this.rightRepeater=new Ext.util.ClickRepeater(b,{interval:this.scrollRepeatInterval,handler:this.onScrollRight,scope:this});this.scrollRight=b},getScrollWidth:function(){return this.edge.getOffsetsTo(this.stripWrap)[0]+this.getScrollPos()},getScrollPos:function(){return parseInt(this.stripWrap.dom.scrollLeft,10)||0},getScrollArea:function(){return parseInt(this.stripWrap.dom.clientWidth,10)||0},getScrollAnim:function(){return{duration:this.scrollDuration,callback:this.updateScrollButtons,scope:this}},getScrollIncrement:function(){return this.scrollIncrement||(this.resizeTabs?this.lastTabWidth+2:100)},scrollToTab:function(e,a){if(!e){return}var c=this.getTabEl(e),h=this.getScrollPos(),d=this.getScrollArea(),g=Ext.fly(c).getOffsetsTo(this.stripWrap)[0]+h,b=g+c.offsetWidth;if(g<h){this.scrollTo(g,a)}else{if(b>(h+d)){this.scrollTo(b-d,a)}}},scrollTo:function(b,a){this.stripWrap.scrollTo(\"left\",b,a?this.getScrollAnim():false);if(!a){this.updateScrollButtons()}},onWheel:function(g){var h=g.getWheelDelta()*this.wheelIncrement*-1;g.stopEvent();var i=this.getScrollPos(),c=i+h,a=this.getScrollWidth()-this.getScrollArea();var b=Math.max(0,Math.min(a,c));if(b!=i){this.scrollTo(b,false)}},onScrollRight:function(){var a=this.getScrollWidth()-this.getScrollArea(),c=this.getScrollPos(),b=Math.min(a,c+this.getScrollIncrement());if(b!=c){this.scrollTo(b,this.animScroll)}},onScrollLeft:function(){var b=this.getScrollPos(),a=Math.max(0,b-this.getScrollIncrement());if(a!=b){this.scrollTo(a,this.animScroll)}},updateScrollButtons:function(){var a=this.getScrollPos();this.scrollLeft[a===0?\"addClass\":\"removeClass\"](\"x-tab-scroller-left-disabled\");this.scrollRight[a>=(this.getScrollWidth()-this.getScrollArea())?\"addClass\":\"removeClass\"](\"x-tab-scroller-right-disabled\")},beforeDestroy:function(){Ext.destroy(this.leftRepeater,this.rightRepeater);this.deleteMembers(\"strip\",\"edge\",\"scrollLeft\",\"scrollRight\",\"stripWrap\");this.activeTab=null;Ext.TabPanel.superclass.beforeDestroy.apply(this)}});Ext.reg(\"tabpanel\",Ext.TabPanel);Ext.TabPanel.prototype.activate=Ext.TabPanel.prototype.setActiveTab;Ext.TabPanel.AccessStack=function(){var a=[];return{add:function(b){a.push(b);if(a.length>10){a.shift()}},remove:function(e){var d=[];for(var c=0,b=a.length;c<b;c++){if(a[c]!=e){d.push(a[c])}}a=d},next:function(){return a.pop()}}};Ext.Button=Ext.extend(Ext.BoxComponent,{hidden:false,disabled:false,pressed:false,enableToggle:false,menuAlign:\"tl-bl?\",type:\"button\",menuClassTarget:\"tr:nth(2)\",clickEvent:\"click\",handleMouseEvents:true,tooltipType:\"qtip\",buttonSelector:\"button:first-child\",scale:\"small\",iconAlign:\"left\",arrowAlign:\"right\",initComponent:function(){if(this.menu){if(Ext.isArray(this.menu)){this.menu={items:this.menu}}if(Ext.isObject(this.menu)){this.menu.ownerCt=this}this.menu=Ext.menu.MenuMgr.get(this.menu);this.menu.ownerCt=undefined}Ext.Button.superclass.initComponent.call(this);this.addEvents(\"click\",\"toggle\",\"mouseover\",\"mouseout\",\"menushow\",\"menuhide\",\"menutriggerover\",\"menutriggerout\");if(Ext.isString(this.toggleGroup)){this.enableToggle=true}},getTemplateArgs:function(){return[this.type,\"x-btn-\"+this.scale+\" x-btn-icon-\"+this.scale+\"-\"+this.iconAlign,this.getMenuClass(),this.cls,this.id]},setButtonClass:function(){if(this.useSetClass){if(!Ext.isEmpty(this.oldCls)){this.el.removeClass([this.oldCls,\"x-btn-pressed\"])}this.oldCls=(this.iconCls||this.icon)?(this.text?\"x-btn-text-icon\":\"x-btn-icon\"):\"x-btn-noicon\";this.el.addClass([this.oldCls,this.pressed?\"x-btn-pressed\":null])}},getMenuClass:function(){return this.menu?(this.arrowAlign!=\"bottom\"?\"x-btn-arrow\":\"x-btn-arrow-bottom\"):\"\"},onRender:function(c,a){if(!this.template){if(!Ext.Button.buttonTemplate){Ext.Button.buttonTemplate=new Ext.Template('<table id=\"{4}\" cellspacing=\"0\" class=\"x-btn {3}\"><tbody class=\"{1}\">','<tr><td class=\"x-btn-tl\"><i>&#160;</i></td><td class=\"x-btn-tc\"></td><td class=\"x-btn-tr\"><i>&#160;</i></td></tr>','<tr><td class=\"x-btn-ml\"><i>&#160;</i></td><td class=\"x-btn-mc\"><em class=\"{2} x-unselectable\" unselectable=\"on\"><button type=\"{0}\"></button></em></td><td class=\"x-btn-mr\"><i>&#160;</i></td></tr>','<tr><td class=\"x-btn-bl\"><i>&#160;</i></td><td class=\"x-btn-bc\"></td><td class=\"x-btn-br\"><i>&#160;</i></td></tr>',\"</tbody></table>\");Ext.Button.buttonTemplate.compile()}this.template=Ext.Button.buttonTemplate}var b,d=this.getTemplateArgs();if(a){b=this.template.insertBefore(a,d,true)}else{b=this.template.append(c,d,true)}this.btnEl=b.child(this.buttonSelector);this.mon(this.btnEl,{scope:this,focus:this.onFocus,blur:this.onBlur});this.initButtonEl(b,this.btnEl);Ext.ButtonToggleMgr.register(this)},initButtonEl:function(b,c){this.el=b;this.setIcon(this.icon);this.setText(this.text);this.setIconClass(this.iconCls);if(Ext.isDefined(this.tabIndex)){c.dom.tabIndex=this.tabIndex}if(this.tooltip){this.setTooltip(this.tooltip,true)}if(this.handleMouseEvents){this.mon(b,{scope:this,mouseover:this.onMouseOver,mousedown:this.onMouseDown})}if(this.menu){this.mon(this.menu,{scope:this,show:this.onMenuShow,hide:this.onMenuHide})}if(this.repeat){var a=new Ext.util.ClickRepeater(b,Ext.isObject(this.repeat)?this.repeat:{});this.mon(a,\"click\",this.onRepeatClick,this)}else{this.mon(b,this.clickEvent,this.onClick,this)}},afterRender:function(){Ext.Button.superclass.afterRender.call(this);this.useSetClass=true;this.setButtonClass();this.doc=Ext.getDoc();this.doAutoWidth()},setIconClass:function(a){this.iconCls=a;if(this.el){this.btnEl.dom.className=\"\";this.btnEl.addClass([\"x-btn-text\",a||\"\"]);this.setButtonClass()}return this},setTooltip:function(b,a){if(this.rendered){if(!a){this.clearTip()}if(Ext.isObject(b)){Ext.QuickTips.register(Ext.apply({target:this.btnEl.id},b));this.tooltip=b}else{this.btnEl.dom[this.tooltipType]=b}}else{this.tooltip=b}return this},clearTip:function(){if(Ext.isObject(this.tooltip)){Ext.QuickTips.unregister(this.btnEl)}},beforeDestroy:function(){if(this.rendered){this.clearTip()}if(this.menu&&this.destroyMenu!==false){Ext.destroy(this.btnEl,this.menu)}Ext.destroy(this.repeater)},onDestroy:function(){if(this.rendered){this.doc.un(\"mouseover\",this.monitorMouseOver,this);this.doc.un(\"mouseup\",this.onMouseUp,this);delete this.doc;delete this.btnEl;Ext.ButtonToggleMgr.unregister(this)}Ext.Button.superclass.onDestroy.call(this)},doAutoWidth:function(){if(this.autoWidth!==false&&this.el&&this.text&&this.width===undefined){this.el.setWidth(\"auto\");if(Ext.isIE7&&Ext.isStrict){var a=this.btnEl;if(a&&a.getWidth()>20){a.clip();a.setWidth(Ext.util.TextMetrics.measure(a,this.text).width+a.getFrameWidth(\"lr\"))}}if(this.minWidth){if(this.el.getWidth()<this.minWidth){this.el.setWidth(this.minWidth)}}}},setHandler:function(b,a){this.handler=b;this.scope=a;return this},setText:function(a){this.text=a;if(this.el){this.btnEl.update(a||\"&#160;\");this.setButtonClass()}this.doAutoWidth();return this},setIcon:function(a){this.icon=a;if(this.el){this.btnEl.setStyle(\"background-image\",a?\"url(\"+a+\")\":\"\");this.setButtonClass()}return this},getText:function(){return this.text},toggle:function(b,a){b=b===undefined?!this.pressed:!!b;if(b!=this.pressed){if(this.rendered){this.el[b?\"addClass\":\"removeClass\"](\"x-btn-pressed\")}this.pressed=b;if(!a){this.fireEvent(\"toggle\",this,b);if(this.toggleHandler){this.toggleHandler.call(this.scope||this,this,b)}}}return this},onDisable:function(){this.onDisableChange(true)},onEnable:function(){this.onDisableChange(false)},onDisableChange:function(a){if(this.el){if(!Ext.isIE6||!this.text){this.el[a?\"addClass\":\"removeClass\"](this.disabledClass)}this.el.dom.disabled=a}this.disabled=a},showMenu:function(){if(this.rendered&&this.menu){if(this.tooltip){Ext.QuickTips.getQuickTip().cancelShow(this.btnEl)}if(this.menu.isVisible()){this.menu.hide()}this.menu.ownerCt=this;this.menu.show(this.el,this.menuAlign)}return this},hideMenu:function(){if(this.hasVisibleMenu()){this.menu.hide()}return this},hasVisibleMenu:function(){return this.menu&&this.menu.ownerCt==this&&this.menu.isVisible()},onRepeatClick:function(a,b){this.onClick(b)},onClick:function(a){if(a){a.preventDefault()}if(a.button!==0){return}if(!this.disabled){this.doToggle();if(this.menu&&!this.hasVisibleMenu()&&!this.ignoreNextClick){this.showMenu()}this.fireEvent(\"click\",this,a);if(this.handler){this.handler.call(this.scope||this,this,a)}}},doToggle:function(){if(this.enableToggle&&(this.allowDepress!==false||!this.pressed)){this.toggle()}},isMenuTriggerOver:function(b,a){return this.menu&&!a},isMenuTriggerOut:function(b,a){return this.menu&&!a},onMouseOver:function(b){if(!this.disabled){var a=b.within(this.el,true);if(!a){this.el.addClass(\"x-btn-over\");if(!this.monitoringMouseOver){this.doc.on(\"mouseover\",this.monitorMouseOver,this);this.monitoringMouseOver=true}this.fireEvent(\"mouseover\",this,b)}if(this.isMenuTriggerOver(b,a)){this.fireEvent(\"menutriggerover\",this,this.menu,b)}}},monitorMouseOver:function(a){if(a.target!=this.el.dom&&!a.within(this.el)){if(this.monitoringMouseOver){this.doc.un(\"mouseover\",this.monitorMouseOver,this);this.monitoringMouseOver=false}this.onMouseOut(a)}},onMouseOut:function(b){var a=b.within(this.el)&&b.target!=this.el.dom;this.el.removeClass(\"x-btn-over\");this.fireEvent(\"mouseout\",this,b);if(this.isMenuTriggerOut(b,a)){this.fireEvent(\"menutriggerout\",this,this.menu,b)}},focus:function(){this.btnEl.focus()},blur:function(){this.btnEl.blur()},onFocus:function(a){if(!this.disabled){this.el.addClass(\"x-btn-focus\")}},onBlur:function(a){this.el.removeClass(\"x-btn-focus\")},getClickEl:function(b,a){return this.el},onMouseDown:function(a){if(!this.disabled&&a.button===0){this.getClickEl(a).addClass(\"x-btn-click\");this.doc.on(\"mouseup\",this.onMouseUp,this)}},onMouseUp:function(a){if(a.button===0){this.getClickEl(a,true).removeClass(\"x-btn-click\");this.doc.un(\"mouseup\",this.onMouseUp,this)}},onMenuShow:function(a){if(this.menu.ownerCt==this){this.menu.ownerCt=this;this.ignoreNextClick=0;this.el.addClass(\"x-btn-menu-active\");this.fireEvent(\"menushow\",this,this.menu)}},onMenuHide:function(a){if(this.menu.ownerCt==this){this.el.removeClass(\"x-btn-menu-active\");this.ignoreNextClick=this.restoreClick.defer(250,this);this.fireEvent(\"menuhide\",this,this.menu);delete this.menu.ownerCt}},restoreClick:function(){this.ignoreNextClick=0}});Ext.reg(\"button\",Ext.Button);Ext.ButtonToggleMgr=function(){var a={};function b(e,j){if(j){var h=a[e.toggleGroup];for(var d=0,c=h.length;d<c;d++){if(h[d]!=e){h[d].toggle(false)}}}}return{register:function(c){if(!c.toggleGroup){return}var d=a[c.toggleGroup];if(!d){d=a[c.toggleGroup]=[]}d.push(c);c.on(\"toggle\",b)},unregister:function(c){if(!c.toggleGroup){return}var d=a[c.toggleGroup];if(d){d.remove(c);c.un(\"toggle\",b)}},getPressed:function(h){var e=a[h];if(e){for(var d=0,c=e.length;d<c;d++){if(e[d].pressed===true){return e[d]}}}return null}}}();Ext.SplitButton=Ext.extend(Ext.Button,{arrowSelector:\"em\",split:true,initComponent:function(){Ext.SplitButton.superclass.initComponent.call(this);this.addEvents(\"arrowclick\")},onRender:function(){Ext.SplitButton.superclass.onRender.apply(this,arguments);if(this.arrowTooltip){this.el.child(this.arrowSelector).dom[this.tooltipType]=this.arrowTooltip}},setArrowHandler:function(b,a){this.arrowHandler=b;this.scope=a},getMenuClass:function(){return\"x-btn-split\"+(this.arrowAlign==\"bottom\"?\"-bottom\":\"\")},isClickOnArrow:function(c){if(this.arrowAlign!=\"bottom\"){var b=this.el.child(\"em.x-btn-split\");var a=b.getRegion().right-b.getPadding(\"r\");return c.getPageX()>a}else{return c.getPageY()>this.btnEl.getRegion().bottom}},onClick:function(b,a){b.preventDefault();if(!this.disabled){if(this.isClickOnArrow(b)){if(this.menu&&!this.menu.isVisible()&&!this.ignoreNextClick){this.showMenu()}this.fireEvent(\"arrowclick\",this,b);if(this.arrowHandler){this.arrowHandler.call(this.scope||this,this,b)}}else{this.doToggle();this.fireEvent(\"click\",this,b);if(this.handler){this.handler.call(this.scope||this,this,b)}}}},isMenuTriggerOver:function(a){return this.menu&&a.target.tagName==this.arrowSelector},isMenuTriggerOut:function(b,a){return this.menu&&b.target.tagName!=this.arrowSelector}});Ext.reg(\"splitbutton\",Ext.SplitButton);Ext.CycleButton=Ext.extend(Ext.SplitButton,{getItemText:function(a){if(a&&this.showText===true){var b=\"\";if(this.prependText){b+=this.prependText}b+=a.text;return b}return undefined},setActiveItem:function(c,a){if(!Ext.isObject(c)){c=this.menu.getComponent(c)}if(c){if(!this.rendered){this.text=this.getItemText(c);this.iconCls=c.iconCls}else{var b=this.getItemText(c);if(b){this.setText(b)}this.setIconClass(c.iconCls)}this.activeItem=c;if(!c.checked){c.setChecked(true,a)}if(this.forceIcon){this.setIconClass(this.forceIcon)}if(!a){this.fireEvent(\"change\",this,c)}}},getActiveItem:function(){return this.activeItem},initComponent:function(){this.addEvents(\"change\");if(this.changeHandler){this.on(\"change\",this.changeHandler,this.scope||this);delete this.changeHandler}this.itemCount=this.items.length;this.menu={cls:\"x-cycle-menu\",items:[]};var a=0;Ext.each(this.items,function(c,b){Ext.apply(c,{group:c.group||this.id,itemIndex:b,checkHandler:this.checkHandler,scope:this,checked:c.checked||false});this.menu.items.push(c);if(c.checked){a=b}},this);Ext.CycleButton.superclass.initComponent.call(this);this.on(\"click\",this.toggleSelected,this);this.setActiveItem(a,true)},checkHandler:function(a,b){if(b){this.setActiveItem(a)}},toggleSelected:function(){var a=this.menu;a.render();if(!a.hasLayout){a.doLayout()}var d,b;for(var c=1;c<this.itemCount;c++){d=(this.activeItem.itemIndex+c)%this.itemCount;b=a.items.itemAt(d);if(!b.disabled){b.setChecked(true);break}}}});Ext.reg(\"cycle\",Ext.CycleButton);Ext.Toolbar=function(a){if(Ext.isArray(a)){a={items:a,layout:\"toolbar\"}}else{a=Ext.apply({layout:\"toolbar\"},a);if(a.buttons){a.items=a.buttons}}Ext.Toolbar.superclass.constructor.call(this,a)};(function(){var a=Ext.Toolbar;Ext.extend(a,Ext.Container,{defaultType:\"button\",enableOverflow:false,trackMenus:true,internalDefaults:{removeMode:\"container\",hideParent:true},toolbarCls:\"x-toolbar\",initComponent:function(){a.superclass.initComponent.call(this);this.addEvents(\"overflowchange\")},onRender:function(c,b){if(!this.el){if(!this.autoCreate){this.autoCreate={cls:this.toolbarCls+\" x-small-editor\"}}this.el=c.createChild(Ext.apply({id:this.id},this.autoCreate),b);Ext.Toolbar.superclass.onRender.apply(this,arguments)}},lookupComponent:function(b){if(Ext.isString(b)){if(b==\"-\"){b=new a.Separator()}else{if(b==\" \"){b=new a.Spacer()}else{if(b==\"->\"){b=new a.Fill()}else{b=new a.TextItem(b)}}}this.applyDefaults(b)}else{if(b.isFormField||b.render){b=this.createComponent(b)}else{if(b.tag){b=new a.Item({autoEl:b})}else{if(b.tagName){b=new a.Item({el:b})}else{if(Ext.isObject(b)){b=b.xtype?this.createComponent(b):this.constructButton(b)}}}}}return b},applyDefaults:function(e){if(!Ext.isString(e)){e=Ext.Toolbar.superclass.applyDefaults.call(this,e);var b=this.internalDefaults;if(e.events){Ext.applyIf(e.initialConfig,b);Ext.apply(e,b)}else{Ext.applyIf(e,b)}}return e},addSeparator:function(){return this.add(new a.Separator())},addSpacer:function(){return this.add(new a.Spacer())},addFill:function(){this.add(new a.Fill())},addElement:function(b){return this.addItem(new a.Item({el:b}))},addItem:function(b){return this.add.apply(this,arguments)},addButton:function(c){if(Ext.isArray(c)){var e=[];for(var d=0,b=c.length;d<b;d++){e.push(this.addButton(c[d]))}return e}return this.add(this.constructButton(c))},addText:function(b){return this.addItem(new a.TextItem(b))},addDom:function(b){return this.add(new a.Item({autoEl:b}))},addField:function(b){return this.add(b)},insertButton:function(c,g){if(Ext.isArray(g)){var e=[];for(var d=0,b=g.length;d<b;d++){e.push(this.insertButton(c+d,g[d]))}return e}return Ext.Toolbar.superclass.insert.call(this,c,g)},trackMenu:function(c,b){if(this.trackMenus&&c.menu){var d=b?\"mun\":\"mon\";this[d](c,\"menutriggerover\",this.onButtonTriggerOver,this);this[d](c,\"menushow\",this.onButtonMenuShow,this);this[d](c,\"menuhide\",this.onButtonMenuHide,this)}},constructButton:function(d){var c=d.events?d:this.createComponent(d,d.split?\"splitbutton\":this.defaultType);return c},onAdd:function(b){Ext.Toolbar.superclass.onAdd.call(this);this.trackMenu(b);if(this.disabled){b.disable()}},onRemove:function(b){Ext.Toolbar.superclass.onRemove.call(this);if(b==this.activeMenuBtn){delete this.activeMenuBtn}this.trackMenu(b,true)},onDisable:function(){this.items.each(function(b){if(b.disable){b.disable()}})},onEnable:function(){this.items.each(function(b){if(b.enable){b.enable()}})},onButtonTriggerOver:function(b){if(this.activeMenuBtn&&this.activeMenuBtn!=b){this.activeMenuBtn.hideMenu();b.showMenu();this.activeMenuBtn=b}},onButtonMenuShow:function(b){this.activeMenuBtn=b},onButtonMenuHide:function(b){delete this.activeMenuBtn}});Ext.reg(\"toolbar\",Ext.Toolbar);a.Item=Ext.extend(Ext.BoxComponent,{hideParent:true,enable:Ext.emptyFn,disable:Ext.emptyFn,focus:Ext.emptyFn});Ext.reg(\"tbitem\",a.Item);a.Separator=Ext.extend(a.Item,{onRender:function(c,b){this.el=c.createChild({tag:\"span\",cls:\"xtb-sep\"},b)}});Ext.reg(\"tbseparator\",a.Separator);a.Spacer=Ext.extend(a.Item,{onRender:function(c,b){this.el=c.createChild({tag:\"div\",cls:\"xtb-spacer\",style:this.width?\"width:\"+this.width+\"px\":\"\"},b)}});Ext.reg(\"tbspacer\",a.Spacer);a.Fill=Ext.extend(a.Item,{render:Ext.emptyFn,isFill:true});Ext.reg(\"tbfill\",a.Fill);a.TextItem=Ext.extend(a.Item,{constructor:function(b){a.TextItem.superclass.constructor.call(this,Ext.isString(b)?{text:b}:b)},onRender:function(c,b){this.autoEl={cls:\"xtb-text\",html:this.text||\"\"};a.TextItem.superclass.onRender.call(this,c,b)},setText:function(b){if(this.rendered){this.el.update(b)}else{this.text=b}}});Ext.reg(\"tbtext\",a.TextItem);a.Button=Ext.extend(Ext.Button,{});a.SplitButton=Ext.extend(Ext.SplitButton,{});Ext.reg(\"tbbutton\",a.Button);Ext.reg(\"tbsplit\",a.SplitButton)})();Ext.ButtonGroup=Ext.extend(Ext.Panel,{baseCls:\"x-btn-group\",layout:\"table\",defaultType:\"button\",frame:true,internalDefaults:{removeMode:\"container\",hideParent:true},initComponent:function(){this.layoutConfig=this.layoutConfig||{};Ext.applyIf(this.layoutConfig,{columns:this.columns});if(!this.title){this.addClass(\"x-btn-group-notitle\")}this.on(\"afterlayout\",this.onAfterLayout,this);Ext.ButtonGroup.superclass.initComponent.call(this)},applyDefaults:function(b){b=Ext.ButtonGroup.superclass.applyDefaults.call(this,b);var a=this.internalDefaults;if(b.events){Ext.applyIf(b.initialConfig,a);Ext.apply(b,a)}else{Ext.applyIf(b,a)}return b},onAfterLayout:function(){var a=this.body.getFrameWidth(\"lr\")+this.body.dom.firstChild.offsetWidth;this.body.setWidth(a);this.el.setWidth(a+this.getFrameWidth())}});Ext.reg(\"buttongroup\",Ext.ButtonGroup);(function(){var a=Ext.Toolbar;Ext.PagingToolbar=Ext.extend(Ext.Toolbar,{pageSize:20,displayMsg:\"Displaying {0} - {1} of {2}\",emptyMsg:\"No data to display\",beforePageText:\"Page\",afterPageText:\"of {0}\",firstText:\"First Page\",prevText:\"Previous Page\",nextText:\"Next Page\",lastText:\"Last Page\",refreshText:\"Refresh\",initComponent:function(){var c=[this.first=new a.Button({tooltip:this.firstText,overflowText:this.firstText,iconCls:\"x-tbar-page-first\",disabled:true,handler:this.moveFirst,scope:this}),this.prev=new a.Button({tooltip:this.prevText,overflowText:this.prevText,iconCls:\"x-tbar-page-prev\",disabled:true,handler:this.movePrevious,scope:this}),\"-\",this.beforePageText,this.inputItem=new Ext.form.NumberField({cls:\"x-tbar-page-number\",allowDecimals:false,allowNegative:false,enableKeyEvents:true,selectOnFocus:true,submitValue:false,listeners:{scope:this,keydown:this.onPagingKeyDown,blur:this.onPagingBlur}}),this.afterTextItem=new a.TextItem({text:String.format(this.afterPageText,1)}),\"-\",this.next=new a.Button({tooltip:this.nextText,overflowText:this.nextText,iconCls:\"x-tbar-page-next\",disabled:true,handler:this.moveNext,scope:this}),this.last=new a.Button({tooltip:this.lastText,overflowText:this.lastText,iconCls:\"x-tbar-page-last\",disabled:true,handler:this.moveLast,scope:this}),\"-\",this.refresh=new a.Button({tooltip:this.refreshText,overflowText:this.refreshText,iconCls:\"x-tbar-loading\",handler:this.doRefresh,scope:this})];var b=this.items||this.buttons||[];if(this.prependButtons){this.items=b.concat(c)}else{this.items=c.concat(b)}delete this.buttons;if(this.displayInfo){this.items.push(\"->\");this.items.push(this.displayItem=new a.TextItem({}))}Ext.PagingToolbar.superclass.initComponent.call(this);this.addEvents(\"change\",\"beforechange\");this.on(\"afterlayout\",this.onFirstLayout,this,{single:true});this.cursor=0;this.bindStore(this.store,true)},onFirstLayout:function(){if(this.dsLoaded){this.onLoad.apply(this,this.dsLoaded)}},updateInfo:function(){if(this.displayItem){var b=this.store.getCount();var c=b==0?this.emptyMsg:String.format(this.displayMsg,this.cursor+1,this.cursor+b,this.store.getTotalCount());this.displayItem.setText(c)}},onLoad:function(b,e,j){if(!this.rendered){this.dsLoaded=[b,e,j];return}var g=this.getParams();this.cursor=(j.params&&j.params[g.start])?j.params[g.start]:0;var i=this.getPageData(),c=i.activePage,h=i.pages;this.afterTextItem.setText(String.format(this.afterPageText,i.pages));this.inputItem.setValue(c);this.first.setDisabled(c==1);this.prev.setDisabled(c==1);this.next.setDisabled(c==h);this.last.setDisabled(c==h);this.refresh.enable();this.updateInfo();this.fireEvent(\"change\",this,i)},getPageData:function(){var b=this.store.getTotalCount();return{total:b,activePage:Math.ceil((this.cursor+this.pageSize)/this.pageSize),pages:b<this.pageSize?1:Math.ceil(b/this.pageSize)}},changePage:function(b){this.doLoad(((b-1)*this.pageSize).constrain(0,this.store.getTotalCount()))},onLoadError:function(){if(!this.rendered){return}this.refresh.enable()},readPage:function(e){var b=this.inputItem.getValue(),c;if(!b||isNaN(c=parseInt(b,10))){this.inputItem.setValue(e.activePage);return false}return c},onPagingFocus:function(){this.inputItem.select()},onPagingBlur:function(b){this.inputItem.setValue(this.getPageData().activePage)},onPagingKeyDown:function(i,h){var c=h.getKey(),j=this.getPageData(),g;if(c==h.RETURN){h.stopEvent();g=this.readPage(j);if(g!==false){g=Math.min(Math.max(1,g),j.pages)-1;this.doLoad(g*this.pageSize)}}else{if(c==h.HOME||c==h.END){h.stopEvent();g=c==h.HOME?1:j.pages;i.setValue(g)}else{if(c==h.UP||c==h.PAGEUP||c==h.DOWN||c==h.PAGEDOWN){h.stopEvent();if((g=this.readPage(j))){var b=h.shiftKey?10:1;if(c==h.DOWN||c==h.PAGEDOWN){b*=-1}g+=b;if(g>=1&g<=j.pages){i.setValue(g)}}}}}},getParams:function(){return this.paramNames||this.store.paramNames},beforeLoad:function(){if(this.rendered&&this.refresh){this.refresh.disable()}},doLoad:function(d){var c={},b=this.getParams();c[b.start]=d;c[b.limit]=this.pageSize;if(this.fireEvent(\"beforechange\",this,c)!==false){this.store.load({params:c})}},moveFirst:function(){this.doLoad(0)},movePrevious:function(){this.doLoad(Math.max(0,this.cursor-this.pageSize))},moveNext:function(){this.doLoad(this.cursor+this.pageSize)},moveLast:function(){var c=this.store.getTotalCount(),b=c%this.pageSize;this.doLoad(b?(c-b):c-this.pageSize)},doRefresh:function(){this.doLoad(this.cursor)},bindStore:function(c,d){var b;if(!d&&this.store){if(c!==this.store&&this.store.autoDestroy){this.store.destroy()}else{this.store.un(\"beforeload\",this.beforeLoad,this);this.store.un(\"load\",this.onLoad,this);this.store.un(\"exception\",this.onLoadError,this)}if(!c){this.store=null}}if(c){c=Ext.StoreMgr.lookup(c);c.on({scope:this,beforeload:this.beforeLoad,load:this.onLoad,exception:this.onLoadError});b=true}this.store=c;if(b){this.onLoad(c,null,{})}},unbind:function(b){this.bindStore(null)},bind:function(b){this.bindStore(b)},onDestroy:function(){this.bindStore(null);Ext.PagingToolbar.superclass.onDestroy.call(this)}})})();Ext.reg(\"paging\",Ext.PagingToolbar);Ext.History=(function(){var e,c;var k=false;var d;function g(){var l=location.href,m=l.indexOf(\"#\"),n=m>=0?l.substr(m+1):null;if(Ext.isGecko){n=decodeURIComponent(n)}return n}function a(){c.value=d}function h(l){d=l;Ext.History.fireEvent(\"change\",l)}function i(m){var l=['<html><body><div id=\"state\">',Ext.util.Format.htmlEncode(m),\"</div></body></html>\"].join(\"\");try{var o=e.contentWindow.document;o.open();o.write(l);o.close();return true}catch(n){return false}}function b(){if(!e.contentWindow||!e.contentWindow.document){setTimeout(b,10);return}var o=e.contentWindow.document;var m=o.getElementById(\"state\");var l=m?m.innerText:null;var n=g();setInterval(function(){o=e.contentWindow.document;m=o.getElementById(\"state\");var q=m?m.innerText:null;var p=g();if(q!==l){l=q;h(l);location.hash=l;n=l;a()}else{if(p!==n){n=p;i(p)}}},50);k=true;Ext.History.fireEvent(\"ready\",Ext.History)}function j(){d=c.value?c.value:g();if(Ext.isIE){b()}else{var l=g();setInterval(function(){var m=g();if(m!==l){l=m;h(l);a()}},50);k=true;Ext.History.fireEvent(\"ready\",Ext.History)}}return{fieldId:\"x-history-field\",iframeId:\"x-history-frame\",events:{},init:function(m,l){if(k){Ext.callback(m,l,[this]);return}if(!Ext.isReady){Ext.onReady(function(){Ext.History.init(m,l)});return}c=Ext.getDom(Ext.History.fieldId);if(Ext.isIE){e=Ext.getDom(Ext.History.iframeId)}this.addEvents(\"ready\",\"change\");if(m){this.on(\"ready\",m,l,{single:true})}j()},add:function(l,m){if(m!==false){if(this.getToken()==l){return true}}if(Ext.isIE){return i(l)}else{location.hash=l;return true}},back:function(){history.go(-1)},forward:function(){history.go(1)},getToken:function(){return k?d:g()}}})();Ext.apply(Ext.History,new Ext.util.Observable());Ext.Tip=Ext.extend(Ext.Panel,{minWidth:40,maxWidth:300,shadow:\"sides\",defaultAlign:\"tl-bl?\",autoRender:true,quickShowInterval:250,frame:true,hidden:true,baseCls:\"x-tip\",floating:{shadow:true,shim:true,useDisplay:true,constrain:false},autoHeight:true,closeAction:\"hide\",initComponent:function(){Ext.Tip.superclass.initComponent.call(this);if(this.closable&&!this.title){this.elements+=\",header\"}},afterRender:function(){Ext.Tip.superclass.afterRender.call(this);if(this.closable){this.addTool({id:\"close\",handler:this[this.closeAction],scope:this})}},showAt:function(a){Ext.Tip.superclass.show.call(this);if(this.measureWidth!==false&&(!this.initialConfig||typeof this.initialConfig.width!=\"number\")){this.doAutoWidth()}if(this.constrainPosition){a=this.el.adjustForConstraints(a)}this.setPagePosition(a[0],a[1])},doAutoWidth:function(a){a=a||0;var b=this.body.getTextWidth();if(this.title){b=Math.max(b,this.header.child(\"span\").getTextWidth(this.title))}b+=this.getFrameWidth()+(this.closable?20:0)+this.body.getPadding(\"lr\")+a;this.setWidth(b.constrain(this.minWidth,this.maxWidth));if(Ext.isIE7&&!this.repainted){this.el.repaint();this.repainted=true}},showBy:function(a,b){if(!this.rendered){this.render(Ext.getBody())}this.showAt(this.el.getAlignToXY(a,b||this.defaultAlign))},initDraggable:function(){this.dd=new Ext.Tip.DD(this,typeof this.draggable==\"boolean\"?null:this.draggable);this.header.addClass(\"x-tip-draggable\")}});Ext.reg(\"tip\",Ext.Tip);Ext.Tip.DD=function(b,a){Ext.apply(this,a);this.tip=b;Ext.Tip.DD.superclass.constructor.call(this,b.el.id,\"WindowDD-\"+b.id);this.setHandleElId(b.header.id);this.scroll=false};Ext.extend(Ext.Tip.DD,Ext.dd.DD,{moveOnly:true,scroll:false,headerOffsets:[100,25],startDrag:function(){this.tip.el.disableShadow()},endDrag:function(a){this.tip.el.enableShadow(true)}});Ext.ToolTip=Ext.extend(Ext.Tip,{showDelay:500,hideDelay:200,dismissDelay:5000,trackMouse:false,anchorToTarget:true,anchorOffset:0,targetCounter:0,constrainPosition:false,initComponent:function(){Ext.ToolTip.superclass.initComponent.call(this);this.lastActive=new Date();this.initTarget(this.target);this.origAnchor=this.anchor},onRender:function(b,a){Ext.ToolTip.superclass.onRender.call(this,b,a);this.anchorCls=\"x-tip-anchor-\"+this.getAnchorPosition();this.anchorEl=this.el.createChild({cls:\"x-tip-anchor \"+this.anchorCls})},afterRender:function(){Ext.ToolTip.superclass.afterRender.call(this);this.anchorEl.setStyle(\"z-index\",this.el.getZIndex()+1).setVisibilityMode(Ext.Element.DISPLAY)},initTarget:function(c){var a;if((a=Ext.get(c))){if(this.target){var b=Ext.get(this.target);this.mun(b,\"mouseover\",this.onTargetOver,this);this.mun(b,\"mouseout\",this.onTargetOut,this);this.mun(b,\"mousemove\",this.onMouseMove,this)}this.mon(a,{mouseover:this.onTargetOver,mouseout:this.onTargetOut,mousemove:this.onMouseMove,scope:this});this.target=a}if(this.anchor){this.anchorTarget=this.target}},onMouseMove:function(b){var a=this.delegate?b.getTarget(this.delegate):this.triggerElement=true;if(a){this.targetXY=b.getXY();if(a===this.triggerElement){if(!this.hidden&&this.trackMouse){this.setPagePosition(this.getTargetXY())}}else{this.hide();this.lastActive=new Date(0);this.onTargetOver(b)}}else{if(!this.closable&&this.isVisible()){this.hide()}}},getTargetXY:function(){if(this.delegate){this.anchorTarget=this.triggerElement}if(this.anchor){this.targetCounter++;var c=this.getOffsets(),l=(this.anchorToTarget&&!this.trackMouse)?this.el.getAlignToXY(this.anchorTarget,this.getAnchorAlign()):this.targetXY,a=Ext.lib.Dom.getViewWidth()-5,h=Ext.lib.Dom.getViewHeight()-5,i=document.documentElement,e=document.body,k=(i.scrollLeft||e.scrollLeft||0)+5,j=(i.scrollTop||e.scrollTop||0)+5,b=[l[0]+c[0],l[1]+c[1]],g=this.getSize();this.anchorEl.removeClass(this.anchorCls);if(this.targetCounter<2){if(b[0]<k){if(this.anchorToTarget){this.defaultAlign=\"l-r\";if(this.mouseOffset){this.mouseOffset[0]*=-1}}this.anchor=\"left\";return this.getTargetXY()}if(b[0]+g.width>a){if(this.anchorToTarget){this.defaultAlign=\"r-l\";if(this.mouseOffset){this.mouseOffset[0]*=-1}}this.anchor=\"right\";return this.getTargetXY()}if(b[1]<j){if(this.anchorToTarget){this.defaultAlign=\"t-b\";if(this.mouseOffset){this.mouseOffset[1]*=-1}}this.anchor=\"top\";return this.getTargetXY()}if(b[1]+g.height>h){if(this.anchorToTarget){this.defaultAlign=\"b-t\";if(this.mouseOffset){this.mouseOffset[1]*=-1}}this.anchor=\"bottom\";return this.getTargetXY()}}this.anchorCls=\"x-tip-anchor-\"+this.getAnchorPosition();this.anchorEl.addClass(this.anchorCls);this.targetCounter=0;return b}else{var d=this.getMouseOffset();return[this.targetXY[0]+d[0],this.targetXY[1]+d[1]]}},getMouseOffset:function(){var a=this.anchor?[0,0]:[15,18];if(this.mouseOffset){a[0]+=this.mouseOffset[0];a[1]+=this.mouseOffset[1]}return a},getAnchorPosition:function(){if(this.anchor){this.tipAnchor=this.anchor.charAt(0)}else{var a=this.defaultAlign.match(/^([a-z]+)-([a-z]+)(\\?)?$/);if(!a){throw\"AnchorTip.defaultAlign is invalid\"}this.tipAnchor=a[1].charAt(0)}switch(this.tipAnchor){case\"t\":return\"top\";case\"b\":return\"bottom\";case\"r\":return\"right\"}return\"left\"},getAnchorAlign:function(){switch(this.anchor){case\"top\":return\"tl-bl\";case\"left\":return\"tl-tr\";case\"right\":return\"tr-tl\";default:return\"bl-tl\"}},getOffsets:function(){var b,a=this.getAnchorPosition().charAt(0);if(this.anchorToTarget&&!this.trackMouse){switch(a){case\"t\":b=[0,9];break;case\"b\":b=[0,-13];break;case\"r\":b=[-13,0];break;default:b=[9,0];break}}else{switch(a){case\"t\":b=[-15-this.anchorOffset,30];break;case\"b\":b=[-19-this.anchorOffset,-13-this.el.dom.offsetHeight];break;case\"r\":b=[-15-this.el.dom.offsetWidth,-13-this.anchorOffset];break;default:b=[25,-13-this.anchorOffset];break}}var c=this.getMouseOffset();b[0]+=c[0];b[1]+=c[1];return b},onTargetOver:function(b){if(this.disabled||b.within(this.target.dom,true)){return}var a=b.getTarget(this.delegate);if(a){this.triggerElement=a;this.clearTimer(\"hide\");this.targetXY=b.getXY();this.delayShow()}},delayShow:function(){if(this.hidden&&!this.showTimer){if(this.lastActive.getElapsed()<this.quickShowInterval){this.show()}else{this.showTimer=this.show.defer(this.showDelay,this)}}else{if(!this.hidden&&this.autoHide!==false){this.show()}}},onTargetOut:function(a){if(this.disabled||a.within(this.target.dom,true)){return}this.clearTimer(\"show\");if(this.autoHide!==false){this.delayHide()}},delayHide:function(){if(!this.hidden&&!this.hideTimer){this.hideTimer=this.hide.defer(this.hideDelay,this)}},hide:function(){this.clearTimer(\"dismiss\");this.lastActive=new Date();if(this.anchorEl){this.anchorEl.hide()}Ext.ToolTip.superclass.hide.call(this);delete this.triggerElement},show:function(){if(this.anchor){this.showAt([-1000,-1000]);this.origConstrainPosition=this.constrainPosition;this.constrainPosition=false;this.anchor=this.origAnchor}this.showAt(this.getTargetXY());if(this.anchor){this.anchorEl.show();this.syncAnchor();this.constrainPosition=this.origConstrainPosition}else{this.anchorEl.hide()}},showAt:function(a){this.lastActive=new Date();this.clearTimers();Ext.ToolTip.superclass.showAt.call(this,a);if(this.dismissDelay&&this.autoHide!==false){this.dismissTimer=this.hide.defer(this.dismissDelay,this)}if(this.anchor&&!this.anchorEl.isVisible()){this.syncAnchor();this.anchorEl.show()}else{this.anchorEl.hide()}},syncAnchor:function(){var a,b,c;switch(this.tipAnchor.charAt(0)){case\"t\":a=\"b\";b=\"tl\";c=[20+this.anchorOffset,2];break;case\"r\":a=\"l\";b=\"tr\";c=[-2,11+this.anchorOffset];break;case\"b\":a=\"t\";b=\"bl\";c=[20+this.anchorOffset,-2];break;default:a=\"r\";b=\"tl\";c=[2,11+this.anchorOffset];break}this.anchorEl.alignTo(this.el,a+\"-\"+b,c)},setPagePosition:function(a,b){Ext.ToolTip.superclass.setPagePosition.call(this,a,b);if(this.anchor){this.syncAnchor()}},clearTimer:function(a){a=a+\"Timer\";clearTimeout(this[a]);delete this[a]},clearTimers:function(){this.clearTimer(\"show\");this.clearTimer(\"dismiss\");this.clearTimer(\"hide\")},onShow:function(){Ext.ToolTip.superclass.onShow.call(this);Ext.getDoc().on(\"mousedown\",this.onDocMouseDown,this)},onHide:function(){Ext.ToolTip.superclass.onHide.call(this);Ext.getDoc().un(\"mousedown\",this.onDocMouseDown,this)},onDocMouseDown:function(a){if(this.autoHide!==true&&!this.closable&&!a.within(this.el.dom)){this.disable();this.doEnable.defer(100,this)}},doEnable:function(){if(!this.isDestroyed){this.enable()}},onDisable:function(){this.clearTimers();this.hide()},adjustPosition:function(a,d){if(this.constrainPosition){var c=this.targetXY[1],b=this.getSize().height;if(d<=c&&(d+b)>=c){d=c-b-5}}return{x:a,y:d}},beforeDestroy:function(){this.clearTimers();Ext.destroy(this.anchorEl);delete this.anchorEl;delete this.target;delete this.anchorTarget;delete this.triggerElement;Ext.ToolTip.superclass.beforeDestroy.call(this)},onDestroy:function(){Ext.getDoc().un(\"mousedown\",this.onDocMouseDown,this);Ext.ToolTip.superclass.onDestroy.call(this)}});Ext.reg(\"tooltip\",Ext.ToolTip);Ext.QuickTip=Ext.extend(Ext.ToolTip,{interceptTitles:false,tagConfig:{namespace:\"ext\",attribute:\"qtip\",width:\"qwidth\",target:\"target\",title:\"qtitle\",hide:\"hide\",cls:\"qclass\",align:\"qalign\",anchor:\"anchor\"},initComponent:function(){this.target=this.target||Ext.getDoc();this.targets=this.targets||{};Ext.QuickTip.superclass.initComponent.call(this)},register:function(e){var h=Ext.isArray(e)?e:arguments;for(var g=0,a=h.length;g<a;g++){var l=h[g];var k=l.target;if(k){if(Ext.isArray(k)){for(var d=0,b=k.length;d<b;d++){this.targets[Ext.id(k[d])]=l}}else{this.targets[Ext.id(k)]=l}}}},unregister:function(a){delete this.targets[Ext.id(a)]},cancelShow:function(b){var a=this.activeTarget;b=Ext.get(b).dom;if(this.isVisible()){if(a&&a.el==b){this.hide()}}else{if(a&&a.el==b){this.clearTimer(\"show\")}}},getTipCfg:function(d){var b=d.getTarget(),c,a;if(this.interceptTitles&&b.title&&Ext.isString(b.title)){c=b.title;b.qtip=c;b.removeAttribute(\"title\");d.preventDefault()}else{a=this.tagConfig;c=b.qtip||Ext.fly(b).getAttribute(a.attribute,a.namespace)}return c},onTargetOver:function(i){if(this.disabled){return}this.targetXY=i.getXY();var c=i.getTarget();if(!c||c.nodeType!==1||c==document||c==document.body){return}if(this.activeTarget&&((c==this.activeTarget.el)||Ext.fly(this.activeTarget.el).contains(c))){this.clearTimer(\"hide\");this.show();return}if(c&&this.targets[c.id]){this.activeTarget=this.targets[c.id];this.activeTarget.el=c;this.anchor=this.activeTarget.anchor;if(this.anchor){this.anchorTarget=c}this.delayShow();return}var g,h=Ext.fly(c),b=this.tagConfig,d=b.namespace;if(g=this.getTipCfg(i)){var a=h.getAttribute(b.hide,d);this.activeTarget={el:c,text:g,width:h.getAttribute(b.width,d),autoHide:a!=\"user\"&&a!==\"false\",title:h.getAttribute(b.title,d),cls:h.getAttribute(b.cls,d),align:h.getAttribute(b.align,d)};this.anchor=h.getAttribute(b.anchor,d);if(this.anchor){this.anchorTarget=c}this.delayShow()}},onTargetOut:function(a){if(this.activeTarget&&a.within(this.activeTarget.el)&&!this.getTipCfg(a)){return}this.clearTimer(\"show\");if(this.autoHide!==false){this.delayHide()}},showAt:function(b){var a=this.activeTarget;if(a){if(!this.rendered){this.render(Ext.getBody());this.activeTarget=a}if(a.width){this.setWidth(a.width);this.body.setWidth(this.adjustBodyWidth(a.width-this.getFrameWidth()));this.measureWidth=false}else{this.measureWidth=true}this.setTitle(a.title||\"\");this.body.update(a.text);this.autoHide=a.autoHide;this.dismissDelay=a.dismissDelay||this.dismissDelay;if(this.lastCls){this.el.removeClass(this.lastCls);delete this.lastCls}if(a.cls){this.el.addClass(a.cls);this.lastCls=a.cls}if(this.anchor){this.constrainPosition=false}else{if(a.align){b=this.el.getAlignToXY(a.el,a.align);this.constrainPosition=false}else{this.constrainPosition=true}}}Ext.QuickTip.superclass.showAt.call(this,b)},hide:function(){delete this.activeTarget;Ext.QuickTip.superclass.hide.call(this)}});Ext.reg(\"quicktip\",Ext.QuickTip);Ext.QuickTips=function(){var b,a=false;return{init:function(c){if(!b){if(!Ext.isReady){Ext.onReady(function(){Ext.QuickTips.init(c)});return}b=new Ext.QuickTip({elements:\"header,body\",disabled:a});if(c!==false){b.render(Ext.getBody())}}},ddDisable:function(){if(b&&!a){b.disable()}},ddEnable:function(){if(b&&!a){b.enable()}},enable:function(){if(b){b.enable()}a=false},disable:function(){if(b){b.disable()}a=true},isEnabled:function(){return b!==undefined&&!b.disabled},getQuickTip:function(){return b},register:function(){b.register.apply(b,arguments)},unregister:function(){b.unregister.apply(b,arguments)},tips:function(){b.register.apply(b,arguments)}}}();Ext.slider.Tip=Ext.extend(Ext.Tip,{minWidth:10,offsets:[0,-10],init:function(a){a.on({scope:this,dragstart:this.onSlide,drag:this.onSlide,dragend:this.hide,destroy:this.destroy})},onSlide:function(b,c,a){this.show();this.body.update(this.getText(a));this.doAutoWidth();this.el.alignTo(a.el,\"b-t?\",this.offsets)},getText:function(a){return String(a.value)}});Ext.ux.SliderTip=Ext.slider.Tip;Ext.tree.TreePanel=Ext.extend(Ext.Panel,{rootVisible:true,animate:Ext.enableFx,lines:true,enableDD:false,hlDrop:Ext.enableFx,pathSeparator:\"/\",bubbleEvents:[],initComponent:function(){Ext.tree.TreePanel.superclass.initComponent.call(this);if(!this.eventModel){this.eventModel=new Ext.tree.TreeEventModel(this)}var a=this.loader;if(!a){a=new Ext.tree.TreeLoader({dataUrl:this.dataUrl,requestMethod:this.requestMethod})}else{if(Ext.isObject(a)&&!a.load){a=new Ext.tree.TreeLoader(a)}}this.loader=a;this.nodeHash={};if(this.root){var b=this.root;delete this.root;this.setRootNode(b)}this.addEvents(\"append\",\"remove\",\"movenode\",\"insert\",\"beforeappend\",\"beforeremove\",\"beforemovenode\",\"beforeinsert\",\"beforeload\",\"load\",\"textchange\",\"beforeexpandnode\",\"beforecollapsenode\",\"expandnode\",\"disabledchange\",\"collapsenode\",\"beforeclick\",\"click\",\"containerclick\",\"checkchange\",\"beforedblclick\",\"dblclick\",\"containerdblclick\",\"contextmenu\",\"containercontextmenu\",\"beforechildrenrendered\",\"startdrag\",\"enddrag\",\"dragdrop\",\"beforenodedrop\",\"nodedrop\",\"nodedragover\");if(this.singleExpand){this.on(\"beforeexpandnode\",this.restrictExpand,this)}},proxyNodeEvent:function(c,b,a,h,g,e,d){if(c==\"collapse\"||c==\"expand\"||c==\"beforecollapse\"||c==\"beforeexpand\"||c==\"move\"||c==\"beforemove\"){c=c+\"node\"}return this.fireEvent(c,b,a,h,g,e,d)},getRootNode:function(){return this.root},setRootNode:function(b){this.destroyRoot();if(!b.render){b=this.loader.createNode(b)}this.root=b;b.ownerTree=this;b.isRoot=true;this.registerNode(b);if(!this.rootVisible){var a=b.attributes.uiProvider;b.ui=a?new a(b):new Ext.tree.RootTreeNodeUI(b)}if(this.innerCt){this.clearInnerCt();this.renderRoot()}return b},clearInnerCt:function(){this.innerCt.update(\"\")},renderRoot:function(){this.root.render();if(!this.rootVisible){this.root.renderChildren()}},getNodeById:function(a){return this.nodeHash[a]},registerNode:function(a){this.nodeHash[a.id]=a},unregisterNode:function(a){delete this.nodeHash[a.id]},toString:function(){return\"[Tree\"+(this.id?\" \"+this.id:\"\")+\"]\"},restrictExpand:function(a){var b=a.parentNode;if(b){if(b.expandedChild&&b.expandedChild.parentNode==b){b.expandedChild.collapse()}b.expandedChild=a}},getChecked:function(b,c){c=c||this.root;var d=[];var e=function(){if(this.attributes.checked){d.push(!b?this:(b==\"id\"?this.id:this.attributes[b]))}};c.cascade(e);return d},getLoader:function(){return this.loader},expandAll:function(){this.root.expand(true)},collapseAll:function(){this.root.collapse(true)},getSelectionModel:function(){if(!this.selModel){this.selModel=new Ext.tree.DefaultSelectionModel()}return this.selModel},expandPath:function(g,a,h){if(Ext.isEmpty(g)){if(h){h(false,undefined)}return}a=a||\"id\";var d=g.split(this.pathSeparator);var c=this.root;if(c.attributes[a]!=d[1]){if(h){h(false,null)}return}var b=1;var e=function(){if(++b==d.length){if(h){h(true,c)}return}var i=c.findChild(a,d[b]);if(!i){if(h){h(false,c)}return}c=i;i.expand(false,false,e)};c.expand(false,false,e)},selectPath:function(e,a,g){if(Ext.isEmpty(e)){if(g){g(false,undefined)}return}a=a||\"id\";var c=e.split(this.pathSeparator),b=c.pop();if(c.length>1){var d=function(i,h){if(i&&h){var j=h.findChild(a,b);if(j){j.select();if(g){g(true,j)}}else{if(g){g(false,j)}}}else{if(g){g(false,j)}}};this.expandPath(c.join(this.pathSeparator),a,d)}else{this.root.select();if(g){g(true,this.root)}}},getTreeEl:function(){return this.body},onRender:function(b,a){Ext.tree.TreePanel.superclass.onRender.call(this,b,a);this.el.addClass(\"x-tree\");this.innerCt=this.body.createChild({tag:\"ul\",cls:\"x-tree-root-ct \"+(this.useArrows?\"x-tree-arrows\":this.lines?\"x-tree-lines\":\"x-tree-no-lines\")})},initEvents:function(){Ext.tree.TreePanel.superclass.initEvents.call(this);if(this.containerScroll){Ext.dd.ScrollManager.register(this.body)}if((this.enableDD||this.enableDrop)&&!this.dropZone){this.dropZone=new Ext.tree.TreeDropZone(this,this.dropConfig||{ddGroup:this.ddGroup||\"TreeDD\",appendOnly:this.ddAppendOnly===true})}if((this.enableDD||this.enableDrag)&&!this.dragZone){this.dragZone=new Ext.tree.TreeDragZone(this,this.dragConfig||{ddGroup:this.ddGroup||\"TreeDD\",scroll:this.ddScroll})}this.getSelectionModel().init(this)},afterRender:function(){Ext.tree.TreePanel.superclass.afterRender.call(this);this.renderRoot()},beforeDestroy:function(){if(this.rendered){Ext.dd.ScrollManager.unregister(this.body);Ext.destroy(this.dropZone,this.dragZone)}this.destroyRoot();Ext.destroy(this.loader);this.nodeHash=this.root=this.loader=null;Ext.tree.TreePanel.superclass.beforeDestroy.call(this)},destroyRoot:function(){if(this.root&&this.root.destroy){this.root.destroy(true)}}});Ext.tree.TreePanel.nodeTypes={};Ext.reg(\"treepanel\",Ext.tree.TreePanel);Ext.tree.TreeEventModel=function(a){this.tree=a;this.tree.on(\"render\",this.initEvents,this)};Ext.tree.TreeEventModel.prototype={initEvents:function(){var a=this.tree;if(a.trackMouseOver!==false){a.mon(a.innerCt,{scope:this,mouseover:this.delegateOver,mouseout:this.delegateOut})}a.mon(a.getTreeEl(),{scope:this,click:this.delegateClick,dblclick:this.delegateDblClick,contextmenu:this.delegateContextMenu})},getNode:function(b){var a;if(a=b.getTarget(\".x-tree-node-el\",10)){var c=Ext.fly(a,\"_treeEvents\").getAttribute(\"tree-node-id\",\"ext\");if(c){return this.tree.getNodeById(c)}}return null},getNodeTarget:function(b){var a=b.getTarget(\".x-tree-node-icon\",1);if(!a){a=b.getTarget(\".x-tree-node-el\",6)}return a},delegateOut:function(b,a){if(!this.beforeEvent(b)){return}if(b.getTarget(\".x-tree-ec-icon\",1)){var c=this.getNode(b);this.onIconOut(b,c);if(c==this.lastEcOver){delete this.lastEcOver}}if((a=this.getNodeTarget(b))&&!b.within(a,true)){this.onNodeOut(b,this.getNode(b))}},delegateOver:function(b,a){if(!this.beforeEvent(b)){return}if(Ext.isGecko&&!this.trackingDoc){Ext.getBody().on(\"mouseover\",this.trackExit,this);this.trackingDoc=true}if(this.lastEcOver){this.onIconOut(b,this.lastEcOver);delete this.lastEcOver}if(b.getTarget(\".x-tree-ec-icon\",1)){this.lastEcOver=this.getNode(b);this.onIconOver(b,this.lastEcOver)}if(a=this.getNodeTarget(b)){this.onNodeOver(b,this.getNode(b))}},trackExit:function(a){if(this.lastOverNode){if(this.lastOverNode.ui&&!a.within(this.lastOverNode.ui.getEl())){this.onNodeOut(a,this.lastOverNode)}delete this.lastOverNode;Ext.getBody().un(\"mouseover\",this.trackExit,this);this.trackingDoc=false}},delegateClick:function(b,a){if(this.beforeEvent(b)){if(b.getTarget(\"input[type=checkbox]\",1)){this.onCheckboxClick(b,this.getNode(b))}else{if(b.getTarget(\".x-tree-ec-icon\",1)){this.onIconClick(b,this.getNode(b))}else{if(this.getNodeTarget(b)){this.onNodeClick(b,this.getNode(b))}}}}else{this.checkContainerEvent(b,\"click\")}},delegateDblClick:function(b,a){if(this.beforeEvent(b)){if(this.getNodeTarget(b)){this.onNodeDblClick(b,this.getNode(b))}}else{this.checkContainerEvent(b,\"dblclick\")}},delegateContextMenu:function(b,a){if(this.beforeEvent(b)){if(this.getNodeTarget(b)){this.onNodeContextMenu(b,this.getNode(b))}}else{this.checkContainerEvent(b,\"contextmenu\")}},checkContainerEvent:function(b,a){if(this.disabled){b.stopEvent();return false}this.onContainerEvent(b,a)},onContainerEvent:function(b,a){this.tree.fireEvent(\"container\"+a,this.tree,b)},onNodeClick:function(b,a){a.ui.onClick(b)},onNodeOver:function(b,a){this.lastOverNode=a;a.ui.onOver(b)},onNodeOut:function(b,a){a.ui.onOut(b)},onIconOver:function(b,a){a.ui.addClass(\"x-tree-ec-over\")},onIconOut:function(b,a){a.ui.removeClass(\"x-tree-ec-over\")},onIconClick:function(b,a){a.ui.ecClick(b)},onCheckboxClick:function(b,a){a.ui.onCheckChange(b)},onNodeDblClick:function(b,a){a.ui.onDblClick(b)},onNodeContextMenu:function(b,a){a.ui.onContextMenu(b)},beforeEvent:function(b){var a=this.getNode(b);if(this.disabled||!a||!a.ui){b.stopEvent();return false}return true},disable:function(){this.disabled=true},enable:function(){this.disabled=false}};Ext.tree.DefaultSelectionModel=Ext.extend(Ext.util.Observable,{constructor:function(a){this.selNode=null;this.addEvents(\"selectionchange\",\"beforeselect\");Ext.apply(this,a);Ext.tree.DefaultSelectionModel.superclass.constructor.call(this)},init:function(a){this.tree=a;a.mon(a.getTreeEl(),\"keydown\",this.onKeyDown,this);a.on(\"click\",this.onNodeClick,this)},onNodeClick:function(a,b){this.select(a)},select:function(c,a){if(!Ext.fly(c.ui.wrap).isVisible()&&a){return a.call(this,c)}var b=this.selNode;if(c==b){c.ui.onSelectedChange(true)}else{if(this.fireEvent(\"beforeselect\",this,c,b)!==false){if(b&&b.ui){b.ui.onSelectedChange(false)}this.selNode=c;c.ui.onSelectedChange(true);this.fireEvent(\"selectionchange\",this,c,b)}}return c},unselect:function(b,a){if(this.selNode==b){this.clearSelections(a)}},clearSelections:function(a){var b=this.selNode;if(b){b.ui.onSelectedChange(false);this.selNode=null;if(a!==true){this.fireEvent(\"selectionchange\",this,null)}}return b},getSelectedNode:function(){return this.selNode},isSelected:function(a){return this.selNode==a},selectPrevious:function(a){if(!(a=a||this.selNode||this.lastSelNode)){return null}var c=a.previousSibling;if(c){if(!c.isExpanded()||c.childNodes.length<1){return this.select(c,this.selectPrevious)}else{var b=c.lastChild;while(b&&b.isExpanded()&&Ext.fly(b.ui.wrap).isVisible()&&b.childNodes.length>0){b=b.lastChild}return this.select(b,this.selectPrevious)}}else{if(a.parentNode&&(this.tree.rootVisible||!a.parentNode.isRoot)){return this.select(a.parentNode,this.selectPrevious)}}return null},selectNext:function(b){if(!(b=b||this.selNode||this.lastSelNode)){return null}if(b.firstChild&&b.isExpanded()&&Ext.fly(b.ui.wrap).isVisible()){return this.select(b.firstChild,this.selectNext)}else{if(b.nextSibling){return this.select(b.nextSibling,this.selectNext)}else{if(b.parentNode){var a=null;b.parentNode.bubble(function(){if(this.nextSibling){a=this.getOwnerTree().selModel.select(this.nextSibling,this.selectNext);return false}});return a}}}return null},onKeyDown:function(c){var b=this.selNode||this.lastSelNode;var d=this;if(!b){return}var a=c.getKey();switch(a){case c.DOWN:c.stopEvent();this.selectNext();break;case c.UP:c.stopEvent();this.selectPrevious();break;case c.RIGHT:c.preventDefault();if(b.hasChildNodes()){if(!b.isExpanded()){b.expand()}else{if(b.firstChild){this.select(b.firstChild,c)}}}break;case c.LEFT:c.preventDefault();if(b.hasChildNodes()&&b.isExpanded()){b.collapse()}else{if(b.parentNode&&(this.tree.rootVisible||b.parentNode!=this.tree.getRootNode())){this.select(b.parentNode,c)}}break}}});Ext.tree.MultiSelectionModel=Ext.extend(Ext.util.Observable,{constructor:function(a){this.selNodes=[];this.selMap={};this.addEvents(\"selectionchange\");Ext.apply(this,a);Ext.tree.MultiSelectionModel.superclass.constructor.call(this)},init:function(a){this.tree=a;a.mon(a.getTreeEl(),\"keydown\",this.onKeyDown,this);a.on(\"click\",this.onNodeClick,this)},onNodeClick:function(a,b){if(b.ctrlKey&&this.isSelected(a)){this.unselect(a)}else{this.select(a,b,b.ctrlKey)}},select:function(a,c,b){if(b!==true){this.clearSelections(true)}if(this.isSelected(a)){this.lastSelNode=a;return a}this.selNodes.push(a);this.selMap[a.id]=a;this.lastSelNode=a;a.ui.onSelectedChange(true);this.fireEvent(\"selectionchange\",this,this.selNodes);return a},unselect:function(b){if(this.selMap[b.id]){b.ui.onSelectedChange(false);var c=this.selNodes;var a=c.indexOf(b);if(a!=-1){this.selNodes.splice(a,1)}delete this.selMap[b.id];this.fireEvent(\"selectionchange\",this,this.selNodes)}},clearSelections:function(b){var d=this.selNodes;if(d.length>0){for(var c=0,a=d.length;c<a;c++){d[c].ui.onSelectedChange(false)}this.selNodes=[];this.selMap={};if(b!==true){this.fireEvent(\"selectionchange\",this,this.selNodes)}}},isSelected:function(a){return this.selMap[a.id]?true:false},getSelectedNodes:function(){return this.selNodes.concat([])},onKeyDown:Ext.tree.DefaultSelectionModel.prototype.onKeyDown,selectNext:Ext.tree.DefaultSelectionModel.prototype.selectNext,selectPrevious:Ext.tree.DefaultSelectionModel.prototype.selectPrevious});Ext.data.Tree=Ext.extend(Ext.util.Observable,{constructor:function(a){this.nodeHash={};this.root=null;if(a){this.setRootNode(a)}this.addEvents(\"append\",\"remove\",\"move\",\"insert\",\"beforeappend\",\"beforeremove\",\"beforemove\",\"beforeinsert\");Ext.data.Tree.superclass.constructor.call(this)},pathSeparator:\"/\",proxyNodeEvent:function(){return this.fireEvent.apply(this,arguments)},getRootNode:function(){return this.root},setRootNode:function(a){this.root=a;a.ownerTree=this;a.isRoot=true;this.registerNode(a);return a},getNodeById:function(a){return this.nodeHash[a]},registerNode:function(a){this.nodeHash[a.id]=a},unregisterNode:function(a){delete this.nodeHash[a.id]},toString:function(){return\"[Tree\"+(this.id?\" \"+this.id:\"\")+\"]\"}});Ext.data.Node=Ext.extend(Ext.util.Observable,{constructor:function(a){this.attributes=a||{};this.leaf=this.attributes.leaf;this.id=this.attributes.id;if(!this.id){this.id=Ext.id(null,\"xnode-\");this.attributes.id=this.id}this.childNodes=[];this.parentNode=null;this.firstChild=null;this.lastChild=null;this.previousSibling=null;this.nextSibling=null;this.addEvents({append:true,remove:true,move:true,insert:true,beforeappend:true,beforeremove:true,beforemove:true,beforeinsert:true});this.listeners=this.attributes.listeners;Ext.data.Node.superclass.constructor.call(this)},fireEvent:function(b){if(Ext.data.Node.superclass.fireEvent.apply(this,arguments)===false){return false}var a=this.getOwnerTree();if(a){if(a.proxyNodeEvent.apply(a,arguments)===false){return false}}return true},isLeaf:function(){return this.leaf===true},setFirstChild:function(a){this.firstChild=a},setLastChild:function(a){this.lastChild=a},isLast:function(){return(!this.parentNode?true:this.parentNode.lastChild==this)},isFirst:function(){return(!this.parentNode?true:this.parentNode.firstChild==this)},hasChildNodes:function(){return !this.isLeaf()&&this.childNodes.length>0},isExpandable:function(){return this.attributes.expandable||this.hasChildNodes()},appendChild:function(e){var g=false;if(Ext.isArray(e)){g=e}else{if(arguments.length>1){g=arguments}}if(g){for(var d=0,a=g.length;d<a;d++){this.appendChild(g[d])}}else{if(this.fireEvent(\"beforeappend\",this.ownerTree,this,e)===false){return false}var b=this.childNodes.length;var c=e.parentNode;if(c){if(e.fireEvent(\"beforemove\",e.getOwnerTree(),e,c,this,b)===false){return false}c.removeChild(e)}b=this.childNodes.length;if(b===0){this.setFirstChild(e)}this.childNodes.push(e);e.parentNode=this;var h=this.childNodes[b-1];if(h){e.previousSibling=h;h.nextSibling=e}else{e.previousSibling=null}e.nextSibling=null;this.setLastChild(e);e.setOwnerTree(this.getOwnerTree());this.fireEvent(\"append\",this.ownerTree,this,e,b);if(c){e.fireEvent(\"move\",this.ownerTree,e,c,this,b)}return e}},removeChild:function(c,b){var a=this.childNodes.indexOf(c);if(a==-1){return false}if(this.fireEvent(\"beforeremove\",this.ownerTree,this,c)===false){return false}this.childNodes.splice(a,1);if(c.previousSibling){c.previousSibling.nextSibling=c.nextSibling}if(c.nextSibling){c.nextSibling.previousSibling=c.previousSibling}if(this.firstChild==c){this.setFirstChild(c.nextSibling)}if(this.lastChild==c){this.setLastChild(c.previousSibling)}this.fireEvent(\"remove\",this.ownerTree,this,c);if(b){c.destroy(true)}else{c.clear()}return c},clear:function(a){this.setOwnerTree(null,a);this.parentNode=this.previousSibling=this.nextSibling=null;if(a){this.firstChild=this.lastChild=null}},destroy:function(a){if(a===true){this.purgeListeners();this.clear(true);Ext.each(this.childNodes,function(b){b.destroy(true)});this.childNodes=null}else{this.remove(true)}},insertBefore:function(d,a){if(!a){return this.appendChild(d)}if(d==a){return false}if(this.fireEvent(\"beforeinsert\",this.ownerTree,this,d,a)===false){return false}var b=this.childNodes.indexOf(a);var c=d.parentNode;var e=b;if(c==this&&this.childNodes.indexOf(d)<b){e--}if(c){if(d.fireEvent(\"beforemove\",d.getOwnerTree(),d,c,this,b,a)===false){return false}c.removeChild(d)}if(e===0){this.setFirstChild(d)}this.childNodes.splice(e,0,d);d.parentNode=this;var g=this.childNodes[e-1];if(g){d.previousSibling=g;g.nextSibling=d}else{d.previousSibling=null}d.nextSibling=a;a.previousSibling=d;d.setOwnerTree(this.getOwnerTree());this.fireEvent(\"insert\",this.ownerTree,this,d,a);if(c){d.fireEvent(\"move\",this.ownerTree,d,c,this,e,a)}return d},remove:function(a){if(this.parentNode){this.parentNode.removeChild(this,a)}return this},removeAll:function(a){var c=this.childNodes,b;while((b=c[0])){this.removeChild(b,a)}return this},item:function(a){return this.childNodes[a]},replaceChild:function(a,c){var b=c?c.nextSibling:null;this.removeChild(c);this.insertBefore(a,b);return c},indexOf:function(a){return this.childNodes.indexOf(a)},getOwnerTree:function(){if(!this.ownerTree){var a=this;while(a){if(a.ownerTree){this.ownerTree=a.ownerTree;break}a=a.parentNode}}return this.ownerTree},getDepth:function(){var b=0;var a=this;while(a.parentNode){++b;a=a.parentNode}return b},setOwnerTree:function(a,b){if(a!=this.ownerTree){if(this.ownerTree){this.ownerTree.unregisterNode(this)}this.ownerTree=a;if(b!==true){Ext.each(this.childNodes,function(c){c.setOwnerTree(a)})}if(a){a.registerNode(this)}}},setId:function(b){if(b!==this.id){var a=this.ownerTree;if(a){a.unregisterNode(this)}this.id=this.attributes.id=b;if(a){a.registerNode(this)}this.onIdChange(b)}},onIdChange:Ext.emptyFn,getPath:function(c){c=c||\"id\";var e=this.parentNode;var a=[this.attributes[c]];while(e){a.unshift(e.attributes[c]);e=e.parentNode}var d=this.getOwnerTree().pathSeparator;return d+a.join(d)},bubble:function(c,b,a){var d=this;while(d){if(c.apply(b||d,a||[d])===false){break}d=d.parentNode}},cascade:function(g,e,b){if(g.apply(e||this,b||[this])!==false){var d=this.childNodes;for(var c=0,a=d.length;c<a;c++){d[c].cascade(g,e,b)}}},eachChild:function(g,e,b){var d=this.childNodes;for(var c=0,a=d.length;c<a;c++){if(g.apply(e||d[c],b||[d[c]])===false){break}}},findChild:function(b,c,a){return this.findChildBy(function(){return this.attributes[b]==c},null,a)},findChildBy:function(h,g,b){var e=this.childNodes,a=e.length,d=0,j,c;for(;d<a;d++){j=e[d];if(h.call(g||j,j)===true){return j}else{if(b){c=j.findChildBy(h,g,b);if(c!=null){return c}}}}return null},sort:function(e,d){var c=this.childNodes;var a=c.length;if(a>0){var g=d?function(){e.apply(d,arguments)}:e;c.sort(g);for(var b=0;b<a;b++){var h=c[b];h.previousSibling=c[b-1];h.nextSibling=c[b+1];if(b===0){this.setFirstChild(h)}if(b==a-1){this.setLastChild(h)}}}},contains:function(a){return a.isAncestor(this)},isAncestor:function(a){var b=this.parentNode;while(b){if(b==a){return true}b=b.parentNode}return false},toString:function(){return\"[Node\"+(this.id?\" \"+this.id:\"\")+\"]\"}});Ext.tree.TreeNode=Ext.extend(Ext.data.Node,{constructor:function(a){a=a||{};if(Ext.isString(a)){a={text:a}}this.childrenRendered=false;this.rendered=false;Ext.tree.TreeNode.superclass.constructor.call(this,a);this.expanded=a.expanded===true;this.isTarget=a.isTarget!==false;this.draggable=a.draggable!==false&&a.allowDrag!==false;this.allowChildren=a.allowChildren!==false&&a.allowDrop!==false;this.text=a.text;this.disabled=a.disabled===true;this.hidden=a.hidden===true;this.addEvents(\"textchange\",\"beforeexpand\",\"beforecollapse\",\"expand\",\"disabledchange\",\"collapse\",\"beforeclick\",\"click\",\"checkchange\",\"beforedblclick\",\"dblclick\",\"contextmenu\",\"beforechildrenrendered\");var b=this.attributes.uiProvider||this.defaultUI||Ext.tree.TreeNodeUI;this.ui=new b(this)},preventHScroll:true,isExpanded:function(){return this.expanded},getUI:function(){return this.ui},getLoader:function(){var a;return this.loader||((a=this.getOwnerTree())&&a.loader?a.loader:(this.loader=new Ext.tree.TreeLoader()))},setFirstChild:function(a){var b=this.firstChild;Ext.tree.TreeNode.superclass.setFirstChild.call(this,a);if(this.childrenRendered&&b&&a!=b){b.renderIndent(true,true)}if(this.rendered){this.renderIndent(true,true)}},setLastChild:function(b){var a=this.lastChild;Ext.tree.TreeNode.superclass.setLastChild.call(this,b);if(this.childrenRendered&&a&&b!=a){a.renderIndent(true,true)}if(this.rendered){this.renderIndent(true,true)}},appendChild:function(b){if(!b.render&&!Ext.isArray(b)){b=this.getLoader().createNode(b)}var a=Ext.tree.TreeNode.superclass.appendChild.call(this,b);if(a&&this.childrenRendered){a.render()}this.ui.updateExpandIcon();return a},removeChild:function(b,a){this.ownerTree.getSelectionModel().unselect(b);Ext.tree.TreeNode.superclass.removeChild.apply(this,arguments);if(!a){var c=b.ui.rendered;if(c){b.ui.remove()}if(c&&this.childNodes.length<1){this.collapse(false,false)}else{this.ui.updateExpandIcon()}if(!this.firstChild&&!this.isHiddenRoot()){this.childrenRendered=false}}return b},insertBefore:function(c,a){if(!c.render){c=this.getLoader().createNode(c)}var b=Ext.tree.TreeNode.superclass.insertBefore.call(this,c,a);if(b&&a&&this.childrenRendered){c.render()}this.ui.updateExpandIcon();return b},setText:function(b){var a=this.text;this.text=this.attributes.text=b;if(this.rendered){this.ui.onTextChange(this,b,a)}this.fireEvent(\"textchange\",this,b,a)},setIconCls:function(b){var a=this.attributes.iconCls;this.attributes.iconCls=b;if(this.rendered){this.ui.onIconClsChange(this,b,a)}},setTooltip:function(a,b){this.attributes.qtip=a;this.attributes.qtipTitle=b;if(this.rendered){this.ui.onTipChange(this,a,b)}},setIcon:function(a){this.attributes.icon=a;if(this.rendered){this.ui.onIconChange(this,a)}},setHref:function(a,b){this.attributes.href=a;this.attributes.hrefTarget=b;if(this.rendered){this.ui.onHrefChange(this,a,b)}},setCls:function(b){var a=this.attributes.cls;this.attributes.cls=b;if(this.rendered){this.ui.onClsChange(this,b,a)}},select:function(){var a=this.getOwnerTree();if(a){a.getSelectionModel().select(this)}},unselect:function(a){var b=this.getOwnerTree();if(b){b.getSelectionModel().unselect(this,a)}},isSelected:function(){var a=this.getOwnerTree();return a?a.getSelectionModel().isSelected(this):false},expand:function(a,c,d,b){if(!this.expanded){if(this.fireEvent(\"beforeexpand\",this,a,c)===false){return}if(!this.childrenRendered){this.renderChildren()}this.expanded=true;if(!this.isHiddenRoot()&&(this.getOwnerTree().animate&&c!==false)||c){this.ui.animExpand(function(){this.fireEvent(\"expand\",this);this.runCallback(d,b||this,[this]);if(a===true){this.expandChildNodes(true,true)}}.createDelegate(this));return}else{this.ui.expand();this.fireEvent(\"expand\",this);this.runCallback(d,b||this,[this])}}else{this.runCallback(d,b||this,[this])}if(a===true){this.expandChildNodes(true)}},runCallback:function(a,c,b){if(Ext.isFunction(a)){a.apply(c,b)}},isHiddenRoot:function(){return this.isRoot&&!this.getOwnerTree().rootVisible},collapse:function(b,g,h,e){if(this.expanded&&!this.isHiddenRoot()){if(this.fireEvent(\"beforecollapse\",this,b,g)===false){return}this.expanded=false;if((this.getOwnerTree().animate&&g!==false)||g){this.ui.animCollapse(function(){this.fireEvent(\"collapse\",this);this.runCallback(h,e||this,[this]);if(b===true){this.collapseChildNodes(true)}}.createDelegate(this));return}else{this.ui.collapse();this.fireEvent(\"collapse\",this);this.runCallback(h,e||this,[this])}}else{if(!this.expanded){this.runCallback(h,e||this,[this])}}if(b===true){var d=this.childNodes;for(var c=0,a=d.length;c<a;c++){d[c].collapse(true,false)}}},delayedExpand:function(a){if(!this.expandProcId){this.expandProcId=this.expand.defer(a,this)}},cancelExpand:function(){if(this.expandProcId){clearTimeout(this.expandProcId)}this.expandProcId=false},toggle:function(){if(this.expanded){this.collapse()}else{this.expand()}},ensureVisible:function(c,b){var a=this.getOwnerTree();a.expandPath(this.parentNode?this.parentNode.getPath():this.getPath(),false,function(){var d=a.getNodeById(this.id);a.getTreeEl().scrollChildIntoView(d.ui.anchor);this.runCallback(c,b||this,[this])}.createDelegate(this))},expandChildNodes:function(b,e){var d=this.childNodes,c,a=d.length;for(c=0;c<a;c++){d[c].expand(b,e)}},collapseChildNodes:function(b){var d=this.childNodes;for(var c=0,a=d.length;c<a;c++){d[c].collapse(b)}},disable:function(){this.disabled=true;this.unselect();if(this.rendered&&this.ui.onDisableChange){this.ui.onDisableChange(this,true)}this.fireEvent(\"disabledchange\",this,true)},enable:function(){this.disabled=false;if(this.rendered&&this.ui.onDisableChange){this.ui.onDisableChange(this,false)}this.fireEvent(\"disabledchange\",this,false)},renderChildren:function(b){if(b!==false){this.fireEvent(\"beforechildrenrendered\",this)}var d=this.childNodes;for(var c=0,a=d.length;c<a;c++){d[c].render(true)}this.childrenRendered=true},sort:function(e,d){Ext.tree.TreeNode.superclass.sort.apply(this,arguments);if(this.childrenRendered){var c=this.childNodes;for(var b=0,a=c.length;b<a;b++){c[b].render(true)}}},render:function(a){this.ui.render(a);if(!this.rendered){this.getOwnerTree().registerNode(this);this.rendered=true;if(this.expanded){this.expanded=false;this.expand(false,false)}}},renderIndent:function(b,e){if(e){this.ui.childIndent=null}this.ui.renderIndent();if(b===true&&this.childrenRendered){var d=this.childNodes;for(var c=0,a=d.length;c<a;c++){d[c].renderIndent(true,e)}}},beginUpdate:function(){this.childrenRendered=false},endUpdate:function(){if(this.expanded&&this.rendered){this.renderChildren()}},destroy:function(a){if(a===true){this.unselect(true)}Ext.tree.TreeNode.superclass.destroy.call(this,a);Ext.destroy(this.ui,this.loader);this.ui=this.loader=null},onIdChange:function(a){this.ui.onIdChange(a)}});Ext.tree.TreePanel.nodeTypes.node=Ext.tree.TreeNode;Ext.tree.AsyncTreeNode=function(a){this.loaded=a&&a.loaded===true;this.loading=false;Ext.tree.AsyncTreeNode.superclass.constructor.apply(this,arguments);this.addEvents(\"beforeload\",\"load\")};Ext.extend(Ext.tree.AsyncTreeNode,Ext.tree.TreeNode,{expand:function(b,e,h,c){if(this.loading){var g;var d=function(){if(!this.loading){clearInterval(g);this.expand(b,e,h,c)}}.createDelegate(this);g=setInterval(d,200);return}if(!this.loaded){if(this.fireEvent(\"beforeload\",this)===false){return}this.loading=true;this.ui.beforeLoad(this);var a=this.loader||this.attributes.loader||this.getOwnerTree().getLoader();if(a){a.load(this,this.loadComplete.createDelegate(this,[b,e,h,c]),this);return}}Ext.tree.AsyncTreeNode.superclass.expand.call(this,b,e,h,c)},isLoading:function(){return this.loading},loadComplete:function(a,c,d,b){this.loading=false;this.loaded=true;this.ui.afterLoad(this);this.fireEvent(\"load\",this);this.expand(a,c,d,b)},isLoaded:function(){return this.loaded},hasChildNodes:function(){if(!this.isLeaf()&&!this.loaded){return true}else{return Ext.tree.AsyncTreeNode.superclass.hasChildNodes.call(this)}},reload:function(b,a){this.collapse(false,false);while(this.firstChild){this.removeChild(this.firstChild).destroy()}this.childrenRendered=false;this.loaded=false;if(this.isHiddenRoot()){this.expanded=false}this.expand(false,false,b,a)}});Ext.tree.TreePanel.nodeTypes.async=Ext.tree.AsyncTreeNode;Ext.tree.TreeNodeUI=Ext.extend(Object,{constructor:function(a){Ext.apply(this,{node:a,rendered:false,animating:false,wasLeaf:true,ecc:\"x-tree-ec-icon x-tree-elbow\",emptyIcon:Ext.BLANK_IMAGE_URL})},removeChild:function(a){if(this.rendered){this.ctNode.removeChild(a.ui.getEl())}},beforeLoad:function(){this.addClass(\"x-tree-node-loading\")},afterLoad:function(){this.removeClass(\"x-tree-node-loading\")},onTextChange:function(b,c,a){if(this.rendered){this.textNode.innerHTML=c}},onIconClsChange:function(c,a,b){if(this.rendered){Ext.fly(this.iconNode).replaceClass(b,a)}},onIconChange:function(b,a){if(this.rendered){var c=Ext.isEmpty(a);this.iconNode.src=c?this.emptyIcon:a;Ext.fly(this.iconNode)[c?\"removeClass\":\"addClass\"](\"x-tree-node-inline-icon\")}},onTipChange:function(b,c,d){if(this.rendered){var a=Ext.isDefined(d);if(this.textNode.setAttributeNS){this.textNode.setAttributeNS(\"ext\",\"qtip\",c);if(a){this.textNode.setAttributeNS(\"ext\",\"qtitle\",d)}}else{this.textNode.setAttribute(\"ext:qtip\",c);if(a){this.textNode.setAttribute(\"ext:qtitle\",d)}}}},onHrefChange:function(b,a,c){if(this.rendered){this.anchor.href=this.getHref(a);if(Ext.isDefined(c)){this.anchor.target=c}}},onClsChange:function(c,a,b){if(this.rendered){Ext.fly(this.elNode).replaceClass(b,a)}},onDisableChange:function(a,b){this.disabled=b;if(this.checkbox){this.checkbox.disabled=b}this[b?\"addClass\":\"removeClass\"](\"x-tree-node-disabled\")},onSelectedChange:function(a){if(a){this.focus();this.addClass(\"x-tree-selected\")}else{this.removeClass(\"x-tree-selected\")}},onMove:function(a,h,e,g,d,b){this.childIndent=null;if(this.rendered){var i=g.ui.getContainer();if(!i){this.holder=document.createElement(\"div\");this.holder.appendChild(this.wrap);return}var c=b?b.ui.getEl():null;if(c){i.insertBefore(this.wrap,c)}else{i.appendChild(this.wrap)}this.node.renderIndent(true,e!=g)}},addClass:function(a){if(this.elNode){Ext.fly(this.elNode).addClass(a)}},removeClass:function(a){if(this.elNode){Ext.fly(this.elNode).removeClass(a)}},remove:function(){if(this.rendered){this.holder=document.createElement(\"div\");this.holder.appendChild(this.wrap)}},fireEvent:function(){return this.node.fireEvent.apply(this.node,arguments)},initEvents:function(){this.node.on(\"move\",this.onMove,this);if(this.node.disabled){this.onDisableChange(this.node,true)}if(this.node.hidden){this.hide()}var b=this.node.getOwnerTree();var a=b.enableDD||b.enableDrag||b.enableDrop;if(a&&(!this.node.isRoot||b.rootVisible)){Ext.dd.Registry.register(this.elNode,{node:this.node,handles:this.getDDHandles(),isHandle:false})}},getDDHandles:function(){return[this.iconNode,this.textNode,this.elNode]},hide:function(){this.node.hidden=true;if(this.wrap){this.wrap.style.display=\"none\"}},show:function(){this.node.hidden=false;if(this.wrap){this.wrap.style.display=\"\"}},onContextMenu:function(a){if(this.node.hasListener(\"contextmenu\")||this.node.getOwnerTree().hasListener(\"contextmenu\")){a.preventDefault();this.focus();this.fireEvent(\"contextmenu\",this.node,a)}},onClick:function(c){if(this.dropping){c.stopEvent();return}if(this.fireEvent(\"beforeclick\",this.node,c)!==false){var b=c.getTarget(\"a\");if(!this.disabled&&this.node.attributes.href&&b){this.fireEvent(\"click\",this.node,c);return}else{if(b&&c.ctrlKey){c.stopEvent()}}c.preventDefault();if(this.disabled){return}if(this.node.attributes.singleClickExpand&&!this.animating&&this.node.isExpandable()){this.node.toggle()}this.fireEvent(\"click\",this.node,c)}else{c.stopEvent()}},onDblClick:function(a){a.preventDefault();if(this.disabled){return}if(this.fireEvent(\"beforedblclick\",this.node,a)!==false){if(this.checkbox){this.toggleCheck()}if(!this.animating&&this.node.isExpandable()){this.node.toggle()}this.fireEvent(\"dblclick\",this.node,a)}},onOver:function(a){this.addClass(\"x-tree-node-over\")},onOut:function(a){this.removeClass(\"x-tree-node-over\")},onCheckChange:function(){var a=this.checkbox.checked;this.checkbox.defaultChecked=a;this.node.attributes.checked=a;this.fireEvent(\"checkchange\",this.node,a)},ecClick:function(a){if(!this.animating&&this.node.isExpandable()){this.node.toggle()}},startDrop:function(){this.dropping=true},endDrop:function(){setTimeout(function(){this.dropping=false}.createDelegate(this),50)},expand:function(){this.updateExpandIcon();this.ctNode.style.display=\"\"},focus:function(){if(!this.node.preventHScroll){try{this.anchor.focus()}catch(c){}}else{try{var b=this.node.getOwnerTree().getTreeEl().dom;var a=b.scrollLeft;this.anchor.focus();b.scrollLeft=a}catch(c){}}},toggleCheck:function(b){var a=this.checkbox;if(a){a.checked=(b===undefined?!a.checked:b);this.onCheckChange()}},blur:function(){try{this.anchor.blur()}catch(a){}},animExpand:function(b){var a=Ext.get(this.ctNode);a.stopFx();if(!this.node.isExpandable()){this.updateExpandIcon();this.ctNode.style.display=\"\";Ext.callback(b);return}this.animating=true;this.updateExpandIcon();a.slideIn(\"t\",{callback:function(){this.animating=false;Ext.callback(b)},scope:this,duration:this.node.ownerTree.duration||0.25})},highlight:function(){var a=this.node.getOwnerTree();Ext.fly(this.wrap).highlight(a.hlColor||\"C3DAF9\",{endColor:a.hlBaseColor})},collapse:function(){this.updateExpandIcon();this.ctNode.style.display=\"none\"},animCollapse:function(b){var a=Ext.get(this.ctNode);a.enableDisplayMode(\"block\");a.stopFx();this.animating=true;this.updateExpandIcon();a.slideOut(\"t\",{callback:function(){this.animating=false;Ext.callback(b)},scope:this,duration:this.node.ownerTree.duration||0.25})},getContainer:function(){return this.ctNode},getEl:function(){return this.wrap},appendDDGhost:function(a){a.appendChild(this.elNode.cloneNode(true))},getDDRepairXY:function(){return Ext.lib.Dom.getXY(this.iconNode)},onRender:function(){this.render()},render:function(c){var e=this.node,b=e.attributes;var d=e.parentNode?e.parentNode.ui.getContainer():e.ownerTree.innerCt.dom;if(!this.rendered){this.rendered=true;this.renderElements(e,b,d,c);if(b.qtip){this.onTipChange(e,b.qtip,b.qtipTitle)}else{if(b.qtipCfg){b.qtipCfg.target=Ext.id(this.textNode);Ext.QuickTips.register(b.qtipCfg)}}this.initEvents();if(!this.node.expanded){this.updateExpandIcon(true)}}else{if(c===true){d.appendChild(this.wrap)}}},renderElements:function(e,k,j,l){this.indentMarkup=e.parentNode?e.parentNode.ui.getChildIndent():\"\";var g=Ext.isBoolean(k.checked),b,c=this.getHref(k.href),d=['<li class=\"x-tree-node\"><div ext:tree-node-id=\"',e.id,'\" class=\"x-tree-node-el x-tree-node-leaf x-unselectable ',k.cls,'\" unselectable=\"on\">','<span class=\"x-tree-node-indent\">',this.indentMarkup,\"</span>\",'<img alt=\"\" src=\"',this.emptyIcon,'\" class=\"x-tree-ec-icon x-tree-elbow\" />','<img alt=\"\" src=\"',k.icon||this.emptyIcon,'\" class=\"x-tree-node-icon',(k.icon?\" x-tree-node-inline-icon\":\"\"),(k.iconCls?\" \"+k.iconCls:\"\"),'\" unselectable=\"on\" />',g?('<input class=\"x-tree-node-cb\" type=\"checkbox\" '+(k.checked?'checked=\"checked\" />':\"/>\")):\"\",'<a hidefocus=\"on\" class=\"x-tree-node-anchor\" href=\"',c,'\" tabIndex=\"1\" ',k.hrefTarget?' target=\"'+k.hrefTarget+'\"':\"\",'><span unselectable=\"on\">',e.text,\"</span></a></div>\",'<ul class=\"x-tree-node-ct\" style=\"display:none;\"></ul>',\"</li>\"].join(\"\");if(l!==true&&e.nextSibling&&(b=e.nextSibling.ui.getEl())){this.wrap=Ext.DomHelper.insertHtml(\"beforeBegin\",b,d)}else{this.wrap=Ext.DomHelper.insertHtml(\"beforeEnd\",j,d)}this.elNode=this.wrap.childNodes[0];this.ctNode=this.wrap.childNodes[1];var i=this.elNode.childNodes;this.indentNode=i[0];this.ecNode=i[1];this.iconNode=i[2];var h=3;if(g){this.checkbox=i[3];this.checkbox.defaultChecked=this.checkbox.checked;h++}this.anchor=i[h];this.textNode=i[h].firstChild},getHref:function(a){return Ext.isEmpty(a)?(Ext.isGecko?\"\":\"#\"):a},getAnchor:function(){return this.anchor},getTextEl:function(){return this.textNode},getIconEl:function(){return this.iconNode},isChecked:function(){return this.checkbox?this.checkbox.checked:false},updateExpandIcon:function(){if(this.rendered){var g=this.node,d,c,a=g.isLast()?\"x-tree-elbow-end\":\"x-tree-elbow\",e=g.hasChildNodes();if(e||g.attributes.expandable){if(g.expanded){a+=\"-minus\";d=\"x-tree-node-collapsed\";c=\"x-tree-node-expanded\"}else{a+=\"-plus\";d=\"x-tree-node-expanded\";c=\"x-tree-node-collapsed\"}if(this.wasLeaf){this.removeClass(\"x-tree-node-leaf\");this.wasLeaf=false}if(this.c1!=d||this.c2!=c){Ext.fly(this.elNode).replaceClass(d,c);this.c1=d;this.c2=c}}else{if(!this.wasLeaf){Ext.fly(this.elNode).replaceClass(\"x-tree-node-expanded\",\"x-tree-node-collapsed\");delete this.c1;delete this.c2;this.wasLeaf=true}}var b=\"x-tree-ec-icon \"+a;if(this.ecc!=b){this.ecNode.className=b;this.ecc=b}}},onIdChange:function(a){if(this.rendered){this.elNode.setAttribute(\"ext:tree-node-id\",a)}},getChildIndent:function(){if(!this.childIndent){var a=[],b=this.node;while(b){if(!b.isRoot||(b.isRoot&&b.ownerTree.rootVisible)){if(!b.isLast()){a.unshift('<img alt=\"\" src=\"'+this.emptyIcon+'\" class=\"x-tree-elbow-line\" />')}else{a.unshift('<img alt=\"\" src=\"'+this.emptyIcon+'\" class=\"x-tree-icon\" />')}}b=b.parentNode}this.childIndent=a.join(\"\")}return this.childIndent},renderIndent:function(){if(this.rendered){var a=\"\",b=this.node.parentNode;if(b){a=b.ui.getChildIndent()}if(this.indentMarkup!=a){this.indentNode.innerHTML=a;this.indentMarkup=a}this.updateExpandIcon()}},destroy:function(){if(this.elNode){Ext.dd.Registry.unregister(this.elNode.id)}Ext.each([\"textnode\",\"anchor\",\"checkbox\",\"indentNode\",\"ecNode\",\"iconNode\",\"elNode\",\"ctNode\",\"wrap\",\"holder\"],function(a){if(this[a]){Ext.fly(this[a]).remove();delete this[a]}},this);delete this.node}});Ext.tree.RootTreeNodeUI=Ext.extend(Ext.tree.TreeNodeUI,{render:function(){if(!this.rendered){var a=this.node.ownerTree.innerCt.dom;this.node.expanded=true;a.innerHTML='<div class=\"x-tree-root-node\"></div>';this.wrap=this.ctNode=a.firstChild}},collapse:Ext.emptyFn,expand:Ext.emptyFn});Ext.tree.TreeLoader=function(a){this.baseParams={};Ext.apply(this,a);this.addEvents(\"beforeload\",\"load\",\"loadexception\");Ext.tree.TreeLoader.superclass.constructor.call(this);if(Ext.isString(this.paramOrder)){this.paramOrder=this.paramOrder.split(/[\\s,|]/)}};Ext.extend(Ext.tree.TreeLoader,Ext.util.Observable,{uiProviders:{},clearOnLoad:true,paramOrder:undefined,paramsAsHash:false,nodeParameter:\"node\",directFn:undefined,load:function(b,c,a){if(this.clearOnLoad){while(b.firstChild){b.removeChild(b.firstChild)}}if(this.doPreload(b)){this.runCallback(c,a||b,[b])}else{if(this.directFn||this.dataUrl||this.url){this.requestData(b,c,a||b)}}},doPreload:function(d){if(d.attributes.children){if(d.childNodes.length<1){var c=d.attributes.children;d.beginUpdate();for(var b=0,a=c.length;b<a;b++){var e=d.appendChild(this.createNode(c[b]));if(this.preloadChildren){this.doPreload(e)}}d.endUpdate()}return true}return false},getParams:function(g){var e=Ext.apply({},this.baseParams),h=this.nodeParameter,b=this.paramOrder;h&&(e[h]=g.id);if(this.directFn){var c=[g.id];if(b){if(h&&b.indexOf(h)>-1){c=[]}for(var d=0,a=b.length;d<a;d++){c.push(e[b[d]])}}else{if(this.paramsAsHash){c=[e]}}return c}else{return e}},requestData:function(c,d,b){if(this.fireEvent(\"beforeload\",this,c,d)!==false){if(this.directFn){var a=this.getParams(c);a.push(this.processDirectResponse.createDelegate(this,[{callback:d,node:c,scope:b}],true));this.directFn.apply(window,a)}else{this.transId=Ext.Ajax.request({method:this.requestMethod,url:this.dataUrl||this.url,success:this.handleResponse,failure:this.handleFailure,scope:this,argument:{callback:d,node:c,scope:b},params:this.getParams(c)})}}else{this.runCallback(d,b||c,[])}},processDirectResponse:function(a,b,c){if(b.status){this.handleResponse({responseData:Ext.isArray(a)?a:null,responseText:a,argument:c})}else{this.handleFailure({argument:c})}},runCallback:function(a,c,b){if(Ext.isFunction(a)){a.apply(c,b)}},isLoading:function(){return !!this.transId},abort:function(){if(this.isLoading()){Ext.Ajax.abort(this.transId)}},createNode:function(attr){if(this.baseAttrs){Ext.applyIf(attr,this.baseAttrs)}if(this.applyLoader!==false&&!attr.loader){attr.loader=this}if(Ext.isString(attr.uiProvider)){attr.uiProvider=this.uiProviders[attr.uiProvider]||eval(attr.uiProvider)}if(attr.nodeType){return new Ext.tree.TreePanel.nodeTypes[attr.nodeType](attr)}else{return attr.leaf?new Ext.tree.TreeNode(attr):new Ext.tree.AsyncTreeNode(attr)}},processResponse:function(d,c,k,l){var m=d.responseText;try{var a=d.responseData||Ext.decode(m);c.beginUpdate();for(var g=0,h=a.length;g<h;g++){var b=this.createNode(a[g]);if(b){c.appendChild(b)}}c.endUpdate();this.runCallback(k,l||c,[c])}catch(j){this.handleFailure(d)}},handleResponse:function(c){this.transId=false;var b=c.argument;this.processResponse(c,b.node,b.callback,b.scope);this.fireEvent(\"load\",this,b.node,c)},handleFailure:function(c){this.transId=false;var b=c.argument;this.fireEvent(\"loadexception\",this,b.node,c);this.runCallback(b.callback,b.scope||b.node,[b.node])},destroy:function(){this.abort();this.purgeListeners()}});Ext.tree.TreeFilter=function(a,b){this.tree=a;this.filtered={};Ext.apply(this,b)};Ext.tree.TreeFilter.prototype={clearBlank:false,reverse:false,autoClear:false,remove:false,filter:function(d,a,b){a=a||\"text\";var c;if(typeof d==\"string\"){var e=d.length;if(e==0&&this.clearBlank){this.clear();return}d=d.toLowerCase();c=function(g){return g.attributes[a].substr(0,e).toLowerCase()==d}}else{if(d.exec){c=function(g){return d.test(g.attributes[a])}}else{throw\"Illegal filter type, must be string or regex\"}}this.filterBy(c,null,b)},filterBy:function(d,c,b){b=b||this.tree.root;if(this.autoClear){this.clear()}var a=this.filtered,i=this.reverse;var e=function(k){if(k==b){return true}if(a[k.id]){return false}var j=d.call(c||k,k);if(!j||i){a[k.id]=k;k.ui.hide();return false}return true};b.cascade(e);if(this.remove){for(var h in a){if(typeof h!=\"function\"){var g=a[h];if(g&&g.parentNode){g.parentNode.removeChild(g)}}}}},clear:function(){var b=this.tree;var a=this.filtered;for(var d in a){if(typeof d!=\"function\"){var c=a[d];if(c){c.ui.show()}}}this.filtered={}}};Ext.tree.TreeSorter=Ext.extend(Object,{constructor:function(a,c){Ext.apply(this,c);a.on({scope:this,beforechildrenrendered:this.doSort,append:this.updateSort,insert:this.updateSort,textchange:this.updateSortParent});var e=this.dir&&this.dir.toLowerCase()==\"desc\",i=this.property||\"text\",d=this.sortType,h=this.folderSort,b=this.caseSensitive===true,g=this.leafAttr||\"leaf\";if(Ext.isString(d)){d=Ext.data.SortTypes[d]}this.sortFn=function(o,m){var k=o.attributes,j=m.attributes;if(h){if(k[g]&&!j[g]){return 1}if(!k[g]&&j[g]){return -1}}var n=k[i],l=j[i],q=d?d(n,o):(b?n:n.toUpperCase()),p=d?d(l,m):(b?l:l.toUpperCase());if(q<p){return e?1:-1}else{if(q>p){return e?-1:1}}return 0}},doSort:function(a){a.sort(this.sortFn)},updateSort:function(a,b){if(b.childrenRendered){this.doSort.defer(1,this,[b])}},updateSortParent:function(a){var b=a.parentNode;if(b&&b.childrenRendered){this.doSort.defer(1,this,[b])}}});if(Ext.dd.DropZone){Ext.tree.TreeDropZone=function(a,b){this.allowParentInsert=b.allowParentInsert||false;this.allowContainerDrop=b.allowContainerDrop||false;this.appendOnly=b.appendOnly||false;Ext.tree.TreeDropZone.superclass.constructor.call(this,a.getTreeEl(),b);this.tree=a;this.dragOverData={};this.lastInsertClass=\"x-tree-no-status\"};Ext.extend(Ext.tree.TreeDropZone,Ext.dd.DropZone,{ddGroup:\"TreeDD\",expandDelay:1000,expandNode:function(a){if(a.hasChildNodes()&&!a.isExpanded()){a.expand(false,null,this.triggerCacheRefresh.createDelegate(this))}},queueExpand:function(a){this.expandProcId=this.expandNode.defer(this.expandDelay,this,[a])},cancelExpand:function(){if(this.expandProcId){clearTimeout(this.expandProcId);this.expandProcId=false}},isValidDropPoint:function(a,k,i,d,c){if(!a||!c){return false}var g=a.node;var h=c.node;if(!(g&&g.isTarget&&k)){return false}if(k==\"append\"&&g.allowChildren===false){return false}if((k==\"above\"||k==\"below\")&&(g.parentNode&&g.parentNode.allowChildren===false)){return false}if(h&&(g==h||h.contains(g))){return false}var b=this.dragOverData;b.tree=this.tree;b.target=g;b.data=c;b.point=k;b.source=i;b.rawEvent=d;b.dropNode=h;b.cancel=false;var j=this.tree.fireEvent(\"nodedragover\",b);return b.cancel===false&&j!==false},getDropPoint:function(h,g,l){var m=g.node;if(m.isRoot){return m.allowChildren!==false?\"append\":false}var c=g.ddel;var o=Ext.lib.Dom.getY(c),j=o+c.offsetHeight;var i=Ext.lib.Event.getPageY(h);var k=m.allowChildren===false||m.isLeaf();if(this.appendOnly||m.parentNode.allowChildren===false){return k?false:\"append\"}var d=false;if(!this.allowParentInsert){d=m.hasChildNodes()&&m.isExpanded()}var a=(j-o)/(k?2:3);if(i>=o&&i<(o+a)){return\"above\"}else{if(!d&&(k||i>=j-a&&i<=j)){return\"below\"}else{return\"append\"}}},onNodeEnter:function(d,a,c,b){this.cancelExpand()},onContainerOver:function(a,c,b){if(this.allowContainerDrop&&this.isValidDropPoint({ddel:this.tree.getRootNode().ui.elNode,node:this.tree.getRootNode()},\"append\",a,c,b)){return this.dropAllowed}return this.dropNotAllowed},onNodeOver:function(b,i,h,g){var k=this.getDropPoint(h,b,i);var c=b.node;if(!this.expandProcId&&k==\"append\"&&c.hasChildNodes()&&!b.node.isExpanded()){this.queueExpand(c)}else{if(k!=\"append\"){this.cancelExpand()}}var d=this.dropNotAllowed;if(this.isValidDropPoint(b,k,i,h,g)){if(k){var a=b.ddel;var j;if(k==\"above\"){d=b.node.isFirst()?\"x-tree-drop-ok-above\":\"x-tree-drop-ok-between\";j=\"x-tree-drag-insert-above\"}else{if(k==\"below\"){d=b.node.isLast()?\"x-tree-drop-ok-below\":\"x-tree-drop-ok-between\";j=\"x-tree-drag-insert-below\"}else{d=\"x-tree-drop-ok-append\";j=\"x-tree-drag-append\"}}if(this.lastInsertClass!=j){Ext.fly(a).replaceClass(this.lastInsertClass,j);this.lastInsertClass=j}}}return d},onNodeOut:function(d,a,c,b){this.cancelExpand();this.removeDropIndicators(d)},onNodeDrop:function(i,b,h,d){var a=this.getDropPoint(h,i,b);var g=i.node;g.ui.startDrop();if(!this.isValidDropPoint(i,a,b,h,d)){g.ui.endDrop();return false}var c=d.node||(b.getTreeNode?b.getTreeNode(d,g,a,h):null);return this.processDrop(g,d,a,b,h,c)},onContainerDrop:function(a,g,c){if(this.allowContainerDrop&&this.isValidDropPoint({ddel:this.tree.getRootNode().ui.elNode,node:this.tree.getRootNode()},\"append\",a,g,c)){var d=this.tree.getRootNode();d.ui.startDrop();var b=c.node||(a.getTreeNode?a.getTreeNode(c,d,\"append\",g):null);return this.processDrop(d,c,\"append\",a,g,b)}return false},processDrop:function(j,h,b,a,i,d){var g={tree:this.tree,target:j,data:h,point:b,source:a,rawEvent:i,dropNode:d,cancel:!d,dropStatus:false};var c=this.tree.fireEvent(\"beforenodedrop\",g);if(c===false||g.cancel===true||!g.dropNode){j.ui.endDrop();return g.dropStatus}j=g.target;if(b==\"append\"&&!j.isExpanded()){j.expand(false,null,function(){this.completeDrop(g)}.createDelegate(this))}else{this.completeDrop(g)}return true},completeDrop:function(h){var d=h.dropNode,e=h.point,c=h.target;if(!Ext.isArray(d)){d=[d]}var g;for(var b=0,a=d.length;b<a;b++){g=d[b];if(e==\"above\"){c.parentNode.insertBefore(g,c)}else{if(e==\"below\"){c.parentNode.insertBefore(g,c.nextSibling)}else{c.appendChild(g)}}}g.ui.focus();if(Ext.enableFx&&this.tree.hlDrop){g.ui.highlight()}c.ui.endDrop();this.tree.fireEvent(\"nodedrop\",h)},afterNodeMoved:function(a,c,g,d,b){if(Ext.enableFx&&this.tree.hlDrop){b.ui.focus();b.ui.highlight()}this.tree.fireEvent(\"nodedrop\",this.tree,d,c,a,g)},getTree:function(){return this.tree},removeDropIndicators:function(b){if(b&&b.ddel){var a=b.ddel;Ext.fly(a).removeClass([\"x-tree-drag-insert-above\",\"x-tree-drag-insert-below\",\"x-tree-drag-append\"]);this.lastInsertClass=\"_noclass\"}},beforeDragDrop:function(b,a,c){this.cancelExpand();return true},afterRepair:function(a){if(a&&Ext.enableFx){a.node.ui.highlight()}this.hideProxy()}})}if(Ext.dd.DragZone){Ext.tree.TreeDragZone=function(a,b){Ext.tree.TreeDragZone.superclass.constructor.call(this,a.innerCt,b);this.tree=a};Ext.extend(Ext.tree.TreeDragZone,Ext.dd.DragZone,{ddGroup:\"TreeDD\",onBeforeDrag:function(a,b){var c=a.node;return c&&c.draggable&&!c.disabled},onInitDrag:function(b){var a=this.dragData;this.tree.getSelectionModel().select(a.node);this.tree.eventModel.disable();this.proxy.update(\"\");a.node.ui.appendDDGhost(this.proxy.ghost.dom);this.tree.fireEvent(\"startdrag\",this.tree,a.node,b)},getRepairXY:function(b,a){return a.node.ui.getDDRepairXY()},onEndDrag:function(a,b){this.tree.eventModel.enable.defer(100,this.tree.eventModel);this.tree.fireEvent(\"enddrag\",this.tree,a.node,b)},onValidDrop:function(a,b,c){this.tree.fireEvent(\"dragdrop\",this.tree,this.dragData.node,a,b);this.hideProxy()},beforeInvalidDrop:function(a,c){var b=this.tree.getSelectionModel();b.clearSelections();b.select(this.dragData.node)},afterRepair:function(){if(Ext.enableFx&&this.tree.hlDrop){Ext.Element.fly(this.dragData.ddel).highlight(this.hlColor||\"c3daf9\")}this.dragging=false}})}Ext.tree.TreeEditor=function(a,c,b){c=c||{};var d=c.events?c:new Ext.form.TextField(c);Ext.tree.TreeEditor.superclass.constructor.call(this,d,b);this.tree=a;if(!a.rendered){a.on(\"render\",this.initEditor,this)}else{this.initEditor(a)}};Ext.extend(Ext.tree.TreeEditor,Ext.Editor,{alignment:\"l-l\",autoSize:false,hideEl:false,cls:\"x-small-editor x-tree-editor\",shim:false,shadow:\"frame\",maxWidth:250,editDelay:350,initEditor:function(a){a.on({scope:this,beforeclick:this.beforeNodeClick,dblclick:this.onNodeDblClick});this.on({scope:this,complete:this.updateNode,beforestartedit:this.fitToTree,specialkey:this.onSpecialKey});this.on(\"startedit\",this.bindScroll,this,{delay:10})},fitToTree:function(b,c){var e=this.tree.getTreeEl().dom,d=c.dom;if(e.scrollLeft>d.offsetLeft){e.scrollLeft=d.offsetLeft}var a=Math.min(this.maxWidth,(e.clientWidth>20?e.clientWidth:e.offsetWidth)-Math.max(0,d.offsetLeft-e.scrollLeft)-5);this.setSize(a,\"\")},triggerEdit:function(a,c){this.completeEdit();if(a.attributes.editable!==false){this.editNode=a;if(this.tree.autoScroll){Ext.fly(a.ui.getEl()).scrollIntoView(this.tree.body)}var b=a.text||\"\";if(!Ext.isGecko&&Ext.isEmpty(a.text)){a.setText(\"&#160;\")}this.autoEditTimer=this.startEdit.defer(this.editDelay,this,[a.ui.textNode,b]);return false}},bindScroll:function(){this.tree.getTreeEl().on(\"scroll\",this.cancelEdit,this)},beforeNodeClick:function(a,b){clearTimeout(this.autoEditTimer);if(this.tree.getSelectionModel().isSelected(a)){b.stopEvent();return this.triggerEdit(a)}},onNodeDblClick:function(a,b){clearTimeout(this.autoEditTimer)},updateNode:function(a,b){this.tree.getTreeEl().un(\"scroll\",this.cancelEdit,this);this.editNode.setText(b)},onHide:function(){Ext.tree.TreeEditor.superclass.onHide.call(this);if(this.editNode){this.editNode.ui.focus.defer(50,this.editNode.ui)}},onSpecialKey:function(c,b){var a=b.getKey();if(a==b.ESC){b.stopEvent();this.cancelEdit()}else{if(a==b.ENTER&&!b.hasModifier()){b.stopEvent();this.completeEdit()}}},onDestroy:function(){clearTimeout(this.autoEditTimer);Ext.tree.TreeEditor.superclass.onDestroy.call(this);var a=this.tree;a.un(\"beforeclick\",this.beforeNodeClick,this);a.un(\"dblclick\",this.onNodeDblClick,this)}});var swfobject=function(){var E=\"undefined\",s=\"object\",T=\"Shockwave Flash\",X=\"ShockwaveFlash.ShockwaveFlash\",r=\"application/x-shockwave-flash\",S=\"SWFObjectExprInst\",y=\"onreadystatechange\",P=window,k=document,u=navigator,U=false,V=[i],p=[],O=[],J=[],m,R,F,C,K=false,a=false,o,H,n=true,N=function(){var ab=typeof k.getElementById!=E&&typeof k.getElementsByTagName!=E&&typeof k.createElement!=E,ai=u.userAgent.toLowerCase(),Z=u.platform.toLowerCase(),af=Z?(/win/).test(Z):/win/.test(ai),ad=Z?(/mac/).test(Z):/mac/.test(ai),ag=/webkit/.test(ai)?parseFloat(ai.replace(/^.*webkit\\/(\\d+(\\.\\d+)?).*$/,\"$1\")):false,Y=!+\"\\v1\",ah=[0,0,0],ac=null;if(typeof u.plugins!=E&&typeof u.plugins[T]==s){ac=u.plugins[T].description;if(ac&&!(typeof u.mimeTypes!=E&&u.mimeTypes[r]&&!u.mimeTypes[r].enabledPlugin)){U=true;Y=false;ac=ac.replace(/^.*\\s+(\\S+\\s+\\S+$)/,\"$1\");ah[0]=parseInt(ac.replace(/^(.*)\\..*$/,\"$1\"),10);ah[1]=parseInt(ac.replace(/^.*\\.(.*)\\s.*$/,\"$1\"),10);ah[2]=/[a-zA-Z]/.test(ac)?parseInt(ac.replace(/^.*[a-zA-Z]+(.*)$/,\"$1\"),10):0}}else{if(typeof P.ActiveXObject!=E){try{var ae=new ActiveXObject(X);if(ae){ac=ae.GetVariable(\"$version\");if(ac){Y=true;ac=ac.split(\" \")[1].split(\",\");ah=[parseInt(ac[0],10),parseInt(ac[1],10),parseInt(ac[2],10)]}}}catch(aa){}}}return{w3:ab,pv:ah,wk:ag,ie:Y,win:af,mac:ad}}(),l=function(){if(!N.w3){return}if((typeof k.readyState!=E&&k.readyState==\"complete\")||(typeof k.readyState==E&&(k.getElementsByTagName(\"body\")[0]||k.body))){g()}if(!K){if(typeof k.addEventListener!=E){k.addEventListener(\"DOMContentLoaded\",g,false)}if(N.ie&&N.win){k.attachEvent(y,function(){if(k.readyState==\"complete\"){k.detachEvent(y,arguments.callee);g()}});if(P==top){(function(){if(K){return}try{k.documentElement.doScroll(\"left\")}catch(Y){setTimeout(arguments.callee,0);return}g()})()}}if(N.wk){(function(){if(K){return}if(!(/loaded|complete/).test(k.readyState)){setTimeout(arguments.callee,0);return}g()})()}t(g)}}();function g(){if(K){return}try{var aa=k.getElementsByTagName(\"body\")[0].appendChild(D(\"span\"));aa.parentNode.removeChild(aa)}catch(ab){return}K=true;var Y=V.length;for(var Z=0;Z<Y;Z++){V[Z]()}}function L(Y){if(K){Y()}else{V[V.length]=Y}}function t(Z){if(typeof P.addEventListener!=E){P.addEventListener(\"load\",Z,false)}else{if(typeof k.addEventListener!=E){k.addEventListener(\"load\",Z,false)}else{if(typeof P.attachEvent!=E){j(P,\"onload\",Z)}else{if(typeof P.onload==\"function\"){var Y=P.onload;P.onload=function(){Y();Z()}}else{P.onload=Z}}}}}function i(){if(U){W()}else{I()}}function W(){var Y=k.getElementsByTagName(\"body\")[0];var ab=D(s);ab.setAttribute(\"type\",r);var aa=Y.appendChild(ab);if(aa){var Z=0;(function(){if(typeof aa.GetVariable!=E){var ac=aa.GetVariable(\"$version\");if(ac){ac=ac.split(\" \")[1].split(\",\");N.pv=[parseInt(ac[0],10),parseInt(ac[1],10),parseInt(ac[2],10)]}}else{if(Z<10){Z++;setTimeout(arguments.callee,10);return}}Y.removeChild(ab);aa=null;I()})()}else{I()}}function I(){var ah=p.length;if(ah>0){for(var ag=0;ag<ah;ag++){var Z=p[ag].id;var ac=p[ag].callbackFn;var ab={success:false,id:Z};if(N.pv[0]>0){var af=c(Z);if(af){if(G(p[ag].swfVersion)&&!(N.wk&&N.wk<312)){x(Z,true);if(ac){ab.success=true;ab.ref=A(Z);ac(ab)}}else{if(p[ag].expressInstall&&B()){var aj={};aj.data=p[ag].expressInstall;aj.width=af.getAttribute(\"width\")||\"0\";aj.height=af.getAttribute(\"height\")||\"0\";if(af.getAttribute(\"class\")){aj.styleclass=af.getAttribute(\"class\")}if(af.getAttribute(\"align\")){aj.align=af.getAttribute(\"align\")}var ai={};var Y=af.getElementsByTagName(\"param\");var ad=Y.length;for(var ae=0;ae<ad;ae++){if(Y[ae].getAttribute(\"name\").toLowerCase()!=\"movie\"){ai[Y[ae].getAttribute(\"name\")]=Y[ae].getAttribute(\"value\")}}Q(aj,ai,Z,ac)}else{q(af);if(ac){ac(ab)}}}}}else{x(Z,true);if(ac){var aa=A(Z);if(aa&&typeof aa.SetVariable!=E){ab.success=true;ab.ref=aa}ac(ab)}}}}}function A(ab){var Y=null;var Z=c(ab);if(Z&&Z.nodeName==\"OBJECT\"){if(typeof Z.SetVariable!=E){Y=Z}else{var aa=Z.getElementsByTagName(s)[0];if(aa){Y=aa}}}return Y}function B(){return !a&&G(\"6.0.65\")&&(N.win||N.mac)&&!(N.wk&&N.wk<312)}function Q(ab,ac,Y,aa){a=true;F=aa||null;C={success:false,id:Y};var af=c(Y);if(af){if(af.nodeName==\"OBJECT\"){m=h(af);R=null}else{m=af;R=Y}ab.id=S;if(typeof ab.width==E||(!(/%$/).test(ab.width)&&parseInt(ab.width,10)<310)){ab.width=\"310\"}if(typeof ab.height==E||(!(/%$/).test(ab.height)&&parseInt(ab.height,10)<137)){ab.height=\"137\"}k.title=k.title.slice(0,47)+\" - Flash Player Installation\";var ae=N.ie&&N.win?\"ActiveX\":\"PlugIn\",ad=\"MMredirectURL=\"+P.location.toString().replace(/&/g,\"%26\")+\"&MMplayerType=\"+ae+\"&MMdoctitle=\"+k.title;if(typeof ac.flashvars!=E){ac.flashvars+=\"&\"+ad}else{ac.flashvars=ad}if(N.ie&&N.win&&af.readyState!=4){var Z=D(\"div\");Y+=\"SWFObjectNew\";Z.setAttribute(\"id\",Y);af.parentNode.insertBefore(Z,af);af.style.display=\"none\";(function(){if(af.readyState==4){af.parentNode.removeChild(af)}else{setTimeout(arguments.callee,10)}})()}v(ab,ac,Y)}}function q(Z){if(N.ie&&N.win&&Z.readyState!=4){var Y=D(\"div\");Z.parentNode.insertBefore(Y,Z);Y.parentNode.replaceChild(h(Z),Y);Z.style.display=\"none\";(function(){if(Z.readyState==4){Z.parentNode.removeChild(Z)}else{setTimeout(arguments.callee,10)}})()}else{Z.parentNode.replaceChild(h(Z),Z)}}function h(ad){var ab=D(\"div\");if(N.win&&N.ie){ab.innerHTML=ad.innerHTML}else{var Z=ad.getElementsByTagName(s)[0];if(Z){var ae=Z.childNodes;if(ae){var Y=ae.length;for(var aa=0;aa<Y;aa++){if(!(ae[aa].nodeType==1&&ae[aa].nodeName==\"PARAM\")&&!(ae[aa].nodeType==8)){ab.appendChild(ae[aa].cloneNode(true))}}}}}return ab}function v(aj,ah,Z){var Y,ab=c(Z);if(N.wk&&N.wk<312){return Y}if(ab){if(typeof aj.id==E){aj.id=Z}if(N.ie&&N.win){var ai=\"\";for(var af in aj){if(aj[af]!=Object.prototype[af]){if(af.toLowerCase()==\"data\"){ah.movie=aj[af]}else{if(af.toLowerCase()==\"styleclass\"){ai+=' class=\"'+aj[af]+'\"'}else{if(af.toLowerCase()!=\"classid\"){ai+=\" \"+af+'=\"'+aj[af]+'\"'}}}}}var ag=\"\";for(var ae in ah){if(ah[ae]!=Object.prototype[ae]){ag+='<param name=\"'+ae+'\" value=\"'+ah[ae]+'\" />'}}ab.outerHTML='<object classid=\"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000\"'+ai+\">\"+ag+\"</object>\";O[O.length]=aj.id;Y=c(aj.id)}else{var aa=D(s);aa.setAttribute(\"type\",r);for(var ad in aj){if(aj[ad]!=Object.prototype[ad]){if(ad.toLowerCase()==\"styleclass\"){aa.setAttribute(\"class\",aj[ad])}else{if(ad.toLowerCase()!=\"classid\"){aa.setAttribute(ad,aj[ad])}}}}for(var ac in ah){if(ah[ac]!=Object.prototype[ac]&&ac.toLowerCase()!=\"movie\"){e(aa,ac,ah[ac])}}ab.parentNode.replaceChild(aa,ab);Y=aa}}return Y}function e(aa,Y,Z){var ab=D(\"param\");ab.setAttribute(\"name\",Y);ab.setAttribute(\"value\",Z);aa.appendChild(ab)}function z(Z){var Y=c(Z);if(Y&&Y.nodeName==\"OBJECT\"){if(N.ie&&N.win){Y.style.display=\"none\";(function(){if(Y.readyState==4){b(Z)}else{setTimeout(arguments.callee,10)}})()}else{Y.parentNode.removeChild(Y)}}}function b(aa){var Z=c(aa);if(Z){for(var Y in Z){if(typeof Z[Y]==\"function\"){Z[Y]=null}}Z.parentNode.removeChild(Z)}}function c(aa){var Y=null;try{Y=k.getElementById(aa)}catch(Z){}return Y}function D(Y){return k.createElement(Y)}function j(aa,Y,Z){aa.attachEvent(Y,Z);J[J.length]=[aa,Y,Z]}function G(aa){var Z=N.pv,Y=aa.split(\".\");Y[0]=parseInt(Y[0],10);Y[1]=parseInt(Y[1],10)||0;Y[2]=parseInt(Y[2],10)||0;return(Z[0]>Y[0]||(Z[0]==Y[0]&&Z[1]>Y[1])||(Z[0]==Y[0]&&Z[1]==Y[1]&&Z[2]>=Y[2]))?true:false}function w(ad,Z,ae,ac){if(N.ie&&N.mac){return}var ab=k.getElementsByTagName(\"head\")[0];if(!ab){return}var Y=(ae&&typeof ae==\"string\")?ae:\"screen\";if(ac){o=null;H=null}if(!o||H!=Y){var aa=D(\"style\");aa.setAttribute(\"type\",\"text/css\");aa.setAttribute(\"media\",Y);o=ab.appendChild(aa);if(N.ie&&N.win&&typeof k.styleSheets!=E&&k.styleSheets.length>0){o=k.styleSheets[k.styleSheets.length-1]}H=Y}if(N.ie&&N.win){if(o&&typeof o.addRule==s){o.addRule(ad,Z)}}else{if(o&&typeof k.createTextNode!=E){o.appendChild(k.createTextNode(ad+\" {\"+Z+\"}\"))}}}function x(aa,Y){if(!n){return}var Z=Y?\"visible\":\"hidden\";if(K&&c(aa)){c(aa).style.visibility=Z}else{w(\"#\"+aa,\"visibility:\"+Z)}}function M(Z){var aa=/[\\\\\\\"<>\\.;]/;var Y=aa.exec(Z)!=null;return Y&&typeof encodeURIComponent!=E?encodeURIComponent(Z):Z}var d=function(){if(N.ie&&N.win){window.attachEvent(\"onunload\",function(){var ad=J.length;for(var ac=0;ac<ad;ac++){J[ac][0].detachEvent(J[ac][1],J[ac][2])}var aa=O.length;for(var ab=0;ab<aa;ab++){z(O[ab])}for(var Z in N){N[Z]=null}N=null;for(var Y in swfobject){swfobject[Y]=null}swfobject=null;window.detachEvent(\"onunload\",arguments.callee)})}}();return{registerObject:function(ac,Y,ab,aa){if(N.w3&&ac&&Y){var Z={};Z.id=ac;Z.swfVersion=Y;Z.expressInstall=ab;Z.callbackFn=aa;p[p.length]=Z;x(ac,false)}else{if(aa){aa({success:false,id:ac})}}},getObjectById:function(Y){if(N.w3){return A(Y)}},embedSWF:function(ac,ai,af,ah,Z,ab,aa,ae,ag,ad){var Y={success:false,id:ai};if(N.w3&&!(N.wk&&N.wk<312)&&ac&&ai&&af&&ah&&Z){x(ai,false);L(function(){af+=\"\";ah+=\"\";var ak={};if(ag&&typeof ag===s){for(var am in ag){ak[am]=ag[am]}}ak.data=ac;ak.width=af;ak.height=ah;var an={};if(ae&&typeof ae===s){for(var al in ae){an[al]=ae[al]}}if(aa&&typeof aa===s){for(var aj in aa){if(typeof an.flashvars!=E){an.flashvars+=\"&\"+aj+\"=\"+aa[aj]}else{an.flashvars=aj+\"=\"+aa[aj]}}}if(G(Z)){var ao=v(ak,an,ai);if(ak.id==ai){x(ai,true)}Y.success=true;Y.ref=ao}else{if(ab&&B()){ak.data=ab;Q(ak,an,ai,ad);return}else{x(ai,true)}}if(ad){ad(Y)}})}else{if(ad){ad(Y)}}},switchOffAutoHideShow:function(){n=false},ua:N,getFlashPlayerVersion:function(){return{major:N.pv[0],minor:N.pv[1],release:N.pv[2]}},hasFlashPlayerVersion:G,createSWF:function(aa,Z,Y){if(N.w3){return v(aa,Z,Y)}else{return undefined}},showExpressInstall:function(aa,ab,Y,Z){if(N.w3&&B()){Q(aa,ab,Y,Z)}},removeSWF:function(Y){if(N.w3){z(Y)}},createCSS:function(ab,aa,Z,Y){if(N.w3){w(ab,aa,Z,Y)}},addDomLoadEvent:L,addLoadEvent:t,getQueryParamValue:function(ab){var aa=k.location.search||k.location.hash;if(aa){if(/\\?/.test(aa)){aa=aa.split(\"?\")[1]}if(ab==null){return M(aa)}var Z=aa.split(\"&\");for(var Y=0;Y<Z.length;Y++){if(Z[Y].substring(0,Z[Y].indexOf(\"=\"))==ab){return M(Z[Y].substring((Z[Y].indexOf(\"=\")+1)))}}}return\"\"},expressInstallCallback:function(){if(a){var Y=c(S);if(Y&&m){Y.parentNode.replaceChild(m,Y);if(R){x(R,true);if(N.ie&&N.win){m.style.display=\"block\"}}if(F){F(C)}}a=false}}}}();Ext.FlashComponent=Ext.extend(Ext.BoxComponent,{flashVersion:\"9.0.115\",backgroundColor:\"#ffffff\",wmode:\"opaque\",flashVars:undefined,flashParams:undefined,url:undefined,swfId:undefined,swfWidth:\"100%\",swfHeight:\"100%\",expressInstall:false,initComponent:function(){Ext.FlashComponent.superclass.initComponent.call(this);this.addEvents(\"initialize\")},onRender:function(){Ext.FlashComponent.superclass.onRender.apply(this,arguments);var b=Ext.apply({allowScriptAccess:\"always\",bgcolor:this.backgroundColor,wmode:this.wmode},this.flashParams),a=Ext.apply({allowedDomain:document.location.hostname,YUISwfId:this.getId(),YUIBridgeCallback:\"Ext.FlashEventProxy.onEvent\"},this.flashVars);new swfobject.embedSWF(this.url,this.id,this.swfWidth,this.swfHeight,this.flashVersion,this.expressInstall?Ext.FlashComponent.EXPRESS_INSTALL_URL:undefined,a,b);this.swf=Ext.getDom(this.id);this.el=Ext.get(this.swf)},getSwfId:function(){return this.swfId||(this.swfId=\"extswf\"+(++Ext.Component.AUTO_ID))},getId:function(){return this.id||(this.id=\"extflashcmp\"+(++Ext.Component.AUTO_ID))},onFlashEvent:function(a){switch(a.type){case\"swfReady\":this.initSwf();return;case\"log\":return}a.component=this;this.fireEvent(a.type.toLowerCase().replace(/event$/,\"\"),a)},initSwf:function(){this.onSwfReady(!!this.isInitialized);this.isInitialized=true;this.fireEvent(\"initialize\",this)},beforeDestroy:function(){if(this.rendered){swfobject.removeSWF(this.swf.id)}Ext.FlashComponent.superclass.beforeDestroy.call(this)},onSwfReady:Ext.emptyFn});Ext.FlashComponent.EXPRESS_INSTALL_URL=\"http://swfobject.googlecode.com/svn/trunk/swfobject/expressInstall.swf\";Ext.reg(\"flash\",Ext.FlashComponent);Ext.FlashEventProxy={onEvent:function(c,b){var a=Ext.getCmp(c);if(a){a.onFlashEvent(b)}else{arguments.callee.defer(10,this,[c,b])}}};Ext.chart.Chart=Ext.extend(Ext.FlashComponent,{refreshBuffer:100,chartStyle:{padding:10,animationEnabled:true,font:{name:\"Tahoma\",color:4473924,size:11},dataTip:{padding:5,border:{color:10075112,size:1},background:{color:14346230,alpha:0.9},font:{name:\"Tahoma\",color:1393291,size:10,bold:true}}},extraStyle:null,seriesStyles:null,disableCaching:Ext.isIE||Ext.isOpera,disableCacheParam:\"_dc\",initComponent:function(){Ext.chart.Chart.superclass.initComponent.call(this);if(!this.url){this.url=Ext.chart.Chart.CHART_URL}if(this.disableCaching){this.url=Ext.urlAppend(this.url,String.format(\"{0}={1}\",this.disableCacheParam,new Date().getTime()))}this.addEvents(\"itemmouseover\",\"itemmouseout\",\"itemclick\",\"itemdoubleclick\",\"itemdragstart\",\"itemdrag\",\"itemdragend\",\"beforerefresh\",\"refresh\");this.store=Ext.StoreMgr.lookup(this.store)},setStyle:function(a,b){this.swf.setStyle(a,Ext.encode(b))},setStyles:function(a){this.swf.setStyles(Ext.encode(a))},setSeriesStyles:function(b){this.seriesStyles=b;var a=[];Ext.each(b,function(c){a.push(Ext.encode(c))});this.swf.setSeriesStyles(a)},setCategoryNames:function(a){this.swf.setCategoryNames(a)},setLegendRenderer:function(c,b){var a=this;b=b||a;a.removeFnProxy(a.legendFnName);a.legendFnName=a.createFnProxy(function(d){return c.call(b,d)});a.swf.setLegendLabelFunction(a.legendFnName)},setTipRenderer:function(c,b){var a=this;b=b||a;a.removeFnProxy(a.tipFnName);a.tipFnName=a.createFnProxy(function(h,e,g){var d=a.store.getAt(e);return c.call(b,a,d,e,g)});a.swf.setDataTipFunction(a.tipFnName)},setSeries:function(a){this.series=a;this.refresh()},bindStore:function(a,b){if(!b&&this.store){if(a!==this.store&&this.store.autoDestroy){this.store.destroy()}else{this.store.un(\"datachanged\",this.refresh,this);this.store.un(\"add\",this.delayRefresh,this);this.store.un(\"remove\",this.delayRefresh,this);this.store.un(\"update\",this.delayRefresh,this);this.store.un(\"clear\",this.refresh,this)}}if(a){a=Ext.StoreMgr.lookup(a);a.on({scope:this,datachanged:this.refresh,add:this.delayRefresh,remove:this.delayRefresh,update:this.delayRefresh,clear:this.refresh})}this.store=a;if(a&&!b){this.refresh()}},onSwfReady:function(b){Ext.chart.Chart.superclass.onSwfReady.call(this,b);var a;this.swf.setType(this.type);if(this.chartStyle){this.setStyles(Ext.apply({},this.extraStyle,this.chartStyle))}if(this.categoryNames){this.setCategoryNames(this.categoryNames)}if(this.tipRenderer){a=this.getFunctionRef(this.tipRenderer);this.setTipRenderer(a.fn,a.scope)}if(this.legendRenderer){a=this.getFunctionRef(this.legendRenderer);this.setLegendRenderer(a.fn,a.scope)}if(!b){this.bindStore(this.store,true)}this.refresh.defer(10,this)},delayRefresh:function(){if(!this.refreshTask){this.refreshTask=new Ext.util.DelayedTask(this.refresh,this)}this.refreshTask.delay(this.refreshBuffer)},refresh:function(){if(this.fireEvent(\"beforerefresh\",this)!==false){var m=false;var k=[],c=this.store.data.items;for(var g=0,l=c.length;g<l;g++){k[g]=c[g].data}var e=[];var d=0;var n=null;var h=0;if(this.series){d=this.series.length;for(h=0;h<d;h++){n=this.series[h];var b={};for(var a in n){if(a==\"style\"&&n.style!==null){b.style=Ext.encode(n.style);m=true}else{b[a]=n[a]}}e.push(b)}}if(d>0){for(h=0;h<d;h++){n=e[h];if(!n.type){n.type=this.type}n.dataProvider=k}}else{e.push({type:this.type,dataProvider:k})}this.swf.setDataProvider(e);if(this.seriesStyles){this.setSeriesStyles(this.seriesStyles)}this.fireEvent(\"refresh\",this)}},createFnProxy:function(a){var b=\"extFnProxy\"+(++Ext.chart.Chart.PROXY_FN_ID);Ext.chart.Chart.proxyFunction[b]=a;return\"Ext.chart.Chart.proxyFunction.\"+b},removeFnProxy:function(a){if(!Ext.isEmpty(a)){a=a.replace(\"Ext.chart.Chart.proxyFunction.\",\"\");delete Ext.chart.Chart.proxyFunction[a]}},getFunctionRef:function(a){if(Ext.isFunction(a)){return{fn:a,scope:this}}else{return{fn:a.fn,scope:a.scope||this}}},onDestroy:function(){if(this.refreshTask&&this.refreshTask.cancel){this.refreshTask.cancel()}Ext.chart.Chart.superclass.onDestroy.call(this);this.bindStore(null);this.removeFnProxy(this.tipFnName);this.removeFnProxy(this.legendFnName)}});Ext.reg(\"chart\",Ext.chart.Chart);Ext.chart.Chart.PROXY_FN_ID=0;Ext.chart.Chart.proxyFunction={};Ext.chart.Chart.CHART_URL=\"http://yui.yahooapis.com/2.8.2/build/charts/assets/charts.swf\";Ext.chart.PieChart=Ext.extend(Ext.chart.Chart,{type:\"pie\",onSwfReady:function(a){Ext.chart.PieChart.superclass.onSwfReady.call(this,a);this.setDataField(this.dataField);this.setCategoryField(this.categoryField)},setDataField:function(a){this.dataField=a;this.swf.setDataField(a)},setCategoryField:function(a){this.categoryField=a;this.swf.setCategoryField(a)}});Ext.reg(\"piechart\",Ext.chart.PieChart);Ext.chart.CartesianChart=Ext.extend(Ext.chart.Chart,{onSwfReady:function(a){Ext.chart.CartesianChart.superclass.onSwfReady.call(this,a);this.labelFn=[];if(this.xField){this.setXField(this.xField)}if(this.yField){this.setYField(this.yField)}if(this.xAxis){this.setXAxis(this.xAxis)}if(this.xAxes){this.setXAxes(this.xAxes)}if(this.yAxis){this.setYAxis(this.yAxis)}if(this.yAxes){this.setYAxes(this.yAxes)}if(Ext.isDefined(this.constrainViewport)){this.swf.setConstrainViewport(this.constrainViewport)}},setXField:function(a){this.xField=a;this.swf.setHorizontalField(a)},setYField:function(a){this.yField=a;this.swf.setVerticalField(a)},setXAxis:function(a){this.xAxis=this.createAxis(\"xAxis\",a);this.swf.setHorizontalAxis(this.xAxis)},setXAxes:function(c){var b;for(var a=0;a<c.length;a++){b=this.createAxis(\"xAxis\"+a,c[a]);this.swf.setHorizontalAxis(b)}},setYAxis:function(a){this.yAxis=this.createAxis(\"yAxis\",a);this.swf.setVerticalAxis(this.yAxis)},setYAxes:function(c){var b;for(var a=0;a<c.length;a++){b=this.createAxis(\"yAxis\"+a,c[a]);this.swf.setVerticalAxis(b)}},createAxis:function(b,d){var e=Ext.apply({},d),c,a;if(this[b]){a=this[b].labelFunction;this.removeFnProxy(a);this.labelFn.remove(a)}if(e.labelRenderer){c=this.getFunctionRef(e.labelRenderer);e.labelFunction=this.createFnProxy(function(g){return c.fn.call(c.scope,g)});delete e.labelRenderer;this.labelFn.push(e.labelFunction)}if(b.indexOf(\"xAxis\")>-1&&e.position==\"left\"){e.position=\"bottom\"}return e},onDestroy:function(){Ext.chart.CartesianChart.superclass.onDestroy.call(this);Ext.each(this.labelFn,function(a){this.removeFnProxy(a)},this)}});Ext.reg(\"cartesianchart\",Ext.chart.CartesianChart);Ext.chart.LineChart=Ext.extend(Ext.chart.CartesianChart,{type:\"line\"});Ext.reg(\"linechart\",Ext.chart.LineChart);Ext.chart.ColumnChart=Ext.extend(Ext.chart.CartesianChart,{type:\"column\"});Ext.reg(\"columnchart\",Ext.chart.ColumnChart);Ext.chart.StackedColumnChart=Ext.extend(Ext.chart.CartesianChart,{type:\"stackcolumn\"});Ext.reg(\"stackedcolumnchart\",Ext.chart.StackedColumnChart);Ext.chart.BarChart=Ext.extend(Ext.chart.CartesianChart,{type:\"bar\"});Ext.reg(\"barchart\",Ext.chart.BarChart);Ext.chart.StackedBarChart=Ext.extend(Ext.chart.CartesianChart,{type:\"stackbar\"});Ext.reg(\"stackedbarchart\",Ext.chart.StackedBarChart);Ext.chart.Axis=function(a){Ext.apply(this,a)};Ext.chart.Axis.prototype={type:null,orientation:\"horizontal\",reverse:false,labelFunction:null,hideOverlappingLabels:true,labelSpacing:2};Ext.chart.NumericAxis=Ext.extend(Ext.chart.Axis,{type:\"numeric\",minimum:NaN,maximum:NaN,majorUnit:NaN,minorUnit:NaN,snapToUnits:true,alwaysShowZero:true,scale:\"linear\",roundMajorUnit:true,calculateByLabelSize:true,position:\"left\",adjustMaximumByMajorUnit:true,adjustMinimumByMajorUnit:true});Ext.chart.TimeAxis=Ext.extend(Ext.chart.Axis,{type:\"time\",minimum:null,maximum:null,majorUnit:NaN,majorTimeUnit:null,minorUnit:NaN,minorTimeUnit:null,snapToUnits:true,stackingEnabled:false,calculateByLabelSize:true});Ext.chart.CategoryAxis=Ext.extend(Ext.chart.Axis,{type:\"category\",categoryNames:null,calculateCategoryCount:false});Ext.chart.Series=function(a){Ext.apply(this,a)};Ext.chart.Series.prototype={type:null,displayName:null};Ext.chart.CartesianSeries=Ext.extend(Ext.chart.Series,{xField:null,yField:null,showInLegend:true,axis:\"primary\"});Ext.chart.ColumnSeries=Ext.extend(Ext.chart.CartesianSeries,{type:\"column\"});Ext.chart.LineSeries=Ext.extend(Ext.chart.CartesianSeries,{type:\"line\"});Ext.chart.BarSeries=Ext.extend(Ext.chart.CartesianSeries,{type:\"bar\"});Ext.chart.PieSeries=Ext.extend(Ext.chart.Series,{type:\"pie\",dataField:null,categoryField:null});Ext.menu.Menu=Ext.extend(Ext.Container,{minWidth:120,shadow:\"sides\",subMenuAlign:\"tl-tr?\",defaultAlign:\"tl-bl?\",allowOtherMenus:false,ignoreParentClicks:false,enableScrolling:true,maxHeight:null,scrollIncrement:24,showSeparator:true,defaultOffsets:[0,0],plain:false,floating:true,zIndex:15000,hidden:true,layout:\"menu\",hideMode:\"offsets\",scrollerHeight:8,autoLayout:true,defaultType:\"menuitem\",bufferResize:false,initComponent:function(){if(Ext.isArray(this.initialConfig)){Ext.apply(this,{items:this.initialConfig})}this.addEvents(\"click\",\"mouseover\",\"mouseout\",\"itemclick\");Ext.menu.MenuMgr.register(this);if(this.floating){Ext.EventManager.onWindowResize(this.hide,this)}else{if(this.initialConfig.hidden!==false){this.hidden=false}this.internalDefaults={hideOnClick:false}}Ext.menu.Menu.superclass.initComponent.call(this);if(this.autoLayout){var a=this.doLayout.createDelegate(this,[]);this.on({add:a,remove:a})}},getLayoutTarget:function(){return this.ul},onRender:function(b,a){if(!b){b=Ext.getBody()}var c={id:this.getId(),cls:\"x-menu \"+((this.floating)?\"x-menu-floating x-layer \":\"\")+(this.cls||\"\")+(this.plain?\" x-menu-plain\":\"\")+(this.showSeparator?\"\":\" x-menu-nosep\"),style:this.style,cn:[{tag:\"a\",cls:\"x-menu-focus\",href:\"#\",onclick:\"return false;\",tabIndex:\"-1\"},{tag:\"ul\",cls:\"x-menu-list\"}]};if(this.floating){this.el=new Ext.Layer({shadow:this.shadow,dh:c,constrain:false,parentEl:b,zindex:this.zIndex})}else{this.el=b.createChild(c)}Ext.menu.Menu.superclass.onRender.call(this,b,a);if(!this.keyNav){this.keyNav=new Ext.menu.MenuNav(this)}this.focusEl=this.el.child(\"a.x-menu-focus\");this.ul=this.el.child(\"ul.x-menu-list\");this.mon(this.ul,{scope:this,click:this.onClick,mouseover:this.onMouseOver,mouseout:this.onMouseOut});if(this.enableScrolling){this.mon(this.el,{scope:this,delegate:\".x-menu-scroller\",click:this.onScroll,mouseover:this.deactivateActive})}},findTargetItem:function(b){var a=b.getTarget(\".x-menu-list-item\",this.ul,true);if(a&&a.menuItemId){return this.items.get(a.menuItemId)}},onClick:function(b){var a=this.findTargetItem(b);if(a){if(a.isFormField){this.setActiveItem(a)}else{if(a instanceof Ext.menu.BaseItem){if(a.menu&&this.ignoreParentClicks){a.expandMenu();b.preventDefault()}else{if(a.onClick){a.onClick(b);this.fireEvent(\"click\",this,a,b)}}}}}},setActiveItem:function(a,b){if(a!=this.activeItem){this.deactivateActive();if((this.activeItem=a).isFormField){a.focus()}else{a.activate(b)}}else{if(b){a.expandMenu()}}},deactivateActive:function(){var b=this.activeItem;if(b){if(b.isFormField){if(b.collapse){b.collapse()}}else{b.deactivate()}delete this.activeItem}},tryActivate:function(g,e){var b=this.items;for(var c=g,a=b.length;c>=0&&c<a;c+=e){var d=b.get(c);if(d.isVisible()&&!d.disabled&&(d.canActivate||d.isFormField)){this.setActiveItem(d,false);return d}}return false},onMouseOver:function(b){var a=this.findTargetItem(b);if(a){if(a.canActivate&&!a.disabled){this.setActiveItem(a,true)}}this.over=true;this.fireEvent(\"mouseover\",this,b,a)},onMouseOut:function(b){var a=this.findTargetItem(b);if(a){if(a==this.activeItem&&a.shouldDeactivate&&a.shouldDeactivate(b)){this.activeItem.deactivate();delete this.activeItem}}this.over=false;this.fireEvent(\"mouseout\",this,b,a)},onScroll:function(d,b){if(d){d.stopEvent()}var a=this.ul.dom,c=Ext.fly(b).is(\".x-menu-scroller-top\");a.scrollTop+=this.scrollIncrement*(c?-1:1);if(c?a.scrollTop<=0:a.scrollTop+this.activeMax>=a.scrollHeight){this.onScrollerOut(null,b)}},onScrollerIn:function(d,b){var a=this.ul.dom,c=Ext.fly(b).is(\".x-menu-scroller-top\");if(c?a.scrollTop>0:a.scrollTop+this.activeMax<a.scrollHeight){Ext.fly(b).addClass([\"x-menu-item-active\",\"x-menu-scroller-active\"])}},onScrollerOut:function(b,a){Ext.fly(a).removeClass([\"x-menu-item-active\",\"x-menu-scroller-active\"])},show:function(b,c,a){if(this.floating){this.parentMenu=a;if(!this.el){this.render();this.doLayout(false,true)}this.showAt(this.el.getAlignToXY(b,c||this.defaultAlign,this.defaultOffsets),a)}else{Ext.menu.Menu.superclass.show.call(this)}},showAt:function(b,a){if(this.fireEvent(\"beforeshow\",this)!==false){this.parentMenu=a;if(!this.el){this.render()}if(this.enableScrolling){this.el.setXY(b);b[1]=this.constrainScroll(b[1]);b=[this.el.adjustForConstraints(b)[0],b[1]]}else{b=this.el.adjustForConstraints(b)}this.el.setXY(b);this.el.show();Ext.menu.Menu.superclass.onShow.call(this);if(Ext.isIE9m){this.fireEvent(\"autosize\",this);if(!Ext.isIE8){this.el.repaint()}}this.hidden=false;this.focus();this.fireEvent(\"show\",this)}},constrainScroll:function(i){var b,d=this.ul.setHeight(\"auto\").getHeight(),a=i,h,e,g,c;if(this.floating){e=Ext.fly(this.el.dom.parentNode);g=e.getScroll().top;c=e.getViewSize().height;h=i-g;b=this.maxHeight?this.maxHeight:c-h;if(d>c){b=c;a=i-h}else{if(b<d){a=i-(d-b);b=d}}}else{b=this.getHeight()}if(this.maxHeight){b=Math.min(this.maxHeight,b)}if(d>b&&b>0){this.activeMax=b-this.scrollerHeight*2-this.el.getFrameWidth(\"tb\")-Ext.num(this.el.shadowOffset,0);this.ul.setHeight(this.activeMax);this.createScrollers();this.el.select(\".x-menu-scroller\").setDisplayed(\"\")}else{this.ul.setHeight(d);this.el.select(\".x-menu-scroller\").setDisplayed(\"none\")}this.ul.dom.scrollTop=0;return a},createScrollers:function(){if(!this.scroller){this.scroller={pos:0,top:this.el.insertFirst({tag:\"div\",cls:\"x-menu-scroller x-menu-scroller-top\",html:\"&#160;\"}),bottom:this.el.createChild({tag:\"div\",cls:\"x-menu-scroller x-menu-scroller-bottom\",html:\"&#160;\"})};this.scroller.top.hover(this.onScrollerIn,this.onScrollerOut,this);this.scroller.topRepeater=new Ext.util.ClickRepeater(this.scroller.top,{listeners:{click:this.onScroll.createDelegate(this,[null,this.scroller.top],false)}});this.scroller.bottom.hover(this.onScrollerIn,this.onScrollerOut,this);this.scroller.bottomRepeater=new Ext.util.ClickRepeater(this.scroller.bottom,{listeners:{click:this.onScroll.createDelegate(this,[null,this.scroller.bottom],false)}})}},onLayout:function(){if(this.isVisible()){if(this.enableScrolling){this.constrainScroll(this.el.getTop())}if(this.floating){this.el.sync()}}},focus:function(){if(!this.hidden){this.doFocus.defer(50,this)}},doFocus:function(){if(!this.hidden){this.focusEl.focus()}},hide:function(a){if(!this.isDestroyed){this.deepHide=a;Ext.menu.Menu.superclass.hide.call(this);delete this.deepHide}},onHide:function(){Ext.menu.Menu.superclass.onHide.call(this);this.deactivateActive();if(this.el&&this.floating){this.el.hide()}var a=this.parentMenu;if(this.deepHide===true&&a){if(a.floating){a.hide(true)}else{a.deactivateActive()}}},lookupComponent:function(a){if(Ext.isString(a)){a=(a==\"separator\"||a==\"-\")?new Ext.menu.Separator():new Ext.menu.TextItem(a);this.applyDefaults(a)}else{if(Ext.isObject(a)){a=this.getMenuItem(a)}else{if(a.tagName||a.el){a=new Ext.BoxComponent({el:a})}}}return a},applyDefaults:function(b){if(!Ext.isString(b)){b=Ext.menu.Menu.superclass.applyDefaults.call(this,b);var a=this.internalDefaults;if(a){if(b.events){Ext.applyIf(b.initialConfig,a);Ext.apply(b,a)}else{Ext.applyIf(b,a)}}}return b},getMenuItem:function(a){a.ownerCt=this;if(!a.isXType){if(!a.xtype&&Ext.isBoolean(a.checked)){return new Ext.menu.CheckItem(a)}return Ext.create(a,this.defaultType)}return a},addSeparator:function(){return this.add(new Ext.menu.Separator())},addElement:function(a){return this.add(new Ext.menu.BaseItem({el:a}))},addItem:function(a){return this.add(a)},addMenuItem:function(a){return this.add(this.getMenuItem(a))},addText:function(a){return this.add(new Ext.menu.TextItem(a))},onDestroy:function(){Ext.EventManager.removeResizeListener(this.hide,this);var a=this.parentMenu;if(a&&a.activeChild==this){delete a.activeChild}delete this.parentMenu;Ext.menu.Menu.superclass.onDestroy.call(this);Ext.menu.MenuMgr.unregister(this);if(this.keyNav){this.keyNav.disable()}var b=this.scroller;if(b){Ext.destroy(b.topRepeater,b.bottomRepeater,b.top,b.bottom)}Ext.destroy(this.el,this.focusEl,this.ul)}});Ext.reg(\"menu\",Ext.menu.Menu);Ext.menu.MenuNav=Ext.extend(Ext.KeyNav,function(){function a(d,c){if(!c.tryActivate(c.items.indexOf(c.activeItem)-1,-1)){c.tryActivate(c.items.length-1,-1)}}function b(d,c){if(!c.tryActivate(c.items.indexOf(c.activeItem)+1,1)){c.tryActivate(0,1)}}return{constructor:function(c){Ext.menu.MenuNav.superclass.constructor.call(this,c.el);this.scope=this.menu=c},doRelay:function(g,d){var c=g.getKey();if(this.menu.activeItem&&this.menu.activeItem.isFormField&&c!=g.TAB){return false}if(!this.menu.activeItem&&g.isNavKeyPress()&&c!=g.SPACE&&c!=g.RETURN){this.menu.tryActivate(0,1);return false}return d.call(this.scope||this,g,this.menu)},tab:function(d,c){d.stopEvent();if(d.shiftKey){a(d,c)}else{b(d,c)}},up:a,down:b,right:function(d,c){if(c.activeItem){c.activeItem.expandMenu(true)}},left:function(d,c){c.hide();if(c.parentMenu&&c.parentMenu.activeItem){c.parentMenu.activeItem.activate()}},enter:function(d,c){if(c.activeItem){d.stopPropagation();c.activeItem.onClick(d);c.fireEvent(\"click\",this,c.activeItem);return true}}}}());Ext.menu.MenuMgr=function(){var h,e,b,d={},a=false,l=new Date();function n(){h={};e=new Ext.util.MixedCollection();b=Ext.getDoc().addKeyListener(27,j);b.disable()}function j(){if(e&&e.length>0){var o=e.clone();o.each(function(p){p.hide()});return true}return false}function g(o){e.remove(o);if(e.length<1){b.disable();Ext.getDoc().un(\"mousedown\",m);a=false}}function k(o){var p=e.last();l=new Date();e.add(o);if(!a){b.enable();Ext.getDoc().on(\"mousedown\",m);a=true}if(o.parentMenu){o.getEl().setZIndex(parseInt(o.parentMenu.getEl().getStyle(\"z-index\"),10)+3);o.parentMenu.activeChild=o}else{if(p&&!p.isDestroyed&&p.isVisible()){o.getEl().setZIndex(parseInt(p.getEl().getStyle(\"z-index\"),10)+3)}}}function c(o){if(o.activeChild){o.activeChild.hide()}if(o.autoHideTimer){clearTimeout(o.autoHideTimer);delete o.autoHideTimer}}function i(o){var p=o.parentMenu;if(!p&&!o.allowOtherMenus){j()}else{if(p&&p.activeChild){p.activeChild.hide()}}}function m(o){if(l.getElapsed()>50&&e.length>0&&!o.getTarget(\".x-menu\")){j()}}return{hideAll:function(){return j()},register:function(o){if(!h){n()}h[o.id]=o;o.on({beforehide:c,hide:g,beforeshow:i,show:k})},get:function(o){if(typeof o==\"string\"){if(!h){return null}return h[o]}else{if(o.events){return o}else{if(typeof o.length==\"number\"){return new Ext.menu.Menu({items:o})}else{return Ext.create(o,\"menu\")}}}},unregister:function(o){delete h[o.id];o.un(\"beforehide\",c);o.un(\"hide\",g);o.un(\"beforeshow\",i);o.un(\"show\",k)},registerCheckable:function(o){var p=o.group;if(p){if(!d[p]){d[p]=[]}d[p].push(o)}},unregisterCheckable:function(o){var p=o.group;if(p){d[p].remove(o)}},onCheckChange:function(q,r){if(q.group&&r){var t=d[q.group],p=0,o=t.length,s;for(;p<o;p++){s=t[p];if(s!=q){s.setChecked(false)}}}},getCheckedItem:function(q){var r=d[q];if(r){for(var p=0,o=r.length;p<o;p++){if(r[p].checked){return r[p]}}}return null},setCheckedItem:function(q,s){var r=d[q];if(r){for(var p=0,o=r.length;p<o;p++){if(r[p].id==s){r[p].setChecked(true)}}}return null}}}();Ext.menu.BaseItem=Ext.extend(Ext.Component,{canActivate:false,activeClass:\"x-menu-item-active\",hideOnClick:true,clickHideDelay:1,ctype:\"Ext.menu.BaseItem\",actionMode:\"container\",initComponent:function(){Ext.menu.BaseItem.superclass.initComponent.call(this);this.addEvents(\"click\",\"activate\",\"deactivate\");if(this.handler){this.on(\"click\",this.handler,this.scope)}},onRender:function(b,a){Ext.menu.BaseItem.superclass.onRender.apply(this,arguments);if(this.ownerCt&&this.ownerCt instanceof Ext.menu.Menu){this.parentMenu=this.ownerCt}else{this.container.addClass(\"x-menu-list-item\");this.mon(this.el,{scope:this,click:this.onClick,mouseenter:this.activate,mouseleave:this.deactivate})}},setHandler:function(b,a){if(this.handler){this.un(\"click\",this.handler,this.scope)}this.on(\"click\",this.handler=b,this.scope=a)},onClick:function(a){if(!this.disabled&&this.fireEvent(\"click\",this,a)!==false&&(this.parentMenu&&this.parentMenu.fireEvent(\"itemclick\",this,a)!==false)){this.handleClick(a)}else{a.stopEvent()}},activate:function(){if(this.disabled){return false}var a=this.container;a.addClass(this.activeClass);this.region=a.getRegion().adjust(2,2,-2,-2);this.fireEvent(\"activate\",this);return true},deactivate:function(){this.container.removeClass(this.activeClass);this.fireEvent(\"deactivate\",this)},shouldDeactivate:function(a){return !this.region||!this.region.contains(a.getPoint())},handleClick:function(b){var a=this.parentMenu;if(this.hideOnClick){if(a.floating){this.clickHideDelayTimer=a.hide.defer(this.clickHideDelay,a,[true])}else{a.deactivateActive()}}},beforeDestroy:function(){clearTimeout(this.clickHideDelayTimer);Ext.menu.BaseItem.superclass.beforeDestroy.call(this)},expandMenu:Ext.emptyFn,hideMenu:Ext.emptyFn});Ext.reg(\"menubaseitem\",Ext.menu.BaseItem);Ext.menu.TextItem=Ext.extend(Ext.menu.BaseItem,{hideOnClick:false,itemCls:\"x-menu-text\",constructor:function(a){if(typeof a==\"string\"){a={text:a}}Ext.menu.TextItem.superclass.constructor.call(this,a)},onRender:function(){var a=document.createElement(\"span\");a.className=this.itemCls;a.innerHTML=this.text;this.el=a;Ext.menu.TextItem.superclass.onRender.apply(this,arguments)}});Ext.reg(\"menutextitem\",Ext.menu.TextItem);Ext.menu.Separator=Ext.extend(Ext.menu.BaseItem,{itemCls:\"x-menu-sep\",hideOnClick:false,activeClass:\"\",onRender:function(a){var b=document.createElement(\"span\");b.className=this.itemCls;b.innerHTML=\"&#160;\";this.el=b;a.addClass(\"x-menu-sep-li\");Ext.menu.Separator.superclass.onRender.apply(this,arguments)}});Ext.reg(\"menuseparator\",Ext.menu.Separator);Ext.menu.Item=Ext.extend(Ext.menu.BaseItem,{itemCls:\"x-menu-item\",canActivate:true,showDelay:200,altText:\"\",hideDelay:200,ctype:\"Ext.menu.Item\",initComponent:function(){Ext.menu.Item.superclass.initComponent.call(this);if(this.menu){if(Ext.isArray(this.menu)){this.menu={items:this.menu}}if(Ext.isObject(this.menu)){this.menu.ownerCt=this}this.menu=Ext.menu.MenuMgr.get(this.menu);this.menu.ownerCt=undefined}},onRender:function(d,b){if(!this.itemTpl){this.itemTpl=Ext.menu.Item.prototype.itemTpl=new Ext.XTemplate('<a id=\"{id}\" class=\"{cls} x-unselectable\" hidefocus=\"true\" unselectable=\"on\" href=\"{href}\"','<tpl if=\"hrefTarget\">',' target=\"{hrefTarget}\"',\"</tpl>\",\">\",'<img alt=\"{altText}\" src=\"{icon}\" class=\"x-menu-item-icon {iconCls}\"/>','<span class=\"x-menu-item-text\">{text}</span>',\"</a>\")}var c=this.getTemplateArgs();this.el=b?this.itemTpl.insertBefore(b,c,true):this.itemTpl.append(d,c,true);this.iconEl=this.el.child(\"img.x-menu-item-icon\");this.textEl=this.el.child(\".x-menu-item-text\");if(!this.href){this.mon(this.el,\"click\",Ext.emptyFn,null,{preventDefault:true})}Ext.menu.Item.superclass.onRender.call(this,d,b)},getTemplateArgs:function(){return{id:this.id,cls:this.itemCls+(this.menu?\" x-menu-item-arrow\":\"\")+(this.cls?\" \"+this.cls:\"\"),href:this.href||\"#\",hrefTarget:this.hrefTarget,icon:this.icon||Ext.BLANK_IMAGE_URL,iconCls:this.iconCls||\"\",text:this.itemText||this.text||\"&#160;\",altText:this.altText||\"\"}},setText:function(a){this.text=a||\"&#160;\";if(this.rendered){this.textEl.update(this.text);this.parentMenu.layout.doAutoSize()}},setIconClass:function(a){var b=this.iconCls;this.iconCls=a;if(this.rendered){this.iconEl.replaceClass(b,this.iconCls)}},beforeDestroy:function(){clearTimeout(this.showTimer);clearTimeout(this.hideTimer);if(this.menu){delete this.menu.ownerCt;this.menu.destroy()}Ext.menu.Item.superclass.beforeDestroy.call(this)},handleClick:function(a){if(!this.href){a.stopEvent()}Ext.menu.Item.superclass.handleClick.apply(this,arguments)},activate:function(a){if(Ext.menu.Item.superclass.activate.apply(this,arguments)){this.focus();if(a){this.expandMenu()}}return true},shouldDeactivate:function(a){if(Ext.menu.Item.superclass.shouldDeactivate.call(this,a)){if(this.menu&&this.menu.isVisible()){return !this.menu.getEl().getRegion().contains(a.getPoint())}return true}return false},deactivate:function(){Ext.menu.Item.superclass.deactivate.apply(this,arguments);this.hideMenu()},expandMenu:function(a){if(!this.disabled&&this.menu){clearTimeout(this.hideTimer);delete this.hideTimer;if(!this.menu.isVisible()&&!this.showTimer){this.showTimer=this.deferExpand.defer(this.showDelay,this,[a])}else{if(this.menu.isVisible()&&a){this.menu.tryActivate(0,1)}}}},deferExpand:function(a){delete this.showTimer;this.menu.show(this.container,this.parentMenu.subMenuAlign||\"tl-tr?\",this.parentMenu);if(a){this.menu.tryActivate(0,1)}},hideMenu:function(){clearTimeout(this.showTimer);delete this.showTimer;if(!this.hideTimer&&this.menu&&this.menu.isVisible()){this.hideTimer=this.deferHide.defer(this.hideDelay,this)}},deferHide:function(){delete this.hideTimer;if(this.menu.over){this.parentMenu.setActiveItem(this,false)}else{this.menu.hide()}}});Ext.reg(\"menuitem\",Ext.menu.Item);Ext.menu.CheckItem=Ext.extend(Ext.menu.Item,{itemCls:\"x-menu-item x-menu-check-item\",groupClass:\"x-menu-group-item\",checked:false,ctype:\"Ext.menu.CheckItem\",initComponent:function(){Ext.menu.CheckItem.superclass.initComponent.call(this);this.addEvents(\"beforecheckchange\",\"checkchange\");if(this.checkHandler){this.on(\"checkchange\",this.checkHandler,this.scope)}Ext.menu.MenuMgr.registerCheckable(this)},onRender:function(a){Ext.menu.CheckItem.superclass.onRender.apply(this,arguments);if(this.group){this.el.addClass(this.groupClass)}if(this.checked){this.checked=false;this.setChecked(true,true)}},destroy:function(){Ext.menu.MenuMgr.unregisterCheckable(this);Ext.menu.CheckItem.superclass.destroy.apply(this,arguments)},setChecked:function(b,a){var c=a===true;if(this.checked!=b&&(c||this.fireEvent(\"beforecheckchange\",this,b)!==false)){Ext.menu.MenuMgr.onCheckChange(this,b);if(this.container){this.container[b?\"addClass\":\"removeClass\"](\"x-menu-item-checked\")}this.checked=b;if(!c){this.fireEvent(\"checkchange\",this,b)}}},handleClick:function(a){if(!this.disabled&&!(this.checked&&this.group)){this.setChecked(!this.checked)}Ext.menu.CheckItem.superclass.handleClick.apply(this,arguments)}});Ext.reg(\"menucheckitem\",Ext.menu.CheckItem);Ext.menu.DateMenu=Ext.extend(Ext.menu.Menu,{enableScrolling:false,hideOnClick:true,pickerId:null,cls:\"x-date-menu\",initComponent:function(){this.on(\"beforeshow\",this.onBeforeShow,this);if(this.strict=(Ext.isIE7&&Ext.isStrict)){this.on(\"show\",this.onShow,this,{single:true,delay:20})}Ext.apply(this,{plain:true,showSeparator:false,items:this.picker=new Ext.DatePicker(Ext.applyIf({internalRender:this.strict||!Ext.isIE9m,ctCls:\"x-menu-date-item\",id:this.pickerId},this.initialConfig))});this.picker.purgeListeners();Ext.menu.DateMenu.superclass.initComponent.call(this);this.relayEvents(this.picker,[\"select\"]);this.on(\"show\",this.picker.focus,this.picker);this.on(\"select\",this.menuHide,this);if(this.handler){this.on(\"select\",this.handler,this.scope||this)}},menuHide:function(){if(this.hideOnClick){this.hide(true)}},onBeforeShow:function(){if(this.picker){this.picker.hideMonthPicker(true)}},onShow:function(){var a=this.picker.getEl();a.setWidth(a.getWidth())}});Ext.reg(\"datemenu\",Ext.menu.DateMenu);Ext.menu.ColorMenu=Ext.extend(Ext.menu.Menu,{enableScrolling:false,hideOnClick:true,cls:\"x-color-menu\",paletteId:null,initComponent:function(){Ext.apply(this,{plain:true,showSeparator:false,items:this.palette=new Ext.ColorPalette(Ext.applyIf({id:this.paletteId},this.initialConfig))});this.palette.purgeListeners();Ext.menu.ColorMenu.superclass.initComponent.call(this);this.relayEvents(this.palette,[\"select\"]);this.on(\"select\",this.menuHide,this);if(this.handler){this.on(\"select\",this.handler,this.scope||this)}},menuHide:function(){if(this.hideOnClick){this.hide(true)}}});Ext.reg(\"colormenu\",Ext.menu.ColorMenu);Ext.form.Field=Ext.extend(Ext.BoxComponent,{invalidClass:\"x-form-invalid\",invalidText:\"The value in this field is invalid\",focusClass:\"x-form-focus\",validationEvent:\"keyup\",validateOnBlur:true,validationDelay:250,defaultAutoCreate:{tag:\"input\",type:\"text\",size:\"20\",autocomplete:\"off\"},fieldClass:\"x-form-field\",msgTarget:\"qtip\",msgFx:\"normal\",readOnly:false,disabled:false,submitValue:true,isFormField:true,msgDisplay:\"\",hasFocus:false,initComponent:function(){Ext.form.Field.superclass.initComponent.call(this);this.addEvents(\"focus\",\"blur\",\"specialkey\",\"change\",\"invalid\",\"valid\")},getName:function(){return this.rendered&&this.el.dom.name?this.el.dom.name:this.name||this.id||\"\"},onRender:function(c,a){if(!this.el){var b=this.getAutoCreate();if(!b.name){b.name=this.name||this.id}if(this.inputType){b.type=this.inputType}this.autoEl=b}Ext.form.Field.superclass.onRender.call(this,c,a);if(this.submitValue===false){this.el.dom.removeAttribute(\"name\")}var d=this.el.dom.type;if(d){if(d==\"password\"){d=\"text\"}this.el.addClass(\"x-form-\"+d)}if(this.readOnly){this.setReadOnly(true)}if(this.tabIndex!==undefined){this.el.dom.setAttribute(\"tabIndex\",this.tabIndex)}this.el.addClass([this.fieldClass,this.cls])},getItemCt:function(){return this.itemCt},initValue:function(){if(this.value!==undefined){this.setValue(this.value)}else{if(!Ext.isEmpty(this.el.dom.value)&&this.el.dom.value!=this.emptyText){this.setValue(this.el.dom.value)}}this.originalValue=this.getValue()},isDirty:function(){if(this.disabled||!this.rendered){return false}return String(this.getValue())!==String(this.originalValue)},setReadOnly:function(a){if(this.rendered){this.el.dom.readOnly=a}this.readOnly=a},afterRender:function(){Ext.form.Field.superclass.afterRender.call(this);this.initEvents();this.initValue()},fireKey:function(a){if(a.isSpecialKey()){this.fireEvent(\"specialkey\",this,a)}},reset:function(){this.setValue(this.originalValue);this.clearInvalid()},initEvents:function(){this.mon(this.el,Ext.EventManager.getKeyEvent(),this.fireKey,this);this.mon(this.el,\"focus\",this.onFocus,this);this.mon(this.el,\"blur\",this.onBlur,this,this.inEditor?{buffer:10}:null)},preFocus:Ext.emptyFn,onFocus:function(){this.preFocus();if(this.focusClass){this.el.addClass(this.focusClass)}if(!this.hasFocus){this.hasFocus=true;this.startValue=this.getValue();this.fireEvent(\"focus\",this)}},beforeBlur:Ext.emptyFn,onBlur:function(){this.beforeBlur();if(this.focusClass){this.el.removeClass(this.focusClass)}this.hasFocus=false;if(this.validationEvent!==false&&(this.validateOnBlur||this.validationEvent==\"blur\")){this.validate()}var a=this.getValue();if(String(a)!==String(this.startValue)){this.fireEvent(\"change\",this,a,this.startValue)}this.fireEvent(\"blur\",this);this.postBlur()},postBlur:Ext.emptyFn,isValid:function(a){if(this.disabled){return true}var c=this.preventMark;this.preventMark=a===true;var b=this.validateValue(this.processValue(this.getRawValue()),a);this.preventMark=c;return b},validate:function(){if(this.disabled||this.validateValue(this.processValue(this.getRawValue()))){this.clearInvalid();return true}return false},processValue:function(a){return a},validateValue:function(b){var a=this.getErrors(b)[0];if(a==undefined){return true}else{this.markInvalid(a);return false}},getErrors:function(){return[]},getActiveError:function(){return this.activeError||\"\"},markInvalid:function(c){if(this.rendered&&!this.preventMark){c=c||this.invalidText;var a=this.getMessageHandler();if(a){a.mark(this,c)}else{if(this.msgTarget){this.el.addClass(this.invalidClass);var b=Ext.getDom(this.msgTarget);if(b){b.innerHTML=c;b.style.display=this.msgDisplay}}}}this.setActiveError(c)},clearInvalid:function(){if(this.rendered&&!this.preventMark){this.el.removeClass(this.invalidClass);var a=this.getMessageHandler();if(a){a.clear(this)}else{if(this.msgTarget){this.el.removeClass(this.invalidClass);var b=Ext.getDom(this.msgTarget);if(b){b.innerHTML=\"\";b.style.display=\"none\"}}}}this.unsetActiveError()},setActiveError:function(b,a){this.activeError=b;if(a!==true){this.fireEvent(\"invalid\",this,b)}},unsetActiveError:function(a){delete this.activeError;if(a!==true){this.fireEvent(\"valid\",this)}},getMessageHandler:function(){return Ext.form.MessageTargets[this.msgTarget]},getErrorCt:function(){return this.el.findParent(\".x-form-element\",5,true)||this.el.findParent(\".x-form-field-wrap\",5,true)},alignErrorEl:function(){this.errorEl.setWidth(this.getErrorCt().getWidth(true)-20)},alignErrorIcon:function(){this.errorIcon.alignTo(this.el,\"tl-tr\",[2,0])},getRawValue:function(){var a=this.rendered?this.el.getValue():Ext.value(this.value,\"\");if(a===this.emptyText){a=\"\"}return a},getValue:function(){if(!this.rendered){return this.value}var a=this.el.getValue();if(a===this.emptyText||a===undefined){a=\"\"}return a},setRawValue:function(a){return this.rendered?(this.el.dom.value=(Ext.isEmpty(a)?\"\":a)):\"\"},setValue:function(a){this.value=a;if(this.rendered){this.el.dom.value=(Ext.isEmpty(a)?\"\":a);this.validate()}return this},append:function(a){this.setValue([this.getValue(),a].join(\"\"))}});Ext.form.MessageTargets={qtip:{mark:function(a,b){a.el.addClass(a.invalidClass);a.el.dom.qtip=b;a.el.dom.qclass=\"x-form-invalid-tip\";if(Ext.QuickTips){Ext.QuickTips.enable()}},clear:function(a){a.el.removeClass(a.invalidClass);a.el.dom.qtip=\"\"}},title:{mark:function(a,b){a.el.addClass(a.invalidClass);a.el.dom.title=b},clear:function(a){a.el.dom.title=\"\"}},under:{mark:function(b,c){b.el.addClass(b.invalidClass);if(!b.errorEl){var a=b.getErrorCt();if(!a){b.el.dom.title=c;return}b.errorEl=a.createChild({cls:\"x-form-invalid-msg\"});b.on(\"resize\",b.alignErrorEl,b);b.on(\"destroy\",function(){Ext.destroy(this.errorEl)},b)}b.alignErrorEl();b.errorEl.update(c);Ext.form.Field.msgFx[b.msgFx].show(b.errorEl,b)},clear:function(a){a.el.removeClass(a.invalidClass);if(a.errorEl){Ext.form.Field.msgFx[a.msgFx].hide(a.errorEl,a)}else{a.el.dom.title=\"\"}}},side:{mark:function(b,c){b.el.addClass(b.invalidClass);if(!b.errorIcon){var a=b.getErrorCt();if(!a){b.el.dom.title=c;return}b.errorIcon=a.createChild({cls:\"x-form-invalid-icon\"});if(b.ownerCt){b.ownerCt.on(\"afterlayout\",b.alignErrorIcon,b);b.ownerCt.on(\"expand\",b.alignErrorIcon,b)}b.on(\"resize\",b.alignErrorIcon,b);b.on(\"destroy\",function(){Ext.destroy(this.errorIcon)},b)}b.alignErrorIcon();b.errorIcon.dom.qtip=c;b.errorIcon.dom.qclass=\"x-form-invalid-tip\";b.errorIcon.show()},clear:function(a){a.el.removeClass(a.invalidClass);if(a.errorIcon){a.errorIcon.dom.qtip=\"\";a.errorIcon.hide()}else{a.el.dom.title=\"\"}}}};Ext.form.Field.msgFx={normal:{show:function(a,b){a.setDisplayed(\"block\")},hide:function(a,b){a.setDisplayed(false).update(\"\")}},slide:{show:function(a,b){a.slideIn(\"t\",{stopFx:true})},hide:function(a,b){a.slideOut(\"t\",{stopFx:true,useDisplay:true})}},slideRight:{show:function(a,b){a.fixDisplay();a.alignTo(b.el,\"tl-tr\");a.slideIn(\"l\",{stopFx:true})},hide:function(a,b){a.slideOut(\"l\",{stopFx:true,useDisplay:true})}}};Ext.reg(\"field\",Ext.form.Field);Ext.form.TextField=Ext.extend(Ext.form.Field,{grow:false,growMin:30,growMax:800,vtype:null,maskRe:null,disableKeyFilter:false,allowBlank:true,minLength:0,maxLength:Number.MAX_VALUE,minLengthText:\"The minimum length for this field is {0}\",maxLengthText:\"The maximum length for this field is {0}\",selectOnFocus:false,blankText:\"This field is required\",validator:null,regex:null,regexText:\"\",emptyText:null,emptyClass:\"x-form-empty-field\",initComponent:function(){Ext.form.TextField.superclass.initComponent.call(this);this.addEvents(\"autosize\",\"keydown\",\"keyup\",\"keypress\")},initEvents:function(){Ext.form.TextField.superclass.initEvents.call(this);if(this.validationEvent==\"keyup\"){this.validationTask=new Ext.util.DelayedTask(this.validate,this);this.mon(this.el,\"keyup\",this.filterValidation,this)}else{if(this.validationEvent!==false&&this.validationEvent!=\"blur\"){this.mon(this.el,this.validationEvent,this.validate,this,{buffer:this.validationDelay})}}if(this.selectOnFocus||this.emptyText){this.mon(this.el,\"mousedown\",this.onMouseDown,this);if(this.emptyText){this.applyEmptyText()}}if(this.maskRe||(this.vtype&&this.disableKeyFilter!==true&&(this.maskRe=Ext.form.VTypes[this.vtype+\"Mask\"]))){this.mon(this.el,\"keypress\",this.filterKeys,this)}if(this.grow){this.mon(this.el,\"keyup\",this.onKeyUpBuffered,this,{buffer:50});this.mon(this.el,\"click\",this.autoSize,this)}if(this.enableKeyEvents){this.mon(this.el,{scope:this,keyup:this.onKeyUp,keydown:this.onKeyDown,keypress:this.onKeyPress})}},onMouseDown:function(a){if(!this.hasFocus){this.mon(this.el,\"mouseup\",Ext.emptyFn,this,{single:true,preventDefault:true})}},processValue:function(a){if(this.stripCharsRe){var b=a.replace(this.stripCharsRe,\"\");if(b!==a){this.setRawValue(b);return b}}return a},filterValidation:function(a){if(!a.isNavKeyPress()){this.validationTask.delay(this.validationDelay)}},onDisable:function(){Ext.form.TextField.superclass.onDisable.call(this);if(Ext.isIE){this.el.dom.unselectable=\"on\"}},onEnable:function(){Ext.form.TextField.superclass.onEnable.call(this);if(Ext.isIE){this.el.dom.unselectable=\"\"}},onKeyUpBuffered:function(a){if(this.doAutoSize(a)){this.autoSize()}},doAutoSize:function(a){return !a.isNavKeyPress()},onKeyUp:function(a){this.fireEvent(\"keyup\",this,a)},onKeyDown:function(a){this.fireEvent(\"keydown\",this,a)},onKeyPress:function(a){this.fireEvent(\"keypress\",this,a)},reset:function(){Ext.form.TextField.superclass.reset.call(this);this.applyEmptyText()},applyEmptyText:function(){if(this.rendered&&this.emptyText&&this.getRawValue().length<1&&!this.hasFocus){this.setRawValue(this.emptyText);this.el.addClass(this.emptyClass)}},preFocus:function(){var a=this.el,b;if(this.emptyText){if(a.dom.value==this.emptyText){this.setRawValue(\"\");b=true}a.removeClass(this.emptyClass)}if(this.selectOnFocus||b){a.dom.select()}},postBlur:function(){this.applyEmptyText()},filterKeys:function(b){if(b.ctrlKey){return}var a=b.getKey();if(Ext.isGecko&&(b.isNavKeyPress()||a==b.BACKSPACE||(a==b.DELETE&&b.button==-1))){return}var c=String.fromCharCode(b.getCharCode());if(!Ext.isGecko&&b.isSpecialKey()&&!c){return}if(!this.maskRe.test(c)){b.stopEvent()}},setValue:function(a){if(this.emptyText&&this.el&&!Ext.isEmpty(a)){this.el.removeClass(this.emptyClass)}Ext.form.TextField.superclass.setValue.apply(this,arguments);this.applyEmptyText();this.autoSize();return this},getErrors:function(a){var d=Ext.form.TextField.superclass.getErrors.apply(this,arguments);a=Ext.isDefined(a)?a:this.processValue(this.getRawValue());if(Ext.isFunction(this.validator)){var c=this.validator(a);if(c!==true){d.push(c)}}if(a.length<1||a===this.emptyText){if(this.allowBlank){return d}else{d.push(this.blankText)}}if(!this.allowBlank&&(a.length<1||a===this.emptyText)){d.push(this.blankText)}if(a.length<this.minLength){d.push(String.format(this.minLengthText,this.minLength))}if(a.length>this.maxLength){d.push(String.format(this.maxLengthText,this.maxLength))}if(this.vtype){var b=Ext.form.VTypes;if(!b[this.vtype](a,this)){d.push(this.vtypeText||b[this.vtype+\"Text\"])}}if(this.regex&&!this.regex.test(a)){d.push(this.regexText)}return d},selectText:function(h,a){var c=this.getRawValue();var e=false;if(c.length>0){h=h===undefined?0:h;a=a===undefined?c.length:a;var g=this.el.dom;if(g.setSelectionRange){g.setSelectionRange(h,a)}else{if(g.createTextRange){var b=g.createTextRange();b.moveStart(\"character\",h);b.moveEnd(\"character\",a-c.length);b.select()}}e=Ext.isGecko||Ext.isOpera}else{e=true}if(e){this.focus()}},autoSize:function(){if(!this.grow||!this.rendered){return}if(!this.metrics){this.metrics=Ext.util.TextMetrics.createInstance(this.el)}var c=this.el;var b=c.dom.value;var e=document.createElement(\"div\");e.appendChild(document.createTextNode(b));b=e.innerHTML;Ext.removeNode(e);e=null;b+=\"&#160;\";var a=Math.min(this.growMax,Math.max(this.metrics.getWidth(b)+10,this.growMin));this.el.setWidth(a);this.fireEvent(\"autosize\",this,a)},onDestroy:function(){if(this.validationTask){this.validationTask.cancel();this.validationTask=null}Ext.form.TextField.superclass.onDestroy.call(this)}});Ext.reg(\"textfield\",Ext.form.TextField);Ext.form.TriggerField=Ext.extend(Ext.form.TextField,{defaultAutoCreate:{tag:\"input\",type:\"text\",size:\"16\",autocomplete:\"off\"},hideTrigger:false,editable:true,readOnly:false,wrapFocusClass:\"x-trigger-wrap-focus\",autoSize:Ext.emptyFn,monitorTab:true,deferHeight:true,mimicing:false,actionMode:\"wrap\",defaultTriggerWidth:17,onResize:function(a,c){Ext.form.TriggerField.superclass.onResize.call(this,a,c);var b=this.getTriggerWidth();if(Ext.isNumber(a)){this.el.setWidth(a-b)}this.wrap.setWidth(this.el.getWidth()+b)},getTriggerWidth:function(){var a=this.trigger.getWidth();if(!this.hideTrigger&&!this.readOnly&&a===0){a=this.defaultTriggerWidth}return a},alignErrorIcon:function(){if(this.wrap){this.errorIcon.alignTo(this.wrap,\"tl-tr\",[2,0])}},onRender:function(b,a){this.doc=Ext.isIE?Ext.getBody():Ext.getDoc();Ext.form.TriggerField.superclass.onRender.call(this,b,a);this.wrap=this.el.wrap({cls:\"x-form-field-wrap x-form-field-trigger-wrap\"});this.trigger=this.wrap.createChild(this.triggerConfig||{tag:\"img\",src:Ext.BLANK_IMAGE_URL,alt:\"\",cls:\"x-form-trigger \"+this.triggerClass});this.initTrigger();if(!this.width){this.wrap.setWidth(this.el.getWidth()+this.trigger.getWidth())}this.resizeEl=this.positionEl=this.wrap},getWidth:function(){return(this.el.getWidth()+this.trigger.getWidth())},updateEditState:function(){if(this.rendered){if(this.readOnly){this.el.dom.readOnly=true;this.el.addClass(\"x-trigger-noedit\");this.mun(this.el,\"click\",this.onTriggerClick,this);this.trigger.setDisplayed(false)}else{if(!this.editable){this.el.dom.readOnly=true;this.el.addClass(\"x-trigger-noedit\");this.mon(this.el,\"click\",this.onTriggerClick,this)}else{this.el.dom.readOnly=false;this.el.removeClass(\"x-trigger-noedit\");this.mun(this.el,\"click\",this.onTriggerClick,this)}this.trigger.setDisplayed(!this.hideTrigger)}this.onResize(this.width||this.wrap.getWidth())}},setHideTrigger:function(a){if(a!=this.hideTrigger){this.hideTrigger=a;this.updateEditState()}},setEditable:function(a){if(a!=this.editable){this.editable=a;this.updateEditState()}},setReadOnly:function(a){if(a!=this.readOnly){this.readOnly=a;this.updateEditState()}},afterRender:function(){Ext.form.TriggerField.superclass.afterRender.call(this);this.updateEditState()},initTrigger:function(){this.mon(this.trigger,\"click\",this.onTriggerClick,this,{preventDefault:true});this.trigger.addClassOnOver(\"x-form-trigger-over\");this.trigger.addClassOnClick(\"x-form-trigger-click\")},onDestroy:function(){Ext.destroy(this.trigger,this.wrap);if(this.mimicing){this.doc.un(\"mousedown\",this.mimicBlur,this)}delete this.doc;Ext.form.TriggerField.superclass.onDestroy.call(this)},onFocus:function(){Ext.form.TriggerField.superclass.onFocus.call(this);if(!this.mimicing){this.wrap.addClass(this.wrapFocusClass);this.mimicing=true;this.doc.on(\"mousedown\",this.mimicBlur,this,{delay:10});if(this.monitorTab){this.on(\"specialkey\",this.checkTab,this)}}},checkTab:function(a,b){if(b.getKey()==b.TAB){this.triggerBlur()}},onBlur:Ext.emptyFn,mimicBlur:function(a){if(!this.isDestroyed&&!this.wrap.contains(a.target)&&this.validateBlur(a)){this.triggerBlur()}},triggerBlur:function(){this.mimicing=false;this.doc.un(\"mousedown\",this.mimicBlur,this);if(this.monitorTab&&this.el){this.un(\"specialkey\",this.checkTab,this)}Ext.form.TriggerField.superclass.onBlur.call(this);if(this.wrap){this.wrap.removeClass(this.wrapFocusClass)}},beforeBlur:Ext.emptyFn,validateBlur:function(a){return true},onTriggerClick:Ext.emptyFn});Ext.form.TwinTriggerField=Ext.extend(Ext.form.TriggerField,{initComponent:function(){Ext.form.TwinTriggerField.superclass.initComponent.call(this);this.triggerConfig={tag:\"span\",cls:\"x-form-twin-triggers\",cn:[{tag:\"img\",src:Ext.BLANK_IMAGE_URL,alt:\"\",cls:\"x-form-trigger \"+this.trigger1Class},{tag:\"img\",src:Ext.BLANK_IMAGE_URL,alt:\"\",cls:\"x-form-trigger \"+this.trigger2Class}]}},getTrigger:function(a){return this.triggers[a]},afterRender:function(){Ext.form.TwinTriggerField.superclass.afterRender.call(this);var c=this.triggers,b=0,a=c.length;for(;b<a;++b){if(this[\"hideTrigger\"+(b+1)]){c[b].hide()}}},initTrigger:function(){var a=this.trigger.select(\".x-form-trigger\",true),b=this;a.each(function(d,g,c){var e=\"Trigger\"+(c+1);d.hide=function(){var h=b.wrap.getWidth();this.dom.style.display=\"none\";b.el.setWidth(h-b.trigger.getWidth());b[\"hidden\"+e]=true};d.show=function(){var h=b.wrap.getWidth();this.dom.style.display=\"\";b.el.setWidth(h-b.trigger.getWidth());b[\"hidden\"+e]=false};this.mon(d,\"click\",this[\"on\"+e+\"Click\"],this,{preventDefault:true});d.addClassOnOver(\"x-form-trigger-over\");d.addClassOnClick(\"x-form-trigger-click\")},this);this.triggers=a.elements},getTriggerWidth:function(){var a=0;Ext.each(this.triggers,function(d,c){var e=\"Trigger\"+(c+1),b=d.getWidth();if(b===0&&!this[\"hidden\"+e]){a+=this.defaultTriggerWidth}else{a+=b}},this);return a},onDestroy:function(){Ext.destroy(this.triggers);Ext.form.TwinTriggerField.superclass.onDestroy.call(this)},onTrigger1Click:Ext.emptyFn,onTrigger2Click:Ext.emptyFn});Ext.reg(\"trigger\",Ext.form.TriggerField);Ext.reg(\"twintrigger\",Ext.form.TwinTriggerField);Ext.form.TextArea=Ext.extend(Ext.form.TextField,{growMin:60,growMax:1000,growAppend:\"&#160;\\n&#160;\",enterIsSpecial:false,preventScrollbars:false,onRender:function(b,a){if(!this.el){this.defaultAutoCreate={tag:\"textarea\",style:\"width:100px;height:60px;\",autocomplete:\"off\"}}Ext.form.TextArea.superclass.onRender.call(this,b,a);if(this.grow){this.textSizeEl=Ext.DomHelper.append(document.body,{tag:\"pre\",cls:\"x-form-grow-sizer\"});if(this.preventScrollbars){this.el.setStyle(\"overflow\",\"hidden\")}this.el.setHeight(this.growMin)}},onDestroy:function(){Ext.removeNode(this.textSizeEl);Ext.form.TextArea.superclass.onDestroy.call(this)},fireKey:function(a){if(a.isSpecialKey()&&(this.enterIsSpecial||(a.getKey()!=a.ENTER||a.hasModifier()))){this.fireEvent(\"specialkey\",this,a)}},doAutoSize:function(a){return !a.isNavKeyPress()||a.getKey()==a.ENTER},filterValidation:function(a){if(!a.isNavKeyPress()||(!this.enterIsSpecial&&a.keyCode==a.ENTER)){this.validationTask.delay(this.validationDelay)}},autoSize:function(){if(!this.grow||!this.textSizeEl){return}var c=this.el,a=Ext.util.Format.htmlEncode(c.dom.value),d=this.textSizeEl,b;Ext.fly(d).setWidth(this.el.getWidth());if(a.length<1){a=\"&#160;&#160;\"}else{a+=this.growAppend;if(Ext.isIE){a=a.replace(/\\n/g,\"&#160;<br />\")}}d.innerHTML=a;b=Math.min(this.growMax,Math.max(d.offsetHeight,this.growMin));if(b!=this.lastHeight){this.lastHeight=b;this.el.setHeight(b);this.fireEvent(\"autosize\",this,b)}}});Ext.reg(\"textarea\",Ext.form.TextArea);Ext.form.NumberField=Ext.extend(Ext.form.TextField,{fieldClass:\"x-form-field x-form-num-field\",allowDecimals:true,decimalSeparator:\".\",decimalPrecision:2,allowNegative:true,minValue:Number.NEGATIVE_INFINITY,maxValue:Number.MAX_VALUE,minText:\"The minimum value for this field is {0}\",maxText:\"The maximum value for this field is {0}\",nanText:\"{0} is not a valid number\",baseChars:\"0123456789\",autoStripChars:false,initEvents:function(){var a=this.baseChars+\"\";if(this.allowDecimals){a+=this.decimalSeparator}if(this.allowNegative){a+=\"-\"}a=Ext.escapeRe(a);this.maskRe=new RegExp(\"[\"+a+\"]\");if(this.autoStripChars){this.stripCharsRe=new RegExp(\"[^\"+a+\"]\",\"gi\")}Ext.form.NumberField.superclass.initEvents.call(this)},getErrors:function(b){var c=Ext.form.NumberField.superclass.getErrors.apply(this,arguments);b=Ext.isDefined(b)?b:this.processValue(this.getRawValue());if(b.length<1){return c}b=String(b).replace(this.decimalSeparator,\".\");if(isNaN(b)){c.push(String.format(this.nanText,b))}var a=this.parseValue(b);if(a<this.minValue){c.push(String.format(this.minText,this.minValue))}if(a>this.maxValue){c.push(String.format(this.maxText,this.maxValue))}return c},getValue:function(){return this.fixPrecision(this.parseValue(Ext.form.NumberField.superclass.getValue.call(this)))},setValue:function(a){a=Ext.isNumber(a)?a:parseFloat(String(a).replace(this.decimalSeparator,\".\"));a=this.fixPrecision(a);a=isNaN(a)?\"\":String(a).replace(\".\",this.decimalSeparator);return Ext.form.NumberField.superclass.setValue.call(this,a)},setMinValue:function(a){this.minValue=Ext.num(a,Number.NEGATIVE_INFINITY)},setMaxValue:function(a){this.maxValue=Ext.num(a,Number.MAX_VALUE)},parseValue:function(a){a=parseFloat(String(a).replace(this.decimalSeparator,\".\"));return isNaN(a)?\"\":a},fixPrecision:function(b){var a=isNaN(b);if(!this.allowDecimals||this.decimalPrecision==-1||a||!b){return a?\"\":b}return parseFloat(parseFloat(b).toFixed(this.decimalPrecision))},beforeBlur:function(){var a=this.parseValue(this.getRawValue());if(!Ext.isEmpty(a)){this.setValue(a)}}});Ext.reg(\"numberfield\",Ext.form.NumberField);Ext.form.DateField=Ext.extend(Ext.form.TriggerField,{format:\"m/d/Y\",altFormats:\"m/d/Y|n/j/Y|n/j/y|m/j/y|n/d/y|m/j/Y|n/d/Y|m-d-y|m-d-Y|m/d|m-d|md|mdy|mdY|d|Y-m-d|n-j|n/j\",disabledDaysText:\"Disabled\",disabledDatesText:\"Disabled\",minText:\"The date in this field must be equal to or after {0}\",maxText:\"The date in this field must be equal to or before {0}\",invalidText:\"{0} is not a valid date - it must be in the format {1}\",triggerClass:\"x-form-date-trigger\",showToday:true,startDay:0,defaultAutoCreate:{tag:\"input\",type:\"text\",size:\"10\",autocomplete:\"off\"},initTime:\"12\",initTimeFormat:\"H\",safeParse:function(b,c){if(Date.formatContainsHourInfo(c)){return Date.parseDate(b,c)}else{var a=Date.parseDate(b+\" \"+this.initTime,c+\" \"+this.initTimeFormat);if(a){return a.clearTime()}}},initComponent:function(){Ext.form.DateField.superclass.initComponent.call(this);this.addEvents(\"select\");if(Ext.isString(this.minValue)){this.minValue=this.parseDate(this.minValue)}if(Ext.isString(this.maxValue)){this.maxValue=this.parseDate(this.maxValue)}this.disabledDatesRE=null;this.initDisabledDays()},initEvents:function(){Ext.form.DateField.superclass.initEvents.call(this);this.keyNav=new Ext.KeyNav(this.el,{down:function(a){this.onTriggerClick()},scope:this,forceKeyDown:true})},initDisabledDays:function(){if(this.disabledDates){var b=this.disabledDates,a=b.length-1,c=\"(?:\";Ext.each(b,function(g,e){c+=Ext.isDate(g)?\"^\"+Ext.escapeRe(g.dateFormat(this.format))+\"$\":b[e];if(e!=a){c+=\"|\"}},this);this.disabledDatesRE=new RegExp(c+\")\")}},setDisabledDates:function(a){this.disabledDates=a;this.initDisabledDays();if(this.menu){this.menu.picker.setDisabledDates(this.disabledDatesRE)}},setDisabledDays:function(a){this.disabledDays=a;if(this.menu){this.menu.picker.setDisabledDays(a)}},setMinValue:function(a){this.minValue=(Ext.isString(a)?this.parseDate(a):a);if(this.menu){this.menu.picker.setMinDate(this.minValue)}},setMaxValue:function(a){this.maxValue=(Ext.isString(a)?this.parseDate(a):a);if(this.menu){this.menu.picker.setMaxDate(this.maxValue)}},getErrors:function(e){var h=Ext.form.DateField.superclass.getErrors.apply(this,arguments);e=this.formatDate(e||this.processValue(this.getRawValue()));if(e.length<1){return h}var c=e;e=this.parseDate(e);if(!e){h.push(String.format(this.invalidText,c,this.format));return h}var g=e.getTime();if(this.minValue&&g<this.minValue.clearTime().getTime()){h.push(String.format(this.minText,this.formatDate(this.minValue)))}if(this.maxValue&&g>this.maxValue.clearTime().getTime()){h.push(String.format(this.maxText,this.formatDate(this.maxValue)))}if(this.disabledDays){var a=e.getDay();for(var b=0;b<this.disabledDays.length;b++){if(a===this.disabledDays[b]){h.push(this.disabledDaysText);break}}}var d=this.formatDate(e);if(this.disabledDatesRE&&this.disabledDatesRE.test(d)){h.push(String.format(this.disabledDatesText,d))}return h},validateBlur:function(){return !this.menu||!this.menu.isVisible()},getValue:function(){return this.parseDate(Ext.form.DateField.superclass.getValue.call(this))||\"\"},setValue:function(a){return Ext.form.DateField.superclass.setValue.call(this,this.formatDate(this.parseDate(a)))},parseDate:function(g){if(!g||Ext.isDate(g)){return g}var b=this.safeParse(g,this.format),c=this.altFormats,e=this.altFormatsArray;if(!b&&c){e=e||c.split(\"|\");for(var d=0,a=e.length;d<a&&!b;d++){b=this.safeParse(g,e[d])}}return b},onDestroy:function(){Ext.destroy(this.menu,this.keyNav);Ext.form.DateField.superclass.onDestroy.call(this)},formatDate:function(a){return Ext.isDate(a)?a.dateFormat(this.format):a},onTriggerClick:function(){if(this.disabled){return}if(this.menu==null){this.menu=new Ext.menu.DateMenu({hideOnClick:false,focusOnSelect:false})}this.onFocus();Ext.apply(this.menu.picker,{minDate:this.minValue,maxDate:this.maxValue,disabledDatesRE:this.disabledDatesRE,disabledDatesText:this.disabledDatesText,disabledDays:this.disabledDays,disabledDaysText:this.disabledDaysText,format:this.format,showToday:this.showToday,startDay:this.startDay,minText:String.format(this.minText,this.formatDate(this.minValue)),maxText:String.format(this.maxText,this.formatDate(this.maxValue))});this.menu.picker.setValue(this.getValue()||new Date());this.menu.show(this.el,\"tl-bl?\");this.menuEvents(\"on\")},menuEvents:function(a){this.menu[a](\"select\",this.onSelect,this);this.menu[a](\"hide\",this.onMenuHide,this);this.menu[a](\"show\",this.onFocus,this)},onSelect:function(a,b){this.setValue(b);this.fireEvent(\"select\",this,b);this.menu.hide()},onMenuHide:function(){this.focus(false,60);this.menuEvents(\"un\")},beforeBlur:function(){var a=this.parseDate(this.getRawValue());if(a){this.setValue(a)}}});Ext.reg(\"datefield\",Ext.form.DateField);Ext.form.DisplayField=Ext.extend(Ext.form.Field,{validationEvent:false,validateOnBlur:false,defaultAutoCreate:{tag:\"div\"},fieldClass:\"x-form-display-field\",htmlEncode:false,initEvents:Ext.emptyFn,isValid:function(){return true},validate:function(){return true},getRawValue:function(){var a=this.rendered?this.el.dom.innerHTML:Ext.value(this.value,\"\");if(a===this.emptyText){a=\"\"}if(this.htmlEncode){a=Ext.util.Format.htmlDecode(a)}return a},getValue:function(){return this.getRawValue()},getName:function(){return this.name},setRawValue:function(a){if(this.htmlEncode){a=Ext.util.Format.htmlEncode(a)}return this.rendered?(this.el.dom.innerHTML=(Ext.isEmpty(a)?\"\":a)):(this.value=a)},setValue:function(a){this.setRawValue(a);return this}});Ext.reg(\"displayfield\",Ext.form.DisplayField);Ext.form.ComboBox=Ext.extend(Ext.form.TriggerField,{defaultAutoCreate:{tag:\"input\",type:\"text\",size:\"24\",autocomplete:\"off\"},listClass:\"\",selectedClass:\"x-combo-selected\",listEmptyText:\"\",triggerClass:\"x-form-arrow-trigger\",shadow:\"sides\",listAlign:\"tl-bl?\",maxHeight:300,minHeight:90,triggerAction:\"query\",minChars:4,autoSelect:true,typeAhead:false,queryDelay:500,pageSize:0,selectOnFocus:false,queryParam:\"query\",loadingText:\"Loading...\",resizable:false,handleHeight:8,allQuery:\"\",mode:\"remote\",minListWidth:70,forceSelection:false,typeAheadDelay:250,lazyInit:true,clearFilterOnReset:true,submitValue:undefined,initComponent:function(){Ext.form.ComboBox.superclass.initComponent.call(this);this.addEvents(\"expand\",\"collapse\",\"beforeselect\",\"select\",\"beforequery\");if(this.transform){var c=Ext.getDom(this.transform);if(!this.hiddenName){this.hiddenName=c.name}if(!this.store){this.mode=\"local\";var j=[],e=c.options;for(var b=0,a=e.length;b<a;b++){var h=e[b],g=(h.hasAttribute?h.hasAttribute(\"value\"):h.getAttributeNode(\"value\").specified)?h.value:h.text;if(h.selected&&Ext.isEmpty(this.value,true)){this.value=g}j.push([g,h.text])}this.store=new Ext.data.ArrayStore({idIndex:0,fields:[\"value\",\"text\"],data:j,autoDestroy:true});this.valueField=\"value\";this.displayField=\"text\"}c.name=Ext.id();if(!this.lazyRender){this.target=true;this.el=Ext.DomHelper.insertBefore(c,this.autoCreate||this.defaultAutoCreate);this.render(this.el.parentNode,c)}Ext.removeNode(c)}else{if(this.store){this.store=Ext.StoreMgr.lookup(this.store);if(this.store.autoCreated){this.displayField=this.valueField=\"field1\";if(!this.store.expandData){this.displayField=\"field2\"}this.mode=\"local\"}}}this.selectedIndex=-1;if(this.mode==\"local\"){if(!Ext.isDefined(this.initialConfig.queryDelay)){this.queryDelay=10}if(!Ext.isDefined(this.initialConfig.minChars)){this.minChars=0}}},onRender:function(b,a){if(this.hiddenName&&!Ext.isDefined(this.submitValue)){this.submitValue=false}Ext.form.ComboBox.superclass.onRender.call(this,b,a);if(this.hiddenName){this.hiddenField=this.el.insertSibling({tag:\"input\",type:\"hidden\",name:this.hiddenName,id:(this.hiddenId||Ext.id())},\"before\",true)}if(Ext.isGecko){this.el.dom.setAttribute(\"autocomplete\",\"off\")}if(!this.lazyInit){this.initList()}else{this.on(\"focus\",this.initList,this,{single:true})}},initValue:function(){Ext.form.ComboBox.superclass.initValue.call(this);if(this.hiddenField){this.hiddenField.value=Ext.value(Ext.isDefined(this.hiddenValue)?this.hiddenValue:this.value,\"\")}},getParentZIndex:function(){var a;if(this.ownerCt){this.findParentBy(function(b){a=parseInt(b.getPositionEl().getStyle(\"z-index\"),10);return !!a})}return a},getZIndex:function(b){b=b||Ext.getDom(this.getListParent()||Ext.getBody());var a=parseInt(Ext.fly(b).getStyle(\"z-index\"),10);if(!a){a=this.getParentZIndex()}return(a||12000)+5},initList:function(){if(!this.list){var a=\"x-combo-list\",c=Ext.getDom(this.getListParent()||Ext.getBody());this.list=new Ext.Layer({parentEl:c,shadow:this.shadow,cls:[a,this.listClass].join(\" \"),constrain:false,zindex:this.getZIndex(c)});var b=this.listWidth||Math.max(this.wrap.getWidth(),this.minListWidth);this.list.setSize(b,0);this.list.swallowEvent(\"mousewheel\");this.assetHeight=0;if(this.syncFont!==false){this.list.setStyle(\"font-size\",this.el.getStyle(\"font-size\"))}if(this.title){this.header=this.list.createChild({cls:a+\"-hd\",html:this.title});this.assetHeight+=this.header.getHeight()}this.innerList=this.list.createChild({cls:a+\"-inner\"});this.mon(this.innerList,\"mouseover\",this.onViewOver,this);this.mon(this.innerList,\"mousemove\",this.onViewMove,this);this.innerList.setWidth(b-this.list.getFrameWidth(\"lr\"));if(this.pageSize){this.footer=this.list.createChild({cls:a+\"-ft\"});this.pageTb=new Ext.PagingToolbar({store:this.store,pageSize:this.pageSize,renderTo:this.footer});this.assetHeight+=this.footer.getHeight()}if(!this.tpl){this.tpl='<tpl for=\".\"><div class=\"'+a+'-item\">{'+this.displayField+\"}</div></tpl>\"}this.view=new Ext.DataView({applyTo:this.innerList,tpl:this.tpl,singleSelect:true,selectedClass:this.selectedClass,itemSelector:this.itemSelector||\".\"+a+\"-item\",emptyText:this.listEmptyText,deferEmptyText:false});this.mon(this.view,{containerclick:this.onViewClick,click:this.onViewClick,scope:this});this.bindStore(this.store,true);if(this.resizable){this.resizer=new Ext.Resizable(this.list,{pinned:true,handles:\"se\"});this.mon(this.resizer,\"resize\",function(g,d,e){this.maxHeight=e-this.handleHeight-this.list.getFrameWidth(\"tb\")-this.assetHeight;this.listWidth=d;this.innerList.setWidth(d-this.list.getFrameWidth(\"lr\"));this.restrictHeight()},this);this[this.pageSize?\"footer\":\"innerList\"].setStyle(\"margin-bottom\",this.handleHeight+\"px\")}}},getListParent:function(){return document.body},getStore:function(){return this.store},bindStore:function(a,b){if(this.store&&!b){if(this.store!==a&&this.store.autoDestroy){this.store.destroy()}else{this.store.un(\"beforeload\",this.onBeforeLoad,this);this.store.un(\"load\",this.onLoad,this);this.store.un(\"exception\",this.collapse,this)}if(!a){this.store=null;if(this.view){this.view.bindStore(null)}if(this.pageTb){this.pageTb.bindStore(null)}}}if(a){if(!b){this.lastQuery=null;if(this.pageTb){this.pageTb.bindStore(a)}}this.store=Ext.StoreMgr.lookup(a);this.store.on({scope:this,beforeload:this.onBeforeLoad,load:this.onLoad,exception:this.collapse});if(this.view){this.view.bindStore(a)}}},reset:function(){if(this.clearFilterOnReset&&this.mode==\"local\"){this.store.clearFilter()}Ext.form.ComboBox.superclass.reset.call(this)},initEvents:function(){Ext.form.ComboBox.superclass.initEvents.call(this);this.keyNav=new Ext.KeyNav(this.el,{up:function(a){this.inKeyMode=true;this.selectPrev()},down:function(a){if(!this.isExpanded()){this.onTriggerClick()}else{this.inKeyMode=true;this.selectNext()}},enter:function(a){this.onViewClick()},esc:function(a){this.collapse()},tab:function(a){if(this.forceSelection===true){this.collapse()}else{this.onViewClick(false)}return true},scope:this,doRelay:function(c,b,a){if(a==\"down\"||this.scope.isExpanded()){var d=Ext.KeyNav.prototype.doRelay.apply(this,arguments);if((((Ext.isIE9&&Ext.isStrict)||Ext.isIE10p)||!Ext.isIE)&&Ext.EventManager.useKeydown){this.scope.fireKey(c)}return d}return true},forceKeyDown:true,defaultEventAction:\"stopEvent\"});this.queryDelay=Math.max(this.queryDelay||10,this.mode==\"local\"?10:250);this.dqTask=new Ext.util.DelayedTask(this.initQuery,this);if(this.typeAhead){this.taTask=new Ext.util.DelayedTask(this.onTypeAhead,this)}if(!this.enableKeyEvents){this.mon(this.el,\"keyup\",this.onKeyUp,this)}},onDestroy:function(){if(this.dqTask){this.dqTask.cancel();this.dqTask=null}this.bindStore(null);Ext.destroy(this.resizer,this.view,this.pageTb,this.list);Ext.destroyMembers(this,\"hiddenField\");Ext.form.ComboBox.superclass.onDestroy.call(this)},fireKey:function(a){if(!this.isExpanded()){Ext.form.ComboBox.superclass.fireKey.call(this,a)}},onResize:function(a,b){Ext.form.ComboBox.superclass.onResize.apply(this,arguments);if(!isNaN(a)&&this.isVisible()&&this.list){this.doResize(a)}else{this.bufferSize=a}},doResize:function(a){if(!Ext.isDefined(this.listWidth)){var b=Math.max(a,this.minListWidth);this.list.setWidth(b);this.innerList.setWidth(b-this.list.getFrameWidth(\"lr\"))}},onEnable:function(){Ext.form.ComboBox.superclass.onEnable.apply(this,arguments);if(this.hiddenField){this.hiddenField.disabled=false}},onDisable:function(){Ext.form.ComboBox.superclass.onDisable.apply(this,arguments);if(this.hiddenField){this.hiddenField.disabled=true}},onBeforeLoad:function(){if(!this.hasFocus){return}this.innerList.update(this.loadingText?'<div class=\"loading-indicator\">'+this.loadingText+\"</div>\":\"\");this.restrictHeight();this.selectedIndex=-1},onLoad:function(){if(!this.hasFocus){return}if(this.store.getCount()>0||this.listEmptyText){this.expand();this.restrictHeight();if(this.lastQuery==this.allQuery){if(this.editable){this.el.dom.select()}if(this.autoSelect!==false&&!this.selectByValue(this.value,true)){this.select(0,true)}}else{if(this.autoSelect!==false){this.selectNext()}if(this.typeAhead&&this.lastKey!=Ext.EventObject.BACKSPACE&&this.lastKey!=Ext.EventObject.DELETE){this.taTask.delay(this.typeAheadDelay)}}}else{this.collapse()}},onTypeAhead:function(){if(this.store.getCount()>0){var b=this.store.getAt(0);var c=b.data[this.displayField];var a=c.length;var d=this.getRawValue().length;if(d!=a){this.setRawValue(c);this.selectText(d,c.length)}}},assertValue:function(){var b=this.getRawValue(),a;if(this.valueField&&Ext.isDefined(this.value)){a=this.findRecord(this.valueField,this.value)}if(!a||a.get(this.displayField)!=b){a=this.findRecord(this.displayField,b)}if(!a&&this.forceSelection){if(b.length>0&&b!=this.emptyText){this.el.dom.value=Ext.value(this.lastSelectionText,\"\");this.applyEmptyText()}else{this.clearValue()}}else{if(a&&this.valueField){if(this.value==b){return}b=a.get(this.valueField||this.displayField)}this.setValue(b)}},onSelect:function(a,b){if(this.fireEvent(\"beforeselect\",this,a,b)!==false){this.setValue(a.data[this.valueField||this.displayField]);this.collapse();this.fireEvent(\"select\",this,a,b)}},getName:function(){var a=this.hiddenField;return a&&a.name?a.name:this.hiddenName||Ext.form.ComboBox.superclass.getName.call(this)},getValue:function(){if(this.valueField){return Ext.isDefined(this.value)?this.value:\"\"}else{return Ext.form.ComboBox.superclass.getValue.call(this)}},clearValue:function(){if(this.hiddenField){this.hiddenField.value=\"\"}this.setRawValue(\"\");this.lastSelectionText=\"\";this.applyEmptyText();this.value=\"\"},setValue:function(a){var c=a;if(this.valueField){var b=this.findRecord(this.valueField,a);if(b){c=b.data[this.displayField]}else{if(Ext.isDefined(this.valueNotFoundText)){c=this.valueNotFoundText}}}this.lastSelectionText=c;if(this.hiddenField){this.hiddenField.value=Ext.value(a,\"\")}Ext.form.ComboBox.superclass.setValue.call(this,c);this.value=a;return this},findRecord:function(c,b){var a;if(this.store.getCount()>0){this.store.each(function(d){if(d.data[c]==b){a=d;return false}})}return a},onViewMove:function(b,a){this.inKeyMode=false},onViewOver:function(d,b){if(this.inKeyMode){return}var c=this.view.findItemFromChild(b);if(c){var a=this.view.indexOf(c);this.select(a,false)}},onViewClick:function(b){var a=this.view.getSelectedIndexes()[0],c=this.store,d=c.getAt(a);if(d){this.onSelect(d,a)}else{this.collapse()}if(b!==false){this.el.focus()}},restrictHeight:function(){this.innerList.dom.style.height=\"\";var b=this.innerList.dom,e=this.list.getFrameWidth(\"tb\")+(this.resizable?this.handleHeight:0)+this.assetHeight,c=Math.max(b.clientHeight,b.offsetHeight,b.scrollHeight),a=this.getPosition()[1]-Ext.getBody().getScroll().top,g=Ext.lib.Dom.getViewHeight()-a-this.getSize().height,d=Math.max(a,g,this.minHeight||0)-this.list.shadowOffset-e-5;c=Math.min(c,d,this.maxHeight);this.innerList.setHeight(c);this.list.beginUpdate();this.list.setHeight(c+e);this.list.alignTo.apply(this.list,[this.el].concat(this.listAlign));this.list.endUpdate()},isExpanded:function(){return this.list&&this.list.isVisible()},selectByValue:function(a,c){if(!Ext.isEmpty(a,true)){var b=this.findRecord(this.valueField||this.displayField,a);if(b){this.select(this.store.indexOf(b),c);return true}}return false},select:function(a,c){this.selectedIndex=a;this.view.select(a);if(c!==false){var b=this.view.getNode(a);if(b){this.innerList.scrollChildIntoView(b,false)}}},selectNext:function(){var a=this.store.getCount();if(a>0){if(this.selectedIndex==-1){this.select(0)}else{if(this.selectedIndex<a-1){this.select(this.selectedIndex+1)}}}},selectPrev:function(){var a=this.store.getCount();if(a>0){if(this.selectedIndex==-1){this.select(0)}else{if(this.selectedIndex!==0){this.select(this.selectedIndex-1)}}}},onKeyUp:function(b){var a=b.getKey();if(this.editable!==false&&this.readOnly!==true&&(a==b.BACKSPACE||!b.isSpecialKey())){this.lastKey=a;this.dqTask.delay(this.queryDelay)}Ext.form.ComboBox.superclass.onKeyUp.call(this,b)},validateBlur:function(){return !this.list||!this.list.isVisible()},initQuery:function(){this.doQuery(this.getRawValue())},beforeBlur:function(){this.assertValue()},postBlur:function(){Ext.form.ComboBox.superclass.postBlur.call(this);this.collapse();this.inKeyMode=false},doQuery:function(c,b){c=Ext.isEmpty(c)?\"\":c;var a={query:c,forceAll:b,combo:this,cancel:false};if(this.fireEvent(\"beforequery\",a)===false||a.cancel){return false}c=a.query;b=a.forceAll;if(b===true||(c.length>=this.minChars)){if(this.lastQuery!==c){this.lastQuery=c;if(this.mode==\"local\"){this.selectedIndex=-1;if(b){this.store.clearFilter()}else{this.store.filter(this.displayField,c)}this.onLoad()}else{this.store.baseParams[this.queryParam]=c;this.store.load({params:this.getParams(c)});this.expand()}}else{this.selectedIndex=-1;this.onLoad()}}},getParams:function(a){var b={},c=this.store.paramNames;if(this.pageSize){b[c.start]=0;b[c.limit]=this.pageSize}return b},collapse:function(){if(!this.isExpanded()){return}this.list.hide();Ext.getDoc().un(\"mousewheel\",this.collapseIf,this);Ext.getDoc().un(\"mousedown\",this.collapseIf,this);this.fireEvent(\"collapse\",this)},collapseIf:function(a){if(!this.isDestroyed&&!a.within(this.wrap)&&!a.within(this.list)){this.collapse()}},expand:function(){if(this.isExpanded()||!this.hasFocus){return}if(this.title||this.pageSize){this.assetHeight=0;if(this.title){this.assetHeight+=this.header.getHeight()}if(this.pageSize){this.assetHeight+=this.footer.getHeight()}}if(this.bufferSize){this.doResize(this.bufferSize);delete this.bufferSize}this.list.alignTo.apply(this.list,[this.el].concat(this.listAlign));this.list.setZIndex(this.getZIndex());this.list.show();if(Ext.isGecko2){this.innerList.setOverflow(\"auto\")}this.mon(Ext.getDoc(),{scope:this,mousewheel:this.collapseIf,mousedown:this.collapseIf});this.fireEvent(\"expand\",this)},onTriggerClick:function(){if(this.readOnly||this.disabled){return}if(this.isExpanded()){this.collapse();this.el.focus()}else{this.onFocus({});if(this.triggerAction==\"all\"){this.doQuery(this.allQuery,true)}else{this.doQuery(this.getRawValue())}this.el.focus()}}});Ext.reg(\"combo\",Ext.form.ComboBox);Ext.form.Checkbox=Ext.extend(Ext.form.Field,{focusClass:undefined,fieldClass:\"x-form-field\",checked:false,boxLabel:\"&#160;\",defaultAutoCreate:{tag:\"input\",type:\"checkbox\",autocomplete:\"off\"},actionMode:\"wrap\",initComponent:function(){Ext.form.Checkbox.superclass.initComponent.call(this);this.addEvents(\"check\")},onResize:function(){Ext.form.Checkbox.superclass.onResize.apply(this,arguments);if(!this.boxLabel&&!this.fieldLabel){this.el.alignTo(this.wrap,\"c-c\")}},initEvents:function(){Ext.form.Checkbox.superclass.initEvents.call(this);this.mon(this.el,{scope:this,click:this.onClick,change:this.onClick})},markInvalid:Ext.emptyFn,clearInvalid:Ext.emptyFn,onRender:function(b,a){Ext.form.Checkbox.superclass.onRender.call(this,b,a);if(this.inputValue!==undefined){this.el.dom.value=this.inputValue}this.wrap=this.el.wrap({cls:\"x-form-check-wrap\"});if(this.boxLabel){this.wrap.createChild({tag:\"label\",htmlFor:this.el.id,cls:\"x-form-cb-label\",html:this.boxLabel})}if(this.checked){this.setValue(true)}else{this.checked=this.el.dom.checked}if(Ext.isIEQuirks){this.wrap.repaint()}this.resizeEl=this.positionEl=this.wrap},onDestroy:function(){Ext.destroy(this.wrap);Ext.form.Checkbox.superclass.onDestroy.call(this)},initValue:function(){this.originalValue=this.getValue()},getValue:function(){if(this.rendered){return this.el.dom.checked}return this.checked},onClick:function(){if(this.el.dom.checked!=this.checked){this.setValue(this.el.dom.checked)}},setValue:function(a){var c=this.checked,b=this.inputValue;if(a===false){this.checked=false}else{this.checked=(a===true||a===\"true\"||a==\"1\"||(b?a==b:String(a).toLowerCase()==\"on\"))}if(this.rendered){this.el.dom.checked=this.checked;this.el.dom.defaultChecked=this.checked}if(c!=this.checked){this.fireEvent(\"check\",this,this.checked);if(this.handler){this.handler.call(this.scope||this,this,this.checked)}}return this}});Ext.reg(\"checkbox\",Ext.form.Checkbox);Ext.form.CheckboxGroup=Ext.extend(Ext.form.Field,{columns:\"auto\",vertical:false,allowBlank:true,blankText:\"You must select at least one item in this group\",defaultType:\"checkbox\",groupCls:\"x-form-check-group\",initComponent:function(){this.addEvents(\"change\");this.on(\"change\",this.validate,this);Ext.form.CheckboxGroup.superclass.initComponent.call(this)},onRender:function(j,g){if(!this.el){var p={autoEl:{id:this.id},cls:this.groupCls,layout:\"column\",renderTo:j,bufferResize:false};var a={xtype:\"container\",defaultType:this.defaultType,layout:\"form\",defaults:{hideLabel:true,anchor:\"100%\"}};if(this.items[0].items){Ext.apply(p,{layoutConfig:{columns:this.items.length},defaults:this.defaults,items:this.items});for(var e=0,m=this.items.length;e<m;e++){Ext.applyIf(this.items[e],a)}}else{var d,n=[];if(typeof this.columns==\"string\"){this.columns=this.items.length}if(!Ext.isArray(this.columns)){var k=[];for(var e=0;e<this.columns;e++){k.push((100/this.columns)*0.01)}this.columns=k}d=this.columns.length;for(var e=0;e<d;e++){var b=Ext.apply({items:[]},a);b[this.columns[e]<=1?\"columnWidth\":\"width\"]=this.columns[e];if(this.defaults){b.defaults=Ext.apply(b.defaults||{},this.defaults)}n.push(b)}if(this.vertical){var r=Math.ceil(this.items.length/d),o=0;for(var e=0,m=this.items.length;e<m;e++){if(e>0&&e%r==0){o++}if(this.items[e].fieldLabel){this.items[e].hideLabel=false}n[o].items.push(this.items[e])}}else{for(var e=0,m=this.items.length;e<m;e++){var q=e%d;if(this.items[e].fieldLabel){this.items[e].hideLabel=false}n[q].items.push(this.items[e])}}Ext.apply(p,{layoutConfig:{columns:d},items:n})}this.panel=new Ext.Container(p);this.panel.ownerCt=this;this.el=this.panel.getEl();if(this.forId&&this.itemCls){var c=this.el.up(this.itemCls).child(\"label\",true);if(c){c.setAttribute(\"htmlFor\",this.forId)}}var h=this.panel.findBy(function(i){return i.isFormField},this);this.items=new Ext.util.MixedCollection();this.items.addAll(h)}Ext.form.CheckboxGroup.superclass.onRender.call(this,j,g)},initValue:function(){if(this.value){this.setValue.apply(this,this.buffered?this.value:[this.value]);delete this.buffered;delete this.value}},afterRender:function(){Ext.form.CheckboxGroup.superclass.afterRender.call(this);this.eachItem(function(a){a.on(\"check\",this.fireChecked,this);a.inGroup=true})},doLayout:function(){if(this.rendered){this.panel.forceLayout=this.ownerCt.forceLayout;this.panel.doLayout()}},fireChecked:function(){var a=[];this.eachItem(function(b){if(b.checked){a.push(b)}});this.fireEvent(\"change\",this,a)},getErrors:function(){var b=Ext.form.CheckboxGroup.superclass.getErrors.apply(this,arguments);if(!this.allowBlank){var a=true;this.eachItem(function(c){if(c.checked){return(a=false)}});if(a){b.push(this.blankText)}}return b},isDirty:function(){if(this.disabled||!this.rendered){return false}var a=false;this.eachItem(function(b){if(b.isDirty()){a=true;return false}});return a},setReadOnly:function(a){if(this.rendered){this.eachItem(function(b){b.setReadOnly(a)})}this.readOnly=a},onDisable:function(){this.eachItem(function(a){a.disable()})},onEnable:function(){this.eachItem(function(a){a.enable()})},onResize:function(a,b){this.panel.setSize(a,b);this.panel.doLayout()},reset:function(){if(this.originalValue){this.eachItem(function(a){if(a.setValue){a.setValue(false);a.originalValue=a.getValue()}});this.resetOriginal=true;this.setValue(this.originalValue);delete this.resetOriginal}else{this.eachItem(function(a){if(a.reset){a.reset()}})}(function(){this.clearInvalid()}).defer(50,this)},setValue:function(){if(this.rendered){this.onSetValue.apply(this,arguments)}else{this.buffered=true;this.value=arguments}return this},onSetValue:function(d,c){if(arguments.length==1){if(Ext.isArray(d)){Ext.each(d,function(h,e){if(Ext.isObject(h)&&h.setValue){h.setValue(true);if(this.resetOriginal===true){h.originalValue=h.getValue()}}else{var g=this.items.itemAt(e);if(g){g.setValue(h)}}},this)}else{if(Ext.isObject(d)){for(var a in d){var b=this.getBox(a);if(b){b.setValue(d[a])}}}else{this.setValueForItem(d)}}}else{var b=this.getBox(d);if(b){b.setValue(c)}}},beforeDestroy:function(){Ext.destroy(this.panel);if(!this.rendered){Ext.destroy(this.items)}Ext.form.CheckboxGroup.superclass.beforeDestroy.call(this)},setValueForItem:function(a){a=String(a).split(\",\");this.eachItem(function(b){if(a.indexOf(b.inputValue)>-1){b.setValue(true)}})},getBox:function(b){var a=null;this.eachItem(function(c){if(b==c||c.dataIndex==b||c.id==b||c.getName()==b){a=c;return false}});return a},getValue:function(){var a=[];this.eachItem(function(b){if(b.checked){a.push(b)}});return a},eachItem:function(b,a){if(this.items&&this.items.each){this.items.each(b,a||this)}},getRawValue:Ext.emptyFn,setRawValue:Ext.emptyFn});Ext.reg(\"checkboxgroup\",Ext.form.CheckboxGroup);Ext.form.CompositeField=Ext.extend(Ext.form.Field,{defaultMargins:\"0 5 0 0\",skipLastItemMargin:true,isComposite:true,combineErrors:true,labelConnector:\", \",initComponent:function(){var g=[],b=this.items,e;for(var d=0,c=b.length;d<c;d++){e=b[d];if(!Ext.isEmpty(e.ref)){e.ref=\"../\"+e.ref}g.push(e.fieldLabel);Ext.applyIf(e,this.defaults);if(!(d==c-1&&this.skipLastItemMargin)){Ext.applyIf(e,{margins:this.defaultMargins})}}this.fieldLabel=this.fieldLabel||this.buildLabel(g);this.fieldErrors=new Ext.util.MixedCollection(true,function(h){return h.field});this.fieldErrors.on({scope:this,add:this.updateInvalidMark,remove:this.updateInvalidMark,replace:this.updateInvalidMark});Ext.form.CompositeField.superclass.initComponent.apply(this,arguments);this.innerCt=new Ext.Container({layout:\"hbox\",items:this.items,cls:\"x-form-composite\",defaultMargins:\"0 3 0 0\",ownerCt:this});delete this.innerCt.ownerCt;var a=this.innerCt.findBy(function(h){return h.isFormField},this);this.items=new Ext.util.MixedCollection();this.items.addAll(a)},onRender:function(c,a){if(!this.el){var d=this.innerCt;d.render(c);this.innerCt.ownerCt=this;this.el=d.getEl();if(this.combineErrors){this.eachItem(function(e){Ext.apply(e,{markInvalid:this.onFieldMarkInvalid.createDelegate(this,[e],0),clearInvalid:this.onFieldClearInvalid.createDelegate(this,[e],0)})})}var b=this.el.parent().parent().child(\"label\",true);if(b){b.setAttribute(\"for\",this.items.items[0].id)}}Ext.form.CompositeField.superclass.onRender.apply(this,arguments)},onFieldMarkInvalid:function(d,c){var b=d.getName(),a={field:b,errorName:d.fieldLabel||b,error:c};this.fieldErrors.replace(b,a);if(!d.preventMark){d.el.addClass(d.invalidClass)}},onFieldClearInvalid:function(a){this.fieldErrors.removeKey(a.getName());a.el.removeClass(a.invalidClass)},updateInvalidMark:function(){var a=Ext.isIE6&&Ext.isStrict;if(this.fieldErrors.length==0){this.clearInvalid();if(a){this.clearInvalid.defer(50,this)}}else{var b=this.buildCombinedErrorMessage(this.fieldErrors.items);this.sortErrors();this.markInvalid(b);if(a){this.markInvalid(b)}}},validateValue:function(c,a){var b=true;this.eachItem(function(d){if(!d.isValid(a)){b=false}});return b},buildCombinedErrorMessage:function(e){var d=[],b;for(var c=0,a=e.length;c<a;c++){b=e[c];d.push(String.format(\"{0}: {1}\",b.errorName,b.error))}return d.join(\"<br />\")},sortErrors:function(){var a=this.items;this.fieldErrors.sort(\"ASC\",function(g,d){var c=function(b){return function(i){return i.getName()==b}};var h=a.findIndexBy(c(g.field)),e=a.findIndexBy(c(d.field));return h<e?-1:1})},reset:function(){this.eachItem(function(a){a.reset()});(function(){this.clearInvalid()}).defer(50,this)},clearInvalidChildren:function(){this.eachItem(function(a){a.clearInvalid()})},buildLabel:function(a){return Ext.clean(a).join(this.labelConnector)},isDirty:function(){if(this.disabled||!this.rendered){return false}var a=false;this.eachItem(function(b){if(b.isDirty()){a=true;return false}});return a},eachItem:function(b,a){if(this.items&&this.items.each){this.items.each(b,a||this)}},onResize:function(e,c,a,d){var b=this.innerCt;if(this.rendered&&b.rendered){b.setSize(e,c)}Ext.form.CompositeField.superclass.onResize.apply(this,arguments)},doLayout:function(c,b){if(this.rendered){var a=this.innerCt;a.forceLayout=this.ownerCt.forceLayout;a.doLayout(c,b)}},beforeDestroy:function(){Ext.destroy(this.innerCt);Ext.form.CompositeField.superclass.beforeDestroy.call(this)},setReadOnly:function(a){if(a==undefined){a=true}a=!!a;if(this.rendered){this.eachItem(function(b){b.setReadOnly(a)})}this.readOnly=a},onShow:function(){Ext.form.CompositeField.superclass.onShow.call(this);this.doLayout()},onDisable:function(){this.eachItem(function(a){a.disable()})},onEnable:function(){this.eachItem(function(a){a.enable()})}});Ext.reg(\"compositefield\",Ext.form.CompositeField);Ext.form.Radio=Ext.extend(Ext.form.Checkbox,{inputType:\"radio\",markInvalid:Ext.emptyFn,clearInvalid:Ext.emptyFn,getGroupValue:function(){var a=this.el.up(\"form\")||Ext.getBody();var b=a.child('input[name=\"'+this.el.dom.name+'\"]:checked',true);return b?b.value:null},setValue:function(b){var a,d,c;if(typeof b==\"boolean\"){Ext.form.Radio.superclass.setValue.call(this,b)}else{if(this.rendered){a=this.getCheckEl();c=a.child('input[name=\"'+this.el.dom.name+'\"][value=\"'+b+'\"]',true);if(c){Ext.getCmp(c.id).setValue(true)}}}if(this.rendered&&this.checked){a=a||this.getCheckEl();d=this.getCheckEl().select('input[name=\"'+this.el.dom.name+'\"]');d.each(function(e){if(e.dom.id!=this.id){Ext.getCmp(e.dom.id).setValue(false)}},this)}return this},getCheckEl:function(){if(this.inGroup){return this.el.up(\".x-form-radio-group\")}return this.el.up(\"form\")||Ext.getBody()}});Ext.reg(\"radio\",Ext.form.Radio);Ext.form.RadioGroup=Ext.extend(Ext.form.CheckboxGroup,{allowBlank:true,blankText:\"You must select one item in this group\",defaultType:\"radio\",groupCls:\"x-form-radio-group\",getValue:function(){var a=null;this.eachItem(function(b){if(b.checked){a=b;return false}});return a},onSetValue:function(c,b){if(arguments.length>1){var a=this.getBox(c);if(a){a.setValue(b);if(a.checked){this.eachItem(function(d){if(d!==a){d.setValue(false)}})}}}else{this.setValueForItem(c)}},setValueForItem:function(a){a=String(a).split(\",\")[0];this.eachItem(function(b){b.setValue(a==b.inputValue)})},fireChecked:function(){if(!this.checkTask){this.checkTask=new Ext.util.DelayedTask(this.bufferChecked,this)}this.checkTask.delay(10)},bufferChecked:function(){var a=null;this.eachItem(function(b){if(b.checked){a=b;return false}});this.fireEvent(\"change\",this,a)},onDestroy:function(){if(this.checkTask){this.checkTask.cancel();this.checkTask=null}Ext.form.RadioGroup.superclass.onDestroy.call(this)}});Ext.reg(\"radiogroup\",Ext.form.RadioGroup);Ext.form.Hidden=Ext.extend(Ext.form.Field,{inputType:\"hidden\",shouldLayout:false,onRender:function(){Ext.form.Hidden.superclass.onRender.apply(this,arguments)},initEvents:function(){this.originalValue=this.getValue()},setSize:Ext.emptyFn,setWidth:Ext.emptyFn,setHeight:Ext.emptyFn,setPosition:Ext.emptyFn,setPagePosition:Ext.emptyFn,markInvalid:Ext.emptyFn,clearInvalid:Ext.emptyFn});Ext.reg(\"hidden\",Ext.form.Hidden);Ext.form.BasicForm=Ext.extend(Ext.util.Observable,{constructor:function(b,a){Ext.apply(this,a);if(Ext.isString(this.paramOrder)){this.paramOrder=this.paramOrder.split(/[\\s,|]/)}this.items=new Ext.util.MixedCollection(false,function(c){return c.getItemId()});this.addEvents(\"beforeaction\",\"actionfailed\",\"actioncomplete\");if(b){this.initEl(b)}Ext.form.BasicForm.superclass.constructor.call(this)},timeout:30,paramOrder:undefined,paramsAsHash:false,waitTitle:\"Please Wait...\",activeAction:null,trackResetOnLoad:false,initEl:function(a){this.el=Ext.get(a);this.id=this.el.id||Ext.id();if(!this.standardSubmit){this.el.on(\"submit\",this.onSubmit,this)}this.el.addClass(\"x-form\")},getEl:function(){return this.el},onSubmit:function(a){a.stopEvent()},destroy:function(a){if(a!==true){this.items.each(function(b){Ext.destroy(b)});Ext.destroy(this.el)}this.items.clear();this.purgeListeners()},isValid:function(){var a=true;this.items.each(function(b){if(!b.validate()){a=false}});return a},isDirty:function(){var a=false;this.items.each(function(b){if(b.isDirty()){a=true;return false}});return a},doAction:function(b,a){if(Ext.isString(b)){b=new Ext.form.Action.ACTION_TYPES[b](this,a)}if(this.fireEvent(\"beforeaction\",this,b)!==false){this.beforeAction(b);b.run.defer(100,b)}return this},submit:function(b){b=b||{};if(this.standardSubmit){var a=b.clientValidation===false||this.isValid();if(a){var c=this.el.dom;if(this.url&&Ext.isEmpty(c.action)){c.action=this.url}c.submit()}return a}var d=String.format(\"{0}submit\",this.api?\"direct\":\"\");this.doAction(d,b);return this},load:function(a){var b=String.format(\"{0}load\",this.api?\"direct\":\"\");this.doAction(b,a);return this},updateRecord:function(b){b.beginEdit();var a=b.fields,d,c;a.each(function(e){d=this.findField(e.name);if(d){c=d.getValue();if(Ext.type(c)!==false&&c.getGroupValue){c=c.getGroupValue()}else{if(d.eachItem){c=[];d.eachItem(function(g){c.push(g.getValue())})}}b.set(e.name,c)}},this);b.endEdit();return this},loadRecord:function(a){this.setValues(a.data);return this},beforeAction:function(a){this.items.each(function(c){if(c.isFormField&&c.syncValue){c.syncValue()}});var b=a.options;if(b.waitMsg){if(this.waitMsgTarget===true){this.el.mask(b.waitMsg,\"x-mask-loading\")}else{if(this.waitMsgTarget){this.waitMsgTarget=Ext.get(this.waitMsgTarget);this.waitMsgTarget.mask(b.waitMsg,\"x-mask-loading\")}else{Ext.MessageBox.wait(b.waitMsg,b.waitTitle||this.waitTitle)}}}},afterAction:function(a,c){this.activeAction=null;var b=a.options;if(b.waitMsg){if(this.waitMsgTarget===true){this.el.unmask()}else{if(this.waitMsgTarget){this.waitMsgTarget.unmask()}else{Ext.MessageBox.updateProgress(1);Ext.MessageBox.hide()}}}if(c){if(b.reset){this.reset()}Ext.callback(b.success,b.scope,[this,a]);this.fireEvent(\"actioncomplete\",this,a)}else{Ext.callback(b.failure,b.scope,[this,a]);this.fireEvent(\"actionfailed\",this,a)}},findField:function(c){var b=this.items.get(c);if(!Ext.isObject(b)){var a=function(d){if(d.isFormField){if(d.dataIndex==c||d.id==c||d.getName()==c){b=d;return false}else{if(d.isComposite){return d.items.each(a)}else{if(d instanceof Ext.form.CheckboxGroup&&d.rendered){return d.eachItem(a)}}}}};this.items.each(a)}return b||null},markInvalid:function(h){if(Ext.isArray(h)){for(var c=0,a=h.length;c<a;c++){var b=h[c];var d=this.findField(b.id);if(d){d.markInvalid(b.msg)}}}else{var e,g;for(g in h){if(!Ext.isFunction(h[g])&&(e=this.findField(g))){e.markInvalid(h[g])}}}return this},setValues:function(c){if(Ext.isArray(c)){for(var d=0,a=c.length;d<a;d++){var b=c[d];var e=this.findField(b.id);if(e){e.setValue(b.value);if(this.trackResetOnLoad){e.originalValue=e.getValue()}}}}else{var g,h;for(h in c){if(!Ext.isFunction(c[h])&&(g=this.findField(h))){g.setValue(c[h]);if(this.trackResetOnLoad){g.originalValue=g.getValue()}}}}return this},getValues:function(b){var a=Ext.lib.Ajax.serializeForm(this.el.dom);if(b===true){return a}return Ext.urlDecode(a)},getFieldValues:function(a){var d={},e,b,c;this.items.each(function(g){if(!g.disabled&&(a!==true||g.isDirty())){e=g.getName();b=d[e];c=g.getValue();if(Ext.isDefined(b)){if(Ext.isArray(b)){d[e].push(c)}else{d[e]=[b,c]}}else{d[e]=c}}});return d},clearInvalid:function(){this.items.each(function(a){a.clearInvalid()});return this},reset:function(){this.items.each(function(a){a.reset()});return this},add:function(){this.items.addAll(Array.prototype.slice.call(arguments,0));return this},remove:function(a){this.items.remove(a);return this},cleanDestroyed:function(){this.items.filterBy(function(a){return !!a.isDestroyed}).each(this.remove,this)},render:function(){this.items.each(function(a){if(a.isFormField&&!a.rendered&&document.getElementById(a.id)){a.applyToMarkup(a.id)}});return this},applyToFields:function(a){this.items.each(function(b){Ext.apply(b,a)});return this},applyIfToFields:function(a){this.items.each(function(b){Ext.applyIf(b,a)});return this},callFieldMethod:function(b,a){a=a||[];this.items.each(function(c){if(Ext.isFunction(c[b])){c[b].apply(c,a)}});return this}});Ext.BasicForm=Ext.form.BasicForm;Ext.FormPanel=Ext.extend(Ext.Panel,{minButtonWidth:75,labelAlign:\"left\",monitorValid:false,monitorPoll:200,layout:\"form\",initComponent:function(){this.form=this.createForm();Ext.FormPanel.superclass.initComponent.call(this);this.bodyCfg={tag:\"form\",cls:this.baseCls+\"-body\",method:this.method||\"POST\",id:this.formId||Ext.id()};if(this.fileUpload){this.bodyCfg.enctype=\"multipart/form-data\"}this.initItems();this.addEvents(\"clientvalidation\");this.relayEvents(this.form,[\"beforeaction\",\"actionfailed\",\"actioncomplete\"])},createForm:function(){var a=Ext.applyIf({listeners:{}},this.initialConfig);return new Ext.form.BasicForm(null,a)},initFields:function(){var c=this.form;var a=this;var b=function(d){if(a.isField(d)){c.add(d)}else{if(d.findBy&&d!=a){a.applySettings(d);if(d.items&&d.items.each){d.items.each(b,this)}}}};this.items.each(b,this)},applySettings:function(b){var a=b.ownerCt;Ext.applyIf(b,{labelAlign:a.labelAlign,labelWidth:a.labelWidth,itemCls:a.itemCls})},getLayoutTarget:function(){return this.form.el},getForm:function(){return this.form},onRender:function(b,a){this.initFields();Ext.FormPanel.superclass.onRender.call(this,b,a);this.form.initEl(this.body)},beforeDestroy:function(){this.stopMonitoring();this.form.destroy(true);Ext.FormPanel.superclass.beforeDestroy.call(this)},isField:function(a){return !!a.setValue&&!!a.getValue&&!!a.markInvalid&&!!a.clearInvalid},initEvents:function(){Ext.FormPanel.superclass.initEvents.call(this);this.on({scope:this,add:this.onAddEvent,remove:this.onRemoveEvent});if(this.monitorValid){this.startMonitoring()}},onAdd:function(a){Ext.FormPanel.superclass.onAdd.call(this,a);this.processAdd(a)},onAddEvent:function(a,b){if(a!==this){this.processAdd(b)}},processAdd:function(a){if(this.isField(a)){this.form.add(a)}else{if(a.findBy){this.applySettings(a);this.form.add.apply(this.form,a.findBy(this.isField))}}},onRemove:function(a){Ext.FormPanel.superclass.onRemove.call(this,a);this.processRemove(a)},onRemoveEvent:function(a,b){if(a!==this){this.processRemove(b)}},processRemove:function(a){if(!this.destroying){if(this.isField(a)){this.form.remove(a)}else{if(a.findBy){Ext.each(a.findBy(this.isField),this.form.remove,this.form);this.form.cleanDestroyed()}}}},startMonitoring:function(){if(!this.validTask){this.validTask=new Ext.util.TaskRunner();this.validTask.start({run:this.bindHandler,interval:this.monitorPoll||200,scope:this})}},stopMonitoring:function(){if(this.validTask){this.validTask.stopAll();this.validTask=null}},load:function(){this.form.load.apply(this.form,arguments)},onDisable:function(){Ext.FormPanel.superclass.onDisable.call(this);if(this.form){this.form.items.each(function(){this.disable()})}},onEnable:function(){Ext.FormPanel.superclass.onEnable.call(this);if(this.form){this.form.items.each(function(){this.enable()})}},bindHandler:function(){var e=true;this.form.items.each(function(g){if(!g.isValid(true)){e=false;return false}});if(this.fbar){var b=this.fbar.items.items;for(var d=0,a=b.length;d<a;d++){var c=b[d];if(c.formBind===true&&c.disabled===e){c.setDisabled(!e)}}}this.fireEvent(\"clientvalidation\",this,e)}});Ext.reg(\"form\",Ext.FormPanel);Ext.form.FormPanel=Ext.FormPanel;Ext.form.FieldSet=Ext.extend(Ext.Panel,{baseCls:\"x-fieldset\",layout:\"form\",animCollapse:false,onRender:function(b,a){if(!this.el){this.el=document.createElement(\"fieldset\");this.el.id=this.id;if(this.title||this.header||this.checkboxToggle){this.el.appendChild(document.createElement(\"legend\")).className=this.baseCls+\"-header\"}}Ext.form.FieldSet.superclass.onRender.call(this,b,a);if(this.checkboxToggle){var c=typeof this.checkboxToggle==\"object\"?this.checkboxToggle:{tag:\"input\",type:\"checkbox\",name:this.checkboxName||this.id+\"-checkbox\"};this.checkbox=this.header.insertFirst(c);this.checkbox.dom.checked=!this.collapsed;this.mon(this.checkbox,\"click\",this.onCheckClick,this)}},onCollapse:function(a,b){if(this.checkbox){this.checkbox.dom.checked=false}Ext.form.FieldSet.superclass.onCollapse.call(this,a,b)},onExpand:function(a,b){if(this.checkbox){this.checkbox.dom.checked=true}Ext.form.FieldSet.superclass.onExpand.call(this,a,b)},onCheckClick:function(){this[this.checkbox.dom.checked?\"expand\":\"collapse\"]()}});Ext.reg(\"fieldset\",Ext.form.FieldSet);Ext.form.HtmlEditor=Ext.extend(Ext.form.Field,{enableFormat:true,enableFontSize:true,enableColors:true,enableAlignments:true,enableLists:true,enableSourceEdit:true,enableLinks:true,enableFont:true,createLinkText:\"Please enter the URL for the link:\",defaultLinkValue:\"http://\",fontFamilies:[\"Arial\",\"Courier New\",\"Tahoma\",\"Times New Roman\",\"Verdana\"],defaultFont:\"tahoma\",defaultValue:(Ext.isOpera||Ext.isIE6)?\"&#160;\":\"&#8203;\",actionMode:\"wrap\",validationEvent:false,deferHeight:true,initialized:false,activated:false,sourceEditMode:false,onFocus:Ext.emptyFn,iframePad:3,hideMode:\"offsets\",defaultAutoCreate:{tag:\"textarea\",style:\"width:500px;height:300px;\",autocomplete:\"off\"},initComponent:function(){this.addEvents(\"initialize\",\"activate\",\"beforesync\",\"beforepush\",\"sync\",\"push\",\"editmodechange\");Ext.form.HtmlEditor.superclass.initComponent.call(this)},createFontOptions:function(){var d=[],b=this.fontFamilies,c,g;for(var e=0,a=b.length;e<a;e++){c=b[e];g=c.toLowerCase();d.push('<option value=\"',g,'\" style=\"font-family:',c,';\"',(this.defaultFont==g?' selected=\"true\">':\">\"),c,\"</option>\")}return d.join(\"\")},createToolbar:function(e){var c=[];var a=Ext.QuickTips&&Ext.QuickTips.isEnabled();function d(j,h,i){return{itemId:j,cls:\"x-btn-icon\",iconCls:\"x-edit-\"+j,enableToggle:h!==false,scope:e,handler:i||e.relayBtnCmd,clickEvent:\"mousedown\",tooltip:a?e.buttonTips[j]||undefined:undefined,overflowText:e.buttonTips[j].title||undefined,tabIndex:-1}}if(this.enableFont&&!Ext.isSafari2){var g=new Ext.Toolbar.Item({autoEl:{tag:\"select\",cls:\"x-font-select\",html:this.createFontOptions()}});c.push(g,\"-\")}if(this.enableFormat){c.push(d(\"bold\"),d(\"italic\"),d(\"underline\"))}if(this.enableFontSize){c.push(\"-\",d(\"increasefontsize\",false,this.adjustFont),d(\"decreasefontsize\",false,this.adjustFont))}if(this.enableColors){c.push(\"-\",{itemId:\"forecolor\",cls:\"x-btn-icon\",iconCls:\"x-edit-forecolor\",clickEvent:\"mousedown\",tooltip:a?e.buttonTips.forecolor||undefined:undefined,tabIndex:-1,menu:new Ext.menu.ColorMenu({allowReselect:true,focus:Ext.emptyFn,value:\"000000\",plain:true,listeners:{scope:this,select:function(i,h){this.execCmd(\"forecolor\",Ext.isWebKit||Ext.isIE?\"#\"+h:h);this.deferFocus()}},clickEvent:\"mousedown\"})},{itemId:\"backcolor\",cls:\"x-btn-icon\",iconCls:\"x-edit-backcolor\",clickEvent:\"mousedown\",tooltip:a?e.buttonTips.backcolor||undefined:undefined,tabIndex:-1,menu:new Ext.menu.ColorMenu({focus:Ext.emptyFn,value:\"FFFFFF\",plain:true,allowReselect:true,listeners:{scope:this,select:function(i,h){if(Ext.isGecko){this.execCmd(\"useCSS\",false);this.execCmd(\"hilitecolor\",h);this.execCmd(\"useCSS\",true);this.deferFocus()}else{this.execCmd(Ext.isOpera?\"hilitecolor\":\"backcolor\",Ext.isWebKit||Ext.isIE?\"#\"+h:h);this.deferFocus()}}},clickEvent:\"mousedown\"})})}if(this.enableAlignments){c.push(\"-\",d(\"justifyleft\"),d(\"justifycenter\"),d(\"justifyright\"))}if(!Ext.isSafari2){if(this.enableLinks){c.push(\"-\",d(\"createlink\",false,this.createLink))}if(this.enableLists){c.push(\"-\",d(\"insertorderedlist\"),d(\"insertunorderedlist\"))}if(this.enableSourceEdit){c.push(\"-\",d(\"sourceedit\",true,function(h){this.toggleSourceEdit(!this.sourceEditMode)}))}}var b=new Ext.Toolbar({renderTo:this.wrap.dom.firstChild,items:c});if(g){this.fontSelect=g.el;this.mon(this.fontSelect,\"change\",function(){var h=this.fontSelect.dom.value;this.relayCmd(\"fontname\",h);this.deferFocus()},this)}this.mon(b.el,\"click\",function(h){h.preventDefault()});this.tb=b;this.tb.doLayout()},onDisable:function(){this.wrap.mask();Ext.form.HtmlEditor.superclass.onDisable.call(this)},onEnable:function(){this.wrap.unmask();Ext.form.HtmlEditor.superclass.onEnable.call(this)},setReadOnly:function(b){Ext.form.HtmlEditor.superclass.setReadOnly.call(this,b);if(this.initialized){if(Ext.isIE){this.getEditorBody().contentEditable=!b}else{this.setDesignMode(!b)}var a=this.getEditorBody();if(a){a.style.cursor=this.readOnly?\"default\":\"text\"}this.disableItems(b)}},getDocMarkup:function(){var a=Ext.fly(this.iframe).getHeight()-this.iframePad*2;return String.format('<html><head><style type=\"text/css\">body{border: 0; margin: 0; padding: {0}px; height: {1}px; cursor: text}</style></head><body></body></html>',this.iframePad,a)},getEditorBody:function(){var a=this.getDoc();return a.body||a.documentElement},getDoc:function(){return Ext.isIE?this.getWin().document:(this.iframe.contentDocument||this.getWin().document)},getWin:function(){return Ext.isIE?this.iframe.contentWindow:window.frames[this.iframe.name]},onRender:function(b,a){Ext.form.HtmlEditor.superclass.onRender.call(this,b,a);this.el.dom.style.border=\"0 none\";this.el.dom.setAttribute(\"tabIndex\",-1);this.el.addClass(\"x-hidden\");if(Ext.isIE){this.el.applyStyles(\"margin-top:-1px;margin-bottom:-1px;\")}this.wrap=this.el.wrap({cls:\"x-html-editor-wrap\",cn:{cls:\"x-html-editor-tb\"}});this.createToolbar(this);this.disableItems(true);this.tb.doLayout();this.createIFrame();if(!this.width){var c=this.el.getSize();this.setSize(c.width,this.height||c.height)}this.resizeEl=this.positionEl=this.wrap},createIFrame:function(){var a=document.createElement(\"iframe\");a.name=Ext.id();a.frameBorder=\"0\";a.style.overflow=\"auto\";a.src=Ext.SSL_SECURE_URL;this.wrap.dom.appendChild(a);this.iframe=a;this.monitorTask=Ext.TaskMgr.start({run:this.checkDesignMode,scope:this,interval:100})},initFrame:function(){Ext.TaskMgr.stop(this.monitorTask);var a=this.getDoc();this.win=this.getWin();a.open();a.write(this.getDocMarkup());a.close();this.readyTask={run:function(){var b=this.getDoc();if(b.body||b.readyState==\"complete\"){Ext.TaskMgr.stop(this.readyTask);this.setDesignMode(true);this.initEditor.defer(10,this)}},interval:10,duration:10000,scope:this};Ext.TaskMgr.start(this.readyTask)},checkDesignMode:function(){if(this.wrap&&this.wrap.dom.offsetWidth){var a=this.getDoc();if(!a){return}if(!a.editorInitialized||this.getDesignMode()!=\"on\"){this.initFrame()}}},setDesignMode:function(b){var a=this.getDoc();if(a){if(this.readOnly){b=false}a.designMode=(/on|true/i).test(String(b).toLowerCase())?\"on\":\"off\"}},getDesignMode:function(){var a=this.getDoc();if(!a){return\"\"}return String(a.designMode).toLowerCase()},disableItems:function(a){if(this.fontSelect){this.fontSelect.dom.disabled=a}this.tb.items.each(function(b){if(b.getItemId()!=\"sourceedit\"){b.setDisabled(a)}})},onResize:function(b,c){Ext.form.HtmlEditor.superclass.onResize.apply(this,arguments);if(this.el&&this.iframe){if(Ext.isNumber(b)){var e=b-this.wrap.getFrameWidth(\"lr\");this.el.setWidth(e);this.tb.setWidth(e);this.iframe.style.width=Math.max(e,0)+\"px\"}if(Ext.isNumber(c)){var a=c-this.wrap.getFrameWidth(\"tb\")-this.tb.el.getHeight();this.el.setHeight(a);this.iframe.style.height=Math.max(a,0)+\"px\";var d=this.getEditorBody();if(d){d.style.height=Math.max((a-(this.iframePad*2)),0)+\"px\"}}}},toggleSourceEdit:function(b){var d,a;if(b===undefined){b=!this.sourceEditMode}this.sourceEditMode=b===true;var c=this.tb.getComponent(\"sourceedit\");if(c.pressed!==this.sourceEditMode){c.toggle(this.sourceEditMode);if(!c.xtbHidden){return}}if(this.sourceEditMode){this.previousSize=this.getSize();d=Ext.get(this.iframe).getHeight();this.disableItems(true);this.syncValue();this.iframe.className=\"x-hidden\";this.el.removeClass(\"x-hidden\");this.el.dom.removeAttribute(\"tabIndex\");this.el.focus();this.el.dom.style.height=d+\"px\"}else{a=parseInt(this.el.dom.style.height,10);if(this.initialized){this.disableItems(this.readOnly)}this.pushValue();this.iframe.className=\"\";this.el.addClass(\"x-hidden\");this.el.dom.setAttribute(\"tabIndex\",-1);this.deferFocus();this.setSize(this.previousSize);delete this.previousSize;this.iframe.style.height=a+\"px\"}this.fireEvent(\"editmodechange\",this,this.sourceEditMode)},createLink:function(){var a=prompt(this.createLinkText,this.defaultLinkValue);if(a&&a!=\"http://\"){this.relayCmd(\"createlink\",a)}},initEvents:function(){this.originalValue=this.getValue()},markInvalid:Ext.emptyFn,clearInvalid:Ext.emptyFn,setValue:function(a){Ext.form.HtmlEditor.superclass.setValue.call(this,a);this.pushValue();return this},cleanHtml:function(a){a=String(a);if(Ext.isWebKit){a=a.replace(/\\sclass=\"(?:Apple-style-span|khtml-block-placeholder)\"/gi,\"\")}if(a.charCodeAt(0)==this.defaultValue.replace(/\\D/g,\"\")){a=a.substring(1)}return a},syncValue:function(){if(this.initialized){var d=this.getEditorBody();var c=d.innerHTML;if(Ext.isWebKit){var b=d.getAttribute(\"style\");var a=b.match(/text-align:(.*?);/i);if(a&&a[1]){c='<div style=\"'+a[0]+'\">'+c+\"</div>\"}}c=this.cleanHtml(c);if(this.fireEvent(\"beforesync\",this,c)!==false){this.el.dom.value=c;this.fireEvent(\"sync\",this,c)}}},getValue:function(){this[this.sourceEditMode?\"pushValue\":\"syncValue\"]();return Ext.form.HtmlEditor.superclass.getValue.call(this)},pushValue:function(){if(this.initialized){var a=this.el.dom.value;if(!this.activated&&a.length<1){a=this.defaultValue}if(this.fireEvent(\"beforepush\",this,a)!==false){this.getEditorBody().innerHTML=a;if(Ext.isGecko){this.setDesignMode(false);this.setDesignMode(true)}this.fireEvent(\"push\",this,a)}}},deferFocus:function(){this.focus.defer(10,this)},focus:function(){if(this.win&&!this.sourceEditMode){this.win.focus()}else{this.el.focus()}},initEditor:function(){try{var c=this.getEditorBody(),a=this.el.getStyles(\"font-size\",\"font-family\",\"background-image\",\"background-repeat\",\"background-color\",\"color\"),g,b;a[\"background-attachment\"]=\"fixed\";c.bgProperties=\"fixed\";Ext.DomHelper.applyStyles(c,a);g=this.getDoc();if(g){try{Ext.EventManager.removeAll(g)}catch(d){}}b=this.onEditorEvent.createDelegate(this);Ext.EventManager.on(g,{mousedown:b,dblclick:b,click:b,keyup:b,buffer:100});if(Ext.isGecko){Ext.EventManager.on(g,\"keypress\",this.applyCommand,this)}if(Ext.isIE||Ext.isWebKit||Ext.isOpera){Ext.EventManager.on(g,\"keydown\",this.fixKeys,this)}g.editorInitialized=true;this.initialized=true;this.pushValue();this.setReadOnly(this.readOnly);this.fireEvent(\"initialize\",this)}catch(d){}},beforeDestroy:function(){if(this.monitorTask){Ext.TaskMgr.stop(this.monitorTask)}if(this.readyTask){Ext.TaskMgr.stop(this.readyTask)}if(this.rendered){Ext.destroy(this.tb);var b=this.getDoc();Ext.EventManager.removeFromSpecialCache(b);if(b){try{Ext.EventManager.removeAll(b);for(var c in b){delete b[c]}}catch(a){}}if(this.wrap){this.wrap.dom.innerHTML=\"\";this.wrap.remove()}}Ext.form.HtmlEditor.superclass.beforeDestroy.call(this)},onFirstFocus:function(){this.activated=true;this.disableItems(this.readOnly);if(Ext.isGecko){this.win.focus();var a=this.win.getSelection();if(!a.focusNode||a.focusNode.nodeType!=3){var b=a.getRangeAt(0);b.selectNodeContents(this.getEditorBody());b.collapse(true);this.deferFocus()}try{this.execCmd(\"useCSS\",true);this.execCmd(\"styleWithCSS\",false)}catch(c){}}this.fireEvent(\"activate\",this)},adjustFont:function(b){var d=b.getItemId()==\"increasefontsize\"?1:-1,c=this.getDoc(),a=parseInt(c.queryCommandValue(\"FontSize\")||2,10);if((Ext.isSafari&&!Ext.isSafari2)||Ext.isChrome||Ext.isAir){if(a<=10){a=1+d}else{if(a<=13){a=2+d}else{if(a<=16){a=3+d}else{if(a<=18){a=4+d}else{if(a<=24){a=5+d}else{a=6+d}}}}}a=a.constrain(1,6)}else{if(Ext.isSafari){d*=2}a=Math.max(1,a+d)+(Ext.isSafari?\"px\":0)}this.execCmd(\"FontSize\",a)},onEditorEvent:function(a){this.updateToolbar()},updateToolbar:function(){if(this.readOnly){return}if(!this.activated){this.onFirstFocus();return}var b=this.tb.items.map,c=this.getDoc();if(this.enableFont&&!Ext.isSafari2){var a=(c.queryCommandValue(\"FontName\")||this.defaultFont).toLowerCase();if(a!=this.fontSelect.dom.value){this.fontSelect.dom.value=a}}if(this.enableFormat){b.bold.toggle(c.queryCommandState(\"bold\"));b.italic.toggle(c.queryCommandState(\"italic\"));b.underline.toggle(c.queryCommandState(\"underline\"))}if(this.enableAlignments){b.justifyleft.toggle(c.queryCommandState(\"justifyleft\"));b.justifycenter.toggle(c.queryCommandState(\"justifycenter\"));b.justifyright.toggle(c.queryCommandState(\"justifyright\"))}if(!Ext.isSafari2&&this.enableLists){b.insertorderedlist.toggle(c.queryCommandState(\"insertorderedlist\"));b.insertunorderedlist.toggle(c.queryCommandState(\"insertunorderedlist\"))}Ext.menu.MenuMgr.hideAll();this.syncValue()},relayBtnCmd:function(a){this.relayCmd(a.getItemId())},relayCmd:function(b,a){(function(){this.focus();this.execCmd(b,a);this.updateToolbar()}).defer(10,this)},execCmd:function(b,a){var c=this.getDoc();c.execCommand(b,false,a===undefined?null:a);this.syncValue()},applyCommand:function(b){if(b.ctrlKey){var d=b.getCharCode(),a;if(d>0){d=String.fromCharCode(d);switch(d){case\"b\":a=\"bold\";break;case\"i\":a=\"italic\";break;case\"u\":a=\"underline\";break}if(a){this.win.focus();this.execCmd(a);this.deferFocus();b.preventDefault()}}}},insertAtCursor:function(c){if(!this.activated){return}if(Ext.isIE){this.win.focus();var b=this.getDoc(),a=b.selection.createRange();if(a){a.pasteHTML(c);this.syncValue();this.deferFocus()}}else{this.win.focus();this.execCmd(\"InsertHTML\",c);this.deferFocus()}},fixKeys:function(){if(Ext.isIE){return function(g){var a=g.getKey(),d=this.getDoc(),b;if(a==g.TAB){g.stopEvent();b=d.selection.createRange();if(b){b.collapse(true);b.pasteHTML(\"&nbsp;&nbsp;&nbsp;&nbsp;\");this.deferFocus()}}else{if(a==g.ENTER){b=d.selection.createRange();if(b){var c=b.parentElement();if(!c||c.tagName.toLowerCase()!=\"li\"){g.stopEvent();b.pasteHTML(\"<br />\");b.collapse(false);b.select()}}}}}}else{if(Ext.isOpera){return function(b){var a=b.getKey();if(a==b.TAB){b.stopEvent();this.win.focus();this.execCmd(\"InsertHTML\",\"&nbsp;&nbsp;&nbsp;&nbsp;\");this.deferFocus()}}}else{if(Ext.isWebKit){return function(b){var a=b.getKey();if(a==b.TAB){b.stopEvent();this.execCmd(\"InsertText\",\"\\t\");this.deferFocus()}else{if(a==b.ENTER){b.stopEvent();this.execCmd(\"InsertHtml\",\"<br /><br />\");this.deferFocus()}}}}}}}(),getToolbar:function(){return this.tb},buttonTips:{bold:{title:\"Bold (Ctrl+B)\",text:\"Make the selected text bold.\",cls:\"x-html-editor-tip\"},italic:{title:\"Italic (Ctrl+I)\",text:\"Make the selected text italic.\",cls:\"x-html-editor-tip\"},underline:{title:\"Underline (Ctrl+U)\",text:\"Underline the selected text.\",cls:\"x-html-editor-tip\"},increasefontsize:{title:\"Grow Text\",text:\"Increase the font size.\",cls:\"x-html-editor-tip\"},decreasefontsize:{title:\"Shrink Text\",text:\"Decrease the font size.\",cls:\"x-html-editor-tip\"},backcolor:{title:\"Text Highlight Color\",text:\"Change the background color of the selected text.\",cls:\"x-html-editor-tip\"},forecolor:{title:\"Font Color\",text:\"Change the color of the selected text.\",cls:\"x-html-editor-tip\"},justifyleft:{title:\"Align Text Left\",text:\"Align text to the left.\",cls:\"x-html-editor-tip\"},justifycenter:{title:\"Center Text\",text:\"Center text in the editor.\",cls:\"x-html-editor-tip\"},justifyright:{title:\"Align Text Right\",text:\"Align text to the right.\",cls:\"x-html-editor-tip\"},insertunorderedlist:{title:\"Bullet List\",text:\"Start a bulleted list.\",cls:\"x-html-editor-tip\"},insertorderedlist:{title:\"Numbered List\",text:\"Start a numbered list.\",cls:\"x-html-editor-tip\"},createlink:{title:\"Hyperlink\",text:\"Make the selected text a hyperlink.\",cls:\"x-html-editor-tip\"},sourceedit:{title:\"Source Edit\",text:\"Switch to source editing mode.\",cls:\"x-html-editor-tip\"}}});Ext.reg(\"htmleditor\",Ext.form.HtmlEditor);Ext.form.TimeField=Ext.extend(Ext.form.ComboBox,{minValue:undefined,maxValue:undefined,minText:\"The time in this field must be equal to or after {0}\",maxText:\"The time in this field must be equal to or before {0}\",invalidText:\"{0} is not a valid time\",format:\"g:i A\",altFormats:\"g:ia|g:iA|g:i a|g:i A|h:i|g:i|H:i|ga|ha|gA|h a|g a|g A|gi|hi|gia|hia|g|H|gi a|hi a|giA|hiA|gi A|hi A\",increment:15,mode:\"local\",triggerAction:\"all\",typeAhead:false,initDate:\"1/1/2008\",initDateFormat:\"j/n/Y\",initComponent:function(){if(Ext.isDefined(this.minValue)){this.setMinValue(this.minValue,true)}if(Ext.isDefined(this.maxValue)){this.setMaxValue(this.maxValue,true)}if(!this.store){this.generateStore(true)}Ext.form.TimeField.superclass.initComponent.call(this)},setMinValue:function(b,a){this.setLimit(b,true,a);return this},setMaxValue:function(b,a){this.setLimit(b,false,a);return this},generateStore:function(b){var c=this.minValue||new Date(this.initDate).clearTime(),a=this.maxValue||new Date(this.initDate).clearTime().add(\"mi\",(24*60)-1),d=[];while(c<=a){d.push(c.dateFormat(this.format));c=c.add(\"mi\",this.increment)}this.bindStore(d,b)},setLimit:function(b,g,a){var e;if(Ext.isString(b)){e=this.parseDate(b)}else{if(Ext.isDate(b)){e=b}}if(e){var c=new Date(this.initDate).clearTime();c.setHours(e.getHours(),e.getMinutes(),e.getSeconds(),e.getMilliseconds());this[g?\"minValue\":\"maxValue\"]=c;if(!a){this.generateStore()}}},getValue:function(){var a=Ext.form.TimeField.superclass.getValue.call(this);return this.formatDate(this.parseDate(a))||\"\"},setValue:function(a){return Ext.form.TimeField.superclass.setValue.call(this,this.formatDate(this.parseDate(a)))},validateValue:Ext.form.DateField.prototype.validateValue,formatDate:Ext.form.DateField.prototype.formatDate,parseDate:function(h){if(!h||Ext.isDate(h)){return h}var j=this.initDate+\" \",g=this.initDateFormat+\" \",b=Date.parseDate(j+h,g+this.format),c=this.altFormats;if(!b&&c){if(!this.altFormatsArray){this.altFormatsArray=c.split(\"|\")}for(var e=0,d=this.altFormatsArray,a=d.length;e<a&&!b;e++){b=Date.parseDate(j+h,g+d[e])}}return b}});Ext.reg(\"timefield\",Ext.form.TimeField);Ext.form.SliderField=Ext.extend(Ext.form.Field,{useTips:true,tipText:null,actionMode:\"wrap\",initComponent:function(){var b=Ext.copyTo({id:this.id+\"-slider\"},this.initialConfig,[\"vertical\",\"minValue\",\"maxValue\",\"decimalPrecision\",\"keyIncrement\",\"increment\",\"clickToChange\",\"animate\"]);if(this.useTips){var a=this.tipText?{getText:this.tipText}:{};b.plugins=[new Ext.slider.Tip(a)]}this.slider=new Ext.Slider(b);Ext.form.SliderField.superclass.initComponent.call(this)},onRender:function(b,a){this.autoCreate={id:this.id,name:this.name,type:\"hidden\",tag:\"input\"};Ext.form.SliderField.superclass.onRender.call(this,b,a);this.wrap=this.el.wrap({cls:\"x-form-field-wrap\"});this.resizeEl=this.positionEl=this.wrap;this.slider.render(this.wrap)},onResize:function(b,c,d,a){Ext.form.SliderField.superclass.onResize.call(this,b,c,d,a);this.slider.setSize(b,c)},initEvents:function(){Ext.form.SliderField.superclass.initEvents.call(this);this.slider.on(\"change\",this.onChange,this)},onChange:function(b,a){this.setValue(a,undefined,true)},onEnable:function(){Ext.form.SliderField.superclass.onEnable.call(this);this.slider.enable()},onDisable:function(){Ext.form.SliderField.superclass.onDisable.call(this);this.slider.disable()},beforeDestroy:function(){Ext.destroy(this.slider);Ext.form.SliderField.superclass.beforeDestroy.call(this)},alignErrorIcon:function(){this.errorIcon.alignTo(this.slider.el,\"tl-tr\",[2,0])},setMinValue:function(a){this.slider.setMinValue(a);return this},setMaxValue:function(a){this.slider.setMaxValue(a);return this},setValue:function(c,b,a){if(!a){this.slider.setValue(c,b)}return Ext.form.SliderField.superclass.setValue.call(this,this.slider.getValue())},getValue:function(){return this.slider.getValue()}});Ext.reg(\"sliderfield\",Ext.form.SliderField);Ext.form.Label=Ext.extend(Ext.BoxComponent,{onRender:function(b,a){if(!this.el){this.el=document.createElement(\"label\");this.el.id=this.getId();this.el.innerHTML=this.text?Ext.util.Format.htmlEncode(this.text):(this.html||\"\");if(this.forId){this.el.setAttribute(\"for\",this.forId)}}Ext.form.Label.superclass.onRender.call(this,b,a)},setText:function(a,b){var c=b===false;this[!c?\"text\":\"html\"]=a;delete this[c?\"text\":\"html\"];if(this.rendered){this.el.dom.innerHTML=b!==false?Ext.util.Format.htmlEncode(a):a}return this}});Ext.reg(\"label\",Ext.form.Label);Ext.form.Action=function(b,a){this.form=b;this.options=a||{}};Ext.form.Action.CLIENT_INVALID=\"client\";Ext.form.Action.SERVER_INVALID=\"server\";Ext.form.Action.CONNECT_FAILURE=\"connect\";Ext.form.Action.LOAD_FAILURE=\"load\";Ext.form.Action.prototype={type:\"default\",run:function(a){},success:function(a){},handleResponse:function(a){},failure:function(a){this.response=a;this.failureType=Ext.form.Action.CONNECT_FAILURE;this.form.afterAction(this,false)},processResponse:function(a){this.response=a;if(!a.responseText&&!a.responseXML){return true}this.result=this.handleResponse(a);return this.result},decodeResponse:function(a){try{return Ext.decode(a.responseText)}catch(b){return false}},getUrl:function(c){var a=this.options.url||this.form.url||this.form.el.dom.action;if(c){var b=this.getParams();if(b){a=Ext.urlAppend(a,b)}}return a},getMethod:function(){return(this.options.method||this.form.method||this.form.el.dom.method||\"POST\").toUpperCase()},getParams:function(){var a=this.form.baseParams;var b=this.options.params;if(b){if(typeof b==\"object\"){b=Ext.urlEncode(Ext.applyIf(b,a))}else{if(typeof b==\"string\"&&a){b+=\"&\"+Ext.urlEncode(a)}}}else{if(a){b=Ext.urlEncode(a)}}return b},createCallback:function(a){var a=a||{};return{success:this.success,failure:this.failure,scope:this,timeout:(a.timeout*1000)||(this.form.timeout*1000),upload:this.form.fileUpload?this.success:undefined}}};Ext.form.Action.Submit=function(b,a){Ext.form.Action.Submit.superclass.constructor.call(this,b,a)};Ext.extend(Ext.form.Action.Submit,Ext.form.Action,{type:\"submit\",run:function(){var e=this.options,g=this.getMethod(),d=g==\"GET\";if(e.clientValidation===false||this.form.isValid()){if(e.submitEmptyText===false){var a=this.form.items,c=[],b=function(h){if(h.el.getValue()==h.emptyText){c.push(h);h.el.dom.value=\"\"}if(h.isComposite&&h.rendered){h.items.each(b)}};a.each(b)}Ext.Ajax.request(Ext.apply(this.createCallback(e),{form:this.form.el.dom,url:this.getUrl(d),method:g,headers:e.headers,params:!d?this.getParams():null,isUpload:this.form.fileUpload}));if(e.submitEmptyText===false){Ext.each(c,function(h){if(h.applyEmptyText){h.applyEmptyText()}})}}else{if(e.clientValidation!==false){this.failureType=Ext.form.Action.CLIENT_INVALID;this.form.afterAction(this,false)}}},success:function(b){var a=this.processResponse(b);if(a===true||a.success){this.form.afterAction(this,true);return}if(a.errors){this.form.markInvalid(a.errors)}this.failureType=Ext.form.Action.SERVER_INVALID;this.form.afterAction(this,false)},handleResponse:function(c){if(this.form.errorReader){var b=this.form.errorReader.read(c);var g=[];if(b.records){for(var d=0,a=b.records.length;d<a;d++){var e=b.records[d];g[d]=e.data}}if(g.length<1){g=null}return{success:b.success,errors:g}}return this.decodeResponse(c)}});Ext.form.Action.Load=function(b,a){Ext.form.Action.Load.superclass.constructor.call(this,b,a);this.reader=this.form.reader};Ext.extend(Ext.form.Action.Load,Ext.form.Action,{type:\"load\",run:function(){Ext.Ajax.request(Ext.apply(this.createCallback(this.options),{method:this.getMethod(),url:this.getUrl(false),headers:this.options.headers,params:this.getParams()}))},success:function(b){var a=this.processResponse(b);if(a===true||!a.success||!a.data){this.failureType=Ext.form.Action.LOAD_FAILURE;this.form.afterAction(this,false);return}this.form.clearInvalid();this.form.setValues(a.data);this.form.afterAction(this,true)},handleResponse:function(b){if(this.form.reader){var a=this.form.reader.read(b);var c=a.records&&a.records[0]?a.records[0].data:null;return{success:a.success,data:c}}return this.decodeResponse(b)}});Ext.form.Action.DirectLoad=Ext.extend(Ext.form.Action.Load,{constructor:function(b,a){Ext.form.Action.DirectLoad.superclass.constructor.call(this,b,a)},type:\"directload\",run:function(){var a=this.getParams();a.push(this.success,this);this.form.api.load.apply(window,a)},getParams:function(){var c=[],h={};var e=this.form.baseParams;var g=this.options.params;Ext.apply(h,g,e);var b=this.form.paramOrder;if(b){for(var d=0,a=b.length;d<a;d++){c.push(h[b[d]])}}else{if(this.form.paramsAsHash){c.push(h)}}return c},processResponse:function(a){this.result=a;return a},success:function(a,b){if(b.type==Ext.Direct.exceptions.SERVER){a={}}Ext.form.Action.DirectLoad.superclass.success.call(this,a)}});Ext.form.Action.DirectSubmit=Ext.extend(Ext.form.Action.Submit,{constructor:function(b,a){Ext.form.Action.DirectSubmit.superclass.constructor.call(this,b,a)},type:\"directsubmit\",run:function(){var a=this.options;if(a.clientValidation===false||this.form.isValid()){this.success.params=this.getParams();this.form.api.submit(this.form.el.dom,this.success,this)}else{if(a.clientValidation!==false){this.failureType=Ext.form.Action.CLIENT_INVALID;this.form.afterAction(this,false)}}},getParams:function(){var c={};var a=this.form.baseParams;var b=this.options.params;Ext.apply(c,b,a);return c},processResponse:function(a){this.result=a;return a},success:function(a,b){if(b.type==Ext.Direct.exceptions.SERVER){a={}}Ext.form.Action.DirectSubmit.superclass.success.call(this,a)}});Ext.form.Action.ACTION_TYPES={load:Ext.form.Action.Load,submit:Ext.form.Action.Submit,directload:Ext.form.Action.DirectLoad,directsubmit:Ext.form.Action.DirectSubmit};Ext.form.VTypes=function(){var c=/^[a-zA-Z_]+$/,d=/^[a-zA-Z0-9_]+$/,b=/^(\\w+)([\\-+.\\'][\\w]+)*@(\\w[\\-\\w]*\\.){1,5}([A-Za-z]){2,6}$/,a=/(((^https?)|(^ftp)):\\/\\/([\\-\\w]+\\.)+\\w{2,3}(\\/[%\\-\\w]+(\\.\\w{2,})?)*(([\\w\\-\\.\\?\\\\\\/+@&#;`~=%!]*)(\\.\\w{2,})?)*\\/?)/i;return{email:function(e){return b.test(e)},emailText:'This field should be an e-mail address in the format \"user@example.com\"',emailMask:/[a-z0-9_\\.\\-\\+\\'@]/i,url:function(e){return a.test(e)},urlText:'This field should be a URL in the format \"http://www.example.com\"',alpha:function(e){return c.test(e)},alphaText:\"This field should only contain letters and _\",alphaMask:/[a-z_]/i,alphanum:function(e){return d.test(e)},alphanumText:\"This field should only contain letters, numbers and _\",alphanumMask:/[a-z0-9_]/i}}();Ext.grid.GridPanel=Ext.extend(Ext.Panel,{autoExpandColumn:false,autoExpandMax:1000,autoExpandMin:50,columnLines:false,ddText:\"{0} selected row{1}\",deferRowRender:true,enableColumnHide:true,enableColumnMove:true,enableDragDrop:false,enableHdMenu:true,loadMask:false,minColumnWidth:25,stripeRows:false,trackMouseOver:true,stateEvents:[\"columnmove\",\"columnresize\",\"sortchange\",\"groupchange\"],view:null,bubbleEvents:[],rendered:false,viewReady:false,initComponent:function(){Ext.grid.GridPanel.superclass.initComponent.call(this);if(this.columnLines){this.cls=(this.cls||\"\")+\" x-grid-with-col-lines\"}this.autoScroll=false;this.autoWidth=false;if(Ext.isArray(this.columns)){this.colModel=new Ext.grid.ColumnModel(this.columns);delete this.columns}if(this.ds){this.store=this.ds;delete this.ds}if(this.cm){this.colModel=this.cm;delete this.cm}if(this.sm){this.selModel=this.sm;delete this.sm}this.store=Ext.StoreMgr.lookup(this.store);this.addEvents(\"click\",\"dblclick\",\"contextmenu\",\"mousedown\",\"mouseup\",\"mouseover\",\"mouseout\",\"keypress\",\"keydown\",\"cellmousedown\",\"rowmousedown\",\"headermousedown\",\"groupmousedown\",\"rowbodymousedown\",\"containermousedown\",\"cellclick\",\"celldblclick\",\"rowclick\",\"rowdblclick\",\"headerclick\",\"headerdblclick\",\"groupclick\",\"groupdblclick\",\"containerclick\",\"containerdblclick\",\"rowbodyclick\",\"rowbodydblclick\",\"rowcontextmenu\",\"cellcontextmenu\",\"headercontextmenu\",\"groupcontextmenu\",\"containercontextmenu\",\"rowbodycontextmenu\",\"bodyscroll\",\"columnresize\",\"columnmove\",\"sortchange\",\"groupchange\",\"reconfigure\",\"viewready\")},onRender:function(d,a){Ext.grid.GridPanel.superclass.onRender.apply(this,arguments);var e=this.getGridEl();this.el.addClass(\"x-grid-panel\");this.mon(e,{scope:this,mousedown:this.onMouseDown,click:this.onClick,dblclick:this.onDblClick,contextmenu:this.onContextMenu});this.relayEvents(e,[\"mousedown\",\"mouseup\",\"mouseover\",\"mouseout\",\"keypress\",\"keydown\"]);var b=this.getView();b.init(this);b.render();this.getSelectionModel().init(this)},initEvents:function(){Ext.grid.GridPanel.superclass.initEvents.call(this);if(this.loadMask){this.loadMask=new Ext.LoadMask(this.bwrap,Ext.apply({store:this.store},this.loadMask))}},initStateEvents:function(){Ext.grid.GridPanel.superclass.initStateEvents.call(this);this.mon(this.colModel,\"hiddenchange\",this.saveState,this,{delay:100})},applyState:function(a){var k=this.colModel,g=a.columns,j=this.store,m,h,l;if(g){for(var d=0,e=g.length;d<e;d++){m=g[d];h=k.getColumnById(m.id);if(h){l=k.getIndexById(m.id);k.setState(l,{hidden:m.hidden,width:m.width,sortable:h.sortable,editable:h.editable});if(l!=d){k.moveColumn(l,d)}}}}if(j){m=a.sort;if(m){j[j.remoteSort?\"setDefaultSort\":\"sort\"](m.field,m.direction)}m=a.group;if(j.groupBy){if(m){j.groupBy(m)}else{j.clearGrouping()}}}var b=Ext.apply({},a);delete b.columns;delete b.sort;Ext.grid.GridPanel.superclass.applyState.call(this,b)},getState:function(){var g={columns:[]},b=this.store,e,a;for(var d=0,h;(h=this.colModel.config[d]);d++){g.columns[d]={id:h.id,width:h.width};if(h.hidden){g.columns[d].hidden=true}}if(b){e=b.getSortState();if(e){g.sort=e}if(b.getGroupState){a=b.getGroupState();if(a){g.group=a}}}return g},afterRender:function(){Ext.grid.GridPanel.superclass.afterRender.call(this);var a=this.view;this.on(\"bodyresize\",a.layout,a);a.layout(true);if(this.deferRowRender){if(!this.deferRowRenderTask){this.deferRowRenderTask=new Ext.util.DelayedTask(a.afterRender,this.view)}this.deferRowRenderTask.delay(10)}else{a.afterRender()}this.viewReady=true},reconfigure:function(a,b){var c=this.rendered;if(c){if(this.loadMask){this.loadMask.destroy();this.loadMask=new Ext.LoadMask(this.bwrap,Ext.apply({},{store:a},this.initialConfig.loadMask))}}if(this.view){this.view.initData(a,b)}this.store=a;this.colModel=b;if(c){this.view.refresh(true)}this.fireEvent(\"reconfigure\",this,a,b)},onDestroy:function(){if(this.deferRowRenderTask&&this.deferRowRenderTask.cancel){this.deferRowRenderTask.cancel()}if(this.rendered){Ext.destroy(this.view,this.loadMask)}else{if(this.store&&this.store.autoDestroy){this.store.destroy()}}Ext.destroy(this.colModel,this.selModel);this.store=this.selModel=this.colModel=this.view=this.loadMask=null;Ext.grid.GridPanel.superclass.onDestroy.call(this)},processEvent:function(a,b){this.view.processEvent(a,b)},onClick:function(a){this.processEvent(\"click\",a)},onMouseDown:function(a){this.processEvent(\"mousedown\",a)},onContextMenu:function(b,a){this.processEvent(\"contextmenu\",b)},onDblClick:function(a){this.processEvent(\"dblclick\",a)},walkCells:function(k,c,b,e,j){var i=this.colModel,g=i.getColumnCount(),a=this.store,h=a.getCount(),d=true;if(b<0){if(c<0){k--;d=false}while(k>=0){if(!d){c=g-1}d=false;while(c>=0){if(e.call(j||this,k,c,i)===true){return[k,c]}c--}k--}}else{if(c>=g){k++;d=false}while(k<h){if(!d){c=0}d=false;while(c<g){if(e.call(j||this,k,c,i)===true){return[k,c]}c++}k++}}return null},getGridEl:function(){return this.body},stopEditing:Ext.emptyFn,getSelectionModel:function(){if(!this.selModel){this.selModel=new Ext.grid.RowSelectionModel(this.disableSelection?{selectRow:Ext.emptyFn}:null)}return this.selModel},getStore:function(){return this.store},getColumnModel:function(){return this.colModel},getView:function(){if(!this.view){this.view=new Ext.grid.GridView(this.viewConfig)}return this.view},getDragDropText:function(){var a=this.selModel.getCount?this.selModel.getCount():1;return String.format(this.ddText,a,a==1?\"\":\"s\")}});Ext.reg(\"grid\",Ext.grid.GridPanel);Ext.grid.PivotGrid=Ext.extend(Ext.grid.GridPanel,{aggregator:\"sum\",renderer:undefined,initComponent:function(){Ext.grid.PivotGrid.superclass.initComponent.apply(this,arguments);this.initAxes();this.enableColumnResize=false;this.viewConfig=Ext.apply(this.viewConfig||{},{forceFit:true});this.colModel=new Ext.grid.ColumnModel({})},getAggregator:function(){if(typeof this.aggregator==\"string\"){return Ext.grid.PivotAggregatorMgr.types[this.aggregator]}else{return this.aggregator}},setAggregator:function(a){this.aggregator=a},setMeasure:function(a){this.measure=a},setLeftAxis:function(b,a){this.leftAxis=b;if(a){this.view.refresh()}},setTopAxis:function(b,a){this.topAxis=b;if(a){this.view.refresh()}},initAxes:function(){var a=Ext.grid.PivotAxis;if(!(this.leftAxis instanceof a)){this.setLeftAxis(new a({orientation:\"vertical\",dimensions:this.leftAxis||[],store:this.store}))}if(!(this.topAxis instanceof a)){this.setTopAxis(new a({orientation:\"horizontal\",dimensions:this.topAxis||[],store:this.store}))}},extractData:function(){var c=this.store.data.items,s=c.length,q=[],h,g,e,d;if(s==0){return[]}var l=this.leftAxis.getTuples(),o=l.length,m=this.topAxis.getTuples(),a=m.length,b=this.getAggregator();for(g=0;g<s;g++){h=c[g];for(e=0;e<o;e++){q[e]=q[e]||[];if(l[e].matcher(h)===true){for(d=0;d<a;d++){q[e][d]=q[e][d]||[];if(m[d].matcher(h)){q[e][d].push(h)}}}}}var n=q.length,p,r;for(g=0;g<n;g++){r=q[g];p=r.length;for(e=0;e<p;e++){q[g][e]=b(q[g][e],this.measure)}}return q},getView:function(){if(!this.view){this.view=new Ext.grid.PivotGridView(this.viewConfig)}return this.view}});Ext.reg(\"pivotgrid\",Ext.grid.PivotGrid);Ext.grid.PivotAggregatorMgr=new Ext.AbstractManager();Ext.grid.PivotAggregatorMgr.registerType(\"sum\",function(a,c){var e=a.length,d=0,b;for(b=0;b<e;b++){d+=a[b].get(c)}return d});Ext.grid.PivotAggregatorMgr.registerType(\"avg\",function(a,c){var e=a.length,d=0,b;for(b=0;b<e;b++){d+=a[b].get(c)}return(d/e)||\"n/a\"});Ext.grid.PivotAggregatorMgr.registerType(\"min\",function(a,c){var e=[],d=a.length,b;for(b=0;b<d;b++){e.push(a[b].get(c))}return Math.min.apply(this,e)||\"n/a\"});Ext.grid.PivotAggregatorMgr.registerType(\"max\",function(a,c){var e=[],d=a.length,b;for(b=0;b<d;b++){e.push(a[b].get(c))}return Math.max.apply(this,e)||\"n/a\"});Ext.grid.PivotAggregatorMgr.registerType(\"count\",function(a,b){return a.length});Ext.grid.GridView=Ext.extend(Ext.util.Observable,{deferEmptyText:true,scrollOffset:undefined,autoFill:false,forceFit:false,sortClasses:[\"sort-asc\",\"sort-desc\"],sortAscText:\"Sort Ascending\",sortDescText:\"Sort Descending\",hideSortIcons:false,columnsText:\"Columns\",selectedRowClass:\"x-grid3-row-selected\",borderWidth:2,tdClass:\"x-grid3-cell\",hdCls:\"x-grid3-hd\",markDirty:true,cellSelectorDepth:4,rowSelectorDepth:10,rowBodySelectorDepth:10,cellSelector:\"td.x-grid3-cell\",rowSelector:\"div.x-grid3-row\",rowBodySelector:\"div.x-grid3-row-body\",firstRowCls:\"x-grid3-row-first\",lastRowCls:\"x-grid3-row-last\",rowClsRe:/(?:^|\\s+)x-grid3-row-(first|last|alt)(?:\\s+|$)/g,headerMenuOpenCls:\"x-grid3-hd-menu-open\",rowOverCls:\"x-grid3-row-over\",constructor:function(a){Ext.apply(this,a);this.addEvents(\"beforerowremoved\",\"beforerowsinserted\",\"beforerefresh\",\"rowremoved\",\"rowsinserted\",\"rowupdated\",\"refresh\");Ext.grid.GridView.superclass.constructor.call(this)},masterTpl:new Ext.Template('<div class=\"x-grid3\" hidefocus=\"true\">','<div class=\"x-grid3-viewport\">','<div class=\"x-grid3-header\">','<div class=\"x-grid3-header-inner\">','<div class=\"x-grid3-header-offset\" style=\"{ostyle}\">{header}</div>',\"</div>\",'<div class=\"x-clear\"></div>',\"</div>\",'<div class=\"x-grid3-scroller\">','<div class=\"x-grid3-body\" style=\"{bstyle}\">{body}</div>','<a href=\"#\" class=\"x-grid3-focus\" tabIndex=\"-1\"></a>',\"</div>\",\"</div>\",'<div class=\"x-grid3-resize-marker\">&#160;</div>','<div class=\"x-grid3-resize-proxy\">&#160;</div>',\"</div>\"),headerTpl:new Ext.Template('<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\" style=\"{tstyle}\">',\"<thead>\",'<tr class=\"x-grid3-hd-row\">{cells}</tr>',\"</thead>\",\"</table>\"),bodyTpl:new Ext.Template(\"{rows}\"),cellTpl:new Ext.Template('<td class=\"x-grid3-col x-grid3-cell x-grid3-td-{id} {css}\" style=\"{style}\" tabIndex=\"0\" {cellAttr}>','<div class=\"x-grid3-cell-inner x-grid3-col-{id} x-unselectable\" unselectable=\"on\" {attr}>{value}</div>',\"</td>\"),initTemplates:function(){var c=this.templates||{},d,b,g=new Ext.Template('<td class=\"x-grid3-hd x-grid3-cell x-grid3-td-{id} {css}\" style=\"{style}\">','<div {tooltip} {attr} class=\"x-grid3-hd-inner x-grid3-hd-{id}\" unselectable=\"on\" style=\"{istyle}\">',this.grid.enableHdMenu?'<a class=\"x-grid3-hd-btn\" href=\"#\"></a>':\"\",\"{value}\",'<img alt=\"\" class=\"x-grid3-sort-icon\" src=\"',Ext.BLANK_IMAGE_URL,'\" />',\"</div>\",\"</td>\"),a=['<tr class=\"x-grid3-row-body-tr\" style=\"{bodyStyle}\">','<td colspan=\"{cols}\" class=\"x-grid3-body-cell\" tabIndex=\"0\" hidefocus=\"on\">','<div class=\"x-grid3-row-body\">{body}</div>',\"</td>\",\"</tr>\"].join(\"\"),e=['<table class=\"x-grid3-row-table\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\" style=\"{tstyle}\">',\"<tbody>\",\"<tr>{cells}</tr>\",this.enableRowBody?a:\"\",\"</tbody>\",\"</table>\"].join(\"\");Ext.applyIf(c,{hcell:g,cell:this.cellTpl,body:this.bodyTpl,header:this.headerTpl,master:this.masterTpl,row:new Ext.Template('<div class=\"x-grid3-row {alt}\" style=\"{tstyle}\">'+e+\"</div>\"),rowInner:new Ext.Template(e)});for(b in c){d=c[b];if(d&&Ext.isFunction(d.compile)&&!d.compiled){d.disableFormats=true;d.compile()}}this.templates=c;this.colRe=new RegExp(\"x-grid3-td-([^\\\\s]+)\",\"\")},fly:function(a){if(!this._flyweight){this._flyweight=new Ext.Element.Flyweight(document.body)}this._flyweight.dom=a;return this._flyweight},getEditorParent:function(){return this.scroller.dom},initElements:function(){var b=Ext.Element,d=Ext.get(this.grid.getGridEl().dom.firstChild),e=new b(d.child(\"div.x-grid3-viewport\")),c=new b(e.child(\"div.x-grid3-header\")),a=new b(e.child(\"div.x-grid3-scroller\"));if(this.grid.hideHeaders){c.setDisplayed(false)}if(this.forceFit){a.setStyle(\"overflow-x\",\"hidden\")}Ext.apply(this,{el:d,mainWrap:e,scroller:a,mainHd:c,innerHd:c.child(\"div.x-grid3-header-inner\").dom,mainBody:new b(b.fly(a).child(\"div.x-grid3-body\")),focusEl:new b(b.fly(a).child(\"a\")),resizeMarker:new b(d.child(\"div.x-grid3-resize-marker\")),resizeProxy:new b(d.child(\"div.x-grid3-resize-proxy\"))});this.focusEl.swallowEvent(\"click\",true)},getRows:function(){return this.hasRows()?this.mainBody.dom.childNodes:[]},findCell:function(a){if(!a){return false}return this.fly(a).findParent(this.cellSelector,this.cellSelectorDepth)},findCellIndex:function(d,c){var b=this.findCell(d),a;if(b){a=this.fly(b).hasClass(c);if(!c||a){return this.getCellIndex(b)}}return false},getCellIndex:function(b){if(b){var a=b.className.match(this.colRe);if(a&&a[1]){return this.cm.getIndexById(a[1])}}return false},findHeaderCell:function(b){var a=this.findCell(b);return a&&this.fly(a).hasClass(this.hdCls)?a:null},findHeaderIndex:function(a){return this.findCellIndex(a,this.hdCls)},findRow:function(a){if(!a){return false}return this.fly(a).findParent(this.rowSelector,this.rowSelectorDepth)},findRowIndex:function(a){var b=this.findRow(a);return b?b.rowIndex:false},findRowBody:function(a){if(!a){return false}return this.fly(a).findParent(this.rowBodySelector,this.rowBodySelectorDepth)},getRow:function(a){return this.getRows()[a]},getCell:function(b,a){return Ext.fly(this.getRow(b)).query(this.cellSelector)[a]},getHeaderCell:function(a){return this.mainHd.dom.getElementsByTagName(\"td\")[a]},addRowClass:function(b,a){var c=this.getRow(b);if(c){this.fly(c).addClass(a)}},removeRowClass:function(c,a){var b=this.getRow(c);if(b){this.fly(b).removeClass(a)}},removeRow:function(a){Ext.removeNode(this.getRow(a));this.syncFocusEl(a)},removeRows:function(c,a){var b=this.mainBody.dom,d;for(d=c;d<=a;d++){Ext.removeNode(b.childNodes[c])}this.syncFocusEl(c)},getScrollState:function(){var a=this.scroller.dom;return{left:a.scrollLeft,top:a.scrollTop}},restoreScroll:function(a){var b=this.scroller.dom;b.scrollLeft=a.left;b.scrollTop=a.top},scrollToTop:function(){var a=this.scroller.dom;a.scrollTop=0;a.scrollLeft=0},syncScroll:function(){this.syncHeaderScroll();var a=this.scroller.dom;this.grid.fireEvent(\"bodyscroll\",a.scrollLeft,a.scrollTop)},syncHeaderScroll:function(){var a=this.innerHd,b=this.scroller.dom.scrollLeft;a.scrollLeft=b;a.scrollLeft=b},updateSortIcon:function(d,c){var a=this.sortClasses,b=a[c==\"DESC\"?1:0],e=this.mainHd.select(\"td\").removeClass(a);e.item(d).addClass(b)},updateAllColumnWidths:function(){var e=this.getTotalWidth(),k=this.cm.getColumnCount(),m=this.getRows(),g=m.length,b=[],l,a,h,d,c;for(d=0;d<k;d++){b[d]=this.getColumnWidth(d);this.getHeaderCell(d).style.width=b[d]}this.updateHeaderWidth();for(d=0;d<g;d++){l=m[d];l.style.width=e;a=l.firstChild;if(a){a.style.width=e;h=a.rows[0];for(c=0;c<k;c++){h.childNodes[c].style.width=b[c]}}}this.onAllColumnWidthsUpdated(b,e)},updateColumnWidth:function(d,b){var c=this.getColumnWidth(d),j=this.getTotalWidth(),h=this.getHeaderCell(d),a=this.getRows(),e=a.length,l,g,k;this.updateHeaderWidth();h.style.width=c;for(g=0;g<e;g++){l=a[g];k=l.firstChild;l.style.width=j;if(k){k.style.width=j;k.rows[0].childNodes[d].style.width=c}}this.onColumnWidthUpdated(d,c,j)},updateColumnHidden:function(b,j){var h=this.getTotalWidth(),k=j?\"none\":\"\",g=this.getHeaderCell(b),a=this.getRows(),d=a.length,l,c,e;this.updateHeaderWidth();g.style.display=k;for(e=0;e<d;e++){l=a[e];l.style.width=h;c=l.firstChild;if(c){c.style.width=h;c.rows[0].childNodes[b].style.display=k}}this.onColumnHiddenUpdated(b,j,h);delete this.lastViewWidth;this.layout()},doRender:function(d,v,m,a,r,t){var h=this.templates,c=h.cell,y=h.row,o=r-1,b=\"width:\"+this.getTotalWidth()+\";\",k=[],l=[],n={tstyle:b},q={},w=v.length,x,g,e,u,s,p;for(s=0;s<w;s++){e=v[s];l=[];p=s+a;for(u=0;u<r;u++){g=d[u];q.id=g.id;q.css=u===0?\"x-grid3-cell-first \":(u==o?\"x-grid3-cell-last \":\"\");q.attr=q.cellAttr=\"\";q.style=g.style;q.value=g.renderer.call(g.scope,e.data[g.name],q,e,p,u,m);if(Ext.isEmpty(q.value)){q.value=\"&#160;\"}if(this.markDirty&&e.dirty&&typeof e.modified[g.name]!=\"undefined\"){q.css+=\" x-grid3-dirty-cell\"}l[l.length]=c.apply(q)}x=[];if(t&&((p+1)%2===0)){x[0]=\"x-grid3-row-alt\"}if(e.dirty){x[1]=\" x-grid3-dirty-row\"}n.cols=r;if(this.getRowClass){x[2]=this.getRowClass(e,p,n,m)}n.alt=x.join(\" \");n.cells=l.join(\"\");k[k.length]=y.apply(n)}return k.join(\"\")},processRows:function(a,g){if(!this.ds||this.ds.getCount()<1){return}var d=this.getRows(),c=d.length,e,b;g=g||!this.grid.stripeRows;a=a||0;for(b=0;b<c;b++){e=d[b];if(e){e.rowIndex=b;if(!g){e.className=e.className.replace(this.rowClsRe,\" \");if((b+1)%2===0){e.className+=\" x-grid3-row-alt\"}}}}if(a===0){Ext.fly(d[0]).addClass(this.firstRowCls)}Ext.fly(d[c-1]).addClass(this.lastRowCls)},afterRender:function(){if(!this.ds||!this.cm){return}this.mainBody.dom.innerHTML=this.renderBody()||\"&#160;\";this.processRows(0,true);if(this.deferEmptyText!==true){this.applyEmptyText()}this.grid.fireEvent(\"viewready\",this.grid)},afterRenderUI:function(){var a=this.grid;this.initElements();Ext.fly(this.innerHd).on(\"click\",this.handleHdDown,this);this.mainHd.on({scope:this,mouseover:this.handleHdOver,mouseout:this.handleHdOut,mousemove:this.handleHdMove});this.scroller.on(\"scroll\",this.syncScroll,this);if(a.enableColumnResize!==false){this.splitZone=new Ext.grid.GridView.SplitDragZone(a,this.mainHd.dom)}if(a.enableColumnMove){this.columnDrag=new Ext.grid.GridView.ColumnDragZone(a,this.innerHd);this.columnDrop=new Ext.grid.HeaderDropZone(a,this.mainHd.dom)}if(a.enableHdMenu!==false){this.hmenu=new Ext.menu.Menu({id:a.id+\"-hctx\"});this.hmenu.add({itemId:\"asc\",text:this.sortAscText,cls:\"xg-hmenu-sort-asc\"},{itemId:\"desc\",text:this.sortDescText,cls:\"xg-hmenu-sort-desc\"});if(a.enableColumnHide!==false){this.colMenu=new Ext.menu.Menu({id:a.id+\"-hcols-menu\"});this.colMenu.on({scope:this,beforeshow:this.beforeColMenuShow,itemclick:this.handleHdMenuClick});this.hmenu.add({itemId:\"sortSep\",xtype:\"menuseparator\"},{itemId:\"columns\",hideOnClick:false,text:this.columnsText,menu:this.colMenu,iconCls:\"x-cols-icon\"})}this.hmenu.on(\"itemclick\",this.handleHdMenuClick,this)}if(a.trackMouseOver){this.mainBody.on({scope:this,mouseover:this.onRowOver,mouseout:this.onRowOut})}if(a.enableDragDrop||a.enableDrag){this.dragZone=new Ext.grid.GridDragZone(a,{ddGroup:a.ddGroup||\"GridDD\"})}this.updateHeaderSortState()},renderUI:function(){var a=this.templates;return a.master.apply({body:a.body.apply({rows:\"&#160;\"}),header:this.renderHeaders(),ostyle:\"width:\"+this.getOffsetWidth()+\";\",bstyle:\"width:\"+this.getTotalWidth()+\";\"})},processEvent:function(b,h){var i=h.getTarget(),a=this.grid,d=this.findHeaderIndex(i),k,j,c,g;a.fireEvent(b,h);if(d!==false){a.fireEvent(\"header\"+b,a,d,h)}else{k=this.findRowIndex(i);if(k!==false){j=this.findCellIndex(i);if(j!==false){c=a.colModel.getColumnAt(j);if(a.fireEvent(\"cell\"+b,a,k,j,h)!==false){if(!c||(c.processEvent&&(c.processEvent(b,h,a,k,j)!==false))){a.fireEvent(\"row\"+b,a,k,h)}}}else{if(a.fireEvent(\"row\"+b,a,k,h)!==false){(g=this.findRowBody(i))&&a.fireEvent(\"rowbody\"+b,a,k,h)}}}else{a.fireEvent(\"container\"+b,a,h)}}},layout:function(j){if(!this.mainBody){return}var a=this.grid,d=a.getGridEl(),c=d.getSize(true),i=c.width,b=c.height,h=this.scroller,g,e,k;if(i<20||b<20){return}if(a.autoHeight){g=h.dom.style;g.overflow=\"visible\";if(Ext.isWebKit){g.position=\"static\"}}else{this.el.setSize(i,b);e=this.mainHd.getHeight();k=b-e;h.setSize(i,k);if(this.innerHd){this.innerHd.style.width=(i)+\"px\"}}if(this.forceFit||(j===true&&this.autoFill)){if(this.lastViewWidth!=i){this.fitColumns(false,false);this.lastViewWidth=i}}else{this.autoExpand();this.syncHeaderScroll()}this.onLayout(i,k)},onLayout:function(a,b){},onColumnWidthUpdated:function(c,a,b){},onAllColumnWidthsUpdated:function(a,b){},onColumnHiddenUpdated:function(b,c,a){},updateColumnText:function(a,b){},afterMove:function(a){},init:function(a){this.grid=a;this.initTemplates();this.initData(a.store,a.colModel);this.initUI(a)},getColumnId:function(a){return this.cm.getColumnId(a)},getOffsetWidth:function(){return(this.cm.getTotalWidth()+this.getScrollOffset())+\"px\"},getScrollOffset:function(){return Ext.num(this.scrollOffset,Ext.getScrollBarWidth())},renderHeaders:function(){var e=this.cm,g=this.templates,a=g.hcell,d={},h=e.getColumnCount(),j=h-1,k=[],c,b;for(c=0;c<h;c++){if(c==0){b=\"x-grid3-cell-first \"}else{b=c==j?\"x-grid3-cell-last \":\"\"}d={id:e.getColumnId(c),value:e.getColumnHeader(c)||\"\",style:this.getColumnStyle(c,true),css:b,tooltip:this.getColumnTooltip(c)};if(e.config[c].align==\"right\"){d.istyle=\"padding-right: 16px;\"}else{delete d.istyle}k[c]=a.apply(d)}return g.header.apply({cells:k.join(\"\"),tstyle:String.format(\"width: {0};\",this.getTotalWidth())})},getColumnTooltip:function(a){var b=this.cm.getColumnTooltip(a);if(b){if(Ext.QuickTips.isEnabled()){return'ext:qtip=\"'+b+'\"'}else{return'title=\"'+b+'\"'}}return\"\"},beforeUpdate:function(){this.grid.stopEditing(true)},updateHeaders:function(){this.innerHd.firstChild.innerHTML=this.renderHeaders();this.updateHeaderWidth(false)},updateHeaderWidth:function(c){var b=this.innerHd.firstChild,a=this.getTotalWidth();b.style.width=this.getOffsetWidth();b.firstChild.style.width=a;if(c!==false){this.mainBody.dom.style.width=a}},focusRow:function(a){this.focusCell(a,0,false)},focusCell:function(d,b,c){this.syncFocusEl(this.ensureVisible(d,b,c));var a=this.focusEl;if(Ext.isGecko){a.focus()}else{a.focus.defer(1,a)}},resolveCell:function(h,d,g){if(!Ext.isNumber(h)){h=h.rowIndex}if(!this.ds){return null}if(h<0||h>=this.ds.getCount()){return null}d=(d!==undefined?d:0);var c=this.getRow(h),b=this.cm,e=b.getColumnCount(),a;if(!(g===false&&d===0)){while(d<e&&b.isHidden(d)){d++}a=this.getCell(h,d)}return{row:c,cell:a}},getResolvedXY:function(b){if(!b){return null}var a=b.cell,c=b.row;if(a){return Ext.fly(a).getXY()}else{return[this.el.getX(),Ext.fly(c).getY()]}},syncFocusEl:function(d,a,c){var b=d;if(!Ext.isArray(b)){d=Math.min(d,Math.max(0,this.getRows().length-1));if(isNaN(d)){return}b=this.getResolvedXY(this.resolveCell(d,a,c))}this.focusEl.setXY(b||this.scroller.getXY())},ensureVisible:function(t,g,e){var r=this.resolveCell(t,g,e);if(!r||!r.row){return null}var k=r.row,h=r.cell,n=this.scroller.dom,d=k,s=0,o=this.el.dom;while(d&&d!=o){s+=d.offsetTop;d=d.offsetParent}s-=this.mainHd.dom.offsetHeight;o=parseInt(n.scrollTop,10);var q=s+k.offsetHeight,a=n.clientHeight,m=o+a;if(s<o){n.scrollTop=s}else{if(q>m){n.scrollTop=q-a}}if(e!==false){var l=parseInt(h.offsetLeft,10),j=l+h.offsetWidth,i=parseInt(n.scrollLeft,10),b=i+n.clientWidth;if(l<i){n.scrollLeft=l}else{if(j>b){n.scrollLeft=j-n.clientWidth}}}return this.getResolvedXY(r)},insertRows:function(a,i,e,h){var d=a.getCount()-1;if(!h&&i===0&&e>=d){this.fireEvent(\"beforerowsinserted\",this,i,e);this.refresh();this.fireEvent(\"rowsinserted\",this,i,e)}else{if(!h){this.fireEvent(\"beforerowsinserted\",this,i,e)}var b=this.renderRows(i,e),g=this.getRow(i);if(g){if(i===0){Ext.fly(this.getRow(0)).removeClass(this.firstRowCls)}Ext.DomHelper.insertHtml(\"beforeBegin\",g,b)}else{var c=this.getRow(d-1);if(c){Ext.fly(c).removeClass(this.lastRowCls)}Ext.DomHelper.insertHtml(\"beforeEnd\",this.mainBody.dom,b)}if(!h){this.processRows(i);this.fireEvent(\"rowsinserted\",this,i,e)}else{if(i===0||i>=d){Ext.fly(this.getRow(i)).addClass(i===0?this.firstRowCls:this.lastRowCls)}}}this.syncFocusEl(i)},deleteRows:function(a,c,b){if(a.getRowCount()<1){this.refresh()}else{this.fireEvent(\"beforerowsdeleted\",this,c,b);this.removeRows(c,b);this.processRows(c);this.fireEvent(\"rowsdeleted\",this,c,b)}},getColumnStyle:function(b,d){var a=this.cm,g=a.config,c=d?\"\":g[b].css||\"\",e=g[b].align;c+=String.format(\"width: {0};\",this.getColumnWidth(b));if(a.isHidden(b)){c+=\"display: none; \"}if(e){c+=String.format(\"text-align: {0};\",e)}return c},getColumnWidth:function(b){var c=this.cm.getColumnWidth(b),a=this.borderWidth;if(Ext.isNumber(c)){if(Ext.isBorderBox){return c+\"px\"}else{return Math.max(c-a,0)+\"px\"}}else{return c}},getTotalWidth:function(){return this.cm.getTotalWidth()+\"px\"},fitColumns:function(g,j,h){var a=this.grid,l=this.cm,s=l.getTotalWidth(false),q=this.getGridInnerWidth(),r=q-s,c=[],o=0,n=0,u,d,p;if(q<20||r===0){return false}var e=l.getColumnCount(true),m=l.getColumnCount(false),b=e-(Ext.isNumber(h)?1:0);if(b===0){b=1;h=undefined}for(p=0;p<m;p++){if(!l.isFixed(p)&&p!==h){u=l.getColumnWidth(p);c.push(p,u);if(!l.isHidden(p)){o=p;n+=u}}}d=(q-l.getTotalWidth())/n;while(c.length){u=c.pop();p=c.pop();l.setColumnWidth(p,Math.max(a.minColumnWidth,Math.floor(u+u*d)),true)}s=l.getTotalWidth(false);if(s>q){var t=(b==e)?o:h,k=Math.max(1,l.getColumnWidth(t)-(s-q));l.setColumnWidth(t,k,true)}if(g!==true){this.updateAllColumnWidths()}return true},autoExpand:function(k){var a=this.grid,i=this.cm,e=this.getGridInnerWidth(),c=i.getTotalWidth(false),g=a.autoExpandColumn;if(!this.userResized&&g){if(e!=c){var j=i.getIndexById(g),b=i.getColumnWidth(j),h=e-c+b,d=Math.min(Math.max(h,a.autoExpandMin),a.autoExpandMax);if(b!=d){i.setColumnWidth(j,d,true);if(k!==true){this.updateColumnWidth(j,d)}}}}},getGridInnerWidth:function(){return this.grid.getGridEl().getWidth(true)-this.getScrollOffset()},getColumnData:function(){var e=[],c=this.cm,g=c.getColumnCount(),a=this.ds.fields,d,b;for(d=0;d<g;d++){b=c.getDataIndex(d);e[d]={name:Ext.isDefined(b)?b:(a.get(d)?a.get(d).name:undefined),renderer:c.getRenderer(d),scope:c.getRendererScope(d),id:c.getColumnId(d),style:this.getColumnStyle(d)}}return e},renderRows:function(i,c){var a=this.grid,g=a.store,j=a.stripeRows,e=a.colModel,h=e.getColumnCount(),d=g.getCount(),b;if(d<1){return\"\"}i=i||0;c=Ext.isDefined(c)?c:d-1;b=g.getRange(i,c);return this.doRender(this.getColumnData(),b,g,i,h,j)},renderBody:function(){var a=this.renderRows()||\"&#160;\";return this.templates.body.apply({rows:a})},refreshRow:function(g){var l=this.ds,m=this.cm.getColumnCount(),c=this.getColumnData(),n=m-1,p=[\"x-grid3-row\"],e={tstyle:String.format(\"width: {0};\",this.getTotalWidth())},a=[],k=this.templates.cell,j,q,b,o,h,d;if(Ext.isNumber(g)){j=g;g=l.getAt(j)}else{j=l.indexOf(g)}if(!g||j<0){return}for(d=0;d<m;d++){b=c[d];if(d==0){h=\"x-grid3-cell-first\"}else{h=(d==n)?\"x-grid3-cell-last \":\"\"}o={id:b.id,style:b.style,css:h,attr:\"\",cellAttr:\"\"};o.value=b.renderer.call(b.scope,g.data[b.name],o,g,j,d,l);if(Ext.isEmpty(o.value)){o.value=\"&#160;\"}if(this.markDirty&&g.dirty&&typeof g.modified[b.name]!=\"undefined\"){o.css+=\" x-grid3-dirty-cell\"}a[d]=k.apply(o)}q=this.getRow(j);q.className=\"\";if(this.grid.stripeRows&&((j+1)%2===0)){p.push(\"x-grid3-row-alt\")}if(this.getRowClass){e.cols=m;p.push(this.getRowClass(g,j,e,l))}this.fly(q).addClass(p).setStyle(e.tstyle);e.cells=a.join(\"\");q.innerHTML=this.templates.rowInner.apply(e);this.fireEvent(\"rowupdated\",this,j,g)},refresh:function(b){this.fireEvent(\"beforerefresh\",this);this.grid.stopEditing(true);var a=this.renderBody();this.mainBody.update(a).setWidth(this.getTotalWidth());if(b===true){this.updateHeaders();this.updateHeaderSortState()}this.processRows(0,true);this.layout();this.applyEmptyText();this.fireEvent(\"refresh\",this)},applyEmptyText:function(){if(this.emptyText&&!this.hasRows()){this.mainBody.update('<div class=\"x-grid-empty\">'+this.emptyText+\"</div>\")}},updateHeaderSortState:function(){var b=this.ds.getSortState();if(!b){return}if(!this.sortState||(this.sortState.field!=b.field||this.sortState.direction!=b.direction)){this.grid.fireEvent(\"sortchange\",this.grid,b)}this.sortState=b;var c=this.cm.findColumnIndex(b.field);if(c!=-1){var a=b.direction;this.updateSortIcon(c,a)}},clearHeaderSortState:function(){if(!this.sortState){return}this.grid.fireEvent(\"sortchange\",this.grid,null);this.mainHd.select(\"td\").removeClass(this.sortClasses);delete this.sortState},destroy:function(){var j=this,a=j.grid,d=a.getGridEl(),i=j.dragZone,g=j.splitZone,h=j.columnDrag,e=j.columnDrop,k=j.scrollToTopTask,c,b;if(k&&k.cancel){k.cancel()}Ext.destroyMembers(j,\"colMenu\",\"hmenu\");j.initData(null,null);j.purgeListeners();Ext.fly(j.innerHd).un(\"click\",j.handleHdDown,j);if(a.enableColumnMove){c=h.dragData;b=h.proxy;Ext.destroy(h.el,b.ghost,b.el,e.el,e.proxyTop,e.proxyBottom,c.ddel,c.header);if(b.anim){Ext.destroy(b.anim)}delete b.ghost;delete c.ddel;delete c.header;h.destroy();delete Ext.dd.DDM.locationCache[h.id];delete h._domRef;delete e.proxyTop;delete e.proxyBottom;e.destroy();delete Ext.dd.DDM.locationCache[\"gridHeader\"+d.id];delete e._domRef;delete Ext.dd.DDM.ids[e.ddGroup]}if(g){g.destroy();delete g._domRef;delete Ext.dd.DDM.ids[\"gridSplitters\"+d.id]}Ext.fly(j.innerHd).removeAllListeners();Ext.removeNode(j.innerHd);delete j.innerHd;Ext.destroy(j.el,j.mainWrap,j.mainHd,j.scroller,j.mainBody,j.focusEl,j.resizeMarker,j.resizeProxy,j.activeHdBtn,j._flyweight,i,g);delete a.container;if(i){i.destroy()}Ext.dd.DDM.currentTarget=null;delete Ext.dd.DDM.locationCache[d.id];Ext.EventManager.removeResizeListener(j.onWindowResize,j)},onDenyColumnHide:function(){},render:function(){if(this.autoFill){var a=this.grid.ownerCt;if(a&&a.getLayout()){a.on(\"afterlayout\",function(){this.fitColumns(true,true);this.updateHeaders();this.updateHeaderSortState()},this,{single:true})}}else{if(this.forceFit){this.fitColumns(true,false)}else{if(this.grid.autoExpandColumn){this.autoExpand(true)}}}this.grid.getGridEl().dom.innerHTML=this.renderUI();this.afterRenderUI()},initData:function(a,e){var b=this;if(b.ds){var d=b.ds;d.un(\"add\",b.onAdd,b);d.un(\"load\",b.onLoad,b);d.un(\"clear\",b.onClear,b);d.un(\"remove\",b.onRemove,b);d.un(\"update\",b.onUpdate,b);d.un(\"datachanged\",b.onDataChange,b);if(d!==a&&d.autoDestroy){d.destroy()}}if(a){a.on({scope:b,load:b.onLoad,add:b.onAdd,remove:b.onRemove,update:b.onUpdate,clear:b.onClear,datachanged:b.onDataChange})}if(b.cm){var c=b.cm;c.un(\"configchange\",b.onColConfigChange,b);c.un(\"widthchange\",b.onColWidthChange,b);c.un(\"headerchange\",b.onHeaderChange,b);c.un(\"hiddenchange\",b.onHiddenChange,b);c.un(\"columnmoved\",b.onColumnMove,b)}if(e){delete b.lastViewWidth;e.on({scope:b,configchange:b.onColConfigChange,widthchange:b.onColWidthChange,headerchange:b.onHeaderChange,hiddenchange:b.onHiddenChange,columnmoved:b.onColumnMove})}b.ds=a;b.cm=e},onDataChange:function(){this.refresh(true);this.updateHeaderSortState();this.syncFocusEl(0)},onClear:function(){this.refresh();this.syncFocusEl(0)},onUpdate:function(b,a){this.refreshRow(a)},onAdd:function(b,a,c){this.insertRows(b,c,c+(a.length-1))},onRemove:function(b,a,c,d){if(d!==true){this.fireEvent(\"beforerowremoved\",this,c,a)}this.removeRow(c);if(d!==true){this.processRows(c);this.applyEmptyText();this.fireEvent(\"rowremoved\",this,c,a)}},onLoad:function(){if(Ext.isGecko){if(!this.scrollToTopTask){this.scrollToTopTask=new Ext.util.DelayedTask(this.scrollToTop,this)}this.scrollToTopTask.delay(1)}else{this.scrollToTop()}},onColWidthChange:function(a,b,c){this.updateColumnWidth(b,c)},onHeaderChange:function(a,b,c){this.updateHeaders()},onHiddenChange:function(a,b,c){this.updateColumnHidden(b,c)},onColumnMove:function(a,c,b){this.indexMap=null;this.refresh(true);this.restoreScroll(this.getScrollState());this.afterMove(b);this.grid.fireEvent(\"columnmove\",c,b)},onColConfigChange:function(){delete this.lastViewWidth;this.indexMap=null;this.refresh(true)},initUI:function(a){a.on(\"headerclick\",this.onHeaderClick,this)},initEvents:Ext.emptyFn,onHeaderClick:function(b,a){if(this.headersDisabled||!this.cm.isSortable(a)){return}b.stopEditing(true);b.store.sort(this.cm.getDataIndex(a))},onRowOver:function(b,a){var c=this.findRowIndex(a);if(c!==false){this.addRowClass(c,this.rowOverCls)}},onRowOut:function(b,a){var c=this.findRowIndex(a);if(c!==false&&!b.within(this.getRow(c),true)){this.removeRowClass(c,this.rowOverCls)}},onRowSelect:function(a){this.addRowClass(a,this.selectedRowClass)},onRowDeselect:function(a){this.removeRowClass(a,this.selectedRowClass)},onCellSelect:function(c,b){var a=this.getCell(c,b);if(a){this.fly(a).addClass(\"x-grid3-cell-selected\")}},onCellDeselect:function(c,b){var a=this.getCell(c,b);if(a){this.fly(a).removeClass(\"x-grid3-cell-selected\")}},handleWheel:function(a){a.stopPropagation()},onColumnSplitterMoved:function(a,b){this.userResized=true;this.grid.colModel.setColumnWidth(a,b,true);if(this.forceFit){this.fitColumns(true,false,a);this.updateAllColumnWidths()}else{this.updateColumnWidth(a,b);this.syncHeaderScroll()}this.grid.fireEvent(\"columnresize\",a,b)},beforeColMenuShow:function(){var b=this.cm,d=b.getColumnCount(),a=this.colMenu,c;a.removeAll();for(c=0;c<d;c++){if(b.config[c].hideable!==false){a.add(new Ext.menu.CheckItem({text:b.getColumnHeader(c),itemId:\"col-\"+b.getColumnId(c),checked:!b.isHidden(c),disabled:b.config[c].hideable===false,hideOnClick:false}))}}},handleHdMenuClick:function(c){var a=this.ds,b=this.cm.getDataIndex(this.hdCtxIndex);switch(c.getItemId()){case\"asc\":a.sort(b,\"ASC\");break;case\"desc\":a.sort(b,\"DESC\");break;default:this.handleHdMenuClickDefault(c)}return true},handleHdMenuClickDefault:function(c){var b=this.cm,d=c.getItemId(),a=b.getIndexById(d.substr(4));if(a!=-1){if(c.checked&&b.getColumnsBy(this.isHideableColumn,this).length<=1){this.onDenyColumnHide();return}b.setHidden(a,c.checked)}},handleHdDown:function(i,j){if(Ext.fly(j).hasClass(\"x-grid3-hd-btn\")){i.stopEvent();var k=this.cm,g=this.findHeaderCell(j),h=this.getCellIndex(g),d=k.isSortable(h),c=this.hmenu,b=c.items,a=this.headerMenuOpenCls,l;this.hdCtxIndex=h;Ext.fly(g).addClass(a);if(this.hideSortIcons){b.get(\"asc\").setVisible(d);b.get(\"desc\").setVisible(d);l=b.get(\"sortSep\");if(l){l.setVisible(d)}}else{b.get(\"asc\").setDisabled(!d);b.get(\"desc\").setDisabled(!d)}c.on(\"hide\",function(){Ext.fly(g).removeClass(a)},this,{single:true});c.show(j,\"tl-bl?\")}},handleHdMove:function(k){var i=this.findHeaderCell(this.activeHdRef);if(i&&!this.headersDisabled){var l=this.splitHandleWidth||5,j=this.activeHdRegion,p=i.style,m=this.cm,o=\"\",g=k.getPageX();if(this.grid.enableColumnResize!==false){var a=this.activeHdIndex,b=this.getPreviousVisible(a),n=m.isResizable(a),c=b&&m.isResizable(b),d=g-j.left<=l,h=j.right-g<=(!this.activeHdBtn?l:2);if(d&&c){o=Ext.isAir?\"move\":Ext.isWebKit?\"e-resize\":\"col-resize\"}else{if(h&&n){o=Ext.isAir?\"move\":Ext.isWebKit?\"w-resize\":\"col-resize\"}}}p.cursor=o}},getPreviousVisible:function(a){while(a>0){if(!this.cm.isHidden(a-1)){return a}a--}return undefined},handleHdOver:function(c,b){var d=this.findHeaderCell(b);if(d&&!this.headersDisabled){var a=this.fly(d);this.activeHdRef=b;this.activeHdIndex=this.getCellIndex(d);this.activeHdRegion=a.getRegion();if(!this.isMenuDisabled(this.activeHdIndex,a)){a.addClass(\"x-grid3-hd-over\");this.activeHdBtn=a.child(\".x-grid3-hd-btn\");if(this.activeHdBtn){this.activeHdBtn.dom.style.height=(d.firstChild.offsetHeight-1)+\"px\"}}}},handleHdOut:function(b,a){var c=this.findHeaderCell(a);if(c&&(!Ext.isIE9m||!b.within(c,true))){this.activeHdRef=null;this.fly(c).removeClass(\"x-grid3-hd-over\");c.style.cursor=\"\"}},isMenuDisabled:function(a,b){return this.cm.isMenuDisabled(a)},hasRows:function(){var a=this.mainBody.dom.firstChild;return a&&a.nodeType==1&&a.className!=\"x-grid-empty\"},isHideableColumn:function(a){return !a.hidden},bind:function(a,b){this.initData(a,b)}});Ext.grid.GridView.SplitDragZone=Ext.extend(Ext.dd.DDProxy,{constructor:function(a,b){this.grid=a;this.view=a.getView();this.marker=this.view.resizeMarker;this.proxy=this.view.resizeProxy;Ext.grid.GridView.SplitDragZone.superclass.constructor.call(this,b,\"gridSplitters\"+this.grid.getGridEl().id,{dragElId:Ext.id(this.proxy.dom),resizeFrame:false});this.scroll=false;this.hw=this.view.splitHandleWidth||5},b4StartDrag:function(a,e){this.dragHeadersDisabled=this.view.headersDisabled;this.view.headersDisabled=true;var d=this.view.mainWrap.getHeight();this.marker.setHeight(d);this.marker.show();this.marker.alignTo(this.view.getHeaderCell(this.cellIndex),\"tl-tl\",[-2,0]);this.proxy.setHeight(d);var b=this.cm.getColumnWidth(this.cellIndex),c=Math.max(b-this.grid.minColumnWidth,0);this.resetConstraints();this.setXConstraint(c,1000);this.setYConstraint(0,0);this.minX=a-c;this.maxX=a+1000;this.startPos=a;Ext.dd.DDProxy.prototype.b4StartDrag.call(this,a,e)},allowHeaderDrag:function(a){return true},handleMouseDown:function(a){var h=this.view.findHeaderCell(a.getTarget());if(h&&this.allowHeaderDrag(a)){var k=this.view.fly(h).getXY(),c=k[0],i=a.getXY(),b=i[0],g=h.offsetWidth,d=false;if((b-c)<=this.hw){d=-1}else{if((c+g)-b<=this.hw){d=0}}if(d!==false){this.cm=this.grid.colModel;var j=this.view.getCellIndex(h);if(d==-1){if(j+d<0){return}while(this.cm.isHidden(j+d)){--d;if(j+d<0){return}}}this.cellIndex=j+d;this.split=h.dom;if(this.cm.isResizable(this.cellIndex)&&!this.cm.isFixed(this.cellIndex)){Ext.grid.GridView.SplitDragZone.superclass.handleMouseDown.apply(this,arguments)}}else{if(this.view.columnDrag){this.view.columnDrag.callHandleMouseDown(a)}}}},endDrag:function(g){this.marker.hide();var a=this.view,c=Math.max(this.minX,g.getPageX()),d=c-this.startPos,b=this.dragHeadersDisabled;a.onColumnSplitterMoved(this.cellIndex,this.cm.getColumnWidth(this.cellIndex)+d);setTimeout(function(){a.headersDisabled=b},50)},autoOffset:function(){this.setDelta(0,0)}});Ext.grid.PivotGridView=Ext.extend(Ext.grid.GridView,{colHeaderCellCls:\"grid-hd-group-cell\",title:\"\",getColumnHeaders:function(){return this.grid.topAxis.buildHeaders()},getRowHeaders:function(){return this.grid.leftAxis.buildHeaders()},renderRows:function(a,t){var b=this.grid,o=b.extractData(),p=o.length,g=this.templates,s=b.renderer,h=typeof s==\"function\",w=this.getCellCls,n=typeof w==\"function\",d=g.cell,x=g.row,k=[],q={},c=\"width:\"+this.getGridInnerWidth()+\"px;\",l,r,e,v,m;a=a||0;t=Ext.isDefined(t)?t:p-1;for(v=0;v<p;v++){m=o[v];r=m.length;l=[];for(var u=0;u<r;u++){q.id=v+\"-\"+u;q.css=u===0?\"x-grid3-cell-first \":(u==(r-1)?\"x-grid3-cell-last \":\"\");q.attr=q.cellAttr=\"\";q.value=m[u];if(Ext.isEmpty(q.value)){q.value=\"&#160;\"}if(h){q.value=s(q.value)}if(n){q.css+=w(q.value)+\" \"}l[l.length]=d.apply(q)}k[k.length]=x.apply({tstyle:c,cols:r,cells:l.join(\"\"),alt:\"\"})}return k.join(\"\")},masterTpl:new Ext.Template('<div class=\"x-grid3 x-pivotgrid\" hidefocus=\"true\">','<div class=\"x-grid3-viewport\">','<div class=\"x-grid3-header\">','<div class=\"x-grid3-header-title\"><span>{title}</span></div>','<div class=\"x-grid3-header-inner\">','<div class=\"x-grid3-header-offset\" style=\"{ostyle}\"></div>',\"</div>\",'<div class=\"x-clear\"></div>',\"</div>\",'<div class=\"x-grid3-scroller\">','<div class=\"x-grid3-row-headers\"></div>','<div class=\"x-grid3-body\" style=\"{bstyle}\">{body}</div>','<a href=\"#\" class=\"x-grid3-focus\" tabIndex=\"-1\"></a>',\"</div>\",\"</div>\",'<div class=\"x-grid3-resize-marker\">&#160;</div>','<div class=\"x-grid3-resize-proxy\">&#160;</div>',\"</div>\"),initTemplates:function(){Ext.grid.PivotGridView.superclass.initTemplates.apply(this,arguments);var a=this.templates||{};if(!a.gcell){a.gcell=new Ext.XTemplate('<td class=\"x-grid3-hd x-grid3-gcell x-grid3-td-{id} ux-grid-hd-group-row-{row} '+this.colHeaderCellCls+'\" style=\"{style}\">','<div {tooltip} class=\"x-grid3-hd-inner x-grid3-hd-{id} x-unselectable\" unselectable=\"on\" style=\"{istyle}\">',this.grid.enableHdMenu?'<a class=\"x-grid3-hd-btn\" href=\"#\"></a>':\"\",\"{value}\",\"</div>\",\"</td>\")}this.templates=a;this.hrowRe=new RegExp(\"ux-grid-hd-group-row-(\\\\d+)\",\"\")},initElements:function(){Ext.grid.PivotGridView.superclass.initElements.apply(this,arguments);this.rowHeadersEl=new Ext.Element(this.scroller.child(\"div.x-grid3-row-headers\"));this.headerTitleEl=new Ext.Element(this.mainHd.child(\"div.x-grid3-header-title\"))},getGridInnerWidth:function(){var a=Ext.grid.PivotGridView.superclass.getGridInnerWidth.apply(this,arguments);return a-this.getTotalRowHeaderWidth()},getTotalRowHeaderWidth:function(){var d=this.getRowHeaders(),c=d.length,b=0,a;for(a=0;a<c;a++){b+=d[a].width}return b},getTotalColumnHeaderHeight:function(){return this.getColumnHeaders().length*21},getCellIndex:function(b){if(b){var a=b.className.match(this.colRe),c;if(a&&(c=a[1])){return parseInt(c.split(\"-\")[1],10)}}return false},renderUI:function(){var b=this.templates,a=this.getGridInnerWidth();return b.master.apply({body:b.body.apply({rows:\"&#160;\"}),ostyle:\"width:\"+a+\"px\",bstyle:\"width:\"+a+\"px\"})},onLayout:function(b,a){Ext.grid.PivotGridView.superclass.onLayout.apply(this,arguments);var b=this.getGridInnerWidth();this.resizeColumnHeaders(b);this.resizeAllRows(b)},refresh:function(b){this.fireEvent(\"beforerefresh\",this);this.grid.stopEditing(true);var a=this.renderBody();this.mainBody.update(a).setWidth(this.getGridInnerWidth());if(b===true){this.updateHeaders();this.updateHeaderSortState()}this.processRows(0,true);this.layout();this.applyEmptyText();this.fireEvent(\"refresh\",this)},renderHeaders:Ext.emptyFn,fitColumns:Ext.emptyFn,resizeColumnHeaders:function(b){var a=this.grid.topAxis;if(a.rendered){a.el.setWidth(b)}},resizeRowHeaders:function(){var a=this.getTotalRowHeaderWidth(),b=String.format(\"margin-left: {0}px;\",a);this.rowHeadersEl.setWidth(a);this.mainBody.applyStyles(b);Ext.fly(this.innerHd).applyStyles(b);this.headerTitleEl.setWidth(a);this.headerTitleEl.setHeight(this.getTotalColumnHeaderHeight())},resizeAllRows:function(b){var d=this.getRows(),c=d.length,a;for(a=0;a<c;a++){Ext.fly(d[a]).setWidth(b);Ext.fly(d[a]).child(\"table\").setWidth(b)}},updateHeaders:function(){this.renderGroupRowHeaders();this.renderGroupColumnHeaders()},renderGroupRowHeaders:function(){var a=this.grid.leftAxis;this.resizeRowHeaders();a.rendered=false;a.render(this.rowHeadersEl);this.setTitle(this.title)},setTitle:function(a){this.headerTitleEl.child(\"span\").dom.innerHTML=a},renderGroupColumnHeaders:function(){var a=this.grid.topAxis;a.rendered=false;a.render(this.innerHd.firstChild)},isMenuDisabled:function(a,b){return true}});Ext.grid.PivotAxis=Ext.extend(Ext.Component,{orientation:\"horizontal\",defaultHeaderWidth:80,paddingWidth:7,setDimensions:function(a){this.dimensions=a},onRender:function(b,a){var c=this.orientation==\"horizontal\"?this.renderHorizontalRows():this.renderVerticalRows();this.el=Ext.DomHelper.overwrite(b.dom,{tag:\"table\",cn:c},true)},renderHorizontalRows:function(){var k=this.buildHeaders(),a=k.length,g=[],c,h,e,d,b;for(d=0;d<a;d++){c=[];h=k[d].items;e=h.length;for(b=0;b<e;b++){c.push({tag:\"td\",html:h[b].header,colspan:h[b].span})}g[d]={tag:\"tr\",cn:c}}return g},renderVerticalRows:function(){var b=this.buildHeaders(),k=b.length,a=[],m=[],h,c,l,g,e,d;for(e=0;e<k;e++){c=b[e];g=c.width||80;h=c.items.length;for(d=0;d<h;d++){l=c.items[d];a[l.start]=a[l.start]||[];a[l.start].push({tag:\"td\",html:l.header,rowspan:l.span,width:Ext.isBorderBox?g:g-this.paddingWidth})}}h=a.length;for(e=0;e<h;e++){m[e]={tag:\"tr\",cn:a[e]}}return m},getTuples:function(){var b=new Ext.data.Store({});b.data=this.store.data.clone();b.fields=this.store.fields;var l=[],a=this.dimensions,c=a.length,j;for(j=0;j<c;j++){l.push({field:a[j].dataIndex,direction:a[j].direction||\"ASC\"})}b.sort(l);var e=b.data.items,n=[],k=[],o,h,d,g,m;c=e.length;for(j=0;j<c;j++){d=this.getRecordInfo(e[j]);g=d.data;h=\"\";for(m in g){h+=g[m]+\"---\"}if(n.indexOf(h)==-1){n.push(h);k.push(d)}}b.destroy();return k},getRecordInfo:function(a){var e=this.dimensions,d=e.length,h={},j,c,b;for(b=0;b<d;b++){j=e[b];c=j.dataIndex;h[c]=a.get(c)}var g=function(i){return function(k){for(var l in i){if(k.get(l)!=i[l]){return false}}return true}};return{data:h,matcher:g(h)}},buildHeaders:function(){var l=this.getTuples(),m=l.length,a=this.dimensions,e,r=a.length,c=[],o,s,n,q,p,b,k,h,g,d;for(g=0;g<r;g++){e=a[g];s=[];p=0;b=0;for(d=0;d<m;d++){o=l[d];k=d==(m-1);n=o.data[e.dataIndex];h=q!=undefined&&q!=n;if(g>0&&d>0){h=h||o.data[a[g-1].dataIndex]!=l[d-1].data[a[g-1].dataIndex]}if(h){s.push({header:q,span:p,start:b});b+=p;p=0}if(k){s.push({header:n,span:p+1,start:b});b+=p;p=0}q=n;p++}c.push({items:s,width:e.width||this.defaultHeaderWidth});q=undefined}return c}});Ext.grid.HeaderDragZone=Ext.extend(Ext.dd.DragZone,{maxDragWidth:120,constructor:function(a,c,b){this.grid=a;this.view=a.getView();this.ddGroup=\"gridHeader\"+this.grid.getGridEl().id;Ext.grid.HeaderDragZone.superclass.constructor.call(this,c);if(b){this.setHandleElId(Ext.id(c));this.setOuterHandleElId(Ext.id(b))}this.scroll=false},getDragData:function(c){var a=Ext.lib.Event.getTarget(c),b=this.view.findHeaderCell(a);if(b){return{ddel:b.firstChild,header:b}}return false},onInitDrag:function(a){this.dragHeadersDisabled=this.view.headersDisabled;this.view.headersDisabled=true;var b=this.dragData.ddel.cloneNode(true);b.id=Ext.id();b.style.width=Math.min(this.dragData.header.offsetWidth,this.maxDragWidth)+\"px\";this.proxy.update(b);return true},afterValidDrop:function(){this.completeDrop()},afterInvalidDrop:function(){this.completeDrop()},completeDrop:function(){var a=this.view,b=this.dragHeadersDisabled;setTimeout(function(){a.headersDisabled=b},50)}});Ext.grid.HeaderDropZone=Ext.extend(Ext.dd.DropZone,{proxyOffsets:[-4,-9],fly:Ext.Element.fly,constructor:function(a,c,b){this.grid=a;this.view=a.getView();this.proxyTop=Ext.DomHelper.append(document.body,{cls:\"col-move-top\",html:\"&#160;\"},true);this.proxyBottom=Ext.DomHelper.append(document.body,{cls:\"col-move-bottom\",html:\"&#160;\"},true);this.proxyTop.hide=this.proxyBottom.hide=function(){this.setLeftTop(-100,-100);this.setStyle(\"visibility\",\"hidden\")};this.ddGroup=\"gridHeader\"+this.grid.getGridEl().id;Ext.grid.HeaderDropZone.superclass.constructor.call(this,a.getGridEl().dom)},getTargetFromEvent:function(c){var a=Ext.lib.Event.getTarget(c),b=this.view.findCellIndex(a);if(b!==false){return this.view.getHeaderCell(b)}},nextVisible:function(c){var b=this.view,a=this.grid.colModel;c=c.nextSibling;while(c){if(!a.isHidden(b.getCellIndex(c))){return c}c=c.nextSibling}return null},prevVisible:function(c){var b=this.view,a=this.grid.colModel;c=c.prevSibling;while(c){if(!a.isHidden(b.getCellIndex(c))){return c}c=c.prevSibling}return null},positionIndicator:function(d,k,j){var a=Ext.lib.Event.getPageX(j),g=Ext.lib.Dom.getRegion(k.firstChild),c,i,b=g.top+this.proxyOffsets[1];if((g.right-a)<=(g.right-g.left)/2){c=g.right+this.view.borderWidth;i=\"after\"}else{c=g.left;i=\"before\"}if(this.grid.colModel.isFixed(this.view.getCellIndex(k))){return false}c+=this.proxyOffsets[0];this.proxyTop.setLeftTop(c,b);this.proxyTop.show();if(!this.bottomOffset){this.bottomOffset=this.view.mainHd.getHeight()}this.proxyBottom.setLeftTop(c,b+this.proxyTop.dom.offsetHeight+this.bottomOffset);this.proxyBottom.show();return i},onNodeEnter:function(d,a,c,b){if(b.header!=d){this.positionIndicator(b.header,d,c)}},onNodeOver:function(g,b,d,c){var a=false;if(c.header!=g){a=this.positionIndicator(c.header,g,d)}if(!a){this.proxyTop.hide();this.proxyBottom.hide()}return a?this.dropAllowed:this.dropNotAllowed},onNodeOut:function(d,a,c,b){this.proxyTop.hide();this.proxyBottom.hide()},onNodeDrop:function(b,m,g,c){var d=c.header;if(d!=b){var k=this.grid.colModel,j=Ext.lib.Event.getPageX(g),a=Ext.lib.Dom.getRegion(b.firstChild),o=(a.right-j)<=((a.right-a.left)/2)?\"after\":\"before\",i=this.view.getCellIndex(d),l=this.view.getCellIndex(b);if(o==\"after\"){l++}if(i<l){l--}k.moveColumn(i,l);return true}return false}});Ext.grid.GridView.ColumnDragZone=Ext.extend(Ext.grid.HeaderDragZone,{constructor:function(a,b){Ext.grid.GridView.ColumnDragZone.superclass.constructor.call(this,a,b,null);this.proxy.el.addClass(\"x-grid3-col-dd\")},handleMouseDown:function(a){},callHandleMouseDown:function(a){Ext.grid.GridView.ColumnDragZone.superclass.handleMouseDown.call(this,a)}});Ext.grid.SplitDragZone=Ext.extend(Ext.dd.DDProxy,{fly:Ext.Element.fly,constructor:function(a,c,b){this.grid=a;this.view=a.getView();this.proxy=this.view.resizeProxy;Ext.grid.SplitDragZone.superclass.constructor.call(this,c,\"gridSplitters\"+this.grid.getGridEl().id,{dragElId:Ext.id(this.proxy.dom),resizeFrame:false});this.setHandleElId(Ext.id(c));this.setOuterHandleElId(Ext.id(b));this.scroll=false},b4StartDrag:function(a,d){this.view.headersDisabled=true;this.proxy.setHeight(this.view.mainWrap.getHeight());var b=this.cm.getColumnWidth(this.cellIndex);var c=Math.max(b-this.grid.minColumnWidth,0);this.resetConstraints();this.setXConstraint(c,1000);this.setYConstraint(0,0);this.minX=a-c;this.maxX=a+1000;this.startPos=a;Ext.dd.DDProxy.prototype.b4StartDrag.call(this,a,d)},handleMouseDown:function(c){var b=Ext.EventObject.setEvent(c);var a=this.fly(b.getTarget());if(a.hasClass(\"x-grid-split\")){this.cellIndex=this.view.getCellIndex(a.dom);this.split=a.dom;this.cm=this.grid.colModel;if(this.cm.isResizable(this.cellIndex)&&!this.cm.isFixed(this.cellIndex)){Ext.grid.SplitDragZone.superclass.handleMouseDown.apply(this,arguments)}}},endDrag:function(c){this.view.headersDisabled=false;var a=Math.max(this.minX,Ext.lib.Event.getPageX(c));var b=a-this.startPos;this.view.onColumnSplitterMoved(this.cellIndex,this.cm.getColumnWidth(this.cellIndex)+b)},autoOffset:function(){this.setDelta(0,0)}});Ext.grid.GridDragZone=function(b,a){this.view=b.getView();Ext.grid.GridDragZone.superclass.constructor.call(this,this.view.mainBody.dom,a);this.scroll=false;this.grid=b;this.ddel=document.createElement(\"div\");this.ddel.className=\"x-grid-dd-wrap\";this.preventDefault=true};Ext.extend(Ext.grid.GridDragZone,Ext.dd.DragZone,{ddGroup:\"GridDD\",getDragData:function(g){var c=Ext.lib.Event.getTarget(g),i,h=this.view.findRowIndex(c),b,a,d;if(h!==false){i=this.grid.selModel;if(i.getSelectedCell){b=this.view.findCellIndex(c);a=i.getSelectedCell();if(!a||a[0]!==h||a[1]!==b){i.handleMouseDown(this.grid,h,b,g)}if(this.grid.dragCell){d=i.getSelectedCell();if(!this.grid.hasOwnProperty(\"ddText\")){this.grid.ddText=\"{0} selected cell{1}\"}}else{d=[this.grid.store.getAt(h)]}}else{if(!i.isSelected(h)||g.hasModifier()){i.handleMouseDown(this.grid,h,g)}d=i.getSelections()}return{grid:this.grid,ddel:this.ddel,rowIndex:h,selections:d}}return false},onInitDrag:function(b){var a=this.dragData;this.ddel.innerHTML=this.grid.getDragDropText();this.proxy.update(this.ddel)},afterRepair:function(){this.dragging=false},getRepairXY:function(b,a){return false},onEndDrag:function(a,b){},onValidDrop:function(a,b,c){this.hideProxy()},beforeInvalidDrop:function(a,b){}});Ext.grid.ColumnModel=Ext.extend(Ext.util.Observable,{defaultWidth:100,defaultSortable:false,constructor:function(a){if(a.columns){Ext.apply(this,a);this.setConfig(a.columns,true)}else{this.setConfig(a,true)}this.addEvents(\"widthchange\",\"headerchange\",\"hiddenchange\",\"columnmoved\",\"configchange\");Ext.grid.ColumnModel.superclass.constructor.call(this)},getColumnId:function(a){return this.config[a].id},getColumnAt:function(a){return this.config[a]},setConfig:function(d,b){var e,h,a;if(!b){delete this.totalWidth;for(e=0,a=this.config.length;e<a;e++){h=this.config[e];if(h.setEditor){h.setEditor(null)}}}this.defaults=Ext.apply({width:this.defaultWidth,sortable:this.defaultSortable},this.defaults);this.config=d;this.lookup={};for(e=0,a=d.length;e<a;e++){h=Ext.applyIf(d[e],this.defaults);if(Ext.isEmpty(h.id)){h.id=e}if(!h.isColumn){var g=Ext.grid.Column.types[h.xtype||\"gridcolumn\"];h=new g(h);d[e]=h}this.lookup[h.id]=h}if(!b){this.fireEvent(\"configchange\",this)}},getColumnById:function(a){return this.lookup[a]},getIndexById:function(c){for(var b=0,a=this.config.length;b<a;b++){if(this.config[b].id==c){return b}}return -1},moveColumn:function(e,b){var a=this.config,d=a[e];a.splice(e,1);a.splice(b,0,d);this.dataMap=null;this.fireEvent(\"columnmoved\",this,e,b)},getColumnCount:function(b){var d=this.config.length,e=0,a;if(b===true){for(a=0;a<d;a++){if(!this.isHidden(a)){e++}}return e}return d},getColumnsBy:function(g,e){var b=this.config,h=b.length,a=[],d,j;for(d=0;d<h;d++){j=b[d];if(g.call(e||this,j,d)===true){a[a.length]=j}}return a},isSortable:function(a){return !!this.config[a].sortable},isMenuDisabled:function(a){return !!this.config[a].menuDisabled},getRenderer:function(a){return this.config[a].renderer||Ext.grid.ColumnModel.defaultRenderer},getRendererScope:function(a){return this.config[a].scope},setRenderer:function(a,b){this.config[a].renderer=b},getColumnWidth:function(a){var b=this.config[a].width;if(typeof b!=\"number\"){b=this.defaultWidth}return b},setColumnWidth:function(b,c,a){this.config[b].width=c;this.totalWidth=null;if(!a){this.fireEvent(\"widthchange\",this,b,c)}},getTotalWidth:function(b){if(!this.totalWidth){this.totalWidth=0;for(var c=0,a=this.config.length;c<a;c++){if(b||!this.isHidden(c)){this.totalWidth+=this.getColumnWidth(c)}}}return this.totalWidth},getColumnHeader:function(a){return this.config[a].header},setColumnHeader:function(a,b){this.config[a].header=b;this.fireEvent(\"headerchange\",this,a,b)},getColumnTooltip:function(a){return this.config[a].tooltip},setColumnTooltip:function(a,b){this.config[a].tooltip=b},getDataIndex:function(a){return this.config[a].dataIndex},setDataIndex:function(a,b){this.config[a].dataIndex=b},findColumnIndex:function(d){var e=this.config;for(var b=0,a=e.length;b<a;b++){if(e[b].dataIndex==d){return b}}return -1},isCellEditable:function(b,e){var d=this.config[b],a=d.editable;return !!(a||(!Ext.isDefined(a)&&d.editor))},getCellEditor:function(a,b){return this.config[a].getCellEditor(b)},setEditable:function(a,b){this.config[a].editable=b},isHidden:function(a){return !!this.config[a].hidden},isFixed:function(a){return !!this.config[a].fixed},isResizable:function(a){return a>=0&&this.config[a].resizable!==false&&this.config[a].fixed!==true},setHidden:function(a,b){var d=this.config[a];if(d.hidden!==b){d.hidden=b;this.totalWidth=null;this.fireEvent(\"hiddenchange\",this,a,b)}},setEditor:function(a,b){this.config[a].setEditor(b)},destroy:function(){var b=this.config.length,a=0;for(;a<b;a++){this.config[a].destroy()}delete this.config;delete this.lookup;this.purgeListeners()},setState:function(a,b){b=Ext.applyIf(b,this.defaults);Ext.apply(this.config[a],b)}});Ext.grid.ColumnModel.defaultRenderer=function(a){if(typeof a==\"string\"&&a.length<1){return\"&#160;\"}return a};Ext.grid.AbstractSelectionModel=Ext.extend(Ext.util.Observable,{constructor:function(){this.locked=false;Ext.grid.AbstractSelectionModel.superclass.constructor.call(this)},init:function(a){this.grid=a;if(this.lockOnInit){delete this.lockOnInit;this.locked=false;this.lock()}this.initEvents()},lock:function(){if(!this.locked){this.locked=true;var a=this.grid;if(a){a.getView().on({scope:this,beforerefresh:this.sortUnLock,refresh:this.sortLock})}else{this.lockOnInit=true}}},sortLock:function(){this.locked=true},sortUnLock:function(){this.locked=false},unlock:function(){if(this.locked){this.locked=false;var a=this.grid,b;if(a){b=a.getView();b.un(\"beforerefresh\",this.sortUnLock,this);b.un(\"refresh\",this.sortLock,this)}else{delete this.lockOnInit}}},isLocked:function(){return this.locked},destroy:function(){this.unlock();this.purgeListeners()}});Ext.grid.RowSelectionModel=Ext.extend(Ext.grid.AbstractSelectionModel,{singleSelect:false,constructor:function(a){Ext.apply(this,a);this.selections=new Ext.util.MixedCollection(false,function(b){return b.id});this.last=false;this.lastActive=false;this.addEvents(\"selectionchange\",\"beforerowselect\",\"rowselect\",\"rowdeselect\");Ext.grid.RowSelectionModel.superclass.constructor.call(this)},initEvents:function(){if(!this.grid.enableDragDrop&&!this.grid.enableDrag){this.grid.on(\"rowmousedown\",this.handleMouseDown,this)}this.rowNav=new Ext.KeyNav(this.grid.getGridEl(),{up:this.onKeyPress,down:this.onKeyPress,scope:this});this.grid.getView().on({scope:this,refresh:this.onRefresh,rowupdated:this.onRowUpdated,rowremoved:this.onRemove})},onKeyPress:function(g,b){var a=b==\"up\",h=a?\"selectPrevious\":\"selectNext\",d=a?-1:1,c;if(!g.shiftKey||this.singleSelect){this[h](false)}else{if(this.last!==false&&this.lastActive!==false){c=this.last;this.selectRange(this.last,this.lastActive+d);this.grid.getView().focusRow(this.lastActive);if(c!==false){this.last=c}}else{this.selectFirstRow()}}},onRefresh:function(){var g=this.grid.store,d=this.getSelections(),c=0,a=d.length,b,e;this.silent=true;this.clearSelections(true);for(;c<a;c++){e=d[c];if((b=g.indexOfId(e.id))!=-1){this.selectRow(b,true)}}if(d.length!=this.selections.getCount()){this.fireEvent(\"selectionchange\",this)}this.silent=false},onRemove:function(a,b,c){if(this.selections.remove(c)!==false){this.fireEvent(\"selectionchange\",this)}},onRowUpdated:function(a,b,c){if(this.isSelected(c)){a.onRowSelect(b)}},selectRecords:function(b,e){if(!e){this.clearSelections()}var d=this.grid.store,c=0,a=b.length;for(;c<a;c++){this.selectRow(d.indexOf(b[c]),true)}},getCount:function(){return this.selections.length},selectFirstRow:function(){this.selectRow(0)},selectLastRow:function(a){this.selectRow(this.grid.store.getCount()-1,a)},selectNext:function(a){if(this.hasNext()){this.selectRow(this.last+1,a);this.grid.getView().focusRow(this.last);return true}return false},selectPrevious:function(a){if(this.hasPrevious()){this.selectRow(this.last-1,a);this.grid.getView().focusRow(this.last);return true}return false},hasNext:function(){return this.last!==false&&(this.last+1)<this.grid.store.getCount()},hasPrevious:function(){return !!this.last},getSelections:function(){return[].concat(this.selections.items)},getSelected:function(){return this.selections.itemAt(0)},each:function(e,d){var c=this.getSelections(),b=0,a=c.length;for(;b<a;b++){if(e.call(d||this,c[b],b)===false){return false}}return true},clearSelections:function(a){if(this.isLocked()){return}if(a!==true){var c=this.grid.store,b=this.selections;b.each(function(d){this.deselectRow(c.indexOfId(d.id))},this);b.clear()}else{this.selections.clear()}this.last=false},selectAll:function(){if(this.isLocked()){return}this.selections.clear();for(var b=0,a=this.grid.store.getCount();b<a;b++){this.selectRow(b,true)}},hasSelection:function(){return this.selections.length>0},isSelected:function(a){var b=Ext.isNumber(a)?this.grid.store.getAt(a):a;return(b&&this.selections.key(b.id)?true:false)},isIdSelected:function(a){return(this.selections.key(a)?true:false)},handleMouseDown:function(d,i,h){if(h.button!==0||this.isLocked()){return}var a=this.grid.getView();if(h.shiftKey&&!this.singleSelect&&this.last!==false){var c=this.last;this.selectRange(c,i,h.ctrlKey);this.last=c;a.focusRow(i)}else{var b=this.isSelected(i);if(h.ctrlKey&&b){this.deselectRow(i)}else{if(!b||this.getCount()>1){this.selectRow(i,h.ctrlKey||h.shiftKey);a.focusRow(i)}}}},selectRows:function(c,d){if(!d){this.clearSelections()}for(var b=0,a=c.length;b<a;b++){this.selectRow(c[b],true)}},selectRange:function(b,a,d){var c;if(this.isLocked()){return}if(!d){this.clearSelections()}if(b<=a){for(c=b;c<=a;c++){this.selectRow(c,true)}}else{for(c=b;c>=a;c--){this.selectRow(c,true)}}},deselectRange:function(c,b,a){if(this.isLocked()){return}for(var d=c;d<=b;d++){this.deselectRow(d,a)}},selectRow:function(b,d,a){if(this.isLocked()||(b<0||b>=this.grid.store.getCount())||(d&&this.isSelected(b))){return}var c=this.grid.store.getAt(b);if(c&&this.fireEvent(\"beforerowselect\",this,b,d,c)!==false){if(!d||this.singleSelect){this.clearSelections()}this.selections.add(c);this.last=this.lastActive=b;if(!a){this.grid.getView().onRowSelect(b)}if(!this.silent){this.fireEvent(\"rowselect\",this,b,c);this.fireEvent(\"selectionchange\",this)}}},deselectRow:function(b,a){if(this.isLocked()){return}if(this.last==b){this.last=false}if(this.lastActive==b){this.lastActive=false}var c=this.grid.store.getAt(b);if(c){this.selections.remove(c);if(!a){this.grid.getView().onRowDeselect(b)}this.fireEvent(\"rowdeselect\",this,b,c);this.fireEvent(\"selectionchange\",this)}},acceptsNav:function(c,b,a){return !a.isHidden(b)&&a.isCellEditable(b,c)},onEditorKey:function(n,l){var d=l.getKey(),h,i=this.grid,p=i.lastEdit,j=i.activeEditor,b=l.shiftKey,o,p,a,m;if(d==l.TAB){l.stopEvent();j.completeEdit();if(b){h=i.walkCells(j.row,j.col-1,-1,this.acceptsNav,this)}else{h=i.walkCells(j.row,j.col+1,1,this.acceptsNav,this)}}else{if(d==l.ENTER){if(this.moveEditorOnEnter!==false){if(b){h=i.walkCells(p.row-1,p.col,-1,this.acceptsNav,this)}else{h=i.walkCells(p.row+1,p.col,1,this.acceptsNav,this)}}}}if(h){a=h[0];m=h[1];this.onEditorSelect(a,p.row);if(i.isEditor&&i.editing){o=i.activeEditor;if(o&&o.field.triggerBlur){o.field.triggerBlur()}}i.startEditing(a,m)}},onEditorSelect:function(b,a){if(a!=b){this.selectRow(b)}},destroy:function(){Ext.destroy(this.rowNav);this.rowNav=null;Ext.grid.RowSelectionModel.superclass.destroy.call(this)}});Ext.grid.Column=Ext.extend(Ext.util.Observable,{isColumn:true,constructor:function(b){Ext.apply(this,b);if(Ext.isString(this.renderer)){this.renderer=Ext.util.Format[this.renderer]}else{if(Ext.isObject(this.renderer)){this.scope=this.renderer.scope;this.renderer=this.renderer.fn}}if(!this.scope){this.scope=this}var a=this.editor;delete this.editor;this.setEditor(a);this.addEvents(\"click\",\"contextmenu\",\"dblclick\",\"mousedown\");Ext.grid.Column.superclass.constructor.call(this)},processEvent:function(b,d,c,g,a){return this.fireEvent(b,this,c,g,d)},destroy:function(){if(this.setEditor){this.setEditor(null)}this.purgeListeners()},renderer:function(a){return a},getEditor:function(a){return this.editable!==false?this.editor:null},setEditor:function(b){var a=this.editor;if(a){if(a.gridEditor){a.gridEditor.destroy();delete a.gridEditor}else{a.destroy()}}this.editor=null;if(b){if(!b.isXType){b=Ext.create(b,\"textfield\")}this.editor=b}},getCellEditor:function(b){var a=this.getEditor(b);if(a){if(!a.startEdit){if(!a.gridEditor){a.gridEditor=new Ext.grid.GridEditor(a)}a=a.gridEditor}}return a}});Ext.grid.BooleanColumn=Ext.extend(Ext.grid.Column,{trueText:\"true\",falseText:\"false\",undefinedText:\"&#160;\",constructor:function(a){Ext.grid.BooleanColumn.superclass.constructor.call(this,a);var c=this.trueText,d=this.falseText,b=this.undefinedText;this.renderer=function(e){if(e===undefined){return b}if(!e||e===\"false\"){return d}return c}}});Ext.grid.NumberColumn=Ext.extend(Ext.grid.Column,{format:\"0,000.00\",constructor:function(a){Ext.grid.NumberColumn.superclass.constructor.call(this,a);this.renderer=Ext.util.Format.numberRenderer(this.format)}});Ext.grid.DateColumn=Ext.extend(Ext.grid.Column,{format:\"m/d/Y\",constructor:function(a){Ext.grid.DateColumn.superclass.constructor.call(this,a);this.renderer=Ext.util.Format.dateRenderer(this.format)}});Ext.grid.TemplateColumn=Ext.extend(Ext.grid.Column,{constructor:function(a){Ext.grid.TemplateColumn.superclass.constructor.call(this,a);var b=(!Ext.isPrimitive(this.tpl)&&this.tpl.compile)?this.tpl:new Ext.XTemplate(this.tpl);this.renderer=function(d,e,c){return b.apply(c.data)};this.tpl=b}});Ext.grid.ActionColumn=Ext.extend(Ext.grid.Column,{header:\"&#160;\",actionIdRe:/x-action-col-(\\d+)/,altText:\"\",constructor:function(b){var g=this,c=b.items||(g.items=[g]),a=c.length,d,e;Ext.grid.ActionColumn.superclass.constructor.call(g,b);g.renderer=function(h,i){h=Ext.isFunction(b.renderer)?b.renderer.apply(this,arguments)||\"\":\"\";i.css+=\" x-action-col-cell\";for(d=0;d<a;d++){e=c[d];h+='<img alt=\"'+(e.altText||g.altText)+'\" src=\"'+(e.icon||Ext.BLANK_IMAGE_URL)+'\" class=\"x-action-col-icon x-action-col-'+String(d)+\" \"+(e.iconCls||\"\")+\" \"+(Ext.isFunction(e.getClass)?e.getClass.apply(e.scope||this.scope||this,arguments):\"\")+'\"'+((e.tooltip)?' ext:qtip=\"'+e.tooltip+'\"':\"\")+\" />\"}return h}},destroy:function(){delete this.items;delete this.renderer;return Ext.grid.ActionColumn.superclass.destroy.apply(this,arguments)},processEvent:function(c,i,d,j,b){var a=i.getTarget().className.match(this.actionIdRe),h,g;if(a&&(h=this.items[parseInt(a[1],10)])){if(c==\"click\"){(g=h.handler||this.handler)&&g.call(h.scope||this.scope||this,d,j,b,h,i)}else{if((c==\"mousedown\")&&(h.stopSelection!==false)){return false}}}return Ext.grid.ActionColumn.superclass.processEvent.apply(this,arguments)}});Ext.grid.Column.types={gridcolumn:Ext.grid.Column,booleancolumn:Ext.grid.BooleanColumn,numbercolumn:Ext.grid.NumberColumn,datecolumn:Ext.grid.DateColumn,templatecolumn:Ext.grid.TemplateColumn,actioncolumn:Ext.grid.ActionColumn};Ext.grid.RowNumberer=Ext.extend(Object,{header:\"\",width:23,sortable:false,constructor:function(a){Ext.apply(this,a);if(this.rowspan){this.renderer=this.renderer.createDelegate(this)}},fixed:true,hideable:false,menuDisabled:true,dataIndex:\"\",id:\"numberer\",rowspan:undefined,renderer:function(b,c,a,d){if(this.rowspan){c.cellAttr='rowspan=\"'+this.rowspan+'\"'}return d+1}});Ext.grid.CheckboxSelectionModel=Ext.extend(Ext.grid.RowSelectionModel,{header:'<div class=\"x-grid3-hd-checker\">&#160;</div>',width:20,sortable:false,menuDisabled:true,fixed:true,hideable:false,dataIndex:\"\",id:\"checker\",isColumn:true,constructor:function(){Ext.grid.CheckboxSelectionModel.superclass.constructor.apply(this,arguments);if(this.checkOnly){this.handleMouseDown=Ext.emptyFn}},initEvents:function(){Ext.grid.CheckboxSelectionModel.superclass.initEvents.call(this);this.grid.on(\"render\",function(){Ext.fly(this.grid.getView().innerHd).on(\"mousedown\",this.onHdMouseDown,this)},this)},processEvent:function(b,d,c,g,a){if(b==\"mousedown\"){this.onMouseDown(d,d.getTarget());return false}else{return Ext.grid.Column.prototype.processEvent.apply(this,arguments)}},onMouseDown:function(c,b){if(c.button===0&&b.className==\"x-grid3-row-checker\"){c.stopEvent();var d=c.getTarget(\".x-grid3-row\");if(d){var a=d.rowIndex;if(this.isSelected(a)){this.deselectRow(a)}else{this.selectRow(a,true);this.grid.getView().focusRow(a)}}}},onHdMouseDown:function(c,a){if(a.className==\"x-grid3-hd-checker\"){c.stopEvent();var b=Ext.fly(a.parentNode);var d=b.hasClass(\"x-grid3-hd-checker-on\");if(d){b.removeClass(\"x-grid3-hd-checker-on\");this.clearSelections()}else{b.addClass(\"x-grid3-hd-checker-on\");this.selectAll()}}},renderer:function(b,c,a){return'<div class=\"x-grid3-row-checker\">&#160;</div>'},onEditorSelect:function(b,a){if(a!=b&&!this.checkOnly){this.selectRow(b)}}});Ext.grid.CellSelectionModel=Ext.extend(Ext.grid.AbstractSelectionModel,{constructor:function(a){Ext.apply(this,a);this.selection=null;this.addEvents(\"beforecellselect\",\"cellselect\",\"selectionchange\");Ext.grid.CellSelectionModel.superclass.constructor.call(this)},initEvents:function(){this.grid.on(\"cellmousedown\",this.handleMouseDown,this);this.grid.on(Ext.EventManager.getKeyEvent(),this.handleKeyDown,this);this.grid.getView().on({scope:this,refresh:this.onViewChange,rowupdated:this.onRowUpdated,beforerowremoved:this.clearSelections,beforerowsinserted:this.clearSelections});if(this.grid.isEditor){this.grid.on(\"beforeedit\",this.beforeEdit,this)}},beforeEdit:function(a){this.select(a.row,a.column,false,true,a.record)},onRowUpdated:function(a,b,c){if(this.selection&&this.selection.record==c){a.onCellSelect(b,this.selection.cell[1])}},onViewChange:function(){this.clearSelections(true)},getSelectedCell:function(){return this.selection?this.selection.cell:null},clearSelections:function(b){var a=this.selection;if(a){if(b!==true){this.grid.view.onCellDeselect(a.cell[0],a.cell[1])}this.selection=null;this.fireEvent(\"selectionchange\",this,null)}},hasSelection:function(){return this.selection?true:false},handleMouseDown:function(b,d,a,c){if(c.button!==0||this.isLocked()){return}this.select(d,a)},select:function(g,c,b,e,d){if(this.fireEvent(\"beforecellselect\",this,g,c)!==false){this.clearSelections();d=d||this.grid.store.getAt(g);this.selection={record:d,cell:[g,c]};if(!b){var a=this.grid.getView();a.onCellSelect(g,c);if(e!==true){a.focusCell(g,c)}}this.fireEvent(\"cellselect\",this,g,c);this.fireEvent(\"selectionchange\",this,this.selection)}},isSelectable:function(c,b,a){return !a.isHidden(b)},onEditorKey:function(b,a){if(a.getKey()==a.TAB){this.handleKeyDown(a)}},handleKeyDown:function(j){if(!j.isNavKeyPress()){return}var d=j.getKey(),i=this.grid,p=this.selection,b=this,m=function(g,c,e){return i.walkCells(g,c,e,i.isEditor&&i.editing?b.acceptsNav:b.isSelectable,b)},o,h,a,l,n;switch(d){case j.ESC:case j.PAGE_UP:case j.PAGE_DOWN:break;default:j.stopEvent();break}if(!p){o=m(0,0,1);if(o){this.select(o[0],o[1])}return}o=p.cell;a=o[0];l=o[1];switch(d){case j.TAB:if(j.shiftKey){h=m(a,l-1,-1)}else{h=m(a,l+1,1)}break;case j.DOWN:h=m(a+1,l,1);break;case j.UP:h=m(a-1,l,-1);break;case j.RIGHT:h=m(a,l+1,1);break;case j.LEFT:h=m(a,l-1,-1);break;case j.ENTER:if(i.isEditor&&!i.editing){i.startEditing(a,l);return}break}if(h){a=h[0];l=h[1];this.select(a,l);if(i.isEditor&&i.editing){n=i.activeEditor;if(n&&n.field.triggerBlur){n.field.triggerBlur()}i.startEditing(a,l)}}},acceptsNav:function(c,b,a){return !a.isHidden(b)&&a.isCellEditable(b,c)}});Ext.grid.EditorGridPanel=Ext.extend(Ext.grid.GridPanel,{clicksToEdit:2,forceValidation:false,isEditor:true,detectEdit:false,autoEncode:false,trackMouseOver:false,initComponent:function(){Ext.grid.EditorGridPanel.superclass.initComponent.call(this);if(!this.selModel){this.selModel=new Ext.grid.CellSelectionModel()}this.activeEditor=null;this.addEvents(\"beforeedit\",\"afteredit\",\"validateedit\")},initEvents:function(){Ext.grid.EditorGridPanel.superclass.initEvents.call(this);this.getGridEl().on(\"mousewheel\",this.stopEditing.createDelegate(this,[true]),this);this.on(\"columnresize\",this.stopEditing,this,[true]);if(this.clicksToEdit==1){this.on(\"cellclick\",this.onCellDblClick,this)}else{var a=this.getView();if(this.clicksToEdit==\"auto\"&&a.mainBody){a.mainBody.on(\"mousedown\",this.onAutoEditClick,this)}this.on(\"celldblclick\",this.onCellDblClick,this)}},onResize:function(){Ext.grid.EditorGridPanel.superclass.onResize.apply(this,arguments);var a=this.activeEditor;if(this.editing&&a){a.realign(true)}},onCellDblClick:function(b,c,a){this.startEditing(c,a)},onAutoEditClick:function(c,b){if(c.button!==0){return}var g=this.view.findRowIndex(b),a=this.view.findCellIndex(b);if(g!==false&&a!==false){this.stopEditing();if(this.selModel.getSelectedCell){var d=this.selModel.getSelectedCell();if(d&&d[0]===g&&d[1]===a){this.startEditing(g,a)}}else{if(this.selModel.isSelected(g)){this.startEditing(g,a)}}}},onEditComplete:function(b,d,a){this.editing=false;this.lastActiveEditor=this.activeEditor;this.activeEditor=null;var c=b.record,h=this.colModel.getDataIndex(b.col);d=this.postEditValue(d,a,c,h);if(this.forceValidation===true||String(d)!==String(a)){var g={grid:this,record:c,field:h,originalValue:a,value:d,row:b.row,column:b.col,cancel:false};if(this.fireEvent(\"validateedit\",g)!==false&&!g.cancel&&String(d)!==String(a)){c.set(h,g.value);delete g.cancel;this.fireEvent(\"afteredit\",g)}}this.view.focusCell(b.row,b.col)},startEditing:function(i,c){this.stopEditing();if(this.colModel.isCellEditable(c,i)){this.view.ensureVisible(i,c,true);var d=this.store.getAt(i),h=this.colModel.getDataIndex(c),g={grid:this,record:d,field:h,value:d.data[h],row:i,column:c,cancel:false};if(this.fireEvent(\"beforeedit\",g)!==false&&!g.cancel){this.editing=true;var b=this.colModel.getCellEditor(c,i);if(!b){return}if(!b.rendered){b.parentEl=this.view.getEditorParent(b);b.on({scope:this,render:{fn:function(e){e.field.focus(false,true)},single:true,scope:this},specialkey:function(k,j){this.getSelectionModel().onEditorKey(k,j)},complete:this.onEditComplete,canceledit:this.stopEditing.createDelegate(this,[true])})}Ext.apply(b,{row:i,col:c,record:d});this.lastEdit={row:i,col:c};this.activeEditor=b;if(b.field.isXType(\"checkbox\")){b.allowBlur=false;this.setupCheckbox(b.field)}b.selectSameEditor=(this.activeEditor==this.lastActiveEditor);var a=this.preEditValue(d,h);b.startEdit(this.view.getCell(i,c).firstChild,Ext.isDefined(a)?a:\"\");(function(){delete b.selectSameEditor}).defer(50)}}},setupCheckbox:function(c){var b=this,a=function(){c.el.on(\"click\",b.onCheckClick,b,{single:true})};if(c.rendered){a()}else{c.on(\"render\",a,null,{single:true})}},onCheckClick:function(){var a=this.activeEditor;a.allowBlur=true;a.field.focus(false,10)},preEditValue:function(a,c){var b=a.data[c];return this.autoEncode&&Ext.isString(b)?Ext.util.Format.htmlDecode(b):b},postEditValue:function(c,a,b,d){return this.autoEncode&&Ext.isString(c)?Ext.util.Format.htmlEncode(c):c},stopEditing:function(b){if(this.editing){var a=this.lastActiveEditor=this.activeEditor;if(a){a[b===true?\"cancelEdit\":\"completeEdit\"]();this.view.focusCell(a.row,a.col)}this.activeEditor=null}this.editing=false}});Ext.reg(\"editorgrid\",Ext.grid.EditorGridPanel);Ext.grid.GridEditor=function(b,a){Ext.grid.GridEditor.superclass.constructor.call(this,b,a);b.monitorTab=false};Ext.extend(Ext.grid.GridEditor,Ext.Editor,{alignment:\"tl-tl\",autoSize:\"width\",hideEl:false,cls:\"x-small-editor x-grid-editor\",shim:false,shadow:false});Ext.grid.PropertyRecord=Ext.data.Record.create([{name:\"name\",type:\"string\"},\"value\"]);Ext.grid.PropertyStore=Ext.extend(Ext.util.Observable,{constructor:function(a,b){this.grid=a;this.store=new Ext.data.Store({recordType:Ext.grid.PropertyRecord});this.store.on(\"update\",this.onUpdate,this);if(b){this.setSource(b)}Ext.grid.PropertyStore.superclass.constructor.call(this)},setSource:function(c){this.source=c;this.store.removeAll();var b=[];for(var a in c){if(this.isEditableValue(c[a])){b.push(new Ext.grid.PropertyRecord({name:a,value:c[a]},a))}}this.store.loadRecords({records:b},{},true)},onUpdate:function(e,a,d){if(d==Ext.data.Record.EDIT){var b=a.data.value;var c=a.modified.value;if(this.grid.fireEvent(\"beforepropertychange\",this.source,a.id,b,c)!==false){this.source[a.id]=b;a.commit();this.grid.fireEvent(\"propertychange\",this.source,a.id,b,c)}else{a.reject()}}},getProperty:function(a){return this.store.getAt(a)},isEditableValue:function(a){return Ext.isPrimitive(a)||Ext.isDate(a)},setValue:function(d,c,a){var b=this.getRec(d);if(b){b.set(\"value\",c);this.source[d]=c}else{if(a){this.source[d]=c;b=new Ext.grid.PropertyRecord({name:d,value:c},d);this.store.add(b)}}},remove:function(b){var a=this.getRec(b);if(a){this.store.remove(a);delete this.source[b]}},getRec:function(a){return this.store.getById(a)},getSource:function(){return this.source}});Ext.grid.PropertyColumnModel=Ext.extend(Ext.grid.ColumnModel,{nameText:\"Name\",valueText:\"Value\",dateFormat:\"m/j/Y\",trueText:\"true\",falseText:\"false\",constructor:function(c,b){var d=Ext.grid,e=Ext.form;this.grid=c;d.PropertyColumnModel.superclass.constructor.call(this,[{header:this.nameText,width:50,sortable:true,dataIndex:\"name\",id:\"name\",menuDisabled:true},{header:this.valueText,width:50,resizable:false,dataIndex:\"value\",id:\"value\",menuDisabled:true}]);this.store=b;var a=new e.Field({autoCreate:{tag:\"select\",children:[{tag:\"option\",value:\"true\",html:this.trueText},{tag:\"option\",value:\"false\",html:this.falseText}]},getValue:function(){return this.el.dom.value==\"true\"}});this.editors={date:new d.GridEditor(new e.DateField({selectOnFocus:true})),string:new d.GridEditor(new e.TextField({selectOnFocus:true})),number:new d.GridEditor(new e.NumberField({selectOnFocus:true,style:\"text-align:left;\"})),\"boolean\":new d.GridEditor(a,{autoSize:\"both\"})};this.renderCellDelegate=this.renderCell.createDelegate(this);this.renderPropDelegate=this.renderProp.createDelegate(this)},renderDate:function(a){return a.dateFormat(this.dateFormat)},renderBool:function(a){return this[a?\"trueText\":\"falseText\"]},isCellEditable:function(a,b){return a==1},getRenderer:function(a){return a==1?this.renderCellDelegate:this.renderPropDelegate},renderProp:function(a){return this.getPropertyName(a)},renderCell:function(d,b,c){var a=this.grid.customRenderers[c.get(\"name\")];if(a){return a.apply(this,arguments)}var e=d;if(Ext.isDate(d)){e=this.renderDate(d)}else{if(typeof d==\"boolean\"){e=this.renderBool(d)}}return Ext.util.Format.htmlEncode(e)},getPropertyName:function(b){var a=this.grid.propertyNames;return a&&a[b]?a[b]:b},getCellEditor:function(a,e){var b=this.store.getProperty(e),d=b.data.name,c=b.data.value;if(this.grid.customEditors[d]){return this.grid.customEditors[d]}if(Ext.isDate(c)){return this.editors.date}else{if(typeof c==\"number\"){return this.editors.number}else{if(typeof c==\"boolean\"){return this.editors[\"boolean\"]}else{return this.editors.string}}}},destroy:function(){Ext.grid.PropertyColumnModel.superclass.destroy.call(this);this.destroyEditors(this.editors);this.destroyEditors(this.grid.customEditors)},destroyEditors:function(b){for(var a in b){Ext.destroy(b[a])}}});Ext.grid.PropertyGrid=Ext.extend(Ext.grid.EditorGridPanel,{enableColumnMove:false,stripeRows:false,trackMouseOver:false,clicksToEdit:1,enableHdMenu:false,viewConfig:{forceFit:true},initComponent:function(){this.customRenderers=this.customRenderers||{};this.customEditors=this.customEditors||{};this.lastEditRow=null;var b=new Ext.grid.PropertyStore(this);this.propStore=b;var a=new Ext.grid.PropertyColumnModel(this,b);b.store.sort(\"name\",\"ASC\");this.addEvents(\"beforepropertychange\",\"propertychange\");this.cm=a;this.ds=b.store;Ext.grid.PropertyGrid.superclass.initComponent.call(this);this.mon(this.selModel,\"beforecellselect\",function(e,d,c){if(c===0){this.startEditing.defer(200,this,[d,1]);return false}},this)},onRender:function(){Ext.grid.PropertyGrid.superclass.onRender.apply(this,arguments);this.getGridEl().addClass(\"x-props-grid\")},afterRender:function(){Ext.grid.PropertyGrid.superclass.afterRender.apply(this,arguments);if(this.source){this.setSource(this.source)}},setSource:function(a){this.propStore.setSource(a)},getSource:function(){return this.propStore.getSource()},setProperty:function(c,b,a){this.propStore.setValue(c,b,a)},removeProperty:function(a){this.propStore.remove(a)}});Ext.reg(\"propertygrid\",Ext.grid.PropertyGrid);Ext.grid.GroupingView=Ext.extend(Ext.grid.GridView,{groupByText:\"Group By This Field\",showGroupsText:\"Show in Groups\",hideGroupedColumn:false,showGroupName:true,startCollapsed:false,enableGrouping:true,enableGroupingMenu:true,enableNoGroups:true,emptyGroupText:\"(None)\",ignoreAdd:false,groupTextTpl:\"{text}\",groupMode:\"value\",cancelEditOnToggle:true,initTemplates:function(){Ext.grid.GroupingView.superclass.initTemplates.call(this);this.state={};var a=this.grid.getSelectionModel();a.on(a.selectRow?\"beforerowselect\":\"beforecellselect\",this.onBeforeRowSelect,this);if(!this.startGroup){this.startGroup=new Ext.XTemplate('<div id=\"{groupId}\" class=\"x-grid-group {cls}\">','<div id=\"{groupId}-hd\" class=\"x-grid-group-hd\" style=\"{style}\"><div class=\"x-grid-group-title\">',this.groupTextTpl,\"</div></div>\",'<div id=\"{groupId}-bd\" class=\"x-grid-group-body\">')}this.startGroup.compile();if(!this.endGroup){this.endGroup=\"</div></div>\"}},findGroup:function(a){return Ext.fly(a).up(\".x-grid-group\",this.mainBody.dom)},getGroups:function(){return this.hasRows()?this.mainBody.dom.childNodes:[]},onAdd:function(d,a,b){if(this.canGroup()&&!this.ignoreAdd){var c=this.getScrollState();this.fireEvent(\"beforerowsinserted\",d,b,b+(a.length-1));this.refresh();this.restoreScroll(c);this.fireEvent(\"rowsinserted\",d,b,b+(a.length-1))}else{if(!this.canGroup()){Ext.grid.GroupingView.superclass.onAdd.apply(this,arguments)}}},onRemove:function(e,a,b,d){Ext.grid.GroupingView.superclass.onRemove.apply(this,arguments);var c=document.getElementById(a._groupId);if(c&&c.childNodes[1].childNodes.length<1){Ext.removeNode(c)}this.applyEmptyText()},refreshRow:function(a){if(this.ds.getCount()==1){this.refresh()}else{this.isUpdating=true;Ext.grid.GroupingView.superclass.refreshRow.apply(this,arguments);this.isUpdating=false}},beforeMenuShow:function(){var c,a=this.hmenu.items,b=this.cm.config[this.hdCtxIndex].groupable===false;if((c=a.get(\"groupBy\"))){c.setDisabled(b)}if((c=a.get(\"showGroups\"))){c.setDisabled(b);c.setChecked(this.canGroup(),true)}},renderUI:function(){var a=Ext.grid.GroupingView.superclass.renderUI.call(this);if(this.enableGroupingMenu&&this.hmenu){this.hmenu.add(\"-\",{itemId:\"groupBy\",text:this.groupByText,handler:this.onGroupByClick,scope:this,iconCls:\"x-group-by-icon\"});if(this.enableNoGroups){this.hmenu.add({itemId:\"showGroups\",text:this.showGroupsText,checked:true,checkHandler:this.onShowGroupsClick,scope:this})}this.hmenu.on(\"beforeshow\",this.beforeMenuShow,this)}return a},processEvent:function(b,i){Ext.grid.GroupingView.superclass.processEvent.call(this,b,i);var h=i.getTarget(\".x-grid-group-hd\",this.mainBody);if(h){var g=this.getGroupField(),d=this.getPrefix(g),a=h.id.substring(d.length),c=new RegExp(\"gp-\"+Ext.escapeRe(g)+\"--hd\");a=a.substr(0,a.length-3);if(a||c.test(h.id)){this.grid.fireEvent(\"group\"+b,this.grid,g,a,i)}if(b==\"mousedown\"&&i.button==0){this.toggleGroup(h.parentNode)}}},onGroupByClick:function(){var a=this.grid;this.enableGrouping=true;a.store.groupBy(this.cm.getDataIndex(this.hdCtxIndex));a.fireEvent(\"groupchange\",a,a.store.getGroupState());this.beforeMenuShow();this.refresh()},onShowGroupsClick:function(a,b){this.enableGrouping=b;if(b){this.onGroupByClick()}else{this.grid.store.clearGrouping();this.grid.fireEvent(\"groupchange\",this,null)}},toggleRowIndex:function(c,a){if(!this.canGroup()){return}var b=this.getRow(c);if(b){this.toggleGroup(this.findGroup(b),a)}},toggleGroup:function(c,b){var a=Ext.get(c),d=Ext.util.Format.htmlEncode(a.id);b=Ext.isDefined(b)?b:a.hasClass(\"x-grid-group-collapsed\");if(this.state[d]!==b){if(this.cancelEditOnToggle!==false){this.grid.stopEditing(true)}this.state[d]=b;a[b?\"removeClass\":\"addClass\"](\"x-grid-group-collapsed\")}},toggleAllGroups:function(c){var b=this.getGroups();for(var d=0,a=b.length;d<a;d++){this.toggleGroup(b[d],c)}},expandAllGroups:function(){this.toggleAllGroups(true)},collapseAllGroups:function(){this.toggleAllGroups(false)},getGroup:function(a,e,i,j,b,h){var c=this.cm.config[b],d=i?i.call(c.scope,a,{},e,j,b,h):String(a);if(d===\"\"||d===\"&#160;\"){d=c.emptyGroupText||this.emptyGroupText}return d},getGroupField:function(){return this.grid.store.getGroupState()},afterRender:function(){if(!this.ds||!this.cm){return}Ext.grid.GroupingView.superclass.afterRender.call(this);if(this.grid.deferRowRender){this.updateGroupWidths()}},afterRenderUI:function(){Ext.grid.GroupingView.superclass.afterRenderUI.call(this);if(this.enableGroupingMenu&&this.hmenu){this.hmenu.add(\"-\",{itemId:\"groupBy\",text:this.groupByText,handler:this.onGroupByClick,scope:this,iconCls:\"x-group-by-icon\"});if(this.enableNoGroups){this.hmenu.add({itemId:\"showGroups\",text:this.showGroupsText,checked:true,checkHandler:this.onShowGroupsClick,scope:this})}this.hmenu.on(\"beforeshow\",this.beforeMenuShow,this)}},renderRows:function(){var a=this.getGroupField();var e=!!a;if(this.hideGroupedColumn){var b=this.cm.findColumnIndex(a),d=Ext.isDefined(this.lastGroupField);if(!e&&d){this.mainBody.update(\"\");this.cm.setHidden(this.cm.findColumnIndex(this.lastGroupField),false);delete this.lastGroupField}else{if(e&&!d){this.lastGroupField=a;this.cm.setHidden(b,true)}else{if(e&&d&&a!==this.lastGroupField){this.mainBody.update(\"\");var c=this.cm.findColumnIndex(this.lastGroupField);this.cm.setHidden(c,false);this.lastGroupField=a;this.cm.setHidden(b,true)}}}}return Ext.grid.GroupingView.superclass.renderRows.apply(this,arguments)},doRender:function(c,h,q,a,p,s){if(h.length<1){return\"\"}if(!this.canGroup()||this.isUpdating){return Ext.grid.GroupingView.superclass.doRender.apply(this,arguments)}var z=this.getGroupField(),o=this.cm.findColumnIndex(z),w,j=\"width:\"+this.getTotalWidth()+\";\",e=this.cm.config[o],b=e.groupRenderer||e.renderer,t=this.showGroupName?(e.groupName||e.header)+\": \":\"\",y=[],l,u,v,n;for(u=0,v=h.length;u<v;u++){var k=a+u,m=h[u],d=m.data[z];w=this.getGroup(d,m,b,k,o,q);if(!l||l.group!=w){n=this.constructId(d,z,o);this.state[n]=!(Ext.isDefined(this.state[n])?!this.state[n]:this.startCollapsed);l={group:w,gvalue:d,text:t+w,groupId:n,startRow:k,rs:[m],cls:this.state[n]?\"\":\"x-grid-group-collapsed\",style:j};y.push(l)}else{l.rs.push(m)}m._groupId=n}var x=[];for(u=0,v=y.length;u<v;u++){w=y[u];this.doGroupStart(x,w,c,q,p);x[x.length]=Ext.grid.GroupingView.superclass.doRender.call(this,c,w.rs,q,w.startRow,p,s);this.doGroupEnd(x,w,c,q,p)}return x.join(\"\")},getGroupId:function(a){var b=this.getGroupField();return this.constructId(a,b,this.cm.findColumnIndex(b))},constructId:function(c,e,a){var b=this.cm.config[a],d=b.groupRenderer||b.renderer,g=(this.groupMode==\"value\")?c:this.getGroup(c,{data:{}},d,0,a,this.ds);return this.getPrefix(e)+Ext.util.Format.htmlEncode(g)},canGroup:function(){return this.enableGrouping&&!!this.getGroupField()},getPrefix:function(a){return this.grid.getGridEl().id+\"-gp-\"+a+\"-\"},doGroupStart:function(a,d,b,e,c){a[a.length]=this.startGroup.apply(d)},doGroupEnd:function(a,d,b,e,c){a[a.length]=this.endGroup},getRows:function(){if(!this.canGroup()){return Ext.grid.GroupingView.superclass.getRows.call(this)}var k=[],c=this.getGroups(),h,e=0,a=c.length,d,b;for(;e<a;++e){h=c[e].childNodes[1];if(h){h=h.childNodes;for(d=0,b=h.length;d<b;++d){k[k.length]=h[d]}}}return k},updateGroupWidths:function(){if(!this.canGroup()||!this.hasRows()){return}var c=Math.max(this.cm.getTotalWidth(),this.el.dom.offsetWidth-this.getScrollOffset())+\"px\";var b=this.getGroups();for(var d=0,a=b.length;d<a;d++){b[d].firstChild.style.width=c}},onColumnWidthUpdated:function(c,a,b){Ext.grid.GroupingView.superclass.onColumnWidthUpdated.call(this,c,a,b);this.updateGroupWidths()},onAllColumnWidthsUpdated:function(a,b){Ext.grid.GroupingView.superclass.onAllColumnWidthsUpdated.call(this,a,b);this.updateGroupWidths()},onColumnHiddenUpdated:function(b,c,a){Ext.grid.GroupingView.superclass.onColumnHiddenUpdated.call(this,b,c,a);this.updateGroupWidths()},onLayout:function(){this.updateGroupWidths()},onBeforeRowSelect:function(b,a){this.toggleRowIndex(a,true)}});Ext.grid.GroupingView.GROUP_ID=1000;"
  },
  {
    "path": "client/src/ext/ext.jsb2",
    "content": "{\n    \"projectName\": \"Ext JS\",\n    \"deployDir\": \".\",\n    \"licenseText\": \"\",\n    \"pkgs\": [{\n        \"name\": \"Ext Base\",\n        \"file\": \"adapter/ext/ext-base.js\",\n        \"isDebug\": true,\n        \"fileIncludes\": [{\n            \"text\": \"Ext.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"TaskMgr.js\",\n            \"path\": \"src/ext-core/src/util/\"\n        },{\n            \"text\": \"ext-base-begin.js\",\n            \"path\": \"src/ext-core/src/adapter/\"\n        },{\n            \"text\": \"ext-base-dom.js\",\n            \"path\": \"src/ext-core/src/adapter/\"\n        },{\n            \"text\": \"ext-base-event.js\",\n            \"path\": \"src/ext-core/src/adapter/\"\n        },{\n            \"text\": \"ext-base-ajax.js\",\n            \"path\": \"src/ext-core/src/adapter/\"\n        },{\n            \"text\": \"ext-base-anim.js\",\n            \"path\": \"src/ext-core/src/adapter/\"\n        },{\n            \"text\": \"ext-base-anim-extra.js\",\n            \"path\": \"src/ext-core/src/adapter/\"\n        },{\n            \"text\": \"ext-base-end.js\",\n            \"path\": \"src/ext-core/src/adapter/\"\n        }]\n    },{\n        \"name\": \"YUI Adapter\",\n        \"file\": \"adapter/yui/ext-yui-adapter.js\",\n        \"isDebug\": true,\n        \"fileIncludes\": [{\n            \"text\": \"Ext.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"TaskMgr.js\",\n            \"path\": \"src/ext-core/src/util/\"\n        },{\n            \"text\": \"yui-bridge.js\",\n            \"path\": \"src/adapter/\"\n        }]\n    },{\n        \"name\": \"Prototype Adapter\",\n        \"file\": \"adapter/prototype/ext-prototype-adapter.js\",\n        \"isDebug\": true,\n        \"fileIncludes\": [{\n            \"text\": \"Ext.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"TaskMgr.js\",\n            \"path\": \"src/ext-core/src/util/\"\n        },{\n            \"text\": \"prototype-bridge.js\",\n            \"path\": \"src/adapter/\"\n        }]\n    },{\n        \"name\": \"jQuery Adapter\",\n        \"file\": \"adapter/jquery/ext-jquery-adapter.js\",\n        \"isDebug\": true,\n        \"fileIncludes\": [{\n            \"text\": \"Ext.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"TaskMgr.js\",\n            \"path\": \"src/ext-core/src/util/\"\n        },{\n            \"text\": \"jquery-bridge.js\",\n            \"path\": \"src/adapter/\"\n        }]\n    },{\n        \"name\": \"Ext Core\",\n        \"file\": \"pkgs/ext-core.js\",\n        \"isDebug\": true,\n        \"fileIncludes\": [{\n            \"text\": \"Observable.js\",\n            \"path\": \"src/ext-core/src/util/\"\n        },{\n            \"text\": \"DomHelper.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"Template.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"DomQuery.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"DelayedTask.js\",\n            \"path\": \"src/ext-core/src/util/\"\n        },{\n            \"text\": \"Element.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"Element.traversal.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"Element.insertion.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"Element.style.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"Element.position.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"Element.scroll.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"Element.fx.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"Fx.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"CompositeElementLite.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"Connection.js\",\n            \"path\": \"src/ext-core/src/data/\"\n        },{\n            \"text\": \"JSON.js\",\n            \"path\": \"src/ext-core/src/util/\"\n        },\n        {\n            \"text\": \"EventManager.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        },{\n            \"text\": \"Loader.js\",\n            \"path\": \"src/ext-core/src/core/\"\n        }]\n    },{\n        \"name\": \"Ext Foundation\",\n        \"file\": \"pkgs/ext-foundation.js\",\n        \"isDebug\": true,\n        \"fileIncludes\": [{\n            \"text\": \"Ext-more.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"ext-base-dom-more.js\",\n            \"path\": \"src/adapter/\"\n        },{\n            \"text\": \"ext-base-region.js\",\n            \"path\": \"src/ext-core/src/adapter/\"\n        },{\n            \"text\": \"ext-base-point.js\",\n            \"path\": \"src/ext-core/src/adapter/\"\n        },{\n            \"text\": \"DomHelper-more.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"Template-more.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"Function.js\",\n            \"path\": \"src/util/\"\n        },{\n            \"text\": \"Observable-more.js\",\n            \"path\": \"src/util/\"\n        },{\n            \"text\": \"EventManager-more.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"Element-more.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"Element.alignment.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"Element.traversal-more.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"Element.insertion-more.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"Element.style-more.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"Element.position-more.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"Element.scroll-more.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"Element.fx-more.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"Element.keys.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"CompositeElementLite-more.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"CompositeElement.js\",\n            \"path\": \"src/core/\"\n        },{\n            \"text\": \"UpdateManager.js\",\n            \"path\": \"src/util/\"\n        },{\n            \"text\": \"Date.js\",\n            \"path\": \"src/util/\"\n        },{\n            \"text\": \"MixedCollection.js\",\n            \"path\": \"src/util/\"\n        },{\n            \"text\": \"AbstractManager.js\",\n            \"path\": \"src/util/\"\n        },{\n            \"text\": \"Format.js\",\n            \"path\": \"src/util/\"\n        },{\n            \"text\": \"XTemplate.js\",\n            \"path\": \"src/util/\"\n        },{\n            \"text\": \"CSS.js\",\n            \"path\": \"src/util/\"\n        },{\n            \"text\": \"ClickRepeater.js\",\n            \"path\": \"src/util/\"\n        },{\n            \"text\": \"KeyNav.js\",\n            \"path\": \"src/util/\"\n        },{\n            \"text\": \"KeyMap.js\",\n            \"path\": \"src/util/\"\n        },{\n            \"text\": \"TextMetrics.js\",\n            \"path\": \"src/util/\"\n        },{\n            \"text\": \"Cookies.js\",\n            \"path\": \"src/util/\"\n        },{\n            \"text\": \"Error.js\",\n            \"path\": \"src/core/\"\n        }]\n    },{\n        \"name\": \"Drag Drop\",\n        \"file\": \"pkgs/ext-dd.js\",\n        \"isDebug\": true,\n        \"pkgDeps\": [\"pkgs/ext-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"DDCore.js\",\n            \"path\": \"src/dd/\"\n        },{\n            \"text\": \"DragTracker.js\",\n            \"path\": \"src/dd/\"\n        },{\n            \"text\": \"ScrollManager.js\",\n            \"path\": \"src/dd/\"\n        },{\n            \"text\": \"Registry.js\",\n            \"path\": \"src/dd/\"\n        },{\n            \"text\": \"StatusProxy.js\",\n            \"path\": \"src/dd/\"\n        },{\n            \"text\": \"DragSource.js\",\n            \"path\": \"src/dd/\"\n        },{\n            \"text\": \"DropTarget.js\",\n            \"path\": \"src/dd/\"\n        },{\n            \"text\": \"DragZone.js\",\n            \"path\": \"src/dd/\"\n        },{\n            \"text\": \"DropZone.js\",\n            \"path\": \"src/dd/\"\n        },{\n            \"text\": \"Element.dd.js\",\n            \"path\": \"src/core/\"\n        }]\n    },{\n        \"name\": \"Data Foundation\",\n        \"file\": \"pkgs/data-foundation.js\",\n        \"isDebug\": true,\n        \"pkgDeps\": [\"pkgs/ext-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"Api.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"SortTypes.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"Record.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"StoreMgr.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"Store.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"DataField.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"DataReader.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"DataWriter.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"DataProxy.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"Request.js\",\n            \"path\": \"src/data/\"\n        }, {\n            \"text\": \"Response.js\",\n            \"path\": \"src/data/\"\n        }, {\n            \"text\": \"ScriptTagProxy.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"HttpProxy.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"MemoryProxy.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"Types.js\",\n            \"path\": \"src/data/\"\n        }]\n    },{\n        \"name\": \"Data - Json\",\n        \"file\": \"pkgs/data-json.js\",\n        \"isDebug\": true,\n        \"pkgDeps\": [\"pkgs/data-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"JsonWriter.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"JsonReader.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"ArrayReader.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"ArrayStore.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"JsonStore.js\",\n            \"path\": \"src/data/\"\n        }]\n    },{\n        \"name\": \"Data - XML\",\n        \"file\": \"pkgs/data-xml.js\",\n        \"isDebug\": true,\n        \"pkgDeps\": [\"pkgs/data-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"XmlWriter.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"XmlReader.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"XmlStore.js\",\n            \"path\": \"src/data/\"\n        }]\n    },{\n        \"name\": \"Data - GroupingStore\",\n        \"file\": \"pkgs/data-grouping.js\",\n        \"isDebug\": true,\n        \"pkgDeps\": [\"pkgs/data-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"GroupingStore.js\",\n            \"path\": \"src/data/\"\n        }]\n    },{\n        \"name\": \"Direct\",\n        \"file\": \"pkgs/direct.js\",\n        \"isDebug\": true,\n        \"pkgDeps\": [\"pkgs/ext-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"DirectProxy.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"DirectStore.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"Direct.js\",\n            \"path\": \"src/direct/\"\n        },{\n            \"text\": \"Transaction.js\",\n            \"path\": \"src/direct/\"\n        },{\n            \"text\": \"Event.js\",\n            \"path\": \"src/direct/\"\n        },{\n            \"text\": \"Provider.js\",\n            \"path\": \"src/direct/\"\n        },{\n            \"text\": \"JsonProvider.js\",\n            \"path\": \"src/direct/\"\n        },{\n            \"text\": \"PollingProvider.js\",\n            \"path\": \"src/direct/\"\n        },{\n            \"text\": \"RemotingProvider.js\",\n            \"path\": \"src/direct/\"\n        }]\n    },{\n        \"name\": \"Component Foundation\",\n        \"file\": \"pkgs/cmp-foundation.js\",\n        \"isDebug\": true,\n        \"pkgDeps\": [\"pkgs/ext-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"ComponentMgr.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"Component.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"Action.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"Layer.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"Shadow.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"BoxComponent.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"SplitBar.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"Container.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"ContainerLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"AutoLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"FitLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"CardLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"AnchorLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"ColumnLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"BorderLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"FormLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"AccordionLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"TableLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"AbsoluteLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"BoxLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"MenuOverflow.js\",\n            \"path\": \"src/widgets/layout/box/\"\n        },{\n            \"text\": \"ScrollerOverflow.js\",\n            \"path\": \"src/widgets/layout/box/\"\n        },{\n            \"text\": \"HBoxLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"VBoxLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"ToolbarLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"MenuLayout.js\",\n            \"path\": \"src/widgets/layout/\"\n        },{\n            \"text\": \"Viewport.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"Panel.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"Editor.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"ColorPalette.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"DatePicker.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"LoadMask.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"Slider.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"ProgressBar.js\",\n            \"path\": \"src/widgets/\"\n        }]\n    },{\n        \"name\": \"Window\",\n        \"file\": \"pkgs/window.js\",\n        \"isDebug\": true,\n        \"pkgDeps\": [\"pkgs/cmp-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"Window.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"WindowManager.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"MessageBox.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"PanelDD.js\",\n            \"path\": \"src/widgets/\"\n        }]\n    },{\n        \"name\": \"State\",\n        \"file\": \"pkgs/state.js\",\n        \"isDebug\": true,\n        \"pkgDeps\": [\"pkgs/cmp-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"Provider.js\",\n            \"path\": \"src/state/\"\n        },{\n            \"text\": \"StateManager.js\",\n            \"path\": \"src/state/\"\n        },{\n            \"text\": \"CookieProvider.js\",\n            \"path\": \"src/state/\"\n        }]\n    },{\n        \"name\": \"Data and ListViews\",\n        \"file\": \"pkgs/data-list-views.js\",\n        \"isDebug\": true,\n        \"pkgDeps\": [\"pkgs/cmp-foundation.js\",\"pkgs/data-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"DataView.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"ListView.js\",\n            \"path\": \"src/widgets/list/\"\n        },{\n            \"text\": \"Column.js\",\n            \"path\": \"src/widgets/list/\"\n        },{\n            \"text\": \"ColumnResizer.js\",\n            \"path\": \"src/widgets/list/\"\n        },{\n            \"text\": \"Sorter.js\",\n            \"path\": \"src/widgets/list/\"\n        }]\n    },{\n        \"name\": \"Resizable\",\n        \"file\": \"pkgs/resizable.js\",\n        \"isDebug\": true,\n        \"pkgs\": [\"pkgs/ext-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"Resizable.js\",\n            \"path\": \"src/widgets/\"\n        }]\n\n    },{\n        \"name\": \"TabPanel\",\n        \"file\": \"pkgs/pkg-tabs.js\",\n        \"isDebug\": true,\n        \"pkgs\": [\"pkgs/cmp-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"TabPanel.js\",\n            \"path\": \"src/widgets/\"\n        }]\n    },{\n        \"name\": \"Buttons\",\n        \"file\": \"pkgs/pkg-buttons.js\",\n        \"isDebug\": true,\n        \"pkgs\": [\"pkgs/cmp-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"Button.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"SplitButton.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"CycleButton.js\",\n            \"path\": \"src/widgets/\"\n        }]\n    },{\n        \"name\": \"Toolbars\",\n        \"file\": \"pkgs/pkg-toolbars.js\",\n        \"type\": \"js\",\n        \"isDebug\": true,\n        \"pkgs\": [\"pkgs/cmp-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"Toolbar.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"ButtonGroup.js\",\n            \"path\": \"src/widgets/\"\n        },{\n            \"text\": \"PagingToolbar.js\",\n            \"path\": \"src/widgets/\"\n        }]\n    },{\n        \"name\": \"History\",\n        \"file\": \"pkgs/pkg-history.js\",\n        \"isDebug\": true,\n        \"pkgs\": [\"pkgs/ext-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"History.js\",\n            \"path\": \"src/util/\"\n        }]\n    },{\n        \"name\": \"Tooltips\",\n        \"file\": \"pkgs/pkg-tips.js\",\n        \"isDebug\": true,\n        \"pkgs\": [\"pkgs/cmp-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"Tip.js\",\n            \"path\": \"src/widgets/tips/\"\n        },{\n            \"text\": \"ToolTip.js\",\n            \"path\": \"src/widgets/tips/\"\n        },{\n            \"text\": \"QuickTip.js\",\n            \"path\": \"src/widgets/tips/\"\n        },{\n            \"text\": \"QuickTips.js\",\n            \"path\": \"src/widgets/tips/\"\n        },{\n            \"text\": \"SliderTip.js\",\n            \"path\": \"src/widgets/tips/\"\n        }]\n    },{\n        \"name\": \"Trees\",\n        \"file\": \"pkgs/pkg-tree.js\",\n        \"isDebug\": true,\n        \"pkgs\": [\"pkgs/cmp-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"TreePanel.js\",\n            \"path\": \"src/widgets/tree/\"\n        },{\n            \"text\": \"TreeEventModel.js\",\n            \"path\": \"src/widgets/tree/\"\n        },{\n            \"text\": \"TreeSelectionModel.js\",\n            \"path\": \"src/widgets/tree/\"\n        },{\n            \"text\": \"Tree.js\",\n            \"path\": \"src/data/\"\n        },{\n            \"text\": \"TreeNode.js\",\n            \"path\": \"src/widgets/tree/\"\n        },{\n            \"text\": \"AsyncTreeNode.js\",\n            \"path\": \"src/widgets/tree/\"\n        },{\n            \"text\": \"TreeNodeUI.js\",\n            \"path\": \"src/widgets/tree/\"\n        },{\n            \"text\": \"TreeLoader.js\",\n            \"path\": \"src/widgets/tree/\"\n        },{\n            \"text\": \"TreeFilter.js\",\n            \"path\": \"src/widgets/tree/\"\n        },{\n            \"text\": \"TreeSorter.js\",\n            \"path\": \"src/widgets/tree/\"\n        },{\n            \"text\": \"TreeDropZone.js\",\n            \"path\": \"src/widgets/tree/\"\n        },{\n            \"text\": \"TreeDragZone.js\",\n            \"path\": \"src/widgets/tree/\"\n        },{\n            \"text\": \"TreeEditor.js\",\n            \"path\": \"src/widgets/tree/\"\n        }]\n    },{\n        \"name\": \"Charts\",\n        \"file\": \"pkgs/pkg-charts.js\",\n        \"isDebug\": true,\n        \"pkgs\": [\"pkgs/cmp-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"swfobject.js\",\n            \"path\": \"src/widgets/chart/\"\n        },{\n            \"text\": \"FlashComponent.js\",\n            \"path\": \"src/widgets/chart/\"\n        },{\n            \"text\": \"EventProxy.js\",\n            \"path\": \"src/widgets/chart/\"\n        },{\n            \"text\": \"Chart.js\",\n            \"path\": \"src/widgets/chart/\"\n        }]\n    },{\n        \"name\": \"Menu\",\n        \"file\": \"pkgs/pkg-menu.js\",\n        \"isDebug\": true,\n        \"pkgs\": [\"pkgs/cmp-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"Menu.js\",\n            \"path\": \"src/widgets/menu/\"\n        },{\n            \"text\": \"MenuMgr.js\",\n            \"path\": \"src/widgets/menu/\"\n        },{\n            \"text\": \"BaseItem.js\",\n            \"path\": \"src/widgets/menu/\"\n        },{\n            \"text\": \"TextItem.js\",\n            \"path\": \"src/widgets/menu/\"\n        },{\n            \"text\": \"Separator.js\",\n            \"path\": \"src/widgets/menu/\"\n        },{\n            \"text\": \"Item.js\",\n            \"path\": \"src/widgets/menu/\"\n        },{\n            \"text\": \"CheckItem.js\",\n            \"path\": \"src/widgets/menu/\"\n        },{\n            \"text\": \"DateMenu.js\",\n            \"path\": \"src/widgets/menu/\"\n        },{\n            \"text\": \"ColorMenu.js\",\n            \"path\": \"src/widgets/menu/\"\n        }]\n    },{\n        \"name\": \"Forms\",\n        \"file\": \"pkgs/pkg-forms.js\",\n        \"isDebug\": true,\n        \"pkgs\": [\"pkgs/cmp-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"Field.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"TextField.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"TriggerField.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"TextArea.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"NumberField.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"DateField.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"DisplayField.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"Combo.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"Checkbox.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"CheckboxGroup.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"CompositeField.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"Radio.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"RadioGroup.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"Hidden.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"BasicForm.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"Form.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"FieldSet.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"HtmlEditor.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"TimeField.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"SliderField.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"Label.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"Action.js\",\n            \"path\": \"src/widgets/form/\"\n        },{\n            \"text\": \"VTypes.js\",\n            \"path\": \"src/widgets/form/\"\n        }]\n    },{\n        \"name\": \"Grid Foundation\",\n        \"file\": \"pkgs/pkg-grid-foundation.js\",\n        \"isDebug\": true,\n        \"pkgs\": [\"pkgs/cmp-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"GridPanel.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"PivotGrid.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"GridView.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"PivotGridView.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"PivotAxis.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"ColumnDD.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"ColumnSplitDD.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"GridDD.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"ColumnModel.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"AbstractSelectionModel.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"RowSelectionModel.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"Column.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"RowNumberer.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"CheckboxSelectionModel.js\",\n            \"path\": \"src/widgets/grid/\"\n        }]\n    },{\n        \"name\": \"Grid Editor\",\n        \"file\": \"pkgs/pkg-grid-editor.js\",\n        \"isDebug\": true,\n        \"pkgs\": [\"pkgs/pkg-grid-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"CellSelectionModel.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"EditorGrid.js\",\n            \"path\": \"src/widgets/grid/\"\n        },{\n            \"text\": \"GridEditor.js\",\n            \"path\": \"src/widgets/grid/\"\n        }]\n    },{\n        \"name\": \"Grid - Property Grid\",\n        \"file\": \"pkgs/pkg-grid-property.js\",\n        \"isDebug\": true,\n        \"pkgs\": [\"pkgs/pkg-grid-foundation.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"PropertyGrid.js\",\n            \"path\": \"src/widgets/grid/\"\n        }]\n    },{\n        \"name\": \"Grid - GroupingView\",\n        \"file\": \"pkgs/pkg-grid-grouping.js\",\n        \"isDebug\": true,\n        \"pkgs\": [\"pkgs/pkg-grid-foundation.js\", \"pkgs/data-grouping.js\"],\n        \"fileIncludes\": [{\n            \"text\": \"GroupingView.js\",\n            \"path\": \"src/widgets/grid/\"\n        }]\n    },{\n        \"name\": \"Ext Core\",\n        \"file\": \"ext-core-all.js\",\n        \"isDebug\": true,\n        \"includeDeps\": true,\n        \"pkgDeps\": [\n            \"adapter/ext/ext-base.js\",\n            \"pkgs/ext-core.js\"\n        ],\n        \"fileIncludes\": []\n    },{\n        \"name\": \"Ext All No Core\",\n        \"file\": \"ext-all-no-core.js\",\n        \"isDebug\": true,\n        \"includeDeps\": true,\n        \"pkgDeps\": [\n            \"pkgs/ext-foundation.js\",\n            \"pkgs/cmp-foundation.js\",\n            \"pkgs/ext-dd.js\",\n            \"pkgs/data-foundation.js\",\n            \"pkgs/data-json.js\",\n            \"pkgs/data-xml.js\",\n            \"pkgs/data-grouping.js\",\n            \"pkgs/direct.js\",\n            \"pkgs/resizable.js\",\n            \"pkgs/window.js\",\n            \"pkgs/state.js\",\n            \"pkgs/data-list-views.js\",\n            \"pkgs/pkg-tabs.js\",\n            \"pkgs/pkg-buttons.js\",\n            \"pkgs/pkg-toolbars.js\",\n            \"pkgs/pkg-history.js\",\n            \"pkgs/pkg-tips.js\",\n            \"pkgs/pkg-tree.js\",\n            \"pkgs/pkg-charts.js\",\n            \"pkgs/pkg-menu.js\",\n            \"pkgs/pkg-forms.js\",\n            \"pkgs/pkg-grid-foundation.js\",\n            \"pkgs/pkg-grid-editor.js\",\n            \"pkgs/pkg-grid-property.js\",\n            \"pkgs/pkg-grid-grouping.js\"\n        ],\n        \"fileIncludes\": []\n    },{\n        \"name\": \"Ext All\",\n        \"file\": \"ext-all.js\",\n        \"isDebug\": true,\n        \"includeDeps\": true,\n        \"pkgDeps\": [\n            \"pkgs/ext-core.js\",\n            \"ext-all-no-core.js\"\n        ],\n        \"fileIncludes\": []\n    },\n    {\n        \"name\": \"Calendar\",\n        \"file\": \"examples/calendar/calendar-all.js\",\n        \"isDebug\": true,\n        \"fileIncludes\": [\n            {\"path\": \"examples/calendar/src/\",           \"text\": \"Ext.calendar.js\"},\n            {\"path\": \"examples/calendar/src/templates/\", \"text\": \"DayHeaderTemplate.js\"},\n            {\"path\": \"examples/calendar/src/templates/\", \"text\": \"DayBodyTemplate.js\"},\n            {\"path\": \"examples/calendar/src/templates/\", \"text\": \"DayViewTemplate.js\"},\n            {\"path\": \"examples/calendar/src/templates/\", \"text\": \"BoxLayoutTemplate.js\"},\n            {\"path\": \"examples/calendar/src/templates/\", \"text\": \"MonthViewTemplate.js\"},\n            {\"path\": \"examples/calendar/src/dd/\",        \"text\": \"CalendarScrollManager.js\"},\n            {\"path\": \"examples/calendar/src/dd/\",        \"text\": \"StatusProxy.js\"},\n            {\"path\": \"examples/calendar/src/dd/\",        \"text\": \"CalendarDD.js\"},\n            {\"path\": \"examples/calendar/src/dd/\",        \"text\": \"DayViewDD.js\"},\n            {\"path\": \"examples/calendar/src/\",           \"text\": \"EventRecord.js\"},\n            {\"path\": \"examples/calendar/src/views/\",     \"text\": \"MonthDayDetailView.js\"},\n            {\"path\": \"examples/calendar/src/widgets/\",   \"text\": \"CalendarPicker.js\"},\n            {\"path\": \"examples/calendar/src/\",           \"text\": \"WeekEventRenderer.js\"},\n            {\"path\": \"examples/calendar/src/views/\",     \"text\": \"CalendarView.js\"},\n            {\"path\": \"examples/calendar/src/views/\",     \"text\": \"MonthView.js\"},\n            {\"path\": \"examples/calendar/src/views/\",     \"text\": \"DayHeaderView.js\"},\n            {\"path\": \"examples/calendar/src/views/\",     \"text\": \"DayBodyView.js\"},\n            {\"path\": \"examples/calendar/src/views/\",     \"text\": \"DayView.js\"},\n            {\"path\": \"examples/calendar/src/views/\",     \"text\": \"WeekView.js\"},\n            {\"path\": \"examples/calendar/src/widgets/\",   \"text\": \"DateRangeField.js\"},\n            {\"path\": \"examples/calendar/src/widgets/\",   \"text\": \"ReminderField.js\"},\n            {\"path\": \"examples/calendar/src/\",           \"text\": \"EventEditForm.js\"},\n            {\"path\": \"examples/calendar/src/\",           \"text\": \"EventEditWindow.js\"},\n            {\"path\": \"examples/calendar/src/\",           \"text\": \"CalendarPanel.js\"}\n        ]\n    },\n    {\n       \"name\": \"User Extension JS Pack\",\n       \"file\": \"examples/ux/ux-all.js\",\n       \"isDebug\": true,\n       \"fileIncludes\": [{\n          \"text\": \"BufferView.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"CenterLayout.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"CheckColumn.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"ColumnHeaderGroup.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"ColumnNodeUI.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"DataView-more.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"FileUploadField.js\",\n          \"path\": \"examples/ux/fileuploadfield/\"\n       },{\n          \"text\": \"GMapPanel.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"GridFilters.js\",\n          \"path\": \"examples/ux/gridfilters/\"\n       },{\n          \"text\": \"Filter.js\",\n          \"path\": \"examples/ux/gridfilters/filter/\"\n       },{\n          \"text\": \"BooleanFilter.js\",\n          \"path\": \"examples/ux/gridfilters/filter/\"\n       },{\n          \"text\": \"DateFilter.js\",\n          \"path\": \"examples/ux/gridfilters/filter/\"\n       },{\n          \"text\": \"ListFilter.js\",\n          \"path\": \"examples/ux/gridfilters/filter/\"\n       },{\n          \"text\": \"NumericFilter.js\",\n          \"path\": \"examples/ux/gridfilters/filter/\"\n       },{\n          \"text\": \"StringFilter.js\",\n          \"path\": \"examples/ux/gridfilters/filter/\"\n       },{\n          \"text\": \"ListMenu.js\",\n          \"path\": \"examples/ux/gridfilters/menu/\"\n       },{\n          \"text\": \"RangeMenu.js\",\n          \"path\": \"examples/ux/gridfilters/menu/\"\n       },{\n          \"text\": \"GroupSummary.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"GroupTab.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"GroupTabPanel.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"ItemSelector.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"LockingGridView.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"MultiSelect.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"PagingMemoryProxy.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"PanelResizer.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"Portal.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"PortalColumn.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"Portlet.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"ProgressBarPager.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"RowEditor.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"RowExpander.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"RowLayout.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"SearchField.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"SelectBox.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"SlidingPager.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"SpinnerField.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"Spinner.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"Spotlight.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"StatusBar.js\",\n          \"path\": \"examples/ux/statusbar/\"\n       },{\n          \"text\": \"TabCloseMenu.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"TableGrid.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"TabScrollerMenu.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"XmlTreeLoader.js\",\n          \"path\": \"examples/ux/\"\n       },{\n          \"text\": \"ValidationStatus.js\",\n          \"path\": \"examples/ux/statusbar/\"\n       }, {\n          \"text\": \"TreeGridColumns.js\",\n          \"path\": \"examples/ux/treegrid/\"\n       },{\n          \"text\": \"TreeGridNodeUI.js\",\n          \"path\": \"examples/ux/treegrid/\"\n       },{\n          \"text\": \"TreeGridColumnResizer.js\",\n          \"path\": \"examples/ux/treegrid/\"\n       },{\n          \"text\": \"TreeGridSorter.js\",\n          \"path\": \"examples/ux/treegrid/\"\n       },{\n          \"text\": \"TreeGridLoader.js\",\n          \"path\": \"examples/ux/treegrid/\"\n       },{\n          \"text\": \"TreeGrid.js\",\n          \"path\": \"examples/ux/treegrid/\"\n       }]\n    },{\n       \"name\": \"User Extension CSS Pack\",\n       \"file\": \"examples/ux/css/ux-all.css\",\n       \"fileIncludes\": [{\n          \"text\": \"CenterLayout.css\",\n          \"path\": \"examples/ux/css/\"\n       },{\n          \"text\": \"ColumnHeaderGroup.css\",\n          \"path\": \"examples/ux/css/\"\n       },{\n          \"text\": \"ColumnNodeUI.css\",\n          \"path\": \"examples/ux/css/\"\n       },{\n          \"text\": \"fileuploadfield.css\",\n          \"path\": \"examples/ux/fileuploadfield/css/\"\n       },{\n          \"text\": \"GridFilters.css\",\n          \"path\": \"examples/ux/gridfilters/css/\"\n       },{\n          \"text\": \"RangeMenu.css\",\n          \"path\": \"examples/ux/gridfilters/css/\"\n       },{\n          \"text\": \"GroupSummary.css\",\n          \"path\": \"examples/ux/css/\"\n       },{\n          \"text\": \"GroupTab.css\",\n          \"path\": \"examples/ux/css/\"\n       },{\n          \"text\": \"LockingGridView.css\",\n          \"path\": \"examples/ux/css/\"\n       },{\n          \"text\": \"MultiSelect.css\",\n          \"path\": \"examples/ux/css/\"\n       },{\n          \"text\": \"PanelResizer.css\",\n          \"path\": \"examples/ux/css/\"\n       },{\n          \"text\": \"Portal.css\",\n          \"path\": \"examples/ux/css/\"\n       },{\n          \"text\": \"RowEditor.css\",\n          \"path\": \"examples/ux/css/\"\n       },{\n          \"text\": \"Spinner.css\",\n          \"path\": \"examples/ux/css/\"\n       },{\n          \"text\": \"statusbar.css\",\n          \"path\": \"examples/ux/statusbar/css/\"\n       },{\n          \"text\": \"treegrid.css\",\n          \"path\": \"examples/ux/treegrid/\"\n       }]\n    },{\n       \"name\": \"Ext All CSS\",\n       \"file\": \"resources/css/ext-all.css\",\n       \"fileIncludes\": [],\n       \"includeDeps\": true,\n       \"pkgDeps\": [\n           \"resources/css/ext-all-notheme.css\",\n           \"resources/css/xtheme-blue.css\"\n       ]\n    },{\n       \"name\": \"Ext All CSS No theme\",\n       \"file\": \"resources/css/ext-all-notheme.css\",\n       \"fileIncludes\": [{\n           \"text\": \"reset.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"core.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n            \"text\": \"resizable.css\",\n            \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"tabs.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"form.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"button.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"toolbar.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"grid.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"pivotgrid.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"dd.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"tree.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"date-picker.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"qtips.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"menu.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"box.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"combo.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"panel.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"panel-reset.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"window.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"editor.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"borders.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"layout.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"progress.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"list-view.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"slider.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"dialog.css\",\n           \"path\": \"resources/css/structure/\"\n       }]\n    },{\n       \"name\": \"Ext Blue Theme\",\n       \"file\": \"resources/css/xtheme-blue.css\",\n       \"fileIncludes\": [{\n           \"text\": \"core.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"tabs.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"form.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"button.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"toolbar.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"resizable.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"grid.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"pivotgrid.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"dd.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"tree.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"date-picker.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"qtips.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"menu.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"box.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"combo.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"panel.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"window.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"editor.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"borders.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"layout.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"progress.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"list-view.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"slider.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"dialog.css\",\n           \"path\": \"resources/css/visual/\"\n       }]\n    },{\n       \"name\": \"Your Theme\",\n       \"file\": \"resources/css/yourtheme.css\",\n       \"fileIncludes\": [{\n           \"text\": \"core.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"tabs.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"form.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"button.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"toolbar.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"resizable.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"grid.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"dd.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"tree.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"date-picker.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"qtips.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"menu.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"box.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"combo.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"panel.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"window.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"editor.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"borders.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"layout.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"progress.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"list-view.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"slider.css\",\n           \"path\": \"resources/css/visual/\"\n       },{\n           \"text\": \"dialog.css\",\n           \"path\": \"resources/css/visual/\"\n       }]\n    },{\n       \"name\": \"Ext Gray Theme\",\n       \"file\": \"resources/css/xtheme-gray.css\",\n       \"fileIncludes\": [{\n           \"text\": \"core.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"tabs.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"form.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"button.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"toolbar.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"resizable.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"grid.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"pivotgrid.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"dd.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"tree.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"date-picker.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"qtips.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"menu.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"box.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"combo.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"panel.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"window.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"editor.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"borders.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"layout.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"progress.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"list-view.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"slider.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       },{\n           \"text\": \"dialog.css\",\n           \"path\": \"resources/css/theme-gray/\"\n       }]\n    },{\n       \"name\": \"Ext Accessibility Theme\",\n       \"file\": \"resources/css/xtheme-access.css\",\n       \"fileIncludes\": [{\n           \"text\": \"core.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"tabs.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"form.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"button.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"toolbar.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"resizable.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"grid.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"dd.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"tree.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"date-picker.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"qtips.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"menu.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"box.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"combo.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"panel.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"window.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"editor.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"borders.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"layout.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"progress.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"list-view.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"slider.css\",\n           \"path\": \"resources/css/theme-access/\"\n       },{\n           \"text\": \"dialog.css\",\n           \"path\": \"resources/css/theme-access/\"\n       }]\n    },{\n       \"name\": \"Ext Debug CSS\",\n       \"file\": \"resources/css/debug.css\",\n       \"fileIncludes\": [{\n           \"text\": \"debug.css\",\n           \"path\": \"resources/css/structure/\"\n       },{\n           \"text\": \"debug.css\",\n           \"path\": \"resources/css/visual/\"\n        }]\n    }],\n    \"resources\": [{\n        \"src\": \"src/\",\n        \"dest\": \"src/\",\n        \"filters\": \".*\\\\.js\"\n    },{\n        \"src\": \"examples/\",\n        \"dest\": \"examples/\",\n        \"filters\": \".*[\\\\.html|\\\\.jpg|\\\\.png|\\\\.gif|\\\\.css|\\\\.js|\\\\.php]\"\n    },{\n        \"src\": \"test/\",\n        \"dest\": \"test/\",\n        \"filters\": \".*[\\\\.js]\"\n    },{\n        \"src\": \"welcome/\",\n        \"dest\": \"welcome/\",\n        \"filters\": \".*\"\n    },{\n        \"src\": \"index.html\",\n        \"dest\": \"index.html\",\n        \"filters\": \".*\"\n    },{\n        \"src\": \"resources/\",\n        \"dest\": \"resources/\",\n        \"filters\": \".*\"\n    },{\n        \"src\": \"release-notes.html\",\n        \"dest\": \"release-notes.html\",\n        \"filters\": \".*\"\n    },{\n        \"src\": \"license.txt\",\n        \"dest\": \"license.txt\",\n        \"filters\": \".*\"\n    },{\n        \"src\": \"gpl-3.0.txt\",\n        \"dest\": \"gpl-3.0.txt\",\n        \"filters\": \".*\"\n    },{\n        \"src\": \"INCLUDE_ORDER.txt\",\n        \"dest\": \"INCLUDE_ORDER.txt\",\n        \"filters\": \".*\"\n    },{\n        \"src\": \"ext.jsb2\",\n        \"dest\": \"ext.jsb2\",\n        \"filters\": \".*\"\n    }]\n}\n"
  },
  {
    "path": "client/src/ext/gpl-3.0.txt",
    "content": "                    GNU GENERAL PUBLIC LICENSE\n                       Version 3, 29 June 2007\n\n Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>\n Everyone is permitted to copy and distribute verbatim copies\n of this license document, but changing it is not allowed.\n\n                            Preamble\n\n  The GNU General Public License is a free, copyleft license for\nsoftware and other kinds of works.\n\n  The licenses for most software and other practical works are designed\nto take away your freedom to share and change the works.  By contrast,\nthe GNU General Public License is intended to guarantee your freedom to\nshare and change all versions of a program--to make sure it remains free\nsoftware for all its users.  We, the Free Software Foundation, use the\nGNU General Public License for most of our software; it applies also to\nany other work released this way by its authors.  You can apply it to\nyour programs, too.\n\n  When we speak of free software, we are referring to freedom, not\nprice.  Our General Public Licenses are designed to make sure that you\nhave the freedom to distribute copies of free software (and charge for\nthem if you wish), that you receive source code or can get it if you\nwant it, that you can change the software or use pieces of it in new\nfree programs, and that you know you can do these things.\n\n  To protect your rights, we need to prevent others from denying you\nthese rights or asking you to surrender the rights.  Therefore, you have\ncertain responsibilities if you distribute copies of the software, or if\nyou modify it: responsibilities to respect the freedom of others.\n\n  For example, if you distribute copies of such a program, whether\ngratis or for a fee, you must pass on to the recipients the same\nfreedoms that you received.  You must make sure that they, too, receive\nor can get the source code.  And you must show them these terms so they\nknow their rights.\n\n  Developers that use the GNU GPL protect your rights with two steps:\n(1) assert copyright on the software, and (2) offer you this License\ngiving you legal permission to copy, distribute and/or modify it.\n\n  For the developers' and authors' protection, the GPL clearly explains\nthat there is no warranty for this free software.  For both users' and\nauthors' sake, the GPL requires that modified versions be marked as\nchanged, so that their problems will not be attributed erroneously to\nauthors of previous versions.\n\n  Some devices are designed to deny users access to install or run\nmodified versions of the software inside them, although the manufacturer\ncan do so.  This is fundamentally incompatible with the aim of\nprotecting users' freedom to change the software.  The systematic\npattern of such abuse occurs in the area of products for individuals to\nuse, which is precisely where it is most unacceptable.  Therefore, we\nhave designed this version of the GPL to prohibit the practice for those\nproducts.  If such problems arise substantially in other domains, we\nstand ready to extend this provision to those domains in future versions\nof the GPL, as needed to protect the freedom of users.\n\n  Finally, every program is threatened constantly by software patents.\nStates should not allow patents to restrict development and use of\nsoftware on general-purpose computers, but in those that do, we wish to\navoid the special danger that patents applied to a free program could\nmake it effectively proprietary.  To prevent this, the GPL assures that\npatents cannot be used to render the program non-free.\n\n  The precise terms and conditions for copying, distribution and\nmodification follow.\n\n                       TERMS AND CONDITIONS\n\n  0. Definitions.\n\n  \"This License\" refers to version 3 of the GNU General Public License.\n\n  \"Copyright\" also means copyright-like laws that apply to other kinds of\nworks, such as semiconductor masks.\n\n  \"The Program\" refers to any copyrightable work licensed under this\nLicense.  Each licensee is addressed as \"you\".  \"Licensees\" and\n\"recipients\" may be individuals or organizations.\n\n  To \"modify\" a work means to copy from or adapt all or part of the work\nin a fashion requiring copyright permission, other than the making of an\nexact copy.  The resulting work is called a \"modified version\" of the\nearlier work or a work \"based on\" the earlier work.\n\n  A \"covered work\" means either the unmodified Program or a work based\non the Program.\n\n  To \"propagate\" a work means to do anything with it that, without\npermission, would make you directly or secondarily liable for\ninfringement under applicable copyright law, except executing it on a\ncomputer or modifying a private copy.  Propagation includes copying,\ndistribution (with or without modification), making available to the\npublic, and in some countries other activities as well.\n\n  To \"convey\" a work means any kind of propagation that enables other\nparties to make or receive copies.  Mere interaction with a user through\na computer network, with no transfer of a copy, is not conveying.\n\n  An interactive user interface displays \"Appropriate Legal Notices\"\nto the extent that it includes a convenient and prominently visible\nfeature that (1) displays an appropriate copyright notice, and (2)\ntells the user that there is no warranty for the work (except to the\nextent that warranties are provided), that licensees may convey the\nwork under this License, and how to view a copy of this License.  If\nthe interface presents a list of user commands or options, such as a\nmenu, a prominent item in the list meets this criterion.\n\n  1. Source Code.\n\n  The \"source code\" for a work means the preferred form of the work\nfor making modifications to it.  \"Object code\" means any non-source\nform of a work.\n\n  A \"Standard Interface\" means an interface that either is an official\nstandard defined by a recognized standards body, or, in the case of\ninterfaces specified for a particular programming language, one that\nis widely used among developers working in that language.\n\n  The \"System Libraries\" of an executable work include anything, other\nthan the work as a whole, that (a) is included in the normal form of\npackaging a Major Component, but which is not part of that Major\nComponent, and (b) serves only to enable use of the work with that\nMajor Component, or to implement a Standard Interface for which an\nimplementation is available to the public in source code form.  A\n\"Major Component\", in this context, means a major essential component\n(kernel, window system, and so on) of the specific operating system\n(if any) on which the executable work runs, or a compiler used to\nproduce the work, or an object code interpreter used to run it.\n\n  The \"Corresponding Source\" for a work in object code form means all\nthe source code needed to generate, install, and (for an executable\nwork) run the object code and to modify the work, including scripts to\ncontrol those activities.  However, it does not include the work's\nSystem Libraries, or general-purpose tools or generally available free\nprograms which are used unmodified in performing those activities but\nwhich are not part of the work.  For example, Corresponding Source\nincludes interface definition files associated with source files for\nthe work, and the source code for shared libraries and dynamically\nlinked subprograms that the work is specifically designed to require,\nsuch as by intimate data communication or control flow between those\nsubprograms and other parts of the work.\n\n  The Corresponding Source need not include anything that users\ncan regenerate automatically from other parts of the Corresponding\nSource.\n\n  The Corresponding Source for a work in source code form is that\nsame work.\n\n  2. Basic Permissions.\n\n  All rights granted under this License are granted for the term of\ncopyright on the Program, and are irrevocable provided the stated\nconditions are met.  This License explicitly affirms your unlimited\npermission to run the unmodified Program.  The output from running a\ncovered work is covered by this License only if the output, given its\ncontent, constitutes a covered work.  This License acknowledges your\nrights of fair use or other equivalent, as provided by copyright law.\n\n  You may make, run and propagate covered works that you do not\nconvey, without conditions so long as your license otherwise remains\nin force.  You may convey covered works to others for the sole purpose\nof having them make modifications exclusively for you, or provide you\nwith facilities for running those works, provided that you comply with\nthe terms of this License in conveying all material for which you do\nnot control copyright.  Those thus making or running the covered works\nfor you must do so exclusively on your behalf, under your direction\nand control, on terms that prohibit them from making any copies of\nyour copyrighted material outside their relationship with you.\n\n  Conveying under any other circumstances is permitted solely under\nthe conditions stated below.  Sublicensing is not allowed; section 10\nmakes it unnecessary.\n\n  3. Protecting Users' Legal Rights From Anti-Circumvention Law.\n\n  No covered work shall be deemed part of an effective technological\nmeasure under any applicable law fulfilling obligations under article\n11 of the WIPO copyright treaty adopted on 20 December 1996, or\nsimilar laws prohibiting or restricting circumvention of such\nmeasures.\n\n  When you convey a covered work, you waive any legal power to forbid\ncircumvention of technological measures to the extent such circumvention\nis effected by exercising rights under this License with respect to\nthe covered work, and you disclaim any intention to limit operation or\nmodification of the work as a means of enforcing, against the work's\nusers, your or third parties' legal rights to forbid circumvention of\ntechnological measures.\n\n  4. Conveying Verbatim Copies.\n\n  You may convey verbatim copies of the Program's source code as you\nreceive it, in any medium, provided that you conspicuously and\nappropriately publish on each copy an appropriate copyright notice;\nkeep intact all notices stating that this License and any\nnon-permissive terms added in accord with section 7 apply to the code;\nkeep intact all notices of the absence of any warranty; and give all\nrecipients a copy of this License along with the Program.\n\n  You may charge any price or no price for each copy that you convey,\nand you may offer support or warranty protection for a fee.\n\n  5. Conveying Modified Source Versions.\n\n  You may convey a work based on the Program, or the modifications to\nproduce it from the Program, in the form of source code under the\nterms of section 4, provided that you also meet all of these conditions:\n\n    a) The work must carry prominent notices stating that you modified\n    it, and giving a relevant date.\n\n    b) The work must carry prominent notices stating that it is\n    released under this License and any conditions added under section\n    7.  This requirement modifies the requirement in section 4 to\n    \"keep intact all notices\".\n\n    c) You must license the entire work, as a whole, under this\n    License to anyone who comes into possession of a copy.  This\n    License will therefore apply, along with any applicable section 7\n    additional terms, to the whole of the work, and all its parts,\n    regardless of how they are packaged.  This License gives no\n    permission to license the work in any other way, but it does not\n    invalidate such permission if you have separately received it.\n\n    d) If the work has interactive user interfaces, each must display\n    Appropriate Legal Notices; however, if the Program has interactive\n    interfaces that do not display Appropriate Legal Notices, your\n    work need not make them do so.\n\n  A compilation of a covered work with other separate and independent\nworks, which are not by their nature extensions of the covered work,\nand which are not combined with it such as to form a larger program,\nin or on a volume of a storage or distribution medium, is called an\n\"aggregate\" if the compilation and its resulting copyright are not\nused to limit the access or legal rights of the compilation's users\nbeyond what the individual works permit.  Inclusion of a covered work\nin an aggregate does not cause this License to apply to the other\nparts of the aggregate.\n\n  6. Conveying Non-Source Forms.\n\n  You may convey a covered work in object code form under the terms\nof sections 4 and 5, provided that you also convey the\nmachine-readable Corresponding Source under the terms of this License,\nin one of these ways:\n\n    a) Convey the object code in, or embodied in, a physical product\n    (including a physical distribution medium), accompanied by the\n    Corresponding Source fixed on a durable physical medium\n    customarily used for software interchange.\n\n    b) Convey the object code in, or embodied in, a physical product\n    (including a physical distribution medium), accompanied by a\n    written offer, valid for at least three years and valid for as\n    long as you offer spare parts or customer support for that product\n    model, to give anyone who possesses the object code either (1) a\n    copy of the Corresponding Source for all the software in the\n    product that is covered by this License, on a durable physical\n    medium customarily used for software interchange, for a price no\n    more than your reasonable cost of physically performing this\n    conveying of source, or (2) access to copy the\n    Corresponding Source from a network server at no charge.\n\n    c) Convey individual copies of the object code with a copy of the\n    written offer to provide the Corresponding Source.  This\n    alternative is allowed only occasionally and noncommercially, and\n    only if you received the object code with such an offer, in accord\n    with subsection 6b.\n\n    d) Convey the object code by offering access from a designated\n    place (gratis or for a charge), and offer equivalent access to the\n    Corresponding Source in the same way through the same place at no\n    further charge.  You need not require recipients to copy the\n    Corresponding Source along with the object code.  If the place to\n    copy the object code is a network server, the Corresponding Source\n    may be on a different server (operated by you or a third party)\n    that supports equivalent copying facilities, provided you maintain\n    clear directions next to the object code saying where to find the\n    Corresponding Source.  Regardless of what server hosts the\n    Corresponding Source, you remain obligated to ensure that it is\n    available for as long as needed to satisfy these requirements.\n\n    e) Convey the object code using peer-to-peer transmission, provided\n    you inform other peers where the object code and Corresponding\n    Source of the work are being offered to the general public at no\n    charge under subsection 6d.\n\n  A separable portion of the object code, whose source code is excluded\nfrom the Corresponding Source as a System Library, need not be\nincluded in conveying the object code work.\n\n  A \"User Product\" is either (1) a \"consumer product\", which means any\ntangible personal property which is normally used for personal, family,\nor household purposes, or (2) anything designed or sold for incorporation\ninto a dwelling.  In determining whether a product is a consumer product,\ndoubtful cases shall be resolved in favor of coverage.  For a particular\nproduct received by a particular user, \"normally used\" refers to a\ntypical or common use of that class of product, regardless of the status\nof the particular user or of the way in which the particular user\nactually uses, or expects or is expected to use, the product.  A product\nis a consumer product regardless of whether the product has substantial\ncommercial, industrial or non-consumer uses, unless such uses represent\nthe only significant mode of use of the product.\n\n  \"Installation Information\" for a User Product means any methods,\nprocedures, authorization keys, or other information required to install\nand execute modified versions of a covered work in that User Product from\na modified version of its Corresponding Source.  The information must\nsuffice to ensure that the continued functioning of the modified object\ncode is in no case prevented or interfered with solely because\nmodification has been made.\n\n  If you convey an object code work under this section in, or with, or\nspecifically for use in, a User Product, and the conveying occurs as\npart of a transaction in which the right of possession and use of the\nUser Product is transferred to the recipient in perpetuity or for a\nfixed term (regardless of how the transaction is characterized), the\nCorresponding Source conveyed under this section must be accompanied\nby the Installation Information.  But this requirement does not apply\nif neither you nor any third party retains the ability to install\nmodified object code on the User Product (for example, the work has\nbeen installed in ROM).\n\n  The requirement to provide Installation Information does not include a\nrequirement to continue to provide support service, warranty, or updates\nfor a work that has been modified or installed by the recipient, or for\nthe User Product in which it has been modified or installed.  Access to a\nnetwork may be denied when the modification itself materially and\nadversely affects the operation of the network or violates the rules and\nprotocols for communication across the network.\n\n  Corresponding Source conveyed, and Installation Information provided,\nin accord with this section must be in a format that is publicly\ndocumented (and with an implementation available to the public in\nsource code form), and must require no special password or key for\nunpacking, reading or copying.\n\n  7. Additional Terms.\n\n  \"Additional permissions\" are terms that supplement the terms of this\nLicense by making exceptions from one or more of its conditions.\nAdditional permissions that are applicable to the entire Program shall\nbe treated as though they were included in this License, to the extent\nthat they are valid under applicable law.  If additional permissions\napply only to part of the Program, that part may be used separately\nunder those permissions, but the entire Program remains governed by\nthis License without regard to the additional permissions.\n\n  When you convey a copy of a covered work, you may at your option\nremove any additional permissions from that copy, or from any part of\nit.  (Additional permissions may be written to require their own\nremoval in certain cases when you modify the work.)  You may place\nadditional permissions on material, added by you to a covered work,\nfor which you have or can give appropriate copyright permission.\n\n  Notwithstanding any other provision of this License, for material you\nadd to a covered work, you may (if authorized by the copyright holders of\nthat material) supplement the terms of this License with terms:\n\n    a) Disclaiming warranty or limiting liability differently from the\n    terms of sections 15 and 16 of this License; or\n\n    b) Requiring preservation of specified reasonable legal notices or\n    author attributions in that material or in the Appropriate Legal\n    Notices displayed by works containing it; or\n\n    c) Prohibiting misrepresentation of the origin of that material, or\n    requiring that modified versions of such material be marked in\n    reasonable ways as different from the original version; or\n\n    d) Limiting the use for publicity purposes of names of licensors or\n    authors of the material; or\n\n    e) Declining to grant rights under trademark law for use of some\n    trade names, trademarks, or service marks; or\n\n    f) Requiring indemnification of licensors and authors of that\n    material by anyone who conveys the material (or modified versions of\n    it) with contractual assumptions of liability to the recipient, for\n    any liability that these contractual assumptions directly impose on\n    those licensors and authors.\n\n  All other non-permissive additional terms are considered \"further\nrestrictions\" within the meaning of section 10.  If the Program as you\nreceived it, or any part of it, contains a notice stating that it is\ngoverned by this License along with a term that is a further\nrestriction, you may remove that term.  If a license document contains\na further restriction but permits relicensing or conveying under this\nLicense, you may add to a covered work material governed by the terms\nof that license document, provided that the further restriction does\nnot survive such relicensing or conveying.\n\n  If you add terms to a covered work in accord with this section, you\nmust place, in the relevant source files, a statement of the\nadditional terms that apply to those files, or a notice indicating\nwhere to find the applicable terms.\n\n  Additional terms, permissive or non-permissive, may be stated in the\nform of a separately written license, or stated as exceptions;\nthe above requirements apply either way.\n\n  8. Termination.\n\n  You may not propagate or modify a covered work except as expressly\nprovided under this License.  Any attempt otherwise to propagate or\nmodify it is void, and will automatically terminate your rights under\nthis License (including any patent licenses granted under the third\nparagraph of section 11).\n\n  However, if you cease all violation of this License, then your\nlicense from a particular copyright holder is reinstated (a)\nprovisionally, unless and until the copyright holder explicitly and\nfinally terminates your license, and (b) permanently, if the copyright\nholder fails to notify you of the violation by some reasonable means\nprior to 60 days after the cessation.\n\n  Moreover, your license from a particular copyright holder is\nreinstated permanently if the copyright holder notifies you of the\nviolation by some reasonable means, this is the first time you have\nreceived notice of violation of this License (for any work) from that\ncopyright holder, and you cure the violation prior to 30 days after\nyour receipt of the notice.\n\n  Termination of your rights under this section does not terminate the\nlicenses of parties who have received copies or rights from you under\nthis License.  If your rights have been terminated and not permanently\nreinstated, you do not qualify to receive new licenses for the same\nmaterial under section 10.\n\n  9. Acceptance Not Required for Having Copies.\n\n  You are not required to accept this License in order to receive or\nrun a copy of the Program.  Ancillary propagation of a covered work\noccurring solely as a consequence of using peer-to-peer transmission\nto receive a copy likewise does not require acceptance.  However,\nnothing other than this License grants you permission to propagate or\nmodify any covered work.  These actions infringe copyright if you do\nnot accept this License.  Therefore, by modifying or propagating a\ncovered work, you indicate your acceptance of this License to do so.\n\n  10. Automatic Licensing of Downstream Recipients.\n\n  Each time you convey a covered work, the recipient automatically\nreceives a license from the original licensors, to run, modify and\npropagate that work, subject to this License.  You are not responsible\nfor enforcing compliance by third parties with this License.\n\n  An \"entity transaction\" is a transaction transferring control of an\norganization, or substantially all assets of one, or subdividing an\norganization, or merging organizations.  If propagation of a covered\nwork results from an entity transaction, each party to that\ntransaction who receives a copy of the work also receives whatever\nlicenses to the work the party's predecessor in interest had or could\ngive under the previous paragraph, plus a right to possession of the\nCorresponding Source of the work from the predecessor in interest, if\nthe predecessor has it or can get it with reasonable efforts.\n\n  You may not impose any further restrictions on the exercise of the\nrights granted or affirmed under this License.  For example, you may\nnot impose a license fee, royalty, or other charge for exercise of\nrights granted under this License, and you may not initiate litigation\n(including a cross-claim or counterclaim in a lawsuit) alleging that\nany patent claim is infringed by making, using, selling, offering for\nsale, or importing the Program or any portion of it.\n\n  11. Patents.\n\n  A \"contributor\" is a copyright holder who authorizes use under this\nLicense of the Program or a work on which the Program is based.  The\nwork thus licensed is called the contributor's \"contributor version\".\n\n  A contributor's \"essential patent claims\" are all patent claims\nowned or controlled by the contributor, whether already acquired or\nhereafter acquired, that would be infringed by some manner, permitted\nby this License, of making, using, or selling its contributor version,\nbut do not include claims that would be infringed only as a\nconsequence of further modification of the contributor version.  For\npurposes of this definition, \"control\" includes the right to grant\npatent sublicenses in a manner consistent with the requirements of\nthis License.\n\n  Each contributor grants you a non-exclusive, worldwide, royalty-free\npatent license under the contributor's essential patent claims, to\nmake, use, sell, offer for sale, import and otherwise run, modify and\npropagate the contents of its contributor version.\n\n  In the following three paragraphs, a \"patent license\" is any express\nagreement or commitment, however denominated, not to enforce a patent\n(such as an express permission to practice a patent or covenant not to\nsue for patent infringement).  To \"grant\" such a patent license to a\nparty means to make such an agreement or commitment not to enforce a\npatent against the party.\n\n  If you convey a covered work, knowingly relying on a patent license,\nand the Corresponding Source of the work is not available for anyone\nto copy, free of charge and under the terms of this License, through a\npublicly available network server or other readily accessible means,\nthen you must either (1) cause the Corresponding Source to be so\navailable, or (2) arrange to deprive yourself of the benefit of the\npatent license for this particular work, or (3) arrange, in a manner\nconsistent with the requirements of this License, to extend the patent\nlicense to downstream recipients.  \"Knowingly relying\" means you have\nactual knowledge that, but for the patent license, your conveying the\ncovered work in a country, or your recipient's use of the covered work\nin a country, would infringe one or more identifiable patents in that\ncountry that you have reason to believe are valid.\n\n  If, pursuant to or in connection with a single transaction or\narrangement, you convey, or propagate by procuring conveyance of, a\ncovered work, and grant a patent license to some of the parties\nreceiving the covered work authorizing them to use, propagate, modify\nor convey a specific copy of the covered work, then the patent license\nyou grant is automatically extended to all recipients of the covered\nwork and works based on it.\n\n  A patent license is \"discriminatory\" if it does not include within\nthe scope of its coverage, prohibits the exercise of, or is\nconditioned on the non-exercise of one or more of the rights that are\nspecifically granted under this License.  You may not convey a covered\nwork if you are a party to an arrangement with a third party that is\nin the business of distributing software, under which you make payment\nto the third party based on the extent of your activity of conveying\nthe work, and under which the third party grants, to any of the\nparties who would receive the covered work from you, a discriminatory\npatent license (a) in connection with copies of the covered work\nconveyed by you (or copies made from those copies), or (b) primarily\nfor and in connection with specific products or compilations that\ncontain the covered work, unless you entered into that arrangement,\nor that patent license was granted, prior to 28 March 2007.\n\n  Nothing in this License shall be construed as excluding or limiting\nany implied license or other defenses to infringement that may\notherwise be available to you under applicable patent law.\n\n  12. No Surrender of Others' Freedom.\n\n  If conditions are imposed on you (whether by court order, agreement or\notherwise) that contradict the conditions of this License, they do not\nexcuse you from the conditions of this License.  If you cannot convey a\ncovered work so as to satisfy simultaneously your obligations under this\nLicense and any other pertinent obligations, then as a consequence you may\nnot convey it at all.  For example, if you agree to terms that obligate you\nto collect a royalty for further conveying from those to whom you convey\nthe Program, the only way you could satisfy both those terms and this\nLicense would be to refrain entirely from conveying the Program.\n\n  13. Use with the GNU Affero General Public License.\n\n  Notwithstanding any other provision of this License, you have\npermission to link or combine any covered work with a work licensed\nunder version 3 of the GNU Affero General Public License into a single\ncombined work, and to convey the resulting work.  The terms of this\nLicense will continue to apply to the part which is the covered work,\nbut the special requirements of the GNU Affero General Public License,\nsection 13, concerning interaction through a network will apply to the\ncombination as such.\n\n  14. Revised Versions of this License.\n\n  The Free Software Foundation may publish revised and/or new versions of\nthe GNU General Public License from time to time.  Such new versions will\nbe similar in spirit to the present version, but may differ in detail to\naddress new problems or concerns.\n\n  Each version is given a distinguishing version number.  If the\nProgram specifies that a certain numbered version of the GNU General\nPublic License \"or any later version\" applies to it, you have the\noption of following the terms and conditions either of that numbered\nversion or of any later version published by the Free Software\nFoundation.  If the Program does not specify a version number of the\nGNU General Public License, you may choose any version ever published\nby the Free Software Foundation.\n\n  If the Program specifies that a proxy can decide which future\nversions of the GNU General Public License can be used, that proxy's\npublic statement of acceptance of a version permanently authorizes you\nto choose that version for the Program.\n\n  Later license versions may give you additional or different\npermissions.  However, no additional obligations are imposed on any\nauthor or copyright holder as a result of your choosing to follow a\nlater version.\n\n  15. Disclaimer of Warranty.\n\n  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY\nAPPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT\nHOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM \"AS IS\" WITHOUT WARRANTY\nOF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,\nTHE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\nPURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM\nIS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF\nALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n  16. Limitation of Liability.\n\n  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING\nWILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS\nTHE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY\nGENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE\nUSE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF\nDATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD\nPARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),\nEVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF\nSUCH DAMAGES.\n\n  17. Interpretation of Sections 15 and 16.\n\n  If the disclaimer of warranty and limitation of liability provided\nabove cannot be given local legal effect according to their terms,\nreviewing courts shall apply local law that most closely approximates\nan absolute waiver of all civil liability in connection with the\nProgram, unless a warranty or assumption of liability accompanies a\ncopy of the Program in return for a fee.\n\n                     END OF TERMS AND CONDITIONS\n\n            How to Apply These Terms to Your New Programs\n\n  If you develop a new program, and you want it to be of the greatest\npossible use to the public, the best way to achieve this is to make it\nfree software which everyone can redistribute and change under these terms.\n\n  To do so, attach the following notices to the program.  It is safest\nto attach them to the start of each source file to most effectively\nstate the exclusion of warranty; and each file should have at least\nthe \"copyright\" line and a pointer to where the full notice is found.\n\n    <one line to give the program's name and a brief idea of what it does.>\n    Copyright (C) <year>  <name of author>\n\n    This program is free software: you can redistribute it and/or modify\n    it under the terms of the GNU General Public License as published by\n    the Free Software Foundation, either version 3 of the License, or\n    (at your option) any later version.\n\n    This program is distributed in the hope that it will be useful,\n    but WITHOUT ANY WARRANTY; without even the implied warranty of\n    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n    GNU General Public License for more details.\n\n    You should have received a copy of the GNU General Public License\n    along with this program.  If not, see <http://www.gnu.org/licenses/>.\n\nAlso add information on how to contact you by electronic and paper mail.\n\n  If the program does terminal interaction, make it output a short\nnotice like this when it starts in an interactive mode:\n\n    <program>  Copyright (C) <year>  <name of author>\n    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.\n    This is free software, and you are welcome to redistribute it\n    under certain conditions; type `show c' for details.\n\nThe hypothetical commands `show w' and `show c' should show the appropriate\nparts of the General Public License.  Of course, your program's commands\nmight be different; for a GUI interface, you would use an \"about box\".\n\n  You should also get your employer (if you work as a programmer) or school,\nif any, to sign a \"copyright disclaimer\" for the program, if necessary.\nFor more information on this, and how to apply and follow the GNU GPL, see\n<http://www.gnu.org/licenses/>.\n\n  The GNU General Public License does not permit incorporating your program\ninto proprietary programs.  If your program is a subroutine library, you\nmay consider it more useful to permit linking proprietary applications with\nthe library.  If this is what you want to do, use the GNU Lesser General\nPublic License instead of this License.  But first, please read\n<http://www.gnu.org/philosophy/why-not-lgpl.html>.\n"
  },
  {
    "path": "client/src/ext/index.html",
    "content": "<!DOCTYPE HTML>\n<html>\n<head>\n<meta charset=\"UTF-8\" />\n<title>Welcome to Ext JS</title>\n<link rel=\"shortcut icon\" href=\"http://www.sencha.com/favicon.ico\" />\n<style type=\"text/css\">\n\n* {\n    margin: 0;\n    padding: 0;\n}\n\nbody {\n    background: #fff;\n    color: #333;\n    font: normal 12px/1.3 Helvetica, sans-serif;\n    margin: 0 auto 0;\n    padding: 0;\n    width: 800px;\n    \n    -webkit-font-smoothing: antialiased;\n    text-rendering: optimizelegibility;\n}\n\np {\n    margin: 0 0 1em;\n}\n\na:link,\na:visited {\n    color: #0464BB;\n    text-decoration: none;\n}\n\na:hover,\na:focus,\na:active {\n    color: #0464BB;\n    text-decoration: underline;\n}\n\nh1,h2,h3,h4,h5,h6 {\n    color: #222;\n    font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif;\n    line-height: 1.1;    \n    margin-bottom: 0;\n    padding-bottom: 0;\n}\n\na#logo {\n    background: url(welcome/images/logo-sencha-sm.png) no-repeat 0 100%;\n    display: block;\n    height: 58px;\n    margin: 0 0 24px;\n    overflow: hidden;\n    padding: 0px;\n    text-indent: 150%;\n    white-space: nowrap;\n    width: 134px;\n}\n\n#header {\n    background: url(welcome/images/ext-comp.png) no-repeat 100% 48px;\n    height: 320px;\n}\n\n#header h1 {\n    font-size: 32px;\n    margin: 45px 0 12px;\n    width: 350px;\n}\n\n#header p {\n    color: #555;\n    font-size: 16px;\n    line-height: 1.5;\n    width: 360px;\n}\n\ndiv.button-wrap {\n    padding: 0 0 1em;\n}\n\n.button:link,\n.button:visited {\n    background: #2a64a6;\n    border: 1px solid;\n    border-color: transparent transparent rgba(0,0,0,0.4) transparent;\n    -webkit-border-radius: 13px;\n    -moz-border-radius:    13px;\n    border-radius:         13px;\n    color: #fff;\n    display: table-cell;\n    font-size: 13px;\n    font-weight: bold;\n    height: 13px;\n    padding: 2px 12px;\n    text-align: center;\n    text-decoration: none;\n    text-shadow: 0 1px 0 rgba(0,0,0,0.4);\n    width: 114px;\n}\n\n.button:hover,\n.button:focus {\n    background: #265B98;\n}\n\n.button:active {\n    background: #1F4C7E;\n    border-color: rgba(0,0,0,0.4) transparent transparent transparent;\n    text-decoration: none;\n    text-shadow: 0 -1px 0 rgba(0,0,0,0.4);\n}\n\nh2 {\n    font-size: 18px;\n}\n\n#header {\n    display: block;\n    margin: 0 0 24px;\n    padding: 0;\n}\n\ndiv#container {\n    margin: 0 auto;\n    overflow: hidden;\n    width: 800px;\n}\n\n.section {\n    float: left;\n    margin-right: 50px;\n    width: 233px;\n}\n\n.section h2 {\n    line-height: 30px;\n    margin: 0;\n    padding: 0;\n}\n\n#engage ul li {\n    height: 16px;\n    line-height: 16px;\n}\n\n#engage ul#social li a {\n    color: #777;\n    display: block;\n    height: 16px;\n    line-height: 16px;\n    margin: 6px 0 0;\n    padding-left: 22px;\n    text-decoration: none;\n}\n\n#engage ul#social li a span {\n    color: #0464BB;\n    font-weight: bold;\n    text-decoration: none;\n}\n\n#engage ul#social li a:hover {\n    color: #777;\n    text-decoration: none;\n}\n\n#engage ul#social li a:hover span {\n    color: #0464BB;\n    text-decoration: underline;\n}\n\n#engage a#join_us.button {\n    width: 148px;\n}\n\n#engage a#twitter {\n    background: url(welcome/images/social_sprite.gif) no-repeat 0 0;\n}\n\n#engage a#twitter:hover {\n    background: url(welcome/images/social_sprite.gif) no-repeat 0 -16px;\n}\n\n#engage a#tumblr {\n    background: url(welcome/images/social_sprite.gif) no-repeat 0 -32px;\n}\n\n#engage a#tumblr:hover {\n    background: url(welcome/images/social_sprite.gif) no-repeat 0 -48px;\n}\n\n#engage a#facebook {\n    background: url(welcome/images/social_sprite.gif) no-repeat 0 -64px;\n}\n\n#engage a#facebook:hover {\n    background: url(welcome/images/social_sprite.gif) no-repeat 0 -80px;\n}\n\n#engage a#linkedin {\n    background: url(welcome/images/social_sprite.gif) no-repeat 0 -128px;\n}\n\n#engage a#linkedin:hover {\n    background: url(welcome/images/social_sprite.gif) no-repeat 0 -144px;\n}\n\n#engage a#blog {\n    background: url(welcome/images/social_sprite.gif) no-repeat 0 -96px;\n}\n\n#engage a#blog:hover {\n    background: url(welcome/images/social_sprite.gif) no-repeat 0 -112px;\n}\n\n#license {\n    margin-right: 0;\n}\n\nul,\nul li {\n    list-style: none;\n    margin: 0;\n    padding: 0;\n}\n\n#learn ul li,\n#license ul li {\n    background: url(welcome/images/li.png) no-repeat 1px 2px;\n    padding: 0 0 0.5em 10px;\n    margin-left: 0px;\n}\n\ndiv#communication {\n    border-top: 1px solid #dfdfdf;\n    font-size: 13px;\n    height: 16px;\n    line-height: 16px;\n    margin: 24px 0;\n    overflow: hidden;\n    overflow: visible;\n    padding: 24px 0 0;\n}\n\ndiv#communication form {\n    float: left;\n    width: 550px;\n}\n\ndiv#communication p {\n    color: #222;\n    margin: 0;\n}\n\ndiv#communication p strong {\n    color: #555;\n}\n\ndiv#communication input#MERGE0 {\n    padding: 2px;\n}\n\ndiv#communication p#jobs {\n    float: right;\n    text-align: right;\n    width: 220px;\n}\n\n</style>\n</head>\n<body>\n<div id=\"page\">\n<div id=\"header\">\n<a href=\"http://www.sencha.com/\" id=\"logo\">Sencha - Ext JS - Amazing Web Apps Built on Web Standards</a>\n<h1>Welcome to Ext JS</h1>\n<p>Thank you for downloading Ext JS. With a community of over one million developers and our robust family of Sencha products, Ext JS is the leader in Javascript application development.</p>\n<div class=\"button-wrap\">\n    <a href=\"examples/\" id=\"examples\" class=\"button\"><span>View Examples</span></a>\n</div>\n</div>\n<div id=\"container\">\n<div id=\"learn\" class=\"section\">\n<h2>Learn</h2>\n<p>Use the included files to <a href=\"examples/index.html\">view samples</a> and our <a href=\"docs/\">API documentation</a>.</p>\n<p>For advanced, hands-on support, please see our premium <a href=\"http://www.sencha.com/store\">support subscriptions</a>. Larger organizations can use <a href=\"http://www.sencha.com/support/\">our enterprise training and services</a>.</p>\n<ul>\n<li><a href=\"http://www.sencha.com/learn/Tutorial:Ext_StartUp_Guide\">Getting Started Guide</a></li>\n<li><a href=\"examples/\">Examples</a></li>\n<li><a href=\"release-notes.html\">Release Notes</a></li>\n</ul>\n</div>\n\n<div id=\"engage\" class=\"section\">\n<h2>Engage</h2>\n<p>Our <a href=\"http://www.sencha.com/forum/\">community forums</a> have over 100,000 registered users and are a great place to ask questions and interact with other Ext JS developers.</p>\n\n<div class=\"button-wrap\">\n    <a href=\"http://www.sencha.com/forum/register.php\" id=\"join_us\" class=\"button\"><span>Join Sencha Forum</span></a>\n</div>\n\n<ul id=\"social\">\n<li><a href=\"http://twitter.com/senchainc\" id=\"twitter\"><span>Follow @SenchaInc</span> on Twitter</a></li>\n<li><a href=\"http://senchainc.tumblr.com/\" id=\"tumblr\"><span>Check out</span> our new Tumblelog</a></li>\n<li><a href=\"http://www.facebook.com/senchainc\" id=\"facebook\"><span>Become a fan</span> on Facebook</a></li>\n<li><a href=\"http://j.mp/sencha-in\" id=\"linkedin\"><span>Network with us</span> on LinkedIn</a></li>\n<li><a href=\"http://www.sencha.com/blog/\" id=\"blog\"><span>Subscribe</span> to the official blog</a></li>\n</ul>\n</div>\n\n<div id=\"license\" class=\"section\">\n<h2>License</h2>\n<p>Ext JS is <a href=\"http://www.sencha.com/company/dual.php\">dual licensed</a>. This means:</p>\n<ul>\n<li>Free to use and test in your local development environment.</li>\n<li>Free to use in your open source projects.</li>\n<li>Purchase a developer license if you don&rsquo;t plan on releasing your website or application&rsquo;s code as open source.</li>\n</ul>\n<p>To purchase a commercial license, please see our <a href=\"http://www.sencha.com/store/extjs/\">pricing page</a>.</p>\n</div>\n</div>\n\n<div id=\"communication\">\n<form action=\"http://extjs.us1.list-manage.com/subscribe/post\" method=\"post\">\n<p>\n<label for=\"MERGE0\"><strong>Sign up to stay in the loop:</strong></label>\n<input name=\"u\" type=\"hidden\" value=\"fb30e9d0e8ab5e66a19398a14\" />\n<input name=\"id\" type=\"hidden\" value=\"879d2e6c9b\" />\n<input name=\"refurl\" type=\"hidden\" value=\"/extjs\" />\n<input name=\"interests\" type=\"hidden\" value=\"Company News, Ext JS\" />\n<input name=\"orig-lang\" type=\"hidden\" value=\"1\" />\n<input id=\"MERGE0\" name=\"MERGE0\" type=\"email\" autofocus=\"true\" placeholder=\"johndoe@example.com\" size=\"25\" />\n<input id=\"submit\" name=\"submit\" type=\"submit\" value=\"Subscribe\" />\n</p>\n</form>\n<p id=\"jobs\">Check out our <a href=\"http://jobs.extjs.com/\">Job Board &raquo;</a></p>\n</div>\n\n</div>\n</body>\n</html>"
  },
  {
    "path": "client/src/ext/license.txt",
    "content": "Ext JS 3.4 - JavaScript Library\nCopyright (c) 2006-2013, Sencha Inc.\nAll rights reserved.\nlicensing@sencha.com\n\nhttp://www.sencha.com/license\n\nOpen Source License\n------------------------------------------------------------------------------------------\nThis version of Ext JS is licensed under the terms of the Open Source GPL 3.0 license. \n\nhttp://www.gnu.org/licenses/gpl.html\n\nThere are several FLOSS exceptions available for use with this release for\nopen source applications that are distributed under a license other than GPL.\n\n* Open Source License Exception for Applications\n\n  http://www.sencha.com/products/floss-exception.php\n\n* Open Source License Exception for Development\n\n  http://www.sencha.com/products/ux-exception.php\n\n\nAlternate Licensing\n------------------------------------------------------------------------------------------\nCommercial and OEM Licenses are available for an alternate download of Ext JS.\nThis is the appropriate option if you are creating proprietary applications and you are \nnot prepared to distribute and share the source code of your application under the \nGPL v3 license. Please visit http://www.sencha.com/license for more details.\n\n--\n\nThis library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT OF THIRD-PARTY INTELLECTUAL PROPERTY RIGHTS.  See the GNU General Public License for more details."
  },
  {
    "path": "client/src/ext/release-notes.html",
    "content": "<!DOCTYPE html PUBLIC \"-//W3C//DTD HTML 4.01//EN\">\n<html>\n    <head>\n        <meta charset=\"UTF-8\">\n        <title>\n            Release Notes for Ext JS 3.4.0\n        </title>\n        <style type=\"text/css\">\n\n        * { margin: 0; padding: 0; }\n        body { \n        color: #333; \n        font-family: Helvetica, Arial, sans-serif; \n        font-size: 12px;\n        padding: 0 40px 40px; \n        width: 800px;\n        margin: 0 auto;\n        }\n        h1, h2, h3 { \n        font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; \n        font-weight: 600; \n        margin: 1em 0;\n        }\n        h1 { font-size: 23px; }\n        h2 { font-size: 16px; margin-top: 1em; }\n        h3 { font-size: 14px; }\n        ul li { padding: 2px 0; font-size: 13px; }\n        ul ul li { font-size: 12px; font-weight: normal; }\n        .doc { color: blue; }\n        .change { color: #196cb4; }\n        .new { color: #6e7a32; }\n        ul { padding: .1em 1.5em; }\n        .notes { color: #777; }\n        a { color: rgb(4, 100, 187); }\n        a:hover { color: rgb(28, 65, 124); }\n        </style>\n    </head>\n    <body>\n        <p>\n            <a href=\"http://www.sencha.com/\" id=\"logo\" name=\"logo\"><img src=\"http://www.sencha.com/assets/images/logo-sencha-sm.png\" alt=\"\"></a>\n        </p>\n        <h1>\n            Release Notes for <a href=\"http://www.sencha.com/products/extjs3/\">Ext JS</a> 3.4.1.1\n        </h1>\n        <p class=\"notes\">\n            Release Date: March 29, 2013<br>\n            Version Number: 3.4.1.1<br>\n            Downloads: <a href=\"../../commercial/ext-3.4.1.1-commercial.zip\">Commercial</a>\n            <a href=\"../../gpl/ext-3.4.1.1-gpl.zip\">GPL</a>\n        </p>\n\n        <h2>New Features</h2>\n        <ul>\n            <li><b>EXTJSIII-118</b> - Support for IE10\n        </ul>\n\n        <h2>Bugs Fixed</h2>\n        <ul>\n            <li><b>EXTJSIII-115</b> - Ajax of XML data does not properly handle XML namespaces on IE8\n            <li><b>EXTJSIII-119</b> - Grid causes double scrollbars in WebKit\n        </ul>\n\n\n        <!-- ********************************************************************* -->\n        <h1>\n            Release Notes for <a href=\"http://www.sencha.com/products/extjs3/\">Ext JS</a> 3.4.1\n        </h1>\n        <p class=\"notes\">\n            Release Date: July 30, 2012<br>\n            Version Number: 3.4.1\n        </p>\n\n        <h2>New Features</h2>\n        <ul>\n            <li>Added a functionally-reduced flavor of Ext.define. This will allow you to start structuring\n                and declaring your classes using the new syntax. To clarify, this is not a back-port of the V4\n                class system or the dynamic loader, only a simple wrapper around Ext.extend and Ext.override.\n                As such, only the most important directives are provided:\n                <ul>\n                    <li>extend\n                    <li>override\n                    <li>statics\n                    <li>singleton\n                    <li>xtype\n                    <li>callParent\n                </ul>\n        </ul>\n\n        <h2>Bugs Fixed</h2>\n        <ul>\n            <li><b>EXTJSIII-15</b> - IE 9.0: Active tab has double lines underneath it in quirks mode\n            <li><b>EXTJSIII-17</b> - enableDragDrop on EditorGridPanel breaks when using CheckColumn\n            <li><b>EXTJSIII-18</b> - CompositeField ownerCt chain broken\n            <li><b>EXTJSIII-19</b> - Ext.calendar cannot be recreated after being destroyed\n            <li><b>EXTJSIII-23</b> - Form layout ignores container's layoutConfig\n            <li><b>EXTJSIII-24</b> - Can't access checkbox when using BooleanColumn's editor is a checkbox\n            <li><b>EXTJSIII-30</b> - notifyDrop called in wrong ddGroup and/or multiple times\n            <li><b>EXTJSIII-31</b> - Grid drag zone swallows document mousedown event in IE\n            <li><b>EXTJSIII-32</b> - Destroying an Ext.form.HtmlEditor twice is causing it to fail to initialize on all subsequent creations of the editor in IE 9\n            <li><b>EXTJSIII-33</b> - User cannot create select region in IE9\n            <li><b>EXTJSIII-34</b> - applyState on grid wipes out sortable property\n            <li><b>EXTJSIII-35</b> - Ext.util.Format.defaultValue doesn't default to an empty string\n            <li><b>EXTJSIII-37</b> - Ext.data.HttpProxy.doRequest does not abort an activeRequest for the same action\n            <li><b>EXTJSIII-38</b> - Update scroller in tabPanel when tab title is changed.\n            <li><b>EXTJSIII-39</b> - DragTracker broken in IE9 Strict mode\n            <li><b>EXTJSIII-41</b> - Buttons in a toolbar loose their position after the left side is collapsed\n            <li><b>EXTJSIII-44</b> - Documentation error in BorderLayout.Region\n            <li><b>EXTJSIII-45</b> - Store.hasMultiSort listed as Store.multiSort\n            <li><b>EXTJSIII-48</b> - Component not allowing select should have proper CSS style\n            <li><b>EXTJSIII-49</b> - Wrong ext-lang-tr.js distributed with ExtJS 3.4.0\n            <li><b>EXTJSIII-50</b> - Focus jump out of order when tab key press from a Grid cell in editing in IE9 standard mode\n            <li><b>EXTJSIII-54</b> - Toolbar reorderer bug. Dragged items can lose contact with mouse pointer.\n        </ul>\n\n\n        <h1>\n            Release Notes for <a href=\"http://www.sencha.com/products/extjs3/\">Ext JS</a> 3.4.0\n        </h1>\n        <p class=\"notes\">\n            Release Date: June 9, 2011<br>\n            Current Version: 3.4.0 (rev 7395/288)<br>\n            Previous Version: 3.3.3 (rev 7389/286)\n        </p>\n        <h2 class=\"new\">\n            Changes\n        </h2>\n        <h3>\n            Menu\n        </h3>\n        <ul>\n            <li>Incorrect menu width on IE9\n            </li>\n            <li>Fix Reorderable example\n            </li>\n        </ul>\n        <h3>\n            Form/Field\n        </h3>\n        <ul>\n            <li>Fix an issue with composite fields being marked incorrectly\n            </li>\n            <li>Trigger fields are now flushed with fields on IE9\n            </li>\n            <li>Fix field width in IE9\n            </li>\n            <li>Fix fieldset header checkboxes in IE9 quirks\n            </li>\n        </ul>\n        <h3>\n            Misc\n        </h3>\n        <ul>\n            <li>Allow altText to be specified on a per item basis for grid columns\n            </li>\n            <li>Ensure there's no bottom margin on the multi-select\n            </li>\n            <li>Apply additional css classes for IE9 (ext-ie9 and x-quirks)\n            </li>\n            <li>Apply additional boolean flags for IE9 (Ext.isIE9 and Ext.isIEQuirks)\n            </li>\n            <li>Add support to insertHTML method to prevent createContextualFragment errors with IE9\n            </li>\n        </ul>\n    </body>\n</html>\n"
  },
  {
    "path": "client/src/ext/resources/css/debug.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n#x-debug-browser .x-tree .x-tree-node a span {\n    padding-top:2px;\n    line-height:18px;\n}\n\n#x-debug-browser  .x-tool-toggle {\n    background-position:0 -75px;\n}\n\n#x-debug-browser  .x-tool-toggle-over {\n    background-position:-15px -75px;\n}\n\n#x-debug-browser.x-panel-collapsed .x-tool-toggle {\n    background-position:0 -60px;\n}\n\n#x-debug-browser.x-panel-collapsed .x-tool-toggle-over {\n    background-position:-15px -60px;\n}#x-debug-browser .x-tree .x-tree-node a span {\n    color:#222297;\n    font-size:11px;\n    font-family:\"monotype\",\"courier new\",sans-serif;\n}\n\n#x-debug-browser .x-tree a i {\n    color:#ff4545;\n    font-style:normal;\n}\n\n#x-debug-browser .x-tree a em {\n    color:#999;\n}\n\n#x-debug-browser .x-tree .x-tree-node .x-tree-selected a span{\n    background-color:#c3daf9;\n}"
  },
  {
    "path": "client/src/ext/resources/css/ext-all-notheme.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nhtml,body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,p,blockquote,th,td{margin:0;padding:0;}img,body,html{border:0;}address,caption,cite,code,dfn,em,strong,th,var{font-style:normal;font-weight:normal;}ol,ul {list-style:none;}caption,th {text-align:left;}h1,h2,h3,h4,h5,h6{font-size:100%;}q:before,q:after{content:'';}\n\n.ext-forced-border-box, .ext-forced-border-box * {\n    -moz-box-sizing: border-box;\n    -ms-box-sizing: border-box;\n    -webkit-box-sizing: border-box;\n}\n.ext-el-mask {\n    z-index: 100;\n    position: absolute;\n    top:0;\n    left:0;\n    -moz-opacity: 0.5;\n    opacity: .50;\n    filter: alpha(opacity=50);\n    width: 100%;\n    height: 100%;\n    zoom: 1;\n}\n\n.ext-el-mask-msg {\n    z-index: 20001;\n    position: absolute;\n    top: 0;\n    left: 0;\n    border:1px solid;\n    background:repeat-x 0 -16px;\n    padding:2px;\n}\n\n.ext-el-mask-msg div {\n    padding:5px 10px 5px 10px;\n    border:1px solid;\n    cursor:wait;\n}\n\n.ext-shim {\n    position:absolute;\n    visibility:hidden;\n    left:0;\n    top:0;\n    overflow:hidden;\n}\n\n.ext-ie .ext-shim {\n    filter: alpha(opacity=0);\n}\n\n.ext-ie6 .ext-shim {\n    margin-left: 5px;\n    margin-top: 3px;\n}\n\n.x-mask-loading div {\n    padding:5px 10px 5px 25px;\n    background:no-repeat 5px 5px;\n    line-height:16px;\n}\n\n/* class for hiding elements without using display:none */\n.x-hidden, .x-hide-offsets {\n    position:absolute !important;\n    left:-10000px;\n    top:-10000px;\n    visibility:hidden;\n}\n\n.x-hide-display {\n    display:none !important;\n}\n\n.x-hide-nosize,\n.x-hide-nosize *    /* Emulate display:none for children */\n {\n   height:0px!important;\n   width:0px!important;\n   visibility:hidden!important;\n   border:none!important;\n   zoom:1;\n}\n\n.x-hide-visibility {\n    visibility:hidden !important;\n}\n\n.x-masked {\n    overflow: hidden !important;\n}\n.x-masked-relative {\n    position: relative !important;\n}\n\n.x-masked select, .x-masked object, .x-masked embed {\n    visibility: hidden;\n}\n\n.x-layer {\n    visibility: hidden;\n}\n\n.x-unselectable, .x-unselectable * {\n    user-select: none;\n    -o-user-select: none;\n    -ms-user-select: none;\n    -moz-user-select: -moz-none;\n    -webkit-user-select: none;\n    \n    cursor:default;\n}\n\n.x-repaint {\n    zoom: 1;\n    background-color: transparent;\n    -moz-outline: none;\n    outline: none;\n}\n\n.x-item-disabled {\n    cursor: default;\n    opacity: .6;\n    -moz-opacity: .6;\n    filter: alpha(opacity=60);\n}\n\n.x-item-disabled * {\n    cursor: default !important;\n}\n\n.x-form-radio-group .x-item-disabled {\n    filter: none;\n}\n\n.x-splitbar-proxy {\n    position: absolute;\n    visibility: hidden;\n    z-index: 20001;\n    zoom: 1;\n    line-height: 1px;\n    font-size: 1px;\n    overflow: hidden;\n}\n\n.x-splitbar-h, .x-splitbar-proxy-h {\n    cursor: e-resize;\n    cursor: col-resize;\n}\n\n.x-splitbar-v, .x-splitbar-proxy-v {\n    cursor: s-resize;\n    cursor: row-resize;\n}\n\n.x-color-palette {\n    width: 150px;\n    height: 92px;\n    cursor: pointer;\n}\n\n.x-color-palette a {\n    border: 1px solid;\n    float: left;\n    padding: 2px;\n    text-decoration: none;\n    -moz-outline: 0 none;\n    outline: 0 none;\n    cursor: pointer;\n}\n\n.x-color-palette a:hover, .x-color-palette a.x-color-palette-sel {\n    border: 1px solid;\n}\n\n.x-color-palette em {\n    display: block;\n    border: 1px solid;\n}\n\n.x-color-palette em span {\n    cursor: pointer;\n    display: block;\n    height: 10px;\n    line-height: 10px;\n    width: 10px;\n}\n\n.x-ie-shadow {\n    display: none;\n    position: absolute;\n    overflow: hidden;\n    left:0;\n    top:0;\n    zoom:1;\n}\n\n.x-shadow {\n    display: none;\n    position: absolute;\n    overflow: hidden;\n    left:0;\n    top:0;\n}\n\n.x-shadow * {\n    overflow: hidden;\n}\n\n.x-shadow * {\n    padding: 0;\n    border: 0;\n    margin: 0;\n    clear: none;\n    zoom: 1;\n}\n\n/* top  bottom */\n.x-shadow .xstc, .x-shadow .xsbc {\n    height: 6px;\n    float: left;\n}\n\n/* corners */\n.x-shadow .xstl, .x-shadow .xstr, .x-shadow .xsbl, .x-shadow .xsbr {\n    width: 6px;\n    height: 6px;\n    float: left;\n}\n\n/* sides */\n.x-shadow .xsc {\n    width: 100%;\n}\n\n.x-shadow .xsml, .x-shadow .xsmr {\n    width: 6px;\n    float: left;\n    height: 100%;\n}\n\n.x-shadow .xsmc {\n    float: left;\n    height: 100%;\n    background-color: transparent;\n}\n\n.x-shadow .xst, .x-shadow .xsb {\n    height: 6px;\n    overflow: hidden;\n    width: 100%;\n}\n\n.x-shadow .xsml {\n    background: transparent repeat-y 0 0;\n}\n\n.x-shadow .xsmr {\n    background: transparent repeat-y -6px 0;\n}\n\n.x-shadow .xstl {\n    background: transparent no-repeat 0 0;\n}\n\n.x-shadow .xstc {\n    background: transparent repeat-x 0 -30px;\n}\n\n.x-shadow .xstr {\n    background: transparent repeat-x 0 -18px;\n}\n\n.x-shadow .xsbl {\n    background: transparent no-repeat 0 -12px;\n}\n\n.x-shadow .xsbc {\n    background: transparent repeat-x 0 -36px;\n}\n\n.x-shadow .xsbr {\n    background: transparent repeat-x 0 -6px;\n}\n\n.loading-indicator {\n    background: no-repeat left;\n    padding-left: 20px;\n    line-height: 16px;\n    margin: 3px;\n}\n\n.x-text-resize {\n    position: absolute;\n    left: -1000px;\n    top: -1000px;\n    visibility: hidden;\n    zoom: 1;\n}\n\n.x-drag-overlay {\n    width: 100%;\n    height: 100%;\n    display: none;\n    position: absolute;\n    left: 0;\n    top: 0;\n    background-image:url(../images/default/s.gif);\n    z-index: 20000;\n}\n\n.x-clear {\n    clear:both;\n    height:0;\n    overflow:hidden;\n    line-height:0;\n    font-size:0;\n}\n\n.x-spotlight {\n    z-index: 8999;\n    position: absolute;\n    top:0;\n    left:0;\n    -moz-opacity: 0.5;\n    opacity: .50;\n    filter: alpha(opacity=50);\n    width:0;\n    height:0;\n    zoom: 1;\n}\n\n#x-history-frame {\n    position:absolute;\n    top:-1px;\n    left:0;\n\twidth:1px;\n    height:1px;\n    visibility:hidden;\n}\n\n#x-history-field {\n    position:absolute;\n    top:0;\n    left:-1px;\n\twidth:1px;\n    height:1px;\n    visibility:hidden;\n}\n.x-resizable-handle {\n    position:absolute;\n    z-index:100;\n    /* ie needs these */\n    font-size:1px;\n    line-height:6px;\n    overflow:hidden;\n\tfilter:alpha(opacity=0);\n\topacity:0;\n\tzoom:1;\n}\n\n.x-resizable-handle-east{\n    width:6px;\n    cursor:e-resize;\n    right:0;\n    top:0;\n    height:100%;\n}\n\n.ext-ie .x-resizable-handle-east {\n    margin-right:-1px; /*IE rounding error*/\n}\n\n.x-resizable-handle-south{\n    width:100%;\n    cursor:s-resize;\n    left:0;\n    bottom:0;\n    height:6px;\n}\n\n.ext-ie .x-resizable-handle-south {\n    margin-bottom:-1px; /*IE rounding error*/\n}\n\n.x-resizable-handle-west{\n    width:6px;\n    cursor:w-resize;\n    left:0;\n    top:0;\n    height:100%;\n}\n\n.x-resizable-handle-north{\n    width:100%;\n    cursor:n-resize;\n    left:0;\n    top:0;\n    height:6px;\n}\n\n.x-resizable-handle-southeast{\n    width:6px;\n    cursor:se-resize;\n    right:0;\n    bottom:0;\n    height:6px;\n    z-index:101;\n}\n\n.x-resizable-handle-northwest{\n    width:6px;\n    cursor:nw-resize;\n    left:0;\n    top:0;\n    height:6px;\n    z-index:101;\n}\n\n.x-resizable-handle-northeast{\n    width:6px;\n    cursor:ne-resize;\n    right:0;\n    top:0;\n    height:6px;\n    z-index:101;\n}\n\n.x-resizable-handle-southwest{\n    width:6px;\n    cursor:sw-resize;\n    left:0;\n    bottom:0;\n    height:6px;\n    z-index:101;\n}\n\n.x-resizable-over .x-resizable-handle, .x-resizable-pinned .x-resizable-handle{\n    filter:alpha(opacity=100);\n\topacity:1;\n}\n\n.x-resizable-over .x-resizable-handle-east, .x-resizable-pinned .x-resizable-handle-east,\n.x-resizable-over .x-resizable-handle-west, .x-resizable-pinned .x-resizable-handle-west\n{\n\tbackground-position: left;\n}\n\n.x-resizable-over .x-resizable-handle-south, .x-resizable-pinned .x-resizable-handle-south,\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north\n{\n    background-position: top;\n}\n\n.x-resizable-over .x-resizable-handle-southeast, .x-resizable-pinned .x-resizable-handle-southeast{\n    background-position: top left;\n}\n\n.x-resizable-over .x-resizable-handle-northwest, .x-resizable-pinned .x-resizable-handle-northwest{\n    background-position:bottom right;\n}\n\n.x-resizable-over .x-resizable-handle-northeast, .x-resizable-pinned .x-resizable-handle-northeast{\n    background-position: bottom left;\n}\n\n.x-resizable-over .x-resizable-handle-southwest, .x-resizable-pinned .x-resizable-handle-southwest{\n    background-position: top right;\n}\n\n.x-resizable-proxy{\n    border: 1px dashed;\n    position:absolute;\n    overflow:hidden;\n    display:none;\n\tleft:0;\n    top:0;\n    z-index:50000;\n}\n\n.x-resizable-overlay{\n    width:100%;\n\theight:100%;\n\tdisplay:none;\n\tposition:absolute;\n\tleft:0;\n\ttop:0;\n\tz-index:200000;\n\t-moz-opacity: 0;\n    opacity:0;\n    filter: alpha(opacity=0);\n}\n.x-tab-panel {\n    overflow:hidden;\n}\n\n.x-tab-panel-header, .x-tab-panel-footer {\n\tborder: 1px solid;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tab-panel-header {\n\tborder: 1px solid;\n\tpadding-bottom: 2px;\n}\n\n.x-tab-panel-footer {\n\tborder: 1px solid;\n\tpadding-top: 2px;\n}\n\n.x-tab-strip-wrap {\n\twidth:100%;\n    overflow:hidden;\n    position:relative;\n    zoom:1;\n}\n\nul.x-tab-strip {\n\tdisplay:block;\n    width:5000px;\n    zoom:1;\n}\n\nul.x-tab-strip-top{\n\tpadding-top: 1px;\n\tbackground: repeat-x bottom;\n\tborder-bottom: 1px solid;\n}\n\nul.x-tab-strip-bottom{\n\tpadding-bottom: 1px;\n\tbackground: repeat-x top;\n\tborder-top: 1px solid;\n\tborder-bottom: 0 none;\n}\n\n.x-tab-panel-header-plain .x-tab-strip-top {\n    background:transparent !important;\n    padding-top:0 !important;\n}\n\n.x-tab-panel-header-plain {\n    background:transparent !important;\n    border-width:0 !important;\n    padding-bottom:0 !important;\n}\n\n.x-tab-panel-header-plain .x-tab-strip-spacer,\n.x-tab-panel-footer-plain .x-tab-strip-spacer {\n    border:1px solid;\n    height:2px;\n    font-size:1px;\n    line-height:1px;\n}\n\n.x-tab-panel-header-plain .x-tab-strip-spacer {\n    border-top: 0 none;\n}\n\n.x-tab-panel-footer-plain .x-tab-strip-spacer {\n    border-bottom: 0 none;\n}\n\n.x-tab-panel-footer-plain .x-tab-strip-bottom {\n    background:transparent !important;\n    padding-bottom:0 !important;\n}\n\n.x-tab-panel-footer-plain {\n    background:transparent !important;\n    border-width:0 !important;\n    padding-top:0 !important;\n}\n\n.ext-border-box .x-tab-panel-header-plain .x-tab-strip-spacer,\n.ext-border-box .x-tab-panel-footer-plain .x-tab-strip-spacer {\n    height:3px;\n}\n\nul.x-tab-strip li {\n    float:left;\n    margin-left:2px;\n}\n\nul.x-tab-strip li.x-tab-edge {\n    float:left;\n    margin:0 !important;\n    padding:0 !important;\n    border:0 none !important;\n    font-size:1px !important;\n    line-height:1px !important;\n    overflow:hidden;\n    zoom:1;\n    background:transparent !important;\n    width:1px;\n}\n\n.x-tab-strip a, .x-tab-strip span, .x-tab-strip em {\n\tdisplay:block;\n}\n\n.x-tab-strip a {\n\ttext-decoration:none !important;\n\t-moz-outline: none;\n\toutline: none;\n\tcursor:pointer;\n}\n\n.x-tab-strip-inner {\n    overflow:hidden;\n\ttext-overflow: ellipsis;\n}\n\n.x-tab-strip span.x-tab-strip-text {\n\twhite-space: nowrap;\n\tcursor:pointer;\n    padding:4px 0;\n}\n\n.x-tab-strip-top .x-tab-with-icon .x-tab-right {\n    padding-left:6px;\n}\n\n.x-tab-strip .x-tab-with-icon span.x-tab-strip-text {\n\tpadding-left:20px;\n    background-position: 0 3px;\n    background-repeat: no-repeat;\n}\n\n.x-tab-strip-active, .x-tab-strip-active a.x-tab-right {\n    cursor:default;\n}\n\n.x-tab-strip-active span.x-tab-strip-text {\n\tcursor:default;\n}\n\n.x-tab-strip-disabled .x-tabs-text {\n\tcursor:default;\n}\n\n.x-tab-panel-body {\n    overflow:hidden;\n}\n\n.x-tab-panel-bwrap {\n    overflow:hidden;\n}\n\n.ext-ie .x-tab-strip .x-tab-right {\n    position:relative;\n}\n\n.x-tab-strip-top .x-tab-strip-active .x-tab-right {\n    margin-bottom:-1px;\n}\n\n/*\n * For IE8/9 in quirks mode\n */\n.ext-ie8 .x-tab-strip li {\n    position: relative;\n}\n.ext-border-box .ext-ie8 .x-tab-strip-top .x-tab-right, .ext-border-box .ext-ie9 .x-tab-strip-top .x-tab-right {\n    top: 1px;\n}\n.ext-ie8 .x-tab-strip-top, .ext-ie9 .x-tab-strip-top {\n    padding-top: 1px;\n}\n.ext-border-box .ext-ie8 .x-tab-strip-top, .ext-border-box .ext-ie9 .x-tab-strip-top {\n    padding-top: 0;\n}\n.ext-ie8 .x-tab-strip .x-tab-strip-closable a.x-tab-strip-close, .ext-ie9 .x-tab-strip .x-tab-strip-closable a.x-tab-strip-close {\n    top:3px;\n}\n.ext-border-box .ext-ie8 .x-tab-strip .x-tab-strip-closable a.x-tab-strip-close,\n.ext-border-box .ext-ie9 .x-tab-strip .x-tab-strip-closable a.x-tab-strip-close {\n    top:4px;\n}\n.ext-ie8 .x-tab-strip-bottom .x-tab-right, .ext-ie9 .x-tab-strip-bottom .x-tab-right{\n    top:0;\n}\n\n\n.x-tab-strip-top .x-tab-strip-active .x-tab-right span.x-tab-strip-text {\n    padding-bottom:5px;\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-right {\n    margin-top:-1px;\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-right span.x-tab-strip-text {\n    padding-top:5px;\n}\n\n.x-tab-strip-top .x-tab-right {\n\tbackground: transparent no-repeat 0 -51px;\n    padding-left:10px;\n}\n\n.x-tab-strip-top .x-tab-left {\n\tbackground: transparent no-repeat right -351px;\n    padding-right:10px;\n}\n\n.x-tab-strip-top .x-tab-strip-inner {\n\tbackground: transparent repeat-x 0 -201px;\n}\n\n.x-tab-strip-top .x-tab-strip-over .x-tab-right {\n\t background-position:0 -101px;\n}\n\n.x-tab-strip-top .x-tab-strip-over .x-tab-left {\n\t background-position:right -401px;\n}\n\n.x-tab-strip-top .x-tab-strip-over .x-tab-strip-inner {\n\t background-position:0 -251px;\n}\n\n.x-tab-strip-top .x-tab-strip-active .x-tab-right {\n\tbackground-position: 0 0;\n}\n\n.x-tab-strip-top .x-tab-strip-active .x-tab-left {\n\tbackground-position: right -301px;\n}\n\n.x-tab-strip-top .x-tab-strip-active .x-tab-strip-inner {\n\tbackground-position: 0 -151px;\n}\n\n.x-tab-strip-bottom .x-tab-right {\n\tbackground: no-repeat bottom right;\n}\n\n.x-tab-strip-bottom .x-tab-left {\n\tbackground: no-repeat bottom left;\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-right {\n\tbackground: no-repeat bottom right;\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-left {\n\tbackground: no-repeat bottom left;\n}\n\n.x-tab-strip-bottom .x-tab-left {\n    margin-right: 3px;\n    padding:0 10px;\n}\n\n.x-tab-strip-bottom .x-tab-right {\n    padding:0;\n}\n\n.x-tab-strip .x-tab-strip-close {\n    display:none;\n}\n\n.x-tab-strip-closable {\n    position:relative;\n}\n\n.x-tab-strip-closable .x-tab-left {\n    padding-right:19px;\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close {\n    opacity:.6;\n    -moz-opacity:.6;\n    background-repeat:no-repeat;\n    display:block;\n\twidth:11px;\n    height:11px;\n    position:absolute;\n    top:3px;\n    right:3px;\n    cursor:pointer;\n    z-index:2;\n}\n\n.x-tab-strip .x-tab-strip-active a.x-tab-strip-close {\n    opacity:.8;\n    -moz-opacity:.8;\n}\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close:hover{\n    opacity:1;\n    -moz-opacity:1;\n}\n\n.x-tab-panel-body {\n    border: 1px solid;\n}\n\n.x-tab-panel-body-top {\n    border-top: 0 none;\n}\n\n.x-tab-panel-body-bottom {\n    border-bottom: 0 none;\n}\n\n.x-tab-scroller-left {\n    background: transparent no-repeat -18px 0;\n    border-bottom: 1px solid;\n    width:18px;\n    position:absolute;\n    left:0;\n    top:0;\n    z-index:10;\n    cursor:pointer;\n}\n.x-tab-scroller-left-over {\n    background-position: 0 0;\n}\n\n.x-tab-scroller-left-disabled {\n    background-position: -18px 0;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n    cursor:default;\n}\n\n.x-tab-scroller-right {\n    background: transparent no-repeat 0 0;\n    border-bottom: 1px solid;\n    width:18px;\n    position:absolute;\n    right:0;\n    top:0;\n    z-index:10;\n    cursor:pointer;\n}\n\n.x-tab-scroller-right-over {\n    background-position: -18px 0;\n}\n\n.x-tab-scroller-right-disabled {\n    background-position: 0 0;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n    cursor:default;\n}\n\n.x-tab-scrolling-bottom .x-tab-scroller-left, .x-tab-scrolling-bottom .x-tab-scroller-right{\n    margin-top: 1px;\n}\n\n.x-tab-scrolling .x-tab-strip-wrap {\n    margin-left:18px;\n    margin-right:18px;\n}\n\n.x-tab-scrolling {\n    position:relative;    \n}\n\n.x-tab-panel-bbar .x-toolbar {\n    border:1px solid;\n    border-top:0 none;\n    overflow:hidden;\n    padding:2px;\n}\n\n.x-tab-panel-tbar .x-toolbar {\n    border:1px solid;\n    border-top:0 none;\n    overflow:hidden;\n    padding:2px;\n}/* all fields */\n.x-form-field{\n    margin: 0 0 0 0;\n}\n\n.ext-webkit *:focus{\n    outline: none !important;\n}\n\n/* ---- text fields ---- */\n.x-form-text, textarea.x-form-field{\n    padding:1px 3px;\n    background:repeat-x 0 0;\n    border:1px solid;\n}\n\ntextarea.x-form-field {\n    padding:2px 3px;\n}\n\n.x-form-text, .ext-ie .x-form-file {\n    height:22px;\n    line-height:18px;\n    vertical-align:middle;\n}\n\n.ext-ie6 .x-form-text, .ext-ie7 .x-form-text {\n    margin:-1px 0; /* ie bogus margin bug */\n    height:22px; /* ie quirks */\n    line-height:18px;\n}\n\n.x-quirks .ext-ie9 .x-form-text {\n    height: 22px;\n    padding-top: 3px;\n    padding-bottom: 0px;\n}\n\n/* Ugly hacks for the bogus 1px margin bug in IE9 quirks */\n.x-quirks .ext-ie9 .x-input-wrapper .x-form-text,\n.x-quirks .ext-ie9 .x-form-field-trigger-wrap .x-form-text {\n    margin-top: -1px;\n    margin-bottom: -1px;\n}\n.x-quirks .ext-ie9 .x-input-wrapper .x-form-element {\n    margin-bottom: -1px;\n}\n\n.ext-ie6 .x-form-field-wrap .x-form-file-btn, .ext-ie7 .x-form-field-wrap .x-form-file-btn {\n    top: -1px; /* because of all these margin hacks, these buttons are off by one pixel in IE6,7 */\n}\n\n.ext-ie6 textarea.x-form-field, .ext-ie7 textarea.x-form-field {\n    margin:-1px 0; /* ie bogus margin bug */\n}\n\n.ext-strict .x-form-text {\n    height:18px;\n}\n\n.ext-safari.ext-mac textarea.x-form-field {\n    margin-bottom:-2px; /* another bogus margin bug, safari/mac only */\n}\n\n/*\n.ext-strict .ext-ie8 .x-form-text, .ext-strict .ext-ie8 textarea.x-form-field {\n    margin-bottom: 1px;\n}\n*/\n\n.ext-gecko .x-form-text , .ext-ie8 .x-form-text {\n    padding-top:2px; /* FF won't center the text vertically */\n    padding-bottom:0;\n}\n\n.ext-ie6 .x-form-composite .x-form-text.x-box-item, .ext-ie7 .x-form-composite .x-form-text.x-box-item {\n    margin: 0 !important; /* clear ie bogus margin bug fix */\n}\n\ntextarea {\n    resize: none;  /* Disable browser resizable textarea */\n}\n\n/* select boxes */\n.x-form-select-one {\n    height:20px;\n    line-height:18px;\n    vertical-align:middle;\n    border: 1px solid;\n}\n\n/* multi select boxes */\n\n/* --- TODO --- */\n\n/* 2.0.2 style */\n.x-form-check-wrap {\n    line-height:18px;\n    height: auto;\n}\n\n.ext-ie .x-form-check-wrap input {\n    width:15px;\n    height:15px;\n}\n\n.x-form-check-wrap input{\n    vertical-align: bottom;\n}\n\n.x-editor .x-form-check-wrap {\n    padding:3px;\n}\n\n.x-editor .x-form-checkbox {\n    height:13px;\n}\n\n.x-form-check-group-label {\n    border-bottom: 1px solid;\n    margin-bottom: 5px;\n    padding-left: 3px !important;\n    float: none !important;\n}\n\n/* wrapped fields and triggers */\n.x-form-field-wrap .x-form-trigger{\n    width:17px;\n    height:21px;\n    border:0;\n    background:transparent no-repeat 0 0;\n    cursor:pointer;\n    border-bottom: 1px solid;\n    position:absolute;\n    top:0;\n}\n\n.x-form-field-wrap .x-form-date-trigger, .x-form-field-wrap .x-form-clear-trigger, .x-form-field-wrap .x-form-search-trigger{\n    cursor:pointer;\n}\n\n.x-form-field-wrap .x-form-twin-triggers .x-form-trigger{\n    position:static;\n    top:auto;\n    vertical-align:top;\n}\n\n.x-form-field-wrap {\n    position:relative;\n    left:0;top:0;\n    text-align: left;\n    zoom:1;\n    white-space: nowrap;\n}\n\n.ext-strict .ext-ie8 .x-toolbar-cell .x-form-field-trigger-wrap .x-form-trigger {\n    right: 0; /* IE8 Strict mode trigger bug */\n}\n\n.x-form-field-wrap .x-form-trigger-over{\n    background-position:-17px 0;\n}\n\n.x-form-field-wrap .x-form-trigger-click{\n    background-position:-34px 0;\n}\n\n.x-trigger-wrap-focus .x-form-trigger{\n    background-position:-51px 0;\n}\n\n.x-trigger-wrap-focus .x-form-trigger-over{\n    background-position:-68px 0;\n}\n\n.x-trigger-wrap-focus .x-form-trigger-click{\n    background-position:-85px 0;\n}\n\n.x-trigger-wrap-focus .x-form-trigger{\n    border-bottom: 1px solid;\n}\n\n.x-item-disabled .x-form-trigger-over{\n    background-position:0 0 !important;\n    border-bottom: 1px solid;\n}\n\n.x-item-disabled .x-form-trigger-click{\n    background-position:0 0 !important;\n    border-bottom: 1px solid;\n}\n\n.x-trigger-noedit{\n    cursor:pointer;\n}\n\n/* field focus style */\n.x-form-focus, textarea.x-form-focus{\n    border: 1px solid;\n}\n\n/* invalid fields */\n.x-form-invalid, textarea.x-form-invalid{\n    background:repeat-x bottom;\n    border: 1px solid;\n}\n\n.x-form-inner-invalid, textarea.x-form-inner-invalid{\n    background:repeat-x bottom;\n}\n\n/* editors */\n.x-editor {\n    visibility:hidden;\n    padding:0;\n    margin:0;\n}\n\n.x-form-grow-sizer {\n    left: -10000px;\n    padding: 8px 3px;\n    position: absolute;\n    visibility:hidden;\n    top: -10000px;\n    white-space: pre-wrap;\n    white-space: -moz-pre-wrap;\n    white-space: -pre-wrap;\n    white-space: -o-pre-wrap;\n    word-wrap: break-word;\n    zoom:1;\n}\n\n.x-form-grow-sizer p {\n    margin:0 !important;\n    border:0 none !important;\n    padding:0 !important;\n}\n\n/* Form Items CSS */\n\n.x-form-item {\n    display:block;\n    margin-bottom:4px;\n    zoom:1;\n}\n\n.x-form-item label.x-form-item-label {\n    display:block;\n    float:left;\n    width:100px;\n    padding:3px;\n    padding-left:0;\n    clear:left;\n    z-index:2;\n    position:relative;\n}\n\n.x-form-element {\n    padding-left:105px;\n    position:relative;\n}\n\n.x-form-invalid-msg {\n    padding:2px;\n    padding-left:18px;\n    background: transparent no-repeat 0 2px;\n    line-height:16px;\n    width:200px;\n}\n\n.x-form-label-left label.x-form-item-label {\n   text-align:left;\n}\n\n.x-form-label-right label.x-form-item-label {\n   text-align:right;\n}\n\n.x-form-label-top .x-form-item label.x-form-item-label {\n    width:auto;\n    float:none;\n    clear:none;\n    display:inline;\n    margin-bottom:4px;\n    position:static;\n}\n\n.x-form-label-top .x-form-element {\n    padding-left:0;\n    padding-top:4px;\n}\n\n.x-form-label-top .x-form-item {\n    padding-bottom:4px;\n}\n\n/* Editor small font for grid, toolbar and tree */\n.x-small-editor .x-form-text {\n    height:20px;\n    line-height:16px;\n    vertical-align:middle;\n}\n\n.ext-ie6 .x-small-editor .x-form-text, .ext-ie7 .x-small-editor .x-form-text {\n    margin-top:-1px !important; /* ie bogus margin bug */\n    margin-bottom:-1px !important;\n    height:20px !important; /* ie quirks */\n    line-height:16px !important;\n}\n\n.ext-strict .x-small-editor .x-form-text {\n    height:16px !important;\n}\n\n.ext-ie6 .x-small-editor .x-form-text, .ext-ie7 .x-small-editor .x-form-text {\n    height:20px;\n    line-height:16px;\n}\n\n.ext-border-box .x-small-editor .x-form-text {\n    height:20px;\n}\n\n.x-small-editor .x-form-select-one {\n    height:20px;\n    line-height:16px;\n    vertical-align:middle;\n}\n\n.x-small-editor .x-form-num-field {\n    text-align:right;\n}\n\n.x-small-editor .x-form-field-wrap .x-form-trigger{\n    height:19px;\n}\n\n.ext-webkit .x-small-editor .x-form-text{padding-top:3px;font-size:100%;}\n\n.ext-strict .ext-webkit .x-small-editor .x-form-text{\n    height:14px !important;\n}\n\n.x-form-clear {\n    clear:both;\n    height:0;\n    overflow:hidden;\n    line-height:0;\n    font-size:0;\n}\n.x-form-clear-left {\n    clear:left;\n    height:0;\n    overflow:hidden;\n    line-height:0;\n    font-size:0;\n}\n\n.ext-ie6 .x-form-check-wrap input, .ext-border-box .x-form-check-wrap input{\n   margin-top: 3px;\n}\n\n.x-form-cb-label {\n    position: relative;\n    margin-left:4px;\n    top: 2px;\n}\n\n.ext-ie .x-form-cb-label{\n    top: 1px;\n}\n\n.ext-ie6 .x-form-cb-label, .ext-border-box .x-form-cb-label{\n    top: 3px;\n}\n\n.x-form-display-field{\n    padding-top: 2px;\n}\n\n.ext-gecko .x-form-display-field, .ext-strict .ext-ie7 .x-form-display-field{\n    padding-top: 1px;\n}\n\n.ext-ie .x-form-display-field{\n    padding-top: 3px;\n}\n\n.ext-strict .ext-ie8 .x-form-display-field{\n    padding-top: 0;\n}\n\n.x-form-column {\n    float:left;\n    padding:0;\n    margin:0;\n    width:48%;\n    overflow:hidden;\n    zoom:1;\n}\n\n/* buttons */\n.x-form .x-form-btns-ct .x-btn{\n    float:right;\n    clear:none;\n}\n\n.x-form .x-form-btns-ct .x-form-btns td {\n    border:0;\n    padding:0;\n}\n\n.x-form .x-form-btns-ct .x-form-btns-right table{\n    float:right;\n    clear:none;\n}\n\n.x-form .x-form-btns-ct .x-form-btns-left table{\n    float:left;\n    clear:none;\n}\n\n.x-form .x-form-btns-ct .x-form-btns-center{\n    text-align:center; /*ie*/\n}\n\n.x-form .x-form-btns-ct .x-form-btns-center table{\n    margin:0 auto; /*everyone else*/\n}\n\n.x-form .x-form-btns-ct table td.x-form-btn-td{\n    padding:3px;\n}\n\n.x-form .x-form-btns-ct .x-btn-focus .x-btn-left{\n    background-position:0 -147px;\n}\n\n.x-form .x-form-btns-ct .x-btn-focus .x-btn-right{\n    background-position:0 -168px;\n}\n\n.x-form .x-form-btns-ct .x-btn-focus .x-btn-center{\n    background-position:0 -189px;\n}\n\n.x-form .x-form-btns-ct .x-btn-click .x-btn-center{\n    background-position:0 -126px;\n}\n\n.x-form .x-form-btns-ct .x-btn-click  .x-btn-right{\n    background-position:0 -84px;\n}\n\n.x-form .x-form-btns-ct .x-btn-click .x-btn-left{\n    background-position:0 -63px;\n}\n\n.x-form-invalid-icon {\n    width:16px;\n    height:18px;\n    visibility:hidden;\n    position:absolute;\n    left:0;\n    top:0;\n    display:block;\n    background:transparent no-repeat 0 2px;\n}\n\n/* fieldsets */\n.x-fieldset {\n    border:1px solid;\n    padding:10px;\n    margin-bottom:10px;\n    display:block; /* preserve margins in IE */\n}\n\n/* make top of checkbox/tools visible in webkit */\n.ext-webkit .x-fieldset-header {\n    padding-top: 1px;\n}\n\n.ext-ie .x-fieldset legend {\n    margin-bottom:10px;\n}\n\n.ext-strict .ext-ie9 .x-fieldset legend.x-fieldset-header {\n    padding-top: 1px;\n}\n\n.ext-ie .x-fieldset {\n    padding-top: 0;\n    padding-bottom:10px;\n}\n\n.x-fieldset legend .x-tool-toggle {\n    margin-right:3px;\n    margin-left:0;\n    float:left !important;\n}\n\n.x-fieldset legend input {\n    margin-right:3px;\n    float:left !important;\n    height:13px;\n    width:13px;\n}\n\nfieldset.x-panel-collapsed {\n    padding-bottom:0 !important;\n    border-width: 1px 1px 0 1px !important;\n    border-left-color: transparent;\n    border-right-color: transparent;\n}\n\n.ext-ie6 fieldset.x-panel-collapsed{\n    padding-bottom:0 !important;\n    border-width: 1px 0 0 0 !important;\n    margin-left: 1px;\n    margin-right: 1px;\n}\n\nfieldset.x-panel-collapsed .x-fieldset-bwrap {\n    visibility:hidden;\n    position:absolute;\n    left:-1000px;\n    top:-1000px;\n}\n\n.ext-ie .x-fieldset-bwrap {\n    zoom:1;\n}\n\n.x-fieldset-noborder {\n    border:0px none transparent;\n}\n\n.x-fieldset-noborder legend {\n    margin-left:-3px;\n}\n\n/* IE legend positioning bug */\n.ext-ie .x-fieldset-noborder legend {\n    position: relative;\n    margin-bottom:23px;\n}\n.ext-ie .x-fieldset-noborder legend span {\n    position: absolute;\n    left:16px;\n}\n\n.ext-gecko .x-window-body .x-form-item {\n    -moz-outline: none;\n    outline: none;\n    overflow: auto;\n}\n\n.ext-mac.ext-gecko .x-window-body .x-form-item {\n    overflow:hidden;\n}\n\n.ext-gecko .x-form-item {\n    -moz-outline: none;\n    outline: none;\n}\n\n.x-hide-label label.x-form-item-label {\n     display:none;\n}\n\n.x-hide-label .x-form-element {\n     padding-left: 0 !important;\n}\n\n.x-form-label-top .x-hide-label label.x-form-item-label{\n    display: none;\n}\n\n.x-fieldset {\n    overflow:hidden;\n}\n\n.x-fieldset-bwrap {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-fieldset-body {\n    overflow:hidden;\n}\n.x-btn{\n\tcursor:pointer;\n\twhite-space: nowrap;\n}\n\n.x-btn button{\n    border:0 none;\n    background-color:transparent;\n    padding-left:3px;\n    padding-right:3px;\n    cursor:pointer;\n    margin:0;\n    overflow:visible;\n    width:auto;\n    -moz-outline:0 none;\n    outline:0 none;\n}\n\n* html .ext-ie .x-btn button {\n    width:1px;\n}\n\n.ext-gecko .x-btn button, .ext-webkit .x-btn button {\n    padding-left:0;\n    padding-right:0;\n}\n\n.ext-gecko .x-btn button::-moz-focus-inner {\n    padding:0;\n}\n\n.ext-ie .x-btn button {\n    padding-top:2px;\n}\n\n.x-btn td {\n    padding:0 !important;\n}\n\n.x-btn-text {\n    cursor:pointer;\n\twhite-space: nowrap;\n    padding:0;\n}\n\n/* icon placement and sizing styles */\n\n/* Only text */\n.x-btn-noicon .x-btn-small .x-btn-text{\n\theight: 16px;\n}\n\n.x-btn-noicon .x-btn-medium .x-btn-text{\n    height: 24px;\n}\n\n.x-btn-noicon .x-btn-large .x-btn-text{\n    height: 32px;\n}\n\n/* Only icons */\n.x-btn-icon .x-btn-text{\n    background-position: center;\n\tbackground-repeat: no-repeat;\n}\n\n.x-btn-icon .x-btn-small .x-btn-text{\n\theight: 16px;\n\twidth: 16px;\n}\n\n.x-btn-icon .x-btn-medium .x-btn-text{\n    height: 24px;\n\twidth: 24px;\n}\n\n.x-btn-icon .x-btn-large .x-btn-text{\n    height: 32px;\n\twidth: 32px;\n}\n\n/* Icons and text */\n/* left */\n.x-btn-text-icon .x-btn-icon-small-left .x-btn-text{\n    background-position: 0 center;\n\tbackground-repeat: no-repeat;\n    padding-left:18px;\n    height:16px;\n}\n\n.x-btn-text-icon .x-btn-icon-medium-left .x-btn-text{\n    background-position: 0 center;\n\tbackground-repeat: no-repeat;\n    padding-left:26px;\n    height:24px;\n}\n\n.x-btn-text-icon .x-btn-icon-large-left .x-btn-text{\n    background-position: 0 center;\n\tbackground-repeat: no-repeat;\n    padding-left:34px;\n    height:32px;\n}\n\n/* top */\n.x-btn-text-icon .x-btn-icon-small-top .x-btn-text{\n    background-position: center 0;\n\tbackground-repeat: no-repeat;\n    padding-top:18px;\n}\n\n.x-btn-text-icon .x-btn-icon-medium-top .x-btn-text{\n    background-position: center 0;\n\tbackground-repeat: no-repeat;\n    padding-top:26px;\n}\n\n.x-btn-text-icon .x-btn-icon-large-top .x-btn-text{\n    background-position: center 0;\n\tbackground-repeat: no-repeat;\n    padding-top:34px;\n}\n\n/* right */\n.x-btn-text-icon .x-btn-icon-small-right .x-btn-text{\n    background-position: right center;\n\tbackground-repeat: no-repeat;\n    padding-right:18px;\n    height:16px;\n}\n\n.x-btn-text-icon .x-btn-icon-medium-right .x-btn-text{\n    background-position: right center;\n\tbackground-repeat: no-repeat;\n    padding-right:26px;\n    height:24px;\n}\n\n.x-btn-text-icon .x-btn-icon-large-right .x-btn-text{\n    background-position: right center;\n\tbackground-repeat: no-repeat;\n    padding-right:34px;\n    height:32px;\n}\n\n/* bottom */\n.x-btn-text-icon .x-btn-icon-small-bottom .x-btn-text{\n    background-position: center bottom;\n\tbackground-repeat: no-repeat;\n    padding-bottom:18px;\n}\n\n.x-btn-text-icon .x-btn-icon-medium-bottom .x-btn-text{\n    background-position: center bottom;\n\tbackground-repeat: no-repeat;\n    padding-bottom:26px;\n}\n\n.x-btn-text-icon .x-btn-icon-large-bottom .x-btn-text{\n    background-position: center bottom;\n\tbackground-repeat: no-repeat;\n    padding-bottom:34px;\n}\n\n/* background positioning */\n.x-btn-tr i, .x-btn-tl i, .x-btn-mr i, .x-btn-ml i, .x-btn-br i, .x-btn-bl i{\n\tfont-size:1px;\n    line-height:1px;\n    width:3px;\n    display:block;\n    overflow:hidden;\n}\n\n.x-btn-tr i, .x-btn-tl i, .x-btn-br i, .x-btn-bl i{\n\theight:3px;\n}\n\n.x-btn-tl{\n\twidth:3px;\n\theight:3px;\n\tbackground:no-repeat 0 0;\n}\n.x-btn-tr{\n\twidth:3px;\n\theight:3px;\n\tbackground:no-repeat -3px 0;\n}\n.x-btn-tc{\n\theight:3px;\n\tbackground:repeat-x 0 -6px;\n}\n\n.x-btn-ml{\n\twidth:3px;\n\tbackground:no-repeat 0 -24px;\n}\n.x-btn-mr{\n\twidth:3px;\n\tbackground:no-repeat -3px -24px;\n}\n\n.x-btn-mc{\n\tbackground:repeat-x 0 -1096px;\n    vertical-align: middle;\n\ttext-align:center;\n\tpadding:0 5px;\n\tcursor:pointer;\n\twhite-space:nowrap;\n}\n\n/* Fixes an issue with the button height */\n.ext-strict .ext-ie6 .x-btn-mc, .ext-strict .ext-ie7 .x-btn-mc {\n    height: 100%;\n}\n\n.x-btn-bl{\n\twidth:3px;\n\theight:3px;\n\tbackground:no-repeat 0 -3px;\n}\n\n.x-btn-br{\n\twidth:3px;\n\theight:3px;\n\tbackground:no-repeat -3px -3px;\n}\n\n.x-btn-bc{\n\theight:3px;\n\tbackground:repeat-x 0 -15px;\n}\n\n.x-btn-over .x-btn-tl{\n\tbackground-position: -6px 0;\n}\n\n.x-btn-over .x-btn-tr{\n\tbackground-position: -9px 0;\n}\n\n.x-btn-over .x-btn-tc{\n\tbackground-position: 0 -9px;\n}\n\n.x-btn-over .x-btn-ml{\n\tbackground-position: -6px -24px;\n}\n\n.x-btn-over .x-btn-mr{\n\tbackground-position: -9px -24px;\n}\n\n.x-btn-over .x-btn-mc{\n\tbackground-position: 0 -2168px;\n}\n\n.x-btn-over .x-btn-bl{\n\tbackground-position: -6px -3px;\n}\n\n.x-btn-over .x-btn-br{\n\tbackground-position: -9px -3px;\n}\n\n.x-btn-over .x-btn-bc{\n\tbackground-position: 0 -18px;\n}\n\n.x-btn-click .x-btn-tl, .x-btn-menu-active .x-btn-tl, .x-btn-pressed .x-btn-tl{\n\tbackground-position: -12px 0;\n}\n\n.x-btn-click .x-btn-tr, .x-btn-menu-active .x-btn-tr, .x-btn-pressed .x-btn-tr{\n\tbackground-position: -15px 0;\n}\n\n.x-btn-click .x-btn-tc, .x-btn-menu-active .x-btn-tc, .x-btn-pressed .x-btn-tc{\n\tbackground-position: 0 -12px;\n}\n\n.x-btn-click .x-btn-ml, .x-btn-menu-active .x-btn-ml, .x-btn-pressed .x-btn-ml{\n\tbackground-position: -12px -24px;\n}\n\n.x-btn-click .x-btn-mr, .x-btn-menu-active .x-btn-mr, .x-btn-pressed .x-btn-mr{\n\tbackground-position: -15px -24px;\n}\n\n.x-btn-click .x-btn-mc, .x-btn-menu-active .x-btn-mc, .x-btn-pressed .x-btn-mc{\n\tbackground-position: 0 -3240px;\n}\n\n.x-btn-click .x-btn-bl, .x-btn-menu-active .x-btn-bl, .x-btn-pressed .x-btn-bl{\n\tbackground-position: -12px -3px;\n}\n\n.x-btn-click .x-btn-br, .x-btn-menu-active .x-btn-br, .x-btn-pressed .x-btn-br{\n\tbackground-position: -15px -3px;\n}\n\n.x-btn-click .x-btn-bc, .x-btn-menu-active .x-btn-bc, .x-btn-pressed .x-btn-bc{\n\tbackground-position: 0 -21px;\n}\n\n.x-btn-disabled *{\n\tcursor:default !important;\n}\n\n\n/* With a menu arrow */\n/* right */\n.x-btn-mc em.x-btn-arrow {\n    display:block;\n    background:transparent no-repeat right center;\n\tpadding-right:10px;\n}\n\n.x-btn-mc em.x-btn-split {\n    display:block;\n    background:transparent no-repeat right center;\n\tpadding-right:14px;\n}\n\n/* bottom */\n.x-btn-mc em.x-btn-arrow-bottom {\n    display:block;\n    background:transparent no-repeat center bottom;\n\tpadding-bottom:14px;\n}\n\n.x-btn-mc em.x-btn-split-bottom {\n    display:block;\n    background:transparent no-repeat center bottom;\n\tpadding-bottom:14px;\n}\n\n/* height adjustment class */\n.x-btn-as-arrow .x-btn-mc em {\n    display:block;\n    background-color:transparent;\n\tpadding-bottom:14px;\n}\n\n/* groups */\n.x-btn-group {\n    padding:1px;\n}\n\n.x-btn-group-header {\n    padding:2px;\n    text-align:center;\n}\n\n.x-btn-group-tc {\n\tbackground: transparent repeat-x 0 0;\n\toverflow:hidden;\n}\n\n.x-btn-group-tl {\n\tbackground: transparent no-repeat 0 0;\n\tpadding-left:3px;\n    zoom:1;\n}\n\n.x-btn-group-tr {\n\tbackground: transparent no-repeat right 0;\n\tzoom:1;\n    padding-right:3px;\n}\n\n.x-btn-group-bc {\n\tbackground: transparent repeat-x 0 bottom;\n    zoom:1;\n}\n\n.x-btn-group-bc .x-panel-footer {\n    zoom:1;\n}\n\n.x-btn-group-bl {\n\tbackground: transparent no-repeat 0 bottom;\n\tpadding-left:3px;\n    zoom:1;\n}\n\n.x-btn-group-br {\n\tbackground: transparent no-repeat right bottom;\n\tpadding-right:3px;\n    zoom:1;\n}\n\n.x-btn-group-mc {\n    border:0 none;\n    padding:1px 0 0 0;\n    margin:0;\n}\n\n.x-btn-group-mc .x-btn-group-body {\n    background-color:transparent;\n    border: 0 none;\n}\n\n.x-btn-group-ml {\n\tbackground: transparent repeat-y 0 0;\n\tpadding-left:3px;\n    zoom:1;\n}\n\n.x-btn-group-mr {\n\tbackground: transparent repeat-y right 0;\n\tpadding-right:3px;\n    zoom:1;\n}\n\n.x-btn-group-bc .x-btn-group-footer {\n    padding-bottom:6px;\n}\n\n.x-panel-nofooter .x-btn-group-bc {\n\theight:3px;\n    font-size:0;\n    line-height:0;\n}\n\n.x-btn-group-bwrap {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-btn-group-body {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-btn-group-notitle .x-btn-group-tc {\n\tbackground: transparent repeat-x 0 0;\n\toverflow:hidden;\n    height:2px;\n}.x-toolbar{\n    border-style:solid;\n    border-width:0 0 1px 0;\n    display: block;\n\tpadding:2px;\n    background:repeat-x top left;\n    position:relative;\n    left:0;\n    top:0;\n    zoom:1;\n    overflow:hidden;\n}\n\n.x-toolbar-left {\n    width: 100%;\n}\n\n.x-toolbar .x-item-disabled .x-btn-icon {\n    opacity: .35;\n    -moz-opacity: .35;\n    filter: alpha(opacity=35);\n}\n\n.x-toolbar td {\n\tvertical-align:middle;\n}\n\n.x-toolbar td,.x-toolbar span,.x-toolbar input,.x-toolbar div,.x-toolbar select,.x-toolbar label{\n\twhite-space: nowrap;\n}\n\n.x-toolbar .x-item-disabled {\n\tcursor:default;\n\topacity:.6;\n\t-moz-opacity:.6;\n\tfilter:alpha(opacity=60);\n}\n\n.x-toolbar .x-item-disabled * {\n\tcursor:default;\n}\n\n.x-toolbar .x-toolbar-cell {\n    vertical-align:middle;\n}\n\n.x-toolbar .x-btn-tl, .x-toolbar .x-btn-tr, .x-toolbar .x-btn-tc, .x-toolbar .x-btn-ml, .x-toolbar .x-btn-mr,\n.x-toolbar .x-btn-mc, .x-toolbar .x-btn-bl, .x-toolbar .x-btn-br, .x-toolbar .x-btn-bc\n{\n\tbackground-position: 500px 500px;\n}\n\n/* These rules are duplicated from button.css to give priority of x-toolbar rules above */\n.x-toolbar .x-btn-over .x-btn-tl{\n\tbackground-position: -6px 0;\n}\n\n.x-toolbar .x-btn-over .x-btn-tr{\n\tbackground-position: -9px 0;\n}\n\n.x-toolbar .x-btn-over .x-btn-tc{\n\tbackground-position: 0 -9px;\n}\n\n.x-toolbar .x-btn-over .x-btn-ml{\n\tbackground-position: -6px -24px;\n}\n\n.x-toolbar .x-btn-over .x-btn-mr{\n\tbackground-position: -9px -24px;\n}\n\n.x-toolbar .x-btn-over .x-btn-mc{\n\tbackground-position: 0 -2168px;\n}\n\n.x-toolbar .x-btn-over .x-btn-bl{\n\tbackground-position: -6px -3px;\n}\n\n.x-toolbar .x-btn-over .x-btn-br{\n\tbackground-position: -9px -3px;\n}\n\n.x-toolbar .x-btn-over .x-btn-bc{\n\tbackground-position: 0 -18px;\n}\n\n.x-toolbar .x-btn-click .x-btn-tl, .x-toolbar .x-btn-menu-active .x-btn-tl, .x-toolbar .x-btn-pressed .x-btn-tl{\n\tbackground-position: -12px 0;\n}\n\n.x-toolbar .x-btn-click .x-btn-tr, .x-toolbar .x-btn-menu-active .x-btn-tr, .x-toolbar .x-btn-pressed .x-btn-tr{\n\tbackground-position: -15px 0;\n}\n\n.x-toolbar .x-btn-click .x-btn-tc, .x-toolbar .x-btn-menu-active .x-btn-tc, .x-toolbar .x-btn-pressed .x-btn-tc{\n\tbackground-position: 0 -12px;\n}\n\n.x-toolbar .x-btn-click .x-btn-ml, .x-toolbar .x-btn-menu-active .x-btn-ml, .x-toolbar .x-btn-pressed .x-btn-ml{\n\tbackground-position: -12px -24px;\n}\n\n.x-toolbar .x-btn-click .x-btn-mr, .x-toolbar .x-btn-menu-active .x-btn-mr, .x-toolbar .x-btn-pressed .x-btn-mr{\n\tbackground-position: -15px -24px;\n}\n\n.x-toolbar .x-btn-click .x-btn-mc, .x-toolbar .x-btn-menu-active .x-btn-mc, .x-toolbar .x-btn-pressed .x-btn-mc{\n\tbackground-position: 0 -3240px;\n}\n\n.x-toolbar .x-btn-click .x-btn-bl, .x-toolbar .x-btn-menu-active .x-btn-bl, .x-toolbar .x-btn-pressed .x-btn-bl{\n\tbackground-position: -12px -3px;\n}\n\n.x-toolbar .x-btn-click .x-btn-br, .x-toolbar .x-btn-menu-active .x-btn-br, .x-toolbar .x-btn-pressed .x-btn-br{\n\tbackground-position: -15px -3px;\n}\n\n.x-toolbar .x-btn-click .x-btn-bc, .x-toolbar .x-btn-menu-active .x-btn-bc, .x-toolbar .x-btn-pressed .x-btn-bc{\n\tbackground-position: 0 -21px;\n}\n\n.x-toolbar div.xtb-text{\n    padding:2px 2px 0;\n    line-height:16px;\n    display:block;\n}\n\n.x-toolbar .xtb-sep {\n\tbackground-position: center;\n\tbackground-repeat: no-repeat;\n\tdisplay: block;\n\tfont-size: 1px;\n\theight: 16px;\n\twidth:4px;\n\toverflow: hidden;\n\tcursor:default;\n\tmargin: 0 2px 0;\n\tborder:0;\n}\n\n.x-toolbar .xtb-spacer {\n    width:2px;\n}\n\n/* Paging Toolbar */\n.x-tbar-page-number{\n\twidth:30px;\n\theight:14px;\n}\n\n.ext-ie .x-tbar-page-number{\n    margin-top: 2px;\n}\n\n.x-paging-info {\n    position:absolute;\n    top:5px;\n    right: 8px;\n}\n\n/* floating */\n.x-toolbar-ct {\n    width:100%;\n}\n\n.x-toolbar-right td {\n    text-align: center;\n}\n\n.x-panel-tbar, .x-panel-bbar, .x-window-tbar, .x-window-bbar, .x-tab-panel-tbar, .x-tab-panel-bbar, .x-plain-tbar, .x-plain-bbar {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-toolbar-more .x-btn-small .x-btn-text{\n\theight: 16px;\n\twidth: 12px;\n}\n\n.x-toolbar-more em.x-btn-arrow {\n    display:inline;\n    background-color:transparent;\n\tpadding-right:0;\n}\n\n.x-toolbar-more .x-btn-mc em.x-btn-arrow {\n    background-image: none;\n}\n\ndiv.x-toolbar-no-items {\n    color:gray !important;\n    padding:5px 10px !important;\n}\n\n/* fix ie toolbar form items */\n.ext-border-box .x-toolbar-cell .x-form-text {\n    margin-bottom:-1px !important;\n}\n\n.ext-border-box .x-toolbar-cell .x-form-field-wrap .x-form-text {\n    margin:0 !important;\n}\n\n.ext-ie .x-toolbar-cell .x-form-field-wrap {\n    height:21px;\n}\n\n.ext-ie .x-toolbar-cell .x-form-text {\n    position:relative;\n    top:-1px;\n}\n\n.ext-strict .ext-ie8 .x-toolbar-cell .x-form-field-trigger-wrap .x-form-text, .ext-strict .ext-ie .x-toolbar-cell .x-form-text {\n    top: 0px;\n}\n\n.x-toolbar-right td .x-form-field-trigger-wrap{\n    text-align: left;\n}\n\n.x-toolbar-cell .x-form-checkbox, .x-toolbar-cell .x-form-radio{\n    margin-top: 5px;\n}\n\n.x-toolbar-cell .x-form-cb-label{\n    vertical-align: bottom;\n    top: 1px;\n}\n\n.ext-ie .x-toolbar-cell .x-form-checkbox, .ext-ie .x-toolbar-cell .x-form-radio{\n    margin-top: 4px;\n}\n\n.ext-ie .x-toolbar-cell .x-form-cb-label{\n    top: 0;\n}\n/* Grid3 styles */\n.x-grid3 {\n\tposition:relative;\n\toverflow:hidden;\n}\n\n.x-grid-panel .x-panel-body {\n    overflow:hidden !important;\n}\n\n.x-grid-panel .x-panel-mc .x-panel-body {\n    border:1px solid;\n}\n\n.x-grid3 table {\n    table-layout:fixed;\n}\n\n.x-grid3-viewport{\n\toverflow:hidden;\n}\n\n.x-grid3-hd-row td, .x-grid3-row td, .x-grid3-summary-row td{\n    -moz-outline: none;\n    outline: none;\n\t-moz-user-focus: normal;\n}\n\n.x-grid3-row td, .x-grid3-summary-row td {\n    line-height:13px;\n    vertical-align: top;\n\tpadding-left:1px;\n    padding-right:1px;\n    -moz-user-select: none;\n    -khtml-user-select:none;\n    -webkit-user-select:ignore;\n}\n\n.x-grid3-cell{\n    -moz-user-select: none;\n    -khtml-user-select:none;\n    -webkit-user-select:ignore;\n}\n\n.x-grid3-hd-row td {\n    line-height:15px;\n    vertical-align:middle;\n    border-left:1px solid;\n    border-right:1px solid;\n}\n\n.x-grid3-hd-row .x-grid3-marker-hd {\n    padding:3px;\n}\n\n.x-grid3-row .x-grid3-marker {\n    padding:3px;\n}\n\n.x-grid3-cell-inner, .x-grid3-hd-inner{\n\toverflow:hidden;\n\t-o-text-overflow: ellipsis;\n\ttext-overflow: ellipsis;\n    padding:3px 3px 3px 5px;\n    white-space: nowrap;\n}\n\n/* ActionColumn, reduce padding to accommodate 16x16 icons in normal row height */\n.x-action-col-cell .x-grid3-cell-inner {\n    padding-top: 1px;\n    padding-bottom: 1px;\n}\n\n.x-action-col-icon {\n    cursor: pointer;\n}\n\n.x-grid3-hd-inner {\n    position:relative;\n\tcursor:inherit;\n\tpadding:4px 3px 4px 5px;\n}\n\n.x-grid3-row-body {\n    white-space:normal;\n}\n\n.x-grid3-body-cell {\n    -moz-outline:0 none;\n    outline:0 none;\n}\n\n/* IE Quirks to clip */\n.ext-ie .x-grid3-cell-inner, .ext-ie .x-grid3-hd-inner{\n\twidth:100%;\n}\n\n/* reverse above in strict mode */\n.ext-strict .x-grid3-cell-inner, .ext-strict .x-grid3-hd-inner{\n\twidth:auto;\n}\n\n.x-grid-row-loading {\n    background: no-repeat center center;\n}\n\n.x-grid-page {\n    overflow:hidden;\n}\n\n.x-grid3-row {\n\tcursor: default;\n    border: 1px solid;\n    width:100%;\n}\n\n.x-grid3-row-over {\n\tborder:1px solid;\n    background: repeat-x left top;\n}\n\n.x-grid3-resize-proxy {\n\twidth:1px;\n    left:0;\n\tcursor: e-resize;\n\tcursor: col-resize;\n\tposition:absolute;\n\ttop:0;\n\theight:100px;\n\toverflow:hidden;\n\tvisibility:hidden;\n\tborder:0 none;\n\tz-index:7;\n}\n\n.x-grid3-resize-marker {\n\twidth:1px;\n\tleft:0;\n\tposition:absolute;\n\ttop:0;\n\theight:100px;\n\toverflow:hidden;\n\tvisibility:hidden;\n\tborder:0 none;\n\tz-index:7;\n}\n\n.x-grid3-focus {\n\tposition:absolute;\n\tleft:0;\n\ttop:0;\n\twidth:1px;\n\theight:1px;\n    line-height:1px;\n    font-size:1px;\n    -moz-outline:0 none;\n    outline:0 none;\n    -moz-user-select: text;\n    -khtml-user-select: text;\n    -webkit-user-select:ignore;\n}\n\n/* header styles */\n.x-grid3-header{\n\tbackground: repeat-x 0 bottom;\n\tcursor:default;\n    zoom:1;\n    padding:1px 0 0 0;\n}\n\n.x-grid3-header-pop {\n    border-left:1px solid;\n    float:right;\n    clear:none;\n}\n\n.x-grid3-header-pop-inner {\n    border-left:1px solid;\n    width:14px;\n    height:19px;\n    background: transparent no-repeat center center;\n}\n\n.ext-ie .x-grid3-header-pop-inner {\n    width:15px;\n}\n\n.ext-strict .x-grid3-header-pop-inner {\n    width:14px; \n}\n\n.x-grid3-header-inner {\n    overflow:hidden;\n    zoom:1;\n    float:left;\n}\n\n.x-grid3-header-offset {\n    padding-left:1px;\n    text-align: left;\n}\n\ntd.x-grid3-hd-over, td.sort-desc, td.sort-asc, td.x-grid3-hd-menu-open {\n    border-left:1px solid;\n    border-right:1px solid;\n}\n\ntd.x-grid3-hd-over .x-grid3-hd-inner, td.sort-desc .x-grid3-hd-inner, td.sort-asc .x-grid3-hd-inner, td.x-grid3-hd-menu-open .x-grid3-hd-inner {\n    background: repeat-x left bottom;\n\n}\n\n.x-grid3-sort-icon{\n\tbackground-repeat: no-repeat;\n\tdisplay: none;\n\theight: 4px;\n\twidth: 13px;\n\tmargin-left:3px;\n\tvertical-align: middle;\n}\n\n.sort-asc .x-grid3-sort-icon, .sort-desc .x-grid3-sort-icon {\n\tdisplay: inline;\n}\n\n/* Header position fixes for IE strict mode */\n.ext-strict .ext-ie .x-grid3-header-inner, .ext-strict .ext-ie6 .x-grid3-hd {\n    position:relative;\n}\n\n.ext-strict .ext-ie6 .x-grid3-hd-inner{\n    position:static;\n}\n\n/* Body Styles */\n.x-grid3-body {\n\tzoom:1;\n}\n\n.x-grid3-scroller {\n\toverflow:auto;\n    zoom:1;\n    position:relative;\n}\n\n.x-grid3-cell-text, .x-grid3-hd-text {\n\tdisplay: block;\n\tpadding: 3px 5px 3px 5px;\n\t-moz-user-select: none;\n\t-khtml-user-select: none;\n    -webkit-user-select:ignore;\n}\n\n.x-grid3-split {\n\tbackground-position: center;\n\tbackground-repeat: no-repeat;\n\tcursor: e-resize;\n\tcursor: col-resize;\n\tdisplay: block;\n\tfont-size: 1px;\n\theight: 16px;\n\toverflow: hidden;\n\tposition: absolute;\n\ttop: 2px;\n\twidth: 6px;\n\tz-index: 3;\n}\n\n/* Column Reorder DD */\n.x-dd-drag-proxy .x-grid3-hd-inner{\n\tbackground: repeat-x left bottom;\n\twidth:120px;\n\tpadding:3px;\n\tborder:1px solid;\n\toverflow:hidden;\n}\n\n.col-move-top, .col-move-bottom{\n\twidth:9px;\n\theight:9px;\n\tposition:absolute;\n\ttop:0;\n\tline-height:1px;\n\tfont-size:1px;\n\toverflow:hidden;\n\tvisibility:hidden;\n\tz-index:20000;\n    background:transparent no-repeat left top;\n}\n\n/* Selection Styles */\n.x-grid3-row-selected {\n\tborder:1px dotted;\n}\n\n.x-grid3-locked td.x-grid3-row-marker, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker{\n    background: repeat-x 0 bottom !important;\n    vertical-align:middle !important;\n    padding:0;\n    border-top:1px solid;\n    border-bottom:none !important;\n    border-right:1px solid !important;\n    text-align:center;\n}\n\n.x-grid3-locked td.x-grid3-row-marker div, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker div{\n    padding:0 4px;\n    text-align:center;\n}\n\n/* dirty cells */\n.x-grid3-dirty-cell {\n    background: transparent no-repeat 0 0;\n}\n\n/* Grid Toolbars */\n.x-grid3-topbar, .x-grid3-bottombar{\n    overflow:hidden;\n\tdisplay:none;\n\tzoom:1;\n    position:relative;\n}\n\n.x-grid3-topbar .x-toolbar{\n\tborder-right:0 none;\n}\n\n.x-grid3-bottombar .x-toolbar{\n\tborder-right:0 none;\n\tborder-bottom:0 none;\n\tborder-top:1px solid;\n}\n\n/* Props Grid Styles */\n.x-props-grid .x-grid3-cell{\n\tpadding:1px;\n}\n\n.x-props-grid .x-grid3-td-name .x-grid3-cell-inner{\n\tbackground:transparent repeat-y -16px !important;\n    padding-left:12px;\n}\n\n.x-props-grid .x-grid3-body .x-grid3-td-name{\n    padding:1px;\n    padding-right:0;\n    border:0 none;\n    border-right:1px solid;\n}\n\n/* dd */\n.x-grid3-col-dd {\n    border:0 none;\n    padding:0;\n    background-color:transparent;\n}\n\n.x-dd-drag-ghost .x-grid3-dd-wrap {\n    padding:1px 3px 3px 1px;\n}\n\n.x-grid3-hd {\n    -moz-user-select:none;\n    -khtml-user-select:none;\n    -webkit-user-select:ignore;\n}\n\n.x-grid3-hd-btn {\n    display:none;\n    position:absolute;\n    width:14px;\n    background:no-repeat left center;\n    right:0;\n    top:0;\n    z-index:2;\n\tcursor:pointer;\n}\n\n.x-grid3-hd-over .x-grid3-hd-btn, .x-grid3-hd-menu-open .x-grid3-hd-btn {\n    display:block;\n}\n\na.x-grid3-hd-btn:hover {\n    background-position:-14px center;\n}\n\n/* Expanders */\n.x-grid3-body .x-grid3-td-expander {\n    background:transparent repeat-y right;\n}\n\n.x-grid3-body .x-grid3-td-expander .x-grid3-cell-inner {\n    padding:0 !important;\n    height:100%;\n}\n\n.x-grid3-row-expander {\n    width:100%;\n    height:18px;\n    background-position:4px 2px;\n    background-repeat:no-repeat;\n    background-color:transparent;\n}\n\n.x-grid3-row-collapsed .x-grid3-row-expander {\n    background-position:4px 2px;\n}\n\n.x-grid3-row-expanded .x-grid3-row-expander {\n    background-position:-21px 2px;\n}\n\n.x-grid3-row-collapsed .x-grid3-row-body {\n    display:none !important;\n}\n\n.x-grid3-row-expanded .x-grid3-row-body {\n    display:block !important;\n}\n\n/* Checkers */\n.x-grid3-body .x-grid3-td-checker {\n    background:transparent repeat-y right;\n}\n\n.x-grid3-body .x-grid3-td-checker .x-grid3-cell-inner, .x-grid3-header .x-grid3-td-checker .x-grid3-hd-inner {\n    padding:0 !important;\n    height:100%;\n}\n\n.x-grid3-row-checker, .x-grid3-hd-checker {\n    width:100%;\n    height:18px;\n    background-position:2px 2px;\n    background-repeat:no-repeat;\n    background-color:transparent;\n}\n\n.x-grid3-row .x-grid3-row-checker {\n    background-position:2px 2px;\n}\n\n.x-grid3-row-selected .x-grid3-row-checker, .x-grid3-hd-checker-on .x-grid3-hd-checker,.x-grid3-row-checked .x-grid3-row-checker {\n    background-position:-23px 2px;\n}\n\n.x-grid3-hd-checker {\n    background-position:2px 1px;\n}\n\n.ext-border-box .x-grid3-hd-checker {\n    background-position:2px 3px;\n}\n\n.x-grid3-hd-checker-on .x-grid3-hd-checker {\n    background-position:-23px 1px;\n}\n\n.ext-border-box .x-grid3-hd-checker-on .x-grid3-hd-checker {\n    background-position:-23px 3px;\n}\n\n/* Numberer */\n.x-grid3-body .x-grid3-td-numberer {\n    background:transparent repeat-y right;\n}\n\n.x-grid3-body .x-grid3-td-numberer .x-grid3-cell-inner {\n    padding:3px 5px 0 0 !important;\n    text-align:right;\n}\n\n/* Row Icon */\n\n.x-grid3-body .x-grid3-td-row-icon {\n    background:transparent repeat-y right;\n    vertical-align:top;\n    text-align:center;\n}\n\n.x-grid3-body .x-grid3-td-row-icon .x-grid3-cell-inner {\n    padding:0 !important;\n    background-position:center center;\n    background-repeat:no-repeat;\n    width:16px;\n    height:16px;\n    margin-left:2px;\n    margin-top:3px;\n}\n\n/* All specials */\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-numberer,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-checker,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-expander {\n\tbackground:transparent repeat-y right;\n}\n\n.x-grid3-body .x-grid3-check-col-td .x-grid3-cell-inner {\n    padding: 1px 0 0 0 !important;\n}\n\n.x-grid3-check-col {\n    width:100%;\n    height:16px;\n    background-position:center center;\n    background-repeat:no-repeat;\n    background-color:transparent;\n}\n\n.x-grid3-check-col-on {\n    width:100%;\n    height:16px;\n    background-position:center center;\n    background-repeat:no-repeat;\n    background-color:transparent;\n}\n\n/* Grouping classes */\n.x-grid-group, .x-grid-group-body, .x-grid-group-hd {\n    zoom:1;\n}\n\n.x-grid-group-hd {\n    border-bottom: 2px solid;\n    cursor:pointer;\n    padding-top:6px;\n}\n\n.x-grid-group-hd div.x-grid-group-title {\n    background:transparent no-repeat 3px 3px;\n    padding:4px 4px 4px 17px;\n}\n\n.x-grid-group-collapsed .x-grid-group-body {\n    display:none;\n}\n\n.ext-ie6 .x-grid3 .x-editor .x-form-text, .ext-ie7 .x-grid3 .x-editor .x-form-text {\n    position:relative;\n    top:-1px;\n}\n\n.x-grid-editor .x-form-check-wrap {\n    text-align: center;\n    margin-top: -4px;\n}\n\n.ext-ie .x-props-grid .x-editor .x-form-text {\n    position:static;\n    top:0;\n}\n\n.x-grid-empty {\n    padding:10px;\n}\n\n/* fix floating toolbar issue */\n.ext-ie7 .x-grid-panel .x-panel-bbar {\n    position:relative;\n}\n\n\n/* Reset position to static when Grid Panel has been framed */\n/* to resolve 'snapping' from top to bottom behavior. */\n/* @forumThread 86656 */\n.ext-ie7 .x-grid-panel .x-panel-mc .x-panel-bbar {\n    position: static;\n}\n\n.ext-ie6 .x-grid3-header {\n    position: relative;\n}\n\n/* Fix WebKit bug in Grids */\n.ext-webkit .x-grid-panel .x-panel-bwrap{\n    -webkit-user-select:none;\n}\n.ext-webkit .x-tbar-page-number{\n    -webkit-user-select:ignore;\n}\n/* end*/\n\n/* column lines */\n.x-grid-with-col-lines .x-grid3-row td.x-grid3-cell {\n    padding-right:0;\n    border-right:1px solid;\n}\n.x-pivotgrid .x-grid3-header-offset table {\n    width: 100%;\n    border-collapse: collapse;\n}\n\n.x-pivotgrid .x-grid3-header-offset table td {\n    padding: 4px 3px 4px 5px;\n    text-align: center;\n    white-space: nowrap;\n    overflow: hidden;\n    text-overflow: ellipsis;\n    font-size: 11px;\n    line-height: 13px;\n    font-family: tahoma;\n}\n\n.x-pivotgrid .x-grid3-row-headers {\n    display: block;\n    float: left;\n}\n\n.x-pivotgrid .x-grid3-row-headers table {\n    height: 100%;\n    width: 100%;\n    border-collapse: collapse;\n}\n\n.x-pivotgrid .x-grid3-row-headers table td {\n    height: 18px;\n    padding: 2px 7px 0 0;\n    text-align: right;\n    text-overflow: ellipsis;\n    font-size: 11px;\n    font-family: tahoma;\n}\n\n.ext-gecko .x-pivotgrid .x-grid3-row-headers table td {\n    height: 21px;\n}\n\n.x-grid3-header-title {\n    top: 0%;\n    left: 0%;\n    position: absolute;\n    text-align: center;\n    vertical-align: middle;\n    font-family: tahoma;\n    font-size: 11px;\n    padding: auto 1px;\n    display: table-cell;\n}\n\n.x-grid3-header-title span {\n    position: absolute;\n    top: 50%;\n    left: 0%;\n    width: 100%;\n    margin-top: -6px;\n}.x-dd-drag-proxy{\n\tposition:absolute;\n\tleft:0;\n    top:0;\n\tvisibility:hidden;\n\tz-index:15000;\n}\n\n.x-dd-drag-ghost{\n\t-moz-opacity: 0.85;\n    opacity:.85;\n    filter: alpha(opacity=85);\n    border: 1px solid;\n\tpadding:3px;\n\tpadding-left:20px;\n\twhite-space:nowrap;\n}\n\n.x-dd-drag-repair .x-dd-drag-ghost{\n\t-moz-opacity: 0.4;\n    opacity:.4;\n    filter: alpha(opacity=40);\n\tborder:0 none;\n\tpadding:0;\n\tbackground-color:transparent;\n}\n\n.x-dd-drag-repair .x-dd-drop-icon{\n\tvisibility:hidden;\n}\n\n.x-dd-drop-icon{\n    position:absolute;\n\ttop:3px;\n\tleft:3px;\n\tdisplay:block;\n\twidth:16px;\n\theight:16px;\n\tbackground-color:transparent;\n\tbackground-position: center;\n\tbackground-repeat: no-repeat;\n\tz-index:1;\n}\n\n.x-view-selector {\n    position:absolute;\n    left:0;\n    top:0;\n    width:0;\n    border:1px dotted;\n\topacity: .5;\n    -moz-opacity: .5;\n    filter:alpha(opacity=50);\n    zoom:1;\n}.ext-strict .ext-ie .x-tree .x-panel-bwrap{\n    position:relative;\n    overflow:hidden;\n}\n\n.x-tree-icon, .x-tree-ec-icon, .x-tree-elbow-line, .x-tree-elbow, .x-tree-elbow-end, .x-tree-elbow-plus, .x-tree-elbow-minus, .x-tree-elbow-end-plus, .x-tree-elbow-end-minus{\n\tborder: 0 none;\n\theight: 18px;\n\tmargin: 0;\n\tpadding: 0;\n\tvertical-align: top;\n\twidth: 16px;\n    background-repeat: no-repeat;\n}\n\n.x-tree-node-collapsed .x-tree-node-icon, .x-tree-node-expanded .x-tree-node-icon, .x-tree-node-leaf .x-tree-node-icon{\n\tborder: 0 none;\n\theight: 18px;\n\tmargin: 0;\n\tpadding: 0;\n\tvertical-align: top;\n\twidth: 16px;\n\tbackground-position:center;\n    background-repeat: no-repeat;\n}\n\n.ext-ie .x-tree-node-indent img, .ext-ie .x-tree-node-icon, .ext-ie .x-tree-ec-icon {\n    vertical-align: middle !important;\n}\n\n.ext-strict .ext-ie8 .x-tree-node-indent img, .ext-strict .ext-ie8 .x-tree-node-icon, .ext-strict .ext-ie8 .x-tree-ec-icon {\n    vertical-align: top !important;\n}\n\n/* checkboxes */\n\ninput.x-tree-node-cb {\n    margin-left:1px;\n    height: 19px;\n\tvertical-align: bottom;\n}\n\n.ext-ie input.x-tree-node-cb {\n    margin-left:0;\n    margin-top: 1px;\n    width: 16px;\n    height: 16px;\n    vertical-align: middle;\n}\n\n.ext-strict .ext-ie8 input.x-tree-node-cb{\n    margin: 1px 1px;\n    height: 14px;\n    vertical-align: bottom;\n}\n\n.ext-strict .ext-ie8 input.x-tree-node-cb + a{\n    vertical-align: bottom;\n}\n\n.ext-opera input.x-tree-node-cb {\n    height: 14px;\n    vertical-align: middle;\n}\n\n.x-tree-noicon .x-tree-node-icon{\n\twidth:0; height:0;\n}\n\n/* No line styles */\n.x-tree-no-lines .x-tree-elbow{\n\tbackground-color:transparent;\n}\n\n.x-tree-no-lines .x-tree-elbow-end{\n\tbackground-color:transparent;\n}\n\n.x-tree-no-lines .x-tree-elbow-line{\n\tbackground-color:transparent;\n}\n\n/* Arrows */\n.x-tree-arrows .x-tree-elbow{\n\tbackground-color:transparent;\n}\n\n.x-tree-arrows .x-tree-elbow-plus{\n    background:transparent no-repeat 0 0;\n}\n\n.x-tree-arrows .x-tree-elbow-minus{\n    background:transparent no-repeat -16px 0;\n}\n\n.x-tree-arrows .x-tree-elbow-end{\n\tbackground-color:transparent;\n}\n\n.x-tree-arrows .x-tree-elbow-end-plus{\n    background:transparent no-repeat 0 0;\n}\n\n.x-tree-arrows .x-tree-elbow-end-minus{\n    background:transparent no-repeat -16px 0;\n}\n\n.x-tree-arrows .x-tree-elbow-line{\n\tbackground-color:transparent;\n}\n\n.x-tree-arrows .x-tree-ec-over .x-tree-elbow-plus{\n    background-position:-32px 0;\n}\n\n.x-tree-arrows .x-tree-ec-over .x-tree-elbow-minus{\n    background-position:-48px 0;\n}\n\n.x-tree-arrows .x-tree-ec-over .x-tree-elbow-end-plus{\n    background-position:-32px 0;\n}\n\n.x-tree-arrows .x-tree-ec-over .x-tree-elbow-end-minus{\n    background-position:-48px 0;\n}\n\n.x-tree-elbow-plus, .x-tree-elbow-minus, .x-tree-elbow-end-plus, .x-tree-elbow-end-minus{\n\tcursor:pointer;\n}\n\n.ext-ie ul.x-tree-node-ct{\n    font-size:0;\n    line-height:0;\n    zoom:1;\n}\n\n.x-tree-node{\n\twhite-space: nowrap;\n}\n\n.x-tree-node-el {\n    line-height:18px;\n    cursor:pointer;\n}\n\n.x-tree-node a, .x-dd-drag-ghost a{\n\ttext-decoration:none;\n\t-khtml-user-select:none;\n\t-moz-user-select:none;\n    -webkit-user-select:ignore;\n    -kthml-user-focus:normal;\n    -moz-user-focus:normal;\n    -moz-outline: 0 none;\n    outline:0 none;\n}\n\n.x-tree-node a span, .x-dd-drag-ghost a span{\n\ttext-decoration:none;\n\tpadding:1px 3px 1px 2px;\n}\n\n.x-tree-node .x-tree-node-disabled .x-tree-node-icon{\n\t-moz-opacity: 0.5;\n   opacity:.5;\n   filter: alpha(opacity=50);\n}\n\n.x-tree-node .x-tree-node-inline-icon{\n\tbackground-color:transparent;\n}\n\n.x-tree-node a:hover, .x-dd-drag-ghost a:hover{\n\ttext-decoration:none;\n}\n\n.x-tree-node div.x-tree-drag-insert-below{\n \t border-bottom:1px dotted;\n}\n\n.x-tree-node div.x-tree-drag-insert-above{\n\t border-top:1px dotted;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below{\n \t border-bottom:0 none;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above{\n\t border-top:0 none;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below a{\n \t border-bottom:2px solid;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above a{\n\t border-top:2px solid;\n}\n\n.x-tree-node .x-tree-drag-append a span{\n\t border:1px dotted;\n}\n\n.x-dd-drag-ghost .x-tree-node-indent, .x-dd-drag-ghost .x-tree-ec-icon{\n\tdisplay:none !important;\n}\n\n/* Fix for ie rootVisible:false issue */\n.x-tree-root-ct {\n    zoom:1;\n}\n.x-date-picker {\n    border: 1px solid;\n    border-top:0 none;\n\tposition:relative;\n}\n\n.x-date-picker a {\n    -moz-outline:0 none;\n    outline:0 none;\n}\n\n.x-date-inner, .x-date-inner td, .x-date-inner th{\n    border-collapse:separate;\n}\n\n.x-date-middle,.x-date-left,.x-date-right {\n\tbackground: repeat-x 0 -83px;\n\toverflow:hidden;\n}\n\n.x-date-middle .x-btn-tc,.x-date-middle .x-btn-tl,.x-date-middle .x-btn-tr,\n.x-date-middle .x-btn-mc,.x-date-middle .x-btn-ml,.x-date-middle .x-btn-mr,\n.x-date-middle .x-btn-bc,.x-date-middle .x-btn-bl,.x-date-middle .x-btn-br{\n\tbackground:transparent !important;\n    vertical-align:middle;\n}\n\n.x-date-middle .x-btn-mc em.x-btn-arrow {\n    background:transparent no-repeat right 0;\n}\n\n.x-date-right, .x-date-left {\n    width:18px;\n}\n\n.x-date-right{\n    text-align:right;\n}\n\n.x-date-middle {\n    padding-top:2px;\n    padding-bottom:2px;\n    width:130px; /* FF3 */\n}\n\n.x-date-right a, .x-date-left a{\n    display:block;\n    width:16px;\n\theight:16px;\n\tbackground-position: center;\n\tbackground-repeat: no-repeat;\n\tcursor:pointer;\n    -moz-opacity: 0.6;\n    opacity:.6;\n    filter: alpha(opacity=60);\n}\n\n.x-date-right a:hover, .x-date-left a:hover{\n    -moz-opacity: 1;\n    opacity:1;\n    filter: alpha(opacity=100);\n}\n\n.x-item-disabled .x-date-right a:hover, .x-item-disabled .x-date-left a:hover{\n    -moz-opacity: 0.6;\n    opacity:.6;\n    filter: alpha(opacity=60);\n}\n\n.x-date-right a {\n    margin-right:2px;\n    text-decoration:none !important;\n}\n\n.x-date-left a{\n    margin-left:2px;\n    text-decoration:none !important;\n}\n\ntable.x-date-inner {\n    width: 100%;\n    table-layout:fixed;\n}\n\n.ext-webkit table.x-date-inner{\n    /* Fix for webkit browsers */\n    width: 175px;\n}\n\n\n.x-date-inner th {\n    width:25px;\n}\n\n.x-date-inner th {\n    background: repeat-x left top;\n    text-align:right !important;\n\tborder-bottom: 1px solid;\n\tcursor:default;\n    padding:0;\n    border-collapse:separate;\n}\n\n.x-date-inner th span {\n    display:block;\n    padding:2px;\n    padding-right:7px;\n}\n\n.x-date-inner td {\n    border: 1px solid;\n\ttext-align:right;\n    padding:0;\n}\n\n.x-date-inner a {\n    padding:2px 5px;\n    display:block;\n\ttext-decoration:none;\n    text-align:right;\n    zoom:1;\n}\n\n.x-date-inner .x-date-active{\n\tcursor:pointer;\n\tcolor:black;\n}\n\n.x-date-inner .x-date-selected a{\n\tbackground: repeat-x left top;\n\tborder:1px solid;\n    padding:1px 4px;\n}\n\n.x-date-inner .x-date-today a{\n\tborder: 1px solid;\n    padding:1px 4px;\n}\n\n.x-date-inner .x-date-prevday a,.x-date-inner .x-date-nextday a {\n    text-decoration:none !important;\n}\n\n.x-date-bottom {\n    padding:4px;\n    border-top: 1px solid;\n    background: repeat-x left top;\n}\n\n.x-date-inner a:hover, .x-date-inner .x-date-disabled a:hover{\n    text-decoration:none !important;\n}\n\n.x-item-disabled .x-date-inner a:hover{\n    background: none;\n}\n\n.x-date-inner .x-date-disabled a {\n\tcursor:default;\n}\n\n.x-date-menu .x-menu-item {\n\tpadding:1px 24px 1px 4px;\n\twhite-space: nowrap;\n}\n\n.x-date-menu .x-menu-item .x-menu-item-icon {\n    width:10px;\n    height:10px;\n    margin-right:5px;\n    background-position:center -4px !important;\n}\n\n.x-date-mp {\n\tposition:absolute;\n\tleft:0;\n\ttop:0;\n\tdisplay:none;\n}\n\n.x-date-mp td {\n    padding:2px;\n\tfont:normal 11px arial, helvetica,tahoma,sans-serif;\n}\n\ntd.x-date-mp-month,td.x-date-mp-year,td.x-date-mp-ybtn {\n    border: 0 none;\n\ttext-align:center;\n\tvertical-align: middle;\n\twidth:25%;\n}\n\n.x-date-mp-ok {\n\tmargin-right:3px;\n}\n\n.x-date-mp-btns button {\n\ttext-decoration:none;\n\ttext-align:center;\n\ttext-decoration:none !important;\n\tborder:1px solid;\n\tpadding:1px 3px 1px;\n\tcursor:pointer;\n}\n\n.x-date-mp-btns {\n\tbackground: repeat-x left top;\n}\n\n.x-date-mp-btns td {\n\tborder-top: 1px solid;\n    text-align:center;\n}\n\ntd.x-date-mp-month a,td.x-date-mp-year a {\n\tdisplay:block;\n\tpadding:2px 4px;\n\ttext-decoration:none;\n\ttext-align:center;\n}\n\ntd.x-date-mp-month a:hover,td.x-date-mp-year a:hover {\n\ttext-decoration:none;\n\tcursor:pointer;\n}\n\ntd.x-date-mp-sel a {\n\tpadding:1px 3px;\n\tbackground: repeat-x left top;\n\tborder:1px solid;\n}\n\n.x-date-mp-ybtn a {\n    overflow:hidden;\n    width:15px;\n    height:15px;\n    cursor:pointer;\n    background:transparent no-repeat;\n    display:block;\n    margin:0 auto;\n}\n\n.x-date-mp-ybtn a.x-date-mp-next {\n    background-position:0 -120px;\n}\n\n.x-date-mp-ybtn a.x-date-mp-next:hover {\n    background-position:-15px -120px;\n}\n\n.x-date-mp-ybtn a.x-date-mp-prev {\n    background-position:0 -105px;\n}\n\n.x-date-mp-ybtn a.x-date-mp-prev:hover {\n    background-position:-15px -105px;\n}\n\n.x-date-mp-ybtn {\n   text-align:center;\n}\n\ntd.x-date-mp-sep {\n   border-right:1px solid;\n}.x-tip{\n\tposition: absolute;\n\ttop: 0;\n    left:0;\n    visibility: hidden;\n\tz-index: 20002;\n    border:0 none;\n}\n\n.x-tip .x-tip-close{\n\theight: 15px;\n\tfloat:right;\n\twidth: 15px;\n    margin:0 0 2px 2px;\n    cursor:pointer;\n    display:none;\n}\n\n.x-tip .x-tip-tc {\n\tbackground: transparent no-repeat 0 -62px;\n\tpadding-top:3px;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tip .x-tip-tl {\n\tbackground: transparent no-repeat 0 0;\n\tpadding-left:6px;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tip .x-tip-tr {\n\tbackground: transparent no-repeat right 0;\n\tpadding-right:6px;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tip .x-tip-bc {\n\tbackground: transparent no-repeat 0 -121px;\n\theight:3px;\n    overflow:hidden;\n}\n\n.x-tip .x-tip-bl {\n\tbackground: transparent no-repeat 0 -59px;\n\tpadding-left:6px;\n    zoom:1;\n}\n\n.x-tip .x-tip-br {\n\tbackground: transparent no-repeat right -59px;\n\tpadding-right:6px;\n    zoom:1;\n}\n\n.x-tip .x-tip-mc {\n    border:0 none;\n}\n\n.x-tip .x-tip-ml {\n\tbackground: no-repeat 0 -124px;\n\tpadding-left:6px;\n    zoom:1;\n}\n\n.x-tip .x-tip-mr {\n\tbackground: transparent no-repeat right -124px;\n\tpadding-right:6px;\n    zoom:1;\n}\n\n.ext-ie .x-tip .x-tip-header,.ext-ie .x-tip .x-tip-tc {\n    font-size:0;\n    line-height:0;\n}\n\n.ext-border-box .x-tip .x-tip-header, .ext-border-box .x-tip .x-tip-tc{\n    line-height: 1px;\n}\n\n.x-tip .x-tip-header-text {\n    padding:0;\n    margin:0 0 2px 0;\n}\n\n.x-tip .x-tip-body {\n    margin:0 !important;\n    line-height:14px;\n    padding:0;\n}\n\n.x-tip .x-tip-body .loading-indicator {\n    margin:0;\n}\n\n.x-tip-draggable .x-tip-header,.x-tip-draggable .x-tip-header-text {\n    cursor:move;\n}\n\n.x-form-invalid-tip .x-tip-tc {\n\tbackground: repeat-x 0 -12px;\n    padding-top:6px;\n}\n\n.x-form-invalid-tip .x-tip-bc {\n\tbackground: repeat-x 0 -18px;\n    height:6px;\n}\n\n.x-form-invalid-tip .x-tip-bl {\n\tbackground: no-repeat 0 -6px;\n}\n\n.x-form-invalid-tip .x-tip-br {\n\tbackground: no-repeat right -6px;\n}\n\n.x-form-invalid-tip .x-tip-body {\n    padding:2px;\n}\n\n.x-form-invalid-tip .x-tip-body {\n    padding-left:24px;\n    background:transparent no-repeat 2px 2px;\n}\n\n.x-tip-anchor {\n    position: absolute;\n    width: 9px;\n    height: 10px;\n    overflow:hidden;\n    background: transparent no-repeat 0 0;\n    zoom:1;\n}\n.x-tip-anchor-bottom {\n    background-position: -9px 0;\n}\n.x-tip-anchor-right {\n    background-position: -18px 0;\n    width: 10px;\n}\n.x-tip-anchor-left {\n    background-position: -28px 0;\n    width: 10px;\n}.x-menu {\n\tz-index: 15000;\n\tzoom: 1;\n\tbackground: repeat-y;\n}\n\n.x-menu-floating{\n    border: 1px solid;\n}\n\n.x-menu a {\n    text-decoration: none !important;\n}\n\n.ext-ie .x-menu {\n    zoom:1;\n    overflow:hidden;\n}\n\n.x-menu-list{\n    padding: 2px;\n\tbackground-color:transparent;\n\tborder:0 none;\n    overflow:hidden;\n    overflow-y: hidden;\n}\n\n.ext-strict .ext-ie .x-menu-list{\n    position: relative;\n}\n\n.x-menu li{\n\tline-height:100%;\n}\n\n.x-menu li.x-menu-sep-li{\n\tfont-size:1px;\n\tline-height:1px;\n}\n\n.x-menu-list-item{\n    white-space: nowrap;\n\tdisplay:block;\n\tpadding:1px;\n}\n\n.x-menu-item{\n    -moz-user-select: none;\n    -khtml-user-select:none;\n    -webkit-user-select:ignore;\n}\n\n.x-menu-item-arrow{\n\tbackground:transparent no-repeat right;\n}\n\n.x-menu-sep {\n\tdisplay:block;\n\tfont-size:1px;\n\tline-height:1px;\n\tmargin: 2px 3px;\n\tborder-bottom:1px solid;\n    overflow:hidden;\n}\n\n.x-menu-focus {\n\tposition:absolute;\n\tleft:-1px;\n\ttop:-1px;\n\twidth:1px;\n\theight:1px;\n    line-height:1px;\n    font-size:1px;\n    -moz-outline:0 none;\n    outline:0 none;\n    -moz-user-select: none;\n    -khtml-user-select:none;\n    -webkit-user-select:ignore;\n    overflow:hidden;\n    display:block;\n}\n\na.x-menu-item {\n    cursor: pointer;\n    display: block;\n    line-height: 16px;\n    outline-color: -moz-use-text-color;\n    outline-style: none;\n    outline-width: 0;\n    padding: 3px 21px 3px 27px;\n    position: relative;\n    text-decoration: none;\n    white-space: nowrap;\n}\n\n.x-menu-item-active {\n    background-repeat: repeat-x;\n    background-position: left bottom;\n    border-style:solid;\n    border-width: 1px 0;\n    margin:0 1px;\n\tpadding: 0;\n}\n\n.x-menu-item-active a.x-menu-item {\n    border-style:solid;\n    border-width:0 1px;\n    margin:0 -1px;\n}\n\n.x-menu-item-icon {\n\tborder: 0 none;\n\theight: 16px;\n\tpadding: 0;\n\tvertical-align: top;\n\twidth: 16px;\n\tposition: absolute;\n    left: 3px;\n    top: 3px;\n    margin: 0;\n    background-position:center;\n}\n\n.ext-ie .x-menu-item-icon {\n    left: -24px;\n}\n.ext-strict .x-menu-item-icon {\n    left: 3px;\n}\n\n.ext-ie6 .x-menu-item-icon {\n    left: -24px;\n}\n\n.ext-ie .x-menu-item-icon {\n    vertical-align: middle;\n}\n\n.x-menu-check-item .x-menu-item-icon{\n\tbackground: transparent no-repeat center;\n}\n\n.x-menu-group-item .x-menu-item-icon{\n\tbackground-color: transparent;\n}\n\n.x-menu-item-checked .x-menu-group-item .x-menu-item-icon{\n    background: transparent no-repeat center;\n}\n\n.x-date-menu .x-menu-list{\n    padding: 0;\n}\n\n.x-menu-date-item{\n\tpadding:0;\n}\n\n.x-menu .x-color-palette, .x-menu .x-date-picker{\n    margin-left: 26px;\n\tmargin-right:4px;\n}\n\n.x-menu .x-date-picker{\n    border:1px solid;\n    margin-top:2px;\n    margin-bottom:2px;\n}\n\n.x-menu-plain .x-color-palette, .x-menu-plain .x-date-picker{\n\t margin: 0;\n\t border: 0 none;\n}\n\n.x-date-menu {\n   padding:0 !important;\n}\n\n/*\n * fixes separator visibility problem in IE 6\n */\n.ext-strict .ext-ie6 .x-menu-sep-li {\n    padding: 3px 4px;\n}\n.ext-strict .ext-ie6 .x-menu-sep {\n    margin: 0;\n    height: 1px;\n}\n\n/*\n * Fixes an issue with \"fat\" separators in webkit\n */\n.ext-webkit .x-menu-sep{\n    height: 1px;\n}\n\n/*\n * Ugly mess to remove the white border under the picker\n */\n.ext-ie .x-date-menu{\n    height: 199px;\n}\n\n.ext-strict .ext-ie .x-date-menu, .ext-border-box .ext-ie8 .x-date-menu{\n    height: 197px;\n}\n\n.ext-strict .ext-ie7 .x-date-menu{\n    height: 195px;\n}\n\n.ext-strict .ext-ie8 .x-date-menu{\n    height: auto;\n}\n\n.x-cycle-menu .x-menu-item-checked {\n    border:1px dotted !important;\n\tpadding:0;\n}\n\n.x-menu .x-menu-scroller {\n    width: 100%;\n\tbackground-repeat:no-repeat;\n\tbackground-position:center;\n\theight:8px;\n    line-height: 8px;\n\tcursor:pointer;\n    margin: 0;\n    padding: 0;\n}\n\n.x-menu .x-menu-scroller-active{\n    height: 6px;\n    line-height: 6px;\n}\n\n.x-menu-list-item-indent{\n    padding-left: 27px;\n}/*\n Creates rounded, raised boxes like on the Ext website - the markup isn't pretty:\n  <div class=\"x-box-blue\">\n        <div class=\"x-box-tl\"><div class=\"x-box-tr\"><div class=\"x-box-tc\"></div></div></div>\n        <div class=\"x-box-ml\"><div class=\"x-box-mr\"><div class=\"x-box-mc\">\n            <h3>YOUR TITLE HERE (optional)</h3>\n            <div>YOUR CONTENT HERE</div>\n        </div></div></div>\n        <div class=\"x-box-bl\"><div class=\"x-box-br\"><div class=\"x-box-bc\"></div></div></div>\n    </div>\n */\n\n.x-box-tl {\n\tbackground: transparent no-repeat 0 0;\n    zoom:1;\n}\n\n.x-box-tc {\n\theight: 8px;\n\tbackground: transparent repeat-x 0 0;\n\toverflow: hidden;\n}\n\n.x-box-tr {\n\tbackground: transparent no-repeat right -8px;\n}\n\n.x-box-ml {\n\tbackground: transparent repeat-y 0;\n\tpadding-left: 4px;\n\toverflow: hidden;\n    zoom:1;\n}\n\n.x-box-mc {\n\tbackground: repeat-x 0 -16px;\n\tpadding: 4px 10px;\n}\n\n.x-box-mc h3 {\n\tmargin: 0 0 4px 0;\n    zoom:1;\n}\n\n.x-box-mr {\n\tbackground: transparent repeat-y right;\n\tpadding-right: 4px;\n\toverflow: hidden;\n}\n\n.x-box-bl {\n\tbackground: transparent no-repeat 0 -16px;\n    zoom:1;\n}\n\n.x-box-bc {\n\tbackground: transparent repeat-x 0 -8px;\n\theight: 8px;\n\toverflow: hidden;\n}\n\n.x-box-br {\n\tbackground: transparent no-repeat right -24px;\n}\n\n.x-box-tl, .x-box-bl {\n\tpadding-left: 8px;\n\toverflow: hidden;\n}\n\n.x-box-tr, .x-box-br {\n\tpadding-right: 8px;\n\toverflow: hidden;\n}.x-combo-list {\n    border:1px solid;\n    zoom:1;\n    overflow:hidden;\n}\n\n.x-combo-list-inner {\n    overflow:auto;\n    position:relative; /* for calculating scroll offsets */\n    zoom:1;\n    overflow-x:hidden;\n}\n\n.x-combo-list-hd {\n    border-bottom:1px solid;\n    padding:3px;\n}\n\n.x-resizable-pinned .x-combo-list-inner {\n    border-bottom:1px solid;\n}\n\n.x-combo-list-item {\n    padding:2px;\n    border:1px solid;\n    white-space: nowrap;\n    overflow:hidden;\n    text-overflow: ellipsis;\n}\n\n.x-combo-list .x-combo-selected{\n\tborder:1px dotted !important;\n    cursor:pointer;\n}\n\n.x-combo-list .x-toolbar {\n    border-top:1px solid;\n    border-bottom:0 none;\n}.x-panel {\n    border-style: solid;\n    border-width:0;\n}\n\n.x-panel-header {\n    overflow:hidden;\n    zoom:1;\n    padding:5px 3px 4px 5px;\n    border:1px solid;\n    line-height: 15px;\n    background: transparent repeat-x 0 -1px;\n}\n\n.x-panel-body {\n    border:1px solid;\n    border-top:0 none;\n    overflow:hidden;\n    position: relative; /* added for item scroll positioning */\n}\n\n.x-panel-bbar .x-toolbar, .x-panel-tbar .x-toolbar {\n    border:1px solid;\n    border-top:0 none;\n    overflow:hidden;\n    padding:2px;\n}\n\n.x-panel-tbar-noheader .x-toolbar, .x-panel-mc .x-panel-tbar .x-toolbar {\n    border-top:1px solid;\n    border-bottom: 0 none;\n}\n\n.x-panel-body-noheader, .x-panel-mc .x-panel-body {\n    border-top:1px solid;\n}\n\n.x-panel-header {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-panel-tl .x-panel-header {\n    padding:5px 0 4px 0;\n    border:0 none;\n    background:transparent no-repeat;\n}\n\n.x-panel-tl .x-panel-icon, .x-window-tl .x-panel-icon {\n    padding-left:20px !important;\n    background-repeat:no-repeat;\n    background-position:0 4px;\n    zoom:1;\n}\n\n.x-panel-inline-icon {\n    width:16px;\n\theight:16px;\n    background-repeat:no-repeat;\n    background-position:0 0;\n\tvertical-align:middle;\n\tmargin-right:4px;\n\tmargin-top:-1px;\n\tmargin-bottom:-1px;\n}\n\n.x-panel-tc {\n\tbackground: transparent repeat-x 0 0;\n\toverflow:hidden;\n}\n\n/* fix ie7 strict mode bug */\n.ext-strict .ext-ie7 .x-panel-tc {\n    overflow: visible;\n}\n\n.x-panel-tl {\n\tbackground: transparent no-repeat 0 0;\n\tpadding-left:6px;\n    zoom:1;\n    border-bottom:1px solid;\n}\n\n.x-panel-tr {\n\tbackground: transparent no-repeat right 0;\n\tzoom:1;\n    padding-right:6px;\n}\n\n.x-panel-bc {\n\tbackground: transparent repeat-x 0 bottom;\n    zoom:1;\n}\n\n.x-panel-bc .x-panel-footer {\n    zoom:1;\n}\n\n.x-panel-bl {\n\tbackground: transparent no-repeat 0 bottom;\n\tpadding-left:6px;\n    zoom:1;\n}\n\n.x-panel-br {\n\tbackground: transparent no-repeat right bottom;\n\tpadding-right:6px;\n    zoom:1;\n}\n\n.x-panel-mc {\n    border:0 none;\n    padding:0;\n    margin:0;\n    padding-top:6px;\n}\n\n.x-panel-mc .x-panel-body {\n    background-color:transparent;\n    border: 0 none;\n}\n\n.x-panel-ml {\n\tbackground: repeat-y 0 0;\n\tpadding-left:6px;\n    zoom:1;\n}\n\n.x-panel-mr {\n\tbackground: transparent repeat-y right 0;\n\tpadding-right:6px;\n    zoom:1;\n}\n\n.x-panel-bc .x-panel-footer {\n    padding-bottom:6px;\n}\n\n.x-panel-nofooter .x-panel-bc, .x-panel-nofooter .x-window-bc {\n\theight:6px;\n    font-size:0;\n    line-height:0;\n}\n\n.x-panel-bwrap {\n    overflow:hidden;\n    zoom:1;\n    left:0;\n    top:0;\n}\n.x-panel-body {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-panel-collapsed .x-resizable-handle{\n    display:none;\n}\n\n.ext-gecko .x-panel-animated div {\n    overflow:hidden !important;\n}\n\n/* Plain */\n.x-plain-body {\n    overflow:hidden;\n}\n\n.x-plain-bbar .x-toolbar {\n    overflow:hidden;\n    padding:2px;\n}\n\n.x-plain-tbar .x-toolbar {\n    overflow:hidden;\n    padding:2px;\n}\n\n.x-plain-bwrap {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-plain {\n    overflow:hidden;\n}\n\n/* Tools */\n.x-tool {\n    overflow:hidden;\n    width:15px;\n    height:15px;\n    float:right;\n    cursor:pointer;\n    background:transparent no-repeat;\n    margin-left:2px;\n}\n\n/* expand / collapse tools */\n.x-tool-toggle {\n    background-position:0 -60px;\n}\n\n.x-tool-toggle-over {\n    background-position:-15px -60px;\n}\n\n.x-panel-collapsed .x-tool-toggle {\n    background-position:0 -75px;\n}\n\n.x-panel-collapsed .x-tool-toggle-over {\n    background-position:-15px -75px;\n}\n\n\n.x-tool-close {\n    background-position:0 -0;\n}\n\n.x-tool-close-over {\n    background-position:-15px 0;\n}\n\n.x-tool-minimize {\n    background-position:0 -15px;\n}\n\n.x-tool-minimize-over {\n    background-position:-15px -15px;\n}\n\n.x-tool-maximize {\n    background-position:0 -30px;\n}\n\n.x-tool-maximize-over {\n    background-position:-15px -30px;\n}\n\n.x-tool-restore {\n    background-position:0 -45px;\n}\n\n.x-tool-restore-over {\n    background-position:-15px -45px;\n}\n\n.x-tool-gear {\n    background-position:0 -90px;\n}\n\n.x-tool-gear-over {\n    background-position:-15px -90px;\n}\n\n.x-tool-prev {\n    background-position:0 -105px;\n}\n\n.x-tool-prev-over {\n    background-position:-15px -105px;\n}\n\n.x-tool-next {\n    background-position:0 -120px;\n}\n\n.x-tool-next-over {\n    background-position:-15px -120px;\n}\n\n.x-tool-pin {\n    background-position:0 -135px;\n}\n\n.x-tool-pin-over {\n    background-position:-15px -135px;\n}\n\n.x-tool-unpin {\n    background-position:0 -150px;\n}\n\n.x-tool-unpin-over {\n    background-position:-15px -150px;\n}\n\n.x-tool-right {\n    background-position:0 -165px;\n}\n\n.x-tool-right-over {\n    background-position:-15px -165px;\n}\n\n.x-tool-left {\n    background-position:0 -180px;\n}\n\n.x-tool-left-over {\n    background-position:-15px -180px;\n}\n\n.x-tool-down {\n    background-position:0 -195px;\n}\n\n.x-tool-down-over {\n    background-position:-15px -195px;\n}\n\n.x-tool-up {\n    background-position:0 -210px;\n}\n\n.x-tool-up-over {\n    background-position:-15px -210px;\n}\n\n.x-tool-refresh {\n    background-position:0 -225px;\n}\n\n.x-tool-refresh-over {\n    background-position:-15px -225px;\n}\n\n.x-tool-plus {\n    background-position:0 -240px;\n}\n\n.x-tool-plus-over {\n    background-position:-15px -240px;\n}\n\n.x-tool-minus {\n    background-position:0 -255px;\n}\n\n.x-tool-minus-over {\n    background-position:-15px -255px;\n}\n\n.x-tool-search {\n    background-position:0 -270px;\n}\n\n.x-tool-search-over {\n    background-position:-15px -270px;\n}\n\n.x-tool-save {\n    background-position:0 -285px;\n}\n\n.x-tool-save-over {\n    background-position:-15px -285px;\n}\n\n.x-tool-help {\n    background-position:0 -300px;\n}\n\n.x-tool-help-over {\n    background-position:-15px -300px;\n}\n\n.x-tool-print {\n    background-position:0 -315px;\n}\n\n.x-tool-print-over {\n    background-position:-15px -315px;\n}\n\n.x-tool-expand {\n    background-position:0 -330px;\n}\n\n.x-tool-expand-over {\n    background-position:-15px -330px;\n}\n\n.x-tool-collapse {\n    background-position:0 -345px;\n}\n\n.x-tool-collapse-over {\n    background-position:-15px -345px;\n}\n\n.x-tool-resize {\n    background-position:0 -360px;\n}\n\n.x-tool-resize-over {\n    background-position:-15px -360px;\n}\n\n.x-tool-move {\n    background-position:0 -375px;\n}\n\n.x-tool-move-over {\n    background-position:-15px -375px;\n}\n\n/* Ghosting */\n.x-panel-ghost {\n    z-index:12000;\n    overflow:hidden;\n    position:absolute;\n    left:0;top:0;\n    opacity:.65;\n    -moz-opacity:.65;\n    filter:alpha(opacity=65);\n}\n\n.x-panel-ghost ul {\n    margin:0;\n    padding:0;\n    overflow:hidden;\n    font-size:0;\n    line-height:0;\n    border:1px solid;\n    border-top:0 none;\n    display:block;\n}\n\n.x-panel-ghost * {\n    cursor:move !important;\n}\n\n.x-panel-dd-spacer {\n    border:2px dashed;\n}\n\n/* Buttons */\n.x-panel-btns {\n    padding:5px;\n    overflow:hidden;\n}\n\n.x-panel-btns td.x-toolbar-cell{\n\tpadding:3px;\n}\n\n.x-panel-btns .x-btn-focus .x-btn-left{\n\tbackground-position:0 -147px;\n}\n\n.x-panel-btns .x-btn-focus .x-btn-right{\n\tbackground-position:0 -168px;\n}\n\n.x-panel-btns .x-btn-focus .x-btn-center{\n\tbackground-position:0 -189px;\n}\n\n.x-panel-btns .x-btn-over .x-btn-left{\n\tbackground-position:0 -63px;\n}\n\n.x-panel-btns .x-btn-over .x-btn-right{\n\tbackground-position:0 -84px;\n}\n\n.x-panel-btns .x-btn-over .x-btn-center{\n\tbackground-position:0 -105px;\n}\n\n.x-panel-btns .x-btn-click .x-btn-center{\n\tbackground-position:0 -126px;\n}\n\n.x-panel-btns .x-btn-click  .x-btn-right{\n\tbackground-position:0 -84px;\n}\n\n.x-panel-btns .x-btn-click .x-btn-left{\n\tbackground-position:0 -63px;\n}\n\n.x-panel-fbar td,.x-panel-fbar span,.x-panel-fbar input,.x-panel-fbar div,.x-panel-fbar select,.x-panel-fbar label{\n\twhite-space: nowrap;\n}\n/**\n * W3C Suggested Default style sheet for HTML 4\n * http://www.w3.org/TR/CSS21/sample.html\n *\n * Resets for Ext.Panel @cfg normal: true\n */\n.x-panel-reset .x-panel-body html,\n.x-panel-reset .x-panel-body address,\n.x-panel-reset .x-panel-body blockquote,\n.x-panel-reset .x-panel-body body,\n.x-panel-reset .x-panel-body dd,\n.x-panel-reset .x-panel-body div,\n.x-panel-reset .x-panel-body dl,\n.x-panel-reset .x-panel-body dt,\n.x-panel-reset .x-panel-body fieldset,\n.x-panel-reset .x-panel-body form,\n.x-panel-reset .x-panel-body frame, frameset,\n.x-panel-reset .x-panel-body h1,\n.x-panel-reset .x-panel-body h2,\n.x-panel-reset .x-panel-body h3,\n.x-panel-reset .x-panel-body h4,\n.x-panel-reset .x-panel-body h5,\n.x-panel-reset .x-panel-body h6,\n.x-panel-reset .x-panel-body noframes,\n.x-panel-reset .x-panel-body ol,\n.x-panel-reset .x-panel-body p,\n.x-panel-reset .x-panel-body ul,\n.x-panel-reset .x-panel-body center,\n.x-panel-reset .x-panel-body dir,\n.x-panel-reset .x-panel-body hr,\n.x-panel-reset .x-panel-body menu,\n.x-panel-reset .x-panel-body pre \t\t\t  { display: block }\n.x-panel-reset .x-panel-body li              { display: list-item }\n.x-panel-reset .x-panel-body head            { display: none }\n.x-panel-reset .x-panel-body table           { display: table }\n.x-panel-reset .x-panel-body tr              { display: table-row }\n.x-panel-reset .x-panel-body thead           { display: table-header-group }\n.x-panel-reset .x-panel-body tbody           { display: table-row-group }\n.x-panel-reset .x-panel-body tfoot           { display: table-footer-group }\n.x-panel-reset .x-panel-body col             { display: table-column }\n.x-panel-reset .x-panel-body colgroup        { display: table-column-group }\n.x-panel-reset .x-panel-body td,\n.x-panel-reset .x-panel-body th \t          { display: table-cell }\n.x-panel-reset .x-panel-body caption         { display: table-caption }\n.x-panel-reset .x-panel-body th              { font-weight: bolder; text-align: center }\n.x-panel-reset .x-panel-body caption         { text-align: center }\n.x-panel-reset .x-panel-body body            { margin: 8px }\n.x-panel-reset .x-panel-body h1              { font-size: 2em; margin: .67em 0 }\n.x-panel-reset .x-panel-body h2              { font-size: 1.5em; margin: .75em 0 }\n.x-panel-reset .x-panel-body h3              { font-size: 1.17em; margin: .83em 0 }\n.x-panel-reset .x-panel-body h4,\n.x-panel-reset .x-panel-body p,\n.x-panel-reset .x-panel-body blockquote,\n.x-panel-reset .x-panel-body ul,\n.x-panel-reset .x-panel-body fieldset,\n.x-panel-reset .x-panel-body form,\n.x-panel-reset .x-panel-body ol,\n.x-panel-reset .x-panel-body dl,\n.x-panel-reset .x-panel-body dir,\n.x-panel-reset .x-panel-body menu            { margin: 1.12em 0 }\n.x-panel-reset .x-panel-body h5              { font-size: .83em; margin: 1.5em 0 }\n.x-panel-reset .x-panel-body h6              { font-size: .75em; margin: 1.67em 0 }\n.x-panel-reset .x-panel-body h1,\n.x-panel-reset .x-panel-body h2,\n.x-panel-reset .x-panel-body h3,\n.x-panel-reset .x-panel-body h4,\n.x-panel-reset .x-panel-body h5,\n.x-panel-reset .x-panel-body h6,\n.x-panel-reset .x-panel-body b,\n.x-panel-reset .x-panel-body strong          { font-weight: bolder }\n.x-panel-reset .x-panel-body blockquote      { margin-left: 40px; margin-right: 40px }\n.x-panel-reset .x-panel-body i,\n.x-panel-reset .x-panel-body cite,\n.x-panel-reset .x-panel-body em,\n.x-panel-reset .x-panel-body var,\n.x-panel-reset .x-panel-body address    \t  { font-style: italic }\n.x-panel-reset .x-panel-body pre,\n.x-panel-reset .x-panel-body tt,\n.x-panel-reset .x-panel-body code,\n.x-panel-reset .x-panel-body kbd,\n.x-panel-reset .x-panel-body samp       \t  { font-family: monospace }\n.x-panel-reset .x-panel-body pre             { white-space: pre }\n.x-panel-reset .x-panel-body button,\n.x-panel-reset .x-panel-body textarea,\n.x-panel-reset .x-panel-body input,\n.x-panel-reset .x-panel-body select   \t\t  { display: inline-block }\n.x-panel-reset .x-panel-body big             { font-size: 1.17em }\n.x-panel-reset .x-panel-body small,\n.x-panel-reset .x-panel-body sub,\n.x-panel-reset .x-panel-body sup \t\t\t  { font-size: .83em }\n.x-panel-reset .x-panel-body sub             { vertical-align: sub }\n.x-panel-reset .x-panel-body sup             { vertical-align: super }\n.x-panel-reset .x-panel-body table           { border-spacing: 2px; }\n.x-panel-reset .x-panel-body thead,\n.x-panel-reset .x-panel-body tbody,\n.x-panel-reset .x-panel-body tfoot           { vertical-align: middle }\n.x-panel-reset .x-panel-body td,\n.x-panel-reset .x-panel-body th          \t  { vertical-align: inherit }\n.x-panel-reset .x-panel-body s,\n.x-panel-reset .x-panel-body strike,\n.x-panel-reset .x-panel-body del  \t\t\t  { text-decoration: line-through }\n.x-panel-reset .x-panel-body hr              { border: 1px inset }\n.x-panel-reset .x-panel-body ol,\n.x-panel-reset .x-panel-body ul,\n.x-panel-reset .x-panel-body dir,\n.x-panel-reset .x-panel-body menu,\n.x-panel-reset .x-panel-body dd        \t  { margin-left: 40px }\n.x-panel-reset .x-panel-body ul, .x-panel-reset .x-panel-body menu, .x-panel-reset .x-panel-body dir { list-style-type: disc;}\n.x-panel-reset .x-panel-body ol              { list-style-type: decimal }\n.x-panel-reset .x-panel-body ol ul,\n.x-panel-reset .x-panel-body ul ol,\n.x-panel-reset .x-panel-body ul ul,\n.x-panel-reset .x-panel-body ol ol    \t\t  { margin-top: 0; margin-bottom: 0 }\n.x-panel-reset .x-panel-body u,\n.x-panel-reset .x-panel-body ins          \t  { text-decoration: underline }\n.x-panel-reset .x-panel-body br:before       { content: \"\\A\" }\n.x-panel-reset .x-panel-body :before, .x-panel-reset .x-panel-body :after { white-space: pre-line }\n.x-panel-reset .x-panel-body center          { text-align: center }\n.x-panel-reset .x-panel-body :link, .x-panel-reset .x-panel-body :visited { text-decoration: underline }\n.x-panel-reset .x-panel-body :focus          { outline: invert dotted thin }\n\n/* Begin bidirectionality settings (do not change) */\n.x-panel-reset .x-panel-body BDO[DIR=\"ltr\"]  { direction: ltr; unicode-bidi: bidi-override }\n.x-panel-reset .x-panel-body BDO[DIR=\"rtl\"]  { direction: rtl; unicode-bidi: bidi-override }\n.x-window {\n    zoom:1;\n}\n\n.x-window .x-window-handle {\n    opacity:0;\n    -moz-opacity:0;\n    filter:alpha(opacity=0);\n}\n\n.x-window-proxy {\n    border:1px solid;\n    z-index:12000;\n    overflow:hidden;\n    position:absolute;\n    left:0;top:0;\n    display:none;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n}\n\n.x-window-header {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-window-bwrap {\n    z-index:1;\n    position:relative;\n    zoom:1;\n    left:0;top:0;\n}\n\n.x-window-tl .x-window-header {\n    padding:5px 0 4px 0;\n}\n\n.x-window-header-text {\n    cursor:pointer;\n}\n\n.x-window-tc {\n\tbackground: transparent repeat-x 0 0;\n\toverflow:hidden;\n    zoom:1;\n}\n\n.x-window-tl {\n\tbackground: transparent no-repeat 0 0;\n\tpadding-left:6px;\n    zoom:1;\n    z-index:1;\n    position:relative;\n}\n\n.x-window-tr {\n\tbackground: transparent no-repeat right 0;\n\tpadding-right:6px;\n}\n\n.x-window-bc {\n\tbackground: transparent repeat-x 0 bottom;\n    zoom:1;\n}\n\n.x-window-bc .x-window-footer {\n    padding-bottom:6px;\n    zoom:1;\n    font-size:0;\n    line-height:0;\n}\n\n.x-window-bl {\n\tbackground: transparent no-repeat 0 bottom;\n\tpadding-left:6px;\n    zoom:1;\n}\n\n.x-window-br {\n\tbackground: transparent no-repeat right bottom;\n\tpadding-right:6px;\n    zoom:1;\n}\n\n.x-window-mc {\n    border:1px solid;\n    padding:0;\n    margin:0;\n}\n\n.x-window-ml {\n\tbackground: transparent repeat-y 0 0;\n\tpadding-left:6px;\n    zoom:1;\n}\n\n.x-window-mr {\n\tbackground: transparent repeat-y right 0;\n\tpadding-right:6px;\n    zoom:1;\n}\n\n.x-window-body {\n    overflow:hidden;\n}\n\n.x-window-bwrap {\n    overflow:hidden;\n}\n\n.x-window-maximized .x-window-bl, .x-window-maximized .x-window-br,\n    .x-window-maximized .x-window-ml, .x-window-maximized .x-window-mr,\n    .x-window-maximized .x-window-tl, .x-window-maximized .x-window-tr {\n    padding:0;\n}\n\n.x-window-maximized .x-window-footer {\n    padding-bottom:0;\n}\n\n.x-window-maximized .x-window-tc {\n    padding-left:3px;\n    padding-right:3px;\n}\n\n.x-window-maximized .x-window-mc {\n    border-left:0 none;\n    border-right:0 none;\n}\n\n.x-window-tbar .x-toolbar, .x-window-bbar .x-toolbar {\n    border-left:0 none;\n    border-right: 0 none;\n}\n\n.x-window-bbar .x-toolbar {\n    border-top:1px solid;\n    border-bottom:0 none;\n}\n\n.x-window-draggable, .x-window-draggable .x-window-header-text {\n    cursor:move;\n}\n\n.x-window-maximized .x-window-draggable, .x-window-maximized .x-window-draggable .x-window-header-text {\n    cursor:default;\n}\n\n.x-window-body {\n    background-color:transparent;\n}\n\n.x-panel-ghost .x-window-tl {\n    border-bottom:1px solid;\n}\n\n.x-panel-collapsed .x-window-tl {\n    border-bottom:1px solid;\n}\n\n.x-window-maximized-ct {\n    overflow:hidden;\n}\n\n.x-window-maximized .x-window-handle {\n    display:none;\n}\n\n.x-window-sizing-ghost ul {\n    border:0 none !important;\n}\n\n.x-dlg-focus{\n\t-moz-outline:0 none;\n\toutline:0 none;\n\twidth:0;\n\theight:0;\n\toverflow:hidden;\n\tposition:absolute;\n\ttop:0;\n\tleft:0;\n}\n\n.ext-webkit .x-dlg-focus{\n    width: 1px;\n    height: 1px;\n}\n\n.x-dlg-mask{\n    z-index:10000;\n    display:none;\n    position:absolute;\n    top:0;\n    left:0;\n    -moz-opacity: 0.5;\n    opacity:.50;\n    filter: alpha(opacity=50);\n}\n\nbody.ext-ie6.x-body-masked select {\n\tvisibility:hidden;\n}\n\nbody.ext-ie6.x-body-masked .x-window select {\n\tvisibility:visible;\n}\n\n.x-window-plain .x-window-mc {\n    border: 1px solid;\n}\n\n.x-window-plain .x-window-body {\n    border: 1px solid;\n    background:transparent !important;\n}.x-html-editor-wrap {\n    border:1px solid;\n}\n\n.x-html-editor-tb .x-btn-text {\n    background:transparent no-repeat;\n}\n\n.x-html-editor-tb .x-edit-bold, .x-menu-item img.x-edit-bold {\n    background-position:0 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);    \n}\n\n.x-html-editor-tb .x-edit-italic, .x-menu-item img.x-edit-italic {\n    background-position:-16px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-underline, .x-menu-item img.x-edit-underline {\n    background-position:-32px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-forecolor, .x-menu-item img.x-edit-forecolor {\n    background-position:-160px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-backcolor, .x-menu-item img.x-edit-backcolor {\n    background-position:-176px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-justifyleft, .x-menu-item img.x-edit-justifyleft {\n    background-position:-112px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-justifycenter, .x-menu-item img.x-edit-justifycenter {\n    background-position:-128px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-justifyright, .x-menu-item img.x-edit-justifyright {\n    background-position:-144px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-insertorderedlist, .x-menu-item img.x-edit-insertorderedlist {\n    background-position:-80px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-insertunorderedlist, .x-menu-item img.x-edit-insertunorderedlist {\n    background-position:-96px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-increasefontsize, .x-menu-item img.x-edit-increasefontsize {\n    background-position:-48px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-decreasefontsize, .x-menu-item img.x-edit-decreasefontsize {\n    background-position:-64px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-sourceedit, .x-menu-item img.x-edit-sourceedit {\n    background-position:-192px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-createlink, .x-menu-item img.x-edit-createlink {\n    background-position:-208px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tip .x-tip-bd .x-tip-bd-inner {\n    padding:5px;\n    padding-bottom:1px;\n}\n\n.x-html-editor-tb .x-toolbar {\n    position:static !important;\n}.x-panel-noborder .x-panel-body-noborder {\n    border-width:0;\n}\n\n.x-panel-noborder .x-panel-header-noborder {\n    border-width:0 0 1px;\n    border-style:solid;\n}\n\n.x-panel-noborder .x-panel-tbar-noborder .x-toolbar {\n    border-width:0 0 1px;\n    border-style:solid;\n}\n\n.x-panel-noborder .x-panel-bbar-noborder .x-toolbar {\n    border-width:1px 0 0 0;\n    border-style:solid;\n}\n\n.x-window-noborder .x-window-mc {\n    border-width:0;\n}\n\n.x-window-plain .x-window-body-noborder {\n    border-width:0;\n}\n\n.x-tab-panel-noborder .x-tab-panel-body-noborder {\n\tborder-width:0;\n}\n\n.x-tab-panel-noborder .x-tab-panel-header-noborder {\n    border-width: 0 0 1px 0;\n}\n\n.x-tab-panel-noborder .x-tab-panel-footer-noborder {\n    border-width: 1px 0 0 0;\n}\n\n.x-tab-panel-bbar-noborder .x-toolbar {\n    border-width: 1px 0 0 0;\n    border-style:solid;\n}\n\n.x-tab-panel-tbar-noborder .x-toolbar {\n    border-width:0 0 1px;\n    border-style:solid;\n}.x-border-layout-ct {\n    position: relative;\n}\n\n.x-border-panel {\n    position:absolute;\n    left:0;\n    top:0;\n}\n\n.x-tool-collapse-south {\n    background-position:0 -195px;\n}\n\n.x-tool-collapse-south-over {\n    background-position:-15px -195px;\n}\n\n.x-tool-collapse-north {\n    background-position:0 -210px;\n}\n\n.x-tool-collapse-north-over {\n    background-position:-15px -210px;\n}\n\n.x-tool-collapse-west {\n    background-position:0 -180px;\n}\n\n.x-tool-collapse-west-over {\n    background-position:-15px -180px;\n}\n\n.x-tool-collapse-east {\n    background-position:0 -165px;\n}\n\n.x-tool-collapse-east-over {\n    background-position:-15px -165px;\n}\n\n.x-tool-expand-south {\n    background-position:0 -210px;\n}\n\n.x-tool-expand-south-over {\n    background-position:-15px -210px;\n}\n\n.x-tool-expand-north {\n    background-position:0 -195px;\n}\n.x-tool-expand-north-over {\n    background-position:-15px -195px;\n}\n\n.x-tool-expand-west {\n    background-position:0 -165px;\n}\n\n.x-tool-expand-west-over {\n    background-position:-15px -165px;\n}\n\n.x-tool-expand-east {\n    background-position:0 -180px;\n}\n\n.x-tool-expand-east-over {\n    background-position:-15px -180px;\n}\n\n.x-tool-expand-north, .x-tool-expand-south {\n    float:right;\n    margin:3px;\n}\n\n.x-tool-expand-east, .x-tool-expand-west {\n    float:none;\n    margin:3px 2px;\n}\n\n.x-accordion-hd .x-tool-toggle {\n    background-position:0 -255px;\n}\n\n.x-accordion-hd .x-tool-toggle-over {\n    background-position:-15px -255px;\n}\n\n.x-panel-collapsed .x-accordion-hd .x-tool-toggle {\n    background-position:0 -240px;\n}\n\n.x-panel-collapsed .x-accordion-hd .x-tool-toggle-over {\n    background-position:-15px -240px;\n}\n\n.x-accordion-hd {\n\tpadding-top:4px;\n\tpadding-bottom:3px;\n\tborder-top:0 none;\n    background: transparent repeat-x 0 -9px;\n}\n\n.x-layout-collapsed{\n    position:absolute;\n    left:-10000px;\n    top:-10000px;\n    visibility:hidden;\n    width:20px;\n    height:20px;\n    overflow:hidden;\n\tborder:1px solid;\n\tz-index:20;\n}\n\n.ext-border-box .x-layout-collapsed{\n    width:22px;\n    height:22px;\n}\n\n.x-layout-collapsed-over{\n    cursor:pointer;\n}\n\n.x-layout-collapsed-west .x-layout-collapsed-tools, .x-layout-collapsed-east .x-layout-collapsed-tools{\n\tposition:absolute;\n    top:0;\n    left:0;\n    width:20px;\n    height:20px;\n}\n\n\n.x-layout-split{\n    position:absolute;\n    height:5px;\n    width:5px;\n    line-height:1px;\n    font-size:1px;\n    z-index:3;\n    background-color:transparent;\n}\n\n/* IE6 strict won't drag w/out a color */\n.ext-strict .ext-ie6 .x-layout-split{\n    background-color: #fff !important;\n    filter: alpha(opacity=1);\n}\n\n.x-layout-split-h{\n    background-image:url(../images/default/s.gif);\n    background-position: left;\n}\n\n.x-layout-split-v{\n    background-image:url(../images/default/s.gif);\n    background-position: top;\n}\n\n.x-column-layout-ct {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-column {\n    float:left;\n    padding:0;\n    margin:0;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-column-inner {\n    overflow:hidden;\n    zoom:1;\n}\n\n/* mini mode */\n.x-layout-mini {\n    position:absolute;\n    top:0;\n    left:0;\n    display:block;\n    width:5px;\n    height:35px;\n    cursor:pointer;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n}\n\n.x-layout-mini-over, .x-layout-collapsed-over .x-layout-mini{\n    opacity:1;\n    -moz-opacity:1;\n    filter:none;\n}\n\n.x-layout-split-west .x-layout-mini {\n    top:48%;\n}\n\n.x-layout-split-east .x-layout-mini {\n    top:48%;\n}\n\n.x-layout-split-north .x-layout-mini {\n    left:48%;\n    height:5px;\n    width:35px;\n}\n\n.x-layout-split-south .x-layout-mini {\n    left:48%;\n    height:5px;\n    width:35px;\n}\n\n.x-layout-cmini-west .x-layout-mini {\n    top:48%;\n}\n\n.x-layout-cmini-east .x-layout-mini {\n    top:48%;\n}\n\n.x-layout-cmini-north .x-layout-mini {\n    left:48%;\n    height:5px;\n    width:35px;\n}\n\n.x-layout-cmini-south .x-layout-mini {\n    left:48%;\n    height:5px;\n    width:35px;\n}\n\n.x-layout-cmini-west, .x-layout-cmini-east {\n    border:0 none;\n    width:5px !important;\n    padding:0;\n    background-color:transparent;\n}\n\n.x-layout-cmini-north, .x-layout-cmini-south {\n    border:0 none;\n    height:5px !important;\n    padding:0;\n    background-color:transparent;\n}\n\n.x-viewport, .x-viewport body {\n    margin: 0;\n    padding: 0;\n    border: 0 none;\n    overflow: hidden;\n    height: 100%;\n}\n\n.x-abs-layout-item {\n    position:absolute;\n    left:0;\n    top:0;\n}\n\n.ext-ie input.x-abs-layout-item, .ext-ie textarea.x-abs-layout-item {\n    margin:0;\n}\n\n.x-box-layout-ct {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-box-inner {\n    overflow:hidden;\n    zoom:1;\n    position:relative;\n    left:0;\n    top:0;\n}\n\n.x-box-item {\n    position:absolute;\n    left:0;\n    top:0;\n}.x-progress-wrap {\n    border:1px solid;\n    overflow:hidden;\n}\n\n.x-progress-inner {\n    height:18px;\n    background:repeat-x;\n    position:relative;\n}\n\n.x-progress-bar {\n    height:18px;\n    float:left;\n    width:0;\n    background: repeat-x left center;\n    border-top:1px solid;\n    border-bottom:1px solid;\n    border-right:1px solid;\n}\n\n.x-progress-text {\n    padding:1px 5px;\n    overflow:hidden;\n    position:absolute;\n    left:0;\n    text-align:center;\n}\n\n.x-progress-text-back {\n    line-height:16px;\n}\n\n.ext-ie .x-progress-text-back {\n    line-height:15px;\n}\n\n.ext-strict .ext-ie7 .x-progress-text-back{\n    width: 100%;\n}\n.x-list-header{\n\tbackground: repeat-x 0 bottom;\n\tcursor:default;\n    zoom:1;\n    height:22px;\n}\n\n.x-list-header-inner div {\n    display:block;\n    float:left;\n    overflow:hidden;\n\t-o-text-overflow: ellipsis;\n\ttext-overflow: ellipsis;\n    white-space: nowrap;\n}\n\n.x-list-header-inner div em {\n    display:block;\n    border-left:1px solid;\n    padding:4px 4px;\n    overflow:hidden;\n    -moz-user-select: none;\n    -khtml-user-select: none;\n    line-height:14px;\n}\n\n.x-list-body {\n    overflow:auto;\n    overflow-x:hidden;\n    overflow-y:auto;\n    zoom:1;\n    float: left;\n    width: 100%;\n}\n\n.x-list-body dl {\n    zoom:1;\n}\n\n.x-list-body dt {\n    display:block;\n    float:left;\n    overflow:hidden;\n\t-o-text-overflow: ellipsis;\n\ttext-overflow: ellipsis;\n    white-space: nowrap;\n    cursor:pointer;\n    zoom:1;\n}\n\n.x-list-body dt em {\n    display:block;\n    padding:3px 4px;\n    overflow:hidden;\n    -moz-user-select: none;\n    -khtml-user-select: none;\n}\n\n.x-list-resizer {\n    border-left:1px solid;\n    border-right:1px solid;\n    position:absolute;\n    left:0;\n    top:0;\n}\n\n.x-list-header-inner em.sort-asc {\n    background: transparent no-repeat center 0;\n    border-style:solid;\n    border-width: 0 1px 1px;\n    padding-bottom:3px;\n}\n\n.x-list-header-inner em.sort-desc {\n    background: transparent no-repeat center -23px;\n    border-style:solid;\n    border-width: 0 1px 1px;\n    padding-bottom:3px;\n}\n\n/* Shared styles */\n.x-slider {\n    zoom:1;\n}\n\n.x-slider-inner {\n    position:relative;\n    left:0;\n    top:0;\n    overflow:visible;\n    zoom:1;\n}\n\n.x-slider-focus {\n\tposition:absolute;\n\tleft:0;\n\ttop:0;\n\twidth:1px;\n\theight:1px;\n    line-height:1px;\n    font-size:1px;\n    -moz-outline:0 none;\n    outline:0 none;\n    -moz-user-select: none;\n    -khtml-user-select:none;\n    -webkit-user-select:ignore;\n\tdisplay:block;\n\toverflow:hidden;  \n}\n\n/* Horizontal styles */\n.x-slider-horz {\n    padding-left:7px;\n    background:transparent no-repeat 0 -22px;\n}\n\n.x-slider-horz .x-slider-end {\n    padding-right:7px;\n    zoom:1;\n    background:transparent no-repeat right -44px;\n}\n\n.x-slider-horz .x-slider-inner {\n    background:transparent repeat-x 0 0;\n    height:22px;\n}\n\n.x-slider-horz .x-slider-thumb {\n    width:14px;\n    height:15px;\n    position:absolute;\n    left:0;\n    top:3px;\n    background:transparent no-repeat 0 0;\n}\n\n.x-slider-horz .x-slider-thumb-over {\n    background-position: -14px -15px;\n}\n\n.x-slider-horz .x-slider-thumb-drag {\n    background-position: -28px -30px;\n}\n\n/* Vertical styles */\n.x-slider-vert {\n    padding-top:7px;\n    background:transparent no-repeat -44px 0;\n    width:22px;\n}\n\n.x-slider-vert .x-slider-end {\n    padding-bottom:7px;\n    zoom:1;\n    background:transparent no-repeat -22px bottom;\n}\n\n.x-slider-vert .x-slider-inner {\n    background:transparent repeat-y 0 0;\n}\n\n.x-slider-vert .x-slider-thumb {\n    width:15px;\n    height:14px;\n    position:absolute;\n    left:3px;\n    bottom:0;\n    background:transparent no-repeat 0 0;\n}\n\n.x-slider-vert .x-slider-thumb-over {\n    background-position: -15px -14px;\n}\n\n.x-slider-vert .x-slider-thumb-drag {\n    background-position: -30px -28px;\n}.x-window-dlg .x-window-body {\n    border:0 none !important;\n    padding:5px 10px;\n    overflow:hidden !important;\n}\n\n.x-window-dlg .x-window-mc {\n    border:0 none !important;\n}\n\n.x-window-dlg .ext-mb-input {\n    margin-top:4px;\n    width:95%;\n}\n\n.x-window-dlg .ext-mb-textarea {\n    margin-top:4px;\n}\n\n.x-window-dlg .x-progress-wrap {\n    margin-top:4px;\n}\n\n.ext-ie .x-window-dlg .x-progress-wrap {\n    margin-top:6px;\n}\n\n.x-window-dlg .x-msg-box-wait {\n    background:transparent no-repeat left;\n    display:block;\n    width:300px;\n    padding-left:18px;\n    line-height:18px;\n}\n\n.x-window-dlg .ext-mb-icon {\n    float:left;\n    width:47px;\n    height:32px;\n}\n\n.x-window-dlg .x-dlg-icon .ext-mb-content{\n    zoom: 1; \n    margin-left: 47px;\n}\n\n.x-window-dlg .ext-mb-info, .x-window-dlg .ext-mb-warning, .x-window-dlg .ext-mb-question, .x-window-dlg .ext-mb-error {\n    background:transparent no-repeat top left;\n}\n\n.ext-gecko2 .ext-mb-fix-cursor {\n    overflow:auto;\n}"
  },
  {
    "path": "client/src/ext/resources/css/ext-all.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nhtml,body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,p,blockquote,th,td{margin:0;padding:0}img,body,html{border:0}address,caption,cite,code,dfn,em,strong,th,var{font-style:normal;font-weight:normal}ol,ul{list-style:none}caption,th{text-align:left}h1,h2,h3,h4,h5,h6{font-size:100%}q:before,q:after{content:''}.ext-forced-border-box,.ext-forced-border-box *{-moz-box-sizing:border-box;-ms-box-sizing:border-box;-webkit-box-sizing:border-box}.ext-el-mask{z-index:100;position:absolute;top:0;left:0;-moz-opacity:.5;opacity:.50;filter:alpha(opacity=50);width:100%;height:100%;zoom:1}.ext-el-mask-msg{z-index:20001;position:absolute;top:0;left:0;border:1px solid;background:repeat-x 0 -16px;padding:2px}.ext-el-mask-msg div{padding:5px 10px 5px 10px;border:1px solid;cursor:wait}.ext-shim{position:absolute;visibility:hidden;left:0;top:0;overflow:hidden}.ext-ie .ext-shim{filter:alpha(opacity=0)}.ext-ie6 .ext-shim{margin-left:5px;margin-top:3px}.x-mask-loading div{padding:5px 10px 5px 25px;background:no-repeat 5px 5px;line-height:16px}.x-hidden,.x-hide-offsets{position:absolute!important;left:-10000px;top:-10000px;visibility:hidden}.x-hide-display{display:none!important}.x-hide-nosize,.x-hide-nosize *{height:0!important;width:0!important;visibility:hidden!important;border:none!important;zoom:1}.x-hide-visibility{visibility:hidden!important}.x-masked{overflow:hidden!important}.x-masked-relative{position:relative!important}.x-masked select,.x-masked object,.x-masked embed{visibility:hidden}.x-layer{visibility:hidden}.x-unselectable,.x-unselectable *{user-select:none;-o-user-select:none;-ms-user-select:none;-moz-user-select:-moz-none;-webkit-user-select:none;cursor:default}.x-repaint{zoom:1;background-color:transparent;-moz-outline:0;outline:0}.x-item-disabled{cursor:default;opacity:.6;-moz-opacity:.6;filter:alpha(opacity=60)}.x-item-disabled *{cursor:default!important}.x-form-radio-group .x-item-disabled{filter:none}.x-splitbar-proxy{position:absolute;visibility:hidden;z-index:20001;zoom:1;line-height:1px;font-size:1px;overflow:hidden}.x-splitbar-h,.x-splitbar-proxy-h{cursor:e-resize;cursor:col-resize}.x-splitbar-v,.x-splitbar-proxy-v{cursor:s-resize;cursor:row-resize}.x-color-palette{width:150px;height:92px;cursor:pointer}.x-color-palette a{border:1px solid;float:left;padding:2px;text-decoration:none;-moz-outline:0 none;outline:0 none;cursor:pointer}.x-color-palette a:hover,.x-color-palette a.x-color-palette-sel{border:1px solid}.x-color-palette em{display:block;border:1px solid}.x-color-palette em span{cursor:pointer;display:block;height:10px;line-height:10px;width:10px}.x-ie-shadow{display:none;position:absolute;overflow:hidden;left:0;top:0;zoom:1}.x-shadow{display:none;position:absolute;overflow:hidden;left:0;top:0}.x-shadow *{overflow:hidden}.x-shadow *{padding:0;border:0;margin:0;clear:none;zoom:1}.x-shadow .xstc,.x-shadow .xsbc{height:6px;float:left}.x-shadow .xstl,.x-shadow .xstr,.x-shadow .xsbl,.x-shadow .xsbr{width:6px;height:6px;float:left}.x-shadow .xsc{width:100%}.x-shadow .xsml,.x-shadow .xsmr{width:6px;float:left;height:100%}.x-shadow .xsmc{float:left;height:100%;background-color:transparent}.x-shadow .xst,.x-shadow .xsb{height:6px;overflow:hidden;width:100%}.x-shadow .xsml{background:transparent repeat-y 0 0}.x-shadow .xsmr{background:transparent repeat-y -6px 0}.x-shadow .xstl{background:transparent no-repeat 0 0}.x-shadow .xstc{background:transparent repeat-x 0 -30px}.x-shadow .xstr{background:transparent repeat-x 0 -18px}.x-shadow .xsbl{background:transparent no-repeat 0 -12px}.x-shadow .xsbc{background:transparent repeat-x 0 -36px}.x-shadow .xsbr{background:transparent repeat-x 0 -6px}.loading-indicator{background:no-repeat left;padding-left:20px;line-height:16px;margin:3px}.x-text-resize{position:absolute;left:-1000px;top:-1000px;visibility:hidden;zoom:1}.x-drag-overlay{width:100%;height:100%;display:none;position:absolute;left:0;top:0;background-image:url(../images/default/s.gif);z-index:20000}.x-clear{clear:both;height:0;overflow:hidden;line-height:0;font-size:0}.x-spotlight{z-index:8999;position:absolute;top:0;left:0;-moz-opacity:.5;opacity:.50;filter:alpha(opacity=50);width:0;height:0;zoom:1}#x-history-frame{position:absolute;top:-1px;left:0;width:1px;height:1px;visibility:hidden}#x-history-field{position:absolute;top:0;left:-1px;width:1px;height:1px;visibility:hidden}.x-resizable-handle{position:absolute;z-index:100;font-size:1px;line-height:6px;overflow:hidden;filter:alpha(opacity=0);opacity:0;zoom:1}.x-resizable-handle-east{width:6px;cursor:e-resize;right:0;top:0;height:100%}.ext-ie .x-resizable-handle-east{margin-right:-1px}.x-resizable-handle-south{width:100%;cursor:s-resize;left:0;bottom:0;height:6px}.ext-ie .x-resizable-handle-south{margin-bottom:-1px}.x-resizable-handle-west{width:6px;cursor:w-resize;left:0;top:0;height:100%}.x-resizable-handle-north{width:100%;cursor:n-resize;left:0;top:0;height:6px}.x-resizable-handle-southeast{width:6px;cursor:se-resize;right:0;bottom:0;height:6px;z-index:101}.x-resizable-handle-northwest{width:6px;cursor:nw-resize;left:0;top:0;height:6px;z-index:101}.x-resizable-handle-northeast{width:6px;cursor:ne-resize;right:0;top:0;height:6px;z-index:101}.x-resizable-handle-southwest{width:6px;cursor:sw-resize;left:0;bottom:0;height:6px;z-index:101}.x-resizable-over .x-resizable-handle,.x-resizable-pinned .x-resizable-handle{filter:alpha(opacity=100);opacity:1}.x-resizable-over .x-resizable-handle-east,.x-resizable-pinned .x-resizable-handle-east,.x-resizable-over .x-resizable-handle-west,.x-resizable-pinned .x-resizable-handle-west{background-position:left}.x-resizable-over .x-resizable-handle-south,.x-resizable-pinned .x-resizable-handle-south,.x-resizable-over .x-resizable-handle-north,.x-resizable-pinned .x-resizable-handle-north{background-position:top}.x-resizable-over .x-resizable-handle-southeast,.x-resizable-pinned .x-resizable-handle-southeast{background-position:top left}.x-resizable-over .x-resizable-handle-northwest,.x-resizable-pinned .x-resizable-handle-northwest{background-position:bottom right}.x-resizable-over .x-resizable-handle-northeast,.x-resizable-pinned .x-resizable-handle-northeast{background-position:bottom left}.x-resizable-over .x-resizable-handle-southwest,.x-resizable-pinned .x-resizable-handle-southwest{background-position:top right}.x-resizable-proxy{border:1px dashed;position:absolute;overflow:hidden;display:none;left:0;top:0;z-index:50000}.x-resizable-overlay{width:100%;height:100%;display:none;position:absolute;left:0;top:0;z-index:200000;-moz-opacity:0;opacity:0;filter:alpha(opacity=0)}.x-tab-panel{overflow:hidden}.x-tab-panel-header,.x-tab-panel-footer{border:1px solid;overflow:hidden;zoom:1}.x-tab-panel-header{border:1px solid;padding-bottom:2px}.x-tab-panel-footer{border:1px solid;padding-top:2px}.x-tab-strip-wrap{width:100%;overflow:hidden;position:relative;zoom:1}ul.x-tab-strip{display:block;width:5000px;zoom:1}ul.x-tab-strip-top{padding-top:1px;background:repeat-x bottom;border-bottom:1px solid}ul.x-tab-strip-bottom{padding-bottom:1px;background:repeat-x top;border-top:1px solid;border-bottom:0 none}.x-tab-panel-header-plain .x-tab-strip-top{background:transparent!important;padding-top:0!important}.x-tab-panel-header-plain{background:transparent!important;border-width:0!important;padding-bottom:0!important}.x-tab-panel-header-plain .x-tab-strip-spacer,.x-tab-panel-footer-plain .x-tab-strip-spacer{border:1px solid;height:2px;font-size:1px;line-height:1px}.x-tab-panel-header-plain .x-tab-strip-spacer{border-top:0 none}.x-tab-panel-footer-plain .x-tab-strip-spacer{border-bottom:0 none}.x-tab-panel-footer-plain .x-tab-strip-bottom{background:transparent!important;padding-bottom:0!important}.x-tab-panel-footer-plain{background:transparent!important;border-width:0!important;padding-top:0!important}.ext-border-box .x-tab-panel-header-plain .x-tab-strip-spacer,.ext-border-box .x-tab-panel-footer-plain .x-tab-strip-spacer{height:3px}ul.x-tab-strip li{float:left;margin-left:2px}ul.x-tab-strip li.x-tab-edge{float:left;margin:0!important;padding:0!important;border:0 none!important;font-size:1px!important;line-height:1px!important;overflow:hidden;zoom:1;background:transparent!important;width:1px}.x-tab-strip a,.x-tab-strip span,.x-tab-strip em{display:block}.x-tab-strip a{text-decoration:none!important;-moz-outline:0;outline:0;cursor:pointer}.x-tab-strip-inner{overflow:hidden;text-overflow:ellipsis}.x-tab-strip span.x-tab-strip-text{white-space:nowrap;cursor:pointer;padding:4px 0}.x-tab-strip-top .x-tab-with-icon .x-tab-right{padding-left:6px}.x-tab-strip .x-tab-with-icon span.x-tab-strip-text{padding-left:20px;background-position:0 3px;background-repeat:no-repeat}.x-tab-strip-active,.x-tab-strip-active a.x-tab-right{cursor:default}.x-tab-strip-active span.x-tab-strip-text{cursor:default}.x-tab-strip-disabled .x-tabs-text{cursor:default}.x-tab-panel-body{overflow:hidden}.x-tab-panel-bwrap{overflow:hidden}.ext-ie .x-tab-strip .x-tab-right{position:relative}.x-tab-strip-top .x-tab-strip-active .x-tab-right{margin-bottom:-1px}.ext-ie8 .x-tab-strip li{position:relative}.ext-border-box .ext-ie8 .x-tab-strip-top .x-tab-right,.ext-border-box .ext-ie9 .x-tab-strip-top .x-tab-right{top:1px}.ext-ie8 .x-tab-strip-top,.ext-ie9 .x-tab-strip-top{padding-top:1px}.ext-border-box .ext-ie8 .x-tab-strip-top,.ext-border-box .ext-ie9 .x-tab-strip-top{padding-top:0}.ext-ie8 .x-tab-strip .x-tab-strip-closable a.x-tab-strip-close,.ext-ie9 .x-tab-strip .x-tab-strip-closable a.x-tab-strip-close{top:3px}.ext-border-box .ext-ie8 .x-tab-strip .x-tab-strip-closable a.x-tab-strip-close,.ext-border-box .ext-ie9 .x-tab-strip .x-tab-strip-closable a.x-tab-strip-close{top:4px}.ext-ie8 .x-tab-strip-bottom .x-tab-right,.ext-ie9 .x-tab-strip-bottom .x-tab-right{top:0}.x-tab-strip-top .x-tab-strip-active .x-tab-right span.x-tab-strip-text{padding-bottom:5px}.x-tab-strip-bottom .x-tab-strip-active .x-tab-right{margin-top:-1px}.x-tab-strip-bottom .x-tab-strip-active .x-tab-right span.x-tab-strip-text{padding-top:5px}.x-tab-strip-top .x-tab-right{background:transparent no-repeat 0 -51px;padding-left:10px}.x-tab-strip-top .x-tab-left{background:transparent no-repeat right -351px;padding-right:10px}.x-tab-strip-top .x-tab-strip-inner{background:transparent repeat-x 0 -201px}.x-tab-strip-top .x-tab-strip-over .x-tab-right{background-position:0 -101px}.x-tab-strip-top .x-tab-strip-over .x-tab-left{background-position:right -401px}.x-tab-strip-top .x-tab-strip-over .x-tab-strip-inner{background-position:0 -251px}.x-tab-strip-top .x-tab-strip-active .x-tab-right{background-position:0 0}.x-tab-strip-top .x-tab-strip-active .x-tab-left{background-position:right -301px}.x-tab-strip-top .x-tab-strip-active .x-tab-strip-inner{background-position:0 -151px}.x-tab-strip-bottom .x-tab-right{background:no-repeat bottom right}.x-tab-strip-bottom .x-tab-left{background:no-repeat bottom left}.x-tab-strip-bottom .x-tab-strip-active .x-tab-right{background:no-repeat bottom right}.x-tab-strip-bottom .x-tab-strip-active .x-tab-left{background:no-repeat bottom left}.x-tab-strip-bottom .x-tab-left{margin-right:3px;padding:0 10px}.x-tab-strip-bottom .x-tab-right{padding:0}.x-tab-strip .x-tab-strip-close{display:none}.x-tab-strip-closable{position:relative}.x-tab-strip-closable .x-tab-left{padding-right:19px}.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close{opacity:.6;-moz-opacity:.6;background-repeat:no-repeat;display:block;width:11px;height:11px;position:absolute;top:3px;right:3px;cursor:pointer;z-index:2}.x-tab-strip .x-tab-strip-active a.x-tab-strip-close{opacity:.8;-moz-opacity:.8}.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close:hover{opacity:1;-moz-opacity:1}.x-tab-panel-body{border:1px solid}.x-tab-panel-body-top{border-top:0 none}.x-tab-panel-body-bottom{border-bottom:0 none}.x-tab-scroller-left{background:transparent no-repeat -18px 0;border-bottom:1px solid;width:18px;position:absolute;left:0;top:0;z-index:10;cursor:pointer}.x-tab-scroller-left-over{background-position:0 0}.x-tab-scroller-left-disabled{background-position:-18px 0;opacity:.5;-moz-opacity:.5;filter:alpha(opacity=50);cursor:default}.x-tab-scroller-right{background:transparent no-repeat 0 0;border-bottom:1px solid;width:18px;position:absolute;right:0;top:0;z-index:10;cursor:pointer}.x-tab-scroller-right-over{background-position:-18px 0}.x-tab-scroller-right-disabled{background-position:0 0;opacity:.5;-moz-opacity:.5;filter:alpha(opacity=50);cursor:default}.x-tab-scrolling-bottom .x-tab-scroller-left,.x-tab-scrolling-bottom .x-tab-scroller-right{margin-top:1px}.x-tab-scrolling .x-tab-strip-wrap{margin-left:18px;margin-right:18px}.x-tab-scrolling{position:relative}.x-tab-panel-bbar .x-toolbar{border:1px solid;border-top:0 none;overflow:hidden;padding:2px}.x-tab-panel-tbar .x-toolbar{border:1px solid;border-top:0 none;overflow:hidden;padding:2px}.x-form-field{margin:0}.ext-webkit *:focus{outline:none!important}.x-form-text,textarea.x-form-field{padding:1px 3px;background:repeat-x 0 0;border:1px solid}textarea.x-form-field{padding:2px 3px}.x-form-text,.ext-ie .x-form-file{height:22px;line-height:18px;vertical-align:middle}.ext-ie6 .x-form-text,.ext-ie7 .x-form-text{margin:-1px 0;height:22px;line-height:18px}.x-quirks .ext-ie9 .x-form-text{height:22px;padding-top:3px;padding-bottom:0}.x-quirks .ext-ie9 .x-input-wrapper .x-form-text,.x-quirks .ext-ie9 .x-form-field-trigger-wrap .x-form-text{margin-top:-1px;margin-bottom:-1px}.x-quirks .ext-ie9 .x-input-wrapper .x-form-element{margin-bottom:-1px}.ext-ie6 .x-form-field-wrap .x-form-file-btn,.ext-ie7 .x-form-field-wrap .x-form-file-btn{top:-1px}.ext-ie6 textarea.x-form-field,.ext-ie7 textarea.x-form-field{margin:-1px 0}.ext-strict .x-form-text{height:18px}.ext-safari.ext-mac textarea.x-form-field{margin-bottom:-2px}.ext-gecko .x-form-text,.ext-ie8 .x-form-text{padding-top:2px;padding-bottom:0}.ext-ie6 .x-form-composite .x-form-text.x-box-item,.ext-ie7 .x-form-composite .x-form-text.x-box-item{margin:0!important}textarea{resize:none}.x-form-select-one{height:20px;line-height:18px;vertical-align:middle;border:1px solid}.x-form-check-wrap{line-height:18px;height:auto}.ext-ie .x-form-check-wrap input{width:15px;height:15px}.x-form-check-wrap input{vertical-align:bottom}.x-editor .x-form-check-wrap{padding:3px}.x-editor .x-form-checkbox{height:13px}.x-form-check-group-label{border-bottom:1px solid;margin-bottom:5px;padding-left:3px!important;float:none!important}.x-form-field-wrap .x-form-trigger{width:17px;height:21px;border:0;background:transparent no-repeat 0 0;cursor:pointer;border-bottom:1px solid;position:absolute;top:0}.x-form-field-wrap .x-form-date-trigger,.x-form-field-wrap .x-form-clear-trigger,.x-form-field-wrap .x-form-search-trigger{cursor:pointer}.x-form-field-wrap .x-form-twin-triggers .x-form-trigger{position:static;top:auto;vertical-align:top}.x-form-field-wrap{position:relative;left:0;top:0;text-align:left;zoom:1;white-space:nowrap}.ext-strict .ext-ie8 .x-toolbar-cell .x-form-field-trigger-wrap .x-form-trigger{right:0}.x-form-field-wrap .x-form-trigger-over{background-position:-17px 0}.x-form-field-wrap .x-form-trigger-click{background-position:-34px 0}.x-trigger-wrap-focus .x-form-trigger{background-position:-51px 0}.x-trigger-wrap-focus .x-form-trigger-over{background-position:-68px 0}.x-trigger-wrap-focus .x-form-trigger-click{background-position:-85px 0}.x-trigger-wrap-focus .x-form-trigger{border-bottom:1px solid}.x-item-disabled .x-form-trigger-over{background-position:0 0!important;border-bottom:1px solid}.x-item-disabled .x-form-trigger-click{background-position:0 0!important;border-bottom:1px solid}.x-trigger-noedit{cursor:pointer}.x-form-focus,textarea.x-form-focus{border:1px solid}.x-form-invalid,textarea.x-form-invalid{background:repeat-x bottom;border:1px solid}.x-form-inner-invalid,textarea.x-form-inner-invalid{background:repeat-x bottom}.x-editor{visibility:hidden;padding:0;margin:0}.x-form-grow-sizer{left:-10000px;padding:8px 3px;position:absolute;visibility:hidden;top:-10000px;white-space:pre-wrap;white-space:-moz-pre-wrap;white-space:-pre-wrap;white-space:-o-pre-wrap;word-wrap:break-word;zoom:1}.x-form-grow-sizer p{margin:0!important;border:0 none!important;padding:0!important}.x-form-item{display:block;margin-bottom:4px;zoom:1}.x-form-item label.x-form-item-label{display:block;float:left;width:100px;padding:3px;padding-left:0;clear:left;z-index:2;position:relative}.x-form-element{padding-left:105px;position:relative}.x-form-invalid-msg{padding:2px;padding-left:18px;background:transparent no-repeat 0 2px;line-height:16px;width:200px}.x-form-label-left label.x-form-item-label{text-align:left}.x-form-label-right label.x-form-item-label{text-align:right}.x-form-label-top .x-form-item label.x-form-item-label{width:auto;float:none;clear:none;display:inline;margin-bottom:4px;position:static}.x-form-label-top .x-form-element{padding-left:0;padding-top:4px}.x-form-label-top .x-form-item{padding-bottom:4px}.x-small-editor .x-form-text{height:20px;line-height:16px;vertical-align:middle}.ext-ie6 .x-small-editor .x-form-text,.ext-ie7 .x-small-editor .x-form-text{margin-top:-1px!important;margin-bottom:-1px!important;height:20px!important;line-height:16px!important}.ext-strict .x-small-editor .x-form-text{height:16px!important}.ext-ie6 .x-small-editor .x-form-text,.ext-ie7 .x-small-editor .x-form-text{height:20px;line-height:16px}.ext-border-box .x-small-editor .x-form-text{height:20px}.x-small-editor .x-form-select-one{height:20px;line-height:16px;vertical-align:middle}.x-small-editor .x-form-num-field{text-align:right}.x-small-editor .x-form-field-wrap .x-form-trigger{height:19px}.ext-webkit .x-small-editor .x-form-text{padding-top:3px;font-size:100%}.ext-strict .ext-webkit .x-small-editor .x-form-text{height:14px!important}.x-form-clear{clear:both;height:0;overflow:hidden;line-height:0;font-size:0}.x-form-clear-left{clear:left;height:0;overflow:hidden;line-height:0;font-size:0}.ext-ie6 .x-form-check-wrap input,.ext-border-box .x-form-check-wrap input{margin-top:3px}.x-form-cb-label{position:relative;margin-left:4px;top:2px}.ext-ie .x-form-cb-label{top:1px}.ext-ie6 .x-form-cb-label,.ext-border-box .x-form-cb-label{top:3px}.x-form-display-field{padding-top:2px}.ext-gecko .x-form-display-field,.ext-strict .ext-ie7 .x-form-display-field{padding-top:1px}.ext-ie .x-form-display-field{padding-top:3px}.ext-strict .ext-ie8 .x-form-display-field{padding-top:0}.x-form-column{float:left;padding:0;margin:0;width:48%;overflow:hidden;zoom:1}.x-form .x-form-btns-ct .x-btn{float:right;clear:none}.x-form .x-form-btns-ct .x-form-btns td{border:0;padding:0}.x-form .x-form-btns-ct .x-form-btns-right table{float:right;clear:none}.x-form .x-form-btns-ct .x-form-btns-left table{float:left;clear:none}.x-form .x-form-btns-ct .x-form-btns-center{text-align:center}.x-form .x-form-btns-ct .x-form-btns-center table{margin:0 auto}.x-form .x-form-btns-ct table td.x-form-btn-td{padding:3px}.x-form .x-form-btns-ct .x-btn-focus .x-btn-left{background-position:0 -147px}.x-form .x-form-btns-ct .x-btn-focus .x-btn-right{background-position:0 -168px}.x-form .x-form-btns-ct .x-btn-focus .x-btn-center{background-position:0 -189px}.x-form .x-form-btns-ct .x-btn-click .x-btn-center{background-position:0 -126px}.x-form .x-form-btns-ct .x-btn-click .x-btn-right{background-position:0 -84px}.x-form .x-form-btns-ct .x-btn-click .x-btn-left{background-position:0 -63px}.x-form-invalid-icon{width:16px;height:18px;visibility:hidden;position:absolute;left:0;top:0;display:block;background:transparent no-repeat 0 2px}.x-fieldset{border:1px solid;padding:10px;margin-bottom:10px;display:block}.ext-webkit .x-fieldset-header{padding-top:1px}.ext-ie .x-fieldset legend{margin-bottom:10px}.ext-strict .ext-ie9 .x-fieldset legend.x-fieldset-header{padding-top:1px}.ext-ie .x-fieldset{padding-top:0;padding-bottom:10px}.x-fieldset legend .x-tool-toggle{margin-right:3px;margin-left:0;float:left!important}.x-fieldset legend input{margin-right:3px;float:left!important;height:13px;width:13px}fieldset.x-panel-collapsed{padding-bottom:0!important;border-width:1px 1px 0 1px!important;border-left-color:transparent;border-right-color:transparent}.ext-ie6 fieldset.x-panel-collapsed{padding-bottom:0!important;border-width:1px 0 0 0!important;margin-left:1px;margin-right:1px}fieldset.x-panel-collapsed .x-fieldset-bwrap{visibility:hidden;position:absolute;left:-1000px;top:-1000px}.ext-ie .x-fieldset-bwrap{zoom:1}.x-fieldset-noborder{border:0 none transparent}.x-fieldset-noborder legend{margin-left:-3px}.ext-ie .x-fieldset-noborder legend{position:relative;margin-bottom:23px}.ext-ie .x-fieldset-noborder legend span{position:absolute;left:16px}.ext-gecko .x-window-body .x-form-item{-moz-outline:0;outline:0;overflow:auto}.ext-mac.ext-gecko .x-window-body .x-form-item{overflow:hidden}.ext-gecko .x-form-item{-moz-outline:0;outline:0}.x-hide-label label.x-form-item-label{display:none}.x-hide-label .x-form-element{padding-left:0!important}.x-form-label-top .x-hide-label label.x-form-item-label{display:none}.x-fieldset{overflow:hidden}.x-fieldset-bwrap{overflow:hidden;zoom:1}.x-fieldset-body{overflow:hidden}.x-btn{cursor:pointer;white-space:nowrap}.x-btn button{border:0 none;background-color:transparent;padding-left:3px;padding-right:3px;cursor:pointer;margin:0;overflow:visible;width:auto;-moz-outline:0 none;outline:0 none}* html .ext-ie .x-btn button{width:1px}.ext-gecko .x-btn button,.ext-webkit .x-btn button{padding-left:0;padding-right:0}.ext-gecko .x-btn button::-moz-focus-inner{padding:0}.ext-ie .x-btn button{padding-top:2px}.x-btn td{padding:0!important}.x-btn-text{cursor:pointer;white-space:nowrap;padding:0}.x-btn-noicon .x-btn-small .x-btn-text{height:16px}.x-btn-noicon .x-btn-medium .x-btn-text{height:24px}.x-btn-noicon .x-btn-large .x-btn-text{height:32px}.x-btn-icon .x-btn-text{background-position:center;background-repeat:no-repeat}.x-btn-icon .x-btn-small .x-btn-text{height:16px;width:16px}.x-btn-icon .x-btn-medium .x-btn-text{height:24px;width:24px}.x-btn-icon .x-btn-large .x-btn-text{height:32px;width:32px}.x-btn-text-icon .x-btn-icon-small-left .x-btn-text{background-position:0 center;background-repeat:no-repeat;padding-left:18px;height:16px}.x-btn-text-icon .x-btn-icon-medium-left .x-btn-text{background-position:0 center;background-repeat:no-repeat;padding-left:26px;height:24px}.x-btn-text-icon .x-btn-icon-large-left .x-btn-text{background-position:0 center;background-repeat:no-repeat;padding-left:34px;height:32px}.x-btn-text-icon .x-btn-icon-small-top .x-btn-text{background-position:center 0;background-repeat:no-repeat;padding-top:18px}.x-btn-text-icon .x-btn-icon-medium-top .x-btn-text{background-position:center 0;background-repeat:no-repeat;padding-top:26px}.x-btn-text-icon .x-btn-icon-large-top .x-btn-text{background-position:center 0;background-repeat:no-repeat;padding-top:34px}.x-btn-text-icon .x-btn-icon-small-right .x-btn-text{background-position:right center;background-repeat:no-repeat;padding-right:18px;height:16px}.x-btn-text-icon .x-btn-icon-medium-right .x-btn-text{background-position:right center;background-repeat:no-repeat;padding-right:26px;height:24px}.x-btn-text-icon .x-btn-icon-large-right .x-btn-text{background-position:right center;background-repeat:no-repeat;padding-right:34px;height:32px}.x-btn-text-icon .x-btn-icon-small-bottom .x-btn-text{background-position:center bottom;background-repeat:no-repeat;padding-bottom:18px}.x-btn-text-icon .x-btn-icon-medium-bottom .x-btn-text{background-position:center bottom;background-repeat:no-repeat;padding-bottom:26px}.x-btn-text-icon .x-btn-icon-large-bottom .x-btn-text{background-position:center bottom;background-repeat:no-repeat;padding-bottom:34px}.x-btn-tr i,.x-btn-tl i,.x-btn-mr i,.x-btn-ml i,.x-btn-br i,.x-btn-bl i{font-size:1px;line-height:1px;width:3px;display:block;overflow:hidden}.x-btn-tr i,.x-btn-tl i,.x-btn-br i,.x-btn-bl i{height:3px}.x-btn-tl{width:3px;height:3px;background:no-repeat 0 0}.x-btn-tr{width:3px;height:3px;background:no-repeat -3px 0}.x-btn-tc{height:3px;background:repeat-x 0 -6px}.x-btn-ml{width:3px;background:no-repeat 0 -24px}.x-btn-mr{width:3px;background:no-repeat -3px -24px}.x-btn-mc{background:repeat-x 0 -1096px;vertical-align:middle;text-align:center;padding:0 5px;cursor:pointer;white-space:nowrap}.ext-strict .ext-ie6 .x-btn-mc,.ext-strict .ext-ie7 .x-btn-mc{height:100%}.x-btn-bl{width:3px;height:3px;background:no-repeat 0 -3px}.x-btn-br{width:3px;height:3px;background:no-repeat -3px -3px}.x-btn-bc{height:3px;background:repeat-x 0 -15px}.x-btn-over .x-btn-tl{background-position:-6px 0}.x-btn-over .x-btn-tr{background-position:-9px 0}.x-btn-over .x-btn-tc{background-position:0 -9px}.x-btn-over .x-btn-ml{background-position:-6px -24px}.x-btn-over .x-btn-mr{background-position:-9px -24px}.x-btn-over .x-btn-mc{background-position:0 -2168px}.x-btn-over .x-btn-bl{background-position:-6px -3px}.x-btn-over .x-btn-br{background-position:-9px -3px}.x-btn-over .x-btn-bc{background-position:0 -18px}.x-btn-click .x-btn-tl,.x-btn-menu-active .x-btn-tl,.x-btn-pressed .x-btn-tl{background-position:-12px 0}.x-btn-click .x-btn-tr,.x-btn-menu-active .x-btn-tr,.x-btn-pressed .x-btn-tr{background-position:-15px 0}.x-btn-click .x-btn-tc,.x-btn-menu-active .x-btn-tc,.x-btn-pressed .x-btn-tc{background-position:0 -12px}.x-btn-click .x-btn-ml,.x-btn-menu-active .x-btn-ml,.x-btn-pressed .x-btn-ml{background-position:-12px -24px}.x-btn-click .x-btn-mr,.x-btn-menu-active .x-btn-mr,.x-btn-pressed .x-btn-mr{background-position:-15px -24px}.x-btn-click .x-btn-mc,.x-btn-menu-active .x-btn-mc,.x-btn-pressed .x-btn-mc{background-position:0 -3240px}.x-btn-click .x-btn-bl,.x-btn-menu-active .x-btn-bl,.x-btn-pressed .x-btn-bl{background-position:-12px -3px}.x-btn-click .x-btn-br,.x-btn-menu-active .x-btn-br,.x-btn-pressed .x-btn-br{background-position:-15px -3px}.x-btn-click .x-btn-bc,.x-btn-menu-active .x-btn-bc,.x-btn-pressed .x-btn-bc{background-position:0 -21px}.x-btn-disabled *{cursor:default!important}.x-btn-mc em.x-btn-arrow{display:block;background:transparent no-repeat right center;padding-right:10px}.x-btn-mc em.x-btn-split{display:block;background:transparent no-repeat right center;padding-right:14px}.x-btn-mc em.x-btn-arrow-bottom{display:block;background:transparent no-repeat center bottom;padding-bottom:14px}.x-btn-mc em.x-btn-split-bottom{display:block;background:transparent no-repeat center bottom;padding-bottom:14px}.x-btn-as-arrow .x-btn-mc em{display:block;background-color:transparent;padding-bottom:14px}.x-btn-group{padding:1px}.x-btn-group-header{padding:2px;text-align:center}.x-btn-group-tc{background:transparent repeat-x 0 0;overflow:hidden}.x-btn-group-tl{background:transparent no-repeat 0 0;padding-left:3px;zoom:1}.x-btn-group-tr{background:transparent no-repeat right 0;zoom:1;padding-right:3px}.x-btn-group-bc{background:transparent repeat-x 0 bottom;zoom:1}.x-btn-group-bc .x-panel-footer{zoom:1}.x-btn-group-bl{background:transparent no-repeat 0 bottom;padding-left:3px;zoom:1}.x-btn-group-br{background:transparent no-repeat right bottom;padding-right:3px;zoom:1}.x-btn-group-mc{border:0 none;padding:1px 0 0 0;margin:0}.x-btn-group-mc .x-btn-group-body{background-color:transparent;border:0 none}.x-btn-group-ml{background:transparent repeat-y 0 0;padding-left:3px;zoom:1}.x-btn-group-mr{background:transparent repeat-y right 0;padding-right:3px;zoom:1}.x-btn-group-bc .x-btn-group-footer{padding-bottom:6px}.x-panel-nofooter .x-btn-group-bc{height:3px;font-size:0;line-height:0}.x-btn-group-bwrap{overflow:hidden;zoom:1}.x-btn-group-body{overflow:hidden;zoom:1}.x-btn-group-notitle .x-btn-group-tc{background:transparent repeat-x 0 0;overflow:hidden;height:2px}.x-toolbar{border-style:solid;border-width:0 0 1px 0;display:block;padding:2px;background:repeat-x top left;position:relative;left:0;top:0;zoom:1;overflow:hidden}.x-toolbar-left{width:100%}.x-toolbar .x-item-disabled .x-btn-icon{opacity:.35;-moz-opacity:.35;filter:alpha(opacity=35)}.x-toolbar td{vertical-align:middle}.x-toolbar td,.x-toolbar span,.x-toolbar input,.x-toolbar div,.x-toolbar select,.x-toolbar label{white-space:nowrap}.x-toolbar .x-item-disabled{cursor:default;opacity:.6;-moz-opacity:.6;filter:alpha(opacity=60)}.x-toolbar .x-item-disabled *{cursor:default}.x-toolbar .x-toolbar-cell{vertical-align:middle}.x-toolbar .x-btn-tl,.x-toolbar .x-btn-tr,.x-toolbar .x-btn-tc,.x-toolbar .x-btn-ml,.x-toolbar .x-btn-mr,.x-toolbar .x-btn-mc,.x-toolbar .x-btn-bl,.x-toolbar .x-btn-br,.x-toolbar .x-btn-bc{background-position:500px 500px}.x-toolbar .x-btn-over .x-btn-tl{background-position:-6px 0}.x-toolbar .x-btn-over .x-btn-tr{background-position:-9px 0}.x-toolbar .x-btn-over .x-btn-tc{background-position:0 -9px}.x-toolbar .x-btn-over .x-btn-ml{background-position:-6px -24px}.x-toolbar .x-btn-over .x-btn-mr{background-position:-9px -24px}.x-toolbar .x-btn-over .x-btn-mc{background-position:0 -2168px}.x-toolbar .x-btn-over .x-btn-bl{background-position:-6px -3px}.x-toolbar .x-btn-over .x-btn-br{background-position:-9px -3px}.x-toolbar .x-btn-over .x-btn-bc{background-position:0 -18px}.x-toolbar .x-btn-click .x-btn-tl,.x-toolbar .x-btn-menu-active .x-btn-tl,.x-toolbar .x-btn-pressed .x-btn-tl{background-position:-12px 0}.x-toolbar .x-btn-click .x-btn-tr,.x-toolbar .x-btn-menu-active .x-btn-tr,.x-toolbar .x-btn-pressed .x-btn-tr{background-position:-15px 0}.x-toolbar .x-btn-click .x-btn-tc,.x-toolbar .x-btn-menu-active .x-btn-tc,.x-toolbar .x-btn-pressed .x-btn-tc{background-position:0 -12px}.x-toolbar .x-btn-click .x-btn-ml,.x-toolbar .x-btn-menu-active .x-btn-ml,.x-toolbar .x-btn-pressed .x-btn-ml{background-position:-12px -24px}.x-toolbar .x-btn-click .x-btn-mr,.x-toolbar .x-btn-menu-active .x-btn-mr,.x-toolbar .x-btn-pressed .x-btn-mr{background-position:-15px -24px}.x-toolbar .x-btn-click .x-btn-mc,.x-toolbar .x-btn-menu-active .x-btn-mc,.x-toolbar .x-btn-pressed .x-btn-mc{background-position:0 -3240px}.x-toolbar .x-btn-click .x-btn-bl,.x-toolbar .x-btn-menu-active .x-btn-bl,.x-toolbar .x-btn-pressed .x-btn-bl{background-position:-12px -3px}.x-toolbar .x-btn-click .x-btn-br,.x-toolbar .x-btn-menu-active .x-btn-br,.x-toolbar .x-btn-pressed .x-btn-br{background-position:-15px -3px}.x-toolbar .x-btn-click .x-btn-bc,.x-toolbar .x-btn-menu-active .x-btn-bc,.x-toolbar .x-btn-pressed .x-btn-bc{background-position:0 -21px}.x-toolbar div.xtb-text{padding:2px 2px 0;line-height:16px;display:block}.x-toolbar .xtb-sep{background-position:center;background-repeat:no-repeat;display:block;font-size:1px;height:16px;width:4px;overflow:hidden;cursor:default;margin:0 2px 0;border:0}.x-toolbar .xtb-spacer{width:2px}.x-tbar-page-number{width:30px;height:14px}.ext-ie .x-tbar-page-number{margin-top:2px}.x-paging-info{position:absolute;top:5px;right:8px}.x-toolbar-ct{width:100%}.x-toolbar-right td{text-align:center}.x-panel-tbar,.x-panel-bbar,.x-window-tbar,.x-window-bbar,.x-tab-panel-tbar,.x-tab-panel-bbar,.x-plain-tbar,.x-plain-bbar{overflow:hidden;zoom:1}.x-toolbar-more .x-btn-small .x-btn-text{height:16px;width:12px}.x-toolbar-more em.x-btn-arrow{display:inline;background-color:transparent;padding-right:0}.x-toolbar-more .x-btn-mc em.x-btn-arrow{background-image:none}div.x-toolbar-no-items{color:gray!important;padding:5px 10px!important}.ext-border-box .x-toolbar-cell .x-form-text{margin-bottom:-1px!important}.ext-border-box .x-toolbar-cell .x-form-field-wrap .x-form-text{margin:0!important}.ext-ie .x-toolbar-cell .x-form-field-wrap{height:21px}.ext-ie .x-toolbar-cell .x-form-text{position:relative;top:-1px}.ext-strict .ext-ie8 .x-toolbar-cell .x-form-field-trigger-wrap .x-form-text,.ext-strict .ext-ie .x-toolbar-cell .x-form-text{top:0}.x-toolbar-right td .x-form-field-trigger-wrap{text-align:left}.x-toolbar-cell .x-form-checkbox,.x-toolbar-cell .x-form-radio{margin-top:5px}.x-toolbar-cell .x-form-cb-label{vertical-align:bottom;top:1px}.ext-ie .x-toolbar-cell .x-form-checkbox,.ext-ie .x-toolbar-cell .x-form-radio{margin-top:4px}.ext-ie .x-toolbar-cell .x-form-cb-label{top:0}.x-grid3{position:relative;overflow:hidden}.x-grid-panel .x-panel-body{overflow:hidden!important}.x-grid-panel .x-panel-mc .x-panel-body{border:1px solid}.x-grid3 table{table-layout:fixed}.x-grid3-viewport{overflow:hidden}.x-grid3-hd-row td,.x-grid3-row td,.x-grid3-summary-row td{-moz-outline:0;outline:0;-moz-user-focus:normal}.x-grid3-row td,.x-grid3-summary-row td{line-height:13px;vertical-align:top;padding-left:1px;padding-right:1px;-moz-user-select:none;-khtml-user-select:none;-webkit-user-select:ignore}.x-grid3-cell{-moz-user-select:none;-khtml-user-select:none;-webkit-user-select:ignore}.x-grid3-hd-row td{line-height:15px;vertical-align:middle;border-left:1px solid;border-right:1px solid}.x-grid3-hd-row .x-grid3-marker-hd{padding:3px}.x-grid3-row .x-grid3-marker{padding:3px}.x-grid3-cell-inner,.x-grid3-hd-inner{overflow:hidden;-o-text-overflow:ellipsis;text-overflow:ellipsis;padding:3px 3px 3px 5px;white-space:nowrap}.x-action-col-cell .x-grid3-cell-inner{padding-top:1px;padding-bottom:1px}.x-action-col-icon{cursor:pointer}.x-grid3-hd-inner{position:relative;cursor:inherit;padding:4px 3px 4px 5px}.x-grid3-row-body{white-space:normal}.x-grid3-body-cell{-moz-outline:0 none;outline:0 none}.ext-ie .x-grid3-cell-inner,.ext-ie .x-grid3-hd-inner{width:100%}.ext-strict .x-grid3-cell-inner,.ext-strict .x-grid3-hd-inner{width:auto}.x-grid-row-loading{background:no-repeat center center}.x-grid-page{overflow:hidden}.x-grid3-row{cursor:default;border:1px solid;width:100%}.x-grid3-row-over{border:1px solid;background:repeat-x left top}.x-grid3-resize-proxy{width:1px;left:0;cursor:e-resize;cursor:col-resize;position:absolute;top:0;height:100px;overflow:hidden;visibility:hidden;border:0 none;z-index:7}.x-grid3-resize-marker{width:1px;left:0;position:absolute;top:0;height:100px;overflow:hidden;visibility:hidden;border:0 none;z-index:7}.x-grid3-focus{position:absolute;left:0;top:0;width:1px;height:1px;line-height:1px;font-size:1px;-moz-outline:0 none;outline:0 none;-moz-user-select:text;-khtml-user-select:text;-webkit-user-select:ignore}.x-grid3-header{background:repeat-x 0 bottom;cursor:default;zoom:1;padding:1px 0 0 0}.x-grid3-header-pop{border-left:1px solid;float:right;clear:none}.x-grid3-header-pop-inner{border-left:1px solid;width:14px;height:19px;background:transparent no-repeat center center}.ext-ie .x-grid3-header-pop-inner{width:15px}.ext-strict .x-grid3-header-pop-inner{width:14px}.x-grid3-header-inner{overflow:hidden;zoom:1;float:left}.x-grid3-header-offset{padding-left:1px;text-align:left}td.x-grid3-hd-over,td.sort-desc,td.sort-asc,td.x-grid3-hd-menu-open{border-left:1px solid;border-right:1px solid}td.x-grid3-hd-over .x-grid3-hd-inner,td.sort-desc .x-grid3-hd-inner,td.sort-asc .x-grid3-hd-inner,td.x-grid3-hd-menu-open .x-grid3-hd-inner{background:repeat-x left bottom}.x-grid3-sort-icon{background-repeat:no-repeat;display:none;height:4px;width:13px;margin-left:3px;vertical-align:middle}.sort-asc .x-grid3-sort-icon,.sort-desc .x-grid3-sort-icon{display:inline}.ext-strict .ext-ie .x-grid3-header-inner,.ext-strict .ext-ie6 .x-grid3-hd{position:relative}.ext-strict .ext-ie6 .x-grid3-hd-inner{position:static}.x-grid3-body{zoom:1}.x-grid3-scroller{overflow:auto;zoom:1;position:relative}.x-grid3-cell-text,.x-grid3-hd-text{display:block;padding:3px 5px 3px 5px;-moz-user-select:none;-khtml-user-select:none;-webkit-user-select:ignore}.x-grid3-split{background-position:center;background-repeat:no-repeat;cursor:e-resize;cursor:col-resize;display:block;font-size:1px;height:16px;overflow:hidden;position:absolute;top:2px;width:6px;z-index:3}.x-dd-drag-proxy .x-grid3-hd-inner{background:repeat-x left bottom;width:120px;padding:3px;border:1px solid;overflow:hidden}.col-move-top,.col-move-bottom{width:9px;height:9px;position:absolute;top:0;line-height:1px;font-size:1px;overflow:hidden;visibility:hidden;z-index:20000;background:transparent no-repeat left top}.x-grid3-row-selected{border:1px dotted}.x-grid3-locked td.x-grid3-row-marker,.x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker{background:repeat-x 0 bottom!important;vertical-align:middle!important;padding:0;border-top:1px solid;border-bottom:none!important;border-right:1px solid!important;text-align:center}.x-grid3-locked td.x-grid3-row-marker div,.x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker div{padding:0 4px;text-align:center}.x-grid3-dirty-cell{background:transparent no-repeat 0 0}.x-grid3-topbar,.x-grid3-bottombar{overflow:hidden;display:none;zoom:1;position:relative}.x-grid3-topbar .x-toolbar{border-right:0 none}.x-grid3-bottombar .x-toolbar{border-right:0 none;border-bottom:0 none;border-top:1px solid}.x-props-grid .x-grid3-cell{padding:1px}.x-props-grid .x-grid3-td-name .x-grid3-cell-inner{background:transparent repeat-y -16px!important;padding-left:12px}.x-props-grid .x-grid3-body .x-grid3-td-name{padding:1px;padding-right:0;border:0 none;border-right:1px solid}.x-grid3-col-dd{border:0 none;padding:0;background-color:transparent}.x-dd-drag-ghost .x-grid3-dd-wrap{padding:1px 3px 3px 1px}.x-grid3-hd{-moz-user-select:none;-khtml-user-select:none;-webkit-user-select:ignore}.x-grid3-hd-btn{display:none;position:absolute;width:14px;background:no-repeat left center;right:0;top:0;z-index:2;cursor:pointer}.x-grid3-hd-over .x-grid3-hd-btn,.x-grid3-hd-menu-open .x-grid3-hd-btn{display:block}a.x-grid3-hd-btn:hover{background-position:-14px center}.x-grid3-body .x-grid3-td-expander{background:transparent repeat-y right}.x-grid3-body .x-grid3-td-expander .x-grid3-cell-inner{padding:0!important;height:100%}.x-grid3-row-expander{width:100%;height:18px;background-position:4px 2px;background-repeat:no-repeat;background-color:transparent}.x-grid3-row-collapsed .x-grid3-row-expander{background-position:4px 2px}.x-grid3-row-expanded .x-grid3-row-expander{background-position:-21px 2px}.x-grid3-row-collapsed .x-grid3-row-body{display:none!important}.x-grid3-row-expanded .x-grid3-row-body{display:block!important}.x-grid3-body .x-grid3-td-checker{background:transparent repeat-y right}.x-grid3-body .x-grid3-td-checker .x-grid3-cell-inner,.x-grid3-header .x-grid3-td-checker .x-grid3-hd-inner{padding:0!important;height:100%}.x-grid3-row-checker,.x-grid3-hd-checker{width:100%;height:18px;background-position:2px 2px;background-repeat:no-repeat;background-color:transparent}.x-grid3-row .x-grid3-row-checker{background-position:2px 2px}.x-grid3-row-selected .x-grid3-row-checker,.x-grid3-hd-checker-on .x-grid3-hd-checker,.x-grid3-row-checked .x-grid3-row-checker{background-position:-23px 2px}.x-grid3-hd-checker{background-position:2px 1px}.ext-border-box .x-grid3-hd-checker{background-position:2px 3px}.x-grid3-hd-checker-on .x-grid3-hd-checker{background-position:-23px 1px}.ext-border-box .x-grid3-hd-checker-on .x-grid3-hd-checker{background-position:-23px 3px}.x-grid3-body .x-grid3-td-numberer{background:transparent repeat-y right}.x-grid3-body .x-grid3-td-numberer .x-grid3-cell-inner{padding:3px 5px 0 0!important;text-align:right}.x-grid3-body .x-grid3-td-row-icon{background:transparent repeat-y right;vertical-align:top;text-align:center}.x-grid3-body .x-grid3-td-row-icon .x-grid3-cell-inner{padding:0!important;background-position:center center;background-repeat:no-repeat;width:16px;height:16px;margin-left:2px;margin-top:3px}.x-grid3-body .x-grid3-row-selected .x-grid3-td-numberer,.x-grid3-body .x-grid3-row-selected .x-grid3-td-checker,.x-grid3-body .x-grid3-row-selected .x-grid3-td-expander{background:transparent repeat-y right}.x-grid3-body .x-grid3-check-col-td .x-grid3-cell-inner{padding:1px 0 0 0!important}.x-grid3-check-col{width:100%;height:16px;background-position:center center;background-repeat:no-repeat;background-color:transparent}.x-grid3-check-col-on{width:100%;height:16px;background-position:center center;background-repeat:no-repeat;background-color:transparent}.x-grid-group,.x-grid-group-body,.x-grid-group-hd{zoom:1}.x-grid-group-hd{border-bottom:2px solid;cursor:pointer;padding-top:6px}.x-grid-group-hd div.x-grid-group-title{background:transparent no-repeat 3px 3px;padding:4px 4px 4px 17px}.x-grid-group-collapsed .x-grid-group-body{display:none}.ext-ie6 .x-grid3 .x-editor .x-form-text,.ext-ie7 .x-grid3 .x-editor .x-form-text{position:relative;top:-1px}.x-grid-editor .x-form-check-wrap{text-align:center;margin-top:-4px}.ext-ie .x-props-grid .x-editor .x-form-text{position:static;top:0}.x-grid-empty{padding:10px}.ext-ie7 .x-grid-panel .x-panel-bbar{position:relative}.ext-ie7 .x-grid-panel .x-panel-mc .x-panel-bbar{position:static}.ext-ie6 .x-grid3-header{position:relative}.ext-webkit .x-grid-panel .x-panel-bwrap{-webkit-user-select:none}.ext-webkit .x-tbar-page-number{-webkit-user-select:ignore}.x-grid-with-col-lines .x-grid3-row td.x-grid3-cell{padding-right:0;border-right:1px solid}.x-pivotgrid .x-grid3-header-offset table{width:100%;border-collapse:collapse}.x-pivotgrid .x-grid3-header-offset table td{padding:4px 3px 4px 5px;text-align:center;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;font-size:11px;line-height:13px;font-family:tahoma}.x-pivotgrid .x-grid3-row-headers{display:block;float:left}.x-pivotgrid .x-grid3-row-headers table{height:100%;width:100%;border-collapse:collapse}.x-pivotgrid .x-grid3-row-headers table td{height:18px;padding:2px 7px 0 0;text-align:right;text-overflow:ellipsis;font-size:11px;font-family:tahoma}.ext-gecko .x-pivotgrid .x-grid3-row-headers table td{height:21px}.x-grid3-header-title{top:0;left:0;position:absolute;text-align:center;vertical-align:middle;font-family:tahoma;font-size:11px;padding:auto 1px;display:table-cell}.x-grid3-header-title span{position:absolute;top:50%;left:0;width:100%;margin-top:-6px}.x-dd-drag-proxy{position:absolute;left:0;top:0;visibility:hidden;z-index:15000}.x-dd-drag-ghost{-moz-opacity:.85;opacity:.85;filter:alpha(opacity=85);border:1px solid;padding:3px;padding-left:20px;white-space:nowrap}.x-dd-drag-repair .x-dd-drag-ghost{-moz-opacity:.4;opacity:.4;filter:alpha(opacity=40);border:0 none;padding:0;background-color:transparent}.x-dd-drag-repair .x-dd-drop-icon{visibility:hidden}.x-dd-drop-icon{position:absolute;top:3px;left:3px;display:block;width:16px;height:16px;background-color:transparent;background-position:center;background-repeat:no-repeat;z-index:1}.x-view-selector{position:absolute;left:0;top:0;width:0;border:1px dotted;opacity:.5;-moz-opacity:.5;filter:alpha(opacity=50);zoom:1}.ext-strict .ext-ie .x-tree .x-panel-bwrap{position:relative;overflow:hidden}.x-tree-icon,.x-tree-ec-icon,.x-tree-elbow-line,.x-tree-elbow,.x-tree-elbow-end,.x-tree-elbow-plus,.x-tree-elbow-minus,.x-tree-elbow-end-plus,.x-tree-elbow-end-minus{border:0 none;height:18px;margin:0;padding:0;vertical-align:top;width:16px;background-repeat:no-repeat}.x-tree-node-collapsed .x-tree-node-icon,.x-tree-node-expanded .x-tree-node-icon,.x-tree-node-leaf .x-tree-node-icon{border:0 none;height:18px;margin:0;padding:0;vertical-align:top;width:16px;background-position:center;background-repeat:no-repeat}.ext-ie .x-tree-node-indent img,.ext-ie .x-tree-node-icon,.ext-ie .x-tree-ec-icon{vertical-align:middle!important}.ext-strict .ext-ie8 .x-tree-node-indent img,.ext-strict .ext-ie8 .x-tree-node-icon,.ext-strict .ext-ie8 .x-tree-ec-icon{vertical-align:top!important}input.x-tree-node-cb{margin-left:1px;height:19px;vertical-align:bottom}.ext-ie input.x-tree-node-cb{margin-left:0;margin-top:1px;width:16px;height:16px;vertical-align:middle}.ext-strict .ext-ie8 input.x-tree-node-cb{margin:1px 1px;height:14px;vertical-align:bottom}.ext-strict .ext-ie8 input.x-tree-node-cb+a{vertical-align:bottom}.ext-opera input.x-tree-node-cb{height:14px;vertical-align:middle}.x-tree-noicon .x-tree-node-icon{width:0;height:0}.x-tree-no-lines .x-tree-elbow{background-color:transparent}.x-tree-no-lines .x-tree-elbow-end{background-color:transparent}.x-tree-no-lines .x-tree-elbow-line{background-color:transparent}.x-tree-arrows .x-tree-elbow{background-color:transparent}.x-tree-arrows .x-tree-elbow-plus{background:transparent no-repeat 0 0}.x-tree-arrows .x-tree-elbow-minus{background:transparent no-repeat -16px 0}.x-tree-arrows .x-tree-elbow-end{background-color:transparent}.x-tree-arrows .x-tree-elbow-end-plus{background:transparent no-repeat 0 0}.x-tree-arrows .x-tree-elbow-end-minus{background:transparent no-repeat -16px 0}.x-tree-arrows .x-tree-elbow-line{background-color:transparent}.x-tree-arrows .x-tree-ec-over .x-tree-elbow-plus{background-position:-32px 0}.x-tree-arrows .x-tree-ec-over .x-tree-elbow-minus{background-position:-48px 0}.x-tree-arrows .x-tree-ec-over .x-tree-elbow-end-plus{background-position:-32px 0}.x-tree-arrows .x-tree-ec-over .x-tree-elbow-end-minus{background-position:-48px 0}.x-tree-elbow-plus,.x-tree-elbow-minus,.x-tree-elbow-end-plus,.x-tree-elbow-end-minus{cursor:pointer}.ext-ie ul.x-tree-node-ct{font-size:0;line-height:0;zoom:1}.x-tree-node{white-space:nowrap}.x-tree-node-el{line-height:18px;cursor:pointer}.x-tree-node a,.x-dd-drag-ghost a{text-decoration:none;-khtml-user-select:none;-moz-user-select:none;-webkit-user-select:ignore;-kthml-user-focus:normal;-moz-user-focus:normal;-moz-outline:0 none;outline:0 none}.x-tree-node a span,.x-dd-drag-ghost a span{text-decoration:none;padding:1px 3px 1px 2px}.x-tree-node .x-tree-node-disabled .x-tree-node-icon{-moz-opacity:.5;opacity:.5;filter:alpha(opacity=50)}.x-tree-node .x-tree-node-inline-icon{background-color:transparent}.x-tree-node a:hover,.x-dd-drag-ghost a:hover{text-decoration:none}.x-tree-node div.x-tree-drag-insert-below{border-bottom:1px dotted}.x-tree-node div.x-tree-drag-insert-above{border-top:1px dotted}.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below{border-bottom:0 none}.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above{border-top:0 none}.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below a{border-bottom:2px solid}.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above a{border-top:2px solid}.x-tree-node .x-tree-drag-append a span{border:1px dotted}.x-dd-drag-ghost .x-tree-node-indent,.x-dd-drag-ghost .x-tree-ec-icon{display:none!important}.x-tree-root-ct{zoom:1}.x-date-picker{border:1px solid;border-top:0 none;position:relative}.x-date-picker a{-moz-outline:0 none;outline:0 none}.x-date-inner,.x-date-inner td,.x-date-inner th{border-collapse:separate}.x-date-middle,.x-date-left,.x-date-right{background:repeat-x 0 -83px;overflow:hidden}.x-date-middle .x-btn-tc,.x-date-middle .x-btn-tl,.x-date-middle .x-btn-tr,.x-date-middle .x-btn-mc,.x-date-middle .x-btn-ml,.x-date-middle .x-btn-mr,.x-date-middle .x-btn-bc,.x-date-middle .x-btn-bl,.x-date-middle .x-btn-br{background:transparent!important;vertical-align:middle}.x-date-middle .x-btn-mc em.x-btn-arrow{background:transparent no-repeat right 0}.x-date-right,.x-date-left{width:18px}.x-date-right{text-align:right}.x-date-middle{padding-top:2px;padding-bottom:2px;width:130px}.x-date-right a,.x-date-left a{display:block;width:16px;height:16px;background-position:center;background-repeat:no-repeat;cursor:pointer;-moz-opacity:.6;opacity:.6;filter:alpha(opacity=60)}.x-date-right a:hover,.x-date-left a:hover{-moz-opacity:1;opacity:1;filter:alpha(opacity=100)}.x-item-disabled .x-date-right a:hover,.x-item-disabled .x-date-left a:hover{-moz-opacity:.6;opacity:.6;filter:alpha(opacity=60)}.x-date-right a{margin-right:2px;text-decoration:none!important}.x-date-left a{margin-left:2px;text-decoration:none!important}table.x-date-inner{width:100%;table-layout:fixed}.ext-webkit table.x-date-inner{width:175px}.x-date-inner th{width:25px}.x-date-inner th{background:repeat-x left top;text-align:right!important;border-bottom:1px solid;cursor:default;padding:0;border-collapse:separate}.x-date-inner th span{display:block;padding:2px;padding-right:7px}.x-date-inner td{border:1px solid;text-align:right;padding:0}.x-date-inner a{padding:2px 5px;display:block;text-decoration:none;text-align:right;zoom:1}.x-date-inner .x-date-active{cursor:pointer;color:black}.x-date-inner .x-date-selected a{background:repeat-x left top;border:1px solid;padding:1px 4px}.x-date-inner .x-date-today a{border:1px solid;padding:1px 4px}.x-date-inner .x-date-prevday a,.x-date-inner .x-date-nextday a{text-decoration:none!important}.x-date-bottom{padding:4px;border-top:1px solid;background:repeat-x left top}.x-date-inner a:hover,.x-date-inner .x-date-disabled a:hover{text-decoration:none!important}.x-item-disabled .x-date-inner a:hover{background:0}.x-date-inner .x-date-disabled a{cursor:default}.x-date-menu .x-menu-item{padding:1px 24px 1px 4px;white-space:nowrap}.x-date-menu .x-menu-item .x-menu-item-icon{width:10px;height:10px;margin-right:5px;background-position:center -4px!important}.x-date-mp{position:absolute;left:0;top:0;display:none}.x-date-mp td{padding:2px;font:normal 11px arial,helvetica,tahoma,sans-serif}td.x-date-mp-month,td.x-date-mp-year,td.x-date-mp-ybtn{border:0 none;text-align:center;vertical-align:middle;width:25%}.x-date-mp-ok{margin-right:3px}.x-date-mp-btns button{text-decoration:none;text-align:center;text-decoration:none!important;border:1px solid;padding:1px 3px 1px;cursor:pointer}.x-date-mp-btns{background:repeat-x left top}.x-date-mp-btns td{border-top:1px solid;text-align:center}td.x-date-mp-month a,td.x-date-mp-year a{display:block;padding:2px 4px;text-decoration:none;text-align:center}td.x-date-mp-month a:hover,td.x-date-mp-year a:hover{text-decoration:none;cursor:pointer}td.x-date-mp-sel a{padding:1px 3px;background:repeat-x left top;border:1px solid}.x-date-mp-ybtn a{overflow:hidden;width:15px;height:15px;cursor:pointer;background:transparent no-repeat;display:block;margin:0 auto}.x-date-mp-ybtn a.x-date-mp-next{background-position:0 -120px}.x-date-mp-ybtn a.x-date-mp-next:hover{background-position:-15px -120px}.x-date-mp-ybtn a.x-date-mp-prev{background-position:0 -105px}.x-date-mp-ybtn a.x-date-mp-prev:hover{background-position:-15px -105px}.x-date-mp-ybtn{text-align:center}td.x-date-mp-sep{border-right:1px solid}.x-tip{position:absolute;top:0;left:0;visibility:hidden;z-index:20002;border:0 none}.x-tip .x-tip-close{height:15px;float:right;width:15px;margin:0 0 2px 2px;cursor:pointer;display:none}.x-tip .x-tip-tc{background:transparent no-repeat 0 -62px;padding-top:3px;overflow:hidden;zoom:1}.x-tip .x-tip-tl{background:transparent no-repeat 0 0;padding-left:6px;overflow:hidden;zoom:1}.x-tip .x-tip-tr{background:transparent no-repeat right 0;padding-right:6px;overflow:hidden;zoom:1}.x-tip .x-tip-bc{background:transparent no-repeat 0 -121px;height:3px;overflow:hidden}.x-tip .x-tip-bl{background:transparent no-repeat 0 -59px;padding-left:6px;zoom:1}.x-tip .x-tip-br{background:transparent no-repeat right -59px;padding-right:6px;zoom:1}.x-tip .x-tip-mc{border:0 none}.x-tip .x-tip-ml{background:no-repeat 0 -124px;padding-left:6px;zoom:1}.x-tip .x-tip-mr{background:transparent no-repeat right -124px;padding-right:6px;zoom:1}.ext-ie .x-tip .x-tip-header,.ext-ie .x-tip .x-tip-tc{font-size:0;line-height:0}.ext-border-box .x-tip .x-tip-header,.ext-border-box .x-tip .x-tip-tc{line-height:1px}.x-tip .x-tip-header-text{padding:0;margin:0 0 2px 0}.x-tip .x-tip-body{margin:0!important;line-height:14px;padding:0}.x-tip .x-tip-body .loading-indicator{margin:0}.x-tip-draggable .x-tip-header,.x-tip-draggable .x-tip-header-text{cursor:move}.x-form-invalid-tip .x-tip-tc{background:repeat-x 0 -12px;padding-top:6px}.x-form-invalid-tip .x-tip-bc{background:repeat-x 0 -18px;height:6px}.x-form-invalid-tip .x-tip-bl{background:no-repeat 0 -6px}.x-form-invalid-tip .x-tip-br{background:no-repeat right -6px}.x-form-invalid-tip .x-tip-body{padding:2px}.x-form-invalid-tip .x-tip-body{padding-left:24px;background:transparent no-repeat 2px 2px}.x-tip-anchor{position:absolute;width:9px;height:10px;overflow:hidden;background:transparent no-repeat 0 0;zoom:1}.x-tip-anchor-bottom{background-position:-9px 0}.x-tip-anchor-right{background-position:-18px 0;width:10px}.x-tip-anchor-left{background-position:-28px 0;width:10px}.x-menu{z-index:15000;zoom:1;background:repeat-y}.x-menu-floating{border:1px solid}.x-menu a{text-decoration:none!important}.ext-ie .x-menu{zoom:1;overflow:hidden}.x-menu-list{padding:2px;background-color:transparent;border:0 none;overflow:hidden;overflow-y:hidden}.ext-strict .ext-ie .x-menu-list{position:relative}.x-menu li{line-height:100%}.x-menu li.x-menu-sep-li{font-size:1px;line-height:1px}.x-menu-list-item{white-space:nowrap;display:block;padding:1px}.x-menu-item{-moz-user-select:none;-khtml-user-select:none;-webkit-user-select:ignore}.x-menu-item-arrow{background:transparent no-repeat right}.x-menu-sep{display:block;font-size:1px;line-height:1px;margin:2px 3px;border-bottom:1px solid;overflow:hidden}.x-menu-focus{position:absolute;left:-1px;top:-1px;width:1px;height:1px;line-height:1px;font-size:1px;-moz-outline:0 none;outline:0 none;-moz-user-select:none;-khtml-user-select:none;-webkit-user-select:ignore;overflow:hidden;display:block}a.x-menu-item{cursor:pointer;display:block;line-height:16px;outline-color:-moz-use-text-color;outline-style:none;outline-width:0;padding:3px 21px 3px 27px;position:relative;text-decoration:none;white-space:nowrap}.x-menu-item-active{background-repeat:repeat-x;background-position:left bottom;border-style:solid;border-width:1px 0;margin:0 1px;padding:0}.x-menu-item-active a.x-menu-item{border-style:solid;border-width:0 1px;margin:0 -1px}.x-menu-item-icon{border:0 none;height:16px;padding:0;vertical-align:top;width:16px;position:absolute;left:3px;top:3px;margin:0;background-position:center}.ext-ie .x-menu-item-icon{left:-24px}.ext-strict .x-menu-item-icon{left:3px}.ext-ie6 .x-menu-item-icon{left:-24px}.ext-ie .x-menu-item-icon{vertical-align:middle}.x-menu-check-item .x-menu-item-icon{background:transparent no-repeat center}.x-menu-group-item .x-menu-item-icon{background-color:transparent}.x-menu-item-checked .x-menu-group-item .x-menu-item-icon{background:transparent no-repeat center}.x-date-menu .x-menu-list{padding:0}.x-menu-date-item{padding:0}.x-menu .x-color-palette,.x-menu .x-date-picker{margin-left:26px;margin-right:4px}.x-menu .x-date-picker{border:1px solid;margin-top:2px;margin-bottom:2px}.x-menu-plain .x-color-palette,.x-menu-plain .x-date-picker{margin:0;border:0 none}.x-date-menu{padding:0!important}.ext-strict .ext-ie6 .x-menu-sep-li{padding:3px 4px}.ext-strict .ext-ie6 .x-menu-sep{margin:0;height:1px}.ext-webkit .x-menu-sep{height:1px}.ext-ie .x-date-menu{height:199px}.ext-strict .ext-ie .x-date-menu,.ext-border-box .ext-ie8 .x-date-menu{height:197px}.ext-strict .ext-ie7 .x-date-menu{height:195px}.ext-strict .ext-ie8 .x-date-menu{height:auto}.x-cycle-menu .x-menu-item-checked{border:1px dotted!important;padding:0}.x-menu .x-menu-scroller{width:100%;background-repeat:no-repeat;background-position:center;height:8px;line-height:8px;cursor:pointer;margin:0;padding:0}.x-menu .x-menu-scroller-active{height:6px;line-height:6px}.x-menu-list-item-indent{padding-left:27px}.x-box-tl{background:transparent no-repeat 0 0;zoom:1}.x-box-tc{height:8px;background:transparent repeat-x 0 0;overflow:hidden}.x-box-tr{background:transparent no-repeat right -8px}.x-box-ml{background:transparent repeat-y 0;padding-left:4px;overflow:hidden;zoom:1}.x-box-mc{background:repeat-x 0 -16px;padding:4px 10px}.x-box-mc h3{margin:0 0 4px 0;zoom:1}.x-box-mr{background:transparent repeat-y right;padding-right:4px;overflow:hidden}.x-box-bl{background:transparent no-repeat 0 -16px;zoom:1}.x-box-bc{background:transparent repeat-x 0 -8px;height:8px;overflow:hidden}.x-box-br{background:transparent no-repeat right -24px}.x-box-tl,.x-box-bl{padding-left:8px;overflow:hidden}.x-box-tr,.x-box-br{padding-right:8px;overflow:hidden}.x-combo-list{border:1px solid;zoom:1;overflow:hidden}.x-combo-list-inner{overflow:auto;position:relative;zoom:1;overflow-x:hidden}.x-combo-list-hd{border-bottom:1px solid;padding:3px}.x-resizable-pinned .x-combo-list-inner{border-bottom:1px solid}.x-combo-list-item{padding:2px;border:1px solid;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.x-combo-list .x-combo-selected{border:1px dotted!important;cursor:pointer}.x-combo-list .x-toolbar{border-top:1px solid;border-bottom:0 none}.x-panel{border-style:solid;border-width:0}.x-panel-header{overflow:hidden;zoom:1;padding:5px 3px 4px 5px;border:1px solid;line-height:15px;background:transparent repeat-x 0 -1px}.x-panel-body{border:1px solid;border-top:0 none;overflow:hidden;position:relative}.x-panel-bbar .x-toolbar,.x-panel-tbar .x-toolbar{border:1px solid;border-top:0 none;overflow:hidden;padding:2px}.x-panel-tbar-noheader .x-toolbar,.x-panel-mc .x-panel-tbar .x-toolbar{border-top:1px solid;border-bottom:0 none}.x-panel-body-noheader,.x-panel-mc .x-panel-body{border-top:1px solid}.x-panel-header{overflow:hidden;zoom:1}.x-panel-tl .x-panel-header{padding:5px 0 4px 0;border:0 none;background:transparent no-repeat}.x-panel-tl .x-panel-icon,.x-window-tl .x-panel-icon{padding-left:20px!important;background-repeat:no-repeat;background-position:0 4px;zoom:1}.x-panel-inline-icon{width:16px;height:16px;background-repeat:no-repeat;background-position:0 0;vertical-align:middle;margin-right:4px;margin-top:-1px;margin-bottom:-1px}.x-panel-tc{background:transparent repeat-x 0 0;overflow:hidden}.ext-strict .ext-ie7 .x-panel-tc{overflow:visible}.x-panel-tl{background:transparent no-repeat 0 0;padding-left:6px;zoom:1;border-bottom:1px solid}.x-panel-tr{background:transparent no-repeat right 0;zoom:1;padding-right:6px}.x-panel-bc{background:transparent repeat-x 0 bottom;zoom:1}.x-panel-bc .x-panel-footer{zoom:1}.x-panel-bl{background:transparent no-repeat 0 bottom;padding-left:6px;zoom:1}.x-panel-br{background:transparent no-repeat right bottom;padding-right:6px;zoom:1}.x-panel-mc{border:0 none;padding:0;margin:0;padding-top:6px}.x-panel-mc .x-panel-body{background-color:transparent;border:0 none}.x-panel-ml{background:repeat-y 0 0;padding-left:6px;zoom:1}.x-panel-mr{background:transparent repeat-y right 0;padding-right:6px;zoom:1}.x-panel-bc .x-panel-footer{padding-bottom:6px}.x-panel-nofooter .x-panel-bc,.x-panel-nofooter .x-window-bc{height:6px;font-size:0;line-height:0}.x-panel-bwrap{overflow:hidden;zoom:1;left:0;top:0}.x-panel-body{overflow:hidden;zoom:1}.x-panel-collapsed .x-resizable-handle{display:none}.ext-gecko .x-panel-animated div{overflow:hidden!important}.x-plain-body{overflow:hidden}.x-plain-bbar .x-toolbar{overflow:hidden;padding:2px}.x-plain-tbar .x-toolbar{overflow:hidden;padding:2px}.x-plain-bwrap{overflow:hidden;zoom:1}.x-plain{overflow:hidden}.x-tool{overflow:hidden;width:15px;height:15px;float:right;cursor:pointer;background:transparent no-repeat;margin-left:2px}.x-tool-toggle{background-position:0 -60px}.x-tool-toggle-over{background-position:-15px -60px}.x-panel-collapsed .x-tool-toggle{background-position:0 -75px}.x-panel-collapsed .x-tool-toggle-over{background-position:-15px -75px}.x-tool-close{background-position:0 -0}.x-tool-close-over{background-position:-15px 0}.x-tool-minimize{background-position:0 -15px}.x-tool-minimize-over{background-position:-15px -15px}.x-tool-maximize{background-position:0 -30px}.x-tool-maximize-over{background-position:-15px -30px}.x-tool-restore{background-position:0 -45px}.x-tool-restore-over{background-position:-15px -45px}.x-tool-gear{background-position:0 -90px}.x-tool-gear-over{background-position:-15px -90px}.x-tool-prev{background-position:0 -105px}.x-tool-prev-over{background-position:-15px -105px}.x-tool-next{background-position:0 -120px}.x-tool-next-over{background-position:-15px -120px}.x-tool-pin{background-position:0 -135px}.x-tool-pin-over{background-position:-15px -135px}.x-tool-unpin{background-position:0 -150px}.x-tool-unpin-over{background-position:-15px -150px}.x-tool-right{background-position:0 -165px}.x-tool-right-over{background-position:-15px -165px}.x-tool-left{background-position:0 -180px}.x-tool-left-over{background-position:-15px -180px}.x-tool-down{background-position:0 -195px}.x-tool-down-over{background-position:-15px -195px}.x-tool-up{background-position:0 -210px}.x-tool-up-over{background-position:-15px -210px}.x-tool-refresh{background-position:0 -225px}.x-tool-refresh-over{background-position:-15px -225px}.x-tool-plus{background-position:0 -240px}.x-tool-plus-over{background-position:-15px -240px}.x-tool-minus{background-position:0 -255px}.x-tool-minus-over{background-position:-15px -255px}.x-tool-search{background-position:0 -270px}.x-tool-search-over{background-position:-15px -270px}.x-tool-save{background-position:0 -285px}.x-tool-save-over{background-position:-15px -285px}.x-tool-help{background-position:0 -300px}.x-tool-help-over{background-position:-15px -300px}.x-tool-print{background-position:0 -315px}.x-tool-print-over{background-position:-15px -315px}.x-tool-expand{background-position:0 -330px}.x-tool-expand-over{background-position:-15px -330px}.x-tool-collapse{background-position:0 -345px}.x-tool-collapse-over{background-position:-15px -345px}.x-tool-resize{background-position:0 -360px}.x-tool-resize-over{background-position:-15px -360px}.x-tool-move{background-position:0 -375px}.x-tool-move-over{background-position:-15px -375px}.x-panel-ghost{z-index:12000;overflow:hidden;position:absolute;left:0;top:0;opacity:.65;-moz-opacity:.65;filter:alpha(opacity=65)}.x-panel-ghost ul{margin:0;padding:0;overflow:hidden;font-size:0;line-height:0;border:1px solid;border-top:0 none;display:block}.x-panel-ghost *{cursor:move!important}.x-panel-dd-spacer{border:2px dashed}.x-panel-btns{padding:5px;overflow:hidden}.x-panel-btns td.x-toolbar-cell{padding:3px}.x-panel-btns .x-btn-focus .x-btn-left{background-position:0 -147px}.x-panel-btns .x-btn-focus .x-btn-right{background-position:0 -168px}.x-panel-btns .x-btn-focus .x-btn-center{background-position:0 -189px}.x-panel-btns .x-btn-over .x-btn-left{background-position:0 -63px}.x-panel-btns .x-btn-over .x-btn-right{background-position:0 -84px}.x-panel-btns .x-btn-over .x-btn-center{background-position:0 -105px}.x-panel-btns .x-btn-click .x-btn-center{background-position:0 -126px}.x-panel-btns .x-btn-click .x-btn-right{background-position:0 -84px}.x-panel-btns .x-btn-click .x-btn-left{background-position:0 -63px}.x-panel-fbar td,.x-panel-fbar span,.x-panel-fbar input,.x-panel-fbar div,.x-panel-fbar select,.x-panel-fbar label{white-space:nowrap}.x-panel-reset .x-panel-body html,.x-panel-reset .x-panel-body address,.x-panel-reset .x-panel-body blockquote,.x-panel-reset .x-panel-body body,.x-panel-reset .x-panel-body dd,.x-panel-reset .x-panel-body div,.x-panel-reset .x-panel-body dl,.x-panel-reset .x-panel-body dt,.x-panel-reset .x-panel-body fieldset,.x-panel-reset .x-panel-body form,.x-panel-reset .x-panel-body frame,frameset,.x-panel-reset .x-panel-body h1,.x-panel-reset .x-panel-body h2,.x-panel-reset .x-panel-body h3,.x-panel-reset .x-panel-body h4,.x-panel-reset .x-panel-body h5,.x-panel-reset .x-panel-body h6,.x-panel-reset .x-panel-body noframes,.x-panel-reset .x-panel-body ol,.x-panel-reset .x-panel-body p,.x-panel-reset .x-panel-body ul,.x-panel-reset .x-panel-body center,.x-panel-reset .x-panel-body dir,.x-panel-reset .x-panel-body hr,.x-panel-reset .x-panel-body menu,.x-panel-reset .x-panel-body pre{display:block}.x-panel-reset .x-panel-body li{display:list-item}.x-panel-reset .x-panel-body head{display:none}.x-panel-reset .x-panel-body table{display:table}.x-panel-reset .x-panel-body tr{display:table-row}.x-panel-reset .x-panel-body thead{display:table-header-group}.x-panel-reset .x-panel-body tbody{display:table-row-group}.x-panel-reset .x-panel-body tfoot{display:table-footer-group}.x-panel-reset .x-panel-body col{display:table-column}.x-panel-reset .x-panel-body colgroup{display:table-column-group}.x-panel-reset .x-panel-body td,.x-panel-reset .x-panel-body th{display:table-cell}.x-panel-reset .x-panel-body caption{display:table-caption}.x-panel-reset .x-panel-body th{font-weight:bolder;text-align:center}.x-panel-reset .x-panel-body caption{text-align:center}.x-panel-reset .x-panel-body body{margin:8px}.x-panel-reset .x-panel-body h1{font-size:2em;margin:.67em 0}.x-panel-reset .x-panel-body h2{font-size:1.5em;margin:.75em 0}.x-panel-reset .x-panel-body h3{font-size:1.17em;margin:.83em 0}.x-panel-reset .x-panel-body h4,.x-panel-reset .x-panel-body p,.x-panel-reset .x-panel-body blockquote,.x-panel-reset .x-panel-body ul,.x-panel-reset .x-panel-body fieldset,.x-panel-reset .x-panel-body form,.x-panel-reset .x-panel-body ol,.x-panel-reset .x-panel-body dl,.x-panel-reset .x-panel-body dir,.x-panel-reset .x-panel-body menu{margin:1.12em 0}.x-panel-reset .x-panel-body h5{font-size:.83em;margin:1.5em 0}.x-panel-reset .x-panel-body h6{font-size:.75em;margin:1.67em 0}.x-panel-reset .x-panel-body h1,.x-panel-reset .x-panel-body h2,.x-panel-reset .x-panel-body h3,.x-panel-reset .x-panel-body h4,.x-panel-reset .x-panel-body h5,.x-panel-reset .x-panel-body h6,.x-panel-reset .x-panel-body b,.x-panel-reset .x-panel-body strong{font-weight:bolder}.x-panel-reset .x-panel-body blockquote{margin-left:40px;margin-right:40px}.x-panel-reset .x-panel-body i,.x-panel-reset .x-panel-body cite,.x-panel-reset .x-panel-body em,.x-panel-reset .x-panel-body var,.x-panel-reset .x-panel-body address{font-style:italic}.x-panel-reset .x-panel-body pre,.x-panel-reset .x-panel-body tt,.x-panel-reset .x-panel-body code,.x-panel-reset .x-panel-body kbd,.x-panel-reset .x-panel-body samp{font-family:monospace}.x-panel-reset .x-panel-body pre{white-space:pre}.x-panel-reset .x-panel-body button,.x-panel-reset .x-panel-body textarea,.x-panel-reset .x-panel-body input,.x-panel-reset .x-panel-body select{display:inline-block}.x-panel-reset .x-panel-body big{font-size:1.17em}.x-panel-reset .x-panel-body small,.x-panel-reset .x-panel-body sub,.x-panel-reset .x-panel-body sup{font-size:.83em}.x-panel-reset .x-panel-body sub{vertical-align:sub}.x-panel-reset .x-panel-body sup{vertical-align:super}.x-panel-reset .x-panel-body table{border-spacing:2px}.x-panel-reset .x-panel-body thead,.x-panel-reset .x-panel-body tbody,.x-panel-reset .x-panel-body tfoot{vertical-align:middle}.x-panel-reset .x-panel-body td,.x-panel-reset .x-panel-body th{vertical-align:inherit}.x-panel-reset .x-panel-body s,.x-panel-reset .x-panel-body strike,.x-panel-reset .x-panel-body del{text-decoration:line-through}.x-panel-reset .x-panel-body hr{border:1px inset}.x-panel-reset .x-panel-body ol,.x-panel-reset .x-panel-body ul,.x-panel-reset .x-panel-body dir,.x-panel-reset .x-panel-body menu,.x-panel-reset .x-panel-body dd{margin-left:40px}.x-panel-reset .x-panel-body ul,.x-panel-reset .x-panel-body menu,.x-panel-reset .x-panel-body dir{list-style-type:disc}.x-panel-reset .x-panel-body ol{list-style-type:decimal}.x-panel-reset .x-panel-body ol ul,.x-panel-reset .x-panel-body ul ol,.x-panel-reset .x-panel-body ul ul,.x-panel-reset .x-panel-body ol ol{margin-top:0;margin-bottom:0}.x-panel-reset .x-panel-body u,.x-panel-reset .x-panel-body ins{text-decoration:underline}.x-panel-reset .x-panel-body br:before{content:\"\\A\"}.x-panel-reset .x-panel-body :before,.x-panel-reset .x-panel-body :after{white-space:pre-line}.x-panel-reset .x-panel-body center{text-align:center}.x-panel-reset .x-panel-body :link,.x-panel-reset .x-panel-body :visited{text-decoration:underline}.x-panel-reset .x-panel-body :focus{outline:invert dotted thin}.x-panel-reset .x-panel-body BDO[DIR=\"ltr\"]{direction:ltr;unicode-bidi:bidi-override}.x-panel-reset .x-panel-body BDO[DIR=\"rtl\"]{direction:rtl;unicode-bidi:bidi-override}.x-window{zoom:1}.x-window .x-window-handle{opacity:0;-moz-opacity:0;filter:alpha(opacity=0)}.x-window-proxy{border:1px solid;z-index:12000;overflow:hidden;position:absolute;left:0;top:0;display:none;opacity:.5;-moz-opacity:.5;filter:alpha(opacity=50)}.x-window-header{overflow:hidden;zoom:1}.x-window-bwrap{z-index:1;position:relative;zoom:1;left:0;top:0}.x-window-tl .x-window-header{padding:5px 0 4px 0}.x-window-header-text{cursor:pointer}.x-window-tc{background:transparent repeat-x 0 0;overflow:hidden;zoom:1}.x-window-tl{background:transparent no-repeat 0 0;padding-left:6px;zoom:1;z-index:1;position:relative}.x-window-tr{background:transparent no-repeat right 0;padding-right:6px}.x-window-bc{background:transparent repeat-x 0 bottom;zoom:1}.x-window-bc .x-window-footer{padding-bottom:6px;zoom:1;font-size:0;line-height:0}.x-window-bl{background:transparent no-repeat 0 bottom;padding-left:6px;zoom:1}.x-window-br{background:transparent no-repeat right bottom;padding-right:6px;zoom:1}.x-window-mc{border:1px solid;padding:0;margin:0}.x-window-ml{background:transparent repeat-y 0 0;padding-left:6px;zoom:1}.x-window-mr{background:transparent repeat-y right 0;padding-right:6px;zoom:1}.x-window-body{overflow:hidden}.x-window-bwrap{overflow:hidden}.x-window-maximized .x-window-bl,.x-window-maximized .x-window-br,.x-window-maximized .x-window-ml,.x-window-maximized .x-window-mr,.x-window-maximized .x-window-tl,.x-window-maximized .x-window-tr{padding:0}.x-window-maximized .x-window-footer{padding-bottom:0}.x-window-maximized .x-window-tc{padding-left:3px;padding-right:3px}.x-window-maximized .x-window-mc{border-left:0 none;border-right:0 none}.x-window-tbar .x-toolbar,.x-window-bbar .x-toolbar{border-left:0 none;border-right:0 none}.x-window-bbar .x-toolbar{border-top:1px solid;border-bottom:0 none}.x-window-draggable,.x-window-draggable .x-window-header-text{cursor:move}.x-window-maximized .x-window-draggable,.x-window-maximized .x-window-draggable .x-window-header-text{cursor:default}.x-window-body{background-color:transparent}.x-panel-ghost .x-window-tl{border-bottom:1px solid}.x-panel-collapsed .x-window-tl{border-bottom:1px solid}.x-window-maximized-ct{overflow:hidden}.x-window-maximized .x-window-handle{display:none}.x-window-sizing-ghost ul{border:0 none!important}.x-dlg-focus{-moz-outline:0 none;outline:0 none;width:0;height:0;overflow:hidden;position:absolute;top:0;left:0}.ext-webkit .x-dlg-focus{width:1px;height:1px}.x-dlg-mask{z-index:10000;display:none;position:absolute;top:0;left:0;-moz-opacity:.5;opacity:.50;filter:alpha(opacity=50)}body.ext-ie6.x-body-masked select{visibility:hidden}body.ext-ie6.x-body-masked .x-window select{visibility:visible}.x-window-plain .x-window-mc{border:1px solid}.x-window-plain .x-window-body{border:1px solid;background:transparent!important}.x-html-editor-wrap{border:1px solid}.x-html-editor-tb .x-btn-text{background:transparent no-repeat}.x-html-editor-tb .x-edit-bold,.x-menu-item img.x-edit-bold{background-position:0 0;background-image:url(../images/default/editor/tb-sprite.gif)}.x-html-editor-tb .x-edit-italic,.x-menu-item img.x-edit-italic{background-position:-16px 0;background-image:url(../images/default/editor/tb-sprite.gif)}.x-html-editor-tb .x-edit-underline,.x-menu-item img.x-edit-underline{background-position:-32px 0;background-image:url(../images/default/editor/tb-sprite.gif)}.x-html-editor-tb .x-edit-forecolor,.x-menu-item img.x-edit-forecolor{background-position:-160px 0;background-image:url(../images/default/editor/tb-sprite.gif)}.x-html-editor-tb .x-edit-backcolor,.x-menu-item img.x-edit-backcolor{background-position:-176px 0;background-image:url(../images/default/editor/tb-sprite.gif)}.x-html-editor-tb .x-edit-justifyleft,.x-menu-item img.x-edit-justifyleft{background-position:-112px 0;background-image:url(../images/default/editor/tb-sprite.gif)}.x-html-editor-tb .x-edit-justifycenter,.x-menu-item img.x-edit-justifycenter{background-position:-128px 0;background-image:url(../images/default/editor/tb-sprite.gif)}.x-html-editor-tb .x-edit-justifyright,.x-menu-item img.x-edit-justifyright{background-position:-144px 0;background-image:url(../images/default/editor/tb-sprite.gif)}.x-html-editor-tb .x-edit-insertorderedlist,.x-menu-item img.x-edit-insertorderedlist{background-position:-80px 0;background-image:url(../images/default/editor/tb-sprite.gif)}.x-html-editor-tb .x-edit-insertunorderedlist,.x-menu-item img.x-edit-insertunorderedlist{background-position:-96px 0;background-image:url(../images/default/editor/tb-sprite.gif)}.x-html-editor-tb .x-edit-increasefontsize,.x-menu-item img.x-edit-increasefontsize{background-position:-48px 0;background-image:url(../images/default/editor/tb-sprite.gif)}.x-html-editor-tb .x-edit-decreasefontsize,.x-menu-item img.x-edit-decreasefontsize{background-position:-64px 0;background-image:url(../images/default/editor/tb-sprite.gif)}.x-html-editor-tb .x-edit-sourceedit,.x-menu-item img.x-edit-sourceedit{background-position:-192px 0;background-image:url(../images/default/editor/tb-sprite.gif)}.x-html-editor-tb .x-edit-createlink,.x-menu-item img.x-edit-createlink{background-position:-208px 0;background-image:url(../images/default/editor/tb-sprite.gif)}.x-html-editor-tip .x-tip-bd .x-tip-bd-inner{padding:5px;padding-bottom:1px}.x-html-editor-tb .x-toolbar{position:static!important}.x-panel-noborder .x-panel-body-noborder{border-width:0}.x-panel-noborder .x-panel-header-noborder{border-width:0 0 1px;border-style:solid}.x-panel-noborder .x-panel-tbar-noborder .x-toolbar{border-width:0 0 1px;border-style:solid}.x-panel-noborder .x-panel-bbar-noborder .x-toolbar{border-width:1px 0 0 0;border-style:solid}.x-window-noborder .x-window-mc{border-width:0}.x-window-plain .x-window-body-noborder{border-width:0}.x-tab-panel-noborder .x-tab-panel-body-noborder{border-width:0}.x-tab-panel-noborder .x-tab-panel-header-noborder{border-width:0 0 1px 0}.x-tab-panel-noborder .x-tab-panel-footer-noborder{border-width:1px 0 0 0}.x-tab-panel-bbar-noborder .x-toolbar{border-width:1px 0 0 0;border-style:solid}.x-tab-panel-tbar-noborder .x-toolbar{border-width:0 0 1px;border-style:solid}.x-border-layout-ct{position:relative}.x-border-panel{position:absolute;left:0;top:0}.x-tool-collapse-south{background-position:0 -195px}.x-tool-collapse-south-over{background-position:-15px -195px}.x-tool-collapse-north{background-position:0 -210px}.x-tool-collapse-north-over{background-position:-15px -210px}.x-tool-collapse-west{background-position:0 -180px}.x-tool-collapse-west-over{background-position:-15px -180px}.x-tool-collapse-east{background-position:0 -165px}.x-tool-collapse-east-over{background-position:-15px -165px}.x-tool-expand-south{background-position:0 -210px}.x-tool-expand-south-over{background-position:-15px -210px}.x-tool-expand-north{background-position:0 -195px}.x-tool-expand-north-over{background-position:-15px -195px}.x-tool-expand-west{background-position:0 -165px}.x-tool-expand-west-over{background-position:-15px -165px}.x-tool-expand-east{background-position:0 -180px}.x-tool-expand-east-over{background-position:-15px -180px}.x-tool-expand-north,.x-tool-expand-south{float:right;margin:3px}.x-tool-expand-east,.x-tool-expand-west{float:none;margin:3px 2px}.x-accordion-hd .x-tool-toggle{background-position:0 -255px}.x-accordion-hd .x-tool-toggle-over{background-position:-15px -255px}.x-panel-collapsed .x-accordion-hd .x-tool-toggle{background-position:0 -240px}.x-panel-collapsed .x-accordion-hd .x-tool-toggle-over{background-position:-15px -240px}.x-accordion-hd{padding-top:4px;padding-bottom:3px;border-top:0 none;background:transparent repeat-x 0 -9px}.x-layout-collapsed{position:absolute;left:-10000px;top:-10000px;visibility:hidden;width:20px;height:20px;overflow:hidden;border:1px solid;z-index:20}.ext-border-box .x-layout-collapsed{width:22px;height:22px}.x-layout-collapsed-over{cursor:pointer}.x-layout-collapsed-west .x-layout-collapsed-tools,.x-layout-collapsed-east .x-layout-collapsed-tools{position:absolute;top:0;left:0;width:20px;height:20px}.x-layout-split{position:absolute;height:5px;width:5px;line-height:1px;font-size:1px;z-index:3;background-color:transparent}.ext-strict .ext-ie6 .x-layout-split{background-color:#fff!important;filter:alpha(opacity=1)}.x-layout-split-h{background-image:url(../images/default/s.gif);background-position:left}.x-layout-split-v{background-image:url(../images/default/s.gif);background-position:top}.x-column-layout-ct{overflow:hidden;zoom:1}.x-column{float:left;padding:0;margin:0;overflow:hidden;zoom:1}.x-column-inner{overflow:hidden;zoom:1}.x-layout-mini{position:absolute;top:0;left:0;display:block;width:5px;height:35px;cursor:pointer;opacity:.5;-moz-opacity:.5;filter:alpha(opacity=50)}.x-layout-mini-over,.x-layout-collapsed-over .x-layout-mini{opacity:1;-moz-opacity:1;filter:none}.x-layout-split-west .x-layout-mini{top:48%}.x-layout-split-east .x-layout-mini{top:48%}.x-layout-split-north .x-layout-mini{left:48%;height:5px;width:35px}.x-layout-split-south .x-layout-mini{left:48%;height:5px;width:35px}.x-layout-cmini-west .x-layout-mini{top:48%}.x-layout-cmini-east .x-layout-mini{top:48%}.x-layout-cmini-north .x-layout-mini{left:48%;height:5px;width:35px}.x-layout-cmini-south .x-layout-mini{left:48%;height:5px;width:35px}.x-layout-cmini-west,.x-layout-cmini-east{border:0 none;width:5px!important;padding:0;background-color:transparent}.x-layout-cmini-north,.x-layout-cmini-south{border:0 none;height:5px!important;padding:0;background-color:transparent}.x-viewport,.x-viewport body{margin:0;padding:0;border:0 none;overflow:hidden;height:100%}.x-abs-layout-item{position:absolute;left:0;top:0}.ext-ie input.x-abs-layout-item,.ext-ie textarea.x-abs-layout-item{margin:0}.x-box-layout-ct{overflow:hidden;zoom:1}.x-box-inner{overflow:hidden;zoom:1;position:relative;left:0;top:0}.x-box-item{position:absolute;left:0;top:0}.x-progress-wrap{border:1px solid;overflow:hidden}.x-progress-inner{height:18px;background:repeat-x;position:relative}.x-progress-bar{height:18px;float:left;width:0;background:repeat-x left center;border-top:1px solid;border-bottom:1px solid;border-right:1px solid}.x-progress-text{padding:1px 5px;overflow:hidden;position:absolute;left:0;text-align:center}.x-progress-text-back{line-height:16px}.ext-ie .x-progress-text-back{line-height:15px}.ext-strict .ext-ie7 .x-progress-text-back{width:100%}.x-list-header{background:repeat-x 0 bottom;cursor:default;zoom:1;height:22px}.x-list-header-inner div{display:block;float:left;overflow:hidden;-o-text-overflow:ellipsis;text-overflow:ellipsis;white-space:nowrap}.x-list-header-inner div em{display:block;border-left:1px solid;padding:4px 4px;overflow:hidden;-moz-user-select:none;-khtml-user-select:none;line-height:14px}.x-list-body{overflow:auto;overflow-x:hidden;overflow-y:auto;zoom:1;float:left;width:100%}.x-list-body dl{zoom:1}.x-list-body dt{display:block;float:left;overflow:hidden;-o-text-overflow:ellipsis;text-overflow:ellipsis;white-space:nowrap;cursor:pointer;zoom:1}.x-list-body dt em{display:block;padding:3px 4px;overflow:hidden;-moz-user-select:none;-khtml-user-select:none}.x-list-resizer{border-left:1px solid;border-right:1px solid;position:absolute;left:0;top:0}.x-list-header-inner em.sort-asc{background:transparent no-repeat center 0;border-style:solid;border-width:0 1px 1px;padding-bottom:3px}.x-list-header-inner em.sort-desc{background:transparent no-repeat center -23px;border-style:solid;border-width:0 1px 1px;padding-bottom:3px}.x-slider{zoom:1}.x-slider-inner{position:relative;left:0;top:0;overflow:visible;zoom:1}.x-slider-focus{position:absolute;left:0;top:0;width:1px;height:1px;line-height:1px;font-size:1px;-moz-outline:0 none;outline:0 none;-moz-user-select:none;-khtml-user-select:none;-webkit-user-select:ignore;display:block;overflow:hidden}.x-slider-horz{padding-left:7px;background:transparent no-repeat 0 -22px}.x-slider-horz .x-slider-end{padding-right:7px;zoom:1;background:transparent no-repeat right -44px}.x-slider-horz .x-slider-inner{background:transparent repeat-x 0 0;height:22px}.x-slider-horz .x-slider-thumb{width:14px;height:15px;position:absolute;left:0;top:3px;background:transparent no-repeat 0 0}.x-slider-horz .x-slider-thumb-over{background-position:-14px -15px}.x-slider-horz .x-slider-thumb-drag{background-position:-28px -30px}.x-slider-vert{padding-top:7px;background:transparent no-repeat -44px 0;width:22px}.x-slider-vert .x-slider-end{padding-bottom:7px;zoom:1;background:transparent no-repeat -22px bottom}.x-slider-vert .x-slider-inner{background:transparent repeat-y 0 0}.x-slider-vert .x-slider-thumb{width:15px;height:14px;position:absolute;left:3px;bottom:0;background:transparent no-repeat 0 0}.x-slider-vert .x-slider-thumb-over{background-position:-15px -14px}.x-slider-vert .x-slider-thumb-drag{background-position:-30px -28px}.x-window-dlg .x-window-body{border:0 none!important;padding:5px 10px;overflow:hidden!important}.x-window-dlg .x-window-mc{border:0 none!important}.x-window-dlg .ext-mb-input{margin-top:4px;width:95%}.x-window-dlg .ext-mb-textarea{margin-top:4px}.x-window-dlg .x-progress-wrap{margin-top:4px}.ext-ie .x-window-dlg .x-progress-wrap{margin-top:6px}.x-window-dlg .x-msg-box-wait{background:transparent no-repeat left;display:block;width:300px;padding-left:18px;line-height:18px}.x-window-dlg .ext-mb-icon{float:left;width:47px;height:32px}.x-window-dlg .x-dlg-icon .ext-mb-content{zoom:1;margin-left:47px}.x-window-dlg .ext-mb-info,.x-window-dlg .ext-mb-warning,.x-window-dlg .ext-mb-question,.x-window-dlg .ext-mb-error{background:transparent no-repeat top left}.ext-gecko2 .ext-mb-fix-cursor{overflow:auto}.ext-el-mask{background-color:#ccc}.ext-el-mask-msg{border-color:#6593cf;background-color:#c3daf9;background-image:url(../images/default/box/tb-blue.gif)}.ext-el-mask-msg div{background-color:#eee;border-color:#a3bad9;color:#222;font:normal 11px tahoma,arial,helvetica,sans-serif}.x-mask-loading div{background-color:#fbfbfb;background-image:url(../images/default/grid/loading.gif)}.x-item-disabled{color:gray}.x-item-disabled *{color:gray!important}.x-splitbar-proxy{background-color:#aaa}.x-color-palette a{border-color:#fff}.x-color-palette a:hover,.x-color-palette a.x-color-palette-sel{border-color:#8bb8f3;background-color:#deecfd}.x-color-palette em{border-color:#aca899}.x-ie-shadow{background-color:#777}.x-shadow .xsmc{background-image:url(../images/default/shadow-c.png)}.x-shadow .xsml,.x-shadow .xsmr{background-image:url(../images/default/shadow-lr.png)}.x-shadow .xstl,.x-shadow .xstc,.x-shadow .xstr,.x-shadow .xsbl,.x-shadow .xsbc,.x-shadow .xsbr{background-image:url(../images/default/shadow.png)}.loading-indicator{font-size:11px;background-image:url(../images/default/grid/loading.gif)}.x-spotlight{background-color:#ccc}.x-tab-panel-header,.x-tab-panel-footer{background-color:#deecfd;border-color:#8db2e3;overflow:hidden;zoom:1}.x-tab-panel-header,.x-tab-panel-footer{border-color:#8db2e3}ul.x-tab-strip-top{background-color:#cedff5;background-image:url(../images/default/tabs/tab-strip-bg.gif);border-bottom-color:#8db2e3}ul.x-tab-strip-bottom{background-color:#cedff5;background-image:url(../images/default/tabs/tab-strip-btm-bg.gif);border-top-color:#8db2e3}.x-tab-panel-header-plain .x-tab-strip-spacer,.x-tab-panel-footer-plain .x-tab-strip-spacer{border-color:#8db2e3;background-color:#deecfd}.x-tab-strip span.x-tab-strip-text{font:normal 11px tahoma,arial,helvetica;color:#416aa3}.x-tab-strip-over span.x-tab-strip-text{color:#15428b}.x-tab-strip-active span.x-tab-strip-text{color:#15428b;font-weight:bold}.x-tab-strip-disabled .x-tabs-text{color:#aaa}.x-tab-strip-top .x-tab-right,.x-tab-strip-top .x-tab-left,.x-tab-strip-top .x-tab-strip-inner{background-image:url(../images/default/tabs/tabs-sprite.gif)}.x-tab-strip-bottom .x-tab-right{background-image:url(../images/default/tabs/tab-btm-inactive-right-bg.gif)}.x-tab-strip-bottom .x-tab-left{background-image:url(../images/default/tabs/tab-btm-inactive-left-bg.gif)}.x-tab-strip-bottom .x-tab-strip-over .x-tab-right{background-image:url(../images/default/tabs/tab-btm-over-right-bg.gif)}.x-tab-strip-bottom .x-tab-strip-over .x-tab-left{background-image:url(../images/default/tabs/tab-btm-over-left-bg.gif)}.x-tab-strip-bottom .x-tab-strip-active .x-tab-right{background-image:url(../images/default/tabs/tab-btm-right-bg.gif)}.x-tab-strip-bottom .x-tab-strip-active .x-tab-left{background-image:url(../images/default/tabs/tab-btm-left-bg.gif)}.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close{background-image:url(../images/default/tabs/tab-close.gif)}.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close:hover{background-image:url(../images/default/tabs/tab-close.gif)}.x-tab-panel-body{border-color:#8db2e3;background-color:#fff}.x-tab-panel-body-top{border-top:0 none}.x-tab-panel-body-bottom{border-bottom:0 none}.x-tab-scroller-left{background-image:url(../images/default/tabs/scroll-left.gif);border-bottom-color:#8db2e3}.x-tab-scroller-left-over{background-position:0 0}.x-tab-scroller-left-disabled{background-position:-18px 0;opacity:.5;-moz-opacity:.5;filter:alpha(opacity=50);cursor:default}.x-tab-scroller-right{background-image:url(../images/default/tabs/scroll-right.gif);border-bottom-color:#8db2e3}.x-tab-panel-bbar .x-toolbar,.x-tab-panel-tbar .x-toolbar{border-color:#99bbe8}.x-form-field{font:normal 12px tahoma,arial,helvetica,sans-serif}.x-form-text,textarea.x-form-field{background-color:#fff;background-image:url(../images/default/form/text-bg.gif);border-color:#b5b8c8}.x-form-select-one{background-color:#fff;border-color:#b5b8c8}.x-form-check-group-label{border-bottom:1px solid #99bbe8;color:#15428b}.x-editor .x-form-check-wrap{background-color:#fff}.x-form-field-wrap .x-form-trigger{background-image:url(../images/default/form/trigger.gif);border-bottom-color:#b5b8c8}.x-form-field-wrap .x-form-date-trigger{background-image:url(../images/default/form/date-trigger.gif)}.x-form-field-wrap .x-form-clear-trigger{background-image:url(../images/default/form/clear-trigger.gif)}.x-form-field-wrap .x-form-search-trigger{background-image:url(../images/default/form/search-trigger.gif)}.x-trigger-wrap-focus .x-form-trigger{border-bottom-color:#7eadd9}.x-item-disabled .x-form-trigger-over{border-bottom-color:#b5b8c8}.x-item-disabled .x-form-trigger-click{border-bottom-color:#b5b8c8}.x-form-focus,textarea.x-form-focus{border-color:#7eadd9}.x-form-invalid,textarea.x-form-invalid{background-color:#fff;background-image:url(../images/default/grid/invalid_line.gif);border-color:#c30}.x-form-invalid.x-form-composite{border:0;background-image:none}.x-form-invalid.x-form-composite .x-form-invalid{background-color:#fff;background-image:url(../images/default/grid/invalid_line.gif);border-color:#c30}.x-form-inner-invalid,textarea.x-form-inner-invalid{background-color:#fff;background-image:url(../images/default/grid/invalid_line.gif)}.x-form-grow-sizer{font:normal 12px tahoma,arial,helvetica,sans-serif}.x-form-item{font:normal 12px tahoma,arial,helvetica,sans-serif}.x-form-invalid-msg{color:#c0272b;font:normal 11px tahoma,arial,helvetica,sans-serif;background-image:url(../images/default/shared/warning.gif)}.x-form-empty-field{color:gray}.x-small-editor .x-form-field{font:normal 11px arial,tahoma,helvetica,sans-serif}.ext-webkit .x-small-editor .x-form-field{font:normal 11px arial,tahoma,helvetica,sans-serif}.x-form-invalid-icon{background-image:url(../images/default/form/exclamation.gif)}.x-fieldset{border-color:#b5b8c8}.x-fieldset legend{font:bold 11px tahoma,arial,helvetica,sans-serif;color:#15428b}.x-btn{font:normal 11px tahoma,verdana,helvetica}.x-btn button{font:normal 11px arial,tahoma,verdana,helvetica;color:#333}.x-btn em{font-style:normal;font-weight:normal}.x-btn-tl,.x-btn-tr,.x-btn-tc,.x-btn-ml,.x-btn-mr,.x-btn-mc,.x-btn-bl,.x-btn-br,.x-btn-bc{background-image:url(../images/default/button/btn.gif)}.x-btn-click .x-btn-text,.x-btn-menu-active .x-btn-text,.x-btn-pressed .x-btn-text{color:#000}.x-btn-disabled *{color:gray!important}.x-btn-mc em.x-btn-arrow{background-image:url(../images/default/button/arrow.gif)}.x-btn-mc em.x-btn-split{background-image:url(../images/default/button/s-arrow.gif)}.x-btn-over .x-btn-mc em.x-btn-split,.x-btn-click .x-btn-mc em.x-btn-split,.x-btn-menu-active .x-btn-mc em.x-btn-split,.x-btn-pressed .x-btn-mc em.x-btn-split{background-image:url(../images/default/button/s-arrow-o.gif)}.x-btn-mc em.x-btn-arrow-bottom{background-image:url(../images/default/button/s-arrow-b-noline.gif)}.x-btn-mc em.x-btn-split-bottom{background-image:url(../images/default/button/s-arrow-b.gif)}.x-btn-over .x-btn-mc em.x-btn-split-bottom,.x-btn-click .x-btn-mc em.x-btn-split-bottom,.x-btn-menu-active .x-btn-mc em.x-btn-split-bottom,.x-btn-pressed .x-btn-mc em.x-btn-split-bottom{background-image:url(../images/default/button/s-arrow-bo.gif)}.x-btn-group-header{color:#3e6aaa}.x-btn-group-tc{background-image:url(../images/default/button/group-tb.gif)}.x-btn-group-tl{background-image:url(../images/default/button/group-cs.gif)}.x-btn-group-tr{background-image:url(../images/default/button/group-cs.gif)}.x-btn-group-bc{background-image:url(../images/default/button/group-tb.gif)}.x-btn-group-bl{background-image:url(../images/default/button/group-cs.gif)}.x-btn-group-br{background-image:url(../images/default/button/group-cs.gif)}.x-btn-group-ml{background-image:url(../images/default/button/group-lr.gif)}.x-btn-group-mr{background-image:url(../images/default/button/group-lr.gif)}.x-btn-group-notitle .x-btn-group-tc{background-image:url(../images/default/button/group-tb.gif)}.x-toolbar{border-color:#a9bfd3;background-color:#d0def0;background-image:url(../images/default/toolbar/bg.gif)}.x-toolbar td,.x-toolbar span,.x-toolbar input,.x-toolbar div,.x-toolbar select,.x-toolbar label{font:normal 11px arial,tahoma,helvetica,sans-serif}.x-toolbar .x-item-disabled{color:gray}.x-toolbar .x-item-disabled *{color:gray}.x-toolbar .x-btn-mc em.x-btn-split{background-image:url(../images/default/button/s-arrow-noline.gif)}.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split,.x-toolbar .x-btn-click .x-btn-mc em.x-btn-split,.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split,.x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split{background-image:url(../images/default/button/s-arrow-o.gif)}.x-toolbar .x-btn-mc em.x-btn-split-bottom{background-image:url(../images/default/button/s-arrow-b-noline.gif)}.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split-bottom,.x-toolbar .x-btn-click .x-btn-mc em.x-btn-split-bottom,.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom,.x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split-bottom{background-image:url(../images/default/button/s-arrow-bo.gif)}.x-toolbar .xtb-sep{background-image:url(../images/default/grid/grid-blue-split.gif)}.x-tbar-page-first{background-image:url(../images/default/grid/page-first.gif)!important}.x-tbar-loading{background-image:url(../images/default/grid/refresh.gif)!important}.x-tbar-page-last{background-image:url(../images/default/grid/page-last.gif)!important}.x-tbar-page-next{background-image:url(../images/default/grid/page-next.gif)!important}.x-tbar-page-prev{background-image:url(../images/default/grid/page-prev.gif)!important}.x-item-disabled .x-tbar-loading{background-image:url(../images/default/grid/refresh-disabled.gif)!important}.x-item-disabled .x-tbar-page-first{background-image:url(../images/default/grid/page-first-disabled.gif)!important}.x-item-disabled .x-tbar-page-last{background-image:url(../images/default/grid/page-last-disabled.gif)!important}.x-item-disabled .x-tbar-page-next{background-image:url(../images/default/grid/page-next-disabled.gif)!important}.x-item-disabled .x-tbar-page-prev{background-image:url(../images/default/grid/page-prev-disabled.gif)!important}.x-paging-info{color:#444}.x-toolbar-more-icon{background-image:url(../images/default/toolbar/more.gif)!important}.x-resizable-handle{background-color:#fff}.x-resizable-over .x-resizable-handle-east,.x-resizable-pinned .x-resizable-handle-east,.x-resizable-over .x-resizable-handle-west,.x-resizable-pinned .x-resizable-handle-west{background-image:url(../images/default/sizer/e-handle.gif)}.x-resizable-over .x-resizable-handle-south,.x-resizable-pinned .x-resizable-handle-south,.x-resizable-over .x-resizable-handle-north,.x-resizable-pinned .x-resizable-handle-north{background-image:url(../images/default/sizer/s-handle.gif)}.x-resizable-over .x-resizable-handle-north,.x-resizable-pinned .x-resizable-handle-north{background-image:url(../images/default/sizer/s-handle.gif)}.x-resizable-over .x-resizable-handle-southeast,.x-resizable-pinned .x-resizable-handle-southeast{background-image:url(../images/default/sizer/se-handle.gif)}.x-resizable-over .x-resizable-handle-northwest,.x-resizable-pinned .x-resizable-handle-northwest{background-image:url(../images/default/sizer/nw-handle.gif)}.x-resizable-over .x-resizable-handle-northeast,.x-resizable-pinned .x-resizable-handle-northeast{background-image:url(../images/default/sizer/ne-handle.gif)}.x-resizable-over .x-resizable-handle-southwest,.x-resizable-pinned .x-resizable-handle-southwest{background-image:url(../images/default/sizer/sw-handle.gif)}.x-resizable-proxy{border-color:#3b5a82}.x-resizable-overlay{background-color:#fff}.x-grid3{background-color:#fff}.x-grid-panel .x-panel-mc .x-panel-body{border-color:#99bbe8}.x-grid3-row td,.x-grid3-summary-row td{font:normal 11px/13px arial,tahoma,helvetica,sans-serif}.x-grid3-hd-row td{font:normal 11px/15px arial,tahoma,helvetica,sans-serif}.x-grid3-hd-row td{border-left-color:#eee;border-right-color:#d0d0d0}.x-grid-row-loading{background-color:#fff;background-image:url(../images/default/shared/loading-balls.gif)}.x-grid3-row{border-color:#ededed;border-top-color:#fff}.x-grid3-row-alt{background-color:#fafafa}.x-grid3-row-over{border-color:#ddd;background-color:#efefef;background-image:url(../images/default/grid/row-over.gif)}.x-grid3-resize-proxy{background-color:#777}.x-grid3-resize-marker{background-color:#777}.x-grid3-header{background-color:#f9f9f9;background-image:url(../images/default/grid/grid3-hrow.gif)}.x-grid3-header-pop{border-left-color:#d0d0d0}.x-grid3-header-pop-inner{border-left-color:#eee;background-image:url(../images/default/grid/hd-pop.gif)}td.x-grid3-hd-over,td.sort-desc,td.sort-asc,td.x-grid3-hd-menu-open{border-left-color:#aaccf6;border-right-color:#aaccf6}td.x-grid3-hd-over .x-grid3-hd-inner,td.sort-desc .x-grid3-hd-inner,td.sort-asc .x-grid3-hd-inner,td.x-grid3-hd-menu-open .x-grid3-hd-inner{background-color:#ebf3fd;background-image:url(../images/default/grid/grid3-hrow-over.gif)}.sort-asc .x-grid3-sort-icon{background-image:url(../images/default/grid/sort_asc.gif)}.sort-desc .x-grid3-sort-icon{background-image:url(../images/default/grid/sort_desc.gif)}.x-grid3-cell-text,.x-grid3-hd-text{color:#000}.x-grid3-split{background-image:url(../images/default/grid/grid-split.gif)}.x-grid3-hd-text{color:#15428b}.x-dd-drag-proxy .x-grid3-hd-inner{background-color:#ebf3fd;background-image:url(../images/default/grid/grid3-hrow-over.gif);border-color:#aaccf6}.col-move-top{background-image:url(../images/default/grid/col-move-top.gif)}.col-move-bottom{background-image:url(../images/default/grid/col-move-bottom.gif)}td.grid-hd-group-cell{background:url(../images/default/grid/grid3-hrow.gif) repeat-x bottom}.x-grid3-row-selected{background-color:#dfe8f6!important;background-image:none;border-color:#a3bae9}.x-grid3-cell-selected{background-color:#b8cfee!important;color:#000}.x-grid3-cell-selected span{color:#000!important}.x-grid3-cell-selected .x-grid3-cell-text{color:#000}.x-grid3-locked td.x-grid3-row-marker,.x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker{background-color:#ebeadb!important;background-image:url(../images/default/grid/grid-hrow.gif)!important;color:#000;border-top-color:#fff;border-right-color:#6fa0df!important}.x-grid3-locked td.x-grid3-row-marker div,.x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker div{color:#15428b!important}.x-grid3-dirty-cell{background-image:url(../images/default/grid/dirty.gif)}.x-grid3-topbar,.x-grid3-bottombar{font:normal 11px arial,tahoma,helvetica,sans-serif}.x-grid3-bottombar .x-toolbar{border-top-color:#a9bfd3}.x-props-grid .x-grid3-td-name .x-grid3-cell-inner{background-image:url(../images/default/grid/grid3-special-col-bg.gif)!important;color:#000!important}.x-props-grid .x-grid3-body .x-grid3-td-name{background-color:#fff!important;border-right-color:#eee}.xg-hmenu-sort-asc .x-menu-item-icon{background-image:url(../images/default/grid/hmenu-asc.gif)}.xg-hmenu-sort-desc .x-menu-item-icon{background-image:url(../images/default/grid/hmenu-desc.gif)}.xg-hmenu-lock .x-menu-item-icon{background-image:url(../images/default/grid/hmenu-lock.gif)}.xg-hmenu-unlock .x-menu-item-icon{background-image:url(../images/default/grid/hmenu-unlock.gif)}.x-grid3-hd-btn{background-color:#c3daf9;background-image:url(../images/default/grid/grid3-hd-btn.gif)}.x-grid3-body .x-grid3-td-expander{background-image:url(../images/default/grid/grid3-special-col-bg.gif)}.x-grid3-row-expander{background-image:url(../images/default/grid/row-expand-sprite.gif)}.x-grid3-body .x-grid3-td-checker{background-image:url(../images/default/grid/grid3-special-col-bg.gif)}.x-grid3-row-checker,.x-grid3-hd-checker{background-image:url(../images/default/grid/row-check-sprite.gif)}.x-grid3-body .x-grid3-td-numberer{background-image:url(../images/default/grid/grid3-special-col-bg.gif)}.x-grid3-body .x-grid3-td-numberer .x-grid3-cell-inner{color:#444}.x-grid3-body .x-grid3-td-row-icon{background-image:url(../images/default/grid/grid3-special-col-bg.gif)}.x-grid3-body .x-grid3-row-selected .x-grid3-td-numberer,.x-grid3-body .x-grid3-row-selected .x-grid3-td-checker,.x-grid3-body .x-grid3-row-selected .x-grid3-td-expander{background-image:url(../images/default/grid/grid3-special-col-sel-bg.gif)}.x-grid3-check-col{background-image:url(../images/default/menu/unchecked.gif)}.x-grid3-check-col-on{background-image:url(../images/default/menu/checked.gif)}.x-grid-group,.x-grid-group-body,.x-grid-group-hd{zoom:1}.x-grid-group-hd{border-bottom-color:#99bbe8}.x-grid-group-hd div.x-grid-group-title{background-image:url(../images/default/grid/group-collapse.gif);color:#3764a0;font:bold 11px tahoma,arial,helvetica,sans-serif}.x-grid-group-collapsed .x-grid-group-hd div.x-grid-group-title{background-image:url(../images/default/grid/group-expand.gif)}.x-group-by-icon{background-image:url(../images/default/grid/group-by.gif)}.x-cols-icon{background-image:url(../images/default/grid/columns.gif)}.x-show-groups-icon{background-image:url(../images/default/grid/group-by.gif)}.x-grid-empty{color:gray;font:normal 11px tahoma,arial,helvetica,sans-serif}.x-grid-with-col-lines .x-grid3-row td.x-grid3-cell{border-right-color:#ededed}.x-grid-with-col-lines .x-grid3-row-selected{border-top-color:#a3bae9}.x-pivotgrid .x-grid3-header-offset table td{background:url(../images/default/grid/grid3-hrow.gif) repeat-x 50% 100%;border-left:1px solid;border-right:1px solid;border-left-color:#EEE;border-right-color:#d0d0d0}.x-pivotgrid .x-grid3-row-headers{background-color:#f9f9f9}.x-pivotgrid .x-grid3-row-headers table td{background:#EEE url(../images/default/grid/grid3-rowheader.gif) repeat-x left top;border-left:1px solid;border-right:1px solid;border-left-color:#EEE;border-right-color:#d0d0d0;border-bottom:1px solid;border-bottom-color:#d0d0d0;height:18px}.x-dd-drag-ghost{color:#000;font:normal 11px arial,helvetica,sans-serif;border-color:#ddd #bbb #bbb #ddd;background-color:#fff}.x-dd-drop-nodrop .x-dd-drop-icon{background-image:url(../images/default/dd/drop-no.gif)}.x-dd-drop-ok .x-dd-drop-icon{background-image:url(../images/default/dd/drop-yes.gif)}.x-dd-drop-ok-add .x-dd-drop-icon{background-image:url(../images/default/dd/drop-add.gif)}.x-view-selector{background-color:#c3daf9;border-color:#39b}.x-tree-node-expanded .x-tree-node-icon{background-image:url(../images/default/tree/folder-open.gif)}.x-tree-node-leaf .x-tree-node-icon{background-image:url(../images/default/tree/leaf.gif)}.x-tree-node-collapsed .x-tree-node-icon{background-image:url(../images/default/tree/folder.gif)}.x-tree-node-loading .x-tree-node-icon{background-image:url(../images/default/tree/loading.gif)!important}.x-tree-node .x-tree-node-inline-icon{background-image:none}.x-tree-node-loading a span{font-style:italic;color:#444}.x-tree-lines .x-tree-elbow{background-image:url(../images/default/tree/elbow.gif)}.x-tree-lines .x-tree-elbow-plus{background-image:url(../images/default/tree/elbow-plus.gif)}.x-tree-lines .x-tree-elbow-minus{background-image:url(../images/default/tree/elbow-minus.gif)}.x-tree-lines .x-tree-elbow-end{background-image:url(../images/default/tree/elbow-end.gif)}.x-tree-lines .x-tree-elbow-end-plus{background-image:url(../images/default/tree/elbow-end-plus.gif)}.x-tree-lines .x-tree-elbow-end-minus{background-image:url(../images/default/tree/elbow-end-minus.gif)}.x-tree-lines .x-tree-elbow-line{background-image:url(../images/default/tree/elbow-line.gif)}.x-tree-no-lines .x-tree-elbow-plus{background-image:url(../images/default/tree/elbow-plus-nl.gif)}.x-tree-no-lines .x-tree-elbow-minus{background-image:url(../images/default/tree/elbow-minus-nl.gif)}.x-tree-no-lines .x-tree-elbow-end-plus{background-image:url(../images/default/tree/elbow-end-plus-nl.gif)}.x-tree-no-lines .x-tree-elbow-end-minus{background-image:url(../images/default/tree/elbow-end-minus-nl.gif)}.x-tree-arrows .x-tree-elbow-plus{background-image:url(../images/default/tree/arrows.gif)}.x-tree-arrows .x-tree-elbow-minus{background-image:url(../images/default/tree/arrows.gif)}.x-tree-arrows .x-tree-elbow-end-plus{background-image:url(../images/default/tree/arrows.gif)}.x-tree-arrows .x-tree-elbow-end-minus{background-image:url(../images/default/tree/arrows.gif)}.x-tree-node{color:#000;font:normal 11px arial,tahoma,helvetica,sans-serif}.x-tree-node a,.x-dd-drag-ghost a{color:#000}.x-tree-node a span,.x-dd-drag-ghost a span{color:#000}.x-tree-node .x-tree-node-disabled a span{color:gray!important}.x-tree-node div.x-tree-drag-insert-below{border-bottom-color:#36c}.x-tree-node div.x-tree-drag-insert-above{border-top-color:#36c}.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below a{border-bottom-color:#36c}.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above a{border-top-color:#36c}.x-tree-node .x-tree-drag-append a span{background-color:#ddd;border-color:gray}.x-tree-node .x-tree-node-over{background-color:#eee}.x-tree-node .x-tree-selected{background-color:#d9e8fb}.x-tree-drop-ok-append .x-dd-drop-icon{background-image:url(../images/default/tree/drop-add.gif)}.x-tree-drop-ok-above .x-dd-drop-icon{background-image:url(../images/default/tree/drop-over.gif)}.x-tree-drop-ok-below .x-dd-drop-icon{background-image:url(../images/default/tree/drop-under.gif)}.x-tree-drop-ok-between .x-dd-drop-icon{background-image:url(../images/default/tree/drop-between.gif)}.x-date-picker{border-color:#1b376c;background-color:#fff}.x-date-middle,.x-date-left,.x-date-right{background-image:url(../images/default/shared/hd-sprite.gif);color:#fff;font:bold 11px \"sans serif\",tahoma,verdana,helvetica}.x-date-middle .x-btn .x-btn-text{color:#fff}.x-date-middle .x-btn-mc em.x-btn-arrow{background-image:url(../images/default/toolbar/btn-arrow-light.gif)}.x-date-right a{background-image:url(../images/default/shared/right-btn.gif)}.x-date-left a{background-image:url(../images/default/shared/left-btn.gif)}.x-date-inner th{background-color:#dfecfb;background-image:url(../images/default/shared/glass-bg.gif);border-bottom-color:#a3bad9;font:normal 10px arial,helvetica,tahoma,sans-serif;color:#233d6d}.x-date-inner td{border-color:#fff}.x-date-inner a{font:normal 11px arial,helvetica,tahoma,sans-serif;color:#000}.x-date-inner .x-date-active{color:#000}.x-date-inner .x-date-selected a{background-color:#dfecfb;background-image:url(../images/default/shared/glass-bg.gif);border-color:#8db2e3}.x-date-inner .x-date-today a{border-color:darkred}.x-date-inner .x-date-selected span{font-weight:bold}.x-date-inner .x-date-prevday a,.x-date-inner .x-date-nextday a{color:#aaa}.x-date-bottom{border-top-color:#a3bad9;background-color:#dfecfb;background-image:url(../images/default/shared/glass-bg.gif)}.x-date-inner a:hover,.x-date-inner .x-date-disabled a:hover{color:#000;background-color:#ddecfe}.x-date-inner .x-date-disabled a{background-color:#eee;color:#bbb}.x-date-mmenu{background-color:#eee!important}.x-date-mmenu .x-menu-item{font-size:10px;color:#000}.x-date-mp{background-color:#fff}.x-date-mp td{font:normal 11px arial,helvetica,tahoma,sans-serif}.x-date-mp-btns button{background-color:#083772;color:#fff;border-color:#36c #005 #005 #36c;font:normal 11px arial,helvetica,tahoma,sans-serif}.x-date-mp-btns{background-color:#dfecfb;background-image:url(../images/default/shared/glass-bg.gif)}.x-date-mp-btns td{border-top-color:#c5d2df}td.x-date-mp-month a,td.x-date-mp-year a{color:#15428b}td.x-date-mp-month a:hover,td.x-date-mp-year a:hover{color:#15428b;background-color:#ddecfe}td.x-date-mp-sel a{background-color:#dfecfb;background-image:url(../images/default/shared/glass-bg.gif);border-color:#8db2e3}.x-date-mp-ybtn a{background-image:url(../images/default/panel/tool-sprites.gif)}td.x-date-mp-sep{border-right-color:#c5d2df}.x-tip .x-tip-close{background-image:url(../images/default/qtip/close.gif)}.x-tip .x-tip-tc,.x-tip .x-tip-tl,.x-tip .x-tip-tr,.x-tip .x-tip-bc,.x-tip .x-tip-bl,.x-tip .x-tip-br,.x-tip .x-tip-ml,.x-tip .x-tip-mr{background-image:url(../images/default/qtip/tip-sprite.gif)}.x-tip .x-tip-mc{font:normal 11px tahoma,arial,helvetica,sans-serif}.x-tip .x-tip-ml{background-color:#fff}.x-tip .x-tip-header-text{font:bold 11px tahoma,arial,helvetica,sans-serif;color:#444}.x-tip .x-tip-body{font:normal 11px tahoma,arial,helvetica,sans-serif;color:#444}.x-form-invalid-tip .x-tip-tc,.x-form-invalid-tip .x-tip-tl,.x-form-invalid-tip .x-tip-tr,.x-form-invalid-tip .x-tip-bc,.x-form-invalid-tip .x-tip-bl,.x-form-invalid-tip .x-tip-br,.x-form-invalid-tip .x-tip-ml,.x-form-invalid-tip .x-tip-mr{background-image:url(../images/default/form/error-tip-corners.gif)}.x-form-invalid-tip .x-tip-body{background-image:url(../images/default/form/exclamation.gif)}.x-tip-anchor{background-image:url(../images/default/qtip/tip-anchor-sprite.gif)}.x-menu{background-color:#f0f0f0;background-image:url(../images/default/menu/menu.gif)}.x-menu-floating{border-color:#718bb7}.x-menu-nosep{background-image:none}.x-menu-list-item{font:normal 11px arial,tahoma,sans-serif}.x-menu-item-arrow{background-image:url(../images/default/menu/menu-parent.gif)}.x-menu-sep{background-color:#e0e0e0;border-bottom-color:#fff}a.x-menu-item{color:#222}.x-menu-item-active{background-image:url(../images/default/menu/item-over.gif);background-color:#dbecf4;border-color:#aaccf6}.x-menu-item-active a.x-menu-item{border-color:#aaccf6}.x-menu-check-item .x-menu-item-icon{background-image:url(../images/default/menu/unchecked.gif)}.x-menu-item-checked .x-menu-item-icon{background-image:url(../images/default/menu/checked.gif)}.x-menu-item-checked .x-menu-group-item .x-menu-item-icon{background-image:url(../images/default/menu/group-checked.gif)}.x-menu-group-item .x-menu-item-icon{background-image:none}.x-menu-plain{background-color:#f0f0f0!important;background-image:none}.x-date-menu,.x-color-menu{background-color:#fff!important}.x-menu .x-date-picker{border-color:#a3bad9}.x-cycle-menu .x-menu-item-checked{border-color:#a3bae9!important;background-color:#def8f6}.x-menu-scroller-top{background-image:url(../images/default/layout/mini-top.gif)}.x-menu-scroller-bottom{background-image:url(../images/default/layout/mini-bottom.gif)}.x-box-tl{background-image:url(../images/default/box/corners.gif)}.x-box-tc{background-image:url(../images/default/box/tb.gif)}.x-box-tr{background-image:url(../images/default/box/corners.gif)}.x-box-ml{background-image:url(../images/default/box/l.gif)}.x-box-mc{background-color:#eee;background-image:url(../images/default/box/tb.gif);font-family:\"Myriad Pro\",\"Myriad Web\",\"Tahoma\",\"Helvetica\",\"Arial\",sans-serif;color:#393939;font-size:12px}.x-box-mc h3{font-size:14px;font-weight:bold}.x-box-mr{background-image:url(../images/default/box/r.gif)}.x-box-bl{background-image:url(../images/default/box/corners.gif)}.x-box-bc{background-image:url(../images/default/box/tb.gif)}.x-box-br{background-image:url(../images/default/box/corners.gif)}.x-box-blue .x-box-bl,.x-box-blue .x-box-br,.x-box-blue .x-box-tl,.x-box-blue .x-box-tr{background-image:url(../images/default/box/corners-blue.gif)}.x-box-blue .x-box-bc,.x-box-blue .x-box-mc,.x-box-blue .x-box-tc{background-image:url(../images/default/box/tb-blue.gif)}.x-box-blue .x-box-mc{background-color:#c3daf9}.x-box-blue .x-box-mc h3{color:#17385b}.x-box-blue .x-box-ml{background-image:url(../images/default/box/l-blue.gif)}.x-box-blue .x-box-mr{background-image:url(../images/default/box/r-blue.gif)}.x-combo-list{border-color:#98c0f4;background-color:#ddecfe;font:normal 12px tahoma,arial,helvetica,sans-serif}.x-combo-list-inner{background-color:#fff}.x-combo-list-hd{font:bold 11px tahoma,arial,helvetica,sans-serif;color:#15428b;background-image:url(../images/default/layout/panel-title-light-bg.gif);border-bottom-color:#98c0f4}.x-resizable-pinned .x-combo-list-inner{border-bottom-color:#98c0f4}.x-combo-list-item{border-color:#fff}.x-combo-list .x-combo-selected{border-color:#a3bae9!important;background-color:#dfe8f6}.x-combo-list .x-toolbar{border-top-color:#98c0f4}.x-combo-list-small{font:normal 11px tahoma,arial,helvetica,sans-serif}.x-panel{border-color:#99bbe8}.x-panel-header{color:#15428b;font-weight:bold;font-size:11px;font-family:tahoma,arial,verdana,sans-serif;border-color:#99bbe8;background-image:url(../images/default/panel/white-top-bottom.gif)}.x-panel-body{border-color:#99bbe8;background-color:#fff}.x-panel-bbar .x-toolbar,.x-panel-tbar .x-toolbar{border-color:#99bbe8}.x-panel-tbar-noheader .x-toolbar,.x-panel-mc .x-panel-tbar .x-toolbar{border-top-color:#99bbe8}.x-panel-body-noheader,.x-panel-mc .x-panel-body{border-top-color:#99bbe8}.x-panel-tl .x-panel-header{color:#15428b;font:bold 11px tahoma,arial,verdana,sans-serif}.x-panel-tc{background-image:url(../images/default/panel/top-bottom.gif)}.x-panel-tl,.x-panel-tr,.x-panel-bl,.x-panel-br{background-image:url(../images/default/panel/corners-sprite.gif);border-bottom-color:#99bbe8}.x-panel-bc{background-image:url(../images/default/panel/top-bottom.gif)}.x-panel-mc{font:normal 11px tahoma,arial,helvetica,sans-serif;background-color:#dfe8f6}.x-panel-ml{background-color:#fff;background-image:url(../images/default/panel/left-right.gif)}.x-panel-mr{background-image:url(../images/default/panel/left-right.gif)}.x-tool{background-image:url(../images/default/panel/tool-sprites.gif)}.x-panel-ghost{background-color:#cbddf3}.x-panel-ghost ul{border-color:#99bbe8}.x-panel-dd-spacer{border-color:#99bbe8}.x-panel-fbar td,.x-panel-fbar span,.x-panel-fbar input,.x-panel-fbar div,.x-panel-fbar select,.x-panel-fbar label{font:normal 11px arial,tahoma,helvetica,sans-serif}.x-window-proxy{background-color:#c7dffc;border-color:#99bbe8}.x-window-tl .x-window-header{color:#15428b;font:bold 11px tahoma,arial,verdana,sans-serif}.x-window-tc{background-image:url(../images/default/window/top-bottom.png)}.x-window-tl{background-image:url(../images/default/window/left-corners.png)}.x-window-tr{background-image:url(../images/default/window/right-corners.png)}.x-window-bc{background-image:url(../images/default/window/top-bottom.png)}.x-window-bl{background-image:url(../images/default/window/left-corners.png)}.x-window-br{background-image:url(../images/default/window/right-corners.png)}.x-window-mc{border-color:#99bbe8;font:normal 11px tahoma,arial,helvetica,sans-serif;background-color:#dfe8f6}.x-window-ml{background-image:url(../images/default/window/left-right.png)}.x-window-mr{background-image:url(../images/default/window/left-right.png)}.x-window-maximized .x-window-tc{background-color:#fff}.x-window-bbar .x-toolbar{border-top-color:#99bbe8}.x-panel-ghost .x-window-tl{border-bottom-color:#99bbe8}.x-panel-collapsed .x-window-tl{border-bottom-color:#84a0c4}.x-dlg-mask{background-color:#ccc}.x-window-plain .x-window-mc{background-color:#ccd9e8;border-color:#a3bae9 #dfe8f6 #dfe8f6 #a3bae9}.x-window-plain .x-window-body{border-color:#dfe8f6 #a3bae9 #a3bae9 #dfe8f6}body.x-body-masked .x-window-plain .x-window-mc{background-color:#ccd9e8}.x-html-editor-wrap{border-color:#a9bfd3;background-color:#fff}.x-html-editor-tb .x-btn-text{background-image:url(../images/default/editor/tb-sprite.gif)}.x-panel-noborder .x-panel-header-noborder{border-bottom-color:#99bbe8}.x-panel-noborder .x-panel-tbar-noborder .x-toolbar{border-bottom-color:#99bbe8}.x-panel-noborder .x-panel-bbar-noborder .x-toolbar{border-top-color:#99bbe8}.x-tab-panel-bbar-noborder .x-toolbar{border-top-color:#99bbe8}.x-tab-panel-tbar-noborder .x-toolbar{border-bottom-color:#99bbe8}.x-border-layout-ct{background-color:#dfe8f6}.x-accordion-hd{color:#222;font-weight:normal;background-image:url(../images/default/panel/light-hd.gif)}.x-layout-collapsed{background-color:#d2e0f2;border-color:#98c0f4}.x-layout-collapsed-over{background-color:#d9e8fb}.x-layout-split-west .x-layout-mini{background-image:url(../images/default/layout/mini-left.gif)}.x-layout-split-east .x-layout-mini{background-image:url(../images/default/layout/mini-right.gif)}.x-layout-split-north .x-layout-mini{background-image:url(../images/default/layout/mini-top.gif)}.x-layout-split-south .x-layout-mini{background-image:url(../images/default/layout/mini-bottom.gif)}.x-layout-cmini-west .x-layout-mini{background-image:url(../images/default/layout/mini-right.gif)}.x-layout-cmini-east .x-layout-mini{background-image:url(../images/default/layout/mini-left.gif)}.x-layout-cmini-north .x-layout-mini{background-image:url(../images/default/layout/mini-bottom.gif)}.x-layout-cmini-south .x-layout-mini{background-image:url(../images/default/layout/mini-top.gif)}.x-progress-wrap{border-color:#6593cf}.x-progress-inner{background-color:#e0e8f3;background-image:url(../images/default/qtip/bg.gif)}.x-progress-bar{background-color:#9cbfee;background-image:url(../images/default/progress/progress-bg.gif);border-top-color:#d1e4fd;border-bottom-color:#7fa9e4;border-right-color:#7fa9e4}.x-progress-text{font-size:11px;font-weight:bold;color:#fff}.x-progress-text-back{color:#396095}.x-list-header{background-color:#f9f9f9;background-image:url(../images/default/grid/grid3-hrow.gif)}.x-list-header-inner div em{border-left-color:#ddd;font:normal 11px arial,tahoma,helvetica,sans-serif}.x-list-body dt em{font:normal 11px arial,tahoma,helvetica,sans-serif}.x-list-over{background-color:#eee}.x-list-selected{background-color:#dfe8f6}.x-list-resizer{border-left-color:#555;border-right-color:#555}.x-list-header-inner em.sort-asc,.x-list-header-inner em.sort-desc{background-image:url(../images/default/grid/sort-hd.gif);border-color:#99bbe8}.x-slider-horz,.x-slider-horz .x-slider-end,.x-slider-horz .x-slider-inner{background-image:url(../images/default/slider/slider-bg.png)}.x-slider-horz .x-slider-thumb{background-image:url(../images/default/slider/slider-thumb.png)}.x-slider-vert,.x-slider-vert .x-slider-end,.x-slider-vert .x-slider-inner{background-image:url(../images/default/slider/slider-v-bg.png)}.x-slider-vert .x-slider-thumb{background-image:url(../images/default/slider/slider-v-thumb.png)}.x-window-dlg .ext-mb-text,.x-window-dlg .x-window-header-text{font-size:12px}.x-window-dlg .ext-mb-textarea{font:normal 12px tahoma,arial,helvetica,sans-serif}.x-window-dlg .x-msg-box-wait{background-image:url(../images/default/grid/loading.gif)}.x-window-dlg .ext-mb-info{background-image:url(../images/default/window/icon-info.gif)}.x-window-dlg .ext-mb-warning{background-image:url(../images/default/window/icon-warning.gif)}.x-window-dlg .ext-mb-question{background-image:url(../images/default/window/icon-question.gif)}.x-window-dlg .ext-mb-error{background-image:url(../images/default/window/icon-error.gif)}"
  },
  {
    "path": "client/src/ext/resources/css/reset-min.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nhtml,body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,p,blockquote,th,td{margin:0;padding:0;}img,body,html{border:0;}address,caption,cite,code,dfn,em,strong,th,var{font-style:normal;font-weight:normal;}ol,ul {list-style:none;}caption,th {text-align:left;}h1,h2,h3,h4,h5,h6{font-size:100%;}q:before,q:after{content:'';}"
  },
  {
    "path": "client/src/ext/resources/css/structure/borders.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-panel-noborder .x-panel-body-noborder {\n    border-width:0;\n}\n\n.x-panel-noborder .x-panel-header-noborder {\n    border-width:0 0 1px;\n    border-style:solid;\n}\n\n.x-panel-noborder .x-panel-tbar-noborder .x-toolbar {\n    border-width:0 0 1px;\n    border-style:solid;\n}\n\n.x-panel-noborder .x-panel-bbar-noborder .x-toolbar {\n    border-width:1px 0 0 0;\n    border-style:solid;\n}\n\n.x-window-noborder .x-window-mc {\n    border-width:0;\n}\n\n.x-window-plain .x-window-body-noborder {\n    border-width:0;\n}\n\n.x-tab-panel-noborder .x-tab-panel-body-noborder {\n\tborder-width:0;\n}\n\n.x-tab-panel-noborder .x-tab-panel-header-noborder {\n    border-width: 0 0 1px 0;\n}\n\n.x-tab-panel-noborder .x-tab-panel-footer-noborder {\n    border-width: 1px 0 0 0;\n}\n\n.x-tab-panel-bbar-noborder .x-toolbar {\n    border-width: 1px 0 0 0;\n    border-style:solid;\n}\n\n.x-tab-panel-tbar-noborder .x-toolbar {\n    border-width:0 0 1px;\n    border-style:solid;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/box.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/*\n Creates rounded, raised boxes like on the Ext website - the markup isn't pretty:\n  <div class=\"x-box-blue\">\n        <div class=\"x-box-tl\"><div class=\"x-box-tr\"><div class=\"x-box-tc\"></div></div></div>\n        <div class=\"x-box-ml\"><div class=\"x-box-mr\"><div class=\"x-box-mc\">\n            <h3>YOUR TITLE HERE (optional)</h3>\n            <div>YOUR CONTENT HERE</div>\n        </div></div></div>\n        <div class=\"x-box-bl\"><div class=\"x-box-br\"><div class=\"x-box-bc\"></div></div></div>\n    </div>\n */\n\n.x-box-tl {\n\tbackground: transparent no-repeat 0 0;\n    zoom:1;\n}\n\n.x-box-tc {\n\theight: 8px;\n\tbackground: transparent repeat-x 0 0;\n\toverflow: hidden;\n}\n\n.x-box-tr {\n\tbackground: transparent no-repeat right -8px;\n}\n\n.x-box-ml {\n\tbackground: transparent repeat-y 0;\n\tpadding-left: 4px;\n\toverflow: hidden;\n    zoom:1;\n}\n\n.x-box-mc {\n\tbackground: repeat-x 0 -16px;\n\tpadding: 4px 10px;\n}\n\n.x-box-mc h3 {\n\tmargin: 0 0 4px 0;\n    zoom:1;\n}\n\n.x-box-mr {\n\tbackground: transparent repeat-y right;\n\tpadding-right: 4px;\n\toverflow: hidden;\n}\n\n.x-box-bl {\n\tbackground: transparent no-repeat 0 -16px;\n    zoom:1;\n}\n\n.x-box-bc {\n\tbackground: transparent repeat-x 0 -8px;\n\theight: 8px;\n\toverflow: hidden;\n}\n\n.x-box-br {\n\tbackground: transparent no-repeat right -24px;\n}\n\n.x-box-tl, .x-box-bl {\n\tpadding-left: 8px;\n\toverflow: hidden;\n}\n\n.x-box-tr, .x-box-br {\n\tpadding-right: 8px;\n\toverflow: hidden;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/button.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-btn{\n\tcursor:pointer;\n\twhite-space: nowrap;\n}\n\n.x-btn button{\n    border:0 none;\n    background-color:transparent;\n    padding-left:3px;\n    padding-right:3px;\n    cursor:pointer;\n    margin:0;\n    overflow:visible;\n    width:auto;\n    -moz-outline:0 none;\n    outline:0 none;\n}\n\n* html .ext-ie .x-btn button {\n    width:1px;\n}\n\n.ext-gecko .x-btn button, .ext-webkit .x-btn button {\n    padding-left:0;\n    padding-right:0;\n}\n\n.ext-gecko .x-btn button::-moz-focus-inner {\n    padding:0;\n}\n\n.ext-ie .x-btn button {\n    padding-top:2px;\n}\n\n.x-btn td {\n    padding:0 !important;\n}\n\n.x-btn-text {\n    cursor:pointer;\n\twhite-space: nowrap;\n    padding:0;\n}\n\n/* icon placement and sizing styles */\n\n/* Only text */\n.x-btn-noicon .x-btn-small .x-btn-text{\n\theight: 16px;\n}\n\n.x-btn-noicon .x-btn-medium .x-btn-text{\n    height: 24px;\n}\n\n.x-btn-noicon .x-btn-large .x-btn-text{\n    height: 32px;\n}\n\n/* Only icons */\n.x-btn-icon .x-btn-text{\n    background-position: center;\n\tbackground-repeat: no-repeat;\n}\n\n.x-btn-icon .x-btn-small .x-btn-text{\n\theight: 16px;\n\twidth: 16px;\n}\n\n.x-btn-icon .x-btn-medium .x-btn-text{\n    height: 24px;\n\twidth: 24px;\n}\n\n.x-btn-icon .x-btn-large .x-btn-text{\n    height: 32px;\n\twidth: 32px;\n}\n\n/* Icons and text */\n/* left */\n.x-btn-text-icon .x-btn-icon-small-left .x-btn-text{\n    background-position: 0 center;\n\tbackground-repeat: no-repeat;\n    padding-left:18px;\n    height:16px;\n}\n\n.x-btn-text-icon .x-btn-icon-medium-left .x-btn-text{\n    background-position: 0 center;\n\tbackground-repeat: no-repeat;\n    padding-left:26px;\n    height:24px;\n}\n\n.x-btn-text-icon .x-btn-icon-large-left .x-btn-text{\n    background-position: 0 center;\n\tbackground-repeat: no-repeat;\n    padding-left:34px;\n    height:32px;\n}\n\n/* top */\n.x-btn-text-icon .x-btn-icon-small-top .x-btn-text{\n    background-position: center 0;\n\tbackground-repeat: no-repeat;\n    padding-top:18px;\n}\n\n.x-btn-text-icon .x-btn-icon-medium-top .x-btn-text{\n    background-position: center 0;\n\tbackground-repeat: no-repeat;\n    padding-top:26px;\n}\n\n.x-btn-text-icon .x-btn-icon-large-top .x-btn-text{\n    background-position: center 0;\n\tbackground-repeat: no-repeat;\n    padding-top:34px;\n}\n\n/* right */\n.x-btn-text-icon .x-btn-icon-small-right .x-btn-text{\n    background-position: right center;\n\tbackground-repeat: no-repeat;\n    padding-right:18px;\n    height:16px;\n}\n\n.x-btn-text-icon .x-btn-icon-medium-right .x-btn-text{\n    background-position: right center;\n\tbackground-repeat: no-repeat;\n    padding-right:26px;\n    height:24px;\n}\n\n.x-btn-text-icon .x-btn-icon-large-right .x-btn-text{\n    background-position: right center;\n\tbackground-repeat: no-repeat;\n    padding-right:34px;\n    height:32px;\n}\n\n/* bottom */\n.x-btn-text-icon .x-btn-icon-small-bottom .x-btn-text{\n    background-position: center bottom;\n\tbackground-repeat: no-repeat;\n    padding-bottom:18px;\n}\n\n.x-btn-text-icon .x-btn-icon-medium-bottom .x-btn-text{\n    background-position: center bottom;\n\tbackground-repeat: no-repeat;\n    padding-bottom:26px;\n}\n\n.x-btn-text-icon .x-btn-icon-large-bottom .x-btn-text{\n    background-position: center bottom;\n\tbackground-repeat: no-repeat;\n    padding-bottom:34px;\n}\n\n/* background positioning */\n.x-btn-tr i, .x-btn-tl i, .x-btn-mr i, .x-btn-ml i, .x-btn-br i, .x-btn-bl i{\n\tfont-size:1px;\n    line-height:1px;\n    width:3px;\n    display:block;\n    overflow:hidden;\n}\n\n.x-btn-tr i, .x-btn-tl i, .x-btn-br i, .x-btn-bl i{\n\theight:3px;\n}\n\n.x-btn-tl{\n\twidth:3px;\n\theight:3px;\n\tbackground:no-repeat 0 0;\n}\n.x-btn-tr{\n\twidth:3px;\n\theight:3px;\n\tbackground:no-repeat -3px 0;\n}\n.x-btn-tc{\n\theight:3px;\n\tbackground:repeat-x 0 -6px;\n}\n\n.x-btn-ml{\n\twidth:3px;\n\tbackground:no-repeat 0 -24px;\n}\n.x-btn-mr{\n\twidth:3px;\n\tbackground:no-repeat -3px -24px;\n}\n\n.x-btn-mc{\n\tbackground:repeat-x 0 -1096px;\n    vertical-align: middle;\n\ttext-align:center;\n\tpadding:0 5px;\n\tcursor:pointer;\n\twhite-space:nowrap;\n}\n\n/* Fixes an issue with the button height */\n.ext-strict .ext-ie6 .x-btn-mc, .ext-strict .ext-ie7 .x-btn-mc {\n    height: 100%;\n}\n\n.x-btn-bl{\n\twidth:3px;\n\theight:3px;\n\tbackground:no-repeat 0 -3px;\n}\n\n.x-btn-br{\n\twidth:3px;\n\theight:3px;\n\tbackground:no-repeat -3px -3px;\n}\n\n.x-btn-bc{\n\theight:3px;\n\tbackground:repeat-x 0 -15px;\n}\n\n.x-btn-over .x-btn-tl{\n\tbackground-position: -6px 0;\n}\n\n.x-btn-over .x-btn-tr{\n\tbackground-position: -9px 0;\n}\n\n.x-btn-over .x-btn-tc{\n\tbackground-position: 0 -9px;\n}\n\n.x-btn-over .x-btn-ml{\n\tbackground-position: -6px -24px;\n}\n\n.x-btn-over .x-btn-mr{\n\tbackground-position: -9px -24px;\n}\n\n.x-btn-over .x-btn-mc{\n\tbackground-position: 0 -2168px;\n}\n\n.x-btn-over .x-btn-bl{\n\tbackground-position: -6px -3px;\n}\n\n.x-btn-over .x-btn-br{\n\tbackground-position: -9px -3px;\n}\n\n.x-btn-over .x-btn-bc{\n\tbackground-position: 0 -18px;\n}\n\n.x-btn-click .x-btn-tl, .x-btn-menu-active .x-btn-tl, .x-btn-pressed .x-btn-tl{\n\tbackground-position: -12px 0;\n}\n\n.x-btn-click .x-btn-tr, .x-btn-menu-active .x-btn-tr, .x-btn-pressed .x-btn-tr{\n\tbackground-position: -15px 0;\n}\n\n.x-btn-click .x-btn-tc, .x-btn-menu-active .x-btn-tc, .x-btn-pressed .x-btn-tc{\n\tbackground-position: 0 -12px;\n}\n\n.x-btn-click .x-btn-ml, .x-btn-menu-active .x-btn-ml, .x-btn-pressed .x-btn-ml{\n\tbackground-position: -12px -24px;\n}\n\n.x-btn-click .x-btn-mr, .x-btn-menu-active .x-btn-mr, .x-btn-pressed .x-btn-mr{\n\tbackground-position: -15px -24px;\n}\n\n.x-btn-click .x-btn-mc, .x-btn-menu-active .x-btn-mc, .x-btn-pressed .x-btn-mc{\n\tbackground-position: 0 -3240px;\n}\n\n.x-btn-click .x-btn-bl, .x-btn-menu-active .x-btn-bl, .x-btn-pressed .x-btn-bl{\n\tbackground-position: -12px -3px;\n}\n\n.x-btn-click .x-btn-br, .x-btn-menu-active .x-btn-br, .x-btn-pressed .x-btn-br{\n\tbackground-position: -15px -3px;\n}\n\n.x-btn-click .x-btn-bc, .x-btn-menu-active .x-btn-bc, .x-btn-pressed .x-btn-bc{\n\tbackground-position: 0 -21px;\n}\n\n.x-btn-disabled *{\n\tcursor:default !important;\n}\n\n\n/* With a menu arrow */\n/* right */\n.x-btn-mc em.x-btn-arrow {\n    display:block;\n    background:transparent no-repeat right center;\n\tpadding-right:10px;\n}\n\n.x-btn-mc em.x-btn-split {\n    display:block;\n    background:transparent no-repeat right center;\n\tpadding-right:14px;\n}\n\n/* bottom */\n.x-btn-mc em.x-btn-arrow-bottom {\n    display:block;\n    background:transparent no-repeat center bottom;\n\tpadding-bottom:14px;\n}\n\n.x-btn-mc em.x-btn-split-bottom {\n    display:block;\n    background:transparent no-repeat center bottom;\n\tpadding-bottom:14px;\n}\n\n/* height adjustment class */\n.x-btn-as-arrow .x-btn-mc em {\n    display:block;\n    background-color:transparent;\n\tpadding-bottom:14px;\n}\n\n/* groups */\n.x-btn-group {\n    padding:1px;\n}\n\n.x-btn-group-header {\n    padding:2px;\n    text-align:center;\n}\n\n.x-btn-group-tc {\n\tbackground: transparent repeat-x 0 0;\n\toverflow:hidden;\n}\n\n.x-btn-group-tl {\n\tbackground: transparent no-repeat 0 0;\n\tpadding-left:3px;\n    zoom:1;\n}\n\n.x-btn-group-tr {\n\tbackground: transparent no-repeat right 0;\n\tzoom:1;\n    padding-right:3px;\n}\n\n.x-btn-group-bc {\n\tbackground: transparent repeat-x 0 bottom;\n    zoom:1;\n}\n\n.x-btn-group-bc .x-panel-footer {\n    zoom:1;\n}\n\n.x-btn-group-bl {\n\tbackground: transparent no-repeat 0 bottom;\n\tpadding-left:3px;\n    zoom:1;\n}\n\n.x-btn-group-br {\n\tbackground: transparent no-repeat right bottom;\n\tpadding-right:3px;\n    zoom:1;\n}\n\n.x-btn-group-mc {\n    border:0 none;\n    padding:1px 0 0 0;\n    margin:0;\n}\n\n.x-btn-group-mc .x-btn-group-body {\n    background-color:transparent;\n    border: 0 none;\n}\n\n.x-btn-group-ml {\n\tbackground: transparent repeat-y 0 0;\n\tpadding-left:3px;\n    zoom:1;\n}\n\n.x-btn-group-mr {\n\tbackground: transparent repeat-y right 0;\n\tpadding-right:3px;\n    zoom:1;\n}\n\n.x-btn-group-bc .x-btn-group-footer {\n    padding-bottom:6px;\n}\n\n.x-panel-nofooter .x-btn-group-bc {\n\theight:3px;\n    font-size:0;\n    line-height:0;\n}\n\n.x-btn-group-bwrap {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-btn-group-body {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-btn-group-notitle .x-btn-group-tc {\n\tbackground: transparent repeat-x 0 0;\n\toverflow:hidden;\n    height:2px;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/combo.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-combo-list {\n    border:1px solid;\n    zoom:1;\n    overflow:hidden;\n}\n\n.x-combo-list-inner {\n    overflow:auto;\n    position:relative; /* for calculating scroll offsets */\n    zoom:1;\n    overflow-x:hidden;\n}\n\n.x-combo-list-hd {\n    border-bottom:1px solid;\n    padding:3px;\n}\n\n.x-resizable-pinned .x-combo-list-inner {\n    border-bottom:1px solid;\n}\n\n.x-combo-list-item {\n    padding:2px;\n    border:1px solid;\n    white-space: nowrap;\n    overflow:hidden;\n    text-overflow: ellipsis;\n}\n\n.x-combo-list .x-combo-selected{\n\tborder:1px dotted !important;\n    cursor:pointer;\n}\n\n.x-combo-list .x-toolbar {\n    border-top:1px solid;\n    border-bottom:0 none;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/core.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.ext-el-mask {\n    z-index: 100;\n    position: absolute;\n    top:0;\n    left:0;\n    -moz-opacity: 0.5;\n    opacity: .50;\n    filter: alpha(opacity=50);\n    width: 100%;\n    height: 100%;\n    zoom: 1;\n}\n\n.ext-el-mask-msg {\n    z-index: 20001;\n    position: absolute;\n    top: 0;\n    left: 0;\n    border:1px solid;\n    background:repeat-x 0 -16px;\n    padding:2px;\n}\n\n.ext-el-mask-msg div {\n    padding:5px 10px 5px 10px;\n    border:1px solid;\n    cursor:wait;\n}\n\n.ext-shim {\n    position:absolute;\n    visibility:hidden;\n    left:0;\n    top:0;\n    overflow:hidden;\n}\n\n.ext-ie .ext-shim {\n    filter: alpha(opacity=0);\n}\n\n.ext-ie6 .ext-shim {\n    margin-left: 5px;\n    margin-top: 3px;\n}\n\n.x-mask-loading div {\n    padding:5px 10px 5px 25px;\n    background:no-repeat 5px 5px;\n    line-height:16px;\n}\n\n/* class for hiding elements without using display:none */\n.x-hidden, .x-hide-offsets {\n    position:absolute !important;\n    left:-10000px;\n    top:-10000px;\n    visibility:hidden;\n}\n\n.x-hide-display {\n    display:none !important;\n}\n\n.x-hide-nosize,\n.x-hide-nosize *    /* Emulate display:none for children */\n {\n   height:0px!important;\n   width:0px!important;\n   visibility:hidden!important;\n   border:none!important;\n   zoom:1;\n}\n\n.x-hide-visibility {\n    visibility:hidden !important;\n}\n\n.x-masked {\n    overflow: hidden !important;\n}\n.x-masked-relative {\n    position: relative !important;\n}\n\n.x-masked select, .x-masked object, .x-masked embed {\n    visibility: hidden;\n}\n\n.x-layer {\n    visibility: hidden;\n}\n\n.x-unselectable, .x-unselectable * {\n    user-select: none;\n    -o-user-select: none;\n    -ms-user-select: none;\n    -moz-user-select: -moz-none;\n    -webkit-user-select: none;\n    \n    cursor:default;\n}\n\n.x-repaint {\n    zoom: 1;\n    background-color: transparent;\n    -moz-outline: none;\n    outline: none;\n}\n\n.x-item-disabled {\n    cursor: default;\n    opacity: .6;\n    -moz-opacity: .6;\n    filter: alpha(opacity=60);\n}\n\n.x-item-disabled * {\n    cursor: default !important;\n}\n\n.x-form-radio-group .x-item-disabled {\n    filter: none;\n}\n\n.x-splitbar-proxy {\n    position: absolute;\n    visibility: hidden;\n    z-index: 20001;\n    zoom: 1;\n    line-height: 1px;\n    font-size: 1px;\n    overflow: hidden;\n}\n\n.x-splitbar-h, .x-splitbar-proxy-h {\n    cursor: e-resize;\n    cursor: col-resize;\n}\n\n.x-splitbar-v, .x-splitbar-proxy-v {\n    cursor: s-resize;\n    cursor: row-resize;\n}\n\n.x-color-palette {\n    width: 150px;\n    height: 92px;\n    cursor: pointer;\n}\n\n.x-color-palette a {\n    border: 1px solid;\n    float: left;\n    padding: 2px;\n    text-decoration: none;\n    -moz-outline: 0 none;\n    outline: 0 none;\n    cursor: pointer;\n}\n\n.x-color-palette a:hover, .x-color-palette a.x-color-palette-sel {\n    border: 1px solid;\n}\n\n.x-color-palette em {\n    display: block;\n    border: 1px solid;\n}\n\n.x-color-palette em span {\n    cursor: pointer;\n    display: block;\n    height: 10px;\n    line-height: 10px;\n    width: 10px;\n}\n\n.x-ie-shadow {\n    display: none;\n    position: absolute;\n    overflow: hidden;\n    left:0;\n    top:0;\n    zoom:1;\n}\n\n.x-shadow {\n    display: none;\n    position: absolute;\n    overflow: hidden;\n    left:0;\n    top:0;\n}\n\n.x-shadow * {\n    overflow: hidden;\n}\n\n.x-shadow * {\n    padding: 0;\n    border: 0;\n    margin: 0;\n    clear: none;\n    zoom: 1;\n}\n\n/* top  bottom */\n.x-shadow .xstc, .x-shadow .xsbc {\n    height: 6px;\n    float: left;\n}\n\n/* corners */\n.x-shadow .xstl, .x-shadow .xstr, .x-shadow .xsbl, .x-shadow .xsbr {\n    width: 6px;\n    height: 6px;\n    float: left;\n}\n\n/* sides */\n.x-shadow .xsc {\n    width: 100%;\n}\n\n.x-shadow .xsml, .x-shadow .xsmr {\n    width: 6px;\n    float: left;\n    height: 100%;\n}\n\n.x-shadow .xsmc {\n    float: left;\n    height: 100%;\n    background-color: transparent;\n}\n\n.x-shadow .xst, .x-shadow .xsb {\n    height: 6px;\n    overflow: hidden;\n    width: 100%;\n}\n\n.x-shadow .xsml {\n    background: transparent repeat-y 0 0;\n}\n\n.x-shadow .xsmr {\n    background: transparent repeat-y -6px 0;\n}\n\n.x-shadow .xstl {\n    background: transparent no-repeat 0 0;\n}\n\n.x-shadow .xstc {\n    background: transparent repeat-x 0 -30px;\n}\n\n.x-shadow .xstr {\n    background: transparent repeat-x 0 -18px;\n}\n\n.x-shadow .xsbl {\n    background: transparent no-repeat 0 -12px;\n}\n\n.x-shadow .xsbc {\n    background: transparent repeat-x 0 -36px;\n}\n\n.x-shadow .xsbr {\n    background: transparent repeat-x 0 -6px;\n}\n\n.loading-indicator {\n    background: no-repeat left;\n    padding-left: 20px;\n    line-height: 16px;\n    margin: 3px;\n}\n\n.x-text-resize {\n    position: absolute;\n    left: -1000px;\n    top: -1000px;\n    visibility: hidden;\n    zoom: 1;\n}\n\n.x-drag-overlay {\n    width: 100%;\n    height: 100%;\n    display: none;\n    position: absolute;\n    left: 0;\n    top: 0;\n    background-image:url(../images/default/s.gif);\n    z-index: 20000;\n}\n\n.x-clear {\n    clear:both;\n    height:0;\n    overflow:hidden;\n    line-height:0;\n    font-size:0;\n}\n\n.x-spotlight {\n    z-index: 8999;\n    position: absolute;\n    top:0;\n    left:0;\n    -moz-opacity: 0.5;\n    opacity: .50;\n    filter: alpha(opacity=50);\n    width:0;\n    height:0;\n    zoom: 1;\n}\n\n#x-history-frame {\n    position:absolute;\n    top:-1px;\n    left:0;\n\twidth:1px;\n    height:1px;\n    visibility:hidden;\n}\n\n#x-history-field {\n    position:absolute;\n    top:0;\n    left:-1px;\n\twidth:1px;\n    height:1px;\n    visibility:hidden;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/structure/date-picker.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-date-picker {\n    border: 1px solid;\n    border-top:0 none;\n\tposition:relative;\n}\n\n.x-date-picker a {\n    -moz-outline:0 none;\n    outline:0 none;\n}\n\n.x-date-inner, .x-date-inner td, .x-date-inner th{\n    border-collapse:separate;\n}\n\n.x-date-middle,.x-date-left,.x-date-right {\n\tbackground: repeat-x 0 -83px;\n\toverflow:hidden;\n}\n\n.x-date-middle .x-btn-tc,.x-date-middle .x-btn-tl,.x-date-middle .x-btn-tr,\n.x-date-middle .x-btn-mc,.x-date-middle .x-btn-ml,.x-date-middle .x-btn-mr,\n.x-date-middle .x-btn-bc,.x-date-middle .x-btn-bl,.x-date-middle .x-btn-br{\n\tbackground:transparent !important;\n    vertical-align:middle;\n}\n\n.x-date-middle .x-btn-mc em.x-btn-arrow {\n    background:transparent no-repeat right 0;\n}\n\n.x-date-right, .x-date-left {\n    width:18px;\n}\n\n.x-date-right{\n    text-align:right;\n}\n\n.x-date-middle {\n    padding-top:2px;\n    padding-bottom:2px;\n    width:130px; /* FF3 */\n}\n\n.x-date-right a, .x-date-left a{\n    display:block;\n    width:16px;\n\theight:16px;\n\tbackground-position: center;\n\tbackground-repeat: no-repeat;\n\tcursor:pointer;\n    -moz-opacity: 0.6;\n    opacity:.6;\n    filter: alpha(opacity=60);\n}\n\n.x-date-right a:hover, .x-date-left a:hover{\n    -moz-opacity: 1;\n    opacity:1;\n    filter: alpha(opacity=100);\n}\n\n.x-item-disabled .x-date-right a:hover, .x-item-disabled .x-date-left a:hover{\n    -moz-opacity: 0.6;\n    opacity:.6;\n    filter: alpha(opacity=60);\n}\n\n.x-date-right a {\n    margin-right:2px;\n    text-decoration:none !important;\n}\n\n.x-date-left a{\n    margin-left:2px;\n    text-decoration:none !important;\n}\n\ntable.x-date-inner {\n    width: 100%;\n    table-layout:fixed;\n}\n\n.ext-webkit table.x-date-inner{\n    /* Fix for webkit browsers */\n    width: 175px;\n}\n\n\n.x-date-inner th {\n    width:25px;\n}\n\n.x-date-inner th {\n    background: repeat-x left top;\n    text-align:right !important;\n\tborder-bottom: 1px solid;\n\tcursor:default;\n    padding:0;\n    border-collapse:separate;\n}\n\n.x-date-inner th span {\n    display:block;\n    padding:2px;\n    padding-right:7px;\n}\n\n.x-date-inner td {\n    border: 1px solid;\n\ttext-align:right;\n    padding:0;\n}\n\n.x-date-inner a {\n    padding:2px 5px;\n    display:block;\n\ttext-decoration:none;\n    text-align:right;\n    zoom:1;\n}\n\n.x-date-inner .x-date-active{\n\tcursor:pointer;\n\tcolor:black;\n}\n\n.x-date-inner .x-date-selected a{\n\tbackground: repeat-x left top;\n\tborder:1px solid;\n    padding:1px 4px;\n}\n\n.x-date-inner .x-date-today a{\n\tborder: 1px solid;\n    padding:1px 4px;\n}\n\n.x-date-inner .x-date-prevday a,.x-date-inner .x-date-nextday a {\n    text-decoration:none !important;\n}\n\n.x-date-bottom {\n    padding:4px;\n    border-top: 1px solid;\n    background: repeat-x left top;\n}\n\n.x-date-inner a:hover, .x-date-inner .x-date-disabled a:hover{\n    text-decoration:none !important;\n}\n\n.x-item-disabled .x-date-inner a:hover{\n    background: none;\n}\n\n.x-date-inner .x-date-disabled a {\n\tcursor:default;\n}\n\n.x-date-menu .x-menu-item {\n\tpadding:1px 24px 1px 4px;\n\twhite-space: nowrap;\n}\n\n.x-date-menu .x-menu-item .x-menu-item-icon {\n    width:10px;\n    height:10px;\n    margin-right:5px;\n    background-position:center -4px !important;\n}\n\n.x-date-mp {\n\tposition:absolute;\n\tleft:0;\n\ttop:0;\n\tdisplay:none;\n}\n\n.x-date-mp td {\n    padding:2px;\n\tfont:normal 11px arial, helvetica,tahoma,sans-serif;\n}\n\ntd.x-date-mp-month,td.x-date-mp-year,td.x-date-mp-ybtn {\n    border: 0 none;\n\ttext-align:center;\n\tvertical-align: middle;\n\twidth:25%;\n}\n\n.x-date-mp-ok {\n\tmargin-right:3px;\n}\n\n.x-date-mp-btns button {\n\ttext-decoration:none;\n\ttext-align:center;\n\ttext-decoration:none !important;\n\tborder:1px solid;\n\tpadding:1px 3px 1px;\n\tcursor:pointer;\n}\n\n.x-date-mp-btns {\n\tbackground: repeat-x left top;\n}\n\n.x-date-mp-btns td {\n\tborder-top: 1px solid;\n    text-align:center;\n}\n\ntd.x-date-mp-month a,td.x-date-mp-year a {\n\tdisplay:block;\n\tpadding:2px 4px;\n\ttext-decoration:none;\n\ttext-align:center;\n}\n\ntd.x-date-mp-month a:hover,td.x-date-mp-year a:hover {\n\ttext-decoration:none;\n\tcursor:pointer;\n}\n\ntd.x-date-mp-sel a {\n\tpadding:1px 3px;\n\tbackground: repeat-x left top;\n\tborder:1px solid;\n}\n\n.x-date-mp-ybtn a {\n    overflow:hidden;\n    width:15px;\n    height:15px;\n    cursor:pointer;\n    background:transparent no-repeat;\n    display:block;\n    margin:0 auto;\n}\n\n.x-date-mp-ybtn a.x-date-mp-next {\n    background-position:0 -120px;\n}\n\n.x-date-mp-ybtn a.x-date-mp-next:hover {\n    background-position:-15px -120px;\n}\n\n.x-date-mp-ybtn a.x-date-mp-prev {\n    background-position:0 -105px;\n}\n\n.x-date-mp-ybtn a.x-date-mp-prev:hover {\n    background-position:-15px -105px;\n}\n\n.x-date-mp-ybtn {\n   text-align:center;\n}\n\ntd.x-date-mp-sep {\n   border-right:1px solid;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/dd.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-dd-drag-proxy{\n\tposition:absolute;\n\tleft:0;\n    top:0;\n\tvisibility:hidden;\n\tz-index:15000;\n}\n\n.x-dd-drag-ghost{\n\t-moz-opacity: 0.85;\n    opacity:.85;\n    filter: alpha(opacity=85);\n    border: 1px solid;\n\tpadding:3px;\n\tpadding-left:20px;\n\twhite-space:nowrap;\n}\n\n.x-dd-drag-repair .x-dd-drag-ghost{\n\t-moz-opacity: 0.4;\n    opacity:.4;\n    filter: alpha(opacity=40);\n\tborder:0 none;\n\tpadding:0;\n\tbackground-color:transparent;\n}\n\n.x-dd-drag-repair .x-dd-drop-icon{\n\tvisibility:hidden;\n}\n\n.x-dd-drop-icon{\n    position:absolute;\n\ttop:3px;\n\tleft:3px;\n\tdisplay:block;\n\twidth:16px;\n\theight:16px;\n\tbackground-color:transparent;\n\tbackground-position: center;\n\tbackground-repeat: no-repeat;\n\tz-index:1;\n}\n\n.x-view-selector {\n    position:absolute;\n    left:0;\n    top:0;\n    width:0;\n    border:1px dotted;\n\topacity: .5;\n    -moz-opacity: .5;\n    filter:alpha(opacity=50);\n    zoom:1;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/debug.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n#x-debug-browser .x-tree .x-tree-node a span {\n    padding-top:2px;\n    line-height:18px;\n}\n\n#x-debug-browser  .x-tool-toggle {\n    background-position:0 -75px;\n}\n\n#x-debug-browser  .x-tool-toggle-over {\n    background-position:-15px -75px;\n}\n\n#x-debug-browser.x-panel-collapsed .x-tool-toggle {\n    background-position:0 -60px;\n}\n\n#x-debug-browser.x-panel-collapsed .x-tool-toggle-over {\n    background-position:-15px -60px;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/dialog.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-window-dlg .x-window-body {\n    border:0 none !important;\n    padding:5px 10px;\n    overflow:hidden !important;\n}\n\n.x-window-dlg .x-window-mc {\n    border:0 none !important;\n}\n\n.x-window-dlg .ext-mb-input {\n    margin-top:4px;\n    width:95%;\n}\n\n.x-window-dlg .ext-mb-textarea {\n    margin-top:4px;\n}\n\n.x-window-dlg .x-progress-wrap {\n    margin-top:4px;\n}\n\n.ext-ie .x-window-dlg .x-progress-wrap {\n    margin-top:6px;\n}\n\n.x-window-dlg .x-msg-box-wait {\n    background:transparent no-repeat left;\n    display:block;\n    width:300px;\n    padding-left:18px;\n    line-height:18px;\n}\n\n.x-window-dlg .ext-mb-icon {\n    float:left;\n    width:47px;\n    height:32px;\n}\n\n.x-window-dlg .x-dlg-icon .ext-mb-content{\n    zoom: 1; \n    margin-left: 47px;\n}\n\n.x-window-dlg .ext-mb-info, .x-window-dlg .ext-mb-warning, .x-window-dlg .ext-mb-question, .x-window-dlg .ext-mb-error {\n    background:transparent no-repeat top left;\n}\n\n.ext-gecko2 .ext-mb-fix-cursor {\n    overflow:auto;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/editor.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-html-editor-wrap {\n    border:1px solid;\n}\n\n.x-html-editor-tb .x-btn-text {\n    background:transparent no-repeat;\n}\n\n.x-html-editor-tb .x-edit-bold, .x-menu-item img.x-edit-bold {\n    background-position:0 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);    \n}\n\n.x-html-editor-tb .x-edit-italic, .x-menu-item img.x-edit-italic {\n    background-position:-16px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-underline, .x-menu-item img.x-edit-underline {\n    background-position:-32px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-forecolor, .x-menu-item img.x-edit-forecolor {\n    background-position:-160px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-backcolor, .x-menu-item img.x-edit-backcolor {\n    background-position:-176px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-justifyleft, .x-menu-item img.x-edit-justifyleft {\n    background-position:-112px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-justifycenter, .x-menu-item img.x-edit-justifycenter {\n    background-position:-128px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-justifyright, .x-menu-item img.x-edit-justifyright {\n    background-position:-144px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-insertorderedlist, .x-menu-item img.x-edit-insertorderedlist {\n    background-position:-80px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-insertunorderedlist, .x-menu-item img.x-edit-insertunorderedlist {\n    background-position:-96px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-increasefontsize, .x-menu-item img.x-edit-increasefontsize {\n    background-position:-48px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-decreasefontsize, .x-menu-item img.x-edit-decreasefontsize {\n    background-position:-64px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-sourceedit, .x-menu-item img.x-edit-sourceedit {\n    background-position:-192px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tb .x-edit-createlink, .x-menu-item img.x-edit-createlink {\n    background-position:-208px 0;\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n\n.x-html-editor-tip .x-tip-bd .x-tip-bd-inner {\n    padding:5px;\n    padding-bottom:1px;\n}\n\n.x-html-editor-tb .x-toolbar {\n    position:static !important;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/form.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/* all fields */\n.x-form-field{\n    margin: 0 0 0 0;\n}\n\n.ext-webkit *:focus{\n    outline: none !important;\n}\n\n/* ---- text fields ---- */\n.x-form-text, textarea.x-form-field{\n    padding:1px 3px;\n    background:repeat-x 0 0;\n    border:1px solid;\n}\n\ntextarea.x-form-field {\n    padding:2px 3px;\n}\n\n.x-form-text, .ext-ie .x-form-file {\n    height:22px;\n    line-height:18px;\n    vertical-align:middle;\n}\n\n.ext-ie6 .x-form-text, .ext-ie7 .x-form-text {\n    margin:-1px 0; /* ie bogus margin bug */\n    height:22px; /* ie quirks */\n    line-height:18px;\n}\n\n.x-quirks .ext-ie9 .x-form-text {\n    height: 22px;\n    padding-top: 3px;\n    padding-bottom: 0px;\n}\n\n/* Ugly hacks for the bogus 1px margin bug in IE9 quirks */\n.x-quirks .ext-ie9 .x-input-wrapper .x-form-text,\n.x-quirks .ext-ie9 .x-form-field-trigger-wrap .x-form-text {\n    margin-top: -1px;\n    margin-bottom: -1px;\n}\n.x-quirks .ext-ie9 .x-input-wrapper .x-form-element {\n    margin-bottom: -1px;\n}\n\n.ext-ie6 .x-form-field-wrap .x-form-file-btn, .ext-ie7 .x-form-field-wrap .x-form-file-btn {\n    top: -1px; /* because of all these margin hacks, these buttons are off by one pixel in IE6,7 */\n}\n\n.ext-ie6 textarea.x-form-field, .ext-ie7 textarea.x-form-field {\n    margin:-1px 0; /* ie bogus margin bug */\n}\n\n.ext-strict .x-form-text {\n    height:18px;\n}\n\n.ext-safari.ext-mac textarea.x-form-field {\n    margin-bottom:-2px; /* another bogus margin bug, safari/mac only */\n}\n\n/*\n.ext-strict .ext-ie8 .x-form-text, .ext-strict .ext-ie8 textarea.x-form-field {\n    margin-bottom: 1px;\n}\n*/\n\n.ext-gecko .x-form-text , .ext-ie8 .x-form-text {\n    padding-top:2px; /* FF won't center the text vertically */\n    padding-bottom:0;\n}\n\n.ext-ie6 .x-form-composite .x-form-text.x-box-item, .ext-ie7 .x-form-composite .x-form-text.x-box-item {\n    margin: 0 !important; /* clear ie bogus margin bug fix */\n}\n\ntextarea {\n    resize: none;  /* Disable browser resizable textarea */\n}\n\n/* select boxes */\n.x-form-select-one {\n    height:20px;\n    line-height:18px;\n    vertical-align:middle;\n    border: 1px solid;\n}\n\n/* multi select boxes */\n\n/* --- TODO --- */\n\n/* 2.0.2 style */\n.x-form-check-wrap {\n    line-height:18px;\n    height: auto;\n}\n\n.ext-ie .x-form-check-wrap input {\n    width:15px;\n    height:15px;\n}\n\n.x-form-check-wrap input{\n    vertical-align: bottom;\n}\n\n.x-editor .x-form-check-wrap {\n    padding:3px;\n}\n\n.x-editor .x-form-checkbox {\n    height:13px;\n}\n\n.x-form-check-group-label {\n    border-bottom: 1px solid;\n    margin-bottom: 5px;\n    padding-left: 3px !important;\n    float: none !important;\n}\n\n/* wrapped fields and triggers */\n.x-form-field-wrap .x-form-trigger{\n    width:17px;\n    height:21px;\n    border:0;\n    background:transparent no-repeat 0 0;\n    cursor:pointer;\n    border-bottom: 1px solid;\n    position:absolute;\n    top:0;\n}\n\n.x-form-field-wrap .x-form-date-trigger, .x-form-field-wrap .x-form-clear-trigger, .x-form-field-wrap .x-form-search-trigger{\n    cursor:pointer;\n}\n\n.x-form-field-wrap .x-form-twin-triggers .x-form-trigger{\n    position:static;\n    top:auto;\n    vertical-align:top;\n}\n\n.x-form-field-wrap {\n    position:relative;\n    left:0;top:0;\n    text-align: left;\n    zoom:1;\n    white-space: nowrap;\n}\n\n.ext-strict .ext-ie8 .x-toolbar-cell .x-form-field-trigger-wrap .x-form-trigger {\n    right: 0; /* IE8 Strict mode trigger bug */\n}\n\n.x-form-field-wrap .x-form-trigger-over{\n    background-position:-17px 0;\n}\n\n.x-form-field-wrap .x-form-trigger-click{\n    background-position:-34px 0;\n}\n\n.x-trigger-wrap-focus .x-form-trigger{\n    background-position:-51px 0;\n}\n\n.x-trigger-wrap-focus .x-form-trigger-over{\n    background-position:-68px 0;\n}\n\n.x-trigger-wrap-focus .x-form-trigger-click{\n    background-position:-85px 0;\n}\n\n.x-trigger-wrap-focus .x-form-trigger{\n    border-bottom: 1px solid;\n}\n\n.x-item-disabled .x-form-trigger-over{\n    background-position:0 0 !important;\n    border-bottom: 1px solid;\n}\n\n.x-item-disabled .x-form-trigger-click{\n    background-position:0 0 !important;\n    border-bottom: 1px solid;\n}\n\n.x-trigger-noedit{\n    cursor:pointer;\n}\n\n/* field focus style */\n.x-form-focus, textarea.x-form-focus{\n    border: 1px solid;\n}\n\n/* invalid fields */\n.x-form-invalid, textarea.x-form-invalid{\n    background:repeat-x bottom;\n    border: 1px solid;\n}\n\n.x-form-inner-invalid, textarea.x-form-inner-invalid{\n    background:repeat-x bottom;\n}\n\n/* editors */\n.x-editor {\n    visibility:hidden;\n    padding:0;\n    margin:0;\n}\n\n.x-form-grow-sizer {\n    left: -10000px;\n    padding: 8px 3px;\n    position: absolute;\n    visibility:hidden;\n    top: -10000px;\n    white-space: pre-wrap;\n    white-space: -moz-pre-wrap;\n    white-space: -pre-wrap;\n    white-space: -o-pre-wrap;\n    word-wrap: break-word;\n    zoom:1;\n}\n\n.x-form-grow-sizer p {\n    margin:0 !important;\n    border:0 none !important;\n    padding:0 !important;\n}\n\n/* Form Items CSS */\n\n.x-form-item {\n    display:block;\n    margin-bottom:4px;\n    zoom:1;\n}\n\n.x-form-item label.x-form-item-label {\n    display:block;\n    float:left;\n    width:100px;\n    padding:3px;\n    padding-left:0;\n    clear:left;\n    z-index:2;\n    position:relative;\n}\n\n.x-form-element {\n    padding-left:105px;\n    position:relative;\n}\n\n.x-form-invalid-msg {\n    padding:2px;\n    padding-left:18px;\n    background: transparent no-repeat 0 2px;\n    line-height:16px;\n    width:200px;\n}\n\n.x-form-label-left label.x-form-item-label {\n   text-align:left;\n}\n\n.x-form-label-right label.x-form-item-label {\n   text-align:right;\n}\n\n.x-form-label-top .x-form-item label.x-form-item-label {\n    width:auto;\n    float:none;\n    clear:none;\n    display:inline;\n    margin-bottom:4px;\n    position:static;\n}\n\n.x-form-label-top .x-form-element {\n    padding-left:0;\n    padding-top:4px;\n}\n\n.x-form-label-top .x-form-item {\n    padding-bottom:4px;\n}\n\n/* Editor small font for grid, toolbar and tree */\n.x-small-editor .x-form-text {\n    height:20px;\n    line-height:16px;\n    vertical-align:middle;\n}\n\n.ext-ie6 .x-small-editor .x-form-text, .ext-ie7 .x-small-editor .x-form-text {\n    margin-top:-1px !important; /* ie bogus margin bug */\n    margin-bottom:-1px !important;\n    height:20px !important; /* ie quirks */\n    line-height:16px !important;\n}\n\n.ext-strict .x-small-editor .x-form-text {\n    height:16px !important;\n}\n\n.ext-ie6 .x-small-editor .x-form-text, .ext-ie7 .x-small-editor .x-form-text {\n    height:20px;\n    line-height:16px;\n}\n\n.ext-border-box .x-small-editor .x-form-text {\n    height:20px;\n}\n\n.x-small-editor .x-form-select-one {\n    height:20px;\n    line-height:16px;\n    vertical-align:middle;\n}\n\n.x-small-editor .x-form-num-field {\n    text-align:right;\n}\n\n.x-small-editor .x-form-field-wrap .x-form-trigger{\n    height:19px;\n}\n\n.ext-webkit .x-small-editor .x-form-text{padding-top:3px;font-size:100%;}\n\n.ext-strict .ext-webkit .x-small-editor .x-form-text{\n    height:14px !important;\n}\n\n.x-form-clear {\n    clear:both;\n    height:0;\n    overflow:hidden;\n    line-height:0;\n    font-size:0;\n}\n.x-form-clear-left {\n    clear:left;\n    height:0;\n    overflow:hidden;\n    line-height:0;\n    font-size:0;\n}\n\n.ext-ie6 .x-form-check-wrap input, .ext-border-box .x-form-check-wrap input{\n   margin-top: 3px;\n}\n\n.x-form-cb-label {\n    position: relative;\n    margin-left:4px;\n    top: 2px;\n}\n\n.ext-ie .x-form-cb-label{\n    top: 1px;\n}\n\n.ext-ie6 .x-form-cb-label, .ext-border-box .x-form-cb-label{\n    top: 3px;\n}\n\n.x-form-display-field{\n    padding-top: 2px;\n}\n\n.ext-gecko .x-form-display-field, .ext-strict .ext-ie7 .x-form-display-field{\n    padding-top: 1px;\n}\n\n.ext-ie .x-form-display-field{\n    padding-top: 3px;\n}\n\n.ext-strict .ext-ie8 .x-form-display-field{\n    padding-top: 0;\n}\n\n.x-form-column {\n    float:left;\n    padding:0;\n    margin:0;\n    width:48%;\n    overflow:hidden;\n    zoom:1;\n}\n\n/* buttons */\n.x-form .x-form-btns-ct .x-btn{\n    float:right;\n    clear:none;\n}\n\n.x-form .x-form-btns-ct .x-form-btns td {\n    border:0;\n    padding:0;\n}\n\n.x-form .x-form-btns-ct .x-form-btns-right table{\n    float:right;\n    clear:none;\n}\n\n.x-form .x-form-btns-ct .x-form-btns-left table{\n    float:left;\n    clear:none;\n}\n\n.x-form .x-form-btns-ct .x-form-btns-center{\n    text-align:center; /*ie*/\n}\n\n.x-form .x-form-btns-ct .x-form-btns-center table{\n    margin:0 auto; /*everyone else*/\n}\n\n.x-form .x-form-btns-ct table td.x-form-btn-td{\n    padding:3px;\n}\n\n.x-form .x-form-btns-ct .x-btn-focus .x-btn-left{\n    background-position:0 -147px;\n}\n\n.x-form .x-form-btns-ct .x-btn-focus .x-btn-right{\n    background-position:0 -168px;\n}\n\n.x-form .x-form-btns-ct .x-btn-focus .x-btn-center{\n    background-position:0 -189px;\n}\n\n.x-form .x-form-btns-ct .x-btn-click .x-btn-center{\n    background-position:0 -126px;\n}\n\n.x-form .x-form-btns-ct .x-btn-click  .x-btn-right{\n    background-position:0 -84px;\n}\n\n.x-form .x-form-btns-ct .x-btn-click .x-btn-left{\n    background-position:0 -63px;\n}\n\n.x-form-invalid-icon {\n    width:16px;\n    height:18px;\n    visibility:hidden;\n    position:absolute;\n    left:0;\n    top:0;\n    display:block;\n    background:transparent no-repeat 0 2px;\n}\n\n/* fieldsets */\n.x-fieldset {\n    border:1px solid;\n    padding:10px;\n    margin-bottom:10px;\n    display:block; /* preserve margins in IE */\n}\n\n/* make top of checkbox/tools visible in webkit */\n.ext-webkit .x-fieldset-header {\n    padding-top: 1px;\n}\n\n.ext-ie .x-fieldset legend {\n    margin-bottom:10px;\n}\n\n.ext-strict .ext-ie9 .x-fieldset legend.x-fieldset-header {\n    padding-top: 1px;\n}\n\n.ext-ie .x-fieldset {\n    padding-top: 0;\n    padding-bottom:10px;\n}\n\n.x-fieldset legend .x-tool-toggle {\n    margin-right:3px;\n    margin-left:0;\n    float:left !important;\n}\n\n.x-fieldset legend input {\n    margin-right:3px;\n    float:left !important;\n    height:13px;\n    width:13px;\n}\n\nfieldset.x-panel-collapsed {\n    padding-bottom:0 !important;\n    border-width: 1px 1px 0 1px !important;\n    border-left-color: transparent;\n    border-right-color: transparent;\n}\n\n.ext-ie6 fieldset.x-panel-collapsed{\n    padding-bottom:0 !important;\n    border-width: 1px 0 0 0 !important;\n    margin-left: 1px;\n    margin-right: 1px;\n}\n\nfieldset.x-panel-collapsed .x-fieldset-bwrap {\n    visibility:hidden;\n    position:absolute;\n    left:-1000px;\n    top:-1000px;\n}\n\n.ext-ie .x-fieldset-bwrap {\n    zoom:1;\n}\n\n.x-fieldset-noborder {\n    border:0px none transparent;\n}\n\n.x-fieldset-noborder legend {\n    margin-left:-3px;\n}\n\n/* IE legend positioning bug */\n.ext-ie .x-fieldset-noborder legend {\n    position: relative;\n    margin-bottom:23px;\n}\n.ext-ie .x-fieldset-noborder legend span {\n    position: absolute;\n    left:16px;\n}\n\n.ext-gecko .x-window-body .x-form-item {\n    -moz-outline: none;\n    outline: none;\n    overflow: auto;\n}\n\n.ext-mac.ext-gecko .x-window-body .x-form-item {\n    overflow:hidden;\n}\n\n.ext-gecko .x-form-item {\n    -moz-outline: none;\n    outline: none;\n}\n\n.x-hide-label label.x-form-item-label {\n     display:none;\n}\n\n.x-hide-label .x-form-element {\n     padding-left: 0 !important;\n}\n\n.x-form-label-top .x-hide-label label.x-form-item-label{\n    display: none;\n}\n\n.x-fieldset {\n    overflow:hidden;\n}\n\n.x-fieldset-bwrap {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-fieldset-body {\n    overflow:hidden;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/structure/grid.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/* Grid3 styles */\n.x-grid3 {\n\tposition:relative;\n\toverflow:hidden;\n}\n\n.x-grid-panel .x-panel-body {\n    overflow:hidden !important;\n}\n\n.x-grid-panel .x-panel-mc .x-panel-body {\n    border:1px solid;\n}\n\n.x-grid3 table {\n    table-layout:fixed;\n}\n\n.x-grid3-viewport{\n\toverflow:hidden;\n}\n\n.x-grid3-hd-row td, .x-grid3-row td, .x-grid3-summary-row td{\n    -moz-outline: none;\n    outline: none;\n\t-moz-user-focus: normal;\n}\n\n.x-grid3-row td, .x-grid3-summary-row td {\n    line-height:13px;\n    vertical-align: top;\n\tpadding-left:1px;\n    padding-right:1px;\n    -moz-user-select: none;\n    -khtml-user-select:none;\n    -webkit-user-select:ignore;\n}\n\n.x-grid3-cell{\n    -moz-user-select: none;\n    -khtml-user-select:none;\n    -webkit-user-select:ignore;\n}\n\n.x-grid3-hd-row td {\n    line-height:15px;\n    vertical-align:middle;\n    border-left:1px solid;\n    border-right:1px solid;\n}\n\n.x-grid3-hd-row .x-grid3-marker-hd {\n    padding:3px;\n}\n\n.x-grid3-row .x-grid3-marker {\n    padding:3px;\n}\n\n.x-grid3-cell-inner, .x-grid3-hd-inner{\n\toverflow:hidden;\n\t-o-text-overflow: ellipsis;\n\ttext-overflow: ellipsis;\n    padding:3px 3px 3px 5px;\n    white-space: nowrap;\n}\n\n/* ActionColumn, reduce padding to accommodate 16x16 icons in normal row height */\n.x-action-col-cell .x-grid3-cell-inner {\n    padding-top: 1px;\n    padding-bottom: 1px;\n}\n\n.x-action-col-icon {\n    cursor: pointer;\n}\n\n.x-grid3-hd-inner {\n    position:relative;\n\tcursor:inherit;\n\tpadding:4px 3px 4px 5px;\n}\n\n.x-grid3-row-body {\n    white-space:normal;\n}\n\n.x-grid3-body-cell {\n    -moz-outline:0 none;\n    outline:0 none;\n}\n\n/* IE Quirks to clip */\n.ext-ie .x-grid3-cell-inner, .ext-ie .x-grid3-hd-inner{\n\twidth:100%;\n}\n\n/* reverse above in strict mode */\n.ext-strict .x-grid3-cell-inner, .ext-strict .x-grid3-hd-inner{\n\twidth:auto;\n}\n\n.x-grid-row-loading {\n    background: no-repeat center center;\n}\n\n.x-grid-page {\n    overflow:hidden;\n}\n\n.x-grid3-row {\n\tcursor: default;\n    border: 1px solid;\n    width:100%;\n}\n\n.x-grid3-row-over {\n\tborder:1px solid;\n    background: repeat-x left top;\n}\n\n.x-grid3-resize-proxy {\n\twidth:1px;\n    left:0;\n\tcursor: e-resize;\n\tcursor: col-resize;\n\tposition:absolute;\n\ttop:0;\n\theight:100px;\n\toverflow:hidden;\n\tvisibility:hidden;\n\tborder:0 none;\n\tz-index:7;\n}\n\n.x-grid3-resize-marker {\n\twidth:1px;\n\tleft:0;\n\tposition:absolute;\n\ttop:0;\n\theight:100px;\n\toverflow:hidden;\n\tvisibility:hidden;\n\tborder:0 none;\n\tz-index:7;\n}\n\n.x-grid3-focus {\n\tposition:absolute;\n\tleft:0;\n\ttop:0;\n\twidth:1px;\n\theight:1px;\n    line-height:1px;\n    font-size:1px;\n    -moz-outline:0 none;\n    outline:0 none;\n    -moz-user-select: text;\n    -khtml-user-select: text;\n    -webkit-user-select:ignore;\n}\n\n/* header styles */\n.x-grid3-header{\n\tbackground: repeat-x 0 bottom;\n\tcursor:default;\n    zoom:1;\n    padding:1px 0 0 0;\n}\n\n.x-grid3-header-pop {\n    border-left:1px solid;\n    float:right;\n    clear:none;\n}\n\n.x-grid3-header-pop-inner {\n    border-left:1px solid;\n    width:14px;\n    height:19px;\n    background: transparent no-repeat center center;\n}\n\n.ext-ie .x-grid3-header-pop-inner {\n    width:15px;\n}\n\n.ext-strict .x-grid3-header-pop-inner {\n    width:14px; \n}\n\n.x-grid3-header-inner {\n    overflow:hidden;\n    zoom:1;\n    float:left;\n}\n\n.x-grid3-header-offset {\n    padding-left:1px;\n    text-align: left;\n}\n\ntd.x-grid3-hd-over, td.sort-desc, td.sort-asc, td.x-grid3-hd-menu-open {\n    border-left:1px solid;\n    border-right:1px solid;\n}\n\ntd.x-grid3-hd-over .x-grid3-hd-inner, td.sort-desc .x-grid3-hd-inner, td.sort-asc .x-grid3-hd-inner, td.x-grid3-hd-menu-open .x-grid3-hd-inner {\n    background: repeat-x left bottom;\n\n}\n\n.x-grid3-sort-icon{\n\tbackground-repeat: no-repeat;\n\tdisplay: none;\n\theight: 4px;\n\twidth: 13px;\n\tmargin-left:3px;\n\tvertical-align: middle;\n}\n\n.sort-asc .x-grid3-sort-icon, .sort-desc .x-grid3-sort-icon {\n\tdisplay: inline;\n}\n\n/* Header position fixes for IE strict mode */\n.ext-strict .ext-ie .x-grid3-header-inner, .ext-strict .ext-ie6 .x-grid3-hd {\n    position:relative;\n}\n\n.ext-strict .ext-ie6 .x-grid3-hd-inner{\n    position:static;\n}\n\n/* Body Styles */\n.x-grid3-body {\n\tzoom:1;\n}\n\n.x-grid3-scroller {\n\toverflow:auto;\n    zoom:1;\n    position:relative;\n}\n\n.x-grid3-cell-text, .x-grid3-hd-text {\n\tdisplay: block;\n\tpadding: 3px 5px 3px 5px;\n\t-moz-user-select: none;\n\t-khtml-user-select: none;\n    -webkit-user-select:ignore;\n}\n\n.x-grid3-split {\n\tbackground-position: center;\n\tbackground-repeat: no-repeat;\n\tcursor: e-resize;\n\tcursor: col-resize;\n\tdisplay: block;\n\tfont-size: 1px;\n\theight: 16px;\n\toverflow: hidden;\n\tposition: absolute;\n\ttop: 2px;\n\twidth: 6px;\n\tz-index: 3;\n}\n\n/* Column Reorder DD */\n.x-dd-drag-proxy .x-grid3-hd-inner{\n\tbackground: repeat-x left bottom;\n\twidth:120px;\n\tpadding:3px;\n\tborder:1px solid;\n\toverflow:hidden;\n}\n\n.col-move-top, .col-move-bottom{\n\twidth:9px;\n\theight:9px;\n\tposition:absolute;\n\ttop:0;\n\tline-height:1px;\n\tfont-size:1px;\n\toverflow:hidden;\n\tvisibility:hidden;\n\tz-index:20000;\n    background:transparent no-repeat left top;\n}\n\n/* Selection Styles */\n.x-grid3-row-selected {\n\tborder:1px dotted;\n}\n\n.x-grid3-locked td.x-grid3-row-marker, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker{\n    background: repeat-x 0 bottom !important;\n    vertical-align:middle !important;\n    padding:0;\n    border-top:1px solid;\n    border-bottom:none !important;\n    border-right:1px solid !important;\n    text-align:center;\n}\n\n.x-grid3-locked td.x-grid3-row-marker div, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker div{\n    padding:0 4px;\n    text-align:center;\n}\n\n/* dirty cells */\n.x-grid3-dirty-cell {\n    background: transparent no-repeat 0 0;\n}\n\n/* Grid Toolbars */\n.x-grid3-topbar, .x-grid3-bottombar{\n    overflow:hidden;\n\tdisplay:none;\n\tzoom:1;\n    position:relative;\n}\n\n.x-grid3-topbar .x-toolbar{\n\tborder-right:0 none;\n}\n\n.x-grid3-bottombar .x-toolbar{\n\tborder-right:0 none;\n\tborder-bottom:0 none;\n\tborder-top:1px solid;\n}\n\n/* Props Grid Styles */\n.x-props-grid .x-grid3-cell{\n\tpadding:1px;\n}\n\n.x-props-grid .x-grid3-td-name .x-grid3-cell-inner{\n\tbackground:transparent repeat-y -16px !important;\n    padding-left:12px;\n}\n\n.x-props-grid .x-grid3-body .x-grid3-td-name{\n    padding:1px;\n    padding-right:0;\n    border:0 none;\n    border-right:1px solid;\n}\n\n/* dd */\n.x-grid3-col-dd {\n    border:0 none;\n    padding:0;\n    background-color:transparent;\n}\n\n.x-dd-drag-ghost .x-grid3-dd-wrap {\n    padding:1px 3px 3px 1px;\n}\n\n.x-grid3-hd {\n    -moz-user-select:none;\n    -khtml-user-select:none;\n    -webkit-user-select:ignore;\n}\n\n.x-grid3-hd-btn {\n    display:none;\n    position:absolute;\n    width:14px;\n    background:no-repeat left center;\n    right:0;\n    top:0;\n    z-index:2;\n\tcursor:pointer;\n}\n\n.x-grid3-hd-over .x-grid3-hd-btn, .x-grid3-hd-menu-open .x-grid3-hd-btn {\n    display:block;\n}\n\na.x-grid3-hd-btn:hover {\n    background-position:-14px center;\n}\n\n/* Expanders */\n.x-grid3-body .x-grid3-td-expander {\n    background:transparent repeat-y right;\n}\n\n.x-grid3-body .x-grid3-td-expander .x-grid3-cell-inner {\n    padding:0 !important;\n    height:100%;\n}\n\n.x-grid3-row-expander {\n    width:100%;\n    height:18px;\n    background-position:4px 2px;\n    background-repeat:no-repeat;\n    background-color:transparent;\n}\n\n.x-grid3-row-collapsed .x-grid3-row-expander {\n    background-position:4px 2px;\n}\n\n.x-grid3-row-expanded .x-grid3-row-expander {\n    background-position:-21px 2px;\n}\n\n.x-grid3-row-collapsed .x-grid3-row-body {\n    display:none !important;\n}\n\n.x-grid3-row-expanded .x-grid3-row-body {\n    display:block !important;\n}\n\n/* Checkers */\n.x-grid3-body .x-grid3-td-checker {\n    background:transparent repeat-y right;\n}\n\n.x-grid3-body .x-grid3-td-checker .x-grid3-cell-inner, .x-grid3-header .x-grid3-td-checker .x-grid3-hd-inner {\n    padding:0 !important;\n    height:100%;\n}\n\n.x-grid3-row-checker, .x-grid3-hd-checker {\n    width:100%;\n    height:18px;\n    background-position:2px 2px;\n    background-repeat:no-repeat;\n    background-color:transparent;\n}\n\n.x-grid3-row .x-grid3-row-checker {\n    background-position:2px 2px;\n}\n\n.x-grid3-row-selected .x-grid3-row-checker, .x-grid3-hd-checker-on .x-grid3-hd-checker,.x-grid3-row-checked .x-grid3-row-checker {\n    background-position:-23px 2px;\n}\n\n.x-grid3-hd-checker {\n    background-position:2px 1px;\n}\n\n.ext-border-box .x-grid3-hd-checker {\n    background-position:2px 3px;\n}\n\n.x-grid3-hd-checker-on .x-grid3-hd-checker {\n    background-position:-23px 1px;\n}\n\n.ext-border-box .x-grid3-hd-checker-on .x-grid3-hd-checker {\n    background-position:-23px 3px;\n}\n\n/* Numberer */\n.x-grid3-body .x-grid3-td-numberer {\n    background:transparent repeat-y right;\n}\n\n.x-grid3-body .x-grid3-td-numberer .x-grid3-cell-inner {\n    padding:3px 5px 0 0 !important;\n    text-align:right;\n}\n\n/* Row Icon */\n\n.x-grid3-body .x-grid3-td-row-icon {\n    background:transparent repeat-y right;\n    vertical-align:top;\n    text-align:center;\n}\n\n.x-grid3-body .x-grid3-td-row-icon .x-grid3-cell-inner {\n    padding:0 !important;\n    background-position:center center;\n    background-repeat:no-repeat;\n    width:16px;\n    height:16px;\n    margin-left:2px;\n    margin-top:3px;\n}\n\n/* All specials */\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-numberer,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-checker,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-expander {\n\tbackground:transparent repeat-y right;\n}\n\n.x-grid3-body .x-grid3-check-col-td .x-grid3-cell-inner {\n    padding: 1px 0 0 0 !important;\n}\n\n.x-grid3-check-col {\n    width:100%;\n    height:16px;\n    background-position:center center;\n    background-repeat:no-repeat;\n    background-color:transparent;\n}\n\n.x-grid3-check-col-on {\n    width:100%;\n    height:16px;\n    background-position:center center;\n    background-repeat:no-repeat;\n    background-color:transparent;\n}\n\n/* Grouping classes */\n.x-grid-group, .x-grid-group-body, .x-grid-group-hd {\n    zoom:1;\n}\n\n.x-grid-group-hd {\n    border-bottom: 2px solid;\n    cursor:pointer;\n    padding-top:6px;\n}\n\n.x-grid-group-hd div.x-grid-group-title {\n    background:transparent no-repeat 3px 3px;\n    padding:4px 4px 4px 17px;\n}\n\n.x-grid-group-collapsed .x-grid-group-body {\n    display:none;\n}\n\n.ext-ie6 .x-grid3 .x-editor .x-form-text, .ext-ie7 .x-grid3 .x-editor .x-form-text {\n    position:relative;\n    top:-1px;\n}\n\n.x-grid-editor .x-form-check-wrap {\n    text-align: center;\n    margin-top: -4px;\n}\n\n.ext-ie .x-props-grid .x-editor .x-form-text {\n    position:static;\n    top:0;\n}\n\n.x-grid-empty {\n    padding:10px;\n}\n\n/* fix floating toolbar issue */\n.ext-ie7 .x-grid-panel .x-panel-bbar {\n    position:relative;\n}\n\n\n/* Reset position to static when Grid Panel has been framed */\n/* to resolve 'snapping' from top to bottom behavior. */\n/* @forumThread 86656 */\n.ext-ie7 .x-grid-panel .x-panel-mc .x-panel-bbar {\n    position: static;\n}\n\n.ext-ie6 .x-grid3-header {\n    position: relative;\n}\n\n/* Fix WebKit bug in Grids */\n.ext-webkit .x-grid-panel .x-panel-bwrap{\n    -webkit-user-select:none;\n}\n.ext-webkit .x-tbar-page-number{\n    -webkit-user-select:ignore;\n}\n/* end*/\n\n/* column lines */\n.x-grid-with-col-lines .x-grid3-row td.x-grid3-cell {\n    padding-right:0;\n    border-right:1px solid;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/structure/layout.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-border-layout-ct {\n    position: relative;\n}\n\n.x-border-panel {\n    position:absolute;\n    left:0;\n    top:0;\n}\n\n.x-tool-collapse-south {\n    background-position:0 -195px;\n}\n\n.x-tool-collapse-south-over {\n    background-position:-15px -195px;\n}\n\n.x-tool-collapse-north {\n    background-position:0 -210px;\n}\n\n.x-tool-collapse-north-over {\n    background-position:-15px -210px;\n}\n\n.x-tool-collapse-west {\n    background-position:0 -180px;\n}\n\n.x-tool-collapse-west-over {\n    background-position:-15px -180px;\n}\n\n.x-tool-collapse-east {\n    background-position:0 -165px;\n}\n\n.x-tool-collapse-east-over {\n    background-position:-15px -165px;\n}\n\n.x-tool-expand-south {\n    background-position:0 -210px;\n}\n\n.x-tool-expand-south-over {\n    background-position:-15px -210px;\n}\n\n.x-tool-expand-north {\n    background-position:0 -195px;\n}\n.x-tool-expand-north-over {\n    background-position:-15px -195px;\n}\n\n.x-tool-expand-west {\n    background-position:0 -165px;\n}\n\n.x-tool-expand-west-over {\n    background-position:-15px -165px;\n}\n\n.x-tool-expand-east {\n    background-position:0 -180px;\n}\n\n.x-tool-expand-east-over {\n    background-position:-15px -180px;\n}\n\n.x-tool-expand-north, .x-tool-expand-south {\n    float:right;\n    margin:3px;\n}\n\n.x-tool-expand-east, .x-tool-expand-west {\n    float:none;\n    margin:3px 2px;\n}\n\n.x-accordion-hd .x-tool-toggle {\n    background-position:0 -255px;\n}\n\n.x-accordion-hd .x-tool-toggle-over {\n    background-position:-15px -255px;\n}\n\n.x-panel-collapsed .x-accordion-hd .x-tool-toggle {\n    background-position:0 -240px;\n}\n\n.x-panel-collapsed .x-accordion-hd .x-tool-toggle-over {\n    background-position:-15px -240px;\n}\n\n.x-accordion-hd {\n\tpadding-top:4px;\n\tpadding-bottom:3px;\n\tborder-top:0 none;\n    background: transparent repeat-x 0 -9px;\n}\n\n.x-layout-collapsed{\n    position:absolute;\n    left:-10000px;\n    top:-10000px;\n    visibility:hidden;\n    width:20px;\n    height:20px;\n    overflow:hidden;\n\tborder:1px solid;\n\tz-index:20;\n}\n\n.ext-border-box .x-layout-collapsed{\n    width:22px;\n    height:22px;\n}\n\n.x-layout-collapsed-over{\n    cursor:pointer;\n}\n\n.x-layout-collapsed-west .x-layout-collapsed-tools, .x-layout-collapsed-east .x-layout-collapsed-tools{\n\tposition:absolute;\n    top:0;\n    left:0;\n    width:20px;\n    height:20px;\n}\n\n\n.x-layout-split{\n    position:absolute;\n    height:5px;\n    width:5px;\n    line-height:1px;\n    font-size:1px;\n    z-index:3;\n    background-color:transparent;\n}\n\n/* IE6 strict won't drag w/out a color */\n.ext-strict .ext-ie6 .x-layout-split{\n    background-color: #fff !important;\n    filter: alpha(opacity=1);\n}\n\n.x-layout-split-h{\n    background-image:url(../images/default/s.gif);\n    background-position: left;\n}\n\n.x-layout-split-v{\n    background-image:url(../images/default/s.gif);\n    background-position: top;\n}\n\n.x-column-layout-ct {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-column {\n    float:left;\n    padding:0;\n    margin:0;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-column-inner {\n    overflow:hidden;\n    zoom:1;\n}\n\n/* mini mode */\n.x-layout-mini {\n    position:absolute;\n    top:0;\n    left:0;\n    display:block;\n    width:5px;\n    height:35px;\n    cursor:pointer;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n}\n\n.x-layout-mini-over, .x-layout-collapsed-over .x-layout-mini{\n    opacity:1;\n    -moz-opacity:1;\n    filter:none;\n}\n\n.x-layout-split-west .x-layout-mini {\n    top:48%;\n}\n\n.x-layout-split-east .x-layout-mini {\n    top:48%;\n}\n\n.x-layout-split-north .x-layout-mini {\n    left:48%;\n    height:5px;\n    width:35px;\n}\n\n.x-layout-split-south .x-layout-mini {\n    left:48%;\n    height:5px;\n    width:35px;\n}\n\n.x-layout-cmini-west .x-layout-mini {\n    top:48%;\n}\n\n.x-layout-cmini-east .x-layout-mini {\n    top:48%;\n}\n\n.x-layout-cmini-north .x-layout-mini {\n    left:48%;\n    height:5px;\n    width:35px;\n}\n\n.x-layout-cmini-south .x-layout-mini {\n    left:48%;\n    height:5px;\n    width:35px;\n}\n\n.x-layout-cmini-west, .x-layout-cmini-east {\n    border:0 none;\n    width:5px !important;\n    padding:0;\n    background-color:transparent;\n}\n\n.x-layout-cmini-north, .x-layout-cmini-south {\n    border:0 none;\n    height:5px !important;\n    padding:0;\n    background-color:transparent;\n}\n\n.x-viewport, .x-viewport body {\n    margin: 0;\n    padding: 0;\n    border: 0 none;\n    overflow: hidden;\n    height: 100%;\n}\n\n.x-abs-layout-item {\n    position:absolute;\n    left:0;\n    top:0;\n}\n\n.ext-ie input.x-abs-layout-item, .ext-ie textarea.x-abs-layout-item {\n    margin:0;\n}\n\n.x-box-layout-ct {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-box-inner {\n    overflow:hidden;\n    zoom:1;\n    position:relative;\n    left:0;\n    top:0;\n}\n\n.x-box-item {\n    position:absolute;\n    left:0;\n    top:0;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/list-view.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-list-header{\n\tbackground: repeat-x 0 bottom;\n\tcursor:default;\n    zoom:1;\n    height:22px;\n}\n\n.x-list-header-inner div {\n    display:block;\n    float:left;\n    overflow:hidden;\n\t-o-text-overflow: ellipsis;\n\ttext-overflow: ellipsis;\n    white-space: nowrap;\n}\n\n.x-list-header-inner div em {\n    display:block;\n    border-left:1px solid;\n    padding:4px 4px;\n    overflow:hidden;\n    -moz-user-select: none;\n    -khtml-user-select: none;\n    line-height:14px;\n}\n\n.x-list-body {\n    overflow:auto;\n    overflow-x:hidden;\n    overflow-y:auto;\n    zoom:1;\n    float: left;\n    width: 100%;\n}\n\n.x-list-body dl {\n    zoom:1;\n}\n\n.x-list-body dt {\n    display:block;\n    float:left;\n    overflow:hidden;\n\t-o-text-overflow: ellipsis;\n\ttext-overflow: ellipsis;\n    white-space: nowrap;\n    cursor:pointer;\n    zoom:1;\n}\n\n.x-list-body dt em {\n    display:block;\n    padding:3px 4px;\n    overflow:hidden;\n    -moz-user-select: none;\n    -khtml-user-select: none;\n}\n\n.x-list-resizer {\n    border-left:1px solid;\n    border-right:1px solid;\n    position:absolute;\n    left:0;\n    top:0;\n}\n\n.x-list-header-inner em.sort-asc {\n    background: transparent no-repeat center 0;\n    border-style:solid;\n    border-width: 0 1px 1px;\n    padding-bottom:3px;\n}\n\n.x-list-header-inner em.sort-desc {\n    background: transparent no-repeat center -23px;\n    border-style:solid;\n    border-width: 0 1px 1px;\n    padding-bottom:3px;\n}\n\n"
  },
  {
    "path": "client/src/ext/resources/css/structure/menu.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-menu {\n\tz-index: 15000;\n\tzoom: 1;\n\tbackground: repeat-y;\n}\n\n.x-menu-floating{\n    border: 1px solid;\n}\n\n.x-menu a {\n    text-decoration: none !important;\n}\n\n.ext-ie .x-menu {\n    zoom:1;\n    overflow:hidden;\n}\n\n.x-menu-list{\n    padding: 2px;\n\tbackground-color:transparent;\n\tborder:0 none;\n    overflow:hidden;\n    overflow-y: hidden;\n}\n\n.ext-strict .ext-ie .x-menu-list{\n    position: relative;\n}\n\n.x-menu li{\n\tline-height:100%;\n}\n\n.x-menu li.x-menu-sep-li{\n\tfont-size:1px;\n\tline-height:1px;\n}\n\n.x-menu-list-item{\n    white-space: nowrap;\n\tdisplay:block;\n\tpadding:1px;\n}\n\n.x-menu-item{\n    -moz-user-select: none;\n    -khtml-user-select:none;\n    -webkit-user-select:ignore;\n}\n\n.x-menu-item-arrow{\n\tbackground:transparent no-repeat right;\n}\n\n.x-menu-sep {\n\tdisplay:block;\n\tfont-size:1px;\n\tline-height:1px;\n\tmargin: 2px 3px;\n\tborder-bottom:1px solid;\n    overflow:hidden;\n}\n\n.x-menu-focus {\n\tposition:absolute;\n\tleft:-1px;\n\ttop:-1px;\n\twidth:1px;\n\theight:1px;\n    line-height:1px;\n    font-size:1px;\n    -moz-outline:0 none;\n    outline:0 none;\n    -moz-user-select: none;\n    -khtml-user-select:none;\n    -webkit-user-select:ignore;\n    overflow:hidden;\n    display:block;\n}\n\na.x-menu-item {\n    cursor: pointer;\n    display: block;\n    line-height: 16px;\n    outline-color: -moz-use-text-color;\n    outline-style: none;\n    outline-width: 0;\n    padding: 3px 21px 3px 27px;\n    position: relative;\n    text-decoration: none;\n    white-space: nowrap;\n}\n\n.x-menu-item-active {\n    background-repeat: repeat-x;\n    background-position: left bottom;\n    border-style:solid;\n    border-width: 1px 0;\n    margin:0 1px;\n\tpadding: 0;\n}\n\n.x-menu-item-active a.x-menu-item {\n    border-style:solid;\n    border-width:0 1px;\n    margin:0 -1px;\n}\n\n.x-menu-item-icon {\n\tborder: 0 none;\n\theight: 16px;\n\tpadding: 0;\n\tvertical-align: top;\n\twidth: 16px;\n\tposition: absolute;\n    left: 3px;\n    top: 3px;\n    margin: 0;\n    background-position:center;\n}\n\n.ext-ie .x-menu-item-icon {\n    left: -24px;\n}\n.ext-strict .x-menu-item-icon {\n    left: 3px;\n}\n\n.ext-ie6 .x-menu-item-icon {\n    left: -24px;\n}\n\n.ext-ie .x-menu-item-icon {\n    vertical-align: middle;\n}\n\n.x-menu-check-item .x-menu-item-icon{\n\tbackground: transparent no-repeat center;\n}\n\n.x-menu-group-item .x-menu-item-icon{\n\tbackground-color: transparent;\n}\n\n.x-menu-item-checked .x-menu-group-item .x-menu-item-icon{\n    background: transparent no-repeat center;\n}\n\n.x-date-menu .x-menu-list{\n    padding: 0;\n}\n\n.x-menu-date-item{\n\tpadding:0;\n}\n\n.x-menu .x-color-palette, .x-menu .x-date-picker{\n    margin-left: 26px;\n\tmargin-right:4px;\n}\n\n.x-menu .x-date-picker{\n    border:1px solid;\n    margin-top:2px;\n    margin-bottom:2px;\n}\n\n.x-menu-plain .x-color-palette, .x-menu-plain .x-date-picker{\n\t margin: 0;\n\t border: 0 none;\n}\n\n.x-date-menu {\n   padding:0 !important;\n}\n\n/*\n * fixes separator visibility problem in IE 6\n */\n.ext-strict .ext-ie6 .x-menu-sep-li {\n    padding: 3px 4px;\n}\n.ext-strict .ext-ie6 .x-menu-sep {\n    margin: 0;\n    height: 1px;\n}\n\n/*\n * Fixes an issue with \"fat\" separators in webkit\n */\n.ext-webkit .x-menu-sep{\n    height: 1px;\n}\n\n/*\n * Ugly mess to remove the white border under the picker\n */\n.ext-ie .x-date-menu{\n    height: 199px;\n}\n\n.ext-strict .ext-ie .x-date-menu, .ext-border-box .ext-ie8 .x-date-menu{\n    height: 197px;\n}\n\n.ext-strict .ext-ie7 .x-date-menu{\n    height: 195px;\n}\n\n.ext-strict .ext-ie8 .x-date-menu{\n    height: auto;\n}\n\n.x-cycle-menu .x-menu-item-checked {\n    border:1px dotted !important;\n\tpadding:0;\n}\n\n.x-menu .x-menu-scroller {\n    width: 100%;\n\tbackground-repeat:no-repeat;\n\tbackground-position:center;\n\theight:8px;\n    line-height: 8px;\n\tcursor:pointer;\n    margin: 0;\n    padding: 0;\n}\n\n.x-menu .x-menu-scroller-active{\n    height: 6px;\n    line-height: 6px;\n}\n\n.x-menu-list-item-indent{\n    padding-left: 27px;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/panel-reset.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * W3C Suggested Default style sheet for HTML 4\n * http://www.w3.org/TR/CSS21/sample.html\n *\n * Resets for Ext.Panel @cfg normal: true\n */\n.x-panel-reset .x-panel-body html,\n.x-panel-reset .x-panel-body address,\n.x-panel-reset .x-panel-body blockquote,\n.x-panel-reset .x-panel-body body,\n.x-panel-reset .x-panel-body dd,\n.x-panel-reset .x-panel-body div,\n.x-panel-reset .x-panel-body dl,\n.x-panel-reset .x-panel-body dt,\n.x-panel-reset .x-panel-body fieldset,\n.x-panel-reset .x-panel-body form,\n.x-panel-reset .x-panel-body frame, frameset,\n.x-panel-reset .x-panel-body h1,\n.x-panel-reset .x-panel-body h2,\n.x-panel-reset .x-panel-body h3,\n.x-panel-reset .x-panel-body h4,\n.x-panel-reset .x-panel-body h5,\n.x-panel-reset .x-panel-body h6,\n.x-panel-reset .x-panel-body noframes,\n.x-panel-reset .x-panel-body ol,\n.x-panel-reset .x-panel-body p,\n.x-panel-reset .x-panel-body ul,\n.x-panel-reset .x-panel-body center,\n.x-panel-reset .x-panel-body dir,\n.x-panel-reset .x-panel-body hr,\n.x-panel-reset .x-panel-body menu,\n.x-panel-reset .x-panel-body pre \t\t\t  { display: block }\n.x-panel-reset .x-panel-body li              { display: list-item }\n.x-panel-reset .x-panel-body head            { display: none }\n.x-panel-reset .x-panel-body table           { display: table }\n.x-panel-reset .x-panel-body tr              { display: table-row }\n.x-panel-reset .x-panel-body thead           { display: table-header-group }\n.x-panel-reset .x-panel-body tbody           { display: table-row-group }\n.x-panel-reset .x-panel-body tfoot           { display: table-footer-group }\n.x-panel-reset .x-panel-body col             { display: table-column }\n.x-panel-reset .x-panel-body colgroup        { display: table-column-group }\n.x-panel-reset .x-panel-body td,\n.x-panel-reset .x-panel-body th \t          { display: table-cell }\n.x-panel-reset .x-panel-body caption         { display: table-caption }\n.x-panel-reset .x-panel-body th              { font-weight: bolder; text-align: center }\n.x-panel-reset .x-panel-body caption         { text-align: center }\n.x-panel-reset .x-panel-body body            { margin: 8px }\n.x-panel-reset .x-panel-body h1              { font-size: 2em; margin: .67em 0 }\n.x-panel-reset .x-panel-body h2              { font-size: 1.5em; margin: .75em 0 }\n.x-panel-reset .x-panel-body h3              { font-size: 1.17em; margin: .83em 0 }\n.x-panel-reset .x-panel-body h4,\n.x-panel-reset .x-panel-body p,\n.x-panel-reset .x-panel-body blockquote,\n.x-panel-reset .x-panel-body ul,\n.x-panel-reset .x-panel-body fieldset,\n.x-panel-reset .x-panel-body form,\n.x-panel-reset .x-panel-body ol,\n.x-panel-reset .x-panel-body dl,\n.x-panel-reset .x-panel-body dir,\n.x-panel-reset .x-panel-body menu            { margin: 1.12em 0 }\n.x-panel-reset .x-panel-body h5              { font-size: .83em; margin: 1.5em 0 }\n.x-panel-reset .x-panel-body h6              { font-size: .75em; margin: 1.67em 0 }\n.x-panel-reset .x-panel-body h1,\n.x-panel-reset .x-panel-body h2,\n.x-panel-reset .x-panel-body h3,\n.x-panel-reset .x-panel-body h4,\n.x-panel-reset .x-panel-body h5,\n.x-panel-reset .x-panel-body h6,\n.x-panel-reset .x-panel-body b,\n.x-panel-reset .x-panel-body strong          { font-weight: bolder }\n.x-panel-reset .x-panel-body blockquote      { margin-left: 40px; margin-right: 40px }\n.x-panel-reset .x-panel-body i,\n.x-panel-reset .x-panel-body cite,\n.x-panel-reset .x-panel-body em,\n.x-panel-reset .x-panel-body var,\n.x-panel-reset .x-panel-body address    \t  { font-style: italic }\n.x-panel-reset .x-panel-body pre,\n.x-panel-reset .x-panel-body tt,\n.x-panel-reset .x-panel-body code,\n.x-panel-reset .x-panel-body kbd,\n.x-panel-reset .x-panel-body samp       \t  { font-family: monospace }\n.x-panel-reset .x-panel-body pre             { white-space: pre }\n.x-panel-reset .x-panel-body button,\n.x-panel-reset .x-panel-body textarea,\n.x-panel-reset .x-panel-body input,\n.x-panel-reset .x-panel-body select   \t\t  { display: inline-block }\n.x-panel-reset .x-panel-body big             { font-size: 1.17em }\n.x-panel-reset .x-panel-body small,\n.x-panel-reset .x-panel-body sub,\n.x-panel-reset .x-panel-body sup \t\t\t  { font-size: .83em }\n.x-panel-reset .x-panel-body sub             { vertical-align: sub }\n.x-panel-reset .x-panel-body sup             { vertical-align: super }\n.x-panel-reset .x-panel-body table           { border-spacing: 2px; }\n.x-panel-reset .x-panel-body thead,\n.x-panel-reset .x-panel-body tbody,\n.x-panel-reset .x-panel-body tfoot           { vertical-align: middle }\n.x-panel-reset .x-panel-body td,\n.x-panel-reset .x-panel-body th          \t  { vertical-align: inherit }\n.x-panel-reset .x-panel-body s,\n.x-panel-reset .x-panel-body strike,\n.x-panel-reset .x-panel-body del  \t\t\t  { text-decoration: line-through }\n.x-panel-reset .x-panel-body hr              { border: 1px inset }\n.x-panel-reset .x-panel-body ol,\n.x-panel-reset .x-panel-body ul,\n.x-panel-reset .x-panel-body dir,\n.x-panel-reset .x-panel-body menu,\n.x-panel-reset .x-panel-body dd        \t  { margin-left: 40px }\n.x-panel-reset .x-panel-body ul, .x-panel-reset .x-panel-body menu, .x-panel-reset .x-panel-body dir { list-style-type: disc;}\n.x-panel-reset .x-panel-body ol              { list-style-type: decimal }\n.x-panel-reset .x-panel-body ol ul,\n.x-panel-reset .x-panel-body ul ol,\n.x-panel-reset .x-panel-body ul ul,\n.x-panel-reset .x-panel-body ol ol    \t\t  { margin-top: 0; margin-bottom: 0 }\n.x-panel-reset .x-panel-body u,\n.x-panel-reset .x-panel-body ins          \t  { text-decoration: underline }\n.x-panel-reset .x-panel-body br:before       { content: \"\\A\" }\n.x-panel-reset .x-panel-body :before, .x-panel-reset .x-panel-body :after { white-space: pre-line }\n.x-panel-reset .x-panel-body center          { text-align: center }\n.x-panel-reset .x-panel-body :link, .x-panel-reset .x-panel-body :visited { text-decoration: underline }\n.x-panel-reset .x-panel-body :focus          { outline: invert dotted thin }\n\n/* Begin bidirectionality settings (do not change) */\n.x-panel-reset .x-panel-body BDO[DIR=\"ltr\"]  { direction: ltr; unicode-bidi: bidi-override }\n.x-panel-reset .x-panel-body BDO[DIR=\"rtl\"]  { direction: rtl; unicode-bidi: bidi-override }\n"
  },
  {
    "path": "client/src/ext/resources/css/structure/panel.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-panel {\n    border-style: solid;\n    border-width:0;\n}\n\n.x-panel-header {\n    overflow:hidden;\n    zoom:1;\n    padding:5px 3px 4px 5px;\n    border:1px solid;\n    line-height: 15px;\n    background: transparent repeat-x 0 -1px;\n}\n\n.x-panel-body {\n    border:1px solid;\n    border-top:0 none;\n    overflow:hidden;\n    position: relative; /* added for item scroll positioning */\n}\n\n.x-panel-bbar .x-toolbar, .x-panel-tbar .x-toolbar {\n    border:1px solid;\n    border-top:0 none;\n    overflow:hidden;\n    padding:2px;\n}\n\n.x-panel-tbar-noheader .x-toolbar, .x-panel-mc .x-panel-tbar .x-toolbar {\n    border-top:1px solid;\n    border-bottom: 0 none;\n}\n\n.x-panel-body-noheader, .x-panel-mc .x-panel-body {\n    border-top:1px solid;\n}\n\n.x-panel-header {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-panel-tl .x-panel-header {\n    padding:5px 0 4px 0;\n    border:0 none;\n    background:transparent no-repeat;\n}\n\n.x-panel-tl .x-panel-icon, .x-window-tl .x-panel-icon {\n    padding-left:20px !important;\n    background-repeat:no-repeat;\n    background-position:0 4px;\n    zoom:1;\n}\n\n.x-panel-inline-icon {\n    width:16px;\n\theight:16px;\n    background-repeat:no-repeat;\n    background-position:0 0;\n\tvertical-align:middle;\n\tmargin-right:4px;\n\tmargin-top:-1px;\n\tmargin-bottom:-1px;\n}\n\n.x-panel-tc {\n\tbackground: transparent repeat-x 0 0;\n\toverflow:hidden;\n}\n\n/* fix ie7 strict mode bug */\n.ext-strict .ext-ie7 .x-panel-tc {\n    overflow: visible;\n}\n\n.x-panel-tl {\n\tbackground: transparent no-repeat 0 0;\n\tpadding-left:6px;\n    zoom:1;\n    border-bottom:1px solid;\n}\n\n.x-panel-tr {\n\tbackground: transparent no-repeat right 0;\n\tzoom:1;\n    padding-right:6px;\n}\n\n.x-panel-bc {\n\tbackground: transparent repeat-x 0 bottom;\n    zoom:1;\n}\n\n.x-panel-bc .x-panel-footer {\n    zoom:1;\n}\n\n.x-panel-bl {\n\tbackground: transparent no-repeat 0 bottom;\n\tpadding-left:6px;\n    zoom:1;\n}\n\n.x-panel-br {\n\tbackground: transparent no-repeat right bottom;\n\tpadding-right:6px;\n    zoom:1;\n}\n\n.x-panel-mc {\n    border:0 none;\n    padding:0;\n    margin:0;\n    padding-top:6px;\n}\n\n.x-panel-mc .x-panel-body {\n    background-color:transparent;\n    border: 0 none;\n}\n\n.x-panel-ml {\n\tbackground: repeat-y 0 0;\n\tpadding-left:6px;\n    zoom:1;\n}\n\n.x-panel-mr {\n\tbackground: transparent repeat-y right 0;\n\tpadding-right:6px;\n    zoom:1;\n}\n\n.x-panel-bc .x-panel-footer {\n    padding-bottom:6px;\n}\n\n.x-panel-nofooter .x-panel-bc, .x-panel-nofooter .x-window-bc {\n\theight:6px;\n    font-size:0;\n    line-height:0;\n}\n\n.x-panel-bwrap {\n    overflow:hidden;\n    zoom:1;\n    left:0;\n    top:0;\n}\n.x-panel-body {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-panel-collapsed .x-resizable-handle{\n    display:none;\n}\n\n.ext-gecko .x-panel-animated div {\n    overflow:hidden !important;\n}\n\n/* Plain */\n.x-plain-body {\n    overflow:hidden;\n}\n\n.x-plain-bbar .x-toolbar {\n    overflow:hidden;\n    padding:2px;\n}\n\n.x-plain-tbar .x-toolbar {\n    overflow:hidden;\n    padding:2px;\n}\n\n.x-plain-bwrap {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-plain {\n    overflow:hidden;\n}\n\n/* Tools */\n.x-tool {\n    overflow:hidden;\n    width:15px;\n    height:15px;\n    float:right;\n    cursor:pointer;\n    background:transparent no-repeat;\n    margin-left:2px;\n}\n\n/* expand / collapse tools */\n.x-tool-toggle {\n    background-position:0 -60px;\n}\n\n.x-tool-toggle-over {\n    background-position:-15px -60px;\n}\n\n.x-panel-collapsed .x-tool-toggle {\n    background-position:0 -75px;\n}\n\n.x-panel-collapsed .x-tool-toggle-over {\n    background-position:-15px -75px;\n}\n\n\n.x-tool-close {\n    background-position:0 -0;\n}\n\n.x-tool-close-over {\n    background-position:-15px 0;\n}\n\n.x-tool-minimize {\n    background-position:0 -15px;\n}\n\n.x-tool-minimize-over {\n    background-position:-15px -15px;\n}\n\n.x-tool-maximize {\n    background-position:0 -30px;\n}\n\n.x-tool-maximize-over {\n    background-position:-15px -30px;\n}\n\n.x-tool-restore {\n    background-position:0 -45px;\n}\n\n.x-tool-restore-over {\n    background-position:-15px -45px;\n}\n\n.x-tool-gear {\n    background-position:0 -90px;\n}\n\n.x-tool-gear-over {\n    background-position:-15px -90px;\n}\n\n.x-tool-prev {\n    background-position:0 -105px;\n}\n\n.x-tool-prev-over {\n    background-position:-15px -105px;\n}\n\n.x-tool-next {\n    background-position:0 -120px;\n}\n\n.x-tool-next-over {\n    background-position:-15px -120px;\n}\n\n.x-tool-pin {\n    background-position:0 -135px;\n}\n\n.x-tool-pin-over {\n    background-position:-15px -135px;\n}\n\n.x-tool-unpin {\n    background-position:0 -150px;\n}\n\n.x-tool-unpin-over {\n    background-position:-15px -150px;\n}\n\n.x-tool-right {\n    background-position:0 -165px;\n}\n\n.x-tool-right-over {\n    background-position:-15px -165px;\n}\n\n.x-tool-left {\n    background-position:0 -180px;\n}\n\n.x-tool-left-over {\n    background-position:-15px -180px;\n}\n\n.x-tool-down {\n    background-position:0 -195px;\n}\n\n.x-tool-down-over {\n    background-position:-15px -195px;\n}\n\n.x-tool-up {\n    background-position:0 -210px;\n}\n\n.x-tool-up-over {\n    background-position:-15px -210px;\n}\n\n.x-tool-refresh {\n    background-position:0 -225px;\n}\n\n.x-tool-refresh-over {\n    background-position:-15px -225px;\n}\n\n.x-tool-plus {\n    background-position:0 -240px;\n}\n\n.x-tool-plus-over {\n    background-position:-15px -240px;\n}\n\n.x-tool-minus {\n    background-position:0 -255px;\n}\n\n.x-tool-minus-over {\n    background-position:-15px -255px;\n}\n\n.x-tool-search {\n    background-position:0 -270px;\n}\n\n.x-tool-search-over {\n    background-position:-15px -270px;\n}\n\n.x-tool-save {\n    background-position:0 -285px;\n}\n\n.x-tool-save-over {\n    background-position:-15px -285px;\n}\n\n.x-tool-help {\n    background-position:0 -300px;\n}\n\n.x-tool-help-over {\n    background-position:-15px -300px;\n}\n\n.x-tool-print {\n    background-position:0 -315px;\n}\n\n.x-tool-print-over {\n    background-position:-15px -315px;\n}\n\n.x-tool-expand {\n    background-position:0 -330px;\n}\n\n.x-tool-expand-over {\n    background-position:-15px -330px;\n}\n\n.x-tool-collapse {\n    background-position:0 -345px;\n}\n\n.x-tool-collapse-over {\n    background-position:-15px -345px;\n}\n\n.x-tool-resize {\n    background-position:0 -360px;\n}\n\n.x-tool-resize-over {\n    background-position:-15px -360px;\n}\n\n.x-tool-move {\n    background-position:0 -375px;\n}\n\n.x-tool-move-over {\n    background-position:-15px -375px;\n}\n\n/* Ghosting */\n.x-panel-ghost {\n    z-index:12000;\n    overflow:hidden;\n    position:absolute;\n    left:0;top:0;\n    opacity:.65;\n    -moz-opacity:.65;\n    filter:alpha(opacity=65);\n}\n\n.x-panel-ghost ul {\n    margin:0;\n    padding:0;\n    overflow:hidden;\n    font-size:0;\n    line-height:0;\n    border:1px solid;\n    border-top:0 none;\n    display:block;\n}\n\n.x-panel-ghost * {\n    cursor:move !important;\n}\n\n.x-panel-dd-spacer {\n    border:2px dashed;\n}\n\n/* Buttons */\n.x-panel-btns {\n    padding:5px;\n    overflow:hidden;\n}\n\n.x-panel-btns td.x-toolbar-cell{\n\tpadding:3px;\n}\n\n.x-panel-btns .x-btn-focus .x-btn-left{\n\tbackground-position:0 -147px;\n}\n\n.x-panel-btns .x-btn-focus .x-btn-right{\n\tbackground-position:0 -168px;\n}\n\n.x-panel-btns .x-btn-focus .x-btn-center{\n\tbackground-position:0 -189px;\n}\n\n.x-panel-btns .x-btn-over .x-btn-left{\n\tbackground-position:0 -63px;\n}\n\n.x-panel-btns .x-btn-over .x-btn-right{\n\tbackground-position:0 -84px;\n}\n\n.x-panel-btns .x-btn-over .x-btn-center{\n\tbackground-position:0 -105px;\n}\n\n.x-panel-btns .x-btn-click .x-btn-center{\n\tbackground-position:0 -126px;\n}\n\n.x-panel-btns .x-btn-click  .x-btn-right{\n\tbackground-position:0 -84px;\n}\n\n.x-panel-btns .x-btn-click .x-btn-left{\n\tbackground-position:0 -63px;\n}\n\n.x-panel-fbar td,.x-panel-fbar span,.x-panel-fbar input,.x-panel-fbar div,.x-panel-fbar select,.x-panel-fbar label{\n\twhite-space: nowrap;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/structure/pivotgrid.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-pivotgrid .x-grid3-header-offset table {\n    width: 100%;\n    border-collapse: collapse;\n}\n\n.x-pivotgrid .x-grid3-header-offset table td {\n    padding: 4px 3px 4px 5px;\n    text-align: center;\n    white-space: nowrap;\n    overflow: hidden;\n    text-overflow: ellipsis;\n    font-size: 11px;\n    line-height: 13px;\n    font-family: tahoma;\n}\n\n.x-pivotgrid .x-grid3-row-headers {\n    display: block;\n    float: left;\n}\n\n.x-pivotgrid .x-grid3-row-headers table {\n    height: 100%;\n    width: 100%;\n    border-collapse: collapse;\n}\n\n.x-pivotgrid .x-grid3-row-headers table td {\n    height: 18px;\n    padding: 2px 7px 0 0;\n    text-align: right;\n    text-overflow: ellipsis;\n    font-size: 11px;\n    font-family: tahoma;\n}\n\n.ext-gecko .x-pivotgrid .x-grid3-row-headers table td {\n    height: 21px;\n}\n\n.x-grid3-header-title {\n    top: 0%;\n    left: 0%;\n    position: absolute;\n    text-align: center;\n    vertical-align: middle;\n    font-family: tahoma;\n    font-size: 11px;\n    padding: auto 1px;\n    display: table-cell;\n}\n\n.x-grid3-header-title span {\n    position: absolute;\n    top: 50%;\n    left: 0%;\n    width: 100%;\n    margin-top: -6px;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/progress.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-progress-wrap {\n    border:1px solid;\n    overflow:hidden;\n}\n\n.x-progress-inner {\n    height:18px;\n    background:repeat-x;\n    position:relative;\n}\n\n.x-progress-bar {\n    height:18px;\n    float:left;\n    width:0;\n    background: repeat-x left center;\n    border-top:1px solid;\n    border-bottom:1px solid;\n    border-right:1px solid;\n}\n\n.x-progress-text {\n    padding:1px 5px;\n    overflow:hidden;\n    position:absolute;\n    left:0;\n    text-align:center;\n}\n\n.x-progress-text-back {\n    line-height:16px;\n}\n\n.ext-ie .x-progress-text-back {\n    line-height:15px;\n}\n\n.ext-strict .ext-ie7 .x-progress-text-back{\n    width: 100%;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/structure/qtips.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-tip{\n\tposition: absolute;\n\ttop: 0;\n    left:0;\n    visibility: hidden;\n\tz-index: 20002;\n    border:0 none;\n}\n\n.x-tip .x-tip-close{\n\theight: 15px;\n\tfloat:right;\n\twidth: 15px;\n    margin:0 0 2px 2px;\n    cursor:pointer;\n    display:none;\n}\n\n.x-tip .x-tip-tc {\n\tbackground: transparent no-repeat 0 -62px;\n\tpadding-top:3px;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tip .x-tip-tl {\n\tbackground: transparent no-repeat 0 0;\n\tpadding-left:6px;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tip .x-tip-tr {\n\tbackground: transparent no-repeat right 0;\n\tpadding-right:6px;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tip .x-tip-bc {\n\tbackground: transparent no-repeat 0 -121px;\n\theight:3px;\n    overflow:hidden;\n}\n\n.x-tip .x-tip-bl {\n\tbackground: transparent no-repeat 0 -59px;\n\tpadding-left:6px;\n    zoom:1;\n}\n\n.x-tip .x-tip-br {\n\tbackground: transparent no-repeat right -59px;\n\tpadding-right:6px;\n    zoom:1;\n}\n\n.x-tip .x-tip-mc {\n    border:0 none;\n}\n\n.x-tip .x-tip-ml {\n\tbackground: no-repeat 0 -124px;\n\tpadding-left:6px;\n    zoom:1;\n}\n\n.x-tip .x-tip-mr {\n\tbackground: transparent no-repeat right -124px;\n\tpadding-right:6px;\n    zoom:1;\n}\n\n.ext-ie .x-tip .x-tip-header,.ext-ie .x-tip .x-tip-tc {\n    font-size:0;\n    line-height:0;\n}\n\n.ext-border-box .x-tip .x-tip-header, .ext-border-box .x-tip .x-tip-tc{\n    line-height: 1px;\n}\n\n.x-tip .x-tip-header-text {\n    padding:0;\n    margin:0 0 2px 0;\n}\n\n.x-tip .x-tip-body {\n    margin:0 !important;\n    line-height:14px;\n    padding:0;\n}\n\n.x-tip .x-tip-body .loading-indicator {\n    margin:0;\n}\n\n.x-tip-draggable .x-tip-header,.x-tip-draggable .x-tip-header-text {\n    cursor:move;\n}\n\n.x-form-invalid-tip .x-tip-tc {\n\tbackground: repeat-x 0 -12px;\n    padding-top:6px;\n}\n\n.x-form-invalid-tip .x-tip-bc {\n\tbackground: repeat-x 0 -18px;\n    height:6px;\n}\n\n.x-form-invalid-tip .x-tip-bl {\n\tbackground: no-repeat 0 -6px;\n}\n\n.x-form-invalid-tip .x-tip-br {\n\tbackground: no-repeat right -6px;\n}\n\n.x-form-invalid-tip .x-tip-body {\n    padding:2px;\n}\n\n.x-form-invalid-tip .x-tip-body {\n    padding-left:24px;\n    background:transparent no-repeat 2px 2px;\n}\n\n.x-tip-anchor {\n    position: absolute;\n    width: 9px;\n    height: 10px;\n    overflow:hidden;\n    background: transparent no-repeat 0 0;\n    zoom:1;\n}\n.x-tip-anchor-bottom {\n    background-position: -9px 0;\n}\n.x-tip-anchor-right {\n    background-position: -18px 0;\n    width: 10px;\n}\n.x-tip-anchor-left {\n    background-position: -28px 0;\n    width: 10px;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/reset.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nhtml,body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,p,blockquote,th,td{margin:0;padding:0;}img,body,html{border:0;}address,caption,cite,code,dfn,em,strong,th,var{font-style:normal;font-weight:normal;}ol,ul {list-style:none;}caption,th {text-align:left;}h1,h2,h3,h4,h5,h6{font-size:100%;}q:before,q:after{content:'';}\n\n.ext-forced-border-box, .ext-forced-border-box * {\n    -moz-box-sizing: border-box;\n    -ms-box-sizing: border-box;\n    -webkit-box-sizing: border-box;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/structure/resizable.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-resizable-handle {\n    position:absolute;\n    z-index:100;\n    /* ie needs these */\n    font-size:1px;\n    line-height:6px;\n    overflow:hidden;\n\tfilter:alpha(opacity=0);\n\topacity:0;\n\tzoom:1;\n}\n\n.x-resizable-handle-east{\n    width:6px;\n    cursor:e-resize;\n    right:0;\n    top:0;\n    height:100%;\n}\n\n.ext-ie .x-resizable-handle-east {\n    margin-right:-1px; /*IE rounding error*/\n}\n\n.x-resizable-handle-south{\n    width:100%;\n    cursor:s-resize;\n    left:0;\n    bottom:0;\n    height:6px;\n}\n\n.ext-ie .x-resizable-handle-south {\n    margin-bottom:-1px; /*IE rounding error*/\n}\n\n.x-resizable-handle-west{\n    width:6px;\n    cursor:w-resize;\n    left:0;\n    top:0;\n    height:100%;\n}\n\n.x-resizable-handle-north{\n    width:100%;\n    cursor:n-resize;\n    left:0;\n    top:0;\n    height:6px;\n}\n\n.x-resizable-handle-southeast{\n    width:6px;\n    cursor:se-resize;\n    right:0;\n    bottom:0;\n    height:6px;\n    z-index:101;\n}\n\n.x-resizable-handle-northwest{\n    width:6px;\n    cursor:nw-resize;\n    left:0;\n    top:0;\n    height:6px;\n    z-index:101;\n}\n\n.x-resizable-handle-northeast{\n    width:6px;\n    cursor:ne-resize;\n    right:0;\n    top:0;\n    height:6px;\n    z-index:101;\n}\n\n.x-resizable-handle-southwest{\n    width:6px;\n    cursor:sw-resize;\n    left:0;\n    bottom:0;\n    height:6px;\n    z-index:101;\n}\n\n.x-resizable-over .x-resizable-handle, .x-resizable-pinned .x-resizable-handle{\n    filter:alpha(opacity=100);\n\topacity:1;\n}\n\n.x-resizable-over .x-resizable-handle-east, .x-resizable-pinned .x-resizable-handle-east,\n.x-resizable-over .x-resizable-handle-west, .x-resizable-pinned .x-resizable-handle-west\n{\n\tbackground-position: left;\n}\n\n.x-resizable-over .x-resizable-handle-south, .x-resizable-pinned .x-resizable-handle-south,\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north\n{\n    background-position: top;\n}\n\n.x-resizable-over .x-resizable-handle-southeast, .x-resizable-pinned .x-resizable-handle-southeast{\n    background-position: top left;\n}\n\n.x-resizable-over .x-resizable-handle-northwest, .x-resizable-pinned .x-resizable-handle-northwest{\n    background-position:bottom right;\n}\n\n.x-resizable-over .x-resizable-handle-northeast, .x-resizable-pinned .x-resizable-handle-northeast{\n    background-position: bottom left;\n}\n\n.x-resizable-over .x-resizable-handle-southwest, .x-resizable-pinned .x-resizable-handle-southwest{\n    background-position: top right;\n}\n\n.x-resizable-proxy{\n    border: 1px dashed;\n    position:absolute;\n    overflow:hidden;\n    display:none;\n\tleft:0;\n    top:0;\n    z-index:50000;\n}\n\n.x-resizable-overlay{\n    width:100%;\n\theight:100%;\n\tdisplay:none;\n\tposition:absolute;\n\tleft:0;\n\ttop:0;\n\tz-index:200000;\n\t-moz-opacity: 0;\n    opacity:0;\n    filter: alpha(opacity=0);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/structure/slider.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/* Shared styles */\n.x-slider {\n    zoom:1;\n}\n\n.x-slider-inner {\n    position:relative;\n    left:0;\n    top:0;\n    overflow:visible;\n    zoom:1;\n}\n\n.x-slider-focus {\n\tposition:absolute;\n\tleft:0;\n\ttop:0;\n\twidth:1px;\n\theight:1px;\n    line-height:1px;\n    font-size:1px;\n    -moz-outline:0 none;\n    outline:0 none;\n    -moz-user-select: none;\n    -khtml-user-select:none;\n    -webkit-user-select:ignore;\n\tdisplay:block;\n\toverflow:hidden;  \n}\n\n/* Horizontal styles */\n.x-slider-horz {\n    padding-left:7px;\n    background:transparent no-repeat 0 -22px;\n}\n\n.x-slider-horz .x-slider-end {\n    padding-right:7px;\n    zoom:1;\n    background:transparent no-repeat right -44px;\n}\n\n.x-slider-horz .x-slider-inner {\n    background:transparent repeat-x 0 0;\n    height:22px;\n}\n\n.x-slider-horz .x-slider-thumb {\n    width:14px;\n    height:15px;\n    position:absolute;\n    left:0;\n    top:3px;\n    background:transparent no-repeat 0 0;\n}\n\n.x-slider-horz .x-slider-thumb-over {\n    background-position: -14px -15px;\n}\n\n.x-slider-horz .x-slider-thumb-drag {\n    background-position: -28px -30px;\n}\n\n/* Vertical styles */\n.x-slider-vert {\n    padding-top:7px;\n    background:transparent no-repeat -44px 0;\n    width:22px;\n}\n\n.x-slider-vert .x-slider-end {\n    padding-bottom:7px;\n    zoom:1;\n    background:transparent no-repeat -22px bottom;\n}\n\n.x-slider-vert .x-slider-inner {\n    background:transparent repeat-y 0 0;\n}\n\n.x-slider-vert .x-slider-thumb {\n    width:15px;\n    height:14px;\n    position:absolute;\n    left:3px;\n    bottom:0;\n    background:transparent no-repeat 0 0;\n}\n\n.x-slider-vert .x-slider-thumb-over {\n    background-position: -15px -14px;\n}\n\n.x-slider-vert .x-slider-thumb-drag {\n    background-position: -30px -28px;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/tabs.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-tab-panel {\n    overflow:hidden;\n}\n\n.x-tab-panel-header, .x-tab-panel-footer {\n\tborder: 1px solid;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tab-panel-header {\n\tborder: 1px solid;\n\tpadding-bottom: 2px;\n}\n\n.x-tab-panel-footer {\n\tborder: 1px solid;\n\tpadding-top: 2px;\n}\n\n.x-tab-strip-wrap {\n\twidth:100%;\n    overflow:hidden;\n    position:relative;\n    zoom:1;\n}\n\nul.x-tab-strip {\n\tdisplay:block;\n    width:5000px;\n    zoom:1;\n}\n\nul.x-tab-strip-top{\n\tpadding-top: 1px;\n\tbackground: repeat-x bottom;\n\tborder-bottom: 1px solid;\n}\n\nul.x-tab-strip-bottom{\n\tpadding-bottom: 1px;\n\tbackground: repeat-x top;\n\tborder-top: 1px solid;\n\tborder-bottom: 0 none;\n}\n\n.x-tab-panel-header-plain .x-tab-strip-top {\n    background:transparent !important;\n    padding-top:0 !important;\n}\n\n.x-tab-panel-header-plain {\n    background:transparent !important;\n    border-width:0 !important;\n    padding-bottom:0 !important;\n}\n\n.x-tab-panel-header-plain .x-tab-strip-spacer,\n.x-tab-panel-footer-plain .x-tab-strip-spacer {\n    border:1px solid;\n    height:2px;\n    font-size:1px;\n    line-height:1px;\n}\n\n.x-tab-panel-header-plain .x-tab-strip-spacer {\n    border-top: 0 none;\n}\n\n.x-tab-panel-footer-plain .x-tab-strip-spacer {\n    border-bottom: 0 none;\n}\n\n.x-tab-panel-footer-plain .x-tab-strip-bottom {\n    background:transparent !important;\n    padding-bottom:0 !important;\n}\n\n.x-tab-panel-footer-plain {\n    background:transparent !important;\n    border-width:0 !important;\n    padding-top:0 !important;\n}\n\n.ext-border-box .x-tab-panel-header-plain .x-tab-strip-spacer,\n.ext-border-box .x-tab-panel-footer-plain .x-tab-strip-spacer {\n    height:3px;\n}\n\nul.x-tab-strip li {\n    float:left;\n    margin-left:2px;\n}\n\nul.x-tab-strip li.x-tab-edge {\n    float:left;\n    margin:0 !important;\n    padding:0 !important;\n    border:0 none !important;\n    font-size:1px !important;\n    line-height:1px !important;\n    overflow:hidden;\n    zoom:1;\n    background:transparent !important;\n    width:1px;\n}\n\n.x-tab-strip a, .x-tab-strip span, .x-tab-strip em {\n\tdisplay:block;\n}\n\n.x-tab-strip a {\n\ttext-decoration:none !important;\n\t-moz-outline: none;\n\toutline: none;\n\tcursor:pointer;\n}\n\n.x-tab-strip-inner {\n    overflow:hidden;\n\ttext-overflow: ellipsis;\n}\n\n.x-tab-strip span.x-tab-strip-text {\n\twhite-space: nowrap;\n\tcursor:pointer;\n    padding:4px 0;\n}\n\n.x-tab-strip-top .x-tab-with-icon .x-tab-right {\n    padding-left:6px;\n}\n\n.x-tab-strip .x-tab-with-icon span.x-tab-strip-text {\n\tpadding-left:20px;\n    background-position: 0 3px;\n    background-repeat: no-repeat;\n}\n\n.x-tab-strip-active, .x-tab-strip-active a.x-tab-right {\n    cursor:default;\n}\n\n.x-tab-strip-active span.x-tab-strip-text {\n\tcursor:default;\n}\n\n.x-tab-strip-disabled .x-tabs-text {\n\tcursor:default;\n}\n\n.x-tab-panel-body {\n    overflow:hidden;\n}\n\n.x-tab-panel-bwrap {\n    overflow:hidden;\n}\n\n.ext-ie .x-tab-strip .x-tab-right {\n    position:relative;\n}\n\n.x-tab-strip-top .x-tab-strip-active .x-tab-right {\n    margin-bottom:-1px;\n}\n\n/*\n * For IE8/9 in quirks mode\n */\n.ext-ie8 .x-tab-strip li {\n    position: relative;\n}\n.ext-border-box .ext-ie8 .x-tab-strip-top .x-tab-right, .ext-border-box .ext-ie9 .x-tab-strip-top .x-tab-right {\n    top: 1px;\n}\n.ext-ie8 .x-tab-strip-top, .ext-ie9 .x-tab-strip-top {\n    padding-top: 1px;\n}\n.ext-border-box .ext-ie8 .x-tab-strip-top, .ext-border-box .ext-ie9 .x-tab-strip-top {\n    padding-top: 0;\n}\n.ext-ie8 .x-tab-strip .x-tab-strip-closable a.x-tab-strip-close, .ext-ie9 .x-tab-strip .x-tab-strip-closable a.x-tab-strip-close {\n    top:3px;\n}\n.ext-border-box .ext-ie8 .x-tab-strip .x-tab-strip-closable a.x-tab-strip-close,\n.ext-border-box .ext-ie9 .x-tab-strip .x-tab-strip-closable a.x-tab-strip-close {\n    top:4px;\n}\n.ext-ie8 .x-tab-strip-bottom .x-tab-right, .ext-ie9 .x-tab-strip-bottom .x-tab-right{\n    top:0;\n}\n\n\n.x-tab-strip-top .x-tab-strip-active .x-tab-right span.x-tab-strip-text {\n    padding-bottom:5px;\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-right {\n    margin-top:-1px;\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-right span.x-tab-strip-text {\n    padding-top:5px;\n}\n\n.x-tab-strip-top .x-tab-right {\n\tbackground: transparent no-repeat 0 -51px;\n    padding-left:10px;\n}\n\n.x-tab-strip-top .x-tab-left {\n\tbackground: transparent no-repeat right -351px;\n    padding-right:10px;\n}\n\n.x-tab-strip-top .x-tab-strip-inner {\n\tbackground: transparent repeat-x 0 -201px;\n}\n\n.x-tab-strip-top .x-tab-strip-over .x-tab-right {\n\t background-position:0 -101px;\n}\n\n.x-tab-strip-top .x-tab-strip-over .x-tab-left {\n\t background-position:right -401px;\n}\n\n.x-tab-strip-top .x-tab-strip-over .x-tab-strip-inner {\n\t background-position:0 -251px;\n}\n\n.x-tab-strip-top .x-tab-strip-active .x-tab-right {\n\tbackground-position: 0 0;\n}\n\n.x-tab-strip-top .x-tab-strip-active .x-tab-left {\n\tbackground-position: right -301px;\n}\n\n.x-tab-strip-top .x-tab-strip-active .x-tab-strip-inner {\n\tbackground-position: 0 -151px;\n}\n\n.x-tab-strip-bottom .x-tab-right {\n\tbackground: no-repeat bottom right;\n}\n\n.x-tab-strip-bottom .x-tab-left {\n\tbackground: no-repeat bottom left;\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-right {\n\tbackground: no-repeat bottom right;\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-left {\n\tbackground: no-repeat bottom left;\n}\n\n.x-tab-strip-bottom .x-tab-left {\n    margin-right: 3px;\n    padding:0 10px;\n}\n\n.x-tab-strip-bottom .x-tab-right {\n    padding:0;\n}\n\n.x-tab-strip .x-tab-strip-close {\n    display:none;\n}\n\n.x-tab-strip-closable {\n    position:relative;\n}\n\n.x-tab-strip-closable .x-tab-left {\n    padding-right:19px;\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close {\n    opacity:.6;\n    -moz-opacity:.6;\n    background-repeat:no-repeat;\n    display:block;\n\twidth:11px;\n    height:11px;\n    position:absolute;\n    top:3px;\n    right:3px;\n    cursor:pointer;\n    z-index:2;\n}\n\n.x-tab-strip .x-tab-strip-active a.x-tab-strip-close {\n    opacity:.8;\n    -moz-opacity:.8;\n}\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close:hover{\n    opacity:1;\n    -moz-opacity:1;\n}\n\n.x-tab-panel-body {\n    border: 1px solid;\n}\n\n.x-tab-panel-body-top {\n    border-top: 0 none;\n}\n\n.x-tab-panel-body-bottom {\n    border-bottom: 0 none;\n}\n\n.x-tab-scroller-left {\n    background: transparent no-repeat -18px 0;\n    border-bottom: 1px solid;\n    width:18px;\n    position:absolute;\n    left:0;\n    top:0;\n    z-index:10;\n    cursor:pointer;\n}\n.x-tab-scroller-left-over {\n    background-position: 0 0;\n}\n\n.x-tab-scroller-left-disabled {\n    background-position: -18px 0;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n    cursor:default;\n}\n\n.x-tab-scroller-right {\n    background: transparent no-repeat 0 0;\n    border-bottom: 1px solid;\n    width:18px;\n    position:absolute;\n    right:0;\n    top:0;\n    z-index:10;\n    cursor:pointer;\n}\n\n.x-tab-scroller-right-over {\n    background-position: -18px 0;\n}\n\n.x-tab-scroller-right-disabled {\n    background-position: 0 0;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n    cursor:default;\n}\n\n.x-tab-scrolling-bottom .x-tab-scroller-left, .x-tab-scrolling-bottom .x-tab-scroller-right{\n    margin-top: 1px;\n}\n\n.x-tab-scrolling .x-tab-strip-wrap {\n    margin-left:18px;\n    margin-right:18px;\n}\n\n.x-tab-scrolling {\n    position:relative;    \n}\n\n.x-tab-panel-bbar .x-toolbar {\n    border:1px solid;\n    border-top:0 none;\n    overflow:hidden;\n    padding:2px;\n}\n\n.x-tab-panel-tbar .x-toolbar {\n    border:1px solid;\n    border-top:0 none;\n    overflow:hidden;\n    padding:2px;\n}"
  },
  {
    "path": "client/src/ext/resources/css/structure/toolbar.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-toolbar{\n    border-style:solid;\n    border-width:0 0 1px 0;\n    display: block;\n\tpadding:2px;\n    background:repeat-x top left;\n    position:relative;\n    left:0;\n    top:0;\n    zoom:1;\n    overflow:hidden;\n}\n\n.x-toolbar-left {\n    width: 100%;\n}\n\n.x-toolbar .x-item-disabled .x-btn-icon {\n    opacity: .35;\n    -moz-opacity: .35;\n    filter: alpha(opacity=35);\n}\n\n.x-toolbar td {\n\tvertical-align:middle;\n}\n\n.x-toolbar td,.x-toolbar span,.x-toolbar input,.x-toolbar div,.x-toolbar select,.x-toolbar label{\n\twhite-space: nowrap;\n}\n\n.x-toolbar .x-item-disabled {\n\tcursor:default;\n\topacity:.6;\n\t-moz-opacity:.6;\n\tfilter:alpha(opacity=60);\n}\n\n.x-toolbar .x-item-disabled * {\n\tcursor:default;\n}\n\n.x-toolbar .x-toolbar-cell {\n    vertical-align:middle;\n}\n\n.x-toolbar .x-btn-tl, .x-toolbar .x-btn-tr, .x-toolbar .x-btn-tc, .x-toolbar .x-btn-ml, .x-toolbar .x-btn-mr,\n.x-toolbar .x-btn-mc, .x-toolbar .x-btn-bl, .x-toolbar .x-btn-br, .x-toolbar .x-btn-bc\n{\n\tbackground-position: 500px 500px;\n}\n\n/* These rules are duplicated from button.css to give priority of x-toolbar rules above */\n.x-toolbar .x-btn-over .x-btn-tl{\n\tbackground-position: -6px 0;\n}\n\n.x-toolbar .x-btn-over .x-btn-tr{\n\tbackground-position: -9px 0;\n}\n\n.x-toolbar .x-btn-over .x-btn-tc{\n\tbackground-position: 0 -9px;\n}\n\n.x-toolbar .x-btn-over .x-btn-ml{\n\tbackground-position: -6px -24px;\n}\n\n.x-toolbar .x-btn-over .x-btn-mr{\n\tbackground-position: -9px -24px;\n}\n\n.x-toolbar .x-btn-over .x-btn-mc{\n\tbackground-position: 0 -2168px;\n}\n\n.x-toolbar .x-btn-over .x-btn-bl{\n\tbackground-position: -6px -3px;\n}\n\n.x-toolbar .x-btn-over .x-btn-br{\n\tbackground-position: -9px -3px;\n}\n\n.x-toolbar .x-btn-over .x-btn-bc{\n\tbackground-position: 0 -18px;\n}\n\n.x-toolbar .x-btn-click .x-btn-tl, .x-toolbar .x-btn-menu-active .x-btn-tl, .x-toolbar .x-btn-pressed .x-btn-tl{\n\tbackground-position: -12px 0;\n}\n\n.x-toolbar .x-btn-click .x-btn-tr, .x-toolbar .x-btn-menu-active .x-btn-tr, .x-toolbar .x-btn-pressed .x-btn-tr{\n\tbackground-position: -15px 0;\n}\n\n.x-toolbar .x-btn-click .x-btn-tc, .x-toolbar .x-btn-menu-active .x-btn-tc, .x-toolbar .x-btn-pressed .x-btn-tc{\n\tbackground-position: 0 -12px;\n}\n\n.x-toolbar .x-btn-click .x-btn-ml, .x-toolbar .x-btn-menu-active .x-btn-ml, .x-toolbar .x-btn-pressed .x-btn-ml{\n\tbackground-position: -12px -24px;\n}\n\n.x-toolbar .x-btn-click .x-btn-mr, .x-toolbar .x-btn-menu-active .x-btn-mr, .x-toolbar .x-btn-pressed .x-btn-mr{\n\tbackground-position: -15px -24px;\n}\n\n.x-toolbar .x-btn-click .x-btn-mc, .x-toolbar .x-btn-menu-active .x-btn-mc, .x-toolbar .x-btn-pressed .x-btn-mc{\n\tbackground-position: 0 -3240px;\n}\n\n.x-toolbar .x-btn-click .x-btn-bl, .x-toolbar .x-btn-menu-active .x-btn-bl, .x-toolbar .x-btn-pressed .x-btn-bl{\n\tbackground-position: -12px -3px;\n}\n\n.x-toolbar .x-btn-click .x-btn-br, .x-toolbar .x-btn-menu-active .x-btn-br, .x-toolbar .x-btn-pressed .x-btn-br{\n\tbackground-position: -15px -3px;\n}\n\n.x-toolbar .x-btn-click .x-btn-bc, .x-toolbar .x-btn-menu-active .x-btn-bc, .x-toolbar .x-btn-pressed .x-btn-bc{\n\tbackground-position: 0 -21px;\n}\n\n.x-toolbar div.xtb-text{\n    padding:2px 2px 0;\n    line-height:16px;\n    display:block;\n}\n\n.x-toolbar .xtb-sep {\n\tbackground-position: center;\n\tbackground-repeat: no-repeat;\n\tdisplay: block;\n\tfont-size: 1px;\n\theight: 16px;\n\twidth:4px;\n\toverflow: hidden;\n\tcursor:default;\n\tmargin: 0 2px 0;\n\tborder:0;\n}\n\n.x-toolbar .xtb-spacer {\n    width:2px;\n}\n\n/* Paging Toolbar */\n.x-tbar-page-number{\n\twidth:30px;\n\theight:14px;\n}\n\n.ext-ie .x-tbar-page-number{\n    margin-top: 2px;\n}\n\n.x-paging-info {\n    position:absolute;\n    top:5px;\n    right: 8px;\n}\n\n/* floating */\n.x-toolbar-ct {\n    width:100%;\n}\n\n.x-toolbar-right td {\n    text-align: center;\n}\n\n.x-panel-tbar, .x-panel-bbar, .x-window-tbar, .x-window-bbar, .x-tab-panel-tbar, .x-tab-panel-bbar, .x-plain-tbar, .x-plain-bbar {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-toolbar-more .x-btn-small .x-btn-text{\n\theight: 16px;\n\twidth: 12px;\n}\n\n.x-toolbar-more em.x-btn-arrow {\n    display:inline;\n    background-color:transparent;\n\tpadding-right:0;\n}\n\n.x-toolbar-more .x-btn-mc em.x-btn-arrow {\n    background-image: none;\n}\n\ndiv.x-toolbar-no-items {\n    color:gray !important;\n    padding:5px 10px !important;\n}\n\n/* fix ie toolbar form items */\n.ext-border-box .x-toolbar-cell .x-form-text {\n    margin-bottom:-1px !important;\n}\n\n.ext-border-box .x-toolbar-cell .x-form-field-wrap .x-form-text {\n    margin:0 !important;\n}\n\n.ext-ie .x-toolbar-cell .x-form-field-wrap {\n    height:21px;\n}\n\n.ext-ie .x-toolbar-cell .x-form-text {\n    position:relative;\n    top:-1px;\n}\n\n.ext-strict .ext-ie8 .x-toolbar-cell .x-form-field-trigger-wrap .x-form-text, .ext-strict .ext-ie .x-toolbar-cell .x-form-text {\n    top: 0px;\n}\n\n.x-toolbar-right td .x-form-field-trigger-wrap{\n    text-align: left;\n}\n\n.x-toolbar-cell .x-form-checkbox, .x-toolbar-cell .x-form-radio{\n    margin-top: 5px;\n}\n\n.x-toolbar-cell .x-form-cb-label{\n    vertical-align: bottom;\n    top: 1px;\n}\n\n.ext-ie .x-toolbar-cell .x-form-checkbox, .ext-ie .x-toolbar-cell .x-form-radio{\n    margin-top: 4px;\n}\n\n.ext-ie .x-toolbar-cell .x-form-cb-label{\n    top: 0;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/structure/tree.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.ext-strict .ext-ie .x-tree .x-panel-bwrap{\n    position:relative;\n    overflow:hidden;\n}\n\n.x-tree-icon, .x-tree-ec-icon, .x-tree-elbow-line, .x-tree-elbow, .x-tree-elbow-end, .x-tree-elbow-plus, .x-tree-elbow-minus, .x-tree-elbow-end-plus, .x-tree-elbow-end-minus{\n\tborder: 0 none;\n\theight: 18px;\n\tmargin: 0;\n\tpadding: 0;\n\tvertical-align: top;\n\twidth: 16px;\n    background-repeat: no-repeat;\n}\n\n.x-tree-node-collapsed .x-tree-node-icon, .x-tree-node-expanded .x-tree-node-icon, .x-tree-node-leaf .x-tree-node-icon{\n\tborder: 0 none;\n\theight: 18px;\n\tmargin: 0;\n\tpadding: 0;\n\tvertical-align: top;\n\twidth: 16px;\n\tbackground-position:center;\n    background-repeat: no-repeat;\n}\n\n.ext-ie .x-tree-node-indent img, .ext-ie .x-tree-node-icon, .ext-ie .x-tree-ec-icon {\n    vertical-align: middle !important;\n}\n\n.ext-strict .ext-ie8 .x-tree-node-indent img, .ext-strict .ext-ie8 .x-tree-node-icon, .ext-strict .ext-ie8 .x-tree-ec-icon {\n    vertical-align: top !important;\n}\n\n/* checkboxes */\n\ninput.x-tree-node-cb {\n    margin-left:1px;\n    height: 19px;\n\tvertical-align: bottom;\n}\n\n.ext-ie input.x-tree-node-cb {\n    margin-left:0;\n    margin-top: 1px;\n    width: 16px;\n    height: 16px;\n    vertical-align: middle;\n}\n\n.ext-strict .ext-ie8 input.x-tree-node-cb{\n    margin: 1px 1px;\n    height: 14px;\n    vertical-align: bottom;\n}\n\n.ext-strict .ext-ie8 input.x-tree-node-cb + a{\n    vertical-align: bottom;\n}\n\n.ext-opera input.x-tree-node-cb {\n    height: 14px;\n    vertical-align: middle;\n}\n\n.x-tree-noicon .x-tree-node-icon{\n\twidth:0; height:0;\n}\n\n/* No line styles */\n.x-tree-no-lines .x-tree-elbow{\n\tbackground-color:transparent;\n}\n\n.x-tree-no-lines .x-tree-elbow-end{\n\tbackground-color:transparent;\n}\n\n.x-tree-no-lines .x-tree-elbow-line{\n\tbackground-color:transparent;\n}\n\n/* Arrows */\n.x-tree-arrows .x-tree-elbow{\n\tbackground-color:transparent;\n}\n\n.x-tree-arrows .x-tree-elbow-plus{\n    background:transparent no-repeat 0 0;\n}\n\n.x-tree-arrows .x-tree-elbow-minus{\n    background:transparent no-repeat -16px 0;\n}\n\n.x-tree-arrows .x-tree-elbow-end{\n\tbackground-color:transparent;\n}\n\n.x-tree-arrows .x-tree-elbow-end-plus{\n    background:transparent no-repeat 0 0;\n}\n\n.x-tree-arrows .x-tree-elbow-end-minus{\n    background:transparent no-repeat -16px 0;\n}\n\n.x-tree-arrows .x-tree-elbow-line{\n\tbackground-color:transparent;\n}\n\n.x-tree-arrows .x-tree-ec-over .x-tree-elbow-plus{\n    background-position:-32px 0;\n}\n\n.x-tree-arrows .x-tree-ec-over .x-tree-elbow-minus{\n    background-position:-48px 0;\n}\n\n.x-tree-arrows .x-tree-ec-over .x-tree-elbow-end-plus{\n    background-position:-32px 0;\n}\n\n.x-tree-arrows .x-tree-ec-over .x-tree-elbow-end-minus{\n    background-position:-48px 0;\n}\n\n.x-tree-elbow-plus, .x-tree-elbow-minus, .x-tree-elbow-end-plus, .x-tree-elbow-end-minus{\n\tcursor:pointer;\n}\n\n.ext-ie ul.x-tree-node-ct{\n    font-size:0;\n    line-height:0;\n    zoom:1;\n}\n\n.x-tree-node{\n\twhite-space: nowrap;\n}\n\n.x-tree-node-el {\n    line-height:18px;\n    cursor:pointer;\n}\n\n.x-tree-node a, .x-dd-drag-ghost a{\n\ttext-decoration:none;\n\t-khtml-user-select:none;\n\t-moz-user-select:none;\n    -webkit-user-select:ignore;\n    -kthml-user-focus:normal;\n    -moz-user-focus:normal;\n    -moz-outline: 0 none;\n    outline:0 none;\n}\n\n.x-tree-node a span, .x-dd-drag-ghost a span{\n\ttext-decoration:none;\n\tpadding:1px 3px 1px 2px;\n}\n\n.x-tree-node .x-tree-node-disabled .x-tree-node-icon{\n\t-moz-opacity: 0.5;\n   opacity:.5;\n   filter: alpha(opacity=50);\n}\n\n.x-tree-node .x-tree-node-inline-icon{\n\tbackground-color:transparent;\n}\n\n.x-tree-node a:hover, .x-dd-drag-ghost a:hover{\n\ttext-decoration:none;\n}\n\n.x-tree-node div.x-tree-drag-insert-below{\n \t border-bottom:1px dotted;\n}\n\n.x-tree-node div.x-tree-drag-insert-above{\n\t border-top:1px dotted;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below{\n \t border-bottom:0 none;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above{\n\t border-top:0 none;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below a{\n \t border-bottom:2px solid;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above a{\n\t border-top:2px solid;\n}\n\n.x-tree-node .x-tree-drag-append a span{\n\t border:1px dotted;\n}\n\n.x-dd-drag-ghost .x-tree-node-indent, .x-dd-drag-ghost .x-tree-ec-icon{\n\tdisplay:none !important;\n}\n\n/* Fix for ie rootVisible:false issue */\n.x-tree-root-ct {\n    zoom:1;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/structure/window.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-window {\n    zoom:1;\n}\n\n.x-window .x-window-handle {\n    opacity:0;\n    -moz-opacity:0;\n    filter:alpha(opacity=0);\n}\n\n.x-window-proxy {\n    border:1px solid;\n    z-index:12000;\n    overflow:hidden;\n    position:absolute;\n    left:0;top:0;\n    display:none;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n}\n\n.x-window-header {\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-window-bwrap {\n    z-index:1;\n    position:relative;\n    zoom:1;\n    left:0;top:0;\n}\n\n.x-window-tl .x-window-header {\n    padding:5px 0 4px 0;\n}\n\n.x-window-header-text {\n    cursor:pointer;\n}\n\n.x-window-tc {\n\tbackground: transparent repeat-x 0 0;\n\toverflow:hidden;\n    zoom:1;\n}\n\n.x-window-tl {\n\tbackground: transparent no-repeat 0 0;\n\tpadding-left:6px;\n    zoom:1;\n    z-index:1;\n    position:relative;\n}\n\n.x-window-tr {\n\tbackground: transparent no-repeat right 0;\n\tpadding-right:6px;\n}\n\n.x-window-bc {\n\tbackground: transparent repeat-x 0 bottom;\n    zoom:1;\n}\n\n.x-window-bc .x-window-footer {\n    padding-bottom:6px;\n    zoom:1;\n    font-size:0;\n    line-height:0;\n}\n\n.x-window-bl {\n\tbackground: transparent no-repeat 0 bottom;\n\tpadding-left:6px;\n    zoom:1;\n}\n\n.x-window-br {\n\tbackground: transparent no-repeat right bottom;\n\tpadding-right:6px;\n    zoom:1;\n}\n\n.x-window-mc {\n    border:1px solid;\n    padding:0;\n    margin:0;\n}\n\n.x-window-ml {\n\tbackground: transparent repeat-y 0 0;\n\tpadding-left:6px;\n    zoom:1;\n}\n\n.x-window-mr {\n\tbackground: transparent repeat-y right 0;\n\tpadding-right:6px;\n    zoom:1;\n}\n\n.x-window-body {\n    overflow:hidden;\n}\n\n.x-window-bwrap {\n    overflow:hidden;\n}\n\n.x-window-maximized .x-window-bl, .x-window-maximized .x-window-br,\n    .x-window-maximized .x-window-ml, .x-window-maximized .x-window-mr,\n    .x-window-maximized .x-window-tl, .x-window-maximized .x-window-tr {\n    padding:0;\n}\n\n.x-window-maximized .x-window-footer {\n    padding-bottom:0;\n}\n\n.x-window-maximized .x-window-tc {\n    padding-left:3px;\n    padding-right:3px;\n}\n\n.x-window-maximized .x-window-mc {\n    border-left:0 none;\n    border-right:0 none;\n}\n\n.x-window-tbar .x-toolbar, .x-window-bbar .x-toolbar {\n    border-left:0 none;\n    border-right: 0 none;\n}\n\n.x-window-bbar .x-toolbar {\n    border-top:1px solid;\n    border-bottom:0 none;\n}\n\n.x-window-draggable, .x-window-draggable .x-window-header-text {\n    cursor:move;\n}\n\n.x-window-maximized .x-window-draggable, .x-window-maximized .x-window-draggable .x-window-header-text {\n    cursor:default;\n}\n\n.x-window-body {\n    background-color:transparent;\n}\n\n.x-panel-ghost .x-window-tl {\n    border-bottom:1px solid;\n}\n\n.x-panel-collapsed .x-window-tl {\n    border-bottom:1px solid;\n}\n\n.x-window-maximized-ct {\n    overflow:hidden;\n}\n\n.x-window-maximized .x-window-handle {\n    display:none;\n}\n\n.x-window-sizing-ghost ul {\n    border:0 none !important;\n}\n\n.x-dlg-focus{\n\t-moz-outline:0 none;\n\toutline:0 none;\n\twidth:0;\n\theight:0;\n\toverflow:hidden;\n\tposition:absolute;\n\ttop:0;\n\tleft:0;\n}\n\n.ext-webkit .x-dlg-focus{\n    width: 1px;\n    height: 1px;\n}\n\n.x-dlg-mask{\n    z-index:10000;\n    display:none;\n    position:absolute;\n    top:0;\n    left:0;\n    -moz-opacity: 0.5;\n    opacity:.50;\n    filter: alpha(opacity=50);\n}\n\nbody.ext-ie6.x-body-masked select {\n\tvisibility:hidden;\n}\n\nbody.ext-ie6.x-body-masked .x-window select {\n\tvisibility:visible;\n}\n\n.x-window-plain .x-window-mc {\n    border: 1px solid;\n}\n\n.x-window-plain .x-window-body {\n    border: 1px solid;\n    background:transparent !important;\n}"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/borders.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-panel-noborder .x-panel-header-noborder {\n    border-bottom-color:#343d4e;\n}\n\n.x-panel-noborder .x-panel-tbar-noborder .x-toolbar {\n    border-bottom-color:#343d4e;\n}\n\n.x-panel-noborder .x-panel-bbar-noborder .x-toolbar {\n    border-top-color:#343d4e;\n}\n\n.x-tab-panel-bbar-noborder .x-toolbar {\n    border-top-color:#343d4e;\n}\n\n.x-tab-panel-tbar-noborder .x-toolbar {\n    border-bottom-color:#343d4e;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/box.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-box-tl {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-tc {\n\tbackground-image: url(../images/default/box/tb.gif);\n}\n\n.x-box-tr {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-ml {\n\tbackground-image: url(../images/default/box/l.gif);\n}\n\n.x-box-mc {\n\tbackground-color: #eee;\n    background-image: url(../images/default/box/tb.gif);\n\tfont-family: \"Myriad Pro\",\"Myriad Web\",\"Tahoma\",\"Helvetica\",\"Arial\",sans-serif;\n\tcolor: #393939;\n\tfont-size: 15px;\n}\n\n.x-box-mc h3 {\n\tfont-size: 18px;\n\tfont-weight: bold;\n}\n\n.x-box-mr {\n\tbackground-image: url(../images/default/box/r.gif);\n}\n\n.x-box-bl {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-bc {\n\tbackground-image: url(../images/default/box/tb.gif);\n}\n\n.x-box-br {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-blue .x-box-bl, .x-box-blue .x-box-br, .x-box-blue .x-box-tl, .x-box-blue .x-box-tr {\n\tbackground-image: url(../images/default/box/corners-blue.gif);\n}\n\n.x-box-blue .x-box-bc, .x-box-blue .x-box-mc, .x-box-blue .x-box-tc {\n\tbackground-image: url(../images/default/box/tb-blue.gif);\n}\n\n.x-box-blue .x-box-mc {\n\tbackground-color: #c3daf9;\n}\n\n.x-box-blue .x-box-mc h3 {\n\tcolor: #17385b;\n}\n\n.x-box-blue .x-box-ml {\n\tbackground-image: url(../images/default/box/l-blue.gif);\n}\n\n.x-box-blue .x-box-mr {\n\tbackground-image: url(../images/default/box/r-blue.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/button.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-btn {\n\tfont:normal 14px tahoma, verdana, helvetica;\n}\n\n.x-btn button {\n    font:normal 14px arial,tahoma,verdana,helvetica;\n    color:#fffffa;\n    padding-left:6px !important;\n    padding-right:6px !important;\n}\n\n.x-btn-over .x-btn button{\n    color:#fff;\n}\n\n.x-btn-noicon .x-btn-small .x-btn-text, .x-btn-text-icon .x-btn-icon-small-left .x-btn-text,\n.x-btn-icon .x-btn-small .x-btn-text, .x-btn-text-icon .x-btn-icon-small-right .x-btn-text {\n    height:18px;\n}\n\n.x-btn-icon .x-btn-small .x-btn-text {\n    width:18px;\n}\n\n.x-btn-text-icon .x-btn-icon-small-left .x-btn-text {\n    padding-left:21px !important;\n}\n\n.x-btn-text-icon .x-btn-icon-small-right .x-btn-text {\n    padding-right:21px !important;\n}\n\n.x-btn-text-icon .x-btn-icon-medium-left .x-btn-text {\n    padding-left:29px !important;\n}\n\n.x-btn-text-icon .x-btn-icon-medium-right .x-btn-text {\n    padding-right:29px !important;\n}\n\n.x-btn-text-icon .x-btn-icon-large-left .x-btn-text {\n    padding-left:37px !important;\n}\n\n.x-btn-text-icon .x-btn-icon-large-right .x-btn-text {\n    padding-right:37px !important;\n}\n\n.x-btn em {\n    font-style:normal;\n    font-weight:normal;\n}\n\n.x-btn-tl, .x-btn-tr, .x-btn-tc, .x-btn-ml, .x-btn-mr, .x-btn-mc, .x-btn-bl, .x-btn-br, .x-btn-bc{\n\tbackground-image:url(../images/access/button/btn.gif);\n}\n\n.x-btn-click .x-btn-text, .x-btn-menu-active .x-btn-text, .x-btn-pressed .x-btn-text{\n    color:#fff;\n}\n\n.x-btn-disabled *{\n\tcolor:#eee !important;\n}\n\n.x-btn-mc em.x-btn-arrow {\n    background-image:url(../images/access/button/arrow.gif);\n    padding-right:13px;\n}\n\n.x-btn-mc em.x-btn-split {\n    background-image:url(../images/access/button/s-arrow.gif);\n    padding-right:20px;\n}\n\n.x-btn-over .x-btn-mc em.x-btn-split, .x-btn-click .x-btn-mc em.x-btn-split, .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-btn-pressed .x-btn-mc em.x-btn-split {\n    background-image:url(../images/access/button/s-arrow-o.gif);\n}\n\n.x-btn-mc em.x-btn-arrow-bottom {\n    background-image:url(../images/access/button/s-arrow-b-noline.gif);\n}\n\n.x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/access/button/s-arrow-b.gif);\n}\n\n.x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-btn-click .x-btn-mc em.x-btn-split-bottom, .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-btn-pressed .x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/access/button/s-arrow-bo.gif);\n}\n\n.x-btn-group-header {\n    color: #d2d2d2;\n}\n\n.x-btn-group-tc {\n\tbackground-image: url(../images/access/button/group-tb.gif);\n}\n\n.x-btn-group-tl {\n\tbackground-image: url(../images/access/button/group-cs.gif);\n}\n\n.x-btn-group-tr {\n\tbackground-image: url(../images/access/button/group-cs.gif);\n}\n\n.x-btn-group-bc {\n\tbackground-image: url(../images/access/button/group-tb.gif);\n}\n\n.x-btn-group-bl {\n\tbackground-image: url(../images/access/button/group-cs.gif);\n}\n\n.x-btn-group-br {\n\tbackground-image: url(../images/access/button/group-cs.gif);\n}\n\n.x-btn-group-ml {\n\tbackground-image: url(../images/access/button/group-lr.gif);\n}\n\n.x-btn-group-mr {\n\tbackground-image: url(../images/access/button/group-lr.gif);\n}\n\n.x-btn-group-notitle .x-btn-group-tc {\n\tbackground-image: url(../images/access/button/group-tb.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/combo.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-combo-list {\n    border:2px solid #232732;\n    background-color:#555566;\n    font:normal 15px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-combo-list-inner {\n    background-color:#414551;\n}\n\n.x-combo-list-hd {\n    font:bold 14px tahoma, arial, helvetica, sans-serif;\n    color:#fff;\n    background-image: url(../images/default/layout/panel-title-light-bg.gif);\n    border-bottom-color:#98c0f4;\n}\n\n.x-resizable-pinned .x-combo-list-inner {\n    border-bottom-color:#98c0f4;\n}\n\n.x-combo-list-item {\n    border-color:#556;\n}\n\n.x-combo-list .x-combo-selected {\n\tborder-color:#e5872c !important;\n    background-color:#e5872c;\n}\n\n.x-combo-list .x-toolbar {\n    border-top-color:#98c0f4;\n}\n\n.x-combo-list-small {\n    font:normal 14px tahoma, arial, helvetica, sans-serif;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/core.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nbody {\n\tbackground-color:#16181a;\n\tcolor:#fcfcfc;\n}\n\n.ext-el-mask {\n    background-color: #ccc;\n}\n\n.ext-el-mask-msg {\n    border-color:#223;\n    background-color:#3f4757;\n    background-image:url(../images/access/box/tb-blue.gif);\n}\n.ext-el-mask-msg div {\n    background-color: #232d38;\n    border-color:#556;\n    color:#fff;\n    font:normal 14px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-mask-loading div {\n    background-color:#232d38;\n    background-image:url(../images/access/grid/loading.gif);\n}\n\n.x-item-disabled {\n    color: #ddd;\n}\n\n.x-item-disabled * {\n    color: #ddd !important;\n}\n\n.x-splitbar-proxy {\n    background-color: #aaa;\n}\n\n.x-color-palette a {\n    border-color:#fff;\n}\n\n.x-color-palette a:hover, .x-color-palette a.x-color-palette-sel {\n    border-color:#8bb8f3;\n    background-color: #deecfd;\n}\n\n.x-color-palette em {\n    border-color:#aca899;\n}\n\n.x-ie-shadow {\n    background-color:#777;\n}\n\n.x-shadow .xsmc {\n    background-image: url(../images/default/shadow-c.png);\n}\n\n.x-shadow .xsml, .x-shadow .xsmr {\n    background-image: url(../images/default/shadow-lr.png);\n}\n\n.x-shadow .xstl, .x-shadow .xstc,  .x-shadow .xstr, .x-shadow .xsbl, .x-shadow .xsbc, .x-shadow .xsbr{\n    background-image: url(../images/default/shadow.png);\n}\n\n.loading-indicator {\n    font-size: 14px;\n    background-image: url(../images/access/grid/loading.gif);\n}\n\n.x-spotlight {\n    background-color: #ccc;\n}"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/date-picker.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-date-picker {\n    border-color: #737b8c;\n    background-color:#21252e;\n}\n\n.x-date-middle,.x-date-left,.x-date-right {\n\tbackground-image: url(../images/access/shared/hd-sprite.gif);\n\tcolor:#fff;\n\tfont:bold 14px \"sans serif\", tahoma, verdana, helvetica;\n}\n\n.x-date-middle .x-btn .x-btn-text {\n    color:#fff;\n}\n\n.x-date-middle .x-btn-mc em.x-btn-arrow {\n    background-image:url(../images/access/toolbar/btn-arrow-light.gif);\n}\n\n.x-date-right a {\n    background-image: url(../images/access/shared/right-btn.gif);\n}\n\n.x-date-left a{\n\tbackground-image: url(../images/access/shared/left-btn.gif);\n}\n\n.x-date-inner th {\n    background-color:#363d4a;\n    background-image:url(../images/access/toolbar/bg.gif);\n\tborder-bottom-color:#535b5c;\n    font:normal 13px arial, helvetica,tahoma,sans-serif;\n\tcolor:#fff;\n}\n\n.x-date-inner td {\n    border-color:#112;\n}\n\n.x-date-inner a {\n    font:normal 14px arial, helvetica,tahoma,sans-serif;\n    color:#fff;\n    padding:2px 7px 1px 3px; /* Structure to account for larger, bolder fonts in Access theme. */\n}\n\n.x-date-inner .x-date-active{\n\tcolor:#000;\n}\n\n.x-date-inner .x-date-selected a{\n    background-color:#e5872c;\n\tbackground-image:none;\n\tborder-color:#864900;\n    padding:1px 6px 1px 2px; /* Structure to account for larger, bolder fonts in Access theme. */\n}\n\n.x-date-inner .x-date-today a{\n\tborder-color:#99a;\n}\n\n.x-date-inner .x-date-selected span{\n    font-weight:bold;\n}\n\n.x-date-inner .x-date-prevday a,.x-date-inner .x-date-nextday a {\n\tcolor:#aaa;\n}\n\n.x-date-bottom {\n    border-top-color:#737b8c;\n    background-color:#464d5a;\n    background-image:url(../images/access/shared/glass-bg.gif);\n}\n\n.x-date-inner a:hover, .x-date-inner .x-date-disabled a:hover{\n    color:#fff;\n    background-color:#7e5530;\n}\n\n.x-date-inner .x-date-disabled a {\n\tbackground-color:#eee;\n\tcolor:#bbb;\n}\n\n.x-date-mmenu{\n    background-color:#eee !important;\n}\n\n.x-date-mmenu .x-menu-item {\n\tfont-size:13px;\n\tcolor:#000;\n}\n\n.x-date-mp {\n\tbackground-color:#21252e;\n}\n\n.x-date-mp td {\n\tfont:normal 14px arial, helvetica,tahoma,sans-serif;\n}\n\n.x-date-mp-btns button {\n\tbackground-color:#083772;\n\tcolor:#fff;\n\tborder-color: #3366cc #000055 #000055 #3366cc;\n\tfont:normal 14px arial, helvetica,tahoma,sans-serif;\n}\n\n.x-date-mp-btns {\n    background-color: #dfecfb;\n\tbackground-image: url(../images/access/shared/glass-bg.gif);\n}\n\n.x-date-mp-btns td {\n\tborder-top-color: #c5d2df;\n}\n\ntd.x-date-mp-month a,td.x-date-mp-year a {\n\tcolor:#fff;\n}\n\ntd.x-date-mp-month a:hover,td.x-date-mp-year a:hover {\n\tcolor:#fff;\n\tbackground-color: #7e5530;\n}\n\ntd.x-date-mp-sel a {\n    background-color: #e5872c;\n\tbackground-image: none;\n\tborder-color:#864900;\n}\n\n.x-date-mp-ybtn a {\n    background-image:url(../images/access/panel/tool-sprites.gif);\n}\n\ntd.x-date-mp-sep {\n   border-right-color:#c5d2df;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/dd.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-dd-drag-ghost{\n\tcolor:#000;\n\tfont: normal 14px arial, helvetica, sans-serif;\n    border-color: #ddd #bbb #bbb #ddd;\n\tbackground-color:#fff;\n}\n\n.x-dd-drop-nodrop .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-no.gif);\n}\n\n.x-dd-drop-ok .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-yes.gif);\n}\n\n.x-dd-drop-ok-add .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-add.gif);\n}\n\n.x-view-selector {\n    background-color:#c3daf9;\n    border-color:#3399bb;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/debug.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n#x-debug-browser .x-tree .x-tree-node a span {\n    color:#222297;\n    font-size:14px;\n    font-family:\"monotype\",\"courier new\",sans-serif;\n}\n\n#x-debug-browser .x-tree a i {\n    color:#ff4545;\n    font-style:normal;\n}\n\n#x-debug-browser .x-tree a em {\n    color:#999;\n}\n\n#x-debug-browser .x-tree .x-tree-node .x-tree-selected a span{\n    background-color:#c3daf9;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/dialog.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-window-dlg .ext-mb-text,\n.x-window-dlg .x-window-header-text {\n    font-size:15px;\n}\n\n.x-window-dlg .ext-mb-textarea {\n    font:normal 15px tahoma,arial,helvetica,sans-serif;\n}\n\n.x-window-dlg .x-msg-box-wait {\n    background-image:url(../images/access/grid/loading.gif);\n}\n\n.x-window-dlg .ext-mb-info {\n    background-image:url(../images/access/window/icon-info.gif);\n}\n\n.x-window-dlg .ext-mb-warning {\n    background-image:url(../images/access/window/icon-warning.gif);\n}\n\n.x-window-dlg .ext-mb-question {\n    background-image:url(../images/access/window/icon-question.gif);\n}\n\n.x-window-dlg .ext-mb-error {\n    background-image:url(../images/access/window/icon-error.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/editor.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-html-editor-wrap {\n    border-color:#737B8C;\n    background-color:#fff;\n}\n.x-html-editor-wrap iframe {\n    background-color: #fff;\n}\n.x-html-editor-tb .x-btn-text {\n    background-image:url(../images/access/editor/tb-sprite.gif);\n}"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/form.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-form-field {\n    font:normal 15px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-text, textarea.x-form-field{\n    color: #ffffff;\n    background-color:#33373d;\n    background-image:url(../images/access/form/text-bg.gif);\n    border-color:#737b8c;\n    border-width:2px;\n}\n\n.ext-webkit .x-form-text, .ext-webkit textarea.x-form-field{\n    border-width:2px;\n}\n\n.x-form-text, .ext-ie .x-form-file {\n    height:26px;\n}\n\n.ext-strict .x-form-text {\n    height:20px;\n}\n\n.x-form-select-one {\n    background-color:#fff;\n    border-color:#b5b8c8;\n}\n\n.x-form-check-group-label {\n    border-bottom: 1px solid #99bbe8;\n    color: #fff;\n}\n\n.x-editor .x-form-check-wrap {\n    background-color:#fff;\n}\n\n.x-form-field-wrap .x-form-trigger{\n    background-image:url(../images/access/form/trigger.gif);\n    border-bottom-color:#737b8c;\n    border-bottom-width:2px;\n    height:24px;\n    width:20px;\n}\n\n.x-form-field-wrap .x-form-trigger.x-form-trigger-over{\n    border-bottom-color:#d97e27;\n}\n\n.x-form-field-wrap .x-form-trigger.x-form-trigger-click{\n    border-bottom-color:#c86e19;\n}\n\n.x-small-editor .x-form-field-wrap .x-form-trigger {\n    height:24px;\n}\n\n.x-form-field-wrap .x-form-trigger-over {\n    background-position:-20px 0;\n}\n\n.x-form-field-wrap .x-form-trigger-click {\n    background-position:-40px 0;\n}\n\n.x-trigger-wrap-focus .x-form-trigger {\n    background-position:-60px 0;\n}\n\n.x-trigger-wrap-focus .x-form-trigger-over {\n    background-position:-80px 0;\n}\n\n.x-trigger-wrap-focus .x-form-trigger-click {\n    background-position:-100px 0;\n}\n\n.x-form-field-wrap .x-form-date-trigger{\n    background-image: url(../images/access/form/date-trigger.gif);\n}\n\n.x-form-field-wrap .x-form-clear-trigger{\n    background-image: url(../images/access/form/clear-trigger.gif);\n}\n\n.x-form-field-wrap .x-form-search-trigger{\n    background-image: url(../images/access/form/search-trigger.gif);\n}\n\n.x-trigger-wrap-focus .x-form-trigger{\n    border-bottom-color:#737b8c;\n}\n\n.x-item-disabled .x-form-trigger-over{\n    border-bottom-color:#b5b8c8;\n}\n\n.x-item-disabled .x-form-trigger-click{\n    border-bottom-color:#b5b8c8;\n}\n\n.x-form-focus, textarea.x-form-focus{\n\tborder-color:#ff9c33;\n}\n\n.x-form-invalid, textarea.x-form-invalid,\n.ext-webkit .x-form-invalid, .ext-webkit textarea.x-form-invalid{\n    background-color:#15171a;\n\tbackground-image:url(../images/access/grid/invalid_line.gif);\n\tborder-color:#c30;\n}\n\n/*\n.ext-safari .x-form-invalid{\n\tbackground-color:#fee;\n\tborder-color:#ff7870;\n}\n*/\n\n.x-form-inner-invalid, textarea.x-form-inner-invalid{\n    background-color:#fff;\n\tbackground-image:url(../images/access/grid/invalid_line.gif);\n}\n\n.x-form-grow-sizer {\n\tfont:normal 15px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-item {\n    font:normal 15px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-invalid-msg {\n    color:#c0272b;\n    font:normal 14px tahoma, arial, helvetica, sans-serif;\n    background-image:url(../images/default/shared/warning.gif);\n}\n\n.x-form-empty-field {\n    color:#dadadd;\n}\n\n.x-small-editor .x-form-text {\n    height: 26px;\n}\n\n.x-small-editor .x-form-field {\n    font:normal 14px arial, tahoma, helvetica, sans-serif;\n}\n\n.ext-safari .x-small-editor .x-form-field {\n    font:normal 15px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-form-invalid-icon {\n    background-image:url(../images/access/form/exclamation.gif);\n    height:25px;\n    width:19px;\n    background-position:center right;\n}\n\n.x-fieldset {\n    border-color:#737B8C;\n}\n\n.x-fieldset legend {\n    font:bold 14px tahoma, arial, helvetica, sans-serif;\n    color:#fff;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/grid.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-grid3 {\n    background-color:#1f2933;\n}\n\n.x-grid-panel .x-panel-mc .x-panel-body {\n    border-color:#223;\n}\n\n.x-grid3-hd-row td, .x-grid3-row td, .x-grid3-summary-row td{\n\tfont:normal 14px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-grid3-hd-row td {\n    border-left-color:#556;\n    border-right-color:#223;\n}\n\n.x-grid-row-loading {\n    background-color: #fff;\n    background-image:url(../images/default/shared/loading-balls.gif);\n}\n\n.x-grid3-row {\n    border:0 none;\n    border-bottom:1px solid #111;\n    border-right:1px solid #1a1a1c;\n}\n\n.x-grid3-row-alt{\n\tbackground-color:#1b232b;\n}\n\n.x-grid3-row-over {\n    background-color:#7e5530;\n}\n\n.x-grid3-resize-proxy {\n    background-color:#777;\n}\n\n.x-grid3-resize-marker {\n    background-color:#777;\n}\n\n.x-grid3-header{\n    background-color:#3b3f50;\n\tbackground-image:url(../images/access/grid/grid3-hrow.gif);\n}\n\n.x-grid3-header-pop {\n    border-left-color:#d0d0d0;\n}\n\n.x-grid3-header-pop-inner {\n    border-left-color:#eee;\n    background-image:url(../images/default/grid/hd-pop.gif);\n}\n\ntd.x-grid3-hd-over, td.sort-desc, td.sort-asc, td.x-grid3-hd-menu-open {\n    border-left-color:#889;\n    border-right-color:#445;\n}\n\ntd.x-grid3-hd-over .x-grid3-hd-inner, td.sort-desc .x-grid3-hd-inner, td.sort-asc .x-grid3-hd-inner, td.x-grid3-hd-menu-open .x-grid3-hd-inner {\n    background-color:#4e628a;\n    background-image:url(../images/access/grid/grid3-hrow-over.gif);\n}\n\n.x-grid3-cell-inner, .x-grid3-hd-inner {\n    color:#fff;\n}\n\n.sort-asc .x-grid3-sort-icon {\n\tbackground-image: url(../images/access/grid/sort_asc.gif);\n\twidth:15px;\n\theight:9px;\n\tmargin-left:5px;\n}\n\n.sort-desc .x-grid3-sort-icon {\n\tbackground-image: url(../images/access/grid/sort_desc.gif);\n\twidth:15px;\n\theight:9px;\n\tmargin-left:5px;\n}\n\n.x-grid3-cell-text, .x-grid3-hd-text {\n\tcolor:#fff;\n}\n\n.x-grid3-split {\n\tbackground-image: url(../images/default/grid/grid-split.gif);\n}\n\n.x-grid3-hd-text {\n\tcolor:#fff;\n}\n\n.x-dd-drag-proxy .x-grid3-hd-inner{\n    background-color:#ebf3fd;\n\tbackground-image:url(../images/access/grid/grid3-hrow-over.gif);\n\tborder-color:#aaccf6;\n}\n\n.col-move-top{\n\tbackground-image:url(../images/default/grid/col-move-top.gif);\n}\n\n.col-move-bottom{\n\tbackground-image:url(../images/default/grid/col-move-bottom.gif);\n}\n\n.x-grid3-row-selected {\n\tbackground-color: #e5872c !important;\n\tbackground-image: none;\n\tborder-style: solid;\n}\n\n.x-grid3-row-selected .x-grid3-cell {\n    color: #fff;\n}\n\n.x-grid3-cell-selected {\n\tbackground-color: #ffa340 !important;\n\tcolor:#fff;\n}\n\n.x-grid3-cell-selected span{\n\tcolor:#fff !important;\n}\n\n.x-grid3-cell-selected .x-grid3-cell-text{\n\tcolor:#fff;\n}\n\n.x-grid3-locked td.x-grid3-row-marker, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker{\n    background-color:#ebeadb !important;\n    background-image:url(../images/default/grid/grid-hrow.gif) !important;\n    color:#fff;\n    border-top-color:#fff;\n    border-right-color:#6fa0df !important;\n}\n\n.x-grid3-locked td.x-grid3-row-marker div, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker div{\n    color:#fff !important;\n}\n\n.x-grid3-dirty-cell {\n    background-image:url(../images/access/grid/dirty.gif);\n}\n\n.x-grid3-topbar, .x-grid3-bottombar{\n\tfont:normal 14px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-grid3-bottombar .x-toolbar{\n\tborder-top-color:#a9bfd3;\n}\n\n.x-props-grid .x-grid3-td-name .x-grid3-cell-inner{\n\tbackground-image:url(../images/access/grid/grid3-special-col-bg.gif) !important;\n    color:#fff !important;\n}\n.x-props-grid .x-grid3-td-value {\n    color:#fff !important;\n}\n\n.x-props-grid .x-grid3-body .x-grid3-td-name{\n    background-color:#263240 !important;\n    border-right-color:#223;\n}\n\n.xg-hmenu-sort-asc .x-menu-item-icon{\n\tbackground-image: url(../images/access/grid/hmenu-asc.gif);\n}\n\n.xg-hmenu-sort-desc .x-menu-item-icon{\n\tbackground-image: url(../images/access/grid/hmenu-desc.gif);\n}\n\n.xg-hmenu-lock .x-menu-item-icon{\n\tbackground-image: url(../images/access/grid/hmenu-lock.gif);\n}\n\n.xg-hmenu-unlock .x-menu-item-icon{\n\tbackground-image: url(../images/access/grid/hmenu-unlock.gif);\n}\n\n.x-grid3-hd-btn {\n    background-color:#c2c9d0;\n    background-image:url(../images/access/grid/grid3-hd-btn.gif);\n}\n\n.x-grid3-body .x-grid3-td-expander {\n    background-image:url(../images/access/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-row-expander {\n    background-image:url(../images/access/grid/row-expand-sprite.gif);\n}\n\n.x-grid3-body .x-grid3-td-checker {\n    background-image: url(../images/access/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-row-checker, .x-grid3-hd-checker {\n    background-image:url(../images/default/grid/row-check-sprite.gif);\n}\n\n.x-grid3-body .x-grid3-td-numberer {\n    background-image:url(../images/access/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-body .x-grid3-td-numberer .x-grid3-cell-inner {\n\tcolor:#fff;\n}\n\n.x-grid3-body .x-grid3-td-row-icon {\n    background-image:url(../images/access/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-numberer,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-checker,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-expander {\n\tbackground-image:url(../images/access/grid/grid3-special-col-sel-bg.gif);\n}\n\n.x-grid3-check-col {\n\tbackground-image:url(../images/default/menu/unchecked.gif);\n}\n\n.x-grid3-check-col-on {\n\tbackground-image:url(../images/default/menu/checked.gif);\n}\n\n.x-grid-group, .x-grid-group-body, .x-grid-group-hd {\n    zoom:1;\n}\n\n.x-grid-group-hd {\n    border-bottom-color:#4e628a;\n}\n\n.x-grid-group-hd div.x-grid-group-title {\n    background-image:url(../images/access/grid/group-collapse.gif);\n    background-position:3px 6px;\n    color:#ffd;\n    font:bold 14px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-grid-group-collapsed .x-grid-group-hd div.x-grid-group-title {\n    background-image:url(../images/access/grid/group-expand.gif);\n}\n\n.x-group-by-icon {\n    background-image:url(../images/default/grid/group-by.gif);\n}\n\n.x-cols-icon {\n    background-image:url(../images/default/grid/columns.gif);\n}\n\n.x-show-groups-icon {\n    background-image:url(../images/default/grid/group-by.gif);\n}\n\n.x-grid-empty {\n    color:gray;\n    font:normal 14px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-grid-with-col-lines .x-grid3-row td.x-grid3-cell {\n    border-right-color:#ededed;\n}\n\n.x-grid-with-col-lines .x-grid3-row{\n    border-top-color:#ededed;\n}\n\n.x-grid-with-col-lines .x-grid3-row-selected {\n\tborder-top-color:#a3bae9;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/layout.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-border-layout-ct {\n    background-color:#3f4757;\n}\n\n.x-accordion-hd {\n\tcolor:#fff;\n    font-weight:normal;\n    background-image: url(../images/access/panel/light-hd.gif);\n}\n\n.x-layout-collapsed{\n    background-color:#323845;\n\tborder-color:#1a1a1c;\n}\n\n.x-layout-collapsed-over{\n    background-color:#2d3440;\n}\n\n.x-layout-split-west .x-layout-mini {\n    background-image:url(../images/default/layout/mini-left.gif);\n}\n\n.x-layout-split-east .x-layout-mini {\n    background-image:url(../images/default/layout/mini-right.gif);\n}\n\n.x-layout-split-north .x-layout-mini {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n\n.x-layout-split-south .x-layout-mini {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n\n.x-layout-cmini-west .x-layout-mini {\n    background-image:url(../images/default/layout/mini-right.gif);\n}\n\n.x-layout-cmini-east .x-layout-mini {\n    background-image:url(../images/default/layout/mini-left.gif);\n}\n\n.x-layout-cmini-north .x-layout-mini {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n\n.x-layout-cmini-south .x-layout-mini {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/list-view.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-list-header{\n    background-color:#393d4e;\n\tbackground-image:url(../images/access/toolbar/bg.gif);\n\tbackground-position:0 top;\n}\n\n.x-list-header-inner div em {\n    border-left-color:#667;\n    font:normal 14px arial, tahoma, helvetica, sans-serif;\n    line-height: 14px;\n}\n\n.x-list-body-inner {\n    background-color:#1B232B;\n}\n\n.x-list-body dt em {\n    font:normal 14px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-list-over {\n    background-color:#7E5530;\n}\n\n.x-list-selected {\n    background-color:#E5872C;\n}\n\n.x-list-resizer {\n    border-left-color:#555;\n    border-right-color:#555;\n}\n\n.x-list-header-inner em.sort-asc, .x-list-header-inner em.sort-desc {\n    background-image:url(../images/access/grid/sort-hd.gif);\n    border-color: #3e4e6c;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/menu.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-menu {\n\tborder-color:#222;\n    background-color:#414551;\n\tbackground-image:url(../images/access/menu/menu.gif);\n}\n\n.x-menu-nosep {\n\tbackground-image:none;\n}\n\n.x-menu-list-item{\n\tfont:normal 14px tahoma,arial, sans-serif;\n}\n\n.x-menu-item-arrow{\n\tbackground-image:url(../images/access/menu/menu-parent.gif);\n}\n\n.x-menu-sep {\n    background-color:#223;\n\tborder-bottom-color:#666;\n}\n\na.x-menu-item {\n\tcolor:#fffff6;\n}\n\n.x-menu-item-active {\n\tbackground-color: #f09134;\n\tbackground-image: none;\n    border-color:#b36427;\n}\n\n.x-menu-item-active a.x-menu-item {\n\tborder-color:#b36427;\n}\n\n.x-menu-check-item .x-menu-item-icon{\n\tbackground-image:url(../images/default/menu/unchecked.gif);\n}\n\n.x-menu-item-checked .x-menu-item-icon{\n\tbackground-image:url(../images/default/menu/checked.gif);\n}\n\n.x-menu-item-checked .x-menu-group-item .x-menu-item-icon{\n    background-image:url(../images/access/menu/group-checked.gif);\n}\n\n.x-menu-group-item .x-menu-item-icon{\n    background-image:none;\n}\n\n.x-menu-plain {\n\tbackground-color:#fff !important;\n}\n\n.x-menu .x-date-picker{\n    border-color:#a3bad9;\n}\n\n.x-cycle-menu .x-menu-item-checked {\n    border-color:#a3bae9 !important;\n    background-color:#def8f6;\n}\n\n.x-menu-scroller-top {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n\n.x-menu-scroller-bottom {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/panel.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-panel {\n    border-color: #18181a;\n    font-size: 14px;\n}\n\n.x-panel-header {\n    color:#fff;\n    font-weight:bold; \n    font-size: 14px;\n    font-family: tahoma,arial,verdana,sans-serif;\n    border-color:#18181a;\n    background-image: url(../images/access/panel/white-top-bottom.gif);\n}\n\n.x-panel-body {\n    color: #fffff6;\n    border-color:#18181a;\n    background-color:#232d38;\n}\n\n.x-tab-panel .x-panel-body {\n    color: #fffff6;\n    border-color:#18181a;\n    background-color:#1f2730;\n}\n\n.x-panel-bbar .x-toolbar, .x-panel-tbar .x-toolbar {\n    border-color:#223;\n}\n\n.x-panel-tbar-noheader .x-toolbar, .x-panel-mc .x-panel-tbar .x-toolbar {\n    border-top-color:#223;\n}\n\n.x-panel-body-noheader, .x-panel-mc .x-panel-body {\n    border-top-color:#223;\n}\n\n.x-panel-tl .x-panel-header {\n    color:#fff;\n    font:bold 14px tahoma,arial,verdana,sans-serif;\n}\n\n.x-panel-tc {\n    background-image: url(../images/access/panel/top-bottom.gif);\n}\n\n.x-panel-tl, .x-panel-tr, .x-panel-bl,  .x-panel-br{\n    background-image: url(../images/access/panel/corners-sprite.gif);\n    border-bottom-color:#222224;\n}\n\n.x-panel-bc {\n\tbackground-image: url(../images/access/panel/top-bottom.gif);\n}\n\n.x-panel-mc {\n    font: normal 14px tahoma,arial,helvetica,sans-serif;\n    background-color:#3f4757;\n}\n\n.x-panel-ml {\n    background-image:url(../images/access/panel/left-right.gif);\n}\n\n.x-panel-mr {\n\tbackground-image: url(../images/access/panel/left-right.gif);\n}\n\n.x-tool {\n    background-image:url(../images/access/panel/tool-sprites.gif);\n}\n\n.x-panel-ghost {\n    background-color:#3f4757;\n}\n\n.x-panel-ghost ul {\n    border-color:#18181a;\n}\n\n.x-panel-dd-spacer {\n    border-color:#18181a;\n}\n\n.x-panel-fbar td,.x-panel-fbar span,.x-panel-fbar input,.x-panel-fbar div,.x-panel-fbar select,.x-panel-fbar label{\n    font:normal 14px arial,tahoma, helvetica, sans-serif;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/progress.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-progress-wrap {\n    border-color:#18181a;\n}\n\n.x-progress-inner {\n    background-color:#232d38;\n    background-image:none;\n}\n\n.x-progress-bar {\n    background-color:#f39a00;\n    background-image:url(../images/access/progress/progress-bg.gif);\n    border-top-color:#a66900;\n    border-bottom-color:#a66900;\n    border-right-color:#ffb941;\n    height: 20px !important; /* structural override for Accessibility Theme */\n}\n\n.x-progress-text {\n    font-size:14px;\n    font-weight:bold;\n    color:#fff;\n    padding: 0 5px !important; /* structural override for Accessibility Theme */\n}\n\n.x-progress-text-back {\n    color:#aaa;\n    line-height: 19px;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/qtips.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-tip .x-tip-close{\n\tbackground-image: url(../images/access/qtip/close.gif);\n}\n\n.x-tip .x-tip-tc, .x-tip .x-tip-tl, .x-tip .x-tip-tr, .x-tip .x-tip-bc, .x-tip .x-tip-bl, .x-tip .x-tip-br, .x-tip .x-tip-ml, .x-tip .x-tip-mr {\n\tbackground-image: url(../images/access/qtip/tip-sprite.gif);\n}\n\n.x-tip .x-tip-mc {\n    font: normal 14px tahoma,arial,helvetica,sans-serif;\n}\n.x-tip .x-tip-ml {\n\tbackground-color: #fff;\n}\n\n.x-tip .x-tip-header-text {\n    font: bold 14px tahoma,arial,helvetica,sans-serif;\n    color:#ffd;\n}\n\n.x-tip .x-tip-body {\n    font: normal 14px tahoma,arial,helvetica,sans-serif;\n    color:#000;\n}\n\n.x-form-invalid-tip .x-tip-tc, .x-form-invalid-tip .x-tip-tl, .x-form-invalid-tip .x-tip-tr, .x-form-invalid-tip .x-tip-bc,\n.x-form-invalid-tip .x-tip-bl, .x-form-invalid-tip .x-tip-br, .x-form-invalid-tip .x-tip-ml, .x-form-invalid-tip .x-tip-mr\n{\n\tbackground-image: url(../images/default/form/error-tip-corners.gif);\n}\n\n.x-form-invalid-tip .x-tip-body {\n    background-image:url(../images/access/form/exclamation.gif);\n}\n\n.x-tip-anchor {\n    background-image:url(../images/access/qtip/tip-anchor-sprite.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/resizable.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-resizable-handle {\n\tbackground-color:#fff;\n\tcolor: #000;\n}\n\n.x-resizable-over .x-resizable-handle-east, .x-resizable-pinned .x-resizable-handle-east,\n.x-resizable-over .x-resizable-handle-west, .x-resizable-pinned .x-resizable-handle-west\n{\n    background-image:url(../images/access/sizer/e-handle.gif);\n}\n\n.x-resizable-over .x-resizable-handle-south, .x-resizable-pinned .x-resizable-handle-south,\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north\n{\n    background-image:url(../images/access/sizer/s-handle.gif);\n}\n\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north{\n    background-image:url(../images/access/sizer/s-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-southeast, .x-resizable-pinned .x-resizable-handle-southeast{\n    background-image:url(../images/access/sizer/se-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-northwest, .x-resizable-pinned .x-resizable-handle-northwest{\n    background-image:url(../images/access/sizer/nw-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-northeast, .x-resizable-pinned .x-resizable-handle-northeast{\n    background-image:url(../images/access/sizer/ne-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-southwest, .x-resizable-pinned .x-resizable-handle-southwest{\n    background-image:url(../images/access/sizer/sw-handle.gif);\n}\n.x-resizable-proxy{\n    border-color:#3b5a82;\n}\n.x-resizable-overlay{\n    background-color:#fff;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/slider.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-slider-horz, .x-slider-horz .x-slider-end, .x-slider-horz .x-slider-inner {\n    background-image:url(../images/access/slider/slider-bg.png);\n}\n\n.x-slider-horz .x-slider-thumb {\n    background-image:url(../images/access/slider/slider-thumb.png);\n}\n\n.x-slider-vert, .x-slider-vert .x-slider-end, .x-slider-vert .x-slider-inner {\n    background-image:url(../images/access/slider/slider-v-bg.png);\n}\n\n.x-slider-vert .x-slider-thumb {\n    background-image:url(../images/access/slider/slider-v-thumb.png);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/tabs.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-tab-panel-header, .x-tab-panel-footer {\n\tbackground-color:#e18325;\n\tborder-color:#8db2e3;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tab-panel-header, .x-tab-panel-footer {\n\tborder-color:#222;\n}\n\nul.x-tab-strip-top{\n    background-color:#343843;\n\tbackground-image: url(../images/access/tabs/tab-strip-bg.gif);\n\tborder-bottom-color:#343d4e;\n}\n\nul.x-tab-strip-bottom{\n    background-color:#343843;\n\tbackground-image: url(../images/access/tabs/tab-strip-btm-bg.gif);\n\tborder-top-color:#343843;\n}\n\n.x-tab-panel-header-plain .x-tab-strip-spacer,\n.x-tab-panel-footer-plain .x-tab-strip-spacer {\n    border-color:#222;\n    background-color:#e18325;\n}\n\n.x-tab-strip span.x-tab-strip-text {\n\tfont:normal 14px tahoma,arial,helvetica;\n\tcolor:#fff;\n}\n\n.x-tab-strip-over span.x-tab-strip-text {\n\tcolor:#fff;\n}\n\n.x-tab-strip-active span.x-tab-strip-text {\n\tcolor:#fff;\n    font-weight:bold;\n}\n\n.x-tab-strip-disabled .x-tabs-text {\n\tcolor:#aaaaaa;\n}\n\n.x-tab-strip-top .x-tab-right, .x-tab-strip-top .x-tab-left, .x-tab-strip-top .x-tab-strip-inner{\n\tbackground-image: url(../images/access/tabs/tabs-sprite.gif);\n}\n\n.x-tab-strip-bottom .x-tab-right {\n\tbackground-image: url(../images/access/tabs/tab-btm-inactive-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-left {\n\tbackground-image: url(../images/access/tabs/tab-btm-inactive-left-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-right {\n\tbackground-image: url(../images/access/tabs/tab-btm-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-left {\n\tbackground-image: url(../images/access/tabs/tab-btm-left-bg.gif);\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close {\n\tbackground-image:url(../images/access/tabs/tab-close.gif);\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close:hover{\n\tbackground-image:url(../images/access/tabs/tab-close.gif);\n}\n\n.x-tab-panel-body {\n    border-color:#18181a;\n    background-color:#fff;\n}\n\n.x-tab-panel-body-top {\n    border-top: 0 none;\n}\n\n.x-tab-panel-body-bottom {\n    border-bottom: 0 none;\n}\n\n.x-tab-scroller-left {\n    background-image:url(../images/access/tabs/scroll-left.gif);\n    border-bottom-color:#8db2e3;\n}\n\n.x-tab-scroller-left-over {\n    background-position: 0 0;\n}\n\n.x-tab-scroller-left-disabled {\n    background-position: -18px 0;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n    cursor:default;\n}\n\n.x-tab-scroller-right {\n    background-image:url(../images/access/tabs/scroll-right.gif);\n    border-bottom-color:#8db2e3;\n}\n\n.x-tab-panel-bbar .x-toolbar, .x-tab-panel-tbar .x-toolbar {\n    border-color:#99bbe8;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/toolbar.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-toolbar{\n\tborder-color:#18181a;\n    background-color:#393d4e;\n    background-image:url(../images/access/toolbar/bg.gif);\n}\n\n.x-toolbar td,.x-toolbar span,.x-toolbar input,.x-toolbar div,.x-toolbar select,.x-toolbar label{\n    font:normal 14px arial,tahoma, helvetica, sans-serif;\n}\n\n.x-toolbar .x-item-disabled {\n\tcolor:gray;\n}\n\n.x-toolbar .x-item-disabled * {\n\tcolor:gray;\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split {\n    background-image:url(../images/access/button/s-arrow-noline.gif);\n}\n\n.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-click .x-btn-mc em.x-btn-split, \n.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split \n{\n    background-image:url(../images/access/button/s-arrow-o.gif);\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/access/button/s-arrow-b-noline.gif);\n}\n\n.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-click .x-btn-mc em.x-btn-split-bottom, \n.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split-bottom \n{\n    background-image:url(../images/access/button/s-arrow-bo.gif);\n}\n\n.x-toolbar .xtb-sep {\n\tbackground-image: url(../images/access/grid/grid-blue-split.gif);\n}\n\n.x-toolbar .x-btn {\n    padding-left:3px;\n    padding-right:3px;\n}\n\n.x-toolbar .x-btn-mc em.x-btn-arrow {\n    padding-right:10px;\n}\n\n.x-toolbar .x-btn-text-icon .x-btn-icon-small-left .x-btn-text {\n    padding-left:18px !important;\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split {\n    padding-right:14px;\n}\n\n.x-tbar-page-first{\n\tbackground-image: url(../images/access/grid/page-first.gif) !important;\n}\n\n.x-tbar-loading{\n\tbackground-image: url(../images/access/grid/refresh.gif) !important;\n}\n\n.x-tbar-page-last{\n\tbackground-image: url(../images/access/grid/page-last.gif) !important;\n}\n\n.x-tbar-page-next{\n\tbackground-image: url(../images/access/grid/page-next.gif) !important;\n}\n\n.x-tbar-page-prev{\n\tbackground-image: url(../images/access/grid/page-prev.gif) !important;\n}\n\n.x-item-disabled .x-tbar-loading{\n\tbackground-image: url(../images/access/grid/loading.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-first{\n\tbackground-image: url(../images/access/grid/page-first-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-last{\n\tbackground-image: url(../images/access/grid/page-last-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-next{\n\tbackground-image: url(../images/access/grid/page-next-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-prev{\n\tbackground-image: url(../images/access/grid/page-prev-disabled.gif) !important;\n}\n\n.x-paging-info {\n    color:#444;\n}\n\n.x-toolbar-more-icon {\n    background-image: url(../images/access/toolbar/more.gif) !important;\n}\n\n.x-statusbar .x-status-busy {\n    background-image: url(../images/access/grid/loading.gif);\n}\n\n.x-statusbar .x-status-text-panel {\n    border-color: #99bbe8 #fff #fff #99bbe8;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/tree.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-tree-node-expanded .x-tree-node-icon{\n\tbackground-image:url(../images/access/tree/folder-open.gif);\n}\n\n.x-tree-node-leaf .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/leaf.gif);\n}\n\n.x-tree-node-collapsed .x-tree-node-icon{\n\tbackground-image:url(../images/access/tree/folder.gif);\n}\n\n.x-tree-node-loading .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/loading.gif) !important;\n}\n\n.x-tree-node .x-tree-node-inline-icon {\n    background-image: none;\n}\n\n.x-tree-node-loading a span{\n\t font-style: italic;\n\t color:#444444;\n}\n\n.ext-ie .x-tree-node-el input {\n    width:14px;\n    height:14px;\n}\n\n.x-tree-lines .x-tree-elbow{\n\tbackground-image:url(../images/access/tree/elbow.gif);\n}\n\n.x-tree-lines .x-tree-elbow-plus{\n\tbackground-image:url(../images/access/tree/elbow-plus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-minus{\n\tbackground-image:url(../images/access/tree/elbow-minus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end{\n\tbackground-image:url(../images/access/tree/elbow-end.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end-plus{\n\tbackground-image:url(../images/access/tree/elbow-end-plus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end-minus{\n\tbackground-image:url(../images/access/tree/elbow-end-minus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-line{\n\tbackground-image:url(../images/access/tree/elbow-line.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-plus{\n\tbackground-image:url(../images/access/tree/elbow-plus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-minus{\n\tbackground-image:url(../images/access/tree/elbow-minus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-end-plus{\n\tbackground-image:url(../images/access/tree/elbow-end-plus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-end-minus{\n\tbackground-image:url(../images/access/tree/elbow-end-minus-nl.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-plus{\n    background-image:url(../images/access/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-minus{\n    background-image:url(../images/access/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-end-plus{\n    background-image:url(../images/access/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-end-minus{\n    background-image:url(../images/access/tree/arrows.gif);\n}\n\n.x-tree-node{\n\tcolor:#000;\n\tfont: normal 14px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-tree-node a, .x-dd-drag-ghost a{\n\tcolor:#fff;\n}\n\n.x-tree-node a span, .x-dd-drag-ghost a span{\n\tcolor:#fff;\n}\n\n.x-tree-node .x-tree-selected a, .x-dd-drag-ghost a{\n\tcolor:#fff;\n}\n\n.x-tree-node .x-tree-selected a span, .x-dd-drag-ghost a span{\n\tcolor:#fff;\n}\n\n.x-tree-node .x-tree-node-disabled a span{\n\tcolor:gray !important;\n}\n\n.x-tree-node div.x-tree-drag-insert-below{\n \t border-bottom-color:#36c;\n}\n\n.x-tree-node div.x-tree-drag-insert-above{\n\t border-top-color:#36c;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below a{\n \t border-bottom-color:#36c;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above a{\n\t border-top-color:#36c;\n}\n\n.x-tree-node .x-tree-drag-append a span{\n\t background-color:#ddd;\n\t border-color:gray;\n}\n\n.x-tree-node .x-tree-node-over {\n\tbackground-color: #7e5530;\n}\n\n.x-tree-node .x-tree-selected {\n\tbackground-color: #e5872c;\n}\n\n.x-tree-drop-ok-append .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-add.gif);\n}\n\n.x-tree-drop-ok-above .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-over.gif);\n}\n\n.x-tree-drop-ok-below .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-under.gif);\n}\n\n.x-tree-drop-ok-between .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-between.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-access/window.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-window-proxy {\n    background-color:#1f2833;\n    border-color:#18181a;\n}\n\n.x-window-tl .x-window-header {\n    color:#fff;\n\tfont:bold 14px tahoma,arial,verdana,sans-serif;\n}\n\n.x-window-tc {\n\tbackground-image: url(../images/access/window/top-bottom.png);\n}\n\n.x-window-tl {\n\tbackground-image: url(../images/access/window/left-corners.png);\n}\n\n.x-window-tr {\n\tbackground-image: url(../images/access/window/right-corners.png);\n}\n\n.x-window-bc {\n\tbackground-image: url(../images/access/window/top-bottom.png);\n}\n\n.x-window-bl {\n\tbackground-image: url(../images/access/window/left-corners.png);\n}\n\n.x-window-br {\n\tbackground-image: url(../images/access/window/right-corners.png);\n}\n\n.x-window-mc {\n    border-color:#18181a;\n    font: normal 14px tahoma,arial,helvetica,sans-serif;\n    background-color:#1f2833;\n}\n\n.x-window-ml {\n\tbackground-image: url(../images/access/window/left-right.png);\n}\n\n.x-window-mr {\n\tbackground-image: url(../images/access/window/left-right.png);\n}\n\n.x-window-maximized .x-window-tc {\n    background-color:#fff;\n}\n\n.x-window-bbar .x-toolbar {\n    border-top-color:#323945;\n}\n\n.x-panel-ghost .x-window-tl {\n    border-bottom-color:#323945;\n}\n\n.x-panel-collapsed .x-window-tl {\n    border-bottom-color:#323945;\n}\n\n.x-dlg-mask{\n   background-color:#ccc;\n}\n\n.x-window-plain .x-window-mc {\n    background-color: #464f61;\n    border-color: #636778;\n}\n\n.x-window-plain .x-window-body {\n    color: #fffff6;\n    border-color: #464F61;\n}\n\nbody.x-body-masked .x-window-plain .x-window-mc {\n    background-color: #464f61;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/borders.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-panel-noborder .x-panel-header-noborder {\n    border-bottom-color:#d0d0d0;\n}\n\n.x-panel-noborder .x-panel-tbar-noborder .x-toolbar {\n    border-bottom-color:#d0d0d0;\n}\n\n.x-panel-noborder .x-panel-bbar-noborder .x-toolbar {\n    border-top-color:#d0d0d0;\n}\n\n.x-tab-panel-bbar-noborder .x-toolbar {\n    border-top-color:#d0d0d0;\n}\n\n.x-tab-panel-tbar-noborder .x-toolbar {\n    border-bottom-color:#d0d0d0;\n}\n\n.x-border-layout-ct {\n    background-color:#f0f0f0;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/box.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-box-tl {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-tc {\n\tbackground-image: url(../images/default/box/tb.gif);\n}\n\n.x-box-tr {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-ml {\n\tbackground-image: url(../images/default/box/l.gif);\n}\n\n.x-box-mc {\n\tbackground-color: #eee;\n    background-image: url(../images/default/box/tb.gif);\n\tfont-family: \"Myriad Pro\",\"Myriad Web\",\"Tahoma\",\"Helvetica\",\"Arial\",sans-serif;\n\tcolor: #393939;\n\tfont-size: 12px;\n}\n\n.x-box-mc h3 {\n\tfont-size: 14px;\n\tfont-weight: bold;\n}\n\n.x-box-mr {\n\tbackground-image: url(../images/default/box/r.gif);\n}\n\n.x-box-bl {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-bc {\n\tbackground-image: url(../images/default/box/tb.gif);\n}\n\n.x-box-br {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-blue .x-box-bl, .x-box-blue .x-box-br, .x-box-blue .x-box-tl, .x-box-blue .x-box-tr {\n\tbackground-image: url(../images/default/box/corners-blue.gif);\n}\n\n.x-box-blue .x-box-bc, .x-box-blue .x-box-mc, .x-box-blue .x-box-tc {\n\tbackground-image: url(../images/default/box/tb-blue.gif);\n}\n\n.x-box-blue .x-box-mc {\n\tbackground-color: #c3daf9;\n}\n\n.x-box-blue .x-box-mc h3 {\n\tcolor: #17385b;\n}\n\n.x-box-blue .x-box-ml {\n\tbackground-image: url(../images/default/box/l-blue.gif);\n}\n\n.x-box-blue .x-box-mr {\n\tbackground-image: url(../images/default/box/r-blue.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/button.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-btn{\n\tfont:normal 11px tahoma, verdana, helvetica;\n}\n\n.x-btn button{\n    font:normal 11px arial,tahoma,verdana,helvetica;\n    color:#333;\n}\n\n.x-btn em {\n    font-style:normal;\n    font-weight:normal;\n}\n\n.x-btn-tl, .x-btn-tr, .x-btn-tc, .x-btn-ml, .x-btn-mr, .x-btn-mc, .x-btn-bl, .x-btn-br, .x-btn-bc{\n\tbackground-image:url(../images/gray/button/btn.gif);\n}\n\n.x-btn-click .x-btn-text, .x-btn-menu-active .x-btn-text, .x-btn-pressed .x-btn-text{\n    color:#000;\n}\n\n.x-btn-disabled *{\n\tcolor:gray !important;\n}\n\n.x-btn-mc em.x-btn-arrow {\n    background-image:url(../images/default/button/arrow.gif);\n}\n\n.x-btn-mc em.x-btn-split {\n    background-image:url(../images/default/button/s-arrow.gif);\n}\n\n.x-btn-over .x-btn-mc em.x-btn-split, .x-btn-click .x-btn-mc em.x-btn-split, .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-btn-pressed .x-btn-mc em.x-btn-split {\n    background-image:url(../images/gray/button/s-arrow-o.gif);\n}\n\n.x-btn-mc em.x-btn-arrow-bottom {\n    background-image:url(../images/default/button/s-arrow-b-noline.gif);\n}\n\n.x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/default/button/s-arrow-b.gif);\n}\n\n.x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-btn-click .x-btn-mc em.x-btn-split-bottom, .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-btn-pressed .x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/gray/button/s-arrow-bo.gif);\n}\n\n.x-btn-group-header {\n    color: #666;\n}\n\n.x-btn-group-tc {\n\tbackground-image: url(../images/gray/button/group-tb.gif);\n}\n\n.x-btn-group-tl {\n\tbackground-image: url(../images/gray/button/group-cs.gif);\n}\n\n.x-btn-group-tr {\n\tbackground-image: url(../images/gray/button/group-cs.gif);\n}\n\n.x-btn-group-bc {\n\tbackground-image: url(../images/gray/button/group-tb.gif);\n}\n\n.x-btn-group-bl {\n\tbackground-image: url(../images/gray/button/group-cs.gif);\n}\n\n.x-btn-group-br {\n\tbackground-image: url(../images/gray/button/group-cs.gif);\n}\n\n.x-btn-group-ml {\n\tbackground-image: url(../images/gray/button/group-lr.gif);\n}\n.x-btn-group-mr {\n\tbackground-image: url(../images/gray/button/group-lr.gif);\n}\n\n.x-btn-group-notitle .x-btn-group-tc {\n\tbackground-image: url(../images/gray/button/group-tb.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/combo.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-combo-list {\n    border-color:#ccc;\n    background-color:#ddd;\n    font:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-combo-list-inner {\n    background-color:#fff;\n}\n\n.x-combo-list-hd {\n    font:bold 11px tahoma, arial, helvetica, sans-serif;\n    color:#333;\n    background-image: url(../images/default/layout/panel-title-light-bg.gif);\n    border-bottom-color:#BCBCBC;\n}\n\n.x-resizable-pinned .x-combo-list-inner {\n    border-bottom-color:#BEBEBE;\n}\n\n.x-combo-list-item {\n    border-color:#fff;\n}\n\n.x-combo-list .x-combo-selected{\n\tborder-color:#777 !important;\n    background-color:#f0f0f0;\n}\n\n.x-combo-list .x-toolbar {\n    border-top-color:#BCBCBC;\n}\n\n.x-combo-list-small {\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n}"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/core.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.ext-el-mask {\n    background-color: #ccc;\n}\n\n.ext-el-mask-msg {\n    border-color:#999;\n    background-color:#ddd;\n    background-image:url(../images/gray/panel/white-top-bottom.gif);\n    background-position: 0 -1px;\n}\n.ext-el-mask-msg div {\n    background-color: #eee;\n    border-color:#d0d0d0;\n    color:#222;\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-mask-loading div {\n    background-color:#fbfbfb;\n    background-image:url(../images/default/grid/loading.gif);\n}\n\n.x-item-disabled {\n    color: gray;\n}\n\n.x-item-disabled * {\n    color: gray !important;\n}\n\n.x-splitbar-proxy {\n    background-color: #aaa;\n}\n\n.x-color-palette a {\n    border-color:#fff;\n}\n\n.x-color-palette a:hover, .x-color-palette a.x-color-palette-sel {\n    border-color:#CFCFCF;\n    background-color: #eaeaea;\n}\n\n/*\n.x-color-palette em:hover, .x-color-palette span:hover{   \n    background-color: #eaeaea;\n}\n*/\n\n.x-color-palette em {\n    border-color:#aca899;\n}\n\n.x-ie-shadow {\n    background-color:#777;\n}\n\n.x-shadow .xsmc {\n    background-image: url(../images/default/shadow-c.png);\n}\n\n.x-shadow .xsml, .x-shadow .xsmr {\n    background-image: url(../images/default/shadow-lr.png);\n}\n\n.x-shadow .xstl, .x-shadow .xstc,  .x-shadow .xstr, .x-shadow .xsbl, .x-shadow .xsbc, .x-shadow .xsbr{\n    background-image: url(../images/default/shadow.png);\n}\n\n.loading-indicator {\n    font-size: 11px;\n    background-image: url(../images/default/grid/loading.gif);\n}\n\n.x-spotlight {\n    background-color: #ccc;\n}"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/date-picker.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-date-picker {\n    border-color:#585858;\n    background-color:#fff;\n}\n\n.x-date-middle,.x-date-left,.x-date-right {\n\tbackground-image: url(../images/gray/shared/hd-sprite.gif);\n\tcolor:#fff;\n\tfont:bold 11px \"sans serif\", tahoma, verdana, helvetica;\n}\n\n.x-date-middle .x-btn .x-btn-text {\n    color:#fff;\n}\n\n.x-date-middle .x-btn-mc em.x-btn-arrow {\n    background-image:url(../images/gray/toolbar/btn-arrow-light.gif);\n}\n\n.x-date-right a {\n    background-image: url(../images/gray/shared/right-btn.gif);\n}\n\n.x-date-left a{\n\tbackground-image: url(../images/gray/shared/left-btn.gif);\n}\n\n.x-date-inner th {\n    background-color:#D8D8D8;\n    background-image: url(../images/gray/panel/white-top-bottom.gif);\n\tborder-bottom-color:#AFAFAF;\n    font:normal 10px arial, helvetica,tahoma,sans-serif;\n\tcolor:#595959;\n}\n\n.x-date-inner td {\n    border-color:#fff;\n}\n\n.x-date-inner a {\n    font:normal 11px arial, helvetica,tahoma,sans-serif;\n    color:#000;\n}\n\n.x-date-inner .x-date-active{\n\tcolor:#000;\n}\n\n.x-date-inner .x-date-selected a{\n    background-image: none;\n    background-color:#D8D8D8;\n\tborder-color:#DCDCDC;\n}\n\n.x-date-inner .x-date-today a{\n\tborder-color:darkred;\n}\n\n.x-date-inner .x-date-selected span{\n    font-weight:bold;\n}\n\n.x-date-inner .x-date-prevday a,.x-date-inner .x-date-nextday a {\n\tcolor:#aaa;\n}\n\n.x-date-bottom {\n    border-top-color:#AFAFAF;\n    background-color:#D8D8D8;\n    background:#D8D8D8 url(../images/gray/panel/white-top-bottom.gif) 0 -2px;\n}\n\n.x-date-inner a:hover, .x-date-inner .x-date-disabled a:hover{\n    color:#000;\n    background-color:#D8D8D8;\n}\n\n.x-date-inner .x-date-disabled a {\n\tbackground-color:#eee;\n\tcolor:#bbb;\n}\n\n.x-date-mmenu{\n    background-color:#eee !important;\n}\n\n.x-date-mmenu .x-menu-item {\n\tfont-size:10px;\n\tcolor:#000;\n}\n\n.x-date-mp {\n\tbackground-color:#fff;\n}\n\n.x-date-mp td {\n\tfont:normal 11px arial, helvetica,tahoma,sans-serif;\n}\n\n.x-date-mp-btns button {\n\tbackground-color:#4E565F;\n\tcolor:#fff;\n\tborder-color:#C0C0C0 #434343 #434343 #C0C0C0;\n\tfont:normal 11px arial, helvetica,tahoma,sans-serif;\n}\n\n.x-date-mp-btns {\n    background-color:#D8D8D8;\n    background:#D8D8D8 url(../images/gray/panel/white-top-bottom.gif) 0 -2px;\n}\n\n.x-date-mp-btns td {\n\tborder-top-color:#AFAFAF;\n}\n\ntd.x-date-mp-month a,td.x-date-mp-year a {\n\tcolor: #333;\n}\n\ntd.x-date-mp-month a:hover,td.x-date-mp-year a:hover {\n\tcolor:#333;\n\tbackground-color:#FDFDFD;\n}\n\ntd.x-date-mp-sel a {\n    background-color:#D8D8D8;\n    background:#D8D8D8 url(../images/gray/panel/white-top-bottom.gif) 0 -2px;\n\tborder-color:#DCDCDC;\n}\n\n.x-date-mp-ybtn a {\n    background-image:url(../images/gray/panel/tool-sprites.gif);\n}\n\ntd.x-date-mp-sep {\n   border-right-color:#D7D7D7;\n}"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/dd.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-dd-drag-ghost{\n\tcolor:#000;\n\tfont: normal 11px arial, helvetica, sans-serif;\n    border-color: #ddd #bbb #bbb #ddd;\n\tbackground-color:#fff;\n}\n\n.x-dd-drop-nodrop .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-no.gif);\n}\n\n.x-dd-drop-ok .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-yes.gif);\n}\n\n.x-dd-drop-ok-add .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-add.gif);\n}\n\n.x-view-selector {\n    background-color:#D6D6D6;\n    border-color:#888888;\n}"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/debug.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n#x-debug-browser .x-tree .x-tree-node a span {\n    color:#222297;\n    font-size:11px;\n    font-family:\"monotype\",\"courier new\",sans-serif;\n}\n\n#x-debug-browser .x-tree a i {\n    color:#ff4545;\n    font-style:normal;\n}\n\n#x-debug-browser .x-tree a em {\n    color:#999;\n}\n\n#x-debug-browser .x-tree .x-tree-node .x-tree-selected a span{\n    background-color:#D5D5D5;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/dialog.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-window-dlg .ext-mb-text,\n.x-window-dlg .x-window-header-text {\n    font-size:12px;\n}\n\n.x-window-dlg .ext-mb-textarea {\n    font:normal 12px tahoma,arial,helvetica,sans-serif;\n}\n\n.x-window-dlg .x-msg-box-wait {\n    background-image:url(../images/default/grid/loading.gif);\n}\n\n.x-window-dlg .ext-mb-info {\n    background-image:url(../images/gray/window/icon-info.gif);\n}\n\n.x-window-dlg .ext-mb-warning {\n    background-image:url(../images/gray/window/icon-warning.gif);\n}\n\n.x-window-dlg .ext-mb-question {\n    background-image:url(../images/gray/window/icon-question.gif);\n}\n\n.x-window-dlg .ext-mb-error {\n    background-image:url(../images/gray/window/icon-error.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/editor.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-html-editor-wrap {\n    border-color:#BCBCBC;\n    background-color:#fff;\n}\n.x-html-editor-tb .x-btn-text {\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/form.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-form-field{\n    font:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-text, textarea.x-form-field{\n    background-color:#fff;\n    background-image:url(../images/default/form/text-bg.gif);\n    border-color:#C1C1C1;\n}\n\n.x-form-select-one {\n    background-color:#fff;\n    border-color:#C1C1C1;\n}\n\n.x-form-check-group-label {\n    border-bottom: 1px solid #d0d0d0;\n    color: #333;\n}\n\n.x-editor .x-form-check-wrap {\n    background-color:#fff;\n}\n\n.x-form-field-wrap .x-form-trigger{\n    background-image:url(../images/gray/form/trigger.gif);\n    border-bottom-color:#b5b8c8;\n}\n\n.x-form-field-wrap .x-form-date-trigger{\n    background-image: url(../images/gray/form/date-trigger.gif);\n}\n\n.x-form-field-wrap .x-form-clear-trigger{\n    background-image: url(../images/gray/form/clear-trigger.gif);\n}\n\n.x-form-field-wrap .x-form-search-trigger{\n    background-image: url(../images/gray/form/search-trigger.gif);\n}\n\n.x-trigger-wrap-focus .x-form-trigger{\n    border-bottom-color: #777777;\n}\n\n.x-item-disabled .x-form-trigger-over{\n    border-bottom-color:#b5b8c8;\n}\n\n.x-item-disabled .x-form-trigger-click{\n    border-bottom-color:#b5b8c8;\n}\n\n.x-form-focus, textarea.x-form-focus{\n\tborder-color:#777777;\n}\n\n.x-form-invalid, textarea.x-form-invalid{\n    background-color:#fff;\n\tbackground-image:url(../images/default/grid/invalid_line.gif);\n\tborder-color:#c30;\n}\n\n.ext-webkit .x-form-invalid{\n\tbackground-color:#fee;\n\tborder-color:#ff7870;\n}\n\n.x-form-inner-invalid, textarea.x-form-inner-invalid{\n    background-color:#fff;\n\tbackground-image:url(../images/default/grid/invalid_line.gif);\n}\n\n.x-form-grow-sizer {\n\tfont:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-item {\n    font:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-invalid-msg {\n    color:#c0272b;\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n    background-image:url(../images/default/shared/warning.gif);\n}\n\n.x-form-empty-field {\n    color:gray;\n}\n\n.x-small-editor .x-form-field {\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.ext-webkit .x-small-editor .x-form-field {\n    font:normal 12px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-form-invalid-icon {\n    background-image:url(../images/default/form/exclamation.gif);\n}\n\n.x-fieldset {\n    border-color:#CCCCCC;\n}\n\n.x-fieldset legend {\n    font:bold 11px tahoma, arial, helvetica, sans-serif;\n    color:#777777;\n}"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/grid.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-grid3 {\n    background-color:#fff;\n}\n\n.x-grid-panel .x-panel-mc .x-panel-body {\n    border-color:#d0d0d0;\n}\n\n.x-grid3-row td, .x-grid3-summary-row td{\n    font:normal 11px/13px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-grid3-hd-row td {\n    font:normal 11px/15px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-grid3-hd-row td {\n    border-left-color:#eee;\n    border-right-color:#d0d0d0;\n}\n\n.x-grid-row-loading {\n    background-color: #fff;\n    background-image:url(../images/default/shared/loading-balls.gif);\n}\n\n.x-grid3-row {\n    border-color:#ededed;\n    border-top-color:#fff;\n}\n\n.x-grid3-row-alt{\n\tbackground-color:#fafafa;\n}\n\n.x-grid3-row-over {\n\tborder-color:#ddd;\n    background-color:#efefef;\n    background-image:url(../images/default/grid/row-over.gif);\n}\n\n.x-grid3-resize-proxy {\n    background-color:#777;\n}\n\n.x-grid3-resize-marker {\n    background-color:#777;\n}\n\n.x-grid3-header{\n    background-color:#f9f9f9;\n\tbackground-image:url(../images/gray/grid/grid3-hrow2.gif);\n}\n\n.x-grid3-header-pop {\n    border-left-color:#d0d0d0;\n}\n\n.x-grid3-header-pop-inner {\n    border-left-color:#eee;\n    background-image:url(../images/default/grid/hd-pop.gif);\n}\n\ntd.x-grid3-hd-over, td.sort-desc, td.sort-asc, td.x-grid3-hd-menu-open {\n    border-left-color:#ACACAC;\n    border-right-color:#ACACAC;\n}\n\ntd.x-grid3-hd-over .x-grid3-hd-inner, td.sort-desc .x-grid3-hd-inner, td.sort-asc .x-grid3-hd-inner, td.x-grid3-hd-menu-open .x-grid3-hd-inner {\n    background-color:#f9f9f9;\n    background-image:url(../images/gray/grid/grid3-hrow-over2.gif);\n\n}\n\n.sort-asc .x-grid3-sort-icon {\n\tbackground-image: url(../images/gray/grid/sort_asc.gif);\n}\n\n.sort-desc .x-grid3-sort-icon {\n\tbackground-image: url(../images/gray/grid/sort_desc.gif);\n}\n\n.x-grid3-cell-text, .x-grid3-hd-text {\n\tcolor:#000;\n}\n\n.x-grid3-split {\n\tbackground-image: url(../images/default/grid/grid-split.gif);\n}\n\n.x-grid3-hd-text {\n\tcolor:#333;\n}\n\n.x-dd-drag-proxy .x-grid3-hd-inner{\n    background-color:#f9f9f9;\n\tbackground-image:url(../images/gray/grid/grid3-hrow-over2.gif);\n\tborder-color:#ACACAC;\n}\n\n.col-move-top{\n\tbackground-image:url(../images/gray/grid/col-move-top.gif);\n}\n\n.col-move-bottom{\n\tbackground-image:url(../images/gray/grid/col-move-bottom.gif);\n}\n\n.x-grid3-row-selected {\n\tbackground-color:#CCCCCC !important;\n\tbackground-image: none;\n\tborder-color:#ACACAC;\n}\n\n.x-grid3-cell-selected{\n\tbackground-color: #CBCBCB !important;\n\tcolor:#000;\n}\n\n.x-grid3-cell-selected span{\n\tcolor:#000 !important;\n}\n\n.x-grid3-cell-selected .x-grid3-cell-text{\n\tcolor:#000;\n}\n\n.x-grid3-locked td.x-grid3-row-marker, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker{\n    background-color:#ebeadb !important;\n    background-image:url(../images/default/grid/grid-hrow.gif) !important;\n    color:#000;\n    border-top-color:#fff;\n    border-right-color:#6fa0df !important;\n}\n\n.x-grid3-locked td.x-grid3-row-marker div, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker div{\n    color:#333 !important;\n}\n\n.x-grid3-dirty-cell {\n    background-image:url(../images/default/grid/dirty.gif);\n}\n\n.x-grid3-topbar, .x-grid3-bottombar{\n\tfont:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-grid3-bottombar .x-toolbar{\n\tborder-top-color:#a9bfd3;\n}\n\n.x-props-grid .x-grid3-td-name .x-grid3-cell-inner{\n\tbackground-image:url(../images/default/grid/grid3-special-col-bg.gif) !important;\n    color:#000 !important;\n}\n\n.x-props-grid .x-grid3-body .x-grid3-td-name{\n    background-color:#fff !important;\n    border-right-color:#eee;\n}\n\n.xg-hmenu-sort-asc .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-asc.gif);\n}\n\n.xg-hmenu-sort-desc .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-desc.gif);\n}\n\n.xg-hmenu-lock .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-lock.gif);\n}\n\n.xg-hmenu-unlock .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-unlock.gif);\n}\n\n.x-grid3-hd-btn {\n    background-color:#f9f9f9;\n    background-image:url(../images/gray/grid/grid3-hd-btn.gif);\n}\n\n.x-grid3-body .x-grid3-td-expander {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-row-expander {\n    background-image:url(../images/gray/grid/row-expand-sprite.gif);\n}\n\n.x-grid3-body .x-grid3-td-checker {\n    background-image: url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-row-checker, .x-grid3-hd-checker {\n    background-image:url(../images/default/grid/row-check-sprite.gif);\n}\n\n.x-grid3-body .x-grid3-td-numberer {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-body .x-grid3-td-numberer .x-grid3-cell-inner {\n\tcolor:#444;\n}\n\n.x-grid3-body .x-grid3-td-row-icon {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-numberer,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-checker,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-expander {\n\tbackground-image:url(../images/gray/grid/grid3-special-col-sel-bg.gif);\n}\n\n.x-grid3-check-col {\n\tbackground-image:url(../images/default/menu/unchecked.gif);\n}\n\n.x-grid3-check-col-on {\n\tbackground-image:url(../images/default/menu/checked.gif);\n}\n\n.x-grid-group, .x-grid-group-body, .x-grid-group-hd {\n    zoom:1;\n}\n\n.x-grid-group-hd {\n    border-bottom-color:#d0d0d0;\n}\n\n.x-grid-group-hd div.x-grid-group-title {\n    background-image:url(../images/gray/grid/group-collapse.gif);\n    color:#5F5F5F;\n    font:bold 11px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-grid-group-collapsed .x-grid-group-hd div.x-grid-group-title {\n    background-image:url(../images/gray/grid/group-expand.gif);\n}\n\n.x-group-by-icon {\n    background-image:url(../images/default/grid/group-by.gif);\n}\n\n.x-cols-icon {\n    background-image:url(../images/default/grid/columns.gif);\n}\n\n.x-show-groups-icon {\n    background-image:url(../images/default/grid/group-by.gif);\n}\n\n.x-grid-empty {\n    color:gray;\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-grid-with-col-lines .x-grid3-row td.x-grid3-cell {\n    border-right-color:#ededed;\n}\n\n.x-grid-with-col-lines .x-grid3-row{\n    border-top-color:#ededed;\n}\n\n.x-grid-with-col-lines .x-grid3-row-selected {\n\tborder-top-color:#B9B9B9;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/layout.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-border-layout-ct {\n    background-color:#f0f0f0;\n}\n\n.x-accordion-hd {\n\tcolor:#222;\n    font-weight:normal;\n    background-image: url(../images/gray/panel/light-hd.gif);\n}\n\n.x-layout-collapsed{\n    background-color:#dfdfdf;\n\tborder-color:#d0d0d0;\n}\n\n.x-layout-collapsed-over{\n    background-color:#e7e7e7;\n}\n\n.x-layout-split-west .x-layout-mini {\n    background-image:url(../images/default/layout/mini-left.gif);\n}\n.x-layout-split-east .x-layout-mini {\n    background-image:url(../images/default/layout/mini-right.gif);\n}\n.x-layout-split-north .x-layout-mini {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n.x-layout-split-south .x-layout-mini {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n\n.x-layout-cmini-west .x-layout-mini {\n    background-image:url(../images/default/layout/mini-right.gif);\n}\n\n.x-layout-cmini-east .x-layout-mini {\n    background-image:url(../images/default/layout/mini-left.gif);\n}\n\n.x-layout-cmini-north .x-layout-mini {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n\n.x-layout-cmini-south .x-layout-mini {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/list-view.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-list-header{\n    background-color:#f9f9f9;\n\tbackground-image:url(../images/gray/grid/grid3-hrow2.gif);\n}\n\n.x-list-header-inner div em {\n    border-left-color:#ddd;\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-list-body dt em {\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-list-over {\n    background-color:#eee;\n}\n\n.x-list-selected {\n    background-color:#f0f0f0;\n}\n\n.x-list-resizer {\n    border-left-color:#555;\n    border-right-color:#555;\n}\n\n.x-list-header-inner em.sort-asc, .x-list-header-inner em.sort-desc {\n    background-image:url(../images/gray/grid/sort-hd.gif);\n    border-color: #d0d0d0;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/menu.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-menu {\n    background-color:#f0f0f0;\n\tbackground-image:url(../images/default/menu/menu.gif);\n}\n\n.x-menu-floating{\n    border-color:#7D7D7D;\n}\n\n.x-menu-nosep {\n\tbackground-image:none;\n}\n\n.x-menu-list-item{\n\tfont:normal 11px arial,tahoma,sans-serif;\n}\n\n.x-menu-item-arrow{\n\tbackground-image:url(../images/gray/menu/menu-parent.gif);\n}\n\n.x-menu-sep {\n    background-color:#e0e0e0;\n\tborder-bottom-color:#fff;\n}\n\na.x-menu-item {\n\tcolor:#222;\n}\n\n.x-menu-item-active {\n    background-image: url(../images/gray/menu/item-over.gif);\n\tbackground-color: #f1f1f1;\n    border-color:#ACACAC;\n}\n\n.x-menu-item-active a.x-menu-item {\n\tborder-color:#ACACAC;\n}\n\n.x-menu-check-item .x-menu-item-icon{\n\tbackground-image:url(../images/default/menu/unchecked.gif);\n}\n\n.x-menu-item-checked .x-menu-item-icon{\n\tbackground-image:url(../images/default/menu/checked.gif);\n}\n\n.x-menu-item-checked .x-menu-group-item .x-menu-item-icon{\n    background-image:url(../images/gray/menu/group-checked.gif);\n}\n\n.x-menu-group-item .x-menu-item-icon{\n    background-image:none;\n}\n\n.x-menu-plain {\n\tbackground-color:#fff !important;\n}\n\n.x-menu .x-date-picker{\n    border-color:#AFAFAF;\n}\n\n.x-cycle-menu .x-menu-item-checked {\n    border-color:#B9B9B9 !important;\n    background-color:#F1F1F1;\n}\n\n.x-menu-scroller-top {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n\n.x-menu-scroller-bottom {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/panel.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-panel {\n    border-color: #d0d0d0;\n}\n\n.x-panel-header {\n    color:#333;\n\tfont-weight:bold; \n    font-size: 11px;\n    font-family: tahoma,arial,verdana,sans-serif;\n    border-color:#d0d0d0;\n    background-image: url(../images/gray/panel/white-top-bottom.gif);\n}\n\n.x-panel-body {\n    border-color:#d0d0d0;\n    background-color:#fff;\n}\n\n.x-panel-bbar .x-toolbar, .x-panel-tbar .x-toolbar {\n    border-color:#d0d0d0;\n}\n\n.x-panel-tbar-noheader .x-toolbar, .x-panel-mc .x-panel-tbar .x-toolbar {\n    border-top-color:#d0d0d0;\n}\n\n.x-panel-body-noheader, .x-panel-mc .x-panel-body {\n    border-top-color:#d0d0d0;\n}\n\n.x-panel-tl .x-panel-header {\n    color:#333;\n\tfont:bold 11px tahoma,arial,verdana,sans-serif;\n}\n\n.x-panel-tc {\n\tbackground-image: url(../images/gray/panel/top-bottom.gif);\n}\n\n.x-panel-tl, .x-panel-tr, .x-panel-bl,  .x-panel-br{\n\tbackground-image: url(../images/gray/panel/corners-sprite.gif);\n    border-bottom-color:#d0d0d0;\n}\n\n.x-panel-bc {\n\tbackground-image: url(../images/gray/panel/top-bottom.gif);\n}\n\n.x-panel-mc {\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n    background-color:#f1f1f1;\n}\n\n.x-panel-ml {\n\tbackground-color: #fff;\n    background-image:url(../images/gray/panel/left-right.gif);\n}\n\n.x-panel-mr {\n\tbackground-image: url(../images/gray/panel/left-right.gif);\n}\n\n.x-tool {\n    background-image:url(../images/gray/panel/tool-sprites.gif);\n}\n\n.x-panel-ghost {\n    background-color:#f2f2f2;\n}\n\n.x-panel-ghost ul {\n    border-color:#d0d0d0;\n}\n\n.x-panel-dd-spacer {\n    border-color:#d0d0d0;\n}\n\n.x-panel-fbar td,.x-panel-fbar span,.x-panel-fbar input,.x-panel-fbar div,.x-panel-fbar select,.x-panel-fbar label{\n    font:normal 11px arial,tahoma, helvetica, sans-serif;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/pivotgrid.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-pivotgrid .x-grid3-header-offset table td {\n    background: url(../images/gray/grid/grid3-hrow2.gif) repeat-x 50% 100%;\n    border-left: 1px solid;\n    border-right: 1px solid;\n    border-left-color: #D0D0D0;\n    border-right-color: #D0D0D0;\n}\n\n.x-pivotgrid .x-grid3-row-headers {\n    background-color: #f9f9f9;\n}\n\n.x-pivotgrid .x-grid3-row-headers table td {\n    background: #EEE url(../images/default/grid/grid3-rowheader.gif) repeat-x left top;\n    border-left: 1px solid;\n    border-right: 1px solid;\n    border-left-color: #EEE;\n    border-right-color: #D0D0D0;\n    border-bottom: 1px solid;\n    border-bottom-color: #D0D0D0;\n    height: 18px;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/progress.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-progress-wrap {\n    border-color:#8E8E8E;\n}\n\n.x-progress-inner {\n    background-color:#E7E7E7;\n    background-image:url(../images/gray/qtip/bg.gif);\n}\n\n.x-progress-bar {\n    background-color:#BCBCBC;\n    background-image:url(../images/gray/progress/progress-bg.gif);\n    border-top-color:#E2E2E2;\n    border-bottom-color:#A4A4A4;\n    border-right-color:#A4A4A4;\n}\n\n.x-progress-text {\n    font-size:11px;\n    font-weight:bold;\n    color:#fff;\n}\n\n.x-progress-text-back {\n    color:#5F5F5F;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/qtips.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-tip .x-tip-close{\n\tbackground-image: url(../images/gray/qtip/close.gif);\n}\n\n.x-tip .x-tip-tc, .x-tip .x-tip-tl, .x-tip .x-tip-tr, .x-tip .x-tip-bc, .x-tip .x-tip-bl, .x-tip .x-tip-br, .x-tip .x-tip-ml, .x-tip .x-tip-mr {\n\tbackground-image: url(../images/gray/qtip/tip-sprite.gif);\n}\n\n.x-tip .x-tip-mc {\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n}\n.x-tip .x-tip-ml {\n\tbackground-color: #fff;\n}\n\n.x-tip .x-tip-header-text {\n    font: bold 11px tahoma,arial,helvetica,sans-serif;\n    color:#444;\n}\n\n.x-tip .x-tip-body {\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n    color:#444;\n}\n\n.x-form-invalid-tip .x-tip-tc, .x-form-invalid-tip .x-tip-tl, .x-form-invalid-tip .x-tip-tr, .x-form-invalid-tip .x-tip-bc,\n.x-form-invalid-tip .x-tip-bl, .x-form-invalid-tip .x-tip-br, .x-form-invalid-tip .x-tip-ml, .x-form-invalid-tip .x-tip-mr\n{\n\tbackground-image: url(../images/default/form/error-tip-corners.gif);\n}\n\n.x-form-invalid-tip .x-tip-body {\n    background-image:url(../images/default/form/exclamation.gif);\n}\n\n.x-tip-anchor {\n    background-image:url(../images/gray/qtip/tip-anchor-sprite.gif);\n}"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/resizable.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-resizable-handle {\n\tbackground-color:#fff;\n}\n\n.x-resizable-over .x-resizable-handle-east, .x-resizable-pinned .x-resizable-handle-east,\n.x-resizable-over .x-resizable-handle-west, .x-resizable-pinned .x-resizable-handle-west\n{\n    background-image:url(../images/gray/sizer/e-handle.gif);\n}\n\n.x-resizable-over .x-resizable-handle-south, .x-resizable-pinned .x-resizable-handle-south,\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north\n{\n    background-image:url(../images/gray/sizer/s-handle.gif);\n}\n\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north{\n    background-image:url(../images/gray/sizer/s-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-southeast, .x-resizable-pinned .x-resizable-handle-southeast{\n    background-image:url(../images/gray/sizer/se-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-northwest, .x-resizable-pinned .x-resizable-handle-northwest{\n    background-image:url(../images/gray/sizer/nw-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-northeast, .x-resizable-pinned .x-resizable-handle-northeast{\n    background-image:url(../images/gray/sizer/ne-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-southwest, .x-resizable-pinned .x-resizable-handle-southwest{\n    background-image:url(../images/gray/sizer/sw-handle.gif);\n}\n.x-resizable-proxy{\n    border-color:#565656;\n}\n.x-resizable-overlay{\n    background-color:#fff;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/slider.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-slider-horz, .x-slider-horz .x-slider-end, .x-slider-horz .x-slider-inner {\n    background-image:url(../images/default/slider/slider-bg.png);\n}\n\n.x-slider-horz .x-slider-thumb {\n    background-image:url(../images/gray/slider/slider-thumb.png);\n}\n\n.x-slider-vert, .x-slider-vert .x-slider-end, .x-slider-vert .x-slider-inner {\n    background-image:url(../images/default/slider/slider-v-bg.png);\n}\n\n.x-slider-vert .x-slider-thumb {\n    background-image:url(../images/gray/slider/slider-v-thumb.png);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/tabs.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-tab-panel-header, .x-tab-panel-footer {\n\tbackground-color: #eaeaea;\n\tborder-color:#d0d0d0;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tab-panel-header, .x-tab-panel-footer {\n\tborder-color:#d0d0d0;\n}\n\nul.x-tab-strip-top{\n    background-color:#dbdbdb;\n\tbackground-image: url(../images/gray/tabs/tab-strip-bg.gif);\n\tborder-bottom-color:#d0d0d0;\n}\n\nul.x-tab-strip-bottom{\n    background-color:#dbdbdb;\n\tbackground-image: url(../images/gray/tabs/tab-strip-btm-bg.gif);\n\tborder-top-color:#d0d0d0;\n}\n\n.x-tab-panel-header-plain .x-tab-strip-spacer,\n.x-tab-panel-footer-plain .x-tab-strip-spacer {\n    border-color:#d0d0d0;\n    background-color: #eaeaea;\n}\n\n.x-tab-strip span.x-tab-strip-text {\n\tfont:normal 11px tahoma,arial,helvetica;\n\tcolor:#333;\n}\n\n.x-tab-strip-over span.x-tab-strip-text {\n\tcolor:#111;\n}\n\n.x-tab-strip-active span.x-tab-strip-text {\n\tcolor:#333;\n    font-weight:bold;\n}\n\n.x-tab-strip-disabled .x-tabs-text {\n\tcolor:#aaaaaa;\n}\n\n.x-tab-strip-top .x-tab-right, .x-tab-strip-top .x-tab-left, .x-tab-strip-top .x-tab-strip-inner{\n\tbackground-image: url(../images/gray/tabs/tabs-sprite.gif);\n}\n\n.x-tab-strip-bottom .x-tab-right {\n\tbackground-image: url(../images/gray/tabs/tab-btm-inactive-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-left {\n\tbackground-image: url(../images/gray/tabs/tab-btm-inactive-left-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-over .x-tab-left {\n\tbackground-image: url(../images/gray/tabs/tab-btm-over-left-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-over .x-tab-right {\n\tbackground-image: url(../images/gray/tabs/tab-btm-over-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-right {\n\tbackground-image: url(../images/gray/tabs/tab-btm-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-left {\n\tbackground-image: url(../images/gray/tabs/tab-btm-left-bg.gif);\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close {\n\tbackground-image:url(../images/gray/tabs/tab-close.gif);\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close:hover{\n\tbackground-image:url(../images/gray/tabs/tab-close.gif);\n}\n\n.x-tab-panel-body {\n    border-color:#d0d0d0;\n    background-color:#fff;\n}\n\n.x-tab-panel-body-top {\n    border-top: 0 none;\n}\n\n.x-tab-panel-body-bottom {\n    border-bottom: 0 none;\n}\n\n.x-tab-scroller-left {\n    background-image:url(../images/gray/tabs/scroll-left.gif);\n    border-bottom-color:#d0d0d0;\n}\n\n.x-tab-scroller-left-over {\n    background-position: 0 0;\n}\n\n.x-tab-scroller-left-disabled {\n    background-position: -18px 0;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n    cursor:default;\n}\n\n.x-tab-scroller-right {\n    background-image:url(../images/gray/tabs/scroll-right.gif);\n    border-bottom-color:#d0d0d0;\n}\n\n.x-tab-panel-bbar .x-toolbar, .x-tab-panel-tbar .x-toolbar {\n    border-color:#d0d0d0;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/toolbar.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-toolbar{\n\tborder-color:#d0d0d0;\n    background-color:#f0f0f0;\n    background-image:url(../images/gray/toolbar/bg.gif);\n}\n\n.x-toolbar td,.x-toolbar span,.x-toolbar input,.x-toolbar div,.x-toolbar select,.x-toolbar label{\n    font:normal 11px arial,tahoma, helvetica, sans-serif;\n}\n\n.x-toolbar .x-item-disabled {\n\tcolor:gray;\n}\n\n.x-toolbar .x-item-disabled * {\n\tcolor:gray;\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split {\n    background-image:url(../images/default/button/s-arrow-noline.gif);\n}\n\n.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-click .x-btn-mc em.x-btn-split, \n.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split \n{\n    background-image:url(../images/gray/button/s-arrow-o.gif);\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/default/button/s-arrow-b-noline.gif);\n}\n\n.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-click .x-btn-mc em.x-btn-split-bottom, \n.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split-bottom \n{\n    background-image:url(../images/gray/button/s-arrow-bo.gif);\n}\n\n.x-toolbar .xtb-sep {\n\tbackground-image: url(../images/default/grid/grid-split.gif);\n}\n\n.x-tbar-page-first{\n\tbackground-image: url(../images/gray/grid/page-first.gif) !important;\n}\n\n.x-tbar-loading{\n\tbackground-image: url(../images/gray/grid/refresh.gif) !important;\n}\n\n.x-tbar-page-last{\n\tbackground-image: url(../images/gray/grid/page-last.gif) !important;\n}\n\n.x-tbar-page-next{\n\tbackground-image: url(../images/gray/grid/page-next.gif) !important;\n}\n\n.x-tbar-page-prev{\n\tbackground-image: url(../images/gray/grid/page-prev.gif) !important;\n}\n\n.x-item-disabled .x-tbar-loading{\n\tbackground-image: url(../images/default/grid/loading.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-first{\n\tbackground-image: url(../images/default/grid/page-first-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-last{\n\tbackground-image: url(../images/default/grid/page-last-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-next{\n\tbackground-image: url(../images/default/grid/page-next-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-prev{\n\tbackground-image: url(../images/default/grid/page-prev-disabled.gif) !important;\n}\n\n.x-paging-info {\n    color:#444;\n}\n\n.x-toolbar-more-icon {\n    background-image: url(../images/gray/toolbar/more.gif) !important;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/tree.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-tree-node-expanded .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/folder-open.gif);\n}\n\n.x-tree-node-leaf .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/leaf.gif);\n}\n\n.x-tree-node-collapsed .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/folder.gif);\n}\n\n.x-tree-node-loading .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/loading.gif) !important;\n}\n\n.x-tree-node .x-tree-node-inline-icon {\n    background-image: none;\n}\n\n.x-tree-node-loading a span{\n\t font-style: italic;\n\t color:#444444;\n}\n\n.ext-ie .x-tree-node-el input {\n    width:15px;\n    height:15px;\n}\n\n.x-tree-lines .x-tree-elbow{\n\tbackground-image:url(../images/default/tree/elbow.gif);\n}\n\n.x-tree-lines .x-tree-elbow-plus{\n\tbackground-image:url(../images/default/tree/elbow-plus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-minus{\n\tbackground-image:url(../images/default/tree/elbow-minus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end{\n\tbackground-image:url(../images/default/tree/elbow-end.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end-plus{\n\tbackground-image:url(../images/gray/tree/elbow-end-plus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end-minus{\n\tbackground-image:url(../images/gray/tree/elbow-end-minus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-line{\n\tbackground-image:url(../images/default/tree/elbow-line.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-plus{\n\tbackground-image:url(../images/default/tree/elbow-plus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-minus{\n\tbackground-image:url(../images/default/tree/elbow-minus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-end-plus{\n\tbackground-image:url(../images/gray/tree/elbow-end-plus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-end-minus{\n\tbackground-image:url(../images/gray/tree/elbow-end-minus-nl.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-plus{\n    background-image:url(../images/gray/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-minus{\n    background-image:url(../images/gray/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-end-plus{\n    background-image:url(../images/gray/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-end-minus{\n    background-image:url(../images/gray/tree/arrows.gif);\n}\n\n.x-tree-node{\n\tcolor:#000;\n\tfont: normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-tree-node a, .x-dd-drag-ghost a{\n\tcolor:#000;\n}\n\n.x-tree-node a span, .x-dd-drag-ghost a span{\n\tcolor:#000;\n}\n\n.x-tree-node .x-tree-node-disabled a span{\n\tcolor:gray !important;\n}\n\n.x-tree-node div.x-tree-drag-insert-below{\n \t border-bottom-color:#36c;\n}\n\n.x-tree-node div.x-tree-drag-insert-above{\n\t border-top-color:#36c;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below a{\n \t border-bottom-color:#36c;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above a{\n\t border-top-color:#36c;\n}\n\n.x-tree-node .x-tree-drag-append a span{\n\t background-color:#ddd;\n\t border-color:gray;\n}\n\n.x-tree-node .x-tree-node-over {\n\tbackground-color: #eee;\n}\n\n.x-tree-node .x-tree-selected {\n\tbackground-color: #ddd;\n}\n\n.x-tree-drop-ok-append .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-add.gif);\n}\n\n.x-tree-drop-ok-above .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-over.gif);\n}\n\n.x-tree-drop-ok-below .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-under.gif);\n}\n\n.x-tree-drop-ok-between .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-between.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/theme-gray/window.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-window-proxy {\n    background-color:#fcfcfc;\n    border-color:#d0d0d0;\n}\n\n.x-window-tl .x-window-header {\n    color:#555;\n\tfont:bold 11px tahoma,arial,verdana,sans-serif;\n}\n\n.x-window-tc {\n\tbackground-image: url(../images/gray/window/top-bottom.png);\n}\n\n.x-window-tl {\n\tbackground-image: url(../images/gray/window/left-corners.png);\n}\n\n.x-window-tr {\n\tbackground-image: url(../images/gray/window/right-corners.png);\n}\n\n.x-window-bc {\n\tbackground-image: url(../images/gray/window/top-bottom.png);\n}\n\n.x-window-bl {\n\tbackground-image: url(../images/gray/window/left-corners.png);\n}\n\n.x-window-br {\n\tbackground-image: url(../images/gray/window/right-corners.png);\n}\n\n.x-window-mc {\n    border-color:#d0d0d0;\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n    background-color:#e8e8e8;\n}\n\n.x-window-ml {\n\tbackground-image: url(../images/gray/window/left-right.png);\n}\n\n.x-window-mr {\n\tbackground-image: url(../images/gray/window/left-right.png);\n}\n\n.x-window-maximized .x-window-tc {\n    background-color:#fff;\n}\n\n.x-window-bbar .x-toolbar {\n    border-top-color:#d0d0d0;\n}\n\n.x-panel-ghost .x-window-tl {\n    border-bottom-color:#d0d0d0;\n}\n\n.x-panel-collapsed .x-window-tl {\n    border-bottom-color:#d0d0d0;\n}\n\n.x-dlg-mask{\n   background-color:#ccc;\n}\n\n.x-window-plain .x-window-mc {\n    background-color: #E8E8E8;\n    border-color: #D0D0D0 #EEEEEE #EEEEEE #D0D0D0;\n}\n\n.x-window-plain .x-window-body {\n    border-color: #EEEEEE #D0D0D0 #D0D0D0 #EEEEEE;\n}\n\nbody.x-body-masked .x-window-plain .x-window-mc {\n    background-color: #E4E4E4;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/visual/borders.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-panel-noborder .x-panel-header-noborder {\n    border-bottom-color:#99bbe8;\n}\n\n.x-panel-noborder .x-panel-tbar-noborder .x-toolbar {\n    border-bottom-color:#99bbe8;\n}\n\n.x-panel-noborder .x-panel-bbar-noborder .x-toolbar {\n    border-top-color:#99bbe8;\n}\n\n.x-tab-panel-bbar-noborder .x-toolbar {\n    border-top-color:#99bbe8;\n}\n\n.x-tab-panel-tbar-noborder .x-toolbar {\n    border-bottom-color:#99bbe8;\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/box.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-box-tl {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-tc {\n\tbackground-image: url(../images/default/box/tb.gif);\n}\n\n.x-box-tr {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-ml {\n\tbackground-image: url(../images/default/box/l.gif);\n}\n\n.x-box-mc {\n\tbackground-color: #eee;\n    background-image: url(../images/default/box/tb.gif);\n\tfont-family: \"Myriad Pro\",\"Myriad Web\",\"Tahoma\",\"Helvetica\",\"Arial\",sans-serif;\n\tcolor: #393939;\n\tfont-size: 12px;\n}\n\n.x-box-mc h3 {\n\tfont-size: 14px;\n\tfont-weight: bold;\n}\n\n.x-box-mr {\n\tbackground-image: url(../images/default/box/r.gif);\n}\n\n.x-box-bl {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-bc {\n\tbackground-image: url(../images/default/box/tb.gif);\n}\n\n.x-box-br {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-blue .x-box-bl, .x-box-blue .x-box-br, .x-box-blue .x-box-tl, .x-box-blue .x-box-tr {\n\tbackground-image: url(../images/default/box/corners-blue.gif);\n}\n\n.x-box-blue .x-box-bc, .x-box-blue .x-box-mc, .x-box-blue .x-box-tc {\n\tbackground-image: url(../images/default/box/tb-blue.gif);\n}\n\n.x-box-blue .x-box-mc {\n\tbackground-color: #c3daf9;\n}\n\n.x-box-blue .x-box-mc h3 {\n\tcolor: #17385b;\n}\n\n.x-box-blue .x-box-ml {\n\tbackground-image: url(../images/default/box/l-blue.gif);\n}\n\n.x-box-blue .x-box-mr {\n\tbackground-image: url(../images/default/box/r-blue.gif);\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/button.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-btn{\n\tfont:normal 11px tahoma, verdana, helvetica;\n}\n\n.x-btn button{\n    font:normal 11px arial,tahoma,verdana,helvetica;\n    color:#333;\n}\n\n.x-btn em {\n    font-style:normal;\n    font-weight:normal;\n}\n\n.x-btn-tl, .x-btn-tr, .x-btn-tc, .x-btn-ml, .x-btn-mr, .x-btn-mc, .x-btn-bl, .x-btn-br, .x-btn-bc{\n\tbackground-image:url(../images/default/button/btn.gif);\n}\n\n.x-btn-click .x-btn-text, .x-btn-menu-active .x-btn-text, .x-btn-pressed .x-btn-text{\n    color:#000;\n}\n\n.x-btn-disabled *{\n\tcolor:gray !important;\n}\n\n.x-btn-mc em.x-btn-arrow {\n    background-image:url(../images/default/button/arrow.gif);\n}\n\n.x-btn-mc em.x-btn-split {\n    background-image:url(../images/default/button/s-arrow.gif);\n}\n\n.x-btn-over .x-btn-mc em.x-btn-split, .x-btn-click .x-btn-mc em.x-btn-split, .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-btn-pressed .x-btn-mc em.x-btn-split {\n    background-image:url(../images/default/button/s-arrow-o.gif);\n}\n\n.x-btn-mc em.x-btn-arrow-bottom {\n    background-image:url(../images/default/button/s-arrow-b-noline.gif);\n}\n\n.x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/default/button/s-arrow-b.gif);\n}\n\n.x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-btn-click .x-btn-mc em.x-btn-split-bottom, .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-btn-pressed .x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/default/button/s-arrow-bo.gif);\n}\n\n.x-btn-group-header {\n    color: #3e6aaa;\n}\n\n.x-btn-group-tc {\n\tbackground-image: url(../images/default/button/group-tb.gif);\n}\n\n.x-btn-group-tl {\n\tbackground-image: url(../images/default/button/group-cs.gif);\n}\n\n.x-btn-group-tr {\n\tbackground-image: url(../images/default/button/group-cs.gif);\n}\n\n.x-btn-group-bc {\n\tbackground-image: url(../images/default/button/group-tb.gif);\n}\n\n.x-btn-group-bl {\n\tbackground-image: url(../images/default/button/group-cs.gif);\n}\n\n.x-btn-group-br {\n\tbackground-image: url(../images/default/button/group-cs.gif);\n}\n\n.x-btn-group-ml {\n\tbackground-image: url(../images/default/button/group-lr.gif);\n}\n.x-btn-group-mr {\n\tbackground-image: url(../images/default/button/group-lr.gif);\n}\n\n.x-btn-group-notitle .x-btn-group-tc {\n\tbackground-image: url(../images/default/button/group-tb.gif);\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/combo.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-combo-list {\n    border-color:#98c0f4;\n    background-color:#ddecfe;\n    font:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-combo-list-inner {\n    background-color:#fff;\n}\n\n.x-combo-list-hd {\n    font:bold 11px tahoma, arial, helvetica, sans-serif;\n    color:#15428b;\n    background-image: url(../images/default/layout/panel-title-light-bg.gif);\n    border-bottom-color:#98c0f4;\n}\n\n.x-resizable-pinned .x-combo-list-inner {\n    border-bottom-color:#98c0f4;\n}\n\n.x-combo-list-item {\n    border-color:#fff;\n}\n\n.x-combo-list .x-combo-selected{\n\tborder-color:#a3bae9 !important;\n    background-color:#dfe8f6;\n}\n\n.x-combo-list .x-toolbar {\n    border-top-color:#98c0f4;\n}\n\n.x-combo-list-small {\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/core.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.ext-el-mask {\n    background-color: #ccc;\n}\n\n.ext-el-mask-msg {\n    border-color:#6593cf;\n    background-color:#c3daf9;\n    background-image:url(../images/default/box/tb-blue.gif);\n}\n.ext-el-mask-msg div {\n    background-color: #eee;\n    border-color:#a3bad9;\n    color:#222;\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-mask-loading div {\n    background-color:#fbfbfb;\n    background-image:url(../images/default/grid/loading.gif);\n}\n\n.x-item-disabled {\n    color: gray;\n}\n\n.x-item-disabled * {\n    color: gray !important;\n}\n\n.x-splitbar-proxy {\n    background-color: #aaa;\n}\n\n.x-color-palette a {\n    border-color:#fff;\n}\n\n.x-color-palette a:hover, .x-color-palette a.x-color-palette-sel {\n    border-color:#8bb8f3;\n    background-color: #deecfd;\n}\n\n/*\n.x-color-palette em:hover, .x-color-palette span:hover{   \n    background-color: #deecfd;\n}\n*/\n\n.x-color-palette em {\n    border-color:#aca899;\n}\n\n.x-ie-shadow {\n    background-color:#777;\n}\n\n.x-shadow .xsmc {\n    background-image: url(../images/default/shadow-c.png);\n}\n\n.x-shadow .xsml, .x-shadow .xsmr {\n    background-image: url(../images/default/shadow-lr.png);\n}\n\n.x-shadow .xstl, .x-shadow .xstc,  .x-shadow .xstr, .x-shadow .xsbl, .x-shadow .xsbc, .x-shadow .xsbr{\n    background-image: url(../images/default/shadow.png);\n}\n\n.loading-indicator {\n    font-size: 11px;\n    background-image: url(../images/default/grid/loading.gif);\n}\n\n.x-spotlight {\n    background-color: #ccc;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/visual/date-picker.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-date-picker {\n    border-color: #1b376c;\n    background-color:#fff;\n}\n\n.x-date-middle,.x-date-left,.x-date-right {\n\tbackground-image: url(../images/default/shared/hd-sprite.gif);\n\tcolor:#fff;\n\tfont:bold 11px \"sans serif\", tahoma, verdana, helvetica;\n}\n\n.x-date-middle .x-btn .x-btn-text {\n    color:#fff;\n}\n\n.x-date-middle .x-btn-mc em.x-btn-arrow {\n    background-image:url(../images/default/toolbar/btn-arrow-light.gif);\n}\n\n.x-date-right a {\n    background-image: url(../images/default/shared/right-btn.gif);\n}\n\n.x-date-left a{\n\tbackground-image: url(../images/default/shared/left-btn.gif);\n}\n\n.x-date-inner th {\n    background-color:#dfecfb;\n    background-image:url(../images/default/shared/glass-bg.gif);\n\tborder-bottom-color:#a3bad9;\n    font:normal 10px arial, helvetica,tahoma,sans-serif;\n\tcolor:#233d6d;\n}\n\n.x-date-inner td {\n    border-color:#fff;\n}\n\n.x-date-inner a {\n    font:normal 11px arial, helvetica,tahoma,sans-serif;\n    color:#000;\n}\n\n.x-date-inner .x-date-active{\n\tcolor:#000;\n}\n\n.x-date-inner .x-date-selected a{\n    background-color:#dfecfb;\n\tbackground-image:url(../images/default/shared/glass-bg.gif);\n\tborder-color:#8db2e3;\n}\n\n.x-date-inner .x-date-today a{\n\tborder-color:darkred;\n}\n\n.x-date-inner .x-date-selected span{\n    font-weight:bold;\n}\n\n.x-date-inner .x-date-prevday a,.x-date-inner .x-date-nextday a {\n\tcolor:#aaa;\n}\n\n.x-date-bottom {\n    border-top-color:#a3bad9;\n    background-color:#dfecfb;\n    background-image:url(../images/default/shared/glass-bg.gif);\n}\n\n.x-date-inner a:hover, .x-date-inner .x-date-disabled a:hover{\n    color:#000;\n    background-color:#ddecfe;\n}\n\n.x-date-inner .x-date-disabled a {\n\tbackground-color:#eee;\n\tcolor:#bbb;\n}\n\n.x-date-mmenu{\n    background-color:#eee !important;\n}\n\n.x-date-mmenu .x-menu-item {\n\tfont-size:10px;\n\tcolor:#000;\n}\n\n.x-date-mp {\n\tbackground-color:#fff;\n}\n\n.x-date-mp td {\n\tfont:normal 11px arial, helvetica,tahoma,sans-serif;\n}\n\n.x-date-mp-btns button {\n\tbackground-color:#083772;\n\tcolor:#fff;\n\tborder-color: #3366cc #000055 #000055 #3366cc;\n\tfont:normal 11px arial, helvetica,tahoma,sans-serif;\n}\n\n.x-date-mp-btns {\n    background-color: #dfecfb;\n\tbackground-image: url(../images/default/shared/glass-bg.gif);\n}\n\n.x-date-mp-btns td {\n\tborder-top-color: #c5d2df;\n}\n\ntd.x-date-mp-month a,td.x-date-mp-year a {\n\tcolor:#15428b;\n}\n\ntd.x-date-mp-month a:hover,td.x-date-mp-year a:hover {\n\tcolor:#15428b;\n\tbackground-color: #ddecfe;\n}\n\ntd.x-date-mp-sel a {\n    background-color: #dfecfb;\n\tbackground-image: url(../images/default/shared/glass-bg.gif);\n\tborder-color:#8db2e3;\n}\n\n.x-date-mp-ybtn a {\n    background-image:url(../images/default/panel/tool-sprites.gif);\n}\n\ntd.x-date-mp-sep {\n   border-right-color:#c5d2df;\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/dd.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-dd-drag-ghost{\n\tcolor:#000;\n\tfont: normal 11px arial, helvetica, sans-serif;\n    border-color: #ddd #bbb #bbb #ddd;\n\tbackground-color:#fff;\n}\n\n.x-dd-drop-nodrop .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-no.gif);\n}\n\n.x-dd-drop-ok .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-yes.gif);\n}\n\n.x-dd-drop-ok-add .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-add.gif);\n}\n\n.x-view-selector {\n    background-color:#c3daf9;\n    border-color:#3399bb;\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/debug.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n#x-debug-browser .x-tree .x-tree-node a span {\n    color:#222297;\n    font-size:11px;\n    font-family:\"monotype\",\"courier new\",sans-serif;\n}\n\n#x-debug-browser .x-tree a i {\n    color:#ff4545;\n    font-style:normal;\n}\n\n#x-debug-browser .x-tree a em {\n    color:#999;\n}\n\n#x-debug-browser .x-tree .x-tree-node .x-tree-selected a span{\n    background-color:#c3daf9;\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/dialog.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-window-dlg .ext-mb-text,\n.x-window-dlg .x-window-header-text {\n    font-size:12px;\n}\n\n.x-window-dlg .ext-mb-textarea {\n    font:normal 12px tahoma,arial,helvetica,sans-serif;\n}\n\n.x-window-dlg .x-msg-box-wait {\n    background-image:url(../images/default/grid/loading.gif);\n}\n\n.x-window-dlg .ext-mb-info {\n    background-image:url(../images/default/window/icon-info.gif);\n}\n\n.x-window-dlg .ext-mb-warning {\n    background-image:url(../images/default/window/icon-warning.gif);\n}\n\n.x-window-dlg .ext-mb-question {\n    background-image:url(../images/default/window/icon-question.gif);\n}\n\n.x-window-dlg .ext-mb-error {\n    background-image:url(../images/default/window/icon-error.gif);\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/editor.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-html-editor-wrap {\n    border-color:#a9bfd3;\n    background-color:#fff;\n}\n.x-html-editor-tb .x-btn-text {\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/form.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-form-field {\n    font:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-text, textarea.x-form-field {\n    background-color:#fff;\n    background-image:url(../images/default/form/text-bg.gif);\n    border-color:#b5b8c8;\n}\n\n.x-form-select-one {\n    background-color:#fff;\n    border-color:#b5b8c8;\n}\n\n.x-form-check-group-label {\n    border-bottom: 1px solid #99bbe8;\n    color: #15428b;\n}\n\n.x-editor .x-form-check-wrap {\n    background-color:#fff;\n}\n\n.x-form-field-wrap .x-form-trigger {\n    background-image:url(../images/default/form/trigger.gif);\n    border-bottom-color:#b5b8c8;\n}\n\n.x-form-field-wrap .x-form-date-trigger {\n    background-image: url(../images/default/form/date-trigger.gif);\n}\n\n.x-form-field-wrap .x-form-clear-trigger {\n    background-image: url(../images/default/form/clear-trigger.gif);\n}\n\n.x-form-field-wrap .x-form-search-trigger {\n    background-image: url(../images/default/form/search-trigger.gif);\n}\n\n.x-trigger-wrap-focus .x-form-trigger {\n    border-bottom-color:#7eadd9;\n}\n\n.x-item-disabled .x-form-trigger-over {\n    border-bottom-color:#b5b8c8;\n}\n\n.x-item-disabled .x-form-trigger-click {\n    border-bottom-color:#b5b8c8;\n}\n\n.x-form-focus, textarea.x-form-focus {\n\tborder-color:#7eadd9;\n}\n\n.x-form-invalid, textarea.x-form-invalid {\n    background-color:#fff;\n\tbackground-image:url(../images/default/grid/invalid_line.gif);\n\tborder-color:#c30;\n}\n\n.x-form-invalid.x-form-composite {\n    border: none;\n    background-image: none;\n}\n\n.x-form-invalid.x-form-composite .x-form-invalid {\n    background-color:#fff;\n\tbackground-image:url(../images/default/grid/invalid_line.gif);\n\tborder-color:#c30;\n}\n\n.x-form-inner-invalid, textarea.x-form-inner-invalid {\n    background-color:#fff;\n\tbackground-image:url(../images/default/grid/invalid_line.gif);\n}\n\n.x-form-grow-sizer {\n\tfont:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-item {\n    font:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-invalid-msg {\n    color:#c0272b;\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n    background-image:url(../images/default/shared/warning.gif);\n}\n\n.x-form-empty-field {\n    color:gray;\n}\n\n.x-small-editor .x-form-field {\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.ext-webkit .x-small-editor .x-form-field {\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-form-invalid-icon {\n    background-image:url(../images/default/form/exclamation.gif);\n}\n\n.x-fieldset {\n    border-color:#b5b8c8;\n}\n\n.x-fieldset legend {\n    font:bold 11px tahoma, arial, helvetica, sans-serif;\n    color:#15428b;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/visual/grid.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-grid3 {\n    background-color:#fff;\n}\n\n.x-grid-panel .x-panel-mc .x-panel-body {\n    border-color:#99bbe8;\n}\n\n.x-grid3-row td, .x-grid3-summary-row td{\n\tfont:normal 11px/13px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-grid3-hd-row td {\n\tfont:normal 11px/15px arial, tahoma, helvetica, sans-serif;\n}\n\n\n.x-grid3-hd-row td {\n    border-left-color:#eee;\n    border-right-color:#d0d0d0;\n}\n\n.x-grid-row-loading {\n    background-color: #fff;\n    background-image:url(../images/default/shared/loading-balls.gif);\n}\n\n.x-grid3-row {\n    border-color:#ededed;\n    border-top-color:#fff;\n}\n\n.x-grid3-row-alt{\n\tbackground-color:#fafafa;\n}\n\n.x-grid3-row-over {\n\tborder-color:#ddd;\n    background-color:#efefef;\n    background-image:url(../images/default/grid/row-over.gif);\n}\n\n.x-grid3-resize-proxy {\n    background-color:#777;\n}\n\n.x-grid3-resize-marker {\n    background-color:#777;\n}\n\n.x-grid3-header{\n    background-color:#f9f9f9;\n\tbackground-image:url(../images/default/grid/grid3-hrow.gif);\n}\n\n.x-grid3-header-pop {\n    border-left-color:#d0d0d0;\n}\n\n.x-grid3-header-pop-inner {\n    border-left-color:#eee;\n    background-image:url(../images/default/grid/hd-pop.gif);\n}\n\ntd.x-grid3-hd-over, td.sort-desc, td.sort-asc, td.x-grid3-hd-menu-open {\n    border-left-color:#aaccf6;\n    border-right-color:#aaccf6;\n}\n\ntd.x-grid3-hd-over .x-grid3-hd-inner, td.sort-desc .x-grid3-hd-inner, td.sort-asc .x-grid3-hd-inner, td.x-grid3-hd-menu-open .x-grid3-hd-inner {\n    background-color:#ebf3fd;\n    background-image:url(../images/default/grid/grid3-hrow-over.gif);\n\n}\n\n.sort-asc .x-grid3-sort-icon {\n\tbackground-image: url(../images/default/grid/sort_asc.gif);\n}\n\n.sort-desc .x-grid3-sort-icon {\n\tbackground-image: url(../images/default/grid/sort_desc.gif);\n}\n\n.x-grid3-cell-text, .x-grid3-hd-text {\n\tcolor:#000;\n}\n\n.x-grid3-split {\n\tbackground-image: url(../images/default/grid/grid-split.gif);\n}\n\n.x-grid3-hd-text {\n\tcolor:#15428b;\n}\n\n.x-dd-drag-proxy .x-grid3-hd-inner{\n    background-color:#ebf3fd;\n\tbackground-image:url(../images/default/grid/grid3-hrow-over.gif);\n\tborder-color:#aaccf6;\n}\n\n.col-move-top{\n\tbackground-image:url(../images/default/grid/col-move-top.gif);\n}\n\n.col-move-bottom{\n\tbackground-image:url(../images/default/grid/col-move-bottom.gif);\n}\n\ntd.grid-hd-group-cell {\n    background: url(../images/default/grid/grid3-hrow.gif) repeat-x bottom;\n}\n\n.x-grid3-row-selected {\n\tbackground-color: #dfe8f6 !important;\n\tbackground-image: none;\n\tborder-color:#a3bae9;\n}\n\n.x-grid3-cell-selected{\n\tbackground-color: #b8cfee !important;\n\tcolor:#000;\n}\n\n.x-grid3-cell-selected span{\n\tcolor:#000 !important;\n}\n\n.x-grid3-cell-selected .x-grid3-cell-text{\n\tcolor:#000;\n}\n\n.x-grid3-locked td.x-grid3-row-marker, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker{\n    background-color:#ebeadb !important;\n    background-image:url(../images/default/grid/grid-hrow.gif) !important;\n    color:#000;\n    border-top-color:#fff;\n    border-right-color:#6fa0df !important;\n}\n\n.x-grid3-locked td.x-grid3-row-marker div, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker div{\n    color:#15428b !important;\n}\n\n.x-grid3-dirty-cell {\n    background-image:url(../images/default/grid/dirty.gif);\n}\n\n.x-grid3-topbar, .x-grid3-bottombar{\n\tfont:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-grid3-bottombar .x-toolbar{\n\tborder-top-color:#a9bfd3;\n}\n\n.x-props-grid .x-grid3-td-name .x-grid3-cell-inner{\n\tbackground-image:url(../images/default/grid/grid3-special-col-bg.gif) !important;\n    color:#000 !important;\n}\n\n.x-props-grid .x-grid3-body .x-grid3-td-name{\n    background-color:#fff !important;\n    border-right-color:#eee;\n}\n\n.xg-hmenu-sort-asc .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-asc.gif);\n}\n\n.xg-hmenu-sort-desc .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-desc.gif);\n}\n\n.xg-hmenu-lock .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-lock.gif);\n}\n\n.xg-hmenu-unlock .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-unlock.gif);\n}\n\n.x-grid3-hd-btn {\n    background-color:#c3daf9;\n    background-image:url(../images/default/grid/grid3-hd-btn.gif);\n}\n\n.x-grid3-body .x-grid3-td-expander {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-row-expander {\n    background-image:url(../images/default/grid/row-expand-sprite.gif);\n}\n\n.x-grid3-body .x-grid3-td-checker {\n    background-image: url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-row-checker, .x-grid3-hd-checker {\n    background-image:url(../images/default/grid/row-check-sprite.gif);\n}\n\n.x-grid3-body .x-grid3-td-numberer {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-body .x-grid3-td-numberer .x-grid3-cell-inner {\n\tcolor:#444;\n}\n\n.x-grid3-body .x-grid3-td-row-icon {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-numberer,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-checker,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-expander {\n\tbackground-image:url(../images/default/grid/grid3-special-col-sel-bg.gif);\n}\n\n.x-grid3-check-col {\n\tbackground-image:url(../images/default/menu/unchecked.gif);\n}\n\n.x-grid3-check-col-on {\n\tbackground-image:url(../images/default/menu/checked.gif);\n}\n\n.x-grid-group, .x-grid-group-body, .x-grid-group-hd {\n    zoom:1;\n}\n\n.x-grid-group-hd {\n    border-bottom-color:#99bbe8;\n}\n\n.x-grid-group-hd div.x-grid-group-title {\n    background-image:url(../images/default/grid/group-collapse.gif);\n    color:#3764a0;\n    font:bold 11px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-grid-group-collapsed .x-grid-group-hd div.x-grid-group-title {\n    background-image:url(../images/default/grid/group-expand.gif);\n}\n\n.x-group-by-icon {\n    background-image:url(../images/default/grid/group-by.gif);\n}\n\n.x-cols-icon {\n    background-image:url(../images/default/grid/columns.gif);\n}\n\n.x-show-groups-icon {\n    background-image:url(../images/default/grid/group-by.gif);\n}\n\n.x-grid-empty {\n    color:gray;\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-grid-with-col-lines .x-grid3-row td.x-grid3-cell {\n    border-right-color:#ededed;\n}\n\n.x-grid-with-col-lines .x-grid3-row-selected {\n\tborder-top-color:#a3bae9;\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/layout.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-border-layout-ct {\n    background-color:#dfe8f6;\n}\n\n.x-accordion-hd {\n\tcolor:#222;\n    font-weight:normal;\n    background-image: url(../images/default/panel/light-hd.gif);\n}\n\n.x-layout-collapsed{\n    background-color:#d2e0f2;\n\tborder-color:#98c0f4;\n}\n\n.x-layout-collapsed-over{\n    background-color:#d9e8fb;\n}\n\n.x-layout-split-west .x-layout-mini {\n    background-image:url(../images/default/layout/mini-left.gif);\n}\n.x-layout-split-east .x-layout-mini {\n    background-image:url(../images/default/layout/mini-right.gif);\n}\n.x-layout-split-north .x-layout-mini {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n.x-layout-split-south .x-layout-mini {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n\n.x-layout-cmini-west .x-layout-mini {\n    background-image:url(../images/default/layout/mini-right.gif);\n}\n\n.x-layout-cmini-east .x-layout-mini {\n    background-image:url(../images/default/layout/mini-left.gif);\n}\n\n.x-layout-cmini-north .x-layout-mini {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n\n.x-layout-cmini-south .x-layout-mini {\n    background-image:url(../images/default/layout/mini-top.gif);\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/list-view.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-list-header{\n    background-color:#f9f9f9;\n\tbackground-image:url(../images/default/grid/grid3-hrow.gif);\n}\n\n.x-list-header-inner div em {\n    border-left-color:#ddd;\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-list-body dt em {\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-list-over {\n    background-color:#eee;\n}\n\n.x-list-selected {\n    background-color:#dfe8f6;\n}\n\n.x-list-resizer {\n    border-left-color:#555;\n    border-right-color:#555;\n}\n\n.x-list-header-inner em.sort-asc, .x-list-header-inner em.sort-desc {\n    background-image:url(../images/default/grid/sort-hd.gif);\n    border-color: #99bbe8;\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/menu.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-menu {\n    background-color:#f0f0f0;\n\tbackground-image:url(../images/default/menu/menu.gif);\n}\n\n.x-menu-floating{\n    border-color:#718bb7;\n}\n\n.x-menu-nosep {\n\tbackground-image:none;\n}\n\n.x-menu-list-item{\n\tfont:normal 11px arial,tahoma,sans-serif;\n}\n\n.x-menu-item-arrow{\n\tbackground-image:url(../images/default/menu/menu-parent.gif);\n}\n\n.x-menu-sep {\n    background-color:#e0e0e0;\n\tborder-bottom-color:#fff;\n}\n\na.x-menu-item {\n\tcolor:#222;\n}\n\n.x-menu-item-active {\n    background-image: url(../images/default/menu/item-over.gif);\n\tbackground-color: #dbecf4;\n    border-color:#aaccf6;\n}\n\n.x-menu-item-active a.x-menu-item {\n\tborder-color:#aaccf6;\n}\n\n.x-menu-check-item .x-menu-item-icon{\n\tbackground-image:url(../images/default/menu/unchecked.gif);\n}\n\n.x-menu-item-checked .x-menu-item-icon{\n\tbackground-image:url(../images/default/menu/checked.gif);\n}\n\n.x-menu-item-checked .x-menu-group-item .x-menu-item-icon{\n    background-image:url(../images/default/menu/group-checked.gif);\n}\n\n.x-menu-group-item .x-menu-item-icon{\n    background-image:none;\n}\n\n.x-menu-plain {\n\tbackground-color:#f0f0f0 !important;\n    background-image: none;\n}\n\n.x-date-menu, .x-color-menu{\n    background-color: #fff !important;\n}\n\n.x-menu .x-date-picker{\n    border-color:#a3bad9;\n}\n\n.x-cycle-menu .x-menu-item-checked {\n    border-color:#a3bae9 !important;\n    background-color:#def8f6;\n}\n\n.x-menu-scroller-top {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n\n.x-menu-scroller-bottom {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/visual/panel.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-panel {\n    border-color: #99bbe8;\n}\n\n.x-panel-header {\n    color:#15428b;\n\tfont-weight:bold; \n    font-size: 11px;\n    font-family: tahoma,arial,verdana,sans-serif;\n    border-color:#99bbe8;\n    background-image: url(../images/default/panel/white-top-bottom.gif);\n}\n\n.x-panel-body {\n    border-color:#99bbe8;\n    background-color:#fff;\n}\n\n.x-panel-bbar .x-toolbar, .x-panel-tbar .x-toolbar {\n    border-color:#99bbe8;\n}\n\n.x-panel-tbar-noheader .x-toolbar, .x-panel-mc .x-panel-tbar .x-toolbar {\n    border-top-color:#99bbe8;\n}\n\n.x-panel-body-noheader, .x-panel-mc .x-panel-body {\n    border-top-color:#99bbe8;\n}\n\n.x-panel-tl .x-panel-header {\n    color:#15428b;\n\tfont:bold 11px tahoma,arial,verdana,sans-serif;\n}\n\n.x-panel-tc {\n\tbackground-image: url(../images/default/panel/top-bottom.gif);\n}\n\n.x-panel-tl, .x-panel-tr, .x-panel-bl,  .x-panel-br{\n\tbackground-image: url(../images/default/panel/corners-sprite.gif);\n    border-bottom-color:#99bbe8;\n}\n\n.x-panel-bc {\n\tbackground-image: url(../images/default/panel/top-bottom.gif);\n}\n\n.x-panel-mc {\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n    background-color:#dfe8f6;\n}\n\n.x-panel-ml {\n\tbackground-color: #fff;\n    background-image:url(../images/default/panel/left-right.gif);\n}\n\n.x-panel-mr {\n\tbackground-image: url(../images/default/panel/left-right.gif);\n}\n\n.x-tool {\n    background-image:url(../images/default/panel/tool-sprites.gif);\n}\n\n.x-panel-ghost {\n    background-color:#cbddf3;\n}\n\n.x-panel-ghost ul {\n    border-color:#99bbe8;\n}\n\n.x-panel-dd-spacer {\n    border-color:#99bbe8;\n}\n\n.x-panel-fbar td,.x-panel-fbar span,.x-panel-fbar input,.x-panel-fbar div,.x-panel-fbar select,.x-panel-fbar label{\n    font:normal 11px arial,tahoma, helvetica, sans-serif;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/visual/pivotgrid.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-pivotgrid .x-grid3-header-offset table td {\n    background: url(../images/default/grid/grid3-hrow.gif) repeat-x 50% 100%;\n    border-left: 1px solid;\n    border-right: 1px solid;\n    border-left-color: #EEE;\n    border-right-color: #D0D0D0;\n}\n\n.x-pivotgrid .x-grid3-row-headers {\n    background-color: #f9f9f9;\n}\n\n.x-pivotgrid .x-grid3-row-headers table td {\n    background: #EEE url(../images/default/grid/grid3-rowheader.gif) repeat-x left top;\n    border-left: 1px solid;\n    border-right: 1px solid;\n    border-left-color: #EEE;\n    border-right-color: #D0D0D0;\n    border-bottom: 1px solid;\n    border-bottom-color: #D0D0D0;\n    height: 18px;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/visual/progress.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-progress-wrap {\n    border-color:#6593cf;\n}\n\n.x-progress-inner {\n    background-color:#e0e8f3;\n    background-image:url(../images/default/qtip/bg.gif);\n}\n\n.x-progress-bar {\n    background-color:#9cbfee;\n    background-image:url(../images/default/progress/progress-bg.gif);\n    border-top-color:#d1e4fd;\n    border-bottom-color:#7fa9e4;\n    border-right-color:#7fa9e4;\n}\n\n.x-progress-text {\n    font-size:11px;\n    font-weight:bold;\n    color:#fff;\n}\n\n.x-progress-text-back {\n    color:#396095;\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/qtips.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-tip .x-tip-close{\n\tbackground-image: url(../images/default/qtip/close.gif);\n}\n\n.x-tip .x-tip-tc, .x-tip .x-tip-tl, .x-tip .x-tip-tr, .x-tip .x-tip-bc, .x-tip .x-tip-bl, .x-tip .x-tip-br, .x-tip .x-tip-ml, .x-tip .x-tip-mr {\n\tbackground-image: url(../images/default/qtip/tip-sprite.gif);\n}\n\n.x-tip .x-tip-mc {\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n}\n.x-tip .x-tip-ml {\n\tbackground-color: #fff;\n}\n\n.x-tip .x-tip-header-text {\n    font: bold 11px tahoma,arial,helvetica,sans-serif;\n    color:#444;\n}\n\n.x-tip .x-tip-body {\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n    color:#444;\n}\n\n.x-form-invalid-tip .x-tip-tc, .x-form-invalid-tip .x-tip-tl, .x-form-invalid-tip .x-tip-tr, .x-form-invalid-tip .x-tip-bc,\n.x-form-invalid-tip .x-tip-bl, .x-form-invalid-tip .x-tip-br, .x-form-invalid-tip .x-tip-ml, .x-form-invalid-tip .x-tip-mr\n{\n\tbackground-image: url(../images/default/form/error-tip-corners.gif);\n}\n\n.x-form-invalid-tip .x-tip-body {\n    background-image:url(../images/default/form/exclamation.gif);\n}\n\n.x-tip-anchor {\n    background-image:url(../images/default/qtip/tip-anchor-sprite.gif);\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/resizable.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-resizable-handle {\n\tbackground-color:#fff;\n}\n\n.x-resizable-over .x-resizable-handle-east, .x-resizable-pinned .x-resizable-handle-east,\n.x-resizable-over .x-resizable-handle-west, .x-resizable-pinned .x-resizable-handle-west\n{\n    background-image:url(../images/default/sizer/e-handle.gif);\n}\n\n.x-resizable-over .x-resizable-handle-south, .x-resizable-pinned .x-resizable-handle-south,\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north\n{\n    background-image:url(../images/default/sizer/s-handle.gif);\n}\n\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north{\n    background-image:url(../images/default/sizer/s-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-southeast, .x-resizable-pinned .x-resizable-handle-southeast{\n    background-image:url(../images/default/sizer/se-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-northwest, .x-resizable-pinned .x-resizable-handle-northwest{\n    background-image:url(../images/default/sizer/nw-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-northeast, .x-resizable-pinned .x-resizable-handle-northeast{\n    background-image:url(../images/default/sizer/ne-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-southwest, .x-resizable-pinned .x-resizable-handle-southwest{\n    background-image:url(../images/default/sizer/sw-handle.gif);\n}\n.x-resizable-proxy{\n    border-color:#3b5a82;\n}\n.x-resizable-overlay{\n    background-color:#fff;\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/visual/slider.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-slider-horz, .x-slider-horz .x-slider-end, .x-slider-horz .x-slider-inner {\n    background-image:url(../images/default/slider/slider-bg.png);\n}\n\n.x-slider-horz .x-slider-thumb {\n    background-image:url(../images/default/slider/slider-thumb.png);\n}\n\n.x-slider-vert, .x-slider-vert .x-slider-end, .x-slider-vert .x-slider-inner {\n    background-image:url(../images/default/slider/slider-v-bg.png);\n}\n\n.x-slider-vert .x-slider-thumb {\n    background-image:url(../images/default/slider/slider-v-thumb.png);\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/tabs.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-tab-panel-header, .x-tab-panel-footer {\n\tbackground-color: #deecfd;\n\tborder-color:#8db2e3;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tab-panel-header, .x-tab-panel-footer {\n\tborder-color:#8db2e3;\n}\n\nul.x-tab-strip-top{\n    background-color:#cedff5;\n\tbackground-image: url(../images/default/tabs/tab-strip-bg.gif);\n\tborder-bottom-color:#8db2e3;\n}\n\nul.x-tab-strip-bottom{\n    background-color:#cedff5;\n\tbackground-image: url(../images/default/tabs/tab-strip-btm-bg.gif);\n\tborder-top-color:#8db2e3;\n}\n\n.x-tab-panel-header-plain .x-tab-strip-spacer,\n.x-tab-panel-footer-plain .x-tab-strip-spacer {\n    border-color:#8db2e3;\n    background-color: #deecfd;\n}\n\n.x-tab-strip span.x-tab-strip-text {\n\tfont:normal 11px tahoma,arial,helvetica;\n\tcolor:#416aa3;\n}\n\n.x-tab-strip-over span.x-tab-strip-text {\n\tcolor:#15428b;\n}\n\n.x-tab-strip-active span.x-tab-strip-text {\n\tcolor:#15428b;\n    font-weight:bold;\n}\n\n.x-tab-strip-disabled .x-tabs-text {\n\tcolor:#aaaaaa;\n}\n\n.x-tab-strip-top .x-tab-right, .x-tab-strip-top .x-tab-left, .x-tab-strip-top .x-tab-strip-inner{\n\tbackground-image: url(../images/default/tabs/tabs-sprite.gif);\n}\n\n.x-tab-strip-bottom .x-tab-right {\n\tbackground-image: url(../images/default/tabs/tab-btm-inactive-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-left {\n\tbackground-image: url(../images/default/tabs/tab-btm-inactive-left-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-over .x-tab-right {\n\tbackground-image: url(../images/default/tabs/tab-btm-over-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-over .x-tab-left {\n\tbackground-image: url(../images/default/tabs/tab-btm-over-left-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-right {\n\tbackground-image: url(../images/default/tabs/tab-btm-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-left {\n\tbackground-image: url(../images/default/tabs/tab-btm-left-bg.gif);\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close {\n\tbackground-image:url(../images/default/tabs/tab-close.gif);\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close:hover{\n\tbackground-image:url(../images/default/tabs/tab-close.gif);\n}\n\n.x-tab-panel-body {\n    border-color:#8db2e3;\n    background-color:#fff;\n}\n\n.x-tab-panel-body-top {\n    border-top: 0 none;\n}\n\n.x-tab-panel-body-bottom {\n    border-bottom: 0 none;\n}\n\n.x-tab-scroller-left {\n    background-image:url(../images/default/tabs/scroll-left.gif);\n    border-bottom-color:#8db2e3;\n}\n\n.x-tab-scroller-left-over {\n    background-position: 0 0;\n}\n\n.x-tab-scroller-left-disabled {\n    background-position: -18px 0;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n    cursor:default;\n}\n\n.x-tab-scroller-right {\n    background-image:url(../images/default/tabs/scroll-right.gif);\n    border-bottom-color:#8db2e3;\n}\n\n.x-tab-panel-bbar .x-toolbar, .x-tab-panel-tbar .x-toolbar {\n    border-color:#99bbe8;\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/toolbar.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-toolbar{\n\tborder-color:#a9bfd3;\n    background-color:#d0def0;\n    background-image:url(../images/default/toolbar/bg.gif);\n}\n\n.x-toolbar td,.x-toolbar span,.x-toolbar input,.x-toolbar div,.x-toolbar select,.x-toolbar label{\n    font:normal 11px arial,tahoma, helvetica, sans-serif;\n}\n\n.x-toolbar .x-item-disabled {\n\tcolor:gray;\n}\n\n.x-toolbar .x-item-disabled * {\n\tcolor:gray;\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split {\n    background-image:url(../images/default/button/s-arrow-noline.gif);\n}\n\n.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-click .x-btn-mc em.x-btn-split,\n.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split\n{\n    background-image:url(../images/default/button/s-arrow-o.gif);\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/default/button/s-arrow-b-noline.gif);\n}\n\n.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-click .x-btn-mc em.x-btn-split-bottom,\n.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split-bottom\n{\n    background-image:url(../images/default/button/s-arrow-bo.gif);\n}\n\n.x-toolbar .xtb-sep {\n\tbackground-image: url(../images/default/grid/grid-blue-split.gif);\n}\n\n.x-tbar-page-first{\n\tbackground-image: url(../images/default/grid/page-first.gif) !important;\n}\n\n.x-tbar-loading{\n\tbackground-image: url(../images/default/grid/refresh.gif) !important;\n}\n\n.x-tbar-page-last{\n\tbackground-image: url(../images/default/grid/page-last.gif) !important;\n}\n\n.x-tbar-page-next{\n\tbackground-image: url(../images/default/grid/page-next.gif) !important;\n}\n\n.x-tbar-page-prev{\n\tbackground-image: url(../images/default/grid/page-prev.gif) !important;\n}\n\n.x-item-disabled .x-tbar-loading{\n\tbackground-image: url(../images/default/grid/refresh-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-first{\n\tbackground-image: url(../images/default/grid/page-first-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-last{\n\tbackground-image: url(../images/default/grid/page-last-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-next{\n\tbackground-image: url(../images/default/grid/page-next-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-prev{\n\tbackground-image: url(../images/default/grid/page-prev-disabled.gif) !important;\n}\n\n.x-paging-info {\n    color:#444;\n}\n\n.x-toolbar-more-icon {\n    background-image: url(../images/default/toolbar/more.gif) !important;\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/tree.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-tree-node-expanded .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/folder-open.gif);\n}\n\n.x-tree-node-leaf .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/leaf.gif);\n}\n\n.x-tree-node-collapsed .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/folder.gif);\n}\n\n.x-tree-node-loading .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/loading.gif) !important;\n}\n\n.x-tree-node .x-tree-node-inline-icon {\n    background-image: none;\n}\n\n.x-tree-node-loading a span{\n\t font-style: italic;\n\t color:#444444;\n}\n\n.x-tree-lines .x-tree-elbow{\n\tbackground-image:url(../images/default/tree/elbow.gif);\n}\n\n.x-tree-lines .x-tree-elbow-plus{\n\tbackground-image:url(../images/default/tree/elbow-plus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-minus{\n\tbackground-image:url(../images/default/tree/elbow-minus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end{\n\tbackground-image:url(../images/default/tree/elbow-end.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end-plus{\n\tbackground-image:url(../images/default/tree/elbow-end-plus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end-minus{\n\tbackground-image:url(../images/default/tree/elbow-end-minus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-line{\n\tbackground-image:url(../images/default/tree/elbow-line.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-plus{\n\tbackground-image:url(../images/default/tree/elbow-plus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-minus{\n\tbackground-image:url(../images/default/tree/elbow-minus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-end-plus{\n\tbackground-image:url(../images/default/tree/elbow-end-plus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-end-minus{\n\tbackground-image:url(../images/default/tree/elbow-end-minus-nl.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-plus{\n    background-image:url(../images/default/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-minus{\n    background-image:url(../images/default/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-end-plus{\n    background-image:url(../images/default/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-end-minus{\n    background-image:url(../images/default/tree/arrows.gif);\n}\n\n.x-tree-node{\n\tcolor:#000;\n\tfont: normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-tree-node a, .x-dd-drag-ghost a{\n\tcolor:#000;\n}\n\n.x-tree-node a span, .x-dd-drag-ghost a span{\n\tcolor:#000;\n}\n\n.x-tree-node .x-tree-node-disabled a span{\n\tcolor:gray !important;\n}\n\n.x-tree-node div.x-tree-drag-insert-below{\n \t border-bottom-color:#36c;\n}\n\n.x-tree-node div.x-tree-drag-insert-above{\n\t border-top-color:#36c;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below a{\n \t border-bottom-color:#36c;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above a{\n\t border-top-color:#36c;\n}\n\n.x-tree-node .x-tree-drag-append a span{\n\t background-color:#ddd;\n\t border-color:gray;\n}\n\n.x-tree-node .x-tree-node-over {\n\tbackground-color: #eee;\n}\n\n.x-tree-node .x-tree-selected {\n\tbackground-color: #d9e8fb;\n}\n\n.x-tree-drop-ok-append .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-add.gif);\n}\n\n.x-tree-drop-ok-above .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-over.gif);\n}\n\n.x-tree-drop-ok-below .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-under.gif);\n}\n\n.x-tree-drop-ok-between .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-between.gif);\n}"
  },
  {
    "path": "client/src/ext/resources/css/visual/window.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-window-proxy {\n    background-color:#c7dffc;\n    border-color:#99bbe8;\n}\n\n.x-window-tl .x-window-header {\n    color:#15428b;\n\tfont:bold 11px tahoma,arial,verdana,sans-serif;\n}\n\n.x-window-tc {\n\tbackground-image: url(../images/default/window/top-bottom.png);\n}\n\n.x-window-tl {\n\tbackground-image: url(../images/default/window/left-corners.png);\n}\n\n.x-window-tr {\n\tbackground-image: url(../images/default/window/right-corners.png);\n}\n\n.x-window-bc {\n\tbackground-image: url(../images/default/window/top-bottom.png);\n}\n\n.x-window-bl {\n\tbackground-image: url(../images/default/window/left-corners.png);\n}\n\n.x-window-br {\n\tbackground-image: url(../images/default/window/right-corners.png);\n}\n\n.x-window-mc {\n    border-color:#99bbe8;\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n    background-color:#dfe8f6;\n}\n\n.x-window-ml {\n\tbackground-image: url(../images/default/window/left-right.png);\n}\n\n.x-window-mr {\n\tbackground-image: url(../images/default/window/left-right.png);\n}\n\n.x-window-maximized .x-window-tc {\n    background-color:#fff;\n}\n\n.x-window-bbar .x-toolbar {\n    border-top-color:#99bbe8;\n}\n\n.x-panel-ghost .x-window-tl {\n    border-bottom-color:#99bbe8;\n}\n\n.x-panel-collapsed .x-window-tl {\n    border-bottom-color:#84a0c4;\n}\n\n.x-dlg-mask{\n   background-color:#ccc;\n}\n\n.x-window-plain .x-window-mc {\n    background-color: #ccd9e8;\n    border-color: #a3bae9 #dfe8f6 #dfe8f6 #a3bae9;\n}\n\n.x-window-plain .x-window-body {\n    border-color: #dfe8f6 #a3bae9 #a3bae9 #dfe8f6;\n}\n\nbody.x-body-masked .x-window-plain .x-window-mc {\n    background-color: #ccd9e8;\n}"
  },
  {
    "path": "client/src/ext/resources/css/xtheme-access.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nbody {\n\tbackground-color:#16181a;\n\tcolor:#fcfcfc;\n}\n\n.ext-el-mask {\n    background-color: #ccc;\n}\n\n.ext-el-mask-msg {\n    border-color:#223;\n    background-color:#3f4757;\n    background-image:url(../images/access/box/tb-blue.gif);\n}\n.ext-el-mask-msg div {\n    background-color: #232d38;\n    border-color:#556;\n    color:#fff;\n    font:normal 14px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-mask-loading div {\n    background-color:#232d38;\n    background-image:url(../images/access/grid/loading.gif);\n}\n\n.x-item-disabled {\n    color: #ddd;\n}\n\n.x-item-disabled * {\n    color: #ddd !important;\n}\n\n.x-splitbar-proxy {\n    background-color: #aaa;\n}\n\n.x-color-palette a {\n    border-color:#fff;\n}\n\n.x-color-palette a:hover, .x-color-palette a.x-color-palette-sel {\n    border-color:#8bb8f3;\n    background-color: #deecfd;\n}\n\n.x-color-palette em {\n    border-color:#aca899;\n}\n\n.x-ie-shadow {\n    background-color:#777;\n}\n\n.x-shadow .xsmc {\n    background-image: url(../images/default/shadow-c.png);\n}\n\n.x-shadow .xsml, .x-shadow .xsmr {\n    background-image: url(../images/default/shadow-lr.png);\n}\n\n.x-shadow .xstl, .x-shadow .xstc,  .x-shadow .xstr, .x-shadow .xsbl, .x-shadow .xsbc, .x-shadow .xsbr{\n    background-image: url(../images/default/shadow.png);\n}\n\n.loading-indicator {\n    font-size: 14px;\n    background-image: url(../images/access/grid/loading.gif);\n}\n\n.x-spotlight {\n    background-color: #ccc;\n}.x-tab-panel-header, .x-tab-panel-footer {\n\tbackground-color:#e18325;\n\tborder-color:#8db2e3;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tab-panel-header, .x-tab-panel-footer {\n\tborder-color:#222;\n}\n\nul.x-tab-strip-top{\n    background-color:#343843;\n\tbackground-image: url(../images/access/tabs/tab-strip-bg.gif);\n\tborder-bottom-color:#343d4e;\n}\n\nul.x-tab-strip-bottom{\n    background-color:#343843;\n\tbackground-image: url(../images/access/tabs/tab-strip-btm-bg.gif);\n\tborder-top-color:#343843;\n}\n\n.x-tab-panel-header-plain .x-tab-strip-spacer,\n.x-tab-panel-footer-plain .x-tab-strip-spacer {\n    border-color:#222;\n    background-color:#e18325;\n}\n\n.x-tab-strip span.x-tab-strip-text {\n\tfont:normal 14px tahoma,arial,helvetica;\n\tcolor:#fff;\n}\n\n.x-tab-strip-over span.x-tab-strip-text {\n\tcolor:#fff;\n}\n\n.x-tab-strip-active span.x-tab-strip-text {\n\tcolor:#fff;\n    font-weight:bold;\n}\n\n.x-tab-strip-disabled .x-tabs-text {\n\tcolor:#aaaaaa;\n}\n\n.x-tab-strip-top .x-tab-right, .x-tab-strip-top .x-tab-left, .x-tab-strip-top .x-tab-strip-inner{\n\tbackground-image: url(../images/access/tabs/tabs-sprite.gif);\n}\n\n.x-tab-strip-bottom .x-tab-right {\n\tbackground-image: url(../images/access/tabs/tab-btm-inactive-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-left {\n\tbackground-image: url(../images/access/tabs/tab-btm-inactive-left-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-right {\n\tbackground-image: url(../images/access/tabs/tab-btm-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-left {\n\tbackground-image: url(../images/access/tabs/tab-btm-left-bg.gif);\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close {\n\tbackground-image:url(../images/access/tabs/tab-close.gif);\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close:hover{\n\tbackground-image:url(../images/access/tabs/tab-close.gif);\n}\n\n.x-tab-panel-body {\n    border-color:#18181a;\n    background-color:#fff;\n}\n\n.x-tab-panel-body-top {\n    border-top: 0 none;\n}\n\n.x-tab-panel-body-bottom {\n    border-bottom: 0 none;\n}\n\n.x-tab-scroller-left {\n    background-image:url(../images/access/tabs/scroll-left.gif);\n    border-bottom-color:#8db2e3;\n}\n\n.x-tab-scroller-left-over {\n    background-position: 0 0;\n}\n\n.x-tab-scroller-left-disabled {\n    background-position: -18px 0;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n    cursor:default;\n}\n\n.x-tab-scroller-right {\n    background-image:url(../images/access/tabs/scroll-right.gif);\n    border-bottom-color:#8db2e3;\n}\n\n.x-tab-panel-bbar .x-toolbar, .x-tab-panel-tbar .x-toolbar {\n    border-color:#99bbe8;\n}\n.x-form-field {\n    font:normal 15px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-text, textarea.x-form-field{\n    color: #ffffff;\n    background-color:#33373d;\n    background-image:url(../images/access/form/text-bg.gif);\n    border-color:#737b8c;\n    border-width:2px;\n}\n\n.ext-webkit .x-form-text, .ext-webkit textarea.x-form-field{\n    border-width:2px;\n}\n\n.x-form-text, .ext-ie .x-form-file {\n    height:26px;\n}\n\n.ext-strict .x-form-text {\n    height:20px;\n}\n\n.x-form-select-one {\n    background-color:#fff;\n    border-color:#b5b8c8;\n}\n\n.x-form-check-group-label {\n    border-bottom: 1px solid #99bbe8;\n    color: #fff;\n}\n\n.x-editor .x-form-check-wrap {\n    background-color:#fff;\n}\n\n.x-form-field-wrap .x-form-trigger{\n    background-image:url(../images/access/form/trigger.gif);\n    border-bottom-color:#737b8c;\n    border-bottom-width:2px;\n    height:24px;\n    width:20px;\n}\n\n.x-form-field-wrap .x-form-trigger.x-form-trigger-over{\n    border-bottom-color:#d97e27;\n}\n\n.x-form-field-wrap .x-form-trigger.x-form-trigger-click{\n    border-bottom-color:#c86e19;\n}\n\n.x-small-editor .x-form-field-wrap .x-form-trigger {\n    height:24px;\n}\n\n.x-form-field-wrap .x-form-trigger-over {\n    background-position:-20px 0;\n}\n\n.x-form-field-wrap .x-form-trigger-click {\n    background-position:-40px 0;\n}\n\n.x-trigger-wrap-focus .x-form-trigger {\n    background-position:-60px 0;\n}\n\n.x-trigger-wrap-focus .x-form-trigger-over {\n    background-position:-80px 0;\n}\n\n.x-trigger-wrap-focus .x-form-trigger-click {\n    background-position:-100px 0;\n}\n\n.x-form-field-wrap .x-form-date-trigger{\n    background-image: url(../images/access/form/date-trigger.gif);\n}\n\n.x-form-field-wrap .x-form-clear-trigger{\n    background-image: url(../images/access/form/clear-trigger.gif);\n}\n\n.x-form-field-wrap .x-form-search-trigger{\n    background-image: url(../images/access/form/search-trigger.gif);\n}\n\n.x-trigger-wrap-focus .x-form-trigger{\n    border-bottom-color:#737b8c;\n}\n\n.x-item-disabled .x-form-trigger-over{\n    border-bottom-color:#b5b8c8;\n}\n\n.x-item-disabled .x-form-trigger-click{\n    border-bottom-color:#b5b8c8;\n}\n\n.x-form-focus, textarea.x-form-focus{\n\tborder-color:#ff9c33;\n}\n\n.x-form-invalid, textarea.x-form-invalid,\n.ext-webkit .x-form-invalid, .ext-webkit textarea.x-form-invalid{\n    background-color:#15171a;\n\tbackground-image:url(../images/access/grid/invalid_line.gif);\n\tborder-color:#c30;\n}\n\n/*\n.ext-safari .x-form-invalid{\n\tbackground-color:#fee;\n\tborder-color:#ff7870;\n}\n*/\n\n.x-form-inner-invalid, textarea.x-form-inner-invalid{\n    background-color:#fff;\n\tbackground-image:url(../images/access/grid/invalid_line.gif);\n}\n\n.x-form-grow-sizer {\n\tfont:normal 15px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-item {\n    font:normal 15px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-invalid-msg {\n    color:#c0272b;\n    font:normal 14px tahoma, arial, helvetica, sans-serif;\n    background-image:url(../images/default/shared/warning.gif);\n}\n\n.x-form-empty-field {\n    color:#dadadd;\n}\n\n.x-small-editor .x-form-text {\n    height: 26px;\n}\n\n.x-small-editor .x-form-field {\n    font:normal 14px arial, tahoma, helvetica, sans-serif;\n}\n\n.ext-safari .x-small-editor .x-form-field {\n    font:normal 15px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-form-invalid-icon {\n    background-image:url(../images/access/form/exclamation.gif);\n    height:25px;\n    width:19px;\n    background-position:center right;\n}\n\n.x-fieldset {\n    border-color:#737B8C;\n}\n\n.x-fieldset legend {\n    font:bold 14px tahoma, arial, helvetica, sans-serif;\n    color:#fff;\n}\n.x-btn {\n\tfont:normal 14px tahoma, verdana, helvetica;\n}\n\n.x-btn button {\n    font:normal 14px arial,tahoma,verdana,helvetica;\n    color:#fffffa;\n    padding-left:6px !important;\n    padding-right:6px !important;\n}\n\n.x-btn-over .x-btn button{\n    color:#fff;\n}\n\n.x-btn-noicon .x-btn-small .x-btn-text, .x-btn-text-icon .x-btn-icon-small-left .x-btn-text,\n.x-btn-icon .x-btn-small .x-btn-text, .x-btn-text-icon .x-btn-icon-small-right .x-btn-text {\n    height:18px;\n}\n\n.x-btn-icon .x-btn-small .x-btn-text {\n    width:18px;\n}\n\n.x-btn-text-icon .x-btn-icon-small-left .x-btn-text {\n    padding-left:21px !important;\n}\n\n.x-btn-text-icon .x-btn-icon-small-right .x-btn-text {\n    padding-right:21px !important;\n}\n\n.x-btn-text-icon .x-btn-icon-medium-left .x-btn-text {\n    padding-left:29px !important;\n}\n\n.x-btn-text-icon .x-btn-icon-medium-right .x-btn-text {\n    padding-right:29px !important;\n}\n\n.x-btn-text-icon .x-btn-icon-large-left .x-btn-text {\n    padding-left:37px !important;\n}\n\n.x-btn-text-icon .x-btn-icon-large-right .x-btn-text {\n    padding-right:37px !important;\n}\n\n.x-btn em {\n    font-style:normal;\n    font-weight:normal;\n}\n\n.x-btn-tl, .x-btn-tr, .x-btn-tc, .x-btn-ml, .x-btn-mr, .x-btn-mc, .x-btn-bl, .x-btn-br, .x-btn-bc{\n\tbackground-image:url(../images/access/button/btn.gif);\n}\n\n.x-btn-click .x-btn-text, .x-btn-menu-active .x-btn-text, .x-btn-pressed .x-btn-text{\n    color:#fff;\n}\n\n.x-btn-disabled *{\n\tcolor:#eee !important;\n}\n\n.x-btn-mc em.x-btn-arrow {\n    background-image:url(../images/access/button/arrow.gif);\n    padding-right:13px;\n}\n\n.x-btn-mc em.x-btn-split {\n    background-image:url(../images/access/button/s-arrow.gif);\n    padding-right:20px;\n}\n\n.x-btn-over .x-btn-mc em.x-btn-split, .x-btn-click .x-btn-mc em.x-btn-split, .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-btn-pressed .x-btn-mc em.x-btn-split {\n    background-image:url(../images/access/button/s-arrow-o.gif);\n}\n\n.x-btn-mc em.x-btn-arrow-bottom {\n    background-image:url(../images/access/button/s-arrow-b-noline.gif);\n}\n\n.x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/access/button/s-arrow-b.gif);\n}\n\n.x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-btn-click .x-btn-mc em.x-btn-split-bottom, .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-btn-pressed .x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/access/button/s-arrow-bo.gif);\n}\n\n.x-btn-group-header {\n    color: #d2d2d2;\n}\n\n.x-btn-group-tc {\n\tbackground-image: url(../images/access/button/group-tb.gif);\n}\n\n.x-btn-group-tl {\n\tbackground-image: url(../images/access/button/group-cs.gif);\n}\n\n.x-btn-group-tr {\n\tbackground-image: url(../images/access/button/group-cs.gif);\n}\n\n.x-btn-group-bc {\n\tbackground-image: url(../images/access/button/group-tb.gif);\n}\n\n.x-btn-group-bl {\n\tbackground-image: url(../images/access/button/group-cs.gif);\n}\n\n.x-btn-group-br {\n\tbackground-image: url(../images/access/button/group-cs.gif);\n}\n\n.x-btn-group-ml {\n\tbackground-image: url(../images/access/button/group-lr.gif);\n}\n\n.x-btn-group-mr {\n\tbackground-image: url(../images/access/button/group-lr.gif);\n}\n\n.x-btn-group-notitle .x-btn-group-tc {\n\tbackground-image: url(../images/access/button/group-tb.gif);\n}\n.x-toolbar{\n\tborder-color:#18181a;\n    background-color:#393d4e;\n    background-image:url(../images/access/toolbar/bg.gif);\n}\n\n.x-toolbar td,.x-toolbar span,.x-toolbar input,.x-toolbar div,.x-toolbar select,.x-toolbar label{\n    font:normal 14px arial,tahoma, helvetica, sans-serif;\n}\n\n.x-toolbar .x-item-disabled {\n\tcolor:gray;\n}\n\n.x-toolbar .x-item-disabled * {\n\tcolor:gray;\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split {\n    background-image:url(../images/access/button/s-arrow-noline.gif);\n}\n\n.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-click .x-btn-mc em.x-btn-split, \n.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split \n{\n    background-image:url(../images/access/button/s-arrow-o.gif);\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/access/button/s-arrow-b-noline.gif);\n}\n\n.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-click .x-btn-mc em.x-btn-split-bottom, \n.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split-bottom \n{\n    background-image:url(../images/access/button/s-arrow-bo.gif);\n}\n\n.x-toolbar .xtb-sep {\n\tbackground-image: url(../images/access/grid/grid-blue-split.gif);\n}\n\n.x-toolbar .x-btn {\n    padding-left:3px;\n    padding-right:3px;\n}\n\n.x-toolbar .x-btn-mc em.x-btn-arrow {\n    padding-right:10px;\n}\n\n.x-toolbar .x-btn-text-icon .x-btn-icon-small-left .x-btn-text {\n    padding-left:18px !important;\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split {\n    padding-right:14px;\n}\n\n.x-tbar-page-first{\n\tbackground-image: url(../images/access/grid/page-first.gif) !important;\n}\n\n.x-tbar-loading{\n\tbackground-image: url(../images/access/grid/refresh.gif) !important;\n}\n\n.x-tbar-page-last{\n\tbackground-image: url(../images/access/grid/page-last.gif) !important;\n}\n\n.x-tbar-page-next{\n\tbackground-image: url(../images/access/grid/page-next.gif) !important;\n}\n\n.x-tbar-page-prev{\n\tbackground-image: url(../images/access/grid/page-prev.gif) !important;\n}\n\n.x-item-disabled .x-tbar-loading{\n\tbackground-image: url(../images/access/grid/loading.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-first{\n\tbackground-image: url(../images/access/grid/page-first-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-last{\n\tbackground-image: url(../images/access/grid/page-last-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-next{\n\tbackground-image: url(../images/access/grid/page-next-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-prev{\n\tbackground-image: url(../images/access/grid/page-prev-disabled.gif) !important;\n}\n\n.x-paging-info {\n    color:#444;\n}\n\n.x-toolbar-more-icon {\n    background-image: url(../images/access/toolbar/more.gif) !important;\n}\n\n.x-statusbar .x-status-busy {\n    background-image: url(../images/access/grid/loading.gif);\n}\n\n.x-statusbar .x-status-text-panel {\n    border-color: #99bbe8 #fff #fff #99bbe8;\n}\n.x-resizable-handle {\n\tbackground-color:#fff;\n\tcolor: #000;\n}\n\n.x-resizable-over .x-resizable-handle-east, .x-resizable-pinned .x-resizable-handle-east,\n.x-resizable-over .x-resizable-handle-west, .x-resizable-pinned .x-resizable-handle-west\n{\n    background-image:url(../images/access/sizer/e-handle.gif);\n}\n\n.x-resizable-over .x-resizable-handle-south, .x-resizable-pinned .x-resizable-handle-south,\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north\n{\n    background-image:url(../images/access/sizer/s-handle.gif);\n}\n\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north{\n    background-image:url(../images/access/sizer/s-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-southeast, .x-resizable-pinned .x-resizable-handle-southeast{\n    background-image:url(../images/access/sizer/se-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-northwest, .x-resizable-pinned .x-resizable-handle-northwest{\n    background-image:url(../images/access/sizer/nw-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-northeast, .x-resizable-pinned .x-resizable-handle-northeast{\n    background-image:url(../images/access/sizer/ne-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-southwest, .x-resizable-pinned .x-resizable-handle-southwest{\n    background-image:url(../images/access/sizer/sw-handle.gif);\n}\n.x-resizable-proxy{\n    border-color:#3b5a82;\n}\n.x-resizable-overlay{\n    background-color:#fff;\n}\n.x-grid3 {\n    background-color:#1f2933;\n}\n\n.x-grid-panel .x-panel-mc .x-panel-body {\n    border-color:#223;\n}\n\n.x-grid3-hd-row td, .x-grid3-row td, .x-grid3-summary-row td{\n\tfont:normal 14px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-grid3-hd-row td {\n    border-left-color:#556;\n    border-right-color:#223;\n}\n\n.x-grid-row-loading {\n    background-color: #fff;\n    background-image:url(../images/default/shared/loading-balls.gif);\n}\n\n.x-grid3-row {\n    border:0 none;\n    border-bottom:1px solid #111;\n    border-right:1px solid #1a1a1c;\n}\n\n.x-grid3-row-alt{\n\tbackground-color:#1b232b;\n}\n\n.x-grid3-row-over {\n    background-color:#7e5530;\n}\n\n.x-grid3-resize-proxy {\n    background-color:#777;\n}\n\n.x-grid3-resize-marker {\n    background-color:#777;\n}\n\n.x-grid3-header{\n    background-color:#3b3f50;\n\tbackground-image:url(../images/access/grid/grid3-hrow.gif);\n}\n\n.x-grid3-header-pop {\n    border-left-color:#d0d0d0;\n}\n\n.x-grid3-header-pop-inner {\n    border-left-color:#eee;\n    background-image:url(../images/default/grid/hd-pop.gif);\n}\n\ntd.x-grid3-hd-over, td.sort-desc, td.sort-asc, td.x-grid3-hd-menu-open {\n    border-left-color:#889;\n    border-right-color:#445;\n}\n\ntd.x-grid3-hd-over .x-grid3-hd-inner, td.sort-desc .x-grid3-hd-inner, td.sort-asc .x-grid3-hd-inner, td.x-grid3-hd-menu-open .x-grid3-hd-inner {\n    background-color:#4e628a;\n    background-image:url(../images/access/grid/grid3-hrow-over.gif);\n}\n\n.x-grid3-cell-inner, .x-grid3-hd-inner {\n    color:#fff;\n}\n\n.sort-asc .x-grid3-sort-icon {\n\tbackground-image: url(../images/access/grid/sort_asc.gif);\n\twidth:15px;\n\theight:9px;\n\tmargin-left:5px;\n}\n\n.sort-desc .x-grid3-sort-icon {\n\tbackground-image: url(../images/access/grid/sort_desc.gif);\n\twidth:15px;\n\theight:9px;\n\tmargin-left:5px;\n}\n\n.x-grid3-cell-text, .x-grid3-hd-text {\n\tcolor:#fff;\n}\n\n.x-grid3-split {\n\tbackground-image: url(../images/default/grid/grid-split.gif);\n}\n\n.x-grid3-hd-text {\n\tcolor:#fff;\n}\n\n.x-dd-drag-proxy .x-grid3-hd-inner{\n    background-color:#ebf3fd;\n\tbackground-image:url(../images/access/grid/grid3-hrow-over.gif);\n\tborder-color:#aaccf6;\n}\n\n.col-move-top{\n\tbackground-image:url(../images/default/grid/col-move-top.gif);\n}\n\n.col-move-bottom{\n\tbackground-image:url(../images/default/grid/col-move-bottom.gif);\n}\n\n.x-grid3-row-selected {\n\tbackground-color: #e5872c !important;\n\tbackground-image: none;\n\tborder-style: solid;\n}\n\n.x-grid3-row-selected .x-grid3-cell {\n    color: #fff;\n}\n\n.x-grid3-cell-selected {\n\tbackground-color: #ffa340 !important;\n\tcolor:#fff;\n}\n\n.x-grid3-cell-selected span{\n\tcolor:#fff !important;\n}\n\n.x-grid3-cell-selected .x-grid3-cell-text{\n\tcolor:#fff;\n}\n\n.x-grid3-locked td.x-grid3-row-marker, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker{\n    background-color:#ebeadb !important;\n    background-image:url(../images/default/grid/grid-hrow.gif) !important;\n    color:#fff;\n    border-top-color:#fff;\n    border-right-color:#6fa0df !important;\n}\n\n.x-grid3-locked td.x-grid3-row-marker div, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker div{\n    color:#fff !important;\n}\n\n.x-grid3-dirty-cell {\n    background-image:url(../images/access/grid/dirty.gif);\n}\n\n.x-grid3-topbar, .x-grid3-bottombar{\n\tfont:normal 14px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-grid3-bottombar .x-toolbar{\n\tborder-top-color:#a9bfd3;\n}\n\n.x-props-grid .x-grid3-td-name .x-grid3-cell-inner{\n\tbackground-image:url(../images/access/grid/grid3-special-col-bg.gif) !important;\n    color:#fff !important;\n}\n.x-props-grid .x-grid3-td-value {\n    color:#fff !important;\n}\n\n.x-props-grid .x-grid3-body .x-grid3-td-name{\n    background-color:#263240 !important;\n    border-right-color:#223;\n}\n\n.xg-hmenu-sort-asc .x-menu-item-icon{\n\tbackground-image: url(../images/access/grid/hmenu-asc.gif);\n}\n\n.xg-hmenu-sort-desc .x-menu-item-icon{\n\tbackground-image: url(../images/access/grid/hmenu-desc.gif);\n}\n\n.xg-hmenu-lock .x-menu-item-icon{\n\tbackground-image: url(../images/access/grid/hmenu-lock.gif);\n}\n\n.xg-hmenu-unlock .x-menu-item-icon{\n\tbackground-image: url(../images/access/grid/hmenu-unlock.gif);\n}\n\n.x-grid3-hd-btn {\n    background-color:#c2c9d0;\n    background-image:url(../images/access/grid/grid3-hd-btn.gif);\n}\n\n.x-grid3-body .x-grid3-td-expander {\n    background-image:url(../images/access/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-row-expander {\n    background-image:url(../images/access/grid/row-expand-sprite.gif);\n}\n\n.x-grid3-body .x-grid3-td-checker {\n    background-image: url(../images/access/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-row-checker, .x-grid3-hd-checker {\n    background-image:url(../images/default/grid/row-check-sprite.gif);\n}\n\n.x-grid3-body .x-grid3-td-numberer {\n    background-image:url(../images/access/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-body .x-grid3-td-numberer .x-grid3-cell-inner {\n\tcolor:#fff;\n}\n\n.x-grid3-body .x-grid3-td-row-icon {\n    background-image:url(../images/access/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-numberer,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-checker,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-expander {\n\tbackground-image:url(../images/access/grid/grid3-special-col-sel-bg.gif);\n}\n\n.x-grid3-check-col {\n\tbackground-image:url(../images/default/menu/unchecked.gif);\n}\n\n.x-grid3-check-col-on {\n\tbackground-image:url(../images/default/menu/checked.gif);\n}\n\n.x-grid-group, .x-grid-group-body, .x-grid-group-hd {\n    zoom:1;\n}\n\n.x-grid-group-hd {\n    border-bottom-color:#4e628a;\n}\n\n.x-grid-group-hd div.x-grid-group-title {\n    background-image:url(../images/access/grid/group-collapse.gif);\n    background-position:3px 6px;\n    color:#ffd;\n    font:bold 14px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-grid-group-collapsed .x-grid-group-hd div.x-grid-group-title {\n    background-image:url(../images/access/grid/group-expand.gif);\n}\n\n.x-group-by-icon {\n    background-image:url(../images/default/grid/group-by.gif);\n}\n\n.x-cols-icon {\n    background-image:url(../images/default/grid/columns.gif);\n}\n\n.x-show-groups-icon {\n    background-image:url(../images/default/grid/group-by.gif);\n}\n\n.x-grid-empty {\n    color:gray;\n    font:normal 14px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-grid-with-col-lines .x-grid3-row td.x-grid3-cell {\n    border-right-color:#ededed;\n}\n\n.x-grid-with-col-lines .x-grid3-row{\n    border-top-color:#ededed;\n}\n\n.x-grid-with-col-lines .x-grid3-row-selected {\n\tborder-top-color:#a3bae9;\n}\n.x-dd-drag-ghost{\n\tcolor:#000;\n\tfont: normal 14px arial, helvetica, sans-serif;\n    border-color: #ddd #bbb #bbb #ddd;\n\tbackground-color:#fff;\n}\n\n.x-dd-drop-nodrop .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-no.gif);\n}\n\n.x-dd-drop-ok .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-yes.gif);\n}\n\n.x-dd-drop-ok-add .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-add.gif);\n}\n\n.x-view-selector {\n    background-color:#c3daf9;\n    border-color:#3399bb;\n}\n.x-tree-node-expanded .x-tree-node-icon{\n\tbackground-image:url(../images/access/tree/folder-open.gif);\n}\n\n.x-tree-node-leaf .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/leaf.gif);\n}\n\n.x-tree-node-collapsed .x-tree-node-icon{\n\tbackground-image:url(../images/access/tree/folder.gif);\n}\n\n.x-tree-node-loading .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/loading.gif) !important;\n}\n\n.x-tree-node .x-tree-node-inline-icon {\n    background-image: none;\n}\n\n.x-tree-node-loading a span{\n\t font-style: italic;\n\t color:#444444;\n}\n\n.ext-ie .x-tree-node-el input {\n    width:14px;\n    height:14px;\n}\n\n.x-tree-lines .x-tree-elbow{\n\tbackground-image:url(../images/access/tree/elbow.gif);\n}\n\n.x-tree-lines .x-tree-elbow-plus{\n\tbackground-image:url(../images/access/tree/elbow-plus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-minus{\n\tbackground-image:url(../images/access/tree/elbow-minus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end{\n\tbackground-image:url(../images/access/tree/elbow-end.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end-plus{\n\tbackground-image:url(../images/access/tree/elbow-end-plus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end-minus{\n\tbackground-image:url(../images/access/tree/elbow-end-minus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-line{\n\tbackground-image:url(../images/access/tree/elbow-line.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-plus{\n\tbackground-image:url(../images/access/tree/elbow-plus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-minus{\n\tbackground-image:url(../images/access/tree/elbow-minus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-end-plus{\n\tbackground-image:url(../images/access/tree/elbow-end-plus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-end-minus{\n\tbackground-image:url(../images/access/tree/elbow-end-minus-nl.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-plus{\n    background-image:url(../images/access/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-minus{\n    background-image:url(../images/access/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-end-plus{\n    background-image:url(../images/access/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-end-minus{\n    background-image:url(../images/access/tree/arrows.gif);\n}\n\n.x-tree-node{\n\tcolor:#000;\n\tfont: normal 14px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-tree-node a, .x-dd-drag-ghost a{\n\tcolor:#fff;\n}\n\n.x-tree-node a span, .x-dd-drag-ghost a span{\n\tcolor:#fff;\n}\n\n.x-tree-node .x-tree-selected a, .x-dd-drag-ghost a{\n\tcolor:#fff;\n}\n\n.x-tree-node .x-tree-selected a span, .x-dd-drag-ghost a span{\n\tcolor:#fff;\n}\n\n.x-tree-node .x-tree-node-disabled a span{\n\tcolor:gray !important;\n}\n\n.x-tree-node div.x-tree-drag-insert-below{\n \t border-bottom-color:#36c;\n}\n\n.x-tree-node div.x-tree-drag-insert-above{\n\t border-top-color:#36c;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below a{\n \t border-bottom-color:#36c;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above a{\n\t border-top-color:#36c;\n}\n\n.x-tree-node .x-tree-drag-append a span{\n\t background-color:#ddd;\n\t border-color:gray;\n}\n\n.x-tree-node .x-tree-node-over {\n\tbackground-color: #7e5530;\n}\n\n.x-tree-node .x-tree-selected {\n\tbackground-color: #e5872c;\n}\n\n.x-tree-drop-ok-append .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-add.gif);\n}\n\n.x-tree-drop-ok-above .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-over.gif);\n}\n\n.x-tree-drop-ok-below .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-under.gif);\n}\n\n.x-tree-drop-ok-between .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-between.gif);\n}\n.x-date-picker {\n    border-color: #737b8c;\n    background-color:#21252e;\n}\n\n.x-date-middle,.x-date-left,.x-date-right {\n\tbackground-image: url(../images/access/shared/hd-sprite.gif);\n\tcolor:#fff;\n\tfont:bold 14px \"sans serif\", tahoma, verdana, helvetica;\n}\n\n.x-date-middle .x-btn .x-btn-text {\n    color:#fff;\n}\n\n.x-date-middle .x-btn-mc em.x-btn-arrow {\n    background-image:url(../images/access/toolbar/btn-arrow-light.gif);\n}\n\n.x-date-right a {\n    background-image: url(../images/access/shared/right-btn.gif);\n}\n\n.x-date-left a{\n\tbackground-image: url(../images/access/shared/left-btn.gif);\n}\n\n.x-date-inner th {\n    background-color:#363d4a;\n    background-image:url(../images/access/toolbar/bg.gif);\n\tborder-bottom-color:#535b5c;\n    font:normal 13px arial, helvetica,tahoma,sans-serif;\n\tcolor:#fff;\n}\n\n.x-date-inner td {\n    border-color:#112;\n}\n\n.x-date-inner a {\n    font:normal 14px arial, helvetica,tahoma,sans-serif;\n    color:#fff;\n    padding:2px 7px 1px 3px; /* Structure to account for larger, bolder fonts in Access theme. */\n}\n\n.x-date-inner .x-date-active{\n\tcolor:#000;\n}\n\n.x-date-inner .x-date-selected a{\n    background-color:#e5872c;\n\tbackground-image:none;\n\tborder-color:#864900;\n    padding:1px 6px 1px 2px; /* Structure to account for larger, bolder fonts in Access theme. */\n}\n\n.x-date-inner .x-date-today a{\n\tborder-color:#99a;\n}\n\n.x-date-inner .x-date-selected span{\n    font-weight:bold;\n}\n\n.x-date-inner .x-date-prevday a,.x-date-inner .x-date-nextday a {\n\tcolor:#aaa;\n}\n\n.x-date-bottom {\n    border-top-color:#737b8c;\n    background-color:#464d5a;\n    background-image:url(../images/access/shared/glass-bg.gif);\n}\n\n.x-date-inner a:hover, .x-date-inner .x-date-disabled a:hover{\n    color:#fff;\n    background-color:#7e5530;\n}\n\n.x-date-inner .x-date-disabled a {\n\tbackground-color:#eee;\n\tcolor:#bbb;\n}\n\n.x-date-mmenu{\n    background-color:#eee !important;\n}\n\n.x-date-mmenu .x-menu-item {\n\tfont-size:13px;\n\tcolor:#000;\n}\n\n.x-date-mp {\n\tbackground-color:#21252e;\n}\n\n.x-date-mp td {\n\tfont:normal 14px arial, helvetica,tahoma,sans-serif;\n}\n\n.x-date-mp-btns button {\n\tbackground-color:#083772;\n\tcolor:#fff;\n\tborder-color: #3366cc #000055 #000055 #3366cc;\n\tfont:normal 14px arial, helvetica,tahoma,sans-serif;\n}\n\n.x-date-mp-btns {\n    background-color: #dfecfb;\n\tbackground-image: url(../images/access/shared/glass-bg.gif);\n}\n\n.x-date-mp-btns td {\n\tborder-top-color: #c5d2df;\n}\n\ntd.x-date-mp-month a,td.x-date-mp-year a {\n\tcolor:#fff;\n}\n\ntd.x-date-mp-month a:hover,td.x-date-mp-year a:hover {\n\tcolor:#fff;\n\tbackground-color: #7e5530;\n}\n\ntd.x-date-mp-sel a {\n    background-color: #e5872c;\n\tbackground-image: none;\n\tborder-color:#864900;\n}\n\n.x-date-mp-ybtn a {\n    background-image:url(../images/access/panel/tool-sprites.gif);\n}\n\ntd.x-date-mp-sep {\n   border-right-color:#c5d2df;\n}\n.x-tip .x-tip-close{\n\tbackground-image: url(../images/access/qtip/close.gif);\n}\n\n.x-tip .x-tip-tc, .x-tip .x-tip-tl, .x-tip .x-tip-tr, .x-tip .x-tip-bc, .x-tip .x-tip-bl, .x-tip .x-tip-br, .x-tip .x-tip-ml, .x-tip .x-tip-mr {\n\tbackground-image: url(../images/access/qtip/tip-sprite.gif);\n}\n\n.x-tip .x-tip-mc {\n    font: normal 14px tahoma,arial,helvetica,sans-serif;\n}\n.x-tip .x-tip-ml {\n\tbackground-color: #fff;\n}\n\n.x-tip .x-tip-header-text {\n    font: bold 14px tahoma,arial,helvetica,sans-serif;\n    color:#ffd;\n}\n\n.x-tip .x-tip-body {\n    font: normal 14px tahoma,arial,helvetica,sans-serif;\n    color:#000;\n}\n\n.x-form-invalid-tip .x-tip-tc, .x-form-invalid-tip .x-tip-tl, .x-form-invalid-tip .x-tip-tr, .x-form-invalid-tip .x-tip-bc,\n.x-form-invalid-tip .x-tip-bl, .x-form-invalid-tip .x-tip-br, .x-form-invalid-tip .x-tip-ml, .x-form-invalid-tip .x-tip-mr\n{\n\tbackground-image: url(../images/default/form/error-tip-corners.gif);\n}\n\n.x-form-invalid-tip .x-tip-body {\n    background-image:url(../images/access/form/exclamation.gif);\n}\n\n.x-tip-anchor {\n    background-image:url(../images/access/qtip/tip-anchor-sprite.gif);\n}\n.x-menu {\n\tborder-color:#222;\n    background-color:#414551;\n\tbackground-image:url(../images/access/menu/menu.gif);\n}\n\n.x-menu-nosep {\n\tbackground-image:none;\n}\n\n.x-menu-list-item{\n\tfont:normal 14px tahoma,arial, sans-serif;\n}\n\n.x-menu-item-arrow{\n\tbackground-image:url(../images/access/menu/menu-parent.gif);\n}\n\n.x-menu-sep {\n    background-color:#223;\n\tborder-bottom-color:#666;\n}\n\na.x-menu-item {\n\tcolor:#fffff6;\n}\n\n.x-menu-item-active {\n\tbackground-color: #f09134;\n\tbackground-image: none;\n    border-color:#b36427;\n}\n\n.x-menu-item-active a.x-menu-item {\n\tborder-color:#b36427;\n}\n\n.x-menu-check-item .x-menu-item-icon{\n\tbackground-image:url(../images/default/menu/unchecked.gif);\n}\n\n.x-menu-item-checked .x-menu-item-icon{\n\tbackground-image:url(../images/default/menu/checked.gif);\n}\n\n.x-menu-item-checked .x-menu-group-item .x-menu-item-icon{\n    background-image:url(../images/access/menu/group-checked.gif);\n}\n\n.x-menu-group-item .x-menu-item-icon{\n    background-image:none;\n}\n\n.x-menu-plain {\n\tbackground-color:#fff !important;\n}\n\n.x-menu .x-date-picker{\n    border-color:#a3bad9;\n}\n\n.x-cycle-menu .x-menu-item-checked {\n    border-color:#a3bae9 !important;\n    background-color:#def8f6;\n}\n\n.x-menu-scroller-top {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n\n.x-menu-scroller-bottom {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n.x-box-tl {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-tc {\n\tbackground-image: url(../images/default/box/tb.gif);\n}\n\n.x-box-tr {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-ml {\n\tbackground-image: url(../images/default/box/l.gif);\n}\n\n.x-box-mc {\n\tbackground-color: #eee;\n    background-image: url(../images/default/box/tb.gif);\n\tfont-family: \"Myriad Pro\",\"Myriad Web\",\"Tahoma\",\"Helvetica\",\"Arial\",sans-serif;\n\tcolor: #393939;\n\tfont-size: 15px;\n}\n\n.x-box-mc h3 {\n\tfont-size: 18px;\n\tfont-weight: bold;\n}\n\n.x-box-mr {\n\tbackground-image: url(../images/default/box/r.gif);\n}\n\n.x-box-bl {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-bc {\n\tbackground-image: url(../images/default/box/tb.gif);\n}\n\n.x-box-br {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-blue .x-box-bl, .x-box-blue .x-box-br, .x-box-blue .x-box-tl, .x-box-blue .x-box-tr {\n\tbackground-image: url(../images/default/box/corners-blue.gif);\n}\n\n.x-box-blue .x-box-bc, .x-box-blue .x-box-mc, .x-box-blue .x-box-tc {\n\tbackground-image: url(../images/default/box/tb-blue.gif);\n}\n\n.x-box-blue .x-box-mc {\n\tbackground-color: #c3daf9;\n}\n\n.x-box-blue .x-box-mc h3 {\n\tcolor: #17385b;\n}\n\n.x-box-blue .x-box-ml {\n\tbackground-image: url(../images/default/box/l-blue.gif);\n}\n\n.x-box-blue .x-box-mr {\n\tbackground-image: url(../images/default/box/r-blue.gif);\n}\n.x-combo-list {\n    border:2px solid #232732;\n    background-color:#555566;\n    font:normal 15px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-combo-list-inner {\n    background-color:#414551;\n}\n\n.x-combo-list-hd {\n    font:bold 14px tahoma, arial, helvetica, sans-serif;\n    color:#fff;\n    background-image: url(../images/default/layout/panel-title-light-bg.gif);\n    border-bottom-color:#98c0f4;\n}\n\n.x-resizable-pinned .x-combo-list-inner {\n    border-bottom-color:#98c0f4;\n}\n\n.x-combo-list-item {\n    border-color:#556;\n}\n\n.x-combo-list .x-combo-selected {\n\tborder-color:#e5872c !important;\n    background-color:#e5872c;\n}\n\n.x-combo-list .x-toolbar {\n    border-top-color:#98c0f4;\n}\n\n.x-combo-list-small {\n    font:normal 14px tahoma, arial, helvetica, sans-serif;\n}\n.x-panel {\n    border-color: #18181a;\n    font-size: 14px;\n}\n\n.x-panel-header {\n    color:#fff;\n    font-weight:bold; \n    font-size: 14px;\n    font-family: tahoma,arial,verdana,sans-serif;\n    border-color:#18181a;\n    background-image: url(../images/access/panel/white-top-bottom.gif);\n}\n\n.x-panel-body {\n    color: #fffff6;\n    border-color:#18181a;\n    background-color:#232d38;\n}\n\n.x-tab-panel .x-panel-body {\n    color: #fffff6;\n    border-color:#18181a;\n    background-color:#1f2730;\n}\n\n.x-panel-bbar .x-toolbar, .x-panel-tbar .x-toolbar {\n    border-color:#223;\n}\n\n.x-panel-tbar-noheader .x-toolbar, .x-panel-mc .x-panel-tbar .x-toolbar {\n    border-top-color:#223;\n}\n\n.x-panel-body-noheader, .x-panel-mc .x-panel-body {\n    border-top-color:#223;\n}\n\n.x-panel-tl .x-panel-header {\n    color:#fff;\n    font:bold 14px tahoma,arial,verdana,sans-serif;\n}\n\n.x-panel-tc {\n    background-image: url(../images/access/panel/top-bottom.gif);\n}\n\n.x-panel-tl, .x-panel-tr, .x-panel-bl,  .x-panel-br{\n    background-image: url(../images/access/panel/corners-sprite.gif);\n    border-bottom-color:#222224;\n}\n\n.x-panel-bc {\n\tbackground-image: url(../images/access/panel/top-bottom.gif);\n}\n\n.x-panel-mc {\n    font: normal 14px tahoma,arial,helvetica,sans-serif;\n    background-color:#3f4757;\n}\n\n.x-panel-ml {\n    background-image:url(../images/access/panel/left-right.gif);\n}\n\n.x-panel-mr {\n\tbackground-image: url(../images/access/panel/left-right.gif);\n}\n\n.x-tool {\n    background-image:url(../images/access/panel/tool-sprites.gif);\n}\n\n.x-panel-ghost {\n    background-color:#3f4757;\n}\n\n.x-panel-ghost ul {\n    border-color:#18181a;\n}\n\n.x-panel-dd-spacer {\n    border-color:#18181a;\n}\n\n.x-panel-fbar td,.x-panel-fbar span,.x-panel-fbar input,.x-panel-fbar div,.x-panel-fbar select,.x-panel-fbar label{\n    font:normal 14px arial,tahoma, helvetica, sans-serif;\n}\n.x-window-proxy {\n    background-color:#1f2833;\n    border-color:#18181a;\n}\n\n.x-window-tl .x-window-header {\n    color:#fff;\n\tfont:bold 14px tahoma,arial,verdana,sans-serif;\n}\n\n.x-window-tc {\n\tbackground-image: url(../images/access/window/top-bottom.png);\n}\n\n.x-window-tl {\n\tbackground-image: url(../images/access/window/left-corners.png);\n}\n\n.x-window-tr {\n\tbackground-image: url(../images/access/window/right-corners.png);\n}\n\n.x-window-bc {\n\tbackground-image: url(../images/access/window/top-bottom.png);\n}\n\n.x-window-bl {\n\tbackground-image: url(../images/access/window/left-corners.png);\n}\n\n.x-window-br {\n\tbackground-image: url(../images/access/window/right-corners.png);\n}\n\n.x-window-mc {\n    border-color:#18181a;\n    font: normal 14px tahoma,arial,helvetica,sans-serif;\n    background-color:#1f2833;\n}\n\n.x-window-ml {\n\tbackground-image: url(../images/access/window/left-right.png);\n}\n\n.x-window-mr {\n\tbackground-image: url(../images/access/window/left-right.png);\n}\n\n.x-window-maximized .x-window-tc {\n    background-color:#fff;\n}\n\n.x-window-bbar .x-toolbar {\n    border-top-color:#323945;\n}\n\n.x-panel-ghost .x-window-tl {\n    border-bottom-color:#323945;\n}\n\n.x-panel-collapsed .x-window-tl {\n    border-bottom-color:#323945;\n}\n\n.x-dlg-mask{\n   background-color:#ccc;\n}\n\n.x-window-plain .x-window-mc {\n    background-color: #464f61;\n    border-color: #636778;\n}\n\n.x-window-plain .x-window-body {\n    color: #fffff6;\n    border-color: #464F61;\n}\n\nbody.x-body-masked .x-window-plain .x-window-mc {\n    background-color: #464f61;\n}\n.x-html-editor-wrap {\n    border-color:#737B8C;\n    background-color:#fff;\n}\n.x-html-editor-wrap iframe {\n    background-color: #fff;\n}\n.x-html-editor-tb .x-btn-text {\n    background-image:url(../images/access/editor/tb-sprite.gif);\n}.x-panel-noborder .x-panel-header-noborder {\n    border-bottom-color:#343d4e;\n}\n\n.x-panel-noborder .x-panel-tbar-noborder .x-toolbar {\n    border-bottom-color:#343d4e;\n}\n\n.x-panel-noborder .x-panel-bbar-noborder .x-toolbar {\n    border-top-color:#343d4e;\n}\n\n.x-tab-panel-bbar-noborder .x-toolbar {\n    border-top-color:#343d4e;\n}\n\n.x-tab-panel-tbar-noborder .x-toolbar {\n    border-bottom-color:#343d4e;\n}\n.x-border-layout-ct {\n    background-color:#3f4757;\n}\n\n.x-accordion-hd {\n\tcolor:#fff;\n    font-weight:normal;\n    background-image: url(../images/access/panel/light-hd.gif);\n}\n\n.x-layout-collapsed{\n    background-color:#323845;\n\tborder-color:#1a1a1c;\n}\n\n.x-layout-collapsed-over{\n    background-color:#2d3440;\n}\n\n.x-layout-split-west .x-layout-mini {\n    background-image:url(../images/default/layout/mini-left.gif);\n}\n\n.x-layout-split-east .x-layout-mini {\n    background-image:url(../images/default/layout/mini-right.gif);\n}\n\n.x-layout-split-north .x-layout-mini {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n\n.x-layout-split-south .x-layout-mini {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n\n.x-layout-cmini-west .x-layout-mini {\n    background-image:url(../images/default/layout/mini-right.gif);\n}\n\n.x-layout-cmini-east .x-layout-mini {\n    background-image:url(../images/default/layout/mini-left.gif);\n}\n\n.x-layout-cmini-north .x-layout-mini {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n\n.x-layout-cmini-south .x-layout-mini {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n.x-progress-wrap {\n    border-color:#18181a;\n}\n\n.x-progress-inner {\n    background-color:#232d38;\n    background-image:none;\n}\n\n.x-progress-bar {\n    background-color:#f39a00;\n    background-image:url(../images/access/progress/progress-bg.gif);\n    border-top-color:#a66900;\n    border-bottom-color:#a66900;\n    border-right-color:#ffb941;\n    height: 20px !important; /* structural override for Accessibility Theme */\n}\n\n.x-progress-text {\n    font-size:14px;\n    font-weight:bold;\n    color:#fff;\n    padding: 0 5px !important; /* structural override for Accessibility Theme */\n}\n\n.x-progress-text-back {\n    color:#aaa;\n    line-height: 19px;\n}\n.x-list-header{\n    background-color:#393d4e;\n\tbackground-image:url(../images/access/toolbar/bg.gif);\n\tbackground-position:0 top;\n}\n\n.x-list-header-inner div em {\n    border-left-color:#667;\n    font:normal 14px arial, tahoma, helvetica, sans-serif;\n    line-height: 14px;\n}\n\n.x-list-body-inner {\n    background-color:#1B232B;\n}\n\n.x-list-body dt em {\n    font:normal 14px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-list-over {\n    background-color:#7E5530;\n}\n\n.x-list-selected {\n    background-color:#E5872C;\n}\n\n.x-list-resizer {\n    border-left-color:#555;\n    border-right-color:#555;\n}\n\n.x-list-header-inner em.sort-asc, .x-list-header-inner em.sort-desc {\n    background-image:url(../images/access/grid/sort-hd.gif);\n    border-color: #3e4e6c;\n}\n.x-slider-horz, .x-slider-horz .x-slider-end, .x-slider-horz .x-slider-inner {\n    background-image:url(../images/access/slider/slider-bg.png);\n}\n\n.x-slider-horz .x-slider-thumb {\n    background-image:url(../images/access/slider/slider-thumb.png);\n}\n\n.x-slider-vert, .x-slider-vert .x-slider-end, .x-slider-vert .x-slider-inner {\n    background-image:url(../images/access/slider/slider-v-bg.png);\n}\n\n.x-slider-vert .x-slider-thumb {\n    background-image:url(../images/access/slider/slider-v-thumb.png);\n}\n.x-window-dlg .ext-mb-text,\n.x-window-dlg .x-window-header-text {\n    font-size:15px;\n}\n\n.x-window-dlg .ext-mb-textarea {\n    font:normal 15px tahoma,arial,helvetica,sans-serif;\n}\n\n.x-window-dlg .x-msg-box-wait {\n    background-image:url(../images/access/grid/loading.gif);\n}\n\n.x-window-dlg .ext-mb-info {\n    background-image:url(../images/access/window/icon-info.gif);\n}\n\n.x-window-dlg .ext-mb-warning {\n    background-image:url(../images/access/window/icon-warning.gif);\n}\n\n.x-window-dlg .ext-mb-question {\n    background-image:url(../images/access/window/icon-question.gif);\n}\n\n.x-window-dlg .ext-mb-error {\n    background-image:url(../images/access/window/icon-error.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/xtheme-blue.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.ext-el-mask {\n    background-color: #ccc;\n}\n\n.ext-el-mask-msg {\n    border-color:#6593cf;\n    background-color:#c3daf9;\n    background-image:url(../images/default/box/tb-blue.gif);\n}\n.ext-el-mask-msg div {\n    background-color: #eee;\n    border-color:#a3bad9;\n    color:#222;\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-mask-loading div {\n    background-color:#fbfbfb;\n    background-image:url(../images/default/grid/loading.gif);\n}\n\n.x-item-disabled {\n    color: gray;\n}\n\n.x-item-disabled * {\n    color: gray !important;\n}\n\n.x-splitbar-proxy {\n    background-color: #aaa;\n}\n\n.x-color-palette a {\n    border-color:#fff;\n}\n\n.x-color-palette a:hover, .x-color-palette a.x-color-palette-sel {\n    border-color:#8bb8f3;\n    background-color: #deecfd;\n}\n\n/*\n.x-color-palette em:hover, .x-color-palette span:hover{   \n    background-color: #deecfd;\n}\n*/\n\n.x-color-palette em {\n    border-color:#aca899;\n}\n\n.x-ie-shadow {\n    background-color:#777;\n}\n\n.x-shadow .xsmc {\n    background-image: url(../images/default/shadow-c.png);\n}\n\n.x-shadow .xsml, .x-shadow .xsmr {\n    background-image: url(../images/default/shadow-lr.png);\n}\n\n.x-shadow .xstl, .x-shadow .xstc,  .x-shadow .xstr, .x-shadow .xsbl, .x-shadow .xsbc, .x-shadow .xsbr{\n    background-image: url(../images/default/shadow.png);\n}\n\n.loading-indicator {\n    font-size: 11px;\n    background-image: url(../images/default/grid/loading.gif);\n}\n\n.x-spotlight {\n    background-color: #ccc;\n}\n.x-tab-panel-header, .x-tab-panel-footer {\n\tbackground-color: #deecfd;\n\tborder-color:#8db2e3;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tab-panel-header, .x-tab-panel-footer {\n\tborder-color:#8db2e3;\n}\n\nul.x-tab-strip-top{\n    background-color:#cedff5;\n\tbackground-image: url(../images/default/tabs/tab-strip-bg.gif);\n\tborder-bottom-color:#8db2e3;\n}\n\nul.x-tab-strip-bottom{\n    background-color:#cedff5;\n\tbackground-image: url(../images/default/tabs/tab-strip-btm-bg.gif);\n\tborder-top-color:#8db2e3;\n}\n\n.x-tab-panel-header-plain .x-tab-strip-spacer,\n.x-tab-panel-footer-plain .x-tab-strip-spacer {\n    border-color:#8db2e3;\n    background-color: #deecfd;\n}\n\n.x-tab-strip span.x-tab-strip-text {\n\tfont:normal 11px tahoma,arial,helvetica;\n\tcolor:#416aa3;\n}\n\n.x-tab-strip-over span.x-tab-strip-text {\n\tcolor:#15428b;\n}\n\n.x-tab-strip-active span.x-tab-strip-text {\n\tcolor:#15428b;\n    font-weight:bold;\n}\n\n.x-tab-strip-disabled .x-tabs-text {\n\tcolor:#aaaaaa;\n}\n\n.x-tab-strip-top .x-tab-right, .x-tab-strip-top .x-tab-left, .x-tab-strip-top .x-tab-strip-inner{\n\tbackground-image: url(../images/default/tabs/tabs-sprite.gif);\n}\n\n.x-tab-strip-bottom .x-tab-right {\n\tbackground-image: url(../images/default/tabs/tab-btm-inactive-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-left {\n\tbackground-image: url(../images/default/tabs/tab-btm-inactive-left-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-over .x-tab-right {\n\tbackground-image: url(../images/default/tabs/tab-btm-over-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-over .x-tab-left {\n\tbackground-image: url(../images/default/tabs/tab-btm-over-left-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-right {\n\tbackground-image: url(../images/default/tabs/tab-btm-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-left {\n\tbackground-image: url(../images/default/tabs/tab-btm-left-bg.gif);\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close {\n\tbackground-image:url(../images/default/tabs/tab-close.gif);\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close:hover{\n\tbackground-image:url(../images/default/tabs/tab-close.gif);\n}\n\n.x-tab-panel-body {\n    border-color:#8db2e3;\n    background-color:#fff;\n}\n\n.x-tab-panel-body-top {\n    border-top: 0 none;\n}\n\n.x-tab-panel-body-bottom {\n    border-bottom: 0 none;\n}\n\n.x-tab-scroller-left {\n    background-image:url(../images/default/tabs/scroll-left.gif);\n    border-bottom-color:#8db2e3;\n}\n\n.x-tab-scroller-left-over {\n    background-position: 0 0;\n}\n\n.x-tab-scroller-left-disabled {\n    background-position: -18px 0;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n    cursor:default;\n}\n\n.x-tab-scroller-right {\n    background-image:url(../images/default/tabs/scroll-right.gif);\n    border-bottom-color:#8db2e3;\n}\n\n.x-tab-panel-bbar .x-toolbar, .x-tab-panel-tbar .x-toolbar {\n    border-color:#99bbe8;\n}.x-form-field {\n    font:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-text, textarea.x-form-field {\n    background-color:#fff;\n    background-image:url(../images/default/form/text-bg.gif);\n    border-color:#b5b8c8;\n}\n\n.x-form-select-one {\n    background-color:#fff;\n    border-color:#b5b8c8;\n}\n\n.x-form-check-group-label {\n    border-bottom: 1px solid #99bbe8;\n    color: #15428b;\n}\n\n.x-editor .x-form-check-wrap {\n    background-color:#fff;\n}\n\n.x-form-field-wrap .x-form-trigger {\n    background-image:url(../images/default/form/trigger.gif);\n    border-bottom-color:#b5b8c8;\n}\n\n.x-form-field-wrap .x-form-date-trigger {\n    background-image: url(../images/default/form/date-trigger.gif);\n}\n\n.x-form-field-wrap .x-form-clear-trigger {\n    background-image: url(../images/default/form/clear-trigger.gif);\n}\n\n.x-form-field-wrap .x-form-search-trigger {\n    background-image: url(../images/default/form/search-trigger.gif);\n}\n\n.x-trigger-wrap-focus .x-form-trigger {\n    border-bottom-color:#7eadd9;\n}\n\n.x-item-disabled .x-form-trigger-over {\n    border-bottom-color:#b5b8c8;\n}\n\n.x-item-disabled .x-form-trigger-click {\n    border-bottom-color:#b5b8c8;\n}\n\n.x-form-focus, textarea.x-form-focus {\n\tborder-color:#7eadd9;\n}\n\n.x-form-invalid, textarea.x-form-invalid {\n    background-color:#fff;\n\tbackground-image:url(../images/default/grid/invalid_line.gif);\n\tborder-color:#c30;\n}\n\n.x-form-invalid.x-form-composite {\n    border: none;\n    background-image: none;\n}\n\n.x-form-invalid.x-form-composite .x-form-invalid {\n    background-color:#fff;\n\tbackground-image:url(../images/default/grid/invalid_line.gif);\n\tborder-color:#c30;\n}\n\n.x-form-inner-invalid, textarea.x-form-inner-invalid {\n    background-color:#fff;\n\tbackground-image:url(../images/default/grid/invalid_line.gif);\n}\n\n.x-form-grow-sizer {\n\tfont:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-item {\n    font:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-invalid-msg {\n    color:#c0272b;\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n    background-image:url(../images/default/shared/warning.gif);\n}\n\n.x-form-empty-field {\n    color:gray;\n}\n\n.x-small-editor .x-form-field {\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.ext-webkit .x-small-editor .x-form-field {\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-form-invalid-icon {\n    background-image:url(../images/default/form/exclamation.gif);\n}\n\n.x-fieldset {\n    border-color:#b5b8c8;\n}\n\n.x-fieldset legend {\n    font:bold 11px tahoma, arial, helvetica, sans-serif;\n    color:#15428b;\n}\n.x-btn{\n\tfont:normal 11px tahoma, verdana, helvetica;\n}\n\n.x-btn button{\n    font:normal 11px arial,tahoma,verdana,helvetica;\n    color:#333;\n}\n\n.x-btn em {\n    font-style:normal;\n    font-weight:normal;\n}\n\n.x-btn-tl, .x-btn-tr, .x-btn-tc, .x-btn-ml, .x-btn-mr, .x-btn-mc, .x-btn-bl, .x-btn-br, .x-btn-bc{\n\tbackground-image:url(../images/default/button/btn.gif);\n}\n\n.x-btn-click .x-btn-text, .x-btn-menu-active .x-btn-text, .x-btn-pressed .x-btn-text{\n    color:#000;\n}\n\n.x-btn-disabled *{\n\tcolor:gray !important;\n}\n\n.x-btn-mc em.x-btn-arrow {\n    background-image:url(../images/default/button/arrow.gif);\n}\n\n.x-btn-mc em.x-btn-split {\n    background-image:url(../images/default/button/s-arrow.gif);\n}\n\n.x-btn-over .x-btn-mc em.x-btn-split, .x-btn-click .x-btn-mc em.x-btn-split, .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-btn-pressed .x-btn-mc em.x-btn-split {\n    background-image:url(../images/default/button/s-arrow-o.gif);\n}\n\n.x-btn-mc em.x-btn-arrow-bottom {\n    background-image:url(../images/default/button/s-arrow-b-noline.gif);\n}\n\n.x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/default/button/s-arrow-b.gif);\n}\n\n.x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-btn-click .x-btn-mc em.x-btn-split-bottom, .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-btn-pressed .x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/default/button/s-arrow-bo.gif);\n}\n\n.x-btn-group-header {\n    color: #3e6aaa;\n}\n\n.x-btn-group-tc {\n\tbackground-image: url(../images/default/button/group-tb.gif);\n}\n\n.x-btn-group-tl {\n\tbackground-image: url(../images/default/button/group-cs.gif);\n}\n\n.x-btn-group-tr {\n\tbackground-image: url(../images/default/button/group-cs.gif);\n}\n\n.x-btn-group-bc {\n\tbackground-image: url(../images/default/button/group-tb.gif);\n}\n\n.x-btn-group-bl {\n\tbackground-image: url(../images/default/button/group-cs.gif);\n}\n\n.x-btn-group-br {\n\tbackground-image: url(../images/default/button/group-cs.gif);\n}\n\n.x-btn-group-ml {\n\tbackground-image: url(../images/default/button/group-lr.gif);\n}\n.x-btn-group-mr {\n\tbackground-image: url(../images/default/button/group-lr.gif);\n}\n\n.x-btn-group-notitle .x-btn-group-tc {\n\tbackground-image: url(../images/default/button/group-tb.gif);\n}.x-toolbar{\n\tborder-color:#a9bfd3;\n    background-color:#d0def0;\n    background-image:url(../images/default/toolbar/bg.gif);\n}\n\n.x-toolbar td,.x-toolbar span,.x-toolbar input,.x-toolbar div,.x-toolbar select,.x-toolbar label{\n    font:normal 11px arial,tahoma, helvetica, sans-serif;\n}\n\n.x-toolbar .x-item-disabled {\n\tcolor:gray;\n}\n\n.x-toolbar .x-item-disabled * {\n\tcolor:gray;\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split {\n    background-image:url(../images/default/button/s-arrow-noline.gif);\n}\n\n.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-click .x-btn-mc em.x-btn-split,\n.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split\n{\n    background-image:url(../images/default/button/s-arrow-o.gif);\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/default/button/s-arrow-b-noline.gif);\n}\n\n.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-click .x-btn-mc em.x-btn-split-bottom,\n.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split-bottom\n{\n    background-image:url(../images/default/button/s-arrow-bo.gif);\n}\n\n.x-toolbar .xtb-sep {\n\tbackground-image: url(../images/default/grid/grid-blue-split.gif);\n}\n\n.x-tbar-page-first{\n\tbackground-image: url(../images/default/grid/page-first.gif) !important;\n}\n\n.x-tbar-loading{\n\tbackground-image: url(../images/default/grid/refresh.gif) !important;\n}\n\n.x-tbar-page-last{\n\tbackground-image: url(../images/default/grid/page-last.gif) !important;\n}\n\n.x-tbar-page-next{\n\tbackground-image: url(../images/default/grid/page-next.gif) !important;\n}\n\n.x-tbar-page-prev{\n\tbackground-image: url(../images/default/grid/page-prev.gif) !important;\n}\n\n.x-item-disabled .x-tbar-loading{\n\tbackground-image: url(../images/default/grid/refresh-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-first{\n\tbackground-image: url(../images/default/grid/page-first-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-last{\n\tbackground-image: url(../images/default/grid/page-last-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-next{\n\tbackground-image: url(../images/default/grid/page-next-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-prev{\n\tbackground-image: url(../images/default/grid/page-prev-disabled.gif) !important;\n}\n\n.x-paging-info {\n    color:#444;\n}\n\n.x-toolbar-more-icon {\n    background-image: url(../images/default/toolbar/more.gif) !important;\n}.x-resizable-handle {\n\tbackground-color:#fff;\n}\n\n.x-resizable-over .x-resizable-handle-east, .x-resizable-pinned .x-resizable-handle-east,\n.x-resizable-over .x-resizable-handle-west, .x-resizable-pinned .x-resizable-handle-west\n{\n    background-image:url(../images/default/sizer/e-handle.gif);\n}\n\n.x-resizable-over .x-resizable-handle-south, .x-resizable-pinned .x-resizable-handle-south,\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north\n{\n    background-image:url(../images/default/sizer/s-handle.gif);\n}\n\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north{\n    background-image:url(../images/default/sizer/s-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-southeast, .x-resizable-pinned .x-resizable-handle-southeast{\n    background-image:url(../images/default/sizer/se-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-northwest, .x-resizable-pinned .x-resizable-handle-northwest{\n    background-image:url(../images/default/sizer/nw-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-northeast, .x-resizable-pinned .x-resizable-handle-northeast{\n    background-image:url(../images/default/sizer/ne-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-southwest, .x-resizable-pinned .x-resizable-handle-southwest{\n    background-image:url(../images/default/sizer/sw-handle.gif);\n}\n.x-resizable-proxy{\n    border-color:#3b5a82;\n}\n.x-resizable-overlay{\n    background-color:#fff;\n}\n.x-grid3 {\n    background-color:#fff;\n}\n\n.x-grid-panel .x-panel-mc .x-panel-body {\n    border-color:#99bbe8;\n}\n\n.x-grid3-row td, .x-grid3-summary-row td{\n\tfont:normal 11px/13px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-grid3-hd-row td {\n\tfont:normal 11px/15px arial, tahoma, helvetica, sans-serif;\n}\n\n\n.x-grid3-hd-row td {\n    border-left-color:#eee;\n    border-right-color:#d0d0d0;\n}\n\n.x-grid-row-loading {\n    background-color: #fff;\n    background-image:url(../images/default/shared/loading-balls.gif);\n}\n\n.x-grid3-row {\n    border-color:#ededed;\n    border-top-color:#fff;\n}\n\n.x-grid3-row-alt{\n\tbackground-color:#fafafa;\n}\n\n.x-grid3-row-over {\n\tborder-color:#ddd;\n    background-color:#efefef;\n    background-image:url(../images/default/grid/row-over.gif);\n}\n\n.x-grid3-resize-proxy {\n    background-color:#777;\n}\n\n.x-grid3-resize-marker {\n    background-color:#777;\n}\n\n.x-grid3-header{\n    background-color:#f9f9f9;\n\tbackground-image:url(../images/default/grid/grid3-hrow.gif);\n}\n\n.x-grid3-header-pop {\n    border-left-color:#d0d0d0;\n}\n\n.x-grid3-header-pop-inner {\n    border-left-color:#eee;\n    background-image:url(../images/default/grid/hd-pop.gif);\n}\n\ntd.x-grid3-hd-over, td.sort-desc, td.sort-asc, td.x-grid3-hd-menu-open {\n    border-left-color:#aaccf6;\n    border-right-color:#aaccf6;\n}\n\ntd.x-grid3-hd-over .x-grid3-hd-inner, td.sort-desc .x-grid3-hd-inner, td.sort-asc .x-grid3-hd-inner, td.x-grid3-hd-menu-open .x-grid3-hd-inner {\n    background-color:#ebf3fd;\n    background-image:url(../images/default/grid/grid3-hrow-over.gif);\n\n}\n\n.sort-asc .x-grid3-sort-icon {\n\tbackground-image: url(../images/default/grid/sort_asc.gif);\n}\n\n.sort-desc .x-grid3-sort-icon {\n\tbackground-image: url(../images/default/grid/sort_desc.gif);\n}\n\n.x-grid3-cell-text, .x-grid3-hd-text {\n\tcolor:#000;\n}\n\n.x-grid3-split {\n\tbackground-image: url(../images/default/grid/grid-split.gif);\n}\n\n.x-grid3-hd-text {\n\tcolor:#15428b;\n}\n\n.x-dd-drag-proxy .x-grid3-hd-inner{\n    background-color:#ebf3fd;\n\tbackground-image:url(../images/default/grid/grid3-hrow-over.gif);\n\tborder-color:#aaccf6;\n}\n\n.col-move-top{\n\tbackground-image:url(../images/default/grid/col-move-top.gif);\n}\n\n.col-move-bottom{\n\tbackground-image:url(../images/default/grid/col-move-bottom.gif);\n}\n\ntd.grid-hd-group-cell {\n    background: url(../images/default/grid/grid3-hrow.gif) repeat-x bottom;\n}\n\n.x-grid3-row-selected {\n\tbackground-color: #dfe8f6 !important;\n\tbackground-image: none;\n\tborder-color:#a3bae9;\n}\n\n.x-grid3-cell-selected{\n\tbackground-color: #b8cfee !important;\n\tcolor:#000;\n}\n\n.x-grid3-cell-selected span{\n\tcolor:#000 !important;\n}\n\n.x-grid3-cell-selected .x-grid3-cell-text{\n\tcolor:#000;\n}\n\n.x-grid3-locked td.x-grid3-row-marker, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker{\n    background-color:#ebeadb !important;\n    background-image:url(../images/default/grid/grid-hrow.gif) !important;\n    color:#000;\n    border-top-color:#fff;\n    border-right-color:#6fa0df !important;\n}\n\n.x-grid3-locked td.x-grid3-row-marker div, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker div{\n    color:#15428b !important;\n}\n\n.x-grid3-dirty-cell {\n    background-image:url(../images/default/grid/dirty.gif);\n}\n\n.x-grid3-topbar, .x-grid3-bottombar{\n\tfont:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-grid3-bottombar .x-toolbar{\n\tborder-top-color:#a9bfd3;\n}\n\n.x-props-grid .x-grid3-td-name .x-grid3-cell-inner{\n\tbackground-image:url(../images/default/grid/grid3-special-col-bg.gif) !important;\n    color:#000 !important;\n}\n\n.x-props-grid .x-grid3-body .x-grid3-td-name{\n    background-color:#fff !important;\n    border-right-color:#eee;\n}\n\n.xg-hmenu-sort-asc .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-asc.gif);\n}\n\n.xg-hmenu-sort-desc .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-desc.gif);\n}\n\n.xg-hmenu-lock .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-lock.gif);\n}\n\n.xg-hmenu-unlock .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-unlock.gif);\n}\n\n.x-grid3-hd-btn {\n    background-color:#c3daf9;\n    background-image:url(../images/default/grid/grid3-hd-btn.gif);\n}\n\n.x-grid3-body .x-grid3-td-expander {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-row-expander {\n    background-image:url(../images/default/grid/row-expand-sprite.gif);\n}\n\n.x-grid3-body .x-grid3-td-checker {\n    background-image: url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-row-checker, .x-grid3-hd-checker {\n    background-image:url(../images/default/grid/row-check-sprite.gif);\n}\n\n.x-grid3-body .x-grid3-td-numberer {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-body .x-grid3-td-numberer .x-grid3-cell-inner {\n\tcolor:#444;\n}\n\n.x-grid3-body .x-grid3-td-row-icon {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-numberer,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-checker,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-expander {\n\tbackground-image:url(../images/default/grid/grid3-special-col-sel-bg.gif);\n}\n\n.x-grid3-check-col {\n\tbackground-image:url(../images/default/menu/unchecked.gif);\n}\n\n.x-grid3-check-col-on {\n\tbackground-image:url(../images/default/menu/checked.gif);\n}\n\n.x-grid-group, .x-grid-group-body, .x-grid-group-hd {\n    zoom:1;\n}\n\n.x-grid-group-hd {\n    border-bottom-color:#99bbe8;\n}\n\n.x-grid-group-hd div.x-grid-group-title {\n    background-image:url(../images/default/grid/group-collapse.gif);\n    color:#3764a0;\n    font:bold 11px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-grid-group-collapsed .x-grid-group-hd div.x-grid-group-title {\n    background-image:url(../images/default/grid/group-expand.gif);\n}\n\n.x-group-by-icon {\n    background-image:url(../images/default/grid/group-by.gif);\n}\n\n.x-cols-icon {\n    background-image:url(../images/default/grid/columns.gif);\n}\n\n.x-show-groups-icon {\n    background-image:url(../images/default/grid/group-by.gif);\n}\n\n.x-grid-empty {\n    color:gray;\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-grid-with-col-lines .x-grid3-row td.x-grid3-cell {\n    border-right-color:#ededed;\n}\n\n.x-grid-with-col-lines .x-grid3-row-selected {\n\tborder-top-color:#a3bae9;\n}.x-pivotgrid .x-grid3-header-offset table td {\n    background: url(../images/default/grid/grid3-hrow.gif) repeat-x 50% 100%;\n    border-left: 1px solid;\n    border-right: 1px solid;\n    border-left-color: #EEE;\n    border-right-color: #D0D0D0;\n}\n\n.x-pivotgrid .x-grid3-row-headers {\n    background-color: #f9f9f9;\n}\n\n.x-pivotgrid .x-grid3-row-headers table td {\n    background: #EEE url(../images/default/grid/grid3-rowheader.gif) repeat-x left top;\n    border-left: 1px solid;\n    border-right: 1px solid;\n    border-left-color: #EEE;\n    border-right-color: #D0D0D0;\n    border-bottom: 1px solid;\n    border-bottom-color: #D0D0D0;\n    height: 18px;\n}\n.x-dd-drag-ghost{\n\tcolor:#000;\n\tfont: normal 11px arial, helvetica, sans-serif;\n    border-color: #ddd #bbb #bbb #ddd;\n\tbackground-color:#fff;\n}\n\n.x-dd-drop-nodrop .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-no.gif);\n}\n\n.x-dd-drop-ok .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-yes.gif);\n}\n\n.x-dd-drop-ok-add .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-add.gif);\n}\n\n.x-view-selector {\n    background-color:#c3daf9;\n    border-color:#3399bb;\n}.x-tree-node-expanded .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/folder-open.gif);\n}\n\n.x-tree-node-leaf .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/leaf.gif);\n}\n\n.x-tree-node-collapsed .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/folder.gif);\n}\n\n.x-tree-node-loading .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/loading.gif) !important;\n}\n\n.x-tree-node .x-tree-node-inline-icon {\n    background-image: none;\n}\n\n.x-tree-node-loading a span{\n\t font-style: italic;\n\t color:#444444;\n}\n\n.x-tree-lines .x-tree-elbow{\n\tbackground-image:url(../images/default/tree/elbow.gif);\n}\n\n.x-tree-lines .x-tree-elbow-plus{\n\tbackground-image:url(../images/default/tree/elbow-plus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-minus{\n\tbackground-image:url(../images/default/tree/elbow-minus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end{\n\tbackground-image:url(../images/default/tree/elbow-end.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end-plus{\n\tbackground-image:url(../images/default/tree/elbow-end-plus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end-minus{\n\tbackground-image:url(../images/default/tree/elbow-end-minus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-line{\n\tbackground-image:url(../images/default/tree/elbow-line.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-plus{\n\tbackground-image:url(../images/default/tree/elbow-plus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-minus{\n\tbackground-image:url(../images/default/tree/elbow-minus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-end-plus{\n\tbackground-image:url(../images/default/tree/elbow-end-plus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-end-minus{\n\tbackground-image:url(../images/default/tree/elbow-end-minus-nl.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-plus{\n    background-image:url(../images/default/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-minus{\n    background-image:url(../images/default/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-end-plus{\n    background-image:url(../images/default/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-end-minus{\n    background-image:url(../images/default/tree/arrows.gif);\n}\n\n.x-tree-node{\n\tcolor:#000;\n\tfont: normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-tree-node a, .x-dd-drag-ghost a{\n\tcolor:#000;\n}\n\n.x-tree-node a span, .x-dd-drag-ghost a span{\n\tcolor:#000;\n}\n\n.x-tree-node .x-tree-node-disabled a span{\n\tcolor:gray !important;\n}\n\n.x-tree-node div.x-tree-drag-insert-below{\n \t border-bottom-color:#36c;\n}\n\n.x-tree-node div.x-tree-drag-insert-above{\n\t border-top-color:#36c;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below a{\n \t border-bottom-color:#36c;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above a{\n\t border-top-color:#36c;\n}\n\n.x-tree-node .x-tree-drag-append a span{\n\t background-color:#ddd;\n\t border-color:gray;\n}\n\n.x-tree-node .x-tree-node-over {\n\tbackground-color: #eee;\n}\n\n.x-tree-node .x-tree-selected {\n\tbackground-color: #d9e8fb;\n}\n\n.x-tree-drop-ok-append .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-add.gif);\n}\n\n.x-tree-drop-ok-above .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-over.gif);\n}\n\n.x-tree-drop-ok-below .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-under.gif);\n}\n\n.x-tree-drop-ok-between .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-between.gif);\n}.x-date-picker {\n    border-color: #1b376c;\n    background-color:#fff;\n}\n\n.x-date-middle,.x-date-left,.x-date-right {\n\tbackground-image: url(../images/default/shared/hd-sprite.gif);\n\tcolor:#fff;\n\tfont:bold 11px \"sans serif\", tahoma, verdana, helvetica;\n}\n\n.x-date-middle .x-btn .x-btn-text {\n    color:#fff;\n}\n\n.x-date-middle .x-btn-mc em.x-btn-arrow {\n    background-image:url(../images/default/toolbar/btn-arrow-light.gif);\n}\n\n.x-date-right a {\n    background-image: url(../images/default/shared/right-btn.gif);\n}\n\n.x-date-left a{\n\tbackground-image: url(../images/default/shared/left-btn.gif);\n}\n\n.x-date-inner th {\n    background-color:#dfecfb;\n    background-image:url(../images/default/shared/glass-bg.gif);\n\tborder-bottom-color:#a3bad9;\n    font:normal 10px arial, helvetica,tahoma,sans-serif;\n\tcolor:#233d6d;\n}\n\n.x-date-inner td {\n    border-color:#fff;\n}\n\n.x-date-inner a {\n    font:normal 11px arial, helvetica,tahoma,sans-serif;\n    color:#000;\n}\n\n.x-date-inner .x-date-active{\n\tcolor:#000;\n}\n\n.x-date-inner .x-date-selected a{\n    background-color:#dfecfb;\n\tbackground-image:url(../images/default/shared/glass-bg.gif);\n\tborder-color:#8db2e3;\n}\n\n.x-date-inner .x-date-today a{\n\tborder-color:darkred;\n}\n\n.x-date-inner .x-date-selected span{\n    font-weight:bold;\n}\n\n.x-date-inner .x-date-prevday a,.x-date-inner .x-date-nextday a {\n\tcolor:#aaa;\n}\n\n.x-date-bottom {\n    border-top-color:#a3bad9;\n    background-color:#dfecfb;\n    background-image:url(../images/default/shared/glass-bg.gif);\n}\n\n.x-date-inner a:hover, .x-date-inner .x-date-disabled a:hover{\n    color:#000;\n    background-color:#ddecfe;\n}\n\n.x-date-inner .x-date-disabled a {\n\tbackground-color:#eee;\n\tcolor:#bbb;\n}\n\n.x-date-mmenu{\n    background-color:#eee !important;\n}\n\n.x-date-mmenu .x-menu-item {\n\tfont-size:10px;\n\tcolor:#000;\n}\n\n.x-date-mp {\n\tbackground-color:#fff;\n}\n\n.x-date-mp td {\n\tfont:normal 11px arial, helvetica,tahoma,sans-serif;\n}\n\n.x-date-mp-btns button {\n\tbackground-color:#083772;\n\tcolor:#fff;\n\tborder-color: #3366cc #000055 #000055 #3366cc;\n\tfont:normal 11px arial, helvetica,tahoma,sans-serif;\n}\n\n.x-date-mp-btns {\n    background-color: #dfecfb;\n\tbackground-image: url(../images/default/shared/glass-bg.gif);\n}\n\n.x-date-mp-btns td {\n\tborder-top-color: #c5d2df;\n}\n\ntd.x-date-mp-month a,td.x-date-mp-year a {\n\tcolor:#15428b;\n}\n\ntd.x-date-mp-month a:hover,td.x-date-mp-year a:hover {\n\tcolor:#15428b;\n\tbackground-color: #ddecfe;\n}\n\ntd.x-date-mp-sel a {\n    background-color: #dfecfb;\n\tbackground-image: url(../images/default/shared/glass-bg.gif);\n\tborder-color:#8db2e3;\n}\n\n.x-date-mp-ybtn a {\n    background-image:url(../images/default/panel/tool-sprites.gif);\n}\n\ntd.x-date-mp-sep {\n   border-right-color:#c5d2df;\n}.x-tip .x-tip-close{\n\tbackground-image: url(../images/default/qtip/close.gif);\n}\n\n.x-tip .x-tip-tc, .x-tip .x-tip-tl, .x-tip .x-tip-tr, .x-tip .x-tip-bc, .x-tip .x-tip-bl, .x-tip .x-tip-br, .x-tip .x-tip-ml, .x-tip .x-tip-mr {\n\tbackground-image: url(../images/default/qtip/tip-sprite.gif);\n}\n\n.x-tip .x-tip-mc {\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n}\n.x-tip .x-tip-ml {\n\tbackground-color: #fff;\n}\n\n.x-tip .x-tip-header-text {\n    font: bold 11px tahoma,arial,helvetica,sans-serif;\n    color:#444;\n}\n\n.x-tip .x-tip-body {\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n    color:#444;\n}\n\n.x-form-invalid-tip .x-tip-tc, .x-form-invalid-tip .x-tip-tl, .x-form-invalid-tip .x-tip-tr, .x-form-invalid-tip .x-tip-bc,\n.x-form-invalid-tip .x-tip-bl, .x-form-invalid-tip .x-tip-br, .x-form-invalid-tip .x-tip-ml, .x-form-invalid-tip .x-tip-mr\n{\n\tbackground-image: url(../images/default/form/error-tip-corners.gif);\n}\n\n.x-form-invalid-tip .x-tip-body {\n    background-image:url(../images/default/form/exclamation.gif);\n}\n\n.x-tip-anchor {\n    background-image:url(../images/default/qtip/tip-anchor-sprite.gif);\n}.x-menu {\n    background-color:#f0f0f0;\n\tbackground-image:url(../images/default/menu/menu.gif);\n}\n\n.x-menu-floating{\n    border-color:#718bb7;\n}\n\n.x-menu-nosep {\n\tbackground-image:none;\n}\n\n.x-menu-list-item{\n\tfont:normal 11px arial,tahoma,sans-serif;\n}\n\n.x-menu-item-arrow{\n\tbackground-image:url(../images/default/menu/menu-parent.gif);\n}\n\n.x-menu-sep {\n    background-color:#e0e0e0;\n\tborder-bottom-color:#fff;\n}\n\na.x-menu-item {\n\tcolor:#222;\n}\n\n.x-menu-item-active {\n    background-image: url(../images/default/menu/item-over.gif);\n\tbackground-color: #dbecf4;\n    border-color:#aaccf6;\n}\n\n.x-menu-item-active a.x-menu-item {\n\tborder-color:#aaccf6;\n}\n\n.x-menu-check-item .x-menu-item-icon{\n\tbackground-image:url(../images/default/menu/unchecked.gif);\n}\n\n.x-menu-item-checked .x-menu-item-icon{\n\tbackground-image:url(../images/default/menu/checked.gif);\n}\n\n.x-menu-item-checked .x-menu-group-item .x-menu-item-icon{\n    background-image:url(../images/default/menu/group-checked.gif);\n}\n\n.x-menu-group-item .x-menu-item-icon{\n    background-image:none;\n}\n\n.x-menu-plain {\n\tbackground-color:#f0f0f0 !important;\n    background-image: none;\n}\n\n.x-date-menu, .x-color-menu{\n    background-color: #fff !important;\n}\n\n.x-menu .x-date-picker{\n    border-color:#a3bad9;\n}\n\n.x-cycle-menu .x-menu-item-checked {\n    border-color:#a3bae9 !important;\n    background-color:#def8f6;\n}\n\n.x-menu-scroller-top {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n\n.x-menu-scroller-bottom {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n.x-box-tl {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-tc {\n\tbackground-image: url(../images/default/box/tb.gif);\n}\n\n.x-box-tr {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-ml {\n\tbackground-image: url(../images/default/box/l.gif);\n}\n\n.x-box-mc {\n\tbackground-color: #eee;\n    background-image: url(../images/default/box/tb.gif);\n\tfont-family: \"Myriad Pro\",\"Myriad Web\",\"Tahoma\",\"Helvetica\",\"Arial\",sans-serif;\n\tcolor: #393939;\n\tfont-size: 12px;\n}\n\n.x-box-mc h3 {\n\tfont-size: 14px;\n\tfont-weight: bold;\n}\n\n.x-box-mr {\n\tbackground-image: url(../images/default/box/r.gif);\n}\n\n.x-box-bl {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-bc {\n\tbackground-image: url(../images/default/box/tb.gif);\n}\n\n.x-box-br {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-blue .x-box-bl, .x-box-blue .x-box-br, .x-box-blue .x-box-tl, .x-box-blue .x-box-tr {\n\tbackground-image: url(../images/default/box/corners-blue.gif);\n}\n\n.x-box-blue .x-box-bc, .x-box-blue .x-box-mc, .x-box-blue .x-box-tc {\n\tbackground-image: url(../images/default/box/tb-blue.gif);\n}\n\n.x-box-blue .x-box-mc {\n\tbackground-color: #c3daf9;\n}\n\n.x-box-blue .x-box-mc h3 {\n\tcolor: #17385b;\n}\n\n.x-box-blue .x-box-ml {\n\tbackground-image: url(../images/default/box/l-blue.gif);\n}\n\n.x-box-blue .x-box-mr {\n\tbackground-image: url(../images/default/box/r-blue.gif);\n}.x-combo-list {\n    border-color:#98c0f4;\n    background-color:#ddecfe;\n    font:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-combo-list-inner {\n    background-color:#fff;\n}\n\n.x-combo-list-hd {\n    font:bold 11px tahoma, arial, helvetica, sans-serif;\n    color:#15428b;\n    background-image: url(../images/default/layout/panel-title-light-bg.gif);\n    border-bottom-color:#98c0f4;\n}\n\n.x-resizable-pinned .x-combo-list-inner {\n    border-bottom-color:#98c0f4;\n}\n\n.x-combo-list-item {\n    border-color:#fff;\n}\n\n.x-combo-list .x-combo-selected{\n\tborder-color:#a3bae9 !important;\n    background-color:#dfe8f6;\n}\n\n.x-combo-list .x-toolbar {\n    border-top-color:#98c0f4;\n}\n\n.x-combo-list-small {\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n}.x-panel {\n    border-color: #99bbe8;\n}\n\n.x-panel-header {\n    color:#15428b;\n\tfont-weight:bold; \n    font-size: 11px;\n    font-family: tahoma,arial,verdana,sans-serif;\n    border-color:#99bbe8;\n    background-image: url(../images/default/panel/white-top-bottom.gif);\n}\n\n.x-panel-body {\n    border-color:#99bbe8;\n    background-color:#fff;\n}\n\n.x-panel-bbar .x-toolbar, .x-panel-tbar .x-toolbar {\n    border-color:#99bbe8;\n}\n\n.x-panel-tbar-noheader .x-toolbar, .x-panel-mc .x-panel-tbar .x-toolbar {\n    border-top-color:#99bbe8;\n}\n\n.x-panel-body-noheader, .x-panel-mc .x-panel-body {\n    border-top-color:#99bbe8;\n}\n\n.x-panel-tl .x-panel-header {\n    color:#15428b;\n\tfont:bold 11px tahoma,arial,verdana,sans-serif;\n}\n\n.x-panel-tc {\n\tbackground-image: url(../images/default/panel/top-bottom.gif);\n}\n\n.x-panel-tl, .x-panel-tr, .x-panel-bl,  .x-panel-br{\n\tbackground-image: url(../images/default/panel/corners-sprite.gif);\n    border-bottom-color:#99bbe8;\n}\n\n.x-panel-bc {\n\tbackground-image: url(../images/default/panel/top-bottom.gif);\n}\n\n.x-panel-mc {\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n    background-color:#dfe8f6;\n}\n\n.x-panel-ml {\n\tbackground-color: #fff;\n    background-image:url(../images/default/panel/left-right.gif);\n}\n\n.x-panel-mr {\n\tbackground-image: url(../images/default/panel/left-right.gif);\n}\n\n.x-tool {\n    background-image:url(../images/default/panel/tool-sprites.gif);\n}\n\n.x-panel-ghost {\n    background-color:#cbddf3;\n}\n\n.x-panel-ghost ul {\n    border-color:#99bbe8;\n}\n\n.x-panel-dd-spacer {\n    border-color:#99bbe8;\n}\n\n.x-panel-fbar td,.x-panel-fbar span,.x-panel-fbar input,.x-panel-fbar div,.x-panel-fbar select,.x-panel-fbar label{\n    font:normal 11px arial,tahoma, helvetica, sans-serif;\n}\n.x-window-proxy {\n    background-color:#c7dffc;\n    border-color:#99bbe8;\n}\n\n.x-window-tl .x-window-header {\n    color:#15428b;\n\tfont:bold 11px tahoma,arial,verdana,sans-serif;\n}\n\n.x-window-tc {\n\tbackground-image: url(../images/default/window/top-bottom.png);\n}\n\n.x-window-tl {\n\tbackground-image: url(../images/default/window/left-corners.png);\n}\n\n.x-window-tr {\n\tbackground-image: url(../images/default/window/right-corners.png);\n}\n\n.x-window-bc {\n\tbackground-image: url(../images/default/window/top-bottom.png);\n}\n\n.x-window-bl {\n\tbackground-image: url(../images/default/window/left-corners.png);\n}\n\n.x-window-br {\n\tbackground-image: url(../images/default/window/right-corners.png);\n}\n\n.x-window-mc {\n    border-color:#99bbe8;\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n    background-color:#dfe8f6;\n}\n\n.x-window-ml {\n\tbackground-image: url(../images/default/window/left-right.png);\n}\n\n.x-window-mr {\n\tbackground-image: url(../images/default/window/left-right.png);\n}\n\n.x-window-maximized .x-window-tc {\n    background-color:#fff;\n}\n\n.x-window-bbar .x-toolbar {\n    border-top-color:#99bbe8;\n}\n\n.x-panel-ghost .x-window-tl {\n    border-bottom-color:#99bbe8;\n}\n\n.x-panel-collapsed .x-window-tl {\n    border-bottom-color:#84a0c4;\n}\n\n.x-dlg-mask{\n   background-color:#ccc;\n}\n\n.x-window-plain .x-window-mc {\n    background-color: #ccd9e8;\n    border-color: #a3bae9 #dfe8f6 #dfe8f6 #a3bae9;\n}\n\n.x-window-plain .x-window-body {\n    border-color: #dfe8f6 #a3bae9 #a3bae9 #dfe8f6;\n}\n\nbody.x-body-masked .x-window-plain .x-window-mc {\n    background-color: #ccd9e8;\n}.x-html-editor-wrap {\n    border-color:#a9bfd3;\n    background-color:#fff;\n}\n.x-html-editor-tb .x-btn-text {\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}.x-panel-noborder .x-panel-header-noborder {\n    border-bottom-color:#99bbe8;\n}\n\n.x-panel-noborder .x-panel-tbar-noborder .x-toolbar {\n    border-bottom-color:#99bbe8;\n}\n\n.x-panel-noborder .x-panel-bbar-noborder .x-toolbar {\n    border-top-color:#99bbe8;\n}\n\n.x-tab-panel-bbar-noborder .x-toolbar {\n    border-top-color:#99bbe8;\n}\n\n.x-tab-panel-tbar-noborder .x-toolbar {\n    border-bottom-color:#99bbe8;\n}.x-border-layout-ct {\n    background-color:#dfe8f6;\n}\n\n.x-accordion-hd {\n\tcolor:#222;\n    font-weight:normal;\n    background-image: url(../images/default/panel/light-hd.gif);\n}\n\n.x-layout-collapsed{\n    background-color:#d2e0f2;\n\tborder-color:#98c0f4;\n}\n\n.x-layout-collapsed-over{\n    background-color:#d9e8fb;\n}\n\n.x-layout-split-west .x-layout-mini {\n    background-image:url(../images/default/layout/mini-left.gif);\n}\n.x-layout-split-east .x-layout-mini {\n    background-image:url(../images/default/layout/mini-right.gif);\n}\n.x-layout-split-north .x-layout-mini {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n.x-layout-split-south .x-layout-mini {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n\n.x-layout-cmini-west .x-layout-mini {\n    background-image:url(../images/default/layout/mini-right.gif);\n}\n\n.x-layout-cmini-east .x-layout-mini {\n    background-image:url(../images/default/layout/mini-left.gif);\n}\n\n.x-layout-cmini-north .x-layout-mini {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n\n.x-layout-cmini-south .x-layout-mini {\n    background-image:url(../images/default/layout/mini-top.gif);\n}.x-progress-wrap {\n    border-color:#6593cf;\n}\n\n.x-progress-inner {\n    background-color:#e0e8f3;\n    background-image:url(../images/default/qtip/bg.gif);\n}\n\n.x-progress-bar {\n    background-color:#9cbfee;\n    background-image:url(../images/default/progress/progress-bg.gif);\n    border-top-color:#d1e4fd;\n    border-bottom-color:#7fa9e4;\n    border-right-color:#7fa9e4;\n}\n\n.x-progress-text {\n    font-size:11px;\n    font-weight:bold;\n    color:#fff;\n}\n\n.x-progress-text-back {\n    color:#396095;\n}.x-list-header{\n    background-color:#f9f9f9;\n\tbackground-image:url(../images/default/grid/grid3-hrow.gif);\n}\n\n.x-list-header-inner div em {\n    border-left-color:#ddd;\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-list-body dt em {\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-list-over {\n    background-color:#eee;\n}\n\n.x-list-selected {\n    background-color:#dfe8f6;\n}\n\n.x-list-resizer {\n    border-left-color:#555;\n    border-right-color:#555;\n}\n\n.x-list-header-inner em.sort-asc, .x-list-header-inner em.sort-desc {\n    background-image:url(../images/default/grid/sort-hd.gif);\n    border-color: #99bbe8;\n}.x-slider-horz, .x-slider-horz .x-slider-end, .x-slider-horz .x-slider-inner {\n    background-image:url(../images/default/slider/slider-bg.png);\n}\n\n.x-slider-horz .x-slider-thumb {\n    background-image:url(../images/default/slider/slider-thumb.png);\n}\n\n.x-slider-vert, .x-slider-vert .x-slider-end, .x-slider-vert .x-slider-inner {\n    background-image:url(../images/default/slider/slider-v-bg.png);\n}\n\n.x-slider-vert .x-slider-thumb {\n    background-image:url(../images/default/slider/slider-v-thumb.png);\n}.x-window-dlg .ext-mb-text,\n.x-window-dlg .x-window-header-text {\n    font-size:12px;\n}\n\n.x-window-dlg .ext-mb-textarea {\n    font:normal 12px tahoma,arial,helvetica,sans-serif;\n}\n\n.x-window-dlg .x-msg-box-wait {\n    background-image:url(../images/default/grid/loading.gif);\n}\n\n.x-window-dlg .ext-mb-info {\n    background-image:url(../images/default/window/icon-info.gif);\n}\n\n.x-window-dlg .ext-mb-warning {\n    background-image:url(../images/default/window/icon-warning.gif);\n}\n\n.x-window-dlg .ext-mb-question {\n    background-image:url(../images/default/window/icon-question.gif);\n}\n\n.x-window-dlg .ext-mb-error {\n    background-image:url(../images/default/window/icon-error.gif);\n}"
  },
  {
    "path": "client/src/ext/resources/css/xtheme-gray.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.ext-el-mask {\n    background-color: #ccc;\n}\n\n.ext-el-mask-msg {\n    border-color:#999;\n    background-color:#ddd;\n    background-image:url(../images/gray/panel/white-top-bottom.gif);\n    background-position: 0 -1px;\n}\n.ext-el-mask-msg div {\n    background-color: #eee;\n    border-color:#d0d0d0;\n    color:#222;\n    font:normal 11px Open Sans, helvetica, sans-serif;\n}\n\n.x-mask-loading div {\n    background-color:#fbfbfb;\n    background-image:url(../images/default/grid/loading.gif);\n}\n\n.x-item-disabled {\n    color: gray;\n}\n\n.x-item-disabled * {\n    color: gray !important;\n}\n\n.x-splitbar-proxy {\n    background-color: #aaa;\n}\n\n.x-color-palette a {\n    border-color:#fff;\n}\n\n.x-color-palette a:hover, .x-color-palette a.x-color-palette-sel {\n    border-color:#CFCFCF;\n    background-color: #eaeaea;\n}\n\n/*\n.x-color-palette em:hover, .x-color-palette span:hover{   \n    background-color: #eaeaea;\n}\n*/\n\n.x-color-palette em {\n    border-color:#aca899;\n}\n\n.x-ie-shadow {\n    background-color:#777;\n}\n\n.x-shadow .xsmc {\n    background-image: url(../images/default/shadow-c.png);\n}\n\n.x-shadow .xsml, .x-shadow .xsmr {\n    background-image: url(../images/default/shadow-lr.png);\n}\n\n.x-shadow .xstl, .x-shadow .xstc,  .x-shadow .xstr, .x-shadow .xsbl, .x-shadow .xsbc, .x-shadow .xsbr{\n    background-image: url(../images/default/shadow.png);\n}\n\n.loading-indicator {\n    font-size: 11px;\n    background-image: url(../images/default/grid/loading.gif);\n}\n\n.x-spotlight {\n    background-color: #ccc;\n}.x-tab-panel-header, .x-tab-panel-footer {\n\tbackground-color: #eaeaea;\n\tborder-color:#d0d0d0;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tab-panel-header, .x-tab-panel-footer {\n\tborder-color:#d0d0d0;\n}\n\nul.x-tab-strip-top{\n    background-color:#dbdbdb;\n\tbackground-image: url(../images/gray/tabs/tab-strip-bg.gif);\n\tborder-bottom-color:#d0d0d0;\n}\n\nul.x-tab-strip-bottom{\n    background-color:#dbdbdb;\n\tbackground-image: url(../images/gray/tabs/tab-strip-btm-bg.gif);\n\tborder-top-color:#d0d0d0;\n}\n\n.x-tab-panel-header-plain .x-tab-strip-spacer,\n.x-tab-panel-footer-plain .x-tab-strip-spacer {\n    border-color:#d0d0d0;\n    background-color: #eaeaea;\n}\n\n.x-tab-strip span.x-tab-strip-text {\n\tfont:normal 11px Open Sans,Open Sans,helvetica;\n\tcolor:#333;\n}\n\n.x-tab-strip-over span.x-tab-strip-text {\n\tcolor:#111;\n}\n\n.x-tab-strip-active span.x-tab-strip-text {\n\tcolor:#333;\n    font-weight:bold;\n}\n\n.x-tab-strip-disabled .x-tabs-text {\n\tcolor:#aaaaaa;\n}\n\n.x-tab-strip-top .x-tab-right, .x-tab-strip-top .x-tab-left, .x-tab-strip-top .x-tab-strip-inner{\n\tbackground-image: url(../images/gray/tabs/tabs-sprite.gif);\n}\n\n.x-tab-strip-bottom .x-tab-right {\n\tbackground-image: url(../images/gray/tabs/tab-btm-inactive-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-left {\n\tbackground-image: url(../images/gray/tabs/tab-btm-inactive-left-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-over .x-tab-left {\n\tbackground-image: url(../images/gray/tabs/tab-btm-over-left-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-over .x-tab-right {\n\tbackground-image: url(../images/gray/tabs/tab-btm-over-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-right {\n\tbackground-image: url(../images/gray/tabs/tab-btm-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-left {\n\tbackground-image: url(../images/gray/tabs/tab-btm-left-bg.gif);\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close {\n\tbackground-image:url(../images/gray/tabs/tab-close.gif);\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close:hover{\n\tbackground-image:url(../images/gray/tabs/tab-close.gif);\n}\n\n.x-tab-panel-body {\n    border-color:#d0d0d0;\n    background-color:#fff;\n}\n\n.x-tab-panel-body-top {\n    border-top: 0 none;\n}\n\n.x-tab-panel-body-bottom {\n    border-bottom: 0 none;\n}\n\n.x-tab-scroller-left {\n    background-image:url(../images/gray/tabs/scroll-left.gif);\n    border-bottom-color:#d0d0d0;\n}\n\n.x-tab-scroller-left-over {\n    background-position: 0 0;\n}\n\n.x-tab-scroller-left-disabled {\n    background-position: -18px 0;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n    cursor:default;\n}\n\n.x-tab-scroller-right {\n    background-image:url(../images/gray/tabs/scroll-right.gif);\n    border-bottom-color:#d0d0d0;\n}\n\n.x-tab-panel-bbar .x-toolbar, .x-tab-panel-tbar .x-toolbar {\n    border-color:#d0d0d0;\n}\n.x-form-field{\n    font:normal 12px Open Sans, helvetica, sans-serif;\n}\n\n.x-form-text, textarea.x-form-field{\n    background-color:#fff;\n    background-image:url(../images/default/form/text-bg.gif);\n    border-color:#C1C1C1;\n}\n\n.x-form-select-one {\n    background-color:#fff;\n    border-color:#C1C1C1;\n}\n\n.x-form-check-group-label {\n    border-bottom: 1px solid #d0d0d0;\n    color: #333;\n}\n\n.x-editor .x-form-check-wrap {\n    background-color:#fff;\n}\n\n.x-form-field-wrap .x-form-trigger{\n    background-image:url(../images/gray/form/trigger.gif);\n    border-bottom-color:#b5b8c8;\n}\n\n.x-form-field-wrap .x-form-date-trigger{\n    background-image: url(../images/gray/form/date-trigger.gif);\n}\n\n.x-form-field-wrap .x-form-clear-trigger{\n    background-image: url(../images/gray/form/clear-trigger.gif);\n}\n\n.x-form-field-wrap .x-form-search-trigger{\n    background-image: url(../images/gray/form/search-trigger.gif);\n}\n\n.x-trigger-wrap-focus .x-form-trigger{\n    border-bottom-color: #777777;\n}\n\n.x-item-disabled .x-form-trigger-over{\n    border-bottom-color:#b5b8c8;\n}\n\n.x-item-disabled .x-form-trigger-click{\n    border-bottom-color:#b5b8c8;\n}\n\n.x-form-focus, textarea.x-form-focus{\n\tborder-color:#777777;\n}\n\n.x-form-invalid, textarea.x-form-invalid{\n    background-color:#fff;\n\tbackground-image:url(../images/default/grid/invalid_line.gif);\n\tborder-color:#c30;\n}\n\n.ext-webkit .x-form-invalid{\n\tbackground-color:#fee;\n\tborder-color:#ff7870;\n}\n\n.x-form-inner-invalid, textarea.x-form-inner-invalid{\n    background-color:#fff;\n\tbackground-image:url(../images/default/grid/invalid_line.gif);\n}\n\n.x-form-grow-sizer {\n\tfont:normal 12px Open Sans, helvetica, sans-serif;\n}\n\n.x-form-item {\n    font:normal 12px Open Sans, helvetica, sans-serif;\n}\n\n.x-form-invalid-msg {\n    color:#c0272b;\n    font:normal 11px Open Sans, helvetica, sans-serif;\n    background-image:url(../images/default/shared/warning.gif);\n}\n\n.x-form-empty-field {\n    color:gray;\n}\n\n.x-small-editor .x-form-field {\n    font:normal 11px Open Sans, helvetica, sans-serif;\n}\n\n.ext-webkit .x-small-editor .x-form-field {\n    font:normal 12px Open Sans, helvetica, sans-serif;\n}\n\n.x-form-invalid-icon {\n    background-image:url(../images/default/form/exclamation.gif);\n}\n\n.x-fieldset {\n    border-color:#CCCCCC;\n}\n\n.x-fieldset legend {\n    font:bold 11px Open Sans, helvetica, sans-serif;\n    color:#777777;\n}.x-btn{\n\tfont:normal 11px Open Sans, verdana, helvetica;\n}\n\n.x-btn button{\n    font:normal 11px Open Sans,Open Sans,verdana,helvetica;\n    color:#333;\n}\n\n.x-btn em {\n    font-style:normal;\n    font-weight:normal;\n}\n\n.x-btn-tl, .x-btn-tr, .x-btn-tc, .x-btn-ml, .x-btn-mr, .x-btn-mc, .x-btn-bl, .x-btn-br, .x-btn-bc{\n\tbackground-image:url(../images/gray/button/btn.gif);\n}\n\n.x-btn-click .x-btn-text, .x-btn-menu-active .x-btn-text, .x-btn-pressed .x-btn-text{\n    color:#000;\n}\n\n.x-btn-disabled *{\n\tcolor:gray !important;\n}\n\n.x-btn-mc em.x-btn-arrow {\n    background-image:url(../images/default/button/arrow.gif);\n}\n\n.x-btn-mc em.x-btn-split {\n    background-image:url(../images/default/button/s-arrow.gif);\n}\n\n.x-btn-over .x-btn-mc em.x-btn-split, .x-btn-click .x-btn-mc em.x-btn-split, .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-btn-pressed .x-btn-mc em.x-btn-split {\n    background-image:url(../images/gray/button/s-arrow-o.gif);\n}\n\n.x-btn-mc em.x-btn-arrow-bottom {\n    background-image:url(../images/default/button/s-arrow-b-noline.gif);\n}\n\n.x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/default/button/s-arrow-b.gif);\n}\n\n.x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-btn-click .x-btn-mc em.x-btn-split-bottom, .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-btn-pressed .x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/gray/button/s-arrow-bo.gif);\n}\n\n.x-btn-group-header {\n    color: #666;\n}\n\n.x-btn-group-tc {\n\tbackground-image: url(../images/gray/button/group-tb.gif);\n}\n\n.x-btn-group-tl {\n\tbackground-image: url(../images/gray/button/group-cs.gif);\n}\n\n.x-btn-group-tr {\n\tbackground-image: url(../images/gray/button/group-cs.gif);\n}\n\n.x-btn-group-bc {\n\tbackground-image: url(../images/gray/button/group-tb.gif);\n}\n\n.x-btn-group-bl {\n\tbackground-image: url(../images/gray/button/group-cs.gif);\n}\n\n.x-btn-group-br {\n\tbackground-image: url(../images/gray/button/group-cs.gif);\n}\n\n.x-btn-group-ml {\n\tbackground-image: url(../images/gray/button/group-lr.gif);\n}\n.x-btn-group-mr {\n\tbackground-image: url(../images/gray/button/group-lr.gif);\n}\n\n.x-btn-group-notitle .x-btn-group-tc {\n\tbackground-image: url(../images/gray/button/group-tb.gif);\n}\n.x-toolbar{\n\tborder-color:#d0d0d0;\n    background-color:#f0f0f0;\n    background-image:url(../images/gray/toolbar/bg.gif);\n}\n\n.x-toolbar td,.x-toolbar span,.x-toolbar input,.x-toolbar div,.x-toolbar select,.x-toolbar label{\n    font:normal 11px Open Sans,Open Sans, helvetica, sans-serif;\n}\n\n.x-toolbar .x-item-disabled {\n\tcolor:gray;\n}\n\n.x-toolbar .x-item-disabled * {\n\tcolor:gray;\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split {\n    background-image:url(../images/default/button/s-arrow-noline.gif);\n}\n\n.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-click .x-btn-mc em.x-btn-split, \n.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split \n{\n    background-image:url(../images/gray/button/s-arrow-o.gif);\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/default/button/s-arrow-b-noline.gif);\n}\n\n.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-click .x-btn-mc em.x-btn-split-bottom, \n.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split-bottom \n{\n    background-image:url(../images/gray/button/s-arrow-bo.gif);\n}\n\n.x-toolbar .xtb-sep {\n\tbackground-image: url(../images/default/grid/grid-split.gif);\n}\n\n.x-tbar-page-first{\n\tbackground-image: url(../images/gray/grid/page-first.gif) !important;\n}\n\n.x-tbar-loading{\n\tbackground-image: url(../images/gray/grid/refresh.gif) !important;\n}\n\n.x-tbar-page-last{\n\tbackground-image: url(../images/gray/grid/page-last.gif) !important;\n}\n\n.x-tbar-page-next{\n\tbackground-image: url(../images/gray/grid/page-next.gif) !important;\n}\n\n.x-tbar-page-prev{\n\tbackground-image: url(../images/gray/grid/page-prev.gif) !important;\n}\n\n.x-item-disabled .x-tbar-loading{\n\tbackground-image: url(../images/default/grid/loading.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-first{\n\tbackground-image: url(../images/default/grid/page-first-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-last{\n\tbackground-image: url(../images/default/grid/page-last-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-next{\n\tbackground-image: url(../images/default/grid/page-next-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-prev{\n\tbackground-image: url(../images/default/grid/page-prev-disabled.gif) !important;\n}\n\n.x-paging-info {\n    color:#444;\n}\n\n.x-toolbar-more-icon {\n    background-image: url(../images/gray/toolbar/more.gif) !important;\n}\n.x-resizable-handle {\n\tbackground-color:#fff;\n}\n\n.x-resizable-over .x-resizable-handle-east, .x-resizable-pinned .x-resizable-handle-east,\n.x-resizable-over .x-resizable-handle-west, .x-resizable-pinned .x-resizable-handle-west\n{\n    background-image:url(../images/gray/sizer/e-handle.gif);\n}\n\n.x-resizable-over .x-resizable-handle-south, .x-resizable-pinned .x-resizable-handle-south,\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north\n{\n    background-image:url(../images/gray/sizer/s-handle.gif);\n}\n\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north{\n    background-image:url(../images/gray/sizer/s-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-southeast, .x-resizable-pinned .x-resizable-handle-southeast{\n    background-image:url(../images/gray/sizer/se-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-northwest, .x-resizable-pinned .x-resizable-handle-northwest{\n    background-image:url(../images/gray/sizer/nw-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-northeast, .x-resizable-pinned .x-resizable-handle-northeast{\n    background-image:url(../images/gray/sizer/ne-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-southwest, .x-resizable-pinned .x-resizable-handle-southwest{\n    background-image:url(../images/gray/sizer/sw-handle.gif);\n}\n.x-resizable-proxy{\n    border-color:#565656;\n}\n.x-resizable-overlay{\n    background-color:#fff;\n}\n.x-grid3 {\n    background-color:#fff;\n}\n\n.x-grid-panel .x-panel-mc .x-panel-body {\n    border-color:#d0d0d0;\n}\n\n.x-grid3-row td, .x-grid3-summary-row td{\n    font:normal 11px/13px Open Sans, helvetica, sans-serif;\n}\n\n.x-grid3-hd-row td {\n    font:normal 11px/15px Open Sans, helvetica, sans-serif;\n}\n\n.x-grid3-hd-row td {\n    border-left-color:#eee;\n    border-right-color:#d0d0d0;\n}\n\n.x-grid-row-loading {\n    background-color: #fff;\n    background-image:url(../images/default/shared/loading-balls.gif);\n}\n\n.x-grid3-row {\n    border-color:#ededed;\n    border-top-color:#fff;\n}\n\n.x-grid3-row-alt{\n\tbackground-color:#fafafa;\n}\n\n.x-grid3-row-over {\n\tborder-color:#ddd;\n    background-color:#efefef;\n    /* background-image:url(../images/default/grid/row-over.gif); */\n}\n\n.x-grid3-resize-proxy {\n    background-color:#777;\n}\n\n.x-grid3-resize-marker {\n    background-color:#777;\n}\n\n.x-grid3-header{\n    background-color:#f9f9f9;\n\tbackground-image:url(../images/gray/grid/grid3-hrow2.gif);\n}\n\n.x-grid3-header-pop {\n    border-left-color:#d0d0d0;\n}\n\n.x-grid3-header-pop-inner {\n    border-left-color:#eee;\n    background-image:url(../images/default/grid/hd-pop.gif);\n}\n\ntd.x-grid3-hd-over, td.sort-desc, td.sort-asc, td.x-grid3-hd-menu-open {\n    border-left-color:#ACACAC;\n    border-right-color:#ACACAC;\n}\n\ntd.x-grid3-hd-over .x-grid3-hd-inner, td.sort-desc .x-grid3-hd-inner, td.sort-asc .x-grid3-hd-inner, td.x-grid3-hd-menu-open .x-grid3-hd-inner {\n    background-color:#f9f9f9;\n    background-image:url(../images/gray/grid/grid3-hrow-over2.gif);\n\n}\n\n.sort-asc .x-grid3-sort-icon {\n\tbackground-image: url(../images/gray/grid/sort_asc.gif);\n}\n\n.sort-desc .x-grid3-sort-icon {\n\tbackground-image: url(../images/gray/grid/sort_desc.gif);\n}\n\n.x-grid3-cell-text, .x-grid3-hd-text {\n\tcolor:#000;\n}\n\n.x-grid3-split {\n\tbackground-image: url(../images/default/grid/grid-split.gif);\n}\n\n.x-grid3-hd-text {\n\tcolor:#333;\n}\n\n.x-dd-drag-proxy .x-grid3-hd-inner{\n    background-color:#f9f9f9;\n\tbackground-image:url(../images/gray/grid/grid3-hrow-over2.gif);\n\tborder-color:#ACACAC;\n}\n\n.col-move-top{\n\tbackground-image:url(../images/gray/grid/col-move-top.gif);\n}\n\n.col-move-bottom{\n\tbackground-image:url(../images/gray/grid/col-move-bottom.gif);\n}\n\n.x-grid3-row-selected {\n\tbackground-color:#CCCCCC !important;\n\tbackground-image: none;\n\tborder-color:#ACACAC;\n}\n\n.x-grid3-cell-selected{\n\tbackground-color: #CBCBCB !important;\n\tcolor:#000;\n}\n\n.x-grid3-cell-selected span{\n\tcolor:#000 !important;\n}\n\n.x-grid3-cell-selected .x-grid3-cell-text{\n\tcolor:#000;\n}\n\n.x-grid3-locked td.x-grid3-row-marker, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker{\n    background-color:#ebeadb !important;\n    background-image:url(../images/default/grid/grid-hrow.gif) !important;\n    color:#000;\n    border-top-color:#fff;\n    border-right-color:#6fa0df !important;\n}\n\n.x-grid3-locked td.x-grid3-row-marker div, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker div{\n    color:#333 !important;\n}\n\n.x-grid3-dirty-cell {\n    background-image:url(../images/default/grid/dirty.gif);\n}\n\n.x-grid3-topbar, .x-grid3-bottombar{\n\tfont:normal 11px Open Sans, helvetica, sans-serif;\n}\n\n.x-grid3-bottombar .x-toolbar{\n\tborder-top-color:#a9bfd3;\n}\n\n.x-props-grid .x-grid3-td-name .x-grid3-cell-inner{\n\tbackground-image:url(../images/default/grid/grid3-special-col-bg.gif) !important;\n    color:#000 !important;\n}\n\n.x-props-grid .x-grid3-body .x-grid3-td-name{\n    background-color:#fff !important;\n    border-right-color:#eee;\n}\n\n.xg-hmenu-sort-asc .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-asc.gif);\n}\n\n.xg-hmenu-sort-desc .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-desc.gif);\n}\n\n.xg-hmenu-lock .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-lock.gif);\n}\n\n.xg-hmenu-unlock .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-unlock.gif);\n}\n\n.x-grid3-hd-btn {\n    background-color:#f9f9f9;\n    background-image:url(../images/gray/grid/grid3-hd-btn.gif);\n}\n\n.x-grid3-body .x-grid3-td-expander {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-row-expander {\n    background-image:url(../images/gray/grid/row-expand-sprite.gif);\n}\n\n.x-grid3-body .x-grid3-td-checker {\n    background-image: url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-row-checker, .x-grid3-hd-checker {\n    background-image:url(../images/default/grid/row-check-sprite.gif);\n}\n\n.x-grid3-body .x-grid3-td-numberer {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-body .x-grid3-td-numberer .x-grid3-cell-inner {\n\tcolor:#444;\n}\n\n.x-grid3-body .x-grid3-td-row-icon {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-numberer,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-checker,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-expander {\n\tbackground-image:url(../images/gray/grid/grid3-special-col-sel-bg.gif);\n}\n\n.x-grid3-check-col {\n\tbackground-image:url(../images/default/menu/unchecked.gif);\n}\n\n.x-grid3-check-col-on {\n\tbackground-image:url(../images/default/menu/checked.gif);\n}\n\n.x-grid-group, .x-grid-group-body, .x-grid-group-hd {\n    zoom:1;\n}\n\n.x-grid-group-hd {\n    border-bottom-color:#d0d0d0;\n}\n\n.x-grid-group-hd div.x-grid-group-title {\n    background-image:url(../images/gray/grid/group-collapse.gif);\n    color:#5F5F5F;\n    font:bold 11px Open Sans, helvetica, sans-serif;\n}\n\n.x-grid-group-collapsed .x-grid-group-hd div.x-grid-group-title {\n    background-image:url(../images/gray/grid/group-expand.gif);\n}\n\n.x-group-by-icon {\n    background-image:url(../images/default/grid/group-by.gif);\n}\n\n.x-cols-icon {\n    background-image:url(../images/default/grid/columns.gif);\n}\n\n.x-show-groups-icon {\n    background-image:url(../images/default/grid/group-by.gif);\n}\n\n.x-grid-empty {\n    color:gray;\n    font:normal 11px Open Sans, helvetica, sans-serif;\n}\n\n.x-grid-with-col-lines .x-grid3-row td.x-grid3-cell {\n    border-right-color:#ededed;\n}\n\n.x-grid-with-col-lines .x-grid3-row{\n    border-top-color:#ededed;\n}\n\n.x-grid-with-col-lines .x-grid3-row-selected {\n\tborder-top-color:#B9B9B9;\n}\n.x-pivotgrid .x-grid3-header-offset table td {\n    background: url(../images/gray/grid/grid3-hrow2.gif) repeat-x 50% 100%;\n    border-left: 1px solid;\n    border-right: 1px solid;\n    border-left-color: #D0D0D0;\n    border-right-color: #D0D0D0;\n}\n\n.x-pivotgrid .x-grid3-row-headers {\n    background-color: #f9f9f9;\n}\n\n.x-pivotgrid .x-grid3-row-headers table td {\n    background: #EEE url(../images/default/grid/grid3-rowheader.gif) repeat-x left top;\n    border-left: 1px solid;\n    border-right: 1px solid;\n    border-left-color: #EEE;\n    border-right-color: #D0D0D0;\n    border-bottom: 1px solid;\n    border-bottom-color: #D0D0D0;\n    height: 18px;\n}\n.x-dd-drag-ghost{\n\tcolor:#000;\n\tfont: normal 11px Open Sans, helvetica, sans-serif;\n    border-color: #ddd #bbb #bbb #ddd;\n\tbackground-color:#fff;\n}\n\n.x-dd-drop-nodrop .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-no.gif);\n}\n\n.x-dd-drop-ok .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-yes.gif);\n}\n\n.x-dd-drop-ok-add .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-add.gif);\n}\n\n.x-view-selector {\n    background-color:#D6D6D6;\n    border-color:#888888;\n}.x-tree-node-expanded .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/folder-open.gif);\n}\n\n.x-tree-node-leaf .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/leaf.gif);\n}\n\n.x-tree-node-collapsed .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/folder.gif);\n}\n\n.x-tree-node-loading .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/loading.gif) !important;\n}\n\n.x-tree-node .x-tree-node-inline-icon {\n    background-image: none;\n}\n\n.x-tree-node-loading a span{\n\t font-style: italic;\n\t color:#444444;\n}\n\n.ext-ie .x-tree-node-el input {\n    width:15px;\n    height:15px;\n}\n\n.x-tree-lines .x-tree-elbow{\n\tbackground-image:url(../images/default/tree/elbow.gif);\n}\n\n.x-tree-lines .x-tree-elbow-plus{\n\tbackground-image:url(../images/default/tree/elbow-plus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-minus{\n\tbackground-image:url(../images/default/tree/elbow-minus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end{\n\tbackground-image:url(../images/default/tree/elbow-end.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end-plus{\n\tbackground-image:url(../images/gray/tree/elbow-end-plus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end-minus{\n\tbackground-image:url(../images/gray/tree/elbow-end-minus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-line{\n\tbackground-image:url(../images/default/tree/elbow-line.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-plus{\n\tbackground-image:url(../images/default/tree/elbow-plus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-minus{\n\tbackground-image:url(../images/default/tree/elbow-minus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-end-plus{\n\tbackground-image:url(../images/gray/tree/elbow-end-plus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-end-minus{\n\tbackground-image:url(../images/gray/tree/elbow-end-minus-nl.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-plus{\n    background-image:url(../images/gray/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-minus{\n    background-image:url(../images/gray/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-end-plus{\n    background-image:url(../images/gray/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-end-minus{\n    background-image:url(../images/gray/tree/arrows.gif);\n}\n\n.x-tree-node{\n\tcolor:#000;\n\tfont: normal 11px Open Sans, helvetica, sans-serif;\n}\n\n.x-tree-node a, .x-dd-drag-ghost a{\n\tcolor:#000;\n}\n\n.x-tree-node a span, .x-dd-drag-ghost a span{\n\tcolor:#000;\n}\n\n.x-tree-node .x-tree-node-disabled a span{\n\tcolor:gray !important;\n}\n\n.x-tree-node div.x-tree-drag-insert-below{\n \t border-bottom-color:#36c;\n}\n\n.x-tree-node div.x-tree-drag-insert-above{\n\t border-top-color:#36c;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below a{\n \t border-bottom-color:#36c;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above a{\n\t border-top-color:#36c;\n}\n\n.x-tree-node .x-tree-drag-append a span{\n\t background-color:#ddd;\n\t border-color:gray;\n}\n\n.x-tree-node .x-tree-node-over {\n\tbackground-color: #eee;\n}\n\n.x-tree-node .x-tree-selected {\n\tbackground-color: #ddd;\n}\n\n.x-tree-drop-ok-append .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-add.gif);\n}\n\n.x-tree-drop-ok-above .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-over.gif);\n}\n\n.x-tree-drop-ok-below .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-under.gif);\n}\n\n.x-tree-drop-ok-between .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-between.gif);\n}\n.x-date-picker {\n    border-color:#585858;\n    background-color:#fff;\n}\n\n.x-date-middle,.x-date-left,.x-date-right {\n\tbackground-image: url(../images/gray/shared/hd-sprite.gif);\n\tcolor:#fff;\n\tfont:bold 11px \"sans serif\", Open Sans, verdana, helvetica;\n}\n\n.x-date-middle .x-btn .x-btn-text {\n    color:#fff;\n}\n\n.x-date-middle .x-btn-mc em.x-btn-arrow {\n    background-image:url(../images/gray/toolbar/btn-arrow-light.gif);\n}\n\n.x-date-right a {\n    background-image: url(../images/gray/shared/right-btn.gif);\n}\n\n.x-date-left a{\n\tbackground-image: url(../images/gray/shared/left-btn.gif);\n}\n\n.x-date-inner th {\n    background-color:#D8D8D8;\n    background-image: url(../images/gray/panel/white-top-bottom.gif);\n\tborder-bottom-color:#AFAFAF;\n    font:normal 10px Open Sans, helvetica,Open Sans,sans-serif;\n\tcolor:#595959;\n}\n\n.x-date-inner td {\n    border-color:#fff;\n}\n\n.x-date-inner a {\n    font:normal 11px Open Sans, helvetica,Open Sans,sans-serif;\n    color:#000;\n}\n\n.x-date-inner .x-date-active{\n\tcolor:#000;\n}\n\n.x-date-inner .x-date-selected a{\n    background-image: none;\n    background-color:#D8D8D8;\n\tborder-color:#DCDCDC;\n}\n\n.x-date-inner .x-date-today a{\n\tborder-color:darkred;\n}\n\n.x-date-inner .x-date-selected span{\n    font-weight:bold;\n}\n\n.x-date-inner .x-date-prevday a,.x-date-inner .x-date-nextday a {\n\tcolor:#aaa;\n}\n\n.x-date-bottom {\n    border-top-color:#AFAFAF;\n    background-color:#D8D8D8;\n    background:#D8D8D8 url(../images/gray/panel/white-top-bottom.gif) 0 -2px;\n}\n\n.x-date-inner a:hover, .x-date-inner .x-date-disabled a:hover{\n    color:#000;\n    background-color:#D8D8D8;\n}\n\n.x-date-inner .x-date-disabled a {\n\tbackground-color:#eee;\n\tcolor:#bbb;\n}\n\n.x-date-mmenu{\n    background-color:#eee !important;\n}\n\n.x-date-mmenu .x-menu-item {\n\tfont-size:10px;\n\tcolor:#000;\n}\n\n.x-date-mp {\n\tbackground-color:#fff;\n}\n\n.x-date-mp td {\n\tfont:normal 11px Open Sans, helvetica,Open Sans,sans-serif;\n}\n\n.x-date-mp-btns button {\n\tbackground-color:#4E565F;\n\tcolor:#fff;\n\tborder-color:#C0C0C0 #434343 #434343 #C0C0C0;\n\tfont:normal 11px Open Sans, helvetica,Open Sans,sans-serif;\n}\n\n.x-date-mp-btns {\n    background-color:#D8D8D8;\n    background:#D8D8D8 url(../images/gray/panel/white-top-bottom.gif) 0 -2px;\n}\n\n.x-date-mp-btns td {\n\tborder-top-color:#AFAFAF;\n}\n\ntd.x-date-mp-month a,td.x-date-mp-year a {\n\tcolor: #333;\n}\n\ntd.x-date-mp-month a:hover,td.x-date-mp-year a:hover {\n\tcolor:#333;\n\tbackground-color:#FDFDFD;\n}\n\ntd.x-date-mp-sel a {\n    background-color:#D8D8D8;\n    background:#D8D8D8 url(../images/gray/panel/white-top-bottom.gif) 0 -2px;\n\tborder-color:#DCDCDC;\n}\n\n.x-date-mp-ybtn a {\n    background-image:url(../images/gray/panel/tool-sprites.gif);\n}\n\ntd.x-date-mp-sep {\n   border-right-color:#D7D7D7;\n}.x-tip .x-tip-close{\n\tbackground-image: url(../images/gray/qtip/close.gif);\n}\n\n.x-tip .x-tip-tc, .x-tip .x-tip-tl, .x-tip .x-tip-tr, .x-tip .x-tip-bc, .x-tip .x-tip-bl, .x-tip .x-tip-br, .x-tip .x-tip-ml, .x-tip .x-tip-mr {\n\tbackground-image: url(../images/gray/qtip/tip-sprite.gif);\n}\n\n.x-tip .x-tip-mc {\n    font: normal 11px Open Sans,Open Sans,helvetica,sans-serif;\n}\n.x-tip .x-tip-ml {\n\tbackground-color: #fff;\n}\n\n.x-tip .x-tip-header-text {\n    font: bold 11px Open Sans,Open Sans,helvetica,sans-serif;\n    color:#444;\n}\n\n.x-tip .x-tip-body {\n    font: normal 11px Open Sans,Open Sans,helvetica,sans-serif;\n    color:#444;\n}\n\n.x-form-invalid-tip .x-tip-tc, .x-form-invalid-tip .x-tip-tl, .x-form-invalid-tip .x-tip-tr, .x-form-invalid-tip .x-tip-bc,\n.x-form-invalid-tip .x-tip-bl, .x-form-invalid-tip .x-tip-br, .x-form-invalid-tip .x-tip-ml, .x-form-invalid-tip .x-tip-mr\n{\n\tbackground-image: url(../images/default/form/error-tip-corners.gif);\n}\n\n.x-form-invalid-tip .x-tip-body {\n    background-image:url(../images/default/form/exclamation.gif);\n}\n\n.x-tip-anchor {\n    background-image:url(../images/gray/qtip/tip-anchor-sprite.gif);\n}.x-menu {\n    background-color:#f0f0f0;\n\tbackground-image:url(../images/default/menu/menu.gif);\n}\n\n.x-menu-floating{\n    border-color:#7D7D7D;\n}\n\n.x-menu-nosep {\n\tbackground-image:none;\n}\n\n.x-menu-list-item{\n\tfont:normal 11px Open Sans,Open Sans,sans-serif;\n}\n\n.x-menu-item-arrow{\n\tbackground-image:url(../images/gray/menu/menu-parent.gif);\n}\n\n.x-menu-sep {\n    background-color:#e0e0e0;\n\tborder-bottom-color:#fff;\n}\n\na.x-menu-item {\n\tcolor:#222;\n}\n\n.x-menu-item-active {\n    background-image: url(../images/gray/menu/item-over.gif);\n\tbackground-color: #f1f1f1;\n    border-color:#ACACAC;\n}\n\n.x-menu-item-active a.x-menu-item {\n\tborder-color:#ACACAC;\n}\n\n.x-menu-check-item .x-menu-item-icon{\n\tbackground-image:url(../images/default/menu/unchecked.gif);\n}\n\n.x-menu-item-checked .x-menu-item-icon{\n\tbackground-image:url(../images/default/menu/checked.gif);\n}\n\n.x-menu-item-checked .x-menu-group-item .x-menu-item-icon{\n    background-image:url(../images/gray/menu/group-checked.gif);\n}\n\n.x-menu-group-item .x-menu-item-icon{\n    background-image:none;\n}\n\n.x-menu-plain {\n\tbackground-color:#fff !important;\n}\n\n.x-menu .x-date-picker{\n    border-color:#AFAFAF;\n}\n\n.x-cycle-menu .x-menu-item-checked {\n    border-color:#B9B9B9 !important;\n    background-color:#F1F1F1;\n}\n\n.x-menu-scroller-top {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n\n.x-menu-scroller-bottom {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}.x-box-tl {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-tc {\n\tbackground-image: url(../images/default/box/tb.gif);\n}\n\n.x-box-tr {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-ml {\n\tbackground-image: url(../images/default/box/l.gif);\n}\n\n.x-box-mc {\n\tbackground-color: #eee;\n    background-image: url(../images/default/box/tb.gif);\n\tfont-family: \"Myriad Pro\",\"Myriad Web\",\"Open Sans\",\"Helvetica\",\"Open Sans\",sans-serif;\n\tcolor: #393939;\n\tfont-size: 12px;\n}\n\n.x-box-mc h3 {\n\tfont-size: 14px;\n\tfont-weight: bold;\n}\n\n.x-box-mr {\n\tbackground-image: url(../images/default/box/r.gif);\n}\n\n.x-box-bl {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-bc {\n\tbackground-image: url(../images/default/box/tb.gif);\n}\n\n.x-box-br {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-blue .x-box-bl, .x-box-blue .x-box-br, .x-box-blue .x-box-tl, .x-box-blue .x-box-tr {\n\tbackground-image: url(../images/default/box/corners-blue.gif);\n}\n\n.x-box-blue .x-box-bc, .x-box-blue .x-box-mc, .x-box-blue .x-box-tc {\n\tbackground-image: url(../images/default/box/tb-blue.gif);\n}\n\n.x-box-blue .x-box-mc {\n\tbackground-color: #c3daf9;\n}\n\n.x-box-blue .x-box-mc h3 {\n\tcolor: #17385b;\n}\n\n.x-box-blue .x-box-ml {\n\tbackground-image: url(../images/default/box/l-blue.gif);\n}\n\n.x-box-blue .x-box-mr {\n\tbackground-image: url(../images/default/box/r-blue.gif);\n}\n.x-combo-list {\n    border-color:#ccc;\n    background-color:#ddd;\n    font:normal 12px Open Sans, helvetica, sans-serif;\n}\n\n.x-combo-list-inner {\n    background-color:#fff;\n}\n\n.x-combo-list-hd {\n    font:bold 11px Open Sans, helvetica, sans-serif;\n    color:#333;\n    background-image: url(../images/default/layout/panel-title-light-bg.gif);\n    border-bottom-color:#BCBCBC;\n}\n\n.x-resizable-pinned .x-combo-list-inner {\n    border-bottom-color:#BEBEBE;\n}\n\n.x-combo-list-item {\n    border-color:#fff;\n}\n\n.x-combo-list .x-combo-selected{\n\tborder-color:#777 !important;\n    background-color:#f0f0f0;\n}\n\n.x-combo-list .x-toolbar {\n    border-top-color:#BCBCBC;\n}\n\n.x-combo-list-small {\n    font:normal 11px Open Sans, helvetica, sans-serif;\n}.x-panel {\n    border-color: #d0d0d0;\n}\n\n.x-panel-header {\n    color:#333;\n\tfont-weight:bold; \n    font-size: 11px;\n    font-family: Open Sans,Open Sans,verdana,sans-serif;\n    border-color:#d0d0d0;\n    background-image: url(../images/gray/panel/white-top-bottom.gif);\n}\n\n.x-panel-body {\n    border-color:#d0d0d0;\n    background-color:#fff;\n}\n\n.x-panel-bbar .x-toolbar, .x-panel-tbar .x-toolbar {\n    border-color:#d0d0d0;\n}\n\n.x-panel-tbar-noheader .x-toolbar, .x-panel-mc .x-panel-tbar .x-toolbar {\n    border-top-color:#d0d0d0;\n}\n\n.x-panel-body-noheader, .x-panel-mc .x-panel-body {\n    border-top-color:#d0d0d0;\n}\n\n.x-panel-tl .x-panel-header {\n    color:#333;\n\tfont:bold 11px Open Sans,Open Sans,verdana,sans-serif;\n}\n\n.x-panel-tc {\n\tbackground-image: url(../images/gray/panel/top-bottom.gif);\n}\n\n.x-panel-tl, .x-panel-tr, .x-panel-bl,  .x-panel-br{\n\tbackground-image: url(../images/gray/panel/corners-sprite.gif);\n    border-bottom-color:#d0d0d0;\n}\n\n.x-panel-bc {\n\tbackground-image: url(../images/gray/panel/top-bottom.gif);\n}\n\n.x-panel-mc {\n    font: normal 11px Open Sans,Open Sans,helvetica,sans-serif;\n    background-color:#f1f1f1;\n}\n\n.x-panel-ml {\n\tbackground-color: #fff;\n    background-image:url(../images/gray/panel/left-right.gif);\n}\n\n.x-panel-mr {\n\tbackground-image: url(../images/gray/panel/left-right.gif);\n}\n\n.x-tool {\n    background-image:url(../images/gray/panel/tool-sprites.gif);\n}\n\n.x-panel-ghost {\n    background-color:#f2f2f2;\n}\n\n.x-panel-ghost ul {\n    border-color:#d0d0d0;\n}\n\n.x-panel-dd-spacer {\n    border-color:#d0d0d0;\n}\n\n.x-panel-fbar td,.x-panel-fbar span,.x-panel-fbar input,.x-panel-fbar div,.x-panel-fbar select,.x-panel-fbar label{\n    font:normal 11px Open Sans,Open Sans, helvetica, sans-serif;\n}\n.x-window-proxy {\n    background-color:#fcfcfc;\n    border-color:#d0d0d0;\n}\n\n.x-window-tl .x-window-header {\n    color:#555;\n\tfont:bold 11px Open Sans,Open Sans,verdana,sans-serif;\n}\n\n.x-window-tc {\n\tbackground-image: url(../images/gray/window/top-bottom.png);\n}\n\n.x-window-tl {\n\tbackground-image: url(../images/gray/window/left-corners.png);\n}\n\n.x-window-tr {\n\tbackground-image: url(../images/gray/window/right-corners.png);\n}\n\n.x-window-bc {\n\tbackground-image: url(../images/gray/window/top-bottom.png);\n}\n\n.x-window-bl {\n\tbackground-image: url(../images/gray/window/left-corners.png);\n}\n\n.x-window-br {\n\tbackground-image: url(../images/gray/window/right-corners.png);\n}\n\n.x-window-mc {\n    border-color:#d0d0d0;\n    font: normal 11px Open Sans,Open Sans,helvetica,sans-serif;\n    background-color:#e8e8e8;\n}\n\n.x-window-ml {\n\tbackground-image: url(../images/gray/window/left-right.png);\n}\n\n.x-window-mr {\n\tbackground-image: url(../images/gray/window/left-right.png);\n}\n\n.x-window-maximized .x-window-tc {\n    background-color:#fff;\n}\n\n.x-window-bbar .x-toolbar {\n    border-top-color:#d0d0d0;\n}\n\n.x-panel-ghost .x-window-tl {\n    border-bottom-color:#d0d0d0;\n}\n\n.x-panel-collapsed .x-window-tl {\n    border-bottom-color:#d0d0d0;\n}\n\n.x-dlg-mask{\n   background-color:#ccc;\n}\n\n.x-window-plain .x-window-mc {\n    background-color: #E8E8E8;\n    border-color: #D0D0D0 #EEEEEE #EEEEEE #D0D0D0;\n}\n\n.x-window-plain .x-window-body {\n    border-color: #EEEEEE #D0D0D0 #D0D0D0 #EEEEEE;\n}\n\nbody.x-body-masked .x-window-plain .x-window-mc {\n    background-color: #E4E4E4;\n}\n.x-html-editor-wrap {\n    border-color:#BCBCBC;\n    background-color:#fff;\n}\n.x-html-editor-tb .x-btn-text {\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}\n.x-panel-noborder .x-panel-header-noborder {\n    border-bottom-color:#d0d0d0;\n}\n\n.x-panel-noborder .x-panel-tbar-noborder .x-toolbar {\n    border-bottom-color:#d0d0d0;\n}\n\n.x-panel-noborder .x-panel-bbar-noborder .x-toolbar {\n    border-top-color:#d0d0d0;\n}\n\n.x-tab-panel-bbar-noborder .x-toolbar {\n    border-top-color:#d0d0d0;\n}\n\n.x-tab-panel-tbar-noborder .x-toolbar {\n    border-bottom-color:#d0d0d0;\n}\n\n.x-border-layout-ct {\n    background-color:#f0f0f0;\n}\n.x-border-layout-ct {\n    background-color:#f0f0f0;\n}\n\n.x-accordion-hd {\n\tcolor:#222;\n    font-weight:normal;\n    background-image: url(../images/gray/panel/light-hd.gif);\n}\n\n.x-layout-collapsed{\n    background-color:#dfdfdf;\n\tborder-color:#d0d0d0;\n}\n\n.x-layout-collapsed-over{\n    background-color:#e7e7e7;\n}\n\n.x-layout-split-west .x-layout-mini {\n    background-image:url(../images/default/layout/mini-left.gif);\n}\n.x-layout-split-east .x-layout-mini {\n    background-image:url(../images/default/layout/mini-right.gif);\n}\n.x-layout-split-north .x-layout-mini {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n.x-layout-split-south .x-layout-mini {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n\n.x-layout-cmini-west .x-layout-mini {\n    background-image:url(../images/default/layout/mini-right.gif);\n}\n\n.x-layout-cmini-east .x-layout-mini {\n    background-image:url(../images/default/layout/mini-left.gif);\n}\n\n.x-layout-cmini-north .x-layout-mini {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n\n.x-layout-cmini-south .x-layout-mini {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n.x-progress-wrap {\n    border-color:#8E8E8E;\n}\n\n.x-progress-inner {\n    background-color:#E7E7E7;\n    background-image:url(../images/gray/qtip/bg.gif);\n}\n\n.x-progress-bar {\n    background-color:#BCBCBC;\n    background-image:url(../images/gray/progress/progress-bg.gif);\n    border-top-color:#E2E2E2;\n    border-bottom-color:#A4A4A4;\n    border-right-color:#A4A4A4;\n}\n\n.x-progress-text {\n    font-size:11px;\n    font-weight:bold;\n    color:#fff;\n}\n\n.x-progress-text-back {\n    color:#5F5F5F;\n}\n.x-list-header{\n    background-color:#f9f9f9;\n\tbackground-image:url(../images/gray/grid/grid3-hrow2.gif);\n}\n\n.x-list-header-inner div em {\n    border-left-color:#ddd;\n    font:normal 11px Open Sans, helvetica, sans-serif;\n}\n\n.x-list-body dt em {\n    font:normal 11px Open Sans, helvetica, sans-serif;\n}\n\n.x-list-over {\n    background-color:#eee;\n}\n\n.x-list-selected {\n    background-color:#f0f0f0;\n}\n\n.x-list-resizer {\n    border-left-color:#555;\n    border-right-color:#555;\n}\n\n.x-list-header-inner em.sort-asc, .x-list-header-inner em.sort-desc {\n    background-image:url(../images/gray/grid/sort-hd.gif);\n    border-color: #d0d0d0;\n}\n.x-slider-horz, .x-slider-horz .x-slider-end, .x-slider-horz .x-slider-inner {\n    background-image:url(../images/default/slider/slider-bg.png);\n}\n\n.x-slider-horz .x-slider-thumb {\n    background-image:url(../images/gray/slider/slider-thumb.png);\n}\n\n.x-slider-vert, .x-slider-vert .x-slider-end, .x-slider-vert .x-slider-inner {\n    background-image:url(../images/default/slider/slider-v-bg.png);\n}\n\n.x-slider-vert .x-slider-thumb {\n    background-image:url(../images/gray/slider/slider-v-thumb.png);\n}\n.x-window-dlg .ext-mb-text,\n.x-window-dlg .x-window-header-text {\n    font-size:12px;\n}\n\n.x-window-dlg .ext-mb-textarea {\n    font:normal 12px Open Sans,Open Sans,helvetica,sans-serif;\n}\n\n.x-window-dlg .x-msg-box-wait {\n    background-image:url(../images/default/grid/loading.gif);\n}\n\n.x-window-dlg .ext-mb-info {\n    background-image:url(../images/gray/window/icon-info.gif);\n}\n\n.x-window-dlg .ext-mb-warning {\n    background-image:url(../images/gray/window/icon-warning.gif);\n}\n\n.x-window-dlg .ext-mb-question {\n    background-image:url(../images/gray/window/icon-question.gif);\n}\n\n.x-window-dlg .ext-mb-error {\n    background-image:url(../images/gray/window/icon-error.gif);\n}\n"
  },
  {
    "path": "client/src/ext/resources/css/yourtheme.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.ext-el-mask {\n    background-color: #ccc;\n}\n\n.ext-el-mask-msg {\n    border-color:#6593cf;\n    background-color:#c3daf9;\n    background-image:url(../images/default/box/tb-blue.gif);\n}\n.ext-el-mask-msg div {\n    background-color: #eee;\n    border-color:#a3bad9;\n    color:#222;\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-mask-loading div {\n    background-color:#fbfbfb;\n    background-image:url(../images/default/grid/loading.gif);\n}\n\n.x-item-disabled {\n    color: gray;\n}\n\n.x-item-disabled * {\n    color: gray !important;\n}\n\n.x-splitbar-proxy {\n    background-color: #aaa;\n}\n\n.x-color-palette a {\n    border-color:#fff;\n}\n\n.x-color-palette a:hover, .x-color-palette a.x-color-palette-sel {\n    border-color:#8bb8f3;\n    background-color: #deecfd;\n}\n\n/*\n.x-color-palette em:hover, .x-color-palette span:hover{   \n    background-color: #deecfd;\n}\n*/\n\n.x-color-palette em {\n    border-color:#aca899;\n}\n\n.x-ie-shadow {\n    background-color:#777;\n}\n\n.x-shadow .xsmc {\n    background-image: url(../images/default/shadow-c.png);\n}\n\n.x-shadow .xsml, .x-shadow .xsmr {\n    background-image: url(../images/default/shadow-lr.png);\n}\n\n.x-shadow .xstl, .x-shadow .xstc,  .x-shadow .xstr, .x-shadow .xsbl, .x-shadow .xsbc, .x-shadow .xsbr{\n    background-image: url(../images/default/shadow.png);\n}\n\n.loading-indicator {\n    font-size: 11px;\n    background-image: url(../images/default/grid/loading.gif);\n}\n\n.x-spotlight {\n    background-color: #ccc;\n}\n.x-tab-panel-header, .x-tab-panel-footer {\n\tbackground-color: #deecfd;\n\tborder-color:#8db2e3;\n    overflow:hidden;\n    zoom:1;\n}\n\n.x-tab-panel-header, .x-tab-panel-footer {\n\tborder-color:#8db2e3;\n}\n\nul.x-tab-strip-top{\n    background-color:#cedff5;\n\tbackground-image: url(../images/default/tabs/tab-strip-bg.gif);\n\tborder-bottom-color:#8db2e3;\n}\n\nul.x-tab-strip-bottom{\n    background-color:#cedff5;\n\tbackground-image: url(../images/default/tabs/tab-strip-btm-bg.gif);\n\tborder-top-color:#8db2e3;\n}\n\n.x-tab-panel-header-plain .x-tab-strip-spacer,\n.x-tab-panel-footer-plain .x-tab-strip-spacer {\n    border-color:#8db2e3;\n    background-color: #deecfd;\n}\n\n.x-tab-strip span.x-tab-strip-text {\n\tfont:normal 11px tahoma,arial,helvetica;\n\tcolor:#416aa3;\n}\n\n.x-tab-strip-over span.x-tab-strip-text {\n\tcolor:#15428b;\n}\n\n.x-tab-strip-active span.x-tab-strip-text {\n\tcolor:#15428b;\n    font-weight:bold;\n}\n\n.x-tab-strip-disabled .x-tabs-text {\n\tcolor:#aaaaaa;\n}\n\n.x-tab-strip-top .x-tab-right, .x-tab-strip-top .x-tab-left, .x-tab-strip-top .x-tab-strip-inner{\n\tbackground-image: url(../images/default/tabs/tabs-sprite.gif);\n}\n\n.x-tab-strip-bottom .x-tab-right {\n\tbackground-image: url(../images/default/tabs/tab-btm-inactive-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-left {\n\tbackground-image: url(../images/default/tabs/tab-btm-inactive-left-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-over .x-tab-right {\n\tbackground-image: url(../images/default/tabs/tab-btm-over-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-over .x-tab-left {\n\tbackground-image: url(../images/default/tabs/tab-btm-over-left-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-right {\n\tbackground-image: url(../images/default/tabs/tab-btm-right-bg.gif);\n}\n\n.x-tab-strip-bottom .x-tab-strip-active .x-tab-left {\n\tbackground-image: url(../images/default/tabs/tab-btm-left-bg.gif);\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close {\n\tbackground-image:url(../images/default/tabs/tab-close.gif);\n}\n\n.x-tab-strip .x-tab-strip-closable a.x-tab-strip-close:hover{\n\tbackground-image:url(../images/default/tabs/tab-close.gif);\n}\n\n.x-tab-panel-body {\n    border-color:#8db2e3;\n    background-color:#fff;\n}\n\n.x-tab-panel-body-top {\n    border-top: 0 none;\n}\n\n.x-tab-panel-body-bottom {\n    border-bottom: 0 none;\n}\n\n.x-tab-scroller-left {\n    background-image:url(../images/default/tabs/scroll-left.gif);\n    border-bottom-color:#8db2e3;\n}\n\n.x-tab-scroller-left-over {\n    background-position: 0 0;\n}\n\n.x-tab-scroller-left-disabled {\n    background-position: -18px 0;\n    opacity:.5;\n    -moz-opacity:.5;\n    filter:alpha(opacity=50);\n    cursor:default;\n}\n\n.x-tab-scroller-right {\n    background-image:url(../images/default/tabs/scroll-right.gif);\n    border-bottom-color:#8db2e3;\n}\n\n.x-tab-panel-bbar .x-toolbar, .x-tab-panel-tbar .x-toolbar {\n    border-color:#99bbe8;\n}.x-form-field {\n    font:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-text, textarea.x-form-field {\n    background-color:#fff;\n    background-image:url(../images/default/form/text-bg.gif);\n    border-color:#b5b8c8;\n}\n\n.x-form-select-one {\n    background-color:#fff;\n    border-color:#b5b8c8;\n}\n\n.x-form-check-group-label {\n    border-bottom: 1px solid #99bbe8;\n    color: #15428b;\n}\n\n.x-editor .x-form-check-wrap {\n    background-color:#fff;\n}\n\n.x-form-field-wrap .x-form-trigger {\n    background-image:url(../images/default/form/trigger.gif);\n    border-bottom-color:#b5b8c8;\n}\n\n.x-form-field-wrap .x-form-date-trigger {\n    background-image: url(../images/default/form/date-trigger.gif);\n}\n\n.x-form-field-wrap .x-form-clear-trigger {\n    background-image: url(../images/default/form/clear-trigger.gif);\n}\n\n.x-form-field-wrap .x-form-search-trigger {\n    background-image: url(../images/default/form/search-trigger.gif);\n}\n\n.x-trigger-wrap-focus .x-form-trigger {\n    border-bottom-color:#7eadd9;\n}\n\n.x-item-disabled .x-form-trigger-over {\n    border-bottom-color:#b5b8c8;\n}\n\n.x-item-disabled .x-form-trigger-click {\n    border-bottom-color:#b5b8c8;\n}\n\n.x-form-focus, textarea.x-form-focus {\n\tborder-color:#7eadd9;\n}\n\n.x-form-invalid, textarea.x-form-invalid {\n    background-color:#fff;\n\tbackground-image:url(../images/default/grid/invalid_line.gif);\n\tborder-color:#c30;\n}\n\n.x-form-invalid.x-form-composite {\n    border: none;\n    background-image: none;\n}\n\n.x-form-invalid.x-form-composite .x-form-invalid {\n    background-color:#fff;\n\tbackground-image:url(../images/default/grid/invalid_line.gif);\n\tborder-color:#c30;\n}\n\n.x-form-inner-invalid, textarea.x-form-inner-invalid {\n    background-color:#fff;\n\tbackground-image:url(../images/default/grid/invalid_line.gif);\n}\n\n.x-form-grow-sizer {\n\tfont:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-item {\n    font:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-form-invalid-msg {\n    color:#c0272b;\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n    background-image:url(../images/default/shared/warning.gif);\n}\n\n.x-form-empty-field {\n    color:gray;\n}\n\n.x-small-editor .x-form-field {\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.ext-webkit .x-small-editor .x-form-field {\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-form-invalid-icon {\n    background-image:url(../images/default/form/exclamation.gif);\n}\n\n.x-fieldset {\n    border-color:#b5b8c8;\n}\n\n.x-fieldset legend {\n    font:bold 11px tahoma, arial, helvetica, sans-serif;\n    color:#15428b;\n}\n.x-btn{\n\tfont:normal 11px tahoma, verdana, helvetica;\n}\n\n.x-btn button{\n    font:normal 11px arial,tahoma,verdana,helvetica;\n    color:#333;\n}\n\n.x-btn em {\n    font-style:normal;\n    font-weight:normal;\n}\n\n.x-btn-tl, .x-btn-tr, .x-btn-tc, .x-btn-ml, .x-btn-mr, .x-btn-mc, .x-btn-bl, .x-btn-br, .x-btn-bc{\n\tbackground-image:url(../images/default/button/btn.gif);\n}\n\n.x-btn-click .x-btn-text, .x-btn-menu-active .x-btn-text, .x-btn-pressed .x-btn-text{\n    color:#000;\n}\n\n.x-btn-disabled *{\n\tcolor:gray !important;\n}\n\n.x-btn-mc em.x-btn-arrow {\n    background-image:url(../images/default/button/arrow.gif);\n}\n\n.x-btn-mc em.x-btn-split {\n    background-image:url(../images/default/button/s-arrow.gif);\n}\n\n.x-btn-over .x-btn-mc em.x-btn-split, .x-btn-click .x-btn-mc em.x-btn-split, .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-btn-pressed .x-btn-mc em.x-btn-split {\n    background-image:url(../images/default/button/s-arrow-o.gif);\n}\n\n.x-btn-mc em.x-btn-arrow-bottom {\n    background-image:url(../images/default/button/s-arrow-b-noline.gif);\n}\n\n.x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/default/button/s-arrow-b.gif);\n}\n\n.x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-btn-click .x-btn-mc em.x-btn-split-bottom, .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-btn-pressed .x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/default/button/s-arrow-bo.gif);\n}\n\n.x-btn-group-header {\n    color: #3e6aaa;\n}\n\n.x-btn-group-tc {\n\tbackground-image: url(../images/default/button/group-tb.gif);\n}\n\n.x-btn-group-tl {\n\tbackground-image: url(../images/default/button/group-cs.gif);\n}\n\n.x-btn-group-tr {\n\tbackground-image: url(../images/default/button/group-cs.gif);\n}\n\n.x-btn-group-bc {\n\tbackground-image: url(../images/default/button/group-tb.gif);\n}\n\n.x-btn-group-bl {\n\tbackground-image: url(../images/default/button/group-cs.gif);\n}\n\n.x-btn-group-br {\n\tbackground-image: url(../images/default/button/group-cs.gif);\n}\n\n.x-btn-group-ml {\n\tbackground-image: url(../images/default/button/group-lr.gif);\n}\n.x-btn-group-mr {\n\tbackground-image: url(../images/default/button/group-lr.gif);\n}\n\n.x-btn-group-notitle .x-btn-group-tc {\n\tbackground-image: url(../images/default/button/group-tb.gif);\n}.x-toolbar{\n\tborder-color:#a9bfd3;\n    background-color:#d0def0;\n    background-image:url(../images/default/toolbar/bg.gif);\n}\n\n.x-toolbar td,.x-toolbar span,.x-toolbar input,.x-toolbar div,.x-toolbar select,.x-toolbar label{\n    font:normal 11px arial,tahoma, helvetica, sans-serif;\n}\n\n.x-toolbar .x-item-disabled {\n\tcolor:gray;\n}\n\n.x-toolbar .x-item-disabled * {\n\tcolor:gray;\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split {\n    background-image:url(../images/default/button/s-arrow-noline.gif);\n}\n\n.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-click .x-btn-mc em.x-btn-split,\n.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split\n{\n    background-image:url(../images/default/button/s-arrow-o.gif);\n}\n\n.x-toolbar .x-btn-mc em.x-btn-split-bottom {\n    background-image:url(../images/default/button/s-arrow-b-noline.gif);\n}\n\n.x-toolbar .x-btn-over .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-click .x-btn-mc em.x-btn-split-bottom,\n.x-toolbar .x-btn-menu-active .x-btn-mc em.x-btn-split-bottom, .x-toolbar .x-btn-pressed .x-btn-mc em.x-btn-split-bottom\n{\n    background-image:url(../images/default/button/s-arrow-bo.gif);\n}\n\n.x-toolbar .xtb-sep {\n\tbackground-image: url(../images/default/grid/grid-blue-split.gif);\n}\n\n.x-tbar-page-first{\n\tbackground-image: url(../images/default/grid/page-first.gif) !important;\n}\n\n.x-tbar-loading{\n\tbackground-image: url(../images/default/grid/refresh.gif) !important;\n}\n\n.x-tbar-page-last{\n\tbackground-image: url(../images/default/grid/page-last.gif) !important;\n}\n\n.x-tbar-page-next{\n\tbackground-image: url(../images/default/grid/page-next.gif) !important;\n}\n\n.x-tbar-page-prev{\n\tbackground-image: url(../images/default/grid/page-prev.gif) !important;\n}\n\n.x-item-disabled .x-tbar-loading{\n\tbackground-image: url(../images/default/grid/refresh-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-first{\n\tbackground-image: url(../images/default/grid/page-first-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-last{\n\tbackground-image: url(../images/default/grid/page-last-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-next{\n\tbackground-image: url(../images/default/grid/page-next-disabled.gif) !important;\n}\n\n.x-item-disabled .x-tbar-page-prev{\n\tbackground-image: url(../images/default/grid/page-prev-disabled.gif) !important;\n}\n\n.x-paging-info {\n    color:#444;\n}\n\n.x-toolbar-more-icon {\n    background-image: url(../images/default/toolbar/more.gif) !important;\n}.x-resizable-handle {\n\tbackground-color:#fff;\n}\n\n.x-resizable-over .x-resizable-handle-east, .x-resizable-pinned .x-resizable-handle-east,\n.x-resizable-over .x-resizable-handle-west, .x-resizable-pinned .x-resizable-handle-west\n{\n    background-image:url(../images/default/sizer/e-handle.gif);\n}\n\n.x-resizable-over .x-resizable-handle-south, .x-resizable-pinned .x-resizable-handle-south,\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north\n{\n    background-image:url(../images/default/sizer/s-handle.gif);\n}\n\n.x-resizable-over .x-resizable-handle-north, .x-resizable-pinned .x-resizable-handle-north{\n    background-image:url(../images/default/sizer/s-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-southeast, .x-resizable-pinned .x-resizable-handle-southeast{\n    background-image:url(../images/default/sizer/se-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-northwest, .x-resizable-pinned .x-resizable-handle-northwest{\n    background-image:url(../images/default/sizer/nw-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-northeast, .x-resizable-pinned .x-resizable-handle-northeast{\n    background-image:url(../images/default/sizer/ne-handle.gif);\n}\n.x-resizable-over .x-resizable-handle-southwest, .x-resizable-pinned .x-resizable-handle-southwest{\n    background-image:url(../images/default/sizer/sw-handle.gif);\n}\n.x-resizable-proxy{\n    border-color:#3b5a82;\n}\n.x-resizable-overlay{\n    background-color:#fff;\n}\n.x-grid3 {\n    background-color:#fff;\n}\n\n.x-grid-panel .x-panel-mc .x-panel-body {\n    border-color:#99bbe8;\n}\n\n.x-grid3-row td, .x-grid3-summary-row td{\n\tfont:normal 11px/13px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-grid3-hd-row td {\n\tfont:normal 11px/15px arial, tahoma, helvetica, sans-serif;\n}\n\n\n.x-grid3-hd-row td {\n    border-left-color:#eee;\n    border-right-color:#d0d0d0;\n}\n\n.x-grid-row-loading {\n    background-color: #fff;\n    background-image:url(../images/default/shared/loading-balls.gif);\n}\n\n.x-grid3-row {\n    border-color:#ededed;\n    border-top-color:#fff;\n}\n\n.x-grid3-row-alt{\n\tbackground-color:#fafafa;\n}\n\n.x-grid3-row-over {\n\tborder-color:#ddd;\n    background-color:#efefef;\n    background-image:url(../images/default/grid/row-over.gif);\n}\n\n.x-grid3-resize-proxy {\n    background-color:#777;\n}\n\n.x-grid3-resize-marker {\n    background-color:#777;\n}\n\n.x-grid3-header{\n    background-color:#f9f9f9;\n\tbackground-image:url(../images/default/grid/grid3-hrow.gif);\n}\n\n.x-grid3-header-pop {\n    border-left-color:#d0d0d0;\n}\n\n.x-grid3-header-pop-inner {\n    border-left-color:#eee;\n    background-image:url(../images/default/grid/hd-pop.gif);\n}\n\ntd.x-grid3-hd-over, td.sort-desc, td.sort-asc, td.x-grid3-hd-menu-open {\n    border-left-color:#aaccf6;\n    border-right-color:#aaccf6;\n}\n\ntd.x-grid3-hd-over .x-grid3-hd-inner, td.sort-desc .x-grid3-hd-inner, td.sort-asc .x-grid3-hd-inner, td.x-grid3-hd-menu-open .x-grid3-hd-inner {\n    background-color:#ebf3fd;\n    background-image:url(../images/default/grid/grid3-hrow-over.gif);\n\n}\n\n.sort-asc .x-grid3-sort-icon {\n\tbackground-image: url(../images/default/grid/sort_asc.gif);\n}\n\n.sort-desc .x-grid3-sort-icon {\n\tbackground-image: url(../images/default/grid/sort_desc.gif);\n}\n\n.x-grid3-cell-text, .x-grid3-hd-text {\n\tcolor:#000;\n}\n\n.x-grid3-split {\n\tbackground-image: url(../images/default/grid/grid-split.gif);\n}\n\n.x-grid3-hd-text {\n\tcolor:#15428b;\n}\n\n.x-dd-drag-proxy .x-grid3-hd-inner{\n    background-color:#ebf3fd;\n\tbackground-image:url(../images/default/grid/grid3-hrow-over.gif);\n\tborder-color:#aaccf6;\n}\n\n.col-move-top{\n\tbackground-image:url(../images/default/grid/col-move-top.gif);\n}\n\n.col-move-bottom{\n\tbackground-image:url(../images/default/grid/col-move-bottom.gif);\n}\n\ntd.grid-hd-group-cell {\n    background: url(../images/default/grid/grid3-hrow.gif) repeat-x bottom;\n}\n\n.x-grid3-row-selected {\n\tbackground-color: #dfe8f6 !important;\n\tbackground-image: none;\n\tborder-color:#a3bae9;\n}\n\n.x-grid3-cell-selected{\n\tbackground-color: #b8cfee !important;\n\tcolor:#000;\n}\n\n.x-grid3-cell-selected span{\n\tcolor:#000 !important;\n}\n\n.x-grid3-cell-selected .x-grid3-cell-text{\n\tcolor:#000;\n}\n\n.x-grid3-locked td.x-grid3-row-marker, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker{\n    background-color:#ebeadb !important;\n    background-image:url(../images/default/grid/grid-hrow.gif) !important;\n    color:#000;\n    border-top-color:#fff;\n    border-right-color:#6fa0df !important;\n}\n\n.x-grid3-locked td.x-grid3-row-marker div, .x-grid3-locked .x-grid3-row-selected td.x-grid3-row-marker div{\n    color:#15428b !important;\n}\n\n.x-grid3-dirty-cell {\n    background-image:url(../images/default/grid/dirty.gif);\n}\n\n.x-grid3-topbar, .x-grid3-bottombar{\n\tfont:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-grid3-bottombar .x-toolbar{\n\tborder-top-color:#a9bfd3;\n}\n\n.x-props-grid .x-grid3-td-name .x-grid3-cell-inner{\n\tbackground-image:url(../images/default/grid/grid3-special-col-bg.gif) !important;\n    color:#000 !important;\n}\n\n.x-props-grid .x-grid3-body .x-grid3-td-name{\n    background-color:#fff !important;\n    border-right-color:#eee;\n}\n\n.xg-hmenu-sort-asc .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-asc.gif);\n}\n\n.xg-hmenu-sort-desc .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-desc.gif);\n}\n\n.xg-hmenu-lock .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-lock.gif);\n}\n\n.xg-hmenu-unlock .x-menu-item-icon{\n\tbackground-image: url(../images/default/grid/hmenu-unlock.gif);\n}\n\n.x-grid3-hd-btn {\n    background-color:#c3daf9;\n    background-image:url(../images/default/grid/grid3-hd-btn.gif);\n}\n\n.x-grid3-body .x-grid3-td-expander {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-row-expander {\n    background-image:url(../images/default/grid/row-expand-sprite.gif);\n}\n\n.x-grid3-body .x-grid3-td-checker {\n    background-image: url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-row-checker, .x-grid3-hd-checker {\n    background-image:url(../images/default/grid/row-check-sprite.gif);\n}\n\n.x-grid3-body .x-grid3-td-numberer {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-body .x-grid3-td-numberer .x-grid3-cell-inner {\n\tcolor:#444;\n}\n\n.x-grid3-body .x-grid3-td-row-icon {\n    background-image:url(../images/default/grid/grid3-special-col-bg.gif);\n}\n\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-numberer,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-checker,\n.x-grid3-body .x-grid3-row-selected .x-grid3-td-expander {\n\tbackground-image:url(../images/default/grid/grid3-special-col-sel-bg.gif);\n}\n\n.x-grid3-check-col {\n\tbackground-image:url(../images/default/menu/unchecked.gif);\n}\n\n.x-grid3-check-col-on {\n\tbackground-image:url(../images/default/menu/checked.gif);\n}\n\n.x-grid-group, .x-grid-group-body, .x-grid-group-hd {\n    zoom:1;\n}\n\n.x-grid-group-hd {\n    border-bottom-color:#99bbe8;\n}\n\n.x-grid-group-hd div.x-grid-group-title {\n    background-image:url(../images/default/grid/group-collapse.gif);\n    color:#3764a0;\n    font:bold 11px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-grid-group-collapsed .x-grid-group-hd div.x-grid-group-title {\n    background-image:url(../images/default/grid/group-expand.gif);\n}\n\n.x-group-by-icon {\n    background-image:url(../images/default/grid/group-by.gif);\n}\n\n.x-cols-icon {\n    background-image:url(../images/default/grid/columns.gif);\n}\n\n.x-show-groups-icon {\n    background-image:url(../images/default/grid/group-by.gif);\n}\n\n.x-grid-empty {\n    color:gray;\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-grid-with-col-lines .x-grid3-row td.x-grid3-cell {\n    border-right-color:#ededed;\n}\n\n.x-grid-with-col-lines .x-grid3-row-selected {\n\tborder-top-color:#a3bae9;\n}.x-dd-drag-ghost{\n\tcolor:#000;\n\tfont: normal 11px arial, helvetica, sans-serif;\n    border-color: #ddd #bbb #bbb #ddd;\n\tbackground-color:#fff;\n}\n\n.x-dd-drop-nodrop .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-no.gif);\n}\n\n.x-dd-drop-ok .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-yes.gif);\n}\n\n.x-dd-drop-ok-add .x-dd-drop-icon{\n  background-image: url(../images/default/dd/drop-add.gif);\n}\n\n.x-view-selector {\n    background-color:#c3daf9;\n    border-color:#3399bb;\n}.x-tree-node-expanded .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/folder-open.gif);\n}\n\n.x-tree-node-leaf .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/leaf.gif);\n}\n\n.x-tree-node-collapsed .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/folder.gif);\n}\n\n.x-tree-node-loading .x-tree-node-icon{\n\tbackground-image:url(../images/default/tree/loading.gif) !important;\n}\n\n.x-tree-node .x-tree-node-inline-icon {\n    background-image: none;\n}\n\n.x-tree-node-loading a span{\n\t font-style: italic;\n\t color:#444444;\n}\n\n.x-tree-lines .x-tree-elbow{\n\tbackground-image:url(../images/default/tree/elbow.gif);\n}\n\n.x-tree-lines .x-tree-elbow-plus{\n\tbackground-image:url(../images/default/tree/elbow-plus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-minus{\n\tbackground-image:url(../images/default/tree/elbow-minus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end{\n\tbackground-image:url(../images/default/tree/elbow-end.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end-plus{\n\tbackground-image:url(../images/default/tree/elbow-end-plus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-end-minus{\n\tbackground-image:url(../images/default/tree/elbow-end-minus.gif);\n}\n\n.x-tree-lines .x-tree-elbow-line{\n\tbackground-image:url(../images/default/tree/elbow-line.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-plus{\n\tbackground-image:url(../images/default/tree/elbow-plus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-minus{\n\tbackground-image:url(../images/default/tree/elbow-minus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-end-plus{\n\tbackground-image:url(../images/default/tree/elbow-end-plus-nl.gif);\n}\n\n.x-tree-no-lines .x-tree-elbow-end-minus{\n\tbackground-image:url(../images/default/tree/elbow-end-minus-nl.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-plus{\n    background-image:url(../images/default/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-minus{\n    background-image:url(../images/default/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-end-plus{\n    background-image:url(../images/default/tree/arrows.gif);\n}\n\n.x-tree-arrows .x-tree-elbow-end-minus{\n    background-image:url(../images/default/tree/arrows.gif);\n}\n\n.x-tree-node{\n\tcolor:#000;\n\tfont: normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-tree-node a, .x-dd-drag-ghost a{\n\tcolor:#000;\n}\n\n.x-tree-node a span, .x-dd-drag-ghost a span{\n\tcolor:#000;\n}\n\n.x-tree-node .x-tree-node-disabled a span{\n\tcolor:gray !important;\n}\n\n.x-tree-node div.x-tree-drag-insert-below{\n \t border-bottom-color:#36c;\n}\n\n.x-tree-node div.x-tree-drag-insert-above{\n\t border-top-color:#36c;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-below a{\n \t border-bottom-color:#36c;\n}\n\n.x-tree-dd-underline .x-tree-node div.x-tree-drag-insert-above a{\n\t border-top-color:#36c;\n}\n\n.x-tree-node .x-tree-drag-append a span{\n\t background-color:#ddd;\n\t border-color:gray;\n}\n\n.x-tree-node .x-tree-node-over {\n\tbackground-color: #eee;\n}\n\n.x-tree-node .x-tree-selected {\n\tbackground-color: #d9e8fb;\n}\n\n.x-tree-drop-ok-append .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-add.gif);\n}\n\n.x-tree-drop-ok-above .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-over.gif);\n}\n\n.x-tree-drop-ok-below .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-under.gif);\n}\n\n.x-tree-drop-ok-between .x-dd-drop-icon{\n  background-image: url(../images/default/tree/drop-between.gif);\n}.x-date-picker {\n    border-color: #1b376c;\n    background-color:#fff;\n}\n\n.x-date-middle,.x-date-left,.x-date-right {\n\tbackground-image: url(../images/default/shared/hd-sprite.gif);\n\tcolor:#fff;\n\tfont:bold 11px \"sans serif\", tahoma, verdana, helvetica;\n}\n\n.x-date-middle .x-btn .x-btn-text {\n    color:#fff;\n}\n\n.x-date-middle .x-btn-mc em.x-btn-arrow {\n    background-image:url(../images/default/toolbar/btn-arrow-light.gif);\n}\n\n.x-date-right a {\n    background-image: url(../images/default/shared/right-btn.gif);\n}\n\n.x-date-left a{\n\tbackground-image: url(../images/default/shared/left-btn.gif);\n}\n\n.x-date-inner th {\n    background-color:#dfecfb;\n    background-image:url(../images/default/shared/glass-bg.gif);\n\tborder-bottom-color:#a3bad9;\n    font:normal 10px arial, helvetica,tahoma,sans-serif;\n\tcolor:#233d6d;\n}\n\n.x-date-inner td {\n    border-color:#fff;\n}\n\n.x-date-inner a {\n    font:normal 11px arial, helvetica,tahoma,sans-serif;\n    color:#000;\n}\n\n.x-date-inner .x-date-active{\n\tcolor:#000;\n}\n\n.x-date-inner .x-date-selected a{\n    background-color:#dfecfb;\n\tbackground-image:url(../images/default/shared/glass-bg.gif);\n\tborder-color:#8db2e3;\n}\n\n.x-date-inner .x-date-today a{\n\tborder-color:darkred;\n}\n\n.x-date-inner .x-date-selected span{\n    font-weight:bold;\n}\n\n.x-date-inner .x-date-prevday a,.x-date-inner .x-date-nextday a {\n\tcolor:#aaa;\n}\n\n.x-date-bottom {\n    border-top-color:#a3bad9;\n    background-color:#dfecfb;\n    background-image:url(../images/default/shared/glass-bg.gif);\n}\n\n.x-date-inner a:hover, .x-date-inner .x-date-disabled a:hover{\n    color:#000;\n    background-color:#ddecfe;\n}\n\n.x-date-inner .x-date-disabled a {\n\tbackground-color:#eee;\n\tcolor:#bbb;\n}\n\n.x-date-mmenu{\n    background-color:#eee !important;\n}\n\n.x-date-mmenu .x-menu-item {\n\tfont-size:10px;\n\tcolor:#000;\n}\n\n.x-date-mp {\n\tbackground-color:#fff;\n}\n\n.x-date-mp td {\n\tfont:normal 11px arial, helvetica,tahoma,sans-serif;\n}\n\n.x-date-mp-btns button {\n\tbackground-color:#083772;\n\tcolor:#fff;\n\tborder-color: #3366cc #000055 #000055 #3366cc;\n\tfont:normal 11px arial, helvetica,tahoma,sans-serif;\n}\n\n.x-date-mp-btns {\n    background-color: #dfecfb;\n\tbackground-image: url(../images/default/shared/glass-bg.gif);\n}\n\n.x-date-mp-btns td {\n\tborder-top-color: #c5d2df;\n}\n\ntd.x-date-mp-month a,td.x-date-mp-year a {\n\tcolor:#15428b;\n}\n\ntd.x-date-mp-month a:hover,td.x-date-mp-year a:hover {\n\tcolor:#15428b;\n\tbackground-color: #ddecfe;\n}\n\ntd.x-date-mp-sel a {\n    background-color: #dfecfb;\n\tbackground-image: url(../images/default/shared/glass-bg.gif);\n\tborder-color:#8db2e3;\n}\n\n.x-date-mp-ybtn a {\n    background-image:url(../images/default/panel/tool-sprites.gif);\n}\n\ntd.x-date-mp-sep {\n   border-right-color:#c5d2df;\n}.x-tip .x-tip-close{\n\tbackground-image: url(../images/default/qtip/close.gif);\n}\n\n.x-tip .x-tip-tc, .x-tip .x-tip-tl, .x-tip .x-tip-tr, .x-tip .x-tip-bc, .x-tip .x-tip-bl, .x-tip .x-tip-br, .x-tip .x-tip-ml, .x-tip .x-tip-mr {\n\tbackground-image: url(../images/default/qtip/tip-sprite.gif);\n}\n\n.x-tip .x-tip-mc {\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n}\n.x-tip .x-tip-ml {\n\tbackground-color: #fff;\n}\n\n.x-tip .x-tip-header-text {\n    font: bold 11px tahoma,arial,helvetica,sans-serif;\n    color:#444;\n}\n\n.x-tip .x-tip-body {\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n    color:#444;\n}\n\n.x-form-invalid-tip .x-tip-tc, .x-form-invalid-tip .x-tip-tl, .x-form-invalid-tip .x-tip-tr, .x-form-invalid-tip .x-tip-bc,\n.x-form-invalid-tip .x-tip-bl, .x-form-invalid-tip .x-tip-br, .x-form-invalid-tip .x-tip-ml, .x-form-invalid-tip .x-tip-mr\n{\n\tbackground-image: url(../images/default/form/error-tip-corners.gif);\n}\n\n.x-form-invalid-tip .x-tip-body {\n    background-image:url(../images/default/form/exclamation.gif);\n}\n\n.x-tip-anchor {\n    background-image:url(../images/default/qtip/tip-anchor-sprite.gif);\n}.x-menu {\n    background-color:#f0f0f0;\n\tbackground-image:url(../images/default/menu/menu.gif);\n}\n\n.x-menu-floating{\n    border-color:#718bb7;\n}\n\n.x-menu-nosep {\n\tbackground-image:none;\n}\n\n.x-menu-list-item{\n\tfont:normal 11px arial,tahoma,sans-serif;\n}\n\n.x-menu-item-arrow{\n\tbackground-image:url(../images/default/menu/menu-parent.gif);\n}\n\n.x-menu-sep {\n    background-color:#e0e0e0;\n\tborder-bottom-color:#fff;\n}\n\na.x-menu-item {\n\tcolor:#222;\n}\n\n.x-menu-item-active {\n    background-image: url(../images/default/menu/item-over.gif);\n\tbackground-color: #dbecf4;\n    border-color:#aaccf6;\n}\n\n.x-menu-item-active a.x-menu-item {\n\tborder-color:#aaccf6;\n}\n\n.x-menu-check-item .x-menu-item-icon{\n\tbackground-image:url(../images/default/menu/unchecked.gif);\n}\n\n.x-menu-item-checked .x-menu-item-icon{\n\tbackground-image:url(../images/default/menu/checked.gif);\n}\n\n.x-menu-item-checked .x-menu-group-item .x-menu-item-icon{\n    background-image:url(../images/default/menu/group-checked.gif);\n}\n\n.x-menu-group-item .x-menu-item-icon{\n    background-image:none;\n}\n\n.x-menu-plain {\n\tbackground-color:#f0f0f0 !important;\n    background-image: none;\n}\n\n.x-date-menu, .x-color-menu{\n    background-color: #fff !important;\n}\n\n.x-menu .x-date-picker{\n    border-color:#a3bad9;\n}\n\n.x-cycle-menu .x-menu-item-checked {\n    border-color:#a3bae9 !important;\n    background-color:#def8f6;\n}\n\n.x-menu-scroller-top {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n\n.x-menu-scroller-bottom {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n.x-box-tl {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-tc {\n\tbackground-image: url(../images/default/box/tb.gif);\n}\n\n.x-box-tr {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-ml {\n\tbackground-image: url(../images/default/box/l.gif);\n}\n\n.x-box-mc {\n\tbackground-color: #eee;\n    background-image: url(../images/default/box/tb.gif);\n\tfont-family: \"Myriad Pro\",\"Myriad Web\",\"Tahoma\",\"Helvetica\",\"Arial\",sans-serif;\n\tcolor: #393939;\n\tfont-size: 12px;\n}\n\n.x-box-mc h3 {\n\tfont-size: 14px;\n\tfont-weight: bold;\n}\n\n.x-box-mr {\n\tbackground-image: url(../images/default/box/r.gif);\n}\n\n.x-box-bl {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-bc {\n\tbackground-image: url(../images/default/box/tb.gif);\n}\n\n.x-box-br {\n\tbackground-image: url(../images/default/box/corners.gif);\n}\n\n.x-box-blue .x-box-bl, .x-box-blue .x-box-br, .x-box-blue .x-box-tl, .x-box-blue .x-box-tr {\n\tbackground-image: url(../images/default/box/corners-blue.gif);\n}\n\n.x-box-blue .x-box-bc, .x-box-blue .x-box-mc, .x-box-blue .x-box-tc {\n\tbackground-image: url(../images/default/box/tb-blue.gif);\n}\n\n.x-box-blue .x-box-mc {\n\tbackground-color: #c3daf9;\n}\n\n.x-box-blue .x-box-mc h3 {\n\tcolor: #17385b;\n}\n\n.x-box-blue .x-box-ml {\n\tbackground-image: url(../images/default/box/l-blue.gif);\n}\n\n.x-box-blue .x-box-mr {\n\tbackground-image: url(../images/default/box/r-blue.gif);\n}.x-combo-list {\n    border-color:#98c0f4;\n    background-color:#ddecfe;\n    font:normal 12px tahoma, arial, helvetica, sans-serif;\n}\n\n.x-combo-list-inner {\n    background-color:#fff;\n}\n\n.x-combo-list-hd {\n    font:bold 11px tahoma, arial, helvetica, sans-serif;\n    color:#15428b;\n    background-image: url(../images/default/layout/panel-title-light-bg.gif);\n    border-bottom-color:#98c0f4;\n}\n\n.x-resizable-pinned .x-combo-list-inner {\n    border-bottom-color:#98c0f4;\n}\n\n.x-combo-list-item {\n    border-color:#fff;\n}\n\n.x-combo-list .x-combo-selected{\n\tborder-color:#a3bae9 !important;\n    background-color:#dfe8f6;\n}\n\n.x-combo-list .x-toolbar {\n    border-top-color:#98c0f4;\n}\n\n.x-combo-list-small {\n    font:normal 11px tahoma, arial, helvetica, sans-serif;\n}.x-panel {\n    border-color: #99bbe8;\n}\n\n.x-panel-header {\n    color:#15428b;\n\tfont-weight:bold; \n    font-size: 11px;\n    font-family: tahoma,arial,verdana,sans-serif;\n    border-color:#99bbe8;\n    background-image: url(../images/default/panel/white-top-bottom.gif);\n}\n\n.x-panel-body {\n    border-color:#99bbe8;\n    background-color:#fff;\n}\n\n.x-panel-bbar .x-toolbar, .x-panel-tbar .x-toolbar {\n    border-color:#99bbe8;\n}\n\n.x-panel-tbar-noheader .x-toolbar, .x-panel-mc .x-panel-tbar .x-toolbar {\n    border-top-color:#99bbe8;\n}\n\n.x-panel-body-noheader, .x-panel-mc .x-panel-body {\n    border-top-color:#99bbe8;\n}\n\n.x-panel-tl .x-panel-header {\n    color:#15428b;\n\tfont:bold 11px tahoma,arial,verdana,sans-serif;\n}\n\n.x-panel-tc {\n\tbackground-image: url(../images/default/panel/top-bottom.gif);\n}\n\n.x-panel-tl, .x-panel-tr, .x-panel-bl,  .x-panel-br{\n\tbackground-image: url(../images/default/panel/corners-sprite.gif);\n    border-bottom-color:#99bbe8;\n}\n\n.x-panel-bc {\n\tbackground-image: url(../images/default/panel/top-bottom.gif);\n}\n\n.x-panel-mc {\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n    background-color:#dfe8f6;\n}\n\n.x-panel-ml {\n\tbackground-color: #fff;\n    background-image:url(../images/default/panel/left-right.gif);\n}\n\n.x-panel-mr {\n\tbackground-image: url(../images/default/panel/left-right.gif);\n}\n\n.x-tool {\n    background-image:url(../images/default/panel/tool-sprites.gif);\n}\n\n.x-panel-ghost {\n    background-color:#cbddf3;\n}\n\n.x-panel-ghost ul {\n    border-color:#99bbe8;\n}\n\n.x-panel-dd-spacer {\n    border-color:#99bbe8;\n}\n\n.x-panel-fbar td,.x-panel-fbar span,.x-panel-fbar input,.x-panel-fbar div,.x-panel-fbar select,.x-panel-fbar label{\n    font:normal 11px arial,tahoma, helvetica, sans-serif;\n}\n.x-window-proxy {\n    background-color:#c7dffc;\n    border-color:#99bbe8;\n}\n\n.x-window-tl .x-window-header {\n    color:#15428b;\n\tfont:bold 11px tahoma,arial,verdana,sans-serif;\n}\n\n.x-window-tc {\n\tbackground-image: url(../images/default/window/top-bottom.png);\n}\n\n.x-window-tl {\n\tbackground-image: url(../images/default/window/left-corners.png);\n}\n\n.x-window-tr {\n\tbackground-image: url(../images/default/window/right-corners.png);\n}\n\n.x-window-bc {\n\tbackground-image: url(../images/default/window/top-bottom.png);\n}\n\n.x-window-bl {\n\tbackground-image: url(../images/default/window/left-corners.png);\n}\n\n.x-window-br {\n\tbackground-image: url(../images/default/window/right-corners.png);\n}\n\n.x-window-mc {\n    border-color:#99bbe8;\n    font: normal 11px tahoma,arial,helvetica,sans-serif;\n    background-color:#dfe8f6;\n}\n\n.x-window-ml {\n\tbackground-image: url(../images/default/window/left-right.png);\n}\n\n.x-window-mr {\n\tbackground-image: url(../images/default/window/left-right.png);\n}\n\n.x-window-maximized .x-window-tc {\n    background-color:#fff;\n}\n\n.x-window-bbar .x-toolbar {\n    border-top-color:#99bbe8;\n}\n\n.x-panel-ghost .x-window-tl {\n    border-bottom-color:#99bbe8;\n}\n\n.x-panel-collapsed .x-window-tl {\n    border-bottom-color:#84a0c4;\n}\n\n.x-dlg-mask{\n   background-color:#ccc;\n}\n\n.x-window-plain .x-window-mc {\n    background-color: #ccd9e8;\n    border-color: #a3bae9 #dfe8f6 #dfe8f6 #a3bae9;\n}\n\n.x-window-plain .x-window-body {\n    border-color: #dfe8f6 #a3bae9 #a3bae9 #dfe8f6;\n}\n\nbody.x-body-masked .x-window-plain .x-window-mc {\n    background-color: #ccd9e8;\n}.x-html-editor-wrap {\n    border-color:#a9bfd3;\n    background-color:#fff;\n}\n.x-html-editor-tb .x-btn-text {\n    background-image:url(../images/default/editor/tb-sprite.gif);\n}.x-panel-noborder .x-panel-header-noborder {\n    border-bottom-color:#99bbe8;\n}\n\n.x-panel-noborder .x-panel-tbar-noborder .x-toolbar {\n    border-bottom-color:#99bbe8;\n}\n\n.x-panel-noborder .x-panel-bbar-noborder .x-toolbar {\n    border-top-color:#99bbe8;\n}\n\n.x-tab-panel-bbar-noborder .x-toolbar {\n    border-top-color:#99bbe8;\n}\n\n.x-tab-panel-tbar-noborder .x-toolbar {\n    border-bottom-color:#99bbe8;\n}.x-border-layout-ct {\n    background-color:#dfe8f6;\n}\n\n.x-accordion-hd {\n\tcolor:#222;\n    font-weight:normal;\n    background-image: url(../images/default/panel/light-hd.gif);\n}\n\n.x-layout-collapsed{\n    background-color:#d2e0f2;\n\tborder-color:#98c0f4;\n}\n\n.x-layout-collapsed-over{\n    background-color:#d9e8fb;\n}\n\n.x-layout-split-west .x-layout-mini {\n    background-image:url(../images/default/layout/mini-left.gif);\n}\n.x-layout-split-east .x-layout-mini {\n    background-image:url(../images/default/layout/mini-right.gif);\n}\n.x-layout-split-north .x-layout-mini {\n    background-image:url(../images/default/layout/mini-top.gif);\n}\n.x-layout-split-south .x-layout-mini {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n\n.x-layout-cmini-west .x-layout-mini {\n    background-image:url(../images/default/layout/mini-right.gif);\n}\n\n.x-layout-cmini-east .x-layout-mini {\n    background-image:url(../images/default/layout/mini-left.gif);\n}\n\n.x-layout-cmini-north .x-layout-mini {\n    background-image:url(../images/default/layout/mini-bottom.gif);\n}\n\n.x-layout-cmini-south .x-layout-mini {\n    background-image:url(../images/default/layout/mini-top.gif);\n}.x-progress-wrap {\n    border-color:#6593cf;\n}\n\n.x-progress-inner {\n    background-color:#e0e8f3;\n    background-image:url(../images/default/qtip/bg.gif);\n}\n\n.x-progress-bar {\n    background-color:#9cbfee;\n    background-image:url(../images/default/progress/progress-bg.gif);\n    border-top-color:#d1e4fd;\n    border-bottom-color:#7fa9e4;\n    border-right-color:#7fa9e4;\n}\n\n.x-progress-text {\n    font-size:11px;\n    font-weight:bold;\n    color:#fff;\n}\n\n.x-progress-text-back {\n    color:#396095;\n}.x-list-header{\n    background-color:#f9f9f9;\n\tbackground-image:url(../images/default/grid/grid3-hrow.gif);\n}\n\n.x-list-header-inner div em {\n    border-left-color:#ddd;\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-list-body dt em {\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-list-over {\n    background-color:#eee;\n}\n\n.x-list-selected {\n    background-color:#dfe8f6;\n}\n\n.x-list-resizer {\n    border-left-color:#555;\n    border-right-color:#555;\n}\n\n.x-list-header-inner em.sort-asc, .x-list-header-inner em.sort-desc {\n    background-image:url(../images/default/grid/sort-hd.gif);\n    border-color: #99bbe8;\n}.x-slider-horz, .x-slider-horz .x-slider-end, .x-slider-horz .x-slider-inner {\n    background-image:url(../images/default/slider/slider-bg.png);\n}\n\n.x-slider-horz .x-slider-thumb {\n    background-image:url(../images/default/slider/slider-thumb.png);\n}\n\n.x-slider-vert, .x-slider-vert .x-slider-end, .x-slider-vert .x-slider-inner {\n    background-image:url(../images/default/slider/slider-v-bg.png);\n}\n\n.x-slider-vert .x-slider-thumb {\n    background-image:url(../images/default/slider/slider-v-thumb.png);\n}.x-window-dlg .ext-mb-text,\n.x-window-dlg .x-window-header-text {\n    font-size:12px;\n}\n\n.x-window-dlg .ext-mb-textarea {\n    font:normal 12px tahoma,arial,helvetica,sans-serif;\n}\n\n.x-window-dlg .x-msg-box-wait {\n    background-image:url(../images/default/grid/loading.gif);\n}\n\n.x-window-dlg .ext-mb-info {\n    background-image:url(../images/default/window/icon-info.gif);\n}\n\n.x-window-dlg .ext-mb-warning {\n    background-image:url(../images/default/window/icon-warning.gif);\n}\n\n.x-window-dlg .ext-mb-question {\n    background-image:url(../images/default/window/icon-question.gif);\n}\n\n.x-window-dlg .ext-mb-error {\n    background-image:url(../images/default/window/icon-error.gif);\n}"
  },
  {
    "path": "client/src/ext/resources/images/yourtheme/README.txt",
    "content": "2010-03-16 jwr:\nThe image directory, \"yourtheme\", is an exact copy of the \"default\" image directory. Remember to update your file paths in \"css/yourtheme.css\" if you make changes or add your own custom images for your custom theme."
  },
  {
    "path": "client/src/ext/ux/BufferView.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.BufferView\n * @extends Ext.grid.GridView\n * A custom GridView which renders rows on an as-needed basis.\n */\nExt.ux.grid.BufferView = Ext.extend(Ext.grid.GridView, {\n\t/**\n\t * @cfg {Number} rowHeight\n\t * The height of a row in the grid.\n\t */\n\trowHeight: 19,\n\n\t/**\n\t * @cfg {Number} borderHeight\n\t * The combined height of border-top and border-bottom of a row.\n\t */\n\tborderHeight: 2,\n\n\t/**\n\t * @cfg {Boolean/Number} scrollDelay\n\t * The number of milliseconds before rendering rows out of the visible\n\t * viewing area. Defaults to 100. Rows will render immediately with a config\n\t * of false.\n\t */\n\tscrollDelay: 100,\n\n\t/**\n\t * @cfg {Number} cacheSize\n\t * The number of rows to look forward and backwards from the currently viewable\n\t * area.  The cache applies only to rows that have been rendered already.\n\t */\n\tcacheSize: 20,\n\n\t/**\n\t * @cfg {Number} cleanDelay\n\t * The number of milliseconds to buffer cleaning of extra rows not in the\n\t * cache.\n\t */\n\tcleanDelay: 500,\n\n\tinitTemplates : function(){\n\t\tExt.ux.grid.BufferView.superclass.initTemplates.call(this);\n\t\tvar ts = this.templates;\n\t\t// empty div to act as a place holder for a row\n\t        ts.rowHolder = new Ext.Template(\n\t\t        '<div class=\"x-grid3-row {alt}\" style=\"{tstyle}\"></div>'\n\t\t);\n\t\tts.rowHolder.disableFormats = true;\n\t\tts.rowHolder.compile();\n\n\t\tts.rowBody = new Ext.Template(\n\t\t        '<table class=\"x-grid3-row-table\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\" style=\"{tstyle}\">',\n\t\t\t'<tbody><tr>{cells}</tr>',\n\t\t\t(this.enableRowBody ? '<tr class=\"x-grid3-row-body-tr\" style=\"{bodyStyle}\"><td colspan=\"{cols}\" class=\"x-grid3-body-cell\" tabIndex=\"0\" hidefocus=\"on\"><div class=\"x-grid3-row-body\">{body}</div></td></tr>' : ''),\n\t\t\t'</tbody></table>'\n\t\t);\n\t\tts.rowBody.disableFormats = true;\n\t\tts.rowBody.compile();\n\t},\n\n\tgetStyleRowHeight : function(){\n\t\treturn Ext.isBorderBox ? (this.rowHeight + this.borderHeight) : this.rowHeight;\n\t},\n\n\tgetCalculatedRowHeight : function(){\n\t\treturn this.rowHeight + this.borderHeight;\n\t},\n\n\tgetVisibleRowCount : function(){\n\t\tvar rh = this.getCalculatedRowHeight(),\n\t\t    visibleHeight = this.scroller.dom.clientHeight;\n\t\treturn (visibleHeight < 1) ? 0 : Math.ceil(visibleHeight / rh);\n\t},\n\n\tgetVisibleRows: function(){\n\t\tvar count = this.getVisibleRowCount(),\n\t\t    sc = this.scroller.dom.scrollTop,\n\t\t    start = (sc === 0 ? 0 : Math.floor(sc/this.getCalculatedRowHeight())-1);\n\t\treturn {\n\t\t\tfirst: Math.max(start, 0),\n\t\t\tlast: Math.min(start + count + 2, this.ds.getCount()-1)\n\t\t};\n\t},\n\n\tdoRender : function(cs, rs, ds, startRow, colCount, stripe, onlyBody){\n\t\tvar ts = this.templates, \n            ct = ts.cell, \n            rt = ts.row, \n            rb = ts.rowBody, \n            last = colCount-1,\n\t\t    rh = this.getStyleRowHeight(),\n\t\t    vr = this.getVisibleRows(),\n\t\t    tstyle = 'width:'+this.getTotalWidth()+';height:'+rh+'px;',\n\t\t    // buffers\n\t\t    buf = [], \n            cb, \n            c, \n            p = {}, \n            rp = {tstyle: tstyle}, \n            r;\n\t\tfor (var j = 0, len = rs.length; j < len; j++) {\n\t\t\tr = rs[j]; cb = [];\n\t\t\tvar rowIndex = (j+startRow),\n\t\t\t    visible = rowIndex >= vr.first && rowIndex <= vr.last;\n\t\t\tif (visible) {\n\t\t\t\tfor (var i = 0; i < colCount; i++) {\n\t\t\t\t\tc = cs[i];\n\t\t\t\t\tp.id = c.id;\n\t\t\t\t\tp.css = i === 0 ? 'x-grid3-cell-first ' : (i == last ? 'x-grid3-cell-last ' : '');\n\t\t\t\t\tp.attr = p.cellAttr = \"\";\n\t\t\t\t\tp.value = c.renderer(r.data[c.name], p, r, rowIndex, i, ds);\n\t\t\t\t\tp.style = c.style;\n\t\t\t\t\tif (p.value === undefined || p.value === \"\") {\n\t\t\t\t\t\tp.value = \"&#160;\";\n\t\t\t\t\t}\n\t\t\t\t\tif (r.dirty && typeof r.modified[c.name] !== 'undefined') {\n\t\t\t\t\t\tp.css += ' x-grid3-dirty-cell';\n\t\t\t\t\t}\n\t\t\t\t\tcb[cb.length] = ct.apply(p);\n\t\t\t\t}\n\t\t\t}\n\t\t\tvar alt = [];\n\t\t\tif(stripe && ((rowIndex+1) % 2 === 0)){\n\t\t\t    alt[0] = \"x-grid3-row-alt\";\n\t\t\t}\n\t\t\tif(r.dirty){\n\t\t\t    alt[1] = \" x-grid3-dirty-row\";\n\t\t\t}\n\t\t\trp.cols = colCount;\n\t\t\tif(this.getRowClass){\n\t\t\t    alt[2] = this.getRowClass(r, rowIndex, rp, ds);\n\t\t\t}\n\t\t\trp.alt = alt.join(\" \");\n\t\t\trp.cells = cb.join(\"\");\n\t\t\tbuf[buf.length] =  !visible ? ts.rowHolder.apply(rp) : (onlyBody ? rb.apply(rp) : rt.apply(rp));\n\t\t}\n\t\treturn buf.join(\"\");\n\t},\n\n\tisRowRendered: function(index){\n\t\tvar row = this.getRow(index);\n\t\treturn row && row.childNodes.length > 0;\n\t},\n\n\tsyncScroll: function(){\n\t\tExt.ux.grid.BufferView.superclass.syncScroll.apply(this, arguments);\n\t\tthis.update();\n\t},\n\n\t// a (optionally) buffered method to update contents of gridview\n\tupdate: function(){\n\t\tif (this.scrollDelay) {\n\t\t\tif (!this.renderTask) {\n\t\t\t\tthis.renderTask = new Ext.util.DelayedTask(this.doUpdate, this);\n\t\t\t}\n\t\t\tthis.renderTask.delay(this.scrollDelay);\n\t\t}else{\n\t\t\tthis.doUpdate();\n\t\t}\n\t},\n    \n    onRemove : function(ds, record, index, isUpdate){\n        Ext.ux.grid.BufferView.superclass.onRemove.apply(this, arguments);\n        if(isUpdate !== true){\n            this.update();\n        }\n    },\n\n\tdoUpdate: function(){\n\t\tif (this.getVisibleRowCount() > 0) {\n\t\t\tvar g = this.grid, \n                cm = g.colModel, \n                ds = g.store,\n    \t        cs = this.getColumnData(),\n\t\t        vr = this.getVisibleRows(),\n                row;\n\t\t\tfor (var i = vr.first; i <= vr.last; i++) {\n\t\t\t\t// if row is NOT rendered and is visible, render it\n\t\t\t\tif(!this.isRowRendered(i) && (row = this.getRow(i))){\n\t\t\t\t\tvar html = this.doRender(cs, [ds.getAt(i)], ds, i, cm.getColumnCount(), g.stripeRows, true);\n\t\t\t\t\trow.innerHTML = html;\n\t\t\t\t}\n\t\t\t}\n\t\t\tthis.clean();\n\t\t}\n\t},\n\n\t// a buffered method to clean rows\n\tclean : function(){\n\t\tif(!this.cleanTask){\n\t\t\tthis.cleanTask = new Ext.util.DelayedTask(this.doClean, this);\n\t\t}\n\t\tthis.cleanTask.delay(this.cleanDelay);\n\t},\n\n\tdoClean: function(){\n\t\tif (this.getVisibleRowCount() > 0) {\n\t\t\tvar vr = this.getVisibleRows();\n\t\t\tvr.first -= this.cacheSize;\n\t\t\tvr.last += this.cacheSize;\n\n\t\t\tvar i = 0, rows = this.getRows();\n\t\t\t// if first is less than 0, all rows have been rendered\n\t\t\t// so lets clean the end...\n\t\t\tif(vr.first <= 0){\n\t\t\t\ti = vr.last + 1;\n\t\t\t}\n\t\t\tfor(var len = this.ds.getCount(); i < len; i++){\n\t\t\t\t// if current row is outside of first and last and\n\t\t\t\t// has content, update the innerHTML to nothing\n\t\t\t\tif ((i < vr.first || i > vr.last) && rows[i].innerHTML) {\n\t\t\t\t\trows[i].innerHTML = '';\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t},\n    \n    removeTask: function(name){\n        var task = this[name];\n        if(task && task.cancel){\n            task.cancel();\n            this[name] = null;\n        }\n    },\n    \n    destroy : function(){\n        this.removeTask('cleanTask');\n        this.removeTask('renderTask');  \n        Ext.ux.grid.BufferView.superclass.destroy.call(this);\n    },\n\n\tlayout: function(){\n\t\tExt.ux.grid.BufferView.superclass.layout.call(this);\n\t\tthis.update();\n\t}\n});"
  },
  {
    "path": "client/src/ext/ux/CenterLayout.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n// We are adding these custom layouts to a namespace that does not\n// exist by default in Ext, so we have to add the namespace first:\nExt.ns('Ext.ux.layout');\n\n/**\n * @class Ext.ux.layout.CenterLayout\n * @extends Ext.layout.FitLayout\n * <p>This is a very simple layout style used to center contents within a container.  This layout works within\n * nested containers and can also be used as expected as a Viewport layout to center the page layout.</p>\n * <p>As a subclass of FitLayout, CenterLayout expects to have a single child panel of the container that uses\n * the layout.  The layout does not require any config options, although the child panel contained within the\n * layout must provide a fixed or percentage width.  The child panel's height will fit to the container by\n * default, but you can specify <tt>autoHeight:true</tt> to allow it to autosize based on its content height.\n * Example usage:</p>\n * <pre><code>\n// The content panel is centered in the container\nvar p = new Ext.Panel({\n    title: 'Center Layout',\n    layout: 'ux.center',\n    items: [{\n        title: 'Centered Content',\n        width: '75%',\n        html: 'Some content'\n    }]\n});\n\n// If you leave the title blank and specify no border\n// you'll create a non-visual, structural panel just\n// for centering the contents in the main container.\nvar p = new Ext.Panel({\n    layout: 'ux.center',\n    border: false,\n    items: [{\n        title: 'Centered Content',\n        width: 300,\n        autoHeight: true,\n        html: 'Some content'\n    }]\n});\n</code></pre>\n */\nExt.ux.layout.CenterLayout = Ext.extend(Ext.layout.FitLayout, {\n\t// private\n    setItemSize : function(item, size){\n        this.container.addClass('ux-layout-center');\n        item.addClass('ux-layout-center-item');\n        if(item && size.height > 0){\n            if(item.width){\n                size.width = item.width;\n            }\n            item.setSize(size);\n        }\n    }\n});\n\nExt.Container.LAYOUTS['ux.center'] = Ext.ux.layout.CenterLayout;\n"
  },
  {
    "path": "client/src/ext/ux/CheckColumn.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.CheckColumn\n * @extends Ext.grid.Column\n * <p>A Column subclass which renders a checkbox in each column cell which toggles the truthiness of the associated data field on click.</p>\n * <p><b>Note. As of ExtJS 3.3 this no longer has to be configured as a plugin of the GridPanel.</b></p>\n * <p>Example usage:</p>\n * <pre><code>\nvar cm = new Ext.grid.ColumnModel([{\n       header: 'Foo',\n       ...\n    },{\n       xtype: 'checkcolumn',\n       header: 'Indoor?',\n       dataIndex: 'indoor',\n       width: 55\n    }\n]);\n\n// create the grid\nvar grid = new Ext.grid.EditorGridPanel({\n    ...\n    colModel: cm,\n    ...\n});\n * </code></pre>\n * In addition to toggling a Boolean value within the record data, this\n * class toggles a css class between <tt>'x-grid3-check-col'</tt> and\n * <tt>'x-grid3-check-col-on'</tt> to alter the background image used for\n * a column.\n */\nExt.ux.grid.CheckColumn = Ext.extend(Ext.grid.Column, {\n\n    /**\n     * @private\n     * Process and refire events routed from the GridView's processEvent method.\n     */\n    processEvent : function(name, e, grid, rowIndex, colIndex){\n        if (name == 'mousedown') {\n            var record = grid.store.getAt(rowIndex);\n            record.set(this.dataIndex, !record.data[this.dataIndex]);\n            return false; // Cancel row selection.\n        } else {\n            return Ext.grid.ActionColumn.superclass.processEvent.apply(this, arguments);\n        }\n    },\n\n    renderer : function(v, p, record){\n        p.css += ' x-grid3-check-col-td'; \n        return String.format('<div class=\"x-grid3-check-col{0}\">&#160;</div>', v ? '-on' : '');\n    },\n\n    // Deprecate use as a plugin. Remove in 4.0\n    init: Ext.emptyFn\n});\n\n// register ptype. Deprecate. Remove in 4.0\nExt.preg('checkcolumn', Ext.ux.grid.CheckColumn);\n\n// backwards compat. Remove in 4.0\nExt.grid.CheckColumn = Ext.ux.grid.CheckColumn;\n\n// register Column xtype\nExt.grid.Column.types.checkcolumn = Ext.ux.grid.CheckColumn;"
  },
  {
    "path": "client/src/ext/ux/ColumnHeaderGroup.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.grid');\n\nExt.ux.grid.ColumnHeaderGroup = Ext.extend(Ext.util.Observable, {\n\n    constructor: function(config){\n        this.config = config;\n    },\n\n    init: function(grid){\n        Ext.applyIf(grid.colModel, this.config);\n        Ext.apply(grid.getView(), this.viewConfig);\n    },\n\n    viewConfig: {\n        initTemplates: function(){\n            this.constructor.prototype.initTemplates.apply(this, arguments);\n            var ts = this.templates || {};\n            if(!ts.gcell){\n                ts.gcell = new Ext.XTemplate('<td class=\"x-grid3-hd x-grid3-gcell x-grid3-td-{id} ux-grid-hd-group-row-{row} {cls}\" style=\"{style}\">', '<div {tooltip} class=\"x-grid3-hd-inner x-grid3-hd-{id}\" unselectable=\"on\" style=\"{istyle}\">', this.grid.enableHdMenu ? '<a class=\"x-grid3-hd-btn\" href=\"#\"></a>' : '', '{value}</div></td>');\n            }\n            this.templates = ts;\n            this.hrowRe = new RegExp(\"ux-grid-hd-group-row-(\\\\d+)\", \"\");\n        },\n\n        renderHeaders: function(){\n            var ts = this.templates, headers = [], cm = this.cm, rows = cm.rows, tstyle = 'width:' + this.getTotalWidth() + ';';\n\n            for(var row = 0, rlen = rows.length; row < rlen; row++){\n                var r = rows[row], cells = [];\n                for(var i = 0, gcol = 0, len = r.length; i < len; i++){\n                    var group = r[i];\n                    group.colspan = group.colspan || 1;\n                    var id = this.getColumnId(group.dataIndex ? cm.findColumnIndex(group.dataIndex) : gcol), gs = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupStyle.call(this, group, gcol);\n                    cells[i] = ts.gcell.apply({\n                        cls: 'ux-grid-hd-group-cell',\n                        id: id,\n                        row: row,\n                        style: 'width:' + gs.width + ';' + (gs.hidden ? 'display:none;' : '') + (group.align ? 'text-align:' + group.align + ';' : ''),\n                        tooltip: group.tooltip ? (Ext.QuickTips.isEnabled() ? 'ext:qtip' : 'title') + '=\"' + group.tooltip + '\"' : '',\n                        istyle: group.align == 'right' ? 'padding-right:16px' : '',\n                        btn: this.grid.enableHdMenu && group.header,\n                        value: group.header || '&nbsp;'\n                    });\n                    gcol += group.colspan;\n                }\n                headers[row] = ts.header.apply({\n                    tstyle: tstyle,\n                    cells: cells.join('')\n                });\n            }\n            headers.push(this.constructor.prototype.renderHeaders.apply(this, arguments));\n            return headers.join('');\n        },\n\n        onColumnWidthUpdated: function(){\n            this.constructor.prototype.onColumnWidthUpdated.apply(this, arguments);\n            Ext.ux.grid.ColumnHeaderGroup.prototype.updateGroupStyles.call(this);\n        },\n\n        onAllColumnWidthsUpdated: function(){\n            this.constructor.prototype.onAllColumnWidthsUpdated.apply(this, arguments);\n            Ext.ux.grid.ColumnHeaderGroup.prototype.updateGroupStyles.call(this);\n        },\n\n        onColumnHiddenUpdated: function(){\n            this.constructor.prototype.onColumnHiddenUpdated.apply(this, arguments);\n            Ext.ux.grid.ColumnHeaderGroup.prototype.updateGroupStyles.call(this);\n        },\n\n        getHeaderCell: function(index){\n            return this.mainHd.query(this.cellSelector)[index];\n        },\n\n        findHeaderCell: function(el){\n            return el ? this.fly(el).findParent('td.x-grid3-hd', this.cellSelectorDepth) : false;\n        },\n\n        findHeaderIndex: function(el){\n            var cell = this.findHeaderCell(el);\n            return cell ? this.getCellIndex(cell) : false;\n        },\n\n        updateSortIcon: function(col, dir){\n            var sc = this.sortClasses, hds = this.mainHd.select(this.cellSelector).removeClass(sc);\n            hds.item(col).addClass(sc[dir == \"DESC\" ? 1 : 0]);\n        },\n\n        handleHdDown: function(e, t){\n            var el = Ext.get(t);\n            if(el.hasClass('x-grid3-hd-btn')){\n                e.stopEvent();\n                var hd = this.findHeaderCell(t);\n                Ext.fly(hd).addClass('x-grid3-hd-menu-open');\n                var index = this.getCellIndex(hd);\n                this.hdCtxIndex = index;\n                var ms = this.hmenu.items, cm = this.cm;\n                ms.get('asc').setDisabled(!cm.isSortable(index));\n                ms.get('desc').setDisabled(!cm.isSortable(index));\n                this.hmenu.on('hide', function(){\n                    Ext.fly(hd).removeClass('x-grid3-hd-menu-open');\n                }, this, {\n                    single: true\n                });\n                this.hmenu.show(t, 'tl-bl?');\n            }else if(el.hasClass('ux-grid-hd-group-cell') || Ext.fly(t).up('.ux-grid-hd-group-cell')){\n                e.stopEvent();\n            }\n        },\n\n        handleHdMove: function(e, t){\n            var hd = this.findHeaderCell(this.activeHdRef);\n            if(hd && !this.headersDisabled && !Ext.fly(hd).hasClass('ux-grid-hd-group-cell')){\n                var hw = this.splitHandleWidth || 5, r = this.activeHdRegion, x = e.getPageX(), ss = hd.style, cur = '';\n                if(this.grid.enableColumnResize !== false){\n                    if(x - r.left <= hw && this.cm.isResizable(this.activeHdIndex - 1)){\n                        cur = Ext.isAir ? 'move' : Ext.isWebKit ? 'e-resize' : 'col-resize'; // col-resize\n                                                                                                // not\n                                                                                                // always\n                                                                                                // supported\n                    }else if(r.right - x <= (!this.activeHdBtn ? hw : 2) && this.cm.isResizable(this.activeHdIndex)){\n                        cur = Ext.isAir ? 'move' : Ext.isWebKit ? 'w-resize' : 'col-resize';\n                    }\n                }\n                ss.cursor = cur;\n            }\n        },\n\n        handleHdOver: function(e, t){\n            var hd = this.findHeaderCell(t);\n            if(hd && !this.headersDisabled){\n                this.activeHdRef = t;\n                this.activeHdIndex = this.getCellIndex(hd);\n                var fly = this.fly(hd);\n                this.activeHdRegion = fly.getRegion();\n                if(!(this.cm.isMenuDisabled(this.activeHdIndex) || fly.hasClass('ux-grid-hd-group-cell'))){\n                    fly.addClass('x-grid3-hd-over');\n                    this.activeHdBtn = fly.child('.x-grid3-hd-btn');\n                    if(this.activeHdBtn){\n                        this.activeHdBtn.dom.style.height = (hd.firstChild.offsetHeight - 1) + 'px';\n                    }\n                }\n            }\n        },\n\n        handleHdOut: function(e, t){\n            var hd = this.findHeaderCell(t);\n            if(hd && (!Ext.isIE || !e.within(hd, true))){\n                this.activeHdRef = null;\n                this.fly(hd).removeClass('x-grid3-hd-over');\n                hd.style.cursor = '';\n            }\n        },\n\n        handleHdMenuClick: function(item){\n            var index = this.hdCtxIndex, cm = this.cm, ds = this.ds, id = item.getItemId();\n            switch(id){\n                case 'asc':\n                    ds.sort(cm.getDataIndex(index), 'ASC');\n                    break;\n                case 'desc':\n                    ds.sort(cm.getDataIndex(index), 'DESC');\n                    break;\n                default:\n                    if(id.substr(0, 6) == 'group-'){\n                        var i = id.split('-'), row = parseInt(i[1], 10), col = parseInt(i[2], 10), r = this.cm.rows[row], group, gcol = 0;\n                        for(var i = 0, len = r.length; i < len; i++){\n                            group = r[i];\n                            if(col >= gcol && col < gcol + group.colspan){\n                                break;\n                            }\n                            gcol += group.colspan;\n                        }\n                        if(item.checked){\n                            var max = cm.getColumnsBy(this.isHideableColumn, this).length;\n                            for(var i = gcol, len = gcol + group.colspan; i < len; i++){\n                                if(!cm.isHidden(i)){\n                                    max--;\n                                }\n                            }\n                            if(max < 1){\n                                this.onDenyColumnHide();\n                                return false;\n                            }\n                        }\n                        for(var i = gcol, len = gcol + group.colspan; i < len; i++){\n                            if(cm.config[i].fixed !== true && cm.config[i].hideable !== false){\n                                cm.setHidden(i, item.checked);\n                            }\n                        }\n                    }else if(id.substr(0, 4) == 'col-'){\n                        index = cm.getIndexById(id.substr(4));\n                        if(index != -1){\n                            if(item.checked && cm.getColumnsBy(this.isHideableColumn, this).length <= 1){\n                                this.onDenyColumnHide();\n                                return false;\n                            }\n                            cm.setHidden(index, item.checked);\n                        }\n                    }\n                    if(id.substr(0, 6) == 'group-' || id.substr(0, 4) == 'col-'){\n                        item.checked = !item.checked;\n                        if(item.menu){\n                            var updateChildren = function(menu){\n                                menu.items.each(function(childItem){\n                                    if(!childItem.disabled){\n                                        childItem.setChecked(item.checked, false);\n                                        if(childItem.menu){\n                                            updateChildren(childItem.menu);\n                                        }\n                                    }\n                                });\n                            }\n                            updateChildren(item.menu);\n                        }\n                        var parentMenu = item, parentItem;\n                        while(parentMenu = parentMenu.parentMenu){\n                            if(!parentMenu.parentMenu || !(parentItem = parentMenu.parentMenu.items.get(parentMenu.getItemId())) || !parentItem.setChecked){\n                                break;\n                            }\n                            var checked = parentMenu.items.findIndexBy(function(m){\n                                return m.checked;\n                            }) >= 0;\n                            parentItem.setChecked(checked, true);\n                        }\n                        item.checked = !item.checked;\n                    }\n            }\n            return true;\n        },\n\n        beforeColMenuShow: function(){\n            var cm = this.cm, rows = this.cm.rows;\n            this.colMenu.removeAll();\n            for(var col = 0, clen = cm.getColumnCount(); col < clen; col++){\n                var menu = this.colMenu, title = cm.getColumnHeader(col), text = [];\n                if(cm.config[col].fixed !== true && cm.config[col].hideable !== false){\n                    for(var row = 0, rlen = rows.length; row < rlen; row++){\n                        var r = rows[row], group, gcol = 0;\n                        for(var i = 0, len = r.length; i < len; i++){\n                            group = r[i];\n                            if(col >= gcol && col < gcol + group.colspan){\n                                break;\n                            }\n                            gcol += group.colspan;\n                        }\n                        if(group && group.header){\n                            if(cm.hierarchicalColMenu){\n                                var gid = 'group-' + row + '-' + gcol,\n                                    item = menu.items ? menu.getComponent(gid) : null,\n                                    submenu = item ? item.menu : null;\n                                if(!submenu){\n                                    submenu = new Ext.menu.Menu({\n                                        itemId: gid\n                                    });\n                                    submenu.on(\"itemclick\", this.handleHdMenuClick, this);\n                                    var checked = false, disabled = true;\n                                    for(var c = gcol, lc = gcol + group.colspan; c < lc; c++){\n                                        if(!cm.isHidden(c)){\n                                            checked = true;\n                                        }\n                                        if(cm.config[c].hideable !== false){\n                                            disabled = false;\n                                        }\n                                    }\n                                    menu.add({\n                                        itemId: gid,\n                                        text: group.header,\n                                        menu: submenu,\n                                        hideOnClick: false,\n                                        checked: checked,\n                                        disabled: disabled\n                                    });\n                                }\n                                menu = submenu;\n                            }else{\n                                text.push(group.header);\n                            }\n                        }\n                    }\n                    text.push(title);\n                    menu.add(new Ext.menu.CheckItem({\n                        itemId: \"col-\" + cm.getColumnId(col),\n                        text: text.join(' '),\n                        checked: !cm.isHidden(col),\n                        hideOnClick: false,\n                        disabled: cm.config[col].hideable === false\n                    }));\n                }\n            }\n        },\n\n        afterRenderUI: function(){\n            this.constructor.prototype.afterRenderUI.apply(this, arguments);\n            Ext.apply(this.columnDrop, Ext.ux.grid.ColumnHeaderGroup.prototype.columnDropConfig);\n            Ext.apply(this.splitZone, Ext.ux.grid.ColumnHeaderGroup.prototype.splitZoneConfig);\n        }\n    },\n\n    splitZoneConfig: {\n        allowHeaderDrag: function(e){\n            return !e.getTarget(null, null, true).hasClass('ux-grid-hd-group-cell');\n        }\n    },\n\n    columnDropConfig: {\n        getTargetFromEvent: function(e){\n            var t = Ext.lib.Event.getTarget(e);\n            return this.view.findHeaderCell(t);\n        },\n\n        positionIndicator: function(h, n, e){\n            var data = Ext.ux.grid.ColumnHeaderGroup.prototype.getDragDropData.call(this, h, n, e);\n            if(data === false){\n                return false;\n            }\n            var px = data.px + this.proxyOffsets[0];\n            this.proxyTop.setLeftTop(px, data.r.top + this.proxyOffsets[1]);\n            this.proxyTop.show();\n            this.proxyBottom.setLeftTop(px, data.r.bottom);\n            this.proxyBottom.show();\n            return data.pt;\n        },\n\n        onNodeDrop: function(n, dd, e, data){\n            var h = data.header;\n            if(h != n){\n                var d = Ext.ux.grid.ColumnHeaderGroup.prototype.getDragDropData.call(this, h, n, e);\n                if(d === false){\n                    return false;\n                }\n                var cm = this.grid.colModel, right = d.oldIndex < d.newIndex, rows = cm.rows;\n                for(var row = d.row, rlen = rows.length; row < rlen; row++){\n                    var r = rows[row], len = r.length, fromIx = 0, span = 1, toIx = len;\n                    for(var i = 0, gcol = 0; i < len; i++){\n                        var group = r[i];\n                        if(d.oldIndex >= gcol && d.oldIndex < gcol + group.colspan){\n                            fromIx = i;\n                        }\n                        if(d.oldIndex + d.colspan - 1 >= gcol && d.oldIndex + d.colspan - 1 < gcol + group.colspan){\n                            span = i - fromIx + 1;\n                        }\n                        if(d.newIndex >= gcol && d.newIndex < gcol + group.colspan){\n                            toIx = i;\n                        }\n                        gcol += group.colspan;\n                    }\n                    var groups = r.splice(fromIx, span);\n                    rows[row] = r.splice(0, toIx - (right ? span : 0)).concat(groups).concat(r);\n                }\n                for(var c = 0; c < d.colspan; c++){\n                    var oldIx = d.oldIndex + (right ? 0 : c), newIx = d.newIndex + (right ? -1 : c);\n                    cm.moveColumn(oldIx, newIx);\n                    this.grid.fireEvent(\"columnmove\", oldIx, newIx);\n                }\n                return true;\n            }\n            return false;\n        }\n    },\n\n    getGroupStyle: function(group, gcol){\n        var width = 0, hidden = true;\n        for(var i = gcol, len = gcol + group.colspan; i < len; i++){\n            if(!this.cm.isHidden(i)){\n                var cw = this.cm.getColumnWidth(i);\n                if(typeof cw == 'number'){\n                    width += cw;\n                }\n                hidden = false;\n            }\n        }\n        return {\n            width: (Ext.isBorderBox || (Ext.isWebKit && !Ext.isSafari2) ? width : Math.max(width - this.borderWidth, 0)) + 'px',\n            hidden: hidden\n        };\n    },\n\n    updateGroupStyles: function(col){\n        var tables = this.mainHd.query('.x-grid3-header-offset > table'), tw = this.getTotalWidth(), rows = this.cm.rows;\n        for(var row = 0; row < tables.length; row++){\n            tables[row].style.width = tw;\n            if(row < rows.length){\n                var cells = tables[row].firstChild.firstChild.childNodes;\n                for(var i = 0, gcol = 0; i < cells.length; i++){\n                    var group = rows[row][i];\n                    if((typeof col != 'number') || (col >= gcol && col < gcol + group.colspan)){\n                        var gs = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupStyle.call(this, group, gcol);\n                        cells[i].style.width = gs.width;\n                        cells[i].style.display = gs.hidden ? 'none' : '';\n                    }\n                    gcol += group.colspan;\n                }\n            }\n        }\n    },\n\n    getGroupRowIndex: function(el){\n        if(el){\n            var m = el.className.match(this.hrowRe);\n            if(m && m[1]){\n                return parseInt(m[1], 10);\n            }\n        }\n        return this.cm.rows.length;\n    },\n\n    getGroupSpan: function(row, col){\n        if(row < 0){\n            return {\n                col: 0,\n                colspan: this.cm.getColumnCount()\n            };\n        }\n        var r = this.cm.rows[row];\n        if(r){\n            for(var i = 0, gcol = 0, len = r.length; i < len; i++){\n                var group = r[i];\n                if(col >= gcol && col < gcol + group.colspan){\n                    return {\n                        col: gcol,\n                        colspan: group.colspan\n                    };\n                }\n                gcol += group.colspan;\n            }\n            return {\n                col: gcol,\n                colspan: 0\n            };\n        }\n        return {\n            col: col,\n            colspan: 1\n        };\n    },\n\n    getDragDropData: function(h, n, e){\n        if(h.parentNode != n.parentNode){\n            return false;\n        }\n        var cm = this.grid.colModel, x = Ext.lib.Event.getPageX(e), r = Ext.lib.Dom.getRegion(n.firstChild), px, pt;\n        if((r.right - x) <= (r.right - r.left) / 2){\n            px = r.right + this.view.borderWidth;\n            pt = \"after\";\n        }else{\n            px = r.left;\n            pt = \"before\";\n        }\n        var oldIndex = this.view.getCellIndex(h), newIndex = this.view.getCellIndex(n);\n        if(cm.isFixed(newIndex)){\n            return false;\n        }\n        var row = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupRowIndex.call(this.view, h),\n            oldGroup = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupSpan.call(this.view, row, oldIndex),\n            newGroup = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupSpan.call(this.view, row, newIndex),\n            oldIndex = oldGroup.col;\n            newIndex = newGroup.col + (pt == \"after\" ? newGroup.colspan : 0);\n        if(newIndex >= oldGroup.col && newIndex <= oldGroup.col + oldGroup.colspan){\n            return false;\n        }\n        var parentGroup = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupSpan.call(this.view, row - 1, oldIndex);\n        if(newIndex < parentGroup.col || newIndex > parentGroup.col + parentGroup.colspan){\n            return false;\n        }\n        return {\n            r: r,\n            px: px,\n            pt: pt,\n            row: row,\n            oldIndex: oldIndex,\n            newIndex: newIndex,\n            colspan: oldGroup.colspan\n        };\n    }\n});"
  },
  {
    "path": "client/src/ext/ux/ColumnNodeUI.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.tree');\n\n/**\n * @class Ext.ux.tree.ColumnTree\n * @extends Ext.tree.TreePanel\n * \n * @xtype columntree\n */\nExt.ux.tree.ColumnTree = Ext.extend(Ext.tree.TreePanel, {\n    lines : false,\n    borderWidth : Ext.isBorderBox ? 0 : 2, // the combined left/right border for each cell\n    cls : 'x-column-tree',\n\n    onRender : function(){\n        Ext.tree.ColumnTree.superclass.onRender.apply(this, arguments);\n        this.headers = this.header.createChild({cls:'x-tree-headers'});\n\n        var cols = this.columns, c;\n        var totalWidth = 0;\n        var scrollOffset = 19; // similar to Ext.grid.GridView default\n\n        for(var i = 0, len = cols.length; i < len; i++){\n             c = cols[i];\n             totalWidth += c.width;\n             this.headers.createChild({\n                 cls:'x-tree-hd ' + (c.cls?c.cls+'-hd':''),\n                 cn: {\n                     cls:'x-tree-hd-text',\n                     html: c.header\n                 },\n                 style:'width:'+(c.width-this.borderWidth)+'px;'\n             });\n        }\n        this.headers.createChild({cls:'x-clear'});\n        // prevent floats from wrapping when clipped\n        this.headers.setWidth(totalWidth+scrollOffset);\n        this.innerCt.setWidth(totalWidth);\n    }\n});\n\nExt.reg('columntree', Ext.ux.tree.ColumnTree);\n\n//backwards compat\nExt.tree.ColumnTree = Ext.ux.tree.ColumnTree;\n\n\n/**\n * @class Ext.ux.tree.ColumnNodeUI\n * @extends Ext.tree.TreeNodeUI\n */\nExt.ux.tree.ColumnNodeUI = Ext.extend(Ext.tree.TreeNodeUI, {\n    focus: Ext.emptyFn, // prevent odd scrolling behavior\n\n    renderElements : function(n, a, targetNode, bulkRender){\n        this.indentMarkup = n.parentNode ? n.parentNode.ui.getChildIndent() : '';\n\n        var t = n.getOwnerTree();\n        var cols = t.columns;\n        var bw = t.borderWidth;\n        var c = cols[0];\n\n        var buf = [\n             '<li class=\"x-tree-node\"><div ext:tree-node-id=\"',n.id,'\" class=\"x-tree-node-el x-tree-node-leaf ', a.cls,'\">',\n                '<div class=\"x-tree-col\" style=\"width:',c.width-bw,'px;\">',\n                    '<span class=\"x-tree-node-indent\">',this.indentMarkup,\"</span>\",\n                    '<img src=\"', this.emptyIcon, '\" class=\"x-tree-ec-icon x-tree-elbow\">',\n                    '<img src=\"', a.icon || this.emptyIcon, '\" class=\"x-tree-node-icon',(a.icon ? \" x-tree-node-inline-icon\" : \"\"),(a.iconCls ? \" \"+a.iconCls : \"\"),'\" unselectable=\"on\">',\n                    '<a hidefocus=\"on\" class=\"x-tree-node-anchor\" href=\"',a.href ? a.href : \"#\",'\" tabIndex=\"1\" ',\n                    a.hrefTarget ? ' target=\"'+a.hrefTarget+'\"' : \"\", '>',\n                    '<span unselectable=\"on\">', n.text || (c.renderer ? c.renderer(a[c.dataIndex], n, a) : a[c.dataIndex]),\"</span></a>\",\n                \"</div>\"];\n         for(var i = 1, len = cols.length; i < len; i++){\n             c = cols[i];\n\n             buf.push('<div class=\"x-tree-col ',(c.cls?c.cls:''),'\" style=\"width:',c.width-bw,'px;\">',\n                        '<div class=\"x-tree-col-text\">',(c.renderer ? c.renderer(a[c.dataIndex], n, a) : a[c.dataIndex]),\"</div>\",\n                      \"</div>\");\n         }\n         buf.push(\n            '<div class=\"x-clear\"></div></div>',\n            '<ul class=\"x-tree-node-ct\" style=\"display:none;\"></ul>',\n            \"</li>\");\n\n        if(bulkRender !== true && n.nextSibling && n.nextSibling.ui.getEl()){\n            this.wrap = Ext.DomHelper.insertHtml(\"beforeBegin\",\n                                n.nextSibling.ui.getEl(), buf.join(\"\"));\n        }else{\n            this.wrap = Ext.DomHelper.insertHtml(\"beforeEnd\", targetNode, buf.join(\"\"));\n        }\n\n        this.elNode = this.wrap.childNodes[0];\n        this.ctNode = this.wrap.childNodes[1];\n        var cs = this.elNode.firstChild.childNodes;\n        this.indentNode = cs[0];\n        this.ecNode = cs[1];\n        this.iconNode = cs[2];\n        this.anchor = cs[3];\n        this.textNode = cs[3].firstChild;\n    }\n});\n\n//backwards compat\nExt.tree.ColumnNodeUI = Ext.ux.tree.ColumnNodeUI;\n"
  },
  {
    "path": "client/src/ext/ux/DataView-more.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * @class Ext.DataView.LabelEditor\n * @extends Ext.Editor\n * \n */\nExt.DataView.LabelEditor = Ext.extend(Ext.Editor, {\n    alignment: \"tl-tl\",\n    hideEl : false,\n    cls: \"x-small-editor\",\n    shim: false,\n    completeOnEnter: true,\n    cancelOnEsc: true,\n    labelSelector: 'span.x-editable',\n    \n    constructor: function(cfg, field){\n        Ext.DataView.LabelEditor.superclass.constructor.call(this,\n            field || new Ext.form.TextField({\n                allowBlank: false,\n                growMin:90,\n                growMax:240,\n                grow:true,\n                selectOnFocus:true\n            }), cfg\n        );\n    },\n    \n    init : function(view){\n        this.view = view;\n        view.on('render', this.initEditor, this);\n        this.on('complete', this.onSave, this);\n    },\n\n    initEditor : function(){\n        this.view.on({\n            scope: this,\n            containerclick: this.doBlur,\n            click: this.doBlur\n        });\n        this.view.getEl().on('mousedown', this.onMouseDown, this, {delegate: this.labelSelector});\n    },\n    \n    doBlur: function(){\n        if(this.editing){\n            this.field.blur();\n        }\n    },\n\n    onMouseDown : function(e, target){\n        if(!e.ctrlKey && !e.shiftKey){\n            var item = this.view.findItemFromChild(target);\n            e.stopEvent();\n            var record = this.view.store.getAt(this.view.indexOf(item));\n            this.startEdit(target, record.data[this.dataIndex]);\n            this.activeRecord = record;\n        }else{\n            e.preventDefault();\n        }\n    },\n\n    onSave : function(ed, value){\n        this.activeRecord.set(this.dataIndex, value);\n    }\n});\n\n\nExt.DataView.DragSelector = function(cfg){\n    cfg = cfg || {};\n    var view, proxy, tracker;\n    var rs, bodyRegion, dragRegion = new Ext.lib.Region(0,0,0,0);\n    var dragSafe = cfg.dragSafe === true;\n\n    this.init = function(dataView){\n        view = dataView;\n        view.on('render', onRender);\n    };\n\n    function fillRegions(){\n        rs = [];\n        view.all.each(function(el){\n            rs[rs.length] = el.getRegion();\n        });\n        bodyRegion = view.el.getRegion();\n    }\n\n    function cancelClick(){\n        return false;\n    }\n\n    function onBeforeStart(e){\n        return !dragSafe || e.target == view.el.dom;\n    }\n\n    function onStart(e){\n        view.on('containerclick', cancelClick, view, {single:true});\n        if(!proxy){\n            proxy = view.el.createChild({cls:'x-view-selector'});\n        }else{\n            if(proxy.dom.parentNode !== view.el.dom){\n                view.el.dom.appendChild(proxy.dom);\n            }\n            proxy.setDisplayed('block');\n        }\n        fillRegions();\n        view.clearSelections();\n    }\n\n    function onDrag(e){\n        var startXY = tracker.startXY;\n        var xy = tracker.getXY();\n\n        var x = Math.min(startXY[0], xy[0]);\n        var y = Math.min(startXY[1], xy[1]);\n        var w = Math.abs(startXY[0] - xy[0]);\n        var h = Math.abs(startXY[1] - xy[1]);\n\n        dragRegion.left = x;\n        dragRegion.top = y;\n        dragRegion.right = x+w;\n        dragRegion.bottom = y+h;\n\n        dragRegion.constrainTo(bodyRegion);\n        proxy.setRegion(dragRegion);\n\n        for(var i = 0, len = rs.length; i < len; i++){\n            var r = rs[i], sel = dragRegion.intersect(r);\n            if(sel && !r.selected){\n                r.selected = true;\n                view.select(i, true);\n            }else if(!sel && r.selected){\n                r.selected = false;\n                view.deselect(i);\n            }\n        }\n    }\n\n    function onEnd(e){\n        if (!Ext.isIE) {\n            view.un('containerclick', cancelClick, view);    \n        }        \n        if(proxy){\n            proxy.setDisplayed(false);\n        }\n    }\n\n    function onRender(view){\n        tracker = new Ext.dd.DragTracker({\n            onBeforeStart: onBeforeStart,\n            onStart: onStart,\n            onDrag: onDrag,\n            onEnd: onEnd\n        });\n        tracker.initEl(view.el);\n    }\n};"
  },
  {
    "path": "client/src/ext/ux/DataViewTransition.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * @class Ext.ux.DataViewTransition\n * @extends Object\n * @author Ed Spencer (http://extjs.com)\n * Transition plugin for DataViews\n */\nExt.ux.DataViewTransition = Ext.extend(Object, {\n\n    /**\n     * @property defaults\n     * @type Object\n     * Default configuration options for all DataViewTransition instances\n     */\n    defaults: {\n        duration  : 750,\n        idProperty: 'id'\n    },\n    \n    /**\n     * Creates the plugin instance, applies defaults\n     * @constructor\n     * @param {Object} config Optional config object\n     */\n    constructor: function(config) {\n        Ext.apply(this, config || {}, this.defaults);\n    },\n\n    /**\n     * Initializes the transition plugin. Overrides the dataview's default refresh function\n     * @param {Ext.DataView} dataview The dataview\n     */\n    init: function(dataview) {\n        /**\n         * @property dataview\n         * @type Ext.DataView\n         * Reference to the DataView this instance is bound to\n         */\n        this.dataview = dataview;\n        \n        var idProperty = this.idProperty;\n        dataview.blockRefresh = true;\n        dataview.updateIndexes = dataview.updateIndexes.createSequence(function() {\n            this.getTemplateTarget().select(this.itemSelector).each(function(element, composite, index) {\n                element.id = element.dom.id = String.format(\"{0}-{1}\", dataview.id, store.getAt(index).get(idProperty));\n            }, this);\n        }, dataview);\n        \n        /**\n         * @property dataviewID\n         * @type String\n         * The string ID of the DataView component. This is used internally when animating child objects\n         */\n        this.dataviewID = dataview.id;\n        \n        /**\n         * @property cachedStoreData\n         * @type Object\n         * A cache of existing store data, keyed by id. This is used to determine\n         * whether any items were added or removed from the store on data change\n         */\n        this.cachedStoreData = {};\n        \n        var store = dataview.store;\n        \n        //cache the data immediately, and again on any load operation\n        this.cacheStoreData(store);\n        store.on('load', this.cacheStoreData, this);\n        \n        store.on('datachanged', function(store) {\n            var parentEl = dataview.getTemplateTarget(),\n                calcItem = store.getAt(0),\n                added    = this.getAdded(store),\n                removed  = this.getRemoved(store),\n                previous = this.getRemaining(store),\n                existing = Ext.apply({}, previous, added);\n            \n            //hide old items\n            Ext.each(removed, function(item) {\n                Ext.fly(this.dataviewID + '-' + item.get(this.idProperty)).fadeOut({\n                    remove  : false,\n                    duration: duration / 1000,\n                    useDisplay: true\n                });\n            }, this);\n            \n            //store is empty\n            if (calcItem == undefined) {\n                this.cacheStoreData(store);\n                return;\n            }\n            \n            var el = parentEl.child(\"#\" + this.dataviewID + \"-\" + calcItem.get(this.idProperty));\n            \n            //calculate the number of rows and columns we have\n            var itemCount   = store.getCount(),\n                itemWidth   = el.getMargins('lr') + el.getWidth(),\n                itemHeight  = el.getMargins('bt') + el.getHeight(),\n                dvWidth     = parentEl.getWidth(),\n                columns     = Math.floor(dvWidth / itemWidth),\n                rows        = Math.ceil(itemCount / columns),\n                currentRows = Math.ceil(this.getExistingCount() / columns);\n            \n            //make sure the correct styles are applied to the parent element\n            parentEl.applyStyles({\n                display : 'block',\n                position: 'relative'\n                // ,\n                // height  : Ext.max([rows, currentRows]) * itemHeight,\n                // width   : columns * itemWidth\n            });\n            \n            //stores the current top and left values for each element (discovered below)\n            var oldPositions = {},\n                newPositions = {},\n                elCache      = {};\n            \n            //find current positions of each element and save a reference in the elCache\n            Ext.iterate(previous, function(id, item) {\n                var id = item.get(this.idProperty),\n                    el = elCache[id] = parentEl.child('#' + this.dataviewID + '-' + id);\n                \n                oldPositions[id] = {\n                    top : el.getTop()  - parentEl.getTop()  - el.getMargins('t') - parentEl.getPadding('t'),\n                    left: el.getLeft() - parentEl.getLeft() - el.getMargins('l') - parentEl.getPadding('l')\n                };\n            }, this);\n            \n            //set absolute positioning on all DataView items. We need to set position, left and \n            //top at the same time to avoid any flickering\n            Ext.iterate(previous, function(id, item) {\n                var oldPos = oldPositions[id],\n                    el     = elCache[id];\n                    \n                if (el.getStyle('position') != 'absolute') {\n                    elCache[id].applyStyles({\n                        position: 'absolute',\n                        left    : oldPos.left + \"px\",\n                        top     : oldPos.top + \"px\",\n\n                        //we set the width here to make ListViews work correctly. This is not needed for DataViews\n                        width   : el.getWidth(!Ext.isIE || Ext.isStrict),\n                        height  : el.getHeight(!Ext.isIE || Ext.isStrict)\n                    });\n                }\n            });\n            \n            //get new positions\n            var index = 0;\n            Ext.iterate(store.data.items, function(item) {\n                var id = item.get(idProperty),\n                    el = elCache[id];\n                \n                var column = index % columns,\n                    row    = Math.floor(index / columns),\n                    top    = row    * itemHeight,\n                    left   = column * itemWidth;\n                \n                newPositions[id] = {\n                    top : top,\n                    left: left\n                };\n                \n                index ++;\n            }, this);\n            \n            //do the movements\n            var startTime  = new Date(),\n                duration   = this.duration,\n                dataviewID = this.dataviewID;\n            \n            var doAnimate = function() {\n                var elapsed  = new Date() - startTime,\n                    fraction = elapsed / duration;\n                \n                if (fraction >= 1) {\n                    for (var id in newPositions) {\n                        Ext.fly(dataviewID + '-' + id).applyStyles({\n                            top : newPositions[id].top + \"px\",\n                            left: newPositions[id].left + \"px\"\n                        });\n                    }\n                    \n                    Ext.TaskMgr.stop(task);\n                } else {\n                    //move each item\n                    for (var id in newPositions) {\n                        if (!previous[id]) continue;\n                        \n                        var oldPos  = oldPositions[id],\n                            newPos  = newPositions[id],\n                            oldTop  = oldPos.top,\n                            newTop  = newPos.top,\n                            oldLeft = oldPos.left,\n                            newLeft = newPos.left,\n                            diffTop = fraction * Math.abs(oldTop  - newTop),\n                            diffLeft= fraction * Math.abs(oldLeft - newLeft),\n                            midTop  = oldTop  > newTop  ? oldTop  - diffTop  : oldTop  + diffTop,\n                            midLeft = oldLeft > newLeft ? oldLeft - diffLeft : oldLeft + diffLeft;\n                        \n                        Ext.fly(dataviewID + '-' + id).applyStyles({\n                            top : midTop + \"px\",\n                            left: midLeft + \"px\"\n                        });\n                    }\n                }\n            };\n            \n            var task = {\n                run     : doAnimate,\n                interval: 20,\n                scope   : this\n            };\n            \n            Ext.TaskMgr.start(task);\n            \n            //show new items\n            Ext.iterate(added, function(id, item) {\n                Ext.fly(this.dataviewID + '-' + item.get(this.idProperty)).applyStyles({\n                    top : newPositions[id].top + \"px\",\n                    left: newPositions[id].left + \"px\"\n                }).fadeIn({\n                    remove  : false,\n                    duration: duration / 1000\n                });\n            }, this);\n            \n            this.cacheStoreData(store);\n        }, this);\n    },\n    \n    /**\n     * Caches the records from a store locally for comparison later\n     * @param {Ext.data.Store} store The store to cache data from\n     */\n    cacheStoreData: function(store) {\n        this.cachedStoreData = {};\n        \n        store.each(function(record) {\n             this.cachedStoreData[record.get(this.idProperty)] = record;\n        }, this);\n    },\n    \n    /**\n     * Returns all records that were already in the DataView\n     * @return {Object} All existing records\n     */\n    getExisting: function() {\n        return this.cachedStoreData;\n    },\n    \n    /**\n     * Returns the total number of items that are currently visible in the DataView\n     * @return {Number} The number of existing items\n     */\n    getExistingCount: function() {\n        var count = 0,\n            items = this.getExisting();\n        \n        for (var k in items) count++;\n        \n        return count;\n    },\n    \n    /**\n     * Returns all records in the given store that were not already present\n     * @param {Ext.data.Store} store The updated store instance\n     * @return {Object} Object of records not already present in the dataview in format {id: record}\n     */\n    getAdded: function(store) {\n        var added = {};\n        \n        store.each(function(record) {\n            if (this.cachedStoreData[record.get(this.idProperty)] == undefined) {\n                added[record.get(this.idProperty)] = record;\n            }\n        }, this);\n        \n        return added;\n    },\n    \n    /**\n     * Returns all records that are present in the DataView but not the new store\n     * @param {Ext.data.Store} store The updated store instance\n     * @return {Array} Array of records that used to be present\n     */\n    getRemoved: function(store) {\n        var removed = [];\n        \n        for (var id in this.cachedStoreData) {\n            if (store.findExact(this.idProperty, Number(id)) == -1) removed.push(this.cachedStoreData[id]);\n        }\n        \n        return removed;\n    },\n    \n    /**\n     * Returns all records that are already present and are still present in the new store\n     * @param {Ext.data.Store} store The updated store instance\n     * @return {Object} Object of records that are still present from last time in format {id: record}\n     */\n    getRemaining: function(store) {\n      var remaining = {};\n      \n      store.each(function(record) {\n          if (this.cachedStoreData[record.get(this.idProperty)] != undefined) {\n              remaining[record.get(this.idProperty)] = record;\n          }\n      }, this);\n      \n      return remaining;\n    }\n});"
  },
  {
    "path": "client/src/ext/ux/FieldLabeler.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns(\"Ext.ux\");\n\n/**\n * @class Ext.ux.FieldLabeler\n * <p>A plugin for Field Components which renders standard Ext form wrapping and labels\n * round the Field at render time regardless of the layout of the Container.</p>\n * <p>Usage:</p>\n * <pre><code>\n    {\n        xtype: 'combo',\n        plugins: [ Ext.ux.FieldLabeler ],\n        triggerAction: 'all',\n        fieldLabel: 'Select type',\n        store: typeStore\n    }\n * </code></pre>\n */\nExt.ux.FieldLabeler = (function(){\n\n//  Pulls a named property down from the first ancestor Container it's found in\n    function getParentProperty(propName) {\n        for (var p = this.ownerCt; p; p = p.ownerCt) {\n            if (p[propName]) {\n                return p[propName];\n            }\n        }\n    }\n\n    return {\n\n//      Add behaviour at important points in the Field's lifecycle.\n        init: function(f) {\n//          Replace the Field's onRender method with a sequence that calls the plugin's onRender after the Field's onRender\n            f.onRender = f.onRender.createSequence(this.onRender);\n\n//          We need to completely override the onResize method because of the complexity\n            f.onResize = this.onResize;\n\n//          Replace the Field's onDestroy method with a sequence that calls the plugin's onDestroy after the Field's onRender\n            f.onDestroy = f.onDestroy.createSequence(this.onDestroy);\n        },\n\n        onRender: function() {\n//          Do nothing if being rendered by a form layout\n            if (this.ownerCt) {\n                if (this.ownerCt.layout instanceof Ext.layout.FormLayout) {\n                    return;\n                }\n            }\n\n            this.resizeEl = (this.wrap || this.el).wrap({\n                cls: 'x-form-element',\n                style: (Ext.isIE || Ext.isOpera) ? 'position:absolute;top:0;left:0;overflow:visible' : ''\n            });\n            this.positionEl = this.itemCt = this.resizeEl.wrap({\n                cls: 'x-form-item '\n            });\n            if (this.nextSibling()) {\n                this.margins = {\n                    top: 0,\n                    right: 0,\n                    bottom: this.positionEl.getMargins('b'),\n                    left: 0\n                };\n            }\n            this.actionMode = 'itemCt';\n\n//          If our Container is hiding labels, then we're done!\n            if (!Ext.isDefined(this.hideLabels)) {\n                this.hideLabels = getParentProperty.call(this, \"hideLabels\");\n            }\n            if (this.hideLabels) {\n                this.resizeEl.setStyle('padding-left', '0px');\n                return;\n            }\n\n//          Collect the info we need to render the label from our Container.\n            if (!Ext.isDefined(this.labelSeparator)) {\n                this.labelSeparator = getParentProperty.call(this, \"labelSeparator\");\n            }\n            if (!Ext.isDefined(this.labelPad)) {\n                this.labelPad = getParentProperty.call(this, \"labelPad\");\n            }\n            if (!Ext.isDefined(this.labelAlign)) {\n                this.labelAlign = getParentProperty.call(this, \"labelAlign\") || 'left';\n            }\n            this.itemCt.addClass('x-form-label-' + this.labelAlign);\n\n            if(this.labelAlign == 'top'){\n                if (!this.labelWidth) {\n                    this.labelWidth = 'auto';\n                }\n                this.resizeEl.setStyle('padding-left', '0px');\n            } else {\n                if (!Ext.isDefined(this.labelWidth)) {\n                    this.labelWidth = getParentProperty.call(this, \"labelWidth\") || 100;\n                }\n                this.resizeEl.setStyle('padding-left', (this.labelWidth + (this.labelPad || 5)) + 'px');\n                this.labelWidth += 'px';\n            }\n\n            this.label = this.itemCt.insertFirst({\n                tag: 'label',\n                cls: 'x-form-item-label',\n                style: {\n                    width: this.labelWidth\n                },\n                html: this.fieldLabel + (this.labelSeparator || ':')\n            });\n        },\n\n//      private\n//      Ensure the input field is sized to fit in the content area of the resizeEl (to the right of its padding-left)\n//      We perform all necessary sizing here. We do NOT call the current class's onResize because we need this control\n//      we skip that and go up the hierarchy to Ext.form.Field\n        onResize: function(w, h) {\n            Ext.form.Field.prototype.onResize.apply(this, arguments);\n            w -= this.resizeEl.getPadding('l');\n            if (this.getTriggerWidth) {\n                this.wrap.setWidth(w);\n                this.el.setWidth(w - this.getTriggerWidth());\n            } else {\n                this.el.setWidth(w);\n            }\n            if (this.el.dom.tagName.toLowerCase() == 'textarea') {\n                var h = this.resizeEl.getHeight(true);\n                if (!this.hideLabels && (this.labelAlign == 'top')) {\n                    h -= this.label.getHeight();\n                }\n                this.el.setHeight(h);\n            }\n        },\n\n//      private\n//      Ensure that we clean up on destroy.\n        onDestroy: function() {\n            this.itemCt.remove();\n        }\n    };\n})();"
  },
  {
    "path": "client/src/ext/ux/FieldReplicator.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns(\"Ext.ux\");\n\n/**\n * @class Ext.ux.FieldReplicator\n * <p>A plugin for Field Components which creates clones of the Field for as\n * long as the user keeps filling them. Leaving the final one blank ends the repeating series.</p>\n * <p>Usage:</p>\n * <pre><code>\n    {\n        xtype: 'combo',\n        plugins: [ Ext.ux.FieldReplicator ],\n        triggerAction: 'all',\n        fieldLabel: 'Select recipient',\n        store: recipientStore\n    }\n * </code></pre>\n */\nExt.ux.FieldReplicator = {\n    init: function(f) {\n        f.replicator = this;\n        f.enableKeyEvents = true;\n        f.on('change', this.onChange, this);\n        f.onKeyDown = f.onKeyDown.createInterceptor(this.onKeyDown);\n    },\n\n//  If tabbing out and the change event will be fired, flag that\n//  the change handler must focus the correct sibling Field.\n    onKeyDown: function(e) {\n        if ((e.getKey() == Ext.EventObject.TAB) && (String(this.startValue) !== String(this.getValue()))) {\n            if (e.shiftKey) {\n                this.focusPrev = true;\n            } else if (!e.shiftKey && !e.altKey) {\n                this.focusNext = true;\n            }\n        }\n    },\n\n//  Handle the field either being changed to blank or from blank.\n    onChange: function(f, n, o) {\n\n//\t\tEnsure that \"change\" is only fired once.\n    \tf.startValue = n;\n\n        var c = f.ownerCt, l,\n            ps = f.previousSibling(),\n            ns = f.nextSibling();\n        if (Ext.isEmpty(n)) {\n            if (!Ext.isEmpty(o)) {\n//              The Field has been blanked, and it is not the only one left, remove it\n                if ((ps && (ps.replicator === this)) || (ns && (ns.replicator === this))) {\n                    l = f.findParentBy(function(p) {\n                        return !Ext.isDefined(p.ownerCt);\n                    });\n                    c.remove(f);\n                    l.doLayout();\n                }\n            }\n        } else {\n            if (Ext.isEmpty(o)) {\n//              Field filled, insert a clone as the next sibling\n                ns = new f.constructor(f.cloneConfig());\n                c.insert(c.items.indexOf(f) + 1, ns);\n                c.doLayout();\n                l = f.findParentBy(function(p) {\n                    return !Ext.isDefined(p.ownerCt);\n                });\n                l.doLayout();\n            }\n        }\n        if (f.focusPrev) {\n            delete f.focusPrev;\n            ps.focus(false, true);\n        } else  if (f.focusNext) {\n            delete f.focusNext;\n            ns.focus(false, true);\n        }\n    }\n};"
  },
  {
    "path": "client/src/ext/ux/Focus.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n(function(){\nExt.ns('Ext.a11y');\n\nExt.a11y.Frame = Ext.extend(Object, {\n    initialized: false,\n    \n    constructor: function(size, color){\n        this.setSize(size || 1);\n        this.setColor(color || '15428B');\n    },\n    \n    init: function(){\n        if (!this.initialized) {\n            this.sides = [];\n            \n            var s, i;\n            \n            this.ct = Ext.DomHelper.append(document.body, {\n                cls: 'x-a11y-focusframe'\n            }, true);\n            \n            for (i = 0; i < 4; i++) {\n                s = Ext.DomHelper.append(this.ct, {\n                    cls: 'x-a11y-focusframe-side',\n                    style: 'background-color: #' + this.color\n                }, true);\n                s.visibilityMode = Ext.Element.DISPLAY;\n                this.sides.push(s);\n            }\n            \n            this.frameTask = new Ext.util.DelayedTask(function(el){\n                var newEl = Ext.get(el);\n                if (newEl != this.curEl) {\n                    var w = newEl.getWidth();\n                    var h = newEl.getHeight();\n                    this.sides[0].show().setSize(w, this.size).anchorTo(el, 'tl', [0, -1]);\n                    this.sides[2].show().setSize(w, this.size).anchorTo(el, 'bl', [0, -1]);\n                    this.sides[1].show().setSize(this.size, h).anchorTo(el, 'tr', [-1, 0]);\n                    this.sides[3].show().setSize(this.size, h).anchorTo(el, 'tl', [-1, 0]);\n                    this.curEl = newEl;\n                }\n            }, this);\n            \n            this.unframeTask = new Ext.util.DelayedTask(function(){\n                if (this.initialized) {\n                    this.sides[0].hide();\n                    this.sides[1].hide();\n                    this.sides[2].hide();\n                    this.sides[3].hide();\n                    this.curEl = null;\n                }\n            }, this);\n            this.initialized = true;\n        }\n    },\n    \n    frame: function(el){\n        this.init();\n        this.unframeTask.cancel();\n        this.frameTask.delay(2, false, false, [el]);\n    },\n    \n    unframe: function(){\n        this.init();\n        this.unframeTask.delay(2);\n    },\n    \n    setSize: function(size){\n        this.size = size;\n    },\n    \n    setColor: function(color){\n        this.color = color;\n    }\n});\n\nExt.a11y.FocusFrame = new Ext.a11y.Frame(2, '15428B');\nExt.a11y.RelayFrame = new Ext.a11y.Frame(1, '6B8CBF');\n\nExt.a11y.Focusable = Ext.extend(Ext.util.Observable, {\n    constructor: function(el, relayTo, noFrame, frameEl){\n        Ext.a11y.Focusable.superclass.constructor.call(this);\n        \n        this.addEvents('focus', 'blur', 'left', 'right', 'up', 'down', 'esc', 'enter', 'space');\n        \n        if (el instanceof Ext.Component) {\n            this.el = el.el;\n            this.setComponent(el);\n        }\n        else {\n            this.el = Ext.get(el);\n            this.setComponent(null);\n        }\n        \n        this.setRelayTo(relayTo)\n        this.setNoFrame(noFrame);\n        this.setFrameEl(frameEl);\n        \n        this.init();\n        \n        Ext.a11y.FocusMgr.register(this);\n    },\n    \n    init: function(){\n        this.el.dom.tabIndex = '1';\n        this.el.addClass('x-a11y-focusable');\n        this.el.on({\n            focus: this.onFocus,\n            blur: this.onBlur,\n            keydown: this.onKeyDown,\n            scope: this\n        });\n    },\n    \n    setRelayTo: function(relayTo){\n        this.relayTo = relayTo ? Ext.a11y.FocusMgr.get(relayTo) : null;\n    },\n    \n    setNoFrame: function(noFrame){\n        this.noFrame = (noFrame === true) ? true : false;\n    },\n    \n    setFrameEl: function(frameEl){\n        this.frameEl = frameEl && Ext.get(frameEl) || this.el;\n    },\n    \n    setComponent: function(cmp){\n        this.component = cmp || null;\n    },\n    \n    onKeyDown: function(e, t){\n        var k = e.getKey(), SK = Ext.a11y.Focusable.SpecialKeys, ret, tf;\n        \n        tf = (t !== this.el.dom) ? Ext.a11y.FocusMgr.get(t, true) : this;\n        if (!tf) {\n            // this can happen when you are on a focused item within a panel body\n            // that is not a Ext.a11y.Focusable\n            tf = Ext.a11y.FocusMgr.get(Ext.fly(t).parent('.x-a11y-focusable'));\n        }\n        \n        if (SK[k] !== undefined) {\n            ret = this.fireEvent(SK[k], e, t, tf, this);\n        }\n        if (ret === false || this.fireEvent('keydown', e, t, tf, this) === false) {\n            e.stopEvent();\n        }\n    },\n    \n    focus: function(){\n        this.el.dom.focus();\n    },\n    \n    blur: function(){\n        this.el.dom.blur();\n    },\n    \n    onFocus: function(e, t){\n        this.el.addClass('x-a11y-focused');\n        if (this.relayTo) {\n            this.relayTo.el.addClass('x-a11y-focused-relay');\n            if (!this.relayTo.noFrame) {\n                Ext.a11y.FocusFrame.frame(this.relayTo.frameEl);\n            }\n            if (!this.noFrame) {\n                Ext.a11y.RelayFrame.frame(this.frameEl);\n            }\n        }\n        else {\n            if (!this.noFrame) {\n                Ext.a11y.FocusFrame.frame(this.frameEl);\n            }\n        }\n        \n        this.fireEvent('focus', e, t, this);\n    },\n    \n    onBlur: function(e, t){\n        if (this.relayTo) {\n            this.relayTo.el.removeClass('x-a11y-focused-relay');\n            Ext.a11y.RelayFrame.unframe();\n        }\n        this.el.removeClass('x-a11y-focused');\n        Ext.a11y.FocusFrame.unframe();\n        this.fireEvent('blur', e, t, this);\n    },\n    \n    destroy: function(){\n        this.el.un('keydown', this.onKeyDown);\n        this.el.un('focus', this.onFocus);\n        this.el.un('blur', this.onBlur);\n        this.el.removeClass('x-a11y-focusable');\n        this.el.removeClass('x-a11y-focused');\n        if (this.relayTo) {\n            this.relayTo.el.removeClass('x-a11y-focused-relay');\n        }\n    }\n});\n\nExt.a11y.FocusItem = Ext.extend(Object, {\n    constructor: function(el, enableTabbing){\n        Ext.a11y.FocusItem.superclass.constructor.call(this);\n        \n        this.el = Ext.get(el);\n        this.fi = new Ext.a11y.Focusable(el);\n        this.fi.setComponent(this);\n        \n        this.fi.on('tab', this.onTab, this);\n        \n        this.enableTabbing = enableTabbing === true ? true : false;\n    },\n    \n    getEnterItem: function(){\n        if (this.enableTabbing) {\n            var items = this.getFocusItems();\n            if (items && items.length) {\n                return items[0];\n            }\n        }\n    },\n    \n    getFocusItems: function(){\n        if (this.enableTabbing) {\n            return this.el.query('a, button, input, select');\n        }\n        return null;\n    },\n    \n    onTab: function(e, t){\n        var items = this.getFocusItems(), i;\n        \n        if (items && items.length && (i = items.indexOf(t)) !== -1) {\n            if (e.shiftKey && i > 0) {\n                e.stopEvent();\n                items[i - 1].focus();\n                Ext.a11y.FocusFrame.frame.defer(20, Ext.a11y.FocusFrame, [this.el]);\n                return;\n            }\n            else \n                if (!e.shiftKey && i < items.length - 1) {\n                    e.stopEvent();\n                    items[i + 1].focus();\n                    Ext.a11y.FocusFrame.frame.defer(20, Ext.a11y.FocusFrame, [this.el]);\n                    return;\n                }\n        }\n    },\n    \n    focus: function(){\n        if (this.enableTabbing) {\n            var items = this.getFocusItems();\n            if (items && items.length) {\n                items[0].focus();\n                Ext.a11y.FocusFrame.frame.defer(20, Ext.a11y.FocusFrame, [this.el]);\n                return;\n            }\n        }\n        this.fi.focus();\n    },\n    \n    blur: function(){\n        this.fi.blur();\n    }\n});\n\nExt.a11y.FocusMgr = function(){\n    var all = new Ext.util.MixedCollection();\n    \n    return {\n        register: function(f){\n            all.add(f.el && Ext.id(f.el), f);\n        },\n        \n        unregister: function(f){\n            all.remove(f);\n        },\n        \n        get: function(el, noCreate){\n            return all.get(Ext.id(el)) || (noCreate ? false : new Ext.a11y.Focusable(el));\n        },\n        \n        all: all\n    }\n}();\n\nExt.a11y.Focusable.SpecialKeys = {};\nExt.a11y.Focusable.SpecialKeys[Ext.EventObjectImpl.prototype.LEFT] = 'left';\nExt.a11y.Focusable.SpecialKeys[Ext.EventObjectImpl.prototype.RIGHT] = 'right';\nExt.a11y.Focusable.SpecialKeys[Ext.EventObjectImpl.prototype.DOWN] = 'down';\nExt.a11y.Focusable.SpecialKeys[Ext.EventObjectImpl.prototype.UP] = 'up';\nExt.a11y.Focusable.SpecialKeys[Ext.EventObjectImpl.prototype.ESC] = 'esc';\nExt.a11y.Focusable.SpecialKeys[Ext.EventObjectImpl.prototype.ENTER] = 'enter';\nExt.a11y.Focusable.SpecialKeys[Ext.EventObjectImpl.prototype.SPACE] = 'space';\nExt.a11y.Focusable.SpecialKeys[Ext.EventObjectImpl.prototype.TAB] = 'tab';\n\n// we use the new observeClass method to fire our new initFocus method on components\nExt.util.Observable.observeClass(Ext.Component);\nExt.Component.on('render', function(cmp){\n    cmp.initFocus();\n    cmp.initARIA();\n});\nExt.override(Ext.Component, {\n    initFocus: Ext.emptyFn,\n    initARIA: Ext.emptyFn\n});\n\nExt.override(Ext.Container, {\n    isFocusable: true,\n    noFocus: false,\n    \n    // private\n    initFocus: function(){\n        if (!this.fi && !this.noFocus) {\n            this.fi = new Ext.a11y.Focusable(this);\n        }\n        this.mon(this.fi, {\n            focus: this.onFocus,\n            blur: this.onBlur,\n            tab: this.onTab,\n            enter: this.onEnter,\n            esc: this.onEsc,\n            scope: this\n        });\n        \n        if (this.hidden) {\n            this.isFocusable = false;\n        }\n        \n        this.on('show', function(){\n            this.isFocusable = true;\n        }, this);\n        this.on('hide', function(){\n            this.isFocusable = false;\n        }, this);\n    },\n    \n    focus: function(){\n        this.fi.focus();\n    },\n    \n    blur: function(){\n        this.fi.blur();\n    },\n    \n    enter: function(){\n        var eitem = this.getEnterItem();\n        if (eitem) {\n            eitem.focus();\n        }\n    },\n    \n    onFocus: Ext.emptyFn,\n    onBlur: Ext.emptyFn,\n    \n    onTab: function(e, t, tf){\n        var rf = tf.relayTo || tf;\n        if (rf.component && rf.component !== this) {\n            e.stopEvent();\n            var item = e.shiftKey ? this.getPreviousFocus(rf.component) : this.getNextFocus(rf.component);\n            item.focus();\n        }\n    },\n    \n    onEnter: function(e, t, tf){\n        // check to see if enter is pressed while \"on\" the panel\n        if (tf.component && tf.component === this) {\n            e.stopEvent();\n            this.enter();\n        }\n        e.stopPropagation();\n    },\n    \n    onEsc: function(e, t){\n        e.preventDefault();\n        \n        // check to see if esc is pressed while \"inside\" the panel\n        // or while \"on\" the panel\n        if (t === this.el.dom) {\n            // \"on\" the panel, check if this panel has an owner panel and focus that\n            // we dont stop the event in this case so that this same check will be\n            // done for this ownerCt\n            if (this.ownerCt) {\n                this.ownerCt.focus();\n            }\n        }\n        else {\n            // we were inside the panel when esc was pressed,\n            // so go back \"on\" the panel\n            if (this.ownerCt && this.ownerCt.isFocusable) {\n                var si = this.ownerCt.getFocusItems();\n                \n                if (si && si.getCount() > 1) {\n                    e.stopEvent();\n                }\n            }\n            this.focus();\n        }\n    },\n    \n    getFocusItems: function(){\n        return this.items &&\n            this.items.filterBy(function(o){\n                return o.isFocusable;\n            }) ||\n            null;\n    },\n    \n    getEnterItem: function(){\n        var ci = this.getFocusItems(), length = ci ? ci.getCount() : 0;\n        \n        if (length === 1) {\n            return ci.first().getEnterItem && ci.first().getEnterItem() || ci.first();\n        }\n        else if (length > 1) {\n            return ci.first();\n        }\n    },\n    \n    getNextFocus: function(current){\n        var items = this.getFocusItems(), next = current, i = items.indexOf(current), length = items.getCount();\n        \n        if (i === length - 1) {\n            next = items.first();\n        }\n        else {\n            next = items.get(i + 1);\n        }\n        return next;\n    },\n    \n    getPreviousFocus: function(current){\n        var items = this.getFocusItems(), prev = current, i = items.indexOf(current), length = items.getCount();\n        \n        if (i === 0) {\n            prev = items.last();\n        }\n        else {\n            prev = items.get(i - 1);\n        }\n        return prev;\n    },\n    \n    getFocusable : function() {\n        return this.fi;\n    }\n});\n\nExt.override(Ext.Panel, {\n    /**\n     * @cfg {Boolean} enableTabbing <tt>true</tt> to enable tabbing. Default is <tt>false</tt>.\n     */        \n    getFocusItems: function(){\n        // items gets all the items inside the body\n        var items = Ext.Panel.superclass.getFocusItems.call(this), bodyFocus = null;\n\n        if (!items) {\n            items = new Ext.util.MixedCollection();\n            this.bodyFocus = this.bodyFocus || new Ext.a11y.FocusItem(this.body, this.enableTabbing);\n            items.add('body', this.bodyFocus);\n        }\n        // but panels can also have tbar, bbar, fbar\n        if (this.tbar && this.topToolbar) {\n            items.insert(0, this.topToolbar);\n        }\n        if (this.bbar && this.bottomToolbar) {\n            items.add(this.bottomToolbar);\n        }\n        if (this.fbar) {\n            items.add(this.fbar);\n        }\n        \n        return items;\n    }\n});\n\nExt.override(Ext.TabPanel, {\n    // private\n    initFocus: function(){\n        Ext.TabPanel.superclass.initFocus.call(this);\n        this.mon(this.fi, {\n            left: this.onLeft,\n            right: this.onRight,\n            scope: this\n        });\n    },\n    \n    onLeft: function(e){\n        if (!this.activeTab) {\n            return;\n        }\n        e.stopEvent();\n        var prev = this.items.itemAt(this.items.indexOf(this.activeTab) - 1);\n        if (prev) {\n            this.setActiveTab(prev);\n        }\n        return false;\n    },\n    \n    onRight: function(e){\n        if (!this.activeTab) {\n            return;\n        }\n        e.stopEvent();\n        var next = this.items.itemAt(this.items.indexOf(this.activeTab) + 1);\n        if (next) {\n            this.setActiveTab(next);\n        }\n        return false;\n    }\n});\n\nExt.override(Ext.tree.TreeNodeUI, {\n    // private\n    focus: function(){\n        this.node.getOwnerTree().bodyFocus.focus();\n    }\n});\n\nExt.override(Ext.tree.TreePanel, {\n    // private\n    afterRender : function(){\n        Ext.tree.TreePanel.superclass.afterRender.call(this);\n        this.root.render();\n        if(!this.rootVisible){\n            this.root.renderChildren();\n        }\n        this.bodyFocus = new Ext.a11y.FocusItem(this.body.down('.x-tree-root-ct'));\n        this.bodyFocus.fi.setFrameEl(this.body);\n    } \n});\n\nExt.override(Ext.grid.GridPanel, {\n    initFocus: function(){\n        Ext.grid.GridPanel.superclass.initFocus.call(this);\n        this.bodyFocus = new Ext.a11y.FocusItem(this.view.focusEl);\n        this.bodyFocus.fi.setFrameEl(this.body);\n    }\n});\n\nExt.override(Ext.Button, {\n    isFocusable: true,\n    noFocus: false,\n    \n    initFocus: function(){\n        Ext.Button.superclass.initFocus.call(this);\n        this.fi = this.fi || new Ext.a11y.Focusable(this.btnEl, null, null, this.el);\n        this.fi.setComponent(this);\n        \n        this.mon(this.fi, {\n            focus: this.onFocus,\n            blur: this.onBlur,\n            scope: this\n        });\n        \n        if (this.menu) {\n            this.mon(this.fi, 'down', this.showMenu, this);\n            this.on('menuhide', this.focus, this);\n        }\n        \n        if (this.hidden) {\n            this.isFocusable = false;\n        }\n        \n        this.on('show', function(){\n            this.isFocusable = true;\n        }, this);\n        this.on('hide', function(){\n            this.isFocusable = false;\n        }, this);\n    },\n    \n    focus: function(){\n        this.fi.focus();\n    },\n    \n    blur: function(){\n        this.fi.blur();\n    },\n    \n    onFocus: function(){\n        if (!this.disabled) {\n            this.el.addClass(\"x-btn-focus\");\n        }\n    },\n    \n    onBlur: function(){\n        this.el.removeClass(\"x-btn-focus\");\n    }\n});\n\nExt.override(Ext.Toolbar, {\n    initFocus: function(){\n        Ext.Toolbar.superclass.initFocus.call(this);\n        this.mon(this.fi, {\n            left: this.onLeft,\n            right: this.onRight,\n            scope: this\n        });\n        \n        this.on('focus', this.onButtonFocus, this, {\n            stopEvent: true\n        });\n    },\n    \n    add: function(){\n        var item = Ext.Toolbar.superclass.add.apply(this, arguments);\n        if(!item || !item.events) {\n            return item;\n        }\n        if (item.rendered && item.fi !== undefined) {\n            item.fi.setRelayTo(this.el);\n            this.relayEvents(item.fi, ['focus']);\n        }\n        else {\n            item.on('render', function(){\n                if (item.fi !== undefined) {\n                    item.fi.setRelayTo(this.el);\n                    this.relayEvents(item.fi, ['focus']);\n                }\n            }, this, {\n                single: true\n            });\n        }\n        return item;\n    },\n    \n    onFocus: function(){\n        var items = this.getFocusItems();\n        if (items && items.getCount() > 0) {\n            if (this.lastFocus && items.indexOf(this.lastFocus) !== -1) {\n                this.lastFocus.focus();\n            }\n            else {\n                items.first().focus();\n            }\n        }\n    },\n    \n    onButtonFocus: function(e, t, tf){\n        this.lastFocus = tf.component || null;\n    },\n    \n    onLeft: function(e, t, tf){\n        e.stopEvent();\n        this.getPreviousFocus(tf.component).focus();\n    },\n    \n    onRight: function(e, t, tf){\n        e.stopEvent();\n        this.getNextFocus(tf.component).focus();\n    },\n    \n    getEnterItem: Ext.emptyFn,\n    onTab: Ext.emptyFn,\n    onEsc: Ext.emptyFn\n});\n\nExt.override(Ext.menu.BaseItem, {\n    initFocus: function(){\n        this.fi = new Ext.a11y.Focusable(this, this.parentMenu && this.parentMenu.el || null, true);\n    }\n});\n\nExt.override(Ext.menu.Menu, {\n    initFocus: function(){\n        this.fi = new Ext.a11y.Focusable(this);\n        this.focusEl = this.fi;\n    }\n});\n\nExt.a11y.WindowMgr = new Ext.WindowGroup();\n\nExt.apply(Ext.WindowMgr, {\n    bringToFront: function(win){\n        Ext.a11y.WindowMgr.bringToFront.call(this, win);\n        if (win.modal) {\n            win.enter();\n        }\n        else {\n            win.focus();\n        }\n    }\n});\n\nExt.override(Ext.Window, {\n    initFocus: function(){\n        Ext.Window.superclass.initFocus.call(this);\n        this.on('beforehide', function(){\n            Ext.a11y.RelayFrame.unframe();\n            Ext.a11y.FocusFrame.unframe();\n        });\n    }\n});\n\nExt.override(Ext.form.Field, {\n    isFocusable: true,\n    noFocus: false,\n    \n    initFocus: function(){\n        this.fi = this.fi || new Ext.a11y.Focusable(this, null, true);\n        \n        Ext.form.Field.superclass.initFocus.call(this);\n        \n        if (this.hidden) {\n            this.isFocusable = false;\n        }\n        \n        this.on('show', function(){\n            this.isFocusable = true;\n        }, this);\n        this.on('hide', function(){\n            this.isFocusable = false;\n        }, this);\n    }\n});\n\nExt.override(Ext.FormPanel, {\n    initFocus: function(){\n        Ext.FormPanel.superclass.initFocus.call(this);\n        this.on('focus', this.onFieldFocus, this, {\n            stopEvent: true\n        });\n    },\n    \n    // private\n    createForm: function(){\n        delete this.initialConfig.listeners;\n        var form = new Ext.form.BasicForm(null, this.initialConfig);\n        form.afterMethod('add', this.formItemAdd, this);\n        return form;\n    },\n    \n    formItemAdd: function(item){\n        item.on('render', function(field){\n            field.fi.setRelayTo(this.el);\n            this.relayEvents(field.fi, ['focus']);\n        }, this, {\n            single: true\n        });\n    },\n    \n    onFocus: function(){\n        var items = this.getFocusItems();\n        if (items && items.getCount() > 0) {\n            if (this.lastFocus && items.indexOf(this.lastFocus) !== -1) {\n                this.lastFocus.focus();\n            }\n            else {\n                items.first().focus();\n            }\n        }\n    },\n    \n    onFieldFocus: function(e, t, tf){\n        this.lastFocus = tf.component || null;\n    },\n    \n    onTab: function(e, t, tf){\n        if (tf.relayTo.component === this) {\n            var item = e.shiftKey ? this.getPreviousFocus(tf.component) : this.getNextFocus(tf.component);\n            \n            if (item) {\n                ev.stopEvent();\n                item.focus();\n                return;\n            }\n        }\n        Ext.FormPanel.superclass.onTab.apply(this, arguments);\n    },\n    \n    getNextFocus: function(current){\n        var items = this.getFocusItems(), i = items.indexOf(current), length = items.getCount();\n        \n        return (i < length - 1) ? items.get(i + 1) : false;\n    },\n    \n    getPreviousFocus: function(current){\n        var items = this.getFocusItems(), i = items.indexOf(current), length = items.getCount();\n        \n        return (i > 0) ? items.get(i - 1) : false;\n    }\n});\n\nExt.override(Ext.Viewport, {\n    initFocus: function(){\n        Ext.Viewport.superclass.initFocus.apply(this);\n        this.mon(Ext.get(document), 'focus', this.focus, this);\n        this.mon(Ext.get(document), 'blur', this.blur, this);\n        this.fi.setNoFrame(true);\n    },\n    \n    onTab: function(e, t, tf, f){\n        e.stopEvent();\n        \n        if (tf === f) {\n            items = this.getFocusItems();\n            if (items && items.getCount() > 0) {\n                items.first().focus();\n            }\n        }\n        else {\n            var rf = tf.relayTo || tf;\n            var item = e.shiftKey ? this.getPreviousFocus(rf.component) : this.getNextFocus(rf.component);\n            item.focus();\n        }\n    }\n});\n    \n})();"
  },
  {
    "path": "client/src/ext/ux/GMapPanel.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * @class Ext.ux.GMapPanel\n * @extends Ext.Panel\n * @author Shea Frederick\n */\nExt.ux.GMapPanel = Ext.extend(Ext.Panel, {\n    initComponent : function(){\n        \n        var defConfig = {\n            plain: true,\n            zoomLevel: 3,\n            yaw: 180,\n            pitch: 0,\n            zoom: 0,\n            gmapType: 'map',\n            border: false\n        };\n        \n        Ext.applyIf(this,defConfig);\n        \n        Ext.ux.GMapPanel.superclass.initComponent.call(this);        \n\n    },\n    afterRender : function(){\n        \n        var wh = this.ownerCt.getSize();\n        Ext.applyIf(this, wh);\n        \n        Ext.ux.GMapPanel.superclass.afterRender.call(this);    \n        \n        if (this.gmapType === 'map'){\n            this.gmap = new GMap2(this.body.dom);\n        }\n        \n        if (this.gmapType === 'panorama'){\n            this.gmap = new GStreetviewPanorama(this.body.dom);\n        }\n        \n        if (typeof this.addControl == 'object' && this.gmapType === 'map') {\n            this.gmap.addControl(this.addControl);\n        }\n        \n        if (typeof this.setCenter === 'object') {\n            if (typeof this.setCenter.geoCodeAddr === 'string'){\n                this.geoCodeLookup(this.setCenter.geoCodeAddr);\n            }else{\n                if (this.gmapType === 'map'){\n                    var point = new GLatLng(this.setCenter.lat,this.setCenter.lng);\n                    this.gmap.setCenter(point, this.zoomLevel);    \n                }\n                if (typeof this.setCenter.marker === 'object' && typeof point === 'object'){\n                    this.addMarker(point,this.setCenter.marker,this.setCenter.marker.clear);\n                }\n            }\n            if (this.gmapType === 'panorama'){\n                this.gmap.setLocationAndPOV(new GLatLng(this.setCenter.lat,this.setCenter.lng), {yaw: this.yaw, pitch: this.pitch, zoom: this.zoom});\n            }\n        }\n\n        GEvent.bind(this.gmap, 'load', this, function(){\n            this.onMapReady();\n        });\n\n    },\n    onMapReady : function(){\n        this.addMarkers(this.markers);\n        this.addMapControls();\n        this.addOptions();  \n    },\n    onResize : function(w, h){\n\n        if (typeof this.getMap() == 'object') {\n            this.gmap.checkResize();\n        }\n        \n        Ext.ux.GMapPanel.superclass.onResize.call(this, w, h);\n\n    },\n    setSize : function(width, height, animate){\n        \n        if (typeof this.getMap() == 'object') {\n            this.gmap.checkResize();\n        }\n        \n        Ext.ux.GMapPanel.superclass.setSize.call(this, width, height, animate);\n        \n    },\n    getMap : function(){\n        \n        return this.gmap;\n        \n    },\n    getCenter : function(){\n        \n        return this.getMap().getCenter();\n        \n    },\n    getCenterLatLng : function(){\n        \n        var ll = this.getCenter();\n        return {lat: ll.lat(), lng: ll.lng()};\n        \n    },\n    addMarkers : function(markers) {\n        \n        if (Ext.isArray(markers)){\n            for (var i = 0; i < markers.length; i++) {\n                var mkr_point = new GLatLng(markers[i].lat,markers[i].lng);\n                this.addMarker(mkr_point,markers[i].marker,false,markers[i].setCenter, markers[i].listeners);\n            }\n        }\n        \n    },\n    addMarker : function(point, marker, clear, center, listeners){\n        \n        Ext.applyIf(marker,G_DEFAULT_ICON);\n\n        if (clear === true){\n            this.getMap().clearOverlays();\n        }\n        if (center === true) {\n            this.getMap().setCenter(point, this.zoomLevel);\n        }\n\n        var mark = new GMarker(point,marker);\n        if (typeof listeners === 'object'){\n            for (evt in listeners) {\n                GEvent.bind(mark, evt, this, listeners[evt]);\n            }\n        }\n        this.getMap().addOverlay(mark);\n\n    },\n    addMapControls : function(){\n        \n        if (this.gmapType === 'map') {\n            if (Ext.isArray(this.mapControls)) {\n                for(i=0;i<this.mapControls.length;i++){\n                    this.addMapControl(this.mapControls[i]);\n                }\n            }else if(typeof this.mapControls === 'string'){\n                this.addMapControl(this.mapControls);\n            }else if(typeof this.mapControls === 'object'){\n                this.getMap().addControl(this.mapControls);\n            }\n        }\n        \n    },\n    addMapControl : function(mc){\n        \n        var mcf = window[mc];\n        if (typeof mcf === 'function') {\n            this.getMap().addControl(new mcf());\n        }    \n        \n    },\n    addOptions : function(){\n        \n        if (Ext.isArray(this.mapConfOpts)) {\n            var mc;\n            for(i=0;i<this.mapConfOpts.length;i++){\n                this.addOption(this.mapConfOpts[i]);\n            }\n        }else if(typeof this.mapConfOpts === 'string'){\n            this.addOption(this.mapConfOpts);\n        }        \n        \n    },\n    addOption : function(mc){\n        \n        var mcf = this.getMap()[mc];\n        if (typeof mcf === 'function') {\n            this.getMap()[mc]();\n        }    \n        \n    },\n    geoCodeLookup : function(addr) {\n        \n        this.geocoder = new GClientGeocoder();\n        this.geocoder.getLocations(addr, this.addAddressToMap.createDelegate(this));\n        \n    },\n    addAddressToMap : function(response) {\n        \n        if (!response || response.Status.code != 200) {\n            Ext.MessageBox.alert('Error', 'Code '+response.Status.code+' Error Returned');\n        }else{\n            place = response.Placemark[0];\n            addressinfo = place.AddressDetails;\n            accuracy = addressinfo.Accuracy;\n            if (accuracy === 0) {\n                Ext.MessageBox.alert('Unable to Locate Address', 'Unable to Locate the Address you provided');\n            }else{\n                if (accuracy < 7) {\n                    Ext.MessageBox.alert('Address Accuracy', 'The address provided has a low accuracy.<br><br>Level '+accuracy+' Accuracy (8 = Exact Match, 1 = Vague Match)');\n                }else{\n                    point = new GLatLng(place.Point.coordinates[1], place.Point.coordinates[0]);\n                    if (typeof this.setCenter.marker === 'object' && typeof point === 'object'){\n                        this.addMarker(point,this.setCenter.marker,this.setCenter.marker.clear,true, this.setCenter.listeners);\n                    }\n                }\n            }\n        }\n        \n    }\n \n});\n\nExt.reg('gmappanel', Ext.ux.GMapPanel); "
  },
  {
    "path": "client/src/ext/ux/GroupSummary.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.GroupSummary\n * @extends Ext.util.Observable\n * A GridPanel plugin that enables dynamic column calculations and a dynamically\n * updated grouped summary row.\n */\nExt.ux.grid.GroupSummary = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Function} summaryRenderer Renderer example:<pre><code>\nsummaryRenderer: function(v, params, data){\n    return ((v === 0 || v > 1) ? '(' + v +' Tasks)' : '(1 Task)');\n},\n     * </code></pre>\n     */\n    /**\n     * @cfg {String} summaryType (Optional) The type of\n     * calculation to be used for the column.  For options available see\n     * {@link #Calculations}.\n     */\n\n    constructor : function(config){\n        Ext.apply(this, config);\n        Ext.ux.grid.GroupSummary.superclass.constructor.call(this);\n    },\n    init : function(grid){\n        this.grid = grid;\n        var v = this.view = grid.getView();\n        v.doGroupEnd = this.doGroupEnd.createDelegate(this);\n\n        v.afterMethod('onColumnWidthUpdated', this.doWidth, this);\n        v.afterMethod('onAllColumnWidthsUpdated', this.doAllWidths, this);\n        v.afterMethod('onColumnHiddenUpdated', this.doHidden, this);\n        v.afterMethod('onUpdate', this.doUpdate, this);\n        v.afterMethod('onRemove', this.doRemove, this);\n\n        if(!this.rowTpl){\n            this.rowTpl = new Ext.Template(\n                '<div class=\"x-grid3-summary-row\" style=\"{tstyle}\">',\n                '<table class=\"x-grid3-summary-table\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\" style=\"{tstyle}\">',\n                    '<tbody><tr>{cells}</tr></tbody>',\n                '</table></div>'\n            );\n            this.rowTpl.disableFormats = true;\n        }\n        this.rowTpl.compile();\n\n        if(!this.cellTpl){\n            this.cellTpl = new Ext.Template(\n                '<td class=\"x-grid3-col x-grid3-cell x-grid3-td-{id} {css}\" style=\"{style}\">',\n                '<div class=\"x-grid3-cell-inner x-grid3-col-{id}\" unselectable=\"on\">{value}</div>',\n                \"</td>\"\n            );\n            this.cellTpl.disableFormats = true;\n        }\n        this.cellTpl.compile();\n    },\n\n    /**\n     * Toggle the display of the summary row on/off\n     * @param {Boolean} visible <tt>true</tt> to show the summary, <tt>false</tt> to hide the summary.\n     */\n    toggleSummaries : function(visible){\n        var el = this.grid.getGridEl();\n        if(el){\n            if(visible === undefined){\n                visible = el.hasClass('x-grid-hide-summary');\n            }\n            el[visible ? 'removeClass' : 'addClass']('x-grid-hide-summary');\n        }\n    },\n\n    renderSummary : function(o, cs){\n        cs = cs || this.view.getColumnData();\n        var cfg = this.grid.getColumnModel().config,\n            buf = [], c, p = {}, cf, last = cs.length-1;\n        for(var i = 0, len = cs.length; i < len; i++){\n            c = cs[i];\n            cf = cfg[i];\n            p.id = c.id;\n            p.style = c.style;\n            p.css = i == 0 ? 'x-grid3-cell-first ' : (i == last ? 'x-grid3-cell-last ' : '');\n            if(cf.summaryType || cf.summaryRenderer){\n                p.value = (cf.summaryRenderer || c.renderer)(o.data[c.name], p, o);\n            }else{\n                p.value = '';\n            }\n            if(p.value == undefined || p.value === \"\") p.value = \"&#160;\";\n            buf[buf.length] = this.cellTpl.apply(p);\n        }\n\n        return this.rowTpl.apply({\n            tstyle: 'width:'+this.view.getTotalWidth()+';',\n            cells: buf.join('')\n        });\n    },\n\n    /**\n     * @private\n     * @param {Object} rs\n     * @param {Object} cs\n     */\n    calculate : function(rs, cs){\n        var data = {}, r, c, cfg = this.grid.getColumnModel().config, cf;\n        for(var j = 0, jlen = rs.length; j < jlen; j++){\n            r = rs[j];\n            for(var i = 0, len = cs.length; i < len; i++){\n                c = cs[i];\n                cf = cfg[i];\n                if(cf.summaryType){\n                    data[c.name] = Ext.ux.grid.GroupSummary.Calculations[cf.summaryType](data[c.name] || 0, r, c.name, data);\n                }\n            }\n        }\n        return data;\n    },\n\n    doGroupEnd : function(buf, g, cs, ds, colCount){\n        var data = this.calculate(g.rs, cs);\n        buf.push('</div>', this.renderSummary({data: data}, cs), '</div>');\n    },\n\n    doWidth : function(col, w, tw){\n        if(!this.isGrouped()){\n            return;\n        }\n        var gs = this.view.getGroups(),\n            len = gs.length,\n            i = 0,\n            s;\n        for(; i < len; ++i){\n            s = gs[i].childNodes[2];\n            s.style.width = tw;\n            s.firstChild.style.width = tw;\n            s.firstChild.rows[0].childNodes[col].style.width = w;\n        }\n    },\n\n    doAllWidths : function(ws, tw){\n        if(!this.isGrouped()){\n            return;\n        }\n        var gs = this.view.getGroups(),\n            len = gs.length,\n            i = 0,\n            j, \n            s, \n            cells, \n            wlen = ws.length;\n            \n        for(; i < len; i++){\n            s = gs[i].childNodes[2];\n            s.style.width = tw;\n            s.firstChild.style.width = tw;\n            cells = s.firstChild.rows[0].childNodes;\n            for(j = 0; j < wlen; j++){\n                cells[j].style.width = ws[j];\n            }\n        }\n    },\n\n    doHidden : function(col, hidden, tw){\n        if(!this.isGrouped()){\n            return;\n        }\n        var gs = this.view.getGroups(),\n            len = gs.length,\n            i = 0,\n            s, \n            display = hidden ? 'none' : '';\n        for(; i < len; i++){\n            s = gs[i].childNodes[2];\n            s.style.width = tw;\n            s.firstChild.style.width = tw;\n            s.firstChild.rows[0].childNodes[col].style.display = display;\n        }\n    },\n    \n    isGrouped : function(){\n        return !Ext.isEmpty(this.grid.getStore().groupField);\n    },\n\n    // Note: requires that all (or the first) record in the\n    // group share the same group value. Returns false if the group\n    // could not be found.\n    refreshSummary : function(groupValue){\n        return this.refreshSummaryById(this.view.getGroupId(groupValue));\n    },\n\n    getSummaryNode : function(gid){\n        var g = Ext.fly(gid, '_gsummary');\n        if(g){\n            return g.down('.x-grid3-summary-row', true);\n        }\n        return null;\n    },\n\n    refreshSummaryById : function(gid){\n        var g = Ext.getDom(gid);\n        if(!g){\n            return false;\n        }\n        var rs = [];\n        this.grid.getStore().each(function(r){\n            if(r._groupId == gid){\n                rs[rs.length] = r;\n            }\n        });\n        var cs = this.view.getColumnData(),\n            data = this.calculate(rs, cs),\n            markup = this.renderSummary({data: data}, cs),\n            existing = this.getSummaryNode(gid);\n            \n        if(existing){\n            g.removeChild(existing);\n        }\n        Ext.DomHelper.append(g, markup);\n        return true;\n    },\n\n    doUpdate : function(ds, record){\n        this.refreshSummaryById(record._groupId);\n    },\n\n    doRemove : function(ds, record, index, isUpdate){\n        if(!isUpdate){\n            this.refreshSummaryById(record._groupId);\n        }\n    },\n\n    /**\n     * Show a message in the summary row.\n     * <pre><code>\ngrid.on('afteredit', function(){\n    var groupValue = 'Ext Forms: Field Anchoring';\n    summary.showSummaryMsg(groupValue, 'Updating Summary...');\n});\n     * </code></pre>\n     * @param {String} groupValue\n     * @param {String} msg Text to use as innerHTML for the summary row.\n     */\n    showSummaryMsg : function(groupValue, msg){\n        var gid = this.view.getGroupId(groupValue),\n             node = this.getSummaryNode(gid);\n        if(node){\n            node.innerHTML = '<div class=\"x-grid3-summary-msg\">' + msg + '</div>';\n        }\n    }\n});\n\n//backwards compat\nExt.grid.GroupSummary = Ext.ux.grid.GroupSummary;\n\n\n/**\n * Calculation types for summary row:</p><div class=\"mdetail-params\"><ul>\n * <li><b><tt>sum</tt></b> : <div class=\"sub-desc\"></div></li>\n * <li><b><tt>count</tt></b> : <div class=\"sub-desc\"></div></li>\n * <li><b><tt>max</tt></b> : <div class=\"sub-desc\"></div></li>\n * <li><b><tt>min</tt></b> : <div class=\"sub-desc\"></div></li>\n * <li><b><tt>average</tt></b> : <div class=\"sub-desc\"></div></li>\n * </ul></div>\n * <p>Custom calculations may be implemented.  An example of\n * custom <code>summaryType=totalCost</code>:</p><pre><code>\n// define a custom summary function\nExt.ux.grid.GroupSummary.Calculations['totalCost'] = function(v, record, field){\n    return v + (record.data.estimate * record.data.rate);\n};\n * </code></pre>\n * @property Calculations\n */\n\nExt.ux.grid.GroupSummary.Calculations = {\n    'sum' : function(v, record, field){\n        return v + (record.data[field]||0);\n    },\n\n    'count' : function(v, record, field, data){\n        return data[field+'count'] ? ++data[field+'count'] : (data[field+'count'] = 1);\n    },\n\n    'max' : function(v, record, field, data){\n        var v = record.data[field];\n        var max = data[field+'max'] === undefined ? (data[field+'max'] = v) : data[field+'max'];\n        return v > max ? (data[field+'max'] = v) : max;\n    },\n\n    'min' : function(v, record, field, data){\n        var v = record.data[field];\n        var min = data[field+'min'] === undefined ? (data[field+'min'] = v) : data[field+'min'];\n        return v < min ? (data[field+'min'] = v) : min;\n    },\n\n    'average' : function(v, record, field, data){\n        var c = data[field+'count'] ? ++data[field+'count'] : (data[field+'count'] = 1);\n        var t = (data[field+'total'] = ((data[field+'total']||0) + (record.data[field]||0)));\n        return t === 0 ? 0 : t / c;\n    }\n};\nExt.grid.GroupSummary.Calculations = Ext.ux.grid.GroupSummary.Calculations;\n\n/**\n * @class Ext.ux.grid.HybridSummary\n * @extends Ext.ux.grid.GroupSummary\n * Adds capability to specify the summary data for the group via json as illustrated here:\n * <pre><code>\n{\n    data: [\n        {\n            projectId: 100,     project: 'House',\n            taskId:    112, description: 'Paint',\n            estimate:    6,        rate:     150,\n            due:'06/24/2007'\n        },\n        ...\n    ],\n\n    summaryData: {\n        'House': {\n            description: 14, estimate: 9,\n                   rate: 99, due: new Date(2009, 6, 29),\n                   cost: 999\n        }\n    }\n}\n * </code></pre>\n *\n */\nExt.ux.grid.HybridSummary = Ext.extend(Ext.ux.grid.GroupSummary, {\n    /**\n     * @private\n     * @param {Object} rs\n     * @param {Object} cs\n     */\n    calculate : function(rs, cs){\n        var gcol = this.view.getGroupField(),\n            gvalue = rs[0].data[gcol],\n            gdata = this.getSummaryData(gvalue);\n        return gdata || Ext.ux.grid.HybridSummary.superclass.calculate.call(this, rs, cs);\n    },\n\n    /**\n     * <pre><code>\ngrid.on('afteredit', function(){\n    var groupValue = 'Ext Forms: Field Anchoring';\n    summary.showSummaryMsg(groupValue, 'Updating Summary...');\n    setTimeout(function(){ // simulate server call\n        // HybridSummary class implements updateSummaryData\n        summary.updateSummaryData(groupValue,\n            // create data object based on configured dataIndex\n            {description: 22, estimate: 888, rate: 888, due: new Date(), cost: 8});\n    }, 2000);\n});\n     * </code></pre>\n     * @param {String} groupValue\n     * @param {Object} data data object\n     * @param {Boolean} skipRefresh (Optional) Defaults to false\n     */\n    updateSummaryData : function(groupValue, data, skipRefresh){\n        var json = this.grid.getStore().reader.jsonData;\n        if(!json.summaryData){\n            json.summaryData = {};\n        }\n        json.summaryData[groupValue] = data;\n        if(!skipRefresh){\n            this.refreshSummary(groupValue);\n        }\n    },\n\n    /**\n     * Returns the summaryData for the specified groupValue or null.\n     * @param {String} groupValue\n     * @return {Object} summaryData\n     */\n    getSummaryData : function(groupValue){\n        var reader = this.grid.getStore().reader,\n            json = reader.jsonData,\n            fields = reader.recordType.prototype.fields,\n            v;\n            \n        if(json && json.summaryData){\n            v = json.summaryData[groupValue];\n            if(v){\n                return reader.extractValues(v, fields.items, fields.length);\n            }\n        }\n        return null;\n    }\n});\n\n//backwards compat\nExt.grid.HybridSummary = Ext.ux.grid.HybridSummary;\n"
  },
  {
    "path": "client/src/ext/ux/GroupTab.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ux.GroupTab = Ext.extend(Ext.Container, {\n    mainItem: 0,\n    \n    expanded: true,\n    \n    deferredRender: true,\n    \n    activeTab: null,\n    \n    idDelimiter: '__',\n    \n    headerAsText: false,\n    \n    frame: false,\n    \n    hideBorders: true,\n    \n    initComponent: function(config){\n        Ext.apply(this, config);\n        this.frame = false;\n        \n        Ext.ux.GroupTab.superclass.initComponent.call(this);\n        \n        this.addEvents('activate', 'deactivate', 'changemainitem', 'beforetabchange', 'tabchange');\n        \n        this.setLayout(new Ext.layout.CardLayout({\n            deferredRender: this.deferredRender\n        }));\n        \n        if (!this.stack) {\n            this.stack = Ext.TabPanel.AccessStack();\n        }\n        \n        this.initItems();\n        \n        this.on('beforerender', function(){\n            this.groupEl = this.ownerCt.getGroupEl(this);\n        }, this);\n        \n        this.on('add', this.onAdd, this, {\n            target: this\n        });\n        this.on('remove', this.onRemove, this, {\n            target: this\n        });\n        \n        if (this.mainItem !== undefined) {\n            var item = (typeof this.mainItem == 'object') ? this.mainItem : this.items.get(this.mainItem);\n            delete this.mainItem;\n            this.setMainItem(item);\n        }\n    },\n    \n    /**\n     * Sets the specified tab as the active tab. This method fires the {@link #beforetabchange} event which\n     * can return false to cancel the tab change.\n     * @param {String/Panel} tab The id or tab Panel to activate\n     */\n    setActiveTab : function(item){\n        item = this.getComponent(item);\n        if(!item){\n            return false;\n        }\n        if(!this.rendered){\n            this.activeTab = item;\n            return true;\n        }\n        if(this.activeTab != item && this.fireEvent('beforetabchange', this, item, this.activeTab) !== false){\n            if(this.activeTab && this.activeTab != this.mainItem){\n                var oldEl = this.getTabEl(this.activeTab);\n                if(oldEl){\n                    Ext.fly(oldEl).removeClass('x-grouptabs-strip-active');\n                }\n            }\n            var el = this.getTabEl(item);\n            Ext.fly(el).addClass('x-grouptabs-strip-active');\n            this.activeTab = item;\n            this.stack.add(item);\n\n            this.layout.setActiveItem(item);\n            if(this.layoutOnTabChange && item.doLayout){\n                item.doLayout();\n            }\n            if(this.scrolling){\n                this.scrollToTab(item, this.animScroll);\n            }\n\n            this.fireEvent('tabchange', this, item);\n            return true;\n        }\n        return false;\n    },\n    \n    getTabEl: function(item){\n        if (item == this.mainItem) {\n            return this.groupEl;\n        }\n        return Ext.TabPanel.prototype.getTabEl.call(this, item);\n    },\n    \n    onRender: function(ct, position){\n        Ext.ux.GroupTab.superclass.onRender.call(this, ct, position);\n        \n        this.strip = Ext.fly(this.groupEl).createChild({\n            tag: 'ul',\n            cls: 'x-grouptabs-sub'\n        });\n\n        this.tooltip = new Ext.ToolTip({\n           target: this.groupEl,\n           delegate: 'a.x-grouptabs-text',\n           trackMouse: true,\n           renderTo: document.body,\n           listeners: {\n               beforeshow: function(tip) {\n                   var item = (tip.triggerElement.parentNode === this.mainItem.tabEl)\n                       ? this.mainItem\n                       : this.findById(tip.triggerElement.parentNode.id.split(this.idDelimiter)[1]);\n\n                   if(!item.tabTip) {\n                       return false;\n                   }\n                   tip.body.dom.innerHTML = item.tabTip;\n               },\n               scope: this\n           }\n        });\n                \n        if (!this.itemTpl) {\n            var tt = new Ext.Template('<li class=\"{cls}\" id=\"{id}\">', '<a onclick=\"return false;\" class=\"x-grouptabs-text {iconCls}\">{text}</a>', '</li>');\n            tt.disableFormats = true;\n            tt.compile();\n            Ext.ux.GroupTab.prototype.itemTpl = tt;\n        }\n        \n        this.items.each(this.initTab, this);\n    },\n    \n    afterRender: function(){\n        Ext.ux.GroupTab.superclass.afterRender.call(this);\n        \n        if (this.activeTab !== undefined) {\n            var item = (typeof this.activeTab == 'object') ? this.activeTab : this.items.get(this.activeTab);\n            delete this.activeTab;\n            this.setActiveTab(item);\n        }\n    },\n    \n    // private\n    initTab: function(item, index){\n        var before = this.strip.dom.childNodes[index];\n        var p = Ext.TabPanel.prototype.getTemplateArgs.call(this, item);\n        \n        if (item === this.mainItem) {\n            item.tabEl = this.groupEl;\n            p.cls += ' x-grouptabs-main-item';\n        }\n        \n        var el = before ? this.itemTpl.insertBefore(before, p) : this.itemTpl.append(this.strip, p);\n        \n        item.tabEl = item.tabEl || el;\n                \n        item.on('disable', this.onItemDisabled, this);\n        item.on('enable', this.onItemEnabled, this);\n        item.on('titlechange', this.onItemTitleChanged, this);\n        item.on('iconchange', this.onItemIconChanged, this);\n        item.on('beforeshow', this.onBeforeShowItem, this);\n    },\n    \n    setMainItem: function(item){\n        item = this.getComponent(item);\n        if (!item || this.fireEvent('changemainitem', this, item, this.mainItem) === false) {\n            return;\n        }\n        \n        this.mainItem = item;\n    },\n    \n    getMainItem: function(){\n        return this.mainItem || null;\n    },\n    \n    // private\n    onBeforeShowItem: function(item){\n        if (item != this.activeTab) {\n            this.setActiveTab(item);\n            return false;\n        }\n    },\n    \n    // private\n    onAdd: function(gt, item, index){\n        if (this.rendered) {\n            this.initTab.call(this, item, index);\n        }\n    },\n    \n    // private\n    onRemove: function(tp, item){\n        Ext.destroy(Ext.get(this.getTabEl(item)));\n        this.stack.remove(item);\n        item.un('disable', this.onItemDisabled, this);\n        item.un('enable', this.onItemEnabled, this);\n        item.un('titlechange', this.onItemTitleChanged, this);\n        item.un('iconchange', this.onItemIconChanged, this);\n        item.un('beforeshow', this.onBeforeShowItem, this);\n        if (item == this.activeTab) {\n            var next = this.stack.next();\n            if (next) {\n                this.setActiveTab(next);\n            }\n            else if (this.items.getCount() > 0) {\n                this.setActiveTab(0);\n            }\n            else {\n                this.activeTab = null;\n            }\n        }\n    },\n    \n    // private\n    onBeforeAdd: function(item){\n        var existing = item.events ? (this.items.containsKey(item.getItemId()) ? item : null) : this.items.get(item);\n        if (existing) {\n            this.setActiveTab(item);\n            return false;\n        }\n        Ext.TabPanel.superclass.onBeforeAdd.apply(this, arguments);\n        var es = item.elements;\n        item.elements = es ? es.replace(',header', '') : es;\n        item.border = (item.border === true);\n    },\n    \n    // private\n    onItemDisabled: Ext.TabPanel.prototype.onItemDisabled,\n    onItemEnabled: Ext.TabPanel.prototype.onItemEnabled,\n    \n    // private\n    onItemTitleChanged: function(item){\n        var el = this.getTabEl(item);\n        if (el) {\n            Ext.fly(el).child('a.x-grouptabs-text', true).innerHTML = item.title;\n        }\n    },\n    \n    //private\n    onItemIconChanged: function(item, iconCls, oldCls){\n        var el = this.getTabEl(item);\n        if (el) {\n            Ext.fly(el).child('a.x-grouptabs-text').replaceClass(oldCls, iconCls);\n        }\n    },\n    \n    beforeDestroy: function(){\n        Ext.TabPanel.prototype.beforeDestroy.call(this);\n        this.tooltip.destroy();\n    }\n});\n\nExt.reg('grouptab', Ext.ux.GroupTab);\n"
  },
  {
    "path": "client/src/ext/ux/GroupTabPanel.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux');\n\nExt.ux.GroupTabPanel = Ext.extend(Ext.TabPanel, {\n    tabPosition: 'left',\n\n    alternateColor: false,\n\n    alternateCls: 'x-grouptabs-panel-alt',\n\n    defaultType: 'grouptab',\n\n    deferredRender: false,\n\n    activeGroup : null,\n\n    initComponent: function(){\n        Ext.ux.GroupTabPanel.superclass.initComponent.call(this);\n        \n        this.addEvents(\n            'beforegroupchange',\n            'groupchange'\n        );\n        this.elements = 'body,header';\n        this.stripTarget = 'header';\n\n        this.tabPosition = this.tabPosition == 'right' ? 'right' : 'left';\n\n        this.addClass('x-grouptabs-panel');\n\n        if (this.tabStyle && this.tabStyle != '') {\n            this.addClass('x-grouptabs-panel-' + this.tabStyle);\n        }\n\n        if (this.alternateColor) {\n            this.addClass(this.alternateCls);\n        }\n\n        this.on('beforeadd', function(gtp, item, index){\n            this.initGroup(item, index);\n        });\n        this.items.each(function(item){\n            item.on('tabchange',function(item){\n                this.fireEvent('tabchange', this, item.activeTab);\n            }, this);\n        },this);\n    },\n\n    initEvents : function() {\n        this.mon(this.strip, 'mousedown', this.onStripMouseDown, this);\n    },\n\n    onRender: function(ct, position){\n        Ext.TabPanel.superclass.onRender.call(this, ct, position);\n        if(this.plain){\n            var pos = this.tabPosition == 'top' ? 'header' : 'footer';\n            this[pos].addClass('x-tab-panel-'+pos+'-plain');\n        }\n\n        var st = this[this.stripTarget];\n\n        this.stripWrap = st.createChild({cls:'x-tab-strip-wrap ', cn:{\n            tag:'ul', cls:'x-grouptabs-strip x-grouptabs-tab-strip-'+this.tabPosition}});\n\n        var beforeEl = (this.tabPosition=='bottom' ? this.stripWrap : null);\n        this.strip = new Ext.Element(this.stripWrap.dom.firstChild);\n\n        this.header.addClass('x-grouptabs-panel-header');\n        this.bwrap.addClass('x-grouptabs-bwrap');\n        this.body.addClass('x-tab-panel-body-'+this.tabPosition + ' x-grouptabs-panel-body');\n\n        if (!this.groupTpl) {\n            var tt = new Ext.Template(\n                '<li class=\"{cls}\" id=\"{id}\">',\n                '<a class=\"x-grouptabs-expand\" onclick=\"return false;\"></a>',\n                '<a class=\"x-grouptabs-text {iconCls}\" href=\"#\" onclick=\"return false;\">',\n                '<span>{text}</span></a>',\n                '</li>'\n            );\n            tt.disableFormats = true;\n            tt.compile();\n            Ext.ux.GroupTabPanel.prototype.groupTpl = tt;\n        }\n        this.items.each(this.initGroup, this);\n    },\n\n    afterRender: function(){\n        Ext.ux.GroupTabPanel.superclass.afterRender.call(this);\n\n        this.tabJoint = Ext.fly(this.body.dom.parentNode).createChild({\n            cls: 'x-tab-joint'\n        });\n\n        this.addClass('x-tab-panel-' + this.tabPosition);\n        this.header.setWidth(this.tabWidth);\n\n        if (this.activeGroup !== undefined) {\n            var group = (typeof this.activeGroup == 'object') ? this.activeGroup : this.items.get(this.activeGroup);\n            delete this.activeGroup;\n            this.setActiveGroup(group);\n            group.setActiveTab(group.getMainItem());\n        }\n    },\n\n    getGroupEl : Ext.TabPanel.prototype.getTabEl,\n\n    // private\n    findTargets: function(e){\n        var item = null,\n            itemEl = e.getTarget('li', this.strip);\n        if (itemEl) {\n            item = this.findById(itemEl.id.split(this.idDelimiter)[1]);\n            if (item.disabled) {\n                return {\n                    expand: null,\n                    item: null,\n                    el: null\n                };\n            }\n        }\n        return {\n            expand: e.getTarget('.x-grouptabs-expand', this.strip),\n            isGroup: !e.getTarget('ul.x-grouptabs-sub', this.strip),\n            item: item,\n            el: itemEl\n        };\n    },\n\n    // private\n    onStripMouseDown: function(e){\n        if (e.button != 0) {\n            return;\n        }\n        e.preventDefault();\n        var t = this.findTargets(e);\n        if (t.expand) {\n            this.toggleGroup(t.el);\n        }\n        else if (t.item) {\n            if(t.isGroup) {\n                t.item.setActiveTab(t.item.getMainItem());\n            }\n            else {\n                t.item.ownerCt.setActiveTab(t.item);\n            }\n        }\n    },\n\n    expandGroup: function(groupEl){\n        if(groupEl.isXType) {\n            groupEl = this.getGroupEl(groupEl);\n        }\n        Ext.fly(groupEl).addClass('x-grouptabs-expanded');\n        this.syncTabJoint();\n    },\n\n    toggleGroup: function(groupEl){\n        if(groupEl.isXType) {\n            groupEl = this.getGroupEl(groupEl);\n        }\n        Ext.fly(groupEl).toggleClass('x-grouptabs-expanded');\n        this.syncTabJoint();\n    },\n\n    collapseGroup: function(groupEl){\n        if(groupEl.isXType) {\n            groupEl = this.getGroupEl(groupEl);\n        }\n        Ext.fly(groupEl).removeClass('x-grouptabs-expanded');\n        this.syncTabJoint();\n    },\n\n    syncTabJoint: function(groupEl){\n        if (!this.tabJoint) {\n            return;\n        }\n\n        groupEl = groupEl || this.getGroupEl(this.activeGroup);\n        if(groupEl) {\n            this.tabJoint.setHeight(Ext.fly(groupEl).getHeight() - 2);\n\n            var y = Ext.isGecko2 ? 0 : 1;\n            if (this.tabPosition == 'left'){\n                this.tabJoint.alignTo(groupEl, 'tl-tr', [-2,y]);\n            }\n            else {\n                this.tabJoint.alignTo(groupEl, 'tr-tl', [1,y]);\n            }\n        }\n        else {\n            this.tabJoint.hide();\n        }\n    },\n\n    getActiveTab : function() {\n        if(!this.activeGroup) return null;\n        return this.activeGroup.getTabEl(this.activeGroup.activeTab) || null;\n    },\n\n    onResize: function(){\n        Ext.ux.GroupTabPanel.superclass.onResize.apply(this, arguments);\n        this.syncTabJoint();\n    },\n\n    createCorner: function(el, pos){\n        return Ext.fly(el).createChild({\n            cls: 'x-grouptabs-corner x-grouptabs-corner-' + pos\n        });\n    },\n\n    initGroup: function(group, index){\n        var before = this.strip.dom.childNodes[index],\n            p = this.getTemplateArgs(group);\n        if (index === 0) {\n            p.cls += ' x-tab-first';\n        }\n        p.cls += ' x-grouptabs-main';\n        p.text = group.getMainItem().title;\n\n        var el = before ? this.groupTpl.insertBefore(before, p) : this.groupTpl.append(this.strip, p),\n            tl = this.createCorner(el, 'top-' + this.tabPosition),\n            bl = this.createCorner(el, 'bottom-' + this.tabPosition);\n\n        group.tabEl = el;\n        if (group.expanded) {\n            this.expandGroup(el);\n        }\n\n        if (Ext.isIE6 || (Ext.isIE && !Ext.isStrict)){\n            bl.setLeft('-10px');\n            bl.setBottom('-5px');\n            tl.setLeft('-10px');\n            tl.setTop('-5px');\n        }\n\n        this.mon(group, {\n            scope: this,\n            changemainitem: this.onGroupChangeMainItem,\n            beforetabchange: this.onGroupBeforeTabChange\n        });\n    },\n\n    setActiveGroup : function(group) {\n        group = this.getComponent(group);\n        if(!group){\n            return false;\n        }\n        if(!this.rendered){\n            this.activeGroup = group;\n            return true;\n        }\n        if(this.activeGroup != group && this.fireEvent('beforegroupchange', this, group, this.activeGroup) !== false){\n            if(this.activeGroup){\n                this.activeGroup.activeTab = null;\n                var oldEl = this.getGroupEl(this.activeGroup);\n                if(oldEl){\n                    Ext.fly(oldEl).removeClass('x-grouptabs-strip-active');\n                }\n            }\n\n            var groupEl = this.getGroupEl(group);\n            Ext.fly(groupEl).addClass('x-grouptabs-strip-active');\n\n            this.activeGroup = group;\n            this.stack.add(group);\n\n            this.layout.setActiveItem(group);\n            this.syncTabJoint(groupEl);\n\n            this.fireEvent('groupchange', this, group);\n            return true;\n        }\n        return false;\n    },\n\n    onGroupBeforeTabChange: function(group, newTab, oldTab){\n        if(group !== this.activeGroup || newTab !== oldTab) {\n            this.strip.select('.x-grouptabs-sub > li.x-grouptabs-strip-active', true).removeClass('x-grouptabs-strip-active');\n        }\n        this.expandGroup(this.getGroupEl(group));\n        if(group !== this.activeGroup) {\n            return this.setActiveGroup(group);\n        }\n    },\n\n    getFrameHeight: function(){\n        var h = this.el.getFrameWidth('tb');\n        h += (this.tbar ? this.tbar.getHeight() : 0) +\n        (this.bbar ? this.bbar.getHeight() : 0);\n\n        return h;\n    },\n\n    adjustBodyWidth: function(w){\n        return w - this.tabWidth;\n    }\n});\n\nExt.reg('grouptabpanel', Ext.ux.GroupTabPanel);\n"
  },
  {
    "path": "client/src/ext/ux/ItemSelector.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/*\n * Note that this control will most likely remain as an example, and not as a core Ext form\n * control.  However, the API will be changing in a future release and so should not yet be\n * treated as a final, stable API at this time.\n */\n\n/**\n * @class Ext.ux.form.ItemSelector\n * @extends Ext.form.Field\n * A control that allows selection of between two Ext.ux.form.MultiSelect controls.\n *\n *  @history\n *    2008-06-19 bpm Original code contributed by Toby Stuart (with contributions from Robert Williams)\n *\n * @constructor\n * Create a new ItemSelector\n * @param {Object} config Configuration options\n * @xtype itemselector \n */\nExt.ux.form.ItemSelector = Ext.extend(Ext.form.Field,  {\n    hideNavIcons:false,\n    imagePath:\"\",\n    iconUp:\"up2.gif\",\n    iconDown:\"down2.gif\",\n    iconLeft:\"left2.gif\",\n    iconRight:\"right2.gif\",\n    iconTop:\"top2.gif\",\n    iconBottom:\"bottom2.gif\",\n    drawUpIcon:true,\n    drawDownIcon:true,\n    drawLeftIcon:true,\n    drawRightIcon:true,\n    drawTopIcon:true,\n    drawBotIcon:true,\n    delimiter:',',\n    bodyStyle:null,\n    border:false,\n    defaultAutoCreate:{tag: \"div\"},\n    /**\n     * @cfg {Array} multiselects An array of {@link Ext.ux.form.MultiSelect} config objects, with at least all required parameters (e.g., store)\n     */\n    multiselects:null,\n\n    initComponent: function(){\n        Ext.ux.form.ItemSelector.superclass.initComponent.call(this);\n        this.addEvents({\n            'rowdblclick' : true,\n            'change' : true\n        });\n    },\n\n    onRender: function(ct, position){\n        Ext.ux.form.ItemSelector.superclass.onRender.call(this, ct, position);\n\n        // Internal default configuration for both multiselects\n        var msConfig = [{\n            legend: 'Available',\n            draggable: true,\n            droppable: true,\n            width: 100,\n            height: 100\n        },{\n            legend: 'Selected',\n            droppable: true,\n            draggable: true,\n            width: 100,\n            height: 100\n        }];\n\n        this.fromMultiselect = new Ext.ux.form.MultiSelect(Ext.applyIf(this.multiselects[0], msConfig[0]));\n        this.fromMultiselect.on('dblclick', this.onRowDblClick, this);\n\n        this.toMultiselect = new Ext.ux.form.MultiSelect(Ext.applyIf(this.multiselects[1], msConfig[1]));\n        this.toMultiselect.on('dblclick', this.onRowDblClick, this);\n\n        var p = new Ext.Panel({\n            bodyStyle:this.bodyStyle,\n            border:this.border,\n            layout:\"table\",\n            layoutConfig:{columns:3}\n        });\n\n        p.add(this.fromMultiselect);\n        var icons = new Ext.Panel({header:false});\n        p.add(icons);\n        p.add(this.toMultiselect);\n        p.render(this.el);\n        icons.el.down('.'+icons.bwrapCls).remove();\n\n        // ICON HELL!!!\n        if (this.imagePath!=\"\" && this.imagePath.charAt(this.imagePath.length-1)!=\"/\")\n            this.imagePath+=\"/\";\n        this.iconUp = this.imagePath + (this.iconUp || 'up2.gif');\n        this.iconDown = this.imagePath + (this.iconDown || 'down2.gif');\n        this.iconLeft = this.imagePath + (this.iconLeft || 'left2.gif');\n        this.iconRight = this.imagePath + (this.iconRight || 'right2.gif');\n        this.iconTop = this.imagePath + (this.iconTop || 'top2.gif');\n        this.iconBottom = this.imagePath + (this.iconBottom || 'bottom2.gif');\n        var el=icons.getEl();\n        this.toTopIcon = el.createChild({tag:'img', src:this.iconTop, style:{cursor:'pointer', margin:'2px'}});\n        el.createChild({tag: 'br'});\n        this.upIcon = el.createChild({tag:'img', src:this.iconUp, style:{cursor:'pointer', margin:'2px'}});\n        el.createChild({tag: 'br'});\n        this.addIcon = el.createChild({tag:'img', src:this.iconRight, style:{cursor:'pointer', margin:'2px'}});\n        el.createChild({tag: 'br'});\n        this.removeIcon = el.createChild({tag:'img', src:this.iconLeft, style:{cursor:'pointer', margin:'2px'}});\n        el.createChild({tag: 'br'});\n        this.downIcon = el.createChild({tag:'img', src:this.iconDown, style:{cursor:'pointer', margin:'2px'}});\n        el.createChild({tag: 'br'});\n        this.toBottomIcon = el.createChild({tag:'img', src:this.iconBottom, style:{cursor:'pointer', margin:'2px'}});\n        this.toTopIcon.on('click', this.toTop, this);\n        this.upIcon.on('click', this.up, this);\n        this.downIcon.on('click', this.down, this);\n        this.toBottomIcon.on('click', this.toBottom, this);\n        this.addIcon.on('click', this.fromTo, this);\n        this.removeIcon.on('click', this.toFrom, this);\n        if (!this.drawUpIcon || this.hideNavIcons) { this.upIcon.dom.style.display='none'; }\n        if (!this.drawDownIcon || this.hideNavIcons) { this.downIcon.dom.style.display='none'; }\n        if (!this.drawLeftIcon || this.hideNavIcons) { this.addIcon.dom.style.display='none'; }\n        if (!this.drawRightIcon || this.hideNavIcons) { this.removeIcon.dom.style.display='none'; }\n        if (!this.drawTopIcon || this.hideNavIcons) { this.toTopIcon.dom.style.display='none'; }\n        if (!this.drawBotIcon || this.hideNavIcons) { this.toBottomIcon.dom.style.display='none'; }\n\n        var tb = p.body.first();\n        this.el.setWidth(p.body.first().getWidth());\n        p.body.removeClass();\n\n        this.hiddenName = this.name;\n        var hiddenTag = {tag: \"input\", type: \"hidden\", value: \"\", name: this.name};\n        this.hiddenField = this.el.createChild(hiddenTag);\n    },\n    \n    doLayout: function(){\n        if(this.rendered){\n            this.fromMultiselect.fs.doLayout();\n            this.toMultiselect.fs.doLayout();\n        }\n    },\n\n    afterRender: function(){\n        Ext.ux.form.ItemSelector.superclass.afterRender.call(this);\n\n        this.toStore = this.toMultiselect.store;\n        this.toStore.on('add', this.valueChanged, this);\n        this.toStore.on('remove', this.valueChanged, this);\n        this.toStore.on('load', this.valueChanged, this);\n        this.valueChanged(this.toStore);\n    },\n\n    toTop : function() {\n        var selectionsArray = this.toMultiselect.view.getSelectedIndexes();\n        var records = [];\n        if (selectionsArray.length > 0) {\n            selectionsArray.sort();\n            for (var i=0; i<selectionsArray.length; i++) {\n                record = this.toMultiselect.view.store.getAt(selectionsArray[i]);\n                records.push(record);\n            }\n            selectionsArray = [];\n            for (var i=records.length-1; i>-1; i--) {\n                record = records[i];\n                this.toMultiselect.view.store.remove(record);\n                this.toMultiselect.view.store.insert(0, record);\n                selectionsArray.push(((records.length - 1) - i));\n            }\n        }\n        this.toMultiselect.view.refresh();\n        this.toMultiselect.view.select(selectionsArray);\n    },\n\n    toBottom : function() {\n        var selectionsArray = this.toMultiselect.view.getSelectedIndexes();\n        var records = [];\n        if (selectionsArray.length > 0) {\n            selectionsArray.sort();\n            for (var i=0; i<selectionsArray.length; i++) {\n                record = this.toMultiselect.view.store.getAt(selectionsArray[i]);\n                records.push(record);\n            }\n            selectionsArray = [];\n            for (var i=0; i<records.length; i++) {\n                record = records[i];\n                this.toMultiselect.view.store.remove(record);\n                this.toMultiselect.view.store.add(record);\n                selectionsArray.push((this.toMultiselect.view.store.getCount()) - (records.length - i));\n            }\n        }\n        this.toMultiselect.view.refresh();\n        this.toMultiselect.view.select(selectionsArray);\n    },\n\n    up : function() {\n        var record = null;\n        var selectionsArray = this.toMultiselect.view.getSelectedIndexes();\n        selectionsArray.sort();\n        var newSelectionsArray = [];\n        if (selectionsArray.length > 0) {\n            for (var i=0; i<selectionsArray.length; i++) {\n                record = this.toMultiselect.view.store.getAt(selectionsArray[i]);\n                if ((selectionsArray[i] - 1) >= 0) {\n                    this.toMultiselect.view.store.remove(record);\n                    this.toMultiselect.view.store.insert(selectionsArray[i] - 1, record);\n                    newSelectionsArray.push(selectionsArray[i] - 1);\n                }\n            }\n            this.toMultiselect.view.refresh();\n            this.toMultiselect.view.select(newSelectionsArray);\n        }\n    },\n\n    down : function() {\n        var record = null;\n        var selectionsArray = this.toMultiselect.view.getSelectedIndexes();\n        selectionsArray.sort();\n        selectionsArray.reverse();\n        var newSelectionsArray = [];\n        if (selectionsArray.length > 0) {\n            for (var i=0; i<selectionsArray.length; i++) {\n                record = this.toMultiselect.view.store.getAt(selectionsArray[i]);\n                if ((selectionsArray[i] + 1) < this.toMultiselect.view.store.getCount()) {\n                    this.toMultiselect.view.store.remove(record);\n                    this.toMultiselect.view.store.insert(selectionsArray[i] + 1, record);\n                    newSelectionsArray.push(selectionsArray[i] + 1);\n                }\n            }\n            this.toMultiselect.view.refresh();\n            this.toMultiselect.view.select(newSelectionsArray);\n        }\n    },\n\n    fromTo : function() {\n        var selectionsArray = this.fromMultiselect.view.getSelectedIndexes();\n        var records = [];\n        if (selectionsArray.length > 0) {\n            for (var i=0; i<selectionsArray.length; i++) {\n                record = this.fromMultiselect.view.store.getAt(selectionsArray[i]);\n                records.push(record);\n            }\n            if(!this.allowDup)selectionsArray = [];\n            for (var i=0; i<records.length; i++) {\n                record = records[i];\n                if(this.allowDup){\n                    var x=new Ext.data.Record();\n                    record.id=x.id;\n                    delete x;\n                    this.toMultiselect.view.store.add(record);\n                }else{\n                    this.fromMultiselect.view.store.remove(record);\n                    this.toMultiselect.view.store.add(record);\n                    selectionsArray.push((this.toMultiselect.view.store.getCount() - 1));\n                }\n            }\n        }\n        this.toMultiselect.view.refresh();\n        this.fromMultiselect.view.refresh();\n        var si = this.toMultiselect.store.sortInfo;\n        if(si){\n            this.toMultiselect.store.sort(si.field, si.direction);\n        }\n        this.toMultiselect.view.select(selectionsArray);\n    },\n\n    toFrom : function() {\n        var selectionsArray = this.toMultiselect.view.getSelectedIndexes();\n        var records = [];\n        if (selectionsArray.length > 0) {\n            for (var i=0; i<selectionsArray.length; i++) {\n                record = this.toMultiselect.view.store.getAt(selectionsArray[i]);\n                records.push(record);\n            }\n            selectionsArray = [];\n            for (var i=0; i<records.length; i++) {\n                record = records[i];\n                this.toMultiselect.view.store.remove(record);\n                if(!this.allowDup){\n                    this.fromMultiselect.view.store.add(record);\n                    selectionsArray.push((this.fromMultiselect.view.store.getCount() - 1));\n                }\n            }\n        }\n        this.fromMultiselect.view.refresh();\n        this.toMultiselect.view.refresh();\n        var si = this.fromMultiselect.store.sortInfo;\n        if (si){\n            this.fromMultiselect.store.sort(si.field, si.direction);\n        }\n        this.fromMultiselect.view.select(selectionsArray);\n    },\n\n    valueChanged: function(store) {\n        var record = null;\n        var values = [];\n        for (var i=0; i<store.getCount(); i++) {\n            record = store.getAt(i);\n            values.push(record.get(this.toMultiselect.valueField));\n        }\n        this.hiddenField.dom.value = values.join(this.delimiter);\n        this.fireEvent('change', this, this.getValue(), this.hiddenField.dom.value);\n    },\n\n    getValue : function() {\n        return this.hiddenField.dom.value;\n    },\n\n    onRowDblClick : function(vw, index, node, e) {\n        if (vw == this.toMultiselect.view){\n            this.toFrom();\n        } else if (vw == this.fromMultiselect.view) {\n            this.fromTo();\n        }\n        return this.fireEvent('rowdblclick', vw, index, node, e);\n    },\n\n    reset: function(){\n        range = this.toMultiselect.store.getRange();\n        this.toMultiselect.store.removeAll();\n        this.fromMultiselect.store.add(range);\n        var si = this.fromMultiselect.store.sortInfo;\n        if (si){\n            this.fromMultiselect.store.sort(si.field, si.direction);\n        }\n        this.valueChanged(this.toMultiselect.store);\n    }\n});\n\nExt.reg('itemselector', Ext.ux.form.ItemSelector);\n\n//backwards compat\nExt.ux.ItemSelector = Ext.ux.form.ItemSelector;\n"
  },
  {
    "path": "client/src/ext/ux/LockingGridView.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.grid');\n\nExt.ux.grid.LockingGridView = Ext.extend(Ext.grid.GridView, {\n    lockText : 'Lock',\n    unlockText : 'Unlock',\n    rowBorderWidth : 1,\n    lockedBorderWidth : 1,\n\n    /*\n     * This option ensures that height between the rows is synchronized\n     * between the locked and unlocked sides. This option only needs to be used\n     * when the row heights aren't predictable.\n     */\n    syncHeights: false,\n\n    initTemplates : function(){\n        var ts = this.templates || {};\n\n        if (!ts.masterTpl) {\n            ts.masterTpl = new Ext.Template(\n                '<div class=\"x-grid3\" hidefocus=\"true\">',\n                    '<div class=\"x-grid3-locked\">',\n                        '<div class=\"x-grid3-header\"><div class=\"x-grid3-header-inner\"><div class=\"x-grid3-header-offset\" style=\"{lstyle}\">{lockedHeader}</div></div><div class=\"x-clear\"></div></div>',\n                        '<div class=\"x-grid3-scroller\"><div class=\"x-grid3-body\" style=\"{lstyle}\">{lockedBody}</div><div class=\"x-grid3-scroll-spacer\"></div></div>',\n                    '</div>',\n                    '<div class=\"x-grid3-viewport x-grid3-unlocked\">',\n                        '<div class=\"x-grid3-header\"><div class=\"x-grid3-header-inner\"><div class=\"x-grid3-header-offset\" style=\"{ostyle}\">{header}</div></div><div class=\"x-clear\"></div></div>',\n                        '<div class=\"x-grid3-scroller\"><div class=\"x-grid3-body\" style=\"{bstyle}\">{body}</div><a href=\"#\" class=\"x-grid3-focus\" tabIndex=\"-1\"></a></div>',\n                    '</div>',\n                    '<div class=\"x-grid3-resize-marker\">&#160;</div>',\n                    '<div class=\"x-grid3-resize-proxy\">&#160;</div>',\n                '</div>'\n            );\n        }\n\n        this.templates = ts;\n\n        Ext.ux.grid.LockingGridView.superclass.initTemplates.call(this);\n    },\n\n    getEditorParent : function(ed){\n        return this.el.dom;\n    },\n\n    initElements : function(){\n        var el             = Ext.get(this.grid.getGridEl().dom.firstChild),\n            lockedWrap     = el.child('div.x-grid3-locked'),\n            lockedHd       = lockedWrap.child('div.x-grid3-header'),\n            lockedScroller = lockedWrap.child('div.x-grid3-scroller'),\n            mainWrap       = el.child('div.x-grid3-viewport'),\n            mainHd         = mainWrap.child('div.x-grid3-header'),\n            scroller       = mainWrap.child('div.x-grid3-scroller');\n            \n        if (this.grid.hideHeaders) {\n            lockedHd.setDisplayed(false);\n            mainHd.setDisplayed(false);\n        }\n        \n        if(this.forceFit){\n            scroller.setStyle('overflow-x', 'hidden');\n        }\n        \n        Ext.apply(this, {\n            el      : el,\n            mainWrap: mainWrap,\n            mainHd  : mainHd,\n            innerHd : mainHd.dom.firstChild,\n            scroller: scroller,\n            mainBody: scroller.child('div.x-grid3-body'),\n            focusEl : scroller.child('a'),\n            resizeMarker: el.child('div.x-grid3-resize-marker'),\n            resizeProxy : el.child('div.x-grid3-resize-proxy'),\n            lockedWrap: lockedWrap,\n            lockedHd: lockedHd,\n            lockedScroller: lockedScroller,\n            lockedBody: lockedScroller.child('div.x-grid3-body'),\n            lockedInnerHd: lockedHd.child('div.x-grid3-header-inner', true)\n        });\n        \n        this.focusEl.swallowEvent('click', true);\n    },\n\n    getLockedRows : function(){\n        return this.hasRows() ? this.lockedBody.dom.childNodes : [];\n    },\n\n    getLockedRow : function(row){\n        return this.getLockedRows()[row];\n    },\n\n    getCell : function(row, col){\n        var lockedLen = this.cm.getLockedCount();\n        if(col < lockedLen){\n            return this.getLockedRow(row).getElementsByTagName('td')[col];\n        }\n        return Ext.ux.grid.LockingGridView.superclass.getCell.call(this, row, col - lockedLen);\n    },\n\n    getHeaderCell : function(index){\n        var lockedLen = this.cm.getLockedCount();\n        if(index < lockedLen){\n            return this.lockedHd.dom.getElementsByTagName('td')[index];\n        }\n        return Ext.ux.grid.LockingGridView.superclass.getHeaderCell.call(this, index - lockedLen);\n    },\n\n    addRowClass : function(row, cls){\n        var lockedRow = this.getLockedRow(row);\n        if(lockedRow){\n            this.fly(lockedRow).addClass(cls);\n        }\n        Ext.ux.grid.LockingGridView.superclass.addRowClass.call(this, row, cls);\n    },\n\n    removeRowClass : function(row, cls){\n        var lockedRow = this.getLockedRow(row);\n        if(lockedRow){\n            this.fly(lockedRow).removeClass(cls);\n        }\n        Ext.ux.grid.LockingGridView.superclass.removeRowClass.call(this, row, cls);\n    },\n\n    removeRow : function(row) {\n        Ext.removeNode(this.getLockedRow(row));\n        Ext.ux.grid.LockingGridView.superclass.removeRow.call(this, row);\n    },\n\n    removeRows : function(firstRow, lastRow){\n        var lockedBody = this.lockedBody.dom,\n            rowIndex = firstRow;\n        for(; rowIndex <= lastRow; rowIndex++){\n            Ext.removeNode(lockedBody.childNodes[firstRow]);\n        }\n        Ext.ux.grid.LockingGridView.superclass.removeRows.call(this, firstRow, lastRow);\n    },\n\n    syncScroll : function(e){\n        this.lockedScroller.dom.scrollTop = this.scroller.dom.scrollTop;\n        Ext.ux.grid.LockingGridView.superclass.syncScroll.call(this, e);\n    },\n\n    updateSortIcon : function(col, dir){\n        var sortClasses = this.sortClasses,\n            lockedHeaders = this.lockedHd.select('td').removeClass(sortClasses),\n            headers = this.mainHd.select('td').removeClass(sortClasses),\n            lockedLen = this.cm.getLockedCount(),\n            cls = sortClasses[dir == 'DESC' ? 1 : 0];\n            \n        if(col < lockedLen){\n            lockedHeaders.item(col).addClass(cls);\n        }else{\n            headers.item(col - lockedLen).addClass(cls);\n        }\n    },\n\n    updateAllColumnWidths : function(){\n        var tw = this.getTotalWidth(),\n            clen = this.cm.getColumnCount(),\n            lw = this.getLockedWidth(),\n            llen = this.cm.getLockedCount(),\n            ws = [], len, i;\n        this.updateLockedWidth();\n        for(i = 0; i < clen; i++){\n            ws[i] = this.getColumnWidth(i);\n            var hd = this.getHeaderCell(i);\n            hd.style.width = ws[i];\n        }\n        var lns = this.getLockedRows(), ns = this.getRows(), row, trow, j;\n        for(i = 0, len = ns.length; i < len; i++){\n            row = lns[i];\n            row.style.width = lw;\n            if(row.firstChild){\n                row.firstChild.style.width = lw;\n                trow = row.firstChild.rows[0];\n                for (j = 0; j < llen; j++) {\n                   trow.childNodes[j].style.width = ws[j];\n                }\n            }\n            row = ns[i];\n            row.style.width = tw;\n            if(row.firstChild){\n                row.firstChild.style.width = tw;\n                trow = row.firstChild.rows[0];\n                for (j = llen; j < clen; j++) {\n                   trow.childNodes[j - llen].style.width = ws[j];\n                }\n            }\n        }\n        this.onAllColumnWidthsUpdated(ws, tw);\n        this.syncHeaderHeight();\n    },\n\n    updateColumnWidth : function(col, width){\n        var w = this.getColumnWidth(col),\n            llen = this.cm.getLockedCount(),\n            ns, rw, c, row;\n        this.updateLockedWidth();\n        if(col < llen){\n            ns = this.getLockedRows();\n            rw = this.getLockedWidth();\n            c = col;\n        }else{\n            ns = this.getRows();\n            rw = this.getTotalWidth();\n            c = col - llen;\n        }\n        var hd = this.getHeaderCell(col);\n        hd.style.width = w;\n        for(var i = 0, len = ns.length; i < len; i++){\n            row = ns[i];\n            row.style.width = rw;\n            if(row.firstChild){\n                row.firstChild.style.width = rw;\n                row.firstChild.rows[0].childNodes[c].style.width = w;\n            }\n        }\n        this.onColumnWidthUpdated(col, w, this.getTotalWidth());\n        this.syncHeaderHeight();\n    },\n\n    updateColumnHidden : function(col, hidden){\n        var llen = this.cm.getLockedCount(),\n            ns, rw, c, row,\n            display = hidden ? 'none' : '';\n        this.updateLockedWidth();\n        if(col < llen){\n            ns = this.getLockedRows();\n            rw = this.getLockedWidth();\n            c = col;\n        }else{\n            ns = this.getRows();\n            rw = this.getTotalWidth();\n            c = col - llen;\n        }\n        var hd = this.getHeaderCell(col);\n        hd.style.display = display;\n        for(var i = 0, len = ns.length; i < len; i++){\n            row = ns[i];\n            row.style.width = rw;\n            if(row.firstChild){\n                row.firstChild.style.width = rw;\n                row.firstChild.rows[0].childNodes[c].style.display = display;\n            }\n        }\n        this.onColumnHiddenUpdated(col, hidden, this.getTotalWidth());\n        delete this.lastViewWidth;\n        this.layout();\n    },\n\n    doRender : function(cs, rs, ds, startRow, colCount, stripe){\n        var ts = this.templates, ct = ts.cell, rt = ts.row, last = colCount-1,\n            tstyle = 'width:'+this.getTotalWidth()+';',\n            lstyle = 'width:'+this.getLockedWidth()+';',\n            buf = [], lbuf = [], cb, lcb, c, p = {}, rp = {}, r;\n        for(var j = 0, len = rs.length; j < len; j++){\n            r = rs[j]; cb = []; lcb = [];\n            var rowIndex = (j+startRow);\n            for(var i = 0; i < colCount; i++){\n                c = cs[i];\n                p.id = c.id;\n                p.css = (i === 0 ? 'x-grid3-cell-first ' : (i == last ? 'x-grid3-cell-last ' : '')) +\n                    (this.cm.config[i].cellCls ? ' ' + this.cm.config[i].cellCls : '');\n                p.attr = p.cellAttr = '';\n                p.value = c.renderer(r.data[c.name], p, r, rowIndex, i, ds);\n                p.style = c.style;\n                if(Ext.isEmpty(p.value)){\n                    p.value = '&#160;';\n                }\n                if(this.markDirty && r.dirty && Ext.isDefined(r.modified[c.name])){\n                    p.css += ' x-grid3-dirty-cell';\n                }\n                if(c.locked){\n                    lcb[lcb.length] = ct.apply(p);\n                }else{\n                    cb[cb.length] = ct.apply(p);\n                }\n            }\n            var alt = [];\n            if(stripe && ((rowIndex+1) % 2 === 0)){\n                alt[0] = 'x-grid3-row-alt';\n            }\n            if(r.dirty){\n                alt[1] = ' x-grid3-dirty-row';\n            }\n            rp.cols = colCount;\n            if(this.getRowClass){\n                alt[2] = this.getRowClass(r, rowIndex, rp, ds);\n            }\n            rp.alt = alt.join(' ');\n            rp.cells = cb.join('');\n            rp.tstyle = tstyle;\n            buf[buf.length] = rt.apply(rp);\n            rp.cells = lcb.join('');\n            rp.tstyle = lstyle;\n            lbuf[lbuf.length] = rt.apply(rp);\n        }\n        return [buf.join(''), lbuf.join('')];\n    },\n    processRows : function(startRow, skipStripe){\n        if(!this.ds || this.ds.getCount() < 1){\n            return;\n        }\n        var rows = this.getRows(),\n            lrows = this.getLockedRows(),\n            row, lrow;\n        skipStripe = skipStripe || !this.grid.stripeRows;\n        startRow = startRow || 0;\n        for(var i = 0, len = rows.length; i < len; ++i){\n            row = rows[i];\n            lrow = lrows[i];\n            row.rowIndex = i;\n            lrow.rowIndex = i;\n            if(!skipStripe){\n                row.className = row.className.replace(this.rowClsRe, ' ');\n                lrow.className = lrow.className.replace(this.rowClsRe, ' ');\n                if ((i + 1) % 2 === 0){\n                    row.className += ' x-grid3-row-alt';\n                    lrow.className += ' x-grid3-row-alt';\n                }\n            }\n            this.syncRowHeights(row, lrow);\n        }\n        if(startRow === 0){\n            Ext.fly(rows[0]).addClass(this.firstRowCls);\n            Ext.fly(lrows[0]).addClass(this.firstRowCls);\n        }\n        Ext.fly(rows[rows.length - 1]).addClass(this.lastRowCls);\n        Ext.fly(lrows[lrows.length - 1]).addClass(this.lastRowCls);\n    },\n    \n    syncRowHeights: function(row1, row2){\n        if(this.syncHeights){\n            var el1 = Ext.get(row1),\n                el2 = Ext.get(row2),\n                h1 = el1.getHeight(),\n                h2 = el2.getHeight();\n\n            if(h1 > h2){\n                el2.setHeight(h1);\n            }else if(h2 > h1){\n                el1.setHeight(h2);\n            }\n        }\n    },\n\n    afterRender : function(){\n        if(!this.ds || !this.cm){\n            return;\n        }\n        var bd = this.renderRows() || ['&#160;', '&#160;'];\n        this.mainBody.dom.innerHTML = bd[0];\n        this.lockedBody.dom.innerHTML = bd[1];\n        this.processRows(0, true);\n        if(this.deferEmptyText !== true){\n            this.applyEmptyText();\n        }\n        this.grid.fireEvent('viewready', this.grid);\n    },\n\n    renderUI : function(){        \n        var templates = this.templates,\n            header = this.renderHeaders(),\n            body = templates.body.apply({rows:'&#160;'});\n\n        return templates.masterTpl.apply({\n            body  : body,\n            header: header[0],\n            ostyle: 'width:' + this.getOffsetWidth() + ';',\n            bstyle: 'width:' + this.getTotalWidth()  + ';',\n            lockedBody: body,\n            lockedHeader: header[1],\n            lstyle: 'width:'+this.getLockedWidth()+';'\n        });\n    },\n    \n    afterRenderUI: function(){\n        var g = this.grid;\n        this.initElements();\n        Ext.fly(this.innerHd).on('click', this.handleHdDown, this);\n        Ext.fly(this.lockedInnerHd).on('click', this.handleHdDown, this);\n        this.mainHd.on({\n            scope: this,\n            mouseover: this.handleHdOver,\n            mouseout: this.handleHdOut,\n            mousemove: this.handleHdMove\n        });\n        this.lockedHd.on({\n            scope: this,\n            mouseover: this.handleHdOver,\n            mouseout: this.handleHdOut,\n            mousemove: this.handleHdMove\n        });\n        this.scroller.on('scroll', this.syncScroll,  this);\n        if(g.enableColumnResize !== false){\n            this.splitZone = new Ext.grid.GridView.SplitDragZone(g, this.mainHd.dom);\n            this.splitZone.setOuterHandleElId(Ext.id(this.lockedHd.dom));\n            this.splitZone.setOuterHandleElId(Ext.id(this.mainHd.dom));\n        }\n        if(g.enableColumnMove){\n            this.columnDrag = new Ext.grid.GridView.ColumnDragZone(g, this.innerHd);\n            this.columnDrag.setOuterHandleElId(Ext.id(this.lockedInnerHd));\n            this.columnDrag.setOuterHandleElId(Ext.id(this.innerHd));\n            this.columnDrop = new Ext.grid.HeaderDropZone(g, this.mainHd.dom);\n        }\n        if(g.enableHdMenu !== false){\n            this.hmenu = new Ext.menu.Menu({id: g.id + '-hctx'});\n            this.hmenu.add(\n                {itemId: 'asc', text: this.sortAscText, cls: 'xg-hmenu-sort-asc'},\n                {itemId: 'desc', text: this.sortDescText, cls: 'xg-hmenu-sort-desc'}\n            );\n            if(this.grid.enableColLock !== false){\n                this.hmenu.add({\n                    itemId: 'sortSep',\n                    xtype: 'menuseparator'\n                },\n                    {itemId: 'lock', text: this.lockText, cls: 'xg-hmenu-lock'},\n                    {itemId: 'unlock', text: this.unlockText, cls: 'xg-hmenu-unlock'}\n                );\n            }\n            if(g.enableColumnHide !== false){\n                this.colMenu = new Ext.menu.Menu({id:g.id + '-hcols-menu'});\n                this.colMenu.on({\n                    scope: this,\n                    beforeshow: this.beforeColMenuShow,\n                    itemclick: this.handleHdMenuClick\n                });\n                this.hmenu.add('-', {\n                    itemId:'columns',\n                    hideOnClick: false,\n                    text: this.columnsText,\n                    menu: this.colMenu,\n                    iconCls: 'x-cols-icon'\n                });\n            }\n            this.hmenu.on('itemclick', this.handleHdMenuClick, this);\n        }\n        if(g.trackMouseOver){\n            this.mainBody.on({\n                scope: this,\n                mouseover: this.onRowOver,\n                mouseout: this.onRowOut\n            });\n            this.lockedBody.on({\n                scope: this,\n                mouseover: this.onRowOver,\n                mouseout: this.onRowOut\n            });\n        }\n\n        if(g.enableDragDrop || g.enableDrag){\n            this.dragZone = new Ext.grid.GridDragZone(g, {\n                ddGroup : g.ddGroup || 'GridDD'\n            });\n        }\n        this.updateHeaderSortState();    \n    },\n\n    layout : function(){\n        if(!this.mainBody){\n            return;\n        }\n        var g = this.grid;\n        var c = g.getGridEl();\n        var csize = c.getSize(true);\n        var vw = csize.width;\n        if(!g.hideHeaders && (vw < 20 || csize.height < 20)){\n            return;\n        }\n        this.syncHeaderHeight();\n        if(g.autoHeight){\n            this.scroller.dom.style.overflow = 'visible';\n            this.lockedScroller.dom.style.overflow = 'visible';\n            if(Ext.isWebKit){\n                this.scroller.dom.style.position = 'static';\n                this.lockedScroller.dom.style.position = 'static';\n            }\n        }else{\n            this.el.setSize(csize.width, csize.height);\n            var hdHeight = this.mainHd.getHeight();\n            var vh = csize.height - (hdHeight);\n        }\n        this.updateLockedWidth();\n        if(this.forceFit){\n            if(this.lastViewWidth != vw){\n                this.fitColumns(false, false);\n                this.lastViewWidth = vw;\n            }\n        }else {\n            this.autoExpand();\n            this.syncHeaderScroll();\n        }\n        this.onLayout(vw, vh);\n    },\n\n    getOffsetWidth : function() {\n        return (this.cm.getTotalWidth() - this.cm.getTotalLockedWidth() + this.getScrollOffset()) + 'px';\n    },\n\n    renderHeaders : function(){\n        var cm = this.cm,\n            ts = this.templates,\n            ct = ts.hcell,\n            cb = [], lcb = [],\n            p = {},\n            len = cm.getColumnCount(),\n            last = len - 1;\n        for(var i = 0; i < len; i++){\n            p.id = cm.getColumnId(i);\n            p.value = cm.getColumnHeader(i) || '';\n            p.style = this.getColumnStyle(i, true);\n            p.tooltip = this.getColumnTooltip(i);\n            p.css = (i === 0 ? 'x-grid3-cell-first ' : (i == last ? 'x-grid3-cell-last ' : '')) +\n                (cm.config[i].headerCls ? ' ' + cm.config[i].headerCls : '');\n            if(cm.config[i].align == 'right'){\n                p.istyle = 'padding-right:16px';\n            } else {\n                delete p.istyle;\n            }\n            if(cm.isLocked(i)){\n                lcb[lcb.length] = ct.apply(p);\n            }else{\n                cb[cb.length] = ct.apply(p);\n            }\n        }\n        return [ts.header.apply({cells: cb.join(''), tstyle:'width:'+this.getTotalWidth()+';'}),\n                ts.header.apply({cells: lcb.join(''), tstyle:'width:'+this.getLockedWidth()+';'})];\n    },\n\n    updateHeaders : function(){\n        var hd = this.renderHeaders();\n        this.innerHd.firstChild.innerHTML = hd[0];\n        this.innerHd.firstChild.style.width = this.getOffsetWidth();\n        this.innerHd.firstChild.firstChild.style.width = this.getTotalWidth();\n        this.lockedInnerHd.firstChild.innerHTML = hd[1];\n        var lw = this.getLockedWidth();\n        this.lockedInnerHd.firstChild.style.width = lw;\n        this.lockedInnerHd.firstChild.firstChild.style.width = lw;\n    },\n\n    getResolvedXY : function(resolved){\n        if(!resolved){\n            return null;\n        }\n        var c = resolved.cell, r = resolved.row;\n        return c ? Ext.fly(c).getXY() : [this.scroller.getX(), Ext.fly(r).getY()];\n    },\n\n    syncFocusEl : function(row, col, hscroll){\n        Ext.ux.grid.LockingGridView.superclass.syncFocusEl.call(this, row, col, col < this.cm.getLockedCount() ? false : hscroll);\n    },\n\n    ensureVisible : function(row, col, hscroll){\n        return Ext.ux.grid.LockingGridView.superclass.ensureVisible.call(this, row, col, col < this.cm.getLockedCount() ? false : hscroll);\n    },\n\n    insertRows : function(dm, firstRow, lastRow, isUpdate){\n        var last = dm.getCount() - 1;\n        if(!isUpdate && firstRow === 0 && lastRow >= last){\n            this.refresh();\n        }else{\n            if(!isUpdate){\n                this.fireEvent('beforerowsinserted', this, firstRow, lastRow);\n            }\n            var html = this.renderRows(firstRow, lastRow),\n                before = this.getRow(firstRow);\n            if(before){\n                if(firstRow === 0){\n                    this.removeRowClass(0, this.firstRowCls);\n                }\n                Ext.DomHelper.insertHtml('beforeBegin', before, html[0]);\n                before = this.getLockedRow(firstRow);\n                Ext.DomHelper.insertHtml('beforeBegin', before, html[1]);\n            }else{\n                this.removeRowClass(last - 1, this.lastRowCls);\n                Ext.DomHelper.insertHtml('beforeEnd', this.mainBody.dom, html[0]);\n                Ext.DomHelper.insertHtml('beforeEnd', this.lockedBody.dom, html[1]);\n            }\n            if(!isUpdate){\n                this.fireEvent('rowsinserted', this, firstRow, lastRow);\n                this.processRows(firstRow);\n            }else if(firstRow === 0 || firstRow >= last){\n                this.addRowClass(firstRow, firstRow === 0 ? this.firstRowCls : this.lastRowCls);\n            }\n        }\n        this.syncFocusEl(firstRow);\n    },\n\n    getColumnStyle : function(col, isHeader){\n        var style = !isHeader ? this.cm.config[col].cellStyle || this.cm.config[col].css || '' : this.cm.config[col].headerStyle || '';\n        style += 'width:'+this.getColumnWidth(col)+';';\n        if(this.cm.isHidden(col)){\n            style += 'display:none;';\n        }\n        var align = this.cm.config[col].align;\n        if(align){\n            style += 'text-align:'+align+';';\n        }\n        return style;\n    },\n\n    getLockedWidth : function() {\n        return this.cm.getTotalLockedWidth() + 'px';\n    },\n\n    getTotalWidth : function() {\n        return (this.cm.getTotalWidth() - this.cm.getTotalLockedWidth()) + 'px';\n    },\n\n    getColumnData : function(){\n        var cs = [], cm = this.cm, colCount = cm.getColumnCount();\n        for(var i = 0; i < colCount; i++){\n            var name = cm.getDataIndex(i);\n            cs[i] = {\n                name : (!Ext.isDefined(name) ? this.ds.fields.get(i).name : name),\n                renderer : cm.getRenderer(i),\n                scope : cm.getRendererScope(i),\n                id : cm.getColumnId(i),\n                style : this.getColumnStyle(i),\n                locked : cm.isLocked(i)\n            };\n        }\n        return cs;\n    },\n\n    renderBody : function(){\n        var markup = this.renderRows() || ['&#160;', '&#160;'];\n        return [this.templates.body.apply({rows: markup[0]}), this.templates.body.apply({rows: markup[1]})];\n    },\n    \n    refreshRow: function(record){\n        var store = this.ds, \n            colCount = this.cm.getColumnCount(), \n            columns = this.getColumnData(), \n            last = colCount - 1, \n            cls = ['x-grid3-row'], \n            rowParams = {\n                tstyle: String.format(\"width: {0};\", this.getTotalWidth())\n            }, \n            lockedRowParams = {\n                tstyle: String.format(\"width: {0};\", this.getLockedWidth())\n            }, \n            colBuffer = [], \n            lockedColBuffer = [], \n            cellTpl = this.templates.cell, \n            rowIndex, \n            row, \n            lockedRow, \n            column, \n            meta, \n            css, \n            i;\n        \n        if (Ext.isNumber(record)) {\n            rowIndex = record;\n            record = store.getAt(rowIndex);\n        } else {\n            rowIndex = store.indexOf(record);\n        }\n        \n        if (!record || rowIndex < 0) {\n            return;\n        }\n        \n        for (i = 0; i < colCount; i++) {\n            column = columns[i];\n            \n            if (i == 0) {\n                css = 'x-grid3-cell-first';\n            } else {\n                css = (i == last) ? 'x-grid3-cell-last ' : '';\n            }\n            \n            meta = {\n                id: column.id,\n                style: column.style,\n                css: css,\n                attr: \"\",\n                cellAttr: \"\"\n            };\n            \n            meta.value = column.renderer.call(column.scope, record.data[column.name], meta, record, rowIndex, i, store);\n            \n            if (Ext.isEmpty(meta.value)) {\n                meta.value = ' ';\n            }\n            \n            if (this.markDirty && record.dirty && typeof record.modified[column.name] != 'undefined') {\n                meta.css += ' x-grid3-dirty-cell';\n            }\n            \n            if (column.locked) {\n                lockedColBuffer[i] = cellTpl.apply(meta);\n            } else {\n                colBuffer[i] = cellTpl.apply(meta);\n            }\n        }\n        \n        row = this.getRow(rowIndex);\n        row.className = '';\n        lockedRow = this.getLockedRow(rowIndex);\n        lockedRow.className = '';\n        \n        if (this.grid.stripeRows && ((rowIndex + 1) % 2 === 0)) {\n            cls.push('x-grid3-row-alt');\n        }\n        \n        if (this.getRowClass) {\n            rowParams.cols = colCount;\n            cls.push(this.getRowClass(record, rowIndex, rowParams, store));\n        }\n        \n        // Unlocked rows\n        this.fly(row).addClass(cls).setStyle(rowParams.tstyle);\n        rowParams.cells = colBuffer.join(\"\");\n        row.innerHTML = this.templates.rowInner.apply(rowParams);\n        \n        // Locked rows\n        this.fly(lockedRow).addClass(cls).setStyle(lockedRowParams.tstyle);\n        lockedRowParams.cells = lockedColBuffer.join(\"\");\n        lockedRow.innerHTML = this.templates.rowInner.apply(lockedRowParams);\n        lockedRow.rowIndex = rowIndex;\n        this.syncRowHeights(row, lockedRow);  \n        this.fireEvent('rowupdated', this, rowIndex, record);\n    },\n\n    refresh : function(headersToo){\n        this.fireEvent('beforerefresh', this);\n        this.grid.stopEditing(true);\n        var result = this.renderBody();\n        this.mainBody.update(result[0]).setWidth(this.getTotalWidth());\n        this.lockedBody.update(result[1]).setWidth(this.getLockedWidth());\n        if(headersToo === true){\n            this.updateHeaders();\n            this.updateHeaderSortState();\n        }\n        this.processRows(0, true);\n        this.layout();\n        this.applyEmptyText();\n        this.fireEvent('refresh', this);\n    },\n\n    onDenyColumnLock : function(){\n\n    },\n\n    initData : function(ds, cm){\n        if(this.cm){\n            this.cm.un('columnlockchange', this.onColumnLock, this);\n        }\n        Ext.ux.grid.LockingGridView.superclass.initData.call(this, ds, cm);\n        if(this.cm){\n            this.cm.on('columnlockchange', this.onColumnLock, this);\n        }\n    },\n\n    onColumnLock : function(){\n        this.refresh(true);\n    },\n\n    handleHdMenuClick : function(item){\n        var index = this.hdCtxIndex,\n            cm = this.cm,\n            id = item.getItemId(),\n            llen = cm.getLockedCount();\n        switch(id){\n            case 'lock':\n                if(cm.getColumnCount(true) <= llen + 1){\n                    this.onDenyColumnLock();\n                    return undefined;\n                }\n                cm.setLocked(index, true, llen != index);\n                if(llen != index){\n                    cm.moveColumn(index, llen);\n                    this.grid.fireEvent('columnmove', index, llen);\n                }\n            break;\n            case 'unlock':\n                if(llen - 1 != index){\n                    cm.setLocked(index, false, true);\n                    cm.moveColumn(index, llen - 1);\n                    this.grid.fireEvent('columnmove', index, llen - 1);\n                }else{\n                    cm.setLocked(index, false);\n                }\n            break;\n            default:\n                return Ext.ux.grid.LockingGridView.superclass.handleHdMenuClick.call(this, item);\n        }\n        return true;\n    },\n\n    handleHdDown : function(e, t){\n        Ext.ux.grid.LockingGridView.superclass.handleHdDown.call(this, e, t);\n        if(this.grid.enableColLock !== false){\n            if(Ext.fly(t).hasClass('x-grid3-hd-btn')){\n                var hd = this.findHeaderCell(t),\n                    index = this.getCellIndex(hd),\n                    ms = this.hmenu.items, cm = this.cm;\n                ms.get('lock').setDisabled(cm.isLocked(index));\n                ms.get('unlock').setDisabled(!cm.isLocked(index));\n            }\n        }\n    },\n\n    syncHeaderHeight: function(){\n        var hrow = Ext.fly(this.innerHd).child('tr', true),\n            lhrow = Ext.fly(this.lockedInnerHd).child('tr', true);\n            \n        hrow.style.height = 'auto';\n        lhrow.style.height = 'auto';\n        var hd = hrow.offsetHeight,\n            lhd = lhrow.offsetHeight,\n            height = Math.max(lhd, hd) + 'px';\n            \n        hrow.style.height = height;\n        lhrow.style.height = height;\n\n    },\n\n    updateLockedWidth: function(){\n        var lw = this.cm.getTotalLockedWidth(),\n            tw = this.cm.getTotalWidth() - lw,\n            csize = this.grid.getGridEl().getSize(true),\n            lp = Ext.isBorderBox ? 0 : this.lockedBorderWidth,\n            rp = Ext.isBorderBox ? 0 : this.rowBorderWidth,\n            vw = Math.max(csize.width - lw - lp - rp, 0) + 'px',\n            so = this.getScrollOffset();\n        if(!this.grid.autoHeight){\n            var vh = Math.max(csize.height - this.mainHd.getHeight(), 0) + 'px';\n            this.lockedScroller.dom.style.height = vh;\n            this.scroller.dom.style.height = vh;\n        }\n        this.lockedWrap.dom.style.width = (lw + rp) + 'px';\n        this.scroller.dom.style.width = vw;\n        this.mainWrap.dom.style.left = (lw + lp + rp) + 'px';\n        if(this.innerHd){\n            this.lockedInnerHd.firstChild.style.width = lw + 'px';\n            this.lockedInnerHd.firstChild.firstChild.style.width = lw + 'px';\n            this.innerHd.style.width = vw;\n            this.innerHd.firstChild.style.width = (tw + rp + so) + 'px';\n            this.innerHd.firstChild.firstChild.style.width = tw + 'px';\n        }\n        if(this.mainBody){\n            this.lockedBody.dom.style.width = (lw + rp) + 'px';\n            this.mainBody.dom.style.width = (tw + rp) + 'px';\n        }\n    }\n});\n\nExt.ux.grid.LockingColumnModel = Ext.extend(Ext.grid.ColumnModel, {\n    /**\n     * Returns true if the given column index is currently locked\n     * @param {Number} colIndex The column index\n     * @return {Boolean} True if the column is locked\n     */\n    isLocked : function(colIndex){\n        return this.config[colIndex].locked === true;\n    },\n\n    /**\n     * Locks or unlocks a given column\n     * @param {Number} colIndex The column index\n     * @param {Boolean} value True to lock, false to unlock\n     * @param {Boolean} suppressEvent Pass false to cause the columnlockchange event not to fire\n     */\n    setLocked : function(colIndex, value, suppressEvent){\n        if (this.isLocked(colIndex) == value) {\n            return;\n        }\n        this.config[colIndex].locked = value;\n        if (!suppressEvent) {\n            this.fireEvent('columnlockchange', this, colIndex, value);\n        }\n    },\n\n    /**\n     * Returns the total width of all locked columns\n     * @return {Number} The width of all locked columns\n     */\n    getTotalLockedWidth : function(){\n        var totalWidth = 0;\n        for (var i = 0, len = this.config.length; i < len; i++) {\n            if (this.isLocked(i) && !this.isHidden(i)) {\n                totalWidth += this.getColumnWidth(i);\n            }\n        }\n\n        return totalWidth;\n    },\n\n    /**\n     * Returns the total number of locked columns\n     * @return {Number} The number of locked columns\n     */\n    getLockedCount : function() {\n        var len = this.config.length;\n\n        for (var i = 0; i < len; i++) {\n            if (!this.isLocked(i)) {\n                return i;\n            }\n        }\n\n        //if we get to this point all of the columns are locked so we return the total\n        return len;\n    },\n\n    /**\n     * Moves a column from one position to another\n     * @param {Number} oldIndex The current column index\n     * @param {Number} newIndex The destination column index\n     */\n    moveColumn : function(oldIndex, newIndex){\n        var oldLocked = this.isLocked(oldIndex),\n            newLocked = this.isLocked(newIndex);\n\n        if (oldIndex < newIndex && oldLocked && !newLocked) {\n            this.setLocked(oldIndex, false, true);\n        } else if (oldIndex > newIndex && !oldLocked && newLocked) {\n            this.setLocked(oldIndex, true, true);\n        }\n\n        Ext.ux.grid.LockingColumnModel.superclass.moveColumn.apply(this, arguments);\n    }\n});\n"
  },
  {
    "path": "client/src/ext/ux/MultiSelect.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.form');\n\n/**\n * @class Ext.ux.form.MultiSelect\n * @extends Ext.form.Field\n * A control that allows selection and form submission of multiple list items.\n *\n *  @history\n *    2008-06-19 bpm Original code contributed by Toby Stuart (with contributions from Robert Williams)\n *    2008-06-19 bpm Docs and demo code clean up\n *\n * @constructor\n * Create a new MultiSelect\n * @param {Object} config Configuration options\n * @xtype multiselect\n */\nExt.ux.form.MultiSelect = Ext.extend(Ext.form.Field,  {\n    /**\n     * @cfg {String} legend Wraps the object with a fieldset and specified legend.\n     */\n    /**\n     * @cfg {Ext.ListView} view The {@link Ext.ListView} used to render the multiselect list.\n     */\n    /**\n     * @cfg {String/Array} dragGroup The ddgroup name(s) for the MultiSelect DragZone (defaults to undefined).\n     */\n    /**\n     * @cfg {String/Array} dropGroup The ddgroup name(s) for the MultiSelect DropZone (defaults to undefined).\n     */\n    /**\n     * @cfg {Boolean} ddReorder Whether the items in the MultiSelect list are drag/drop reorderable (defaults to false).\n     */\n    ddReorder:false,\n    /**\n     * @cfg {Object/Array} tbar The top toolbar of the control. This can be a {@link Ext.Toolbar} object, a\n     * toolbar config, or an array of buttons/button configs to be added to the toolbar.\n     */\n    /**\n     * @cfg {String} appendOnly True if the list should only allow append drops when drag/drop is enabled\n     * (use for lists which are sorted, defaults to false).\n     */\n    appendOnly:false,\n    /**\n     * @cfg {Number} width Width in pixels of the control (defaults to 100).\n     */\n    width:100,\n    /**\n     * @cfg {Number} height Height in pixels of the control (defaults to 100).\n     */\n    height:100,\n    /**\n     * @cfg {String/Number} displayField Name/Index of the desired display field in the dataset (defaults to 0).\n     */\n    displayField:0,\n    /**\n     * @cfg {String/Number} valueField Name/Index of the desired value field in the dataset (defaults to 1).\n     */\n    valueField:1,\n    /**\n     * @cfg {Boolean} allowBlank False to require at least one item in the list to be selected, true to allow no\n     * selection (defaults to true).\n     */\n    allowBlank:true,\n    /**\n     * @cfg {Number} minSelections Minimum number of selections allowed (defaults to 0).\n     */\n    minSelections:0,\n    /**\n     * @cfg {Number} maxSelections Maximum number of selections allowed (defaults to Number.MAX_VALUE).\n     */\n    maxSelections:Number.MAX_VALUE,\n    /**\n     * @cfg {String} blankText Default text displayed when the control contains no items (defaults to the same value as\n     * {@link Ext.form.TextField#blankText}.\n     */\n    blankText:Ext.form.TextField.prototype.blankText,\n    /**\n     * @cfg {String} minSelectionsText Validation message displayed when {@link #minSelections} is not met (defaults to 'Minimum {0}\n     * item(s) required').  The {0} token will be replaced by the value of {@link #minSelections}.\n     */\n    minSelectionsText:'Minimum {0} item(s) required',\n    /**\n     * @cfg {String} maxSelectionsText Validation message displayed when {@link #maxSelections} is not met (defaults to 'Maximum {0}\n     * item(s) allowed').  The {0} token will be replaced by the value of {@link #maxSelections}.\n     */\n    maxSelectionsText:'Maximum {0} item(s) allowed',\n    /**\n     * @cfg {String} delimiter The string used to delimit between items when set or returned as a string of values\n     * (defaults to ',').\n     */\n    delimiter:',',\n    /**\n     * @cfg {Ext.data.Store/Array} store The data source to which this MultiSelect is bound (defaults to <tt>undefined</tt>).\n     * Acceptable values for this property are:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>any {@link Ext.data.Store Store} subclass</b></li>\n     * <li><b>an Array</b> : Arrays will be converted to a {@link Ext.data.ArrayStore} internally.\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>1-dimensional array</b> : (e.g., <tt>['Foo','Bar']</tt>)<div class=\"sub-desc\">\n     * A 1-dimensional array will automatically be expanded (each array item will be the combo\n     * {@link #valueField value} and {@link #displayField text})</div></li>\n     * <li><b>2-dimensional array</b> : (e.g., <tt>[['f','Foo'],['b','Bar']]</tt>)<div class=\"sub-desc\">\n     * For a multi-dimensional array, the value in index 0 of each item will be assumed to be the combo\n     * {@link #valueField value}, while the value at index 1 is assumed to be the combo {@link #displayField text}.\n     * </div></li></ul></div></li></ul></div>\n     */\n    \n    cls: 'ux-form-multiselect',\n\n    // private\n    defaultAutoCreate : {tag: \"div\"},\n\n    // private\n    initComponent: function(){\n        Ext.ux.form.MultiSelect.superclass.initComponent.call(this);\n\n        if(Ext.isArray(this.store)){\n            if (Ext.isArray(this.store[0])){\n                this.store = new Ext.data.ArrayStore({\n                    fields: ['value','text'],\n                    data: this.store\n                });\n                this.valueField = 'value';\n            }else{\n                this.store = new Ext.data.ArrayStore({\n                    fields: ['text'],\n                    data: this.store,\n                    expandData: true\n                });\n                this.valueField = 'text';\n            }\n            this.displayField = 'text';\n        } else {\n            this.store = Ext.StoreMgr.lookup(this.store);\n        }\n\n        this.addEvents({\n            'dblclick' : true,\n            'click' : true,\n            'change' : true,\n            'drop' : true\n        });\n    },\n\n    // private\n    onRender: function(ct, position){\n        Ext.ux.form.MultiSelect.superclass.onRender.call(this, ct, position);\n\n        var fs = this.fs = new Ext.form.FieldSet({\n            renderTo: this.el,\n            title: this.legend,\n            height: this.height,\n            width: this.width,\n            style: \"padding:0;\",\n            tbar: this.tbar\n        });\n        fs.body.addClass('ux-mselect');\n\n        this.view = new Ext.ListView({\n            selectedClass: 'ux-mselect-selected',\n            multiSelect: true,\n            store: this.store,\n            columns: [{ header: 'Value', width: 1, dataIndex: this.displayField }],\n            hideHeaders: true\n        });\n\n        fs.add(this.view);\n\n        this.view.on('click', this.onViewClick, this);\n        this.view.on('beforeclick', this.onViewBeforeClick, this);\n        this.view.on('dblclick', this.onViewDblClick, this);\n\n        this.hiddenName = this.name || Ext.id();\n        var hiddenTag = { tag: \"input\", type: \"hidden\", value: \"\", name: this.hiddenName };\n        this.hiddenField = this.el.createChild(hiddenTag);\n        this.hiddenField.dom.disabled = this.hiddenName != this.name;\n        fs.doLayout();\n    },\n\n    // private\n    afterRender: function(){\n        Ext.ux.form.MultiSelect.superclass.afterRender.call(this);\n\n        if (this.ddReorder && !this.dragGroup && !this.dropGroup){\n            this.dragGroup = this.dropGroup = 'MultiselectDD-' + Ext.id();\n        }\n\n        if (this.draggable || this.dragGroup){\n            this.dragZone = new Ext.ux.form.MultiSelect.DragZone(this, {\n                ddGroup: this.dragGroup\n            });\n        }\n        if (this.droppable || this.dropGroup){\n            this.dropZone = new Ext.ux.form.MultiSelect.DropZone(this, {\n                ddGroup: this.dropGroup\n            });\n        }\n    },\n\n    // private\n    onViewClick: function(vw, index, node, e) {\n        this.fireEvent('change', this, this.getValue(), this.hiddenField.dom.value);\n        this.hiddenField.dom.value = this.getValue();\n        this.fireEvent('click', this, e);\n        this.validate();\n    },\n\n    // private\n    onViewBeforeClick: function(vw, index, node, e) {\n        if (this.disabled || this.readOnly) {\n            return false;\n        }\n    },\n\n    // private\n    onViewDblClick : function(vw, index, node, e) {\n        return this.fireEvent('dblclick', vw, index, node, e);\n    },\n\n    /**\n     * Returns an array of data values for the selected items in the list. The values will be separated\n     * by {@link #delimiter}.\n     * @return {Array} value An array of string data values\n     */\n    getValue: function(valueField){\n        var returnArray = [];\n        var selectionsArray = this.view.getSelectedIndexes();\n        if (selectionsArray.length == 0) {return '';}\n        for (var i=0; i<selectionsArray.length; i++) {\n            returnArray.push(this.store.getAt(selectionsArray[i]).get((valueField != null) ? valueField : this.valueField));\n        }\n        return returnArray.join(this.delimiter);\n    },\n\n    /**\n     * Sets a delimited string (using {@link #delimiter}) or array of data values into the list.\n     * @param {String/Array} values The values to set\n     */\n    setValue: function(values) {\n        var index;\n        var selections = [];\n        this.view.clearSelections();\n        this.hiddenField.dom.value = '';\n\n        if (!values || (values == '')) { return; }\n\n        if (!Ext.isArray(values)) { values = values.split(this.delimiter); }\n        for (var i=0; i<values.length; i++) {\n            index = this.view.store.indexOf(this.view.store.query(this.valueField,\n                new RegExp('^' + values[i] + '$', \"i\")).itemAt(0));\n            selections.push(index);\n        }\n        this.view.select(selections);\n        this.hiddenField.dom.value = this.getValue();\n        this.validate();\n    },\n\n    // inherit docs\n    reset : function() {\n        this.setValue('');\n    },\n\n    // inherit docs\n    getRawValue: function(valueField) {\n        var tmp = this.getValue(valueField);\n        if (tmp.length) {\n            tmp = tmp.split(this.delimiter);\n        }\n        else {\n            tmp = [];\n        }\n        return tmp;\n    },\n\n    // inherit docs\n    setRawValue: function(values){\n        setValue(values);\n    },\n\n    // inherit docs\n    validateValue : function(value){\n        if (value.length < 1) { // if it has no value\n             if (this.allowBlank) {\n                 this.clearInvalid();\n                 return true;\n             } else {\n                 this.markInvalid(this.blankText);\n                 return false;\n             }\n        }\n        if (value.length < this.minSelections) {\n            this.markInvalid(String.format(this.minSelectionsText, this.minSelections));\n            return false;\n        }\n        if (value.length > this.maxSelections) {\n            this.markInvalid(String.format(this.maxSelectionsText, this.maxSelections));\n            return false;\n        }\n        return true;\n    },\n\n    // inherit docs\n    disable: function(){\n        this.disabled = true;\n        this.hiddenField.dom.disabled = true;\n        this.fs.disable();\n    },\n\n    // inherit docs\n    enable: function(){\n        this.disabled = false;\n        this.hiddenField.dom.disabled = false;\n        this.fs.enable();\n    },\n\n    // inherit docs\n    destroy: function(){\n        Ext.destroy(this.fs, this.dragZone, this.dropZone);\n        Ext.ux.form.MultiSelect.superclass.destroy.call(this);\n    }\n});\n\n\nExt.reg('multiselect', Ext.ux.form.MultiSelect);\n\n//backwards compat\nExt.ux.Multiselect = Ext.ux.form.MultiSelect;\n\n\nExt.ux.form.MultiSelect.DragZone = function(ms, config){\n    this.ms = ms;\n    this.view = ms.view;\n    var ddGroup = config.ddGroup || 'MultiselectDD';\n    var dd;\n    if (Ext.isArray(ddGroup)){\n        dd = ddGroup.shift();\n    } else {\n        dd = ddGroup;\n        ddGroup = null;\n    }\n    Ext.ux.form.MultiSelect.DragZone.superclass.constructor.call(this, this.ms.fs.body, { containerScroll: true, ddGroup: dd });\n    this.setDraggable(ddGroup);\n};\n\nExt.extend(Ext.ux.form.MultiSelect.DragZone, Ext.dd.DragZone, {\n    onInitDrag : function(x, y){\n        var el = Ext.get(this.dragData.ddel.cloneNode(true));\n        this.proxy.update(el.dom);\n        el.setWidth(el.child('em').getWidth());\n        this.onStartDrag(x, y);\n        return true;\n    },\n\n    // private\n    collectSelection: function(data) {\n        data.repairXY = Ext.fly(this.view.getSelectedNodes()[0]).getXY();\n        var i = 0;\n        this.view.store.each(function(rec){\n            if (this.view.isSelected(i)) {\n                var n = this.view.getNode(i);\n                var dragNode = n.cloneNode(true);\n                dragNode.id = Ext.id();\n                data.ddel.appendChild(dragNode);\n                data.records.push(this.view.store.getAt(i));\n                data.viewNodes.push(n);\n            }\n            i++;\n        }, this);\n    },\n\n    // override\n    onEndDrag: function(data, e) {\n        var d = Ext.get(this.dragData.ddel);\n        if (d && d.hasClass(\"multi-proxy\")) {\n            d.remove();\n        }\n    },\n\n    // override\n    getDragData: function(e){\n        var target = this.view.findItemFromChild(e.getTarget());\n        if(target) {\n            if (!this.view.isSelected(target) && !e.ctrlKey && !e.shiftKey) {\n                this.view.select(target);\n                this.ms.setValue(this.ms.getValue());\n            }\n            if (this.view.getSelectionCount() == 0 || e.ctrlKey || e.shiftKey) return false;\n            var dragData = {\n                sourceView: this.view,\n                viewNodes: [],\n                records: []\n            };\n            if (this.view.getSelectionCount() == 1) {\n                var i = this.view.getSelectedIndexes()[0];\n                var n = this.view.getNode(i);\n                dragData.viewNodes.push(dragData.ddel = n);\n                dragData.records.push(this.view.store.getAt(i));\n                dragData.repairXY = Ext.fly(n).getXY();\n            } else {\n                dragData.ddel = document.createElement('div');\n                dragData.ddel.className = 'multi-proxy';\n                this.collectSelection(dragData);\n            }\n            return dragData;\n        }\n        return false;\n    },\n\n    // override the default repairXY.\n    getRepairXY : function(e){\n        return this.dragData.repairXY;\n    },\n\n    // private\n    setDraggable: function(ddGroup){\n        if (!ddGroup) return;\n        if (Ext.isArray(ddGroup)) {\n            Ext.each(ddGroup, this.setDraggable, this);\n            return;\n        }\n        this.addToGroup(ddGroup);\n    }\n});\n\nExt.ux.form.MultiSelect.DropZone = function(ms, config){\n    this.ms = ms;\n    this.view = ms.view;\n    var ddGroup = config.ddGroup || 'MultiselectDD';\n    var dd;\n    if (Ext.isArray(ddGroup)){\n        dd = ddGroup.shift();\n    } else {\n        dd = ddGroup;\n        ddGroup = null;\n    }\n    Ext.ux.form.MultiSelect.DropZone.superclass.constructor.call(this, this.ms.fs.body, { containerScroll: true, ddGroup: dd });\n    this.setDroppable(ddGroup);\n};\n\nExt.extend(Ext.ux.form.MultiSelect.DropZone, Ext.dd.DropZone, {\n    /**\n     * Part of the Ext.dd.DropZone interface. If no target node is found, the\n     * whole Element becomes the target, and this causes the drop gesture to append.\n     */\n    getTargetFromEvent : function(e) {\n        var target = e.getTarget();\n        return target;\n    },\n\n    // private\n    getDropPoint : function(e, n, dd){\n        if (n == this.ms.fs.body.dom) { return \"below\"; }\n        var t = Ext.lib.Dom.getY(n), b = t + n.offsetHeight;\n        var c = t + (b - t) / 2;\n        var y = Ext.lib.Event.getPageY(e);\n        if(y <= c) {\n            return \"above\";\n        }else{\n            return \"below\";\n        }\n    },\n\n    // private\n    isValidDropPoint: function(pt, n, data) {\n        if (!data.viewNodes || (data.viewNodes.length != 1)) {\n            return true;\n        }\n        var d = data.viewNodes[0];\n        if (d == n) {\n            return false;\n        }\n        if ((pt == \"below\") && (n.nextSibling == d)) {\n            return false;\n        }\n        if ((pt == \"above\") && (n.previousSibling == d)) {\n            return false;\n        }\n        return true;\n    },\n\n    // override\n    onNodeEnter : function(n, dd, e, data){\n        return false;\n    },\n\n    // override\n    onNodeOver : function(n, dd, e, data){\n        var dragElClass = this.dropNotAllowed;\n        var pt = this.getDropPoint(e, n, dd);\n        if (this.isValidDropPoint(pt, n, data)) {\n            if (this.ms.appendOnly) {\n                return \"x-tree-drop-ok-below\";\n            }\n\n            // set the insert point style on the target node\n            if (pt) {\n                var targetElClass;\n                if (pt == \"above\"){\n                    dragElClass = n.previousSibling ? \"x-tree-drop-ok-between\" : \"x-tree-drop-ok-above\";\n                    targetElClass = \"x-view-drag-insert-above\";\n                } else {\n                    dragElClass = n.nextSibling ? \"x-tree-drop-ok-between\" : \"x-tree-drop-ok-below\";\n                    targetElClass = \"x-view-drag-insert-below\";\n                }\n                if (this.lastInsertClass != targetElClass){\n                    Ext.fly(n).replaceClass(this.lastInsertClass, targetElClass);\n                    this.lastInsertClass = targetElClass;\n                }\n            }\n        }\n        return dragElClass;\n    },\n\n    // private\n    onNodeOut : function(n, dd, e, data){\n        this.removeDropIndicators(n);\n    },\n\n    // private\n    onNodeDrop : function(n, dd, e, data){\n        if (this.ms.fireEvent(\"drop\", this, n, dd, e, data) === false) {\n            return false;\n        }\n        var pt = this.getDropPoint(e, n, dd);\n        if (n != this.ms.fs.body.dom)\n            n = this.view.findItemFromChild(n);\n\n        if(this.ms.appendOnly) {\n            insertAt = this.view.store.getCount();\n        } else {\n            insertAt = n == this.ms.fs.body.dom ? this.view.store.getCount() - 1 : this.view.indexOf(n);\n            if (pt == \"below\") {\n                insertAt++;\n            }\n        }\n\n        var dir = false;\n\n        // Validate if dragging within the same MultiSelect\n        if (data.sourceView == this.view) {\n            // If the first element to be inserted below is the target node, remove it\n            if (pt == \"below\") {\n                if (data.viewNodes[0] == n) {\n                    data.viewNodes.shift();\n                }\n            } else {  // If the last element to be inserted above is the target node, remove it\n                if (data.viewNodes[data.viewNodes.length - 1] == n) {\n                    data.viewNodes.pop();\n                }\n            }\n\n            // Nothing to drop...\n            if (!data.viewNodes.length) {\n                return false;\n            }\n\n            // If we are moving DOWN, then because a store.remove() takes place first,\n            // the insertAt must be decremented.\n            if (insertAt > this.view.store.indexOf(data.records[0])) {\n                dir = 'down';\n                insertAt--;\n            }\n        }\n\n        for (var i = 0; i < data.records.length; i++) {\n            var r = data.records[i];\n            if (data.sourceView) {\n                data.sourceView.store.remove(r);\n            }\n            this.view.store.insert(dir == 'down' ? insertAt : insertAt++, r);\n            var si = this.view.store.sortInfo;\n            if(si){\n                this.view.store.sort(si.field, si.direction);\n            }\n        }\n        return true;\n    },\n\n    // private\n    removeDropIndicators : function(n){\n        if(n){\n            Ext.fly(n).removeClass([\n                \"x-view-drag-insert-above\",\n                \"x-view-drag-insert-left\",\n                \"x-view-drag-insert-right\",\n                \"x-view-drag-insert-below\"]);\n            this.lastInsertClass = \"_noclass\";\n        }\n    },\n\n    // private\n    setDroppable: function(ddGroup){\n        if (!ddGroup) return;\n        if (Ext.isArray(ddGroup)) {\n            Ext.each(ddGroup, this.setDroppable, this);\n            return;\n        }\n        this.addToGroup(ddGroup);\n    }\n});\n"
  },
  {
    "path": "client/src/ext/ux/PagingMemoryProxy.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n\n/* Fix for Opera, which does not seem to include the map function on Array's */\nif (!Array.prototype.map) {\n    Array.prototype.map = function(fun){\n        var len = this.length;\n        if (typeof fun != 'function') {\n            throw new TypeError();\n        }\n        var res = new Array(len);\n        var thisp = arguments[1];\n        for (var i = 0; i < len; i++) {\n            if (i in this) {\n                res[i] = fun.call(thisp, this[i], i, this);\n            }\n        }\n        return res;\n    };\n}\n\nExt.ns('Ext.ux.data');\n\n/**\n * @class Ext.ux.data.PagingMemoryProxy\n * @extends Ext.data.MemoryProxy\n * <p>Paging Memory Proxy, allows to use paging grid with in memory dataset</p>\n */\nExt.ux.data.PagingMemoryProxy = Ext.extend(Ext.data.MemoryProxy, {\n    constructor : function(data){\n        Ext.ux.data.PagingMemoryProxy.superclass.constructor.call(this);\n        this.data = data;\n    },\n    doRequest : function(action, rs, params, reader, callback, scope, options){\n        params = params ||\n        {};\n        var result;\n        try {\n            result = reader.readRecords(this.data);\n        } \n        catch (e) {\n            this.fireEvent('loadexception', this, options, null, e);\n            callback.call(scope, null, options, false);\n            return;\n        }\n        \n        // filtering\n        if (params.filter !== undefined) {\n            result.records = result.records.filter(function(el){\n                if (typeof(el) == 'object') {\n                    var att = params.filterCol || 0;\n                    return String(el.data[att]).match(params.filter) ? true : false;\n                }\n                else {\n                    return String(el).match(params.filter) ? true : false;\n                }\n            });\n            result.totalRecords = result.records.length;\n        }\n        \n        // sorting\n        if (params.sort !== undefined) {\n            // use integer as params.sort to specify column, since arrays are not named\n            // params.sort=0; would also match a array without columns\n            var dir = String(params.dir).toUpperCase() == 'DESC' ? -1 : 1;\n            var fn = function(v1, v2){\n                return v1 > v2 ? 1 : (v1 < v2 ? -1 : 0);\n            };\n            result.records.sort(function(a, b){\n                var v = 0;\n                if (typeof(a) == 'object') {\n                    v = fn(a.data[params.sort], b.data[params.sort]) * dir;\n                }\n                else {\n                    v = fn(a, b) * dir;\n                }\n                if (v == 0) {\n                    v = (a.index < b.index ? -1 : 1);\n                }\n                return v;\n            });\n        }\n        // paging (use undefined cause start can also be 0 (thus false))\n        if (params.start !== undefined && params.limit !== undefined) {\n            result.records = result.records.slice(params.start, params.start + params.limit);\n        }\n        callback.call(scope, result, options, true);\n    }\n});\n\n//backwards compat.\nExt.data.PagingMemoryProxy = Ext.ux.data.PagingMemoryProxy;\n"
  },
  {
    "path": "client/src/ext/ux/PanelResizer.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ux.PanelResizer = Ext.extend(Ext.util.Observable, {\n    minHeight: 0,\n    maxHeight:10000000,\n\n    constructor: function(config){\n        Ext.apply(this, config);\n        this.events = {};\n        Ext.ux.PanelResizer.superclass.constructor.call(this, config);\n    },\n\n    init : function(p){\n        this.panel = p;\n\n        if(this.panel.elements.indexOf('footer')==-1){\n            p.elements += ',footer';\n        }\n        p.on('render', this.onRender, this);\n    },\n\n    onRender : function(p){\n        this.handle = p.footer.createChild({cls:'x-panel-resize'});\n\n        this.tracker = new Ext.dd.DragTracker({\n            onStart: this.onDragStart.createDelegate(this),\n            onDrag: this.onDrag.createDelegate(this),\n            onEnd: this.onDragEnd.createDelegate(this),\n            tolerance: 3,\n            autoStart: 300\n        });\n        this.tracker.initEl(this.handle);\n        p.on('beforedestroy', this.tracker.destroy, this.tracker);\n    },\n\n\t// private\n    onDragStart: function(e){\n        this.dragging = true;\n        this.startHeight = this.panel.el.getHeight();\n        this.fireEvent('dragstart', this, e);\n    },\n\n\t// private\n    onDrag: function(e){\n        this.panel.setHeight((this.startHeight-this.tracker.getOffset()[1]).constrain(this.minHeight, this.maxHeight));\n        this.fireEvent('drag', this, e);\n    },\n\n\t// private\n    onDragEnd: function(e){\n        this.dragging = false;\n        this.fireEvent('dragend', this, e);\n    }\n});\nExt.preg('panelresizer', Ext.ux.PanelResizer);"
  },
  {
    "path": "client/src/ext/ux/Portal.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ux.Portal = Ext.extend(Ext.Panel, {\n    layout : 'column',\n    autoScroll : true,\n    cls : 'x-portal',\n    defaultType : 'portalcolumn',\n    \n    initComponent : function(){\n        Ext.ux.Portal.superclass.initComponent.call(this);\n        this.addEvents({\n            validatedrop:true,\n            beforedragover:true,\n            dragover:true,\n            beforedrop:true,\n            drop:true\n        });\n    },\n\n    initEvents : function(){\n        Ext.ux.Portal.superclass.initEvents.call(this);\n        this.dd = new Ext.ux.Portal.DropZone(this, this.dropConfig);\n    },\n    \n    beforeDestroy : function() {\n        if(this.dd){\n            this.dd.unreg();\n        }\n        Ext.ux.Portal.superclass.beforeDestroy.call(this);\n    }\n});\n\nExt.reg('portal', Ext.ux.Portal);\n\nExt.ux.Portal.DropZone = Ext.extend(Ext.dd.DropTarget, {\n    \n    constructor : function(portal, cfg){\n        this.portal = portal;\n        Ext.dd.ScrollManager.register(portal.body);\n        Ext.ux.Portal.DropZone.superclass.constructor.call(this, portal.bwrap.dom, cfg);\n        portal.body.ddScrollConfig = this.ddScrollConfig;\n    },\n    \n    ddScrollConfig : {\n        vthresh: 50,\n        hthresh: -1,\n        animate: true,\n        increment: 200\n    },\n\n    createEvent : function(dd, e, data, col, c, pos){\n        return {\n            portal: this.portal,\n            panel: data.panel,\n            columnIndex: col,\n            column: c,\n            position: pos,\n            data: data,\n            source: dd,\n            rawEvent: e,\n            status: this.dropAllowed\n        };\n    },\n\n    notifyOver : function(dd, e, data){\n        var xy = e.getXY(), portal = this.portal, px = dd.proxy;\n\n        // case column widths\n        if(!this.grid){\n            this.grid = this.getGrid();\n        }\n\n        // handle case scroll where scrollbars appear during drag\n        var cw = portal.body.dom.clientWidth;\n        if(!this.lastCW){\n            this.lastCW = cw;\n        }else if(this.lastCW != cw){\n            this.lastCW = cw;\n            portal.doLayout();\n            this.grid = this.getGrid();\n        }\n\n        // determine column\n        var col = 0, xs = this.grid.columnX, cmatch = false;\n        for(var len = xs.length; col < len; col++){\n            if(xy[0] < (xs[col].x + xs[col].w)){\n                cmatch = true;\n                break;\n            }\n        }\n        // no match, fix last index\n        if(!cmatch){\n            col--;\n        }\n\n        // find insert position\n        var p, match = false, pos = 0,\n            c = portal.items.itemAt(col),\n            items = c.items.items, overSelf = false;\n\n        for(var len = items.length; pos < len; pos++){\n            p = items[pos];\n            var h = p.el.getHeight();\n            if(h === 0){\n                overSelf = true;\n            }\n            else if((p.el.getY()+(h/2)) > xy[1]){\n                match = true;\n                break;\n            }\n        }\n\n        pos = (match && p ? pos : c.items.getCount()) + (overSelf ? -1 : 0);\n        var overEvent = this.createEvent(dd, e, data, col, c, pos);\n\n        if(portal.fireEvent('validatedrop', overEvent) !== false &&\n           portal.fireEvent('beforedragover', overEvent) !== false){\n\n            // make sure proxy width is fluid\n            px.getProxy().setWidth('auto');\n\n            if(p){\n                px.moveProxy(p.el.dom.parentNode, match ? p.el.dom : null);\n            }else{\n                px.moveProxy(c.el.dom, null);\n            }\n\n            this.lastPos = {c: c, col: col, p: overSelf || (match && p) ? pos : false};\n            this.scrollPos = portal.body.getScroll();\n\n            portal.fireEvent('dragover', overEvent);\n\n            return overEvent.status;\n        }else{\n            return overEvent.status;\n        }\n\n    },\n\n    notifyOut : function(){\n        delete this.grid;\n    },\n\n    notifyDrop : function(dd, e, data){\n        delete this.grid;\n        if(!this.lastPos){\n            return;\n        }\n        var c = this.lastPos.c, \n            col = this.lastPos.col, \n            pos = this.lastPos.p,\n            panel = dd.panel,\n            dropEvent = this.createEvent(dd, e, data, col, c,\n                pos !== false ? pos : c.items.getCount());\n\n        if(this.portal.fireEvent('validatedrop', dropEvent) !== false &&\n           this.portal.fireEvent('beforedrop', dropEvent) !== false){\n\n            dd.proxy.getProxy().remove();\n            panel.el.dom.parentNode.removeChild(dd.panel.el.dom);\n            \n            if(pos !== false){\n                c.insert(pos, panel);\n            }else{\n                c.add(panel);\n            }\n            \n            c.doLayout();\n\n            this.portal.fireEvent('drop', dropEvent);\n\n            // scroll position is lost on drop, fix it\n            var st = this.scrollPos.top;\n            if(st){\n                var d = this.portal.body.dom;\n                setTimeout(function(){\n                    d.scrollTop = st;\n                }, 10);\n            }\n\n        }\n        delete this.lastPos;\n    },\n\n    // internal cache of body and column coords\n    getGrid : function(){\n        var box = this.portal.bwrap.getBox();\n        box.columnX = [];\n        this.portal.items.each(function(c){\n             box.columnX.push({x: c.el.getX(), w: c.el.getWidth()});\n        });\n        return box;\n    },\n\n    // unregister the dropzone from ScrollManager\n    unreg: function() {\n        Ext.dd.ScrollManager.unregister(this.portal.body);\n        Ext.ux.Portal.DropZone.superclass.unreg.call(this);\n    }\n});\n"
  },
  {
    "path": "client/src/ext/ux/PortalColumn.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ux.PortalColumn = Ext.extend(Ext.Container, {\n    layout : 'anchor',\n    //autoEl : 'div',//already defined by Ext.Component\n    defaultType : 'portlet',\n    cls : 'x-portal-column'\n});\n\nExt.reg('portalcolumn', Ext.ux.PortalColumn);\n"
  },
  {
    "path": "client/src/ext/ux/Portlet.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ux.Portlet = Ext.extend(Ext.Panel, {\n    anchor : '100%',\n    frame : true,\n    collapsible : true,\n    draggable : true,\n    cls : 'x-portlet'\n});\n\nExt.reg('portlet', Ext.ux.Portlet);\n"
  },
  {
    "path": "client/src/ext/ux/ProgressBarPager.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n* @class Ext.ux.ProgressBarPager\n* @extends Object \n* Plugin (ptype = 'tabclosemenu') for displaying a progressbar inside of a paging toolbar instead of plain text\n* \n* @ptype progressbarpager \n* @constructor\n* Create a new ItemSelector\n* @param {Object} config Configuration options\n* @xtype itemselector \n*/\nExt.ux.ProgressBarPager  = Ext.extend(Object, {\n\t/**\n \t* @cfg {Integer} progBarWidth\n \t* <p>The default progress bar width.  Default is 225.</p>\n\t*/\n\tprogBarWidth   : 225,\n\t/**\n \t* @cfg {String} defaultText\n\t* <p>The text to display while the store is loading.  Default is 'Loading...'</p>\n \t*/\n\tdefaultText    : 'Loading...',\n    \t/**\n \t* @cfg {Object} defaultAnimCfg \n \t* <p>A {@link Ext.Fx Ext.Fx} configuration object.  Default is  { duration : 1, easing : 'bounceOut' }.</p>\n \t*/\n\tdefaultAnimCfg : {\n\t\tduration   : 1,\n\t\teasing     : 'bounceOut'\t\n\t},\t\t\t\t\t\t\t\t\t\t\t\t  \n\tconstructor : function(config) {\n\t\tif (config) {\n\t\t\tExt.apply(this, config);\n\t\t}\n\t},\n\t//public\n\tinit : function (parent) {\n\t\t\n\t\tif(parent.displayInfo){\n\t\t\tthis.parent = parent;\n\t\t\tvar ind  = parent.items.indexOf(parent.displayItem);\n\t\t\tparent.remove(parent.displayItem, true);\n\t\t\tthis.progressBar = new Ext.ProgressBar({\n\t\t\t\ttext    : this.defaultText,\n\t\t\t\twidth   : this.progBarWidth,\n\t\t\t\tanimate :  this.defaultAnimCfg\n\t\t\t});\t\t\t\t\t\n\t\t   \n\t\t\tparent.displayItem = this.progressBar;\n\t\t\t\n\t\t\tparent.add(parent.displayItem);\t\n\t\t\tparent.doLayout();\n\t\t\tExt.apply(parent, this.parentOverrides);\t\t\n\t\t\t\n\t\t\tthis.progressBar.on('render', function(pb) {\n                pb.mon(pb.getEl().applyStyles('cursor:pointer'), 'click', this.handleProgressBarClick, this);\n            }, this, {single: true});\n\t\t\t\t\t\t\n\t\t}\n\t\t  \n\t},\n\t// private\n\t// This method handles the click for the progress bar\n\thandleProgressBarClick : function(e){\n\t\tvar parent = this.parent,\n\t\t    displayItem = parent.displayItem,\n\t\t    box = this.progressBar.getBox(),\n\t\t    xy = e.getXY(),\n\t\t    position = xy[0]-box.x,\n\t\t    pages = Math.ceil(parent.store.getTotalCount()/parent.pageSize),\n\t\t    newpage = Math.ceil(position/(displayItem.width/pages));\n            \n\t\tparent.changePage(newpage);\n\t},\n\t\n\t// private, overriddes\n\tparentOverrides  : {\n\t\t// private\n\t\t// This method updates the information via the progress bar.\n\t\tupdateInfo : function(){\n\t\t\tif(this.displayItem){\n\t\t\t\tvar count = this.store.getCount(),\n\t\t\t\t    pgData = this.getPageData(),\n\t\t\t\t    pageNum = this.readPage(pgData),\n\t\t\t\t    msg = count == 0 ?\n\t\t\t\t\tthis.emptyMsg :\n\t\t\t\t\tString.format(\n\t\t\t\t\t\tthis.displayMsg,\n\t\t\t\t\t\tthis.cursor+1, this.cursor+count, this.store.getTotalCount()\n\t\t\t\t\t);\n\t\t\t\t\t\n\t\t\t\tpageNum = pgData.activePage; ;\t\n\t\t\t\t\n\t\t\t\tvar pct\t= pageNum / pgData.pages;\t\n\t\t\t\t\n\t\t\t\tthis.displayItem.updateProgress(pct, msg, this.animate || this.defaultAnimConfig);\n\t\t\t}\n\t\t}\n\t}\n});\nExt.preg('progressbarpager', Ext.ux.ProgressBarPager);\n\n"
  },
  {
    "path": "client/src/ext/ux/Reorderer.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * @class Ext.ux.Reorderer\n * @extends Object\n * Generic base class for handling reordering of items. This base class must be extended to provide the\n * actual reordering functionality - the base class just sets up events and abstract logic functions.\n * It will fire events and set defaults, deferring the actual reordering to a doReorder implementation.\n * See Ext.ux.TabReorderer for an example.\n */\nExt.ux.Reorderer = Ext.extend(Object, {\n    /**\n     * @property defaults\n     * @type Object\n     * Object containing default values for plugin configuration details. These can be overridden when\n     * constructing the plugin\n     */\n    defaults: {\n        /**\n         * @cfg animate\n         * @type Boolean\n         * If set to true, the rearranging of the toolbar items is animated\n         */\n        animate: true,\n        \n        /**\n         * @cfg animationDuration\n         * @type Number\n         * The duration of the animation used to move other toolbar items out of the way\n         */\n        animationDuration: 0.2,\n        \n        /**\n         * @cfg defaultReorderable\n         * @type Boolean\n         * True to make every toolbar draggable unless reorderable is specifically set to false.\n         * This defaults to false\n         */\n        defaultReorderable: false\n    },\n    \n    /**\n     * Creates the plugin instance, applies defaults\n     * @constructor\n     * @param {Object} config Optional config object\n     */\n    constructor: function(config) {\n        Ext.apply(this, config || {}, this.defaults);\n    },\n    \n    /**\n     * Initializes the plugin, stores a reference to the target \n     * @param {Mixed} target The target component which contains the reorderable items\n     */\n    init: function(target) {\n        /**\n         * @property target\n         * @type Ext.Component\n         * Reference to the target component which contains the reorderable items\n         */\n        this.target = target;\n        \n        this.initEvents();\n        \n        var items  = this.getItems(),\n            length = items.length,\n            i;\n        \n        for (i = 0; i < length; i++) {\n            this.createIfReorderable(items[i]);\n        }\n    },\n    \n    /**\n     * Reorders the items in the target component according to the given mapping object. Example:\n     * this.reorder({\n     *     1: 5,\n     *     3: 2\n     * });\n     * Would move the item at index 1 to index 5, and the item at index 3 to index 2\n     * @param {Object} mappings Object containing current item index as key and new index as property\n     */\n    reorder: function(mappings) {\n        var target = this.target;\n        \n        if (target.fireEvent('before-reorder', mappings, target, this) !== false) {\n            this.doReorder(mappings);\n            \n            target.fireEvent('reorder', mappings, target, this);\n        }\n    },\n    \n    /**\n     * Abstract function to perform the actual reordering. This MUST be overridden in a subclass\n     * @param {Object} mappings Mappings of the old item indexes to new item indexes\n     */\n    doReorder: function(paramName) {\n        throw new Error(\"doReorder must be implemented in the Ext.ux.Reorderer subclass\");\n    },\n    \n    /**\n     * Should create and return an Ext.dd.DD for the given item. This MUST be overridden in a subclass\n     * @param {Mixed} item The item to create a DD for. This could be a TabPanel tab, a Toolbar button, etc\n     * @return {Ext.dd.DD} The DD for the given item\n     */\n    createItemDD: function(item) {\n        throw new Error(\"createItemDD must be implemented in the Ext.ux.Reorderer subclass\");\n    },\n    \n    /**\n     * Sets up the given Toolbar item as a draggable\n     * @param {Mixed} button The item to make draggable (usually an Ext.Button instance)\n     */\n    createItemDD: function(button) {\n        var el   = button.getEl(),\n            id   = el.id,\n            tbar = this.target,\n            me   = this;\n        \n        button.dd = new Ext.dd.DD(el, undefined, {\n            isTarget: false\n        });\n        \n        button.dd.constrainTo(tbar.getEl());\n        button.dd.setYConstraint(0, 0, 0);\n        \n        Ext.apply(button.dd, {\n            b4StartDrag: function() {       \n                this.startPosition = el.getXY();\n                \n                //bump up the z index of the button being dragged but keep a reference to the original\n                this.startZIndex = el.getStyle('zIndex');\n                el.setStyle('zIndex', 10000);\n                \n                button.suspendEvents();\n            },\n            \n            onDrag: function(e) {\n                //calculate the button's index within the toolbar and its current midpoint\n                var buttonX  = el.getXY()[0],\n                    deltaX   = buttonX - this.startPosition[0],\n                    items    = tbar.items.items,\n                    oldIndex = items.indexOf(button),\n                    newIndex;\n                \n                //find which item in the toolbar the midpoint is currently over\n                for (var index = 0; index < items.length; index++) {\n                    var item = items[index];\n                    \n                    if (item.reorderable && item.id != button.id) {\n                        //find the midpoint of the button\n                        var box        = item.getEl().getBox(),\n                            midpoint   = (me.buttonXCache[item.id] || box.x) + (box.width / 2),\n                            movedLeft  = oldIndex > index && deltaX < 0 && buttonX < midpoint,\n                            movedRight = oldIndex < index && deltaX > 0 && (buttonX + el.getWidth()) > midpoint;\n                        \n                        if (movedLeft || movedRight) {\n                            me[movedLeft ? 'onMovedLeft' : 'onMovedRight'](button, index, oldIndex);\n                            break;\n                        }                        \n                    }\n                }\n            },\n            \n            /**\n             * After the drag has been completed, make sure the button being dragged makes it back to\n             * the correct location and resets its z index\n             */\n            endDrag: function() {\n                //we need to update the cache here for cases where the button was dragged but its\n                //position in the toolbar did not change\n                me.updateButtonXCache();\n                \n                el.moveTo(me.buttonXCache[button.id], undefined, {\n                    duration: me.animationDuration,\n                    scope   : this,\n                    callback: function() {\n                        button.resumeEvents();\n                        \n                        tbar.fireEvent('reordered', button, tbar);\n                    }\n                });\n                \n                el.setStyle('zIndex', this.startZIndex);\n            }\n        });\n    },\n    \n    /**\n     * @private\n     * Creates a DD instance for a given item if it is reorderable\n     * @param {Mixed} item The item\n     */\n    createIfReorderable: function(item) {\n        if (this.defaultReorderable && item.reorderable == undefined) {\n            item.reorderable = true;\n        }\n        \n        if (item.reorderable && !item.dd) {\n            if (item.rendered) {\n                this.createItemDD(item);                \n            } else {\n                item.on('render', this.createItemDD.createDelegate(this, [item]), this, {single: true});\n            }\n        }\n    },\n    \n    /**\n     * Returns an array of items which will be made draggable. This defaults to the contents of this.target.items,\n     * but can be overridden - e.g. for TabPanels\n     * @return {Array} The array of items which will be made draggable\n     */\n    getItems: function() {\n        return this.target.items.items;\n    },\n    \n    /**\n     * Adds before-reorder and reorder events to the target component\n     */\n    initEvents: function() {\n        this.target.addEvents(\n          /**\n           * @event before-reorder\n           * Fires before a reorder occurs. Return false to cancel\n           * @param {Object} mappings Mappings of the old item indexes to new item indexes\n           * @param {Mixed} component The target component\n           * @param {Ext.ux.TabReorderer} this The plugin instance\n           */\n          'before-reorder',\n          \n          /**\n           * @event reorder\n           * Fires after a reorder has occured.\n           * @param {Object} mappings Mappings of the old item indexes to the new item indexes\n           * @param {Mixed} component The target component\n           * @param {Ext.ux.TabReorderer} this The plugin instance\n           */\n          'reorder'\n        );\n    }\n});\n\n/**\n * @class Ext.ux.HBoxReorderer\n * @extends Ext.ux.Reorderer\n * Description\n */\nExt.ux.HBoxReorderer = Ext.extend(Ext.ux.Reorderer, {\n    /**\n     * Initializes the plugin, decorates the container with additional functionality\n     */\n    init: function(container) {\n        /**\n         * This is used to store the correct x value of each button in the array. We need to use this\n         * instead of the button's reported x co-ordinate because the buttons are animated when they move -\n         * if another onDrag is fired while the button is still moving, the comparison x value will be incorrect\n         */\n        this.buttonXCache = {};\n        \n        container.on({\n            scope: this,\n            add  : function(container, item) {\n                this.createIfReorderable(item);\n            }\n        });\n        \n        //super sets a reference to the toolbar in this.target\n        Ext.ux.HBoxReorderer.superclass.init.apply(this, arguments);\n    },\n    \n    /**\n     * Sets up the given Toolbar item as a draggable\n     * @param {Mixed} button The item to make draggable (usually an Ext.Button instance)\n     */\n    createItemDD: function(button) {\n        if (button.dd != undefined) {\n            return;\n        }\n        \n        var el   = button.getEl(),\n            id   = el.id,\n            me   = this,\n            tbar = me.target;\n        \n        button.dd = new Ext.dd.DD(el, undefined, {\n            isTarget: false\n        });\n        \n        el.applyStyles({\n            position: 'absolute'\n        });\n        \n        //if a button has a menu, it is disabled while dragging with this function\n        var menuDisabler = function() {\n            return false;\n        };\n        \n        Ext.apply(button.dd, {\n            b4StartDrag: function() {       \n                this.startPosition = el.getXY();\n                \n                //bump up the z index of the button being dragged but keep a reference to the original\n                this.startZIndex = el.getStyle('zIndex');\n                el.setStyle('zIndex', 10000);\n                \n                button.suspendEvents();\n                if (button.menu) {\n                    button.menu.on('beforeshow', menuDisabler, me);\n                }\n            },\n            \n            startDrag: function() {\n                this.constrainTo(tbar.getEl());\n                this.setYConstraint(0, 0, 0);\n            },\n            \n            onDrag: function(e) {\n                //calculate the button's index within the toolbar and its current midpoint\n                var buttonX  = el.getXY()[0],\n                    deltaX   = buttonX - this.startPosition[0],\n                    items    = tbar.items.items,\n                    length   = items.length,\n                    oldIndex = items.indexOf(button),\n                    newIndex, index, item;\n                \n                //find which item in the toolbar the midpoint is currently over\n                for (index = 0; index < length; index++) {\n                    item = items[index];\n                    \n                    if (item.reorderable && item.id != button.id) {\n                        //find the midpoint of the button\n                        var box        = item.getEl().getBox(),\n                            midpoint   = (me.buttonXCache[item.id] || box.x) + (box.width / 2),\n                            movedLeft  = oldIndex > index && deltaX < 0 && buttonX < midpoint,\n                            movedRight = oldIndex < index && deltaX > 0 && (buttonX + el.getWidth()) > midpoint;\n                        \n                        if (movedLeft || movedRight) {\n                            me[movedLeft ? 'onMovedLeft' : 'onMovedRight'](button, index, oldIndex);\n                            break;\n                        }                        \n                    }\n                }\n            },\n            \n            /**\n             * After the drag has been completed, make sure the button being dragged makes it back to\n             * the correct location and resets its z index\n             */\n            endDrag: function() {\n                //we need to update the cache here for cases where the button was dragged but its\n                //position in the toolbar did not change\n                me.updateButtonXCache();\n                \n                el.moveTo(me.buttonXCache[button.id], el.getY(), {\n                    duration: me.animationDuration,\n                    scope   : this,\n                    callback: function() {\n                        button.resumeEvents();\n                        if (button.menu) {\n                            button.menu.un('beforeshow', menuDisabler, me);\n                        }\n                        \n                        tbar.fireEvent('reordered', button, tbar);\n                    }\n                });\n                \n                el.setStyle('zIndex', this.startZIndex);\n            }\n        });\n    },\n    \n    onMovedLeft: function(item, newIndex, oldIndex) {\n        var tbar   = this.target,\n            items  = tbar.items.items,\n            length = items.length,\n            index;\n        \n        if (newIndex != undefined && newIndex != oldIndex) {\n            //move the button currently under drag to its new location\n            tbar.remove(item, false);\n            tbar.insert(newIndex, item);\n            \n            //set the correct x location of each item in the toolbar\n            this.updateButtonXCache();\n            for (index = 0; index < length; index++) {\n                var obj  = items[index],\n                    newX = this.buttonXCache[obj.id];\n                \n                if (item == obj) {\n                    item.dd.startPosition[0] = newX;\n                } else {\n                    var el = obj.getEl();\n                    \n                    el.moveTo(newX, el.getY(), {\n                        duration: this.animationDuration\n                    });\n                }\n            }\n        }\n    },\n    \n    onMovedRight: function(item, newIndex, oldIndex) {\n        this.onMovedLeft.apply(this, arguments);\n    },\n    \n    /**\n     * @private\n     * Updates the internal cache of button X locations. \n     */\n    updateButtonXCache: function() {\n        var tbar   = this.target,\n            items  = tbar.items,\n            totalX = tbar.getEl().getBox(true).x;\n            \n        items.each(function(item) {\n            this.buttonXCache[item.id] = totalX;\n\n            totalX += item.getEl().getWidth();\n        }, this);\n    }\n});"
  },
  {
    "path": "client/src/ext/ux/RowEditor.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.RowEditor\n * @extends Ext.Panel\n * Plugin (ptype = 'roweditor') that adds the ability to rapidly edit full rows in a grid.\n * A validation mode may be enabled which uses AnchorTips to notify the user of all\n * validation errors at once.\n *\n * @ptype roweditor\n */\nExt.ux.grid.RowEditor = Ext.extend(Ext.Panel, {\n    floating: true,\n    shadow: false,\n    layout: 'hbox',\n    cls: 'x-small-editor',\n    buttonAlign: 'center',\n    baseCls: 'x-row-editor',\n    elements: 'header,footer,body',\n    frameWidth: 5,\n    buttonPad: 3,\n    clicksToEdit: 'auto',\n    monitorValid: true,\n    focusDelay: 250,\n    errorSummary: true,\n\n    saveText: 'Save',\n    cancelText: 'Cancel',\n    commitChangesText: 'You need to commit or cancel your changes',\n    errorText: 'Errors',\n\n    defaults: {\n        normalWidth: true\n    },\n\n    initComponent: function(){\n        Ext.ux.grid.RowEditor.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event beforeedit\n             * Fired before the row editor is activated.\n             * If the listener returns <tt>false</tt> the editor will not be activated.\n             * @param {Ext.ux.grid.RowEditor} roweditor This object\n             * @param {Number} rowIndex The rowIndex of the row just edited\n             */\n            'beforeedit',\n            /**\n             * @event canceledit\n             * Fired when the editor is cancelled.\n             * @param {Ext.ux.grid.RowEditor} roweditor This object\n             * @param {Boolean} forced True if the cancel button is pressed, false is the editor was invalid.\n             */\n            'canceledit',\n            /**\n             * @event validateedit\n             * Fired after a row is edited and passes validation.\n             * If the listener returns <tt>false</tt> changes to the record will not be set.\n             * @param {Ext.ux.grid.RowEditor} roweditor This object\n             * @param {Object} changes Object with changes made to the record.\n             * @param {Ext.data.Record} r The Record that was edited.\n             * @param {Number} rowIndex The rowIndex of the row just edited\n             */\n            'validateedit',\n            /**\n             * @event afteredit\n             * Fired after a row is edited and passes validation.  This event is fired\n             * after the store's update event is fired with this edit.\n             * @param {Ext.ux.grid.RowEditor} roweditor This object\n             * @param {Object} changes Object with changes made to the record.\n             * @param {Ext.data.Record} r The Record that was edited.\n             * @param {Number} rowIndex The rowIndex of the row just edited\n             */\n            'afteredit'\n        );\n    },\n\n    init: function(grid){\n        this.grid = grid;\n        this.ownerCt = grid;\n        if(this.clicksToEdit === 2){\n            grid.on('rowdblclick', this.onRowDblClick, this);\n        }else{\n            grid.on('rowclick', this.onRowClick, this);\n            if(Ext.isIE){\n                grid.on('rowdblclick', this.onRowDblClick, this);\n            }\n        }\n\n        // stopEditing without saving when a record is removed from Store.\n        grid.getStore().on('remove', function() {\n            this.stopEditing(false);\n        },this);\n\n        grid.on({\n            scope: this,\n            keydown: this.onGridKey,\n            columnresize: this.verifyLayout,\n            columnmove: this.refreshFields,\n            reconfigure: this.refreshFields,\n            beforedestroy : this.beforedestroy,\n            destroy : this.destroy,\n            bodyscroll: {\n                buffer: 250,\n                fn: this.positionButtons\n            }\n        });\n        grid.getColumnModel().on('hiddenchange', this.verifyLayout, this, {delay:1});\n        grid.getView().on('refresh', this.stopEditing.createDelegate(this, []));\n    },\n\n    beforedestroy: function() {\n        this.stopMonitoring();\n        this.grid.getStore().un('remove', this.onStoreRemove, this);\n        this.stopEditing(false);\n        Ext.destroy(this.btns, this.tooltip);\n    },\n\n    refreshFields: function(){\n        this.initFields();\n        this.verifyLayout();\n    },\n\n    isDirty: function(){\n        var dirty;\n        this.items.each(function(f){\n            if(String(this.values[f.id]) !== String(f.getValue())){\n                dirty = true;\n                return false;\n            }\n        }, this);\n        return dirty;\n    },\n\n    startEditing: function(rowIndex, doFocus){\n        if(this.editing && this.isDirty()){\n            this.showTooltip(this.commitChangesText);\n            return;\n        }\n        if(Ext.isObject(rowIndex)){\n            rowIndex = this.grid.getStore().indexOf(rowIndex);\n        }\n        if(this.fireEvent('beforeedit', this, rowIndex) !== false){\n            this.editing = true;\n            var g = this.grid, view = g.getView(),\n                row = view.getRow(rowIndex),\n                record = g.store.getAt(rowIndex);\n\n            this.record = record;\n            this.rowIndex = rowIndex;\n            this.values = {};\n            if(!this.rendered){\n                this.render(view.getEditorParent());\n            }\n            var w = Ext.fly(row).getWidth();\n            this.setSize(w);\n            if(!this.initialized){\n                this.initFields();\n            }\n            var cm = g.getColumnModel(), fields = this.items.items, f, val;\n            for(var i = 0, len = cm.getColumnCount(); i < len; i++){\n                val = this.preEditValue(record, cm.getDataIndex(i));\n                f = fields[i];\n                f.setValue(val);\n                this.values[f.id] = Ext.isEmpty(val) ? '' : val;\n            }\n            this.verifyLayout(true);\n            if(!this.isVisible()){\n                this.setPagePosition(Ext.fly(row).getXY());\n            } else{\n                this.el.setXY(Ext.fly(row).getXY(), {duration:0.15});\n            }\n            if(!this.isVisible()){\n                this.show().doLayout();\n            }\n            if(doFocus !== false){\n                this.doFocus.defer(this.focusDelay, this);\n            }\n        }\n    },\n\n    stopEditing : function(saveChanges){\n        this.editing = false;\n        if(!this.isVisible()){\n            return;\n        }\n        if(saveChanges === false || !this.isValid()){\n            this.hide();\n            this.fireEvent('canceledit', this, saveChanges === false);\n            return;\n        }\n        var changes = {},\n            r = this.record,\n            hasChange = false,\n            cm = this.grid.colModel,\n            fields = this.items.items;\n        for(var i = 0, len = cm.getColumnCount(); i < len; i++){\n            if(!cm.isHidden(i)){\n                var dindex = cm.getDataIndex(i);\n                if(!Ext.isEmpty(dindex)){\n                    var oldValue = r.data[dindex],\n                        value = this.postEditValue(fields[i].getValue(), oldValue, r, dindex);\n                    if(String(oldValue) !== String(value)){\n                        changes[dindex] = value;\n                        hasChange = true;\n                    }\n                }\n            }\n        }\n        if(hasChange && this.fireEvent('validateedit', this, changes, r, this.rowIndex) !== false){\n            r.beginEdit();\n            Ext.iterate(changes, function(name, value){\n                r.set(name, value);\n            });\n            r.endEdit();\n            this.fireEvent('afteredit', this, changes, r, this.rowIndex);\n        } else {\n            this.fireEvent('canceledit', this, false);\n        }\n        this.hide();\n    },\n\n    verifyLayout: function(force){\n        if(this.el && (this.isVisible() || force === true)){\n            var row = this.grid.getView().getRow(this.rowIndex);\n            this.setSize(Ext.fly(row).getWidth(), Ext.isIE ? Ext.fly(row).getHeight() + 9 : undefined);\n            var cm = this.grid.colModel, fields = this.items.items;\n            for(var i = 0, len = cm.getColumnCount(); i < len; i++){\n                if(!cm.isHidden(i)){\n                    var adjust = 0;\n                    if(i === (len - 1)){\n                        adjust += 3; // outer padding\n                    } else{\n                        adjust += 1;\n                    }\n                    fields[i].show();\n                    fields[i].setWidth(cm.getColumnWidth(i) - adjust);\n                } else{\n                    fields[i].hide();\n                }\n            }\n            this.doLayout();\n            this.positionButtons();\n        }\n    },\n\n    slideHide : function(){\n        this.hide();\n    },\n\n    initFields: function(){\n        var cm = this.grid.getColumnModel(), pm = Ext.layout.ContainerLayout.prototype.parseMargins;\n        this.removeAll(false);\n        for(var i = 0, len = cm.getColumnCount(); i < len; i++){\n            var c = cm.getColumnAt(i),\n                ed = c.getEditor();\n            if(!ed){\n                ed = c.displayEditor || new Ext.form.DisplayField();\n            }\n            if(i == 0){\n                ed.margins = pm('0 1 2 1');\n            } else if(i == len - 1){\n                ed.margins = pm('0 0 2 1');\n            } else{\n                if (Ext.isIE) {\n                    ed.margins = pm('0 0 2 0');\n                }\n                else {\n                    ed.margins = pm('0 1 2 0');\n                }\n            }\n            ed.setWidth(cm.getColumnWidth(i));\n            ed.column = c;\n            if(ed.ownerCt !== this){\n                ed.on('focus', this.ensureVisible, this);\n                ed.on('specialkey', this.onKey, this);\n            }\n            this.insert(i, ed);\n        }\n        this.initialized = true;\n    },\n\n    onKey: function(f, e){\n        if(e.getKey() === e.ENTER){\n            this.stopEditing(true);\n            e.stopPropagation();\n        }\n    },\n\n    onGridKey: function(e){\n        if(e.getKey() === e.ENTER && !this.isVisible()){\n            var r = this.grid.getSelectionModel().getSelected();\n            if(r){\n                var index = this.grid.store.indexOf(r);\n                this.startEditing(index);\n                e.stopPropagation();\n            }\n        }\n    },\n\n    ensureVisible: function(editor){\n        if(this.isVisible()){\n             this.grid.getView().ensureVisible(this.rowIndex, this.grid.colModel.getIndexById(editor.column.id), true);\n        }\n    },\n\n    onRowClick: function(g, rowIndex, e){\n        if(this.clicksToEdit == 'auto'){\n            var li = this.lastClickIndex;\n            this.lastClickIndex = rowIndex;\n            if(li != rowIndex && !this.isVisible()){\n                return;\n            }\n        }\n        this.startEditing(rowIndex, false);\n        this.doFocus.defer(this.focusDelay, this, [e.getPoint()]);\n    },\n\n    onRowDblClick: function(g, rowIndex, e){\n        this.startEditing(rowIndex, false);\n        this.doFocus.defer(this.focusDelay, this, [e.getPoint()]);\n    },\n\n    onRender: function(){\n        Ext.ux.grid.RowEditor.superclass.onRender.apply(this, arguments);\n        this.el.swallowEvent(['keydown', 'keyup', 'keypress']);\n        this.btns = new Ext.Panel({\n            baseCls: 'x-plain',\n            cls: 'x-btns',\n            elements:'body',\n            layout: 'table',\n            width: (this.minButtonWidth * 2) + (this.frameWidth * 2) + (this.buttonPad * 4), // width must be specified for IE\n            items: [{\n                ref: 'saveBtn',\n                itemId: 'saveBtn',\n                xtype: 'button',\n                text: this.saveText,\n                width: this.minButtonWidth,\n                handler: this.stopEditing.createDelegate(this, [true])\n            }, {\n                xtype: 'button',\n                text: this.cancelText,\n                width: this.minButtonWidth,\n                handler: this.stopEditing.createDelegate(this, [false])\n            }]\n        });\n        this.btns.render(this.bwrap);\n    },\n\n    afterRender: function(){\n        Ext.ux.grid.RowEditor.superclass.afterRender.apply(this, arguments);\n        this.positionButtons();\n        if(this.monitorValid){\n            this.startMonitoring();\n        }\n    },\n\n    onShow: function(){\n        if(this.monitorValid){\n            this.startMonitoring();\n        }\n        Ext.ux.grid.RowEditor.superclass.onShow.apply(this, arguments);\n    },\n\n    onHide: function(){\n        Ext.ux.grid.RowEditor.superclass.onHide.apply(this, arguments);\n        this.stopMonitoring();\n        this.grid.getView().focusRow(this.rowIndex);\n    },\n\n    positionButtons: function(){\n        if(this.btns){\n            var g = this.grid,\n                h = this.el.dom.clientHeight,\n                view = g.getView(),\n                scroll = view.scroller.dom.scrollLeft,\n                bw = this.btns.getWidth(),\n                width = Math.min(g.getWidth(), g.getColumnModel().getTotalWidth());\n\n            this.btns.el.shift({left: (width/2)-(bw/2)+scroll, top: h - 2, stopFx: true, duration:0.2});\n        }\n    },\n\n    // private\n    preEditValue : function(r, field){\n        var value = r.data[field];\n        return this.autoEncode && typeof value === 'string' ? Ext.util.Format.htmlDecode(value) : value;\n    },\n\n    // private\n    postEditValue : function(value, originalValue, r, field){\n        return this.autoEncode && typeof value == 'string' ? Ext.util.Format.htmlEncode(value) : value;\n    },\n\n    doFocus: function(pt){\n        if(this.isVisible()){\n            var index = 0,\n                cm = this.grid.getColumnModel(),\n                c;\n            if(pt){\n                index = this.getTargetColumnIndex(pt);\n            }\n            for(var i = index||0, len = cm.getColumnCount(); i < len; i++){\n                c = cm.getColumnAt(i);\n                if(!c.hidden && c.getEditor()){\n                    c.getEditor().focus();\n                    break;\n                }\n            }\n        }\n    },\n\n    getTargetColumnIndex: function(pt){\n        var grid = this.grid,\n            v = grid.view,\n            x = pt.left,\n            cms = grid.colModel.config,\n            i = 0,\n            match = false;\n        for(var len = cms.length, c; c = cms[i]; i++){\n            if(!c.hidden){\n                if(Ext.fly(v.getHeaderCell(i)).getRegion().right >= x){\n                    match = i;\n                    break;\n                }\n            }\n        }\n        return match;\n    },\n\n    startMonitoring : function(){\n        if(!this.bound && this.monitorValid){\n            this.bound = true;\n            Ext.TaskMgr.start({\n                run : this.bindHandler,\n                interval : this.monitorPoll || 200,\n                scope: this\n            });\n        }\n    },\n\n    stopMonitoring : function(){\n        this.bound = false;\n        if(this.tooltip){\n            this.tooltip.hide();\n        }\n    },\n\n    isValid: function(){\n        var valid = true;\n        this.items.each(function(f){\n            if(!f.isValid(true)){\n                valid = false;\n                return false;\n            }\n        });\n        return valid;\n    },\n\n    // private\n    bindHandler : function(){\n        if(!this.bound){\n            return false; // stops binding\n        }\n        var valid = this.isValid();\n        if(!valid && this.errorSummary){\n            this.showTooltip(this.getErrorText().join(''));\n        }\n        this.btns.saveBtn.setDisabled(!valid);\n        this.fireEvent('validation', this, valid);\n    },\n\n    lastVisibleColumn : function() {\n        var i = this.items.getCount() - 1,\n            c;\n        for(; i >= 0; i--) {\n            c = this.items.items[i];\n            if (!c.hidden) {\n                return c;\n            }\n        }\n    },\n\n    showTooltip: function(msg){\n        var t = this.tooltip;\n        if(!t){\n            t = this.tooltip = new Ext.ToolTip({\n                maxWidth: 600,\n                cls: 'errorTip',\n                width: 300,\n                title: this.errorText,\n                autoHide: false,\n                anchor: 'left',\n                anchorToTarget: true,\n                mouseOffset: [40,0]\n            });\n        }\n        var v = this.grid.getView(),\n            top = parseInt(this.el.dom.style.top, 10),\n            scroll = v.scroller.dom.scrollTop,\n            h = this.el.getHeight();\n\n        if(top + h >= scroll){\n            t.initTarget(this.lastVisibleColumn().getEl());\n            if(!t.rendered){\n                t.show();\n                t.hide();\n            }\n            t.body.update(msg);\n            t.doAutoWidth(20);\n            t.show();\n        }else if(t.rendered){\n            t.hide();\n        }\n    },\n\n    getErrorText: function(){\n        var data = ['<ul>'];\n        this.items.each(function(f){\n            if(!f.isValid(true)){\n                data.push('<li>', f.getActiveError(), '</li>');\n            }\n        });\n        data.push('</ul>');\n        return data;\n    }\n});\nExt.preg('roweditor', Ext.ux.grid.RowEditor);\n"
  },
  {
    "path": "client/src/ext/ux/RowExpander.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.RowExpander\n * @extends Ext.util.Observable\n * Plugin (ptype = 'rowexpander') that adds the ability to have a Column in a grid which enables\n * a second row body which expands/contracts.  The expand/contract behavior is configurable to react\n * on clicking of the column, double click of the row, and/or hitting enter while a row is selected.\n *\n * @ptype rowexpander\n */\nExt.ux.grid.RowExpander = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Boolean} expandOnEnter\n     * <tt>true</tt> to toggle selected row(s) between expanded/collapsed when the enter\n     * key is pressed (defaults to <tt>true</tt>).\n     */\n    expandOnEnter : true,\n    /**\n     * @cfg {Boolean} expandOnDblClick\n     * <tt>true</tt> to toggle a row between expanded/collapsed when double clicked\n     * (defaults to <tt>true</tt>).\n     */\n    expandOnDblClick : true,\n\n    header : '',\n    width : 20,\n    sortable : false,\n    fixed : true,\n    hideable: false,\n    menuDisabled : true,\n    dataIndex : '',\n    id : 'expander',\n    lazyRender : true,\n    enableCaching : true,\n\n    constructor: function(config){\n        Ext.apply(this, config);\n\n        this.addEvents({\n            /**\n             * @event beforeexpand\n             * Fires before the row expands. Have the listener return false to prevent the row from expanding.\n             * @param {Object} this RowExpander object.\n             * @param {Object} Ext.data.Record Record for the selected row.\n             * @param {Object} body body element for the secondary row.\n             * @param {Number} rowIndex The current row index.\n             */\n            beforeexpand: true,\n            /**\n             * @event expand\n             * Fires after the row expands.\n             * @param {Object} this RowExpander object.\n             * @param {Object} Ext.data.Record Record for the selected row.\n             * @param {Object} body body element for the secondary row.\n             * @param {Number} rowIndex The current row index.\n             */\n            expand: true,\n            /**\n             * @event beforecollapse\n             * Fires before the row collapses. Have the listener return false to prevent the row from collapsing.\n             * @param {Object} this RowExpander object.\n             * @param {Object} Ext.data.Record Record for the selected row.\n             * @param {Object} body body element for the secondary row.\n             * @param {Number} rowIndex The current row index.\n             */\n            beforecollapse: true,\n            /**\n             * @event collapse\n             * Fires after the row collapses.\n             * @param {Object} this RowExpander object.\n             * @param {Object} Ext.data.Record Record for the selected row.\n             * @param {Object} body body element for the secondary row.\n             * @param {Number} rowIndex The current row index.\n             */\n            collapse: true\n        });\n\n        Ext.ux.grid.RowExpander.superclass.constructor.call(this);\n\n        if(this.tpl){\n            if(typeof this.tpl == 'string'){\n                this.tpl = new Ext.Template(this.tpl);\n            }\n            this.tpl.compile();\n        }\n\n        this.state = {};\n        this.bodyContent = {};\n    },\n\n    getRowClass : function(record, rowIndex, p, ds){\n        p.cols = p.cols-1;\n        var content = this.bodyContent[record.id];\n        if(!content && !this.lazyRender){\n            content = this.getBodyContent(record, rowIndex);\n        }\n        if(content){\n            p.body = content;\n        }\n        return this.state[record.id] ? 'x-grid3-row-expanded' : 'x-grid3-row-collapsed';\n    },\n\n    init : function(grid){\n        this.grid = grid;\n\n        var view = grid.getView();\n        view.getRowClass = this.getRowClass.createDelegate(this);\n\n        view.enableRowBody = true;\n\n\n        grid.on('render', this.onRender, this);\n        grid.on('destroy', this.onDestroy, this);\n    },\n\n    // @private\n    onRender: function() {\n        var grid = this.grid;\n        var mainBody = grid.getView().mainBody;\n        mainBody.on('mousedown', this.onMouseDown, this, {delegate: '.x-grid3-row-expander'});\n        if (this.expandOnEnter) {\n            this.keyNav = new Ext.KeyNav(this.grid.getGridEl(), {\n                'enter' : this.onEnter,\n                scope: this\n            });\n        }\n        if (this.expandOnDblClick) {\n            grid.on('rowdblclick', this.onRowDblClick, this);\n        }\n    },\n    \n    // @private    \n    onDestroy: function() {\n        if(this.keyNav){\n            this.keyNav.disable();\n            delete this.keyNav;\n        }\n        /*\n         * A majority of the time, the plugin will be destroyed along with the grid,\n         * which means the mainBody won't be available. On the off chance that the plugin\n         * isn't destroyed with the grid, take care of removing the listener.\n         */\n        var mainBody = this.grid.getView().mainBody;\n        if(mainBody){\n            mainBody.un('mousedown', this.onMouseDown, this);\n        }\n    },\n    // @private\n    onRowDblClick: function(grid, rowIdx, e) {\n        this.toggleRow(rowIdx);\n    },\n\n    onEnter: function(e) {\n        var g = this.grid;\n        var sm = g.getSelectionModel();\n        var sels = sm.getSelections();\n        for (var i = 0, len = sels.length; i < len; i++) {\n            var rowIdx = g.getStore().indexOf(sels[i]);\n            this.toggleRow(rowIdx);\n        }\n    },\n\n    getBodyContent : function(record, index){\n        if(!this.enableCaching){\n            return this.tpl.apply(record.data);\n        }\n        var content = this.bodyContent[record.id];\n        if(!content){\n            content = this.tpl.apply(record.data);\n            this.bodyContent[record.id] = content;\n        }\n        return content;\n    },\n\n    onMouseDown : function(e, t){\n        e.stopEvent();\n        var row = e.getTarget('.x-grid3-row');\n        this.toggleRow(row);\n    },\n\n    renderer : function(v, p, record){\n        p.cellAttr = 'rowspan=\"2\"';\n        return '<div class=\"x-grid3-row-expander\">&#160;</div>';\n    },\n\n    beforeExpand : function(record, body, rowIndex){\n        if(this.fireEvent('beforeexpand', this, record, body, rowIndex) !== false){\n            if(this.tpl && this.lazyRender){\n                body.innerHTML = this.getBodyContent(record, rowIndex);\n            }\n            return true;\n        }else{\n            return false;\n        }\n    },\n\n    toggleRow : function(row){\n        if(typeof row == 'number'){\n            row = this.grid.view.getRow(row);\n        }\n        this[Ext.fly(row).hasClass('x-grid3-row-collapsed') ? 'expandRow' : 'collapseRow'](row);\n    },\n\n    expandRow : function(row){\n        if(typeof row == 'number'){\n            row = this.grid.view.getRow(row);\n        }\n        var record = this.grid.store.getAt(row.rowIndex);\n        var body = Ext.DomQuery.selectNode('tr:nth(2) div.x-grid3-row-body', row);\n        if(this.beforeExpand(record, body, row.rowIndex)){\n            this.state[record.id] = true;\n            Ext.fly(row).replaceClass('x-grid3-row-collapsed', 'x-grid3-row-expanded');\n            this.fireEvent('expand', this, record, body, row.rowIndex);\n        }\n    },\n\n    collapseRow : function(row){\n        if(typeof row == 'number'){\n            row = this.grid.view.getRow(row);\n        }\n        var record = this.grid.store.getAt(row.rowIndex);\n        var body = Ext.fly(row).child('tr:nth(1) div.x-grid3-row-body', true);\n        if(this.fireEvent('beforecollapse', this, record, body, row.rowIndex) !== false){\n            this.state[record.id] = false;\n            Ext.fly(row).replaceClass('x-grid3-row-expanded', 'x-grid3-row-collapsed');\n            this.fireEvent('collapse', this, record, body, row.rowIndex);\n        }\n    }\n});\n\nExt.preg('rowexpander', Ext.ux.grid.RowExpander);\n\n//backwards compat\nExt.grid.RowExpander = Ext.ux.grid.RowExpander;"
  },
  {
    "path": "client/src/ext/ux/RowLayout.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n// We are adding these custom layouts to a namespace that does not\n// exist by default in Ext, so we have to add the namespace first:\nExt.ns('Ext.ux.layout');\n\n/**\n * @class Ext.ux.layout.RowLayout\n * @extends Ext.layout.ContainerLayout\n * <p>This is the layout style of choice for creating structural layouts in a multi-row format where the height of\n * each row can be specified as a percentage or fixed height.  Row widths can also be fixed, percentage or auto.\n * This class is intended to be extended or created via the layout:'ux.row' {@link Ext.Container#layout} config,\n * and should generally not need to be created directly via the new keyword.</p>\n * <p>RowLayout does not have any direct config options (other than inherited ones), but it does support a\n * specific config property of <b><tt>rowHeight</tt></b> that can be included in the config of any panel added to it.  The\n * layout will use the rowHeight (if present) or height of each panel during layout to determine how to size each panel.\n * If height or rowHeight is not specified for a given panel, its height will default to the panel's height (or auto).</p>\n * <p>The height property is always evaluated as pixels, and must be a number greater than or equal to 1.\n * The rowHeight property is always evaluated as a percentage, and must be a decimal value greater than 0 and\n * less than 1 (e.g., .25).</p>\n * <p>The basic rules for specifying row heights are pretty simple.  The logic makes two passes through the\n * set of contained panels.  During the first layout pass, all panels that either have a fixed height or none\n * specified (auto) are skipped, but their heights are subtracted from the overall container height.  During the second\n * pass, all panels with rowHeights are assigned pixel heights in proportion to their percentages based on\n * the total <b>remaining</b> container height.  In other words, percentage height panels are designed to fill the space\n * left over by all the fixed-height and/or auto-height panels.  Because of this, while you can specify any number of rows\n * with different percentages, the rowHeights must always add up to 1 (or 100%) when added together, otherwise your\n * layout may not render as expected.  Example usage:</p>\n * <pre><code>\n// All rows are percentages -- they must add up to 1\nvar p = new Ext.Panel({\n    title: 'Row Layout - Percentage Only',\n    layout:'ux.row',\n    items: [{\n        title: 'Row 1',\n        rowHeight: .25\n    },{\n        title: 'Row 2',\n        rowHeight: .6\n    },{\n        title: 'Row 3',\n        rowHeight: .15\n    }]\n});\n\n// Mix of height and rowHeight -- all rowHeight values must add\n// up to 1. The first row will take up exactly 120px, and the last two\n// rows will fill the remaining container height.\nvar p = new Ext.Panel({\n    title: 'Row Layout - Mixed',\n    layout:'ux.row',\n    items: [{\n        title: 'Row 1',\n        height: 120,\n        // standard panel widths are still supported too:\n        width: '50%' // or 200\n    },{\n        title: 'Row 2',\n        rowHeight: .8,\n        width: 300\n    },{\n        title: 'Row 3',\n        rowHeight: .2\n    }]\n});\n</code></pre>\n */\nExt.ux.layout.RowLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    // private\n    monitorResize:true,\n\n    type: 'row',\n\n    // private\n    allowContainerRemove: false,\n\n    // private\n    isValidParent : function(c, target){\n        return this.innerCt && c.getPositionEl().dom.parentNode == this.innerCt.dom;\n    },\n\n    getLayoutTargetSize : function() {\n        var target = this.container.getLayoutTarget(), ret;\n        if (target) {\n            ret = target.getViewSize();\n\n            // IE in strict mode will return a height of 0 on the 1st pass of getViewSize.\n            // Use getStyleSize to verify the 0 height, the adjustment pass will then work properly\n            // with getViewSize\n            if (Ext.isIE && Ext.isStrict && ret.height == 0){\n                ret =  target.getStyleSize();\n            }\n\n            ret.width -= target.getPadding('lr');\n            ret.height -= target.getPadding('tb');\n        }\n        return ret;\n    },\n\n    renderAll : function(ct, target) {\n        if(!this.innerCt){\n            // the innerCt prevents wrapping and shuffling while\n            // the container is resizing\n            this.innerCt = target.createChild({cls:'x-column-inner'});\n            this.innerCt.createChild({cls:'x-clear'});\n        }\n        Ext.layout.ColumnLayout.superclass.renderAll.call(this, ct, this.innerCt);\n    },\n\n    // private\n    onLayout : function(ct, target){\n        var rs = ct.items.items,\n            len = rs.length,\n            r,\n            m,\n            i,\n            margins = [];\n\n        this.renderAll(ct, target);\n\n        var size = this.getLayoutTargetSize();\n\n        if(size.width < 1 && size.height < 1){ // display none?\n            return;\n        }\n\n        var h = size.height,\n            ph = h;\n\n        this.innerCt.setSize({height:h});\n\n        // some rows can be percentages while others are fixed\n        // so we need to make 2 passes\n\n        for(i = 0; i < len; i++){\n            r = rs[i];\n            m = r.getPositionEl().getMargins('tb');\n            margins[i] = m;\n            if(!r.rowHeight){\n                ph -= (r.getHeight() + m);\n            }\n        }\n\n        ph = ph < 0 ? 0 : ph;\n\n        for(i = 0; i < len; i++){\n            r = rs[i];\n            m = margins[i];\n            if(r.rowHeight){\n                r.setSize({height: Math.floor(r.rowHeight*ph) - m});\n            }\n        }\n\n        // Browsers differ as to when they account for scrollbars.  We need to re-measure to see if the scrollbar\n        // spaces were accounted for properly.  If not, re-layout.\n        if (Ext.isIE) {\n            if (i = target.getStyle('overflow') && i != 'hidden' && !this.adjustmentPass) {\n                var ts = this.getLayoutTargetSize();\n                if (ts.width != size.width){\n                    this.adjustmentPass = true;\n                    this.onLayout(ct, target);\n                }\n            }\n        }\n        delete this.adjustmentPass;\n    }\n\n    /**\n     * @property activeItem\n     * @hide\n     */\n});\n\nExt.Container.LAYOUTS['ux.row'] = Ext.ux.layout.RowLayout;\n"
  },
  {
    "path": "client/src/ext/ux/SearchField.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.form');\n\nExt.ux.form.SearchField = Ext.extend(Ext.form.TwinTriggerField, {\n    initComponent : function(){\n        Ext.ux.form.SearchField.superclass.initComponent.call(this);\n        this.on('specialkey', function(f, e){\n            if(e.getKey() == e.ENTER){\n                this.onTrigger2Click();\n            }\n        }, this);\n    },\n\n    validationEvent:false,\n    validateOnBlur:false,\n    trigger1Class:'x-form-clear-trigger',\n    trigger2Class:'x-form-search-trigger',\n    hideTrigger1:true,\n    width:180,\n    hasSearch : false,\n    paramName : 'query',\n\n    onTrigger1Click : function(){\n        if(this.hasSearch){\n            this.el.dom.value = '';\n            var o = {start: 0};\n            this.store.baseParams = this.store.baseParams || {};\n            this.store.baseParams[this.paramName] = '';\n            this.store.reload({params:o});\n            this.triggers[0].hide();\n            this.hasSearch = false;\n        }\n    },\n\n    onTrigger2Click : function(){\n        var v = this.getRawValue();\n        if(v.length < 1){\n            this.onTrigger1Click();\n            return;\n        }\n        var o = {start: 0};\n        this.store.baseParams = this.store.baseParams || {};\n        this.store.baseParams[this.paramName] = v;\n        this.store.reload({params:o});\n        this.hasSearch = true;\n        this.triggers[0].show();\n    }\n});"
  },
  {
    "path": "client/src/ext/ux/SelectBox.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.form');\n\n/**\n * @class Ext.ux.form.SelectBox\n * @extends Ext.form.ComboBox\n * <p>Makes a ComboBox more closely mimic an HTML SELECT.  Supports clicking and dragging\n * through the list, with item selection occurring when the mouse button is released.\n * When used will automatically set {@link #editable} to false and call {@link Ext.Element#unselectable}\n * on inner elements.  Re-enabling editable after calling this will NOT work.</p>\n * @author Corey Gilmore http://extjs.com/forum/showthread.php?t=6392\n * @history 2007-07-08 jvs\n * Slight mods for Ext 2.0\n * @xtype selectbox\n */\nExt.ux.form.SelectBox = Ext.extend(Ext.form.ComboBox, {\n\tconstructor: function(config){\n\t\tthis.searchResetDelay = 1000;\n\t\tconfig = config || {};\n\t\tconfig = Ext.apply(config || {}, {\n\t\t\teditable: false,\n\t\t\tforceSelection: true,\n\t\t\trowHeight: false,\n\t\t\tlastSearchTerm: false,\n\t\t\ttriggerAction: 'all',\n\t\t\tmode: 'local'\n\t\t});\n\n\t\tExt.ux.form.SelectBox.superclass.constructor.apply(this, arguments);\n\n\t\tthis.lastSelectedIndex = this.selectedIndex || 0;\n\t},\n\n\tinitEvents : function(){\n\t\tExt.ux.form.SelectBox.superclass.initEvents.apply(this, arguments);\n\t\t// you need to use keypress to capture upper/lower case and shift+key, but it doesn't work in IE\n\t\tthis.el.on('keydown', this.keySearch, this, true);\n\t\tthis.cshTask = new Ext.util.DelayedTask(this.clearSearchHistory, this);\n\t},\n\n\tkeySearch : function(e, target, options) {\n\t\tvar raw = e.getKey();\n\t\tvar key = String.fromCharCode(raw);\n\t\tvar startIndex = 0;\n\n\t\tif( !this.store.getCount() ) {\n\t\t\treturn;\n\t\t}\n\n\t\tswitch(raw) {\n\t\t\tcase Ext.EventObject.HOME:\n\t\t\t\te.stopEvent();\n\t\t\t\tthis.selectFirst();\n\t\t\t\treturn;\n\n\t\t\tcase Ext.EventObject.END:\n\t\t\t\te.stopEvent();\n\t\t\t\tthis.selectLast();\n\t\t\t\treturn;\n\n\t\t\tcase Ext.EventObject.PAGEDOWN:\n\t\t\t\tthis.selectNextPage();\n\t\t\t\te.stopEvent();\n\t\t\t\treturn;\n\n\t\t\tcase Ext.EventObject.PAGEUP:\n\t\t\t\tthis.selectPrevPage();\n\t\t\t\te.stopEvent();\n\t\t\t\treturn;\n\t\t}\n\n\t\t// skip special keys other than the shift key\n\t\tif( (e.hasModifier() && !e.shiftKey) || e.isNavKeyPress() || e.isSpecialKey() ) {\n\t\t\treturn;\n\t\t}\n\t\tif( this.lastSearchTerm == key ) {\n\t\t\tstartIndex = this.lastSelectedIndex;\n\t\t}\n\t\tthis.search(this.displayField, key, startIndex);\n\t\tthis.cshTask.delay(this.searchResetDelay);\n\t},\n\n\tonRender : function(ct, position) {\n\t\tthis.store.on('load', this.calcRowsPerPage, this);\n\t\tExt.ux.form.SelectBox.superclass.onRender.apply(this, arguments);\n\t\tif( this.mode == 'local' ) {\n            this.initList();\n\t\t\tthis.calcRowsPerPage();\n\t\t}\n\t},\n\n\tonSelect : function(record, index, skipCollapse){\n\t\tif(this.fireEvent('beforeselect', this, record, index) !== false){\n\t\t\tthis.setValue(record.data[this.valueField || this.displayField]);\n\t\t\tif( !skipCollapse ) {\n\t\t\t\tthis.collapse();\n\t\t\t}\n\t\t\tthis.lastSelectedIndex = index + 1;\n\t\t\tthis.fireEvent('select', this, record, index);\n\t\t}\n\t},\n\n\tafterRender : function() {\n\t\tExt.ux.form.SelectBox.superclass.afterRender.apply(this, arguments);\n\t\tif(Ext.isWebKit) {\n\t\t\tthis.el.swallowEvent('mousedown', true);\n\t\t}\n\t\tthis.el.unselectable();\n\t\tthis.innerList.unselectable();\n\t\tthis.trigger.unselectable();\n\t\tthis.innerList.on('mouseup', function(e, target, options) {\n\t\t\tif( target.id && target.id == this.innerList.id ) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tthis.onViewClick();\n\t\t}, this);\n                this.mun(this.view, 'containerclick', this.onViewClick, this);\n                this.mun(this.view, 'click', this.onViewClick, this);\n\n\t\tthis.innerList.on('mouseover', function(e, target, options) {\n\t\t\tif( target.id && target.id == this.innerList.id ) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tthis.lastSelectedIndex = this.view.getSelectedIndexes()[0] + 1;\n\t\t\tthis.cshTask.delay(this.searchResetDelay);\n\t\t}, this);\n\n\t\tthis.trigger.un('click', this.onTriggerClick, this);\n\t\tthis.trigger.on('mousedown', function(e, target, options) {\n\t\t\te.preventDefault();\n\t\t\tthis.onTriggerClick();\n\t\t}, this);\n\n\t\tthis.on('collapse', function(e, target, options) {\n\t\t\tExt.getDoc().un('mouseup', this.collapseIf, this);\n\t\t}, this, true);\n\n\t\tthis.on('expand', function(e, target, options) {\n\t\t\tExt.getDoc().on('mouseup', this.collapseIf, this);\n\t\t}, this, true);\n\t},\n\n\tclearSearchHistory : function() {\n\t\tthis.lastSelectedIndex = 0;\n\t\tthis.lastSearchTerm = false;\n\t},\n\n\tselectFirst : function() {\n\t\tthis.focusAndSelect(this.store.data.first());\n\t},\n\n\tselectLast : function() {\n\t\tthis.focusAndSelect(this.store.data.last());\n\t},\n\n\tselectPrevPage : function() {\n\t\tif( !this.rowHeight ) {\n\t\t\treturn;\n\t\t}\n\t\tvar index = Math.max(this.selectedIndex-this.rowsPerPage, 0);\n\t\tthis.focusAndSelect(this.store.getAt(index));\n\t},\n\n\tselectNextPage : function() {\n\t\tif( !this.rowHeight ) {\n\t\t\treturn;\n\t\t}\n\t\tvar index = Math.min(this.selectedIndex+this.rowsPerPage, this.store.getCount() - 1);\n\t\tthis.focusAndSelect(this.store.getAt(index));\n\t},\n\n\tsearch : function(field, value, startIndex) {\n\t\tfield = field || this.displayField;\n\t\tthis.lastSearchTerm = value;\n\t\tvar index = this.store.find.apply(this.store, arguments);\n\t\tif( index !== -1 ) {\n\t\t\tthis.focusAndSelect(index);\n\t\t}\n\t},\n\n\tfocusAndSelect : function(record) {\n        var index = Ext.isNumber(record) ? record : this.store.indexOf(record);\n        this.select(index, this.isExpanded());\n        this.onSelect(this.store.getAt(index), index, this.isExpanded());\n\t},\n\n\tcalcRowsPerPage : function() {\n\t\tif( this.store.getCount() ) {\n\t\t\tthis.rowHeight = Ext.fly(this.view.getNode(0)).getHeight();\n\t\t\tthis.rowsPerPage = this.maxHeight / this.rowHeight;\n\t\t} else {\n\t\t\tthis.rowHeight = false;\n\t\t}\n\t}\n\n});\n\nExt.reg('selectbox', Ext.ux.form.SelectBox);\n\n//backwards compat\nExt.ux.SelectBox = Ext.ux.form.SelectBox;\n"
  },
  {
    "path": "client/src/ext/ux/SlidingPager.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * Plugin for PagingToolbar which replaces the textfield input with a slider \n */\nExt.ux.SlidingPager = Ext.extend(Object, {\n    init : function(pbar){\n        var idx = pbar.items.indexOf(pbar.inputItem);\n        Ext.each(pbar.items.getRange(idx - 2, idx + 2), function(c){\n            c.hide();\n        });\n        var slider = new Ext.Slider({\n            width: 114,\n            minValue: 1,\n            maxValue: 1,\n            plugins: new Ext.slider.Tip({\n                getText : function(thumb) {\n                    return String.format('Page <b>{0}</b> of <b>{1}</b>', thumb.value, thumb.slider.maxValue);\n                }\n            }),\n            listeners: {\n                changecomplete: function(s, v){\n                    pbar.changePage(v);\n                }\n            }\n        });\n        pbar.insert(idx + 1, slider);\n        pbar.on({\n            change: function(pb, data){\n                slider.setMaxValue(data.pages);\n                slider.setValue(data.activePage);\n            }\n        });\n    }\n});"
  },
  {
    "path": "client/src/ext/ux/Spinner.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * @class Ext.ux.Spinner\n * @extends Ext.util.Observable\n * Creates a Spinner control utilized by Ext.ux.form.SpinnerField\n */\nExt.ux.Spinner = Ext.extend(Ext.util.Observable, {\n    incrementValue: 1,\n    alternateIncrementValue: 5,\n    triggerClass: 'x-form-spinner-trigger',\n    splitterClass: 'x-form-spinner-splitter',\n    alternateKey: Ext.EventObject.shiftKey,\n    defaultValue: 0,\n    accelerate: false,\n\n    constructor: function(config){\n        Ext.ux.Spinner.superclass.constructor.call(this, config);\n        Ext.apply(this, config);\n        this.mimicing = false;\n    },\n\n    init: function(field){\n        this.field = field;\n\n        field.afterMethod('onRender', this.doRender, this);\n        field.afterMethod('onEnable', this.doEnable, this);\n        field.afterMethod('onDisable', this.doDisable, this);\n        field.afterMethod('afterRender', this.doAfterRender, this);\n        field.afterMethod('onResize', this.doResize, this);\n        field.afterMethod('onFocus', this.doFocus, this);\n        field.beforeMethod('onDestroy', this.doDestroy, this);\n    },\n\n    doRender: function(ct, position){\n        var el = this.el = this.field.getEl();\n        var f = this.field;\n\n        if (!f.wrap) {\n            f.wrap = this.wrap = el.wrap({\n                cls: \"x-form-field-wrap\"\n            });\n        }\n        else {\n            this.wrap = f.wrap.addClass('x-form-field-wrap');\n        }\n\n        this.trigger = this.wrap.createChild({\n            tag: \"img\",\n            src: Ext.BLANK_IMAGE_URL,\n            cls: \"x-form-trigger \" + this.triggerClass\n        });\n\n        if (!f.width) {\n            this.wrap.setWidth(el.getWidth() + this.trigger.getWidth());\n        }\n\n        this.splitter = this.wrap.createChild({\n            tag: 'div',\n            cls: this.splitterClass,\n            style: 'width:13px; height:2px;'\n        });\n        this.splitter.setRight((Ext.isIE) ? 1 : 2).setTop(10).show();\n\n        this.proxy = this.trigger.createProxy('', this.splitter, true);\n        this.proxy.addClass(\"x-form-spinner-proxy\");\n        this.proxy.setStyle('left', '0px');\n        this.proxy.setSize(14, 1);\n        this.proxy.hide();\n        this.dd = new Ext.dd.DDProxy(this.splitter.dom.id, \"SpinnerDrag\", {\n            dragElId: this.proxy.id\n        });\n\n        this.initTrigger();\n        this.initSpinner();\n    },\n\n    doAfterRender: function(){\n        var y;\n        if (Ext.isIE && this.el.getY() != (y = this.trigger.getY())) {\n            this.el.position();\n            this.el.setY(y);\n        }\n    },\n\n    doEnable: function(){\n        if (this.wrap) {\n            this.disabled = false;\n            this.wrap.removeClass(this.field.disabledClass);\n        }\n    },\n\n    doDisable: function(){\n        if (this.wrap) {\n\t        this.disabled = true;\n            this.wrap.addClass(this.field.disabledClass);\n            this.el.removeClass(this.field.disabledClass);\n        }\n    },\n\n    doResize: function(w, h){\n        if (typeof w == 'number') {\n            this.el.setWidth(w - this.trigger.getWidth());\n        }\n        this.wrap.setWidth(this.el.getWidth() + this.trigger.getWidth());\n    },\n\n    doFocus: function(){\n        if (!this.mimicing) {\n            this.wrap.addClass('x-trigger-wrap-focus');\n            this.mimicing = true;\n            Ext.get(Ext.isIE ? document.body : document).on(\"mousedown\", this.mimicBlur, this, {\n                delay: 10\n            });\n            this.el.on('keydown', this.checkTab, this);\n        }\n    },\n\n    // private\n    checkTab: function(e){\n        if (e.getKey() == e.TAB) {\n            this.triggerBlur();\n        }\n    },\n\n    // private\n    mimicBlur: function(e){\n        if (!this.wrap.contains(e.target) && this.field.validateBlur(e)) {\n            this.triggerBlur();\n        }\n    },\n\n    // private\n    triggerBlur: function(){\n        this.mimicing = false;\n        Ext.get(Ext.isIE ? document.body : document).un(\"mousedown\", this.mimicBlur, this);\n        this.el.un(\"keydown\", this.checkTab, this);\n        this.field.beforeBlur();\n        this.wrap.removeClass('x-trigger-wrap-focus');\n        this.field.onBlur.call(this.field);\n    },\n\n    initTrigger: function(){\n        this.trigger.addClassOnOver('x-form-trigger-over');\n        this.trigger.addClassOnClick('x-form-trigger-click');\n    },\n\n    initSpinner: function(){\n        this.field.addEvents({\n            'spin': true,\n            'spinup': true,\n            'spindown': true\n        });\n\n        this.keyNav = new Ext.KeyNav(this.el, {\n            \"up\": function(e){\n                e.preventDefault();\n                this.onSpinUp();\n            },\n\n            \"down\": function(e){\n                e.preventDefault();\n                this.onSpinDown();\n            },\n\n            \"pageUp\": function(e){\n                e.preventDefault();\n                this.onSpinUpAlternate();\n            },\n\n            \"pageDown\": function(e){\n                e.preventDefault();\n                this.onSpinDownAlternate();\n            },\n\n            scope: this\n        });\n\n        this.repeater = new Ext.util.ClickRepeater(this.trigger, {\n            accelerate: this.accelerate\n        });\n        this.field.mon(this.repeater, \"click\", this.onTriggerClick, this, {\n            preventDefault: true\n        });\n\n        this.field.mon(this.trigger, {\n            mouseover: this.onMouseOver,\n            mouseout: this.onMouseOut,\n            mousemove: this.onMouseMove,\n            mousedown: this.onMouseDown,\n            mouseup: this.onMouseUp,\n            scope: this,\n            preventDefault: true\n        });\n\n        this.field.mon(this.wrap, \"mousewheel\", this.handleMouseWheel, this);\n\n        this.dd.setXConstraint(0, 0, 10)\n        this.dd.setYConstraint(1500, 1500, 10);\n        this.dd.endDrag = this.endDrag.createDelegate(this);\n        this.dd.startDrag = this.startDrag.createDelegate(this);\n        this.dd.onDrag = this.onDrag.createDelegate(this);\n    },\n\n    onMouseOver: function(){\n        if (this.disabled) {\n            return;\n        }\n        var middle = this.getMiddle();\n        this.tmpHoverClass = (Ext.EventObject.getPageY() < middle) ? 'x-form-spinner-overup' : 'x-form-spinner-overdown';\n        this.trigger.addClass(this.tmpHoverClass);\n    },\n\n    //private\n    onMouseOut: function(){\n        this.trigger.removeClass(this.tmpHoverClass);\n    },\n\n    //private\n    onMouseMove: function(){\n        if (this.disabled) {\n            return;\n        }\n        var middle = this.getMiddle();\n        if (((Ext.EventObject.getPageY() > middle) && this.tmpHoverClass == \"x-form-spinner-overup\") ||\n        ((Ext.EventObject.getPageY() < middle) && this.tmpHoverClass == \"x-form-spinner-overdown\")) {\n        }\n    },\n\n    //private\n    onMouseDown: function(){\n        if (this.disabled) {\n            return;\n        }\n        var middle = this.getMiddle();\n        this.tmpClickClass = (Ext.EventObject.getPageY() < middle) ? 'x-form-spinner-clickup' : 'x-form-spinner-clickdown';\n        this.trigger.addClass(this.tmpClickClass);\n    },\n\n    //private\n    onMouseUp: function(){\n        this.trigger.removeClass(this.tmpClickClass);\n    },\n\n    //private\n    onTriggerClick: function(){\n        if (this.disabled || this.el.dom.readOnly) {\n            return;\n        }\n        var middle = this.getMiddle();\n        var ud = (Ext.EventObject.getPageY() < middle) ? 'Up' : 'Down';\n        this['onSpin' + ud]();\n    },\n\n    //private\n    getMiddle: function(){\n        var t = this.trigger.getTop();\n        var h = this.trigger.getHeight();\n        var middle = t + (h / 2);\n        return middle;\n    },\n\n    //private\n    //checks if control is allowed to spin\n    isSpinnable: function(){\n        if (this.disabled || this.el.dom.readOnly) {\n            Ext.EventObject.preventDefault(); //prevent scrolling when disabled/readonly\n            return false;\n        }\n        return true;\n    },\n\n    handleMouseWheel: function(e){\n        //disable scrolling when not focused\n        if (this.wrap.hasClass('x-trigger-wrap-focus') == false) {\n            return;\n        }\n\n        var delta = e.getWheelDelta();\n        if (delta > 0) {\n            this.onSpinUp();\n            e.stopEvent();\n        }\n        else\n            if (delta < 0) {\n                this.onSpinDown();\n                e.stopEvent();\n            }\n    },\n\n    //private\n    startDrag: function(){\n        this.proxy.show();\n        this._previousY = Ext.fly(this.dd.getDragEl()).getTop();\n    },\n\n    //private\n    endDrag: function(){\n        this.proxy.hide();\n    },\n\n    //private\n    onDrag: function(){\n        if (this.disabled) {\n            return;\n        }\n        var y = Ext.fly(this.dd.getDragEl()).getTop();\n        var ud = '';\n\n        if (this._previousY > y) {\n            ud = 'Up';\n        } //up\n        if (this._previousY < y) {\n            ud = 'Down';\n        } //down\n        if (ud != '') {\n            this['onSpin' + ud]();\n        }\n\n        this._previousY = y;\n    },\n\n    //private\n    onSpinUp: function(){\n        if (this.isSpinnable() == false) {\n            return;\n        }\n        if (Ext.EventObject.shiftKey == true) {\n            this.onSpinUpAlternate();\n            return;\n        }\n        else {\n            this.spin(false, false);\n        }\n        this.field.fireEvent(\"spin\", this);\n        this.field.fireEvent(\"spinup\", this);\n    },\n\n    //private\n    onSpinDown: function(){\n        if (this.isSpinnable() == false) {\n            return;\n        }\n        if (Ext.EventObject.shiftKey == true) {\n            this.onSpinDownAlternate();\n            return;\n        }\n        else {\n            this.spin(true, false);\n        }\n        this.field.fireEvent(\"spin\", this);\n        this.field.fireEvent(\"spindown\", this);\n    },\n\n    //private\n    onSpinUpAlternate: function(){\n        if (this.isSpinnable() == false) {\n            return;\n        }\n        this.spin(false, true);\n        this.field.fireEvent(\"spin\", this);\n        this.field.fireEvent(\"spinup\", this);\n    },\n\n    //private\n    onSpinDownAlternate: function(){\n        if (this.isSpinnable() == false) {\n            return;\n        }\n        this.spin(true, true);\n        this.field.fireEvent(\"spin\", this);\n        this.field.fireEvent(\"spindown\", this);\n    },\n\n    spin: function(down, alternate){\n        var v = parseFloat(this.field.getValue());\n        var incr = (alternate == true) ? this.alternateIncrementValue : this.incrementValue;\n        (down == true) ? v -= incr : v += incr;\n\n        v = (isNaN(v)) ? this.defaultValue : v;\n        v = this.fixBoundries(v);\n        this.field.setRawValue(v);\n    },\n\n    fixBoundries: function(value){\n        var v = value;\n\n        if (this.field.minValue != undefined && v < this.field.minValue) {\n            v = this.field.minValue;\n        }\n        if (this.field.maxValue != undefined && v > this.field.maxValue) {\n            v = this.field.maxValue;\n        }\n\n        return this.fixPrecision(v);\n    },\n\n    // private\n    fixPrecision: function(value){\n        var nan = isNaN(value);\n        if (!this.field.allowDecimals || this.field.decimalPrecision == -1 || nan || !value) {\n            return nan ? '' : value;\n        }\n        return parseFloat(parseFloat(value).toFixed(this.field.decimalPrecision));\n    },\n\n    doDestroy: function(){\n        if (this.trigger) {\n            this.trigger.remove();\n        }\n        if (this.wrap) {\n            this.wrap.remove();\n            delete this.field.wrap;\n        }\n\n        if (this.splitter) {\n            this.splitter.remove();\n        }\n\n        if (this.dd) {\n            this.dd.unreg();\n            this.dd = null;\n        }\n\n        if (this.proxy) {\n            this.proxy.remove();\n        }\n\n        if (this.repeater) {\n            this.repeater.purgeListeners();\n        }\n        if (this.mimicing){\n            Ext.get(Ext.isIE ? document.body : document).un(\"mousedown\", this.mimicBlur, this);\n        }\n    }\n});\n\n//backwards compat\nExt.form.Spinner = Ext.ux.Spinner;"
  },
  {
    "path": "client/src/ext/ux/SpinnerField.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.form');\n\n/**\n * @class Ext.ux.form.SpinnerField\n * @extends Ext.form.NumberField\n * Creates a field utilizing Ext.ux.Spinner\n * @xtype spinnerfield\n */\nExt.ux.form.SpinnerField = Ext.extend(Ext.form.NumberField, {\n    actionMode: 'wrap',\n    deferHeight: true,\n    autoSize: Ext.emptyFn,\n    onBlur: Ext.emptyFn,\n    adjustSize: Ext.BoxComponent.prototype.adjustSize,\n\n\tconstructor: function(config) {\n\t\tvar spinnerConfig = Ext.copyTo({}, config, 'incrementValue,alternateIncrementValue,accelerate,defaultValue,triggerClass,splitterClass');\n\n\t\tvar spl = this.spinner = new Ext.ux.Spinner(spinnerConfig);\n\n\t\tvar plugins = config.plugins\n\t\t\t? (Ext.isArray(config.plugins)\n\t\t\t\t? config.plugins.push(spl)\n\t\t\t\t: [config.plugins, spl])\n\t\t\t: spl;\n\n\t\tExt.ux.form.SpinnerField.superclass.constructor.call(this, Ext.apply(config, {plugins: plugins}));\n\t},\n\n    // private\n    getResizeEl: function(){\n        return this.wrap;\n    },\n\n    // private\n    getPositionEl: function(){\n        return this.wrap;\n    },\n\n    // private\n    alignErrorIcon: function(){\n        if (this.wrap) {\n            this.errorIcon.alignTo(this.wrap, 'tl-tr', [2, 0]);\n        }\n    },\n\n    validateBlur: function(){\n        return true;\n    }\n});\n\nExt.reg('spinnerfield', Ext.ux.form.SpinnerField);\n\n//backwards compat\nExt.form.SpinnerField = Ext.ux.form.SpinnerField;\n"
  },
  {
    "path": "client/src/ext/ux/Spotlight.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ux.Spotlight = function(config){\n    Ext.apply(this, config);\n}\nExt.ux.Spotlight.prototype = {\n    active : false,\n    animate : true,\n    duration: .25,\n    easing:'easeNone',\n\n    // private\n    animated : false,\n\n    createElements : function(){\n        var bd = Ext.getBody();\n\n        this.right = bd.createChild({cls:'x-spotlight'});\n        this.left = bd.createChild({cls:'x-spotlight'});\n        this.top = bd.createChild({cls:'x-spotlight'});\n        this.bottom = bd.createChild({cls:'x-spotlight'});\n\n        this.all = new Ext.CompositeElement([this.right, this.left, this.top, this.bottom]);\n    },\n\n    show : function(el, callback, scope){\n        if(this.animated){\n            this.show.defer(50, this, [el, callback, scope]);\n            return;\n        }\n        this.el = Ext.get(el);\n        if(!this.right){\n            this.createElements();\n        }\n        if(!this.active){\n            this.all.setDisplayed('');\n            this.applyBounds(true, false);\n            this.active = true;\n            Ext.EventManager.onWindowResize(this.syncSize, this);\n            this.applyBounds(false, this.animate, false, callback, scope);\n        }else{\n            this.applyBounds(false, false, false, callback, scope); // all these booleans look hideous\n        }\n    },\n\n    hide : function(callback, scope){\n        if(this.animated){\n            this.hide.defer(50, this, [callback, scope]);\n            return;\n        }\n        Ext.EventManager.removeResizeListener(this.syncSize, this);\n        this.applyBounds(true, this.animate, true, callback, scope);\n    },\n\n    doHide : function(){\n        this.active = false;\n        this.all.setDisplayed(false);\n    },\n\n    syncSize : function(){\n        this.applyBounds(false, false);\n    },\n\n    applyBounds : function(basePts, anim, doHide, callback, scope){\n\n        var rg = this.el.getRegion();\n\n        var dw = Ext.lib.Dom.getViewWidth(true);\n        var dh = Ext.lib.Dom.getViewHeight(true);\n\n        var c = 0, cb = false;\n        if(anim){\n            cb = {\n                callback: function(){\n                    c++;\n                    if(c == 4){\n                        this.animated = false;\n                        if(doHide){\n                            this.doHide();\n                        }\n                        Ext.callback(callback, scope, [this]);\n                    }\n                },\n                scope: this,\n                duration: this.duration,\n                easing: this.easing\n            };\n            this.animated = true;\n        }\n\n        this.right.setBounds(\n                rg.right,\n                basePts ? dh : rg.top,\n                dw - rg.right,\n                basePts ? 0 : (dh - rg.top),\n                cb);\n\n        this.left.setBounds(\n                0,\n                0,\n                rg.left,\n                basePts ? 0 : rg.bottom,\n                cb);\n\n        this.top.setBounds(\n                basePts ? dw : rg.left,\n                0,\n                basePts ? 0 : dw - rg.left,\n                rg.top,\n                cb);\n\n        this.bottom.setBounds(\n                0,\n                rg.bottom,\n                basePts ? 0 : rg.right,\n                dh - rg.bottom,\n                cb);\n\n        if(!anim){\n            if(doHide){\n                this.doHide();\n            }\n            if(callback){\n                Ext.callback(callback, scope, [this]);\n            }\n        }\n    },\n\n    destroy : function(){\n        this.doHide();\n        Ext.destroy(\n            this.right,\n            this.left,\n            this.top,\n            this.bottom);\n        delete this.el;\n        delete this.all;\n    }\n};\n\n//backwards compat\nExt.Spotlight = Ext.ux.Spotlight;"
  },
  {
    "path": "client/src/ext/ux/TabCloseMenu.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * @class Ext.ux.TabCloseMenu\n * @extends Object \n * Plugin (ptype = 'tabclosemenu') for adding a close context menu to tabs. Note that the menu respects\n * the closable configuration on the tab. As such, commands like remove others and remove all will not\n * remove items that are not closable.\n * \n * @constructor\n * @param {Object} config The configuration options\n * @ptype tabclosemenu\n */\nExt.ux.TabCloseMenu = Ext.extend(Object, {\n    /**\n     * @cfg {String} closeTabText\n     * The text for closing the current tab. Defaults to <tt>'Close Tab'</tt>.\n     */\n    closeTabText: 'Close Tab',\n\n    /**\n     * @cfg {String} closeOtherTabsText\n     * The text for closing all tabs except the current one. Defaults to <tt>'Close Other Tabs'</tt>.\n     */\n    closeOtherTabsText: 'Close Other Tabs',\n    \n    /**\n     * @cfg {Boolean} showCloseAll\n     * Indicates whether to show the 'Close All' option. Defaults to <tt>true</tt>. \n     */\n    showCloseAll: true,\n\n    /**\n     * @cfg {String} closeAllTabsText\n     * <p>The text for closing all tabs. Defaults to <tt>'Close All Tabs'</tt>.\n     */\n    closeAllTabsText: 'Close All Tabs',\n    \n    constructor : function(config){\n        Ext.apply(this, config || {});\n    },\n\n    //public\n    init : function(tabs){\n        this.tabs = tabs;\n        tabs.on({\n            scope: this,\n            contextmenu: this.onContextMenu,\n            destroy: this.destroy\n        });\n    },\n    \n    destroy : function(){\n        Ext.destroy(this.menu);\n        delete this.menu;\n        delete this.tabs;\n        delete this.active;    \n    },\n\n    // private\n    onContextMenu : function(tabs, item, e){\n        this.active = item;\n        var m = this.createMenu(),\n            disableAll = true,\n            disableOthers = true,\n            closeAll = m.getComponent('closeall');\n        \n        m.getComponent('close').setDisabled(!item.closable);\n        tabs.items.each(function(){\n            if(this.closable){\n                disableAll = false;\n                if(this != item){\n                    disableOthers = false;\n                    return false;\n                }\n            }\n        });\n        m.getComponent('closeothers').setDisabled(disableOthers);\n        if(closeAll){\n            closeAll.setDisabled(disableAll);\n        }\n        \n        e.stopEvent();\n        m.showAt(e.getPoint());\n    },\n    \n    createMenu : function(){\n        if(!this.menu){\n            var items = [{\n                itemId: 'close',\n                text: this.closeTabText,\n                scope: this,\n                handler: this.onClose\n            }];\n            if(this.showCloseAll){\n                items.push('-');\n            }\n            items.push({\n                itemId: 'closeothers',\n                text: this.closeOtherTabsText,\n                scope: this,\n                handler: this.onCloseOthers\n            });\n            if(this.showCloseAll){\n                items.push({\n                    itemId: 'closeall',\n                    text: this.closeAllTabsText,\n                    scope: this,\n                    handler: this.onCloseAll\n                });\n            }\n            this.menu = new Ext.menu.Menu({\n                items: items\n            });\n        }\n        return this.menu;\n    },\n    \n    onClose : function(){\n        this.tabs.remove(this.active);\n    },\n    \n    onCloseOthers : function(){\n        this.doClose(true);\n    },\n    \n    onCloseAll : function(){\n        this.doClose(false);\n    },\n    \n    doClose : function(excludeActive){\n        var items = [];\n        this.tabs.items.each(function(item){\n            if(item.closable){\n                if(!excludeActive || item != this.active){\n                    items.push(item);\n                }    \n            }\n        }, this);\n        Ext.each(items, function(item){\n            this.tabs.remove(item);\n        }, this);\n    }\n});\n\nExt.preg('tabclosemenu', Ext.ux.TabCloseMenu);"
  },
  {
    "path": "client/src/ext/ux/TabScrollerMenu.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux');\n/**\n * @class Ext.ux.TabScrollerMenu\n * @extends Object \n * Plugin (ptype = 'tabscrollermenu') for adding a tab scroller menu to tabs.\n * @constructor \n * @param {Object} config Configuration options\n * @ptype tabscrollermenu\n */\nExt.ux.TabScrollerMenu =  Ext.extend(Object, {\n    /**\n     * @cfg {Number} pageSize How many items to allow per submenu.\n     */\n\tpageSize       : 10,\n    /**\n     * @cfg {Number} maxText How long should the title of each {@link Ext.menu.Item} be.\n     */\n\tmaxText        : 15,\n    /**\n     * @cfg {String} menuPrefixText Text to prefix the submenus.\n     */    \n\tmenuPrefixText : 'Items',\n\tconstructor    : function(config) {\n\t\tconfig = config || {};\n\t\tExt.apply(this, config);\n\t},\n    //private\n\tinit : function(tabPanel) {\n\t\tExt.apply(tabPanel, this.parentOverrides);\n\t\t\n\t\ttabPanel.tabScrollerMenu = this;\n\t\tvar thisRef = this;\n\t\t\n\t\ttabPanel.on({\n\t\t\trender : {\n\t\t\t\tscope  : tabPanel,\n\t\t\t\tsingle : true,\n\t\t\t\tfn     : function() { \n\t\t\t\t\tvar newFn = tabPanel.createScrollers.createSequence(thisRef.createPanelsMenu, this);\n\t\t\t\t\ttabPanel.createScrollers = newFn;\n\t\t\t\t}\n\t\t\t}\n\t\t});\n\t},\n\t// private && sequeneced\n\tcreatePanelsMenu : function() {\n\t\tvar h = this.stripWrap.dom.offsetHeight;\n\t\t\n\t\t//move the right menu item to the left 18px\n\t\tvar rtScrBtn = this.header.dom.firstChild;\n\t\tExt.fly(rtScrBtn).applyStyles({\n\t\t\tright : '18px'\n\t\t});\n\t\t\n\t\tvar stripWrap = Ext.get(this.strip.dom.parentNode);\n\t\tstripWrap.applyStyles({\n\t\t\t 'margin-right' : '36px'\n\t\t});\n\t\t\n\t\t// Add the new righthand menu\n\t\tvar scrollMenu = this.header.insertFirst({\n\t\t\tcls:'x-tab-tabmenu-right'\n\t\t});\n\t\tscrollMenu.setHeight(h);\n\t\tscrollMenu.addClassOnOver('x-tab-tabmenu-over');\n\t\tscrollMenu.on('click', this.showTabsMenu, this);\t\n\t\t\n\t\tthis.scrollLeft.show = this.scrollLeft.show.createSequence(function() {\n\t\t\tscrollMenu.show();\t\t\t\t\t\t\t\t\t\t\t\t \t\t\t\t\t\t \n\t\t});\n\t\t\n\t\tthis.scrollLeft.hide = this.scrollLeft.hide.createSequence(function() {\n\t\t\tscrollMenu.hide();\t\t\t\t\t\t\t\t\n\t\t});\n\t\t\n\t},\n    /**\n     * Returns an the current page size (this.pageSize);\n     * @return {Number} this.pageSize The current page size.\n     */\n\tgetPageSize : function() {\n\t\treturn this.pageSize;\n\t},\n    /**\n     * Sets the number of menu items per submenu \"page size\".\n     * @param {Number} pageSize The page size\n     */\n    setPageSize : function(pageSize) {\n\t\tthis.pageSize = pageSize;\n\t},\n    /**\n     * Returns the current maxText length;\n     * @return {Number} this.maxText The current max text length.\n     */\n    getMaxText : function() {\n\t\treturn this.maxText;\n\t},\n    /**\n     * Sets the maximum text size for each menu item.\n     * @param {Number} t The max text per each menu item.\n     */\n    setMaxText : function(t) {\n\t\tthis.maxText = t;\n\t},\n    /**\n     * Returns the current menu prefix text String.;\n     * @return {String} this.menuPrefixText The current menu prefix text.\n     */\n\tgetMenuPrefixText : function() {\n\t\treturn this.menuPrefixText;\n\t},\n    /**\n     * Sets the menu prefix text String.\n     * @param {String} t The menu prefix text.\n     */    \n\tsetMenuPrefixText : function(t) {\n\t\tthis.menuPrefixText = t;\n\t},\n\t// private && applied to the tab panel itself.\n\tparentOverrides : {\n\t\t// all execute within the scope of the tab panel\n\t\t// private\t\n\t\tshowTabsMenu : function(e) {\t\t\n\t\t\tif  (this.tabsMenu) {\n\t\t\t\tthis.tabsMenu.destroy();\n                this.un('destroy', this.tabsMenu.destroy, this.tabsMenu);\n                this.tabsMenu = null;\n\t\t\t}\n            this.tabsMenu =  new Ext.menu.Menu();\n            this.on('destroy', this.tabsMenu.destroy, this.tabsMenu);\n\n            this.generateTabMenuItems();\n\n            var target = Ext.get(e.getTarget());\n\t\t\tvar xy     = target.getXY();\n//\n\t\t\t//Y param + 24 pixels\n\t\t\txy[1] += 24;\n\t\t\t\n\t\t\tthis.tabsMenu.showAt(xy);\n\t\t},\n\t\t// private\t\n\t\tgenerateTabMenuItems : function() {\n\t\t\tvar curActive  = this.getActiveTab();\n\t\t\tvar totalItems = this.items.getCount();\n\t\t\tvar pageSize   = this.tabScrollerMenu.getPageSize();\n\t\t\t\n\t\t\t\n\t\t\tif (totalItems > pageSize)  {\n\t\t\t\tvar numSubMenus = Math.floor(totalItems / pageSize);\n\t\t\t\tvar remainder   = totalItems % pageSize;\n\t\t\t\t\n\t\t\t\t// Loop through all of the items and create submenus in chunks of 10\n\t\t\t\tfor (var i = 0 ; i < numSubMenus; i++) {\n\t\t\t\t\tvar curPage = (i + 1) * pageSize;\n\t\t\t\t\tvar menuItems = [];\n\t\t\t\t\t\n\t\t\t\t\t\n\t\t\t\t\tfor (var x = 0; x < pageSize; x++) {\t\t\t\t\n\t\t\t\t\t\tindex = x + curPage - pageSize;\n\t\t\t\t\t\tvar item = this.items.get(index);\n\t\t\t\t\t\tmenuItems.push(this.autoGenMenuItem(item));\n\t\t\t\t\t}\n\t\t\t\t\t\n\t\t\t\t\tthis.tabsMenu.add({\n\t\t\t\t\t\ttext : this.tabScrollerMenu.getMenuPrefixText() + ' '  + (curPage - pageSize + 1) + ' - ' + curPage,\n\t\t\t\t\t\tmenu : menuItems\n\t\t\t\t\t});\n\t\t\t\t\t\n\t\t\t\t}\n\t\t\t\t// remaining items\n\t\t\t\tif (remainder > 0) {\n\t\t\t\t\tvar start = numSubMenus * pageSize;\n\t\t\t\t\tmenuItems = [];\n\t\t\t\t\tfor (var i = start ; i < totalItems; i ++ ) {\t\t\t\t\t\n\t\t\t\t\t\tvar item = this.items.get(i);\n\t\t\t\t\t\tmenuItems.push(this.autoGenMenuItem(item));\n\t\t\t\t\t}\n\t\t\t\t\t\n\t\t\t\t\tthis.tabsMenu.add({\n\t\t\t\t\t\ttext : this.tabScrollerMenu.menuPrefixText  + ' ' + (start + 1) + ' - ' + (start + menuItems.length),\n\t\t\t\t\t\tmenu : menuItems\n\t\t\t\t\t});\n\n\t\t\t\t}\n\t\t\t}\n\t\t\telse {\n\t\t\t\tthis.items.each(function(item) {\n\t\t\t\t\tif (item.id != curActive.id && !item.hidden) {\n                        this.tabsMenu.add(this.autoGenMenuItem(item));\n\t\t\t\t\t}\n\t\t\t\t}, this);\n\t\t\t}\n\t\t},\n\t\t// private\n\t\tautoGenMenuItem : function(item) {\n\t\t\tvar maxText = this.tabScrollerMenu.getMaxText();\n\t\t\tvar text    = Ext.util.Format.ellipsis(item.title, maxText);\n\t\t\t\n\t\t\treturn {\n\t\t\t\ttext      : text,\n\t\t\t\thandler   : this.showTabFromMenu,\n\t\t\t\tscope     : this,\n\t\t\t\tdisabled  : item.disabled,\n\t\t\t\ttabToShow : item,\n\t\t\t\ticonCls   : item.iconCls\n\t\t\t}\n\t\t\n\t\t},\n\t\t// private\n\t\tshowTabFromMenu : function(menuItem) {\n\t\t\tthis.setActiveTab(menuItem.tabToShow);\n\t\t}\t\n\t}\t\n});\n\nExt.reg('tabscrollermenu', Ext.ux.TabScrollerMenu);\n"
  },
  {
    "path": "client/src/ext/ux/TableGrid.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.TableGrid\n * @extends Ext.grid.GridPanel\n * A Grid which creates itself from an existing HTML table element.\n * @history\n * 2007-03-01 Original version by Nige \"Animal\" White\n * 2007-03-10 jvs Slightly refactored to reuse existing classes * @constructor\n * @param {String/HTMLElement/Ext.Element} table The table element from which this grid will be created -\n * The table MUST have some type of size defined for the grid to fill. The container will be\n * automatically set to position relative if it isn't already.\n * @param {Object} config A config object that sets properties on this grid and has two additional (optional)\n * properties: fields and columns which allow for customizing data fields and columns for this grid.\n */\nExt.ux.grid.TableGrid = function(table, config){\n    config = config ||\n    {};\n    Ext.apply(this, config);\n    var cf = config.fields || [], ch = config.columns || [];\n    table = Ext.get(table);\n    \n    var ct = table.insertSibling();\n    \n    var fields = [], cols = [];\n    var headers = table.query(\"thead th\");\n    for (var i = 0, h; h = headers[i]; i++) {\n        var text = h.innerHTML;\n        var name = 'tcol-' + i;\n        \n        fields.push(Ext.applyIf(cf[i] ||\n        {}, {\n            name: name,\n            mapping: 'td:nth(' + (i + 1) + ')/@innerHTML'\n        }));\n        \n        cols.push(Ext.applyIf(ch[i] ||\n        {}, {\n            'header': text,\n            'dataIndex': name,\n            'width': h.offsetWidth,\n            'tooltip': h.title,\n            'sortable': true\n        }));\n    }\n    \n    var ds = new Ext.data.Store({\n        reader: new Ext.data.XmlReader({\n            record: 'tbody tr'\n        }, fields)\n    });\n    \n    ds.loadData(table.dom);\n    \n    var cm = new Ext.grid.ColumnModel(cols);\n    \n    if (config.width || config.height) {\n        ct.setSize(config.width || 'auto', config.height || 'auto');\n    }\n    else {\n        ct.setWidth(table.getWidth());\n    }\n    \n    if (config.remove !== false) {\n        table.remove();\n    }\n    \n    Ext.applyIf(this, {\n        'ds': ds,\n        'cm': cm,\n        'sm': new Ext.grid.RowSelectionModel(),\n        autoHeight: true,\n        autoWidth: false\n    });\n    Ext.ux.grid.TableGrid.superclass.constructor.call(this, ct, {});\n};\n\nExt.extend(Ext.ux.grid.TableGrid, Ext.grid.GridPanel);\n\n//backwards compat\nExt.grid.TableGrid = Ext.ux.grid.TableGrid;\n"
  },
  {
    "path": "client/src/ext/ux/ToolbarDroppable.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * @class Ext.ux.ToolbarDroppable\n * @extends Object\n * Plugin which allows items to be dropped onto a toolbar and be turned into new Toolbar items.\n * To use the plugin, you just need to provide a createItem implementation that takes the drop\n * data as an argument and returns an object that can be placed onto the toolbar. Example:\n * <pre>\n * new Ext.ux.ToolbarDroppable({\n *   createItem: function(data) {\n *     return new Ext.Button({text: data.text});\n *   }\n * });\n * </pre>\n * The afterLayout function can also be overridden, and is called after a new item has been \n * created and inserted into the Toolbar. Use this for any logic that needs to be run after\n * the item has been created.\n */\nExt.ux.ToolbarDroppable = Ext.extend(Object, {\n    /**\n     * @constructor\n     */\n    constructor: function(config) {\n      Ext.apply(this, config, {\n          \n      });\n    },\n    \n    /**\n     * Initializes the plugin and saves a reference to the toolbar\n     * @param {Ext.Toolbar} toolbar The toolbar instance\n     */\n    init: function(toolbar) {\n      /**\n       * @property toolbar\n       * @type Ext.Toolbar\n       * The toolbar instance that this plugin is tied to\n       */\n      this.toolbar = toolbar;\n      \n      this.toolbar.on({\n          scope : this,\n          render: this.createDropTarget\n      });\n    },\n    \n    /**\n     * Creates a drop target on the toolbar\n     */\n    createDropTarget: function() {\n        /**\n         * @property dropTarget\n         * @type Ext.dd.DropTarget\n         * The drop target attached to the toolbar instance\n         */\n        this.dropTarget = new Ext.dd.DropTarget(this.toolbar.getEl(), {\n            notifyOver: this.notifyOver.createDelegate(this),\n            notifyDrop: this.notifyDrop.createDelegate(this)\n        });\n    },\n    \n    /**\n     * Adds the given DD Group to the drop target\n     * @param {String} ddGroup The DD Group\n     */\n    addDDGroup: function(ddGroup) {\n        this.dropTarget.addToGroup(ddGroup);\n    },\n    \n    /**\n     * Calculates the location on the toolbar to create the new sorter button based on the XY of the\n     * drag event\n     * @param {Ext.EventObject} e The event object\n     * @return {Number} The index at which to insert the new button\n     */\n    calculateEntryIndex: function(e) {\n        var entryIndex = 0,\n            toolbar    = this.toolbar,\n            items      = toolbar.items.items,\n            count      = items.length,\n            xTotal     = toolbar.getEl().getXY()[0],\n            xHover     = e.getXY()[0] - xTotal;\n        \n        for (var index = 0; index < count; index++) {\n            var item     = items[index],\n                width    = item.getEl().getWidth(),\n                midpoint = xTotal + width / 2;\n            \n            xTotal += width;\n            \n            if (xHover < midpoint) {\n                entryIndex = index;       \n\n                break;\n            } else {\n                entryIndex = index + 1;\n            }\n        }\n        \n        return entryIndex;\n    },\n    \n    /**\n     * Returns true if the drop is allowed on the drop target. This function can be overridden\n     * and defaults to simply return true\n     * @param {Object} data Arbitrary data from the drag source\n     * @return {Boolean} True if the drop is allowed\n     */\n    canDrop: function(data) {\n        return true;\n    },\n    \n    /**\n     * Custom notifyOver method which will be used in the plugin's internal DropTarget\n     * @return {String} The CSS class to add\n     */\n    notifyOver: function(dragSource, event, data) {\n        return this.canDrop.apply(this, arguments) ? this.dropTarget.dropAllowed : this.dropTarget.dropNotAllowed;\n    },\n    \n    /**\n     * Called when the drop has been made. Creates the new toolbar item, places it at the correct location\n     * and calls the afterLayout callback.\n     */\n    notifyDrop: function(dragSource, event, data) {\n        var canAdd = this.canDrop(dragSource, event, data),\n            tbar   = this.toolbar;\n        \n        if (canAdd) {\n            var entryIndex = this.calculateEntryIndex(event);\n            \n            tbar.insert(entryIndex, this.createItem(data));\n            tbar.doLayout();\n            \n            this.afterLayout();\n        }\n        \n        return canAdd;\n    },\n    \n    /**\n     * Creates the new toolbar item based on drop data. This method must be implemented by the plugin instance\n     * @param {Object} data Arbitrary data from the drop\n     * @return {Mixed} An item that can be added to a toolbar\n     */\n    createItem: function(data) {\n        throw new Error(\"The createItem method must be implemented in the ToolbarDroppable plugin\");\n    },\n    \n    /**\n     * Called after a new button has been created and added to the toolbar. Add any required cleanup logic here\n     */\n    afterLayout: Ext.emptyFn\n});"
  },
  {
    "path": "client/src/ext/ux/ToolbarReorderer.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * @class Ext.ux.ToolbarReorderer\n * @extends Ext.ux.Reorderer\n * Plugin which can be attached to any Ext.Toolbar instance. Provides ability to reorder toolbar items\n * with drag and drop. Example:\n * <pre>\n * new Ext.Toolbar({\n *     plugins: [\n *         new Ext.ux.ToolbarReorderer({\n *             defaultReorderable: true\n *         })\n *     ],\n *     items: [\n *       {text: 'Button 1', reorderable: false},\n *       {text: 'Button 2'},\n *       {text: 'Button 3'}\n *     ]\n * });\n * </pre>\n * In the example above, buttons 2 and 3 will be reorderable via drag and drop. An event named 'reordered'\n * is added to the Toolbar, and is fired whenever a reorder has been completed.\n */\nExt.ux.ToolbarReorderer = Ext.extend(Ext.ux.Reorderer, {\n    /**\n     * Initializes the plugin, decorates the toolbar with additional functionality\n     */\n    init: function(toolbar) {\n        /**\n         * This is used to store the correct x value of each button in the array. We need to use this\n         * instead of the button's reported x co-ordinate because the buttons are animated when they move -\n         * if another onDrag is fired while the button is still moving, the comparison x value will be incorrect\n         */\n        this.buttonXCache = {};\n        \n        toolbar.on({\n            scope: this,\n            add  : function(toolbar, item) {\n                this.createIfReorderable(item);\n            }\n        });\n        \n        this.movedTask = new Ext.util.DelayedTask(this.finishMove, this);\n        \n        //super sets a reference to the toolbar in this.target\n        Ext.ux.ToolbarReorderer.superclass.init.apply(this, arguments);\n    },\n        \n    /**\n     * Sets up the given Toolbar item as a draggable\n     * @param {Mixed} button The item to make draggable (usually an Ext.Button instance)\n     */\n    createItemDD: function(button) {\n        if (button.dd != undefined) {\n            return;\n        }\n        \n        var el   = button.getEl(),\n            id   = el.id,\n            tbar = this.target,\n            me   = this;\n        \n        button.dd = new Ext.dd.DD(el, undefined, {\n            isTarget: false\n        });\n        \n        //if a button has a menu, it is disabled while dragging with this function\n        var menuDisabler = function() {\n            return false;\n        };\n        \n        Ext.apply(button.dd, {\n            b4StartDrag: function() {       \n                this.startPosition = el.getXY();\n                \n                //bump up the z index of the button being dragged but keep a reference to the original\n                this.startZIndex = el.getStyle('zIndex');\n                el.setStyle('zIndex', 10000);\n                \n                button.suspendEvents();\n                if (button.menu) {\n                    button.menu.on('beforeshow', menuDisabler, me);\n                }\n            },\n            \n            startDrag: function() {\n                this.constrainTo(tbar.getEl());\n                this.setYConstraint(0, 0, 0);\n            },\n            \n            onDrag: function(e) {\n                //calculate the button's index within the toolbar and its current midpoint\n                var buttonX  = el.getXY()[0],\n                    deltaX   = buttonX - this.startPosition[0],\n                    items    = tbar.items.items,\n                    oldIndex = items.indexOf(button),\n                    newIndex;\n                \n                //find which item in the toolbar the midpoint is currently over\n                for (var index = 0; index < items.length; index++) {\n                    var item = items[index];\n                    \n                    if (item.reorderable && item.id != button.id) {\n                        //find the midpoint of the button\n                        var box        = item.getEl().getBox(),\n                            midpoint   = (me.buttonXCache[item.id] || box.x) + (box.width / 2),\n                            movedLeft  = oldIndex > index && deltaX < 0 && buttonX < midpoint,\n                            movedRight = oldIndex < index && deltaX > 0 && (buttonX + el.getWidth()) > midpoint;\n                        \n                        if (movedLeft || movedRight) {\n                            me[movedLeft ? 'onMovedLeft' : 'onMovedRight'](button, index, oldIndex);\n                            break;\n                        }\n                    }\n                }\n            },\n\n            /**\n             * After the drag has been completed, make sure the button being dragged makes it back to\n             * the correct location and resets its z index\n             */\n            endDrag: function() {\n                //we need to update the cache here for cases where the button was dragged but its\n                //position in the toolbar did not change\n                me.updateButtonXCache();\n\n                el.moveTo(me.buttonXCache[button.id], el.getY(), {\n                    duration: me.animationDuration,\n                    scope   : this,\n                    callback: function() {\n                        me.movedTask.delay(200);\n                        button.resumeEvents();\n                        if (button.menu) {\n                            button.menu.un('beforeshow', menuDisabler, me);\n                        }\n\n                        tbar.fireEvent('reordered', button, tbar);\n                    }\n                });\n\n                el.setStyle('zIndex', this.startZIndex);\n            }\n        });\n    },\n\n    onMovedLeft: function(item, newIndex, oldIndex) {\n        var tbar  = this.target,\n            items = tbar.items.items;\n\n        this.movedTask.cancel();\n        if (newIndex != undefined && newIndex != oldIndex) {\n            //move the button currently under drag to its new location\n            tbar.remove(item, false);\n            tbar.insert(newIndex, item);\n\n            //set the correct x location of each item in the toolbar\n            this.updateButtonXCache();\n            for (var index = 0; index < items.length; index++) {\n                var obj  = items[index],\n                    newX = this.buttonXCache[obj.id];\n\n                if (item == obj) {\n                    item.dd.startPosition[0] = newX;\n                } else {\n                    var el = obj.getEl();\n\n                    el.moveTo(newX, el.getY(), {\n                        duration: this.animationDuration\n                    });\n                }\n            }\n        }\n    },\n\n    onMovedRight: function(item, newIndex, oldIndex) {\n        this.onMovedLeft.apply(this, arguments);\n    },\n\n    finishMove: function(){\n        var tbar = this.target;\n        tbar.items.each(function(btn){\n            btn.el.dom.style.left = '';\n        });\n        tbar.doLayout();\n    },\n\n    /**\n     * @private\n     * Updates the internal cache of button X locations. \n     */\n    updateButtonXCache: function() {\n        var tbar   = this.target,\n            items  = tbar.items,\n            totalX = tbar.getEl().getBox(true).x;\n            \n        items.each(function(item) {\n            this.buttonXCache[item.id] = totalX;\n\n            totalX += item.getEl().getWidth();\n        }, this);\n    }\n});"
  },
  {
    "path": "client/src/ext/ux/XmlTreeLoader.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.tree');\n\n/**\n * @class Ext.ux.tree.XmlTreeLoader\n * @extends Ext.tree.TreeLoader\n * <p>A TreeLoader that can convert an XML document into a hierarchy of {@link Ext.tree.TreeNode}s.\n * Any text value included as a text node in the XML will be added to the parent node as an attribute\n * called <tt>innerText</tt>.  Also, the tag name of each XML node will be added to the tree node as\n * an attribute called <tt>tagName</tt>.</p>\n * <p>By default, this class expects that your source XML will provide the necessary attributes on each\n * node as expected by the {@link Ext.tree.TreePanel} to display and load properly.  However, you can\n * provide your own custom processing of node attributes by overriding the {@link #processNode} method\n * and modifying the attributes as needed before they are used to create the associated TreeNode.</p>\n * @constructor\n * Creates a new XmlTreeloader.\n * @param {Object} config A config object containing config properties.\n */\nExt.ux.tree.XmlTreeLoader = Ext.extend(Ext.tree.TreeLoader, {\n    /**\n     * @property  XML_NODE_ELEMENT\n     * XML element node (value 1, read-only)\n     * @type Number\n     */\n    XML_NODE_ELEMENT : 1,\n    /**\n     * @property  XML_NODE_TEXT\n     * XML text node (value 3, read-only)\n     * @type Number\n     */\n    XML_NODE_TEXT : 3,\n\n    // private override\n    processResponse : function(response, node, callback){\n        var xmlData = response.responseXML,\n            root = xmlData.documentElement || xmlData;\n\n        try{\n            node.beginUpdate();\n            node.appendChild(this.parseXml(root));\n            node.endUpdate();\n\n            this.runCallback(callback, scope || node, [node]);\n        }catch(e){\n            this.handleFailure(response);\n        }\n    },\n\n    // private\n    parseXml : function(node) {\n        var nodes = [];\n        Ext.each(node.childNodes, function(n){\n            if(n.nodeType == this.XML_NODE_ELEMENT){\n                var treeNode = this.createNode(n);\n                if(n.childNodes.length > 0){\n                    var child = this.parseXml(n);\n                    if(typeof child == 'string'){\n                        treeNode.attributes.innerText = child;\n                    }else{\n                        treeNode.appendChild(child);\n                    }\n                }\n                nodes.push(treeNode);\n            }\n            else if(n.nodeType == this.XML_NODE_TEXT){\n                var text = n.nodeValue.trim();\n                if(text.length > 0){\n                    return nodes = text;\n                }\n            }\n        }, this);\n\n        return nodes;\n    },\n\n    // private override\n    createNode : function(node){\n        var attr = {\n            tagName: node.tagName\n        };\n\n        Ext.each(node.attributes, function(a){\n            attr[a.nodeName] = a.nodeValue;\n        });\n\n        this.processAttributes(attr);\n\n        return Ext.ux.tree.XmlTreeLoader.superclass.createNode.call(this, attr);\n    },\n\n    /*\n     * Template method intended to be overridden by subclasses that need to provide\n     * custom attribute processing prior to the creation of each TreeNode.  This method\n     * will be passed a config object containing existing TreeNode attribute name/value\n     * pairs which can be modified as needed directly (no need to return the object).\n     */\n    processAttributes: Ext.emptyFn\n});\n\n//backwards compat\nExt.ux.XmlTreeLoader = Ext.ux.tree.XmlTreeLoader;\n"
  },
  {
    "path": "client/src/ext/ux/css/CenterLayout.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.ux-layout-center-item {\n    margin:0 auto;\n    text-align:left;\n}\n.ux-layout-center .x-panel-body,   \nbody.ux-layout-center {            \n    text-align:center;\n}\n"
  },
  {
    "path": "client/src/ext/ux/css/ColumnHeaderGroup.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\ntd.ux-grid-hd-group-cell {\n    background: url(../../../resources/images/default/grid/grid3-hrow.gif) repeat-x bottom;\n}"
  },
  {
    "path": "client/src/ext/ux/css/ColumnNodeUI.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-column-tree .x-panel-header {\n\tpadding: 3px 0px 0px 0px;\n\tborder-bottom-width: 0px;\n}\n\n.x-column-tree .x-panel-header .x-panel-header-text {\n\tmargin-left: 3px\n}\n\n.x-column-tree .x-tree-node {\n    zoom:1;\n}\n.x-column-tree .x-tree-node-el {\n    /*border-bottom:1px solid #eee; borders? */\n    zoom:1;\n}\n.x-column-tree .x-tree-selected {\n    background: #d9e8fb;\n}\n.x-column-tree  .x-tree-node a {\n    line-height:18px;\n    vertical-align:middle;\n}\n.x-column-tree  .x-tree-node a span{\n\t\n}\n.x-column-tree  .x-tree-node .x-tree-selected a span{\n\tbackground:transparent;\n\tcolor:#000;\n}\n.x-tree-col {\n    float:left;\n    overflow:hidden;\n    padding:0 1px;\n    zoom:1;\n}\n\n.x-tree-col-text, .x-tree-hd-text {\n    color:#000;\n    overflow:hidden;\n    -o-text-overflow: ellipsis;\n    text-overflow: ellipsis;\n    padding:3px 3px 3px 5px;\n    white-space: nowrap;\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-tree-headers {\n\tmargin-top: 3px;\n\tbackground: #f9f9f9 url(../../../resources/images/default/grid/grid3-hrow.gif) repeat-x 0 bottom;\n\tcursor:default;\n    zoom:1;\n}\n\n.x-tree-hd {\n    float:left;\n    overflow:hidden;\n    border-left:1px solid #eee;\n    border-right:1px solid #d0d0d0;\n}\n"
  },
  {
    "path": "client/src/ext/ux/css/GroupSummary.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-grid3-summary-row {\n    border-left:1px solid #fff;\n    border-right:1px solid #fff;\n    color:#333;\n    background: #f1f2f4;\n}\n.x-grid3-summary-row .x-grid3-cell-inner {\n    font-weight:bold;\n    padding-bottom:4px;\n}\n.x-grid3-cell-first .x-grid3-cell-inner {\n    padding-left:16px;\n}\n.x-grid-hide-summary .x-grid3-summary-row {\n    display:none;\n}\n.x-grid3-summary-msg {\n    padding:4px 16px;\n    font-weight:bold;\n}"
  },
  {
    "path": "client/src/ext/ux/css/GroupTab.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-grouptabs-panel {\n    background-color: #4E78B1;\n    border: solid 15px #4E78B1;\n}\n.x-tab-panel-left .x-grouptabs-panel-header,\n.x-tab-panel-right .x-grouptabs-panel-header {\n    float: left;\n    border: 0;\n    background: transparent;\n}\n.x-tab-panel-right .x-grouptabs-panel-header {\n    float:right;\n}\n.x-tab-panel-left .x-grouptabs-bwrap {\n    float: right;\n    position: relative;\n}\n.x-tab-panel-right .x-grouptabs-bwrap {\n    float: left;\n    position: relative;\n}\n.x-tab-panel-left ul.x-grouptabs-strip,\n.x-tab-panel-right ul.x-grouptabs-strip {\n    width: auto;\n\tdisplay: block;\n}\n.x-tab-panel-left ul.x-grouptabs-strip li,\n.x-tab-panel-right ul.x-grouptabs-strip li {\n    padding: 6px 0 2px 6px;\n    float: none;\n    margin: 0;\n    position: relative;\n    clear: both;\n}\n.x-tab-panel-left .x-tab-panel-header ul.x-grouptabs-strip a.x-grouptabs-text,\n.x-tab-panel-right .x-tab-panel-header ul.x-grouptabs-strip a.x-grouptabs-text{\n\tfont-size: 13px;\n\tline-height: 18px;\n\tcursor: pointer;\n}\n\n.x-tab-panel-left .x-tab-panel-header ul.x-grouptabs-strip a.x-grouptabs-text{\n    padding-left: 18px;\n}\n.x-tab-panel-right .x-tab-panel-header ul.x-grouptabs-strip a.x-grouptabs-text{\n    padding-right: 18px;\n}\n\n.x-tab-panel-left .x-tab-panel-header ul.x-grouptabs-sub a.x-grouptabs-text,\n.x-tab-panel-right .x-tab-panel-header ul.x-grouptabs-sub a.x-grouptabs-text{\n\tfont-size: 12px;\n    padding: 0;  \n}\n\n.x-tab-panel-left .x-tab-panel-header ul.x-grouptabs-sub a.x-grouptabs-text{\n\tmargin-left: 4px;\n}\n.x-tab-panel-right .x-tab-panel-header ul.x-grouptabs-sub a.x-grouptabs-text{\n\tmargin-right: 4px;\n}\n\n.x-grouptabs-panel .x-grouptabs-strip a.x-grouptabs-text{\n    overflow: hidden;\n    white-space: nowrap;\n\tdisplay: block;\n    color: #DFE8F6;\n    font-family: tahoma, arial, sans-serif;\n    font-weight: bold;\n    text-decoration: none;\n}\n.x-tab-panel-right .x-grouptabs-strip a.x-grouptabs-text {\n    text-align: right;\n}\n\n.x-grouptabs-panel .x-grouptabs-strip-active a.x-grouptabs-text {\n    color: #395B8E;\n}\n\n.x-grouptabs-panel ul.x-grouptabs-sub a.x-grouptabs-text {\n\tfont-weight: normal;\n}\n.x-tab-joint {\n    position: absolute;\n    width: 3px;\n    top: 1px;\n    background: #fff;\n    z-index: 8999;\n}\n\n.x-grouptabs-panel .x-grouptabs-panel-body {\n    border: 1px solid #999;\n}\n\n.x-grouptabs-panel ul.x-grouptabs-strip li {\n    border-top: 1px solid transparent;\n    border-bottom: 1px solid transparent;\n\tborder-left: 1px solid transparent;\n}\n\n.x-grouptabs-panel ul.x-grouptabs-strip li.x-grouptabs-strip-active {\n    border: 0;\n    background: #fff;\n    border-top: 1px solid #999;\n    border-bottom: 1px solid #999;\n}\n\n.x-tab-panel-left ul.x-grouptabs-strip li.x-grouptabs-strip-active {\n    border-left: 1px solid #999;\n}\n.x-tab-panel-right ul.x-grouptabs-strip li.x-grouptabs-strip-active {\n    border-right: 1px solid #999;\n}\n\n.x-grouptabs-panel li.x-grouptabs-strip-active ul.x-grouptabs-sub li.x-grouptabs-strip-active{\n    background-color: #EDEEF0;\n}\n\n.x-grouptabs-panel li.x-grouptabs-strip-active ul.x-grouptabs-sub {\n    background-color: transparent;\n}\n\n.x-grouptabs-panel li.x-grouptabs-strip-active ul.x-grouptabs-sub li {\n    border-color: transparent;\n}\n\n/* Tab corners */\n.x-grouptabs-panel .x-grouptabs-corner {\n    background-image: url('../images/x-grouptabs-corners.gif');\n    display: none;\n    width: 11px;\n    height: 11px;\n    position: absolute;\n    font-size: 1px;\n    line-height: 6px;\n    overflow: hidden;\n    zoom:1;\n}\n.x-grouptabs-panel .x-grouptabs-strip-active .x-grouptabs-corner {\n    display: block;\n}\n.x-grouptabs-panel .x-grouptabs-main.x-grouptabs-strip-active ul.x-grouptabs-sub .x-grouptabs-corner {\n\tdisplay: none;\n}\n\n.x-grouptabs-panel .x-grouptabs-corner-top-left {\n    background-position: top left;\n    left: 0; top: 0;\n}\n.x-grouptabs-panel .x-grouptabs-corner-bottom-left {\n    background-position: bottom left;\n    left: 0; bottom: 0;\n}\n.x-grouptabs-panel .x-grouptabs-corner-top-right {\n    background-position: top right;\n    right: 0; top: 0;\n}\n.x-grouptabs-panel .x-grouptabs-corner-bottom-right {\n    background-position: bottom right;\n    right: 0; bottom: 0;\n}\n.x-grouptabs-panel li.x-grouptabs-strip-active .x-grouptabs-corner-bottom-left{\n    bottom: -4px; left: -4px;\n}\n.x-grouptabs-panel li.x-grouptabs-strip-active .x-grouptabs-corner-bottom-right{\n    bottom: -4px; right: -4px;\n}\n.x-grouptabs-panel li.x-grouptabs-strip-active .x-grouptabs-corner-top-left{\n    top: -4px; left: -4px;\n}\n.x-grouptabs-panel li.x-grouptabs-strip-active .x-grouptabs-corner-top-right{\n    top: -4px; right: -4px;\n}\n\n.x-grouptabs-panel ul.x-grouptabs-sub li.x-tab-with-icon a.x-grouptabs-text {\n    background-repeat: no-repeat;\n    padding-left: 20px;\n}\n\n/* General tab styling */\n.x-grouptabs-panel .x-grouptabs-expand {\n\tbackground: transparent url('../images/elbow-plus-nl.gif') no-repeat;\n\twidth: 16px;\n\theight: 16px;\n\tposition: absolute;\n\tleft: 7px;\n\ttop: 6px;\n}\n\n.ext-ie6 .x-grouptabs-panel .x-grouptabs-expand,\n.ext-border-box .x-grouptabs-panel .x-grouptabs-expand {\n\tleft: 0;\n}\n\n.x-grouptabs-expanded .x-grouptabs-expand {\n\tbackground-image: url('../images/elbow-minus-nl.gif');\n}\n\n/* GroupTabs sub group styling */\n.x-grouptabs-sub {\n\tdisplay: none;\n\tmargin-top: 4px;\n}\n\n.x-grouptabs-expanded .x-grouptabs-sub {\n\tdisplay: block;\n}\n\n.x-grouptabs-panel ul.x-grouptabs-sub li {\n\theight: 18px;\n\tmargin: 0 0 2px;\n    padding: 0;\n}\n\n.x-grouptabs-panel ul.x-grouptabs-sub .x-grouptabs-main-item {\n\tdisplay: none;\n}\n\n.x-tab-with-icon{\n   border-style:none !important;\n}\n"
  },
  {
    "path": "client/src/ext/ux/css/LockingGridView.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-grid3-locked, .x-grid3-unlocked {\n\toverflow: hidden;\n\tposition: absolute;\n}\n\n.x-grid3-locked {\n\tborder-right: 1px solid #808080;\n\tbox-sizing: border-box;\n}\n\n.x-grid3-locked .x-grid3-scroller {\n\toverflow: hidden;\n}\n\n.x-grid3-locked .x-grid3-row {\n\tborder-right: 0;\n}\n\n.x-grid3-scroll-spacer {\n\theight: 19px;\n}\n\n.x-grid3-unlocked .x-grid3-header-offset {\n\tpadding-left: 0;\n}\n\n.x-grid3-unlocked .x-grid3-row {\n\tborder-left: 0;\n}\n"
  },
  {
    "path": "client/src/ext/ux/css/MultiSelect.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.ux-mselect{\n    overflow:auto;\n    background:white;\n    position:relative; /* for calculating scroll offsets */\n    zoom:1;\n    overflow:auto;\t\n}\n.ux-mselect-item{\n    font:normal 12px tahoma, arial, helvetica, sans-serif;\n    padding:2px;\n    border:1px solid #fff;\n    white-space: nowrap;\n    cursor:pointer;\n}\n.ux-mselect-selected{\n\tborder:1px dotted #a3bae9 !important;\n    background:#DFE8F6;\n    cursor:pointer;\n}\n\n.x-view-drag-insert-above { \n    border-top:1px dotted #3366cc; \n} \n.x-view-drag-insert-below { \n    border-bottom:1px dotted #3366cc; \n} \n\n.ext-ie .ux-form-multiselect .x-fieldset legend {\n    margin-bottom: 0;\n}\n"
  },
  {
    "path": "client/src/ext/ux/css/PanelResizer.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-panel-resize {\n        height:5px;\n        background:transparent url(../images/panel-handle.gif) no-repeat center bottom;\n        position:relative;\n        left:0;\n        top:2px;\n        cursor:n-resize;\n        cursor:row-resize;\n        /* for IE */\n        font-size:1px;\n        line-height:1px;\n        overflow:hidden;\n}"
  },
  {
    "path": "client/src/ext/ux/css/Portal.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-portal .x-panel-dd-spacer {\n    margin-bottom:10px;\n}\n\n.x-portlet {\n    margin-bottom:10px;\n}\n\n/* Clean up the look of the portlets */\n.x-portlet .x-panel-ml {\n    padding-left:2px;\n}\n.x-portlet .x-panel-mr {\n    padding-right:2px;\n}\n.x-portlet .x-panel-bl {\n    padding-left:2px;\n}\n\n.x-portlet .x-panel-br {\n    padding-right:2px;\n}\n.x-portlet .x-panel-body {\n    background:white;\n}\n.x-portlet .x-panel-mc {\n    padding-top:2px;\n}\n.x-portlet .x-panel-bc .x-panel-footer {\n    padding-bottom:2px;\n}\n.x-portlet .x-panel-nofooter .x-panel-bc {\n    height:2px;\n}"
  },
  {
    "path": "client/src/ext/ux/css/RowEditor.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.ext-ie .x-row-editor .x-form-text {\n    margin:0 !important; \n}\n.x-row-editor-header {\n    height:2px;\n    overflow:hidden;\n    background: transparent url(../images/row-editor-bg.gif) repeat-x 0 0;\n}\n.x-row-editor-footer {\n    height:2px;\n    overflow:hidden;\n    background: transparent url(../images/row-editor-bg.gif) repeat-x 0 -2px;\n}\n.ext-ie .x-row-editor-footer {\n    margin-top:-1px;\n}\n\n.x-row-editor-body {\n    overflow:hidden;\n    zoom:1;\n    background: #ebf2fb;\n    padding-top:2px;\n}\n.x-row-editor .x-btns {\n    position:absolute;\n    top:28px;\n    left:20px;\n    padding-left:5px;\n    background: transparent url(../images/row-editor-btns.gif) no-repeat 0 0;\n}\n.x-row-editor .x-btns .x-plain-bwrap {\n    padding-right:5px;\n    background: transparent url(../images/row-editor-btns.gif) no-repeat right -31px;\n}\n.x-row-editor .x-btns .x-plain-body {\n    background: transparent url(../images/row-editor-btns.gif) repeat-x 0 -62px;\n    height:31px;\n}\n.x-row-editor .x-btns .x-table-layout-cell {\n    padding:3px;\n}\n\n/* Fixes for IE6/7 trigger fields */\n.ext-ie6 .x-row-editor .x-form-field-wrap .x-form-trigger, .ext-ie7 .x-row-editor .x-form-field-wrap .x-form-trigger {\n  top: 1px;\n}\n\n.ext-ie6 .x-row-editor .x-form-field-trigger-wrap, .ext-ie7 .x-row-editor .x-form-field-trigger-wrap {\n  margin-top: -1px;\n}\n\n.errorTip .x-tip-body ul{\n    list-style-type:disc;\n    margin-left:15px;\n}\n"
  },
  {
    "path": "client/src/ext/ux/css/Spinner.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-form-spinner-proxy{\n\t/*background-color:#ff00cc;*/\n}\n.x-form-field-wrap .x-form-spinner-trigger {\n    background:transparent url('../images/spinner.gif') no-repeat 0 0;\n}\n\n.x-form-field-wrap .x-form-spinner-overup{\n    background-position:-17px 0;\n}\n.x-form-field-wrap .x-form-spinner-clickup{\n    background-position:-34px 0;\n}\n.x-form-field-wrap .x-form-spinner-overdown{\n    background-position:-51px 0;\n}\n.x-form-field-wrap .x-form-spinner-clickdown{\n    background-position:-68px 0;\n}\n\n\n.x-trigger-wrap-focus .x-form-spinner-trigger{\n    background-position:-85px 0;\n}\n.x-trigger-wrap-focus .x-form-spinner-overup{\n    background-position:-102px 0;\n}\n.x-trigger-wrap-focus .x-form-spinner-clickup{\n    background-position:-119px 0;\n}\n.x-trigger-wrap-focus .x-form-spinner-overdown{\n    background-position:-136px 0;\n}\n.x-trigger-wrap-focus .x-form-spinner-clickdown{\n    background-position:-153px 0;\n}\n.x-trigger-wrap-focus .x-form-trigger{\n    border-bottom: 1px solid #7eadd9;\n}\n\n.x-form-field-wrap .x-form-spinner-splitter {\n\tline-height:1px;\n\tfont-size:1px;\n    background:transparent url('../images/spinner-split.gif') no-repeat 0 0;\n\tposition:absolute;\n\tcursor: n-resize;\n}\n.x-trigger-wrap-focus .x-form-spinner-splitter{\n    background-position:-14px 0;\n}\n"
  },
  {
    "path": "client/src/ext/ux/css/ux-all.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.ux-layout-center-item {\n    margin:0 auto;\n    text-align:left;\n}\n.ux-layout-center .x-panel-body,   \nbody.ux-layout-center {            \n    text-align:center;\n}\ntd.ux-grid-hd-group-cell {\n    background: url(../../../resources/images/default/grid/grid3-hrow.gif) repeat-x bottom;\n}.x-column-tree .x-panel-header {\n\tpadding: 3px 0px 0px 0px;\n\tborder-bottom-width: 0px;\n}\n\n.x-column-tree .x-panel-header .x-panel-header-text {\n\tmargin-left: 3px\n}\n\n.x-column-tree .x-tree-node {\n    zoom:1;\n}\n.x-column-tree .x-tree-node-el {\n    /*border-bottom:1px solid #eee; borders? */\n    zoom:1;\n}\n.x-column-tree .x-tree-selected {\n    background: #d9e8fb;\n}\n.x-column-tree  .x-tree-node a {\n    line-height:18px;\n    vertical-align:middle;\n}\n.x-column-tree  .x-tree-node a span{\n\t\n}\n.x-column-tree  .x-tree-node .x-tree-selected a span{\n\tbackground:transparent;\n\tcolor:#000;\n}\n.x-tree-col {\n    float:left;\n    overflow:hidden;\n    padding:0 1px;\n    zoom:1;\n}\n\n.x-tree-col-text, .x-tree-hd-text {\n    color:#000;\n    overflow:hidden;\n    -o-text-overflow: ellipsis;\n    text-overflow: ellipsis;\n    padding:3px 3px 3px 5px;\n    white-space: nowrap;\n    font:normal 11px arial, tahoma, helvetica, sans-serif;\n}\n\n.x-tree-headers {\n\tmargin-top: 3px;\n\tbackground: #f9f9f9 url(../../../resources/images/default/grid/grid3-hrow.gif) repeat-x 0 bottom;\n\tcursor:default;\n    zoom:1;\n}\n\n.x-tree-hd {\n    float:left;\n    overflow:hidden;\n    border-left:1px solid #eee;\n    border-right:1px solid #d0d0d0;\n}\n/*\n * FileUploadField component styles\n */\n.x-form-file-wrap {\n    position: relative;\n    height: 22px;\n}\n.x-form-file-wrap .x-form-file {\n\tposition: absolute;\n\tright: 0;\n\t-moz-opacity: 0;\n\tfilter:alpha(opacity: 0);\n\topacity: 0;\n\tz-index: 2;\n    height: 22px;\n}\n.x-form-file-wrap .x-form-file-btn {\n\tposition: absolute;\n\tright: 0;\n\tz-index: 1;\n}\n.x-form-file-wrap .x-form-file-text {\n    position: absolute;\n    left: 0;\n    z-index: 3;\n    color: #777;\n}/**\n * GridFilters Styles\n **/\n/*\n.x-grid3-hd-row .ux-filtered-column {\n\tborder-left:  1px solid #C7E3B4;\n\tborder-right: 1px solid #C7E3B4;\n}\n\n.x-grid3-hd-row .ux-filtered-column .x-grid3-hd-inner {\n\tbackground-image: url(../images/header_bg.gif);\n}\n\n.ux-filtered-column .x-grid3-hd-btn {\n\tbackground-image: url(../images/hd-btn.gif);\n}\n*/\n.x-grid3-hd-row td.ux-filtered-column {   \n    font-style: italic;  \n    font-weight: bold;\n}\t\t\n\n.ux-filtered-column.sort-asc .x-grid3-sort-icon {\n\tbackground-image: url(../images/sort_filtered_asc.gif) !important;\n}\n\n.ux-filtered-column.sort-desc .x-grid3-sort-icon {\n\tbackground-image: url(../images/sort_filtered_desc.gif) !important;\n}\n\n.ux-gridfilter-text-icon {\n\tbackground-image: url(../images/find.png) !important;\n}\n\n/* Temporary Patch for Bug ??? */\n.x-menu-list-item-indent .x-menu-item-icon {\n\tposition: relative;\n    top: 3px;\n    left: 3px;\n\tmargin-right: 10px;\n}\nli.x-menu-list-item-indent {\n\tpadding-left:0px;\n}\nli.x-menu-list-item div {\n\tdisplay: block;\n}\n\n/**\n * RangeMenu Styles\n **/\n.ux-rangemenu-gt {\n\tbackground-image: url(../images/greater_than.png) !important;\n}\n\n.ux-rangemenu-lt {\n\tbackground-image: url(../images/less_than.png) !important;\n}\n\n.ux-rangemenu-eq {\n\tbackground-image: url(../images/equals.png) !important;\n}\n.x-grid3-summary-row {\n    border-left:1px solid #fff;\n    border-right:1px solid #fff;\n    color:#333;\n    background: #f1f2f4;\n}\n.x-grid3-summary-row .x-grid3-cell-inner {\n    font-weight:bold;\n    padding-bottom:4px;\n}\n.x-grid3-cell-first .x-grid3-cell-inner {\n    padding-left:16px;\n}\n.x-grid-hide-summary .x-grid3-summary-row {\n    display:none;\n}\n.x-grid3-summary-msg {\n    padding:4px 16px;\n    font-weight:bold;\n}.x-grouptabs-panel {\n    background-color: #4E78B1;\n    border: solid 15px #4E78B1;\n}\n.x-tab-panel-left .x-grouptabs-panel-header,\n.x-tab-panel-right .x-grouptabs-panel-header {\n    float: left;\n    border: 0;\n    background: transparent;\n}\n.x-tab-panel-right .x-grouptabs-panel-header {\n    float:right;\n}\n.x-tab-panel-left .x-grouptabs-bwrap {\n    float: right;\n    position: relative;\n}\n.x-tab-panel-right .x-grouptabs-bwrap {\n    float: left;\n    position: relative;\n}\n.x-tab-panel-left ul.x-grouptabs-strip,\n.x-tab-panel-right ul.x-grouptabs-strip {\n    width: auto;\n\tdisplay: block;\n}\n.x-tab-panel-left ul.x-grouptabs-strip li,\n.x-tab-panel-right ul.x-grouptabs-strip li {\n    padding: 6px 0 2px 6px;\n    float: none;\n    margin: 0;\n    position: relative;\n    clear: both;\n}\n.x-tab-panel-left .x-tab-panel-header ul.x-grouptabs-strip a.x-grouptabs-text,\n.x-tab-panel-right .x-tab-panel-header ul.x-grouptabs-strip a.x-grouptabs-text{\n\tfont-size: 13px;\n\tline-height: 18px;\n\tcursor: pointer;\n}\n\n.x-tab-panel-left .x-tab-panel-header ul.x-grouptabs-strip a.x-grouptabs-text{\n    padding-left: 18px;\n}\n.x-tab-panel-right .x-tab-panel-header ul.x-grouptabs-strip a.x-grouptabs-text{\n    padding-right: 18px;\n}\n\n.x-tab-panel-left .x-tab-panel-header ul.x-grouptabs-sub a.x-grouptabs-text,\n.x-tab-panel-right .x-tab-panel-header ul.x-grouptabs-sub a.x-grouptabs-text{\n\tfont-size: 12px;\n    padding: 0;  \n}\n\n.x-tab-panel-left .x-tab-panel-header ul.x-grouptabs-sub a.x-grouptabs-text{\n\tmargin-left: 4px;\n}\n.x-tab-panel-right .x-tab-panel-header ul.x-grouptabs-sub a.x-grouptabs-text{\n\tmargin-right: 4px;\n}\n\n.x-grouptabs-panel .x-grouptabs-strip a.x-grouptabs-text{\n    overflow: hidden;\n    white-space: nowrap;\n\tdisplay: block;\n    color: #DFE8F6;\n    font-family: tahoma, arial, sans-serif;\n    font-weight: bold;\n    text-decoration: none;\n}\n.x-tab-panel-right .x-grouptabs-strip a.x-grouptabs-text {\n    text-align: right;\n}\n\n.x-grouptabs-panel .x-grouptabs-strip-active a.x-grouptabs-text {\n    color: #395B8E;\n}\n\n.x-grouptabs-panel ul.x-grouptabs-sub a.x-grouptabs-text {\n\tfont-weight: normal;\n}\n.x-tab-joint {\n    position: absolute;\n    width: 3px;\n    top: 1px;\n    background: #fff;\n    z-index: 8999;\n}\n\n.x-grouptabs-panel .x-grouptabs-panel-body {\n    border: 1px solid #999;\n}\n\n.x-grouptabs-panel ul.x-grouptabs-strip li {\n    border-top: 1px solid transparent;\n    border-bottom: 1px solid transparent;\n\tborder-left: 1px solid transparent;\n}\n\n.x-grouptabs-panel ul.x-grouptabs-strip li.x-grouptabs-strip-active {\n    border: 0;\n    background: #fff;\n    border-top: 1px solid #999;\n    border-bottom: 1px solid #999;\n}\n\n.x-tab-panel-left ul.x-grouptabs-strip li.x-grouptabs-strip-active {\n    border-left: 1px solid #999;\n}\n.x-tab-panel-right ul.x-grouptabs-strip li.x-grouptabs-strip-active {\n    border-right: 1px solid #999;\n}\n\n.x-grouptabs-panel li.x-grouptabs-strip-active ul.x-grouptabs-sub li.x-grouptabs-strip-active{\n    background-color: #EDEEF0;\n}\n\n.x-grouptabs-panel li.x-grouptabs-strip-active ul.x-grouptabs-sub {\n    background-color: transparent;\n}\n\n.x-grouptabs-panel li.x-grouptabs-strip-active ul.x-grouptabs-sub li {\n    border-color: transparent;\n}\n\n/* Tab corners */\n.x-grouptabs-panel .x-grouptabs-corner {\n    background-image: url('../images/x-grouptabs-corners.gif');\n    display: none;\n    width: 11px;\n    height: 11px;\n    position: absolute;\n    font-size: 1px;\n    line-height: 6px;\n    overflow: hidden;\n    zoom:1;\n}\n.x-grouptabs-panel .x-grouptabs-strip-active .x-grouptabs-corner {\n    display: block;\n}\n.x-grouptabs-panel .x-grouptabs-main.x-grouptabs-strip-active ul.x-grouptabs-sub .x-grouptabs-corner {\n\tdisplay: none;\n}\n\n.x-grouptabs-panel .x-grouptabs-corner-top-left {\n    background-position: top left;\n    left: 0; top: 0;\n}\n.x-grouptabs-panel .x-grouptabs-corner-bottom-left {\n    background-position: bottom left;\n    left: 0; bottom: 0;\n}\n.x-grouptabs-panel .x-grouptabs-corner-top-right {\n    background-position: top right;\n    right: 0; top: 0;\n}\n.x-grouptabs-panel .x-grouptabs-corner-bottom-right {\n    background-position: bottom right;\n    right: 0; bottom: 0;\n}\n.x-grouptabs-panel li.x-grouptabs-strip-active .x-grouptabs-corner-bottom-left{\n    bottom: -4px; left: -4px;\n}\n.x-grouptabs-panel li.x-grouptabs-strip-active .x-grouptabs-corner-bottom-right{\n    bottom: -4px; right: -4px;\n}\n.x-grouptabs-panel li.x-grouptabs-strip-active .x-grouptabs-corner-top-left{\n    top: -4px; left: -4px;\n}\n.x-grouptabs-panel li.x-grouptabs-strip-active .x-grouptabs-corner-top-right{\n    top: -4px; right: -4px;\n}\n\n.x-grouptabs-panel ul.x-grouptabs-sub li.x-tab-with-icon a.x-grouptabs-text {\n    background-repeat: no-repeat;\n    padding-left: 20px;\n}\n\n/* General tab styling */\n.x-grouptabs-panel .x-grouptabs-expand {\n\tbackground: transparent url('../images/elbow-plus-nl.gif') no-repeat;\n\twidth: 16px;\n\theight: 16px;\n\tposition: absolute;\n\tleft: 7px;\n\ttop: 6px;\n}\n\n.ext-ie6 .x-grouptabs-panel .x-grouptabs-expand,\n.ext-border-box .x-grouptabs-panel .x-grouptabs-expand {\n\tleft: 0;\n}\n\n.x-grouptabs-expanded .x-grouptabs-expand {\n\tbackground-image: url('../images/elbow-minus-nl.gif');\n}\n\n/* GroupTabs sub group styling */\n.x-grouptabs-sub {\n\tdisplay: none;\n\tmargin-top: 4px;\n}\n\n.x-grouptabs-expanded .x-grouptabs-sub {\n\tdisplay: block;\n}\n\n.x-grouptabs-panel ul.x-grouptabs-sub li {\n\theight: 18px;\n\tmargin: 0 0 2px;\n    padding: 0;\n}\n\n.x-grouptabs-panel ul.x-grouptabs-sub .x-grouptabs-main-item {\n\tdisplay: none;\n}\n\n.x-tab-with-icon{\n   border-style:none !important;\n}\n.x-grid3-locked, .x-grid3-unlocked {\n\toverflow: hidden;\n\tposition: absolute;\n}\n\n.x-grid3-locked {\n\tborder-right: 1px solid #99BBE8;\n}\n\n.x-grid3-locked .x-grid3-scroller {\n\toverflow: hidden;\n}\n\n.x-grid3-locked .x-grid3-row {\n\tborder-right: 0;\n}\n\n.x-grid3-scroll-spacer {\n\theight: 19px;\n}\n\n.x-grid3-unlocked .x-grid3-header-offset {\n\tpadding-left: 0;\n}\n\n.x-grid3-unlocked .x-grid3-row {\n\tborder-left: 0;\n}\n.ux-mselect{\n    overflow:auto;\n    background:white;\n    position:relative; /* for calculating scroll offsets */\n    zoom:1;\n    overflow:auto;\t\n}\n.ux-mselect-item{\n    font:normal 12px tahoma, arial, helvetica, sans-serif;\n    padding:2px;\n    border:1px solid #fff;\n    white-space: nowrap;\n    cursor:pointer;\n}\n.ux-mselect-selected{\n\tborder:1px dotted #a3bae9 !important;\n    background:#DFE8F6;\n    cursor:pointer;\n}\n\n.x-view-drag-insert-above { \n    border-top:1px dotted #3366cc; \n} \n.x-view-drag-insert-below { \n    border-bottom:1px dotted #3366cc; \n} \n\n.ext-ie .ux-form-multiselect .x-fieldset legend {\n    margin-bottom: 0;\n}\n.x-panel-resize {\n        height:5px;\n        background:transparent url(../images/panel-handle.gif) no-repeat center bottom;\n        position:relative;\n        left:0;\n        top:2px;\n        cursor:n-resize;\n        cursor:row-resize;\n        /* for IE */\n        font-size:1px;\n        line-height:1px;\n        overflow:hidden;\n}.x-portal .x-panel-dd-spacer {\n    margin-bottom:10px;\n}\n\n.x-portlet {\n    margin-bottom:10px;\n}\n\n/* Clean up the look of the portlets */\n.x-portlet .x-panel-ml {\n    padding-left:2px;\n}\n.x-portlet .x-panel-mr {\n    padding-right:2px;\n}\n.x-portlet .x-panel-bl {\n    padding-left:2px;\n}\n\n.x-portlet .x-panel-br {\n    padding-right:2px;\n}\n.x-portlet .x-panel-body {\n    background:white;\n}\n.x-portlet .x-panel-mc {\n    padding-top:2px;\n}\n.x-portlet .x-panel-bc .x-panel-footer {\n    padding-bottom:2px;\n}\n.x-portlet .x-panel-nofooter .x-panel-bc {\n    height:2px;\n}.ext-ie .x-row-editor .x-form-text {\n    margin:0 !important; \n}\n.x-row-editor-header {\n    height:2px;\n    overflow:hidden;\n    background: transparent url(../images/row-editor-bg.gif) repeat-x 0 0;\n}\n.x-row-editor-footer {\n    height:2px;\n    overflow:hidden;\n    background: transparent url(../images/row-editor-bg.gif) repeat-x 0 -2px;\n}\n.ext-ie .x-row-editor-footer {\n    margin-top:-1px;\n}\n\n.x-row-editor-body {\n    overflow:hidden;\n    zoom:1;\n    background: #ebf2fb;\n    padding-top:2px;\n}\n.x-row-editor .x-btns {\n    position:absolute;\n    top:28px;\n    left:20px;\n    padding-left:5px;\n    background: transparent url(../images/row-editor-btns.gif) no-repeat 0 0;\n}\n.x-row-editor .x-btns .x-plain-bwrap {\n    padding-right:5px;\n    background: transparent url(../images/row-editor-btns.gif) no-repeat right -31px;\n}\n.x-row-editor .x-btns .x-plain-body {\n    background: transparent url(../images/row-editor-btns.gif) repeat-x 0 -62px;\n    height:31px;\n}\n.x-row-editor .x-btns .x-table-layout-cell {\n    padding:3px;\n}\n\n/* Fixes for IE6/7 trigger fields */\n.ext-ie6 .x-row-editor .x-form-field-wrap .x-form-trigger, .ext-ie7 .x-row-editor .x-form-field-wrap .x-form-trigger {\n  top: 1px;\n}\n\n.ext-ie6 .x-row-editor .x-form-field-trigger-wrap, .ext-ie7 .x-row-editor .x-form-field-trigger-wrap {\n  margin-top: -1px;\n}\n\n.errorTip .x-tip-body ul{\n    list-style-type:disc;\n    margin-left:15px;\n}\n.x-form-spinner-proxy{\n\t/*background-color:#ff00cc;*/\n}\n.x-form-field-wrap .x-form-spinner-trigger {\n    background:transparent url('../images/spinner.gif') no-repeat 0 0;\n}\n\n.x-form-field-wrap .x-form-spinner-overup{\n    background-position:-17px 0;\n}\n.x-form-field-wrap .x-form-spinner-clickup{\n    background-position:-34px 0;\n}\n.x-form-field-wrap .x-form-spinner-overdown{\n    background-position:-51px 0;\n}\n.x-form-field-wrap .x-form-spinner-clickdown{\n    background-position:-68px 0;\n}\n\n\n.x-trigger-wrap-focus .x-form-spinner-trigger{\n    background-position:-85px 0;\n}\n.x-trigger-wrap-focus .x-form-spinner-overup{\n    background-position:-102px 0;\n}\n.x-trigger-wrap-focus .x-form-spinner-clickup{\n    background-position:-119px 0;\n}\n.x-trigger-wrap-focus .x-form-spinner-overdown{\n    background-position:-136px 0;\n}\n.x-trigger-wrap-focus .x-form-spinner-clickdown{\n    background-position:-153px 0;\n}\n.x-trigger-wrap-focus .x-form-trigger{\n    border-bottom: 1px solid #7eadd9;\n}\n\n.x-form-field-wrap .x-form-spinner-splitter {\n\tline-height:1px;\n\tfont-size:1px;\n    background:transparent url('../images/spinner-split.gif') no-repeat 0 0;\n\tposition:absolute;\n\tcursor: n-resize;\n}\n.x-trigger-wrap-focus .x-form-spinner-splitter{\n    background-position:-14px 0;\n}\n/* StatusBar - structure */\n.x-statusbar .x-status-text {\n    cursor: default;\n/*\n    height: 21px;\n    line-height: 21px;\n    padding: 0 4px;\n*/\n}\n.x-statusbar .x-status-busy {\n    padding-left: 25px !important;\n    background: transparent no-repeat 3px 2px;\n}\n\n.x-toolbar div.xtb-text\n\n.x-statusbar .x-status-text-panel {\n    border-top: 1px solid;\n    border-right: 1px solid;\n    border-bottom: 1px solid;\n    border-left: 1px solid;\n    padding: 2px 8px 2px 5px;\n}\n\n/* StatusBar word processor example styles */\n\n#word-status .x-status-text-panel .spacer {\n    width: 60px;\n    font-size:0;\n    line-height:0;\n}\n#word-status .x-status-busy {\n    padding-left: 25px !important;\n    background: transparent no-repeat 3px 2px;\n}\n#word-status .x-status-saved {\n    padding-left: 25px !important;\n    background: transparent no-repeat 3px 2px;\n}\n\n/* StatusBar form validation example styles */\n\n.x-statusbar .x-status-error {\n    cursor: pointer;\n    padding-left: 25px !important;\n    background: transparent no-repeat 3px 2px;\n}\n.x-statusbar .x-status-valid {\n    padding-left: 25px !important;\n    background: transparent no-repeat 3px 2px;\n}\n.x-status-error-list {\n    font: 11px tahoma,arial,verdana,sans-serif;\n    position: absolute;\n    z-index: 9999;\n    border-top: 1px solid;\n    border-right: 1px solid;\n    border-bottom: 1px solid;\n    border-left: 1px solid;\n    padding: 5px 10px;\n}\n.x-status-error-list li {\n    cursor: pointer;\n    list-style: disc;\n    margin-left: 10px;\n}\n.x-status-error-list li a {\n    text-decoration: none;\n}\n.x-status-error-list li a:hover {\n    text-decoration: underline;\n}\n\n\n/* *********************************************************** */\n/* *********************************************************** */\n/* *********************************************************** */\n\n\n/* StatusBar - visual */\n\n.x-statusbar .x-status-busy {\n    background-image: url(../images/loading.gif);\n}\n.x-statusbar .x-status-text-panel {\n    border-color: #99bbe8 #fff #fff #99bbe8;\n}\n\n/* StatusBar word processor example styles */\n\n#word-status .x-status-text {\n    color: #777;\n}\n#word-status .x-status-busy {\n    background-image: url(../images/saving.gif);\n}\n#word-status .x-status-saved {\n    background-image: url(../images/saved.png);\n}\n\n/* StatusBar form validation example styles */\n\n.x-statusbar .x-status-error {\n    color: #C33;\n    background-image: url(../images/exclamation.gif);\n}\n.x-statusbar .x-status-valid {\n    background-image: url(../images/accept.png);\n}\n.x-status-error-list {\n    border-color: #C33;\n}\n.x-status-error-list li a {\n    color: #15428B;\n}.x-treegrid-root-table {\n    border-right: 1px solid;\n}\n\n.x-treegrid-root-node {\n    overflow: auto;\n}\n\n.x-treegrid-hd-hidden {\n    visibility: hidden;\n    border: 0;\n    width: 0;\n}\n\n.x-treegrid-col {\n    border-bottom: 1px solid;\n    height: 20px;\n    overflow: hidden;\n    vertical-align: top;\n\t-o-text-overflow: ellipsis;\n\ttext-overflow: ellipsis;\n    white-space: nowrap;\n}\n\n.x-treegrid-text {\n    padding-left: 4px;\n    -moz-user-select: none;\n    -khtml-user-select: none;\n}\n\n.x-treegrid-resizer {\n    border-left:1px solid;\n    border-right:1px solid;\n    position:absolute;\n    left:0;\n    top:0;\n}\n\n.x-treegrid-header-inner {\n    overflow: hidden;\n}\n\n.x-treegrid-root-table,\n.x-treegrid-col {\n    border-color: #ededed;\n}\n\n.x-treegrid-resizer {\n    border-left-color:#555;\n    border-right-color:#555;\n}"
  },
  {
    "path": "client/src/ext/ux/fileuploadfield/FileUploadField.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.form');\n\n/**\n * @class Ext.ux.form.FileUploadField\n * @extends Ext.form.TextField\n * Creates a file upload field.\n * @xtype fileuploadfield\n */\nExt.ux.form.FileUploadField = Ext.extend(Ext.form.TextField,  {\n    /**\n     * @cfg {String} buttonText The button text to display on the upload button (defaults to\n     * 'Browse...').  Note that if you supply a value for {@link #buttonCfg}, the buttonCfg.text\n     * value will be used instead if available.\n     */\n    buttonText: 'Browse...',\n    /**\n     * @cfg {Boolean} buttonOnly True to display the file upload field as a button with no visible\n     * text field (defaults to false).  If true, all inherited TextField members will still be available.\n     */\n    buttonOnly: false,\n    /**\n     * @cfg {Number} buttonOffset The number of pixels of space reserved between the button and the text field\n     * (defaults to 3).  Note that this only applies if {@link #buttonOnly} = false.\n     */\n    buttonOffset: 3,\n    /**\n     * @cfg {Object} buttonCfg A standard {@link Ext.Button} config object.\n     */\n\n    // private\n    readOnly: true,\n\n    /**\n     * @hide\n     * @method autoSize\n     */\n    autoSize: Ext.emptyFn,\n\n    // private\n    initComponent: function(){\n        Ext.ux.form.FileUploadField.superclass.initComponent.call(this);\n\n        this.addEvents(\n            /**\n             * @event fileselected\n             * Fires when the underlying file input field's value has changed from the user\n             * selecting a new file from the system file selection dialog.\n             * @param {Ext.ux.form.FileUploadField} this\n             * @param {String} value The file value returned by the underlying file input field\n             */\n            'fileselected'\n        );\n    },\n\n    // private\n    onRender : function(ct, position){\n        Ext.ux.form.FileUploadField.superclass.onRender.call(this, ct, position);\n\n        this.wrap = this.el.wrap({cls:'x-form-field-wrap x-form-file-wrap'});\n        this.el.addClass('x-form-file-text');\n        this.el.dom.removeAttribute('name');\n        this.createFileInput();\n\n        var btnCfg = Ext.applyIf(this.buttonCfg || {}, {\n            text: this.buttonText\n        });\n        this.button = new Ext.Button(Ext.apply(btnCfg, {\n            renderTo: this.wrap,\n            cls: 'x-form-file-btn' + (btnCfg.iconCls ? ' x-btn-icon' : '')\n        }));\n\n        if(this.buttonOnly){\n            this.el.hide();\n            this.wrap.setWidth(this.button.getEl().getWidth());\n        }\n\n        this.bindListeners();\n        this.resizeEl = this.positionEl = this.wrap;\n    },\n    \n    bindListeners: function(){\n        this.fileInput.on({\n            scope: this,\n            mouseenter: function() {\n                this.button.addClass(['x-btn-over','x-btn-focus'])\n            },\n            mouseleave: function(){\n                this.button.removeClass(['x-btn-over','x-btn-focus','x-btn-click'])\n            },\n            mousedown: function(){\n                this.button.addClass('x-btn-click')\n            },\n            mouseup: function(){\n                this.button.removeClass(['x-btn-over','x-btn-focus','x-btn-click'])\n            },\n            change: function(){\n                var v = this.fileInput.dom.value;\n\t\tv = v.replace(\"C:\\\\fakepath\\\\\",\"\");\n                this.setValue(v);\n                this.fireEvent('fileselected', this, v);    \n            }\n        }); \n    },\n    \n    createFileInput : function() {\n        this.fileInput = this.wrap.createChild({\n            id: this.getFileInputId(),\n            name: this.name||this.getId(),\n            cls: 'x-form-file',\n            tag: 'input',\n            type: 'file',\n            size: 1\n        });\n    },\n    \n    reset : function(){\n        if (this.rendered) {\n            this.fileInput.remove();\n            this.createFileInput();\n            this.bindListeners();\n        }\n        Ext.ux.form.FileUploadField.superclass.reset.call(this);\n    },\n\n    // private\n    getFileInputId: function(){\n        return this.id + '-file';\n    },\n\n    // private\n    onResize : function(w, h){\n        Ext.ux.form.FileUploadField.superclass.onResize.call(this, w, h);\n\n        this.wrap.setWidth(w);\n\n        if(!this.buttonOnly){\n            var w = this.wrap.getWidth() - this.button.getEl().getWidth() - this.buttonOffset;\n            this.el.setWidth(w);\n        }\n    },\n\n    // private\n    onDestroy: function(){\n        Ext.ux.form.FileUploadField.superclass.onDestroy.call(this);\n        Ext.destroy(this.fileInput, this.button, this.wrap);\n    },\n    \n    onDisable: function(){\n        Ext.ux.form.FileUploadField.superclass.onDisable.call(this);\n        this.doDisable(true);\n    },\n    \n    onEnable: function(){\n        Ext.ux.form.FileUploadField.superclass.onEnable.call(this);\n        this.doDisable(false);\n\n    },\n    \n    // private\n    doDisable: function(disabled){\n        this.fileInput.dom.disabled = disabled;\n        this.button.setDisabled(disabled);\n    },\n\n\n    // private\n    preFocus : Ext.emptyFn,\n\n    // private\n    alignErrorIcon : function(){\n        this.errorIcon.alignTo(this.wrap, 'tl-tr', [2, 0]);\n    }\n\n});\n\nExt.reg('fileuploadfield', Ext.ux.form.FileUploadField);\n\n// backwards compat\nExt.form.FileUploadField = Ext.ux.form.FileUploadField;\n"
  },
  {
    "path": "client/src/ext/ux/fileuploadfield/css/fileuploadfield.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/*\n * FileUploadField component styles\n */\n.x-form-file-wrap {\n    position: relative;\n    height: 22px;\n}\n.x-form-file-wrap .x-form-file {\n\tposition: absolute;\n\tright: 0;\n\t-moz-opacity: 0;\n\tfilter:alpha(opacity: 0);\n\topacity: 0;\n\tz-index: 2;\n    height: 22px;\n}\n.x-form-file-wrap .x-form-file-btn {\n\tposition: absolute;\n\tright: 0;\n\tz-index: 1;\n}\n.x-form-file-wrap .x-form-file-text {\n    position: absolute;\n    left: 0;\n    z-index: 3;\n    color: #777;\n}"
  },
  {
    "path": "client/src/ext/ux/gridfilters/GridFilters.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.namespace('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.GridFilters\n * @extends Ext.util.Observable\n * <p>GridFilter is a plugin (<code>ptype='gridfilters'</code>) for grids that\n * allow for a slightly more robust representation of filtering than what is\n * provided by the default store.</p>\n * <p>Filtering is adjusted by the user using the grid's column header menu\n * (this menu can be disabled through configuration). Through this menu users\n * can configure, enable, and disable filters for each column.</p>\n * <p><b><u>Features:</u></b></p>\n * <div class=\"mdetail-params\"><ul>\n * <li><b>Filtering implementations</b> :\n * <div class=\"sub-desc\">\n * Default filtering for Strings, Numeric Ranges, Date Ranges, Lists (which can\n * be backed by a Ext.data.Store), and Boolean. Additional custom filter types\n * and menus are easily created by extending Ext.ux.grid.filter.Filter.\n * </div></li>\n * <li><b>Graphical indicators</b> :\n * <div class=\"sub-desc\">\n * Columns that are filtered have {@link #filterCls a configurable css class}\n * applied to the column headers.\n * </div></li>\n * <li><b>Paging</b> :\n * <div class=\"sub-desc\">\n * If specified as a plugin to the grid's configured PagingToolbar, the current page\n * will be reset to page 1 whenever you update the filters.\n * </div></li>\n * <li><b>Automatic Reconfiguration</b> :\n * <div class=\"sub-desc\">\n * Filters automatically reconfigure when the grid 'reconfigure' event fires.\n * </div></li>\n * <li><b>Stateful</b> :\n * Filter information will be persisted across page loads by specifying a\n * <code>stateId</code> in the Grid configuration.\n * <div class=\"sub-desc\">\n * The filter collection binds to the\n * <code>{@link Ext.grid.GridPanel#beforestaterestore beforestaterestore}</code>\n * and <code>{@link Ext.grid.GridPanel#beforestatesave beforestatesave}</code>\n * events in order to be stateful.\n * </div></li>\n * <li><b>Grid Changes</b> :\n * <div class=\"sub-desc\"><ul>\n * <li>A <code>filters</code> <i>property</i> is added to the grid pointing to\n * this plugin.</li>\n * <li>A <code>filterupdate</code> <i>event</i> is added to the grid and is\n * fired upon onStateChange completion.</li>\n * </ul></div></li>\n * <li><b>Server side code examples</b> :\n * <div class=\"sub-desc\"><ul>\n * <li><a href=\"http://www.vinylfox.com/extjs/grid-filter-php-backend-code.php\">PHP</a> - (Thanks VinylFox)</li>\n * <li><a href=\"http://extjs.com/forum/showthread.php?p=77326#post77326\">Ruby on Rails</a> - (Thanks Zyclops)</li>\n * <li><a href=\"http://extjs.com/forum/showthread.php?p=176596#post176596\">Ruby on Rails</a> - (Thanks Rotomaul)</li>\n * <li><a href=\"http://www.debatablybeta.com/posts/using-extjss-grid-filtering-with-django/\">Python</a> - (Thanks Matt)</li>\n * <li><a href=\"http://mcantrell.wordpress.com/2008/08/22/extjs-grids-and-grails/\">Grails</a> - (Thanks Mike)</li>\n * </ul></div></li>\n * </ul></div>\n * <p><b><u>Example usage:</u></b></p>\n * <pre><code>\nvar store = new Ext.data.GroupingStore({\n    ...\n});\n\nvar filters = new Ext.ux.grid.GridFilters({\n    autoReload: false, //don&#39;t reload automatically\n    local: true, //only filter locally\n    // filters may be configured through the plugin,\n    // or in the column definition within the column model configuration\n    filters: [{\n        type: 'numeric',\n        dataIndex: 'id'\n    }, {\n        type: 'string',\n        dataIndex: 'name'\n    }, {\n        type: 'numeric',\n        dataIndex: 'price'\n    }, {\n        type: 'date',\n        dataIndex: 'dateAdded'\n    }, {\n        type: 'list',\n        dataIndex: 'size',\n        options: ['extra small', 'small', 'medium', 'large', 'extra large'],\n        phpMode: true\n    }, {\n        type: 'boolean',\n        dataIndex: 'visible'\n    }]\n});\nvar cm = new Ext.grid.ColumnModel([{\n    ...\n}]);\n\nvar grid = new Ext.grid.GridPanel({\n     ds: store,\n     cm: cm,\n     view: new Ext.grid.GroupingView(),\n     plugins: [filters],\n     height: 400,\n     width: 700,\n     bbar: new Ext.PagingToolbar({\n         store: store,\n         pageSize: 15,\n         plugins: [filters] //reset page to page 1 if filters change\n     })\n });\n\nstore.load({params: {start: 0, limit: 15}});\n\n// a filters property is added to the grid\ngrid.filters\n * </code></pre>\n */\nExt.ux.grid.GridFilters = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Boolean} autoReload\n     * Defaults to true, reloading the datasource when a filter change happens.\n     * Set this to false to prevent the datastore from being reloaded if there\n     * are changes to the filters.  See <code>{@link updateBuffer}</code>.\n     */\n    autoReload : true,\n    /**\n     * @cfg {Boolean} encode\n     * Specify true for {@link #buildQuery} to use Ext.util.JSON.encode to\n     * encode the filter query parameter sent with a remote request.\n     * Defaults to false.\n     */\n    /**\n     * @cfg {Array} filters\n     * An Array of filters config objects. Refer to each filter type class for\n     * configuration details specific to each filter type. Filters for Strings,\n     * Numeric Ranges, Date Ranges, Lists, and Boolean are the standard filters\n     * available.\n     */\n    /**\n     * @cfg {String} filterCls\n     * The css class to be applied to column headers with active filters.\n     * Defaults to <tt>'ux-filterd-column'</tt>.\n     */\n    filterCls : 'ux-filtered-column',\n    /**\n     * @cfg {Boolean} local\n     * <tt>true</tt> to use Ext.data.Store filter functions (local filtering)\n     * instead of the default (<tt>false</tt>) server side filtering.\n     */\n    local : false,\n    /**\n     * @cfg {String} menuFilterText\n     * defaults to <tt>'Filters'</tt>.\n     */\n    menuFilterText : 'Filters',\n    /**\n     * @cfg {String} paramPrefix\n     * The url parameter prefix for the filters.\n     * Defaults to <tt>'filter'</tt>.\n     */\n    paramPrefix : 'filter',\n    /**\n     * @cfg {Boolean} showMenu\n     * Defaults to true, including a filter submenu in the default header menu.\n     */\n    showMenu : true,\n    /**\n     * @cfg {String} stateId\n     * Name of the value to be used to store state information.\n     */\n    stateId : undefined,\n    /**\n     * @cfg {Integer} updateBuffer\n     * Number of milliseconds to defer store updates since the last filter change.\n     */\n    updateBuffer : 500,\n\n    /** @private */\n    constructor : function (config) {\n        config = config || {};\n        this.deferredUpdate = new Ext.util.DelayedTask(this.reload, this);\n        this.filters = new Ext.util.MixedCollection();\n        this.filters.getKey = function (o) {\n            return o ? o.dataIndex : null;\n        };\n        this.addFilters(config.filters);\n        delete config.filters;\n        Ext.apply(this, config);\n    },\n\n    /** @private */\n    init : function (grid) {\n        if (grid instanceof Ext.grid.GridPanel) {\n            this.grid = grid;\n\n            this.bindStore(this.grid.getStore(), true);\n            // assumes no filters were passed in the constructor, so try and use ones from the colModel\n            if(this.filters.getCount() == 0){\n                this.addFilters(this.grid.getColumnModel());\n            }\n\n            this.grid.filters = this;\n\n            this.grid.addEvents({'filterupdate': true});\n\n            grid.on({\n                scope: this,\n                beforestaterestore: this.applyState,\n                beforestatesave: this.saveState,\n                beforedestroy: this.destroy,\n                reconfigure: this.onReconfigure\n            });\n\n            if (grid.rendered){\n                this.onRender();\n            } else {\n                grid.on({\n                    scope: this,\n                    single: true,\n                    render: this.onRender\n                });\n            }\n\n        } else if (grid instanceof Ext.PagingToolbar) {\n            this.toolbar = grid;\n        }\n    },\n\n    /**\n     * @private\n     * Handler for the grid's beforestaterestore event (fires before the state of the\n     * grid is restored).\n     * @param {Object} grid The grid object\n     * @param {Object} state The hash of state values returned from the StateProvider.\n     */\n    applyState : function (grid, state) {\n        var key, filter;\n        this.applyingState = true;\n        this.clearFilters();\n        if (state.filters) {\n            for (key in state.filters) {\n                filter = this.filters.get(key);\n                if (filter) {\n                    filter.setValue(state.filters[key]);\n                    filter.setActive(true);\n                }\n            }\n        }\n        this.deferredUpdate.cancel();\n        if (this.local) {\n            this.reload();\n        }\n        delete this.applyingState;\n        delete state.filters;\n    },\n\n    /**\n     * Saves the state of all active filters\n     * @param {Object} grid\n     * @param {Object} state\n     * @return {Boolean}\n     */\n    saveState : function (grid, state) {\n        var filters = {};\n        this.filters.each(function (filter) {\n            if (filter.active) {\n                filters[filter.dataIndex] = filter.getValue();\n            }\n        });\n        return (state.filters = filters);\n    },\n\n    /**\n     * @private\n     * Handler called when the grid is rendered\n     */\n    onRender : function () {\n        this.grid.getView().on('refresh', this.onRefresh, this);\n        this.createMenu();\n    },\n\n    /**\n     * @private\n     * Handler called by the grid 'beforedestroy' event\n     */\n    destroy : function () {\n        this.removeAll();\n        this.purgeListeners();\n\n        if(this.filterMenu){\n            Ext.menu.MenuMgr.unregister(this.filterMenu);\n            this.filterMenu.destroy();\n             this.filterMenu = this.menu.menu = null;\n        }\n    },\n\n    /**\n     * Remove all filters, permanently destroying them.\n     */\n    removeAll : function () {\n        if(this.filters){\n            Ext.destroy.apply(Ext, this.filters.items);\n            // remove all items from the collection\n            this.filters.clear();\n        }\n    },\n\n\n    /**\n     * Changes the data store bound to this view and refreshes it.\n     * @param {Store} store The store to bind to this view\n     */\n    bindStore : function(store, initial){\n        if(!initial && this.store){\n            if (this.local) {\n                store.un('load', this.onLoad, this);\n            } else {\n                store.un('beforeload', this.onBeforeLoad, this);\n            }\n        }\n        if(store){\n            if (this.local) {\n                store.on('load', this.onLoad, this);\n            } else {\n                store.on('beforeload', this.onBeforeLoad, this);\n            }\n        }\n        this.store = store;\n    },\n\n    /**\n     * @private\n     * Handler called when the grid reconfigure event fires\n     */\n    onReconfigure : function () {\n        this.bindStore(this.grid.getStore());\n        this.store.clearFilter();\n        this.removeAll();\n        this.addFilters(this.grid.getColumnModel());\n        this.updateColumnHeadings();\n    },\n\n    createMenu : function () {\n        var view = this.grid.getView(),\n            hmenu = view.hmenu;\n\n        if (this.showMenu && hmenu) {\n\n            this.sep  = hmenu.addSeparator();\n            this.filterMenu = new Ext.menu.Menu({\n                id: this.grid.id + '-filters-menu'\n            });\n            this.menu = hmenu.add({\n                checked: false,\n                itemId: 'filters',\n                text: this.menuFilterText,\n                menu: this.filterMenu\n            });\n\n            this.menu.on({\n                scope: this,\n                checkchange: this.onCheckChange,\n                beforecheckchange: this.onBeforeCheck\n            });\n            hmenu.on('beforeshow', this.onMenu, this);\n        }\n        this.updateColumnHeadings();\n    },\n\n    /**\n     * @private\n     * Get the filter menu from the filters MixedCollection based on the clicked header\n     */\n    getMenuFilter : function () {\n        var view = this.grid.getView();\n        if (!view || view.hdCtxIndex === undefined) {\n            return null;\n        }\n        return this.filters.get(\n            view.cm.config[view.hdCtxIndex].dataIndex\n        );\n    },\n\n    /**\n     * @private\n     * Handler called by the grid's hmenu beforeshow event\n     */\n    onMenu : function (filterMenu) {\n        var filter = this.getMenuFilter();\n\n        if (filter) {\n/*\nTODO: lazy rendering\n            if (!filter.menu) {\n                filter.menu = filter.createMenu();\n            }\n*/\n            this.menu.menu = filter.menu;\n            this.menu.setChecked(filter.active, false);\n            // disable the menu if filter.disabled explicitly set to true\n            this.menu.setDisabled(filter.disabled === true);\n        }\n\n        this.menu.setVisible(filter !== undefined);\n        this.sep.setVisible(filter !== undefined);\n    },\n\n    /** @private */\n    onCheckChange : function (item, value) {\n        this.getMenuFilter().setActive(value);\n    },\n\n    /** @private */\n    onBeforeCheck : function (check, value) {\n        return !value || this.getMenuFilter().isActivatable();\n    },\n\n    /**\n     * @private\n     * Handler for all events on filters.\n     * @param {String} event Event name\n     * @param {Object} filter Standard signature of the event before the event is fired\n     */\n    onStateChange : function (event, filter) {\n        if (event === 'serialize') {\n            return;\n        }\n\n        if (filter == this.getMenuFilter()) {\n            this.menu.setChecked(filter.active, false);\n        }\n\n        if ((this.autoReload || this.local) && !this.applyingState) {\n            this.deferredUpdate.delay(this.updateBuffer);\n        }\n        this.updateColumnHeadings();\n\n        if (!this.applyingState) {\n            this.grid.saveState();\n        }\n        this.grid.fireEvent('filterupdate', this, filter);\n    },\n\n    /**\n     * @private\n     * Handler for store's beforeload event when configured for remote filtering\n     * @param {Object} store\n     * @param {Object} options\n     */\n    onBeforeLoad : function (store, options) {\n        options.params = options.params || {};\n        this.cleanParams(options.params);\n        var params = this.buildQuery(this.getFilterData());\n        Ext.apply(options.params, params);\n    },\n\n    /**\n     * @private\n     * Handler for store's load event when configured for local filtering\n     * @param {Object} store\n     * @param {Object} options\n     */\n    onLoad : function (store, options) {\n        store.filterBy(this.getRecordFilter());\n    },\n\n    /**\n     * @private\n     * Handler called when the grid's view is refreshed\n     */\n    onRefresh : function () {\n        this.updateColumnHeadings();\n    },\n\n    /**\n     * Update the styles for the header row based on the active filters\n     */\n    updateColumnHeadings : function () {\n        var view = this.grid.getView(),\n            i, len, filter;\n        if (view.mainHd) {\n            for (i = 0, len = view.cm.config.length; i < len; i++) {\n                filter = this.getFilter(view.cm.config[i].dataIndex);\n                Ext.fly(view.getHeaderCell(i))[filter && filter.active ? 'addClass' : 'removeClass'](this.filterCls);\n            }\n        }\n    },\n\n    /** @private */\n    reload : function () {\n        if (this.local) {\n            this.grid.store.clearFilter(true);\n            this.grid.store.filterBy(this.getRecordFilter());\n        } else {\n            var start,\n                store = this.grid.store;\n            this.deferredUpdate.cancel();\n            if (this.toolbar) {\n                start = store.paramNames.start;\n                if (store.lastOptions && store.lastOptions.params && store.lastOptions.params[start]) {\n                    store.lastOptions.params[start] = 0;\n                }\n            }\n            store.reload();\n        }\n    },\n\n    /**\n     * Method factory that generates a record validator for the filters active at the time\n     * of invokation.\n     * @private\n     */\n    getRecordFilter : function () {\n        var f = [], len, i;\n        this.filters.each(function (filter) {\n            if (filter.active) {\n                f.push(filter);\n            }\n        });\n\n        len = f.length;\n        return function (record) {\n            for (i = 0; i < len; i++) {\n                if (!f[i].validateRecord(record)) {\n                    return false;\n                }\n            }\n            return true;\n        };\n    },\n\n    /**\n     * Adds a filter to the collection and observes it for state change.\n     * @param {Object/Ext.ux.grid.filter.Filter} config A filter configuration or a filter object.\n     * @return {Ext.ux.grid.filter.Filter} The existing or newly created filter object.\n     */\n    addFilter : function (config) {\n        var Cls = this.getFilterClass(config.type),\n            filter = config.menu ? config : (new Cls(config));\n        this.filters.add(filter);\n\n        Ext.util.Observable.capture(filter, this.onStateChange, this);\n        return filter;\n    },\n\n    /**\n     * Adds filters to the collection.\n     * @param {Array/Ext.grid.ColumnModel} filters Either an Array of\n     * filter configuration objects or an Ext.grid.ColumnModel.  The columns\n     * of a passed Ext.grid.ColumnModel will be examined for a <code>filter</code>\n     * property and, if present, will be used as the filter configuration object.\n     */\n    addFilters : function (filters) {\n        if (filters) {\n            var i, len, filter, cm = false, dI;\n            if (filters instanceof Ext.grid.ColumnModel) {\n                filters = filters.config;\n                cm = true;\n            }\n            for (i = 0, len = filters.length; i < len; i++) {\n                filter = false;\n                if (cm) {\n                    dI = filters[i].dataIndex;\n                    filter = filters[i].filter || filters[i].filterable;\n                    if (filter){\n                        filter = (filter === true) ? {} : filter;\n                        Ext.apply(filter, {dataIndex:dI});\n                        // filter type is specified in order of preference:\n                        //     filter type specified in config\n                        //     type specified in store's field's type config\n                        filter.type = filter.type || this.store.fields.get(dI).type.type;\n                    }\n                } else {\n                    filter = filters[i];\n                }\n                // if filter config found add filter for the column\n                if (filter) {\n                    this.addFilter(filter);\n                }\n            }\n        }\n    },\n\n    /**\n     * Returns a filter for the given dataIndex, if one exists.\n     * @param {String} dataIndex The dataIndex of the desired filter object.\n     * @return {Ext.ux.grid.filter.Filter}\n     */\n    getFilter : function (dataIndex) {\n        return this.filters.get(dataIndex);\n    },\n\n    /**\n     * Turns all filters off. This does not clear the configuration information\n     * (see {@link #removeAll}).\n     */\n    clearFilters : function () {\n        this.filters.each(function (filter) {\n            filter.setActive(false);\n        });\n    },\n\n    /**\n     * Returns an Array of the currently active filters.\n     * @return {Array} filters Array of the currently active filters.\n     */\n    getFilterData : function () {\n        var filters = [], i, len;\n\n        this.filters.each(function (f) {\n            if (f.active) {\n                var d = [].concat(f.serialize());\n                for (i = 0, len = d.length; i < len; i++) {\n                    filters.push({\n                        field: f.dataIndex,\n                        data: d[i]\n                    });\n                }\n            }\n        });\n        return filters;\n    },\n\n    /**\n     * Function to take the active filters data and build it into a query.\n     * The format of the query depends on the <code>{@link #encode}</code>\n     * configuration:\n     * <div class=\"mdetail-params\"><ul>\n     *\n     * <li><b><tt>false</tt></b> : <i>Default</i>\n     * <div class=\"sub-desc\">\n     * Flatten into query string of the form (assuming <code>{@link #paramPrefix}='filters'</code>:\n     * <pre><code>\nfilters[0][field]=\"someDataIndex\"&\nfilters[0][data][comparison]=\"someValue1\"&\nfilters[0][data][type]=\"someValue2\"&\nfilters[0][data][value]=\"someValue3\"&\n     * </code></pre>\n     * </div></li>\n     * <li><b><tt>true</tt></b> :\n     * <div class=\"sub-desc\">\n     * JSON encode the filter data\n     * <pre><code>\nfilters[0][field]=\"someDataIndex\"&\nfilters[0][data][comparison]=\"someValue1\"&\nfilters[0][data][type]=\"someValue2\"&\nfilters[0][data][value]=\"someValue3\"&\n     * </code></pre>\n     * </div></li>\n     * </ul></div>\n     * Override this method to customize the format of the filter query for remote requests.\n     * @param {Array} filters A collection of objects representing active filters and their configuration.\n     *    Each element will take the form of {field: dataIndex, data: filterConf}. dataIndex is not assured\n     *    to be unique as any one filter may be a composite of more basic filters for the same dataIndex.\n     * @return {Object} Query keys and values\n     */\n    buildQuery : function (filters) {\n        var p = {}, i, f, root, dataPrefix, key, tmp,\n            len = filters.length;\n\n        if (!this.encode){\n            for (i = 0; i < len; i++) {\n                f = filters[i];\n                root = [this.paramPrefix, '[', i, ']'].join('');\n                p[root + '[field]'] = f.field;\n\n                dataPrefix = root + '[data]';\n                for (key in f.data) {\n                    p[[dataPrefix, '[', key, ']'].join('')] = f.data[key];\n                }\n            }\n        } else {\n            tmp = [];\n            for (i = 0; i < len; i++) {\n                f = filters[i];\n                tmp.push(Ext.apply(\n                    {},\n                    {field: f.field},\n                    f.data\n                ));\n            }\n            // only build if there is active filter\n            if (tmp.length > 0){\n                p[this.paramPrefix] = Ext.util.JSON.encode(tmp);\n            }\n        }\n        return p;\n    },\n\n    /**\n     * Removes filter related query parameters from the provided object.\n     * @param {Object} p Query parameters that may contain filter related fields.\n     */\n    cleanParams : function (p) {\n        // if encoding just delete the property\n        if (this.encode) {\n            delete p[this.paramPrefix];\n        // otherwise scrub the object of filter data\n        } else {\n            var regex, key;\n            regex = new RegExp('^' + this.paramPrefix + '\\[[0-9]+\\]');\n            for (key in p) {\n                if (regex.test(key)) {\n                    delete p[key];\n                }\n            }\n        }\n    },\n\n    /**\n     * Function for locating filter classes, overwrite this with your favorite\n     * loader to provide dynamic filter loading.\n     * @param {String} type The type of filter to load ('Filter' is automatically\n     * appended to the passed type; eg, 'string' becomes 'StringFilter').\n     * @return {Class} The Ext.ux.grid.filter.Class\n     */\n    getFilterClass : function (type) {\n        // map the supported Ext.data.Field type values into a supported filter\n        switch(type) {\n            case 'auto':\n              type = 'string';\n              break;\n            case 'int':\n            case 'float':\n              type = 'numeric';\n              break;\n            case 'bool':\n              type = 'boolean';\n              break;\n        }\n        return Ext.ux.grid.filter[type.substr(0, 1).toUpperCase() + type.substr(1) + 'Filter'];\n    }\n});\n\n// register ptype\nExt.preg('gridfilters', Ext.ux.grid.GridFilters);\n"
  },
  {
    "path": "client/src/ext/ux/gridfilters/css/GridFilters.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * GridFilters Styles\n **/\n/*\n.x-grid3-hd-row .ux-filtered-column {\n\tborder-left:  1px solid #C7E3B4;\n\tborder-right: 1px solid #C7E3B4;\n}\n\n.x-grid3-hd-row .ux-filtered-column .x-grid3-hd-inner {\n\tbackground-image: url(../images/header_bg.gif);\n}\n\n.ux-filtered-column .x-grid3-hd-btn {\n\tbackground-image: url(../images/hd-btn.gif);\n}\n*/\n.x-grid3-hd-row td.ux-filtered-column {   \n    font-style: italic;  \n    font-weight: bold;\n}\t\t\n\n.ux-filtered-column.sort-asc .x-grid3-sort-icon {\n\tbackground-image: url(../images/sort_filtered_asc.gif) !important;\n}\n\n.ux-filtered-column.sort-desc .x-grid3-sort-icon {\n\tbackground-image: url(../images/sort_filtered_desc.gif) !important;\n}\n\n.ux-gridfilter-text-icon {\n\tbackground-image: url(../images/find.png) !important;\n}\n\n/* Temporary Patch for Bug ??? */\n.x-menu-list-item-indent .x-menu-item-icon {\n\tposition: relative;\n    top: 3px;\n    left: 3px;\n\tmargin-right: 10px;\n}\nli.x-menu-list-item-indent {\n\tpadding-left:0px;\n}\nli.x-menu-list-item div {\n\tdisplay: block;\n}\n\n"
  },
  {
    "path": "client/src/ext/ux/gridfilters/css/RangeMenu.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * RangeMenu Styles\n **/\n.ux-rangemenu-gt {\n\tbackground-image: url(../images/greater_than.png) !important;\n}\n\n.ux-rangemenu-lt {\n\tbackground-image: url(../images/less_than.png) !important;\n}\n\n.ux-rangemenu-eq {\n\tbackground-image: url(../images/equals.png) !important;\n}\n"
  },
  {
    "path": "client/src/ext/ux/gridfilters/filter/BooleanFilter.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/** \n * @class Ext.ux.grid.filter.BooleanFilter\n * @extends Ext.ux.grid.filter.Filter\n * Boolean filters use unique radio group IDs (so you can have more than one!)\n * <p><b><u>Example Usage:</u></b></p>\n * <pre><code>    \nvar filters = new Ext.ux.grid.GridFilters({\n    ...\n    filters: [{\n        // required configs\n        type: 'boolean',\n        dataIndex: 'visible'\n\n        // optional configs\n        defaultValue: null, // leave unselected (false selected by default)\n        yesText: 'Yes',     // default\n        noText: 'No'        // default\n    }]\n});\n * </code></pre>\n */\nExt.ux.grid.filter.BooleanFilter = Ext.extend(Ext.ux.grid.filter.Filter, {\n\t/**\n\t * @cfg {Boolean} defaultValue\n\t * Set this to null if you do not want either option to be checked by default. Defaults to false.\n\t */\n\tdefaultValue : false,\n\t/**\n\t * @cfg {String} yesText\n\t * Defaults to 'Yes'.\n\t */\n\tyesText : 'Yes',\n\t/**\n\t * @cfg {String} noText\n\t * Defaults to 'No'.\n\t */\n\tnoText : 'No',\n\n    /**  \n     * @private\n     * Template method that is to initialize the filter and install required menu items.\n     */\n    init : function (config) {\n        var gId = Ext.id();\n\t\tthis.options = [\n\t\t\tnew Ext.menu.CheckItem({text: this.yesText, group: gId, checked: this.defaultValue === true}),\n\t\t\tnew Ext.menu.CheckItem({text: this.noText, group: gId, checked: this.defaultValue === false})];\n\t\t\n\t\tthis.menu.add(this.options[0], this.options[1]);\n\t\t\n\t\tfor(var i=0; i<this.options.length; i++){\n\t\t\tthis.options[i].on('click', this.fireUpdate, this);\n\t\t\tthis.options[i].on('checkchange', this.fireUpdate, this);\n\t\t}\n\t},\n\t\n    /**\n     * @private\n     * Template method that is to get and return the value of the filter.\n     * @return {String} The value of this filter\n     */\n    getValue : function () {\n\t\treturn this.options[0].checked;\n\t},\n\n    /**\n     * @private\n     * Template method that is to set the value of the filter.\n     * @param {Object} value The value to set the filter\n     */\t\n\tsetValue : function (value) {\n\t\tthis.options[value ? 0 : 1].setChecked(true);\n\t},\n\n    /**\n     * @private\n     * Template method that is to get and return serialized filter data for\n     * transmission to the server.\n     * @return {Object/Array} An object or collection of objects containing\n     * key value pairs representing the current configuration of the filter.\n     */\n    getSerialArgs : function () {\n\t\tvar args = {type: 'boolean', value: this.getValue()};\n\t\treturn args;\n\t},\n\t\n    /**\n     * Template method that is to validate the provided Ext.data.Record\n     * against the filters configuration.\n     * @param {Ext.data.Record} record The record to validate\n     * @return {Boolean} true if the record is valid within the bounds\n     * of the filter, false otherwise.\n     */\n    validateRecord : function (record) {\n\t\treturn record.get(this.dataIndex) == this.getValue();\n\t}\n});"
  },
  {
    "path": "client/src/ext/ux/gridfilters/filter/DateFilter.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/** \n * @class Ext.ux.grid.filter.DateFilter\n * @extends Ext.ux.grid.filter.Filter\n * Filter by a configurable Ext.menu.DateMenu\n * <p><b><u>Example Usage:</u></b></p>\n * <pre><code>    \nvar filters = new Ext.ux.grid.GridFilters({\n    ...\n    filters: [{\n        // required configs\n        type: 'date',\n        dataIndex: 'dateAdded',\n        \n        // optional configs\n        dateFormat: 'm/d/Y',  // default\n        beforeText: 'Before', // default\n        afterText: 'After',   // default\n        onText: 'On',         // default\n        pickerOpts: {\n            // any DateMenu configs\n        },\n\n        active: true // default is false\n    }]\n});\n * </code></pre>\n */\nExt.ux.grid.filter.DateFilter = Ext.extend(Ext.ux.grid.filter.Filter, {\n    /**\n     * @cfg {String} afterText\n     * Defaults to 'After'.\n     */\n    afterText : 'After',\n    /**\n     * @cfg {String} beforeText\n     * Defaults to 'Before'.\n     */\n    beforeText : 'Before',\n    /**\n     * @cfg {Object} compareMap\n     * Map for assigning the comparison values used in serialization.\n     */\n    compareMap : {\n        before: 'lt',\n        after:  'gt',\n        on:     'eq'\n    },\n    /**\n     * @cfg {String} dateFormat\n     * The date format to return when using getValue.\n     * Defaults to 'm/d/Y'.\n     */\n    dateFormat : 'm/d/Y',\n\n    /**\n     * @cfg {Date} maxDate\n     * Allowable date as passed to the Ext.DatePicker\n     * Defaults to undefined.\n     */\n    /**\n     * @cfg {Date} minDate\n     * Allowable date as passed to the Ext.DatePicker\n     * Defaults to undefined.\n     */\n    /**\n     * @cfg {Array} menuItems\n     * The items to be shown in this menu\n     * Defaults to:<pre>\n     * menuItems : ['before', 'after', '-', 'on'],\n     * </pre>\n     */\n    menuItems : ['before', 'after', '-', 'on'],\n\n    /**\n     * @cfg {Object} menuItemCfgs\n     * Default configuration options for each menu item\n     */\n    menuItemCfgs : {\n        selectOnFocus: true,\n        width: 125\n    },\n\n    /**\n     * @cfg {String} onText\n     * Defaults to 'On'.\n     */\n    onText : 'On',\n    \n    /**\n     * @cfg {Object} pickerOpts\n     * Configuration options for the date picker associated with each field.\n     */\n    pickerOpts : {},\n\n    /**  \n     * @private\n     * Template method that is to initialize the filter and install required menu items.\n     */\n    init : function (config) {\n        var menuCfg, i, len, item, cfg, Cls;\n\n        menuCfg = Ext.apply(this.pickerOpts, {\n            minDate: this.minDate, \n            maxDate: this.maxDate, \n            format:  this.dateFormat,\n            listeners: {\n                scope: this,\n                select: this.onMenuSelect\n            }\n        });\n\n        this.fields = {};\n        for (i = 0, len = this.menuItems.length; i < len; i++) {\n            item = this.menuItems[i];\n            if (item !== '-') {\n                cfg = {\n                    itemId: 'range-' + item,\n                    text: this[item + 'Text'],\n                    menu: new Ext.menu.DateMenu(\n                        Ext.apply(menuCfg, {\n                            itemId: item\n                        })\n                    ),\n                    listeners: {\n                        scope: this,\n                        checkchange: this.onCheckChange\n                    }\n                };\n                Cls = Ext.menu.CheckItem;\n                item = this.fields[item] = new Cls(cfg);\n            }\n            //this.add(item);\n            this.menu.add(item);\n        }\n    },\n\n    onCheckChange : function () {\n        this.setActive(this.isActivatable());\n        this.fireEvent('update', this);\n    },\n\n    /**  \n     * @private\n     * Handler method called when there is a keyup event on an input\n     * item of this menu.\n     */\n    onInputKeyUp : function (field, e) {\n        var k = e.getKey();\n        if (k == e.RETURN && field.isValid()) {\n            e.stopEvent();\n            this.menu.hide(true);\n            return;\n        }\n    },\n\n    /**\n     * Handler for when the menu for a field fires the 'select' event\n     * @param {Object} date\n     * @param {Object} menuItem\n     * @param {Object} value\n     * @param {Object} picker\n     */\n    onMenuSelect : function (menuItem, value, picker) {\n        var fields = this.fields,\n            field = this.fields[menuItem.itemId];\n        \n        field.setChecked(true);\n        \n        if (field == fields.on) {\n            fields.before.setChecked(false, true);\n            fields.after.setChecked(false, true);\n        } else {\n            fields.on.setChecked(false, true);\n            if (field == fields.after && fields.before.menu.picker.value < value) {\n                fields.before.setChecked(false, true);\n            } else if (field == fields.before && fields.after.menu.picker.value > value) {\n                fields.after.setChecked(false, true);\n            }\n        }\n        this.fireEvent('update', this);\n    },\n\n    /**\n     * @private\n     * Template method that is to get and return the value of the filter.\n     * @return {String} The value of this filter\n     */\n    getValue : function () {\n        var key, result = {};\n        for (key in this.fields) {\n            if (this.fields[key].checked) {\n                result[key] = this.fields[key].menu.picker.getValue();\n            }\n        }\n        return result;\n    },\n\n    /**\n     * @private\n     * Template method that is to set the value of the filter.\n     * @param {Object} value The value to set the filter\n     * @param {Boolean} preserve true to preserve the checked status\n     * of the other fields.  Defaults to false, unchecking the\n     * other fields\n     */\t\n    setValue : function (value, preserve) {\n        var key;\n        for (key in this.fields) {\n            if(value[key]){\n                this.fields[key].menu.picker.setValue(value[key]);\n                this.fields[key].setChecked(true);\n            } else if (!preserve) {\n                this.fields[key].setChecked(false);\n            }\n        }\n        this.fireEvent('update', this);\n    },\n\n    /**\n     * @private\n     * Template method that is to return <tt>true</tt> if the filter\n     * has enough configuration information to be activated.\n     * @return {Boolean}\n     */\n    isActivatable : function () {\n        var key;\n        for (key in this.fields) {\n            if (this.fields[key].checked) {\n                return true;\n            }\n        }\n        return false;\n    },\n\n    /**\n     * @private\n     * Template method that is to get and return serialized filter data for\n     * transmission to the server.\n     * @return {Object/Array} An object or collection of objects containing\n     * key value pairs representing the current configuration of the filter.\n     */\n    getSerialArgs : function () {\n        var args = [];\n        for (var key in this.fields) {\n            if(this.fields[key].checked){\n                args.push({\n                    type: 'date',\n                    comparison: this.compareMap[key],\n                    value: this.getFieldValue(key).format(this.dateFormat)\n                });\n            }\n        }\n        return args;\n    },\n\n    /**\n     * Get and return the date menu picker value\n     * @param {String} item The field identifier ('before', 'after', 'on')\n     * @return {Date} Gets the current selected value of the date field\n     */\n    getFieldValue : function(item){\n        return this.fields[item].menu.picker.getValue();\n    },\n    \n    /**\n     * Gets the menu picker associated with the passed field\n     * @param {String} item The field identifier ('before', 'after', 'on')\n     * @return {Object} The menu picker\n     */\n    getPicker : function(item){\n        return this.fields[item].menu.picker;\n    },\n\n    /**\n     * Template method that is to validate the provided Ext.data.Record\n     * against the filters configuration.\n     * @param {Ext.data.Record} record The record to validate\n     * @return {Boolean} true if the record is valid within the bounds\n     * of the filter, false otherwise.\n     */\n    validateRecord : function (record) {\n        var key,\n            pickerValue,\n            val = record.get(this.dataIndex);\n            \n        if(!Ext.isDate(val)){\n            return false;\n        }\n        val = val.clearTime(true).getTime();\n        \n        for (key in this.fields) {\n            if (this.fields[key].checked) {\n                pickerValue = this.getFieldValue(key).clearTime(true).getTime();\n                if (key == 'before' && pickerValue <= val) {\n                    return false;\n                }\n                if (key == 'after' && pickerValue >= val) {\n                    return false;\n                }\n                if (key == 'on' && pickerValue != val) {\n                    return false;\n                }\n            }\n        }\n        return true;\n    }\n});"
  },
  {
    "path": "client/src/ext/ux/gridfilters/filter/Filter.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.namespace('Ext.ux.grid.filter');\n\n/** \n * @class Ext.ux.grid.filter.Filter\n * @extends Ext.util.Observable\n * Abstract base class for filter implementations.\n */\nExt.ux.grid.filter.Filter = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Boolean} active\n     * Indicates the initial status of the filter (defaults to false).\n     */\n    active : false,\n    /**\n     * True if this filter is active.  Use setActive() to alter after configuration.\n     * @type Boolean\n     * @property active\n     */\n    /**\n     * @cfg {String} dataIndex \n     * The {@link Ext.data.Store} dataIndex of the field this filter represents.\n     * The dataIndex does not actually have to exist in the store.\n     */\n    dataIndex : null,\n    /**\n     * The filter configuration menu that will be installed into the filter submenu of a column menu.\n     * @type Ext.menu.Menu\n     * @property\n     */\n    menu : null,\n    /**\n     * @cfg {Number} updateBuffer\n     * Number of milliseconds to wait after user interaction to fire an update. Only supported \n     * by filters: 'list', 'numeric', and 'string'. Defaults to 500.\n     */\n    updateBuffer : 500,\n\n    constructor : function (config) {\n        Ext.apply(this, config);\n            \n        this.addEvents(\n            /**\n             * @event activate\n             * Fires when an inactive filter becomes active\n             * @param {Ext.ux.grid.filter.Filter} this\n             */\n            'activate',\n            /**\n             * @event deactivate\n             * Fires when an active filter becomes inactive\n             * @param {Ext.ux.grid.filter.Filter} this\n             */\n            'deactivate',\n            /**\n             * @event serialize\n             * Fires after the serialization process. Use this to attach additional parameters to serialization\n             * data before it is encoded and sent to the server.\n             * @param {Array/Object} data A map or collection of maps representing the current filter configuration.\n             * @param {Ext.ux.grid.filter.Filter} filter The filter being serialized.\n             */\n            'serialize',\n            /**\n             * @event update\n             * Fires when a filter configuration has changed\n             * @param {Ext.ux.grid.filter.Filter} this The filter object.\n             */\n            'update'\n        );\n        Ext.ux.grid.filter.Filter.superclass.constructor.call(this);\n\n        this.menu = new Ext.menu.Menu();\n        this.init(config);\n        if(config && config.value){\n            this.setValue(config.value);\n            this.setActive(config.active !== false, true);\n            delete config.value;\n        }\n    },\n\n    /**\n     * Destroys this filter by purging any event listeners, and removing any menus.\n     */\n    destroy : function(){\n        if (this.menu){\n            this.menu.destroy();\n        }\n        this.purgeListeners();\n    },\n\n    /**\n     * Template method to be implemented by all subclasses that is to\n     * initialize the filter and install required menu items.\n     * Defaults to Ext.emptyFn.\n     */\n    init : Ext.emptyFn,\n    \n    /**\n     * Template method to be implemented by all subclasses that is to\n     * get and return the value of the filter.\n     * Defaults to Ext.emptyFn.\n     * @return {Object} The 'serialized' form of this filter\n     * @methodOf Ext.ux.grid.filter.Filter\n     */\n    getValue : Ext.emptyFn,\n    \n    /**\n     * Template method to be implemented by all subclasses that is to\n     * set the value of the filter and fire the 'update' event.\n     * Defaults to Ext.emptyFn.\n     * @param {Object} data The value to set the filter\n     * @methodOf Ext.ux.grid.filter.Filter\n     */\t\n    setValue : Ext.emptyFn,\n    \n    /**\n     * Template method to be implemented by all subclasses that is to\n     * return <tt>true</tt> if the filter has enough configuration information to be activated.\n     * Defaults to <tt>return true</tt>.\n     * @return {Boolean}\n     */\n    isActivatable : function(){\n        return true;\n    },\n    \n    /**\n     * Template method to be implemented by all subclasses that is to\n     * get and return serialized filter data for transmission to the server.\n     * Defaults to Ext.emptyFn.\n     */\n    getSerialArgs : Ext.emptyFn,\n\n    /**\n     * Template method to be implemented by all subclasses that is to\n     * validates the provided Ext.data.Record against the filters configuration.\n     * Defaults to <tt>return true</tt>.\n     * @param {Ext.data.Record} record The record to validate\n     * @return {Boolean} true if the record is valid within the bounds\n     * of the filter, false otherwise.\n     */\n    validateRecord : function(){\n        return true;\n    },\n\n    /**\n     * Returns the serialized filter data for transmission to the server\n     * and fires the 'serialize' event.\n     * @return {Object/Array} An object or collection of objects containing\n     * key value pairs representing the current configuration of the filter.\n     * @methodOf Ext.ux.grid.filter.Filter\n     */\n    serialize : function(){\n        var args = this.getSerialArgs();\n        this.fireEvent('serialize', args, this);\n        return args;\n    },\n\n    /** @private */\n    fireUpdate : function(){\n        if (this.active) {\n            this.fireEvent('update', this);\n        }\n        this.setActive(this.isActivatable());\n    },\n    \n    /**\n     * Sets the status of the filter and fires the appropriate events.\n     * @param {Boolean} active        The new filter state.\n     * @param {Boolean} suppressEvent True to prevent events from being fired.\n     * @methodOf Ext.ux.grid.filter.Filter\n     */\n    setActive : function(active, suppressEvent){\n        if(this.active != active){\n            this.active = active;\n            if (suppressEvent !== true) {\n                this.fireEvent(active ? 'activate' : 'deactivate', this);\n            }\n        }\n    }    \n});"
  },
  {
    "path": "client/src/ext/ux/gridfilters/filter/ListFilter.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/** \n * @class Ext.ux.grid.filter.ListFilter\n * @extends Ext.ux.grid.filter.Filter\n * <p>List filters are able to be preloaded/backed by an Ext.data.Store to load\n * their options the first time they are shown. ListFilter utilizes the\n * {@link Ext.ux.menu.ListMenu} component.</p>\n * <p>Although not shown here, this class accepts all configuration options\n * for {@link Ext.ux.menu.ListMenu}.</p>\n * \n * <p><b><u>Example Usage:</u></b></p>\n * <pre><code>    \nvar filters = new Ext.ux.grid.GridFilters({\n    ...\n    filters: [{\n        type: 'list',\n        dataIndex: 'size',\n        phpMode: true,\n        // options will be used as data to implicitly creates an ArrayStore\n        options: ['extra small', 'small', 'medium', 'large', 'extra large']\n    }]\n});\n * </code></pre>\n * \n */\nExt.ux.grid.filter.ListFilter = Ext.extend(Ext.ux.grid.filter.Filter, {\n\n    /**\n     * @cfg {Array} options\n     * <p><code>data</code> to be used to implicitly create a data store\n     * to back this list when the data source is <b>local</b>. If the\n     * data for the list is remote, use the <code>{@link #store}</code>\n     * config instead.</p>\n     * <br><p>Each item within the provided array may be in one of the\n     * following formats:</p>\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>Array</b> :\n     * <pre><code>\noptions: [\n    [11, 'extra small'], \n    [18, 'small'],\n    [22, 'medium'],\n    [35, 'large'],\n    [44, 'extra large']\n]\n     * </code></pre>\n     * </li>\n     * <li><b>Object</b> :\n     * <pre><code>\nlabelField: 'name', // override default of 'text'\noptions: [\n    {id: 11, name:'extra small'}, \n    {id: 18, name:'small'}, \n    {id: 22, name:'medium'}, \n    {id: 35, name:'large'}, \n    {id: 44, name:'extra large'} \n]\n     * </code></pre>\n     * </li>\n     * <li><b>String</b> :\n     * <pre><code>\n     * options: ['extra small', 'small', 'medium', 'large', 'extra large']\n     * </code></pre>\n     * </li>\n     */\n    /**\n     * @cfg {Boolean} phpMode\n     * <p>Adjust the format of this filter. Defaults to false.</p>\n     * <br><p>When GridFilters <code>@cfg encode = false</code> (default):</p>\n     * <pre><code>\n// phpMode == false (default):\nfilter[0][data][type] list\nfilter[0][data][value] value1\nfilter[0][data][value] value2\nfilter[0][field] prod \n\n// phpMode == true:\nfilter[0][data][type] list\nfilter[0][data][value] value1, value2\nfilter[0][field] prod \n     * </code></pre>\n     * When GridFilters <code>@cfg encode = true</code>:\n     * <pre><code>\n// phpMode == false (default):\nfilter : [{\"type\":\"list\",\"value\":[\"small\",\"medium\"],\"field\":\"size\"}]\n\n// phpMode == true:\nfilter : [{\"type\":\"list\",\"value\":\"small,medium\",\"field\":\"size\"}]\n     * </code></pre>\n     */\n    phpMode : false,\n    /**\n     * @cfg {Ext.data.Store} store\n     * The {@link Ext.data.Store} this list should use as its data source\n     * when the data source is <b>remote</b>. If the data for the list\n     * is local, use the <code>{@link #options}</code> config instead.\n     */\n\n    /**  \n     * @private\n     * Template method that is to initialize the filter and install required menu items.\n     * @param {Object} config\n     */\n    init : function (config) {\n        this.dt = new Ext.util.DelayedTask(this.fireUpdate, this);\n\n        // if a menu already existed, do clean up first\n        if (this.menu){\n            this.menu.destroy();\n        }\n        this.menu = new Ext.ux.menu.ListMenu(config);\n        this.menu.on('checkchange', this.onCheckChange, this);\n    },\n    \n    /**\n     * @private\n     * Template method that is to get and return the value of the filter.\n     * @return {String} The value of this filter\n     */\n    getValue : function () {\n        return this.menu.getSelected();\n    },\n    /**\n     * @private\n     * Template method that is to set the value of the filter.\n     * @param {Object} value The value to set the filter\n     */\t\n    setValue : function (value) {\n        this.menu.setSelected(value);\n        this.fireEvent('update', this);\n    },\n\n    /**\n     * @private\n     * Template method that is to return <tt>true</tt> if the filter\n     * has enough configuration information to be activated.\n     * @return {Boolean}\n     */\n    isActivatable : function () {\n        return this.getValue().length > 0;\n    },\n    \n    /**\n     * @private\n     * Template method that is to get and return serialized filter data for\n     * transmission to the server.\n     * @return {Object/Array} An object or collection of objects containing\n     * key value pairs representing the current configuration of the filter.\n     */\n    getSerialArgs : function () {\n        var args = {type: 'list', value: this.phpMode ? this.getValue().join(',') : this.getValue()};\n        return args;\n    },\n\n    /** @private */\n    onCheckChange : function(){\n        this.dt.delay(this.updateBuffer);\n    },\n    \n    \n    /**\n     * Template method that is to validate the provided Ext.data.Record\n     * against the filters configuration.\n     * @param {Ext.data.Record} record The record to validate\n     * @return {Boolean} true if the record is valid within the bounds\n     * of the filter, false otherwise.\n     */\n    validateRecord : function (record) {\n        return this.getValue().indexOf(record.get(this.dataIndex)) > -1;\n    }\n});"
  },
  {
    "path": "client/src/ext/ux/gridfilters/filter/NumericFilter.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/** \n * @class Ext.ux.grid.filter.NumericFilter\n * @extends Ext.ux.grid.filter.Filter\n * Filters using an Ext.ux.menu.RangeMenu.\n * <p><b><u>Example Usage:</u></b></p>\n * <pre><code>    \nvar filters = new Ext.ux.grid.GridFilters({\n    ...\n    filters: [{\n        type: 'numeric',\n        dataIndex: 'price'\n    }]\n});\n * </code></pre> \n */\nExt.ux.grid.filter.NumericFilter = Ext.extend(Ext.ux.grid.filter.Filter, {\n\n    /**\n     * @cfg {Object} fieldCls\n     * The Class to use to construct each field item within this menu\n     * Defaults to:<pre>\n     * fieldCls : Ext.form.NumberField\n     * </pre>\n     */\n    fieldCls : Ext.form.NumberField,\n    /**\n     * @cfg {Object} fieldCfg\n     * The default configuration options for any field item unless superseded\n     * by the <code>{@link #fields}</code> configuration.\n     * Defaults to:<pre>\n     * fieldCfg : {}\n     * </pre>\n     * Example usage:\n     * <pre><code>\nfieldCfg : {\n    width: 150,\n},\n     * </code></pre>\n     */\n    /**\n     * @cfg {Object} fields\n     * The field items may be configured individually\n     * Defaults to <tt>undefined</tt>.\n     * Example usage:\n     * <pre><code>\nfields : {\n    gt: { // override fieldCfg options\n        width: 200,\n        fieldCls: Ext.ux.form.CustomNumberField // to override default {@link #fieldCls}\n    }\n},\n     * </code></pre>\n     */\n    /**\n     * @cfg {Object} iconCls\n     * The iconCls to be applied to each comparator field item.\n     * Defaults to:<pre>\niconCls : {\n    gt : 'ux-rangemenu-gt',\n    lt : 'ux-rangemenu-lt',\n    eq : 'ux-rangemenu-eq'\n}\n     * </pre>\n     */\n    iconCls : {\n        gt : 'ux-rangemenu-gt',\n        lt : 'ux-rangemenu-lt',\n        eq : 'ux-rangemenu-eq'\n    },\n\n    /**\n     * @cfg {Object} menuItemCfgs\n     * Default configuration options for each menu item\n     * Defaults to:<pre>\nmenuItemCfgs : {\n    emptyText: 'Enter Filter Text...',\n    selectOnFocus: true,\n    width: 125\n}\n     * </pre>\n     */\n    menuItemCfgs : {\n        emptyText: 'Enter Filter Text...',\n        selectOnFocus: true,\n        width: 125\n    },\n\n    /**\n     * @cfg {Array} menuItems\n     * The items to be shown in this menu.  Items are added to the menu\n     * according to their position within this array. Defaults to:<pre>\n     * menuItems : ['lt','gt','-','eq']\n     * </pre>\n     */\n    menuItems : ['lt', 'gt', '-', 'eq'],\n\n    /**  \n     * @private\n     * Template method that is to initialize the filter and install required menu items.\n     */\n    init : function (config) {\n        // if a menu already existed, do clean up first\n        if (this.menu){\n            this.menu.destroy();\n        }        \n        this.menu = new Ext.ux.menu.RangeMenu(Ext.apply(config, {\n            // pass along filter configs to the menu\n            fieldCfg : this.fieldCfg || {},\n            fieldCls : this.fieldCls,\n            fields : this.fields || {},\n            iconCls: this.iconCls,\n            menuItemCfgs: this.menuItemCfgs,\n            menuItems: this.menuItems,\n            updateBuffer: this.updateBuffer\n        }));\n        // relay the event fired by the menu\n        this.menu.on('update', this.fireUpdate, this);\n    },\n    \n    /**\n     * @private\n     * Template method that is to get and return the value of the filter.\n     * @return {String} The value of this filter\n     */\n    getValue : function () {\n        return this.menu.getValue();\n    },\n\n    /**\n     * @private\n     * Template method that is to set the value of the filter.\n     * @param {Object} value The value to set the filter\n     */\t\n    setValue : function (value) {\n        this.menu.setValue(value);\n    },\n\n    /**\n     * @private\n     * Template method that is to return <tt>true</tt> if the filter\n     * has enough configuration information to be activated.\n     * @return {Boolean}\n     */\n    isActivatable : function () {\n        var values = this.getValue();\n        for (key in values) {\n            if (values[key] !== undefined) {\n                return true;\n            }\n        }\n        return false;\n    },\n    \n    /**\n     * @private\n     * Template method that is to get and return serialized filter data for\n     * transmission to the server.\n     * @return {Object/Array} An object or collection of objects containing\n     * key value pairs representing the current configuration of the filter.\n     */\n    getSerialArgs : function () {\n        var key,\n            args = [],\n            values = this.menu.getValue();\n        for (key in values) {\n            args.push({\n                type: 'numeric',\n                comparison: key,\n                value: values[key]\n            });\n        }\n        return args;\n    },\n\n    /**\n     * Template method that is to validate the provided Ext.data.Record\n     * against the filters configuration.\n     * @param {Ext.data.Record} record The record to validate\n     * @return {Boolean} true if the record is valid within the bounds\n     * of the filter, false otherwise.\n     */\n    validateRecord : function (record) {\n        var val = record.get(this.dataIndex),\n            values = this.getValue();\n        if (values.eq !== undefined && val != values.eq) {\n            return false;\n        }\n        if (values.lt !== undefined && val >= values.lt) {\n            return false;\n        }\n        if (values.gt !== undefined && val <= values.gt) {\n            return false;\n        }\n        return true;\n    }\n});"
  },
  {
    "path": "client/src/ext/ux/gridfilters/filter/StringFilter.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/** \n * @class Ext.ux.grid.filter.StringFilter\n * @extends Ext.ux.grid.filter.Filter\n * Filter by a configurable Ext.form.TextField\n * <p><b><u>Example Usage:</u></b></p>\n * <pre><code>    \nvar filters = new Ext.ux.grid.GridFilters({\n    ...\n    filters: [{\n        // required configs\n        type: 'string',\n        dataIndex: 'name',\n        \n        // optional configs\n        value: 'foo',\n        active: true, // default is false\n        iconCls: 'ux-gridfilter-text-icon' // default\n        // any Ext.form.TextField configs accepted\n    }]\n});\n * </code></pre>\n */\nExt.ux.grid.filter.StringFilter = Ext.extend(Ext.ux.grid.filter.Filter, {\n\n    /**\n     * @cfg {String} iconCls\n     * The iconCls to be applied to the menu item.\n     * Defaults to <tt>'ux-gridfilter-text-icon'</tt>.\n     */\n    iconCls : 'ux-gridfilter-text-icon',\n\n    emptyText: 'Enter Filter Text...',\n    selectOnFocus: true,\n    width: 125,\n    \n    /**  \n     * @private\n     * Template method that is to initialize the filter and install required menu items.\n     */\n    init : function (config) {\n        Ext.applyIf(config, {\n            enableKeyEvents: true,\n            iconCls: this.iconCls,\n            listeners: {\n                scope: this,\n                keyup: this.onInputKeyUp\n            }\n        });\n\n        this.inputItem = new Ext.form.TextField(config); \n        this.menu.add(this.inputItem);\n        this.updateTask = new Ext.util.DelayedTask(this.fireUpdate, this);\n    },\n    \n    /**\n     * @private\n     * Template method that is to get and return the value of the filter.\n     * @return {String} The value of this filter\n     */\n    getValue : function () {\n        return this.inputItem.getValue();\n    },\n    \n    /**\n     * @private\n     * Template method that is to set the value of the filter.\n     * @param {Object} value The value to set the filter\n     */\t\n    setValue : function (value) {\n        this.inputItem.setValue(value);\n        this.fireEvent('update', this);\n    },\n\n    /**\n     * @private\n     * Template method that is to return <tt>true</tt> if the filter\n     * has enough configuration information to be activated.\n     * @return {Boolean}\n     */\n    isActivatable : function () {\n        return this.inputItem.getValue().length > 0;\n    },\n\n    /**\n     * @private\n     * Template method that is to get and return serialized filter data for\n     * transmission to the server.\n     * @return {Object/Array} An object or collection of objects containing\n     * key value pairs representing the current configuration of the filter.\n     */\n    getSerialArgs : function () {\n        return {type: 'string', value: this.getValue()};\n    },\n\n    /**\n     * Template method that is to validate the provided Ext.data.Record\n     * against the filters configuration.\n     * @param {Ext.data.Record} record The record to validate\n     * @return {Boolean} true if the record is valid within the bounds\n     * of the filter, false otherwise.\n     */\n    validateRecord : function (record) {\n        var val = record.get(this.dataIndex);\n\n        if(typeof val != 'string') {\n            return (this.getValue().length === 0);\n        }\n\n        return val.toLowerCase().indexOf(this.getValue().toLowerCase()) > -1;\n    },\n    \n    /**  \n     * @private\n     * Handler method called when there is a keyup event on this.inputItem\n     */\n    onInputKeyUp : function (field, e) {\n        var k = e.getKey();\n        if (k == e.RETURN && field.isValid()) {\n            e.stopEvent();\n            this.menu.hide(true);\n            return;\n        }\n        // restart the timer\n        this.updateTask.delay(this.updateBuffer);\n    }\n});\n"
  },
  {
    "path": "client/src/ext/ux/gridfilters/menu/ListMenu.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.namespace('Ext.ux.menu');\n\n/** \n * @class Ext.ux.menu.ListMenu\n * @extends Ext.menu.Menu\n * This is a supporting class for {@link Ext.ux.grid.filter.ListFilter}.\n * Although not listed as configuration options for this class, this class\n * also accepts all configuration options from {@link Ext.ux.grid.filter.ListFilter}.\n */\nExt.ux.menu.ListMenu = Ext.extend(Ext.menu.Menu, {\n    /**\n     * @cfg {String} labelField\n     * Defaults to 'text'.\n     */\n    labelField :  'text',\n    /**\n     * @cfg {String} paramPrefix\n     * Defaults to 'Loading...'.\n     */\n    loadingText : 'Loading...',\n    /**\n     * @cfg {Boolean} loadOnShow\n     * Defaults to true.\n     */\n    loadOnShow : true,\n    /**\n     * @cfg {Boolean} single\n     * Specify true to group all items in this list into a single-select\n     * radio button group. Defaults to false.\n     */\n    single : false,\n\n    constructor : function (cfg) {\n        this.selected = [];\n        this.addEvents(\n            /**\n             * @event checkchange\n             * Fires when there is a change in checked items from this list\n             * @param {Object} item Ext.menu.CheckItem\n             * @param {Object} checked The checked value that was set\n             */\n            'checkchange'\n        );\n      \n        Ext.ux.menu.ListMenu.superclass.constructor.call(this, cfg = cfg || {});\n    \n        if(!cfg.store && cfg.options){\n            var options = [];\n            for(var i=0, len=cfg.options.length; i<len; i++){\n                var value = cfg.options[i];\n                switch(Ext.type(value)){\n                    case 'array':  options.push(value); break;\n                    case 'object': options.push([value.id, value[this.labelField]]); break;\n                    case 'string': options.push([value, value]); break;\n                }\n            }\n            \n            this.store = new Ext.data.Store({\n                reader: new Ext.data.ArrayReader({id: 0}, ['id', this.labelField]),\n                data:   options,\n                listeners: {\n                    'load': this.onLoad,\n                    scope:  this\n                }\n            });\n            this.loaded = true;\n        } else {\n            this.add({text: this.loadingText, iconCls: 'loading-indicator'});\n            this.store.on('load', this.onLoad, this);\n        }\n    },\n\n    destroy : function () {\n        if (this.store) {\n            this.store.destroy();    \n        }\n        Ext.ux.menu.ListMenu.superclass.destroy.call(this);\n    },\n\n    /**\n     * Lists will initially show a 'loading' item while the data is retrieved from the store.\n     * In some cases the loaded data will result in a list that goes off the screen to the\n     * right (as placement calculations were done with the loading item). This adapter will\n     * allow show to be called with no arguments to show with the previous arguments and\n     * thus recalculate the width and potentially hang the menu from the left.\n     */\n    show : function () {\n        var lastArgs = null;\n        return function(){\n            if(arguments.length === 0){\n                Ext.ux.menu.ListMenu.superclass.show.apply(this, lastArgs);\n            } else {\n                lastArgs = arguments;\n                if (this.loadOnShow && !this.loaded) {\n                    this.store.load();\n                }\n                Ext.ux.menu.ListMenu.superclass.show.apply(this, arguments);\n            }\n        };\n    }(),\n    \n    /** @private */\n    onLoad : function (store, records) {\n        var visible = this.isVisible();\n        this.hide(false);\n        \n        this.removeAll(true);\n        \n        var gid = this.single ? Ext.id() : null;\n        for(var i=0, len=records.length; i<len; i++){\n            var item = new Ext.menu.CheckItem({\n                text:    records[i].get(this.labelField), \n                group:   gid,\n                checked: this.selected.indexOf(records[i].id) > -1,\n                hideOnClick: false});\n            \n            item.itemId = records[i].id;\n            item.on('checkchange', this.checkChange, this);\n                        \n            this.add(item);\n        }\n        \n        this.loaded = true;\n        \n        if (visible) {\n            this.show();\n        }\t\n        this.fireEvent('load', this, records);\n    },\n\n    /**\n     * Get the selected items.\n     * @return {Array} selected\n     */\n    getSelected : function () {\n        return this.selected;\n    },\n    \n    /** @private */\n    setSelected : function (value) {\n        value = this.selected = [].concat(value);\n\n        if (this.loaded) {\n            this.items.each(function(item){\n                item.setChecked(false, true);\n                for (var i = 0, len = value.length; i < len; i++) {\n                    if (item.itemId == value[i]) {\n                        item.setChecked(true, true);\n                    }\n                }\n            }, this);\n        }\n    },\n    \n    /**\n     * Handler for the 'checkchange' event from an check item in this menu\n     * @param {Object} item Ext.menu.CheckItem\n     * @param {Object} checked The checked value that was set\n     */\n    checkChange : function (item, checked) {\n        var value = [];\n        this.items.each(function(item){\n            if (item.checked) {\n                value.push(item.itemId);\n            }\n        },this);\n        this.selected = value;\n        \n        this.fireEvent('checkchange', item, checked);\n    }    \n});"
  },
  {
    "path": "client/src/ext/ux/gridfilters/menu/RangeMenu.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.menu');\n\n/** \n * @class Ext.ux.menu.RangeMenu\n * @extends Ext.menu.Menu\n * Custom implementation of Ext.menu.Menu that has preconfigured\n * items for gt, lt, eq.\n * <p><b><u>Example Usage:</u></b></p>\n * <pre><code>    \n\n * </code></pre> \n */\nExt.ux.menu.RangeMenu = Ext.extend(Ext.menu.Menu, {\n\n    constructor : function (config) {\n\n        Ext.ux.menu.RangeMenu.superclass.constructor.call(this, config);\n\n        this.addEvents(\n            /**\n             * @event update\n             * Fires when a filter configuration has changed\n             * @param {Ext.ux.grid.filter.Filter} this The filter object.\n             */\n            'update'\n        );\n      \n        this.updateTask = new Ext.util.DelayedTask(this.fireUpdate, this);\n    \n        var i, len, item, cfg, Cls;\n\n        for (i = 0, len = this.menuItems.length; i < len; i++) {\n            item = this.menuItems[i];\n            if (item !== '-') {\n                // defaults\n                cfg = {\n                    itemId: 'range-' + item,\n                    enableKeyEvents: true,\n                    iconCls: this.iconCls[item] || 'no-icon',\n                    listeners: {\n                        scope: this,\n                        keyup: this.onInputKeyUp\n                    }\n                };\n                Ext.apply(\n                    cfg,\n                    // custom configs\n                    Ext.applyIf(this.fields[item] || {}, this.fieldCfg[item]),\n                    // configurable defaults\n                    this.menuItemCfgs\n                );\n                Cls = cfg.fieldCls || this.fieldCls;\n                item = this.fields[item] = new Cls(cfg);\n            }\n            this.add(item);\n        }\n    },\n\n    /**\n     * @private\n     * called by this.updateTask\n     */\n    fireUpdate : function () {\n        this.fireEvent('update', this);\n    },\n    \n    /**\n     * Get and return the value of the filter.\n     * @return {String} The value of this filter\n     */\n    getValue : function () {\n        var result = {}, key, field;\n        for (key in this.fields) {\n            field = this.fields[key];\n            if (field.isValid() && String(field.getValue()).length > 0) {\n                result[key] = field.getValue();\n            }\n        }\n        return result;\n    },\n  \n    /**\n     * Set the value of this menu and fires the 'update' event.\n     * @param {Object} data The data to assign to this menu\n     */\t\n    setValue : function (data) {\n        var key;\n        for (key in this.fields) {\n            this.fields[key].setValue(data[key] !== undefined ? data[key] : '');\n        }\n        this.fireEvent('update', this);\n    },\n\n    /**  \n     * @private\n     * Handler method called when there is a keyup event on an input\n     * item of this menu.\n     */\n    onInputKeyUp : function (field, e) {\n        var k = e.getKey();\n        if (k == e.RETURN && field.isValid()) {\n            e.stopEvent();\n            this.hide(true);\n            return;\n        }\n        \n        if (field == this.fields.eq) {\n            if (this.fields.gt) {\n                this.fields.gt.setValue(null);\n            }\n            if (this.fields.lt) {\n                this.fields.lt.setValue(null);\n            }\n        }\n        else {\n            this.fields.eq.setValue(null);\n        }\n        \n        // restart the timer\n        this.updateTask.delay(this.updateBuffer);\n    }\n});\n"
  },
  {
    "path": "client/src/ext/ux/statusbar/StatusBar.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * @class Ext.ux.StatusBar\n * <p>Basic status bar component that can be used as the bottom toolbar of any {@link Ext.Panel}.  In addition to\n * supporting the standard {@link Ext.Toolbar} interface for adding buttons, menus and other items, the StatusBar\n * provides a greedy status element that can be aligned to either side and has convenient methods for setting the\n * status text and icon.  You can also indicate that something is processing using the {@link #showBusy} method.</p>\n * <pre><code>\nnew Ext.Panel({\n    title: 'StatusBar',\n    // etc.\n    bbar: new Ext.ux.StatusBar({\n        id: 'my-status',\n\n        // defaults to use when the status is cleared:\n        defaultText: 'Default status text',\n        defaultIconCls: 'default-icon',\n\n        // values to set initially:\n        text: 'Ready',\n        iconCls: 'ready-icon',\n\n        // any standard Toolbar items:\n        items: [{\n            text: 'A Button'\n        }, '-', 'Plain Text']\n    })\n});\n\n// Update the status bar later in code:\nvar sb = Ext.getCmp('my-status');\nsb.setStatus({\n    text: 'OK',\n    iconCls: 'ok-icon',\n    clear: true // auto-clear after a set interval\n});\n\n// Set the status bar to show that something is processing:\nsb.showBusy();\n\n// processing....\n\nsb.clearStatus(); // once completeed\n</code></pre>\n * @extends Ext.Toolbar\n * @constructor\n * Creates a new StatusBar\n * @param {Object/Array} config A config object\n */\nExt.ux.StatusBar = Ext.extend(Ext.Toolbar, {\n    /**\n     * @cfg {String} statusAlign\n     * The alignment of the status element within the overall StatusBar layout.  When the StatusBar is rendered,\n     * it creates an internal div containing the status text and icon.  Any additional Toolbar items added in the\n     * StatusBar's {@link #items} config, or added via {@link #add} or any of the supported add* methods, will be\n     * rendered, in added order, to the opposite side.  The status element is greedy, so it will automatically\n     * expand to take up all sapce left over by any other items.  Example usage:\n     * <pre><code>\n// Create a left-aligned status bar containing a button,\n// separator and text item that will be right-aligned (default):\nnew Ext.Panel({\n    title: 'StatusBar',\n    // etc.\n    bbar: new Ext.ux.StatusBar({\n        defaultText: 'Default status text',\n        id: 'status-id',\n        items: [{\n            text: 'A Button'\n        }, '-', 'Plain Text']\n    })\n});\n\n// By adding the statusAlign config, this will create the\n// exact same toolbar, except the status and toolbar item\n// layout will be reversed from the previous example:\nnew Ext.Panel({\n    title: 'StatusBar',\n    // etc.\n    bbar: new Ext.ux.StatusBar({\n        defaultText: 'Default status text',\n        id: 'status-id',\n        statusAlign: 'right',\n        items: [{\n            text: 'A Button'\n        }, '-', 'Plain Text']\n    })\n});\n</code></pre>\n     */\n    /**\n     * @cfg {String} defaultText\n     * The default {@link #text} value.  This will be used anytime the status bar is cleared with the\n     * <tt>useDefaults:true</tt> option (defaults to '').\n     */\n    /**\n     * @cfg {String} defaultIconCls\n     * The default {@link #iconCls} value (see the iconCls docs for additional details about customizing the icon).\n     * This will be used anytime the status bar is cleared with the <tt>useDefaults:true</tt> option (defaults to '').\n     */\n    /**\n     * @cfg {String} text\n     * A string that will be <b>initially</b> set as the status message.  This string\n     * will be set as innerHTML (html tags are accepted) for the toolbar item.\n     * If not specified, the value set for <code>{@link #defaultText}</code>\n     * will be used.\n     */\n    /**\n     * @cfg {String} iconCls\n     * A CSS class that will be <b>initially</b> set as the status bar icon and is\n     * expected to provide a background image (defaults to '').\n     * Example usage:<pre><code>\n// Example CSS rule:\n.x-statusbar .x-status-custom {\n    padding-left: 25px;\n    background: transparent url(images/custom-icon.gif) no-repeat 3px 2px;\n}\n\n// Setting a default icon:\nvar sb = new Ext.ux.StatusBar({\n    defaultIconCls: 'x-status-custom'\n});\n\n// Changing the icon:\nsb.setStatus({\n    text: 'New status',\n    iconCls: 'x-status-custom'\n});\n</code></pre>\n     */\n\n    /**\n     * @cfg {String} cls\n     * The base class applied to the containing element for this component on render (defaults to 'x-statusbar')\n     */\n    cls : 'x-statusbar',\n    /**\n     * @cfg {String} busyIconCls\n     * The default <code>{@link #iconCls}</code> applied when calling\n     * <code>{@link #showBusy}</code> (defaults to <tt>'x-status-busy'</tt>).\n     * It can be overridden at any time by passing the <code>iconCls</code>\n     * argument into <code>{@link #showBusy}</code>.\n     */\n    busyIconCls : 'x-status-busy',\n    /**\n     * @cfg {String} busyText\n     * The default <code>{@link #text}</code> applied when calling\n     * <code>{@link #showBusy}</code> (defaults to <tt>'Loading...'</tt>).\n     * It can be overridden at any time by passing the <code>text</code>\n     * argument into <code>{@link #showBusy}</code>.\n     */\n    busyText : 'Loading...',\n    /**\n     * @cfg {Number} autoClear\n     * The number of milliseconds to wait after setting the status via\n     * <code>{@link #setStatus}</code> before automatically clearing the status\n     * text and icon (defaults to <tt>5000</tt>).  Note that this only applies\n     * when passing the <tt>clear</tt> argument to <code>{@link #setStatus}</code>\n     * since that is the only way to defer clearing the status.  This can\n     * be overridden by specifying a different <tt>wait</tt> value in\n     * <code>{@link #setStatus}</code>. Calls to <code>{@link #clearStatus}</code>\n     * always clear the status bar immediately and ignore this value.\n     */\n    autoClear : 5000,\n\n    /**\n     * @cfg {String} emptyText\n     * The text string to use if no text has been set.  Defaults to\n     * <tt>'&nbsp;'</tt>).  If there are no other items in the toolbar using\n     * an empty string (<tt>''</tt>) for this value would end up in the toolbar\n     * height collapsing since the empty string will not maintain the toolbar\n     * height.  Use <tt>''</tt> if the toolbar should collapse in height\n     * vertically when no text is specified and there are no other items in\n     * the toolbar.\n     */\n    emptyText : '&nbsp;',\n\n    // private\n    activeThreadId : 0,\n\n    // private\n    initComponent : function(){\n        if(this.statusAlign=='right'){\n            this.cls += ' x-status-right';\n        }\n        Ext.ux.StatusBar.superclass.initComponent.call(this);\n    },\n\n    // private\n    afterRender : function(){\n        Ext.ux.StatusBar.superclass.afterRender.call(this);\n\n        var right = this.statusAlign == 'right';\n        this.currIconCls = this.iconCls || this.defaultIconCls;\n        this.statusEl = new Ext.Toolbar.TextItem({\n            cls: 'x-status-text ' + (this.currIconCls || ''),\n            text: this.text || this.defaultText || ''\n        });\n\n        if(right){\n            this.add('->');\n            this.add(this.statusEl);\n        }else{\n            this.insert(0, this.statusEl);\n            this.insert(1, '->');\n        }\n        this.doLayout();\n    },\n\n    /**\n     * Sets the status {@link #text} and/or {@link #iconCls}. Also supports automatically clearing the\n     * status that was set after a specified interval.\n     * @param {Object/String} config A config object specifying what status to set, or a string assumed\n     * to be the status text (and all other options are defaulted as explained below). A config\n     * object containing any or all of the following properties can be passed:<ul>\n     * <li><tt>text</tt> {String} : (optional) The status text to display.  If not specified, any current\n     * status text will remain unchanged.</li>\n     * <li><tt>iconCls</tt> {String} : (optional) The CSS class used to customize the status icon (see\n     * {@link #iconCls} for details). If not specified, any current iconCls will remain unchanged.</li>\n     * <li><tt>clear</tt> {Boolean/Number/Object} : (optional) Allows you to set an internal callback that will\n     * automatically clear the status text and iconCls after a specified amount of time has passed. If clear is not\n     * specified, the new status will not be auto-cleared and will stay until updated again or cleared using\n     * {@link #clearStatus}. If <tt>true</tt> is passed, the status will be cleared using {@link #autoClear},\n     * {@link #defaultText} and {@link #defaultIconCls} via a fade out animation. If a numeric value is passed,\n     * it will be used as the callback interval (in milliseconds), overriding the {@link #autoClear} value.\n     * All other options will be defaulted as with the boolean option.  To customize any other options,\n     * you can pass an object in the format:<ul>\n     *    <li><tt>wait</tt> {Number} : (optional) The number of milliseconds to wait before clearing\n     *    (defaults to {@link #autoClear}).</li>\n     *    <li><tt>anim</tt> {Number} : (optional) False to clear the status immediately once the callback\n     *    executes (defaults to true which fades the status out).</li>\n     *    <li><tt>useDefaults</tt> {Number} : (optional) False to completely clear the status text and iconCls\n     *    (defaults to true which uses {@link #defaultText} and {@link #defaultIconCls}).</li>\n     * </ul></li></ul>\n     * Example usage:<pre><code>\n// Simple call to update the text\nstatusBar.setStatus('New status');\n\n// Set the status and icon, auto-clearing with default options:\nstatusBar.setStatus({\n    text: 'New status',\n    iconCls: 'x-status-custom',\n    clear: true\n});\n\n// Auto-clear with custom options:\nstatusBar.setStatus({\n    text: 'New status',\n    iconCls: 'x-status-custom',\n    clear: {\n        wait: 8000,\n        anim: false,\n        useDefaults: false\n    }\n});\n</code></pre>\n     * @return {Ext.ux.StatusBar} this\n     */\n    setStatus : function(o){\n        o = o || {};\n\n        if(typeof o == 'string'){\n            o = {text:o};\n        }\n        if(o.text !== undefined){\n            this.setText(o.text);\n        }\n        if(o.iconCls !== undefined){\n            this.setIcon(o.iconCls);\n        }\n\n        if(o.clear){\n            var c = o.clear,\n                wait = this.autoClear,\n                defaults = {useDefaults: true, anim: true};\n\n            if(typeof c == 'object'){\n                c = Ext.applyIf(c, defaults);\n                if(c.wait){\n                    wait = c.wait;\n                }\n            }else if(typeof c == 'number'){\n                wait = c;\n                c = defaults;\n            }else if(typeof c == 'boolean'){\n                c = defaults;\n            }\n\n            c.threadId = this.activeThreadId;\n            this.clearStatus.defer(wait, this, [c]);\n        }\n        return this;\n    },\n\n    /**\n     * Clears the status {@link #text} and {@link #iconCls}. Also supports clearing via an optional fade out animation.\n     * @param {Object} config (optional) A config object containing any or all of the following properties.  If this\n     * object is not specified the status will be cleared using the defaults below:<ul>\n     * <li><tt>anim</tt> {Boolean} : (optional) True to clear the status by fading out the status element (defaults\n     * to false which clears immediately).</li>\n     * <li><tt>useDefaults</tt> {Boolean} : (optional) True to reset the text and icon using {@link #defaultText} and\n     * {@link #defaultIconCls} (defaults to false which sets the text to '' and removes any existing icon class).</li>\n     * </ul>\n     * @return {Ext.ux.StatusBar} this\n     */\n    clearStatus : function(o){\n        o = o || {};\n\n        if(o.threadId && o.threadId !== this.activeThreadId){\n            // this means the current call was made internally, but a newer\n            // thread has set a message since this call was deferred.  Since\n            // we don't want to overwrite a newer message just ignore.\n            return this;\n        }\n\n        var text = o.useDefaults ? this.defaultText : this.emptyText,\n            iconCls = o.useDefaults ? (this.defaultIconCls ? this.defaultIconCls : '') : '';\n\n        if(o.anim){\n            // animate the statusEl Ext.Element\n            this.statusEl.el.fadeOut({\n                remove: false,\n                useDisplay: true,\n                scope: this,\n                callback: function(){\n                    this.setStatus({\n\t                    text: text,\n\t                    iconCls: iconCls\n\t                });\n\n                    this.statusEl.el.show();\n                }\n            });\n        }else{\n            // hide/show the el to avoid jumpy text or icon\n            this.statusEl.hide();\n\t        this.setStatus({\n\t            text: text,\n\t            iconCls: iconCls\n\t        });\n            this.statusEl.show();\n        }\n        return this;\n    },\n\n    /**\n     * Convenience method for setting the status text directly.  For more flexible options see {@link #setStatus}.\n     * @param {String} text (optional) The text to set (defaults to '')\n     * @return {Ext.ux.StatusBar} this\n     */\n    setText : function(text){\n        this.activeThreadId++;\n        this.text = text || '';\n        if(this.rendered){\n            this.statusEl.setText(this.text);\n        }\n        return this;\n    },\n\n    /**\n     * Returns the current status text.\n     * @return {String} The status text\n     */\n    getText : function(){\n        return this.text;\n    },\n\n    /**\n     * Convenience method for setting the status icon directly.  For more flexible options see {@link #setStatus}.\n     * See {@link #iconCls} for complete details about customizing the icon.\n     * @param {String} iconCls (optional) The icon class to set (defaults to '', and any current icon class is removed)\n     * @return {Ext.ux.StatusBar} this\n     */\n    setIcon : function(cls){\n        this.activeThreadId++;\n        cls = cls || '';\n\n        if(this.rendered){\n\t        if(this.currIconCls){\n\t            this.statusEl.removeClass(this.currIconCls);\n\t            this.currIconCls = null;\n\t        }\n\t        if(cls.length > 0){\n\t            this.statusEl.addClass(cls);\n\t            this.currIconCls = cls;\n\t        }\n        }else{\n            this.currIconCls = cls;\n        }\n        return this;\n    },\n\n    /**\n     * Convenience method for setting the status text and icon to special values that are pre-configured to indicate\n     * a \"busy\" state, usually for loading or processing activities.\n     * @param {Object/String} config (optional) A config object in the same format supported by {@link #setStatus}, or a\n     * string to use as the status text (in which case all other options for setStatus will be defaulted).  Use the\n     * <tt>text</tt> and/or <tt>iconCls</tt> properties on the config to override the default {@link #busyText}\n     * and {@link #busyIconCls} settings. If the config argument is not specified, {@link #busyText} and\n     * {@link #busyIconCls} will be used in conjunction with all of the default options for {@link #setStatus}.\n     * @return {Ext.ux.StatusBar} this\n     */\n    showBusy : function(o){\n        if(typeof o == 'string'){\n            o = {text:o};\n        }\n        o = Ext.applyIf(o || {}, {\n            text: this.busyText,\n            iconCls: this.busyIconCls\n        });\n        return this.setStatus(o);\n    }\n});\nExt.reg('statusbar', Ext.ux.StatusBar);\n"
  },
  {
    "path": "client/src/ext/ux/statusbar/ValidationStatus.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * @class Ext.ux.ValidationStatus\n * A {@link Ext.StatusBar} plugin that provides automatic error notification when the\n * associated form contains validation errors.\n * @extends Ext.Component\n * @constructor\n * Creates a new ValiationStatus plugin\n * @param {Object} config A config object\n */\nExt.ux.ValidationStatus = Ext.extend(Ext.Component, {\n    /**\n     * @cfg {String} errorIconCls\n     * The {@link #iconCls} value to be applied to the status message when there is a\n     * validation error. Defaults to <tt>'x-status-error'</tt>.\n     */\n    errorIconCls : 'x-status-error',\n    /**\n     * @cfg {String} errorListCls\n     * The css class to be used for the error list when there are validation errors.\n     * Defaults to <tt>'x-status-error-list'</tt>.\n     */\n    errorListCls : 'x-status-error-list',\n    /**\n     * @cfg {String} validIconCls\n     * The {@link #iconCls} value to be applied to the status message when the form\n     * validates. Defaults to <tt>'x-status-valid'</tt>.\n     */\n    validIconCls : 'x-status-valid',\n    \n    /**\n     * @cfg {String} showText\n     * The {@link #text} value to be applied when there is a form validation error.\n     * Defaults to <tt>'The form has errors (click for details...)'</tt>.\n     */\n    showText : 'The form has errors (click for details...)',\n    /**\n     * @cfg {String} showText\n     * The {@link #text} value to display when the error list is displayed.\n     * Defaults to <tt>'Click again to hide the error list'</tt>.\n     */\n    hideText : 'Click again to hide the error list',\n    /**\n     * @cfg {String} submitText\n     * The {@link #text} value to be applied when the form is being submitted.\n     * Defaults to <tt>'Saving...'</tt>.\n     */\n    submitText : 'Saving...',\n    \n    // private\n    init : function(sb){\n        sb.on('render', function(){\n            this.statusBar = sb;\n            this.monitor = true;\n            this.errors = new Ext.util.MixedCollection();\n            this.listAlign = (sb.statusAlign=='right' ? 'br-tr?' : 'bl-tl?');\n            \n            if(this.form){\n                this.form = Ext.getCmp(this.form).getForm();\n                this.startMonitoring();\n                this.form.on('beforeaction', function(f, action){\n                    if(action.type == 'submit'){\n                        // Ignore monitoring while submitting otherwise the field validation\n                        // events cause the status message to reset too early\n                        this.monitor = false;\n                    }\n                }, this);\n                var startMonitor = function(){\n                    this.monitor = true;\n                };\n                this.form.on('actioncomplete', startMonitor, this);\n                this.form.on('actionfailed', startMonitor, this);\n            }\n        }, this, {single:true});\n        sb.on({\n            scope: this,\n            afterlayout:{\n                single: true,\n                fn: function(){\n                    // Grab the statusEl after the first layout.\n                    sb.statusEl.getEl().on('click', this.onStatusClick, this, {buffer:200});\n                } \n            }, \n            beforedestroy:{\n                single: true,\n                fn: this.onDestroy\n            } \n        });\n    },\n    \n    // private\n    startMonitoring : function(){\n        this.form.items.each(function(f){\n            f.on('invalid', this.onFieldValidation, this);\n            f.on('valid', this.onFieldValidation, this);\n        }, this);\n    },\n    \n    // private\n    stopMonitoring : function(){\n        this.form.items.each(function(f){\n            f.un('invalid', this.onFieldValidation, this);\n            f.un('valid', this.onFieldValidation, this);\n        }, this);\n    },\n    \n    // private\n    onDestroy : function(){\n        this.stopMonitoring();\n        this.statusBar.statusEl.un('click', this.onStatusClick, this);\n        Ext.ux.ValidationStatus.superclass.onDestroy.call(this);\n    },\n    \n    // private\n    onFieldValidation : function(f, msg){\n        if(!this.monitor){\n            return false;\n        }\n        if(msg){\n            this.errors.add(f.id, {field:f, msg:msg});\n        }else{\n            this.errors.removeKey(f.id);\n        }\n        this.updateErrorList();\n        if(this.errors.getCount() > 0){\n            if(this.statusBar.getText() != this.showText){\n                this.statusBar.setStatus({text:this.showText, iconCls:this.errorIconCls});\n            }\n        }else{\n            this.statusBar.clearStatus().setIcon(this.validIconCls);\n        }\n    },\n    \n    // private\n    updateErrorList : function(){\n        if(this.errors.getCount() > 0){\n\t        var msg = '<ul>';\n\t        this.errors.each(function(err){\n\t            msg += ('<li id=\"x-err-'+ err.field.id +'\"><a href=\"#\">' + err.msg + '</a></li>');\n\t        }, this);\n\t        this.getMsgEl().update(msg+'</ul>');\n        }else{\n            this.getMsgEl().update('');\n        }\n    },\n    \n    // private\n    getMsgEl : function(){\n        if(!this.msgEl){\n            this.msgEl = Ext.DomHelper.append(Ext.getBody(), {\n                cls: this.errorListCls+' x-hide-offsets'\n            }, true);\n            \n            this.msgEl.on('click', function(e){\n                var t = e.getTarget('li', 10, true);\n                if(t){\n                    Ext.getCmp(t.id.split('x-err-')[1]).focus();\n                    this.hideErrors();\n                }\n            }, this, {stopEvent:true}); // prevent anchor click navigation\n        }\n        return this.msgEl;\n    },\n    \n    // private\n    showErrors : function(){\n        this.updateErrorList();\n        this.getMsgEl().alignTo(this.statusBar.getEl(), this.listAlign).slideIn('b', {duration:0.3, easing:'easeOut'});\n        this.statusBar.setText(this.hideText);\n        this.form.getEl().on('click', this.hideErrors, this, {single:true}); // hide if the user clicks directly into the form\n    },\n    \n    // private\n    hideErrors : function(){\n        var el = this.getMsgEl();\n        if(el.isVisible()){\n\t        el.slideOut('b', {duration:0.2, easing:'easeIn'});\n\t        this.statusBar.setText(this.showText);\n        }\n        this.form.getEl().un('click', this.hideErrors, this);\n    },\n    \n    // private\n    onStatusClick : function(){\n        if(this.getMsgEl().isVisible()){\n            this.hideErrors();\n        }else if(this.errors.getCount() > 0){\n            this.showErrors();\n        }\n    }\n});"
  },
  {
    "path": "client/src/ext/ux/statusbar/css/statusbar.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/* StatusBar - structure */\n.x-statusbar .x-status-text {\n    cursor: default;\n/*\n    height: 21px;\n    line-height: 21px;\n    padding: 0 4px;\n*/\n}\n.x-statusbar .x-status-busy {\n    padding-left: 25px !important;\n    background: transparent no-repeat 3px 2px;\n}\n\n.x-toolbar div.xtb-text\n\n.x-statusbar .x-status-text-panel {\n    border-top: 1px solid;\n    border-right: 1px solid;\n    border-bottom: 1px solid;\n    border-left: 1px solid;\n    padding: 2px 8px 2px 5px;\n}\n\n/* StatusBar word processor example styles */\n\n#word-status .x-status-text-panel .spacer {\n    width: 60px;\n    font-size:0;\n    line-height:0;\n}\n#word-status .x-status-busy {\n    padding-left: 25px !important;\n    background: transparent no-repeat 3px 2px;\n}\n#word-status .x-status-saved {\n    padding-left: 25px !important;\n    background: transparent no-repeat 3px 2px;\n}\n\n/* StatusBar form validation example styles */\n\n.x-statusbar .x-status-error {\n    cursor: pointer;\n    padding-left: 25px !important;\n    background: transparent no-repeat 3px 2px;\n}\n.x-statusbar .x-status-valid {\n    padding-left: 25px !important;\n    background: transparent no-repeat 3px 2px;\n}\n.x-status-error-list {\n    font: 11px tahoma,arial,verdana,sans-serif;\n    position: absolute;\n    z-index: 9999;\n    border-top: 1px solid;\n    border-right: 1px solid;\n    border-bottom: 1px solid;\n    border-left: 1px solid;\n    padding: 5px 10px;\n}\n.x-status-error-list li {\n    cursor: pointer;\n    list-style: disc;\n    margin-left: 10px;\n}\n.x-status-error-list li a {\n    text-decoration: none;\n}\n.x-status-error-list li a:hover {\n    text-decoration: underline;\n}\n\n\n/* *********************************************************** */\n/* *********************************************************** */\n/* *********************************************************** */\n\n\n/* StatusBar - visual */\n\n.x-statusbar .x-status-busy {\n    background-image: url(../images/loading.gif);\n}\n.x-statusbar .x-status-text-panel {\n    border-color: #99bbe8 #fff #fff #99bbe8;\n}\n\n/* StatusBar word processor example styles */\n\n#word-status .x-status-text {\n    color: #777;\n}\n#word-status .x-status-busy {\n    background-image: url(../images/saving.gif);\n}\n#word-status .x-status-saved {\n    background-image: url(../images/saved.png);\n}\n\n/* StatusBar form validation example styles */\n\n.x-statusbar .x-status-error {\n    color: #C33;\n    background-image: url(../images/exclamation.gif);\n}\n.x-statusbar .x-status-valid {\n    background-image: url(../images/accept.png);\n}\n.x-status-error-list {\n    border-color: #C33;\n}\n.x-status-error-list li a {\n    color: #15428B;\n}"
  },
  {
    "path": "client/src/ext/ux/treegrid/TreeGrid.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * @class Ext.ux.tree.TreeGrid\n * @extends Ext.tree.TreePanel\n * \n * @xtype treegrid\n */\nExt.ux.tree.TreeGrid = Ext.extend(Ext.tree.TreePanel, {\n    rootVisible : false,\n    useArrows : true,\n    lines : false,\n    borderWidth : Ext.isBorderBox ? 0 : 2, // the combined left/right border for each cell\n    cls : 'x-treegrid',\n\n    columnResize : true,\n    enableSort : true,\n    reserveScrollOffset : true,\n    enableHdMenu : true,\n    \n    columnsText : 'Columns',\n\n    initComponent : function() {\n        if(!this.root) {\n            this.root = new Ext.tree.AsyncTreeNode({text: 'Root'});\n        }\n        \n        // initialize the loader\n        var l = this.loader;\n        if(!l){\n            l = new Ext.ux.tree.TreeGridLoader({\n                dataUrl: this.dataUrl,\n                requestMethod: this.requestMethod,\n                store: this.store\n            });\n        }else if(Ext.isObject(l) && !l.load){\n            l = new Ext.ux.tree.TreeGridLoader(l);\n        }\n        this.loader = l;\n                            \n        Ext.ux.tree.TreeGrid.superclass.initComponent.call(this);                    \n        \n        this.initColumns();\n        \n        if(this.enableSort) {\n            this.treeGridSorter = new Ext.ux.tree.TreeGridSorter(this, this.enableSort);\n        }\n        \n        if(this.columnResize){\n            this.colResizer = new Ext.tree.ColumnResizer(this.columnResize);\n            this.colResizer.init(this);\n        }\n        \n        var c = this.columns;\n        if(!this.internalTpl){                                \n            this.internalTpl = new Ext.XTemplate(\n                '<div class=\"x-grid3-header\">',\n                    '<div class=\"x-treegrid-header-inner\">',\n                        '<div class=\"x-grid3-header-offset\">',\n                            '<table style=\"table-layout: fixed;\" cellspacing=\"0\" cellpadding=\"0\" border=\"0\"><colgroup><tpl for=\"columns\"><col /></tpl></colgroup>',\n                            '<thead><tr class=\"x-grid3-hd-row\">',\n                            '<tpl for=\"columns\">',\n                            '<td class=\"x-grid3-hd x-grid3-cell x-treegrid-hd\" style=\"text-align: {align};\" id=\"', this.id, '-xlhd-{#}\">',\n                                '<div class=\"x-grid3-hd-inner x-treegrid-hd-inner\" unselectable=\"on\">',\n                                     this.enableHdMenu ? '<a class=\"x-grid3-hd-btn\" href=\"#\"></a>' : '',\n                                     '{header}<img class=\"x-grid3-sort-icon\" src=\"', Ext.BLANK_IMAGE_URL, '\" />',\n                                 '</div>',\n                            '</td></tpl>',\n                            '</tr></thead>',\n                        '</table>',\n                    '</div></div>',\n                '</div>',\n                '<div class=\"x-treegrid-root-node\">',\n                    '<table class=\"x-treegrid-root-table\" cellpadding=\"0\" cellspacing=\"0\" style=\"table-layout: fixed;\"></table>',\n                '</div>'\n            );\n        }\n        \n        if(!this.colgroupTpl) {\n            this.colgroupTpl = new Ext.XTemplate(\n                '<colgroup><tpl for=\"columns\"><col style=\"width: {width}px\"/></tpl></colgroup>'\n            );\n        }\n    },\n\n    initColumns : function() {\n        var cs = this.columns,\n            len = cs.length, \n            columns = [],\n            i, c;\n\n        for(i = 0; i < len; i++){\n            c = cs[i];\n            if(!c.isColumn) {\n                c.xtype = c.xtype ? (/^tg/.test(c.xtype) ? c.xtype : 'tg' + c.xtype) : 'tgcolumn';\n                c = Ext.create(c);\n            }\n            c.init(this);\n            columns.push(c);\n            \n            if(this.enableSort !== false && c.sortable !== false) {\n                c.sortable = true;\n                this.enableSort = true;\n            }\n        }\n\n        this.columns = columns;\n    },\n\n    onRender : function(){\n        Ext.tree.TreePanel.superclass.onRender.apply(this, arguments);\n\n        this.el.addClass('x-treegrid');\n        \n        this.outerCt = this.body.createChild({\n            cls:'x-tree-root-ct x-treegrid-ct ' + (this.useArrows ? 'x-tree-arrows' : this.lines ? 'x-tree-lines' : 'x-tree-no-lines')\n        });\n        \n        this.internalTpl.overwrite(this.outerCt, {columns: this.columns});\n        \n        this.mainHd = Ext.get(this.outerCt.dom.firstChild);\n        this.innerHd = Ext.get(this.mainHd.dom.firstChild);\n        this.innerBody = Ext.get(this.outerCt.dom.lastChild);\n        this.innerCt = Ext.get(this.innerBody.dom.firstChild);\n        \n        this.colgroupTpl.insertFirst(this.innerCt, {columns: this.columns});\n        \n        if(this.hideHeaders){\n            this.el.child('.x-grid3-header').setDisplayed('none');\n        }\n        else if(this.enableHdMenu !== false){\n            this.hmenu = new Ext.menu.Menu({id: this.id + '-hctx'});\n            if(this.enableColumnHide !== false){\n                this.colMenu = new Ext.menu.Menu({id: this.id + '-hcols-menu'});\n                this.colMenu.on({\n                    scope: this,\n                    beforeshow: this.beforeColMenuShow,\n                    itemclick: this.handleHdMenuClick\n                });\n                this.hmenu.add({\n                    itemId:'columns',\n                    hideOnClick: false,\n                    text: this.columnsText,\n                    menu: this.colMenu,\n                    iconCls: 'x-cols-icon'\n                });\n            }\n            this.hmenu.on('itemclick', this.handleHdMenuClick, this);\n        }\n    },\n\n    setRootNode : function(node){\n        node.attributes.uiProvider = Ext.ux.tree.TreeGridRootNodeUI;        \n        node = Ext.ux.tree.TreeGrid.superclass.setRootNode.call(this, node);\n        if(this.innerCt) {\n            this.colgroupTpl.insertFirst(this.innerCt, {columns: this.columns});\n        }\n        return node;\n    },\n    \n    clearInnerCt : function(){\n        if(Ext.isIE){\n            var dom = this.innerCt.dom;\n            while(dom.firstChild){\n                dom.removeChild(dom.firstChild);\n            }\n        }else{\n            Ext.ux.tree.TreeGrid.superclass.clearInnerCt.call(this);\n        }\n    },\n    \n    initEvents : function() {\n        Ext.ux.tree.TreeGrid.superclass.initEvents.apply(this, arguments);\n\n        this.mon(this.innerBody, 'scroll', this.syncScroll, this);\n        this.mon(this.innerHd, 'click', this.handleHdDown, this);\n        this.mon(this.mainHd, {\n            scope: this,\n            mouseover: this.handleHdOver,\n            mouseout: this.handleHdOut\n        });\n    },\n    \n    onResize : function(w, h) {\n        Ext.ux.tree.TreeGrid.superclass.onResize.apply(this, arguments);\n        \n        var bd = this.innerBody.dom;\n        var hd = this.innerHd.dom;\n\n        if(!bd){\n            return;\n        }\n\n        if(Ext.isNumber(h)){\n            bd.style.height = this.body.getHeight(true) - hd.offsetHeight + 'px';\n        }\n\n        if(Ext.isNumber(w)){                        \n            var sw = Ext.num(this.scrollOffset, Ext.getScrollBarWidth());\n            if(this.reserveScrollOffset || ((bd.offsetWidth - bd.clientWidth) > 10)){\n                this.setScrollOffset(sw);\n            }else{\n                var me = this;\n                setTimeout(function(){\n                    me.setScrollOffset(bd.offsetWidth - bd.clientWidth > 10 ? sw : 0);\n                }, 10);\n            }\n        }\n    },\n\n    updateColumnWidths : function() {\n        var cols = this.columns,\n            colCount = cols.length,\n            groups = this.outerCt.query('colgroup'),\n            groupCount = groups.length,\n            c, g, i, j;\n\n        for(i = 0; i<colCount; i++) {\n            c = cols[i];\n            for(j = 0; j<groupCount; j++) {\n                g = groups[j];\n                g.childNodes[i].style.width = (c.hidden ? 0 : c.width) + 'px';\n            }\n        }\n        \n        for(i = 0, groups = this.innerHd.query('td'), len = groups.length; i<len; i++) {\n            c = Ext.fly(groups[i]);\n            if(cols[i] && cols[i].hidden) {\n                c.addClass('x-treegrid-hd-hidden');\n            }\n            else {\n                c.removeClass('x-treegrid-hd-hidden');\n            }\n        }\n\n        var tcw = this.getTotalColumnWidth();                        \n        Ext.fly(this.innerHd.dom.firstChild).setWidth(tcw + (this.scrollOffset || 0));\n        this.outerCt.select('table').setWidth(tcw);\n        this.syncHeaderScroll();    \n    },\n                    \n    getVisibleColumns : function() {\n        var columns = [],\n            cs = this.columns,\n            len = cs.length,\n            i;\n            \n        for(i = 0; i<len; i++) {\n            if(!cs[i].hidden) {\n                columns.push(cs[i]);\n            }\n        }        \n        return columns;\n    },\n\n    getTotalColumnWidth : function() {\n        var total = 0;\n        for(var i = 0, cs = this.getVisibleColumns(), len = cs.length; i<len; i++) {\n            total += cs[i].width;\n        }\n        return total;\n    },\n\n    setScrollOffset : function(scrollOffset) {\n        this.scrollOffset = scrollOffset;                        \n        this.updateColumnWidths();\n    },\n\n    // private\n    handleHdDown : function(e, t){\n        var hd = e.getTarget('.x-treegrid-hd');\n\n        if(hd && Ext.fly(t).hasClass('x-grid3-hd-btn')){\n            var ms = this.hmenu.items,\n                cs = this.columns,\n                index = this.findHeaderIndex(hd),\n                c = cs[index],\n                sort = c.sortable;\n                \n            e.stopEvent();\n            Ext.fly(hd).addClass('x-grid3-hd-menu-open');\n            this.hdCtxIndex = index;\n            \n            this.fireEvent('headerbuttonclick', ms, c, hd, index);\n            \n            this.hmenu.on('hide', function(){\n                Ext.fly(hd).removeClass('x-grid3-hd-menu-open');\n            }, this, {single:true});\n            \n            this.hmenu.show(t, 'tl-bl?');\n        }\n        else if(hd) {\n            var index = this.findHeaderIndex(hd);\n            this.fireEvent('headerclick', this.columns[index], hd, index);\n        }\n    },\n\n    // private\n    handleHdOver : function(e, t){                    \n        var hd = e.getTarget('.x-treegrid-hd');                        \n        if(hd && !this.headersDisabled){\n            index = this.findHeaderIndex(hd);\n            this.activeHdRef = t;\n            this.activeHdIndex = index;\n            var el = Ext.get(hd);\n            this.activeHdRegion = el.getRegion();\n            el.addClass('x-grid3-hd-over');\n            this.activeHdBtn = el.child('.x-grid3-hd-btn');\n            if(this.activeHdBtn){\n                this.activeHdBtn.dom.style.height = (hd.firstChild.offsetHeight-1)+'px';\n            }\n        }\n    },\n    \n    // private\n    handleHdOut : function(e, t){\n        var hd = e.getTarget('.x-treegrid-hd');\n        if(hd && (!Ext.isIE || !e.within(hd, true))){\n            this.activeHdRef = null;\n            Ext.fly(hd).removeClass('x-grid3-hd-over');\n            hd.style.cursor = '';\n        }\n    },\n                    \n    findHeaderIndex : function(hd){\n        hd = hd.dom || hd;\n        var cs = hd.parentNode.childNodes;\n        for(var i = 0, c; c = cs[i]; i++){\n            if(c == hd){\n                return i;\n            }\n        }\n        return -1;\n    },\n    \n    // private\n    beforeColMenuShow : function(){\n        var cols = this.columns,  \n            colCount = cols.length,\n            i, c;                        \n        this.colMenu.removeAll();                    \n        for(i = 1; i < colCount; i++){\n            c = cols[i];\n            if(c.hideable !== false){\n                this.colMenu.add(new Ext.menu.CheckItem({\n                    itemId: 'col-' + i,\n                    text: c.header,\n                    checked: !c.hidden,\n                    hideOnClick:false,\n                    disabled: c.hideable === false\n                }));\n            }\n        }\n    },\n                    \n    // private\n    handleHdMenuClick : function(item){\n        var index = this.hdCtxIndex,\n            id = item.getItemId();\n        \n        if(this.fireEvent('headermenuclick', this.columns[index], id, index) !== false) {\n            index = id.substr(4);\n            if(index > 0 && this.columns[index]) {\n                this.setColumnVisible(index, !item.checked);\n            }     \n        }\n        \n        return true;\n    },\n    \n    setColumnVisible : function(index, visible) {\n        this.columns[index].hidden = !visible;        \n        this.updateColumnWidths();\n    },\n\n    /**\n     * Scrolls the grid to the top\n     */\n    scrollToTop : function(){\n        this.innerBody.dom.scrollTop = 0;\n        this.innerBody.dom.scrollLeft = 0;\n    },\n\n    // private\n    syncScroll : function(){\n        this.syncHeaderScroll();\n        var mb = this.innerBody.dom;\n        this.fireEvent('bodyscroll', mb.scrollLeft, mb.scrollTop);\n    },\n\n    // private\n    syncHeaderScroll : function(){\n        var mb = this.innerBody.dom;\n        this.innerHd.dom.scrollLeft = mb.scrollLeft;\n        this.innerHd.dom.scrollLeft = mb.scrollLeft; // second time for IE (1/2 time first fails, other browsers ignore)\n    },\n    \n    registerNode : function(n) {\n        Ext.ux.tree.TreeGrid.superclass.registerNode.call(this, n);\n        if(!n.uiProvider && !n.isRoot && !n.ui.isTreeGridNodeUI) {\n            n.ui = new Ext.ux.tree.TreeGridNodeUI(n);\n        }\n    }\n});\n\nExt.reg('treegrid', Ext.ux.tree.TreeGrid);"
  },
  {
    "path": "client/src/ext/ux/treegrid/TreeGridColumnResizer.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * @class Ext.tree.ColumnResizer\n * @extends Ext.util.Observable\n */\nExt.tree.ColumnResizer = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Number} minWidth The minimum width the column can be dragged to.\n     * Defaults to <tt>14</tt>.\n     */\n    minWidth: 14,\n\n    constructor: function(config){\n        Ext.apply(this, config);\n        Ext.tree.ColumnResizer.superclass.constructor.call(this);\n    },\n\n    init : function(tree){\n        this.tree = tree;\n        tree.on('render', this.initEvents, this);\n    },\n\n    initEvents : function(tree){\n        tree.mon(tree.innerHd, 'mousemove', this.handleHdMove, this);\n        this.tracker = new Ext.dd.DragTracker({\n            onBeforeStart: this.onBeforeStart.createDelegate(this),\n            onStart: this.onStart.createDelegate(this),\n            onDrag: this.onDrag.createDelegate(this),\n            onEnd: this.onEnd.createDelegate(this),\n            tolerance: 3,\n            autoStart: 300\n        });\n        this.tracker.initEl(tree.innerHd);\n        tree.on('beforedestroy', this.tracker.destroy, this.tracker);\n    },\n\n    handleHdMove : function(e, t){\n        var hw = 5,\n            x = e.getPageX(),\n            hd = e.getTarget('.x-treegrid-hd', 3, true);\n        \n        if(hd){                                 \n            var r = hd.getRegion(),\n                ss = hd.dom.style,\n                pn = hd.dom.parentNode;\n            \n            if(x - r.left <= hw && hd.dom !== pn.firstChild) {\n                var ps = hd.dom.previousSibling;\n                while(ps && Ext.fly(ps).hasClass('x-treegrid-hd-hidden')) {\n                    ps = ps.previousSibling;\n                }\n                if(ps) {                    \n                    this.activeHd = Ext.get(ps);\n    \t\t\t\tss.cursor = Ext.isWebKit ? 'e-resize' : 'col-resize';\n                }\n            } else if(r.right - x <= hw) {\n                var ns = hd.dom;\n                while(ns && Ext.fly(ns).hasClass('x-treegrid-hd-hidden')) {\n                    ns = ns.previousSibling;\n                }\n                if(ns) {\n                    this.activeHd = Ext.get(ns);\n    \t\t\t\tss.cursor = Ext.isWebKit ? 'w-resize' : 'col-resize';                    \n                }\n            } else{\n                delete this.activeHd;\n                ss.cursor = '';\n            }\n        }\n    },\n\n    onBeforeStart : function(e){\n        this.dragHd = this.activeHd;\n        return !!this.dragHd;\n    },\n\n    onStart : function(e){\n        this.dragHeadersDisabled = this.tree.headersDisabled;\n        this.tree.headersDisabled = true;\n        this.proxy = this.tree.body.createChild({cls:'x-treegrid-resizer'});\n        this.proxy.setHeight(this.tree.body.getHeight());\n\n        var x = this.tracker.getXY()[0];\n\n        this.hdX = this.dragHd.getX();\n        this.hdIndex = this.tree.findHeaderIndex(this.dragHd);\n\n        this.proxy.setX(this.hdX);\n        this.proxy.setWidth(x-this.hdX);\n\n        this.maxWidth = this.tree.outerCt.getWidth() - this.tree.innerBody.translatePoints(this.hdX).left;\n    },\n\n    onDrag : function(e){\n        var cursorX = this.tracker.getXY()[0];\n        this.proxy.setWidth((cursorX-this.hdX).constrain(this.minWidth, this.maxWidth));\n    },\n\n    onEnd : function(e){\n        var nw = this.proxy.getWidth(),\n            tree = this.tree,\n            disabled = this.dragHeadersDisabled;\n        \n        this.proxy.remove();\n        delete this.dragHd;\n        \n        tree.columns[this.hdIndex].width = nw;\n        tree.updateColumnWidths();\n        \n        setTimeout(function(){\n            tree.headersDisabled = disabled;\n        }, 100);\n    }\n});"
  },
  {
    "path": "client/src/ext/ux/treegrid/TreeGridColumns.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n(function() {\n    Ext.override(Ext.list.Column, {\n        init : function() {    \n            var types = Ext.data.Types,\n                st = this.sortType;\n                    \n            if(this.type){\n                if(Ext.isString(this.type)){\n                    this.type = Ext.data.Types[this.type.toUpperCase()] || types.AUTO;\n                }\n            }else{\n                this.type = types.AUTO;\n            }\n\n            // named sortTypes are supported, here we look them up\n            if(Ext.isString(st)){\n                this.sortType = Ext.data.SortTypes[st];\n            }else if(Ext.isEmpty(st)){\n                this.sortType = this.type.sortType;\n            }\n        }\n    });\n\n    Ext.tree.Column = Ext.extend(Ext.list.Column, {});\n    Ext.tree.NumberColumn = Ext.extend(Ext.list.NumberColumn, {});\n    Ext.tree.DateColumn = Ext.extend(Ext.list.DateColumn, {});\n    Ext.tree.BooleanColumn = Ext.extend(Ext.list.BooleanColumn, {});\n\n    Ext.reg('tgcolumn', Ext.tree.Column);\n    Ext.reg('tgnumbercolumn', Ext.tree.NumberColumn);\n    Ext.reg('tgdatecolumn', Ext.tree.DateColumn);\n    Ext.reg('tgbooleancolumn', Ext.tree.BooleanColumn);\n})();\n"
  },
  {
    "path": "client/src/ext/ux/treegrid/TreeGridLoader.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * @class Ext.ux.tree.TreeGridLoader\n * @extends Ext.tree.TreeLoader\n */\nExt.ux.tree.TreeGridLoader = Ext.extend(Ext.tree.TreeLoader, {\n    createNode : function(attr) {\n        if (!attr.uiProvider) {\n            attr.uiProvider = Ext.ux.tree.TreeGridNodeUI;\n        }\n        return Ext.tree.TreeLoader.prototype.createNode.call(this, attr);\n    }\n});"
  },
  {
    "path": "client/src/ext/ux/treegrid/TreeGridNodeUI.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n/**\n * @class Ext.ux.tree.TreeGridNodeUI\n * @extends Ext.tree.TreeNodeUI\n */\nExt.ux.tree.TreeGridNodeUI = Ext.extend(Ext.tree.TreeNodeUI, {\n    isTreeGridNodeUI: true,\n\n    renderElements : function(n, a, targetNode, bulkRender){\n        var t = n.getOwnerTree(),\n            cols = t.columns,\n            c = cols[0],\n            i, buf, len;\n\n        this.indentMarkup = n.parentNode ? n.parentNode.ui.getChildIndent() : '';\n\n        buf = [\n             '<tbody class=\"x-tree-node\">',\n                '<tr ext:tree-node-id=\"', n.id ,'\" class=\"x-tree-node-el x-tree-node-leaf ', a.cls, '\">',\n                    '<td class=\"x-treegrid-col\">',\n                        '<span class=\"x-tree-node-indent\">', this.indentMarkup, \"</span>\",\n                        '<img src=\"', this.emptyIcon, '\" class=\"x-tree-ec-icon x-tree-elbow\" />',\n                        '<img src=\"', a.icon || this.emptyIcon, '\" class=\"x-tree-node-icon', (a.icon ? \" x-tree-node-inline-icon\" : \"\"), (a.iconCls ? \" \"+a.iconCls : \"\"), '\" unselectable=\"on\" />',\n                        '<a hidefocus=\"on\" class=\"x-tree-node-anchor\" href=\"', a.href ? a.href : '#', '\" tabIndex=\"1\" ',\n                            a.hrefTarget ? ' target=\"'+a.hrefTarget+'\"' : '', '>',\n                        '<span unselectable=\"on\">', (c.tpl ? c.tpl.apply(a) : a[c.dataIndex] || c.text), '</span></a>',\n                    '</td>'\n        ];\n\n        for(i = 1, len = cols.length; i < len; i++){\n            c = cols[i];\n            buf.push(\n                    '<td class=\"x-treegrid-col ', (c.cls ? c.cls : ''), '\">',\n                        '<div unselectable=\"on\" class=\"x-treegrid-text\"', (c.align ? ' style=\"text-align: ' + c.align + ';\"' : ''), '>',\n                            (c.tpl ? c.tpl.apply(a) : a[c.dataIndex]),\n                        '</div>',\n                    '</td>'\n            );\n        }\n\n        buf.push(\n            '</tr><tr class=\"x-tree-node-ct\"><td colspan=\"', cols.length, '\">',\n            '<table class=\"x-treegrid-node-ct-table\" cellpadding=\"0\" cellspacing=\"0\" style=\"table-layout: fixed; display: none; width: ', t.innerCt.getWidth() ,'px;\"><colgroup>'\n        );\n        for(i = 0, len = cols.length; i<len; i++) {\n            buf.push('<col style=\"width: ', (cols[i].hidden ? 0 : cols[i].width) ,'px;\" />');\n        }\n        buf.push('</colgroup></table></td></tr></tbody>');\n\n        if(bulkRender !== true && n.nextSibling && n.nextSibling.ui.getEl()){\n            this.wrap = Ext.DomHelper.insertHtml(\"beforeBegin\", n.nextSibling.ui.getEl(), buf.join(''));\n        }else{\n            this.wrap = Ext.DomHelper.insertHtml(\"beforeEnd\", targetNode, buf.join(''));\n        }\n\n        this.elNode = this.wrap.childNodes[0];\n        this.ctNode = this.wrap.childNodes[1].firstChild.firstChild;\n        var cs = this.elNode.firstChild.childNodes;\n        this.indentNode = cs[0];\n        this.ecNode = cs[1];\n        this.iconNode = cs[2];\n        this.anchor = cs[3];\n        this.textNode = cs[3].firstChild;\n    },\n\n    // private\n    animExpand : function(cb){\n        this.ctNode.style.display = \"\";\n        Ext.ux.tree.TreeGridNodeUI.superclass.animExpand.call(this, cb);\n    }\n});\n\nExt.ux.tree.TreeGridRootNodeUI = Ext.extend(Ext.tree.TreeNodeUI, {\n    isTreeGridNodeUI: true,\n\n    // private\n    render : function(){\n        if(!this.rendered){\n            this.wrap = this.ctNode = this.node.ownerTree.innerCt.dom;\n            this.node.expanded = true;\n        }\n\n        if(Ext.isWebKit) {\n            // weird table-layout: fixed issue in webkit\n            var ct = this.ctNode;\n            ct.style.tableLayout = null;\n            (function() {\n                ct.style.tableLayout = 'fixed';\n            }).defer(1);\n        }\n    },\n\n    destroy : function(){\n        if(this.elNode){\n            Ext.dd.Registry.unregister(this.elNode.id);\n        }\n        delete this.node;\n    },\n\n    collapse : Ext.emptyFn,\n    expand : Ext.emptyFn\n});"
  },
  {
    "path": "client/src/ext/ux/treegrid/TreeGridSorter.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.tree');\n\n/**\n * @class Ext.ux.tree.TreeGridSorter\n * @extends Ext.tree.TreeSorter\n * Provides sorting of nodes in a {@link Ext.ux.tree.TreeGrid}.  The TreeGridSorter automatically monitors events on the\n * associated TreeGrid that might affect the tree's sort order (beforechildrenrendered, append, insert and textchange).\n * Example usage:<br />\n * <pre><code>\n new Ext.ux.tree.TreeGridSorter(myTreeGrid, {\n     folderSort: true,\n     dir: \"desc\",\n     sortType: function(node) {\n         // sort by a custom, typed attribute:\n         return parseInt(node.id, 10);\n     }\n });\n </code></pre>\n * @constructor\n * @param {TreeGrid} tree\n * @param {Object} config\n */\nExt.ux.tree.TreeGridSorter = Ext.extend(Ext.tree.TreeSorter, {\n    /**\n     * @cfg {Array} sortClasses The CSS classes applied to a header when it is sorted. (defaults to <tt>['sort-asc', 'sort-desc']</tt>)\n     */\n    sortClasses : ['sort-asc', 'sort-desc'],\n    /**\n     * @cfg {String} sortAscText The text displayed in the 'Sort Ascending' menu item (defaults to <tt>'Sort Ascending'</tt>)\n     */\n    sortAscText : 'Sort Ascending',\n    /**\n     * @cfg {String} sortDescText The text displayed in the 'Sort Descending' menu item (defaults to <tt>'Sort Descending'</tt>)\n     */\n    sortDescText : 'Sort Descending',\n\n    constructor : function(tree, config) {\n        if(!Ext.isObject(config)) {\n            config = {\n                property: tree.columns[0].dataIndex || 'text',\n                folderSort: true\n            }\n        }\n\n        Ext.ux.tree.TreeGridSorter.superclass.constructor.apply(this, arguments);\n\n        this.tree = tree;\n        tree.on('headerclick', this.onHeaderClick, this);\n        tree.ddAppendOnly = true;\n\n        var me = this;\n        this.defaultSortFn = function(n1, n2){\n\n            var desc = me.dir && me.dir.toLowerCase() == 'desc',\n                prop = me.property || 'text',\n                sortType = me.sortType,\n                caseSensitive = me.caseSensitive === true,\n                leafAttr = me.leafAttr || 'leaf',\n                attr1 = n1.attributes,\n                attr2 = n2.attributes;\n\n            if(me.folderSort){\n                if(attr1[leafAttr] && !attr2[leafAttr]){\n                    return 1;\n                }\n                if(!attr1[leafAttr] && attr2[leafAttr]){\n                    return -1;\n                }\n            }\n            var prop1 = attr1[prop],\n                prop2 = attr2[prop],\n                v1 = sortType ? sortType(prop1) : (caseSensitive ? prop1 : prop1.toUpperCase());\n                v2 = sortType ? sortType(prop2) : (caseSensitive ? prop2 : prop2.toUpperCase());\n                \n            if(v1 < v2){\n                return desc ? +1 : -1;\n            }else if(v1 > v2){\n                return desc ? -1 : +1;\n            }else{\n                return 0;\n            }\n        };\n\n        tree.on('afterrender', this.onAfterTreeRender, this, {single: true});\n        tree.on('headermenuclick', this.onHeaderMenuClick, this);\n    },\n\n    onAfterTreeRender : function() {\n        if(this.tree.hmenu){\n            this.tree.hmenu.insert(0,\n                {itemId:'asc', text: this.sortAscText, cls: 'xg-hmenu-sort-asc'},\n                {itemId:'desc', text: this.sortDescText, cls: 'xg-hmenu-sort-desc'}\n            );\n        }\n        this.updateSortIcon(0, 'asc');\n    },\n\n    onHeaderMenuClick : function(c, id, index) {\n        if(id === 'asc' || id === 'desc') {\n            this.onHeaderClick(c, null, index);\n            return false;\n        }\n    },\n\n    onHeaderClick : function(c, el, i) {\n        if(c && !this.tree.headersDisabled){\n            var me = this;\n\n            me.property = c.dataIndex;\n            me.dir = c.dir = (c.dir === 'desc' ? 'asc' : 'desc');\n            me.sortType = c.sortType;\n            me.caseSensitive === Ext.isBoolean(c.caseSensitive) ? c.caseSensitive : this.caseSensitive;\n            me.sortFn = c.sortFn || this.defaultSortFn;\n\n            this.tree.root.cascade(function(n) {\n                if(!n.isLeaf()) {\n                    me.updateSort(me.tree, n);\n                }\n            });\n\n            this.updateSortIcon(i, c.dir);\n        }\n    },\n\n    // private\n    updateSortIcon : function(col, dir){\n        var sc = this.sortClasses,\n            hds = this.tree.innerHd.select('td').removeClass(sc);\n        hds.item(col).addClass(sc[dir == 'desc' ? 1 : 0]);\n    }\n});"
  },
  {
    "path": "client/src/ext/ux/treegrid/treegrid.css",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\n.x-treegrid-root-table {\n    border-right: 1px solid;\n}\n\n.x-treegrid-root-node {\n    overflow: auto;\n}\n\n.x-treegrid-hd-hidden {\n    visibility: hidden;\n    border: 0;\n    width: 0;\n}\n\n.x-treegrid-col {\n    border-bottom: 1px solid;\n    height: 20px;\n    overflow: hidden;\n    vertical-align: top;\n\t-o-text-overflow: ellipsis;\n\ttext-overflow: ellipsis;\n    white-space: nowrap;\n}\n\n.x-treegrid-text {\n    padding-left: 4px;\n    -moz-user-select: none;\n    -khtml-user-select: none;\n}\n\n.x-treegrid-resizer {\n    border-left:1px solid;\n    border-right:1px solid;\n    position:absolute;\n    left:0;\n    top:0;\n}\n\n.x-treegrid-header-inner {\n    overflow: hidden;\n}\n\n.x-treegrid-root-table,\n.x-treegrid-col {\n    border-color: #ededed;\n}\n\n.x-treegrid-resizer {\n    border-left-color:#555;\n    border-right-color:#555;\n}"
  },
  {
    "path": "client/src/ext/ux/ux-all-debug.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.BufferView\n * @extends Ext.grid.GridView\n * A custom GridView which renders rows on an as-needed basis.\n */\nExt.ux.grid.BufferView = Ext.extend(Ext.grid.GridView, {\n\t/**\n\t * @cfg {Number} rowHeight\n\t * The height of a row in the grid.\n\t */\n\trowHeight: 19,\n\n\t/**\n\t * @cfg {Number} borderHeight\n\t * The combined height of border-top and border-bottom of a row.\n\t */\n\tborderHeight: 2,\n\n\t/**\n\t * @cfg {Boolean/Number} scrollDelay\n\t * The number of milliseconds before rendering rows out of the visible\n\t * viewing area. Defaults to 100. Rows will render immediately with a config\n\t * of false.\n\t */\n\tscrollDelay: 100,\n\n\t/**\n\t * @cfg {Number} cacheSize\n\t * The number of rows to look forward and backwards from the currently viewable\n\t * area.  The cache applies only to rows that have been rendered already.\n\t */\n\tcacheSize: 20,\n\n\t/**\n\t * @cfg {Number} cleanDelay\n\t * The number of milliseconds to buffer cleaning of extra rows not in the\n\t * cache.\n\t */\n\tcleanDelay: 500,\n\n\tinitTemplates : function(){\n\t\tExt.ux.grid.BufferView.superclass.initTemplates.call(this);\n\t\tvar ts = this.templates;\n\t\t// empty div to act as a place holder for a row\n\t        ts.rowHolder = new Ext.Template(\n\t\t        '<div class=\"x-grid3-row {alt}\" style=\"{tstyle}\"></div>'\n\t\t);\n\t\tts.rowHolder.disableFormats = true;\n\t\tts.rowHolder.compile();\n\n\t\tts.rowBody = new Ext.Template(\n\t\t        '<table class=\"x-grid3-row-table\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\" style=\"{tstyle}\">',\n\t\t\t'<tbody><tr>{cells}</tr>',\n\t\t\t(this.enableRowBody ? '<tr class=\"x-grid3-row-body-tr\" style=\"{bodyStyle}\"><td colspan=\"{cols}\" class=\"x-grid3-body-cell\" tabIndex=\"0\" hidefocus=\"on\"><div class=\"x-grid3-row-body\">{body}</div></td></tr>' : ''),\n\t\t\t'</tbody></table>'\n\t\t);\n\t\tts.rowBody.disableFormats = true;\n\t\tts.rowBody.compile();\n\t},\n\n\tgetStyleRowHeight : function(){\n\t\treturn Ext.isBorderBox ? (this.rowHeight + this.borderHeight) : this.rowHeight;\n\t},\n\n\tgetCalculatedRowHeight : function(){\n\t\treturn this.rowHeight + this.borderHeight;\n\t},\n\n\tgetVisibleRowCount : function(){\n\t\tvar rh = this.getCalculatedRowHeight(),\n\t\t    visibleHeight = this.scroller.dom.clientHeight;\n\t\treturn (visibleHeight < 1) ? 0 : Math.ceil(visibleHeight / rh);\n\t},\n\n\tgetVisibleRows: function(){\n\t\tvar count = this.getVisibleRowCount(),\n\t\t    sc = this.scroller.dom.scrollTop,\n\t\t    start = (sc === 0 ? 0 : Math.floor(sc/this.getCalculatedRowHeight())-1);\n\t\treturn {\n\t\t\tfirst: Math.max(start, 0),\n\t\t\tlast: Math.min(start + count + 2, this.ds.getCount()-1)\n\t\t};\n\t},\n\n\tdoRender : function(cs, rs, ds, startRow, colCount, stripe, onlyBody){\n\t\tvar ts = this.templates, \n            ct = ts.cell, \n            rt = ts.row, \n            rb = ts.rowBody, \n            last = colCount-1,\n\t\t    rh = this.getStyleRowHeight(),\n\t\t    vr = this.getVisibleRows(),\n\t\t    tstyle = 'width:'+this.getTotalWidth()+';height:'+rh+'px;',\n\t\t    // buffers\n\t\t    buf = [], \n            cb, \n            c, \n            p = {}, \n            rp = {tstyle: tstyle}, \n            r;\n\t\tfor (var j = 0, len = rs.length; j < len; j++) {\n\t\t\tr = rs[j]; cb = [];\n\t\t\tvar rowIndex = (j+startRow),\n\t\t\t    visible = rowIndex >= vr.first && rowIndex <= vr.last;\n\t\t\tif (visible) {\n\t\t\t\tfor (var i = 0; i < colCount; i++) {\n\t\t\t\t\tc = cs[i];\n\t\t\t\t\tp.id = c.id;\n\t\t\t\t\tp.css = i === 0 ? 'x-grid3-cell-first ' : (i == last ? 'x-grid3-cell-last ' : '');\n\t\t\t\t\tp.attr = p.cellAttr = \"\";\n\t\t\t\t\tp.value = c.renderer(r.data[c.name], p, r, rowIndex, i, ds);\n\t\t\t\t\tp.style = c.style;\n\t\t\t\t\tif (p.value === undefined || p.value === \"\") {\n\t\t\t\t\t\tp.value = \"&#160;\";\n\t\t\t\t\t}\n\t\t\t\t\tif (r.dirty && typeof r.modified[c.name] !== 'undefined') {\n\t\t\t\t\t\tp.css += ' x-grid3-dirty-cell';\n\t\t\t\t\t}\n\t\t\t\t\tcb[cb.length] = ct.apply(p);\n\t\t\t\t}\n\t\t\t}\n\t\t\tvar alt = [];\n\t\t\tif(stripe && ((rowIndex+1) % 2 === 0)){\n\t\t\t    alt[0] = \"x-grid3-row-alt\";\n\t\t\t}\n\t\t\tif(r.dirty){\n\t\t\t    alt[1] = \" x-grid3-dirty-row\";\n\t\t\t}\n\t\t\trp.cols = colCount;\n\t\t\tif(this.getRowClass){\n\t\t\t    alt[2] = this.getRowClass(r, rowIndex, rp, ds);\n\t\t\t}\n\t\t\trp.alt = alt.join(\" \");\n\t\t\trp.cells = cb.join(\"\");\n\t\t\tbuf[buf.length] =  !visible ? ts.rowHolder.apply(rp) : (onlyBody ? rb.apply(rp) : rt.apply(rp));\n\t\t}\n\t\treturn buf.join(\"\");\n\t},\n\n\tisRowRendered: function(index){\n\t\tvar row = this.getRow(index);\n\t\treturn row && row.childNodes.length > 0;\n\t},\n\n\tsyncScroll: function(){\n\t\tExt.ux.grid.BufferView.superclass.syncScroll.apply(this, arguments);\n\t\tthis.update();\n\t},\n\n\t// a (optionally) buffered method to update contents of gridview\n\tupdate: function(){\n\t\tif (this.scrollDelay) {\n\t\t\tif (!this.renderTask) {\n\t\t\t\tthis.renderTask = new Ext.util.DelayedTask(this.doUpdate, this);\n\t\t\t}\n\t\t\tthis.renderTask.delay(this.scrollDelay);\n\t\t}else{\n\t\t\tthis.doUpdate();\n\t\t}\n\t},\n    \n    onRemove : function(ds, record, index, isUpdate){\n        Ext.ux.grid.BufferView.superclass.onRemove.apply(this, arguments);\n        if(isUpdate !== true){\n            this.update();\n        }\n    },\n\n\tdoUpdate: function(){\n\t\tif (this.getVisibleRowCount() > 0) {\n\t\t\tvar g = this.grid, \n                cm = g.colModel, \n                ds = g.store,\n    \t        cs = this.getColumnData(),\n\t\t        vr = this.getVisibleRows(),\n                row;\n\t\t\tfor (var i = vr.first; i <= vr.last; i++) {\n\t\t\t\t// if row is NOT rendered and is visible, render it\n\t\t\t\tif(!this.isRowRendered(i) && (row = this.getRow(i))){\n\t\t\t\t\tvar html = this.doRender(cs, [ds.getAt(i)], ds, i, cm.getColumnCount(), g.stripeRows, true);\n\t\t\t\t\trow.innerHTML = html;\n\t\t\t\t}\n\t\t\t}\n\t\t\tthis.clean();\n\t\t}\n\t},\n\n\t// a buffered method to clean rows\n\tclean : function(){\n\t\tif(!this.cleanTask){\n\t\t\tthis.cleanTask = new Ext.util.DelayedTask(this.doClean, this);\n\t\t}\n\t\tthis.cleanTask.delay(this.cleanDelay);\n\t},\n\n\tdoClean: function(){\n\t\tif (this.getVisibleRowCount() > 0) {\n\t\t\tvar vr = this.getVisibleRows();\n\t\t\tvr.first -= this.cacheSize;\n\t\t\tvr.last += this.cacheSize;\n\n\t\t\tvar i = 0, rows = this.getRows();\n\t\t\t// if first is less than 0, all rows have been rendered\n\t\t\t// so lets clean the end...\n\t\t\tif(vr.first <= 0){\n\t\t\t\ti = vr.last + 1;\n\t\t\t}\n\t\t\tfor(var len = this.ds.getCount(); i < len; i++){\n\t\t\t\t// if current row is outside of first and last and\n\t\t\t\t// has content, update the innerHTML to nothing\n\t\t\t\tif ((i < vr.first || i > vr.last) && rows[i].innerHTML) {\n\t\t\t\t\trows[i].innerHTML = '';\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t},\n    \n    removeTask: function(name){\n        var task = this[name];\n        if(task && task.cancel){\n            task.cancel();\n            this[name] = null;\n        }\n    },\n    \n    destroy : function(){\n        this.removeTask('cleanTask');\n        this.removeTask('renderTask');  \n        Ext.ux.grid.BufferView.superclass.destroy.call(this);\n    },\n\n\tlayout: function(){\n\t\tExt.ux.grid.BufferView.superclass.layout.call(this);\n\t\tthis.update();\n\t}\n});// We are adding these custom layouts to a namespace that does not\n// exist by default in Ext, so we have to add the namespace first:\nExt.ns('Ext.ux.layout');\n\n/**\n * @class Ext.ux.layout.CenterLayout\n * @extends Ext.layout.FitLayout\n * <p>This is a very simple layout style used to center contents within a container.  This layout works within\n * nested containers and can also be used as expected as a Viewport layout to center the page layout.</p>\n * <p>As a subclass of FitLayout, CenterLayout expects to have a single child panel of the container that uses\n * the layout.  The layout does not require any config options, although the child panel contained within the\n * layout must provide a fixed or percentage width.  The child panel's height will fit to the container by\n * default, but you can specify <tt>autoHeight:true</tt> to allow it to autosize based on its content height.\n * Example usage:</p>\n * <pre><code>\n// The content panel is centered in the container\nvar p = new Ext.Panel({\n    title: 'Center Layout',\n    layout: 'ux.center',\n    items: [{\n        title: 'Centered Content',\n        width: '75%',\n        html: 'Some content'\n    }]\n});\n\n// If you leave the title blank and specify no border\n// you'll create a non-visual, structural panel just\n// for centering the contents in the main container.\nvar p = new Ext.Panel({\n    layout: 'ux.center',\n    border: false,\n    items: [{\n        title: 'Centered Content',\n        width: 300,\n        autoHeight: true,\n        html: 'Some content'\n    }]\n});\n</code></pre>\n */\nExt.ux.layout.CenterLayout = Ext.extend(Ext.layout.FitLayout, {\n\t// private\n    setItemSize : function(item, size){\n        this.container.addClass('ux-layout-center');\n        item.addClass('ux-layout-center-item');\n        if(item && size.height > 0){\n            if(item.width){\n                size.width = item.width;\n            }\n            item.setSize(size);\n        }\n    }\n});\n\nExt.Container.LAYOUTS['ux.center'] = Ext.ux.layout.CenterLayout;\nExt.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.CheckColumn\n * @extends Ext.grid.Column\n * <p>A Column subclass which renders a checkbox in each column cell which toggles the truthiness of the associated data field on click.</p>\n * <p><b>Note. As of ExtJS 3.3 this no longer has to be configured as a plugin of the GridPanel.</b></p>\n * <p>Example usage:</p>\n * <pre><code>\nvar cm = new Ext.grid.ColumnModel([{\n       header: 'Foo',\n       ...\n    },{\n       xtype: 'checkcolumn',\n       header: 'Indoor?',\n       dataIndex: 'indoor',\n       width: 55\n    }\n]);\n\n// create the grid\nvar grid = new Ext.grid.EditorGridPanel({\n    ...\n    colModel: cm,\n    ...\n});\n * </code></pre>\n * In addition to toggling a Boolean value within the record data, this\n * class toggles a css class between <tt>'x-grid3-check-col'</tt> and\n * <tt>'x-grid3-check-col-on'</tt> to alter the background image used for\n * a column.\n */\nExt.ux.grid.CheckColumn = Ext.extend(Ext.grid.Column, {\n\n    /**\n     * @private\n     * Process and refire events routed from the GridView's processEvent method.\n     */\n    processEvent : function(name, e, grid, rowIndex, colIndex){\n        if (name == 'mousedown') {\n            var record = grid.store.getAt(rowIndex);\n            record.set(this.dataIndex, !record.data[this.dataIndex]);\n            return false; // Cancel row selection.\n        } else {\n            return Ext.grid.ActionColumn.superclass.processEvent.apply(this, arguments);\n        }\n    },\n\n    renderer : function(v, p, record){\n        p.css += ' x-grid3-check-col-td'; \n        return String.format('<div class=\"x-grid3-check-col{0}\">&#160;</div>', v ? '-on' : '');\n    },\n\n    // Deprecate use as a plugin. Remove in 4.0\n    init: Ext.emptyFn\n});\n\n// register ptype. Deprecate. Remove in 4.0\nExt.preg('checkcolumn', Ext.ux.grid.CheckColumn);\n\n// backwards compat. Remove in 4.0\nExt.grid.CheckColumn = Ext.ux.grid.CheckColumn;\n\n// register Column xtype\nExt.grid.Column.types.checkcolumn = Ext.ux.grid.CheckColumn;Ext.ns('Ext.ux.grid');\n\nExt.ux.grid.ColumnHeaderGroup = Ext.extend(Ext.util.Observable, {\n\n    constructor: function(config){\n        this.config = config;\n    },\n\n    init: function(grid){\n        Ext.applyIf(grid.colModel, this.config);\n        Ext.apply(grid.getView(), this.viewConfig);\n    },\n\n    viewConfig: {\n        initTemplates: function(){\n            this.constructor.prototype.initTemplates.apply(this, arguments);\n            var ts = this.templates || {};\n            if(!ts.gcell){\n                ts.gcell = new Ext.XTemplate('<td class=\"x-grid3-hd x-grid3-gcell x-grid3-td-{id} ux-grid-hd-group-row-{row} {cls}\" style=\"{style}\">', '<div {tooltip} class=\"x-grid3-hd-inner x-grid3-hd-{id}\" unselectable=\"on\" style=\"{istyle}\">', this.grid.enableHdMenu ? '<a class=\"x-grid3-hd-btn\" href=\"#\"></a>' : '', '{value}</div></td>');\n            }\n            this.templates = ts;\n            this.hrowRe = new RegExp(\"ux-grid-hd-group-row-(\\\\d+)\", \"\");\n        },\n\n        renderHeaders: function(){\n            var ts = this.templates, headers = [], cm = this.cm, rows = cm.rows, tstyle = 'width:' + this.getTotalWidth() + ';';\n\n            for(var row = 0, rlen = rows.length; row < rlen; row++){\n                var r = rows[row], cells = [];\n                for(var i = 0, gcol = 0, len = r.length; i < len; i++){\n                    var group = r[i];\n                    group.colspan = group.colspan || 1;\n                    var id = this.getColumnId(group.dataIndex ? cm.findColumnIndex(group.dataIndex) : gcol), gs = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupStyle.call(this, group, gcol);\n                    cells[i] = ts.gcell.apply({\n                        cls: 'ux-grid-hd-group-cell',\n                        id: id,\n                        row: row,\n                        style: 'width:' + gs.width + ';' + (gs.hidden ? 'display:none;' : '') + (group.align ? 'text-align:' + group.align + ';' : ''),\n                        tooltip: group.tooltip ? (Ext.QuickTips.isEnabled() ? 'ext:qtip' : 'title') + '=\"' + group.tooltip + '\"' : '',\n                        istyle: group.align == 'right' ? 'padding-right:16px' : '',\n                        btn: this.grid.enableHdMenu && group.header,\n                        value: group.header || '&nbsp;'\n                    });\n                    gcol += group.colspan;\n                }\n                headers[row] = ts.header.apply({\n                    tstyle: tstyle,\n                    cells: cells.join('')\n                });\n            }\n            headers.push(this.constructor.prototype.renderHeaders.apply(this, arguments));\n            return headers.join('');\n        },\n\n        onColumnWidthUpdated: function(){\n            this.constructor.prototype.onColumnWidthUpdated.apply(this, arguments);\n            Ext.ux.grid.ColumnHeaderGroup.prototype.updateGroupStyles.call(this);\n        },\n\n        onAllColumnWidthsUpdated: function(){\n            this.constructor.prototype.onAllColumnWidthsUpdated.apply(this, arguments);\n            Ext.ux.grid.ColumnHeaderGroup.prototype.updateGroupStyles.call(this);\n        },\n\n        onColumnHiddenUpdated: function(){\n            this.constructor.prototype.onColumnHiddenUpdated.apply(this, arguments);\n            Ext.ux.grid.ColumnHeaderGroup.prototype.updateGroupStyles.call(this);\n        },\n\n        getHeaderCell: function(index){\n            return this.mainHd.query(this.cellSelector)[index];\n        },\n\n        findHeaderCell: function(el){\n            return el ? this.fly(el).findParent('td.x-grid3-hd', this.cellSelectorDepth) : false;\n        },\n\n        findHeaderIndex: function(el){\n            var cell = this.findHeaderCell(el);\n            return cell ? this.getCellIndex(cell) : false;\n        },\n\n        updateSortIcon: function(col, dir){\n            var sc = this.sortClasses, hds = this.mainHd.select(this.cellSelector).removeClass(sc);\n            hds.item(col).addClass(sc[dir == \"DESC\" ? 1 : 0]);\n        },\n\n        handleHdDown: function(e, t){\n            var el = Ext.get(t);\n            if(el.hasClass('x-grid3-hd-btn')){\n                e.stopEvent();\n                var hd = this.findHeaderCell(t);\n                Ext.fly(hd).addClass('x-grid3-hd-menu-open');\n                var index = this.getCellIndex(hd);\n                this.hdCtxIndex = index;\n                var ms = this.hmenu.items, cm = this.cm;\n                ms.get('asc').setDisabled(!cm.isSortable(index));\n                ms.get('desc').setDisabled(!cm.isSortable(index));\n                this.hmenu.on('hide', function(){\n                    Ext.fly(hd).removeClass('x-grid3-hd-menu-open');\n                }, this, {\n                    single: true\n                });\n                this.hmenu.show(t, 'tl-bl?');\n            }else if(el.hasClass('ux-grid-hd-group-cell') || Ext.fly(t).up('.ux-grid-hd-group-cell')){\n                e.stopEvent();\n            }\n        },\n\n        handleHdMove: function(e, t){\n            var hd = this.findHeaderCell(this.activeHdRef);\n            if(hd && !this.headersDisabled && !Ext.fly(hd).hasClass('ux-grid-hd-group-cell')){\n                var hw = this.splitHandleWidth || 5, r = this.activeHdRegion, x = e.getPageX(), ss = hd.style, cur = '';\n                if(this.grid.enableColumnResize !== false){\n                    if(x - r.left <= hw && this.cm.isResizable(this.activeHdIndex - 1)){\n                        cur = Ext.isAir ? 'move' : Ext.isWebKit ? 'e-resize' : 'col-resize'; // col-resize\n                                                                                                // not\n                                                                                                // always\n                                                                                                // supported\n                    }else if(r.right - x <= (!this.activeHdBtn ? hw : 2) && this.cm.isResizable(this.activeHdIndex)){\n                        cur = Ext.isAir ? 'move' : Ext.isWebKit ? 'w-resize' : 'col-resize';\n                    }\n                }\n                ss.cursor = cur;\n            }\n        },\n\n        handleHdOver: function(e, t){\n            var hd = this.findHeaderCell(t);\n            if(hd && !this.headersDisabled){\n                this.activeHdRef = t;\n                this.activeHdIndex = this.getCellIndex(hd);\n                var fly = this.fly(hd);\n                this.activeHdRegion = fly.getRegion();\n                if(!(this.cm.isMenuDisabled(this.activeHdIndex) || fly.hasClass('ux-grid-hd-group-cell'))){\n                    fly.addClass('x-grid3-hd-over');\n                    this.activeHdBtn = fly.child('.x-grid3-hd-btn');\n                    if(this.activeHdBtn){\n                        this.activeHdBtn.dom.style.height = (hd.firstChild.offsetHeight - 1) + 'px';\n                    }\n                }\n            }\n        },\n\n        handleHdOut: function(e, t){\n            var hd = this.findHeaderCell(t);\n            if(hd && (!Ext.isIE || !e.within(hd, true))){\n                this.activeHdRef = null;\n                this.fly(hd).removeClass('x-grid3-hd-over');\n                hd.style.cursor = '';\n            }\n        },\n\n        handleHdMenuClick: function(item){\n            var index = this.hdCtxIndex, cm = this.cm, ds = this.ds, id = item.getItemId();\n            switch(id){\n                case 'asc':\n                    ds.sort(cm.getDataIndex(index), 'ASC');\n                    break;\n                case 'desc':\n                    ds.sort(cm.getDataIndex(index), 'DESC');\n                    break;\n                default:\n                    if(id.substr(0, 6) == 'group-'){\n                        var i = id.split('-'), row = parseInt(i[1], 10), col = parseInt(i[2], 10), r = this.cm.rows[row], group, gcol = 0;\n                        for(var i = 0, len = r.length; i < len; i++){\n                            group = r[i];\n                            if(col >= gcol && col < gcol + group.colspan){\n                                break;\n                            }\n                            gcol += group.colspan;\n                        }\n                        if(item.checked){\n                            var max = cm.getColumnsBy(this.isHideableColumn, this).length;\n                            for(var i = gcol, len = gcol + group.colspan; i < len; i++){\n                                if(!cm.isHidden(i)){\n                                    max--;\n                                }\n                            }\n                            if(max < 1){\n                                this.onDenyColumnHide();\n                                return false;\n                            }\n                        }\n                        for(var i = gcol, len = gcol + group.colspan; i < len; i++){\n                            if(cm.config[i].fixed !== true && cm.config[i].hideable !== false){\n                                cm.setHidden(i, item.checked);\n                            }\n                        }\n                    }else if(id.substr(0, 4) == 'col-'){\n                        index = cm.getIndexById(id.substr(4));\n                        if(index != -1){\n                            if(item.checked && cm.getColumnsBy(this.isHideableColumn, this).length <= 1){\n                                this.onDenyColumnHide();\n                                return false;\n                            }\n                            cm.setHidden(index, item.checked);\n                        }\n                    }\n                    if(id.substr(0, 6) == 'group-' || id.substr(0, 4) == 'col-'){\n                        item.checked = !item.checked;\n                        if(item.menu){\n                            var updateChildren = function(menu){\n                                menu.items.each(function(childItem){\n                                    if(!childItem.disabled){\n                                        childItem.setChecked(item.checked, false);\n                                        if(childItem.menu){\n                                            updateChildren(childItem.menu);\n                                        }\n                                    }\n                                });\n                            }\n                            updateChildren(item.menu);\n                        }\n                        var parentMenu = item, parentItem;\n                        while(parentMenu = parentMenu.parentMenu){\n                            if(!parentMenu.parentMenu || !(parentItem = parentMenu.parentMenu.items.get(parentMenu.getItemId())) || !parentItem.setChecked){\n                                break;\n                            }\n                            var checked = parentMenu.items.findIndexBy(function(m){\n                                return m.checked;\n                            }) >= 0;\n                            parentItem.setChecked(checked, true);\n                        }\n                        item.checked = !item.checked;\n                    }\n            }\n            return true;\n        },\n\n        beforeColMenuShow: function(){\n            var cm = this.cm, rows = this.cm.rows;\n            this.colMenu.removeAll();\n            for(var col = 0, clen = cm.getColumnCount(); col < clen; col++){\n                var menu = this.colMenu, title = cm.getColumnHeader(col), text = [];\n                if(cm.config[col].fixed !== true && cm.config[col].hideable !== false){\n                    for(var row = 0, rlen = rows.length; row < rlen; row++){\n                        var r = rows[row], group, gcol = 0;\n                        for(var i = 0, len = r.length; i < len; i++){\n                            group = r[i];\n                            if(col >= gcol && col < gcol + group.colspan){\n                                break;\n                            }\n                            gcol += group.colspan;\n                        }\n                        if(group && group.header){\n                            if(cm.hierarchicalColMenu){\n                                var gid = 'group-' + row + '-' + gcol,\n                                    item = menu.items ? menu.getComponent(gid) : null,\n                                    submenu = item ? item.menu : null;\n                                if(!submenu){\n                                    submenu = new Ext.menu.Menu({\n                                        itemId: gid\n                                    });\n                                    submenu.on(\"itemclick\", this.handleHdMenuClick, this);\n                                    var checked = false, disabled = true;\n                                    for(var c = gcol, lc = gcol + group.colspan; c < lc; c++){\n                                        if(!cm.isHidden(c)){\n                                            checked = true;\n                                        }\n                                        if(cm.config[c].hideable !== false){\n                                            disabled = false;\n                                        }\n                                    }\n                                    menu.add({\n                                        itemId: gid,\n                                        text: group.header,\n                                        menu: submenu,\n                                        hideOnClick: false,\n                                        checked: checked,\n                                        disabled: disabled\n                                    });\n                                }\n                                menu = submenu;\n                            }else{\n                                text.push(group.header);\n                            }\n                        }\n                    }\n                    text.push(title);\n                    menu.add(new Ext.menu.CheckItem({\n                        itemId: \"col-\" + cm.getColumnId(col),\n                        text: text.join(' '),\n                        checked: !cm.isHidden(col),\n                        hideOnClick: false,\n                        disabled: cm.config[col].hideable === false\n                    }));\n                }\n            }\n        },\n\n        afterRenderUI: function(){\n            this.constructor.prototype.afterRenderUI.apply(this, arguments);\n            Ext.apply(this.columnDrop, Ext.ux.grid.ColumnHeaderGroup.prototype.columnDropConfig);\n            Ext.apply(this.splitZone, Ext.ux.grid.ColumnHeaderGroup.prototype.splitZoneConfig);\n        }\n    },\n\n    splitZoneConfig: {\n        allowHeaderDrag: function(e){\n            return !e.getTarget(null, null, true).hasClass('ux-grid-hd-group-cell');\n        }\n    },\n\n    columnDropConfig: {\n        getTargetFromEvent: function(e){\n            var t = Ext.lib.Event.getTarget(e);\n            return this.view.findHeaderCell(t);\n        },\n\n        positionIndicator: function(h, n, e){\n            var data = Ext.ux.grid.ColumnHeaderGroup.prototype.getDragDropData.call(this, h, n, e);\n            if(data === false){\n                return false;\n            }\n            var px = data.px + this.proxyOffsets[0];\n            this.proxyTop.setLeftTop(px, data.r.top + this.proxyOffsets[1]);\n            this.proxyTop.show();\n            this.proxyBottom.setLeftTop(px, data.r.bottom);\n            this.proxyBottom.show();\n            return data.pt;\n        },\n\n        onNodeDrop: function(n, dd, e, data){\n            var h = data.header;\n            if(h != n){\n                var d = Ext.ux.grid.ColumnHeaderGroup.prototype.getDragDropData.call(this, h, n, e);\n                if(d === false){\n                    return false;\n                }\n                var cm = this.grid.colModel, right = d.oldIndex < d.newIndex, rows = cm.rows;\n                for(var row = d.row, rlen = rows.length; row < rlen; row++){\n                    var r = rows[row], len = r.length, fromIx = 0, span = 1, toIx = len;\n                    for(var i = 0, gcol = 0; i < len; i++){\n                        var group = r[i];\n                        if(d.oldIndex >= gcol && d.oldIndex < gcol + group.colspan){\n                            fromIx = i;\n                        }\n                        if(d.oldIndex + d.colspan - 1 >= gcol && d.oldIndex + d.colspan - 1 < gcol + group.colspan){\n                            span = i - fromIx + 1;\n                        }\n                        if(d.newIndex >= gcol && d.newIndex < gcol + group.colspan){\n                            toIx = i;\n                        }\n                        gcol += group.colspan;\n                    }\n                    var groups = r.splice(fromIx, span);\n                    rows[row] = r.splice(0, toIx - (right ? span : 0)).concat(groups).concat(r);\n                }\n                for(var c = 0; c < d.colspan; c++){\n                    var oldIx = d.oldIndex + (right ? 0 : c), newIx = d.newIndex + (right ? -1 : c);\n                    cm.moveColumn(oldIx, newIx);\n                    this.grid.fireEvent(\"columnmove\", oldIx, newIx);\n                }\n                return true;\n            }\n            return false;\n        }\n    },\n\n    getGroupStyle: function(group, gcol){\n        var width = 0, hidden = true;\n        for(var i = gcol, len = gcol + group.colspan; i < len; i++){\n            if(!this.cm.isHidden(i)){\n                var cw = this.cm.getColumnWidth(i);\n                if(typeof cw == 'number'){\n                    width += cw;\n                }\n                hidden = false;\n            }\n        }\n        return {\n            width: (Ext.isBorderBox || (Ext.isWebKit && !Ext.isSafari2) ? width : Math.max(width - this.borderWidth, 0)) + 'px',\n            hidden: hidden\n        };\n    },\n\n    updateGroupStyles: function(col){\n        var tables = this.mainHd.query('.x-grid3-header-offset > table'), tw = this.getTotalWidth(), rows = this.cm.rows;\n        for(var row = 0; row < tables.length; row++){\n            tables[row].style.width = tw;\n            if(row < rows.length){\n                var cells = tables[row].firstChild.firstChild.childNodes;\n                for(var i = 0, gcol = 0; i < cells.length; i++){\n                    var group = rows[row][i];\n                    if((typeof col != 'number') || (col >= gcol && col < gcol + group.colspan)){\n                        var gs = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupStyle.call(this, group, gcol);\n                        cells[i].style.width = gs.width;\n                        cells[i].style.display = gs.hidden ? 'none' : '';\n                    }\n                    gcol += group.colspan;\n                }\n            }\n        }\n    },\n\n    getGroupRowIndex: function(el){\n        if(el){\n            var m = el.className.match(this.hrowRe);\n            if(m && m[1]){\n                return parseInt(m[1], 10);\n            }\n        }\n        return this.cm.rows.length;\n    },\n\n    getGroupSpan: function(row, col){\n        if(row < 0){\n            return {\n                col: 0,\n                colspan: this.cm.getColumnCount()\n            };\n        }\n        var r = this.cm.rows[row];\n        if(r){\n            for(var i = 0, gcol = 0, len = r.length; i < len; i++){\n                var group = r[i];\n                if(col >= gcol && col < gcol + group.colspan){\n                    return {\n                        col: gcol,\n                        colspan: group.colspan\n                    };\n                }\n                gcol += group.colspan;\n            }\n            return {\n                col: gcol,\n                colspan: 0\n            };\n        }\n        return {\n            col: col,\n            colspan: 1\n        };\n    },\n\n    getDragDropData: function(h, n, e){\n        if(h.parentNode != n.parentNode){\n            return false;\n        }\n        var cm = this.grid.colModel, x = Ext.lib.Event.getPageX(e), r = Ext.lib.Dom.getRegion(n.firstChild), px, pt;\n        if((r.right - x) <= (r.right - r.left) / 2){\n            px = r.right + this.view.borderWidth;\n            pt = \"after\";\n        }else{\n            px = r.left;\n            pt = \"before\";\n        }\n        var oldIndex = this.view.getCellIndex(h), newIndex = this.view.getCellIndex(n);\n        if(cm.isFixed(newIndex)){\n            return false;\n        }\n        var row = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupRowIndex.call(this.view, h),\n            oldGroup = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupSpan.call(this.view, row, oldIndex),\n            newGroup = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupSpan.call(this.view, row, newIndex),\n            oldIndex = oldGroup.col;\n            newIndex = newGroup.col + (pt == \"after\" ? newGroup.colspan : 0);\n        if(newIndex >= oldGroup.col && newIndex <= oldGroup.col + oldGroup.colspan){\n            return false;\n        }\n        var parentGroup = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupSpan.call(this.view, row - 1, oldIndex);\n        if(newIndex < parentGroup.col || newIndex > parentGroup.col + parentGroup.colspan){\n            return false;\n        }\n        return {\n            r: r,\n            px: px,\n            pt: pt,\n            row: row,\n            oldIndex: oldIndex,\n            newIndex: newIndex,\n            colspan: oldGroup.colspan\n        };\n    }\n});Ext.ns('Ext.ux.tree');\n\n/**\n * @class Ext.ux.tree.ColumnTree\n * @extends Ext.tree.TreePanel\n * \n * @xtype columntree\n */\nExt.ux.tree.ColumnTree = Ext.extend(Ext.tree.TreePanel, {\n    lines : false,\n    borderWidth : Ext.isBorderBox ? 0 : 2, // the combined left/right border for each cell\n    cls : 'x-column-tree',\n\n    onRender : function(){\n        Ext.tree.ColumnTree.superclass.onRender.apply(this, arguments);\n        this.headers = this.header.createChild({cls:'x-tree-headers'});\n\n        var cols = this.columns, c;\n        var totalWidth = 0;\n        var scrollOffset = 19; // similar to Ext.grid.GridView default\n\n        for(var i = 0, len = cols.length; i < len; i++){\n             c = cols[i];\n             totalWidth += c.width;\n             this.headers.createChild({\n                 cls:'x-tree-hd ' + (c.cls?c.cls+'-hd':''),\n                 cn: {\n                     cls:'x-tree-hd-text',\n                     html: c.header\n                 },\n                 style:'width:'+(c.width-this.borderWidth)+'px;'\n             });\n        }\n        this.headers.createChild({cls:'x-clear'});\n        // prevent floats from wrapping when clipped\n        this.headers.setWidth(totalWidth+scrollOffset);\n        this.innerCt.setWidth(totalWidth);\n    }\n});\n\nExt.reg('columntree', Ext.ux.tree.ColumnTree);\n\n//backwards compat\nExt.tree.ColumnTree = Ext.ux.tree.ColumnTree;\n\n\n/**\n * @class Ext.ux.tree.ColumnNodeUI\n * @extends Ext.tree.TreeNodeUI\n */\nExt.ux.tree.ColumnNodeUI = Ext.extend(Ext.tree.TreeNodeUI, {\n    focus: Ext.emptyFn, // prevent odd scrolling behavior\n\n    renderElements : function(n, a, targetNode, bulkRender){\n        this.indentMarkup = n.parentNode ? n.parentNode.ui.getChildIndent() : '';\n\n        var t = n.getOwnerTree();\n        var cols = t.columns;\n        var bw = t.borderWidth;\n        var c = cols[0];\n\n        var buf = [\n             '<li class=\"x-tree-node\"><div ext:tree-node-id=\"',n.id,'\" class=\"x-tree-node-el x-tree-node-leaf ', a.cls,'\">',\n                '<div class=\"x-tree-col\" style=\"width:',c.width-bw,'px;\">',\n                    '<span class=\"x-tree-node-indent\">',this.indentMarkup,\"</span>\",\n                    '<img src=\"', this.emptyIcon, '\" class=\"x-tree-ec-icon x-tree-elbow\">',\n                    '<img src=\"', a.icon || this.emptyIcon, '\" class=\"x-tree-node-icon',(a.icon ? \" x-tree-node-inline-icon\" : \"\"),(a.iconCls ? \" \"+a.iconCls : \"\"),'\" unselectable=\"on\">',\n                    '<a hidefocus=\"on\" class=\"x-tree-node-anchor\" href=\"',a.href ? a.href : \"#\",'\" tabIndex=\"1\" ',\n                    a.hrefTarget ? ' target=\"'+a.hrefTarget+'\"' : \"\", '>',\n                    '<span unselectable=\"on\">', n.text || (c.renderer ? c.renderer(a[c.dataIndex], n, a) : a[c.dataIndex]),\"</span></a>\",\n                \"</div>\"];\n         for(var i = 1, len = cols.length; i < len; i++){\n             c = cols[i];\n\n             buf.push('<div class=\"x-tree-col ',(c.cls?c.cls:''),'\" style=\"width:',c.width-bw,'px;\">',\n                        '<div class=\"x-tree-col-text\">',(c.renderer ? c.renderer(a[c.dataIndex], n, a) : a[c.dataIndex]),\"</div>\",\n                      \"</div>\");\n         }\n         buf.push(\n            '<div class=\"x-clear\"></div></div>',\n            '<ul class=\"x-tree-node-ct\" style=\"display:none;\"></ul>',\n            \"</li>\");\n\n        if(bulkRender !== true && n.nextSibling && n.nextSibling.ui.getEl()){\n            this.wrap = Ext.DomHelper.insertHtml(\"beforeBegin\",\n                                n.nextSibling.ui.getEl(), buf.join(\"\"));\n        }else{\n            this.wrap = Ext.DomHelper.insertHtml(\"beforeEnd\", targetNode, buf.join(\"\"));\n        }\n\n        this.elNode = this.wrap.childNodes[0];\n        this.ctNode = this.wrap.childNodes[1];\n        var cs = this.elNode.firstChild.childNodes;\n        this.indentNode = cs[0];\n        this.ecNode = cs[1];\n        this.iconNode = cs[2];\n        this.anchor = cs[3];\n        this.textNode = cs[3].firstChild;\n    }\n});\n\n//backwards compat\nExt.tree.ColumnNodeUI = Ext.ux.tree.ColumnNodeUI;\n/**\n * @class Ext.DataView.LabelEditor\n * @extends Ext.Editor\n * \n */\nExt.DataView.LabelEditor = Ext.extend(Ext.Editor, {\n    alignment: \"tl-tl\",\n    hideEl : false,\n    cls: \"x-small-editor\",\n    shim: false,\n    completeOnEnter: true,\n    cancelOnEsc: true,\n    labelSelector: 'span.x-editable',\n    \n    constructor: function(cfg, field){\n        Ext.DataView.LabelEditor.superclass.constructor.call(this,\n            field || new Ext.form.TextField({\n                allowBlank: false,\n                growMin:90,\n                growMax:240,\n                grow:true,\n                selectOnFocus:true\n            }), cfg\n        );\n    },\n    \n    init : function(view){\n        this.view = view;\n        view.on('render', this.initEditor, this);\n        this.on('complete', this.onSave, this);\n    },\n\n    initEditor : function(){\n        this.view.on({\n            scope: this,\n            containerclick: this.doBlur,\n            click: this.doBlur\n        });\n        this.view.getEl().on('mousedown', this.onMouseDown, this, {delegate: this.labelSelector});\n    },\n    \n    doBlur: function(){\n        if(this.editing){\n            this.field.blur();\n        }\n    },\n\n    onMouseDown : function(e, target){\n        if(!e.ctrlKey && !e.shiftKey){\n            var item = this.view.findItemFromChild(target);\n            e.stopEvent();\n            var record = this.view.store.getAt(this.view.indexOf(item));\n            this.startEdit(target, record.data[this.dataIndex]);\n            this.activeRecord = record;\n        }else{\n            e.preventDefault();\n        }\n    },\n\n    onSave : function(ed, value){\n        this.activeRecord.set(this.dataIndex, value);\n    }\n});\n\n\nExt.DataView.DragSelector = function(cfg){\n    cfg = cfg || {};\n    var view, proxy, tracker;\n    var rs, bodyRegion, dragRegion = new Ext.lib.Region(0,0,0,0);\n    var dragSafe = cfg.dragSafe === true;\n\n    this.init = function(dataView){\n        view = dataView;\n        view.on('render', onRender);\n    };\n\n    function fillRegions(){\n        rs = [];\n        view.all.each(function(el){\n            rs[rs.length] = el.getRegion();\n        });\n        bodyRegion = view.el.getRegion();\n    }\n\n    function cancelClick(){\n        return false;\n    }\n\n    function onBeforeStart(e){\n        return !dragSafe || e.target == view.el.dom;\n    }\n\n    function onStart(e){\n        view.on('containerclick', cancelClick, view, {single:true});\n        if(!proxy){\n            proxy = view.el.createChild({cls:'x-view-selector'});\n        }else{\n            if(proxy.dom.parentNode !== view.el.dom){\n                view.el.dom.appendChild(proxy.dom);\n            }\n            proxy.setDisplayed('block');\n        }\n        fillRegions();\n        view.clearSelections();\n    }\n\n    function onDrag(e){\n        var startXY = tracker.startXY;\n        var xy = tracker.getXY();\n\n        var x = Math.min(startXY[0], xy[0]);\n        var y = Math.min(startXY[1], xy[1]);\n        var w = Math.abs(startXY[0] - xy[0]);\n        var h = Math.abs(startXY[1] - xy[1]);\n\n        dragRegion.left = x;\n        dragRegion.top = y;\n        dragRegion.right = x+w;\n        dragRegion.bottom = y+h;\n\n        dragRegion.constrainTo(bodyRegion);\n        proxy.setRegion(dragRegion);\n\n        for(var i = 0, len = rs.length; i < len; i++){\n            var r = rs[i], sel = dragRegion.intersect(r);\n            if(sel && !r.selected){\n                r.selected = true;\n                view.select(i, true);\n            }else if(!sel && r.selected){\n                r.selected = false;\n                view.deselect(i);\n            }\n        }\n    }\n\n    function onEnd(e){\n        if (!Ext.isIE) {\n            view.un('containerclick', cancelClick, view);    \n        }        \n        if(proxy){\n            proxy.setDisplayed(false);\n        }\n    }\n\n    function onRender(view){\n        tracker = new Ext.dd.DragTracker({\n            onBeforeStart: onBeforeStart,\n            onStart: onStart,\n            onDrag: onDrag,\n            onEnd: onEnd\n        });\n        tracker.initEl(view.el);\n    }\n};Ext.ns('Ext.ux.form');\n\n/**\n * @class Ext.ux.form.FileUploadField\n * @extends Ext.form.TextField\n * Creates a file upload field.\n * @xtype fileuploadfield\n */\nExt.ux.form.FileUploadField = Ext.extend(Ext.form.TextField,  {\n    /**\n     * @cfg {String} buttonText The button text to display on the upload button (defaults to\n     * 'Browse...').  Note that if you supply a value for {@link #buttonCfg}, the buttonCfg.text\n     * value will be used instead if available.\n     */\n    buttonText: 'Browse...',\n    /**\n     * @cfg {Boolean} buttonOnly True to display the file upload field as a button with no visible\n     * text field (defaults to false).  If true, all inherited TextField members will still be available.\n     */\n    buttonOnly: false,\n    /**\n     * @cfg {Number} buttonOffset The number of pixels of space reserved between the button and the text field\n     * (defaults to 3).  Note that this only applies if {@link #buttonOnly} = false.\n     */\n    buttonOffset: 3,\n    /**\n     * @cfg {Object} buttonCfg A standard {@link Ext.Button} config object.\n     */\n\n    // private\n    readOnly: true,\n\n    /**\n     * @hide\n     * @method autoSize\n     */\n    autoSize: Ext.emptyFn,\n\n    // private\n    initComponent: function(){\n        Ext.ux.form.FileUploadField.superclass.initComponent.call(this);\n\n        this.addEvents(\n            /**\n             * @event fileselected\n             * Fires when the underlying file input field's value has changed from the user\n             * selecting a new file from the system file selection dialog.\n             * @param {Ext.ux.form.FileUploadField} this\n             * @param {String} value The file value returned by the underlying file input field\n             */\n            'fileselected'\n        );\n    },\n\n    // private\n    onRender : function(ct, position){\n        Ext.ux.form.FileUploadField.superclass.onRender.call(this, ct, position);\n\n        this.wrap = this.el.wrap({cls:'x-form-field-wrap x-form-file-wrap'});\n        this.el.addClass('x-form-file-text');\n        this.el.dom.removeAttribute('name');\n        this.createFileInput();\n\n        var btnCfg = Ext.applyIf(this.buttonCfg || {}, {\n            text: this.buttonText\n        });\n        this.button = new Ext.Button(Ext.apply(btnCfg, {\n            renderTo: this.wrap,\n            cls: 'x-form-file-btn' + (btnCfg.iconCls ? ' x-btn-icon' : '')\n        }));\n\n        if(this.buttonOnly){\n            this.el.hide();\n            this.wrap.setWidth(this.button.getEl().getWidth());\n        }\n\n        this.bindListeners();\n        this.resizeEl = this.positionEl = this.wrap;\n    },\n    \n    bindListeners: function(){\n        this.fileInput.on({\n            scope: this,\n            mouseenter: function() {\n                this.button.addClass(['x-btn-over','x-btn-focus'])\n            },\n            mouseleave: function(){\n                this.button.removeClass(['x-btn-over','x-btn-focus','x-btn-click'])\n            },\n            mousedown: function(){\n                this.button.addClass('x-btn-click')\n            },\n            mouseup: function(){\n                this.button.removeClass(['x-btn-over','x-btn-focus','x-btn-click'])\n            },\n            change: function(){\n                var v = this.fileInput.dom.value;\n                this.setValue(v);\n                this.fireEvent('fileselected', this, v);    \n            }\n        }); \n    },\n    \n    createFileInput : function() {\n        this.fileInput = this.wrap.createChild({\n            id: this.getFileInputId(),\n            name: this.name||this.getId(),\n            cls: 'x-form-file',\n            tag: 'input',\n            type: 'file',\n            size: 1\n        });\n    },\n    \n    reset : function(){\n        if (this.rendered) {\n            this.fileInput.remove();\n            this.createFileInput();\n            this.bindListeners();\n        }\n        Ext.ux.form.FileUploadField.superclass.reset.call(this);\n    },\n\n    // private\n    getFileInputId: function(){\n        return this.id + '-file';\n    },\n\n    // private\n    onResize : function(w, h){\n        Ext.ux.form.FileUploadField.superclass.onResize.call(this, w, h);\n\n        this.wrap.setWidth(w);\n\n        if(!this.buttonOnly){\n            var w = this.wrap.getWidth() - this.button.getEl().getWidth() - this.buttonOffset;\n            this.el.setWidth(w);\n        }\n    },\n\n    // private\n    onDestroy: function(){\n        Ext.ux.form.FileUploadField.superclass.onDestroy.call(this);\n        Ext.destroy(this.fileInput, this.button, this.wrap);\n    },\n    \n    onDisable: function(){\n        Ext.ux.form.FileUploadField.superclass.onDisable.call(this);\n        this.doDisable(true);\n    },\n    \n    onEnable: function(){\n        Ext.ux.form.FileUploadField.superclass.onEnable.call(this);\n        this.doDisable(false);\n\n    },\n    \n    // private\n    doDisable: function(disabled){\n        this.fileInput.dom.disabled = disabled;\n        this.button.setDisabled(disabled);\n    },\n\n\n    // private\n    preFocus : Ext.emptyFn,\n\n    // private\n    alignErrorIcon : function(){\n        this.errorIcon.alignTo(this.wrap, 'tl-tr', [2, 0]);\n    }\n\n});\n\nExt.reg('fileuploadfield', Ext.ux.form.FileUploadField);\n\n// backwards compat\nExt.form.FileUploadField = Ext.ux.form.FileUploadField;\n/**\n * @class Ext.ux.GMapPanel\n * @extends Ext.Panel\n * @author Shea Frederick\n */\nExt.ux.GMapPanel = Ext.extend(Ext.Panel, {\n    initComponent : function(){\n        \n        var defConfig = {\n            plain: true,\n            zoomLevel: 3,\n            yaw: 180,\n            pitch: 0,\n            zoom: 0,\n            gmapType: 'map',\n            border: false\n        };\n        \n        Ext.applyIf(this,defConfig);\n        \n        Ext.ux.GMapPanel.superclass.initComponent.call(this);        \n\n    },\n    afterRender : function(){\n        \n        var wh = this.ownerCt.getSize();\n        Ext.applyIf(this, wh);\n        \n        Ext.ux.GMapPanel.superclass.afterRender.call(this);    \n        \n        if (this.gmapType === 'map'){\n            this.gmap = new GMap2(this.body.dom);\n        }\n        \n        if (this.gmapType === 'panorama'){\n            this.gmap = new GStreetviewPanorama(this.body.dom);\n        }\n        \n        if (typeof this.addControl == 'object' && this.gmapType === 'map') {\n            this.gmap.addControl(this.addControl);\n        }\n        \n        if (typeof this.setCenter === 'object') {\n            if (typeof this.setCenter.geoCodeAddr === 'string'){\n                this.geoCodeLookup(this.setCenter.geoCodeAddr);\n            }else{\n                if (this.gmapType === 'map'){\n                    var point = new GLatLng(this.setCenter.lat,this.setCenter.lng);\n                    this.gmap.setCenter(point, this.zoomLevel);    \n                }\n                if (typeof this.setCenter.marker === 'object' && typeof point === 'object'){\n                    this.addMarker(point,this.setCenter.marker,this.setCenter.marker.clear);\n                }\n            }\n            if (this.gmapType === 'panorama'){\n                this.gmap.setLocationAndPOV(new GLatLng(this.setCenter.lat,this.setCenter.lng), {yaw: this.yaw, pitch: this.pitch, zoom: this.zoom});\n            }\n        }\n\n        GEvent.bind(this.gmap, 'load', this, function(){\n            this.onMapReady();\n        });\n\n    },\n    onMapReady : function(){\n        this.addMarkers(this.markers);\n        this.addMapControls();\n        this.addOptions();  \n    },\n    onResize : function(w, h){\n\n        if (typeof this.getMap() == 'object') {\n            this.gmap.checkResize();\n        }\n        \n        Ext.ux.GMapPanel.superclass.onResize.call(this, w, h);\n\n    },\n    setSize : function(width, height, animate){\n        \n        if (typeof this.getMap() == 'object') {\n            this.gmap.checkResize();\n        }\n        \n        Ext.ux.GMapPanel.superclass.setSize.call(this, width, height, animate);\n        \n    },\n    getMap : function(){\n        \n        return this.gmap;\n        \n    },\n    getCenter : function(){\n        \n        return this.getMap().getCenter();\n        \n    },\n    getCenterLatLng : function(){\n        \n        var ll = this.getCenter();\n        return {lat: ll.lat(), lng: ll.lng()};\n        \n    },\n    addMarkers : function(markers) {\n        \n        if (Ext.isArray(markers)){\n            for (var i = 0; i < markers.length; i++) {\n                var mkr_point = new GLatLng(markers[i].lat,markers[i].lng);\n                this.addMarker(mkr_point,markers[i].marker,false,markers[i].setCenter, markers[i].listeners);\n            }\n        }\n        \n    },\n    addMarker : function(point, marker, clear, center, listeners){\n        \n        Ext.applyIf(marker,G_DEFAULT_ICON);\n\n        if (clear === true){\n            this.getMap().clearOverlays();\n        }\n        if (center === true) {\n            this.getMap().setCenter(point, this.zoomLevel);\n        }\n\n        var mark = new GMarker(point,marker);\n        if (typeof listeners === 'object'){\n            for (evt in listeners) {\n                GEvent.bind(mark, evt, this, listeners[evt]);\n            }\n        }\n        this.getMap().addOverlay(mark);\n\n    },\n    addMapControls : function(){\n        \n        if (this.gmapType === 'map') {\n            if (Ext.isArray(this.mapControls)) {\n                for(i=0;i<this.mapControls.length;i++){\n                    this.addMapControl(this.mapControls[i]);\n                }\n            }else if(typeof this.mapControls === 'string'){\n                this.addMapControl(this.mapControls);\n            }else if(typeof this.mapControls === 'object'){\n                this.getMap().addControl(this.mapControls);\n            }\n        }\n        \n    },\n    addMapControl : function(mc){\n        \n        var mcf = window[mc];\n        if (typeof mcf === 'function') {\n            this.getMap().addControl(new mcf());\n        }    \n        \n    },\n    addOptions : function(){\n        \n        if (Ext.isArray(this.mapConfOpts)) {\n            var mc;\n            for(i=0;i<this.mapConfOpts.length;i++){\n                this.addOption(this.mapConfOpts[i]);\n            }\n        }else if(typeof this.mapConfOpts === 'string'){\n            this.addOption(this.mapConfOpts);\n        }        \n        \n    },\n    addOption : function(mc){\n        \n        var mcf = this.getMap()[mc];\n        if (typeof mcf === 'function') {\n            this.getMap()[mc]();\n        }    \n        \n    },\n    geoCodeLookup : function(addr) {\n        \n        this.geocoder = new GClientGeocoder();\n        this.geocoder.getLocations(addr, this.addAddressToMap.createDelegate(this));\n        \n    },\n    addAddressToMap : function(response) {\n        \n        if (!response || response.Status.code != 200) {\n            Ext.MessageBox.alert('Error', 'Code '+response.Status.code+' Error Returned');\n        }else{\n            place = response.Placemark[0];\n            addressinfo = place.AddressDetails;\n            accuracy = addressinfo.Accuracy;\n            if (accuracy === 0) {\n                Ext.MessageBox.alert('Unable to Locate Address', 'Unable to Locate the Address you provided');\n            }else{\n                if (accuracy < 7) {\n                    Ext.MessageBox.alert('Address Accuracy', 'The address provided has a low accuracy.<br><br>Level '+accuracy+' Accuracy (8 = Exact Match, 1 = Vague Match)');\n                }else{\n                    point = new GLatLng(place.Point.coordinates[1], place.Point.coordinates[0]);\n                    if (typeof this.setCenter.marker === 'object' && typeof point === 'object'){\n                        this.addMarker(point,this.setCenter.marker,this.setCenter.marker.clear,true, this.setCenter.listeners);\n                    }\n                }\n            }\n        }\n        \n    }\n \n});\n\nExt.reg('gmappanel', Ext.ux.GMapPanel); Ext.namespace('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.GridFilters\n * @extends Ext.util.Observable\n * <p>GridFilter is a plugin (<code>ptype='gridfilters'</code>) for grids that\n * allow for a slightly more robust representation of filtering than what is\n * provided by the default store.</p>\n * <p>Filtering is adjusted by the user using the grid's column header menu\n * (this menu can be disabled through configuration). Through this menu users\n * can configure, enable, and disable filters for each column.</p>\n * <p><b><u>Features:</u></b></p>\n * <div class=\"mdetail-params\"><ul>\n * <li><b>Filtering implementations</b> :\n * <div class=\"sub-desc\">\n * Default filtering for Strings, Numeric Ranges, Date Ranges, Lists (which can\n * be backed by a Ext.data.Store), and Boolean. Additional custom filter types\n * and menus are easily created by extending Ext.ux.grid.filter.Filter.\n * </div></li>\n * <li><b>Graphical indicators</b> :\n * <div class=\"sub-desc\">\n * Columns that are filtered have {@link #filterCls a configurable css class}\n * applied to the column headers.\n * </div></li>\n * <li><b>Paging</b> :\n * <div class=\"sub-desc\">\n * If specified as a plugin to the grid's configured PagingToolbar, the current page\n * will be reset to page 1 whenever you update the filters.\n * </div></li>\n * <li><b>Automatic Reconfiguration</b> :\n * <div class=\"sub-desc\">\n * Filters automatically reconfigure when the grid 'reconfigure' event fires.\n * </div></li>\n * <li><b>Stateful</b> :\n * Filter information will be persisted across page loads by specifying a\n * <code>stateId</code> in the Grid configuration.\n * <div class=\"sub-desc\">\n * The filter collection binds to the\n * <code>{@link Ext.grid.GridPanel#beforestaterestore beforestaterestore}</code>\n * and <code>{@link Ext.grid.GridPanel#beforestatesave beforestatesave}</code>\n * events in order to be stateful.\n * </div></li>\n * <li><b>Grid Changes</b> :\n * <div class=\"sub-desc\"><ul>\n * <li>A <code>filters</code> <i>property</i> is added to the grid pointing to\n * this plugin.</li>\n * <li>A <code>filterupdate</code> <i>event</i> is added to the grid and is\n * fired upon onStateChange completion.</li>\n * </ul></div></li>\n * <li><b>Server side code examples</b> :\n * <div class=\"sub-desc\"><ul>\n * <li><a href=\"http://www.vinylfox.com/extjs/grid-filter-php-backend-code.php\">PHP</a> - (Thanks VinylFox)</li>\n * <li><a href=\"http://extjs.com/forum/showthread.php?p=77326#post77326\">Ruby on Rails</a> - (Thanks Zyclops)</li>\n * <li><a href=\"http://extjs.com/forum/showthread.php?p=176596#post176596\">Ruby on Rails</a> - (Thanks Rotomaul)</li>\n * <li><a href=\"http://www.debatablybeta.com/posts/using-extjss-grid-filtering-with-django/\">Python</a> - (Thanks Matt)</li>\n * <li><a href=\"http://mcantrell.wordpress.com/2008/08/22/extjs-grids-and-grails/\">Grails</a> - (Thanks Mike)</li>\n * </ul></div></li>\n * </ul></div>\n * <p><b><u>Example usage:</u></b></p>\n * <pre><code>\nvar store = new Ext.data.GroupingStore({\n    ...\n});\n\nvar filters = new Ext.ux.grid.GridFilters({\n    autoReload: false, //don&#39;t reload automatically\n    local: true, //only filter locally\n    // filters may be configured through the plugin,\n    // or in the column definition within the column model configuration\n    filters: [{\n        type: 'numeric',\n        dataIndex: 'id'\n    }, {\n        type: 'string',\n        dataIndex: 'name'\n    }, {\n        type: 'numeric',\n        dataIndex: 'price'\n    }, {\n        type: 'date',\n        dataIndex: 'dateAdded'\n    }, {\n        type: 'list',\n        dataIndex: 'size',\n        options: ['extra small', 'small', 'medium', 'large', 'extra large'],\n        phpMode: true\n    }, {\n        type: 'boolean',\n        dataIndex: 'visible'\n    }]\n});\nvar cm = new Ext.grid.ColumnModel([{\n    ...\n}]);\n\nvar grid = new Ext.grid.GridPanel({\n     ds: store,\n     cm: cm,\n     view: new Ext.grid.GroupingView(),\n     plugins: [filters],\n     height: 400,\n     width: 700,\n     bbar: new Ext.PagingToolbar({\n         store: store,\n         pageSize: 15,\n         plugins: [filters] //reset page to page 1 if filters change\n     })\n });\n\nstore.load({params: {start: 0, limit: 15}});\n\n// a filters property is added to the grid\ngrid.filters\n * </code></pre>\n */\nExt.ux.grid.GridFilters = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Boolean} autoReload\n     * Defaults to true, reloading the datasource when a filter change happens.\n     * Set this to false to prevent the datastore from being reloaded if there\n     * are changes to the filters.  See <code>{@link updateBuffer}</code>.\n     */\n    autoReload : true,\n    /**\n     * @cfg {Boolean} encode\n     * Specify true for {@link #buildQuery} to use Ext.util.JSON.encode to\n     * encode the filter query parameter sent with a remote request.\n     * Defaults to false.\n     */\n    /**\n     * @cfg {Array} filters\n     * An Array of filters config objects. Refer to each filter type class for\n     * configuration details specific to each filter type. Filters for Strings,\n     * Numeric Ranges, Date Ranges, Lists, and Boolean are the standard filters\n     * available.\n     */\n    /**\n     * @cfg {String} filterCls\n     * The css class to be applied to column headers with active filters.\n     * Defaults to <tt>'ux-filterd-column'</tt>.\n     */\n    filterCls : 'ux-filtered-column',\n    /**\n     * @cfg {Boolean} local\n     * <tt>true</tt> to use Ext.data.Store filter functions (local filtering)\n     * instead of the default (<tt>false</tt>) server side filtering.\n     */\n    local : false,\n    /**\n     * @cfg {String} menuFilterText\n     * defaults to <tt>'Filters'</tt>.\n     */\n    menuFilterText : 'Filters',\n    /**\n     * @cfg {String} paramPrefix\n     * The url parameter prefix for the filters.\n     * Defaults to <tt>'filter'</tt>.\n     */\n    paramPrefix : 'filter',\n    /**\n     * @cfg {Boolean} showMenu\n     * Defaults to true, including a filter submenu in the default header menu.\n     */\n    showMenu : true,\n    /**\n     * @cfg {String} stateId\n     * Name of the value to be used to store state information.\n     */\n    stateId : undefined,\n    /**\n     * @cfg {Integer} updateBuffer\n     * Number of milliseconds to defer store updates since the last filter change.\n     */\n    updateBuffer : 500,\n\n    /** @private */\n    constructor : function (config) {\n        config = config || {};\n        this.deferredUpdate = new Ext.util.DelayedTask(this.reload, this);\n        this.filters = new Ext.util.MixedCollection();\n        this.filters.getKey = function (o) {\n            return o ? o.dataIndex : null;\n        };\n        this.addFilters(config.filters);\n        delete config.filters;\n        Ext.apply(this, config);\n    },\n\n    /** @private */\n    init : function (grid) {\n        if (grid instanceof Ext.grid.GridPanel) {\n            this.grid = grid;\n\n            this.bindStore(this.grid.getStore(), true);\n            // assumes no filters were passed in the constructor, so try and use ones from the colModel\n            if(this.filters.getCount() == 0){\n                this.addFilters(this.grid.getColumnModel());\n            }\n\n            this.grid.filters = this;\n\n            this.grid.addEvents({'filterupdate': true});\n\n            grid.on({\n                scope: this,\n                beforestaterestore: this.applyState,\n                beforestatesave: this.saveState,\n                beforedestroy: this.destroy,\n                reconfigure: this.onReconfigure\n            });\n\n            if (grid.rendered){\n                this.onRender();\n            } else {\n                grid.on({\n                    scope: this,\n                    single: true,\n                    render: this.onRender\n                });\n            }\n\n        } else if (grid instanceof Ext.PagingToolbar) {\n            this.toolbar = grid;\n        }\n    },\n\n    /**\n     * @private\n     * Handler for the grid's beforestaterestore event (fires before the state of the\n     * grid is restored).\n     * @param {Object} grid The grid object\n     * @param {Object} state The hash of state values returned from the StateProvider.\n     */\n    applyState : function (grid, state) {\n        var key, filter;\n        this.applyingState = true;\n        this.clearFilters();\n        if (state.filters) {\n            for (key in state.filters) {\n                filter = this.filters.get(key);\n                if (filter) {\n                    filter.setValue(state.filters[key]);\n                    filter.setActive(true);\n                }\n            }\n        }\n        this.deferredUpdate.cancel();\n        if (this.local) {\n            this.reload();\n        }\n        delete this.applyingState;\n        delete state.filters;\n    },\n\n    /**\n     * Saves the state of all active filters\n     * @param {Object} grid\n     * @param {Object} state\n     * @return {Boolean}\n     */\n    saveState : function (grid, state) {\n        var filters = {};\n        this.filters.each(function (filter) {\n            if (filter.active) {\n                filters[filter.dataIndex] = filter.getValue();\n            }\n        });\n        return (state.filters = filters);\n    },\n\n    /**\n     * @private\n     * Handler called when the grid is rendered\n     */\n    onRender : function () {\n        this.grid.getView().on('refresh', this.onRefresh, this);\n        this.createMenu();\n    },\n\n    /**\n     * @private\n     * Handler called by the grid 'beforedestroy' event\n     */\n    destroy : function () {\n        this.removeAll();\n        this.purgeListeners();\n\n        if(this.filterMenu){\n            Ext.menu.MenuMgr.unregister(this.filterMenu);\n            this.filterMenu.destroy();\n             this.filterMenu = this.menu.menu = null;\n        }\n    },\n\n    /**\n     * Remove all filters, permanently destroying them.\n     */\n    removeAll : function () {\n        if(this.filters){\n            Ext.destroy.apply(Ext, this.filters.items);\n            // remove all items from the collection\n            this.filters.clear();\n        }\n    },\n\n\n    /**\n     * Changes the data store bound to this view and refreshes it.\n     * @param {Store} store The store to bind to this view\n     */\n    bindStore : function(store, initial){\n        if(!initial && this.store){\n            if (this.local) {\n                store.un('load', this.onLoad, this);\n            } else {\n                store.un('beforeload', this.onBeforeLoad, this);\n            }\n        }\n        if(store){\n            if (this.local) {\n                store.on('load', this.onLoad, this);\n            } else {\n                store.on('beforeload', this.onBeforeLoad, this);\n            }\n        }\n        this.store = store;\n    },\n\n    /**\n     * @private\n     * Handler called when the grid reconfigure event fires\n     */\n    onReconfigure : function () {\n        this.bindStore(this.grid.getStore());\n        this.store.clearFilter();\n        this.removeAll();\n        this.addFilters(this.grid.getColumnModel());\n        this.updateColumnHeadings();\n    },\n\n    createMenu : function () {\n        var view = this.grid.getView(),\n            hmenu = view.hmenu;\n\n        if (this.showMenu && hmenu) {\n\n            this.sep  = hmenu.addSeparator();\n            this.filterMenu = new Ext.menu.Menu({\n                id: this.grid.id + '-filters-menu'\n            });\n            this.menu = hmenu.add({\n                checked: false,\n                itemId: 'filters',\n                text: this.menuFilterText,\n                menu: this.filterMenu\n            });\n\n            this.menu.on({\n                scope: this,\n                checkchange: this.onCheckChange,\n                beforecheckchange: this.onBeforeCheck\n            });\n            hmenu.on('beforeshow', this.onMenu, this);\n        }\n        this.updateColumnHeadings();\n    },\n\n    /**\n     * @private\n     * Get the filter menu from the filters MixedCollection based on the clicked header\n     */\n    getMenuFilter : function () {\n        var view = this.grid.getView();\n        if (!view || view.hdCtxIndex === undefined) {\n            return null;\n        }\n        return this.filters.get(\n            view.cm.config[view.hdCtxIndex].dataIndex\n        );\n    },\n\n    /**\n     * @private\n     * Handler called by the grid's hmenu beforeshow event\n     */\n    onMenu : function (filterMenu) {\n        var filter = this.getMenuFilter();\n\n        if (filter) {\n/*\nTODO: lazy rendering\n            if (!filter.menu) {\n                filter.menu = filter.createMenu();\n            }\n*/\n            this.menu.menu = filter.menu;\n            this.menu.setChecked(filter.active, false);\n            // disable the menu if filter.disabled explicitly set to true\n            this.menu.setDisabled(filter.disabled === true);\n        }\n\n        this.menu.setVisible(filter !== undefined);\n        this.sep.setVisible(filter !== undefined);\n    },\n\n    /** @private */\n    onCheckChange : function (item, value) {\n        this.getMenuFilter().setActive(value);\n    },\n\n    /** @private */\n    onBeforeCheck : function (check, value) {\n        return !value || this.getMenuFilter().isActivatable();\n    },\n\n    /**\n     * @private\n     * Handler for all events on filters.\n     * @param {String} event Event name\n     * @param {Object} filter Standard signature of the event before the event is fired\n     */\n    onStateChange : function (event, filter) {\n        if (event === 'serialize') {\n            return;\n        }\n\n        if (filter == this.getMenuFilter()) {\n            this.menu.setChecked(filter.active, false);\n        }\n\n        if ((this.autoReload || this.local) && !this.applyingState) {\n            this.deferredUpdate.delay(this.updateBuffer);\n        }\n        this.updateColumnHeadings();\n\n        if (!this.applyingState) {\n            this.grid.saveState();\n        }\n        this.grid.fireEvent('filterupdate', this, filter);\n    },\n\n    /**\n     * @private\n     * Handler for store's beforeload event when configured for remote filtering\n     * @param {Object} store\n     * @param {Object} options\n     */\n    onBeforeLoad : function (store, options) {\n        options.params = options.params || {};\n        this.cleanParams(options.params);\n        var params = this.buildQuery(this.getFilterData());\n        Ext.apply(options.params, params);\n    },\n\n    /**\n     * @private\n     * Handler for store's load event when configured for local filtering\n     * @param {Object} store\n     * @param {Object} options\n     */\n    onLoad : function (store, options) {\n        store.filterBy(this.getRecordFilter());\n    },\n\n    /**\n     * @private\n     * Handler called when the grid's view is refreshed\n     */\n    onRefresh : function () {\n        this.updateColumnHeadings();\n    },\n\n    /**\n     * Update the styles for the header row based on the active filters\n     */\n    updateColumnHeadings : function () {\n        var view = this.grid.getView(),\n            i, len, filter;\n        if (view.mainHd) {\n            for (i = 0, len = view.cm.config.length; i < len; i++) {\n                filter = this.getFilter(view.cm.config[i].dataIndex);\n                Ext.fly(view.getHeaderCell(i))[filter && filter.active ? 'addClass' : 'removeClass'](this.filterCls);\n            }\n        }\n    },\n\n    /** @private */\n    reload : function () {\n        if (this.local) {\n            this.grid.store.clearFilter(true);\n            this.grid.store.filterBy(this.getRecordFilter());\n        } else {\n            var start,\n                store = this.grid.store;\n            this.deferredUpdate.cancel();\n            if (this.toolbar) {\n                start = store.paramNames.start;\n                if (store.lastOptions && store.lastOptions.params && store.lastOptions.params[start]) {\n                    store.lastOptions.params[start] = 0;\n                }\n            }\n            store.reload();\n        }\n    },\n\n    /**\n     * Method factory that generates a record validator for the filters active at the time\n     * of invokation.\n     * @private\n     */\n    getRecordFilter : function () {\n        var f = [], len, i;\n        this.filters.each(function (filter) {\n            if (filter.active) {\n                f.push(filter);\n            }\n        });\n\n        len = f.length;\n        return function (record) {\n            for (i = 0; i < len; i++) {\n                if (!f[i].validateRecord(record)) {\n                    return false;\n                }\n            }\n            return true;\n        };\n    },\n\n    /**\n     * Adds a filter to the collection and observes it for state change.\n     * @param {Object/Ext.ux.grid.filter.Filter} config A filter configuration or a filter object.\n     * @return {Ext.ux.grid.filter.Filter} The existing or newly created filter object.\n     */\n    addFilter : function (config) {\n        var Cls = this.getFilterClass(config.type),\n            filter = config.menu ? config : (new Cls(config));\n        this.filters.add(filter);\n\n        Ext.util.Observable.capture(filter, this.onStateChange, this);\n        return filter;\n    },\n\n    /**\n     * Adds filters to the collection.\n     * @param {Array/Ext.grid.ColumnModel} filters Either an Array of\n     * filter configuration objects or an Ext.grid.ColumnModel.  The columns\n     * of a passed Ext.grid.ColumnModel will be examined for a <code>filter</code>\n     * property and, if present, will be used as the filter configuration object.\n     */\n    addFilters : function (filters) {\n        if (filters) {\n            var i, len, filter, cm = false, dI;\n            if (filters instanceof Ext.grid.ColumnModel) {\n                filters = filters.config;\n                cm = true;\n            }\n            for (i = 0, len = filters.length; i < len; i++) {\n                filter = false;\n                if (cm) {\n                    dI = filters[i].dataIndex;\n                    filter = filters[i].filter || filters[i].filterable;\n                    if (filter){\n                        filter = (filter === true) ? {} : filter;\n                        Ext.apply(filter, {dataIndex:dI});\n                        // filter type is specified in order of preference:\n                        //     filter type specified in config\n                        //     type specified in store's field's type config\n                        filter.type = filter.type || this.store.fields.get(dI).type.type;\n                    }\n                } else {\n                    filter = filters[i];\n                }\n                // if filter config found add filter for the column\n                if (filter) {\n                    this.addFilter(filter);\n                }\n            }\n        }\n    },\n\n    /**\n     * Returns a filter for the given dataIndex, if one exists.\n     * @param {String} dataIndex The dataIndex of the desired filter object.\n     * @return {Ext.ux.grid.filter.Filter}\n     */\n    getFilter : function (dataIndex) {\n        return this.filters.get(dataIndex);\n    },\n\n    /**\n     * Turns all filters off. This does not clear the configuration information\n     * (see {@link #removeAll}).\n     */\n    clearFilters : function () {\n        this.filters.each(function (filter) {\n            filter.setActive(false);\n        });\n    },\n\n    /**\n     * Returns an Array of the currently active filters.\n     * @return {Array} filters Array of the currently active filters.\n     */\n    getFilterData : function () {\n        var filters = [], i, len;\n\n        this.filters.each(function (f) {\n            if (f.active) {\n                var d = [].concat(f.serialize());\n                for (i = 0, len = d.length; i < len; i++) {\n                    filters.push({\n                        field: f.dataIndex,\n                        data: d[i]\n                    });\n                }\n            }\n        });\n        return filters;\n    },\n\n    /**\n     * Function to take the active filters data and build it into a query.\n     * The format of the query depends on the <code>{@link #encode}</code>\n     * configuration:\n     * <div class=\"mdetail-params\"><ul>\n     *\n     * <li><b><tt>false</tt></b> : <i>Default</i>\n     * <div class=\"sub-desc\">\n     * Flatten into query string of the form (assuming <code>{@link #paramPrefix}='filters'</code>:\n     * <pre><code>\nfilters[0][field]=\"someDataIndex\"&\nfilters[0][data][comparison]=\"someValue1\"&\nfilters[0][data][type]=\"someValue2\"&\nfilters[0][data][value]=\"someValue3\"&\n     * </code></pre>\n     * </div></li>\n     * <li><b><tt>true</tt></b> :\n     * <div class=\"sub-desc\">\n     * JSON encode the filter data\n     * <pre><code>\nfilters[0][field]=\"someDataIndex\"&\nfilters[0][data][comparison]=\"someValue1\"&\nfilters[0][data][type]=\"someValue2\"&\nfilters[0][data][value]=\"someValue3\"&\n     * </code></pre>\n     * </div></li>\n     * </ul></div>\n     * Override this method to customize the format of the filter query for remote requests.\n     * @param {Array} filters A collection of objects representing active filters and their configuration.\n     *    Each element will take the form of {field: dataIndex, data: filterConf}. dataIndex is not assured\n     *    to be unique as any one filter may be a composite of more basic filters for the same dataIndex.\n     * @return {Object} Query keys and values\n     */\n    buildQuery : function (filters) {\n        var p = {}, i, f, root, dataPrefix, key, tmp,\n            len = filters.length;\n\n        if (!this.encode){\n            for (i = 0; i < len; i++) {\n                f = filters[i];\n                root = [this.paramPrefix, '[', i, ']'].join('');\n                p[root + '[field]'] = f.field;\n\n                dataPrefix = root + '[data]';\n                for (key in f.data) {\n                    p[[dataPrefix, '[', key, ']'].join('')] = f.data[key];\n                }\n            }\n        } else {\n            tmp = [];\n            for (i = 0; i < len; i++) {\n                f = filters[i];\n                tmp.push(Ext.apply(\n                    {},\n                    {field: f.field},\n                    f.data\n                ));\n            }\n            // only build if there is active filter\n            if (tmp.length > 0){\n                p[this.paramPrefix] = Ext.util.JSON.encode(tmp);\n            }\n        }\n        return p;\n    },\n\n    /**\n     * Removes filter related query parameters from the provided object.\n     * @param {Object} p Query parameters that may contain filter related fields.\n     */\n    cleanParams : function (p) {\n        // if encoding just delete the property\n        if (this.encode) {\n            delete p[this.paramPrefix];\n        // otherwise scrub the object of filter data\n        } else {\n            var regex, key;\n            regex = new RegExp('^' + this.paramPrefix + '\\[[0-9]+\\]');\n            for (key in p) {\n                if (regex.test(key)) {\n                    delete p[key];\n                }\n            }\n        }\n    },\n\n    /**\n     * Function for locating filter classes, overwrite this with your favorite\n     * loader to provide dynamic filter loading.\n     * @param {String} type The type of filter to load ('Filter' is automatically\n     * appended to the passed type; eg, 'string' becomes 'StringFilter').\n     * @return {Class} The Ext.ux.grid.filter.Class\n     */\n    getFilterClass : function (type) {\n        // map the supported Ext.data.Field type values into a supported filter\n        switch(type) {\n            case 'auto':\n              type = 'string';\n              break;\n            case 'int':\n            case 'float':\n              type = 'numeric';\n              break;\n            case 'bool':\n              type = 'boolean';\n              break;\n        }\n        return Ext.ux.grid.filter[type.substr(0, 1).toUpperCase() + type.substr(1) + 'Filter'];\n    }\n});\n\n// register ptype\nExt.preg('gridfilters', Ext.ux.grid.GridFilters);\nExt.namespace('Ext.ux.grid.filter');\n\n/** \n * @class Ext.ux.grid.filter.Filter\n * @extends Ext.util.Observable\n * Abstract base class for filter implementations.\n */\nExt.ux.grid.filter.Filter = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Boolean} active\n     * Indicates the initial status of the filter (defaults to false).\n     */\n    active : false,\n    /**\n     * True if this filter is active.  Use setActive() to alter after configuration.\n     * @type Boolean\n     * @property active\n     */\n    /**\n     * @cfg {String} dataIndex \n     * The {@link Ext.data.Store} dataIndex of the field this filter represents.\n     * The dataIndex does not actually have to exist in the store.\n     */\n    dataIndex : null,\n    /**\n     * The filter configuration menu that will be installed into the filter submenu of a column menu.\n     * @type Ext.menu.Menu\n     * @property\n     */\n    menu : null,\n    /**\n     * @cfg {Number} updateBuffer\n     * Number of milliseconds to wait after user interaction to fire an update. Only supported \n     * by filters: 'list', 'numeric', and 'string'. Defaults to 500.\n     */\n    updateBuffer : 500,\n\n    constructor : function (config) {\n        Ext.apply(this, config);\n            \n        this.addEvents(\n            /**\n             * @event activate\n             * Fires when an inactive filter becomes active\n             * @param {Ext.ux.grid.filter.Filter} this\n             */\n            'activate',\n            /**\n             * @event deactivate\n             * Fires when an active filter becomes inactive\n             * @param {Ext.ux.grid.filter.Filter} this\n             */\n            'deactivate',\n            /**\n             * @event serialize\n             * Fires after the serialization process. Use this to attach additional parameters to serialization\n             * data before it is encoded and sent to the server.\n             * @param {Array/Object} data A map or collection of maps representing the current filter configuration.\n             * @param {Ext.ux.grid.filter.Filter} filter The filter being serialized.\n             */\n            'serialize',\n            /**\n             * @event update\n             * Fires when a filter configuration has changed\n             * @param {Ext.ux.grid.filter.Filter} this The filter object.\n             */\n            'update'\n        );\n        Ext.ux.grid.filter.Filter.superclass.constructor.call(this);\n\n        this.menu = new Ext.menu.Menu();\n        this.init(config);\n        if(config && config.value){\n            this.setValue(config.value);\n            this.setActive(config.active !== false, true);\n            delete config.value;\n        }\n    },\n\n    /**\n     * Destroys this filter by purging any event listeners, and removing any menus.\n     */\n    destroy : function(){\n        if (this.menu){\n            this.menu.destroy();\n        }\n        this.purgeListeners();\n    },\n\n    /**\n     * Template method to be implemented by all subclasses that is to\n     * initialize the filter and install required menu items.\n     * Defaults to Ext.emptyFn.\n     */\n    init : Ext.emptyFn,\n    \n    /**\n     * Template method to be implemented by all subclasses that is to\n     * get and return the value of the filter.\n     * Defaults to Ext.emptyFn.\n     * @return {Object} The 'serialized' form of this filter\n     * @methodOf Ext.ux.grid.filter.Filter\n     */\n    getValue : Ext.emptyFn,\n    \n    /**\n     * Template method to be implemented by all subclasses that is to\n     * set the value of the filter and fire the 'update' event.\n     * Defaults to Ext.emptyFn.\n     * @param {Object} data The value to set the filter\n     * @methodOf Ext.ux.grid.filter.Filter\n     */\t\n    setValue : Ext.emptyFn,\n    \n    /**\n     * Template method to be implemented by all subclasses that is to\n     * return <tt>true</tt> if the filter has enough configuration information to be activated.\n     * Defaults to <tt>return true</tt>.\n     * @return {Boolean}\n     */\n    isActivatable : function(){\n        return true;\n    },\n    \n    /**\n     * Template method to be implemented by all subclasses that is to\n     * get and return serialized filter data for transmission to the server.\n     * Defaults to Ext.emptyFn.\n     */\n    getSerialArgs : Ext.emptyFn,\n\n    /**\n     * Template method to be implemented by all subclasses that is to\n     * validates the provided Ext.data.Record against the filters configuration.\n     * Defaults to <tt>return true</tt>.\n     * @param {Ext.data.Record} record The record to validate\n     * @return {Boolean} true if the record is valid within the bounds\n     * of the filter, false otherwise.\n     */\n    validateRecord : function(){\n        return true;\n    },\n\n    /**\n     * Returns the serialized filter data for transmission to the server\n     * and fires the 'serialize' event.\n     * @return {Object/Array} An object or collection of objects containing\n     * key value pairs representing the current configuration of the filter.\n     * @methodOf Ext.ux.grid.filter.Filter\n     */\n    serialize : function(){\n        var args = this.getSerialArgs();\n        this.fireEvent('serialize', args, this);\n        return args;\n    },\n\n    /** @private */\n    fireUpdate : function(){\n        if (this.active) {\n            this.fireEvent('update', this);\n        }\n        this.setActive(this.isActivatable());\n    },\n    \n    /**\n     * Sets the status of the filter and fires the appropriate events.\n     * @param {Boolean} active        The new filter state.\n     * @param {Boolean} suppressEvent True to prevent events from being fired.\n     * @methodOf Ext.ux.grid.filter.Filter\n     */\n    setActive : function(active, suppressEvent){\n        if(this.active != active){\n            this.active = active;\n            if (suppressEvent !== true) {\n                this.fireEvent(active ? 'activate' : 'deactivate', this);\n            }\n        }\n    }    \n});/** \n * @class Ext.ux.grid.filter.BooleanFilter\n * @extends Ext.ux.grid.filter.Filter\n * Boolean filters use unique radio group IDs (so you can have more than one!)\n * <p><b><u>Example Usage:</u></b></p>\n * <pre><code>    \nvar filters = new Ext.ux.grid.GridFilters({\n    ...\n    filters: [{\n        // required configs\n        type: 'boolean',\n        dataIndex: 'visible'\n\n        // optional configs\n        defaultValue: null, // leave unselected (false selected by default)\n        yesText: 'Yes',     // default\n        noText: 'No'        // default\n    }]\n});\n * </code></pre>\n */\nExt.ux.grid.filter.BooleanFilter = Ext.extend(Ext.ux.grid.filter.Filter, {\n\t/**\n\t * @cfg {Boolean} defaultValue\n\t * Set this to null if you do not want either option to be checked by default. Defaults to false.\n\t */\n\tdefaultValue : false,\n\t/**\n\t * @cfg {String} yesText\n\t * Defaults to 'Yes'.\n\t */\n\tyesText : 'Yes',\n\t/**\n\t * @cfg {String} noText\n\t * Defaults to 'No'.\n\t */\n\tnoText : 'No',\n\n    /**  \n     * @private\n     * Template method that is to initialize the filter and install required menu items.\n     */\n    init : function (config) {\n        var gId = Ext.id();\n\t\tthis.options = [\n\t\t\tnew Ext.menu.CheckItem({text: this.yesText, group: gId, checked: this.defaultValue === true}),\n\t\t\tnew Ext.menu.CheckItem({text: this.noText, group: gId, checked: this.defaultValue === false})];\n\t\t\n\t\tthis.menu.add(this.options[0], this.options[1]);\n\t\t\n\t\tfor(var i=0; i<this.options.length; i++){\n\t\t\tthis.options[i].on('click', this.fireUpdate, this);\n\t\t\tthis.options[i].on('checkchange', this.fireUpdate, this);\n\t\t}\n\t},\n\t\n    /**\n     * @private\n     * Template method that is to get and return the value of the filter.\n     * @return {String} The value of this filter\n     */\n    getValue : function () {\n\t\treturn this.options[0].checked;\n\t},\n\n    /**\n     * @private\n     * Template method that is to set the value of the filter.\n     * @param {Object} value The value to set the filter\n     */\t\n\tsetValue : function (value) {\n\t\tthis.options[value ? 0 : 1].setChecked(true);\n\t},\n\n    /**\n     * @private\n     * Template method that is to get and return serialized filter data for\n     * transmission to the server.\n     * @return {Object/Array} An object or collection of objects containing\n     * key value pairs representing the current configuration of the filter.\n     */\n    getSerialArgs : function () {\n\t\tvar args = {type: 'boolean', value: this.getValue()};\n\t\treturn args;\n\t},\n\t\n    /**\n     * Template method that is to validate the provided Ext.data.Record\n     * against the filters configuration.\n     * @param {Ext.data.Record} record The record to validate\n     * @return {Boolean} true if the record is valid within the bounds\n     * of the filter, false otherwise.\n     */\n    validateRecord : function (record) {\n\t\treturn record.get(this.dataIndex) == this.getValue();\n\t}\n});/** \n * @class Ext.ux.grid.filter.DateFilter\n * @extends Ext.ux.grid.filter.Filter\n * Filter by a configurable Ext.menu.DateMenu\n * <p><b><u>Example Usage:</u></b></p>\n * <pre><code>    \nvar filters = new Ext.ux.grid.GridFilters({\n    ...\n    filters: [{\n        // required configs\n        type: 'date',\n        dataIndex: 'dateAdded',\n        \n        // optional configs\n        dateFormat: 'm/d/Y',  // default\n        beforeText: 'Before', // default\n        afterText: 'After',   // default\n        onText: 'On',         // default\n        pickerOpts: {\n            // any DateMenu configs\n        },\n\n        active: true // default is false\n    }]\n});\n * </code></pre>\n */\nExt.ux.grid.filter.DateFilter = Ext.extend(Ext.ux.grid.filter.Filter, {\n    /**\n     * @cfg {String} afterText\n     * Defaults to 'After'.\n     */\n    afterText : 'After',\n    /**\n     * @cfg {String} beforeText\n     * Defaults to 'Before'.\n     */\n    beforeText : 'Before',\n    /**\n     * @cfg {Object} compareMap\n     * Map for assigning the comparison values used in serialization.\n     */\n    compareMap : {\n        before: 'lt',\n        after:  'gt',\n        on:     'eq'\n    },\n    /**\n     * @cfg {String} dateFormat\n     * The date format to return when using getValue.\n     * Defaults to 'm/d/Y'.\n     */\n    dateFormat : 'm/d/Y',\n\n    /**\n     * @cfg {Date} maxDate\n     * Allowable date as passed to the Ext.DatePicker\n     * Defaults to undefined.\n     */\n    /**\n     * @cfg {Date} minDate\n     * Allowable date as passed to the Ext.DatePicker\n     * Defaults to undefined.\n     */\n    /**\n     * @cfg {Array} menuItems\n     * The items to be shown in this menu\n     * Defaults to:<pre>\n     * menuItems : ['before', 'after', '-', 'on'],\n     * </pre>\n     */\n    menuItems : ['before', 'after', '-', 'on'],\n\n    /**\n     * @cfg {Object} menuItemCfgs\n     * Default configuration options for each menu item\n     */\n    menuItemCfgs : {\n        selectOnFocus: true,\n        width: 125\n    },\n\n    /**\n     * @cfg {String} onText\n     * Defaults to 'On'.\n     */\n    onText : 'On',\n    \n    /**\n     * @cfg {Object} pickerOpts\n     * Configuration options for the date picker associated with each field.\n     */\n    pickerOpts : {},\n\n    /**  \n     * @private\n     * Template method that is to initialize the filter and install required menu items.\n     */\n    init : function (config) {\n        var menuCfg, i, len, item, cfg, Cls;\n\n        menuCfg = Ext.apply(this.pickerOpts, {\n            minDate: this.minDate, \n            maxDate: this.maxDate, \n            format:  this.dateFormat,\n            listeners: {\n                scope: this,\n                select: this.onMenuSelect\n            }\n        });\n\n        this.fields = {};\n        for (i = 0, len = this.menuItems.length; i < len; i++) {\n            item = this.menuItems[i];\n            if (item !== '-') {\n                cfg = {\n                    itemId: 'range-' + item,\n                    text: this[item + 'Text'],\n                    menu: new Ext.menu.DateMenu(\n                        Ext.apply(menuCfg, {\n                            itemId: item\n                        })\n                    ),\n                    listeners: {\n                        scope: this,\n                        checkchange: this.onCheckChange\n                    }\n                };\n                Cls = Ext.menu.CheckItem;\n                item = this.fields[item] = new Cls(cfg);\n            }\n            //this.add(item);\n            this.menu.add(item);\n        }\n    },\n\n    onCheckChange : function () {\n        this.setActive(this.isActivatable());\n        this.fireEvent('update', this);\n    },\n\n    /**  \n     * @private\n     * Handler method called when there is a keyup event on an input\n     * item of this menu.\n     */\n    onInputKeyUp : function (field, e) {\n        var k = e.getKey();\n        if (k == e.RETURN && field.isValid()) {\n            e.stopEvent();\n            this.menu.hide(true);\n            return;\n        }\n    },\n\n    /**\n     * Handler for when the menu for a field fires the 'select' event\n     * @param {Object} date\n     * @param {Object} menuItem\n     * @param {Object} value\n     * @param {Object} picker\n     */\n    onMenuSelect : function (menuItem, value, picker) {\n        var fields = this.fields,\n            field = this.fields[menuItem.itemId];\n        \n        field.setChecked(true);\n        \n        if (field == fields.on) {\n            fields.before.setChecked(false, true);\n            fields.after.setChecked(false, true);\n        } else {\n            fields.on.setChecked(false, true);\n            if (field == fields.after && fields.before.menu.picker.value < value) {\n                fields.before.setChecked(false, true);\n            } else if (field == fields.before && fields.after.menu.picker.value > value) {\n                fields.after.setChecked(false, true);\n            }\n        }\n        this.fireEvent('update', this);\n    },\n\n    /**\n     * @private\n     * Template method that is to get and return the value of the filter.\n     * @return {String} The value of this filter\n     */\n    getValue : function () {\n        var key, result = {};\n        for (key in this.fields) {\n            if (this.fields[key].checked) {\n                result[key] = this.fields[key].menu.picker.getValue();\n            }\n        }\n        return result;\n    },\n\n    /**\n     * @private\n     * Template method that is to set the value of the filter.\n     * @param {Object} value The value to set the filter\n     * @param {Boolean} preserve true to preserve the checked status\n     * of the other fields.  Defaults to false, unchecking the\n     * other fields\n     */\t\n    setValue : function (value, preserve) {\n        var key;\n        for (key in this.fields) {\n            if(value[key]){\n                this.fields[key].menu.picker.setValue(value[key]);\n                this.fields[key].setChecked(true);\n            } else if (!preserve) {\n                this.fields[key].setChecked(false);\n            }\n        }\n        this.fireEvent('update', this);\n    },\n\n    /**\n     * @private\n     * Template method that is to return <tt>true</tt> if the filter\n     * has enough configuration information to be activated.\n     * @return {Boolean}\n     */\n    isActivatable : function () {\n        var key;\n        for (key in this.fields) {\n            if (this.fields[key].checked) {\n                return true;\n            }\n        }\n        return false;\n    },\n\n    /**\n     * @private\n     * Template method that is to get and return serialized filter data for\n     * transmission to the server.\n     * @return {Object/Array} An object or collection of objects containing\n     * key value pairs representing the current configuration of the filter.\n     */\n    getSerialArgs : function () {\n        var args = [];\n        for (var key in this.fields) {\n            if(this.fields[key].checked){\n                args.push({\n                    type: 'date',\n                    comparison: this.compareMap[key],\n                    value: this.getFieldValue(key).format(this.dateFormat)\n                });\n            }\n        }\n        return args;\n    },\n\n    /**\n     * Get and return the date menu picker value\n     * @param {String} item The field identifier ('before', 'after', 'on')\n     * @return {Date} Gets the current selected value of the date field\n     */\n    getFieldValue : function(item){\n        return this.fields[item].menu.picker.getValue();\n    },\n    \n    /**\n     * Gets the menu picker associated with the passed field\n     * @param {String} item The field identifier ('before', 'after', 'on')\n     * @return {Object} The menu picker\n     */\n    getPicker : function(item){\n        return this.fields[item].menu.picker;\n    },\n\n    /**\n     * Template method that is to validate the provided Ext.data.Record\n     * against the filters configuration.\n     * @param {Ext.data.Record} record The record to validate\n     * @return {Boolean} true if the record is valid within the bounds\n     * of the filter, false otherwise.\n     */\n    validateRecord : function (record) {\n        var key,\n            pickerValue,\n            val = record.get(this.dataIndex);\n            \n        if(!Ext.isDate(val)){\n            return false;\n        }\n        val = val.clearTime(true).getTime();\n        \n        for (key in this.fields) {\n            if (this.fields[key].checked) {\n                pickerValue = this.getFieldValue(key).clearTime(true).getTime();\n                if (key == 'before' && pickerValue <= val) {\n                    return false;\n                }\n                if (key == 'after' && pickerValue >= val) {\n                    return false;\n                }\n                if (key == 'on' && pickerValue != val) {\n                    return false;\n                }\n            }\n        }\n        return true;\n    }\n});/** \n * @class Ext.ux.grid.filter.ListFilter\n * @extends Ext.ux.grid.filter.Filter\n * <p>List filters are able to be preloaded/backed by an Ext.data.Store to load\n * their options the first time they are shown. ListFilter utilizes the\n * {@link Ext.ux.menu.ListMenu} component.</p>\n * <p>Although not shown here, this class accepts all configuration options\n * for {@link Ext.ux.menu.ListMenu}.</p>\n * \n * <p><b><u>Example Usage:</u></b></p>\n * <pre><code>    \nvar filters = new Ext.ux.grid.GridFilters({\n    ...\n    filters: [{\n        type: 'list',\n        dataIndex: 'size',\n        phpMode: true,\n        // options will be used as data to implicitly creates an ArrayStore\n        options: ['extra small', 'small', 'medium', 'large', 'extra large']\n    }]\n});\n * </code></pre>\n * \n */\nExt.ux.grid.filter.ListFilter = Ext.extend(Ext.ux.grid.filter.Filter, {\n\n    /**\n     * @cfg {Array} options\n     * <p><code>data</code> to be used to implicitly create a data store\n     * to back this list when the data source is <b>local</b>. If the\n     * data for the list is remote, use the <code>{@link #store}</code>\n     * config instead.</p>\n     * <br><p>Each item within the provided array may be in one of the\n     * following formats:</p>\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>Array</b> :\n     * <pre><code>\noptions: [\n    [11, 'extra small'], \n    [18, 'small'],\n    [22, 'medium'],\n    [35, 'large'],\n    [44, 'extra large']\n]\n     * </code></pre>\n     * </li>\n     * <li><b>Object</b> :\n     * <pre><code>\nlabelField: 'name', // override default of 'text'\noptions: [\n    {id: 11, name:'extra small'}, \n    {id: 18, name:'small'}, \n    {id: 22, name:'medium'}, \n    {id: 35, name:'large'}, \n    {id: 44, name:'extra large'} \n]\n     * </code></pre>\n     * </li>\n     * <li><b>String</b> :\n     * <pre><code>\n     * options: ['extra small', 'small', 'medium', 'large', 'extra large']\n     * </code></pre>\n     * </li>\n     */\n    /**\n     * @cfg {Boolean} phpMode\n     * <p>Adjust the format of this filter. Defaults to false.</p>\n     * <br><p>When GridFilters <code>@cfg encode = false</code> (default):</p>\n     * <pre><code>\n// phpMode == false (default):\nfilter[0][data][type] list\nfilter[0][data][value] value1\nfilter[0][data][value] value2\nfilter[0][field] prod \n\n// phpMode == true:\nfilter[0][data][type] list\nfilter[0][data][value] value1, value2\nfilter[0][field] prod \n     * </code></pre>\n     * When GridFilters <code>@cfg encode = true</code>:\n     * <pre><code>\n// phpMode == false (default):\nfilter : [{\"type\":\"list\",\"value\":[\"small\",\"medium\"],\"field\":\"size\"}]\n\n// phpMode == true:\nfilter : [{\"type\":\"list\",\"value\":\"small,medium\",\"field\":\"size\"}]\n     * </code></pre>\n     */\n    phpMode : false,\n    /**\n     * @cfg {Ext.data.Store} store\n     * The {@link Ext.data.Store} this list should use as its data source\n     * when the data source is <b>remote</b>. If the data for the list\n     * is local, use the <code>{@link #options}</code> config instead.\n     */\n\n    /**  \n     * @private\n     * Template method that is to initialize the filter and install required menu items.\n     * @param {Object} config\n     */\n    init : function (config) {\n        this.dt = new Ext.util.DelayedTask(this.fireUpdate, this);\n\n        // if a menu already existed, do clean up first\n        if (this.menu){\n            this.menu.destroy();\n        }\n        this.menu = new Ext.ux.menu.ListMenu(config);\n        this.menu.on('checkchange', this.onCheckChange, this);\n    },\n    \n    /**\n     * @private\n     * Template method that is to get and return the value of the filter.\n     * @return {String} The value of this filter\n     */\n    getValue : function () {\n        return this.menu.getSelected();\n    },\n    /**\n     * @private\n     * Template method that is to set the value of the filter.\n     * @param {Object} value The value to set the filter\n     */\t\n    setValue : function (value) {\n        this.menu.setSelected(value);\n        this.fireEvent('update', this);\n    },\n\n    /**\n     * @private\n     * Template method that is to return <tt>true</tt> if the filter\n     * has enough configuration information to be activated.\n     * @return {Boolean}\n     */\n    isActivatable : function () {\n        return this.getValue().length > 0;\n    },\n    \n    /**\n     * @private\n     * Template method that is to get and return serialized filter data for\n     * transmission to the server.\n     * @return {Object/Array} An object or collection of objects containing\n     * key value pairs representing the current configuration of the filter.\n     */\n    getSerialArgs : function () {\n        var args = {type: 'list', value: this.phpMode ? this.getValue().join(',') : this.getValue()};\n        return args;\n    },\n\n    /** @private */\n    onCheckChange : function(){\n        this.dt.delay(this.updateBuffer);\n    },\n    \n    \n    /**\n     * Template method that is to validate the provided Ext.data.Record\n     * against the filters configuration.\n     * @param {Ext.data.Record} record The record to validate\n     * @return {Boolean} true if the record is valid within the bounds\n     * of the filter, false otherwise.\n     */\n    validateRecord : function (record) {\n        return this.getValue().indexOf(record.get(this.dataIndex)) > -1;\n    }\n});/** \n * @class Ext.ux.grid.filter.NumericFilter\n * @extends Ext.ux.grid.filter.Filter\n * Filters using an Ext.ux.menu.RangeMenu.\n * <p><b><u>Example Usage:</u></b></p>\n * <pre><code>    \nvar filters = new Ext.ux.grid.GridFilters({\n    ...\n    filters: [{\n        type: 'numeric',\n        dataIndex: 'price'\n    }]\n});\n * </code></pre> \n */\nExt.ux.grid.filter.NumericFilter = Ext.extend(Ext.ux.grid.filter.Filter, {\n\n    /**\n     * @cfg {Object} fieldCls\n     * The Class to use to construct each field item within this menu\n     * Defaults to:<pre>\n     * fieldCls : Ext.form.NumberField\n     * </pre>\n     */\n    fieldCls : Ext.form.NumberField,\n    /**\n     * @cfg {Object} fieldCfg\n     * The default configuration options for any field item unless superseded\n     * by the <code>{@link #fields}</code> configuration.\n     * Defaults to:<pre>\n     * fieldCfg : {}\n     * </pre>\n     * Example usage:\n     * <pre><code>\nfieldCfg : {\n    width: 150,\n},\n     * </code></pre>\n     */\n    /**\n     * @cfg {Object} fields\n     * The field items may be configured individually\n     * Defaults to <tt>undefined</tt>.\n     * Example usage:\n     * <pre><code>\nfields : {\n    gt: { // override fieldCfg options\n        width: 200,\n        fieldCls: Ext.ux.form.CustomNumberField // to override default {@link #fieldCls}\n    }\n},\n     * </code></pre>\n     */\n    /**\n     * @cfg {Object} iconCls\n     * The iconCls to be applied to each comparator field item.\n     * Defaults to:<pre>\niconCls : {\n    gt : 'ux-rangemenu-gt',\n    lt : 'ux-rangemenu-lt',\n    eq : 'ux-rangemenu-eq'\n}\n     * </pre>\n     */\n    iconCls : {\n        gt : 'ux-rangemenu-gt',\n        lt : 'ux-rangemenu-lt',\n        eq : 'ux-rangemenu-eq'\n    },\n\n    /**\n     * @cfg {Object} menuItemCfgs\n     * Default configuration options for each menu item\n     * Defaults to:<pre>\nmenuItemCfgs : {\n    emptyText: 'Enter Filter Text...',\n    selectOnFocus: true,\n    width: 125\n}\n     * </pre>\n     */\n    menuItemCfgs : {\n        emptyText: 'Enter Filter Text...',\n        selectOnFocus: true,\n        width: 125\n    },\n\n    /**\n     * @cfg {Array} menuItems\n     * The items to be shown in this menu.  Items are added to the menu\n     * according to their position within this array. Defaults to:<pre>\n     * menuItems : ['lt','gt','-','eq']\n     * </pre>\n     */\n    menuItems : ['lt', 'gt', '-', 'eq'],\n\n    /**  \n     * @private\n     * Template method that is to initialize the filter and install required menu items.\n     */\n    init : function (config) {\n        // if a menu already existed, do clean up first\n        if (this.menu){\n            this.menu.destroy();\n        }        \n        this.menu = new Ext.ux.menu.RangeMenu(Ext.apply(config, {\n            // pass along filter configs to the menu\n            fieldCfg : this.fieldCfg || {},\n            fieldCls : this.fieldCls,\n            fields : this.fields || {},\n            iconCls: this.iconCls,\n            menuItemCfgs: this.menuItemCfgs,\n            menuItems: this.menuItems,\n            updateBuffer: this.updateBuffer\n        }));\n        // relay the event fired by the menu\n        this.menu.on('update', this.fireUpdate, this);\n    },\n    \n    /**\n     * @private\n     * Template method that is to get and return the value of the filter.\n     * @return {String} The value of this filter\n     */\n    getValue : function () {\n        return this.menu.getValue();\n    },\n\n    /**\n     * @private\n     * Template method that is to set the value of the filter.\n     * @param {Object} value The value to set the filter\n     */\t\n    setValue : function (value) {\n        this.menu.setValue(value);\n    },\n\n    /**\n     * @private\n     * Template method that is to return <tt>true</tt> if the filter\n     * has enough configuration information to be activated.\n     * @return {Boolean}\n     */\n    isActivatable : function () {\n        var values = this.getValue();\n        for (key in values) {\n            if (values[key] !== undefined) {\n                return true;\n            }\n        }\n        return false;\n    },\n    \n    /**\n     * @private\n     * Template method that is to get and return serialized filter data for\n     * transmission to the server.\n     * @return {Object/Array} An object or collection of objects containing\n     * key value pairs representing the current configuration of the filter.\n     */\n    getSerialArgs : function () {\n        var key,\n            args = [],\n            values = this.menu.getValue();\n        for (key in values) {\n            args.push({\n                type: 'numeric',\n                comparison: key,\n                value: values[key]\n            });\n        }\n        return args;\n    },\n\n    /**\n     * Template method that is to validate the provided Ext.data.Record\n     * against the filters configuration.\n     * @param {Ext.data.Record} record The record to validate\n     * @return {Boolean} true if the record is valid within the bounds\n     * of the filter, false otherwise.\n     */\n    validateRecord : function (record) {\n        var val = record.get(this.dataIndex),\n            values = this.getValue();\n        if (values.eq !== undefined && val != values.eq) {\n            return false;\n        }\n        if (values.lt !== undefined && val >= values.lt) {\n            return false;\n        }\n        if (values.gt !== undefined && val <= values.gt) {\n            return false;\n        }\n        return true;\n    }\n});/** \n * @class Ext.ux.grid.filter.StringFilter\n * @extends Ext.ux.grid.filter.Filter\n * Filter by a configurable Ext.form.TextField\n * <p><b><u>Example Usage:</u></b></p>\n * <pre><code>    \nvar filters = new Ext.ux.grid.GridFilters({\n    ...\n    filters: [{\n        // required configs\n        type: 'string',\n        dataIndex: 'name',\n        \n        // optional configs\n        value: 'foo',\n        active: true, // default is false\n        iconCls: 'ux-gridfilter-text-icon' // default\n        // any Ext.form.TextField configs accepted\n    }]\n});\n * </code></pre>\n */\nExt.ux.grid.filter.StringFilter = Ext.extend(Ext.ux.grid.filter.Filter, {\n\n    /**\n     * @cfg {String} iconCls\n     * The iconCls to be applied to the menu item.\n     * Defaults to <tt>'ux-gridfilter-text-icon'</tt>.\n     */\n    iconCls : 'ux-gridfilter-text-icon',\n\n    emptyText: 'Enter Filter Text...',\n    selectOnFocus: true,\n    width: 125,\n    \n    /**  \n     * @private\n     * Template method that is to initialize the filter and install required menu items.\n     */\n    init : function (config) {\n        Ext.applyIf(config, {\n            enableKeyEvents: true,\n            iconCls: this.iconCls,\n            listeners: {\n                scope: this,\n                keyup: this.onInputKeyUp\n            }\n        });\n\n        this.inputItem = new Ext.form.TextField(config); \n        this.menu.add(this.inputItem);\n        this.updateTask = new Ext.util.DelayedTask(this.fireUpdate, this);\n    },\n    \n    /**\n     * @private\n     * Template method that is to get and return the value of the filter.\n     * @return {String} The value of this filter\n     */\n    getValue : function () {\n        return this.inputItem.getValue();\n    },\n    \n    /**\n     * @private\n     * Template method that is to set the value of the filter.\n     * @param {Object} value The value to set the filter\n     */\t\n    setValue : function (value) {\n        this.inputItem.setValue(value);\n        this.fireEvent('update', this);\n    },\n\n    /**\n     * @private\n     * Template method that is to return <tt>true</tt> if the filter\n     * has enough configuration information to be activated.\n     * @return {Boolean}\n     */\n    isActivatable : function () {\n        return this.inputItem.getValue().length > 0;\n    },\n\n    /**\n     * @private\n     * Template method that is to get and return serialized filter data for\n     * transmission to the server.\n     * @return {Object/Array} An object or collection of objects containing\n     * key value pairs representing the current configuration of the filter.\n     */\n    getSerialArgs : function () {\n        return {type: 'string', value: this.getValue()};\n    },\n\n    /**\n     * Template method that is to validate the provided Ext.data.Record\n     * against the filters configuration.\n     * @param {Ext.data.Record} record The record to validate\n     * @return {Boolean} true if the record is valid within the bounds\n     * of the filter, false otherwise.\n     */\n    validateRecord : function (record) {\n        var val = record.get(this.dataIndex);\n\n        if(typeof val != 'string') {\n            return (this.getValue().length === 0);\n        }\n\n        return val.toLowerCase().indexOf(this.getValue().toLowerCase()) > -1;\n    },\n    \n    /**  \n     * @private\n     * Handler method called when there is a keyup event on this.inputItem\n     */\n    onInputKeyUp : function (field, e) {\n        var k = e.getKey();\n        if (k == e.RETURN && field.isValid()) {\n            e.stopEvent();\n            this.menu.hide(true);\n            return;\n        }\n        // restart the timer\n        this.updateTask.delay(this.updateBuffer);\n    }\n});\nExt.namespace('Ext.ux.menu');\n\n/** \n * @class Ext.ux.menu.ListMenu\n * @extends Ext.menu.Menu\n * This is a supporting class for {@link Ext.ux.grid.filter.ListFilter}.\n * Although not listed as configuration options for this class, this class\n * also accepts all configuration options from {@link Ext.ux.grid.filter.ListFilter}.\n */\nExt.ux.menu.ListMenu = Ext.extend(Ext.menu.Menu, {\n    /**\n     * @cfg {String} labelField\n     * Defaults to 'text'.\n     */\n    labelField :  'text',\n    /**\n     * @cfg {String} paramPrefix\n     * Defaults to 'Loading...'.\n     */\n    loadingText : 'Loading...',\n    /**\n     * @cfg {Boolean} loadOnShow\n     * Defaults to true.\n     */\n    loadOnShow : true,\n    /**\n     * @cfg {Boolean} single\n     * Specify true to group all items in this list into a single-select\n     * radio button group. Defaults to false.\n     */\n    single : false,\n\n    constructor : function (cfg) {\n        this.selected = [];\n        this.addEvents(\n            /**\n             * @event checkchange\n             * Fires when there is a change in checked items from this list\n             * @param {Object} item Ext.menu.CheckItem\n             * @param {Object} checked The checked value that was set\n             */\n            'checkchange'\n        );\n      \n        Ext.ux.menu.ListMenu.superclass.constructor.call(this, cfg = cfg || {});\n    \n        if(!cfg.store && cfg.options){\n            var options = [];\n            for(var i=0, len=cfg.options.length; i<len; i++){\n                var value = cfg.options[i];\n                switch(Ext.type(value)){\n                    case 'array':  options.push(value); break;\n                    case 'object': options.push([value.id, value[this.labelField]]); break;\n                    case 'string': options.push([value, value]); break;\n                }\n            }\n            \n            this.store = new Ext.data.Store({\n                reader: new Ext.data.ArrayReader({id: 0}, ['id', this.labelField]),\n                data:   options,\n                listeners: {\n                    'load': this.onLoad,\n                    scope:  this\n                }\n            });\n            this.loaded = true;\n        } else {\n            this.add({text: this.loadingText, iconCls: 'loading-indicator'});\n            this.store.on('load', this.onLoad, this);\n        }\n    },\n\n    destroy : function () {\n        if (this.store) {\n            this.store.destroy();    \n        }\n        Ext.ux.menu.ListMenu.superclass.destroy.call(this);\n    },\n\n    /**\n     * Lists will initially show a 'loading' item while the data is retrieved from the store.\n     * In some cases the loaded data will result in a list that goes off the screen to the\n     * right (as placement calculations were done with the loading item). This adapter will\n     * allow show to be called with no arguments to show with the previous arguments and\n     * thus recalculate the width and potentially hang the menu from the left.\n     */\n    show : function () {\n        var lastArgs = null;\n        return function(){\n            if(arguments.length === 0){\n                Ext.ux.menu.ListMenu.superclass.show.apply(this, lastArgs);\n            } else {\n                lastArgs = arguments;\n                if (this.loadOnShow && !this.loaded) {\n                    this.store.load();\n                }\n                Ext.ux.menu.ListMenu.superclass.show.apply(this, arguments);\n            }\n        };\n    }(),\n    \n    /** @private */\n    onLoad : function (store, records) {\n        var visible = this.isVisible();\n        this.hide(false);\n        \n        this.removeAll(true);\n        \n        var gid = this.single ? Ext.id() : null;\n        for(var i=0, len=records.length; i<len; i++){\n            var item = new Ext.menu.CheckItem({\n                text:    records[i].get(this.labelField), \n                group:   gid,\n                checked: this.selected.indexOf(records[i].id) > -1,\n                hideOnClick: false});\n            \n            item.itemId = records[i].id;\n            item.on('checkchange', this.checkChange, this);\n                        \n            this.add(item);\n        }\n        \n        this.loaded = true;\n        \n        if (visible) {\n            this.show();\n        }\t\n        this.fireEvent('load', this, records);\n    },\n\n    /**\n     * Get the selected items.\n     * @return {Array} selected\n     */\n    getSelected : function () {\n        return this.selected;\n    },\n    \n    /** @private */\n    setSelected : function (value) {\n        value = this.selected = [].concat(value);\n\n        if (this.loaded) {\n            this.items.each(function(item){\n                item.setChecked(false, true);\n                for (var i = 0, len = value.length; i < len; i++) {\n                    if (item.itemId == value[i]) {\n                        item.setChecked(true, true);\n                    }\n                }\n            }, this);\n        }\n    },\n    \n    /**\n     * Handler for the 'checkchange' event from an check item in this menu\n     * @param {Object} item Ext.menu.CheckItem\n     * @param {Object} checked The checked value that was set\n     */\n    checkChange : function (item, checked) {\n        var value = [];\n        this.items.each(function(item){\n            if (item.checked) {\n                value.push(item.itemId);\n            }\n        },this);\n        this.selected = value;\n        \n        this.fireEvent('checkchange', item, checked);\n    }    \n});Ext.ns('Ext.ux.menu');\n\n/** \n * @class Ext.ux.menu.RangeMenu\n * @extends Ext.menu.Menu\n * Custom implementation of Ext.menu.Menu that has preconfigured\n * items for gt, lt, eq.\n * <p><b><u>Example Usage:</u></b></p>\n * <pre><code>    \n\n * </code></pre> \n */\nExt.ux.menu.RangeMenu = Ext.extend(Ext.menu.Menu, {\n\n    constructor : function (config) {\n\n        Ext.ux.menu.RangeMenu.superclass.constructor.call(this, config);\n\n        this.addEvents(\n            /**\n             * @event update\n             * Fires when a filter configuration has changed\n             * @param {Ext.ux.grid.filter.Filter} this The filter object.\n             */\n            'update'\n        );\n      \n        this.updateTask = new Ext.util.DelayedTask(this.fireUpdate, this);\n    \n        var i, len, item, cfg, Cls;\n\n        for (i = 0, len = this.menuItems.length; i < len; i++) {\n            item = this.menuItems[i];\n            if (item !== '-') {\n                // defaults\n                cfg = {\n                    itemId: 'range-' + item,\n                    enableKeyEvents: true,\n                    iconCls: this.iconCls[item] || 'no-icon',\n                    listeners: {\n                        scope: this,\n                        keyup: this.onInputKeyUp\n                    }\n                };\n                Ext.apply(\n                    cfg,\n                    // custom configs\n                    Ext.applyIf(this.fields[item] || {}, this.fieldCfg[item]),\n                    // configurable defaults\n                    this.menuItemCfgs\n                );\n                Cls = cfg.fieldCls || this.fieldCls;\n                item = this.fields[item] = new Cls(cfg);\n            }\n            this.add(item);\n        }\n    },\n\n    /**\n     * @private\n     * called by this.updateTask\n     */\n    fireUpdate : function () {\n        this.fireEvent('update', this);\n    },\n    \n    /**\n     * Get and return the value of the filter.\n     * @return {String} The value of this filter\n     */\n    getValue : function () {\n        var result = {}, key, field;\n        for (key in this.fields) {\n            field = this.fields[key];\n            if (field.isValid() && String(field.getValue()).length > 0) {\n                result[key] = field.getValue();\n            }\n        }\n        return result;\n    },\n  \n    /**\n     * Set the value of this menu and fires the 'update' event.\n     * @param {Object} data The data to assign to this menu\n     */\t\n    setValue : function (data) {\n        var key;\n        for (key in this.fields) {\n            this.fields[key].setValue(data[key] !== undefined ? data[key] : '');\n        }\n        this.fireEvent('update', this);\n    },\n\n    /**  \n     * @private\n     * Handler method called when there is a keyup event on an input\n     * item of this menu.\n     */\n    onInputKeyUp : function (field, e) {\n        var k = e.getKey();\n        if (k == e.RETURN && field.isValid()) {\n            e.stopEvent();\n            this.hide(true);\n            return;\n        }\n        \n        if (field == this.fields.eq) {\n            if (this.fields.gt) {\n                this.fields.gt.setValue(null);\n            }\n            if (this.fields.lt) {\n                this.fields.lt.setValue(null);\n            }\n        }\n        else {\n            this.fields.eq.setValue(null);\n        }\n        \n        // restart the timer\n        this.updateTask.delay(this.updateBuffer);\n    }\n});\nExt.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.GroupSummary\n * @extends Ext.util.Observable\n * A GridPanel plugin that enables dynamic column calculations and a dynamically\n * updated grouped summary row.\n */\nExt.ux.grid.GroupSummary = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Function} summaryRenderer Renderer example:<pre><code>\nsummaryRenderer: function(v, params, data){\n    return ((v === 0 || v > 1) ? '(' + v +' Tasks)' : '(1 Task)');\n},\n     * </code></pre>\n     */\n    /**\n     * @cfg {String} summaryType (Optional) The type of\n     * calculation to be used for the column.  For options available see\n     * {@link #Calculations}.\n     */\n\n    constructor : function(config){\n        Ext.apply(this, config);\n        Ext.ux.grid.GroupSummary.superclass.constructor.call(this);\n    },\n    init : function(grid){\n        this.grid = grid;\n        var v = this.view = grid.getView();\n        v.doGroupEnd = this.doGroupEnd.createDelegate(this);\n\n        v.afterMethod('onColumnWidthUpdated', this.doWidth, this);\n        v.afterMethod('onAllColumnWidthsUpdated', this.doAllWidths, this);\n        v.afterMethod('onColumnHiddenUpdated', this.doHidden, this);\n        v.afterMethod('onUpdate', this.doUpdate, this);\n        v.afterMethod('onRemove', this.doRemove, this);\n\n        if(!this.rowTpl){\n            this.rowTpl = new Ext.Template(\n                '<div class=\"x-grid3-summary-row\" style=\"{tstyle}\">',\n                '<table class=\"x-grid3-summary-table\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\" style=\"{tstyle}\">',\n                    '<tbody><tr>{cells}</tr></tbody>',\n                '</table></div>'\n            );\n            this.rowTpl.disableFormats = true;\n        }\n        this.rowTpl.compile();\n\n        if(!this.cellTpl){\n            this.cellTpl = new Ext.Template(\n                '<td class=\"x-grid3-col x-grid3-cell x-grid3-td-{id} {css}\" style=\"{style}\">',\n                '<div class=\"x-grid3-cell-inner x-grid3-col-{id}\" unselectable=\"on\">{value}</div>',\n                \"</td>\"\n            );\n            this.cellTpl.disableFormats = true;\n        }\n        this.cellTpl.compile();\n    },\n\n    /**\n     * Toggle the display of the summary row on/off\n     * @param {Boolean} visible <tt>true</tt> to show the summary, <tt>false</tt> to hide the summary.\n     */\n    toggleSummaries : function(visible){\n        var el = this.grid.getGridEl();\n        if(el){\n            if(visible === undefined){\n                visible = el.hasClass('x-grid-hide-summary');\n            }\n            el[visible ? 'removeClass' : 'addClass']('x-grid-hide-summary');\n        }\n    },\n\n    renderSummary : function(o, cs){\n        cs = cs || this.view.getColumnData();\n        var cfg = this.grid.getColumnModel().config,\n            buf = [], c, p = {}, cf, last = cs.length-1;\n        for(var i = 0, len = cs.length; i < len; i++){\n            c = cs[i];\n            cf = cfg[i];\n            p.id = c.id;\n            p.style = c.style;\n            p.css = i == 0 ? 'x-grid3-cell-first ' : (i == last ? 'x-grid3-cell-last ' : '');\n            if(cf.summaryType || cf.summaryRenderer){\n                p.value = (cf.summaryRenderer || c.renderer)(o.data[c.name], p, o);\n            }else{\n                p.value = '';\n            }\n            if(p.value == undefined || p.value === \"\") p.value = \"&#160;\";\n            buf[buf.length] = this.cellTpl.apply(p);\n        }\n\n        return this.rowTpl.apply({\n            tstyle: 'width:'+this.view.getTotalWidth()+';',\n            cells: buf.join('')\n        });\n    },\n\n    /**\n     * @private\n     * @param {Object} rs\n     * @param {Object} cs\n     */\n    calculate : function(rs, cs){\n        var data = {}, r, c, cfg = this.grid.getColumnModel().config, cf;\n        for(var j = 0, jlen = rs.length; j < jlen; j++){\n            r = rs[j];\n            for(var i = 0, len = cs.length; i < len; i++){\n                c = cs[i];\n                cf = cfg[i];\n                if(cf.summaryType){\n                    data[c.name] = Ext.ux.grid.GroupSummary.Calculations[cf.summaryType](data[c.name] || 0, r, c.name, data);\n                }\n            }\n        }\n        return data;\n    },\n\n    doGroupEnd : function(buf, g, cs, ds, colCount){\n        var data = this.calculate(g.rs, cs);\n        buf.push('</div>', this.renderSummary({data: data}, cs), '</div>');\n    },\n\n    doWidth : function(col, w, tw){\n        if(!this.isGrouped()){\n            return;\n        }\n        var gs = this.view.getGroups(),\n            len = gs.length,\n            i = 0,\n            s;\n        for(; i < len; ++i){\n            s = gs[i].childNodes[2];\n            s.style.width = tw;\n            s.firstChild.style.width = tw;\n            s.firstChild.rows[0].childNodes[col].style.width = w;\n        }\n    },\n\n    doAllWidths : function(ws, tw){\n        if(!this.isGrouped()){\n            return;\n        }\n        var gs = this.view.getGroups(),\n            len = gs.length,\n            i = 0,\n            j, \n            s, \n            cells, \n            wlen = ws.length;\n            \n        for(; i < len; i++){\n            s = gs[i].childNodes[2];\n            s.style.width = tw;\n            s.firstChild.style.width = tw;\n            cells = s.firstChild.rows[0].childNodes;\n            for(j = 0; j < wlen; j++){\n                cells[j].style.width = ws[j];\n            }\n        }\n    },\n\n    doHidden : function(col, hidden, tw){\n        if(!this.isGrouped()){\n            return;\n        }\n        var gs = this.view.getGroups(),\n            len = gs.length,\n            i = 0,\n            s, \n            display = hidden ? 'none' : '';\n        for(; i < len; i++){\n            s = gs[i].childNodes[2];\n            s.style.width = tw;\n            s.firstChild.style.width = tw;\n            s.firstChild.rows[0].childNodes[col].style.display = display;\n        }\n    },\n    \n    isGrouped : function(){\n        return !Ext.isEmpty(this.grid.getStore().groupField);\n    },\n\n    // Note: requires that all (or the first) record in the\n    // group share the same group value. Returns false if the group\n    // could not be found.\n    refreshSummary : function(groupValue){\n        return this.refreshSummaryById(this.view.getGroupId(groupValue));\n    },\n\n    getSummaryNode : function(gid){\n        var g = Ext.fly(gid, '_gsummary');\n        if(g){\n            return g.down('.x-grid3-summary-row', true);\n        }\n        return null;\n    },\n\n    refreshSummaryById : function(gid){\n        var g = Ext.getDom(gid);\n        if(!g){\n            return false;\n        }\n        var rs = [];\n        this.grid.getStore().each(function(r){\n            if(r._groupId == gid){\n                rs[rs.length] = r;\n            }\n        });\n        var cs = this.view.getColumnData(),\n            data = this.calculate(rs, cs),\n            markup = this.renderSummary({data: data}, cs),\n            existing = this.getSummaryNode(gid);\n            \n        if(existing){\n            g.removeChild(existing);\n        }\n        Ext.DomHelper.append(g, markup);\n        return true;\n    },\n\n    doUpdate : function(ds, record){\n        this.refreshSummaryById(record._groupId);\n    },\n\n    doRemove : function(ds, record, index, isUpdate){\n        if(!isUpdate){\n            this.refreshSummaryById(record._groupId);\n        }\n    },\n\n    /**\n     * Show a message in the summary row.\n     * <pre><code>\ngrid.on('afteredit', function(){\n    var groupValue = 'Ext Forms: Field Anchoring';\n    summary.showSummaryMsg(groupValue, 'Updating Summary...');\n});\n     * </code></pre>\n     * @param {String} groupValue\n     * @param {String} msg Text to use as innerHTML for the summary row.\n     */\n    showSummaryMsg : function(groupValue, msg){\n        var gid = this.view.getGroupId(groupValue),\n             node = this.getSummaryNode(gid);\n        if(node){\n            node.innerHTML = '<div class=\"x-grid3-summary-msg\">' + msg + '</div>';\n        }\n    }\n});\n\n//backwards compat\nExt.grid.GroupSummary = Ext.ux.grid.GroupSummary;\n\n\n/**\n * Calculation types for summary row:</p><div class=\"mdetail-params\"><ul>\n * <li><b><tt>sum</tt></b> : <div class=\"sub-desc\"></div></li>\n * <li><b><tt>count</tt></b> : <div class=\"sub-desc\"></div></li>\n * <li><b><tt>max</tt></b> : <div class=\"sub-desc\"></div></li>\n * <li><b><tt>min</tt></b> : <div class=\"sub-desc\"></div></li>\n * <li><b><tt>average</tt></b> : <div class=\"sub-desc\"></div></li>\n * </ul></div>\n * <p>Custom calculations may be implemented.  An example of\n * custom <code>summaryType=totalCost</code>:</p><pre><code>\n// define a custom summary function\nExt.ux.grid.GroupSummary.Calculations['totalCost'] = function(v, record, field){\n    return v + (record.data.estimate * record.data.rate);\n};\n * </code></pre>\n * @property Calculations\n */\n\nExt.ux.grid.GroupSummary.Calculations = {\n    'sum' : function(v, record, field){\n        return v + (record.data[field]||0);\n    },\n\n    'count' : function(v, record, field, data){\n        return data[field+'count'] ? ++data[field+'count'] : (data[field+'count'] = 1);\n    },\n\n    'max' : function(v, record, field, data){\n        var v = record.data[field];\n        var max = data[field+'max'] === undefined ? (data[field+'max'] = v) : data[field+'max'];\n        return v > max ? (data[field+'max'] = v) : max;\n    },\n\n    'min' : function(v, record, field, data){\n        var v = record.data[field];\n        var min = data[field+'min'] === undefined ? (data[field+'min'] = v) : data[field+'min'];\n        return v < min ? (data[field+'min'] = v) : min;\n    },\n\n    'average' : function(v, record, field, data){\n        var c = data[field+'count'] ? ++data[field+'count'] : (data[field+'count'] = 1);\n        var t = (data[field+'total'] = ((data[field+'total']||0) + (record.data[field]||0)));\n        return t === 0 ? 0 : t / c;\n    }\n};\nExt.grid.GroupSummary.Calculations = Ext.ux.grid.GroupSummary.Calculations;\n\n/**\n * @class Ext.ux.grid.HybridSummary\n * @extends Ext.ux.grid.GroupSummary\n * Adds capability to specify the summary data for the group via json as illustrated here:\n * <pre><code>\n{\n    data: [\n        {\n            projectId: 100,     project: 'House',\n            taskId:    112, description: 'Paint',\n            estimate:    6,        rate:     150,\n            due:'06/24/2007'\n        },\n        ...\n    ],\n\n    summaryData: {\n        'House': {\n            description: 14, estimate: 9,\n                   rate: 99, due: new Date(2009, 6, 29),\n                   cost: 999\n        }\n    }\n}\n * </code></pre>\n *\n */\nExt.ux.grid.HybridSummary = Ext.extend(Ext.ux.grid.GroupSummary, {\n    /**\n     * @private\n     * @param {Object} rs\n     * @param {Object} cs\n     */\n    calculate : function(rs, cs){\n        var gcol = this.view.getGroupField(),\n            gvalue = rs[0].data[gcol],\n            gdata = this.getSummaryData(gvalue);\n        return gdata || Ext.ux.grid.HybridSummary.superclass.calculate.call(this, rs, cs);\n    },\n\n    /**\n     * <pre><code>\ngrid.on('afteredit', function(){\n    var groupValue = 'Ext Forms: Field Anchoring';\n    summary.showSummaryMsg(groupValue, 'Updating Summary...');\n    setTimeout(function(){ // simulate server call\n        // HybridSummary class implements updateSummaryData\n        summary.updateSummaryData(groupValue,\n            // create data object based on configured dataIndex\n            {description: 22, estimate: 888, rate: 888, due: new Date(), cost: 8});\n    }, 2000);\n});\n     * </code></pre>\n     * @param {String} groupValue\n     * @param {Object} data data object\n     * @param {Boolean} skipRefresh (Optional) Defaults to false\n     */\n    updateSummaryData : function(groupValue, data, skipRefresh){\n        var json = this.grid.getStore().reader.jsonData;\n        if(!json.summaryData){\n            json.summaryData = {};\n        }\n        json.summaryData[groupValue] = data;\n        if(!skipRefresh){\n            this.refreshSummary(groupValue);\n        }\n    },\n\n    /**\n     * Returns the summaryData for the specified groupValue or null.\n     * @param {String} groupValue\n     * @return {Object} summaryData\n     */\n    getSummaryData : function(groupValue){\n        var reader = this.grid.getStore().reader,\n            json = reader.jsonData,\n            fields = reader.recordType.prototype.fields,\n            v;\n            \n        if(json && json.summaryData){\n            v = json.summaryData[groupValue];\n            if(v){\n                return reader.extractValues(v, fields.items, fields.length);\n            }\n        }\n        return null;\n    }\n});\n\n//backwards compat\nExt.grid.HybridSummary = Ext.ux.grid.HybridSummary;\nExt.ux.GroupTab = Ext.extend(Ext.Container, {\n    mainItem: 0,\n    \n    expanded: true,\n    \n    deferredRender: true,\n    \n    activeTab: null,\n    \n    idDelimiter: '__',\n    \n    headerAsText: false,\n    \n    frame: false,\n    \n    hideBorders: true,\n    \n    initComponent: function(config){\n        Ext.apply(this, config);\n        this.frame = false;\n        \n        Ext.ux.GroupTab.superclass.initComponent.call(this);\n        \n        this.addEvents('activate', 'deactivate', 'changemainitem', 'beforetabchange', 'tabchange');\n        \n        this.setLayout(new Ext.layout.CardLayout({\n            deferredRender: this.deferredRender\n        }));\n        \n        if (!this.stack) {\n            this.stack = Ext.TabPanel.AccessStack();\n        }\n        \n        this.initItems();\n        \n        this.on('beforerender', function(){\n            this.groupEl = this.ownerCt.getGroupEl(this);\n        }, this);\n        \n        this.on('add', this.onAdd, this, {\n            target: this\n        });\n        this.on('remove', this.onRemove, this, {\n            target: this\n        });\n        \n        if (this.mainItem !== undefined) {\n            var item = (typeof this.mainItem == 'object') ? this.mainItem : this.items.get(this.mainItem);\n            delete this.mainItem;\n            this.setMainItem(item);\n        }\n    },\n    \n    /**\n     * Sets the specified tab as the active tab. This method fires the {@link #beforetabchange} event which\n     * can return false to cancel the tab change.\n     * @param {String/Panel} tab The id or tab Panel to activate\n     */\n    setActiveTab : function(item){\n        item = this.getComponent(item);\n        if(!item){\n            return false;\n        }\n        if(!this.rendered){\n            this.activeTab = item;\n            return true;\n        }\n        if(this.activeTab != item && this.fireEvent('beforetabchange', this, item, this.activeTab) !== false){\n            if(this.activeTab && this.activeTab != this.mainItem){\n                var oldEl = this.getTabEl(this.activeTab);\n                if(oldEl){\n                    Ext.fly(oldEl).removeClass('x-grouptabs-strip-active');\n                }\n            }\n            var el = this.getTabEl(item);\n            Ext.fly(el).addClass('x-grouptabs-strip-active');\n            this.activeTab = item;\n            this.stack.add(item);\n\n            this.layout.setActiveItem(item);\n            if(this.layoutOnTabChange && item.doLayout){\n                item.doLayout();\n            }\n            if(this.scrolling){\n                this.scrollToTab(item, this.animScroll);\n            }\n\n            this.fireEvent('tabchange', this, item);\n            return true;\n        }\n        return false;\n    },\n    \n    getTabEl: function(item){\n        if (item == this.mainItem) {\n            return this.groupEl;\n        }\n        return Ext.TabPanel.prototype.getTabEl.call(this, item);\n    },\n    \n    onRender: function(ct, position){\n        Ext.ux.GroupTab.superclass.onRender.call(this, ct, position);\n        \n        this.strip = Ext.fly(this.groupEl).createChild({\n            tag: 'ul',\n            cls: 'x-grouptabs-sub'\n        });\n\n        this.tooltip = new Ext.ToolTip({\n           target: this.groupEl,\n           delegate: 'a.x-grouptabs-text',\n           trackMouse: true,\n           renderTo: document.body,\n           listeners: {\n               beforeshow: function(tip) {\n                   var item = (tip.triggerElement.parentNode === this.mainItem.tabEl)\n                       ? this.mainItem\n                       : this.findById(tip.triggerElement.parentNode.id.split(this.idDelimiter)[1]);\n\n                   if(!item.tabTip) {\n                       return false;\n                   }\n                   tip.body.dom.innerHTML = item.tabTip;\n               },\n               scope: this\n           }\n        });\n                \n        if (!this.itemTpl) {\n            var tt = new Ext.Template('<li class=\"{cls}\" id=\"{id}\">', '<a onclick=\"return false;\" class=\"x-grouptabs-text {iconCls}\">{text}</a>', '</li>');\n            tt.disableFormats = true;\n            tt.compile();\n            Ext.ux.GroupTab.prototype.itemTpl = tt;\n        }\n        \n        this.items.each(this.initTab, this);\n    },\n    \n    afterRender: function(){\n        Ext.ux.GroupTab.superclass.afterRender.call(this);\n        \n        if (this.activeTab !== undefined) {\n            var item = (typeof this.activeTab == 'object') ? this.activeTab : this.items.get(this.activeTab);\n            delete this.activeTab;\n            this.setActiveTab(item);\n        }\n    },\n    \n    // private\n    initTab: function(item, index){\n        var before = this.strip.dom.childNodes[index];\n        var p = Ext.TabPanel.prototype.getTemplateArgs.call(this, item);\n        \n        if (item === this.mainItem) {\n            item.tabEl = this.groupEl;\n            p.cls += ' x-grouptabs-main-item';\n        }\n        \n        var el = before ? this.itemTpl.insertBefore(before, p) : this.itemTpl.append(this.strip, p);\n        \n        item.tabEl = item.tabEl || el;\n                \n        item.on('disable', this.onItemDisabled, this);\n        item.on('enable', this.onItemEnabled, this);\n        item.on('titlechange', this.onItemTitleChanged, this);\n        item.on('iconchange', this.onItemIconChanged, this);\n        item.on('beforeshow', this.onBeforeShowItem, this);\n    },\n    \n    setMainItem: function(item){\n        item = this.getComponent(item);\n        if (!item || this.fireEvent('changemainitem', this, item, this.mainItem) === false) {\n            return;\n        }\n        \n        this.mainItem = item;\n    },\n    \n    getMainItem: function(){\n        return this.mainItem || null;\n    },\n    \n    // private\n    onBeforeShowItem: function(item){\n        if (item != this.activeTab) {\n            this.setActiveTab(item);\n            return false;\n        }\n    },\n    \n    // private\n    onAdd: function(gt, item, index){\n        if (this.rendered) {\n            this.initTab.call(this, item, index);\n        }\n    },\n    \n    // private\n    onRemove: function(tp, item){\n        Ext.destroy(Ext.get(this.getTabEl(item)));\n        this.stack.remove(item);\n        item.un('disable', this.onItemDisabled, this);\n        item.un('enable', this.onItemEnabled, this);\n        item.un('titlechange', this.onItemTitleChanged, this);\n        item.un('iconchange', this.onItemIconChanged, this);\n        item.un('beforeshow', this.onBeforeShowItem, this);\n        if (item == this.activeTab) {\n            var next = this.stack.next();\n            if (next) {\n                this.setActiveTab(next);\n            }\n            else if (this.items.getCount() > 0) {\n                this.setActiveTab(0);\n            }\n            else {\n                this.activeTab = null;\n            }\n        }\n    },\n    \n    // private\n    onBeforeAdd: function(item){\n        var existing = item.events ? (this.items.containsKey(item.getItemId()) ? item : null) : this.items.get(item);\n        if (existing) {\n            this.setActiveTab(item);\n            return false;\n        }\n        Ext.TabPanel.superclass.onBeforeAdd.apply(this, arguments);\n        var es = item.elements;\n        item.elements = es ? es.replace(',header', '') : es;\n        item.border = (item.border === true);\n    },\n    \n    // private\n    onItemDisabled: Ext.TabPanel.prototype.onItemDisabled,\n    onItemEnabled: Ext.TabPanel.prototype.onItemEnabled,\n    \n    // private\n    onItemTitleChanged: function(item){\n        var el = this.getTabEl(item);\n        if (el) {\n            Ext.fly(el).child('a.x-grouptabs-text', true).innerHTML = item.title;\n        }\n    },\n    \n    //private\n    onItemIconChanged: function(item, iconCls, oldCls){\n        var el = this.getTabEl(item);\n        if (el) {\n            Ext.fly(el).child('a.x-grouptabs-text').replaceClass(oldCls, iconCls);\n        }\n    },\n    \n    beforeDestroy: function(){\n        Ext.TabPanel.prototype.beforeDestroy.call(this);\n        this.tooltip.destroy();\n    }\n});\n\nExt.reg('grouptab', Ext.ux.GroupTab);\nExt.ns('Ext.ux');\n\nExt.ux.GroupTabPanel = Ext.extend(Ext.TabPanel, {\n    tabPosition: 'left',\n\n    alternateColor: false,\n\n    alternateCls: 'x-grouptabs-panel-alt',\n\n    defaultType: 'grouptab',\n\n    deferredRender: false,\n\n    activeGroup : null,\n\n    initComponent: function(){\n        Ext.ux.GroupTabPanel.superclass.initComponent.call(this);\n        \n        this.addEvents(\n            'beforegroupchange',\n            'groupchange'\n        );\n        this.elements = 'body,header';\n        this.stripTarget = 'header';\n\n        this.tabPosition = this.tabPosition == 'right' ? 'right' : 'left';\n\n        this.addClass('x-grouptabs-panel');\n\n        if (this.tabStyle && this.tabStyle != '') {\n            this.addClass('x-grouptabs-panel-' + this.tabStyle);\n        }\n\n        if (this.alternateColor) {\n            this.addClass(this.alternateCls);\n        }\n\n        this.on('beforeadd', function(gtp, item, index){\n            this.initGroup(item, index);\n        });\n        this.items.each(function(item){\n            item.on('tabchange',function(item){\n                this.fireEvent('tabchange', this, item.activeTab);\n            }, this);\n        },this);\n    },\n\n    initEvents : function() {\n        this.mon(this.strip, 'mousedown', this.onStripMouseDown, this);\n    },\n\n    onRender: function(ct, position){\n        Ext.TabPanel.superclass.onRender.call(this, ct, position);\n        if(this.plain){\n            var pos = this.tabPosition == 'top' ? 'header' : 'footer';\n            this[pos].addClass('x-tab-panel-'+pos+'-plain');\n        }\n\n        var st = this[this.stripTarget];\n\n        this.stripWrap = st.createChild({cls:'x-tab-strip-wrap ', cn:{\n            tag:'ul', cls:'x-grouptabs-strip x-grouptabs-tab-strip-'+this.tabPosition}});\n\n        var beforeEl = (this.tabPosition=='bottom' ? this.stripWrap : null);\n        this.strip = new Ext.Element(this.stripWrap.dom.firstChild);\n\n        this.header.addClass('x-grouptabs-panel-header');\n        this.bwrap.addClass('x-grouptabs-bwrap');\n        this.body.addClass('x-tab-panel-body-'+this.tabPosition + ' x-grouptabs-panel-body');\n\n        if (!this.groupTpl) {\n            var tt = new Ext.Template(\n                '<li class=\"{cls}\" id=\"{id}\">',\n                '<a class=\"x-grouptabs-expand\" onclick=\"return false;\"></a>',\n                '<a class=\"x-grouptabs-text {iconCls}\" href=\"#\" onclick=\"return false;\">',\n                '<span>{text}</span></a>',\n                '</li>'\n            );\n            tt.disableFormats = true;\n            tt.compile();\n            Ext.ux.GroupTabPanel.prototype.groupTpl = tt;\n        }\n        this.items.each(this.initGroup, this);\n    },\n\n    afterRender: function(){\n        Ext.ux.GroupTabPanel.superclass.afterRender.call(this);\n\n        this.tabJoint = Ext.fly(this.body.dom.parentNode).createChild({\n            cls: 'x-tab-joint'\n        });\n\n        this.addClass('x-tab-panel-' + this.tabPosition);\n        this.header.setWidth(this.tabWidth);\n\n        if (this.activeGroup !== undefined) {\n            var group = (typeof this.activeGroup == 'object') ? this.activeGroup : this.items.get(this.activeGroup);\n            delete this.activeGroup;\n            this.setActiveGroup(group);\n            group.setActiveTab(group.getMainItem());\n        }\n    },\n\n    getGroupEl : Ext.TabPanel.prototype.getTabEl,\n\n    // private\n    findTargets: function(e){\n        var item = null,\n            itemEl = e.getTarget('li', this.strip);\n        if (itemEl) {\n            item = this.findById(itemEl.id.split(this.idDelimiter)[1]);\n            if (item.disabled) {\n                return {\n                    expand: null,\n                    item: null,\n                    el: null\n                };\n            }\n        }\n        return {\n            expand: e.getTarget('.x-grouptabs-expand', this.strip),\n            isGroup: !e.getTarget('ul.x-grouptabs-sub', this.strip),\n            item: item,\n            el: itemEl\n        };\n    },\n\n    // private\n    onStripMouseDown: function(e){\n        if (e.button != 0) {\n            return;\n        }\n        e.preventDefault();\n        var t = this.findTargets(e);\n        if (t.expand) {\n            this.toggleGroup(t.el);\n        }\n        else if (t.item) {\n            if(t.isGroup) {\n                t.item.setActiveTab(t.item.getMainItem());\n            }\n            else {\n                t.item.ownerCt.setActiveTab(t.item);\n            }\n        }\n    },\n\n    expandGroup: function(groupEl){\n        if(groupEl.isXType) {\n            groupEl = this.getGroupEl(groupEl);\n        }\n        Ext.fly(groupEl).addClass('x-grouptabs-expanded');\n        this.syncTabJoint();\n    },\n\n    toggleGroup: function(groupEl){\n        if(groupEl.isXType) {\n            groupEl = this.getGroupEl(groupEl);\n        }\n        Ext.fly(groupEl).toggleClass('x-grouptabs-expanded');\n        this.syncTabJoint();\n    },\n\n    collapseGroup: function(groupEl){\n        if(groupEl.isXType) {\n            groupEl = this.getGroupEl(groupEl);\n        }\n        Ext.fly(groupEl).removeClass('x-grouptabs-expanded');\n        this.syncTabJoint();\n    },\n\n    syncTabJoint: function(groupEl){\n        if (!this.tabJoint) {\n            return;\n        }\n\n        groupEl = groupEl || this.getGroupEl(this.activeGroup);\n        if(groupEl) {\n            this.tabJoint.setHeight(Ext.fly(groupEl).getHeight() - 2);\n\n            var y = Ext.isGecko2 ? 0 : 1;\n            if (this.tabPosition == 'left'){\n                this.tabJoint.alignTo(groupEl, 'tl-tr', [-2,y]);\n            }\n            else {\n                this.tabJoint.alignTo(groupEl, 'tr-tl', [1,y]);\n            }\n        }\n        else {\n            this.tabJoint.hide();\n        }\n    },\n\n    getActiveTab : function() {\n        if(!this.activeGroup) return null;\n        return this.activeGroup.getTabEl(this.activeGroup.activeTab) || null;\n    },\n\n    onResize: function(){\n        Ext.ux.GroupTabPanel.superclass.onResize.apply(this, arguments);\n        this.syncTabJoint();\n    },\n\n    createCorner: function(el, pos){\n        return Ext.fly(el).createChild({\n            cls: 'x-grouptabs-corner x-grouptabs-corner-' + pos\n        });\n    },\n\n    initGroup: function(group, index){\n        var before = this.strip.dom.childNodes[index],\n            p = this.getTemplateArgs(group);\n        if (index === 0) {\n            p.cls += ' x-tab-first';\n        }\n        p.cls += ' x-grouptabs-main';\n        p.text = group.getMainItem().title;\n\n        var el = before ? this.groupTpl.insertBefore(before, p) : this.groupTpl.append(this.strip, p),\n            tl = this.createCorner(el, 'top-' + this.tabPosition),\n            bl = this.createCorner(el, 'bottom-' + this.tabPosition);\n\n        group.tabEl = el;\n        if (group.expanded) {\n            this.expandGroup(el);\n        }\n\n        if (Ext.isIE6 || (Ext.isIE && !Ext.isStrict)){\n            bl.setLeft('-10px');\n            bl.setBottom('-5px');\n            tl.setLeft('-10px');\n            tl.setTop('-5px');\n        }\n\n        this.mon(group, {\n            scope: this,\n            changemainitem: this.onGroupChangeMainItem,\n            beforetabchange: this.onGroupBeforeTabChange\n        });\n    },\n\n    setActiveGroup : function(group) {\n        group = this.getComponent(group);\n        if(!group){\n            return false;\n        }\n        if(!this.rendered){\n            this.activeGroup = group;\n            return true;\n        }\n        if(this.activeGroup != group && this.fireEvent('beforegroupchange', this, group, this.activeGroup) !== false){\n            if(this.activeGroup){\n                this.activeGroup.activeTab = null;\n                var oldEl = this.getGroupEl(this.activeGroup);\n                if(oldEl){\n                    Ext.fly(oldEl).removeClass('x-grouptabs-strip-active');\n                }\n            }\n\n            var groupEl = this.getGroupEl(group);\n            Ext.fly(groupEl).addClass('x-grouptabs-strip-active');\n\n            this.activeGroup = group;\n            this.stack.add(group);\n\n            this.layout.setActiveItem(group);\n            this.syncTabJoint(groupEl);\n\n            this.fireEvent('groupchange', this, group);\n            return true;\n        }\n        return false;\n    },\n\n    onGroupBeforeTabChange: function(group, newTab, oldTab){\n        if(group !== this.activeGroup || newTab !== oldTab) {\n            this.strip.select('.x-grouptabs-sub > li.x-grouptabs-strip-active', true).removeClass('x-grouptabs-strip-active');\n        }\n        this.expandGroup(this.getGroupEl(group));\n        if(group !== this.activeGroup) {\n            return this.setActiveGroup(group);\n        }\n    },\n\n    getFrameHeight: function(){\n        var h = this.el.getFrameWidth('tb');\n        h += (this.tbar ? this.tbar.getHeight() : 0) +\n        (this.bbar ? this.bbar.getHeight() : 0);\n\n        return h;\n    },\n\n    adjustBodyWidth: function(w){\n        return w - this.tabWidth;\n    }\n});\n\nExt.reg('grouptabpanel', Ext.ux.GroupTabPanel);\n/*\n * Note that this control will most likely remain as an example, and not as a core Ext form\n * control.  However, the API will be changing in a future release and so should not yet be\n * treated as a final, stable API at this time.\n */\n\n/**\n * @class Ext.ux.form.ItemSelector\n * @extends Ext.form.Field\n * A control that allows selection of between two Ext.ux.form.MultiSelect controls.\n *\n *  @history\n *    2008-06-19 bpm Original code contributed by Toby Stuart (with contributions from Robert Williams)\n *\n * @constructor\n * Create a new ItemSelector\n * @param {Object} config Configuration options\n * @xtype itemselector \n */\nExt.ux.form.ItemSelector = Ext.extend(Ext.form.Field,  {\n    hideNavIcons:false,\n    imagePath:\"\",\n    iconUp:\"up2.gif\",\n    iconDown:\"down2.gif\",\n    iconLeft:\"left2.gif\",\n    iconRight:\"right2.gif\",\n    iconTop:\"top2.gif\",\n    iconBottom:\"bottom2.gif\",\n    drawUpIcon:true,\n    drawDownIcon:true,\n    drawLeftIcon:true,\n    drawRightIcon:true,\n    drawTopIcon:true,\n    drawBotIcon:true,\n    delimiter:',',\n    bodyStyle:null,\n    border:false,\n    defaultAutoCreate:{tag: \"div\"},\n    /**\n     * @cfg {Array} multiselects An array of {@link Ext.ux.form.MultiSelect} config objects, with at least all required parameters (e.g., store)\n     */\n    multiselects:null,\n\n    initComponent: function(){\n        Ext.ux.form.ItemSelector.superclass.initComponent.call(this);\n        this.addEvents({\n            'rowdblclick' : true,\n            'change' : true\n        });\n    },\n\n    onRender: function(ct, position){\n        Ext.ux.form.ItemSelector.superclass.onRender.call(this, ct, position);\n\n        // Internal default configuration for both multiselects\n        var msConfig = [{\n            legend: 'Available',\n            draggable: true,\n            droppable: true,\n            width: 100,\n            height: 100\n        },{\n            legend: 'Selected',\n            droppable: true,\n            draggable: true,\n            width: 100,\n            height: 100\n        }];\n\n        this.fromMultiselect = new Ext.ux.form.MultiSelect(Ext.applyIf(this.multiselects[0], msConfig[0]));\n        this.fromMultiselect.on('dblclick', this.onRowDblClick, this);\n\n        this.toMultiselect = new Ext.ux.form.MultiSelect(Ext.applyIf(this.multiselects[1], msConfig[1]));\n        this.toMultiselect.on('dblclick', this.onRowDblClick, this);\n\n        var p = new Ext.Panel({\n            bodyStyle:this.bodyStyle,\n            border:this.border,\n            layout:\"table\",\n            layoutConfig:{columns:3}\n        });\n\n        p.add(this.fromMultiselect);\n        var icons = new Ext.Panel({header:false});\n        p.add(icons);\n        p.add(this.toMultiselect);\n        p.render(this.el);\n        icons.el.down('.'+icons.bwrapCls).remove();\n\n        // ICON HELL!!!\n        if (this.imagePath!=\"\" && this.imagePath.charAt(this.imagePath.length-1)!=\"/\")\n            this.imagePath+=\"/\";\n        this.iconUp = this.imagePath + (this.iconUp || 'up2.gif');\n        this.iconDown = this.imagePath + (this.iconDown || 'down2.gif');\n        this.iconLeft = this.imagePath + (this.iconLeft || 'left2.gif');\n        this.iconRight = this.imagePath + (this.iconRight || 'right2.gif');\n        this.iconTop = this.imagePath + (this.iconTop || 'top2.gif');\n        this.iconBottom = this.imagePath + (this.iconBottom || 'bottom2.gif');\n        var el=icons.getEl();\n        this.toTopIcon = el.createChild({tag:'img', src:this.iconTop, style:{cursor:'pointer', margin:'2px'}});\n        el.createChild({tag: 'br'});\n        this.upIcon = el.createChild({tag:'img', src:this.iconUp, style:{cursor:'pointer', margin:'2px'}});\n        el.createChild({tag: 'br'});\n        this.addIcon = el.createChild({tag:'img', src:this.iconRight, style:{cursor:'pointer', margin:'2px'}});\n        el.createChild({tag: 'br'});\n        this.removeIcon = el.createChild({tag:'img', src:this.iconLeft, style:{cursor:'pointer', margin:'2px'}});\n        el.createChild({tag: 'br'});\n        this.downIcon = el.createChild({tag:'img', src:this.iconDown, style:{cursor:'pointer', margin:'2px'}});\n        el.createChild({tag: 'br'});\n        this.toBottomIcon = el.createChild({tag:'img', src:this.iconBottom, style:{cursor:'pointer', margin:'2px'}});\n        this.toTopIcon.on('click', this.toTop, this);\n        this.upIcon.on('click', this.up, this);\n        this.downIcon.on('click', this.down, this);\n        this.toBottomIcon.on('click', this.toBottom, this);\n        this.addIcon.on('click', this.fromTo, this);\n        this.removeIcon.on('click', this.toFrom, this);\n        if (!this.drawUpIcon || this.hideNavIcons) { this.upIcon.dom.style.display='none'; }\n        if (!this.drawDownIcon || this.hideNavIcons) { this.downIcon.dom.style.display='none'; }\n        if (!this.drawLeftIcon || this.hideNavIcons) { this.addIcon.dom.style.display='none'; }\n        if (!this.drawRightIcon || this.hideNavIcons) { this.removeIcon.dom.style.display='none'; }\n        if (!this.drawTopIcon || this.hideNavIcons) { this.toTopIcon.dom.style.display='none'; }\n        if (!this.drawBotIcon || this.hideNavIcons) { this.toBottomIcon.dom.style.display='none'; }\n\n        var tb = p.body.first();\n        this.el.setWidth(p.body.first().getWidth());\n        p.body.removeClass();\n\n        this.hiddenName = this.name;\n        var hiddenTag = {tag: \"input\", type: \"hidden\", value: \"\", name: this.name};\n        this.hiddenField = this.el.createChild(hiddenTag);\n    },\n    \n    doLayout: function(){\n        if(this.rendered){\n            this.fromMultiselect.fs.doLayout();\n            this.toMultiselect.fs.doLayout();\n        }\n    },\n\n    afterRender: function(){\n        Ext.ux.form.ItemSelector.superclass.afterRender.call(this);\n\n        this.toStore = this.toMultiselect.store;\n        this.toStore.on('add', this.valueChanged, this);\n        this.toStore.on('remove', this.valueChanged, this);\n        this.toStore.on('load', this.valueChanged, this);\n        this.valueChanged(this.toStore);\n    },\n\n    toTop : function() {\n        var selectionsArray = this.toMultiselect.view.getSelectedIndexes();\n        var records = [];\n        if (selectionsArray.length > 0) {\n            selectionsArray.sort();\n            for (var i=0; i<selectionsArray.length; i++) {\n                record = this.toMultiselect.view.store.getAt(selectionsArray[i]);\n                records.push(record);\n            }\n            selectionsArray = [];\n            for (var i=records.length-1; i>-1; i--) {\n                record = records[i];\n                this.toMultiselect.view.store.remove(record);\n                this.toMultiselect.view.store.insert(0, record);\n                selectionsArray.push(((records.length - 1) - i));\n            }\n        }\n        this.toMultiselect.view.refresh();\n        this.toMultiselect.view.select(selectionsArray);\n    },\n\n    toBottom : function() {\n        var selectionsArray = this.toMultiselect.view.getSelectedIndexes();\n        var records = [];\n        if (selectionsArray.length > 0) {\n            selectionsArray.sort();\n            for (var i=0; i<selectionsArray.length; i++) {\n                record = this.toMultiselect.view.store.getAt(selectionsArray[i]);\n                records.push(record);\n            }\n            selectionsArray = [];\n            for (var i=0; i<records.length; i++) {\n                record = records[i];\n                this.toMultiselect.view.store.remove(record);\n                this.toMultiselect.view.store.add(record);\n                selectionsArray.push((this.toMultiselect.view.store.getCount()) - (records.length - i));\n            }\n        }\n        this.toMultiselect.view.refresh();\n        this.toMultiselect.view.select(selectionsArray);\n    },\n\n    up : function() {\n        var record = null;\n        var selectionsArray = this.toMultiselect.view.getSelectedIndexes();\n        selectionsArray.sort();\n        var newSelectionsArray = [];\n        if (selectionsArray.length > 0) {\n            for (var i=0; i<selectionsArray.length; i++) {\n                record = this.toMultiselect.view.store.getAt(selectionsArray[i]);\n                if ((selectionsArray[i] - 1) >= 0) {\n                    this.toMultiselect.view.store.remove(record);\n                    this.toMultiselect.view.store.insert(selectionsArray[i] - 1, record);\n                    newSelectionsArray.push(selectionsArray[i] - 1);\n                }\n            }\n            this.toMultiselect.view.refresh();\n            this.toMultiselect.view.select(newSelectionsArray);\n        }\n    },\n\n    down : function() {\n        var record = null;\n        var selectionsArray = this.toMultiselect.view.getSelectedIndexes();\n        selectionsArray.sort();\n        selectionsArray.reverse();\n        var newSelectionsArray = [];\n        if (selectionsArray.length > 0) {\n            for (var i=0; i<selectionsArray.length; i++) {\n                record = this.toMultiselect.view.store.getAt(selectionsArray[i]);\n                if ((selectionsArray[i] + 1) < this.toMultiselect.view.store.getCount()) {\n                    this.toMultiselect.view.store.remove(record);\n                    this.toMultiselect.view.store.insert(selectionsArray[i] + 1, record);\n                    newSelectionsArray.push(selectionsArray[i] + 1);\n                }\n            }\n            this.toMultiselect.view.refresh();\n            this.toMultiselect.view.select(newSelectionsArray);\n        }\n    },\n\n    fromTo : function() {\n        var selectionsArray = this.fromMultiselect.view.getSelectedIndexes();\n        var records = [];\n        if (selectionsArray.length > 0) {\n            for (var i=0; i<selectionsArray.length; i++) {\n                record = this.fromMultiselect.view.store.getAt(selectionsArray[i]);\n                records.push(record);\n            }\n            if(!this.allowDup)selectionsArray = [];\n            for (var i=0; i<records.length; i++) {\n                record = records[i];\n                if(this.allowDup){\n                    var x=new Ext.data.Record();\n                    record.id=x.id;\n                    delete x;\n                    this.toMultiselect.view.store.add(record);\n                }else{\n                    this.fromMultiselect.view.store.remove(record);\n                    this.toMultiselect.view.store.add(record);\n                    selectionsArray.push((this.toMultiselect.view.store.getCount() - 1));\n                }\n            }\n        }\n        this.toMultiselect.view.refresh();\n        this.fromMultiselect.view.refresh();\n        var si = this.toMultiselect.store.sortInfo;\n        if(si){\n            this.toMultiselect.store.sort(si.field, si.direction);\n        }\n        this.toMultiselect.view.select(selectionsArray);\n    },\n\n    toFrom : function() {\n        var selectionsArray = this.toMultiselect.view.getSelectedIndexes();\n        var records = [];\n        if (selectionsArray.length > 0) {\n            for (var i=0; i<selectionsArray.length; i++) {\n                record = this.toMultiselect.view.store.getAt(selectionsArray[i]);\n                records.push(record);\n            }\n            selectionsArray = [];\n            for (var i=0; i<records.length; i++) {\n                record = records[i];\n                this.toMultiselect.view.store.remove(record);\n                if(!this.allowDup){\n                    this.fromMultiselect.view.store.add(record);\n                    selectionsArray.push((this.fromMultiselect.view.store.getCount() - 1));\n                }\n            }\n        }\n        this.fromMultiselect.view.refresh();\n        this.toMultiselect.view.refresh();\n        var si = this.fromMultiselect.store.sortInfo;\n        if (si){\n            this.fromMultiselect.store.sort(si.field, si.direction);\n        }\n        this.fromMultiselect.view.select(selectionsArray);\n    },\n\n    valueChanged: function(store) {\n        var record = null;\n        var values = [];\n        for (var i=0; i<store.getCount(); i++) {\n            record = store.getAt(i);\n            values.push(record.get(this.toMultiselect.valueField));\n        }\n        this.hiddenField.dom.value = values.join(this.delimiter);\n        this.fireEvent('change', this, this.getValue(), this.hiddenField.dom.value);\n    },\n\n    getValue : function() {\n        return this.hiddenField.dom.value;\n    },\n\n    onRowDblClick : function(vw, index, node, e) {\n        if (vw == this.toMultiselect.view){\n            this.toFrom();\n        } else if (vw == this.fromMultiselect.view) {\n            this.fromTo();\n        }\n        return this.fireEvent('rowdblclick', vw, index, node, e);\n    },\n\n    reset: function(){\n        range = this.toMultiselect.store.getRange();\n        this.toMultiselect.store.removeAll();\n        this.fromMultiselect.store.add(range);\n        var si = this.fromMultiselect.store.sortInfo;\n        if (si){\n            this.fromMultiselect.store.sort(si.field, si.direction);\n        }\n        this.valueChanged(this.toMultiselect.store);\n    }\n});\n\nExt.reg('itemselector', Ext.ux.form.ItemSelector);\n\n//backwards compat\nExt.ux.ItemSelector = Ext.ux.form.ItemSelector;\nExt.ns('Ext.ux.grid');\n\nExt.ux.grid.LockingGridView = Ext.extend(Ext.grid.GridView, {\n    lockText : 'Lock',\n    unlockText : 'Unlock',\n    rowBorderWidth : 1,\n    lockedBorderWidth : 1,\n\n    /*\n     * This option ensures that height between the rows is synchronized\n     * between the locked and unlocked sides. This option only needs to be used\n     * when the row heights aren't predictable.\n     */\n    syncHeights: false,\n\n    initTemplates : function(){\n        var ts = this.templates || {};\n\n        if (!ts.masterTpl) {\n            ts.masterTpl = new Ext.Template(\n                '<div class=\"x-grid3\" hidefocus=\"true\">',\n                    '<div class=\"x-grid3-locked\">',\n                        '<div class=\"x-grid3-header\"><div class=\"x-grid3-header-inner\"><div class=\"x-grid3-header-offset\" style=\"{lstyle}\">{lockedHeader}</div></div><div class=\"x-clear\"></div></div>',\n                        '<div class=\"x-grid3-scroller\"><div class=\"x-grid3-body\" style=\"{lstyle}\">{lockedBody}</div><div class=\"x-grid3-scroll-spacer\"></div></div>',\n                    '</div>',\n                    '<div class=\"x-grid3-viewport x-grid3-unlocked\">',\n                        '<div class=\"x-grid3-header\"><div class=\"x-grid3-header-inner\"><div class=\"x-grid3-header-offset\" style=\"{ostyle}\">{header}</div></div><div class=\"x-clear\"></div></div>',\n                        '<div class=\"x-grid3-scroller\"><div class=\"x-grid3-body\" style=\"{bstyle}\">{body}</div><a href=\"#\" class=\"x-grid3-focus\" tabIndex=\"-1\"></a></div>',\n                    '</div>',\n                    '<div class=\"x-grid3-resize-marker\">&#160;</div>',\n                    '<div class=\"x-grid3-resize-proxy\">&#160;</div>',\n                '</div>'\n            );\n        }\n\n        this.templates = ts;\n\n        Ext.ux.grid.LockingGridView.superclass.initTemplates.call(this);\n    },\n\n    getEditorParent : function(ed){\n        return this.el.dom;\n    },\n\n    initElements : function(){\n        var el             = Ext.get(this.grid.getGridEl().dom.firstChild),\n            lockedWrap     = el.child('div.x-grid3-locked'),\n            lockedHd       = lockedWrap.child('div.x-grid3-header'),\n            lockedScroller = lockedWrap.child('div.x-grid3-scroller'),\n            mainWrap       = el.child('div.x-grid3-viewport'),\n            mainHd         = mainWrap.child('div.x-grid3-header'),\n            scroller       = mainWrap.child('div.x-grid3-scroller');\n            \n        if (this.grid.hideHeaders) {\n            lockedHd.setDisplayed(false);\n            mainHd.setDisplayed(false);\n        }\n        \n        if(this.forceFit){\n            scroller.setStyle('overflow-x', 'hidden');\n        }\n        \n        Ext.apply(this, {\n            el      : el,\n            mainWrap: mainWrap,\n            mainHd  : mainHd,\n            innerHd : mainHd.dom.firstChild,\n            scroller: scroller,\n            mainBody: scroller.child('div.x-grid3-body'),\n            focusEl : scroller.child('a'),\n            resizeMarker: el.child('div.x-grid3-resize-marker'),\n            resizeProxy : el.child('div.x-grid3-resize-proxy'),\n            lockedWrap: lockedWrap,\n            lockedHd: lockedHd,\n            lockedScroller: lockedScroller,\n            lockedBody: lockedScroller.child('div.x-grid3-body'),\n            lockedInnerHd: lockedHd.child('div.x-grid3-header-inner', true)\n        });\n        \n        this.focusEl.swallowEvent('click', true);\n    },\n\n    getLockedRows : function(){\n        return this.hasRows() ? this.lockedBody.dom.childNodes : [];\n    },\n\n    getLockedRow : function(row){\n        return this.getLockedRows()[row];\n    },\n\n    getCell : function(row, col){\n        var lockedLen = this.cm.getLockedCount();\n        if(col < lockedLen){\n            return this.getLockedRow(row).getElementsByTagName('td')[col];\n        }\n        return Ext.ux.grid.LockingGridView.superclass.getCell.call(this, row, col - lockedLen);\n    },\n\n    getHeaderCell : function(index){\n        var lockedLen = this.cm.getLockedCount();\n        if(index < lockedLen){\n            return this.lockedHd.dom.getElementsByTagName('td')[index];\n        }\n        return Ext.ux.grid.LockingGridView.superclass.getHeaderCell.call(this, index - lockedLen);\n    },\n\n    addRowClass : function(row, cls){\n        var lockedRow = this.getLockedRow(row);\n        if(lockedRow){\n            this.fly(lockedRow).addClass(cls);\n        }\n        Ext.ux.grid.LockingGridView.superclass.addRowClass.call(this, row, cls);\n    },\n\n    removeRowClass : function(row, cls){\n        var lockedRow = this.getLockedRow(row);\n        if(lockedRow){\n            this.fly(lockedRow).removeClass(cls);\n        }\n        Ext.ux.grid.LockingGridView.superclass.removeRowClass.call(this, row, cls);\n    },\n\n    removeRow : function(row) {\n        Ext.removeNode(this.getLockedRow(row));\n        Ext.ux.grid.LockingGridView.superclass.removeRow.call(this, row);\n    },\n\n    removeRows : function(firstRow, lastRow){\n        var lockedBody = this.lockedBody.dom,\n            rowIndex = firstRow;\n        for(; rowIndex <= lastRow; rowIndex++){\n            Ext.removeNode(lockedBody.childNodes[firstRow]);\n        }\n        Ext.ux.grid.LockingGridView.superclass.removeRows.call(this, firstRow, lastRow);\n    },\n\n    syncScroll : function(e){\n        this.lockedScroller.dom.scrollTop = this.scroller.dom.scrollTop;\n        Ext.ux.grid.LockingGridView.superclass.syncScroll.call(this, e);\n    },\n\n    updateSortIcon : function(col, dir){\n        var sortClasses = this.sortClasses,\n            lockedHeaders = this.lockedHd.select('td').removeClass(sortClasses),\n            headers = this.mainHd.select('td').removeClass(sortClasses),\n            lockedLen = this.cm.getLockedCount(),\n            cls = sortClasses[dir == 'DESC' ? 1 : 0];\n            \n        if(col < lockedLen){\n            lockedHeaders.item(col).addClass(cls);\n        }else{\n            headers.item(col - lockedLen).addClass(cls);\n        }\n    },\n\n    updateAllColumnWidths : function(){\n        var tw = this.getTotalWidth(),\n            clen = this.cm.getColumnCount(),\n            lw = this.getLockedWidth(),\n            llen = this.cm.getLockedCount(),\n            ws = [], len, i;\n        this.updateLockedWidth();\n        for(i = 0; i < clen; i++){\n            ws[i] = this.getColumnWidth(i);\n            var hd = this.getHeaderCell(i);\n            hd.style.width = ws[i];\n        }\n        var lns = this.getLockedRows(), ns = this.getRows(), row, trow, j;\n        for(i = 0, len = ns.length; i < len; i++){\n            row = lns[i];\n            row.style.width = lw;\n            if(row.firstChild){\n                row.firstChild.style.width = lw;\n                trow = row.firstChild.rows[0];\n                for (j = 0; j < llen; j++) {\n                   trow.childNodes[j].style.width = ws[j];\n                }\n            }\n            row = ns[i];\n            row.style.width = tw;\n            if(row.firstChild){\n                row.firstChild.style.width = tw;\n                trow = row.firstChild.rows[0];\n                for (j = llen; j < clen; j++) {\n                   trow.childNodes[j - llen].style.width = ws[j];\n                }\n            }\n        }\n        this.onAllColumnWidthsUpdated(ws, tw);\n        this.syncHeaderHeight();\n    },\n\n    updateColumnWidth : function(col, width){\n        var w = this.getColumnWidth(col),\n            llen = this.cm.getLockedCount(),\n            ns, rw, c, row;\n        this.updateLockedWidth();\n        if(col < llen){\n            ns = this.getLockedRows();\n            rw = this.getLockedWidth();\n            c = col;\n        }else{\n            ns = this.getRows();\n            rw = this.getTotalWidth();\n            c = col - llen;\n        }\n        var hd = this.getHeaderCell(col);\n        hd.style.width = w;\n        for(var i = 0, len = ns.length; i < len; i++){\n            row = ns[i];\n            row.style.width = rw;\n            if(row.firstChild){\n                row.firstChild.style.width = rw;\n                row.firstChild.rows[0].childNodes[c].style.width = w;\n            }\n        }\n        this.onColumnWidthUpdated(col, w, this.getTotalWidth());\n        this.syncHeaderHeight();\n    },\n\n    updateColumnHidden : function(col, hidden){\n        var llen = this.cm.getLockedCount(),\n            ns, rw, c, row,\n            display = hidden ? 'none' : '';\n        this.updateLockedWidth();\n        if(col < llen){\n            ns = this.getLockedRows();\n            rw = this.getLockedWidth();\n            c = col;\n        }else{\n            ns = this.getRows();\n            rw = this.getTotalWidth();\n            c = col - llen;\n        }\n        var hd = this.getHeaderCell(col);\n        hd.style.display = display;\n        for(var i = 0, len = ns.length; i < len; i++){\n            row = ns[i];\n            row.style.width = rw;\n            if(row.firstChild){\n                row.firstChild.style.width = rw;\n                row.firstChild.rows[0].childNodes[c].style.display = display;\n            }\n        }\n        this.onColumnHiddenUpdated(col, hidden, this.getTotalWidth());\n        delete this.lastViewWidth;\n        this.layout();\n    },\n\n    doRender : function(cs, rs, ds, startRow, colCount, stripe){\n        var ts = this.templates, ct = ts.cell, rt = ts.row, last = colCount-1,\n            tstyle = 'width:'+this.getTotalWidth()+';',\n            lstyle = 'width:'+this.getLockedWidth()+';',\n            buf = [], lbuf = [], cb, lcb, c, p = {}, rp = {}, r;\n        for(var j = 0, len = rs.length; j < len; j++){\n            r = rs[j]; cb = []; lcb = [];\n            var rowIndex = (j+startRow);\n            for(var i = 0; i < colCount; i++){\n                c = cs[i];\n                p.id = c.id;\n                p.css = (i === 0 ? 'x-grid3-cell-first ' : (i == last ? 'x-grid3-cell-last ' : '')) +\n                    (this.cm.config[i].cellCls ? ' ' + this.cm.config[i].cellCls : '');\n                p.attr = p.cellAttr = '';\n                p.value = c.renderer(r.data[c.name], p, r, rowIndex, i, ds);\n                p.style = c.style;\n                if(Ext.isEmpty(p.value)){\n                    p.value = '&#160;';\n                }\n                if(this.markDirty && r.dirty && Ext.isDefined(r.modified[c.name])){\n                    p.css += ' x-grid3-dirty-cell';\n                }\n                if(c.locked){\n                    lcb[lcb.length] = ct.apply(p);\n                }else{\n                    cb[cb.length] = ct.apply(p);\n                }\n            }\n            var alt = [];\n            if(stripe && ((rowIndex+1) % 2 === 0)){\n                alt[0] = 'x-grid3-row-alt';\n            }\n            if(r.dirty){\n                alt[1] = ' x-grid3-dirty-row';\n            }\n            rp.cols = colCount;\n            if(this.getRowClass){\n                alt[2] = this.getRowClass(r, rowIndex, rp, ds);\n            }\n            rp.alt = alt.join(' ');\n            rp.cells = cb.join('');\n            rp.tstyle = tstyle;\n            buf[buf.length] = rt.apply(rp);\n            rp.cells = lcb.join('');\n            rp.tstyle = lstyle;\n            lbuf[lbuf.length] = rt.apply(rp);\n        }\n        return [buf.join(''), lbuf.join('')];\n    },\n    processRows : function(startRow, skipStripe){\n        if(!this.ds || this.ds.getCount() < 1){\n            return;\n        }\n        var rows = this.getRows(),\n            lrows = this.getLockedRows(),\n            row, lrow;\n        skipStripe = skipStripe || !this.grid.stripeRows;\n        startRow = startRow || 0;\n        for(var i = 0, len = rows.length; i < len; ++i){\n            row = rows[i];\n            lrow = lrows[i];\n            row.rowIndex = i;\n            lrow.rowIndex = i;\n            if(!skipStripe){\n                row.className = row.className.replace(this.rowClsRe, ' ');\n                lrow.className = lrow.className.replace(this.rowClsRe, ' ');\n                if ((i + 1) % 2 === 0){\n                    row.className += ' x-grid3-row-alt';\n                    lrow.className += ' x-grid3-row-alt';\n                }\n            }\n            this.syncRowHeights(row, lrow);\n        }\n        if(startRow === 0){\n            Ext.fly(rows[0]).addClass(this.firstRowCls);\n            Ext.fly(lrows[0]).addClass(this.firstRowCls);\n        }\n        Ext.fly(rows[rows.length - 1]).addClass(this.lastRowCls);\n        Ext.fly(lrows[lrows.length - 1]).addClass(this.lastRowCls);\n    },\n    \n    syncRowHeights: function(row1, row2){\n        if(this.syncHeights){\n            var el1 = Ext.get(row1),\n                el2 = Ext.get(row2),\n                h1 = el1.getHeight(),\n                h2 = el2.getHeight();\n\n            if(h1 > h2){\n                el2.setHeight(h1);\n            }else if(h2 > h1){\n                el1.setHeight(h2);\n            }\n        }\n    },\n\n    afterRender : function(){\n        if(!this.ds || !this.cm){\n            return;\n        }\n        var bd = this.renderRows() || ['&#160;', '&#160;'];\n        this.mainBody.dom.innerHTML = bd[0];\n        this.lockedBody.dom.innerHTML = bd[1];\n        this.processRows(0, true);\n        if(this.deferEmptyText !== true){\n            this.applyEmptyText();\n        }\n        this.grid.fireEvent('viewready', this.grid);\n    },\n\n    renderUI : function(){        \n        var templates = this.templates,\n            header = this.renderHeaders(),\n            body = templates.body.apply({rows:'&#160;'});\n\n        return templates.masterTpl.apply({\n            body  : body,\n            header: header[0],\n            ostyle: 'width:' + this.getOffsetWidth() + ';',\n            bstyle: 'width:' + this.getTotalWidth()  + ';',\n            lockedBody: body,\n            lockedHeader: header[1],\n            lstyle: 'width:'+this.getLockedWidth()+';'\n        });\n    },\n    \n    afterRenderUI: function(){\n        var g = this.grid;\n        this.initElements();\n        Ext.fly(this.innerHd).on('click', this.handleHdDown, this);\n        Ext.fly(this.lockedInnerHd).on('click', this.handleHdDown, this);\n        this.mainHd.on({\n            scope: this,\n            mouseover: this.handleHdOver,\n            mouseout: this.handleHdOut,\n            mousemove: this.handleHdMove\n        });\n        this.lockedHd.on({\n            scope: this,\n            mouseover: this.handleHdOver,\n            mouseout: this.handleHdOut,\n            mousemove: this.handleHdMove\n        });\n        this.scroller.on('scroll', this.syncScroll,  this);\n        if(g.enableColumnResize !== false){\n            this.splitZone = new Ext.grid.GridView.SplitDragZone(g, this.mainHd.dom);\n            this.splitZone.setOuterHandleElId(Ext.id(this.lockedHd.dom));\n            this.splitZone.setOuterHandleElId(Ext.id(this.mainHd.dom));\n        }\n        if(g.enableColumnMove){\n            this.columnDrag = new Ext.grid.GridView.ColumnDragZone(g, this.innerHd);\n            this.columnDrag.setOuterHandleElId(Ext.id(this.lockedInnerHd));\n            this.columnDrag.setOuterHandleElId(Ext.id(this.innerHd));\n            this.columnDrop = new Ext.grid.HeaderDropZone(g, this.mainHd.dom);\n        }\n        if(g.enableHdMenu !== false){\n            this.hmenu = new Ext.menu.Menu({id: g.id + '-hctx'});\n            this.hmenu.add(\n                {itemId: 'asc', text: this.sortAscText, cls: 'xg-hmenu-sort-asc'},\n                {itemId: 'desc', text: this.sortDescText, cls: 'xg-hmenu-sort-desc'}\n            );\n            if(this.grid.enableColLock !== false){\n                this.hmenu.add({\n                    itemId: 'sortSep',\n                    xtype: 'menuseparator'\n                },\n                    {itemId: 'lock', text: this.lockText, cls: 'xg-hmenu-lock'},\n                    {itemId: 'unlock', text: this.unlockText, cls: 'xg-hmenu-unlock'}\n                );\n            }\n            if(g.enableColumnHide !== false){\n                this.colMenu = new Ext.menu.Menu({id:g.id + '-hcols-menu'});\n                this.colMenu.on({\n                    scope: this,\n                    beforeshow: this.beforeColMenuShow,\n                    itemclick: this.handleHdMenuClick\n                });\n                this.hmenu.add('-', {\n                    itemId:'columns',\n                    hideOnClick: false,\n                    text: this.columnsText,\n                    menu: this.colMenu,\n                    iconCls: 'x-cols-icon'\n                });\n            }\n            this.hmenu.on('itemclick', this.handleHdMenuClick, this);\n        }\n        if(g.trackMouseOver){\n            this.mainBody.on({\n                scope: this,\n                mouseover: this.onRowOver,\n                mouseout: this.onRowOut\n            });\n            this.lockedBody.on({\n                scope: this,\n                mouseover: this.onRowOver,\n                mouseout: this.onRowOut\n            });\n        }\n\n        if(g.enableDragDrop || g.enableDrag){\n            this.dragZone = new Ext.grid.GridDragZone(g, {\n                ddGroup : g.ddGroup || 'GridDD'\n            });\n        }\n        this.updateHeaderSortState();    \n    },\n\n    layout : function(){\n        if(!this.mainBody){\n            return;\n        }\n        var g = this.grid;\n        var c = g.getGridEl();\n        var csize = c.getSize(true);\n        var vw = csize.width;\n        if(!g.hideHeaders && (vw < 20 || csize.height < 20)){\n            return;\n        }\n        this.syncHeaderHeight();\n        if(g.autoHeight){\n            this.scroller.dom.style.overflow = 'visible';\n            this.lockedScroller.dom.style.overflow = 'visible';\n            if(Ext.isWebKit){\n                this.scroller.dom.style.position = 'static';\n                this.lockedScroller.dom.style.position = 'static';\n            }\n        }else{\n            this.el.setSize(csize.width, csize.height);\n            var hdHeight = this.mainHd.getHeight();\n            var vh = csize.height - (hdHeight);\n        }\n        this.updateLockedWidth();\n        if(this.forceFit){\n            if(this.lastViewWidth != vw){\n                this.fitColumns(false, false);\n                this.lastViewWidth = vw;\n            }\n        }else {\n            this.autoExpand();\n            this.syncHeaderScroll();\n        }\n        this.onLayout(vw, vh);\n    },\n\n    getOffsetWidth : function() {\n        return (this.cm.getTotalWidth() - this.cm.getTotalLockedWidth() + this.getScrollOffset()) + 'px';\n    },\n\n    renderHeaders : function(){\n        var cm = this.cm,\n            ts = this.templates,\n            ct = ts.hcell,\n            cb = [], lcb = [],\n            p = {},\n            len = cm.getColumnCount(),\n            last = len - 1;\n        for(var i = 0; i < len; i++){\n            p.id = cm.getColumnId(i);\n            p.value = cm.getColumnHeader(i) || '';\n            p.style = this.getColumnStyle(i, true);\n            p.tooltip = this.getColumnTooltip(i);\n            p.css = (i === 0 ? 'x-grid3-cell-first ' : (i == last ? 'x-grid3-cell-last ' : '')) +\n                (cm.config[i].headerCls ? ' ' + cm.config[i].headerCls : '');\n            if(cm.config[i].align == 'right'){\n                p.istyle = 'padding-right:16px';\n            } else {\n                delete p.istyle;\n            }\n            if(cm.isLocked(i)){\n                lcb[lcb.length] = ct.apply(p);\n            }else{\n                cb[cb.length] = ct.apply(p);\n            }\n        }\n        return [ts.header.apply({cells: cb.join(''), tstyle:'width:'+this.getTotalWidth()+';'}),\n                ts.header.apply({cells: lcb.join(''), tstyle:'width:'+this.getLockedWidth()+';'})];\n    },\n\n    updateHeaders : function(){\n        var hd = this.renderHeaders();\n        this.innerHd.firstChild.innerHTML = hd[0];\n        this.innerHd.firstChild.style.width = this.getOffsetWidth();\n        this.innerHd.firstChild.firstChild.style.width = this.getTotalWidth();\n        this.lockedInnerHd.firstChild.innerHTML = hd[1];\n        var lw = this.getLockedWidth();\n        this.lockedInnerHd.firstChild.style.width = lw;\n        this.lockedInnerHd.firstChild.firstChild.style.width = lw;\n    },\n\n    getResolvedXY : function(resolved){\n        if(!resolved){\n            return null;\n        }\n        var c = resolved.cell, r = resolved.row;\n        return c ? Ext.fly(c).getXY() : [this.scroller.getX(), Ext.fly(r).getY()];\n    },\n\n    syncFocusEl : function(row, col, hscroll){\n        Ext.ux.grid.LockingGridView.superclass.syncFocusEl.call(this, row, col, col < this.cm.getLockedCount() ? false : hscroll);\n    },\n\n    ensureVisible : function(row, col, hscroll){\n        return Ext.ux.grid.LockingGridView.superclass.ensureVisible.call(this, row, col, col < this.cm.getLockedCount() ? false : hscroll);\n    },\n\n    insertRows : function(dm, firstRow, lastRow, isUpdate){\n        var last = dm.getCount() - 1;\n        if(!isUpdate && firstRow === 0 && lastRow >= last){\n            this.refresh();\n        }else{\n            if(!isUpdate){\n                this.fireEvent('beforerowsinserted', this, firstRow, lastRow);\n            }\n            var html = this.renderRows(firstRow, lastRow),\n                before = this.getRow(firstRow);\n            if(before){\n                if(firstRow === 0){\n                    this.removeRowClass(0, this.firstRowCls);\n                }\n                Ext.DomHelper.insertHtml('beforeBegin', before, html[0]);\n                before = this.getLockedRow(firstRow);\n                Ext.DomHelper.insertHtml('beforeBegin', before, html[1]);\n            }else{\n                this.removeRowClass(last - 1, this.lastRowCls);\n                Ext.DomHelper.insertHtml('beforeEnd', this.mainBody.dom, html[0]);\n                Ext.DomHelper.insertHtml('beforeEnd', this.lockedBody.dom, html[1]);\n            }\n            if(!isUpdate){\n                this.fireEvent('rowsinserted', this, firstRow, lastRow);\n                this.processRows(firstRow);\n            }else if(firstRow === 0 || firstRow >= last){\n                this.addRowClass(firstRow, firstRow === 0 ? this.firstRowCls : this.lastRowCls);\n            }\n        }\n        this.syncFocusEl(firstRow);\n    },\n\n    getColumnStyle : function(col, isHeader){\n        var style = !isHeader ? this.cm.config[col].cellStyle || this.cm.config[col].css || '' : this.cm.config[col].headerStyle || '';\n        style += 'width:'+this.getColumnWidth(col)+';';\n        if(this.cm.isHidden(col)){\n            style += 'display:none;';\n        }\n        var align = this.cm.config[col].align;\n        if(align){\n            style += 'text-align:'+align+';';\n        }\n        return style;\n    },\n\n    getLockedWidth : function() {\n        return this.cm.getTotalLockedWidth() + 'px';\n    },\n\n    getTotalWidth : function() {\n        return (this.cm.getTotalWidth() - this.cm.getTotalLockedWidth()) + 'px';\n    },\n\n    getColumnData : function(){\n        var cs = [], cm = this.cm, colCount = cm.getColumnCount();\n        for(var i = 0; i < colCount; i++){\n            var name = cm.getDataIndex(i);\n            cs[i] = {\n                name : (!Ext.isDefined(name) ? this.ds.fields.get(i).name : name),\n                renderer : cm.getRenderer(i),\n                scope : cm.getRendererScope(i),\n                id : cm.getColumnId(i),\n                style : this.getColumnStyle(i),\n                locked : cm.isLocked(i)\n            };\n        }\n        return cs;\n    },\n\n    renderBody : function(){\n        var markup = this.renderRows() || ['&#160;', '&#160;'];\n        return [this.templates.body.apply({rows: markup[0]}), this.templates.body.apply({rows: markup[1]})];\n    },\n    \n    refreshRow: function(record){\n        var store = this.ds, \n            colCount = this.cm.getColumnCount(), \n            columns = this.getColumnData(), \n            last = colCount - 1, \n            cls = ['x-grid3-row'], \n            rowParams = {\n                tstyle: String.format(\"width: {0};\", this.getTotalWidth())\n            }, \n            lockedRowParams = {\n                tstyle: String.format(\"width: {0};\", this.getLockedWidth())\n            }, \n            colBuffer = [], \n            lockedColBuffer = [], \n            cellTpl = this.templates.cell, \n            rowIndex, \n            row, \n            lockedRow, \n            column, \n            meta, \n            css, \n            i;\n        \n        if (Ext.isNumber(record)) {\n            rowIndex = record;\n            record = store.getAt(rowIndex);\n        } else {\n            rowIndex = store.indexOf(record);\n        }\n        \n        if (!record || rowIndex < 0) {\n            return;\n        }\n        \n        for (i = 0; i < colCount; i++) {\n            column = columns[i];\n            \n            if (i == 0) {\n                css = 'x-grid3-cell-first';\n            } else {\n                css = (i == last) ? 'x-grid3-cell-last ' : '';\n            }\n            \n            meta = {\n                id: column.id,\n                style: column.style,\n                css: css,\n                attr: \"\",\n                cellAttr: \"\"\n            };\n            \n            meta.value = column.renderer.call(column.scope, record.data[column.name], meta, record, rowIndex, i, store);\n            \n            if (Ext.isEmpty(meta.value)) {\n                meta.value = ' ';\n            }\n            \n            if (this.markDirty && record.dirty && typeof record.modified[column.name] != 'undefined') {\n                meta.css += ' x-grid3-dirty-cell';\n            }\n            \n            if (column.locked) {\n                lockedColBuffer[i] = cellTpl.apply(meta);\n            } else {\n                colBuffer[i] = cellTpl.apply(meta);\n            }\n        }\n        \n        row = this.getRow(rowIndex);\n        row.className = '';\n        lockedRow = this.getLockedRow(rowIndex);\n        lockedRow.className = '';\n        \n        if (this.grid.stripeRows && ((rowIndex + 1) % 2 === 0)) {\n            cls.push('x-grid3-row-alt');\n        }\n        \n        if (this.getRowClass) {\n            rowParams.cols = colCount;\n            cls.push(this.getRowClass(record, rowIndex, rowParams, store));\n        }\n        \n        // Unlocked rows\n        this.fly(row).addClass(cls).setStyle(rowParams.tstyle);\n        rowParams.cells = colBuffer.join(\"\");\n        row.innerHTML = this.templates.rowInner.apply(rowParams);\n        \n        // Locked rows\n        this.fly(lockedRow).addClass(cls).setStyle(lockedRowParams.tstyle);\n        lockedRowParams.cells = lockedColBuffer.join(\"\");\n        lockedRow.innerHTML = this.templates.rowInner.apply(lockedRowParams);\n        lockedRow.rowIndex = rowIndex;\n        this.syncRowHeights(row, lockedRow);  \n        this.fireEvent('rowupdated', this, rowIndex, record);\n    },\n\n    refresh : function(headersToo){\n        this.fireEvent('beforerefresh', this);\n        this.grid.stopEditing(true);\n        var result = this.renderBody();\n        this.mainBody.update(result[0]).setWidth(this.getTotalWidth());\n        this.lockedBody.update(result[1]).setWidth(this.getLockedWidth());\n        if(headersToo === true){\n            this.updateHeaders();\n            this.updateHeaderSortState();\n        }\n        this.processRows(0, true);\n        this.layout();\n        this.applyEmptyText();\n        this.fireEvent('refresh', this);\n    },\n\n    onDenyColumnLock : function(){\n\n    },\n\n    initData : function(ds, cm){\n        if(this.cm){\n            this.cm.un('columnlockchange', this.onColumnLock, this);\n        }\n        Ext.ux.grid.LockingGridView.superclass.initData.call(this, ds, cm);\n        if(this.cm){\n            this.cm.on('columnlockchange', this.onColumnLock, this);\n        }\n    },\n\n    onColumnLock : function(){\n        this.refresh(true);\n    },\n\n    handleHdMenuClick : function(item){\n        var index = this.hdCtxIndex,\n            cm = this.cm,\n            id = item.getItemId(),\n            llen = cm.getLockedCount();\n        switch(id){\n            case 'lock':\n                if(cm.getColumnCount(true) <= llen + 1){\n                    this.onDenyColumnLock();\n                    return undefined;\n                }\n                cm.setLocked(index, true, llen != index);\n                if(llen != index){\n                    cm.moveColumn(index, llen);\n                    this.grid.fireEvent('columnmove', index, llen);\n                }\n            break;\n            case 'unlock':\n                if(llen - 1 != index){\n                    cm.setLocked(index, false, true);\n                    cm.moveColumn(index, llen - 1);\n                    this.grid.fireEvent('columnmove', index, llen - 1);\n                }else{\n                    cm.setLocked(index, false);\n                }\n            break;\n            default:\n                return Ext.ux.grid.LockingGridView.superclass.handleHdMenuClick.call(this, item);\n        }\n        return true;\n    },\n\n    handleHdDown : function(e, t){\n        Ext.ux.grid.LockingGridView.superclass.handleHdDown.call(this, e, t);\n        if(this.grid.enableColLock !== false){\n            if(Ext.fly(t).hasClass('x-grid3-hd-btn')){\n                var hd = this.findHeaderCell(t),\n                    index = this.getCellIndex(hd),\n                    ms = this.hmenu.items, cm = this.cm;\n                ms.get('lock').setDisabled(cm.isLocked(index));\n                ms.get('unlock').setDisabled(!cm.isLocked(index));\n            }\n        }\n    },\n\n    syncHeaderHeight: function(){\n        var hrow = Ext.fly(this.innerHd).child('tr', true),\n            lhrow = Ext.fly(this.lockedInnerHd).child('tr', true);\n            \n        hrow.style.height = 'auto';\n        lhrow.style.height = 'auto';\n        var hd = hrow.offsetHeight,\n            lhd = lhrow.offsetHeight,\n            height = Math.max(lhd, hd) + 'px';\n            \n        hrow.style.height = height;\n        lhrow.style.height = height;\n\n    },\n\n    updateLockedWidth: function(){\n        var lw = this.cm.getTotalLockedWidth(),\n            tw = this.cm.getTotalWidth() - lw,\n            csize = this.grid.getGridEl().getSize(true),\n            lp = Ext.isBorderBox ? 0 : this.lockedBorderWidth,\n            rp = Ext.isBorderBox ? 0 : this.rowBorderWidth,\n            vw = Math.max(csize.width - lw - lp - rp, 0) + 'px',\n            so = this.getScrollOffset();\n        if(!this.grid.autoHeight){\n            var vh = Math.max(csize.height - this.mainHd.getHeight(), 0) + 'px';\n            this.lockedScroller.dom.style.height = vh;\n            this.scroller.dom.style.height = vh;\n        }\n        this.lockedWrap.dom.style.width = (lw + rp) + 'px';\n        this.scroller.dom.style.width = vw;\n        this.mainWrap.dom.style.left = (lw + lp + rp) + 'px';\n        if(this.innerHd){\n            this.lockedInnerHd.firstChild.style.width = lw + 'px';\n            this.lockedInnerHd.firstChild.firstChild.style.width = lw + 'px';\n            this.innerHd.style.width = vw;\n            this.innerHd.firstChild.style.width = (tw + rp + so) + 'px';\n            this.innerHd.firstChild.firstChild.style.width = tw + 'px';\n        }\n        if(this.mainBody){\n            this.lockedBody.dom.style.width = (lw + rp) + 'px';\n            this.mainBody.dom.style.width = (tw + rp) + 'px';\n        }\n    }\n});\n\nExt.ux.grid.LockingColumnModel = Ext.extend(Ext.grid.ColumnModel, {\n    /**\n     * Returns true if the given column index is currently locked\n     * @param {Number} colIndex The column index\n     * @return {Boolean} True if the column is locked\n     */\n    isLocked : function(colIndex){\n        return this.config[colIndex].locked === true;\n    },\n\n    /**\n     * Locks or unlocks a given column\n     * @param {Number} colIndex The column index\n     * @param {Boolean} value True to lock, false to unlock\n     * @param {Boolean} suppressEvent Pass false to cause the columnlockchange event not to fire\n     */\n    setLocked : function(colIndex, value, suppressEvent){\n        if (this.isLocked(colIndex) == value) {\n            return;\n        }\n        this.config[colIndex].locked = value;\n        if (!suppressEvent) {\n            this.fireEvent('columnlockchange', this, colIndex, value);\n        }\n    },\n\n    /**\n     * Returns the total width of all locked columns\n     * @return {Number} The width of all locked columns\n     */\n    getTotalLockedWidth : function(){\n        var totalWidth = 0;\n        for (var i = 0, len = this.config.length; i < len; i++) {\n            if (this.isLocked(i) && !this.isHidden(i)) {\n                totalWidth += this.getColumnWidth(i);\n            }\n        }\n\n        return totalWidth;\n    },\n\n    /**\n     * Returns the total number of locked columns\n     * @return {Number} The number of locked columns\n     */\n    getLockedCount : function() {\n        var len = this.config.length;\n\n        for (var i = 0; i < len; i++) {\n            if (!this.isLocked(i)) {\n                return i;\n            }\n        }\n\n        //if we get to this point all of the columns are locked so we return the total\n        return len;\n    },\n\n    /**\n     * Moves a column from one position to another\n     * @param {Number} oldIndex The current column index\n     * @param {Number} newIndex The destination column index\n     */\n    moveColumn : function(oldIndex, newIndex){\n        var oldLocked = this.isLocked(oldIndex),\n            newLocked = this.isLocked(newIndex);\n\n        if (oldIndex < newIndex && oldLocked && !newLocked) {\n            this.setLocked(oldIndex, false, true);\n        } else if (oldIndex > newIndex && !oldLocked && newLocked) {\n            this.setLocked(oldIndex, true, true);\n        }\n\n        Ext.ux.grid.LockingColumnModel.superclass.moveColumn.apply(this, arguments);\n    }\n});\nExt.ns('Ext.ux.form');\n\n/**\n * @class Ext.ux.form.MultiSelect\n * @extends Ext.form.Field\n * A control that allows selection and form submission of multiple list items.\n *\n *  @history\n *    2008-06-19 bpm Original code contributed by Toby Stuart (with contributions from Robert Williams)\n *    2008-06-19 bpm Docs and demo code clean up\n *\n * @constructor\n * Create a new MultiSelect\n * @param {Object} config Configuration options\n * @xtype multiselect\n */\nExt.ux.form.MultiSelect = Ext.extend(Ext.form.Field,  {\n    /**\n     * @cfg {String} legend Wraps the object with a fieldset and specified legend.\n     */\n    /**\n     * @cfg {Ext.ListView} view The {@link Ext.ListView} used to render the multiselect list.\n     */\n    /**\n     * @cfg {String/Array} dragGroup The ddgroup name(s) for the MultiSelect DragZone (defaults to undefined).\n     */\n    /**\n     * @cfg {String/Array} dropGroup The ddgroup name(s) for the MultiSelect DropZone (defaults to undefined).\n     */\n    /**\n     * @cfg {Boolean} ddReorder Whether the items in the MultiSelect list are drag/drop reorderable (defaults to false).\n     */\n    ddReorder:false,\n    /**\n     * @cfg {Object/Array} tbar The top toolbar of the control. This can be a {@link Ext.Toolbar} object, a\n     * toolbar config, or an array of buttons/button configs to be added to the toolbar.\n     */\n    /**\n     * @cfg {String} appendOnly True if the list should only allow append drops when drag/drop is enabled\n     * (use for lists which are sorted, defaults to false).\n     */\n    appendOnly:false,\n    /**\n     * @cfg {Number} width Width in pixels of the control (defaults to 100).\n     */\n    width:100,\n    /**\n     * @cfg {Number} height Height in pixels of the control (defaults to 100).\n     */\n    height:100,\n    /**\n     * @cfg {String/Number} displayField Name/Index of the desired display field in the dataset (defaults to 0).\n     */\n    displayField:0,\n    /**\n     * @cfg {String/Number} valueField Name/Index of the desired value field in the dataset (defaults to 1).\n     */\n    valueField:1,\n    /**\n     * @cfg {Boolean} allowBlank False to require at least one item in the list to be selected, true to allow no\n     * selection (defaults to true).\n     */\n    allowBlank:true,\n    /**\n     * @cfg {Number} minSelections Minimum number of selections allowed (defaults to 0).\n     */\n    minSelections:0,\n    /**\n     * @cfg {Number} maxSelections Maximum number of selections allowed (defaults to Number.MAX_VALUE).\n     */\n    maxSelections:Number.MAX_VALUE,\n    /**\n     * @cfg {String} blankText Default text displayed when the control contains no items (defaults to the same value as\n     * {@link Ext.form.TextField#blankText}.\n     */\n    blankText:Ext.form.TextField.prototype.blankText,\n    /**\n     * @cfg {String} minSelectionsText Validation message displayed when {@link #minSelections} is not met (defaults to 'Minimum {0}\n     * item(s) required').  The {0} token will be replaced by the value of {@link #minSelections}.\n     */\n    minSelectionsText:'Minimum {0} item(s) required',\n    /**\n     * @cfg {String} maxSelectionsText Validation message displayed when {@link #maxSelections} is not met (defaults to 'Maximum {0}\n     * item(s) allowed').  The {0} token will be replaced by the value of {@link #maxSelections}.\n     */\n    maxSelectionsText:'Maximum {0} item(s) allowed',\n    /**\n     * @cfg {String} delimiter The string used to delimit between items when set or returned as a string of values\n     * (defaults to ',').\n     */\n    delimiter:',',\n    /**\n     * @cfg {Ext.data.Store/Array} store The data source to which this MultiSelect is bound (defaults to <tt>undefined</tt>).\n     * Acceptable values for this property are:\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>any {@link Ext.data.Store Store} subclass</b></li>\n     * <li><b>an Array</b> : Arrays will be converted to a {@link Ext.data.ArrayStore} internally.\n     * <div class=\"mdetail-params\"><ul>\n     * <li><b>1-dimensional array</b> : (e.g., <tt>['Foo','Bar']</tt>)<div class=\"sub-desc\">\n     * A 1-dimensional array will automatically be expanded (each array item will be the combo\n     * {@link #valueField value} and {@link #displayField text})</div></li>\n     * <li><b>2-dimensional array</b> : (e.g., <tt>[['f','Foo'],['b','Bar']]</tt>)<div class=\"sub-desc\">\n     * For a multi-dimensional array, the value in index 0 of each item will be assumed to be the combo\n     * {@link #valueField value}, while the value at index 1 is assumed to be the combo {@link #displayField text}.\n     * </div></li></ul></div></li></ul></div>\n     */\n    \n    cls: 'ux-form-multiselect',\n\n    // private\n    defaultAutoCreate : {tag: \"div\"},\n\n    // private\n    initComponent: function(){\n        Ext.ux.form.MultiSelect.superclass.initComponent.call(this);\n\n        if(Ext.isArray(this.store)){\n            if (Ext.isArray(this.store[0])){\n                this.store = new Ext.data.ArrayStore({\n                    fields: ['value','text'],\n                    data: this.store\n                });\n                this.valueField = 'value';\n            }else{\n                this.store = new Ext.data.ArrayStore({\n                    fields: ['text'],\n                    data: this.store,\n                    expandData: true\n                });\n                this.valueField = 'text';\n            }\n            this.displayField = 'text';\n        } else {\n            this.store = Ext.StoreMgr.lookup(this.store);\n        }\n\n        this.addEvents({\n            'dblclick' : true,\n            'click' : true,\n            'change' : true,\n            'drop' : true\n        });\n    },\n\n    // private\n    onRender: function(ct, position){\n        Ext.ux.form.MultiSelect.superclass.onRender.call(this, ct, position);\n\n        var fs = this.fs = new Ext.form.FieldSet({\n            renderTo: this.el,\n            title: this.legend,\n            height: this.height,\n            width: this.width,\n            style: \"padding:0;\",\n            tbar: this.tbar\n        });\n        fs.body.addClass('ux-mselect');\n\n        this.view = new Ext.ListView({\n            selectedClass: 'ux-mselect-selected',\n            multiSelect: true,\n            store: this.store,\n            columns: [{ header: 'Value', width: 1, dataIndex: this.displayField }],\n            hideHeaders: true\n        });\n\n        fs.add(this.view);\n\n        this.view.on('click', this.onViewClick, this);\n        this.view.on('beforeclick', this.onViewBeforeClick, this);\n        this.view.on('dblclick', this.onViewDblClick, this);\n\n        this.hiddenName = this.name || Ext.id();\n        var hiddenTag = { tag: \"input\", type: \"hidden\", value: \"\", name: this.hiddenName };\n        this.hiddenField = this.el.createChild(hiddenTag);\n        this.hiddenField.dom.disabled = this.hiddenName != this.name;\n        fs.doLayout();\n    },\n\n    // private\n    afterRender: function(){\n        Ext.ux.form.MultiSelect.superclass.afterRender.call(this);\n\n        if (this.ddReorder && !this.dragGroup && !this.dropGroup){\n            this.dragGroup = this.dropGroup = 'MultiselectDD-' + Ext.id();\n        }\n\n        if (this.draggable || this.dragGroup){\n            this.dragZone = new Ext.ux.form.MultiSelect.DragZone(this, {\n                ddGroup: this.dragGroup\n            });\n        }\n        if (this.droppable || this.dropGroup){\n            this.dropZone = new Ext.ux.form.MultiSelect.DropZone(this, {\n                ddGroup: this.dropGroup\n            });\n        }\n    },\n\n    // private\n    onViewClick: function(vw, index, node, e) {\n        this.fireEvent('change', this, this.getValue(), this.hiddenField.dom.value);\n        this.hiddenField.dom.value = this.getValue();\n        this.fireEvent('click', this, e);\n        this.validate();\n    },\n\n    // private\n    onViewBeforeClick: function(vw, index, node, e) {\n        if (this.disabled || this.readOnly) {\n            return false;\n        }\n    },\n\n    // private\n    onViewDblClick : function(vw, index, node, e) {\n        return this.fireEvent('dblclick', vw, index, node, e);\n    },\n\n    /**\n     * Returns an array of data values for the selected items in the list. The values will be separated\n     * by {@link #delimiter}.\n     * @return {Array} value An array of string data values\n     */\n    getValue: function(valueField){\n        var returnArray = [];\n        var selectionsArray = this.view.getSelectedIndexes();\n        if (selectionsArray.length == 0) {return '';}\n        for (var i=0; i<selectionsArray.length; i++) {\n            returnArray.push(this.store.getAt(selectionsArray[i]).get((valueField != null) ? valueField : this.valueField));\n        }\n        return returnArray.join(this.delimiter);\n    },\n\n    /**\n     * Sets a delimited string (using {@link #delimiter}) or array of data values into the list.\n     * @param {String/Array} values The values to set\n     */\n    setValue: function(values) {\n        var index;\n        var selections = [];\n        this.view.clearSelections();\n        this.hiddenField.dom.value = '';\n\n        if (!values || (values == '')) { return; }\n\n        if (!Ext.isArray(values)) { values = values.split(this.delimiter); }\n        for (var i=0; i<values.length; i++) {\n            index = this.view.store.indexOf(this.view.store.query(this.valueField,\n                new RegExp('^' + values[i] + '$', \"i\")).itemAt(0));\n            selections.push(index);\n        }\n        this.view.select(selections);\n        this.hiddenField.dom.value = this.getValue();\n        this.validate();\n    },\n\n    // inherit docs\n    reset : function() {\n        this.setValue('');\n    },\n\n    // inherit docs\n    getRawValue: function(valueField) {\n        var tmp = this.getValue(valueField);\n        if (tmp.length) {\n            tmp = tmp.split(this.delimiter);\n        }\n        else {\n            tmp = [];\n        }\n        return tmp;\n    },\n\n    // inherit docs\n    setRawValue: function(values){\n        setValue(values);\n    },\n\n    // inherit docs\n    validateValue : function(value){\n        if (value.length < 1) { // if it has no value\n             if (this.allowBlank) {\n                 this.clearInvalid();\n                 return true;\n             } else {\n                 this.markInvalid(this.blankText);\n                 return false;\n             }\n        }\n        if (value.length < this.minSelections) {\n            this.markInvalid(String.format(this.minSelectionsText, this.minSelections));\n            return false;\n        }\n        if (value.length > this.maxSelections) {\n            this.markInvalid(String.format(this.maxSelectionsText, this.maxSelections));\n            return false;\n        }\n        return true;\n    },\n\n    // inherit docs\n    disable: function(){\n        this.disabled = true;\n        this.hiddenField.dom.disabled = true;\n        this.fs.disable();\n    },\n\n    // inherit docs\n    enable: function(){\n        this.disabled = false;\n        this.hiddenField.dom.disabled = false;\n        this.fs.enable();\n    },\n\n    // inherit docs\n    destroy: function(){\n        Ext.destroy(this.fs, this.dragZone, this.dropZone);\n        Ext.ux.form.MultiSelect.superclass.destroy.call(this);\n    }\n});\n\n\nExt.reg('multiselect', Ext.ux.form.MultiSelect);\n\n//backwards compat\nExt.ux.Multiselect = Ext.ux.form.MultiSelect;\n\n\nExt.ux.form.MultiSelect.DragZone = function(ms, config){\n    this.ms = ms;\n    this.view = ms.view;\n    var ddGroup = config.ddGroup || 'MultiselectDD';\n    var dd;\n    if (Ext.isArray(ddGroup)){\n        dd = ddGroup.shift();\n    } else {\n        dd = ddGroup;\n        ddGroup = null;\n    }\n    Ext.ux.form.MultiSelect.DragZone.superclass.constructor.call(this, this.ms.fs.body, { containerScroll: true, ddGroup: dd });\n    this.setDraggable(ddGroup);\n};\n\nExt.extend(Ext.ux.form.MultiSelect.DragZone, Ext.dd.DragZone, {\n    onInitDrag : function(x, y){\n        var el = Ext.get(this.dragData.ddel.cloneNode(true));\n        this.proxy.update(el.dom);\n        el.setWidth(el.child('em').getWidth());\n        this.onStartDrag(x, y);\n        return true;\n    },\n\n    // private\n    collectSelection: function(data) {\n        data.repairXY = Ext.fly(this.view.getSelectedNodes()[0]).getXY();\n        var i = 0;\n        this.view.store.each(function(rec){\n            if (this.view.isSelected(i)) {\n                var n = this.view.getNode(i);\n                var dragNode = n.cloneNode(true);\n                dragNode.id = Ext.id();\n                data.ddel.appendChild(dragNode);\n                data.records.push(this.view.store.getAt(i));\n                data.viewNodes.push(n);\n            }\n            i++;\n        }, this);\n    },\n\n    // override\n    onEndDrag: function(data, e) {\n        var d = Ext.get(this.dragData.ddel);\n        if (d && d.hasClass(\"multi-proxy\")) {\n            d.remove();\n        }\n    },\n\n    // override\n    getDragData: function(e){\n        var target = this.view.findItemFromChild(e.getTarget());\n        if(target) {\n            if (!this.view.isSelected(target) && !e.ctrlKey && !e.shiftKey) {\n                this.view.select(target);\n                this.ms.setValue(this.ms.getValue());\n            }\n            if (this.view.getSelectionCount() == 0 || e.ctrlKey || e.shiftKey) return false;\n            var dragData = {\n                sourceView: this.view,\n                viewNodes: [],\n                records: []\n            };\n            if (this.view.getSelectionCount() == 1) {\n                var i = this.view.getSelectedIndexes()[0];\n                var n = this.view.getNode(i);\n                dragData.viewNodes.push(dragData.ddel = n);\n                dragData.records.push(this.view.store.getAt(i));\n                dragData.repairXY = Ext.fly(n).getXY();\n            } else {\n                dragData.ddel = document.createElement('div');\n                dragData.ddel.className = 'multi-proxy';\n                this.collectSelection(dragData);\n            }\n            return dragData;\n        }\n        return false;\n    },\n\n    // override the default repairXY.\n    getRepairXY : function(e){\n        return this.dragData.repairXY;\n    },\n\n    // private\n    setDraggable: function(ddGroup){\n        if (!ddGroup) return;\n        if (Ext.isArray(ddGroup)) {\n            Ext.each(ddGroup, this.setDraggable, this);\n            return;\n        }\n        this.addToGroup(ddGroup);\n    }\n});\n\nExt.ux.form.MultiSelect.DropZone = function(ms, config){\n    this.ms = ms;\n    this.view = ms.view;\n    var ddGroup = config.ddGroup || 'MultiselectDD';\n    var dd;\n    if (Ext.isArray(ddGroup)){\n        dd = ddGroup.shift();\n    } else {\n        dd = ddGroup;\n        ddGroup = null;\n    }\n    Ext.ux.form.MultiSelect.DropZone.superclass.constructor.call(this, this.ms.fs.body, { containerScroll: true, ddGroup: dd });\n    this.setDroppable(ddGroup);\n};\n\nExt.extend(Ext.ux.form.MultiSelect.DropZone, Ext.dd.DropZone, {\n    /**\n     * Part of the Ext.dd.DropZone interface. If no target node is found, the\n     * whole Element becomes the target, and this causes the drop gesture to append.\n     */\n    getTargetFromEvent : function(e) {\n        var target = e.getTarget();\n        return target;\n    },\n\n    // private\n    getDropPoint : function(e, n, dd){\n        if (n == this.ms.fs.body.dom) { return \"below\"; }\n        var t = Ext.lib.Dom.getY(n), b = t + n.offsetHeight;\n        var c = t + (b - t) / 2;\n        var y = Ext.lib.Event.getPageY(e);\n        if(y <= c) {\n            return \"above\";\n        }else{\n            return \"below\";\n        }\n    },\n\n    // private\n    isValidDropPoint: function(pt, n, data) {\n        if (!data.viewNodes || (data.viewNodes.length != 1)) {\n            return true;\n        }\n        var d = data.viewNodes[0];\n        if (d == n) {\n            return false;\n        }\n        if ((pt == \"below\") && (n.nextSibling == d)) {\n            return false;\n        }\n        if ((pt == \"above\") && (n.previousSibling == d)) {\n            return false;\n        }\n        return true;\n    },\n\n    // override\n    onNodeEnter : function(n, dd, e, data){\n        return false;\n    },\n\n    // override\n    onNodeOver : function(n, dd, e, data){\n        var dragElClass = this.dropNotAllowed;\n        var pt = this.getDropPoint(e, n, dd);\n        if (this.isValidDropPoint(pt, n, data)) {\n            if (this.ms.appendOnly) {\n                return \"x-tree-drop-ok-below\";\n            }\n\n            // set the insert point style on the target node\n            if (pt) {\n                var targetElClass;\n                if (pt == \"above\"){\n                    dragElClass = n.previousSibling ? \"x-tree-drop-ok-between\" : \"x-tree-drop-ok-above\";\n                    targetElClass = \"x-view-drag-insert-above\";\n                } else {\n                    dragElClass = n.nextSibling ? \"x-tree-drop-ok-between\" : \"x-tree-drop-ok-below\";\n                    targetElClass = \"x-view-drag-insert-below\";\n                }\n                if (this.lastInsertClass != targetElClass){\n                    Ext.fly(n).replaceClass(this.lastInsertClass, targetElClass);\n                    this.lastInsertClass = targetElClass;\n                }\n            }\n        }\n        return dragElClass;\n    },\n\n    // private\n    onNodeOut : function(n, dd, e, data){\n        this.removeDropIndicators(n);\n    },\n\n    // private\n    onNodeDrop : function(n, dd, e, data){\n        if (this.ms.fireEvent(\"drop\", this, n, dd, e, data) === false) {\n            return false;\n        }\n        var pt = this.getDropPoint(e, n, dd);\n        if (n != this.ms.fs.body.dom)\n            n = this.view.findItemFromChild(n);\n\n        if(this.ms.appendOnly) {\n            insertAt = this.view.store.getCount();\n        } else {\n            insertAt = n == this.ms.fs.body.dom ? this.view.store.getCount() - 1 : this.view.indexOf(n);\n            if (pt == \"below\") {\n                insertAt++;\n            }\n        }\n\n        var dir = false;\n\n        // Validate if dragging within the same MultiSelect\n        if (data.sourceView == this.view) {\n            // If the first element to be inserted below is the target node, remove it\n            if (pt == \"below\") {\n                if (data.viewNodes[0] == n) {\n                    data.viewNodes.shift();\n                }\n            } else {  // If the last element to be inserted above is the target node, remove it\n                if (data.viewNodes[data.viewNodes.length - 1] == n) {\n                    data.viewNodes.pop();\n                }\n            }\n\n            // Nothing to drop...\n            if (!data.viewNodes.length) {\n                return false;\n            }\n\n            // If we are moving DOWN, then because a store.remove() takes place first,\n            // the insertAt must be decremented.\n            if (insertAt > this.view.store.indexOf(data.records[0])) {\n                dir = 'down';\n                insertAt--;\n            }\n        }\n\n        for (var i = 0; i < data.records.length; i++) {\n            var r = data.records[i];\n            if (data.sourceView) {\n                data.sourceView.store.remove(r);\n            }\n            this.view.store.insert(dir == 'down' ? insertAt : insertAt++, r);\n            var si = this.view.store.sortInfo;\n            if(si){\n                this.view.store.sort(si.field, si.direction);\n            }\n        }\n        return true;\n    },\n\n    // private\n    removeDropIndicators : function(n){\n        if(n){\n            Ext.fly(n).removeClass([\n                \"x-view-drag-insert-above\",\n                \"x-view-drag-insert-left\",\n                \"x-view-drag-insert-right\",\n                \"x-view-drag-insert-below\"]);\n            this.lastInsertClass = \"_noclass\";\n        }\n    },\n\n    // private\n    setDroppable: function(ddGroup){\n        if (!ddGroup) return;\n        if (Ext.isArray(ddGroup)) {\n            Ext.each(ddGroup, this.setDroppable, this);\n            return;\n        }\n        this.addToGroup(ddGroup);\n    }\n});\n\n/* Fix for Opera, which does not seem to include the map function on Array's */\nif (!Array.prototype.map) {\n    Array.prototype.map = function(fun){\n        var len = this.length;\n        if (typeof fun != 'function') {\n            throw new TypeError();\n        }\n        var res = new Array(len);\n        var thisp = arguments[1];\n        for (var i = 0; i < len; i++) {\n            if (i in this) {\n                res[i] = fun.call(thisp, this[i], i, this);\n            }\n        }\n        return res;\n    };\n}\n\nExt.ns('Ext.ux.data');\n\n/**\n * @class Ext.ux.data.PagingMemoryProxy\n * @extends Ext.data.MemoryProxy\n * <p>Paging Memory Proxy, allows to use paging grid with in memory dataset</p>\n */\nExt.ux.data.PagingMemoryProxy = Ext.extend(Ext.data.MemoryProxy, {\n    constructor : function(data){\n        Ext.ux.data.PagingMemoryProxy.superclass.constructor.call(this);\n        this.data = data;\n    },\n    doRequest : function(action, rs, params, reader, callback, scope, options){\n        params = params ||\n        {};\n        var result;\n        try {\n            result = reader.readRecords(this.data);\n        } \n        catch (e) {\n            this.fireEvent('loadexception', this, options, null, e);\n            callback.call(scope, null, options, false);\n            return;\n        }\n        \n        // filtering\n        if (params.filter !== undefined) {\n            result.records = result.records.filter(function(el){\n                if (typeof(el) == 'object') {\n                    var att = params.filterCol || 0;\n                    return String(el.data[att]).match(params.filter) ? true : false;\n                }\n                else {\n                    return String(el).match(params.filter) ? true : false;\n                }\n            });\n            result.totalRecords = result.records.length;\n        }\n        \n        // sorting\n        if (params.sort !== undefined) {\n            // use integer as params.sort to specify column, since arrays are not named\n            // params.sort=0; would also match a array without columns\n            var dir = String(params.dir).toUpperCase() == 'DESC' ? -1 : 1;\n            var fn = function(v1, v2){\n                return v1 > v2 ? 1 : (v1 < v2 ? -1 : 0);\n            };\n            result.records.sort(function(a, b){\n                var v = 0;\n                if (typeof(a) == 'object') {\n                    v = fn(a.data[params.sort], b.data[params.sort]) * dir;\n                }\n                else {\n                    v = fn(a, b) * dir;\n                }\n                if (v == 0) {\n                    v = (a.index < b.index ? -1 : 1);\n                }\n                return v;\n            });\n        }\n        // paging (use undefined cause start can also be 0 (thus false))\n        if (params.start !== undefined && params.limit !== undefined) {\n            result.records = result.records.slice(params.start, params.start + params.limit);\n        }\n        callback.call(scope, result, options, true);\n    }\n});\n\n//backwards compat.\nExt.data.PagingMemoryProxy = Ext.ux.data.PagingMemoryProxy;\nExt.ux.PanelResizer = Ext.extend(Ext.util.Observable, {\n    minHeight: 0,\n    maxHeight:10000000,\n\n    constructor: function(config){\n        Ext.apply(this, config);\n        this.events = {};\n        Ext.ux.PanelResizer.superclass.constructor.call(this, config);\n    },\n\n    init : function(p){\n        this.panel = p;\n\n        if(this.panel.elements.indexOf('footer')==-1){\n            p.elements += ',footer';\n        }\n        p.on('render', this.onRender, this);\n    },\n\n    onRender : function(p){\n        this.handle = p.footer.createChild({cls:'x-panel-resize'});\n\n        this.tracker = new Ext.dd.DragTracker({\n            onStart: this.onDragStart.createDelegate(this),\n            onDrag: this.onDrag.createDelegate(this),\n            onEnd: this.onDragEnd.createDelegate(this),\n            tolerance: 3,\n            autoStart: 300\n        });\n        this.tracker.initEl(this.handle);\n        p.on('beforedestroy', this.tracker.destroy, this.tracker);\n    },\n\n\t// private\n    onDragStart: function(e){\n        this.dragging = true;\n        this.startHeight = this.panel.el.getHeight();\n        this.fireEvent('dragstart', this, e);\n    },\n\n\t// private\n    onDrag: function(e){\n        this.panel.setHeight((this.startHeight-this.tracker.getOffset()[1]).constrain(this.minHeight, this.maxHeight));\n        this.fireEvent('drag', this, e);\n    },\n\n\t// private\n    onDragEnd: function(e){\n        this.dragging = false;\n        this.fireEvent('dragend', this, e);\n    }\n});\nExt.preg('panelresizer', Ext.ux.PanelResizer);Ext.ux.Portal = Ext.extend(Ext.Panel, {\n    layout : 'column',\n    autoScroll : true,\n    cls : 'x-portal',\n    defaultType : 'portalcolumn',\n    \n    initComponent : function(){\n        Ext.ux.Portal.superclass.initComponent.call(this);\n        this.addEvents({\n            validatedrop:true,\n            beforedragover:true,\n            dragover:true,\n            beforedrop:true,\n            drop:true\n        });\n    },\n\n    initEvents : function(){\n        Ext.ux.Portal.superclass.initEvents.call(this);\n        this.dd = new Ext.ux.Portal.DropZone(this, this.dropConfig);\n    },\n    \n    beforeDestroy : function() {\n        if(this.dd){\n            this.dd.unreg();\n        }\n        Ext.ux.Portal.superclass.beforeDestroy.call(this);\n    }\n});\n\nExt.reg('portal', Ext.ux.Portal);\n\nExt.ux.Portal.DropZone = Ext.extend(Ext.dd.DropTarget, {\n    \n    constructor : function(portal, cfg){\n        this.portal = portal;\n        Ext.dd.ScrollManager.register(portal.body);\n        Ext.ux.Portal.DropZone.superclass.constructor.call(this, portal.bwrap.dom, cfg);\n        portal.body.ddScrollConfig = this.ddScrollConfig;\n    },\n    \n    ddScrollConfig : {\n        vthresh: 50,\n        hthresh: -1,\n        animate: true,\n        increment: 200\n    },\n\n    createEvent : function(dd, e, data, col, c, pos){\n        return {\n            portal: this.portal,\n            panel: data.panel,\n            columnIndex: col,\n            column: c,\n            position: pos,\n            data: data,\n            source: dd,\n            rawEvent: e,\n            status: this.dropAllowed\n        };\n    },\n\n    notifyOver : function(dd, e, data){\n        var xy = e.getXY(), portal = this.portal, px = dd.proxy;\n\n        // case column widths\n        if(!this.grid){\n            this.grid = this.getGrid();\n        }\n\n        // handle case scroll where scrollbars appear during drag\n        var cw = portal.body.dom.clientWidth;\n        if(!this.lastCW){\n            this.lastCW = cw;\n        }else if(this.lastCW != cw){\n            this.lastCW = cw;\n            portal.doLayout();\n            this.grid = this.getGrid();\n        }\n\n        // determine column\n        var col = 0, xs = this.grid.columnX, cmatch = false;\n        for(var len = xs.length; col < len; col++){\n            if(xy[0] < (xs[col].x + xs[col].w)){\n                cmatch = true;\n                break;\n            }\n        }\n        // no match, fix last index\n        if(!cmatch){\n            col--;\n        }\n\n        // find insert position\n        var p, match = false, pos = 0,\n            c = portal.items.itemAt(col),\n            items = c.items.items, overSelf = false;\n\n        for(var len = items.length; pos < len; pos++){\n            p = items[pos];\n            var h = p.el.getHeight();\n            if(h === 0){\n                overSelf = true;\n            }\n            else if((p.el.getY()+(h/2)) > xy[1]){\n                match = true;\n                break;\n            }\n        }\n\n        pos = (match && p ? pos : c.items.getCount()) + (overSelf ? -1 : 0);\n        var overEvent = this.createEvent(dd, e, data, col, c, pos);\n\n        if(portal.fireEvent('validatedrop', overEvent) !== false &&\n           portal.fireEvent('beforedragover', overEvent) !== false){\n\n            // make sure proxy width is fluid\n            px.getProxy().setWidth('auto');\n\n            if(p){\n                px.moveProxy(p.el.dom.parentNode, match ? p.el.dom : null);\n            }else{\n                px.moveProxy(c.el.dom, null);\n            }\n\n            this.lastPos = {c: c, col: col, p: overSelf || (match && p) ? pos : false};\n            this.scrollPos = portal.body.getScroll();\n\n            portal.fireEvent('dragover', overEvent);\n\n            return overEvent.status;\n        }else{\n            return overEvent.status;\n        }\n\n    },\n\n    notifyOut : function(){\n        delete this.grid;\n    },\n\n    notifyDrop : function(dd, e, data){\n        delete this.grid;\n        if(!this.lastPos){\n            return;\n        }\n        var c = this.lastPos.c, \n            col = this.lastPos.col, \n            pos = this.lastPos.p,\n            panel = dd.panel,\n            dropEvent = this.createEvent(dd, e, data, col, c,\n                pos !== false ? pos : c.items.getCount());\n\n        if(this.portal.fireEvent('validatedrop', dropEvent) !== false &&\n           this.portal.fireEvent('beforedrop', dropEvent) !== false){\n\n            dd.proxy.getProxy().remove();\n            panel.el.dom.parentNode.removeChild(dd.panel.el.dom);\n            \n            if(pos !== false){\n                c.insert(pos, panel);\n            }else{\n                c.add(panel);\n            }\n            \n            c.doLayout();\n\n            this.portal.fireEvent('drop', dropEvent);\n\n            // scroll position is lost on drop, fix it\n            var st = this.scrollPos.top;\n            if(st){\n                var d = this.portal.body.dom;\n                setTimeout(function(){\n                    d.scrollTop = st;\n                }, 10);\n            }\n\n        }\n        delete this.lastPos;\n    },\n\n    // internal cache of body and column coords\n    getGrid : function(){\n        var box = this.portal.bwrap.getBox();\n        box.columnX = [];\n        this.portal.items.each(function(c){\n             box.columnX.push({x: c.el.getX(), w: c.el.getWidth()});\n        });\n        return box;\n    },\n\n    // unregister the dropzone from ScrollManager\n    unreg: function() {\n        Ext.dd.ScrollManager.unregister(this.portal.body);\n        Ext.ux.Portal.DropZone.superclass.unreg.call(this);\n    }\n});\nExt.ux.PortalColumn = Ext.extend(Ext.Container, {\n    layout : 'anchor',\n    //autoEl : 'div',//already defined by Ext.Component\n    defaultType : 'portlet',\n    cls : 'x-portal-column'\n});\n\nExt.reg('portalcolumn', Ext.ux.PortalColumn);\nExt.ux.Portlet = Ext.extend(Ext.Panel, {\n    anchor : '100%',\n    frame : true,\n    collapsible : true,\n    draggable : true,\n    cls : 'x-portlet'\n});\n\nExt.reg('portlet', Ext.ux.Portlet);\n/**\n* @class Ext.ux.ProgressBarPager\n* @extends Object \n* Plugin (ptype = 'tabclosemenu') for displaying a progressbar inside of a paging toolbar instead of plain text\n* \n* @ptype progressbarpager \n* @constructor\n* Create a new ItemSelector\n* @param {Object} config Configuration options\n* @xtype itemselector \n*/\nExt.ux.ProgressBarPager  = Ext.extend(Object, {\n\t/**\n \t* @cfg {Integer} progBarWidth\n \t* <p>The default progress bar width.  Default is 225.</p>\n\t*/\n\tprogBarWidth   : 225,\n\t/**\n \t* @cfg {String} defaultText\n\t* <p>The text to display while the store is loading.  Default is 'Loading...'</p>\n \t*/\n\tdefaultText    : 'Loading...',\n    \t/**\n \t* @cfg {Object} defaultAnimCfg \n \t* <p>A {@link Ext.Fx Ext.Fx} configuration object.  Default is  { duration : 1, easing : 'bounceOut' }.</p>\n \t*/\n\tdefaultAnimCfg : {\n\t\tduration   : 1,\n\t\teasing     : 'bounceOut'\t\n\t},\t\t\t\t\t\t\t\t\t\t\t\t  \n\tconstructor : function(config) {\n\t\tif (config) {\n\t\t\tExt.apply(this, config);\n\t\t}\n\t},\n\t//public\n\tinit : function (parent) {\n\t\t\n\t\tif(parent.displayInfo){\n\t\t\tthis.parent = parent;\n\t\t\tvar ind  = parent.items.indexOf(parent.displayItem);\n\t\t\tparent.remove(parent.displayItem, true);\n\t\t\tthis.progressBar = new Ext.ProgressBar({\n\t\t\t\ttext    : this.defaultText,\n\t\t\t\twidth   : this.progBarWidth,\n\t\t\t\tanimate :  this.defaultAnimCfg\n\t\t\t});\t\t\t\t\t\n\t\t   \n\t\t\tparent.displayItem = this.progressBar;\n\t\t\t\n\t\t\tparent.add(parent.displayItem);\t\n\t\t\tparent.doLayout();\n\t\t\tExt.apply(parent, this.parentOverrides);\t\t\n\t\t\t\n\t\t\tthis.progressBar.on('render', function(pb) {\n                pb.mon(pb.getEl().applyStyles('cursor:pointer'), 'click', this.handleProgressBarClick, this);\n            }, this, {single: true});\n\t\t\t\t\t\t\n\t\t}\n\t\t  \n\t},\n\t// private\n\t// This method handles the click for the progress bar\n\thandleProgressBarClick : function(e){\n\t\tvar parent = this.parent,\n\t\t    displayItem = parent.displayItem,\n\t\t    box = this.progressBar.getBox(),\n\t\t    xy = e.getXY(),\n\t\t    position = xy[0]-box.x,\n\t\t    pages = Math.ceil(parent.store.getTotalCount()/parent.pageSize),\n\t\t    newpage = Math.ceil(position/(displayItem.width/pages));\n            \n\t\tparent.changePage(newpage);\n\t},\n\t\n\t// private, overriddes\n\tparentOverrides  : {\n\t\t// private\n\t\t// This method updates the information via the progress bar.\n\t\tupdateInfo : function(){\n\t\t\tif(this.displayItem){\n\t\t\t\tvar count = this.store.getCount(),\n\t\t\t\t    pgData = this.getPageData(),\n\t\t\t\t    pageNum = this.readPage(pgData),\n\t\t\t\t    msg = count == 0 ?\n\t\t\t\t\tthis.emptyMsg :\n\t\t\t\t\tString.format(\n\t\t\t\t\t\tthis.displayMsg,\n\t\t\t\t\t\tthis.cursor+1, this.cursor+count, this.store.getTotalCount()\n\t\t\t\t\t);\n\t\t\t\t\t\n\t\t\t\tpageNum = pgData.activePage; ;\t\n\t\t\t\t\n\t\t\t\tvar pct\t= pageNum / pgData.pages;\t\n\t\t\t\t\n\t\t\t\tthis.displayItem.updateProgress(pct, msg, this.animate || this.defaultAnimConfig);\n\t\t\t}\n\t\t}\n\t}\n});\nExt.preg('progressbarpager', Ext.ux.ProgressBarPager);\n\nExt.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.RowEditor\n * @extends Ext.Panel\n * Plugin (ptype = 'roweditor') that adds the ability to rapidly edit full rows in a grid.\n * A validation mode may be enabled which uses AnchorTips to notify the user of all\n * validation errors at once.\n *\n * @ptype roweditor\n */\nExt.ux.grid.RowEditor = Ext.extend(Ext.Panel, {\n    floating: true,\n    shadow: false,\n    layout: 'hbox',\n    cls: 'x-small-editor',\n    buttonAlign: 'center',\n    baseCls: 'x-row-editor',\n    elements: 'header,footer,body',\n    frameWidth: 5,\n    buttonPad: 3,\n    clicksToEdit: 'auto',\n    monitorValid: true,\n    focusDelay: 250,\n    errorSummary: true,\n\n    saveText: 'Save',\n    cancelText: 'Cancel',\n    commitChangesText: 'You need to commit or cancel your changes',\n    errorText: 'Errors',\n\n    defaults: {\n        normalWidth: true\n    },\n\n    initComponent: function(){\n        Ext.ux.grid.RowEditor.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event beforeedit\n             * Fired before the row editor is activated.\n             * If the listener returns <tt>false</tt> the editor will not be activated.\n             * @param {Ext.ux.grid.RowEditor} roweditor This object\n             * @param {Number} rowIndex The rowIndex of the row just edited\n             */\n            'beforeedit',\n            /**\n             * @event canceledit\n             * Fired when the editor is cancelled.\n             * @param {Ext.ux.grid.RowEditor} roweditor This object\n             * @param {Boolean} forced True if the cancel button is pressed, false is the editor was invalid.\n             */\n            'canceledit',\n            /**\n             * @event validateedit\n             * Fired after a row is edited and passes validation.\n             * If the listener returns <tt>false</tt> changes to the record will not be set.\n             * @param {Ext.ux.grid.RowEditor} roweditor This object\n             * @param {Object} changes Object with changes made to the record.\n             * @param {Ext.data.Record} r The Record that was edited.\n             * @param {Number} rowIndex The rowIndex of the row just edited\n             */\n            'validateedit',\n            /**\n             * @event afteredit\n             * Fired after a row is edited and passes validation.  This event is fired\n             * after the store's update event is fired with this edit.\n             * @param {Ext.ux.grid.RowEditor} roweditor This object\n             * @param {Object} changes Object with changes made to the record.\n             * @param {Ext.data.Record} r The Record that was edited.\n             * @param {Number} rowIndex The rowIndex of the row just edited\n             */\n            'afteredit'\n        );\n    },\n\n    init: function(grid){\n        this.grid = grid;\n        this.ownerCt = grid;\n        if(this.clicksToEdit === 2){\n            grid.on('rowdblclick', this.onRowDblClick, this);\n        }else{\n            grid.on('rowclick', this.onRowClick, this);\n            if(Ext.isIE){\n                grid.on('rowdblclick', this.onRowDblClick, this);\n            }\n        }\n\n        // stopEditing without saving when a record is removed from Store.\n        grid.getStore().on('remove', function() {\n            this.stopEditing(false);\n        },this);\n\n        grid.on({\n            scope: this,\n            keydown: this.onGridKey,\n            columnresize: this.verifyLayout,\n            columnmove: this.refreshFields,\n            reconfigure: this.refreshFields,\n            beforedestroy : this.beforedestroy,\n            destroy : this.destroy,\n            bodyscroll: {\n                buffer: 250,\n                fn: this.positionButtons\n            }\n        });\n        grid.getColumnModel().on('hiddenchange', this.verifyLayout, this, {delay:1});\n        grid.getView().on('refresh', this.stopEditing.createDelegate(this, []));\n    },\n\n    beforedestroy: function() {\n        this.stopMonitoring();\n        this.grid.getStore().un('remove', this.onStoreRemove, this);\n        this.stopEditing(false);\n        Ext.destroy(this.btns, this.tooltip);\n    },\n\n    refreshFields: function(){\n        this.initFields();\n        this.verifyLayout();\n    },\n\n    isDirty: function(){\n        var dirty;\n        this.items.each(function(f){\n            if(String(this.values[f.id]) !== String(f.getValue())){\n                dirty = true;\n                return false;\n            }\n        }, this);\n        return dirty;\n    },\n\n    startEditing: function(rowIndex, doFocus){\n        if(this.editing && this.isDirty()){\n            this.showTooltip(this.commitChangesText);\n            return;\n        }\n        if(Ext.isObject(rowIndex)){\n            rowIndex = this.grid.getStore().indexOf(rowIndex);\n        }\n        if(this.fireEvent('beforeedit', this, rowIndex) !== false){\n            this.editing = true;\n            var g = this.grid, view = g.getView(),\n                row = view.getRow(rowIndex),\n                record = g.store.getAt(rowIndex);\n\n            this.record = record;\n            this.rowIndex = rowIndex;\n            this.values = {};\n            if(!this.rendered){\n                this.render(view.getEditorParent());\n            }\n            var w = Ext.fly(row).getWidth();\n            this.setSize(w);\n            if(!this.initialized){\n                this.initFields();\n            }\n            var cm = g.getColumnModel(), fields = this.items.items, f, val;\n            for(var i = 0, len = cm.getColumnCount(); i < len; i++){\n                val = this.preEditValue(record, cm.getDataIndex(i));\n                f = fields[i];\n                f.setValue(val);\n                this.values[f.id] = Ext.isEmpty(val) ? '' : val;\n            }\n            this.verifyLayout(true);\n            if(!this.isVisible()){\n                this.setPagePosition(Ext.fly(row).getXY());\n            } else{\n                this.el.setXY(Ext.fly(row).getXY(), {duration:0.15});\n            }\n            if(!this.isVisible()){\n                this.show().doLayout();\n            }\n            if(doFocus !== false){\n                this.doFocus.defer(this.focusDelay, this);\n            }\n        }\n    },\n\n    stopEditing : function(saveChanges){\n        this.editing = false;\n        if(!this.isVisible()){\n            return;\n        }\n        if(saveChanges === false || !this.isValid()){\n            this.hide();\n            this.fireEvent('canceledit', this, saveChanges === false);\n            return;\n        }\n        var changes = {},\n            r = this.record,\n            hasChange = false,\n            cm = this.grid.colModel,\n            fields = this.items.items;\n        for(var i = 0, len = cm.getColumnCount(); i < len; i++){\n            if(!cm.isHidden(i)){\n                var dindex = cm.getDataIndex(i);\n                if(!Ext.isEmpty(dindex)){\n                    var oldValue = r.data[dindex],\n                        value = this.postEditValue(fields[i].getValue(), oldValue, r, dindex);\n                    if(String(oldValue) !== String(value)){\n                        changes[dindex] = value;\n                        hasChange = true;\n                    }\n                }\n            }\n        }\n        if(hasChange && this.fireEvent('validateedit', this, changes, r, this.rowIndex) !== false){\n            r.beginEdit();\n            Ext.iterate(changes, function(name, value){\n                r.set(name, value);\n            });\n            r.endEdit();\n            this.fireEvent('afteredit', this, changes, r, this.rowIndex);\n        } else {\n            this.fireEvent('canceledit', this, false);\n        }\n        this.hide();\n    },\n\n    verifyLayout: function(force){\n        if(this.el && (this.isVisible() || force === true)){\n            var row = this.grid.getView().getRow(this.rowIndex);\n            this.setSize(Ext.fly(row).getWidth(), Ext.isIE ? Ext.fly(row).getHeight() + 9 : undefined);\n            var cm = this.grid.colModel, fields = this.items.items;\n            for(var i = 0, len = cm.getColumnCount(); i < len; i++){\n                if(!cm.isHidden(i)){\n                    var adjust = 0;\n                    if(i === (len - 1)){\n                        adjust += 3; // outer padding\n                    } else{\n                        adjust += 1;\n                    }\n                    fields[i].show();\n                    fields[i].setWidth(cm.getColumnWidth(i) - adjust);\n                } else{\n                    fields[i].hide();\n                }\n            }\n            this.doLayout();\n            this.positionButtons();\n        }\n    },\n\n    slideHide : function(){\n        this.hide();\n    },\n\n    initFields: function(){\n        var cm = this.grid.getColumnModel(), pm = Ext.layout.ContainerLayout.prototype.parseMargins;\n        this.removeAll(false);\n        for(var i = 0, len = cm.getColumnCount(); i < len; i++){\n            var c = cm.getColumnAt(i),\n                ed = c.getEditor();\n            if(!ed){\n                ed = c.displayEditor || new Ext.form.DisplayField();\n            }\n            if(i == 0){\n                ed.margins = pm('0 1 2 1');\n            } else if(i == len - 1){\n                ed.margins = pm('0 0 2 1');\n            } else{\n                if (Ext.isIE) {\n                    ed.margins = pm('0 0 2 0');\n                }\n                else {\n                    ed.margins = pm('0 1 2 0');\n                }\n            }\n            ed.setWidth(cm.getColumnWidth(i));\n            ed.column = c;\n            if(ed.ownerCt !== this){\n                ed.on('focus', this.ensureVisible, this);\n                ed.on('specialkey', this.onKey, this);\n            }\n            this.insert(i, ed);\n        }\n        this.initialized = true;\n    },\n\n    onKey: function(f, e){\n        if(e.getKey() === e.ENTER){\n            this.stopEditing(true);\n            e.stopPropagation();\n        }\n    },\n\n    onGridKey: function(e){\n        if(e.getKey() === e.ENTER && !this.isVisible()){\n            var r = this.grid.getSelectionModel().getSelected();\n            if(r){\n                var index = this.grid.store.indexOf(r);\n                this.startEditing(index);\n                e.stopPropagation();\n            }\n        }\n    },\n\n    ensureVisible: function(editor){\n        if(this.isVisible()){\n             this.grid.getView().ensureVisible(this.rowIndex, this.grid.colModel.getIndexById(editor.column.id), true);\n        }\n    },\n\n    onRowClick: function(g, rowIndex, e){\n        if(this.clicksToEdit == 'auto'){\n            var li = this.lastClickIndex;\n            this.lastClickIndex = rowIndex;\n            if(li != rowIndex && !this.isVisible()){\n                return;\n            }\n        }\n        this.startEditing(rowIndex, false);\n        this.doFocus.defer(this.focusDelay, this, [e.getPoint()]);\n    },\n\n    onRowDblClick: function(g, rowIndex, e){\n        this.startEditing(rowIndex, false);\n        this.doFocus.defer(this.focusDelay, this, [e.getPoint()]);\n    },\n\n    onRender: function(){\n        Ext.ux.grid.RowEditor.superclass.onRender.apply(this, arguments);\n        this.el.swallowEvent(['keydown', 'keyup', 'keypress']);\n        this.btns = new Ext.Panel({\n            baseCls: 'x-plain',\n            cls: 'x-btns',\n            elements:'body',\n            layout: 'table',\n            width: (this.minButtonWidth * 2) + (this.frameWidth * 2) + (this.buttonPad * 4), // width must be specified for IE\n            items: [{\n                ref: 'saveBtn',\n                itemId: 'saveBtn',\n                xtype: 'button',\n                text: this.saveText,\n                width: this.minButtonWidth,\n                handler: this.stopEditing.createDelegate(this, [true])\n            }, {\n                xtype: 'button',\n                text: this.cancelText,\n                width: this.minButtonWidth,\n                handler: this.stopEditing.createDelegate(this, [false])\n            }]\n        });\n        this.btns.render(this.bwrap);\n    },\n\n    afterRender: function(){\n        Ext.ux.grid.RowEditor.superclass.afterRender.apply(this, arguments);\n        this.positionButtons();\n        if(this.monitorValid){\n            this.startMonitoring();\n        }\n    },\n\n    onShow: function(){\n        if(this.monitorValid){\n            this.startMonitoring();\n        }\n        Ext.ux.grid.RowEditor.superclass.onShow.apply(this, arguments);\n    },\n\n    onHide: function(){\n        Ext.ux.grid.RowEditor.superclass.onHide.apply(this, arguments);\n        this.stopMonitoring();\n        this.grid.getView().focusRow(this.rowIndex);\n    },\n\n    positionButtons: function(){\n        if(this.btns){\n            var g = this.grid,\n                h = this.el.dom.clientHeight,\n                view = g.getView(),\n                scroll = view.scroller.dom.scrollLeft,\n                bw = this.btns.getWidth(),\n                width = Math.min(g.getWidth(), g.getColumnModel().getTotalWidth());\n\n            this.btns.el.shift({left: (width/2)-(bw/2)+scroll, top: h - 2, stopFx: true, duration:0.2});\n        }\n    },\n\n    // private\n    preEditValue : function(r, field){\n        var value = r.data[field];\n        return this.autoEncode && typeof value === 'string' ? Ext.util.Format.htmlDecode(value) : value;\n    },\n\n    // private\n    postEditValue : function(value, originalValue, r, field){\n        return this.autoEncode && typeof value == 'string' ? Ext.util.Format.htmlEncode(value) : value;\n    },\n\n    doFocus: function(pt){\n        if(this.isVisible()){\n            var index = 0,\n                cm = this.grid.getColumnModel(),\n                c;\n            if(pt){\n                index = this.getTargetColumnIndex(pt);\n            }\n            for(var i = index||0, len = cm.getColumnCount(); i < len; i++){\n                c = cm.getColumnAt(i);\n                if(!c.hidden && c.getEditor()){\n                    c.getEditor().focus();\n                    break;\n                }\n            }\n        }\n    },\n\n    getTargetColumnIndex: function(pt){\n        var grid = this.grid,\n            v = grid.view,\n            x = pt.left,\n            cms = grid.colModel.config,\n            i = 0,\n            match = false;\n        for(var len = cms.length, c; c = cms[i]; i++){\n            if(!c.hidden){\n                if(Ext.fly(v.getHeaderCell(i)).getRegion().right >= x){\n                    match = i;\n                    break;\n                }\n            }\n        }\n        return match;\n    },\n\n    startMonitoring : function(){\n        if(!this.bound && this.monitorValid){\n            this.bound = true;\n            Ext.TaskMgr.start({\n                run : this.bindHandler,\n                interval : this.monitorPoll || 200,\n                scope: this\n            });\n        }\n    },\n\n    stopMonitoring : function(){\n        this.bound = false;\n        if(this.tooltip){\n            this.tooltip.hide();\n        }\n    },\n\n    isValid: function(){\n        var valid = true;\n        this.items.each(function(f){\n            if(!f.isValid(true)){\n                valid = false;\n                return false;\n            }\n        });\n        return valid;\n    },\n\n    // private\n    bindHandler : function(){\n        if(!this.bound){\n            return false; // stops binding\n        }\n        var valid = this.isValid();\n        if(!valid && this.errorSummary){\n            this.showTooltip(this.getErrorText().join(''));\n        }\n        this.btns.saveBtn.setDisabled(!valid);\n        this.fireEvent('validation', this, valid);\n    },\n\n    lastVisibleColumn : function() {\n        var i = this.items.getCount() - 1,\n            c;\n        for(; i >= 0; i--) {\n            c = this.items.items[i];\n            if (!c.hidden) {\n                return c;\n            }\n        }\n    },\n\n    showTooltip: function(msg){\n        var t = this.tooltip;\n        if(!t){\n            t = this.tooltip = new Ext.ToolTip({\n                maxWidth: 600,\n                cls: 'errorTip',\n                width: 300,\n                title: this.errorText,\n                autoHide: false,\n                anchor: 'left',\n                anchorToTarget: true,\n                mouseOffset: [40,0]\n            });\n        }\n        var v = this.grid.getView(),\n            top = parseInt(this.el.dom.style.top, 10),\n            scroll = v.scroller.dom.scrollTop,\n            h = this.el.getHeight();\n\n        if(top + h >= scroll){\n            t.initTarget(this.lastVisibleColumn().getEl());\n            if(!t.rendered){\n                t.show();\n                t.hide();\n            }\n            t.body.update(msg);\n            t.doAutoWidth(20);\n            t.show();\n        }else if(t.rendered){\n            t.hide();\n        }\n    },\n\n    getErrorText: function(){\n        var data = ['<ul>'];\n        this.items.each(function(f){\n            if(!f.isValid(true)){\n                data.push('<li>', f.getActiveError(), '</li>');\n            }\n        });\n        data.push('</ul>');\n        return data;\n    }\n});\nExt.preg('roweditor', Ext.ux.grid.RowEditor);\nExt.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.RowExpander\n * @extends Ext.util.Observable\n * Plugin (ptype = 'rowexpander') that adds the ability to have a Column in a grid which enables\n * a second row body which expands/contracts.  The expand/contract behavior is configurable to react\n * on clicking of the column, double click of the row, and/or hitting enter while a row is selected.\n *\n * @ptype rowexpander\n */\nExt.ux.grid.RowExpander = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Boolean} expandOnEnter\n     * <tt>true</tt> to toggle selected row(s) between expanded/collapsed when the enter\n     * key is pressed (defaults to <tt>true</tt>).\n     */\n    expandOnEnter : true,\n    /**\n     * @cfg {Boolean} expandOnDblClick\n     * <tt>true</tt> to toggle a row between expanded/collapsed when double clicked\n     * (defaults to <tt>true</tt>).\n     */\n    expandOnDblClick : true,\n\n    header : '',\n    width : 20,\n    sortable : false,\n    fixed : true,\n    hideable: false,\n    menuDisabled : true,\n    dataIndex : '',\n    id : 'expander',\n    lazyRender : true,\n    enableCaching : true,\n\n    constructor: function(config){\n        Ext.apply(this, config);\n\n        this.addEvents({\n            /**\n             * @event beforeexpand\n             * Fires before the row expands. Have the listener return false to prevent the row from expanding.\n             * @param {Object} this RowExpander object.\n             * @param {Object} Ext.data.Record Record for the selected row.\n             * @param {Object} body body element for the secondary row.\n             * @param {Number} rowIndex The current row index.\n             */\n            beforeexpand: true,\n            /**\n             * @event expand\n             * Fires after the row expands.\n             * @param {Object} this RowExpander object.\n             * @param {Object} Ext.data.Record Record for the selected row.\n             * @param {Object} body body element for the secondary row.\n             * @param {Number} rowIndex The current row index.\n             */\n            expand: true,\n            /**\n             * @event beforecollapse\n             * Fires before the row collapses. Have the listener return false to prevent the row from collapsing.\n             * @param {Object} this RowExpander object.\n             * @param {Object} Ext.data.Record Record for the selected row.\n             * @param {Object} body body element for the secondary row.\n             * @param {Number} rowIndex The current row index.\n             */\n            beforecollapse: true,\n            /**\n             * @event collapse\n             * Fires after the row collapses.\n             * @param {Object} this RowExpander object.\n             * @param {Object} Ext.data.Record Record for the selected row.\n             * @param {Object} body body element for the secondary row.\n             * @param {Number} rowIndex The current row index.\n             */\n            collapse: true\n        });\n\n        Ext.ux.grid.RowExpander.superclass.constructor.call(this);\n\n        if(this.tpl){\n            if(typeof this.tpl == 'string'){\n                this.tpl = new Ext.Template(this.tpl);\n            }\n            this.tpl.compile();\n        }\n\n        this.state = {};\n        this.bodyContent = {};\n    },\n\n    getRowClass : function(record, rowIndex, p, ds){\n        p.cols = p.cols-1;\n        var content = this.bodyContent[record.id];\n        if(!content && !this.lazyRender){\n            content = this.getBodyContent(record, rowIndex);\n        }\n        if(content){\n            p.body = content;\n        }\n        return this.state[record.id] ? 'x-grid3-row-expanded' : 'x-grid3-row-collapsed';\n    },\n\n    init : function(grid){\n        this.grid = grid;\n\n        var view = grid.getView();\n        view.getRowClass = this.getRowClass.createDelegate(this);\n\n        view.enableRowBody = true;\n\n\n        grid.on('render', this.onRender, this);\n        grid.on('destroy', this.onDestroy, this);\n    },\n\n    // @private\n    onRender: function() {\n        var grid = this.grid;\n        var mainBody = grid.getView().mainBody;\n        mainBody.on('mousedown', this.onMouseDown, this, {delegate: '.x-grid3-row-expander'});\n        if (this.expandOnEnter) {\n            this.keyNav = new Ext.KeyNav(this.grid.getGridEl(), {\n                'enter' : this.onEnter,\n                scope: this\n            });\n        }\n        if (this.expandOnDblClick) {\n            grid.on('rowdblclick', this.onRowDblClick, this);\n        }\n    },\n    \n    // @private    \n    onDestroy: function() {\n        if(this.keyNav){\n            this.keyNav.disable();\n            delete this.keyNav;\n        }\n        /*\n         * A majority of the time, the plugin will be destroyed along with the grid,\n         * which means the mainBody won't be available. On the off chance that the plugin\n         * isn't destroyed with the grid, take care of removing the listener.\n         */\n        var mainBody = this.grid.getView().mainBody;\n        if(mainBody){\n            mainBody.un('mousedown', this.onMouseDown, this);\n        }\n    },\n    // @private\n    onRowDblClick: function(grid, rowIdx, e) {\n        this.toggleRow(rowIdx);\n    },\n\n    onEnter: function(e) {\n        var g = this.grid;\n        var sm = g.getSelectionModel();\n        var sels = sm.getSelections();\n        for (var i = 0, len = sels.length; i < len; i++) {\n            var rowIdx = g.getStore().indexOf(sels[i]);\n            this.toggleRow(rowIdx);\n        }\n    },\n\n    getBodyContent : function(record, index){\n        if(!this.enableCaching){\n            return this.tpl.apply(record.data);\n        }\n        var content = this.bodyContent[record.id];\n        if(!content){\n            content = this.tpl.apply(record.data);\n            this.bodyContent[record.id] = content;\n        }\n        return content;\n    },\n\n    onMouseDown : function(e, t){\n        e.stopEvent();\n        var row = e.getTarget('.x-grid3-row');\n        this.toggleRow(row);\n    },\n\n    renderer : function(v, p, record){\n        p.cellAttr = 'rowspan=\"2\"';\n        return '<div class=\"x-grid3-row-expander\">&#160;</div>';\n    },\n\n    beforeExpand : function(record, body, rowIndex){\n        if(this.fireEvent('beforeexpand', this, record, body, rowIndex) !== false){\n            if(this.tpl && this.lazyRender){\n                body.innerHTML = this.getBodyContent(record, rowIndex);\n            }\n            return true;\n        }else{\n            return false;\n        }\n    },\n\n    toggleRow : function(row){\n        if(typeof row == 'number'){\n            row = this.grid.view.getRow(row);\n        }\n        this[Ext.fly(row).hasClass('x-grid3-row-collapsed') ? 'expandRow' : 'collapseRow'](row);\n    },\n\n    expandRow : function(row){\n        if(typeof row == 'number'){\n            row = this.grid.view.getRow(row);\n        }\n        var record = this.grid.store.getAt(row.rowIndex);\n        var body = Ext.DomQuery.selectNode('tr:nth(2) div.x-grid3-row-body', row);\n        if(this.beforeExpand(record, body, row.rowIndex)){\n            this.state[record.id] = true;\n            Ext.fly(row).replaceClass('x-grid3-row-collapsed', 'x-grid3-row-expanded');\n            this.fireEvent('expand', this, record, body, row.rowIndex);\n        }\n    },\n\n    collapseRow : function(row){\n        if(typeof row == 'number'){\n            row = this.grid.view.getRow(row);\n        }\n        var record = this.grid.store.getAt(row.rowIndex);\n        var body = Ext.fly(row).child('tr:nth(1) div.x-grid3-row-body', true);\n        if(this.fireEvent('beforecollapse', this, record, body, row.rowIndex) !== false){\n            this.state[record.id] = false;\n            Ext.fly(row).replaceClass('x-grid3-row-expanded', 'x-grid3-row-collapsed');\n            this.fireEvent('collapse', this, record, body, row.rowIndex);\n        }\n    }\n});\n\nExt.preg('rowexpander', Ext.ux.grid.RowExpander);\n\n//backwards compat\nExt.grid.RowExpander = Ext.ux.grid.RowExpander;// We are adding these custom layouts to a namespace that does not\n// exist by default in Ext, so we have to add the namespace first:\nExt.ns('Ext.ux.layout');\n\n/**\n * @class Ext.ux.layout.RowLayout\n * @extends Ext.layout.ContainerLayout\n * <p>This is the layout style of choice for creating structural layouts in a multi-row format where the height of\n * each row can be specified as a percentage or fixed height.  Row widths can also be fixed, percentage or auto.\n * This class is intended to be extended or created via the layout:'ux.row' {@link Ext.Container#layout} config,\n * and should generally not need to be created directly via the new keyword.</p>\n * <p>RowLayout does not have any direct config options (other than inherited ones), but it does support a\n * specific config property of <b><tt>rowHeight</tt></b> that can be included in the config of any panel added to it.  The\n * layout will use the rowHeight (if present) or height of each panel during layout to determine how to size each panel.\n * If height or rowHeight is not specified for a given panel, its height will default to the panel's height (or auto).</p>\n * <p>The height property is always evaluated as pixels, and must be a number greater than or equal to 1.\n * The rowHeight property is always evaluated as a percentage, and must be a decimal value greater than 0 and\n * less than 1 (e.g., .25).</p>\n * <p>The basic rules for specifying row heights are pretty simple.  The logic makes two passes through the\n * set of contained panels.  During the first layout pass, all panels that either have a fixed height or none\n * specified (auto) are skipped, but their heights are subtracted from the overall container height.  During the second\n * pass, all panels with rowHeights are assigned pixel heights in proportion to their percentages based on\n * the total <b>remaining</b> container height.  In other words, percentage height panels are designed to fill the space\n * left over by all the fixed-height and/or auto-height panels.  Because of this, while you can specify any number of rows\n * with different percentages, the rowHeights must always add up to 1 (or 100%) when added together, otherwise your\n * layout may not render as expected.  Example usage:</p>\n * <pre><code>\n// All rows are percentages -- they must add up to 1\nvar p = new Ext.Panel({\n    title: 'Row Layout - Percentage Only',\n    layout:'ux.row',\n    items: [{\n        title: 'Row 1',\n        rowHeight: .25\n    },{\n        title: 'Row 2',\n        rowHeight: .6\n    },{\n        title: 'Row 3',\n        rowHeight: .15\n    }]\n});\n\n// Mix of height and rowHeight -- all rowHeight values must add\n// up to 1. The first row will take up exactly 120px, and the last two\n// rows will fill the remaining container height.\nvar p = new Ext.Panel({\n    title: 'Row Layout - Mixed',\n    layout:'ux.row',\n    items: [{\n        title: 'Row 1',\n        height: 120,\n        // standard panel widths are still supported too:\n        width: '50%' // or 200\n    },{\n        title: 'Row 2',\n        rowHeight: .8,\n        width: 300\n    },{\n        title: 'Row 3',\n        rowHeight: .2\n    }]\n});\n</code></pre>\n */\nExt.ux.layout.RowLayout = Ext.extend(Ext.layout.ContainerLayout, {\n    // private\n    monitorResize:true,\n\n    type: 'row',\n\n    // private\n    allowContainerRemove: false,\n\n    // private\n    isValidParent : function(c, target){\n        return this.innerCt && c.getPositionEl().dom.parentNode == this.innerCt.dom;\n    },\n\n    getLayoutTargetSize : function() {\n        var target = this.container.getLayoutTarget(), ret;\n        if (target) {\n            ret = target.getViewSize();\n\n            // IE in strict mode will return a height of 0 on the 1st pass of getViewSize.\n            // Use getStyleSize to verify the 0 height, the adjustment pass will then work properly\n            // with getViewSize\n            if (Ext.isIE && Ext.isStrict && ret.height == 0){\n                ret =  target.getStyleSize();\n            }\n\n            ret.width -= target.getPadding('lr');\n            ret.height -= target.getPadding('tb');\n        }\n        return ret;\n    },\n\n    renderAll : function(ct, target) {\n        if(!this.innerCt){\n            // the innerCt prevents wrapping and shuffling while\n            // the container is resizing\n            this.innerCt = target.createChild({cls:'x-column-inner'});\n            this.innerCt.createChild({cls:'x-clear'});\n        }\n        Ext.layout.ColumnLayout.superclass.renderAll.call(this, ct, this.innerCt);\n    },\n\n    // private\n    onLayout : function(ct, target){\n        var rs = ct.items.items,\n            len = rs.length,\n            r,\n            m,\n            i,\n            margins = [];\n\n        this.renderAll(ct, target);\n\n        var size = this.getLayoutTargetSize();\n\n        if(size.width < 1 && size.height < 1){ // display none?\n            return;\n        }\n\n        var h = size.height,\n            ph = h;\n\n        this.innerCt.setSize({height:h});\n\n        // some rows can be percentages while others are fixed\n        // so we need to make 2 passes\n\n        for(i = 0; i < len; i++){\n            r = rs[i];\n            m = r.getPositionEl().getMargins('tb');\n            margins[i] = m;\n            if(!r.rowHeight){\n                ph -= (r.getHeight() + m);\n            }\n        }\n\n        ph = ph < 0 ? 0 : ph;\n\n        for(i = 0; i < len; i++){\n            r = rs[i];\n            m = margins[i];\n            if(r.rowHeight){\n                r.setSize({height: Math.floor(r.rowHeight*ph) - m});\n            }\n        }\n\n        // Browsers differ as to when they account for scrollbars.  We need to re-measure to see if the scrollbar\n        // spaces were accounted for properly.  If not, re-layout.\n        if (Ext.isIE) {\n            if (i = target.getStyle('overflow') && i != 'hidden' && !this.adjustmentPass) {\n                var ts = this.getLayoutTargetSize();\n                if (ts.width != size.width){\n                    this.adjustmentPass = true;\n                    this.onLayout(ct, target);\n                }\n            }\n        }\n        delete this.adjustmentPass;\n    }\n\n    /**\n     * @property activeItem\n     * @hide\n     */\n});\n\nExt.Container.LAYOUTS['ux.row'] = Ext.ux.layout.RowLayout;\nExt.ns('Ext.ux.form');\n\nExt.ux.form.SearchField = Ext.extend(Ext.form.TwinTriggerField, {\n    initComponent : function(){\n        Ext.ux.form.SearchField.superclass.initComponent.call(this);\n        this.on('specialkey', function(f, e){\n            if(e.getKey() == e.ENTER){\n                this.onTrigger2Click();\n            }\n        }, this);\n    },\n\n    validationEvent:false,\n    validateOnBlur:false,\n    trigger1Class:'x-form-clear-trigger',\n    trigger2Class:'x-form-search-trigger',\n    hideTrigger1:true,\n    width:180,\n    hasSearch : false,\n    paramName : 'query',\n\n    onTrigger1Click : function(){\n        if(this.hasSearch){\n            this.el.dom.value = '';\n            var o = {start: 0};\n            this.store.baseParams = this.store.baseParams || {};\n            this.store.baseParams[this.paramName] = '';\n            this.store.reload({params:o});\n            this.triggers[0].hide();\n            this.hasSearch = false;\n        }\n    },\n\n    onTrigger2Click : function(){\n        var v = this.getRawValue();\n        if(v.length < 1){\n            this.onTrigger1Click();\n            return;\n        }\n        var o = {start: 0};\n        this.store.baseParams = this.store.baseParams || {};\n        this.store.baseParams[this.paramName] = v;\n        this.store.reload({params:o});\n        this.hasSearch = true;\n        this.triggers[0].show();\n    }\n});Ext.ns('Ext.ux.form');\n\n/**\n * @class Ext.ux.form.SelectBox\n * @extends Ext.form.ComboBox\n * <p>Makes a ComboBox more closely mimic an HTML SELECT.  Supports clicking and dragging\n * through the list, with item selection occurring when the mouse button is released.\n * When used will automatically set {@link #editable} to false and call {@link Ext.Element#unselectable}\n * on inner elements.  Re-enabling editable after calling this will NOT work.</p>\n * @author Corey Gilmore http://extjs.com/forum/showthread.php?t=6392\n * @history 2007-07-08 jvs\n * Slight mods for Ext 2.0\n * @xtype selectbox\n */\nExt.ux.form.SelectBox = Ext.extend(Ext.form.ComboBox, {\n\tconstructor: function(config){\n\t\tthis.searchResetDelay = 1000;\n\t\tconfig = config || {};\n\t\tconfig = Ext.apply(config || {}, {\n\t\t\teditable: false,\n\t\t\tforceSelection: true,\n\t\t\trowHeight: false,\n\t\t\tlastSearchTerm: false,\n\t\t\ttriggerAction: 'all',\n\t\t\tmode: 'local'\n\t\t});\n\n\t\tExt.ux.form.SelectBox.superclass.constructor.apply(this, arguments);\n\n\t\tthis.lastSelectedIndex = this.selectedIndex || 0;\n\t},\n\n\tinitEvents : function(){\n\t\tExt.ux.form.SelectBox.superclass.initEvents.apply(this, arguments);\n\t\t// you need to use keypress to capture upper/lower case and shift+key, but it doesn't work in IE\n\t\tthis.el.on('keydown', this.keySearch, this, true);\n\t\tthis.cshTask = new Ext.util.DelayedTask(this.clearSearchHistory, this);\n\t},\n\n\tkeySearch : function(e, target, options) {\n\t\tvar raw = e.getKey();\n\t\tvar key = String.fromCharCode(raw);\n\t\tvar startIndex = 0;\n\n\t\tif( !this.store.getCount() ) {\n\t\t\treturn;\n\t\t}\n\n\t\tswitch(raw) {\n\t\t\tcase Ext.EventObject.HOME:\n\t\t\t\te.stopEvent();\n\t\t\t\tthis.selectFirst();\n\t\t\t\treturn;\n\n\t\t\tcase Ext.EventObject.END:\n\t\t\t\te.stopEvent();\n\t\t\t\tthis.selectLast();\n\t\t\t\treturn;\n\n\t\t\tcase Ext.EventObject.PAGEDOWN:\n\t\t\t\tthis.selectNextPage();\n\t\t\t\te.stopEvent();\n\t\t\t\treturn;\n\n\t\t\tcase Ext.EventObject.PAGEUP:\n\t\t\t\tthis.selectPrevPage();\n\t\t\t\te.stopEvent();\n\t\t\t\treturn;\n\t\t}\n\n\t\t// skip special keys other than the shift key\n\t\tif( (e.hasModifier() && !e.shiftKey) || e.isNavKeyPress() || e.isSpecialKey() ) {\n\t\t\treturn;\n\t\t}\n\t\tif( this.lastSearchTerm == key ) {\n\t\t\tstartIndex = this.lastSelectedIndex;\n\t\t}\n\t\tthis.search(this.displayField, key, startIndex);\n\t\tthis.cshTask.delay(this.searchResetDelay);\n\t},\n\n\tonRender : function(ct, position) {\n\t\tthis.store.on('load', this.calcRowsPerPage, this);\n\t\tExt.ux.form.SelectBox.superclass.onRender.apply(this, arguments);\n\t\tif( this.mode == 'local' ) {\n            this.initList();\n\t\t\tthis.calcRowsPerPage();\n\t\t}\n\t},\n\n\tonSelect : function(record, index, skipCollapse){\n\t\tif(this.fireEvent('beforeselect', this, record, index) !== false){\n\t\t\tthis.setValue(record.data[this.valueField || this.displayField]);\n\t\t\tif( !skipCollapse ) {\n\t\t\t\tthis.collapse();\n\t\t\t}\n\t\t\tthis.lastSelectedIndex = index + 1;\n\t\t\tthis.fireEvent('select', this, record, index);\n\t\t}\n\t},\n\n\tafterRender : function() {\n\t\tExt.ux.form.SelectBox.superclass.afterRender.apply(this, arguments);\n\t\tif(Ext.isWebKit) {\n\t\t\tthis.el.swallowEvent('mousedown', true);\n\t\t}\n\t\tthis.el.unselectable();\n\t\tthis.innerList.unselectable();\n\t\tthis.trigger.unselectable();\n\t\tthis.innerList.on('mouseup', function(e, target, options) {\n\t\t\tif( target.id && target.id == this.innerList.id ) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tthis.onViewClick();\n\t\t}, this);\n                this.mun(this.view, 'containerclick', this.onViewClick, this);\n                this.mun(this.view, 'click', this.onViewClick, this);\n\n\t\tthis.innerList.on('mouseover', function(e, target, options) {\n\t\t\tif( target.id && target.id == this.innerList.id ) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tthis.lastSelectedIndex = this.view.getSelectedIndexes()[0] + 1;\n\t\t\tthis.cshTask.delay(this.searchResetDelay);\n\t\t}, this);\n\n\t\tthis.trigger.un('click', this.onTriggerClick, this);\n\t\tthis.trigger.on('mousedown', function(e, target, options) {\n\t\t\te.preventDefault();\n\t\t\tthis.onTriggerClick();\n\t\t}, this);\n\n\t\tthis.on('collapse', function(e, target, options) {\n\t\t\tExt.getDoc().un('mouseup', this.collapseIf, this);\n\t\t}, this, true);\n\n\t\tthis.on('expand', function(e, target, options) {\n\t\t\tExt.getDoc().on('mouseup', this.collapseIf, this);\n\t\t}, this, true);\n\t},\n\n\tclearSearchHistory : function() {\n\t\tthis.lastSelectedIndex = 0;\n\t\tthis.lastSearchTerm = false;\n\t},\n\n\tselectFirst : function() {\n\t\tthis.focusAndSelect(this.store.data.first());\n\t},\n\n\tselectLast : function() {\n\t\tthis.focusAndSelect(this.store.data.last());\n\t},\n\n\tselectPrevPage : function() {\n\t\tif( !this.rowHeight ) {\n\t\t\treturn;\n\t\t}\n\t\tvar index = Math.max(this.selectedIndex-this.rowsPerPage, 0);\n\t\tthis.focusAndSelect(this.store.getAt(index));\n\t},\n\n\tselectNextPage : function() {\n\t\tif( !this.rowHeight ) {\n\t\t\treturn;\n\t\t}\n\t\tvar index = Math.min(this.selectedIndex+this.rowsPerPage, this.store.getCount() - 1);\n\t\tthis.focusAndSelect(this.store.getAt(index));\n\t},\n\n\tsearch : function(field, value, startIndex) {\n\t\tfield = field || this.displayField;\n\t\tthis.lastSearchTerm = value;\n\t\tvar index = this.store.find.apply(this.store, arguments);\n\t\tif( index !== -1 ) {\n\t\t\tthis.focusAndSelect(index);\n\t\t}\n\t},\n\n\tfocusAndSelect : function(record) {\n        var index = Ext.isNumber(record) ? record : this.store.indexOf(record);\n        this.select(index, this.isExpanded());\n        this.onSelect(this.store.getAt(index), index, this.isExpanded());\n\t},\n\n\tcalcRowsPerPage : function() {\n\t\tif( this.store.getCount() ) {\n\t\t\tthis.rowHeight = Ext.fly(this.view.getNode(0)).getHeight();\n\t\t\tthis.rowsPerPage = this.maxHeight / this.rowHeight;\n\t\t} else {\n\t\t\tthis.rowHeight = false;\n\t\t}\n\t}\n\n});\n\nExt.reg('selectbox', Ext.ux.form.SelectBox);\n\n//backwards compat\nExt.ux.SelectBox = Ext.ux.form.SelectBox;\n/**\n * Plugin for PagingToolbar which replaces the textfield input with a slider \n */\nExt.ux.SlidingPager = Ext.extend(Object, {\n    init : function(pbar){\n        var idx = pbar.items.indexOf(pbar.inputItem);\n        Ext.each(pbar.items.getRange(idx - 2, idx + 2), function(c){\n            c.hide();\n        });\n        var slider = new Ext.Slider({\n            width: 114,\n            minValue: 1,\n            maxValue: 1,\n            plugins: new Ext.slider.Tip({\n                getText : function(thumb) {\n                    return String.format('Page <b>{0}</b> of <b>{1}</b>', thumb.value, thumb.slider.maxValue);\n                }\n            }),\n            listeners: {\n                changecomplete: function(s, v){\n                    pbar.changePage(v);\n                }\n            }\n        });\n        pbar.insert(idx + 1, slider);\n        pbar.on({\n            change: function(pb, data){\n                slider.setMaxValue(data.pages);\n                slider.setValue(data.activePage);\n            }\n        });\n    }\n});Ext.ns('Ext.ux.form');\n\n/**\n * @class Ext.ux.form.SpinnerField\n * @extends Ext.form.NumberField\n * Creates a field utilizing Ext.ux.Spinner\n * @xtype spinnerfield\n */\nExt.ux.form.SpinnerField = Ext.extend(Ext.form.NumberField, {\n    actionMode: 'wrap',\n    deferHeight: true,\n    autoSize: Ext.emptyFn,\n    onBlur: Ext.emptyFn,\n    adjustSize: Ext.BoxComponent.prototype.adjustSize,\n\n\tconstructor: function(config) {\n\t\tvar spinnerConfig = Ext.copyTo({}, config, 'incrementValue,alternateIncrementValue,accelerate,defaultValue,triggerClass,splitterClass');\n\n\t\tvar spl = this.spinner = new Ext.ux.Spinner(spinnerConfig);\n\n\t\tvar plugins = config.plugins\n\t\t\t? (Ext.isArray(config.plugins)\n\t\t\t\t? config.plugins.push(spl)\n\t\t\t\t: [config.plugins, spl])\n\t\t\t: spl;\n\n\t\tExt.ux.form.SpinnerField.superclass.constructor.call(this, Ext.apply(config, {plugins: plugins}));\n\t},\n\n    // private\n    getResizeEl: function(){\n        return this.wrap;\n    },\n\n    // private\n    getPositionEl: function(){\n        return this.wrap;\n    },\n\n    // private\n    alignErrorIcon: function(){\n        if (this.wrap) {\n            this.errorIcon.alignTo(this.wrap, 'tl-tr', [2, 0]);\n        }\n    },\n\n    validateBlur: function(){\n        return true;\n    }\n});\n\nExt.reg('spinnerfield', Ext.ux.form.SpinnerField);\n\n//backwards compat\nExt.form.SpinnerField = Ext.ux.form.SpinnerField;\n/**\n * @class Ext.ux.Spinner\n * @extends Ext.util.Observable\n * Creates a Spinner control utilized by Ext.ux.form.SpinnerField\n */\nExt.ux.Spinner = Ext.extend(Ext.util.Observable, {\n    incrementValue: 1,\n    alternateIncrementValue: 5,\n    triggerClass: 'x-form-spinner-trigger',\n    splitterClass: 'x-form-spinner-splitter',\n    alternateKey: Ext.EventObject.shiftKey,\n    defaultValue: 0,\n    accelerate: false,\n\n    constructor: function(config){\n        Ext.ux.Spinner.superclass.constructor.call(this, config);\n        Ext.apply(this, config);\n        this.mimicing = false;\n    },\n\n    init: function(field){\n        this.field = field;\n\n        field.afterMethod('onRender', this.doRender, this);\n        field.afterMethod('onEnable', this.doEnable, this);\n        field.afterMethod('onDisable', this.doDisable, this);\n        field.afterMethod('afterRender', this.doAfterRender, this);\n        field.afterMethod('onResize', this.doResize, this);\n        field.afterMethod('onFocus', this.doFocus, this);\n        field.beforeMethod('onDestroy', this.doDestroy, this);\n    },\n\n    doRender: function(ct, position){\n        var el = this.el = this.field.getEl();\n        var f = this.field;\n\n        if (!f.wrap) {\n            f.wrap = this.wrap = el.wrap({\n                cls: \"x-form-field-wrap\"\n            });\n        }\n        else {\n            this.wrap = f.wrap.addClass('x-form-field-wrap');\n        }\n\n        this.trigger = this.wrap.createChild({\n            tag: \"img\",\n            src: Ext.BLANK_IMAGE_URL,\n            cls: \"x-form-trigger \" + this.triggerClass\n        });\n\n        if (!f.width) {\n            this.wrap.setWidth(el.getWidth() + this.trigger.getWidth());\n        }\n\n        this.splitter = this.wrap.createChild({\n            tag: 'div',\n            cls: this.splitterClass,\n            style: 'width:13px; height:2px;'\n        });\n        this.splitter.setRight((Ext.isIE) ? 1 : 2).setTop(10).show();\n\n        this.proxy = this.trigger.createProxy('', this.splitter, true);\n        this.proxy.addClass(\"x-form-spinner-proxy\");\n        this.proxy.setStyle('left', '0px');\n        this.proxy.setSize(14, 1);\n        this.proxy.hide();\n        this.dd = new Ext.dd.DDProxy(this.splitter.dom.id, \"SpinnerDrag\", {\n            dragElId: this.proxy.id\n        });\n\n        this.initTrigger();\n        this.initSpinner();\n    },\n\n    doAfterRender: function(){\n        var y;\n        if (Ext.isIE && this.el.getY() != (y = this.trigger.getY())) {\n            this.el.position();\n            this.el.setY(y);\n        }\n    },\n\n    doEnable: function(){\n        if (this.wrap) {\n            this.disabled = false;\n            this.wrap.removeClass(this.field.disabledClass);\n        }\n    },\n\n    doDisable: function(){\n        if (this.wrap) {\n\t        this.disabled = true;\n            this.wrap.addClass(this.field.disabledClass);\n            this.el.removeClass(this.field.disabledClass);\n        }\n    },\n\n    doResize: function(w, h){\n        if (typeof w == 'number') {\n            this.el.setWidth(w - this.trigger.getWidth());\n        }\n        this.wrap.setWidth(this.el.getWidth() + this.trigger.getWidth());\n    },\n\n    doFocus: function(){\n        if (!this.mimicing) {\n            this.wrap.addClass('x-trigger-wrap-focus');\n            this.mimicing = true;\n            Ext.get(Ext.isIE ? document.body : document).on(\"mousedown\", this.mimicBlur, this, {\n                delay: 10\n            });\n            this.el.on('keydown', this.checkTab, this);\n        }\n    },\n\n    // private\n    checkTab: function(e){\n        if (e.getKey() == e.TAB) {\n            this.triggerBlur();\n        }\n    },\n\n    // private\n    mimicBlur: function(e){\n        if (!this.wrap.contains(e.target) && this.field.validateBlur(e)) {\n            this.triggerBlur();\n        }\n    },\n\n    // private\n    triggerBlur: function(){\n        this.mimicing = false;\n        Ext.get(Ext.isIE ? document.body : document).un(\"mousedown\", this.mimicBlur, this);\n        this.el.un(\"keydown\", this.checkTab, this);\n        this.field.beforeBlur();\n        this.wrap.removeClass('x-trigger-wrap-focus');\n        this.field.onBlur.call(this.field);\n    },\n\n    initTrigger: function(){\n        this.trigger.addClassOnOver('x-form-trigger-over');\n        this.trigger.addClassOnClick('x-form-trigger-click');\n    },\n\n    initSpinner: function(){\n        this.field.addEvents({\n            'spin': true,\n            'spinup': true,\n            'spindown': true\n        });\n\n        this.keyNav = new Ext.KeyNav(this.el, {\n            \"up\": function(e){\n                e.preventDefault();\n                this.onSpinUp();\n            },\n\n            \"down\": function(e){\n                e.preventDefault();\n                this.onSpinDown();\n            },\n\n            \"pageUp\": function(e){\n                e.preventDefault();\n                this.onSpinUpAlternate();\n            },\n\n            \"pageDown\": function(e){\n                e.preventDefault();\n                this.onSpinDownAlternate();\n            },\n\n            scope: this\n        });\n\n        this.repeater = new Ext.util.ClickRepeater(this.trigger, {\n            accelerate: this.accelerate\n        });\n        this.field.mon(this.repeater, \"click\", this.onTriggerClick, this, {\n            preventDefault: true\n        });\n\n        this.field.mon(this.trigger, {\n            mouseover: this.onMouseOver,\n            mouseout: this.onMouseOut,\n            mousemove: this.onMouseMove,\n            mousedown: this.onMouseDown,\n            mouseup: this.onMouseUp,\n            scope: this,\n            preventDefault: true\n        });\n\n        this.field.mon(this.wrap, \"mousewheel\", this.handleMouseWheel, this);\n\n        this.dd.setXConstraint(0, 0, 10)\n        this.dd.setYConstraint(1500, 1500, 10);\n        this.dd.endDrag = this.endDrag.createDelegate(this);\n        this.dd.startDrag = this.startDrag.createDelegate(this);\n        this.dd.onDrag = this.onDrag.createDelegate(this);\n    },\n\n    onMouseOver: function(){\n        if (this.disabled) {\n            return;\n        }\n        var middle = this.getMiddle();\n        this.tmpHoverClass = (Ext.EventObject.getPageY() < middle) ? 'x-form-spinner-overup' : 'x-form-spinner-overdown';\n        this.trigger.addClass(this.tmpHoverClass);\n    },\n\n    //private\n    onMouseOut: function(){\n        this.trigger.removeClass(this.tmpHoverClass);\n    },\n\n    //private\n    onMouseMove: function(){\n        if (this.disabled) {\n            return;\n        }\n        var middle = this.getMiddle();\n        if (((Ext.EventObject.getPageY() > middle) && this.tmpHoverClass == \"x-form-spinner-overup\") ||\n        ((Ext.EventObject.getPageY() < middle) && this.tmpHoverClass == \"x-form-spinner-overdown\")) {\n        }\n    },\n\n    //private\n    onMouseDown: function(){\n        if (this.disabled) {\n            return;\n        }\n        var middle = this.getMiddle();\n        this.tmpClickClass = (Ext.EventObject.getPageY() < middle) ? 'x-form-spinner-clickup' : 'x-form-spinner-clickdown';\n        this.trigger.addClass(this.tmpClickClass);\n    },\n\n    //private\n    onMouseUp: function(){\n        this.trigger.removeClass(this.tmpClickClass);\n    },\n\n    //private\n    onTriggerClick: function(){\n        if (this.disabled || this.el.dom.readOnly) {\n            return;\n        }\n        var middle = this.getMiddle();\n        var ud = (Ext.EventObject.getPageY() < middle) ? 'Up' : 'Down';\n        this['onSpin' + ud]();\n    },\n\n    //private\n    getMiddle: function(){\n        var t = this.trigger.getTop();\n        var h = this.trigger.getHeight();\n        var middle = t + (h / 2);\n        return middle;\n    },\n\n    //private\n    //checks if control is allowed to spin\n    isSpinnable: function(){\n        if (this.disabled || this.el.dom.readOnly) {\n            Ext.EventObject.preventDefault(); //prevent scrolling when disabled/readonly\n            return false;\n        }\n        return true;\n    },\n\n    handleMouseWheel: function(e){\n        //disable scrolling when not focused\n        if (this.wrap.hasClass('x-trigger-wrap-focus') == false) {\n            return;\n        }\n\n        var delta = e.getWheelDelta();\n        if (delta > 0) {\n            this.onSpinUp();\n            e.stopEvent();\n        }\n        else\n            if (delta < 0) {\n                this.onSpinDown();\n                e.stopEvent();\n            }\n    },\n\n    //private\n    startDrag: function(){\n        this.proxy.show();\n        this._previousY = Ext.fly(this.dd.getDragEl()).getTop();\n    },\n\n    //private\n    endDrag: function(){\n        this.proxy.hide();\n    },\n\n    //private\n    onDrag: function(){\n        if (this.disabled) {\n            return;\n        }\n        var y = Ext.fly(this.dd.getDragEl()).getTop();\n        var ud = '';\n\n        if (this._previousY > y) {\n            ud = 'Up';\n        } //up\n        if (this._previousY < y) {\n            ud = 'Down';\n        } //down\n        if (ud != '') {\n            this['onSpin' + ud]();\n        }\n\n        this._previousY = y;\n    },\n\n    //private\n    onSpinUp: function(){\n        if (this.isSpinnable() == false) {\n            return;\n        }\n        if (Ext.EventObject.shiftKey == true) {\n            this.onSpinUpAlternate();\n            return;\n        }\n        else {\n            this.spin(false, false);\n        }\n        this.field.fireEvent(\"spin\", this);\n        this.field.fireEvent(\"spinup\", this);\n    },\n\n    //private\n    onSpinDown: function(){\n        if (this.isSpinnable() == false) {\n            return;\n        }\n        if (Ext.EventObject.shiftKey == true) {\n            this.onSpinDownAlternate();\n            return;\n        }\n        else {\n            this.spin(true, false);\n        }\n        this.field.fireEvent(\"spin\", this);\n        this.field.fireEvent(\"spindown\", this);\n    },\n\n    //private\n    onSpinUpAlternate: function(){\n        if (this.isSpinnable() == false) {\n            return;\n        }\n        this.spin(false, true);\n        this.field.fireEvent(\"spin\", this);\n        this.field.fireEvent(\"spinup\", this);\n    },\n\n    //private\n    onSpinDownAlternate: function(){\n        if (this.isSpinnable() == false) {\n            return;\n        }\n        this.spin(true, true);\n        this.field.fireEvent(\"spin\", this);\n        this.field.fireEvent(\"spindown\", this);\n    },\n\n    spin: function(down, alternate){\n        var v = parseFloat(this.field.getValue());\n        var incr = (alternate == true) ? this.alternateIncrementValue : this.incrementValue;\n        (down == true) ? v -= incr : v += incr;\n\n        v = (isNaN(v)) ? this.defaultValue : v;\n        v = this.fixBoundries(v);\n        this.field.setRawValue(v);\n    },\n\n    fixBoundries: function(value){\n        var v = value;\n\n        if (this.field.minValue != undefined && v < this.field.minValue) {\n            v = this.field.minValue;\n        }\n        if (this.field.maxValue != undefined && v > this.field.maxValue) {\n            v = this.field.maxValue;\n        }\n\n        return this.fixPrecision(v);\n    },\n\n    // private\n    fixPrecision: function(value){\n        var nan = isNaN(value);\n        if (!this.field.allowDecimals || this.field.decimalPrecision == -1 || nan || !value) {\n            return nan ? '' : value;\n        }\n        return parseFloat(parseFloat(value).toFixed(this.field.decimalPrecision));\n    },\n\n    doDestroy: function(){\n        if (this.trigger) {\n            this.trigger.remove();\n        }\n        if (this.wrap) {\n            this.wrap.remove();\n            delete this.field.wrap;\n        }\n\n        if (this.splitter) {\n            this.splitter.remove();\n        }\n\n        if (this.dd) {\n            this.dd.unreg();\n            this.dd = null;\n        }\n\n        if (this.proxy) {\n            this.proxy.remove();\n        }\n\n        if (this.repeater) {\n            this.repeater.purgeListeners();\n        }\n        if (this.mimicing){\n            Ext.get(Ext.isIE ? document.body : document).un(\"mousedown\", this.mimicBlur, this);\n        }\n    }\n});\n\n//backwards compat\nExt.form.Spinner = Ext.ux.Spinner;Ext.ux.Spotlight = function(config){\n    Ext.apply(this, config);\n}\nExt.ux.Spotlight.prototype = {\n    active : false,\n    animate : true,\n    duration: .25,\n    easing:'easeNone',\n\n    // private\n    animated : false,\n\n    createElements : function(){\n        var bd = Ext.getBody();\n\n        this.right = bd.createChild({cls:'x-spotlight'});\n        this.left = bd.createChild({cls:'x-spotlight'});\n        this.top = bd.createChild({cls:'x-spotlight'});\n        this.bottom = bd.createChild({cls:'x-spotlight'});\n\n        this.all = new Ext.CompositeElement([this.right, this.left, this.top, this.bottom]);\n    },\n\n    show : function(el, callback, scope){\n        if(this.animated){\n            this.show.defer(50, this, [el, callback, scope]);\n            return;\n        }\n        this.el = Ext.get(el);\n        if(!this.right){\n            this.createElements();\n        }\n        if(!this.active){\n            this.all.setDisplayed('');\n            this.applyBounds(true, false);\n            this.active = true;\n            Ext.EventManager.onWindowResize(this.syncSize, this);\n            this.applyBounds(false, this.animate, false, callback, scope);\n        }else{\n            this.applyBounds(false, false, false, callback, scope); // all these booleans look hideous\n        }\n    },\n\n    hide : function(callback, scope){\n        if(this.animated){\n            this.hide.defer(50, this, [callback, scope]);\n            return;\n        }\n        Ext.EventManager.removeResizeListener(this.syncSize, this);\n        this.applyBounds(true, this.animate, true, callback, scope);\n    },\n\n    doHide : function(){\n        this.active = false;\n        this.all.setDisplayed(false);\n    },\n\n    syncSize : function(){\n        this.applyBounds(false, false);\n    },\n\n    applyBounds : function(basePts, anim, doHide, callback, scope){\n\n        var rg = this.el.getRegion();\n\n        var dw = Ext.lib.Dom.getViewWidth(true);\n        var dh = Ext.lib.Dom.getViewHeight(true);\n\n        var c = 0, cb = false;\n        if(anim){\n            cb = {\n                callback: function(){\n                    c++;\n                    if(c == 4){\n                        this.animated = false;\n                        if(doHide){\n                            this.doHide();\n                        }\n                        Ext.callback(callback, scope, [this]);\n                    }\n                },\n                scope: this,\n                duration: this.duration,\n                easing: this.easing\n            };\n            this.animated = true;\n        }\n\n        this.right.setBounds(\n                rg.right,\n                basePts ? dh : rg.top,\n                dw - rg.right,\n                basePts ? 0 : (dh - rg.top),\n                cb);\n\n        this.left.setBounds(\n                0,\n                0,\n                rg.left,\n                basePts ? 0 : rg.bottom,\n                cb);\n\n        this.top.setBounds(\n                basePts ? dw : rg.left,\n                0,\n                basePts ? 0 : dw - rg.left,\n                rg.top,\n                cb);\n\n        this.bottom.setBounds(\n                0,\n                rg.bottom,\n                basePts ? 0 : rg.right,\n                dh - rg.bottom,\n                cb);\n\n        if(!anim){\n            if(doHide){\n                this.doHide();\n            }\n            if(callback){\n                Ext.callback(callback, scope, [this]);\n            }\n        }\n    },\n\n    destroy : function(){\n        this.doHide();\n        Ext.destroy(\n            this.right,\n            this.left,\n            this.top,\n            this.bottom);\n        delete this.el;\n        delete this.all;\n    }\n};\n\n//backwards compat\nExt.Spotlight = Ext.ux.Spotlight;/**\n * @class Ext.ux.StatusBar\n * <p>Basic status bar component that can be used as the bottom toolbar of any {@link Ext.Panel}.  In addition to\n * supporting the standard {@link Ext.Toolbar} interface for adding buttons, menus and other items, the StatusBar\n * provides a greedy status element that can be aligned to either side and has convenient methods for setting the\n * status text and icon.  You can also indicate that something is processing using the {@link #showBusy} method.</p>\n * <pre><code>\nnew Ext.Panel({\n    title: 'StatusBar',\n    // etc.\n    bbar: new Ext.ux.StatusBar({\n        id: 'my-status',\n\n        // defaults to use when the status is cleared:\n        defaultText: 'Default status text',\n        defaultIconCls: 'default-icon',\n\n        // values to set initially:\n        text: 'Ready',\n        iconCls: 'ready-icon',\n\n        // any standard Toolbar items:\n        items: [{\n            text: 'A Button'\n        }, '-', 'Plain Text']\n    })\n});\n\n// Update the status bar later in code:\nvar sb = Ext.getCmp('my-status');\nsb.setStatus({\n    text: 'OK',\n    iconCls: 'ok-icon',\n    clear: true // auto-clear after a set interval\n});\n\n// Set the status bar to show that something is processing:\nsb.showBusy();\n\n// processing....\n\nsb.clearStatus(); // once completeed\n</code></pre>\n * @extends Ext.Toolbar\n * @constructor\n * Creates a new StatusBar\n * @param {Object/Array} config A config object\n */\nExt.ux.StatusBar = Ext.extend(Ext.Toolbar, {\n    /**\n     * @cfg {String} statusAlign\n     * The alignment of the status element within the overall StatusBar layout.  When the StatusBar is rendered,\n     * it creates an internal div containing the status text and icon.  Any additional Toolbar items added in the\n     * StatusBar's {@link #items} config, or added via {@link #add} or any of the supported add* methods, will be\n     * rendered, in added order, to the opposite side.  The status element is greedy, so it will automatically\n     * expand to take up all sapce left over by any other items.  Example usage:\n     * <pre><code>\n// Create a left-aligned status bar containing a button,\n// separator and text item that will be right-aligned (default):\nnew Ext.Panel({\n    title: 'StatusBar',\n    // etc.\n    bbar: new Ext.ux.StatusBar({\n        defaultText: 'Default status text',\n        id: 'status-id',\n        items: [{\n            text: 'A Button'\n        }, '-', 'Plain Text']\n    })\n});\n\n// By adding the statusAlign config, this will create the\n// exact same toolbar, except the status and toolbar item\n// layout will be reversed from the previous example:\nnew Ext.Panel({\n    title: 'StatusBar',\n    // etc.\n    bbar: new Ext.ux.StatusBar({\n        defaultText: 'Default status text',\n        id: 'status-id',\n        statusAlign: 'right',\n        items: [{\n            text: 'A Button'\n        }, '-', 'Plain Text']\n    })\n});\n</code></pre>\n     */\n    /**\n     * @cfg {String} defaultText\n     * The default {@link #text} value.  This will be used anytime the status bar is cleared with the\n     * <tt>useDefaults:true</tt> option (defaults to '').\n     */\n    /**\n     * @cfg {String} defaultIconCls\n     * The default {@link #iconCls} value (see the iconCls docs for additional details about customizing the icon).\n     * This will be used anytime the status bar is cleared with the <tt>useDefaults:true</tt> option (defaults to '').\n     */\n    /**\n     * @cfg {String} text\n     * A string that will be <b>initially</b> set as the status message.  This string\n     * will be set as innerHTML (html tags are accepted) for the toolbar item.\n     * If not specified, the value set for <code>{@link #defaultText}</code>\n     * will be used.\n     */\n    /**\n     * @cfg {String} iconCls\n     * A CSS class that will be <b>initially</b> set as the status bar icon and is\n     * expected to provide a background image (defaults to '').\n     * Example usage:<pre><code>\n// Example CSS rule:\n.x-statusbar .x-status-custom {\n    padding-left: 25px;\n    background: transparent url(images/custom-icon.gif) no-repeat 3px 2px;\n}\n\n// Setting a default icon:\nvar sb = new Ext.ux.StatusBar({\n    defaultIconCls: 'x-status-custom'\n});\n\n// Changing the icon:\nsb.setStatus({\n    text: 'New status',\n    iconCls: 'x-status-custom'\n});\n</code></pre>\n     */\n\n    /**\n     * @cfg {String} cls\n     * The base class applied to the containing element for this component on render (defaults to 'x-statusbar')\n     */\n    cls : 'x-statusbar',\n    /**\n     * @cfg {String} busyIconCls\n     * The default <code>{@link #iconCls}</code> applied when calling\n     * <code>{@link #showBusy}</code> (defaults to <tt>'x-status-busy'</tt>).\n     * It can be overridden at any time by passing the <code>iconCls</code>\n     * argument into <code>{@link #showBusy}</code>.\n     */\n    busyIconCls : 'x-status-busy',\n    /**\n     * @cfg {String} busyText\n     * The default <code>{@link #text}</code> applied when calling\n     * <code>{@link #showBusy}</code> (defaults to <tt>'Loading...'</tt>).\n     * It can be overridden at any time by passing the <code>text</code>\n     * argument into <code>{@link #showBusy}</code>.\n     */\n    busyText : 'Loading...',\n    /**\n     * @cfg {Number} autoClear\n     * The number of milliseconds to wait after setting the status via\n     * <code>{@link #setStatus}</code> before automatically clearing the status\n     * text and icon (defaults to <tt>5000</tt>).  Note that this only applies\n     * when passing the <tt>clear</tt> argument to <code>{@link #setStatus}</code>\n     * since that is the only way to defer clearing the status.  This can\n     * be overridden by specifying a different <tt>wait</tt> value in\n     * <code>{@link #setStatus}</code>. Calls to <code>{@link #clearStatus}</code>\n     * always clear the status bar immediately and ignore this value.\n     */\n    autoClear : 5000,\n\n    /**\n     * @cfg {String} emptyText\n     * The text string to use if no text has been set.  Defaults to\n     * <tt>'&nbsp;'</tt>).  If there are no other items in the toolbar using\n     * an empty string (<tt>''</tt>) for this value would end up in the toolbar\n     * height collapsing since the empty string will not maintain the toolbar\n     * height.  Use <tt>''</tt> if the toolbar should collapse in height\n     * vertically when no text is specified and there are no other items in\n     * the toolbar.\n     */\n    emptyText : '&nbsp;',\n\n    // private\n    activeThreadId : 0,\n\n    // private\n    initComponent : function(){\n        if(this.statusAlign=='right'){\n            this.cls += ' x-status-right';\n        }\n        Ext.ux.StatusBar.superclass.initComponent.call(this);\n    },\n\n    // private\n    afterRender : function(){\n        Ext.ux.StatusBar.superclass.afterRender.call(this);\n\n        var right = this.statusAlign == 'right';\n        this.currIconCls = this.iconCls || this.defaultIconCls;\n        this.statusEl = new Ext.Toolbar.TextItem({\n            cls: 'x-status-text ' + (this.currIconCls || ''),\n            text: this.text || this.defaultText || ''\n        });\n\n        if(right){\n            this.add('->');\n            this.add(this.statusEl);\n        }else{\n            this.insert(0, this.statusEl);\n            this.insert(1, '->');\n        }\n        this.doLayout();\n    },\n\n    /**\n     * Sets the status {@link #text} and/or {@link #iconCls}. Also supports automatically clearing the\n     * status that was set after a specified interval.\n     * @param {Object/String} config A config object specifying what status to set, or a string assumed\n     * to be the status text (and all other options are defaulted as explained below). A config\n     * object containing any or all of the following properties can be passed:<ul>\n     * <li><tt>text</tt> {String} : (optional) The status text to display.  If not specified, any current\n     * status text will remain unchanged.</li>\n     * <li><tt>iconCls</tt> {String} : (optional) The CSS class used to customize the status icon (see\n     * {@link #iconCls} for details). If not specified, any current iconCls will remain unchanged.</li>\n     * <li><tt>clear</tt> {Boolean/Number/Object} : (optional) Allows you to set an internal callback that will\n     * automatically clear the status text and iconCls after a specified amount of time has passed. If clear is not\n     * specified, the new status will not be auto-cleared and will stay until updated again or cleared using\n     * {@link #clearStatus}. If <tt>true</tt> is passed, the status will be cleared using {@link #autoClear},\n     * {@link #defaultText} and {@link #defaultIconCls} via a fade out animation. If a numeric value is passed,\n     * it will be used as the callback interval (in milliseconds), overriding the {@link #autoClear} value.\n     * All other options will be defaulted as with the boolean option.  To customize any other options,\n     * you can pass an object in the format:<ul>\n     *    <li><tt>wait</tt> {Number} : (optional) The number of milliseconds to wait before clearing\n     *    (defaults to {@link #autoClear}).</li>\n     *    <li><tt>anim</tt> {Number} : (optional) False to clear the status immediately once the callback\n     *    executes (defaults to true which fades the status out).</li>\n     *    <li><tt>useDefaults</tt> {Number} : (optional) False to completely clear the status text and iconCls\n     *    (defaults to true which uses {@link #defaultText} and {@link #defaultIconCls}).</li>\n     * </ul></li></ul>\n     * Example usage:<pre><code>\n// Simple call to update the text\nstatusBar.setStatus('New status');\n\n// Set the status and icon, auto-clearing with default options:\nstatusBar.setStatus({\n    text: 'New status',\n    iconCls: 'x-status-custom',\n    clear: true\n});\n\n// Auto-clear with custom options:\nstatusBar.setStatus({\n    text: 'New status',\n    iconCls: 'x-status-custom',\n    clear: {\n        wait: 8000,\n        anim: false,\n        useDefaults: false\n    }\n});\n</code></pre>\n     * @return {Ext.ux.StatusBar} this\n     */\n    setStatus : function(o){\n        o = o || {};\n\n        if(typeof o == 'string'){\n            o = {text:o};\n        }\n        if(o.text !== undefined){\n            this.setText(o.text);\n        }\n        if(o.iconCls !== undefined){\n            this.setIcon(o.iconCls);\n        }\n\n        if(o.clear){\n            var c = o.clear,\n                wait = this.autoClear,\n                defaults = {useDefaults: true, anim: true};\n\n            if(typeof c == 'object'){\n                c = Ext.applyIf(c, defaults);\n                if(c.wait){\n                    wait = c.wait;\n                }\n            }else if(typeof c == 'number'){\n                wait = c;\n                c = defaults;\n            }else if(typeof c == 'boolean'){\n                c = defaults;\n            }\n\n            c.threadId = this.activeThreadId;\n            this.clearStatus.defer(wait, this, [c]);\n        }\n        return this;\n    },\n\n    /**\n     * Clears the status {@link #text} and {@link #iconCls}. Also supports clearing via an optional fade out animation.\n     * @param {Object} config (optional) A config object containing any or all of the following properties.  If this\n     * object is not specified the status will be cleared using the defaults below:<ul>\n     * <li><tt>anim</tt> {Boolean} : (optional) True to clear the status by fading out the status element (defaults\n     * to false which clears immediately).</li>\n     * <li><tt>useDefaults</tt> {Boolean} : (optional) True to reset the text and icon using {@link #defaultText} and\n     * {@link #defaultIconCls} (defaults to false which sets the text to '' and removes any existing icon class).</li>\n     * </ul>\n     * @return {Ext.ux.StatusBar} this\n     */\n    clearStatus : function(o){\n        o = o || {};\n\n        if(o.threadId && o.threadId !== this.activeThreadId){\n            // this means the current call was made internally, but a newer\n            // thread has set a message since this call was deferred.  Since\n            // we don't want to overwrite a newer message just ignore.\n            return this;\n        }\n\n        var text = o.useDefaults ? this.defaultText : this.emptyText,\n            iconCls = o.useDefaults ? (this.defaultIconCls ? this.defaultIconCls : '') : '';\n\n        if(o.anim){\n            // animate the statusEl Ext.Element\n            this.statusEl.el.fadeOut({\n                remove: false,\n                useDisplay: true,\n                scope: this,\n                callback: function(){\n                    this.setStatus({\n\t                    text: text,\n\t                    iconCls: iconCls\n\t                });\n\n                    this.statusEl.el.show();\n                }\n            });\n        }else{\n            // hide/show the el to avoid jumpy text or icon\n            this.statusEl.hide();\n\t        this.setStatus({\n\t            text: text,\n\t            iconCls: iconCls\n\t        });\n            this.statusEl.show();\n        }\n        return this;\n    },\n\n    /**\n     * Convenience method for setting the status text directly.  For more flexible options see {@link #setStatus}.\n     * @param {String} text (optional) The text to set (defaults to '')\n     * @return {Ext.ux.StatusBar} this\n     */\n    setText : function(text){\n        this.activeThreadId++;\n        this.text = text || '';\n        if(this.rendered){\n            this.statusEl.setText(this.text);\n        }\n        return this;\n    },\n\n    /**\n     * Returns the current status text.\n     * @return {String} The status text\n     */\n    getText : function(){\n        return this.text;\n    },\n\n    /**\n     * Convenience method for setting the status icon directly.  For more flexible options see {@link #setStatus}.\n     * See {@link #iconCls} for complete details about customizing the icon.\n     * @param {String} iconCls (optional) The icon class to set (defaults to '', and any current icon class is removed)\n     * @return {Ext.ux.StatusBar} this\n     */\n    setIcon : function(cls){\n        this.activeThreadId++;\n        cls = cls || '';\n\n        if(this.rendered){\n\t        if(this.currIconCls){\n\t            this.statusEl.removeClass(this.currIconCls);\n\t            this.currIconCls = null;\n\t        }\n\t        if(cls.length > 0){\n\t            this.statusEl.addClass(cls);\n\t            this.currIconCls = cls;\n\t        }\n        }else{\n            this.currIconCls = cls;\n        }\n        return this;\n    },\n\n    /**\n     * Convenience method for setting the status text and icon to special values that are pre-configured to indicate\n     * a \"busy\" state, usually for loading or processing activities.\n     * @param {Object/String} config (optional) A config object in the same format supported by {@link #setStatus}, or a\n     * string to use as the status text (in which case all other options for setStatus will be defaulted).  Use the\n     * <tt>text</tt> and/or <tt>iconCls</tt> properties on the config to override the default {@link #busyText}\n     * and {@link #busyIconCls} settings. If the config argument is not specified, {@link #busyText} and\n     * {@link #busyIconCls} will be used in conjunction with all of the default options for {@link #setStatus}.\n     * @return {Ext.ux.StatusBar} this\n     */\n    showBusy : function(o){\n        if(typeof o == 'string'){\n            o = {text:o};\n        }\n        o = Ext.applyIf(o || {}, {\n            text: this.busyText,\n            iconCls: this.busyIconCls\n        });\n        return this.setStatus(o);\n    }\n});\nExt.reg('statusbar', Ext.ux.StatusBar);\n/**\n * @class Ext.ux.TabCloseMenu\n * @extends Object \n * Plugin (ptype = 'tabclosemenu') for adding a close context menu to tabs. Note that the menu respects\n * the closable configuration on the tab. As such, commands like remove others and remove all will not\n * remove items that are not closable.\n * \n * @constructor\n * @param {Object} config The configuration options\n * @ptype tabclosemenu\n */\nExt.ux.TabCloseMenu = Ext.extend(Object, {\n    /**\n     * @cfg {String} closeTabText\n     * The text for closing the current tab. Defaults to <tt>'Close Tab'</tt>.\n     */\n    closeTabText: 'Close Tab',\n\n    /**\n     * @cfg {String} closeOtherTabsText\n     * The text for closing all tabs except the current one. Defaults to <tt>'Close Other Tabs'</tt>.\n     */\n    closeOtherTabsText: 'Close Other Tabs',\n    \n    /**\n     * @cfg {Boolean} showCloseAll\n     * Indicates whether to show the 'Close All' option. Defaults to <tt>true</tt>. \n     */\n    showCloseAll: true,\n\n    /**\n     * @cfg {String} closeAllTabsText\n     * <p>The text for closing all tabs. Defaults to <tt>'Close All Tabs'</tt>.\n     */\n    closeAllTabsText: 'Close All Tabs',\n    \n    constructor : function(config){\n        Ext.apply(this, config || {});\n    },\n\n    //public\n    init : function(tabs){\n        this.tabs = tabs;\n        tabs.on({\n            scope: this,\n            contextmenu: this.onContextMenu,\n            destroy: this.destroy\n        });\n    },\n    \n    destroy : function(){\n        Ext.destroy(this.menu);\n        delete this.menu;\n        delete this.tabs;\n        delete this.active;    \n    },\n\n    // private\n    onContextMenu : function(tabs, item, e){\n        this.active = item;\n        var m = this.createMenu(),\n            disableAll = true,\n            disableOthers = true,\n            closeAll = m.getComponent('closeall');\n        \n        m.getComponent('close').setDisabled(!item.closable);\n        tabs.items.each(function(){\n            if(this.closable){\n                disableAll = false;\n                if(this != item){\n                    disableOthers = false;\n                    return false;\n                }\n            }\n        });\n        m.getComponent('closeothers').setDisabled(disableOthers);\n        if(closeAll){\n            closeAll.setDisabled(disableAll);\n        }\n        \n        e.stopEvent();\n        m.showAt(e.getPoint());\n    },\n    \n    createMenu : function(){\n        if(!this.menu){\n            var items = [{\n                itemId: 'close',\n                text: this.closeTabText,\n                scope: this,\n                handler: this.onClose\n            }];\n            if(this.showCloseAll){\n                items.push('-');\n            }\n            items.push({\n                itemId: 'closeothers',\n                text: this.closeOtherTabsText,\n                scope: this,\n                handler: this.onCloseOthers\n            });\n            if(this.showCloseAll){\n                items.push({\n                    itemId: 'closeall',\n                    text: this.closeAllTabsText,\n                    scope: this,\n                    handler: this.onCloseAll\n                });\n            }\n            this.menu = new Ext.menu.Menu({\n                items: items\n            });\n        }\n        return this.menu;\n    },\n    \n    onClose : function(){\n        this.tabs.remove(this.active);\n    },\n    \n    onCloseOthers : function(){\n        this.doClose(true);\n    },\n    \n    onCloseAll : function(){\n        this.doClose(false);\n    },\n    \n    doClose : function(excludeActive){\n        var items = [];\n        this.tabs.items.each(function(item){\n            if(item.closable){\n                if(!excludeActive || item != this.active){\n                    items.push(item);\n                }    \n            }\n        }, this);\n        Ext.each(items, function(item){\n            this.tabs.remove(item);\n        }, this);\n    }\n});\n\nExt.preg('tabclosemenu', Ext.ux.TabCloseMenu);Ext.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.TableGrid\n * @extends Ext.grid.GridPanel\n * A Grid which creates itself from an existing HTML table element.\n * @history\n * 2007-03-01 Original version by Nige \"Animal\" White\n * 2007-03-10 jvs Slightly refactored to reuse existing classes * @constructor\n * @param {String/HTMLElement/Ext.Element} table The table element from which this grid will be created -\n * The table MUST have some type of size defined for the grid to fill. The container will be\n * automatically set to position relative if it isn't already.\n * @param {Object} config A config object that sets properties on this grid and has two additional (optional)\n * properties: fields and columns which allow for customizing data fields and columns for this grid.\n */\nExt.ux.grid.TableGrid = function(table, config){\n    config = config ||\n    {};\n    Ext.apply(this, config);\n    var cf = config.fields || [], ch = config.columns || [];\n    table = Ext.get(table);\n    \n    var ct = table.insertSibling();\n    \n    var fields = [], cols = [];\n    var headers = table.query(\"thead th\");\n    for (var i = 0, h; h = headers[i]; i++) {\n        var text = h.innerHTML;\n        var name = 'tcol-' + i;\n        \n        fields.push(Ext.applyIf(cf[i] ||\n        {}, {\n            name: name,\n            mapping: 'td:nth(' + (i + 1) + ')/@innerHTML'\n        }));\n        \n        cols.push(Ext.applyIf(ch[i] ||\n        {}, {\n            'header': text,\n            'dataIndex': name,\n            'width': h.offsetWidth,\n            'tooltip': h.title,\n            'sortable': true\n        }));\n    }\n    \n    var ds = new Ext.data.Store({\n        reader: new Ext.data.XmlReader({\n            record: 'tbody tr'\n        }, fields)\n    });\n    \n    ds.loadData(table.dom);\n    \n    var cm = new Ext.grid.ColumnModel(cols);\n    \n    if (config.width || config.height) {\n        ct.setSize(config.width || 'auto', config.height || 'auto');\n    }\n    else {\n        ct.setWidth(table.getWidth());\n    }\n    \n    if (config.remove !== false) {\n        table.remove();\n    }\n    \n    Ext.applyIf(this, {\n        'ds': ds,\n        'cm': cm,\n        'sm': new Ext.grid.RowSelectionModel(),\n        autoHeight: true,\n        autoWidth: false\n    });\n    Ext.ux.grid.TableGrid.superclass.constructor.call(this, ct, {});\n};\n\nExt.extend(Ext.ux.grid.TableGrid, Ext.grid.GridPanel);\n\n//backwards compat\nExt.grid.TableGrid = Ext.ux.grid.TableGrid;\nExt.ns('Ext.ux');\n/**\n * @class Ext.ux.TabScrollerMenu\n * @extends Object \n * Plugin (ptype = 'tabscrollermenu') for adding a tab scroller menu to tabs.\n * @constructor \n * @param {Object} config Configuration options\n * @ptype tabscrollermenu\n */\nExt.ux.TabScrollerMenu =  Ext.extend(Object, {\n    /**\n     * @cfg {Number} pageSize How many items to allow per submenu.\n     */\n\tpageSize       : 10,\n    /**\n     * @cfg {Number} maxText How long should the title of each {@link Ext.menu.Item} be.\n     */\n\tmaxText        : 15,\n    /**\n     * @cfg {String} menuPrefixText Text to prefix the submenus.\n     */    \n\tmenuPrefixText : 'Items',\n\tconstructor    : function(config) {\n\t\tconfig = config || {};\n\t\tExt.apply(this, config);\n\t},\n    //private\n\tinit : function(tabPanel) {\n\t\tExt.apply(tabPanel, this.parentOverrides);\n\t\t\n\t\ttabPanel.tabScrollerMenu = this;\n\t\tvar thisRef = this;\n\t\t\n\t\ttabPanel.on({\n\t\t\trender : {\n\t\t\t\tscope  : tabPanel,\n\t\t\t\tsingle : true,\n\t\t\t\tfn     : function() { \n\t\t\t\t\tvar newFn = tabPanel.createScrollers.createSequence(thisRef.createPanelsMenu, this);\n\t\t\t\t\ttabPanel.createScrollers = newFn;\n\t\t\t\t}\n\t\t\t}\n\t\t});\n\t},\n\t// private && sequeneced\n\tcreatePanelsMenu : function() {\n\t\tvar h = this.stripWrap.dom.offsetHeight;\n\t\t\n\t\t//move the right menu item to the left 18px\n\t\tvar rtScrBtn = this.header.dom.firstChild;\n\t\tExt.fly(rtScrBtn).applyStyles({\n\t\t\tright : '18px'\n\t\t});\n\t\t\n\t\tvar stripWrap = Ext.get(this.strip.dom.parentNode);\n\t\tstripWrap.applyStyles({\n\t\t\t 'margin-right' : '36px'\n\t\t});\n\t\t\n\t\t// Add the new righthand menu\n\t\tvar scrollMenu = this.header.insertFirst({\n\t\t\tcls:'x-tab-tabmenu-right'\n\t\t});\n\t\tscrollMenu.setHeight(h);\n\t\tscrollMenu.addClassOnOver('x-tab-tabmenu-over');\n\t\tscrollMenu.on('click', this.showTabsMenu, this);\t\n\t\t\n\t\tthis.scrollLeft.show = this.scrollLeft.show.createSequence(function() {\n\t\t\tscrollMenu.show();\t\t\t\t\t\t\t\t\t\t\t\t \t\t\t\t\t\t \n\t\t});\n\t\t\n\t\tthis.scrollLeft.hide = this.scrollLeft.hide.createSequence(function() {\n\t\t\tscrollMenu.hide();\t\t\t\t\t\t\t\t\n\t\t});\n\t\t\n\t},\n    /**\n     * Returns an the current page size (this.pageSize);\n     * @return {Number} this.pageSize The current page size.\n     */\n\tgetPageSize : function() {\n\t\treturn this.pageSize;\n\t},\n    /**\n     * Sets the number of menu items per submenu \"page size\".\n     * @param {Number} pageSize The page size\n     */\n    setPageSize : function(pageSize) {\n\t\tthis.pageSize = pageSize;\n\t},\n    /**\n     * Returns the current maxText length;\n     * @return {Number} this.maxText The current max text length.\n     */\n    getMaxText : function() {\n\t\treturn this.maxText;\n\t},\n    /**\n     * Sets the maximum text size for each menu item.\n     * @param {Number} t The max text per each menu item.\n     */\n    setMaxText : function(t) {\n\t\tthis.maxText = t;\n\t},\n    /**\n     * Returns the current menu prefix text String.;\n     * @return {String} this.menuPrefixText The current menu prefix text.\n     */\n\tgetMenuPrefixText : function() {\n\t\treturn this.menuPrefixText;\n\t},\n    /**\n     * Sets the menu prefix text String.\n     * @param {String} t The menu prefix text.\n     */    \n\tsetMenuPrefixText : function(t) {\n\t\tthis.menuPrefixText = t;\n\t},\n\t// private && applied to the tab panel itself.\n\tparentOverrides : {\n\t\t// all execute within the scope of the tab panel\n\t\t// private\t\n\t\tshowTabsMenu : function(e) {\t\t\n\t\t\tif  (this.tabsMenu) {\n\t\t\t\tthis.tabsMenu.destroy();\n                this.un('destroy', this.tabsMenu.destroy, this.tabsMenu);\n                this.tabsMenu = null;\n\t\t\t}\n            this.tabsMenu =  new Ext.menu.Menu();\n            this.on('destroy', this.tabsMenu.destroy, this.tabsMenu);\n\n            this.generateTabMenuItems();\n\n            var target = Ext.get(e.getTarget());\n\t\t\tvar xy     = target.getXY();\n//\n\t\t\t//Y param + 24 pixels\n\t\t\txy[1] += 24;\n\t\t\t\n\t\t\tthis.tabsMenu.showAt(xy);\n\t\t},\n\t\t// private\t\n\t\tgenerateTabMenuItems : function() {\n\t\t\tvar curActive  = this.getActiveTab();\n\t\t\tvar totalItems = this.items.getCount();\n\t\t\tvar pageSize   = this.tabScrollerMenu.getPageSize();\n\t\t\t\n\t\t\t\n\t\t\tif (totalItems > pageSize)  {\n\t\t\t\tvar numSubMenus = Math.floor(totalItems / pageSize);\n\t\t\t\tvar remainder   = totalItems % pageSize;\n\t\t\t\t\n\t\t\t\t// Loop through all of the items and create submenus in chunks of 10\n\t\t\t\tfor (var i = 0 ; i < numSubMenus; i++) {\n\t\t\t\t\tvar curPage = (i + 1) * pageSize;\n\t\t\t\t\tvar menuItems = [];\n\t\t\t\t\t\n\t\t\t\t\t\n\t\t\t\t\tfor (var x = 0; x < pageSize; x++) {\t\t\t\t\n\t\t\t\t\t\tindex = x + curPage - pageSize;\n\t\t\t\t\t\tvar item = this.items.get(index);\n\t\t\t\t\t\tmenuItems.push(this.autoGenMenuItem(item));\n\t\t\t\t\t}\n\t\t\t\t\t\n\t\t\t\t\tthis.tabsMenu.add({\n\t\t\t\t\t\ttext : this.tabScrollerMenu.getMenuPrefixText() + ' '  + (curPage - pageSize + 1) + ' - ' + curPage,\n\t\t\t\t\t\tmenu : menuItems\n\t\t\t\t\t});\n\t\t\t\t\t\n\t\t\t\t}\n\t\t\t\t// remaining items\n\t\t\t\tif (remainder > 0) {\n\t\t\t\t\tvar start = numSubMenus * pageSize;\n\t\t\t\t\tmenuItems = [];\n\t\t\t\t\tfor (var i = start ; i < totalItems; i ++ ) {\t\t\t\t\t\n\t\t\t\t\t\tvar item = this.items.get(i);\n\t\t\t\t\t\tmenuItems.push(this.autoGenMenuItem(item));\n\t\t\t\t\t}\n\t\t\t\t\t\n\t\t\t\t\tthis.tabsMenu.add({\n\t\t\t\t\t\ttext : this.tabScrollerMenu.menuPrefixText  + ' ' + (start + 1) + ' - ' + (start + menuItems.length),\n\t\t\t\t\t\tmenu : menuItems\n\t\t\t\t\t});\n\n\t\t\t\t}\n\t\t\t}\n\t\t\telse {\n\t\t\t\tthis.items.each(function(item) {\n\t\t\t\t\tif (item.id != curActive.id && !item.hidden) {\n                        this.tabsMenu.add(this.autoGenMenuItem(item));\n\t\t\t\t\t}\n\t\t\t\t}, this);\n\t\t\t}\n\t\t},\n\t\t// private\n\t\tautoGenMenuItem : function(item) {\n\t\t\tvar maxText = this.tabScrollerMenu.getMaxText();\n\t\t\tvar text    = Ext.util.Format.ellipsis(item.title, maxText);\n\t\t\t\n\t\t\treturn {\n\t\t\t\ttext      : text,\n\t\t\t\thandler   : this.showTabFromMenu,\n\t\t\t\tscope     : this,\n\t\t\t\tdisabled  : item.disabled,\n\t\t\t\ttabToShow : item,\n\t\t\t\ticonCls   : item.iconCls\n\t\t\t}\n\t\t\n\t\t},\n\t\t// private\n\t\tshowTabFromMenu : function(menuItem) {\n\t\t\tthis.setActiveTab(menuItem.tabToShow);\n\t\t}\t\n\t}\t\n});\n\nExt.reg('tabscrollermenu', Ext.ux.TabScrollerMenu);\nExt.ns('Ext.ux.tree');\n\n/**\n * @class Ext.ux.tree.XmlTreeLoader\n * @extends Ext.tree.TreeLoader\n * <p>A TreeLoader that can convert an XML document into a hierarchy of {@link Ext.tree.TreeNode}s.\n * Any text value included as a text node in the XML will be added to the parent node as an attribute\n * called <tt>innerText</tt>.  Also, the tag name of each XML node will be added to the tree node as\n * an attribute called <tt>tagName</tt>.</p>\n * <p>By default, this class expects that your source XML will provide the necessary attributes on each\n * node as expected by the {@link Ext.tree.TreePanel} to display and load properly.  However, you can\n * provide your own custom processing of node attributes by overriding the {@link #processNode} method\n * and modifying the attributes as needed before they are used to create the associated TreeNode.</p>\n * @constructor\n * Creates a new XmlTreeloader.\n * @param {Object} config A config object containing config properties.\n */\nExt.ux.tree.XmlTreeLoader = Ext.extend(Ext.tree.TreeLoader, {\n    /**\n     * @property  XML_NODE_ELEMENT\n     * XML element node (value 1, read-only)\n     * @type Number\n     */\n    XML_NODE_ELEMENT : 1,\n    /**\n     * @property  XML_NODE_TEXT\n     * XML text node (value 3, read-only)\n     * @type Number\n     */\n    XML_NODE_TEXT : 3,\n\n    // private override\n    processResponse : function(response, node, callback){\n        var xmlData = response.responseXML,\n            root = xmlData.documentElement || xmlData;\n\n        try{\n            node.beginUpdate();\n            node.appendChild(this.parseXml(root));\n            node.endUpdate();\n\n            this.runCallback(callback, scope || node, [node]);\n        }catch(e){\n            this.handleFailure(response);\n        }\n    },\n\n    // private\n    parseXml : function(node) {\n        var nodes = [];\n        Ext.each(node.childNodes, function(n){\n            if(n.nodeType == this.XML_NODE_ELEMENT){\n                var treeNode = this.createNode(n);\n                if(n.childNodes.length > 0){\n                    var child = this.parseXml(n);\n                    if(typeof child == 'string'){\n                        treeNode.attributes.innerText = child;\n                    }else{\n                        treeNode.appendChild(child);\n                    }\n                }\n                nodes.push(treeNode);\n            }\n            else if(n.nodeType == this.XML_NODE_TEXT){\n                var text = n.nodeValue.trim();\n                if(text.length > 0){\n                    return nodes = text;\n                }\n            }\n        }, this);\n\n        return nodes;\n    },\n\n    // private override\n    createNode : function(node){\n        var attr = {\n            tagName: node.tagName\n        };\n\n        Ext.each(node.attributes, function(a){\n            attr[a.nodeName] = a.nodeValue;\n        });\n\n        this.processAttributes(attr);\n\n        return Ext.ux.tree.XmlTreeLoader.superclass.createNode.call(this, attr);\n    },\n\n    /*\n     * Template method intended to be overridden by subclasses that need to provide\n     * custom attribute processing prior to the creation of each TreeNode.  This method\n     * will be passed a config object containing existing TreeNode attribute name/value\n     * pairs which can be modified as needed directly (no need to return the object).\n     */\n    processAttributes: Ext.emptyFn\n});\n\n//backwards compat\nExt.ux.XmlTreeLoader = Ext.ux.tree.XmlTreeLoader;\n/**\n * @class Ext.ux.ValidationStatus\n * A {@link Ext.StatusBar} plugin that provides automatic error notification when the\n * associated form contains validation errors.\n * @extends Ext.Component\n * @constructor\n * Creates a new ValiationStatus plugin\n * @param {Object} config A config object\n */\nExt.ux.ValidationStatus = Ext.extend(Ext.Component, {\n    /**\n     * @cfg {String} errorIconCls\n     * The {@link #iconCls} value to be applied to the status message when there is a\n     * validation error. Defaults to <tt>'x-status-error'</tt>.\n     */\n    errorIconCls : 'x-status-error',\n    /**\n     * @cfg {String} errorListCls\n     * The css class to be used for the error list when there are validation errors.\n     * Defaults to <tt>'x-status-error-list'</tt>.\n     */\n    errorListCls : 'x-status-error-list',\n    /**\n     * @cfg {String} validIconCls\n     * The {@link #iconCls} value to be applied to the status message when the form\n     * validates. Defaults to <tt>'x-status-valid'</tt>.\n     */\n    validIconCls : 'x-status-valid',\n    \n    /**\n     * @cfg {String} showText\n     * The {@link #text} value to be applied when there is a form validation error.\n     * Defaults to <tt>'The form has errors (click for details...)'</tt>.\n     */\n    showText : 'The form has errors (click for details...)',\n    /**\n     * @cfg {String} showText\n     * The {@link #text} value to display when the error list is displayed.\n     * Defaults to <tt>'Click again to hide the error list'</tt>.\n     */\n    hideText : 'Click again to hide the error list',\n    /**\n     * @cfg {String} submitText\n     * The {@link #text} value to be applied when the form is being submitted.\n     * Defaults to <tt>'Saving...'</tt>.\n     */\n    submitText : 'Saving...',\n    \n    // private\n    init : function(sb){\n        sb.on('render', function(){\n            this.statusBar = sb;\n            this.monitor = true;\n            this.errors = new Ext.util.MixedCollection();\n            this.listAlign = (sb.statusAlign=='right' ? 'br-tr?' : 'bl-tl?');\n            \n            if(this.form){\n                this.form = Ext.getCmp(this.form).getForm();\n                this.startMonitoring();\n                this.form.on('beforeaction', function(f, action){\n                    if(action.type == 'submit'){\n                        // Ignore monitoring while submitting otherwise the field validation\n                        // events cause the status message to reset too early\n                        this.monitor = false;\n                    }\n                }, this);\n                var startMonitor = function(){\n                    this.monitor = true;\n                };\n                this.form.on('actioncomplete', startMonitor, this);\n                this.form.on('actionfailed', startMonitor, this);\n            }\n        }, this, {single:true});\n        sb.on({\n            scope: this,\n            afterlayout:{\n                single: true,\n                fn: function(){\n                    // Grab the statusEl after the first layout.\n                    sb.statusEl.getEl().on('click', this.onStatusClick, this, {buffer:200});\n                } \n            }, \n            beforedestroy:{\n                single: true,\n                fn: this.onDestroy\n            } \n        });\n    },\n    \n    // private\n    startMonitoring : function(){\n        this.form.items.each(function(f){\n            f.on('invalid', this.onFieldValidation, this);\n            f.on('valid', this.onFieldValidation, this);\n        }, this);\n    },\n    \n    // private\n    stopMonitoring : function(){\n        this.form.items.each(function(f){\n            f.un('invalid', this.onFieldValidation, this);\n            f.un('valid', this.onFieldValidation, this);\n        }, this);\n    },\n    \n    // private\n    onDestroy : function(){\n        this.stopMonitoring();\n        this.statusBar.statusEl.un('click', this.onStatusClick, this);\n        Ext.ux.ValidationStatus.superclass.onDestroy.call(this);\n    },\n    \n    // private\n    onFieldValidation : function(f, msg){\n        if(!this.monitor){\n            return false;\n        }\n        if(msg){\n            this.errors.add(f.id, {field:f, msg:msg});\n        }else{\n            this.errors.removeKey(f.id);\n        }\n        this.updateErrorList();\n        if(this.errors.getCount() > 0){\n            if(this.statusBar.getText() != this.showText){\n                this.statusBar.setStatus({text:this.showText, iconCls:this.errorIconCls});\n            }\n        }else{\n            this.statusBar.clearStatus().setIcon(this.validIconCls);\n        }\n    },\n    \n    // private\n    updateErrorList : function(){\n        if(this.errors.getCount() > 0){\n\t        var msg = '<ul>';\n\t        this.errors.each(function(err){\n\t            msg += ('<li id=\"x-err-'+ err.field.id +'\"><a href=\"#\">' + err.msg + '</a></li>');\n\t        }, this);\n\t        this.getMsgEl().update(msg+'</ul>');\n        }else{\n            this.getMsgEl().update('');\n        }\n    },\n    \n    // private\n    getMsgEl : function(){\n        if(!this.msgEl){\n            this.msgEl = Ext.DomHelper.append(Ext.getBody(), {\n                cls: this.errorListCls+' x-hide-offsets'\n            }, true);\n            \n            this.msgEl.on('click', function(e){\n                var t = e.getTarget('li', 10, true);\n                if(t){\n                    Ext.getCmp(t.id.split('x-err-')[1]).focus();\n                    this.hideErrors();\n                }\n            }, this, {stopEvent:true}); // prevent anchor click navigation\n        }\n        return this.msgEl;\n    },\n    \n    // private\n    showErrors : function(){\n        this.updateErrorList();\n        this.getMsgEl().alignTo(this.statusBar.getEl(), this.listAlign).slideIn('b', {duration:0.3, easing:'easeOut'});\n        this.statusBar.setText(this.hideText);\n        this.form.getEl().on('click', this.hideErrors, this, {single:true}); // hide if the user clicks directly into the form\n    },\n    \n    // private\n    hideErrors : function(){\n        var el = this.getMsgEl();\n        if(el.isVisible()){\n\t        el.slideOut('b', {duration:0.2, easing:'easeIn'});\n\t        this.statusBar.setText(this.showText);\n        }\n        this.form.getEl().un('click', this.hideErrors, this);\n    },\n    \n    // private\n    onStatusClick : function(){\n        if(this.getMsgEl().isVisible()){\n            this.hideErrors();\n        }else if(this.errors.getCount() > 0){\n            this.showErrors();\n        }\n    }\n});(function() {\n    Ext.override(Ext.list.Column, {\n        init : function() {    \n            var types = Ext.data.Types,\n                st = this.sortType;\n                    \n            if(this.type){\n                if(Ext.isString(this.type)){\n                    this.type = Ext.data.Types[this.type.toUpperCase()] || types.AUTO;\n                }\n            }else{\n                this.type = types.AUTO;\n            }\n\n            // named sortTypes are supported, here we look them up\n            if(Ext.isString(st)){\n                this.sortType = Ext.data.SortTypes[st];\n            }else if(Ext.isEmpty(st)){\n                this.sortType = this.type.sortType;\n            }\n        }\n    });\n\n    Ext.tree.Column = Ext.extend(Ext.list.Column, {});\n    Ext.tree.NumberColumn = Ext.extend(Ext.list.NumberColumn, {});\n    Ext.tree.DateColumn = Ext.extend(Ext.list.DateColumn, {});\n    Ext.tree.BooleanColumn = Ext.extend(Ext.list.BooleanColumn, {});\n\n    Ext.reg('tgcolumn', Ext.tree.Column);\n    Ext.reg('tgnumbercolumn', Ext.tree.NumberColumn);\n    Ext.reg('tgdatecolumn', Ext.tree.DateColumn);\n    Ext.reg('tgbooleancolumn', Ext.tree.BooleanColumn);\n})();\n/**\n * @class Ext.ux.tree.TreeGridNodeUI\n * @extends Ext.tree.TreeNodeUI\n */\nExt.ux.tree.TreeGridNodeUI = Ext.extend(Ext.tree.TreeNodeUI, {\n    isTreeGridNodeUI: true,\n\n    renderElements : function(n, a, targetNode, bulkRender){\n        var t = n.getOwnerTree(),\n            cols = t.columns,\n            c = cols[0],\n            i, buf, len;\n\n        this.indentMarkup = n.parentNode ? n.parentNode.ui.getChildIndent() : '';\n\n        buf = [\n             '<tbody class=\"x-tree-node\">',\n                '<tr ext:tree-node-id=\"', n.id ,'\" class=\"x-tree-node-el x-tree-node-leaf ', a.cls, '\">',\n                    '<td class=\"x-treegrid-col\">',\n                        '<span class=\"x-tree-node-indent\">', this.indentMarkup, \"</span>\",\n                        '<img src=\"', this.emptyIcon, '\" class=\"x-tree-ec-icon x-tree-elbow\" />',\n                        '<img src=\"', a.icon || this.emptyIcon, '\" class=\"x-tree-node-icon', (a.icon ? \" x-tree-node-inline-icon\" : \"\"), (a.iconCls ? \" \"+a.iconCls : \"\"), '\" unselectable=\"on\" />',\n                        '<a hidefocus=\"on\" class=\"x-tree-node-anchor\" href=\"', a.href ? a.href : '#', '\" tabIndex=\"1\" ',\n                            a.hrefTarget ? ' target=\"'+a.hrefTarget+'\"' : '', '>',\n                        '<span unselectable=\"on\">', (c.tpl ? c.tpl.apply(a) : a[c.dataIndex] || c.text), '</span></a>',\n                    '</td>'\n        ];\n\n        for(i = 1, len = cols.length; i < len; i++){\n            c = cols[i];\n            buf.push(\n                    '<td class=\"x-treegrid-col ', (c.cls ? c.cls : ''), '\">',\n                        '<div unselectable=\"on\" class=\"x-treegrid-text\"', (c.align ? ' style=\"text-align: ' + c.align + ';\"' : ''), '>',\n                            (c.tpl ? c.tpl.apply(a) : a[c.dataIndex]),\n                        '</div>',\n                    '</td>'\n            );\n        }\n\n        buf.push(\n            '</tr><tr class=\"x-tree-node-ct\"><td colspan=\"', cols.length, '\">',\n            '<table class=\"x-treegrid-node-ct-table\" cellpadding=\"0\" cellspacing=\"0\" style=\"table-layout: fixed; display: none; width: ', t.innerCt.getWidth() ,'px;\"><colgroup>'\n        );\n        for(i = 0, len = cols.length; i<len; i++) {\n            buf.push('<col style=\"width: ', (cols[i].hidden ? 0 : cols[i].width) ,'px;\" />');\n        }\n        buf.push('</colgroup></table></td></tr></tbody>');\n\n        if(bulkRender !== true && n.nextSibling && n.nextSibling.ui.getEl()){\n            this.wrap = Ext.DomHelper.insertHtml(\"beforeBegin\", n.nextSibling.ui.getEl(), buf.join(''));\n        }else{\n            this.wrap = Ext.DomHelper.insertHtml(\"beforeEnd\", targetNode, buf.join(''));\n        }\n\n        this.elNode = this.wrap.childNodes[0];\n        this.ctNode = this.wrap.childNodes[1].firstChild.firstChild;\n        var cs = this.elNode.firstChild.childNodes;\n        this.indentNode = cs[0];\n        this.ecNode = cs[1];\n        this.iconNode = cs[2];\n        this.anchor = cs[3];\n        this.textNode = cs[3].firstChild;\n    },\n\n    // private\n    animExpand : function(cb){\n        this.ctNode.style.display = \"\";\n        Ext.ux.tree.TreeGridNodeUI.superclass.animExpand.call(this, cb);\n    }\n});\n\nExt.ux.tree.TreeGridRootNodeUI = Ext.extend(Ext.tree.TreeNodeUI, {\n    isTreeGridNodeUI: true,\n\n    // private\n    render : function(){\n        if(!this.rendered){\n            this.wrap = this.ctNode = this.node.ownerTree.innerCt.dom;\n            this.node.expanded = true;\n        }\n\n        if(Ext.isWebKit) {\n            // weird table-layout: fixed issue in webkit\n            var ct = this.ctNode;\n            ct.style.tableLayout = null;\n            (function() {\n                ct.style.tableLayout = 'fixed';\n            }).defer(1);\n        }\n    },\n\n    destroy : function(){\n        if(this.elNode){\n            Ext.dd.Registry.unregister(this.elNode.id);\n        }\n        delete this.node;\n    },\n\n    collapse : Ext.emptyFn,\n    expand : Ext.emptyFn\n});/**\n * @class Ext.tree.ColumnResizer\n * @extends Ext.util.Observable\n */\nExt.tree.ColumnResizer = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Number} minWidth The minimum width the column can be dragged to.\n     * Defaults to <tt>14</tt>.\n     */\n    minWidth: 14,\n\n    constructor: function(config){\n        Ext.apply(this, config);\n        Ext.tree.ColumnResizer.superclass.constructor.call(this);\n    },\n\n    init : function(tree){\n        this.tree = tree;\n        tree.on('render', this.initEvents, this);\n    },\n\n    initEvents : function(tree){\n        tree.mon(tree.innerHd, 'mousemove', this.handleHdMove, this);\n        this.tracker = new Ext.dd.DragTracker({\n            onBeforeStart: this.onBeforeStart.createDelegate(this),\n            onStart: this.onStart.createDelegate(this),\n            onDrag: this.onDrag.createDelegate(this),\n            onEnd: this.onEnd.createDelegate(this),\n            tolerance: 3,\n            autoStart: 300\n        });\n        this.tracker.initEl(tree.innerHd);\n        tree.on('beforedestroy', this.tracker.destroy, this.tracker);\n    },\n\n    handleHdMove : function(e, t){\n        var hw = 5,\n            x = e.getPageX(),\n            hd = e.getTarget('.x-treegrid-hd', 3, true);\n        \n        if(hd){                                 \n            var r = hd.getRegion(),\n                ss = hd.dom.style,\n                pn = hd.dom.parentNode;\n            \n            if(x - r.left <= hw && hd.dom !== pn.firstChild) {\n                var ps = hd.dom.previousSibling;\n                while(ps && Ext.fly(ps).hasClass('x-treegrid-hd-hidden')) {\n                    ps = ps.previousSibling;\n                }\n                if(ps) {                    \n                    this.activeHd = Ext.get(ps);\n    \t\t\t\tss.cursor = Ext.isWebKit ? 'e-resize' : 'col-resize';\n                }\n            } else if(r.right - x <= hw) {\n                var ns = hd.dom;\n                while(ns && Ext.fly(ns).hasClass('x-treegrid-hd-hidden')) {\n                    ns = ns.previousSibling;\n                }\n                if(ns) {\n                    this.activeHd = Ext.get(ns);\n    \t\t\t\tss.cursor = Ext.isWebKit ? 'w-resize' : 'col-resize';                    \n                }\n            } else{\n                delete this.activeHd;\n                ss.cursor = '';\n            }\n        }\n    },\n\n    onBeforeStart : function(e){\n        this.dragHd = this.activeHd;\n        return !!this.dragHd;\n    },\n\n    onStart : function(e){\n        this.dragHeadersDisabled = this.tree.headersDisabled;\n        this.tree.headersDisabled = true;\n        this.proxy = this.tree.body.createChild({cls:'x-treegrid-resizer'});\n        this.proxy.setHeight(this.tree.body.getHeight());\n\n        var x = this.tracker.getXY()[0];\n\n        this.hdX = this.dragHd.getX();\n        this.hdIndex = this.tree.findHeaderIndex(this.dragHd);\n\n        this.proxy.setX(this.hdX);\n        this.proxy.setWidth(x-this.hdX);\n\n        this.maxWidth = this.tree.outerCt.getWidth() - this.tree.innerBody.translatePoints(this.hdX).left;\n    },\n\n    onDrag : function(e){\n        var cursorX = this.tracker.getXY()[0];\n        this.proxy.setWidth((cursorX-this.hdX).constrain(this.minWidth, this.maxWidth));\n    },\n\n    onEnd : function(e){\n        var nw = this.proxy.getWidth(),\n            tree = this.tree,\n            disabled = this.dragHeadersDisabled;\n        \n        this.proxy.remove();\n        delete this.dragHd;\n        \n        tree.columns[this.hdIndex].width = nw;\n        tree.updateColumnWidths();\n        \n        setTimeout(function(){\n            tree.headersDisabled = disabled;\n        }, 100);\n    }\n});Ext.ns('Ext.ux.tree');\n\n/**\n * @class Ext.ux.tree.TreeGridSorter\n * @extends Ext.tree.TreeSorter\n * Provides sorting of nodes in a {@link Ext.ux.tree.TreeGrid}.  The TreeGridSorter automatically monitors events on the\n * associated TreeGrid that might affect the tree's sort order (beforechildrenrendered, append, insert and textchange).\n * Example usage:<br />\n * <pre><code>\n new Ext.ux.tree.TreeGridSorter(myTreeGrid, {\n     folderSort: true,\n     dir: \"desc\",\n     sortType: function(node) {\n         // sort by a custom, typed attribute:\n         return parseInt(node.id, 10);\n     }\n });\n </code></pre>\n * @constructor\n * @param {TreeGrid} tree\n * @param {Object} config\n */\nExt.ux.tree.TreeGridSorter = Ext.extend(Ext.tree.TreeSorter, {\n    /**\n     * @cfg {Array} sortClasses The CSS classes applied to a header when it is sorted. (defaults to <tt>['sort-asc', 'sort-desc']</tt>)\n     */\n    sortClasses : ['sort-asc', 'sort-desc'],\n    /**\n     * @cfg {String} sortAscText The text displayed in the 'Sort Ascending' menu item (defaults to <tt>'Sort Ascending'</tt>)\n     */\n    sortAscText : 'Sort Ascending',\n    /**\n     * @cfg {String} sortDescText The text displayed in the 'Sort Descending' menu item (defaults to <tt>'Sort Descending'</tt>)\n     */\n    sortDescText : 'Sort Descending',\n\n    constructor : function(tree, config) {\n        if(!Ext.isObject(config)) {\n            config = {\n                property: tree.columns[0].dataIndex || 'text',\n                folderSort: true\n            }\n        }\n\n        Ext.ux.tree.TreeGridSorter.superclass.constructor.apply(this, arguments);\n\n        this.tree = tree;\n        tree.on('headerclick', this.onHeaderClick, this);\n        tree.ddAppendOnly = true;\n\n        var me = this;\n        this.defaultSortFn = function(n1, n2){\n\n            var desc = me.dir && me.dir.toLowerCase() == 'desc',\n                prop = me.property || 'text',\n                sortType = me.sortType,\n                caseSensitive = me.caseSensitive === true,\n                leafAttr = me.leafAttr || 'leaf',\n                attr1 = n1.attributes,\n                attr2 = n2.attributes;\n\n            if(me.folderSort){\n                if(attr1[leafAttr] && !attr2[leafAttr]){\n                    return 1;\n                }\n                if(!attr1[leafAttr] && attr2[leafAttr]){\n                    return -1;\n                }\n            }\n            var prop1 = attr1[prop],\n                prop2 = attr2[prop],\n                v1 = sortType ? sortType(prop1) : (caseSensitive ? prop1 : prop1.toUpperCase());\n                v2 = sortType ? sortType(prop2) : (caseSensitive ? prop2 : prop2.toUpperCase());\n                \n            if(v1 < v2){\n                return desc ? +1 : -1;\n            }else if(v1 > v2){\n                return desc ? -1 : +1;\n            }else{\n                return 0;\n            }\n        };\n\n        tree.on('afterrender', this.onAfterTreeRender, this, {single: true});\n        tree.on('headermenuclick', this.onHeaderMenuClick, this);\n    },\n\n    onAfterTreeRender : function() {\n        if(this.tree.hmenu){\n            this.tree.hmenu.insert(0,\n                {itemId:'asc', text: this.sortAscText, cls: 'xg-hmenu-sort-asc'},\n                {itemId:'desc', text: this.sortDescText, cls: 'xg-hmenu-sort-desc'}\n            );\n        }\n        this.updateSortIcon(0, 'asc');\n    },\n\n    onHeaderMenuClick : function(c, id, index) {\n        if(id === 'asc' || id === 'desc') {\n            this.onHeaderClick(c, null, index);\n            return false;\n        }\n    },\n\n    onHeaderClick : function(c, el, i) {\n        if(c && !this.tree.headersDisabled){\n            var me = this;\n\n            me.property = c.dataIndex;\n            me.dir = c.dir = (c.dir === 'desc' ? 'asc' : 'desc');\n            me.sortType = c.sortType;\n            me.caseSensitive === Ext.isBoolean(c.caseSensitive) ? c.caseSensitive : this.caseSensitive;\n            me.sortFn = c.sortFn || this.defaultSortFn;\n\n            this.tree.root.cascade(function(n) {\n                if(!n.isLeaf()) {\n                    me.updateSort(me.tree, n);\n                }\n            });\n\n            this.updateSortIcon(i, c.dir);\n        }\n    },\n\n    // private\n    updateSortIcon : function(col, dir){\n        var sc = this.sortClasses,\n            hds = this.tree.innerHd.select('td').removeClass(sc);\n        hds.item(col).addClass(sc[dir == 'desc' ? 1 : 0]);\n    }\n});/**\n * @class Ext.ux.tree.TreeGridLoader\n * @extends Ext.tree.TreeLoader\n */\nExt.ux.tree.TreeGridLoader = Ext.extend(Ext.tree.TreeLoader, {\n    createNode : function(attr) {\n        if (!attr.uiProvider) {\n            attr.uiProvider = Ext.ux.tree.TreeGridNodeUI;\n        }\n        return Ext.tree.TreeLoader.prototype.createNode.call(this, attr);\n    }\n});/**\n * @class Ext.ux.tree.TreeGrid\n * @extends Ext.tree.TreePanel\n * \n * @xtype treegrid\n */\nExt.ux.tree.TreeGrid = Ext.extend(Ext.tree.TreePanel, {\n    rootVisible : false,\n    useArrows : true,\n    lines : false,\n    borderWidth : Ext.isBorderBox ? 0 : 2, // the combined left/right border for each cell\n    cls : 'x-treegrid',\n\n    columnResize : true,\n    enableSort : true,\n    reserveScrollOffset : true,\n    enableHdMenu : true,\n    \n    columnsText : 'Columns',\n\n    initComponent : function() {\n        if(!this.root) {\n            this.root = new Ext.tree.AsyncTreeNode({text: 'Root'});\n        }\n        \n        // initialize the loader\n        var l = this.loader;\n        if(!l){\n            l = new Ext.ux.tree.TreeGridLoader({\n                dataUrl: this.dataUrl,\n                requestMethod: this.requestMethod,\n                store: this.store\n            });\n        }else if(Ext.isObject(l) && !l.load){\n            l = new Ext.ux.tree.TreeGridLoader(l);\n        }\n        this.loader = l;\n                            \n        Ext.ux.tree.TreeGrid.superclass.initComponent.call(this);                    \n        \n        this.initColumns();\n        \n        if(this.enableSort) {\n            this.treeGridSorter = new Ext.ux.tree.TreeGridSorter(this, this.enableSort);\n        }\n        \n        if(this.columnResize){\n            this.colResizer = new Ext.tree.ColumnResizer(this.columnResize);\n            this.colResizer.init(this);\n        }\n        \n        var c = this.columns;\n        if(!this.internalTpl){                                \n            this.internalTpl = new Ext.XTemplate(\n                '<div class=\"x-grid3-header\">',\n                    '<div class=\"x-treegrid-header-inner\">',\n                        '<div class=\"x-grid3-header-offset\">',\n                            '<table style=\"table-layout: fixed;\" cellspacing=\"0\" cellpadding=\"0\" border=\"0\"><colgroup><tpl for=\"columns\"><col /></tpl></colgroup>',\n                            '<thead><tr class=\"x-grid3-hd-row\">',\n                            '<tpl for=\"columns\">',\n                            '<td class=\"x-grid3-hd x-grid3-cell x-treegrid-hd\" style=\"text-align: {align};\" id=\"', this.id, '-xlhd-{#}\">',\n                                '<div class=\"x-grid3-hd-inner x-treegrid-hd-inner\" unselectable=\"on\">',\n                                     this.enableHdMenu ? '<a class=\"x-grid3-hd-btn\" href=\"#\"></a>' : '',\n                                     '{header}<img class=\"x-grid3-sort-icon\" src=\"', Ext.BLANK_IMAGE_URL, '\" />',\n                                 '</div>',\n                            '</td></tpl>',\n                            '</tr></thead>',\n                        '</table>',\n                    '</div></div>',\n                '</div>',\n                '<div class=\"x-treegrid-root-node\">',\n                    '<table class=\"x-treegrid-root-table\" cellpadding=\"0\" cellspacing=\"0\" style=\"table-layout: fixed;\"></table>',\n                '</div>'\n            );\n        }\n        \n        if(!this.colgroupTpl) {\n            this.colgroupTpl = new Ext.XTemplate(\n                '<colgroup><tpl for=\"columns\"><col style=\"width: {width}px\"/></tpl></colgroup>'\n            );\n        }\n    },\n\n    initColumns : function() {\n        var cs = this.columns,\n            len = cs.length, \n            columns = [],\n            i, c;\n\n        for(i = 0; i < len; i++){\n            c = cs[i];\n            if(!c.isColumn) {\n                c.xtype = c.xtype ? (/^tg/.test(c.xtype) ? c.xtype : 'tg' + c.xtype) : 'tgcolumn';\n                c = Ext.create(c);\n            }\n            c.init(this);\n            columns.push(c);\n            \n            if(this.enableSort !== false && c.sortable !== false) {\n                c.sortable = true;\n                this.enableSort = true;\n            }\n        }\n\n        this.columns = columns;\n    },\n\n    onRender : function(){\n        Ext.tree.TreePanel.superclass.onRender.apply(this, arguments);\n\n        this.el.addClass('x-treegrid');\n        \n        this.outerCt = this.body.createChild({\n            cls:'x-tree-root-ct x-treegrid-ct ' + (this.useArrows ? 'x-tree-arrows' : this.lines ? 'x-tree-lines' : 'x-tree-no-lines')\n        });\n        \n        this.internalTpl.overwrite(this.outerCt, {columns: this.columns});\n        \n        this.mainHd = Ext.get(this.outerCt.dom.firstChild);\n        this.innerHd = Ext.get(this.mainHd.dom.firstChild);\n        this.innerBody = Ext.get(this.outerCt.dom.lastChild);\n        this.innerCt = Ext.get(this.innerBody.dom.firstChild);\n        \n        this.colgroupTpl.insertFirst(this.innerCt, {columns: this.columns});\n        \n        if(this.hideHeaders){\n            this.el.child('.x-grid3-header').setDisplayed('none');\n        }\n        else if(this.enableHdMenu !== false){\n            this.hmenu = new Ext.menu.Menu({id: this.id + '-hctx'});\n            if(this.enableColumnHide !== false){\n                this.colMenu = new Ext.menu.Menu({id: this.id + '-hcols-menu'});\n                this.colMenu.on({\n                    scope: this,\n                    beforeshow: this.beforeColMenuShow,\n                    itemclick: this.handleHdMenuClick\n                });\n                this.hmenu.add({\n                    itemId:'columns',\n                    hideOnClick: false,\n                    text: this.columnsText,\n                    menu: this.colMenu,\n                    iconCls: 'x-cols-icon'\n                });\n            }\n            this.hmenu.on('itemclick', this.handleHdMenuClick, this);\n        }\n    },\n\n    setRootNode : function(node){\n        node.attributes.uiProvider = Ext.ux.tree.TreeGridRootNodeUI;        \n        node = Ext.ux.tree.TreeGrid.superclass.setRootNode.call(this, node);\n        if(this.innerCt) {\n            this.colgroupTpl.insertFirst(this.innerCt, {columns: this.columns});\n        }\n        return node;\n    },\n    \n    clearInnerCt : function(){\n        if(Ext.isIE){\n            var dom = this.innerCt.dom;\n            while(dom.firstChild){\n                dom.removeChild(dom.firstChild);\n            }\n        }else{\n            Ext.ux.tree.TreeGrid.superclass.clearInnerCt.call(this);\n        }\n    },\n    \n    initEvents : function() {\n        Ext.ux.tree.TreeGrid.superclass.initEvents.apply(this, arguments);\n\n        this.mon(this.innerBody, 'scroll', this.syncScroll, this);\n        this.mon(this.innerHd, 'click', this.handleHdDown, this);\n        this.mon(this.mainHd, {\n            scope: this,\n            mouseover: this.handleHdOver,\n            mouseout: this.handleHdOut\n        });\n    },\n    \n    onResize : function(w, h) {\n        Ext.ux.tree.TreeGrid.superclass.onResize.apply(this, arguments);\n        \n        var bd = this.innerBody.dom;\n        var hd = this.innerHd.dom;\n\n        if(!bd){\n            return;\n        }\n\n        if(Ext.isNumber(h)){\n            bd.style.height = this.body.getHeight(true) - hd.offsetHeight + 'px';\n        }\n\n        if(Ext.isNumber(w)){                        \n            var sw = Ext.num(this.scrollOffset, Ext.getScrollBarWidth());\n            if(this.reserveScrollOffset || ((bd.offsetWidth - bd.clientWidth) > 10)){\n                this.setScrollOffset(sw);\n            }else{\n                var me = this;\n                setTimeout(function(){\n                    me.setScrollOffset(bd.offsetWidth - bd.clientWidth > 10 ? sw : 0);\n                }, 10);\n            }\n        }\n    },\n\n    updateColumnWidths : function() {\n        var cols = this.columns,\n            colCount = cols.length,\n            groups = this.outerCt.query('colgroup'),\n            groupCount = groups.length,\n            c, g, i, j;\n\n        for(i = 0; i<colCount; i++) {\n            c = cols[i];\n            for(j = 0; j<groupCount; j++) {\n                g = groups[j];\n                g.childNodes[i].style.width = (c.hidden ? 0 : c.width) + 'px';\n            }\n        }\n        \n        for(i = 0, groups = this.innerHd.query('td'), len = groups.length; i<len; i++) {\n            c = Ext.fly(groups[i]);\n            if(cols[i] && cols[i].hidden) {\n                c.addClass('x-treegrid-hd-hidden');\n            }\n            else {\n                c.removeClass('x-treegrid-hd-hidden');\n            }\n        }\n\n        var tcw = this.getTotalColumnWidth();                        \n        Ext.fly(this.innerHd.dom.firstChild).setWidth(tcw + (this.scrollOffset || 0));\n        this.outerCt.select('table').setWidth(tcw);\n        this.syncHeaderScroll();    \n    },\n                    \n    getVisibleColumns : function() {\n        var columns = [],\n            cs = this.columns,\n            len = cs.length,\n            i;\n            \n        for(i = 0; i<len; i++) {\n            if(!cs[i].hidden) {\n                columns.push(cs[i]);\n            }\n        }        \n        return columns;\n    },\n\n    getTotalColumnWidth : function() {\n        var total = 0;\n        for(var i = 0, cs = this.getVisibleColumns(), len = cs.length; i<len; i++) {\n            total += cs[i].width;\n        }\n        return total;\n    },\n\n    setScrollOffset : function(scrollOffset) {\n        this.scrollOffset = scrollOffset;                        \n        this.updateColumnWidths();\n    },\n\n    // private\n    handleHdDown : function(e, t){\n        var hd = e.getTarget('.x-treegrid-hd');\n\n        if(hd && Ext.fly(t).hasClass('x-grid3-hd-btn')){\n            var ms = this.hmenu.items,\n                cs = this.columns,\n                index = this.findHeaderIndex(hd),\n                c = cs[index],\n                sort = c.sortable;\n                \n            e.stopEvent();\n            Ext.fly(hd).addClass('x-grid3-hd-menu-open');\n            this.hdCtxIndex = index;\n            \n            this.fireEvent('headerbuttonclick', ms, c, hd, index);\n            \n            this.hmenu.on('hide', function(){\n                Ext.fly(hd).removeClass('x-grid3-hd-menu-open');\n            }, this, {single:true});\n            \n            this.hmenu.show(t, 'tl-bl?');\n        }\n        else if(hd) {\n            var index = this.findHeaderIndex(hd);\n            this.fireEvent('headerclick', this.columns[index], hd, index);\n        }\n    },\n\n    // private\n    handleHdOver : function(e, t){                    \n        var hd = e.getTarget('.x-treegrid-hd');                        \n        if(hd && !this.headersDisabled){\n            index = this.findHeaderIndex(hd);\n            this.activeHdRef = t;\n            this.activeHdIndex = index;\n            var el = Ext.get(hd);\n            this.activeHdRegion = el.getRegion();\n            el.addClass('x-grid3-hd-over');\n            this.activeHdBtn = el.child('.x-grid3-hd-btn');\n            if(this.activeHdBtn){\n                this.activeHdBtn.dom.style.height = (hd.firstChild.offsetHeight-1)+'px';\n            }\n        }\n    },\n    \n    // private\n    handleHdOut : function(e, t){\n        var hd = e.getTarget('.x-treegrid-hd');\n        if(hd && (!Ext.isIE || !e.within(hd, true))){\n            this.activeHdRef = null;\n            Ext.fly(hd).removeClass('x-grid3-hd-over');\n            hd.style.cursor = '';\n        }\n    },\n                    \n    findHeaderIndex : function(hd){\n        hd = hd.dom || hd;\n        var cs = hd.parentNode.childNodes;\n        for(var i = 0, c; c = cs[i]; i++){\n            if(c == hd){\n                return i;\n            }\n        }\n        return -1;\n    },\n    \n    // private\n    beforeColMenuShow : function(){\n        var cols = this.columns,  \n            colCount = cols.length,\n            i, c;                        \n        this.colMenu.removeAll();                    \n        for(i = 1; i < colCount; i++){\n            c = cols[i];\n            if(c.hideable !== false){\n                this.colMenu.add(new Ext.menu.CheckItem({\n                    itemId: 'col-' + i,\n                    text: c.header,\n                    checked: !c.hidden,\n                    hideOnClick:false,\n                    disabled: c.hideable === false\n                }));\n            }\n        }\n    },\n                    \n    // private\n    handleHdMenuClick : function(item){\n        var index = this.hdCtxIndex,\n            id = item.getItemId();\n        \n        if(this.fireEvent('headermenuclick', this.columns[index], id, index) !== false) {\n            index = id.substr(4);\n            if(index > 0 && this.columns[index]) {\n                this.setColumnVisible(index, !item.checked);\n            }     \n        }\n        \n        return true;\n    },\n    \n    setColumnVisible : function(index, visible) {\n        this.columns[index].hidden = !visible;        \n        this.updateColumnWidths();\n    },\n\n    /**\n     * Scrolls the grid to the top\n     */\n    scrollToTop : function(){\n        this.innerBody.dom.scrollTop = 0;\n        this.innerBody.dom.scrollLeft = 0;\n    },\n\n    // private\n    syncScroll : function(){\n        this.syncHeaderScroll();\n        var mb = this.innerBody.dom;\n        this.fireEvent('bodyscroll', mb.scrollLeft, mb.scrollTop);\n    },\n\n    // private\n    syncHeaderScroll : function(){\n        var mb = this.innerBody.dom;\n        this.innerHd.dom.scrollLeft = mb.scrollLeft;\n        this.innerHd.dom.scrollLeft = mb.scrollLeft; // second time for IE (1/2 time first fails, other browsers ignore)\n    },\n    \n    registerNode : function(n) {\n        Ext.ux.tree.TreeGrid.superclass.registerNode.call(this, n);\n        if(!n.uiProvider && !n.isRoot && !n.ui.isTreeGridNodeUI) {\n            n.ui = new Ext.ux.tree.TreeGridNodeUI(n);\n        }\n    }\n});\n\nExt.reg('treegrid', Ext.ux.tree.TreeGrid);"
  },
  {
    "path": "client/src/ext/ux/ux-all.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns(\"Ext.ux.grid\");Ext.ux.grid.BufferView=Ext.extend(Ext.grid.GridView,{rowHeight:19,borderHeight:2,scrollDelay:100,cacheSize:20,cleanDelay:500,initTemplates:function(){Ext.ux.grid.BufferView.superclass.initTemplates.call(this);var a=this.templates;a.rowHolder=new Ext.Template('<div class=\"x-grid3-row {alt}\" style=\"{tstyle}\"></div>');a.rowHolder.disableFormats=true;a.rowHolder.compile();a.rowBody=new Ext.Template('<table class=\"x-grid3-row-table\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\" style=\"{tstyle}\">',\"<tbody><tr>{cells}</tr>\",(this.enableRowBody?'<tr class=\"x-grid3-row-body-tr\" style=\"{bodyStyle}\"><td colspan=\"{cols}\" class=\"x-grid3-body-cell\" tabIndex=\"0\" hidefocus=\"on\"><div class=\"x-grid3-row-body\">{body}</div></td></tr>':\"\"),\"</tbody></table>\");a.rowBody.disableFormats=true;a.rowBody.compile()},getStyleRowHeight:function(){return Ext.isBorderBox?(this.rowHeight+this.borderHeight):this.rowHeight},getCalculatedRowHeight:function(){return this.rowHeight+this.borderHeight},getVisibleRowCount:function(){var b=this.getCalculatedRowHeight(),a=this.scroller.dom.clientHeight;return(a<1)?0:Math.ceil(a/b)},getVisibleRows:function(){var a=this.getVisibleRowCount(),b=this.scroller.dom.scrollTop,c=(b===0?0:Math.floor(b/this.getCalculatedRowHeight())-1);return{first:Math.max(c,0),last:Math.min(c+a+2,this.ds.getCount()-1)}},doRender:function(g,k,u,a,s,A,l){var b=this.templates,f=b.cell,h=b.row,x=b.rowBody,n=s-1,t=this.getStyleRowHeight(),z=this.getVisibleRows(),d=\"width:\"+this.getTotalWidth()+\";height:\"+t+\"px;\",D=[],w,E,v={},m={tstyle:d},q;for(var y=0,C=k.length;y<C;y++){q=k[y];w=[];var o=(y+a),e=o>=z.first&&o<=z.last;if(e){for(var B=0;B<s;B++){E=g[B];v.id=E.id;v.css=B===0?\"x-grid3-cell-first \":(B==n?\"x-grid3-cell-last \":\"\");v.attr=v.cellAttr=\"\";v.value=E.renderer(q.data[E.name],v,q,o,B,u);v.style=E.style;if(v.value===undefined||v.value===\"\"){v.value=\"&#160;\"}if(q.dirty&&typeof q.modified[E.name]!==\"undefined\"){v.css+=\" x-grid3-dirty-cell\"}w[w.length]=f.apply(v)}}var F=[];if(A&&((o+1)%2===0)){F[0]=\"x-grid3-row-alt\"}if(q.dirty){F[1]=\" x-grid3-dirty-row\"}m.cols=s;if(this.getRowClass){F[2]=this.getRowClass(q,o,m,u)}m.alt=F.join(\" \");m.cells=w.join(\"\");D[D.length]=!e?b.rowHolder.apply(m):(l?x.apply(m):h.apply(m))}return D.join(\"\")},isRowRendered:function(a){var b=this.getRow(a);return b&&b.childNodes.length>0},syncScroll:function(){Ext.ux.grid.BufferView.superclass.syncScroll.apply(this,arguments);this.update()},update:function(){if(this.scrollDelay){if(!this.renderTask){this.renderTask=new Ext.util.DelayedTask(this.doUpdate,this)}this.renderTask.delay(this.scrollDelay)}else{this.doUpdate()}},onRemove:function(d,a,b,c){Ext.ux.grid.BufferView.superclass.onRemove.apply(this,arguments);if(c!==true){this.update()}},doUpdate:function(){if(this.getVisibleRowCount()>0){var f=this.grid,b=f.colModel,h=f.store,e=this.getColumnData(),a=this.getVisibleRows(),j;for(var d=a.first;d<=a.last;d++){if(!this.isRowRendered(d)&&(j=this.getRow(d))){var c=this.doRender(e,[h.getAt(d)],h,d,b.getColumnCount(),f.stripeRows,true);j.innerHTML=c}}this.clean()}},clean:function(){if(!this.cleanTask){this.cleanTask=new Ext.util.DelayedTask(this.doClean,this)}this.cleanTask.delay(this.cleanDelay)},doClean:function(){if(this.getVisibleRowCount()>0){var b=this.getVisibleRows();b.first-=this.cacheSize;b.last+=this.cacheSize;var c=0,d=this.getRows();if(b.first<=0){c=b.last+1}for(var a=this.ds.getCount();c<a;c++){if((c<b.first||c>b.last)&&d[c].innerHTML){d[c].innerHTML=\"\"}}}},removeTask:function(b){var a=this[b];if(a&&a.cancel){a.cancel();this[b]=null}},destroy:function(){this.removeTask(\"cleanTask\");this.removeTask(\"renderTask\");Ext.ux.grid.BufferView.superclass.destroy.call(this)},layout:function(){Ext.ux.grid.BufferView.superclass.layout.call(this);this.update()}});Ext.ns(\"Ext.ux.layout\");Ext.ux.layout.CenterLayout=Ext.extend(Ext.layout.FitLayout,{setItemSize:function(b,a){this.container.addClass(\"ux-layout-center\");b.addClass(\"ux-layout-center-item\");if(b&&a.height>0){if(b.width){a.width=b.width}b.setSize(a)}}});Ext.Container.LAYOUTS[\"ux.center\"]=Ext.ux.layout.CenterLayout;Ext.ns(\"Ext.ux.grid\");Ext.ux.grid.CheckColumn=Ext.extend(Ext.grid.Column,{processEvent:function(c,f,d,g,b){if(c==\"mousedown\"){var a=d.store.getAt(g);a.set(this.dataIndex,!a.data[this.dataIndex]);return false}else{return Ext.grid.ActionColumn.superclass.processEvent.apply(this,arguments)}},renderer:function(b,c,a){c.css+=\" x-grid3-check-col-td\";return String.format('<div class=\"x-grid3-check-col{0}\">&#160;</div>',b?\"-on\":\"\")},init:Ext.emptyFn});Ext.preg(\"checkcolumn\",Ext.ux.grid.CheckColumn);Ext.grid.CheckColumn=Ext.ux.grid.CheckColumn;Ext.grid.Column.types.checkcolumn=Ext.ux.grid.CheckColumn;Ext.ns(\"Ext.ux.grid\");Ext.ux.grid.ColumnHeaderGroup=Ext.extend(Ext.util.Observable,{constructor:function(a){this.config=a},init:function(a){Ext.applyIf(a.colModel,this.config);Ext.apply(a.getView(),this.viewConfig)},viewConfig:{initTemplates:function(){this.constructor.prototype.initTemplates.apply(this,arguments);var a=this.templates||{};if(!a.gcell){a.gcell=new Ext.XTemplate('<td class=\"x-grid3-hd x-grid3-gcell x-grid3-td-{id} ux-grid-hd-group-row-{row} {cls}\" style=\"{style}\">','<div {tooltip} class=\"x-grid3-hd-inner x-grid3-hd-{id}\" unselectable=\"on\" style=\"{istyle}\">',this.grid.enableHdMenu?'<a class=\"x-grid3-hd-btn\" href=\"#\"></a>':\"\",\"{value}</div></td>\")}this.templates=a;this.hrowRe=new RegExp(\"ux-grid-hd-group-row-(\\\\d+)\",\"\")},renderHeaders:function(){var h=this.templates,d=[],l=this.cm,p=l.rows,j=\"width:\"+this.getTotalWidth()+\";\";for(var o=0,k=p.length;o<k;o++){var a=p[o],n=[];for(var f=0,e=0,g=a.length;f<g;f++){var m=a[f];m.colspan=m.colspan||1;var b=this.getColumnId(m.dataIndex?l.findColumnIndex(m.dataIndex):e),c=Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupStyle.call(this,m,e);n[f]=h.gcell.apply({cls:\"ux-grid-hd-group-cell\",id:b,row:o,style:\"width:\"+c.width+\";\"+(c.hidden?\"display:none;\":\"\")+(m.align?\"text-align:\"+m.align+\";\":\"\"),tooltip:m.tooltip?(Ext.QuickTips.isEnabled()?\"ext:qtip\":\"title\")+'=\"'+m.tooltip+'\"':\"\",istyle:m.align==\"right\"?\"padding-right:16px\":\"\",btn:this.grid.enableHdMenu&&m.header,value:m.header||\"&nbsp;\"});e+=m.colspan}d[o]=h.header.apply({tstyle:j,cells:n.join(\"\")})}d.push(this.constructor.prototype.renderHeaders.apply(this,arguments));return d.join(\"\")},onColumnWidthUpdated:function(){this.constructor.prototype.onColumnWidthUpdated.apply(this,arguments);Ext.ux.grid.ColumnHeaderGroup.prototype.updateGroupStyles.call(this)},onAllColumnWidthsUpdated:function(){this.constructor.prototype.onAllColumnWidthsUpdated.apply(this,arguments);Ext.ux.grid.ColumnHeaderGroup.prototype.updateGroupStyles.call(this)},onColumnHiddenUpdated:function(){this.constructor.prototype.onColumnHiddenUpdated.apply(this,arguments);Ext.ux.grid.ColumnHeaderGroup.prototype.updateGroupStyles.call(this)},getHeaderCell:function(a){return this.mainHd.query(this.cellSelector)[a]},findHeaderCell:function(a){return a?this.fly(a).findParent(\"td.x-grid3-hd\",this.cellSelectorDepth):false},findHeaderIndex:function(b){var a=this.findHeaderCell(b);return a?this.getCellIndex(a):false},updateSortIcon:function(b,a){var d=this.sortClasses,c=this.mainHd.select(this.cellSelector).removeClass(d);c.item(b).addClass(d[a==\"DESC\"?1:0])},handleHdDown:function(h,d){var f=Ext.get(d);if(f.hasClass(\"x-grid3-hd-btn\")){h.stopEvent();var g=this.findHeaderCell(d);Ext.fly(g).addClass(\"x-grid3-hd-menu-open\");var c=this.getCellIndex(g);this.hdCtxIndex=c;var b=this.hmenu.items,a=this.cm;b.get(\"asc\").setDisabled(!a.isSortable(c));b.get(\"desc\").setDisabled(!a.isSortable(c));this.hmenu.on(\"hide\",function(){Ext.fly(g).removeClass(\"x-grid3-hd-menu-open\")},this,{single:true});this.hmenu.show(d,\"tl-bl?\")}else{if(f.hasClass(\"ux-grid-hd-group-cell\")||Ext.fly(d).up(\".ux-grid-hd-group-cell\")){h.stopEvent()}}},handleHdMove:function(h,d){var g=this.findHeaderCell(this.activeHdRef);if(g&&!this.headersDisabled&&!Ext.fly(g).hasClass(\"ux-grid-hd-group-cell\")){var b=this.splitHandleWidth||5,f=this.activeHdRegion,a=h.getPageX(),c=g.style,j=\"\";if(this.grid.enableColumnResize!==false){if(a-f.left<=b&&this.cm.isResizable(this.activeHdIndex-1)){j=Ext.isAir?\"move\":Ext.isWebKit?\"e-resize\":\"col-resize\"}else{if(f.right-a<=(!this.activeHdBtn?b:2)&&this.cm.isResizable(this.activeHdIndex)){j=Ext.isAir?\"move\":Ext.isWebKit?\"w-resize\":\"col-resize\"}}}c.cursor=j}},handleHdOver:function(d,a){var c=this.findHeaderCell(a);if(c&&!this.headersDisabled){this.activeHdRef=a;this.activeHdIndex=this.getCellIndex(c);var b=this.fly(c);this.activeHdRegion=b.getRegion();if(!(this.cm.isMenuDisabled(this.activeHdIndex)||b.hasClass(\"ux-grid-hd-group-cell\"))){b.addClass(\"x-grid3-hd-over\");this.activeHdBtn=b.child(\".x-grid3-hd-btn\");if(this.activeHdBtn){this.activeHdBtn.dom.style.height=(c.firstChild.offsetHeight-1)+\"px\"}}}},handleHdOut:function(c,a){var b=this.findHeaderCell(a);if(b&&(!Ext.isIE||!c.within(b,true))){this.activeHdRef=null;this.fly(b).removeClass(\"x-grid3-hd-over\");b.style.cursor=\"\"}},handleHdMenuClick:function(q){var l=this.hdCtxIndex,o=this.cm,d=this.ds,b=q.getItemId();switch(b){case\"asc\":d.sort(o.getDataIndex(l),\"ASC\");break;case\"desc\":d.sort(o.getDataIndex(l),\"DESC\");break;default:if(b.substr(0,6)==\"group-\"){var h=b.split(\"-\"),s=parseInt(h[1],10),e=parseInt(h[2],10),a=this.cm.rows[s],p,f=0;for(var h=0,k=a.length;h<k;h++){p=a[h];if(e>=f&&e<f+p.colspan){break}f+=p.colspan}if(q.checked){var m=o.getColumnsBy(this.isHideableColumn,this).length;for(var h=f,k=f+p.colspan;h<k;h++){if(!o.isHidden(h)){m--}}if(m<1){this.onDenyColumnHide();return false}}for(var h=f,k=f+p.colspan;h<k;h++){if(o.config[h].fixed!==true&&o.config[h].hideable!==false){o.setHidden(h,q.checked)}}}else{if(b.substr(0,4)==\"col-\"){l=o.getIndexById(b.substr(4));if(l!=-1){if(q.checked&&o.getColumnsBy(this.isHideableColumn,this).length<=1){this.onDenyColumnHide();return false}o.setHidden(l,q.checked)}}}if(b.substr(0,6)==\"group-\"||b.substr(0,4)==\"col-\"){q.checked=!q.checked;if(q.menu){var j=function(r){r.items.each(function(t){if(!t.disabled){t.setChecked(q.checked,false);if(t.menu){j(t.menu)}}})};j(q.menu)}var g=q,c;while(g=g.parentMenu){if(!g.parentMenu||!(c=g.parentMenu.items.get(g.getItemId()))||!c.setChecked){break}var n=g.items.findIndexBy(function(r){return r.checked})>=0;c.setChecked(n,true)}q.checked=!q.checked}}return true},beforeColMenuShow:function(){var h=this.cm,j=this.cm.rows;this.colMenu.removeAll();for(var d=0,m=h.getColumnCount();d<m;d++){var a=this.colMenu,x=h.getColumnHeader(d),l=[];if(h.config[d].fixed!==true&&h.config[d].hideable!==false){for(var e=0,s=j.length;e<s;e++){var n=j[e],g,p=0;for(var t=0,u=n.length;t<u;t++){g=n[t];if(d>=p&&d<p+g.colspan){break}p+=g.colspan}if(g&&g.header){if(h.hierarchicalColMenu){var o=\"group-\"+e+\"-\"+p,v=a.items?a.getComponent(o):null,k=v?v.menu:null;if(!k){k=new Ext.menu.Menu({itemId:o});k.on(\"itemclick\",this.handleHdMenuClick,this);var f=false,b=true;for(var w=p,q=p+g.colspan;w<q;w++){if(!h.isHidden(w)){f=true}if(h.config[w].hideable!==false){b=false}}a.add({itemId:o,text:g.header,menu:k,hideOnClick:false,checked:f,disabled:b})}a=k}else{l.push(g.header)}}}l.push(x);a.add(new Ext.menu.CheckItem({itemId:\"col-\"+h.getColumnId(d),text:l.join(\" \"),checked:!h.isHidden(d),hideOnClick:false,disabled:h.config[d].hideable===false}))}}},afterRenderUI:function(){this.constructor.prototype.afterRenderUI.apply(this,arguments);Ext.apply(this.columnDrop,Ext.ux.grid.ColumnHeaderGroup.prototype.columnDropConfig);Ext.apply(this.splitZone,Ext.ux.grid.ColumnHeaderGroup.prototype.splitZoneConfig)}},splitZoneConfig:{allowHeaderDrag:function(a){return !a.getTarget(null,null,true).hasClass(\"ux-grid-hd-group-cell\")}},columnDropConfig:{getTargetFromEvent:function(b){var a=Ext.lib.Event.getTarget(b);return this.view.findHeaderCell(a)},positionIndicator:function(b,f,d){var c=Ext.ux.grid.ColumnHeaderGroup.prototype.getDragDropData.call(this,b,f,d);if(c===false){return false}var a=c.px+this.proxyOffsets[0];this.proxyTop.setLeftTop(a,c.r.top+this.proxyOffsets[1]);this.proxyTop.show();this.proxyBottom.setLeftTop(a,c.r.bottom);this.proxyBottom.show();return c.pt},onNodeDrop:function(o,A,v,C){var u=C.header;if(u!=o){var x=Ext.ux.grid.ColumnHeaderGroup.prototype.getDragDropData.call(this,u,o,v);if(x===false){return false}var j=this.grid.colModel,z=x.oldIndex<x.newIndex,k=j.rows;for(var f=x.row,p=k.length;f<p;f++){var l=k[f],t=l.length,B=0,q=1,D=t;for(var s=0,m=0;s<t;s++){var g=l[s];if(x.oldIndex>=m&&x.oldIndex<m+g.colspan){B=s}if(x.oldIndex+x.colspan-1>=m&&x.oldIndex+x.colspan-1<m+g.colspan){q=s-B+1}if(x.newIndex>=m&&x.newIndex<m+g.colspan){D=s}m+=g.colspan}var w=l.splice(B,q);k[f]=l.splice(0,D-(z?q:0)).concat(w).concat(l)}for(var y=0;y<x.colspan;y++){var b=x.oldIndex+(z?0:y),a=x.newIndex+(z?-1:y);j.moveColumn(b,a);this.grid.fireEvent(\"columnmove\",b,a)}return true}return false}},getGroupStyle:function(g,c){var e=0,f=true;for(var d=c,a=c+g.colspan;d<a;d++){if(!this.cm.isHidden(d)){var b=this.cm.getColumnWidth(d);if(typeof b==\"number\"){e+=b}f=false}}return{width:(Ext.isBorderBox||(Ext.isWebKit&&!Ext.isSafari2)?e:Math.max(e-this.borderWidth,0))+\"px\",hidden:f}},updateGroupStyles:function(b){var g=this.mainHd.query(\".x-grid3-header-offset > table\"),e=this.getTotalWidth(),k=this.cm.rows;for(var j=0;j<g.length;j++){g[j].style.width=e;if(j<k.length){var h=g[j].firstChild.firstChild.childNodes;for(var d=0,c=0;d<h.length;d++){var f=k[j][d];if((typeof b!=\"number\")||(b>=c&&b<c+f.colspan)){var a=Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupStyle.call(this,f,c);h[d].style.width=a.width;h[d].style.display=a.hidden?\"none\":\"\"}c+=f.colspan}}}},getGroupRowIndex:function(b){if(b){var a=b.className.match(this.hrowRe);if(a&&a[1]){return parseInt(a[1],10)}}return this.cm.rows.length},getGroupSpan:function(g,c){if(g<0){return{col:0,colspan:this.cm.getColumnCount()}}var e=this.cm.rows[g];if(e){for(var d=0,b=0,a=e.length;d<a;d++){var f=e[d];if(c>=b&&c<b+f.colspan){return{col:b,colspan:f.colspan}}b+=f.colspan}return{col:b,colspan:0}}return{col:c,colspan:1}},getDragDropData:function(f,d,g){if(f.parentNode!=d.parentNode){return false}var o=this.grid.colModel,l=Ext.lib.Event.getPageX(g),a=Ext.lib.Dom.getRegion(d.firstChild),m,s;if((a.right-l)<=(a.right-a.left)/2){m=a.right+this.view.borderWidth;s=\"after\"}else{m=a.left;s=\"before\"}var k=this.view.getCellIndex(f),p=this.view.getCellIndex(d);if(o.isFixed(p)){return false}var q=Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupRowIndex.call(this.view,f),b=Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupSpan.call(this.view,q,k),c=Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupSpan.call(this.view,q,p),k=b.col;p=c.col+(s==\"after\"?c.colspan:0);if(p>=b.col&&p<=b.col+b.colspan){return false}var j=Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupSpan.call(this.view,q-1,k);if(p<j.col||p>j.col+j.colspan){return false}return{r:a,px:m,pt:s,row:q,oldIndex:k,newIndex:p,colspan:b.colspan}}});Ext.ns(\"Ext.ux.tree\");Ext.ux.tree.ColumnTree=Ext.extend(Ext.tree.TreePanel,{lines:false,borderWidth:Ext.isBorderBox?0:2,cls:\"x-column-tree\",onRender:function(){Ext.tree.ColumnTree.superclass.onRender.apply(this,arguments);this.headers=this.header.createChild({cls:\"x-tree-headers\"});var f=this.columns,g;var b=0;var d=19;for(var e=0,a=f.length;e<a;e++){g=f[e];b+=g.width;this.headers.createChild({cls:\"x-tree-hd \"+(g.cls?g.cls+\"-hd\":\"\"),cn:{cls:\"x-tree-hd-text\",html:g.header},style:\"width:\"+(g.width-this.borderWidth)+\"px;\"})}this.headers.createChild({cls:\"x-clear\"});this.headers.setWidth(b+d);this.innerCt.setWidth(b)}});Ext.reg(\"columntree\",Ext.ux.tree.ColumnTree);Ext.tree.ColumnTree=Ext.ux.tree.ColumnTree;Ext.ux.tree.ColumnNodeUI=Ext.extend(Ext.tree.TreeNodeUI,{focus:Ext.emptyFn,renderElements:function(d,m,h,o){this.indentMarkup=d.parentNode?d.parentNode.ui.getChildIndent():\"\";var p=d.getOwnerTree();var l=p.columns;var k=p.borderWidth;var j=l[0];var b=['<li class=\"x-tree-node\"><div ext:tree-node-id=\"',d.id,'\" class=\"x-tree-node-el x-tree-node-leaf ',m.cls,'\">','<div class=\"x-tree-col\" style=\"width:',j.width-k,'px;\">','<span class=\"x-tree-node-indent\">',this.indentMarkup,\"</span>\",'<img src=\"',this.emptyIcon,'\" class=\"x-tree-ec-icon x-tree-elbow\">','<img src=\"',m.icon||this.emptyIcon,'\" class=\"x-tree-node-icon',(m.icon?\" x-tree-node-inline-icon\":\"\"),(m.iconCls?\" \"+m.iconCls:\"\"),'\" unselectable=\"on\">','<a hidefocus=\"on\" class=\"x-tree-node-anchor\" href=\"',m.href?m.href:\"#\",'\" tabIndex=\"1\" ',m.hrefTarget?' target=\"'+m.hrefTarget+'\"':\"\",\">\",'<span unselectable=\"on\">',d.text||(j.renderer?j.renderer(m[j.dataIndex],d,m):m[j.dataIndex]),\"</span></a>\",\"</div>\"];for(var e=1,g=l.length;e<g;e++){j=l[e];b.push('<div class=\"x-tree-col ',(j.cls?j.cls:\"\"),'\" style=\"width:',j.width-k,'px;\">','<div class=\"x-tree-col-text\">',(j.renderer?j.renderer(m[j.dataIndex],d,m):m[j.dataIndex]),\"</div>\",\"</div>\")}b.push('<div class=\"x-clear\"></div></div>','<ul class=\"x-tree-node-ct\" style=\"display:none;\"></ul>',\"</li>\");if(o!==true&&d.nextSibling&&d.nextSibling.ui.getEl()){this.wrap=Ext.DomHelper.insertHtml(\"beforeBegin\",d.nextSibling.ui.getEl(),b.join(\"\"))}else{this.wrap=Ext.DomHelper.insertHtml(\"beforeEnd\",h,b.join(\"\"))}this.elNode=this.wrap.childNodes[0];this.ctNode=this.wrap.childNodes[1];var f=this.elNode.firstChild.childNodes;this.indentNode=f[0];this.ecNode=f[1];this.iconNode=f[2];this.anchor=f[3];this.textNode=f[3].firstChild}});Ext.tree.ColumnNodeUI=Ext.ux.tree.ColumnNodeUI;Ext.DataView.LabelEditor=Ext.extend(Ext.Editor,{alignment:\"tl-tl\",hideEl:false,cls:\"x-small-editor\",shim:false,completeOnEnter:true,cancelOnEsc:true,labelSelector:\"span.x-editable\",constructor:function(a,b){Ext.DataView.LabelEditor.superclass.constructor.call(this,b||new Ext.form.TextField({allowBlank:false,growMin:90,growMax:240,grow:true,selectOnFocus:true}),a)},init:function(a){this.view=a;a.on(\"render\",this.initEditor,this);this.on(\"complete\",this.onSave,this)},initEditor:function(){this.view.on({scope:this,containerclick:this.doBlur,click:this.doBlur});this.view.getEl().on(\"mousedown\",this.onMouseDown,this,{delegate:this.labelSelector})},doBlur:function(){if(this.editing){this.field.blur()}},onMouseDown:function(d,c){if(!d.ctrlKey&&!d.shiftKey){var b=this.view.findItemFromChild(c);d.stopEvent();var a=this.view.store.getAt(this.view.indexOf(b));this.startEdit(c,a.data[this.dataIndex]);this.activeRecord=a}else{d.preventDefault()}},onSave:function(a,b){this.activeRecord.set(this.dataIndex,b)}});Ext.DataView.DragSelector=function(f){f=f||{};var j,h,l;var d,k,m=new Ext.lib.Region(0,0,0,0);var b=f.dragSafe===true;this.init=function(q){j=q;j.on(\"render\",p)};function n(){d=[];j.all.each(function(q){d[d.length]=q.getRegion()});k=j.el.getRegion()}function e(){return false}function g(q){return !b||q.target==j.el.dom}function o(q){j.on(\"containerclick\",e,j,{single:true});if(!h){h=j.el.createChild({cls:\"x-view-selector\"})}else{if(h.dom.parentNode!==j.el.dom){j.el.dom.appendChild(h.dom)}h.setDisplayed(\"block\")}n();j.clearSelections()}function c(z){var A=l.startXY;var E=l.getXY();var C=Math.min(A[0],E[0]);var B=Math.min(A[1],E[1]);var D=Math.abs(A[0]-E[0]);var u=Math.abs(A[1]-E[1]);m.left=C;m.top=B;m.right=C+D;m.bottom=B+u;m.constrainTo(k);h.setRegion(m);for(var t=0,v=d.length;t<v;t++){var q=d[t],s=m.intersect(q);if(s&&!q.selected){q.selected=true;j.select(t,true)}else{if(!s&&q.selected){q.selected=false;j.deselect(t)}}}}function a(q){if(!Ext.isIE){j.un(\"containerclick\",e,j)}if(h){h.setDisplayed(false)}}function p(q){l=new Ext.dd.DragTracker({onBeforeStart:g,onStart:o,onDrag:c,onEnd:a});l.initEl(q.el)}};Ext.ns(\"Ext.ux.form\");Ext.ux.form.FileUploadField=Ext.extend(Ext.form.TextField,{buttonText:\"Browse...\",buttonOnly:false,buttonOffset:3,readOnly:true,autoSize:Ext.emptyFn,initComponent:function(){Ext.ux.form.FileUploadField.superclass.initComponent.call(this);this.addEvents(\"fileselected\")},onRender:function(c,a){Ext.ux.form.FileUploadField.superclass.onRender.call(this,c,a);this.wrap=this.el.wrap({cls:\"x-form-field-wrap x-form-file-wrap\"});this.el.addClass(\"x-form-file-text\");this.el.dom.removeAttribute(\"name\");this.createFileInput();var b=Ext.applyIf(this.buttonCfg||{},{text:this.buttonText});this.button=new Ext.Button(Ext.apply(b,{renderTo:this.wrap,cls:\"x-form-file-btn\"+(b.iconCls?\" x-btn-icon\":\"\")}));if(this.buttonOnly){this.el.hide();this.wrap.setWidth(this.button.getEl().getWidth())}this.bindListeners();this.resizeEl=this.positionEl=this.wrap},bindListeners:function(){this.fileInput.on({scope:this,mouseenter:function(){this.button.addClass([\"x-btn-over\",\"x-btn-focus\"])},mouseleave:function(){this.button.removeClass([\"x-btn-over\",\"x-btn-focus\",\"x-btn-click\"])},mousedown:function(){this.button.addClass(\"x-btn-click\")},mouseup:function(){this.button.removeClass([\"x-btn-over\",\"x-btn-focus\",\"x-btn-click\"])},change:function(){var a=this.fileInput.dom.value;this.setValue(a);this.fireEvent(\"fileselected\",this,a)}})},createFileInput:function(){this.fileInput=this.wrap.createChild({id:this.getFileInputId(),name:this.name||this.getId(),cls:\"x-form-file\",tag:\"input\",type:\"file\",size:1})},reset:function(){if(this.rendered){this.fileInput.remove();this.createFileInput();this.bindListeners()}Ext.ux.form.FileUploadField.superclass.reset.call(this)},getFileInputId:function(){return this.id+\"-file\"},onResize:function(a,b){Ext.ux.form.FileUploadField.superclass.onResize.call(this,a,b);this.wrap.setWidth(a);if(!this.buttonOnly){var a=this.wrap.getWidth()-this.button.getEl().getWidth()-this.buttonOffset;this.el.setWidth(a)}},onDestroy:function(){Ext.ux.form.FileUploadField.superclass.onDestroy.call(this);Ext.destroy(this.fileInput,this.button,this.wrap)},onDisable:function(){Ext.ux.form.FileUploadField.superclass.onDisable.call(this);this.doDisable(true)},onEnable:function(){Ext.ux.form.FileUploadField.superclass.onEnable.call(this);this.doDisable(false)},doDisable:function(a){this.fileInput.dom.disabled=a;this.button.setDisabled(a)},preFocus:Ext.emptyFn,alignErrorIcon:function(){this.errorIcon.alignTo(this.wrap,\"tl-tr\",[2,0])}});Ext.reg(\"fileuploadfield\",Ext.ux.form.FileUploadField);Ext.form.FileUploadField=Ext.ux.form.FileUploadField;Ext.ux.GMapPanel=Ext.extend(Ext.Panel,{initComponent:function(){var a={plain:true,zoomLevel:3,yaw:180,pitch:0,zoom:0,gmapType:\"map\",border:false};Ext.applyIf(this,a);Ext.ux.GMapPanel.superclass.initComponent.call(this)},afterRender:function(){var b=this.ownerCt.getSize();Ext.applyIf(this,b);Ext.ux.GMapPanel.superclass.afterRender.call(this);if(this.gmapType===\"map\"){this.gmap=new GMap2(this.body.dom)}if(this.gmapType===\"panorama\"){this.gmap=new GStreetviewPanorama(this.body.dom)}if(typeof this.addControl==\"object\"&&this.gmapType===\"map\"){this.gmap.addControl(this.addControl)}if(typeof this.setCenter===\"object\"){if(typeof this.setCenter.geoCodeAddr===\"string\"){this.geoCodeLookup(this.setCenter.geoCodeAddr)}else{if(this.gmapType===\"map\"){var a=new GLatLng(this.setCenter.lat,this.setCenter.lng);this.gmap.setCenter(a,this.zoomLevel)}if(typeof this.setCenter.marker===\"object\"&&typeof a===\"object\"){this.addMarker(a,this.setCenter.marker,this.setCenter.marker.clear)}}if(this.gmapType===\"panorama\"){this.gmap.setLocationAndPOV(new GLatLng(this.setCenter.lat,this.setCenter.lng),{yaw:this.yaw,pitch:this.pitch,zoom:this.zoom})}}GEvent.bind(this.gmap,\"load\",this,function(){this.onMapReady()})},onMapReady:function(){this.addMarkers(this.markers);this.addMapControls();this.addOptions()},onResize:function(a,b){if(typeof this.getMap()==\"object\"){this.gmap.checkResize()}Ext.ux.GMapPanel.superclass.onResize.call(this,a,b)},setSize:function(c,a,b){if(typeof this.getMap()==\"object\"){this.gmap.checkResize()}Ext.ux.GMapPanel.superclass.setSize.call(this,c,a,b)},getMap:function(){return this.gmap},getCenter:function(){return this.getMap().getCenter()},getCenterLatLng:function(){var a=this.getCenter();return{lat:a.lat(),lng:a.lng()}},addMarkers:function(c){if(Ext.isArray(c)){for(var b=0;b<c.length;b++){var a=new GLatLng(c[b].lat,c[b].lng);this.addMarker(a,c[b].marker,false,c[b].setCenter,c[b].listeners)}}},addMarker:function(c,d,b,a,e){Ext.applyIf(d,G_DEFAULT_ICON);if(b===true){this.getMap().clearOverlays()}if(a===true){this.getMap().setCenter(c,this.zoomLevel)}var f=new GMarker(c,d);if(typeof e===\"object\"){for(evt in e){GEvent.bind(f,evt,this,e[evt])}}this.getMap().addOverlay(f)},addMapControls:function(){if(this.gmapType===\"map\"){if(Ext.isArray(this.mapControls)){for(i=0;i<this.mapControls.length;i++){this.addMapControl(this.mapControls[i])}}else{if(typeof this.mapControls===\"string\"){this.addMapControl(this.mapControls)}else{if(typeof this.mapControls===\"object\"){this.getMap().addControl(this.mapControls)}}}}},addMapControl:function(b){var a=window[b];if(typeof a===\"function\"){this.getMap().addControl(new a())}},addOptions:function(){if(Ext.isArray(this.mapConfOpts)){var a;for(i=0;i<this.mapConfOpts.length;i++){this.addOption(this.mapConfOpts[i])}}else{if(typeof this.mapConfOpts===\"string\"){this.addOption(this.mapConfOpts)}}},addOption:function(b){var a=this.getMap()[b];if(typeof a===\"function\"){this.getMap()[b]()}},geoCodeLookup:function(a){this.geocoder=new GClientGeocoder();this.geocoder.getLocations(a,this.addAddressToMap.createDelegate(this))},addAddressToMap:function(a){if(!a||a.Status.code!=200){Ext.MessageBox.alert(\"Error\",\"Code \"+a.Status.code+\" Error Returned\")}else{place=a.Placemark[0];addressinfo=place.AddressDetails;accuracy=addressinfo.Accuracy;if(accuracy===0){Ext.MessageBox.alert(\"Unable to Locate Address\",\"Unable to Locate the Address you provided\")}else{if(accuracy<7){Ext.MessageBox.alert(\"Address Accuracy\",\"The address provided has a low accuracy.<br><br>Level \"+accuracy+\" Accuracy (8 = Exact Match, 1 = Vague Match)\")}else{point=new GLatLng(place.Point.coordinates[1],place.Point.coordinates[0]);if(typeof this.setCenter.marker===\"object\"&&typeof point===\"object\"){this.addMarker(point,this.setCenter.marker,this.setCenter.marker.clear,true,this.setCenter.listeners)}}}}}});Ext.reg(\"gmappanel\",Ext.ux.GMapPanel);Ext.namespace(\"Ext.ux.grid\");Ext.ux.grid.GridFilters=Ext.extend(Ext.util.Observable,{autoReload:true,filterCls:\"ux-filtered-column\",local:false,menuFilterText:\"Filters\",paramPrefix:\"filter\",showMenu:true,stateId:undefined,updateBuffer:500,constructor:function(a){a=a||{};this.deferredUpdate=new Ext.util.DelayedTask(this.reload,this);this.filters=new Ext.util.MixedCollection();this.filters.getKey=function(b){return b?b.dataIndex:null};this.addFilters(a.filters);delete a.filters;Ext.apply(this,a)},init:function(a){if(a instanceof Ext.grid.GridPanel){this.grid=a;this.bindStore(this.grid.getStore(),true);if(this.filters.getCount()==0){this.addFilters(this.grid.getColumnModel())}this.grid.filters=this;this.grid.addEvents({filterupdate:true});a.on({scope:this,beforestaterestore:this.applyState,beforestatesave:this.saveState,beforedestroy:this.destroy,reconfigure:this.onReconfigure});if(a.rendered){this.onRender()}else{a.on({scope:this,single:true,render:this.onRender})}}else{if(a instanceof Ext.PagingToolbar){this.toolbar=a}}},applyState:function(b,d){var a,c;this.applyingState=true;this.clearFilters();if(d.filters){for(a in d.filters){c=this.filters.get(a);if(c){c.setValue(d.filters[a]);c.setActive(true)}}}this.deferredUpdate.cancel();if(this.local){this.reload()}delete this.applyingState;delete d.filters},saveState:function(a,c){var b={};this.filters.each(function(d){if(d.active){b[d.dataIndex]=d.getValue()}});return(c.filters=b)},onRender:function(){this.grid.getView().on(\"refresh\",this.onRefresh,this);this.createMenu()},destroy:function(){this.removeAll();this.purgeListeners();if(this.filterMenu){Ext.menu.MenuMgr.unregister(this.filterMenu);this.filterMenu.destroy();this.filterMenu=this.menu.menu=null}},removeAll:function(){if(this.filters){Ext.destroy.apply(Ext,this.filters.items);this.filters.clear()}},bindStore:function(a,b){if(!b&&this.store){if(this.local){a.un(\"load\",this.onLoad,this)}else{a.un(\"beforeload\",this.onBeforeLoad,this)}}if(a){if(this.local){a.on(\"load\",this.onLoad,this)}else{a.on(\"beforeload\",this.onBeforeLoad,this)}}this.store=a},onReconfigure:function(){this.bindStore(this.grid.getStore());this.store.clearFilter();this.removeAll();this.addFilters(this.grid.getColumnModel());this.updateColumnHeadings()},createMenu:function(){var a=this.grid.getView(),b=a.hmenu;if(this.showMenu&&b){this.sep=b.addSeparator();this.filterMenu=new Ext.menu.Menu({id:this.grid.id+\"-filters-menu\"});this.menu=b.add({checked:false,itemId:\"filters\",text:this.menuFilterText,menu:this.filterMenu});this.menu.on({scope:this,checkchange:this.onCheckChange,beforecheckchange:this.onBeforeCheck});b.on(\"beforeshow\",this.onMenu,this)}this.updateColumnHeadings()},getMenuFilter:function(){var a=this.grid.getView();if(!a||a.hdCtxIndex===undefined){return null}return this.filters.get(a.cm.config[a.hdCtxIndex].dataIndex)},onMenu:function(b){var a=this.getMenuFilter();if(a){this.menu.menu=a.menu;this.menu.setChecked(a.active,false);this.menu.setDisabled(a.disabled===true)}this.menu.setVisible(a!==undefined);this.sep.setVisible(a!==undefined)},onCheckChange:function(a,b){this.getMenuFilter().setActive(b)},onBeforeCheck:function(a,b){return !b||this.getMenuFilter().isActivatable()},onStateChange:function(b,a){if(b===\"serialize\"){return}if(a==this.getMenuFilter()){this.menu.setChecked(a.active,false)}if((this.autoReload||this.local)&&!this.applyingState){this.deferredUpdate.delay(this.updateBuffer)}this.updateColumnHeadings();if(!this.applyingState){this.grid.saveState()}this.grid.fireEvent(\"filterupdate\",this,a)},onBeforeLoad:function(a,b){b.params=b.params||{};this.cleanParams(b.params);var c=this.buildQuery(this.getFilterData());Ext.apply(b.params,c)},onLoad:function(a,b){a.filterBy(this.getRecordFilter())},onRefresh:function(){this.updateColumnHeadings()},updateColumnHeadings:function(){var b=this.grid.getView(),c,a,d;if(b.mainHd){for(c=0,a=b.cm.config.length;c<a;c++){d=this.getFilter(b.cm.config[c].dataIndex);Ext.fly(b.getHeaderCell(c))[d&&d.active?\"addClass\":\"removeClass\"](this.filterCls)}}},reload:function(){if(this.local){this.grid.store.clearFilter(true);this.grid.store.filterBy(this.getRecordFilter())}else{var b,a=this.grid.store;this.deferredUpdate.cancel();if(this.toolbar){b=a.paramNames.start;if(a.lastOptions&&a.lastOptions.params&&a.lastOptions.params[b]){a.lastOptions.params[b]=0}}a.reload()}},getRecordFilter:function(){var c=[],a,b;this.filters.each(function(d){if(d.active){c.push(d)}});a=c.length;return function(d){for(b=0;b<a;b++){if(!c[b].validateRecord(d)){return false}}return true}},addFilter:function(a){var c=this.getFilterClass(a.type),b=a.menu?a:(new c(a));this.filters.add(b);Ext.util.Observable.capture(b,this.onStateChange,this);return b},addFilters:function(f){if(f){var c,b,e,a=false,d;if(f instanceof Ext.grid.ColumnModel){f=f.config;a=true}for(c=0,b=f.length;c<b;c++){e=false;if(a){d=f[c].dataIndex;e=f[c].filter||f[c].filterable;if(e){e=(e===true)?{}:e;Ext.apply(e,{dataIndex:d});e.type=e.type||this.store.fields.get(d).type.type}}else{e=f[c]}if(e){this.addFilter(e)}}}},getFilter:function(a){return this.filters.get(a)},clearFilters:function(){this.filters.each(function(a){a.setActive(false)})},getFilterData:function(){var c=[],b,a;this.filters.each(function(e){if(e.active){var g=[].concat(e.serialize());for(b=0,a=g.length;b<a;b++){c.push({field:e.dataIndex,data:g[b]})}}});return c},buildQuery:function(b){var a={},c,h,j,e,k,d,g=b.length;if(!this.encode){for(c=0;c<g;c++){h=b[c];j=[this.paramPrefix,\"[\",c,\"]\"].join(\"\");a[j+\"[field]\"]=h.field;e=j+\"[data]\";for(k in h.data){a[[e,\"[\",k,\"]\"].join(\"\")]=h.data[k]}}}else{d=[];for(c=0;c<g;c++){h=b[c];d.push(Ext.apply({},{field:h.field},h.data))}if(d.length>0){a[this.paramPrefix]=Ext.util.JSON.encode(d)}}return a},cleanParams:function(c){if(this.encode){delete c[this.paramPrefix]}else{var b,a;b=new RegExp(\"^\"+this.paramPrefix+\"[[0-9]+]\");for(a in c){if(b.test(a)){delete c[a]}}}},getFilterClass:function(a){switch(a){case\"auto\":a=\"string\";break;case\"int\":case\"float\":a=\"numeric\";break;case\"bool\":a=\"boolean\";break}return Ext.ux.grid.filter[a.substr(0,1).toUpperCase()+a.substr(1)+\"Filter\"]}});Ext.preg(\"gridfilters\",Ext.ux.grid.GridFilters);Ext.namespace(\"Ext.ux.grid.filter\");Ext.ux.grid.filter.Filter=Ext.extend(Ext.util.Observable,{active:false,dataIndex:null,menu:null,updateBuffer:500,constructor:function(a){Ext.apply(this,a);this.addEvents(\"activate\",\"deactivate\",\"serialize\",\"update\");Ext.ux.grid.filter.Filter.superclass.constructor.call(this);this.menu=new Ext.menu.Menu();this.init(a);if(a&&a.value){this.setValue(a.value);this.setActive(a.active!==false,true);delete a.value}},destroy:function(){if(this.menu){this.menu.destroy()}this.purgeListeners()},init:Ext.emptyFn,getValue:Ext.emptyFn,setValue:Ext.emptyFn,isActivatable:function(){return true},getSerialArgs:Ext.emptyFn,validateRecord:function(){return true},serialize:function(){var a=this.getSerialArgs();this.fireEvent(\"serialize\",a,this);return a},fireUpdate:function(){if(this.active){this.fireEvent(\"update\",this)}this.setActive(this.isActivatable())},setActive:function(b,a){if(this.active!=b){this.active=b;if(a!==true){this.fireEvent(b?\"activate\":\"deactivate\",this)}}}});Ext.ux.grid.filter.BooleanFilter=Ext.extend(Ext.ux.grid.filter.Filter,{defaultValue:false,yesText:\"Yes\",noText:\"No\",init:function(a){var c=Ext.id();this.options=[new Ext.menu.CheckItem({text:this.yesText,group:c,checked:this.defaultValue===true}),new Ext.menu.CheckItem({text:this.noText,group:c,checked:this.defaultValue===false})];this.menu.add(this.options[0],this.options[1]);for(var b=0;b<this.options.length;b++){this.options[b].on(\"click\",this.fireUpdate,this);this.options[b].on(\"checkchange\",this.fireUpdate,this)}},getValue:function(){return this.options[0].checked},setValue:function(a){this.options[a?0:1].setChecked(true)},getSerialArgs:function(){var a={type:\"boolean\",value:this.getValue()};return a},validateRecord:function(a){return a.get(this.dataIndex)==this.getValue()}});Ext.ux.grid.filter.DateFilter=Ext.extend(Ext.ux.grid.filter.Filter,{afterText:\"After\",beforeText:\"Before\",compareMap:{before:\"lt\",after:\"gt\",on:\"eq\"},dateFormat:\"m/d/Y\",menuItems:[\"before\",\"after\",\"-\",\"on\"],menuItemCfgs:{selectOnFocus:true,width:125},onText:\"On\",pickerOpts:{},init:function(c){var g,d,a,e,b,f;g=Ext.apply(this.pickerOpts,{minDate:this.minDate,maxDate:this.maxDate,format:this.dateFormat,listeners:{scope:this,select:this.onMenuSelect}});this.fields={};for(d=0,a=this.menuItems.length;d<a;d++){e=this.menuItems[d];if(e!==\"-\"){b={itemId:\"range-\"+e,text:this[e+\"Text\"],menu:new Ext.menu.DateMenu(Ext.apply(g,{itemId:e})),listeners:{scope:this,checkchange:this.onCheckChange}};f=Ext.menu.CheckItem;e=this.fields[e]=new f(b)}this.menu.add(e)}},onCheckChange:function(){this.setActive(this.isActivatable());this.fireEvent(\"update\",this)},onInputKeyUp:function(c,b){var a=b.getKey();if(a==b.RETURN&&c.isValid()){b.stopEvent();this.menu.hide(true);return}},onMenuSelect:function(c,d,b){var a=this.fields,e=this.fields[c.itemId];e.setChecked(true);if(e==a.on){a.before.setChecked(false,true);a.after.setChecked(false,true)}else{a.on.setChecked(false,true);if(e==a.after&&a.before.menu.picker.value<d){a.before.setChecked(false,true)}else{if(e==a.before&&a.after.menu.picker.value>d){a.after.setChecked(false,true)}}}this.fireEvent(\"update\",this)},getValue:function(){var b,a={};for(b in this.fields){if(this.fields[b].checked){a[b]=this.fields[b].menu.picker.getValue()}}return a},setValue:function(c,b){var a;for(a in this.fields){if(c[a]){this.fields[a].menu.picker.setValue(c[a]);this.fields[a].setChecked(true)}else{if(!b){this.fields[a].setChecked(false)}}}this.fireEvent(\"update\",this)},isActivatable:function(){var a;for(a in this.fields){if(this.fields[a].checked){return true}}return false},getSerialArgs:function(){var a=[];for(var b in this.fields){if(this.fields[b].checked){a.push({type:\"date\",comparison:this.compareMap[b],value:this.getFieldValue(b).format(this.dateFormat)})}}return a},getFieldValue:function(a){return this.fields[a].menu.picker.getValue()},getPicker:function(a){return this.fields[a].menu.picker},validateRecord:function(a){var b,d,c=a.get(this.dataIndex);if(!Ext.isDate(c)){return false}c=c.clearTime(true).getTime();for(b in this.fields){if(this.fields[b].checked){d=this.getFieldValue(b).clearTime(true).getTime();if(b==\"before\"&&d<=c){return false}if(b==\"after\"&&d>=c){return false}if(b==\"on\"&&d!=c){return false}}}return true}});Ext.ux.grid.filter.ListFilter=Ext.extend(Ext.ux.grid.filter.Filter,{phpMode:false,init:function(a){this.dt=new Ext.util.DelayedTask(this.fireUpdate,this);if(this.menu){this.menu.destroy()}this.menu=new Ext.ux.menu.ListMenu(a);this.menu.on(\"checkchange\",this.onCheckChange,this)},getValue:function(){return this.menu.getSelected()},setValue:function(a){this.menu.setSelected(a);this.fireEvent(\"update\",this)},isActivatable:function(){return this.getValue().length>0},getSerialArgs:function(){var a={type:\"list\",value:this.phpMode?this.getValue().join(\",\"):this.getValue()};return a},onCheckChange:function(){this.dt.delay(this.updateBuffer)},validateRecord:function(a){return this.getValue().indexOf(a.get(this.dataIndex))>-1}});Ext.ux.grid.filter.NumericFilter=Ext.extend(Ext.ux.grid.filter.Filter,{fieldCls:Ext.form.NumberField,iconCls:{gt:\"ux-rangemenu-gt\",lt:\"ux-rangemenu-lt\",eq:\"ux-rangemenu-eq\"},menuItemCfgs:{emptyText:\"Enter Filter Text...\",selectOnFocus:true,width:125},menuItems:[\"lt\",\"gt\",\"-\",\"eq\"],init:function(a){if(this.menu){this.menu.destroy()}this.menu=new Ext.ux.menu.RangeMenu(Ext.apply(a,{fieldCfg:this.fieldCfg||{},fieldCls:this.fieldCls,fields:this.fields||{},iconCls:this.iconCls,menuItemCfgs:this.menuItemCfgs,menuItems:this.menuItems,updateBuffer:this.updateBuffer}));this.menu.on(\"update\",this.fireUpdate,this)},getValue:function(){return this.menu.getValue()},setValue:function(a){this.menu.setValue(a)},isActivatable:function(){var a=this.getValue();for(key in a){if(a[key]!==undefined){return true}}return false},getSerialArgs:function(){var c,b=[],a=this.menu.getValue();for(c in a){b.push({type:\"numeric\",comparison:c,value:a[c]})}return b},validateRecord:function(a){var c=a.get(this.dataIndex),b=this.getValue();if(b.eq!==undefined&&c!=b.eq){return false}if(b.lt!==undefined&&c>=b.lt){return false}if(b.gt!==undefined&&c<=b.gt){return false}return true}});Ext.ux.grid.filter.StringFilter=Ext.extend(Ext.ux.grid.filter.Filter,{iconCls:\"ux-gridfilter-text-icon\",emptyText:\"Enter Filter Text...\",selectOnFocus:true,width:125,init:function(a){Ext.applyIf(a,{enableKeyEvents:true,iconCls:this.iconCls,listeners:{scope:this,keyup:this.onInputKeyUp}});this.inputItem=new Ext.form.TextField(a);this.menu.add(this.inputItem);this.updateTask=new Ext.util.DelayedTask(this.fireUpdate,this)},getValue:function(){return this.inputItem.getValue()},setValue:function(a){this.inputItem.setValue(a);this.fireEvent(\"update\",this)},isActivatable:function(){return this.inputItem.getValue().length>0},getSerialArgs:function(){return{type:\"string\",value:this.getValue()}},validateRecord:function(a){var b=a.get(this.dataIndex);if(typeof b!=\"string\"){return(this.getValue().length===0)}return b.toLowerCase().indexOf(this.getValue().toLowerCase())>-1},onInputKeyUp:function(c,b){var a=b.getKey();if(a==b.RETURN&&c.isValid()){b.stopEvent();this.menu.hide(true);return}this.updateTask.delay(this.updateBuffer)}});Ext.namespace(\"Ext.ux.menu\");Ext.ux.menu.ListMenu=Ext.extend(Ext.menu.Menu,{labelField:\"text\",loadingText:\"Loading...\",loadOnShow:true,single:false,constructor:function(b){this.selected=[];this.addEvents(\"checkchange\");Ext.ux.menu.ListMenu.superclass.constructor.call(this,b=b||{});if(!b.store&&b.options){var c=[];for(var d=0,a=b.options.length;d<a;d++){var e=b.options[d];switch(Ext.type(e)){case\"array\":c.push(e);break;case\"object\":c.push([e.id,e[this.labelField]]);break;case\"string\":c.push([e,e]);break}}this.store=new Ext.data.Store({reader:new Ext.data.ArrayReader({id:0},[\"id\",this.labelField]),data:c,listeners:{load:this.onLoad,scope:this}});this.loaded=true}else{this.add({text:this.loadingText,iconCls:\"loading-indicator\"});this.store.on(\"load\",this.onLoad,this)}},destroy:function(){if(this.store){this.store.destroy()}Ext.ux.menu.ListMenu.superclass.destroy.call(this)},show:function(){var a=null;return function(){if(arguments.length===0){Ext.ux.menu.ListMenu.superclass.show.apply(this,a)}else{a=arguments;if(this.loadOnShow&&!this.loaded){this.store.load()}Ext.ux.menu.ListMenu.superclass.show.apply(this,arguments)}}}(),onLoad:function(c,b){var g=this.isVisible();this.hide(false);this.removeAll(true);var e=this.single?Ext.id():null;for(var d=0,a=b.length;d<a;d++){var f=new Ext.menu.CheckItem({text:b[d].get(this.labelField),group:e,checked:this.selected.indexOf(b[d].id)>-1,hideOnClick:false});f.itemId=b[d].id;f.on(\"checkchange\",this.checkChange,this);this.add(f)}this.loaded=true;if(g){this.show()}this.fireEvent(\"load\",this,b)},getSelected:function(){return this.selected},setSelected:function(a){a=this.selected=[].concat(a);if(this.loaded){this.items.each(function(d){d.setChecked(false,true);for(var c=0,b=a.length;c<b;c++){if(d.itemId==a[c]){d.setChecked(true,true)}}},this)}},checkChange:function(b,a){var c=[];this.items.each(function(d){if(d.checked){c.push(d.itemId)}},this);this.selected=c;this.fireEvent(\"checkchange\",b,a)}});Ext.ns(\"Ext.ux.menu\");Ext.ux.menu.RangeMenu=Ext.extend(Ext.menu.Menu,{constructor:function(c){Ext.ux.menu.RangeMenu.superclass.constructor.call(this,c);this.addEvents(\"update\");this.updateTask=new Ext.util.DelayedTask(this.fireUpdate,this);var d,a,e,b,f;for(d=0,a=this.menuItems.length;d<a;d++){e=this.menuItems[d];if(e!==\"-\"){b={itemId:\"range-\"+e,enableKeyEvents:true,iconCls:this.iconCls[e]||\"no-icon\",listeners:{scope:this,keyup:this.onInputKeyUp}};Ext.apply(b,Ext.applyIf(this.fields[e]||{},this.fieldCfg[e]),this.menuItemCfgs);f=b.fieldCls||this.fieldCls;e=this.fields[e]=new f(b)}this.add(e)}},fireUpdate:function(){this.fireEvent(\"update\",this)},getValue:function(){var a={},b,c;for(b in this.fields){c=this.fields[b];if(c.isValid()&&String(c.getValue()).length>0){a[b]=c.getValue()}}return a},setValue:function(b){var a;for(a in this.fields){this.fields[a].setValue(b[a]!==undefined?b[a]:\"\")}this.fireEvent(\"update\",this)},onInputKeyUp:function(c,b){var a=b.getKey();if(a==b.RETURN&&c.isValid()){b.stopEvent();this.hide(true);return}if(c==this.fields.eq){if(this.fields.gt){this.fields.gt.setValue(null)}if(this.fields.lt){this.fields.lt.setValue(null)}}else{this.fields.eq.setValue(null)}this.updateTask.delay(this.updateBuffer)}});Ext.ns(\"Ext.ux.grid\");Ext.ux.grid.GroupSummary=Ext.extend(Ext.util.Observable,{constructor:function(a){Ext.apply(this,a);Ext.ux.grid.GroupSummary.superclass.constructor.call(this)},init:function(b){this.grid=b;var a=this.view=b.getView();a.doGroupEnd=this.doGroupEnd.createDelegate(this);a.afterMethod(\"onColumnWidthUpdated\",this.doWidth,this);a.afterMethod(\"onAllColumnWidthsUpdated\",this.doAllWidths,this);a.afterMethod(\"onColumnHiddenUpdated\",this.doHidden,this);a.afterMethod(\"onUpdate\",this.doUpdate,this);a.afterMethod(\"onRemove\",this.doRemove,this);if(!this.rowTpl){this.rowTpl=new Ext.Template('<div class=\"x-grid3-summary-row\" style=\"{tstyle}\">','<table class=\"x-grid3-summary-table\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\" style=\"{tstyle}\">',\"<tbody><tr>{cells}</tr></tbody>\",\"</table></div>\");this.rowTpl.disableFormats=true}this.rowTpl.compile();if(!this.cellTpl){this.cellTpl=new Ext.Template('<td class=\"x-grid3-col x-grid3-cell x-grid3-td-{id} {css}\" style=\"{style}\">','<div class=\"x-grid3-cell-inner x-grid3-col-{id}\" unselectable=\"on\">{value}</div>',\"</td>\");this.cellTpl.disableFormats=true}this.cellTpl.compile()},toggleSummaries:function(b){var a=this.grid.getGridEl();if(a){if(b===undefined){b=a.hasClass(\"x-grid-hide-summary\")}a[b?\"removeClass\":\"addClass\"](\"x-grid-hide-summary\")}},renderSummary:function(d,h){h=h||this.view.getColumnData();var j=this.grid.getColumnModel().config,e=[],k,a={},b,l=h.length-1;for(var f=0,g=h.length;f<g;f++){k=h[f];b=j[f];a.id=k.id;a.style=k.style;a.css=f==0?\"x-grid3-cell-first \":(f==l?\"x-grid3-cell-last \":\"\");if(b.summaryType||b.summaryRenderer){a.value=(b.summaryRenderer||k.renderer)(d.data[k.name],a,d)}else{a.value=\"\"}if(a.value==undefined||a.value===\"\"){a.value=\"&#160;\"}e[e.length]=this.cellTpl.apply(a)}return this.rowTpl.apply({tstyle:\"width:\"+this.view.getTotalWidth()+\";\",cells:e.join(\"\")})},calculate:function(d,k){var g={},a,m,l=this.grid.getColumnModel().config,b;for(var e=0,n=d.length;e<n;e++){a=d[e];for(var f=0,h=k.length;f<h;f++){m=k[f];b=l[f];if(b.summaryType){g[m.name]=Ext.ux.grid.GroupSummary.Calculations[b.summaryType](g[m.name]||0,a,m.name,g)}}}return g},doGroupEnd:function(a,d,b,f,c){var e=this.calculate(d.rs,b);a.push(\"</div>\",this.renderSummary({data:e},b),\"</div>\")},doWidth:function(e,b,d){if(!this.isGrouped()){return}var c=this.view.getGroups(),a=c.length,f=0,g;for(;f<a;++f){g=c[f].childNodes[2];g.style.width=d;g.firstChild.style.width=d;g.firstChild.rows[0].childNodes[e].style.width=b}},doAllWidths:function(g,d){if(!this.isGrouped()){return}var a=this.view.getGroups(),f=a.length,c=0,b,k,h,e=g.length;for(;c<f;c++){k=a[c].childNodes[2];k.style.width=d;k.firstChild.style.width=d;h=k.firstChild.rows[0].childNodes;for(b=0;b<e;b++){h[b].style.width=g[b]}}},doHidden:function(d,g,c){if(!this.isGrouped()){return}var b=this.view.getGroups(),a=b.length,e=0,f,h=g?\"none\":\"\";for(;e<a;e++){f=b[e].childNodes[2];f.style.width=c;f.firstChild.style.width=c;f.firstChild.rows[0].childNodes[d].style.display=h}},isGrouped:function(){return !Ext.isEmpty(this.grid.getStore().groupField)},refreshSummary:function(a){return this.refreshSummaryById(this.view.getGroupId(a))},getSummaryNode:function(a){var b=Ext.fly(a,\"_gsummary\");if(b){return b.down(\".x-grid3-summary-row\",true)}return null},refreshSummaryById:function(d){var f=Ext.getDom(d);if(!f){return false}var b=[];this.grid.getStore().each(function(g){if(g._groupId==d){b[b.length]=g}});var c=this.view.getColumnData(),h=this.calculate(b,c),a=this.renderSummary({data:h},c),e=this.getSummaryNode(d);if(e){f.removeChild(e)}Ext.DomHelper.append(f,a);return true},doUpdate:function(b,a){this.refreshSummaryById(a._groupId)},doRemove:function(d,a,b,c){if(!c){this.refreshSummaryById(a._groupId)}},showSummaryMsg:function(a,d){var b=this.view.getGroupId(a),c=this.getSummaryNode(b);if(c){c.innerHTML='<div class=\"x-grid3-summary-msg\">'+d+\"</div>\"}}});Ext.grid.GroupSummary=Ext.ux.grid.GroupSummary;Ext.ux.grid.GroupSummary.Calculations={sum:function(b,a,c){return b+(a.data[c]||0)},count:function(b,a,d,c){return c[d+\"count\"]?++c[d+\"count\"]:(c[d+\"count\"]=1)},max:function(c,b,e,d){var c=b.data[e];var a=d[e+\"max\"]===undefined?(d[e+\"max\"]=c):d[e+\"max\"];return c>a?(d[e+\"max\"]=c):a},min:function(b,a,e,d){var b=a.data[e];var c=d[e+\"min\"]===undefined?(d[e+\"min\"]=b):d[e+\"min\"];return b<c?(d[e+\"min\"]=b):c},average:function(b,a,f,e){var g=e[f+\"count\"]?++e[f+\"count\"]:(e[f+\"count\"]=1);var d=(e[f+\"total\"]=((e[f+\"total\"]||0)+(a.data[f]||0)));return d===0?0:d/g}};Ext.grid.GroupSummary.Calculations=Ext.ux.grid.GroupSummary.Calculations;Ext.ux.grid.HybridSummary=Ext.extend(Ext.ux.grid.GroupSummary,{calculate:function(b,d){var a=this.view.getGroupField(),c=b[0].data[a],e=this.getSummaryData(c);return e||Ext.ux.grid.HybridSummary.superclass.calculate.call(this,b,d)},updateSummaryData:function(a,d,c){var b=this.grid.getStore().reader.jsonData;if(!b.summaryData){b.summaryData={}}b.summaryData[a]=d;if(!c){this.refreshSummary(a)}},getSummaryData:function(c){var b=this.grid.getStore().reader,e=b.jsonData,a=b.recordType.prototype.fields,d;if(e&&e.summaryData){d=e.summaryData[c];if(d){return b.extractValues(d,a.items,a.length)}}return null}});Ext.grid.HybridSummary=Ext.ux.grid.HybridSummary;Ext.ux.GroupTab=Ext.extend(Ext.Container,{mainItem:0,expanded:true,deferredRender:true,activeTab:null,idDelimiter:\"__\",headerAsText:false,frame:false,hideBorders:true,initComponent:function(a){Ext.apply(this,a);this.frame=false;Ext.ux.GroupTab.superclass.initComponent.call(this);this.addEvents(\"activate\",\"deactivate\",\"changemainitem\",\"beforetabchange\",\"tabchange\");this.setLayout(new Ext.layout.CardLayout({deferredRender:this.deferredRender}));if(!this.stack){this.stack=Ext.TabPanel.AccessStack()}this.initItems();this.on(\"beforerender\",function(){this.groupEl=this.ownerCt.getGroupEl(this)},this);this.on(\"add\",this.onAdd,this,{target:this});this.on(\"remove\",this.onRemove,this,{target:this});if(this.mainItem!==undefined){var b=(typeof this.mainItem==\"object\")?this.mainItem:this.items.get(this.mainItem);delete this.mainItem;this.setMainItem(b)}},setActiveTab:function(c){c=this.getComponent(c);if(!c){return false}if(!this.rendered){this.activeTab=c;return true}if(this.activeTab!=c&&this.fireEvent(\"beforetabchange\",this,c,this.activeTab)!==false){if(this.activeTab&&this.activeTab!=this.mainItem){var a=this.getTabEl(this.activeTab);if(a){Ext.fly(a).removeClass(\"x-grouptabs-strip-active\")}}var b=this.getTabEl(c);Ext.fly(b).addClass(\"x-grouptabs-strip-active\");this.activeTab=c;this.stack.add(c);this.layout.setActiveItem(c);if(this.layoutOnTabChange&&c.doLayout){c.doLayout()}if(this.scrolling){this.scrollToTab(c,this.animScroll)}this.fireEvent(\"tabchange\",this,c);return true}return false},getTabEl:function(a){if(a==this.mainItem){return this.groupEl}return Ext.TabPanel.prototype.getTabEl.call(this,a)},onRender:function(b,a){Ext.ux.GroupTab.superclass.onRender.call(this,b,a);this.strip=Ext.fly(this.groupEl).createChild({tag:\"ul\",cls:\"x-grouptabs-sub\"});this.tooltip=new Ext.ToolTip({target:this.groupEl,delegate:\"a.x-grouptabs-text\",trackMouse:true,renderTo:document.body,listeners:{beforeshow:function(e){var d=(e.triggerElement.parentNode===this.mainItem.tabEl)?this.mainItem:this.findById(e.triggerElement.parentNode.id.split(this.idDelimiter)[1]);if(!d.tabTip){return false}e.body.dom.innerHTML=d.tabTip},scope:this}});if(!this.itemTpl){var c=new Ext.Template('<li class=\"{cls}\" id=\"{id}\">','<a onclick=\"return false;\" class=\"x-grouptabs-text {iconCls}\">{text}</a>',\"</li>\");c.disableFormats=true;c.compile();Ext.ux.GroupTab.prototype.itemTpl=c}this.items.each(this.initTab,this)},afterRender:function(){Ext.ux.GroupTab.superclass.afterRender.call(this);if(this.activeTab!==undefined){var a=(typeof this.activeTab==\"object\")?this.activeTab:this.items.get(this.activeTab);delete this.activeTab;this.setActiveTab(a)}},initTab:function(c,a){var d=this.strip.dom.childNodes[a];var e=Ext.TabPanel.prototype.getTemplateArgs.call(this,c);if(c===this.mainItem){c.tabEl=this.groupEl;e.cls+=\" x-grouptabs-main-item\"}var b=d?this.itemTpl.insertBefore(d,e):this.itemTpl.append(this.strip,e);c.tabEl=c.tabEl||b;c.on(\"disable\",this.onItemDisabled,this);c.on(\"enable\",this.onItemEnabled,this);c.on(\"titlechange\",this.onItemTitleChanged,this);c.on(\"iconchange\",this.onItemIconChanged,this);c.on(\"beforeshow\",this.onBeforeShowItem,this)},setMainItem:function(a){a=this.getComponent(a);if(!a||this.fireEvent(\"changemainitem\",this,a,this.mainItem)===false){return}this.mainItem=a},getMainItem:function(){return this.mainItem||null},onBeforeShowItem:function(a){if(a!=this.activeTab){this.setActiveTab(a);return false}},onAdd:function(a,c,b){if(this.rendered){this.initTab.call(this,c,b)}},onRemove:function(c,b){Ext.destroy(Ext.get(this.getTabEl(b)));this.stack.remove(b);b.un(\"disable\",this.onItemDisabled,this);b.un(\"enable\",this.onItemEnabled,this);b.un(\"titlechange\",this.onItemTitleChanged,this);b.un(\"iconchange\",this.onItemIconChanged,this);b.un(\"beforeshow\",this.onBeforeShowItem,this);if(b==this.activeTab){var a=this.stack.next();if(a){this.setActiveTab(a)}else{if(this.items.getCount()>0){this.setActiveTab(0)}else{this.activeTab=null}}}},onBeforeAdd:function(b){var a=b.events?(this.items.containsKey(b.getItemId())?b:null):this.items.get(b);if(a){this.setActiveTab(b);return false}Ext.TabPanel.superclass.onBeforeAdd.apply(this,arguments);var c=b.elements;b.elements=c?c.replace(\",header\",\"\"):c;b.border=(b.border===true)},onItemDisabled:Ext.TabPanel.prototype.onItemDisabled,onItemEnabled:Ext.TabPanel.prototype.onItemEnabled,onItemTitleChanged:function(b){var a=this.getTabEl(b);if(a){Ext.fly(a).child(\"a.x-grouptabs-text\",true).innerHTML=b.title}},onItemIconChanged:function(d,a,c){var b=this.getTabEl(d);if(b){Ext.fly(b).child(\"a.x-grouptabs-text\").replaceClass(c,a)}},beforeDestroy:function(){Ext.TabPanel.prototype.beforeDestroy.call(this);this.tooltip.destroy()}});Ext.reg(\"grouptab\",Ext.ux.GroupTab);Ext.ns(\"Ext.ux\");Ext.ux.GroupTabPanel=Ext.extend(Ext.TabPanel,{tabPosition:\"left\",alternateColor:false,alternateCls:\"x-grouptabs-panel-alt\",defaultType:\"grouptab\",deferredRender:false,activeGroup:null,initComponent:function(){Ext.ux.GroupTabPanel.superclass.initComponent.call(this);this.addEvents(\"beforegroupchange\",\"groupchange\");this.elements=\"body,header\";this.stripTarget=\"header\";this.tabPosition=this.tabPosition==\"right\"?\"right\":\"left\";this.addClass(\"x-grouptabs-panel\");if(this.tabStyle&&this.tabStyle!=\"\"){this.addClass(\"x-grouptabs-panel-\"+this.tabStyle)}if(this.alternateColor){this.addClass(this.alternateCls)}this.on(\"beforeadd\",function(b,c,a){this.initGroup(c,a)});this.items.each(function(a){a.on(\"tabchange\",function(b){this.fireEvent(\"tabchange\",this,b.activeTab)},this)},this)},initEvents:function(){this.mon(this.strip,\"mousedown\",this.onStripMouseDown,this)},onRender:function(c,a){Ext.TabPanel.superclass.onRender.call(this,c,a);if(this.plain){var f=this.tabPosition==\"top\"?\"header\":\"footer\";this[f].addClass(\"x-tab-panel-\"+f+\"-plain\")}var b=this[this.stripTarget];this.stripWrap=b.createChild({cls:\"x-tab-strip-wrap \",cn:{tag:\"ul\",cls:\"x-grouptabs-strip x-grouptabs-tab-strip-\"+this.tabPosition}});var e=(this.tabPosition==\"bottom\"?this.stripWrap:null);this.strip=new Ext.Element(this.stripWrap.dom.firstChild);this.header.addClass(\"x-grouptabs-panel-header\");this.bwrap.addClass(\"x-grouptabs-bwrap\");this.body.addClass(\"x-tab-panel-body-\"+this.tabPosition+\" x-grouptabs-panel-body\");if(!this.groupTpl){var d=new Ext.Template('<li class=\"{cls}\" id=\"{id}\">','<a class=\"x-grouptabs-expand\" onclick=\"return false;\"></a>','<a class=\"x-grouptabs-text {iconCls}\" href=\"#\" onclick=\"return false;\">',\"<span>{text}</span></a>\",\"</li>\");d.disableFormats=true;d.compile();Ext.ux.GroupTabPanel.prototype.groupTpl=d}this.items.each(this.initGroup,this)},afterRender:function(){Ext.ux.GroupTabPanel.superclass.afterRender.call(this);this.tabJoint=Ext.fly(this.body.dom.parentNode).createChild({cls:\"x-tab-joint\"});this.addClass(\"x-tab-panel-\"+this.tabPosition);this.header.setWidth(this.tabWidth);if(this.activeGroup!==undefined){var a=(typeof this.activeGroup==\"object\")?this.activeGroup:this.items.get(this.activeGroup);delete this.activeGroup;this.setActiveGroup(a);a.setActiveTab(a.getMainItem())}},getGroupEl:Ext.TabPanel.prototype.getTabEl,findTargets:function(c){var b=null,a=c.getTarget(\"li\",this.strip);if(a){b=this.findById(a.id.split(this.idDelimiter)[1]);if(b.disabled){return{expand:null,item:null,el:null}}}return{expand:c.getTarget(\".x-grouptabs-expand\",this.strip),isGroup:!c.getTarget(\"ul.x-grouptabs-sub\",this.strip),item:b,el:a}},onStripMouseDown:function(b){if(b.button!=0){return}b.preventDefault();var a=this.findTargets(b);if(a.expand){this.toggleGroup(a.el)}else{if(a.item){if(a.isGroup){a.item.setActiveTab(a.item.getMainItem())}else{a.item.ownerCt.setActiveTab(a.item)}}}},expandGroup:function(a){if(a.isXType){a=this.getGroupEl(a)}Ext.fly(a).addClass(\"x-grouptabs-expanded\");this.syncTabJoint()},toggleGroup:function(a){if(a.isXType){a=this.getGroupEl(a)}Ext.fly(a).toggleClass(\"x-grouptabs-expanded\");this.syncTabJoint()},collapseGroup:function(a){if(a.isXType){a=this.getGroupEl(a)}Ext.fly(a).removeClass(\"x-grouptabs-expanded\");this.syncTabJoint()},syncTabJoint:function(b){if(!this.tabJoint){return}b=b||this.getGroupEl(this.activeGroup);if(b){this.tabJoint.setHeight(Ext.fly(b).getHeight()-2);var a=Ext.isGecko2?0:1;if(this.tabPosition==\"left\"){this.tabJoint.alignTo(b,\"tl-tr\",[-2,a])}else{this.tabJoint.alignTo(b,\"tr-tl\",[1,a])}}else{this.tabJoint.hide()}},getActiveTab:function(){if(!this.activeGroup){return null}return this.activeGroup.getTabEl(this.activeGroup.activeTab)||null},onResize:function(){Ext.ux.GroupTabPanel.superclass.onResize.apply(this,arguments);this.syncTabJoint()},createCorner:function(a,b){return Ext.fly(a).createChild({cls:\"x-grouptabs-corner x-grouptabs-corner-\"+b})},initGroup:function(f,b){var d=this.strip.dom.childNodes[b],e=this.getTemplateArgs(f);if(b===0){e.cls+=\" x-tab-first\"}e.cls+=\" x-grouptabs-main\";e.text=f.getMainItem().title;var c=d?this.groupTpl.insertBefore(d,e):this.groupTpl.append(this.strip,e),a=this.createCorner(c,\"top-\"+this.tabPosition),g=this.createCorner(c,\"bottom-\"+this.tabPosition);f.tabEl=c;if(f.expanded){this.expandGroup(c)}if(Ext.isIE6||(Ext.isIE&&!Ext.isStrict)){g.setLeft(\"-10px\");g.setBottom(\"-5px\");a.setLeft(\"-10px\");a.setTop(\"-5px\")}this.mon(f,{scope:this,changemainitem:this.onGroupChangeMainItem,beforetabchange:this.onGroupBeforeTabChange})},setActiveGroup:function(b){b=this.getComponent(b);if(!b){return false}if(!this.rendered){this.activeGroup=b;return true}if(this.activeGroup!=b&&this.fireEvent(\"beforegroupchange\",this,b,this.activeGroup)!==false){if(this.activeGroup){this.activeGroup.activeTab=null;var a=this.getGroupEl(this.activeGroup);if(a){Ext.fly(a).removeClass(\"x-grouptabs-strip-active\")}}var c=this.getGroupEl(b);Ext.fly(c).addClass(\"x-grouptabs-strip-active\");this.activeGroup=b;this.stack.add(b);this.layout.setActiveItem(b);this.syncTabJoint(c);this.fireEvent(\"groupchange\",this,b);return true}return false},onGroupBeforeTabChange:function(a,c,b){if(a!==this.activeGroup||c!==b){this.strip.select(\".x-grouptabs-sub > li.x-grouptabs-strip-active\",true).removeClass(\"x-grouptabs-strip-active\")}this.expandGroup(this.getGroupEl(a));if(a!==this.activeGroup){return this.setActiveGroup(a)}},getFrameHeight:function(){var a=this.el.getFrameWidth(\"tb\");a+=(this.tbar?this.tbar.getHeight():0)+(this.bbar?this.bbar.getHeight():0);return a},adjustBodyWidth:function(a){return a-this.tabWidth}});Ext.reg(\"grouptabpanel\",Ext.ux.GroupTabPanel);Ext.ux.form.ItemSelector=Ext.extend(Ext.form.Field,{hideNavIcons:false,imagePath:\"\",iconUp:\"up2.gif\",iconDown:\"down2.gif\",iconLeft:\"left2.gif\",iconRight:\"right2.gif\",iconTop:\"top2.gif\",iconBottom:\"bottom2.gif\",drawUpIcon:true,drawDownIcon:true,drawLeftIcon:true,drawRightIcon:true,drawTopIcon:true,drawBotIcon:true,delimiter:\",\",bodyStyle:null,border:false,defaultAutoCreate:{tag:\"div\"},multiselects:null,initComponent:function(){Ext.ux.form.ItemSelector.superclass.initComponent.call(this);this.addEvents({rowdblclick:true,change:true})},onRender:function(d,a){Ext.ux.form.ItemSelector.superclass.onRender.call(this,d,a);var h=[{legend:\"Available\",draggable:true,droppable:true,width:100,height:100},{legend:\"Selected\",droppable:true,draggable:true,width:100,height:100}];this.fromMultiselect=new Ext.ux.form.MultiSelect(Ext.applyIf(this.multiselects[0],h[0]));this.fromMultiselect.on(\"dblclick\",this.onRowDblClick,this);this.toMultiselect=new Ext.ux.form.MultiSelect(Ext.applyIf(this.multiselects[1],h[1]));this.toMultiselect.on(\"dblclick\",this.onRowDblClick,this);var g=new Ext.Panel({bodyStyle:this.bodyStyle,border:this.border,layout:\"table\",layoutConfig:{columns:3}});g.add(this.fromMultiselect);var c=new Ext.Panel({header:false});g.add(c);g.add(this.toMultiselect);g.render(this.el);c.el.down(\".\"+c.bwrapCls).remove();if(this.imagePath!=\"\"&&this.imagePath.charAt(this.imagePath.length-1)!=\"/\"){this.imagePath+=\"/\"}this.iconUp=this.imagePath+(this.iconUp||\"up2.gif\");this.iconDown=this.imagePath+(this.iconDown||\"down2.gif\");this.iconLeft=this.imagePath+(this.iconLeft||\"left2.gif\");this.iconRight=this.imagePath+(this.iconRight||\"right2.gif\");this.iconTop=this.imagePath+(this.iconTop||\"top2.gif\");this.iconBottom=this.imagePath+(this.iconBottom||\"bottom2.gif\");var f=c.getEl();this.toTopIcon=f.createChild({tag:\"img\",src:this.iconTop,style:{cursor:\"pointer\",margin:\"2px\"}});f.createChild({tag:\"br\"});this.upIcon=f.createChild({tag:\"img\",src:this.iconUp,style:{cursor:\"pointer\",margin:\"2px\"}});f.createChild({tag:\"br\"});this.addIcon=f.createChild({tag:\"img\",src:this.iconRight,style:{cursor:\"pointer\",margin:\"2px\"}});f.createChild({tag:\"br\"});this.removeIcon=f.createChild({tag:\"img\",src:this.iconLeft,style:{cursor:\"pointer\",margin:\"2px\"}});f.createChild({tag:\"br\"});this.downIcon=f.createChild({tag:\"img\",src:this.iconDown,style:{cursor:\"pointer\",margin:\"2px\"}});f.createChild({tag:\"br\"});this.toBottomIcon=f.createChild({tag:\"img\",src:this.iconBottom,style:{cursor:\"pointer\",margin:\"2px\"}});this.toTopIcon.on(\"click\",this.toTop,this);this.upIcon.on(\"click\",this.up,this);this.downIcon.on(\"click\",this.down,this);this.toBottomIcon.on(\"click\",this.toBottom,this);this.addIcon.on(\"click\",this.fromTo,this);this.removeIcon.on(\"click\",this.toFrom,this);if(!this.drawUpIcon||this.hideNavIcons){this.upIcon.dom.style.display=\"none\"}if(!this.drawDownIcon||this.hideNavIcons){this.downIcon.dom.style.display=\"none\"}if(!this.drawLeftIcon||this.hideNavIcons){this.addIcon.dom.style.display=\"none\"}if(!this.drawRightIcon||this.hideNavIcons){this.removeIcon.dom.style.display=\"none\"}if(!this.drawTopIcon||this.hideNavIcons){this.toTopIcon.dom.style.display=\"none\"}if(!this.drawBotIcon||this.hideNavIcons){this.toBottomIcon.dom.style.display=\"none\"}var b=g.body.first();this.el.setWidth(g.body.first().getWidth());g.body.removeClass();this.hiddenName=this.name;var e={tag:\"input\",type:\"hidden\",value:\"\",name:this.name};this.hiddenField=this.el.createChild(e)},doLayout:function(){if(this.rendered){this.fromMultiselect.fs.doLayout();this.toMultiselect.fs.doLayout()}},afterRender:function(){Ext.ux.form.ItemSelector.superclass.afterRender.call(this);this.toStore=this.toMultiselect.store;this.toStore.on(\"add\",this.valueChanged,this);this.toStore.on(\"remove\",this.valueChanged,this);this.toStore.on(\"load\",this.valueChanged,this);this.valueChanged(this.toStore)},toTop:function(){var c=this.toMultiselect.view.getSelectedIndexes();var a=[];if(c.length>0){c.sort();for(var b=0;b<c.length;b++){record=this.toMultiselect.view.store.getAt(c[b]);a.push(record)}c=[];for(var b=a.length-1;b>-1;b--){record=a[b];this.toMultiselect.view.store.remove(record);this.toMultiselect.view.store.insert(0,record);c.push(((a.length-1)-b))}}this.toMultiselect.view.refresh();this.toMultiselect.view.select(c)},toBottom:function(){var c=this.toMultiselect.view.getSelectedIndexes();var a=[];if(c.length>0){c.sort();for(var b=0;b<c.length;b++){record=this.toMultiselect.view.store.getAt(c[b]);a.push(record)}c=[];for(var b=0;b<a.length;b++){record=a[b];this.toMultiselect.view.store.remove(record);this.toMultiselect.view.store.add(record);c.push((this.toMultiselect.view.store.getCount())-(a.length-b))}}this.toMultiselect.view.refresh();this.toMultiselect.view.select(c)},up:function(){var a=null;var c=this.toMultiselect.view.getSelectedIndexes();c.sort();var d=[];if(c.length>0){for(var b=0;b<c.length;b++){a=this.toMultiselect.view.store.getAt(c[b]);if((c[b]-1)>=0){this.toMultiselect.view.store.remove(a);this.toMultiselect.view.store.insert(c[b]-1,a);d.push(c[b]-1)}}this.toMultiselect.view.refresh();this.toMultiselect.view.select(d)}},down:function(){var a=null;var c=this.toMultiselect.view.getSelectedIndexes();c.sort();c.reverse();var d=[];if(c.length>0){for(var b=0;b<c.length;b++){a=this.toMultiselect.view.store.getAt(c[b]);if((c[b]+1)<this.toMultiselect.view.store.getCount()){this.toMultiselect.view.store.remove(a);this.toMultiselect.view.store.insert(c[b]+1,a);d.push(c[b]+1)}}this.toMultiselect.view.refresh();this.toMultiselect.view.select(d)}},fromTo:function(){var e=this.fromMultiselect.view.getSelectedIndexes();var b=[];if(e.length>0){for(var d=0;d<e.length;d++){record=this.fromMultiselect.view.store.getAt(e[d]);b.push(record)}if(!this.allowDup){e=[]}for(var d=0;d<b.length;d++){record=b[d];if(this.allowDup){var a=new Ext.data.Record();record.id=a.id;delete a;this.toMultiselect.view.store.add(record)}else{this.fromMultiselect.view.store.remove(record);this.toMultiselect.view.store.add(record);e.push((this.toMultiselect.view.store.getCount()-1))}}}this.toMultiselect.view.refresh();this.fromMultiselect.view.refresh();var c=this.toMultiselect.store.sortInfo;if(c){this.toMultiselect.store.sort(c.field,c.direction)}this.toMultiselect.view.select(e)},toFrom:function(){var d=this.toMultiselect.view.getSelectedIndexes();var a=[];if(d.length>0){for(var c=0;c<d.length;c++){record=this.toMultiselect.view.store.getAt(d[c]);a.push(record)}d=[];for(var c=0;c<a.length;c++){record=a[c];this.toMultiselect.view.store.remove(record);if(!this.allowDup){this.fromMultiselect.view.store.add(record);d.push((this.fromMultiselect.view.store.getCount()-1))}}}this.fromMultiselect.view.refresh();this.toMultiselect.view.refresh();var b=this.fromMultiselect.store.sortInfo;if(b){this.fromMultiselect.store.sort(b.field,b.direction)}this.fromMultiselect.view.select(d)},valueChanged:function(c){var a=null;var b=[];for(var d=0;d<c.getCount();d++){a=c.getAt(d);b.push(a.get(this.toMultiselect.valueField))}this.hiddenField.dom.value=b.join(this.delimiter);this.fireEvent(\"change\",this,this.getValue(),this.hiddenField.dom.value)},getValue:function(){return this.hiddenField.dom.value},onRowDblClick:function(c,a,b,d){if(c==this.toMultiselect.view){this.toFrom()}else{if(c==this.fromMultiselect.view){this.fromTo()}}return this.fireEvent(\"rowdblclick\",c,a,b,d)},reset:function(){range=this.toMultiselect.store.getRange();this.toMultiselect.store.removeAll();this.fromMultiselect.store.add(range);var a=this.fromMultiselect.store.sortInfo;if(a){this.fromMultiselect.store.sort(a.field,a.direction)}this.valueChanged(this.toMultiselect.store)}});Ext.reg(\"itemselector\",Ext.ux.form.ItemSelector);Ext.ux.ItemSelector=Ext.ux.form.ItemSelector;Ext.ns(\"Ext.ux.grid\");Ext.ux.grid.LockingGridView=Ext.extend(Ext.grid.GridView,{lockText:\"Lock\",unlockText:\"Unlock\",rowBorderWidth:1,lockedBorderWidth:1,syncHeights:false,initTemplates:function(){var a=this.templates||{};if(!a.masterTpl){a.masterTpl=new Ext.Template('<div class=\"x-grid3\" hidefocus=\"true\">','<div class=\"x-grid3-locked\">','<div class=\"x-grid3-header\"><div class=\"x-grid3-header-inner\"><div class=\"x-grid3-header-offset\" style=\"{lstyle}\">{lockedHeader}</div></div><div class=\"x-clear\"></div></div>','<div class=\"x-grid3-scroller\"><div class=\"x-grid3-body\" style=\"{lstyle}\">{lockedBody}</div><div class=\"x-grid3-scroll-spacer\"></div></div>',\"</div>\",'<div class=\"x-grid3-viewport x-grid3-unlocked\">','<div class=\"x-grid3-header\"><div class=\"x-grid3-header-inner\"><div class=\"x-grid3-header-offset\" style=\"{ostyle}\">{header}</div></div><div class=\"x-clear\"></div></div>','<div class=\"x-grid3-scroller\"><div class=\"x-grid3-body\" style=\"{bstyle}\">{body}</div><a href=\"#\" class=\"x-grid3-focus\" tabIndex=\"-1\"></a></div>',\"</div>\",'<div class=\"x-grid3-resize-marker\">&#160;</div>','<div class=\"x-grid3-resize-proxy\">&#160;</div>',\"</div>\")}this.templates=a;Ext.ux.grid.LockingGridView.superclass.initTemplates.call(this)},getEditorParent:function(a){return this.el.dom},initElements:function(){var e=Ext.get(this.grid.getGridEl().dom.firstChild),g=e.child(\"div.x-grid3-locked\"),c=g.child(\"div.x-grid3-header\"),b=g.child(\"div.x-grid3-scroller\"),f=e.child(\"div.x-grid3-viewport\"),d=f.child(\"div.x-grid3-header\"),a=f.child(\"div.x-grid3-scroller\");if(this.grid.hideHeaders){c.setDisplayed(false);d.setDisplayed(false)}if(this.forceFit){a.setStyle(\"overflow-x\",\"hidden\")}Ext.apply(this,{el:e,mainWrap:f,mainHd:d,innerHd:d.dom.firstChild,scroller:a,mainBody:a.child(\"div.x-grid3-body\"),focusEl:a.child(\"a\"),resizeMarker:e.child(\"div.x-grid3-resize-marker\"),resizeProxy:e.child(\"div.x-grid3-resize-proxy\"),lockedWrap:g,lockedHd:c,lockedScroller:b,lockedBody:b.child(\"div.x-grid3-body\"),lockedInnerHd:c.child(\"div.x-grid3-header-inner\",true)});this.focusEl.swallowEvent(\"click\",true)},getLockedRows:function(){return this.hasRows()?this.lockedBody.dom.childNodes:[]},getLockedRow:function(a){return this.getLockedRows()[a]},getCell:function(c,a){var b=this.cm.getLockedCount();if(a<b){return this.getLockedRow(c).getElementsByTagName(\"td\")[a]}return Ext.ux.grid.LockingGridView.superclass.getCell.call(this,c,a-b)},getHeaderCell:function(a){var b=this.cm.getLockedCount();if(a<b){return this.lockedHd.dom.getElementsByTagName(\"td\")[a]}return Ext.ux.grid.LockingGridView.superclass.getHeaderCell.call(this,a-b)},addRowClass:function(c,a){var b=this.getLockedRow(c);if(b){this.fly(b).addClass(a)}Ext.ux.grid.LockingGridView.superclass.addRowClass.call(this,c,a)},removeRowClass:function(c,a){var b=this.getLockedRow(c);if(b){this.fly(b).removeClass(a)}Ext.ux.grid.LockingGridView.superclass.removeRowClass.call(this,c,a)},removeRow:function(a){Ext.removeNode(this.getLockedRow(a));Ext.ux.grid.LockingGridView.superclass.removeRow.call(this,a)},removeRows:function(c,b){var a=this.lockedBody.dom,d=c;for(;d<=b;d++){Ext.removeNode(a.childNodes[c])}Ext.ux.grid.LockingGridView.superclass.removeRows.call(this,c,b)},syncScroll:function(a){this.lockedScroller.dom.scrollTop=this.scroller.dom.scrollTop;Ext.ux.grid.LockingGridView.superclass.syncScroll.call(this,a)},updateSortIcon:function(d,c){var a=this.sortClasses,e=this.lockedHd.select(\"td\").removeClass(a),g=this.mainHd.select(\"td\").removeClass(a),f=this.cm.getLockedCount(),b=a[c==\"DESC\"?1:0];if(d<f){e.item(d).addClass(b)}else{g.item(d-f).addClass(b)}},updateAllColumnWidths:function(){var g=this.getTotalWidth(),n=this.cm.getColumnCount(),b=this.getLockedWidth(),d=this.cm.getLockedCount(),k=[],h,e;this.updateLockedWidth();for(e=0;e<n;e++){k[e]=this.getColumnWidth(e);var f=this.getHeaderCell(e);f.style.width=k[e]}var a=this.getLockedRows(),m=this.getRows(),o,l,c;for(e=0,h=m.length;e<h;e++){o=a[e];o.style.width=b;if(o.firstChild){o.firstChild.style.width=b;l=o.firstChild.rows[0];for(c=0;c<d;c++){l.childNodes[c].style.width=k[c]}}o=m[e];o.style.width=g;if(o.firstChild){o.firstChild.style.width=g;l=o.firstChild.rows[0];for(c=d;c<n;c++){l.childNodes[c-d].style.width=k[c]}}}this.onAllColumnWidthsUpdated(k,g);this.syncHeaderHeight()},updateColumnWidth:function(d,a){var l=this.getColumnWidth(d),e=this.cm.getLockedCount(),k,b,j,m;this.updateLockedWidth();if(d<e){k=this.getLockedRows();b=this.getLockedWidth();j=d}else{k=this.getRows();b=this.getTotalWidth();j=d-e}var g=this.getHeaderCell(d);g.style.width=l;for(var f=0,h=k.length;f<h;f++){m=k[f];m.style.width=b;if(m.firstChild){m.firstChild.style.width=b;m.firstChild.rows[0].childNodes[j].style.width=l}}this.onColumnWidthUpdated(d,l,this.getTotalWidth());this.syncHeaderHeight()},updateColumnHidden:function(b,g){var d=this.cm.getLockedCount(),l,a,k,m,j=g?\"none\":\"\";this.updateLockedWidth();if(b<d){l=this.getLockedRows();a=this.getLockedWidth();k=b}else{l=this.getRows();a=this.getTotalWidth();k=b-d}var f=this.getHeaderCell(b);f.style.display=j;for(var e=0,h=l.length;e<h;e++){m=l[e];m.style.width=a;if(m.firstChild){m.firstChild.style.width=a;m.firstChild.rows[0].childNodes[k].style.display=j}}this.onColumnHiddenUpdated(b,g,this.getTotalWidth());delete this.lastViewWidth;this.layout()},doRender:function(g,l,t,a,s,x){var d=this.templates,f=d.cell,h=d.row,n=s-1,e=\"width:\"+this.getTotalWidth()+\";\",b=\"width:\"+this.getLockedWidth()+\";\",A=[],D=[],v,k,B,u={},m={},q;for(var w=0,z=l.length;w<z;w++){q=l[w];v=[];k=[];var o=(w+a);for(var y=0;y<s;y++){B=g[y];u.id=B.id;u.css=(y===0?\"x-grid3-cell-first \":(y==n?\"x-grid3-cell-last \":\"\"))+(this.cm.config[y].cellCls?\" \"+this.cm.config[y].cellCls:\"\");u.attr=u.cellAttr=\"\";u.value=B.renderer(q.data[B.name],u,q,o,y,t);u.style=B.style;if(Ext.isEmpty(u.value)){u.value=\"&#160;\"}if(this.markDirty&&q.dirty&&Ext.isDefined(q.modified[B.name])){u.css+=\" x-grid3-dirty-cell\"}if(B.locked){k[k.length]=f.apply(u)}else{v[v.length]=f.apply(u)}}var C=[];if(x&&((o+1)%2===0)){C[0]=\"x-grid3-row-alt\"}if(q.dirty){C[1]=\" x-grid3-dirty-row\"}m.cols=s;if(this.getRowClass){C[2]=this.getRowClass(q,o,m,t)}m.alt=C.join(\" \");m.cells=v.join(\"\");m.tstyle=e;A[A.length]=h.apply(m);m.cells=k.join(\"\");m.tstyle=b;D[D.length]=h.apply(m)}return[A.join(\"\"),D.join(\"\")]},processRows:function(b,h){if(!this.ds||this.ds.getCount()<1){return}var f=this.getRows(),e=this.getLockedRows(),g,d;h=h||!this.grid.stripeRows;b=b||0;for(var c=0,a=f.length;c<a;++c){g=f[c];d=e[c];g.rowIndex=c;d.rowIndex=c;if(!h){g.className=g.className.replace(this.rowClsRe,\" \");d.className=d.className.replace(this.rowClsRe,\" \");if((c+1)%2===0){g.className+=\" x-grid3-row-alt\";d.className+=\" x-grid3-row-alt\"}}this.syncRowHeights(g,d)}if(b===0){Ext.fly(f[0]).addClass(this.firstRowCls);Ext.fly(e[0]).addClass(this.firstRowCls)}Ext.fly(f[f.length-1]).addClass(this.lastRowCls);Ext.fly(e[e.length-1]).addClass(this.lastRowCls)},syncRowHeights:function(f,e){if(this.syncHeights){var d=Ext.get(f),b=Ext.get(e),c=d.getHeight(),a=b.getHeight();if(c>a){b.setHeight(c)}else{if(a>c){d.setHeight(a)}}}},afterRender:function(){if(!this.ds||!this.cm){return}var a=this.renderRows()||[\"&#160;\",\"&#160;\"];this.mainBody.dom.innerHTML=a[0];this.lockedBody.dom.innerHTML=a[1];this.processRows(0,true);if(this.deferEmptyText!==true){this.applyEmptyText()}this.grid.fireEvent(\"viewready\",this.grid)},renderUI:function(){var b=this.templates,c=this.renderHeaders(),a=b.body.apply({rows:\"&#160;\"});return b.masterTpl.apply({body:a,header:c[0],ostyle:\"width:\"+this.getOffsetWidth()+\";\",bstyle:\"width:\"+this.getTotalWidth()+\";\",lockedBody:a,lockedHeader:c[1],lstyle:\"width:\"+this.getLockedWidth()+\";\"})},afterRenderUI:function(){var a=this.grid;this.initElements();Ext.fly(this.innerHd).on(\"click\",this.handleHdDown,this);Ext.fly(this.lockedInnerHd).on(\"click\",this.handleHdDown,this);this.mainHd.on({scope:this,mouseover:this.handleHdOver,mouseout:this.handleHdOut,mousemove:this.handleHdMove});this.lockedHd.on({scope:this,mouseover:this.handleHdOver,mouseout:this.handleHdOut,mousemove:this.handleHdMove});this.scroller.on(\"scroll\",this.syncScroll,this);if(a.enableColumnResize!==false){this.splitZone=new Ext.grid.GridView.SplitDragZone(a,this.mainHd.dom);this.splitZone.setOuterHandleElId(Ext.id(this.lockedHd.dom));this.splitZone.setOuterHandleElId(Ext.id(this.mainHd.dom))}if(a.enableColumnMove){this.columnDrag=new Ext.grid.GridView.ColumnDragZone(a,this.innerHd);this.columnDrag.setOuterHandleElId(Ext.id(this.lockedInnerHd));this.columnDrag.setOuterHandleElId(Ext.id(this.innerHd));this.columnDrop=new Ext.grid.HeaderDropZone(a,this.mainHd.dom)}if(a.enableHdMenu!==false){this.hmenu=new Ext.menu.Menu({id:a.id+\"-hctx\"});this.hmenu.add({itemId:\"asc\",text:this.sortAscText,cls:\"xg-hmenu-sort-asc\"},{itemId:\"desc\",text:this.sortDescText,cls:\"xg-hmenu-sort-desc\"});if(this.grid.enableColLock!==false){this.hmenu.add({itemId:\"sortSep\",xtype:\"menuseparator\"},{itemId:\"lock\",text:this.lockText,cls:\"xg-hmenu-lock\"},{itemId:\"unlock\",text:this.unlockText,cls:\"xg-hmenu-unlock\"})}if(a.enableColumnHide!==false){this.colMenu=new Ext.menu.Menu({id:a.id+\"-hcols-menu\"});this.colMenu.on({scope:this,beforeshow:this.beforeColMenuShow,itemclick:this.handleHdMenuClick});this.hmenu.add(\"-\",{itemId:\"columns\",hideOnClick:false,text:this.columnsText,menu:this.colMenu,iconCls:\"x-cols-icon\"})}this.hmenu.on(\"itemclick\",this.handleHdMenuClick,this)}if(a.trackMouseOver){this.mainBody.on({scope:this,mouseover:this.onRowOver,mouseout:this.onRowOut});this.lockedBody.on({scope:this,mouseover:this.onRowOver,mouseout:this.onRowOut})}if(a.enableDragDrop||a.enableDrag){this.dragZone=new Ext.grid.GridDragZone(a,{ddGroup:a.ddGroup||\"GridDD\"})}this.updateHeaderSortState()},layout:function(){if(!this.mainBody){return}var d=this.grid;var h=d.getGridEl();var a=h.getSize(true);var b=a.width;if(!d.hideHeaders&&(b<20||a.height<20)){return}this.syncHeaderHeight();if(d.autoHeight){this.scroller.dom.style.overflow=\"visible\";this.lockedScroller.dom.style.overflow=\"visible\";if(Ext.isWebKit){this.scroller.dom.style.position=\"static\";this.lockedScroller.dom.style.position=\"static\"}}else{this.el.setSize(a.width,a.height);var f=this.mainHd.getHeight();var e=a.height-(f)}this.updateLockedWidth();if(this.forceFit){if(this.lastViewWidth!=b){this.fitColumns(false,false);this.lastViewWidth=b}}else{this.autoExpand();this.syncHeaderScroll()}this.onLayout(b,e)},getOffsetWidth:function(){return(this.cm.getTotalWidth()-this.cm.getTotalLockedWidth()+this.getScrollOffset())+\"px\"},renderHeaders:function(){var h=this.cm,f=this.templates,d=f.hcell,b=[],g=[],a={},e=h.getColumnCount(),j=e-1;for(var c=0;c<e;c++){a.id=h.getColumnId(c);a.value=h.getColumnHeader(c)||\"\";a.style=this.getColumnStyle(c,true);a.tooltip=this.getColumnTooltip(c);a.css=(c===0?\"x-grid3-cell-first \":(c==j?\"x-grid3-cell-last \":\"\"))+(h.config[c].headerCls?\" \"+h.config[c].headerCls:\"\");if(h.config[c].align==\"right\"){a.istyle=\"padding-right:16px\"}else{delete a.istyle}if(h.isLocked(c)){g[g.length]=d.apply(a)}else{b[b.length]=d.apply(a)}}return[f.header.apply({cells:b.join(\"\"),tstyle:\"width:\"+this.getTotalWidth()+\";\"}),f.header.apply({cells:g.join(\"\"),tstyle:\"width:\"+this.getLockedWidth()+\";\"})]},updateHeaders:function(){var b=this.renderHeaders();this.innerHd.firstChild.innerHTML=b[0];this.innerHd.firstChild.style.width=this.getOffsetWidth();this.innerHd.firstChild.firstChild.style.width=this.getTotalWidth();this.lockedInnerHd.firstChild.innerHTML=b[1];var a=this.getLockedWidth();this.lockedInnerHd.firstChild.style.width=a;this.lockedInnerHd.firstChild.firstChild.style.width=a},getResolvedXY:function(a){if(!a){return null}var d=a.cell,b=a.row;return d?Ext.fly(d).getXY():[this.scroller.getX(),Ext.fly(b).getY()]},syncFocusEl:function(c,a,b){Ext.ux.grid.LockingGridView.superclass.syncFocusEl.call(this,c,a,a<this.cm.getLockedCount()?false:b)},ensureVisible:function(c,a,b){return Ext.ux.grid.LockingGridView.superclass.ensureVisible.call(this,c,a,a<this.cm.getLockedCount()?false:b)},insertRows:function(a,g,d,f){var c=a.getCount()-1;if(!f&&g===0&&d>=c){this.refresh()}else{if(!f){this.fireEvent(\"beforerowsinserted\",this,g,d)}var b=this.renderRows(g,d),e=this.getRow(g);if(e){if(g===0){this.removeRowClass(0,this.firstRowCls)}Ext.DomHelper.insertHtml(\"beforeBegin\",e,b[0]);e=this.getLockedRow(g);Ext.DomHelper.insertHtml(\"beforeBegin\",e,b[1])}else{this.removeRowClass(c-1,this.lastRowCls);Ext.DomHelper.insertHtml(\"beforeEnd\",this.mainBody.dom,b[0]);Ext.DomHelper.insertHtml(\"beforeEnd\",this.lockedBody.dom,b[1])}if(!f){this.fireEvent(\"rowsinserted\",this,g,d);this.processRows(g)}else{if(g===0||g>=c){this.addRowClass(g,g===0?this.firstRowCls:this.lastRowCls)}}}this.syncFocusEl(g)},getColumnStyle:function(a,c){var b=!c?this.cm.config[a].cellStyle||this.cm.config[a].css||\"\":this.cm.config[a].headerStyle||\"\";b+=\"width:\"+this.getColumnWidth(a)+\";\";if(this.cm.isHidden(a)){b+=\"display:none;\"}var d=this.cm.config[a].align;if(d){b+=\"text-align:\"+d+\";\"}return b},getLockedWidth:function(){return this.cm.getTotalLockedWidth()+\"px\"},getTotalWidth:function(){return(this.cm.getTotalWidth()-this.cm.getTotalLockedWidth())+\"px\"},getColumnData:function(){var d=[],a=this.cm,e=a.getColumnCount();for(var c=0;c<e;c++){var b=a.getDataIndex(c);d[c]={name:(!Ext.isDefined(b)?this.ds.fields.get(c).name:b),renderer:a.getRenderer(c),scope:a.getRendererScope(c),id:a.getColumnId(c),style:this.getColumnStyle(c),locked:a.isLocked(c)}}return d},renderBody:function(){var a=this.renderRows()||[\"&#160;\",\"&#160;\"];return[this.templates.body.apply({rows:a[0]}),this.templates.body.apply({rows:a[1]})]},refreshRow:function(c){var g=this.ds,r=this.cm.getColumnCount(),b=this.getColumnData(),l=r-1,a=[\"x-grid3-row\"],k={tstyle:String.format(\"width: {0};\",this.getTotalWidth())},j={tstyle:String.format(\"width: {0};\",this.getLockedWidth())},f=[],e=[],o=this.templates.cell,n,h,m,d,q,p,s;if(Ext.isNumber(c)){n=c;c=g.getAt(n)}else{n=g.indexOf(c)}if(!c||n<0){return}for(s=0;s<r;s++){d=b[s];if(s==0){p=\"x-grid3-cell-first\"}else{p=(s==l)?\"x-grid3-cell-last \":\"\"}q={id:d.id,style:d.style,css:p,attr:\"\",cellAttr:\"\"};q.value=d.renderer.call(d.scope,c.data[d.name],q,c,n,s,g);if(Ext.isEmpty(q.value)){q.value=\" \"}if(this.markDirty&&c.dirty&&typeof c.modified[d.name]!=\"undefined\"){q.css+=\" x-grid3-dirty-cell\"}if(d.locked){e[s]=o.apply(q)}else{f[s]=o.apply(q)}}h=this.getRow(n);h.className=\"\";m=this.getLockedRow(n);m.className=\"\";if(this.grid.stripeRows&&((n+1)%2===0)){a.push(\"x-grid3-row-alt\")}if(this.getRowClass){k.cols=r;a.push(this.getRowClass(c,n,k,g))}this.fly(h).addClass(a).setStyle(k.tstyle);k.cells=f.join(\"\");h.innerHTML=this.templates.rowInner.apply(k);this.fly(m).addClass(a).setStyle(j.tstyle);j.cells=e.join(\"\");m.innerHTML=this.templates.rowInner.apply(j);m.rowIndex=n;this.syncRowHeights(h,m);this.fireEvent(\"rowupdated\",this,n,c)},refresh:function(b){this.fireEvent(\"beforerefresh\",this);this.grid.stopEditing(true);var a=this.renderBody();this.mainBody.update(a[0]).setWidth(this.getTotalWidth());this.lockedBody.update(a[1]).setWidth(this.getLockedWidth());if(b===true){this.updateHeaders();this.updateHeaderSortState()}this.processRows(0,true);this.layout();this.applyEmptyText();this.fireEvent(\"refresh\",this)},onDenyColumnLock:function(){},initData:function(b,a){if(this.cm){this.cm.un(\"columnlockchange\",this.onColumnLock,this)}Ext.ux.grid.LockingGridView.superclass.initData.call(this,b,a);if(this.cm){this.cm.on(\"columnlockchange\",this.onColumnLock,this)}},onColumnLock:function(){this.refresh(true)},handleHdMenuClick:function(d){var b=this.hdCtxIndex,a=this.cm,e=d.getItemId(),c=a.getLockedCount();switch(e){case\"lock\":if(a.getColumnCount(true)<=c+1){this.onDenyColumnLock();return undefined}a.setLocked(b,true,c!=b);if(c!=b){a.moveColumn(b,c);this.grid.fireEvent(\"columnmove\",b,c)}break;case\"unlock\":if(c-1!=b){a.setLocked(b,false,true);a.moveColumn(b,c-1);this.grid.fireEvent(\"columnmove\",b,c-1)}else{a.setLocked(b,false)}break;default:return Ext.ux.grid.LockingGridView.superclass.handleHdMenuClick.call(this,d)}return true},handleHdDown:function(g,d){Ext.ux.grid.LockingGridView.superclass.handleHdDown.call(this,g,d);if(this.grid.enableColLock!==false){if(Ext.fly(d).hasClass(\"x-grid3-hd-btn\")){var f=this.findHeaderCell(d),c=this.getCellIndex(f),b=this.hmenu.items,a=this.cm;b.get(\"lock\").setDisabled(a.isLocked(c));b.get(\"unlock\").setDisabled(!a.isLocked(c))}}},syncHeaderHeight:function(){var d=Ext.fly(this.innerHd).child(\"tr\",true),b=Ext.fly(this.lockedInnerHd).child(\"tr\",true);d.style.height=\"auto\";b.style.height=\"auto\";var e=d.offsetHeight,c=b.offsetHeight,a=Math.max(c,e)+\"px\";d.style.height=a;b.style.height=a},updateLockedWidth:function(){var g=this.cm.getTotalLockedWidth(),a=this.cm.getTotalWidth()-g,c=this.grid.getGridEl().getSize(true),b=Ext.isBorderBox?0:this.lockedBorderWidth,d=Ext.isBorderBox?0:this.rowBorderWidth,e=Math.max(c.width-g-b-d,0)+\"px\",f=this.getScrollOffset();if(!this.grid.autoHeight){var h=Math.max(c.height-this.mainHd.getHeight(),0)+\"px\";this.lockedScroller.dom.style.height=h;this.scroller.dom.style.height=h}this.lockedWrap.dom.style.width=(g+d)+\"px\";this.scroller.dom.style.width=e;this.mainWrap.dom.style.left=(g+b+d)+\"px\";if(this.innerHd){this.lockedInnerHd.firstChild.style.width=g+\"px\";this.lockedInnerHd.firstChild.firstChild.style.width=g+\"px\";this.innerHd.style.width=e;this.innerHd.firstChild.style.width=(a+d+f)+\"px\";this.innerHd.firstChild.firstChild.style.width=a+\"px\"}if(this.mainBody){this.lockedBody.dom.style.width=(g+d)+\"px\";this.mainBody.dom.style.width=(a+d)+\"px\"}}});Ext.ux.grid.LockingColumnModel=Ext.extend(Ext.grid.ColumnModel,{isLocked:function(a){return this.config[a].locked===true},setLocked:function(b,c,a){if(this.isLocked(b)==c){return}this.config[b].locked=c;if(!a){this.fireEvent(\"columnlockchange\",this,b,c)}},getTotalLockedWidth:function(){var b=0;for(var c=0,a=this.config.length;c<a;c++){if(this.isLocked(c)&&!this.isHidden(c)){b+=this.getColumnWidth(c)}}return b},getLockedCount:function(){var a=this.config.length;for(var b=0;b<a;b++){if(!this.isLocked(b)){return b}}return a},moveColumn:function(d,c){var a=this.isLocked(d),b=this.isLocked(c);if(d<c&&a&&!b){this.setLocked(d,false,true)}else{if(d>c&&!a&&b){this.setLocked(d,true,true)}}Ext.ux.grid.LockingColumnModel.superclass.moveColumn.apply(this,arguments)}});Ext.ns(\"Ext.ux.form\");Ext.ux.form.MultiSelect=Ext.extend(Ext.form.Field,{ddReorder:false,appendOnly:false,width:100,height:100,displayField:0,valueField:1,allowBlank:true,minSelections:0,maxSelections:Number.MAX_VALUE,blankText:Ext.form.TextField.prototype.blankText,minSelectionsText:\"Minimum {0} item(s) required\",maxSelectionsText:\"Maximum {0} item(s) allowed\",delimiter:\",\",cls:\"ux-form-multiselect\",defaultAutoCreate:{tag:\"div\"},initComponent:function(){Ext.ux.form.MultiSelect.superclass.initComponent.call(this);if(Ext.isArray(this.store)){if(Ext.isArray(this.store[0])){this.store=new Ext.data.ArrayStore({fields:[\"value\",\"text\"],data:this.store});this.valueField=\"value\"}else{this.store=new Ext.data.ArrayStore({fields:[\"text\"],data:this.store,expandData:true});this.valueField=\"text\"}this.displayField=\"text\"}else{this.store=Ext.StoreMgr.lookup(this.store)}this.addEvents({dblclick:true,click:true,change:true,drop:true})},onRender:function(c,b){Ext.ux.form.MultiSelect.superclass.onRender.call(this,c,b);var a=this.fs=new Ext.form.FieldSet({renderTo:this.el,title:this.legend,height:this.height,width:this.width,style:\"padding:0;\",tbar:this.tbar});a.body.addClass(\"ux-mselect\");this.view=new Ext.ListView({selectedClass:\"ux-mselect-selected\",multiSelect:true,store:this.store,columns:[{header:\"Value\",width:1,dataIndex:this.displayField}],hideHeaders:true});a.add(this.view);this.view.on(\"click\",this.onViewClick,this);this.view.on(\"beforeclick\",this.onViewBeforeClick,this);this.view.on(\"dblclick\",this.onViewDblClick,this);this.hiddenName=this.name||Ext.id();var d={tag:\"input\",type:\"hidden\",value:\"\",name:this.hiddenName};this.hiddenField=this.el.createChild(d);this.hiddenField.dom.disabled=this.hiddenName!=this.name;a.doLayout()},afterRender:function(){Ext.ux.form.MultiSelect.superclass.afterRender.call(this);if(this.ddReorder&&!this.dragGroup&&!this.dropGroup){this.dragGroup=this.dropGroup=\"MultiselectDD-\"+Ext.id()}if(this.draggable||this.dragGroup){this.dragZone=new Ext.ux.form.MultiSelect.DragZone(this,{ddGroup:this.dragGroup})}if(this.droppable||this.dropGroup){this.dropZone=new Ext.ux.form.MultiSelect.DropZone(this,{ddGroup:this.dropGroup})}},onViewClick:function(c,a,b,d){this.fireEvent(\"change\",this,this.getValue(),this.hiddenField.dom.value);this.hiddenField.dom.value=this.getValue();this.fireEvent(\"click\",this,d);this.validate()},onViewBeforeClick:function(c,a,b,d){if(this.disabled||this.readOnly){return false}},onViewDblClick:function(c,a,b,d){return this.fireEvent(\"dblclick\",c,a,b,d)},getValue:function(a){var d=[];var c=this.view.getSelectedIndexes();if(c.length==0){return\"\"}for(var b=0;b<c.length;b++){d.push(this.store.getAt(c[b]).get((a!=null)?a:this.valueField))}return d.join(this.delimiter)},setValue:function(a){var b;var d=[];this.view.clearSelections();this.hiddenField.dom.value=\"\";if(!a||(a==\"\")){return}if(!Ext.isArray(a)){a=a.split(this.delimiter)}for(var c=0;c<a.length;c++){b=this.view.store.indexOf(this.view.store.query(this.valueField,new RegExp(\"^\"+a[c]+\"$\",\"i\")).itemAt(0));d.push(b)}this.view.select(d);this.hiddenField.dom.value=this.getValue();this.validate()},reset:function(){this.setValue(\"\")},getRawValue:function(a){var b=this.getValue(a);if(b.length){b=b.split(this.delimiter)}else{b=[]}return b},setRawValue:function(a){setValue(a)},validateValue:function(a){if(a.length<1){if(this.allowBlank){this.clearInvalid();return true}else{this.markInvalid(this.blankText);return false}}if(a.length<this.minSelections){this.markInvalid(String.format(this.minSelectionsText,this.minSelections));return false}if(a.length>this.maxSelections){this.markInvalid(String.format(this.maxSelectionsText,this.maxSelections));return false}return true},disable:function(){this.disabled=true;this.hiddenField.dom.disabled=true;this.fs.disable()},enable:function(){this.disabled=false;this.hiddenField.dom.disabled=false;this.fs.enable()},destroy:function(){Ext.destroy(this.fs,this.dragZone,this.dropZone);Ext.ux.form.MultiSelect.superclass.destroy.call(this)}});Ext.reg(\"multiselect\",Ext.ux.form.MultiSelect);Ext.ux.Multiselect=Ext.ux.form.MultiSelect;Ext.ux.form.MultiSelect.DragZone=function(d,c){this.ms=d;this.view=d.view;var b=c.ddGroup||\"MultiselectDD\";var a;if(Ext.isArray(b)){a=b.shift()}else{a=b;b=null}Ext.ux.form.MultiSelect.DragZone.superclass.constructor.call(this,this.ms.fs.body,{containerScroll:true,ddGroup:a});this.setDraggable(b)};Ext.extend(Ext.ux.form.MultiSelect.DragZone,Ext.dd.DragZone,{onInitDrag:function(a,c){var b=Ext.get(this.dragData.ddel.cloneNode(true));this.proxy.update(b.dom);b.setWidth(b.child(\"em\").getWidth());this.onStartDrag(a,c);return true},collectSelection:function(b){b.repairXY=Ext.fly(this.view.getSelectedNodes()[0]).getXY();var a=0;this.view.store.each(function(d){if(this.view.isSelected(a)){var e=this.view.getNode(a);var c=e.cloneNode(true);c.id=Ext.id();b.ddel.appendChild(c);b.records.push(this.view.store.getAt(a));b.viewNodes.push(e)}a++},this)},onEndDrag:function(a,b){var c=Ext.get(this.dragData.ddel);if(c&&c.hasClass(\"multi-proxy\")){c.remove()}},getDragData:function(d){var c=this.view.findItemFromChild(d.getTarget());if(c){if(!this.view.isSelected(c)&&!d.ctrlKey&&!d.shiftKey){this.view.select(c);this.ms.setValue(this.ms.getValue())}if(this.view.getSelectionCount()==0||d.ctrlKey||d.shiftKey){return false}var b={sourceView:this.view,viewNodes:[],records:[]};if(this.view.getSelectionCount()==1){var a=this.view.getSelectedIndexes()[0];var f=this.view.getNode(a);b.viewNodes.push(b.ddel=f);b.records.push(this.view.store.getAt(a));b.repairXY=Ext.fly(f).getXY()}else{b.ddel=document.createElement(\"div\");b.ddel.className=\"multi-proxy\";this.collectSelection(b)}return b}return false},getRepairXY:function(a){return this.dragData.repairXY},setDraggable:function(a){if(!a){return}if(Ext.isArray(a)){Ext.each(a,this.setDraggable,this);return}this.addToGroup(a)}});Ext.ux.form.MultiSelect.DropZone=function(d,c){this.ms=d;this.view=d.view;var b=c.ddGroup||\"MultiselectDD\";var a;if(Ext.isArray(b)){a=b.shift()}else{a=b;b=null}Ext.ux.form.MultiSelect.DropZone.superclass.constructor.call(this,this.ms.fs.body,{containerScroll:true,ddGroup:a});this.setDroppable(b)};Ext.extend(Ext.ux.form.MultiSelect.DropZone,Ext.dd.DropZone,{getTargetFromEvent:function(b){var a=b.getTarget();return a},getDropPoint:function(g,k,d){if(k==this.ms.fs.body.dom){return\"below\"}var f=Ext.lib.Dom.getY(k),a=f+k.offsetHeight;var j=f+(a-f)/2;var h=Ext.lib.Event.getPageY(g);if(h<=j){return\"above\"}else{return\"below\"}},isValidDropPoint:function(b,e,a){if(!a.viewNodes||(a.viewNodes.length!=1)){return true}var c=a.viewNodes[0];if(c==e){return false}if((b==\"below\")&&(e.nextSibling==c)){return false}if((b==\"above\")&&(e.previousSibling==c)){return false}return true},onNodeEnter:function(d,a,c,b){return false},onNodeOver:function(h,a,g,d){var b=this.dropNotAllowed;var f=this.getDropPoint(g,h,a);if(this.isValidDropPoint(f,h,d)){if(this.ms.appendOnly){return\"x-tree-drop-ok-below\"}if(f){var c;if(f==\"above\"){b=h.previousSibling?\"x-tree-drop-ok-between\":\"x-tree-drop-ok-above\";c=\"x-view-drag-insert-above\"}else{b=h.nextSibling?\"x-tree-drop-ok-between\":\"x-tree-drop-ok-below\";c=\"x-view-drag-insert-below\"}if(this.lastInsertClass!=c){Ext.fly(h).replaceClass(this.lastInsertClass,c);this.lastInsertClass=c}}}return b},onNodeOut:function(d,a,c,b){this.removeDropIndicators(d)},onNodeDrop:function(b,j,h,f){if(this.ms.fireEvent(\"drop\",this,b,j,h,f)===false){return false}var k=this.getDropPoint(h,b,j);if(b!=this.ms.fs.body.dom){b=this.view.findItemFromChild(b)}if(this.ms.appendOnly){insertAt=this.view.store.getCount()}else{insertAt=b==this.ms.fs.body.dom?this.view.store.getCount()-1:this.view.indexOf(b);if(k==\"below\"){insertAt++}}var c=false;if(f.sourceView==this.view){if(k==\"below\"){if(f.viewNodes[0]==b){f.viewNodes.shift()}}else{if(f.viewNodes[f.viewNodes.length-1]==b){f.viewNodes.pop()}}if(!f.viewNodes.length){return false}if(insertAt>this.view.store.indexOf(f.records[0])){c=\"down\";insertAt--}}for(var g=0;g<f.records.length;g++){var a=f.records[g];if(f.sourceView){f.sourceView.store.remove(a)}this.view.store.insert(c==\"down\"?insertAt:insertAt++,a);var d=this.view.store.sortInfo;if(d){this.view.store.sort(d.field,d.direction)}}return true},removeDropIndicators:function(a){if(a){Ext.fly(a).removeClass([\"x-view-drag-insert-above\",\"x-view-drag-insert-left\",\"x-view-drag-insert-right\",\"x-view-drag-insert-below\"]);this.lastInsertClass=\"_noclass\"}},setDroppable:function(a){if(!a){return}if(Ext.isArray(a)){Ext.each(a,this.setDroppable,this);return}this.addToGroup(a)}});if(!Array.prototype.map){Array.prototype.map=function(b){var a=this.length;if(typeof b!=\"function\"){throw new TypeError()}var e=new Array(a);var d=arguments[1];for(var c=0;c<a;c++){if(c in this){e[c]=b.call(d,this[c],c,this)}}return e}}Ext.ns(\"Ext.ux.data\");Ext.ux.data.PagingMemoryProxy=Ext.extend(Ext.data.MemoryProxy,{constructor:function(a){Ext.ux.data.PagingMemoryProxy.superclass.constructor.call(this);this.data=a},doRequest:function(c,d,b,f,j,k,l){b=b||{};var m;try{m=f.readRecords(this.data)}catch(g){this.fireEvent(\"loadexception\",this,l,null,g);j.call(k,null,l,false);return}if(b.filter!==undefined){m.records=m.records.filter(function(n){if(typeof(n)==\"object\"){var e=b.filterCol||0;return String(n.data[e]).match(b.filter)?true:false}else{return String(n).match(b.filter)?true:false}});m.totalRecords=m.records.length}if(b.sort!==undefined){var a=String(b.dir).toUpperCase()==\"DESC\"?-1:1;var h=function(n,e){return n>e?1:(n<e?-1:0)};m.records.sort(function(n,e){var o=0;if(typeof(n)==\"object\"){o=h(n.data[b.sort],e.data[b.sort])*a}else{o=h(n,e)*a}if(o==0){o=(n.index<e.index?-1:1)}return o})}if(b.start!==undefined&&b.limit!==undefined){m.records=m.records.slice(b.start,b.start+b.limit)}j.call(k,m,l,true)}});Ext.data.PagingMemoryProxy=Ext.ux.data.PagingMemoryProxy;Ext.ux.PanelResizer=Ext.extend(Ext.util.Observable,{minHeight:0,maxHeight:10000000,constructor:function(a){Ext.apply(this,a);this.events={};Ext.ux.PanelResizer.superclass.constructor.call(this,a)},init:function(a){this.panel=a;if(this.panel.elements.indexOf(\"footer\")==-1){a.elements+=\",footer\"}a.on(\"render\",this.onRender,this)},onRender:function(a){this.handle=a.footer.createChild({cls:\"x-panel-resize\"});this.tracker=new Ext.dd.DragTracker({onStart:this.onDragStart.createDelegate(this),onDrag:this.onDrag.createDelegate(this),onEnd:this.onDragEnd.createDelegate(this),tolerance:3,autoStart:300});this.tracker.initEl(this.handle);a.on(\"beforedestroy\",this.tracker.destroy,this.tracker)},onDragStart:function(a){this.dragging=true;this.startHeight=this.panel.el.getHeight();this.fireEvent(\"dragstart\",this,a)},onDrag:function(a){this.panel.setHeight((this.startHeight-this.tracker.getOffset()[1]).constrain(this.minHeight,this.maxHeight));this.fireEvent(\"drag\",this,a)},onDragEnd:function(a){this.dragging=false;this.fireEvent(\"dragend\",this,a)}});Ext.preg(\"panelresizer\",Ext.ux.PanelResizer);Ext.ux.Portal=Ext.extend(Ext.Panel,{layout:\"column\",autoScroll:true,cls:\"x-portal\",defaultType:\"portalcolumn\",initComponent:function(){Ext.ux.Portal.superclass.initComponent.call(this);this.addEvents({validatedrop:true,beforedragover:true,dragover:true,beforedrop:true,drop:true})},initEvents:function(){Ext.ux.Portal.superclass.initEvents.call(this);this.dd=new Ext.ux.Portal.DropZone(this,this.dropConfig)},beforeDestroy:function(){if(this.dd){this.dd.unreg()}Ext.ux.Portal.superclass.beforeDestroy.call(this)}});Ext.reg(\"portal\",Ext.ux.Portal);Ext.ux.Portal.DropZone=Ext.extend(Ext.dd.DropTarget,{constructor:function(a,b){this.portal=a;Ext.dd.ScrollManager.register(a.body);Ext.ux.Portal.DropZone.superclass.constructor.call(this,a.bwrap.dom,b);a.body.ddScrollConfig=this.ddScrollConfig},ddScrollConfig:{vthresh:50,hthresh:-1,animate:true,increment:200},createEvent:function(a,f,d,b,h,g){return{portal:this.portal,panel:d.panel,columnIndex:b,column:h,position:g,data:d,source:a,rawEvent:f,status:this.dropAllowed}},notifyOver:function(w,u,x){var f=u.getXY(),a=this.portal,o=w.proxy;if(!this.grid){this.grid=this.getGrid()}var b=a.body.dom.clientWidth;if(!this.lastCW){this.lastCW=b}else{if(this.lastCW!=b){this.lastCW=b;a.doLayout();this.grid=this.getGrid()}}var d=0,m=this.grid.columnX,n=false;for(var t=m.length;d<t;d++){if(f[0]<(m[d].x+m[d].w)){n=true;break}}if(!n){d--}var r,l=false,j=0,v=a.items.itemAt(d),q=v.items.items,k=false;for(var t=q.length;j<t;j++){r=q[j];var s=r.el.getHeight();if(s===0){k=true}else{if((r.el.getY()+(s/2))>f[1]){l=true;break}}}j=(l&&r?j:v.items.getCount())+(k?-1:0);var g=this.createEvent(w,u,x,d,v,j);if(a.fireEvent(\"validatedrop\",g)!==false&&a.fireEvent(\"beforedragover\",g)!==false){o.getProxy().setWidth(\"auto\");if(r){o.moveProxy(r.el.dom.parentNode,l?r.el.dom:null)}else{o.moveProxy(v.el.dom,null)}this.lastPos={c:v,col:d,p:k||(l&&r)?j:false};this.scrollPos=a.body.getScroll();a.fireEvent(\"dragover\",g);return g.status}else{return g.status}},notifyOut:function(){delete this.grid},notifyDrop:function(m,h,g){delete this.grid;if(!this.lastPos){return}var k=this.lastPos.c,f=this.lastPos.col,l=this.lastPos.p,a=m.panel,b=this.createEvent(m,h,g,f,k,l!==false?l:k.items.getCount());if(this.portal.fireEvent(\"validatedrop\",b)!==false&&this.portal.fireEvent(\"beforedrop\",b)!==false){m.proxy.getProxy().remove();a.el.dom.parentNode.removeChild(m.panel.el.dom);if(l!==false){k.insert(l,a)}else{k.add(a)}k.doLayout();this.portal.fireEvent(\"drop\",b);var n=this.scrollPos.top;if(n){var j=this.portal.body.dom;setTimeout(function(){j.scrollTop=n},10)}}delete this.lastPos},getGrid:function(){var a=this.portal.bwrap.getBox();a.columnX=[];this.portal.items.each(function(b){a.columnX.push({x:b.el.getX(),w:b.el.getWidth()})});return a},unreg:function(){Ext.dd.ScrollManager.unregister(this.portal.body);Ext.ux.Portal.DropZone.superclass.unreg.call(this)}});Ext.ux.PortalColumn=Ext.extend(Ext.Container,{layout:\"anchor\",defaultType:\"portlet\",cls:\"x-portal-column\"});Ext.reg(\"portalcolumn\",Ext.ux.PortalColumn);Ext.ux.Portlet=Ext.extend(Ext.Panel,{anchor:\"100%\",frame:true,collapsible:true,draggable:true,cls:\"x-portlet\"});Ext.reg(\"portlet\",Ext.ux.Portlet);Ext.ux.ProgressBarPager=Ext.extend(Object,{progBarWidth:225,defaultText:\"Loading...\",defaultAnimCfg:{duration:1,easing:\"bounceOut\"},constructor:function(a){if(a){Ext.apply(this,a)}},init:function(a){if(a.displayInfo){this.parent=a;var b=a.items.indexOf(a.displayItem);a.remove(a.displayItem,true);this.progressBar=new Ext.ProgressBar({text:this.defaultText,width:this.progBarWidth,animate:this.defaultAnimCfg});a.displayItem=this.progressBar;a.add(a.displayItem);a.doLayout();Ext.apply(a,this.parentOverrides);this.progressBar.on(\"render\",function(c){c.mon(c.getEl().applyStyles(\"cursor:pointer\"),\"click\",this.handleProgressBarClick,this)},this,{single:true})}},handleProgressBarClick:function(j){var d=this.parent,c=d.displayItem,f=this.progressBar.getBox(),h=j.getXY(),b=h[0]-f.x,a=Math.ceil(d.store.getTotalCount()/d.pageSize),g=Math.ceil(b/(c.width/a));d.changePage(g)},parentOverrides:{updateInfo:function(){if(this.displayItem){var b=this.store.getCount(),a=this.getPageData(),d=this.readPage(a),e=b==0?this.emptyMsg:String.format(this.displayMsg,this.cursor+1,this.cursor+b,this.store.getTotalCount());d=a.activePage;var c=d/a.pages;this.displayItem.updateProgress(c,e,this.animate||this.defaultAnimConfig)}}}});Ext.preg(\"progressbarpager\",Ext.ux.ProgressBarPager);Ext.ns(\"Ext.ux.grid\");Ext.ux.grid.RowEditor=Ext.extend(Ext.Panel,{floating:true,shadow:false,layout:\"hbox\",cls:\"x-small-editor\",buttonAlign:\"center\",baseCls:\"x-row-editor\",elements:\"header,footer,body\",frameWidth:5,buttonPad:3,clicksToEdit:\"auto\",monitorValid:true,focusDelay:250,errorSummary:true,saveText:\"Save\",cancelText:\"Cancel\",commitChangesText:\"You need to commit or cancel your changes\",errorText:\"Errors\",defaults:{normalWidth:true},initComponent:function(){Ext.ux.grid.RowEditor.superclass.initComponent.call(this);this.addEvents(\"beforeedit\",\"canceledit\",\"validateedit\",\"afteredit\")},init:function(a){this.grid=a;this.ownerCt=a;if(this.clicksToEdit===2){a.on(\"rowdblclick\",this.onRowDblClick,this)}else{a.on(\"rowclick\",this.onRowClick,this);if(Ext.isIE){a.on(\"rowdblclick\",this.onRowDblClick,this)}}a.getStore().on(\"remove\",function(){this.stopEditing(false)},this);a.on({scope:this,keydown:this.onGridKey,columnresize:this.verifyLayout,columnmove:this.refreshFields,reconfigure:this.refreshFields,beforedestroy:this.beforedestroy,destroy:this.destroy,bodyscroll:{buffer:250,fn:this.positionButtons}});a.getColumnModel().on(\"hiddenchange\",this.verifyLayout,this,{delay:1});a.getView().on(\"refresh\",this.stopEditing.createDelegate(this,[]))},beforedestroy:function(){this.stopMonitoring();this.grid.getStore().un(\"remove\",this.onStoreRemove,this);this.stopEditing(false);Ext.destroy(this.btns,this.tooltip)},refreshFields:function(){this.initFields();this.verifyLayout()},isDirty:function(){var a;this.items.each(function(b){if(String(this.values[b.id])!==String(b.getValue())){a=true;return false}},this);return a},startEditing:function(k,p){if(this.editing&&this.isDirty()){this.showTooltip(this.commitChangesText);return}if(Ext.isObject(k)){k=this.grid.getStore().indexOf(k)}if(this.fireEvent(\"beforeedit\",this,k)!==false){this.editing=true;var e=this.grid,l=e.getView(),o=l.getRow(k),c=e.store.getAt(k);this.record=c;this.rowIndex=k;this.values={};if(!this.rendered){this.render(l.getEditorParent())}var m=Ext.fly(o).getWidth();this.setSize(m);if(!this.initialized){this.initFields()}var n=e.getColumnModel(),d=this.items.items,j,a;for(var b=0,h=n.getColumnCount();b<h;b++){a=this.preEditValue(c,n.getDataIndex(b));j=d[b];j.setValue(a);this.values[j.id]=Ext.isEmpty(a)?\"\":a}this.verifyLayout(true);if(!this.isVisible()){this.setPagePosition(Ext.fly(o).getXY())}else{this.el.setXY(Ext.fly(o).getXY(),{duration:0.15})}if(!this.isVisible()){this.show().doLayout()}if(p!==false){this.doFocus.defer(this.focusDelay,this)}}},stopEditing:function(l){this.editing=false;if(!this.isVisible()){return}if(l===false||!this.isValid()){this.hide();this.fireEvent(\"canceledit\",this,l===false);return}var g={},b=this.record,h=false,k=this.grid.colModel,e=this.items.items;for(var d=0,f=k.getColumnCount();d<f;d++){if(!k.isHidden(d)){var c=k.getDataIndex(d);if(!Ext.isEmpty(c)){var a=b.data[c],j=this.postEditValue(e[d].getValue(),a,b,c);if(String(a)!==String(j)){g[c]=j;h=true}}}}if(h&&this.fireEvent(\"validateedit\",this,g,b,this.rowIndex)!==false){b.beginEdit();Ext.iterate(g,function(m,n){b.set(m,n)});b.endEdit();this.fireEvent(\"afteredit\",this,g,b,this.rowIndex)}else{this.fireEvent(\"canceledit\",this,false)}this.hide()},verifyLayout:function(e){if(this.el&&(this.isVisible()||e===true)){var g=this.grid.getView().getRow(this.rowIndex);this.setSize(Ext.fly(g).getWidth(),Ext.isIE?Ext.fly(g).getHeight()+9:undefined);var c=this.grid.colModel,b=this.items.items;for(var d=0,a=c.getColumnCount();d<a;d++){if(!c.isHidden(d)){var f=0;if(d===(a-1)){f+=3}else{f+=1}b[d].show();b[d].setWidth(c.getColumnWidth(d)-f)}else{b[d].hide()}}this.doLayout();this.positionButtons()}},slideHide:function(){this.hide()},initFields:function(){var b=this.grid.getColumnModel(),f=Ext.layout.ContainerLayout.prototype.parseMargins;this.removeAll(false);for(var e=0,a=b.getColumnCount();e<a;e++){var g=b.getColumnAt(e),d=g.getEditor();if(!d){d=g.displayEditor||new Ext.form.DisplayField()}if(e==0){d.margins=f(\"0 1 2 1\")}else{if(e==a-1){d.margins=f(\"0 0 2 1\")}else{if(Ext.isIE){d.margins=f(\"0 0 2 0\")}else{d.margins=f(\"0 1 2 0\")}}}d.setWidth(b.getColumnWidth(e));d.column=g;if(d.ownerCt!==this){d.on(\"focus\",this.ensureVisible,this);d.on(\"specialkey\",this.onKey,this)}this.insert(e,d)}this.initialized=true},onKey:function(a,b){if(b.getKey()===b.ENTER){this.stopEditing(true);b.stopPropagation()}},onGridKey:function(c){if(c.getKey()===c.ENTER&&!this.isVisible()){var b=this.grid.getSelectionModel().getSelected();if(b){var a=this.grid.store.indexOf(b);this.startEditing(a);c.stopPropagation()}}},ensureVisible:function(a){if(this.isVisible()){this.grid.getView().ensureVisible(this.rowIndex,this.grid.colModel.getIndexById(a.column.id),true)}},onRowClick:function(b,d,c){if(this.clicksToEdit==\"auto\"){var a=this.lastClickIndex;this.lastClickIndex=d;if(a!=d&&!this.isVisible()){return}}this.startEditing(d,false);this.doFocus.defer(this.focusDelay,this,[c.getPoint()])},onRowDblClick:function(a,c,b){this.startEditing(c,false);this.doFocus.defer(this.focusDelay,this,[b.getPoint()])},onRender:function(){Ext.ux.grid.RowEditor.superclass.onRender.apply(this,arguments);this.el.swallowEvent([\"keydown\",\"keyup\",\"keypress\"]);this.btns=new Ext.Panel({baseCls:\"x-plain\",cls:\"x-btns\",elements:\"body\",layout:\"table\",width:(this.minButtonWidth*2)+(this.frameWidth*2)+(this.buttonPad*4),items:[{ref:\"saveBtn\",itemId:\"saveBtn\",xtype:\"button\",text:this.saveText,width:this.minButtonWidth,handler:this.stopEditing.createDelegate(this,[true])},{xtype:\"button\",text:this.cancelText,width:this.minButtonWidth,handler:this.stopEditing.createDelegate(this,[false])}]});this.btns.render(this.bwrap)},afterRender:function(){Ext.ux.grid.RowEditor.superclass.afterRender.apply(this,arguments);this.positionButtons();if(this.monitorValid){this.startMonitoring()}},onShow:function(){if(this.monitorValid){this.startMonitoring()}Ext.ux.grid.RowEditor.superclass.onShow.apply(this,arguments)},onHide:function(){Ext.ux.grid.RowEditor.superclass.onHide.apply(this,arguments);this.stopMonitoring();this.grid.getView().focusRow(this.rowIndex)},positionButtons:function(){if(this.btns){var e=this.grid,d=this.el.dom.clientHeight,b=e.getView(),a=b.scroller.dom.scrollLeft,f=this.btns.getWidth(),c=Math.min(e.getWidth(),e.getColumnModel().getTotalWidth());this.btns.el.shift({left:(c/2)-(f/2)+a,top:d-2,stopFx:true,duration:0.2})}},preEditValue:function(a,c){var b=a.data[c];return this.autoEncode&&typeof b===\"string\"?Ext.util.Format.htmlDecode(b):b},postEditValue:function(c,a,b,d){return this.autoEncode&&typeof c==\"string\"?Ext.util.Format.htmlEncode(c):c},doFocus:function(f){if(this.isVisible()){var d=0,b=this.grid.getColumnModel(),g;if(f){d=this.getTargetColumnIndex(f)}for(var e=d||0,a=b.getColumnCount();e<a;e++){g=b.getColumnAt(e);if(!g.hidden&&g.getEditor()){g.getEditor().focus();break}}}},getTargetColumnIndex:function(k){var a=this.grid,j=a.view,h=k.left,f=a.colModel.config,b=0,d=false;for(var e=f.length,g;g=f[b];b++){if(!g.hidden){if(Ext.fly(j.getHeaderCell(b)).getRegion().right>=h){d=b;break}}}return d},startMonitoring:function(){if(!this.bound&&this.monitorValid){this.bound=true;Ext.TaskMgr.start({run:this.bindHandler,interval:this.monitorPoll||200,scope:this})}},stopMonitoring:function(){this.bound=false;if(this.tooltip){this.tooltip.hide()}},isValid:function(){var a=true;this.items.each(function(b){if(!b.isValid(true)){a=false;return false}});return a},bindHandler:function(){if(!this.bound){return false}var a=this.isValid();if(!a&&this.errorSummary){this.showTooltip(this.getErrorText().join(\"\"))}this.btns.saveBtn.setDisabled(!a);this.fireEvent(\"validation\",this,a)},lastVisibleColumn:function(){var a=this.items.getCount()-1,b;for(;a>=0;a--){b=this.items.items[a];if(!b.hidden){return b}}},showTooltip:function(f){var c=this.tooltip;if(!c){c=this.tooltip=new Ext.ToolTip({maxWidth:600,cls:\"errorTip\",width:300,title:this.errorText,autoHide:false,anchor:\"left\",anchorToTarget:true,mouseOffset:[40,0]})}var b=this.grid.getView(),e=parseInt(this.el.dom.style.top,10),a=b.scroller.dom.scrollTop,d=this.el.getHeight();if(e+d>=a){c.initTarget(this.lastVisibleColumn().getEl());if(!c.rendered){c.show();c.hide()}c.body.update(f);c.doAutoWidth(20);c.show()}else{if(c.rendered){c.hide()}}},getErrorText:function(){var a=[\"<ul>\"];this.items.each(function(b){if(!b.isValid(true)){a.push(\"<li>\",b.getActiveError(),\"</li>\")}});a.push(\"</ul>\");return a}});Ext.preg(\"roweditor\",Ext.ux.grid.RowEditor);Ext.ns(\"Ext.ux.grid\");Ext.ux.grid.RowExpander=Ext.extend(Ext.util.Observable,{expandOnEnter:true,expandOnDblClick:true,header:\"\",width:20,sortable:false,fixed:true,hideable:false,menuDisabled:true,dataIndex:\"\",id:\"expander\",lazyRender:true,enableCaching:true,constructor:function(a){Ext.apply(this,a);this.addEvents({beforeexpand:true,expand:true,beforecollapse:true,collapse:true});Ext.ux.grid.RowExpander.superclass.constructor.call(this);if(this.tpl){if(typeof this.tpl==\"string\"){this.tpl=new Ext.Template(this.tpl)}this.tpl.compile()}this.state={};this.bodyContent={}},getRowClass:function(a,e,d,c){d.cols=d.cols-1;var b=this.bodyContent[a.id];if(!b&&!this.lazyRender){b=this.getBodyContent(a,e)}if(b){d.body=b}return this.state[a.id]?\"x-grid3-row-expanded\":\"x-grid3-row-collapsed\"},init:function(b){this.grid=b;var a=b.getView();a.getRowClass=this.getRowClass.createDelegate(this);a.enableRowBody=true;b.on(\"render\",this.onRender,this);b.on(\"destroy\",this.onDestroy,this)},onRender:function(){var a=this.grid;var b=a.getView().mainBody;b.on(\"mousedown\",this.onMouseDown,this,{delegate:\".x-grid3-row-expander\"});if(this.expandOnEnter){this.keyNav=new Ext.KeyNav(this.grid.getGridEl(),{enter:this.onEnter,scope:this})}if(this.expandOnDblClick){a.on(\"rowdblclick\",this.onRowDblClick,this)}},onDestroy:function(){if(this.keyNav){this.keyNav.disable();delete this.keyNav}var a=this.grid.getView().mainBody;if(a){a.un(\"mousedown\",this.onMouseDown,this)}},onRowDblClick:function(a,b,c){this.toggleRow(b)},onEnter:function(h){var f=this.grid;var j=f.getSelectionModel();var b=j.getSelections();for(var c=0,a=b.length;c<a;c++){var d=f.getStore().indexOf(b[c]);this.toggleRow(d)}},getBodyContent:function(a,b){if(!this.enableCaching){return this.tpl.apply(a.data)}var c=this.bodyContent[a.id];if(!c){c=this.tpl.apply(a.data);this.bodyContent[a.id]=c}return c},onMouseDown:function(b,a){b.stopEvent();var c=b.getTarget(\".x-grid3-row\");this.toggleRow(c)},renderer:function(b,c,a){c.cellAttr='rowspan=\"2\"';return'<div class=\"x-grid3-row-expander\">&#160;</div>'},beforeExpand:function(b,a,c){if(this.fireEvent(\"beforeexpand\",this,b,a,c)!==false){if(this.tpl&&this.lazyRender){a.innerHTML=this.getBodyContent(b,c)}return true}else{return false}},toggleRow:function(a){if(typeof a==\"number\"){a=this.grid.view.getRow(a)}this[Ext.fly(a).hasClass(\"x-grid3-row-collapsed\")?\"expandRow\":\"collapseRow\"](a)},expandRow:function(c){if(typeof c==\"number\"){c=this.grid.view.getRow(c)}var b=this.grid.store.getAt(c.rowIndex);var a=Ext.DomQuery.selectNode(\"tr:nth(2) div.x-grid3-row-body\",c);if(this.beforeExpand(b,a,c.rowIndex)){this.state[b.id]=true;Ext.fly(c).replaceClass(\"x-grid3-row-collapsed\",\"x-grid3-row-expanded\");this.fireEvent(\"expand\",this,b,a,c.rowIndex)}},collapseRow:function(c){if(typeof c==\"number\"){c=this.grid.view.getRow(c)}var b=this.grid.store.getAt(c.rowIndex);var a=Ext.fly(c).child(\"tr:nth(1) div.x-grid3-row-body\",true);if(this.fireEvent(\"beforecollapse\",this,b,a,c.rowIndex)!==false){this.state[b.id]=false;Ext.fly(c).replaceClass(\"x-grid3-row-expanded\",\"x-grid3-row-collapsed\");this.fireEvent(\"collapse\",this,b,a,c.rowIndex)}}});Ext.preg(\"rowexpander\",Ext.ux.grid.RowExpander);Ext.grid.RowExpander=Ext.ux.grid.RowExpander;Ext.ns(\"Ext.ux.layout\");Ext.ux.layout.RowLayout=Ext.extend(Ext.layout.ContainerLayout,{monitorResize:true,type:\"row\",allowContainerRemove:false,isValidParent:function(b,a){return this.innerCt&&b.getPositionEl().dom.parentNode==this.innerCt.dom},getLayoutTargetSize:function(){var b=this.container.getLayoutTarget(),a;if(b){a=b.getViewSize();if(Ext.isIE&&Ext.isStrict&&a.height==0){a=b.getStyleSize()}a.width-=b.getPadding(\"lr\");a.height-=b.getPadding(\"tb\")}return a},renderAll:function(a,b){if(!this.innerCt){this.innerCt=b.createChild({cls:\"x-column-inner\"});this.innerCt.createChild({cls:\"x-clear\"})}Ext.layout.ColumnLayout.superclass.renderAll.call(this,a,this.innerCt)},onLayout:function(g,k){var c=g.items.items,j=c.length,a,b,d,n=[];this.renderAll(g,k);var o=this.getLayoutTargetSize();if(o.width<1&&o.height<1){return}var e=o.height,f=e;this.innerCt.setSize({height:e});for(d=0;d<j;d++){a=c[d];b=a.getPositionEl().getMargins(\"tb\");n[d]=b;if(!a.rowHeight){f-=(a.getHeight()+b)}}f=f<0?0:f;for(d=0;d<j;d++){a=c[d];b=n[d];if(a.rowHeight){a.setSize({height:Math.floor(a.rowHeight*f)-b})}}if(Ext.isIE){if(d=k.getStyle(\"overflow\")&&d!=\"hidden\"&&!this.adjustmentPass){var l=this.getLayoutTargetSize();if(l.width!=o.width){this.adjustmentPass=true;this.onLayout(g,k)}}}delete this.adjustmentPass}});Ext.Container.LAYOUTS[\"ux.row\"]=Ext.ux.layout.RowLayout;Ext.ns(\"Ext.ux.form\");Ext.ux.form.SearchField=Ext.extend(Ext.form.TwinTriggerField,{initComponent:function(){Ext.ux.form.SearchField.superclass.initComponent.call(this);this.on(\"specialkey\",function(a,b){if(b.getKey()==b.ENTER){this.onTrigger2Click()}},this)},validationEvent:false,validateOnBlur:false,trigger1Class:\"x-form-clear-trigger\",trigger2Class:\"x-form-search-trigger\",hideTrigger1:true,width:180,hasSearch:false,paramName:\"query\",onTrigger1Click:function(){if(this.hasSearch){this.el.dom.value=\"\";var a={start:0};this.store.baseParams=this.store.baseParams||{};this.store.baseParams[this.paramName]=\"\";this.store.reload({params:a});this.triggers[0].hide();this.hasSearch=false}},onTrigger2Click:function(){var a=this.getRawValue();if(a.length<1){this.onTrigger1Click();return}var b={start:0};this.store.baseParams=this.store.baseParams||{};this.store.baseParams[this.paramName]=a;this.store.reload({params:b});this.hasSearch=true;this.triggers[0].show()}});Ext.ns(\"Ext.ux.form\");Ext.ux.form.SelectBox=Ext.extend(Ext.form.ComboBox,{constructor:function(a){this.searchResetDelay=1000;a=a||{};a=Ext.apply(a||{},{editable:false,forceSelection:true,rowHeight:false,lastSearchTerm:false,triggerAction:\"all\",mode:\"local\"});Ext.ux.form.SelectBox.superclass.constructor.apply(this,arguments);this.lastSelectedIndex=this.selectedIndex||0},initEvents:function(){Ext.ux.form.SelectBox.superclass.initEvents.apply(this,arguments);this.el.on(\"keydown\",this.keySearch,this,true);this.cshTask=new Ext.util.DelayedTask(this.clearSearchHistory,this)},keySearch:function(f,d,b){var a=f.getKey();var c=String.fromCharCode(a);var g=0;if(!this.store.getCount()){return}switch(a){case Ext.EventObject.HOME:f.stopEvent();this.selectFirst();return;case Ext.EventObject.END:f.stopEvent();this.selectLast();return;case Ext.EventObject.PAGEDOWN:this.selectNextPage();f.stopEvent();return;case Ext.EventObject.PAGEUP:this.selectPrevPage();f.stopEvent();return}if((f.hasModifier()&&!f.shiftKey)||f.isNavKeyPress()||f.isSpecialKey()){return}if(this.lastSearchTerm==c){g=this.lastSelectedIndex}this.search(this.displayField,c,g);this.cshTask.delay(this.searchResetDelay)},onRender:function(b,a){this.store.on(\"load\",this.calcRowsPerPage,this);Ext.ux.form.SelectBox.superclass.onRender.apply(this,arguments);if(this.mode==\"local\"){this.initList();this.calcRowsPerPage()}},onSelect:function(a,c,b){if(this.fireEvent(\"beforeselect\",this,a,c)!==false){this.setValue(a.data[this.valueField||this.displayField]);if(!b){this.collapse()}this.lastSelectedIndex=c+1;this.fireEvent(\"select\",this,a,c)}},afterRender:function(){Ext.ux.form.SelectBox.superclass.afterRender.apply(this,arguments);if(Ext.isWebKit){this.el.swallowEvent(\"mousedown\",true)}this.el.unselectable();this.innerList.unselectable();this.trigger.unselectable();this.innerList.on(\"mouseup\",function(c,b,a){if(b.id&&b.id==this.innerList.id){return}this.onViewClick()},this);this.mun(this.view,\"containerclick\",this.onViewClick,this);this.mun(this.view,\"click\",this.onViewClick,this);this.innerList.on(\"mouseover\",function(c,b,a){if(b.id&&b.id==this.innerList.id){return}this.lastSelectedIndex=this.view.getSelectedIndexes()[0]+1;this.cshTask.delay(this.searchResetDelay)},this);this.trigger.un(\"click\",this.onTriggerClick,this);this.trigger.on(\"mousedown\",function(c,b,a){c.preventDefault();this.onTriggerClick()},this);this.on(\"collapse\",function(c,b,a){Ext.getDoc().un(\"mouseup\",this.collapseIf,this)},this,true);this.on(\"expand\",function(c,b,a){Ext.getDoc().on(\"mouseup\",this.collapseIf,this)},this,true)},clearSearchHistory:function(){this.lastSelectedIndex=0;this.lastSearchTerm=false},selectFirst:function(){this.focusAndSelect(this.store.data.first())},selectLast:function(){this.focusAndSelect(this.store.data.last())},selectPrevPage:function(){if(!this.rowHeight){return}var a=Math.max(this.selectedIndex-this.rowsPerPage,0);this.focusAndSelect(this.store.getAt(a))},selectNextPage:function(){if(!this.rowHeight){return}var a=Math.min(this.selectedIndex+this.rowsPerPage,this.store.getCount()-1);this.focusAndSelect(this.store.getAt(a))},search:function(c,b,d){c=c||this.displayField;this.lastSearchTerm=b;var a=this.store.find.apply(this.store,arguments);if(a!==-1){this.focusAndSelect(a)}},focusAndSelect:function(a){var b=Ext.isNumber(a)?a:this.store.indexOf(a);this.select(b,this.isExpanded());this.onSelect(this.store.getAt(b),b,this.isExpanded())},calcRowsPerPage:function(){if(this.store.getCount()){this.rowHeight=Ext.fly(this.view.getNode(0)).getHeight();this.rowsPerPage=this.maxHeight/this.rowHeight}else{this.rowHeight=false}}});Ext.reg(\"selectbox\",Ext.ux.form.SelectBox);Ext.ux.SelectBox=Ext.ux.form.SelectBox;Ext.ux.SlidingPager=Ext.extend(Object,{init:function(b){var a=b.items.indexOf(b.inputItem);Ext.each(b.items.getRange(a-2,a+2),function(d){d.hide()});var c=new Ext.Slider({width:114,minValue:1,maxValue:1,plugins:new Ext.slider.Tip({getText:function(d){return String.format(\"Page <b>{0}</b> of <b>{1}</b>\",d.value,d.slider.maxValue)}}),listeners:{changecomplete:function(e,d){b.changePage(d)}}});b.insert(a+1,c);b.on({change:function(d,e){c.setMaxValue(e.pages);c.setValue(e.activePage)}})}});Ext.ns(\"Ext.ux.form\");Ext.ux.form.SpinnerField=Ext.extend(Ext.form.NumberField,{actionMode:\"wrap\",deferHeight:true,autoSize:Ext.emptyFn,onBlur:Ext.emptyFn,adjustSize:Ext.BoxComponent.prototype.adjustSize,constructor:function(c){var b=Ext.copyTo({},c,\"incrementValue,alternateIncrementValue,accelerate,defaultValue,triggerClass,splitterClass\");var d=this.spinner=new Ext.ux.Spinner(b);var a=c.plugins?(Ext.isArray(c.plugins)?c.plugins.push(d):[c.plugins,d]):d;Ext.ux.form.SpinnerField.superclass.constructor.call(this,Ext.apply(c,{plugins:a}))},getResizeEl:function(){return this.wrap},getPositionEl:function(){return this.wrap},alignErrorIcon:function(){if(this.wrap){this.errorIcon.alignTo(this.wrap,\"tl-tr\",[2,0])}},validateBlur:function(){return true}});Ext.reg(\"spinnerfield\",Ext.ux.form.SpinnerField);Ext.form.SpinnerField=Ext.ux.form.SpinnerField;Ext.ux.Spinner=Ext.extend(Ext.util.Observable,{incrementValue:1,alternateIncrementValue:5,triggerClass:\"x-form-spinner-trigger\",splitterClass:\"x-form-spinner-splitter\",alternateKey:Ext.EventObject.shiftKey,defaultValue:0,accelerate:false,constructor:function(a){Ext.ux.Spinner.superclass.constructor.call(this,a);Ext.apply(this,a);this.mimicing=false},init:function(a){this.field=a;a.afterMethod(\"onRender\",this.doRender,this);a.afterMethod(\"onEnable\",this.doEnable,this);a.afterMethod(\"onDisable\",this.doDisable,this);a.afterMethod(\"afterRender\",this.doAfterRender,this);a.afterMethod(\"onResize\",this.doResize,this);a.afterMethod(\"onFocus\",this.doFocus,this);a.beforeMethod(\"onDestroy\",this.doDestroy,this)},doRender:function(b,a){var c=this.el=this.field.getEl();var d=this.field;if(!d.wrap){d.wrap=this.wrap=c.wrap({cls:\"x-form-field-wrap\"})}else{this.wrap=d.wrap.addClass(\"x-form-field-wrap\")}this.trigger=this.wrap.createChild({tag:\"img\",src:Ext.BLANK_IMAGE_URL,cls:\"x-form-trigger \"+this.triggerClass});if(!d.width){this.wrap.setWidth(c.getWidth()+this.trigger.getWidth())}this.splitter=this.wrap.createChild({tag:\"div\",cls:this.splitterClass,style:\"width:13px; height:2px;\"});this.splitter.setRight((Ext.isIE)?1:2).setTop(10).show();this.proxy=this.trigger.createProxy(\"\",this.splitter,true);this.proxy.addClass(\"x-form-spinner-proxy\");this.proxy.setStyle(\"left\",\"0px\");this.proxy.setSize(14,1);this.proxy.hide();this.dd=new Ext.dd.DDProxy(this.splitter.dom.id,\"SpinnerDrag\",{dragElId:this.proxy.id});this.initTrigger();this.initSpinner()},doAfterRender:function(){var a;if(Ext.isIE&&this.el.getY()!=(a=this.trigger.getY())){this.el.position();this.el.setY(a)}},doEnable:function(){if(this.wrap){this.disabled=false;this.wrap.removeClass(this.field.disabledClass)}},doDisable:function(){if(this.wrap){this.disabled=true;this.wrap.addClass(this.field.disabledClass);this.el.removeClass(this.field.disabledClass)}},doResize:function(a,b){if(typeof a==\"number\"){this.el.setWidth(a-this.trigger.getWidth())}this.wrap.setWidth(this.el.getWidth()+this.trigger.getWidth())},doFocus:function(){if(!this.mimicing){this.wrap.addClass(\"x-trigger-wrap-focus\");this.mimicing=true;Ext.get(Ext.isIE?document.body:document).on(\"mousedown\",this.mimicBlur,this,{delay:10});this.el.on(\"keydown\",this.checkTab,this)}},checkTab:function(a){if(a.getKey()==a.TAB){this.triggerBlur()}},mimicBlur:function(a){if(!this.wrap.contains(a.target)&&this.field.validateBlur(a)){this.triggerBlur()}},triggerBlur:function(){this.mimicing=false;Ext.get(Ext.isIE?document.body:document).un(\"mousedown\",this.mimicBlur,this);this.el.un(\"keydown\",this.checkTab,this);this.field.beforeBlur();this.wrap.removeClass(\"x-trigger-wrap-focus\");this.field.onBlur.call(this.field)},initTrigger:function(){this.trigger.addClassOnOver(\"x-form-trigger-over\");this.trigger.addClassOnClick(\"x-form-trigger-click\")},initSpinner:function(){this.field.addEvents({spin:true,spinup:true,spindown:true});this.keyNav=new Ext.KeyNav(this.el,{up:function(a){a.preventDefault();this.onSpinUp()},down:function(a){a.preventDefault();this.onSpinDown()},pageUp:function(a){a.preventDefault();this.onSpinUpAlternate()},pageDown:function(a){a.preventDefault();this.onSpinDownAlternate()},scope:this});this.repeater=new Ext.util.ClickRepeater(this.trigger,{accelerate:this.accelerate});this.field.mon(this.repeater,\"click\",this.onTriggerClick,this,{preventDefault:true});this.field.mon(this.trigger,{mouseover:this.onMouseOver,mouseout:this.onMouseOut,mousemove:this.onMouseMove,mousedown:this.onMouseDown,mouseup:this.onMouseUp,scope:this,preventDefault:true});this.field.mon(this.wrap,\"mousewheel\",this.handleMouseWheel,this);this.dd.setXConstraint(0,0,10);this.dd.setYConstraint(1500,1500,10);this.dd.endDrag=this.endDrag.createDelegate(this);this.dd.startDrag=this.startDrag.createDelegate(this);this.dd.onDrag=this.onDrag.createDelegate(this)},onMouseOver:function(){if(this.disabled){return}var a=this.getMiddle();this.tmpHoverClass=(Ext.EventObject.getPageY()<a)?\"x-form-spinner-overup\":\"x-form-spinner-overdown\";this.trigger.addClass(this.tmpHoverClass)},onMouseOut:function(){this.trigger.removeClass(this.tmpHoverClass)},onMouseMove:function(){if(this.disabled){return}var a=this.getMiddle();if(((Ext.EventObject.getPageY()>a)&&this.tmpHoverClass==\"x-form-spinner-overup\")||((Ext.EventObject.getPageY()<a)&&this.tmpHoverClass==\"x-form-spinner-overdown\")){}},onMouseDown:function(){if(this.disabled){return}var a=this.getMiddle();this.tmpClickClass=(Ext.EventObject.getPageY()<a)?\"x-form-spinner-clickup\":\"x-form-spinner-clickdown\";this.trigger.addClass(this.tmpClickClass)},onMouseUp:function(){this.trigger.removeClass(this.tmpClickClass)},onTriggerClick:function(){if(this.disabled||this.el.dom.readOnly){return}var b=this.getMiddle();var a=(Ext.EventObject.getPageY()<b)?\"Up\":\"Down\";this[\"onSpin\"+a]()},getMiddle:function(){var b=this.trigger.getTop();var c=this.trigger.getHeight();var a=b+(c/2);return a},isSpinnable:function(){if(this.disabled||this.el.dom.readOnly){Ext.EventObject.preventDefault();return false}return true},handleMouseWheel:function(a){if(this.wrap.hasClass(\"x-trigger-wrap-focus\")==false){return}var b=a.getWheelDelta();if(b>0){this.onSpinUp();a.stopEvent()}else{if(b<0){this.onSpinDown();a.stopEvent()}}},startDrag:function(){this.proxy.show();this._previousY=Ext.fly(this.dd.getDragEl()).getTop()},endDrag:function(){this.proxy.hide()},onDrag:function(){if(this.disabled){return}var b=Ext.fly(this.dd.getDragEl()).getTop();var a=\"\";if(this._previousY>b){a=\"Up\"}if(this._previousY<b){a=\"Down\"}if(a!=\"\"){this[\"onSpin\"+a]()}this._previousY=b},onSpinUp:function(){if(this.isSpinnable()==false){return}if(Ext.EventObject.shiftKey==true){this.onSpinUpAlternate();return}else{this.spin(false,false)}this.field.fireEvent(\"spin\",this);this.field.fireEvent(\"spinup\",this)},onSpinDown:function(){if(this.isSpinnable()==false){return}if(Ext.EventObject.shiftKey==true){this.onSpinDownAlternate();return}else{this.spin(true,false)}this.field.fireEvent(\"spin\",this);this.field.fireEvent(\"spindown\",this)},onSpinUpAlternate:function(){if(this.isSpinnable()==false){return}this.spin(false,true);this.field.fireEvent(\"spin\",this);this.field.fireEvent(\"spinup\",this)},onSpinDownAlternate:function(){if(this.isSpinnable()==false){return}this.spin(true,true);this.field.fireEvent(\"spin\",this);this.field.fireEvent(\"spindown\",this)},spin:function(d,b){var a=parseFloat(this.field.getValue());var c=(b==true)?this.alternateIncrementValue:this.incrementValue;(d==true)?a-=c:a+=c;a=(isNaN(a))?this.defaultValue:a;a=this.fixBoundries(a);this.field.setRawValue(a)},fixBoundries:function(b){var a=b;if(this.field.minValue!=undefined&&a<this.field.minValue){a=this.field.minValue}if(this.field.maxValue!=undefined&&a>this.field.maxValue){a=this.field.maxValue}return this.fixPrecision(a)},fixPrecision:function(b){var a=isNaN(b);if(!this.field.allowDecimals||this.field.decimalPrecision==-1||a||!b){return a?\"\":b}return parseFloat(parseFloat(b).toFixed(this.field.decimalPrecision))},doDestroy:function(){if(this.trigger){this.trigger.remove()}if(this.wrap){this.wrap.remove();delete this.field.wrap}if(this.splitter){this.splitter.remove()}if(this.dd){this.dd.unreg();this.dd=null}if(this.proxy){this.proxy.remove()}if(this.repeater){this.repeater.purgeListeners()}if(this.mimicing){Ext.get(Ext.isIE?document.body:document).un(\"mousedown\",this.mimicBlur,this)}}});Ext.form.Spinner=Ext.ux.Spinner;Ext.ux.Spotlight=function(a){Ext.apply(this,a)};Ext.ux.Spotlight.prototype={active:false,animate:true,duration:0.25,easing:\"easeNone\",animated:false,createElements:function(){var a=Ext.getBody();this.right=a.createChild({cls:\"x-spotlight\"});this.left=a.createChild({cls:\"x-spotlight\"});this.top=a.createChild({cls:\"x-spotlight\"});this.bottom=a.createChild({cls:\"x-spotlight\"});this.all=new Ext.CompositeElement([this.right,this.left,this.top,this.bottom])},show:function(b,c,a){if(this.animated){this.show.defer(50,this,[b,c,a]);return}this.el=Ext.get(b);if(!this.right){this.createElements()}if(!this.active){this.all.setDisplayed(\"\");this.applyBounds(true,false);this.active=true;Ext.EventManager.onWindowResize(this.syncSize,this);this.applyBounds(false,this.animate,false,c,a)}else{this.applyBounds(false,false,false,c,a)}},hide:function(b,a){if(this.animated){this.hide.defer(50,this,[b,a]);return}Ext.EventManager.removeResizeListener(this.syncSize,this);this.applyBounds(true,this.animate,true,b,a)},doHide:function(){this.active=false;this.all.setDisplayed(false)},syncSize:function(){this.applyBounds(false,false)},applyBounds:function(e,d,k,j,l){var h=this.el.getRegion();var a=Ext.lib.Dom.getViewWidth(true);var g=Ext.lib.Dom.getViewHeight(true);var f=0,b=false;if(d){b={callback:function(){f++;if(f==4){this.animated=false;if(k){this.doHide()}Ext.callback(j,l,[this])}},scope:this,duration:this.duration,easing:this.easing};this.animated=true}this.right.setBounds(h.right,e?g:h.top,a-h.right,e?0:(g-h.top),b);this.left.setBounds(0,0,h.left,e?0:h.bottom,b);this.top.setBounds(e?a:h.left,0,e?0:a-h.left,h.top,b);this.bottom.setBounds(0,h.bottom,e?0:h.right,g-h.bottom,b);if(!d){if(k){this.doHide()}if(j){Ext.callback(j,l,[this])}}},destroy:function(){this.doHide();Ext.destroy(this.right,this.left,this.top,this.bottom);delete this.el;delete this.all}};Ext.Spotlight=Ext.ux.Spotlight;Ext.ux.StatusBar=Ext.extend(Ext.Toolbar,{cls:\"x-statusbar\",busyIconCls:\"x-status-busy\",busyText:\"Loading...\",autoClear:5000,emptyText:\"&nbsp;\",activeThreadId:0,initComponent:function(){if(this.statusAlign==\"right\"){this.cls+=\" x-status-right\"}Ext.ux.StatusBar.superclass.initComponent.call(this)},afterRender:function(){Ext.ux.StatusBar.superclass.afterRender.call(this);var a=this.statusAlign==\"right\";this.currIconCls=this.iconCls||this.defaultIconCls;this.statusEl=new Ext.Toolbar.TextItem({cls:\"x-status-text \"+(this.currIconCls||\"\"),text:this.text||this.defaultText||\"\"});if(a){this.add(\"->\");this.add(this.statusEl)}else{this.insert(0,this.statusEl);this.insert(1,\"->\")}this.doLayout()},setStatus:function(d){d=d||{};if(typeof d==\"string\"){d={text:d}}if(d.text!==undefined){this.setText(d.text)}if(d.iconCls!==undefined){this.setIcon(d.iconCls)}if(d.clear){var e=d.clear,b=this.autoClear,a={useDefaults:true,anim:true};if(typeof e==\"object\"){e=Ext.applyIf(e,a);if(e.wait){b=e.wait}}else{if(typeof e==\"number\"){b=e;e=a}else{if(typeof e==\"boolean\"){e=a}}}e.threadId=this.activeThreadId;this.clearStatus.defer(b,this,[e])}return this},clearStatus:function(c){c=c||{};if(c.threadId&&c.threadId!==this.activeThreadId){return this}var b=c.useDefaults?this.defaultText:this.emptyText,a=c.useDefaults?(this.defaultIconCls?this.defaultIconCls:\"\"):\"\";if(c.anim){this.statusEl.el.fadeOut({remove:false,useDisplay:true,scope:this,callback:function(){this.setStatus({text:b,iconCls:a});this.statusEl.el.show()}})}else{this.statusEl.hide();this.setStatus({text:b,iconCls:a});this.statusEl.show()}return this},setText:function(a){this.activeThreadId++;this.text=a||\"\";if(this.rendered){this.statusEl.setText(this.text)}return this},getText:function(){return this.text},setIcon:function(a){this.activeThreadId++;a=a||\"\";if(this.rendered){if(this.currIconCls){this.statusEl.removeClass(this.currIconCls);this.currIconCls=null}if(a.length>0){this.statusEl.addClass(a);this.currIconCls=a}}else{this.currIconCls=a}return this},showBusy:function(a){if(typeof a==\"string\"){a={text:a}}a=Ext.applyIf(a||{},{text:this.busyText,iconCls:this.busyIconCls});return this.setStatus(a)}});Ext.reg(\"statusbar\",Ext.ux.StatusBar);Ext.ux.TabCloseMenu=Ext.extend(Object,{closeTabText:\"Close Tab\",closeOtherTabsText:\"Close Other Tabs\",showCloseAll:true,closeAllTabsText:\"Close All Tabs\",constructor:function(a){Ext.apply(this,a||{})},init:function(a){this.tabs=a;a.on({scope:this,contextmenu:this.onContextMenu,destroy:this.destroy})},destroy:function(){Ext.destroy(this.menu);delete this.menu;delete this.tabs;delete this.active},onContextMenu:function(b,c,g){this.active=c;var a=this.createMenu(),d=true,h=true,f=a.getComponent(\"closeall\");a.getComponent(\"close\").setDisabled(!c.closable);b.items.each(function(){if(this.closable){d=false;if(this!=c){h=false;return false}}});a.getComponent(\"closeothers\").setDisabled(h);if(f){f.setDisabled(d)}g.stopEvent();a.showAt(g.getPoint())},createMenu:function(){if(!this.menu){var a=[{itemId:\"close\",text:this.closeTabText,scope:this,handler:this.onClose}];if(this.showCloseAll){a.push(\"-\")}a.push({itemId:\"closeothers\",text:this.closeOtherTabsText,scope:this,handler:this.onCloseOthers});if(this.showCloseAll){a.push({itemId:\"closeall\",text:this.closeAllTabsText,scope:this,handler:this.onCloseAll})}this.menu=new Ext.menu.Menu({items:a})}return this.menu},onClose:function(){this.tabs.remove(this.active)},onCloseOthers:function(){this.doClose(true)},onCloseAll:function(){this.doClose(false)},doClose:function(b){var a=[];this.tabs.items.each(function(c){if(c.closable){if(!b||c!=this.active){a.push(c)}}},this);Ext.each(a,function(c){this.tabs.remove(c)},this)}});Ext.preg(\"tabclosemenu\",Ext.ux.TabCloseMenu);Ext.ns(\"Ext.ux.grid\");Ext.ux.grid.TableGrid=function(p,f){f=f||{};Ext.apply(this,f);var c=f.fields||[],a=f.columns||[];p=Ext.get(p);var k=p.insertSibling();var l=[],m=[];var e=p.query(\"thead th\");for(var g=0,j;j=e[g];g++){var o=j.innerHTML;var b=\"tcol-\"+g;l.push(Ext.applyIf(c[g]||{},{name:b,mapping:\"td:nth(\"+(g+1)+\")/@innerHTML\"}));m.push(Ext.applyIf(a[g]||{},{header:o,dataIndex:b,width:j.offsetWidth,tooltip:j.title,sortable:true}))}var d=new Ext.data.Store({reader:new Ext.data.XmlReader({record:\"tbody tr\"},l)});d.loadData(p.dom);var n=new Ext.grid.ColumnModel(m);if(f.width||f.height){k.setSize(f.width||\"auto\",f.height||\"auto\")}else{k.setWidth(p.getWidth())}if(f.remove!==false){p.remove()}Ext.applyIf(this,{ds:d,cm:n,sm:new Ext.grid.RowSelectionModel(),autoHeight:true,autoWidth:false});Ext.ux.grid.TableGrid.superclass.constructor.call(this,k,{})};Ext.extend(Ext.ux.grid.TableGrid,Ext.grid.GridPanel);Ext.grid.TableGrid=Ext.ux.grid.TableGrid;Ext.ns(\"Ext.ux\");Ext.ux.TabScrollerMenu=Ext.extend(Object,{pageSize:10,maxText:15,menuPrefixText:\"Items\",constructor:function(a){a=a||{};Ext.apply(this,a)},init:function(b){Ext.apply(b,this.parentOverrides);b.tabScrollerMenu=this;var a=this;b.on({render:{scope:b,single:true,fn:function(){var c=b.createScrollers.createSequence(a.createPanelsMenu,this);b.createScrollers=c}}})},createPanelsMenu:function(){var c=this.stripWrap.dom.offsetHeight;var b=this.header.dom.firstChild;Ext.fly(b).applyStyles({right:\"18px\"});var a=Ext.get(this.strip.dom.parentNode);a.applyStyles({\"margin-right\":\"36px\"});var d=this.header.insertFirst({cls:\"x-tab-tabmenu-right\"});d.setHeight(c);d.addClassOnOver(\"x-tab-tabmenu-over\");d.on(\"click\",this.showTabsMenu,this);this.scrollLeft.show=this.scrollLeft.show.createSequence(function(){d.show()});this.scrollLeft.hide=this.scrollLeft.hide.createSequence(function(){d.hide()})},getPageSize:function(){return this.pageSize},setPageSize:function(a){this.pageSize=a},getMaxText:function(){return this.maxText},setMaxText:function(a){this.maxText=a},getMenuPrefixText:function(){return this.menuPrefixText},setMenuPrefixText:function(a){this.menuPrefixText=a},parentOverrides:{showTabsMenu:function(c){if(this.tabsMenu){this.tabsMenu.destroy();this.un(\"destroy\",this.tabsMenu.destroy,this.tabsMenu);this.tabsMenu=null}this.tabsMenu=new Ext.menu.Menu();this.on(\"destroy\",this.tabsMenu.destroy,this.tabsMenu);this.generateTabMenuItems();var b=Ext.get(c.getTarget());var a=b.getXY();a[1]+=24;this.tabsMenu.showAt(a)},generateTabMenuItems:function(){var a=this.getActiveTab();var l=this.items.getCount();var g=this.tabScrollerMenu.getPageSize();if(l>g){var d=Math.floor(l/g);var j=l%g;for(var e=0;e<d;e++){var f=(e+1)*g;var b=[];for(var h=0;h<g;h++){index=h+f-g;var k=this.items.get(index);b.push(this.autoGenMenuItem(k))}this.tabsMenu.add({text:this.tabScrollerMenu.getMenuPrefixText()+\" \"+(f-g+1)+\" - \"+f,menu:b})}if(j>0){var c=d*g;b=[];for(var e=c;e<l;e++){var k=this.items.get(e);b.push(this.autoGenMenuItem(k))}this.tabsMenu.add({text:this.tabScrollerMenu.menuPrefixText+\" \"+(c+1)+\" - \"+(c+b.length),menu:b})}}else{this.items.each(function(m){if(m.id!=a.id&&!m.hidden){this.tabsMenu.add(this.autoGenMenuItem(m))}},this)}},autoGenMenuItem:function(b){var a=this.tabScrollerMenu.getMaxText();var c=Ext.util.Format.ellipsis(b.title,a);return{text:c,handler:this.showTabFromMenu,scope:this,disabled:b.disabled,tabToShow:b,iconCls:b.iconCls}},showTabFromMenu:function(a){this.setActiveTab(a.tabToShow)}}});Ext.reg(\"tabscrollermenu\",Ext.ux.TabScrollerMenu);Ext.ns(\"Ext.ux.tree\");Ext.ux.tree.XmlTreeLoader=Ext.extend(Ext.tree.TreeLoader,{XML_NODE_ELEMENT:1,XML_NODE_TEXT:3,processResponse:function(b,d,g){var c=b.responseXML,a=c.documentElement||c;try{d.beginUpdate();d.appendChild(this.parseXml(a));d.endUpdate();this.runCallback(g,scope||d,[d])}catch(f){this.handleFailure(b)}},parseXml:function(b){var a=[];Ext.each(b.childNodes,function(f){if(f.nodeType==this.XML_NODE_ELEMENT){var c=this.createNode(f);if(f.childNodes.length>0){var e=this.parseXml(f);if(typeof e==\"string\"){c.attributes.innerText=e}else{c.appendChild(e)}}a.push(c)}else{if(f.nodeType==this.XML_NODE_TEXT){var d=f.nodeValue.trim();if(d.length>0){return a=d}}}},this);return a},createNode:function(b){var a={tagName:b.tagName};Ext.each(b.attributes,function(c){a[c.nodeName]=c.nodeValue});this.processAttributes(a);return Ext.ux.tree.XmlTreeLoader.superclass.createNode.call(this,a)},processAttributes:Ext.emptyFn});Ext.ux.XmlTreeLoader=Ext.ux.tree.XmlTreeLoader;Ext.ux.ValidationStatus=Ext.extend(Ext.Component,{errorIconCls:\"x-status-error\",errorListCls:\"x-status-error-list\",validIconCls:\"x-status-valid\",showText:\"The form has errors (click for details...)\",hideText:\"Click again to hide the error list\",submitText:\"Saving...\",init:function(a){a.on(\"render\",function(){this.statusBar=a;this.monitor=true;this.errors=new Ext.util.MixedCollection();this.listAlign=(a.statusAlign==\"right\"?\"br-tr?\":\"bl-tl?\");if(this.form){this.form=Ext.getCmp(this.form).getForm();this.startMonitoring();this.form.on(\"beforeaction\",function(d,c){if(c.type==\"submit\"){this.monitor=false}},this);var b=function(){this.monitor=true};this.form.on(\"actioncomplete\",b,this);this.form.on(\"actionfailed\",b,this)}},this,{single:true});a.on({scope:this,afterlayout:{single:true,fn:function(){a.statusEl.getEl().on(\"click\",this.onStatusClick,this,{buffer:200})}},beforedestroy:{single:true,fn:this.onDestroy}})},startMonitoring:function(){this.form.items.each(function(a){a.on(\"invalid\",this.onFieldValidation,this);a.on(\"valid\",this.onFieldValidation,this)},this)},stopMonitoring:function(){this.form.items.each(function(a){a.un(\"invalid\",this.onFieldValidation,this);a.un(\"valid\",this.onFieldValidation,this)},this)},onDestroy:function(){this.stopMonitoring();this.statusBar.statusEl.un(\"click\",this.onStatusClick,this);Ext.ux.ValidationStatus.superclass.onDestroy.call(this)},onFieldValidation:function(a,b){if(!this.monitor){return false}if(b){this.errors.add(a.id,{field:a,msg:b})}else{this.errors.removeKey(a.id)}this.updateErrorList();if(this.errors.getCount()>0){if(this.statusBar.getText()!=this.showText){this.statusBar.setStatus({text:this.showText,iconCls:this.errorIconCls})}}else{this.statusBar.clearStatus().setIcon(this.validIconCls)}},updateErrorList:function(){if(this.errors.getCount()>0){var a=\"<ul>\";this.errors.each(function(b){a+=('<li id=\"x-err-'+b.field.id+'\"><a href=\"#\">'+b.msg+\"</a></li>\")},this);this.getMsgEl().update(a+\"</ul>\")}else{this.getMsgEl().update(\"\")}},getMsgEl:function(){if(!this.msgEl){this.msgEl=Ext.DomHelper.append(Ext.getBody(),{cls:this.errorListCls+\" x-hide-offsets\"},true);this.msgEl.on(\"click\",function(b){var a=b.getTarget(\"li\",10,true);if(a){Ext.getCmp(a.id.split(\"x-err-\")[1]).focus();this.hideErrors()}},this,{stopEvent:true})}return this.msgEl},showErrors:function(){this.updateErrorList();this.getMsgEl().alignTo(this.statusBar.getEl(),this.listAlign).slideIn(\"b\",{duration:0.3,easing:\"easeOut\"});this.statusBar.setText(this.hideText);this.form.getEl().on(\"click\",this.hideErrors,this,{single:true})},hideErrors:function(){var a=this.getMsgEl();if(a.isVisible()){a.slideOut(\"b\",{duration:0.2,easing:\"easeIn\"});this.statusBar.setText(this.showText)}this.form.getEl().un(\"click\",this.hideErrors,this)},onStatusClick:function(){if(this.getMsgEl().isVisible()){this.hideErrors()}else{if(this.errors.getCount()>0){this.showErrors()}}}});(function(){Ext.override(Ext.list.Column,{init:function(){var b=Ext.data.Types,a=this.sortType;if(this.type){if(Ext.isString(this.type)){this.type=Ext.data.Types[this.type.toUpperCase()]||b.AUTO}}else{this.type=b.AUTO}if(Ext.isString(a)){this.sortType=Ext.data.SortTypes[a]}else{if(Ext.isEmpty(a)){this.sortType=this.type.sortType}}}});Ext.tree.Column=Ext.extend(Ext.list.Column,{});Ext.tree.NumberColumn=Ext.extend(Ext.list.NumberColumn,{});Ext.tree.DateColumn=Ext.extend(Ext.list.DateColumn,{});Ext.tree.BooleanColumn=Ext.extend(Ext.list.BooleanColumn,{});Ext.reg(\"tgcolumn\",Ext.tree.Column);Ext.reg(\"tgnumbercolumn\",Ext.tree.NumberColumn);Ext.reg(\"tgdatecolumn\",Ext.tree.DateColumn);Ext.reg(\"tgbooleancolumn\",Ext.tree.BooleanColumn)})();Ext.ux.tree.TreeGridNodeUI=Ext.extend(Ext.tree.TreeNodeUI,{isTreeGridNodeUI:true,renderElements:function(d,l,h,m){var o=d.getOwnerTree(),k=o.columns,j=k[0],e,b,g;this.indentMarkup=d.parentNode?d.parentNode.ui.getChildIndent():\"\";b=['<tbody class=\"x-tree-node\">','<tr ext:tree-node-id=\"',d.id,'\" class=\"x-tree-node-el x-tree-node-leaf ',l.cls,'\">','<td class=\"x-treegrid-col\">','<span class=\"x-tree-node-indent\">',this.indentMarkup,\"</span>\",'<img src=\"',this.emptyIcon,'\" class=\"x-tree-ec-icon x-tree-elbow\" />','<img src=\"',l.icon||this.emptyIcon,'\" class=\"x-tree-node-icon',(l.icon?\" x-tree-node-inline-icon\":\"\"),(l.iconCls?\" \"+l.iconCls:\"\"),'\" unselectable=\"on\" />','<a hidefocus=\"on\" class=\"x-tree-node-anchor\" href=\"',l.href?l.href:\"#\",'\" tabIndex=\"1\" ',l.hrefTarget?' target=\"'+l.hrefTarget+'\"':\"\",\">\",'<span unselectable=\"on\">',(j.tpl?j.tpl.apply(l):l[j.dataIndex]||j.text),\"</span></a>\",\"</td>\"];for(e=1,g=k.length;e<g;e++){j=k[e];b.push('<td class=\"x-treegrid-col ',(j.cls?j.cls:\"\"),'\">','<div unselectable=\"on\" class=\"x-treegrid-text\"',(j.align?' style=\"text-align: '+j.align+';\"':\"\"),\">\",(j.tpl?j.tpl.apply(l):l[j.dataIndex]),\"</div>\",\"</td>\")}b.push('</tr><tr class=\"x-tree-node-ct\"><td colspan=\"',k.length,'\">','<table class=\"x-treegrid-node-ct-table\" cellpadding=\"0\" cellspacing=\"0\" style=\"table-layout: fixed; display: none; width: ',o.innerCt.getWidth(),'px;\"><colgroup>');for(e=0,g=k.length;e<g;e++){b.push('<col style=\"width: ',(k[e].hidden?0:k[e].width),'px;\" />')}b.push(\"</colgroup></table></td></tr></tbody>\");if(m!==true&&d.nextSibling&&d.nextSibling.ui.getEl()){this.wrap=Ext.DomHelper.insertHtml(\"beforeBegin\",d.nextSibling.ui.getEl(),b.join(\"\"))}else{this.wrap=Ext.DomHelper.insertHtml(\"beforeEnd\",h,b.join(\"\"))}this.elNode=this.wrap.childNodes[0];this.ctNode=this.wrap.childNodes[1].firstChild.firstChild;var f=this.elNode.firstChild.childNodes;this.indentNode=f[0];this.ecNode=f[1];this.iconNode=f[2];this.anchor=f[3];this.textNode=f[3].firstChild},animExpand:function(a){this.ctNode.style.display=\"\";Ext.ux.tree.TreeGridNodeUI.superclass.animExpand.call(this,a)}});Ext.ux.tree.TreeGridRootNodeUI=Ext.extend(Ext.tree.TreeNodeUI,{isTreeGridNodeUI:true,render:function(){if(!this.rendered){this.wrap=this.ctNode=this.node.ownerTree.innerCt.dom;this.node.expanded=true}if(Ext.isWebKit){var a=this.ctNode;a.style.tableLayout=null;(function(){a.style.tableLayout=\"fixed\"}).defer(1)}},destroy:function(){if(this.elNode){Ext.dd.Registry.unregister(this.elNode.id)}delete this.node},collapse:Ext.emptyFn,expand:Ext.emptyFn});Ext.tree.ColumnResizer=Ext.extend(Ext.util.Observable,{minWidth:14,constructor:function(a){Ext.apply(this,a);Ext.tree.ColumnResizer.superclass.constructor.call(this)},init:function(a){this.tree=a;a.on(\"render\",this.initEvents,this)},initEvents:function(a){a.mon(a.innerHd,\"mousemove\",this.handleHdMove,this);this.tracker=new Ext.dd.DragTracker({onBeforeStart:this.onBeforeStart.createDelegate(this),onStart:this.onStart.createDelegate(this),onDrag:this.onDrag.createDelegate(this),onEnd:this.onEnd.createDelegate(this),tolerance:3,autoStart:300});this.tracker.initEl(a.innerHd);a.on(\"beforedestroy\",this.tracker.destroy,this.tracker)},handleHdMove:function(f,k){var g=5,j=f.getPageX(),d=f.getTarget(\".x-treegrid-hd\",3,true);if(d){var b=d.getRegion(),l=d.dom.style,c=d.dom.parentNode;if(j-b.left<=g&&d.dom!==c.firstChild){var a=d.dom.previousSibling;while(a&&Ext.fly(a).hasClass(\"x-treegrid-hd-hidden\")){a=a.previousSibling}if(a){this.activeHd=Ext.get(a);l.cursor=Ext.isWebKit?\"e-resize\":\"col-resize\"}}else{if(b.right-j<=g){var h=d.dom;while(h&&Ext.fly(h).hasClass(\"x-treegrid-hd-hidden\")){h=h.previousSibling}if(h){this.activeHd=Ext.get(h);l.cursor=Ext.isWebKit?\"w-resize\":\"col-resize\"}}else{delete this.activeHd;l.cursor=\"\"}}}},onBeforeStart:function(a){this.dragHd=this.activeHd;return !!this.dragHd},onStart:function(b){this.dragHeadersDisabled=this.tree.headersDisabled;this.tree.headersDisabled=true;this.proxy=this.tree.body.createChild({cls:\"x-treegrid-resizer\"});this.proxy.setHeight(this.tree.body.getHeight());var a=this.tracker.getXY()[0];this.hdX=this.dragHd.getX();this.hdIndex=this.tree.findHeaderIndex(this.dragHd);this.proxy.setX(this.hdX);this.proxy.setWidth(a-this.hdX);this.maxWidth=this.tree.outerCt.getWidth()-this.tree.innerBody.translatePoints(this.hdX).left},onDrag:function(b){var a=this.tracker.getXY()[0];this.proxy.setWidth((a-this.hdX).constrain(this.minWidth,this.maxWidth))},onEnd:function(d){var b=this.proxy.getWidth(),a=this.tree,c=this.dragHeadersDisabled;this.proxy.remove();delete this.dragHd;a.columns[this.hdIndex].width=b;a.updateColumnWidths();setTimeout(function(){a.headersDisabled=c},100)}});Ext.ns(\"Ext.ux.tree\");Ext.ux.tree.TreeGridSorter=Ext.extend(Ext.tree.TreeSorter,{sortClasses:[\"sort-asc\",\"sort-desc\"],sortAscText:\"Sort Ascending\",sortDescText:\"Sort Descending\",constructor:function(a,b){if(!Ext.isObject(b)){b={property:a.columns[0].dataIndex||\"text\",folderSort:true}}Ext.ux.tree.TreeGridSorter.superclass.constructor.apply(this,arguments);this.tree=a;a.on(\"headerclick\",this.onHeaderClick,this);a.ddAppendOnly=true;var c=this;this.defaultSortFn=function(l,k){var j=c.dir&&c.dir.toLowerCase()==\"desc\",d=c.property||\"text\",f=c.sortType,n=c.caseSensitive===true,e=c.leafAttr||\"leaf\",o=l.attributes,m=k.attributes;if(c.folderSort){if(o[e]&&!m[e]){return 1}if(!o[e]&&m[e]){return -1}}var h=o[d],g=m[d],p=f?f(h):(n?h:h.toUpperCase());v2=f?f(g):(n?g:g.toUpperCase());if(p<v2){return j?+1:-1}else{if(p>v2){return j?-1:+1}else{return 0}}};a.on(\"afterrender\",this.onAfterTreeRender,this,{single:true});a.on(\"headermenuclick\",this.onHeaderMenuClick,this)},onAfterTreeRender:function(){if(this.tree.hmenu){this.tree.hmenu.insert(0,{itemId:\"asc\",text:this.sortAscText,cls:\"xg-hmenu-sort-asc\"},{itemId:\"desc\",text:this.sortDescText,cls:\"xg-hmenu-sort-desc\"})}this.updateSortIcon(0,\"asc\")},onHeaderMenuClick:function(d,b,a){if(b===\"asc\"||b===\"desc\"){this.onHeaderClick(d,null,a);return false}},onHeaderClick:function(e,b,a){if(e&&!this.tree.headersDisabled){var d=this;d.property=e.dataIndex;d.dir=e.dir=(e.dir===\"desc\"?\"asc\":\"desc\");d.sortType=e.sortType;d.caseSensitive===Ext.isBoolean(e.caseSensitive)?e.caseSensitive:this.caseSensitive;d.sortFn=e.sortFn||this.defaultSortFn;this.tree.root.cascade(function(c){if(!c.isLeaf()){d.updateSort(d.tree,c)}});this.updateSortIcon(a,e.dir)}},updateSortIcon:function(b,a){var d=this.sortClasses,c=this.tree.innerHd.select(\"td\").removeClass(d);c.item(b).addClass(d[a==\"desc\"?1:0])}});Ext.ux.tree.TreeGridLoader=Ext.extend(Ext.tree.TreeLoader,{createNode:function(a){if(!a.uiProvider){a.uiProvider=Ext.ux.tree.TreeGridNodeUI}return Ext.tree.TreeLoader.prototype.createNode.call(this,a)}});Ext.ux.tree.TreeGrid=Ext.extend(Ext.tree.TreePanel,{rootVisible:false,useArrows:true,lines:false,borderWidth:Ext.isBorderBox?0:2,cls:\"x-treegrid\",columnResize:true,enableSort:true,reserveScrollOffset:true,enableHdMenu:true,columnsText:\"Columns\",initComponent:function(){if(!this.root){this.root=new Ext.tree.AsyncTreeNode({text:\"Root\"})}var a=this.loader;if(!a){a=new Ext.ux.tree.TreeGridLoader({dataUrl:this.dataUrl,requestMethod:this.requestMethod,store:this.store})}else{if(Ext.isObject(a)&&!a.load){a=new Ext.ux.tree.TreeGridLoader(a)}}this.loader=a;Ext.ux.tree.TreeGrid.superclass.initComponent.call(this);this.initColumns();if(this.enableSort){this.treeGridSorter=new Ext.ux.tree.TreeGridSorter(this,this.enableSort)}if(this.columnResize){this.colResizer=new Ext.tree.ColumnResizer(this.columnResize);this.colResizer.init(this)}var b=this.columns;if(!this.internalTpl){this.internalTpl=new Ext.XTemplate('<div class=\"x-grid3-header\">','<div class=\"x-treegrid-header-inner\">','<div class=\"x-grid3-header-offset\">','<table style=\"table-layout: fixed;\" cellspacing=\"0\" cellpadding=\"0\" border=\"0\"><colgroup><tpl for=\"columns\"><col /></tpl></colgroup>','<thead><tr class=\"x-grid3-hd-row\">','<tpl for=\"columns\">','<td class=\"x-grid3-hd x-grid3-cell x-treegrid-hd\" style=\"text-align: {align};\" id=\"',this.id,'-xlhd-{#}\">','<div class=\"x-grid3-hd-inner x-treegrid-hd-inner\" unselectable=\"on\">',this.enableHdMenu?'<a class=\"x-grid3-hd-btn\" href=\"#\"></a>':\"\",'{header}<img class=\"x-grid3-sort-icon\" src=\"',Ext.BLANK_IMAGE_URL,'\" />',\"</div>\",\"</td></tpl>\",\"</tr></thead>\",\"</table>\",\"</div></div>\",\"</div>\",'<div class=\"x-treegrid-root-node\">','<table class=\"x-treegrid-root-table\" cellpadding=\"0\" cellspacing=\"0\" style=\"table-layout: fixed;\"></table>',\"</div>\")}if(!this.colgroupTpl){this.colgroupTpl=new Ext.XTemplate('<colgroup><tpl for=\"columns\"><col style=\"width: {width}px\"/></tpl></colgroup>')}},initColumns:function(){var e=this.columns,a=e.length,d=[],b,f;for(b=0;b<a;b++){f=e[b];if(!f.isColumn){f.xtype=f.xtype?(/^tg/.test(f.xtype)?f.xtype:\"tg\"+f.xtype):\"tgcolumn\";f=Ext.create(f)}f.init(this);d.push(f);if(this.enableSort!==false&&f.sortable!==false){f.sortable=true;this.enableSort=true}}this.columns=d},onRender:function(){Ext.tree.TreePanel.superclass.onRender.apply(this,arguments);this.el.addClass(\"x-treegrid\");this.outerCt=this.body.createChild({cls:\"x-tree-root-ct x-treegrid-ct \"+(this.useArrows?\"x-tree-arrows\":this.lines?\"x-tree-lines\":\"x-tree-no-lines\")});this.internalTpl.overwrite(this.outerCt,{columns:this.columns});this.mainHd=Ext.get(this.outerCt.dom.firstChild);this.innerHd=Ext.get(this.mainHd.dom.firstChild);this.innerBody=Ext.get(this.outerCt.dom.lastChild);this.innerCt=Ext.get(this.innerBody.dom.firstChild);this.colgroupTpl.insertFirst(this.innerCt,{columns:this.columns});if(this.hideHeaders){this.el.child(\".x-grid3-header\").setDisplayed(\"none\")}else{if(this.enableHdMenu!==false){this.hmenu=new Ext.menu.Menu({id:this.id+\"-hctx\"});if(this.enableColumnHide!==false){this.colMenu=new Ext.menu.Menu({id:this.id+\"-hcols-menu\"});this.colMenu.on({scope:this,beforeshow:this.beforeColMenuShow,itemclick:this.handleHdMenuClick});this.hmenu.add({itemId:\"columns\",hideOnClick:false,text:this.columnsText,menu:this.colMenu,iconCls:\"x-cols-icon\"})}this.hmenu.on(\"itemclick\",this.handleHdMenuClick,this)}}},setRootNode:function(a){a.attributes.uiProvider=Ext.ux.tree.TreeGridRootNodeUI;a=Ext.ux.tree.TreeGrid.superclass.setRootNode.call(this,a);if(this.innerCt){this.colgroupTpl.insertFirst(this.innerCt,{columns:this.columns})}return a},clearInnerCt:function(){if(Ext.isIE){var a=this.innerCt.dom;while(a.firstChild){a.removeChild(a.firstChild)}}else{Ext.ux.tree.TreeGrid.superclass.clearInnerCt.call(this)}},initEvents:function(){Ext.ux.tree.TreeGrid.superclass.initEvents.apply(this,arguments);this.mon(this.innerBody,\"scroll\",this.syncScroll,this);this.mon(this.innerHd,\"click\",this.handleHdDown,this);this.mon(this.mainHd,{scope:this,mouseover:this.handleHdOver,mouseout:this.handleHdOut})},onResize:function(b,c){Ext.ux.tree.TreeGrid.superclass.onResize.apply(this,arguments);var e=this.innerBody.dom;var f=this.innerHd.dom;if(!e){return}if(Ext.isNumber(c)){e.style.height=this.body.getHeight(true)-f.offsetHeight+\"px\"}if(Ext.isNumber(b)){var a=Ext.num(this.scrollOffset,Ext.getScrollBarWidth());if(this.reserveScrollOffset||((e.offsetWidth-e.clientWidth)>10)){this.setScrollOffset(a)}else{var d=this;setTimeout(function(){d.setScrollOffset(e.offsetWidth-e.clientWidth>10?a:0)},10)}}},updateColumnWidths:function(){var k=this.columns,m=k.length,a=this.outerCt.query(\"colgroup\"),l=a.length,h,e,d,b;for(d=0;d<m;d++){h=k[d];for(b=0;b<l;b++){e=a[b];e.childNodes[d].style.width=(h.hidden?0:h.width)+\"px\"}}for(d=0,a=this.innerHd.query(\"td\"),len=a.length;d<len;d++){h=Ext.fly(a[d]);if(k[d]&&k[d].hidden){h.addClass(\"x-treegrid-hd-hidden\")}else{h.removeClass(\"x-treegrid-hd-hidden\")}}var f=this.getTotalColumnWidth();Ext.fly(this.innerHd.dom.firstChild).setWidth(f+(this.scrollOffset||0));this.outerCt.select(\"table\").setWidth(f);this.syncHeaderScroll()},getVisibleColumns:function(){var c=[],d=this.columns,a=d.length,b;for(b=0;b<a;b++){if(!d[b].hidden){c.push(d[b])}}return c},getTotalColumnWidth:function(){var d=0;for(var b=0,c=this.getVisibleColumns(),a=c.length;b<a;b++){d+=c[b].width}return d},setScrollOffset:function(a){this.scrollOffset=a;this.updateColumnWidths()},handleHdDown:function(j,f){var h=j.getTarget(\".x-treegrid-hd\");if(h&&Ext.fly(f).hasClass(\"x-grid3-hd-btn\")){var b=this.hmenu.items,g=this.columns,a=this.findHeaderIndex(h),k=g[a],d=k.sortable;j.stopEvent();Ext.fly(h).addClass(\"x-grid3-hd-menu-open\");this.hdCtxIndex=a;this.fireEvent(\"headerbuttonclick\",b,k,h,a);this.hmenu.on(\"hide\",function(){Ext.fly(h).removeClass(\"x-grid3-hd-menu-open\")},this,{single:true});this.hmenu.show(f,\"tl-bl?\")}else{if(h){var a=this.findHeaderIndex(h);this.fireEvent(\"headerclick\",this.columns[a],h,a)}}},handleHdOver:function(d,a){var c=d.getTarget(\".x-treegrid-hd\");if(c&&!this.headersDisabled){index=this.findHeaderIndex(c);this.activeHdRef=a;this.activeHdIndex=index;var b=Ext.get(c);this.activeHdRegion=b.getRegion();b.addClass(\"x-grid3-hd-over\");this.activeHdBtn=b.child(\".x-grid3-hd-btn\");if(this.activeHdBtn){this.activeHdBtn.dom.style.height=(c.firstChild.offsetHeight-1)+\"px\"}}},handleHdOut:function(c,a){var b=c.getTarget(\".x-treegrid-hd\");if(b&&(!Ext.isIE||!c.within(b,true))){this.activeHdRef=null;Ext.fly(b).removeClass(\"x-grid3-hd-over\");b.style.cursor=\"\"}},findHeaderIndex:function(d){d=d.dom||d;var b=d.parentNode.childNodes;for(var a=0,e;e=b[a];a++){if(e==d){return a}}return -1},beforeColMenuShow:function(){var d=this.columns,b=d.length,a,e;this.colMenu.removeAll();for(a=1;a<b;a++){e=d[a];if(e.hideable!==false){this.colMenu.add(new Ext.menu.CheckItem({itemId:\"col-\"+a,text:e.header,checked:!e.hidden,hideOnClick:false,disabled:e.hideable===false}))}}},handleHdMenuClick:function(b){var a=this.hdCtxIndex,c=b.getItemId();if(this.fireEvent(\"headermenuclick\",this.columns[a],c,a)!==false){a=c.substr(4);if(a>0&&this.columns[a]){this.setColumnVisible(a,!b.checked)}}return true},setColumnVisible:function(a,b){this.columns[a].hidden=!b;this.updateColumnWidths()},scrollToTop:function(){this.innerBody.dom.scrollTop=0;this.innerBody.dom.scrollLeft=0},syncScroll:function(){this.syncHeaderScroll();var a=this.innerBody.dom;this.fireEvent(\"bodyscroll\",a.scrollLeft,a.scrollTop)},syncHeaderScroll:function(){var a=this.innerBody.dom;this.innerHd.dom.scrollLeft=a.scrollLeft;this.innerHd.dom.scrollLeft=a.scrollLeft},registerNode:function(a){Ext.ux.tree.TreeGrid.superclass.registerNode.call(this,a);if(!a.uiProvider&&!a.isRoot&&!a.ui.isTreeGridNodeUI){a.ui=new Ext.ux.tree.TreeGridNodeUI(a)}}});Ext.reg(\"treegrid\",Ext.ux.tree.TreeGrid);"
  },
  {
    "path": "client/src/index.html",
    "content": "<!DOCTYPE html>\n<html lang=\"en\">\n\t<head>\n\t\t<meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge,chrome=1\">\n\t\t<title>STIG Manager</title>\n\t\t<link rel=\"stylesheet\" type=\"text/css\" href=\"css/init.css\" />\n\t\t<link rel=\"icon\" type=\"image/svg+xml\" href=\"img/shield-green-check.svg\">\n\t\t<script type=\"text/javascript\" src=\"js/Env.js\"></script>\n\t\t<script type=\"importmap\">{\"imports\": {\"@kurkle/color\": \"./js/modules/node_modules/@kurkle/color/dist/color.esm.js\"}}</script>\n\t\t<script type=\"module\" src=\"js/init.js\"></script>\n\t</head>\n\t<body>\n\t\t<div id=\"loading-mask\">\n\t\t\t<div id=\"loading\">\n\t\t\t\t<div id=\"indicator\" class=\"loading-indicator\">\n\t\t\t\t\t<img src=\"img/shield-green-check.svg\" alt=\"Green shield with check\" width=\"48px\" height=\"48px\" style=\"position: relative;bottom: -7px;left: 0px;\">\n\t\t\t\t\t<span id=\"loading-header\">STIG Manager</span>\n\t\t\t\t\t<div id=\"loading-text\"></div>\n\t\t\t\t</div>\n\t\t\t</div>\n\t\t</div>\n\t</body>\n</html>\n"
  },
  {
    "path": "client/src/js/BufferView.js",
    "content": "/*!\n * Based on original code from: Ext JS Library 3.4.0\n * Copyright(c) 2006-2011 Sencha Inc.\n * \n * Modified for STIG Manager OSS\n * Caches pre-rendered rows in a document-fragment for quick assignment to the DOM\n */\nExt.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.BufferView\n * @extends Ext.grid.GridView\n * A custom GridView which renders rows on an as-needed basis.\n */\nExt.ux.grid.BufferView = Ext.extend(Ext.grid.GridView, {\n\t/**\n\t * @cfg {Number} rowHeight\n\t * The height of a row in the grid.\n\t */\n\trowHeight: 21,\n\n\t/**\n\t * @cfg {Number} borderHeight\n\t * The combined height of border-top and border-bottom of a row.\n\t */\n\tborderHeight: 2,\n\n\t/**\n\t * @cfg {Boolean/Number} scrollDelay\n\t * The number of milliseconds before rendering rows out of the visible\n\t * viewing area. Defaults to 100. Rows will render immediately with a config\n\t * of false.\n\t */\n\tscrollDelay: false,\n\n\t/**\n\t * @cfg {Number} cacheSize\n\t * The number of rows to look forward and backwards from the currently viewable\n\t * area.  The cache applies only to rows that have been rendered already.\n\t */\n\tcacheSize: 0,\n\n\t/**\n\t * @cfg {Number} cleanDelay\n\t * The number of milliseconds to buffer cleaning of extra rows not in the\n\t * cache.\n\t */\n\tcleanDelay: 500,\n\n\tlineClamp: 1,\n\n\tinitTemplates: function () {\n\t\tExt.ux.grid.BufferView.superclass.initTemplates.call(this);\n\t\tvar ts = this.templates;\n\t\t// empty div to act as a place holder for a row\n\t\tts.rowHolder = new Ext.Template(\n\t\t\t'<div class=\"x-grid3-row {alt}\" style=\"{tstyle}\"></div>'\n\t\t);\n\t\tts.rowHolder.disableFormats = true;\n\t\tts.rowHolder.compile();\n\n\t\tconst rowBodyText = [\n\t\t\t'<tr class=\"x-grid3-row-body-tr\" style=\"{bodyStyle}\">',\n\t\t\t'<td colspan=\"{cols}\" class=\"x-grid3-body-cell\" tabIndex=\"0\" hidefocus=\"on\">',\n\t\t\t'<div class=\"x-grid3-row-body\">{body}</div>',\n\t\t\t'</td></tr>'\n\t\t].join(\"\")\n\n\t\tconst innerText = [\n\t\t\t'<table class=\"x-grid3-row-table',\n\t\t\t'<tpl if=\"lineClamp &gt; 1\"> sm-line-clamp-wrap</tpl>',\n\t\t\t'\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\" style=\"{tstyle}\">',\n\t\t\t'<tbody><tr>{cells}</tr>',\n\t\t\t(this.enableRowBody ? rowBodyText : ''),\n\t\t\t'</tbody></table>'\n\t\t].join(\"\")\n\n\t\tts.row = new Ext.XTemplate('<div class=\"x-grid3-row {alt}\" style=\"{tstyle}\">' + innerText + '</div>')\n\t\tts.row.disableFormats = true;\n\t\tts.row.compile();\n\n\t\tts.rowInner = new Ext.XTemplate(innerText)\n\t\tts.rowInner.disableFormats = true;\n\t\tts.rowInner.compile();\n\t},\n\n\tgetStyleRowHeight: function () {\n\t\treturn Ext.isBorderBox ? (this.rowHeight + this.borderHeight) : this.rowHeight;\n\t},\n\n\tgetCalculatedRowHeight: function () {\n\t\treturn this.scroller.dom.scrollHeight === this.scroller.dom.clientHeight ?\n\t\t\tthis.rowHeight + this.borderHeight : this.scroller.dom.scrollHeight / this.ds.getCount();\n\t},\n\n\tgetVisibleRowCount: function () {\n\t\tvar rh = this.getCalculatedRowHeight(),\n\t\t\tvisibleHeight = this.scroller.dom.clientHeight;\n\t\treturn (visibleHeight < 1) ? 0 : Math.ceil(visibleHeight / rh);\n\t},\n\n\tgetVisibleRows: function () {\n\t\tvar count = this.getVisibleRowCount(),\n\t\t\tsc = this.scroller.dom.scrollTop,\n\t\t\tstart = (sc === 0 ? 0 : Math.floor(sc / this.getCalculatedRowHeight()) - 1);\n\t\treturn {\n\t\t\tfirst: Math.max(start, 0),\n\t\t\tlast: Math.min(start + count + 2, this.ds.getCount() - 1)\n\t\t};\n\t},\n\n\tdoRender: function (cs, rs, ds, startRow, colCount, stripe) {\n\t\tvar ts = this.templates,\n\t\t\tct = ts.cell,\n\t\t\trt = ts.row,\n\t\t\tri = ts.rowInner,\n\t\t\tlast = colCount - 1,\n\t\t\trh = this.getStyleRowHeight(),\n\t\t\tvr = this.getVisibleRows(),\n\t\t\ttstyle = 'width:' + this.getTotalWidth() + ';height:' + rh + 'px;',\n\t\t\t// buffers\n\t\t\tbuf = [],\n\t\t\tcb,\n\t\t\tc,\n\t\t\tp = {},\n\t\t\trp = { tstyle, lineClamp: this.lineClamp },\n\t\t\tr;\n\t\tconst rowInnerMarkupBuffer = []\n\t\tfor (var j = 0, len = rs.length; j < len; j++) {\n\t\t\tr = rs[j]; cb = [];\n\t\t\tvar rowIndex = (j + startRow),\n\t\t\t\tvisible = rowIndex >= vr.first && rowIndex <= vr.last;\n\n\t\t\tfor (var i = 0; i < colCount; i++) {\n\t\t\t\tc = cs[i];\n\t\t\t\tp.id = c.id;\n\t\t\t\tp.css = i === 0 ? 'x-grid3-cell-first ' : (i == last ? 'x-grid3-cell-last ' : '');\n\t\t\t\tp.attr = p.cellAttr = \"\";\n\t\t\t\tif (this.lineClamp !== 'undefined') {\n\t\t\t\t\tp.attr += ` style=\"-webkit-line-clamp: ${this.lineClamp};\"`\n\t\t\t\t}\n\t\t\t\tp.value = c.renderer.call(c.scope || c, typeof r.data[c.name] === 'string' ? SM.he(r.data[c.name]) : r.data[c.name], p, r, rowIndex, i, ds);\n\t\t\t\tp.style = c.style;\n\t\t\t\tif (p.value === undefined || p.value === \"\") {\n\t\t\t\t\tp.value = \"&#160;\";\n\t\t\t\t}\n\t\t\t\tif (r.dirty && typeof r.modified[c.name] !== 'undefined') {\n\t\t\t\t\tp.css += ' x-grid3-dirty-cell';\n\t\t\t\t}\n\t\t\t\tcb[cb.length] = ct.apply(p);\n\t\t\t}\n\n\t\t\tvar alt = [];\n\t\t\tif (stripe && ((rowIndex + 1) % 2 === 0)) {\n\t\t\t\talt[0] = \"x-grid3-row-alt\";\n\t\t\t}\n\t\t\tif (r.dirty) {\n\t\t\t\talt[1] = \" x-grid3-dirty-row\";\n\t\t\t}\n\t\t\trp.cols = colCount;\n\t\t\tif (this.getRowClass) {\n\t\t\t\talt[2] = this.getRowClass(r, rowIndex, rp, ds);\n\t\t\t}\n\t\t\trp.alt = alt.join(\" \");\n\t\t\trp.cells = cb.join(\"\")\n\t\t\t// save the row inner markup \n\t\t\trowInnerMarkupBuffer[rowIndex] = ri.apply(rp)\n\t\t\t// add either [row div + nothing] or [row div + row inner] to the return buffer\n\t\t\tbuf[buf.length] = !visible ? ts.rowHolder.apply(rp) : rt.apply(rp);\n\t\t}\n\t\t\n\t\t// set the content of a <template> to the row inner markups\n\t\tthis.rowInnerTemplateEl = document.createElement('template')\n\t\tthis.rowInnerTemplateEl.innerHTML = rowInnerMarkupBuffer.join('')\n\t\t\n\t\treturn buf.join(\"\");\n\t},\n\t\n\trefreshRow: function (record) {\n\t\tvar store = this.ds,\n\t\t\tcolCount = this.cm.getColumnCount(),\n\t\t\tcolumns = this.getColumnData(),\n\t\t\tlast = colCount - 1,\n\t\t\tcls = ['x-grid3-row'],\n\t\t\trh = this.getStyleRowHeight(),\n\t\t\tvr = this.getVisibleRows(),\n\t\t\trowParams = {\n\t\t\t\ttstyle: 'width:' + this.getTotalWidth() + ';height:' + rh + 'px;',\n\t\t\t\tlineClamp: this.lineClamp\n\t\t\t},\n\t\t\tcolBuffer = [],\n\t\t\tcellTpl = this.templates.cell,\n\t\t\trowIndex, row, column, meta, css, i;\n\n\t\tif (Ext.isNumber(record)) {\n\t\t\trowIndex = record;\n\t\t\trecord = store.getAt(rowIndex);\n\t\t} else {\n\t\t\trowIndex = store.indexOf(record);\n\t\t}\n\n\t\tconst visible = rowIndex >= vr.first && rowIndex <= vr.last\n\n\t\t//the record could not be found\n\t\tif (!visible || !record || rowIndex < 0) {\n\t\t\treturn;\n\t\t}\n\n\t\t//builds each column in this row\n\t\tfor (i = 0; i < colCount; i++) {\n\t\t\tcolumn = columns[i];\n\n\t\t\tif (i == 0) {\n\t\t\t\tcss = 'x-grid3-cell-first';\n\t\t\t} else {\n\t\t\t\tcss = (i == last) ? 'x-grid3-cell-last ' : '';\n\t\t\t}\n\n\t\t\tmeta = {\n\t\t\t\tid: column.id,\n\t\t\t\tstyle: column.style,\n\t\t\t\tcss: css,\n\t\t\t\tattr: `style=\"-webkit-line-clamp: ${this.lineClamp};\"`,\n\t\t\t\tcellAttr: \"\"\n\t\t\t};\n\t\t\t// Need to set this after, because we pass meta to the renderer\n\t\t\tmeta.value = column.renderer.call(column.scope, typeof record.data[column.name] === 'string' ? SM.he(record.data[column.name]) : record.data[column.name], meta, record, rowIndex, i, store);\n\n\t\t\tif (Ext.isEmpty(meta.value)) {\n\t\t\t\tmeta.value = '&#160;';\n\t\t\t}\n\n\t\t\tif (this.markDirty && record.dirty && typeof record.modified[column.name] != 'undefined') {\n\t\t\t\tmeta.css += ' x-grid3-dirty-cell';\n\t\t\t}\n\n\t\t\tcolBuffer[i] = cellTpl.apply(meta);\n\t\t}\n\n\t\trow = this.getRow(rowIndex);\n\t\trow.className = '';\n\n\t\tif (this.grid.stripeRows && ((rowIndex + 1) % 2 === 0)) {\n\t\t\tcls.push('x-grid3-row-alt');\n\t\t}\n\n\t\tif (this.getRowClass) {\n\t\t\trowParams.cols = colCount;\n\t\t\tcls.push(this.getRowClass(record, rowIndex, rowParams, store));\n\t\t}\n\n\t\tthis.fly(row).addClass(cls).setStyle(rowParams.tstyle);\n\t\trowParams.cells = colBuffer.join(\"\");\n\t\trow.innerHTML = this.templates.rowInner.apply(rowParams);\n\t\tthis.rowInnerTemplateEl.content.children[rowIndex].innerHTML = row.innerHTML\n\n\t\tthis.fireEvent('rowupdated', this, rowIndex, record);\n\t},\n\n\tisRowRendered: function (index) {\n\t\tvar row = this.getRow(index);\n\t\treturn row && row.childNodes.length > 0;\n\t},\n\n\tsyncScroll: function () {\n\t\tExt.ux.grid.BufferView.superclass.syncScroll.apply(this, arguments);\n\t\tthis.update();\n\t},\n\n\tupdate: function () {\n\t\tif (this.scrollDelay) {\n\t\t\tif (!this.renderTask) {\n\t\t\t\tthis.renderTask = new Ext.util.DelayedTask(this.doUpdate, this);\n\t\t\t}\n\t\t\tthis.renderTask.delay(this.scrollDelay);\n\t\t} else {\n\t\t\tthis.doUpdate();\n\t\t}\n\t},\n\n\tonRemove: function (ds, record, index, isUpdate) {\n\t\tExt.ux.grid.BufferView.superclass.onRemove.apply(this, arguments);\n\t\tif (isUpdate !== true) {\n\t\t\tthis.update();\n\t\t}\n\t},\n\n\tdoUpdate: function () {\n\t\tif (this.getVisibleRowCount() > 0) {\n\t\t\tlet vr = this.getVisibleRows(), row;\n\t\t\tfor (var i = vr.first; i <= vr.last; i++) {\n\t\t\t\t// if row is NOT rendered and is visible, render it\n\t\t\t\tif (!this.isRowRendered(i) && (row = this.getRow(i))) {\n\t\t\t\t\trow.innerHTML = this.rowInnerTemplateEl.content.children[i].outerHTML;\n\t\t\t\t}\n\t\t\t}\n\t\t\tthis.clean();\n\t\t}\n\t},\n\n\tupdateAllColumnWidths: function () {\n\t\tvar totalWidth = this.getTotalWidth(),\n\t\t\tcolCount = this.cm.getColumnCount(),\n\t\t\trows = this.getRows(),\n\t\t\trowCount = rows.length,\n\t\t\twidths = [],\n\t\t\trow, rowFirstChild, trow, i, j;\n\n\t\tconst rowInnerCache = this.rowInnerTemplateEl?.content?.children\n\n\t\tfor (i = 0; i < colCount; i++) {\n\t\t\twidths[i] = this.getColumnWidth(i);\n\t\t\tthis.getHeaderCell(i).style.width = widths[i];\n\t\t}\n\n\t\tthis.updateHeaderWidth();\n\n\t\tfor (i = 0; i < rowCount; i++) {\n\t\t\trow = rows[i];\n\t\t\trow.style.width = totalWidth;\n\t\t\trowFirstChild = row.firstChild;\n\n\t\t\tif (rowFirstChild) {\n\t\t\t\trowFirstChild.style.width = totalWidth;\n\t\t\t\ttrow = rowFirstChild.rows[0];\n\n\t\t\t\tfor (j = 0; j < colCount; j++) {\n\t\t\t\t\ttrow.childNodes[j].style.width = widths[j];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// BufferView extends to update the cache's <template> element\n\t\t\tlet rowInnerCached = rowInnerCache?.[i]\n\t\t\tif (rowInnerCached) {\n\t\t\t\trowInnerCached.style.width = totalWidth\n\t\t\t\ttrow = rowInnerCached.rows[0];\n\t\t\t\tfor (j = 0; j < colCount; j++) {\n\t\t\t\t\ttrow.childNodes[j].style.width = widths[j];\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tthis.onAllColumnWidthsUpdated(widths, totalWidth);\n\t},\n\n\tupdateColumnWidth: function (column, width) {\n\t\tvar columnWidth = this.getColumnWidth(column),\n\t\t\ttotalWidth = this.getTotalWidth(),\n\t\t\theaderCell = this.getHeaderCell(column),\n\t\t\tnodes = this.getRows(),\n\t\t\tnodeCount = nodes.length,\n\t\t\trow, i, firstChild;\n\t\t\n\t\tconst rowInnerCache = this.rowInnerTemplateEl?.content?.children\n\n\t\tthis.updateHeaderWidth();\n\t\theaderCell.style.width = columnWidth;\n\n\t\tfor (i = 0; i < nodeCount; i++) {\n\t\t\trow = nodes[i];\n\t\t\tfirstChild = row.firstChild;\n\n\t\t\trow.style.width = totalWidth;\n\t\t\tif (firstChild) {\n\t\t\t\tfirstChild.style.width = totalWidth;\n\t\t\t\tfirstChild.rows[0].childNodes[column].style.width = columnWidth;\n\t\t\t}\n\n\t\t\t// BufferView extends to update the cache's <template> element\n\t\t\tlet rowInnerCached = rowInnerCache?.[i]\n\t\t\tif (rowInnerCached) {\n\t\t\t\trowInnerCached.style.width = totalWidth\n\t\t\t\trowInnerCached.rows[0].childNodes[column].style.width = columnWidth\n\t\t\t}\n\t\t}\n\n\t\tthis.onColumnWidthUpdated(column, columnWidth, totalWidth);\n\t},\n\n\tupdateColumnHidden: function (col, hidden) {\n\t\tvar totalWidth = this.getTotalWidth(),\n\t\t\tdisplay = hidden ? 'none' : '',\n\t\t\theaderCell = this.getHeaderCell(col),\n\t\t\tnodes = this.getRows(),\n\t\t\tnodeCount = nodes.length,\n\t\t\trow, rowFirstChild, i;\n\n\t\tconst rowInnerCache = this.rowInnerTemplateEl?.content?.children\n\n\t\tthis.updateHeaderWidth();\n\t\theaderCell.style.display = display;\n\n\t\tfor (i = 0; i < nodeCount; i++) {\n\t\t\trow = nodes[i];\n\t\t\trow.style.width = totalWidth;\n\t\t\trowFirstChild = row.firstChild;\n\n\t\t\tif (rowFirstChild) {\n\t\t\t\trowFirstChild.style.width = totalWidth;\n\t\t\t\trowFirstChild.rows[0].childNodes[col].style.display = display;\n\t\t\t}\n\n\t\t\t// BufferView extends to update the cache's <template> element\n\t\t\tlet rowInnerCached = rowInnerCache?.[i]\n\t\t\tif (rowInnerCached) {\n\t\t\t\trowInnerCached.style.width = totalWidth\n\t\t\t\trowInnerCached.rows[0].childNodes[col].style.display = display\n\t\t\t}\n\t\t}\n\n\t\tthis.onColumnHiddenUpdated(col, hidden, totalWidth);\n\t\tdelete this.lastViewWidth; //recalc\n\t\tthis.layout();\n\t},\n\n\tclean: function () {\n\t\tif (!this.cleanTask) {\n\t\t\tthis.cleanTask = new Ext.util.DelayedTask(this.doClean, this);\n\t\t}\n\t\tthis.cleanTask.delay(this.cleanDelay);\n\t},\n\n\tdoClean: function () {\n\t\tif (this.getVisibleRowCount() > 0) {\n\t\t\tvar vr = this.getVisibleRows();\n\t\t\tvr.first -= this.cacheSize;\n\t\t\tvr.last += this.cacheSize;\n\n\t\t\tvar i = 0, rows = this.getRows();\n\t\t\t// if first is less than 0, all rows have been rendered\n\t\t\t// so lets clean the end...\n\t\t\tif (vr.first <= 0) {\n\t\t\t\ti = vr.last + 1;\n\t\t\t}\n\t\t\tfor (var len = this.ds.getCount(); i < len; i++) {\n\t\t\t\t// if current row is outside of first and last and\n\t\t\t\t// has content, update the innerHTML to nothing\n\t\t\t\tif ((i < vr.first || i > vr.last) && rows[i].innerHTML) {\n\t\t\t\t\trows[i].innerHTML = '';\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t},\n\n\tremoveTask: function (name) {\n\t\tvar task = this[name];\n\t\tif (task && task.cancel) {\n\t\t\ttask.cancel();\n\t\t\tthis[name] = null;\n\t\t}\n\t},\n\n\tdestroy: function () {\n\t\tthis.removeTask('cleanTask');\n\t\tthis.removeTask('renderTask');\n\t\tExt.ux.grid.BufferView.superclass.destroy.call(this);\n\t},\n\n\tlayout: function () {\n\t\tExt.ux.grid.BufferView.superclass.layout.call(this);\n\t\tthis.update();\n\t},\n\n\tisBufferView: true,\n\n\tdoUpdateRowHeight: function () {\n\t\tlet\tcolCount = this.cm.getColumnCount(),\n\t\t\trows = this.getRows(),\n\t\t\trowCount = rows.length,\n\t\t\trh = `${this.getStyleRowHeight()}px`,\n\t\t\trow, rowFirstChild, trow, i, j;\n\n\t\tconst rowInnerCache = this.rowInnerTemplateEl?.content?.children\n\n\t\tfor (i = 0; i < rowCount; i++) {\n\t\t\trow = rows[i]\n\t\t\trow.style.height = rh\n\t\t\trowFirstChild = row.firstChild\n\n\t\t\tif (rowFirstChild) {\n\t\t\t\trowFirstChild.style.height = rh\n\t\t\t\ttrow = rowFirstChild.rows[0]\n\t\t\t\tfor (j = 0; j < colCount; j++) {\n\t\t\t\t\ttrow.childNodes[j].childNodes[0].style['-webkit-line-clamp'] = this.lineClamp\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// BufferView extends to update the cache's <template> element\n\t\t\tlet rowInnerCached = rowInnerCache?.[i]\n\t\t\tif (rowInnerCached) {\n\t\t\t\trowInnerCached.style.height = rh\n\t\t\t\ttrow = rowInnerCached.rows[0]\n\t\t\t\tfor (j = 0; j < colCount; j++) {\n\t\t\t\t\ttrow.childNodes[j].childNodes[0].style['-webkit-line-clamp'] = this.lineClamp\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t},\n\n\tchangeRowHeight: function (rowHeight, lineClamp) {\n\t\tthis.rowHeight = rowHeight\n\t\tthis.lineClamp = lineClamp ? lineClamp : this.lineClamp\t\t\n\t\tconst scrollTopPct = this.scroller.dom.scrollTop / this.scroller.dom.scrollHeight\n\t\tthis.doUpdateRowHeight()\n\t\tthis.doUpdate()\n\t\tthis.scroller.dom.scrollTop = this.scroller.dom.scrollHeight * scrollTopPct\n\t}\n});"
  },
  {
    "path": "client/src/js/ColumnHeaderGroup.js",
    "content": "/*!\n * Ext JS Library 3.4.0\n * Copyright(c) 2006-2011 Sencha Inc.\n * licensing@sencha.com\n * http://www.sencha.com/license\n */\nExt.ns('Ext.ux.grid');\n\nExt.ux.grid.ColumnHeaderGroup = Ext.extend(Ext.util.Observable, {\n\n    constructor: function(config){\n        this.config = config;\n    },\n\n    init: function(grid){\n        Ext.applyIf(grid.colModel, this.config);\n        Ext.apply(grid.getView(), this.viewConfig);\n    },\n\n    viewConfig: {\n        initTemplates: function(){\n            this.constructor.prototype.initTemplates.apply(this, arguments);\n            var ts = this.templates || {};\n            if(!ts.gcell){\n                ts.gcell = new Ext.XTemplate('<td class=\"x-grid3-hd x-grid3-gcell x-grid3-td-{id} ux-grid-hd-group-row-{row} {cls}\" style=\"{style}\">', '<div {tooltip} class=\"x-grid3-hd-inner x-grid3-hd-{id}\" unselectable=\"on\" style=\"{istyle}\">', this.grid.enableHdMenu ? '<a class=\"x-grid3-hd-btn\" href=\"#\"></a>' : '', '{value}</div></td>');\n            }\n            this.templates = ts;\n            this.hrowRe = new RegExp(\"ux-grid-hd-group-row-(\\\\d+)\", \"\");\n        },\n\n        renderHeaders: function(){\n            var ts = this.templates, headers = [], cm = this.cm, rows = cm.rows, tstyle = 'width:' + this.getTotalWidth() + ';';\n\n            for(var row = 0, rlen = rows.length; row < rlen; row++){\n                var r = rows[row], cells = [];\n                for(var i = 0, gcol = 0, len = r.length; i < len; i++){\n                    var group = r[i];\n                    group.colspan = group.colspan || 1;\n                    var id = this.getColumnId(group.dataIndex ? cm.findColumnIndex(group.dataIndex) : gcol), gs = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupStyle.call(this, group, gcol);\n                    cells[i] = ts.gcell.apply({\n                        cls: 'ux-grid-hd-group-cell',\n                        id: id,\n                        row: row,\n                        style: 'width:' + gs.width + ';' + (gs.hidden ? 'display:none;' : '') + (group.align ? 'text-align:' + group.align + ';' : ''),\n                        tooltip: group.tooltip ? (Ext.QuickTips.isEnabled() ? 'ext:qtip' : 'title') + '=\"' + group.tooltip + '\"' : '',\n                        istyle: group.align == 'right' ? 'padding-right:16px' : '',\n                        btn: this.grid.enableHdMenu && group.header,\n                        value: group.header || '&nbsp;'\n                    });\n                    gcol += group.colspan;\n                }\n                headers[row] = ts.header.apply({\n                    tstyle: tstyle,\n                    cells: cells.join('')\n                });\n            }\n            headers.push(this.constructor.prototype.renderHeaders.apply(this, arguments));\n            return headers.join('');\n        },\n\n        onColumnWidthUpdated: function(){\n            this.constructor.prototype.onColumnWidthUpdated.apply(this, arguments);\n            Ext.ux.grid.ColumnHeaderGroup.prototype.updateGroupStyles.call(this);\n        },\n\n        onAllColumnWidthsUpdated: function(){\n            this.constructor.prototype.onAllColumnWidthsUpdated.apply(this, arguments);\n            Ext.ux.grid.ColumnHeaderGroup.prototype.updateGroupStyles.call(this);\n        },\n\n        onColumnHiddenUpdated: function(){\n            this.constructor.prototype.onColumnHiddenUpdated.apply(this, arguments);\n            Ext.ux.grid.ColumnHeaderGroup.prototype.updateGroupStyles.call(this);\n        },\n\n        getHeaderCell: function(index){\n            return this.mainHd.query(this.cellSelector)[index];\n        },\n\n        findHeaderCell: function(el){\n            return el ? this.fly(el).findParent('td.x-grid3-hd', this.cellSelectorDepth) : false;\n        },\n\n        findHeaderIndex: function(el){\n            var cell = this.findHeaderCell(el);\n            return cell ? this.getCellIndex(cell) : false;\n        },\n\n        updateSortIcon: function(col, dir){\n            var sc = this.sortClasses, hds = this.mainHd.select(this.cellSelector).removeClass(sc);\n            hds.item(col).addClass(sc[dir == \"DESC\" ? 1 : 0]);\n        },\n\n        handleHdDown: function(e, t){\n            var el = Ext.get(t);\n            if(el.hasClass('x-grid3-hd-btn')){\n                e.stopEvent();\n                var hd = this.findHeaderCell(t);\n                Ext.fly(hd).addClass('x-grid3-hd-menu-open');\n                var index = this.getCellIndex(hd);\n                this.hdCtxIndex = index;\n                var ms = this.hmenu.items, cm = this.cm;\n                ms.get('asc').setDisabled(!cm.isSortable(index));\n                ms.get('desc').setDisabled(!cm.isSortable(index));\n                this.hmenu.on('hide', function(){\n                    Ext.fly(hd).removeClass('x-grid3-hd-menu-open');\n                }, this, {\n                    single: true\n                });\n                this.hmenu.show(t, 'tl-bl?');\n            }else if(el.hasClass('ux-grid-hd-group-cell') || Ext.fly(t).up('.ux-grid-hd-group-cell')){\n                e.stopEvent();\n            }\n        },\n\n        handleHdMove: function(e, t){\n            var hd = this.findHeaderCell(this.activeHdRef);\n            if(hd && !this.headersDisabled && !Ext.fly(hd).hasClass('ux-grid-hd-group-cell')){\n                var hw = this.splitHandleWidth || 5, r = this.activeHdRegion, x = e.getPageX(), ss = hd.style, cur = '';\n                if(this.grid.enableColumnResize !== false){\n                    if(x - r.left <= hw && this.cm.isResizable(this.activeHdIndex - 1)){\n                        cur = Ext.isAir ? 'move' : Ext.isWebKit ? 'e-resize' : 'col-resize'; // col-resize\n                                                                                                // not\n                                                                                                // always\n                                                                                                // supported\n                    }else if(r.right - x <= (!this.activeHdBtn ? hw : 2) && this.cm.isResizable(this.activeHdIndex)){\n                        cur = Ext.isAir ? 'move' : Ext.isWebKit ? 'w-resize' : 'col-resize';\n                    }\n                }\n                ss.cursor = cur;\n            }\n        },\n\n        handleHdOver: function(e, t){\n            var hd = this.findHeaderCell(t);\n            if(hd && !this.headersDisabled){\n                this.activeHdRef = t;\n                this.activeHdIndex = this.getCellIndex(hd);\n                var fly = this.fly(hd);\n                this.activeHdRegion = fly.getRegion();\n                if(!(this.cm.isMenuDisabled(this.activeHdIndex) || fly.hasClass('ux-grid-hd-group-cell'))){\n                    fly.addClass('x-grid3-hd-over');\n                    this.activeHdBtn = fly.child('.x-grid3-hd-btn');\n                    if(this.activeHdBtn){\n                        this.activeHdBtn.dom.style.height = (hd.firstChild.offsetHeight - 1) + 'px';\n                    }\n                }\n            }\n        },\n\n        handleHdOut: function(e, t){\n            var hd = this.findHeaderCell(t);\n            if(hd && (!Ext.isIE || !e.within(hd, true))){\n                this.activeHdRef = null;\n                this.fly(hd).removeClass('x-grid3-hd-over');\n                hd.style.cursor = '';\n            }\n        },\n\n        handleHdMenuClick: function(item){\n            var index = this.hdCtxIndex, cm = this.cm, ds = this.ds, id = item.getItemId();\n            switch(id){\n                case 'asc':\n                    ds.sort(cm.getDataIndex(index), 'ASC');\n                    break;\n                case 'desc':\n                    ds.sort(cm.getDataIndex(index), 'DESC');\n                    break;\n                default:\n                    if(id.substr(0, 6) == 'group-'){\n                        var i = id.split('-'), row = parseInt(i[1], 10), col = parseInt(i[2], 10), r = this.cm.rows[row], group, gcol = 0;\n                        for(var i = 0, len = r.length; i < len; i++){\n                            group = r[i];\n                            if(col >= gcol && col < gcol + group.colspan){\n                                break;\n                            }\n                            gcol += group.colspan;\n                        }\n                        if(item.checked){\n                            var max = cm.getColumnsBy(this.isHideableColumn, this).length;\n                            for(var i = gcol, len = gcol + group.colspan; i < len; i++){\n                                if(!cm.isHidden(i)){\n                                    max--;\n                                }\n                            }\n                            if(max < 1){\n                                this.onDenyColumnHide();\n                                return false;\n                            }\n                        }\n                        for(var i = gcol, len = gcol + group.colspan; i < len; i++){\n                            if(cm.config[i].fixed !== true && cm.config[i].hideable !== false){\n                                cm.setHidden(i, item.checked);\n                            }\n                        }\n                    }else if(id.substr(0, 4) == 'col-'){\n                        index = cm.getIndexById(id.substr(4));\n                        if(index != -1){\n                            if(item.checked && cm.getColumnsBy(this.isHideableColumn, this).length <= 1){\n                                this.onDenyColumnHide();\n                                return false;\n                            }\n                            cm.setHidden(index, item.checked);\n                        }\n                    }\n                    if(id.substr(0, 6) == 'group-' || id.substr(0, 4) == 'col-'){\n                        item.checked = !item.checked;\n                        if(item.menu){\n                            var updateChildren = function(menu){\n                                menu.items.each(function(childItem){\n                                    if(!childItem.disabled){\n                                        childItem.setChecked(item.checked, false);\n                                        if(childItem.menu){\n                                            updateChildren(childItem.menu);\n                                        }\n                                    }\n                                });\n                            }\n                            updateChildren(item.menu);\n                        }\n                        var parentMenu = item, parentItem;\n                        while(parentMenu = parentMenu.parentMenu){\n                            if(!parentMenu.parentMenu || !(parentItem = parentMenu.parentMenu.items.get(parentMenu.getItemId())) || !parentItem.setChecked){\n                                break;\n                            }\n                            var checked = parentMenu.items.findIndexBy(function(m){\n                                return m.checked;\n                            }) >= 0;\n                            parentItem.setChecked(checked, true);\n                        }\n                        item.checked = !item.checked;\n                    }\n            }\n            return true;\n        },\n\n        beforeColMenuShow: function(){\n            var cm = this.cm, rows = this.cm.rows;\n            this.colMenu.removeAll();\n            for(var col = 0, clen = cm.getColumnCount(); col < clen; col++){\n                var menu = this.colMenu, title = cm.getColumnHeader(col), text = [];\n                if(cm.config[col].fixed !== true && cm.config[col].hideable !== false){\n                    for(var row = 0, rlen = rows.length; row < rlen; row++){\n                        var r = rows[row], group, gcol = 0;\n                        for(var i = 0, len = r.length; i < len; i++){\n                            group = r[i];\n                            if(col >= gcol && col < gcol + group.colspan){\n                                break;\n                            }\n                            gcol += group.colspan;\n                        }\n                        if(group && group.header){\n                            if(cm.hierarchicalColMenu){\n                                var gid = 'group-' + row + '-' + gcol,\n                                    item = menu.items ? menu.getComponent(gid) : null,\n                                    submenu = item ? item.menu : null;\n                                if(!submenu){\n                                    submenu = new Ext.menu.Menu({\n                                        itemId: gid\n                                    });\n                                    submenu.on(\"itemclick\", this.handleHdMenuClick, this);\n                                    var checked = false, disabled = true;\n                                    for(var c = gcol, lc = gcol + group.colspan; c < lc; c++){\n                                        if(!cm.isHidden(c)){\n                                            checked = true;\n                                        }\n                                        if(cm.config[c].hideable !== false){\n                                            disabled = false;\n                                        }\n                                    }\n                                    menu.add({\n                                        itemId: gid,\n                                        text: group.header,\n                                        menu: submenu,\n                                        hideOnClick: false,\n                                        checked: checked,\n                                        disabled: disabled\n                                    });\n                                }\n                                menu = submenu;\n                            }else{\n                                text.push(group.header);\n                            }\n                        }\n                    }\n                    text.push(title);\n                    menu.add(new Ext.menu.CheckItem({\n                        itemId: \"col-\" + cm.getColumnId(col),\n                        text: text.join(' '),\n                        checked: !cm.isHidden(col),\n                        hideOnClick: false,\n                        disabled: cm.config[col].hideable === false\n                    }));\n                }\n            }\n        },\n\n        afterRenderUI: function(){\n            this.constructor.prototype.afterRenderUI.apply(this, arguments);\n            Ext.apply(this.columnDrop, Ext.ux.grid.ColumnHeaderGroup.prototype.columnDropConfig);\n            Ext.apply(this.splitZone, Ext.ux.grid.ColumnHeaderGroup.prototype.splitZoneConfig);\n        }\n    },\n\n    splitZoneConfig: {\n        allowHeaderDrag: function(e){\n            return !e.getTarget(null, null, true).hasClass('ux-grid-hd-group-cell');\n        }\n    },\n\n    columnDropConfig: {\n        getTargetFromEvent: function(e){\n            var t = Ext.lib.Event.getTarget(e);\n            return this.view.findHeaderCell(t);\n        },\n\n        positionIndicator: function(h, n, e){\n            var data = Ext.ux.grid.ColumnHeaderGroup.prototype.getDragDropData.call(this, h, n, e);\n            if(data === false){\n                return false;\n            }\n            var px = data.px + this.proxyOffsets[0];\n            this.proxyTop.setLeftTop(px, data.r.top + this.proxyOffsets[1]);\n            this.proxyTop.show();\n            this.proxyBottom.setLeftTop(px, data.r.bottom);\n            this.proxyBottom.show();\n            return data.pt;\n        },\n\n        onNodeDrop: function(n, dd, e, data){\n            var h = data.header;\n            if(h != n){\n                var d = Ext.ux.grid.ColumnHeaderGroup.prototype.getDragDropData.call(this, h, n, e);\n                if(d === false){\n                    return false;\n                }\n                var cm = this.grid.colModel, right = d.oldIndex < d.newIndex, rows = cm.rows;\n                for(var row = d.row, rlen = rows.length; row < rlen; row++){\n                    var r = rows[row], len = r.length, fromIx = 0, span = 1, toIx = len;\n                    for(var i = 0, gcol = 0; i < len; i++){\n                        var group = r[i];\n                        if(d.oldIndex >= gcol && d.oldIndex < gcol + group.colspan){\n                            fromIx = i;\n                        }\n                        if(d.oldIndex + d.colspan - 1 >= gcol && d.oldIndex + d.colspan - 1 < gcol + group.colspan){\n                            span = i - fromIx + 1;\n                        }\n                        if(d.newIndex >= gcol && d.newIndex < gcol + group.colspan){\n                            toIx = i;\n                        }\n                        gcol += group.colspan;\n                    }\n                    var groups = r.splice(fromIx, span);\n                    rows[row] = r.splice(0, toIx - (right ? span : 0)).concat(groups).concat(r);\n                }\n                for(var c = 0; c < d.colspan; c++){\n                    var oldIx = d.oldIndex + (right ? 0 : c), newIx = d.newIndex + (right ? -1 : c);\n                    cm.moveColumn(oldIx, newIx);\n                    this.grid.fireEvent(\"columnmove\", oldIx, newIx);\n                }\n                return true;\n            }\n            return false;\n        }\n    },\n\n    getGroupStyle: function(group, gcol){\n        var width = 0, hidden = true;\n        for(var i = gcol, len = gcol + group.colspan; i < len; i++){\n            if(!this.cm.isHidden(i)){\n                var cw = this.cm.getColumnWidth(i);\n                if(typeof cw == 'number'){\n                    width += cw;\n                }\n                hidden = false;\n            }\n        }\n        return {\n            width: (Ext.isBorderBox || (Ext.isWebKit && !Ext.isSafari2) ? width : Math.max(width - this.borderWidth, 0)) + 'px',\n            hidden: hidden\n        };\n    },\n\n    updateGroupStyles: function(col){\n        var tables = this.mainHd.query('.x-grid3-header-offset > table'), tw = this.getTotalWidth(), rows = this.cm.rows;\n        for(var row = 0; row < tables.length; row++){\n            tables[row].style.width = tw;\n            if(row < rows.length){\n                var cells = tables[row].firstChild.firstChild.childNodes;\n                for(var i = 0, gcol = 0; i < cells.length; i++){\n                    var group = rows[row][i];\n                    if((typeof col != 'number') || (col >= gcol && col < gcol + group.colspan)){\n                        var gs = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupStyle.call(this, group, gcol);\n                        cells[i].style.width = gs.width;\n                        cells[i].style.display = gs.hidden ? 'none' : '';\n                    }\n                    gcol += group.colspan;\n                }\n            }\n        }\n    },\n\n    getGroupRowIndex: function(el){\n        if(el){\n            var m = el.className.match(this.hrowRe);\n            if(m && m[1]){\n                return parseInt(m[1], 10);\n            }\n        }\n        return this.cm.rows.length;\n    },\n\n    getGroupSpan: function(row, col){\n        if(row < 0){\n            return {\n                col: 0,\n                colspan: this.cm.getColumnCount()\n            };\n        }\n        var r = this.cm.rows[row];\n        if(r){\n            for(var i = 0, gcol = 0, len = r.length; i < len; i++){\n                var group = r[i];\n                if(col >= gcol && col < gcol + group.colspan){\n                    return {\n                        col: gcol,\n                        colspan: group.colspan\n                    };\n                }\n                gcol += group.colspan;\n            }\n            return {\n                col: gcol,\n                colspan: 0\n            };\n        }\n        return {\n            col: col,\n            colspan: 1\n        };\n    },\n\n    getDragDropData: function(h, n, e){\n        if(h.parentNode != n.parentNode){\n            return false;\n        }\n        var cm = this.grid.colModel, x = Ext.lib.Event.getPageX(e), r = Ext.lib.Dom.getRegion(n.firstChild), px, pt;\n        if((r.right - x) <= (r.right - r.left) / 2){\n            px = r.right + this.view.borderWidth;\n            pt = \"after\";\n        }else{\n            px = r.left;\n            pt = \"before\";\n        }\n        var oldIndex = this.view.getCellIndex(h), newIndex = this.view.getCellIndex(n);\n        if(cm.isFixed(newIndex)){\n            return false;\n        }\n        var row = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupRowIndex.call(this.view, h),\n            oldGroup = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupSpan.call(this.view, row, oldIndex),\n            newGroup = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupSpan.call(this.view, row, newIndex),\n            oldIndex = oldGroup.col;\n            newIndex = newGroup.col + (pt == \"after\" ? newGroup.colspan : 0);\n        if(newIndex >= oldGroup.col && newIndex <= oldGroup.col + oldGroup.colspan){\n            return false;\n        }\n        var parentGroup = Ext.ux.grid.ColumnHeaderGroup.prototype.getGroupSpan.call(this.view, row - 1, oldIndex);\n        if(newIndex < parentGroup.col || newIndex > parentGroup.col + parentGroup.colspan){\n            return false;\n        }\n        return {\n            r: r,\n            px: px,\n            pt: pt,\n            row: row,\n            oldIndex: oldIndex,\n            newIndex: newIndex,\n            colspan: oldGroup.colspan\n        };\n    }\n});"
  },
  {
    "path": "client/src/js/Env.js.example",
    "content": "\n// This file is usually served dynamically by the API service, which\n// sets values according the its configuraion. If you are serving the\n// client from a detached distribution (not recommended), you will\n// need to edit this file yourself and rename it to \"Env.js\".\n\nconst STIGMAN = {\n  Env: {\n    version: \"1.1.0\",\n    apiBase: \"/api\",\n    welcome: {\n      image: \"\",\n      title: \"\",\n      message: \"\",\n      link: \"\"\n    },\n    commit: {\n        branch: \"na\",\n        sha: \"na\",\n        tag: \"na\",\n        describe: \"na\"\n    },\n    oauth: {\n        authority:  \"http://localhost:8080/auth/realms/stigman\",\n        clientId: \"stig-manager\",\n        refreshToken: {\n          disabled: false\n        },\n        extraScopes: \"\",\n        scopePrefix: \"\",\n        claims: {\n          scope: \"scope\",\n          username: \"preferred_username\",\n          servicename: \"clientId\",\n          name: \"name\",\n          privileges: \"['realm_access']?.['roles']\",\n          email: \"email\"\n        }\n    }\n  }\n}    \n"
  },
  {
    "path": "client/src/js/ExportButton.js",
    "content": "/**\r\n * $Id: ExportButton.js 807 2017-07-27 13:04:19Z csmig $\r\n *\r\n * @class Ext.ExportButton\r\n * @extends Ext.Button\r\n * A button for downloading local data, which optionally contains a menu.\r\n * Original author: Carl Smigielski\r\n * @constructor\r\n * Creates a new ExportButton\r\n */ \r\nExt.ux.ExportButton = Ext.extend(Ext.Button, {\r\n\tconstructor: function(config) {\r\n\t\t\r\n\t\tif (config.hasMenu == true) {\r\n\t\t\tExt.applyIf(config, {\r\n\t\t\t\tmenu: new Ext.menu.Menu({\r\n\t\t\t\t\titems: [\r\n\t\t\t\t\t{\r\n\t\t\t\t\t\ttext: \"Grid data (.csv)\"\r\n\t\t\t\t\t\t,iconCls: 'sm-table-icon'\r\n\t\t\t\t\t\t,exportType: 'grid'\r\n\t\t\t\t\t\t,exportFormat: 'csv'\r\n\t\t\t\t\t\t,href: \"#\"\r\n\t\t\t\t\t}\r\n\t\t\t\t\t,{\r\n\t\t\t\t\t\ttext: \"Store data (.csv)\"\r\n\t\t\t\t\t\t,iconCls: 'sm-database-icon'\r\n\t\t\t\t\t\t,exportType: 'store'\r\n\t\t\t\t\t\t,exportFormat: 'csv'\r\n\t\t\t\t\t\t,href: \"#\"\r\n\t\t\t\t\t}]\r\n\t\t\t\t}),\r\n\t\t\t});\r\n\t\t}\r\n\t\t\r\n\t\tthis.gridBasename = (config.gridBasename || 'grid_export'),\r\n\t\tthis.gridSource = config.grid || undefined,\r\n\t\tthis.storeBasename = (config.storeBasename || 'store_export'),\r\n\t\tthis.storeSource = config.store || undefined,\r\n\t\tthis.exportType = config.exportType || 'grid';\r\n\t\tthis.exportFormat = config.exportFormat || 'csv';\r\n\r\n\t\tExt.ux.ExportButton.superclass.constructor.call(this, config);\r\n\t\t\r\n\t\tif (this.menu) {\r\n\t\t\tthis.menu.addListener('itemclick',this.menuItemClick,this);\r\n\t\t\tthis.menu.addListener('beforeshow',this.menuBeforeShow,this);\r\n\t\t} else {\r\n\t\t\tthis.addListener('click',this.buttonClick,this);\r\n\t\t}\r\n\t},\r\n\t\r\n    onRender: function(ct, position){\r\n\t\tif (this.gridSource == undefined) {\r\n\t\t\tthis.gridSource = this.findParentByType('grid');\r\n\t\t}\r\n\t\tif (this.storeSource == undefined && this.gridSource != undefined) {\r\n\t\t\tthis.storeSource = this.gridSource.store;\r\n\t\t}\r\n\t\tExt.ux.ExportButton.superclass.onRender.call(this,ct,position);\r\n\t},\r\n\t\r\n\tbuttonClick: function (btn, e) {\r\n\t\tlet csv = \"\\ufeff\"; // UTF-8 BOM\r\n\t\tlet filename = \"\";\r\n\t\tif (btn.exportFormat == 'csv'){\r\n\t\t\tif (btn.exportType == 'grid') {\r\n\t\t\t\tcsv += this.gridToCsv(this.gridSource);\r\n\t\t\t\tfilename = SM.Global.filenameEscaped(`${this.gridBasename}_${SM.Global.filenameComponentFromDate()}.csv`);\r\n\t\t\t} else if (btn.exportType == 'store') {\r\n\t\t\t\tcsv += this.storeToCsv(this.storeSource);\r\n\t\t\t\tfilename = SM.Global.filenameEscaped(`${this.storeBasename}_${SM.Global.filenameComponentFromDate()}.csv`);\r\n\t\t\t}\r\n\t\t}\r\n\t\tlet blob = new Blob([csv],{type:\"text/csv;charset=utf-8\"});\r\n\t\tif (window.navigator.msSaveOrOpenBlob){\r\n\t\t\tnavigator.msSaveOrOpenBlob(blob,filename);\r\n\t\t} else {\r\n\t\t\tlet a = window.document.createElement(\"a\");\r\n\t\t\ta.style.display= \"none\";\r\n\t\t\ta.href = window.URL.createObjectURL(blob);\r\n\t\t\ta.download = filename;\r\n\t\t\tdocument.body.appendChild(a);\r\n\t\t\ta.click();\r\n\t\t\tdocument.body.removeChild(a);\r\n\t\t}\r\n\t},\r\n\t\r\n\tmenuBeforeShow: function (menu) {\r\n\t\tmenu.items.each(function(item) {\r\n\t\t\tswitch (item.exportType) {\r\n\t\t\t\tcase 'grid':\r\n\t\t\t\t\titem.setDisabled(this.gridSource == undefined); \r\n\t\t\t\t\tbreak;\r\n\t\t\t\tcase 'store':\r\n\t\t\t\t\titem.setDisabled(this.storeSource == undefined); \r\n\t\t\t\t\tbreak;\r\n\t\t\t}\r\n\t\t},this);\r\n\t},\r\n\t\r\n\tmenuItemClick: function (item) {\r\n\t\tlet csv = \"\\ufeff\";\r\n\t\tlet filename = \"\";\r\n\t\tif (item.exportFormat == 'csv'){\r\n\t\t\tif (item.exportType == 'grid') {\r\n\t\t\t\tcsv += this.gridToCsv(this.gridSource);\r\n\t\t\t\tfilename = this.gridBasename + '.csv';\r\n\t\t\t} else if (item.exportType == 'store') {\r\n\t\t\t\tcsv += this.storeToCsv(this.storeSource);\r\n\t\t\t\tfilename = this.storeBasename + '.csv';\r\n\t\t\t}\r\n\t\t}\r\n\t\tif (window.navigator.msSaveOrOpenBlob){\r\n\t\t\tlet blob = new Blob([csv],{type:\"text/csv;charset=utf-8\"});\r\n\t\t\tnavigator.msSaveOrOpenBlob(blob,filename);\r\n\t\t} else {\r\n\t\t\titem.el.dom.setAttribute('download',filename);\r\n\t\t\tlet href = encodeURI(\"data:text/csv;charset=utf-8,\" + csv)\r\n\t\t\titem.el.dom.setAttribute('href',href);\r\n\t\t\titem.el.dom.setAttribute('target','_self');\r\n\t\t}\r\n\t},\r\n\t\r\n\tgridToCsv: function (grid) {\r\n\t\tlet csv = \"\";\r\n\t\tlet view = grid.getView();\r\n\t\tlet store = grid.store;\r\n\t\t\r\n\t\t// Get the array of all grid columns\r\n\t\tlet columns = grid.getColumnModel().getColumnsBy(function(c) {return true} );\r\n\t\t\r\n\t\t// headerArray[] will hold data for the CSV header row\r\n\t\tlet headerArray = ['Marking'];\r\n\t\t// ci[] will hold the column indexes for which we will later get row data\r\n\t\tlet ci = [];\r\n\t\tfor (let x=0; x < columns.length; x++){\r\n\t\t\tlet c = columns[x];\r\n\t\t\t// Criteria for inclusion of the column\r\n\t\t\tif (c.dataIndex != \"\" && c.header != \"\" && !c.hidden){\r\n\t\t\t\t// Build an element to hold the column header's HTML\r\n\t\t\t\tlet el = document.createElement('html');\r\n\t\t\t\tel.innerHTML = c.header;\r\n\t\t\t\t// Try to find the first child element with an 'exportvalue' attribute\r\n\t\t\t\tlet ev = el.querySelector('[exportvalue]');\r\n\t\t\t\tif (ev != null) {\r\n\t\t\t\t\t// An element with an 'exportvalue' attribute was found. The CSV column header will be the value of 'exportvalue'\r\n\t\t\t\t\theaderArray.push('\"' + ev.getAttribute('exportvalue') + '\"');\r\n\t\t\t\t} else {\r\n\t\t\t\t\t// No element with an 'exportvalue' attribute was found was found. The CSV column header will be the quoted UI column header\r\n\t\t\t\t\theaderArray.push('\"' + c.header + '\"');\r\n\t\t\t\t}\r\n\t\t\t\t// Add this column index to ci[]\r\n\t\t\t\tci.push(x);\r\n\t\t\t}\r\n\t\t}\r\n\t\t// Comma separate the header data and append to the CSV \r\n\t\tcsv += headerArray.join(',') + \"\\n\";\r\n\t\t\r\n\t\t// Process all the records in the grid's store\r\n\t\tlet recordCount = store.getCount();\r\n\t\tfor (let rowIndex = 0; rowIndex < recordCount; rowIndex++){\r\n\t\t\t// rowArray[] will hold data for a single CSV row\r\n\t\t\tlet rowArray = [`(${STIGMAN.apiConfig?.classification})`];\r\n\r\n\t\t\tif (view.isBufferView) {\r\n\t\t\t\tlet r = store.data.items[rowIndex]\r\n\t\t\t\t// Iterate across the included column indexes \r\n\t\t\t\tfor (let x=0; x < ci.length; x++) {\r\n\t\t\t\t\tconst c = columns[ci[x]]\r\n\t\t\t\t\tconst p = {}\r\n\t\t\t\t\tconst rendered = c.renderer.call(c.scope || c, r.data[c.dataIndex], p, r, rowIndex, x, store)\r\n\t\t\t\t\tconst exportvalue = p.attr?.match(/exportvalue=\"(.*)\"/)?.[1]\r\n\t\t\t\t\tif (exportvalue) {\r\n\t\t\t\t\t\trowArray.push('\"' + exportvalue + '\"');\r\n\t\t\t\t\t}\r\n\t\t\t\t\telse {\r\n\t\t\t\t\t\tconst templateEl = document.createElement('template')\r\n\t\t\t\t\t\ttemplateEl.innerHTML = rendered\r\n\t\t\t\t\t\tconst value = '\"' + templateEl.content.textContent.replace(/\"/g,'\"\"').trim() + '\"'\r\n\t\t\t\t\t\trowArray.push(value)\r\n\t\t\t\t\t}\r\n\t\t\t\t}\t\r\n\t\t\t}\r\n\t\t\telse {\r\n\t\t\t\t// rowCells[] is an array of <td> children of the first <tr> element of a row\r\n\t\t\t\tlet rowCells = view.getRow(rowIndex).getElementsByTagName('tr')[0].cells;\r\n\t\t\t\t// Iterate across the included column indexes \r\n\t\t\t\tfor (let x=0; x < ci.length; x++){\r\n\t\t\t\t\t// Try to find the first child element with an 'exportvalue' attribute\r\n\t\t\t\t\tlet ev = rowCells[ci[x]].querySelector('[exportvalue]');\r\n\t\t\t\t\tif (ev != null) {\r\n\t\t\t\t\t\t// An element with an 'exportvalue' attribute was found was found. The CSV data will be the value of 'exportvalue'\r\n\t\t\t\t\t\trowArray.push('\"' + ev.getAttribute('exportvalue') + '\"');\r\n\t\t\t\t\t} else {\r\n\t\t\t\t\t\t// No element with an 'exportvalue' attribute was found was found. The CSV data will be the quoted and escaped textContent of the <td>'s firstChild\r\n\t\t\t\t\t\tlet value = '\"' + rowCells[ci[x]].firstChild.textContent.replace(/\"/g,'\"\"').trim() + '\"';\r\n\t\t\t\t\t\trowArray.push(value);\r\n\t\t\t\t\t}\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t\t\t// Comma separate the row data and append to the CSV \r\n\t\t\tcsv += rowArray.join(',') + \"\\n\";\r\n\t\t}\r\n\t\t\r\n\t\treturn csv;\t\r\n\t},\r\n\r\n\tstoreToCsv: function (store) {\r\n\t\tlet csv = \"\";\r\n\t\t\r\n\t\t// headerArray[] will hold data for the CSV header row\r\n\t\tlet headerArray = [];\r\n\t\t// fieldArray[] will hold data for later traversal of the Ext.data.Records\r\n\t\tlet fieldArray = [];\r\n\t\tstore.fields.each(function(item){\r\n\t\t\theaderArray.push('\"' + item.name + '\"');\r\n\t\t\tfieldArray.push(item.name);\r\n\t\t});\r\n\t\t// Comma separate the header data and append to the CSV \r\n\t\tcsv += headerArray.join(',') + \"\\n\";\r\n\r\n\t\tstore.each(function(record){\r\n\t\t\tlet rowArray = [];\r\n\t\t\tfor (let x = 0; x < fieldArray.length; x++){\r\n\t\t\t\tlet field = fieldArray[x];\r\n\t\t\t\tlet value = \"\";\r\n\t\t\t\tswitch (Object.prototype.toString.call(record.data[field])) {\r\n\t\t\t\t\tcase \"[object String]\":\r\n\t\t\t\t\t\tvalue = '\"' + record.data[field] + '\"';\r\n\t\t\t\t\t\tbreak;\r\n\t\t\t\t\tcase \"[object Number]\":\r\n\t\t\t\t\t\tvalue = record.data[field];\r\n\t\t\t\t\t\tbreak;\r\n\t\t\t\t\tcase \"[object Date]\":\r\n\t\t\t\t\t\tvalue = record.data[field].format(\"Y-m-d H:i:s\");\r\n\t\t\t\t\t\tbreak;\r\n\t\t\t\t\tdefault:\r\n\t\t\t\t\t\tvalue = record.data[field];\r\n\t\t\t\t\t\tbreak;\r\n\t\t\t\t}\r\n\t\t\t\trowArray.push(value);\r\n\t\t\t}\r\n\t\t\tcsv += rowArray.join(',') + \"\\n\";\r\n\t\t});\r\n\t\t\r\n\t\treturn csv;\t\r\n\t}\r\n\r\n\r\n\t\r\n});\r\nExt.reg('exportbutton', Ext.ux.ExportButton);"
  },
  {
    "path": "client/src/js/FileSaver.js",
    "content": "(function (global, factory) {\n    if (typeof define === \"function\" && define.amd) {\n      define([], factory);\n    } else if (typeof exports !== \"undefined\") {\n      factory();\n    } else {\n      var mod = {\n        exports: {}\n      };\n      factory();\n      global.FileSaver = mod.exports;\n    }\n  })(this, function () {\n    \"use strict\";\n  \n    /*\n    * FileSaver.js\n    * A saveAs() FileSaver implementation.\n    *\n    * By Eli Grey, http://eligrey.com\n    *\n    * License : https://github.com/eligrey/FileSaver.js/blob/master/LICENSE.md (MIT)\n    * source  : http://purl.eligrey.com/github/FileSaver.js\n    */\n    // The one and only way of getting global scope in all environments\n    // https://stackoverflow.com/q/3277182/1008999\n    var _global = typeof window === 'object' && window.window === window ? window : typeof self === 'object' && self.self === self ? self : typeof global === 'object' && global.global === global ? global : void 0;\n  \n    function bom(blob, opts) {\n      if (typeof opts === 'undefined') opts = {\n        autoBom: false\n      };else if (typeof opts !== 'object') {\n        console.warn('Deprecated: Expected third argument to be a object');\n        opts = {\n          autoBom: !opts\n        };\n      } // prepend BOM for UTF-8 XML and text/* types (including HTML)\n      // note: your browser will automatically convert UTF-16 U+FEFF to EF BB BF\n  \n      if (opts.autoBom && /^\\s*(?:text\\/\\S*|application\\/xml|\\S*\\/\\S*\\+xml)\\s*;.*charset\\s*=\\s*utf-8/i.test(blob.type)) {\n        return new Blob([String.fromCharCode(0xFEFF), blob], {\n          type: blob.type\n        });\n      }\n  \n      return blob;\n    }\n  \n    function download(url, name, opts) {\n      var xhr = new XMLHttpRequest();\n      xhr.open('GET', url);\n      xhr.responseType = 'blob';\n  \n      xhr.onload = function () {\n        saveAs(xhr.response, name, opts);\n      };\n  \n      xhr.onerror = function () {\n        console.error('could not download file');\n      };\n  \n      xhr.send();\n    }\n  \n    function corsEnabled(url) {\n      var xhr = new XMLHttpRequest(); // use sync to avoid popup blocker\n  \n      xhr.open('HEAD', url, false);\n  \n      try {\n        xhr.send();\n      } catch (e) {}\n  \n      return xhr.status >= 200 && xhr.status <= 299;\n    } // `a.click()` doesn't work for all browsers (#465)\n  \n  \n    function click(node) {\n      try {\n        node.dispatchEvent(new MouseEvent('click'));\n      } catch (e) {\n        var evt = document.createEvent('MouseEvents');\n        evt.initMouseEvent('click', true, true, window, 0, 0, 0, 80, 20, false, false, false, false, 0, null);\n        node.dispatchEvent(evt);\n      }\n    } // Detect WebView inside a native macOS app by ruling out all browsers\n    // We just need to check for 'Safari' because all other browsers (besides Firefox) include that too\n    // https://www.whatismybrowser.com/guides/the-latest-user-agent/macos\n  \n  \n    var isMacOSWebView = /Macintosh/.test(navigator.userAgent) && /AppleWebKit/.test(navigator.userAgent) && !/Safari/.test(navigator.userAgent);\n    var saveAs = _global.saveAs || ( // probably in some web worker\n    typeof window !== 'object' || window !== _global ? function saveAs() {}\n    /* noop */\n    // Use download attribute first if possible (#193 Lumia mobile) unless this is a macOS WebView\n    : 'download' in HTMLAnchorElement.prototype && !isMacOSWebView ? function saveAs(blob, name, opts) {\n      var URL = _global.URL || _global.webkitURL;\n      var a = document.createElement('a');\n      name = name || blob.name || 'download';\n      a.download = name;\n      a.rel = 'noopener'; // tabnabbing\n      // TODO: detect chrome extensions & packaged apps\n      // a.target = '_blank'\n  \n      if (typeof blob === 'string') {\n        // Support regular links\n        a.href = blob;\n  \n        if (a.origin !== location.origin) {\n          corsEnabled(a.href) ? download(blob, name, opts) : click(a, a.target = '_blank');\n        } else {\n          click(a);\n        }\n      } else {\n        // Support blobs\n        a.href = URL.createObjectURL(blob);\n        setTimeout(function () {\n          URL.revokeObjectURL(a.href);\n        }, 4E4); // 40s\n  \n        setTimeout(function () {\n          click(a);\n        }, 0);\n      }\n    } // Use msSaveOrOpenBlob as a second approach\n    : 'msSaveOrOpenBlob' in navigator ? function saveAs(blob, name, opts) {\n      name = name || blob.name || 'download';\n  \n      if (typeof blob === 'string') {\n        if (corsEnabled(blob)) {\n          download(blob, name, opts);\n        } else {\n          var a = document.createElement('a');\n          a.href = blob;\n          a.target = '_blank';\n          setTimeout(function () {\n            click(a);\n          });\n        }\n      } else {\n        navigator.msSaveOrOpenBlob(bom(blob, opts), name);\n      }\n    } // Fallback to using FileReader and a popup\n    : function saveAs(blob, name, opts, popup) {\n      // Open a popup immediately do go around popup blocker\n      // Mostly only available on user interaction and the fileReader is async so...\n      popup = popup || open('', '_blank');\n  \n      if (popup) {\n        popup.document.title = popup.document.body.innerText = 'downloading...';\n      }\n  \n      if (typeof blob === 'string') return download(blob, name, opts);\n      var force = blob.type === 'application/octet-stream';\n  \n      var isSafari = /constructor/i.test(_global.HTMLElement) || _global.safari;\n  \n      var isChromeIOS = /CriOS\\/[\\d]+/.test(navigator.userAgent);\n  \n      if ((isChromeIOS || force && isSafari || isMacOSWebView) && typeof FileReader !== 'undefined') {\n        // Safari doesn't allow downloading of blob URLs\n        var reader = new FileReader();\n  \n        reader.onloadend = function () {\n          var url = reader.result;\n          url = isChromeIOS ? url : url.replace(/^data:[^;]*;/, 'data:attachment/file;');\n          if (popup) popup.location.href = url;else location = url;\n          popup = null; // reverse-tabnabbing #460\n        };\n  \n        reader.readAsDataURL(blob);\n      } else {\n        var URL = _global.URL || _global.webkitURL;\n        var url = URL.createObjectURL(blob);\n        if (popup) popup.location = url;else location.href = url;\n        popup = null; // reverse-tabnabbing #460\n  \n        setTimeout(function () {\n          URL.revokeObjectURL(url);\n        }, 4E4); // 40s\n      }\n    });\n    _global.saveAs = saveAs.saveAs = saveAs;\n  \n    if (typeof module !== 'undefined') {\n      module.exports = saveAs;\n    }\n  });"
  },
  {
    "path": "client/src/js/FileUploadField.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.form');\n\n/**\n * @class Ext.ux.form.FileUploadField\n * @extends Ext.form.TextField\n * Creates a file upload field.\n * @xtype fileuploadfield\n */\nExt.ux.form.FileUploadField = Ext.extend(Ext.form.TextField,  {\n    /**\n     * @cfg {String} buttonText The button text to display on the upload button (defaults to\n     * 'Browse...').  Note that if you supply a value for {@link #buttonCfg}, the buttonCfg.text\n     * value will be used instead if available.\n     */\n    buttonText: 'Browse...',\n    /**\n     * @cfg {Boolean} buttonOnly True to display the file upload field as a button with no visible\n     * text field (defaults to false).  If true, all inherited TextField members will still be available.\n     */\n    buttonOnly: false,\n    /**\n     * @cfg {Number} buttonOffset The number of pixels of space reserved between the button and the text field\n     * (defaults to 3).  Note that this only applies if {@link #buttonOnly} = false.\n     */\n    buttonOffset: 3,\n    /**\n     * @cfg {Object} buttonCfg A standard {@link Ext.Button} config object.\n     */\n\n    // private\n    readOnly: true,\n\n    /**\n     * @hide\n     * @method autoSize\n     */\n    autoSize: Ext.emptyFn,\n\n    // private\n    initComponent: function(){\n        Ext.ux.form.FileUploadField.superclass.initComponent.call(this);\n\n        this.addEvents(\n            /**\n             * @event fileselected\n             * Fires when the underlying file input field's value has changed from the user\n             * selecting a new file from the system file selection dialog.\n             * @param {Ext.ux.form.FileUploadField} this\n             * @param {String} value The file value returned by the underlying file input field\n             */\n            'fileselected'\n        );\n    },\n\n    // private\n    onRender : function(ct, position){\n        Ext.ux.form.FileUploadField.superclass.onRender.call(this, ct, position);\n\n        this.wrap = this.el.wrap({cls:'x-form-field-wrap x-form-file-wrap'});\n        this.el.addClass('x-form-file-text');\n        this.el.dom.removeAttribute('name');\n        this.createFileInput();\n\n        var btnCfg = Ext.applyIf(this.buttonCfg || {}, {\n            text: this.buttonText\n        });\n        this.button = new Ext.Button(Ext.apply(btnCfg, {\n            renderTo: this.wrap,\n            cls: 'x-form-file-btn' + (btnCfg.iconCls ? ' x-btn-icon' : '')\n        }));\n\n        if(this.buttonOnly){\n            this.el.hide();\n            this.wrap.setWidth(this.button.getEl().getWidth());\n        }\n\n        this.bindListeners();\n        this.resizeEl = this.positionEl = this.wrap;\n    },\n    \n    bindListeners: function(){\n        this.fileInput.on({\n            scope: this,\n            mouseenter: function() {\n                this.button.addClass(['x-btn-over','x-btn-focus'])\n            },\n            mouseleave: function(){\n                this.button.removeClass(['x-btn-over','x-btn-focus','x-btn-click'])\n            },\n            mousedown: function(){\n                this.button.addClass('x-btn-click')\n            },\n            mouseup: function(){\n                this.button.removeClass(['x-btn-over','x-btn-focus','x-btn-click'])\n            },\n            change: function(){\n                var v = this.fileInput.dom.value;\n\t\t\t\tv = v.replace(/^.*[\\\\\\/]/,\"\");// remove directory path\n                this.setValue(v);\n                this.fireEvent('fileselected', this, v);    \n            }\n        }); \n    },\n    \n    createFileInput : function() {\n        this.fileInput = this.wrap.createChild({\n            id: this.getFileInputId(),\n            name: this.name||this.getId(),\n            cls: 'x-form-file',\n            tag: 'input',\n            type: 'file',\n            title: ' ',\n            accept: this.accept || '*',\n            // size: 100\n        })\n        if (this.multiple) {\n            this.fileInput.dom.setAttribute('multiple', '')\n        }\n        if (this.webkitdirectory) {\n            this.fileInput.dom.setAttribute('webkitdirectory', '')\n        }\n        if (this.style) {\n            this.fileInput.dom.setAttribute('style', this.style)\n        }\n    },\n    \n    reset : function(){\n        if (this.rendered) {\n            this.fileInput.remove();\n            this.createFileInput();\n            this.bindListeners();\n        }\n        Ext.ux.form.FileUploadField.superclass.reset.call(this);\n    },\n\n    // private\n    getFileInputId: function(){\n        return this.id + '-file';\n    },\n\n    // private\n    onResize : function(w, h){\n        Ext.ux.form.FileUploadField.superclass.onResize.call(this, w, h);\n\n        this.wrap.setWidth(w);\n\n        if(!this.buttonOnly){\n            var w = this.wrap.getWidth() - this.button.getEl().getWidth() - this.buttonOffset;\n            this.el.setWidth(w);\n        }\n    },\n\n    // private\n    onDestroy: function(){\n        Ext.ux.form.FileUploadField.superclass.onDestroy.call(this);\n        Ext.destroy(this.fileInput, this.button, this.wrap);\n    },\n    \n    onDisable: function(){\n        Ext.ux.form.FileUploadField.superclass.onDisable.call(this);\n        this.doDisable(true);\n    },\n    \n    onEnable: function(){\n        Ext.ux.form.FileUploadField.superclass.onEnable.call(this);\n        this.doDisable(false);\n\n    },\n    \n    // private\n    doDisable: function(disabled){\n        this.fileInput.dom.disabled = disabled;\n        this.button.setDisabled(disabled);\n    },\n\n\n    // private\n    preFocus : Ext.emptyFn,\n\n    // private\n    alignErrorIcon : function(){\n        this.errorIcon.alignTo(this.wrap, 'tl-tr', [2, 0]);\n    }\n\n});\n\nExt.reg('fileuploadfield', Ext.ux.form.FileUploadField);\n\n// backwards compat\nExt.form.FileUploadField = Ext.ux.form.FileUploadField;\n"
  },
  {
    "path": "client/src/js/LockingGridView.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.grid');\n\nExt.ux.grid.LockingGridView = Ext.extend(Ext.grid.GridView, {\n    lockText : 'Lock',\n    unlockText : 'Unlock',\n    rowBorderWidth : 1,\n    lockedBorderWidth : 1,\n\n    /*\n     * This option ensures that height between the rows is synchronized\n     * between the locked and unlocked sides. This option only needs to be used\n     * when the row heights aren't predictable.\n     */\n    syncHeights: false,\n\n    initTemplates : function(){\n        var ts = this.templates || {};\n\n        if (!ts.masterTpl) {\n            ts.masterTpl = new Ext.Template(\n                '<div class=\"x-grid3\" hidefocus=\"true\">',\n                    '<div class=\"x-grid3-locked\">',\n                        '<div class=\"x-grid3-header\"><div class=\"x-grid3-header-inner\"><div class=\"x-grid3-header-offset\" style=\"{lstyle}\">{lockedHeader}</div></div><div class=\"x-clear\"></div></div>',\n                        '<div class=\"x-grid3-scroller\"><div class=\"x-grid3-body\" style=\"{lstyle}\">{lockedBody}</div><div class=\"x-grid3-scroll-spacer\"></div></div>',\n                    '</div>',\n                    '<div class=\"x-grid3-viewport x-grid3-unlocked\">',\n                        '<div class=\"x-grid3-header\"><div class=\"x-grid3-header-inner\"><div class=\"x-grid3-header-offset\" style=\"{ostyle}\">{header}</div></div><div class=\"x-clear\"></div></div>',\n                        '<div class=\"x-grid3-scroller\"><div class=\"x-grid3-body\" style=\"{bstyle}\">{body}</div><a href=\"#\" class=\"x-grid3-focus\" tabIndex=\"-1\"></a></div>',\n                    '</div>',\n                    '<div class=\"x-grid3-resize-marker\">&#160;</div>',\n                    '<div class=\"x-grid3-resize-proxy\">&#160;</div>',\n                '</div>'\n            );\n        }\n\n        this.templates = ts;\n\n        Ext.ux.grid.LockingGridView.superclass.initTemplates.call(this);\n    },\n\n    getEditorParent : function(ed){\n        return this.el.dom;\n    },\n\n    initElements : function(){\n        var el             = Ext.get(this.grid.getGridEl().dom.firstChild),\n            lockedWrap     = el.child('div.x-grid3-locked'),\n            lockedHd       = lockedWrap.child('div.x-grid3-header'),\n            lockedScroller = lockedWrap.child('div.x-grid3-scroller'),\n            mainWrap       = el.child('div.x-grid3-viewport'),\n            mainHd         = mainWrap.child('div.x-grid3-header'),\n            scroller       = mainWrap.child('div.x-grid3-scroller');\n            \n        if (this.grid.hideHeaders) {\n            lockedHd.setDisplayed(false);\n            mainHd.setDisplayed(false);\n        }\n        \n        if(this.forceFit){\n            scroller.setStyle('overflow-x', 'hidden');\n        }\n        \n        Ext.apply(this, {\n            el      : el,\n            mainWrap: mainWrap,\n            mainHd  : mainHd,\n            innerHd : mainHd.dom.firstChild,\n            scroller: scroller,\n            mainBody: scroller.child('div.x-grid3-body'),\n            focusEl : scroller.child('a'),\n            resizeMarker: el.child('div.x-grid3-resize-marker'),\n            resizeProxy : el.child('div.x-grid3-resize-proxy'),\n            lockedWrap: lockedWrap,\n            lockedHd: lockedHd,\n            lockedScroller: lockedScroller,\n            lockedBody: lockedScroller.child('div.x-grid3-body'),\n            lockedInnerHd: lockedHd.child('div.x-grid3-header-inner', true)\n        });\n        \n        this.focusEl.swallowEvent('click', true);\n    },\n\n    getLockedRows : function(){\n        return this.hasRows() ? this.lockedBody.dom.childNodes : [];\n    },\n\n    getLockedRow : function(row){\n        return this.getLockedRows()[row];\n    },\n\n    getCell : function(row, col){\n        var lockedLen = this.cm.getLockedCount();\n        if(col < lockedLen){\n            return this.getLockedRow(row).getElementsByTagName('td')[col];\n        }\n        return Ext.ux.grid.LockingGridView.superclass.getCell.call(this, row, col - lockedLen);\n    },\n\n    getHeaderCell : function(index){\n        var lockedLen = this.cm.getLockedCount();\n        if(index < lockedLen){\n            return this.lockedHd.dom.getElementsByTagName('td')[index];\n        }\n        return Ext.ux.grid.LockingGridView.superclass.getHeaderCell.call(this, index - lockedLen);\n    },\n\n    addRowClass : function(row, cls){\n        var lockedRow = this.getLockedRow(row);\n        if(lockedRow){\n            this.fly(lockedRow).addClass(cls);\n        }\n        Ext.ux.grid.LockingGridView.superclass.addRowClass.call(this, row, cls);\n    },\n\n    removeRowClass : function(row, cls){\n        var lockedRow = this.getLockedRow(row);\n        if(lockedRow){\n            this.fly(lockedRow).removeClass(cls);\n        }\n        Ext.ux.grid.LockingGridView.superclass.removeRowClass.call(this, row, cls);\n    },\n\n    removeRow : function(row) {\n        Ext.removeNode(this.getLockedRow(row));\n        Ext.ux.grid.LockingGridView.superclass.removeRow.call(this, row);\n    },\n\n    removeRows : function(firstRow, lastRow){\n        var lockedBody = this.lockedBody.dom,\n            rowIndex = firstRow;\n        for(; rowIndex <= lastRow; rowIndex++){\n            Ext.removeNode(lockedBody.childNodes[firstRow]);\n        }\n        Ext.ux.grid.LockingGridView.superclass.removeRows.call(this, firstRow, lastRow);\n    },\n\n    syncScroll : function(e){\n        this.lockedScroller.dom.scrollTop = this.scroller.dom.scrollTop;\n        Ext.ux.grid.LockingGridView.superclass.syncScroll.call(this, e);\n    },\n\n    updateSortIcon : function(col, dir){\n        var sortClasses = this.sortClasses,\n            lockedHeaders = this.lockedHd.select('td').removeClass(sortClasses),\n            headers = this.mainHd.select('td').removeClass(sortClasses),\n            lockedLen = this.cm.getLockedCount(),\n            cls = sortClasses[dir == 'DESC' ? 1 : 0];\n            \n        if(col < lockedLen){\n            lockedHeaders.item(col).addClass(cls);\n        }else{\n            headers.item(col - lockedLen).addClass(cls);\n        }\n    },\n\n    updateAllColumnWidths : function(){\n        var tw = this.getTotalWidth(),\n            clen = this.cm.getColumnCount(),\n            lw = this.getLockedWidth(),\n            llen = this.cm.getLockedCount(),\n            ws = [], len, i;\n        this.updateLockedWidth();\n        for(i = 0; i < clen; i++){\n            ws[i] = this.getColumnWidth(i);\n            var hd = this.getHeaderCell(i);\n            hd.style.width = ws[i];\n        }\n        var lns = this.getLockedRows(), ns = this.getRows(), row, trow, j;\n        for(i = 0, len = ns.length; i < len; i++){\n            row = lns[i];\n            row.style.width = lw;\n            if(row.firstChild){\n                row.firstChild.style.width = lw;\n                trow = row.firstChild.rows[0];\n                for (j = 0; j < llen; j++) {\n                   trow.childNodes[j].style.width = ws[j];\n                }\n            }\n            row = ns[i];\n            row.style.width = tw;\n            if(row.firstChild){\n                row.firstChild.style.width = tw;\n                trow = row.firstChild.rows[0];\n                for (j = llen; j < clen; j++) {\n                   trow.childNodes[j - llen].style.width = ws[j];\n                }\n            }\n        }\n        this.onAllColumnWidthsUpdated(ws, tw);\n        this.syncHeaderHeight();\n    },\n\n    updateColumnWidth : function(col, width){\n        var w = this.getColumnWidth(col),\n            llen = this.cm.getLockedCount(),\n            ns, rw, c, row;\n        this.updateLockedWidth();\n        if(col < llen){\n            ns = this.getLockedRows();\n            rw = this.getLockedWidth();\n            c = col;\n        }else{\n            ns = this.getRows();\n            rw = this.getTotalWidth();\n            c = col - llen;\n        }\n        var hd = this.getHeaderCell(col);\n        hd.style.width = w;\n        for(var i = 0, len = ns.length; i < len; i++){\n            row = ns[i];\n            row.style.width = rw;\n            if(row.firstChild){\n                row.firstChild.style.width = rw;\n                row.firstChild.rows[0].childNodes[c].style.width = w;\n            }\n        }\n        this.onColumnWidthUpdated(col, w, this.getTotalWidth());\n        this.syncHeaderHeight();\n    },\n\n    updateColumnHidden : function(col, hidden){\n        var llen = this.cm.getLockedCount(),\n            ns, rw, c, row,\n            display = hidden ? 'none' : '';\n        this.updateLockedWidth();\n        if(col < llen){\n            ns = this.getLockedRows();\n            rw = this.getLockedWidth();\n            c = col;\n        }else{\n            ns = this.getRows();\n            rw = this.getTotalWidth();\n            c = col - llen;\n        }\n        var hd = this.getHeaderCell(col);\n        hd.style.display = display;\n        for(var i = 0, len = ns.length; i < len; i++){\n            row = ns[i];\n            row.style.width = rw;\n            if(row.firstChild){\n                row.firstChild.style.width = rw;\n                row.firstChild.rows[0].childNodes[c].style.display = display;\n            }\n        }\n        this.onColumnHiddenUpdated(col, hidden, this.getTotalWidth());\n        delete this.lastViewWidth;\n        this.layout();\n    },\n\n    doRender : function(cs, rs, ds, startRow, colCount, stripe){\n        var ts = this.templates, ct = ts.cell, rt = ts.row, last = colCount-1,\n            tstyle = 'width:'+this.getTotalWidth()+';',\n            lstyle = 'width:'+this.getLockedWidth()+';',\n            buf = [], lbuf = [], cb, lcb, c, p = {}, rp = {}, r;\n        for(var j = 0, len = rs.length; j < len; j++){\n            r = rs[j]; cb = []; lcb = [];\n            var rowIndex = (j+startRow);\n            for(var i = 0; i < colCount; i++){\n                c = cs[i];\n                p.id = c.id;\n                p.css = (i === 0 ? 'x-grid3-cell-first ' : (i == last ? 'x-grid3-cell-last ' : '')) +\n                    (this.cm.config[i].cellCls ? ' ' + this.cm.config[i].cellCls : '');\n                p.attr = p.cellAttr = '';\n                p.value = c.renderer(r.data[c.name], p, r, rowIndex, i, ds);\n                p.style = c.style;\n                if(Ext.isEmpty(p.value)){\n                    p.value = '&#160;';\n                }\n                if(this.markDirty && r.dirty && Ext.isDefined(r.modified[c.name])){\n                    p.css += ' x-grid3-dirty-cell';\n                }\n                if(c.locked){\n                    lcb[lcb.length] = ct.apply(p);\n                }else{\n                    cb[cb.length] = ct.apply(p);\n                }\n            }\n            var alt = [];\n            if(stripe && ((rowIndex+1) % 2 === 0)){\n                alt[0] = 'x-grid3-row-alt';\n            }\n            if(r.dirty){\n                alt[1] = ' x-grid3-dirty-row';\n            }\n            rp.cols = colCount;\n            if(this.getRowClass){\n                alt[2] = this.getRowClass(r, rowIndex, rp, ds);\n            }\n            rp.alt = alt.join(' ');\n            rp.cells = cb.join('');\n            rp.tstyle = tstyle;\n            buf[buf.length] = rt.apply(rp);\n            rp.cells = lcb.join('');\n            rp.tstyle = lstyle;\n            lbuf[lbuf.length] = rt.apply(rp);\n        }\n        return [buf.join(''), lbuf.join('')];\n    },\n    processRows : function(startRow, skipStripe){\n        if(!this.ds || this.ds.getCount() < 1){\n            return;\n        }\n        var rows = this.getRows(),\n            lrows = this.getLockedRows(),\n            row, lrow;\n        skipStripe = skipStripe || !this.grid.stripeRows;\n        startRow = startRow || 0;\n        for(var i = 0, len = rows.length; i < len; ++i){\n            row = rows[i];\n            lrow = lrows[i];\n            row.rowIndex = i;\n            lrow.rowIndex = i;\n            if(!skipStripe){\n                row.className = row.className.replace(this.rowClsRe, ' ');\n                lrow.className = lrow.className.replace(this.rowClsRe, ' ');\n                if ((i + 1) % 2 === 0){\n                    row.className += ' x-grid3-row-alt';\n                    lrow.className += ' x-grid3-row-alt';\n                }\n            }\n            this.syncRowHeights(row, lrow);\n        }\n        if(startRow === 0){\n            Ext.fly(rows[0]).addClass(this.firstRowCls);\n            Ext.fly(lrows[0]).addClass(this.firstRowCls);\n        }\n        Ext.fly(rows[rows.length - 1]).addClass(this.lastRowCls);\n        Ext.fly(lrows[lrows.length - 1]).addClass(this.lastRowCls);\n    },\n    \n    syncRowHeights: function(row1, row2){\n        if(this.syncHeights){\n            var el1 = Ext.get(row1),\n                el2 = Ext.get(row2),\n                h1 = el1.getHeight(),\n                h2 = el2.getHeight();\n\n            if(h1 > h2){\n                el2.setHeight(h1);\n            }else if(h2 > h1){\n                el1.setHeight(h2);\n            }\n        }\n    },\n\n    afterRender : function(){\n        if(!this.ds || !this.cm){\n            return;\n        }\n        var bd = this.renderRows() || ['&#160;', '&#160;'];\n        this.mainBody.dom.innerHTML = bd[0];\n        this.lockedBody.dom.innerHTML = bd[1];\n        this.processRows(0, true);\n        if(this.deferEmptyText !== true){\n            this.applyEmptyText();\n        }\n        this.grid.fireEvent('viewready', this.grid);\n    },\n\n    renderUI : function(){        \n        var templates = this.templates,\n            header = this.renderHeaders(),\n            body = templates.body.apply({rows:'&#160;'});\n\n        return templates.masterTpl.apply({\n            body  : body,\n            header: header[0],\n            ostyle: 'width:' + this.getOffsetWidth() + ';',\n            bstyle: 'width:' + this.getTotalWidth()  + ';',\n            lockedBody: body,\n            lockedHeader: header[1],\n            lstyle: 'width:'+this.getLockedWidth()+';'\n        });\n    },\n    \n    afterRenderUI: function(){\n        var g = this.grid;\n        this.initElements();\n        Ext.fly(this.innerHd).on('click', this.handleHdDown, this);\n        Ext.fly(this.lockedInnerHd).on('click', this.handleHdDown, this);\n        this.mainHd.on({\n            scope: this,\n            mouseover: this.handleHdOver,\n            mouseout: this.handleHdOut,\n            mousemove: this.handleHdMove\n        });\n        this.lockedHd.on({\n            scope: this,\n            mouseover: this.handleHdOver,\n            mouseout: this.handleHdOut,\n            mousemove: this.handleHdMove\n        });\n        this.scroller.on('scroll', this.syncScroll,  this);\n        if(g.enableColumnResize !== false){\n            this.splitZone = new Ext.grid.GridView.SplitDragZone(g, this.mainHd.dom);\n            this.splitZone.setOuterHandleElId(Ext.id(this.lockedHd.dom));\n            this.splitZone.setOuterHandleElId(Ext.id(this.mainHd.dom));\n        }\n        if(g.enableColumnMove){\n            this.columnDrag = new Ext.grid.GridView.ColumnDragZone(g, this.innerHd);\n            this.columnDrag.setOuterHandleElId(Ext.id(this.lockedInnerHd));\n            this.columnDrag.setOuterHandleElId(Ext.id(this.innerHd));\n            this.columnDrop = new Ext.grid.HeaderDropZone(g, this.mainHd.dom);\n        }\n        if(g.enableHdMenu !== false){\n            this.hmenu = new Ext.menu.Menu({id: g.id + '-hctx'});\n            this.hmenu.add(\n                {itemId: 'asc', text: this.sortAscText, cls: 'xg-hmenu-sort-asc'},\n                {itemId: 'desc', text: this.sortDescText, cls: 'xg-hmenu-sort-desc'}\n            );\n            if(this.grid.enableColLock !== false){\n                this.hmenu.add({\n                    itemId: 'sortSep',\n                    xtype: 'menuseparator'\n                },\n                    {itemId: 'lock', text: this.lockText, cls: 'xg-hmenu-lock'},\n                    {itemId: 'unlock', text: this.unlockText, cls: 'xg-hmenu-unlock'}\n                );\n            }\n            if(g.enableColumnHide !== false){\n                this.colMenu = new Ext.menu.Menu({id:g.id + '-hcols-menu'});\n                this.colMenu.on({\n                    scope: this,\n                    beforeshow: this.beforeColMenuShow,\n                    itemclick: this.handleHdMenuClick\n                });\n                this.hmenu.add('-', {\n                    itemId:'columns',\n                    hideOnClick: false,\n                    text: this.columnsText,\n                    menu: this.colMenu,\n                    iconCls: 'x-cols-icon'\n                });\n            }\n            this.hmenu.on('itemclick', this.handleHdMenuClick, this);\n        }\n        if(g.trackMouseOver){\n            this.mainBody.on({\n                scope: this,\n                mouseover: this.onRowOver,\n                mouseout: this.onRowOut\n            });\n            this.lockedBody.on({\n                scope: this,\n                mouseover: this.onRowOver,\n                mouseout: this.onRowOut\n            });\n        }\n\n        if(g.enableDragDrop || g.enableDrag){\n            this.dragZone = new Ext.grid.GridDragZone(g, {\n                ddGroup : g.ddGroup || 'GridDD'\n            });\n        }\n        this.updateHeaderSortState();    \n    },\n\n    layout : function(){\n        if(!this.mainBody){\n            return;\n        }\n        var g = this.grid;\n        var c = g.getGridEl();\n        var csize = c.getSize(true);\n        var vw = csize.width;\n        if(!g.hideHeaders && (vw < 20 || csize.height < 20)){\n            return;\n        }\n        this.syncHeaderHeight();\n        if(g.autoHeight){\n            this.scroller.dom.style.overflow = 'visible';\n            this.lockedScroller.dom.style.overflow = 'visible';\n            if(Ext.isWebKit){\n                this.scroller.dom.style.position = 'static';\n                this.lockedScroller.dom.style.position = 'static';\n            }\n        }else{\n            this.el.setSize(csize.width, csize.height);\n            var hdHeight = this.mainHd.getHeight();\n            var vh = csize.height - (hdHeight);\n        }\n        this.updateLockedWidth();\n        if(this.forceFit){\n            if(this.lastViewWidth != vw){\n                this.fitColumns(false, false);\n                this.lastViewWidth = vw;\n            }\n        }else {\n            this.autoExpand();\n            this.syncHeaderScroll();\n        }\n        this.onLayout(vw, vh);\n    },\n\n    getOffsetWidth : function() {\n        return (this.cm.getTotalWidth() - this.cm.getTotalLockedWidth() + this.getScrollOffset()) + 'px';\n    },\n\n    renderHeaders : function(){\n        var cm = this.cm,\n            ts = this.templates,\n            ct = ts.hcell,\n            cb = [], lcb = [],\n            p = {},\n            len = cm.getColumnCount(),\n            last = len - 1;\n        for(var i = 0; i < len; i++){\n            p.id = cm.getColumnId(i);\n            p.value = cm.getColumnHeader(i) || '';\n            p.style = this.getColumnStyle(i, true);\n            p.tooltip = this.getColumnTooltip(i);\n            p.css = (i === 0 ? 'x-grid3-cell-first ' : (i == last ? 'x-grid3-cell-last ' : '')) +\n                (cm.config[i].headerCls ? ' ' + cm.config[i].headerCls : '');\n            if(cm.config[i].align == 'right'){\n                p.istyle = 'padding-right:4px';\n            } else {\n                delete p.istyle;\n            }\n            if(cm.isLocked(i)){\n                lcb[lcb.length] = ct.apply(p);\n            }else{\n                cb[cb.length] = ct.apply(p);\n            }\n        }\n        return [ts.header.apply({cells: cb.join(''), tstyle:'width:'+this.getTotalWidth()+';'}),\n                ts.header.apply({cells: lcb.join(''), tstyle:'width:'+this.getLockedWidth()+';'})];\n    },\n\n    updateHeaders : function(){\n        var hd = this.renderHeaders();\n        this.innerHd.firstChild.innerHTML = hd[0];\n        this.innerHd.firstChild.style.width = this.getOffsetWidth();\n        this.innerHd.firstChild.firstChild.style.width = this.getTotalWidth();\n        this.lockedInnerHd.firstChild.innerHTML = hd[1];\n        var lw = this.getLockedWidth();\n        this.lockedInnerHd.firstChild.style.width = lw;\n        this.lockedInnerHd.firstChild.firstChild.style.width = lw;\n    },\n\n    getResolvedXY : function(resolved){\n        if(!resolved){\n            return null;\n        }\n        var c = resolved.cell, r = resolved.row;\n        return c ? Ext.fly(c).getXY() : [this.scroller.getX(), Ext.fly(r).getY()];\n    },\n\n    syncFocusEl : function(row, col, hscroll){\n        Ext.ux.grid.LockingGridView.superclass.syncFocusEl.call(this, row, col, col < this.cm.getLockedCount() ? false : hscroll);\n    },\n\n    ensureVisible : function(row, col, hscroll){\n        return Ext.ux.grid.LockingGridView.superclass.ensureVisible.call(this, row, col, col < this.cm.getLockedCount() ? false : hscroll);\n    },\n\n    insertRows : function(dm, firstRow, lastRow, isUpdate){\n        var last = dm.getCount() - 1;\n        if(!isUpdate && firstRow === 0 && lastRow >= last){\n            this.refresh();\n        }else{\n            if(!isUpdate){\n                this.fireEvent('beforerowsinserted', this, firstRow, lastRow);\n            }\n            var html = this.renderRows(firstRow, lastRow),\n                before = this.getRow(firstRow);\n            if(before){\n                if(firstRow === 0){\n                    this.removeRowClass(0, this.firstRowCls);\n                }\n                Ext.DomHelper.insertHtml('beforeBegin', before, html[0]);\n                before = this.getLockedRow(firstRow);\n                Ext.DomHelper.insertHtml('beforeBegin', before, html[1]);\n            }else{\n                this.removeRowClass(last - 1, this.lastRowCls);\n                Ext.DomHelper.insertHtml('beforeEnd', this.mainBody.dom, html[0]);\n                Ext.DomHelper.insertHtml('beforeEnd', this.lockedBody.dom, html[1]);\n            }\n            if(!isUpdate){\n                this.fireEvent('rowsinserted', this, firstRow, lastRow);\n                this.processRows(firstRow);\n            }else if(firstRow === 0 || firstRow >= last){\n                this.addRowClass(firstRow, firstRow === 0 ? this.firstRowCls : this.lastRowCls);\n            }\n        }\n        this.syncFocusEl(firstRow);\n    },\n\n    getColumnStyle : function(col, isHeader){\n        var style = !isHeader ? this.cm.config[col].cellStyle || this.cm.config[col].css || '' : this.cm.config[col].headerStyle || '';\n        style += 'width:'+this.getColumnWidth(col)+';';\n        if(this.cm.isHidden(col)){\n            style += 'display:none;';\n        }\n        var align = this.cm.config[col].align;\n        if(align){\n            style += 'text-align:'+align+';';\n        }\n        return style;\n    },\n\n    getLockedWidth : function() {\n        return this.cm.getTotalLockedWidth() + 'px';\n    },\n\n    getTotalWidth : function() {\n        return (this.cm.getTotalWidth() - this.cm.getTotalLockedWidth()) + 'px';\n    },\n\n    getColumnData : function(){\n        var cs = [], cm = this.cm, colCount = cm.getColumnCount();\n        for(var i = 0; i < colCount; i++){\n            var name = cm.getDataIndex(i);\n            cs[i] = {\n                name : (!Ext.isDefined(name) ? this.ds.fields.get(i).name : name),\n                renderer : cm.getRenderer(i),\n                scope : cm.getRendererScope(i),\n                id : cm.getColumnId(i),\n                style : this.getColumnStyle(i),\n                locked : cm.isLocked(i)\n            };\n        }\n        return cs;\n    },\n\n    renderBody : function(){\n        var markup = this.renderRows() || ['&#160;', '&#160;'];\n        return [this.templates.body.apply({rows: markup[0]}), this.templates.body.apply({rows: markup[1]})];\n    },\n    \n    refreshRow: function(record){\n        var store = this.ds, \n            colCount = this.cm.getColumnCount(), \n            columns = this.getColumnData(), \n            last = colCount - 1, \n            cls = ['x-grid3-row'], \n            rowParams = {\n                tstyle: String.format(\"width: {0};\", this.getTotalWidth())\n            }, \n            lockedRowParams = {\n                tstyle: String.format(\"width: {0};\", this.getLockedWidth())\n            }, \n            colBuffer = [], \n            lockedColBuffer = [], \n            cellTpl = this.templates.cell, \n            rowIndex, \n            row, \n            lockedRow, \n            column, \n            meta, \n            css, \n            i;\n        \n        if (Ext.isNumber(record)) {\n            rowIndex = record;\n            record = store.getAt(rowIndex);\n        } else {\n            rowIndex = store.indexOf(record);\n        }\n        \n        if (!record || rowIndex < 0) {\n            return;\n        }\n        \n        for (i = 0; i < colCount; i++) {\n            column = columns[i];\n            \n            if (i == 0) {\n                css = 'x-grid3-cell-first';\n            } else {\n                css = (i == last) ? 'x-grid3-cell-last ' : '';\n            }\n            \n            meta = {\n                id: column.id,\n                style: column.style,\n                css: css,\n                attr: \"\",\n                cellAttr: \"\"\n            };\n            \n            meta.value = column.renderer.call(column.scope, record.data[column.name], meta, record, rowIndex, i, store);\n            \n            if (Ext.isEmpty(meta.value)) {\n                meta.value = ' ';\n            }\n            \n            if (this.markDirty && record.dirty && typeof record.modified[column.name] != 'undefined') {\n                meta.css += ' x-grid3-dirty-cell';\n            }\n            \n            if (column.locked) {\n                lockedColBuffer[i] = cellTpl.apply(meta);\n            } else {\n                colBuffer[i] = cellTpl.apply(meta);\n            }\n        }\n        \n        row = this.getRow(rowIndex);\n        row.className = '';\n        lockedRow = this.getLockedRow(rowIndex);\n        lockedRow.className = '';\n        \n        if (this.grid.stripeRows && ((rowIndex + 1) % 2 === 0)) {\n            cls.push('x-grid3-row-alt');\n        }\n        \n        if (this.getRowClass) {\n            rowParams.cols = colCount;\n            cls.push(this.getRowClass(record, rowIndex, rowParams, store));\n        }\n        \n        // Unlocked rows\n        this.fly(row).addClass(cls).setStyle(rowParams.tstyle);\n        rowParams.cells = colBuffer.join(\"\");\n        row.innerHTML = this.templates.rowInner.apply(rowParams);\n        \n        // Locked rows\n        this.fly(lockedRow).addClass(cls).setStyle(lockedRowParams.tstyle);\n        lockedRowParams.cells = lockedColBuffer.join(\"\");\n        lockedRow.innerHTML = this.templates.rowInner.apply(lockedRowParams);\n        lockedRow.rowIndex = rowIndex;\n        this.syncRowHeights(row, lockedRow);  \n        this.fireEvent('rowupdated', this, rowIndex, record);\n    },\n\n    refresh : function(headersToo){\n        this.fireEvent('beforerefresh', this);\n        this.grid.stopEditing(true);\n        var result = this.renderBody();\n        this.mainBody.update(result[0]).setWidth(this.getTotalWidth());\n        this.lockedBody.update(result[1]).setWidth(this.getLockedWidth());\n        if(headersToo === true){\n            this.updateHeaders();\n            this.updateHeaderSortState();\n        }\n        this.processRows(0, true);\n        this.layout();\n        this.applyEmptyText();\n        this.fireEvent('refresh', this);\n    },\n\n    onDenyColumnLock : function(){\n\n    },\n\n    initData : function(ds, cm){\n        if(this.cm){\n            this.cm.un('columnlockchange', this.onColumnLock, this);\n        }\n        Ext.ux.grid.LockingGridView.superclass.initData.call(this, ds, cm);\n        if(this.cm){\n            this.cm.on('columnlockchange', this.onColumnLock, this);\n        }\n    },\n\n    onColumnLock : function(){\n        this.refresh(true);\n    },\n\n    handleHdMenuClick : function(item){\n        var index = this.hdCtxIndex,\n            cm = this.cm,\n            id = item.getItemId(),\n            llen = cm.getLockedCount();\n        switch(id){\n            case 'lock':\n                if(cm.getColumnCount(true) <= llen + 1){\n                    this.onDenyColumnLock();\n                    return undefined;\n                }\n                cm.setLocked(index, true, llen != index);\n                if(llen != index){\n                    cm.moveColumn(index, llen);\n                    this.grid.fireEvent('columnmove', index, llen);\n                }\n            break;\n            case 'unlock':\n                if(llen - 1 != index){\n                    cm.setLocked(index, false, true);\n                    cm.moveColumn(index, llen - 1);\n                    this.grid.fireEvent('columnmove', index, llen - 1);\n                }else{\n                    cm.setLocked(index, false);\n                }\n            break;\n            default:\n                return Ext.ux.grid.LockingGridView.superclass.handleHdMenuClick.call(this, item);\n        }\n        return true;\n    },\n\n    handleHdDown : function(e, t){\n        Ext.ux.grid.LockingGridView.superclass.handleHdDown.call(this, e, t);\n        if(this.grid.enableColLock !== false){\n            if(Ext.fly(t).hasClass('x-grid3-hd-btn')){\n                var hd = this.findHeaderCell(t),\n                    index = this.getCellIndex(hd),\n                    ms = this.hmenu.items, cm = this.cm;\n                ms.get('lock').setDisabled(cm.isLocked(index));\n                ms.get('unlock').setDisabled(!cm.isLocked(index));\n            }\n        }\n    },\n\n    syncHeaderHeight: function(){\n        var hrow = Ext.fly(this.innerHd).child('tr', true),\n            lhrow = Ext.fly(this.lockedInnerHd).child('tr', true);\n            \n        hrow.style.height = 'auto';\n        lhrow.style.height = 'auto';\n        var hd = hrow.offsetHeight,\n            lhd = lhrow.offsetHeight,\n            height = Math.max(lhd, hd) + 'px';\n            \n        hrow.style.height = height;\n        lhrow.style.height = height;\n\n    },\n\n    updateLockedWidth: function(){\n        var lw = this.cm.getTotalLockedWidth(),\n            tw = this.cm.getTotalWidth() - lw,\n            csize = this.grid.getGridEl().getSize(true),\n            lp = Ext.isBorderBox ? 0 : this.lockedBorderWidth,\n            rp = Ext.isBorderBox ? 0 : this.rowBorderWidth,\n            vw = Math.max(csize.width - lw - lp - rp, 0) + 'px',\n            so = this.getScrollOffset();\n        if(!this.grid.autoHeight){\n            var vh = Math.max(csize.height - this.mainHd.getHeight(), 0) + 'px';\n            this.lockedScroller.dom.style.height = vh;\n            this.scroller.dom.style.height = vh;\n        }\n        this.lockedWrap.dom.style.width = (lw + rp) + 'px';\n        this.scroller.dom.style.width = vw;\n        this.mainWrap.dom.style.left = (lw + lp + rp) + 'px';\n        if(this.innerHd){\n            this.lockedInnerHd.firstChild.style.width = lw + 'px';\n            this.lockedInnerHd.firstChild.firstChild.style.width = lw + 'px';\n            this.innerHd.style.width = vw;\n            this.innerHd.firstChild.style.width = (tw + rp + so) + 'px';\n            this.innerHd.firstChild.firstChild.style.width = tw + 'px';\n        }\n        if(this.mainBody){\n            this.lockedBody.dom.style.width = (lw + rp) + 'px';\n            this.mainBody.dom.style.width = (tw + rp) + 'px';\n        }\n    }\n});\n\nExt.ux.grid.LockingColumnModel = Ext.extend(Ext.grid.ColumnModel, {\n    /**\n     * Returns true if the given column index is currently locked\n     * @param {Number} colIndex The column index\n     * @return {Boolean} True if the column is locked\n     */\n    isLocked : function(colIndex){\n        return this.config[colIndex].locked === true;\n    },\n\n    /**\n     * Locks or unlocks a given column\n     * @param {Number} colIndex The column index\n     * @param {Boolean} value True to lock, false to unlock\n     * @param {Boolean} suppressEvent Pass false to cause the columnlockchange event not to fire\n     */\n    setLocked : function(colIndex, value, suppressEvent){\n        if (this.isLocked(colIndex) == value) {\n            return;\n        }\n        this.config[colIndex].locked = value;\n        if (!suppressEvent) {\n            this.fireEvent('columnlockchange', this, colIndex, value);\n        }\n    },\n\n    /**\n     * Returns the total width of all locked columns\n     * @return {Number} The width of all locked columns\n     */\n    getTotalLockedWidth : function(){\n        var totalWidth = 0;\n        for (var i = 0, len = this.config.length; i < len; i++) {\n            if (this.isLocked(i) && !this.isHidden(i)) {\n                totalWidth += this.getColumnWidth(i);\n            }\n        }\n\n        return totalWidth;\n    },\n\n    /**\n     * Returns the total number of locked columns\n     * @return {Number} The number of locked columns\n     */\n    getLockedCount : function() {\n        var len = this.config.length;\n\n        for (var i = 0; i < len; i++) {\n            if (!this.isLocked(i)) {\n                return i;\n            }\n        }\n\n        //if we get to this point all of the columns are locked so we return the total\n        return len;\n    },\n\n    /**\n     * Moves a column from one position to another\n     * @param {Number} oldIndex The current column index\n     * @param {Number} newIndex The destination column index\n     */\n    moveColumn : function(oldIndex, newIndex){\n        var oldLocked = this.isLocked(oldIndex),\n            newLocked = this.isLocked(newIndex);\n\n        if (oldIndex < newIndex && oldLocked && !newLocked) {\n            this.setLocked(oldIndex, false, true);\n        } else if (oldIndex > newIndex && !oldLocked && newLocked) {\n            this.setLocked(oldIndex, true, true);\n        }\n\n        Ext.ux.grid.LockingColumnModel.superclass.moveColumn.apply(this, arguments);\n    }\n});\n"
  },
  {
    "path": "client/src/js/MessageBox.js",
    "content": "// STIG Manager modification: Two instances of document.body were replaced with Ext.getBody()\nExt.MessageBox = function(){\n    var dlg, opt, mask, waitTimer,\n        bodyEl, msgEl, textboxEl, textareaEl, progressBar, pp, iconEl, spacerEl,\n        buttons, activeTextEl, bwidth, bufferIcon = '', iconCls = '',\n        buttonNames = ['ok', 'yes', 'no', 'cancel'];\n\n    // private\n    var handleButton = function(button){\n        buttons[button].blur();\n        if(dlg.isVisible()){\n            dlg.hide();\n            handleHide();\n            Ext.callback(opt.fn, opt.scope||window, [button, activeTextEl.dom.value, opt], 1);\n        }\n    };\n\n    // private\n    var handleHide = function(){\n        if(opt && opt.cls){\n            dlg.el.removeClass(opt.cls);\n        }\n        progressBar.reset();        \n    };\n\n    // private\n    var handleEsc = function(d, k, e){\n        if(opt && opt.closable !== false){\n            dlg.hide();\n            handleHide();\n        }\n        if(e){\n            e.stopEvent();\n        }\n    };\n\n    // private\n    var updateButtons = function(b){\n        var width = 0,\n            cfg;\n        if(!b){\n            Ext.each(buttonNames, function(name){\n                buttons[name].hide();\n            });\n            return width;\n        }\n        dlg.footer.dom.style.display = '';\n        Ext.iterate(buttons, function(name, btn){\n            cfg = b[name];\n            if(cfg){\n                btn.show();\n                btn.setText(Ext.isString(cfg) ? cfg : Ext.MessageBox.buttonText[name]);\n                width += btn.getEl().getWidth() + 15;\n            }else{\n                btn.hide();\n            }\n        });\n        return width;\n    };\n\n    return {\n        /**\n         * Returns a reference to the underlying {@link Ext.Window} element\n         * @return {Ext.Window} The window\n         */\n        getDialog : function(titleText){\n           if(!dlg){\n                var btns = [];\n                \n                buttons = {};\n                Ext.each(buttonNames, function(name){\n                    btns.push(buttons[name] = new Ext.Button({\n                        text: this.buttonText[name],\n                        handler: handleButton.createCallback(name),\n                        hideMode: 'offsets'\n                    }));\n                }, this);\n                dlg = new Ext.Window({\n                    autoCreate : true,\n                    title:titleText,\n                    resizable:false,\n                    constrain:true,\n                    constrainHeader:true,\n                    minimizable : false,\n                    maximizable : false,\n                    stateful: false,\n                    modal: true,\n                    shim:true,\n                    buttonAlign:\"center\",\n                    width:400,\n                    height:100,\n                    minHeight: 80,\n                    plain:true,\n                    footer:true,\n                    closable:true,\n                    close : function(){\n                        if(opt && opt.buttons && opt.buttons.no && !opt.buttons.cancel){\n                            handleButton(\"no\");\n                        }else{\n                            handleButton(\"cancel\");\n                        }\n                    },\n                    fbar: new Ext.Toolbar({\n                        items: btns,\n                        enableOverflow: false\n                    })\n                });\n                // First document.body => Ext.getBody() substitution\n                dlg.render(Ext.getBody());\n                dlg.getEl().addClass('x-window-dlg');\n                mask = dlg.mask;\n                bodyEl = dlg.body.createChild({\n                    html:'<div class=\"ext-mb-icon\"></div><div class=\"ext-mb-content\"><span class=\"ext-mb-text\"></span><br /><div class=\"ext-mb-fix-cursor\"><input type=\"text\" class=\"ext-mb-input\" /><textarea class=\"ext-mb-textarea\"></textarea></div></div>'\n                });\n                iconEl = Ext.get(bodyEl.dom.firstChild);\n                var contentEl = bodyEl.dom.childNodes[1];\n                msgEl = Ext.get(contentEl.firstChild);\n                textboxEl = Ext.get(contentEl.childNodes[2].firstChild);\n                textboxEl.enableDisplayMode();\n                textboxEl.addKeyListener([10,13], function(){\n                    if(dlg.isVisible() && opt && opt.buttons){\n                        if(opt.buttons.ok){\n                            handleButton(\"ok\");\n                        }else if(opt.buttons.yes){\n                            handleButton(\"yes\");\n                        }\n                    }\n                });\n                textareaEl = Ext.get(contentEl.childNodes[2].childNodes[1]);\n                textareaEl.enableDisplayMode();\n                progressBar = new Ext.ProgressBar({\n                    renderTo:bodyEl\n                });\n               bodyEl.createChild({cls:'x-clear'});\n            }\n            return dlg;\n        },\n\n        /**\n         * Updates the message box body text\n         * @param {String} text (optional) Replaces the message box element's innerHTML with the specified string (defaults to\n         * the XHTML-compliant non-breaking space character '&amp;#160;')\n         * @return {Ext.MessageBox} this\n         */\n        updateText : function(text){\n            if(!dlg.isVisible() && !opt.width){\n                dlg.setSize(this.maxWidth, 100); // resize first so content is never clipped from previous shows\n            }\n            // Append a space here for sizing. In IE, for some reason, it wraps text incorrectly without one in some cases\n            msgEl.update(text ? text + ' ' : '&#160;');\n\n            var iw = iconCls != '' ? (iconEl.getWidth() + iconEl.getMargins('lr')) : 0,\n                mw = msgEl.getWidth() + msgEl.getMargins('lr'),\n                fw = dlg.getFrameWidth('lr'),\n                bw = dlg.body.getFrameWidth('lr'),\n                w;\n                \n            w = Math.max(Math.min(opt.width || iw+mw+fw+bw, opt.maxWidth || this.maxWidth),\n                    Math.max(opt.minWidth || this.minWidth, bwidth || 0));\n\n            if(opt.prompt === true){\n                activeTextEl.setWidth(w-iw-fw-bw);\n            }\n            if(opt.progress === true || opt.wait === true){\n                progressBar.setSize(w-iw-fw-bw);\n            }\n            if(Ext.isIE9m && w == bwidth){\n                w += 4; //Add offset when the content width is smaller than the buttons.    \n            }\n            msgEl.update(text || '&#160;');\n            dlg.setSize(w, 'auto').center();\n            return this;\n        },\n\n        /**\n         * Updates a progress-style message box's text and progress bar. Only relevant on message boxes\n         * initiated via {@link Ext.MessageBox#progress} or {@link Ext.MessageBox#wait},\n         * or by calling {@link Ext.MessageBox#show} with progress: true.\n         * @param {Number} value Any number between 0 and 1 (e.g., .5, defaults to 0)\n         * @param {String} progressText The progress text to display inside the progress bar (defaults to '')\n         * @param {String} msg The message box's body text is replaced with the specified string (defaults to undefined\n         * so that any existing body text will not get overwritten by default unless a new value is passed in)\n         * @return {Ext.MessageBox} this\n         */\n        updateProgress : function(value, progressText, msg){\n            progressBar.updateProgress(value, progressText);\n            if(msg){\n                this.updateText(msg);\n            }\n            return this;\n        },\n\n        /**\n         * Returns true if the message box is currently displayed\n         * @return {Boolean} True if the message box is visible, else false\n         */\n        isVisible : function(){\n            return dlg && dlg.isVisible();\n        },\n\n        /**\n         * Hides the message box if it is displayed\n         * @return {Ext.MessageBox} this\n         */\n        hide : function(){\n            var proxy = dlg ? dlg.activeGhost : null;\n            if(this.isVisible() || proxy){\n                dlg.hide();\n                handleHide();\n                if (proxy){\n                    // unghost is a private function, but i saw no better solution\n                    // to fix the locking problem when dragging while it closes\n                    dlg.unghost(false, false);\n                } \n            }\n            return this;\n        },\n\n        /**\n         * Displays a new message box, or reinitializes an existing message box, based on the config options\n         * passed in. All display functions (e.g. prompt, alert, etc.) on MessageBox call this function internally,\n         * although those calls are basic shortcuts and do not support all of the config options allowed here.\n         * @param {Object} config The following config options are supported: <ul>\n         * <li><b>animEl</b> : String/Element<div class=\"sub-desc\">An id or Element from which the message box should animate as it\n         * opens and closes (defaults to undefined)</div></li>\n         * <li><b>buttons</b> : Object/Boolean<div class=\"sub-desc\">A button config object (e.g., Ext.MessageBox.OKCANCEL or {ok:'Foo',\n         * cancel:'Bar'}), or false to not show any buttons (defaults to false)</div></li>\n         * <li><b>closable</b> : Boolean<div class=\"sub-desc\">False to hide the top-right close button (defaults to true). Note that\n         * progress and wait dialogs will ignore this property and always hide the close button as they can only\n         * be closed programmatically.</div></li>\n         * <li><b>cls</b> : String<div class=\"sub-desc\">A custom CSS class to apply to the message box's container element</div></li>\n         * <li><b>defaultTextHeight</b> : Number<div class=\"sub-desc\">The default height in pixels of the message box's multiline textarea\n         * if displayed (defaults to 75)</div></li>\n         * <li><b>fn</b> : Function<div class=\"sub-desc\">A callback function which is called when the dialog is dismissed either\n         * by clicking on the configured buttons, or on the dialog close button, or by pressing\n         * the return button to enter input.\n         * <p>Progress and wait dialogs will ignore this option since they do not respond to user\n         * actions and can only be closed programmatically, so any required function should be called\n         * by the same code after it closes the dialog. Parameters passed:<ul>\n         * <li><b>buttonId</b> : String<div class=\"sub-desc\">The ID of the button pressed, one of:<div class=\"sub-desc\"><ul>\n         * <li><tt>ok</tt></li>\n         * <li><tt>yes</tt></li>\n         * <li><tt>no</tt></li>\n         * <li><tt>cancel</tt></li>\n         * </ul></div></div></li>\n         * <li><b>text</b> : String<div class=\"sub-desc\">Value of the input field if either <tt><a href=\"#show-option-prompt\" ext:member=\"show-option-prompt\" ext:cls=\"Ext.MessageBox\">prompt</a></tt>\n         * or <tt><a href=\"#show-option-multiline\" ext:member=\"show-option-multiline\" ext:cls=\"Ext.MessageBox\">multiline</a></tt> is true</div></li>\n         * <li><b>opt</b> : Object<div class=\"sub-desc\">The config object passed to show.</div></li>\n         * </ul></p></div></li>\n         * <li><b>scope</b> : Object<div class=\"sub-desc\">The scope of the callback function</div></li>\n         * <li><b>icon</b> : String<div class=\"sub-desc\">A CSS class that provides a background image to be used as the body icon for the\n         * dialog (e.g. Ext.MessageBox.WARNING or 'custom-class') (defaults to '')</div></li>\n         * <li><b>iconCls</b> : String<div class=\"sub-desc\">The standard {@link Ext.Window#iconCls} to\n         * add an optional header icon (defaults to '')</div></li>\n         * <li><b>maxWidth</b> : Number<div class=\"sub-desc\">The maximum width in pixels of the message box (defaults to 600)</div></li>\n         * <li><b>minWidth</b> : Number<div class=\"sub-desc\">The minimum width in pixels of the message box (defaults to 100)</div></li>\n         * <li><b>modal</b> : Boolean<div class=\"sub-desc\">False to allow user interaction with the page while the message box is\n         * displayed (defaults to true)</div></li>\n         * <li><b>msg</b> : String<div class=\"sub-desc\">A string that will replace the existing message box body text (defaults to the\n         * XHTML-compliant non-breaking space character '&amp;#160;')</div></li>\n         * <li><a id=\"show-option-multiline\"></a><b>multiline</b> : Boolean<div class=\"sub-desc\">\n         * True to prompt the user to enter multi-line text (defaults to false)</div></li>\n         * <li><b>progress</b> : Boolean<div class=\"sub-desc\">True to display a progress bar (defaults to false)</div></li>\n         * <li><b>progressText</b> : String<div class=\"sub-desc\">The text to display inside the progress bar if progress = true (defaults to '')</div></li>\n         * <li><a id=\"show-option-prompt\"></a><b>prompt</b> : Boolean<div class=\"sub-desc\">True to prompt the user to enter single-line text (defaults to false)</div></li>\n         * <li><b>proxyDrag</b> : Boolean<div class=\"sub-desc\">True to display a lightweight proxy while dragging (defaults to false)</div></li>\n         * <li><b>title</b> : String<div class=\"sub-desc\">The title text</div></li>\n         * <li><b>value</b> : String<div class=\"sub-desc\">The string value to set into the active textbox element if displayed</div></li>\n         * <li><b>wait</b> : Boolean<div class=\"sub-desc\">True to display a progress bar (defaults to false)</div></li>\n         * <li><b>waitConfig</b> : Object<div class=\"sub-desc\">A {@link Ext.ProgressBar#waitConfig} object (applies only if wait = true)</div></li>\n         * <li><b>width</b> : Number<div class=\"sub-desc\">The width of the dialog in pixels</div></li>\n         * </ul>\n         * Example usage:\n         * <pre><code>\nExt.Msg.show({\n   title: 'Address',\n   msg: 'Please enter your address:',\n   width: 300,\n   buttons: Ext.MessageBox.OKCANCEL,\n   multiline: true,\n   fn: saveAddress,\n   animEl: 'addAddressBtn',\n   icon: Ext.MessageBox.INFO\n});\n</code></pre>\n         * @return {Ext.MessageBox} this\n         */\n        show : function(options){\n            if(this.isVisible()){\n                this.hide();\n            }\n            opt = options;\n            var d = this.getDialog(opt.title || \"&#160;\");\n\n            d.setTitle(SM.he(opt.title) || \"&#160;\");\n            var allowClose = (opt.closable !== false && opt.progress !== true && opt.wait !== true);\n            d.tools.close.setDisplayed(allowClose);\n            activeTextEl = textboxEl;\n            opt.prompt = opt.prompt || (opt.multiline ? true : false);\n            if(opt.prompt){\n                if(opt.multiline){\n                    textboxEl.hide();\n                    textareaEl.show();\n                    textareaEl.setHeight(Ext.isNumber(opt.multiline) ? opt.multiline : this.defaultTextHeight);\n                    activeTextEl = textareaEl;\n                }else{\n                    textboxEl.show();\n                    textareaEl.hide();\n                }\n            }else{\n                textboxEl.hide();\n                textareaEl.hide();\n            }\n            activeTextEl.dom.value = opt.value || \"\";\n            if(opt.prompt){\n                d.focusEl = activeTextEl;\n            }else{\n                var bs = opt.buttons;\n                var db = null;\n                if(bs && bs.ok){\n                    db = buttons[\"ok\"];\n                }else if(bs && bs.yes){\n                    db = buttons[\"yes\"];\n                }\n                if (db){\n                    d.focusEl = db;\n                }\n            }\n            if(Ext.isDefined(opt.iconCls)){\n              d.setIconClass(opt.iconCls);\n            }\n            this.setIcon(Ext.isDefined(opt.icon) ? opt.icon : bufferIcon);\n            bwidth = updateButtons(opt.buttons);\n            progressBar.setVisible(opt.progress === true || opt.wait === true);\n            this.updateProgress(0, opt.progressText);\n            this.updateText(opt.msg);\n            if(opt.cls){\n                d.el.addClass(opt.cls);\n            }\n            d.proxyDrag = opt.proxyDrag === true;\n            d.modal = opt.modal !== false;\n            d.mask = opt.modal !== false ? mask : false;\n            if(!d.isVisible()){\n                // force it to the end of the z-index stack so it gets a cursor in FF\n                // Second document.body => Ext.getBody() substitution\n                Ext.getBody().appendChild(dlg.el.dom);\n                d.setAnimateTarget(opt.animEl);\n                //workaround for window internally enabling keymap in afterShow\n                d.on('show', function(){\n                    if(allowClose === true){\n                        d.keyMap.enable();\n                    }else{\n                        d.keyMap.disable();\n                    }\n                }, this, {single:true});\n                d.show(opt.animEl);\n            }\n            if(opt.wait === true){\n                progressBar.wait(opt.waitConfig);\n            }\n            return this;\n        },\n\n        /**\n         * Adds the specified icon to the dialog.  By default, the class 'ext-mb-icon' is applied for default\n         * styling, and the class passed in is expected to supply the background image url. Pass in empty string ('')\n         * to clear any existing icon. This method must be called before the MessageBox is shown.\n         * The following built-in icon classes are supported, but you can also pass in a custom class name:\n         * <pre>\nExt.MessageBox.INFO\nExt.MessageBox.WARNING\nExt.MessageBox.QUESTION\nExt.MessageBox.ERROR\n         *</pre>\n         * @param {String} icon A CSS classname specifying the icon's background image url, or empty string to clear the icon\n         * @return {Ext.MessageBox} this\n         */\n        setIcon : function(icon){\n            if(!dlg){\n                bufferIcon = icon;\n                return;\n            }\n            bufferIcon = undefined;\n            if(icon && icon != ''){\n                iconEl.removeClass('x-hidden');\n                iconEl.replaceClass(iconCls, icon);\n                bodyEl.addClass('x-dlg-icon');\n                iconCls = icon;\n            }else{\n                iconEl.replaceClass(iconCls, 'x-hidden');\n                bodyEl.removeClass('x-dlg-icon');\n                iconCls = '';\n            }\n            return this;\n        },\n\n        /**\n         * Displays a message box with a progress bar.  This message box has no buttons and is not closeable by\n         * the user.  You are responsible for updating the progress bar as needed via {@link Ext.MessageBox#updateProgress}\n         * and closing the message box when the process is complete.\n         * @param {String} title The title bar text\n         * @param {String} msg The message box body text\n         * @param {String} progressText (optional) The text to display inside the progress bar (defaults to '')\n         * @return {Ext.MessageBox} this\n         */\n        progress : function(title, msg, progressText){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: false,\n                progress:true,\n                closable:false,\n                minWidth: this.minProgressWidth,\n                progressText: progressText\n            });\n            return this;\n        },\n\n        /**\n         * Displays a message box with an infinitely auto-updating progress bar.  This can be used to block user\n         * interaction while waiting for a long-running process to complete that does not have defined intervals.\n         * You are responsible for closing the message box when the process is complete.\n         * @param {String} msg The message box body text\n         * @param {String} title (optional) The title bar text\n         * @param {Object} config (optional) A {@link Ext.ProgressBar#waitConfig} object\n         * @return {Ext.MessageBox} this\n         */\n        wait : function(msg, title, config){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: false,\n                closable:false,\n                wait:true,\n                modal:true,\n                minWidth: this.minProgressWidth,\n                waitConfig: config\n            });\n            return this;\n        },\n\n        /**\n         * Displays a standard read-only message box with an OK button (comparable to the basic JavaScript alert prompt).\n         * If a callback function is passed it will be called after the user clicks the button, and the\n         * id of the button that was clicked will be passed as the only parameter to the callback\n         * (could also be the top-right close button).\n         * @param {String} title The title bar text\n         * @param {String} msg The message box body text\n         * @param {Function} fn (optional) The callback function invoked after the message box is closed\n         * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the callback is executed. Defaults to the browser wnidow.\n         * @return {Ext.MessageBox} this\n         */\n        alert : function(title, msg, fn, scope){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: this.OK,\n                fn: fn,\n                scope : scope,\n                minWidth: this.minWidth\n            });\n            return this;\n        },\n\n        /**\n         * Displays a confirmation message box with Yes and No buttons (comparable to JavaScript's confirm).\n         * If a callback function is passed it will be called after the user clicks either button,\n         * and the id of the button that was clicked will be passed as the only parameter to the callback\n         * (could also be the top-right close button).\n         * @param {String} title The title bar text\n         * @param {String} msg The message box body text\n         * @param {Function} fn (optional) The callback function invoked after the message box is closed\n         * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the callback is executed. Defaults to the browser wnidow.\n         * @return {Ext.MessageBox} this\n         */\n        confirm : function(title, msg, fn, scope){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: this.YESNO,\n                fn: fn,\n                scope : scope,\n                icon: this.QUESTION,\n                minWidth: this.minWidth\n            });\n            return this;\n        },\n\n        /**\n         * Displays a message box with OK and Cancel buttons prompting the user to enter some text (comparable to JavaScript's prompt).\n         * The prompt can be a single-line or multi-line textbox.  If a callback function is passed it will be called after the user\n         * clicks either button, and the id of the button that was clicked (could also be the top-right\n         * close button) and the text that was entered will be passed as the two parameters to the callback.\n         * @param {String} title The title bar text\n         * @param {String} msg The message box body text\n         * @param {Function} fn (optional) The callback function invoked after the message box is closed\n         * @param {Object} scope (optional) The scope (<code>this</code> reference) in which the callback is executed. Defaults to the browser wnidow.\n         * @param {Boolean/Number} multiline (optional) True to create a multiline textbox using the defaultTextHeight\n         * property, or the height in pixels to create the textbox (defaults to false / single-line)\n         * @param {String} value (optional) Default value of the text input element (defaults to '')\n         * @return {Ext.MessageBox} this\n         */\n        prompt : function(title, msg, fn, scope, multiline, value){\n            this.show({\n                title : title,\n                msg : msg,\n                buttons: this.OKCANCEL,\n                fn: fn,\n                minWidth: this.minPromptWidth,\n                scope : scope,\n                prompt:true,\n                multiline: multiline,\n                value: value\n            });\n            return this;\n        },\n\n        /**\n         * Button config that displays a single OK button\n         * @type Object\n         */\n        OK : {ok:true},\n        /**\n         * Button config that displays a single Cancel button\n         * @type Object\n         */\n        CANCEL : {cancel:true},\n        /**\n         * Button config that displays OK and Cancel buttons\n         * @type Object\n         */\n        OKCANCEL : {ok:true, cancel:true},\n        /**\n         * Button config that displays Yes and No buttons\n         * @type Object\n         */\n        YESNO : {yes:true, no:true},\n        /**\n         * Button config that displays Yes, No and Cancel buttons\n         * @type Object\n         */\n        YESNOCANCEL : {yes:true, no:true, cancel:true},\n        /**\n         * The CSS class that provides the INFO icon image\n         * @type String\n         */\n        INFO : 'ext-mb-info',\n        /**\n         * The CSS class that provides the WARNING icon image\n         * @type String\n         */\n        WARNING : 'ext-mb-warning',\n        /**\n         * The CSS class that provides the QUESTION icon image\n         * @type String\n         */\n        QUESTION : 'ext-mb-question',\n        /**\n         * The CSS class that provides the ERROR icon image\n         * @type String\n         */\n        ERROR : 'ext-mb-error',\n\n        /**\n         * The default height in pixels of the message box's multiline textarea if displayed (defaults to 75)\n         * @type Number\n         */\n        defaultTextHeight : 75,\n        /**\n         * The maximum width in pixels of the message box (defaults to 600)\n         * @type Number\n         */\n        maxWidth : 600,\n        /**\n         * The minimum width in pixels of the message box (defaults to 100)\n         * @type Number\n         */\n        minWidth : 100,\n        /**\n         * The minimum width in pixels of the message box if it is a progress-style dialog.  This is useful\n         * for setting a different minimum width than text-only dialogs may need (defaults to 250).\n         * @type Number\n         */\n        minProgressWidth : 250,\n        /**\n         * The minimum width in pixels of the message box if it is a prompt dialog.  This is useful\n         * for setting a different minimum width than text-only dialogs may need (defaults to 250).\n         * @type Number\n         */\n        minPromptWidth: 250,\n        /**\n         * An object containing the default button text strings that can be overriden for localized language support.\n         * Supported properties are: ok, cancel, yes and no.  Generally you should include a locale-specific\n         * resource file for handling language support across the framework.\n         * Customize the default text like so: Ext.MessageBox.buttonText.yes = \"oui\"; //french\n         * @type Object\n         */\n        buttonText : {\n            ok : \"OK\",\n            cancel : \"Cancel\",\n            yes : \"Yes\",\n            no : \"No\"\n        }\n    };\n}();\n\n/**\n * Shorthand for {@link Ext.MessageBox}\n */\nExt.Msg = Ext.MessageBox;"
  },
  {
    "path": "client/src/js/RowEditor.js",
    "content": "/*\nThis file is part of Ext JS 3.4\n\nCopyright (c) 2011-2013 Sencha Inc\n\nContact:  http://www.sencha.com/contact\n\nGNU General Public License Usage\nThis file may be used under the terms of the GNU General Public License version 3.0 as\npublished by the Free Software Foundation and appearing in the file LICENSE included in the\npackaging of this file.\n\nPlease review the following information to ensure the GNU General Public License version 3.0\nrequirements will be met: http://www.gnu.org/copyleft/gpl.html.\n\nIf you are unsure which license is appropriate for your use, please contact the sales department\nat http://www.sencha.com/contact.\n\nBuild date: 2013-04-03 15:07:25\n*/\nExt.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.RowEditor\n * @extends Ext.Panel\n * Plugin (ptype = 'roweditor') that adds the ability to rapidly edit full rows in a grid.\n * A validation mode may be enabled which uses AnchorTips to notify the user of all\n * validation errors at once.\n *\n * @ptype roweditor\n */\nExt.ux.grid.RowEditor = Ext.extend(Ext.Panel, {\n    floating: true,\n    shadow: false,\n    layout: 'hbox',\n    cls: 'x-small-editor',\n    buttonAlign: 'center',\n    baseCls: 'x-row-editor',\n    elements: 'header,footer,body',\n    frameWidth: 5,\n    buttonPad: 3,\n    clicksToEdit: 'auto',\n    monitorValid: true,\n    focusDelay: 250,\n    errorSummary: true,\n\n    saveText: 'Save',\n    cancelText: 'Cancel',\n    commitChangesText: 'You need to commit or cancel your changes',\n    errorText: 'Errors',\n\n    defaults: {\n        normalWidth: true\n    },\n\n    initComponent: function(){\n        Ext.ux.grid.RowEditor.superclass.initComponent.call(this);\n        this.addEvents(\n            /**\n             * @event beforeedit\n             * Fired before the row editor is activated.\n             * If the listener returns <tt>false</tt> the editor will not be activated.\n             * @param {Ext.ux.grid.RowEditor} roweditor This object\n             * @param {Number} rowIndex The rowIndex of the row just edited\n             */\n            'beforeedit',\n            /**\n             * @event canceledit\n             * Fired when the editor is cancelled.\n             * @param {Ext.ux.grid.RowEditor} roweditor This object\n             * @param {Boolean} forced True if the cancel button is pressed, false is the editor was invalid.\n             */\n            'canceledit',\n            /**\n             * @event validateedit\n             * Fired after a row is edited and passes validation.\n             * If the listener returns <tt>false</tt> changes to the record will not be set.\n             * @param {Ext.ux.grid.RowEditor} roweditor This object\n             * @param {Object} changes Object with changes made to the record.\n             * @param {Ext.data.Record} r The Record that was edited.\n             * @param {Number} rowIndex The rowIndex of the row just edited\n             */\n            'validateedit',\n            /**\n             * @event afteredit\n             * Fired after a row is edited and passes validation.  This event is fired\n             * after the store's update event is fired with this edit.\n             * @param {Ext.ux.grid.RowEditor} roweditor This object\n             * @param {Object} changes Object with changes made to the record.\n             * @param {Ext.data.Record} r The Record that was edited.\n             * @param {Number} rowIndex The rowIndex of the row just edited\n             */\n            'afteredit'\n        );\n    },\n    init: function(grid){\n        this.grid = grid;\n        this.ownerCt = grid;\n        if(this.clicksToEdit === 2){\n            grid.on('rowdblclick', this.onRowDblClick, this);\n        }else{\n            grid.on('rowclick', this.onRowClick, this);\n            if(Ext.isIE){\n                grid.on('rowdblclick', this.onRowDblClick, this);\n            }\n        }\n\n        // stopEditing without saving when a record is removed from Store.\n        grid.getStore().on('remove', function() {\n            this.stopEditing(false);\n        },this);\n\n        grid.on({\n            scope: this,\n            keydown: this.onGridKey,\n            columnresize: this.verifyLayout,\n            columnmove: this.refreshFields,\n            reconfigure: this.refreshFields,\n            beforedestroy : this.beforedestroy,\n            destroy : this.destroy,\n            bodyscroll: {\n                buffer: 250,\n                fn: this.positionButtons\n            }\n        });\n        grid.getColumnModel().on('hiddenchange', this.verifyLayout, this, {delay:1});\n        grid.getView().on('refresh', this.stopEditing.createDelegate(this, []));\n        this.globalClickHandler = (event) => {\n            if (!this.el?.dom?.contains(event.target)) {\n                this.stopEditing(false);\n            }\n        }\n    },\n\n    beforedestroy: function() {\n        this.stopMonitoring();\n        this.grid.getStore().un('remove', this.onStoreRemove, this);\n        this.stopEditing(false);\n        Ext.destroy(this.btns, this.tooltip);\n    },\n\n    refreshFields: function(){\n        this.initFields();\n        this.verifyLayout();\n    },\n\n    isDirty: function(){\n        var dirty;\n        this.items.each(function(f){\n            if(String(this.values[f.id]) !== String(f.getValue())){\n                dirty = true;\n                return false;\n            }\n        }, this);\n        return dirty;\n    },\n\n    startEditing: function(rowIndex, doFocus){\n        document.body.addEventListener('click', this.globalClickHandler)\n        if(this.editing && this.isDirty()){\n            this.showTooltip(this.commitChangesText);\n            return;\n        }\n        if(Ext.isObject(rowIndex)){\n            rowIndex = this.grid.getStore().indexOf(rowIndex);\n        }\n        if(this.fireEvent('beforeedit', this, rowIndex) !== false){\n            this.grid.getEl().mask()\n            this.editing = true;\n            var g = this.grid, view = g.getView(),\n                row = view.getRow(rowIndex),\n                record = g.store.getAt(rowIndex);\n\n            this.record = record;\n            this.rowIndex = rowIndex;\n            this.values = {};\n            if(!this.rendered){\n                this.render(view.getEditorParent());\n            }\n            var w = Ext.fly(row).getWidth();\n            this.setSize(w);\n            if(!this.initialized){\n                this.initFields();\n            }\n            var cm = g.getColumnModel(), fields = this.items.items, f, val;\n            for(var i = 0, len = cm.getColumnCount(); i < len; i++){\n                val = this.preEditValue(record, cm.getDataIndex(i));\n                f = fields[i];\n                f.setValue(val);\n                this.values[f.id] = Ext.isEmpty(val) ? '' : val;\n            }\n            this.verifyLayout(true);\n            if(!this.isVisible()){\n                this.setPagePosition(Ext.fly(row).getXY());\n            } else{\n                this.el.setXY(Ext.fly(row).getXY(), {duration:0.15});\n            }\n            if(!this.isVisible()){\n                this.show().doLayout();\n            }\n            if(doFocus !== false){\n                this.doFocus.defer(this.focusDelay, this);\n            }\n        }\n    },\n\n    stopEditing : function(saveChanges){\n        document.body.removeEventListener('click', this.globalClickHandler)\n        this.editing = false;\n        this.grid.getEl()?.unmask()\n\n        if(!this.isVisible()){\n            return;\n        }\n        if(saveChanges === false || !this.isValid()){\n            this.hide();\n            this.fireEvent('canceledit', this, saveChanges === false);\n            return;\n        }\n        var changes = {},\n            r = this.record,\n            hasChange = false,\n            cm = this.grid.colModel,\n            fields = this.items.items;\n        for(var i = 0, len = cm.getColumnCount(); i < len; i++){\n            if(!cm.isHidden(i)){\n                var dindex = cm.getDataIndex(i);\n                if(!Ext.isEmpty(dindex)){\n                    var oldValue = r.data[dindex],\n                        value = this.postEditValue(fields[i].getValue(), oldValue, r, dindex);\n                    if(String(oldValue) !== String(value)){\n                        changes[dindex] = value;\n                        hasChange = true;\n                    }\n                }\n            }\n        }\n        if(hasChange && this.fireEvent('validateedit', this, changes, r, this.rowIndex) !== false){\n            r.beginEdit();\n            Ext.iterate(changes, function(name, value){\n                r.set(name, value);\n            });\n            r.endEdit();\n            this.fireEvent('afteredit', this, changes, r, this.rowIndex);\n        } else {\n            this.fireEvent('canceledit', this, false);\n        }\n        this.hide();\n    },\n\n    verifyLayout: function(force){\n        if(this.el && (this.isVisible() || force === true)){\n            var row = this.grid.getView().getRow(this.rowIndex);\n            this.setSize(Ext.fly(row).getWidth(), Ext.isIE ? Ext.fly(row).getHeight() + 9 : undefined);\n            var cm = this.grid.colModel, fields = this.items.items;\n            for(var i = 0, len = cm.getColumnCount(); i < len; i++){\n                if(!cm.isHidden(i)){\n                    var adjust = 0;\n                    if(i === (len - 1)){\n                        adjust += 3; // outer padding\n                    } else{\n                        adjust += 1;\n                    }\n                    fields[i].show();\n                    fields[i].setWidth(cm.getColumnWidth(i) - adjust);\n                } else{\n                    fields[i].hide();\n                }\n            }\n            this.doLayout();\n            this.positionButtons();\n        }\n    },\n\n    slideHide : function(){\n        this.hide();\n    },\n\n    initFields: function(){\n        var cm = this.grid.getColumnModel(), pm = Ext.layout.ContainerLayout.prototype.parseMargins;\n        this.removeAll(false);\n        for(var i = 0, len = cm.getColumnCount(); i < len; i++){\n            var c = cm.getColumnAt(i),\n                ed = c.getEditor();\n            if(!ed){\n                ed = c.displayEditor || new Ext.form.DisplayField();\n            }\n            if(i == 0){\n                ed.margins = pm('0 1 2 1');\n            } else if(i == len - 1){\n                ed.margins = pm('0 0 2 1');\n            } else{\n                // if (Ext.isIE) {\n                    // ed.margins = pm('0 0 2 0');\n                // }\n                // else {\n                    ed.margins = pm('0 1 2 3');\n                // }\n            }\n            ed.setWidth(cm.getColumnWidth(i));\n            ed.column = c;\n            if(ed.ownerCt !== this){\n                ed.on('focus', this.ensureVisible, this);\n                ed.on('specialkey', this.onKey, this);\n            }\n            this.insert(i, ed);\n        }\n        this.initialized = true;\n    },\n\n    onKey: function(f, e){\n        // if(e.getKey() === e.ENTER){\n        //     this.stopEditing(true);\n        //     e.stopPropagation();\n        // }\n    },\n\n    onGridKey: function(e){\n        if(e.getKey() === e.ENTER && !this.isVisible()){\n            var r = this.grid.getSelectionModel().getSelected();\n            if(r){\n                var index = this.grid.store.indexOf(r);\n                this.startEditing(index);\n                e.stopPropagation();\n            }\n        }\n    },\n\n    ensureVisible: function(editor){\n        if(this.isVisible()){\n             this.grid.getView().ensureVisible(this.rowIndex, this.grid.colModel.getIndexById(editor.column.id), true);\n        }\n    },\n\n    onRowClick: function(g, rowIndex, e){\n        if(this.clicksToEdit == 'auto'){\n            var li = this.lastClickIndex;\n            this.lastClickIndex = rowIndex;\n            if(li != rowIndex && !this.isVisible()){\n                return;\n            }\n        }\n        this.startEditing(rowIndex, false);\n        this.doFocus.defer(this.focusDelay, this, [e.getPoint()]);\n    },\n\n    onRowDblClick: function(g, rowIndex, e){\n        this.startEditing(rowIndex, false);\n        this.doFocus.defer(this.focusDelay, this, [e.getPoint()]);\n    },\n\n    onRender: function(){\n        Ext.ux.grid.RowEditor.superclass.onRender.apply(this, arguments);\n        this.el.swallowEvent(['keydown', 'keyup', 'keypress']);\n        this.btns = new Ext.Panel({\n            baseCls: 'x-plain',\n            cls: 'x-btns',\n            elements:'body',\n            layout: 'table',\n            width: (this.minButtonWidth * 2) + (this.frameWidth * 2) + (this.buttonPad * 4), // width must be specified for IE\n            items: [{\n                ref: 'saveBtn',\n                itemId: 'saveBtn',\n                xtype: 'button',\n                text: this.saveText,\n                width: this.minButtonWidth,\n                handler: this.stopEditing.createDelegate(this, [true])\n            }, {\n                xtype: 'button',\n                text: this.cancelText,\n                width: this.minButtonWidth,\n                handler: this.stopEditing.createDelegate(this, [false])\n            }]\n        });\n        this.btns.render(this.bwrap);\n    },\n\n    afterRender: function(){\n        Ext.ux.grid.RowEditor.superclass.afterRender.apply(this, arguments);\n        this.positionButtons();\n        if(this.monitorValid){\n            this.startMonitoring();\n        }\n    },\n\n    onShow: function(){\n        if(this.monitorValid){\n            this.startMonitoring();\n        }\n        Ext.ux.grid.RowEditor.superclass.onShow.apply(this, arguments);\n    },\n\n    onHide: function(){\n        Ext.ux.grid.RowEditor.superclass.onHide.apply(this, arguments);\n        this.stopMonitoring();\n        this.grid.getView().focusRow(this.rowIndex);\n    },\n\n    positionButtons: function(){\n        if(this.btns){\n            var g = this.grid,\n                h = this.el.dom.clientHeight,\n                view = g.getView(),\n                scroll = view.scroller.dom.scrollLeft,\n                bw = this.btns.getWidth(),\n                width = Math.min(g.getWidth(), g.getColumnModel().getTotalWidth());\n\n            this.btns.el.shift({left: (width/2)-(bw/2)+scroll, top: h - 2, stopFx: true, duration:0.2});\n        }\n    },\n\n    // private\n    preEditValue : function(r, field){\n        var value = r.data[field];\n        return this.autoEncode && typeof value === 'string' ? Ext.util.Format.htmlDecode(value) : value;\n    },\n\n    // private\n    postEditValue : function(value, originalValue, r, field){\n        return this.autoEncode && typeof value == 'string' ? SM.he(value) : value;\n    },\n\n    doFocus: function(pt){\n        if(this.isVisible()){\n            var index = 0,\n                cm = this.grid.getColumnModel(),\n                c;\n            if(pt){\n                index = this.getTargetColumnIndex(pt);\n            }\n            for(var i = index||0, len = cm.getColumnCount(); i < len; i++){\n                c = cm.getColumnAt(i);\n                const editor = c.getEditor()\n                if(!c.hidden && editor && !editor.disabled){\n                    editor.focus();\n                    break;\n                }\n            }\n        }\n    },\n\n    getTargetColumnIndex: function(pt){\n        var grid = this.grid,\n            v = grid.view,\n            x = pt.left,\n            cms = grid.colModel.config,\n            i = 0,\n            match = false;\n        for(var len = cms.length, c; c = cms[i]; i++){\n            if(!c.hidden){\n                if(Ext.fly(v.getHeaderCell(i)).getRegion().right >= x){\n                    match = i;\n                    break;\n                }\n            }\n        }\n        return match;\n    },\n\n    startMonitoring : function(){\n        if(!this.bound && this.monitorValid){\n            this.bound = true;\n            Ext.TaskMgr.start({\n                run : this.bindHandler,\n                interval : this.monitorPoll || 200,\n                scope: this\n            });\n        }\n    },\n\n    stopMonitoring : function(){\n        this.bound = false;\n        if(this.tooltip){\n            this.tooltip.hide();\n        }\n    },\n\n    isValid: function(){\n        var valid = true;\n        this.items.each(function(f){\n            if(!f.isValid(true)){\n                valid = false;\n                return false;\n            }\n        });\n        return valid;\n    },\n\n    // private\n    bindHandler : function(){\n        if(!this.bound){\n            return false; // stops binding\n        }\n        var valid = this.isValid();\n        if(!valid && this.errorSummary){\n            this.showTooltip(this.getErrorText().join(''));\n        }\n        this.btns.saveBtn.setDisabled(!valid);\n        this.fireEvent('validation', this, valid);\n    },\n\n    lastVisibleColumn : function() {\n        var i = this.items.getCount() - 1,\n            c;\n        for(; i >= 0; i--) {\n            c = this.items.items[i];\n            if (!c.hidden) {\n                return c;\n            }\n        }\n    },\n\n    showTooltip: function(msg){\n        var t = this.tooltip;\n        if(!t){\n            t = this.tooltip = new Ext.ToolTip({\n                maxWidth: 600,\n                cls: 'errorTip',\n                width: 300,\n                title: this.errorText,\n                autoHide: false,\n                anchor: 'left',\n                anchorToTarget: true,\n                mouseOffset: [40,0]\n            });\n        }\n        var v = this.grid.getView(),\n            top = parseInt(this.el.dom.style.top, 10),\n            scroll = v.scroller.dom.scrollTop,\n            h = this.el.getHeight();\n\n        if(top + h >= scroll){\n            t.initTarget(this.lastVisibleColumn().getEl());\n            if(!t.rendered){\n                t.show();\n                t.hide();\n            }\n            t.body.update(msg);\n            t.doAutoWidth(20);\n            t.show();\n        }else if(t.rendered){\n            t.hide();\n        }\n    },\n\n    getErrorText: function(){\n        var data = ['<ul>'];\n        this.items.each(function(f){\n            if(!f.isValid(true)){\n                data.push('<li>', f.getActiveError(), '</li>');\n            }\n        });\n        data.push('</ul>');\n        return data;\n    }\n});\nExt.preg('roweditor', Ext.ux.grid.RowEditor);\n"
  },
  {
    "path": "client/src/js/RowExpander.js",
    "content": "/*!\n * Ext JS Library 3.2.1\n * Copyright(c) 2006-2010 Ext JS, Inc.\n * licensing@extjs.com\n * http://www.extjs.com/license\n * $Id: RowExpander.js 807 2017-07-27 13:04:19Z csmig $\n */\nExt.ns('Ext.ux.grid');\n\n/**\n * @class Ext.ux.grid.RowExpander\n * @extends Ext.util.Observable\n * Plugin (ptype = 'rowexpander') that adds the ability to have a Column in a grid which enables\n * a second row body which expands/contracts.  The expand/contract behavior is configurable to react\n * on clicking of the column, double click of the row, and/or hitting enter while a row is selected.\n *\n * @ptype rowexpander\n */\nExt.ux.grid.RowExpander = Ext.extend(Ext.util.Observable, {\n    /**\n     * @cfg {Boolean} expandOnEnter\n     * <tt>true</tt> to toggle selected row(s) between expanded/collapsed when the enter\n     * key is pressed (defaults to <tt>true</tt>).\n     */\n    expandOnEnter : true,\n    /**\n     * @cfg {Boolean} expandOnDblClick\n     * <tt>true</tt> to toggle a row between expanded/collapsed when double clicked\n     * (defaults to <tt>true</tt>).\n     */\n    expandOnDblClick : false,\n\n    header : '',\n    width : 20,\n    sortable : false,\n    fixed : true,\n    hideable: false,\n    menuDisabled : true,\n    dataIndex : '',\n    id : 'expander',\n    lazyRender : false,\n    enableCaching : false,\n\n    constructor: function(config){\n        Ext.apply(this, config);\n\n        this.addEvents({\n            /**\n             * @event beforeexpand\n             * Fires before the row expands. Have the listener return false to prevent the row from expanding.\n             * @param {Object} this RowExpander object.\n             * @param {Object} Ext.data.Record Record for the selected row.\n             * @param {Object} body body element for the secondary row.\n             * @param {Number} rowIndex The current row index.\n             */\n            beforeexpand: true,\n            /**\n             * @event expand\n             * Fires after the row expands.\n             * @param {Object} this RowExpander object.\n             * @param {Object} Ext.data.Record Record for the selected row.\n             * @param {Object} body body element for the secondary row.\n             * @param {Number} rowIndex The current row index.\n             */\n            expand: true,\n            /**\n             * @event beforecollapse\n             * Fires before the row collapses. Have the listener return false to prevent the row from collapsing.\n             * @param {Object} this RowExpander object.\n             * @param {Object} Ext.data.Record Record for the selected row.\n             * @param {Object} body body element for the secondary row.\n             * @param {Number} rowIndex The current row index.\n             */\n            beforecollapse: true,\n            /**\n             * @event collapse\n             * Fires after the row collapses.\n             * @param {Object} this RowExpander object.\n             * @param {Object} Ext.data.Record Record for the selected row.\n             * @param {Object} body body element for the secondary row.\n             * @param {Number} rowIndex The current row index.\n             */\n            collapse: true\n        });\n\n        Ext.ux.grid.RowExpander.superclass.constructor.call(this);\n\n        if(this.tpl){\n            if(typeof this.tpl == 'string'){\n                this.tpl = new Ext.Template(this.tpl);\n            }\n            this.tpl.compile();\n        }\n\n        this.state = {};\n        this.bodyContent = {};\n    },\n\n    getRowClass : function(record, rowIndex, p, ds){\n        p.cols = p.cols-1;\n        var content = this.bodyContent[record.id];\n        if(!content && !this.lazyRender){\n            content = this.getBodyContent(record, rowIndex);\n        }\n        p.body = content // resolves bug where an empty content did not replace previous body\n        return this.state[record.id] ? 'x-grid3-row-expanded' : 'x-grid3-row-collapsed';\n    },\n\n    init : function(grid){\n        this.grid = grid;\n\n        var view = grid.getView();\n        view.getRowClass = this.getRowClass.createDelegate(this);\n\n        view.enableRowBody = true;\n\n\n        grid.on('render', this.onRender, this);\n        grid.on('destroy', this.onDestroy, this);\n    },\n\n    // @private\n    onRender: function() {\n        var grid = this.grid;\n        var mainBody = grid.getView().mainBody;\n        mainBody.on('mousedown', this.onMouseDown, this, {delegate: '.x-grid3-row-expander'});\n        if (this.expandOnEnter) {\n            this.keyNav = new Ext.KeyNav(this.grid.getGridEl(), {\n                'enter' : this.onEnter,\n                scope: this\n            });\n        }\n        if (this.expandOnDblClick) {\n            grid.on('rowdblclick', this.onRowDblClick, this);\n        }\n    },\n    \n    // @private    \n    onDestroy: function() {\n        if(this.keyNav){\n            this.keyNav.disable();\n            delete this.keyNav;\n        }\n        /*\n         * A majority of the time, the plugin will be destroyed along with the grid,\n         * which means the mainBody won't be available. On the off chance that the plugin\n         * isn't destroyed with the grid, take care of removing the listener.\n         */\n        var mainBody = this.grid.getView().mainBody;\n        if(mainBody){\n            mainBody.un('mousedown', this.onMouseDown, this);\n        }\n    },\n    // @private\n    onRowDblClick: function(grid, rowIdx, e) {\n        this.toggleRow(rowIdx);\n    },\n\n    onEnter: function(e) {\n        var g = this.grid;\n        var sm = g.getSelectionModel();\n        var sels = sm.getSelections();\n        for (var i = 0, len = sels.length; i < len; i++) {\n            var rowIdx = g.getStore().indexOf(sels[i]);\n            this.toggleRow(rowIdx);\n        }\n    },\n\n    getBodyContent : function(record, index){\n        if(!this.enableCaching){\n            return this.tpl.apply(record.data);\n        }\n        var content = this.bodyContent[record.id];\n        if(!content){\n            content = this.tpl.apply(record.data);\n            this.bodyContent[record.id] = content;\n        }\n        return content;\n    },\n\n    onMouseDown : function(e, t){\n        e.stopEvent();\n        var row = e.getTarget('.x-grid3-row');\n        this.toggleRow(row);\n    },\n\n    renderer : function(v, p, record){\n        p.cellAttr = 'rowspan=\"2\"';\n        return '<div class=\"x-grid3-row-expander\">&#160;</div>';\n    },\n\n    beforeExpand : function(record, body, rowIndex){\n        if(this.fireEvent('beforeexpand', this, record, body, rowIndex) !== false){\n            if(this.tpl && this.lazyRender){\n                body.innerHTML = this.getBodyContent(record, rowIndex);\n            }\n            return true;\n        }else{\n            return false;\n        }\n    },\n\n    toggleRow : function(row){\n        if(typeof row == 'number'){\n            row = this.grid.view.getRow(row);\n        }\n        this[Ext.fly(row).hasClass('x-grid3-row-collapsed') ? 'expandRow' : 'collapseRow'](row);\n    },\n\n    expandRow : function(row){\n        if(typeof row == 'number'){\n            row = this.grid.view.getRow(row);\n        }\n        var record = this.grid.store.getAt(row.rowIndex);\n        var body = Ext.DomQuery.selectNode('tr:nth(2) div.x-grid3-row-body', row);\n        if(this.beforeExpand(record, body, row.rowIndex)){\n            this.state[record.id] = true;\n            Ext.fly(row).replaceClass('x-grid3-row-collapsed', 'x-grid3-row-expanded');\n            this.fireEvent('expand', this, record, body, row.rowIndex);\n        }\n    },\n\n    collapseRow : function(row){\n        if(typeof row == 'number'){\n            row = this.grid.view.getRow(row);\n        }\n        var record = this.grid.store.getAt(row.rowIndex);\n        var body = Ext.fly(row).child('tr:nth(1) div.x-grid3-row-body', true);\n        if(this.fireEvent('beforecollapse', this, record, body, row.rowIndex) !== false){\n            this.state[record.id] = false;\n            Ext.fly(row).replaceClass('x-grid3-row-expanded', 'x-grid3-row-collapsed');\n            this.fireEvent('collapse', this, record, body, row.rowIndex);\n        }\n    }\n});\n\nExt.preg('rowexpander', Ext.ux.grid.RowExpander);\n\n//backwards compat\nExt.grid.RowExpander = Ext.ux.grid.RowExpander;\n\n//support truncation feature by passing entire record to tpl\nExt.ux.grid.RowExpander2 = Ext.extend(Ext.ux.grid.RowExpander, {\n    getBodyContent : function(record, index){\n        if(!this.enableCaching){\n            return this.tpl.apply(record);\n        }\n        var content = this.bodyContent[record.id];\n        if(!content){\n            content = this.tpl.apply(record);\n            this.bodyContent[record.id] = content;\n        }\n        return content;\n    }\n})"
  },
  {
    "path": "client/src/js/SM/Acl.js",
    "content": "Ext.ns('SM.Acl')\n\nSM.Acl.ResourceTreePanel = Ext.extend(Ext.tree.TreePanel, {\n    initComponent: function() {\n      const collectionId = this.collectionId\n      const config = {\n          autoScroll: true,\n          bodyStyle: 'padding:5px;',\n          minSize: 220,\n          root: {\n            nodeType: 'async',\n            id: `${collectionId}-resource-root`,\n            expanded: true\n          },\n          rootVisible: false,\n          loader: new Ext.tree.TreeLoader({\n            directFn: this.loadTree\n          }),\n          loadMask: {msg: ''},\n          listeners: {\n            beforeexpandnode: function (n) {\n              n.loaded = false; // always reload from the server\n            }\n          }\n      }\n  \n      Ext.apply(this, Ext.apply(this.initialConfig, config))\n      this.superclass().initComponent.call(this)\n    },\n    loadTree: async function (node, cb) {\n        try {\n          let match\n          // Root node\n          match = node.match(/^(\\d+)-resource-root$/)\n          if (match) {\n            const collectionId = match[1]\n            const content = []\n            content.push(\n              {\n                id: `${collectionId}-resource-collection-node`,\n                node: 'collection',\n                text: 'Collection',\n                iconCls: 'sm-collection-icon',\n                expanded: true,\n                children: [\n                  {\n                    id: `${collectionId}-resource-stigs-node`,\n                    node: 'stigs',\n                    text: 'STIGs',\n                    iconCls: 'sm-stig-icon'\n                  },\n                  {\n                      id: `${collectionId}-resource-assets-node`,\n                      node: 'assets',\n                      text: 'Assets',\n                      iconCls: 'sm-asset-icon'\n                  },\n                  {\n                    id: `${collectionId}-resource-labels-node`,\n                    node: 'labels',\n                    text: 'Labels',\n                    iconCls: 'sm-label-icon'\n                  }\n                ]\n              }\n            )\n            cb(content, { status: true })\n            return\n          }\n          // Collection-Assets node\n          match = node.match(/^(\\d+)-resource-assets-node$/)\n          if (match) {\n            const collectionId = match[1]\n            const apiAssets = await Ext.Ajax.requestPromise({\n              responseType: 'json',\n              url: `${STIGMAN.Env.apiBase}/assets`,\n              method: 'GET',\n              params: {\n                collectionId: collectionId\n              }\n            })\n            const content = apiAssets.map(asset => ({\n              id: `${collectionId}-${asset.assetId}-resource-assets-asset-node`,\n              text: SM.he(asset.name),\n              assetName: asset.name,\n              node: 'asset',\n              collectionId: collectionId,\n              assetId: asset.assetId,\n              iconCls: 'sm-asset-icon',\n              qtip: SM.he(asset.name)\n            }))\n            cb(content, { status: true })\n            return\n          }\n          // Collection-Assets-STIG node\n          match = node.match(/^(\\d+)-(\\d+)-resource-assets-asset-node$/)\n          if (match) {\n            const collectionId = match[1]\n            const assetId = match[2]\n            const apiAsset = await Ext.Ajax.requestPromise({\n              responseType: 'json',\n              url: `${STIGMAN.Env.apiBase}/assets/${assetId}`,\n              method: 'GET',\n              params: {\n                projection: 'stigs'\n              }\n            })\n            const content = apiAsset.stigs.map(stig => ({\n              id: `${collectionId}-${assetId}-${stig.benchmarkId}-resource-leaf`,\n              text: SM.he(stig.benchmarkId),\n              leaf: true,\n              node: 'asset-stig',\n              iconCls: 'sm-stig-icon',\n              stigName: stig.benchmarkId,\n              assetName: apiAsset.name,\n              assetId: apiAsset.assetId,\n              collectionId: collectionId,\n              benchmarkId: stig.benchmarkId,\n              qtip: `Rules: ${SM.he(stig.ruleCount)}`\n            }))\n            cb(content, { status: true })\n            return\n          }\n      \n          // Collection-STIGs node\n          match = node.match(/^(\\d+)-resource-stigs-node$/)\n          if (match) {\n            const collectionId = match[1]\n            const apiStigs = await Ext.Ajax.requestPromise({\n              responseType: 'json',\n              url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/stigs`,\n              method: 'GET',\n              // params: {\n              //   projection: 'stigs'\n              // }\n            })\n            const content = apiStigs.map( stig => ({\n              collectionId: collectionId,\n              text: SM.he(stig.benchmarkId),\n              node: 'stig',\n              iconCls: 'sm-stig-icon',\n              id: `${collectionId}-${stig.benchmarkId}-resource-stigs-stig-node`,\n              benchmarkId: stig.benchmarkId,\n              qtip: `Assets: ${SM.he(stig.assetCount)}`\n            }) )\n            cb( content, { status: true } )\n            return\n          }\n          // Collection-STIGs-Asset node\n          match = node.match(/^(\\d+)-(.*)-resource-stigs-stig-node$/)\n          if (match) {\n            const collectionId = match[1]\n            const benchmarkId = match[2]\n            const apiAssets = await Ext.Ajax.requestPromise({\n                responseType: 'json',\n                url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/stigs/${benchmarkId}/assets`,\n              method: 'GET'\n            })\n            const content = apiAssets.map(asset => ({\n              id: `${collectionId}-${benchmarkId}-${asset.assetId}-resource-leaf`,\n              text: SM.he(asset.name),\n              leaf: true,\n              node: 'stig-asset',\n              iconCls: 'sm-asset-icon',\n              stigName: benchmarkId,\n              assetName: asset.name,\n              assetId: asset.assetId,\n              collectionId: collectionId,\n              benchmarkId: benchmarkId,\n              qtip: SM.he(asset.name)\n            }))\n            cb(content, { status: true })\n            return\n          }\n\n          // Collection-Labels node\n          match = node.match(/^(\\d+)-resource-labels-node$/)\n          if (match) {\n            const collectionId = match[1]\n            const apiLabels = await Ext.Ajax.requestPromise({\n              responseType: 'json',\n              url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/labels`,\n              method: 'GET'\n            })\n            const content = apiLabels.map( label => ({\n              collectionId: collectionId,\n              label,\n              text: SM.Manage.Collection.LabelTpl.apply(label),\n              node: 'label',\n              iconCls: 'sm-label-icon',\n              id: `${collectionId}-${label.name}-resource-labels-label-node`,\n              qtip: `Assets: ${SM.he(label.uses)}`\n            }) )\n            cb( content, { status: true } )\n            return\n          }\n          // Collection-Labels-STIG node\n          match = node.match(/^(\\d+)-(.*)-resource-labels-label-node$/)\n          if (match) {\n            const collectionId = match[1]\n            const label = this.attributes.label\n            const apiStig = await Ext.Ajax.requestPromise({\n              responseType: 'json',\n              url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/stigs`,\n              method: 'GET',\n              params: {\n                labelId: label.labelId\n              }\n            })\n            const content = apiStig.map(stig => ({\n              id: `${collectionId}-${label.labelName}-${stig.benchmarkId}-resource-leaf`,\n              text: SM.he(stig.benchmarkId),\n              leaf: true,\n              node: 'label-stig',\n              iconCls: 'sm-stig-icon',\n              stigName: stig.benchmarkId,\n              label,\n              collectionId,\n              benchmarkId: stig.benchmarkId,\n              qtip: `Assets: ${SM.he(stig.assetCount)}`\n            }))\n            cb(content, { status: true })\n            return\n          }\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n    }\n})\n  \nSM.Acl.ResourceAddBtn = Ext.extend(Ext.Button, {\n  initComponent: function () {\n    const config = {\n      disabled: true,\n      // height: 30,\n      // width: 150,\n      // margins: \"0 10 10 10\",\n      // icon: 'img/right-arrow-16.png',\n      iconCls: 'sm-add-assignment-icon',\n      // iconAlign: 'right',\n      // cls: 'x-btn-text-icon'\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n  \nSM.Acl.ResourceRemoveBtn = Ext.extend(Ext.Button, {\n  initComponent: function () {\n    const grid = this.grid\n    const config = {\n      disabled: true,\n      // height: 30,\n      // width: 150,\n      // margins: \"0 10 10 10\",\n      iconCls: 'sm-remove-assignment-icon',\n      // icon: 'img/left-arrow-16.png',\n      // iconAlign: 'left',\n      // cls: 'x-btn-text-icon',\n      listeners:{\n      click: function(){\n          const assigmentsToPurge = grid.getSelectionModel().getSelections()\n          grid.getStore().remove(assigmentsToPurge)\n        }\n      }\n}\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Acl.AssignedRulesGrid = Ext.extend(Ext.grid.EditorGridPanel, {\n  initComponent: function() {\n    const _this = this\n    const assignmentStore = new Ext.data.JsonStore({\n      fields: [\n        'benchmarkId',\n        'assetId',\n        'assetName',\n        'labelId',\n        'labelName',\n        'label',\n        'access',\n        {\n          name: 'sorter',\n          convert: (v, r) => {\n            let value\n            if (!r.assetName && !r.labelName && !r.benchmarkId) {\n              value = '!!!Sorttop'\n            }\n            else {\n              value = `${r.assetName ?? ''}${r.labelName ?? ''}${r.benchmarkId ?? ''}`.toLowerCase()\n            }\n            return value\n          }\n        }  \n      ],\n      root: this.root || '',\n      sortInfo: {\n          field: 'sorter',\n          direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      },\n      idProperty: v => `${v.benchmarkId}-${v.assetName}-${v.labelName}`,\n      listeners: {\n        add: function(){\n          // _this.setTitle('Asset-STIG Assignments (' + assignmentStore.getCount() + ')');\n        }, \n        remove: function(){\n          // _this.setTitle('Asset-STIG Assignments (' + assignmentStore.getCount() + ')');\n          //==========================================================\n          //DISABLE THE REMOVAL BUTTON AFTER EACH REMOVAL OF ASSIGMENTS\n          //==========================================================\n          _this.panel.removeButton.disable();\n        } \n      }  \n    })\n    const selectionModel = new Ext.grid.RowSelectionModel({\n      singleSelect: false,\n      listeners: {\n        rowselect: function(theSelModel, theRowIndex, therecord){\n          _this.panel.removeButton.enable();\n        },\n        rowdeselect: function(theSelModel, theRowIndex, therecord){\n          if (theSelModel.getCount()<1){\n            //==============================================\n            //WHEN THERE ARE NO MORE SELECTIONS, DISABLE THE \n            //\"REMOVE ASSIGNMENTS\" BUTTON\n            //==============================================\n            _this.panel.removeButton.disable();\n          }\n        }\n      }\n      \n    })\n\n    function renderResource (value, metadata, record) {\n      let html = ''\n      if (!record.data.assetName && !record.data.labelName && !record.data.benchmarkId) {\n        html += `<div class=\"sm-collection-icon sm-cell-with-icon\">Collection</div>`\n      }\n      if (record.data.assetName) {\n        html += `<div class=\"sm-asset-icon sm-cell-with-icon\">${record.data.assetName}</div>`\n      }\n      if (record.data.labelName) {\n        html += `<div class=\"sm-label-icon sm-cell-with-icon\">${SM.Manage.Collection.LabelTpl.apply(record.data.label)}</div>`\n      }\n      if (record.data.benchmarkId) {\n        html += `<div class=\"sm-stig-icon sm-cell-with-icon\">${record.data.benchmarkId}</div>`\n      }\n      return html\n    }\n\n    const accessData = [\n      ['rw'],\n      ['r']\n    ]\n    if (this.roleId === 1) {\n      accessData.push(['none'])\n    }\n\n    const accessComboBox = new Ext.form.ComboBox({\n      mode: 'local',\n      forceSelection: true,\n      autoSelect: true,\n      editable: false,\n      store: new Ext.data.SimpleStore({\n        fields: ['access'],\n        data: accessData\n      }),\n      valueField:'access',\n      displayField:'access',\n      monitorValid: false,\n      listeners: {\n        select: function (combo,record,index) {\n          if (combo.startValue !== combo.value ) {\n            combo.fireEvent(\"blur\");\n          } \n        }\n      },\n      triggerAction: 'all'\n    })\n\n    const columns = [\n      {\n        header: `Resource`,\n        dataIndex: 'sorter',\n        sortable: true,\n        width: 350,\n        renderer: renderResource\n      },\n      {\n        header: `Access`, \n        dataIndex: 'access',\n        sortable: true,\n        width: 100,\n        editor: accessComboBox\n      }\n    ]\n\n    const totalTextCmp = new SM.RowCountTextItem({ store: assignmentStore })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          gridBasename: 'Collection ACL',\n          exportType: 'grid',\n          iconCls: 'sm-export-icon',\n          text: 'CSV',\n          grid: this\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        totalTextCmp\n      ]\n    })\n\n    const config = {\n      name: 'access',\n      isFormField: true,\n      setValue: function(acl) {\n        assignmentStore.loadData(acl.map(rule=>({\n          benchmarkId: rule.benchmarkId,\n          assetId: rule.asset?.assetId,\n          assetName: rule.asset?.name,\n          labelId: rule.label?.labelId,\n          labelName: rule.label?.name,\n          label: rule.label,\n          access: rule.access\n        })))\n      },\n      getValue: function() {\n        let rules = [];\n        assignmentStore.each(function(record){\n          rules.push({\n            benchmarkId: record.data.benchmarkId || undefined,\n            assetId: record.data.assetId || undefined,\n            labelId: record.data.labelId || undefined,\n            access: record.data.access\n          })\n        })\n        return rules\n      },\n      markInvalid: Ext.emptyFn,\n      clearInvalid: Ext.emptyFn,\n      isValid: function() { return true},\n      disabled: false,\n      getName: function() {return this.name},\n      validate: function() { return true},\n      // width: _this.width || 400,\n      store: assignmentStore,\n      view: new SM.ColumnFilters.GridView({\n        emptyText: this.emptyText || 'No records to display',\n        forceFit: true,\n        markDirty: false\n      }),\n      stripeRows: true,\n      sm: selectionModel,\n      columns,\n      bbar,\n      listeners: {\n        keydown: SM.CtrlAGridHandler\n      }\n    }\n    \n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Acl.Panel = Ext.extend(Ext.Panel, {\n  // config: {collectionId, userId}\n  initComponent: function() {\n    const navTree = new SM.Acl.ResourceTreePanel({\n      panel: this,\n      title: 'Collection Resources',\n      width: 300,\n      collectionId: this.collectionId,\n      listeners: {\n        click: handleTreeClick\n      }\n    })\n\n    function handleTreeClick (node) {\n      switch (node.attributes.node){\n        case 'collection':\n        case 'stig':\n        case 'stig-asset':\n        case 'asset':\n        case 'asset-stig':\n        case 'label':\n        case 'label-stig':\n          addBtn.setDisabled(isTreeNodeInRulesGrid(node))\n          break\n        default:\n          addBtn.disable()\n          break\n      }\n    }\n\n    function handleAddBtnItem(item) {\n      const selectedNode = navTree.getSelectionModel().getSelectedNode()\n      makeAssignment(selectedNode, item.access);\n    }\n\n    function makeAssignment(selectedNode, access) {\n      const assignment = {\n        benchmarkId:selectedNode.attributes.benchmarkId, \n        assetId:selectedNode.attributes.assetId, \n        assetName: selectedNode.attributes.assetName,\n        labelId:selectedNode.attributes.label?.labelId, \n        labelName: selectedNode.attributes.label?.name,\n        label: selectedNode.attributes.label,\n        access\n      }\n      const store = assignedRulesGrid.getStore()\n      store.loadData(assignment, true)\n      store.sort(store.sortInfo.field, store.sortInfo.direction)\n    }\n\n    const assignedRulesGrid = new SM.Acl.AssignedRulesGrid({\n      panel: this,\n      roleId: this.roleId,\n      title: `Assigned ACL`,\n      flex: 1\n    })\n\n    function isTreeNodeInRulesGrid(node) {\n      const candidateId = `${node.attributes.benchmarkId ?? 'undefined'}-${node.attributes.assetName ?? 'undefined'}-${node.attributes.label?.name ?? 'undefined'}`\n      const record = assignedRulesGrid.store.getById(candidateId)\n      return !!record\n    }\n\n    this.assignmentGrid = assignedRulesGrid\n\n    const addBtnMenuItems = [\n      {text: 'with Read/Write access', iconCls: 'sm-add-assignment-icon', access: 'rw', handler: handleAddBtnItem},\n      {text: 'with Read Only access', iconCls: 'sm-add-assignment-icon', access: 'r', handler: handleAddBtnItem},\n    ]\n    if (this.roleId === 1) addBtnMenuItems.push({text: 'with No access', iconCls: 'sm-add-assignment-icon', access: 'none', handler: handleAddBtnItem})\n    const addBtn = new SM.Acl.ResourceAddBtn({\n      tree: navTree,\n      margins: \"10 0 10 0\",\n      text: 'Add',\n      grid: assignedRulesGrid,\n      menu: new Ext.menu.Menu({\n        items: addBtnMenuItems\n      })\n    })\n    this.addButton = addBtn\n\n    const removeBtn = new SM.Acl.ResourceRemoveBtn({\n      tree: navTree,\n      text: 'Remove',\n      grid: assignedRulesGrid\n    })\n    this.removeButton = removeBtn\n\n    const buttonPanel = new Ext.Panel({\n      bodyStyle: 'background-color:transparent;border:none',\n      width: 100,\n      layout: {\n        type: 'vbox',\n        pack: 'center',\n        align: 'center',\n        padding: \"10 10 10 10\"\n      },\n      items: [\n        addBtn,\n        removeBtn\n      ]\n    })\n\n    const config = {\n      bodyStyle: 'background:transparent;border:none',\n      assignmentGrid: assignedRulesGrid,\n      layout: 'hbox',\n      anchor: '100% -130',\n      layoutConfig: {\n        align: 'stretch'\n      },\n      items: [ \n        navTree,\n        buttonPanel,\n        assignedRulesGrid\n      ]\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Acl.showAccess = async function(collectionId, grantRecord) {\n  try {\n    async function onSave () {\n      try {\n        await Ext.Ajax.requestPromise({\n          url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/grants/${grantRecord.grantId}/acl`,\n          method: 'PUT',\n          headers: { 'Content-Type': 'application/json;charset=utf-8' },\n          jsonData: assignmentPanel.assignmentGrid.getValue()\n        })      \n      }\n      catch (e) {\n        SM.Error.handleError(e)\n      }\n      finally {\n        appwindow.close()\n      }\n    }\n\n    const assignmentPanel = new SM.Acl.Panel({\n        collectionId,\n        roleId: grantRecord.roleId\n    })\n\n    const appwindow = new Ext.Window({\n      title: `Access Control List for ${grantRecord.name}`,\n      cls: 'sm-dialog-window sm-round-panel',\n      modal: true,\n      hidden: true,\n      width: 900,\n      height:600,\n      layout: 'fit',\n      plain:true,\n      bodyStyle:'padding:20px;',\n      buttonAlign:'right',\n      items: assignmentPanel,\n      buttons: [\n        {\n          text: 'Cancel',\n          handler: () => appwindow.close()\n        },\n        {\n          text: 'Save',\n          handler: onSave\n        }\n      ]\n    })\n\n    appwindow.show()\n\n    const timeoutId = setTimeout(() => {\n      assignmentPanel.assignmentGrid.view.scroller.mask('Getting ACL...')\n    }, 250)\n    const apiAccess = await Ext.Ajax.requestPromise({\n      responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/grants/${grantRecord.grantId}/acl`,\n        method: 'GET'\n    })\n    assignmentPanel.assignmentGrid.setValue(apiAccess.acl)\n    assignmentPanel.assignmentGrid.setTitle(`ACL Rules, default access = ${apiAccess.defaultAccess}`)   \n    clearTimeout(timeoutId)\n    assignmentPanel.assignmentGrid.view.scroller.unmask()\n  }\n  catch (e) {\n    SM.Error.handleError(e)\n    assignmentPanel.assignmentGrid.view.scroller.unmask()\n  }\n}\n"
  },
  {
    "path": "client/src/js/SM/ActivityHandler.js",
    "content": "class ActivityHandler {\n  #lastMessageTime = 0;\n  #messageTime = 0;\n  #messageThrottle = 1000; // 1 second\n\n  #events = ['click', 'keypress', 'scroll'];\n  #boundHandler = null;\n\n  #logPrefix = '[ActivityHandler]';\n  reportActivity = true;\n  \n  add() {\n    if (!this.#boundHandler && this.reportActivity) {\n      this.#boundHandler = this.throttledActiveMessage.bind(this);\n      this.#events.forEach(event => {\n        window.addEventListener(event, this.#boundHandler, true);\n      });\n      console.log(`${this.#logPrefix} activity event handlers added`);\n    } \n  }\n\n  remove() {\n    if (this.#boundHandler) {\n      this.#events.forEach(event => {\n        window.removeEventListener(event, this.#boundHandler, true);\n      });\n      this.#boundHandler = null;\n      console.log(`${this.#logPrefix} activity event handlers removed`);\n    }\n  }\n\n  throttledActiveMessage() {\n    this.#messageTime = Date.now();\n    if (this.#messageTime - this.#lastMessageTime >= this.#messageThrottle) {\n      window.oidcWorker.postContextActiveMessage();\n      this.#lastMessageTime = this.#messageTime;\n      console.log(`${this.#logPrefix} contextActive message posted to OIDC worker`);\n    }\n  }\n}\n\nSM.ActivityHandler = new ActivityHandler();\n"
  },
  {
    "path": "client/src/js/SM/Ajax.js",
    "content": "Ext.lib.Ajax = function() {\n    var activeX = ['Msxml2.XMLHTTP.3.0',\n                   'Msxml2.XMLHTTP'],\n        CONTENTTYPE = 'Content-Type';\n\n    // private\n    function setHeader(o) {\n        var conn = o.conn,\n            prop,\n            headers = {};\n\n        function setTheHeaders(conn, headers){\n            for (prop in headers) {\n                if (headers.hasOwnProperty(prop)) {\n                    conn.setRequestHeader(prop, headers[prop]);\n                }\n            }\n        }\n\n        Ext.apply(headers, pub.headers, pub.defaultHeaders);\n        setTheHeaders(conn, headers);\n        delete pub.headers;\n    }\n\n    // private\n    function createExceptionObject(tId, callbackArg, isAbort, isTimeout) {\n        return {\n            tId : tId,\n            status : isAbort ? -1 : 0,\n            statusText : isAbort ? 'transaction aborted' : 'communication failure',\n            isAbort: isAbort,\n            isTimeout: isTimeout,\n            argument : callbackArg\n        };\n    }\n\n    // private\n    function initHeader(label, value) {\n        (pub.headers = pub.headers || {})[label] = value;\n    }\n\n    // private\n    function createResponseObject(o, callbackArg) {\n        var headerObj = {},\n            headerStr,\n            conn = o.conn,\n            t,\n            s,\n            // see: https://prototype.lighthouseapp.com/projects/8886/tickets/129-ie-mangles-http-response-status-code-204-to-1223\n            isBrokenStatus = conn.status == 1223;\n\n        try {\n            headerStr = o.conn.getAllResponseHeaders();\n            Ext.each(headerStr.replace(/\\r\\n/g, '\\n').split('\\n'), function(v){\n                t = v.indexOf(':');\n                if(t >= 0){\n                    s = v.substr(0, t).toLowerCase();\n                    if(v.charAt(t + 1) == ' '){\n                        ++t;\n                    }\n                    headerObj[s] = v.substr(t + 1);\n                }\n            });\n        } catch(e) {}\n\n        return {\n            tId : o.tId,\n            // Normalize the status and statusText when IE returns 1223, see the above link.\n            status : isBrokenStatus ? 204 : conn.status,\n            statusText : isBrokenStatus ? 'No Content' : conn.statusText,\n            getResponseHeader : function(header){return headerObj[header.toLowerCase()];},\n            getAllResponseHeaders : function(){return headerStr;},\n            responseText : conn.responseText,\n            responseXML : conn.responseXML,\n            argument : callbackArg\n        };\n    }\n\n    // private\n    function releaseObject(o) {\n        if (o.tId) {\n            pub.conn[o.tId] = null;\n        }\n        o.conn = null;\n        o = null;\n    }\n\n    // private\n    function handleTransactionResponse(o, callback, isAbort, isTimeout) {\n        if (!callback) {\n            releaseObject(o);\n            return;\n        }\n\n        var httpStatus, responseObject;\n\n        try {\n            if (o.conn.status !== undefined && o.conn.status != 0) {\n                httpStatus = o.conn.status;\n            }\n            else {\n                httpStatus = 13030;\n            }\n        }\n        catch(e) {\n            httpStatus = 13030;\n        }\n\n        if ((httpStatus >= 200 && httpStatus < 300) || (Ext.isIE && httpStatus == 1223)) {\n            responseObject = createResponseObject(o, callback.argument);\n            if (callback.success) {\n                if (!callback.scope) {\n                    callback.success(responseObject);\n                }\n                else {\n                    callback.success.apply(callback.scope, [responseObject]);\n                }\n            }\n        }\n        else {\n            switch (httpStatus) {\n                case 12002:\n                case 12029:\n                case 12030:\n                case 12031:\n                case 12152:\n                case 13030:\n                    responseObject = createExceptionObject(o.tId, callback.argument, (isAbort ? isAbort : false), isTimeout);\n                    if (callback.failure) {\n                        if (!callback.scope) {\n                            callback.failure(responseObject);\n                        }\n                        else {\n                            callback.failure.apply(callback.scope, [responseObject]);\n                        }\n                    }\n                    break;\n                default:\n                    responseObject = createResponseObject(o, callback.argument);\n                    if (callback.failure) {\n                        if (!callback.scope) {\n                            callback.failure(responseObject);\n                        }\n                        else {\n                            callback.failure.apply(callback.scope, [responseObject]);\n                        }\n                    }\n            }\n        }\n\n        releaseObject(o);\n        responseObject = null;\n    }\n    \n    function checkResponse(o, callback, conn, tId, poll, cbTimeout){\n        if (conn && conn.readyState == 4) {\n            clearInterval(poll[tId]);\n            poll[tId] = null;\n\n            if (cbTimeout) {\n                clearTimeout(pub.timeout[tId]);\n                pub.timeout[tId] = null;\n            }\n            handleTransactionResponse(o, callback);\n        }\n    }\n    \n    function checkTimeout(o, callback){\n        pub.abort(o, callback, true);\n    }\n    \n\n    // private\n    function handleReadyState(o, callback){\n        callback = callback || {};\n        var conn = o.conn,\n            tId = o.tId,\n            poll = pub.poll,\n            cbTimeout = callback.timeout || null;\n\n        if (cbTimeout) {\n            pub.conn[tId] = conn;\n            pub.timeout[tId] = setTimeout(checkTimeout.createCallback(o, callback), cbTimeout);\n        }\n        poll[tId] = setInterval(checkResponse.createCallback(o, callback, conn, tId, poll, cbTimeout), pub.pollInterval);\n    }\n\n    // private\n    function asyncRequest(method, uri, callback, postData) {\n        var o = getConnectionObject() || null;\n\n        if (o && window.oidcWorker.token) {\n            o.conn.open(method, uri, true);\n\n            initHeader('Authorization', 'Bearer ' + window.oidcWorker.token)\n\n            if (pub.useDefaultXhrHeader) {\n                initHeader('X-Requested-With', pub.defaultXhrHeader);\n            }\n\n            if(postData && pub.useDefaultHeader && (!pub.headers || !pub.headers[CONTENTTYPE])){\n                initHeader(CONTENTTYPE, pub.defaultPostHeader);\n            }\n\n            if (pub.defaultHeaders || pub.headers) {\n                setHeader(o);\n            }\n\n            handleReadyState(o, callback);\n            o.conn.send(postData || null);\n        }\n        return o;\n    }\n\n    // private\n    function getConnectionObject() {\n        var o;\n\n        try {\n            if (o = createXhrObject(pub.transactionId)) {\n                pub.transactionId++;\n            }\n        } catch(e) {\n        } finally {\n            return o;\n        }\n    }\n\n    // private\n    function createXhrObject(transactionId) {\n        var http;\n\n        try {\n            http = new XMLHttpRequest();\n        } catch(e) {\n            for (var i = Ext.isIE6 ? 1 : 0; i < activeX.length; ++i) {\n                try {\n                    http = new ActiveXObject(activeX[i]);\n                    break;\n                } catch(e) {}\n            }\n        } finally {\n            return {conn : http, tId : transactionId};\n        }\n    }\n\n    var pub = {\n        request : function(method, uri, cb, data, options) {\n            if(options){\n                var me = this,\n                    xmlData = options.xmlData,\n                    jsonData = options.jsonData,\n                    hs;\n\n                Ext.applyIf(me, options);\n\n                if(xmlData || jsonData){\n                    hs = me.headers;\n                    if(!hs || !hs[CONTENTTYPE]){\n                        initHeader(CONTENTTYPE, xmlData ? 'text/xml' : 'application/json');\n                    }\n                    data = xmlData || (!Ext.isPrimitive(jsonData) ? Ext.encode(jsonData) : jsonData);\n                }\n            }\n            return asyncRequest(method || options.method || \"POST\", uri, cb, data);\n        },\n\n        serializeForm : function(form) {\n            var fElements = form.elements || (document.forms[form] || Ext.getDom(form)).elements, \n                hasSubmit = false, \n                encoder = encodeURIComponent, \n                name, \n                data = '', \n                type, \n                hasValue;\n    \n            Ext.each(fElements, function(element){\n                name = element.name;\n                type = element.type;\n        \n                if (!element.disabled && name) {\n                    if (/select-(one|multiple)/i.test(type)) {\n                        Ext.each(element.options, function(opt){\n                            if (opt.selected) {\n                                hasValue = opt.hasAttribute ? opt.hasAttribute('value') : opt.getAttributeNode('value').specified;\n                                data += String.format(\"{0}={1}&\", encoder(name), encoder(hasValue ? opt.value : opt.text));\n                            }\n                        });\n                    } else if (!(/file|undefined|reset|button/i.test(type))) {\n                        if (!(/radio|checkbox/i.test(type) && !element.checked) && !(type == 'submit' && hasSubmit)) {\n                            data += encoder(name) + '=' + encoder(element.value) + '&';\n                            hasSubmit = /submit/i.test(type);\n                        }\n                    }\n                }\n            });\n            return data.substr(0, data.length - 1);\n        },\n\n        useDefaultHeader : true,\n        defaultPostHeader : 'application/json',\n        useDefaultXhrHeader : true,\n        defaultXhrHeader : 'XMLHttpRequest',\n        poll : {},\n        timeout : {},\n        conn: {},\n        pollInterval : 50,\n        transactionId : 0,\n\n//  This is never called - Is it worth exposing this?\n//          setProgId : function(id) {\n//              activeX.unshift(id);\n//          },\n\n//  This is never called - Is it worth exposing this?\n//          setDefaultPostHeader : function(b) {\n//              this.useDefaultHeader = b;\n//          },\n\n//  This is never called - Is it worth exposing this?\n//          setDefaultXhrHeader : function(b) {\n//              this.useDefaultXhrHeader = b;\n//          },\n\n//  This is never called - Is it worth exposing this?\n//          setPollingInterval : function(i) {\n//              if (typeof i == 'number' && isFinite(i)) {\n//                  this.pollInterval = i;\n//              }\n//          },\n\n//  This is never called - Is it worth exposing this?\n//          resetDefaultHeaders : function() {\n//              this.defaultHeaders = null;\n//          },\n\n        abort : function(o, callback, isTimeout) {\n            var me = this,\n                tId = o.tId,\n                isAbort = false;\n\n            if (me.isCallInProgress(o)) {\n                o.conn.abort();\n                clearInterval(me.poll[tId]);\n                me.poll[tId] = null;\n                clearTimeout(pub.timeout[tId]);\n                me.timeout[tId] = null;\n\n                handleTransactionResponse(o, callback, (isAbort = true), isTimeout);\n            }\n            return isAbort;\n        },\n\n        isCallInProgress : function(o) {\n            // if there is a connection and readyState is not 0 or 4\n            return o.conn && !{0:true,4:true}[o.conn.readyState];\n        }\n    };\n    return pub;\n}();"
  },
  {
    "path": "client/src/js/SM/ApiState.js",
    "content": "if (STIGMAN.Env.stateEvents && window.stateWorker?.workerChannel) {\n  Ext.ns('SM.ApiState');\n\n  SM.ApiState.AlertModal = Ext.extend(Ext.Window, {\n    initComponent: function () {\n      const title = `<div class=\"sm-alert-icon\" style=\"padding-left:20px\">Service Alert</div>`;\n      const config = {\n        title,\n        width: 400,\n        closable: false, \n        modal: true,\n      };\n      Ext.apply(this, Ext.apply(this.initialConfig, config));\n      this.superclass().initComponent.call(this);\n    }\n  });\n\n  // Utility to ensure only one alert is visible at a time\n  // If called with no arguments, closes any existing alert\n  SM.ApiState.showModal = function (modal = null) {\n    if (this.alertModal) {\n      this.alertModal.close();\n      this.alertModal = null;\n    }\n    if (modal) {\n      this.alertModal = modal;\n      modal.show();\n    }\n  };\n\n  // Handler for unavailable state\n  SM.ApiState.handleUnavailableState = function (state) {\n    const online = '<span class=\"sm-label-sprite\" style=\"color:#ddd; background-color:green; margin-right: 10px;\">Online</span>';\n    const offline = '<span class=\"sm-label-sprite\" style=\"color:#ddd; background-color:#940000; margin-right: 10px;\">Offline</span>';\n    const html = `<div style=\"padding: 10px\">\n    <p><b>The API is currently unavailable</b></p>\n    <br>\n    <p>Database: ${state?.dependencies?.db ? online : offline} Authentication: ${state?.dependencies?.oidc ? online : offline}</p>\n    </div>`;\n    const modal = new SM.ApiState.AlertModal({ html, closable: false, modal: true, cls: 'sm-round-panel sm-unavailable-modal' });\n    SM.ApiState.showModal(modal);\n  };\n\n  // Handler for state error\n  SM.ApiState.handleStateError = function () {\n    if (!this.alertModal?.offlineAlert) {\n      const html = `<div style=\"padding: 10px\">\n      <p><b>The API is offline. Waiting for restoration...</b></p>\n      </div>`;\n      const modal = new SM.ApiState.AlertModal({ offlineAlert: true, html, cls: 'sm-round-panel sm-offline-modal' });\n      SM.ApiState.showModal(modal);\n    }\n  };\n\n  // Main message handler\n  SM.ApiState.handleBroadcastMessage = function (event) {\n    console.log('[State Broadcast] Received message:', event.data);\n    const state = SM.safeJSONParse(event.data.data);\n    const type = event.data.type;\n\n    if (type === 'state-changed') {\n      if (state?.currentState !== 'available') {\n        this.handleUnavailableState(state);\n      } else {\n        this.showModal(); // Close any existing alert\n      }\n    }\n    else if (type === 'state-error') {\n      this.handleStateError();\n    }\n    else if (type === 'state-report' && state?.currentState === 'available') {\n      this.showModal(); // Close any existing alert \n    }\n  };\n\n  window.stateWorker.workerChannel.onmessage = SM.ApiState.handleBroadcastMessage.bind(SM.ApiState);\n}\n\n\n\n\n\n"
  },
  {
    "path": "client/src/js/SM/AppData.js",
    "content": "Ext.ns('SM.AppData')\n\nSM.AppData.FormatComboBox = Ext.extend(Ext.form.ComboBox, {\n  initComponent: function () {\n      const config = {\n        fieldLabel: 'Format',\n        displayField: 'display',\n        valueField: 'value',\n        triggerAction: 'all',\n        mode: 'local',\n        editable: false,\n        value: 'gzip'\n      }\n      this.store = new Ext.data.SimpleStore({\n        fields: ['value', 'display'],\n        data: [\n          ['gzip', 'GZip'],\n          ['jsonl', 'JSONL']\n        ]\n      })\n\n      Ext.apply(this, Ext.apply(this.initialConfig, config))\n      this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppData.DownloadButton = Ext.extend(Ext.Button, {\n  initComponent: function () {\n    const config = {\n      text: 'Download Application Data&nbsp;',\n      iconCls: 'sm-export-icon',\n      handler: this._handler\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n\n  },\n  _handler: async function () {\n    try {\n      await SM.AppData.doDownload(this.formatCombo.value)\n    }\n    catch (e) {\n      SM.Error.handleError(e)\n    }\n    finally {\n      Ext.getBody().unmask();\n    }\n  }\n})\n\nSM.AppData.ReplaceButton = Ext.extend(Ext.Button, {\n  initComponent: function () {\n    const config = {\n      text: 'Replace Application Data...&nbsp;',\n      iconCls: 'sm-import-icon',\n      handler: this._handler\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n\n  },\n  _handler: async function () {\n    try {\n      SM.AppData.doReplace()\n    }\n    catch (e) {\n      SM.Error.handleError(e)\n    }\n    finally {\n      Ext.getBody().unmask();\n    }\n  }\n})\n\nSM.AppData.ManagePanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    this.formatCombo = new SM.AppData.FormatComboBox({\n      width: 120\n    })\n    this.downloadBtn = new SM.AppData.DownloadButton({\n      style: 'padding-top: 5px',\n      formatCombo: this.formatCombo\n    })\n    this.replaceBtn = new SM.AppData.ReplaceButton({\n      padding: 10\n    })\n    const config = {\n      items: [\n        {\n          xtype: 'fieldset',\n          labelWidth: 50,\n          width: 200,\n          title: 'Export',\n          items: [\n            this.formatCombo, \n            this.downloadBtn\n          ]\n        },\n        {\n          xtype: 'fieldset',\n          width: 200,\n          title: 'Import',\n          items: [this.replaceBtn]\n        }\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.AppData.ReplacePanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    this.selectFileBtn = new Ext.ux.form.FileUploadField({\n      buttonOnly: true,\n      accept: '.gz, .jsonl',\n      webkitdirectory: false,\n      multiple: false,\n      style: 'width: 95px;',\n      buttonText: `Select appdata file...`,\n      buttonCfg: {\n        icon: \"img/disc_drive.png\"\n      },\n      listeners: {\n        fileselected: this.onFileSelected\n      }\n    })\n    this.textarea = new Ext.form.TextArea({\n      buffer: '',\n      anchor: '100%, -10',\n      border: false,\n      readOnly: true\n    })\n    this.progress = new Ext.ProgressBar({\n      width: 300\n    })\n\n    this.actionButton = new Ext.Button({\n      text: 'Replace Application Data',\n      disabled: true,\n      handler: this.btnHandler\n    })\n\n    const config = {\n      layout: 'anchor',\n      border: false,\n      items: [this.textarea],\n      tbar: [\n        this.selectFileBtn,\n        '->',\n        this.progress\n      ],\n      buttons: [this.actionButton]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  },\n  updateProgress: function (value, text) {\n    this.progress.updateProgress(value, SM.he(text))\n  },\n  setProgressErrorState: function (isError) {\n    if (isError) {\n      this.progress.addClass('sm-pb-error')\n    }\n    else {\n      this.progress.removeClass('sm-pb-error')\n    }\n  },\n  updateStatusText: function (text, noNL = false, replace = false) {\n    const ta = this.textarea\n    if (replace) ta.buffer = ''\n    if (noNL) {\n      ta.buffer += text;\n    } else {\n      ta.buffer += text + \"\\n\"\n    }\n    ta.setRawValue(ta.buffer)\n    ta.getEl().dom.scrollTop = 99999 // scroll to bottom\n  }\n})\n\nSM.AppData.doDownload = async function (format = 'gzip') {\n  try {\n    \n    const fetchInit = {\n      url: `${STIGMAN.Env.apiBase}/op/appdata?format=${format}&elevate=true`,\n      method: 'GET',\n      headers: {\n        'Authorization': `Bearer ${window.oidcWorker.token}`\n      }\n    }\n    const href = await SM.ServiceWorker.getDownloadUrl(fetchInit)\n    if (href) {\n      window.location = href\n      return\n    }\n  }\n  catch (e) {\n    SM.Error.handleError(e)\n  }\n}\n\n{\n  class JSONLObjectStream extends TransformStream {\n  constructor (separator = '\\n') {\n    /**\n     * buffer - stores string from incoming chunk\n     * @type {string}\n     */\n    let buffer = ''\n    /**\n     * splitRegExp - RegExp to split including any trailing separator\n     */\n    const splitRegExp = new RegExp(`(?<=${separator})`)\n\n    super({\n      transform (chunk, controller) {\n        buffer += chunk\n\n        /** @type {string[]} */\n        const candidates = buffer.split(splitRegExp)\n\n        /** @type {number} */\n        const lastIndex = candidates.length - 1\n\n        buffer = ''\n\n        /** index @type {number} */\n        /** candidate @type {string} */\n        for (const [index, candidate] of candidates.entries()) {\n          if (index === lastIndex && !candidate.endsWith(separator)) {\n            // this is the last candidate and there's no trailing separator\n            // initialize buffer for next _transform() or _flush()\n            buffer = candidate\n          }\n          else if (candidate.startsWith('{')) {\n            const record = SM.safeJSONParse(candidate)\n            if (record) {\n              // write any parsed Object\n              controller.enqueue(record)\n            }\n          }\n        }\n      },\n      flush (controller) {\n        // if what's left in the buffer is a parsable Object, write it\n        if (buffer.startsWith('{')) {\n          const record = SM.safeJSONParse(buffer)\n          if (record) {\n            // write any parsed Object\n            controller.enqueue(record)\n          }\n        }\n      }\n    })\n  }\n}\nSM.AppData.JSONLObjectStream = JSONLObjectStream\n}\n\n{\n  class FileReaderProgressStream extends TransformStream {\n    constructor (fileSize, progressFn) {\n      let readSize = 0\n      super({\n        async transform(chunk, controller) {\n          readSize += chunk.length\n          progressFn(readSize/fileSize, 'Analyzing')\n          await new Promise(resolve => setTimeout(resolve, 0)) // let DOM update\n          controller.enqueue(chunk)\n        }\n      })\n    }\n  }\n  SM.AppData.FileReaderProgressStream = FileReaderProgressStream\n}\n\nSM.AppData.doReplace = function () {\n  const rp = new SM.AppData.ReplacePanel({\n    onFileSelected,\n    btnHandler\n  })\n\n  new Ext.Window({\n    title: 'Replace Application Data',\n    cls: 'sm-dialog-window sm-round-panel',\n    modal: true,\n    width: 500,\n    height: 400,\n    layout: 'fit',\n    plain: true,\n    bodyStyle: 'padding:5px;',\n    buttonAlign: 'center',\n    items: rp,\n    onEsc: Ext.emptyFn\n  }).show(document.body)\n  rp.updateStatusText('No file has been selected', true, true)\n\n  function btnHandler (btn) {\n    if (btn.fileObj) upload(btn.fileObj)\n  }\n\n  async function analyze (fileObj) {\n    try {\n      rp.actionButton.disable()\n      rp.setProgressErrorState(false)\n      rp.updateProgress(0, 'Analyzing')\n      rp.updateStatusText('', true, true)\n\n      let objectStream\n      if (fileObj.type === 'application/gzip' || fileObj.type === 'application/x-gzip') {\n        objectStream = fileObj.stream()\n          .pipeThrough(new SM.AppData.FileReaderProgressStream(fileObj.size, rp.updateProgress.bind(rp)))\n          .pipeThrough(new DecompressionStream(\"gzip\"))\n          .pipeThrough(new TextDecoderStream())\n          .pipeThrough(new SM.AppData.JSONLObjectStream())\n      }\n      else {\n        objectStream = fileObj.stream()\n        .pipeThrough(new SM.AppData.FileReaderProgressStream(fileObj.size, rp.updateProgress.bind(rp)))\n        .pipeThrough(new TextDecoderStream())\n        .pipeThrough(new SM.AppData.JSONLObjectStream())\n      }\n\n      const fileData = {\n        version: false,\n        tableData: null\n      }\n      for await (const object of objectStream) {\n        if (object.version) {\n          fileData.version = object.version\n          rp.updateStatusText(`File is from STIG Manager version ${object.version}`)\n          if (object.date) {\n            rp.updateStatusText(`File is dated ${object.date}`)\n          }\n          if (object.lastMigration) {\n            fileData.lastMigration = object.lastMigration\n            rp.updateStatusText(`File is from migration ${object.lastMigration}. Current API migration is ${STIGMAN.apiConfig.lastMigration}.`)\n            if (fileData.lastMigration > STIGMAN.apiConfig.lastMigration) {\n              rp.updateStatusText(`Cannot import to lower API migration.`)\n              break\n            }\n          }\n        }\n        if (object.tables) fileData.tableData = object\n        if (object.table) rp.updateStatusText(`Found data for table: ${object.table}, rowCount: ${object.rowCount}`)\n        await new Promise(resolve => setTimeout(resolve, 10))\n      }\n      if (fileData.lastMigration <= STIGMAN.apiConfig.lastMigration && fileData.tableData) {\n        rp.updateProgress(1, 'Valid')\n        rp.updateStatusText(`\\n**** VALID source file, click \"Replace Application Data\" to upload to API`)\n        rp.actionButton.fileObj = fileObj\n        rp.actionButton.enable()\n      }\n      else {\n        rp.updateStatusText(`\\n**** INVALID source file ****`)\n        rp.updateProgress(1, `Invalid`)\n        rp.setProgressErrorState(true)\n        rp.actionButton.disable()\n      }\n      return\n    }\n    catch (e) {\n      rp.updateStatusText(e.message)\n      rp.updateProgress(1, `Error: ${e.message}`)\n      rp.setProgressErrorState(true)\n      rp.actionButton.disable()\n    }\n  }\n\n  async function upload (fileObj) {\n    try {\n      if (fileObj.name.endsWith('.jsonl') ) {\n        fileObj = new File([fileObj], fileObj.name, {type: 'application/jsonl'})\n      }\n      rp.actionButton.disable()\n      rp.ownerCt.getTool('close')?.hide()\n\n      rp.updateStatusText('Sending file. Awaiting API response...', false, true)\n\n      \n      const response = await fetch(`${STIGMAN.Env.apiBase}/op/appdata?elevate=true`, {\n        method: 'POST',\n        headers: new Headers({\n          'Authorization': `Bearer ${window.oidcWorker.token}`\n        }),\n        body: fileObj\n      })\n\n      const objectStream = response.body\n      .pipeThrough(new TextDecoderStream())\n      .pipeThrough(new SM.AppData.JSONLObjectStream())\n\n      let totalRows = 0\n      let insertedRows = 0\n      let currentTable = ''\n\n      for await (const object of objectStream) {\n        if (object.totalRows) totalRows = object.totalRows\n        if (object.valueCount) {\n          currentTable = object.table\n          insertedRows += object.valueCount\n        }\n        rp.updateStatusText(JSON.stringify(object))\n        rp.updateProgress(insertedRows/totalRows, `Importing ${currentTable}`)\n        await new Promise(resolve => setTimeout(resolve, 10))\n      } \n      rp.updateStatusText('\\n**** REFRESH the web app to use the new data ****')\n      rp.updateProgress(1, 'Done')\n    }\n    catch (e) {\n      SM.Error.handleError(e)\n    }\n\n  }\n\n  async function onFileSelected (uploadField) {\n    try {\n      let input = uploadField.fileInput.dom\n      const files = [...input.files]\n      analyze(files[0])\n      uploadField.reset()\n    }\n    catch (e) {\n      uploadField.reset()\n      SM.Error.handleError(e)\n    }\n  }\n}\n\nSM.AppData.showAppDataTab = function (params) {\n  let { treePath } = params\n  const tab = Ext.getCmp('main-tab-panel').getItem('appdata-admin-tab')\n  if (tab) {\n    tab.show()\n    return\n  }\n\n  const appDataPanel = new SM.AppData.ManagePanel({\n    border: false,\n    // title: 'Application Data <span class=\"sm-navtree-sprite\">experimental</span>',\n    margins: { top: SM.Margin.adjacent, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n    cls: 'sm-round-panel',\n    height: 200,\n    labelWidth: 1,\n    hideLabel: true,\n    padding: 10\n  })\n\n  const thisTab = Ext.getCmp('main-tab-panel').add({\n    id: 'appdata-admin-tab',\n    sm_treePath: treePath,\n    iconCls: 'sm-database-save-icon',\n    title: 'Export/Import Data',\n    closable: true,\n    layout: 'fit',\n    items: [appDataPanel]\n  })\n  thisTab.show()\n}\n"
  },
  {
    "path": "client/src/js/SM/AppInfo.js",
    "content": "Ext.ns(\"SM.AppInfo\")\nExt.ns(\"SM.AppInfo.Collections\")\nExt.ns(\"SM.AppInfo.MySql\")\nExt.ns(\"SM.AppInfo.Requests\")\nExt.ns(\"SM.AppInfo.Users\")\nExt.ns(\"SM.AppInfo.Groups\")\nExt.ns(\"SM.AppInfo.Nodejs\")\nExt.ns(\"SM.AppInfo.ShareFile\")\n\nSM.AppInfo.numberFormat = new Intl.NumberFormat().format\n\nSM.AppInfo.numberRenderer = function (value) {\n    return value && value !== 0 ? SM.AppInfo.numberFormat(value) : `<span class=\"sm-render-zero\">${value}</span>`\n}\n\nSM.AppInfo.usernameLookup = {}\nSM.AppInfo.groupNameLookup = {}\n\nSM.AppInfo.uptimeString = function uptimeString(uptime) {\n  const days = Math.floor(uptime / 86400)\n  uptime %= 86400\n  const hours = Math.floor(uptime / 3600)\n  uptime %= 3600\n  const minutes = Math.floor(uptime / 60)\n  const seconds = Math.floor(uptime % 60)\n  return `${days}d ${hours}h ${minutes}m ${seconds}s`\n}\n\nSM.AppInfo.transformPreviousSchemas = function transform (input) {\n  if (input.schema === 'stig-manager-appinfo-v1.1') {\n    return input\n  }\n  // Before v1.1 (rbac-2), only \"restricted\" grants were reported, so the counts that get transformed here will not be directly comparable to v1.1 counts.\n  if (input.schema === 'stig-manager-appinfo-v1.0') {\n    return transform(transformV1_0(input))\n  }\n  // first version of appInfo had \"stigmanVersion\" property instead of \"version\"  \n  if (input.stigmanVersion){\n    return transform(transformV0_0(input))\n  }\n  // if neither version nor stigmanVersion, not a supported file.\n  else{\n    return false\n  }  \n\n  function transformV1_0(input) {\n    const o = {}\n    // shifts aclCount.users to aclCount.grants, creates grantId from userId and adds grantee object\n    function transformCountsByCollection(collections) {\n      const o = {}\n      for (const id in collections) {\n        const { aclCounts, grantCounts, ...keep } = collections[id]\n\n          \n        const grants = {}\n        for (const grantId in aclCounts.users) {\n          grants[grantId] = {\n            grantId: grantId,\n            grantee: {\n              userId: grantId,\n              groupId: null,\n            },\n            ...aclCounts.users[grantId]\n          }\n        }\n\n        o[id] = {\n          grants,\n          roleCounts: grantCounts,\n          ...keep\n        }\n        \n      }\n      return o\n    }\n\n    const v1_1 = {\n      date: input.date,\n      schema: 'stig-manager-appinfo-v1.1',\n      version: input.version,\n      collections: transformCountsByCollection(input.collections),\n      requests: input.requests,\n      users: input.users,\n      groups: {},\n      mysql: input.mysql,\n      nodejs: input.nodejs\n    }\n\n    return v1_1\n\n  }\n\n  function transformV0_0(input) {\n    // renames properties \"assetStigByCollection\" and \"restrictedGrantCountsByUser\"\n    function transformCountsByCollection(i) {\n      const o = {}\n      const padLength = Object.keys(i).at(-1).length\n      for (const id in i) {\n        const { \n          assetStigByCollection, \n          restrictedGrantCountsByUser, \n          assetsTotal, \n          assetsDisabled, \n          ruleCnt, \n          reviewCntTotal, \n          reviewCntDisabled,\n          labelCounts,\n          ...keep } = i[id]\n\n        // rename restrictedGrantCountsByUser properties to match aclCounts schema\n        for (const userId in restrictedGrantCountsByUser) {\n          restrictedGrantCountsByUser[userId].ruleCounts = {\n            rw: restrictedGrantCountsByUser[userId].stigAssetCount,\n            r: 0,\n            none: 0\n          }\n          delete restrictedGrantCountsByUser[userId].stigAssetCount\n        }\n\n        // rename grantCounts properties\n        const grantCounts = {\n          restricted: keep.grantCounts.accessLevel1,\n          full: keep.grantCounts.accessLevel2,\n          manage: keep.grantCounts.accessLevel3,\n          owner: keep.grantCounts.accessLevel4        \n        }\n        delete keep.grantCounts\n\n        // rename labelCounts properties\n        labelCounts.collectionLabels = labelCounts.collectionLabelCount\n        delete labelCounts.collectionLabelCount\n        labelCounts.labeledAssets = labelCounts.labeledAssetCount\n        delete labelCounts.labeledAssetCount\n        labelCounts.assetLabels = labelCounts.assetLabelCount\n        delete labelCounts.assetLabelCount\n\n        o[id] = {\n          name: id.padStart(padLength, '0'),\n          assets: assetsTotal - assetsDisabled,\n          assetsDisabled,\n          rules: ruleCnt,\n          reviews: reviewCntTotal - reviewCntDisabled,\n          reviewsDisabled: reviewCntDisabled,\n          ...keep,\n          assetStigRanges: transformAssetStigByCollection(assetStigByCollection),\n          aclCounts: {\n            users: restrictedGrantCountsByUser || {}\n          },\n          grantCounts,\n          labelCounts,\n          settings: {\n            fields: {\n              detail: {\n                enabled: null,\n                required: null\n              },\n              comment: {\n                enabled: null,\n                required: null\n              }\n            },\n            status: {\n              canAccept: null,\n              resetCriteria: null,\n              minAcceptGrant: null\n            }\n\n          }\n        }\n      }\n      return o\n    }\n\n    // renames property \"roles\" and removes the string \"other\"\n    function transformUserInfo(i) {\n      const o = {}\n      const padLength = Object.keys(i).at(-1).length\n      for (const id in i) {\n        const { roles, ...keep } = i[id]\n        o[id] = {\n          username: id.padStart(padLength, '0'),\n            ...keep,\n          privileges: roles?.filter(v => v !== 'other') || [],\n          roles: {\n            restricted: null,\n            full: null,\n            manage: null,\n            owner: null\n          }\n        }\n      }\n      return o\n    }\n\n    // remove counts of the \"other\" string\n    function transformUserPrivilegeCounts(i) {\n      for (const category in i) {\n        delete i[category].other\n      }\n      return i\n    }\n\n    // add count of privilege \"none\" to each category\n    // must be called after transforming userInfo\n    function addNoPrivilegeCount(i) {\n      const dataTime = Math.floor(new Date(i.dateGenerated) / 1000)\n      const thirtyDaysAgo = dataTime - (30 * 24 * 60 * 60)\n      const ninetyDaysAgo = dataTime - (90 * 24 * 60 * 60)\n\n      i.userPrivilegeCounts.overall.none = 0\n      i.userPrivilegeCounts.activeInLast90Days.none = 0\n      i.userPrivilegeCounts.activeInLast30Days.none = 0\n\n      for (const userId in i.userInfo) {\n        const user = i.userInfo[userId]\n        if (user.privileges.length === 0) {\n          i.userPrivilegeCounts.overall.none++\n          // Update counts for the last 30 and 90 days based on lastAccess\n          if (user.lastAccess >= ninetyDaysAgo) {\n            i.userPrivilegeCounts.activeInLast90Days.none++\n          }\n          if (user.lastAccess >= thirtyDaysAgo) {\n            i.userPrivilegeCounts.activeInLast30Days.none++\n          }\n        }\n      }\n    }\n\n    function transformAssetStigByCollection(i) {\n      i.range00 = i.assetCnt - (i.range01to05 + i.range06to10 + i.range11to15 + i.range16plus)\n      delete i.assetCnt\n      return i\n    }\n\n    const { operationIdStats, ...requestsKeep } = input.operationalStats\n    for (const opId in operationIdStats) {\n      operationIdStats[opId].errors = {}\n    }\n\n    input.userInfo = transformUserInfo(input.userInfo)\n    addNoPrivilegeCount(input)\n    transformUserPrivilegeCounts(input.userPrivilegeCounts)\n\n    function parseNodeUptimeString(uptimeString) {\n      const values = uptimeString.match(/\\d+/g)\n      return (parseInt(values[0]) * 86400) +\n        (parseInt(values[1]) * 3600) +\n        (parseInt(values[2]) * 60) +\n        parseInt(values[3])\n    }    \n\n    const v1_0 = {\n      date: input.dateGenerated,\n      schema: 'stig-manager-appinfo-v1.0',\n      version: input.stigmanVersion,\n      collections: transformCountsByCollection(input.countsByCollection),\n      requests: {\n        ...requestsKeep,\n        operationIds: operationIdStats\n      },\n      users: {\n        userInfo: input.userInfo,\n        userPrivilegeCounts: input.userPrivilegeCounts\n      },\n      mysql: {\n        version: input.mySqlVersion,\n        tables: input.dbInfo.tables,\n        variables: input.mySqlVariablesRaw,\n        status: input.mySqlStatusRaw\n      },\n      nodejs: {\n        version: 'v0.0.0',\n        uptime: parseNodeUptimeString(input.nodeUptime),\n        os: {},\n        environment: {},\n        memory: input.nodeMemoryUsageInMb,\n        cpus: []\n      }\n    }\n\n    return v1_0\n  }\n}\n\nSM.AppInfo.objectToRowsArray = function (obj, keyPropertyName) {\n  const rows = []\n  for (const prop of obj) {\n    rows.push({[keyPropertyName]: prop, ...obj[prop]})\n  }\n  return rows\n}\n\nSM.AppInfo.KeyValueGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const valueColumnId = Ext.id()\n    const fields = [\n      'key',\n      'value'\n    ]\n\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'key',\n      sortInfo: {\n        field: 'key',\n        direction: 'ASC'\n      }\n    })\n\n    const keyColumn = {\n      ...{\n        header: 'key',\n        width: 100,\n        dataIndex: 'key',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      ...this.keyColumnConfig\n    }\n\n    const valueColumn = {\n      ...{\n        header: 'value',\n        id: valueColumnId,\n        dataIndex: 'value',\n        sortable: true,\n        align: 'right',\n        renderer: v => {\n          const rendered = SM.AppInfo.numberRenderer(v)\n          return rendered === 'NaN' ? v : rendered\n        }\n      },\n      ...this.valueColumnConfig\n    }\n\n    const columns = [\n      keyColumn,\n      valueColumn\n    ]\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      deferEmptyText: false,\n      forceFit: this.forceFit ?? false,\n      markDirty: false,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      }\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          grid: this,\n          gridBasename: this.exportName || this.title || 'keys',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          noun: this.rowCountNoun ?? 'key',\n          iconCls: 'sm-circle-icon'\n        })\n      ]\n    })\n\n    function loadData(o) {\n      const rows = []\n      for (const key in o) {\n        rows.push({ key, value: o[key] })\n      }\n      this.store.loadData(rows)\n    }\n\n    const config = {\n      cls: this.cls ?? 'sm-round-panel',\n      autoExpandColumn: valueColumnId,\n      autoExpandMax: 500,\n      store,\n      view,\n      sm,\n      columns,\n      bbar,\n      loadData\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.JsonTreePanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    let tree\n    function loadData(data) {\n      tree = JsonView.createTree(data)\n      tree.isExpanded = true\n      if (this.body) {\n        this.body.dom.textContent = ''\n        JsonView.render(tree, this.body.dom)\n      }\n    }\n    function renderTree() {\n      if (tree) {\n        JsonView.render(tree, this.body.dom)\n      }\n    }\n\n    const config = {\n      bodyStyle: 'overflow-y:auto;',\n      loadData\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n    this.on('render', renderTree)\n  }\n})\n\nSM.AppInfo.Collections.OverviewGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      {\n        name: 'collectionId',\n        type: 'int'\n      },\n      'name',\n      'state',\n      'assets',\n      'assetsDisabled',\n      {\n        name: 'assetsTotal',\n        convert: (v, r) => r.assets + r.assetsDisabled\n      },\n      'uniqueStigs',\n      'stigAssignments',\n      'rules',\n      'reviews',\n      'reviewsDisabled',\n      {\n        name: 'reviewsTotal',\n        convert: (v, r) => r.reviews + r.reviewsDisabled\n      },\n      'grants',\n      {\n        name: 'countOfGrants',\n        convert: (v, r) => Object.keys(r.grants).length || 0\n      }\n    ]\n\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'collectionId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC'\n      }\n    })\n\n    const columns = [\n      {\n        header: \"Collection\",\n        width: 180,\n        dataIndex: 'name',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"Id\",\n        hidden: true,\n        dataIndex: 'collectionId',\n        sortable: true,\n      },\n      {\n        header: \"State\",\n        dataIndex: 'state',\n        sortable: true,\n        filter: { type: 'values' }\n      },\n      {\n        header: \"Assets\",\n        dataIndex: 'assets',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Assets Disabled\",\n        dataIndex: 'assetsDisabled',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Assets Total\",\n        hidden: true,\n        dataIndex: 'assetsTotal',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"STIGs\",\n        dataIndex: 'uniqueStigs',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Assignments\",\n        dataIndex: 'stigAssignments',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Rules\",\n        dataIndex: 'rules',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Reviews\",\n        dataIndex: 'reviews',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Reviews Disabled\",\n        dataIndex: 'reviewsDisabled',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Reviews Total\",\n        dataIndex: 'reviewsTotal',\n        hidden: true,\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Grants\",\n        dataIndex: 'countOfGrants',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      }\n    ]\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true,\n      listeners: {\n        rowselect: this.onRowSelect ?? Ext.emptyFn\n      }\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      forceFit: true,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      },\n      getRowClass: record => record.data.state === 'disabled' ? 'sm-row-disabled' : ''\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          grid: this,\n          gridBasename: this.exportName || this.title || 'collections',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          noun: 'collection',\n          iconCls: 'sm-collection-icon'\n        })\n      ]\n    })\n\n    const config = {\n      cls: this.cls ?? 'sm-round-panel',\n      store,\n      view,\n      sm,\n      columns,\n      bbar\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Collections.FullGridLocked = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      {\n        name: 'collectionId',\n        type: 'int'\n      },\n      'name',\n      'state',\n      'assets',\n      'assetsDisabled',\n      {\n        name: 'assetsTotal',\n        convert: (v, r) => r.assets + r.assetsDisabled\n      },\n      'uniqueStigs',\n      'stigAssignments',\n      'rules',\n      'reviews',\n      'reviewsDisabled',\n      {\n        name: 'reviewsTotal',\n        convert: (v, r) => r.reviews + r.reviewsDisabled\n      },\n      'grants',\n      {\n        name: 'countOfGrants',\n        convert: (v, r) => Object.keys(r.grants).length || 0\n      },\n      {\n        name: 'range00',\n        mapping: 'assetStigRanges.range00'\n      },\n      {\n        name: 'range01to05',\n        mapping: 'assetStigRanges.range01to05'\n      },\n      {\n        name: 'range06to10',\n        mapping: 'assetStigRanges.range06to10'\n      },\n      {\n        name: 'range11to15',\n        mapping: 'assetStigRanges.range11to15'\n      },\n      {\n        name: 'range16plus',\n        mapping: 'assetStigRanges.range16plus'\n      },\n      {\n        name: 'restricted',\n        mapping: 'roleCounts.restricted'\n      },\n      {\n        name: 'full',\n        mapping: 'roleCounts.full'\n      },\n      {\n        name: 'manage',\n        mapping: 'roleCounts.manage'\n      },\n      {\n        name: 'owner',\n        mapping: 'roleCounts.owner'\n      },\n      {\n        name: 'collectionLabels',\n        mapping: 'labelCounts.collectionLabels'\n      },\n      {\n        name: 'labeledAssets',\n        mapping: 'labelCounts.labeledAssets'\n      },\n      {\n        name: 'assetLabels',\n        mapping: 'labelCounts.assetLabels'\n      },\n      {\n        name: 'detailEnabled',\n        mapping: 'settings.fields.detail.enabled'\n      },\n      {\n        name: 'detailRequired',\n        mapping: 'settings.fields.detail.required'\n      },\n      {\n        name: 'commentEnabled',\n        mapping: 'settings.fields.comment.enabled'\n      },\n      {\n        name: 'commentRequired',\n        mapping: 'settings.fields.comment.required'\n      },\n      {\n        name: 'canAccept',\n        mapping: 'settings.status.canAccept'\n      },\n      {\n        name: 'resetCriteria',\n        mapping: 'settings.status.resetCriteria'\n      },\n      {\n        name: 'minAcceptGrant',\n        mapping: 'settings.status.minAcceptGrant'\n      }\n    ]\n\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'collectionId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC'\n      }\n    })\n\n    const columns = [\n      {\n        header: \"Name\",\n        locked: true,\n        width: 180,\n        dataIndex: 'name',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"Id\",\n        hidden: true,\n        dataIndex: 'collectionId',\n        sortable: true,\n      },\n      {\n        header: \"State\",\n        dataIndex: 'state',\n        sortable: true,\n        filter: { type: 'values' }\n      },\n      {\n        header: \"Assets\",\n        dataIndex: 'assets',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Assets Disabled\",\n        dataIndex: 'assetsDisabled',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Assets Total\",\n        hidden: true,\n        dataIndex: 'assetsTotal',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"STIGs\",\n        dataIndex: 'uniqueStigs',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Assignments\",\n        dataIndex: 'stigAssignments',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Rules\",\n        dataIndex: 'rules',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Reviews\",\n        dataIndex: 'reviews',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Reviews Disabled\",\n        dataIndex: 'reviewsDisabled',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Reviews Total\",\n        dataIndex: 'reviewsTotal',\n        hidden: true,\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Grants\",\n        dataIndex: 'countOfGrants',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },     \n      {\n        header: \"Range 0\",\n        dataIndex: 'range00',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Range 1-5\",\n        dataIndex: 'range01to05',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Range 6-10\",\n        dataIndex: 'range06to10',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Range 11-15\",\n        dataIndex: 'range11to15',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Range 16+\",\n        dataIndex: 'range16plus',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Restricted\",\n        dataIndex: 'restricted',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Full\",\n        dataIndex: 'full',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Manage\",\n        dataIndex: 'manage',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Owner\",\n        dataIndex: 'owner',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Labels\",\n        dataIndex: 'collectionLabels',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Labeled\",\n        dataIndex: 'labeledAssets',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Tags\",\n        dataIndex: 'assetLabels',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Detail Enabled\",\n        dataIndex: 'detailEnabled',\n        sortable: true\n      },\n      {\n        header: \"Detail Required\",\n        dataIndex: 'detailRequired',\n        sortable: true\n      },\n      {\n        header: \"Comment Enabled\",\n        dataIndex: 'commentEnabled',\n        sortable: true\n      },\n      {\n        header: \"Comment Required\",\n        dataIndex: 'commentRequired',\n        sortable: true\n      },\n      {\n        header: \"Can Accept\",\n        dataIndex: 'canAccept',\n        sortable: true\n      },\n      {\n        header: \"Reset Criteria\",\n        dataIndex: 'resetCriteria',\n        sortable: true\n      },\n      {\n        header: \"Accept Grant\",\n        dataIndex: 'minAcceptGrant',\n        sortable: true\n      }\n    ]\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true,\n      listeners: {\n        rowselect: this.onRowSelect ?? Ext.emptyFn\n      }\n    })\n\n    const view = new SM.ColumnFilters.GridViewLocking({\n      emptyText: this.emptyText || 'No records to display',\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      },\n      getRowClass: record => record.data.state === 'disabled' ? 'sm-row-disabled' : ''\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        // {\n        //   xtype: 'exportbutton',\n        //   hasMenu: false,\n        //   grid: this,\n        //   gridBasename: this.exportName || this.title || 'collections',\n        //   iconCls: 'sm-export-icon',\n        //   text: 'CSV'\n        // },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          noun: 'collection',\n          iconCls: 'sm-collection-icon'\n        })\n      ]\n    })\n\n    const config = {\n      enableColLock: false,\n      cls: this.cls ?? 'sm-round-panel',\n      store,\n      view,\n      sm,\n      colModel: new Ext.ux.grid.LockingColumnModel(columns),\n      bbar\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Collections.GrantsGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      {\n        name: 'grantee',\n        mapping: 'grantee',\n        convert: (v, r) => r.granteeName\n      },\n      {\n        name: 'userId',\n        mapping: 'grantee.userId',\n        type: 'int'\n\n      },\n      {\n        name: 'userGroupId', \n        mapping: 'grantee.userGroupId',\n        type: 'int'\n      },\n      'uniqueAssets',\n      'uniqueAssetsDisabled',\n      'uniqueStigs',\n      'uniqueStigsDisabled',\n      {\n        name: 'ruleCountRw',\n        mapping: 'ruleCounts.rw'\n      },\n      {\n        name: 'ruleCountR',\n        mapping: 'ruleCounts.r'\n      },\n      {\n        name: 'ruleCountNone',\n        mapping: 'ruleCounts.none'\n      },\n      'role',\n      'access'\n    ]\n\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'grantId',  // Change to use grantId as unique identifier\n      sortInfo: {\n        field: 'grantee',\n        direction: 'ASC'\n      }\n    })\n\n    const columns = [\n      {\n        header: \"userId\",\n        hidden: true,\n        dataIndex: 'userId',\n        sortable: true,\n      },\n      {\n        header: \"userGroupId\",\n        hidden: true,\n        dataIndex: 'userGroupId',\n        sortable: true,\n      },      \n      {\n        header: \"Grantee\",\n        dataIndex: 'grantee',\n        sortable: true,\n        filter: { type: 'string' },\n        renderer: function (v, m, r) {\n          const icon = r.data.userId ? 'sm-user-icon' : 'sm-users-icon'\n          return `<div class=\"${icon} sm-cell-with-icon\">${v}</div>`\n        }\n      },\n      {\n        header: \"Role\",\n        dataIndex: 'role',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"Rules RW\",\n        dataIndex: 'ruleCountRw',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Rules R\",\n        dataIndex: 'ruleCountR',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Rules None\",\n        dataIndex: 'ruleCountNone',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Assets\",\n        dataIndex: 'uniqueAssets',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Assets Disabled\",\n        dataIndex: 'uniqueAssetsDisabled',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"STIGs\",\n        dataIndex: 'uniqueStigs',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"STIGs Disabled\",\n        dataIndex: 'uniqueStigsDisabled',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n    ]\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      deferEmptyText: false,\n      forceFit: true,\n      markDirty: false,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      }\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          grid: this,\n          gridBasename: this.exportName || this.title || 'acls',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          noun: 'Grant',\n          iconCls: 'sm-collection-icon'\n        })\n      ]\n    })\n\n    const config = {\n      cls: this.cls ?? 'sm-round-panel',\n      store,\n      view,\n      sm,\n      columns,\n      bbar\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Collections.AssetStigGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      {\n        name: 'collectionId',\n        type: 'int'\n      },\n      'name',\n      'state',\n      'range00',\n      'range01to05',\n      'range06to10',\n      'range11to15',\n      'range16plus'\n    ]\n\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'collectionId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC'\n      }\n    })\n\n    const columns = [\n      {\n        header: \"Id\",\n        hidden: true,\n        dataIndex: 'collectionId',\n        sortable: true,\n      },\n      {\n        header: \"Collection\",\n        dataIndex: 'name',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"State\",\n        hidden: true,\n        dataIndex: 'state',\n        sortable: true,\n        filter: { type: 'values' }\n      },\n      {\n        header: \"0\",\n        dataIndex: 'range00',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"1-5\",\n        dataIndex: 'range01to05',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"6-10\",\n        dataIndex: 'range06to10',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"11-15\",\n        dataIndex: 'range11to15',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"16+\",\n        dataIndex: 'range16plus',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      }\n    ]\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true,\n      listeners: {\n        rowselect: this.onRowSelect ?? Ext.emptyFn\n      }\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      forceFit: true,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      },\n      getRowClass: record => record.data.state === 'disabled' ? 'sm-row-disabled' : ''\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          grid: this,\n          gridBasename: this.exportName || this.title || 'collections',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          noun: 'collection',\n          iconCls: 'sm-collection-icon'\n        })\n      ]\n    })\n\n    const config = {\n      cls: this.cls ?? 'sm-round-panel',\n      store,\n      view,\n      sm,\n      columns,\n      bbar\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Collections.RolesGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      {\n        name: 'collectionId',\n        type: 'int'\n      },\n      'name',\n      'state',\n      'restricted',\n      'full',\n      'manage',\n      'owner'\n    ]\n\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'collectionId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC'\n      }\n    })\n\n    const columns = [\n      {\n        header: \"Id\",\n        hidden: true,\n        dataIndex: 'collectionId',\n        sortable: true,\n      },\n      {\n        header: \"Collection\",\n        dataIndex: 'name',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"State\",\n        hidden: true,\n        dataIndex: 'state',\n        sortable: true,\n        filter: { type: 'values' }\n      },\n      {\n        header: \"Restricted\",\n        width: 40,\n        dataIndex: 'restricted',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Full\",\n        width: 40,\n        dataIndex: 'full',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Manage\",\n        width: 40,\n        dataIndex: 'manage',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Owner\",\n        width: 40,\n        dataIndex: 'owner',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      }\n    ]\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true,\n      listeners: {\n        rowselect: this.onRowSelect ?? Ext.emptyFn\n      }\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      deferEmptyText: false,\n      forceFit: true,\n      markDirty: false,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      },\n      getRowClass: record => record.data.state === 'disabled' ? 'sm-row-disabled' : ''\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          grid: this,\n          gridBasename: this.exportName || this.title || 'collections',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          noun: 'collection',\n          iconCls: 'sm-collection-icon'\n        })\n      ]\n    })\n\n    const config = {\n      cls: this.cls ?? 'sm-round-panel',\n      store,\n      view,\n      sm,\n      columns,\n      bbar\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Collections.LabelsGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      {\n        name: 'collectionId',\n        type: 'int'\n      },\n      'name',\n      'state',\n      'collectionLabels',\n      'labeledAssets',\n      'assetLabels'\n    ]\n\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'collectionId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC'\n      }\n    })\n\n    const columns = [\n      {\n        header: \"Id\",\n        hidden: true,\n        dataIndex: 'collectionId',\n        sortable: true,\n      },\n      {\n        header: \"Collection\",\n        dataIndex: 'name',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"State\",\n        hidden: true,\n        dataIndex: 'state',\n        sortable: true,\n        filter: { type: 'values' }\n      },\n      {\n        header: \"Labels\",\n        dataIndex: 'collectionLabels',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Labeled\",\n        dataIndex: 'labeledAssets',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Tags\",\n        dataIndex: 'assetLabels',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      }\n    ]\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true,\n      listeners: {\n        rowselect: this.onRowSelect ?? Ext.emptyFn\n      }\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      forceFit: true,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      },\n      getRowClass: record => record.data.state === 'disabled' ? 'sm-row-disabled' : ''\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          grid: this,\n          gridBasename: this.exportName || this.title || 'collections',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          noun: 'collection',\n          iconCls: 'sm-collection-icon'\n        })\n      ]\n    })\n\n    const config = {\n      cls: this.cls ?? 'sm-round-panel',\n      store,\n      view,\n      sm,\n      columns,\n      bbar\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Collections.SettingsGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      {\n        name: 'collectionId',\n        type: 'int'\n      },\n      'name',\n      'state',\n      {\n        name: 'detailEnabled',\n        mapping: 'fields.detail.enabled'\n      },\n      {\n        name: 'detailRequired',\n        mapping: 'fields.detail.required'\n      },\n      {\n        name: 'commentEnabled',\n        mapping: 'fields.comment.enabled'\n      },\n      {\n        name: 'commentRequired',\n        mapping: 'fields.comment.required'\n      },\n      {\n        name: 'canAccept',\n        mapping: 'status.canAccept'\n      },\n      {\n        name: 'resetCriteria',\n        mapping: 'status.resetCriteria'\n      },\n      {\n        name: 'minAcceptGrant',\n        mapping: 'status.minAcceptGrant'\n      }\n    ]\n\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'collectionId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC'\n      }\n    })\n\n    const columns = [\n      {\n        header: \"Id\",\n        hidden: true,\n        dataIndex: 'collectionId',\n        sortable: true,\n      },\n      {\n        header: \"Collection\",\n        dataIndex: 'name',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"State\",\n        hidden: true,\n        dataIndex: 'state',\n        sortable: true,\n        filter: { type: 'values' }\n      },\n      {\n        header: \"Detail Enabled\",\n        dataIndex: 'detailEnabled',\n        sortable: true\n      },\n      {\n        header: \"Detail Required\",\n        dataIndex: 'detailRequired',\n        sortable: true\n      },\n      {\n        header: \"Comment Enabled\",\n        dataIndex: 'commentEnabled',\n        sortable: true\n      },\n      {\n        header: \"Comment Required\",\n        dataIndex: 'commentRequired',\n        sortable: true\n      },\n      {\n        header: \"Can Accept\",\n        dataIndex: 'canAccept',\n        sortable: true\n      },\n      {\n        header: \"Reset Criteria\",\n        dataIndex: 'resetCriteria',\n        sortable: true\n      },\n      {\n        header: \"Accept Grant\",\n        dataIndex: 'minAcceptGrant',\n        sortable: true\n      }\n    ]\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true,\n      listeners: {\n        rowselect: this.onRowSelect ?? Ext.emptyFn\n      }\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      forceFit: true,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      },\n      getRowClass: record => record.data.state === 'disabled' ? 'sm-row-disabled' : ''\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          grid: this,\n          gridBasename: this.exportName || this.title || 'collections',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          noun: 'collection',\n          iconCls: 'sm-collection-icon'\n        })\n      ]\n    })\n\n    const config = {\n      cls: this.cls ?? 'sm-round-panel',\n      store,\n      view,\n      sm,\n      columns,\n      bbar\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Collections.Container = Ext.extend(Ext.Container, {\n  initComponent: function () {\n    function loadData(data) {\n      // expects just the collections property of the full object\n      const overview = []\n      const assetStig = []\n      const roles = []\n      const labels = []\n      const settingRows = []\n      for (const collectionId in data) {\n        const { settings, assetStigRanges, roleCounts, labelCounts, name, ...rest } = data[collectionId]\n        overview.push({ collectionId, name, ...rest })\n        assetStig.push({ collectionId, name, ...assetStigRanges })\n        roles.push({ collectionId, name, ...roleCounts })\n        labels.push({ collectionId, name, ...labelCounts })\n        settingRows.push({ collectionId, name, ...settings })\n      }\n      overviewGrid.store.loadData(overview)\n      assetStigGrid.store.loadData(assetStig)\n      rolesGrid.store.loadData(roles)\n      labelsGrid.store.loadData(labels)\n      settingsGrid.store.loadData(settingRows)\n      grantsGrid.store.removeAll()\n\n      const overviewLocked = []\n      for (const collectionId in data) {\n        overviewLocked.push({ collectionId, ...data[collectionId] })\n      }\n      fullGridLocked.store.loadData(overviewLocked)\n    }\n\n    function loadGrants(sm, index, record) {\n      const data = record.data.grants\n      const rows = []\n      for (const grantId in data) {\n        const grantData = data[grantId]\n        rows.push({ \n          grantId: grantData.grantId, // Use the unique grantId\n          granteeName: SM.AppInfo.usernameLookup[grantData.grantee.userId] || \n          SM.AppInfo.groupNameLookup[grantData.grantee.userGroupId],\n          ...grantData \n        })\n      }\n      grantsGrid.store.loadData(rows)\n    }    \n\n    function syncGridsOnRowSelect(sm, rowIndex, e) {\n      const sourceRecord = sm.grid.store.getAt(rowIndex)\n      console.log(sourceRecord)\n      for (const peeredGrid of peeredGrids) {\n        if (sm.grid.title !== peeredGrid.title) {\n          const destRecord = peeredGrid.store.getById(sourceRecord.id)\n          const destIndex = peeredGrid.store.indexOf(destRecord)\n          peeredGrid.selModel.suspendEvents()\n          peeredGrid.selModel.selectRow(destIndex)\n          peeredGrid.selModel.resumeEvents()\n          peeredGrid.view.focusRow(destIndex)\n        }\n      }\n      loadGrants(null, null, overviewGrid.store.getById(sourceRecord.id))\n    }\n\n    const overviewGrid = new SM.AppInfo.Collections.OverviewGrid({\n      title: 'Overview',\n      border: false,\n      region: 'center',\n      onRowSelect: syncGridsOnRowSelect,\n      hideMode: 'offsets'\n    })\n    const fullGridLocked = new SM.AppInfo.Collections.FullGridLocked({\n      title: 'All Fields',\n      border: false,\n      id: 'appinfo-locked',\n      autoDestroy: false,\n      onRowSelect: syncGridsOnRowSelect,\n      hideMode: 'offsets'\n    })\n\n    const grantsGrid = new SM.AppInfo.Collections.GrantsGrid({\n      title: 'Grants',\n      border: false,\n      collapsible: true,\n      region: 'south',\n      split: true,\n      height: 240\n    })\n    const rolesGrid = new SM.AppInfo.Collections.RolesGrid({\n      title: 'Roles',\n      border: false,\n      onRowSelect: syncGridsOnRowSelect,\n      hideMode: 'offsets'\n    })\n    const labelsGrid = new SM.AppInfo.Collections.LabelsGrid({\n      title: 'Labels',\n      border: false,\n      onRowSelect: syncGridsOnRowSelect,\n      hideMode: 'offsets'\n    })\n    const assetStigGrid = new SM.AppInfo.Collections.AssetStigGrid({\n      title: 'STIG Assignment Ranges',\n      border: false,\n      onRowSelect: syncGridsOnRowSelect,\n      hideMode: 'offsets'\n    })\n    const settingsGrid = new SM.AppInfo.Collections.SettingsGrid({\n      title: 'Settings',\n      border: false,\n      onRowSelect: syncGridsOnRowSelect,\n      hideMode: 'offsets'\n    })\n    const peeredGrids = [fullGridLocked, overviewGrid, rolesGrid, labelsGrid, assetStigGrid, settingsGrid]\n    const centerTp = new Ext.TabPanel({\n      region: 'center',\n      border: false,\n      activeTab: 0,\n      deferredRender: false,\n      items: peeredGrids,\n    })\n    const config = {\n      layout: 'border',\n      items: [\n        centerTp,\n        grantsGrid\n      ],\n      loadData\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.MySql.TablesGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      'tableName',\n      'rowCount',\n      'tableRows',\n      'tableCollation',\n      'avgRowLength',\n      'dataLength',\n      'indexLength',\n      'autoIncrement',\n      'createTime',\n      'updateTime'\n    ]\n\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'tableName',\n      sortInfo: {\n        field: 'tableName',\n        direction: 'ASC'\n      }\n    })\n\n    const columns = [\n      {\n        header: \"Table\",\n        width: 160,\n        dataIndex: 'tableName',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"RowCount\",\n        dataIndex: 'rowCount',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"TableRows\",\n        dataIndex: 'tableRows',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Collation\",\n        hidden: true,\n        dataIndex: 'tableCollation',\n        sortable: true,\n        align: 'right',\n      },\n      {\n        header: \"RowLengthAvg\",\n        dataIndex: 'avgRowLength',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"DataLength\",\n        dataIndex: 'dataLength',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"IndexLength\",\n        dataIndex: 'indexLength',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"AutoIncrement\",\n        dataIndex: 'autoIncrement',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Created\",\n        dataIndex: 'createTime',\n        sortable: true,\n        align: 'right',\n      },\n      {\n        header: \"Updated\",\n        dataIndex: 'updateTime',\n        sortable: true,\n        align: 'right',\n      }\n    ]\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      forceFit: true,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      }\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          grid: this,\n          gridBasename: this.exportName || this.title || 'tables',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          noun: 'table',\n          iconCls: 'sm-database-icon'\n        })\n      ]\n    })\n\n    const config = {\n      store,\n      view,\n      sm,\n      columns,\n      bbar\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.MySql.Container = Ext.extend(Ext.Container, {\n  initComponent: function () {\n    function loadData(data) {\n      // expects only mysql property from full appinfo object\n      const tables = []\n      for (const key in data.tables) {\n        tables.push({ tableName: key, ...data.tables[key] })\n      }\n      tablesGrid.store.loadData(tables)\n      variablesGrid.loadData(data.variables)\n      statusGrid.loadData(data.status)\n      const lengths = getTotalLengths(data.tables)\n      const sep = '<span style=\"color:gray\">&#xFF5C;</span>'\n      tablesGrid.setTitle(`Tables ${sep} Data &thickapprox; ${formatBytes(lengths.data)}  ${sep} Indexes &thickapprox; ${formatBytes(lengths.index)}  ${sep} Version ${data.version} ${sep} Up ${SM.AppInfo.uptimeString(data.status.Uptime)} `)\n    }\n\n    function getTotalLengths(tables) {\n      const lengths = {\n        data: 0,\n        index: 0\n      }\n      for (const table in tables) {\n        lengths.data += tables[table].dataLength\n        lengths.index += tables[table].indexLength\n      }\n      return lengths\n    }\n\n    function formatBytes(bytes, decimals = 2) {\n      if (!+bytes) return '0 Bytes'\n  \n      const k = 1024\n      const dm = decimals < 0 ? 0 : decimals\n      const sizes = ['Bytes', 'KiB', 'MiB', 'GiB', 'TiB', 'PiB', 'EiB', 'ZiB', 'YiB']\n  \n      const i = Math.floor(Math.log(bytes) / Math.log(k))\n  \n      return `${parseFloat((bytes / Math.pow(k, i)).toFixed(dm))} ${sizes[i]}`\n  }\n  \n\n    const tablesGrid = new SM.AppInfo.MySql.TablesGrid({\n      title: ' ',\n      border: false,\n      cls: 'sm-round-panel',\n      region: 'center'\n    })\n\n    const variablesGrid = new SM.AppInfo.KeyValueGrid({\n      title: 'Variables',\n      border: false,\n      flex: 1,\n      margins: { top: 0, right: 5, bottom: 0, left: 0 },\n      keyColumnConfig: { header: 'Variable', width: 200 },\n      valueColumnConfig: { header: 'Value' },\n      exportName: 'variables',\n      rowCountNoun: 'variable'\n    })\n\n    const statusGrid = new SM.AppInfo.KeyValueGrid({\n      title: 'Status',\n      border: false,\n      flex: 1,\n      margins: { top: 0, right: 0, bottom: 0, left: 5 },\n      keyColumnConfig: { header: 'Variable', width: 200 },\n      valueColumnConfig: { header: 'Value' },\n      exportName: 'status',\n      rowCountNoun: 'variable'\n    })\n\n    const childContainer = new Ext.Container({\n      region: 'south',\n      split: true,\n      height: 300,\n      layout: 'hbox',\n      bodyStyle: 'background-color: transparent;',\n      layoutConfig: {\n        align: 'stretch',\n      },\n      items: [\n        variablesGrid,\n        statusGrid\n      ]\n    })\n\n    const config = {\n      layout: 'border',\n      items: [\n        tablesGrid,\n        childContainer\n      ],\n      loadData\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Requests.OperationsGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      'operationId',\n      'totalRequests',\n      'totalDuration',\n      'minDuration',\n      'maxDuration',\n      'maxDurationUpdates',\n      {\n        name: 'averageDuration',\n        convert: (v, r) => Math.round(r.totalDuration / r.totalRequests)\n      },\n      'elevatedRequests',\n      'retried',\n      'averageRetries',\n      'totalReqLength',\n      'minReqLength',\n      'maxReqLength',\n      'totalResLength',\n      'minResLength',\n      'maxResLength',\n      'clients',\n      'users',\n      'projections',\n      'errors',\n      {\n        name: 'errorCount',\n        convert: (v, r) => Object.values(r.errors).reduce((a, v) => a+v, 0)\n      }\n    ]\n\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'operationId',\n      sortInfo: {\n        field: 'operationId',\n        direction: 'ASC'\n      }\n    })\n\n    const columns = [\n      {\n        header: \"Operation\",\n        width: 160,\n        dataIndex: 'operationId',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"Requests\",\n        dataIndex: 'totalRequests',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Errors\",\n        dataIndex: 'errorCount',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Duration\",\n        dataIndex: 'totalDuration',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"DurAvg\",\n        hidden: true,\n        dataIndex: 'averageDuration',\n        sortable: true,\n        align: 'right',\n      },\n      {\n        header: \"DurMin\",\n        dataIndex: 'minDuration',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"DurMax\",\n        dataIndex: 'maxDuration',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"DurMaxUpdates\",\n        hidden: true,\n        dataIndex: 'maxDurationUpdates',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Elevated\",\n        dataIndex: 'elevatedRequests',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"Retried\",\n        dataIndex: 'retried',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"RetriesAvg\",\n        dataIndex: 'averageRetries',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"ResLen\",\n        dataIndex: 'totalResLength',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"ResLenMin\",\n        dataIndex: 'minResLength',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"ResLenMax\",\n        dataIndex: 'maxResLength',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"ReqLen\",\n        dataIndex: 'totalReqLength',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"ReqLenMin\",\n        dataIndex: 'minReqLength',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: \"ReqLenMax\",\n        dataIndex: 'maxReqLength',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      }\n    ]\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true,\n      listeners: {\n        rowselect: this.onRowSelect ?? Ext.emptyFn\n      },\n      grid: this\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      deferEmptyText: false,\n      forceFit: true,\n      markDirty: false,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      }\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          grid: this,\n          gridBasename: this.exportName || this.title || 'operations',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          noun: 'operation',\n          iconCls: 'sm-circle-icon'\n        })\n      ]\n    })\n\n    const config = {\n      cls: this.cls ?? 'sm-round-panel',\n      store,\n      view,\n      sm,\n      columns,\n      bbar\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Requests.ProjectionsGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      'projection',\n      'totalRequests',\n      'minDuration',\n      'maxDuration',\n      'totalDuration',\n      'averageDuration',\n      'retried',\n      'averageRetries'\n    ]\n\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'projection',\n      sortInfo: {\n        field: 'projection',\n        direction: 'ASC'\n      }\n    })\n\n    const columns = [\n      {\n        header: 'Projection',\n        width: 160,\n        dataIndex: 'projection',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: 'Requests',\n        dataIndex: 'totalRequests',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: 'Duration',\n        dataIndex: 'totalDuration',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: 'DurMin',\n        dataIndex: 'minDuration',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: 'DurMax',\n        dataIndex: 'maxDuration',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: 'DurationAvg',\n        dataIndex: 'averageDuration',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: 'Retried',\n        dataIndex: 'retried',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: 'RetriesAvg',\n        dataIndex: 'averageRetries',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      }\n    ]\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      deferEmptyText: false,\n      forceFit: true,\n      markDirty: false,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      }\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          grid: this,\n          gridBasename: this.exportName || this.title || 'projections',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          noun: this.rowCountNoun ?? 'projection',\n          iconCls: 'sm-circle-icon'\n        })\n      ]\n    })\n\n    const config = {\n      cls: this.cls ?? 'sm-round-panel',\n      store,\n      view,\n      sm,\n      columns,\n      bbar\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Requests.Container = Ext.extend(Ext.Container, {\n  initComponent: function () {\n    const operationsGrid = new SM.AppInfo.Requests.OperationsGrid({\n      title: 'Operations',\n      border: false,\n      region: 'center',\n      onRowSelect\n    })\n    const usersGrid = new SM.AppInfo.KeyValueGrid({\n      title: 'User requests',\n      border: false,\n      margins: { top: 0, right: 5, bottom: 0, left: 0 },\n      keyColumnConfig: { header: 'Username' },\n      valueColumnConfig: { header: 'Requests' },\n      width: 200,\n      rowCountNoun: 'user'\n    })\n    const clientsGrid = new SM.AppInfo.KeyValueGrid({\n      title: 'Client requests',\n      border: false,\n      margins: { top: 0, right: 5, bottom: 0, left: 5 },\n      keyColumnConfig: { header: 'Client' },\n      valueColumnConfig: { header: 'Requests' },\n      width: 200,\n      rowCountNoun: 'client'\n    })\n    const errorsGrid = new SM.AppInfo.KeyValueGrid({\n      title: 'Errors',\n      border: false,\n      margins: { top: 0, right: 5, bottom: 0, left: 5 },\n      keyColumnConfig: { header: 'Code' },\n      valueColumnConfig: { header: 'Requests' },\n      width: 200,\n      rowCountNoun: 'error'\n    })\n    const projectionsGrid = new SM.AppInfo.Requests.ProjectionsGrid({\n      title: 'Projections',\n      border: false,\n      flex: 1,\n      margins: { top: 0, right: 0, bottom: 0, left: 5 }\n    })\n\n    function onRowSelect(sm, index, record) {\n      const users = []\n      const clients = []\n      const errors= []\n      const projections = []\n      const data = record.data\n      for (const userId in data.users) {\n        users.push({ key: SM.AppInfo.usernameLookup[userId] || 'unknown', value: data.users[userId] })\n      }\n      for (const client in data.clients) {\n        clients.push({ key: client, value: data.clients[client] })\n      }\n      for (const code in data.errors) {\n        errors.push({ key: code, value: data.errors[code] })\n      }\n      for (const projection of Object.keys(data.projections)) {\n        projections.push({ projection, ...data.projections[projection] })\n      }\n      usersGrid.store.loadData(users)\n      clientsGrid.store.loadData(clients)\n      errorsGrid.store.loadData(errors)\n      projectionsGrid.store.loadData(projections)\n    }\n\n    const childContainer = new Ext.Container({\n      region: 'south',\n      split: true,\n      height: 200,\n      bodyStyle: 'background-color: transparent;',\n      layout: 'hbox',\n      layoutConfig: {\n        align: 'stretch',\n      },\n      items: [\n        usersGrid,\n        clientsGrid,\n        errorsGrid,\n        projectionsGrid\n      ]\n    })\n\n    function loadData(data) {\n      const nr = SM.AppInfo.numberRenderer\n      const operationIds = []\n      for (const key in data.operationIds) {\n        operationIds.push({ operationId: key, ...data.operationIds[key] })\n      }\n      operationsGrid.store.loadData(operationIds)\n      const sep = `<span style=\"color:gray\">&#xFF5C;</span>`\n      operationsGrid.setTitle(`API Operations ${sep} ${nr(data.totalRequests)} total requests, ${nr(data.totalApiRequests)} to API, duration ${nr(data.totalRequestDuration)}ms`)\n      usersGrid.store.removeAll()\n      clientsGrid.store.removeAll()\n      errorsGrid.store.removeAll()\n      projectionsGrid.store.removeAll()\n    }\n\n    const config = {\n      layout: 'border',\n      items: [\n        operationsGrid,\n        childContainer\n      ],\n      loadData\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Users.InfoGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      {\n        name: 'userId',\n        type: 'int'\n      },\n      'username',\n      'created',\n      'lastAccess',\n      'privileges',\n      {\n        name: 'restricted',\n        mapping: 'roles.restricted',\n        useNull: true,\n        type: 'int'\n      },\n      {\n        name: 'full',\n        mapping: 'roles.full',\n        useNull: true,\n        type: 'int'\n      },\n      {\n        name: 'manage',\n        mapping: 'roles.manage',\n        useNull: true,\n        type: 'int'\n      },\n      {\n        name: 'owner',\n        mapping: 'roles.owner',\n        useNull: true,\n        type: 'int'\n      }\n    ]\n\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'userId',\n      sortInfo: {\n        field: 'username',\n        direction: 'ASC'\n      }\n    })\n\n    const columns = [\n      {\n        header: 'Username',\n        dataIndex: 'username',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: 'Id',\n        dataIndex: 'userId',\n        hidden: true,\n        sortable: true,\n      },\n      {\n        header: 'Last Access',\n        dataIndex: 'lastAccess',\n        sortable: true,\n        align: 'right',\n        renderer: v => v ? new Date(v * 1000).toISOString() : '-'\n      },\n      {\n        header: 'Owner',\n        dataIndex: 'owner',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: 'Manage',\n        dataIndex: 'manage',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: 'Full',\n        dataIndex: 'full',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: 'Restricted',\n        dataIndex: 'restricted',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: 'Privileges',\n        dataIndex: 'privileges',\n        sortable: true,\n        align: 'right',\n        renderer: v => JSON.stringify(v)\n      },\n      {\n        header: 'Created',\n        dataIndex: 'created',\n        sortable: true,\n        align: 'right'\n      }\n\n    ]\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      deferEmptyText: false,\n      forceFit: true,\n      markDirty: false,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      }\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          grid: this,\n          gridBasename: this.exportName || this.title || 'users',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          noun: this.rowCountNoun ?? 'user',\n          iconCls: 'sm-user-icon'\n        })\n      ]\n    })\n\n    const config = {\n      cls: this.cls ?? 'sm-round-panel',\n      store,\n      view,\n      sm,\n      columns,\n      bbar\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Users.Container = Ext.extend(Ext.Container, {\n  initComponent: function () {\n    // expects just the value of appinfo.users\n    function loadData(data) {\n      const rows = []\n      for (const key in data.userInfo) {\n        rows.push({ userId: key, ...data.userInfo[key] })\n      }\n      infoGrid.store.loadData(rows)\n\n      // setup the username lookup object\n      SM.AppInfo.usernameLookup = {}\n      for (const row of rows) {\n        SM.AppInfo.usernameLookup[row.userId] = row.username\n      }\n\n      for (const key in data.userPrivilegeCounts) {\n        privilegePropertyGridMap[key].loadData(data.userPrivilegeCounts[key])\n      }\n    }\n\n    const privilegeGridOptions = {\n      border: false,\n      flex: 1,\n      keyColumnConfig: { header: 'Privilege' },\n      valueColumnConfig: { header: 'User count' },\n      forceFit: true,\n      exportName: 'overall',\n      rowCountNoun: 'privilege'\n    }\n\n    const overallGrid = new SM.AppInfo.KeyValueGrid({\n      title: 'Privileges - Overall',\n      margins: { top: 0, right: 5, bottom: 0, left: 0 },\n      ...privilegeGridOptions\n    })\n    const last30Grid = new SM.AppInfo.KeyValueGrid({\n      title: 'Privileges - Active last 30d',\n      margins: { top: 0, right: 5, bottom: 0, left: 5 },\n      ...privilegeGridOptions\n    })\n    const last90Grid = new SM.AppInfo.KeyValueGrid({\n      title: 'Privileges - Active last 90d',\n      margins: { top: 0, right: 0, bottom: 0, left: 5 },\n      ...privilegeGridOptions\n    })\n\n    const privilegePropertyGridMap = {\n      overall: overallGrid,\n      activeInLast30Days: last30Grid,\n      activeInLast90Days: last90Grid\n    }\n\n    const infoGrid = new SM.AppInfo.Users.InfoGrid({\n      title: 'User details',\n      border: false,\n      region: 'center'\n    })\n\n    const privilegeContainer = new Ext.Container({\n      region: 'south',\n      split: true,\n      height: 160,\n      bodyStyle: 'background-color: transparent;',\n      layout: 'hbox',\n      layoutConfig: {\n        align: 'stretch',\n      },\n      border: false,\n      items: [\n        overallGrid,\n        last30Grid,\n        last90Grid\n      ]\n    })\n\n    const config = {\n      layout: 'border',\n      items: [infoGrid, privilegeContainer],\n      loadData,\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Groups.InfoGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      {\n        name: 'userGroupId',\n        type: 'int'\n      },\n      'name',\n      'members',\n      'created',\n      {\n        name: 'restricted',\n        mapping: 'roles.restricted',\n        useNull: true,\n        type: 'int'\n      },\n      {\n        name: 'full',\n        mapping: 'roles.full',\n        useNull: true,\n        type: 'int'\n      },\n      {\n        name: 'manage',\n        mapping: 'roles.manage',\n        useNull: true,\n        type: 'int'\n      },\n      {\n        name: 'owner',\n        mapping: 'roles.owner',\n        useNull: true,\n        type: 'int'\n      }\n    ]\n\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'userGroupId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC'\n      }\n    })\n\n    const columns = [\n      {\n        header: 'Group Name',\n        dataIndex: 'name',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: 'Id',\n        dataIndex: 'userGroupId',\n        hidden: true,\n        sortable: true,\n      },\n      {\n        header: 'User Count',\n        dataIndex: 'members',\n        sortable: true,\n      },      \n      {\n        header: 'Owner',\n        dataIndex: 'owner',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: 'Manage',\n        dataIndex: 'manage',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: 'Full',\n        dataIndex: 'full',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: 'Restricted',\n        dataIndex: 'restricted',\n        sortable: true,\n        align: 'right',\n        renderer: SM.AppInfo.numberRenderer\n      },\n      {\n        header: 'Created',\n        dataIndex: 'created',\n        sortable: true,\n        align: 'right'\n      }\n\n    ]\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      deferEmptyText: false,\n      forceFit: true,\n      markDirty: false,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      }\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          grid: this,\n          gridBasename: this.exportName || this.title || 'groups',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          noun: this.rowCountNoun ?? 'group',\n          iconCls: 'sm-users-icon'\n        })\n      ]\n    })\n\n    const config = {\n      cls: this.cls ?? 'sm-round-panel',\n      store,\n      view,\n      sm,\n      columns,\n      bbar\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Groups.Container = Ext.extend(Ext.Container, {\n  initComponent: function () {\n    // expects just the value of appinfo.users\n    function loadData(data) {\n      const rows = []\n      for (const key in data) {\n        rows.push({ userGroupId: key, ...data[key] })\n      }\n      infoGrid.store.loadData(rows)\n\n      // setup the groupName lookup object\n      SM.AppInfo.groupNameLookup = {}\n      for (const row of rows) {\n        SM.AppInfo.groupNameLookup[row.userGroupId] = row.name\n      }\n    }\n\n    const infoGrid = new SM.AppInfo.Groups.InfoGrid({\n      title: 'Group details',\n      border: false,\n      region: 'center'\n    })\n\n    const config = {\n      layout: 'border',\n      items: [infoGrid],\n      loadData,\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\n\nSM.AppInfo.Nodejs.CpusGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    // expects the nodejs.cpus array as data\n    function loadData(data) {\n      let index = 0\n      const rows = data?.map(item => ({\n        cpu: index++,\n        ...item\n      })) || []\n      store.loadData(rows)\n    }\n    const fields = [\n      {\n        name: 'cpu',\n        type: 'int'\n      },\n      'model',\n      'speed'\n    ]\n\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'cpu',\n      sortInfo: {\n        field: 'cpu',\n        direction: 'ASC'\n      }\n    })\n\n    const columns = [\n      {\n        header: 'CPU',\n        dataIndex: 'cpu',\n        width: 15,\n        sortable: true,\n      },\n      {\n        header: 'Model',\n        dataIndex: 'model',\n        width: 60,\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: 'Speed (MHz)',\n        dataIndex: 'speed',\n        width: 25,\n        align: 'right',\n        sortable: true\n      }\n    ]\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      deferEmptyText: false,\n      forceFit: true,\n      markDirty: false,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      }\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          grid: this,\n          gridBasename: this.exportName || this.title || 'cpus',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          noun: this.rowCountNoun ?? 'cpu',\n          iconCls: 'sm-cpu-icon'\n        })\n      ]\n    })\n\n    const config = {\n      cls: this.cls ?? 'sm-round-panel',\n      store,\n      view,\n      sm,\n      columns,\n      bbar,\n      loadData\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.Nodejs.Container = Ext.extend(Ext.Container, {\n  initComponent: function () {\n    // expects just the value of appinfo.nodejs\n    function loadData(data) {\n      const sep = '<span style=\"color:gray\">&#xFF5C;</span>'\n      envGrid.setTitle(`Environment ${sep} Version ${data.version} ${sep} up ${SM.AppInfo.uptimeString(data.uptime)}`)\n      memoryGrid.loadData(data.memory)\n      osGrid.loadData(data.os)\n      cpusGrid.loadData(data.cpus)\n      envGrid.loadData(data.environment)\n    }\n\n    const envGrid = new SM.AppInfo.KeyValueGrid({\n      title: 'Environment',\n      border: false,\n      region: 'center',\n      keyColumnConfig: { header: 'Variable', width: 240 },\n      valueColumnConfig: { header: 'Value', align: 'left', width: 370 },\n      forceFit: true,\n      exportName: 'environment',\n      rowCountNoun: 'item'\n    })\n    const cpusGrid = new SM.AppInfo.Nodejs.CpusGrid({\n      title: 'CPU',\n      border: false,\n      flex: 1,\n      margins: { top: 0, right: 5, bottom: 0, left: 0 }\n    })\n    const memoryGrid = new SM.AppInfo.KeyValueGrid({\n      title: 'Memory',\n      border: false,\n      flex: 1,\n      margins: { top: 0, right: 5, bottom: 0, left: 5 },\n      keyColumnConfig: { header: 'Key' },\n      valueColumnConfig: { header: 'Value' },\n      exportName: 'memory'\n    })\n    const osGrid = new SM.AppInfo.KeyValueGrid({\n      title: 'OS',\n      border: false,\n      flex: 1,\n      margins: { top: 0, right: 0, bottom: 0, left: 5 },\n      keyColumnConfig: { header: 'Key' },\n      valueColumnConfig: { header: 'Value', align: 'left' },\n      exportName: 'os'\n    })\n\n    const panel = new Ext.Panel({\n      region: 'south',\n      split: true,\n      height: 300,\n      bodyStyle: 'background-color: transparent;',\n      layout: 'hbox',\n      layoutConfig: {\n        align: 'stretch'\n      },\n      border: false,\n      items: [\n        cpusGrid,\n        memoryGrid,\n        osGrid,\n      ]\n    })\n\n    const config = {\n      layout: 'border',\n      items: [envGrid, panel],\n      loadData,\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.TabPanel = Ext.extend(Ext.TabPanel, {\n  initComponent: function () {\n    const collectionsContainer = new SM.AppInfo.Collections.Container({\n      border: false,\n      title: 'Collections',\n      iconCls: 'sm-collection-icon'\n    })\n\n    const usersContainer = new SM.AppInfo.Users.Container({\n      title: 'Users',\n      iconCls: 'sm-user-icon'\n    })\n\n    const groupsContainer = new SM.AppInfo.Groups.Container({\n      title: 'Groups',\n      iconCls: 'sm-users-icon'\n    })    \n\n    const requestsContainer = new SM.AppInfo.Requests.Container({\n      title: 'Requests',\n      iconCls: 'sm-browser-icon'\n    })\n\n    const mysqlContainer = new SM.AppInfo.MySql.Container({\n      title: 'MySQL',\n      iconCls: 'sm-database-save-icon'\n    })\n\n    const nodejsContainer = new SM.AppInfo.Nodejs.Container({\n      title: 'Node.js',\n      iconCls: 'sm-nodejs-icon',\n    })\n\n    const jsonPanel = new SM.AppInfo.JsonTreePanel({\n      title: 'JSON Tree',\n      iconCls: 'sm-json-icon',\n      layout: 'fit'\n    })\n\n    const items = [\n      requestsContainer,\n      collectionsContainer,\n      usersContainer,\n      groupsContainer,\n      mysqlContainer,\n      nodejsContainer,\n      jsonPanel,\n    ]\n\n    function loadData(data) {\n      // users and groups MUST be loaded first so the name lookup objects are built\n      usersContainer.loadData(data.users)\n      groupsContainer.loadData(data.groups)\n      collectionsContainer.loadData(data.collections)\n      requestsContainer.loadData(data.requests)\n      mysqlContainer.loadData(data.mysql)\n      nodejsContainer.loadData(data.nodejs)\n      jsonPanel.loadData(data)\n\n    }\n\n    const config = {\n      deferredRender: true,\n      loadData,\n      items\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.ShareFile.OptionsFieldSet = Ext.extend(Ext.form.FieldSet, {\n  initComponent: function () {\n    const collectionNames = new Ext.form.Checkbox({\n      prop: 'collectionName',\n      boxLabel: 'Replace each Collection name with its ID'\n    })\n    const userAndGroupNames = new Ext.form.Checkbox({\n      prop: 'userAndGroupName',\n      boxLabel: 'Replace each User and Group name with its ID'\n    })\n    const clientIds = new Ext.form.Checkbox({\n      prop: 'clientId',\n      boxLabel: 'Replace each Request clientId with a generated value'\n    })\n    const envvars = new Ext.form.Checkbox({\n      prop: 'envvar',\n      boxLabel: 'Exclude Node.js environment variables'\n    })\n\n    const items = [\n      collectionNames,\n      userAndGroupNames,\n      clientIds,\n      envvars\n    ]\n\n    function getValues() {\n      const values = {}\n      for (const item of items) {\n        values[item.prop] = item.getValue()\n      }\n      return values\n    }\n    const config = {\n      title: this.title || 'Options',\n      defaults: {\n        hideLabel: true,\n        checked: true\n      },\n      autoHeight: true,\n      items,\n      getValues\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.ShareFile.Panel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const saveFn = this.onSaveShared || Ext.emptyFn\n    const _this = this\n    const fieldset = new SM.AppInfo.ShareFile.OptionsFieldSet()\n    const button = new Ext.Button({\n      style: 'float: right; margin-top: 6px;',\n      cls: 'x-toolbar',\n      text: 'Save for sharing',\n      iconCls: 'sm-share-icon',\n      handler: () => {\n        const fieldsetValues = fieldset.getValues()\n        if (_this.menu) _this.menu.hide()\n        saveFn(fieldsetValues)\n      }\n    })\n    const config = {\n      border: false,\n      autoWidth: true,\n      items: [\n        fieldset,\n        button\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.SourceMessage = {\n  header: 'Help the STIG Manager OSS project by sharing',\n  text: 'The <span class=\"sm-share-icon\">Save for Sharing</span> option can create a file without identifiers or compliance data. Mail to <span class=\"sm-email\">RMF_Tools@us.navy.mil</span>'\n}\n\nSM.AppInfo.SourcePanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const sourceDisplayField = new Ext.form.DisplayField({\n      fieldLabel: 'Source',\n      width: 330\n    })\n    const dateDisplayField = new Ext.form.DisplayField({\n      fieldLabel: 'Date',\n      width: 200\n    })\n    const versionDisplayField = new Ext.form.DisplayField({\n      fieldLabel: 'Version',\n      width: 200\n    })\n\n    const fieldContainer = new Ext.Container({\n      layout: 'form',\n      items: [\n        sourceDisplayField,\n        dateDisplayField,\n        versionDisplayField\n      ]\n    })\n\n    function loadData({ data, source }) {\n      sourceDisplayField.setValue(source)\n      dateDisplayField.setValue(data.dateGenerated ?? data.date)\n      versionDisplayField.setValue(data.stigmanVersion ?? data.version)\n    }\n\n    const selectFileBtn = new Ext.ux.form.FileUploadField({\n      buttonOnly: true,\n      accept: '.json',\n      webkitdirectory: false,\n      multiple: false,\n      style: 'width: 95px;',\n      buttonText: `Load from file...`,\n      buttonCfg: {\n        icon: \"img/upload.svg\"\n      },\n      listeners: {\n        fileselected: this.onFileSelected || Ext.emptyFn\n      }\n    })\n\n    const saveSharedPanel = new SM.AppInfo.ShareFile.Panel({\n      onSaveShared: this.onSaveShared\n    })\n\n    const saveSharedMenu = new Ext.menu.Menu({\n      plain: true,\n      style: 'padding: 10px;',\n      items: saveSharedPanel\n    })\n    saveSharedPanel.menu = saveSharedMenu\n\n    const tbar = new Ext.Toolbar({\n      items: [\n        selectFileBtn,\n        '-',\n        {\n          text: 'Save to file',\n          iconCls: 'sm-export-icon',\n          handler: this.onSaveFull || Ext.emptyFn\n        },\n        '-',\n        {\n          text: 'Save for sharing',\n          iconCls: 'sm-share-icon',\n          menu: saveSharedMenu\n        },\n        '-',\n        {\n          text: 'Fetch from API',\n          iconCls: 'icon-refresh',\n          menu: [\n            {\n              text: 'Quick fetch (estimated row counts)',\n              iconCls: 'icon-refresh',\n              tooltip: 'Faster fetch using estimated row counts',\n              handler: () => this.onFetchFromApi?.(false) || Ext.emptyFn\n            },\n            {\n              text: 'Full fetch (exact row counts)',\n              iconCls: 'sm-database-save-icon',\n              tooltip: 'Slower fetch with exact row counts for all tables',\n              handler: () => this.onFetchFromApi?.(true) || Ext.emptyFn\n            }\n          ]\n        },\n\n      ]\n    })\n\n    const config = {\n      layout: 'hbox',\n      padding: '10px 10px 10px 10px',\n      items: [\n        fieldContainer,\n        {\n          xtype: 'container',\n          tpl: new Ext.XTemplate(\n            `<div class=\"sm-round-panel sm-appinfo-message\">`,\n            `<div style=\"font-weight:bold;text-align:center;padding-bottom:8px;\">{header}</div>`,\n            `<div>{text}</div>`,\n            `</div>`\n          ),\n          data: SM.AppInfo.SourceMessage\n        }\n      ],\n      tbar,\n      loadData\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.AppInfo.fetchFromApi = async function (includeRowCounts = false) {\n  return Ext.Ajax.requestPromise({\n    responseType: 'json',\n    url: `${STIGMAN.Env.apiBase}/op/appinfo`,\n    params: {\n      elevate: curUser.privileges.admin,\n      includeRowCounts\n    },\n    method: 'GET'\n  })\n}\n\nSM.AppInfo.generateSharable = function (data, options) {\n  const kloned = SM.Klona(data)\n  const { collections, requests, users, groups, nodejs } = kloned\n  if (options.collectionName) {\n    const padLength = Object.keys(collections).at(-1)?.length\n    for (const id in collections) {\n      collections[id].name = id.padStart(padLength, '0')\n    }\n  }\n  if (options.userAndGroupName) {\n    const padLengthUsers = Object.keys(users.userInfo).at(-1)?.length\n    for (const id in users.userInfo) {\n      users.userInfo[id].username = id.padStart(padLengthUsers, '0')\n    }\n    const padLengthGroups = Object.keys(groups).at(-1)?.length\n    for (const id in groups) {\n      groups[id].name = id.padStart(padLengthGroups, '0')\n    }    \n  }\n  if (options.clientId) {\n    obfuscateClients(requests.operationIds)\n  }\n  if (options.envvar) {\n    delete nodejs.environment\n  }\n  return kloned\n\n  function obfuscateClients(operationIds) {\n    const obfuscationMap = {\n      [STIGMAN.Env.oauth.clientId]: 'webapp'\n    }\n    let obfuscatedCounter = 1\n\n    function getObfuscatedKey(client) {\n      if (client === 'unknown' || client === 'webapp') {\n        return client\n      }\n      if (!obfuscationMap[client]) {\n        obfuscationMap[client] = `client${obfuscatedCounter++}`\n      }\n      return obfuscationMap[client]\n    }\n\n    for (const id in operationIds) {\n      if (operationIds[id].clients) {\n        const clients = operationIds[id].clients\n        const newClients = {}\n        for (const client in clients) {\n          const obfuscatedName = getObfuscatedKey(client)\n          newClients[obfuscatedName] = clients[client]\n        }\n        operationIds[id].clients = newClients\n      }\n    }\n  }\n\n}\n\nSM.AppInfo.showAppInfoTab = async function (options) {\n  const { treePath } = options\n  const tab = Ext.getCmp('main-tab-panel').getItem(`appinfo-tab`)\n  if (tab) {\n    Ext.getCmp('main-tab-panel').setActiveTab(tab.id)\n    return\n  }\n\n  let data = ''\n\n  async function onFileSelected(uploadField) {\n    try {\n      thisTab.getEl().mask('Loading from file...')\n      let input = uploadField.fileInput.dom\n      const text = await input.files[0].text()\n      data = SM.AppInfo.transformPreviousSchemas(SM.safeJSONParse(text))\n      if (data) {\n        sourcePanel.loadData({ data, source: input.files[0].name })\n        tabPanel.loadData(data)\n      }\n      else {\n        Ext.Msg.alert('Unrecognized data', 'The file contents could not be understood as Application information.')\n      }\n    }\n    catch (e) {\n      SM.Error.handleError(e)\n    }\n    finally {\n      uploadField.reset()\n      thisTab.getEl()?.unmask()\n    }\n  }\n\n  async function onFetchFromApi(includeRowCounts = false) {\n    try {\n      const maskMsg = includeRowCounts \n        ? 'Fetching from API with exact row counts...' \n        : 'Fetching from API with estimated row counts...'\n      thisTab.getEl().mask(maskMsg)\n      data = await SM.AppInfo.fetchFromApi(includeRowCounts)\n      sourcePanel.loadData({ data, source: 'API' })\n      tabPanel.loadData(data)\n    }\n    finally {\n      thisTab.getEl()?.unmask()\n    }\n  }\n\n  function onSaveFull() {\n    if (data) {\n      const blob = new Blob([JSON.stringify(data)], { type: 'application/json' })\n      downloadBlob(blob, SM.Global.filenameEscaped(`stig-manager-appinfo_${SM.Global.filenameComponentFromDate()}.json`))\n    }\n  }\n\n  function onSaveShared(options) {\n    console.log(options)\n    const kloned = SM.AppInfo.generateSharable(data, options)\n    console.log(kloned)\n    const blob = new Blob([JSON.stringify(kloned)], { type: 'application/json' })\n    downloadBlob(blob, SM.Global.filenameEscaped(`stig-manager-appinfo-shareable_${SM.Global.filenameComponentFromDate()}.json`))\n  }\n\n  function downloadBlob(blob, filename) {\n    let a = document.createElement('a')\n    a.style.display = \"none\"\n    let url = window.URL.createObjectURL(blob)\n    a.href = url\n    a.download = filename\n    document.body.appendChild(a);\n    a.click();\n    document.body.removeChild(a);\n    window.URL.revokeObjectURL(url)\n  }\n\n  const sourcePanel = new SM.AppInfo.SourcePanel({\n    cls: 'sm-round-panel',\n    margins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.adjacent, left: SM.Margin.edge },\n    title: 'Source',\n    region: 'north',\n    border: false,\n    height: 145,\n    onFileSelected,\n    onFetchFromApi,\n    onSaveFull,\n    onSaveShared\n  })\n\n\n  const tabPanel = new SM.AppInfo.TabPanel({\n    cls: 'sm-round-panel',\n    margins: { top: SM.Margin.adjacent, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n    region: 'center',\n    border: false,\n    activeTab: 0,\n    listeners: {\n      tabchange: function () {\n        console.log('tabPanel event')\n      }\n    },\n    flex: 1\n\n  })\n\n  const thisTab = Ext.getCmp('main-tab-panel').add({\n    id: 'appinfo-tab',\n    sm_treePath: treePath,\n    iconCls: 'sm-info-circle-icon',\n    bodyStyle: \"background-color:transparent;\",\n    title: 'Application Info',\n    closable: true,\n    layout: 'vbox',\n    layoutConfig: {\n      align: 'stretch'\n    },\n    border: false,\n    items: [sourcePanel, tabPanel]\n  })\n  thisTab.show()\n\n  await onFetchFromApi(false)\n}"
  },
  {
    "path": "client/src/js/SM/AssetSelection.js",
    "content": "Ext.ns('SM.AssetSelection')\n\nSM.AssetSelection.GridPanel = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    const fields = Ext.data.Record.create([\n      { name: 'assetId', type: 'string' },\n      { name: 'name', type: 'string' },\n      { name: 'ip', type: 'string' },\n      { name: 'fqdn', type: 'string' },\n      { name: 'mac', type: 'string' },\n      'labelIds',\n      { name: 'benchmarkIds', convert: (v, r) => r.stigs.map(stig => stig.benchmarkId) },\n      { name: 'collection' }\n    ])\n    const sm = new Ext.grid.CheckboxSelectionModel({\n      singleSelect: false,\n      checkOnly: false,\n      listeners: {\n        selectionchange: function (sm) {\n          SM.SetCheckboxSelModelHeaderState(sm)\n        }\n      }\n    })\n    const columns = [\n      sm,\n      {\n        header: \"Asset\",\n        width: 150,\n        dataIndex: 'name',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"Labels\",\n        width: 120,\n        dataIndex: 'labelIds',\n        sortable: false,\n        filter: {\n          type: 'multi-value',\n          collectionId: this.collectionId,\n          comparer: function (a, b) {\n            return SM.ColumnFilters.CompareFns.labelIds(a, b, _this.collectionId)\n            },          \n          renderer: SM.ColumnFilters.Renderers.labels\n        },\n        renderer: function (value) {\n          const labels = []\n          for (const labelId of value) {\n            const label = SM.Cache.getCollectionLabel(_this.collectionId, labelId)\n            if (label) labels.push(label)\n          }\n          labels.sort((a, b) => a.name.localeCompare(b.name))\n          return SM.Manage.Collection.LabelArrayTpl.apply(labels)\n        }\n      },\n      {\n        header: \"STIGs\",\n        width: 50,\n        align: 'center',\n        dataIndex: 'benchmarkIds',\n        sortable: true,\n        hidden: false,\n        filter: { type: 'values' },\n        renderer: function (value, metadata, record) {\n          let qtipWidth = 230\n          if (value.length > 0) {\n            let longest = Math.max(...(value.map(el => el.length)))\n            qtipWidth = longest * 8\n          }\n          metadata.attr = ` ext:qwidth=${qtipWidth} ext:qtip=\"<b>${SM.he(record.data.name)} STIGs</b><br>${value.map(SM.he).join('<br>')}\"`\n          return `<i>${value.length}</i>`\n        }\n      },\n      {\n        header: \"FQDN\",\n        width: 100,\n        dataIndex: 'fqdn',\n        sortable: true,\n        hidden: true,\n        renderer: SM.styledEmptyRenderer,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"IP\",\n        width: 100,\n        dataIndex: 'ip',\n        hidden: true,\n        sortable: true,\n        renderer: SM.styledEmptyRenderer\n      },\n      {\n        header: \"MAC\",\n        hidden: true,\n        width: 110,\n        dataIndex: 'mac',\n        sortable: true,\n        renderer: SM.styledEmptyRenderer,\n        filter: { type: 'string' }\n      },\n\n    ]\n    const store = new Ext.data.JsonStore({\n      fields,\n      idProperty: 'assetId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC'\n      },\n    })\n    const totalTextCmp = new SM.RowCountTextItem({\n      store,\n      noun: 'asset',\n      iconCls: 'sm-asset-icon'\n    })\n    const config = {\n      store,\n      columns,\n      sm,\n      enableDragDrop: true,\n      ddText : '{0} selected Asset{1}',\n      bodyCssClass: 'sm-grid3-draggable',\n      ddGroup: `SM.AssetSelection.GridPanel-${this.role}`,\n      border: true,\n      loadMask: false,\n      stripeRows: true,\n      view: new SM.ColumnFilters.GridViewBuffered({\n        forceFit: true,\n        emptyText: 'No Assets to display',\n        listeners: {\n          filterschanged: function (view, item, value) {\n            store.filter(view.getFilterFns())\n          }\n        }\n      }),\n      bbar: new Ext.Toolbar({\n        items: [\n          {\n            xtype: 'exportbutton',\n            grid: this,\n            hasMenu: false,\n            gridBasename: 'Assets (grid)',\n            storeBasename: 'Assets (store)',\n            iconCls: 'sm-export-icon',\n            text: 'CSV'\n          },\n          {\n            xtype: 'tbfill'\n          },\n          {\n            xtype: 'tbseparator'\n          },\n          totalTextCmp\n        ]\n      })\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.AssetSelection.SelectingPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    function setupDragZone (grid) {\n      const gridDragZone = grid.getView().dragZone\n      const originalGetDragData = gridDragZone.getDragData\n      gridDragZone.getDragData = function (e) {\n        const t = Ext.lib.Event.getTarget(e)\n        if (t.className === 'x-grid3-row-checker') {\n          return false\n        }\n        return originalGetDragData.call(gridDragZone, e)\n      }\n      \n      const originalStartDrag = gridDragZone.startDrag\n      gridDragZone.startDrag = function (x, y) {\n        Ext.getBody().addClass('sm-grabbing')\n        return originalStartDrag.call(gridDragZone, x, y)\n      }\n\n      const originalOnDragDrop = gridDragZone.onDragDrop\n      gridDragZone.onDragDrop = function (e, id) {\n        Ext.getBody().removeClass('sm-grabbing')\n        return originalOnDragDrop.call(gridDragZone, e, id)\n      }\n\n      const originalOnInvalidDrop = gridDragZone.onInvalidDrop\n      gridDragZone.onInvalidDrop = function (e, id) {\n        Ext.getBody().removeClass('sm-grabbing')\n        return originalOnInvalidDrop.call(gridDragZone, e)\n      }\n\n    }\n    const availableGrid = new SM.AssetSelection.GridPanel({\n      title: 'Available',\n      headerCssClass: 'sm-available-panel-header',\n      role: 'available',\n      collectionId: this.collectionId,\n      flex: 1,\n      listeners: {\n        render: function (grid) {\n          setupDragZone(grid)\n          const gridDropTargetEl = grid.getView().scroller.dom;\n          const gridDropTarget = new Ext.dd.DropTarget(gridDropTargetEl, {\n            ddGroup: selectionsGrid.ddGroup,\n            notifyDrop: function (ddSource, e, data) {\n              const selectedRecords = ddSource.dragData.selections;\n              changeSelectedAssets(selectionsGrid, selectedRecords, availableGrid)\n              return true\n            }\n          })\n        },\n\n      }\n    })\n    const selectionsGrid = new SM.AssetSelection.GridPanel({\n      title: this.selectionsGridTitle || 'Assigned',\n      headerCssClass: 'sm-selections-panel-header',\n      role: 'selections',\n      collectionId: this.collectionId,\n      flex: 1,\n      listeners: {\n        render: function (grid) {\n          setupDragZone(grid)\n          const gridDropTargetEl = grid.getView().scroller.dom;\n          const gridDropTarget = new Ext.dd.DropTarget(gridDropTargetEl, {\n            ddGroup: availableGrid.ddGroup,\n            notifyDrop: function (ddSource, e, data) {\n              const selectedRecords = ddSource.dragData.selections;\n              changeSelectedAssets(availableGrid, selectedRecords, selectionsGrid)\n              return true\n            }\n          })\n        }\n      }\n    })\n    availableGrid.getSelectionModel().on('selectionchange', handleSelections, selectionsGrid)\n    selectionsGrid.getSelectionModel().on('selectionchange', handleSelections, availableGrid)\n\n    const addBtn = new Ext.Button({\n      iconCls: 'sm-add-assignment-icon',\n      margins: \"0 10 10 10\",\n      disabled: true,\n      handler: function (btn) {\n        const selectedRecords = availableGrid.getSelectionModel().getSelections()\n        changeSelectedAssets(availableGrid, selectedRecords, selectionsGrid)\n        btn.disable()\n      }\n    })\n    const removeBtn = new Ext.Button({\n      iconCls: 'sm-remove-assignment-icon',\n      margins: \"0 10 10 10\",\n      disabled: true,\n      handler: function (btn) {\n        const selectedRecords = selectionsGrid.getSelectionModel().getSelections()\n        changeSelectedAssets(selectionsGrid, selectedRecords, availableGrid)\n        btn.disable()\n      }\n    })\n    const buttonPanel = new Ext.Panel({\n      bodyStyle: 'background-color:transparent;border:none',\n      width: 60,\n      layout: {\n        type: 'vbox',\n        pack: 'center',\n        align: 'center',\n        padding: \"10 10 10 10\"\n      },\n      items: [\n        addBtn,\n        removeBtn,\n        { xtype: 'panel', border: false, html: '<i>or drag</i>' }\n      ]\n    })\n\n    function handleSelections() {\n      const sm = this.selModel\n      if (sm.hasSelection()) {\n        sm.suspendEvents()\n        sm.clearSelections()\n        sm.resumeEvents()\n        SM.SetCheckboxSelModelHeaderState(sm)\n      }\n      const availableSelected = availableGrid.selModel.hasSelection()\n      const selectionsSelected = selectionsGrid.selModel.hasSelection()\n      addBtn.setDisabled(!availableSelected)\n      removeBtn.setDisabled(!selectionsSelected)\n    }\n\n    async function initPanel({ benchmarkId, labelId }) {\n      const promises = [\n        Ext.Ajax.requestPromise({\n          responseType: 'json',\n          url: `${STIGMAN.Env.apiBase}/assets`,\n          params: {\n            collectionId: _this.collectionId,\n            projection: ['stigs']\n          },\n          method: 'GET'\n        })\n      ]\n      if (benchmarkId) {\n        promises.push(Ext.Ajax.requestPromise({\n          responseType: 'json',\n          url: `${STIGMAN.Env.apiBase}/collections/${_this.collectionId}/stigs/${benchmarkId}/assets`,\n          method: 'GET'\n        }))\n        _this.trackedProperty = { dataProperty: 'benchmarkIds', value: benchmarkId }\n      }\n      else if (labelId) {\n        promises.push(Ext.Ajax.requestPromise({\n          responseType: 'json',\n          url: `${STIGMAN.Env.apiBase}/collections/${_this.collectionId}/labels/${labelId}/assets`,\n          method: 'GET'\n        }))\n        _this.trackedProperty = { dataProperty: 'labelIds', value: labelId }\n      }\n      const [apiAvailableAssets, apiAssignedAssets = []] = await Promise.all(promises)\n      const assignedAssetIds = apiAssignedAssets.map(apiAsset => apiAsset.assetId)\n      _this.originalAssetIds = assignedAssetIds\n      const availableAssets = []\n      const assignedAssets = []\n      apiAvailableAssets.reduce((accumulator, asset) => {\n        const property = assignedAssetIds.includes(asset.assetId) ? 'assignedAssets' : 'availableAssets'\n        accumulator[property].push(asset)\n        return accumulator\n      }, { availableAssets, assignedAssets })\n\n      availableGrid.store.loadData(availableAssets)\n      selectionsGrid.store.loadData(assignedAssets)\n    }\n\n    function changeSelectedAssets(srcGrid, records, dstGrid) {\n      srcGrid.store.suspendEvents()\n      dstGrid.store.suspendEvents()\n      srcGrid.store.remove(records)\n      dstGrid.store.add(records)\n      for (const record of records) {\n        if (srcGrid.role === 'available') {\n          record.data[_this.trackedProperty.dataProperty].push(_this.trackedProperty.value)\n          record.commit()\n        }\n        else {\n          record.data[_this.trackedProperty.dataProperty] = record.data[_this.trackedProperty.dataProperty].filter(i => i !== _this.trackedProperty.value)\n          record.commit()\n        }\n      }\n      const { field, direction } = dstGrid.store.getSortState()\n      dstGrid.store.sort(field, direction)\n      srcGrid.store.resumeEvents()\n      dstGrid.store.resumeEvents()\n      srcGrid.store.fireEvent('datachanged', srcGrid.store)\n      dstGrid.store.fireEvent('datachanged', dstGrid.store)\n      srcGrid.store.fireEvent('update', srcGrid.store)\n      dstGrid.store.fireEvent('update', dstGrid.store)\n      dstGrid.store.filter(dstGrid.getView().getFilterFns())\n\n      dstGrid.getSelectionModel().selectRecords(records)\n      dstGrid.getView().focusRow(dstGrid.store.indexOfId(records[0].data.assetId))\n      _this.fireEvent('assetselectionschanged')\n    }\n\n    function getValue() {\n      const records = selectionsGrid.store.snapshot?.items ?? selectionsGrid.store.getRange()\n      return records.map(record => record.data.assetId)\n    }\n\n    const config = {\n      layout: 'hbox',\n      layoutConfig: {\n        align: 'stretch'\n      },\n      name: 'assets',\n      border: false,\n      items: [\n        availableGrid,\n        buttonPanel,\n        selectionsGrid\n      ],\n      availableGrid,\n      selectionsGrid,\n      initPanel,\n      getValue,\n      // need fns below so Ext handles us like a form field\n      setValue: () => { },\n      markInvalid: function () { },\n      clearInvalid: function () { },\n      isValid: () => true,\n      getName: () => this.name,\n      validate: () => true\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})"
  },
  {
    "path": "client/src/js/SM/Attachments.js",
    "content": "Ext.ns('SM.Attachments')\n\nSM.Attachments.Grid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function() {\n    const me = this\n    const nonce = Ext.id()\n    const fields = [\n      'name',\n      'size',\n      'type',\n      'description',\n      'digest',\n      'user',\n      {\n        name: 'date',\n        type: 'date',\n        dateFormat: 'c'\n      }\n    ]\n    const store = new Ext.data.JsonStore({\n      grid: this,\n      root: '',\n      fields: fields,\n      idProperty: 'digest'\n    })\n    // const totalTextCmp = new SM.RowCountTextItem ({\n    //   store: store\n    // })\n    const columns = [\n      {\n        header: \"Artifact\",\n        id: `name-${nonce}`,\n        width: 100,\n        dataIndex: 'name',\n        sortable: true,\n        align: 'left',\n        renderer: function (value, metadata, record) {\n          var returnStr = '<img src=\"' + getFileIcon(value) + '\" class=\"sm-artifact-file-icon\">';\n          returnStr += '<b>' + SM.he(value) + '</b>';\n          returnStr += '<br><b>Type:</b> ' + record.data.type + ' <b>Size:</b> ' + record.data.size;\n          returnStr += `<br><i>Attached ${record.data.date.format('Y-m-d')} by ${SM.he(record.data.user.name)}</i>`;\n          return returnStr;\n        }\n      },\n      {\n        width: 25,\n        header: 'view', // not shown, used in cellclick handler\n        fixed: true,\n        dataIndex: 'none',\n        renderer: function (value, metadata, record) {\n          metadata.css = 'artifact-view'\n          metadata.attr = 'ext:qtip=\"View artifact\"'\n          return ''\n        }\n      },\n      {\n        width: 25,\n        header: 'download', // not shown, used in cellclick handler\n        fixed: true,\n        dataIndex: 'none',\n        renderer: function (value, metadata, record) {\n          metadata.css = 'artifact-download'\n          metadata.attr = 'ext:qtip=\"Download artifact\"'\n          return ''\n        }\n      },\n      {\n        width: 25,\n        header: 'delete',\n        fixed: true,\n        dataIndex: 'none',\n        renderer: function (value, metadata, record) {\n          metadata.css = 'artifact-delete';\n          metadata.attr = 'ext:qtip=\"Unattach the artifact from this review\"';\n          return '';\n        }\n      }\n    ]\n    const loadArtifacts = async function () {\n      try {\n        store.removeAll()\n        const artifactValue = await getMetadataValue('artifacts')\n        store.loadData(JSON.parse(artifactValue))\n        return true\n      }\n      catch (e) {\n        return false\n      }\n    }\n    const getMetadataValue = async function (key) {\n      return Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/collections/${me.collectionId}/reviews/${me.assetId}/${me.ruleId}/metadata/keys/${key}`,\n        method: 'GET'\n      })\n    }\n    const onFileSelected = async function (uploadField) {\n      try {\n        let input = uploadField.fileInput.dom\n        const files = [...input.files]\n        await putArtifact(files[0])\n        uploadField.reset()\n      }\n      catch (e) {\n        uploadField.reset()\n        SM.Error.handleError(e)\n      }\n    }\n\n    const putArtifact = async function (file) {\n      let md\n      try {\n        md = await getMetadataFromFile(file)\n        await putMetadataValue(md.attachment.digest, md.data)\n      }\n      catch (e) {\n        SM.Error.handleError(e)\n        return\n      }\n      try {\n        store.loadData([md.attachment], true) // append\n        const data = store.getRange().map( record => record.data )\n        await putMetadataValue('artifacts', JSON.stringify(data))\n      }\n      catch (e) {\n        try {\n          await deleteMetadataKey(md.attachment.digest)\n        }\n        catch (e2) {\n          console.log(e2)\n          SM.Error.handleError(e2)\n        }\n      }\n    }\n    const getMetadataFromFile = async function  (file) {\n      const dataBuffer = await readArrayBufferAsync(file)\n      const base64 = btoa(\n        new Uint8Array(dataBuffer)\n          .reduce((data, byte) => data + String.fromCharCode(byte), '')\n      );\n      const hashBuffer = await crypto.subtle.digest(\"SHA-256\", dataBuffer); // hash the message\n      const hashArray = Array.from(new Uint8Array(hashBuffer)); // convert buffer to byte array, then regular array.\n      const shahex = hashArray\n      .map((b) => b.toString(16).padStart(2, \"0\"))\n      .join(\"\"); // convert bytes to hex string\n      return {\n        attachment: {\n          name: file.name,\n          date: new Date(),\n          size: file.size,\n          type: file.type,\n          user: {\n            userId: curUser.userId,\n            name: curUser.displayName\n          },\n          digest: shahex\n        },\n        data: base64\n      }\n    }\n    const putMetadataValue = async function (key, value) {\n      return Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/collections/${me.collectionId}/reviews/${me.assetId}/${me.ruleId}/metadata/keys/${key}`,\n        method: 'PUT',\n        jsonData: JSON.stringify(value)\n      })\n    }\n    const removeArtifact = async function (record) {\n      const confirm = await SM.confirmPromise('Confirm',`Remove ${record.data.name}?`)\n      if (confirm === 'yes') {\n        try {\n          await deleteMetadataKey(record.data.digest)\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n          return\n        }\n        try {\n          store.remove(record)\n          const data = store.getRange().map( r => r.data)\n          await putMetadataValue('artifacts', JSON.stringify(data))  \n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n      }\n    }\n    const deleteMetadataKey = async function (key) {\n      let result = await Ext.Ajax.requestPromise({\n        url: `${STIGMAN.Env.apiBase}/collections/${me.collectionId}/reviews/${me.assetId}/${me.ruleId}/metadata/keys/${key}`,\n        method: 'DELETE'\n      })\n      return result.response.responseText ? JSON.parse(result.response.responseText) : \"\"\n    }\n    const showImage = async function (artifactObj) {\n      const imagePanel = new Ext.Panel({\n        bodyStyle: 'background-color: #333;'\n      })\n      const vpSize = Ext.getBody().getViewSize()\n      let height = vpSize.height * 0.75\n      let width = vpSize.width * 0.75 <= 1024 ? vpSize.width * 0.75 : 1024\n      const fpwindow = new Ext.Window({\n        title: `Image`,\n        modal: true,\n        resizable: true,\n        width: width,\n        height: height,\n        layout: 'fit',\n        plain: true,\n        bodyStyle: 'padding:5px;',\n        buttonAlign: 'center',\n        items: imagePanel\n      })\n      fpwindow.show()\n      // could show a wait indicator for image loading if necessary\n      try {\n        const allowedMimeTypes = ['image/gif', 'image/jpeg', 'image/svg+xml', 'image/png', 'image/bmp']\n        if (!allowedMimeTypes.includes(artifactObj.type)) {\n          throw new Error(`Unsupported image type: ${artifactObj.type}`)\n        }\n        const imageB64 = await getMetadataValue(artifactObj.digest)\n        imagePanel.update(`<img style='height: 100%; width: 100%; object-fit: contain' src='data:${SM.he(artifactObj.type)};base64,${encodeURI(imageB64)}'></img>`)\n      }\n      catch (e) {\n       SM.Error.handleError(e)\n      }\n    }\n    const downloadArtifact = async function (artifactObj) {\n      try {\n        const imageB64 = await getMetadataValue(artifactObj.digest)\n        \n        // Create a link element for download\n        const link = document.createElement('a')\n        link.href = `data:${artifactObj.type};base64,${encodeURI(imageB64)}`\n        link.download = artifactObj.name\n        \n        // Append to document, trigger click, and remove\n        document.body.appendChild(link)\n        link.click()\n        document.body.removeChild(link)\n      }\n      catch (e) {\n        SM.Error.handleError(e)\n      }\n    }\n    const fileUploadField = new Ext.ux.form.FileUploadField({\n      buttonOnly: true,\n      accept: '.gif,.jpg,.jpeg,.svg,.png,.bmp',\n      webkitdirectory: false,\n      multiple: false,\n      style: 'width: 95px;',\n      buttonText: `Attach image...`,\n      buttonCfg: {\n          icon: \"img/attachment.svg\",\n          tooltip: ''\n      },\n      listeners: {\n          fileselected: onFileSelected\n      }      \n    })\n    const config = {\n      loadArtifacts: loadArtifacts,\n      fileUploadField: fileUploadField,\n      updateAttachmentButtonState: function(reviewExists, hasWriteAccess) {\n        fileUploadField.setDisabled(!reviewExists || !hasWriteAccess)\n        if (fileUploadField.button) {\n          if (!reviewExists) {\n            fileUploadField.button.setTooltip('Save the review before attaching evidence')\n          } else if (!hasWriteAccess) {\n            fileUploadField.button.setTooltip('No write access')\n          } else {\n            fileUploadField.button.setTooltip('Attach an image file as evidence for this review')\n          }\n        }\n      },\n      disableSelection: true,\n      layout: 'fit',\n      cls: 'custom-artifacts',\n      hideHeaders: true,\n      border: this.border || false,\n      store: store,\n      columns: columns,\n      stripeRows: true,\n      view: new SM.ColumnFilters.GridView({\n        forceFit: true,\n        emptyText: 'No attachments to display.',\n        deferEmptyText: false\n      }),\n      tbar: new Ext.Toolbar({\n        items: [\n          fileUploadField\n        ]\n      }),\n      loadMask: {msg: ''},\n      autoExpandColumn: `name-${nonce}`,\n      emptyText: 'No attachments to display',\n      listeners: {\n        cellclick: function (grid, rowIndex, columnIndex, e) {\n          var r = grid.getStore().getAt(rowIndex)\n          var header = grid.getColumnModel().getColumnHeader(columnIndex)\n          switch (header) {\n            case 'view':\n              showImage(r.data)\n              break\n            case 'download':\n              downloadArtifact(r.data)\n              break\n            case 'delete':\n              removeArtifact(r)\n              break\n          }\n        }\n      }\n    }   \n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.Attachments.Grid.superclass.initComponent.call(this)\n  }\n})\n\n\nfunction readBinaryStringAsync(file) {\n  return new Promise((resolve, reject) => {\n    let reader = new FileReader();\n    reader.onload = () => {\n      resolve(reader.result);\n    }\n    reader.onerror = reject;\n    reader.readAsBinaryString(file)\n  })\n}\n\nfunction readArrayBufferAsync(file) {\n  return new Promise((resolve, reject) => {\n    let reader = new FileReader();\n    reader.onload = () => {\n      resolve(reader.result);\n    }\n    reader.onerror = reject;\n    reader.readAsArrayBuffer(file)\n  })\n}\n"
  },
  {
    "path": "client/src/js/SM/BatchReview.js",
    "content": "Ext.ns('SM.BatchReview')\n\nSM.BatchReview.FormPanel = Ext.extend(Ext.form.FormPanel, {\n  initComponent: function () {\n    const _this = this\n\n    this.resultCombo = new SM.Review.Form.ResultCombo({\n      fieldSettings: this.fieldSettings,\n      listeners: {\n        select: function () {\n          _this.fireEvent('fieldschanged')\n        }\n      }\n    })\n    this.detailTextArea = new SM.Review.Form.DetailTextArea({\n      emptyText: 'Existing Detail text will be preserved',\n      anchor: '100%, 50%',\n      fieldSettings: this.fieldSettings,\n      onInput: () => {\n        _this.fireEvent('fieldschanged')\n      }\n    })\n    this.commentTextArea = new SM.Review.Form.CommentTextArea({\n      emptyText: 'Existing Comment text will be preserved',\n      anchor: '100%, 50%',\n      fieldSettings: this.fieldSettings,\n      onInput: () => {\n        _this.fireEvent('fieldschanged')\n      }\n    })\n\n    const config = {\n      border: false,\n      labelWidth: 65,\n      items: [\n        this.resultCombo,\n        this.detailTextArea,\n        this.commentTextArea\n      ],\n      layoutConfig: {\n        getLayoutTargetSize : function() {\n          var target = this.container.getLayoutTarget(), ret = {};\n          if (target) {\n              ret = target.getViewSize();\n  \n              // IE in strict mode will return a width of 0 on the 1st pass of getViewSize.\n              // Use getStyleSize to verify the 0 width, the adjustment pass will then work properly\n              // with getViewSize\n              if (Ext.isIE9m && Ext.isStrict && ret.width == 0){\n                  ret =  target.getStyleSize();\n              }\n              ret.width -= target.getPadding('lr');\n              ret.height -= target.getPadding('tb');\n              // change in this override to account for space used by \n              // the Result combo box and the 4px bottom-margin of each textarea\n              ret.height -= 34 \n          }\n          return ret;\n        } \n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.BatchReview.showDialog = function (fieldSettings, initialResult) {\n  return new Promise ((resolve, reject) => {\n    try {\n      const actionBtn = new Ext.Button({\n        text: \"Apply Review\",\n        disabled: true,\n        handler: function (btn) {\n          const values = fp.getForm().getFieldValues()\n          fpwindow.close()\n          resolve({\n            result: values.result,\n            detail: values.detail === '' ? undefined : values.detail.trim(),\n            comment: values.comment === '' ? undefined : values.comment.trim()\n          })\n        }\n      })\n      const fp = new SM.BatchReview.FormPanel({\n        fieldSettings,\n        actionBtn,\n        listeners: {\n            fieldschanged: function () {\n            const values = fp.getForm().getFieldValues();\n\n            const result = (values.result ?? '')\n            const hasResult = result !== ''\n\n            const resultDirty = hasResult && result !== (initialResult ?? '')\n            const commentDetailDirty =\n              (values.detail && (values.detail)!== '') ||\n              (values.comment && (values.comment) !== '')\n\n         \n            const canSubmit = hasResult && (resultDirty || commentDetailDirty)\n\n            actionBtn.setDisabled(!canSubmit)\n          }\n        }\n      })\n      if (initialResult) {\n        fp.resultCombo.setValue(initialResult)\n        actionBtn.disable()\n      }\n      const fpwindow = new Ext.Window({\n        title: `Batch Edit`,\n        modal: true,\n        resizable: true,\n        width: 520,\n        height: 560,\n        layout: 'fit',\n        plain: true,\n        bodyStyle: 'padding:10px;',\n        buttonAlign: 'right',\n        buttons: [\n          actionBtn\n        ],\n        items: fp\n      })\n      fpwindow.show()\n    }\n    catch (e) {\n      resolve(undefined)\n    }\n  })\n}\n\nSM.BatchReview.ResponsePanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const config = {}\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.BatchReview.ResponseCounts = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const config = {}\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.BatchReview.ResponseErrors = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const config = {}\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})"
  },
  {
    "path": "client/src/js/SM/Cache.js",
    "content": "Ext.ns('SM.Cache')\n\nSM.Cache.CollectionMap = new Map()\n\nSM.Cache.getCollections = async function () {\n  const apiCollections = await Ext.Ajax.requestPromise({\n    responseType: 'json',\n    url: `${STIGMAN.Env.apiBase}/collections`,\n    method: 'GET'\n  })\n  return SM.Cache.seedCollections(apiCollections)\n}\n\nSM.Cache.updateCollectionLabels = async function (collectionId) {\n  const collection = SM.Cache.CollectionMap.get(collectionId)\n  collection.labels = await Ext.Ajax.requestPromise({\n    responseType: 'json',\n    url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/labels`,\n    method: 'GET'\n  })\n  collection.labelMap = new Map()\n  for (const label of collection.labels) {\n    collection.labelMap.set(label.labelId, label)\n  }\n  return collection.labelMap\n}\n\n\nSM.Cache.updateCollectionSettings = async function (collectionId, settings) {\n  const collection = SM.Cache.CollectionMap.get(collectionId)\n  if (collection) {\n    collection.settings = settings\n  }\n}\n\nSM.Cache.refreshCollection = async function (collectionId) {\n  let apiCollection = await Ext.Ajax.requestPromise({\n    responseType: 'json',\n    url: `${STIGMAN.Env.apiBase}/collections/${collectionId}`,\n    method: 'GET',\n    params: {\n      projection: 'labels'\n    }\n  })\n  const collectionMap = SM.Cache.seedCollections([apiCollection])\n  return collectionMap.get(collectionId)\n}\n\nSM.Cache.updateCollection = function (apiCollection) {\n  let collectionObj = SM.Cache.CollectionMap.get(apiCollection.collectionId)\n  if (collectionObj) {\n    collectionObj = {...collectionObj, ...apiCollection}\n    if (apiCollection.labels) {\n      const labelMap = new Map()\n      for (const label of apiCollection.labels) {\n        labelMap.set(label.labelId, label)\n      }\n      collectionObj.labelMap = labelMap\n    }\n    SM.Cache.CollectionMap.set(apiCollection.collectionId, collectionObj)\n  }\n  else {\n    SM.Cache.seedCollections([apiCollection])\n  }\n}\n\nSM.Cache.seedCollections = function (apiCollections) {\n  for (const collection of apiCollections) {\n    const labelMap = new Map()\n    SM.Cache.CollectionMap.set(collection.collectionId, { labelMap, ...collection })\n  }\n  return SM.Cache.CollectionMap\n}\n\nSM.Cache.getCollectionLabel = function (collectionId, labelId) {\n  if (!labelId || !collectionId) return undefined\n  return SM.Cache.CollectionMap.get(collectionId).labelMap.get(labelId) || {\n    labelId,\n    color: 'FF0000',\n    description: 'cross-collection label error',\n    name: 'ERROR'\n  }\n}\n\nSM.Dispatcher.addListener('collectioncreated', function( apiCollection, options) {\n  SM.Cache.seedCollections([apiCollection])\n})\n\nSM.Dispatcher.addListener('collectionchanged', function( apiCollection, options) {\n  SM.Cache.updateCollection(apiCollection)\n})\n\nSM.Dispatcher.addListener('collectiondeleted', function( collectionId) {\n  SM.Cache.CollectionMap.delete(collectionId)\n})\nSM.Dispatcher.addListener('labelcreated', function (collectionId, label) {\n  const collection = SM.Cache.CollectionMap.get(collectionId)\n  collection.labelMap.set(label.labelId, label)\n  collection.labels = Array.from(collection.labelMap.values()).sort((a,b) => a.name.localeCompare(b.name))\n})\n\nSM.Dispatcher.addListener('labelchanged', function (collectionId, label) {\n  const collection = SM.Cache.CollectionMap.get(collectionId)\n  collection.labelMap.set(label.labelId, label)\n  collection.labels = Array.from(collection.labelMap.values()).sort((a,b) => a.name.localeCompare(b.name))\n})\n\nSM.Dispatcher.addListener('labeldeleted', function (collectionId, labelId) {\n  const collection = SM.Cache.CollectionMap.get(collectionId)\n  collection.labelMap.delete(labelId)\n  collection.labels = Array.from(collection.labelMap.values()).sort((a,b) => a.name.localeCompare(b.name))\n})\n\nSM.Dispatcher.addListener('collectionsettingschanged', function (collectionId, settings) {\n  SM.Cache.updateCollectionSettings(collectionId, settings)\n})\n"
  },
  {
    "path": "client/src/js/SM/Checklist.js",
    "content": "Ext.ns(\"SM.Checklist\")\nExt.ns(\"SM.Checklist.Asset\")\n\nSM.Checklist.Asset.Menu = Ext.extend(Ext.menu.Menu, {\n  initComponent: function () {\n    const conf = {}\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Checklist.Asset.Grid = Ext.extend(Ext.grid.Grid, {\n  initComponent: function () {\n    const _this = this\n    const fields = [\n      'assetId',\n      {\n        name: 'groupId',\n        type: 'string',\n        sortType: sortGroupId\n      },\n      {\n        name: 'ruleId',\n        type: 'string',\n        sortType: sortRuleId\n      },\n      {\n        name: 'groupTitle',\n        type: 'string'\n      },\n      {\n        name: 'ruleTitle',\n        type: 'string'\n      },\n      {\n        name: 'version',\n        type: 'string'\n      },\n      {\n        name: 'severity',\n        type: 'string',\n        sortType: sortSeverity\n      },\n      {\n        name: 'result',\n        type: 'string'\n      },\n      {\n        name: 'status',\n        type: 'string'\n      },\n      {\n        name: 'hasAttach',\n        type: 'boolean'\n      }, \n      'resultEngine',\n      {\n        name: 'engineResult',\n        convert: engineResultConverter\n      },\n      {\n        name: 'touchTs',\n        type: 'date'\n      }\n    ]\n    const store = new Ext.data.JsonStore({\n      proxy: new Ext.data.HttpProxy({\n        url: `${STIGMAN.Env.apiBase}/assets/${this.assetId}/checklists/${this.benchmarkId}/${this.revisionStr}?format=json-access`,\n        method: 'GET'\n      }),\n      root: 'checklist',\n      fields,\n      idProperty: 'ruleId',\n      sortInfo: {\n        field: 'ruleId',\n        direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      },\n      listeners: {\n        load: function (store, records) {\n          reviewForm.defaultAccess = store.reader.jsonData.access\n          groupChecklistMenu.importItem.setVisible(store.reader.jsonData.access === 'rw')\n          groupGrid.accessStr = store.reader.jsonData.access === 'rw' ? '' : 'read only'\n          // Were we passed a specific rule to select?\n          if ('undefined' !== typeof selectedRule) {\n            var index = store.find('ruleId', selectedRule);\n            groupGrid.getSelectionModel().selectRow(index);\n  \n            var rowEl = groupGrid.getView().getRow(index);\n            //rowEl.scrollIntoView(ourGrid.getGridEl(), false);\n            rowEl.scrollIntoView();\n            //ourGrid.getView().focusRow(index+5);\n          } else {\n            groupGrid.getSelectionModel().selectFirstRow();\n          }\n  \n          groupGrid.statSprites.setText(getStatsString(store))\n        },\n        clear: function () {\n          groupGrid.statSprites.setText(getStatsString(store));\n        },\n        update: function (store) {\n          groupGrid.statSprites.setText(getStatsString(store));\n        },\n        datachanged: function (store) {\n          groupGrid?.statSprites.setText(getStatsString(store));\n        }\n      }\n    })\n\n\n\n\n    const conf = {}\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})"
  },
  {
    "path": "client/src/js/SM/Classification.js",
    "content": "'use strict'\n\nExt.ns('SM')\n\nclass Classification {\n    constructor (apiClassification) {\n        this.showBanner = true\n        switch (apiClassification) {\n            case 'U':\n                this.classificationCls = 'unclassified'\n                this.classificationText = 'UNCLASSIFIED (U)'\n                break\n            case 'CUI':\n            case 'FOUO':\n                this.classificationCls = 'cui'\n                this.classificationText = 'CONTROLLED (CUI)'\n                break\n            case 'C':\n                this.classificationCls = 'confidential'\n                this.classificationText = 'CONFIDENTIAL (C)'\n                break\n            case 'S':\n                this.classificationCls = 'secret'\n                this.classificationText = 'SECRET (S)'\n                break\n            case 'TS':\n                this.classificationCls = 'topsecret'\n                this.classificationText = 'TOP SECRET (TS)'\n                break\n            case 'SCI':\n                this.classificationCls = 'sci'\n                this.classificationText = 'TOP SECRET / SCI (TS/SCI)'\n                break\n            case 'NONE':\n            default:\n                this.showBanner = false\n                break\n        }\n    }\n}"
  },
  {
    "path": "client/src/js/SM/CollectionClone.js",
    "content": "Ext.ns('SM.CollectionClone')\n\n\nSM.CollectionClone.ClickThruPanel = Ext.extend(Ext.form.FormPanel, {\n  initComponent: function () {\n    const _this = this\n    const displayField = new Ext.form.DisplayField({\n      value: SM.TipContent.CloneOptions.ClickThru\n    })\n    const disableCheckbox = new Ext.form.Checkbox({\n      boxLabel: `Don't show this warning again during this session`,\n      margins: '30 0 0 0',\n      listeners: {\n        check: function (cb, checked) {\n          sessionStorage.setItem('noCloneWarning', checked ? 'true' : 'false')\n        }\n      }\n    })\n    const continueBtn = new Ext.Button({\n      text: 'Continue',\n      // iconCls: 'sm-clone-icon',\n      handler: this.btnHandler\n    })\n    const config = {\n      baseCls: 'x-plain',\n      cls: 'sm-collection-manage-layout sm-round-panel',\n      bodyStyle: 'padding: 9px;',\n      border: false,\n      hideLabels: true,\n      layout: 'vbox',\n      items: [\n        displayField,\n        disableCheckbox\n      ],\n      buttons: [\n        continueBtn\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.CollectionClone.ComboBox = Ext.extend(SM.Global.HelperComboBox, {\n  initComponent: function () {\n    const _this = this\n    const data = this.data || []\n    this.store = new Ext.data.SimpleStore({\n      fields: ['value', 'display']\n    })\n    this.store.on('load', function (store) {\n      _this.setValue(store.getAt(0).get('value'))\n    })\n    const config = {\n      displayField: 'display',\n      valueField: 'value',\n      triggerAction: 'all',\n      mode: 'local',\n      editable: false\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n    this.store.loadData(data)\n  }\n})\n\nSM.CollectionClone.CloneFormPanel = Ext.extend(Ext.form.FormPanel, {\n  initComponent: function () {\n    const _this = this\n    const nameField = new Ext.form.TextField({\n      fieldLabel: 'Name',\n      enableKeyEvents: true,\n      labelStyle: 'font-weight: 600;',\n      name: 'name',\n      allowBlank: false,\n      value: this.sourceName ? `Clone of ${this.sourceName}` : '',\n      anchor: '-5',\n      listeners: {\n        keyup: handleInput\n      }\n    })\n    const descriptionField = new Ext.form.TextArea({\n      fieldLabel: 'Description',\n      labelStyle: 'font-weight: 600;',\n      name: 'description',\n      anchor: '-5',\n      value: `Cloned from ${this.sourceName} on ${new Date().toLocaleDateString('en-CA')} by ${curUser.displayName}`\n    })\n    const grantsCb = new SM.Global.HelperCheckbox({\n      boxLabel: 'Grants',\n      name: 'grants',\n      checked: true,\n      helpText: SM.TipContent.CloneOptions.Grants,\n      listeners: {\n        check: handleInput\n      }\n\n    })\n    const labelsCb = new SM.Global.HelperCheckbox({\n      boxLabel: 'Labels',\n      name: 'labels',\n      checked: true,\n      helpText: SM.TipContent.CloneOptions.Labels,\n      listeners: {\n        check: handleInput\n      }\n    })\n    const assetsCb = new SM.Global.HelperCheckbox({\n      boxLabel: 'Assets',\n      name: 'assets',\n      checked: true,\n      helpText: SM.TipContent.CloneOptions.Assets,\n      listeners: {\n        check: handleInput\n      }\n    })\n    const cbGroup = new Ext.form.CheckboxGroup({\n      fieldLabel: 'Include',\n      allowBlank: false,\n      name: 'include',\n      columns: 1,\n      items: [\n        grantsCb,\n        labelsCb,\n        assetsCb\n      ]\n    })\n    const stigMappingsComboBox = new SM.CollectionClone.ComboBox({\n      name: 'stigMappings',\n      width: 220,\n      fieldLabel: 'STIGs',\n      helpText: SM.TipContent.CloneOptions.Stigs,\n      data: [\n        ['withReviews', 'Assignments and Reviews'],\n        ['withoutReviews', 'Assignments but not Reviews'],\n        ['none', 'Do not clone assignments or Reviews']\n      ],\n      listeners: {\n        select: handleInput\n      }\n    })\n    const pinRevisionsComboBox = new SM.CollectionClone.ComboBox({\n      name: 'pinRevisions',\n      width: 220,\n      fieldLabel: 'Pin Revisions',\n      helpText: SM.TipContent.CloneOptions.Revisions,\n      data: [\n        ['matchSource', \"Match the source's pinned revisions\"],\n        ['sourceDefaults', \"Pin the source's default revisions\"]\n      ]\n    })\n    const cloneBtn = new Ext.Button({\n      text: 'Clone',\n      iconCls: 'sm-clone-icon',\n      handler: this.btnHandler\n    })\n\n    function getApiValues() {\n      return {\n        name: nameField.getValue(),\n        description: descriptionField.getValue(),\n        options: {\n          grants: grantsCb.getValue(),\n          labels: labelsCb.getValue(),\n          assets: assetsCb.getValue(),\n          stigMappings: stigMappingsComboBox.getValue(),\n          pinRevisions: pinRevisionsComboBox.getValue()\n        }\n      }\n    }\n    function handleInput () {\n      stigMappingsComboBox.setDisabled(!assetsCb.checked)\n      pinRevisionsComboBox.setDisabled(!assetsCb.checked || stigMappingsComboBox.getValue() === 'none')\n      cloneBtn.setDisabled(nameField.getValue() === '' || (!assetsCb.checked && !labelsCb.checked && !grantsCb.checked))\n    }\n    const config = {\n      baseCls: 'x-plain',\n      cls: 'sm-collection-manage-layout sm-round-panel',\n      bodyStyle: 'padding: 9px;',\n      border: false,\n      labelWidth: 100,\n      getApiValues,\n      nameField,\n      items: [\n        {\n          xtype: 'fieldset',\n          title: 'New Collection information',\n          items: [nameField, descriptionField]\n        },\n        {\n          xtype: 'fieldset',\n          title: 'Cloning Options',\n          items: [cbGroup, stigMappingsComboBox, pinRevisionsComboBox]\n        }\n      ],\n      buttons: [\n        cloneBtn\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.CollectionClone.CloneProgressPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const pb = new Ext.ProgressBar({\n      flex: 0\n    })\n    const config = {\n      baseCls: 'x-plain',\n      cls: 'sm-collection-manage-layout sm-round-panel',\n      bodyStyle: 'padding: 9px;',\n      border: false,\n      items: [pb],\n      pb\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.CollectionClone.CloneErrorPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const copyBtn = new Ext.Button({\n      text: 'Unexpected Error. Click to copy the log to the clipboard.',\n      iconCls: 'sm-error-icon',\n      margins: '0 5 0 0',\n      handler: function () {\n        navigator.clipboard.writeText(_this.log)\n      }\n    })\n    const config = {\n      baseCls: 'x-plain',\n      cls: 'sm-collection-manage-layout sm-round-panel',\n      bodyStyle: 'padding: 9px;',\n      border: false,\n      layout: 'hbox',\n      layoutConfig: {\n        pack: 'center'\n      },\n      items: [copyBtn],\n      copyBtn\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.CollectionClone.PostClonePanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const manageBtn = new Ext.Button({\n      action: 'manage', \n      text: 'Manage the Collection',\n      iconCls: 'sm-setting-icon',\n      margins: '0 5 0 0',\n      handler: this.btnHandler\n    })\n    const viewBtn = new Ext.Button({\n      action: 'view', \n      text: 'View the Dashboard',\n      iconCls: 'sm-collection-icon',\n      margins: '0 0 0 5',\n      handler: this.btnHandler\n    })\n\n    const config = {\n      // baseCls: 'x-plain',\n      // cls: 'sm-collection-manage-layout sm-round-panel',\n      bodyStyle: 'padding: 9px;',\n      border: false,\n      layout: 'hbox',\n      layoutConfig: {\n        pack: 'center'\n      },\n      items: [manageBtn, viewBtn]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nfunction NDJSONStream(separator = '\\n') {\n  let buffer = ''\n  return new TransformStream({\n    transform(chunk, controller) {\n      buffer = buffer ? buffer + chunk : chunk\n      const segments = buffer.split(separator)\n      for (const segment of segments) {\n        const jsObj = SM.safeJSONParse(segment)\n        if (jsObj) {\n          controller.enqueue(jsObj)\n        }\n      }\n      buffer = buffer.endsWith(separator) ? '' : segments[segments.length - 1]\n    }\n  })\n}\n\nSM.CollectionClone.showCollectionClone = async function ({collectionId, sourceName}) {\n  try {\n    let showClickThru = !(sessionStorage.getItem('noCloneWarning') === 'true')\n    const width = 420\n    const height = 405\n    const fp = new SM.CollectionClone.CloneFormPanel({\n      sourceName,\n      btnHandler: cloneBtnHandler\n    })\n    const wp = new SM.CollectionClone.ClickThruPanel({btnHandler: clickThruHandler})\n\n    function clickThruHandler () {\n      fpwindow.removeAll()\n      fpwindow.add(fp)\n      fpwindow.doLayout()\n      fp.nameField.focus(true, true)\n    }\n    async function cloneBtnHandler (btn) {\n      try {\n        const jsonData = fp.getApiValues()\n        fpwindow.removeAll()\n        fpwindow.setTitle(`Creating \"${jsonData.name}\"`)\n        fpwindow.getTool('close').hide()\n        const progressPanel = new SM.CollectionClone.CloneProgressPanel()\n        fpwindow.add(progressPanel)\n        fpwindow.setHeight(80)\n        fpwindow.minimize()\n\n        progressPanel.pb.updateProgress(0, \"Cloning\")\n\n        \n        const response = await fetch(`${STIGMAN.Env.apiBase}/collections/${collectionId}/clone?projection=owners&projection=labels&projection=statistics`, {\n          method: 'POST',\n          headers: new Headers({\n            'Content-Type': 'application/json',\n            'Authorization': `Bearer ${window.oidcWorker.token}`\n          }),\n          body: JSON.stringify(jsonData)\n        })\n        if (!response.ok) {\n          const json = await response.json()\n          throw(new Error(`API responded with status ${response.status} ${JSON.stringify(json)}`))\n        }\n        const reader = response.body\n          .pipeThrough(new TextDecoderStream())\n          .pipeThrough(NDJSONStream())\n          .getReader()\n\n        let isDone = false\n        let isError = false\n        let haveResult = false\n        let apiCollection\n        const jsons = []\n        do {\n          const {value, done} = await reader.read()\n          isDone = done\n          if (value) {\n            jsons.push(value)\n            console.log(`chunk: ${JSON.stringify(value)}`)\n            if (value.stage === 'result') {\n              apiCollection = value.collection\n              haveResult = true\n            }\n            if (!fpwindow.isDestroyed) {\n              if (value.status === 'error') {\n                if (value.message === 'Unhandled error') {\n                  fpwindow.removeAll()\n                  fpwindow.setTitle(`Error creating \"${jsonData.name}\"`)\n                  fpwindow.getTool('close').show()\n                  const errorPanel = new SM.CollectionClone.CloneErrorPanel({\n                    log: JSON.stringify(jsons, null, 2)\n                  })\n                  fpwindow.add(errorPanel)\n                  fpwindow.doLayout()\n                }\n                else {\n                  progressPanel.pb.updateProgress(1, value.message)\n                  progressPanel.pb.addClass('sm-pb-error')\n                  fpwindow.getTool('close').show()\n                }\n                isDone = true\n                isError = true\n              }\n              else if (value.stage === 'collection') {\n                const progress = (value.step - 1)/value.stepCount\n                progressPanel.pb.updateProgress(progress, value.message)\n              }\n              else if (value.stage === 'reviews') {\n                if (value.stepName !== 'cloneReviews') {\n                  progressPanel.pb.updateProgress(1, 'Preparing to clone reviews...')\n                }\n                else {\n                  const progress = value.reviewsCopied/value.reviewsTotal\n                  progressPanel.pb.updateProgress(progress, `Cloning reviews (${value.reviewsCopied.toLocaleString()} of ${value.reviewsTotal.toLocaleString()})`)\n                }\n              }\n            }\n          }\n        } while (!isDone)\n\n        if (!fpwindow.isDestroyed && !isError) {\n          fpwindow.removeAll()\n          fpwindow.setTitle(`Created \"${apiCollection.name}\"`)\n          fpwindow.add(new SM.CollectionClone.PostClonePanel({ \n            btnHandler: function (btn) {\n              if (apiCollection) {\n                const openMethod = btn.action === 'manage' ? addCollectionManager : SM.CollectionPanel.showCollectionTab\n                openMethod({\n                  collectionId: apiCollection.collectionId,\n                  collectionName: apiCollection.name,\n                  treePath: SM.Global.mainNavTree.getCollectionLeaf(apiCollection.collectionId)?.getPath()\n                })\n                fpwindow.close()\n              }\n            }\n           }))\n          fpwindow.getTool('minimize').hide()\n          fpwindow.getTool('close').show()\n          fpwindow.doLayout()\n        }\n\n       if (haveResult) {\n        // Refresh the curUser global to include any new grants and fire the collectioncreated event\n        await SM.GetUserObject()\n        SM.Dispatcher.fireEvent( 'collectioncreated', apiCollection, {elevate: false, showManager: false})\n       } \n      }\n      catch (e) {\n        SM.Error.handleError(e)\n        fpwindow.close()\n      }\n    }\n\n    function vpResize (vp, adjWidth, adjHeight) {\n      if (fpwindow.minimized) {\n        const offset = 20\n        fpwindow.setPosition(adjWidth - fpwindow.getWidth()- offset, adjHeight - fpwindow.getHeight() - offset) \n      }\n      else {\n        fpwindow.center()\n      }\n    }\n\n    const fpwindow = new Ext.Window({\n      title: 'Clone Collection',\n      cls: 'sm-dialog-window sm-round-panel',\n      modal: true,\n      resizable: false,\n      closable: true,\n      minimizable: true,\n      maximizable: true,\n      constrain: true,\n      width,\n      height,\n      layout: 'fit',\n      plain: true,\n      bodyStyle: 'padding:5px;',\n      buttonAlign: 'right',\n      items: showClickThru ? wp : fp,\n      listeners: {\n        minimize: function() {\n          const offset = 20\n          fpwindow.mask.hide()\n          fpwindow.getTool('minimize').hide()\n          const vpSize = Ext.getCmp('app-viewport').getSize()\n          fpwindow.setPosition(vpSize.width - fpwindow.getWidth()- offset, vpSize.height - fpwindow.getHeight() - offset)\n          fpwindow.minimized = true\n        },\n        destroy: function () {\n          Ext.getCmp('app-viewport').removeListener('resize', vpResize)\n        }\n      }\n    })\n    fpwindow.render(Ext.getBody())\n    fpwindow.getTool('minimize').hide()\n    fpwindow.getTool('maximize').hide()\n    fpwindow.show()\n    if (!showClickThru) fp.nameField.focus(true, true)\n    Ext.getCmp('app-viewport').addListener('resize', vpResize)\n\n  }\n  catch (e) {\n    SM.Error.handleError(e)\n  }\n}\n"
  },
  {
    "path": "client/src/js/SM/CollectionPanel.js",
    "content": "Ext.ns('SM.CollectionPanel')\n\nChart.defaults.font = {\n  size: 11,\n  family: \"'Open Sans', helvetica, sans-serif\"\n}\n\nSM.CollectionPanel.Renderers = {\n  severityCount: function (v, md) {\n    return v === 0 ? '' : `<div class=\"sm-metrics-findings-count-cell sm-metrics-${this.dataIndex}-box\">${v}</div>`\n  }\n}\n\nSM.CollectionPanel.CommonFields = [\n  {\n    name: 'assessments',\n    type: 'integer',\n    mapping: 'metrics.assessments'\n  },\n  {\n    name: 'assessed',\n    type: 'integer',\n    mapping: 'metrics.assessed'\n  },\n  {\n    name: 'low',\n    type: 'integer',\n    mapping: 'metrics.findings.low'\n  },\n  {\n    name: 'coraScore',\n    type: 'float',\n    convert: (v, r) => {\n      return calculateCoraRiskRating(r.metrics).weightedAvg\n    }\n  },\n  {\n    name: 'coraScoreDetail',\n    type: 'auto',\n    convert: (v, r) => calculateCoraRiskRating(r.metrics)\n  },\n  {\n    name: 'medium',\n    type: 'integer',\n    mapping: 'metrics.findings.medium'\n  },\n  {\n    name: 'high',\n    type: 'integer',\n    mapping: 'metrics.findings.high'\n  },\n  {\n    name: 'saved',\n    type: 'integer',\n    mapping: 'metrics.statuses.saved'\n  },\n  {\n    name: 'submitted',\n    type: 'integer',\n    mapping: 'metrics.statuses.submitted'\n  },\n  {\n    name: 'accepted',\n    type: 'integer',\n    mapping: 'metrics.statuses.accepted'\n  },\n  {\n    name: 'rejected',\n    type: 'integer',\n    mapping: 'metrics.statuses.rejected'\n  },\n  {\n    name: 'pass',\n    type: 'integer',\n    mapping: 'metrics.results.pass'\n  },\n  {\n    name: 'fail',\n    type: 'integer',\n    mapping: 'metrics.results.fail'\n  },\n  {\n    name: 'notapplicable',\n    type: 'integer',\n    mapping: 'metrics.results.notapplicable'\n  },\n  {\n    name: 'unassessed',\n    type: 'integer',\n    mapping: 'metrics.results.other'\n  },\n  {\n    name: 'assessedPct',\n    convert: (v, r) => r.metrics.assessments ? r.metrics.assessed / r.metrics.assessments * 100 : 0\n  },\n  {\n    name: 'savedPct',\n    convert: (v, r) => r.metrics.assessments ? ((r.metrics.statuses.saved + r.metrics.statuses.submitted + r.metrics.statuses.accepted + r.metrics.statuses.rejected) / r.metrics.assessments) * 100 : 0\n  },\n  {\n    name: 'submittedPct',\n    convert: (v, r) => r.metrics.assessments ? ((r.metrics.statuses.submitted + r.metrics.statuses.accepted + r.metrics.statuses.rejected) / r.metrics.assessments) * 100 : 0\n  },\n  {\n    name: 'acceptedPct',\n    convert: (v, r) => r.metrics.assessments ? (r.metrics.statuses.accepted / r.metrics.assessments) * 100 : 0\n  },\n  {\n    name: 'rejectedPct',\n    convert: (v, r) => r.metrics.assessments ? (r.metrics.statuses.rejected / r.metrics.assessments) * 100 : 0\n  },\n  {\n    name: 'minTs',\n    type: 'date',\n    mapping: 'metrics.minTs'\n  },\n  {\n    name: 'maxTs',\n    type: 'date',\n    mapping: 'metrics.maxTs'\n  },\n  {\n    name: 'maxTouchTs',\n    type: 'date',\n    mapping: 'metrics.maxTouchTs'\n  }\n]\n\nSM.CollectionPanel.CommonColumns = [\n  {\n    header: \"Checks\",\n    width: 50,\n    dataIndex: 'assessments',\n    align: \"center\",\n    sortable: true\n  },\n  {\n    header: 'Oldest',\n    width: 50,\n    dataIndex: 'minTs',\n    align: 'center',\n    sortable: true,\n    renderer: renderDurationToNow\n  },\n  {\n    header: 'Newest',\n    width: 50,\n    dataIndex: 'maxTs',\n    align: 'center',\n    sortable: true,\n    renderer: renderDurationToNow\n  },\n  {\n    header: 'Updated',\n    width: 50,\n    dataIndex: 'maxTouchTs',\n    align: 'center',\n    sortable: true,\n    renderer: renderDurationToNow\n  },\n  {\n    header: \"Assessed\",\n    width: 75,\n    dataIndex: 'assessedPct',\n    // align: \"center\",\n    sortable: true,\n    renderer: renderPct\n  },\n  {\n    header: \"Submitted\",\n    width: 75,\n    dataIndex: 'submittedPct',\n    // align: \"center\",\n    sortable: true,\n    renderer: renderPct\n  },\n  {\n    header: \"Accepted\",\n    width: 75,\n    dataIndex: 'acceptedPct',\n    // align: \"center\",\n    sortable: true,\n    renderer: renderPct\n  },\n  {\n    header: \"Rejected\",\n    width: 75,\n    dataIndex: 'rejectedPct',\n    // align: \"center\",\n    sortable: true,\n    renderer: renderPctAllHigh\n  },\n  {\n    header: \"CORA %\",\n    width: 50,\n    align: \"center\",\n    dataIndex: 'coraScore',\n    sortable: true,\n    renderer: function (v, md, r) {\n      const detailedCora = r.get('coraScoreDetail')\n      let riskClass = getRiskClass(detailedCora.riskRating)\n      return `<div class=\"sm-cora-column ${riskClass}\" ext:qtip=\"<div style='white-space: nowrap;'>${SM.he(detailedCora.riskRating)}</div>\">${(detailedCora.weightedAvg * 100).toFixed(1)}</div>`\n    }\n  },\n  {\n    header: \"CAT 3\",\n    width: 50,\n    dataIndex: 'low',\n    align: \"center\",\n    sortable: true,\n    renderer: SM.CollectionPanel.Renderers.severityCount\n  },\n  {\n    header: \"CAT 2\",\n    width: 50,\n    dataIndex: 'medium',\n    align: \"center\",\n    sortable: true,\n    renderer: SM.CollectionPanel.Renderers.severityCount\n  },\n  {\n    header: \"CAT 1\",\n    width: 50,\n    dataIndex: 'high',\n    align: \"center\",\n    sortable: true,\n    renderer: SM.CollectionPanel.Renderers.severityCount\n  },\n]\n\nSM.CollectionPanel.AggGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n\n    const sm = this.checkboxSelModel ? new Ext.grid.CheckboxSelectionModel({\n      singleSelect: false,\n      checkOnly: false,\n    }) : new Ext.grid.RowSelectionModel({\n      singleSelect: true\n    })\n    const fields = [...SM.CollectionPanel.CommonFields]\n    const columns = []\n    if (this.checkboxSelModel) {\n      columns.push(sm)\n    }\n    let idProperty, sortField = 'name', autoExpandColumn = Ext.id()\n    let rowdblclick = () => { }\n    let cellmousedown = () => { }\n\n    function renderWithToolbar(v, md) {\n      return `\n      <div class=\"sm-grid-cell-with-toolbar\">\n        <div class=\"sm-dynamic-width\">\n          <div class=\"sm-info\">${v}</div>\n        </div>\n        <div class=\"sm-static-width\"><img class=\"sm-grid-cell-toolbar-edit\" ext:qtip=\"Open checklist\" src=\"img/shield-green-check.svg\" width=\"14\" height=\"14\"></div>\n      </div>`\n    }\n\n    const rowCountCfg = {\n      noun: this.aggregation,\n      iconCls: `sm-${this.aggregation}-icon`\n    }\n    switch (this.aggregation) {\n      case 'asset':\n        fields.push(\n          { name: 'assetId', type: 'string' },\n          { name: 'name', type: 'string' },\n          { name: 'labelIds', type: 'string', convert: (v, r) => r.labels.map(l => l.labelId) },\n          'benchmarkIds',\n          { name: 'stigCount', convert: (v, r) => r.benchmarkIds.length }\n        )\n        columns.push(\n          {\n            header: \"Asset\",\n            width: 175,\n            id: autoExpandColumn,\n            dataIndex: 'name',\n            sortable: true,\n            filter: { type: 'string' }\n          },\n          {\n            header: \"Labels\",\n            width: 120,\n            dataIndex: 'labelIds',\n            sortable: false,\n            filter: {\n              type: 'multi-value',\n              collectionId: _this.collectionId,\n              comparer: function (a, b) {\n                return SM.ColumnFilters.CompareFns.labelIds(a, b, _this.collectionId)\n                },\n              renderer: SM.ColumnFilters.Renderers.labels\n            },\n            renderer: function (value, metadata) {\n              const labels = []\n              for (const labelId of value) {\n                const label = SM.Cache.getCollectionLabel(_this.collectionId, labelId)\n                if (label) labels.push(label)\n              }\n              labels.sort((a, b) => a.name.localeCompare(b.name))\n              metadata.attr = 'style=\"white-space:nowrap;text-overflow:clip;\"'\n              return SM.styledEmptyRenderer(SM.Manage.Collection.LabelArrayTpl.apply(labels))\n            }\n          },\n          {\n            header: \"STIGs\",\n            width: 50,\n            dataIndex: 'stigCount',\n            align: \"center\",\n            tooltip: \"Total STIGs Assigned\",\n            sortable: true\n          }\n        )\n        idProperty = 'assetId'\n        break\n      case 'collection':\n        fields.push(\n          { name: 'collectionId', type: 'string' },\n          { name: 'name', type: 'string' },\n          { name: 'assets', type: 'integer' },\n          { name: 'checklists', type: 'integer' }\n        )\n        columns.push(\n          {\n            header: \"Collection\",\n            width: 175,\n            id: autoExpandColumn,\n            dataIndex: 'name',\n            sortable: true,\n            filter: { type: 'string' }\n          },\n          {\n            header: \"Assets\",\n            width: 50,\n            dataIndex: 'assets',\n            align: \"center\",\n            tooltip: \"Total Assets in the Collection\",\n            sortable: true\n          },\n          {\n            header: \"Checklists\",\n            width: 50,\n            dataIndex: 'checklists',\n            align: \"center\",\n            tooltip: \"Total Asset/STIG in the Collection\",\n            sortable: true\n          }\n        )\n        idProperty = 'collectionId'\n        break\n      case 'label':\n        fields.push(\n          { name: 'labelId', type: 'string' },\n          { name: 'name', type: 'string' },\n          'assets'\n        )\n        columns.push(\n          {\n            header: \"Label\",\n            width: 175,\n            id: autoExpandColumn,\n            dataIndex: 'labelId',\n            sortable: true,\n            filter: {\n              type: 'values',\n              collectionId: _this.collectionId,\n              comparer: function (a, b) {\n                return SM.ColumnFilters.CompareFns.labelIds(a, b, _this.collectionId)\n                },              \n              renderer: SM.ColumnFilters.Renderers.labels\n            },\n            renderer: function (value, metadata) {\n              const labels = []\n              const labelId = value\n              const label = SM.Cache.getCollectionLabel(_this.collectionId, labelId)\n              if (label) labels.push(label)\n              labels.sort((a, b) => a.name.localeCompare(b.name))\n              metadata.attr = 'style=\"white-space:normal;\"'\n              return SM.styledEmptyRenderer(SM.Manage.Collection.LabelArrayTpl.apply(labels))\n            }\n          },\n          {\n            header: \"Assets\",\n            width: 50,\n            dataIndex: 'assets',\n            align: \"center\",\n            tooltip: \"Total Assets Assigned\",\n            sortable: true\n          }\n        )\n        idProperty = 'labelId'\n        break\n      case 'stig':\n        fields.push(\n          { name: 'benchmarkId', type: 'string' },\n          { name: 'title', type: 'string' },\n          { name: 'revisionStr', type: 'string' },\n          { name: 'revisionPinned' },\n          'assets'\n        )\n        columns.push(\n          {\n            header: \"Benchmark\",\n            width: 175,\n            id: autoExpandColumn,\n            dataIndex: 'benchmarkId',\n            sortable: true,\n            renderer: renderWithToolbar,\n            filter: { type: 'string' },\n            listeners: {\n              mousedown: function (col, grid, index, e) {\n                if (e.target.className === \"sm-grid-cell-toolbar-edit\") {\n                  return false\n                }\n              }\n            }\n          },\n          {\n            header: \"Title\",\n            width: 175,\n            dataIndex: 'title',\n            sortable: true,\n            filter: { type: 'string' },\n            hidden: true\n          },\n          {\n            header: \"Revision\",\n            width: 58,\n            dataIndex: 'revisionStr',\n            align: \"left\",\n            tooltip: \"Default revision\",\n            sortable: true,\n            renderer: function (v, md, r) {\n              return `${r.data.revisionStr}${r.data.revisionPinned ? '<img src=\"img/pin.svg\" width=\"12\" height=\"12\" style=\"margin-left: 8px;\">' : ''}`\n            }\n          },\n          {\n            header: \"Assets\",\n            width: 50,\n            dataIndex: 'assets',\n            align: \"center\",\n            tooltip: \"Total Assets Assigned\",\n            sortable: true\n          }\n        )\n        idProperty = 'benchmarkId'\n        sortField = 'benchmarkId'\n        rowdblclick = (grid, rowIndex) => {\n          const r = grid.getStore().getAt(rowIndex)\n          const leaf = {\n            collectionId: grid.collectionId,\n            benchmarkId: r.data.benchmarkId,\n            revisionStr: r.data.revisionStr\n          }\n          addCollectionReview({ leaf })\n        }\n        cellmousedown = (grid, rowIndex, columnIndex, e) => {\n          if (e.target.className === \"sm-grid-cell-toolbar-edit\") {\n            const r = grid.getStore().getAt(rowIndex)\n            const leaf = {\n              collectionId: grid.collectionId,\n              benchmarkId: r.data.benchmarkId,\n              revisionStr: r.data.revisionStr\n            }\n            addCollectionReview({ leaf })\n          }\n        }\n        rowCountCfg.noun = 'STIG'\n        break\n    }\n    columns.push(...SM.CollectionPanel.CommonColumns)\n\n    this.proxy = new Ext.data.HttpProxy({\n      restful: true,\n      url: `${STIGMAN.Env.apiBase}/collections/${this.collectionId}/metrics/summary/${this.aggregation}`,\n      headers: { 'Content-Type': 'application/json;charset=utf-8' }\n    })\n    const store = new Ext.data.JsonStore({\n      grid: this,\n      autoLoad: this.storeAutoLoad ?? false,\n      baseParams: this.baseParams,\n      smMaskDelay: 50,\n      proxy: this.proxy,\n      root: '',\n      fields,\n      idProperty,\n      sortInfo: {\n        field: sortField,\n        direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      }\n    })\n    this.totalTextCmp = new SM.RowCountTextItem({\n      store,\n      ...rowCountCfg\n    })\n\n    const config = {\n      layout: 'fit',\n      store,\n      loadMask: { msg: '' },\n      sm,\n      cm: new Ext.grid.ColumnModel({\n        columns\n      }),\n      view: new SM.ColumnFilters.GridViewBuffered({\n        emptyText: this.emptyText || 'No records to display',\n        deferEmptyText: false,\n        forceFit: true,\n        forceFitMin: 900,\n        forceFitMax: 2500,\n        cellSelectorDepth: 5,\n        // custom row height\n        rowHeight: 21,\n        borderHeight: 2,\n        // render rows as they come into viewable area.\n        scrollDelay: false,\n        autoExpandColumn,\n        listeners: {\n          filterschanged: function (view, item, value) {\n            store.filter(view.getFilterFns())\n          }\n        },\n      }),\n      bbar: new Ext.Toolbar({\n        items: [\n          {\n            xtype: 'sm-reload-store-button',\n            store,\n            handler: this.reloadBtnHandler\n          },\n          {\n            xtype: 'tbseparator'\n          }, {\n            xtype: 'exportbutton',\n            hasMenu: false,\n            grid: this,\n            gridBasename: this.exportName || this.title || 'aggregation',\n            iconCls: 'sm-export-icon',\n            text: 'CSV'\n          }, {\n            xtype: 'tbfill'\n          }, {\n            xtype: 'tbseparator'\n          },\n          this.totalTextCmp\n        ]\n      }),\n      listeners: {\n        rowdblclick,\n        cellmousedown\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.CollectionPanel.UnaggGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    const fields = [\n      { name: 'assetId', type: 'string' },\n      { name: 'name', type: 'string' },\n      { name: 'labelIds', type: 'string', convert: (v, r) => r.labels.map(l => l.labelId) },\n      'benchmarkId',\n      'title',\n      'revisionStr',\n      'revisionPinned',\n      ...SM.CollectionPanel.CommonFields\n    ]\n    const columns = []\n    let sortField, autoExpandColumn = Ext.id()\n\n    function renderWithToolbar(v) {\n      return `\n      <div class=\"sm-grid-cell-with-toolbar\">\n        <div class=\"sm-dynamic-width\">\n          <div class=\"sm-info\">${v}</div>\n        </div>\n        <div class=\"sm-static-width\"><img class=\"sm-grid-cell-toolbar-edit\" ext:qtip=\"Open checklist\" src=\"img/shield-green-check.svg\" width=\"14\" height=\"14\"></div>\n      </div>`\n    }\n\n    switch (this.parentAggregation) {\n      case 'stig':\n        columns.push(\n          {\n            header: \"Asset\",\n            width: 175,\n            id: autoExpandColumn,\n            dataIndex: 'name',\n            sortable: true,\n            filter: { type: 'string' },\n            renderer: renderWithToolbar\n          },\n          {\n            header: \"Labels\",\n            width: 120,\n            dataIndex: 'labelIds',\n            sortable: false,\n            filter: {\n              type: 'multi-value',\n              collectionId: _this.collectionId,\n              comparer: function (a, b) {\n                return SM.ColumnFilters.CompareFns.labelIds(a, b, _this.collectionId)\n                },              \n              renderer: SM.ColumnFilters.Renderers.labels\n            },\n            renderer: function (value, metadata) {\n              const labels = []\n              for (const labelId of value) {\n                const label = SM.Cache.getCollectionLabel(_this.collectionId, labelId)\n                if (label) labels.push(label)\n              }\n              labels.sort((a, b) => a.name.localeCompare(b.name))\n              metadata.attr = 'style=\"white-space:nowrap;text-overflow:clip;\"'\n              return SM.styledEmptyRenderer(SM.Manage.Collection.LabelArrayTpl.apply(labels))\n            }\n          }\n        )\n        sortField = 'name'\n        break\n      case 'asset':\n        columns.push(\n          {\n            header: \"Benchmark\",\n            width: 175,\n            id: autoExpandColumn,\n            dataIndex: 'benchmarkId',\n            sortable: true,\n            filter: { type: 'string' },\n            renderer: renderWithToolbar\n          },\n          {\n            header: \"Title\",\n            width: 175,\n            dataIndex: 'title',\n            sortable: true,\n            filter: { type: 'string' },\n            hidden: true\n          },\n          {\n            header: \"Revision\",\n            width: 58,\n            dataIndex: 'revisionStr',\n            align: \"center\",\n            tooltip: \"Default revision\",\n            sortable: true,\n            renderer: function (v, md, r) {\n              return `${r.data.revisionStr}${r.data.revisionPinned ? '<img src=\"img/pin.svg\" width=\"12\" height=\"12\" style=\"margin-left: 8px;\">' : ''}`\n            }\n          }\n        )\n        sortField = 'benchmarkId'\n        break\n    }\n    columns.push(...SM.CollectionPanel.CommonColumns)\n\n    this.proxy = new Ext.data.HttpProxy({\n      restful: true,\n      url: `${STIGMAN.Env.apiBase}/collections/${this.collectionId}/metrics/summary`,\n      headers: { 'Content-Type': 'application/json;charset=utf-8' }\n    })\n    const store = new Ext.data.JsonStore({\n      grid: this,\n      autoLoad: false,\n      smMaskDelay: 50,\n      proxy: this.proxy,\n      root: '',\n      fields,\n      idProperty: (v) => {\n        return `${v.assetId}-${v.benchmarkId}`\n      },\n      sortInfo: {\n        field: sortField,\n        direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      }\n    })\n    this.totalTextCmp = new SM.RowCountTextItem({\n      store,\n      noun: 'checklist',\n      iconCls: 'sm-stig-icon'\n    })\n\n    const rowdblclick = (grid, rowIndex) => {\n      const r = grid.getStore().getAt(rowIndex)\n      const leaf = {\n        collectionId: grid.collectionId,\n        assetId: r.data.assetId,\n        assetName: r.data.name,\n        assetLabelIds: r.data.labelIds,\n        benchmarkId: r.data.benchmarkId,\n        revisionStr: r.data.revisionStr,\n        stigName: r.data.benchmarkId,\n      }\n      addReview({ leaf })\n    }\n\n    function cellclick(grid, rowIndex, columnIndex, e) {\n      if (e.target.className === \"sm-grid-cell-toolbar-edit\") {\n        const r = grid.getStore().getAt(rowIndex)\n        const leaf = {\n          collectionId: grid.collectionId,\n          assetId: r.data.assetId,\n          assetName: r.data.name,\n          assetLabelIds: r.data.labelIds,\n          benchmarkId: r.data.benchmarkId,\n          revisionStr: r.data.revisionStr,\n          stigName: r.data.benchmarkId,\n        }\n        addReview({ leaf })\n      }\n    }\n\n    const config = {\n      layout: 'fit',\n      store,\n      loadMask: { msg: '' },\n      cm: new Ext.grid.ColumnModel({\n        columns\n      }),\n      view: new SM.ColumnFilters.GridViewBuffered({\n        emptyText: this.emptyText || 'No records to display',\n        deferEmptyText: false,\n        forceFit: true,\n        forceFitMin: 1000,\n        forceFitMax: 2500,\n        cellSelectorDepth: 5,\n        // custom row height\n        rowHeight: 21,\n        borderHeight: 2,\n        // render rows as they come into viewable area.\n        scrollDelay: false,\n        autoExpandColumn,\n        listeners: {\n          filterschanged: function (view, item, value) {\n            store.filter(view.getFilterFns())\n          }\n        }\n      }),\n      bbar: new Ext.Toolbar({\n        items: [\n          {\n            xtype: 'sm-reload-store-button',\n            store,\n            handler: this.reloadBtnHandler\n          },\n          {\n            xtype: 'tbseparator'\n          },\n          {\n            xtype: 'exportbutton',\n            hasMenu: false,\n            grid: this,\n            gridBasename: this.exportName || this.title || 'unaggregated',\n            iconCls: 'sm-export-icon',\n            text: 'CSV'\n          },\n          {\n            xtype: 'tbfill'\n          },\n          {\n            xtype: 'tbseparator'\n          },\n          this.totalTextCmp\n        ]\n      }),\n      listeners: {\n        rowdblclick,\n        cellclick\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.CollectionPanel.ChartPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    this.chartId = Ext.id()\n    const html = `<canvas id=\"sm-chart-${this.chartId}\"${this.chartHeight ? ' height=\"250px\"' : ''}${this.chartWidth ? ' width=\"250px\"' : ''}></canvas>`\n\n    const config = {\n      html,\n      listeners: {\n        afterrender(me) {\n          me.chart = new Chart(`sm-chart-${me.chartId}`, this.chartOptions)\n        }\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.CollectionPanel.ChartPanel.superclass.initComponent.call(this)\n  },\n  replaceData: function (data, datasetIndex = 0) {\n    this.chart.dataset[datasetIndex].data = data\n    this.chart.update()\n  },\n\n})\n\nSM.CollectionPanel.ProgressBarsPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const calcData = function (metrics) {\n      return {\n        assessed: metrics.assessments ? metrics.assessed / metrics.assessments * 100 : 0,\n        submitted: metrics.assessments ? ((metrics.statuses.submitted + metrics.statuses.accepted + metrics.statuses.rejected) / metrics.assessments) * 100 : 0,\n        accepted: metrics.assessments ? (metrics.statuses.accepted / metrics.assessments) * 100 : 0,\n        rejected: metrics.assessments ? (metrics.statuses.rejected / metrics.assessments) * 100 : 0\n      }\n    }\n    const tpl = new Ext.XTemplate(\n      '<div class=\"sm-metrics-progress-parent\">',\n      '<div class=\"sm-metrics-progress-child\">',\n      `<div class=\"sm-metrics-progress-label\">Assessed</div>`,\n      `<div class=\"sm-metrics-progress-thermometer-wrap\">{[renderPct(values.assessed)]}</div>`,\n      '</div>',\n      '<div class=\"sm-metrics-progress-child\" >',\n      `<div class=\"sm-metrics-progress-label\">Submitted</div>`,\n      `<div class=\"sm-metrics-progress-thermometer-wrap\">{[renderPct(values.submitted)]}</div>`,\n      '</div>',\n      '<div class=\"sm-metrics-progress-child\" >',\n      `<div class=\"sm-metrics-progress-label\">Accepted</div>`,\n      `<div class=\"sm-metrics-progress-thermometer-wrap\">{[renderPct(values.accepted)]}</div>`,\n      '</div>',\n      '<div class=\"sm-metrics-progress-child\" >',\n      `<div class=\"sm-metrics-progress-label\">Rejected</div>`,\n      `<div class=\"sm-metrics-progress-thermometer-wrap\">{[renderPct(values.rejected)]}</div>`,\n      '</div>',\n      '</div>'\n    )\n    const updateMetrics = function (metrics) {\n      _this.update(calcData(metrics))\n    }\n    const config = {\n      tpl,\n      updateMetrics\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.CollectionPanel.ProgressPanelColors = function (theme) {\n  const style = getComputedStyle(document.documentElement)\n  const ordered = [\n    'assessed',\n    'submitted',\n    'accepted',\n    'unassessed',\n    'rejected'\n  ].map(category => style.getPropertyValue(`--metrics-status-chart-${category}-${theme}`))\n  return ordered\n}\n\nSM.CollectionPanel.ProgressPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n\n    const calcMetrics = function (metrics) {\n      return {\n        unassessed: metrics.assessments - metrics.assessed,\n        assessed: metrics.statuses.saved - metrics.results.other,\n        submitted: metrics.statuses.submitted,\n        accepted: metrics.statuses.accepted,\n        rejected: metrics.statuses.rejected,\n        assessments: metrics.assessments,\n        apiAssessed: metrics.assessed\n      }\n    }\n\n    const chartOptions = {\n      type: 'doughnut',\n      data: {\n        datasets: [{\n          data: [0, 0, 0, 0, 0],\n          backgroundColor: SM.CollectionPanel.ProgressPanelColors(curUser?.webPreferences?.darkMode ? 'dark' : 'light'),\n          borderWidth: [1, 1],\n          borderColor: '#bbbbbb'\n        }],\n        labels: [\n          'Assessed',\n          'Submitted',\n          'Accepted',\n          'Unassessed',\n          'Rejected'\n        ],\n      },\n      options: {\n        responsive: true,\n        plugins: {\n          legend: {\n            display: false\n          }\n        }\n      }\n    }\n\n    const chartPanel = new SM.CollectionPanel.ChartPanel({\n      border: false,\n      width: 170,\n      height: 170,\n      chartOptions\n    })\n\n    const onThemeChanged = function (theme) {\n      if (chartPanel.chart) {\n        chartPanel.chart.config._config.data.datasets[0].backgroundColor = SM.CollectionPanel.ProgressPanelColors(theme)\n        chartPanel.chart.update()\n      }\n    }\n    SM.Dispatcher.addListener('themechanged', onThemeChanged)\n\n    const updateMetrics = function (metrics) {\n      const metricCalcs = calcMetrics(metrics)\n      dataPanel.update(metricCalcs)\n      if (chartPanel.chart) {\n        chartPanel.chart.config._config.data.datasets[0].data = [\n          metricCalcs.assessed, //Assessed\n          metricCalcs.submitted, // Submitted\n          metricCalcs.accepted, // Accepted\n          metricCalcs.unassessed, // Unassessed\n          metricCalcs.rejected // Rejected         \n        ]\n        chartPanel.chart.update()\n      }\n      progressBarsPanel.updateMetrics(metrics)\n    }\n\n    const dataTpl = new Ext.XTemplate(\n      `<div class=\"sm-metrics-status-pct\">{[this.calcAssessedPct(values.apiAssessed, values.assessments)]}% assessed</div>`,\n      '<table class=\"sm-metrics-status-table\" style=\"margin: 0 auto;\">',\n      '<tbody>',\n      '<tr><td class=\"sm-metrics-label sm-metrics-unassessed\">Unassessed</td><td class=\"sm-metrics-value\">{unassessed}</td></tr>',\n      '<tr><td class=\"sm-metrics-label sm-metrics-assessed\">Assessed</td><td class=\"sm-metrics-value\">{assessed}</td></tr>',\n      '<tr><td class=\"sm-metrics-label sm-metrics-submitted\">Submitted</td><td class=\"sm-metrics-value\">{submitted}</td></tr>',\n      '<tr><td class=\"sm-metrics-label sm-metrics-accepted\">Accepted</td><td class=\"sm-metrics-value\">{accepted}</td></tr>',\n      '<tr><td class=\"sm-metrics-label sm-metrics-rejected\">Rejected</td><td class=\"sm-metrics-value\">{rejected}</td></tr>',\n      '<tr class=\"sm-metrics-total\"><td>Total Checks</td><td class=\"sm-metrics-value\">{assessments}</td></tr>',\n      '</tbody>',\n      '</table>',\n      {\n        calcAssessedPct: function (assessed, assessments) {\n          const pct = assessments ? assessed/assessments*100 : 0\n          if (pct > 99 && pct < 100) {\n            return '>99'\n          }\n          else {\n            return pct.toFixed(0).toString()\n          }\n        }\n      }\n    )\n\n    const dataPanel = new Ext.Panel({\n      border: false,\n      tpl: dataTpl,\n      width: 150\n    })\n    const progressBarsPanel = new SM.CollectionPanel.ProgressBarsPanel({\n      border: false,\n      height: 44\n    })\n\n    const config = {\n      layout: 'vbox',\n      height: 290,\n      layoutConfig: {\n        align: 'stretch',\n        pack: 'center'\n      },\n      items: [\n        {\n          layout: 'hbox',\n          height: 180,\n          border: false,\n          layoutConfig: {\n            align: 'middle',\n            pack: 'center'\n          },\n          items: [chartPanel, { width: 30, border: false }, dataPanel]\n        },\n        { height: 20, border: false },\n        progressBarsPanel,\n      ],\n      updateMetrics,\n      listeners: {\n        beforedestroy: function () {\n          SM.Dispatcher.removeListener('themechanged', onThemeChanged)\n        }\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.CollectionPanel.AgesPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    let refreshTimer\n    const tpl = new Ext.XTemplate(\n      '<div class=\"sm-metrics-count-parent\">',\n      `<div class=\"sm-metrics-count-child sm-metrics-age-box\" ext:qwidth=130 ext:qtip=\"{[Ext.util.Format.date(values.minTs,'Y-m-d H:i T')]}\">`,\n      `<div class=\"sm-metrics-count-label\">Oldest</div><div class=\"sm-metrics-count-value\">{[renderDurationToNow(values.minTs)]}</div>`,\n      '</div>',\n      `<div class=\"sm-metrics-count-child sm-metrics-age-box\" ext:qwidth=130 ext:qtip=\"{[Ext.util.Format.date(values.maxTs,'Y-m-d H:i T')]}\">`,\n      `<div class=\"sm-metrics-count-label\">Newest</div><div class=\"sm-metrics-count-value\">{[renderDurationToNow(values.maxTs)]}</div>`,\n      '</div>',\n      `<div class=\"sm-metrics-count-child sm-metrics-age-box\" ext:qwidth=130 ext:qtip=\"{[Ext.util.Format.date(values.maxTouchTs,'Y-m-d H:i T')]}\">`,\n      `<div class=\"sm-metrics-count-label\">Updated</div><div class=\"sm-metrics-count-value\">{[renderDurationToNow(values.maxTouchTs)]}</div>`,\n      '</div>',\n      '</div>'\n    )\n    const updateMetrics = function (metrics) {\n      _this.metrics = metrics\n      _this.update(metrics)\n    }\n\n    const config = {\n      tpl,\n      data: this.metrics,\n      updateMetrics,\n      listeners: {\n        beforedestroy: () => {\n          clearTimeout(refreshTimer)\n        },\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.CollectionPanel.FindingsPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const tpl = new Ext.XTemplate(\n      '<div class=\"sm-metrics-count-parent\">',\n      '<div class=\"sm-metrics-count-child sm-metrics-low-box\">',\n      `<div class=\"sm-metrics-count-label\">CAT 3</div><div class=\"sm-metrics-count-value\">{[values.low]}</div>`,\n      '</div>',\n      '<div class=\"sm-metrics-count-child sm-metrics-medium-box\" >',\n      `<div class=\"sm-metrics-count-label\">CAT 2</div><div class=\"sm-metrics-count-value\">{[values.medium]}</div>`,\n      '</div>',\n      '<div class=\"sm-metrics-count-child sm-metrics-high-box\" >',\n      `<div class=\"sm-metrics-count-label\">CAT 1</div><div class=\"sm-metrics-count-value\">{[values.high]}</div>`,\n      '</div>',\n      '</div>'\n    )\n    const updateMetrics = function (metrics) {\n      _this.update(metrics)\n    }\n    const config = {\n      tpl,\n      data: this.metrics,\n      updateMetrics\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.CollectionPanel.ExportPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const collectionId = this.collectionId\n\n    const formatComboBox = new Ext.form.ComboBox({\n      mode: 'local',\n      width: 110,\n      fieldLabel: \"Format\",\n      forceSelection: true,\n      autoSelect: true,\n      editable: false,\n      store: new Ext.data.SimpleStore({\n        fields: ['displayStr', 'valueStr'],\n        data: [\n          ['JSON', 'json'],\n          ['CSV', 'csv']\n        ]\n      }),\n      valueField: 'valueStr',\n      displayField: 'displayStr',\n      value: localStorage.getItem('metricsExportFormat') || 'json',\n      monitorValid: false,\n      triggerAction: 'all',\n      listeners: {\n        select: function (combo, record, index) {\n          localStorage.setItem('metricsExportFormat', combo.getValue())\n        }\n      }\n    })\n    const styleComboBox = new Ext.form.ComboBox({\n      mode: 'local',\n      width: 110,\n      fieldLabel: \"Style\",\n      forceSelection: true,\n      autoSelect: true,\n      editable: false,\n      store: new Ext.data.SimpleStore({\n        fields: ['displayStr', 'valueStr'],\n        data: [\n          ['Summary', 'summary'],\n          ['Detail', 'detail']\n        ]\n      }),\n      valueField: 'valueStr',\n      displayField: 'displayStr',\n      value: localStorage.getItem('metricsExportStyle') || 'summary',\n      monitorValid: false,\n      triggerAction: 'all',\n      listeners: {\n        select: function (combo, record, index) {\n          localStorage.setItem('metricsExportStyle', combo.getValue())\n        }\n      }\n    })\n    const aggComboBox = new Ext.form.ComboBox({\n      mode: 'local',\n      width: 110,\n      fieldLabel: \"Grouped by\",\n      forceSelection: true,\n      autoSelect: true,\n      editable: false,\n      store: new Ext.data.SimpleStore({\n        fields: ['displayStr', 'valueStr'],\n        data: [\n          ['Collection', 'collection'],\n          ['Asset', 'asset'],\n          ['Label', 'label'],\n          ['STIG', 'stig'],\n          ['Ungrouped', 'unagg']\n        ]\n      }),\n      valueField: 'valueStr',\n      displayField: 'displayStr',\n      value: localStorage.getItem('metricsExportAgg') || 'collection',\n      monitorValid: false,\n      triggerAction: 'all',\n      listeners: {\n        select: function (combo, record, index) {\n          localStorage.setItem('metricsExportAgg', combo.getValue())\n        }\n      }\n    })\n    const exportButton = new Ext.Button({\n      text: 'Download',\n      iconCls: 'sm-export-icon',\n      disabled: false,\n      style: {\n        position: 'relative',\n        top: '-52px',\n        left: '255px'\n      },\n      handler: async function () {\n        const queryParams = Object.entries(_this.baseParams ?? {}).flatMap(([k, v]) => Array.isArray(v) ? v.map((v) => [k, v]) : [[k, v]])\n        const format = formatComboBox.getValue()\n        queryParams.push(['format', format])\n        const queryParamsStr = new URLSearchParams(queryParams).toString()\n\n        const style = styleComboBox.getValue()\n        const agg = aggComboBox.getValue()\n        const url = `${STIGMAN.Env.apiBase}/collections/${collectionId}/metrics/${style}${agg === 'unagg' ? '' : `/${agg}`}?${queryParamsStr}`\n\n        const attachment = SM.Global.filenameEscaped(`${SM.Cache.CollectionMap.get(_this.collectionId)?.name}-${agg}-${style}_${SM.Global.filenameComponentFromDate()}.${format}`)\n        \n        const fetchInit = {\n          method: 'GET',\n          headers: {\n            'Authorization': `Bearer ${window.oidcWorker.token}`,\n            'Accept': `${format === 'csv' ? 'text/csv' : 'application/json'}`\n          },\n          attachment\n        }\n        const href = await SM.ServiceWorker.getDownloadUrl({ url, ...fetchInit })\n        if (href) {\n          window.location = href\n          return\n        }\n        const response = await fetch(url, fetchInit)\n        if (!response.ok) {\n          const body = await response.text()\n          throw new Error(`Request failed with status ${response.status}\\n${body}`)\n        }\n        const blob = await response.blob()\n        saveAs(blob, attachment)\n      }\n    })\n\n\n    const config = {\n      layout: 'form',\n      items: [\n        aggComboBox,\n        styleComboBox,\n        formatComboBox,\n        exportButton\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.CollectionPanel.InventoryPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const tpl = new Ext.XTemplate(\n      '<div class=\"sm-metrics-count-parent\">',\n      '<div class=\"sm-metrics-count-child sm-metrics-inventory-box\" >',\n      `<div class=\"sm-metrics-count-label\">Assets</div><div class=\"sm-metrics-count-value\">{assets}</div>`,\n      '</div>',\n      '<div class=\"sm-metrics-count-child sm-metrics-inventory-box\">',\n      `<div class=\"sm-metrics-count-label\">STIGs</div><div class=\"sm-metrics-count-value\">{stigs}</div>`,\n      '</div>',\n      '<div class=\"sm-metrics-count-child sm-metrics-inventory-box\">',\n      `<div class=\"sm-metrics-count-label\">Checklists</div><div class=\"sm-metrics-count-value\">{checklists}</div>`,\n      '</div>',\n      '</div>'\n    )\n    const updateMetrics = function (metrics) {\n      _this.update(metrics)\n    }\n    const config = {\n      tpl,\n      data: this.data,\n      updateMetrics\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.CollectionPanel.CORAPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    \n    _this.helpIconTooltip = null\n\n    _this.tpl = new Ext.XTemplate(\n      '<div class=\"sm-cora-container\">',\n        '<div class=\"sm-cora-box-left\">',\n          '<div class=\"sm-cora-box-title\">Open or Unassessed</div>',\n          '<div class=\"sm-cora-cat sm-cat1\">{catI}</div>',\n          '<div class=\"sm-cora-cat sm-cat2\">{catII}</div>',\n          '<div class=\"sm-cora-cat sm-cat3\">{catIII}</div>',\n        '</div>',\n        '<div class=\"sm-cora-box-right {riskClass}\">',\n          '<div class=\"sm-cora-score-header\">',\n            'CORA Risk',\n          '</div>',\n          '<div class=\"sm-risk-indicator\">{weightedAvg}%</div>',\n          '<div class=\"sm-cora-score-risk-level\">',\n            '<div>{riskRating}</div>',\n          '</div>',\n        '</div>',\n      '</div>'\n    )\n\n    const htmlContainer = new Ext.BoxComponent({\n      tpl: _this.tpl,\n      data: this.data\n    })\n\n    Ext.apply(this, {\n      title: 'CORA' +  '<i class=\"fa fa-question-circle sm-question-circle\"></i>', \n      items: [htmlContainer],\n      listeners: {\n        afterrender: function() {\n          _this.createTooltips()\n        }\n      }\n    })\n\n    _this.createTooltips = function() {\n      setTimeout(function() {\n        const helpIcon = _this.getEl().select('.sm-question-circle').first()\n        if (helpIcon) {\n          _this.helpIconTooltip = new Ext.ToolTip({\n            target: helpIcon,\n            html: SM.TipContent.CORA,\n            showDelay: 0,\n            hideDelay: 0,\n            dismissDelay: 0,\n            autoWidth: true,\n          })\n        }\n      }, 150)\n    }\n\n    _this.updateMetrics = function (metrics) {\n      const coraMetrics = calculateCoraRiskRating(metrics)\n\n      const riskClass = getRiskClass(coraMetrics.riskRating)\n      const { assessmentsBySeverity, assessedBySeverity, findings } = metrics\n\n      function getUnreviewedOrOpen(sev) {\n        return (assessmentsBySeverity[sev] - assessedBySeverity[sev]) + findings[sev]\n      }\n\n      const data = {\n        riskRating: coraMetrics.riskRating,\n        weightedAvg: (coraMetrics.weightedAvg * 100).toFixed(1),\n        catI: getUnreviewedOrOpen('high'),\n        catII: getUnreviewedOrOpen('medium'),\n        catIII: getUnreviewedOrOpen('low'),\n        riskClass\n      }\n\n      htmlContainer.tpl.overwrite(htmlContainer.getEl(), data)\n      if (_this.helpIconTooltip) {\n        _this.helpIconTooltip.destroy()\n      }\n      _this.createTooltips()\n    }\n\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.CollectionPanel.OverviewPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const toolTemplate = new Ext.XTemplate(\n      '<tpl if=\"!!values.text\">',\n      '<div class=\"x-tool x-tool-{id}\">{text}</div>',\n      '</tpl>',\n      '<tpl if=\"!!!values.text\">',\n      '<div class=\"x-tool x-tool-{id}\">&#160;</div>',\n      '</tpl>'\n    )\n\n    const collectionId = this.collectionId\n    this.lastRefreshedTextItem = new Ext.Toolbar.TextItem({\n      text: '',\n      tpl: [\n        `<span style=\"font-weight:600;\">Fetched:</span> {[Ext.util.Format.date(values.date,'Y-m-d H:i:s T')]}`\n      ]\n    })\n    this.reloadBtn = new SM.ReloadStoreButton({\n      handler: this.reloadBtnHandler\n    })\n\n    this.inventoryPanel = new SM.CollectionPanel.InventoryPanel({\n      cls: 'sm-round-inner-panel',\n      bodyStyle: 'padding: 10px;',\n      title: 'Inventory',\n      tools: this.inventoryPanelTools || undefined,\n      toolTemplate,\n      border: true\n    })\n    \n    this.coraPanel = new SM.CollectionPanel.CORAPanel({\n      cls: 'sm-round-inner-panel',\n      bodyStyle: 'padding: 10px;',\n      title: 'CORA',\n      toolTemplate,\n      border: true\n    })\n\n    this.progressPanel = new SM.CollectionPanel.ProgressPanel({\n      cls: 'sm-round-inner-panel',\n      bodyStyle: 'padding: 10px;',\n      title: 'Progress',\n      tools: this.progressPanelTools || undefined,\n      toolTemplate,\n      border: true\n    })\n    this.agesPanel = new SM.CollectionPanel.AgesPanel({\n      cls: 'sm-round-inner-panel',\n      bodyStyle: 'padding: 10px;',\n      title: 'Review Ages',\n      tools: this.agesPanelTools || undefined,\n      border: true\n    })\n    this.findingsPanel = new SM.CollectionPanel.FindingsPanel({\n      cls: 'sm-round-inner-panel',\n      bodyStyle: 'padding: 10px;',\n      title: 'Findings',\n      tools: this.findingsPanelTools || undefined,\n      toolTemplate,\n      border: true\n    })\n    this.exportPanel = new SM.CollectionPanel.ExportPanel({\n      cls: 'sm-round-inner-panel',\n      bodyStyle: 'padding: 10px;',\n      title: 'Export metrics',\n      border: true,\n      height: 122,\n      collectionId\n    })\n\n    const updateBaseParams = function (params) {\n      _this.baseParams = params\n      _this.exportPanel.baseParams = params\n    }\n    const updatePanels = function (data) {\n      _this.inventoryPanel.updateMetrics(data)\n      _this.progressPanel.updateMetrics(data.metrics)\n      _this.agesPanel.updateMetrics(data.metrics)\n      _this.findingsPanel.updateMetrics(data.metrics.findings)\n      _this.coraPanel.updateMetrics(data.metrics)\n      _this.lastRefreshedTextItem.update({\n        date: data.date\n      })\n    }\n    const updateData = async function({refreshViewsOnly = false, loadMasksDisabled = false} = {}) {\n      try {\n        if (!_this.hasContent || !loadMasksDisabled) {\n            _this.bwrap?.mask('')\n        }\n        _this.reloadBtn.showLoadingIcon()\n        if (!refreshViewsOnly) {\n          const results = await Ext.Ajax.requestPromise({\n            url: `${STIGMAN.Env.apiBase}/collections/${_this.collectionId}/metrics/summary/collection`,\n            method: 'GET',\n            params: _this.baseParams\n          })\n          _this.data = JSON.parse(results.response.responseText)\n          _this.data.date = new Date ()\n        }\n        updatePanels(_this.data)\n        _this.hasContent = true\n        return _this.data\n      }\n      catch (e) {\n        console.log(e)\n      }\n      finally {\n        _this.bwrap?.unmask()\n        _this.reloadBtn.showRefreshIcon()\n      }\n    }\n    const config = {\n      border: false,\n      autoScroll: true,\n      toolTemplate,\n      items: [\n        this.progressPanel,\n        this.coraPanel,\n        this.inventoryPanel,\n        this.findingsPanel,\n        this.agesPanel,\n        this.exportPanel\n      ],\n      bbar: [\n        this.reloadBtn,\n        '->',\n        '-',\n        this.lastRefreshedTextItem\n      ],\n      updateData,\n      updateBaseParams\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.CollectionPanel.AggAssetPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const collectionId = this.collectionId\n    const aggAssetGrid = new SM.CollectionPanel.AggGrid({\n      aggregation: 'asset',\n      stateId: `sm-metrics-agg-grid-asset-${collectionId}`,\n      stateful: true,\n      collectionId,\n      border: false,\n      region: 'center',\n      exportName: 'Assets',\n      baseParams: this.baseParams,\n      reloadBtnHandler: this.reloadBtnHandler,\n      initialized: false \n    })\n    const unaggGrid = new SM.CollectionPanel.UnaggGrid({\n      title: 'Checklists',\n      stateId: `sm-metrics-unagg-grid-asset-${collectionId}`,\n      stateful: true,\n      parentAggregation: 'asset',\n      reloadBtnHandler: this.reloadBtnHandler,\n      collectionId,\n      border: false,\n      region: 'south',\n      split: true,\n      height: '33%'\n    })\n    async function onRowSelect(cm, index, record) {\n      await unaggGrid.store.loadPromise({\n        assetId: record.data.assetId\n      })\n      unaggGrid.setTitle(`Checklists for ${record.data.name}`)\n    }\n\n    aggAssetGrid.getSelectionModel().on('rowselect', onRowSelect)\n    const updateBaseParams = function (params) {\n      unaggGrid.store.baseParams = aggAssetGrid.store.baseParams = _this.baseParams = params\n    }\n    const updateData = async function ({refreshViewsOnly = false, loadMasksDisabled = false} = {}) {\n      try {\n        aggAssetGrid.initialized = true\n        const selectedRow = aggAssetGrid.getSelectionModel().getSelected()\n\n        if (refreshViewsOnly) {\n          aggAssetGrid.getView().refresh()\n          if (selectedRow) {\n            unaggGrid.getView().refresh()\n          }\n          return\n        }\n        let savedLoadMaskDisabled = aggAssetGrid.loadMask.disabled\n        aggAssetGrid.loadMask.disabled = loadMasksDisabled\n        await aggAssetGrid.store.loadPromise()\n        aggAssetGrid.loadMask.disabled = savedLoadMaskDisabled\n\n        if (!selectedRow) {\n          return\n        }\n\n        const currentRecord = aggAssetGrid.store.getById(selectedRow.data.assetId)\n        if (!currentRecord) {\n          unaggGrid.setTitle('Checklists')\n          unaggGrid.store.removeAll()\n          return\n        }\n        const currentIndex = aggAssetGrid.store.indexOfId(selectedRow.data.assetId)\n        aggAssetGrid.view.focusRow(currentIndex)\n\n        savedLoadMaskDisabled = unaggGrid.loadMask.disabled\n        unaggGrid.loadMask.disabled = loadMasksDisabled\n        await unaggGrid.store.loadPromise({\n          assetId: currentRecord.data.assetId\n        })\n        unaggGrid.loadMask.disabled = savedLoadMaskDisabled\n\n      }\n      catch (e) {\n        console.log(e)\n      }\n    }\n\n    const config = {\n      layout: 'border',\n      cls: 'sm-metric-agg-panel',\n      items: [\n        aggAssetGrid,\n        unaggGrid\n      ],\n      updateBaseParams,\n      updateData\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.CollectionPanel.AggStigPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const collectionId = this.collectionId\n\n    const aggStigGrid = new SM.CollectionPanel.AggGrid({\n      aggregation: 'stig',\n      stateId: `sm-collection-${collectionId}-agg-grid-stig`,\n      stateful: true,\n      border: false,\n      checkboxSelModel: false,\n      collectionId,\n      baseParams: this.baseParams,\n      reloadBtnHandler: this.reloadBtnHandler,\n      exportName: 'STIGs',\n      region: 'center',\n      initialized: false\n    })\n\n    const unaggGrid = new SM.CollectionPanel.UnaggGrid({\n      title: 'Checklists',\n      stateId: `sm-collection-${collectionId}-unagg-grid-stig`,\n      stateful: true,\n      border: false,\n      parentAggregation: 'stig',\n      collectionId,\n      reloadBtnHandler: this.reloadBtnHandler,\n      region: 'south',\n      split: true,\n      height: '66%'\n    })\n    async function onRowSelect(cm, index, record) {\n      const params = {\n        benchmarkId: record.data.benchmarkId\n      }\n      await unaggGrid.store.loadPromise(params)\n      unaggGrid.setTitle(`Checklists for ${record.data.benchmarkId}`)\n    }\n\n    aggStigGrid.getSelectionModel().on('rowselect', onRowSelect)\n\n    const updateBaseParams = function (params) {\n      unaggGrid.store.baseParams = aggStigGrid.store.baseParams = _this.baseParams = params\n    }\n    const updateData = async function ({refreshViewsOnly = false, loadMasksDisabled = false} = {}) {\n      try {\n        aggStigGrid.initialized = true\n        const selectedRow = aggStigGrid.getSelectionModel().getSelected()\n\n        if (refreshViewsOnly) {\n          aggStigGrid.getView().refresh()\n          if (selectedRow) {\n            unaggGrid.getView().refresh()\n          }\n          return\n        }\n        let savedLoadMaskDisabled = aggStigGrid.loadMask.disabled\n        aggStigGrid.loadMask.disabled = loadMasksDisabled\n        await aggStigGrid.store.loadPromise()\n        aggStigGrid.loadMask.disabled = savedLoadMaskDisabled\n        if (!selectedRow) {\n          return\n        }\n\n\n        const currentRecord = aggStigGrid.store.getById(selectedRow.data.benchmarkId)\n        if (!currentRecord) {\n          unaggGrid.setTitle('Checklists')\n          unaggGrid.store.removeAll()\n          return\n        }\n        const currentIndex = aggStigGrid.store.indexOfId(selectedRow.data.benchmarkId)\n        aggStigGrid.view.focusRow(currentIndex)\n\n        savedLoadMaskDisabled = unaggGrid.loadMask.disabled\n        unaggGrid.loadMask.disabled = loadMasksDisabled\n        await unaggGrid.store.loadPromise({\n          benchmarkId: currentRecord.data.benchmarkId\n        })\n        unaggGrid.loadMask.disabled = savedLoadMaskDisabled\n      }\n      catch (e) {\n        console.log(e)\n      }\n    }\n\n    const config = {\n      layout: 'border',\n      cls: 'sm-metric-agg-panel',\n      items: [\n        aggStigGrid,\n        unaggGrid\n      ],\n      updateBaseParams,\n      updateData\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.CollectionPanel.AggLabelPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const collectionId = this.collectionId\n    const aggLabelGrid = new SM.CollectionPanel.AggGrid({\n      aggregation: 'label',\n      stateId: `sm-metrics-agg-grid-label-${collectionId}`,\n      stateful: true,\n      border: false,\n      collectionId,\n      reloadBtnHandler: this.reloadBtnHandler,\n      baseParams: this.baseParams,\n      exportName: 'Labels',\n      region: 'north',\n      split: true,\n      height: '33%',\n      initialized: false\n    })\n    const aggAssetGrid = new SM.CollectionPanel.AggGrid({\n      title: 'Assets',\n      stateId: `sm-metrics-agg-grid-label-asset-${collectionId}`,\n      stateful: true,\n      border: false,\n      reloadBtnHandler: this.reloadBtnHandler,\n      aggregation: 'asset',\n      storeAutoLoad: false,\n      collectionId,\n      baseParams: this.baseParams,\n      exportName: 'Assets',\n      region: 'center'\n    })\n    const unaggGrid = new SM.CollectionPanel.UnaggGrid({\n      title: 'Checklists',\n      stateId: `sm-metrics-unagg-grid-label-${collectionId}`,\n      stateful: true,\n      border: false,\n      parentAggregation: 'asset',\n      reloadBtnHandler: this.reloadBtnHandler,\n      collectionId,\n      region: 'south',\n      split: true,\n      height: '33%'\n    })\n    async function onRowSelectLabel(cm, index, record) {\n      const params = {}\n      if (record.data.labelId) {\n        params.labelId = record.data.labelId\n      }\n      else {\n        params.labelMatch = 'null'\n      }\n      await loadAggAssetGrid(params)\n      unaggGrid.store.removeAll()\n      aggAssetGrid.setTitle(`Assets for ${record.data.name}`)\n    }\n    async function onRowSelectAsset(cm, index, record) {\n      await unaggGrid.store.loadPromise({\n        assetId: record.data.assetId\n      })\n      unaggGrid.setTitle(`Checklists for ${record.data.name}`)\n    }\n    async function loadAggAssetGrid(params) {\n      const url = new URL(aggAssetGrid.proxy.url, document.baseURI)\n      for (const [key, value] of Object.entries(params)) {\n        if (Array.isArray(value)) {\n          for (const item of value) {\n            url.searchParams.append(key, item)\n          }\n        }\n        else {\n          url.searchParams.append(key, value)\n        }\n      }\n      \n      const fetchOptions = {\n        method: 'GET',\n        headers: {'Authorization': `Bearer ${window.oidcWorker.token}`}\n      }\n      let assets = await(await fetch(url, fetchOptions)).json()\n      \n      if (_this.baseParams.labelId) {\n        assets = assets.filter(asset => asset.labels.some(label => _this.baseParams.labelId.includes(label.labelId)) || (_this.baseParams.labelMatch === 'null' ? asset.labels.length === 0 : false))\n      }\n      aggAssetGrid.store.loadData(assets)\n    }\n\n    aggLabelGrid.getSelectionModel().on('rowselect', onRowSelectLabel)\n    aggAssetGrid.getSelectionModel().on('rowselect', onRowSelectAsset)\n    const updateBaseParams = function (params) {\n      unaggGrid.store.baseParams = aggLabelGrid.store.baseParams = aggAssetGrid.store.baseParams = _this.baseParams = params\n    }\n    const updateData = async function ({refreshViewsOnly = false, loadMasksDisabled = false} = {}) {\n      try {\n        aggLabelGrid.initialized = true\n        const selectedRowLabel = aggLabelGrid.getSelectionModel().getSelected()\n        const selectedRowAsset = aggAssetGrid.getSelectionModel().getSelected()\n\n        if (refreshViewsOnly) {\n          aggLabelGrid.getView().refresh()\n          if (selectedRowLabel) {\n            aggAssetGrid.getView().refresh()\n            if (selectedRowAsset) {\n              unaggGrid.getView().refresh()\n            }\n          }\n          return\n        }\n\n        let savedLoadMaskDisabled = aggLabelGrid.loadMask.disabled\n        aggLabelGrid.loadMask.disabled = loadMasksDisabled\n        await aggLabelGrid.store.loadPromise()\n        aggLabelGrid.loadMask.disabled = savedLoadMaskDisabled\n\n        if (!selectedRowLabel) {\n          return\n        }\n\n        const currentRecordLabel = aggLabelGrid.store.getById(selectedRowLabel.data.labelId)\n        if (!currentRecordLabel) {\n          aggAssetGrid.setTitle('Assets')\n          aggAssetGrid.store.removeAll()\n          unaggGrid.setTitle('STIGs')\n          unaggGrid.store.removeAll()\n          return\n        }\n        const currentIndexLabel = aggLabelGrid.store.indexOfId(selectedRowLabel.data.labelId)\n        aggLabelGrid.view.focusRow(currentIndexLabel)\n        savedLoadMaskDisabled = aggAssetGrid.loadMask.disabled\n        aggAssetGrid.loadMask.disabled = loadMasksDisabled\n        await loadAggAssetGrid({\n          labelId: currentRecordLabel.data.labelId\n        })\n        aggAssetGrid.loadMask.disabled = savedLoadMaskDisabled\n        const currentRecordAsset = aggAssetGrid.store.getById(selectedRowAsset.data.assetId)\n        if (!currentRecordAsset) {\n          unaggGrid.setTitle('STIGs')\n          unaggGrid.store.removeAll()\n          return\n        }\n        const currentIndexAsset = aggAssetGrid.store.indexOfId(selectedRowAsset.data.assetId)\n        aggAssetGrid.view.focusRow(currentIndexAsset)\n        savedLoadMaskDisabled = unaggGrid.loadMask.disabled\n        unaggGrid.loadMask.disabled = loadMasksDisabled\n        await unaggGrid.store.loadPromise({\n          assetId: currentRecordAsset.data.assetId\n        })\n        unaggGrid.loadMask.disabled = savedLoadMaskDisabled\n      }\n      catch (e) {\n        console.log(e)\n      }\n    }\n\n    const config = {\n      layout: 'border',\n      cls: 'sm-metric-agg-panel',\n      items: [\n        aggLabelGrid,\n        aggAssetGrid,\n        unaggGrid\n      ],\n      updateBaseParams,\n      updateData\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.CollectionPanel.showCollectionTab = function (options) {\n  try {\n    const { collectionId, collectionName, treePath, initialLabelIds = [] } = options\n    const tab = Ext.getCmp('main-tab-panel').getItem(`collection-panel-${collectionId}`)\n    if (tab) {\n      Ext.getCmp('main-tab-panel').setActiveTab(tab.id)\n      return\n    }\n\n    SM.Cache.updateCollectionLabels(collectionId)\n\n    const gState = {}\n\n    gState.labelIds = initialLabelIds\n    gState.filterableLabels = []\n\n    const UPDATE_DATA_DELAY = 300000\n\n    const overviewTitleTpl = new Ext.XTemplate(\n      `Collection: {[values.labels ? values.labels : 'all']}`\n    )\n\n    const labelsMenu = new SM.Manage.Collection.LabelsMenu({\n      labels: gState.filterableLabels,\n      showHeader: true,\n      showApply: true,\n      listeners: {\n        applied: function (labelIds) {\n          SM.Dispatcher.fireEvent('labelfilter', collectionId, labelIds)\n        }\n      }\n    })\n    const overviewPanel = new SM.CollectionPanel.OverviewPanel({\n      cls: 'sm-round-panel sm-metrics-overview-panel',\n      collectionId,\n      collapsible: true,\n      collapseFirst: false,\n      inventoryPanelTools: [\n        {\n          id: 'download',\n          text: 'Export...',\n          handler: function (event, toolEl, panel, tc) {\n            SM.Inventory.showInventoryExportOptions(collectionId, collectionName, overviewPanel.baseParams)\n          }\n        },\n        {\n          id: 'spacer'\n        },\n        {\n          id: 'manage',\n          text: 'Manage',\n          handler: (event, toolEl, panel, tc) => {\n            addCollectionManager({\n              collectionId,\n              collectionName,\n              treePath\n            })\n          }\n        }\n      ],\n      findingsPanelTools: [\n        {\n          id: 'report',\n          text: 'Details',\n          handler: (event, toolEl, panel, tc) => {\n            addFindingsSummary({\n              collectionId,\n              collectionName,\n              treePath\n            })\n          }\n        }\n      ],\n      progressPanelTools: [\n        {\n          id: 'import',\n          text: 'Import CKL(B) or SCAP...',\n          qtip: SM.TipContent.ImportFromCollectionPanel,\n          handler: () => {\n            showImportResultFiles(collectionId, false, false)         \n          }\n        }\n      ],\n      tools: [\n        {\n          id: 'label',\n          text: 'Filter &#9660;',\n          handler: (event, toolEl, panel, tc) => {\n            labelsMenu.showAt(event.xy)\n          }\n        }\n      ],\n      title: overviewTitleTpl.apply({\n        labels: SM.Manage.Collection.GetLabelSprites(collectionId, gState.labelIds)\n      }),\n      margins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n      region: 'west',\n      width: 430,\n      minWidth: 430,\n      split: true,\n      collectionId,\n      reloadBtnHandler,\n      listeners: {\n        render: (panel) => {\n          if (panel.tools.label) {\n            panel.tools.label.setDisplayed(gState.filterableLabels.length > 1)\n          }\n        }\n      }\n    })\n    overviewPanel.inventoryPanel.on('render', (panel) => {\n      const collectionGrant = curUser.collectionGrants.find(g => g.collection.collectionId === collectionId)\n      const isManager = !!(collectionGrant?.roleId >= 3)\n      panel.tools.manage.setDisplayed(isManager)\n      panel.tools.spacer.setDisplayed(isManager)\n    })\n    const aggAssetPanel = new SM.CollectionPanel.AggAssetPanel({\n      title: 'Assets',\n      iconCls: 'sm-asset-icon',\n      layout: 'fit',\n      border: false,\n      collectionId,\n      reloadBtnHandler\n    })\n    const aggStigPanel = new SM.CollectionPanel.AggStigPanel({\n      title: 'STIGs',\n      iconCls: 'sm-stig-icon',\n      layout: 'fit',\n      border: false,\n      collectionId,\n      reloadBtnHandler\n    })\n    const aggLabelPanel = new SM.CollectionPanel.AggLabelPanel({\n      title: 'Labels',\n      iconCls: 'sm-label-icon',\n      layout: 'fit',\n      border: false,\n      collectionId,\n      reloadBtnHandler\n    })\n\n    setCurrentBaseParams(initialLabelIds)\n\n    const aggTabPanel = new Ext.TabPanel({\n      activeTab: 0,\n      border: false,\n      deferredRender: false,\n      firstShow: true,\n      items: [\n        aggStigPanel,\n        aggAssetPanel,\n        aggLabelPanel\n      ],\n      listeners: {\n        tabchange: function (tp) {\n          if (!tp.firstShow) updateData({ event: 'tabchange' })\n          tp.firstShow = false\n        }\n      }\n    })\n\n    const centerPanel = new Ext.Panel({\n      region: 'center',\n      layout: 'fit',\n      cls: 'sm-round-panel',\n      margins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.adjacent },\n      border: false,\n      collapsible: false,\n      items: aggTabPanel\n    })\n\n    const collectionTab = new Ext.Panel({\n      id: 'collection-panel-' + collectionId,\n      sm_unshown: true,\n      border: false,\n      region: 'center',\n      collectionId: collectionId,\n      collectionName: collectionName,\n      iconCls: 'sm-collection-icon',\n      title: SM.he(collectionName),\n      closable: true,\n      layout: 'border',\n      sm_treePath: treePath,\n      updateTitle: function () {\n        this.setTitle(SM.he(this.collectionName))\n      },\n      items: [\n        overviewPanel,\n        centerPanel\n      ],\n      listeners: {\n        beforehide: (panel) => {\n          cancelTimers()\n        },\n        activate: (panel) => {\n          updateData({event: 'activate'})\n          panel.sm_unshown = false\n        }\n      }\n    })\n\n    const bc = new BroadcastChannel(window.oidcWorker.channelName)\n    bc.onmessage = (event) => {\n      if (collectionTab.hidden) {\n        return\n      }\n      if (event.data.type === 'noToken') {\n\t\t    cancelTimers()\n      } else if (event.data.type === 'accessToken') {\n        if (!gState.updateDataTimerId && !gState.refreshViewTimerId) {\n          updateData({event: 'updatedata'})\n        }\n      }\n\t  }\n\n    SM.Dispatcher.addListener('labelfilter', onLabelFilter)\n    collectionTab.on('beforedestroy', () => {\n      SM.Dispatcher.removeListener('labelfilter', onLabelFilter)\n      cancelTimers()\n      bc.close()\n    })\n\n    SM.AddPanelToMainTab(collectionTab, 'permanent')\n\n    // functions\n\n    function setCurrentBaseParams(labelIds) {\n      const params = {}\n      for (let x = 0, length = labelIds.length; x < length; x++) {\n        if (labelIds[x] === null) {\n          params.labelMatch = 'null'\n        }\n        else {\n          ; (params.labelId ??= []).push(labelIds[x])\n        }\n      }\n      aggAssetPanel?.updateBaseParams(params)\n      aggStigPanel?.updateBaseParams(params)\n      aggLabelPanel?.updateBaseParams(params)\n      overviewPanel?.updateBaseParams(params)\n      return params\n    }\n\n    async function updateFilterableLabels() {\n      try {\n        const results = await Ext.Ajax.requestPromise({\n          url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/metrics/summary/label`,\n          method: 'GET'\n        })\n        gState.filterableLabels = JSON.parse(results.response.responseText)\n        if (overviewPanel.tools.label) {\n          overviewPanel.tools.label.setDisplayed(!!(gState.filterableLabels.length > 1))\n        }\n        const filterableLabelIds = gState.filterableLabels.map(label => label.labelId)\n        // remove from gState.labelIds any missing labelIds\n        gState.labelIds = gState.labelIds.filter(labelId => filterableLabelIds.includes(labelId))\n        // reset base parameters\n        setCurrentBaseParams(gState.labelIds)\n        labelsMenu.refreshItems(gState.filterableLabels)\n\n        return gState.filterableLabels\n      }\n      catch (e) {\n        console.error(e)\n        return []\n      }\n    }\n\n    function updateOverviewTitle() {\n      const overviewTitle = overviewTitleTpl.apply({\n        labels: SM.Manage.Collection.GetLabelSprites(collectionId, gState.labelIds)\n      })\n      overviewPanel.setTitle(overviewTitle)\n    }\n\n    function reloadBtnHandler() { updateData({event: 'reload'}) }\n\n    // handle change to label filters in NavTree\n    async function onLabelFilter(srcCollectionId, srcLabelIds) {\n      try {\n        if (srcCollectionId === collectionId) {\n          if (gState.filterableLabels.every( i => srcLabelIds.includes(i.labelId) )) {\n            gState.labelIds = []\n          }\n          else {\n            gState.labelIds = srcLabelIds\n          }\n          gState.baseParams = setCurrentBaseParams(gState.labelIds)\n          await overviewPanel.updateData()\n          updateOverviewTitle()\n          const activePanel = aggTabPanel.getActiveTab()\n          if (activePanel) {\n            await activePanel.updateData()\n          }\n        }\n      }\n      catch (e) {\n        SM.Error.handleError(e)\n      }\n    }\n\n    // handle periodic updates\n    async function updateData({event} = {}) {\n      try {\n        // event = activate || tabchange || reload || updateData || refreshViews\n        const refreshViewsOnly = event === 'refreshviews'\n        const loadMasksDisabled = event === 'tabchange' || event === 'updatedata' || event === 'refreshviews'\n        \n        clearTimeout(gState.refreshViewTimerId)\n        const promises = []\n\n        if (!refreshViewsOnly) {\n          clearTimeout(gState.updateDataTimerId)\n          gState.updateDataTimerId = gState.refreshViewTimerId = null\n\n          promises.push(updateFilterableLabels())\n\n          gState.updateDataTimerId = setTimeout(\n            updateData, \n            UPDATE_DATA_DELAY, \n            {event: 'updatedata'}\n          )\n        }\n        promises.push(overviewPanel.updateData({refreshViewsOnly, loadMasksDisabled}))\n        const activePanel = aggTabPanel.getActiveTab()\n        if (activePanel) {\n          promises.push(activePanel.updateData({refreshViewsOnly, loadMasksDisabled: activePanel.items.items[0].initialized ? loadMasksDisabled : false }))\n        }\n\n        const [unused0, apiMetricsCollection, unused1] = await Promise.all(promises)\n        updateOverviewTitle()\n\n        const refreshViewsDelay = calcRefreshDelay(apiMetricsCollection.metrics.maxTouchTs)\n        if (refreshViewsDelay < UPDATE_DATA_DELAY) {\n          gState.refreshViewTimerId = setTimeout(\n            updateData, \n            refreshViewsDelay, \n            {event: 'refreshviews'}\n          )\n        }\n      }\n      catch (e) {\n        console.log(e)\n      }\n    }\n    function cancelTimers() {\n      clearTimeout(gState.refreshViewTimerId)\n      clearTimeout(gState.updateDataTimerId)\n      // clearInterval(gState.updateLastRefreshIntervalId)\n      // gState.refreshViewTimerId = gState.updateDataTimerId = gState.updateLastRefreshIntervalId = null\n      gState.refreshViewTimerId = gState.updateDataTimerId = null\n    }\n\n    function calcRefreshDelay(maxTouchTs) {\n      // given maxTouchTs, calculate the interval to refresh the grids/toolbars\n      const diffSecs = Math.ceil(Math.abs(new Date() - new Date(maxTouchTs)) / 1000)\n      if (diffSecs < 3600) {\n        // 30s when maxTouchTs is < 1h \n        return 30 * 1000\n      }\n      if (diffSecs < 86400) {\n        // 1h when maxTouchTs is < 1d\n        return 3600 * 1000\n      }\n      // 1d\n      return 86400 * 1000\n    }\n  }\n  catch (e) {\n    SM.Error.handleError(e)\n  }\n}\n"
  },
  {
    "path": "client/src/js/SM/ColumnFilters.js",
    "content": "Ext.ns('SM.ColumnFilters')\n\nSM.ColumnFilters.extend = function extend (extended, ex) {\n  return Ext.extend(extended, {\n    constructor: function (config) {\n      // Ext.apply(this, config);\n      this.extends = ex\n      this.addEvents(\n        'filterschanged',\n        'columnfiltered',\n        'columnunfiltered'\n      )\n      SM.ColumnFilters[ex].superclass.constructor.call(this, config);\n    },\n    handleHdDown: function (e, target) {\n      // Modifies superclass method to support lastHide\n  \n      // to support headers with tooltip in <span>, check parent node for the hd-inner class\n      if (target.classList[0] !== 'x-grid3-hd-inner' && target.parentElement.classList[0] !== 'x-grid3-hd-inner') {\n        return\n      }\n      e.stopEvent()\n      if (!this.lastHide || this.lastHide.getElapsed() > 100) {\n        var colModel  = this.cm,\n        header    = this.findHeaderCell(target),\n        index     = this.getCellIndex(header),\n        sortable  = colModel?.isSortable(index),\n        menu      = this.hmenu,\n        menuItems = menu.items,\n        menuCls   = this.headerMenuOpenCls,\n        sep;\n    \n        this.hdCtxIndex = index;\n        \n        Ext.fly(header).addClass(menuCls);\n        if (this.hideSortIcons) {\n            menuItems.get('asc').setVisible(sortable);\n            menuItems.get('desc').setVisible(sortable);\n            sep = menuItems.get('sortSep');\n            if (sep) {\n                sep.setVisible(sortable);    \n            }\n        } else {\n            menuItems.get('asc').setDisabled(!sortable);\n            menuItems.get('desc').setDisabled(!sortable);\n        }\n        \n        menu.on('hide', function() {\n            Ext.fly(header).removeClass(menuCls);\n            this.lastHide = new Date()\n        }, this, {single:true});\n        \n        // menu.show(target, 'tl-bl?');\n        if (this.cm.config[this.hdCtxIndex]?.filter?.type === 'multi-value') {\n          const multiValueItem = menu.filterItems.multiValueItems.find( i => i.filter.dataIndex === this.cm.config[this.hdCtxIndex].dataIndex)\n          if (multiValueItem) {\n            multiValueItem.setGridSizeForXY(e.xy)\n            multiValueItem.sortGrid()\n            multiValueItem.prepareForShow()\n            menu.setWidth(180)\n          }\n        } else {\n          menu.setWidth(150)\n        }\n        menu.showAt(e.xy);    \n      }\n    },\n    onDataChange : function(){\n      SM.ColumnFilters.GridView.superclass.onDataChange.call(this)\n      this.setColumnFilteredStyle()\n    },\n    setColumnFilteredStyle: function () {\n      if (!this.cm) return // handle edge case where grid was destroyed before this method is called\n      const colCount = this.cm?.getColumnCount()\n      for (let i = 0; i < colCount; i++) {\n        const td = this.getHeaderCell(i)\n        td.getElementsByTagName(\"a\")[0].style.height = td.classList.contains('x-grid3-td-checker') ? 0 : (td.firstChild.offsetHeight - 1) + 'px'\n        if (this.cm.config[i].filter) {\n          td.classList.add('sm-grid3-col-filterable')\n        } else {\n          td.classList.remove('sm-grid3-col-filterable')\n        }\n        if (this.cm.config[i].filtered) {\n          td.classList.add('sm-grid3-col-filtered')\n        } else {\n          td.classList.remove('sm-grid3-col-filtered')\n        }  \n      }\n    },\n    getFilterFns: function () {\n      const hmenu = this.hmenu\n      const stringItems = hmenu.filterItems.stringItems\n      const valuesItems = hmenu.filterItems.valuesItems\n      const multiValueItems = hmenu.filterItems.multiValueItems\n      const conditions = {}\n      const filterFns = []\n  \n      // // iterate the menu items and set the condition(s) for each dataIndex\n      for (const stringItem of stringItems) {\n        const value = stringItem.getValue()\n        if (value.value) {\n          conditions[stringItem.filter.dataIndex] = value\n        }\n      }\n      for (const selectAllItem of valuesItems) {\n        if (!selectAllItem.checked) {\n          const dataIndex = selectAllItem.filter.dataIndex\n          conditions[dataIndex] = []\n          for (const valueItem of selectAllItem.valueItems) {\n            if (valueItem.checked === true) {\n              conditions[dataIndex].push(valueItem.filter.value)\n            }\n          }\n        }\n      }\n      for (const multiValueItem of multiValueItems) {\n        const value = multiValueItem.getValue()\n        if (value.isAllSelected && value.condition && value.match === 'any') continue // skip empty multi-value filters\n        conditions[multiValueItem.filter.dataIndex] = multiValueItem.getValue()\n      }\n\n      // create a function for each dataIndex\n      for (const dataIndex of Object.keys(conditions)) {\n          filterFns.push({\n            fn: function (record) {\n              const cellValue = record.data[dataIndex]\n              const condition = conditions[dataIndex]\n\n              if (Array.isArray(cellValue)) { \n              // the record data is an Array of values\n                if (Array.isArray(condition)) {\n                  if (condition.includes('') && cellValue.length === 0) return true\n                  return cellValue.some( v => condition.includes(v))\n                }\n                if (condition.value) { // multi-value condition\n                  let matchResult\n                  if (condition.match === 'all') {\n                    // ALL logic: cellValue must contain ALL values in condition\n                    matchResult = condition.value.every(v => v ? cellValue.includes(v) : cellValue.length === 0)\n                  } else if (condition.match === 'exact') {\n                    // EXACT logic: cellValue must contain the exact values in condition\n                    if (condition.value.length === 1 && condition.value.includes('') && cellValue.length === 0) {\n                      matchResult = true\n                    } else {\n                      matchResult = condition.value.length === cellValue.length && condition.value.every(v => cellValue.includes(v))\n                    }\n                  } else {\n                    // ANY logic: cellValue must contain ANY value in condition (default)\n                    if (condition.value.includes('') && cellValue.length === 0) {\n                      matchResult = true\n                    } else {\n                      matchResult = cellValue.some(v => condition.value.includes(v))\n                    }\n                  }\n                  \n                  // Apply include/exclude filter\n                  return condition.condition ? matchResult : !matchResult\n                }\n              }\n  \n              // the record data is a scalar value (we're missing object handling?)\n              if (Array.isArray(condition)) {\n                return condition.includes(cellValue) \n              }\n              else {\n                // string matches\n                const a = condition.matchCase ? cellValue : cellValue.toLowerCase()\n                const b = condition.matchCase ? condition.value : condition.value.toLowerCase()\n                let found\n                if (condition.matchWord) {\n                  found = a.search(new RegExp(`\\\\b${b}\\\\b`))\n                }\n                else {\n                  found = a.indexOf(b)\n                }\n                return condition.condition ? found > -1 : found === -1\n              }\n            }\n          })  \n      }\n      return filterFns.length ? filterFns : null\n    },\n    onFilterChange: function (item, value) {\n      switch (item.filter.type) {\n        case 'string':\n          item.column.filtered = !!(item.getValue()?.value)\n          break\n        case 'values':\n          {\n            const hmenuItems = this.hmenu.items.items\n            const hmenuPeers = hmenuItems.filter( i => i.filter?.type === 'values' && i.filter?.dataIndex === item.filter.dataIndex)\n            const hmenuPeersChecked = hmenuPeers.map( i => i.checked)\n            item.column.filtered = hmenuPeersChecked.includes(false)\n            break\n          }\n        case 'selectall':\n          item.column.filtered = !(!!value)\n          break\n        case 'multi-value':\n          {\n            const itemValue = item.getValue()\n            item.column.filtered = true\n            if (\n              itemValue.match === 'any' &&\n              (\n                (itemValue.condition && itemValue.isAllSelected) ||\n                (!itemValue.condition && itemValue.value.length === 0)\n              )\n            ) {\n              item.column.filtered = false\n            }\n            break\n          }\n      }\n      this.fireEvent('filterschanged', this, item, value)\n    },\n    buildValueItems: function (records, isLoading) {\n      const hmenu = this.hmenu\n      const _this = this\n      const savedValues = {}\n      for (const selectAllItem of hmenu.filterItems.valuesItems) {\n        const dataIndex = selectAllItem.filter.dataIndex\n        ;(savedValues[dataIndex] = savedValues[dataIndex] || []).selectAllChecked = selectAllItem.checked\n        for (const valueItem of selectAllItem.valueItems) {\n          if (valueItem.checked && !isLoading) {\n            savedValues[dataIndex].push(valueItem.filter.value)\n          }      \n          hmenu.remove(valueItem)\n        }\n        hmenu.remove(selectAllItem)\n      }\n            hmenu.filterItems.valuesItems = []\n      // iterate the values columns and create menu items, restoring saved values if not loading\n      for (const col of this.valuesColumns) {\n        if (isLoading) col.filtered = false\n        const itemConfigs = []\n        // get unique values for this column from the record set\n        const uniqueSet = new Set(records.flatMap( r => r.data[col.dataIndex] ? (r.data[col.dataIndex].length ? r.data[col.dataIndex] : '') : r.data[col.dataIndex] ))\n        const uniqueArray = [...uniqueSet].sort(col.filter.comparer)\n        const cValue = savedValues[col.dataIndex]\n        for ( const value of uniqueArray ) {\n          itemConfigs.push({\n            text: col.filter.renderer ? col.filter.renderer(value, col.filter.collectionId) : value ,\n            xtype: 'menucheckitem',\n            column: col,\n            hideOnClick: false,\n            checked: isLoading ? true : cValue ? cValue.selectAllChecked || cValue.includes(value) : false,\n            filter: {\n              dataIndex: col.dataIndex,\n              type: 'values',\n              value\n            },\n            listeners: {\n              checkchange: function (item, value) {\n                item.selectAllItem.onValueItemChanged()\n                _this.onFilterChange(item, value)\n              }\n            }\n          })\n        }\n        // add the Select All item\n        const selectAllItem = hmenu.addItem({\n          text: '<i>(Select All)</i>',\n          xtype: 'menucheckitem',\n          column: col,\n          hideOnClick: false,\n          checked: isLoading ? true : cValue.selectAllChecked,\n          filter: {\n            dataIndex: col.dataIndex,\n            type: 'selectall'\n          },\n          valueItems: [],\n          onValueItemChanged: function () {\n            const state = this.valueItems.every( i => i.checked )\n            this.setChecked(state, true)\n          },\n          listeners: {\n            checkchange: function (item, checked) {\n              for (const valueItem of item.valueItems) {\n                valueItem.setChecked(checked, true)\n              }\n              _this.onFilterChange(item, checked)\n            }\n          }\n        })\n        // add the child items\n        for (const itemConfig of itemConfigs) {\n          itemConfig.selectAllItem = selectAllItem\n          const valueItem = hmenu.addItem(itemConfig)\n          selectAllItem.valueItems.push(valueItem)\n        }\n        hmenu.filterItems.valuesItems.push(selectAllItem)\n      }\n    },\n    buildValues: function (records, isLoading) {\n      this.buildValueItems(records, isLoading)\n      this.buildMultiValueItems(records, isLoading)\n    },\n    buildMultiValueItems: function (records, isLoading) {\n      const hmenu = this.hmenu\n      const savedMultiValues = {}\n      for (const multiValueItem of hmenu.filterItems.multiValueItems) {\n        const dataIndex = multiValueItem.filter.dataIndex\n        const col = multiValueItem.column\n        savedMultiValues[dataIndex] = multiValueItem.getValue()\n        if (isLoading) col.filtered = false\n        const uniqueSet = new Set(records.flatMap( r => r.data[col.dataIndex] ? (r.data[col.dataIndex].length ? r.data[col.dataIndex] : '') : r.data[col.dataIndex] ))\n        const uniqueArray = [...uniqueSet].sort(col.filter.comparer)\n        const multiValueData = uniqueArray.map( value => [value] )\n        multiValueItem.loadData(multiValueData)\n        if (!isLoading) {\n          savedMultiValues[col.dataIndex] && multiValueItem.setValue(savedMultiValues[col.dataIndex])\n        }\n        multiValueItem.prepareForShow()\n        this.onFilterChange(multiValueItem, multiValueItem.getValue())\n      } \n    },\n    afterRenderUI: function () {\n      this.valuesColumns = []\n      this.multiValueColumns = []\n      const _this = this\n      \n      SM.ColumnFilters[this.extends].superclass.afterRenderUI.call(this)\n  \n      const hmenu = this.hmenu\n      hmenu.filterItems = {\n        stringItems: [],\n        valuesItems: [],\n        multiValueItems: []\n      }\n      // disables keyboard navigation, needed to support left-right arrow in search input\n      hmenu.keyNav = new Ext.KeyNav(document.body, {disabled: true})\n      const itemSeparator = hmenu.addItem('-')\n  \n      const itemLabel = hmenu.addItem({\n        hideOnClick : false,\n        activeClass: '',\n        text: 'FILTER',\n        iconCls: 'sm-menuitem-filter-icon',\n        cls: 'sm-menuitem-filter-label'\n      })\n  \n      this.grid.store.on('load', function (store, records, opt) {\n        _this.buildValues(store.data.items, false)\n        _this.setColumnFilteredStyle()\n        _this.fireEvent('filterschanged', _this)\n\n      })\n      this.grid.store.on('update', function (store, record) {\n        _this.buildValues(store.snapshot ? store.snapshot.items : store.data.items, false)\n      })\n  \n      // Hide menuitems not associated with the clicked column\n      hmenu.on('beforeshow', function (menu) {\n        const dataIndex = _this.cm.config[_this.hdCtxIndex].dataIndex\n        let showSep = false\n        for (const menuitem of menu.items.items) {\n          if (menuitem.filter) {\n            const isVisible = menuitem.filter.dataIndex === dataIndex\n            if (isVisible) showSep = true\n            menuitem.setVisible(isVisible)\n          }\n        }\n        itemSeparator.setVisible(showSep)    \n        itemLabel.setVisible(showSep)    \n      })\n  \n      for (const col of this.cm.config) {\n        switch (col.filter?.type) {\n          case 'string': {\n            if (col.renderer) {\n              col.configRenderer = col.renderer\n              col.renderer = SM.ColumnFilters.Renderers.highlighterShim\n            }\n            const stringItem = hmenu.add(new SM.ColumnFilters.StringPanel({\n              hideOnClick: false,\n              removeMode: 'container', // the menu <li> is removed when the panel is removed\n              column: col,\n              filter: { dataIndex: col.dataIndex, type: 'string'},\n              listeners: {\n                filterchanged: function (panel) {\n                  _this.onFilterChange(panel, panel.getValue())\n                },\n                enterkey: function () {\n                  hmenu.hide(true)\n                }\n              }\n            }))\n            hmenu.filterItems.stringItems.push(stringItem)\n            break\n          }\n          case 'values':\n            this.valuesColumns.push(col)\n            break\n          case 'multi-value': {\n            const multiValueItem = hmenu.add(new SM.ColumnFilters.MultiValuePanel({\n              collectionId: col.filter.collectionId,\n              column: col,\n              filter: { dataIndex: col.dataIndex, type: 'multi-value'},\n              renderer: col.filter.renderer,\n              listeners: {\n                filterchanged: function () {\n                  _this.onFilterChange(multiValueItem, multiValueItem.getValue())\n                },\n              }\n            }))\n            hmenu.filterItems.multiValueItems.push(multiValueItem)\n            break\n          }\n        }\n      }\n      \n      this.buildValues(this.grid.store.data.items, true)\n      this.setColumnFilteredStyle()\n\n    }\n  })\n}\n\nSM.ColumnFilters.GridView = SM.ColumnFilters.extend(Ext.grid.GridView, 'GridView')\nSM.ColumnFilters.GridViewBuffered = SM.ColumnFilters.extend(Ext.ux.grid.BufferView, 'GridViewBuffered')\nSM.ColumnFilters.GridViewLocking = SM.ColumnFilters.extend(Ext.ux.grid.LockingGridView, 'GridViewLocking')\n\nSM.ColumnFilters.StringMatchTextField = Ext.extend(Ext.form.TextField, {\n  initComponent: function () {\n    const config = {\n      autoCreate: {tag: 'input', type: 'search', size: '20', autocomplete: 'off', spellcheck: 'false'},\n      enableKeyEvents: true\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n    this.addEvents( 'input' )\n  },\n  initEvents: function () {\n    this.superclass().initEvents.call(this)\n    this.mon(this.el, {\n      scope: this,\n      input: this.onInput\n    })\n  },\n  onInput: function (e) {\n    this.fireEvent('input', this, e);\n  }\n})\n\nSM.ColumnFilters.StringMatchConditionComboBox = Ext.extend(Ext.form.ComboBox, {\n  initComponent: function () {\n    const store = new Ext.data.ArrayStore({\n      fields: ['display', 'value'],\n      data: [['Include', true], ['Exclude', false]]\n    })\n    const config = {\n      listClass: 'x-menu',\n      store,\n      triggerAction: 'all',\n      mode: 'local',\n      editable: false,\n      valueField: 'value',\n      displayField: 'display'\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n    this.setValue(true)\n  }\n})\n\nSM.ColumnFilters.StringMatchCaseButton = Ext.extend(Ext.Button, {\n  initComponent:  function () {\n    const config = {\n      enableToggle: true,\n      border: false,\n      iconCls: 'sm-match-case-icon',\n      tooltip: 'Match case'\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.ColumnFilters.StringMatchWordButton = Ext.extend(Ext.Button, {\n  initComponent:  function () {\n    const config = {\n      enableToggle: true,\n      border: false,\n      iconCls: 'sm-match-word-icon',\n      tooltip: 'Match word'\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.ColumnFilters.StringPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n\n    const onFilterChange = function () {\n      _this.column.filter.value = getValue()\n      _this.fireEvent('filterchanged', _this)\n    }\n\n    const conditionComboBox = new SM.ColumnFilters.StringMatchConditionComboBox({\n      flex: 1,\n      listeners: {\n        select: onFilterChange\n      }\n    })\n    const matchCaseButton = new SM.ColumnFilters.StringMatchCaseButton({\n      width: 24,\n      listeners: {\n        toggle: onFilterChange\n      }\n    })\n    const matchWordButton = new SM.ColumnFilters.StringMatchWordButton({\n      width: 24,\n      listeners: {\n        toggle: onFilterChange\n      }\n    })\n    const textfield = new SM.ColumnFilters.StringMatchTextField({\n      height: 24,\n      style: {\n        marginTop: '2px'\n      },\n      width: '100%',\n      emptyText: 'Type to filter',\n      listeners: {\n        input: onFilterChange,\n        keyup: function (item, e) {\n          const k = e.getKey()\n          if (k == e.RETURN) {\n              e.stopEvent()\n              _this.fireEvent('enterkey')\n          }\n        }\n      }\n    })\n\n    function getValue () {\n      return {\n        value: textfield.getValue() ?? '',\n        condition: conditionComboBox.getValue(),\n        matchCase: matchCaseButton.pressed,\n        matchWord: matchWordButton.pressed,\n      }\n    }\n    const config = {\n      getValue,\n      border: false,\n      items: [\n        {\n          layout: 'hbox',\n          border: false,\n          items: [\n            conditionComboBox,\n            matchCaseButton,\n            matchWordButton\n          ]\n        },\n        textfield\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.ColumnFilters.MultiValueMatchAnyButton = Ext.extend(Ext.Button, {\n  initComponent: function () {\n    const config = {\n      enableToggle: true,\n      border: false,\n      allowDepress: false,\n      pressed: true,\n      text: \"‖\",\n      // text: '∨',\n      tooltip: 'Match any of the selected items (logical OR)',\n      toggleGroup: 'valuesMatch'\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.ColumnFilters.MultiValueMatchAllButton = Ext.extend(Ext.Button, {\n  initComponent: function () {\n    const config = {\n      enableToggle: true,\n      allowDepress: false,\n      border: false,\n      text: '&',\n      // text: '∧',\n      tooltip: 'Match all of the selected items (logical AND)',\n      toggleGroup: 'valuesMatch'\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.ColumnFilters.MultiValueMatchExactButton = Ext.extend(Ext.Button, {\n  initComponent: function () {\n    const config = {\n      enableToggle: true,\n      allowDepress: false,\n      border: false,\n      text: '=',\n      tooltip: 'Match the exact selected items',\n      toggleGroup: 'valuesMatch'\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.ColumnFilters.MultiValueGridPanel = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    \n    const collectionId = this.collectionId\n    const renderer = this.renderer\n\n    const store = new Ext.data.ArrayStore({\n      fields: ['value'],\n      data: []\n    })\n    const sm = new Ext.grid.CheckboxSelectionModel({\n      singleSelect: false,\n      checkOnly: true,\n      grid: _this,\n      listeners: {\n        selectionchange: function (sm) {\n          SM.SetCheckboxSelModelHeaderState(sm)\n          _this.fireEvent('selectionchange', sm, sm.getSelections())\n        }\n      }\n    })\n\n    function getValue() {\n      const selections = sm.getSelections()\n      if (selections.length === 0) return []\n      return selections.map( s => s.data.value )\n    }\n\n    function isAllSelected () {\n      return store.getCount() === sm.getSelections().length\n    }\n\n    const view = new Ext.grid.GridView({\n      forceFit: true,\n      hasRows : function() {\n          let fc = this.mainBody?.dom.firstChild;\n          return fc && fc.nodeType == 1 && fc.className != 'x-grid-empty';\n      }\n    })\n\n    const config = {\n      getValue,\n      isAllSelected,\n      store,\n      sm,\n      view,\n      columns: [\n        sm,\n        {\n          header: this.header ?? '<i>(Select All)</i>',\n          dataIndex: 'value',\n          renderer: function (v) {\n            if (renderer) {\n              return renderer(v, collectionId)\n            }\n          }\n        }\n      ],\n      cls: 'sm-multi-value-grid',\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})          \n\nSM.ColumnFilters.MultiValuePanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n\n    const onFilterChange = function () {\n      _this.column.filter.value = getValue()\n      _this.fireEvent('filterchanged', _this)\n    }\n\n    const conditionComboBox = new SM.ColumnFilters.StringMatchConditionComboBox({\n      flex: 3,\n      listeners: {\n        select: onFilterChange\n      }\n    })\n    const matchAllButton = new SM.ColumnFilters.MultiValueMatchAllButton({\n      flex: 1,\n      toggleGroup: 'valuesMatch',\n      listeners: {\n        click: onFilterChange\n      }\n    })\n    const matchAnyButton = new SM.ColumnFilters.MultiValueMatchAnyButton({\n      flex: 1,\n      toggleGroup: 'valuesMatch',\n      listeners: {\n        click: onFilterChange\n      }\n    })\n    const matchExactButton = new SM.ColumnFilters.MultiValueMatchExactButton({\n      flex: 1,\n      toggleGroup: 'valuesMatch',\n      listeners: {\n        click: onFilterChange\n      }\n    })\n    const grid = new SM.ColumnFilters.MultiValueGridPanel({\n      collectionId: this.collectionId,\n      cls: 'sm-multi-value-grid',\n      renderer: this.renderer,\n      height: 250,\n      style: {\n        marginTop: '2px'\n      },\n      listeners: {\n        selectionchange: onFilterChange,\n        viewready: function (grid) {\n          grid.view.refresh()\n          SM.SetCheckboxSelModelHeaderState(grid.selModel)\n        },\n        // beforeshow: function (grid) {\n        //   grid.view.refresh()\n        // }\n      }\n    })\n\n    function getValue () {\n      return {\n        value: grid.getValue() ?? [],\n        isAllSelected: grid.isAllSelected(),\n        condition: conditionComboBox.getValue(),\n        match: matchAllButton.pressed ? 'all' : matchExactButton.pressed ? 'exact' : 'any',\n      }\n    }\n\n    function setValue(value) {\n      conditionComboBox.setValue(value.condition)\n      matchAnyButton.toggle(value.match === 'any')\n      matchAllButton.toggle(value.match === 'all')\n      matchExactButton.toggle(value.match === 'exact')\n      \n      const sm = grid.getSelectionModel()\n      sm.suspendEvents()\n      sm.silent = true\n      sm.clearSelections()\n      if (value.isAllSelected) {\n        sm.selectAll()\n      } \n      else {\n        const selections = []\n        if (value.value?.length) {\n          for (const v of value.value) {\n            const record = grid.store.getAt(grid.store.findExact('value', v))\n            if (record) {\n              selections.push(record)\n            }\n          }\n        }\n        if (selections.length) {\n          sm.selectRecords(selections)\n        }\n      }\n      sm.silent = false\n      sm.resumeEvents()\n    }\n\n    function loadData (data, value) {\n      grid.store.loadData(data)\n      const sm = grid.getSelectionModel()\n      if (!value) {\n        sm.suspendEvents()\n        sm.silent = true\n        sm.selectAll()\n        sm.silent = false\n        sm.resumeEvents()\n      } else {\n        setValue(value)\n      }\n    }\n\n    function setGridSizeForXY(xy) {\n      const nonGridHeight = 170 // height of the non-grid elements (sorting items, column item, filter label, controls)\n      const gridHeaderHeight = 24 // height of the grid header\n      const gridRowHeight = 23 // height of each grid row\n      const gridUnscrolledHeight = grid.store.getCount() * gridRowHeight + gridHeaderHeight + 2 // +2 for grid border\n      const bodyHeight = document.body.clientHeight\n      const newGridHeight = Math.min(gridUnscrolledHeight, bodyHeight - xy[1] - nonGridHeight)\n      grid.setHeight(newGridHeight)\n\n      // Wait for the style to be applied using setTimeout\n      setTimeout(() => {\n        if (grid.viewReady){\n            grid.view.layout()\n        }\n      }, 0)\n    }\n\n    function sortGrid() {\n      const compareFn = _this.column.filter.comparer || ((a, b) => a.localeCompare(b))\n      const selected = grid.selModel.getSelections().sort((a,b) => compareFn(a.data.value, b.data.value))\n      const unselected = grid.store.getRange().filter( r => !selected.includes(r) ).sort((a,b) => compareFn(a.data.value, b.data.value))\n      const sorted = [...selected, ...unselected]\n      for (let i = 0; i < sorted.length; i++) {\n        grid.store.data.items[i] = sorted[i]\n        grid.store.data.keys[i] = sorted[i].id\n      }\n    }\n\n    function prepareForShow() {\n      if (grid.viewReady) {\n        grid.view.refresh(true)\n        grid.view.scrollToTop()\n        SM.SetCheckboxSelModelHeaderState(grid.selModel)\n      }\n    }\n\n    const config = {\n      getValue,\n      setValue,\n      setGridSizeForXY,\n      sortGrid,\n      prepareForShow,\n      grid,\n      border: false,\n      loadData,\n      items: [\n        {\n          layout: 'hbox',\n          border: false,\n          items: [\n            conditionComboBox,\n            matchAnyButton,\n            matchAllButton,\n            matchExactButton\n          ]\n        },\n        grid\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.ColumnFilters.Scorers = {\n  severity: {\n    low: 2,\n    medium: 1,\n    high: 0\n  }\n}\n\nSM.ColumnFilters.CompareFns = {\n  severity: (a, b) => {\n    return SM.ColumnFilters.Scorers.severity[a] - SM.ColumnFilters.Scorers.severity[b]\n  },\n  labelIds: (a, b, collectionId) => {\n    if (a === \"\") return -1;\n    if (b === \"\") return 1;\n    return SM.Cache.getCollectionLabel(collectionId, a).name.localeCompare(SM.Cache.getCollectionLabel(collectionId, b).name)\n  }       \n}\n\nSM.ColumnFilters.Renderers = {\n  result: function (v) {\n    if (!v) return '<i>(No value)</i>'\n    return `<div class=\"sm-grid-result-sprite ${SM.RenderResult[v]?.css}\">${SM.RenderResult[v]?.textDisa}</div>`\n  },\n  engineResult: function (v) {\n    if (!v) return '<i>(No value)</i>'\n    switch (v) {\n      case 'engine':\n        return '<div class=\"sm-engine-result-icon sm-menuitem-div-icon\">Engine result</div>'\n      case 'override':\n        return '<div class=\"sm-engine-override-icon sm-menuitem-div-icon\">Engine override</div>'\n      case 'manual':\n        return '<div class=\"sm-engine-manual-icon sm-menuitem-div-icon\">Manual result</div>'\n      }\n    \n  },\n  status: function (v) {\n    switch (v) {\n      case 'saved':\n        return '<img src=\"img/save-icon.svg\" width=12 height=12 class=\"sm-menuitem-status-icon\">Saved'\n      case 'submitted':\n        return '<img src=\"img/ready-16.png\" width=12 height=12 class=\"sm-menuitem-status-icon\">Submitted'\n      case 'rejected':\n        return '<img src=\"img/rejected-16.png\" width=12 height=12 class=\"sm-menuitem-status-icon\">Rejected'\n      case 'accepted':\n        return '<img src=\"img/star.svg\" width=12 height=12 class=\"sm-menuitem-status-icon\">Accepted'\n      default:\n        return '<i>(No value)</i>'\n    }\n  },\n  severity: function (v) {\n    switch (v) {\n      case 'high':\n        return '<span class=\"sm-grid-sprite sm-severity-high\">CAT 1</span>'\n      case 'medium':\n        return '<span class=\"sm-grid-sprite sm-severity-medium\">CAT 2</span>'\n      case 'low':\n        return '<span class=\"sm-grid-sprite sm-severity-low\">CAT 3</span>'\n      case 'mixed':\n        return '<span class=\"sm-grid-sprite sm-severity-low\">Mixed</span>'\n      default:\n        return '<span class=\"sm-grid-sprite sm-severity-low\">U</span>'\n    }  \n  },\n  highlighterShim: function (v, m, r, ri, ci, s) {\n    if (this.filter?.type === 'string' && this.filter.value?.value && this.filter.value.condition) {\n      let searchStr = SM.he(this.filter.value.value)\n      const flags = `g${this.filter.value.matchCase ? '' : 'i'}`\n      if (this.filter.value.matchWord) {\n        searchStr = `\\\\b${searchStr}\\\\b`\n      }\n      v = v.replace(new RegExp(searchStr, flags),'<span class=\"sm-text-highlight\">$&</span>')\n    }\n    return this.configRenderer ? this.configRenderer(v, m, r, ri, ci, s) : v\n  },\n  labels: function (labelId, collectionId) {\n    if (!labelId) return '<i>(No value)</i>'\n    const labelObj = SM.Cache.getCollectionLabel(collectionId, labelId)\n    return SM.Manage.Collection.LabelTpl.apply(labelObj)\n  },\n  groups: function (v) {\n    if (!v) return '<i>(No value)</i>'\n    return SM.User.GroupTpl.apply(v)\n  }\n}\n"
  },
  {
    "path": "client/src/js/SM/Error.js",
    "content": "Ext.ns('SM.Error')\n\nclass SmError extends Error {\n  constructor(message) {\n    super(message)\n    this.name = this.constructor.name\n  }\n}\n\nclass PrivilegeError extends SmError {\n  constructor(detail) {\n    super('User has insufficient privilege to use this app.')\n    this.detail = detail\n  }\n}\n\nclass ExtRequestError extends SmError {\n  constructor(detail, message = 'Ext.Ajax.request() failed') {\n    super(message)\n    this.method = detail?.options?.method\n    this.url = detail?.options?.url\n    this.status = detail?.response?.status\n    this.responseText = detail?.response?.responseText\n    this.responseHeaders = detail?.response?.getAllResponseHeaders?.()\n    const tokenParsed = { ...window.oidcWorker.tokenParsed }\n    let expDate = new Date(tokenParsed.exp*1000)\n    let iatDate = new Date(tokenParsed.iat*1000)\n    let authTimeDate = new Date(tokenParsed.auth_time*1000)\n    tokenParsed.exp = `${tokenParsed.exp} (${expDate.format('Y-m-d H:i:s')})`\n    tokenParsed.iat = `${tokenParsed.iat} (${iatDate.format('Y-m-d H:i:s')})`\n    tokenParsed.auth_time = `${tokenParsed.auth_time} (${authTimeDate.format('Y-m-d H:i:s')})`\n    this.tokenParsed = tokenParsed\n    this.detail = detail\n  }\n}\n\nclass ExtDataProxyError extends SmError {\n  constructor(exception, message = 'Ext.data.DataProxy fired an exception') {\n    super(message)\n    const options = exception?.callback?.arguments?.[0]\n    const response = exception?.callback?.arguments?.[2]\n    this.method = options?.method\n    this.url = options?.url\n    this.status = response?.status\n    this.responseText = response?.responseText\n    this.responseHeaders = response?.getAllResponseHeaders?.()\n    const tokenParsed = { ...window.oidcWorker.tokenParsed }\n    let expDate = new Date(tokenParsed.exp*1000)\n    let iatDate = new Date(tokenParsed.iat*1000)\n    let authTimeDate = new Date(tokenParsed.auth_time*1000)\n    tokenParsed.exp = `${tokenParsed.exp} (${expDate.format('Y-m-d H:i:s')})`\n    tokenParsed.iat = `${tokenParsed.iat} (${iatDate.format('Y-m-d H:i:s')})`\n    tokenParsed.auth_time = `${tokenParsed.auth_time} (${authTimeDate.format('Y-m-d H:i:s')})`\n    this.tokenParsed = tokenParsed\n    this.detail = {\n      options: {\n        method: options.method,\n        url: options.url,\n        params: options.params,\n        headers: options.headers\n      }, response}\n  }\n}\n\nclass NonJsonResponse extends ExtRequestError {\n  constructor(detail) {\n    super(detail, 'The response is not JSON.')\n  }\n}\n\nObject.assign(SM.Error, {\n  SmError,\n  PrivilegeError,\n  ExtRequestError,\n  ExtDataProxyError,\n  NonJsonResponse \n})\n\nSM.Error.FormPanel = Ext.extend(Ext.form.FormPanel, {\n  initComponent: function () {\n    const _this = this\n\n    this.displayField = new Ext.form.DisplayField({\n      fieldLabel: 'Message',\n      value: '<b>An unhandled error has occurred. You can review the error details below and copy the details to your clipboard.</b>',\n      height: 40\n    })\n  \n\n    this.jsonViewDisplayField = new Ext.form.DisplayField({\n      allowBlank: true,\n      style: 'border: 1px solid #C1C1C1',\n      fieldLabel: 'Detail',\n      autoScroll: true,\n      border: true,\n      name: 'errorObj',\n      // height: 150,\n      anchor: '100% -80',\n      setValue: function (v) {\n          if (Object.keys(v).length === 0 && v.constructor === Object) {\n              return\n          }\n          if (!v.env) {\n            v.env = STIGMAN.Env\n          }\n          const tree = JsonView.createTree(v)\n          tree.key = 'error'\n          tree.isExpanded = true\n          tree.children[0].isExpanded = true\n          const el = this.getEl().dom\n          JsonView.render(tree, el)\n          // JsonView.expandChildren(tree)\n          this.value = v\n      }\n    })\n    \n    const config = {\n      border: false,\n      labelWidth: 65,\n      hideLabels: true,\n      items: [\n        this.displayField,\n        this.jsonViewDisplayField\n      ],\n      buttons: [{\n        text: 'Copy to clipboard',\n        handler: async function (btn) {\n          await navigator.clipboard.writeText(JSON.stringify(_this.jsonViewDisplayField.value))\n        }\n      }]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Error.displayError = function (data) {\n  const fp = new SM.Error.FormPanel()\n  const appwindow = new Ext.Window({\n    title: 'Unhandled Error',\n    cls: 'sm-dialog-window sm-round-panel',\n    modal: true,\n    hidden: true,\n    width: 660,\n    height: 650,\n    layout: 'fit',\n    plain:true,\n    bodyStyle:'padding:15px;',\n    buttonAlign:'right',\n    items: fp\n  })\n  appwindow.render(Ext.getBody())\n  fp.getForm().setValues(data)\n  appwindow.show(Ext.getBody())\n}\n\n\nSM.Error.handleError = async function (e) {\n  try {\n    if (STIGMAN.isMinimizedSource && !SM.Error.sourceMapConsumer) {\n      await SM.Error.initSourceMap()\n    }\n    let errorObj\n    if (e instanceof ErrorEvent) e = e.error\n    if (e instanceof Error) {\n      if (STIGMAN.isMinimizedSource) {\n        e.sourceStack = SM.Error.getOriginalSource(e.stack)\n      }\n      if (e?.detail?.options?.headers?.Authorization) {\n        e.detail.options.headers.Authorization = '<removed>'\n      }\n      errorObj = STIGMAN.serializeError(e.error ? e.error : e)\n      // errorObj = e.error ? e.error : e\n    }\n    else {\n      errorObj = STIGMAN.serializeError(e.error ? e.error : e)\n    }\n    SM.Error.displayError({errorObj})\n  }\n  catch (e) {\n    alert(e.message ?? 'error in SM.Error.handleError()!')\n  }\n}\n\nSM.Error.initSourceMap = async function () {\n  try {\n    window.sourceMap.SourceMapConsumer.initialize({\n      \"lib/mappings.wasm\": \"js/modules/source-map/mappings.wasm\"\n    })\n    const response = await fetch ('js/stig-manager.min.js.map')\n    const text = await response.text()\n    SM.Error.sourceMapConsumer = await new window.sourceMap.SourceMapConsumer(JSON.parse(text))\n\n  }\n  catch (e) {\n    SM.Error.handleError(e)\n  }\n\n}\n\nSM.Error.getOriginalSource = function (stackTrace) {\n  let output = ''\n  const stack = SM.StackTrace.parse(stackTrace)\n  stack.forEach(({ methodName, lineNumber, column }) => {\n    try {\n      if (lineNumber == null || lineNumber < 1) {\n        output += `    at ${methodName || ''}\\n`\n      } else {\n        const pos = SM.Error.sourceMapConsumer.originalPositionFor({ line: lineNumber, column });\n        if (pos?.line != null) {\n          output += `    at ${pos.name || ''} (${pos.source}:${pos.line}:${pos.column})\\n`\n        }\n      }\n    } catch (err) {\n      output += `    at FAILED_TO_PARSE_LINE\\n`\n    }\n  })\n  return output\n}\n\nwindow.addEventListener('unhandledrejection', (event) => {\n  SM.Error.handleError(event.reason)\n})\n"
  },
  {
    "path": "client/src/js/SM/EventDispatcher.js",
    "content": "'use strict'\n\nExt.ns('SM')\n\nSM.Dispatcher = new Ext.util.Observable()\nSM.Dispatcher.addEvents(\n    'collectioncreated',\n    'collectiondeleted',\n    'collectionchanged',\n    'assetcreated',\n    'assetdeleted',\n    'assetchanged',\n    'usercreated',\n    'userdeleted',\n    'userchanged',\n    'stigassetschanged',\n    'fieldsettingschanged',\n    'statussettingschanged',\n    'labelcreated',\n    'labelchanged',\n    'labeldeleted',\n    'labelfilter',\n    'collectionsettingschanged',\n    'themechanged'\n)\n"
  },
  {
    "path": "client/src/js/SM/Exports.js",
    "content": "Ext.ns('SM.Exports')\n\nSM.Exports.AssetTree = Ext.extend(Ext.tree.TreePanel, {\n  initComponent: function () {\n    let me = this\n    let collectionId = this.collectionId\n    let config = {\n      layout: 'fit',\n      autoScroll: true,\n      bodyStyle: 'padding:5px;',\n      minSize: 220,\n      root: {\n        nodeType: 'async',\n        id: `${collectionId}-assignment-root`,\n        checked: false,\n        expanded: true\n      },\n      rootVisible: false,\n      loader: new Ext.tree.TreeLoader({\n        directFn: me.loadTree\n      }),\n      loadMask: 'Loading...',\n      listeners: {\n        checkchange: me.onCheckChange\n      }\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.Exports.AssetTree.superclass.initComponent.call(this)\n  },\n  loadTree: async function (node, cb) {\n    try {\n      let match\n      // Root node\n      match = node.match(/^(\\d+)-assignment-root$/)\n      if (match) {\n        let collectionId = match[1]\n        let content = [\n          {\n            id: `${collectionId}-assignment-assets-node`,\n            node: 'assets',\n            text: '<span style=\"font-weight: 600;\">All Assets</span>',\n            checked: true,\n            expanded: true,\n            iconCls: 'sm-asset-icon'\n          }\n        ]\n        cb(content, { status: true })\n        return\n      }\n      // Collection-Assets node\n      match = node.match(/^(\\d+)-assignment-assets-node$/)\n      if (match) {\n        let collectionId = match[1]\n        const gridAssets = this.ownerTree.data.filter( asset => asset.stigCount > 0 )\n        let content = gridAssets.map(asset => {\n          const badgePercent = Math.round(asset.acceptedPct)\n          const badgeClass = badgePercent === 100 ? 'sm-export-sprite-low' : badgePercent >= 50 ? 'sm-export-sprite-medium' : 'sm-export-sprite-high'\n          return {\n            id: `${collectionId}-${asset.assetId}-assignment-assets-asset-node`,\n            text: `${SM.he(asset.name)} <span class=\"sm-export-sprite ${badgeClass}\">${badgePercent}%</span>`,\n            node: 'asset',\n            collectionId: collectionId,\n            assetId: asset.assetId,\n            assetName: asset.name,\n            stigCount: asset.stigCount,\n            iconCls: 'sm-asset-icon',\n            checked: !!this.ui.checkbox.checked,\n            qtip: SM.he(asset.name)\n          }\n        })\n        this.getOwnerTree().assetsNode = this\n        cb(content, { status: true })\n        this.getOwnerTree().fireEvent('treeloaded')\n        return\n      }\n      // Collection-Assets-STIG node\n      match = node.match(/^(\\d+)-(\\d+)-assignment-assets-asset-node$/)\n      if (match) {\n        let collectionId = match[1]\n        let assetId = match[2]\n        let apiMetrics = await Ext.Ajax.requestPromise({\n          responseType: 'json',\n          url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/metrics/summary`,\n          method: 'GET',\n          params: {\n            assetId\n          }\n        })\n        let content = apiMetrics.map(item => {\n          const badgePercent = Math.round((item.metrics.statuses.accepted / item.metrics.assessments) * 100)\n          const badgeClass = badgePercent === 100 ? 'sm-export-sprite-low' : badgePercent >= 50 ? 'sm-export-sprite-medium' : 'sm-export-sprite-high'\n          return {\n            id: `${collectionId}-${assetId}-${item.benchmarkId}-assignment-leaf`,\n            text: `${SM.he(item.benchmarkId)} <span class=\"sm-export-sprite ${badgeClass}\">${badgePercent}%</span>`,\n            leaf: true,\n            node: 'asset-stig',\n            iconCls: 'sm-stig-icon',\n            stigName: item.benchmarkId,\n            assetName: item.name,\n            assetId: item.assetId,\n            collectionId: collectionId,\n            benchmarkId: item.benchmarkId,\n            checked: !!this.ui.checkbox.checked\n          }\n        })\n        cb(content, { status: true })\n        return\n      }\n    }\n    catch (e) {\n      SM.Error.handleError(e)\n    }\n  },\n  onCheckChange: function (node, checked) {\n    const checkDescendents = function (node) {\n      for (const child of node.childNodes) {\n        child.ui.checkbox.checked = checked\n        child.attributes.checked = checked\n        child.ui.checkbox.indeterminate = false\n        checkDescendents(child)\n      }\n    }\n\n    // check/uncheck descendents\n    checkDescendents(node)\n\n    // traverse up from node\n    // TODO: This will check parent if all children are indeterminate?\n    let check = node\n    while (check) {\n      // find parent and siblings\n      const parent = check.parentNode\n      if (parent?.ui?.checkbox) { // root node won't have checkbox\n        const siblingChecks = []\n        let sibling = check\n        while (sibling) {\n          let status =  sibling.ui.checkbox.indeterminate ? 'indeterminate' : (sibling.ui.checkbox.checked ? 'checked' : 'unchecked')\n          siblingChecks.push(status)\n          sibling = sibling.nextSibling\n        }\n        sibling = check\n        do {\n          sibling = sibling.previousSibling\n          if (sibling) {\n            let status =  sibling.ui.checkbox.indeterminate ? 'indeterminate' : (sibling.ui.checkbox.checked ? 'checked' : 'unchecked')\n            siblingChecks.push(status)\n          }\n        } while (sibling)\n        const allChecked = siblingChecks.every(i => i === 'checked')\n        const someChecked = siblingChecks.some(i => i === 'checked')\n        const someUnchecked = siblingChecks.some(i => i === 'unchecked')\n        const someIndeterminate = siblingChecks.some(i => i === 'indeterminate')\n        parent.ui.checkbox.checked = allChecked\n        parent.attributes.checked = allChecked\n        parent.ui.checkbox.indeterminate = someIndeterminate || someChecked && someUnchecked\n      }\n      check = parent\n    }\n    this.fireEvent('checkstateschanged')\n  },\n  getChecked: function ( startNode ) {\n    startNode = startNode || this.assetsNode || this.root\n    var r = {}\n    var f = function(){\n        if (this === startNode) { \n          return true\n        }\n        if(this.ui?.checkbox?.checked && !this.ui?.checkbox?.indeterminate) {\n          if (!r[this.attributes.assetId]) {\n            r[this.attributes.assetId] = {\n              assetName: this.attributes.assetName,\n              benchmarkIds: []\n            }\n          }\n          if (this.attributes.benchmarkId) {\n            r[this.attributes.assetId].benchmarkIds.push(this.attributes.benchmarkId)\n            return true\n          }\n          else {\n            return false\n          }\n        }\n        else if (!this.ui?.checkbox?.checked && !this.ui?.checkbox?.indeterminate) {\n          return false\n        }\n    }\n    startNode.cascade(f)\n    return r\n  },\n  getCheckedForStreaming: function ( startNode ) {\n    startNode = startNode || this.assetsNode || this.root\n    var r = {}\n    var f = function(){\n        if (this === startNode) { \n          return true\n        }\n        const assetId = this.attributes.assetId\n        const benchmarkId = this.attributes.benchmarkId\n        if(this.ui?.checkbox?.checked && !this.ui?.checkbox?.indeterminate) {\n          if (!r[assetId]) {\n            r[assetId] = { assetId }\n          }\n          if (benchmarkId) {\n            r[assetId].stigs = r[assetId].stigs || []\n            r[assetId].stigs.push(benchmarkId)\n            return true\n          }\n          else {\n            return false\n          }\n        }\n        else if (!this.ui?.checkbox?.checked && !this.ui?.checkbox?.indeterminate) {\n          return false\n        }\n    }\n    startNode.cascade(f)\n    return Object.values(r)\n  }\n})\n\nSM.Exports.StigTree = Ext.extend(Ext.tree.TreePanel, {\n  initComponent: function () {\n    let me = this\n    let collectionId = this.collectionId\n    let config = {\n      layout: 'fit',\n      autoScroll: true,\n      bodyStyle: 'padding:5px;',\n      minSize: 220,\n      root: {\n        nodeType: 'async',\n        id: `${collectionId}-assignment-root`,\n        checked: false,\n        expanded: true\n      },\n      rootVisible: false,\n      loader: new Ext.tree.TreeLoader({\n        directFn: me.loadTree,\n        preloadChildren: true\n      }),\n      loadMask: 'Loading...',\n      listeners: {\n        checkchange: me.onCheckChange\n      }\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.Exports.StigTree.superclass.initComponent.call(this)\n  },\n  loadTree: async function (node, cb) {\n    try {\n      let match, collectionGrant\n      // Root node\n      match = node.match(/^(\\d+)-assignment-root$/)\n      if (match) {\n        let collectionId = match[1]\n        let content = [\n          {\n            id: `${collectionId}-assignment-stigs-node`,\n            node: 'stigs',\n            text: '<span style=\"font-weight: 600;\">All STIGs</span>',\n            checked: true,\n            expanded: true,\n            iconCls: 'sm-stig-icon'\n          }\n        ]\n        cb(content, { status: true })\n        return\n      }\n\n      // Collection-STIGs node\n      match = node.match(/^(\\d+)-assignment-stigs-node$/)\n      if (match) {\n        let collectionId = match[1]\n        const gridStigs = this.getOwnerTree().data\n        const apiMetrics = await Ext.Ajax.requestPromise({\n          responseType: 'json',\n          url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/metrics/summary`,\n          method: 'GET',\n          params: {\n            benchmarkId: gridStigs.map( r => r.benchmarkId )\n          }\n        })\n        let benchmarkStatus = {}\n        for (const item of apiMetrics) {\n          if (!benchmarkStatus[item.benchmarkId]) {\n            benchmarkStatus[item.benchmarkId] = []\n          }\n          benchmarkStatus[item.benchmarkId].push(item)\n        }\n\n        let stigNodes = []\n        for (const stig of gridStigs) {\n          // const badgePercent = Math.round((stig.acceptedCount / (stig.ruleCount * stig.assetCount)) * 100)\n          const badgePercent = Math.round(stig.acceptedPct)\n          const badgeClass = badgePercent === 100 ? 'sm-export-sprite-low' : badgePercent >= 50 ? 'sm-export-sprite-medium' : 'sm-export-sprite-high'\n          let stigNode = {\n            id: `${collectionId}-${stig.benchmarkId}-assignment-stigs-stig-node`,\n            text: `${SM.he(stig.benchmarkId)} <span class=\"sm-export-sprite ${badgeClass}\">${badgePercent}%</span>`,\n            node: 'stig',\n            collectionId: collectionId,\n            benchmarkId: stig.benchmarkId,\n            iconCls: 'sm-stig-icon',\n            checked: !!this.ui.checkbox.checked,\n            qtip: SM.he(stig.title)\n          }\n          let assetNodes = []\n          for (const item of benchmarkStatus[stig.benchmarkId]) {\n            const badgePercent = Math.round((item.metrics.statuses.accepted / item.metrics.assessments) * 100)\n            const badgeClass = badgePercent === 100 ? 'sm-export-sprite-low' : badgePercent >= 50 ? 'sm-export-sprite-medium' : 'sm-export-sprite-high'\n            assetNodes.push({\n              id: `${collectionId}-${item.benchmarkId}-${item.assetId}-assignment-leaf`,\n              text: `${SM.he(item.name)} <span class=\"sm-export-sprite ${badgeClass}\">${badgePercent}%</span>`,\n              leaf: true,\n              node: 'stig-asset',\n              iconCls: 'sm-asset-icon',\n              stigName: item.benchmarkId,\n              assetName: item.name,\n              assetId: item.assetId,\n              collectionId: collectionId,\n              benchmarkId: item.benchmarkId,\n              checked: !!this.ui.checkbox.checked,\n            })\n          }\n          stigNode.children = assetNodes\n          stigNodes.push(stigNode)\n        }\n        this.getOwnerTree().stigsNode = this\n        cb(stigNodes, { status: true })\n\n        const doPreload = function () {\n          this.getOwnerTree().loader.doPreload(this)\n          this.renderChildren()\n        }\n        this.cascade(doPreload)\n        this.getOwnerTree().fireEvent('treeloaded')\n        return\n      }\n    }\n    catch (e) {\n      SM.Error.handleError(e)\n    }\n  },\n  onCheckChange: function (node, checked) {\n    const checkDescendents = function (node) {\n      for (const child of node.childNodes) {\n        child.ui.checkbox.checked = checked\n        child.attributes.checked = checked\n        child.ui.checkbox.indeterminate = false\n        checkDescendents(child)\n      }\n    }\n\n    // check/uncheck descendents\n    checkDescendents(node)\n\n    // traverse up from node\n    // TODO: This will check parent if all children are indeterminate?\n    let check = node\n    while (check) {\n      // find parent and siblings\n      const parent = check.parentNode\n      if (parent?.ui?.checkbox) { // root node won't have checkbox\n        const siblingChecks = []\n        let sibling = check\n        while (sibling) {\n          let status =  sibling.ui.checkbox.indeterminate ? 'indeterminate' : (sibling.ui.checkbox.checked ? 'checked' : 'unchecked')\n          siblingChecks.push(status)\n          sibling = sibling.nextSibling\n        }\n        sibling = check\n        do {\n          sibling = sibling.previousSibling\n          if (sibling) {\n            let status =  sibling.ui.checkbox.indeterminate ? 'indeterminate' : (sibling.ui.checkbox.checked ? 'checked' : 'unchecked')\n            siblingChecks.push(status)\n          }\n        } while (sibling)\n        const allChecked = siblingChecks.every(i => i === 'checked')\n        const someChecked = siblingChecks.some(i => i === 'checked')\n        const someUnchecked = siblingChecks.some(i => i === 'unchecked')\n        const someIndeterminate = siblingChecks.some(i => i === 'indeterminate')\n        parent.ui.checkbox.checked = allChecked\n        parent.attributes.checked = allChecked\n        parent.ui.checkbox.indeterminate = someIndeterminate || someChecked && someUnchecked\n      }\n      check = parent\n    }\n    this.fireEvent('checkstateschanged')\n  },\n  getCheckedForStreaming: function ( startNode ) {\n    startNode = startNode || this.stigsNode || this.root\n    var r = {}\n    var f = function(){\n        if (this === startNode) { \n          return true\n        }\n        if (!this.attributes.assetId) {\n          return true\n        }\n        if(this.ui?.checkbox?.checked && !this.ui?.checkbox?.indeterminate) {\n          if (!r[this.attributes.assetId]) {\n            r[this.attributes.assetId] = {\n              assetId: this.attributes.assetId\n            }\n          }\n          if (this.attributes.benchmarkId) {\n            r[this.attributes.assetId].stigs = r[this.attributes.assetId].stigs || []\n            r[this.attributes.assetId].stigs.push(this.attributes.benchmarkId)\n            return true\n          }\n          else {\n            return false\n          }\n        }\n        else if (!this.ui?.checkbox?.checked && !this.ui?.checkbox?.indeterminate) {\n          return false\n        }\n    }\n    startNode.cascade(f)\n    return Object.values(r)\n  },\n  getChecked: function ( startNode ) {\n    startNode = startNode || this.stigsNode || this.root\n    var r = {}\n    var f = function(){\n        if (this === startNode) { \n          return true\n        }\n        if (!this.attributes.assetId) {\n          return true\n        }\n        if(this.ui?.checkbox?.checked && !this.ui?.checkbox?.indeterminate) {\n          if (!r[this.attributes.assetId]) {\n            r[this.attributes.assetId] = {\n              assetName: this.attributes.assetName,\n              benchmarkIds: []\n            }\n          }\n          if (this.attributes.benchmarkId) {\n            r[this.attributes.assetId].benchmarkIds.push(this.attributes.benchmarkId)\n            return true\n          }\n          else {\n            return false\n          }\n        }\n        else if (!this.ui?.checkbox?.checked && !this.ui?.checkbox?.indeterminate) {\n          return false\n        }\n    }\n    startNode.cascade(f)\n    return r\n  }\n})\n\nSM.Exports.showExportTree = async function (collectionId, collectionName, treebase = 'asset', data) {\n  try {\n    let fpwindow\n    // const maxExportToCollection = STIGMAN.apiDefinition.paths['/collections/{collectionId}/export-to/{dstCollectionId}'].post.requestBody.content['application/json'].schema.maxItems\n    const {minItems, maxItems} = STIGMAN.apiDefinition.paths['/collections/{collectionId}/export-to/{dstCollectionId}'].post.requestBody.content['application/json'].schema\n    const dstCollectionData = curUser.collectionGrants\n    .filter(grant => grant.roleId >= 3 && grant.collection.collectionId != collectionId)\n    .map(grant => [grant.collection.name, grant.collection.collectionId])\n    \n    const initialState = getInitialOptions(dstCollectionData)\n    const zipRadio = new SM.Global.HelperRadio({\n      boxLabel: 'Zip archive',\n      name: 'exportTo',\n      exportTo: 'zip',\n      itemField: 'asset',\n      checked: initialState.exportTo === 'zip',\n      helpText: SM.TipContent.ExportOptions.ZipArchive\n    })\n    const collectionRadio = new SM.Global.HelperRadio({\n      boxLabel: `Collection`,\n      disabled: !(initialState.exportCollectionId),\n      name: 'exportTo',\n      exportTo: 'collection',\n      checked: initialState.exportTo === 'collection',\n      helpTpl: SM.TipContent.ExportOptions.CollectionTpl,\n      helpData: {minItems, maxItems}\n    })\n    const exportToRadioGroup = new Ext.form.RadioGroup({\n      fieldLabel: 'Export to',\n      style: 'padding-top: 1px',\n      columns: [100, 100],\n      items: [\n        zipRadio,\n        collectionRadio\n      ],\n      listeners: {\n        change: function (rg, checkedItem) {\n          if (checkedItem.exportTo === 'zip') {\n            collectionComboBox.hide()\n            formatComboBox.show()\n          }\n          else {\n            collectionComboBox.show()\n            formatComboBox.hide()\n          }\n          checkStateHandler()\n        }\n      }\n    })\n\n    const collectionComboBox = new Ext.form.ComboBox({\n      mode: 'local',\n      width: 160,\n      hidden: initialState.exportTo === 'zip',\n      fieldLabel: \"Destination\",\n      forceSelection: true,\n      autoSelect: true,\n      editable: false,\n      store: new Ext.data.SimpleStore({\n        fields: ['displayStr', 'valueStr'],\n        data: dstCollectionData\n      }),\n      valueField:'valueStr',\n      displayField:'displayStr',\n      value: initialState.exportCollectionId,\n      monitorValid: false,\n      triggerAction: 'all',\n    })\n\n    const formatComboBox = new Ext.form.ComboBox({\n      mode: 'local',\n      width: 110,\n      fieldLabel: \"Format\",\n      hidden: initialState.exportTo === 'collection',\n      forceSelection: true,\n      autoSelect: true,\n      editable: false,\n      store: new Ext.data.SimpleStore({\n        fields: ['displayStr', 'valueStr'],\n        data: [\n          ['CKL', 'ckl-mono'],\n          ['CKL (multi-STIG)', 'ckl-multi'],\n          ['CKLB', 'cklb-mono'],\n          ['CKLB (multi-STIG)', 'cklb-multi'],\n          ['XCCDF', 'xccdf']\n        ]\n      }),\n      valueField:'valueStr',\n      displayField:'displayStr',\n      value: initialState.exportFormat,\n      monitorValid: false,\n      triggerAction: 'all',\n    })\n\n    const exportButton = new Ext.Button({\n      text: 'Loading...',\n      iconCls: 'sm-export-icon',\n      disabled: true,\n      handler: function () {\n        saveOptions()\n        const checklists = navTree.getCheckedForStreaming()\n        if (exportToRadioGroup.getValue().exportTo === 'collection') {\n          const dstCollectionId  = collectionComboBox.getValue()\n          const dstCollectionName = collectionComboBox.findRecord.call(collectionComboBox, 'valueStr', dstCollectionId).data.displayStr\n          SM.Exports.exportToCollection({\n            collectionId,\n            dstCollectionId,\n            dstCollectionName,\n            checklists\n          })\n          fpwindow.close()\n        }\n        else {\n          fpwindow.close()\n          SM.Exports.exportArchiveStreaming({\n            collectionId,\n            checklists, \n            format: formatComboBox.getValue()\n          })\n        }\n      }\n    })\n    function checkStateHandler() {\n      const assetCount = Object.keys(navTree.getCheckedForStreaming()).length\n      let btnText = 'Export'\n      if (assetCount < minItems || (assetCount > maxItems && collectionRadio.checked)) {\n        btnText = assetCount < minItems ? `Assets < ${minItems}` : `Assets > ${maxItems}`\n        exportButton.disable()\n        exportButton.setIconClass('sm-alert-icon')\n      }\n      else {\n        exportButton.enable()\n        exportButton.setIconClass('sm-export-icon')\n      }\n      exportButton.setText(btnText)\n    }\n    function navTreeClick(node, e) {\n      const one = 1\n    }\n    const treeConfig = {\n      panel: this,\n      width: 400,\n      flex: 1,\n      collectionId,\n      data,\n      selModel: new Ext.tree.MultiSelectionModel(),\n      listeners: {\n        checkstateschanged: checkStateHandler\n      }\n    }\n    \n    const navTree = treebase === 'asset' ? new SM.Exports.AssetTree(treeConfig) : new SM.Exports.StigTree(treeConfig)\n    navTree.on('treeloaded', checkStateHandler)\n    navTree.on('beforeclick', navTreeClick)\n    /******************************************************/\n    // Form window\n    /******************************************************/\n    fpwindow = new Ext.Window({\n      title: 'Export results',\n      cls: 'sm-dialog-window sm-round-panel',\n      modal: true,\n      hidden: true,\n      width: 460,\n      height: 600,\n      layout: 'vbox',\n      layoutConfig: {\n          align: 'stretch',\n          pack: 'start',\n          padding: '0 10 10 10',\n      },\n      plain: true,\n      bodyStyle: 'padding:5px 5px 0 5px;',\n      buttonAlign: 'left',\n      items: [\n        {\n          html: `<div class=\"sm-dialog-panel-title\">Select Assets and STIGs</div>\n          <div class=\"sm-dialog-panel-text\">Badges: \n            <span class=\"sm-export-sprite sm-export-sprite-high\">Accepted: &lt; 100%</span>\n            <span class=\"sm-export-sprite sm-export-sprite-low\">Accepted: 100%</span>\n          </div>`,\n          border: false\n        },\n        navTree\n      ],\n      listeners: {\n        minimize: function() {\n          const offset = 20\n          fpwindow.mask.hide()\n          const vpSize = Ext.getCmp('app-viewport').getSize()\n          fpwindow.setPosition(vpSize.width - fpwindow.getWidth()- offset, vpSize.height - fpwindow.getHeight() - offset)\n          fpwindow.minimized = true\n        }\n      },\n      fbar: [\n        { \n          xtype: 'form',\n          labelWidth: 75,\n          bodyStyle: 'padding:0 5px 0 15px;',\n          border: false,\n          items: [\n            exportToRadioGroup,\n            formatComboBox,\n            collectionComboBox\n          ]\n        },\n        '->',\n        exportButton\n      ]\n    })\n    fpwindow.render(Ext.getBody())\n    fpwindow.show(Ext.getBody())\n\n    // functions\n    function getInitialOptions (dstCollectionData) {\n      // default options\n      let state = {\n        exportTo: 'zip',\n        exportFormat: 'ckl-mono',\n      }\n      // merge saved options\n      const storage = SM.safeJSONParse(localStorage.getItem(`exportTo-${collectionId}`))\n      if (storage) {\n         state = {...state, ...storage}\n      }\n      state.exportCollectionId = dstCollectionData.map(data => data[1]).includes(state.exportCollectionId) ? \n        state.exportCollectionId : dstCollectionData[0]?.[1]\n      state.exportTo = state.exportTo === 'collection' && dstCollectionData.length ? 'collection' : 'zip'\n      return state\n    }\n\n    function saveOptions() {\n      const state = {\n        exportTo: zipRadio.checked ? 'zip' : 'collection',\n        exportFormat: formatComboBox.getValue(),\n        exportCollectionId: collectionComboBox.getValue()\n      }\n      localStorage.setItem(`exportTo-${collectionId}`, JSON.stringify(state))\n    }\n\n  }\n  catch (e) {\n    Ext.getBody().unmask()\n    SM.Error.handleError(e)\n  }\n}\n\nSM.Exports.exportArchiveStreaming = async function ({collectionId, checklists, format = 'ckl-mono'}) {\n\n  function formatBytes(a, b = 2, k = 1024) { \n    const d = Math.floor(Math.log(a) / Math.log(k));\n    return 0 == a ? \"0 Bytes\" : (a / Math.pow(k, d)).toFixed(b) + \" \" + [\"Bytes\", \"KB\", \"MB\", \"GB\", \"TB\", \"PB\", \"EB\", \"ZB\", \"YB\"][d] \n  }\n\n  const url = {\n    xccdf: `${STIGMAN.Env.apiBase}/collections/${collectionId}/archive/xccdf`,\n    'ckl-multi': `${STIGMAN.Env.apiBase}/collections/${collectionId}/archive/ckl?mode=multi`,\n    'ckl-mono': `${STIGMAN.Env.apiBase}/collections/${collectionId}/archive/ckl?mode=mono`,\n    'cklb-multi': `${STIGMAN.Env.apiBase}/collections/${collectionId}/archive/cklb?mode=multi`,\n    'cklb-mono': `${STIGMAN.Env.apiBase}/collections/${collectionId}/archive/cklb?mode=mono`\n  }\n\n  try {\n    \n    const fetchInit = {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        'Authorization': `Bearer ${window.oidcWorker.token}`\n      },\n      body: JSON.stringify(checklists)     \n    }\n    const href = await SM.ServiceWorker.getDownloadUrl({ url: url[format], ...fetchInit })\n    if (href) {\n      window.location = href\n      return\n    }\n\n    // The fallback code below only executes if the service worker is broken, which probably means we have bigger issues\n    let response = await fetch(url[format], fetchInit)\n    const contentDisposition = response.headers.get(\"content-disposition\")\n    if (!response.ok) {\n      const body = await response.text()\n      throw new Error(`Request failed with status ${response.status}\\n${body}`)\n    }\n    if (!contentDisposition) {\n      throw new Error(`No Content-Disposition header in Response`)\n    }\n    initProgress(\"Downloading checklists\", \"Initializing...\")\n    updateStatusText(`When the stream has finished you will be prompted to save the data to disk. The final size of the archive is unknown during streaming.`, true)\n    const filename = contentDisposition.match(/filename\\*?=['\"]?(?:UTF-\\d['\"]*)?([^\\r\\n\"']*)['\"]?;?/)[1]\n    const reader = response.body.getReader()\n    let receivedLength = 0; // received that many bytes at the moment\n    let chunks = []; // array of received binary chunks (comprises the body)\n    while(true) {\n      const {done, value} = await reader.read()\n      if (done) {\n        break\n      }\n      chunks.push(value)\n      receivedLength += value.length\n      updateProgress(0, `Fetched: ${formatBytes(receivedLength, 2)}`)\n    }\n    const blob = new Blob(chunks)\n    updateStatusText(`\\n\\nStreaming is complete.`, true)\n    saveAs(blob, filename)\n  }\n  catch (e) {\n    SM.Error.handleError(e)\n  }\n}\n\nSM.Exports.exportToCollection = async function ({collectionId, dstCollectionId, dstCollectionName, checklists, fpwindow}) {\n  try {\n    const progressPanel = new SM.CollectionClone.CloneProgressPanel()\n    const vpSize = Ext.getCmp('app-viewport').getSize()\n    const width = 420\n    const height = 80\n    const offset = 20\n    const fpwindow = new Ext.Window({\n      title: `Exporting to \"${dstCollectionName}\"`,\n      closable: true,\n      bodyStyle: 'padding:5px;',\n      layout: 'fit',\n      width,\n      height,\n      pageX: vpSize.width - width - offset,\n      pageY: vpSize.height - height - offset,\n      items: [progressPanel]\n    })\n    fpwindow.show()\n    fpwindow.getTool('close').hide()\n\n    progressPanel.pb.updateProgress(1, \"Sending request\")\n\n    const url = `${STIGMAN.Env.apiBase}/collections/${collectionId}/export-to/${dstCollectionId}`\n    \n    const fetchInit = {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        'Authorization': `Bearer ${window.oidcWorker.token}`\n      },\n      body: JSON.stringify(checklists)     \n    }\n    const response = await fetch(url, fetchInit)\n    if (!response.ok) {\n      const json = await response.json()\n      throw(new Error(`API responded with status ${response.status} ${JSON.stringify(json)}`))\n    }\n    const reader = response.body\n    .pipeThrough(new TextDecoderStream())\n    .pipeThrough(NDJSONStream())\n    .getReader()\n\n    let isDone = false\n    let isError = false\n    let haveResult = false\n    let apiCollection\n    const jsons = []\n    do {\n      const {value, done} = await reader.read()\n      isDone = done\n      if (value) {\n        jsons.push(value)\n        console.log(`chunk: ${JSON.stringify(value)}`)\n        if (value.stage === 'result') {\n          apiCollection = value.collection\n          haveResult = true\n        }\n        if (fpwindow.isDestroyed) return\n        if (value.status === 'error') {\n          if (value.message === 'Unhandled error') {\n            fpwindow.removeAll()\n            fpwindow.setTitle(`Error exporting to \"${dstCollectionName}\"`)\n            fpwindow.getTool('close').show()\n            const errorPanel = new SM.CollectionClone.CloneErrorPanel({\n              log: JSON.stringify(jsons, null, 2)\n            })\n            fpwindow.add(errorPanel)\n            fpwindow.doLayout()\n          }\n          else {\n            progressPanel.pb.updateProgress(1, value.message)\n            progressPanel.pb.addClass('sm-pb-error')\n            fpwindow.getTool('close').show()\n          }\n          isDone = true\n          isError = true\n        }\n        else if (value.stage === 'prepare' || value.stage === 'assets') {\n          const progress = (value.step-1)/value.stepCount\n          progressPanel.pb.updateProgress(progress, value.message)\n        }\n        else if (value.stage === 'reviews') {\n          const progress = value.reviewsExported/value.reviewsTotal\n          progressPanel.pb.updateProgress(progress, `Exporting reviews (${value.reviewsExported.toLocaleString()} of ${value.reviewsTotal.toLocaleString()})`)\n        }\n        else if (value.stage === 'metrics') {\n          const progress = value.metricsUpdated/value.metricsTotal\n          progressPanel.pb.updateProgress(progress, `Updating metrics (${value.metricsUpdated.toLocaleString()} of ${value.metricsTotal.toLocaleString()})`)\n        }\n        else if (value.stage === 'commit') {\n          progressPanel.pb.wait({\n            text: 'Committing',\n            animate: true,\n            interval: 100\n          })\n        }\n      }\n    } while (!isDone)\n\n    if (!fpwindow.isDestroyed && !isError) {\n      fpwindow.removeAll()\n      fpwindow.setTitle(`Export finished`)\n      fpwindow.add(new SM.CollectionClone.PostClonePanel({ \n        btnHandler: function (btn) {\n          const openMethod = btn.action === 'manage' ? addCollectionManager : SM.CollectionPanel.showCollectionTab\n          openMethod({\n            collectionId: dstCollectionId,\n            collectionName: dstCollectionName,\n            treePath: SM.Global.mainNavTree.getCollectionLeaf(dstCollectionId)?.getPath()\n          })\n          fpwindow.close()\n        }\n       }))\n      fpwindow.getTool('close').show()\n      fpwindow.doLayout()\n    }\n\n  }\n  catch (e) {\n    SM.Error.handleError(e)\n  }\n\n}\n\n\n\n\n"
  },
  {
    "path": "client/src/js/SM/FindingsPanel.js",
    "content": "Ext.ns('SM.Findings')\n\nSM.Findings.AggregatorCombo = Ext.extend(Ext.form.ComboBox, {\n\tinitComponent: function () {\n\t\tlet config = {\n\t\t\twidth: 70,\n\t\t\tforceSelection: true,\n\t\t\teditable: false,\n\t\t\tmode: 'local',\n\t\t\ttriggerAction: 'all',\n\t\t\tdisplayField: 'display',\n\t\t\tvalueField: 'aggregator',\n\t\t\tstore: new Ext.data.SimpleStore({\n\t\t\t\tfields: ['display', 'aggregator'],\n\t\t\t\tdata: [['Group', 'groupId'], ['Rule', 'ruleId'], ['CCI', 'cci']]\n\t\t\t})\n\t\t}\n\t\tExt.apply(this, Ext.apply(this.initialConfig, config))\n\t\tthis.superclass().initComponent.call(this)\n\t}\n})\nExt.reg('sm-aggregator-combo', SM.Findings.AggregatorCombo)\n\nSM.Findings.ParentGrid = Ext.extend(Ext.grid.GridPanel, {\n\tinitComponent: function () {\n\t\tlet me = this\n\t\tthis.aggValue = this.aggValue || 'groupId'\n\t\tthis.stigAllValue = '--- All Collection STIGs ---'\n\t\tthis.stigValue = this.stigValue || this.stigAllValue\n\t\tconst store = new Ext.data.JsonStore({\n\t\t\tproxy: new Ext.data.HttpProxy({\n\t\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${this.panel.collectionId}/findings`,\n\t\t\t\tmethod: 'GET'\n\t\t\t}),\n\t\t\tbaseParams: {\n\t\t\t\tprojection: 'stigs'\n\t\t\t},\n\t\t\tsortInfo: {\n\t\t\t\tfield: 'assetCount',\n\t\t\t\tdirection: 'DESC'\n\t\t\t},\n\t\t\troot: '',\n\t\t\tfields: [\n\t\t\t\t{ name: 'severity', type: 'string', sortType: sortSeverity },\n\t\t\t\t{ name: 'assetCount', type: 'int' },\n\t\t\t\t{ name: 'stigs' },\n\t\t\t\t{ name: 'groupId', type: 'string', sortType: sortGroupId },\n\t\t\t\t{ name: 'ruleId', type: 'string' },\n\t\t\t\t{ name: 'title', type: 'string' },\n\t\t\t\t{ name: 'cci', type: 'string' },\n\t\t\t\t{ name: 'definition', type: 'string' },\n\t\t\t\t{ name: 'apAcronym', type: 'string' },\n\t\t\t],\n\t\t\tlisteners: {\n\t\t\t\tload: function (store, records) {\n\t\t\t\t\tsetColumnStates(me.aggValue)\n\t\t\t\t\tme.statSprites?.setText(getStatSprites(store))\n\t\t\t\t},\n\t\t\t\tclear: function(){\n\t\t\t\t\tme.statSprites?.setText(getStatSprites(store))\n\t\t\t\t},\n\t\t\t\tupdate: function(store) {\n\t\t\t\t\tme.statSprites?.setText(getStatSprites(store))\n\t\t\t\t},\n\t\t\t\tdatachanged: function(store) {\n\t\t\t\t\tme.statSprites?.setText(getStatSprites(store))\n\t\t\t\t}\n\t\t\t}\n\t\t})\n\t\tconst totalTextCmp = new SM.RowCountTextItem({ store: store, noun: 'finding' })\n\t\tconst renderSeverity = (val) => {\n\t\t\tswitch (val) {\n\t\t\t\tcase 'high':\n\t\t\t\t\treturn '<span class=\"sm-grid-sprite sm-severity-high\">CAT 1</span>'\n\t\t\t\tcase 'medium':\n\t\t\t\t\treturn '<span class=\"sm-grid-sprite sm-severity-medium\">CAT 2</span>'\n\t\t\t\tcase 'low':\n\t\t\t\t\treturn '<span class=\"sm-grid-sprite sm-severity-low\">CAT 3</span>'\n\t\t\t\tcase 'mixed':\n\t\t\t\t\treturn '<span class=\"sm-grid-sprite sm-severity-low\">Mixed</span>'\n\t\t\t\tdefault:\n\t\t\t\t\treturn '<span class=\"sm-grid-sprite sm-severity-low\">U</span>'\n\t\t\t}\n\t\t}\n\t\tconst colModel = new Ext.grid.ColumnModel([\n\t\t\t{\n\t\t\t\theader: \"CAT\",\n\t\t\t\thidden: false,\n\t\t\t\talign: 'center',\n\t\t\t\twidth: 60,\n\t\t\t\tdataIndex: 'severity',\n\t\t\t\tsortable: true,\n\t\t\t\trenderer: renderSeverity,\n\t\t\t\tfilter: {\n\t\t\t\t\ttype: 'values',\n\t\t\t\t\tcomparer: SM.ColumnFilters.CompareFns.severity,\n\t\t\t\t\trenderer: SM.ColumnFilters.Renderers.severity\n\t\t\t\t}\n\t\t\t},\n\t\t\t{\n\t\t\t\theader: \"Group\",\n\t\t\t\thidden: false,\n\t\t\t\twidth: 80,\n\t\t\t\tdataIndex: 'groupId',\n\t\t\t\tsortable: true,\n\t\t\t\tfilter: { type: 'string' }\n\t\t\t},\n\t\t\t{\n\t\t\t\theader: \"Rule\",\n\t\t\t\thidden: true,\n\t\t\t\twidth: 80,\n\t\t\t\tdataIndex: 'ruleId',\n\t\t\t\tsortable: true,\n\t\t\t\tfilter: { type: 'string' }\n\t\t\t},\n\t\t\t{\n\t\t\t\theader: \"CCI\",\n\t\t\t\thidden: true,\n\t\t\t\twidth: 80,\n\t\t\t\tdataIndex: 'cci',\n\t\t\t\tsortable: true,\n\t\t\t\tfilter: { type: 'string' }\n\t\t\t},\n\t\t\t{\n\t\t\t\theader: \"AP Acronym\",\n\t\t\t\thidden: true,\n\t\t\t\twidth: 80,\n\t\t\t\tdataIndex: 'apAcronym',\n\t\t\t\tsortable: true,\n\t\t\t\tfilter: { type: 'string' }\n\t\t\t},\n\t\t\t{\n\t\t\t\theader: \"Title\",\n\t\t\t\thidden: false,\n\t\t\t\twidth: 270,\n\t\t\t\tdataIndex: 'title',\n\t\t\t\trenderer: columnWrap,\n\t\t\t\tsortable: true,\n\t\t\t\tfilter: { type: 'string' }\n\t\t\t},\n\t\t\t{\n\t\t\t\theader: \"Definition\",\n\t\t\t\thidden: true,\n\t\t\t\twidth: 135,\n\t\t\t\tdataIndex: 'definition',\n\t\t\t\trenderer: columnWrap,\n\t\t\t\tsortable: true,\n\t\t\t\tfilter: { type: 'string' }\n\t\t\t},\n\t\t\t{\n\t\t\t\theader: \"Assets\",\n\t\t\t\thidden: false,\n\t\t\t\twidth: 75,\n\t\t\t\talign: 'center',\n\t\t\t\tdataIndex: 'assetCount',\n\t\t\t\tsortable: true\n\t\t\t},\n\t\t\t{\n\t\t\t\theader: \"STIGs\",\n\t\t\t\thidden: false,\n\t\t\t\twidth: 120,\n\t\t\t\tdataIndex: 'stigs',\n\t\t\t\trenderer: function (v) {\n\t\t\t\t\tv = v.map(i=>i.benchmarkId).join('\\n')\n\t\t\t\t\treturn columnWrap.apply(this, arguments)\n\t\t\t\t},\n\t\t\t\tsortable: true,\n\t\t\t}\n\t\t])\n\t\tconst view = new SM.ColumnFilters.GridView({\n\t\t\tforceFit: true,\n\t\t\temptyText: 'No records found.',\n\t\t\tlisteners: {\n\t\t\t\tfilterschanged: function (view) {\n\t\t\t\t\tstore.filter(view.getFilterFns())\n\t\t\t\t}\n\t\t\t},\n\t\t})\n\t\tconst sm = new Ext.grid.RowSelectionModel({\n\t\t\tsingleSelect: true,\n\t\t\tlisteners: {\n\t\t\t\trowselect: (sm, index, record) => {\n\t\t\t\t\tme.panel.fireEvent('parentrowselect', sm, index, record)\n\t\t\t\t}\n\t\t\t}\n\t\t})\n\t\tconst tbar = new Ext.Toolbar({\n\t\t\titems: [\n\t\t\t\t{\n\t\t\t\t\txtype: 'tbtext',\n\t\t\t\t\ttext: 'Aggregator:'\n\t\t\t\t},\n\t\t\t\t' ', ' ', ' ',\n\t\t\t\t{\n\t\t\t\t\txtype: 'sm-aggregator-combo',\n\t\t\t\t\tvalue: this.aggValue,\n\t\t\t\t\tlisteners: {\n\t\t\t\t\t\tselect: function (f, r, i) {\n\t\t\t\t\t\t\tme.aggValue = f.getValue()\n\t\t\t\t\t\t\tme.fireEvent('aggregatorchanged', me.aggValue)\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t\t' ', ' ', ' ',\n\t\t\t\t{\n\t\t\t\t\txtype: 'tbtext',\n\t\t\t\t\ttext: 'STIG:  '\n\t\t\t\t},\n\t\t\t\t' ', ' ', ' ',\n\t\t\t\tnew SM.Manage.Stig.SelectionComboBox({\n\t\t\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${this.panel.collectionId}/stigs`,\n\t\t\t\t\tautoLoad: true,\n\t\t\t\t\tincludeAllItem: this.stigAllValue,\n\t\t\t\t\twidth: 250,\n\t\t\t\t\ttriggerAction: 'all',\n\t\t\t\t\tallowBlank: true,\n\t\t\t\t\teditable: false,\n\t\t\t\t\tforceSelection: true,\n\t\t\t\t\tvalue: this.stigValue,\n\t\t\t\t\tlisteners: {\n\t\t\t\t\t\tselect: function (f, r, i) {\n\t\t\t\t\t\t\tme.stigValue = f.getValue()\n\t\t\t\t\t\t\tme.fireEvent('stigchanged', me.stigValue)\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t})\n\t\t\t]\n\t\t})\n\t\tconst generatePoamBtn = new Ext.Button({\n\t\t\tparentGrid: me,\n\t\t\ticonCls: 'icon-excel',\n\t\t\ttext: 'Generate POA&M...',\n\t\t\thandler: this.genPoamBtnHandler\n\t\t})\n\t\tfunction getStatSprites (store) {\n\t\t\tconst stats = store.data.items.reduce((accumulator, currentValue) => {\n\t\t\t\tfor (const prop in accumulator) {\n\t\t\t\t\taccumulator[prop] += currentValue.data[prop]\n\t\t\t\t}\n\t\t\t\treturn accumulator\n\t\t\t}, {\n\t\t\t\tassetCount: 0\n\t\t\t})\n\t\t\tconst spriteGroups = []\n\t\t\tspriteGroups.push(`${stats.assetCount ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Total number of finding occurences\"><span style=\"color:grey;font-weight:bolder;\">Occurences </span>${stats.assetCount}</span>` : ''}`)\n\n\t\t\treturn spriteGroups.join('<span class=\"sm-xtb-sep\"></span>')\n\t\t}\n\n\t\tconst bbar = [\n\t\t\t{\n\t\t\t\txtype: 'tbbutton',\n\t\t\t\ticonCls: 'icon-refresh',\n\t\t\t\ttooltip: 'Reload this grid',\n\t\t\t\twidth: 20,\n\t\t\t\thandler: function (btn) {\n\t\t\t\t\tstore.reload()\n\t\t\t\t}\n\t\t\t},\n\t\t\t'-',\n\t\t\t{\n\t\t\t\txtype: 'exportbutton',\n\t\t\t\thasMenu: false,\n\t\t\t\tgridBasename: 'Findings',\n\t\t\t\tgridSource: me,\n\t\t\t\ticonCls: 'sm-export-icon',\n\t\t\t\ttext: 'CSV'\n\t\t\t},\n\t\t\t'-',\n\t\t\tgeneratePoamBtn,\n\t\t\t'->',\n\t\t\t{\n\t\t\t\txtype: 'tbtext',\n\t\t\t\tref: '../statSprites'\n\t\t\t},\n\t\t\t'-',\n\t\t\ttotalTextCmp\n\t\t]\n\t\t\n\t\tconst setColumnStates = (aggregator) => {\n\t\t\tconst colIndex = {}\n\t\t\tfor (const [i, v] of colModel.config.entries()) {\n\t\t\t\tcolIndex[v.dataIndex] = i\n\t\t\t}\n\t\t\t// colModel.suspendEvents(false)\n\t\t\tswitch (aggregator) {\n\t\t\t\tcase 'ruleId':\n\t\t\t\t\tcolModel.setHidden(colIndex.severity, false)\n\t\t\t\t\tcolModel.setHidden(colIndex.groupId, true)\n\t\t\t\t\tcolModel.setHidden(colIndex.ruleId, false)\n\t\t\t\t\tcolModel.setHidden(colIndex.cci, true)\n\t\t\t\t\tcolModel.setHidden(colIndex.apAcronym, true)\n\t\t\t\t\tcolModel.setHidden(colIndex.title, false)\n\t\t\t\t\tcolModel.setHidden(colIndex.definition, true)\n\t\t\t\t\tbreak\n\t\t\t\tcase 'groupId':\n\t\t\t\t\tcolModel.setHidden(colIndex.severity, false)\n\t\t\t\t\tcolModel.setHidden(colIndex.groupId, false)\n\t\t\t\t\tcolModel.setHidden(colIndex.ruleId, true)\n\t\t\t\t\tcolModel.setHidden(colIndex.cci, true)\n\t\t\t\t\tcolModel.setHidden(colIndex.apAcronym, true)\n\t\t\t\t\tcolModel.setHidden(colIndex.title, false)\n\t\t\t\t\tcolModel.setHidden(colIndex.definition, true)\n\t\t\t\t\tbreak\n\t\t\t\tcase 'cci':\n\t\t\t\t\tcolModel.setHidden(colIndex.severity, true)\n\t\t\t\t\tcolModel.setHidden(colIndex.groupId, true)\n\t\t\t\t\tcolModel.setHidden(colIndex.ruleId, true)\n\t\t\t\t\tcolModel.setHidden(colIndex.cci, false)\n\t\t\t\t\tcolModel.setHidden(colIndex.apAcronym, false)\n\t\t\t\t\tcolModel.setHidden(colIndex.title, true)\n\t\t\t\t\tcolModel.setHidden(colIndex.definition, false)\n\t\t\t\t\tbreak\n\t\t\t}\n\t\t\t// colModel.resumeEvents()\n\t\t\t// view.layout(true)\n\t\t}\n\t\tconst onAggregatorChanged = (aggregator) => {\n\t\t\tconst params = {\n\t\t\t\taggregator: aggregator\n\t\t\t}\n\t\t\tif (me.stigValue != me.stigAllValue) {\n\t\t\t\tparams.benchmarkId = me.stigValue\n\t\t\t}\n\t\t\tstore.load({\n\t\t\t\tparams: params\n\t\t\t})\n\t\t\tgeneratePoamBtn.setDisabled(aggregator === 'cci')\n\t\t}\n\t\tconst onStigChanged = (benchmarkId) => {\n\t\t\tconst params = {\n\t\t\t\taggregator: me.aggValue\n\t\t\t}\n\t\t\tif (benchmarkId != me.stigAllValue) {\n\t\t\t\tparams.benchmarkId = benchmarkId\n\t\t\t}\n\t\t\tstore.load({\n\t\t\t\tparams: params\n\t\t\t})\n\t\t}\n\n\t\tconst config = {\n\t\t\tloadMask: {msg: ''},\n\t\t\tstripeRows: true,\n\t\t\tstore,\n\t\t\tcolModel,\n\t\t\tview,\n\t\t\tsm,\n\t\t\ttbar,\n\t\t\tbbar,\n\t\t\tlisteners: {\n\t\t\t\taggregatorchanged: onAggregatorChanged,\n\t\t\t\tstigchanged: onStigChanged\n\t\t\t},\n\n\t\t}\n\t\tExt.apply(this, Ext.apply(this.initialConfig, config))\n\t\tthis.superclass().initComponent.call(this)\n\t}\n})\n\nSM.Findings.ChildGrid = Ext.extend(Ext.grid.GridPanel, {\n\tinitComponent: function () {\n\t\tconst me = this\n\t\tfunction engineResultConverter (v,r) {\n\t\t\treturn r.resultEngine ? \n\t\t\t\t(r.resultEngine.overrides?.length ? 'override' : 'engine') : \n\t\t\t\t(r.result ? 'manual' : '')\n\t\t}\n\t\tconst store = new Ext.data.JsonStore({\n\t\t\tproxy: new Ext.data.HttpProxy({\n\t\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${this.panel.collectionId}/reviews`,\n\t\t\t\tmethod: 'GET'\n\t\t\t}),\n\t\t\tbaseParams: {\n\t\t\t\tresult: 'fail',\n\t\t\t\tprojection: 'stigs'\n\t\t\t},\n\t\t\tsortInfo: {\n\t\t\t\tfield: 'assetName',\n\t\t\t\tdirection: 'ASC'\n\t\t\t},\n\t\t\troot: '',\n\t\t\tstoreId: Ext.id(),\n\t\t\tfields: [\n\t\t\t\t{ name: 'assetId', type: 'string' },\n\t\t\t\t{ name: 'assetName', type: 'string' },\n\t\t\t\t{ name: 'assetLabelIds' },\n\t\t\t\t{ name: 'stigs' },\n\t\t\t\t{ name: 'ruleId', type: 'string' },\n\t\t\t\t{ name: 'severity', type: 'string' },\n\t\t\t\t{ name: 'result', type: 'string' },\n\t\t\t\t{ name: 'detail', type: 'string' },\n\t\t\t\t{ name: 'comment', type: 'string' },\n\t\t\t\t'resultEngine',\n\t\t\t\t{\n\t\t\t\t\tname: 'engineResult',\n\t\t\t\t\tconvert: engineResultConverter\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tname: 'status',\n\t\t\t\t\ttype: 'string',\n\t\t\t\t\tmapping: 'status.label'\n\t\t\t\t},\n\t\t\t\t{ name: 'userId', type: 'string' },\n\t\t\t\t{ name: 'username', type: 'string' },\n\t\t\t\t{ name: 'ts', type: 'string' },\n\t\t\t\t{ name: 'reviewComplete', type: 'boolean' }\n\t\t\t],\n\t\t\tlisteners: {\n\t\t\t\tdatachanged: function(store) {\n\t\t\t\t\tme.statSprites?.setText(getStatSprites(store))\n\t\t\t\t}\n\t\t\t}\n\t\t})\n\t\tfunction getStatSprites (store) {\n\t\t\tconst stats = store.data.items.reduce((accumulator, currentValue) => {\n\t\t\t\tif (currentValue.data.engineResult) accumulator[currentValue.data.engineResult]++\n\t\t\t\tif (currentValue.data.status) accumulator[currentValue.data.status]++\n\t\t\t\treturn accumulator\n\t\t\t},{\n\t\t\t\tsaved: 0,\n\t\t\t\tsubmitted: 0,\n\t\t\t\trejected: 0,\n\t\t\t\taccepted: 0,\n\t\t\t\toverride: 0,\n\t\t\t\tmanual: 0,\n\t\t\t\tengine: 0\n\t\t\t})\n\t\t\tconst spriteGroups = []\n\t\t\tspriteGroups.push(\n\t\t\t\t[\n\t\t\t\t\t`${stats.manual ? `<span class=\"sm-review-sprite sm-engine-manual-icon\" ext:qtip=\"Manual\"> ${stats.manual}</span>` : ''}`,\n\t\t\t\t\t`${stats.engine ? `<span class=\"sm-review-sprite sm-engine-result-icon\" ext:qtip=\"Result engine\"> ${stats.engine}</span>` : ''}`,\n\t\t\t\t\t`${stats.override ? `<span class=\"sm-review-sprite sm-engine-override-icon\" ext:qtip=\"Overriden result engine\"> ${stats.override}</span>` : ''}`\n\t\t\t\t].filter(Boolean).join(' '))\n\t\n\t\t\tspriteGroups.push(\n\t\t\t\t[\n\t\t\t\t\t`${stats.saved ? `<span class=\"sm-review-sprite sm-review-sprite-stat-saved\" ext:qtip=\"Saved\"> ${stats.saved || '-'}</span>` : ''}`,\n\t\t\t\t\t`${stats.submitted ? `<span class=\"sm-review-sprite sm-review-sprite-stat-submitted\" ext:qtip=\"Submitted\"> ${stats.submitted}</span>` : ''}`,\n\t\t\t\t\t`${stats.rejected ? `<span class=\"sm-review-sprite sm-review-sprite-stat-rejected\" ext:qtip=\"Rejected\"> ${stats.rejected}</span>` : ''}`,\n\t\t\t\t\t`${stats.accepted ? `<span class=\"sm-review-sprite sm-review-sprite-stat-accepted\" ext:qtip=\"Accepted\"> ${stats.accepted}</span>` : ''}`\n\t\t\t\t].filter(Boolean).join(' '))\n\t\t\treturn spriteGroups.filter(Boolean).join('<span class=\"sm-xtb-sep\"></span>')\n\t\t\t}\n\n\t\tconst totalTextCmp = new SM.RowCountTextItem({ store: store, noun: 'occurrence' })\n\t\tconst expander = new Ext.ux.grid.RowExpander2({\n\t\t\tlazyRender: true,\n\t\t\ttpl: new Ext.XTemplate(\n\t\t\t\t'<b>Reviewer:</b> {[values.data.username]}</p>',\n\t\t\t\t'<tpl if=\"data.detail\">',\n\t\t\t\t'<p><b>Detail:</b> {[SM.TruncateRecordProperty(values, \"detail\")]}</p>',\n\t\t\t\t'</tpl>',\n\t\t\t\t'<tpl if=\"data.comment\">',\n\t\t\t\t'<p><b>Comment:</b> {[SM.TruncateRecordProperty(values, \"comment\")]}</p>',\n\t\t\t\t'</tpl>'\n\t\t\t\t)\n\t\t})\n\t\tconst columns = [\n\t\t\texpander,\n\t\t\t{\n\t\t\t\theader: \"Asset\",\n\t\t\t\twidth: 80,\n\t\t\t\tdataIndex: 'assetName',\n\t\t\t\tsortable: true,\n\t\t\t\tfilter: { type: 'string' }\n\t\t\t},\n\t\t\t{\n\t\t\t\theader: \"Labels\",\n\t\t\t\twidth: 120,\n\t\t\t\tdataIndex: 'assetLabelIds',\n\t\t\t\tsortable: false,\n\t\t\t\tfilter: {\n\t\t\t\t\ttype: 'multi-value',\n\t\t\t\t\tcollectionId: me.panel.collectionId,\n\t\t\t\t\tcomparer: function (a, b) {\n\t\t\t\t\t\treturn SM.ColumnFilters.CompareFns.labelIds(a, b, me.panel.collectionId)\n\t\t\t\t\t\t},      \t\t\t\t\t\n\t\t\t\t\trenderer: SM.ColumnFilters.Renderers.labels\n\t\t\t\t},\n\t\t\t\trenderer: function (value, metadata) {\n\t\t\t\t\tconst labels = []\n\t\t\t\t\tfor (const labelId of value) {\n\t\t\t\t\t\tconst label = SM.Cache.getCollectionLabel(me.panel.collectionId, labelId)\n\t\t\t\t\t\tif (label) labels.push(label)\n\t\t\t\t\t}\n\t\t\t\t\tlabels.sort((a, b) => a.name.localeCompare(b.name))\n\t\t\t\t\tmetadata.attr = 'style=\"white-space:normal;\"'\n\t\t\t\t\treturn SM.Manage.Collection.LabelArrayTpl.apply(labels)\n\t\t\t\t}\n\t\t\t},\n\t\t\t{\n\t\t\t\theader: \"Rule\",\n\t\t\t\twidth: 80,\n\t\t\t\tdataIndex: 'ruleId',\n\t\t\t\tsortable: true,\n\t\t\t\tfilter: { type: 'string' }\n\t\t\t},\n\t\t\t{\n\t\t\t\theader: \"Last changed\",\n\t\t\t\twidth: 80,\n\t\t\t\tdataIndex: 'ts',\n\t\t\t\tsortable: true,\n\t\t\t},\n\t\t\t{\n\t\t\t\theader: \"STIGs\",\n\t\t\t\twidth: 130,\n\t\t\t\tdataIndex: 'stigs',\n\t\t\t\trenderer: function (v) {\n\t\t\t\t\tv = v.map(i=>i.benchmarkId).join('\\n')\n\t\t\t\t\treturn columnWrap.apply(this, arguments)\n\t\t\t\t},\n\t\t\t\tsortable: true,\n\t\t\t},\n\t\t\t{\n        header: '<div exportvalue=\"Engine\" class=\"sm-engine-result-icon\"></div>',\n        width: 24,\n        fixed: true,\n        dataIndex: 'engineResult',\n        sortable: true,\n        renderer: renderEngineResult,\n        filter: {\n          type: 'values',\n          renderer: SM.ColumnFilters.Renderers.engineResult\n        } \n      },\n      { \t\n\t\t\t\theader: \"Status\", \n\t\t\t\twidth: 50,\n\t\t\t\tfixed: true,\n        align: 'center',\n\t\t\t\tdataIndex: 'status',\n\t\t\t\tsortable: true,\n\t\t\t\trenderer: function (val, metaData, record, rowIndex, colIndex, store) {\n          return renderStatuses(val, metaData, record, rowIndex, colIndex, store)\n        },\n        filter: {\n          type: 'values',\n          renderer: SM.ColumnFilters.Renderers.status\n        }\n\t\t\t},\n\t\t]\n\t\tconst view = new SM.ColumnFilters.GridView({\n\t\t\tforceFit: true,\n\t\t\temptyText: 'Select a finding from the grid to the left.',\n\t\t\tdeferEmptyText: false,\n\t\t\tlisteners: {\n\t\t\t\tfilterschanged: function (view, item, value) {\n\t\t\t\t\tstore.filter(view.getFilterFns())\n\t\t\t\t}\n\t\t\t}\n\t\t})\n\t\tconst sm = new Ext.grid.RowSelectionModel({\n\t\t\tsingleSelect: true\n\t\t})\n\t\tconst bbar = [\n\t\t\t{\n\t\t\t\txtype: 'tbbutton',\n\t\t\t\ticonCls: 'icon-refresh',\n\t\t\t\ttooltip: 'Reload this grid',\n\t\t\t\twidth: 20,\n\t\t\t\thandler: function (btn) {\n\t\t\t\t\tstore.reload()\n\t\t\t\t}\n\t\t\t},\n\t\t\t'-',\n\t\t\t{\n\t\t\t\txtype: 'exportbutton',\n\t\t\t\thasMenu: false,\n\t\t\t\tgridBasename: 'Finding Details',\n\t\t\t\tgridSource: me,\n\t\t\t\ticonCls: 'sm-export-icon',\n\t\t\t\ttext: 'CSV'\n\t\t\t},\n\t\t\t'->',\n\t\t\t{\n\t\t\t\txtype: 'tbtext',\n\t\t\t\tref: '../statSprites'\n\t\t\t},\n\t\t\t'-',\n\t\t\ttotalTextCmp\n\t\t]\n\n\n\t\tconst config = {\n\t\t\tloadMask: {msg: ''},\n\t\t\tstripeRows: true,\n\t\t\tplugins: expander,\n\t\t\tstore,\n\t\t\tcolumns,\n\t\t\tview,\n\t\t\tsm,\n\t\t\tbbar\n\t\t}\n\t\tExt.apply(this, Ext.apply(this.initialConfig, config))\n\t\tthis.superclass().initComponent.call(this)\n\t}\n})\n\nSM.Findings.PoamStatusComboBox = Ext.extend(Ext.form.ComboBox, {\n\tinitComponent: function () {\n\t\tlet config = {\n\t\t\tdisplayField: 'display',\n\t\t\tvalueField: 'value',\n\t\t\ttriggerAction: 'all',\n\t\t\tmode: 'local',\n\t\t\teditable: false\n\t\t}\n\t\tlet me = this\n\t\tlet data = [\n\t\t\t['Ongoing', 'Ongoing'],\n\t\t\t['Completed', 'Completed']\n\t\t]\n\t\tthis.store = new Ext.data.SimpleStore({\n\t\t\tfields: ['value', 'display']\n\t\t})\n\t\tthis.store.on('load', function (store) {\n\t\t\tme.setValue(store.getAt(0).get('value'))\n\t\t})\n\n\t\tExt.apply(this, Ext.apply(this.initialConfig, config))\n\t\tthis.superclass().initComponent.call(this)\n\n\t\tthis.store.loadData(data)\n\t}\n})\n\nSM.Findings.PoamFormatComboBox = Ext.extend(Ext.form.ComboBox, {\n\tinitComponent: function () {\n\t\tlet config = {\n\t\t\tdisplayField: 'display',\n\t\t\tvalueField: 'value',\n\t\t\ttriggerAction: 'all',\n\t\t\tmode: 'local',\n\t\t\teditable: false\n\t\t}\n\t\tlet me = this\n\t\tlet data = [\n\t\t\t['EMASS', 'EMASS'],\n\t\t\t['MCCAST', 'MCCAST']\n\t\t]\n\t\tthis.store = new Ext.data.SimpleStore({\n\t\t\tfields: ['value', 'display']\n\t\t})\n\t\tthis.store.on('load', function (store) {\n\t\t\tme.setValue(store.getAt(0).get('value'))\n\t\t})\n\n\t\tExt.apply(this, Ext.apply(this.initialConfig, config))\n\t\tthis.superclass().initComponent.call(this)\n\n\t\tthis.store.loadData(data)\n\t}\n})\n\nSM.Findings.PoamOptionsPanel = Ext.extend(Ext.FormPanel, {\n\tinitComponent: function () {\n\t\tconst me = this\n\t\t// Set default date 30 days from now\n\t\tconst defaultDate = new Date()\n\t\tdefaultDate.setDate(defaultDate.getDate() + 30)\n\n\t\tconst dateField = new Ext.form.DateField({\n\t\t\tname: 'date',\n\t\t\tanchor: '100%',\n\t\t\thideLabel: true,\n\t\t\tvalue: defaultDate\n\t\t})\n\n\t\tconst statusCombo = new SM.Findings.PoamStatusComboBox({\n\t\t\tanchor: '100%',\n\t\t\thideLabel: true,\n\t\t\tname: 'status',\n\t\t\tref: 'statusCombo'\n\t\t})\n\n\t\tconst setFormatDisplay = function (format) {\n\t\t\t// Toggle visibility of FieldSets based on selection\n\t\t\tconst generatePoamWindow = me.ownerCt\n\t\t\tformatCombo.setValue(format)\n\n\t\t\tif (format === 'MCCAST') {\n\t\t\t\tgeneratePoamWindow.setHeight(460)\n\t\t\t\tstatusCombo.store.loadData([\n\t\t\t\t\t['Started','Started'],\n\t\t\t\t\t['Not Started','Not Started'],\n\t\t\t\t\t['Request Risk Acceptance','Request Risk Acceptance']\n\t\t\t\t])\n\t\t\t\tofficeFieldSet.setVisible(false)\n\t\t\t\tmccastPackageIdFieldSet.setVisible(true)\n\t\t\t\tmccastAuthNameFieldSet.setVisible(true)\n\t\t}\n\t\t//EMASS or OTHER MODE\n\t\telse {\n\t\t\t\tgeneratePoamWindow.setHeight(390)\n\t\t\t\tstatusCombo.store.loadData([\n\t\t\t\t\t['Ongoing','Ongoing'],\n\t\t\t\t\t['Completed','Completed']\n\t\t\t\t])\n\t\t\t\tofficeFieldSet.setVisible(true)\n\t\t\t\tmccastPackageIdFieldSet.setVisible(false)\n\t\t\t\tmccastAuthNameFieldSet.setVisible(false)\n\t\t\t}\n\t\t}\n\n\t\tconst formatCombo = new SM.Findings.PoamFormatComboBox(\t\t\t\t\t{\n\t\t\tanchor: '100%',\n\t\t\thideLabel: true,\n\t\t\tname: 'format',\n\t\t\tvalue: 'EMASS',\n\t\t\tlisteners: {\n\t\t\t\tselect:  (combo, record) => {\n\t\t\t\t\tsetFormatDisplay(record.data.value)\n\t\t\t\t}\n\t\t\t}\n\t\t})\n\n\t\tconst officeFieldSet = new Ext.form.FieldSet({\n\t\t\ttitle: 'Office/Org',\n\t\t\titems: [{\n\t\t\t\txtype: 'textfield',\n\t\t\t\tanchor: '100%',\n\t\t\t\thideLabel: true,\n\t\t\t\tname: 'office',\n\t\t\t\tvalue: 'My Office Info'\n\t\t\t}]\n\t\t})\n\n\t\tconst mccastPackageIdFieldSet = new Ext.form.FieldSet({\n\t\t\ttitle: 'Package ID',\n\t\t\thidden:true,\n\t\t\titems: [{\n\t\t\t\tname: 'mccastPackageId',\n\t\t\t\txtype: 'textfield',\n\t\t\t\tanchor: '100%',\n\t\t\t\thideLabel: true,\n\t\t\t\tvalue: 'Package ID',\n\t\t\t}]\n\t\t})\n\n\t\tconst mccastAuthNameFieldSet = new Ext.form.FieldSet({\n\t\t\ttitle: 'Authorization Package Name',\n\t\t\thidden:true,\n\t\t\titems: [{\n\t\t\t\t\tname: 'mccastAuthName',\n\t\t\t\t\txtype: 'textfield',\n\t\t\t\t\tanchor: '100%',\n\t\t\t\t\thideLabel: true,\n\t\t\t\t\tvalue: 'Authorization Package Name'\n\t\t\t}]\n\t\t})\n\n\t\tconst items = [\n\t\t\t{\n\t\t\t\txtype: 'fieldset',\n\t\t\t\ttitle: 'Format',\n\t\t\t\titems: [formatCombo]\n\t\t\t},\n\t\t\t{\n\t\t\t\txtype: 'fieldset',\n\t\t\t\ttitle: 'Scheduled Completion Date',\n\t\t\t\titems: [dateField]\n\t\t\t},\n\t\t\tofficeFieldSet,\n\t\t\t{\n\t\t\t\txtype: 'fieldset',\n\t\t\t\ttitle: 'Status',\n\t\t\t\titems: [statusCombo]\n\t\t\t},\n\t\t\tmccastPackageIdFieldSet,\n\t\t\tmccastAuthNameFieldSet\n\t\t]\n\n\t\tconst config = {\n\t\t\tbaseCls: 'x-plain',\n\t\t\tlabelWidth: 70,\n\t\t\tmonitorValid: true,\n\t\t\ttrackResetOnLoad: true,\n\t\t\titems,\n\t\t\tbuttons: [{\n\t\t\t\tanchor:'100%',\n\t\t\t\ttext: this.btnText || 'Generate',\n\t\t\t\ticonCls: 'icon-excel',\n\t\t\t\theight: 30,\n\t\t\t\twidth: 120,\n\t\t\t\tparentPanel: me,\n\t\t\t\tformBind: true,\n\t\t\t\thandler: this.btnHandler || function () { }\n\t\t\t}],\n\t\t\tsetFormatDisplay\n\t\t}\n\t\tExt.apply(this, Ext.apply(this.initialConfig, config))\n\t\tthis.superclass().initComponent.call(this)\n\t}\n})\n\nSM.Findings.RequestAndServePoam = async function (collectionId, params) {\n\tlet mb\n\ttry {\n\t\tmb = Ext.MessageBox.wait('Generating POA&M')\n\t\tObject.keys(params).forEach((k) => params[k] == \"\" && delete params[k])\n\t\tif (params.format === \"EMASS\") {\n\t\t\tdelete params.mccastPackageId\n\t\t\tdelete params.mccastAuthName\n\t\t}\n\t\tif (params.format === \"MCCAST\") {\n\t\t\tdelete params.office\n\t\t}\n\t\tconst search = new URLSearchParams(params).toString()\n\t\tlet url = `${STIGMAN.Env.apiBase}/collections/${collectionId}/poam?${search}`\n\n\t\t\n\t\tlet response = await fetch(\n\t\t\turl,\n\t\t\t{\n\t\t\t\tmethod: 'GET',\n\t\t\t\theaders: new Headers({\n\t\t\t\t\t'Authorization': `Bearer ${window.oidcWorker.token}`\n\t\t\t\t})\n\t\t\t}\n\t\t)\n\t\tconst contentDispo = response.headers.get(\"content-disposition\")\n\t\t//https://stackoverflow.com/questions/23054475/javascript-regex-for-extracting-filename-from-content-disposition-header/39800436\n\t\tconst filename = contentDispo.match(/filename\\*?=['\"]?(?:UTF-\\d['\"]*)?([^;\\r\\n\"']*)['\"]?;?/)[1]\n\t\tconst blob = await response.blob()\n\t\tmb.hide()\n\t\tdownloadBlob(blob, filename)\n\n\t\tfunction downloadBlob(blob, filename) {\n\t\t\tlet a = document.createElement('a')\n\t\t\ta.style.display = \"none\"\n\t\t\tlet url = window.URL.createObjectURL(blob)\n\t\t\ta.href = url\n\t\t\ta.download = filename\n\t\t\tdocument.body.appendChild(a)\n\t\t\ta.click()\n\t\t\tdocument.body.removeChild(a)\n\t\t\twindow.URL.revokeObjectURL(url)\n\t\t}\n\t}\n\tcatch (e) {\n\t\tmb.hide()\n\t\tSM.Error.handleError(e)\n\t}\n}\n\nSM.Findings.FindingsPanel = Ext.extend(Ext.Panel, {\n\tinitComponent: function () {\n\t\tconst me = this\n\t\tconst parent = new SM.Findings.ParentGrid({\n\t\t\tcls: 'sm-round-panel',\n\t\t\tmargins: { top: SM.Margin.top, right: SM.Margin.adjacent, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n\t\t\tborder: false,\n\t\t\tregion: 'center',\n\t\t\tpanel: this,\n\t\t\taggValue: me.aggregator || 'groupId',\n\t\t\ttitle: 'Aggregated Findings',\n\t\t\tgenPoamBtnHandler\n\t\t})\n\t\tconst child = new SM.Findings.ChildGrid({\n\t\t\tcls: 'sm-round-panel',\n\t\t\tmargins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.adjacent },\n\t\t\tborder: false,\n\t\t\tregion: 'east',\n\t\t\twidth: '60%',\n\t\t\tsplit: true,\n\t\t\tpanel: this,\n\t\t\ttitle: 'Individual Findings',\n\t\t\tlisteners: {\n\t\t\t\trowdblclick: onChildRowDblClick\n\t\t\t}\n\t\t})\n\t\tparent.child = child\n\t\tchild.parent = parent\n\t\tthis.parent = parent\n\t\tthis.child = child\n\n\t\tconst onParentRowSelect = (sm, index, record) => {\n\t\t\tconst params = {}\n\t\t\tparams[parent.aggValue] = record.data[parent.aggValue]\n\t\t\tif (parent.stigValue !== parent.stigAllValue) {\n\t\t\t\tparams.benchmarkId = parent.stigValue\n\t\t\t}\n\t\t\tchild.store.load({\n\t\t\t\tparams: params\n\t\t\t})\n\t\t}\n\t\tfunction onChildRowDblClick (grid, rowIndex) {\n\t\t\tconst r = grid.getStore().getAt(rowIndex)\n\t\t\tconst leaf = {\n\t\t\t\tcollectionId: grid.panel.collectionId, \n\t\t\t\tassetId: r.data.assetId,\n\t\t\t\tassetName: r.data.assetName,\n\t\t\t\tassetLabelIds: r.data.assetLabelIds,\n\t\t\t\tbenchmarkId: r.data.stigs[0]?.benchmarkId,\n\t\t\t\trevisionStr: r.data.stigs[0]?.revisionStr,\n\t\t\t\tstigName: r.data.stigs[0]?.benchmarkId,\n\t\t\t}\n\t\t\taddReview({\n\t\t\t\tleaf,\n\t\t\t\tselectedRule: r.data.ruleId\n\t\t\t})\n\t\t}\n\n\t\tfunction genPoamBtnHandler() {\n\t\t\tconst poamOptionsPanel = new SM.Findings.PoamOptionsPanel({\n\t\t\t\tbtnText: 'Generate POA&M',\n\t\t\t\tpadding: 10,\n\t\t\t\tbtnHandler: function () {\n\t\t\t\t\tconst params = poamOptionsPanel.getForm().getFieldValues()\n\t\t\t\t\tif (params.date && params.date instanceof Date) {\n\t\t\t\t\t\tparams.date = Ext.util.Format.date(params.date, 'm/d/Y')\n\t\t\t\t\t}\n\t\t\t\t\tparams.aggregator = parent.aggValue\n\t\t\t\t\tif (parent.stigValue && parent.stigValue !== parent.stigAllValue) {\n\t\t\t\t\t\tparams.benchmarkId = parent.stigValue\n\t\t\t\t\t}\n\t\t\t\t\tappwindow.close()\n\t\t\t\t\tlocalStorage.setItem('poam-format', params.format ?? 'EMASS')\n\t\t\t\t\tSM.Findings.RequestAndServePoam(parent.panel.collectionId, params)\n\t\t\t\t}\n\t\t\t})\n\n\t\t\tconst appwindow = new Ext.Window({\n\t\t\t\ttitle: 'POA&M Defaults',\n\t\t\t\tcls: 'sm-dialog-window sm-round-panel',\n\t\t\t\tmodal: true,\n\t\t\t\thidden: true,\n\t\t\t\twidth: 230,\n\t\t\t\theight: 390,\n\t\t\t\tlayout: 'fit',\n\t\t\t\tplain: true,\n\t\t\t\tbodyStyle: 'padding:5px;',\n\t\t\t\tbuttonAlign: 'right',\n\t\t\t\titems: poamOptionsPanel\n\t\t\t})\n\t\t\tappwindow.show(document.body)\n\t\t\tpoamOptionsPanel.setFormatDisplay(localStorage.getItem('poam-format') ?? 'EMASS')\n\t\t}\n\n\t\tconst config = {\n\t\t\tlayout: 'border',\n\t\t\tborder: false,\n\t\t\titems: [\n\t\t\t\tparent,\n\t\t\t\tchild\n\t\t\t],\n\t\t\tlisteners: {\n\t\t\t\tparentrowselect: onParentRowSelect\n\t\t\t}\n\t\t}\n\n\t\tExt.apply(this, Ext.apply(this.initialConfig, config))\n\t\tthis.superclass().initComponent.call(this)\n\n\t}\n})\n\n\n"
  },
  {
    "path": "client/src/js/SM/FlexboxLayout.js",
    "content": "SM.FlexboxLayout = Ext.extend(Ext.layout.ContainerLayout, {\n  onLayout : function(ct, target){\n    target.addClass('sm-flexbox-layout-ct');\n    this.renderAll(ct, target); \n  },\n  renderItem : function(c, position, target){\n    if(c && !c.rendered){\n        c.render(target);\n        this.configureItem(c);\n    }\n  }\n})\nExt.Container.LAYOUTS['sm-flexbox'] = SM.FlexboxLayout\n"
  },
  {
    "path": "client/src/js/SM/Global.js",
    "content": "var appName = 'STIG Manager';\nvar appVersion = \"3.0\";\nvar copyrightStr = '';\nvar licenseStr = \"This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.\\\n\\n\\nThis program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.\\\n\\n\\nThe GNU General Public License is available at  <http://www.gnu.org/licenses/>.\";\n\nvar curUser;\n\nExt.ns('SM')\nExt.ns('SM.Global')\n\nSM.he = Ext.util.Format.htmlEncode\nSM.hd = Ext.util.Format.htmlDecode\nSM.GetUserObject = async function () {\n    let result = await Ext.Ajax.requestPromise({\n        url: `${STIGMAN.Env.apiBase}/user?projection=webPreferences`,\n        method: 'GET'\n    })\n    curUser = JSON.parse(result.response.responseText)\n    curUser.collectionGrants.sort((a, b) => {\n        const nameA = a.collection.name\n        const nameB = b.collection.name\n        if (nameA < nameB) {\n            return -1\n        }\n        if (nameA > nameB) {\n            return 1\n        }\n        return 0\n    })\n    return curUser\n}\nSM.CtrlAGridHandler = function (e) {\n    if (e.browserEvent.key === 'a' && e.browserEvent.ctrlKey) {\n        e.stopPropagation()\n        e.preventDefault()\n        const sm = this.getSelectionModel()\n        sm.suspendEvents(false)\n        sm.selectRange(0, this.getStore().getCount() - 1)\n        sm.resumeEvents()\n        sm.fireEvent('selectionchange', sm)\n    }\n}\nSM.SetCheckboxSelModelHeaderState = function (sm) {\n    // const hd = sm.grid.view.innerHd.querySelector('.x-grid3-hd-row .x-grid3-td-checker .x-grid3-hd-checker')\n    const hd = sm.grid.view.innerHd.querySelector('.x-grid3-hd-inner.x-grid3-hd-checker')\n    if (hd) {\n      const hdState = sm.selections.length === 0 ? null : sm.grid.store.getCount() === sm.selections.length ? 'on' : 'ind'\n      hd.classList.remove('x-grid3-hd-checker-on')\n      hd.classList.remove('x-grid3-hd-checker-ind')\n      if (hdState) {\n          hd.classList.add(`x-grid3-hd-checker-${hdState}`)\n      }\n    }\n\n}\n\n\nSM.styledEmptyRenderer = v => v ? v : '<span class=\"sm-empty-cell\" />'\nSM.styledZeroRenderer = v => v !== 0 ? v : '-'\n\nSM.ResultTipText = `<b>Result</b><br>The result of an evaluation of a STIG ruleId.<br><br><b>Export Mappings</b><br><b>CKL:</b> &lt;CHECKLIST&gt;&lt;STIGS&gt;&lt;iSTIG&gt;&lt;VULN&gt;&lt;STATUS&gt;<br>\n<b>XCCDF:</b> &lt;TestResult&gt;&lt;rule-result&gt;&lt;result&gt;`\n\nSM.ResultTipTpl = new Ext.XTemplate(\n    `<b>Result</b><br>The result of an evaluation of a STIG ruleId.<br><br><b>Export Mappings</b><br><b>CKL:</b> &lt;CHECKLIST&gt;&lt;STIGS&gt;&lt;iSTIG&gt;&lt;VULN&gt;&lt;STATUS&gt;<br>\n<b>XCCDF:</b> &lt;TestResult&gt;&lt;rule-result&gt;&lt;result&gt;`\n)\nSM.DetailTipText = `<b>Detail</b><br>A description of how the evaluator or evaluation tool determined the result.<br><br><b>Export Mappings</b><br><b>CKL:</b> &lt;CHECKLIST&gt;&lt;STIGS&gt;&lt;iSTIG&gt;&lt;VULN&gt;&lt;FINDING_DETAILS&gt;<br>\n<b>XCCDF:</b> &lt;TestResult&gt;&lt;rule-result&gt;&lt;check&gt;&lt;check-content&gt;&lt;sm:detail&gt;`\n\nSM.DetailTipTpl = new Ext.XTemplate(\n    '<b>Detail</b><br>A description of how the evaluator or evaluation tool determined the result.<br><br>',\n    '<b>Collection Settings</b></br>This field is enabled ',\n    `<tpl if=\"enabled == 'always'\">for any result.<br></tpl>`,\n    `<tpl if=\"enabled == 'findings'\">for findings only.<br></tpl>`,\n    `Content in this field is `,\n    `<tpl if=\"required == 'always'\">required to submit a review.<br></tpl>`,\n    `<tpl if=\"required == 'findings'\">required to submit a finding.<br></tpl>`,\n    `<tpl if=\"required == 'optional'\">optional.<br></tpl>`,\n    `<br><b>Export Mappings</b><br><b>CKL:</b> &lt;CHECKLIST&gt;&lt;STIGS&gt;&lt;iSTIG&gt;&lt;VULN&gt;&lt;FINDING_DETAILS&gt;<br><b>XCCDF:</b> &lt;TestResult&gt;&lt;rule-result&gt;&lt;check&gt;&lt;check-content&gt;&lt;sm:detail&gt;`\n)\n\nSM.CommentTipText = `<b>Comment</b><br>Additional comment by the evaluator or evaluation tool.<br><br><b>Export Mappings</b><br><b>CKL:</b> &lt;CHECKLIST&gt;&lt;STIGS&gt;&lt;iSTIG&gt;&lt;VULN&gt;&lt;COMMENTS&gt;<br>\n<b>XCCDF:</b> &lt;TestResult&gt;&lt;rule-result&gt;&lt;check&gt;&lt;check-content&gt;&lt;sm:comment&gt;`\n\nSM.CommentTipTpl = new Ext.XTemplate(\n    '<b>Comment</b><br>Additional comment by the evaluator or evaluation tool.<br><br>',\n    '<b>Collection Settings</b></br>This field is enabled ',\n    `<tpl if=\"enabled == 'always'\">for any result.<br></tpl>`,\n    `<tpl if=\"enabled == 'findings'\">for findings only.<br></tpl>`,\n    `Content in this field is `,\n    `<tpl if=\"required == 'always'\">required to submit a review.<br></tpl>`,\n    `<tpl if=\"required == 'findings'\">required to submit a finding.<br></tpl>`,\n    `<tpl if=\"required == 'optional'\">optional.<br></tpl>`,\n    `<br><b>Export Mappings</b><br><b>CKL:</b> &lt;CHECKLIST&gt;&lt;STIGS&gt;&lt;iSTIG&gt;&lt;VULN&gt;&lt;COMMENTS&gt;<br>\n    <b>XCCDF:</b> &lt;TestResult&gt;&lt;rule-result&gt;&lt;check&gt;&lt;check-content&gt;&lt;sm:comment&gt;`\n)\n\nSM.RenderResult = {\n    fail: {\n        css: 'sm-result-fail',\n        textDisa: 'O',\n        textNist: 'F'\n    },\n    pass: {\n        css: 'sm-result-pass',\n        textDisa: 'NF',\n        textNist: 'P'\n    },\n    notapplicable: {\n        css: 'sm-result-na',\n        textDisa: 'NA',\n        textNist: 'N'\n    },\n    notchecked: {\n        css: 'sm-result-nr',\n        textDisa: 'NR',\n        textNist: 'K'\n    },\n    unknown: {\n        css: 'sm-result-nr',\n        textDisa: 'U',\n        textNist: 'U'\n    },\n    error: {\n        css: 'sm-result-nr',\n        textDisa: 'E',\n        textNist: 'E'\n    },\n    notselected: {\n        css: 'sm-result-nr',\n        textDisa: 'S',\n        textNist: 'S'\n    },\n    informational: {\n        css: 'sm-result-nr',\n        textDisa: 'I',\n        textNist: 'I'\n    },\n    fixed: {\n        css: 'sm-result-pass',\n        textDisa: 'F',\n        textNist: 'F'\n    }\n}\n\nSM.RuleContentTpl = new Ext.XTemplate(\n    '<div class=sm-rule-header-top>{ruleId}',\n      '<span class=\"sm-content-sprite sm-severity-{severity}\">',\n        `<tpl if=\"severity == 'high'\">CAT 1</tpl>`,\n        `<tpl if=\"severity == 'medium'\">CAT 2</tpl>`,\n        `<tpl if=\"severity == 'low'\">CAT 3</tpl>`, \n      '</span>',\n      '<div class=\"sm-content-stigid\">{version}</div>',\n    '</div>',\n    '<div class=sm-rule-header-sub>{[SM.he(values.title)]}</div>',\n    '<div class=sm-rule-body>',\n        '<div class=sm-rule-body-title>Manual Check',\n            '<div class=sm-rule-body-text>',\n            '<pre>{[SM.he(values.check?.content?.trim())]}</pre>',\n            '</div>',\n        '</div>',\n        '<div class=sm-rule-body-title>Fix',\n            '<div class=sm-rule-body-text>',\n            '<pre>{[SM.he(values.fix?.text?.trim())]}</pre>',\n            '</div>',\n        '</div>',\n    '</div>',\n    '<div class=sm-rule-body>',\n        '<div class=sm-rule-body-title>Other Data',\n        '<tpl if=\"values.detail.vulnDiscussion\">',\n            '<div class=sm-rule-body-text><b>Vulnerability Discussion</b><br><br>',\n            '<pre>{[SM.he(values.detail.vulnDiscussion?.trim())]}</pre>',\n            '</div>',\n        '</tpl>',\n        '<tpl if=\"values.detail.documentable\">',\n            '<div class=sm-rule-body-text><b>Documentable: </b>{[SM.he(values.detail.documentable)]}</div>',\n            '</tpl>',\n        '<tpl if=\"values.detail.responsibility\">',\n            '<div class=sm-rule-body-text><b>Responsibility: </b>{[SM.he(values.detail.responsibility)]}</div>',\n        '</tpl>',\n        '<tpl if=\"values.ccis.length === 0\">',\n            '<div class=sm-rule-body-text><b>Controls: </b>No mapped controls</div>',\n        '</tpl>',\n        '<tpl if=\"values.ccis.length !== 0\">',\n            '<div class=sm-rule-body-text><b>Controls: </b><br>',\n            '<table class=sm-rule-body-table border=\"1\">',\n            '<tr><td><b>CCI</b></td><td><b>AP Acronym</b></td><td><b>Control</b></td></tr>',\n            '<tpl for=\"ccis\">',\n                '<tr><td>{cci}</td><td>{[SM.he(values.apAcronym)]}</td><td>{[SM.he(values.control)]}</td></tr>',\n            '</tpl>',\n            '</table>',\n            '</div>',\n        '</tpl>',\n        '</div>',\n    '</div>'\n  )\n\n  SM.StoreRowCount = function (store, noun = 'row', iconCls = 'sm-database-icon') {\n    const rowCount = store.data.length || 0\n    const totalCount = store.snapshot?.length || rowCount\n\n    return `<span class=\"sm-review-sprite ${iconCls}\">${rowCount}${store.isFiltered() ? ' of ' + totalCount : ''} ${noun}${totalCount === 1 ? '' : 's'}</span>`\n  }\n\n  SM.RowCountTextItem = Ext.extend(Ext.Toolbar.TextItem, {\n    initComponent: function () {\n        // initial configuration supports {store, noun, iconCls}\n        const _this = this\n        const config = {\n            store: this.store\n        }\n        const events = ['load', 'datachanged','remove','clear','add']\n        for (const event of events) {\n            this.store?.on(event, () => _this.setText(SM.StoreRowCount(_this.store, _this.noun, _this.iconCls)))\n        }\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.RowCountTextItem.superclass.initComponent.call(this)\n        this.setText(SM.StoreRowCount(_this.store, _this.noun, _this.iconCls))\n    }  \n  })\n\n  function tagValueProcessor(tagName, tagValue) {\n    const txt = document.createElement(\"textarea\")\n    txt.innerHTML = tagValue\n    return txt.value\n  }\n\n  SM.safeJSONParse = function (value) {\n    try {\n        return JSON.parse(value)\n      }\n      catch (e) {\n        return undefined\n      }  \n  }\n\n  SM.TruncateLimit = 256\n    SM.Truncate = function (record, property) {\n        const value = SM.he(record.data[property])\n        if (!value) return ''\n\n        return value.length > SM.TruncateLimit\n            ? value.slice(0, SM.TruncateLimit) + '......'\n            : value\n        }\n\n  SM.TruncateRecordProperty = function (record, property) {\n      const value = SM.he(record.data[property])\n      if (!value) return\n\n      if (value.length > SM.TruncateLimit) {\n          return `${value.slice(0,SM.TruncateLimit)}... <span class=sm-truncated-action onclick=\"SM.ShowUntruncated('${SM.he(record.store.storeId)}','${SM.he(record.id)}','${SM.he(property)}')\">Full text</span>`\n      }\n      else {\n          return value\n      }\n  }\n\n  SM.ShowUntruncated = function (storeId, recordId, property) {\n    const record = Ext.StoreMgr.get(storeId).getById(recordId)\n    const textarea = new Ext.form.TextArea({\n        readOnly: true\n    })\n    const closeBtn = new Ext.Button({\n        text: 'Close',\n        handler: function() {\n            fpwindow.close()\n        }\n    })\n    const copyBtn = new Ext.Button({\n      text: 'Copy to clipboard',\n      handler: function() {\n          navigator.clipboard.writeText(textarea.value)\n      }\n    })\n    const fpwindow = new Ext.Window({\n      title: `Full ${property}`,\n      modal: true,\n      resizable: true,\n      width: 520,\n      height: 560,\n      layout: 'fit',\n      plain: true,\n      bodyStyle: 'padding:20px;',\n      buttonAlign: 'right',\n      buttons: [\n        copyBtn,\n        closeBtn\n      ],\n      items: textarea,\n      listeners: {\n          show: function (window) {\n              textarea.setValue(SM.he(record.data[property]))\n          }\n      }\n    })\n    fpwindow.show()\n  }\n\n  SM.ReloadStoreButton = Ext.extend(Ext.Button, {\n    initComponent: function () {\n        const _this = this\n\n        this.showLoadingIcon = () => _this.setIconClass('icon-loading')\n        this.showRefreshIcon = () => _this.setIconClass('icon-refresh')\n        this.onBeforeLoad = (store) => {\n            const grid = _this.ownerCt?.ownerCt || _this.grid || store.grid\n            const emptyEl = grid?.view?.mainBody?.dom?.querySelector('.x-grid-empty')\n            if (emptyEl) {\n                emptyEl.innerHTML = `<div class=\"icon-loading\" style=\"padding-left:20px;\">Loading</div>`\n            }\n            _this.showLoadingIcon()\n        }\n\n\n        if (this.store) {\n            this.store.on('beforeload', this.onBeforeLoad, this)\n            this.store.on('load', this.showRefreshIcon, this)\n        }\n\n        const destroy = () => {\n            if (_this.store) {\n                _this.store.un('beforeload', _this.onBeforeLoad, _this);\n                _this.store.un('load', _this.showRefreshIcon, _this);\n            }\n        }\n        const config = {\n            grid: this.grid,\n            iconCls: 'icon-refresh',\n            tooltip: 'Reload the grid',\n            width: 20,\n            listeners: {\n                destroy\n            }\n        }\n        if (!this.handler && this.store) {\n            this.handler = async () =>  {\n                const grid = _this.ownerCt?.ownerCt || _this.grid || store.grid\n                if (grid && grid.loadMask) {\n                    grid.loadMask.disabled = false\n                }\n                await _this.store.reloadPromise()\n                if (grid && grid.loadMask) {\n                    grid.loadMask.disabled = true\n                }\n\n            }\n        }\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        this.superclass().initComponent.call(this)\n    }\n  })\n  Ext.reg('sm-reload-store-button', SM.ReloadStoreButton)\n\n  SM.AddPanelToMainTab = function (panel, tabMode = 'permanent') {\n    const tp = Ext.getCmp('main-tab-panel')\n    const ephTabIndex = tp.items.findIndex('sm_tabMode', 'ephemeral')\n    if (ephTabIndex !== -1) {\n      tp.remove(tp.items.itemAt(ephTabIndex))\n      tp.insert(ephTabIndex, panel);\n    } else {\n      tp.add(panel)\n    }\n    panel.sm_tabMode = tabMode\n    panel.updateTitle && panel.updateTitle.call(panel)\n    tp.setActiveTab(panel.id)\n  }\n\n\n  SM.CreateAlertBodyFromErrorResponse = function(errorResponse) {\n    if (errorResponse?.hasOwnProperty('options')){\n        let alertBody = `request: <br>\n        ${errorResponse.options.method}   ${errorResponse.options.url} <br>\n        response:  <br>\n        status: ${errorResponse.response?.status}`\n        let responseObject = SM.safeJSONParse(errorResponse.response?.responseText)\n        for (const property in responseObject) {\n            alertBody += ` <br> ${property}: ${responseObject[property]}`;\n        }\n        return alertBody\n    }\n    else{\n        return JSON.stringify(errorResponse)\n    }\n\n  }\n\n  SM.getContrastYIQ = function (hexcolor){\n\tconst r = parseInt(hexcolor.substr(0,2),16);\n\tconst g = parseInt(hexcolor.substr(2,2),16);\n\tconst b = parseInt(hexcolor.substr(4,2),16);\n\tconst yiq = ((r*299)+(g*587)+(b*114))/1000;\n\treturn (yiq >= 128) ? '#080808' : '#f7f7f7';\n}\n\n  SM.Global.HelperComboBox = Ext.extend(Ext.form.ComboBox, {\n    initComponent: function () {\n        const config = {\n            listeners: {\n                render: function (cb) {\n                    cb.trigger.insertHtml('afterEnd',`<i class=\"fa fa-question-circle sm-question-circle\"></i>`)\n                    const sonarCloudInsists = new Ext.ToolTip({\n                        target: cb.wrap.dom.getElementsByClassName('fa')[0],\n                        showDelay: 0,\n                        dismissDelay: 0,\n                        width: 300,\n                        html: cb.helpText,\n                        tpl: cb.helpTpl,\n                        data: cb.helpData\n                    }) \n                }\n            }\n        }\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.Global.HelperComboBox.superclass.initComponent.call(this)\n    }\n})\n\nSM.Global.helperCheckboxRadioInitComponent = function () {\n    const config = {\n        listeners: {\n            render: function (cb) {\n                cb.wrap.first('label').insertHtml('beforeEnd',`<i class=\"fa fa-question-circle sm-question-circle\"></i>`)\n                const sonarCloudInsists = new Ext.ToolTip({\n                    target: cb.wrap.dom.getElementsByClassName('fa')[0],\n                    showDelay: 0,\n                    dismissDelay: 0,\n                    width: 300,\n                    html: cb.helpText,\n                    tpl: cb.helpTpl,\n                    data: cb.helpData\n                }) \n            }\n        }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n}\nSM.Global.HelperCheckbox = Ext.extend(Ext.form.Checkbox, {\n    initComponent: SM.Global.helperCheckboxRadioInitComponent\n})\n\nSM.Global.HelperRadio = Ext.extend(Ext.form.Radio, {\n    initComponent: SM.Global.helperCheckboxRadioInitComponent\n})\n\n\nSM.Global.GridCellContextMenu = new Ext.menu.Menu({\n    items: [\n        {\n            text: `Copy value`,\n            itemId: 'copycell',\n            iconCls: 'sm-copy-icon'\n        },\n        '-',\n        {\n            text: `Copy row as CSV`,\n            itemId: 'copyrow',\n            iconCls: 'sm-copy-icon'\n        }\n    ],\n    onCellContextMenu: function (grid, rowIndex, cellIndex, e) {\n        const menu = SM.Global.GridCellContextMenu\n        menu.grid = grid\n        menu.rowIndex = rowIndex\n        menu.cellIndex = cellIndex\n        menu.cellText = grid.getView().getCell(rowIndex, cellIndex).innerText\n        const cellDisplay = `\"${menu.cellText.length > 24 ? menu.cellText.slice(0, 24) + '...' : menu.cellText + '\"'}`\n        menu.items.items[0].setText(`Copy value <b>${cellDisplay}</b>`)\n        menu.showAt(e.xy)\n    },\n    listeners: {\n        click: function (menu, item) {\n            if (item.itemId === 'copycell') {\n                navigator.clipboard.writeText(menu.cellText)\n            }\n            else {\n                let csv = ''\n                const rowArray = []\n                const columns = menu.grid.getColumnModel().getColumnsBy(() => true)\n                const rowDiv = menu.grid.getView().getRow(menu.rowIndex)\n                // headerArray[] will hold data for the CSV header row\n                const headerArray = []\n                // ci[] will hold only the column indexes for which we will encode cell data\n                const ci = []\n                for (let x = 0; x < columns.length; x++) {\n                    const c = columns[x]\n                    // Criteria for inclusion of the column\n                    if (c.dataIndex != \"\" && c.header != \"\" && !c.hidden) {\n                        // Build an element to hold the column header's HTML\n                        const el = document.createElement('html')\n                        el.innerHTML = c.header\n                        // Try to find the first child element with an 'exportvalue' attribute\n                        const ev = el.querySelector('[exportvalue]')\n                        if (ev != null) {\n                            // An element with an 'exportvalue' attribute was found. The CSV column header will be the value of 'exportvalue'\n                            headerArray.push('\"' + ev.getAttribute('exportvalue') + '\"')\n                        }\n                        else {\n                            // No element with an 'exportvalue' attribute was found was found. The CSV column header will be the quoted UI column header\n                            headerArray.push('\"' + c.header + '\"')\n                        }\n                        // Add this column index to ci[]\n                        ci.push(x)\n                    }\n                }\n                // Comma separate the header data and append to the CSV \n                csv += headerArray.join(',') + \"\\n\"\n                const rowCells = rowDiv.getElementsByTagName('tr')[0].cells\n                // Iterate across the included column indexes \n                for (let x = 0; x < ci.length; x++) {\n                    const ev = rowCells[ci[x]].querySelector('[exportvalue]')\n                    if (ev != null) {\n                        // An element with an 'exportvalue' attribute was found was found. The CSV data will be the value of 'exportvalue'\n                        rowArray.push('\"' + ev.getAttribute('exportvalue') + '\"')\n                    }\n                    else {\n                        // No element with an 'exportvalue' attribute was found was found. The CSV data will be the quoted and escaped textContent of the <td>'s firstChild\n                        const value = '\"' + rowCells[ci[x]].firstChild.textContent.replace(/\"/g, '\"\"').trim() + '\"'\n                        rowArray.push(value)\n                    }\n                }\n                // Comma separate the row data and append to the CSV \n                csv += rowArray.join(',') + \"\\n\"\n                navigator.clipboard.writeText(csv)\n            }\n        }\n    }\n})\n\n// Global copy-to-clipboard context menu for GridPanel\n// Source: carl.a.smigielski@saic.com\nExt.override(Ext.grid.GridPanel, {\n    initEvents: function () {\n        Ext.grid.GridPanel.superclass.initEvents.call(this)\n        // override code: add handler for cellcontextmenu event\n        this.on('cellcontextmenu', SM.Global.GridCellContextMenu.onCellContextMenu, this)\n\n        if (this.loadMask) {\n            this.loadMask = new Ext.LoadMask(this.bwrap,\n                Ext.apply({ store: this.store }, this.loadMask));\n        }\n    }\n})\n\nSM.Global.filenameComponentFromDate = function (dateObject = new Date()) {\n    return dateObject.toISOString().replace(/:|\\d{2}\\.\\d{3}/g,'')\n}\n\nSM.Global.filenameEscaped = function (value) {\n    /**\n     * Regexes match characters that need to be escaped in filenames.\n     * @type {RegExp}\n     */\n    const osReserved = /[/\\\\:*\"?<>|]/g\n    const controlChars = /[\\x00-\\x1f]/g\n  \n      /**\n     * Map of characters to their corresponding named HTML entities.\n     * @type {Object.<string, string>}\n     */\n    const osReserveReplace = {\n      '/': '&sol;',\n      '\\\\': '&bsol;',\n      ':': '&colon;',\n      '*': '&ast;',\n      '\"': '&quot;',\n      '?': '&quest;',\n      '<': '&lt;',\n      '>': '&gt;',\n      '|': '&vert;',\n    }\n  \n    return value.toString()\n    .replace(osReserved, (match) => osReserveReplace[match])\n    .replace(controlChars, (match) => `&#x${match.charCodeAt(0).toString().padStart(2,'0')};`)\n    .substring(0, 255)\n}\n\nSM.Klona = function klona(val) {\n    // MIT License\n    // Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)\n    // https://github.com/lukeed/klona\n\n    let k, out, tmp\n\n    if (Array.isArray(val)) {\n        out = Array(k = val.length)\n        while (k--) out[k] = (tmp = val[k]) && typeof tmp === 'object' ? klona(tmp) : tmp\n        return out\n    }\n\n    if (Object.prototype.toString.call(val) === '[object Object]') {\n        out = {} // null\n        for (k in val) {\n            if (k === '__proto__') {\n                Object.defineProperty(out, k, {\n                    value: klona(val[k]),\n                    configurable: true,\n                    enumerable: true,\n                    writable: true,\n                })\n            } else {\n                out[k] = (tmp = val[k]) && typeof tmp === 'object' ? klona(tmp) : tmp\n            }\n        }\n        return out\n    }\n\n    return val\n}\n\nSM.RoleStrings = [\n    'Undefined',\n    'Restricted',\n    'Full',\n    'Manage',\n    'Owner'\n]\n\nSM.RoleComboBox = Ext.extend(Ext.form.ComboBox, {\n    initComponent: function () {\n        // const _this = this\n        this.includeOwnerRole = !!this.includeOwnerRole\n        const config = {\n            displayField: 'display',\n            valueField: 'value',\n            triggerAction: 'all',\n            mode: 'local',\n            editable: false,\n            // validator: (v) => {\n            //     // Don't keep the form from validating when I'm not active\n            //     // if (_this.grid.editor.editing == false) {\n            //     //     return true\n            //     // }\n            //     if (v === \"\") { return \"Blank values not allowed\" }\n            // }\n        }\n\n        const data = [\n            [1, SM.RoleStrings[1]],\n            [2, SM.RoleStrings[2]],\n            [3, SM.RoleStrings[3]]\n        ]\n        if (this.includeOwnerRole) {\n            data.push([4, SM.RoleStrings[4]])\n        }\n        this.store = new Ext.data.SimpleStore({\n            fields: ['value', 'display'],\n            data\n        })\n        // this.store.on('load', function (store) {\n        //     _this.setValue(store.getAt(0).get('value'))\n        // })\n\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        this.superclass().initComponent.call(this)\n\n        // this.store.loadData(data)\n    }\n})\n\n// SM.TreeNodeRadioUI = Ext.extend(Ext.tree.TreeNodeUI, {\n//     renderElements : function(n, a, targetNode, bulkRender){\n//         // add some indent caching, this helps performance when rendering a large tree\n//         this.indentMarkup = n.parentNode ? n.parentNode.ui.getChildIndent() : '';\n\n//         let cb = Ext.isBoolean(a.checked),\n//             nel,\n//             href = this.getHref(a.href),\n//             buf = ['<li class=\"x-tree-node\"><div ext:tree-node-id=\"',n.id,'\" class=\"x-tree-node-el x-tree-node-leaf x-unselectable ', a.cls,'\" unselectable=\"on\">',\n//             '<span class=\"x-tree-node-indent\">',this.indentMarkup,\"</span>\",\n//             '<img alt=\"\" src=\"', this.emptyIcon, '\" class=\"x-tree-ec-icon x-tree-elbow\" />',\n//             cb ? ('<input class=\"x-tree-node-cb\" type=\"radio\" name=\"rg\" ' + (a.checked ? 'checked=\"checked\" />' : '/>')) : '',\n//             '<img alt=\"\" src=\"', a.icon || this.emptyIcon, '\" class=\"x-tree-node-icon',(a.icon ? \" x-tree-node-inline-icon\" : \"\"),(a.iconCls ? \" \"+a.iconCls : \"\"),'\" unselectable=\"on\" />',\n//             '<a hidefocus=\"on\" class=\"x-tree-node-anchor\" tabIndex=\"1\" ',\n//              a.hrefTarget ? ' target=\"'+a.hrefTarget+'\"' : \"\", '><span unselectable=\"on\">',n.text,\"</span></a></div>\",\n//             '<ul class=\"x-tree-node-ct\" style=\"display:none;\"></ul>',\n//             \"</li>\"].join('');\n\n//         if(bulkRender !== true && n.nextSibling && (nel = n.nextSibling.ui.getEl())){\n//             this.wrap = Ext.DomHelper.insertHtml(\"beforeBegin\", nel, buf);\n//         }else{\n//             this.wrap = Ext.DomHelper.insertHtml(\"beforeEnd\", targetNode, buf);\n//         }\n\n//         this.elNode = this.wrap.childNodes[0];\n//         this.ctNode = this.wrap.childNodes[1];\n//         let cs = this.elNode.childNodes;\n//         this.indentNode = cs[0];\n//         this.ecNode = cs[1];\n//         this.iconNode = cs[3];\n//         let index = 3;\n//         if(cb){\n//             this.checkbox = cs[2];\n//             // fix for IE6\n//             this.checkbox.defaultChecked = this.checkbox.checked;\n//             index++;\n//         }\n//         this.anchor = cs[index];\n//         this.textNode = cs[index].firstChild;\n//     }, \n// })\n"
  },
  {
    "path": "client/src/js/SM/Grant.js",
    "content": "Ext.ns('SM.Grant')\n\nSM.Grant.GranteeTreePanel = Ext.extend(Ext.tree.TreePanel, {\n  initComponent: function () {\n    const _this = this\n    const timestampRef = Math.floor(new Date().getTime() / 1000)\n\n    const activeFilterComboBox = new Ext.form.ComboBox({\n      mode: 'local',\n      triggerAction: 'all',\n      editable: false,\n      width: 120,\n      store: new Ext.data.ArrayStore({\n          fields: [\n              'earliestTimestamp',\n              'displayText'\n          ],\n          data: [\n            [0, 'All'],\n            [timestampRef - (86400 * 30), 'Active last 30 days'],\n            [timestampRef - (86400 * 60), 'Active last 60 days'],\n            [timestampRef - (86400 * 90), 'Active last 90 days'],\n          ]\n      }),\n      valueField: 'earliestTimestamp',\n      value: 0,\n      displayField: 'displayText',\n      listeners: {\n        select: function (unused, record) {\n          filters.earliestTimestamp = record.data.earliestTimestamp\n          _this.root.cascade(filterNodes)\n        }\n      }\n    })\n\n    const nameFilterTextField = new SM.ColumnFilters.StringMatchTextField({\n      emptyText: 'Filter names',\n      height: 20,\n      enableKeyEvents:true,\n      listeners: {\n        input: function (field,e) {\n          _this.filters.nameFilter = field.getValue().toLowerCase()\n          _this.root.cascade(filterNodes)\n          return false\n        }\n      }\n    })\n\n    function shouldHideNode ({text, lastAccess}) {\n      let passLastAccess = true\n      if (lastAccess !== undefined) {\n        passLastAccess = lastAccess >= filters.earliestTimestamp\n      }\n      const passName = text?.toLowerCase().includes(filters.nameFilter)\n      return !(passLastAccess && passName)\n    }\n\n    function filterNodes (node) {\n      const attr = node.attributes\n      if (attr.type !== 'user' && attr.type !== 'user-group') {\n        return true\n      }\n      if (shouldHideNode({text: attr.text, lastAccess: attr.user?.lastAccess})) {\n        node.ui.hide()\n        if (attr.checked && !_this.radio) {\n          node.ui.toggleCheck(false)\n        }\n      }\n      else {\n        node.ui.show()\n      }\n      return true\n    }\n\n    const filters = {\n      nameFilter: '',\n      earliestTimestamp: activeFilterComboBox.getValue()\n    }\n\n    const tbar = new Ext.Toolbar({\n      items: [\n        'Users:&nbsp;&nbsp;',\n        activeFilterComboBox,\n        '-',\n        nameFilterTextField\n      ]\n    })\n\n    const config = {\n      autoScroll: true,\n      filters,\n      shouldHideNode,\n      bodyStyle: 'padding:5px;',\n      minSize: 220,\n      root: {\n        nodeType: 'async',\n        id: `grantee-root`,\n        expanded: true\n      },\n      rootVisible: false,\n      loader: new Ext.tree.TreeLoader({\n        directFn: this.loadTree\n      }),\n      loadMask: { msg: '' },\n      listeners: {\n        beforeexpandnode: function (n) {\n          // n.loaded = false; // always reload from the server\n        },\n        expandnode: function (n) {\n          console.log(`enpandnode ${n.id}`)\n        }\n      },\n      tbar\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n\n    if (this.radio) {\n      // Override the Ext delegateClick() method to handle radio buttons correctly\n      this.eventModel.delegateClick = function(e, t){\n        if (this.beforeEvent(e)) {\n            // the original method looks for type=checkbox\n            if (e.getTarget('input[type=radio]', 1)) {\n              this.onCheckboxClick(e, this.getNode(e))\n            }\n            else if (e.getTarget('.x-tree-ec-icon', 1)) {\n              this.onIconClick(e, this.getNode(e));\n            } else if (this.getNodeTarget(e)) {\n              this.onNodeClick(e, this.getNode(e));\n            }\n        }\n        else{\n          this.checkContainerEvent(e, 'click');\n        }\n      }\n    }\n  },\n  loadTree: async function (nodeId, cb) {\n    try {\n      const tp = this.ownerTree\n      const existingGrants = tp.existingGrants ?? []\n      const selectedGrant = tp.selectedGrant ?? {}\n      const excludedUserIds = existingGrants.filter( g => g.userId && g.userId !== selectedGrant.userId).map(u=>u.userId)\n      const excludedGroupIds = existingGrants.filter( g => g.userGroupId && g.userGroupId !== selectedGrant.userGroupId).map(g=>g.userGroupId)\n      let match\n      // Root\n      if (nodeId === 'grantee-root') {\n        const content = [\n          {\n            id: `grantee-user-groups-node`,\n            type: 'user-groups-root',\n            text: 'User Groups',\n            iconCls: 'sm-users-icon',\n            expanded: true\n          },\n          {\n            id: `grantee-users-node`,\n            type: 'users-root',\n            text: 'Users',\n            iconCls: 'sm-user-icon',\n            expanded: true\n          }\n        ]\n        cb(content, { status: true })\n        return\n      }\n      // UserGroups\n      if (nodeId === 'grantee-user-groups-node') {\n        const apiUserGroups = await Ext.Ajax.requestPromise({\n          responseType: 'json',\n          url: `${STIGMAN.Env.apiBase}/user-groups`,\n          method: 'GET'\n        })\n        const availUserGroups = apiUserGroups.filter( userGroup => !excludedGroupIds.includes(userGroup.userGroupId))\n\n        const content = availUserGroups.map(userGroup => ({\n          id: `${userGroup.userGroupId}-user-groups-group-node`,\n          text: SM.he(userGroup.name),\n          // hidden: !(SM.he(userGroup.name).includes(tp.filter.nameFilter)),\n          hidden: tp.shouldHideNode({text: SM.he(userGroup.name)}),\n          userGroup,\n          type: 'user-group',\n          iconCls: 'sm-users-icon',\n          checked: userGroup.userGroupId === selectedGrant.userGroupId,\n          qtip: SM.he(userGroup.description)\n        }))\n        cb(content, { status: true })\n        return\n      }\n      // UserGroups-User\n      match = nodeId.match(/^(\\d+)-user-groups-group-node$/)\n      if (match) {\n        const userGroupId = match[1]\n        const apiUsers = await Ext.Ajax.requestPromise({\n          responseType: 'json',\n          url: `${STIGMAN.Env.apiBase}/user-groups/${userGroupId}`,\n          method: 'GET',\n          params: {\n            projection: 'users'\n          }\n        })\n        const content = apiUsers.users.map(user => ({\n          id: `${userGroupId}-${user.userId}-user-group-user-leaf`,\n          text: SM.he(user.displayName),\n          leaf: true,\n          type: 'user-group-user',\n          iconCls: 'sm-user-icon',\n          user,\n          qtip: `Rules: ${SM.he(user.username)}`\n        }))\n        cb(content, { status: true })\n        return\n      }\n\n      // Users\n      if (nodeId === 'grantee-users-node') {\n        const apiUsers = await Ext.Ajax.requestPromise({\n          responseType: 'json',\n          url: `${STIGMAN.Env.apiBase}/users?status=available`,\n          method: 'GET'\n        })\n        const availUsers = apiUsers.filter( user => !excludedUserIds.includes(user.userId))\n\n        const content = availUsers.map(user => ({\n          id: `users-${user.userId}-user-leaf`,\n          text: SM.he(user.displayName),\n          hidden: tp.shouldHideNode({text: SM.he(user.displayName), lastAccess: user.lastAccess || 0}),\n          user,\n          type: 'user',\n          leaf: true,\n          checked: user.userId === selectedGrant.userId,\n          iconCls: 'sm-user-icon',\n          qtip: SM.he(user.username)\n        }))\n        cb(content, { status: true })\n        return\n      }\n    }\n    catch (e) {\n      SM.Error.handleError(e)\n    }\n  }\n})\n\nSM.Grant.GranteeAddBtn = Ext.extend(Ext.Button, {\n  initComponent: function () {\n    const config = {\n      disabled: true,\n      height: 30,\n      width: 150,\n      margins: \"10 10 10 10\",\n      icon: 'img/right-arrow-16.png',\n      iconAlign: 'right',\n      cls: 'x-btn-text-icon'\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Grant.GranteeRemoveBtn = Ext.extend(Ext.Button, {\n  initComponent: function () {\n    const config = {\n      disabled: true,\n      height: 30,\n      width: 150,\n      margins: \"10 10 10 10\",\n      icon: 'img/left-arrow-16.png',\n      iconAlign: 'left',\n      cls: 'x-btn-text-icon'\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Grant.GrantGrid = Ext.extend(Ext.grid.EditorGridPanel, {\n  initComponent: function () {\n    const _this = this\n    const fields = [\n      'grantTarget',\n      'grantTargetId',\n      'title',\n      'subtitle',\n      'roleId',\n      'recordId',\n      'grantee'\n    ]\n\n    const store = new Ext.data.JsonStore({\n      grid: this,\n      root: '',\n      fields,\n      idProperty: 'recordId',\n      sortInfo: {\n        field: 'title',\n        direction: 'ASC'\n      }\n    })\n    const totalTextCmp = new SM.RowCountTextItem({\n      store,\n      noun: 'grant',\n      iconCls: 'sm-lock-icon'\n    })\n    const roleField = new SM.RoleComboBox({\n      submitValue: false,\n      grid: this,\n      includeOwnerRole: this.canModifyOwners,\n      listeners: {\n        select: function (combo) {\n          if (combo.startValue !== combo.value ) {\n            combo.fireEvent(\"blur\");\n          } \n        }\n      }\n    })\n    const colModel = new Ext.grid.ColumnModel({\n      columns: [\n        {\n          header: \"Grantee\",\n          width: 150,\n          dataIndex: 'title',\n          sortable: true,\n          renderer: function (v, m, r) {\n            const icon = r.data.grantTarget === 'user' ? 'sm-user-icon' : 'sm-users-icon'\n            return `<div class=\"x-combo-list-item ${icon} sm-combo-list-icon\" exportValue=\"${r.data.title ?? ''}:${r.data.subtitle ?? ''}\"><span style=\"font-weight:600;\">${r.data.title ?? ''}</span><br>${r.data.subtitle ?? ''}</div>`\n          }\n        },\n        {\n          header: '<span exportvalue=\"Role\">Role<i class= \"fa fa-question-circle sm-question-circle\"></i></span>',\n          width: 70,\n          dataIndex: 'roleId',\n          sortable: true,\n          renderer: (v) => SM.RoleStrings[v],\n          editor: roleField\n        }\n      ]\n    })\n    const selModel = new Ext.grid.RowSelectionModel({\n      singleSelect: false\n    })\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      deferEmptyText: false,\n      forceFit: true,\n      markDirty: false,\n      listeners: {\n        refresh: function (view) {\n          // Setup the tooltip for column 'role'\n          const index = view.grid.getColumnModel().findColumnIndex('roleId')\n          const tipEl = view.getHeaderCell(index).getElementsByClassName('fa')[0]\n          if (tipEl) {\n            new Ext.ToolTip({\n              target: tipEl,\n              showDelay: 0,\n              dismissDelay: 0,\n              maxWidth: 600,\n              html: SM.TipContent.Roles\n            })\n          }\n        },\n      },\n    })\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          gridBasename: 'CollectionGrants',\n          exportType: 'grid',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        }, {\n          xtype: 'tbfill'\n        }, {\n          xtype: 'tbseparator'\n        },\n        totalTextCmp\n      ]\n    })\n    function viewready (grid) {\n      // Setup the tooltip for column 'role'\n      const index = grid.getColumnModel().findColumnIndex('roleId')\n      const tipEl = grid.view.getHeaderCell(index).getElementsByClassName('fa')[0]\n      if (tipEl) {\n        new Ext.ToolTip({\n          target: tipEl,\n          showDelay: 0,\n          dismissDelay: 0,\n          maxWidth: 600,\n          html: SM.TipContent.Roles\n        })\n      }\n    }\n    function getValue () {\n      let grants = []\n      store.data.items.forEach(i => {\n        if (i.data.grantTarget === 'user')\n          grants.push({\n            userId: i.data.grantTargetId,\n            roleId: i.data.roleId\n          })\n        else\n          grants.push({\n            userGroupId: i.data.grantTargetId,\n            roleId: i.data.roleId\n          })\n      })\n      return grants\n    }\n    function setValue (v) {\n      const data = v.map(g => {\n        if (g.user) return {\n          grantTarget: 'user',\n          grantTargetId: g.user.userId,\n          subtitle: g.user.username,\n          title: g.user.displayName,\n          roleId: g.roleId,\n          recordId: `U${g.user.userId}`\n\n        }\n        return {\n          grantTarget: 'user-group',\n          grantTargetId: g.userGroup.userGroupId,\n          title: g.userGroup.name,\n          subtitle: g.userGroup.description,\n          roleId: g.roleId,\n          recordId: `UG${g.userGroup.userGroupId}`\n        }\n      })\n      store.loadData(data)\n    }\n    \n    const config = {\n      name: 'grants',\n      allowBlank: false,\n      layout: 'fit',\n      height: 150,\n      store,\n      colModel,\n      selModel,\n      view,\n      bbar,\n      listeners: {\n        viewready\n      },\n      getValue,\n      setValue\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\nExt.reg('sm-grant-grantgrid', SM.Grant.GrantGrid)\n\nSM.Grant.RoleMenuPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const config = {}\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Grant.NewGrantPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    function handleTreeCheck(node) {\n      const checkedNodes = granteeTp.getChecked()\n      addBtn.setDisabled(!checkedNodes.length)\n    }\n\n    const granteeTp = new SM.Grant.GranteeTreePanel({\n      panel: this,\n      role: 'available',\n      title: 'Available Grantees',\n      width: 320,\n      existingGrants: this.existingGrants,\n      listeners: {\n        checkchange: handleTreeCheck\n      }\n    })\n    granteeTp.getSelectionModel().on('beforeselect', function (sm, newNode, oldNode) {\n      newNode.ui.toggleCheck()\n      return false\n    })\n  \n    new Ext.tree.TreeSorter(granteeTp, {\n      dir: \"asc\"\n    })\n\n    const grantGrid = new SM.Grant.GrantGrid({\n      title: 'New Grants',\n      // emptyText: 'An Owner grant is required',\n      iconCls: 'sm-lock-icon',\n      headerCssClass: 'sm-selections-panel-header',\n      role: 'selections',\n      flex: 1\n    })\n    grantGrid.getSelectionModel().on('selectionchange', function (sm) {\n      removeBtn.setDisabled(sm.getSelected()?.length)\n    })\n\n    function handleAddBtnItem (menuItem) {\n      const checkedNodes = granteeTp.getChecked()\n      const data = checkedNodes.map( node => {\n        if (node.attributes.user) {\n          return {\n            grantTarget: 'user',\n            grantTargetId: node.attributes.user.userId,\n            subtitle: node.attributes.user.username,\n            title: node.attributes.user.displayName,\n            roleId: menuItem.roleId,\n            recordId: `U${node.attributes.user.userId}`,\n            grantee: node.attributes.user\n          } \n        }\n        else {\n          return {\n            grantTarget: 'user-group',\n            grantTargetId: node.attributes.userGroup.userGroupId,\n            title: node.attributes.userGroup.name,\n            subtitle: node.attributes.userGroup.description,\n            roleId: menuItem.roleId,\n            recordId: `UG${node.attributes.userGroup.userGroupId}`,\n            grantee: node.attributes.userGroup\n          }\n        }\n      })\n      for (const node of checkedNodes) {\n        node.remove()\n      }\n      grantGrid.store.loadData(data, true)\n      addBtn.disable()\n    }\n\n    const addBtnMenuItems = [\n      {text: 'Role: Restricted', iconCls: 'sm-add-assignment-icon', roleId: 1, handler: handleAddBtnItem},\n      {text: 'Role: Full', iconCls: 'sm-add-assignment-icon', roleId: 2, handler: handleAddBtnItem},\n      {text: 'Role: Manage', iconCls: 'sm-add-assignment-icon', roleId: 3, handler: handleAddBtnItem},\n      {text: 'Role: Owner', iconCls: 'sm-add-assignment-icon', roleId: 4, handler: handleAddBtnItem},\n    ]\n\n    const addBtn = new Ext.Button({\n      iconCls: 'sm-add-assignment-icon',\n      text: 'Add',\n      margins: \"10 0 10 0\",\n      disabled: true,\n      menu: new Ext.menu.Menu({\n        items: addBtnMenuItems\n      })\n    })\n\n    const removeBtn = new Ext.Button({\n      iconCls: 'sm-remove-assignment-icon',\n      text: 'Remove',\n      disabled: true,\n      handler: function (btn) {\n        const selectedRecords = grantGrid.getSelectionModel().getSelections()\n        for (const record of selectedRecords) {\n          const data = record.data\n          if (data.grantTarget === 'user-group') {\n            const node = new Ext.tree.AsyncTreeNode({\n              id: `${data.grantTargetId}-user-groups-group-node`,\n              text: SM.he(data.title),\n              userGroup: data.grantee,\n              hidden: granteeTp.shouldHideNode({text: SM.he(data.title), lastAccess:data.lastAccess}),\n              type: 'user-group',\n              iconCls: 'sm-users-icon',\n              checked: false,\n              qtip: SM.he(data.subtitle)\n            })\n            const parentNode = granteeTp.getNodeById('grantee-user-groups-node')\n            parentNode.appendChild(node)\n            if (!parentNode.isExpanded()) parentNode.expand({anim: false})\n          }\n          else if (data.grantTarget === 'user') {\n            const node = new Ext.tree.TreeNode({\n              id: `users-${data.grantTargetId}-user-leaf`,\n              text: SM.he(data.title),\n              hidden: granteeTp.shouldHideNode({text: SM.he(data.title), lastAccess:data.grantee.lastAccess}),\n              user: data.grantee,\n              type: 'user',\n              iconCls: 'sm-user-icon',\n              checked: false,\n              qtip: SM.he(data.subtitle)\n            })\n            const parentNode = granteeTp.getNodeById('grantee-users-node')\n            parentNode.appendChild(node)\n            // if (!parentNode.isExpanded()) parentNode.expand({anim: false})\n          }\n        }\n        grantGrid.store.remove(selectedRecords)\n        btn.disable()\n      }\n    })\n\n    const buttonPanel = new Ext.Panel({\n      bodyStyle: 'background-color:transparent;border:none',\n      width: 120,\n      layout: {\n        type: 'vbox',\n        pack: 'center',\n        align: 'center',\n      },\n      items: [\n        addBtn,\n        removeBtn\n      ]\n    })\n\n    const config = {\n      layout: 'hbox',\n      layoutConfig: {\n        align: 'stretch'\n      },\n      border: false,\n      items: [\n        granteeTp,\n        buttonPanel,\n        grantGrid\n      ],\n      granteeTp,\n      grantGrid,\n      buttonPanel\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Grant.showNewGrantWindow = function ({collectionId, existingGrants, canModifyOwners, elevate = false}) {\n  try {\n    async function saveHandler () {\n      try {\n        const grants = panel.grantGrid.getValue()\n        await SM.Grant.Api.postGrantsByCollection({collectionId, grants, elevate})\n      }\n      catch (e) {\n        SM.Error.handleError(e)\n      }\n      finally {\n        panelWindow.close()\n      }\n    }\n      \n    const panel = new SM.Grant.NewGrantPanel({existingGrants, canModifyOwners})\n\n    const saveBtn = new Ext.Button({\n      text: 'Save',\n      disabled: true,\n      id: 'submit-button',\n      handler: saveHandler\n    })\n\n    panel.grantGrid.store.on('add', grantGridStoreHandler)\n    panel.grantGrid.store.on('remove', grantGridStoreHandler)\n\n    function grantGridStoreHandler () {\n      const action = panel.grantGrid.store.data.items.length ? saveBtn.enable : saveBtn.disable\n      action.call(saveBtn)\n    }\n\n    const panelWindow = new Ext.Window({\n      title: `New Grants for ${collectionId}`,\n      cls: 'sm-dialog-window sm-round-panel',\n      modal: true,\n      hidden: true,\n      width: 800,\n      height: 600,\n      layout: 'fit',\n      plain: true,\n      bodyStyle: 'padding:20px;',\n      buttonAlign: 'right',\n      items: panel,\n      buttons: [\n        {\n          text: 'Cancel',\n          handler: function () {\n            panelWindow.close();\n          }\n        },\n        saveBtn\n      ]\n    })\n    panel.panelWindow = panelWindow\n    panelWindow.render(Ext.getBody())\n    Ext.getBody().unmask()\n    panelWindow.show()\n  }\n  catch (e) {\n    if (typeof e === 'object') {\n      if (e instanceof Error) {\n        e = JSON.stringify(e, Object.getOwnPropertyNames(e), 2);\n      }\n      else {\n        e = JSON.stringify(e);\n      }\n    }\n    SM.Error.handleError(e)\n    Ext.getBody().unmask()\n  }\n}\n\nSM.Grant.showEditGrantWindow = function ({existingGrants, selectedGrant, includeOwnerRole, cb = Ext.emptyFn}) {\n  const roleComboBox = new SM.RoleComboBox({\n    fieldLabel: 'Role',\n    width: 80,\n    padding: '5 0 0 0',\n    value: selectedGrant.roleId, \n    includeOwnerRole\n  })\n\n  let selectedNode\n  \n  function handleTreeCheck(node) {\n    if (node.attributes.checked) {\n      granteeDisplayField.setValue(renderGranteeNode(node.attributes))\n      selectedNode = node\n    }\n  }\n\n  function onInitialExpandNode(node) {\n    if (node.attributes.id === 'grantee-users-node') {\n      const checkedNode = granteeTp.getNodeById(document.querySelector('input[name=\"rg\"]:checked').parentElement.getAttribute(\"ext:tree-node-id\"))\n      handleTreeCheck(checkedNode)\n      granteeTp.removeListener('expandnode', onInitialExpandNode)\n    }\n  }\n\n  const granteeTp = new SM.Grant.GranteeTreePanel({\n    title: 'Available Grantees',\n    flex: 1,\n    margins: '0 0 10 0',\n    radio: true,\n    // width: 240,\n    existingGrants,\n    selectedGrant,\n    listeners: {\n      checkchange: handleTreeCheck,\n      expandnode: onInitialExpandNode\n    }\n  })\n\n  granteeTp.getSelectionModel().on('beforeselect', function (unused, newNode) {\n    newNode.ui.toggleCheck(true)\n    return false\n  })\n\n  function saveHandler () {\n    const checkedAttributes = selectedNode.attributes\n    const role = roleComboBox.getValue()\n    const modifiedGrant = {\n      roleId: role\n    }\n    modifiedGrant[checkedAttributes.user ? 'userId' : 'userGroupId'] = checkedAttributes.user?.userId|| checkedAttributes.userGroup?.userGroupId\n    cb(modifiedGrant)\n    panelWindow.close()\n  }\n\n  const renderGranteeNode = function (attr) {\n    const icon = attr.user ? 'sm-user-icon' : 'sm-users-icon'\n    const title = attr.user ? attr.user.displayName : attr.userGroup.name\n    const subtitle = attr.user ? attr.user.username : attr.userGroup.description\n    return `<div class=\"${icon}\" style=\"border: #3d4245 1px solid; border-radius: 6px;    background-position:left; background-position-x: 5px; padding: 5px 5px 5px 25px; text-overflow: ellipsis; white-space: nowrap; overflow: hidden;\"><span style=\"font-weight:600;\">${title}</span><br>${subtitle}</div>`\n  }\n\n  const granteeDisplayField = new Ext.form.DisplayField({\n    fieldLabel: 'Grantee',\n    style: 'padding-bottom: 5px;',\n    html: renderGranteeNode({user: {username: '--', displayName: '--'}})\n  })\n\n  const grantPanel = new Ext.Panel({\n    title: 'Modified Grant',\n    headerCssClass: 'sm-selections-panel-header',\n    layout: 'form',\n    layoutConfig: {\n      labelWidth: 50\n    },\n    bodyStyle: 'padding: 9px;',\n    height: 120,\n    items: [\n      granteeDisplayField,\n      roleComboBox\n    ]\n  })\n\n  const panelWindow = new Ext.Window({\n    title: `Edit Grant`,\n    cls: 'sm-dialog-window sm-round-panel',\n    modal: true,\n    hidden: true,\n    width: 350,\n    height: 550,\n    layout: 'vbox',\n    layoutConfig: {\n      align: 'stretch',\n    },\n    plain: true,\n    bodyStyle: 'padding:20px;',\n    buttonAlign: 'right',\n    items: [\n      granteeTp,\n      grantPanel\n    ],\n    buttons: [\n      {\n        text: 'Cancel',\n        handler: () => panelWindow.close()\n      },\n      {\n        text: 'Save',\n        id: 'submit-button',\n        handler: saveHandler\n      }\n    ]\n  })\n  // panelWindow.render(Ext.getBody())\n  // Ext.getBody().unmask()\n  panelWindow.show()\n}\n\nExt.ns('SM.Grant.Api')\n\nSM.Grant.Api.putGrantByCollectionGrant = async function ({collectionId, grantId, body, elevate}) {\n  const params = elevate ? { elevate } : {}\n  const api = await Ext.Ajax.requestPromise({\n    responseType: 'json',\n    url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/grants/${grantId}`,\n    params,\n    method: 'PUT',\n    jsonData: body\n  })\n  SM.Dispatcher.fireEvent('grant.updated', {collectionId, grantId, api})\n  return api\n}\n\nSM.Grant.Api.deleteGrantByCollectionGrant = async function ({collectionId, grantId, elevate}) {\n  const elevateParam = elevate ? '?elevate=true' : ''\n  const api = await Ext.Ajax.requestPromise({\n    responseType: 'json',\n    url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/grants/${grantId}${elevateParam}`,\n    method: 'DELETE'\n  })\n  SM.Dispatcher.fireEvent('grant.deleted', {collectionId, grantId, api})\n  return api\n}\n\nSM.Grant.Api.postGrantsByCollection = async function({collectionId, grants, elevate}) {\n  const params = elevate ? { elevate } : {}\n  const api = await Ext.Ajax.requestPromise({\n    responseType: 'json',\n    url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/grants`,\n    params,\n    method: 'POST',\n    jsonData: grants\n  })\n  SM.Dispatcher.fireEvent('grant.created', {collectionId, api})\n  return api\n}"
  },
  {
    "path": "client/src/js/SM/Inventory.js",
    "content": "Ext.ns('SM.Inventory')\n\nSM.Inventory.CsvArrayDelimiterComboBox = Ext.extend(Ext.form.ComboBox, {\n  initComponent: function () {\n    const config = {\n      width: 120,\n      forceSelection: true,\n      editable: false,\n      mode: 'local',\n      triggerAction: 'all',\n      displayField: 'display',\n      valueField: 'delimiter',\n      store: new Ext.data.SimpleStore({\n        fields: ['display', 'delimiter'],\n        data: [['Comma', ','], ['Comma and space', ', '], ['Newline', '\\n']]\n      }),\n      value: this.value || ','\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Inventory.CsvAssetFieldSet = Ext.extend(Ext.form.FieldSet, {\n  initComponent: function () {\n    const _this = this\n\n    const nameCheckbox = new Ext.form.Checkbox({\n      boxLabel: 'Name',\n      csvField: {\n        apiProperty: 'name',\n        header: 'Name'\n      },\n      checked: this.state.name,\n      listeners: {\n        check: handleCheckboxes\n      }\n    })\n    const fqdnCheckbox = new Ext.form.Checkbox({\n      boxLabel: 'FQDN',\n      csvField: {\n        apiProperty: 'fqdn',\n        header: 'FQDN'\n      },\n      checked: this.state.fqdn,\n      listeners: {\n        check: handleCheckboxes\n      }\n    })\n    const ipCheckbox = new Ext.form.Checkbox({\n      boxLabel: 'IP',\n      csvField: {\n        apiProperty: 'ip',\n        header: 'IP'\n      },\n      checked: this.state.ip,\n      listeners: {\n        check: handleCheckboxes\n      }\n    })\n    const macCheckbox = new Ext.form.Checkbox({\n      boxLabel: 'MAC',\n      csvField: {\n        apiProperty: 'mac',\n        header: 'MAC'\n      },\n      checked: this.state.mac,\n      listeners: {\n        check: handleCheckboxes\n      }\n    })\n    const descriptionCheckbox = new Ext.form.Checkbox({\n      boxLabel: 'Description',\n      csvField: {\n        apiProperty: 'description',\n        header: 'Description'\n      },\n      checked: this.state.description,\n      listeners: {\n        check: handleCheckboxes\n      }\n    })\n    const stigsCheckbox = new Ext.form.Checkbox({\n      boxLabel: 'STIGs',\n      csvField: {\n        apiProperty: 'stigs',\n        header: 'STIGs',\n        delimitedProperty: 'benchmarkId',\n        delimiter: this.state.stigsDelimiter\n      },\n      checked: this.state.stigs,\n      listeners: {\n        check: handleCheckboxes\n      }\n    })\n    const checkboxGroup = new Ext.form.CheckboxGroup({\n      hideLabel: true,\n      columns: [70, 70, 50, 60, 100, 60],\n      items: [\n        nameCheckbox,\n        fqdnCheckbox,\n        ipCheckbox,\n        macCheckbox,\n        descriptionCheckbox,\n        stigsCheckbox\n      ]\n    })\n    const delimiterComboBox = new SM.Inventory.CsvArrayDelimiterComboBox({\n      fieldLabel: 'STIGs delimited by',\n      disabled: !this.state.stigs,\n      value: this.state.stigsDelimiter,\n      listeners: {\n        select: (cb) => stigsCheckbox.csvField.delimiter = cb.getValue()\n      }\n    })\n\n    function getFieldOptions() {\n      return checkboxGroup.getValue().map(cb => cb.csvField)\n    }\n\n    function handleCheckboxes() {\n      delimiterComboBox.setDisabled(!stigsCheckbox.getValue())\n      const event = nameCheckbox.getValue() || fqdnCheckbox.getValue() ? 'valid' : 'invalid'\n      _this.fireEvent(event, _this)\n    }\n\n    const config = {\n      title: this.title || 'CSV fields',\n      labelWidth: 120,\n      autoHeight: true,\n      getFieldOptions,\n      nameCheckbox,\n      fqdnCheckbox,\n      ipCheckbox,\n      macCheckbox,\n      descriptionCheckbox,\n      stigsCheckbox,\n      checkboxGroup,\n      delimiterComboBox,\n      items: [\n        checkboxGroup,\n        delimiterComboBox\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Inventory.CsvStigFieldSet = Ext.extend(Ext.form.FieldSet, {\n  initComponent: function () {\n    const _this = this\n\n    const benchmarkCheckbox = new Ext.form.Checkbox({\n      boxLabel: 'Benchmark',\n      csvField: {\n        apiProperty: 'benchmarkId',\n        header: 'Benchmark'\n      },\n      checked: this.state.benchmarkId,\n      listeners: {\n        check: handleCheckboxes\n      }\n    })\n    const titleCheckbox = new Ext.form.Checkbox({\n      boxLabel: 'Title',\n      csvField: {\n        apiProperty: 'title',\n        header: 'Title'\n      },\n      checked: this.state.title,\n      listeners: {\n        check: handleCheckboxes\n      }\n    })\n    const revisionCheckbox = new Ext.form.Checkbox({\n      boxLabel: 'Revision',\n      csvField: {\n        apiProperty: 'revisionStr',\n        header: 'Revision'\n      },\n      checked: this.state.revisionStr,\n      listeners: {\n        check: handleCheckboxes\n      }\n    })\n    const dateCheckbox = new Ext.form.Checkbox({\n      boxLabel: 'Date',\n      csvField: {\n        apiProperty: 'benchmarkDate',\n        header: 'Date'\n      },\n      checked: this.state.date,\n      listeners: {\n        check: handleCheckboxes\n      }\n    })\n    const assetsCheckbox = new Ext.form.Checkbox({\n      boxLabel: 'Assets',\n      csvField: {\n        apiProperty: 'assets',\n        header: 'Assets',\n        delimitedProperty: 'name',\n        delimiter: this.state.assetsDelimiter\n      },\n      checked: this.state.assets,\n      listeners: {\n        check: handleCheckboxes\n      }\n    })\n    const checkboxGroup = new Ext.form.CheckboxGroup({\n      hideLabel: true,\n      columns: [100, 70, 85, 70, 70],\n      items: [\n        benchmarkCheckbox,\n        titleCheckbox,\n        revisionCheckbox,\n        dateCheckbox,\n        assetsCheckbox\n      ]\n    })\n    const delimiterComboBox = new SM.Inventory.CsvArrayDelimiterComboBox({\n      fieldLabel: 'Assets delimited by',\n      disabled: !this.state.assets,\n      value: this.state.assetsDelimiter,\n      listeners: {\n        select: (cb) => assetsCheckbox.csvField.delimiter = cb.getValue()\n      }\n    })\n\n    function getFieldOptions() {\n      return checkboxGroup.getValue().map(cb => cb.csvField)\n    }\n\n    function handleCheckboxes() {\n      delimiterComboBox.setDisabled(!assetsCheckbox.getValue())\n      const event = benchmarkCheckbox.getValue() || titleCheckbox.getValue() ? 'valid' : 'invalid'\n      _this.fireEvent(event, _this)\n    }\n\n    const config = {\n      title: this.title || 'CSV fields',\n      labelWidth: 120,\n      autoHeight: true,\n      getFieldOptions,\n      benchmarkCheckbox,\n      titleCheckbox,\n      revisionCheckbox,\n      dateCheckbox,\n      assetsCheckbox,\n      checkboxGroup,\n      delimiterComboBox,\n      items: [\n        checkboxGroup,\n        delimiterComboBox\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Inventory.JsonOptionsFieldSet = Ext.extend(Ext.form.FieldSet, {\n  initComponent: function () {\n    const _this = this\n\n    const projectionCheckbox = new Ext.form.Checkbox({\n      boxLabel: `Include list of ${this.groupBy === 'stig' ? 'Assets' : 'STIGs'} for each ${this.groupBy === 'stig' ? 'STIG' : 'Asset'}`,\n      hideLabel: true,\n      checked: this.projection ?? true\n    })\n    const prettyPrintCheckbox = new Ext.form.Checkbox({\n      boxLabel: 'Pretty print with line breaks and indentation',\n      hideLabel: true,\n      checked: this.prettyPrint ?? false\n    })\n    function getFieldOptions() {\n      return {\n        projection: projectionCheckbox.getValue(),\n        prettyPrint: prettyPrintCheckbox.getValue()\n      }\n    }\n\n    const config = {\n      title: this.title || 'JSON options',\n      hideLabel: true,\n      autoHeight: true,\n      getFieldOptions,\n      projectionCheckbox,\n      prettyPrintCheckbox,\n      items: [\n        projectionCheckbox,\n        prettyPrintCheckbox\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Inventory.ExportOptionsWindow = Ext.extend(Ext.Window, {\n  initComponent: function () {\n    const _this = this\n    if (!this.collectionId || !this.collectionName) throw ('Missing collectionId or collectionName')\n    const localStorageItem = 'inventoryExportOptions'\n    const state = getState()\n    // Group by: and Format:\n    const groupByRadioGroup = new Ext.form.RadioGroup({\n      fieldLabel: 'Group by',\n      columns: [70, 70],\n      items: [\n        {\n          boxLabel: 'STIG',\n          name: 'groupBy',\n          groupBy: 'stig',\n          itemField: 'asset',\n          checked: state.groupBy === 'stig'\n        },\n        {\n          boxLabel: 'Asset',\n          name: 'groupBy',\n          groupBy: 'asset',\n          checked: state.groupBy === 'asset'\n        }\n      ],\n      listeners: {\n        change: updateDisplay\n      }\n    })\n    const formatRadioGroup = new Ext.form.RadioGroup({\n      fieldLabel: 'Format',\n      columns: [70, 70],\n      items: [\n        {\n          boxLabel: 'CSV',\n          name: 'format',\n          format: 'csv',\n          checked: state.format === 'csv'\n        },\n        {\n          boxLabel: 'JSON',\n          name: 'format',\n          format: 'json',\n          checked: state.format === 'json'\n        }\n      ],\n      listeners: {\n        change: updateDisplay\n      }\n    })\n    // CSV fields for group by asset\n    const csvAssetFieldSet = new SM.Inventory.CsvAssetFieldSet({\n      state,\n      listeners: {\n        valid: () => exportButton.enable(),\n        invalid: () => exportButton.disable()\n      }\n    })\n    // CSV fields for group by stig\n    const csvStigFieldSet = new SM.Inventory.CsvStigFieldSet({\n      state,\n      listeners: {\n        valid: () => exportButton.enable(),\n        invalid: () => exportButton.disable()\n      }\n    })\n    // JSON options for group by asset\n    const jsonAssetFieldSet = new SM.Inventory.JsonOptionsFieldSet({\n      projection: state.stigProjection,\n      prettyPrint: state.jsonAssetPrettyPrint,\n      groupBy: 'asset'\n    })\n    // JSON options for group by stig\n    const jsonStigFieldSet = new SM.Inventory.JsonOptionsFieldSet({\n      projection: state.assetProjection,\n      prettyPrint: state.jsonStigPrettyPrint,\n      groupBy: 'stig'\n    })\n    // Button\n    const exportButton = new Ext.Button({\n      text: 'Export',\n      iconCls: 'sm-export-icon',\n      disabled: false,\n      handler: exportHandler\n    })\n    // Functions\n    async function fetchApiDataAsText(groupBy, includeProjection, baseParams = {}) {\n      const requests = {\n        asset: {\n          url: `${STIGMAN.Env.apiBase}/assets`,\n          params: { collectionId: _this.collectionId, ...baseParams }\n        },\n        stig: {\n          url: `${STIGMAN.Env.apiBase}/collections/${_this.collectionId}/stigs`,\n          params: {...baseParams}\n        }\n      }\n      if (includeProjection) {\n        requests.asset.params.projection = 'stigs'\n        requests.stig.params.projection = 'assets'\n      }\n      const result = await Ext.Ajax.requestPromise({\n        method: 'GET',\n        url: requests[groupBy].url,\n        params: requests[groupBy].params\n      })\n      return result.response.responseText\n    }\n    async function exportHandler() {\n      try {\n        _this.getEl().mask('')\n        setState()\n        const groupItem = groupByRadioGroup.getValue()\n        const formatItem = formatRadioGroup.getValue()\n        let downloadData\n        if (formatItem.format === 'csv') {\n          const csvFields = groupItem.groupBy === 'asset' ? csvAssetFieldSet.getFieldOptions() : csvStigFieldSet.getFieldOptions()\n          const requestProjection = csvFields.some(item => item.apiProperty === 'stigs' || item.apiProperty === 'assets')\n          const apiText = await fetchApiDataAsText(groupItem.groupBy, requestProjection, _this.baseParams)\n          downloadData = new Blob([SM.Inventory.apiToCsv(JSON.parse(apiText), csvFields)])\n        }\n        else {\n          const options = (groupItem.groupBy === 'asset' ? jsonAssetFieldSet : jsonStigFieldSet).getFieldOptions()\n          const apiText = await fetchApiDataAsText(groupItem.groupBy, options.projection, _this.baseParams)\n          if (options.prettyPrint) {\n            downloadData = new Blob([JSON.stringify(JSON.parse(apiText), null, 2)])\n          }\n          else {\n            downloadData = new Blob([apiText])\n          }\n        }\n        const timestamp = Ext.util.Format.date((new Date), 'Y-m-d_His')\n        saveAs(downloadData, `${_this.collectionName}_InventoryBy${groupItem.boxLabel}_${timestamp}.${formatItem.format}`)\n      }\n      catch (e) {\n        SM.Error.handleError(e)\n      }\n      finally {\n        _this.close()\n      }\n    }\n    function updateDisplay() {\n      if (formatRadioGroup.getValue().format === 'json') {\n        csvAssetFieldSet.hide()\n        csvStigFieldSet.hide()\n        if (groupByRadioGroup.getValue().groupBy === 'stig') {\n          jsonAssetFieldSet.hide()\n          jsonStigFieldSet.show()\n        }\n        else {\n          jsonAssetFieldSet.show()\n          jsonStigFieldSet.hide()\n        }\n      }\n      else {\n        jsonAssetFieldSet.hide()\n        jsonStigFieldSet.hide()\n        if (groupByRadioGroup.getValue().groupBy === 'stig') {\n          csvAssetFieldSet.hide()\n          csvStigFieldSet.show()\n        }\n        else {\n          csvAssetFieldSet.show()\n          csvStigFieldSet.hide()\n        }\n      }\n    }\n    function getState() {\n      const defaults = {\n        groupBy: 'stig',\n        format: 'csv',\n        benchmarkId: true,\n        title: true,\n        revisionStr: true,\n        date: true,\n        assets: true,\n        assetsDelimiter: ',',\n        name: true,\n        fqdn: true,\n        ip: true,\n        mac: true,\n        description: true,\n        stigs: true,\n        stigsDelimiter: ',',\n        jsonAssetStigProjection: true,\n        jsonAssetPrettyPrint: false,\n        jsonStigAssetProjection: true,\n        jsonStigPrettyPrint: false\n      }\n      const storageValue = SM.safeJSONParse(localStorage.getItem(localStorageItem))\n      return storageValue ? Object.assign({}, defaults, storageValue) : defaults\n    }\n    function setState() {\n      const state = {\n        groupBy: groupByRadioGroup.getValue().groupBy,\n        format: formatRadioGroup.getValue().format,\n        benchmarkId: csvStigFieldSet.benchmarkCheckbox.checked,\n        title: csvStigFieldSet.titleCheckbox.checked,\n        revisionStr: csvStigFieldSet.revisionCheckbox.checked,\n        date: csvStigFieldSet.dateCheckbox.checked,\n        assets: csvStigFieldSet.assetsCheckbox.checked,\n        assetsDelimiter: csvStigFieldSet.delimiterComboBox.getValue(),\n        name: csvAssetFieldSet.nameCheckbox.checked,\n        fqdn: csvAssetFieldSet.fqdnCheckbox.checked,\n        ip: csvAssetFieldSet.ipCheckbox.checked,\n        mac: csvAssetFieldSet.macCheckbox.checked,\n        description: csvAssetFieldSet.descriptionCheckbox.checked,\n        stigs: csvAssetFieldSet.stigsCheckbox.checked,\n        stigsDelimiter: csvAssetFieldSet.delimiterComboBox.getValue(),\n        jsonStigAssetProjection: jsonStigFieldSet.projectionCheckbox.checked,\n        jsonStigPrettyPrint: jsonStigFieldSet.prettyPrintCheckbox.checked,\n        jsonAssetStigProjection: jsonAssetFieldSet.projectionCheckbox.checked,\n        jsonAssetPrettyPrint: jsonAssetFieldSet.prettyPrintCheckbox.checked\n      }\n      localStorage.setItem(localStorageItem, JSON.stringify(state))\n    }\n\n    const config = {\n      layout: 'form',\n      padding: 10,\n      items: [\n        groupByRadioGroup,\n        formatRadioGroup,\n        csvAssetFieldSet,\n        csvStigFieldSet,\n        jsonAssetFieldSet,\n        jsonStigFieldSet\n      ],\n      buttons: [exportButton],\n      listeners: {\n        beforeshow: updateDisplay\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Inventory.apiToCsv = function (apiData, csvFields) {\n  // Function to apply double-quote escaping\n  const quotify = (string) => `\"${string.replace(/\"/g, '\"\"')}\"`\n  // Initialize data\n  const csvData = []\n  // Header\n  const header = []\n  for (const field of csvFields) {\n    header.push(quotify(field.header))\n  }\n  csvData.push(header.join(','))\n  // Rows\n  for (const data of apiData) {\n    const row = []\n    for (const field of csvFields) {\n      if (field.delimiter) {\n        row.push(quotify(data[field.apiProperty].map(i => i[field.delimitedProperty]).join(field.delimiter)))\n      }\n      else {\n        row.push(quotify(data[field.apiProperty] ?? ''))\n      }\n    }\n    csvData.push(row.join(','))\n  }\n  return csvData.join('\\n')\n}\n\nSM.Inventory.showInventoryExportOptions = function (collectionId, collectionName, baseParams) {\n  const optionsWindow = new SM.Inventory.ExportOptionsWindow({\n    title: 'Inventory export options',\n    modal: true,\n    width: 460,\n    collectionId,\n    collectionName,\n    baseParams\n  })\n  optionsWindow.show()\n}"
  },
  {
    "path": "client/src/js/SM/Job.js",
    "content": "Ext.ns('SM.Job')\n\nSM.Job.JobsGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    const runNowFn = this.runNowFn || async function () { }\n\n    const fields = ['jobId', 'name', 'description', 'created', 'updated', 'tasks', 'event', 'runCount', 'lastRun',\n      {\n        name: 'createdBy',\n        convert: function (v, record) {\n          return record.createdBy?.username ?? ''\n        }\n      },\n      {\n        name: 'updatedBy',\n        convert: function (v, record) {\n          return record.updatedBy?.username ?? ''\n        }\n      }\n    ]\n    const columns = [\n      {\n        header: '<span class=\"sm-job-icon sm-icon-column\">Name</span>', dataIndex: 'name', width: 150, sortable: true, renderer: function (v, m, r) {\n          return `<span class=\"sm-job-sprite sm-job-run-state-${r.data.lastRun?.state ?? 'missing'}\">${v}</span>`\n        }\n      },\n      {\n        header: '<span class=\"sm-user-icon sm-icon-column\">Created By</span>', dataIndex: 'createdBy', width: 100, sortable: true, renderer: function (v) {\n          return v || '<i>system</i>'\n        }\n      },\n      { header: '<span class=\"sm-job-icon sm-icon-column\">Description</span>', dataIndex: 'description', hidden: true, width: 250, sortable: false },\n      {\n        header: '<span class=\"sm-job-task-icon sm-icon-column\">Tasks</span>', dataIndex: 'tasks', width: 200, sortable: false, renderer: function (v) {\n          if (v?.length) {\n            return v.map(t => t.name).join('<br>')\n          }\n          return ''\n        }\n      },\n      {\n        header: '<span class=\"sm-job-event-icon sm-icon-column\">Schedule</span>', dataIndex: 'event', width: 200, sortable: false, renderer: function (v) {\n          let html = ''\n          if (v) {\n            if (v.type === 'recurring') {\n              html = `Every ${v.interval.value} ${v.interval.field}(s)<br>Starting ${Ext.util.Format.date(v.starts, 'Y-m-d H:i:s T')}${v.enabled ? '' : '<br>DISABLED'} `\n            }\n            else if (v.type === 'once') {\n              html = `Once at ${Ext.util.Format.date(v.starts, 'Y-m-d H:i:s T')}`\n            }\n          }\n          return `<span class=\"${v?.enabled ? '' : 'sm-job-event-disabled'}\">${html}</span>`\n        }\n      },\n      { header: '<span class=\"sm-job-run-icon sm-icon-column\">Runs</span>', dataIndex: 'runCount', width: 150, sortable: true },\n      {\n        header: '<span class=\"sm-job-run-icon sm-icon-column\">Last Run</span>', dataIndex: 'lastRun', width: 150, sortable: true, renderer: function (v) {\n          return v ? `<span class=\"sm-job-sprite sm-job-run-state-${v.state}\">${v.state}</span><br>${Ext.util.Format.date(v.created || v.updated, 'Y-m-d H:i:s T')}<br>` : '-';\n        },\n      },\n      { header: '<span class=\"sm-job-icon sm-icon-column\">Created</span>', dataIndex: 'created', hidden: true, width: 100, sortable: true },\n      { header: '<span class=\"sm-job-icon sm-icon-column\">Updated</span>', dataIndex: 'updated', hidden: true, width: 150, sortable: true },\n      { header: '<span class=\"sm-user-icon sm-icon-column\">Updated By</span>', dataIndex: 'updatedBy', hidden: true, width: 150, sortable: true },\n    ]\n\n    const store = new Ext.data.JsonStore({\n      proxy: new Ext.data.HttpProxy({\n        url: `${STIGMAN.Env.apiBase}/jobs`,\n        method: 'GET'\n      }),\n      baseParams: {\n        elevate: curUser.privileges.admin\n      },\n      root: '',\n      fields,\n      idProperty: 'jobId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      },\n      listeners: {\n        load: function () {\n          // _this.selModel.selectRow(0)\n        }\n      }\n    })\n    const totalTextCmp = new SM.RowCountTextItem({ store })\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true,\n    })\n\n    sm.on('rowselect', function (sm, rowIndex, record) {\n      _this.modifyBtn.setDisabled(false)\n      _this.removeBtn.setDisabled(!record.data.createdBy)\n      _this.runNowBtn.setDisabled(false)\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      forceFit: true,\n      emptyText: 'No jobs found',\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        },\n        // These listeners keep the grid in the same scroll position after the store is reloaded\n        beforerefresh: function (v) {\n          v.scrollTop = v.scroller.dom.scrollTop;\n          v.scrollHeight = v.scroller.dom.scrollHeight;\n        },\n        refresh: function (v) {\n          setTimeout(function () {\n            v.scroller.dom.scrollTop = v.scrollTop + (v.scrollTop == 0 ? 0 : v.scroller.dom.scrollHeight - v.scrollHeight);\n          }, 100);\n        }\n      },\n      deferEmptyText: false,\n      getRowClass: function (record) {\n        if (record.data.lastRun?.state == 'failed') {\n          return 'sm-grid3-row-error';\n        }\n      }\n    })\n\n    const tbar = [\n      {\n        iconCls: 'icon-add',\n        text: 'Create',\n        handler: function () {\n          Ext.getBody().mask('');\n          SM.Job.showJobProps(0);\n        }\n      },\n      '-',\n      {\n        ref: '../removeBtn',\n        iconCls: 'icon-del',\n        disabled: true,\n        text: 'Remove',\n        handler: function () {\n          let job = _this.getSelectionModel().getSelected();\n          let buttons = { yes: 'Remove', no: 'Cancel' }\n          let confirmStr = `Remove <b>${job.data.name}</b>?<br><br>This action will remove the Job's scheduled events and run output.`;\n\n          Ext.Msg.show({\n            title: 'Confirm remove action',\n            icon: Ext.Msg.WARNING,\n            msg: confirmStr,\n            buttons: buttons,\n            fn: async function (btn, text) {\n              try {\n                if (btn == 'yes') {\n                  await Ext.Ajax.requestPromise({\n                    responseType: 'json',\n                    url: `${STIGMAN.Env.apiBase}/jobs/${job.data.jobId}?elevate=${curUser.privileges.admin}`,\n                    method: 'DELETE',\n                  })\n                  store.reload()\n                }\n              }\n              catch (e) {\n                SM.Error.handleError(e)\n              }\n            }\n          })\n        },\n      },\n      '-',\n      {\n        ref: '../modifyBtn',\n        iconCls: 'icon-edit',\n        text: 'Modify',\n        disabled: true,\n        handler: function () {\n          const r = _this.getSelectionModel().getSelected();\n          Ext.getBody().mask('Getting properties...');\n          SM.Job.showJobProps(r.get('jobId'));\n        }\n      },\n      '-',\n      {\n        ref: '../runNowBtn',\n        iconCls: 'sm-job-run-icon',\n        text: 'Run now...',\n        disabled: true,\n        handler: runNowFn\n      }\n    ]\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'tbbutton',\n          iconCls: 'icon-refresh',\n          tooltip: 'Reload this grid',\n          width: 20,\n          handler: function (btn) {\n            store.reload()\n          }\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          gridBasename: 'Job-Info',\n          exportType: 'grid',\n          iconCls: 'sm-export-icon',\n          text: 'CSV',\n          grid: this\n        },\n        {\n          xtype: 'tbfill'\n        }, {\n          xtype: 'tbseparator'\n        },\n        totalTextCmp\n      ]\n    })\n\n    const listeners = {\n      rowdblclick: function (grid, rowIndex) {\n        const r = _this.getSelectionModel().getSelected();\n        Ext.getBody().mask('Getting properties...');\n        SM.Job.showJobProps(r.get('jobId'));\n      }\n    }\n\n    const config = {\n      store,\n      columns,\n      sm,\n      view,\n      tbar,\n      bbar,\n      listeners,\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Job.RunsGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    \n    function dateRenderWithToolbar(v, md) {\n      return `\n      <div class=\"sm-grid-cell-with-toolbar\">\n        <div class=\"sm-dynamic-width\">\n          <div class=\"sm-info\">${Ext.util.Format.date(v, 'Y-m-d H:i:s.u T')}</div>\n        </div>\n        <div class=\"sm-static-width\"><img class=\"sm-grid-cell-toolbar-edit\" ext:qtip=\"Delete run\" src=\"img/trash.svg\" width=\"14\" height=\"14\"></div>\n      </div>`\n    }\n\n    function rowmousedown(grid, rowIndex, e) {\n      if (e.target.className === \"sm-grid-cell-toolbar-edit\") {\n        const r = grid.getStore().getAt(rowIndex)\n        console.log('delete run', r.data.runId)\n        _this.fireEvent('deleterun', r.data.runId)\n        return false\n      }\n      return true\n    }\n\n    const fields = [\n      'runId',\n      'state',\n      'created',\n      'updated',\n      {\n        name: 'duration',\n        convert: function (v, record) {\n          if (record.state !== 'running') {\n            return new Date(record.updated) - new Date(record.created)\n          }\n          return null\n        }\n      }\n    ]\n    const columns = [\n      { header: 'Started', dataIndex: 'created', width: 200, sortable: true, renderer: dateRenderWithToolbar },\n      {\n        header: 'State', dataIndex: 'state', width: 100, sortable: true, renderer: function (v) {\n          return `<span class=\"sm-job-sprite sm-job-run-state-${v}\">${v}</span>`\n        }\n      },\n      { header: 'Duration', dataIndex: 'duration', width: 70, sortable: true }\n    ]\n\n    const store = new Ext.data.JsonStore({\n      root: '',\n      fields,\n      idProperty: 'runId',\n      sortInfo: {\n        field: 'created',\n        direction: 'DESC'\n      },\n      listeners: {\n        load: function () {\n          _this.selModel.selectRow(0)\n        }\n      }\n    })\n    const totalTextCmp = new SM.RowCountTextItem({ store })\n\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      forceFit: true,\n      emptyText: 'No runs found',\n      cellSelectorDepth: 5, // supports the cell toolbar\n      listeners: {\n        // filterschanged: function (view) {\n        //   store.filter(view.getFilterFns())\n        // },\n        // // These listeners keep the grid in the same scroll position after the store is reloaded\n        // beforerefresh: function (v) {\n        //   v.scrollTop = v.scroller.dom.scrollTop;\n        //   v.scrollHeight = v.scroller.dom.scrollHeight;\n        // },\n        // refresh: function (v) {\n        //   setTimeout(function () {\n        //     v.scroller.dom.scrollTop = v.scrollTop + (v.scrollTop == 0 ? 0 : v.scroller.dom.scrollHeight - v.scrollHeight);\n        //   }, 100);\n        // }\n      },\n      deferEmptyText: false\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          gridBasename: 'runs',\n          exportType: 'grid',\n          iconCls: 'sm-export-icon',\n          text: 'CSV',\n          grid: this\n        },\n        {\n          xtype: 'tbfill'\n        }, {\n          xtype: 'tbseparator'\n        },\n        totalTextCmp\n      ]\n    })\n\n    const listeners = {\n      rowmousedown,\n    }\n\n    const config = {\n      store,\n      columns,\n      sm,\n      view,\n      bbar,\n      listeners,\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n\n})\n\nSM.Job.RunOutputGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = ['seq', 'type', 'message', 'task', 'ts']\n    const columns = [\n      { header: 'Seq', dataIndex: 'seq', width: 50, sortable: true },\n      { header: 'Timestamp', xtype: 'datecolumn', format: 'Y-m-d H:i:s.u T', dataIndex: 'ts', width: 150, sortable: true },\n      { header: 'Task', dataIndex: 'task', width: 120, sortable: true },\n      {\n        header: 'Type', dataIndex: 'type', width: 50, sortable: true, renderer: function (v) {\n          return v === 'error' ? '<span style=\"color: red;\">' + v + '</span>' : v;\n        }\n      },\n      {\n        header: 'Message', dataIndex: 'message', width: 300, sortable: true, renderer: function (v, m, r) {\n          m.attr = 'style=\"white-space:normal;\"'\n          return v ? `<div exportValue=\"${v}\">${Ext.util.Format.htmlEncode(v)}</div>` : '';\n        }\n      },\n    ]\n    const store = new Ext.data.JsonStore({\n      root: '',\n      fields,\n      idProperty: 'seq',\n      sortInfo: {\n        field: 'seq',\n        direction: 'DESC'\n      },\n    })\n    const totalTextCmp = new SM.RowCountTextItem({ store })\n    const view = new SM.ColumnFilters.GridView({\n      forceFit: true,\n      emptyText: 'No output found',\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      }\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          gridBasename: 'Job-Run-Output',\n          exportType: 'grid',\n          iconCls: 'sm-export-icon',\n          text: 'CSV',\n          grid: this\n        },\n        {\n          xtype: 'tbfill'\n        }, {\n          xtype: 'tbseparator'\n        },\n        totalTextCmp\n      ]\n    })\n\n    const config = {\n      store,\n      columns,\n      view,\n      bbar,\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Job.RunsPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const runsGrid = new SM.Job.RunsGrid({\n      region: 'west',\n      title: 'Recent Runs',\n      border: false,\n      width: '25%',\n      split: true,\n      minWidth: 200,\n      maxWidth: 600,\n      iconCls: 'sm-job-run-icon',\n      margins: { top: SM.Margin.top, right: SM.Margin.adjacent, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n      cls: 'sm-round-panel',\n      loadMask: true,\n      listeners: {\n        deleterun: (runId) => this.fireEvent('deleterun', runId)\n      }\n    })\n\n    const outputGrid = new SM.Job.RunOutputGrid({\n      region: 'center',\n      title: 'Runtime Output',\n      border: false,\n      margins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.adjacent },\n      loadMask: true,\n      iconCls: 'sm-run-output-icon',\n      cls: 'sm-round-panel',\n    })\n\n    runsGrid.getSelectionModel().on('rowselect', async function (sm, rowIndex, record) {\n      const response = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/jobs/runs/${record.data.runId}/output`,\n        params: { elevate: curUser.privileges.admin },\n        method: 'GET',\n      })\n      outputGrid.getStore().loadData(response)\n    })\n\n    const config = {\n      layout: 'border',\n      bodyStyle: 'background-color:transparent;',\n      border: false,\n      items: [runsGrid, outputGrid],\n      runsGrid,\n      outputGrid,\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Job.SchedulePanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const intervalValue = new Ext.form.NumberField({\n      fieldLabel: 'Value',\n      name: 'intervalValue',\n      value: 1,\n      minValue: 1,\n      maxValue: 365,\n      width: 30,\n      allowBlank: false,\n      allowDecimals: false,\n      allowNegative: false,\n      listeners: {\n        change: function (nf, newVal, oldVal) {\n          if (newVal < 1) nf.setValue(1)\n          if (newVal > 365) nf.setValue(365)\n        }\n      }\n    })\n\n    const intervalField = new Ext.form.ComboBox({\n      fieldLabel: 'Field',\n      name: 'intervalField',\n      store: new Ext.data.ArrayStore({\n        fields: ['value', 'display'],\n        data: [\n          ['minute', 'Minute(s)'],\n          ['hour', 'Hour(s)'],\n          ['day', 'Day(s)'],\n          ['week', 'Week(s)'],\n          ['month', 'Month(s)'],\n        ]\n      }),\n      valueField: 'value',\n      displayField: 'display',\n      mode: 'local',\n      triggerAction: 'all',\n      editable: false,\n      selectOnFocus: true,\n      forceSelection: true,\n      value: 'day',\n      width: 75,\n      allowBlank: false,\n    })\n\n    const intervalComposite = new Ext.form.CompositeField({\n      fieldLabel: 'Repeat Every',\n      labelWidth: 120,\n      items: [\n        intervalValue,\n        intervalField\n      ]\n    })\n\n    const startTime = new Ext.form.TimeField({\n      fieldLabel: 'Start Time',\n      name: 'dailyTime',\n      value: '00:00',\n      format: 'H:i',\n      width: 110,\n    })\n\n    const startDate = new Ext.form.DateField({\n      fieldLabel: 'Start Date',\n      name: 'dailyDate',\n      value: new Date(),\n      format: 'D Y-m-d',\n      width: 110,\n      editable: false,\n      listeners: {\n        select: function (df, date) {\n        }\n      }\n    })\n\n    const frequencyCombo = new Ext.form.ComboBox({\n      fieldLabel: 'Frequency',\n      name: 'frequency',\n      store: new Ext.data.ArrayStore({\n        fields: ['value', 'display'],\n        data: [\n          ['none', 'None'],\n          ['recurring', 'Recurring'],\n          ['once', 'One Time'],\n        ]\n      }),\n      valueField: 'value',\n      displayField: 'display',\n      mode: 'local',\n      triggerAction: 'all',\n      editable: false,\n      selectOnFocus: true,\n      forceSelection: true,\n      value: 'recurring',\n      width: 110,\n      listeners: {\n        select: function (cb, record, index) {\n          if (cb.getValue() === 'recurring') {\n            enabledCheckbox.show()\n            intervalComposite.show()\n            startDate.show()\n            startTime.show()\n          }\n          else if (cb.getValue() === 'once') {\n            enabledCheckbox.hide()\n            intervalComposite.hide()\n            startDate.show()\n            startTime.show()\n          }\n          else if (cb.getValue() === 'none') {\n            enabledCheckbox.hide()\n            intervalComposite.hide()\n            startDate.hide()\n            startTime.hide()\n          }\n        }\n      }\n    })\n\n    const enabledCheckbox = new Ext.form.Checkbox({\n      boxLabel: 'Enabled',\n      name: 'enabled',\n      checked: true,\n    })\n\n    const initPanel = function (apiJob) {\n      const event = apiJob?.event\n      if (!event) {\n        frequencyCombo.setValue('none')\n        intervalComposite.hide()\n        enabledCheckbox.hide()\n        startDate.hide()\n        startTime.hide()\n        return\n      }\n      if (event.type === 'once') {\n        frequencyCombo.setValue('once')\n        intervalComposite.hide()\n        enabledCheckbox.hide()\n        startDate.setValue(new Date(event.starts))\n        startTime.setValue(new Date(event.starts))\n        return\n      }\n      if (event.type === 'recurring') {\n        frequencyCombo.setValue('recurring')\n        intervalValue.setValue(event.interval.value)\n        intervalField.setValue(event.interval.field)\n        enabledCheckbox.setValue(event.enabled)\n        startDate.setValue(new Date(event.starts))\n        startTime.setValue(new Date(event.starts))\n      }\n    }\n\n    const getValue = function () {\n      if (frequencyCombo.getValue() === 'none') {\n        return null\n      }\n      const dateValue = startDate.getValue()\n      const [hour, minute] = startTime.getValue().split(':')\n      const combinedValue = new Date(\n        dateValue.getFullYear(),\n        dateValue.getMonth(),\n        dateValue.getDate(),\n        hour,\n        minute,\n        0\n      )\n      const event = {\n        type: frequencyCombo.getValue(),\n        starts: combinedValue.toISOString()\n      }\n      if (event.type === 'recurring') {\n        event.interval = {\n          value: intervalValue.getValue().toString(),\n          field: intervalField.getValue(),\n        }\n        event.enabled = enabledCheckbox.getValue()\n      }\n      return event\n    }\n\n    const config = {\n      // layout: 'form',\n      items: [\n        {\n          layout: 'column',\n          border: false,\n          items: [\n            {\n              columnWidth: 0.5,\n              layout: 'form',\n              border: false,\n              labelWidth: 80,\n              items: [frequencyCombo, intervalComposite, enabledCheckbox]\n            },\n            {\n              columnWidth: 0.5,\n              layout: 'form',\n              border: false,\n              labelWidth: 80,\n              items: [startDate, startTime]\n            }\n          ]\n        }\n      ],\n      initPanel,\n      getValue,\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Job.TaskSelectingGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const isSortable = this.isSortable || false\n    const fields = [\n      'taskId',\n      'name',\n      'description',\n    ]\n    const sm = this.isSystemJob ? new Ext.grid.RowSelectionModel() : new Ext.grid.CheckboxSelectionModel({\n      singleSelect: false,\n      checkOnly: false,\n      listeners: {\n        selectionchange: function (sm) {\n          SM.SetCheckboxSelModelHeaderState(sm)\n        }\n      }\n    })\n    const columns = [\n      {\n        header: \"Task\",\n        width: 150,\n        dataIndex: 'name',\n        sortable: isSortable === true,\n        renderer: function (v, m, r) {\n          m.attr = 'style=\"white-space:normal;\"'\n          return `<div exportValue=\"${r.data.name ?? ''}:${r.data.description ?? ''}\"><span style=\"font-weight:700;\">${r.data.name ?? ''}</span><br>\n          <div class=\"sm-task-description\">${r.data.description ?? ''}</div></div>`\n        }\n      },\n    ]\n    if (this.isSystemJob !== true) {\n      columns.unshift(sm)\n    }\n    const store = new Ext.data.JsonStore({\n      fields,\n      idProperty: 'taskId',\n    })\n    if (isSortable === true) {\n      store.sortInfo = {\n        field: 'name',\n        direction: 'ASC'\n      }\n    }\n    const totalTextCmp = new SM.RowCountTextItem({\n      store,\n      noun: 'task',\n      iconCls: 'sm-task-icon'\n    })\n    const initPanel = function (apiJob) {\n      store.loadData(apiJob.tasks || [])\n    }\n    const config = {\n      store,\n      columns,\n      sm,\n      enableDragDrop: true,\n      ddText: '{0} selected Task{1}',\n      bodyCssClass: 'sm-grid3-draggable',\n      ddGroup: `SM.Job.TaskSelectingGrid-${this.role}`,\n      border: true,\n      loadMask: false,\n      stripeRows: true,\n      view: new SM.ColumnFilters.GridView({\n        forceFit: true,\n        emptyText: 'No Tasks to display',\n        listeners: {\n          filterschanged: function (view, item, value) {\n            store.filter(view.getFilterFns())\n          }\n        }\n      }),\n      bbar: new Ext.Toolbar({\n        items: [\n          {\n            xtype: 'exportbutton',\n            grid: this,\n            hasMenu: false,\n            gridBasename: 'Tasks (grid)',\n            storeBasename: 'Tasks (store)',\n            iconCls: 'sm-export-icon',\n            text: 'CSV'\n          },\n          {\n            xtype: 'tbfill'\n          },\n          {\n            xtype: 'tbseparator'\n          },\n          totalTextCmp\n        ]\n      }),\n      initPanel\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.Job.TaskSelectingPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    function setupDragZone(grid) {\n      const gridDragZone = grid.getView().dragZone\n      const originalGetDragData = gridDragZone.getDragData\n      gridDragZone.getDragData = function (e) {\n        const t = Ext.lib.Event.getTarget(e)\n        if (t.className === 'x-grid3-row-checker') {\n          return false\n        }\n        return originalGetDragData.call(gridDragZone, e)\n      }\n\n      const originalStartDrag = gridDragZone.startDrag\n      gridDragZone.startDrag = function (x, y) {\n        Ext.getBody().addClass('sm-grabbing')\n        return originalStartDrag.call(gridDragZone, x, y)\n      }\n\n      const originalOnDragDrop = gridDragZone.onDragDrop\n      gridDragZone.onDragDrop = function (e, id) {\n        Ext.getBody().removeClass('sm-grabbing')\n        return originalOnDragDrop.call(gridDragZone, e, id)\n      }\n\n      const originalOnInvalidDrop = gridDragZone.onInvalidDrop\n      gridDragZone.onInvalidDrop = function (e, id) {\n        Ext.getBody().removeClass('sm-grabbing')\n        return originalOnInvalidDrop.call(gridDragZone, e)\n      }\n\n    }\n    const availableGrid = new SM.Job.TaskSelectingGrid({\n      title: 'Available Tasks',\n      isSortable: true,\n      headerCssClass: 'sm-available-panel-header',\n      role: 'available',\n      flex: 1,\n      listeners: {\n        render: function (grid) {\n          setupDragZone(grid)\n          const gridDropTargetEl = grid.getView().scroller.dom;\n          const gridDropTarget = new Ext.dd.DropTarget(gridDropTargetEl, {\n            ddGroup: selectionsGrid.ddGroup,\n            notifyDrop: function (ddSource, e, data) {\n              const selectedRecords = ddSource.dragData.selections;\n              changeSelected(selectionsGrid, selectedRecords, availableGrid)\n              return true\n            }\n          })\n        },\n\n      }\n    })\n    const selectionsGrid = new SM.Job.TaskSelectingGrid({\n      title: 'Job Tasks (run in order shown)',\n      isSortable: false,\n      headerCssClass: 'sm-selections-panel-header',\n      role: 'selections',\n      flex: 1,\n      listeners: {\n        render: function (grid) {\n          setupDragZone(grid)\n          const gridDropTargetEl = grid.getView().scroller.dom;\n          const gridDropTarget = new Ext.dd.DropTarget(gridDropTargetEl, {\n            ddGroup: availableGrid.ddGroup,\n            notifyDrop: function (ddSource, e, data) {\n              const selectedRecords = ddSource.dragData.selections;\n              changeSelected(availableGrid, selectedRecords, selectionsGrid)\n              return true\n            }\n          })\n          const gridDropTarget2 = new Ext.dd.DropTarget(gridDropTargetEl, {\n            ddGroup: selectionsGrid.ddGroup,\n            notifyDrop: function (ddSource, e, data) {\n              const selectedRecords = ddSource.dragData.selections;\n              return true\n            }\n          })\n\n        }\n      }\n    })\n    availableGrid.getSelectionModel().on('selectionchange', handleSelections, selectionsGrid)\n    selectionsGrid.getSelectionModel().on('selectionchange', handleSelections, availableGrid)\n\n    const addBtn = new Ext.Button({\n      iconCls: 'sm-add-assignment-icon',\n      margins: \"0 10 10 10\",\n      disabled: true,\n      handler: function (btn) {\n        const selectedRecords = availableGrid.getSelectionModel().getSelections()\n        changeSelected(availableGrid, selectedRecords, selectionsGrid)\n        btn.disable()\n      }\n    })\n    const removeBtn = new Ext.Button({\n      iconCls: 'sm-remove-assignment-icon',\n      margins: \"0 10 10 10\",\n      disabled: true,\n      handler: function (btn) {\n        const selectedRecords = selectionsGrid.getSelectionModel().getSelections()\n        changeSelected(selectionsGrid, selectedRecords, availableGrid)\n        btn.disable()\n      }\n    })\n\n    const upBtn = new Ext.Button({\n      iconCls: 'sm-move-up-icon',\n      margins: \"0 10 10 10\",\n      disabled: true,\n      handler: function (btn) {\n        const sm = selectionsGrid.getSelectionModel()\n        if (sm.hasSelection()) {\n          const record = sm.getSelected()\n          const index = selectionsGrid.store.indexOf(record)\n          if (index > 0) {\n            selectionsGrid.store.remove(record)\n            selectionsGrid.store.insert(index - 1, record)\n            sm.selectRow(index - 1)\n            fireSelectedChanged()\n          }\n        }\n      }\n    })\n    const downBtn = new Ext.Button({\n      iconCls: 'sm-move-down-icon',\n      margins: \"0 10 10 10\",\n      disabled: true,\n      handler: function (btn) {\n        const sm = selectionsGrid.getSelectionModel()\n        if (sm.hasSelection()) {\n          const record = sm.getSelected()\n          const index = selectionsGrid.store.indexOf(record)\n          if (index < selectionsGrid.store.getCount() - 1) {\n            selectionsGrid.store.remove(record)\n            selectionsGrid.store.insert(index + 1, record)\n            sm.selectRow(index + 1)\n            fireSelectedChanged()\n          }\n        }\n      }\n    })\n    selectionsGrid.getSelectionModel().on('selectionchange', function (sm) {\n      const hasSelection = sm.hasSelection()\n      upBtn.setDisabled(!hasSelection)\n      downBtn.setDisabled(!hasSelection)\n    })\n\n    // const orderButtonPanel = new Ext.Panel({\n    //   bodyStyle: 'background-color:transparent;border:none',\n    //   width: 60,\n    //   layout: {\n    //     type: 'vbox',\n    //     pack: 'center',\n    //     align: 'center',\n    //     padding: \"10 10 10 10\"\n    //   },\n    //   items: [\n    //     upBtn,\n    //     downBtn,\n    //     { xtype: 'panel', border: false, html: '<i>to reorder</i>' }\n    //   ]\n    // })\n    const buttonPanel = new Ext.Panel({\n      bodyStyle: 'background-color:transparent;border:none',\n      width: 60,\n      layout: {\n        type: 'vbox',\n        pack: 'center',\n        align: 'center',\n        padding: \"10 10 10 10\"\n      },\n      items: [\n        upBtn,\n        downBtn,\n        addBtn,\n        removeBtn,\n        { xtype: 'panel', border: false, html: '<i>or drag</i>' },\n      ]\n    })\n\n    function handleSelections() {\n      const sm = this.selModel\n      if (sm.hasSelection()) {\n        sm.suspendEvents()\n        sm.clearSelections()\n        sm.resumeEvents()\n        SM.SetCheckboxSelModelHeaderState(sm)\n      }\n      const availableSelected = availableGrid.selModel.hasSelection()\n      const selectionsSelected = selectionsGrid.selModel.hasSelection()\n      addBtn.setDisabled(!availableSelected)\n      removeBtn.setDisabled(!selectionsSelected)\n    }\n\n    async function initPanel(apiJob) {\n      const apiAvailableTasks = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/jobs/tasks`,\n        method: 'GET',\n        params: { elevate: curUser.privileges.admin }\n      })\n\n      const availableTaskMap = new Map(apiAvailableTasks.map(task => [task.taskId, task]));\n      const assignedTasks = (apiJob?.tasks ?? []).map(task => ({\n        ...task,\n        description: availableTaskMap.get(task.taskId)?.description ?? ''\n      }));\n      const assignedTaskIds = new Set(assignedTasks.map(task => task.taskId));\n      const availableTasks = apiAvailableTasks.filter(task => !assignedTaskIds.has(task.taskId));\n      availableGrid.store.loadData(availableTasks)\n      selectionsGrid.store.loadData(assignedTasks)\n    }\n\n    function fireSelectedChanged() {\n      _this.fireEvent('selectedchanged', selectionsGrid.store.getRange().map(r => r.data.taskId))\n    }\n\n    function changeSelected(srcGrid, records, dstGrid) {\n      srcGrid.store.suspendEvents()\n      dstGrid.store.suspendEvents()\n      srcGrid.store.remove(records)\n      dstGrid.store.add(records)\n      const sortState = dstGrid.store.getSortState();\n      if (sortState) {\n        dstGrid.store.sort(sortState.field, sortState.direction);\n      }\n      dstGrid.getSelectionModel().selectRecords(records)\n      srcGrid.store.resumeEvents()\n      dstGrid.store.resumeEvents()\n\n      srcGrid.store.fireEvent('datachanged', srcGrid.store)\n      dstGrid.store.fireEvent('datachanged', dstGrid.store)\n      srcGrid.store.fireEvent('update', srcGrid.store)\n      dstGrid.store.fireEvent('update', dstGrid.store)\n      dstGrid.store.filter(dstGrid.getView().getFilterFns())\n      dstGrid.getView().focusRow(dstGrid.store.indexOfId(records[0].data.taskId))\n\n      fireSelectedChanged()\n    }\n\n    function getValue() {\n      const records = selectionsGrid.store.snapshot?.items ?? selectionsGrid.store.getRange()\n      return records.map(record => record.data.taskId)\n    }\n\n    const config = {\n      layout: 'hbox',\n      layoutConfig: {\n        align: 'stretch'\n      },\n      name: 'users',\n      border: false,\n      items: [\n        availableGrid,\n        buttonPanel,\n        selectionsGrid\n      ],\n      availableGrid,\n      selectionsGrid,\n      initPanel,\n      getValue,\n      // need fns below so Ext handles us like a form field\n      setValue: () => { },\n      markInvalid: function () { },\n      clearInvalid: function () { },\n      isValid: () => selectionsGrid.store.getRange().length > 0,\n      getName: () => this.name,\n      validate: () => true\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Job.PropertiesFormPanel = Ext.extend(Ext.FormPanel, {\n  initComponent: function () {\n    const isSystemJob = this.isSystemJob || false\n    const nameField = new Ext.form.TextField({\n      fieldLabel: 'Name',\n      anchor: '100%',\n      emptyText: 'Enter a job name...',\n      allowBlank: false,\n      name: 'name',\n      disabled: isSystemJob,\n    })\n\n    const descriptionField = new Ext.form.TextField({\n      fieldLabel: 'Description',\n      anchor: '100%',\n      emptyText: 'Enter a job description...',\n      allowBlank: true,\n      name: 'description',\n      disabled: isSystemJob,\n    })\n\n    const jobFieldset = new Ext.form.FieldSet({\n      title: '<b>Job information</b>',\n      iconCls: 'sm-job-icon',\n      items: [\n        {\n          layout: 'column',\n          baseCls: 'x-plain',\n          border: false,\n          items: [\n            {\n              columnWidth: .4,\n              layout: 'form',\n              padding: '0px 10px 0px 0px',\n              border: false,\n              items: [nameField]\n            },\n            {\n              columnWidth: .6,\n              layout: 'form',\n              border: false,\n              items: [descriptionField]\n            }\n          ]\n        },\n      ]\n    })\n\n    let taskPanel = null\n    if (isSystemJob) {\n      taskPanel = new SM.Job.TaskSelectingGrid({\n        title: 'Job Tasks (run in order shown)',\n        isSortable: false,\n        headerCssClass: 'sm-selections-panel-header',\n        border: false,\n        anchor: '100%',\n        height: 300,\n        isSystemJob: true,\n      })\n    } else {\n      taskPanel = new SM.Job.TaskSelectingPanel({\n        border: false,\n        anchor: '100%',\n        height: 300,\n      })\n    }\n\n    const taskFieldset = new Ext.form.FieldSet({\n      title: '<b>Tasks</b>',\n      iconCls: 'sm-job-task-icon',\n      layout: 'anchor',\n      autoHeight: true,\n      items: [taskPanel]\n    })\n\n    const schedulePanel = new SM.Job.SchedulePanel({\n      border: false,\n      anchor: '100%',\n    })\n\n    const scheduleFieldset = new Ext.form.FieldSet({\n      title: '<b>Schedule</b>',\n      layout: 'anchor',\n      iconCls: 'sm-job-event-icon',\n      autoHeight: true,\n      items: [\n        schedulePanel,\n      ]\n    })\n\n    const initPanel = async function (apiJob) {\n      taskPanel.initPanel(apiJob)\n      schedulePanel.initPanel(apiJob)\n    }\n\n    const getValue = function () {\n      const values = {\n        event: schedulePanel.getValue(),\n      }\n      if (!isSystemJob) {\n        values.name = nameField.getValue()\n        values.description = descriptionField.getValue()\n        values.tasks = taskPanel.getValue()\n      }\n      return values\n    }\n\n    const config = {\n      baseCls: 'x-plain',\n      region: 'south',\n      labelWidth: 70,\n      monitorValid: true,\n      trackResetOnLoad: true,\n      items: [\n        jobFieldset,\n        taskFieldset,\n        scheduleFieldset,\n        // tabs \n      ],\n      initPanel,\n      getValue,\n      buttons: [{\n        text: this.btnText || 'Save',\n        formBind: true,\n        handler: this.btnHandler || Ext.emptyFn\n      }]\n\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Job.showJobProps = async function (jobId) {\n  try {\n    const btnHandler = async function () {\n      Ext.getBody().mask('Saving job...')\n      try {\n        const values = jobPropsFormPanel.getValue()\n        await Ext.Ajax.requestPromise({\n          responseType: 'json',\n          url: `${STIGMAN.Env.apiBase}/jobs${jobId ? '/' + jobId : ''}`,\n          method: jobId ? 'PATCH' : 'POST',\n          jsonData: values,\n          params: { elevate: curUser.privileges.admin }\n        })\n        SM.Dispatcher.fireEvent('jobchanged')\n        appwindow.close()\n      }\n      catch (e) {\n        SM.Error.handleError(e)\n      }\n      finally {\n        Ext.getBody().unmask()\n      }\n    }\n\n    const jobPropsFormPanel = new SM.Job.PropertiesFormPanel({\n      isSystemJob: jobId && jobId < 100,\n      padding: '10px 15px 10px 15px',\n      btnHandler\n    })\n\n    const appwindow = new Ext.Window({\n      cls: 'sm-dialog-window sm-round-panel',\n      title: jobId ? 'Job Properties, ID ' + jobId : 'Create new Job',\n      modal: true,\n      resizable: false,\n      draggable: false,\n      hidden: true,\n      width: 640,\n      height: 640,\n      layout: 'fit',\n      plain: true,\n      bodyStyle: 'padding:5px;',\n      buttonAlign: 'right',\n      items: jobPropsFormPanel\n    });\n\n    appwindow.render(Ext.getBody())\n\n    if (jobId) {\n      let apiJob = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/jobs/${jobId}`,\n        params: { elevate: curUser.privileges.admin },\n        method: 'GET'\n      })\n      jobPropsFormPanel.getForm().setValues(apiJob)\n      jobPropsFormPanel.initPanel(apiJob)\n    }\n    else {\n      jobPropsFormPanel.initPanel(null)\n    }\n\n    Ext.getBody().unmask();\n    appwindow.show(Ext.getBody());\n  }\n  catch (e) {\n    Ext.getBody().unmask()\n    SM.Error.handleError(e)\n  }\n}\n\nSM.Job.showJobAdminTab = function ({ treePath }) {\n  const tab = Ext.getCmp('main-tab-panel').getItem('job-admin-tab')\n  if (tab) {\n    tab.show()\n    return\n  }\n\n  const jobsGrid = new SM.Job.JobsGrid({\n    region: 'center',\n    border: false,\n    loadMask: true,\n    margins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.edge, left: SM.Margin.edge },\n    cls: 'sm-round-panel',\n    runNowFn,\n  })\n\n  const runsPanel = new SM.Job.RunsPanel({\n    region: 'south',\n    margins: { top: SM.Margin.edge, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n    border: false,\n    iconCls: 'sm-job-run-icon',\n    cls: 'sm-round-panel',\n    height: '66%',\n    split: true,\n    minHeight: 100,\n    loadMask: true,\n  })\n\n  jobsGrid.getSelectionModel().on('rowselect', async function (sm, rowIndex, record) {\n    loadRuns(record.data.jobId)\n  })\n  jobsGrid.getStore().on('load', function () {\n    const selection = jobsGrid.getSelectionModel().getSelected()\n    if (selection) {\n      loadRuns(selection.data.jobId)\n    }\n  })\n\n  runsPanel.on('deleterun', async function (runId) {\n    const response = await Ext.Ajax.requestPromise({\n      responseType: 'json',\n      url: `${STIGMAN.Env.apiBase}/jobs/runs/${runId}?elevate=true`,\n      method: 'DELETE',\n    })\n    const selected = runsPanel.runsGrid.getSelectionModel().getSelected()\n    const record = runsPanel.runsGrid.getStore().getById(runId)\n    runsPanel.runsGrid.getStore().remove(record)\n    if (selected?.data.runId === runId) {\n      runsPanel.outputGrid.getStore().removeAll()\n    }\n  })\n\n  SM.Dispatcher.addListener('jobchanged', onJobChanged)\n\n  const thisTab = Ext.getCmp('main-tab-panel').add({\n    id: 'job-admin-tab',\n    sm_treePath: treePath,\n    iconCls: 'sm-job-icon',\n    title: 'Service Jobs',\n    closable: true,\n    layout: 'border',\n    border: false,\n    items: [jobsGrid, runsPanel],\n    listeners: {\n      destroy: function () {\n        SM.Dispatcher.removeListener('jobchanged', onJobChanged)\n      }\n    }\n  })\n  thisTab.show()\n  jobsGrid.getStore().load()\n\n  async function runNowFn() {\n    const job = jobsGrid.getSelectionModel().getSelected();\n    if (!job) return\n    let buttons = { yes: 'Run Now', no: 'Cancel' }\n    let confirmStr = `Run <b>${job.data.name}</b> now?`\n\n    Ext.Msg.show({\n      title: 'Confirm run action',\n      icon: Ext.Msg.QUESTION,\n      msg: confirmStr,\n      buttons: buttons,\n      fn: async function (btn, text) {\n        try {\n          if (btn == 'yes') {\n            Ext.getBody().mask('Starting job...')\n            const apiJobRun = await Ext.Ajax.requestPromise({\n              responseType: 'json',\n              url: `${STIGMAN.Env.apiBase}/jobs/${job.data.jobId}/runs?elevate=${curUser.privileges.admin}`,\n              method: 'POST',\n            })\n            jobsGrid.getStore().reload()\n            jobsGrid.getSelectionModel().selectRecords([job])\n          }\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n        finally {\n          Ext.getBody().unmask()\n        }\n      }\n    })\n  }\n\n  async function loadRuns(jobId) {\n    const response = await Ext.Ajax.requestPromise({\n      responseType: 'json',\n      url: `${STIGMAN.Env.apiBase}/jobs/${jobId}/runs`,\n      params: { elevate: curUser.privileges.admin },\n      method: 'GET',\n    })\n    runsPanel.outputGrid.getStore().removeAll()\n    runsPanel.runsGrid.getStore().loadData(response)\n  }\n\n  function onJobChanged() {\n    jobsGrid.getStore().reload()\n  }\n\n}"
  },
  {
    "path": "client/src/js/SM/Library.js",
    "content": "Ext.ns(\"SM.Library\")\n\nSM.Library.ChecklistGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    this.benchmarkId = this.benchmarkId || 'RHEL_8_STIG'\n    this.revisionStr = this.revisionStr || 'latest'\n    const title = this.stigTitle\n    const fields = [\n      {\n        name: 'version',\n        type: 'string'\n      },\n      {\n        name: 'groupId',\n        type: 'string',\n        sortType: sortGroupId\n      },\n      {\n        name: 'ruleId',\n        type: 'string',\n        sortType: sortRuleId\n      },\n      {\n        name: 'groupTitle',\n        type: 'string'\n      },\n      {\n        name: 'title',\n        type: 'string',\n      },\n      {\n        name: 'severity',\n        type: 'string',\n        sortType: sortSeverity\n      },\n      {\n        name: 'check',\n        mapping: 'check?.content'\n      },\n      {\n        name: 'fix',\n        mapping: 'fix?.text'\n      },\n      {\n        name: 'discussion',\n        mapping: 'detail.vulnDiscussion'\n      },\n      {\n        name: 'ccis',\n        // Convert the CCIs array into a joined string when loading into the store\n        convert: v => v.map(i => i.cci).join('\\n')\n      }\n    ]\n    const exportBtn = new Ext.ux.ExportButton({\n      hasMenu: false,\n      exportType: 'grid',\n      gridBasename: 'STIG',\n      iconCls: 'sm-export-icon',\n      text: 'CSV',\n      gridSource: this\n    })\n    const store = new Ext.data.JsonStore({\n      fields,\n      root: '',\n      idProperty: 'ruleId',\n      sortInfo: {\n        field: 'ruleId',\n        direction: 'ASC'\n      },\n      listeners: {\n        load: function (store, records) {\n          _this.getSelectionModel().selectFirstRow()\n          totalTextItem.setText(`${store.getCount()} records`)\n        },\n        reload: function (store, records) {\n          _this.getSelectionModel().selectFirstRow()\n          totalTextItem.setText(`${store.getCount()} records`)\n        }\n      }\n    })\n    const totalTextItem = new SM.RowCountTextItem({ store: store })\n    const ruleTitleColumnId = Ext.id()\n    const columns = [\n      {\n        header: \"CAT\",\n        fixed: true,\n        width: 48,\n        align: 'left',\n        dataIndex: 'severity',\n        sortable: true,\n        renderer: renderSeverity,\n        filter: {\n          type: 'values',\n          comparer: SM.ColumnFilters.CompareFns.severity,\n          renderer: SM.ColumnFilters.Renderers.severity\n        }\n      },\n      {\n        header: \"STIG Id\",\n        width: 150,\n        dataIndex: 'version',\n        sortable: true,\n        align: 'left',\n        renderer: (v, attrs) => {\n          attrs.css = 'sm-direction-rtl'\n          return v\n        },\n        filter: { type: 'string' }\n      },\n      {\n        header: \"Group Id\",\n        width: 75,\n        dataIndex: 'groupId',\n        sortable: true,\n        align: 'left',\n        filter: { type: 'string' }\n      },\n      {\n        header: \"Group Title\",\n        width: 200,\n        dataIndex: 'groupTitle',\n        renderer: columnWrap,\n        sortable: true,\n        // hidden: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"Rule Id\",\n        width: 150,\n        dataIndex: 'ruleId',\n        sortable: true,\n        align: 'left',\n        // hidden: true,\n        filter: { type: 'string' }\n      },\n      {\n        id: ruleTitleColumnId,\n        header: \"Rule Title\",\n        width: 300,\n        dataIndex: 'title',\n        renderer: columnWrap,\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"Check\",\n        width: 300,\n        dataIndex: 'check',\n        renderer: columnWrap,\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"Fix\",\n        width: 300,\n        dataIndex: 'fix',\n        renderer: columnWrap,\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"Discussion\",\n        width: 300,\n        dataIndex: 'discussion',\n        renderer: columnWrap,\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"CCIs\",\n        width: 100,\n        dataIndex: 'ccis',\n        renderer: function(v) {\n          return columnWrap.apply(this, arguments)\n        },\n        sortable: false,\n        filter: { type: 'string' }\n      }\n    ]\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      deferEmptyText: false,\n      forceFit: true,\n      rowOverCls: 'sm-null',\n      selectedRowClass: 'sm-null',\n      listeners: {\n        filterschanged: function (view, item, value) {\n          store.filter(view.getFilterFns())\n        }\n      }\n    })\n    const revisionStore = new Ext.data.JsonStore({\n      fields: [\n        \"benchmarkId\",\n        \"revisionStr\",\n        \"version\",\n        \"release\",\n        \"benchmarkDate\",\n        \"status\",\n        \"statusDate\",\n        { name: 'display', convert: (v, r) => `Version ${r.version} Release ${r.release} (${r.benchmarkDate})` }\n      ],\n      url: `${STIGMAN.Env.apiBase}/stigs/${_this.benchmarkId}/revisions`\n    })\n    const revisionComboBox = new Ext.form.ComboBox({\n      store: revisionStore,\n      displayField: 'display',\n      valueField: 'revisionStr',\n      triggerAction: 'all',\n      mode: 'local',\n      editable: false,\n      listeners: {\n        select: function (combo, record, index) {\n          _this.revisionStr = combo.getValue()\n          _this.loadStig()\n        }\n      }\n    })\n    const tbar = new Ext.Toolbar({\n      items: ['Revision', revisionComboBox]\n    })\n    const bbar = new Ext.Toolbar({\n      items: [\n        exportBtn,\n        '->',\n        totalTextItem\n      ]\n    })\n\n    async function getStig(benchmarkId, revisionStr) {\n      let result = await Ext.Ajax.requestPromise({\n        url: `${STIGMAN.Env.apiBase}/stigs/${benchmarkId}/revisions/${revisionStr}/rules`,\n        method: 'GET',\n        params: {\n          projection: ['check', 'fix', 'detail', 'ccis']\n        }\n      })\n      return JSON.parse(result.response.responseText)\n    }\n\n    this.loadStig = async function (benchmarkId = _this.benchmarkId, revisionStr = _this.revisionStr || 'latest') {\n      try {\n        exportBtn.gridBasename = benchmarkId\n        _this.benchmarkId = benchmarkId\n        _this.getEl().mask('Please wait')\n        const apiStig = await getStig(benchmarkId, revisionStr)\n        store.loadData(apiStig)\n      }\n      catch (e) {\n        console.error(e.message)\n      }\n      finally {\n        _this.getEl().unmask()\n      }\n    }\n    this.loadRevisions = async function (benchmarkId = _this.benchmarkId, revisionStr = _this.revisionStr) {\n      try {\n        await revisionStore.loadPromise()\n        revisionComboBox.setValue(revisionStr)\n      }\n      catch (e) {\n        console.error(e.message)\n      }\n    }\n    const config = {\n      title,\n      store,\n      columns,\n      view,\n      tbar,\n      bbar,\n      autoExpandColumn: ruleTitleColumnId,\n      stripeRows: true,\n      loadMask: { msg: '' }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.Library.ChecklistGrid.superclass.initComponent.call(this);\n  }\n})\n\nSM.Library.RuleContentPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const config = {\n      padding: 20,\n      autoScroll: true,\n      title: 'Rule',\n      tpl: SM.RuleContentTpl\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.Library.RuleContentPanel.superclass.initComponent.call(this);\n  }\n})\n\nSM.Library.StigPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const checklistGrid = new SM.Library.ChecklistGrid({\n      benchmarkId: this.benchmarkId,\n      revisionStr: this.revisionStr || 'latest',\n      stigTitle: this.stigTitle,\n      cls: 'sm-round-panel',\n      margins: { top: SM.Margin.top, right: SM.Margin.adjacent, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n      border: false,\n      region: 'center'\n    })\n    this.load = async function () {\n      await checklistGrid.loadStig(this.benchmarkId)\n      await checklistGrid.loadRevisions(this.benchmarkId)\n    }\n    const config = {\n      iconCls: 'sm-stig-icon',\n      closable: true,\n      layout: 'border',\n      layoutConfig: {\n        targetCls: 'sm-border-layout-ct'\n      },\n      items: [\n        checklistGrid\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.Library.RuleContentPanel.superclass.initComponent.call(this)\n  }\n})\n\nSM.Library.DiffRevisionComboBox = Ext.extend(Ext.form.ComboBox, {\n  initComponent: function () {\n    const _this = this\n\n    this.store = new Ext.data.JsonStore({\n      fields: [\n        'revisionStr', \n        'benchmarkDate', \n        'status',\n        {name: 'display', convert: (v, rec) => `${rec.revisionStr} (${rec.benchmarkDate})`}\n      ]\n    })\n\n    const data = []\n\n    const config = {\n      displayField: 'display',\n      valueField: 'revisionStr',\n      triggerAction: 'all',\n      mode: 'local',\n      editable: false\n    }\n\n    this.store.on('load', function (store) {\n      const count = store.getCount()\n      if (count > 1) {\n        const offset = _this.side === 'left' ? 1 : 0\n        _this.setValue(store.getAt(offset).get('revisionStr'))\n      }\n    })\n\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n\n    this.store.loadData(data)\n  }\n})\n\nSM.Library.DiffRulesGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n\n    function disableRevisionComboBoxes(disable) {\n      leftRevisionComboBox.setDisabled(disable)\n      rightRevisionComboBox.setDisabled(disable)\n    }\n\n    const stigSelectionField = new SM.Manage.Stig.SelectionComboBox({\n      autoLoad: false,\n      name: 'benchmarkId',\n      width: 360,\n      submitValue: false,\n      fieldLabel: 'BenchmarkId',\n      hideTrigger: false,\n      anchor: '100%',\n      allowBlank: false,\n      emptyText: 'Select a Benchmark to compare revisions',\n      listeners: {\n        // select: this.onStigSelect || function () { }\n        select: function (combo, record, index) {\n          // const data = record.data.revisionStrs.map(i => [i])\n          const data = record.data.revisions\n          leftRevisionComboBox.store.loadData(data)\n          rightRevisionComboBox.store.loadData(data)\n          disableRevisionComboBoxes(false)\n          _this.onStigSelect && _this.onStigSelect(combo, record, index)\n        },\n        invalid: function (combo, msg) {\n          _this.store.removeAll()\n          leftRevisionComboBox.store.removeAll()\n          rightRevisionComboBox.store.removeAll()\n          disableRevisionComboBoxes(true)\n        }\n      }\n    })\n    stigSelectionField.store.loadData(this.apiStigs)\n\n    const onRevisionSelect = function () {\n      const benchmarkId = stigSelectionField.getValue()\n      const lhRevisionStr = leftRevisionComboBox.getValue()\n      const rhRevisionStr = rightRevisionComboBox.getValue()\n      _this.onRevisionSelect && _this.onRevisionSelect(benchmarkId, lhRevisionStr, rhRevisionStr)\n    }\n\n    const leftRevisionComboBox = new SM.Library.DiffRevisionComboBox({\n      // emptyText: 'Select a Benchmark',\n      width: 140,\n      disabled: true,\n      side: 'left',\n      listeners: {\n        select: onRevisionSelect\n      }\n    })\n    const rightRevisionComboBox = new SM.Library.DiffRevisionComboBox({\n      // emptyText: 'Select a Benchmark',\n      width: 140,\n      disabled: true,\n      listeners: {\n        select: onRevisionSelect\n      }\n    })\n\n    const tbar = new Ext.Toolbar({\n      height: 30,\n      cls: 'sm-toolbar-diff',\n      items: [\n        {\n          xtype: 'tbtext',\n          text: 'Benchmark:&nbsp;'\n        },\n        stigSelectionField,\n        ' ',\n        {\n          xtype: 'tbtext',\n          text: 'Left revision:&nbsp;'\n        },\n        leftRevisionComboBox,\n        ' ',\n        {\n          xtype: 'tbtext',\n          text: 'Right revision:&nbsp;'\n        },\n        rightRevisionComboBox\n      ]\n    })\n\n    const fields = [\n      'stigId', 'severities', 'lRuleId', 'rRuleId', 'unified', 'updates'\n    ]\n\n    const renderRule = function (lhs, rhs, side) {\n      if (!lhs && !rhs) {\n        return ''\n      }\n\n      if (side === 'left') {\n        if (!lhs) {\n          return ''\n        }\n        if (!rhs) {\n          return `<span class=\"sm-diff-del\">${lhs}</span>`\n        }\n      }\n      if (side === 'right') {\n        if (!lhs) {\n          return `<span class=\"sm-diff-ins\">${rhs}</span>`\n        }\n        if (!rhs) {\n          return ''\n        }\n      }\n\n      const re = /SV-(\\d+)r(\\d+)_rule/\n      const lm = lhs.match(re)\n      const rm = rhs.match(re)\n\n      if (side === 'left') {\n        let prefix = lm[1] === rm[1] ? lm[1] : `<span class=\"sm-diff-del\">${lm[1]}</span>`\n        let postfix = lm[2] === rm[2] ? `${lm[2]}` : `<span class=\"sm-diff-del\">${lm[2]}</span>`\n        return `SV-${prefix}r${postfix}_rule`\n      }\n      if (side === 'right') {\n        let prefix = lm[1] === rm[1] ? rm[1] : `<span class=\"sm-diff-ins\">${rm[1]}</span>`\n        let postfix = lm[2] === rm[2] ? `${rm[2]}` : `<span class=\"sm-diff-ins\">${rm[2]}</span>`\n        return `SV-${prefix}r${postfix}_rule`\n      }\n    }\n\n    const columns = [\n      {\n        header: \"STIG Id\",\n        width: 175,\n        dataIndex: 'stigId',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: 'Left rule',\n        width: 175,\n        dataIndex: 'lRuleId',\n        sortable: true,\n        filter: { type: 'string' },\n        renderer: function (value, metaData, record) {\n          return renderRule(record.data.lRuleId, record.data.rRuleId, 'left')\n        }\n      },\n      {\n        header: 'Right rule',\n        width: 175,\n        dataIndex: 'rRuleId',\n        sortable: true,\n        filter: { type: 'string' },\n        renderer: function (value, metaData, record) {\n          return renderRule(record.data.lRuleId, record.data.rRuleId, 'right')\n        }\n      },\n      {\n        header: 'CAT',\n        align: 'center',\n        width: 100,\n        dataIndex: 'severities',\n        filter: { type: 'values' },\n        renderer: function (value) {\n          let html = ''\n          switch (value[0]) {\n            case 'high':\n              html += '<span class=\"sm-grid-sprite sm-severity-high\">CAT 1</span>'\n              break\n            case 'medium':\n              html += '<span class=\"sm-grid-sprite sm-severity-medium\">CAT 2</span>'\n              break\n            case 'low':\n              html += '<span class=\"sm-grid-sprite sm-severity-low\">CAT 3</span>'\n              break\n          }\n          if (value[0] && value[1] && value[0] !== value[1]) {\n            html += ' &gt;&gt; '\n            switch (value[1]) {\n              case 'high':\n                html += '<span class=\"sm-grid-sprite sm-severity-high\">CAT 1</span>'\n                break\n              case 'medium':\n                html += '<span class=\"sm-grid-sprite sm-severity-medium\">CAT 2</span>'\n                break\n              case 'low':\n                html += '<span class=\"sm-grid-sprite sm-severity-low\">CAT 3</span>'\n                break\n            }\n          }\n          return html\n        }\n      },\n      {\n        header: '<span exportvalue=\"Changed properties\">Changed properties<i class= \"fa fa-question-circle sm-question-circle\"></i></span>',\n        id: 'diff-updated-props',\n        width: 200,\n        dataIndex: 'updates',\n        sortable: true,\n        filter: { type: 'values' },\n        renderer: function (value, md, record) {\n          if (!value?.length) {\n            return '<span style=\"color:grey;font-style:italic\">No value</span>'\n          }\n          let spriteChain = ''\n          for (const item of value) {\n            spriteChain += `<span class=\"sm-label-sprite ${item === 'check' || item === 'rule added' ? 'sm-diff-sprite-check' : 'sm-diff-sprite'}\">${item}</span> `\n          }\n          return spriteChain\n        }\n      }\n\n    ]\n    const store = new Ext.data.JsonStore({\n      grid: this,\n      root: '',\n      fields,\n      idProperty: 'stigId',\n      sortInfo: {\n        field: 'stigId',\n        direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      }\n    })\n    this.totalTextCmp = new SM.RowCountTextItem({\n      store\n    })\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          grid: this,\n          hasMenu: false,\n          gridBasename: 'Changed Rules (grid)',\n          storeBasename: 'Changed Rules (store)',\n          iconCls: 'sm-export-icon',\n          text: 'CSV'\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        this.totalTextCmp\n      ]\n    })\n\n    const config = {\n      layout: 'fit',\n      loadMask: { msg: '' },\n      autoExpandColumn: 'diff-updated-props',\n      store,\n      cm: new Ext.grid.ColumnModel({\n        columns\n      }),\n      sm: new Ext.grid.RowSelectionModel({\n        singleSelect: true,\n        listeners: {\n          rowselect: this.onRowSelect || function () { }\n        }\n      }),\n      view: new SM.ColumnFilters.GridView({\n        emptyText: this.emptyText || 'No records to display',\n        deferEmptyText: false,\n        listeners: {\n          filterschanged: function (view, item, value) {\n            store.filter(view.getFilterFns())\n          },\n          refresh: function (view) {\n            // Setup the tooltip for column 'updates'\n            const index = view.grid.getColumnModel().findColumnIndex('updates')\n            const tipEl = view.getHeaderCell(index).getElementsByClassName('fa')[0]\n            if (tipEl) {\n              new Ext.ToolTip({\n                target: tipEl,\n                showDelay: 0,\n                dismissDelay: 0,\n                autoWidth: true,\n                html: SM.TipContent.RulePropertyDiffs\n              })\n            }\n          }\n        }\n      }),\n      tbar,\n      bbar,\n      listeners: {\n        viewready: function (grid) {\n          // Setup the tooltip for column 'updates'\n          const index = grid.getColumnModel().findColumnIndex('updates')\n          const tipEl = grid.view.getHeaderCell(index).getElementsByClassName('fa')[0]\n          if (tipEl) {\n            new Ext.ToolTip({\n              target: tipEl,\n              showDelay: 0,\n              dismissDelay: 0,\n              autoWidth: true,\n              html: SM.TipContent.RulePropertyDiffs\n            })\n          }\n        }\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Library.DiffContentPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const config = {\n      autoScroll: true,\n      emptyText: 'Select a row in the grid above'\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Library.GenerateDiffData = function (lhs, rhs) {\n  const obj = {}\n  const data = []\n\n  for (const rule of lhs) {\n    const value = obj[rule.version] ?? {}\n    value.lhs = rule\n    obj[rule.version] = value\n  }\n  for (const rule of rhs) {\n    const value = obj[rule.version] ?? {}\n    value.rhs = rule\n    obj[rule.version] = value\n  }\n\n  const ruleProps = [\n    'ruleId',\n    'title',\n    'groupId',\n    'groupTitle',\n    'severity',\n  ]\n  const detailProps = [\n    \"weight\",\n    \"mitigations\",\n    \"documentable\",\n    \"falseNegatives\",\n    \"falsePositives\",\n    \"responsibility\",\n    \"vulnDiscussion\",\n    \"thirdPartyTools\",\n    \"potentialImpacts\",\n    \"mitigationControl\",\n    \"severityOverrideGuidance\"\n  ]\n\n  for (const [key, value] of Object.entries(obj)) {\n    let thisUnified\n    const diffOptions = {\n      context: 999,\n      newlineIsToken: true,\n      ignoreWhitespace: false\n    }\n    let fullUnified = ''\n\n    const dataItem = {\n      severities: [],\n      stigId: key,\n      lRuleId: value.lhs?.ruleId,\n      rRuleId: value.rhs?.ruleId,\n      updates: [],\n      unified: ''\n    }\n\n    if (value.lhs?.severity) {\n      dataItem.severities.push(value.lhs.severity)\n    }\n    if (value.rhs?.severity) {\n      dataItem.severities.push(value.rhs.severity)\n    }\n\n    for (const prop of ruleProps) {\n      lhsStr = value.lhs?.[prop] ?? ''\n      rhsStr = value.rhs?.[prop] ?? ''\n      thisUnified = Diff.createPatch(prop, lhsStr, rhsStr, undefined, undefined, diffOptions)\n      if (thisUnified) {\n        dataItem.updates.push(prop)\n        fullUnified += thisUnified\n      }\n    }\n\n    for (const prop of detailProps) {\n      lhsStr = value.lhs?.detail[prop] ?? ''\n      rhsStr = value.rhs?.detail[prop] ?? ''\n      thisUnified = Diff.createPatch(prop, lhsStr, rhsStr, undefined, undefined, diffOptions)\n      if (thisUnified) {\n        dataItem.updates.push(prop)\n        fullUnified += thisUnified\n      }\n    }\n\n    // check\n    lhsStr = value.lhs?.check?.content ?? ''\n    rhsStr = value.rhs?.check?.content ?? ''\n    thisUnified = Diff.createPatch('check', lhsStr, rhsStr, undefined, undefined, diffOptions)\n    if (thisUnified) {\n      dataItem.updates.push('check')\n      fullUnified += thisUnified\n    }\n\n    // fix\n    lhsStr = value.lhs?.fix?.text ?? ''\n    rhsStr = value.rhs?.fix?.text ?? ''\n    thisUnified = Diff.createPatch('fix', lhsStr, rhsStr, undefined, undefined, diffOptions)\n    if (thisUnified) {\n      dataItem.updates.push('fix')\n      fullUnified += thisUnified\n    }\n\n    // ccis\n    const lCcis = value.lhs?.ccis.map(i=>i.cci).sort((a,b)=>a.localeCompare(b)) ?? []\n    const rCcis = value.rhs?.ccis.map(i=>i.cci).sort((a,b)=>a.localeCompare(b)) ?? []\n    thisUnified = Diff.createPatch('cci', JSON.stringify(lCcis), JSON.stringify(rCcis), undefined, undefined, diffOptions)\n    if (thisUnified) {\n      dataItem.updates.push('cci')\n      fullUnified += thisUnified\n    }\n\n    if (fullUnified) {\n      dataItem.unified = fullUnified\n    }\n    if (value.lhs?.ruleId && !value.rhs?.ruleId) {\n      dataItem.updates = ['rule removed']\n    }\n    if (value.rhs?.ruleId && !value.lhs?.ruleId) {\n      dataItem.updates = ['rule added']\n    }\n    if (dataItem.updates.length) {\n      data.push(dataItem)\n    }\n  }\n  return data\n}\n\nSM.Library.DiffPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n\n    const diffContentPanelEmptyText = `<div class=\"x-grid-empty\">Select a rule from the grid above</div>`\n\n    const doDiff = async function (benchmarkId, lhRevisionStr, rhRevisionStr) {\n      try {\n        diffContentPanel.update(diffContentPanelEmptyText)\n        diffRulesGrid.bwrap.mask('')\n\n        const [lhResult, rhResult] = await Promise.all([\n          Ext.Ajax.requestPromise({\n            url: `${STIGMAN.Env.apiBase}/stigs/${benchmarkId}/revisions/${lhRevisionStr}/rules`,\n            method: 'GET',\n            params: {\n              projection: ['check', 'fix', 'detail', 'ccis']\n            }\n          }),\n          Ext.Ajax.requestPromise({\n            url: `${STIGMAN.Env.apiBase}/stigs/${benchmarkId}/revisions/${rhRevisionStr}/rules`,\n            method: 'GET',\n            params: {\n              projection: ['check', 'fix', 'detail', 'ccis']\n            }\n          })\n        ])\n\n        const rhs = JSON.parse(rhResult.response.responseText)\n        const lhs = JSON.parse(lhResult.response.responseText)\n\n        const diffData = SM.Library.GenerateDiffData(lhs, rhs)\n\n        diffRulesGrid.store.loadData(diffData)\n      }\n      catch (e) {\n        console.log(e)\n      }\n      finally {\n        diffRulesGrid.bwrap.unmask()\n      }\n\n    }\n\n    const onStigSelect = async function (combo, record, index) {\n      const benchmarkId = record.data.benchmarkId\n      const revisionStrs = record.data.revisionStrs\n      const rhRevisionStr = revisionStrs[0]\n      const lhRevisionStr = revisionStrs[1]\n      await doDiff(benchmarkId, lhRevisionStr, rhRevisionStr)\n    }\n\n    const onRowSelect = function (sm, index, record) {\n      const configuration = {\n        drawFileList: false,\n        matching: 'lines',\n        diffStyle: 'word'\n      }\n      const html = record.data.unified ? Diff2Html.html(record.data.unified, configuration) : `<div class=\"x-grid-empty\">No tracked properties were changed</div>`\n      diffContentPanel.update(html)\n    }\n\n    const onRevisionSelect = async function (benchmarkId, lhRevisionStr, rhRevisionStr) {\n      await doDiff(benchmarkId, lhRevisionStr, rhRevisionStr)\n    }\n\n    const diffRulesGrid = new SM.Library.DiffRulesGrid({\n      title: 'Changed ruleIds',\n      border: false,\n      cls: 'sm-round-panel',\n      margins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.adjacent, left: SM.Margin.edge },\n      region: 'north',\n      split: true,\n      height: 400,\n      onRowSelect,\n      apiStigs: this.multiRevisionStigs,\n      onStigSelect,\n      onRevisionSelect\n    })\n\n    const diffContentPanel = new SM.Library.DiffContentPanel({\n      title: 'Detailed changes',\n      html: diffContentPanelEmptyText,\n      cls: 'sm-round-panel',\n      padding: 10,\n      border: false,\n      margins: { top: SM.Margin.adjacent, right: SM.Margin.edge, bottom: SM.Margin.edge, left: SM.Margin.edge },\n      region: 'center'\n    })\n\n    const config = {\n      layout: 'border',\n      items: [\n        diffContentPanel,\n        diffRulesGrid\n      ],\n      diffRulesGrid,\n      diffContentPanel\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Library.showDiffPanel = async function (options) {\n\n  const { treePath, multiRevisionStigs = [] } = options\n  const tab = Ext.getCmp('main-tab-panel').getItem(`stig-diff`)\n  if (tab) {\n    Ext.getCmp('main-tab-panel').setActiveTab(tab.id)\n    return\n  }\n\n  const diffPanel = new SM.Library.DiffPanel({\n    title: 'Compare STIG Revisions',\n    id: 'stig-diff',\n    closable: true,\n    iconCls: 'sm-diff-icon',\n    multiRevisionStigs\n  })\n\n  SM.AddPanelToMainTab(diffPanel, 'permanent')\n}"
  },
  {
    "path": "client/src/js/SM/LogStream.js",
    "content": "Ext.ns('SM.LogStream')\nExt.ns('SM.LogStream.Filter')\n\nSM.LogStream.LogPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    this.shouldAutoScroll = true\n    this.writableStream = null\n    this.logLines = []\n    this.logDivs = []\n    this.needsUpdate = false\n    this.maxLines = 1000\n    this.emptyString = '<div id=\"sm-log-empty\" style=\"padding: 10px;color:#999\">Socket connected and ready to stream.</div>'\n    this.preserveLog = true\n\n    const filterPanel = new SM.LogStream.Filter.Panel({\n      onFilter: (values) => {\n        console.log('Filtering log stream with values:', values);\n        this.startStreaming(values);\n        streamBtn.toggle(true, true);\n        streamBtn.setIconClass('sm-stream-icon')\n      }\n    });\n    const filterMenu = new Ext.menu.Menu({\n      plain: true,\n      style: 'padding: 10px;',\n      items: [filterPanel],\n      listeners: {\n        beforehide: (menu) => {\n          if (streamBtn.pressed && !menu.hidden) {\n            this.startStreaming(filterPanel.getValue());\n          }\n        }\n      }\n    });\n    filterPanel.menu = filterMenu;\n\n    const streamBtn = new Ext.SplitButton({\n      text: 'Stream',\n      enableToggle: true,\n      iconCls: 'sm-stream-stopped-icon',\n      menu: filterMenu,\n      handler: (btn) => {\n        if (btn.pressed) {\n          const filter = filterPanel.getValue();\n          console.log('Starting log stream with filter:', filter);\n          this.startStreaming(filter);\n          btn.setIconClass('sm-stream-icon')\n        } else {\n          this.stopStreaming();\n          btn.setIconClass('sm-stream-stopped-icon')\n        }\n      }\n    });\n    const recordingBtn = new Ext.Button({\n      text: 'Record...',\n      enableToggle: true,\n      iconCls: 'sm-recording-stopped-icon',\n      toggleHandler: async (btn, state) => {\n        if (state) {\n          try {\n            const dateString = new Date().toISOString().replace(/\\.\\d{3}Z$/, 'Z').replace(/:/g, '-');\n            const newHandle = await window.showSaveFilePicker({\n              suggestedName: `log-${dateString}.jsonl`,\n              types: [{\n                description: 'JSONL Files',\n                accept: { 'application/jsonl': ['.jsonl'] },\n              }],\n            });\n            this.writableStream = await newHandle.createWritable();\n            btn.setText(`Recording to ${newHandle.name}`);\n            btn.setIconClass('sm-recording-icon');\n          } catch (error) {\n            console.error('Error recording file:', error);\n            btn.toggle(false, true); //toggle off with event suppressed\n            return;\n          }\n        } else {\n          btn.setText('Record...');\n          btn.setIconClass('sm-recording-stopped-icon');\n          if (this.writableStream) {\n            this.writableStream.close();\n            this.writableStream = null;\n          }\n        }\n      }\n    });\n    const preserveCb = new Ext.form.Checkbox({\n      boxLabel: 'Preserve Log',\n      checked: true,\n      listeners: {\n        change: (cb, checked) => {\n          this.preserveLog = checked;\n        }\n      }\n    });\n    const wrapBtn = new Ext.Button({\n      text: 'Wrap',\n      enableToggle: true,\n      iconCls: 'sm-wrap-lines-icon',\n      toggleHandler: (btn, state) => {\n        this.body.dom.style.textWrapMode = state ? 'wrap' : 'nowrap';\n      }\n    });\n    const clearBtn = new Ext.Button({\n      text: 'Clear',\n      iconCls: 'sm-clear-icon',\n      handler: () => {\n        this.logDivs = [];\n        this.clearPanel();\n        this.fireEvent('logCleared');\n      }\n    });\n\n    const toolbarItems = [streamBtn, '-', recordingBtn, '->', preserveCb, '-', wrapBtn, '-', clearBtn];\n    if (!window.showSaveFilePicker) {\n      toolbarItems.splice(1, 2); // Remove recording button\n    }\n\n    const tbar = new Ext.Toolbar({\n      items: toolbarItems\n    });\n\n    const disableUi = () => {\n      streamBtn.disable();\n      streamBtn.toggle(false, true);\n      streamBtn.setIconClass('sm-stream-stopped-icon');\n      recordingBtn.disable();\n      preserveCb.disable();\n      wrapBtn.disable();\n      clearBtn.disable();\n    };\n\n    const enableUi = () => {\n      streamBtn.enable();\n      recordingBtn.enable();\n      preserveCb.enable();\n      wrapBtn.enable();\n      clearBtn.enable();\n    };\n\n    const config = {\n      html: '<div class=\"sm-log-wrapper\"></div>',\n      cls: 'sm-round-panel sm-log-panel',\n      bodyCssClass: 'sm-log-panel-body',\n      tbar,\n      disableUi,\n      enableUi\n    };\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n    disableUi();\n  },\n  afterRender: function () {\n    // setup element event handlers\n    const contentDiv = this.body.dom;\n    this.wrapperDiv = contentDiv.querySelector('.sm-log-wrapper');\n    this.superclass().afterRender.call(this);\n    this.applyEmptyString();\n    // content div scroll handling\n    function isAtBottom() {\n      // Allow a small threshold for float rounding\n      return contentDiv.scrollHeight - contentDiv.scrollTop - contentDiv.clientHeight < 5;\n    }\n    contentDiv.addEventListener('scroll', () => {\n      this.shouldAutoScroll = isAtBottom();\n    });\n\n    // div click handler\n    let selectedLogLineEl = null;\n    contentDiv.addEventListener('click', (event) => {\n      if (event.target.classList.contains('sm-log-line')) {\n        const logLineEl = event.target;\n        if (selectedLogLineEl) {\n          selectedLogLineEl.classList.remove('selected');\n        }\n        logLineEl.classList.add('selected');\n        selectedLogLineEl = logLineEl;\n        const data = JSON.parse(logLineEl.textContent);\n        this.fireEvent('logLineSelected', data);\n      }\n    });\n\n  },\n  addLogString: function (logLine) {\n    this.logLines.push(logLine);\n    if (this.writableStream) {\n      this.writableStream.write(logLine + '\\n').catch((err) => {\n        console.error('Error writing to file:', err);\n      });\n    }\n    if (this.logLines.length > this.maxLines) this.logLines.shift();\n    if (!this.needsUpdate) {\n      this.needsUpdate = true;\n      requestAnimationFrame(this.updatePanelBody.bind(this));\n    }\n  },\n  updatePanelBody: function () {\n    // Anchor scroll position if not auto-scrolling\n    let anchorId = null;\n    let anchorOffset = 0;\n    if (!this.shouldAutoScroll && this.logDivs.length) {\n      // Find the first visible log line\n      const wrapper = this.wrapperDiv;\n      const scrollTop = this.body.dom.scrollTop;\n      for (const el of wrapper.children) {\n        if (el.offsetTop + el.offsetHeight > scrollTop) {\n          anchorId = el.textContent;\n          anchorOffset = el.offsetTop - scrollTop;\n          break;\n        }\n      }\n    }\n\n    for (const logLine of this.logLines) {\n      const json = JSON.parse(logLine);\n      const logTextEl = document.createElement('div');\n      logTextEl.textContent = logLine + '\\n';\n      logTextEl.className = `sm-log-line`;\n      logTextEl.dataset.level = json.level;\n      logTextEl.dataset.component = json.component;\n      if (json.component === 'rest') {\n        logTextEl.dataset.type = json.type;\n        if (json.type === 'request' || json.type === 'response') {\n          logTextEl.dataset.requestId = json.data.requestId;\n        } else if (json.type === 'transaction') {\n          logTextEl.dataset.requestId = json.data.request?.requestId;\n        }\n      }\n      this.logDivs.push(logTextEl);\n      if (this.logDivs.length > this.maxLines) {\n        this.logDivs = this.logDivs.slice(this.logDivs.length - this.maxLines);\n      }\n    }\n    this.wrapperDiv.replaceChildren(...this.logDivs);\n\n    this.logLines = [];\n    if (this.shouldAutoScroll) {\n      this.body.dom.scrollTop = this.body.dom.scrollHeight;\n    } else if (anchorId) {\n      // Restore scroll position to keep the same log line at the same offset\n      for (const el of this.wrapperDiv.children) {\n        if (el.textContent === anchorId) {\n          this.body.dom.scrollTop = el.offsetTop - anchorOffset;\n          break;\n        }\n      }\n    }\n    this.needsUpdate = false;\n  },\n  startStreaming: function (filter) {\n    if (SM.LogStream.Socket) {\n      this.clearEmptyString();\n      if (!this.preserveLog) {\n        this.clearPanel();\n      }\n      const message = {\n        type: 'command',\n        data: {\n          command: 'stream-start',\n        }\n      }\n      if (filter) {\n        message.data.filter = filter;\n      }\n      SM.LogStream.Socket.send(JSON.stringify(message));\n    }\n  },\n  stopStreaming: function () {\n    if (SM.LogStream.Socket) {\n      SM.LogStream.Socket.send(JSON.stringify({ type: 'command', data: { command: 'stream-stop' } }));\n    }\n  },\n  applyEmptyString: function (string) {\n    this.wrapperDiv.innerHTML = string ?? this.emptyString;\n  },\n  clearEmptyString: function () {\n    const emptyEl = this.wrapperDiv.querySelector('#sm-log-empty');\n    if (emptyEl) {\n      this.wrapperDiv.removeChild(emptyEl);\n    }\n  },\n  clearPanel: function () {\n    this.logDivs = [];\n    this.wrapperDiv.innerHTML = '';\n  },\n});\n\nSM.LogStream.JsonTreePanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const config = {\n      bodyStyle: 'overflow-y:auto;',\n      html: this.emptyString,\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  },\n  tree: null,\n  emptyString: '<div style=\"padding: 10px;color:#999\">Select a log record</div>',\n  loadData: function (data) {\n    this.tree = JsonView.createTree(data)\n    this.tree.isExpanded = true\n    this.tree.children[4].isExpanded = true // 'data' property\n    if (this.tree.children[3].value === \"transaction\") {\n      for (const child of this.tree.children[4].children) {\n        child.isExpanded = true\n      }\n    }\n    if (this.body) {\n      this.body.dom.textContent = ''\n      JsonView.render(this.tree, this.body.dom)\n    }\n  },\n  renderTree: function () {\n    if (this.tree) {\n      JsonView.render(this.tree, this.body.dom)\n    }\n  },\n  clearData: function () {\n    this.tree = null\n    if (this.body) {\n      this.update(this.emptyString)\n    }\n  }\n\n})\n\nSM.LogStream.TransactionGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    this.requestMap = new Map();\n    const store = new Ext.data.JsonStore({\n      fields: ['requestId', 'timestamp', 'source', 'user', 'browser', 'url', 'status', 'length', 'duration', 'operationId'],\n      root: '',\n      idProperty: 'requestId',\n    });\n    const columns = [\n      { header: 'Timestamp', dataIndex: 'timestamp', width: 150, xtype: 'datecolumn', format: 'Y-m-d H:i:s.u T' },\n      { header: 'Source', dataIndex: 'source', width: 100, filter: { type: 'string' } },\n      { header: 'User', dataIndex: 'user', width: 100, filter: { type: 'string' } },\n      { header: 'Browser', dataIndex: 'browser', width: 100, filter: { type: 'string' } },\n      { header: 'Operation ID', dataIndex: 'operationId', width: 100, filter: { type: 'string' } },\n      { header: 'URL', dataIndex: 'url', width: 200 },\n      { header: 'Status', dataIndex: 'status', width: 100, renderer: this.statusRenderer, align: 'center', filter: { type: 'values' } },\n      { header: 'Length (b)', dataIndex: 'length', width: 100, align: 'right' },\n      { header: 'Duration (ms)', dataIndex: 'duration', width: 100, align: 'right' },\n    ];\n    const view = new SM.ColumnFilters.GridView({\n      forceFit: true,\n      emptyText: 'No transactions to display',\n      deferEmptyText: false,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())\n        }\n      }\n    });\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        new SM.RowCountTextItem({\n          store,\n          width: 100,\n          noun: 'request',\n          // iconCls: 'sm-logs-icon'\n        })\n      ]\n    })\n\n    const config = {\n      store,\n      columns,\n      view,\n      bbar,\n    };\n    Ext.apply(this, Ext.apply(this.initialConfig, config));\n    this.superclass().initComponent.call(this);\n  },\n  addTransaction: function (logObj) {\n    const logData = logObj.data\n    const record = {\n      requestId: logData.request.requestId,\n      timestamp: logObj.date,\n      source: logData.request.source,\n      user: logData.request.headers?.accessToken?.preferred_username,\n      browser: SM.LogStream.GetBrowser(logData.request.headers['user-agent']),\n      url: `${logData.request.method} ${logData.request.url}`,\n      status: `${logData.response.status}`,\n      length: logData.response.headers?.['content-length'],\n      duration: logData.operationStats.durationMs,\n      operationId: logData.operationStats.operationId\n    };\n    const store = this.getStore();\n    if (store.data.length > 999) {\n      store.removeAt(0);\n    }\n    store.loadData([record], true);\n    const view = this.getView();\n    view.scroller.dom.scrollTop = view.scroller.dom.scrollHeight;\n  },\n  addRequest: function (logObj) {\n    const logData = logObj.data\n    const record = {\n      requestId: logData.requestId,\n      timestamp: logObj.date,\n      source: logData.source,\n      user: logData.headers?.accessToken?.preferred_username,\n      browser: SM.LogStream.GetBrowser(logData.headers['user-agent']),\n      url: `${logData.method} ${logData.url}`,\n    };\n    this.requestMap.set(logData.requestId, record);\n  },\n  addResponse: function (logObj) {\n    const logData = logObj.data\n    const requestRecord = this.requestMap.get(logData.requestId);\n    if (requestRecord) {\n      requestRecord.status = `${logData.status}`;\n      requestRecord.length = logData.headers?.['content-length'];\n      requestRecord.duration = logData.operationStats.durationMs;\n      requestRecord.operationId = logData.operationStats.operationId;\n      const store = this.getStore();\n      if (store.data.length > 999) {\n        store.removeAt(0);\n      }\n      store.loadData([requestRecord], true);\n      const view = this.getView();\n      view.scroller.dom.scrollTop = view.scroller.dom.scrollHeight;\n      this.requestMap.delete(logData.requestId);\n    }\n  },\n  statusRenderer: function (value, metaData, record, rowIndex, colIndex, store) {\n    let css = ''\n    if (value >= 200 && value <= 299) {\n      css = 'sm-http-status-sprite sm-http-status-200';\n    } else if (value >= 300 && value <= 399) {\n      css = 'sm-http-status-sprite sm-http-status-300';\n    } else if (value >= 400 && value <= 499) {\n      css = 'sm-http-status-sprite sm-http-status-400';\n    } else if (value >= 500 && value <= 599) {\n      css = 'sm-http-status-sprite sm-http-status-500';\n    }\n    return `<span class=\"${css}\">${value}</span>`;\n  }\n});\n\nSM.LogStream.Socket = null\n\nSM.LogStream.GetBrowser = function (userAgent) {\n  const browsers = [\n    { name: 'Chrome', regex: /Chrome\\/([0-9.]+$)/ },\n    { name: 'Firefox', regex: /Firefox\\/([0-9.]+$)/ },\n    { name: 'Safari', regex: /Version\\/([0-9.]+).*Safari/ },\n    { name: 'Edge', regex: /Edg\\/([0-9.]+$)/ },\n  ];\n\n  for (const browser of browsers) {\n    const match = userAgent.match(browser.regex);\n    if (match) {\n      return `${browser.name}/${match[1]}`;\n    }\n  }\n\n  return 'Unknown/0';\n}\n\nSM.LogStream.Filter.LevelFieldSet = Ext.extend(Ext.form.FieldSet, {\n  initComponent: function () {\n    const level1 = new Ext.form.Checkbox({\n      prop: 1,\n      boxLabel: 'Error'\n    })\n    const level2 = new Ext.form.Checkbox({\n      prop: 2,\n      boxLabel: 'Warning'\n    })\n    const level3 = new Ext.form.Checkbox({\n      prop: 3,\n      boxLabel: 'Info'\n    })\n\n    const items = [\n      level3,\n      level2,\n      level1\n    ]\n\n    function getValues() {\n      const values = []\n      for (const item of items) {\n        if (item.getValue()) {\n          values.push(item.prop)\n        }\n      }\n      return values.length < items.length ? values : undefined\n    }\n    const config = {\n      title: this.title || 'Level',\n      defaults: {\n        hideLabel: true,\n        checked: true\n      },\n      autoHeight: true,\n      items,\n      getValues\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.LogStream.Filter.ComponentFieldSet = Ext.extend(Ext.form.FieldSet, {\n  initComponent: function () {\n    const items = []\n\n    for (const item of ['jwksCache', 'mysql', 'logSocket', 'rest', 'static']) {\n      items.push(new Ext.form.Checkbox({\n        prop: item,\n        boxLabel: item\n      }))\n    }\n\n    function getValues() {\n      const values = []\n      for (const item of items) {\n        if (item.getValue()) {\n          values.push(item.prop)\n        }\n      }\n      return values.length < items.length ? values : undefined\n    }\n\n    const config = {\n      title: this.title || 'Component',\n      defaults: {\n        hideLabel: true,\n        checked: true\n      },\n      autoHeight: true,\n      items,\n      getValues\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.LogStream.Filter.Panel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const filterFn = this.onFilter || Ext.emptyFn\n    const _this = this\n    const levelFieldset = new SM.LogStream.Filter.LevelFieldSet({\n      width: 100\n    })\n    const componentFieldset = new SM.LogStream.Filter.ComponentFieldSet({\n      width: 100\n    })\n    const button = new Ext.Button({\n      style: 'float: right; margin-top: 6px;',\n      cls: 'x-toolbar',\n      text: 'Stream',\n      iconCls: 'sm-stream-stopped-icon',\n      handler: () => {\n        if (_this.menu) _this.menu.hide()\n        const levelValues = levelFieldset.getValues()\n        const componentValues = componentFieldset.getValues()\n\n        let filter = null;\n        if (levelValues || componentValues) {\n          filter = {};\n          if (levelValues) filter.level = levelValues;\n          if (componentValues) filter.component = componentValues;\n        }\n        filterFn(filter);\n      }\n    })\n    function getValue() {\n      const levelValues = levelFieldset.getValues()\n      const componentValues = componentFieldset.getValues()\n\n      let filter = null;\n      if (levelValues || componentValues) {\n        filter = {};\n        if (levelValues) filter.level = levelValues;\n        if (componentValues) filter.component = componentValues;\n      }\n      return filter\n    }\n    const config = {\n      getValue,\n      layout: 'form',\n      border: false,\n      autoWidth: true,\n      items: [\n        levelFieldset,\n        componentFieldset,\n        // button\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.LogStream.setupSocket = async function () {\n  return new Promise((resolve, reject) => {\n    const locationUrl = new URL(window.location);\n    const wsProtocol = locationUrl.protocol === 'https:' ? 'wss:' : 'ws:';\n    const wsUrl = wsProtocol + '//' + locationUrl.host + locationUrl.pathname + 'socket/log-socket';\n\n    function openHandler(event) {\n      console.log('WebSocket opened:', event);\n      ws.removeEventListener('open', openHandler);\n      ws.removeEventListener('error', errorHandler);\n      SM.LogStream.Socket = ws;\n      resolve();\n    }\n\n    function errorHandler(event) {\n      console.log('WebSocket error:', event);\n      ws.removeEventListener('open', openHandler);\n      ws.removeEventListener('error', errorHandler);\n      reject(new Error(`Feature unavailable. Error establishing WebSocket connection to ${event.target.url}.<br><br>\n        This is usually caused by a reverse proxy not handling HTTP Upgrade requests. For nginx and compatible proxies:<br><br>\n        <pre>\n        proxy_http_version      1.1;\n        proxy_set_header        Upgrade $http_upgrade;\n        proxy_set_header        Connection \"upgrade\";\n        proxy_set_header        Host $host;\n        proxy_read_timeout      3600s;\n        </pre>\n`));\n    }\n\n    const ws = new WebSocket(wsUrl);\n    ws.addEventListener('open', openHandler);\n    ws.addEventListener('error', errorHandler);\n  });\n};\n\nSM.LogStream.showLogTab = async function ({ treePath }) {\n  const tab = Ext.getCmp('main-tab-panel').getItem('logstream-admin-tab')\n  if (tab) {\n    tab.show()\n    return\n  }\n\n  const logPanel = new SM.LogStream.LogPanel({\n    region: 'center',\n    cls: 'sm-round-panel',\n    margins: { top: SM.Margin.top, right: SM.Margin.adjacent, bottom: SM.Margin.adjacent, left: SM.Margin.edge },\n    border: false,\n    listeners: {\n      destroy: function () {\n        if (SM.LogStream.Socket) {\n          SM.LogStream.Socket.removeEventListener('message', mainMessageHandler);\n          SM.LogStream.Socket.removeEventListener('close', closeHandler);\n\n          SM.LogStream.Socket.close();\n        }\n        if (logPanel.writableStream) {\n          logPanel.writableStream.close();\n        }\n      },\n      logLineSelected: function (data) {\n        jsonPanel.loadData(data);\n        const requestId = data.data?.requestId || data.data?.request?.requestId;\n        if (requestId) {\n          const transactionRecord = transactionGrid.getStore().getById(requestId);\n          if (transactionRecord) {\n            const rowIndex = transactionGrid.getStore().indexOf(transactionRecord);\n            transactionGrid.getSelectionModel().selectRow(rowIndex);\n            transactionGrid.getView().focusRow(rowIndex);\n          } else {\n            transactionGrid.getSelectionModel().clearSelections();\n          }\n        } else {\n          transactionGrid.getSelectionModel().clearSelections();\n        }\n\n      },\n      logCleared: function () {\n        jsonPanel.clearData();\n        transactionGrid.store.removeAll();\n      }\n    }\n  });\n\n  const jsonPanel = new SM.LogStream.JsonTreePanel({\n    title: 'JSON Tree',\n    cls: 'sm-round-panel',\n    margins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.adjacent, left: SM.Margin.adjacent },\n    region: 'east',\n    border: false,\n    split: true,\n    iconCls: 'sm-json-icon',\n    width: 400\n  })\n\n  const logAndJsonPanel = new Ext.Panel({\n    margins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.adjacent, left: SM.Margin.edge },\n    region: 'center',\n    layout: 'border',\n    border: false,\n    items: [logPanel, jsonPanel]\n  })\n\n  const transactionGrid = new SM.LogStream.TransactionGrid({\n    region: 'south',\n    margins: { top: SM.Margin.adjacent, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n    cls: 'sm-round-panel',\n    split: true,\n    title: 'API Transactions',\n    height: 400,\n    border: false,\n    listeners: {\n      rowclick: function (grid, rowIndex, e) {\n        const record = grid.getStore().getAt(rowIndex);\n        const requestId = record.get('requestId');\n        if (requestId) {\n          const logLineEl = logPanel.wrapperDiv.querySelector(\n            `.sm-log-line[data-request-id=\"${requestId}\"]:is([data-type=\"request\"], [data-type=\"transaction\"])`\n          );\n          if (logLineEl) {\n            logLineEl.click();\n            // Scroll to the log line\n            const contentDiv = logPanel.body.dom;\n            const logLineOffset = logLineEl.offsetTop;\n            contentDiv.scrollTop = logLineOffset - contentDiv.clientHeight / 2;\n          }\n        }\n      },\n      rowdblclick: function (grid, rowIndex, e) {\n        const record = grid.getStore().getAt(rowIndex);\n        const requestId = record.get('requestId');\n        if (requestId) {\n          const logLineEl = logPanel.wrapperDiv.querySelector(`.sm-log-line[data-request-id=\"${requestId}\"][data-type=\"response\"]`);\n          if (logLineEl) {\n            logLineEl.click();\n            // Scroll to the log line\n            const contentDiv = logPanel.body.dom;\n            const logLineOffset = logLineEl.offsetTop;\n            contentDiv.scrollTop = logLineOffset - contentDiv.clientHeight / 2;\n          }\n        }\n      }\n    }\n  });\n\n  async function mainMessageHandler(event) {\n    const message = JSON.parse(event.data);\n    if (message.type === 'log') {\n      logPanel.addLogString(JSON.stringify(message.data));\n      const logObj = message.data;\n      if (logObj.type === 'transaction' && logObj.component === 'rest') {\n        transactionGrid.addTransaction(logObj);\n      } else if (logObj.type === 'request' && logObj.component === 'rest') {\n        transactionGrid.addRequest(logObj);\n      } else if (logObj.type === 'response' && logObj.component === 'rest') {\n        transactionGrid.addResponse(logObj);\n      }\n    } else if (message.type === 'authorize' && message.data.state === 'unauthorized') {\n      try {\n        await authorizeWebSocket();\n        console.log('WebSocket authorized');\n        logPanel.applyEmptyString();\n      } catch (error) {\n        console.error('WebSocket authorization failed:', error);\n        // logPanel.applyEmptyString(`<div id=\"sm-log-empty\" style=\"padding: 10px;color:#999\">Socket closed.<br>${error.message}</div>`);\n        SM.LogStream.Socket.close(4001, error.message);\n      }\n    }\n  }\n\n  async function authorizeWebSocket() {\n    return new Promise((resolve, reject) => {\n      const timeout = setTimeout(() => {\n        reject(new Error('Authorization timeout after 10 seconds'));\n      }, 10000);\n      function messageHandler(event) {\n        clearTimeout(timeout);\n        const message = JSON.parse(event.data);\n        if (message.type === 'authorize' && message.data.state === 'authorized') {\n          resolve(message);\n        } else if (message.type === 'error' && message.data.message.startsWith('Authorization failed')) {\n          reject(new Error(message.data.message));\n        }\n      }\n      SM.LogStream.Socket.addEventListener('message', messageHandler, {once: true});\n      SM.LogStream.Socket.send(JSON.stringify({ type: 'authorize', data: { token: window.oidcWorker.token } }));\n    });\n  }\n\n  const thisTab = Ext.getCmp('main-tab-panel').add({\n    id: 'logstream-admin-tab',\n    sm_treePath: treePath,\n    iconCls: 'sm-logs-icon',\n    title: 'Log Stream',\n    closable: true,\n    layout: 'border',\n    items: [logAndJsonPanel, transactionGrid]\n  })\n  thisTab.show()\n\n  try {\n    await SM.LogStream.setupSocket()\n    SM.LogStream.Socket.addEventListener('message', mainMessageHandler);\n    SM.LogStream.Socket.addEventListener('close', closeHandler);\n    logPanel.enableUi();\n\n    const bc = new BroadcastChannel(window.oidcWorker.channelName);\n    function tokenBroadcastHandler(event) {\n      if (event.data.type === 'accessToken') {\n        console.log('{log-stream] Received from worker:', event.type, event.data)\n        SM.LogStream.Socket?.send(JSON.stringify({ type: 'authorize', data: { token: event.data.accessToken } }))\n      }\n    }\n    bc.addEventListener('message', tokenBroadcastHandler)\n\n    const maxReconnectAttempts = 5;\n\n    function closeHandler(event) {\n      console.log('WebSocket closed with code:', event.code, 'reason:', event.reason);\n      bc.removeEventListener('message', tokenBroadcastHandler);\n      SM.LogStream.Socket.removeEventListener('message', mainMessageHandler);\n      SM.LogStream.Socket.removeEventListener('close', closeHandler);\n      logPanel.disableUi();\n\n      // Don't reconnect on authentication failures (custom codes) or manual closure\n      if (event.code === 1000 || event.code >= 4000) {\n        logPanel.applyEmptyString(`<div id=\"sm-log-empty\" style=\"padding: 10px;color:#999\">Connection closed: ${event.reason || 'Manual closure'}</div>`);\n        return;\n      }\n\n      retryHandler(1);\n    }\n\n    function retryHandler(attempt) {\n      if (attempt > maxReconnectAttempts) {\n        logPanel.applyEmptyString(`<div id=\"sm-log-empty\" style=\"padding: 10px;color:#999\">Connection failed after ${maxReconnectAttempts} attempts.</div>`);\n        return;\n      }\n      const delay = Math.min(1000 * Math.pow(2, attempt - 1), 30000); // Cap at 30s\n      logPanel.applyEmptyString(`<div id=\"sm-log-empty\" style=\"padding: 10px;color:#999\">Connection lost. Reconnecting in ${delay / 1000}s... (${attempt}/${maxReconnectAttempts})</div>`);\n      setTimeout(async () => {\n        try {\n          console.log(`Reconnection attempt ${attempt}/${maxReconnectAttempts}`);\n          await SM.LogStream.setupSocket();\n          SM.LogStream.Socket.addEventListener('message', mainMessageHandler);\n          SM.LogStream.Socket.addEventListener('close', closeHandler);\n          bc.addEventListener('message', tokenBroadcastHandler);\n          logPanel.applyEmptyString();\n          logPanel.enableUi();\n        } catch (error) {\n          console.error('Reconnection failed:', error);\n          retryHandler(attempt + 1);\n        }\n      }, delay);\n    }\n\n  } catch (error) {\n    logPanel.update(`<div id=\"sm-log-empty\" style=\"padding: 10px;color:#999\">${error.message}</div>`);\n    logPanel.disableUi();\n    return;\n  }\n\n}\n\n"
  },
  {
    "path": "client/src/js/SM/MainPanel.js",
    "content": "Ext.ns('SM')\n\nSM.Margin = {\n  adjacent: 3,\n  top: 6,\n  bottom: 0,\n  edge: 0\n}\n\nSM.MainTabPanel = Ext.extend(Ext.TabPanel, {\n  initComponent: function () {\n    const me = this\n    this.onCollectionChanged = change => {\n      if (change.name) {\n        for (const tab of me.items.items) {\n          if (tab.collectionId === change.collectionId) {\n            tab.collectionName = change.name\n            tab.updateTitle.call(tab)\n          }\n        }\n      }\n    }\n    this.onCollectionDeleted = collectionId => {\n      const tabsToRemove = me.items.items.filter( tab => tab.collectionId === collectionId )\n      for (const tab of tabsToRemove) {\n          me.remove(tab)\n      }\n    }\n    const config = {\n      plugins: new SM.TabEnhancements(),\n      title: 'STIGManager',\n      enableTabScroll: true,\n      activeTab: 0,\n      listeners: {\n        beforetabchange: function (tabPanel, newTab, currentTab) {\n          // For IE: Keep the panels in the same scroll position after tab changes\n          if (Ext.isIE) {\n            if (Ext.isDefined(currentTab)) {\n              if (currentTab.sm_TabType == 'asset_review') {\n                var vCur = currentTab.sm_GroupGridView;\n                vCur.scrollTop = vCur.scroller.dom.scrollTop;\n                vCur.scrollHeight = vCur.scroller.dom.scrollHeight;\n              }\n            }\n            if (Ext.isDefined(newTab)) {\n              if (newTab.sm_TabType == 'asset_review') {\n                var vNew = newTab.sm_GroupGridView;\n                if (Ext.isDefined(vNew.scroller)) {\n                  setTimeout(function () {\n                    vNew.scroller.dom.scrollTop = vNew.scrollTop + (vNew.scrollTop == 0 ? 0 : vNew.scroller.dom.scrollHeight - vNew.scrollHeight);\n                  }, 100);\n                }\n              }\n            }\n          }\n        },\n        tabchange: function (tp, tab) {\n          // expand the navigation tree to the source node\n          if (tab.sm_treePath) {\n            Ext.getCmp('app-nav-tree').selectPath(tab.sm_treePath)\n          }\n        }\n      },\n      items: []\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.MainTabPanel.superclass.initComponent.call(this)\n    SM.Dispatcher.addListener('collectionchanged', this.onCollectionChanged)\n    SM.Dispatcher.addListener('collectiondeleted', this.onCollectionDeleted)\n  }\n})\n\nSM.HomeTab = Ext.extend(Ext.Panel, {\n  initComponent: function() {\n    const me = this\n    const config = {\n      // title: 'Home',\n      autoScroll: true,\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.HomeTab.superclass.initComponent.call(this)\n  }\n})\n\nSM.WelcomeWidget = Ext.extend(Ext.Panel, {\n  initComponent: function() {\n      const me = this\n      const id = Ext.id()\n      const tpl = new Ext.XTemplate(\n          `<div class=sm-home-widget-header>`,\n            `<div class='sm-home-widget-title'>Welcome</div>`,\n          `</div>`,\n          `<div class=\"sm-scroll-home-widget-body\">`,\n            `<div class='sm-home-widget-text'>`,\n              `<div class=sm-home-widget-image-text-wrap>`,\n                `<img src=${STIGMAN.Env.welcome.image ? `\"${STIGMAN.Env.welcome.image}\" onerror=\"this.onerror=null;this.src='img/navy.svg';\"` : '\"img/navy.svg\"'} style=\"max-width:100%;max-height:100%;\"/>`,\n              `</div>`,\n              `<b>STIG Manager</b> is an API and Web client for managing the assessment of Information Systems for compliance with <a href=\"https://public.cyber.mil/stigs/\">security checklists</a> published by the United States Defense Information Systems Agency (DISA). The software is <a target=\"_blank\" href=\"https://github.com/NUWCDIVNPT/stig-manager\">an open source project</a> maintained by the Naval Sea Systems Command (NAVSEA) of the United States Navy.`,\n            `</div>`, \n\n            `<div class='sm-home-widget-text'>`,\n              `<div class='sm-home-widget-subtitle'>\n                ${STIGMAN.Env.welcome.title ? SM.he(STIGMAN.Env.welcome.title) : STIGMAN.Env.welcome.message || STIGMAN.Env.welcome.link ? 'Support' : ''}\n                </div>`,\n                `${SM.he(STIGMAN.Env.welcome.message)}${STIGMAN.Env.welcome.message && STIGMAN.Env.welcome.link ? '<br><br>' : ''}`,\n                `${STIGMAN.Env.welcome.link ? '<a href=\"' + STIGMAN.Env.welcome.link + '\">' + STIGMAN.Env.welcome.link  + '</a>': ''}`,\n            `</div>`,\n          `</div>`,\n        )\n      const config = {\n        tpl: tpl,\n        bodyCssClass: 'sm-home-widget-body',\n        border: false,\n        data: [1]\n      }\n      Ext.apply(this, Ext.apply(this.initialConfig, config))\n      SM.WelcomeWidget.superclass.initComponent.call(this)\n  }\n})\nExt.reg('sm-home-widget-welcome', SM.WelcomeWidget)\n\nSM.DocWidget = Ext.extend(Ext.Panel, {\n  initComponent: function() {\n      const me = this\n      const id = Ext.id()\n      const tpl = new Ext.XTemplate(\n          `<div class=sm-home-widget-header>`,\n          `<div class='sm-home-widget-title'>Documentation</div>`,\n          `</div>`,        \n\n          // `<div class='sm-home-widget-subtitle'>Project Home</div>`,\n          // `<div class='sm-home-widget-text'>What is <a target=\"_blank\" href=\"https://github.com/NUWCDIVNPT/stig-manager#stig-manager\">STIG Manager OSS</a>?</div>`,\n\n          `<div class='sm-home-widget-text'>`,\n          `<div class='sm-home-widget-subtitle'>Need help?</div>`,\n          `Check out our <a target=\"_blank\" href=\"docs/index.html\">Documentation</a>`,\n          `</div>`,\n          \n          `<div class='sm-home-widget-text'>`,\n          `<div class='sm-home-widget-subtitle'> Just Getting Started? </div>`,\n          `Check out our <a target=\"_blank\" href=\"docs/user-guide/user-quickstart.html\">User Walkthrough</a> or the <a target=\"_blank\" href=\"docs/user-guide/user-guide.html\">User Guide</a>`,\n          `</div>`,\n\n          `<div class='sm-home-widget-text'>`,\n          `<div class='sm-home-widget-subtitle'>Common Tasks </div>`,\n          `Not sure how to do something in STIG Manager? Check out these links to <a target=\"_blank\" href=\"docs/features/common-tasks.html\">Common Tasks</a>`,\n          `</div>`,\n\n          `<div class='sm-home-widget-text'>`,\n          `<div class='sm-home-widget-subtitle'>Issues, Feature Requests, and Contributions</div>`,\n          `Want to report a bug, request a feature, or help out the project? <a target=\"_blank\" href=\"docs/the-project/contributing.html\">Check out our Contribution Guide</a>`,\n          `</div>`,\n          \n        )\n      const config = {\n        tpl: tpl,\n        bodyCssClass: 'sm-home-widget-body',\n        border: false,\n        data: [1]\n      }\n      Ext.apply(this, Ext.apply(this.initialConfig, config))\n      SM.DocWidget.superclass.initComponent.call(this)\n  }\n})\nExt.reg('sm-home-widget-doc', SM.DocWidget)\n\nSM.ResourcesWidget = Ext.extend(Ext.Panel, {\n  initComponent: function() {\n      const me = this\n      const id = Ext.id()\n      const tpl = new Ext.XTemplate(\n          `<div class=sm-home-widget-header>`,\n          `<div class='sm-home-widget-title'>Resources</div>`,\n          `</div>`,\n          `<div class='sm-home-widget-text'>`,\n          `<div class='sm-home-widget-subtitle'>GitHub</div>`,\n          `<p><a target=\"_blank\" href=\"https://github.com/NUWCDIVNPT/stig-manager\">STIG Manager</a></p>`,\n          `<p><a target=\"_blank\" href=\"https://github.com/NUWCDIVNPT/stigman-watcher\">STIG Manager Watcher</a></p>`,\n          // `<p><a target=\"_blank\" href=\"https://github.com/Code-dot-mil/code.mil\">Code.mil</a></p>`,\n          `</div>`,\n          `<div class='sm-home-widget-text'>`,\n          `<div class='sm-home-widget-subtitle'>DISA STIGs</div>`,\n          `Get the latest STIGs at <a target=\"_blank\" href=\"https://public.cyber.mil/stigs/downloads/\">cyber.mil</a>.`,\n          `</div>`,\n          `<div class='sm-home-widget-text'>`,\n          `<div class='sm-home-widget-subtitle'>RMF Reference</div>`,\n          `STIG Manager assists with STEP 4 of the <a target=\"_blank\" href=\"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf\">Risk Management Framework Process</a>.`,\n          `</div>`,\n          `<div class='sm-home-widget-text'>`,\n          `<div class='sm-home-widget-subtitle'>DevSecOps</div>`,\n          `STIG Manager is being developed as part of the <a target=\"_blank\" href=\"https://software.af.mil/dsop/documents/\">DoD Enterprise DevSecOps</a> and <a target=\"_blank\" href=\"https://code.mil\">Code.mil Open Source </a> initiatives.`,\n          `</div>`,\n\n        )\n      const config = {\n        tpl: tpl,\n        bodyCssClass: 'sm-home-widget-body',\n        border: false,\n        data: [1]\n      }\n      Ext.apply(this, Ext.apply(this.initialConfig, config))\n      SM.ResourcesWidget.superclass.initComponent.call(this)\n  }\n})\nExt.reg('sm-home-widget-resources', SM.ResourcesWidget)\n\nSM.ApplicationManagers = Ext.extend(Ext.Panel, {\n  initComponent: function() {\n      const me = this\n      me.userListId = Ext.id()\n\n      const tpl = new Ext.XTemplate(\n      `<div class=\"sm-home-widget-header\">`,\n        `<div class=\"sm-home-widget-title\">\n          Application Managers\n        </div>`,\n      `</div>`,\n      `<div class=\"sm-scroll-home-widget-body\">`,\n        `<div class=\"sm-home-widget-text\">`,\n          `<div id=\"${me.userListId}\" class=\"sm-user-list\">\n          </div>`,\n        `</div>`,\n      `</div>`\n      \n        )\n      const config = {\n        tpl: tpl,\n        bodyCssClass: 'sm-home-widget-body',\n        border: false,\n        data: {},\n        autoScroll: false\n      }\n      Ext.apply(this, Ext.apply(this.initialConfig, config))\n      SM.ApplicationManagers.superclass.initComponent.call(this)\n      this.on('afterrender', this.loadApplicationManagers, this)\n  },\n  loadApplicationManagers: async function () {\n    const me = this;\n    try {\n      const response = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/users?privilege=admin&status=available`,\n        method: 'GET',\n        headers: { 'Content-Type': 'application/json;charset=utf-8' },\n      })\n      const userList = Ext.get(me.userListId)\n      if (userList) {\n        const userItems = response\n          .map((user) => {\n            return `\n           <li class=\"sm-user-item\">\n              <div class=\"sm-user-details\">\n                <span class=\"sm-user-name\">${SM.he(user.displayName)}</span>\n                ${user.email\n                  ? `<span class=\"sm-user-email\">${SM.he(user.email)}</span>`\n                  : `<span class=\"sm-user-email\">No Email Available</span>`}\n              </div>\n          </li>`\n          })\n          .join('')\n        userList.update(`<ul>${userItems}</ul>`)\n      }\n \n    } catch (e) {\n      SM.Error.handleError(e)\n    }\n  }\n})\nExt.reg('sm-home-widget-app-managers', SM.ApplicationManagers)\n\nSM.StigWidget = Ext.extend(Ext.Panel, {\n  initComponent: function() {\n      const me = this\n      const id = Ext.id()\n      const tpl = new Ext.XTemplate(\n          `<div class=sm-home-widget-header>`,\n          `<div class='sm-home-widget-title'>STIG updates</div>`,\n          `</div>`,\n          `<div class='sm-reviews-home-body-text'>Lorum ipsum sit dolor.</div>`,\n        )\n      const config = {\n        tpl: tpl,\n        bodyCssClass: 'sm-home-widget-body',\n        border: false,\n        data: [1]\n      }\n      Ext.apply(this, Ext.apply(this.initialConfig, config))\n      SM.StigWidget.superclass.initComponent.call(this)\n  }\n})\nExt.reg('sm-home-widget-stig', SM.StigWidget)\n"
  },
  {
    "path": "client/src/js/SM/Manage.js",
    "content": "'use strict'\n\nExt.ns('SM')\nExt.ns('SM.Manage')\n\nExt.ns('SM.Manage.FieldSettings')\nSM.Manage.FieldSettings.FieldEnabledComboBox = Ext.extend(Ext.form.ComboBox, {\n  initComponent: function () {\n    const config = {\n      displayField: 'display',\n      valueField: 'value',\n      triggerAction: 'all',\n      mode: 'local',\n      editable: false\n    }\n    const _this = this\n    const data = [\n      ['always', 'Always'],\n      ['findings', 'Findings only']\n    ]\n    this.store = new Ext.data.SimpleStore({\n      fields: ['value', 'display']\n    })\n    this.store.on('load', function (store) {\n      _this.setValue(_this.value)\n    })\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n\n    this.store.loadData(data)\n  }\n})\n\nSM.Manage.FieldSettings.FieldRequiredComboBox = Ext.extend(Ext.form.ComboBox, {\n  initComponent: function () {\n    const _this = this\n    const config = {\n      displayField: 'display',\n      valueField: 'value',\n      triggerAction: 'all',\n      mode: 'local',\n      editable: false\n    }\n    const dataAlways = [\n      ['always', 'Always'],\n      ['findings', 'Findings only'],\n      ['optional', 'Optional']\n    ]\n    const dataFails = [\n      ['findings', 'Findings only'],\n      ['optional', 'Optional']\n    ]\n    this.store = new Ext.data.SimpleStore({\n      fields: ['value', 'display']\n    })\n    this.store.on('load', function (store) {\n      _this.setValue(_this.value)\n    })\n\n    this.setListByEnabledValue = function (enabledValue) {\n      const currentValue = _this.value || 'always'\n      if (enabledValue === 'findings') {\n        _this.store.loadData(dataFails)\n        if (currentValue === 'always') {\n          _this.setValue('findings')\n        }\n        else {\n          _this.setValue(currentValue)\n        }\n      }\n      else {\n        _this.store.loadData(dataAlways)\n        _this.setValue(currentValue)\n      }\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n\n    this.setListByEnabledValue(this.enabledField?.value || 'always')\n\n  }\n})\n\nSM.Manage.FieldSettings.ReviewFieldSet = Ext.extend(Ext.form.FieldSet, {\n  initComponent: function () {\n    const _this = this\n    _this.fieldSettings = _this.fieldSettings ?? {\n      detail: {\n        enabled: 'always',\n        required: 'always'\n      },\n      comment: {\n        enabled: 'findings',\n        required: 'findings'\n      }\n    }\n    const detailEnabledCombo = new SM.Manage.FieldSettings.FieldEnabledComboBox({\n      name: 'detailEnabled',\n      value: _this.fieldSettings.detail.enabled,\n      anchor: '-10',\n      listeners: {\n        select: onSelect\n      }\n    })\n    const detailRequiredCombo = new SM.Manage.FieldSettings.FieldRequiredComboBox({\n      name: 'detailRequired',\n      enabledField: detailEnabledCombo,\n      value: _this.fieldSettings.detail.required,\n      anchor: '-5',\n      listeners: {\n        select: onSelect\n      }\n    })\n    detailEnabledCombo.requiredField = detailRequiredCombo\n\n    const commentEnabledCombo = new SM.Manage.FieldSettings.FieldEnabledComboBox({\n      name: 'commentEnabled',\n      value: _this.fieldSettings.comment.enabled,\n      anchor: '-10',\n      listeners: {\n        select: onSelect\n      }\n    })\n    const commentRequiredCombo = new SM.Manage.FieldSettings.FieldRequiredComboBox({\n      name: 'commentRequired',\n      enabledField: commentEnabledCombo,\n      value: _this.fieldSettings.comment.required,\n      anchor: '-5',\n      listeners: {\n        select: onSelect\n      }\n    })\n    commentEnabledCombo.requiredField = commentRequiredCombo\n\n    _this.serialize = function () {\n      return {\n        comment: {\n          enabled: commentEnabledCombo.value,\n          required: commentRequiredCombo.value\n        },\n        detail: {\n          enabled: detailEnabledCombo.value,\n          required: detailRequiredCombo.value\n        }\n      }\n    }\n\n    _this.setValues = function (values) {\n      detailEnabledCombo.setValue(values.detail.enabled)\n      detailRequiredCombo.setValue(values.detail.required)\n      commentEnabledCombo.setValue(values.comment.enabled)\n      commentRequiredCombo.setValue(values.comment.required)\n    }\n\n    function onSelect(item, record, index) {\n      if (item.name === 'detailEnabled' || item.name === 'commentEnabled') {\n        item.requiredField.setListByEnabledValue(item.value)\n      }\n      _this.onFieldSelect && _this.onFieldSelect(_this, item, record, index)\n    }\n\n    const config = {\n      title: _this.title || 'Review fields',\n      labelWidth: 0,\n      hideLabels: true,\n      items: [\n        {\n          layout: 'column',\n          baseCls: 'x-plain',\n          items: [\n            {\n              width: 140,\n              layout: 'form',\n              hideLabels: true,\n              border: false,\n              items: [\n                {\n                  xtype: 'displayfield',\n                  submitValue: false,\n                  value: '<span style=\"font-weight: 600;\">Field</span>'\n                },\n                {\n                  xtype: 'displayfield',\n                  submitValue: false,\n                  value: 'Detail',\n                  height: 22\n                },\n\n                {\n                  xtype: 'displayfield',\n                  submitValue: false,\n                  value: 'Comment',\n                  height: 22\n                }\n              ]\n            },\n            {\n              columnWidth: .5,\n              border: false,\n              hideLabels: true,\n              layout: 'form',\n              items: [\n                {\n                  xtype: 'displayfield',\n                  submitValue: false,\n                  value: '<span style=\"font-weight: 600;\">Enabled</span>'\n                },\n                detailEnabledCombo,\n                commentEnabledCombo\n              ]\n            },\n            {\n              columnWidth: .5,\n              layout: 'form',\n              hideLabels: true,\n              border: false,\n              items: [\n                {\n                  xtype: 'displayfield',\n                  submitValue: false,\n                  value: '<span style=\"font-weight: 600;\">Required to submit</span>'\n                },\n                detailRequiredCombo,\n                commentRequiredCombo,\n              ]\n            }\n          ]\n        }\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nExt.ns('SM.Manage.StatusSettings')\nSM.Manage.StatusSettings.AcceptCheckbox = Ext.extend(Ext.form.Checkbox, {\n  initComponent: function () {\n    const config = {\n      boxLabel: this.boxLabel || 'Accept or Reject reviews'\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Manage.StatusSettings.GrantComboBox = Ext.extend(Ext.form.ComboBox, {\n  initComponent: function () {\n    const config = {\n      displayField: 'display',\n      valueField: 'value',\n      triggerAction: 'all',\n      mode: 'local',\n      editable: false\n    }\n    const _this = this\n    const data = [\n      [3, 'Manage or Owner'],\n      [4, 'Owner']\n    ]\n    this.store = new Ext.data.SimpleStore({\n      fields: ['value', 'display']\n    })\n    this.store.on('load', function (store) {\n      _this.setValue(_this.value)\n    })\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n    this.store.loadData(data)\n  }\n})\n\nSM.Manage.StatusSettings.CriteriaComboBox = Ext.extend(Ext.form.ComboBox, {\n  initComponent: function () {\n    const config = {\n      displayField: 'display',\n      valueField: 'value',\n      triggerAction: 'all',\n      mode: 'local',\n      editable: false\n    }\n    const _this = this\n    const data = [\n      ['result', 'Review result'],\n      ['any', 'any Review field']\n    ]\n    this.store = new Ext.data.SimpleStore({\n      fields: ['value', 'display']\n    })\n    this.store.on('load', function (store) {\n      _this.setValue(_this.value)\n    })\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n    this.store.loadData(data)\n  }\n})\n\nSM.Manage.StatusSettings.StatusFieldSet = Ext.extend(Ext.form.FieldSet, {\n  initComponent: function () {\n    const _this = this\n    _this.statusSettings = _this.statusSettings ?? {\n      canAccept: true,\n      minAcceptGrant: 3,\n      resetCriteria: 'result'\n    }\n    const canAcceptCheckbox = new SM.Manage.StatusSettings.AcceptCheckbox({\n      name: 'canAccept',\n      ctCls: 'sm-cb',\n      hideLabel: true,\n      boxLabel: 'Reviews can be Accepted or Rejected',\n      checked: _this.statusSettings.canAccept,\n      listeners: {\n        check: onStatusCheck\n      }\n    })\n    const grantComboBox = new SM.Manage.StatusSettings.GrantComboBox({\n      name: 'minAcceptGrant',\n      fieldLabel: '<span>Grant required to set Accept or Reject</span>',\n      disabled: !_this.statusSettings.canAccept,\n      width: 125,\n      value: _this.statusSettings.minAcceptGrant,\n      listeners: {\n        select: onComboSelect\n      }\n    })\n\n    const criteriaComboBox = new SM.Manage.StatusSettings.CriteriaComboBox({\n      name: 'resetCriteria',\n      fieldLabel: 'Reset to <img src=\"img/save-icon.svg\" width=12 height=12 ext:qtip=\"Saved\" style=\"padding: 1px 3px 0px 0px;vertical-align:text-top;\"/>Saved upon change to',\n      width: 125,\n      value: _this.statusSettings.resetCriteria || 'result',\n      listeners: {\n        select: onComboSelect\n      }\n    })\n\n    _this.serialize = function () {\n      const output = {}\n      const items = [\n        criteriaComboBox,\n        canAcceptCheckbox,\n        grantComboBox\n      ]\n      for (const item of items) {\n        output[item.name] = item.getValue()\n      }\n      return output\n    }\n\n    _this.setValues = function (values) {\n      criteriaComboBox.setValue(values.resetCriteria || 'result')\n      canAcceptCheckbox.setValue(values.canAccept || false)\n      grantComboBox.setValue(values.minAcceptGrant || 3)\n      grantComboBox.setDisabled(!values.canAccept)\n    }\n\n    function onStatusCheck(item, checked) {\n      grantComboBox.setDisabled(!checked)\n      _this.onFieldsUpdate && _this.onFieldsUpdate(_this, item, checked)\n    }\n\n    function onComboSelect(item, record, index) {\n      _this.onFieldsUpdate && _this.onFieldsUpdate(_this, item, record)\n    }\n\n    const config = {\n      title: _this.title || 'Review status',\n      labelWidth: 220,\n      items: [\n        criteriaComboBox,\n        canAcceptCheckbox,\n        grantComboBox\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nExt.ns('SM.Manage.HistorySettings')\nSM.Manage.HistorySettings.MaxReviewsComboBox = Ext.extend(Ext.form.ComboBox, {\n  initComponent: function () {\n    const config = {\n      displayField: 'display',\n      valueField: 'value',\n      triggerAction: 'all',\n      mode: 'local',\n      editable: false\n    }\n    const data = [\n      [0, 'disabled']\n    ]\n    for (let limit = 1; limit < 16; limit++) {\n      data.push([limit, `capped at ${limit}`])\n    }\n    this.store = new Ext.data.SimpleStore({\n      fields: ['value', 'display']\n    })\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n    this.store.loadData(data)\n  }\n})\n\nSM.Manage.HistorySettings.HistoryFieldSet = Ext.extend(Ext.form.FieldSet, {\n  initComponent: function () {\n    const _this = this\n    _this.historySettings = _this.historySettings ?? {\n      maxReviews: 5\n    }\n    const maxReviewsComboBox = new SM.Manage.HistorySettings.MaxReviewsComboBox({\n      name: 'maxReviews',\n      fieldLabel: 'Asset/Rule history records are',\n      width: 125,\n      value: _this.historySettings.maxReviews,\n      listeners: {\n        select: onComboSelect\n      }\n    })\n\n    _this.serialize = function () {\n      const output = {}\n      const items = [\n        maxReviewsComboBox\n      ]\n      for (const item of items) {\n        output[item.name] = item.getValue()\n      }\n      return output\n    }\n\n    _this.setValues = function (values) {\n      maxReviewsComboBox.setValue(values.maxReviews || 5)\n    }\n\n    function onComboSelect(item, record, index) {\n      _this.onFieldsUpdate && _this.onFieldsUpdate(_this, item, record)\n    }\n\n    const config = {\n      title: _this.title || 'Review history',\n      labelWidth: 200,\n      items: [\n        maxReviewsComboBox\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nExt.ns('SM.Manage.Collection')\nSM.Manage.Collection.ApiAddOrUpdate = async function (collectionId, collectionObj, options = {}) {\n  let url, method\n  if (options.elevate && collectionId) {\n      delete collectionObj.settings\n      delete collectionObj.metadata\n      delete collectionObj.labels\n  }\n  let elevateParam = options.elevate === true || options.elevate === false ? `?elevate=${options.elevate}` : ''\n  if (collectionId) {\n    url = `${STIGMAN.Env.apiBase}/collections/${collectionId}${elevateParam}`\n    method = 'PATCH'\n  }\n  else {\n    url = `${STIGMAN.Env.apiBase}/collections${elevateParam}`,\n    method = 'POST'\n  }\n  let apiCollection = await Ext.Ajax.requestPromise({\n    responseType: 'json',\n    url,\n    method,\n    headers: { 'Content-Type': 'application/json;charset=utf-8' },\n    params: {\n      projection: ['owners', 'statistics', 'labels']\n    },\n    jsonData: collectionObj\n  })\n  SM.Cache.updateCollection(apiCollection)\n  // Refresh the curUser global\n  await SM.GetUserObject()\n  \n  let event = collectionId ? 'collectionchanged' : 'collectioncreated'\n  SM.Dispatcher.fireEvent( event, apiCollection, options )\n  return apiCollection\n}\n\nSM.Manage.Collection.MetadataGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    const fields = ['key', 'value']\n    const newFields = ['key', 'value']\n    const fieldsConstructor = Ext.data.Record.create(fields)\n    this.newRecordConstructor = Ext.data.Record.create(newFields)\n    this.editor = new Ext.ux.grid.RowEditor({\n      saveText: 'Save',\n      grid: this,\n      clicksToEdit: 2,\n      errorSummary: false, // don't display errors during validation monitoring\n      listeners: {\n        canceledit: function (editor, forced) {\n          // The 'editing' property is set by RowEditorToolbar.js\n          if (editor.record.editing === true) { // was the edit on a new record?\n            this.grid.store.suspendEvents(false);\n            this.grid.store.remove(editor.record);\n            this.grid.store.resumeEvents();\n            this.grid.getView().refresh();\n          }\n        },\n        afteredit: function (editor, changes, record, index) {\n          // \"Save\" the record by reconfiguring the store's data collection\n          let mc = record.store.data\n          let generatedId = record.id\n          record.id = record.data.key\n          record.phantom = false\n\n          delete mc.map[generatedId]\n          mc.map[record.id] = record\n          for (let x = 0, l = mc.keys.length; x < l; x++) {\n            if (mc.keys[x] === generatedId) {\n              mc.keys[x] = record.id\n            }\n          }\n          editor.grid.fireEvent('metadatachanged', editor.grid)\n        }\n      }\n    })\n    const writer = new Ext.data.DataWriter()\n    const tbar = new SM.RowEditorToolbar({\n      itemString: 'key',\n      editor: this.editor,\n      gridId: this.id,\n      deleteProperty: 'key',\n      newRecord: this.newRecordConstructor\n    })\n    const store = new Ext.data.ArrayStore({\n      grid: this,\n      writer: writer,\n      autoSave: false,\n      fields: fieldsConstructor,\n      sortInfo: {\n        field: 'key',\n        direction: 'ASC'\n      },\n      root: '',\n      restful: true,\n      idProperty: 'key',\n      listeners: {\n        remove: (store, record, index) => {\n          store.grid.fireEvent('metadatachanged', store.grid)\n        }\n      }\n    })\n    const totalTextCmp = new SM.RowCountTextItem({\n      store,\n      noun: 'key',\n      iconCls: 'sm-database-save-icon'\n    })\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          gridBasename: 'Metadata',\n          exportType: 'grid',\n          iconCls: 'sm-export-icon',\n          text: 'CSV',\n          gridSource: this     \n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        totalTextCmp\n      ]\n    })\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      deferEmptyText: false,\n      forceFit: true\n    })\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true,\n      listeners: {\n        selectionchange: function (sm) {\n          tbar.delButton.setDisabled(!sm.hasSelection())\n        }\n      }\n    })\n    const cm = new Ext.grid.ColumnModel({\n      columns: [\n        {\n          header: \"Key\",\n          dataIndex: 'key',\n          sortable: true,\n          width: 150,\n          editor: new Ext.form.TextField({\n            grid: this,\n            submitValue: false,\n            validator: function (v) {\n              // Don't keep the form from validating when I'm not active\n              if (this.grid.editor.editing == false) return true\n\n              // blanks\n              if (v === \"\") return \"Blank values not allowed\"\n\n              // duplicates\n              // already in store?\n              const searchIdx = this.grid.store.findExact('key', v)\n              // is it this record?\n              const isMe = this.grid.selModel.isSelected(searchIdx)\n              if (!(searchIdx == -1 || isMe)) return \"Duplicate keys not allowed\"\n\n              // ignored key\n              if (_this.ignoreKeys.includes(v)) return \"Reserved keys not allowed\"\n\n              return true\n            }\n          })\n        },\n        {\n          header: \"Value\",\n          dataIndex: 'value',\n          sortable: false,\n          width: 250,\n          editor: new Ext.form.TextField({\n            submitValue: false\n          })\n        }\n      ]\n    })\n    tbar.delButton.disable()\n    const config = {\n      isFormField: true,\n      ignoreKeys: _this.ignoreKeys || [],\n      allowBlank: true,\n      layout: 'fit',\n      height: 150,\n      plugins: [this.editor],\n      store,\n      view,\n      sm,\n      cm,\n      tbar,\n      bbar,\n      getValue: function () {\n        let value = {}\n        this.store.data.items.forEach((i) => {\n          value[i.data.key] = i.data.value\n        })\n        return value\n      },\n      markInvalid: function () { },\n      clearInvalid: function () { },\n      isValid: function () {\n        return true\n      },\n      disabled: false,\n      getName: function () { return this.name },\n      validate: function () { return true },\n      setValue: function (v) {\n        const entries = _this.ignoreKeys.length ? Object.entries(v).filter(entry => !_this.ignoreKeys.includes(entry[0])) : Object.entries(v)\n        this.store.loadData(entries)\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.Manage.Collection.GrantsGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    this.canModifyOwners = !!this.canModifyOwners\n    const fields = [\n      'grantId',\n      'user',\n      'userGroup',\n      'roleId',\n      {\n        name: 'name',\n        convert: (v, r) => r.user?.displayName ?? r.userGroup.name\n      }\n    ]\n\n    this.proxy = new Ext.data.HttpProxy({\n      restful: true,\n      url: this.url,\n      headers: { 'Content-Type': 'application/json;charset=utf-8' }\n    })\n    const store = new Ext.data.JsonStore({\n      grid: this,\n      proxy: this.proxy,\n      baseParams: this.baseParams,\n      root: '',\n      fields,\n      idProperty: 'grantId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC'\n      },\n      listeners: {\n        load: function (store, records) {\n          totalTextCmp.setText(records.length + ' records');\n        },\n        remove: function (store, record, index) {\n          totalTextCmp.setText(store.getCount() + ' records');\n          store.grid.fireEvent('grantsremoved', store.grid)\n        }\n      }\n    })\n    const totalTextCmp = new SM.RowCountTextItem({\n      store,\n      noun: 'grant',\n      iconCls: 'sm-lock-icon'\n    })\n\n    let toolsMarkup = '<span class=\"sm-grid-cell-tool\" style=\"padding-right:4px\"><img data-action=\"showEditGrant\" ext:qtip=\"Edit grant\" src=\"img/edit.svg\" width=\"14\" height=\"14\"></span>'\n    if (this.context !== 'admin') {\n      toolsMarkup += '<span class=\"sm-grid-cell-tool\" style=\"padding-right:4px\"><img data-action=\"editAcl\" ext:qtip=\"Edit ACL\" src=\"img/target.svg\" width=\"14\" height=\"14\"></span>'\n    }\n    toolsMarkup += '<span class=\"sm-grid-cell-tool\"><img data-action=\"removeGrant\" ext:qtip=\"Remove grant\" src=\"img/trash.svg\" width=\"14\" height=\"14\"></span>'\n    \n    const colModel = new Ext.grid.ColumnModel({\n      columns: [\n        {\n          header: '<span exportvalue=\"Role\">Role<i class= \"fa fa-question-circle sm-question-circle\"></i></span>',\n          width: 50,\n          dataIndex: 'roleId',\n          sortable: true,\n          renderer: (v) => `<div class=\"sm-grid-cell-role\">${SM.RoleStrings[v]}</div>`\n        },\n        {\n          header: \"User or Group\",\n          width: 150,\n          dataIndex: 'name',\n          sortable: true,\n          renderer: function (v, m, r) {\n            const icon = r.data.user ? 'sm-user-icon' : 'sm-users-icon'\n            const subtitle = r.data.user?.username ?? r.data.userGroup.description\n            // const title = r.data.user?.displayName ?? r.data.userGroup.name\n            return `\n            <div class=\"sm-grid-cell-with-toolbar-2\">\n              <div class=\"sm-dynamic-width\">\n                <div class=\"sm-info\">\n                  <div class=\"x-combo-list-item ${icon} sm-combo-list-icon\" exportValue=\"${v}:${subtitle}\"><span style=\"font-weight:600;\">${v}</span><br>${subtitle}</div>\n                </div>\n              </div>\n              <div class=\"sm-static-width\" style=\"top: 25%\">\n              ${r.data.roleId !== 4 || _this.canModifyOwners || _this.context === 'admin' ? toolsMarkup : ''}\n              </div>\n            </div>`   \n          }\n        }\n      ]\n    })\n\n    function showEditGrant (grantData, record) {\n      console.log(`changeGrantee ${JSON.stringify(grantData)}`)\n      const selectedGrant = {\n        grantId: grantData.grantId,\n        roleId: grantData.roleId,\n        userId: grantData.user?.userId,\n        userGroupId: grantData.userGroup?.userGroupId\n      }\n      SM.Grant.showEditGrantWindow ({existingGrants: _this.getValue(), selectedGrant, includeOwnerRole: _this.canModifyOwners, cb})\n\n      function cb (grant) {\n        console.log(grant)\n        _this.fireEvent('grantchange', grantData.grantId, grant)\n      }\n    }\n\n    function editAcl (grantData) {\n      SM.Acl.showAccess(_this.collectionId, grantData)\n    }\n    function removeGrant (grantData, record) {\n      Ext.Msg.show({\n        title: `Delete?`,\n        msg: `You are about to delete the grant for \"${SM.he(grantData.name)}\". Do you wish to continue?`,\n        buttons: Ext.Msg.YESNO,\n        fn: (buttonId) => {\n          if (buttonId === 'ok' || buttonId === 'yes') {\n            _this.fireEvent('grantremove', grantData)\n          }\n        },\n        icon: Ext.MessageBox.QUESTION\n     })\n    }\n\n    const toolHandlers = {\n      showEditGrant,\n      editAcl,\n      removeGrant\n    }\n\n    function cellclick(grid, rowIndex, columnIndex, e) {\n      if (e.target.tagName === \"IMG\") {\n        const record = grid.getStore().getAt(rowIndex)\n        toolHandlers[e.target.dataset.action](record.data, record)\n      }\n    }\n\n    const newGrantButton = new Ext.Button( {\n      text: 'Add Grants...',\n      iconCls: 'icon-add',\n      handler: function () {\n        SM.Grant.showNewGrantWindow({\n          collectionId: _this.collectionId,\n          existingGrants: _this.getValue(),\n          canModifyOwners: _this.canModifyOwners,\n          elevate: _this.context === 'admin'\n        })\n      }\n    })\n    const tbarItems = [\n      newGrantButton,\n    ]\n    const tbar = new Ext.Toolbar({\n      items: tbarItems\n    })\n\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      cellSelectorDepth: 0,\n      deferEmptyText: false,\n      forceFit: true,\n      markDirty: false,\n      listeners: {\n        refresh: function (view) {\n          // Setup the tooltip for column 'roleId'\n          const index = view.grid.getColumnModel().findColumnIndex('roleId')\n          const tipEl = view.getHeaderCell(index).getElementsByClassName('fa')[0]\n          if (tipEl) {\n            new Ext.ToolTip({\n              target: tipEl,\n              showDelay: 0,\n              dismissDelay: 0,\n              maxWidth: 600,\n              html: SM.TipContent.Roles\n            })\n          }\n        },\n      },\n    })\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          gridBasename: 'CollectionGrants',\n          exportType: 'grid',\n          iconCls: 'sm-export-icon',\n          text: 'CSV',\n          grid: this     \n        }, {\n          xtype: 'tbfill'\n        }, {\n          xtype: 'tbseparator'\n        },\n        totalTextCmp\n      ]\n    })\n    function viewready (grid) {\n      // Setup the tooltip for column 'role'\n      const index = grid.getColumnModel().findColumnIndex('roleId')\n      const tipEl = grid.view.getHeaderCell(index).getElementsByClassName('fa')[0]\n      if (tipEl) {\n        new Ext.ToolTip({\n          target: tipEl,\n          showDelay: 0,\n          dismissDelay: 0,\n          maxWidth: 600,\n          html: SM.TipContent.Roles\n        })\n      }\n    }\n\n    function setValue (v, append = false) {\n      store.loadData(v, append)\n    }\n\n    function getValue () {\n      return store.data.items.map(i => i.data.user ? {\n          userId: i.data.user.userId,\n          roleId: i.data.roleId\n        } : {\n          userGroupId: i.data.userGroup.userGroupId,\n          roleId: i.data.roleId\n        }\n      )\n      // return store.data.items.map(i => i.data.user ?? i.data.userGroup)\n    }\n\n    const config = {\n      name: 'grants',\n      disableSelection: true,\n      layout: 'fit',\n      store,\n      colModel,\n      view,\n      tbar,\n      bbar,\n      listeners: {\n        viewready,\n        cellclick\n      },\n      setValue,\n      getValue\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Manage.Collection.UsersGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    const fields = [\n      'grantees',\n      {\n        name: 'userId',\n        mapping: 'user.userId'\n      },\n      {\n        name: 'username',\n        mapping: 'user.username'\n      },\n      'roleId',\n      {\n        name: 'displayName',\n        mapping: 'user.displayName'\n      }\n    ]\n\n    this.proxy = new Ext.data.HttpProxy({\n      restful: true,\n      url: this.url,\n      headers: { 'Content-Type': 'application/json;charset=utf-8' }\n    })\n    const store = new Ext.data.JsonStore({\n      grid: this,\n      proxy: this.proxy,\n      baseParams: this.baseParams,\n      root: 'users',\n      fields,\n      idProperty: 'userId',\n      sortInfo: {\n        field: 'username',\n        direction: 'ASC'\n      },\n      listeners: {\n        load: function (store, records) {\n          totalTextCmp.setText(records.length + ' records');\n        }\n      }\n    })\n    const totalTextCmp = new SM.RowCountTextItem({\n      store,\n      noun: 'user',\n      iconCls: 'sm-user-icon'\n    })\n    const columns = [\n      {\n        header: \"User\",\n        width: 150,\n        dataIndex: 'username',\n        sortable: true,\n        renderer: function (v, m, r) {\n          const icon = 'sm-user-icon'\n          return `\n            <div class=\"sm-grid-cell-with-toolbar-2\">\n              <div class=\"sm-dynamic-width\">\n                <div class=\"sm-info\">         \n                  <div class=\"x-combo-list-item ${icon} sm-combo-list-icon\" exportValue=\"${r.data.displayName ?? ''}:${r.data.username ?? ''}\"><span style=\"font-weight:600;\">${r.data.displayName ?? ''}</span><br>${r.data.username ?? ''}</div>\n                </div>\n              </div>\n              <div class=\"sm-static-width\" style=\"top: 25%\">\n                <span class=\"sm-grid-cell-tool\" style=\"padding-right:4px\"><img data-action=\"showEffectiveAcl\" ext:qtip=\"Show access\" src=\"img/target.svg\" width=\"14\" height=\"14\"></span>                \n              </div>\n            </div>`\n        }\n      },\n      {\n        header: '<span exportvalue=\"Grantee\">Grantee<i class= \"fa fa-question-circle sm-question-circle\"></i></span>',\n        width: 150,\n        dataIndex: 'grantees',\n        sortable: false,\n        renderer: function (grantees) {\n          const divs = []\n          for (const grantee of grantees) {\n            const icon = grantee.userId ? 'sm-user-icon' : 'sm-users-icon'\n            const title = grantee.userId ? 'Direct' : grantee.name\n            divs.push(`<div class=\"x-combo-list-item ${icon} sm-combo-list-icon\" exportValue=\"${title}\">\n                        <span style=\"font-weight:600;\">${title}</span></div>`)\n          }\n          return divs.join('')\n        }\n      },\n      {\n        header: '<span exportvalue=\"Role\">Role<i class= \"fa fa-question-circle sm-question-circle\"></i></span>',\n        width: 100,\n        dataIndex: 'roleId',\n        sortable: true,\n        renderer: (v) => SM.RoleStrings[v],\n      }\n    ]\n\n    // function showEffectiveAcl  () {}\n\n    function cellclick(grid, rowIndex, columnIndex, e) {\n      if (e.target.tagName === \"IMG\") {\n        const r = grid.getStore().getAt(rowIndex)\n        const defaultAccess = r.data.roleId === 1 ? 'none' : 'rw'\n        SM.User.showCollectionAcl({ collectionId: _this.collectionId, userId: r.data.userId, displayName: r.data.displayName, defaultAccess })\n      }\n    }\n\n    const viewAclBtn = new Ext.Button({\n      iconCls: 'sm-asset-icon',\n      disabled: true,\n      text: 'View Effective Access List...',\n      handler: function () {\n        const r = _this.getSelectionModel().getSelected()\n        const defaultAccess = r.data.roleId === 1 ? 'none' : 'rw'\n        SM.User.showCollectionAcl({ collectionId: _this.collectionId, userId: r.data.userId, displayName: r.data.displayName, defaultAccess })\n      }\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          gridBasename: 'CollectionUsers',\n          exportType: 'grid',\n          iconCls: 'sm-export-icon',\n          text: 'CSV',\n          grid: this     \n        }, {\n          xtype: 'tbfill'\n        }, {\n          xtype: 'tbseparator'\n        },\n        totalTextCmp\n      ]\n    })\n\n    const config = {\n      name: 'users',\n      allowBlank: false,\n      disableSelection: true,\n      stripeRows: true,\n      layout: 'fit',\n      height: 150,\n      store,\n      columns,\n      view: new SM.ColumnFilters.GridView({\n        emptyText: this.emptyText || 'No records to display',\n        cellSelectorDepth: 0,\n        deferEmptyText: false,\n        forceFit: true,\n        markDirty: false,\n        listeners: {\n          refresh: function (view) {\n            // Setup the tooltip for column 'roleId'\n            const index = view.grid.getColumnModel().findColumnIndex('roleId')\n            const tipEl = view.getHeaderCell(index).getElementsByClassName('fa')[0]\n            if (tipEl) {\n              new Ext.ToolTip({\n                target: tipEl,\n                showDelay: 0,\n                dismissDelay: 0,\n                maxWidth: 600,\n                html: SM.TipContent.Roles\n              })\n            }\n          },\n        },\n      }),\n      bbar,\n      listeners: {\n        viewready: function (grid) {\n          // Setup the tooltip for column 'roleId'\n          const index = grid.getColumnModel().findColumnIndex('roleId')\n          const tipEl = grid.view.getHeaderCell(index).getElementsByClassName('fa')[0]\n          if (tipEl) {\n            new Ext.ToolTip({\n              target: tipEl,\n              showDelay: 0,\n              dismissDelay: 0,\n              maxWidth: 600,\n              html: SM.TipContent.Roles\n            })\n          }\n        },\n        cellclick\n      },\n\n      setValue: function (v) {\n        store.loadData(v)\n      }\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Manage.Collection.AdminGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      'collectionId',\n      'name',\n      'description',\n      'metadata',\n      'owners',\n      {\n        name: 'assets',\n        type: 'integer',\n        mapping: 'statistics.assetCount'\n      },\n      {\n        name: 'users',\n        type: 'integer',\n        mapping: 'statistics.userCount'\n      },\n      {\n        name: 'checklists',\n        type: 'integer',\n        mapping: 'statistics.checklistCount'\n      },\n      {\n        name: 'created',\n        type: 'date',\n        mapping: 'statistics.created'\n      }\n    ]\n    const store = new Ext.data.JsonStore({\n      proxy: new Ext.data.HttpProxy({\n        url: `${STIGMAN.Env.apiBase}/collections`,\n        method: 'GET'\n      }),\n      baseParams: {\n        elevate: curUser.privileges.admin,\n        projection: ['owners', 'statistics']\n      },\n      root: '',\n      fields,\n      isLoaded: false, // custom property\n      idProperty: 'collectionId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      },\n      listeners: {\n        load: function (store, records) {\n          store.isLoaded = true\n        }\n      }\n    })\n\n    const colModel = new Ext.grid.ColumnModel([\n      {\n        header: \"Name\",\n        width: 150,\n        dataIndex: 'name',\n        sortable: true,\n        filter: {type: 'string'}\n      },\n      {\n        header: \"Description\",\n        hidden: true,\n        width: 300,\n        dataIndex: 'description',\n        sortable: true,\n        filter: {type: 'string'}\n      },\n      {\n        header: \"Owners\",\n        width: 150,\n        dataIndex: 'owners',\n        sortable: true,\n        renderer: function (v) {\n          // assigning to v, used elsewhere, does not work here? v = v.map(i => i.username).join('\\n')\n          arguments[0] = v.map(u => u.username || u.name).join('\\n')\n          return columnWrap.apply(this, arguments)\n        }\n      },\n      {\n        header: \"Users\",\n        width: 150,\n        dataIndex: 'users',\n        sortable: true\n      },\n      {\n        header: \"Assets\",\n        width: 150,\n        dataIndex: 'assets',\n        sortable: true\n      },\n      {\n        header: \"Checklists\",\n        width: 150,\n        dataIndex: 'checklists',\n        sortable: true\n      },\n      {\n        header: \"Created\",\n        xtype: 'datecolumn',\n        format: 'Y-m-d H:i T',\n        width: 150,\n        dataIndex: 'created',\n        sortable: true\n      },\n      {\n        header: \"ID\",\n        width: 150,\n        dataIndex: 'collectionId',\n        sortable: true\n      }\n    ])\n\n    const view = new SM.ColumnFilters.GridView({\n      forceFit: true,\n      // These listeners keep the grid in the same scroll position after the store is reloaded\n      listeners: {\n        filterschanged: function (view, item, value) {\n          store.filter(view.getFilterFns())  \n        },\n        beforerefresh: function (v) {\n          v.scrollTop = v.scroller.dom.scrollTop;\n          v.scrollHeight = v.scroller.dom.scrollHeight;\n        },\n        refresh: function (v) {\n          setTimeout(function () {\n            v.scroller.dom.scrollTop = v.scrollTop + (v.scrollTop == 0 ? 0 : v.scroller.dom.scrollHeight - v.scrollHeight);\n          }, 100);\n        }\n      },\n      deferEmptyText: false\n    })\n\n    const selModel = new Ext.grid.RowSelectionModel({ singleSelect: true })\n    const totalTextCmp = new SM.RowCountTextItem({store})\n\n    const tbar = new Ext.Toolbar({\n      items: [\n        {\n          iconCls: 'icon-add',\n          text: 'New Collection',\n          disabled: !(curUser.privileges.admin),\n          handler: function () {\n            showAdminCreatePanel(0);\n          }\n        },\n        '-',\n        {\n          ref: '../removeBtn',\n          iconCls: 'icon-del',\n          text: 'Delete Collection',\n          disabled: !(curUser.privileges.admin),\n          handler: function () {\n            let record = selModel.getSelected()\n            let confirmStr = `Delete \"${record.data.name}\"?`\n\n            Ext.Msg.confirm(\"Confirm\", confirmStr, async function (btn, text) {\n              try {\n                if (btn == 'yes') {\n                  Ext.getBody().mask('Deleting collection')\n                  await Ext.Ajax.requestPromise({\n                    url: `${STIGMAN.Env.apiBase}/collections/${record.data.collectionId}?elevate=true`,\n                    method: 'DELETE'\n                  })\n                  SM.Dispatcher.fireEvent( 'collectiondeleted', record.data.collectionId )\n                }\n              }\n              catch (e) {\n                SM.Error.handleError(e)\n              }\n              finally {\n                Ext.getBody().unmask()\n              }\n            });\n          }\n        }\n      ]\n    })\n\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'tbbutton',\n          iconCls: 'icon-refresh',\n          tooltip: 'Reload this grid',\n          width: 20,\n          handler: function (btn) {\n            store.reload()\n          }\n        },\n        {\n          xtype: 'tbseparator'\n        }, \n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          gridBasename: 'Collection-Info',\n          exportType: 'grid',\n          iconCls: 'sm-export-icon',\n          text: 'CSV',\n          grid: this     \n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        totalTextCmp\n      ]\n    })\n\n    const config = {\n      selModel,\n      colModel,\n      view,\n      store,\n      tbar,\n      bbar\n  }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Manage.Collection.AdminPropertiesPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const nameField = new Ext.form.TextField({\n      fieldLabel: 'Name',\n      labelStyle: 'font-weight: 600;',\n      name: 'name',\n      // allowBlank: false,\n      anchor: '100%',\n      enableKeyEvents: true,\n      listeners: {\n        change: async (field, newValue, oldValue) => {\n          if (!newValue?.trim()) { // only spaces\n            field.setValue(oldValue)\n            return\n          }\n          try {\n            const apiCollection = await Ext.Ajax.requestPromise({\n              responseType: 'json',\n              url: `${STIGMAN.Env.apiBase}/collections/${_this.collectionId}`,\n              method: 'PATCH',\n              params: {\n                elevate: true,\n                projection: 'labels'\n              },\n              jsonData: {\n                name: newValue.trim()\n              }\n            })\n            SM.Dispatcher.fireEvent('collectionchanged', apiCollection)\n          }\n          catch (e) {\n            field.setValue(oldValue)\n            SM.Error.handleError(e)\n          }\n\n        }\n      }\n    })\n    const descriptionField = new Ext.form.TextArea({\n      fieldLabel: 'Description',\n      labelStyle: 'font-weight: 600;',\n      name: 'description',\n      anchor: '100% -30',\n      listeners: {\n        change: async (field, newValue, oldValue) => {\n          try {\n            const apiCollection = await Ext.Ajax.requestPromise({\n              url: `${STIGMAN.Env.apiBase}/collections/${_this.collectionId}`,\n              method: 'PATCH',\n              params: {\n                elevate: true,\n                projection: 'labels'\n              },\n              jsonData: {\n                description: newValue.trim()\n              }\n            })\n            SM.Dispatcher.fireEvent('collectionchanged', apiCollection)\n          }\n          catch (e) {\n            field.setValue(oldValue)\n            SM.Error.handleError(e)\n          }\n        }\n      }\n    })\n    function grantChangeHandler (grantId, data) {\n      return SM.Grant.Api.putGrantByCollectionGrant({\n        collectionId: _this.collectionId,\n        grantId,\n        body: data,\n        elevate: true\n      })\n    }\n    function grantRemoveHandler (data) {\n      return SM.Grant.Api.deleteGrantByCollectionGrant({\n        collectionId: _this.collectionId,\n        grantId: data.grantId,\n        elevate: true\n      })\n    }\n    function onGrantDeleted ({collectionId, grantId}) {\n      if (collectionId === _this.collectionId) {\n        const index = grantStore.findExact('grantId', grantId)\n        if (index !== -1) grantStore.removeAt(index)\n      }\n    }\n    function onGrantUpdated({collectionId, api}) {\n      if (collectionId === _this.collectionId) {\n        grantStore.loadData(api, true)\n        const sortState = grantStore.getSortState()\n        grantStore.sort(sortState.field, sortState.direction)\n        const index = grantStore.findExact('grantId', api.grantId ?? api[0].grantId)\n        grantGrid.getView().ensureVisible(index)\n      }\n    }\n\n    function setFieldValues (apiCollection) {\n      nameField.setValue(apiCollection.name)\n      descriptionField.setValue(apiCollection.description)\n      grantGrid.setValue(apiCollection.grants)\n      _this.collectionId = apiCollection.collectionId\n      grantGrid.collectionId = _this.collectionId\n      _this.collectionName = apiCollection.name\n    }\n\n    const grantGrid = new SM.Manage.Collection.GrantsGrid({\n      iconCls: 'sm-lock-icon',\n      margins: '10 0 0 0',\n      canModifyOwners: true,\n      context: 'admin',\n      title: 'Grants',\n      border: true,\n      region: 'center',\n      flex: 1,\n      listeners: {\n        grantchange: grantChangeHandler,\n        grantremove: grantRemoveHandler\n      }\n    })\n    const grantStore = grantGrid.store\n    SM.Dispatcher.addListener('grant.deleted', onGrantDeleted)\n    SM.Dispatcher.addListener('grant.updated', onGrantUpdated)\n    SM.Dispatcher.addListener('grant.created', onGrantUpdated)\n\n\n    const config = {\n      layout: 'vbox',\n      layoutConfig: {\n        align: 'stretch'\n      },\n      bodyStyle: 'padding: 9px;',\n      border: false,\n      setFieldValues,\n      items: [\n        {\n          xtype: 'fieldset',\n          labelWidth: 100,\n          height: 120,\n          title: 'Information',\n          items: [nameField, descriptionField]\n        },\n        grantGrid\n      ],\n      listeners: {\n        beforedestroy: () => {\n          SM.Dispatcher.removeListener('grant.deleted', onGrantDeleted)\n          SM.Dispatcher.removeListener('grant.updated', onGrantUpdated)\n          SM.Dispatcher.removeListener('grant.created', onGrantUpdated)\n        }\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.Manage.Collection.AdminCreatePanel = Ext.extend(Ext.form.FormPanel, {\n  initComponent: function () {\n    const _this = this\n    const nameField = new Ext.form.TextField({\n      fieldLabel: 'Name',\n      labelStyle: 'font-weight: 600;',\n      name: 'name',\n      allowBlank: false,\n      anchor: '100%',\n    })\n    const descriptionField = new Ext.form.TextArea({\n      fieldLabel: 'Description',\n      labelStyle: 'font-weight: 600;',\n      name: 'description',\n      anchor: '100% -30'\n    })\n    const newGrantPanel = new SM.Grant.NewGrantPanel({\n      iconCls: 'sm-lock-icon',\n      margins: '10 0 0 0',\n      canModifyOwners: true,\n      context: 'admin',\n      border: true,\n      region: 'center'\n    })\n\n    function getFieldValues () {\n      return {\n        name: nameField.getValue(),\n        description: descriptionField.getValue(),\n        grants: newGrantPanel.grantGrid.getValue()\n      }\n    }\n    \n    const config = {\n      // baseCls: 'x-plain',\n      cls: 'sm-round-panel',\n      bodyStyle: 'padding: 9px;',\n      border: false,\n      labelWidth: 100,\n      monitorValid: true,\n      setFieldValues: function (apiCollection) {\n        nameField.setValue(apiCollection.name)\n        descriptionField.setValue(apiCollection.description)\n        grantGrid.setValue(apiCollection.grants)\n        _this.collectionId = apiCollection.collectionId\n        _this.collectionName = apiCollection.name\n      },\n      getFieldValues,\n      items: [\n        {\n          layout: 'border',\n          anchor: '100% 0',\n          hideLabels: true,\n          border: false,\n          // baseCls: 'x-plain',\n          items: [\n            {\n              xtype: 'fieldset',\n              region: 'north',\n              height: 120,\n              split: false,\n              title: 'Information',\n              items: [nameField, descriptionField]\n            },\n            newGrantPanel\n          ]\n        }\n      ],\n      buttons: [{\n        text: this.btnText || 'Create Collection',\n        formBind: true,\n        handler: this.btnHandler || function () { }\n      }]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.Manage.Collection.Panel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    let _this = this\n    this.canModifyOwners = !!this.canModifyOwners\n    \n    async function apiPatchSettings(value) {\n      const apiCollection = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/collections/${_this.collectionId}`,\n        method: 'PATCH',\n        jsonData: {\n          settings: value\n        }\n      })\n      SM.Dispatcher.fireEvent('collectionsettingschanged', _this.collectionId, value)\n      return apiCollection || undefined\n    }\n   \n    async function updateSettings() {\n      const apiCollection = await apiPatchSettings({\n        fields: settingsReviewFields.serialize(),\n        status: settingsStatusFields.serialize(),\n        history: settingsHistoryFields.serialize(),\n        importOptions: settingsImportOptions.getOptions()\n      })\n      \n      return apiCollection\n    }\n\n    const nameField = new Ext.form.TextField({\n      fieldLabel: 'Name',\n      labelStyle: 'font-weight: 600;',\n      value: _this.apiCollection?.name,\n      name: 'name',\n      allowBlank: false,\n      anchor: '-5',\n      enableKeyEvents: true,\n      keys: [\n        {\n          key: Ext.EventObject.ENTER,\n          fn: () => {\n            nameField.getEl().blur()\n          }\n        }\n      ],\n      listeners: {\n        specialkey: (field, e) => {\n          if (e.getKey() == e.ENTER) {\n            field.getEl().blur()\n          }\n        },\n        change: async (field, newValue, oldValue) => {\n          if (!newValue?.trim()) { // only spaces\n            field.setValue(oldValue)\n            return\n          }\n          try {\n            let apiCollection = await Ext.Ajax.requestPromise({\n              responseType: 'json',\n              url: `${STIGMAN.Env.apiBase}/collections/${_this.collectionId}`,\n              method: 'PATCH',\n              params: {\n                projection: 'labels'\n              },\n              jsonData: {\n                name: newValue.trim()\n              }\n            })\n            SM.Dispatcher.fireEvent('collectionchanged', apiCollection)\n          }\n          catch (e) {\n            field.setValue(oldValue)\n            SM.Error.handleError(e)\n          }\n        }\n      }\n    })\n    const descriptionField = new Ext.form.TextArea({\n      fieldLabel: 'Description',\n      labelStyle: 'font-weight: 600;',\n      value: _this.apiCollection?.description,\n      name: 'description',\n      anchor: '-5 -35',\n      listeners: {\n        change: async (field, newValue, oldValue) => {\n          try {\n            await Ext.Ajax.requestPromise({\n              url: `${STIGMAN.Env.apiBase}/collections/${_this.collectionId}`,\n              method: 'PATCH',\n              jsonData: {\n                description: newValue.trim()\n              }\n            })\n          }\n          catch (e) {\n            field.setValue(oldValue)\n            SM.Error.handleError(e)\n          }\n        }\n      }\n    })\n    const metadataGrid = new SM.Manage.Collection.MetadataGrid({\n      title: 'Metadata',\n      iconCls: 'sm-database-save-icon',\n      name: 'metadata',\n      border: false,\n      listeners: {\n        metadatachanged: async grid => {\n          try {\n            const data = grid.getValue()\n            const result = await Ext.Ajax.requestPromise({\n              url: `${STIGMAN.Env.apiBase}/collections/${_this.collectionId}/metadata`,\n              method: 'PUT',\n              jsonData: data\n            })\n            const sortstate = grid.store.getSortState()\n            grid.store.sort([sortstate])\n          }\n          catch (e) {\n            SM.Error.handleError(e)\n          }\n        }\n      }\n\n    })\n    metadataGrid.setValue(_this.apiCollection.metadata)\n\n    const settingsReviewFields = new SM.Manage.FieldSettings.ReviewFieldSet({\n      iconCls: 'sm-stig-icon',\n      fieldSettings: _this.apiCollection?.settings?.fields,\n      border: true,\n      onFieldSelect: async function (fieldset) {\n        try {\n          const apiCollection = await updateSettings()\n          SM.Dispatcher.fireEvent('fieldsettingschanged', _this.apiCollection.collectionId, apiCollection.settings.fields)\n          SM.Dispatcher.fireEvent('collectionchanged', apiCollection)\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n      }\n    })\n    const settingsStatusFields = new SM.Manage.StatusSettings.StatusFieldSet({\n      iconCls: 'sm-star-icon-16',\n      statusSettings: _this.apiCollection?.settings?.status,\n      border: true,\n      autoHeight: true,\n      onFieldsUpdate: async function (fieldset) {\n        try {\n          const apiCollection = await updateSettings()\n          SM.Dispatcher.fireEvent('statussettingschanged', _this.apiCollection.collectionId, apiCollection.settings.status)\n          SM.Dispatcher.fireEvent('collectionchanged', apiCollection)\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n      }\n    })\n    const settingsHistoryFields = new SM.Manage.HistorySettings.HistoryFieldSet({\n      iconCls: 'sm-history-icon',\n      historySettings: _this.apiCollection?.settings?.history,\n      border: true,\n      autoHeight: true,\n      onFieldsUpdate: async function (fieldset) {\n        try {\n          const apiCollection = await updateSettings()\n          SM.Dispatcher.fireEvent('collectionchanged', apiCollection)\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n      }\n    })\n    const settingsImportOptions = new SM.ReviewsImport.ParseOptionsFieldSet({\n      iconCls: 'sm-import-icon',\n      initialOptions: _this.apiCollection?.settings?.importOptions,\n      canAccept: true,\n      onOptionChanged: async function (fieldset) {\n        try {\n          await updateSettings()\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n      }\n    })\n\n    const grantChangeHandler = (grantId, data) => {\n      return SM.Grant.Api.putGrantByCollectionGrant({\n        collectionId: _this.apiCollection.collectionId,\n        grantId,\n        body: data\n      })\n    }\n\n    const grantRemoveHandler = (data) => {\n      return SM.Grant.Api.deleteGrantByCollectionGrant({\n        collectionId: _this.apiCollection.collectionId,\n        grantId: data.grantId\n      })\n    }\n\n    const grantGrid = new SM.Manage.Collection.GrantsGrid({\n      collectionId: _this.apiCollection.collectionId,\n      iconCls: 'sm-lock-icon',\n      canModifyOwners: this.canModifyOwners,\n      url: `${STIGMAN.Env.apiBase}/collections/${_this.apiCollection.collectionId}`,\n      baseParams: {\n        projection: 'grants'\n      },\n      title: 'Grants',\n      border: false,\n      listeners: {\n        grantchange: grantChangeHandler,\n        grantremove: grantRemoveHandler\n      }\n    })\n    grantGrid.setValue(_this.apiCollection.grants)\n    const grantStore = grantGrid.store\n\n    function onGrantDeleted ({collectionId, grantId}) {\n      if (collectionId === _this.apiCollection.collectionId) {\n        const index = grantStore.findExact('grantId', grantId)\n        if (index !== -1) grantStore.removeAt(index)\n      }\n    }\n    function onGrantUpdated({collectionId, api}) {\n      if (collectionId === _this.apiCollection.collectionId) {\n        grantStore.loadData(api, true)\n        const sortState = grantStore.getSortState()\n        grantStore.sort(sortState.field, sortState.direction)\n        const index = grantStore.findExact('grantId', api.grantId ?? api[0].grantId)\n        grantGrid.getView().ensureVisible(index)\n      }\n    }\n    SM.Dispatcher.addListener('grant.deleted', onGrantDeleted)\n    SM.Dispatcher.addListener('grant.updated', onGrantUpdated)\n    SM.Dispatcher.addListener('grant.created', onGrantUpdated)\n\n    const usersGrid = new SM.Manage.Collection.UsersGrid({\n      iconCls: 'sm-user-icon',\n      title: 'Users',\n      border: false,\n      collectionId: _this.apiCollection.collectionId,\n      url: `${STIGMAN.Env.apiBase}/collections/${_this.apiCollection.collectionId}`,\n      baseParams: {\n        projection: 'users'\n      }\n    })\n    // usersGrid.setValue(_this.apiCollection.users)\n\n\n    this.labelGrid = new SM.Manage.Collection.LabelsGrid({\n      collectionId: _this.apiCollection.collectionId,\n      iconCls: 'sm-label-icon',\n      title: 'Labels',\n      border: false,\n      listeners: {\n        labeldeleted: async (labelId) => {\n          try {\n            let result = await Ext.Ajax.requestPromise({\n              url: `${STIGMAN.Env.apiBase}/collections/${_this.apiCollection.collectionId}/labels/${labelId}`,\n              method: 'DELETE'\n            })\n\n            // Let the rest of the app know\n            SM.Dispatcher.fireEvent('labeldeleted', _this.apiCollection.collectionId, labelId)\n          }\n          catch (e) {\n            SM.Error.handleError(e)\n          }\n        },\n        labelchanged: async (grid, record) => {\n          try {\n            const { labelId, uses, ...labelData } = record.data\n            let result = await Ext.Ajax.requestPromise({\n              url: `${STIGMAN.Env.apiBase}/collections/${_this.apiCollection.collectionId}/labels/${labelId}`,\n              method: 'PATCH',\n              jsonData: labelData\n            })\n            const sortState = grid.store.getSortState()\n            grid.store.sort(sortState.field, sortState.direction)\n\n            // Let the rest of the app know\n            const newlabel = JSON.parse(result.response.responseText)\n            SM.Dispatcher.fireEvent('labelchanged', _this.apiCollection.collectionId, newlabel)\n          }\n          catch (e) {\n            SM.Error.handleError(e)\n          }\n        },\n        labelcreated: async (grid, record) => {\n          try {\n            const { labelId, uses, ...labelData } = record.data\n            let result = await Ext.Ajax.requestPromise({\n              url: `${STIGMAN.Env.apiBase}/collections/${_this.apiCollection.collectionId}/labels`,\n              method: 'POST',\n              jsonData: labelData\n            })\n            const label = JSON.parse(result.response.responseText)\n            record.data.labelId = label.labelId\n            record.data.uses = label.uses\n            record.commit()\n            const sortState = grid.store.getSortState()\n            grid.store.sort(sortState.field, sortState.direction)\n\n            // Let the rest of the app know\n            const modlabel = JSON.parse(result.response.responseText)\n            // modlabel.collectionId = _this.apiCollection.collectionId\n            SM.Dispatcher.fireEvent('labelcreated', _this.apiCollection.collectionId, modlabel)\n\n          }\n          catch (e) {\n            SM.Error.handleError(e)\n          }\n        }\n      }\n    })\n    this.labelGrid.setValue(_this.apiCollection.labels)\n\n    const tools = []\n    if (this.allowDelete) {\n      tools.push({\n        id: 'trash',\n        qtip: 'Delete',\n        handler: async function () {\n          try {\n            var confirmStr = \"Deleting this Collection will <b>remove all data</b> associated with the Collection. This includes all Assets and their associated assessments.<br><br>Do you wish to delete the Collection?\";\n            Ext.Msg.confirm(\"Confirm\", confirmStr, async function (btn, text) {\n              if (btn == 'yes') {\n                let result = await Ext.Ajax.requestPromise({\n                  url: `${STIGMAN.Env.apiBase}/collections/${_this.collectionId}`,\n                  method: 'DELETE'\n                })\n                let apiCollection = JSON.parse(result.response.responseText)\n                SM.Dispatcher.fireEvent('collectiondeleted', apiCollection.collectionId)\n              }\n            })\n          }\n          catch (e) {\n            SM.Error.handleError(e)\n          }\n        }\n      })\n    }\n    if (this.allowClone) {\n      tools.push({\n        id: 'clone',\n        qtip: 'Clone',\n        handler: async function () {\n          try {\n            await SM.CollectionClone.showCollectionClone({\n              collectionId: _this.collectionId,\n              sourceName: nameField.getValue()\n            })\n          }\n          catch (e) {\n            SM.Error.handleError(e)\n          }\n        }\n      })\n    }\n\n    const tp = new Ext.TabPanel({\n      region: 'center',\n      activeTab: 0,\n      border: false,\n      items: [\n        grantGrid,\n        usersGrid,\n        {\n          xtype: 'panel',\n          bodyStyle: {\n            overflowY: 'auto',\n            overflowX: 'hidden'\n          },\n          title: 'Settings',\n          layout: 'form',\n          iconCls: 'sm-setting-icon',\n          border: false,\n          padding: 10,\n          items: [\n            settingsReviewFields,\n            settingsStatusFields,\n            settingsHistoryFields,\n            settingsImportOptions\n          ]\n        },\n        metadataGrid,\n        this.labelGrid\n      ],\n      listeners: {\n        tabchange: function (tp, tab) {\n          if (tab.title === 'Users') {\n            usersGrid.store.load()\n          }\n        }\n      }\n    })\n\n    let config = {\n      title: this.title || 'Collection properties',\n      collapseFirst: false,\n      tools,\n      layout: 'border',\n      cls: 'sm-collection-manage-layout sm-round-panel',\n      getFieldValues: function (dirtyOnly) {\n        // Override Ext.form.FormPanel implementation to check submitValue\n        let o = {}, n, key, val;\n        this.items.each(function (f) {\n          if (f.submitValue !== false && !f.disabled && (dirtyOnly !== true || f.isDirty())) {\n            n = f.getName()\n            key = o[n]\n            val = f.getValue()\n            if (Ext.isDefined(key)) {\n              if (Ext.isArray(key)) {\n                o[n].push(val);\n              } else {\n                o[n] = [key, val]\n              }\n            } else {\n              o[n] = val\n            }\n          }\n        })\n        return o\n      },\n      items: [\n        {\n          xtype: 'panel',\n          border: false,\n          region: 'north',\n          height: 160,\n          layout: 'form',\n          margins: '15 15 15 15',\n          items: [nameField, descriptionField]\n        },\n        tp\n      ],\n      listeners: {\n        beforedestroy: () => {\n          SM.Dispatcher.removeListener('grant.deleted', onGrantDeleted)\n          SM.Dispatcher.removeListener('grant.updated', onGrantUpdated)\n          SM.Dispatcher.removeListener('grant.created', onGrantUpdated)\n        }\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.Manage.Collection.LabelSpriteHtml = `<span class=\"sm-label-sprite {extraCls}\" style=\"color:\n    {[SM.getContrastYIQ(values.color)]};background-color: #{color};\" \n    ext:qtip=\"{[SM.he(SM.he(values.description))]}\">\n    <tpl if=\"values.isUnlabeled===true\"><i></tpl>\n    {[SM.he(values.name)]}\n    <tpl if=\"values.isUnlabeled===true\"></i></tpl>\n    </span>`\n\nSM.Manage.Collection.LabelTpl = new Ext.XTemplate(\n  SM.Manage.Collection.LabelSpriteHtml\n)\nSM.Manage.Collection.LabelArrayTpl = new Ext.XTemplate(\n  '<tpl for=\".\">',\n  `${SM.Manage.Collection.LabelSpriteHtml} `,\n  '</tpl>'\n)\n\nSM.Manage.Collection.GetLabelSprites = function (collectionId, labelIds) {\n  let labels = []\n  let includeUnlabeled = false\n  for (const labelId of labelIds) {\n    if (labelId === null) {\n      includeUnlabeled = true\n    }\n    const label = SM.Cache.getCollectionLabel(collectionId, labelId)\n    if (label) labels.push(label)\n  }\n  labels.sort((a, b) => a.name.localeCompare(b.name))\n  if (includeUnlabeled) {\n    labels = [\n      {\n        color: '000000',\n        name: 'no label',\n        isUnlabeled: true\n      },\n      ...labels\n    ]\n  }\n  return SM.Manage.Collection.LabelArrayTpl.apply(labels)\n}\n\nSM.Manage.Collection.LabelEditTpl = new Ext.XTemplate(\n  '<span class=sm-label-sprite style=\"color:{[SM.getContrastYIQ(values.color)]};background-color:#{color};\">{[SM.he(values.name)]}</span><img class=\"sm-label-edit-color\" src=\"img/color-picker.svg\" width=\"12\" height=\"12\">'\n)\n\nSM.Manage.Collection.ColorMenu = Ext.extend(Ext.menu.Menu, {\n  enableScrolling: false,\n  hideOnClick: true,\n  cls: 'x-color-menu',\n  paletteId: null,\n\n  initComponent: function () {\n    Ext.apply(this, {\n      plain: true,\n      showSeparator: false,\n      items: this.palette = new Ext.ColorPalette(Ext.applyIf({\n        id: this.paletteId,\n        renderTo: null,\n        colors: [\n          '4568F2', '7000FF', 'E46300', '8A5000', '019900', 'DF584B',\n          '99CCFF', 'D1ADFF', 'FFC399', 'FFF699', 'A3EA8F', 'F5A3A3',\n        ]\n      }, this.initialConfig))\n    })\n    this.palette.purgeListeners()\n    this.superclass().initComponent.call(this)\n    this.relayEvents(this.palette, ['select'])\n    this.on('select', this.menuHide, this);\n    if (this.handler) {\n      this.on('select', this.handler, this.scope || this)\n    }\n  },\n\n  menuHide: function () {\n    if (this.hideOnClick) {\n      this.hide(true)\n    }\n  }\n})\n\nSM.Manage.Collection.LabelNameEditor = Ext.extend(Ext.form.Field, {\n  defaultAutoCreate: { tag: \"div\" },\n  submitValue: false,\n  initComponent: function () {\n    this.superclass().initComponent.call(this)\n  },\n  setValue: function () {\n    if (this.rendered) {\n      const data = this.ownerCt.record.data\n      this.namefield.setValue(data.name)\n      this.previewfield.update({\n        name: data.name,\n        color: data.color\n      })\n      this.previewfield.color = data.color\n    }\n  },\n  getValue: function () {\n    return {\n      name: this.namefield.getValue(),\n      color: this.previewfield.color\n    }\n  },\n  onRender: function (ct, position) {\n    SM.Manage.Collection.LabelNameEditor.superclass.onRender.call(this, ct, position);\n    const _this = this\n    const cpm = new SM.Manage.Collection.ColorMenu({\n      submitValue: false,\n      renderTo: this.grid.editor.el,\n      listeners: {\n        select: function (palette, color) {\n          _this.previewfield.color = color\n          _this.previewfield.update({\n            name: _this.namefield.getValue(),\n            color\n          })\n        },\n        mouseover: function (menu, e, item) {\n          let one = 1\n        },\n        beforeshow: function (menu) {\n          let one = 1\n        }\n      }\n    })\n    this.grid.editor.cpm = cpm\n    this.namefield = new Ext.form.TextField({\n      value: this.ownerCt.record.data.name,\n      anchor: '100%',\n      align: 'stretch',\n      allowBlank: false,\n      maxLength: 16,\n      enableKeyEvents: true,\n      validator: function (v) {\n        // Don't keep the form from validating when I'm not active\n        if (_this.grid.editor.editing == false) {\n          return true\n        }\n        if (v === \"\") { return \"Blank values not allowed\" }\n        // Is there an item in the store like _this?\n\n        let searchIdx = _this.grid.store.findBy(function (rec) {\n          return rec.get('name')?.toLowerCase() === v.toLowerCase()\n        })\n\n        let isMe = _this.grid.selModel.isSelected(searchIdx)\n        if (searchIdx == -1 || isMe) {\n          return true\n        } else {\n          return \"Duplicate names not allowed\"\n        }\n      },\n      listeners: {\n        keyup: function (field, e) {\n          _this.previewfield.update({\n            name: field.getValue(),\n            color: _this.previewfield.color\n          })\n        }\n      }\n    })\n    this.isValid = function (preventMark) {\n      return this.namefield.isValid(preventMark)\n    }\n\n    this.previewfield = new Ext.form.DisplayField({\n      submitValue: false,\n      tpl: SM.Manage.Collection.LabelEditTpl,\n      data: {\n        name: this.ownerCt.record.data.name,\n        color: this.ownerCt.record.data.color\n      },\n      color: this.ownerCt.record.data.color,\n      anchor: '100%',\n      getValue: function () {\n        return this.color\n      },\n      listeners: {\n        render: function (field, owner) {\n          field.el.addListener('click', (e) => {\n            if (e.target.tagName === 'IMG') {\n              cpm.showAt(e.xy)\n              // Safely attempt to select the color, handling case where color doesn't exist in palette\n              try {\n                cpm.palette.select(_this.previewfield.color, true) //suppress event\n              } catch {\n                // Color not found in palette, ignore the error\n                return\n              }\n            }\n          })\n        }\n      }\n    })\n\n    this.panel = new Ext.Panel({\n      renderTo: this.el,\n      height: 50,\n      width: this.width,\n      border: false,\n      layout: 'form',\n      layoutConfig: {\n        hideLabels: true\n      },\n      bodyStyle: 'background-color: transparent;',\n      items: [\n        this.namefield,\n        this.previewfield\n      ]\n    })\n  },\n  focus: function (selectText, delay) {\n    if (delay) {\n      this.focusTask = new Ext.util.DelayedTask(this.focus, this, [selectText, false]);\n      this.focusTask.delay(Ext.isNumber(delay) ? delay : 10);\n      return this;\n    }\n    if (this.rendered && !this.isDestroyed) {\n      this.namefield.el.focus();\n      if (selectText === true) {\n        this.namefield.el.dom.select();\n      }\n    }\n    return this;\n  }\n})\n\nSM.Manage.Collection.LabelsGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    const fields = [\n      {\n        name: 'labelId',\n        type: 'string',\n      },\n      {\n        name: 'name',\n        type: 'string'\n      },\n      {\n        name: 'description',\n        type: 'string'\n      },\n      {\n        name: 'color',\n        type: 'string'\n      },\n      {\n        name: 'uses',\n        type: 'integer'\n      }\n    ]\n    this.newRecordConstructor = Ext.data.Record.create([{\n      name: 'name',\n      type: 'string'\n    },\n    {\n      name: 'description',\n      type: 'string'\n    },\n    {\n      name: 'color',\n      type: 'string'\n    }\n    ])\n    this.editor = new Ext.ux.grid.RowEditor({\n      saveText: 'Save',\n      grid: this,\n      clicksToEdit: 2,\n      errorSummary: false, // don't display errors during validation monitoring\n      listeners: {\n        validateedit: function (editor, changes, record, index) {\n          // transform record\n          changes.color = changes.name.color\n          changes.name = changes.name.name\n        },\n        canceledit: function (editor, forced) {\n          // The 'editing' property is set by RowEditorToolbar.js\n          if (editor.record.editing === true) { // was the edit on a new record?\n            this.grid.store.suspendEvents(false);\n            this.grid.store.remove(editor.record);\n            this.grid.store.resumeEvents();\n            this.grid.getView().refresh();\n          }\n        },\n        afteredit: function (editor, changes, record, index) {\n          editor.grid.fireEvent(\n            record.data.labelId ? 'labelchanged' : 'labelcreated',\n            editor.grid,\n            record\n          )\n        }\n      }\n    })\n    const labelStore = new Ext.data.JsonStore({\n      grid: this,\n      baseParams: this.baseParams,\n      root: '',\n      fields,\n      idProperty: 'labelId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC'\n      },\n      listeners: {\n        remove: function (store, record, index) {\n          _this.fireEvent('labeldeleted', record.data.labelId)\n        }\n      }\n    })\n\n    const columns = [\n      {\n        header: \"Name\",\n        width: 50,\n        dataIndex: 'name',\n        sortable: true,\n        renderer: function (v, params, record) {\n          return SM.Manage.Collection.LabelTpl.apply({\n            color: record.data.color,\n            name: v,\n            description: ''\n          })\n        },\n        editor: new SM.Manage.Collection.LabelNameEditor({\n          grid: this\n        })\n      },\n      {\n        header: \"Description\",\n        width: 70,\n        dataIndex: 'description',\n        sortable: false,\n        editor: new Ext.form.TextField({ submitValue: false })\n      },\n      {\n        header: '<img exportValue= \"AssetCount\" src=\"img/target.svg\" width=12 height=12>',\n        width: 15,\n        dataIndex: 'uses',\n        align: 'center',\n        sortable: true,\n        renderer: SM.styledZeroRenderer\n      }\n    ]\n    const tbar = new SM.RowEditorToolbar({\n      itemString: 'Label',\n      editor: this.editor,\n      gridId: this.id,\n      deleteProperty: 'name',\n      newRecord: this.newRecordConstructor,\n      newRecordValues: {\n        name: '',\n        description: '',\n        color: '99CCFF'\n      }\n    })\n    tbar.addSeparator()\n    this.assetBtn = tbar.addButton({\n      iconCls: 'sm-asset-icon',\n      disabled: true,\n      text: 'Tag Assets...',\n      handler: function () {\n        const r = _this.getSelectionModel().getSelected()\n        SM.Manage.Collection.showLabelAssetsWindow(_this.collectionId, r.get('labelId'))\n      }\n    })\n\n    const cm = new Ext.grid.ColumnModel({\n      columns\n    })\n    const sm = new Ext.grid.RowSelectionModel({\n      singleSelect: true,\n      listeners: {\n        selectionchange: function (sm) {\n          tbar.delButton.setDisabled(!sm.hasSelection())\n          _this.assetBtn.setDisabled(!sm.hasSelection())\n        }\n      }\n    })\n    const view = new SM.ColumnFilters.GridView({\n      emptyText: this.emptyText || 'No records to display',\n      deferEmptyText: false,\n      forceFit: true,\n      markDirty: false\n    })\n    const totalTextCmp = new SM.RowCountTextItem({\n      store: labelStore,\n      noun: 'label',\n      iconCls: 'sm-label-icon'\n    })\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          gridBasename: 'CollectionLabels',\n          exportType: 'grid',\n          iconCls: 'sm-export-icon',\n          text: 'CSV',\n          grid: this\n        },\n        {\n          xtype: 'tbfill'\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        totalTextCmp\n      ]\n    })\n\n    const config = {\n      isFormField: true,\n      name: 'labels',\n      allowBlank: false,\n      layout: 'fit',\n      height: 150,\n      plugins: [this.editor],\n      store: labelStore,\n      cm,\n      sm,\n      view,\n      tbar,\n      bbar,\n      getValue: function () {\n        const labels = []\n        labelStore.data.items.forEach((i) => {\n          const { uses, ...labelfields } = i.data\n          labels.push(labelfields)\n        })\n        return labels\n      },\n      setValue: function (v) {\n        labelStore.loadData(v)\n      },\n      validator: function (v) {\n        let one = 1\n      },\n      markInvalid: function () {\n        let one = 1\n      },\n      clearInvalid: function () {\n        let one = 1\n      },\n      isValid: function () {\n        return true\n      },\n      getName: () => this.name,\n      validate: function () {\n        let one = 1\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Manage.Collection.LabelsMenu = Ext.extend(Ext.menu.Menu, {\n  initComponent: function () {\n    this.addEvents('applied')\n    const config = {\n      items: [],\n      listeners: {\n        itemclick: this.onItemClick,\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n    this.refreshItems(this.labels)\n  },\n  onItemClick: function (item, e) {\n    if (item.hideOnClick) { // only the Apply item\n      const labelIds = this.getCheckedLabelIds()\n      this.fireEvent('applied', labelIds)\n    }\n  },\n  getCheckedLabelIds: function (excludeUnused = false) {\n    const checked = this.items.items.reduce(function (labelIds, item) {\n      if (item.checked) {\n        if (excludeUnused && item.label.uses === 0) {\n          return labelIds\n        }\n        labelIds.push(item.labelId)\n      }\n      return labelIds\n    }, [])\n    return checked\n  },\n  getLabelItemConfig: function (label, checked = false) {\n    return {\n      xtype: 'menucheckitem',\n      hideOnClick: false,\n      text: SM.Manage.Collection.LabelTpl.apply(label),\n      labelId: label?.labelId ?? null,\n      label,\n      checked,\n      listeners: {\n        checkchange: function (item, checked) {\n          item.parentMenu.fireEvent('itemcheckchanged', item, checked)\n        }\n      }\n    }\n  },\n  getTextItemConfig: function (text = '<b>FILTER</b>') {\n    return {\n      hideOnClick: false,\n      activeClass: '',\n      text,\n      iconCls: 'sm-menuitem-filter-icon',\n      cls: 'sm-menuitem-filter-label'\n    }\n  },\n\n  getSelectAllItemConfig: function () {\n    return {\n      xtype: 'menucheckitem',\n      hideOnClick: false,\n      text: '<i>(Select All)</i>',\n      labelId: 'select-all',\n      checked: true,\n      labelItems: [],\n      onLabelItemChanged: function () {\n        const state = this.labelItems.every(i => i.checked)\n        this.setChecked(state, true)\n      },\n      listeners: {\n        checkchange: function (item, checked) {\n          for (const labelItem of item.labelItems) {\n            labelItem.setChecked(checked, false)\n          }\n        }\n      }\n    }\n  },\n  getActionItemConfig: function (text = '<b>Apply</b>') {\n    return {\n      xtype: 'menuitem',\n      text,\n      icon: 'img/change.svg'\n    }\n  },\n  setLabelsChecked: function (labelIds, checked) {\n    for (const labelId of labelIds) {\n      this.find('labelId', labelId)[0]?.setChecked(checked, true) //suppressEvent = true\n    }\n  },\n  updateLabel: function (label) {\n    const item = this.find('labelId', label.labelId)[0]\n    if (item) {\n      if (label.uses === 0 && this.ignoreUnusedLabels) {\n        this.removeLabel(label)\n      }\n      else {\n        item.label = label\n        item.setText(SM.Manage.Collection.LabelTpl.apply(label))\n        this.items.sort('ASC', this.sorter)\n        this.rerender()\n      }\n    }\n  },\n  addLabel: function (label) {\n    if (label.uses === 0 && this.ignoreUnusedLabels) return\n    this.addItem(this.getLabelItemConfig(label))\n    this.items.sort('ASC', this.sorter)\n    this.rerender()\n  },\n  removeLabel: function (labelId) {\n    const item = this.find('labelId', labelId)[0]\n    if (item) {\n      this.remove(item)\n    }\n  },\n  sorter: function (a, b) {\n    return a.label.name.localeCompare(b.label.name)\n  },\n  refreshItems: function (labels) {\n    const labelIdSet = new Set(this.getCheckedLabelIds())\n    this.removeAll()\n    if (this.showHeader) {\n      this.addItem(this.getTextItemConfig())\n    }\n    \n    // Add Apply button and Select All at the top\n    if (this.showApply) {\n      this.addItem(this.getActionItemConfig())\n      this.addItem('-')\n    }\n    const selectAllItem = this.addItem(this.getSelectAllItemConfig())\n    this.addItem('-')\n    \n    labels.sort((a, b) => {\n      if (a.labelId === null) return -1\n      if (b.labelId === null) return 1\n      return a.name.localeCompare(b.name)\n    })\n    \n    const labelItems = []\n    for (const label of labels) {\n      if (label.uses === 0 && this.ignoreUnusedLabels) continue\n      const checked = labelIdSet.has(label.labelId)\n      let labelItem\n      if (label.labelId === null) {\n        labelItem = this.addItem(this.getLabelItemConfig({\n          color: '000000',\n          name: 'no label',\n          isUnlabeled: true\n        }, checked))\n      }\n      else {\n        labelItem = this.addItem(this.getLabelItemConfig(label, checked))\n      }\n      \n      if (labelItem) {\n        labelItems.push(labelItem)\n        // Set up listener to update Select All state when individual items change\n        labelItem.on('checkchange', function() {\n          selectAllItem.onLabelItemChanged()\n        })\n      }\n    }\n    \n    // Connect Select All with label items\n    selectAllItem.labelItems = labelItems\n    selectAllItem.onLabelItemChanged() // Initialize Select All state\n  },\n  rerender: function () {\n    if (this.rendered) {\n      this.el.remove()\n      delete this.el\n      delete this.ul\n      this.rendered = false\n      this.render()\n      this.doLayout.call(this, false, true)\n    }\n  }\n})\n\nSM.Manage.Collection.LabelAssetsFormPanel = Ext.extend(Ext.form.FormPanel, {\n  initComponent: function () {\n    const _this = this\n    if (!this.collectionId) {\n      throw new Error('missing property collectionId')\n    }\n    const assetSelectionPanel = new SM.AssetSelection.SelectingPanel({\n      name: 'assets',\n      collectionId: this.collectionId,\n      isFormField: true,\n      selectionsGridTitle: 'Tagged'\n    })\n    const labelData = { ...SM.Cache.getCollectionLabel(this.collectionId, this.labelId) }\n    labelData.extraCls = 'sm-jumbo-sprite'\n    const labelSpan = SM.Manage.Collection.LabelTpl.apply(labelData)\n    const labelField = new Ext.form.DisplayField({\n      fieldLabel: 'Label',\n      hideLabel: true,\n      anchor: '100%',\n      value: labelSpan\n    })\n\n    const config = {\n      baseCls: 'x-plain',\n      labelWidth: 80,\n      monitorValid: true,\n      trackResetOnLoad: true,\n      items: [\n        {\n          xtype: 'fieldset',\n          title: '<span class=\"sm-label-title\">Label</span>',\n          items: [\n            labelField\n          ]\n        },\n        {\n          xtype: 'fieldset',\n          title: '<span class=\"sm-asset-assignments-title\">Tagged Assets</span>',\n          anchor: \"100% -70\",\n          layout: 'fit',\n          items: [\n            assetSelectionPanel\n          ]\n        }\n\n      ],\n      buttons: [{\n        text: this.btnText || 'Save',\n        collectionId: _this.collectionId,\n        formBind: true,\n        handler: this.btnHandler || function () { }\n      }],\n      assetSelectionPanel\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n\n  },\n  initPanel: async function () {\n    try {\n      this.el.mask('')\n      await this.assetSelectionPanel.initPanel({ labelId: this.labelId })\n    }\n    catch (e) {\n      SM.Error.handleError(e)\n    }\n    finally {\n      this.el.unmask()\n    }\n  }\n})\n\nSM.Manage.Collection.showLabelAssetsWindow = async function (collectionId, labelId) {\n  try {\n    let labelAssetsFormPanel = new SM.Manage.Collection.LabelAssetsFormPanel({\n      collectionId,\n      labelId,\n      btnHandler: async function (btn) {\n        try {\n          let values = labelAssetsFormPanel.getForm().getFieldValues(false, true) // dirtyOnly=false, getDisabled=true\n          let result = await Ext.Ajax.requestPromise({\n            url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/labels/${labelId}/assets`,\n            method: 'PUT',\n            headers: { 'Content-Type': 'application/json;charset=utf-8' },\n            jsonData: values.assets\n          })\n          const apiLabelAssets = JSON.parse(result.response.responseText)\n          SM.Dispatcher.fireEvent('labelassetschanged', collectionId, labelId, apiLabelAssets)\n          appwindow.close()\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n      }\n    })\n\n    /******************************************************/\n    // Form window\n    /******************************************************/\n    const height = Ext.getBody().getHeight() - 80\n    const width = Math.min(Math.floor(Ext.getBody().getWidth() * 0.75), 1280)\n    var appwindow = new Ext.Window({\n      title: 'Tagged Assets',\n      resizable: true,\n      cls: 'sm-dialog-window sm-round-panel',\n      modal: true,\n      hidden: true,\n      width,\n      height,\n      minWidth: 810,\n      minHeight: 460,\n      maximizable: true,\n      layout: 'fit',\n      plain: true,\n      bodyStyle: 'padding:10px;',\n      buttonAlign: 'right',\n      items: labelAssetsFormPanel\n    });\n\n    appwindow.show(Ext.getBody())\n    await labelAssetsFormPanel.initPanel() // Load asset grid store\n\n\n    appwindow.show(Ext.getBody());\n  }\n  catch (e) {\n    Ext.getBody().unmask()\n    SM.Error.handleError(e)\n  }\n}\n\nSM.Manage.Collection.CreateFormPanel = Ext.extend(Ext.form.FormPanel, {\n  initComponent: function () {\n    const nameField = new Ext.form.TextField({\n      fieldLabel: 'Name',\n      labelStyle: 'font-weight: 600;',\n      name: 'name',\n      allowBlank: false,\n      anchor: '100%'\n    })\n    const descriptionField = new Ext.form.TextArea({\n      fieldLabel: 'Description',\n      labelStyle: 'font-weight: 600;',\n      name: 'description',\n      anchor: '100% -30',\n    })\n    const config = {\n      baseCls: 'x-plain',\n      cls: 'sm-collection-manage-layout sm-round-panel',\n      bodyStyle: 'padding: 9px;',\n      border: false,\n      labelWidth: 100,\n      monitorValid: true,\n      items: [\n        {\n          xtype: 'fieldset',\n          region: 'north',\n          height: 180,\n          split: false,\n          title: 'Information',\n          items: [nameField, descriptionField]\n        }\n      ],\n      buttons: [{\n        text: this.btnText || 'Save',\n        formBind: true,\n        handler: this.btnHandler || function () { }\n      }]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.Manage.Collection.showCreateWindow = function () {\n  const fp = new SM.Manage.Collection.CreateFormPanel({\n    btnHandler: async () => {\n      try {\n        let values = fp.getForm().getFieldValues()\n        values.grants = [{userId: curUser.userId, roleId: 4}]\n        values.metadata = {}\n        await SM.Manage.Collection.ApiAddOrUpdate(0, values, {\n          showManager: true\n        })\n      }\n      catch (e) {\n        if (e.responseText) {\n          const response = SM.safeJSONParse(e.responseText)\n          if (response?.detail === 'Duplicate name exists.') {\n            Ext.Msg.alert('Name unavailable', 'The Collection name is unavailable. Please try a different name.')\n          }\n          else {\n            appwindow.close()\n            await SM.Error.handleError(e)\n          }\n        }\n      }\n      finally {\n        panelWindow.close()\n      }\n    }\n  })\n\n  const panelWindow = new Ext.Window({\n    id: 'window-project-info',\n    cls: 'sm-dialog-window sm-round-panel',\n    title: 'Create Collection',\n    modal: true,\n    width: 460,\n    height:260,\n    layout: 'fit',\n    plain: false,\n    // bodyStyle:'padding:5px;',\n    buttonAlign:'right',\n    items: fp\n  })\n  panelWindow.show(Ext.getBody())\n}\n\nExt.ns('SM.Manage.Asset')\nExt.ns('SM.Manage.Stig')\n\nSM.Manage.Asset.showAssetProps = async function (assetId, initialCollectionId) {\n  try {\n    let assetPropsFormPanel = new SM.Manage.Asset.PropertiesFormPanel({\n      id: 'dev-test',\n      padding: '10px 15px 10px 15px',\n      initialCollectionId,\n      btnHandler: async function () {\n        try {\n          if (assetPropsFormPanel.getForm().isValid()) {\n            let values = assetPropsFormPanel.getForm().getFieldValues(false, true) // dirtyOnly=false, getDisabled=true\n            values.labelNames = values.labelIds\n            delete values.labelIds\n            // //TODO: getFieldValues should not return 'undefined' \n            delete values.undefined\n            const method = assetId ? 'PUT' : 'POST'\n            const url = assetId ? `${STIGMAN.Env.apiBase}/assets/${assetId}` : `${STIGMAN.Env.apiBase}/assets`\n            const returnedAsset = await Ext.Ajax.requestPromise({\n              responseType: 'json',\n              url,\n              method,\n              headers: { 'Content-Type': 'application/json;charset=utf-8' },\n              jsonData: values\n            })\n            const apiAsset = await Ext.Ajax.requestPromise({\n              responseType: 'json',\n              url: `${STIGMAN.Env.apiBase}/collections/${initialCollectionId}/metrics/summary/asset`,\n              method: 'GET',\n              params: {\n                assetId: returnedAsset.assetId\n              }\n            })\n            apiAsset.collection = returnedAsset.collection\n            const event = assetId ? 'assetchanged' : 'assetcreated'\n            SM.Dispatcher.fireEvent(event, apiAsset)\n            appwindow.close()\n          }\n        }\n        catch (e) {\n          if (e.responseText) {\n            const response = SM.safeJSONParse(e.responseText)\n            if (response?.detail?.[0]?.failure === 'name exists') {\n              Ext.Msg.alert('Name unavailable', 'The Asset name is already used in this Collection. Please try a different name.')\n            }\n            else {\n              appwindow.close()\n              await SM.Error.handleError(e)\n            }\n          }\n        }\n      }\n    })\n\n    /******************************************************/\n    // Form window\n    /******************************************************/\n    const appwindow = new Ext.Window({\n      id: 'assetPropsWindow',\n      cls: 'sm-dialog-window sm-round-panel',\n      title: assetId ? 'Asset Properties, ID ' + assetId : 'Create new Asset',\n      modal: true,\n      hidden: true,\n      width: 800,\n      height: 800,\n      layout: 'fit',\n      plain: true,\n      bodyStyle: 'padding:5px;',\n      buttonAlign: 'right',\n      items: assetPropsFormPanel\n    });\n\n\n    appwindow.render(Ext.getBody())\n    // await assetPropsFormPanel.initPanel()\n\n    if (assetId) {\n      let apiAsset = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/assets/${assetId}`,\n        params: {\n          projection: ['stigs']\n        },\n        method: 'GET'\n      })\n      apiAsset.collectionId = apiAsset.collection.collectionId\n      delete apiAsset.collection\n      assetPropsFormPanel.getForm().setValues(apiAsset)\n      assetPropsFormPanel.stigSelectingPanel.initPanel(apiAsset)\n    }\n    else {\n      assetPropsFormPanel.stigSelectingPanel.initPanel({stigs: []})\n    }\n\n    Ext.getBody().unmask();\n    appwindow.show(Ext.getBody());\n  }\n  catch (e) {\n    Ext.getBody().unmask()\n    SM.Error.handleError(e)\n  }\n}\n\nSM.Manage.Asset.Grid = Ext.extend(Ext.grid.GridPanel, {\n  onAssetChangedOrCreated: function (apiAsset) {\n    if (apiAsset.collection.collectionId === this.collectionId) {\n      this.store.loadData(apiAsset, true) // append with replace\n      const sortState = this.store.getSortState()\n      this.store.sort(sortState.field, sortState.direction)\n    }\n  },\n  onLabelChanged: function (collectionId, label) {\n    if (collectionId === this.collectionId) {\n      this.getView().refresh()\n    }\n  },\n  onLabelDeleted: function (collectionId, labelId) {\n    if (collectionId === this.collectionId) {\n      this.getStore().reload()\n    }\n  },\n  initComponent: function () {\n    const me = this\n    const fieldsConstructor = Ext.data.Record.create([\n      { name: 'assetId', type: 'string' },\n      { name: 'name', type: 'string' },\n      { name: 'fqdn', type: 'string' },\n      { name: 'description', type: 'string' },\n      { name: 'ip', type: 'string' },\n      { name: 'mac', type: 'string' },\n      { name: 'noncomputing', type: 'boolean' },\n      {\n        name: 'labelIds',\n        convert: (v, r) => r.labels.map((label) => label.labelId)\n      },\n      {\n        name: 'assessments',\n        type: 'integer',\n        mapping: 'metrics.assessments'\n      },\n      {\n        name: 'stigCount',\n        convert: (v, r) => r.benchmarkIds.length\n      },\n      {\n        name: 'assessedPct',\n        convert: (v, r) => r.metrics.assessments ? r.metrics.assessed / r.metrics.assessments * 100 : 0\n      },\n      {\n        name: 'savedPct',\n        convert: (v, r) => r.metrics.assessments ? ((r.metrics.statuses.saved + r.metrics.statuses.submitted + r.metrics.statuses.accepted + r.metrics.statuses.rejected) / r.metrics.assessments) * 100 : 0\n      },\n      {\n        name: 'submittedPct',\n        convert: (v, r) => r.metrics.assessments ? ((r.metrics.statuses.submitted + r.metrics.statuses.accepted + r.metrics.statuses.rejected) / r.metrics.assessments) * 100 : 0\n      },\n      {\n        name: 'acceptedPct',\n        convert: (v, r) => r.metrics.assessments ? (r.metrics.statuses.accepted / r.metrics.assessments) * 100 : 0\n      },\n      {\n        name: 'rejectedPct',\n        convert: (v, r) => r.metrics.assessments ? (r.metrics.statuses.rejected / r.metrics.assessments) * 100 : 0\n      },\n      {\n        name: 'minTs',\n        type: 'date',\n        mapping: 'metrics.minTs'\n      },\n      {\n        name: 'maxTs',\n        type: 'date',\n        mapping: 'metrics.maxTs'\n      },\n      {\n        name: 'maxTouchTs',\n        type: 'date',\n        mapping: 'metrics.maxTouchTs'\n      },\n      { name: 'metadata' }\n    ])\n    this.proxy = new Ext.data.HttpProxy({\n      restful: true,\n      url: this.url,\n      headers: { 'Content-Type': 'application/json;charset=utf-8' }\n    })\n    const assetStore = new Ext.data.JsonStore({\n      grid: this,\n      smMaskDelay: 250,\n      proxy: this.proxy,\n      root: '',\n      fields: fieldsConstructor,\n      idProperty: 'assetId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      }\n    })\n    me.totalTextCmp = new SM.RowCountTextItem({\n      store: assetStore,\n      noun: 'asset',\n      iconCls: 'sm-asset-icon'\n    })\n    const sm = new Ext.grid.CheckboxSelectionModel({\n      singleSelect: false,\n      checkOnly: false,\n      listeners: {\n        selectionchange: function (sm) {\n          modifyBtn.setDisabled(sm.getCount() !== 1)\n          const hasSelection = sm.hasSelection()\n          let someSelectionsHaveStigs = false\n          if (hasSelection) {\n            const selectedRecords = sm.getSelections()\n            someSelectionsHaveStigs = selectedRecords.some(i => i.data.stigCount > 0)\n          }\n          for (const btn of [deleteBtn, transferBtn]) {\n            btn.setDisabled(!hasSelection)\n          }\n          exportBtn.setDisabled(!(hasSelection && someSelectionsHaveStigs))\n          SM.SetCheckboxSelModelHeaderState(sm)\n        }\n      }\n    })\n    const assetColumnId = Ext.id()\n    const columns = [\n      sm,\n      {\n        header: \"Asset\",\n        id: assetColumnId,\n        width: 175,\n        dataIndex: 'name',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"Labels\",\n        width: 220,\n        dataIndex: 'labelIds',\n        sortable: false,\n        filter: {\n          type: 'multi-value',\n          collectionId: me.collectionId,\n          comparer: function (a, b) {\n            return SM.ColumnFilters.CompareFns.labelIds(a, b, me.collectionId)\n          },\n          renderer: SM.ColumnFilters.Renderers.labels\n        },\n        renderer: function (value, metadata) {\n          const labels = []\n          for (const labelId of value) {\n            const label = SM.Cache.getCollectionLabel(me.collectionId, labelId)\n            if (label) labels.push(label)\n          }\n          labels.sort((a, b) => a.name.localeCompare(b.name))\n          metadata.attr = 'style=\"white-space:nowrap;text-overflow:clip;\"'\n          return SM.Manage.Collection.LabelArrayTpl.apply(labels)\n        }\n      },\n      {\n        header: \"FQDN\",\n        width: 100,\n        dataIndex: 'fqdn',\n        sortable: true,\n        hidden: true,\n        renderer: SM.styledEmptyRenderer,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"IP\",\n        width: 100,\n        dataIndex: 'ip',\n        hidden: true,\n        sortable: true,\n        renderer: SM.styledEmptyRenderer\n      },\n      {\n        header: \"MAC\",\n        hidden: true,\n        width: 110,\n        dataIndex: 'mac',\n        sortable: true,\n        renderer: SM.styledEmptyRenderer,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"STIGs\",\n        width: 50,\n        dataIndex: 'stigCount',\n        align: \"center\",\n        tooltip: \"Total STIGs Assigned\",\n        sortable: true\n      },\n      {\n        header: \"Rules\",\n        width: 50,\n        dataIndex: 'assessments',\n        align: \"center\",\n        sortable: true\n      },\n      {\n        header: 'Oldest',\n        width: 50,\n        dataIndex: 'minTs',\n        align: 'center',\n        sortable: true,\n        renderer: renderDurationToNow\n      },\n      {\n        header: 'Newest',\n        width: 50,\n        dataIndex: 'maxTs',\n        align: 'center',\n        sortable: true,\n        renderer: renderDurationToNow\n      },\n      {\n        header: \"Assessed\",\n        width: 100,\n        dataIndex: 'assessedPct',\n        align: \"center\",\n        sortable: true,\n        renderer: renderPct\n      },\n      {\n        header: \"Submitted\",\n        width: 100,\n        dataIndex: 'submittedPct',\n        align: \"center\",\n        sortable: true,\n        renderer: renderPct\n      },\n      {\n        header: \"Accepted\",\n        width: 100,\n        dataIndex: 'acceptedPct',\n        align: \"center\",\n        sortable: true,\n        renderer: renderPct\n      },\n      {\n        header: \"Rejected\",\n        width: 100,\n        dataIndex: 'rejectedPct',\n        align: \"center\",\n        sortable: true,\n        renderer: renderPctAllHigh\n      }\n    ]\n    const exportBtn = new Ext.Button({\n      iconCls: 'sm-export-icon',\n      text: 'Export results...',\n      disabled: true,\n      handler: function () {\n        SM.Exports.showExportTree(me.collectionId, me.collectionName, 'asset', me.getSelectionModel().getSelections().map(r => r.data))\n      }\n    })\n    const deleteBtn = new Ext.Button({\n      iconCls: 'icon-del',\n      text: 'Delete...',\n      disabled: true,\n      handler: async function () {\n        try {\n          let assetRecords = me.getSelectionModel().getSelections()\n          const multiDelete = assetRecords.length > 1\n          const confirmStr = `Deleting ${multiDelete ? '<b>multiple assets</b>' : 'this asset'} will <b>remove all data</b> associated with the asset${multiDelete ? 's' : ''}. This includes all the corresponding STIG assessments.<br><br>Do you wish to continue?`;\n          let btn = await SM.confirmPromise(\"Confirm Delete\", confirmStr)\n          if (btn == 'yes') {\n            const assetIds = assetRecords.map(r => r.data.assetId)\n            Ext.getBody().mask(`Deleting ${assetRecords.length} Assets`)\n            await Ext.Ajax.requestPromise({\n              responseType: 'json',\n              url: `${STIGMAN.Env.apiBase}/assets?collectionId=${me.collectionId}`,\n              method: 'PATCH',\n              jsonData: {\n                operation: 'delete',\n                assetIds\n              }\n            })\n            me.store.suspendEvents(false)\n            // Might need to handle edge case when the selected record was changed (e.g., stats updated) while still selected, then is deleted\n            me.store.remove(assetRecords)\n            me.store.resumeEvents()\n\n            SM.Dispatcher.fireEvent('assetdeleted', { collection: { collectionId: me.collectionId } }) // mock an Asset for collectionManager.onAssetEvent\n          }\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n        finally {\n          Ext.getBody().unmask()\n        }\n      }\n    })\n    const transferBtn = new SM.TransferAssets.TransferBtn({\n      iconCls: 'sm-collection-icon',\n      disabled: true,\n      srcCollectionId: me.collectionId,\n      text: 'Transfer To',\n      onItemClick: async function (item) {\n        try {\n          const srcAssets = item.parentMenu.srcAssets\n          const isMulti = srcAssets?.length > 1\n          var confirmStr = `Transfering ${isMulti ? 'these assets' : 'this asset'} to ${item.text} will <b>transfer all data</b> associated with the asset${isMulti ? 's' : ''}. This includes all the corresponding STIG assessments.<br><br>Do you wish to continue?`\n          const btn = await SM.confirmPromise('Confirm transfer', confirmStr)\n          if (btn == 'yes') {\n            const l = srcAssets?.length || 0\n            for (let i = 0; i < l; i++) {\n              Ext.getBody().mask(`Transferring ${i + 1}/${l} Assets`)\n              // Edge case to handle when the selected record was changed (e.g., stats updated) \n              // while still selected, then is transferred\n              const thisRecord = me.store.getById(srcAssets[i].assetId)\n              let returnedAsset = await Ext.Ajax.requestPromise({\n                responseType: 'json',\n                url: `${STIGMAN.Env.apiBase}/assets/${thisRecord.data.assetId}`,\n                method: 'PATCH',\n                jsonData: {\n                  collectionId: item.collectionId\n                }\n              })\n              let apiAsset = await Ext.Ajax.requestPromise({\n                responseType: 'json',\n                url: `${STIGMAN.Env.apiBase}/collections/${me.collectionId}/metrics/summary/asset`,\n                method: 'GET',\n                params: {\n                  assetId: thisRecord.data.assetId\n                }\n              })\n              apiAsset.collection = returnedAsset.collection\n              me.store.remove(thisRecord)\n              SM.Cache.updateCollectionLabels(returnedAsset.collection.collectionId)\n              SM.Dispatcher.fireEvent('assetdeleted', { ...apiAsset, ...{ collection: { collectionId: me.collectionId } } })\n              SM.Dispatcher.fireEvent('assetcreated', apiAsset)\n            }\n          }\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n        finally {\n          Ext.getBody().unmask()\n        }\n\n      },\n      handler: function (btn) {\n        const assetRecords = me.getSelectionModel().getSelections()\n        btn.setSrcAssets(assetRecords.map(r => r.data))\n      }\n    })\n    const modifyBtn = new Ext.Button({\n      iconCls: 'sm-asset-icon',\n      disabled: true,\n      text: 'Modify...',\n      handler: function () {\n        var r = me.getSelectionModel().getSelected();\n        Ext.getBody().mask('Getting properties...');\n        SM.Manage.Asset.showAssetProps(r.get('assetId'), me.collectionId);\n      }\n    })\n    const onFileSelected = async function (field, fileName, collectionId) {\n      const file = field.fileInput.dom.files[0]\n      if (!file) {\n        return\n      }\n\n      try {\n        const parser = new STIGMAN.ClientModules.AssetParser()\n        let assets = []\n        let errors = []\n        \n        try {\n          const result = await parser.parse(file)\n          errors = result.errors\n          assets = result.assets\n        } catch (e) {\n          field.fileInput.dom.value = null\n          SM.Error.handleError(e)\n          return\n        }\n        SM.Manage.Asset.showParsedData(assets, errors, collectionId)\n        field.fileInput.dom.value = null\n\n      }\n      catch (e) {\n        field.fileInput.dom.value = null\n        SM.Error.handleError(e)\n      }\n    }\n    const config = {\n      layout: 'fit',\n      loadMask: { msg: '' },\n      store: assetStore,\n      cm: new Ext.grid.ColumnModel({\n        columns: columns\n      }),\n      sm,\n      view: new SM.ColumnFilters.GridViewBuffered({\n        emptyText: this.emptyText || 'No records to display',\n        deferEmptyText: false,\n        forceFit: true,\n        autoExpandColumn: assetColumnId,\n        // custom row height\n        rowHeight: 21,\n        borderHeight: 2,\n        // render rows as they come into viewable area.\n        scrollDelay: false,\n\n        listeners: {\n          filterschanged: function (view, item, value) {\n            assetStore.filter(view.getFilterFns())\n          }\n        }\n      }),\n      listeners: {\n        rowdblclick: function (grid, rowIndex, e) {\n          var r = grid.getStore().getAt(rowIndex);\n          Ext.getBody().mask('Getting properties...');\n          SM.Manage.Asset.showAssetProps(r.get('assetId'), me.collectionId);\n        },\n        beforedestroy: function (grid) {\n          SM.Dispatcher.removeListener('assetchanged', me.onAssetChangedOrCreated, me)\n          SM.Dispatcher.removeListener('assetcreated', me.onAssetChangedOrCreated, me)\n          SM.Dispatcher.removeListener('labelchanged', me.onLabelChanged, me)\n          SM.Dispatcher.removeListener('labeldeleted', me.onLabelDeleted, me)\n        },\n        keydown: SM.CtrlAGridHandler\n      },\n      tbar: new Ext.Toolbar({\n        items: [\n          {\n            iconCls: 'icon-add',\n            text: 'Create...',\n            handler: function () {\n              SM.Manage.Asset.showAssetProps(null, me.collectionId);\n            }\n          },\n          '-',\n          {\n            xtype: 'fileuploadfield',\n            buttonOnly: true,\n            accept: '.csv',\n            webkitdirectory: false,\n            style: 'width: 115px;',\n            buttonCfg: {\n              icon: \"img/add.svg\"\n            },\n            tooltip: \"Import New Assets from CSV\",\n            buttonText: 'Import Assets CSV',\n            listeners: {\n              fileselected: function (field, value) {\n                onFileSelected(field, value, me.collectionId);\n              }\n            }\n          },\n          '-',\n          {\n            text: 'Export Assets CSV',\n            iconCls: 'sm-export-icon',\n            tooltip: 'Export selected assets to CSV',\n            handler: function () {\n              let selectedAssets = me.getSelectionModel().getSelections().map(r => r.data)\n              if (selectedAssets.length === 0) {\n                selectedAssets = assetStore.getRange().map(r => r.data)\n              }\n              SM.Manage.Asset.exportAssetsCSV(me.collectionId,  me.collectionName, selectedAssets)\n            },\n          },\n          '-',\n          {\n            iconCls: 'sm-import-icon',\n            text: 'Import CKL(B) or XCCDF...',\n            tooltip: SM.TipContent.ImportFromCollectionManager,\n            handler: function () {\n              showImportResultFiles(me.collectionId)\n            }\n          },\n          '-',\n          exportBtn,\n          '-',\n          deleteBtn,\n          '-',\n          transferBtn,\n          '-',\n          modifyBtn\n        ]\n      }),\n      bbar: new Ext.Toolbar({\n        items: [\n          {\n            xtype: 'tbbutton',\n            grid: this,\n            iconCls: 'icon-refresh',\n            tooltip: 'Reload this grid',\n            width: 20,\n            handler: function (btn) {\n              const savedSmMaskDelay = btn.grid.store.smMaskDelay\n              btn.grid.store.smMaskDelay = 0\n              btn.grid.store.reload();\n              btn.grid.store.smMaskDelay = savedSmMaskDelay\n            }\n          }, {\n            xtype: 'tbseparator'\n          }, {\n            xtype: 'exportbutton',\n            hasMenu: false,\n            gridBasename: 'Assets (grid)',\n            storeBasename: 'Assets (store)',\n            iconCls: 'sm-export-icon',\n            text: 'CSV',\n            grid: this      \n          }, {\n            xtype: 'tbfill'\n          }, {\n            xtype: 'tbseparator'\n          },\n          this.totalTextCmp\n        ]\n      })\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n\n    SM.Dispatcher.addListener('assetchanged', this.onAssetChangedOrCreated, this)\n    SM.Dispatcher.addListener('assetcreated', this.onAssetChangedOrCreated, this)\n    SM.Dispatcher.addListener('labelchanged', this.onLabelChanged, this)\n    SM.Dispatcher.addListener('labeldeleted', this.onLabelDeleted, this)\n  }\n})\n\n\nSM.Manage.Asset.exportAssetsCSV = async function (collectionId, collectionName, selectedAssets) {\n\n  Ext.MessageBox.show({\n    title: 'Exporting Assets',\n    msg: 'Generating CSV, Please do not refresh.',\n    progressText: 'Saving...',\n    width:300,\n    wait:true,\n    waitConfig: {interval:200},\n    animEl: 'mb7'\n  })\n\n  try {\n    const assetIds = selectedAssets.map(a => a.assetId)\n\n    const assets = await Ext.Ajax.requestPromise({\n      responseType: 'json',\n      url: `${STIGMAN.Env.apiBase}/assets?collectionId=${collectionId}`,\n      method: 'GET',\n      params: {\n        projection: ['stigs']\n      }\n    })\n\n\n    const labels = await Ext.Ajax.requestPromise({\n      responseType: 'json',\n      url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/labels`,\n      method: 'GET'\n    })\n\n\n    const assetResponses = assets.filter(asset => assetIds.includes(asset.assetId))\n\n    for (const assetResponse of assetResponses) {\n      const labelIds = assetResponse.labelIds\n      const labelNames = labels.filter(label => labelIds.includes(label.labelId)).map(label => label.name)\n      assetResponse.labelNames = labelNames\n      delete assetResponse.labelIds\n    }\n\n\n    const csvContent = generateCsvFromAssets(assetResponses)\n    downloadCsv(csvContent, collectionName)\n\n    Ext.MessageBox.hide()\n  } catch (e) {\n    Ext.MessageBox.hide()\n    SM.Error.handleError(e)\n  }\n\n  function downloadCsv(content, collectionName) {\n    const date = new Date().toISOString().split('T')[0]\n    const filename = `assets-${collectionName}-${date}.csv`\n    const blob = new Blob([content], { type: 'text/csv;charset=utf-8;' })\n    const link = document.createElement('a')\n    link.href = URL.createObjectURL(blob)\n    link.setAttribute('download', filename)\n    document.body.appendChild(link)\n    link.click()\n    document.body.removeChild(link)\n  }\n\n  function generateCsvFromAssets(assets) {\n    const headers = [\n      'Name',\n      'Description',\n      'IP',\n      'FQDN',\n      'MAC',\n      'Non-Computing',\n      'STIGs',\n      'Labels',\n      'Metadata',\n    ]\n\n    const escapeCsv = (value) => {\n      if (value == null) return ''\n      const str = String(value)\n      return /[\",\\n]/.test(str) ? `\"${str.replace(/\"/g, '\"\"')}\"` : str\n    }\n\n    const rows = assets.map(asset => {\n      const row = {\n        Name: asset.name,\n        Description: asset.description,\n        IP: asset.ip,\n        FQDN: asset.fqdn,\n        MAC: asset.mac,\n        'Non-Computing': asset.noncomputing ? 'True' : 'False',\n        STIGs: asset.stigs ? asset.stigs.map(stig => stig.benchmarkId).join('\\n') : '',\n        Labels: asset.labelNames ? asset.labelNames.join('\\n') : '',\n        Metadata: asset.metadata ? JSON.stringify(asset.metadata) : ''\n      }\n\n      return headers.map(h => escapeCsv(row[h])).join(',')\n    })\n\n    return [headers.join(','), ...rows].join('\\n')\n  }\n}\n\nSM.Manage.Asset.showParsedData = function (assets, errors, collectionId) {\n  try {\n\n    let parsedAssets = assets\n    let parserErrors = errors\n    let validAssets = []\n    let newLabels = []\n\n    const assetStore = new Ext.data.JsonStore({\n      fields: [\n          { name: 'CSVRow', type: 'integer' },\n          { name: 'name', type: 'string' },\n          { name: 'description', type: 'string' },\n          { name: 'noncomputing', type: 'boolean' },\n          { name: 'ip', type: 'string' },\n          { name: 'fqdn', type: 'string' },\n          { name: 'mac', type: 'string' },\n          { name: 'stigs', type: 'auto' },\n          { name: 'metadata', type: 'auto' },\n          { name: 'labelNames', type: 'auto' }\n      ],\n      data: [],\n      sortInfo: {\n        field: 'CSVRow',\n        direction: 'ASC' \n      }\n    })\n\n    const errorStore = new Ext.data.JsonStore({\n      fields: ['row', 'messages'],\n      data: [],\n      sortInfo: {\n        field: 'row',\n        direction: 'ASC' \n      }\n    })\n\n    const labelStore = new Ext.data.JsonStore({\n      fields: ['labelName'],\n      data: [],\n      sortInfo: {\n        field: 'labelName',\n        direction: 'ASC' \n      }\n    })\n\n    const labelTotalTextCmp = new SM.RowCountTextItem({\n      store: labelStore,\n      noun: 'label',\n      iconCls: 'sm-label-icon'\n   \n    })\n\n    const labelGrid = new Ext.grid.GridPanel({\n      title: '<span style=\"padding-left: 20px; background-size: 15px;\"class=\"sm-label-icon\">New Labels To Be Created</span>',\n      store: labelStore,\n      viewConfig: {\n        forceFit: true\n      },\n      autoScroll: true,\n      columns: [\n        { header: 'Label Name', dataIndex: 'labelName'},\n      ],\n      flex: 1,\n      bbar: [\n        '->',\n        labelTotalTextCmp\n      ]\n    })\n\n    const assetTotalTextCmp = new SM.RowCountTextItem({\n      store: assetStore,\n      noun: 'asset',\n      iconCls: 'sm-asset-icon'\n\n    })\n\n    const assetGrid = new Ext.grid.GridPanel({\n\n        title: '<span style=\"padding-left: 20px; background-size: 15px;\"class=\"sm-asset-icon\">New Assets To Be Created</span>',\n        store: assetStore,\n        flex: 2,\n        viewConfig: {\n          forceFit: true\n        },\n        autoScroll: true,\n        columns: [\n            { header: 'Row', dataIndex: 'CSVRow', width: 50 },\n            { header: 'Asset Name', dataIndex: 'name', width: 120 },\n            { header: 'Description', dataIndex: 'description', width: 150  },\n            { header: 'Noncomputing', dataIndex: 'noncomputing', width: 100, renderer: function (value) { return value ? 'True' : 'False' } },\n            { header: 'IP', dataIndex: 'ip', width: 100 },\n            { header: 'FQDN', dataIndex: 'fqdn', width: 100 },\n            { header: 'MAC', dataIndex: 'mac', width: 100},\n            { \n              header: 'Metadata', \n              dataIndex: 'metadata', \n              width: 150, \n              renderer: function (value) {\n                if (!value || (typeof value === 'object' && Object.keys(value).length === 0)) {\n                  return ''\n                }\n                return JSON.stringify(value)\n              } \n            },\n            {\n                header: 'Labels',\n                dataIndex: 'labelNames',\n                width: 125,\n                renderer: function (value) {\n                    return Array.isArray(value) && value.length ? `<div style=\"white-space: pre-wrap;\">${value.join('\\n')}</div>` : ''\n                }\n            },\n            {\n              header: 'STIGs',\n              dataIndex: 'stigs',\n              width: 200,\n              renderer: function (value) {\n                return Array.isArray(value) ? `<div style=\"white-space: pre-wrap;\">${value.join('\\n')}</div>` : ''\n              }\n            }\n        ],\n        bbar: [\n          '->',\n          assetTotalTextCmp\n        ]\n    })\n\n    const statusBox = new Ext.Panel({\n      id: 'statusBox',\n      height: 30,\n      border: false,\n      bodyStyle: 'padding: 5px; font-weight: bold; font-size: 13px;',\n      html: '<span style=\"color:#444;\">🛈 Parsing Data ....</span>'\n    })\n\n    function errorRenderer(value) {\n      return `<div style=\"white-space: pre-wrap; line-height: 1.5em;\">${value}</div>`\n    }\n\n    const errorTotalTextCmp = new SM.RowCountTextItem({\n      store: errorStore,\n      noun: 'error',\n      iconCls: 'sm-error-icon'\n\n    })\n\n    const errorGrid = new Ext.grid.GridPanel({\n      title: '<span>❌&nbsp;  File Errors</span>',\n      store: errorStore,\n      hidden: false,\n      margins: { top: 0, right: 10, bottom: 0, left: 0 },\n      flex: 2,\n      viewConfig: {\n        forceFit: true\n      },\n      autoScroll: true,\n      columns: [\n        { header: 'Row', dataIndex: 'row', width: 100 },\n        { header: 'Errors', dataIndex: 'messages', renderer: errorRenderer, width: 800 }\n      ],\n      bbar: [\n      '->',\n        errorTotalTextCmp\n      ]\n    })\n    \n    const finalSubmitButton = new Ext.Button({\n      text: 'Submit',\n      disabled: true,\n      handler: function () {\n        SM.Manage.Asset.submitFinalBatch(validAssets, newLabels, collectionId, appwindow)\n      }\n    })\n\n    const groupedErrors = Object.entries(parserErrors).map(([row, messages]) => {\n      return {\n        row: parseInt(row, 10),\n        messages: messages.map(m => `${m}`).join('\\n') // proper newline format\n      }\n    })\n\n    const doValidation = async function() { \n\n      const updateButtonStates = () => {\n        const hasAssets = validAssets.length > 0\n        const hasErrors = errorStore.getCount() > 0\n      \n        finalSubmitButton.setDisabled(!hasAssets)\n      \n        if (hasAssets && !hasErrors) {\n          SM.Manage.Asset.updateStatus('valid', 'All rows valid. Ready to submit.')\n        } else if (hasAssets && hasErrors) {\n          SM.Manage.Asset.updateStatus('mixed', 'Some rows have errors. Valid assets are ready to submit.')\n        } else if (!hasAssets && hasErrors) {\n          SM.Manage.Asset.updateStatus('invalid', 'No valid rows available. Please fix all errors.')\n        } else {\n          SM.Manage.Asset.updateStatus('none', 'No assets to submit.')\n        }\n      }\n\n      Ext.getBody().mask('Loading... ')\n      assetStore.loadData(validAssets)\n      errorStore.loadData(groupedErrors)\n      labelStore.loadData([])\n      updateButtonStates()\n\n      // remove csvrow for api call\n      let parsedAssetsCopy = parsedAssets.map(asset => {\n        const { CSVRow, ...rest } = asset\n        return { ...rest }\n      })\n      \n      try {\n        // dry run \n        if(parsedAssetsCopy.length) {\n\n          const dryRunResponse = await Ext.Ajax.requestPromise({\n            responseType: 'json',\n            url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/assets/?dryRun=true`,\n            method: 'POST',\n            headers: { 'Content-Type': 'application/json' },\n            jsonData: parsedAssetsCopy\n          })\n      \n          Ext.getBody().unmask()\n    \n          // dry run success\n          if (dryRunResponse === \"\" || Object.keys(dryRunResponse).length === 0) {\n            // update state \n            validAssets = parsedAssets\n            assetStore.loadData(validAssets)\n            errorStore.loadData(groupedErrors)\n            labelStore.loadData([])\n            updateButtonStates()\n            return\n          }\n          // dry run fail\n          if (dryRunResponse.error) {\n            \n            // gather errors from the response\n            let newErrors = dryRunResponse.detail\n              // remove label errors\n              .filter(err => {\n                const isLabelError = err.detail && err.detail.labelName\n                return !isLabelError\n              })\n              .map(err => {\n                // extract error specifics\n                const errorSpecifics = []\n                if (err.detail.name) errorSpecifics.push(`• Asset Affected: ${err.detail.name}`)\n                if (err.detail.benchmarkId) errorSpecifics.push(`• STIG Unknown: ${err.detail.benchmarkId}`)\n                if (err.detail.benchmarkIdIndex != null) errorSpecifics.push(`• STIG Unknown Index: ${err.detail.benchmarkIdIndex}`)\n\n                // determine the CSV row number \n                let csvRow = 0\n                if (err.detail.name) {\n                  // find the asset by name in the parsedAssets array which was returned from parsing\n                  const matchedAsset = parsedAssets.find(asset => asset.name === err.detail.name)\n                  if (matchedAsset) {\n                    csvRow = matchedAsset.CSVRow || \"n/a\"\n                  }\n                }\n                const msg = `Data error: ${err.failure}${errorSpecifics.length ? '\\n' + errorSpecifics.join('\\n ') : ''}`\n                return {\n                  row: csvRow,\n                  messages: msg\n                }\n              })\n            \n            // append new errors to the existing error store\n            const existingErrors = errorStore.getRange().map(rec => rec.data)\n            const allErrors = existingErrors.concat(newErrors)\n            errorStore.loadData(allErrors)\n          \n            // Remove assets in assets grid associated with these errored rows\n            const erroredRows = new Set(allErrors.map(e => e.row ))\n            validAssets = parsedAssets.filter(asset => !erroredRows.has(asset.CSVRow))\n            assetStore.loadData(validAssets)\n            updateButtonStates()\n  \n            // get unknown labels\n            let unknownLabels = [...new Set(dryRunResponse.detail.map(e => e.detail.labelName).filter(Boolean))]\n            newLabels = unknownLabels.map(label => ({ labelName: label }))\n            labelStore.loadData(newLabels)\n          }\n        }\n      }\n      catch (error) {\n        SM.Error.handleError(error)\n      }\n      finally {\n        Ext.getBody().unmask()\n      }\n    } \n\n    const vpSize = Ext.getBody().getViewSize()\n    let height = vpSize.height * 0.9\n    let width = vpSize.width * 0.9 <= 1700 ? vpSize.width * 0.9 : 1700\n\n    const appwindow = new Ext.Window({\n        id: 'parsedDataWindow',\n        cls: 'sm-dialog-window sm-round-panel',\n        title: 'Import Assets From CSV',\n        modal: true,\n        width,\n        height,\n        layout: 'vbox',\n        plain: true,\n        layoutConfig: {\n          padding: '0 20 0 20',\n          align: 'stretch',\n        },\n        buttonAlign: 'right',\n        items: \n        [\n          statusBox,\n          assetGrid,\n          {\n            xtype: 'container',\n            flex: 1,\n            margins: { top: 12, right: 0, bottom: 6, left: 0 },\n            layout: 'hbox',\n            layoutConfig: {\n              align: 'stretch'\n            },    \n            items: [\n              errorGrid,\n              labelGrid,\n            ]\n          }\n        ],\n        buttons: [\n          finalSubmitButton,\n          {\n              text: 'Cancel',\n              handler: function () {\n                  appwindow.close()\n              }\n          }\n        ]\n    })\n    appwindow.show(Ext.getBody())\n    doValidation()\n  } \n  catch (e) {\n      SM.Error.handleError(e)\n  }\n\n}\n\nSM.Manage.Asset.updateStatus = function (type, message) {\n  const statusCmp = Ext.getCmp('statusBox')\n  if (!statusCmp) return\n\n  const styles = {\n    valid: 'background-color: #2e7d32; color: #fff;',      // green\n    invalid: 'background-color: #c62828; color: #fff;',    // red\n    mixed: 'background-color: #f9a825; color: #000;',      // yellowish\n    none: 'background-color: #757575; color: #fff;',       // gray\n  }\n\n  const icons = {\n    valid: '✅',\n    invalid: '❌',\n    mixed: '⚠️',\n    none: '🛈',\n  }\n\n  const html = `<span class=\"sm-status-csv\" style=\"${styles[type] || ''}\">\n    ${icons[type] || ''} ${message}\n  </span>`\n\n  statusCmp.update(html)\n}\n\nSM.Manage.Asset.submitFinalBatch = async function (validAssets, newLabels, collectionId, appwindow){\n\n  async function createLabels(labels) {\n    try {\n      const payload = labels.map(label => ({\n        name: label.labelName,\n        description: '',\n        color: '4568F2',\n      }))\n  \n      await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/labels/batch`,\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        jsonData: payload\n      })\n    } catch (e) {\n      SM.Error.handleError(e)\n    }\n  }\n\n  try {\n    Ext.getBody().mask('')\n\n    let parsedAssetsCopy = validAssets.map(asset => {\n      const { CSVRow, ...rest } = asset\n      return { ...rest }\n    })\n\n    if(newLabels.length) {\n      await createLabels(newLabels)\n    }\n    \n    SM.Cache.updateCollectionLabels(collectionId)\n\n    const responses = await Ext.Ajax.requestPromise({\n      responseType: 'json',\n      url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/assets`,\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      jsonData: parsedAssetsCopy\n    })\n\n  \n    SM.Dispatcher.fireEvent('assetcreated', {collection:{collectionId}})\n\n    appwindow.close()\n  }\n  catch (e) {\n    SM.Error.handleError(e)\n  }\n  finally {\n    Ext.getBody().unmask()\n  }\n}\n\nSM.Manage.Asset.LabelField = Ext.extend(Ext.form.Field, {\n  defaultAutoCreate: { tag: \"div\" },\n  initComponent: function () {\n    const _this = this\n    this.labelIds = this.labelIds || []\n    this.labelNames = this.labelNames || []\n    const cachedCollection = SM.Cache.CollectionMap.get(this.collectionId)\n    this.labelsMenu = new SM.Manage.Collection.LabelsMenu({\n      // menuTitle: 'Manage labels',\n      labels: cachedCollection.labels,\n      listeners: {\n        itemcheckchanged: function (item, checked) {\n          const cachedCollection = SM.Cache.CollectionMap.get(_this.collectionId)\n          _this.labelIds = item.parentMenu.getCheckedLabelIds()\n          const assetLabels = cachedCollection.labels.filter(label => _this.labelIds.includes(label.labelId))\n          _this.labelNames = cachedCollection.labels\n            .filter(label => _this.labelIds.includes(label.labelId)).map(label => label.name)\n          _this.previewfield.update(assetLabels)\n          \n\n        },\n        applied: function (labelIds) {\n          const cachedCollection = SM.Cache.CollectionMap.get(_this.collectionId)\n          const assetLabels = cachedCollection.labels.filter(label => labelIds.includes(label.labelId))\n          _this.previewfield.update(assetLabels)\n          _this.labelIds = labelIds\n          _this.labelNames = cachedCollection.labels\n              .filter(label => labelIds.includes(label.labelId))\n              .map(label => label.name)\n      }\n      }\n    })\n    this.menuBtn = new Ext.Button({\n      menu: this.labelsMenu\n    })\n    this.previewfield = new Ext.form.DisplayField({\n      tpl: SM.Manage.Collection.LabelArrayTpl,\n      data: [],\n    })\n    const config = {\n      name: 'labelIds'\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  },\n  setValue: function (labelIds) {\n    this.labelIds = labelIds\n    this.labelsMenu.setLabelsChecked(labelIds, true)\n\n    const cachedCollection = SM.Cache.CollectionMap.get(this.collectionId)\n    const assetLabels = cachedCollection.labels.filter(function (label) {\n      return labelIds.includes(label.labelId)\n    })\n    this.labelNames = assetLabels.map(label => label.name)\n    this.previewfield.update(assetLabels)\n  },\n  getValue: function () {\n    return this.labelNames\n  },\n  onRender: function (ct, position) {\n    SM.Manage.Asset.LabelField.superclass.onRender.call(this, ct, position);\n    const _this = this\n\n    this.panel = new Ext.Panel({\n      renderTo: this.el,\n      // height: 50,\n      // width: this.width,\n      border: false,\n      layout: 'hbox',\n      layoutConfig: {\n        align: 'middle'\n      },\n      bodyStyle: 'background-color: transparent;',\n      items: [\n        this.menuBtn,\n        this.previewfield\n      ]\n    })\n  }\n})\n\nSM.Manage.Asset.StigSelectingGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      {\n        name: 'benchmarkId',\n        type: 'string'\n      },\n      {\n        name: 'ruleCount',\n        type: 'integer'\n      }\n]\n    const sm = new Ext.grid.CheckboxSelectionModel({\n      singleSelect: false,\n      checkOnly: false,\n      listeners: {\n        selectionchange: function (sm) {\n          SM.SetCheckboxSelModelHeaderState(sm)\n        }\n      }\n    })\n    const columns = [\n      sm,\n      {\n        header: \"BenchmarkId\",\n        width: 375,\n        dataIndex: 'benchmarkId',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"Rules\",\n        width: 125,\n        dataIndex: 'ruleCount',\n        align: 'center',\n        sortable: true\n      }\n\n    ]\n    const store = new Ext.data.JsonStore({\n      fields,\n      idProperty: 'benchmarkId',\n      sortInfo: {\n        field: 'benchmarkId',\n        direction: 'ASC'\n      },\n    })\n    const totalTextCmp = new SM.RowCountTextItem({\n      store,\n      noun: 'STIG',\n      iconCls: 'sm-stig-icon'\n    })\n\n    const config = {\n      store,\n      columns,\n      sm,\n      enableDragDrop: true,\n      ddText: '{0} selected STIG{1}',\n      bodyCssClass: 'sm-grid3-draggable',\n      ddGroup: `SM.Manage.Asset.StigSelectingGrid-${this.role}`,\n      border: true,\n      loadMask: false,\n      stripeRows: true,\n      view: new SM.ColumnFilters.GridView({\n        forceFit: true,\n        emptyText: 'No STIGs to display',\n        listeners: {\n          filterschanged: function (view, item, value) {\n            store.filter(view.getFilterFns())\n          }\n        }\n      }),\n      bbar: new Ext.Toolbar({\n        items: [\n          {\n            xtype: 'exportbutton',\n            grid: this,\n            hasMenu: false,\n            gridBasename: 'STIGs (grid)',\n            storeBasename: 'STIGs (store)',\n            iconCls: 'sm-export-icon',\n            text: 'CSV'\n          },\n          {\n            xtype: 'tbfill'\n          },\n          {\n            xtype: 'tbseparator'\n          },\n          totalTextCmp\n        ]\n      })\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.Manage.Asset.StigSelectingPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    function setupDragZone(grid) {\n      const gridDragZone = grid.getView().dragZone\n      const originalGetDragData = gridDragZone.getDragData\n      gridDragZone.getDragData = function (e) {\n        const t = Ext.lib.Event.getTarget(e)\n        if (t.className === 'x-grid3-row-checker') {\n          return false\n        }\n        return originalGetDragData.call(gridDragZone, e)\n      }\n\n      const originalStartDrag = gridDragZone.startDrag\n      gridDragZone.startDrag = function (x, y) {\n        Ext.getBody().addClass('sm-grabbing')\n        return originalStartDrag.call(gridDragZone, x, y)\n      }\n\n      const originalOnDragDrop = gridDragZone.onDragDrop\n      gridDragZone.onDragDrop = function (e, id) {\n        Ext.getBody().removeClass('sm-grabbing')\n        return originalOnDragDrop.call(gridDragZone, e, id)\n      }\n\n      const originalOnInvalidDrop = gridDragZone.onInvalidDrop\n      gridDragZone.onInvalidDrop = function (e, id) {\n        Ext.getBody().removeClass('sm-grabbing')\n        return originalOnInvalidDrop.call(gridDragZone, e)\n      }\n\n    }\n    const availableGrid = new SM.Manage.Asset.StigSelectingGrid({\n      title: 'Available STIGs',\n      iconCls: 'sm-stig-icon',\n      headerCssClass: 'sm-available-panel-header',\n      role: 'available',\n      flex: 1,\n      listeners: {\n        render: function (grid) {\n          setupDragZone(grid)\n          const gridDropTargetEl = grid.getView().scroller.dom;\n          const gridDropTarget = new Ext.dd.DropTarget(gridDropTargetEl, {\n            ddGroup: selectionsGrid.ddGroup,\n            notifyDrop: function (ddSource, e, data) {\n              const selectedRecords = ddSource.dragData.selections;\n              changeSelected(selectionsGrid, selectedRecords, availableGrid)\n              return true\n            }\n          })\n        },\n\n      }\n    })\n    const selectionsGrid = new SM.Manage.Asset.StigSelectingGrid({\n      title: 'Assigned STIGs',\n      iconCls: 'sm-stig-icon',\n      headerCssClass: 'sm-selections-panel-header',\n      role: 'selections',\n      flex: 1,\n      listeners: {\n        render: function (grid) {\n          setupDragZone(grid)\n          const gridDropTargetEl = grid.getView().scroller.dom;\n          const gridDropTarget = new Ext.dd.DropTarget(gridDropTargetEl, {\n            ddGroup: availableGrid.ddGroup,\n            notifyDrop: function (ddSource, e, data) {\n              const selectedRecords = ddSource.dragData.selections;\n              changeSelected(availableGrid, selectedRecords, selectionsGrid)\n              return true\n            }\n          })\n        }\n      }\n    })\n    availableGrid.getSelectionModel().on('selectionchange', handleSelections, selectionsGrid)\n    selectionsGrid.getSelectionModel().on('selectionchange', handleSelections, availableGrid)\n\n    const addBtn = new Ext.Button({\n      iconCls: 'sm-add-assignment-icon',\n      margins: \"0 10 10 10\",\n      disabled: true,\n      handler: function (btn) {\n        const selectedRecords = availableGrid.getSelectionModel().getSelections()\n        changeSelected(availableGrid, selectedRecords, selectionsGrid)\n        btn.disable()\n      }\n    })\n    const removeBtn = new Ext.Button({\n      iconCls: 'sm-remove-assignment-icon',\n      margins: \"0 10 10 10\",\n      disabled: true,\n      handler: function (btn) {\n        const selectedRecords = selectionsGrid.getSelectionModel().getSelections()\n        changeSelected(selectionsGrid, selectedRecords, availableGrid)\n        btn.disable()\n      }\n    })\n    const buttonPanel = new Ext.Panel({\n      bodyStyle: 'background-color:transparent;border:none',\n      width: 60,\n      layout: {\n        type: 'vbox',\n        pack: 'center',\n        align: 'center',\n        padding: \"10 10 10 10\"\n      },\n      items: [\n        addBtn,\n        removeBtn,\n        { xtype: 'panel', border: false, html: '<i>or drag</i>' }\n      ]\n    })\n\n    function handleSelections() {\n      const sm = this.selModel\n      if (sm.hasSelection()) {\n        sm.suspendEvents()\n        sm.clearSelections()\n        sm.resumeEvents()\n        SM.SetCheckboxSelModelHeaderState(sm)\n      }\n      const availableSelected = availableGrid.selModel.hasSelection()\n      const selectionsSelected = selectionsGrid.selModel.hasSelection()\n      addBtn.setDisabled(!availableSelected)\n      removeBtn.setDisabled(!selectionsSelected)\n    }\n\n    async function initPanel(apiAsset) {\n      const apiAvailableStigs = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/stigs`,\n        method: 'GET'\n      })\n\n      const assignedStigs = apiAsset?.stigs?.map(stig => stig.benchmarkId) ?? []\n      _this.originalStigs = assignedStigs\n      const available = []\n      const assigned = []\n      apiAvailableStigs.reduce((accumulator, stig) => {\n        const property = assignedStigs.includes(stig.benchmarkId) ? 'assigned' : 'available'\n        accumulator[property].push(stig)\n        return accumulator\n      }, { available, assigned })\n\n      availableGrid.store.loadData(available)\n      selectionsGrid.store.loadData(assigned)\n    }\n\n    function fireSelectedChanged () {\n      _this.fireEvent('selectedchanged', selectionsGrid.store.getRange().map( r => r.data.userId ))\n    }\n\n    function changeSelected(srcGrid, records, dstGrid) {\n      srcGrid.store.suspendEvents()\n      dstGrid.store.suspendEvents()\n      srcGrid.store.remove(records)\n      dstGrid.store.add(records)\n      const { field, direction } = dstGrid.store.getSortState()\n      dstGrid.store.sort(field, direction)\n      dstGrid.getSelectionModel().selectRecords(records)\n      srcGrid.store.resumeEvents()\n      dstGrid.store.resumeEvents()\n\n      srcGrid.store.fireEvent('datachanged', srcGrid.store)\n      dstGrid.store.fireEvent('datachanged', dstGrid.store)\n      srcGrid.store.fireEvent('update', srcGrid.store)\n      dstGrid.store.fireEvent('update', dstGrid.store)\n      dstGrid.store.filter(dstGrid.getView().getFilterFns())\n      dstGrid.getView().focusRow(dstGrid.store.indexOfId(records[0].data.assetId))\n\n      fireSelectedChanged ()\n    }\n\n    function getValue() {\n      const records = selectionsGrid.store.snapshot?.items ?? selectionsGrid.store.getRange()\n      return records.map(record => record.data.benchmarkId)\n    }\n\n    const config = {\n      layout: 'hbox',\n      layoutConfig: {\n        align: 'stretch'\n      },\n      name: 'stigs',\n      border: false,\n      items: [\n        availableGrid,\n        buttonPanel,\n        selectionsGrid\n      ],\n      availableGrid,\n      selectionsGrid,\n      initPanel,\n      getValue,\n      // need fns below so Ext handles us like a form field\n      setValue: () => { },\n      markInvalid: function () { },\n      clearInvalid: function () { },\n      isValid: () => true,\n      getName: () => this.name,\n      validate: () => true\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Manage.Asset.PropertiesFormPanel = Ext.extend(Ext.form.FormPanel, {\n  initComponent: function () {\n    this.stigSelectingPanel = new SM.Manage.Asset.StigSelectingPanel({\n      name: 'stigs',\n      isFormField: true,\n      submitValue: true\n    })\n    if (!this.initialCollectionId) {\n      throw (new Error('missing property initialCollectionId'))\n    }\n    let assetLabelField\n    if (SM.Cache.CollectionMap.get(this.initialCollectionId).labels.length) {\n      assetLabelField = new SM.Manage.Asset.LabelField({\n        collectionId: this.initialCollectionId,\n        fieldLabel: 'Labels'\n      })\n    }\n    else {\n      assetLabelField = {\n        xtype: 'displayfield',\n        fieldLabel: 'Labels',\n        value: '<i>Asset labels are not defined for this Collection</i>'\n      }\n    }\n    const config = {\n      baseCls: 'x-plain',\n      region: 'south',\n      labelWidth: 70,\n      monitorValid: true,\n      trackResetOnLoad: true,\n      items: [\n        {\n          xtype: 'fieldset',\n          title: '<b>Asset information</b>',\n          items: [\n            {\n              layout: 'column',\n              baseCls: 'x-plain',\n              border: false,\n              items: [\n                {\n                  columnWidth: .4,\n                  layout: 'form',\n                  padding: '0px 10px 0px 0px',\n                  border: false,\n                  items: [\n                    {\n                      xtype: 'textfield',\n                      fieldLabel: 'Name',\n                      anchor: '100%',\n                      emptyText: 'Enter asset name...',\n                      allowBlank: false,\n                      name: 'name'\n                    }\n                  ]\n                },\n                {\n                  columnWidth: .6,\n                  layout: 'form',\n                  border: false,\n                  items: [\n                    {\n                      xtype: 'textfield',\n                      fieldLabel: 'Description',\n                      anchor: '100%',\n                      emptyText: 'Enter asset description...',\n                      allowBlank: true,\n                      name: 'description'\n                    }\n                  ]\n                }\n              ]\n            },\n            {\n              xtype: 'checkbox',\n              name: 'noncomputing',\n              hideLabel: false,\n              checked: false,\n              boxLabel: 'Non-computing'\n            },\n            {\n              layout: 'column',\n              baseCls: 'x-plain',\n              border: false,\n              items: [\n                {\n                  columnWidth: .5,\n                  layout: 'form',\n                  padding: '0px 10px 0px 0px',\n                  border: false,\n                  items: [\n                    {\n                      xtype: 'textfield',\n                      anchor: '100%',\n                      fieldLabel: 'FQDN',\n                      emptyText: 'Enter FQDN',\n                      allowBlank: true,\n                      name: 'fqdn'\n                    }\n                  ]\n                },\n                {\n                  columnWidth: .25,\n                  layout: 'form',\n                  border: false,\n                  padding: '0px 10px 0px 0px',\n                  labelWidth: 20,\n                  items: [\n                    {\n                      xtype: 'textfield',\n                      fieldLabel: 'IP',\n                      anchor: '100%',\n                      emptyText: 'Enter IP',\n                      allowBlank: true,\n                      name: 'ip'\n                    }\n                  ]\n                },\n                {\n                  columnWidth: .25,\n                  layout: 'form',\n                  border: false,\n                  // padding: '0px 10px 0px 0px',\n                  labelWidth: 30,\n                  items: [\n                    {\n                      xtype: 'textfield',\n                      fieldLabel: 'MAC',\n                      anchor: '100%',\n                      emptyText: 'Enter MAC',\n                      allowBlank: true,\n                      name: 'mac'\n                    }\n                  ]\n                },\n              ]\n            },\n            assetLabelField,\n            new SM.Manage.Collection.MetadataGrid({\n              submitValue: true,\n              fieldLabel: 'Metadata',\n              name: 'metadata',\n              anchor: '100%'\n            }),\n            {\n              xtype: 'hidden',\n              name: 'collectionId',\n              value: this.initialCollectionId\n            }\n          ]\n        },\n        {\n          xtype: 'fieldset',\n          title: '<b>STIG Assignments</b>',\n          anchor: \"100% -290\",\n          layout: 'fit',\n          items: [\n            this.stigSelectingPanel\n          ]\n        }\n\n      ],\n      buttons: [{\n        text: this.btnText || 'Save',\n        formBind: true,\n        handler: this.btnHandler || Ext.emptyFn\n      }]\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n\n    this.getForm().getFieldValues = function (dirtyOnly, getDisabled) {\n      // Override to support submitValue boolean\n      var o = {},\n        n,\n        key,\n        val;\n      this.items.each(function (f) {\n        // Added condition for f.submitValue\n        if (f.submitValue && (!f.disabled || getDisabled) && (dirtyOnly !== true || f.isDirty())) {\n          n = f.getName();\n          key = o[n];\n          val = f.getValue();\n\n          if (Ext.isDefined(key)) {\n            if (Ext.isArray(key)) {\n              o[n].push(val);\n            } else {\n              o[n] = [key, val];\n            }\n          } else {\n            o[n] = val;\n          }\n        }\n      });\n      return o;\n    }\n  }\n})\n\nSM.Manage.Stig.showStigProps = async function (benchmarkId, defaultRevisionStr, parentGrid) {\n  let appwindow\n  try {\n      const collectionId = parentGrid.collectionId\n      const stigPropsFormPanel = new SM.Manage.Stig.PropertiesFormPanel({\n          collectionId,\n          benchmarkId,\n          defaultRevisionStr,\n          stigFilteringStore: parentGrid.store,\n          btnHandler: async function( btn ){\n              try {\n                  stigPropsFormPanel.el.mask('Updating')\n                  const values = stigPropsFormPanel.getForm().getFieldValues(false, true) // dirtyOnly=false, getDisabled=true\n                  const jsonData = {}\n                  if (values.defaultRevisionStr) {\n                      jsonData.defaultRevisionStr = values.defaultRevisionStr\n                  }\n                  if (values.assets) {\n                      jsonData.assetIds = values.assets\n                  }\n                  let result = await Ext.Ajax.requestPromise({\n                      url: `${STIGMAN.Env.apiBase}/collections/${btn.collectionId}/stigs/${values.benchmarkId}`,\n                      method: 'POST',\n                      headers: { 'Content-Type': 'application/json;charset=utf-8' },\n                      jsonData\n                  })\n                  const apiStigAssets = JSON.parse(result.response.responseText)\n                  SM.Dispatcher.fireEvent('stigassetschanged', btn.collectionId, values.benchmarkId, apiStigAssets)\n                  appwindow.close()\n              }\n              catch (e) {\n                  SM.Error.handleError(e)\n              }\n              finally {\n                  stigPropsFormPanel.el.unmask()\n              }\n          }\n      })\n\n      /******************************************************/\n      // Form window\n      /******************************************************/\n      const height = Ext.getBody().getHeight() - 80\n      const width = Math.min(Math.floor(Ext.getBody().getWidth() * 0.75), 1280)\n      appwindow = new Ext.Window({\n          title: 'STIG Assignments',\n          resizable: true,\n          cls: 'sm-dialog-window sm-round-panel',\n          modal: true,\n          hidden: true,\n          width,\n          height,\n          minWidth: 810,\n          minHeight: 460,\n          maximizable: true,\n          layout: 'fit',\n          plain:true,\n          bodyStyle:'padding:10px;',\n          buttonAlign:'right',\n          items: stigPropsFormPanel\n      });\n      \n      appwindow.show(Ext.getBody())\n\n      await stigPropsFormPanel.initPanel({\n          benchmarkId,\n          collectionId\n      })\n  }\n  catch (e) {\n      SM.Error.handleError(e)\n      if (appwindow) {\n          appwindow.close()\n      }\n  }\t\n}\n\nSM.Manage.Stig.SelectionComboBox = Ext.extend(Ext.form.ComboBox, {\n  initComponent: function () {\n    const _this = this\n    const stigStore = new Ext.data.JsonStore({\n      fields: [\n        {\n          name: 'benchmarkId',\n          type: 'string'\n        }, {\n          name: 'title',\n          type: 'string'\n        }, {\n          name: 'lastRevisionStr',\n          type: 'string'\n        }, {\n          name: 'lastRevisionDate',\n          type: 'string'\n        }, {\n          name: 'ruleCount',\n          type: 'integer'\n        },\n        'revisionStrs',\n        'revisions'\n      ],\n      autoLoad: this.autoLoad,\n      url: this.url || `${STIGMAN.Env.apiBase}/stigs?projection=revisions`,\n      root: this.root || '',\n      sortInfo: {\n        field: 'benchmarkId',\n        direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      },\n      idProperty: 'benchmarkId',\n      listeners: {\n        load: (store) => {\n          if (_this.includeAllItem) {\n            store.suspendEvents()\n            let allRecord = {\n              benchmarkId: _this.includeAllItem\n            }\n            store.loadData(_this.root ? { [_this.root]: allRecord } : allRecord, true)\n            store.sort('benchmarkId', 'ASC')\n            store.resumeEvents()\n          }\n        }\n      }\n    })\n    const tpl = new Ext.XTemplate(\n      '<tpl for=\".\">',\n      '<div class=\"x-combo-list-item\">{[this.highlightQuery(values.benchmarkId)]}</div>',\n      '</tpl>',\n      {\n        highlightQuery: function (text) {\n          if (_this.el.dom.value) {\n            const re = new RegExp(_this.el.dom.value, 'gi')\n            return text.replace(re, '<span class=\"sm-text-highlight\">$&</span>')\n          }\n          return text\n        }\n      }\n    )\n    const config = {\n      store: stigStore,\n      tpl,\n      filteringStore: this.filteringStore || null,\n      displayField: 'benchmarkId',\n      valueField: 'benchmarkId',\n      mode: 'local',\n      forceSelection: true,\n      typeAhead: false,\n      minChars: 0,\n      triggerAction: 'all',\n      listeners: {\n        afterrender: (combo) => {\n          combo.getEl().dom.setAttribute('spellcheck', 'false')\n        },\n        ...this.listeners\n      },\n      doQuery: (q, forceAll) => {\n        // Custom re-implementation of the original ExtJS method\n        q = Ext.isEmpty(q) ? '' : q;\n        if (forceAll === true || (q.length >= this.minChars)) {\n          // Removed test against this.lastQuery\n          this.selectedIndex = -1\n          let filters = []\n          if (this.filteringStore) {\n            // Exclude records from the combo store that are in the filteringStore\n            filters.push(\n              {\n                fn: (record) => record.id === this.initialBenchmarkId || this.filteringStore.indexOfId(record.id) === -1,\n                scope: this\n              }\n            )\n          }\n          if (q) {\n            // Include records that partially match the combo value\n            filters.push(\n              {\n                property: this.displayField,\n                value: q,\n                anyMatch: true\n              }\n            )\n          }\n          this.store.filter(filters)\n          this.onLoad()\n        }\n      },\n      validator: (v) => {\n        // Don't keep the form from validating when I'm not active\n        if (_this.grid && _this.grid.editor && !_this.grid.editor.editing) {\n          return true\n        }\n        if (v === \"\") {\n          return \"Blank values not allowed\"\n        }\n        if (v !== _this.initialBenchmarkId && _this.store.indexOfId(v) === -1) {\n          return \"Value must be a benchmarkId\"\n        }\n        return true\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  },\n\n  // Re-implement validateBur() to always return false. The framework's implementation always returned true\n  // and selecting an item from the droplist would mimic a blur even when the <input> remained focused. This\n  // prevented the droplist from expanding when characters were typed following a droplist selection\n  validateBlur: function () { return false },\n\n  // Re-implement onTriggerClick() to select the value in the droplist\n  onTriggerClick: function () {\n    if (this.readOnly || this.disabled) {\n      return;\n    }\n    if (this.isExpanded()) {\n      this.collapse();\n      this.el.focus();\n    } else {\n      this.onFocus({});\n      if (this.triggerAction == 'all') {\n        this.doQuery(this.allQuery, true);\n        // added line below for this override\n        this.selectByValue(this.value, true);\n      } else {\n        this.doQuery(this.getRawValue());\n      }\n      this.el.focus();\n    }\n  }\n})\n\nSM.Manage.Stig.Grid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function() {\n      const _this = this\n      const fieldsConstructor = Ext.data.Record.create([\n          { name: 'benchmarkId', type: 'string' },\n          { name: 'revisionStr', type: 'string' },\n          { name: 'revisionPinned', type: 'boolean' },\n          { name: 'assets', type: 'integer' },\n          { name: 'ruleCount', type: 'integer'},\n          {\n              name: 'assessedPct',\n              convert: (v, r) => r.metrics.assessments ? r.metrics.assessed / r.metrics.assessments * 100 : 0\n          },\n          {\n              name: 'savedPct',\n              convert: (v, r) => r.metrics.assessments ? ((r.metrics.statuses.saved + r.metrics.statuses.submitted + r.metrics.statuses.accepted + r.metrics.statuses.rejected) / r.metrics.assessments) * 100 : 0\n          },\n          {\n              name: 'submittedPct',\n              convert: (v, r) => r.metrics.assessments ? ((r.metrics.statuses.submitted + r.metrics.statuses.accepted + r.metrics.statuses.rejected) / r.metrics.assessments) * 100 : 0\n          },\n          {\n              name: 'acceptedPct',\n              convert: (v, r) => r.metrics.assessments ? (r.metrics.statuses.accepted / r.metrics.assessments) * 100 : 0\n          },\n          {\n              name: 'rejectedPct',\n              convert: (v, r) => r.metrics.assessments ? (r.metrics.statuses.rejected / r.metrics.assessments) * 100 : 0\n          },\n          {\n              name: 'minTs',\n              type: 'date',\n              mapping: 'metrics.minTs'\n          },\n          {\n              name: 'maxTs',\n              type: 'date',\n              mapping: 'metrics.maxTs'\n          },\n          {\n              name: 'maxTouchTs',\n              type: 'date',\n              mapping: 'metrics.maxTouchTs'\n          }\n      ])\n      this.proxy = new Ext.data.HttpProxy({\n          restful: true,\n          url: this.url,\n          headers: { 'Content-Type': 'application/json;charset=utf-8' }\n      })\n      const store = new Ext.data.JsonStore({\n          grid: this,\n          smMaskDelay: 250,\n          proxy: this.proxy,\n          root: '',\n          fields: fieldsConstructor,\n          idProperty: 'benchmarkId',\n          sortInfo: {\n              field: 'benchmarkId',\n              direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n          }\n      })\n      this.totalTextCmp = new SM.RowCountTextItem ({\n          store: store,\n          noun: 'STIG',\n          iconCls: 'sm-stig-icon'\n      })\n      const sm = new Ext.grid.CheckboxSelectionModel({\n          singleSelect: false,\n          checkOnly: false,\n          listeners: {\n              selectionchange: function (sm) {\n                  modifyBtn.setDisabled(sm.getCount() !== 1)\n                  deleteBtn.setDisabled(sm.getCount() !== 1)\n                  exportBtn.setDisabled(!sm.hasSelection())\n                  SM.SetCheckboxSelModelHeaderState(sm)\n              }\n          }\n      })\n      const benchmarkColumnId = Ext.id()\n      const columns = [\n          sm,\n          { \t\n      header: \"BenchmarkId\",\n              id: benchmarkColumnId,\n      width: 300,\n              dataIndex: 'benchmarkId',\n      sortable: true,\n              filter: {type:'string'}\n    },\n          { \t\n      header: \"Revision\",\n      width: 70,\n              dataIndex: 'revisionStr',\n              // align: \"center\",\n              sortable: false,\n              renderer: function (v, md, r) {\n                  return `${r.data.revisionStr}${r.data.revisionPinned ? '<img src=\"img/pin.svg\" width=\"12\" height=\"12\" style=\"margin-left: 8px;\">' : ''}`\n              }\n    },\n          {\n              header: 'Rules',\n              width: 70,\n              dataIndex: 'ruleCount',\n              align: \"center\",\n              sortable: true\n          },\n          {\n              header: 'Assets',\n              width: 70,\n              dataIndex: 'assets',\n              align: \"center\",\n              sortable: true\n          },\n          {\n              header: 'Oldest',\n              width: 50,\n              dataIndex: 'minTs',\n              align: 'center',\n              sortable: true,\n              renderer: renderDurationToNow\n          },\n          {\n              header: 'Newest',\n              width: 50,\n              dataIndex: 'maxTs',\n              align: 'center',\n              sortable: true,\n              renderer: renderDurationToNow\n          },\n          { \t\n      header: \"Assessed\",\n      width: 100,\n      dataIndex: 'assessedPct',\n      align: \"center\",\n      sortable: true,\n              renderer: renderPct\n    },\n          { \t\n      header: \"Submitted\",\n      width: 100,\n      dataIndex: 'submittedPct',\n      align: \"center\",\n      sortable: true,\n              renderer: renderPct\n    },\n          { \t\n      header: \"Accepted\",\n      width: 100,\n      dataIndex: 'acceptedPct',\n      align: \"center\",\n      sortable: true,\n              renderer: renderPct\n    },\n          { \t\n      header: \"Rejected\",\n      width: 100,\n      dataIndex: 'rejectedPct',\n      align: \"center\",\n      sortable: true,\n              renderer: renderPctAllHigh\n    }\n      ]\n      const exportBtn = new Ext.Button({\n          iconCls: 'sm-export-icon',\n          text: 'Export results...',\n          disabled: true,\n          handler: function() {\n              SM.Exports.showExportTree( _this.collectionId, _this.collectionName, 'stig', _this.getSelectionModel().getSelections().map( r => r.data )  );            \n          }\n      })\n      const modifyBtn = new Ext.Button({\n          iconCls: 'sm-stig-icon',\n          disabled: true,\n          text: 'Modify...',\n          handler: function() {\n              const r = _this.getSelectionModel().getSelected().data\n              SM.Manage.Stig.showStigProps(r.benchmarkId, r.revisionPinned ? r.revisionStr : 'latest', _this);\n          }\n      })\n      const deleteBtn = new Ext.Button({\n          iconCls: 'icon-remove',\n          text: 'Unassign STIG...',\n          disabled: true,\n          handler: function() {\n              try {\n                  var confirmStr=\"Unassigning this STIG will remove all related Asset assignments. If the STIG is added in the future, the assignments will need to be established again.\";\n                  Ext.Msg.confirm(\"Confirm\", confirmStr, async function (btn,text) {\n                      if (btn == 'yes') {\n                          const stigRecord = _this.getSelectionModel().getSelected()\n                          await Ext.Ajax.requestPromise({\n                              url: `${STIGMAN.Env.apiBase}/collections/${_this.collectionId}/stigs/${stigRecord.data.benchmarkId}/assets`,\n                              method: 'PUT',\n                              jsonData: []\n                          })\n                          _this.store.remove(stigRecord)\n                          SM.Dispatcher.fireEvent('stigassetschanged', _this.collectionId, stigRecord.data.benchmarkId, [] )\n                      }\n                  })\n              }\n              catch (e) {\n                  SM.Error.handleError(e)\n              }\n          }\n      })\n      let config = {\n          layout: 'fit',\n          loadMask: {msg: ''},\n          store: store,\n          cm: new Ext.grid.ColumnModel ({\n              columns: columns   \n          }),\n          sm,\n          view: new SM.ColumnFilters.GridView({\n              emptyText: this.emptyText || 'No records to display',\n              deferEmptyText: false,\n              forceFit:true,\n              listeners: {\n                  filterschanged: function (view, item, value) {\n                      store.filter(view.getFilterFns())  \n                  }\n              }\t\t    \n          }),\n          listeners: {\n              rowdblclick: {\n                  fn: function(grid,rowIndex,e) {\n                      const r = grid.getStore().getAt(rowIndex).data\n                      SM.Manage.Stig.showStigProps(r.benchmarkId, r.revisionPinned ? r.revisionStr : 'latest', _this);\n                  }\n              },\n              keydown: SM.CtrlAGridHandler\n          },\n          tbar: new Ext.Toolbar({\n              items: [\n                  {\n                      iconCls: 'icon-add',\n                      text: 'Assign STIG...',\n                      grid: this,\n                      handler: function(btn) {\n                          SM.Manage.Stig.showStigProps( null, null, btn.grid );            \n                      }\n                  },\n                  '-',\n                  exportBtn,\n                  '-',\n                  deleteBtn,\n                  '-',\n                  modifyBtn                    \n              ]\n          }),\n          bbar: new Ext.Toolbar({\n              items: [\n                  {\n                      xtype: 'tbbutton',\n                      grid: this,\n                      iconCls: 'icon-refresh',\n                      tooltip: 'Reload this grid',\n                      width: 20,\n                      handler: function(btn){\n                          const savedSmMaskDelay = btn.grid.store.smMaskDelay\n                          btn.grid.store.smMaskDelay = 0\n                          btn.grid.store.reload();\n                          btn.grid.store.smMaskDelay = savedSmMaskDelay\n                      }\n                  },{\n                      xtype: 'tbseparator'\n                  },{\n                      xtype: 'exportbutton',\n                      hasMenu: false,\n                      gridBasename: 'STIGs (grid)',\n                      storeBasename: 'STIGs (store)',\n                      iconCls: 'sm-export-icon',\n                      text: 'CSV',\n                      grid: this      \n\n                  },{\n                      xtype: 'tbfill'\n                  },{\n                      xtype: 'tbseparator'\n                  },\n                  this.totalTextCmp\n              ]\n          })\n      }\n      Ext.apply(this, Ext.apply(this.initialConfig, config))\n      this.superclass().initComponent.call(this)\n  }   \n})\n\nSM.Manage.Stig.RevisionComboBox = Ext.extend(SM.Global.HelperComboBox, {\n  initComponent: function () {\n    this.store = new Ext.data.SimpleStore({\n      fields: ['value', 'display']\n    })\n\n    const data = []\n\n    const config = {\n      displayField: 'display',\n      valueField: 'value',\n      triggerAction: 'all',\n      mode: 'local',\n      editable: false,\n      helpText: SM.TipContent.DefaultRevision\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n\n    this.store.loadData(data)\n  }\n})\n\nSM.Manage.Stig.PropertiesFormPanel = Ext.extend(Ext.form.FormPanel, {\n  initComponent: function () {\n      const _this = this\n      if (! this.collectionId) {\n          throw ('missing property collectionId')\n      }\n      const assetSelectionPanel = new SM.AssetSelection.SelectingPanel({\n          name: 'assets',\n          collectionId: this.collectionId,\n          isFormField: true,\n          listeners: {\n              assetselectionschanged: setButtonState\n          }\n      })\n      const stigField = new SM.Manage.Stig.SelectionComboBox({\n          name: 'benchmarkId',\n          submitValue: false,\n          fieldLabel: 'BenchmarkId',\n          hideTrigger: false,\n          width: 350,\n          autoLoad: false,\n          allowBlank: false,\n          filteringStore: this.stigFilteringStore,\n          initialBenchmarkId: this.benchmarkId,\n          fireSelectOnSetValue: true,\n          enableKeyEvents: true,\n          valid: false,\n          listeners: {\n              select: function (combo, record, index) {\n                  const revisions = [['latest', 'Most recent revision'], ...record.data.revisions.map( rev => [rev.revisionStr, `${rev.revisionStr} (${rev.benchmarkDate})`])]\n                  revisionComboBox.store.loadData(revisions)\n                  revisionComboBox.setValue(record.data.benchmarkId === _this.benchmarkId ? _this.defaultRevisionStr : 'latest')\n                  assetSelectionPanel.trackedProperty = { dataProperty: 'benchmarkIds', value: record.data.benchmarkId }\n                  stigField.valid = true\n                  setButtonState()\n              },\n              invalid: function (field) {\n                  field.valid = false\n                  setButtonState()\n              },\n              valid: function (field) {\n                  field.valid = true\n                  setButtonState()\n              },\n              blur: function (field) {\n                  this.setValue(this.getRawValue())\n              },\n              render: function (field) {\n                  field.el.dom.addEventListener('blur', () => field.fireEvent('blur'))\n              }\n          }\n      })\n      const revisionComboBox = new SM.Manage.Stig.RevisionComboBox({\n          name: 'defaultRevisionStr',\n          fieldLabel: 'Default revision',\n          listeners: {\n              select: setButtonState\n          }\n      })\n\n      const saveBtn = new Ext.Button({\n          text: 'Update',\n          disabled: true,\n          collectionId: this.collectionId,\n          formBind: true,\n          handler: this.btnHandler || function () {}\n      })\n\n      function setButtonState () {\n          if (!stigField.valid) {\n              assetFieldSet.disable()\n              saveBtn.disable()\n              return\n          }\n          assetFieldSet.enable()\n          const currentBenchmarkId = stigField.getRawValue()\n          const currentRevisionStr = revisionComboBox.getValue()\n          const currentAssetIds = assetSelectionPanel.getValue()\n          const originalAssetIds = assetSelectionPanel.originalAssetIds\n\n          if (!currentAssetIds.length) {\n              saveBtn.disable()\n              return\n          }\n\n          const revisionUnchanged = currentBenchmarkId === _this.benchmarkId && currentRevisionStr === _this.defaultRevisionStr\n          const assetsUnchanged = currentAssetIds.length === originalAssetIds.length && originalAssetIds.every( assetId => currentAssetIds.includes(assetId))\n\n          saveBtn.setDisabled(revisionUnchanged && assetsUnchanged)\n      }\n\n      const assetFieldSet = new Ext.form.FieldSet({\n          title: '<span class=\"sm-asset-assignments-title\">Asset assignments</span>',\n          anchor: \"100% -95\",\n          layout: 'fit',\n          items: [assetSelectionPanel]\n      })\n      let config = {\n          baseCls: 'x-plain',\n          // height: 400,\n          labelWidth: 100,\n          monitorValid: false,\n          trackResetOnLoad: true,\n          items: [\n              {\n                  xtype: 'fieldset',\n                  title: '<span class=\"sm-stig-information-title\">STIG information</span>',\n                  items: [\n                      stigField,\n                      revisionComboBox\n                  ]\n              },\n              assetFieldSet\n          ],\n          buttons: [saveBtn],\n          stigField,\n          revisionComboBox,\n          assetSelectionPanel\n      }\n\n      Ext.apply(this, Ext.apply(this.initialConfig, config))\n      this.superclass().initComponent.call(this)\n\n  },\n  initPanel: async function ({collectionId, benchmarkId}) {\n      try {\n          this.el.mask('')\n          const promises = [\n              this.stigField.store.loadPromise(),\n              this.assetSelectionPanel.initPanel({benchmarkId})\n          ]\n          await Promise.all(promises)\n          this.getForm().setValues({benchmarkId})\n      }\n      finally {\n          this.el.unmask()\n      }\n  }\n})\n"
  },
  {
    "path": "client/src/js/SM/MetaPanel.js",
    "content": "Ext.ns('SM.MetaPanel')\n\nSM.MetaPanel.numberRenderer = new Intl.NumberFormat().format\n\nSM.MetaPanel.CommonColumns = [\n  {\n    header: \"Checks\",\n    width: 50,\n    dataIndex: 'assessments',\n    align: \"center\",\n    sortable: true,\n    renderer: SM.MetaPanel.numberRenderer\n  },\n  {\n    header: 'Oldest',\n    width: 50,\n    dataIndex: 'minTs',\n    align: 'center',\n    sortable: true,\n    renderer: renderDurationToNow\n  },\n  {\n    header: 'Newest',\n    width: 50,\n    dataIndex: 'maxTs',\n    align: 'center',\n    sortable: true,\n    renderer: renderDurationToNow\n  },\n  {\n    header: 'Updated',\n    width: 50,\n    dataIndex: 'maxTouchTs',\n    align: 'center',\n    sortable: true,\n    renderer: renderDurationToNow\n  },\n  {\n    header: \"Assessed\",\n    width: 75,\n    dataIndex: 'assessedPct',\n    // align: \"center\",\n    sortable: true,\n    renderer: renderPct\n  },\n  {\n    header: \"Submitted\",\n    width: 75,\n    dataIndex: 'submittedPct',\n    // align: \"center\",\n    sortable: true,\n    renderer: renderPct\n  },\n  {\n    header: \"Accepted\",\n    width: 75,\n    dataIndex: 'acceptedPct',\n    // align: \"center\",\n    sortable: true,\n    renderer: renderPct\n  },\n  {\n    header: \"Rejected\",\n    width: 75,\n    dataIndex: 'rejectedPct',\n    // align: \"center\",\n    sortable: true,\n    renderer: renderPctAllHigh\n  },\n  {\n    header: \"CORA %\",\n    width: 50,\n    align: \"center\",\n    dataIndex: 'coraScore',\n    sortable: true,\n    renderer: function (v, md, r) {\n      const detailedCora = r.get('coraScoreDetail')\n      let riskClass = getRiskClass(detailedCora.riskRating)\n      return `<div class=\"sm-cora-column ${riskClass}\" ext:qtip=\"<div style='white-space: nowrap;'>${SM.he(detailedCora.riskRating)}</div>\">${(detailedCora.weightedAvg * 100).toFixed(1)}</div>`\n    }\n  },\n  {\n    header: \"CAT 3\",\n    width: 50,\n    dataIndex: 'low',\n    align: \"center\",\n    sortable: true,\n    renderer: SM.CollectionPanel.Renderers.severityCount\n  },\n  {\n    header: \"CAT 2\",\n    width: 50,\n    dataIndex: 'medium',\n    align: \"center\",\n    sortable: true,\n    renderer: SM.CollectionPanel.Renderers.severityCount\n  },\n  {\n    header: \"CAT 1\",\n    width: 50,\n    dataIndex: 'high',\n    align: \"center\",\n    sortable: true,\n    renderer: SM.CollectionPanel.Renderers.severityCount\n  },\n]\n\nSM.MetaPanel.getRevisionId = function (benchmarkId, revisionStr) {\n  const [results, version, release] = /V(\\d+)R(\\d+(\\.\\d+)?)/.exec(revisionStr)\n  return `${benchmarkId}-${version}-${release}`\n}\n\nSM.MetaPanel.renderWithToolFactory = function (action) {\n  let imgSrc, tipTarget\n  switch (action) {\n    case 'dashboard':\n      imgSrc = \"img/collection-color.svg\"\n      tipTarget = 'dashboard'\n      break\n    case 'checklist':\n    default:\n      imgSrc = \"img/shield-green-check.svg\"\n      tipTarget = 'checklist'\n      break\n  }\n  return function (v) {\n    return `\n    <div class=\"sm-grid-cell-with-toolbar\">\n      <div class=\"sm-dynamic-width\">\n        <div class=\"sm-info\">${v}</div>\n      </div>\n      <div class=\"sm-static-width\"><img class=\"sm-grid-cell-toolbar-edit\" sm:action=\"${action}\" ext:qtip=\"Open ${tipTarget}\" src=\"${imgSrc}\" width=\"13\" height=\"13\"></div>\n    </div>`\n  }\n}\n\nSM.MetaPanel.AggGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n\n    const sm = this.checkboxSelModel ? new Ext.grid.CheckboxSelectionModel({\n      singleSelect: false,\n      checkOnly: false,\n    }) : new Ext.grid.RowSelectionModel({\n      singleSelect: true\n    })\n    const fields = [...SM.CollectionPanel.CommonFields]\n    const columns = []\n    if (this.checkboxSelModel) {\n      columns.push(sm)\n    }\n    let idProperty, sortField = 'name', autoExpandColumn = Ext.id()\n    let rowdblclick = () => { }\n    let cellmousedown = () => { }\n\n    const rowCountCfg = {\n      noun: this.aggregation,\n      iconCls: `sm-${this.aggregation}-icon`\n    }\n    switch (this.aggregation) {\n      case 'asset':\n        fields.push(\n          { name: 'assetId', type: 'string' },\n          { name: 'name', type: 'string' },\n          { name: 'labelIds', type: 'string', convert: (v, r) => r.labels.map(l => l.labelId) },\n          'benchmarkIds',\n          { name: 'stigCount', convert: (v, r) => r.benchmarkIds.length }\n        )\n        columns.push(\n          {\n            header: \"Asset\",\n            width: 175,\n            id: autoExpandColumn,\n            dataIndex: 'name',\n            sortable: true,\n            filter: { type: 'string' }\n          },\n          {\n            header: \"Labels\",\n            width: 120,\n            dataIndex: 'labelIds',\n            sortable: false,\n            filter: {\n              type: 'multi-value',\n              collectionId: _this.collectionId,\n              renderer: SM.ColumnFilters.Renderers.labels\n            },\n            renderer: function (value, metadata) {\n              const labels = []\n              for (const labelId of value) {\n                const label = SM.Cache.getCollectionLabel(_this.collectionId, labelId)\n                if (label) labels.push(label)\n              }\n              labels.sort((a, b) => a.name.localeCompare(b.name))\n              metadata.attr = 'style=\"white-space:nowrap;text-overflow:clip;\"'\n              return SM.styledEmptyRenderer(SM.Manage.Collection.LabelArrayTpl.apply(labels))\n            }\n          },\n          {\n            header: \"STIGs\",\n            width: 50,\n            dataIndex: 'stigCount',\n            align: \"center\",\n            tooltip: \"Total STIGs Assigned\",\n            sortable: true\n          }\n        )\n        idProperty = 'assetId'\n        break\n      case 'collection':\n        fields.push(\n          { name: 'collectionId', type: 'string' },\n          { name: 'name', type: 'string' },\n          { name: 'assets', type: 'integer' },\n          { name: 'stigs', type: 'integer' },\n          { name: 'checklists', type: 'integer' }\n        )\n        columns.push(\n          {\n            header: \"Collection\",\n            width: 175,\n            id: autoExpandColumn,\n            dataIndex: 'name',\n            sortable: true,\n            renderer: SM.MetaPanel.renderWithToolFactory(this.hideReviewTool ? 'dashboard' : 'checklist'),\n            filter: { type: 'string' },\n            listeners: {\n              mousedown: function (col, grid, index, e) {\n                if (e.target.className === \"sm-grid-cell-toolbar-edit\") {\n                  return false\n                }\n              }\n            }\n          },\n          {\n            header: \"Assets\",\n            width: 50,\n            dataIndex: 'assets',\n            align: \"center\",\n            tooltip: \"Total Assets in the Collection\",\n            sortable: true,\n            renderer: SM.MetaPanel.numberRenderer\n          }\n        )\n        if (this.region === 'north') {\n          columns.push(\n            {\n              header: \"STIGs\",\n              width: 50,\n              dataIndex: 'stigs',\n              align: \"center\",\n              tooltip: \"Total STIGs in the Collection\",\n              sortable: true\n            },\n            {\n              header: \"Checklists\",\n              width: 50,\n              dataIndex: 'checklists',\n              align: \"center\",\n              tooltip: \"Total Asset/STIG in the Collection\",\n              sortable: true,\n              renderer: SM.MetaPanel.numberRenderer\n            }  \n          )\n        }\n        idProperty = 'collectionId'\n        sortField = 'name'\n        rowdblclick = (grid, rowIndex) => {\n          const r = grid.getStore().getAt(rowIndex)\n          SM.CollectionPanel.showCollectionTab({\n            collectionId: r.data.collectionId,\n            collectionName: r.data.name\n          })\n        }\n        cellmousedown = (grid, rowIndex, columnIndex, e) => {\n          if (e.target.className === \"sm-grid-cell-toolbar-edit\") {\n            const r = grid.getStore().getAt(rowIndex)\n            const action = e.target.getAttribute('sm:action')\n            if (action === 'dashboard') {\n              SM.CollectionPanel.showCollectionTab({\n                collectionId: r.data.collectionId,\n                collectionName: r.data.name,\n\n              })\n            }\n            else {\n              const leaf = {\n                collectionId: r.data.collectionId,\n                benchmarkId: grid.benchmarkId,\n                revisionStr: grid.revisionStr\n              }\n              addCollectionReview({ leaf }) \n            }\n          }\n        }\n\n        break\n      case 'stig':\n        fields.push(\n          { name: 'benchmarkId', type: 'string' },\n          { name: 'title', type: 'string' },\n          { name: 'revisionStr', type: 'string' },\n          { name: 'revisionPinned' },\n          'collections',\n          'assets',\n          { name: 'revisionId', type: 'string', convert: (v, r) => SM.MetaPanel.getRevisionId(r.benchmarkId, r.revisionStr) }\n        )\n        idProperty = r => SM.MetaPanel.getRevisionId(r.benchmarkId, r.revisionStr)\n        columns.push(\n          {\n            header: \"Benchmark\",\n            width: 175,\n            id: autoExpandColumn,\n            dataIndex: 'benchmarkId',\n            sortable: true,\n            renderer: this.hideReviewTool ?  v => v : SM.MetaPanel.renderWithToolFactory('checklist'),\n            filter: { type: 'string' },\n            listeners: {\n              mousedown: function (col, grid, index, e) {\n                if (e.target.className === \"sm-grid-cell-toolbar-edit\") {\n                  return false\n                }\n              }\n            }\n          },\n          {\n            header: \"Title\",\n            width: 175,\n            dataIndex: 'title',\n            sortable: true,\n            filter: { type: 'string' },\n            hidden: true\n          },\n          {\n            header: \"Revision\",\n            width: 58,\n            dataIndex: 'revisionStr',\n            align: \"left\",\n            tooltip: \"Default revision\",\n            sortable: true,\n            renderer: function (v, md, r) {\n              return `${r.data.revisionStr}${r.data.revisionPinned ? '<img src=\"img/pin.svg\" width=\"12\" height=\"12\" style=\"margin-left: 8px;\">' : ''}`\n            }\n          }\n        )\n        if (this.region === 'north') {\n          columns.push(\n            {\n              header: \"Collections\",\n              width: 50,\n              dataIndex: 'collections',\n              align: \"center\",\n              tooltip: \"Total Collections with this STIG assigned\",\n              sortable: true\n            }\n          )\n        } \n        columns.push(\n          {\n            header: \"Assets\",\n            width: 50,\n            dataIndex: 'assets',\n            align: \"center\",\n            tooltip: \"Total Assets with this STIG assigned\",\n            sortable: true,\n            renderer: SM.MetaPanel.numberRenderer\n          }\n        )\n        sortField = 'benchmarkId'\n        rowdblclick = (grid, rowIndex) => {\n          const r = grid.getStore().getAt(rowIndex)\n          const leaf = {\n            collectionId: grid.collectionId,\n            benchmarkId: r.data.benchmarkId,\n            revisionStr: r.data.revisionStr\n          }\n          addCollectionReview({ leaf })\n        }\n        cellmousedown = (grid, rowIndex, columnIndex, e) => {\n          if (e.target.className === \"sm-grid-cell-toolbar-edit\") {\n            const r = grid.getStore().getAt(rowIndex)\n            const leaf = {\n              collectionId: grid.collectionId,\n              benchmarkId: r.data.benchmarkId,\n              revisionStr: r.data.revisionStr\n            }\n            addCollectionReview({ leaf })\n          }\n        }\n        rowCountCfg.noun = 'STIG'\n        break\n    }\n    columns.push(...SM.MetaPanel.CommonColumns)\n\n    this.proxy = new Ext.data.HttpProxy({\n      restful: true,\n      url: `${STIGMAN.Env.apiBase}/collections/meta/metrics/summary/${this.aggregation}`,\n      headers: { 'Content-Type': 'application/json;charset=utf-8' }\n    })\n    const store = new Ext.data.JsonStore({\n      grid: this,\n      autoLoad: this.storeAutoLoad ?? false,\n      baseParams: this.baseParams,\n      smMaskDelay: 50,\n      proxy: this.proxy,\n      root: '',\n      fields,\n      idProperty,\n      sortInfo: {\n        field: sortField,\n        direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      }\n    })\n    this.totalTextCmp = new SM.RowCountTextItem({\n      store,\n      ...rowCountCfg\n    })\n\n    const config = {\n      layout: 'fit',\n      store,\n      loadMask: { msg: '' },\n      sm,\n      cm: new Ext.grid.ColumnModel({\n        columns\n      }),\n      view: new SM.ColumnFilters.GridViewBuffered({\n        emptyText: this.emptyText || 'No records to display',\n        deferEmptyText: false,\n        forceFit: true,\n        cellSelectorDepth: 5,\n        // custom row height\n        rowHeight: 21,\n        borderHeight: 2,\n        // render rows as they come into viewable area.\n        scrollDelay: false,\n        autoExpandColumn,\n        listeners: {\n          filterschanged: function (view, item, value) {\n            store.filter(view.getFilterFns())\n          }\n        }\n      }),\n      bbar: new Ext.Toolbar({\n        items: [\n          {\n            xtype: 'sm-reload-store-button',\n            store,\n            handler: this.reloadBtnHandler\n          },\n          {\n            xtype: 'tbseparator'\n          }, {\n            xtype: 'exportbutton',\n            hasMenu: false,\n            grid: this,\n            gridBasename: this.exportName || this.title || 'aggregation',\n            iconCls: 'sm-export-icon',\n            text: 'CSV'\n          }, {\n            xtype: 'tbfill'\n          }, {\n            xtype: 'tbseparator'\n          },\n          this.totalTextCmp\n        ]\n      }),\n      listeners: {\n        rowdblclick,\n        cellmousedown\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.MetaPanel.UnaggGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    const fields = [\n      { name: 'assetId', type: 'string' },\n      { name: 'name', type: 'string' },\n      { name: 'labelIds', type: 'string', convert: (v, r) => r.labels.map(l => l.labelId) },\n      'benchmarkId',\n      'title',\n      'revisionStr',\n      'revisionPinned',\n      ...SM.CollectionPanel.CommonFields\n    ]\n    const columns = []\n    let sortField, autoExpandColumn = Ext.id()\n\n    switch (this.parentAggregation) {\n      case 'stig':\n        columns.push(\n          {\n            header: \"Asset\",\n            width: 175,\n            id: autoExpandColumn,\n            dataIndex: 'name',\n            sortable: true,\n            filter: { type: 'string' },\n            renderer: SM.MetaPanel.renderWithToolFactory('checklist')\n          },\n          {\n            header: \"Labels\",\n            width: 120,\n            dataIndex: 'labelIds',\n            sortable: false,\n            // filter: {\n            //   type: 'values',\n            //   collectionId: _this.collectionId,\n            //   renderer: SM.ColumnFilters.Renderers.labels\n            // },\n            renderer: function (value, metadata) {\n              const labels = []\n              for (const labelId of value) {\n                const label = SM.Cache.getCollectionLabel(_this.collectionId, labelId)\n                if (label) labels.push(label)\n              }\n              labels.sort((a, b) => a.name.localeCompare(b.name))\n              metadata.attr = 'style=\"white-space:nowrap;text-overflow:clip;\"'\n              return SM.styledEmptyRenderer(SM.Manage.Collection.LabelArrayTpl.apply(labels))\n            }\n          }\n        )\n        sortField = 'name'\n        break\n      case 'asset':\n        columns.push(\n          {\n            header: \"Benchmark\",\n            width: 175,\n            id: autoExpandColumn,\n            dataIndex: 'benchmarkId',\n            sortable: true,\n            filter: { type: 'string' },\n            renderer: SM.MetaPanel.renderWithToolFactory('checklist')\n          },\n          {\n            header: \"Title\",\n            width: 175,\n            dataIndex: 'title',\n            sortable: true,\n            filter: { type: 'string' },\n            hidden: true\n          },\n          {\n            header: \"Revision\",\n            width: 58,\n            dataIndex: 'revisionStr',\n            align: \"center\",\n            tooltip: \"Default revision\",\n            sortable: true,\n            renderer: function (v, md, r) {\n              return `${r.data.revisionStr}${r.data.revisionPinned ? '<img src=\"img/pin.svg\" width=\"12\" height=\"12\" style=\"margin-left: 8px;\">' : ''}`\n            }\n          }\n        )\n        sortField = 'benchmarkId'\n        break\n    }\n    columns.push(...SM.MetaPanel.CommonColumns)\n\n    this.proxy = new Ext.data.HttpProxy({\n      restful: true,\n      url: `${STIGMAN.Env.apiBase}/collections/${this.collectionId}/metrics/summary`,\n      headers: { 'Content-Type': 'application/json;charset=utf-8' }\n    })\n    const store = new Ext.data.JsonStore({\n      grid: this,\n      autoLoad: false,\n      smMaskDelay: 50,\n      proxy: this.proxy,\n      root: '',\n      fields,\n      idProperty: (v) => {\n        return `${v.assetId}-${v.benchmarkId}`\n      },\n      sortInfo: {\n        field: sortField,\n        direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      }\n    })\n    this.totalTextCmp = new SM.RowCountTextItem({\n      store,\n      noun: 'checklist',\n      iconCls: 'sm-stig-icon'\n    })\n\n    const rowdblclick = (grid, rowIndex) => {\n      const r = grid.getStore().getAt(rowIndex)\n      const leaf = {\n        collectionId: grid.collectionId,\n        assetId: r.data.assetId,\n        assetName: r.data.name,\n        assetLabelIds: r.data.labelIds,\n        benchmarkId: r.data.benchmarkId,\n        revisionStr: r.data.revisionStr,\n        stigName: r.data.benchmarkId,\n      }\n      addReview({ leaf })\n    }\n\n    function cellclick(grid, rowIndex, columnIndex, e) {\n      if (e.target.className === \"sm-grid-cell-toolbar-edit\") {\n        const r = grid.getStore().getAt(rowIndex)\n        const leaf = {\n          collectionId: grid.collectionId,\n          assetId: r.data.assetId,\n          assetName: r.data.name,\n          assetLabelIds: r.data.labelIds,\n          benchmarkId: r.data.benchmarkId,\n          revisionStr: r.data.revisionStr,\n          stigName: r.data.benchmarkId,\n        }\n        addReview({ leaf })\n      }\n    }\n\n    const config = {\n      layout: 'fit',\n      store,\n      loadMask: { msg: '' },\n      cm: new Ext.grid.ColumnModel({\n        columns\n      }),\n      view: new SM.ColumnFilters.GridViewBuffered({\n        emptyText: this.emptyText || 'No records to display',\n        deferEmptyText: false,\n        forceFit: true,\n        cellSelectorDepth: 5,\n        // custom row height\n        rowHeight: 21,\n        borderHeight: 2,\n        // render rows as they come into viewable area.\n        scrollDelay: false,\n        autoExpandColumn,\n        listeners: {\n          filterschanged: function (view, item, value) {\n            store.filter(view.getFilterFns())\n          }\n        }\n      }),\n      bbar: new Ext.Toolbar({\n        items: [\n          {\n            xtype: 'sm-reload-store-button',\n            store,\n            handler: this.reloadBtnHandler\n          },\n          {\n            xtype: 'tbseparator'\n          },\n          {\n            xtype: 'exportbutton',\n            hasMenu: false,\n            grid: this,\n            gridBasename: this.exportName || this.title || 'unaggregated',\n            iconCls: 'sm-export-icon',\n            text: 'CSV'\n          },\n          {\n            xtype: 'tbfill'\n          },\n          {\n            xtype: 'tbseparator'\n          },\n          this.totalTextCmp\n        ]\n      }),\n      listeners: {\n        rowdblclick,\n        cellclick\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.MetaPanel.ProgressPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n\n    const calcMetrics = function (metrics) {\n      return {\n        unassessed: metrics.assessments - metrics.assessed,\n        assessed: metrics.statuses.saved - metrics.results.other,\n        submitted: metrics.statuses.submitted,\n        accepted: metrics.statuses.accepted,\n        rejected: metrics.statuses.rejected,\n        assessments: metrics.assessments,\n        apiAssessed: metrics.assessed\n      }\n    }\n\n    const chartOptions = {\n      type: 'doughnut',\n      data: {\n        datasets: [{\n          data: [0, 0, 0, 0, 0],\n          backgroundColor: SM.CollectionPanel.ProgressPanelColors(curUser?.webPreferences?.darkMode ? 'dark' : 'light'),\n          borderWidth: [1, 1],\n          borderColor: '#bbbbbb'\n        }],\n        labels: [\n          'Assessed',\n          'Submitted',\n          'Accepted',\n          'Unassessed',\n          'Rejected'\n        ],\n      },\n      options: {\n        responsive: true,\n        plugins: {\n          legend: {\n            display: false\n          }\n        }\n      }\n    }\n\n    const chartPanel = new SM.CollectionPanel.ChartPanel({\n      border: false,\n      width: 170,\n      height: 170,\n      chartOptions\n    })\n\n    const onThemeChanged = function (theme) {\n      if (chartPanel.chart) {\n        chartPanel.chart.config._config.data.datasets[0].backgroundColor = SM.CollectionPanel.ProgressPanelColors(theme)\n        chartPanel.chart.update()\n      }\n    }\n    SM.Dispatcher.addListener('themechanged', onThemeChanged)\n\n    const updateMetrics = function (metrics) {\n      const metricCalcs = calcMetrics(metrics)\n      dataPanel.update(metricCalcs)\n      if (chartPanel.chart) {\n        chartPanel.chart.config._config.data.datasets[0].data = [\n          metricCalcs.assessed, //Assessed\n          metricCalcs.submitted, // Submitted\n          metricCalcs.accepted, // Accepted\n          metricCalcs.unassessed, // Unassessed\n          metricCalcs.rejected // Rejected         \n        ]\n        chartPanel.chart.update()\n      }\n      progressBarsPanel.updateMetrics(metrics)\n    }\n\n    const dataTpl = new Ext.XTemplate(\n      `<div class=\"sm-metrics-status-pct\">{[this.calcAssessedPct(values.apiAssessed, values.assessments)]}% assessed</div>`,\n      '<table class=\"sm-metrics-status-table\" style=\"margin: 0 auto;\">',\n      '<tbody>',\n      '<tr><td class=\"sm-metrics-label sm-metrics-unassessed\">Unassessed</td><td class=\"sm-metrics-value\">{[this.intlNumberFormat(values.unassessed)]}</td></tr>',\n      '<tr><td class=\"sm-metrics-label sm-metrics-assessed\">Assessed</td><td class=\"sm-metrics-value\">{[this.intlNumberFormat(values.assessed)]}</td></tr>',\n      '<tr><td class=\"sm-metrics-label sm-metrics-submitted\">Submitted</td><td class=\"sm-metrics-value\">{[this.intlNumberFormat(values.submitted)]}</td></tr>',\n      '<tr><td class=\"sm-metrics-label sm-metrics-accepted\">Accepted</td><td class=\"sm-metrics-value\">{[this.intlNumberFormat(values.accepted)]}</td></tr>',\n      '<tr><td class=\"sm-metrics-label sm-metrics-rejected\">Rejected</td><td class=\"sm-metrics-value\">{[this.intlNumberFormat(values.rejected)]}</td></tr>',\n      '<tr class=\"sm-metrics-total\"><td>Total Checks</td><td class=\"sm-metrics-value\">{[this.intlNumberFormat(values.assessments)]}</td></tr>',\n      '</tbody>',\n      '</table>',\n      {\n        calcAssessedPct: function (assessed, assessments) {\n          const pct = assessments ? assessed / assessments * 100 : 0\n          if (pct > 99 && pct < 100) {\n            return '>99'\n          }\n          else {\n            return pct.toFixed(0).toString()\n          }\n        },\n        intlNumberFormat: SM.MetaPanel.numberRenderer\n      }\n    )\n\n    const dataPanel = new Ext.Panel({\n      border: false,\n      tpl: dataTpl,\n      width: 175\n    })\n    const progressBarsPanel = new SM.CollectionPanel.ProgressBarsPanel({\n      border: false,\n      height: 44\n    })\n\n    const config = {\n      layout: 'vbox',\n      height: 290,\n      layoutConfig: {\n        align: 'stretch',\n        pack: 'center'\n      },\n      items: [\n        {\n          layout: 'hbox',\n          height: 180,\n          border: false,\n          layoutConfig: {\n            align: 'middle',\n            pack: 'center'\n          },\n          items: [chartPanel, { width: 30, border: false }, dataPanel]\n        },\n        { height: 20, border: false },\n        progressBarsPanel,\n      ],\n      updateMetrics,\n      listeners: {\n        beforedestroy: function () {\n          SM.Dispatcher.removeListener('themechanged', onThemeChanged)\n        }\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.MetaPanel.ProgressPanel.superclass.initComponent.call(this)\n  }\n})\n\nSM.MetaPanel.FindingsPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const tpl = new Ext.XTemplate(\n      '<div class=\"sm-metrics-count-parent\">',\n      '<div class=\"sm-metrics-count-child sm-metrics-low-box\">',\n      `<div class=\"sm-metrics-count-label\">CAT 3</div><div class=\"sm-metrics-count-value\">{[SM.MetaPanel.numberRenderer(values.low)]}</div>`,\n      '</div>',\n      '<div class=\"sm-metrics-count-child sm-metrics-medium-box\" >',\n      `<div class=\"sm-metrics-count-label\">CAT 2</div><div class=\"sm-metrics-count-value\">{[SM.MetaPanel.numberRenderer(values.medium)]}</div>`,\n      '</div>',\n      '<div class=\"sm-metrics-count-child sm-metrics-high-box\" >',\n      `<div class=\"sm-metrics-count-label\">CAT 1</div><div class=\"sm-metrics-count-value\">{[SM.MetaPanel.numberRenderer(values.high)]}</div>`,\n      '</div>',\n      '</div>'\n    )\n    const updateMetrics = function (metrics) {\n      _this.update(metrics)\n    }\n    const config = {\n      tpl,\n      data: this.metrics,\n      updateMetrics\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.MetaPanel.ExportPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const collectionId = this.collectionId\n    const localStorageBase = 'metaExport'\n\n    const formatComboBox = new Ext.form.ComboBox({\n      mode: 'local',\n      width: 110,\n      fieldLabel: \"Format\",\n      forceSelection: true,\n      autoSelect: true,\n      editable: false,\n      store: new Ext.data.SimpleStore({\n        fields: ['displayStr', 'valueStr'],\n        data: [\n          ['JSON', 'json'],\n          ['CSV', 'csv']\n        ]\n      }),\n      valueField: 'valueStr',\n      displayField: 'displayStr',\n      value: localStorage.getItem(`${localStorageBase}Format`) || 'json',\n      monitorValid: false,\n      triggerAction: 'all',\n      listeners: {\n        select: function (combo, record, index) {\n          localStorage.setItem(`${localStorageBase}Format`, combo.getValue())\n        }\n      }\n    })\n    const styleComboBox = new Ext.form.ComboBox({\n      mode: 'local',\n      width: 110,\n      fieldLabel: \"Style\",\n      forceSelection: true,\n      autoSelect: true,\n      editable: false,\n      store: new Ext.data.SimpleStore({\n        fields: ['displayStr', 'valueStr'],\n        data: [\n          ['Summary', 'summary'],\n          ['Detail', 'detail']\n        ]\n      }),\n      valueField: 'valueStr',\n      displayField: 'displayStr',\n      value: localStorage.getItem(`${localStorageBase}Style`) || 'summary',\n      monitorValid: false,\n      triggerAction: 'all',\n      listeners: {\n        select: function (combo, record, index) {\n          localStorage.setItem(`${localStorageBase}Style`, combo.getValue())\n        }\n      }\n    })\n    const aggComboBox = new Ext.form.ComboBox({\n      mode: 'local',\n      width: 110,\n      fieldLabel: \"Grouped by\",\n      forceSelection: true,\n      autoSelect: true,\n      editable: false,\n      store: new Ext.data.SimpleStore({\n        fields: ['displayStr', 'valueStr'],\n        data: [\n          ['Collection', 'collection'],\n          ['STIG', 'stig'],\n          ['Totals', 'unagg']\n        ]\n      }),\n      valueField: 'valueStr',\n      displayField: 'displayStr',\n      value: localStorage.getItem(`${localStorageBase}Agg`) || 'collection',\n      monitorValid: false,\n      triggerAction: 'all',\n      listeners: {\n        select: function (combo, record, index) {\n          localStorage.setItem(`${localStorageBase}Agg`, combo.getValue())\n        }\n      }\n    })\n    const exportButton = new Ext.Button({\n      text: 'Download',\n      iconCls: 'sm-export-icon',\n      disabled: false,\n      style: {\n        position: 'relative',\n        top: '-52px',\n        left: '255px'\n      },\n      handler: async function () {\n        const queryParams = Object.entries(_this.baseParams ?? {}).flatMap(([k, v]) => Array.isArray(v) ? v.map((v) => [k, v]) : [[k, v]])\n        const format = formatComboBox.getValue()\n        queryParams.push(['format', format])\n        const queryParamsStr = new URLSearchParams(queryParams).toString()\n\n        const style = styleComboBox.getValue()\n        const agg = aggComboBox.getValue()\n        const url = `${STIGMAN.Env.apiBase}/collections/meta/metrics/${style}${agg === 'unagg' ? '' : `/${agg}`}?${queryParamsStr}`\n\n        const attachment = SM.Global.filenameEscaped(`Meta-${agg}-${style}_${SM.Global.filenameComponentFromDate()}.${format}`)\n\n        \n        const fetchInit = {\n          method: 'GET',\n          headers: {\n            'Authorization': `Bearer ${window.oidcWorker.token}`,\n            'Accept': `${format === 'csv' ? 'text/csv' : 'application/json'}`\n          },\n          attachment\n        }\n        const href = await SM.ServiceWorker.getDownloadUrl({ url, ...fetchInit })\n        if (href) {\n          window.location = href\n          return\n        }\n        const response = await fetch(url, fetchInit)\n        if (!response.ok) {\n          const body = await response.text()\n          throw new Error(`Request failed with status ${response.status}\\n${body}`)\n        }\n        const blob = await response.blob()\n        saveAs(blob, attachment)\n      }\n    })\n\n\n    const config = {\n      layout: 'form',\n      items: [\n        aggComboBox,\n        styleComboBox,\n        formatComboBox,\n        exportButton\n      ]\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.MetaPanel.InventoryPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const tpl = new Ext.XTemplate(\n      '<div class=\"sm-metrics-count-parent\">',\n      '<div class=\"sm-metrics-count-child sm-metrics-inventory-box\" >',\n      `<div class=\"sm-metrics-count-label\">Assets</div><div class=\"sm-metrics-count-value\">{[SM.MetaPanel.numberRenderer(values.assets)]}</div>`,\n      '</div>',\n      '<div class=\"sm-metrics-count-child sm-metrics-inventory-box\">',\n      `<div class=\"sm-metrics-count-label\">STIGs</div><div class=\"sm-metrics-count-value\">{[SM.MetaPanel.numberRenderer(values.stigs)]}</div>`,\n      '</div>',\n      '<div class=\"sm-metrics-count-child sm-metrics-inventory-box\">',\n      `<div class=\"sm-metrics-count-label\">Checklists</div><div class=\"sm-metrics-count-value\">{[SM.MetaPanel.numberRenderer(values.checklists)]}</div>`,\n      '</div>',\n      '</div>'\n    )\n    const updateMetrics = function (metrics) {\n      _this.update(metrics)\n    }\n    const config = {\n      tpl,\n      data: this.data,\n      updateMetrics\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.MetaPanel.OverviewPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const toolTemplate = new Ext.XTemplate(\n      '<tpl if=\"!!values.text\">',\n      '<div class=\"x-tool x-tool-{id}\">{text}</div>',\n      '</tpl>',\n      '<tpl if=\"!!!values.text\">',\n      '<div class=\"x-tool x-tool-{id}\">&#160;</div>',\n      '</tpl>'\n    )\n\n    const collectionId = this.collectionId\n    this.lastRefreshedTextItem = new Ext.Toolbar.TextItem({\n      text: '',\n      tpl: [\n        `<span style=\"font-weight:600;\">Fetched:</span> {[Ext.util.Format.date(values.date,'Y-m-d H:i:s T')]}`\n      ]\n    })\n    this.reloadBtn = new SM.ReloadStoreButton({\n      handler: this.reloadBtnHandler\n    })\n\n    this.inventoryPanel = new SM.MetaPanel.InventoryPanel({\n      cls: 'sm-round-inner-panel',\n      bodyStyle: 'padding: 10px;',\n      title: 'Inventory',\n      tools: this.inventoryPanelTools || undefined,\n      toolTemplate,\n      border: true\n    })\n    this.coraPanel = new SM.CollectionPanel.CORAPanel({\n      cls: 'sm-round-inner-panel',\n      bodyStyle: 'padding: 10px;',\n      title: 'CORA',\n      toolTemplate,\n      border: true\n    })\n    this.progressPanel = new SM.MetaPanel.ProgressPanel({\n      cls: 'sm-round-inner-panel',\n      bodyStyle: 'padding: 10px;',\n      title: 'Progress',\n      tools: this.progressPanelTools || undefined,\n      border: true\n    })\n    this.agesPanel = new SM.CollectionPanel.AgesPanel({\n      cls: 'sm-round-inner-panel',\n      bodyStyle: 'padding: 10px;',\n      title: 'Review Ages',\n      tools: this.agesPanelTools || undefined,\n      border: true\n    })\n    this.findingsPanel = new SM.MetaPanel.FindingsPanel({\n      cls: 'sm-round-inner-panel',\n      bodyStyle: 'padding: 10px;',\n      title: 'Findings',\n      tools: this.findingsPanelTools || undefined,\n      toolTemplate,\n      border: true\n    })\n    this.exportPanel = new SM.MetaPanel.ExportPanel({\n      cls: 'sm-round-inner-panel',\n      bodyStyle: 'padding: 10px;',\n      title: 'Export metrics',\n      border: true,\n      height: 122,\n      collectionId\n    })\n\n    const updateBaseParams = function (params) {\n      _this.baseParams = params\n      _this.exportPanel.baseParams = params\n    }\n    const updatePanels = function (data) {\n      _this.inventoryPanel.updateMetrics(data)\n      _this.progressPanel.updateMetrics(data.metrics)\n      _this.agesPanel.updateMetrics(data.metrics)\n      _this.findingsPanel.updateMetrics(data.metrics.findings)\n      _this.coraPanel.updateMetrics(data.metrics)\n      _this.lastRefreshedTextItem.update({\n        date: data.date\n      })\n    }\n    const updateData = async function ({ refreshViewsOnly = false, loadMasksDisabled = false } = {}) {\n      try {\n        if (!_this.hasContent || !loadMasksDisabled) {\n          _this.bwrap?.mask('')\n        }\n        _this.reloadBtn.showLoadingIcon()\n        if (!refreshViewsOnly) {\n          const results = await Ext.Ajax.requestPromise({\n            url: `${STIGMAN.Env.apiBase}/collections/meta/metrics/summary`,\n            method: 'GET',\n            params: _this.baseParams\n          })\n          _this.data = JSON.parse(results.response.responseText)\n          _this.data.date = new Date()\n        }\n        updatePanels(_this.data)\n        _this.hasContent = true\n        return _this.data\n      }\n      catch (e) {\n        console.log(e)\n      }\n      finally {\n        _this.bwrap?.unmask()\n        _this.reloadBtn.showRefreshIcon()\n      }\n    }\n    const config = {\n      border: false,\n      autoScroll: true,\n      toolTemplate,\n      items: [\n        this.progressPanel,\n        this.coraPanel,\n        this.inventoryPanel,\n        this.findingsPanel,\n        this.agesPanel,\n        this.exportPanel\n      ],\n      bbar: [\n        this.reloadBtn,\n        '->',\n        '-',\n        this.lastRefreshedTextItem\n      ],\n      updateData,\n      updateBaseParams\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.MetaPanel.AggCollectionPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const gridNorth = new SM.MetaPanel.AggGrid({\n      aggregation: 'collection',\n      hideReviewTool: true,\n      // stateId: `sm-metrics-agg-grid-label-${collectionId}`,\n      // stateful: true,\n      border: false,\n      reloadBtnHandler: this.reloadBtnHandler,\n      baseParams: this.baseParams,\n      exportName: 'Collections',\n      region: 'north',\n      split: true,\n      height: '33%',\n      initialized: false\n    })\n    const gridCenter = new SM.MetaPanel.AggGrid({\n      title: 'STIGs',\n      // stateId: `sm-metrics-agg-grid-label-asset-${collectionId}`,\n      // stateful: true,\n      border: false,\n      reloadBtnHandler: this.reloadBtnHandler,\n      aggregation: 'stig',\n      storeAutoLoad: false,\n      baseParams: this.baseParams,\n      exportName: 'STIGs',\n      region: 'center'\n    })\n    const gridSouth = new SM.MetaPanel.UnaggGrid({\n      title: 'Checklists',\n      // stateId: `sm-metrics-unagg-grid-collection-${collectionId}`,\n      // stateful: true,\n      border: false,\n      parentAggregation: 'stig',\n      reloadBtnHandler: this.reloadBtnHandler,\n      region: 'south',\n      split: true,\n      height: '33%'\n    })\n    async function onRowSelectNorth(cm, index, record) {\n      // Update labels for the newly selected collection\n      await SM.Cache.updateCollectionLabels(record.data.collectionId)\n      gridCenter.collectionId = record.data.collectionId\n      gridCenter.store.proxy.setUrl(`${STIGMAN.Env.apiBase}/collections/${record.data.collectionId}/metrics/summary/stig`)\n      // await gridCenter.store.loadPromise()\n      // gridSouth.store.removeAll()\n      // gridCenter.setTitle(`STIGs for ${record.data.name}`)\n      updateData({includeGridNorth: false})\n\n    }\n    async function onRowSelectCenter(cm, index, record) {\n      const selectedRowNorth = gridNorth.getSelectionModel().getSelected()\n      gridSouth.store.proxy.setUrl(`${STIGMAN.Env.apiBase}/collections/${selectedRowNorth.data.collectionId}/metrics/summary`)\n      gridSouth.collectionId = selectedRowNorth.data.collectionId\n      await gridSouth.store.loadPromise({\n        benchmarkId: record.data.benchmarkId\n      })\n      gridSouth.setTitle(`Checklists for \"${record.data.benchmarkId}\" in \"${selectedRowNorth.data.name}\"`)\n    }\n\n    gridNorth.getSelectionModel().on('rowselect', onRowSelectNorth)\n    gridCenter.getSelectionModel().on('rowselect', onRowSelectCenter)\n    const updateBaseParams = function (params) {\n      gridNorth.store.baseParams = _this.baseParams = params\n    }\n    const updateData = async function ({ refreshViewsOnly = false, loadMasksDisabled = false, includeGridNorth = true } = {}) {\n      try {\n        gridNorth.initialized = true\n        const selectedRowNorth = gridNorth.getSelectionModel().getSelected()\n        const selectedRowCenter = gridCenter.getSelectionModel().getSelected()\n\n        if (refreshViewsOnly) {\n          gridNorth.getView().refresh()\n          if (selectedRowNorth) {\n            gridCenter.getView().refresh()\n            if (selectedRowCenter) {\n              gridSouth.getView().refresh()\n            }\n          }\n          return\n        }\n\n        if (includeGridNorth) {\n          let savedLoadMaskDisabled = gridNorth.loadMask.disabled\n          gridNorth.loadMask.disabled = loadMasksDisabled\n          await gridNorth.store.loadPromise()\n          gridNorth.loadMask.disabled = savedLoadMaskDisabled\n        }\n\n        if (!selectedRowNorth) {\n          return\n        }\n\n        const currentRecordNorth = gridNorth.store.getById(selectedRowNorth.data.collectionId)\n        if (!currentRecordNorth) {\n          gridCenter.setTitle('STIGs')\n          gridCenter.store.removeAll()\n          gridSouth.setTitle('Checklists')\n          gridSouth.store.removeAll()\n          return\n        }\n        const currentIndexNorth = gridNorth.store.indexOfId(currentRecordNorth.data.collectionId)\n        gridNorth.view.focusRow(currentIndexNorth)\n        savedLoadMaskDisabled = gridCenter.loadMask.disabled\n        gridCenter.loadMask.disabled = loadMasksDisabled\n        gridCenter.store.proxy.setUrl(`${STIGMAN.Env.apiBase}/collections/${currentRecordNorth.data.collectionId}/metrics/summary/stig`)\n        await gridCenter.store.loadPromise()\n        gridCenter.loadMask.disabled = savedLoadMaskDisabled\n        gridCenter.setTitle(`STIGs in \"${currentRecordNorth.data.name}\"`)\n\n        \n        const currentRecordCenter = gridCenter.store.getById(selectedRowCenter?.data.revisionId)\n        if (!currentRecordCenter) {\n          gridSouth.setTitle('Checklists')\n          gridSouth.store.removeAll()\n          return\n        }\n        const currentIndexCenter = gridCenter.store.indexOfId(currentRecordCenter.data.revisionId)\n        gridCenter.view.focusRow(currentIndexCenter)\n        savedLoadMaskDisabled = gridSouth.loadMask.disabled\n        gridSouth.loadMask.disabled = loadMasksDisabled\n        gridSouth.store.proxy.setUrl(`${STIGMAN.Env.apiBase}/collections/${currentRecordNorth.data.collectionId}/metrics/summary`)\n        gridSouth.collectionId = currentRecordNorth.data.collectionId\n        await gridSouth.store.loadPromise({\n          benchmarkId: currentRecordCenter.data.benchmarkId\n        })\n        gridSouth.loadMask.disabled = savedLoadMaskDisabled\n        gridSouth.setTitle(`Checklists for \"${currentRecordCenter.data.benchmarkId}\" in \"${currentRecordNorth.data.name}\"`)\n\n      }\n      catch (e) {\n        console.log(e)\n      }\n    }\n\n    const config = {\n      layout: 'border',\n      cls: 'sm-metric-agg-panel',\n      items: [\n        gridNorth,\n        gridCenter,\n        gridSouth\n      ],\n      updateBaseParams,\n      updateData\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.MetaPanel.AggStigPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const collectionId = this.collectionId\n    const gridNorth = new SM.MetaPanel.AggGrid({\n      aggregation: 'stig',\n      hideReviewTool: true,\n      // stateId: `sm-metrics-agg-grid-label-${collectionId}`,\n      // stateful: true,\n      border: false,\n      collectionId,\n      reloadBtnHandler: this.reloadBtnHandler,\n      baseParams: this.baseParams,\n      exportName: 'STIGs',\n      region: 'north',\n      split: true,\n      height: '33%',\n      initialized: false\n    })\n    const gridCenter = new SM.MetaPanel.AggGrid({\n      title: 'Collections',\n      // stateId: `sm-metrics-agg-grid-label-asset-${collectionId}`,\n      // stateful: true,\n      border: false,\n      reloadBtnHandler: this.reloadBtnHandler,\n      aggregation: 'collection',\n      storeAutoLoad: false,\n      collectionId,\n      baseParams: this.baseParams,\n      exportName: 'Collections',\n      region: 'center'\n    })\n    const gridSouth = new SM.MetaPanel.UnaggGrid({\n      title: 'Checklists',\n      // stateId: `sm-metrics-unagg-grid-label-${collectionId}`,\n      // stateful: true,\n      border: false,\n      parentAggregation: 'stig',\n      reloadBtnHandler: this.reloadBtnHandler,\n      collectionId,\n      region: 'south',\n      split: true,\n      height: '33%'\n    })\n    async function onRowSelectNorth(cm, index, record) {\n      gridCenter.store.proxy.setUrl(`${STIGMAN.Env.apiBase}/collections/meta/metrics/summary/collection`)\n      gridCenter.benchmarkId = record.data.benchmarkId\n      gridCenter.revisionStr = record.data.revisionStr\n      await gridCenter.store.loadPromise({\n        revisionId: SM.MetaPanel.getRevisionId(record.data.benchmarkId, record.data.revisionStr)\n      })\n      updateData({includeGridNorth: false})\n\n    }\n    async function onRowSelectCenter(cm, index, record) {\n      const selectedRowNorth = gridNorth.getSelectionModel().getSelected()\n      gridSouth.store.proxy.setUrl(`${STIGMAN.Env.apiBase}/collections/${record.data.collectionId}/metrics/summary`)\n      gridSouth.collectionId = record.data.collectionId\n      await SM.Cache.updateCollectionLabels(record.data.collectionId)\n      await gridSouth.store.loadPromise({\n        benchmarkId: selectedRowNorth.data.benchmarkId\n      })\n      gridSouth.setTitle(`Checklists for \"${selectedRowNorth.data.benchmarkId}\" in \"${record.data.name}\"`)\n\n    }\n\n    gridNorth.getSelectionModel().on('rowselect', onRowSelectNorth)\n    gridCenter.getSelectionModel().on('rowselect', onRowSelectCenter)\n    const updateBaseParams = function (params) {\n      gridNorth.store.baseParams = _this.baseParams = params\n      gridCenter.store.baseParams = _this.baseParams = params\n    }\n    const updateData = async function ({ refreshViewsOnly = false, loadMasksDisabled = false, includeGridNorth = true } = {}) {\n      try {\n        gridNorth.initialized = true\n        const selectedRowNorth = gridNorth.getSelectionModel().getSelected()\n        const selectedRowCenter = gridCenter.getSelectionModel().getSelected()\n\n        if (refreshViewsOnly) {\n          gridNorth.getView().refresh()\n          if (selectedRowNorth) {\n            gridCenter.getView().refresh()\n            if (selectedRowCenter) {\n              gridSouth.getView().refresh()\n            }\n          }\n          return\n        }\n\n        if (includeGridNorth) {\n          let savedLoadMaskDisabled = gridNorth.loadMask.disabled\n          gridNorth.loadMask.disabled = loadMasksDisabled\n          await gridNorth.store.loadPromise()\n          gridNorth.loadMask.disabled = savedLoadMaskDisabled\n        }\n\n        if (!selectedRowNorth) {\n          return\n        }\n\n        const currentRecordNorth = gridNorth.store.getById(selectedRowNorth.data.revisionId)\n        if (!currentRecordNorth) {\n          gridCenter.setTitle('Collections')\n          gridCenter.store.removeAll()\n          gridSouth.setTitle('STIGs')\n          gridSouth.store.removeAll()\n          return\n        }\n        const currentIndexNorth = gridNorth.store.indexOfId(currentRecordNorth.data.revisionId)\n        gridNorth.view.focusRow(currentIndexNorth)\n        savedLoadMaskDisabled = gridCenter.loadMask.disabled\n        gridCenter.loadMask.disabled = loadMasksDisabled\n        gridCenter.store.proxy.setUrl(`${STIGMAN.Env.apiBase}/collections/meta/metrics/summary/collection`)\n        await gridCenter.store.loadPromise({\n          revisionId: currentRecordNorth.data.revisionId\n        })\n        gridCenter.loadMask.disabled = savedLoadMaskDisabled\n        gridCenter.setTitle(`Collections with \"${currentRecordNorth.data.benchmarkId} ${currentRecordNorth.data.revisionStr}\"`)\n\n        \n        const currentRecordCenter = gridCenter.store.getById(selectedRowCenter?.data.collectionId)\n        if (!currentRecordCenter) {\n          gridSouth.setTitle('Checklists')\n          gridSouth.store.removeAll()\n          return\n        }\n        const currentIndexCenter = gridCenter.store.indexOfId(currentRecordCenter.data.collectionId)\n        gridCenter.view.focusRow(currentIndexCenter)\n        savedLoadMaskDisabled = gridSouth.loadMask.disabled\n        gridSouth.loadMask.disabled = loadMasksDisabled\n        gridSouth.store.proxy.setUrl(`${STIGMAN.Env.apiBase}/collections/${currentRecordCenter.data.collectionId}/metrics/summary`)\n        await gridSouth.store.loadPromise({\n          benchmarkId: currentRecordNorth.data.benchmarkId\n        })\n        gridSouth.loadMask.disabled = savedLoadMaskDisabled\n        gridSouth.setTitle(`Checklists for \"${currentRecordNorth.data.benchmarkId}\" in \"${currentRecordCenter.data.name}\"`)\n\n      }\n      catch (e) {\n        console.log(e)\n      }\n    }\n\n    const config = {\n      layout: 'border',\n      cls: 'sm-metric-agg-panel',\n      items: [\n        gridNorth,\n        gridCenter,\n        gridSouth\n      ],\n      updateBaseParams,\n      updateData\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.MetaPanel.showMetaTab = async function (options) {\n  try {\n    const { treePath, initialCollectionIds = [] } = options\n    const tab = Ext.getCmp('main-tab-panel').getItem(`meta-panel`)\n    if (tab) {\n      Ext.getCmp('main-tab-panel').setActiveTab(tab.id)\n      return\n    }\n\n\n    const gState = {}\n\n    gState.collectionIds = initialCollectionIds\n    gState.filterableCollections = []\n\n    const UPDATE_DATA_DELAY = 300000\n\n    const overviewTitleTpl = new Ext.XTemplate(\n      `Collections: {[values.collections]}`\n    )\n\n    const filterMenu = new SM.MetaPanel.CollectionsMenu({\n      collections: gState.filterableCollections,\n      initialCollectionIds,\n      showHeader: true,\n      showApply: true,\n      listeners: {\n        applied: function (collectionIds) {\n          SM.Dispatcher.fireEvent('collectionfilter', collectionIds)\n        }\n      }\n    })\n    const overviewPanel = new SM.MetaPanel.OverviewPanel({\n      cls: 'sm-round-panel sm-metrics-overview-panel',\n      collapsible: true,\n      collapseFirst: false,\n      inventoryPanelTools: [],\n      findingsPanelTools: [],\n      tools: [\n        {\n          id: 'collection',\n          text: 'Filter &#9660;',\n          handler: (event, toolEl, panel, tc) => {\n            filterMenu.showAt(event.xy)\n          }\n        }\n      ],\n      title: 'Initializing...',\n      margins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n      region: 'west',\n      width: 430,\n      minWidth: 430,\n      split: true,\n      reloadBtnHandler,\n    })\n    const aggStigPanel = new SM.MetaPanel.AggStigPanel({\n      title: 'STIGs',\n      iconCls: 'sm-stig-icon',\n      layout: 'fit',\n      border: false,\n      reloadBtnHandler\n    })\n    const aggCollectionPanel = new SM.MetaPanel.AggCollectionPanel({\n      title: 'Collections',\n      iconCls: 'sm-collection-icon',\n      layout: 'fit',\n      border: false,\n      reloadBtnHandler\n    })\n\n    setCurrentBaseParams(initialCollectionIds)\n\n    const aggTabPanel = new Ext.TabPanel({\n      activeTab: 0,\n      border: false,\n      deferredRender: false,\n      firstShow: true,\n      items: [\n        aggCollectionPanel,\n        aggStigPanel\n      ],\n      listeners: {\n        tabchange: function (tp) {\n          if (!tp.firstShow) updateData({ event: 'tabchange' })\n          tp.firstShow = false\n        }\n      }\n    })\n\n    const centerPanel = new Ext.Panel({\n      region: 'center',\n      layout: 'fit',\n      cls: 'sm-round-panel',\n      margins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.adjacent },\n      border: false,\n      collapsible: false,\n      items: aggTabPanel\n    })\n\n    const metaTab = new Ext.Panel({\n      id: 'meta-panel',\n      sm_unshown: true,\n      border: false,\n      region: 'center',\n      iconCls: 'sm-report-icon',\n      title: \"Meta Dashboard\",\n      closable: true,\n      layout: 'border',\n      sm_treePath: treePath,\n      updateTitle: function () {\n        this.setTitle(\"Meta Dashboard\")\n      },\n      items: [\n        overviewPanel,\n        centerPanel\n      ],\n      listeners: {\n        beforehide: (panel) => {\n          cancelTimers()\n        },\n        activate: (panel) => {\n          updateData({ event: 'activate' })\n          panel.sm_unshown = false\n        }\n      }\n    })\n\n    const bc = new BroadcastChannel(window.oidcWorker.channelName)\n    bc.onmessage = (event) => {\n      if (metaTab.hidden) {\n        return\n      }\n      if (event.data.type === 'noToken') {\n\t\t    cancelTimers()\n      } else if (event.data.type === 'accessToken') {\n        if (!gState.updateDataTimerId && !gState.refreshViewTimerId) {\n          updateData({event: 'updatedata'})\n        }\n      }\n\t  }\n\n\n    SM.Dispatcher.addListener('collectionfilter', onCollectionFilter)\n    metaTab.on('beforedestroy', () => {\n      SM.Dispatcher.removeListener('collectionfilter', onCollectionFilter)\n      cancelTimers()\n      bc.close()\n    })\n\n    SM.AddPanelToMainTab(metaTab, 'permanent')\n\n    // functions\n\n    function setCurrentBaseParams(collectionIds) {\n      const params = {}\n      if (collectionIds.length) {\n        params.collectionId = collectionIds\n      }\n      aggCollectionPanel?.updateBaseParams(params)\n      aggStigPanel?.updateBaseParams(params)\n      overviewPanel?.updateBaseParams(params)\n      return params\n    }\n\n    async function updateFilterableCollections() {\n      try {\n        gState.filterableCollections = await Ext.Ajax.requestPromise({\n          responseType: 'json',\n          url: `${STIGMAN.Env.apiBase}/collections`,\n          method: 'GET'\n        })\n        const filterableCollectionIds = gState.filterableCollections.map(collection => collection.collectionId)\n        // remove from gState.collectionIds any missing collectionIds\n        gState.collectionIds = gState.collectionIds.filter(collectionId => filterableCollectionIds.includes(collectionId))\n        // reset base parameters\n        setCurrentBaseParams(gState.collectionIds)\n        filterMenu.refreshItems(gState.filterableCollections)\n\n        return gState.filterableCollections\n      }\n      catch (e) {\n        console.error(e)\n        return []\n      }\n    }\n\n    function updateOverviewTitle() {\n      const overviewTitle = overviewTitleTpl.apply({\n        collections: `${gState.collectionIds.length ? gState.collectionIds.length : gState.filterableCollections.length} of ${gState.filterableCollections.length}`\n      })\n      overviewPanel.setTitle(overviewTitle)\n    }\n\n    function reloadBtnHandler() { updateData({ event: 'reload' }) }\n\n    // handle change to collection filters in NavTree\n    async function onCollectionFilter(srcCollectionIds) {\n      try {\n        if (gState.filterableCollections.every(i => srcCollectionIds.includes(i.collectionId))) {\n          gState.collectionIds = []\n        }\n        else {\n          gState.collectionIds = srcCollectionIds\n        }\n        localStorage.setItem('metaCollectionIds', JSON.stringify(gState.collectionIds))\n        gState.baseParams = setCurrentBaseParams(gState.collectionIds)\n        await overviewPanel.updateData()\n        updateOverviewTitle()\n        const activePanel = aggTabPanel.getActiveTab()\n        if (activePanel) {\n          await activePanel.updateData()\n        }\n      }\n      catch (e) {\n        SM.Error.handleError(e)\n      }\n    }\n\n    // handle periodic updates\n    async function updateData({ event } = {}) {\n      try {\n        // event = activate || tabchange || reload || updateData || refreshViews\n        const refreshViewsOnly = event === 'refreshviews'\n        const loadMasksDisabled = event === 'tabchange' || event === 'updatedata' || event === 'refreshviews'\n\n        clearTimeout(gState.refreshViewTimerId)\n        const promises = []\n\n        if (!refreshViewsOnly) {\n          clearTimeout(gState.updateDataTimerId)\n          gState.updateDataTimerId = gState.refreshViewTimerId = null\n\n          promises.push(updateFilterableCollections())\n\n          gState.updateDataTimerId = setTimeout(\n            updateData,\n            UPDATE_DATA_DELAY,\n            { event: 'updatedata' }\n          )\n        }\n        promises.push(overviewPanel.updateData({ refreshViewsOnly, loadMasksDisabled }))\n        const activePanel = aggTabPanel.getActiveTab()\n        if (activePanel) {\n          promises.push(activePanel.updateData({ refreshViewsOnly, loadMasksDisabled: activePanel.items.items[0].initialized ? loadMasksDisabled : false }))\n        }\n\n        const [unused0, apiMetricsCollection, unused1] = await Promise.all(promises)\n        updateOverviewTitle()\n\n        const refreshViewsDelay = calcRefreshDelay(apiMetricsCollection.metrics.maxTouchTs)\n        if (refreshViewsDelay < UPDATE_DATA_DELAY) {\n          gState.refreshViewTimerId = setTimeout(\n            updateData,\n            refreshViewsDelay,\n            { event: 'refreshviews' }\n          )\n        }\n      }\n      catch (e) {\n        console.log(e)\n      }\n    }\n    function cancelTimers() {\n      clearTimeout(gState.refreshViewTimerId)\n      clearTimeout(gState.updateDataTimerId)\n      gState.refreshViewTimerId = gState.updateDataTimerId = null\n    }\n\n    function calcRefreshDelay(maxTouchTs) {\n      // given maxTouchTs, calculate the interval to refresh the grids/toolbars\n      const diffSecs = Math.ceil(Math.abs(new Date() - new Date(maxTouchTs)) / 1000)\n      if (diffSecs < 3600) {\n        // 30s when maxTouchTs is < 1h \n        return 30 * 1000\n      }\n      if (diffSecs < 86400) {\n        // 1h when maxTouchTs is < 1d\n        return 3600 * 1000\n      }\n      // 1d\n      return 86400 * 1000\n    }\n  }\n  catch (e) {\n    SM.Error.handleError(e)\n  }\n}\n\nSM.MetaPanel.CollectionsMenu = Ext.extend(Ext.menu.Menu, {\n  initComponent: function () {\n    const _this = this\n    this.addEvents('applied')\n    const initialItems = this.initialCollectionIds.map( id => ({collectionId: id, checked: true, text: id}))\n    const config = {\n      items: initialItems,\n      listeners: {\n        itemclick: this.onItemClick,\n        hide: this.onMenuHide,\n        show: this.onMenuShow\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  },\n  isExcluded: function (collection) {\n    return collection.metadata['app.metaExcluded'] === '1'\n  },\n  onItemClick: function (item, e) {\n    if (item.hideOnClick) { // only the Apply item\n      this.isApplied = true\n      this.fireEvent('applied', this.getCheckedCollectionIds())\n    }\n  },\n  onMenuHide: function (menu) {\n    if (menu.isApplied) {\n      menu.isApplied = false\n      return\n    }\n    // if selections were not applied, reset items to their checked state when the menu was shown\n    if (menu.lastCheckedStatesObject) {\n      for (const item of this.items.items) {\n        if (item.xtype === 'menucheckitem') item.setChecked(!!menu.lastCheckedStatesObject[item.collectionId], true)\n      }\n    }\n  },\n  onMenuShow: function (menu) {\n    menu.lastCheckedStatesObject = menu.getCheckedStatesObject()\n  },\n  getCheckedStatesObject: function () {\n    return this.items.items.reduce( (agg, item) => {\n      if (item.collectionId) agg[item.collectionId] = item.checked\n      return agg\n    }, {} )\n  },\n  getCheckedCollectionIds: function () {\n    const checked = this.items.items.reduce(function (ids, item) {\n      if (item.checked) {\n        ids.push(item.collectionId)\n      }\n      return ids\n    }, [])\n    return checked\n  },\n  getCheckedCollections: function () {\n    const checked = this.items.items.reduce(function (checkedItems, item) {\n      if (item.checked) {\n        checkedItems.push(item)\n      }\n      return checkedItems\n    }, [])\n    return checked\n  },\n  getCollectionItemConfig: function (collection, checked = false) {\n    return {\n      xtype: 'menucheckitem',\n      hideOnClick: false,\n      text: SM.MetaPanel.CollectionTpl.apply(collection),\n      collectionId: collection?.collectionId ?? null,\n      collection,\n      checked,\n      listeners: {\n        checkchange: function (item, checked) {\n          item.parentMenu.fireEvent('itemcheckchanged', item, checked)\n        }\n      }\n    }\n  },\n  getTextItemConfig: function (text = '<b>FILTER</b>') {\n    return {\n      hideOnClick: false,\n      activeClass: '',\n      text,\n      iconCls: 'sm-menuitem-filter-icon',\n      cls: 'sm-menuitem-filter-label'\n    }\n  },\n  getSelectAllItemConfig: function () {\n    return {\n      xtype: 'menucheckitem',\n      hideOnClick: false,\n      text: '<i>(Select All)</i>',\n      collectionId: 'select-all',\n      checked: true,\n      collectionItems: [],\n      onCollectionItemChanged: function () {\n        const state = this.collectionItems.every(i => i.checked)\n        this.setChecked(state, true)\n      },\n      listeners: {\n        checkchange: function (item, checked) {\n          for (const collectionItem of item.collectionItems) {\n            collectionItem.setChecked(checked, false)\n          }\n        }\n      }\n    }\n  },\n  getActionItemConfig: function (text = '<b>Apply</b>') {\n    return {\n      xtype: 'menuitem',\n      text,\n      icon: 'img/change.svg'\n    }\n  },\n  setCollectionsChecked: function (collectionIds, checked) {\n    for (const collectionId of collectionIds) {\n      this.find('collectionId', collectionId)[0]?.setChecked(checked, true) //suppressEvent = true\n    }\n  },\n  updateCollection: function (collection) {\n    const item = this.find('collectionId', collection.collectionId)[0]\n    if (item) {\n      if (this.isExcluded(collection)) {\n        this.removeCollection(collection)\n      }\n      else {\n        item.collection = collection\n        item.setText(SM.MetaPanel.CollectionTpl.apply(collection))\n        this.items.sort('ASC', this.sorter)\n        this.rerender()\n      }\n    }\n  },\n  addCollection: function (collection) {\n    if (this.isExcluded(collection)) return\n    this.addItem(this.getCollectionItemConfig(collection))\n    this.items.sort('ASC', this.sorter)\n    this.rerender()\n  },\n  removeCollection: function (collectionId) {\n    const item = this.find('collectionId', collectionId)[0]\n    if (item) {\n      this.remove(item)\n    }\n  },\n  sorter: function (a, b) {\n    return a.name.localeCompare(b.name)\n  },\n  refreshItems: function (collections) {\n    const collectionIdSet = new Set(this.getCheckedCollectionIds())\n    this.removeAll()\n    if (this.showHeader) {\n      this.addItem(this.getTextItemConfig())\n    }\n    \n    // Add Apply button and Select All at the top\n    if (this.showApply) {\n      this.addItem(this.getActionItemConfig())\n      this.addItem('-')\n    }\n    const selectAllItem = this.addItem(this.getSelectAllItemConfig())\n    this.addItem('-')\n    \n    collections.sort(this.sorter)\n    \n    const collectionItems = []\n    for (const collection of collections) {\n      if (this.isExcluded(collection)) continue\n      const checked = collectionIdSet.has(collection.collectionId)\n      const collectionItem = this.addItem(this.getCollectionItemConfig(collection, checked))\n      \n      if (collectionItem) {\n        collectionItems.push(collectionItem)\n        // Set up listener to update Select All state when individual items change\n        collectionItem.on('checkchange', function() {\n          selectAllItem.onCollectionItemChanged()\n        })\n      }\n    }\n    \n    // Connect Select All with collection items\n    selectAllItem.collectionItems = collectionItems\n    selectAllItem.onCollectionItemChanged() // Initialize Select All state\n  },\n  rerender: function () {\n    if (this.rendered) {\n      this.el.remove()\n      delete this.el\n      delete this.ul\n      this.rendered = false\n      this.render()\n      this.doLayout.call(this, false, true)\n    }\n  }\n})\n\nSM.MetaPanel.SpriteHtml = `<span class=\"sm-collection-sprite {extraCls}\"\n    ext:qtip=\"{[SM.he(SM.he(values.description))]}\">\n    {[SM.he(values.name)]}\n    </span>`\n\nSM.MetaPanel.CollectionTpl = new Ext.XTemplate(\n  SM.MetaPanel.SpriteHtml\n)\n\n"
  },
  {
    "path": "client/src/js/SM/NavTree.js",
    "content": "Ext.ns('SM')\nExt.ns('SM.NavTree')\n\nSM.NavTree.NodeSorter = (a, b) => {\n  if (a.attributes.sortToTop) {\n    return -1\n  }\n  if (b.attributes.sortToTop) {\n    return 1\n  }\n  return a.text.toUpperCase() < b.text.toUpperCase() ? -1 : 1\n}\n\nSM.NavTree.CollectionLeafConfig = function (collection) {\n  const collectionGrant = curUser.collectionGrants.find( g => g.collection.collectionId === collection.collectionId )\n  let toolsEl = ''\n  if (collectionGrant && collectionGrant.roleId >= 3) {\n    toolsEl = '<img class=\"sm-tree-toolbar\" src=\"img/gear.svg\" width=\"12\" height=\"12\" ext:qtip=\"Manage Collection\">'\n  }\n  return {\n    id: `${collection.collectionId}-collection-leaf`,\n    leaf: true,\n    leafType: 'collection',\n    text: SM.he(collection.name) + toolsEl,\n    collectionId: collection.collectionId,\n    collectionName: collection.name,\n    iconCls: 'sm-collection-icon',\n    listeners: {\n      beforeclick: function (n, e) {\n        if (e.target.className === \"sm-tree-toolbar\") {\n          addCollectionManager({\n            collectionId: n.attributes.collectionId,\n            collectionName: n.attributes.collectionName,\n            treePath: n.getPath()\n          })\n          return false\n        }\n        return true\n      }\n    }\n  }\n}\n\nSM.NavTree.LibraryStigNodeConfig = function (stig) {\n  return {\n    id: `library-${stig.benchmarkId}-leaf`,\n    text: SM.he(stig.benchmarkId),\n    leaf: true,\n    report: 'library',\n    iconCls: 'sm-stig-icon',\n    benchmarkId: stig.benchmarkId,\n    lastRevisionStr: stig.lastRevisionStr,\n    stigTitle: stig.title,\n    qtip: SM.he(stig.title)\n  }\n}\n\nSM.NavTree.LibraryNodesConfig = function (stigs) {\n  const aeRegEx = /^[a-e]/i\n  const fmRegEx = /^[f-m]/i\n  const nvRegEx = /^[n-v]/i\n  const wzRegEx = /^[w-z]/i\n\n  const children = [\n    {\n      id: `library-a-e-folder`,\n      text: 'A-E',\n      iconCls: 'sm-folder-icon',\n      children: stigs.filter( stig => aeRegEx.test(stig.benchmarkId)).map( stig => SM.NavTree.LibraryStigNodeConfig(stig))\n    },\n    {\n      id: `library-f-m-folder`,\n      text: 'F-M',\n      iconCls: 'sm-folder-icon',\n      children: stigs.filter( stig => fmRegEx.test(stig.benchmarkId)).map( stig => SM.NavTree.LibraryStigNodeConfig(stig))\n    },\n    {\n      id: `library-n-v-folder`,\n      text: 'N-V',\n      iconCls: 'sm-folder-icon',\n      children: stigs.filter( stig => nvRegEx.test(stig.benchmarkId)).map( stig => SM.NavTree.LibraryStigNodeConfig(stig))\n    },\n    {\n      id: `library-w-z-folder`,\n      text: 'W-Z',\n      iconCls: 'sm-folder-icon',\n      children: stigs.filter( stig => wzRegEx.test(stig.benchmarkId)).map( stig => SM.NavTree.LibraryStigNodeConfig(stig))\n    }\n  ]\n  const multiRevisionStigs = stigs.filter( stig => stig.revisionStrs.length > 1 )\n  if (multiRevisionStigs.length) {\n    children.unshift({\n      id: 'library-diff-leaf',\n      action: 'stig-diff',\n      text: 'Compare revisions',\n      iconCls: 'sm-diff-icon',\n      multiRevisionStigs,\n      leaf: true\n    })\n  }\n  return children\n}\n\nSM.NavTree.TreePanel = Ext.extend(Ext.tree.TreePanel, {\n    initComponent: function() {\n      let me = this\n      this.getCollectionLeaf = function (collectionId) {\n        return me.getNodeById('collections-root').findChild('id', `${collectionId}-collection-leaf`, true)\n      }\n\n      this.onCollectionCreated = function (apiCollection, options) {\n        const collectionGrant = curUser.collectionGrants.find( g => g.collection.collectionId === apiCollection.collectionId )\n        if (collectionGrant) {\n          let collectionRoot = me.getNodeById('collections-root')\n          let newLeaf = collectionRoot.appendChild( SM.NavTree.CollectionLeafConfig( apiCollection ) )\n          function sortFn (a, b) {\n            if (a.attributes.id === 'collection-create-leaf') {\n              return -1\n            }\n            if (b.attributes.id === 'collection-create-leaf') {\n              return 1\n            }\n            if (a.text.toUpperCase() < b.text.toUpperCase()) {\n              return -1\n            }\n            if (a.text.toUpperCase() > b.text.toUpperCase()) {\n              return 1\n            }\n            return 0\n          }\n          collectionRoot.sort(sortFn)\n          if (options.showManager) {\n            me.selectPath(newLeaf.getPath(), undefined, (bSuccess, oSelNode) => {\n              if (bSuccess) {\n                oSelNode.getUI().elNode.querySelector('.sm-tree-toolbar')?.click()\n              }\n            })\n          }\n        }\n      }\n\n      this.sortNodes = (a, b) => a.text < b.text ? -1 : 1\n\n      this.onCollectionChanged = function (apiCollection) {\n        function sortFn (a, b) {\n          if (a.attributes.id === 'collection-create-leaf') {\n            return -1\n          }\n          if (b.attributes.id === 'collection-create-leaf') {\n            return 1\n          }\n          if (a.text.toUpperCase() < b.text.toUpperCase()) {\n            return -1\n          }\n          if (a.text.toUpperCase() > b.text.toUpperCase()) {\n            return 1\n          }\n          return 0\n        }\n        const collectionLeaf = me.getCollectionLeaf(apiCollection.collectionId)\n        if (collectionLeaf) {\n          collectionLeaf.collectionName = apiCollection.name\n          const text = SM.he(collectionLeaf.collectionName) + '<img class=\"sm-tree-toolbar\" src=\"img/gear.svg\" width=\"12\" height=\"12\" ext:qtip=\"Manage Collection\">'\n          collectionLeaf.setText(text)\n          collectionLeaf.parentNode.sort(sortFn)\n        }\n      }\n      this.onCollectionDeleted = function (collectionId) {\n        const collectionLeaf = me.getCollectionLeaf(collectionId)\n        if (collectionLeaf) {\n          collectionLeaf.remove()\n        }\n      }\n\n      this.onThemeChanged = function (theme, source) {\n        if (source === 'broadcast') {\n          // Update the dark mode checkbox state if the interface node is expanded\n          const interfaceNode = me.getRootNode()?.findChild('id', 'interface-root')\n          if (interfaceNode?.expanded) {\n            const darkModeNode = interfaceNode.findChild('id', 'dark-mode')\n            darkModeNode && (darkModeNode.ui.checkbox.checked = theme === 'dark')\n          }\n        }\n      }\n\n      this.getApiStig = async (benchmarkId) => {\n        try {\n          let result = await Ext.Ajax.requestPromise({\n            url: `${STIGMAN.Env.apiBase}/stigs/${benchmarkId}`,\n            method: 'GET'\n          })\n          return JSON.parse(result.response.responseText)\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n      }\n\n      let config = {\n        autoScroll: true,\n        split: true,\n        collapsible: true,\n        collapseFirst: false,\n        tools: [\n          {\n            id: 'logout',\n            qtip: 'Logout session',\n            handler: window.oidcWorker.logout.bind(window.oidcWorker),\n          },\n        ],\n        title: `${curUser.displayName === 'USER' ? SM.he(curUser.username) : SM.he(curUser.displayName)}`,\n        bodyStyle: 'padding:5px;',\n        width: me.width || 300,\n        minSize: 220,\n        root: {\n          nodeType: 'async',\n          id: 'stigman-root',\n          expanded: true\n        },\n        rootVisible: false,\n        loader: new Ext.tree.TreeLoader({\n          directFn: me.loadTree\n        }),\n        loadMask: 'Loading...',\n        listeners: {\n          click: me.treeClick,\n          render: this.treeRender,\n          collapsenode: function (n) {\n            n.loaded = false; // always reload from the server\n          }\n        }\n      }\n\n      Ext.apply(this, Ext.apply(this.initialConfig, config))\n      SM.NavTree.TreePanel.superclass.initComponent.call(this)\n\n      // Attach handlers for app events\n      SM.Dispatcher.addListener('collectioncreated', this.onCollectionCreated)\n      SM.Dispatcher.addListener('collectionchanged', this.onCollectionChanged)\n      SM.Dispatcher.addListener('collectiondeleted', this.onCollectionDeleted)\n      SM.Dispatcher.addListener('themechanged', this.onThemeChanged)\n    },\n    loadTree: async function (node, cb) {\n        try {\n          // Root node\n          if (node == 'stigman-root') {\n            let content = []\n            if (curUser.privileges.admin) {\n              const children = [\n                {\n                  id: 'collection-admin',\n                  text: 'Collections',\n                  leaf: true,\n                  iconCls: 'sm-collection-icon'\n                },\n                {\n                  id: 'user-admin',\n                  text: 'Users',\n                  leaf: true,\n                  iconCls: 'sm-user-icon'\n                },\n                {\n                  id: 'user-group-admin',\n                  text: 'User Groups',\n                  leaf: true,\n                  iconCls: 'sm-users-icon'\n                },\n                {\n                  id: 'stig-admin',\n                  text: 'STIG Benchmarks',\n                  leaf: true,\n                  iconCls: 'sm-stig-icon'\n                },\n                {\n                  id: 'job-admin',\n                  text: 'Service Jobs',\n                  leaf: true,\n                  iconCls: 'sm-job-icon'\n                },\n                {\n                  id: 'appinfo-admin',\n                  text: 'Application Info',\n                  leaf: true,\n                  iconCls: 'sm-info-circle-icon'\n                },\n              ]\n              if (STIGMAN.Env.experimental.logStream === 'true') {\n                children.push({\n                  id: 'logstream-admin',\n                  text: 'Log Stream <span class=\"sm-navtree-sprite\">experimental</span>',\n                  leaf: true,\n                  iconCls: 'sm-logs-icon'\n                })\n              }\n              if (STIGMAN.Env.experimental.appData === 'true') {\n                children.push({\n                    id: 'appdata-admin',\n                    text: 'Export/Import Data <span class=\"sm-navtree-sprite\">experimental</span>',\n                    leaf: true,\n                    iconCls: 'sm-database-save-icon'\n                  })\n              }\n              content.push(\n                {\n                  id: `admin-root`,\n                  node: 'admin',\n                  text: 'Application Management',\n                  iconCls: 'sm-setting-icon',\n                  expanded: false,\n                  children\n                }\n              )\n            }\n            content.push(\n              {\n                id: `collections-root`,\n                node: 'collections',\n                text: 'Collections<img class=\"sm-tree-toolbar sm-tree-toolbar-persistent\" src=\"img/grid.svg\" width=\"12\" height=\"12\" ext:qtip=\"Meta Dashboard\">',\n                iconCls: 'sm-collection-icon',\n                expanded: true,\n                listeners: {\n                  beforeclick: function (n, e) {\n                    if (e.target.className === \"sm-tree-toolbar sm-tree-toolbar-persistent\") {\n                      SM.MetaPanel.showMetaTab({\n                        treePath: n.getPath(),\n                        initialCollectionIds: SM.safeJSONParse(localStorage.getItem('metaCollectionIds')) ?? []\n                      })\n                      return false\n                    }\n                    return true\n                  }\n                }\n              }\n            )\n            content.push(\n              {\n                id: `library-root`,\n                node: 'library',\n                text: 'STIG Library',\n                iconCls: 'sm-library-icon',\n                expanded: false\n              }\n            )\n            content.push(\n              {\n                id: `interface-root`,\n                node: 'theme',\n                text: 'Interface',\n                iconCls: 'sm-setting-icon',\n                expanded: false,\n              }\n            )\n            cb(content, { status: true })\n            return\n          } else if (node === 'library-root') {\n            const apiStigs = await Ext.Ajax.requestPromise({\n              responseType: 'json',\n              url: `${STIGMAN.Env.apiBase}/stigs?projection=revisions`,\n              method: 'GET'\n            })\n            let content = SM.NavTree.LibraryNodesConfig(apiStigs)\n            cb(content, { status: true })\n            return\n          } else if (node === 'collections-root') {\n            const collectionMap = await SM.Cache.getCollections()\n            const apiCollections = [...collectionMap.values()].sort((a, b) => a.name.localeCompare(b.name))\n            let content = apiCollections.map(collection => SM.NavTree.CollectionLeafConfig(collection))\n            if (curUser.privileges.create_collection) {\n              content.unshift({\n                id: `collection-create-leaf`,\n                action: 'collection-create',\n                text: 'Create Collection...',\n                cls: 'sm-tree-node-create',\n                iconCls: 'sm-add-icon',\n                qtip: 'Create a new STIG Manager Collection',\n                leaf: true\n              })\n            }\n            cb(content, { status: true })\n            return\n          } else if (node === 'interface-root') {\n            const content = [\n              {\n                id: 'whats-new',\n                text: \"What's New\",\n                iconCls: 'sm-stig-icon',\n                leaf: true\n              },\n              {\n                id: 'dark-mode',\n                text: 'Dark mode',\n                leaf: true,\n                checked: curUser?.webPreferences?.darkMode,\n                iconCls: 'sm-dark-mode-icon',\n                listeners: {\n                  //beforeclick gets click events on the text of the node, but not checkbox clicks\n                  beforeclick: function (node) {\n                    //toggle the checkbox state\n                    node.ui.checkbox.checked = !node.ui.checkbox.checked\n                    // Fire checkchange event manually to centralize the theme change logic\n                    node.fireEvent('checkchange', node, node.ui.checkbox.checked)\n                    return false\n                  },\n                  // checkchange captures the click event on the checkbox, then fires the themechanged event\n                  checkchange: function (node, checked) {\n                    SM.Dispatcher.fireEvent('themechanged', checked ? 'dark' : 'light', 'local')\n                  }\n                }\n              }\n            ]\n            cb(content, { status: true })\n            return\n          }\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n    },\n    treeClick: function (n, e) {      \n        if (!n.leaf) {\n          return\n        }\n        SM.Global.mainNavTree.ownerCt.layout.west.slideIn()\n        const treePath = n.getPath()\n\n        if (n.attributes.action === 'stig-diff') {\n          SM.Library.showDiffPanel({\n            multiRevisionStigs: n.attributes.multiRevisionStigs,\n            treePath\n          })\n          return\n        }\n        if (n.attributes.leafType === 'collection') {\n          SM.CollectionPanel.showCollectionTab({\n            collectionId: n.attributes.collectionId,\n            collectionName: n.attributes.collectionName,\n            treePath\n          })\n          return\n        }\n        if (n.attributes.report == 'library') {\n          addLibraryStig({\n            benchmarkId: n.attributes.benchmarkId,\n            revisionStr: n.attributes.lastRevisionStr,\n            stigTitle: n.attributes.stigTitle,\n            treePath\n          })\n        }\n        if (n.attributes.action == 'collection-create') {\n          SM.Manage.Collection.showCreateWindow()\n          return\n        }\n        if (n.attributes.action == 'collection-management') {\n          addCollectionManager({\n            collectionId: n.attributes.collectionId,\n            collectionName: n.attributes.collectionName,\n            treePath\n          })\n        }\n\n        switch (n.id) {\n          case 'collection-admin':\n            addCollectionAdmin({ treePath })\n            break\n          case 'user-admin':\n            SM.User.showUserAdmin({ treePath })\n            break\n          case 'user-group-admin':\n            SM.UserGroup.addUserGroupAdmin({ treePath })\n            break\n          case 'stig-admin':\n            addStigAdmin({ treePath })\n            break\n          case 'job-admin':\n            SM.Job.showJobAdminTab({treePath: n.getPath()})\n            break\n          case 'appinfo-admin':\n            SM.AppInfo.showAppInfoTab({treePath: n.getPath()})\n            break\n          case 'logstream-admin':\n            SM.LogStream.showLogTab({ treePath })\n            break\n          case 'appdata-admin':\n            SM.AppData.showAppDataTab({ treePath })\n            break\n          case 'whats-new':\n            SM.WhatsNew.addTab({ treePath })\n            break\n        }\n\n    },\n    treeRender: function (tree) {\n      new Ext.ToolTip({\n          target: tree.header.dom.querySelector(`.${tree.headerTextCls}`),\n          showDelay: 1000,\n          dismissDelay: 0,\n          width: 600,\n          title: 'OAuth2 token payload',\n          listeners: {\n              show: function (tip) {\n                let tokenParsed = { ...window.oidcWorker.tokenParsed }\n                let expDate = new Date(tokenParsed.exp*1000)\n                let iatDate = new Date(tokenParsed.iat*1000)\n                let authTimeDate = new Date(tokenParsed.auth_time*1000)\n                tokenParsed.exp = `${tokenParsed.exp} (${expDate.format('Y-m-d H:i:s')})`\n                tokenParsed.iat = `${tokenParsed.iat} (${iatDate.format('Y-m-d H:i:s')})`\n                tokenParsed.auth_time = `${tokenParsed.auth_time} (${authTimeDate.format('Y-m-d H:i:s')})`\n                const pre = document.createElement('pre')\n                pre.style.whiteSpace = 'pre-wrap'\n                pre.textContent = JSON.stringify(tokenParsed, null, 2)\n                tip.body.dom.replaceChildren(pre)\n              }\n          }\n      }).getId() //for sonarcloud to see object used\n  }\n\n})"
  },
  {
    "path": "client/src/js/SM/Review.js",
    "content": "Ext.ns('SM.Review.Form')\n\nSM.Review.Form.ResultCombo = Ext.extend(Ext.form.ComboBox, {\n  initComponent: function () {\n    const _this = this\n    const config = {\n      triggerClass: 'sm-review-trigger',\n      disabledClass: 'sm-review-item-disabled',\n      width: 100,\n      lastSavedData: \"\",\n      cls: 'sm-review-combo-input',\n      changed: false,\n      fieldLabel: 'Result<i class= \"fa fa-question-circle sm-question-circle\"></i>',\n      labelSeparator: '',\n      emptyText: 'Your result...',\n      name: 'result',\n      hiddenName: 'result',\n      mode: 'local',\n      triggerAction: 'all',\n      editable: false,\n      store: new Ext.data.SimpleStore({\n        fields: ['result', 'resultStr'],\n        data: [\n          ['pass', 'Not a Finding'],\n          ['notapplicable', 'Not Applicable'],\n          ['fail', 'Open'],\n          ['informational', 'Informational'],\n          ['notchecked', 'Not Reviewed']\n        ]\n      }),\n      valueField: 'result',\n      displayField: 'resultStr',\n      listeners: {\n        render: function (combo) {\n          new Ext.ToolTip({\n            target: combo.label.dom.getElementsByClassName('fa')[0],\n            showDelay: 0,\n            dismissDelay: 0,\n            autoWidth: true,\n            html: SM.ResultTipText\n          }).getId() // for sonarcloud\n        }\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.Review.Form.ResultCombo.superclass.initComponent.call(this)\n  }\n})\n\nSM.Review.Form.DetailTextArea = Ext.extend(Ext.form.TextArea, {\n  //onInput: handler for element's input event\n  //infoTip: tooltip attached to question circle\n  initComponent: function () {\n    const _this = this\n    const config = {\n      cls: 'sm-review-result-textarea',\n      lastSavedData: \"\",\n      allowBlank: true,\n      // emptyText: 'Please address the specific items in the review.',\n      fieldLabel: this.initialConfig.fieldLabel || 'Detail<i class= \"fa fa-question-circle sm-question-circle\"></i>',\n      labelSeparator: '',\n      autoScroll: 'auto',\n      name: 'detail',\n      enableKeyEvents: true,\n      listeners: {\n        render: function (ta) {\n          ta.el.dom.maxLength = 32767\n           if (!_this.readOnly) {\n            ta.mon( ta.el, 'input', _this.onInput)\n            _this.infoTip = new Ext.ToolTip({\n              target: ta.label.dom.getElementsByClassName('fa')[0],\n              showDelay: 0,\n              dismissDelay: 0,\n              autoWidth: true,\n              tpl: SM.DetailTipTpl,\n              data: _this.fieldSettings.detail\n            }) \n          }\n        }\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.Review.Form.DetailTextArea.superclass.initComponent.call(this)\n  }\n})\n\nSM.Review.Form.CommentTextArea = Ext.extend(Ext.form.TextArea, {\n  initComponent: function () {\n    const _this = this\n    const config = {\n      cls: 'sm-review-action-textarea',\n      lastSavedData: \"\",\n      allowBlank: true,\n      fieldLabel: this.initialConfig.fieldLabel || 'Comment<i class= \"fa fa-question-circle sm-question-circle\"></i>',\n      labelSeparator: '',\n      autoScroll: 'auto',\n      name: 'comment',\n      listeners: {\n        'render': function (ta) {\n          ta.el.dom.maxLength = 32767\n          if (!_this.readOnly) {\n            ta.mon(ta.el, 'input', _this.onInput)\n            _this.infoTip = new Ext.ToolTip({\n              target: ta.label.dom.getElementsByClassName('fa')[0],\n              showDelay: 0,\n              dismissDelay: 0,\n              autoWidth: true,\n              tpl: SM.CommentTipTpl,\n              data: _this.fieldSettings.comment\n            }) \n          }\n        }\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.Review.Form.ResultEngineSprite = Ext.extend(Ext.form.DisplayField, {\n  generateMarkup: function(resultEngine) {\n    if (!resultEngine) return `<span class=\"sm-result-engine-sprite\">Manual</span>`\n    const productSpan = `<span class=\"sm-result-engine-sprite\">${SM.he(resultEngine.product)}</span>`\n    const overrideSpan = resultEngine.overrides?.length ? `<span class=\"sm-result-override-sprite\">Override</span>` : ''\n    return `${productSpan}${overrideSpan}`\n  },\n  setRawValue : function(v){\n    this.value = v\n    if (this.rendered) {\n      const displayValue = this.generateMarkup(v)\n      this.el.dom.innerHTML = displayValue\n    }\n    return this.value\n  },\n  getRawValue : function(){\n    return this.value\n  },\n  initComponent: function () {\n    const _this = this\n    const config = {\n      name: 'resultEngine',\n      cls: 'sm-result-engine-span',\n      hideLabel: true,\n      listeners: {\n        render: function (ta) {\n            ta.sm_tooltip = new Ext.ToolTip({\n                target: ta.el.dom,\n                delegate: 'span', // target of the mouseover\n                showDelay: 0,\n                dismissDelay: 0,\n                renderTo: Ext.getBody(),\n                tplResultEngine: new Ext.XTemplate(\n                  '<span>',\n                  '<tpl if=\"values.version\">',\n                    '<b>Version</b><br>{values.version}<br>',\n                  '</tpl>',\n                  '<tpl if=\"values.time\">',\n                    '<b>Time</b><br>{[Ext.util.Format.date(values.time, \"Y-m-d H:i T\")]}<br>',\n                  '</tpl>',\n                  '<tpl if=\"values.checkContent\">',\n                    '<b>Check content</b><br>{values.checkContent.location}',\n                  '</tpl>',\n                  '</span>'\n                ),\n                tplOverride: new Ext.XTemplate(\n                  '<span>',\n                    '<tpl for=\"overrides\">',\n                      '<tpl if=\"oldResult\">',\n                        '<b>Original result</b><br>',\n                        '{[this.getResultSprite(values.oldResult)]}<br><br>',\n                      '</tpl>',\n                      '<tpl if=\"authority\">',\n                        '<b>Overridden by</b><br>{authority}<br><br>',\n                      '</tpl>',\n                      '<tpl if=\"remark\">',\n                        '<b>Remark</b><br>{remark}<br>',\n                      '</tpl>',\n                    '</tpl>',\n                  '</span>',\n                  {\n                    getResultSprite: function(val) {\n                      return `<span class=\"sm-tooltip-result-sprite ${SM.RenderResult[val]?.css}\">${SM.RenderResult[val]?.textDisa}</span>`\n                    }\n                  }\n                ),\n                listeners: {\n                  beforeshow: function updateTipBody(tip) {\n                    const tpl = tip.triggerElement.className === 'sm-result-engine-sprite' ? tip.tplResultEngine : tip.tplOverride\n                    if (_this.value) {\n                      tip.update(tpl.apply(_this.value))\n                      return true\n                    }\n                    else {\n                      return false\n                    }\n                  }\n                }\n            })\n        }\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.Review.Form.ResultEngineSprite.superclass.initComponent.call(this)\n  }\n})\n\nSM.Review.Form.EvaluatedAttributions = Ext.extend(Ext.form.DisplayField, {\n\n  formatValue: function (v) {\n    const otherRules = v.ruleIds.filter(item => item !== v.ruleId).join('<br>')\n    this.setValue(\n      `<span class=\"sm-review-sprite sm-review-sprite-date\">${new Date(v.ts).format('Y-m-d H:i T')}</span>\n       <span class=\"sm-review-sprite sm-review-sprite-user\">${v.username}</span>\n       <span class=\"sm-review-sprite sm-review-sprite-rule\" ${otherRules ? `ext:qtip=\"${otherRules}\" ext:qdmdelay=\"60000\" ext:qwidth=\"200\" ext:qtitle=\"Also applies to:\"` : ''}>${v.ruleId}</span>`\n    )\n  },\n\n  initComponent: function () {\n    const config = {\n      name: 'editStr',\n      fieldLabel: 'Evaluated',\n      hideLabel: false,\n      allowBlank: true,\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n    if (this.value) {\n      this.formatValue(this.value)\n    }\n  }\n})\n\nSM.Review.Form.StatusedAttributions = Ext.extend(Ext.form.DisplayField, {\n \n  formatValue: function (v) {\n    this.setValue(\n      `<span class=\"sm-review-sprite sm-review-sprite-date\">${new Date(v.ts).format('Y-m-d H:i T')}</span>\n       <span class=\"sm-review-sprite sm-review-sprite-user\">${v.user.username}</span>\n       <span class=\"sm-review-sprite sm-review-sprite-${v.label}\"></span>`\n    )\n  },\n\n  initComponent: function () {\n    const config = {\n      name: 'status',\n      fieldLabel: 'Statused',\n      hideLabel: false,\n      allowBlank: true,\n    }\n      \n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n    if (this.value) {\n      this.formatValue(this.value)\n    }\n  }\n})\n\nSM.Review.Form.Panel = Ext.extend(Ext.form.FormPanel, {\n  initComponent: function () {\n    const _this = this\n    const ack = new SM.Review.Form.ResultEngineSprite(\n      {\n        style: {\n          marginLeft: '10px'\n        }\n      }\n    )\n    const rcb = new SM.Review.Form.ResultCombo({ \n      // hideLabel: true,\n      listeners: {\n        select: function () {\n          if (ack.lastSavedData) {\n            if (this.value !== this.lastSavedData) {\n              ack.setValue(null)\n            } else {\n              ack.setValue(ack.lastSavedData)\n            }\n          }\n          setReviewFormItemStates()\n        }\n      }\n    })\n    const dta = new SM.Review.Form.DetailTextArea({\n      anchor: '100%, 50%',\n      fieldSettings: _this.fieldSettings,\n      onInput: function (e) {\n        _this.setReviewFormItemStates()\n      },\n      listeners: {\n        focus: function (field) {\n          field.addClass('sm-field-focus')\n        },\n        blur: function (field) {\n            field.removeClass('sm-field-focus')\n        }\n      }\n    })\n    const cta = new SM.Review.Form.CommentTextArea({ \n      anchor: '100%, 50%',\n      fieldSettings: _this.fieldSettings,\n      onInput: function (e) {\n        _this.setReviewFormItemStates()\n      },\n      listeners: {\n        focus: function (field) {\n          field.addClass('sm-field-focus')\n        },\n        blur: function (field) {\n            field.removeClass('sm-field-focus')\n        }\n      }\n    })\n    const mdf = new SM.Review.Form.EvaluatedAttributions({})\n    const sdf = new SM.Review.Form.StatusedAttributions({})\n\n    const btn1 = new Ext.Button({\n      hidden: true,\n      hideMode: 'visibility',\n      handler: this.btnHandler\n    })\n    const btn2 = new Ext.Button({\n      hidden: true,\n      hideMode: 'visibility',\n      handler: this.btnHandler\n    })\n\n    let statusLabel = ''\n    let access = _this.defaultAccess\n\n    function reviewChanged () {\n      return (\n        rcb.lastSavedData != rcb.value) \n        || (ack.lastSavedData != ack.getValue()) \n        || (dta.lastSavedData != dta.getValue()) \n        || (cta.lastSavedData != cta.getValue()\n      )\n    }\n\n    this.resultChanged = function () {\n      return rcb.lastSavedData != rcb.value\n    }\n\n    function loadValues (values) {\n      const form = _this.getForm()\n      form.setValues.call(form, values)\n      statusLabel = values.status?.label ?? ''\n      access = values.access ?? _this.defaultAccess\n      if (values.ts && values.username) {\n        mdf.formatValue(values)\n      }\n      else {\n        mdf.setValue('--')\n      }\n      if (values.status) {\n        sdf.formatValue(values.status)\n      }\n      else {\n        sdf.setValue('--')\n      }\n      initLastSavedData()\n    }\n\n    function initLastSavedData () {\n      if ( rcb.value === null ) { rcb.value = '' }\n      ack.lastSavedData = ack.getValue()\n      rcb.lastSavedData = rcb.value\n      dta.lastSavedData = dta.getValue()\n      cta.lastSavedData = cta.getValue()\n    }\n\n    function isReviewSubmittable () {\n      if (access != 'rw') return false\n      if (!rcb.value) return false\n      if (rcb.value !== 'pass' && rcb.value !== 'fail' && rcb.value !== 'notapplicable') return false\n      if (_this.fieldSettings.detail.required === 'always' && !dta.getValue()) return false\n      if (_this.fieldSettings.detail.required === 'findings' \n        && rcb.value === 'fail'\n        && !dta.getValue()) return false\n      if (_this.fieldSettings.comment.required === 'always'\n        && (!cta.getValue())) return false\n      if (_this.fieldSettings.comment.required === 'findings'\n        && rcb.value === 'fail'\n        && (!cta.getValue())) return false\n      return true\n    }\n\n    function setReviewFormTips () {\n      const fields = [dta, cta]\n      for (const f of fields) {\n        f.fieldSettings = _this.fieldSettings\n        if (f.infoTip.body) {\n          f.infoTip.update(_this.fieldSettings)\n        }\n        else {\n          f.infoTip.data = f.fieldSettings\n        }\n      }\n    }\n    \n    function setReviewFormItemStates () {\n      const resultCombo = rcb\n      const detailTextArea = dta\n      const commentTextArea = cta\n      const autoResultField = ack\n      const fp = _this\n      const fieldSettings = _this.fieldSettings\n\n      // Initial state: Enable the entry fields if the review status is 'In progress' or 'Rejected', disable them otherwise\n      const editable = access == 'rw' && (statusLabel === '' || statusLabel === 'saved' || statusLabel === 'rejected')\n      resultCombo.setDisabled(!editable) // disable if not editable\n      resultCombo.setReadOnly(!editable) // disable if not editable\n      detailTextArea.setDisabled(!editable)\n      commentTextArea.setDisabled(!editable)\n      btn1.setDisabled(!editable)\n      btn2.setDisabled(!editable)\n\n      if (editable) {\n        if (fieldSettings.detail.enabled === 'always') {\n          detailTextArea.enable()\n        } \n        else if (fieldSettings.detail.enabled === 'findings') {\n          if (resultCombo.value === 'fail') {\n            detailTextArea.enable()\n          }\n          else {\n            detailTextArea.disable()\n          }\n        } \n        \n        if (fieldSettings.comment.enabled === 'always') {\n          commentTextArea.enable()\n        } \n        else if (fieldSettings.comment.enabled === 'findings') {\n          if (resultCombo.value === 'fail') {\n            commentTextArea.enable()\n          }\n          else {\n            commentTextArea.disable()\n          }\n        } \n        \n        if (resultCombo.value === '' || resultCombo.value === undefined || resultCombo.value === null) {\n          detailTextArea.disable()\n          commentTextArea.disable()\n        }\n      }\n\n      btn1.setVisible(access === 'rw')\n      btn2.setVisible(true)\n      if (access !== 'rw') {\n        btn2.disable()\n        btn2.setText('Read only')\n        btn2.setIconClass('sm-read-only-icon')\n      }\n      else if (isReviewSubmittable()) {\n        btn1.show()\n        if (fp.reviewChanged()) {\n          // review has been changed (is dirty)\n          switch (statusLabel) {\n            case '':\n            case 'saved':\n              // button 1\n              btn1.enable()\n              btn1.setText('Save without submitting')\n              btn1.setIconClass('sm-disk-icon')\n              btn1.actionType = 'save'\n              btn1.setTooltip('')\n              // button 2\n              btn2.enable()\n              btn2.setText('Save and Submit')\n              btn2.setIconClass('sm-ready-icon')\n              btn2.actionType = 'save and submit'\n              btn2.setTooltip('')\n              break\n            case 'submitted': // 'ready' (a.k.a 'submitted'), dirty review can't happen\n              break\n            case 'rejected': // 'rejected'\n              // button 1\n              btn1.enable()\n              btn1.setText('Save without submitting')\n              btn1.setIconClass('sm-disk-icon')\n              btn1.actionType = 'save'\n              btn1.setTooltip('')\n              // button 2\n              btn2.enable()\n              btn2.setText('Save and Resubmit')\n              btn2.setIconClass('sm-ready-icon')\n              btn2.actionType = 'save and submit'\n              btn2.setTooltip('')\n              break\n            case 'accepted': // 'approved', dirty review can't happen\n              break\n          }\n        } \n        else {\n          // review has not been changed (is in last saved state)\n          switch (statusLabel) {\n            case '':\n            case 'saved': // in progress\n              // button 1\n              btn1.disable()\n              btn1.setText('Save without submitting')\n              btn1.setIconClass('sm-disk-icon')\n              btn1.actionType = ''\n              btn1.setTooltip('This button is disabled because the review has not been modified.')\n              // button 2\n              btn2.enable()\n              btn2.setText('Submit')\n              btn2.setIconClass('sm-ready-icon')\n              btn2.actionType = 'submit'\n              btn2.setTooltip('')\n              break\n            case 'submitted': // ready\n              // button 1\n              btn1.enable()\n              btn1.setText('Unsubmit')\n              btn1.setIconClass('sm-disk-icon')\n              btn1.actionType = 'unsubmit'\n              btn1.setTooltip('')\n              // button 2\n              if (_this.canAccept) {\n                btn2.enable()\n                btn2.setText('Accept')\n                btn2.setIconClass('sm-star-icon-16')\n                btn2.actionType = 'accept'\n                btn2.setTooltip('')\n              }\n              else {\n                btn2.disable()\n                btn2.setText('Submit')\n                btn2.setIconClass('sm-ready-icon')\n                btn2.actionType = ''\n                btn2.setTooltip('This button is disabled because the review has already been submitted.')\n              }\n              break\n            case 'accepted':\n              // button 1\n              btn1.enable()\n              btn1.setText('Unsubmit')\n              btn1.setIconClass('sm-disk-icon')\n              btn1.actionType = 'unsubmit'\n              btn1.setTooltip('')\n              // button 2\n              btn2.disable()\n              btn2.setText('Accept')\n              btn2.setIconClass('sm-star-icon-16')\n              btn2.actionType = ''\n              btn2.setTooltip('This button is disabled because the review has already been accepted.')\n              break\n            case 'rejected': // rejected\n              // button 1\n              btn1.disable()\n              btn1.setText('Save without submitting')\n              btn1.setIconClass('sm-disk-icon')\n              btn1.actionType = ''\n              btn1.setTooltip('This button is disabled because the review has not been modified.')\n              // button 2\n              btn2.disable()\n              btn2.setText('Save and Resubmit')\n              btn2.setIconClass('sm-ready-icon')\n              btn2.actionType = ''\n              btn2.setTooltip('This button is disabled because the review has not been modified.')\n              break\n          }\n        }\n      } \n      else {\n        // review is incomplete\n        if (fp.reviewChanged()) {\n          // review has been changed\n          // button 1\n          btn1.enable()\n          btn1.setText('Save without submitting')\n          btn1.setIconClass('sm-disk-icon')\n          btn1.actionType = 'save and unsubmit'\n          btn1.setTooltip('')\n          // button 2\n          btn2.disable()\n          btn2.setText('Save and Submit')\n          btn2.setIconClass('sm-ready-icon')\n          btn2.actionType = ''\n          btn2.setTooltip('This button is disabled because the review is not complete and cannot be submitted.')\n        } \n        else {\n          // review has not been changed (as loaded)\n          // button 1\n          if (statusLabel === 'submitted') {\n            btn1.enable()\n            btn1.setText('Unsubmit')\n            btn1.setIconClass('sm-disk-icon')\n            btn1.actionType = 'unsubmit'\n            btn1.setTooltip('')\n          }\n          else {\n            btn1.disable()\n            btn1.setText('Save without submitting')\n            btn1.setIconClass('sm-disk-icon')\n            btn1.actionType = ''\n            btn1.setTooltip('This button is disabled because the review has not been modified.')\n          }\n          // button 2\n          btn2.disable()\n          btn2.setText('Save and Submit')\n          btn2.setIconClass('sm-ready-icon')\n          btn2.actionType = ''\n          btn2.setTooltip('This button is disabled because the review is not complete and cannot be submitted.')\n        }\n      }      \n    }\n    \n    let config = {\n      cls: 'sm-round-panel',\n      bodyCssClass: 'sm-review-form',\n      footerCssClass: 'sm-review-footer',\n      labelWidth: 65,\n      border: false,\n      isLoaded: false, // STIG Manager defined property\n      groupGridRecord: {}, // STIG Manager defined property\n      monitorValid: false,\n      trackResetOnLoad: false,\n      reviewChanged: reviewChanged,\n      loadValues: loadValues,\n      initLastSavedData: initLastSavedData,\n      isReviewSubmittable: isReviewSubmittable,\n      setReviewFormItemStates: setReviewFormItemStates,\n      setReviewFormTips: setReviewFormTips,\n      fieldSettings: this.fieldSettings || {\n        detail: {\n          enabled: 'always',\n          required: 'always'\n        },\n        comment: {\n          enabled: 'findings',\n          required: 'findings'\n        } \n      },\n      items: [\n        {\n          xtype: 'fieldset',\n          layout: 'form',\n          layoutConfig: {\n            getLayoutTargetSize : function() {\n              var target = this.container.getLayoutTarget(), ret = {};\n              if (target) {\n                  ret = target.getViewSize();\n      \n                  // IE in strict mode will return a width of 0 on the 1st pass of getViewSize.\n                  // Use getStyleSize to verify the 0 width, the adjustment pass will then work properly\n                  // with getViewSize\n                  if (Ext.isIE9m && Ext.isStrict && ret.width == 0){\n                      ret =  target.getStyleSize();\n                  }\n                  ret.width -= target.getPadding('lr');\n                  ret.height -= target.getPadding('tb');\n                  // change in this override to account for space used by \n                  // the Result combo box and the 4px bottom-margin of each textarea\n                  ret.height -= 34 \n              }\n              return ret;\n            } \n          },\n          anchor: '100%, -100',\n          title: 'Evaluation',\n          items: [\n            {\n              layout: 'column',\n              baseCls: 'x-plain',\n              items: [\n                {\n                  width: 170,\n                  layout: 'form',\n                  baseCls: 'x-plain',\n                  items: [rcb]\n                },\n                ack\n              ]\n            },\n            dta, cta\n          ]\n          // items: [rcb, ack, dta]\n        },\n        {\n          xtype: 'fieldset',\n          title: 'Attributions',\n          items: [mdf, sdf]\n        }\n      ],\n      buttons: [btn1, btn2],\n      listeners: {\n        render: function (formPanel) {\n          formPanel.getForm().waitMsgTarget = formPanel.getEl()\n          const reviewFormPanelDropTargetEl = formPanel.body.dom\n          const reviewFormPanelDropTarget = new Ext.dd.DropTarget(reviewFormPanelDropTargetEl, {\n            ddGroup: 'gridDDGroup',\n            notifyEnter: function (ddSource, e, data) {\n              const editableDest = (_this.groupGridRecord.data.status == 'saved' || _this.groupGridRecord.data.status == 'rejected' || _this.groupGridRecord.data.status === \"\");\n              const copyableSrc = data.selections[0].data.engineResult === 'manual'\n              if (editableDest && copyableSrc) { // accept drop of manual reviews\n                // no action\n              } else {\n                return (reviewFormPanelDropTarget.dropNotAllowed);\n              }\n            },\n            notifyOver: function (ddSource, e, data) {\n              const editableDest = (_this.groupGridRecord.data.status == 'saved' || _this.groupGridRecord.data.status == 'rejected' || _this.groupGridRecord.data.status === \"\");\n              const copyableSrc = data.selections[0].data.engineResult === 'manual'\n              if (editableDest && copyableSrc) { // accept drop of manual reviews\n                return (reviewFormPanelDropTarget.dropAllowed);\n              } else {\n                return (reviewFormPanelDropTarget.dropNotAllowed);\n              }\n            },\n            notifyDrop: function (ddSource, e, data) {\n              const editableDest = (_this.groupGridRecord.data.status == 'saved' || _this.groupGridRecord.data.status == 'rejected' || _this.groupGridRecord.data.status === \"\");\n              const copyableSrc = data.selections[0].data.engineResult === 'manual'\n              if (editableDest && copyableSrc) { // accept drop of manual reviews\n                // Reference the record (single selection) for readability\n                const selectedRecord = data.selections[0];\n                // Load the record into the form\n                if (!rcb.disabled) {\n                  rcb.setValue(selectedRecord.data.result);\n                  rcb.fireEvent('select')\n                }\n                dta.setValue(selectedRecord.data.detail);\n                if (rcb.getValue() === 'fail') {\n                  cta.enable();\n                } else {\n                  cta.disable();\n                }\n                if (!cta.disabled) {\n                  cta.setValue(selectedRecord.data.comment);\n                }\n                _this.setReviewFormItemStates()\n              }\n              return (true);\n            }\n          })\n        }\n      }\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.Review.Form.Panel.superclass.initComponent.call(this)\n  }\n})"
  },
  {
    "path": "client/src/js/SM/ReviewsImport.js",
    "content": "Ext.ns('SM.ReviewsImport')\n\nSM.ReviewsImport.Grid = Ext.extend(Ext.grid.GridPanel, {\n    initComponent: function () {\n        const me = this\n        const fields = [\n            {\n                name: 'filename',\n                mapping: 'checklist.sourceRef.name'\n            },\n            {\n                name: 'fullPath',\n                mapping: 'checklist.sourceRef.fullPath'\n            },\n            {\n                name: 'date',\n                mapping: 'checklist.sourceRef.lastModifiedDate'\n            },\n            {\n                name: 'file',\n                mapping: 'checklist.sourceRef'\n            },\n            {\n                name: 'assetId',\n                mapping: 'taskAsset.assetProps.assetId'\n            },\n            {\n                name: 'assetName',\n                mapping: 'taskAsset.assetProps.name'\n            },\n            {\n                name: 'ip',\n                mapping: 'taskAsset.assetProps.ip'\n            },\n            {\n                name: 'noncomputing',\n                mapping: 'taskAsset.assetProps.noncomputing'\n            },\n            {\n                name: 'metadata',\n                mapping: 'taskAsset.assetProps.metadata'\n            },\n            {\n                name: 'benchmarkId',\n                mapping: 'checklist.benchmarkId'\n            },\n            {\n                name: 'newAssignment',\n                mapping: 'checklist.newAssignment'\n            },\n            {\n                name: 'informational',\n                mapping: 'checklist.stats.informational'\n            },\n            {\n                name: 'notchecked',\n                mapping: 'checklist.stats.notchecked'\n            },\n            {\n                name: 'pass',\n                mapping: 'checklist.stats.pass'\n            },\n            {\n                name: 'fail',\n                mapping: 'checklist.stats.fail'\n            },\n            {\n                name: 'notapplicable',\n                mapping: 'checklist.stats.notapplicable'\n            },\n            {\n                name: 'reviews',\n                mapping: 'checklist.reviews'\n            },\n            'taskAsset',\n            'checklist'\n        ]\n        const store = new Ext.data.GroupingStore({\n            grid: this,\n            root: '',\n            reader: new Ext.data.JsonReader({\n                fields: fields,\n                // idProperty: (v) => `${v.filename}-${v.assetName}-${v.benchmarkId}`\n                idProperty: (v) => `${v.checklist.sourceRef.name}-${v.taskAsset.assetProps.name}-${v.checklist.benchmarkId}`\n            }),\n            sortInfo: {\n                field: 'assetName',\n                direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n            }\n        })\n        const totalTextCmp = new SM.RowCountTextItem({\n            store: store\n        })\n        const columns = [\n            {\n                header: \"Asset\",\n                width: 150,\n                dataIndex: 'assetName',\n                sortable: true,\n                renderer: (v, m, r) => {\n                    if (r.data.assetId) {\n                        return v\n                    }\n                    else {\n                        return `(+) ${v}`\n                    }\n                }\n            },\n            {\n                header: \"IP\",\n                hidden: true,\n                width: 100,\n                dataIndex: 'ip',\n                sortable: true,\n                renderer: SM.styledEmptyRenderer\n            },\n            {\n                xtype: 'booleancolumn',\n                trueText: '&#x2714;',\n                falseText: '',\n                header: \"Non-computing\",\n                width: 75,\n                dataIndex: 'noncomputing',\n                align: \"center\",\n                sortable: true,\n                hidden: true\n            },\n            {\n                header: \"STIG\",\n                width: 150,\n                dataIndex: 'benchmarkId',\n                sortable: true,\n                renderer: (v, m, r) => {\n                    if (r.data.newAssignment) {\n                        return `(+) ${v}`\n                    }\n                    else {\n                        return v\n                    }\n                }\n            },\n            {\n                header: '<div class=\"sm-grid-result-sprite sm-result-na\" exportvalue=\"I\">I</div>',\n                width: 50,\n                align: 'center',\n                dataIndex: 'informational',\n                sortable: true,\n                renderer: (v) => me.importReviews ? v : '--'\n            },\n            {\n                header: '<div class=\"sm-grid-result-sprite sm-result-na\" exportvalue=\"NR\">NR</div>',\n                width: 50,\n                align: 'center',\n                dataIndex: 'notchecked',\n                sortable: true,\n                renderer: (v) => me.importReviews ? v : '--'\n            },\n            {\n                header: '<div class=\"sm-grid-result-sprite sm-result-na\" exportvalue=\"NA\">NA</div>',\n                width: 50,\n                align: 'center',\n                dataIndex: 'notapplicable',\n                sortable: true,\n                renderer: (v) => me.importReviews ? v : '--'\n            },\n            {\n                header: '<div class=\"sm-grid-result-sprite sm-result-pass\" exportvalue=\"NF\">NF</div>',\n                width: 50,\n                align: 'center',\n                dataIndex: 'pass',\n                sortable: true,\n                renderer: (v) => me.importReviews ? v : '--'\n            },\n            {\n                header: '<div class=\"sm-grid-result-sprite sm-result-fail\" exportvalue=\"O\">O</div>',\n                width: 50,\n                align: 'center',\n                dataIndex: 'fail',\n                sortable: true,\n                renderer: (v) => me.importReviews ? v : '--'\n            },\n            {\n                header: \"File\",\n                width: 150,\n                dataIndex: 'filename',\n                sortable: true,\n                renderer: (v, m, r) => {\n                    m.attr = `ext:qtip=\"${SM.he(r.data.fullPath)}\"`\n                    return v\n                }\n            },\n            {\n                xtype: 'datecolumn',\n                format: 'Y-m-d H:i:s',\n                header: \"Date\",\n                width: 100,\n                dataIndex: 'date',\n                sortable: true\n            }\n        ]\n        const config = {\n            //title: this.title || 'Parent',\n            isFormField: true,\n            name: 'imports',\n            allowBlank: false,\n            layout: 'fit',\n            store: store,\n            cm: new Ext.grid.ColumnModel({\n                columns: columns\n            }),\n            sm: new Ext.grid.RowSelectionModel({\n                singleSelect: true\n            }),\n            view: new Ext.grid.GroupingView({\n                enableGrouping: true,\n                hideGroupedColumn: true,\n                forceFit: true,\n                emptyText: 'No records to display',\n                groupTextTpl: '{[SM.he(values.text)]} ({[values.rs.length]} {[values.text.split(\":\")[0] == \"Asset\" ? \"checklist\" : \"asset\"]}{[values.rs.length > 1 ? \"s assigned\" : \" assigned\"]})',\n            }),\n            bbar: new Ext.Toolbar({\n                items: [\n                    {\n                        xtype: 'exportbutton',\n                        hasMenu: false,\n                        grid: this,\n                        gridBasename: this.exportButtonName ?? 'Parsed Assets',\n                        storeBasename: this.exportButtonName ?? 'Parsed Assets',\n                        iconCls: 'sm-export-icon',\n                        text: 'CSV'\n                    },\n                    {\n                        xtype: 'tbfill'\n                    },\n                    {\n                        xtype: 'tbseparator'\n                    },\n                    totalTextCmp\n                ]\n            }),\n            listeners: {\n            },\n            getValue: () => true,\n            setValue: (v) => store.loadData(v),\n            validator: Ext.emptyFn,\n            markInvalid: Ext.emptyFn,\n            clearInvalid: Ext.emptyFn,\n            isValid: () => true,\n            getName: () => this.name,\n            validate:Ext.emptyFn,\n            createObjects: true,\n            importReviews: true,\n            enableCreateObjects: (enabled = true) => {\n                me.createObjects = enabled\n                if (enabled) {\n                    me.store.clearFilter()\n                }\n                else {\n                    const filter = (record) => record.data.assetId && !record.data.newAssignment\n                    me.store.filterBy(filter)\n                }\n            },\n            enableImportReviews: (enabled = true) => {\n                me.importReviews = enabled\n                me.getView().refresh()\n            }\n        }\n\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.Grid.superclass.initComponent.call(this)\n    }\n})\n\nSM.ReviewsImport.ReviewsFilterCombo = Ext.extend(Ext.form.ComboBox, {\n    initComponent: function () {\n        let config = {\n            width: 140,\n            forceSelection: true,\n            editable: false,\n            mode: 'local',\n            triggerAction: 'all',\n            displayField: 'display',\n            valueField: 'filter',\n            store: new Ext.data.SimpleStore({\n                fields: ['display', 'filter'],\n                data: [['All results', 'all'], ['Updated results only', 'resultchange']]\n            })\n        }\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.ReviewsFilterCombo.superclass.initComponent.call(this)\n    }\n})\nExt.reg('sm-reviews-filter-combo', SM.ReviewsImport.ReviewsFilterCombo)\n\nSM.ReviewsImport.ReviewsGrid = Ext.extend(Ext.grid.GridPanel, {\n    initComponent: function () {\n        const me = this\n        const fields = Ext.data.Record.create([\n            'new',\n            {\n                name: 'groupId',\n                type: 'string',\n                mapping: 'current.groupId',\n                sortType: sortGroupId\n            },\n            {\n                name: 'ruleId',\n                type: 'string',\n                mapping: 'new.ruleId',\n                sortType: sortRuleId\n            },\n            {\n                name: 'groupTitle',\n                mapping: 'current.groupTitle',\n                type: 'string'\n            },\n            {\n                name: 'ruleTitle',\n                mapping: 'current.ruleTitle',\n                type: 'string'\n            },\n            {\n                name: 'severity',\n                type: 'string',\n                mapping: 'current.severity',\n                sortType: sortSeverity\n            },\n            {\n                name: 'result',\n                mapping: 'new.result',\n                type: 'string'\n            },\n            {\n                name: 'curResult',\n                mapping: 'current.result',\n                type: 'string'\n            },\n            {\n                name: 'detail',\n                mapping: 'new.detail',\n                type: 'string'\n            },\n            {\n                name: 'comment',\n                mapping: 'new.comment',\n                type: 'string'\n            },\n            {\n                name: 'status',\n                mapping: 'new.status',\n                type: 'string'\n            }\n        ])\n        const store = new Ext.data.JsonStore({\n            grid: this,\n            root: '',\n            fields: fields,\n            idProperty: 'ruleId',\n            sortInfo: {\n                field: 'ruleId',\n                direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n            },\n            listeners: {\n                load: function (store, records) {\n                    totalTextCmp.setText(records.length + ' records')\n                },\n                datachanged: function (store, record, index) {\n                    totalTextCmp.setText(store.getCount() + ' records')\n                }\n            }\n        })\n        const totalTextCmp = new SM.RowCountTextItem({\n            store: store\n        })\n        const columns = [\n            {\n                header: \"<b>Rule</b>\",\n                width: 150,\n                fixed: true,\n                dataIndex: 'ruleId',\n                sortable: true,\n                renderer: v => `<b>${v}</b>`,\n                align: 'left'\n            },\n            {\n                header: \"Rule Title\",\n                width: 220,\n                fixed: true,\n                dataIndex: 'ruleTitle',\n                renderer: columnWrap,\n                sortable: false\n            },\n            {\n                header: \"Group\",\n                width: 55,\n                dataIndex: 'groupId',\n                fixed: true,\n                sortable: true,\n                align: 'left'\n            },\n            {\n                header: \"CAT\",\n                fixed: true,\n                width: 48,\n                align: 'center',\n                dataIndex: 'severity',\n                sortable: true,\n                renderer: renderSeverity\n            },\n            {\n                header: 'Current', // per docs\n                align: 'center',\n                menuDisabled: true,\n                width: 64,\n                fixed: true,\n                dataIndex: 'curResult',\n                sortable: true,\n                renderer: renderResult\n            },\n            {\n                header: 'New', // per docs\n                align: 'center',\n                menuDisabled: true,\n                width: 64,\n                fixed: true,\n                dataIndex: 'result',\n                sortable: true,\n                renderer: renderResult\n            },\n            {\n                header: 'Detail', // per docs\n                menuDisabled: true,\n                width: 220,\n                // fixed: true,\n                dataIndex: 'detail',\n                renderer: columnWrap,\n                sortable: false\n            },\n            // {\n            //     header: \"Status\",\n            //     fixed: true,\n            //     width: 44,\n            //     align: 'center',\n            //     dataIndex: 'status',\n            //     sortable: false,\n            //     renderer: renderStatuses\n            // }\n        ]\n        const tbar = new Ext.Toolbar({\n            items: [\n                {\n                    xtype: 'tbtext',\n                    text: 'Filter:'\n                },\n                ' ', ' ', ' ',\n                {\n                    xtype: 'sm-reviews-filter-combo',\n                    value: 'all',\n                    listeners: {\n                        select: function (f, r, i) {\n                            me.filterValue = f.getValue()\n                            me.fireEvent('filterchanged', me.filterValue)\n                        }\n                    }\n                }\n            ]\n        })\n        const onFilterChanged = (filter) => {\n            if (filter === 'resultchange' ) {\n                store.filterBy(record => record.data.result !== record.data.curResult)\n            } \n            else {\n                store.clearFilter()\n            }\n        }\n\n        let config = {\n            layout: 'fit',\n            isFormField: true,\n            loadMask: {msg: ''},\n            store: store,\n            columns: columns,\n            view: new SM.ColumnFilters.GridView({\n                emptyText: this.emptyText || 'No records to display',\n                deferEmptyText: false,\n                forceFit: true\n            }),\n            tbar: tbar,\n            bbar: new Ext.Toolbar({\n                items: [\n                    {\n                        xtype: 'exportbutton',\n                        hasMenu: false,\n                        grid: this,\n                        gridBasename: 'Parsed Rules',\n                        storeBasename: 'Parsed Rules',\n                        iconCls: 'sm-export-icon',\n                        text: 'CSV'\n                    },\n                    {\n                        xtype: 'tbfill'\n                    }, {\n                        xtype: 'tbseparator'\n                    },\n                    totalTextCmp\n                ]\n            }),\n            listeners: {\n                filterchanged: onFilterChanged\n            },\n\n        }\n\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.ReviewsGrid.superclass.initComponent.call(this)\n    }\n})\n\nSM.ReviewsImport.ParseErrorsGrid = Ext.extend(Ext.grid.GridPanel, {\n    initComponent: function () {\n        const fields = [\n            {\n                name: 'file'\n            },\n            {\n                name: 'filename',\n                mapping: 'file.name'\n            },\n            {\n                name: 'error'\n            }\n        ]\n        const totalTextCmp = new Ext.Toolbar.TextItem({\n            text: '0 records',\n            width: 80\n        })\n        const store = new Ext.data.GroupingStore({\n            grid: this,\n            root: '',\n            reader: new Ext.data.JsonReader({\n                fields: fields,\n                idProperty: 'filename'\n            }),\n            sortInfo: {\n                field: 'filename',\n                direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n            },\n            listeners: {\n                load: function (store, records) {\n                    totalTextCmp.setText(records.length + ' records')\n                },\n                remove: function (store, record, index) {\n                    totalTextCmp.setText(store.getCount() + ' records')\n                }\n            }\n        })\n        const columns = [\n            {\n                header: \"File\",\n                width: 100,\n                dataIndex: 'filename',\n                sortable: true\n            },\n            {\n                header: \"Error\",\n                width: 150,\n                dataIndex: 'error',\n                sortable: true\n            }\n        ]\n        const config = {\n            //title: this.title || 'Parent',\n            isFormField: true,\n            name: 'imports',\n            allowBlank: false,\n            layout: 'fit',\n            store: store,\n            cm: new Ext.grid.ColumnModel({\n                columns: columns\n            }),\n            sm: new Ext.grid.RowSelectionModel({\n                singleSelect: true\n            }),\n            view: new SM.ColumnFilters.GridView({\n                forceFit: true,\n                emptyText: 'No records to display'\n            }),\n            bbar: new Ext.Toolbar({\n                items: [\n                    {\n                        xtype: 'exportbutton',\n                        hasMenu: false,\n                        grid: this,\n                        gridBasename: 'Parse Errors',\n                        storeBasename: 'Parse Errors',\n                        iconCls: 'sm-export-icon',\n                        text: 'CSV'\n                    },\n                    {\n                        xtype: 'tbfill'\n                    },\n                    {\n                        xtype: 'tbseparator'\n                    },\n                    totalTextCmp\n                ]\n            }),\n            listeners: {\n            },\n            getValue: () => true,\n            setValue: (v) => store.loadData(v),\n            validator: Ext.emptyFn,\n            markInvalid: Ext.emptyFn,\n            clearInvalid: Ext.emptyFn,\n            isValid: () => true,\n            getName: () => this.name,\n            validate: Ext.emptyFn\n        }\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.ParseErrorsGrid.superclass.initComponent.call(this)\n    }\n})\n\nSM.ReviewsImport.WarningPanel = Ext.extend(Ext.Panel, {\n    initComponent: function () {\n        const me = this\n        let config = {\n            border: false,\n            layout: 'vbox',\n            layoutConfig: {\n                // align: 'stretch',\n                pack: 'start',\n                padding: '0 20 20 20',\n            },\n            items: [\n                {\n                    html: `<div class=\"sm-dialog-panel-title\">${me.contentTitle}</div>`,\n                    border: false\n                },\n                {\n                    html: `<div class=\"sm-dialog-panel-content\">${me.contentText}</div>`,\n                    width: 500,\n                    border: false,\n                }\n            ],\n            buttons: [{\n                xtype: 'button',\n                text: 'Continue',\n                handler: me.continueHandler\n            }],\n            buttonAlign: 'right'\n        }\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.WarningPanel.superclass.initComponent.call(this)\n    }\n})\n\nSM.ReviewsImport.AutoStatusComboBox = Ext.extend(SM.Global.HelperComboBox, {\n    initComponent: function () {\n        const _this = this\n        const config = {\n            displayField: 'display',\n            valueField: 'value',\n            triggerAction: 'all',\n            mode: 'local',\n            editable: false,\n            width: 120,\n            helpText: SM.TipContent.ImportOptions.AutoStatus\n        }\n        const data = [\n            ['null', 'Keep Existing'],\n            ['saved', 'Saved'],\n            ['submitted', 'Submitted'],\n        ]\n        if (this.canAccept) {\n            data.push(['accepted', 'Accepted'])\n        }\n        this.store = new Ext.data.SimpleStore({\n            fields: ['value', 'display']\n        })\n        this.store.on('load', function (store) {\n            _this.setValue(_this.value)\n        })\n\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        this.superclass().initComponent.call(this)\n\n        this.store.loadData(data)\n    }\n})\n\nSM.ReviewsImport.UnreviewedComboBox = Ext.extend(SM.Global.HelperComboBox, {\n    initComponent: function () {\n        const _this = this\n        const config = {\n            displayField: 'display',\n            fieldLabel: this.fieldLabel ?? 'Include unreviewed rules',\n            valueField: 'value',\n            triggerAction: 'all',\n            mode: 'local',\n            editable: false,\n            width: 120,\n            helpText: SM.TipContent.ImportOptions.Unreviewed\n        }\n        const data = [\n            ['never', 'Never'],\n            ['commented', 'Having comments'],\n            ['always', 'Always']\n        ]\n        this.store = new Ext.data.SimpleStore({\n            fields: ['value', 'display']\n        })\n        this.store.on('load', function (store) {\n            _this.setValue(_this.value)\n        })\n\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.UnreviewedComboBox.superclass.initComponent.call(this)\n\n        this.store.loadData(data)\n    }\n})\nSM.ReviewsImport.UnreviewedCommentedComboBox = Ext.extend(SM.Global.HelperComboBox, {\n    initComponent: function () {\n        const _this = this\n        const config = {\n            displayField: 'display',\n            fieldLabel: this.fieldLabel ?? 'Unreviewed with a comment is',\n            valueField: 'value',\n            triggerAction: 'all',\n            mode: 'local',\n            editable: false,\n            width: 120,\n            helpText: SM.TipContent.ImportOptions.UnreviewedCommented\n        }\n        let data = [\n            ['informational', 'Informational'],\n            ['notchecked', 'Not Reviewed'],\n        ]\n        this.store = new Ext.data.SimpleStore({\n            fields: ['value', 'display']\n        })\n        this.store.on('load', function (store) {\n            _this.setValue(_this.value)\n        })\n\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.UnreviewedCommentedComboBox.superclass.initComponent.call(this)\n\n        this.store.loadData(data)\n    }\n})\nSM.ReviewsImport.EmptyCommentComboBox = Ext.extend(SM.Global.HelperComboBox, {\n    initComponent: function () {\n        const _this = this\n        const config = {\n            displayField: 'display',\n            fieldLabel: this.fieldLabel ?? `Empty ${this.commentType} text is`,\n            valueField: 'value',\n            triggerAction: 'all',\n            mode: 'local',\n            editable: false,\n            width: 120,\n            helpText: SM.TipContent.ImportOptions.EmptyComment\n        }\n        const data = [\n            ['ignore', 'Ignored'],\n            ['replace', 'Replaced'],\n            ['import', 'Imported']\n        ]\n        this.store = new Ext.data.SimpleStore({\n            fields: ['value', 'display']\n        })\n        this.store.on('load', function (store) {\n            _this.setValue(_this.value)\n        })\n\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.EmptyCommentComboBox.superclass.initComponent.call(this)\n\n        this.store.loadData(data)\n    }\n})\n\nSM.ReviewsImport.ParseOptionsFieldSet = Ext.extend(Ext.form.FieldSet, {\n    initComponent: function () {\n        const _this = this\n        this.context = this.context ?? 'manage' // 'or 'wizard'\n        this.canUpdateAssetProps = this.canUpdateAssetProps ?? true\n        this.autoStatusCombo = new SM.ReviewsImport.AutoStatusComboBox({\n            value: this.initialOptions.autoStatus.fail,\n            name: 'autoStatus.fail',\n            fieldLabel: 'Fail',\n            readOnly: this.context === 'wizard',\n            canAccept: this.canAccept,\n            listeners: {\n                select: onSelect\n            }\n        })\n        this.autoStatusNotApplicable = new SM.ReviewsImport.AutoStatusComboBox({\n            value: this.initialOptions.autoStatus?.notapplicable,\n            name: 'autoStatus.notapplicable',\n            fieldLabel: 'Not Applicable',\n            readOnly: this.context === 'wizard',\n            canAccept: this.canAccept,\n            listeners: {\n                select: onSelect\n            }\n        })\n        \n        this.autoStatusPass = new SM.ReviewsImport.AutoStatusComboBox({\n            value: this.initialOptions.autoStatus?.pass,\n            name: 'autoStatus.pass',\n            fieldLabel: 'Pass',\n            readOnly: this.context === 'wizard',\n            canAccept: this.canAccept,\n            listeners: {\n                select: onSelect\n            }\n        })\n        this.unreviewedCombo = new SM.ReviewsImport.UnreviewedComboBox({\n            value: this.initialOptions.unreviewed,\n            name: 'unreviewed',\n            readOnly: this.context === 'wizard',\n            listeners: {\n                select: onSelect\n            }\n        })\n        this.unreviewedCommentedCombo = new SM.ReviewsImport.UnreviewedCommentedComboBox({\n            value: this.initialOptions.unreviewedCommented,\n            name: 'unreviewedCommented',\n            readOnly: this.context === 'wizard',\n            disabled: this.unreviewedCombo.value === 'never',\n            listeners: {\n                select: onSelect\n            }\n        })\n        this.emptyDetailCombo = new SM.ReviewsImport.EmptyCommentComboBox({\n            commentType: 'detail',\n            name: 'emptyDetail',\n            value: this.initialOptions.emptyDetail,\n            readOnly: this.context === 'wizard',\n            listeners: {\n                select: onSelect\n            }\n        })\n        this.emptyCommentCombo = new SM.ReviewsImport.EmptyCommentComboBox({\n            commentType: 'comment',\n            name: 'emptyComment',\n            value: this.initialOptions.emptyComment,\n            readOnly: this.context === 'wizard',\n            listeners: {\n                select: onSelect\n            }\n        })\n\n        this.updateAssetPropsCb = new SM.Global.HelperCheckbox({\n            boxLabel: 'Update existing Asset properties',\n            name: 'updateAssetProps',\n            checked: this.initialOptions.updateAssetProps ?? false,\n            helpText: SM.TipContent.ImportOptions.UpdateAssetProps,\n            hideLabel: true,\n            disabled: this.context === 'wizard',\n            listeners: {\n                check: function (cb, checked) {\n                    if (_this.localStorage) {\n                        localStorage.setItem('wizardImportOptions', JSON.stringify(_this.getOptions()))\n                    }\n                    _this.onOptionChanged?.(_this, cb, checked)\n                }\n            }\n        })\n        this.updateAssetPropsCb.setReadOnly = function (readOnly) {\n            _this.updateAssetPropsCb.setDisabled(readOnly)\n        }\n\n        this.autoStatusFieldGroup = new Ext.form.FieldSet({\n            title: 'Review Status Per Result',\n            border: true,\n            autoHeight: true,\n            layout: 'form',\n            readOnly: this.context === 'wizard',\n            labelWidth: 200,\n            items: [\n                this.autoStatusCombo,\n                this.autoStatusNotApplicable,\n                this.autoStatusPass\n            ]\n        })\n\n        this.autoStatusFieldGroup.setReadOnly = function (readOnly) {\n            _this.autoStatusCombo.setReadOnly(readOnly)\n            _this.autoStatusNotApplicable.setReadOnly(readOnly)\n            _this.autoStatusPass.setReadOnly(readOnly)\n        }\n        \n        \n        this.optionComboBoxes = [\n            this.autoStatusFieldGroup,\n            this.unreviewedCombo,\n            this.unreviewedCommentedCombo,\n            this.emptyDetailCombo,\n            this.emptyCommentCombo,\n        ]\n        this.allowCustomCb = new Ext.form.Checkbox({\n            boxLabel: `Options can be customized for each import`,\n            checked: this.initialOptions.allowCustom,\n            hideLabel: true,\n            listeners: {\n                check: function (cb, checked) {\n                    _this.onOptionChanged?.(_this, cb, checked)\n                }\n            }\n        })\n        this.customizeCb = new Ext.form.Checkbox({\n            boxLabel: `Configure custom import options`,\n            height: 22,\n            checked: false,\n            hideLabel: true,\n            listeners: {\n                check: function (cb, checked) {\n                    if (!checked) {\n                        _this.restoreOptions()\n                    }\n                    for (const combo of _this.optionComboBoxes) {\n                        combo.setReadOnly(!checked)\n                    }\n                    if (_this.canUpdateAssetProps) {\n                        _this.updateAssetPropsCb.setReadOnly(!checked)\n                    }\n                    _this.localStorage = checked\n                    if (_this.localStorage && localStorage.wizardImportOptions?.length) {\n                        _this.restoreOptions(JSON.parse(localStorage.wizardImportOptions))\n                    }\n                    _this.onOptionChanged?.(_this, cb, checked)\n                }\n            }\n        })\n\n        this.noUpdateAssetPropsDisplay = new Ext.form.DisplayField({\n            value: '<i>Asset property updates are configured in the Manage Collection interface.</i>',\n            height: 22,\n            hideLabel: true\n        })\n\n        this.noCustomizeDisplay = new Ext.form.DisplayField({\n            value: '<i>Import options cannot be changed for this Collection.</i>',\n            height: 22,\n            hideLabel: true\n        })\n\n        function onSelect(item, record, index) {\n            if (item.name === 'unreviewed') {\n                _this.unreviewedCommentedCombo.setDisabled(item.value === 'never')\n            }\n            if (_this.localStorage) {\n                localStorage.setItem('wizardImportOptions', JSON.stringify(_this.getOptions())) \n            }\n            _this.onOptionChanged?.(_this, item, record, index)\n        }\n\n        this.restoreOptions = function (options = _this.initialOptions) {\n            for (const combo of this.optionComboBoxes) {\n                if (typeof combo.setValue === 'function') {\n                    combo.setValue(options[combo.name])\n                }\n            }\n            _this.unreviewedCommentedCombo.setDisabled(_this.unreviewedCombo.value === 'never')\n            _this.autoStatusCombo.setValue(options.autoStatus.fail)\n            _this.autoStatusNotApplicable.setValue(options.autoStatus.notapplicable)\n            _this.autoStatusPass.setValue(options.autoStatus.pass)\n            _this.updateAssetPropsCb.suspendEvents()\n            _this.updateAssetPropsCb.setValue(options.updateAssetProps ?? false)\n            _this.updateAssetPropsCb.resumeEvents()\n        }\n\n        this.getOptions = function () {\n            const options = {\n                autoStatus: {\n                    fail: _this.autoStatusCombo.value,\n                    notapplicable: _this.autoStatusNotApplicable.value,\n                    pass: _this.autoStatusPass.value\n                },\n                unreviewed: _this.unreviewedCombo.value,\n                unreviewedCommented: _this.unreviewedCommentedCombo.value ,  \n                emptyDetail: _this.emptyDetailCombo.value,\n                emptyComment: _this.emptyCommentCombo.value,\n                updateAssetProps: _this.canUpdateAssetProps ? _this.updateAssetPropsCb.checked : false,\n                allowCustom: _this.allowCustomCb.checked\n            }\n            return options\n        }\n\n        const items = []\n        if (this.context === 'wizard') {\n            items.push(this.initialOptions.allowCustom ? this.customizeCb : this.noCustomizeDisplay)\n        }\n        items.push(...this.optionComboBoxes)\n        items.push(this.canUpdateAssetProps ? this.updateAssetPropsCb : this.noUpdateAssetPropsDisplay)\n        if (this.context !== 'wizard') {\n            items.push(this.allowCustomCb)\n        }\n        const config = {\n            title: 'Import options',\n            labelWidth: 200,\n            items\n        }\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.ParseOptionsFieldSet.superclass.initComponent.call(this)\n    }\n})\n\nSM.ReviewsImport.SelectFilesGrid = Ext.extend(Ext.grid.GridPanel, {\n    initComponent: function () {\n        const _this = this\n\n        function handleDragover(e) {\n            e.stopPropagation()\n            e.preventDefault()\n            e.dataTransfer.dropEffect = 'copy'\n            this.getElementsByClassName('x-panel-body')[0].style.border = '1px dashed red'\n        }\n        function handleDragleave(e) {\n            e.stopPropagation()\n            e.preventDefault()\n            e.dataTransfer.dropEffect = 'copy'\n            this.getElementsByClassName('x-panel-body')[0].style.border = ''\n\n        }\n        async function onFileDropped(e) {\n            try {\n                e.stopPropagation()\n                e.preventDefault()\n                this.getElementsByClassName('x-panel-body')[0].style.border = ''\n                let entries = []\n                if (!e.dataTransfer) {\n                    throw new Error('Event is missing the dataTransfer property')\n                }\n                entries = await getAllFileEntries(e.dataTransfer.items)\n                if (!entries.length) {\n                   throw new Error('no entries error')\n                }\n                else {\n                    const files = _this.store.getRange().map(r=>r.json)\n                    for (const entry of entries) {\n                        files.push(await entryFilePromise(entry))\n                    }\n                    _this.store.loadData(files)\n                }\n            }\n            catch (e) {\n                SM.Error.handleError(e)\n            }\n\n            async function getAllFileEntries(dataTransferItemList) {\n                try {\n                    let searched = 0, found = 0\n                    let fileEntries = []\n                    // Use BFS to traverse entire directory/file structure\n                    let queue = []\n                    // Unfortunately dataTransferItemList is not iterable i.e. no forEach\n                    for (let i = 0; i < dataTransferItemList.length; i++) {\n                        queue.push(dataTransferItemList[i].webkitGetAsEntry())\n                    }\n                    while (queue.length > 0) {\n                        let entry = queue.shift()\n                        searched++\n                        if (entry.isFile && (entry.name.toLowerCase().endsWith('.ckl') || entry.name.toLowerCase().endsWith('.cklb') || entry.name.toLowerCase().endsWith('.xml'))) {\n                            fileEntries.push(entry)\n                            found++\n                        } else if (entry.isDirectory) {\n                            queue.push(...await readAllDirectoryEntries(entry.createReader()))\n                        }\n                    }\n                    return fileEntries\n                }\n                catch (e) {\n                    SM.Error.handleError(e)\n                }\n            }\n\n            // Get all the entries (files or sub-directories) in a directory \n            // by calling readEntries until it returns empty array\n            async function readAllDirectoryEntries(directoryReader) {\n                try {\n                    let entries = []\n                    let readEntries = await readEntriesPromise(directoryReader)\n                    while (readEntries?.length > 0) {\n                        entries.push(...readEntries)\n                        readEntries = await readEntriesPromise(directoryReader)\n                    }\n                    return entries;   \n                }\n                catch (e) {\n                    SM.Error.handleError(e)\n                }\n            }\n\n            // Wrap readEntries in a promise to make working with readEntries easier\n            // readEntries will return only some of the entries in a directory\n            // e.g. Chrome returns at most 100 entries at a time\n            async function readEntriesPromise(directoryReader) {\n                try {\n                    return await new Promise((resolve, reject) => {\n                        directoryReader.readEntries(resolve, reject)\n                    })\n                } catch (e) {\n                    SM.Error.handleError(e)\n                }\n            }\n\n            // Wrap entry.file() in a promise\n            async function entryFilePromise(entry) {\n                try {\n                    return await new Promise((resolve, reject) => {\n                        let fullPath = entry.fullPath\n\n                        entry.file(file => {\n                            file.fullPath = fullPath\n                            resolve(file)\n                        }, reject)\n                    })\n                } catch (e) {\n                    SM.Error.handleError(e)\n                }\n            }\n        }\n        function onFileSelected(uploadField) {\n            const files = _this.store.getRange().map(r=>r.json)\n            files.push(...uploadField.fileInput.dom.files)\n            _this.store.loadData(files)\n            uploadField.fileInput.dom.value = ''\n        }\n\n        const fields = [\n            {\n                name: 'filename',\n                type: 'string',\n                mapping: 'name'\n            },\n            {\n                name: 'size',\n                type: 'integer',\n                mapping: 'size'\n            },\n            {\n                name: 'lastModified',\n                type: 'integer',\n                mapping: 'lastModified'\n            },\n            {\n                name: 'lastModifiedDate',\n                type: 'date',\n                mapping: 'lastModifiedDate'\n            },\n            {\n                name: 'id',\n                convert: function (v, r) {\n                    return `${r.name}-${r.size}-${r.lastModified}`\n                }\n            }\n        ]\n        const store = new Ext.data.ArrayStore({\n            grid: this,\n            root: '',\n            fields: fields,         \n            idProperty: 'id',\n            sortInfo: {\n                field: 'filename',\n                direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n            },\n            listeners: {\n                datachanged: function (store, record, index) {\n                    const files = store.getRange().map(r=>r.json)\n                    totalTextCmp.setText(files.length + ' files')\n                    _this.fireEvent('filelistchanged', files)\n                }\n            }\n        })\n        // hack override to handle setting record id as desired\n        store.reader.readRecords = function(o){\n            this.arrayData = o;\n            let s = this.meta,\n                recordType = this.recordType,\n                fields = recordType.prototype.fields,\n                records = [],\n                success = true,\n                v;\n    \n            let root = this.getRoot(o);\n    \n            for(let i = 0, len = root.length; i < len; i++) {\n                let n = root[i],\n                    values = {}\n                for(let j = 0, jlen = fields.length; j < jlen; j++) {\n                    let f = fields.items[j],\n                        k = f.mapping !== undefined && f.mapping !== null ? f.mapping : j;\n                    v = n[k] !== undefined ? n[k] : f.defaultValue;\n                    v = f.convert(v, n);\n                    values[f.name] = v;\n                }\n                // change second argument from id to values.id\n                let record = new recordType(values, values.id);\n                record.json = n;\n                records[records.length] = record;\n            }\n    \n            let totalRecords = records.length;\n    \n            if(s.totalProperty) {\n                v = parseInt(this.getTotal(o), 10);\n                if(!isNaN(v)) {\n                    totalRecords = v;\n                }\n            }\n            if(s.successProperty){\n                v = this.getSuccess(o);\n                if(v === false || v === 'false'){\n                    success = false;\n                }\n            }\n    \n            return {\n                success : success,\n                records : records,\n                totalRecords : totalRecords\n            };\n        }\n        const totalTextCmp = new SM.RowCountTextItem({\n            text: '0 files',\n            store: store\n        })\n        const sm = new Ext.grid.CheckboxSelectionModel({\n                singleSelect: false,\n                checkOnly: false,\n            listeners: {\n                selectionchange: function (sm) {\n                    removeBtn.setDisabled(sm.getCount() === 0)\n                    SM.SetCheckboxSelModelHeaderState(sm)\n                }\n            }\n        })\n        const columns = [\n            sm,\n            {\n                header: \"Filename\",\n                width: 100,\n                dataIndex: 'filename',\n                sortable: true,\n                align: 'left'\n            },\n            {\n                header: \"Size\",\n                width: 25,\n                dataIndex: 'size',\n                sortable: true\n            },\n            {\n                header: \"Last Modified\",\n                width: 35,\n                dataIndex: 'lastModifiedDate',\n                sortable: true,\n                align: 'left',\n\t\t\t\txtype: 'datecolumn',\n\t\t\t\tformat:\t'Y-m-d H:i:s T'\n            }\n        ]\n        const removeBtn = new Ext.Button(                    {\n            iconCls: 'icon-del',\n            text: 'Remove from queue',\n            disabled: true,\n            handler: function () {\n                const records = _this.getSelectionModel().getSelections()\n                _this.suspendEvents()\n                for (const record of records) {\n                    _this.store.remove(record)\n                }\n                _this.resumeEvents()\n                const files = store.getRange().map(r=>r.json)\n                totalTextCmp.setText(files.length + ' files')\n                _this.fireEvent('filelistchanged', files)\n            }\n        })\n\n        const tbar = new Ext.Toolbar({\n            items: [\n                {\n                    xtype: 'fileuploadfield',\n                    buttonOnly: true,\n                    na_this: 'importFile',\n                    accept: '.xml,.ckl,.cklb',\n                    webkitdirectory: false,\n                    multiple: true,\n                    style: 'width: 95px;',\n                    buttonText: `Add files to queue...`,\n                    buttonCfg: {\n                        icon: \"img/disc_drive.png\"\n                    },\n                    listeners: {\n                        fileselected: onFileSelected\n                    }\n                },\n                {\n                    xtype: 'tbfill'\n                },\n                removeBtn\n            ]\n        })\n        const config = {\n            isFormField: true,\n            loadMask: {msg: ''},\n            store: store,\n            columns: columns,\n            viewConfig: {\n                emptyText: 'You may drop files here',\n                deferEmptyText: false,\n                forceFit: true\n            },\n            sm,\n            tbar: tbar,\n            bbar: new Ext.Toolbar({\n                items: [\n                    {\n                        xtype: 'exportbutton',\n                        hasMenu: false,\n                        grid: this,\n                        gridBasename: 'Source Files',\n                        storeBasename: 'Source Files',\n                        iconCls: 'sm-export-icon',\n                        text: 'CSV'\n                    },\n                    {\n                        xtype: 'tbfill'\n                    },\n                    {\n                        xtype: 'tbseparator'\n                    },\n                    totalTextCmp\n                ]\n            }),\n            listeners: {\n                render: (panel) => {\n                    const panelEl = panel.getEl().dom\n                    panelEl.addEventListener('dragenter', handleDragover, false)\n                    panelEl.addEventListener('dragover', handleDragover, false)\n                    panelEl.addEventListener('dragleave', handleDragleave, false)\n                    panelEl.addEventListener('drop', onFileDropped, false)\n                },\n                keydown: SM.CtrlAGridHandler\n            }\n        }\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.SelectFilesGrid.superclass.initComponent.call(this)\n    }\n})\n\nSM.ReviewsImport.MultiSelectPanel = Ext.extend(Ext.Panel, {\n    initComponent: function () {\n        const _this = this\n        this.parseOptionsFieldSet = new SM.ReviewsImport.ParseOptionsFieldSet({\n            height: 330,\n            context: this.optionsContext,\n            canAccept: true,\n            initialOptions: this.initialOptions,\n            canUpdateAssetProps: this.canUpdateAssetProps,\n        })\n        this.selectFilesGrid = new SM.ReviewsImport.SelectFilesGrid({\n            flex: 3,\n            listeners: {\n                filelistchanged: function(list) {\n                    _this.continueBtn.setDisabled(!list.length)\n                }\n            }\n        })\n        this.continueBtn = new Ext.Button({\n            text: 'Continue',\n            disabled: true,\n            handler: () => {\n                _this.fireEvent('continue',_this)\n            }\n        })\n        const config = {\n            layout: 'vbox',\n            layoutConfig: {\n                align: 'stretch',\n                pack: 'start',\n                padding: '0 20 20 20'\n            },\n            items: [\n                {\n                    html: `<div class=\"sm-dialog-panel-title\">Queue files for import</div>`,\n                    border: false\n                },\n                {\n                    xtype: 'displayfield',\n                    html: \"<p>&nbsp;</p>\",\n                },\n                this.selectFilesGrid,\n                {\n                    xtype: 'displayfield',\n                    html: \"<p>&nbsp;</p>\",\n                },\n                this.parseOptionsFieldSet\n            ],\n            buttons: [this.continueBtn],\n            buttonAlign: 'right',\n            listeners: {\n            }\n        }\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.MultiSelectPanel.superclass.initComponent.call(this)\n    }\n})\n\n/**\n * @class SM.ReviewsImport.SelectFilesPanel\n * @extends Ext.Panel\n * Panel class that accepts dropped or selected files\n * @constructor\n * Create a Panel that accepts dropped or selected files\n * @param {Object} config The config object\n * @cfg {Boolean} multifile Support multiple file selections\n * @cfg {Function} onFileSelected Function called on file selection(s)\n * @cfg {Function} onFileDropped Function called on dropped file(s)\n */\nSM.ReviewsImport.SelectFilesPanel = Ext.extend(Ext.Panel, {\n    initComponent: function () {\n\n        const _this = this\n\n        function handleDragover(e) {\n            e.stopPropagation()\n            e.preventDefault()\n            e.dataTransfer.dropEffect = 'copy'\n            this.style.border = \"2px dashed red\"\n        }\n\n        function handleDragleave(e) {\n            e.stopPropagation()\n            e.preventDefault()\n            e.dataTransfer.dropEffect = 'copy'\n            this.style.border = \"\"\n        }\n\n        this.parseOptionsFieldSet = new SM.ReviewsImport.ParseOptionsFieldSet({\n            height: 300,\n            context: 'wizard',\n            initialOptions: this.initialOptions,\n            canAccept: this.canAccept,\n            canUpdateAssetProps: this.canUpdateAssetProps ?? false\n\n        })\n\n\n        const config = {\n            layout: 'vbox',\n            layoutConfig: {\n                align: 'stretch',\n                pack: 'start',\n                padding: '0 20 20 20'\n            },\n            items: [\n                {\n                    html: `<div class=\"sm-dialog-panel-title\">Select or drop file${_this.initialConfig.multifile ? 's' : ''}</div>`,\n                    width: 500,\n                    border: false\n                },\n                {\n                    xtype: 'displayfield',\n                    html: \"<p>&nbsp;</p>\",\n                },\n                {\n                    html: `<div id=\"droptarget\">Drop ${_this.initialConfig.multifile ? 'one or more CKL(B)/XCCDF result files' : 'a CKL(B) or XCCDF result file'} here</div>`,\n                    // border: false,\n                    baseCls: 'sm-drop',\n                    flex: 1,\n                    listeners: {\n                        render: (panel) => {\n                            const panelEl = panel.getEl().dom\n                            panelEl.addEventListener('dragenter', handleDragover, false)\n                            panelEl.addEventListener('dragover', handleDragover, false)\n                            panelEl.addEventListener('dragleave', handleDragleave, false)\n                            panelEl.addEventListener('drop', function (e) {\n                                _this.onFileDropped(e, this)\n                            }, false)\n                        }\n                    }\n                },\n                {\n                    xtype: 'displayfield',\n                    html: \"<p>&nbsp;</p>\",\n                },\n                this.parseOptionsFieldSet,\n                {\n                    xtype: 'displayfield',\n                    html: \"<p>&nbsp;</p>\",\n                },\n                {\n                    xtype: 'fileuploadfield',\n                    buttonOnly: true,\n                    na_this: 'importFile',\n                    accept: '.xml,.ckl,.cklb',\n                    webkitdirectory: false,\n                    multiple: _this.initialConfig.multifile,\n                    style: 'width: 95px;',\n                    buttonText: `Select file${_this.initialConfig.multifile ? 's' : ''}...`,\n                    buttonCfg: {\n                        icon: \"img/disc_drive.png\"\n                    },\n                    listeners: {\n                        fileselected: _this.onFileSelected\n                    }\n                },\n\n\n            ],\n            listeners: {\n            }\n        }\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.SelectFilesPanel.superclass.initComponent.call(this)\n    }\n})\n\nSM.ReviewsImport.ParseErrorsPanel = Ext.extend(Ext.Panel, {\n    initComponent: function () {\n        let me = this\n        me.errorsGrid = new SM.ReviewsImport.ParseErrorsGrid({\n            flex: 1\n        })\n        me.duplicatesGrid = new SM.ReviewsImport.Grid({\n            flex: 1,\n            newIndicator: false,\n            exportButtonName: 'Duplicate Asset-STIGs'\n        })\n        let items = []\n        if (me.errors) {\n            items.push(\n                {\n                    html: '<div class=\"sm-dialog-panel-title\">Errors and warnings</div>',\n                    width: 500,\n                    border: false\n                },\n                me.errorsGrid\n            )\n            me.errorsGrid.store.loadData(me.errors)\n        }\n        if (me.duplicates) {\n            items.push(\n                {\n                    html: '<div class=\"sm-dialog-panel-title\">Duplicates excluded</div>There were multiple result files for some Asset/STIG pairs.<br>Results shown below <b>will not be imported</b> because they were not obtained from the most recently modified file for the Asset/STIG.',\n                    width: 500,\n                    border: false\n                },\n                me.duplicatesGrid\n            )\n            me.duplicatesGrid.store.loadData(me.duplicates)\n        }\n        let config = {\n            border: false,\n            layout: 'vbox',\n            layoutConfig: {\n                align: 'stretch',\n                pack: 'start',\n                padding: '0 20 20 20',\n            },\n            items: items,\n            buttons: [{\n                xtype: 'button',\n                text: me.stopWizard ? 'Close' : 'Continue',\n                handler: me.continueHandler\n            }],\n            buttonAlign: 'right'\n        }\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.ParseErrorsPanel.superclass.initComponent.call(this)\n    }\n})\n\nSM.ReviewsImport.ParseErrorPanel = Ext.extend(Ext.Panel, {\n    initComponent: function () {\n        let me = this\n        const items = [\n            {\n                html: `<div class=\"sm-dialog-panel-title\">There is a problem with your file</div>`,\n                border: false\n            },\n            {\n                html: me.error,\n                width: 500,\n                border: false\n            }\n        ]\n\n        let config = {\n            border: false,\n            layout: 'vbox',\n            layoutConfig: {\n                // align: 'stretch',\n                pack: 'start',\n                padding: '0 20 20 20',\n            },\n            items: items,\n            buttons: [{\n                xtype: 'button',\n                text: 'Exit',\n                handler: me.exitHandler\n            }],\n            buttonAlign: 'right'\n        }\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.ParseErrorPanel.superclass.initComponent.call(this)\n    }\n})\n\nSM.ReviewsImport.OptionsPanel = Ext.extend(Ext.Panel, {\n    initComponent: function () {\n        const me = this\n        const grid = new SM.ReviewsImport.Grid({\n            border: true,\n            flex: 1,\n            panel: this\n        })\n        grid.store.loadData(me.gridData)\n        const continueBtn = new Ext.Button({\n            iconCls: 'sm-import-icon',\n            text: 'Add to Collection...',\n            margins: '0 25',\n            grid: grid,\n            handler: async () => {\n                await me.addHandler(me.taskAssets, grid.createObjects, grid.importReviews)\n            }\n        })\n        const config = {\n            layout: 'vbox',\n            layoutConfig: {\n                align: 'stretch',\n                pack: 'start',\n                padding: '0 20 20 20',\n            },\n            border: false,\n            items: [\n                {\n                    html: '<div class=\"sm-dialog-panel-title\">Import Reviews</div>If you continue, these results will be added to the Collection.<br>&nbsp;',\n                    width: 500,\n                    border: false\n                },\n                // controls,\n                grid\n            ],\n            buttons: [\n                continueBtn\n            ],\n            buttonAlign: 'right',\n            grid: grid\n        }\n\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.OptionsPanel.superclass.initComponent.call(this)\n    }\n})\n\nSM.ReviewsImport.ReviewsPanel = Ext.extend(Ext.form.FormPanel, {\n    initComponent: function () {\n        const me = this\n        const matchingGrid = new SM.ReviewsImport.ReviewsGrid({\n            border: true,\n            name: 'reviews',\n            flex: 1,\n            emptyText: 'No reviews found',\n            getValue: function () { },\n            setValue: function () { },\n            markInvalid: function () { },\n            clearInvalid: function () { },\n            validate: () => true,\n            getName: () => this.name,\n            isValid: function () {\n                return this.getStore().getCount() > 0\n            },\n            panel: this\n        })\n        const currentReviewsArray = me.checklistFromApi.map(i => [i.ruleId, i])\n        const currentReviews = Object.fromEntries(currentReviewsArray)\n\n        //Create object for SM.ReviewImport.ReviewsGrid\n        const matchingData = []\n        const unmatchedData = []\n        const notCheckedData = []\n        for (const review of me.checklistFromFile.reviews) {\n            if (currentReviews[review.ruleId]) {\n                if (review.result === 'notchecked') {\n                    notCheckedData.push(review.ruleId)\n                } else {\n                    matchingData.push({ new: review, current: currentReviews[review.ruleId] })\n                }\n            } else {\n                unmatchedData.push(review.ruleId)\n            }\n        }\n\n        matchingGrid.store.loadData(matchingData)\n        const items = [\n            {\n                html: `<div class=\"sm-dialog-panel-title\">Reviews matched against ${me.benchmarkId} ${me.revisionStr}</div>`,\n                border: false\n            },\n            matchingGrid\n        ]\n        if (notCheckedData.length > 0 || unmatchedData.length > 0) {\n            const errorItems = [\n                {\n                    html: '<div class=\"sm-dialog-panel-title\">Not reviewed</div>',\n                    border: false\n                },\n                new Ext.form.TextArea({\n                    border: true,\n                    emptyText: 'No unreviewed rules',\n                    readOnly: true,\n                    value: notCheckedData.join('\\n'),\n                    margins: '0 20 0 0',\n                    flex: 1\n                }),\n                {\n                    html: '<div class=\"sm-dialog-panel-title\">Unmatched rules</div>',\n                    border: false\n                },\n                new Ext.form.TextArea({\n                    border: true,\n                    emptyText: 'No unmatched rules',\n                    readOnly: true,\n                    value: unmatchedData.join('\\n'),\n                    flex: 1\n                })\n            ]\n            items.push({\n                flex: 0.25,\n                layout: 'hbox',\n                margins: '20 0 0 0',\n                layoutConfig: {\n                    align: 'stretch',\n                    pack: 'start'\n                },\n                border: false,\n                items: errorItems,\n            })\n        }\n\n\n\n        const config = {\n            monitorValid: true,\n            layout: 'vbox',\n            layoutConfig: {\n                align: 'stretch',\n                pack: 'start',\n                padding: '0 20 20 20',\n            },\n            border: false,\n            items: items,\n            buttons: [\n                {\n                    formBind: true,\n                    iconCls: 'sm-import-icon',\n                    text: 'Import matched reviews',\n                    margins: '0 25',\n                    grid: matchingGrid,\n                    handler: async () => {\n                        const reviews = matchingGrid.store.getRange().map(r => r.data.new)\n                        await me.importHandler(reviews)\n                    }\n                }\n            ],\n            buttonAlign: 'right',\n            grid: matchingGrid\n        }\n\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        SM.ReviewsImport.ReviewsPanel.superclass.initComponent.call(this)\n    }\n})\n\nSM.ReviewsImport.ImportStatusGrid = Ext.extend(Ext.grid.GridPanel, {\n    initComponent: function () {\n        const me = this\n        const fields = [\n            'assetId',\n            'assetName',\n            { name: 'created', type: 'boolean'},\n            { name: 'addedStigs', type: 'boolean'},\n            'inserted',\n            'updated',\n            'rejected'\n        ]\n        const totalTextCmp = new Ext.Toolbar.TextItem({\n            text: '0 records',\n            width: 80\n        })\n        const store = new Ext.data.JsonStore({\n            grid: this,\n            root: '',\n            fields,\n            idProperty: 'assetId',\n            listeners: {\n                load: function (store, records) {\n                    totalTextCmp.setText(store.getCount() + ' records')\n                    me.view.scrollToBottom()\n                },\n                remove: function (store, record, index) {\n                    totalTextCmp.setText(store.getCount() + ' records')\n                }\n            }\n        })\n        const columns = [\n            {\n                header: \"Asset\",\n                width: 200,\n                dataIndex: 'assetName',\n                sortable: true\n            },\n            {\n                header: \"Created\",\n                width: 50,\n                dataIndex: 'created',\n                xtype: 'booleancolumn',\n                sortable: true,\n                align: 'center'\n            },\n            {\n                header: \"Added STIGs\",\n                width: 50,\n                dataIndex: 'addedStigs',\n                xtype: 'booleancolumn',\n                sortable: true,\n                align: 'center'\n            },\n            {\n                header: \"Inserted\",\n                width: 50,\n                dataIndex: 'inserted',\n                sortable: true,\n                align: 'center',\n                renderer: SM.styledZeroRenderer\n            },\n            {\n                header: \"Updated\",\n                width: 50,\n                dataIndex: 'updated',\n                sortable: true,\n                align: 'center',\n                renderer: SM.styledZeroRenderer\n            },\n            {\n                header: \"Rejected\",\n                width: 50,\n                dataIndex: 'rejected',\n                sortable: true,\n                align: 'center',\n                renderer: function (val, record, metadata) {\n                    return val?.length ?? '-'\n                }\n            }\n        ]\n        const config = {\n            layout: 'fit',\n            store,\n            cm: new Ext.grid.ColumnModel({\n                columns: columns\n            }),\n            sm: new Ext.grid.RowSelectionModel({\n                singleSelect: true\n            }),\n            view: new SM.ColumnFilters.GridView({\n                forceFit: true,\n                emptyText: 'No records to display',\n                holdPosition: true, // see overrides.js for why this is needed\n                scrollToBottom: function () {\n                    const dom = this.scroller.dom;\n                    dom.scrollTop  = 999999;\n                    dom.scrollLeft = 0;\n                }\n            }),\n            bbar: new Ext.Toolbar({\n                items: [\n                    {\n                        xtype: 'exportbutton',\n                        hasMenu: false,\n                        grid: this,\n                        gridBasename: 'Import Job',\n                        storeBasename: 'Import Job',\n                        iconCls: 'sm-export-icon',\n                        text: 'CSV'\n                    },\n                    {\n                        xtype: 'tbfill'\n                    },\n                    {\n                        xtype: 'tbseparator'\n                    },\n                    totalTextCmp\n                ]\n            }),\n            listeners: {\n            },\n            getValue: () => true,\n            setValue: (v) => store.loadData(v),\n            validator: Ext.emptyFn,\n            markInvalid: Ext.emptyFn,\n            clearInvalid: Ext.emptyFn,\n            isValid: () => true,\n            getName: () => this.name,\n            validate: Ext.emptyFn\n        }\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        this.superclass().initComponent.call(this)\n    }\n})\n\nSM.ReviewsImport.ImportRejectGrid = Ext.extend(Ext.grid.GridPanel, {\n    initComponent: function () {\n        const fields = [\n            'ruleId',\n            'reason'\n        ]\n        const totalTextCmp = new Ext.Toolbar.TextItem({\n            text: '0 records',\n            width: 80\n        })\n        const store = new Ext.data.JsonStore({\n            grid: this,\n            root: '',\n            fields,\n            idProperty: 'ruleId',\n            listeners: {\n                load: function (store, records) {\n                    totalTextCmp.setText(store.getCount() + ' records')\n                },\n                remove: function (store, record, index) {\n                    totalTextCmp.setText(store.getCount() + ' records')\n                }\n            }\n        })\n        const columns = [\n            {\n                header: \"Rule\",\n                width: 100,\n                dataIndex: 'ruleId',\n                sortable: true\n            },\n            {\n                header: \"Reason\",\n                width: 200,\n                dataIndex: 'reason'\n            }\n        ]\n        const config = {\n            layout: 'fit',\n            store,\n            cm: new Ext.grid.ColumnModel({\n                columns: columns\n            }),\n            sm: new Ext.grid.RowSelectionModel({\n                singleSelect: true\n            }),\n            view: new SM.ColumnFilters.GridView({\n                forceFit: true,\n                emptyText: 'No records to display',\n                holdPosition: true, // see overrides.js for why this is needed\n                scrollToBottom: function () {\n                    const dom = this.scroller.dom;\n                    dom.scrollTop  = 999999;\n                    dom.scrollLeft = 0;\n                }\n            }),\n            bbar: new Ext.Toolbar({\n                items: [\n                    {\n                        xtype: 'exportbutton',\n                        hasMenu: false,\n                        grid: this,\n                        gridBasename: 'Unimported Rules',\n                        storeBasename: 'Unimported Rules',\n                        iconCls: 'sm-export-icon',\n                        text: 'CSV'\n                    },\n                    {\n                        xtype: 'tbfill'\n                    },\n                    {\n                        xtype: 'tbseparator'\n                    },\n                    totalTextCmp\n                ]\n            }),\n            listeners: {\n            },\n            getValue: () => true,\n            setValue: (v) => store.loadData(v),\n            validator: Ext.emptyFn,\n            markInvalid: Ext.emptyFn,\n            clearInvalid: Ext.emptyFn,\n            isValid: () => true,\n            getName: () => this.name,\n            validate: Ext.emptyFn\n        }\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        this.superclass().initComponent.call(this)\n    }\n})\n\nSM.ReviewsImport.ImportProgressPanel = Ext.extend(Ext.Panel, {\n    initComponent: function () {\n        const me = this\n        const pb = new Ext.ProgressBar({\n            text: '',\n            border: false\n        })\n        const st = new SM.ReviewsImport.ImportStatusGrid({\n            flex: 2,\n            margins: {\n                top: 10,\n                bottom: 0,\n                left: 0,\n                right: 0,\n            }\n        })\n        const rj = new SM.ReviewsImport.ImportRejectGrid({\n            flex: 1,\n            title: 'Rejected reviews',\n            margins: {\n                top: 10,\n                bottom: 0,\n                left: 0,\n                right: 0,\n            }          \n        })\n        st.getSelectionModel().on('rowselect', function( sm, index, record) {\n            rj.setTitle(`Rejected reviews for ${record.data.assetName}`)\n            rj.store.loadData(record.data.rejected)\n        })\n        const doneBtn = new Ext.Button({\n            text: 'Done',\n            margins: '0 25',\n            handler: me.doneHandler,\n            disabled: true\n        })\n        const config = {\n            layout: 'vbox',\n            layoutConfig: {\n                align: 'stretch',\n                pack: 'start',\n                padding: '0 20 20 20',\n            },\n            border: false,\n            items: [\n                {\n                    html: '<div class=\"sm-dialog-panel-title\">Importing results</div>',\n                    width: 500,\n                    border: false\n                },\n                pb,\n                st,\n                rj\n            ],\n            buttons: [\n                doneBtn\n            ],\n            buttonAlign: 'right',\n            pb,\n            st,\n            doneBtn\n        }\n\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\n        this.superclass().initComponent.call(this)\n    }\n})\n\nasync function showImportResultFiles(collectionId, createObjects = true, canUpdateAssetProps = true) {\n    try {\n        const cachedCollection = SM.Cache.CollectionMap.get(collectionId)\n        const userGrant = curUser.collectionGrants.find( i => i.collection.collectionId === cachedCollection.collectionId )?.roleId\n        const canAccept = cachedCollection.settings.status.canAccept && (userGrant >= cachedCollection.settings.status.minAcceptGrant)\n        const initialOptions = cachedCollection.settings.importOptions\n        if (initialOptions?.autoStatus === 'accepted' && !canAccept) {\n            initialOptions.autoStatus = 'submitted'\n        }\n\n        const vpSize = Ext.getBody().getViewSize()\n        let height = vpSize.height * 0.85\n        let width = vpSize.width * 0.75 <= 1024 ? vpSize.width * 0.75 : 1024\n\n        const fp = new SM.ReviewsImport.MultiSelectPanel({\n            border: false,\n            height: 'auto',\n            width: 'auto',\n            optionsContext: 'wizard',\n            initialOptions,\n            canAccept,\n            canUpdateAssetProps,\n            listeners: {\n                continue: function(panel) {\n                    const records = panel.selectFilesGrid.store.getRange()\n                    const files = records.map( r => r.json )\n                    warnOnExcessFiles(files)\n                },\n                filelist: function(list) {\n\n                }\n            }\n        })\n        const fpwindow = new Ext.Window({\n            title: 'Import results from CKL(B) or XCCDF files',\n            cls: 'sm-dialog-window sm-round-panel',\n            modal: true,\n            resizable: false,\n            width,\n            height,\n            layout: 'fit',\n            plain: true,\n            bodyStyle: 'padding:5px;',\n            buttonAlign: 'center',\n            items: fp\n        })\n        fpwindow.show(Ext.getBody())\n\n        function warnOnExcessFiles(files) {\n            if (files.length >= 250) {\n                let warnPanel = new SM.ReviewsImport.WarningPanel({\n                    continueHandler: onContinue,\n                    contentTitle: `<b>We notice you have selected ${files.length} files to process.</b>`,\n                    contentText: `This browser app is not optimized for parsing a large number of files and performance is highly dependent on your available client resources.<br><br>\n                    <b>Recommendations</b><br><br>\n                    <ul>\n                    <li>Process your files in smaller batches.</li>\n                    <li>Consider using STIG Manager Watcher</li>\n                    </ul>\n                    <div class=\"sm-dialog-panel-callout\">\n                    <img src=\"img/watcher-icon.svg\" width=40px height=40px align=\"left\" style=\"padding-right: 16px;\"/>\n                    If you have an on-going requirement to process large batches of files you should use STIG Manager Watcher, a CLI client that\n                    can monitor your file system, process large numbers of test result files asynchronously, and post the results to your Collection.<br><br>\n                    Watcher is suitable for use as a service or daemon, as a scheduled task, in automated testing pipelines, or from the command line. \n                    Available from <a href=\"https://github.com/NUWCDIVNPT/stigman-watcher\">https://github.com/NUWCDIVNPT/stigman-watcher</a> \n                    and as an NPM module.</div>`\n                    // contentText: '<ul><l1>One</li><li>Two</li></ul>'\n                })\n                fpwindow.removeAll()\n                fpwindow.setAutoScroll(true)\n                fpwindow.add(warnPanel)\n                fpwindow.doLayout()\n            }\n            else {\n                onContinue()\n            }\n\n            function onContinue() {\n                showParseFiles(files)\n            }\n        }\n\n        async function showParseFiles(files) {\n            try {\n                const pb = new Ext.ProgressBar({\n                    text: '',\n                    // margins: '0 30',\n                    border: false\n                })\n                const pbPanel = new Ext.Panel({\n                    layout: 'vbox',\n                    layoutConfig: {\n                        align: 'stretch',\n                        pack: 'start',\n                        padding: '0 20 20 20'\n                    },\n                    border: false,\n                    items: [\n                        {\n                            html: '<div class=\"sm-dialog-panel-title\">Parsing your files</div>',\n                            width: 500,\n                            margins: '0 0',\n                            border: false\n                        },\n                        pb\n                    ]\n                })\n\n                const task = new Ext.util.DelayedTask(function () {\n                    fpwindow.removeAll()\n                    fpwindow.add(pbPanel)\n                    fpwindow.doLayout()\n                })\n                task.delay(50)\n\n                const results = await parseFiles(files, pb)\n                task.cancel()\n\n                results.stopWizard = !results.rows.length\n                if (results.errors.length > 0 || results.hasDuplicates) {\n                    showErrors(results)\n                } else {\n                    showOptions(results)\n                }\n            }\n            catch (e) {\n                SM.Error.handleError(e)\n            }\n        }\n\n        async function parseFiles(files, pb) {\n            // Get collection assets for matching\n            let apiAssetsResult = Ext.Ajax.requestPromise({\n                url: `${STIGMAN.Env.apiBase}/assets`,\n                params: {\n                    collectionId: collectionId,\n                    projection: 'stigs'\n                },\n                method: 'GET'\n            })\n\n            // Get installed STIGs for matching\n            let apiStigsResult = Ext.Ajax.requestPromise({\n                url: `${STIGMAN.Env.apiBase}/stigs`,\n                method: 'GET'\n            })\n\n            // Get SCAP benchmarkId map\n            let scapBenchmarkMap = await getScapBenchmarkMap()\n\n            let filesHandled = 0\n            const parseResults = {\n                success: [],\n                fail: []\n            }\n\n            // Raw parsing of each file\n            for (const file of files) {\n                pb.updateText(file.name)\n                let extension = file.name.substring(file.name.lastIndexOf(\".\") + 1)\n                let data = await readTextFileAsync(file)\n                if (extension === 'ckl') {\n                    try {\n                        const r = STIGMAN.ClientModules.reviewsFromCkl({\n                            data, \n                            fieldSettings: cachedCollection.settings.fields, \n                            allowAccept: canAccept,\n                            importOptions: fp.parseOptionsFieldSet.getOptions(),\n                            sourceRef: file\n                        })\n                        parseResults.success.push(r)\n                    }\n                    catch (e) {\n                        parseResults.fail.push({\n                            file,\n                            error: e.message\n                        })\n                    }\n                }\n                else if (extension === 'cklb') {\n                    try {\n                        const r = STIGMAN.ClientModules.reviewsFromCklb({\n                            data, \n                            fieldSettings: cachedCollection.settings.fields, \n                            allowAccept: canAccept,\n                            importOptions: fp.parseOptionsFieldSet.getOptions(),\n                            sourceRef: file\n                        })\n                        parseResults.success.push(r)\n                    }\n                    catch (e) {\n                        parseResults.fail.push({\n                            file: file,\n                            error: e.message\n                        })\n                    }\n                }\n                else if (extension === 'xml') {\n                    try {\n                        const r = STIGMAN.ClientModules.reviewsFromScc({\n                            data, \n                            fieldSettings: cachedCollection.settings.fields, \n                            allowAccept: canAccept,\n                            importOptions: fp.parseOptionsFieldSet.getOptions(),\n                            scapBenchmarkMap,\n                            sourceRef: file\n                        })\n                        parseResults.success.push(r)\n                    }\n                    catch (e) {\n                        parseResults.fail.push({\n                            file: file,\n                            error: e.message\n                        })\n                    }\n                }\n                filesHandled++\n                pb.updateProgress(filesHandled / files.length)\n            }\n\n            apiAssetsResult = await apiAssetsResult\n            const apiAssets = JSON.parse(apiAssetsResult.response.responseText)\n\n            apiStigsResult = await apiStigsResult\n            const apiStigs = JSON.parse(apiStigsResult.response.responseText)\n\n            const taskConfig = {\n                collectionId,\n                createObjects,\n                strictRevisionCheck: false\n            } \n            const tasks = new STIGMAN.ClientModules.TaskObject({ apiAssets, apiStigs, parsedResults: parseResults.success, options: taskConfig })\n            const taskErrors = tasks.errors.map( e => ({file: e.sourceRef, error: e.message}))\n            // Transform into data for SM.ReviewsImport.Grid\n            const results = {\n                taskAssets: tasks.taskAssets,\n                rows: [],\n                dupedRows: [],\n                errors: [...parseResults.fail, ...taskErrors],\n                hasDuplicates: false\n            }\n            // Collate multiple checklists into duplicates and the single checklist for POSTing.\n            // The parsed files are sorted in descending date order, the first\n            // item in each checklists array is from the most recently dated file and we will choose this item.\n            for (const taskAsset of tasks.taskAssets.values()) {\n                for (const assetStigChecklists of taskAsset.checklists.values()) {\n                    if (assetStigChecklists.length > 1) {\n                        results.hasDuplicates = true\n                        assetStigChecklists.sort((a,b) => b.sourceRef.lastModified - a.sourceRef.lastModified)\n                        const dupedChecklists = assetStigChecklists.slice(1)\n                        const rowsToPush = dupedChecklists.map( checklist => ({ taskAsset, checklist }))\n                        results.dupedRows.push(...rowsToPush)\n                    }\n                    results.rows.push({ taskAsset, checklist: assetStigChecklists[0]})\n                }\n                for (const ignoredChecklist of taskAsset.checklistsIgnored) {\n                    results.errors.push({\n                        file: ignoredChecklist.sourceRef,\n                        error: `Ignoring ${ignoredChecklist.benchmarkId} ${ignoredChecklist.revisionStr}. ${ignoredChecklist.ignored}`\n                    })\n                }\n            }\n            return results\n        }\n\n        function showErrors(results) {\n            let pePanel = new SM.ReviewsImport.ParseErrorsPanel({\n                errors: results.errors.length > 0 ? results.errors : null,\n                duplicates: results.hasDuplicates ? results.dupedRows : null,\n                stopWizard: results.stopWizard,\n                continueHandler: results.stopWizard ? onAbort : onContinue,\n                backHandler: onBack\n            })\n            fpwindow.removeAll()\n            fpwindow.setAutoScroll(true)\n            fpwindow.add(pePanel)\n            fpwindow.doLayout()\n\n            function onContinue() {\n                showOptions(results)\n            }\n\n            function onAbort() {\n                fpwindow.close()\n            }\n\n            function onBack() {\n\n            }\n        }\n\n        function showOptions(results) {\n            let optionsPanel = new SM.ReviewsImport.OptionsPanel({\n                gridData: results.rows,\n                taskAssets: results.taskAssets,\n                addHandler: showImportProgress\n            })\n            fpwindow.removeAll()\n            fpwindow.add(optionsPanel)\n            fpwindow.doLayout()\n        }\n\n        async function showImportProgress(taskAssets, modifyAssets, importReviews) {\n            let progressPanel\n            try {\n                progressPanel = new SM.ReviewsImport.ImportProgressPanel({\n                    doneHandler: () => {\n                        fpwindow.close()\n                    }\n                })\n                fpwindow.removeAll()\n                fpwindow.add(progressPanel)\n                fpwindow.doLayout()\n\n                const { updateAssetProps } = fp.parseOptionsFieldSet.getOptions()\n                let processedCount = 0\n                for (const taskAsset of taskAssets.values()) {\n                    try {\n                        let assetId = taskAsset.assetProps.assetId\n                        updateProgress(processedCount / taskAssets.size, taskAsset.assetProps.name)\n                        let importAssetResult\n                        if (modifyAssets && (!taskAsset.knownAsset || taskAsset.hasNewAssignment || (taskAsset.hasUpdatedAssetProps && updateAssetProps))) {\n                            importAssetResult = await importAsset(taskAsset, updateAssetProps)\n                            updateStatusGrid(importAssetResult)\n                            assetId = importAssetResult.assetId\n                        }\n                        else {\n                            importAssetResult = {\n                                assetId: taskAsset.assetProps.assetId,\n                                assetName: taskAsset.assetProps.name,\n                                created: false,\n                                addedStigs: false\n                            }\n                        }\n                        if (importReviews) {\n                            let reviewsArray = []\n                            for (const benchmarkId of taskAsset.checklists.keys()) {\n                                reviewsArray = reviewsArray.concat(taskAsset.checklists.get(benchmarkId)[0].reviews)\n                            }\n                            const importReviewArrayResult = await importReviewArray(collectionId, assetId, reviewsArray)\n                            updateStatusGrid({...importAssetResult, ...importReviewArrayResult})\n                        }\n                    }\n                    catch (e) {\n                        SM.Error.handleError(e)\n                    }\n                    finally {\n                        processedCount++\n                        updateProgress(processedCount / taskAssets.size, taskAsset.assetProps.name)\n                    }\n                }\n                updateProgress(0, 'Finished')\n                progressPanel.doneBtn.setDisabled(false)\n                SM.Dispatcher.fireEvent('assetchanged', {collection:{collectionId}})\n            }\n            catch (e) {\n                SM.Dispatcher.fireEvent('assetchanged', {collection:{collectionId}})\n                SM.Error.handleError(e)\n            }\n\n            function updateProgress(value, text) {\n                progressPanel.pb.updateProgress(value, SM.he(text))\n            }\n\n            function updateStatusGrid(status) {\n                progressPanel.st.store.loadData(status, true)\n            }\n\n            async function importAsset(taskAsset, updateAssetProps) {\n                let url, method, jsonData\n                if (taskAsset.knownAsset) {\n                    url = `${STIGMAN.Env.apiBase}/assets/${taskAsset.assetProps.assetId}`\n                    method = 'PATCH'\n                    jsonData = { collectionId: taskAsset.assetProps.collectionId }\n                    if (taskAsset.hasNewAssignment) {\n                        jsonData.stigs = taskAsset.assetProps.stigs\n                    }\n                    if (taskAsset.hasUpdatedAssetProps && updateAssetProps) {\n                        const { ip, fqdn, mac, noncomputing, metadata } = taskAsset.assetProps\n                        Object.assign(jsonData, { ip, fqdn, mac, noncomputing, metadata })\n                    }\n                }\n                else {\n                    url = `${STIGMAN.Env.apiBase}/assets`\n                    method = 'POST'\n                    jsonData = taskAsset.assetProps\n                }\n\n                let result, apiAsset, robj\n                try {\n                    result = await Ext.Ajax.requestPromise({\n                        url: url,\n                        method: method,\n                        headers: { 'Content-Type': 'application/json;charset=utf-8' },\n                        jsonData: jsonData\n                    })\n                    apiAsset = JSON.parse(result.response.responseText)\n                    robj = {\n                        assetId: apiAsset.assetId,\n                        assetName: apiAsset.name,\n                        created: !taskAsset.knownAsset,\n                        addedStigs: taskAsset.hasNewAssignment\n                    }\n                }\n                catch (e) {\n                    SM.Error.handleError(e)\n                }\n\n                return robj\n            }\n\n            async function importReviewArray(collectionId, assetId, reviewArray) {\n                if (!reviewArray?.length) { //Don't try to POST reviews if the review Array is empty.\n                    return {\n                        inserted: 0,\n                        updated: 0,\n                        rejected: []\n                    }                    \n                }\n                else{\n                    let url = `${STIGMAN.Env.apiBase}/collections/${collectionId}/reviews/${assetId}`\n                    let result = await Ext.Ajax.requestPromise({\n                        url: url,\n                        method: 'POST',\n                        headers: { 'Content-Type': 'application/json;charset=utf-8' },\n                        jsonData: reviewArray\n                    })\n                    const apiReviews = JSON.parse(result.response.responseText)\n                    return {\n                        inserted: apiReviews.affected.inserted,\n                        updated: apiReviews.affected.updated,\n                        rejected: apiReviews.rejected\n                    }\n                }\n            } \n        }\n    }\n    catch (e) {\n        Ext.getBody().unmask()\n        SM.Error.handleError(e)\n    }\n}\n\nasync function showImportResultFile(params) {\n    try {\n        const cachedCollection = SM.Cache.CollectionMap.get(params.collectionId)\n        const userGrant = curUser.collectionGrants.find( i => i.collection.collectionId === cachedCollection.collectionId )?.roleId\n        const canAccept = cachedCollection.settings.status.canAccept && (userGrant >= cachedCollection.settings.status.minAcceptGrant)\n        const initialOptions = cachedCollection.settings.importOptions\n        if (initialOptions?.autoStatus === 'accepted' && !canAccept) {\n            initialOptions.autoStatus = 'submitted'\n        }\n\n        const vpSize = Ext.getBody().getViewSize()\n        let height = vpSize.height * 0.85\n        let width = vpSize.width * 0.75 <= 1024 ? vpSize.width * 0.75 : 1024\n\n        const fp = new SM.ReviewsImport.SelectFilesPanel({\n            border: false,\n            autoScroll: true,\n            multifile: false,\n            optionsContext: 'wizard',\n            initialOptions,\n            canAccept,\n            canUpdateAssetProps: false,\n            onFileSelected,\n            onFileDropped\n        })\n\n        const fpwindow = new Ext.Window({\n            title: `Import results (${SM.he(params.benchmarkId)} on ${SM.he(params.assetName)})`,\n            modal: true,\n            resizable: false,\n            // renderTo: el,\n            // autoScroll: true,\n            width: width,\n            height: height,\n            layout: 'fit',\n            plain: true,\n            bodyStyle: 'padding:5px;',\n            buttonAlign: 'center',\n            items: fp\n        })\n\n        fpwindow.show()\n\n        async function onFileDropped(e, panel) {\n            e.stopPropagation()\n            e.preventDefault()\n            panel.style.border = \"\"\n            let entries = []\n            let files = []\n            for (let i = 0; i < e.dataTransfer.items.length; i++) {\n                entries.push(e.dataTransfer.items[i].webkitGetAsEntry())\n            }\n\n            for (const entry of entries) {\n                const entryContent = await readEntryContentAsync(entry)\n                files.push(...entryContent)\n            }\n            showParseFile(files[0])\n\n            function readEntryContentAsync(entry) {\n                return new Promise((resolve, reject) => {\n                    let reading = 0\n                    const files = []\n                    readEntry(entry)\n                    function readEntry(entry) {\n                        if (entry.isFile) {\n                            reading++\n                            let fullPath = entry.fullPath\n                            entry.file(file => {\n                                reading--\n                                file.fullPath = fullPath\n                                files.push(file)\n                                if (reading === 0) {\n                                    resolve(files)\n                                }\n                            })\n                        } else if (entry.isDirectory) {\n                            readReaderContent(entry.createReader())\n                        }\n                    }\n                    function readReaderContent(reader) {\n                        reading++\n                        reader.readEntries(function (entries) {\n                            reading--\n                            for (const entry of entries) {\n                                readEntry(entry)\n                            }\n                            if (reading === 0) {\n                                resolve(files)\n                            }\n                        })\n                    }\n                })\n            }\n        }\n\n        async function onFileSelected(uploadField) {\n            let input = uploadField.fileInput.dom\n            const files = [...input.files]\n            await showParseFile(files[0])\n        }\n\n        async function showParseFile(file) {\n            let task\n            try {\n                const pb = new Ext.ProgressBar({\n                    text: file.name,\n                    // margins: '0 30',\n                    border: false\n                })\n                const pbPanel = new Ext.Panel({\n                    layout: 'vbox',\n                    layoutConfig: {\n                        align: 'stretch',\n                        pack: 'start',\n                        padding: '0 20 20 20'\n                    },\n                    border: false,\n                    items: [\n                        {\n                            html: '<div class=\"sm-dialog-panel-title\">Parsing your file</div>',\n                            width: 500,\n                            margins: '0 0',\n                            border: false\n                        },\n                        pb\n                    ]\n                })\n\n                task = new Ext.util.DelayedTask(function () {\n                    fpwindow.removeAll()\n                    fpwindow.add(pbPanel)\n                    fpwindow.doLayout()\n                })\n                task.delay(250)\n\n\n                const [apiAssetResponse, r] = await Promise.all([\n                    Ext.Ajax.requestPromise({\n                        url: `${STIGMAN.Env.apiBase}/assets/${params.assetId}`,\n                        method: 'GET'\n                    }),\n                    parseFile(file, pb)\n                ])\n                const apiAsset = JSON.parse(apiAssetResponse.response.responseText)\n                let assetMatches = false\n                if (r.target.metadata.cklHostName || apiAsset.metadata.cklHostName) {\n                    assetMatches = apiAsset.metadata.cklHostName?.toLowerCase() === r.target.metadata.cklHostName?.toLowerCase()\n                    && apiAsset.metadata.cklWebDbSite?.toLowerCase() === r.target.metadata.cklWebDbSite?.toLowerCase()\n                    && apiAsset.metadata.cklWebDbInstance?.toLowerCase() === r.target.metadata.cklWebDbInstance?.toLowerCase()\n                } \n                else {\n                    assetMatches = r.target.name.toLowerCase() === apiAsset.name.toLowerCase()\n                }\n                if (!assetMatches) {\n                    let errorStr\n                    if (r.target.metadata.cklHostName || apiAsset.metadata.cklHostName) {\n                        errorStr = `CKL elements and values:<br><br>\n                        &lt;WEB_DB_SITE&gt; = ${r.target.metadata.cklWebDbSite ?? '<span style=\"color:grey;font-style:italic\">No value</span>'}<br>\n                        &lt;WEB_DB_INSTANCE&gt = ${r.target.metadata.cklWebDbInstance ?? '<span style=\"color:grey;font-style:italic\">No value</span>'}<br><br>\n                        Asset metadata properties and values:<br><br>\n                        cklWebDbSite = ${apiAsset.metadata.cklWebDbSite ?? '<span style=\"color:grey;font-style:italic\">No property</span>'}<br>\n                        cklWebDbInstance = ${apiAsset.metadata.cklWebDbInstance ?? '<span style=\"color:grey;font-style:italic\">No property</span>'}<br><br>\n                        The corresponding values do not match.\n                        </div>`\n                    }\n                    else {\n                        errorStr = `The CKL file contains reviews for ${r.target.name}`\n                    }\n                    throw (new Error(`<b>The file does not include reviews for this asset.</b><br><div class=\"sm-dialog-panel-callout\">${errorStr}</div>`))\n                }\n                const checklistFromFile = r.checklists.filter(checklist => checklist.benchmarkId === params.benchmarkId)[0]\n                if (!checklistFromFile) {\n                    throw (new Error(`The file does not include reviews for STIG: <b>${params.benchmarkId}</b><br>The file includes reviews for: ${r.checklists[0].benchmarkId}</p>`))\n                }\n                const checklistFromApi = await Ext.Ajax.requestPromise({\n                    responseType: 'json',\n                    url: `${STIGMAN.Env.apiBase}/assets/${params.assetId}/checklists/${params.benchmarkId}/${params.revisionStr}`,\n                    method: 'GET'\n                })\n                task.cancel()\n                showReviews(checklistFromFile, checklistFromApi, params.benchmarkId, params.revisionStr)\n            }\n            catch (e) {\n                task.cancel()\n                showError(e)\n            }\n        }\n\n        async function parseFile(file, pb) {\n            const extension = file.name.substring(file.name.lastIndexOf(\".\") + 1)\n            const data = await readTextFileAsync(file)\n\n            let r\n            if (extension === 'ckl') {\n                r = STIGMAN.ClientModules.reviewsFromCkl({\n                    data, \n                    fieldSettings: cachedCollection.settings.fields, \n                    allowAccept: canAccept,\n                    importOptions: fp.parseOptionsFieldSet.getOptions(),\n                })\n            }\n            else if (extension === 'cklb') {\n                r = STIGMAN.ClientModules.reviewsFromCklb({\n                    data, \n                    fieldSettings: cachedCollection.settings.fields, \n                    allowAccept: canAccept,\n                    importOptions: fp.parseOptionsFieldSet.getOptions()\n                })\n            }\n            else if (extension === 'xml') {\n                const scapBenchmarkMap = await getScapBenchmarkMap()\n                r = STIGMAN.ClientModules.reviewsFromScc({\n                    data, \n                    fieldSettings: cachedCollection.settings.fields, \n                    allowAccept: canAccept,\n                    importOptions: fp.parseOptionsFieldSet.getOptions(),\n                    scapBenchmarkMap\n                })\n            }\n            else {\n                throw (new Error('Unknown file extension'))\n            }\n            return r\n        }\n\n        function showError(e) {\n            let pePanel = new SM.ReviewsImport.ParseErrorPanel({\n                error: e.message,\n                exitHandler: onExit,\n            })\n            fpwindow.removeAll()\n            fpwindow.setAutoScroll(true)\n            fpwindow.add(pePanel)\n            fpwindow.doLayout()\n\n            function onExit() {\n                fpwindow.close()\n            }\n        }\n\n        function showReviews(checklistFromFile, checklistFromApi, benchmarkId, revisionStr) {\n            let reviewsPanel = new SM.ReviewsImport.ReviewsPanel({\n                checklistFromFile: checklistFromFile,\n                checklistFromApi: checklistFromApi,\n                benchmarkId: benchmarkId,\n                revisionStr: revisionStr,\n                importHandler: showImportProgress\n            })\n            fpwindow.removeAll()\n            fpwindow.add(reviewsPanel)\n            fpwindow.doLayout()\n\n\n        }\n\n        async function showImportProgress(reviews) {\n            let progressPanel\n            try {\n                progressPanel = new SM.ReviewsImport.ImportProgressPanel({\n                    doneHandler: () => {\n                        fpwindow.close()\n                    }\n                })\n                fpwindow.removeAll()\n                fpwindow.add(progressPanel)\n                fpwindow.doLayout()\n\n                updateProgress('Importing...')\n                const importReviewArrayResult = await importReviewArray(reviews)\n                const commonProps = {\n                    assetId: params.assetId,\n                    assetName: params.assetName,\n                    created: false,\n                    addedStigs: false\n                }\n                updateStatusGrid({...commonProps, ...importReviewArrayResult})\n                updateProgress(0, 'Finished')\n                progressPanel.doneBtn.setDisabled(false)\n                params.store.reload()\n            }\n            catch (e) {\n                SM.Error.handleError(e)\n            }\n\n            function updateProgress(value, text) {\n                progressPanel.pb.updateProgress(value, SM.he(text))\n            }\n\n            function updateStatusGrid(status) {\n                progressPanel.st.store.loadData(status, true)\n            }\n\n            async function importReviewArray(reviewArray) {\n                if (!reviewArray?.length) { //Don't try to POST reviews if the review Array is empty.\n                    return {\n                        inserted: 0,\n                        updated: 0,\n                        rejected: []\n                    }           \n                }\n                else{                \n                    let url = `${STIGMAN.Env.apiBase}/collections/${params.collectionId}/reviews/${params.assetId}`\n                    let result = await Ext.Ajax.requestPromise({\n                        url: url,\n                        method: 'POST',\n                        headers: { 'Content-Type': 'application/json;charset=utf-8' },\n                        jsonData: reviewArray\n                    })\n                    const apiReviews = JSON.parse(result.response.responseText)\n                    return {\n                        inserted: apiReviews.affected.inserted,\n                        updated: apiReviews.affected.updated,\n                        rejected: apiReviews.rejected\n                    }\n                }\n            }\n        }\n    }\n    catch (e) {\n        Ext.getBody().unmask()\n        SM.Error.handleError(e)\n    }\n\n}\n\nasync function getScapBenchmarkMap() {\n    let result = await Ext.Ajax.requestPromise({\n        url: `${STIGMAN.Env.apiBase}/stigs/scap-maps`,\n        method: 'GET'\n    })\n    const apiScapMaps = JSON.parse(result.response.responseText)\n    return new Map(apiScapMaps.map(apiScapMap => [apiScapMap.scapBenchmarkId, apiScapMap.benchmarkId]))\n}\n\nfunction readTextFileAsync(file) {\n    return new Promise((resolve, reject) => {\n      let reader = new FileReader();\n  \n      reader.onload = () => {\n        resolve(reader.result);\n      };\n  \n      reader.onerror = reject;\n  \n      reader.readAsText(file);\n    })\n  }\n\n"
  },
  {
    "path": "client/src/js/SM/RowEditorToolbar.js",
    "content": "'use strict'\r\n\r\nExt.ns('SM')\r\n\r\n/**\r\n * @class SM.RowEditorToolbar\r\n * @extends Ext.Toolbar\r\n * Toolbar class that embeds New and Delete buttons\r\n * @cfg {String} itemString The name that will be appended to label strings\r\n * @cfg {String} editor The editor to invoke\r\n * @cfg {String} gridId The id of the grid to which the button is attached \r\n * @cfg {String} newRecord The constructor for a new Record as returned by Ext.data.Record.create() \r\n * @constructor\r\n * Create a toolbar\r\n * @param {Object} config The config object\r\n * @xtype sm-row-editor-toolbar\r\n */\r\nSM.RowEditorToolbar = Ext.extend(Ext.Toolbar, {\r\n    initComponent: function() {\r\n        this.newButton = new SM.RowEditorNewBtn({\r\n            toolbar: this,\r\n            itemString: this.itemString,\r\n            title: this.newTitle,\r\n            editor: this.editor,\r\n            gridId: this.gridId,\r\n            newRecord: this.newRecord\r\n        })\r\n        this.delButton = new SM.RowEditorDelBtn({\r\n            itemString: this.itemString,\r\n            title: this.deleteTitle,\r\n            deleteProperty: this.deleteProperty,\r\n            editor: this.editor,\r\n            gridId: this.gridId,\r\n            disabled: true\r\n        })\r\n        let config = {\r\n            newRecordValues: this.newRecordValues || {},\r\n            items: [\r\n                {\r\n                    xtype: 'tbspacer'\r\n                },\r\n                this.newButton,\r\n                '-',\r\n                this.delButton\r\n            ]\r\n        }\r\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\r\n        SM.RowEditorToolbar.superclass.initComponent.call(this);\r\n    }\r\n})\r\nExt.reg('sm-row-editor-toolbar', SM.RowEditorToolbar);\r\n\r\n/**\r\n * @class SM.RowEditorNewBtn\r\n * @extends Ext.Button\r\n * Simple Button class that invokes an editor\r\n * @cfg {String} newTitle The title of the add button\r\n * @cfg {String} deleteTitle The title of the delete button\r\n * @cfg {String} itemString The name that will be appended to label strings\r\n * @cfg {String} itemString The name that will be appended to label strings\r\n * @cfg {String} editor The editor to invoke\r\n * @cfg {String} gridId The id of the grid to which the button is attached \r\n * @cfg {String} newRecord The constructor for the new Record as returned by Ext.data.Record.create() \r\n * @constructor\r\n * Create a new button\r\n * @param {Object} config The config object\r\n * @xtype sm-new-button\r\n */\r\nSM.RowEditorNewBtn = Ext.extend(Ext.Button, {\r\n    initComponent: function() {\r\n        let config = {\r\n            iconCls: 'icon-add',\r\n            text: this.title ?? `New ${this.itemString}`,\r\n            handler: this.btnHandler\r\n        }\r\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\r\n        SM.RowEditorNewBtn.superclass.initComponent.call(this);\r\n    },\r\n    btnHandler: function (button, event) {\r\n        event.stopPropagation()\r\n        this.grid = Ext.getCmp(this.gridId) // grid should exist by the time we're rendered\r\n        this.editor.stopEditing(false) // don't save changes\r\n        this.grid.store.suspendEvents(false) // don't queue events\r\n        let r = new this.newRecord( {...this.toolbar.newRecordValues} )\r\n        r.editing = true\r\n        // this.grid.store.insert(0, new this.newRecord(this.toolbar.newRecordValues)) // will create a phantom record\r\n        this.grid.store.insert(0, r) // will create a phantom record\r\n        this.grid.store.resumeEvents()\r\n        this.grid.getView().refresh()\r\n        this.grid.getSelectionModel().selectRow(0)\r\n        this.editor.startEditing(0)\r\n        this.grid.colModel.columns[0].editor.focus(true)\r\n    }\r\n})\r\nExt.reg('sm-new-button', SM.RowEditorNewBtn);\r\n\r\n/**\r\n * @class SM.RowEditorDelBtn\r\n * @extends Ext.Button\r\n * Simple Button class that invokes an editor\r\n * @cfg {String} itemString The name that will be appended to label strings\r\n * @cfg {String} deleteProperty The record property that will be used in the delete confirmation\r\n * @cfg {String} editor The editor to invoke\r\n * @cfg {String} gridId The id of the grid to which the button is attached \r\n * @constructor\r\n * Create a new button\r\n * @param {Object} config The config object\r\n * @xtype sm-del-button\r\n */\r\nSM.RowEditorDelBtn = Ext.extend(Ext.Button, {\r\n    initComponent: function() {\r\n        let config = {\r\n            iconCls: 'icon-del',\r\n            text: this.title ?? `Delete ${this.itemString}`,\r\n            itemString: this.itemString,\r\n            deleteProperty: this.deleteProperty,\r\n            handler: this.btnHandler\r\n        }\r\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\r\n        SM.RowEditorDelBtn.superclass.initComponent.call(this);\r\n    },\r\n    btnHandler: function (button, event) {\r\n        this.grid = Ext.getCmp(this.gridId) // grid should exist by the time we're rendered\r\n        this.editor.stopEditing()\r\n        let r = this.grid.getSelectionModel().getSelections()\r\n        let deleteItem = r[0].data[this.deleteProperty]\r\n        Ext.Msg.show({\r\n            title: `Delete ${this.itemString}?`,\r\n            store: this.grid.store,\r\n            record: r[0],\r\n            msg: `You are about to delete ${this.itemString} \"${SM.he(deleteItem)}\". Do you wish to continue?`,\r\n            buttons: Ext.Msg.YESNO,\r\n            fn: function (buttonId, text, options) {\r\n                if (buttonId === 'ok' || buttonId === 'yes') {\r\n                    options.store.remove(options.record)\r\n                }\r\n            },\r\n            icon: Ext.MessageBox.QUESTION\r\n         })\r\n        //this.grid.store.remove(r[0])\r\n    }\r\n})\r\nExt.reg('sm-del-button', SM.RowEditorDelBtn);\r\n\r\n"
  },
  {
    "path": "client/src/js/SM/SelectingGridToolbar.js",
    "content": "'use strict'\r\n\r\nExt.ns('SM')\r\n\r\n/**\r\n * @class SM.SelectingGridToolbar\r\n * @extends Ext.Toolbar\r\n * Toolbar class that embeds a toggle button to enable/disable adding selections \r\n * to a grid and a text field for filtering by a single column\r\n * @cfg {Function} filterFn The function to call when filtering should occur\r\n * @cfg {String} triggerId The id of the trigger \r\n * @cfg {String} triggerEmptyText The filter field's empty text\r\n * @cfg {String} btnId The id of the button \r\n * @cfg {String} btnText The button's text\r\n * @cfg {String} btnTooltipText The button tooltip's text\r\n * @cfg {Function} btnToggledFn The function to call when the button is toggled, usually a grid's method\r\n * @cfg {String} gridId The id of the grid to which we're attached \r\n * @cfg {Array} prependItems The Ext.Components to insert after this class's toolbar items \r\n * @cfg {Array} appendItems The Ext.Components to insert before this class's toolbar items \r\n * @constructor\r\n * Create a new toolbar\r\n * @param {Object} config The config object\r\n * @xtype cmsat-new-button\r\n */\r\nSM.SelectingGridToolbar = Ext.extend(Ext.Toolbar, {\r\n    initComponent: function() {\r\n        this.filterField = new Ext.form.TriggerField ({\r\n            id: this.triggerId || undefined,\r\n            toolbar: this,\r\n            hidden: true,\r\n            triggerClass: 'x-form-clear-trigger',\r\n            onTriggerClick: function() {\r\n                this.triggerBlur()\r\n                this.blur()\r\n                this.setValue('')\r\n                this.toolbar.filterFn.call( Ext.getCmp(this.toolbar.gridId), '', ! this.toolbar.button.pressed ) \r\n            },\r\n            width: 200,\r\n            submitValue: false,\r\n            enableKeyEvents:true,\r\n            emptyText: this.triggerEmptyText,\r\n            listeners: {\r\n                keyup: function (field,e) {\r\n                    this.toolbar.filterFn.call( Ext.getCmp(this.toolbar.gridId), this.getValue(), this.toolbar.button.pressed ) \r\n                    return false\r\n                }\r\n            }\r\n\r\n        })\r\n        this.separator = new Ext.Toolbar.Separator ({\r\n            hidden: true\r\n        }) \r\n        this.button = new Ext.Button ({\r\n            id: this.btnId || undefined,\r\n            icon: 'img/tick_white.png',\r\n            toolbar: this,\r\n            text: this.btnText || 'Select items',\r\n            style: {\r\n                marginRight: '10px'\r\n            },\r\n            tooltip: this.btnTooltipText || 'Select items',\r\n            toggleGroup: 'record-selector',\r\n            enableToggle:true,\r\n            allowDepress: true,\r\n            toggleHandler: function (btn,pressed) {\r\n                if (pressed) {\r\n                    this.toolbar.filterField.show()\r\n                    this.toolbar.separator.show()\r\n                } else {\r\n                    this.toolbar.filterField.setValue('')\r\n                    this.toolbar.filterField.hide()\r\n                    this.toolbar.separator.hide()\r\n                }\r\n                //this.toolbar.filterFn( this.toolbar.filterField.getValue(), this.pressed ) \r\n                this.toolbar.filterFn.call( Ext.getCmp(this.toolbar.gridId), this.toolbar.filterField.getValue(), this.pressed ) \r\n                Ext.getCmp(this.toolbar.gridId).onEditChange(pressed)\r\n            }\r\n\r\n        })\r\n        let baseItems = [\r\n            {\r\n                xtype: 'tbfill'\r\n            },\r\n            this.filterField,\r\n            {\r\n                xtype: 'tbseparator',\r\n                hidden: true\r\n            },\r\n            this.button\r\n        ]\r\n        this.appendItems = this.appendItems || []\r\n        this.prependItems = this.prependItems || []\r\n        let items = this.prependItems.concat(baseItems).concat(this.appendItems)\r\n        let config = {\r\n            items: items\r\n        }\r\n        Ext.apply(this, Ext.apply(this.initialConfig, config))\r\n        SM.SelectingGridToolbar.superclass.initComponent.call(this);\r\n    }\r\n})\r\nExt.reg('sm-sel-grid-toolbar', SM.SelectingGridToolbar);\r\n"
  },
  {
    "path": "client/src/js/SM/ServiceWorker.js",
    "content": "Ext.ns('SM.ServiceWorker')\n\nSM.ServiceWorker.getDownloadUrl = function (request) {\n  if (navigator.serviceWorker?.controller) {\n    const messageChannel = new MessageChannel()\n    navigator.serviceWorker.controller.postMessage({\n      type: 'proxy-url-request',\n      request\n    }, [messageChannel.port1])\n    return new Promise((resolve, reject) => {\n      const timer = setTimeout(resolve, 3000)\n      messageChannel.port2.onmessage = (event) => {\n        clearTimeout(timer)\n        resolve(event.data)\n      }\n    })\n  }\n  return null\n}\n"
  },
  {
    "path": "client/src/js/SM/StackTrace.js",
    "content": "Ext.ns('SM.StackTrace')\n\nSM.StackTrace.parse = function parse(stackString) {\n  var UNKNOWN_FUNCTION = '<unknown>';\n  var chromeRe = /^\\s*at (.*?) ?\\(((?:file|https?|blob|chrome-extension|native|eval|webpack|<anonymous>|\\/|[a-z]:\\\\|\\\\\\\\).*?)(?::(\\d+))?(?::(\\d+))?\\)?\\s*$/i;\n  var chromeEvalRe = /\\((\\S*)(?::(\\d+))(?::(\\d+))\\)/;\n  var winjsRe = /^\\s*at (?:((?:\\[object object\\])?.+) )?\\(?((?:file|ms-appx|https?|webpack|blob):.*?):(\\d+)(?::(\\d+))?\\)?\\s*$/i;\n  var geckoRe = /^\\s*(.*?)(?:\\((.*?)\\))?(?:^|@)((?:file|https?|blob|chrome|webpack|resource|\\[native).*?|[^@]*bundle)(?::(\\d+))?(?::(\\d+))?\\s*$/i;\n  var geckoEvalRe = /(\\S+) line (\\d+)(?: > eval line \\d+)* > eval/i;\n  var javaScriptCoreRe = /^\\s*(?:([^@]*)(?:\\((.*?)\\))?@)?(\\S.*?):(\\d+)(?::(\\d+))?\\s*$/i;\n  var nodeRe = /^\\s*at (?:((?:\\[object object\\])?[^\\\\/]+(?: \\[as \\S+\\])?) )?\\(?(.*?):(\\d+)(?::(\\d+))?\\)?\\s*$/i;\n\n  /**\n   * This parses the different stack traces and puts them into one format\n   * This borrows heavily from TraceKit (https://github.com/csnover/TraceKit)\n   */\n  \n  var lines = stackString.split('\\n');\n  return lines.reduce(function (stack, line) {\n    var parseResult = parseChrome(line) || parseWinjs(line) || parseGecko(line) || parseNode(line) || parseJSC(line);\n\n    if (parseResult) {\n      stack.push(parseResult);\n    }\n\n    return stack;\n  }, []);\n\n  \n  function parseChrome(line) {\n    var parts = chromeRe.exec(line);\n  \n    if (!parts) {\n      return null;\n    }\n  \n    var isNative = parts[2] && parts[2].indexOf('native') === 0; // start of line\n  \n    var isEval = parts[2] && parts[2].indexOf('eval') === 0; // start of line\n  \n    var submatch = chromeEvalRe.exec(parts[2]);\n  \n    if (isEval && submatch != null) {\n      // throw out eval line/column and use top-most line/column number\n      parts[2] = submatch[1]; // url\n  \n      parts[3] = submatch[2]; // line\n  \n      parts[4] = submatch[3]; // column\n    }\n  \n    return {\n      file: !isNative ? parts[2] : null,\n      methodName: parts[1] || UNKNOWN_FUNCTION,\n      arguments: isNative ? [parts[2]] : [],\n      lineNumber: parts[3] ? +parts[3] : null,\n      column: parts[4] ? +parts[4] : null\n    };\n  }\n  \n  \n  function parseWinjs(line) {\n    var parts = winjsRe.exec(line);\n  \n    if (!parts) {\n      return null;\n    }\n  \n    return {\n      file: parts[2],\n      methodName: parts[1] || UNKNOWN_FUNCTION,\n      arguments: [],\n      lineNumber: +parts[3],\n      column: parts[4] ? +parts[4] : null\n    };\n  }\n  \n  \n  function parseGecko(line) {\n    var parts = geckoRe.exec(line);\n  \n    if (!parts) {\n      return null;\n    }\n  \n    var isEval = parts[3] && parts[3].indexOf(' > eval') > -1;\n    var submatch = geckoEvalRe.exec(parts[3]);\n  \n    if (isEval && submatch != null) {\n      // throw out eval line/column and use top-most line number\n      parts[3] = submatch[1];\n      parts[4] = submatch[2];\n      parts[5] = null; // no column when eval\n    }\n  \n    return {\n      file: parts[3],\n      methodName: parts[1] || UNKNOWN_FUNCTION,\n      arguments: parts[2] ? parts[2].split(',') : [],\n      lineNumber: parts[4] ? +parts[4] : null,\n      column: parts[5] ? +parts[5] : null\n    };\n  }\n  \n  \n  function parseJSC(line) {\n    var parts = javaScriptCoreRe.exec(line);\n  \n    if (!parts) {\n      return null;\n    }\n  \n    return {\n      file: parts[3],\n      methodName: parts[1] || UNKNOWN_FUNCTION,\n      arguments: [],\n      lineNumber: +parts[4],\n      column: parts[5] ? +parts[5] : null\n    };\n  }\n  \n  \n  function parseNode(line) {\n    var parts = nodeRe.exec(line);\n  \n    if (!parts) {\n      return null;\n    }\n  \n    return {\n      file: parts[2],\n      methodName: parts[1] || UNKNOWN_FUNCTION,\n      arguments: [],\n      lineNumber: +parts[3],\n      column: parts[4] ? +parts[4] : null\n    };\n  }\n}\n"
  },
  {
    "path": "client/src/js/SM/State.js",
    "content": "Ext.namespace('SM.State')\n\nSM.State.LocalStorageProvider = Ext.extend(Ext.state.Provider, {\n  constructor : function(config){\n    SM.State.LocalStorageProvider.superclass.constructor.call(this)\n    Ext.apply(this, config)\n    this.state = this.readLocalStorage()\n  },\n  set : function(name, value){\n    if(typeof value == \"undefined\" || value === null) {\n      this.clear(name)\n      return\n    }\n    localStorage.setItem(`state:${name}`, JSON.stringify(value))\n    SM.State.LocalStorageProvider.superclass.set.call(this, name, value);\n  },\n  clear : function(name){\n    localStorage.removeItem(`state:${name}`)\n    SM.State.LocalStorageProvider.superclass.clear.call(this, name)\n  },\n  readLocalStorage : function(){\n    const state = {}\n    for (const key of Object.keys(localStorage)) {\n      if (key.substring(0,6) === 'state:') {\n        state[key.substring(6)] = JSON.parse(localStorage.getItem(key))\n      }\n    }\n    return state\n  }\n})"
  },
  {
    "path": "client/src/js/SM/StigRevision.js",
    "content": "Ext.ns('SM.StigRevision')\n\nSM.StigRevision.RevisionMenuBtn = Ext.extend(Ext.Button, {\n  initComponent: function () {\n    const _this = this\n    menu = new SM.StigRevision.RevisionMenu( { iconCls: 'icon-del' })\n    const config = { menu }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.StigRevision.RevisionMenuBtn.superclass.initComponent.call(this)\n  }\n})\n\nSM.StigRevision.RevisionMenu = Ext.extend(Ext.menu.Menu, {\n  load: async function (record) {\n    this.removeAll()\n    const re = /^V([\\d,\\.]{1,5})R([\\d,\\.]{1,5})$/\n\n    for (const revision of record.data.revisions) {\n      const matches = re.exec(revision.revisionStr)\n      if (matches && matches.length === 3) {\n        const text = `Version ${SM.he(matches[1])} Release ${SM.he(matches[2])}&nbsp;&nbsp;<span class=\"sm-review-sprite sm-review-sprite-date\">${revision.benchmarkDate}</span> <span class=\"sm-navtree-sprite\">${revision.status}</span>${revision.revisionStr === record.data.lastRevisionStr ? '<span class=\"sm-navtree-sprite\">latest</span>' : ''}`\n        this.addItem({\n          iconCls: revision.collectionIds.length ? 'sm-pin-icon' : 'icon-del',\n          isAssigned: !!revision.collectionIds.length,\n          text,\n          revisionStr: revision.revisionStr,\n          benchmarkId: record.data.benchmarkId,\n          record\n        })\n      }\n    }\n    this.addItem('-')\n    this.addItem({\n      iconCls: 'icon-del',\n      text: 'Remove all revisions',\n      benchmarkId: record.data.benchmarkId,\n      isAssigned: !!record.data.collectionIds.length,\n      record\n    })\n  }\n})\n\nSM.StigRevision.removeStig = function (benchmarkId, force = false) {\n  return Ext.Ajax.requestPromise({\n    responseType: 'json',\n    url: `${STIGMAN.Env.apiBase}/stigs/${benchmarkId}?elevate=true&force=${force ? 'true' : 'false'}`,\n    method: 'DELETE'\n  })\n}\n\nSM.StigRevision.removeStigRevision = async function (benchmarkId, revisionStr, force = false) {\n  const result = await Ext.Ajax.requestPromise({\n    url: `${STIGMAN.Env.apiBase}/stigs/${benchmarkId}/revisions/${revisionStr}?elevate=true&force=${force ? 'true' : 'false'}`,\n    method: 'DELETE'\n  })\n  return JSON.parse(result.response.responseText)\n}\n\nSM.StigRevision.getStig = async function (benchmarkId) {\n  const result = await Ext.Ajax.requestPromise({\n    url: `${STIGMAN.Env.apiBase}/stigs/${benchmarkId}`,\n    method: 'GET'\n  })\n  return JSON.parse(result.response.responseText)\n}\n\nSM.StigRevision.StigGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n\n    const fields = Ext.data.Record.create([\n      {name: 'benchmarkId', type: 'string', sortType: Ext.data.SortTypes.asUCString},\n      'title',\n      'marking',\n      'status',\n      'lastRevisionStr',\n      'lastRevisionDate',\n      'collectionIds',\n      {\n        name: 'collections',\n        convert: function (v, record) {\n          return record.collectionIds.length\n        }\n      },\n      'ruleCount',\n      'revisionStrs',\n      'revisions'\n    ])\n\n    const sm = new Ext.grid.CheckboxSelectionModel({ \n      singleSelect: false,\n      checkOnly: false,\n      listeners: {\n        selectionchange: function (sm) {\n          const count = sm.getCount()\n          if (count === 1) {\n            const r = sm.getSelected()\n            if (r.data.revisionStrs.length >= 2) {\n              revisionMenu.load(r)\n              removeRevisionBtn.setVisible(true)\n              removeStigsBtn.setVisible(false)\n            }\n            else {\n              removeRevisionBtn.setVisible(false)\n              removeStigsBtn.setVisible(true)\n              removeStigsBtn.setDisabled(false)\n              removeStigsBtn.setText(`Remove STIG`)\n            }\n            libraryBtn.setDisabled(false)\n          }\n          else {\n            libraryBtn.setDisabled(true)\n            removeRevisionBtn.setVisible(false)\n            if (count > 0) {\n              removeStigsBtn.setText(`Remove STIG (${count})`)\n              removeStigsBtn.setDisabled(false)\n            }\n            else {\n              removeStigsBtn.setText(`Remove`)\n              removeStigsBtn.setDisabled(true)\n            }\n            removeStigsBtn.setVisible(true)\n          }\n\n          SM.SetCheckboxSelModelHeaderState(sm)\n        }\n      }\n    })\n  \n    const columns = [\n      sm,\n      { \t\n        header: \"Benchmark ID\",\n        width: 300,\n        dataIndex: 'benchmarkId',\n        sortable: true,\n        filter: {type: 'string'},\n        renderer: function(v, md, r) {\n          return `${v} ${r.data.marking ? `<span class=\"sm-sprite-${r.data.marking}\"></span>` : ''}`\n        }\n      },\n      { \t\n        header: \"Title\",\n        id: 'stigGrid-title-column',\n        width: 350,\n        dataIndex: 'title',\n        sortable: true,\n        filter: {type: 'string'}\n      },\n      { \t\n        header: \"Status\",\n        width: 150,\n        align: \"center\",\n        dataIndex: 'status',\n        sortable: true,\n        filter: {type: 'values'}\n      },\n      { \t\n        header: \"Latest revision\",\n        width: 150,\n        align: \"center\",\n        dataIndex: 'lastRevisionStr',\n        sortable: true\n      },\n      { \t\n        header: \"Revision date\",\n        width: 150,\n        align: \"center\",\n        dataIndex: 'lastRevisionDate',\n        xtype: 'datecolumn',\n        format: 'Y-m-d',\n        sortable: true\n      },\n      { \t\n        header: \"Earlier revisions\",\n        width: 150,\n        align: \"center\",\n        dataIndex: 'revisionStrs',\n        sortable: true,\n        renderer: (v, md, r) => v.filter( rev => rev !== r.data.lastRevisionStr ).join(', ') || '--'\n      },\n      { \t\n        header: \"Rules\",\n        width: 150,\n        align: \"center\",\n        dataIndex: 'ruleCount',\n        sortable: true\n      },\n      { \t\n        header: \"Collections\",\n        width: 150,\n        align: \"center\",\n        dataIndex: 'collections',\n        sortable: true,\n        renderer: SM.styledZeroRenderer\n      }\n    ]\n  \n    const store = new Ext.data.JsonStore({\n      proxy: new Ext.data.HttpProxy({\n        url: `${STIGMAN.Env.apiBase}/stigs?elevate=true&projection=revisions`,\n        method: 'GET'\n      }),\n      root: '',\n      fields,\n      idProperty: 'benchmarkId',\n      sortInfo: {\n        field: 'benchmarkId',\n        direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      },\n      listeners: {\n        // load: function (store,records) {\n        //   store.isLoaded = true\n        //   _this.getSelectionModel().selectFirstRow();\n        // }\n      }\n    })\n\n    const totalTextCmp = new SM.RowCountTextItem({ store })\n\n    const view = new SM.ColumnFilters.GridView({\n      forceFit:true,\n      // These listeners keep the grid in the same scroll position after the store is reloaded\n      listeners: {\n        beforerefresh: function(v) {\n           v.scrollTop = v.scroller.dom.scrollTop;\n           v.scrollHeight = v.scroller.dom.scrollHeight;\n        },\n        refresh: function(v) {\n          setTimeout(function() { \n            v.scroller.dom.scrollTop = v.scrollTop + (v.scrollTop == 0 ? 0 : v.scroller.dom.scrollHeight - v.scrollHeight);\n          }, 100);\n        },\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())  \n        }\n      },\n      deferEmptyText:false\n    })\n\n    const importStigsBtn = new Ext.Button({\n      iconCls: 'sm-import-icon',\n      text: 'Import STIGs',\n      disabled: false,\n      handler: function() {\n        SM.StigRevision.ImportStigs(_this)\n      }\n    })\n\n    const libraryBtn = new Ext.Button({\n      iconCls: 'sm-library-icon',\n      text: 'Open in Library',\n      disabled: true,\n      handler: function () {\n        const record = _this.getSelectionModel().getSelected()\n        addLibraryStig({\n          benchmarkId: record.data.benchmarkId,\n          revisionStr: record.data.lastRevisionStr,\n          stigTitle: record.data.title\n        }) \n      }\n    })\n    \n    const removeStigsBtn = new Ext.Button({\n      iconCls: 'icon-del',\n      text: 'Remove',\n      disabled: true,\n      handler: async function () {\n        try {\n          const records = _this.getSelectionModel().getSelections()\n          const heBenchmarkIds = records.map( r => SM.he(r.data.benchmarkId))\n          const forceRequired = records.some( r => r.data.collections > 0 )\n          let benchmarkList \n          if (heBenchmarkIds.length > 10) {\n            benchmarkList = `The ${heBenchmarkIds.length} selected STIGs`\n          }\n          else {\n            benchmarkList = heBenchmarkIds.join('<br>')\n          }\n          const confirmed = await SM.StigRevision.showConfirm({\n            message: `Confirm removal of:<br/><br/>${benchmarkList}<br/><br/>`,\n            forceMessage: `${heBenchmarkIds.length === 1 ? 'This STIG is' : 'Some STIGs are'} in use. Remove anyway?`,\n            forceRequired\n          })\n          if (confirmed) {\n            Ext.getBody().mask('Removing')\n            for (const record of records) {\n              await SM.StigRevision.removeStig(record.data.benchmarkId, !!record.data.collections)\n              _this.store.remove(record)\n            }    \n          }\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n        finally {\n          Ext.getBody().unmask()\n        }\n      }\n    })\n\n    const revisionMenu = new SM.StigRevision.RevisionMenu({\n      listeners: {\n        itemclick: async function (item, e) {\n          try {\n            const confirmed = await SM.StigRevision.showConfirm({\n              message: `Confirm removal of:<br/><br/>${item.benchmarkId} ${item.revisionStr ? item.revisionStr : ''}<br/><br/>`,\n              forceMessage: `This ${item.revisionStr ? 'Revision' : 'STIG'} is in use. Remove anyway?`,\n              forceRequired: item.isAssigned\n            })\n  \n            if (confirmed) {\n              Ext.getBody().mask('Removing')\n              const record = item.record\n              if (!item.revisionStr) { // remove STIG\n                await SM.StigRevision.removeStig(item.benchmarkId, item.isAssigned)\n                _this.store.remove(record)\n              }\n              else {\n                await SM.StigRevision.removeStigRevision(item.benchmarkId, item.revisionStr, item.isAssigned)\n                const apiStig = await SM.StigRevision.getStig(item.benchmarkId)\n                record.data = apiStig\n                record.commit()\n\n                // hack to reselect the record\n                const sm = _this.getSelectionModel()\n\t\t\t\t\t\t    sm.onRefresh()\n                sm.fireEvent('selectionchange', sm)\n              }\n            }\n          }\n          catch (e) {\n            SM.Error.handleError(e)\n          }\n          finally {\n            Ext.getBody().unmask()\n          }\n            \n        }\n      }\n    })\n\n    const removeRevisionBtn = new Ext.Button({\n      iconCls: 'icon-del',\n      text: 'Remove Revision',\n      hidden: true,\n      menu: revisionMenu\n    })\n\n    const tbar = [\n      importStigsBtn,\n      '-',\n      removeStigsBtn,\n      removeRevisionBtn,\n      '-',\n      libraryBtn\n    ]\n\n    const bbar = new Ext.Toolbar({\n      items: [\n      {\n        xtype: 'exportbutton',\n        hasMenu: false,\n        gridBasename: 'Installed-STIGs',\n        exportType: 'grid',\n        iconCls: 'sm-export-icon',\n        text: 'CSV'\n      },\n      {\n        xtype: 'tbfill'\n      },{\n        xtype: 'tbseparator'\n      },\n      totalTextCmp]\n    })\n\n    const config = {\n      store,\n      columns,\n      view,\n      tbar,\n      bbar,\n      sm,\n      listeners: {\n        rowdblclick: function (grid, rowIndex) {\n          const record = grid.store.getAt(rowIndex)\n          addLibraryStig({\n            benchmarkId: record.data.benchmarkId,\n            revisionStr: record.data.lastRevisionStr,\n            stigTitle: record.data.title\n          }) \n        },\n        keydown: SM.CtrlAGridHandler\n      }  \n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.StigRevision.StigGrid.superclass.initComponent.call(this)\n  }\n})\nExt.reg('sm-stigrevision-grid', SM.StigRevision.StigGrid)\n\nSM.StigRevision.ImportStigs = function ( grid ) {\n  const clobberCb = new Ext.form.Checkbox({\n    name: 'clobber',\n    boxLabel: 'Replace existing Revisions',\n    checked: localStorage.getItem('clobberRevision') == 1\n  })\n  const fp = new Ext.FormPanel({\n    padding: 10,\n    standardSubmit: false,\n    fileUpload: true,\n    baseCls: 'x-plain',\n    monitorValid: true,\n    autoHeight: true,\n    labelWidth: 1,\n    hideLabel: true,\n    defaults: {\n      anchor: '100%',\n      allowBlank: false\n    },\n    items: [\n      { \n        xtype:'fieldset',\n        title: 'Instructions',\n        autoHeight:true,\n        items: [\n        {\n          xtype: 'displayfield',\n          id: 'infoText1',\n          name: 'infoText',\n          html: \"Please browse for a STIG archive or XCCDF\",\n        }]\n      },\n      {\n        xtype: 'fileuploadfield',\n        id: 'form-file',\n        emptyText: 'Browse for a file...',\n        name: 'importFile',\n        accept: '.zip,.xml',\n        buttonText: 'Browse...',\n        buttonCfg: {\n          icon: \"img/disc_drive.png\"\n        }\n      },\n      clobberCb\n    ],\n    buttonAlign: 'center',\n    buttons: [{\n      text: 'Import',\n      icon: 'img/page_white_get.png',\n      tooltip: 'Import the archive',\n      formBind: true,\n      handler: async function () {\n        try {\n          let input = document.getElementById(\"form-file-file\")\n          const clobber = clobberCb.getValue()\n          localStorage.setItem('clobberRevision', clobber ? '1' : '0')\n          let file = input.files[0]\n          let extension = file.name.substring(file.name.lastIndexOf(\".\")+1)\n          if (extension.toLowerCase() === 'xml') {\n            // let data = await readTextFileAsync(file)\n            // const r = ReviewParser.benchmarkFromXccdf({\n            //   data, \n            //   XMLParser: fxp.XMLParser,\n            //   valueProcessor: tagValueProcessor\n            // })\n            \n            let formEl = fp.getForm().getEl().dom\n            let formData = new FormData(formEl)\n            formData.delete('clobber')\n            appwindow.close();\n            initProgress(\"Importing file\", \"Initializing...\");\n            updateStatusText (file.name)\n    \n            \n            let response = await fetch(`${STIGMAN.Env.apiBase}/stigs?elevate=true&clobber=${clobber ? 'true':'false'}`, {\n              method: 'POST',\n              headers: new Headers({\n                'Authorization': `Bearer ${window.oidcWorker.token}`\n              }),\n              body: formData\n            })\n            let json = await response.json()\n            updateStatusText (JSON.stringify(json, null, 2))\n            updateStatusText ('------------------------------------')\n            updateStatusText ('Done')\n            updateProgress(0, 'Done')\n          }\n          else if (extension === 'zip') {\n            appwindow.close()\n            initProgress(\"Importing file\", \"Initializing...\");\n            await processZip(input.files[0], clobber)\n            updateStatusText ('Done')\n            updateProgress(0, 'Done')\n          } else {\n            throw new Error(`No handler for ${extension}`)\n          }\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n        finally {\n          grid?.getStore()?.reload()\n        }\n\n        async function processZip (f, clobber) {\n          try {\n            let parentZip = new JSZip()\n       \n            let contents = await parentZip.loadAsync(f)\n            let fns = Object.keys(contents.files)\n            let xmlMembers = fns.filter( fn => fn.toLowerCase().endsWith('.xml'))\n            let zipMembers = fns.filter( fn => fn.toLowerCase().endsWith('.zip') )\n            for (let x=0,l=xmlMembers.length; x<l; x++) {\n              let xml = xmlMembers[x]\n              updateStatusText (xml)\n              let data = await parentZip.files[xml].async(\"blob\")\n              let fd = new FormData()\n              fd.append('importFile', data, xml)\n\n              \n              let response = await fetch(`${STIGMAN.Env.apiBase}/stigs?elevate=true&clobber=${clobber ? 'true':'false'}`, {\n                method: 'POST',\n                params: { clobber },\n                headers: new Headers({\n                  'Authorization': `Bearer ${window.oidcWorker.token}`\n                }),\n                body: fd\n              })\n              let json = await response.json()\n              updateStatusText (JSON.stringify(json, null, 2))\n              updateStatusText ('------------------------------------')\n\n            }\n            for (let x=0, l=zipMembers.length; x<l; x++) {\n              let zip = zipMembers[x]\n              updateProgress((x+1)/l, zip.slice(zip.lastIndexOf('/') + 1))\n              updateStatusText (`Extracting member ${zip}`)\n              let data = await parentZip.files[zip].async(\"blob\")\n              updateStatusText (`Processing member ${zip}`)\n              await processZip(data, clobber)\n            }\n            updateProgress(0, \"\")\n\n          }\n          catch (e) {\n            updateStatusText (`Error processing ZIP: ${e.message}`)\n            updateStatusText ('------------------------------------')\n          }\n          \n        }\n      }\n    },\n    {\n      text: 'Cancel',\n      handler: function() {\n        appwindow.close()\n      }\n    }\n    ]\n  })\n\n  const appwindow = new Ext.Window({\n    title: 'Import STIG ZIP archive or XCCDF file',\n    cls: 'sm-dialog-window sm-round-panel',\n    modal: true,\n    width: 500,\n    layout: 'fit',\n    plain:true,\n    bodyStyle:'padding:5px;',\n    buttonAlign:'center',\n    items: fp\n  })\n\n  appwindow.show(Ext.getBody());\n\n}\n\nSM.StigRevision.ConfirmDeletePanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const items = [\n      new Ext.form.DisplayField({ \n        value: this.message || 'Confirm delete'\n      })\n    ]\n    if (this.forceRequired) {\n      items.push(new Ext.form.Checkbox({\n        boxLabel: this.forceBoxLabel || 'Some items are in use. Confirm forced delete by checking this box.',\n        listeners: {\n          check: this.forceCheckboxHandler\n        }\n      }))\n    }\n\n    const config = {\n      baseCls: 'x-plain',\n      hideLabels: true,\n      layout: 'form',\n      items\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.StigRevision.showConfirm = function ({message, forceMessage, forceRequired}) {\n  return new Promise((resolve, reject) => {\n    const removeBtn = new Ext.Button({\n      text: forceRequired ? 'Forcibly remove' : 'Remove',\n      iconCls: 'icon-del',\n      disabled: forceRequired,\n      handler: () => { \n        fpwindow.close()\n        resolve(true)\n      }\n    })\n    const cancelBtn = new Ext.Button({\n      text: 'Cancel',\n      handler: () => { \n        fpwindow.close()\n        resolve(false)\n      }\n    })\n    function forceCheckboxHandler (cb, checked) {\n      removeBtn.setDisabled(!checked)\n    }\n    const fp = new SM.StigRevision.ConfirmDeletePanel({\n      message,\n      forceBoxLabel: forceMessage,\n      forceRequired,\n      forceCheckboxHandler\n    })\n    const fpwindow = new Ext.Window({\n      title: 'Confirm STIG removal',\n      cls: 'sm-dialog-window sm-round-panel',\n      modal: true,\n      resizable: false,\n      closable: false,\n      width: 300,\n      // height: 300,\n      layout: 'fit',\n      plain: true,\n      bodyStyle: 'padding:15px;',\n      buttonAlign: 'right',\n      items: fp,\n      buttons: [ cancelBtn, removeBtn ]\n    })\n    fpwindow.show(Ext.getBody())\n  })\n}\n"
  },
  {
    "path": "client/src/js/SM/TipContent.js",
    "content": "Ext.ns('SM.TipContent')\n\nExt.ns('SM.TipContent.ImportOptions')\n\nSM.TipContent.ImportOptions.AutoStatus = `Choose the \"Goal\" status for imported reviews.\n<br><br><b>Keep Existing:</b> Keep existing status, if possible. New reviews are set to \"Saved\" status. The resulting Status will also take into consideration the \"Reset to Saved\" configuration that is set in the Review Status section of Collection Settings. \n<br><br><b>Saved:</b> Set Reviews to \"Saved\" status.\n<br><br><b>Submitted:</b> Set Review to \"Submitted\" status. If review does not meet Submit requirements, Review will be set to Saved.\n<br><br><b>Accepted:</b> If importing user has the proper grant, set Review to \"Accepted\". If they cannot Accept, Reviews will be set to \"Submitted.\" If review does not meet Submit requirements, Review will be set to \"Saved.\"\n<br><br>Note: Informational and Not Reviewed reviews will always be set to \"Saved\" status.\n`\n\nSM.TipContent.ImportOptions.Unreviewed = `Should Reviews without a compliance result (NF, NA, O) be imported? \n<br><br><b>Never:</b> Ignore these Reviews. Existing Reviews will not change.  \n<br><br><b>Having Comments:</b> Import these Reviews only if Detail or Comment is also provided. This is usually only seen in CKL sources.\n<br><br><b>Always:</b> Always import these Reviews.\n`\n\nSM.TipContent.ImportOptions.UnreviewedCommented = `The result to be imported for Reviews without a compliance result (NR, NA, O) but having Detail or Comment. This is usually only seen in CKL sources.\n<br><br><b>Informational:</b> Set result to \"Informational\" to distinguish it from those Reviews without commentary. \n<br><br><b>Not Reviewed:</b> Leave the result as \"Not_Reviewed\"\n`\n\nSM.TipContent.ImportOptions.EmptyComment = `How to handle Reviews with empty commentary text:\n<br><br><b>Ignored:</b> Retain any existing text already stored.\n<br><br><b>Replaced:</b> Create a static message. This message will become the text for the purposes of meeting submission requirements.\n<br><br><b>Imported:</b> This will have the effect of clearing any existing text.\n`\n\nSM.TipContent.ImportOptions.UpdateAssetProps = `Should Asset properties be updated from the import source when the Asset already exists in the Collection?\n<br><br>When <b>checked</b>, the import will update Asset information (IP, MAC, FQDN, noncomputing, and metadata including role and tech area) from the import source, if present.\n<br><br>When <b>unchecked</b>, existing Asset properties will be preserved.\n`\n\nSM.TipContent.Roles = `\n<b>Roles</b> <br>\n- <b>Restricted:</b> Can access specific STIGs on specific Assets only. <br>\n- <b>Full:</b> Can access any Asset/STIG in the Collection but cannot add/remove/modify Assets, STIGs, or Grants. <br>\n- <b>Manage:</b> Can access any Asset/STIG in the Collection and can also add/remove/modify Assets, STIGs, and Grants except for User \"Owner\" grants. Optionally responsible for accepting and rejecting reviews from evaluators. <br>\n- <b>Owner:</b> Everything in the \"Manage\" level.  Can also delete the Collection and create new Owner Grants.  Responsible for accepting and rejecting reviews from evaluators. <br>\n<br>\n* By default, Users with a Restricted grant to a Collection can't access any STIG on any Asset. They can be assigned specific STIGs on specific Assets using the \"Edit Restriced Access...\" button in the Grants panel toolbar. <br>\n`\n\nSM.TipContent.RulePropertyDiffs = `<b>Changes to these rule properties are detected</b><br>\n- ruleId<br>\n- title<br>\n- groupId<br>\n- groupTitle<br>\n- severity<br>\n- weight<br>\n- mitigations<br>\n- documentable<br>\n- falseNegatives<br>\n- falsePositives<br>\n- responsibility<br>\n- vulnDiscussion<br>\n- thirdPartyTools<br>\n- potentialImpacts<br>\n- mitigationControl<br>\n- severityOverrideGuidance<br>\n- check<br>\n- fix<br>\n- cci<br>\n`\n\nSM.TipContent.DefaultRevision = `\n<b>Set the default STIG revision to use for this Collection.</b> <br><br>\nAll calculated Metrics and Workspaces for this Collection will default to the \"pinned\" STIG Revision specified here. <br><br>\n- <b>Most Recent Revision:</b> The Collection Metrics and Workspaces will default to the latest STIG in the system as they are updated. <br><br>\n- <b>Revision String (Date):</b> Pin the default to the specified Revision<br><br>\n`\n\nExt.ns('SM.TipContent.CloneOptions')\n\nSM.TipContent.CloneOptions.ClickThru = `<span class=\"sm-warning-header\">Warning</span><br><br>\nCloning large Collections can take several minutes! Users may see performance impacts when accessing the source Collection during this time.<br><br>\n\nMaking changes to the source Collection while it is being cloned may lead to inconsistent results in the cloned Collection.<br><br>\n\n<b>Before proceeding, it is recommended that you warn other Users to refrain from modifying any components of the source Collection while the cloning process is underway.</b>`\n\nSM.TipContent.CloneOptions.Grants = `<b>Clone the source Collection's users and their grants.</b><br><br>Whether this option is selected or not, the creator of the cloned Collection (ie. you) will be given an Owner grant in the clone.`\n\nSM.TipContent.CloneOptions.Labels = `<b>Clone the source Collection's available labels.</b><br><br>You must select this option AND the Assets option for labels to be mapped to Assets in the clone.`\n\nSM.TipContent.CloneOptions.Assets = `<b>Clone the source Collection's Assets and their core properties.</b><br><br>This option must be selected to enable the STIGs and Pin Revisions options below.`\n\nSM.TipContent.CloneOptions.Stigs = `<b>Assignments and Reviews:</b> Assets will be cloned with their current STIG assignments and ALL stored Reviews. This will include Reviews that are no longer associated with a current STIG assignment or are associated with a non-default Revision of a STIG.<br><br>\n<b>Assignments but not Reviews:</b> Assets will be cloned with their current STIG assignments but NO stored Reviews will be cloned. All Metrics will be set to zero.<br><br> \n<b>Do not clone assignments or Reviews:</b> Assets will be cloned with only their core properties and no STIG assignments or Reviews. The Pin Revisions option will be disabled.`\n\nSM.TipContent.CloneOptions.Revisions = `<b>Match the source's pinned Revisions:</b> STIGs in the source Collection that are pinned to a specific Revision will be pinned to that Revision in the clone. STIGs that track the latest Revision (unpinned) in the source will be unpinned in the clone.<br><br> \n<b>Pin the source's default revisions:</b> All STIGs in the clone will be pinned to a specific Revision. STIGs that are pinned to a specific Revision in the source Collection will be pinned to that Revision in the clone. STIGs that track the latest Revision in the source will be pinned to the current latest Revision in the clone.`\n\nExt.ns('SM.TipContent.ExportOptions')\n\nSM.TipContent.ExportOptions.CollectionTpl = `Export results for selected Assets/STIGs to another Collection.<br><br>\nAssets or STIG Assignments that do not exist in the destination Collection will be created. Reviews for existing Assets will be updated in accordance with the destination Collection's import settings.<br><br>\nThe user must have a \"Manage\" or \"Owner\" grant in the destination Collection.<br><br>\n<b>Exporting results to another Collection is limited to a maximum of {maxItems} Assets at a time.</b>`\n\nSM.TipContent.ExportOptions.ZipArchive = `Export a .zip archive of checklists for selected Assets/STIGs in the desired format.`\n\nSM.TipContent.ImportFromCollectionPanel = `Will not create new Assets or STIG assignments.<br><br>To create new Assets or STIG assignments, import from the Collection Management workspace.`\n\nSM.TipContent.ImportFromCollectionManager = `Will create new Assets and STIG assignments if they do not exist in this Collection.`\n\nSM.TipContent.CORA =`\n <b>Cyber Operational Readiness Assessment (CORA)</b> evaluates the effectiveness of security controls and operational processes.<br><br>\n <b>Risk Rating</b> is calculated from a <b>Weighted Average</b> that reflects the number and severity of <i>open</i> or <i>unassessed</i> rules.<br>\n Reviews with <i>Open</i>, <i>Not a Finding</i>, or <i>Not Applicable</i> results are considered <i>assessed</i>.<br>\n Reviews with other results (such as <i>Not Reviewed</i> or <i>Informational</i>) are treated as <i>unassessed</i>.\n <br><br>\n  Each severity category (CAT I, II, III) is weighted differently when calculating the overall score:\n  <br>\n  <b>Weighted Average</b> formula:<br>\n  <code>(p₁·w₁ + p₂·w₂ + p₃·w₃) / (w₁ + w₂ + w₃)</code><br>\n  where:<br>\n  - <code>pₙ</code> = % of open + unassessed rules in that category<br>\n  - <code>wₙ</code> = weight <b>(CAT I = 10, CAT II = 4, CAT III = 1)</b><br><br>\n  The <b>Risk Rating</b> is primarily determined by the <b>Weighted Average</b>, except for the special \"Low\" risk condition:<br>\n  <ul style=\"padding-left: 16px; margin: 4px 0;\">\n    <li><span class=\"sm-cora-tooltip-label sm-cora-risk-very-high\"><b>Very High</b></span><b> ≥ 20%</b></li>\n    <li><span class=\"sm-cora-tooltip-label sm-cora-risk-high\"><b>High</b></span><b> ≥ 10% and &lt; 20%</b></li>\n    <li><span class=\"sm-cora-tooltip-label sm-cora-risk-moderate\"><b>Moderate</b></span><b> &gt; 0% and &lt; 10%</b></li>\n    <li><span class=\"sm-cora-tooltip-label sm-cora-risk-low\"><b>Low</b></span><b> CAT I = 0; CAT II &amp; III each &lt; 5% <i>unweighted</i></b></li>\n    <li><span class=\"sm-cora-tooltip-label sm-cora-risk-very-low\"><b>Very Low</b></span><b> 0% total</b></li>\n  </ul>\n`\n"
  },
  {
    "path": "client/src/js/SM/TransferAssets.js",
    "content": "'use strict'\n\nExt.ns('SM.TransferAssets')\n\nSM.TransferAssets.TransferBtn = Ext.extend(Ext.Button, {\n  initComponent: function() {\n    const me = this\n    const config = {}\n    \n    // Populate the menu with collections that are not the source\n    function setMenuItems (menu) {\n      menu.removeAll()\n      const destCollectionGrants = curUser.collectionGrants.filter( g => g.collection.collectionId !== menu.srcCollectionId && g.roleId >= 3)\n      for (const destCollectionGrant of destCollectionGrants) {\n        menu.addMenuItem({\n          iconCls: 'sm-collection-icon',\n          text: SM.he(destCollectionGrant.collection.name),\n          collectionId: destCollectionGrant.collection.collectionId\n        })\n      }\n    }\n\n    me.setSrcAssets = function (assets) {\n      me.menu.srcAssets = assets\n    }\n\n    me.menu = new Ext.menu.Menu({\n      srcCollectionId: me.srcCollectionId,\n      listeners: {\n        beforeshow: function (menu) {\n          setMenuItems(menu)\n        },\n        itemClick: me.onItemClick || Ext.emptyFn\n      }\n    })\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    SM.TransferAssets.TransferBtn.superclass.initComponent.call(this)\n  }\n})\nExt.reg('sm-transferassets-btn', SM.TransferAssets.TransferBtn)\n"
  },
  {
    "path": "client/src/js/SM/User.js",
    "content": "Ext.ns('SM.User')\n\nSM.User.GroupSpriteHtml = `<span class=\"sm-label-sprite {extraCls}\" style=\"color:black;background-color:#888;\">{[SM.he(values)]}</span>`\n\nSM.User.GroupTpl = new Ext.XTemplate(\n  SM.User.GroupSpriteHtml\n)\nSM.User.GroupArrayTpl = new Ext.XTemplate(\n  '<tpl for=\".\">',\n  `${SM.User.GroupSpriteHtml} `,\n  '</tpl>'\n)\n\nSM.User.EffectiveGrantsGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      {\n        name: 'collectionId',\n        mapping: 'collection.collectionId'\n      },\n      {\n        name: 'name',\n        mapping: 'collection.name'\n      },\n      'roleId',\n      'grantees'\n    ]\n    const totalTextCmp = new Ext.Toolbar.TextItem({\n      text: '0 records',\n      width: 80\n    })\n    const store = new Ext.data.JsonStore({\n      grid: this,\n      root: '',\n      fields,\n      idProperty: 'collectionId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      },\n      listeners: {\n        load: function (store, records) {\n          totalTextCmp.setText(records.length + ' records');\n        }\n      }\n    })\n    const columns = [\n      {\n        header: \"Collection\",\n        width: 150,\n        dataIndex: 'name',\n        sortable: true,\n      },\n      {\n        header: '<span exportvalue=\"Grantee\">Grantee<i class= \"fa fa-question-circle sm-question-circle\"></i></span>',\n        width: 150,\n        dataIndex: 'grantees',\n        sortable: false,\n        renderer: function (grantees) {\n          const divs = []\n          for (const source of grantees) {\n            const icon = source.userId ? 'sm-user-icon' : 'sm-users-icon'\n            const title = source.userId ? 'Direct' : source.name\n            divs.push(`<div class=\"x-combo-list-item ${icon} sm-combo-list-icon\" exportValue=\"${title}\">\n                    <span style=\"font-weight:600;\">${title}</span></div>`)\n          }\n          return divs.join('')\n        }\n      },\n      {\n        header: \"Role\",\n        width: 100,\n        dataIndex: 'roleId',\n        sortable: true,\n        renderer: (v) => SM.RoleStrings[v],\n      }\n    ]\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          gridBasename: 'EffectiveGrants',\n          exportType: 'grid',\n          iconCls: 'sm-export-icon',\n          text: 'CSV',\n          grid: this     \n        }, {\n          xtype: 'tbfill'\n        }, {\n          xtype: 'tbseparator'\n        },\n        totalTextCmp\n      ]\n    })\n\n    const config = {\n      isFormField: true,\n      forceSelection: true,\n      stripeRows: true,\n      layout: 'fit',\n      height: 150,\n      store,\n      columns,\n      sm: new Ext.grid.RowSelectionModel({\n        singleSelect: true\n      }),\n      view: new SM.ColumnFilters.GridView({\n        emptyText: this.emptyText || 'No records to display',\n        deferEmptyText: false,\n        forceFit: true,\n        markDirty: false\n      }),\n      bbar,\n      setValue: function (v) {\n        store.loadData(v)\n      },\n      getValue: function () { },\n      markInvalid: function () { },\n      clearInvalid: function () { },\n      isValid: () => true,\n      getName: () => this.name,\n      validate: () => true\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.User.CollectionGrantGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    const fields = ['collectionId', 'name', 'roleId']\n    const sm = new Ext.grid.CheckboxSelectionModel({\n      singleSelect: false,\n      checkOnly: false,\n      listeners: {\n        selectionchange: function (sm) {\n          SM.SetCheckboxSelModelHeaderState(sm)\n        }\n      }\n    })\n\n    const columns = [\n      sm,\n      {\n        header: \"Collection\",\n        width: 150,\n        dataIndex: 'name',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      {\n        header: \"Role\",\n        width: 80,\n        fixed: true,\n        dataIndex: 'roleId',\n        sortable: true,\n        hidden: !this.showRole,\n        renderer: (v) => `<div class=\"sm-grid-cell-with-menu\">${SM.RoleStrings[v]}</div>`,\n        filter: { type: 'values' }\n      }\n    ]\n    const store = new Ext.data.JsonStore({\n      fields,\n      idProperty: 'collectionId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC'\n      },\n    })\n    const totalTextCmp = new SM.RowCountTextItem({\n      store,\n      noun: 'collection',\n      iconCls: 'sm-collection-icon'\n    })\n\n    const roleCellMenuItems = [\n      {text: 'Role: Restricted', iconCls: 'sm-add-assignment-icon', roleId: 1, },\n      {text: 'Role: Full', iconCls: 'sm-add-assignment-icon', roleId: 2, },\n      {text: 'Role: Manage', iconCls: 'sm-add-assignment-icon', roleId: 3, },\n      {text: 'Role: Owner', iconCls: 'sm-add-assignment-icon', roleId: 4, },\n    ]\n\n    const roleCellMenu = new Ext.menu.Menu({\n      items: roleCellMenuItems,\n      listeners: {\n        itemclick: function (item) {\n          this.currentRecord.data.roleId = item.roleId\n          this.currentRecord.commit()\n          _this.fireEvent('cellrolechanged')\n        }\n      }\n    })\n\n    function cellclick (grid, rowIndex, columnIndex, e) {\n      const fieldName = grid.colModel.getDataIndex(columnIndex)\n      if (fieldName === 'roleId') {\n        roleCellMenu.currentRecord = grid.getStore().getAt(rowIndex)\n        const cellEl = grid.view.getCell(rowIndex, columnIndex)\n        const rect = cellEl.getBoundingClientRect()\n        roleCellMenu.showAt([rect.left, rect.bottom])\n      }\n    }\n\n    const listeners = {...this.initialConfig.listeners, cellclick}\n    const config = {\n      store,\n      columns,\n      sm,\n      border: true,\n      loadMask: false,\n      stripeRows: true,\n      view: new SM.ColumnFilters.GridView({\n        forceFit: true,\n        emptyText: 'No Collections to display',\n        listeners: {\n          filterschanged: function (view, item, value) {\n            store.filter(view.getFilterFns())\n          }\n        }\n      }),\n      listeners,\n      bbar: new Ext.Toolbar({\n        items: [\n          {\n            xtype: 'exportbutton',\n            grid: this,\n            hasMenu: false,\n            gridBasename: 'Collections (grid)',\n            storeBasename: 'Collections (store)',\n            iconCls: 'sm-export-icon',\n            text: 'CSV'\n          },\n          {\n            xtype: 'tbfill'\n          },\n          {\n            xtype: 'tbseparator'\n          },\n          totalTextCmp\n        ]\n      })\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.User.GrantSelectingPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    const availableGrid = new SM.User.CollectionGrantGrid({\n      title: 'Available',\n      headerCssClass: 'sm-available-panel-header',\n      role: 'available',\n      flex: 1\n    })\n    const selectionsGrid = new SM.User.CollectionGrantGrid({\n      title: this.selectionsGridTitle || 'Granted',\n      showRole: true,\n      headerCssClass: 'sm-selections-panel-header',\n      role: 'selections',\n      flex: 1,\n      listeners: {\n        cellrolechanged: fireSelectedChanged\n      }\n    })\n    availableGrid.getSelectionModel().on('selectionchange', handleSelections, selectionsGrid)\n    selectionsGrid.getSelectionModel().on('selectionchange', handleSelections, availableGrid)\n\n    const addBtnMenuItems = [\n      {text: 'Role: Restricted', iconCls: 'sm-add-assignment-icon', roleId: 1, handler: handleAddBtnItem},\n      {text: 'Role: Full', iconCls: 'sm-add-assignment-icon', roleId: 2, handler: handleAddBtnItem},\n      {text: 'Role: Manage', iconCls: 'sm-add-assignment-icon', roleId: 3, handler: handleAddBtnItem},\n      {text: 'Role: Owner', iconCls: 'sm-add-assignment-icon', roleId: 4, handler: handleAddBtnItem},\n    ]\n\n    const addBtn = new Ext.Button({\n      iconCls: 'sm-add-assignment-icon',\n      margins: \"0 10 10 10\",\n      disabled: true,\n      getMenuClass: () => '',\n      menu: new Ext.menu.Menu({\n        items: addBtnMenuItems\n      })\n    })\n\n    function fireSelectedChanged () {\n      _this.fireEvent('selectedchanged', selectionsGrid.store.getRange().map( r => ({\n        collectionId: r.data.collectionId,\n        roleId: r.data.roleId\n      })))\n    }\n\n    function handleAddBtnItem (menuItem) {\n      const selectedRecords = availableGrid.getSelectionModel().getSelections()\n      for (const record of selectedRecords) {\n        record.data.roleId = menuItem.roleId\n      }\n      changeSelected(availableGrid, selectedRecords, selectionsGrid)\n      fireSelectedChanged()\n      addBtn.disable()\n    }\n\n    function changeSelected(srcGrid, records, dstGrid) {\n      srcGrid.store.suspendEvents()\n      dstGrid.store.suspendEvents()\n      srcGrid.store.remove(records)\n      dstGrid.store.add(records)\n      const { field, direction } = dstGrid.store.getSortState()\n      dstGrid.store.sort(field, direction)\n      srcGrid.store.resumeEvents()\n      dstGrid.store.resumeEvents()\n      srcGrid.store.fireEvent('datachanged', srcGrid.store)\n      dstGrid.store.fireEvent('datachanged', dstGrid.store)\n      srcGrid.store.fireEvent('update', srcGrid.store)\n      dstGrid.store.fireEvent('update', dstGrid.store)\n      dstGrid.store.filter(dstGrid.getView().getFilterFns())\n\n      dstGrid.getSelectionModel().selectRecords(records)\n      dstGrid.getView().focusRow(dstGrid.store.indexOfId(records[0].data.assetId))\n    }\n\n    const removeBtn = new Ext.Button({\n      iconCls: 'sm-remove-assignment-icon',\n      margins: \"0 10 10 10\",\n      disabled: true,\n      handler: function (btn) {\n        const selectedRecords = selectionsGrid.getSelectionModel().getSelections()\n        changeSelected(selectionsGrid, selectedRecords, availableGrid)\n        fireSelectedChanged()\n        btn.disable()\n      }\n    })\n    const buttonPanel = new Ext.Panel({\n      bodyStyle: 'background-color:transparent;border:none',\n      width: 60,\n      layout: {\n        type: 'vbox',\n        pack: 'center',\n        align: 'center',\n        padding: \"10 10 10 10\"\n      },\n      items: [\n        addBtn,\n        removeBtn\n      ]\n    })\n\n    function handleSelections() {\n      const sm = this.selModel\n      if (sm.hasSelection()) {\n        sm.suspendEvents()\n        sm.clearSelections()\n        sm.resumeEvents()\n        SM.SetCheckboxSelModelHeaderState(sm)\n      }\n      const availableSelected = availableGrid.selModel.hasSelection()\n      const selectionsSelected = selectionsGrid.selModel.hasSelection()\n      addBtn.setDisabled(!availableSelected)\n      removeBtn.setDisabled(!selectionsSelected)\n    }\n\n    async function initPanel(apiUserOrGroup) {\n      const apiAvailableCollections = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/collections?elevate=true`,\n        method: 'GET'\n      })\n\n      let assignedGrants = []\n\n      if (apiUserOrGroup?.collectionGrants?.length) {\n        if (apiUserOrGroup.collectionGrants[0].grantees) {\n          // is a user object\n          assignedGrants = apiUserOrGroup.collectionGrants.filter(grant => grant.grantees[0].userId).map(grant => ({\n            collectionId: grant.collection.collectionId,\n            name: grant.collection.name,\n            roleId: grant.roleId\n          }))\n        } else {\n          // is a user group object\n          assignedGrants = apiUserOrGroup.collectionGrants.map(grant => ({\n            collectionId: grant.collection.collectionId,\n            name: grant.collection.name,\n            roleId: grant.roleId\n          }))\n        }\n      }\n      const assignedCollectionIds = new Set(assignedGrants.map(g => g.collectionId))\n      const availableCollections = apiAvailableCollections.filter(collection => !assignedCollectionIds.has(collection.collectionId))\n\n      availableGrid.store.loadData(availableCollections)\n      selectionsGrid.store.loadData(assignedGrants)\n    }\n\n    function getValue() {\n      const records = selectionsGrid.store.snapshot?.items ?? selectionsGrid.store.getRange()\n      return records.map(record => ({\n        collectionId: record.data.collectionId,\n        roleId: record.data.roleId\n      }))\n    }\n\n    const config = {\n      layout: 'hbox',\n      layoutConfig: {\n        align: 'stretch',\n        padding: 10\n      },\n      name: 'collectionGrants',\n      items: [\n        availableGrid,\n        buttonPanel,\n        selectionsGrid\n      ],\n      availableGrid,\n      selectionsGrid,\n      initPanel,\n      getValue,\n      // need fns below so Ext handles us like a form field\n      setValue: () => { },\n      markInvalid: function () { },\n      clearInvalid: function () { },\n      isValid: () => true,\n      getName: () => this.name,\n      validate: () => true\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.User.GroupSelectingGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    const fields = Ext.data.Record.create([\n      { name: 'userGroupId', type: 'string' },\n      { name: 'name', type: 'string' },\n      // { name: 'usernames', convert: (v, r) => r.users.map(user => user.username) },\n    ])\n    const sm = new Ext.grid.CheckboxSelectionModel({\n      singleSelect: false,\n      checkOnly: false,\n      listeners: {\n        selectionchange: function (sm) {\n          SM.SetCheckboxSelModelHeaderState(sm)\n        }\n      }\n    })\n    const columns = [\n      sm,\n      {\n        header: \"Group name\",\n        width: 150,\n        dataIndex: 'name',\n        sortable: true,\n        filter: { type: 'string' }\n      },\n      // {\n      //   header: \"Members\",\n      //   width: 50,\n      //   align: 'center',\n      //   dataIndex: 'usernames',\n      //   sortable: true,\n      //   hidden: false,\n      //   filter: { type: 'values' },\n      //   renderer: function (value, metadata, record) {\n      //     let qtipWidth = 230\n      //     if (value.length > 0) {\n      //       let longest = Math.max(...(value.map(el => el.length)))\n      //       qtipWidth = longest * 8\n      //     }\n      //     metadata.attr = ` ext:qwidth=${qtipWidth} ext:qtip=\"<b>${record.data.name} Members</b><br>${value.join('<br>')}\"`\n      //     return `<i>${value.length}</i>`\n      //   }\n      // }\n    ]\n    const store = new Ext.data.JsonStore({\n      fields,\n      idProperty: 'userGroupId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC'\n      },\n    })\n    const totalTextCmp = new SM.RowCountTextItem({\n      store,\n      noun: 'group',\n      iconCls: 'sm-users-icon'\n    })\n    const config = {\n      store,\n      columns,\n      sm,\n      enableDragDrop: true,\n      ddText: '{0} selected Group{1}',\n      bodyCssClass: 'sm-grid3-draggable',\n      ddGroup: `SM.User.GroupSelectingGrid-${this.role}`,\n      border: true,\n      loadMask: false,\n      stripeRows: true,\n      view: new SM.ColumnFilters.GridView({\n        forceFit: true,\n        emptyText: 'No Groups to display',\n        listeners: {\n          filterschanged: function (view, item, value) {\n            store.filter(view.getFilterFns())\n          }\n        }\n      }),\n      bbar: new Ext.Toolbar({\n        items: [\n          {\n            xtype: 'exportbutton',\n            grid: this,\n            hasMenu: false,\n            gridBasename: 'Groups (grid)',\n            storeBasename: 'Groups (store)',\n            iconCls: 'sm-export-icon',\n            text: 'CSV'\n          },\n          {\n            xtype: 'tbfill'\n          },\n          {\n            xtype: 'tbseparator'\n          },\n          totalTextCmp\n        ]\n      })\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.User.GroupSelectingPanel = Ext.extend(Ext.Panel, { initComponent: \n  function () {\n    const _this = this\n    function setupDragZone(grid) {\n      const gridDragZone = grid.getView().dragZone\n      const originalGetDragData = gridDragZone.getDragData\n      gridDragZone.getDragData = function (e) {\n        const t = Ext.lib.Event.getTarget(e)\n        if (t.className === 'x-grid3-row-checker') {\n          return false\n        }\n        return originalGetDragData.call(gridDragZone, e)\n      }\n\n      const originalStartDrag = gridDragZone.startDrag\n      gridDragZone.startDrag = function (x, y) {\n        Ext.getBody().addClass('sm-grabbing')\n        return originalStartDrag.call(gridDragZone, x, y)\n      }\n\n      const originalOnDragDrop = gridDragZone.onDragDrop\n      gridDragZone.onDragDrop = function (e, id) {\n        Ext.getBody().removeClass('sm-grabbing')\n        return originalOnDragDrop.call(gridDragZone, e, id)\n      }\n\n      const originalOnInvalidDrop = gridDragZone.onInvalidDrop\n      gridDragZone.onInvalidDrop = function (e, id) {\n        Ext.getBody().removeClass('sm-grabbing')\n        return originalOnInvalidDrop.call(gridDragZone, e)\n      }\n\n    }\n    const availableGrid = new SM.User.GroupSelectingGrid({\n      title: 'Available',\n      headerCssClass: 'sm-available-panel-header',\n      role: 'available',\n      flex: 1,\n      listeners: {\n        render: function (grid) {\n          setupDragZone(grid)\n          const gridDropTargetEl = grid.getView().scroller.dom;\n          const gridDropTarget = new Ext.dd.DropTarget(gridDropTargetEl, {\n            ddGroup: selectionsGrid.ddGroup,\n            notifyDrop: function (ddSource, e, data) {\n              const selectedRecords = ddSource.dragData.selections;\n              changeSelected(selectionsGrid, selectedRecords, availableGrid)\n              return true\n            }\n          })\n        }\n      }\n    })\n    const selectionsGrid = new SM.User.GroupSelectingGrid({\n      title: this.selectionsGridTitle || 'Assigned',\n      headerCssClass: 'sm-selections-panel-header',\n      role: 'selections',\n      flex: 1,\n      listeners: {\n        render: function (grid) {\n          setupDragZone(grid)\n          const gridDropTargetEl = grid.getView().scroller.dom;\n          const gridDropTarget = new Ext.dd.DropTarget(gridDropTargetEl, {\n            ddGroup: availableGrid.ddGroup,\n            notifyDrop: function (ddSource, e, data) {\n              const selectedRecords = ddSource.dragData.selections;\n              changeSelected(availableGrid, selectedRecords, selectionsGrid)\n              return true\n            }\n          })\n        }\n      }\n    })\n    availableGrid.getSelectionModel().on('selectionchange', handleSelections, selectionsGrid)\n    selectionsGrid.getSelectionModel().on('selectionchange', handleSelections, availableGrid)\n\n    const addBtn = new Ext.Button({\n      iconCls: 'sm-add-assignment-icon',\n      margins: \"0 10 10 10\",\n      disabled: true,\n      handler: function (btn) {\n        const selectedRecords = availableGrid.getSelectionModel().getSelections()\n        changeSelected(availableGrid, selectedRecords, selectionsGrid)\n        btn.disable()\n      }\n    })\n    const removeBtn = new Ext.Button({\n      iconCls: 'sm-remove-assignment-icon',\n      margins: \"0 10 10 10\",\n      disabled: true,\n      handler: function (btn) {\n        const selectedRecords = selectionsGrid.getSelectionModel().getSelections()\n        changeSelected(selectionsGrid, selectedRecords, availableGrid)\n        btn.disable()\n      }\n    })\n    const buttonPanel = new Ext.Panel({\n      bodyStyle: 'background-color:transparent;border:none',\n      width: 60,\n      layout: {\n        type: 'vbox',\n        pack: 'center',\n        align: 'center',\n        padding: \"10 10 10 10\"\n      },\n      items: [\n        addBtn,\n        removeBtn,\n        { xtype: 'panel', border: false, html: '<i>or drag</i>' }\n      ]\n    })\n\n    function handleSelections() {\n      const sm = this.selModel\n      if (sm.hasSelection()) {\n        sm.suspendEvents()\n        sm.clearSelections()\n        sm.resumeEvents()\n        SM.SetCheckboxSelModelHeaderState(sm)\n      }\n      const availableSelected = availableGrid.selModel.hasSelection()\n      const selectionsSelected = selectionsGrid.selModel.hasSelection()\n      addBtn.setDisabled(!availableSelected)\n      removeBtn.setDisabled(!selectionsSelected)\n    }\n\n    function fireSelectedChanged () {\n      _this.fireEvent('selectedchanged', selectionsGrid.store.getRange().map( r => r.data.userGroupId ))\n    }\n\n\n    async function initPanel(apiUser) {\n      const apiAvailableUserGroups = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/user-groups`,\n        params: {\n          projection: ['users']\n        },\n        method: 'GET'\n      })\n      \n      const assignedUserGroupIds = apiUser?.userGroups?.map(userGroup => userGroup.userGroupId) ?? []\n      _this.originalUserGroupIds = assignedUserGroupIds\n      const availableUserGroups = []\n      const assignedUserGroups = []\n      apiAvailableUserGroups.reduce((accumulator, userGroup) => {\n        const property = assignedUserGroupIds.includes(userGroup.userGroupId) ? 'assignedUserGroups' : 'availableUserGroups'\n        accumulator[property].push(userGroup)\n        return accumulator\n      }, { availableUserGroups, assignedUserGroups })\n\n      availableGrid.store.loadData(availableUserGroups)\n      selectionsGrid.store.loadData(assignedUserGroups)\n      // _this.trackedProperty = { dataProperty: 'usernames', value: apiUser.username }\n\n    }\n\n    function changeSelected(srcGrid, records, dstGrid) {\n      srcGrid.store.suspendEvents()\n      dstGrid.store.suspendEvents()\n      srcGrid.store.remove(records)\n      dstGrid.store.add(records)\n      // for (const record of records) {\n      //   if (srcGrid.role === 'available') {\n      //     record.data[_this.trackedProperty.dataProperty].push(_this.trackedProperty.value)\n      //     record.commit()\n      //   }\n      //   else {\n      //     record.data[_this.trackedProperty.dataProperty] = record.data[_this.trackedProperty.dataProperty].filter(i => i !== _this.trackedProperty.value)\n      //     record.commit()\n      //   }\n      // }\n      const { field, direction } = dstGrid.store.getSortState()\n      dstGrid.store.sort(field, direction)\n      dstGrid.selModel.selectRecords(records)\n      srcGrid.store.resumeEvents()\n      dstGrid.store.resumeEvents()\n\n      srcGrid.store.fireEvent('datachanged', srcGrid.store)\n      dstGrid.store.fireEvent('datachanged', dstGrid.store)\n      srcGrid.store.fireEvent('update', srcGrid.store)\n      dstGrid.store.fireEvent('update', dstGrid.store)\n      dstGrid.store.filter(dstGrid.getView().getFilterFns())\n      dstGrid.getView().focusRow(dstGrid.store.indexOfId(records[0].data.assetId))\n\n      fireSelectedChanged()\n    }\n\n    function getValue() {\n      const records = selectionsGrid.store.snapshot?.items ?? selectionsGrid.store.getRange()\n      return records.map(record => record.data.userGroupId)\n    }\n\n    const config = {\n      layout: 'hbox',\n      layoutConfig: {\n        align: 'stretch',\n        padding: 10\n      },\n      name: 'userGroups',\n      items: [\n        availableGrid,\n        buttonPanel,\n        selectionsGrid\n      ],\n      availableGrid,\n      selectionsGrid,\n      initPanel,\n      getValue,\n      // need fns below so Ext handles us like a form field\n      setValue: () => { },\n      markInvalid: function () { },\n      clearInvalid: function () { },\n      isValid: () => true,\n      getName: () => this.name,\n      validate: () => true\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.User.UserGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    const fields = [\n      {\n        name: 'userId',\n        type: 'string'\n      },\n      {\n        name: 'username',\n        type: 'string'\n      },\n      {\n        name: 'displayName',\n        type: 'string'\n      },\n      {\n        name: 'status',\n        type: 'string'\n      },\n      {\n        name: 'statusDate',\n        type: 'string'\n      },\n      {\n        name: 'statusUser',\n        type: 'string'\n      },\n      {\n        name: 'groupNames',\n        convert: (v, r) => r.userGroups.map(userGroup => userGroup.name)\n      },\n      {\n        name: 'created',\n        type: 'date',\n        mapping: 'statistics.created'\n      },\n      {\n        name: 'lastAccess',\n        type: 'integer'\n      },\n      {\n        name: 'collectionGrantCount',\n        type: 'integer',\n        mapping: 'statistics.collectionGrantCount'\n      },\n      'statistics',\n      'privileges'\n    ]\n    const store = new Ext.data.JsonStore({\n      proxy: new Ext.data.HttpProxy({\n        url: `${STIGMAN.Env.apiBase}/users`,\n        method: 'GET'\n      }),\n      baseParams: {\n        elevate: curUser.privileges.admin,\n        // status: 'available',\n        projection: ['userGroups', 'statistics']\n      },\n      root: '',\n      fields,\n      idProperty: 'userId',\n      sortInfo: {\n        field: 'username',\n        direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      },\n      listeners: {\n        load: function () {\n          _this.selModel.selectRow(0)\n        }\n      }\n    })\n    const totalTextCmp = new SM.RowCountTextItem({ store })\n\n    const statusBtnHandler = function () {\n      let user = _this.getSelectionModel().getSelected()\n      \n      // Prevent users from setting themselves as unavailable\n      if (user.data.userId === curUser.userId && user.data.status === 'available') {\n        Ext.Msg.show({\n          title: 'Action not allowed',\n          icon: Ext.Msg.WARNING,\n          msg: 'You cannot set yourself to Unavailable.',\n          buttons: { ok: 'OK' }\n        })\n        return\n      }\n      \n      let buttons = { no: 'Cancel' }\n      let status\n      let msg\n      if (user.data.status === 'available') {\n        buttons.yes = 'Set Unavailable'\n        status = 'unavailable'\n        msg = `Set User ${user.data.username} status to Unavailable?<br><br>This action will remove the User's Collection Grants and User Group assignments.<br> The User will no longer be able to access the system or receive new Grant or Group assignments.<br><br> A record will be retained in the system for auditing and attribution purposes.`\n      }\n      else {\n        buttons.yes ='Set Available'\n        status = 'available'\n        msg = `Set user ${user.data.username} status to Available?<br><br>This action will permit the user to access the system, and be assigned to Collection Grants and User Groups.`\n      }\n\n      Ext.Msg.show({\n        title: 'Confirm action',\n        icon: Ext.Msg.WARNING,\n        msg,\n        buttons,\n        fn: async function (btn, text) {\n          try {\n            if (btn == 'yes') {\n              const apiUser = await Ext.Ajax.requestPromise({\n                responseType: 'json',\n                url: `${STIGMAN.Env.apiBase}/users/${user.data.userId}?elevate=${curUser.privileges.admin}&projection=collectionGrants&projection=statistics&projection=userGroups`,\n                method: 'PATCH',\n                jsonData: {\n                  status,\n                  collectionGrants: [],\n                  userGroups: [],\n                }\n              })\n              SM.Dispatcher.fireEvent('userchanged', apiUser)\n            }\n          }\n          catch (e) {\n            SM.Error.handleError(e)\n          }\n        }\n      })\n    }\n    const config = {\n      store,\n      sm: new Ext.grid.RowSelectionModel({ \n        singleSelect: true,\n        listeners: {\n          rowselect: function (sm, rowIndex, record) {\n            if (store.getAt(rowIndex).data.status === 'available') {\n              _this.modifyBtn.setDisabled(false)\n              _this.statusBtn.setText('Set Unavailable')\n              _this.statusBtn.setIconClass('sm-user-unavailable-icon')\n            } \n            else {\n              _this.modifyBtn.setDisabled(true)\n              _this.statusBtn.setText('Set Available')\n              _this.statusBtn.setIconClass('sm-user-icon')\n            } \n          }\n        }\n      }),\n      columns: [\n        {\n          header: \"Username\",\n          width: 150,\n          dataIndex: 'username',\n          sortable: true,\n          filter: { type: 'string' }\n        },\n        {\n          header: \"Name\",\n          width: 150,\n          dataIndex: 'displayName',\n          sortable: true,\n          filter: { type: 'string' }\n        },\n        {\n          header: \"Status\",\n          width: 150,\n          dataIndex: 'status',\n          sortable: true,\n          filter: { type: 'values' },\n          renderer: function (value, metadata, record, ri, ci, store) {\n            let qtipContent\n            if (record.data.statusUser) {\n              qtipContent = `ext:qtip=\"<b>Status:</b> ${SM.he(value)}<br><b>Set by:</b> userId ${SM.he(record.data.statusUser)}<br><b>Date:</b> ${Ext.util.Format.date(record.data.statusDate,'Y-m-d H:i T')}\"`\n            }\n            metadata.attr = 'style=\"line-height: 17px;white-space:normal;\"'\n            return `<span class=\"sm-label-sprite\" style=\"color:black;background-color:${value === 'available' ? 'green' : 'red'};\" ${qtipContent}>${value}</span>`\n          }\n        },\n        {\n          header: \"Groups\",\n          width: 220,\n          dataIndex: 'groupNames',\n          sortable: false,\n          filter: {\n            type: 'multi-value',\n            renderer: SM.ColumnFilters.Renderers.groups\n          },\n          renderer: function (value, metadata) {\n            value.sort((a, b) => a.localeCompare(b))\n            metadata.attr = 'style=\"line-height: 17px;white-space:normal;\"'\n            return SM.User.GroupArrayTpl.apply(value)\n          }\n        },\n        {\n          header: \"Grants\",\n          width: 50,\n          align: 'center',\n          dataIndex: 'collectionGrantCount',\n          sortable: true,\n        },\n        {\n          header: \"Added\",\n          xtype: 'datecolumn',\n          format: 'Y-m-d H:i T',\n          width: 150,\n          dataIndex: 'created',\n          sortable: true\n        },\n        {\n          header: \"Last Access\",\n          width: 150,\n          dataIndex: 'lastAccess',\n          sortable: true,\n          renderer: v => v ? Ext.util.Format.date(new Date(v * 1000), 'Y-m-d H:i T') : SM.styledEmptyRenderer()\n        },\n        {\n          header: \"Create Collection\",\n          width: 100,\n          align: 'center',\n          renderer: function (value, metaData, record) {\n            return record.data.privileges.create_collection ? '&#x2714;' : ''\n          }\n        },\n        {\n          header: \"Administrator\",\n          width: 100,\n          align: 'center',\n          renderer: function (value, metaData, record) {\n            return record.data.privileges.admin ? '&#x2714;' : ''\n          }\n        },\n        {\n          header: \"userId\",\n          width: 100,\n          dataIndex: 'userId',\n          sortable: true\n        }\n      ],\n      view: new SM.ColumnFilters.GridView({\n        forceFit: true,\n        listeners: {\n          filterschanged: function (view) {\n            store.filter(view.getFilterFns())\n          },\n          // These listeners keep the grid in the same scroll position after the store is reloaded\n          beforerefresh: function (v) {\n            v.scrollTop = v.scroller.dom.scrollTop;\n            v.scrollHeight = v.scroller.dom.scrollHeight;\n          },\n          refresh: function (v) {\n            setTimeout(function () {\n              v.scroller.dom.scrollTop = v.scrollTop + (v.scrollTop == 0 ? 0 : v.scroller.dom.scrollHeight - v.scrollHeight);\n            }, 100);\n          }\n        },\n        deferEmptyText: false\n      }),\n      listeners: {\n        rowdblclick: function (grid, rowIndex, e) {\n          const r = grid.getStore().getAt(rowIndex)\n          if (r.data.status === 'available'){\n            SM.User.showUserProps(r.get('userId'))\n          }\n        }\n      },\n      tbar: [\n        {\n          iconCls: 'icon-add',\n          text: 'Pre-register User',\n          handler: function () {\n            Ext.getBody().mask('');\n            SM.User.showUserProps(0);\n          }\n        },\n        '-',\n        {\n          ref: '../removeBtn',\n          iconCls: 'icon-del',\n          text: 'Unregister User',\n          handler: function () {\n            let user = _this.getSelectionModel().getSelected();\n            let buttons = { yes: 'Unregister', no: 'Cancel' }\n            let confirmStr = `Unregister user ${user.data.username}?<br><br>This action will remove the User's Collection Grants and User Group assignments.<br> The User will still be able to use the system if granted access by the Authentication Provider.`;\n            if (user.data.lastAccess === 0) {\n              confirmStr = `Delete user ${user.data.username}?<br><br>This user has never accessed the system, and will be deleted from the system entirely.`;\n              buttons.yes = 'Delete'\n            }\n\n            Ext.Msg.show({\n              title: 'Confirm unregister action',\n              icon: Ext.Msg.WARNING,\n              msg: confirmStr,\n              buttons: buttons,\n              fn: async function (btn, text) {\n                try {\n                  if (btn == 'yes') {\n                    if (user.data.lastAccess === 0) {\n                      const apiUser = await Ext.Ajax.requestPromise({\n                        responseType: 'json',\n                        url: `${STIGMAN.Env.apiBase}/users/${user.data.userId}?elevate=${curUser.privileges.admin}`,\n                        method: 'DELETE'\n                      })\n                      store.remove(user)\n                      SM.Dispatcher.fireEvent('userdeleted', apiUser)\n                    }\n                    else {\n                      const apiUser = await Ext.Ajax.requestPromise({\n                        responseType: 'json',\n                        url: `${STIGMAN.Env.apiBase}/users/${user.data.userId}?elevate=${curUser.privileges.admin}&projection=collectionGrants&projection=statistics&projection=userGroups`,\n                        method: 'PATCH',\n                        jsonData: {\n                          collectionGrants: [],\n                          userGroups: [],\n                        }\n                      })\n                      // userStore.remove(user)\n                      SM.Dispatcher.fireEvent('userchanged', apiUser)\n                    }\n                  }\n                }\n                catch (e) {\n                  SM.Error.handleError(e)\n                }\n              }\n            })\n          }\n        },\n        '-',\n        {\n          ref: '../statusBtn',\n          iconCls: 'icon-edit',\n          text: ' ',\n          handler: statusBtnHandler\n        },\n        '-',\n        {\n          ref: '../modifyBtn',\n          iconCls: 'icon-edit',\n          text: 'Modify User',\n          handler: function () {\n            var r = _this.getSelectionModel().getSelected();\n            Ext.getBody().mask('Getting properties...');\n            SM.User.showUserProps(r.get('userId'));\n          }\n        }\n      ],\n      bbar: new Ext.Toolbar({\n        items: [\n          {\n            xtype: 'tbbutton',\n            iconCls: 'icon-refresh',\n            tooltip: 'Reload this grid',\n            width: 20,\n            handler: function (btn) {\n              store.reload()\n            }\n          },\n          {\n            xtype: 'tbseparator'\n          },\n          {\n            xtype: 'exportbutton',\n            hasMenu: false,\n            gridBasename: 'User-Info',\n            exportType: 'grid',\n            iconCls: 'sm-export-icon',\n            text: 'CSV',\n            grid: this     \n          },\n          {\n            xtype: 'tbfill'\n          }, {\n            xtype: 'tbseparator'\n          },\n          totalTextCmp\n        ]\n      })\n    }\n\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.User.UserFormPanel = Ext.extend(Ext.form.FormPanel, {\n  initComponent: function () {\n    const _this = this\n    const directGrantsPanel = new SM.User.GrantSelectingPanel({\n      name: 'collectionGrants',\n      title: 'Direct Grants',\n      iconCls: 'sm-lock-icon',\n      border: true,\n      listeners: {\n        selectedchanged: function (selections) {\n          _this.fireEvent('propsupdate', this.name, selections)\n        }\n      }\n    })\n    const userGroupsPanel = new SM.User.GroupSelectingPanel({\n      title: 'User Groups',\n      iconCls: 'sm-users-icon',\n      border: true,\n      isFormField: true,\n      submitValue: true,\n      listeners: {\n        selectedchanged: function (selections) {\n          _this.fireEvent('propsupdate', this.name, selections)\n        }\n      }\n    })\n    const effectiveGrantsGrid = new SM.User.EffectiveGrantsGrid({\n      name: 'effectiveGrants',\n      title: 'Effective Grants',\n      iconCls: 'sm-lock-icon',\n      isFormField: true,\n      border: true\n    })\n    const lastClaimsPanel = new Ext.Panel({\n      title: 'Last Claims',\n      name: 'lastClaims',\n      border: true,\n      html: '',\n      tree: JsonView.createTree({status: 'No claims have been presented.'}),\n      autoScroll: true,\n      iconCls: 'sm-json-icon',\n      layout: 'fit',\n      isFormField: true,\n      setValue: function (v) {\n        if (Object.keys(v).length === 0 && v.constructor === Object) {\n          return\n        }\n        this.tree = JsonView.createTree(v)\n      },\n      getValue: Ext.emptyFn,\n      markInvalid: Ext.emptyFn,\n      clearInvalid: Ext.emptyFn,\n      isValid: () => true,\n      getName: function () { return this.name },\n      validate: () => true,\n      listeners: {\n        render: function () {\n          JsonView.render(this.tree, this.body.dom)\n          JsonView.expandChildren(this.tree)\n        }\n      }\n    })\n    const registeredUserItems = [\n      {\n        layout: 'column',\n        baseCls: 'x-plain',\n        border: false,\n        items: [\n          {\n            columnWidth: .5,\n            layout: 'form',\n            border: false,\n            items: [\n              {\n                xtype: 'textfield',\n                fieldLabel: 'Username',\n                readOnly: true,\n                anchor: '-20',\n                name: 'username'\n              }\n            ]\n          },\n          {\n            columnWidth: .5,\n            layout: 'form',\n            border: false,\n            items: [\n              {\n                xtype: 'textfield',\n                fieldLabel: 'Name',\n                readOnly: true,\n                anchor: '100%',\n                name: 'displayName'\n              }\n            ]\n          }\n        ]\n      },\n      {\n        xtype: 'textfield',\n        fieldLabel: 'Email',\n        anchor: '100%',\n        readOnly: true,\n        name: 'email'\n      },\n      {\n        xtype: 'textfield',\n        fieldLabel: 'Privileges',\n        anchor: '100%',\n        readOnly: true,\n        name: 'privileges'\n      }\n    ]\n    const preregisteredUserItems = [\n      {\n        xtype: 'textfield',\n        fieldLabel: 'Username',\n        allowBlank: false,\n        anchor: '100%',\n        name: 'username'\n      }\n    ]\n    const registeredTabPanelItems = [\n      userGroupsPanel,\n      directGrantsPanel,\n      effectiveGrantsGrid,\n      lastClaimsPanel\n    ]\n    const preregisteredTabPanelItems = [\n      userGroupsPanel,\n      directGrantsPanel\n    ]\n\n    let config = {\n      baseCls: 'x-plain',\n      labelWidth: 70,\n      items: [\n        {\n          xtype: 'fieldset',\n          title: '<b>User information</b>',\n          items: this.registeredUser ? registeredUserItems : preregisteredUserItems\n        },\n        {\n          xtype: 'tabpanel',\n          border: false,\n          activeTab: 0,\n          anchor: `100% ${this.registeredUser ? '-130' : '-85'}`,\n          // height: 270,\n          items: this.registeredUser ? registeredTabPanelItems : preregisteredTabPanelItems\n        }\n      ],\n      userGroupsPanel,\n      directGrantsPanel,\n      effectiveGrantsGrid\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.User.showUserProps = async function showUserProps(userId) {\n  try {\n    const listeners = {}\n    if (userId) {\n      listeners.propsupdate = onPropsUpdate //live updates for registered users\n    }\n    else {\n      listeners.clientvalidation = onClientValidation\n    }\n    const userFormPanel = new SM.User.UserFormPanel({\n      registeredUser: userId,\n      padding: '10px 15px 10px 15px',\n      listeners,\n      monitorValid: !userId //fires clientvalidation event for preregistered users,\n    })\n\n    async function onPropsUpdate(property, value) {\n      const apiUser = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/users/${userId}`,\n        method: 'PATCH',\n        params: {\n          elevate: curUser.privileges.admin,\n          projection: ['userGroups', 'collectionGrants', 'statistics']\n        },\n        headers: { 'Content-Type': 'application/json;charset=utf-8' },\n        jsonData: {\n          [property]: value\n        }\n      })\n      userFormPanel.effectiveGrantsGrid.setValue(apiUser.collectionGrants)\n      SM.Dispatcher.fireEvent('userchanged', apiUser)\n    }\n\n    function onClientValidation(formPanel, isValid) {\n      formPanel.ownerCt.buttons[0].setDisabled(!isValid)\n    }\n\n    async function windowBtnHandler(btn) {\n      if (btn.action === 'close') {\n        appwindow.close()\n      }\n      else if (btn.action === 'save') {\n        try {\n          if (userFormPanel.getForm().isValid()) {\n            const values = userFormPanel.getForm().getFieldValues()\n            const apiUser = await Ext.Ajax.requestPromise({\n              responseType: 'json',\n              url: `${STIGMAN.Env.apiBase}/users`,\n              method: 'POST',\n              params: {\n                elevate: curUser.privileges.admin,\n                projection: ['userGroups', 'collectionGrants', 'statistics']\n              },\n              headers: { 'Content-Type': 'application/json;charset=utf-8' },\n              jsonData: values\n            })\n            const event = userId ? 'userchanged' : 'usercreated'\n            SM.Dispatcher.fireEvent(event, apiUser)\n            appwindow.close()\n          }\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n\n      }\n    }\n\n    const appwindow = new Ext.Window({\n      title: userId ? 'User ID ' + userId : 'Pre-register User',\n      cls: 'sm-dialog-window sm-round-panel',\n      modal: true,\n      hidden: true,\n      width: 660,\n      height: userId ? 650 : 440,\n      layout: 'fit',\n      plain: true,\n      bodyStyle: 'padding:5px;',\n      buttonAlign: 'right',\n      items: userFormPanel,\n      buttons: [{\n        text: userId ? 'Close' : 'Save',\n        action: userId ? 'close' : 'save',\n        handler: windowBtnHandler\n      }]\n    })\n\n    appwindow.show(Ext.getBody())\n\n    let apiUser\n    if (userId) {\n      apiUser = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/users/${userId}`,\n        params: {\n          elevate: curUser.privileges.admin,\n          projection: ['statistics', 'collectionGrants', 'userGroups']\n        },\n        method: 'GET'\n      })\n      for (const claim of ['iat', 'exp', 'auth_time']) {\n        if (apiUser.statistics.lastClaims[claim]) {\n          apiUser.statistics.lastClaims[claim] = new Date(apiUser.statistics.lastClaims[claim] * 1000)\n        }\n      }\n      if (apiUser.statistics.lastClaims.scope) {\n        apiUser.statistics.lastClaims.scope = apiUser.statistics.lastClaims.scope.split(' ')\n      }\n      const privileges = []\n      for (const privilege in apiUser.privileges) {\n        if (apiUser.privileges[privilege]) privileges.push(privilege)\n      }\n      const formValues = {\n        username: apiUser.username,\n        displayName: apiUser.displayName,\n        email: apiUser.email,\n        privileges: privileges.join(', '),\n        canCreateCollection: privileges.includes('create_collection'),\n        canAdmin: privileges.includes('admin'),\n        lastClaims: apiUser.statistics.lastClaims,\n        // collectionGrants: apiUser.collectionGrants || [],\n        effectiveGrants: apiUser.collectionGrants || []\n      }\n      userFormPanel.getForm().setValues(formValues)\n    }\n    await userFormPanel.userGroupsPanel.initPanel(apiUser)\n    await userFormPanel.directGrantsPanel.initPanel(apiUser)\n\n    Ext.getBody().unmask();\n  }\n  catch (e) {\n    Ext.getBody().unmask()\n    SM.Error.handleError(e)\n  }\n}\n\nSM.User.CollectionAclGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n      const fields = [\n        {\n          name: 'assetName',\n          mapping: 'asset.name'\n        },\n        'benchmarkId',\n        'access',\n        'aclSources'\n      ]\n      const store = new Ext.data.JsonStore({\n        autoLoad: true,\n        proxy: new Ext.data.HttpProxy({\n          url: `${STIGMAN.Env.apiBase}/collections/${this.collectionId}/users/${this.userId}/effective-acl`,\n          method: 'GET'\n        }),\n        root: '',\n        fields,\n        idProperty: 'assetName',\n        sortInfo: {\n          field: 'assetName',\n          direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n        }\n      })\n      const columns = [\n        {\n          header: `<span class=\"sm-asset-icon sm-column-with-icon\">Asset</span>`, \n          dataIndex: 'assetName',\n          sortable: true,\n          width: 250\n        },\n        {\n          header: `<span class=\"sm-stig-icon sm-column-with-icon\">STIG</span>`, \n          dataIndex: 'benchmarkId',\n          sortable: true,\n          width: 350\n        },\n        {\n          header: `Access`, \n          dataIndex: 'access',\n          sortable: true,\n          width: 150\n        },\n        {\n          header: 'ACL Source',\n          width: 150,\n          dataIndex: 'aclSources',\n          sortable: false,\n          renderer: function (aclSources) {\n            const divs = []\n            for (const source of aclSources) {\n              const icon = source.grantee.userId ? 'sm-user-icon' : 'sm-users-icon'\n              const title = source.grantee.userId ? 'Direct' : source.grantee.name\n              divs.push(`<div class=\"x-combo-list-item ${icon} sm-combo-list-icon\" exportValue=\"${title}\">\n                      <span style=\"font-weight:600;\">${title}</span></div>`)\n            }\n            return divs.join('')\n          }\n        }\n      ]\n      const sm = new Ext.grid.RowSelectionModel({\n        singleSelect: true\n      })\n      const view = new SM.ColumnFilters.GridView({\n        emptyText: this.emptyText || 'No records to display',\n        deferEmptyText: false,\n        forceFit: true,\n        markDirty: false\n      })\n\n      const totalTextCmp = new SM.RowCountTextItem({ store })\n\n      const bbar = new Ext.Toolbar({\n        items: [\n          {\n            xtype: 'tbbutton',\n            iconCls: 'icon-refresh',\n            tooltip: 'Reload this grid',\n            width: 20,\n            handler: function (btn) {\n              store.reload()\n            }\n          },\n          {\n            xtype: 'tbseparator'\n          },\n          {\n            xtype: 'exportbutton',\n            hasMenu: false,\n            gridBasename: 'Collection ACL',\n            exportType: 'grid',\n            iconCls: 'sm-export-icon',\n            text: 'CSV',\n            grid: this\n          },\n          {\n            xtype: 'tbfill'\n          },\n          {\n            xtype: 'tbseparator'\n          },\n          totalTextCmp\n        ]\n      })\n\n      const config = {\n        fields,\n        store,\n        columns,\n        sm,\n        view,\n        stripeRows: true,\n        layout: 'fit',\n        loadMask: true,\n        bbar\n      }\n      Ext.apply(this, Ext.apply(this.initialConfig, config))\n      this.superclass().initComponent.call(this)\n  }\n})\n\nSM.User.showCollectionAcl = async function ({userId, displayName, collectionId, defaultAccess}) {\n  const aclGrid = new SM.User.CollectionAclGrid({\n    userId,\n    displayName,\n    collectionId,\n    border: false,\n    title: `Effective Access, default = ${defaultAccess}`\n  })\n  const appwindow = new Ext.Window({\n    title: 'User: ' + displayName,\n    cls: 'sm-dialog-window sm-round-panel',\n    modal: true,\n    hidden: true,\n    width: 660,\n    height: 650,\n    layout: 'fit',\n    plain: true,\n    bodyStyle: 'padding:15px;',\n    buttonAlign: 'right',\n    items: aclGrid\n  })\n  appwindow.show(Ext.getBody());\n}\n\nSM.User.showUserAdmin = function (params) {\n\tlet { treePath } = params\n\tconst tab = Ext.getCmp('main-tab-panel').getItem('user-admin-tab')\n\tif (tab) {\n\t\ttab.show()\n\t\treturn\n\t}\n\n\tconst userGrid = new SM.User.UserGrid({\n\t\tcls: 'sm-round-panel',\n\t\tborder: false,\n\t\tmargins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n\t\tregion: 'center',\n\t\tstripeRows:true,\n\t\tloadMask: {msg: ''}\n\t})\n\n\tconst onUserChanged = function (apiUser) {\n\t\tuserGrid.store.loadData(apiUser, true)\n\t\tconst sortState = userGrid.store.getSortState()\n\t\tuserGrid.store.sort(sortState.field, sortState.direction)\n\t\tuserGrid.getSelectionModel().selectRow(userGrid.store.findExact('userId',apiUser.userId))\n\t}\n\tSM.Dispatcher.addListener('userchanged', onUserChanged)\n\tSM.Dispatcher.addListener('usercreated', onUserChanged)\n\n\n\tconst thisTab = Ext.getCmp('main-tab-panel').add({\n\t\tid: 'user-admin-tab',\n\t\tsm_treePath: treePath, \n\t\ticonCls: 'sm-user-icon',\n\t\ttitle: 'Users',\n\t\tclosable:true,\n\t\tlayout: 'fit',\n\t\tborder: false,\n\t\titems: [userGrid],\n\t\tlisteners: {\n\t\t\tbeforedestroy: function(grid) {\n\t\t\t\tSM.Dispatcher.removeListener('userchanged', onUserChanged)\n\t\t\t\tSM.Dispatcher.removeListener('usercreated', onUserChanged)\n\t\t\t}\n\t\t}\n\t})\n\tthisTab.show()\n\t\n  function afterLoad(store, records) {\n    if (records.some(record => record.data.status !== 'available')) {\n      const statusFilterMenu = userGrid.view.hmenu.filterItems.valuesItems[0]\n      statusFilterMenu.checked = false\n      statusFilterMenu.valueItems[0].checked = true\n      statusFilterMenu.valueItems[1].checked = false\n      userGrid.view.setColumnFilteredStyle()\n      const cm = userGrid.getColumnModel()\n      cm.getColumnById(cm.findColumnIndex('status')).filtered = true\n      userGrid.view.fireEvent('filterschanged', userGrid.view)\n    }\n    store.un('load', afterLoad)\n  }\n  userGrid.getStore().on('load', afterLoad)\n\tuserGrid.getStore().load()\n\n}\n\n"
  },
  {
    "path": "client/src/js/SM/UserGroup.js",
    "content": "Ext.ns('SM.UserGroup')\n\nSM.UserGroup.UserSpriteHtml = `<span class=\"sm-label-sprite {extraCls}\" style=\"color:black;background-color:#888;\">{[SM.he(values)]}</span>`\n\nSM.UserGroup.UserTpl = new Ext.XTemplate(\n  SM.UserGroup.GroupSpriteHtml\n)\nSM.UserGroup.UserArrayTpl = new Ext.XTemplate(\n    '<tpl for=\".\">',\n    `${SM.UserGroup.GroupSpriteHtml} `,\n    '</tpl>'\n)\n\nSM.UserGroup.UserGroupGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const _this = this\n    const fields = Ext.data.Record.create([\n      {\n        name: 'userGroupId',\n        type: 'string'\n      },\n      {\n        name: 'name',\n        type: 'string'\n      },\n      {\n        name: 'description',\n        type: 'string'\n      },\n      {\n        name: 'created',\n        type: 'date',\n        mapping: 'attributions.created.ts'\n      },\n      {\n        name: 'userCount',\n        type: 'integer',\n        convert: (v, r) => r.users.length\n      },\n      {\n        name: 'collectionCount',\n        type: 'integer',\n        convert: (v, r) => r.collectionGrants.length\n\n      }\n    ])\n    const store = new Ext.data.JsonStore({\n      proxy: new Ext.data.HttpProxy({\n        url: `${STIGMAN.Env.apiBase}/user-groups`,\n        method: 'GET'\n      }),\n      baseParams: {\n        elevate: curUser.privileges.admin,\n        projection: ['users', 'collectionGrants', 'attributions']\n      },\n      root: '',\n      fields,\n      idProperty: 'userGroupId',\n      sortInfo: {\n        field: 'name',\n        direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n      },\n      listeners: {\n        load: function () {\n          _this.selModel.selectRow(0)\n        }\n      }\n    })\n    const columns = [\n      {\n        header: \"Name\", \n        width: 150,\n        dataIndex: 'name',\n        sortable: true,\n        filter: {type: 'string'}\n      },\n      { \t\n        header: \"Description\",\n        width: 150,\n        dataIndex: 'description',\n        sortable: true,\n        filter: {type: 'string'}\n      },\n      { \t\n        header: \"Created\",\n        xtype: 'datecolumn',\n        format: 'Y-m-d H:i T',\n        width: 150,\n        dataIndex: 'created',\n        sortable: true\n      },\n      { \t\n        header: \"# Users\",\n        width: 100,\n        align: 'center',\n        dataIndex: 'userCount',\n        sortable: true,\n        renderer: SM.styledEmptyRenderer\n      },\n      { \t\n        header: \"# Collections\",\n        width: 100,\n        align: 'center',\n        dataIndex: 'collectionCount',\n        sortable: true,\n        renderer: SM.styledEmptyRenderer\n      }\n    ]\n    const view = new SM.ColumnFilters.GridView({\n      forceFit:true,\n      listeners: {\n        filterschanged: function (view) {\n          store.filter(view.getFilterFns())  \n        },\n        // These listeners keep the grid in the same scroll position after the store is reloaded\n        beforerefresh: function(v) {\n           v.scrollTop = v.scroller.dom.scrollTop;\n           v.scrollHeight = v.scroller.dom.scrollHeight;\n        },\n        refresh: function(v) {\n          setTimeout(function() { \n            v.scroller.dom.scrollTop = v.scrollTop + (v.scrollTop == 0 ? 0 : v.scroller.dom.scrollHeight - v.scrollHeight);\n          }, 100);\n        }\n      },\n      deferEmptyText:false\n    })\n    const sm = new Ext.grid.RowSelectionModel({ \n      singleSelect: true,\n      listeners: {\n        selectionchange: function (sm) {\n          const hasSelection = sm.hasSelection()\n          removeBtn.setDisabled(!hasSelection)\n          modifyBtn.setDisabled(!hasSelection)\n        }\n      }\n    })\n\n    const removeBtn = new Ext.Button({\n      iconCls: 'icon-del',\n      disabled: true,\n      text: 'Delete Group',\n      handler: function() {\n        let selRec = _this.getSelectionModel().getSelected()\n        let buttons = {yes: 'Delete', no: 'Cancel'}\n        let confirmStr=`Delete group ${selRec.data.name}?<br><br>This action will delete all Collection Grants for the user group.`;\n        \n        Ext.Msg.show({\n          title: 'Confirm delete action',\n          icon: Ext.Msg.WARNING,\n          msg: confirmStr,\n          buttons: buttons,\n          fn: async function (btn,text) {\n            try {\n              if (btn == 'yes') {\n                const apiUserGroup = await Ext.Ajax.requestPromise({\n                  responseType: 'json',\n                  url: `${STIGMAN.Env.apiBase}/user-groups/${selRec.data.userGroupId}?elevate=${curUser.privileges.admin}`,\n                  method: 'DELETE'\n                })\n                store.remove(selRec)\n                SM.Dispatcher.fireEvent('usergroupdeleted', apiUserGroup)\n              }\n            }\n            catch (e) {\n              SM.Error.handleError(e)\n            }\n          }\n        })\n      }\n    })\n\n    const modifyBtn = new Ext.Button({\n      iconCls: 'icon-edit',\n      disabled: true,\n      text: 'Modify Group',\n      handler: function() {\n        SM.UserGroup.showUserGroupProps(sm.getSelected().get('userGroupId'))\n      }\n    })\n    const tbar = [\n      {\n        iconCls: 'icon-add',\n        text: 'Add Group',\n        handler: function() {\n          Ext.getBody().mask('');\n          SM.UserGroup.showUserGroupProps(0);            \n        }\n      },\n      modifyBtn,\n      '-',\n      removeBtn,\n      '-',\n      \n    ]\n    const totalTextCmp = new SM.RowCountTextItem({store})\n    const bbar = new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'tbbutton',\n          iconCls: 'icon-refresh',\n          tooltip: 'Reload this grid',\n          width: 20,\n          handler: function(btn){\n            store.reload()\n          }\n        },\n        {\n          xtype: 'tbseparator'\n        },\n        {\n          xtype: 'exportbutton',\n          hasMenu: false,\n          gridBasename: 'UserGroup-Info',\n          exportType: 'grid',\n          iconCls: 'sm-export-icon',\n          text: 'CSV',\n          grid: this     \n        },\t\n        {\n          xtype: 'tbfill'\n        },{\n          xtype: 'tbseparator'\n        },\n        totalTextCmp\n      ]\n    })\n    const config = {\n      store,\n      sm,\n      columns,\n      view,\n      tbar,\n      bbar,\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.UserGroup.UserSelectingGrid = Ext.extend(Ext.grid.GridPanel, {\n  initComponent: function () {\n    const fields = [\n      'userId',\n      'username',\n      'displayName',\n      // { \n      //   name: 'userGroups', \n      //   convert: (v, r) => r.userGroups.map(userGroup => userGroup.name)\n      // }\n    ]\n    const sm = new Ext.grid.CheckboxSelectionModel({\n      singleSelect: false,\n      checkOnly: false,\n      listeners: {\n        selectionchange: function (sm) {\n          SM.SetCheckboxSelModelHeaderState(sm)\n        }\n      }\n    })\n    const columns = [\n      sm,\n      {\n        header: \"User\",\n        width: 150,\n        dataIndex: 'displayName',\n        sortable: true,\n        renderer: function (v, m, r) {\n          return `<div exportValue=\"${r.data.displayName ?? ''}:${r.data.username ?? ''}\"><span style=\"font-weight:600;\">${r.data.displayName ?? ''}</span><br>${r.data.username ?? ''}</div>`\n        }\n      },\n      // {\n      //   header: \"Groups\",\n      //   width: 50,\n      //   align: 'center',\n      //   dataIndex: 'userGroups',\n      //   sortable: true,\n      //   hidden: false,\n      //   filter: { type: 'values' },\n      //   renderer: function (value, metadata, record) {\n      //     let qtipWidth = 230\n      //     if (value.length > 0) {\n      //       let longest = Math.max(...(value.map(el => el.length)))\n      //       qtipWidth = longest * 8\n      //     }\n      //     metadata.attr = ` ext:qwidth=${qtipWidth} ext:qtip=\"<b>${record.data.name} Members</b><br>${value.join('<br>')}\"`\n      //     return `<i>${value.length}</i>`\n      //   }\n      // }\n    ]\n    const store = new Ext.data.JsonStore({\n      fields,\n      idProperty: 'userId',\n      sortInfo: {\n        field: 'displayName',\n        direction: 'ASC'\n      },\n    })\n    const totalTextCmp = new SM.RowCountTextItem({\n      store,\n      noun: 'user',\n      iconCls: 'sm-user-icon'\n    })\n    const config = {\n      store,\n      columns,\n      sm,\n      enableDragDrop: true,\n      ddText: '{0} selected User{1}',\n      bodyCssClass: 'sm-grid3-draggable',\n      ddGroup: `SM.UserGroup.UserSelectingGrid-${this.role}`,\n      border: true,\n      loadMask: false,\n      stripeRows: true,\n      view: new SM.ColumnFilters.GridView({\n        forceFit: true,\n        emptyText: 'No Users to display',\n        listeners: {\n          filterschanged: function (view, item, value) {\n            store.filter(view.getFilterFns())\n          }\n        }\n      }),\n      bbar: new Ext.Toolbar({\n        items: [\n          {\n            xtype: 'exportbutton',\n            grid: this,\n            hasMenu: false,\n            gridBasename: 'Users (grid)',\n            storeBasename: 'Users (store)',\n            iconCls: 'sm-export-icon',\n            text: 'CSV'\n          },\n          {\n            xtype: 'tbfill'\n          },\n          {\n            xtype: 'tbseparator'\n          },\n          totalTextCmp\n        ]\n      })\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this);\n  }\n})\n\nSM.UserGroup.UserSelectingPanel = Ext.extend(Ext.Panel, {\n  initComponent: function () {\n    const _this = this\n    function setupDragZone(grid) {\n      const gridDragZone = grid.getView().dragZone\n      const originalGetDragData = gridDragZone.getDragData\n      gridDragZone.getDragData = function (e) {\n        const t = Ext.lib.Event.getTarget(e)\n        if (t.className === 'x-grid3-row-checker') {\n          return false\n        }\n        return originalGetDragData.call(gridDragZone, e)\n      }\n\n      const originalStartDrag = gridDragZone.startDrag\n      gridDragZone.startDrag = function (x, y) {\n        Ext.getBody().addClass('sm-grabbing')\n        return originalStartDrag.call(gridDragZone, x, y)\n      }\n\n      const originalOnDragDrop = gridDragZone.onDragDrop\n      gridDragZone.onDragDrop = function (e, id) {\n        Ext.getBody().removeClass('sm-grabbing')\n        return originalOnDragDrop.call(gridDragZone, e, id)\n      }\n\n      const originalOnInvalidDrop = gridDragZone.onInvalidDrop\n      gridDragZone.onInvalidDrop = function (e, id) {\n        Ext.getBody().removeClass('sm-grabbing')\n        return originalOnInvalidDrop.call(gridDragZone, e)\n      }\n\n    }\n    const availableGrid = new SM.UserGroup.UserSelectingGrid({\n      title: 'Available Users',\n      iconCls: 'sm-user-icon',\n      headerCssClass: 'sm-available-panel-header',\n      role: 'available',\n      flex: 1,\n      listeners: {\n        render: function (grid) {\n          setupDragZone(grid)\n          const gridDropTargetEl = grid.getView().scroller.dom;\n          const gridDropTarget = new Ext.dd.DropTarget(gridDropTargetEl, {\n            ddGroup: selectionsGrid.ddGroup,\n            notifyDrop: function (ddSource, e, data) {\n              const selectedRecords = ddSource.dragData.selections;\n              changeSelected(selectionsGrid, selectedRecords, availableGrid)\n              return true\n            }\n          })\n        },\n\n      }\n    })\n    const selectionsGrid = new SM.UserGroup.UserSelectingGrid({\n      title: 'Group Members',\n      iconCls: 'sm-user-icon',\n      headerCssClass: 'sm-selections-panel-header',\n      role: 'selections',\n      flex: 1,\n      listeners: {\n        render: function (grid) {\n          setupDragZone(grid)\n          const gridDropTargetEl = grid.getView().scroller.dom;\n          const gridDropTarget = new Ext.dd.DropTarget(gridDropTargetEl, {\n            ddGroup: availableGrid.ddGroup,\n            notifyDrop: function (ddSource, e, data) {\n              const selectedRecords = ddSource.dragData.selections;\n              changeSelected(availableGrid, selectedRecords, selectionsGrid)\n              return true\n            }\n          })\n        }\n      }\n    })\n    availableGrid.getSelectionModel().on('selectionchange', handleSelections, selectionsGrid)\n    selectionsGrid.getSelectionModel().on('selectionchange', handleSelections, availableGrid)\n\n    const addBtn = new Ext.Button({\n      iconCls: 'sm-add-assignment-icon',\n      margins: \"0 10 10 10\",\n      disabled: true,\n      handler: function (btn) {\n        const selectedRecords = availableGrid.getSelectionModel().getSelections()\n        changeSelected(availableGrid, selectedRecords, selectionsGrid)\n        btn.disable()\n      }\n    })\n    const removeBtn = new Ext.Button({\n      iconCls: 'sm-remove-assignment-icon',\n      margins: \"0 10 10 10\",\n      disabled: true,\n      handler: function (btn) {\n        const selectedRecords = selectionsGrid.getSelectionModel().getSelections()\n        changeSelected(selectionsGrid, selectedRecords, availableGrid)\n        btn.disable()\n      }\n    })\n    const buttonPanel = new Ext.Panel({\n      bodyStyle: 'background-color:transparent;border:none',\n      width: 60,\n      layout: {\n        type: 'vbox',\n        pack: 'center',\n        align: 'center',\n        padding: \"10 10 10 10\"\n      },\n      items: [\n        addBtn,\n        removeBtn,\n        { xtype: 'panel', border: false, html: '<i>or drag</i>' }\n      ]\n    })\n\n    function handleSelections() {\n      const sm = this.selModel\n      if (sm.hasSelection()) {\n        sm.suspendEvents()\n        sm.clearSelections()\n        sm.resumeEvents()\n        SM.SetCheckboxSelModelHeaderState(sm)\n      }\n      const availableSelected = availableGrid.selModel.hasSelection()\n      const selectionsSelected = selectionsGrid.selModel.hasSelection()\n      addBtn.setDisabled(!availableSelected)\n      removeBtn.setDisabled(!selectionsSelected)\n    }\n\n    async function initPanel(apiUserGroup) {\n      const apiAvailableUsers = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/users?status=available`,\n        method: 'GET'\n      })\n\n      // const promises = [\n      //   Ext.Ajax.requestPromise({\n      //     responseType: 'json',\n      //     url: `${STIGMAN.Env.apiBase}/users`,\n      //     params: {\n      //       elevate: curUser.privileges.admin,\n      //       projection: ['userGroups']\n      //     },\n      //     method: 'GET'\n      //   })]\n      // if (userGroupId) {\n      //   promises.push(Ext.Ajax.requestPromise({\n      //     responseType: 'json',\n      //     url: `${STIGMAN.Env.apiBase}/user-groups/${userGroupId}`,\n      //     params: {\n      //       elevate: curUser.privileges.admin,\n      //       projection: ['users']\n      //     },\n      //     method: 'GET'\n      //   }))\n      // }\n      // const [apiAvailableUsers, apiUserGroup] = await Promise.all(promises)\n      const assignedUserIds = apiUserGroup?.users?.map(user => user.userId) ?? []\n      _this.originalUserIds = assignedUserIds\n      const availableUsers = []\n      const assignedUsers = []\n      apiAvailableUsers.reduce((accumulator, user) => {\n        const property = assignedUserIds.includes(user.userId) ? 'assignedUsers' : 'availableUsers'\n        accumulator[property].push(user)\n        return accumulator\n      }, { availableUsers, assignedUsers })\n\n      availableGrid.store.loadData(availableUsers)\n      selectionsGrid.store.loadData(assignedUsers)\n      // _this.trackedProperty = { dataProperty: 'userGroups', value: apiUserGroup.name }\n\n    }\n\n    function fireSelectedChanged () {\n      _this.fireEvent('selectedchanged', selectionsGrid.store.getRange().map( r => r.data.userId ))\n    }\n\n    function changeSelected(srcGrid, records, dstGrid) {\n      srcGrid.store.suspendEvents()\n      dstGrid.store.suspendEvents()\n      srcGrid.store.remove(records)\n      dstGrid.store.add(records)\n      const { field, direction } = dstGrid.store.getSortState()\n      dstGrid.store.sort(field, direction)\n      dstGrid.getSelectionModel().selectRecords(records)\n      srcGrid.store.resumeEvents()\n      dstGrid.store.resumeEvents()\n\n      srcGrid.store.fireEvent('datachanged', srcGrid.store)\n      dstGrid.store.fireEvent('datachanged', dstGrid.store)\n      srcGrid.store.fireEvent('update', srcGrid.store)\n      dstGrid.store.fireEvent('update', dstGrid.store)\n      dstGrid.store.filter(dstGrid.getView().getFilterFns())\n      dstGrid.getView().focusRow(dstGrid.store.indexOfId(records[0].data.assetId))\n\n      fireSelectedChanged ()\n    }\n\n    function getValue() {\n      const records = selectionsGrid.store.snapshot?.items ?? selectionsGrid.store.getRange()\n      return records.map(record => record.data.userId)\n    }\n\n    const config = {\n      layout: 'hbox',\n      layoutConfig: {\n        align: 'stretch',\n        padding: 10\n      },\n      name: 'users',\n      items: [\n        availableGrid,\n        buttonPanel,\n        selectionsGrid\n      ],\n      availableGrid,\n      selectionsGrid,\n      initPanel,\n      getValue,\n      // need fns below so Ext handles us like a form field\n      setValue: () => { },\n      markInvalid: function () { },\n      clearInvalid: function () { },\n      isValid: () => true,\n      getName: () => this.name,\n      validate: () => true\n    }\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n  }\n})\n\nSM.UserGroup.UserGroupFormPanel = Ext.extend(Ext.form.FormPanel, {\n  initComponent: function () {\n    const _this = this\n    const usersPanel = new SM.UserGroup.UserSelectingPanel({\n      title: 'Users',\n      hideLabel: true,\n      border: true,\n      isFormField: true,\n      submitValue: true,\n      listeners: {\n        selectedchanged: function (userGroupIds) {\n          _this.fireEvent('propsupdate', 'userIds', userGroupIds)\n        }\n      }\n    })\n    const directGrantsPanel = new SM.User.GrantSelectingPanel({\n      name: 'collectionGrants',\n      title: 'Direct Grants',\n      iconCls: 'sm-lock-icon',\n      border: true,\n      listeners: {\n        selectedchanged: function (selections) {\n          _this.fireEvent('propsupdate', this.name, selections)\n        }\n      }\n    })\n    const tabPanel = new Ext.TabPanel({\n      border: false,\n      activeTab: 0,\n      anchor: `100% -110`,\n      items: [\n        usersPanel,\n        directGrantsPanel\n      ]\n    })\n    const userGroupItems = [\n      {\n        xtype: 'textfield',\n        fieldLabel: 'Group Name',\n        allowBlank: false,\n        anchor: '100%',\n        name: 'name',\n        enableKeyEvents: true,\n        listeners: {\n          change: (field, newValue, oldValue) => {\n            if (!newValue?.trim()) { // only spaces\n              field.setValue(oldValue)\n              return\n            }\n            _this.fireEvent('propsupdate', 'name', newValue)\n          }\n        }\n      },\n      {\n        xtype: 'textfield',\n        fieldLabel: 'Description',\n        allowBlank: true,\n        anchor: '100%',\n        name: 'description',\n        enableKeyEvents: true,\n        listeners: {\n          change: (field, newValue, oldValue) => {\n            _this.fireEvent('propsupdate', 'description', newValue)\n          }\n        }\n      }\n    ]\n\n    const config = {\n      baseCls: 'x-plain',\n      labelWidth: 70,\n      items: [\n        {\n          xtype: 'fieldset',\n          title: '<b>User Group information</b>',\n          items: userGroupItems\n        },\n        tabPanel\n      ],\n      usersPanel,\n      directGrantsPanel,\n      tabPanel\n    }\n\n    Ext.apply(this, Ext.apply(this.initialConfig, config))\n    this.superclass().initComponent.call(this)\n\n  }\n})\n\nSM.UserGroup.showUserGroupProps = async function (userGroupId) {\n  try {\n    const listeners = {}\n    if (userGroupId) {\n      listeners.propsupdate = onPropsUpdate //live updates for existing groups\n    }\n    else {\n      listeners.clientvalidation = onClientValidation\n    }\n\n    const fp = new SM.UserGroup.UserGroupFormPanel({\n      padding: '10px 15px 10px 15px',\n      listeners,\n      monitorValid: !userGroupId //fires clientvalidation event for new groups,\n    })\n\n    async function onPropsUpdate(property, value) {\n      const apiUserGroup = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/user-groups/${userGroupId}`,\n        method: 'PATCH',\n        params: {\n          elevate: curUser.privileges.admin,\n          projection: ['users', 'collectionGrants', 'attributions']\n        },\n        headers: { 'Content-Type': 'application/json;charset=utf-8' },\n        jsonData: {\n          [property]: value\n        }\n      })\n      SM.Dispatcher.fireEvent('usergroupchanged', apiUserGroup)\n    }\n\n    function onClientValidation(formPanel, isValid) {\n      formPanel.ownerCt.buttons[0].setDisabled(!isValid)\n    }\n\n    async function windowBtnHandler(btn) {\n      if (btn.action === 'close') {\n        appwindow.close()\n      }\n      else if (btn.action === 'save') {\n        try {\n          if (fp.getForm().isValid()) {\n            const values = fp.getForm().getFieldValues()\n            values.userIds = values.users\n            delete values.users\n            const apiUserGroup = await Ext.Ajax.requestPromise({\n              responseType: 'json',\n              url: `${STIGMAN.Env.apiBase}/user-groups`,\n              method: 'POST',\n              params: {\n                elevate: curUser.privileges.admin,\n                projection: ['users', 'collectionGrants', 'attributions']\n              },\n              headers: { 'Content-Type': 'application/json;charset=utf-8' },\n              jsonData: values\n            })\n            const event = userGroupId ? 'usergroupchanged' : 'usergroupcreated'\n            SM.Dispatcher.fireEvent(event, apiUserGroup)\n            appwindow.close()\n          }\n        }\n        catch (e) {\n          SM.Error.handleError(e)\n        }\n\n      }\n    }\n\n    const appwindow = new Ext.Window({\n      title: userGroupId ? 'Group ID ' + userGroupId : 'New Group',\n      cls: 'sm-dialog-window sm-round-panel',\n      modal: true,\n      hidden: true,\n      width: 660,\n      height: 650,\n      layout: 'fit',\n      plain: true,\n      bodyStyle: 'padding:5px;',\n      buttonAlign: 'right',\n      items: fp,\n      buttons: [{\n        text: userGroupId ? 'Close' : 'Save',\n        action: userGroupId ? 'close' : 'save',\n        handler: windowBtnHandler\n      }]\n    })\n\n\n    appwindow.show(Ext.getBody());\n\n    let apiUserGroup\n    if (userGroupId) {\n      apiUserGroup = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/user-groups/${userGroupId}`,\n        params: {\n          elevate: curUser.privileges.admin,\n          projection: ['users', 'collectionGrants']\n        },\n        method: 'GET'\n      })\n      fp.getForm().setValues(apiUserGroup)\n    }\n    await fp.usersPanel.initPanel(apiUserGroup)\n    await fp.directGrantsPanel.initPanel(apiUserGroup)\n\n    Ext.getBody().unmask();\n  }\n  catch (e) {\n    Ext.getBody().unmask()\n    SM.Error.handleError(e)\n  }\n}\n\nSM.UserGroup.addUserGroupAdmin = function ({treePath}) {\n\tconst tab = Ext.getCmp('main-tab-panel').getItem('user-group-admin-tab')\n\tif (tab) {\n\t\ttab.show()\n\t\treturn\n\t}\n\n\tconst userGroupGrid = new SM.UserGroup.UserGroupGrid({\n\t\tcls: 'sm-round-panel',\n\t\tmargins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n\t\tregion: 'center',\n\t\tstripeRows:true,\n\t\tloadMask: {msg: ''},\n    listeners: {\n      rowdblclick: function (grid, rowIndex) {\n        SM.UserGroup.showUserGroupProps(grid.getStore().getAt(rowIndex).get('userGroupId'))\n      }\n    }\n\t})\n\n\tconst onUserGroupChanged = function (apiUserGroup) {\n\t\tuserGroupGrid.store.loadData(apiUserGroup, true)\n\t\tconst sortState = userGroupGrid.store.getSortState()\n\t\tuserGroupGrid.store.sort(sortState.field, sortState.direction)\n\t\tuserGroupGrid.getSelectionModel().selectRow(userGroupGrid.store.findExact('userGroupId',apiUserGroup.userGroupId))\n\t}\n\tSM.Dispatcher.addListener('usergroupchanged', onUserGroupChanged)\n\tSM.Dispatcher.addListener('usergroupcreated', onUserGroupChanged)\n\n\n\tconst thisTab = Ext.getCmp('main-tab-panel').add({\n\t\tid: 'user-group-admin-tab',\n\t\tsm_treePath: treePath, \n\t\ticonCls: 'sm-users-icon',\n\t\ttitle: 'User Groups',\n\t\tclosable:true,\n\t\tlayout: 'border',\n\t\tborder: false,\n\t\titems: [userGroupGrid],\n\t\tlisteners: {\n\t\t\t// beforedestroy: function(grid) {\n\t\t\t// \tSM.Dispatcher.removeListener('userchanged', onUserChanged)\n\t\t\t// \tSM.Dispatcher.removeListener('usercreated', onUserChanged)\n\t\t\t// }\n\t\t}\n\t})\n\tthisTab.show()\n\t\n\tuserGroupGrid.getStore().load()\n}\n"
  },
  {
    "path": "client/src/js/SM/WhatsNew.js",
    "content": "Ext.ns('SM.WhatsNew')\n\nSM.WhatsNew.Sources = [\n  {\n    date: '2025-11-03',\n    header: 'Batch Assignment of Collection Grants to User Groups',\n    body: `\n    <p>Application Managers can now assign Collection Grants to User Groups in bulk from the User Groups management interface. This feature allows for quick and easy assignment of multiple Collection Grants to a User Group at once.</p>\n    <p>To use this feature, navigate to the User Groups management interface, select a User Group, and click the \"Modify Group\" button. From the resulting dialog, you can select multiple Collections and assign the desired Grant type to the User Group for each selected Collection.</p>\n    \n    <p><img src=\"img/whatsnew/2025-11-03-group-grants.png\" width=500/></p>`\n  },\n  {\n    date: '2025-10-29',\n    header: `New Log Stream Feature for Application Managers`,\n    body: `\n    <p>This feature provides App Managers with real-time streaming of log records from the STIG Manager backend to the web client. This stream can be recorded to help troubleshoot issues that would otherwise require direct access to the backend logs.</p>\n    \n    <p>Documentation is available in the <a target=\"_blank\" href=\"./docs/admin-guide/admin-guide.html#log-stream\">STIGMan Application Manager (Administrator) Guide</a>.</p>\n\n    <p>The Log Stream interface is accessible from the <b>Application Management -> Log Stream</b> workspace in the Navigation Tree.</p>\n\n    <p><img src=\"img/whatsnew/2025-10-29-admin-log-stream.png\" width=800/></p>`\n  },     \n  {\n    date: '2025-10-18',\n    header: `New Service Jobs Feature for Application Managers`,\n    body: `\n    <p>Application Managers can use the new Service Jobs feature to control and schedule background operations in the STIG Manager database.</p>\n    <p>The initial implementation provides database maintenance and cleanup jobs that are disabled by default. <b>It is highly recommended that Application Managers enable and schedule these jobs to run periodically to help maintain optimal system performance and minimize resource usage.</b></p>\n    \n    <p>Documentation and guidance is available in the <a target=\"_blank\" href=\"./docs/admin-guide/admin-quickstart.html#enable-service-jobs\">STIGMan Application Manager (Administrator) Walkthrough</a> and <a target=\"_blank\" href=\"./docs/admin-guide/admin-guide.html#service-jobs-panel\">Guide</a>.</p>\n\n    <p>The Service Jobs interface is accessible from the <b>Application Management -> Service Jobs</b> workspace in the Navigation Tree.</p>\n\n    <p><img src=\"img/whatsnew/2025-10-05-jobs-grid.png\" width=800/></p>`\n  },     \n  {\n    date: '2025-08-19',\n    header: `Enhanced Label Column Filters`,\n    body: `\n    <p>Filter operations for Label columns have been enhanced with the ability to match Any, All, or Exactly the labels selected, as well as Exclude Any, All, or Exactly the Labels selected.</p>\n    <p>Hover over the operation buttons to get a description of each operation.</p>\n\n    <p><img src=\"img/whatsnew/2025-05-12-new-label-filters.png\" width=500/></p>\n\n    `\n  },     \n  {\n    date: '2025-06-25',\n    header: `Reauthenticate Without Losing Your Workspace State`,\n    body: `\n    <p>STIGManager now supports reauthentication via a popup window, tab, iframe, or traditional redirect (the old behavior). When configured to use any of the first three options, when a session expires, users will be prompted to reauthenticate without losing the current state of their workspace.</p>\n\n    <p>This feature also brings the ability to use STIG Manager in more than one browser tab or window simultaneously.</p>\n\n    <p><img src=\"img/whatsnew/2025-06-25-reauth-prompt.png\" width=500/></p>\n\n    <p><img src=\"img/whatsnew/2025-06-25-reauth-popup.png\" width=600/></p>\n\n    `\n  },    \n    {\n    date: '2025-06-02',\n    header: `CORA Score Now Available in the Collection and Meta Dashboards`,\n    body: ` \n      <p>\n <b>Cyber Operational Readiness Assessment (CORA)</b>-style scoring is now available in the Collection and Meta Dashboards. \n CORA scoring treats Unassessed rules as if they were Open, and uses a weighted average to calculate the overall risk rating for a Collection, or portion thereof.\n       <p>\n\n The dashboard panel displays a count of Open or Unassessed Rules for each Severity Category, the overall Weighted Percentage, and the Risk Rating for the Collection. The Risk Rating is color-coded to indicate the level of risk, with categories ranging from Very Low to Very High. The CORA panel is responsive to the filters applied in the Dashboard.\n \n  <p><img src=\"img/whatsnew/2025-06-02-cora-score-panel.png\" width=350/></p>\n\n  The same scoring is available more granularly in the grid displays of the STIGs, Assets, and Labels tabs:\n\n  <p><img src=\"img/whatsnew/2025-06-02-cora-score-columns.png\" width=750/></p>\n\n<br>\n Reviews with <i>Open</i>, <i>Not a Finding</i>, or <i>Not Applicable</i> results are considered <i>assessed</i>.<br>\n Reviews with other results (such as <i>Not Reviewed</i> or <i>Informational</i>) are treated as <i>unassessed</i>.\n <br><br>\n  Each severity category (CAT I, II, III) is weighted differently when calculating the overall score:\n  <br>\n  <b>Weighted Average</b> formula:<br>\n  <code>(p₁·w₁ + p₂·w₂ + p₃·w₃) / (w₁ + w₂ + w₃)</code><br>\n  where:<br>\n  - <code>pₙ</code> = % of open + unassessed rules in that category<br>\n  - <code>wₙ</code> = weight <b>(CAT I = 10, CAT II = 4, CAT III = 1)</b><br><br>\n  The <b>Risk Rating</b> is primarily determined by the <b>Weighted Average</b>, except for the special \"Low\" risk condition:<br>\n  <ul style=\"padding-left: 16px; margin: 4px 0;\">\n    <li><span class=\"sm-cora-tooltip-label sm-cora-risk-very-high\"><b>Very High</b></span><b> ≥ 20%</b></li>\n    <li><span class=\"sm-cora-tooltip-label sm-cora-risk-high\"><b>High</b></span><b> ≥ 10% and &lt; 20%</b></li>\n    <li><span class=\"sm-cora-tooltip-label sm-cora-risk-moderate\"><b>Moderate</b></span><b> &gt; 0% and &lt; 10%</b></li>\n    <li><span class=\"sm-cora-tooltip-label sm-cora-risk-low\"><b>Low</b></span><b> CAT I = 0; CAT II &amp; III each &lt; 5% <i>unweighted</i></b></li>\n    <li><span class=\"sm-cora-tooltip-label sm-cora-risk-very-low\"><b>Very Low</b></span><b> 0% total</b></li>\n  </ul>\n\n    `\n  },\n  {\n    date: '2025-05-12',\n    header: `Set Review Status for Each Result Type When Importing Checklists`,\n    body: ` \n      <p>\n      Collection Owners and Managers can now configure collection import options more granularly by specifying the desired Review Status for each result type—Fail, Not Applicable, and Pass. If you are using STIGMan Watcher, we recommend updating to <a href=\"https://github.com/NUWCDIVNPT/stigman-watcher/releases/tag/1.5.2\">version 1.5.2</a> to take advantage of this feature for your automated imports as well.\n    </p>\n\n    <p>You can configure separate status values for each result type:</p>\n\n    <ul>\n      <li><strong>Fail</strong></li>\n      <li><strong>Not Applicable</strong></li>\n      <li><strong>Pass</strong></li>\n    </ul>\n\n    <p>Each of these can be set to one of the following statuses:</p>\n\n    <ul>\n      <li><strong>Saved</strong></li>\n      <li><strong>Submitted</strong></li>\n      <li><strong>Accepted</strong></li>\n      <li><strong>Keep Existing</strong> (preserves the current Review Status if one exists)</li>\n    </ul>\n    <p><img src=\"img/whatsnew/2025-05-12-import-options.png\" width=350/></p>\n    `\n  },\n  {\n    date: '2025-04-17',\n    header: `Create Assets in Bulk with a CSV File`,\n    body: `\n    <p>Collection Owners and Managers can now create Assets in bulk by importing a CSV file. This feature supports all properties of an Asset, including Labels, Metadata, and STIG assignments. New Labels, if needed, will be created on import.</p>\n\n    <p>To import an Assets CSV, click the \"Import Assets CSV\" button, and select a file. You will be presented with the Assets and Labels to be created, as well as any rows that could not be processed (for example, due to duplicate Asset names or unknown STIGs). Click \"Submit\" to create all valid Assets/Labels found in the CSV, or \"Cancel\" if you would prefer to fix any errors in the file and try again.</p>\n\n    <p>To generate a CSV file representation of the Assets in your Collection, click the \"Export Assets CSV\" button in the Collection Management workspace. If Assets are selected, this will create a CSV file representation of all of the selected Assets, including their Labels and STIG assignments. If no Assets are selected, all Assets will be included in the CSV.</p>\n\n    <p>For the required CSV format, <a target=\"_blank\" href=\"docs/user-guide/user-guide.html#create-asset-batch\">refer to our documentation for detailed field requirements,</a> or click the \"Export Assets CSV\" button and modify its contents.</p>\n\n    <p><img src=\"img/whatsnew/2025-04-17-asset-csv.png\" width=750/></p>\n\n    `\n  },  \n  {\n    date: '2025-04-10',\n    header: `Set User Status to Control Access`,\n    body: `\n    <p>Application Managers can now set a User's Status to \"Available\" or \"Unavailable\" by selecting a User and clicking the \"Set Un/Available\" button in the toolbar. Setting a User to \"Unavailable\" will prevent them from accessing the system, remove any of their existing Collection Grant or User Group assignments, and prevent them from being assigned new ones.</p>\n    <p>By default, the \"Users\" Application Management interface applies a filter on the new Status column to hide \"Unavailable\" Users. To set a User's status back to \"Available\", disable the filter, select an \"Unavailable\" User, and click the \"Set Available\" button in the toolbar.</p>\n\n    <p><img src=\"img/whatsnew/2025-04-10-user-status.png\" width=750/></p>\n    `\n  },    \n  {\n    date: '2025-01-31',\n    header: `New Dynamic User Grants and User Groups Features`,\n    body: `\n    <p>The Collection Grants system has been significantly reworked to allow for more dynamic and flexible User Grant management. These new Grants also allow for restriction of Users to \"Read Only\" or \"Read/Write\" access to Collection Reviews.</p>\n    <p>In addition, Application Managers can now create User Groups. User Groups can be assigned Grants to Collections in the same manner as individual Users, to provide the same level of access to all Users in the group.</p>\n\n    <p> Access Control for these grants can be defined by creating multiple Access Control Rules with any combination of Collection, STIG, Label, or Asset properties, which will combine to granularly control a User's access to Collection Reviews.</p>\n    <p>For example, if two Access Control Rules are defined to allow a User to \"Read Only\" Reviews for a \"Databases\" label, and \"Read/Write\" for a the \"Databases\" label and the \"PostgreSQL_9-x_STIG\" STIG, the user will be able to view all Reviews for Assets labeled with \"Databases\" but will only be able to modify Reviews in the \"PostgreSQL_9-x_STIG\".</p>\n\n    <p>Please see the <a target=\"_blank\" href=\"docs/user-guide/roles-and-access.html\">STIG Manager Documentation for more details about these new Features!</a>.</p>\n\n    <p><img src=\"img/whatsnew/2025-01-21-collection-manage-acl-popup.png\" width=750/></p>\n\n    <p><b>NOTE:</b> All existing \"Restricted\" Grant types have been migrated with equivalent granular Access Control Rules granting R/W access to those specific Assets and STIGs. If appropriate, you may want to remove these individual Rules and create an ACL granting R/W access to the entire Asset. This will allow the user access to new STIGs that are assigned to that Asset in the future.  </p>\n\n    `\n  },\n\n  {\n    date: '2025-01-31',\n    header: `Collection Review Workspace Changes`,\n    body: `\n    <p>The Collection Review Workspace has been reworked to give more room to Checklist statistics columns and enable future expansion. The display should now be significantly less constrained, especially when viewing extra columns that are usually hidden by default. \n    \n    <p>Review History and Attachments features are now accessible from the History <span class=\"sm-whats-new-no-border\"><img src=\"img/clock.svg\" width=\"14\" height=\"14\"/></span> and Attachments <span class=\"sm-whats-new-no-border\"><img src=\"img/attachment.svg\" width=\"14\" height=\"14\"/></span> icons that appear when hovering over an Asset.</p>\n\n    <p><img src=\"img/whatsnew/2025-01-31-collection-review.png\" width=750/></p>\n\n    `\n  },\n\n  {\n    date: '2024-10-09',\n    header: `New Application Information Report for Application Managers`,\n    body: `\n    <p>Application Managers can now view detailed information about the application from the Application Management tree node. This feature expands on and replaces the \"Anonymized Deployment Details\" feature.</p>\n    <p>To provide insights useful to the local deployment, the information is not anonymized by default. However, the data can be saved with all identifiers removed for sharing with the STIG Manager OSS Project Team. The STIGMan team encourages you to contribute your report, which will be used to recreate production-like scenarios that help us target new features and improve overall performance of the application.</p>\n    <p>The report can be submitted to:</p>\n    <b>RMF_Tools@us.navy.mil</b>\n    <p><b>Thank you for your help!</b></p>\n\n    <p>To access the new report, click on the \"Application Information\" node in the Application Management tree. Click the \"Save for sharing\" button to download the report and send to the team:</p>\n\n    <p><img src=\"img/whatsnew/2024-10-09-app-info-share.png\" width=750/></p>\n\n    <p><b>NOTE:</b> The \"Experimental\" Export/Import Data feature that used to share the \"App Info\" tab was unable to reliably scale with the current size of production deployments. As it was intended mainly for use with testing and demo data sets, it must now be enabled specifically with a deployment configuration option. See the documentation for more details.</p>\n\n    `    \n  },     \n  {\n    date: '2024-03-17',\n    header: `Bulk Checklist Imports Now Available to All Users`,\n    body: `\n    <p>\n    All Users can now import multiple checklists at once from the Collection Dashboard. When initiated from the Collection Dashboard, the import will bring in Reviews for existing Assets and their STIG assignments, but no new Assets or STIG assignments will be created. <p>To create new Assets or STIG Assignments, Managers and Owners can still initiate an import from the Manage Collection Workspace.\n    <p>\n    <p><img src=\"img/whatsnew/2024-03-15-dashboard-import.png\"/></p>\n    `    \n  },     \n  {\n    date: '2024-03-01',\n    header: `Review Age Info Now Available In All Review Grids`,\n    body: `\n    <p>\n    Review ages and timestamps can now be displayed in the top-level grid presentations of the Asset and Collection Review workspaces. The age displayed is calculated using the last time any part of the Review was altered. Hover over a Review age to see the date that change was made.<p>\n\n    Review ages are presented by default in the last column of the Asset Review checklist:\n    <p>\n    <p><img src=\"img/whatsnew/2024-03-01-asset-workspace-dates.png\"/></p>\n\n    <p>The \"Other Assets\" tab also shows this column now:</p>\n    <p><img src=\"img/whatsnew/2024-03-01-asset-workspace-dates-other-assets.png\"/></p>\n\n    In the Collection Review workspace, the Review age columns are hidden by default. Use the column picker to add them to your view. Changes made to this display will persist when you return to the workspace later:\n\n    <p><img src=\"img/whatsnew/2024-03-01-collection-workspace-checklist-dates.png\"/></p>\n\n    <p>Review ages are presented by default in the last column of the individual Asset Review grid:\n\n    <p><img src=\"img/whatsnew/2024-03-01-collection-workspace-asset-dates.png\"/></p>\n\n    `    \n\n  },    \n  {\n    date: '2024-01-17',\n    header: `New Meta Dashboard`,\n    body: `\n    <p>\n    The new Meta Dashboard provides totals and metrics for some or all of your Collections at a glance. The Collections Tab shows top-level metrics for each Collection, while the STIGs tab shows metrics for each STIG across Collections.  \n    <p>\n    Access the Meta Dashboard by clicking on the Report icon in the top-level Collections node of the Navigation Tree:\n    <p>\n    <p><img src=\"img/whatsnew/2024-01-17-meta-collection-icon.png\"/></p>\n\n    <p>Control which Collections are included in the Meta Dashboard with the filters at the top of the Overview panel:</p>\n\n    <p><img src=\"img/whatsnew/2024-01-17-meta-collection-panel-overview-filters.png\"/></p>\n    `    \n  },      \n  {\n    date: '2023-10-31',\n    header: `New Interfaces for Managing Asset Labels and STIG Assignments`,\n    body: `\n    <p>\n    Managing a Collection's Asset Labels and STIG Assignments should now be a more streamlined and informative experience.  Just drag and drop Assets between the two panels to add or remove the selected Label or STIG:\n\n    <p><img src=\"img/whatsnew/2023-10-31-new-label-interface-w-arrow.png\"/></p>\n\n    <p>The new interface also provides additional information about your Assets to help find what you're looking for. Hover over the Asset's name to see its currently assigned STIGs:</p>\n\n    <p><img src=\"img/whatsnew/2023-10-31-new-label-interface-with-popup-crop.png\"/></p>\n\n    <p>Click on a column header to filter on that column's data, or to add or remove columns of Asset information:</p>\n\n    <p><img src=\"img/whatsnew/2023-10-31-new-label-interface-filters-columns-crop.png\"/></p>\n\n    `    \n  },      \n  {\n    date: '2023-09-26',\n    header: `Export Results to Another Collection`,\n    body: `\n    <p>\n    Collection Managers and Owners can now export results from one Collection to another Collection. This feature is available from the Manage Collection Workspace using the \"Export Results...\" button in both the Asset and STIG Assignment panels.  Use the radio buttons to select the desired export action. \n    </p>\n\n    <p><b>Note:</b><b>Exporting Results to another Collection is limited to 100 Assets at a time, and the User must have \"Manage\" or \"Owner\" grants in the destination Collection.</b></p>\n\n    <p><img src=\"img/whatsnew/2023-09-27-results-export-collection.png\"/></p>\n\n    `    \n  },    \n  {\n    date: '2023-08-21',\n    header: `Provisional .CKLB Support`,\n    body: `\n    <p>\n    STIG Manager can now import and export data using the new .cklb file format introduced by DISA with the release of STIG Viewer 3. \n    </p>\n\n    <p><b>Note:</b><b>.CKLB is a new format and may be subject to change without notice! </b></p>\n\n    <p><img src=\"img/whatsnew/2023-08-20-cklb-export.png\"/></p>\n\n    <p><img src=\"img/whatsnew/2023-08-20-cklb-zip-export.png\"/></p>\n    `    \n  },  \n  {\n    date: '2023-08-08',\n    header: `Collection Cloning`,\n    body: `\n    <p>Collection Owners and Managers can now clone their Collections! Cloning a Collection can create a new Collection that is substantially the same as the source Collection, but must have a different name. \n    </p>\n\n    <p>Users can choose to copy the Assets, their STIGs, Labels, and/or Reviews from the original Collection into the new one. They can also choose to copy the User Grants from the original Collection into the new one, and pin STIG Revisions to their current values. The User who created the cloned Collection will always be made an Owner of the new Collection.\n    </p>\n    \n    <p><img src=\"img/whatsnew/2023-08-08-collection-clone-button.png\"/></p>\n\n    <p><img src=\"img/whatsnew/2023-08-08-collection-clone-options.png\"/></p>\n\n    <p><b>Note:</b><b> Large Collections can take several minutes to clone! During this time, Users will likely see a performance impact when accessing the source Collection. Making changes to the source Collection while it is being cloned may lead to inconsistent results in the cloned Collection. You may want to alert your users before cloning a large Collection!</b></p>\n\n    <p>Once the clone operation has started, a status bar will appear at the bottom of the screen.  Users can continue to use STIG Manager while the clone operation is in progress, but performance may be impacted when accessing the source Collection. The status bar will update when the clone is complete.</p>\n\n    <p><img src=\"img/whatsnew/2023-08-08-collection-clone-status-bar.png\"/></p>`    \n  },  \n  {\n    date: '2023-06-20',\n    header: `Set the Default STIG Revision for a Collection`,\n    body: `\n    <p>Collection Owners and Managers can now specify the default STIG Revision that will be used for their Collection. All Workspaces will open and all Metrics will be calculated using the \"pinned\" Revision. Without setting a pin, STIG Manager will always use the latest STIG Revision known to the system. The \"pinned\" Revision will be indicated by a pin <span class=\"sm-whats-new-no-border\"><img src=\"img/pin.svg\" width=\"14\" height=\"14\"/></span> icon in the Collection Dashboard and Management Workspaces.</p>\n\n    \n    <p><b>Note:</b> A STIG must be assigned to at least one Asset in a Collection in order to be Pinned!</p>\n\n    <p> Your options, available from the STIG Assignment Panel in the Manage Collection Workspace:</p>\n      <b>- Most Recent Revision:</b> The Collection Metrics and Workspaces will default to the latest STIG in the system as they are updated. <br>\n      <b>- Revision String (Date):</b> Pin the default to the specified STIG Revision<br><br>\n\n    <p><img src=\"img/whatsnew/2023-06-20-revision-pinning.png\"/></p>`    \n  },  \n  {\n    date: '2023-05-20',\n    header: `Tally Sprites for Most Display Grids`,\n    body: `\n    <p>New tally sprites have been added to the bottom toolbars of grids that display Review data. These sprites show the relevant counts for the various rows, results, and statuses displayed in the grids above.</p>\n\n    <p>These sprites respond to filters you have active on your view of the grid data. For example, if you have a filter active that only shows CAT 1 Rules with a Result of \"Open\", the tally sprite will only count Reviews for CAT 1 Rules with a Result of \"Open\". </p>\n\n    <p>Hover over the sprites for tooltips describing their contents.</p>\n\n    <p><img src=\"img/whatsnew/2023-05-20-tally-sprites.png\"/></p>\n\n    <p>Note: The \"Other\" column in the Collection Review grid has been renamed to \"NR+\" to better describe its contents.</p>`    \n  },  \n  {\n    date: '2023-04-27',\n    header: `Reviews now persist across most Rule changes!`,\n    body: `\n    <p>Reviews are now tracked using the specific Check Content and Version (\"STIG ID\") of a STIG Rule, rather than the RuleId. This new behavior will preserve Reviews when DISA STIG Releases make only minor changes to the Rule text, such as to the description, discussion, or reference elements. <b>Reviews will continue to apply to Rules in new STIG Revisions unless the actual Check Content or STIG ID for a STIG Rule changes.</b></p>\n\n    <ul><li><p>Below is a screenshot of the STIG Comparison tool (Available from the STIG Library node of the Navigation Tree) showing some of the differences between two Revisions of the RHEL 8 STIG. <b>Previously, all Rules in the red box would have required re-evaluation for the new STIG Revision. Now, only the Rule in the yellow box will require re-evaluation, because the actual check for that Rule has changed.</b></p></li></ul>\n\n    <p><img src=\"img/whatsnew/2023-04-25-review-key-differ.png\"/></p>\n\n    <p>There are a very small number of exceptions to this behavior, please see the <a target=\"_blank\" href=\"docs/user-guide/rule-exceptions.html\">STIG Manager Documentation for more details.</a></p>`    \n  },\n  {\n    date: '2023-01-11',\n    header: `New Collection Dashboard!`,\n    body: `\n    <p>The original Navigation Tree has been trimmed down, and all navigation to reports and workspaces within a Collection have been moved to the Collection Dashboard. The Dashboard is an enhanced version of the Metrics Report released a few months ago.</p>\n    <p>Instead of expanding Collection nodes that can get bogged down with thousands of Assets, clicking on a Collection now immediately opens the Collection Dashboard. This Dashboard shows all the same data previously shown in the Metrics Report, but with additional Navigation options and indicators.</p>    \n    <p>The Navigation Tree is now only used to select your working Collection, the STIG library, User Interface options, and Application Management Functions.</p>\n\n    <p><b>All features previously accessed via the deeper nodes of the Navigation Tree can now be accessed from the Collection Dashboard:</b></p>\n\n    <ul>\n      <li>\n      <b>Collection Management Workspace</b>: Click on the gear icon in the Inventory box in the Collection Overview panel.\n      </li>\n      <ul>\n        <img src=\"img/whatsnew/2023-01-09-collection-dash-inventory-management.png\"/>\n      </ul>\n\n      <li>\n        <b>Findings Report</b>: Click on the Details icon in the Findings box in the Collection Overview panel.\n      </li>\n      <ul>\n        <img src=\"img/whatsnew/2023-01-09-collection-dash-findings-details.png\"/>\n      </ul>\n\n      <li>\n        <b>Collection Review Workspace</b>: Double-click on a STIG or click the green STIGMan Shield in the STIGs metrics grid.\n      </li>\n      <ul>\n        <img src=\"img/whatsnew/2023-01-09-collection-dash-stig-shield.png\"/>\n      </ul>\n\n      <li>\n        <b>Asset Review Workspace</b>: Double-click on an Asset or click the green STIGMan Shield in an Asset metrics grid.\n      </li>\n      <ul>\n        <img src=\"img/whatsnew/2023-01-09-collection-dash-asset-shield.png\"/>\n      </ul>\n    </ul>         \n\n\n    <p>Please see the <a target=\"_blank\" href=\"docs/user-guide/user-guide.html#collection-dashboard\">STIG Manager Documentation for more details about this new feature!</a></p>`\n  },       \n  {\n    date: '2023-01-10',\n    header: `New STIG Revision Compare Tool!`,\n    body: `\n    <p>Now available for preview is our new Revision Compare tool. Select a STIG, then two Revisions, and the tool will present a list of STIG IDs and how their Rules changed between revisions. Click on Rule to see a detailed comparison of how each field that STIG Manager tracks differs between the two versions.</p>\n    \n    <p><b>The Revision Compare tool is available from the STIG Library node of the Navigation Tree.</b> </p>\n\n\n    <p><img src=\"img/whatsnew/2023-01-09-stig-compare-tool-crop.png\" width=\"800\"/></p>`\n  },     \n  {\n    date: '2022-10-12',\n    header: `New Metrics Report Replaces Status Report`,\n    body: `<p>The old Status Report has been replaced with a shiny new Metrics Report!</p>\n    \n    <p>Available to all users from the NavTree, the new Metrics Report provides a much easier to digest view of the overall Status and Evaluation progress of your entire Collection, as well as metrics export options and various pivoted presentations of your Collection's assessment statistics.</p>\n    \n    <p>Please see the <a target=\"_blank\" href=\"docs/user-guide/user-guide.html#metrics-report-workspace\">STIG Manager Documentation for more details about this new feature!</a></p>\n    <p><img src=\"img/whatsnew/2022-10-12-metrics-report1.png\"/></p>`\n  },        \n  {\n    date: '2022-09-12',\n    header: `Review History Pruning`,\n    body: `<p>Every time an individual Review for an Asset changes, a History record of its previous state is recorded.  With the release of this new feature, Collection Owners and Managers can now limit how many of these History records they keep for for each Review, or turn Review History off entirely.</p>\n    \n    <p>By default, STIG Manager caps history at 15 records for each Review.</p>\n       \n    <p>To find this new Collection Setting, from the <b>Collection Management</b> workspace, click the \"Settings\" tab. Use the pulldown to select your desired value:</p>\n    <p><img src=\"img/whatsnew/2022-09-12-review-history-setting.png\"/></p>`\n  },      \n  {\n    date: '2022-08-17',\n    header: `XCCDF Export Option`,\n    body: `<p>This new feature allows users to export their review data in the XCCDF format. Look for this option wherever checklist result exports are offered: The Asset Review workspace, the Collection Review workspace, and the Collection Management workspace.   \n    <p>For example, from the <b>Collection Management</b> workspace, click \"Export Results...\" and select the desired format from the pulldown menu:</p>\n    <p><img src=\"img/whatsnew/2022-08-17-xxcdf-archive.png\"/></p>`\n  },    \n  {\n    date: '2022-07-19',\n    header: `Streaming CKL Archive Export Option`,\n    body: `<p>This option bring users better performance when exporting large numbers of .ckl files. The application will generate the exact same .ckl files whether or not this option is selected, they are just delivered to the client in a different way.</p>\n    <p><b>Note:</b> This feature is being offered in an early \"experimental\" capacity to determine if it serves users needs appropriately. Please report any unexpected behavior. Modifications and improvements to the feature may be made in the future. </p> \n    <p>In the <b>Collection Management</b> workspace, click \"Export CKLs...\" and select the \"Use streaming API\" checkbox:</p>\n    <p><img src=\"img/whatsnew/2022-07-19-streaming-archive.png\"/></p>`\n  },  \n  {\n    date: '2022-07-18',\n    header: `Enhanced Options for Creating and Altering STIG-Asset Assignments`,\n    body: `<p>Quickly create new STIG-Asset assignments based on an existing set of assignments:</p>\n    <p>In the <b>Collection Management</b> workspace, select a STIG and click the \"Modify...\" button or double-click the STIG:</p>\n    <p><img src=\"img/whatsnew/2022-07-18-STIG-assignment-modify.png\"/></p>\n    <p>A STIG Assignments window will pop up. Click the pull-down button now available in the BenchmarkId selection box. \n    <p>You will be presented with a list of available STIGs. Scroll to the STIG you want, or start typing to filter the list. Filtering now applies anywhere in the benchmarkId:</p>\n    <p />\n    <p><img src=\"img/whatsnew/2022-07-18-STIG-assignment-pulldown.png\"/></p>\n    <p>Select your desired STIG, make any required Asset changes with the \"Assign Assets\" button, and hit \"Save.\"  \n    <p>A <b>NEW</b> set of STIG-Asset Assignments will be created with the STIG you selected.</p>`\n  },\n  {\n    date: '2022-07-14',\n    header: `Checkbox Selection for Multi-select Grids`,\n    body: `<p>In the <b>Collection Review</b> and <b>Collection Management</b> workspaces, grid rows can be selected with checkboxes.  Selecting the checkbox at the top of the column, or using the CTRL-A keyboard shortcut, will select all rows in the grid.</p>\n    <p><img src=\"img/whatsnew/2022-07-15-selection-checkboxes.png\"/></p>`\n  },\n  {\n    date: '2022-07-14',\n    header: `Review Detail and Comment Fields Now Capped at 32767 Characters`,\n    body: `<p>For better performance and to align with character limits enforced in Excel and the next version of Evaluate-STIG, Review Detail and Comment text fields are now capped at 32767 characters.</p>`\n  },  \n  {\n    date: '2022-07-11',\n    header: `Enhanced User Lists in the Collection Grant Interface`,\n    body: `<p>In the Collection Grants interface, the grid and dropdown lists now show the username and display name.</p>\n    <p><img src=\"img/whatsnew/2022-07-11-A.png\"/></p>\n    <p>When selecting a User from the dropdown list, it is possible to filter the list on a string that appears anywhere in either the username or display name.</p>\n    <p><img src=\"img/whatsnew/2022-07-11-B.png\"/></p>`\n  },\n  {\n    date: '2022-06-01',\n    header: `Batch Editing Preview`,\n    body: `Edit reviews for multiple Assets at once from the Collection Review workspace! This feature is offered as a preview of functionality that is actively under development, and may change somewhat before final release. <p />\n\n    <p/>\n    <b>From the Collection Review workspace, select two or more Reviews, then click the \"Batch edit\" button:</b>\n    <p/>\n    <img src=\"img/whatsnew/batch-edit-button.png\"/>\n    <p/>\n    <b>Make changes to any or all of the desired fields in the pop-up, and click \"Apply Review.\" If you leave the Detail or Comment empty, Reviews will keep their existing commentary. To remove existing commentary, add a space to that field.</b>\n    <p/>\n    <img src=\"img/whatsnew/batch-edit-popup.png\"/>\n    <p/>\n    <b>Your specified Result and Detail/Comment will be applied to all Assets selected!</b>\n    <p/>`\n  },\n  {\n    date: '2022-05-18',\n    header: `What's New Dialog on App Start`,\n    body: `On startup, the App now displays a \"What's New\" dialog describing the latest features added to the App.<p />\n    <ul><li>Click the <b>Don't show these features again</b> button and you will not be alerted until another new feature is added.</li>\n    <li>Click <b>Close</b> and you will be shown the dialog again when you next load the App.</li></ul>\n    <p/>\n    <b>The list of all recent changes is always available from Interface -> What's New.</b>`\n  },\n  {\n    date: '2022-05-16',\n    header: 'Dark Mode Preview',\n    body: `STIG Manager is now easier on the eyes! By popular request, we now provide a \"Dark Mode\" presentation for those STIG-ing after dark. This feature is provided as a preview which is expected to get additional aesthetic tweaks in the future. \n    <p/>\n    <b>Toggle Dark Mode on and off via Interface -> Dark Mode.</b>\n    <p/>\n    <img src=\"img/whatsnew/dark-mode.png\"/>`\n  },\n  {\n    date: '2022-05-16',\n    header: 'New Import Options and Additional Result Values',\n    body: `The App now provides Users with more fine-grained control over the way they import .ckl and XCCDF files. Please see the <a target=\"_blank\" href=\"docs/user-guide/user-guide.html#collection-settings-tab\">STIG Manager Documentation for more details about these new Collection Settings</a>.\n    <p/>\n    <b>Control these Import Options from the Collection -> Manage workspace or from the import interfaces.</b>\n    <p/>\n    <img src=\"img/whatsnew/import-options.gif\"/>\n    <p/>\n    <b>\"Informational\" and \"Not Reviewed\" Result values can now be selected manually:</b>\n    <p/>\n    <img src=\"img/whatsnew/result-values.gif\"/>\n    <p/>\n    <b>Please note that only Reviews with result \"Not a Finding\", \"Not Applicable\", or \"Open\" can be set to a Submit status!</b>`\n  },  \n  {\n    date: '2022-05-16',\n    header: 'Result Engine Property for Reviews',\n    body: `STIG Manager now stores and displays additional information about any tool used to perform an evaluation. Reviews produced by compatible Result Engines, such as the latest version of Evaluate-STIG and those producing XCCDF results, will now be displayed with additional information about the tool.  This information can include:\n    <ul>\n    <li>the Result Engine that performed the Evaluation</li>\n    <li>the timestamp of the actual Evaluation</li>\n    <li>information about any override (e.g., Evaluate-STIG \"Answer File\") to the engine's original result\n    </ul> \n    <p/>\n    <b>Look for this type of sprite next to your Evaluation Result, and hover over it for more info:</b>\n    <p/>\n    <img src=\"img/whatsnew/result-engine-1.png\"/>\n    <p/>\n    <b>Result Engine information for a Review is also indicated in the checklist views:</b>\n    <p/>\n    <img src=\"img/whatsnew/result-engine-2.png\"/>`\n  },\n  {\n    date: '2022-04-20',\n    header: 'Accept Reviews from the Asset-STIG Workspace',\n    body: `Users with an appropriate Grant in a Collection can now Accept individual Reviews right from the Asset-STIG Workspace:\n    <p/>\n    <img src=\"img/whatsnew/accept-review.gif\"/>`\n  }\n]\n\nSM.WhatsNew.FeedbackHtml = `<div class=\"sm-feedback-box\">\n    <div class=\"sm-feedback-box-title\">Have a Feature Request?</div>\n    <div class=\"sm-feedback-box-content\">\n      New features in STIG Manager are primarily driven by user requests.\n      Have an idea or feature request? We'd love to hear from you!\n      Please submit your suggestions by opening an issue on our \n      <a href=\"https://github.com/NUWCDIVNPT/stig-manager/issues\" target=\"_blank\">GitHub Issues page</a>.\n    </div>\n  </div>`\n\nSM.WhatsNew.BodyTpl = new Ext.XTemplate(\n  `<div class=\"sm-home-widget-title sm-whats-new-title\">New Features in the STIG Manager App</div>`,\n  `<hr style=\"margin-left:20px;margin-right:20px;\" />`,\n  `<tpl for=\".\">`,\n    `<tpl if=\"xindex &gt; 1\"><hr style=\"margin-left:20px;margin-right:20px;\" /></tpl>`,\n    `<div class=\"sm-whats-new sm-home-widget-text\">`,\n      `<div class=sm-home-widget-subtitle>{header}<div style=\"font-size:70%; font-style:italic;\">({date})</div></div> `,\n      `<div style=\"width:800px;\">{body}</div>`,\n    `</div>`,\n  `</tpl>`\n)\n\nSM.WhatsNew.addTab = function (params) {\n\tlet { treePath } = params ?? {}\n\tconst tab = Ext.getCmp('main-tab-panel').getItem('whats-new-tab')\n\tif (tab) {\n\t\ttab.show()\n\t\treturn\n\t}\n\n  const feedbackPanel = new Ext.Panel({\n    cls: 'sm-whats-new-feedback-panel',\n    // margins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.adjacent, left: SM.Margin.edge },\n    region: 'north',\n    height: 100,\n    border: false,\n    html: SM.WhatsNew.FeedbackHtml\n  })\n\n  const featuresPanel = new Ext.Panel({\n    autoScroll: true,\n    region: 'center',\n    // margins: { top: SM.Margin.adjacent, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n    border: false,\n    tpl: SM.WhatsNew.BodyTpl,\n    data: SM.WhatsNew.Sources\n  })\n\n  const thisTab = Ext.getCmp('main-tab-panel').add({\n\t\tid: 'whats-new-tab',\n\t\tsm_treePath: treePath,\n    cls: 'sm-round-panel',\n    iconCls: 'sm-stig-icon',\n\t\ttitle: \"What's New\",\n\t\tclosable:true,\n\t\tlayout: 'border',\n\t\titems: [feedbackPanel, featuresPanel]\n\t})\n\n\tthisTab.show();\n}\n\nSM.WhatsNew.showDialog = function (lastDate) {\n  const vpSize = Ext.getBody().getViewSize()\n  let height = vpSize.height * 0.85\n  let width = 850\n\n  const feedbackPanel = new Ext.Panel({\n    cls: 'sm-whats-new-feedback-panel',\n    region: 'north',\n    height: 112,\n    border: false,\n    html: SM.WhatsNew.FeedbackHtml\n  })\n\n  const featuresPanel = new Ext.Panel({\n    region: 'center',\n    border: false,\n    autoScroll: true,\n    margins: { bottom: 20 },\n    tpl: SM.WhatsNew.BodyTpl,\n    data: SM.WhatsNew.Sources.filter( item => item.date > lastDate )\n  })\n\n  const btnClose = new Ext.Button({\n    text: 'Close',\n    handler: function (b, e) {\n      fpwindow.close()\n    }\n  })\n\n  const btnRemember = new Ext.Button({\n    text: `&nbsp;Don't show these features again&nbsp;`,\n    handler: async function (b, e) {\n      const lastWhatsNew = SM.WhatsNew.Sources[0].date\n      try {\n        await Ext.Ajax.requestPromise({\n          responseType: 'json',\n          url: `${STIGMAN.Env.apiBase}/user/web-preferences`,\n          method: 'PATCH',\n          jsonData: { lastWhatsNew }\n        })\n      } catch (error) {\n          SM.Error.handleError(error)\n      }\n      fpwindow.close()\n    }\n  })\n\n  const fpwindow = new Ext.Window({\n    title: `What's New`,\n    modal: true,\n    resizable: false,\n    width,\n    height,\n    layout: 'border',\n    plain: true,\n    bodyStyle: 'padding:5px;',\n    buttonAlign: 'right',\n    buttons: [\n      btnRemember,\n      btnClose\n    ],\n    items: [feedbackPanel, featuresPanel]\n  })\n\n  fpwindow.show()\n\n}\n\nSM.WhatsNew.autoShow = function () {\n  let lastWhatsNew = curUser?.webPreferences?.lastWhatsNew\n\n  // transform any non-standard date from a previous release\n  const dateParts = lastWhatsNew.split('-')\n  lastWhatsNew = `${dateParts[0]}-${dateParts[1].padStart(2, '0')}-${dateParts[2].padStart(2, '0')}`\n\n  if (SM.WhatsNew.Sources[0].date > lastWhatsNew) {\n    SM.WhatsNew.showDialog(lastWhatsNew)\n  }\n}"
  },
  {
    "path": "client/src/js/collectionAdmin.js",
    "content": "function addCollectionAdmin( params ) {\n  let { treePath } = params\n  const tab = Ext.getCmp('main-tab-panel').getItem('collection-admin-tab')\n\tif (tab) {\n\t\ttab.show()\n\t\treturn\n\t}\n\n  const collectionGrid = new SM.Manage.Collection.AdminGrid({\n    cls: 'sm-round-panel',\n\t\tmargins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n    region: 'center',\n    border: false,\n    stripeRows: true,\n    listeners: {\n      rowclick: function (grid, rowIndex) {\n        const r = grid.getStore().getAt(rowIndex)\n        loadAdminPropertiesPanel(r.data.collectionId)\n      }\n    }\n  })\n\n  async function loadAdminPropertiesPanel(collectionId) {\n    const el = adminPropsPanel.getEl()\n    const smTask = setTimeout(el.mask.bind(el), 250)\n    try {\n      const apiCollection = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/collections/${collectionId}`,\n        params: {\n          elevate: true,\n          projection: 'grants'\n        },\n        method: 'GET'\n      })\n      adminPropsPanel.setFieldValues(apiCollection)\n    }\n    finally {\n      if (smTask) {\n        clearTimeout(smTask)\n      }\n      el.unmask()\n      el.removeClass('sm-vbox-disabled')\n    }\n  }\n\n  const adminPropsPanel = new SM.Manage.Collection.AdminPropertiesPanel({\n    title: 'Properties',\n    cls: 'sm-round-panel sm-vbox-disabled',\n    region: 'east',\n\t\tmargins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n    width: 400,\n    split: true\n  })\n\n  function reloadGrid() {\n    collectionGrid.store.reload()\n  }\n  function onCollectionChanged (apiCollection) {\n    collectionGrid.store.reload()\n    // store.loadData(apiCollection, true)\n    // const sortState = store.getSortState()\n    // store.sort(sortState.field, sortState.direction)\n    // collectionGrid.getSelectionModel().selectRow(store.findExact('collectionId',apiCollection.collectionId))\n  }\n  function onCollectionCreated (apiCollection) {\n    collectionGrid.store.reload()\n  }\n  function onCollectionDeleted (collectionId) {\n    collectionGrid.store.reload()\n    // store.removeAt(store.indexOfId(collectionId))\n  }\n  \n  SM.Dispatcher.addListener('collectionchanged', reloadGrid)\n  SM.Dispatcher.addListener('collectioncreated', reloadGrid)\n  SM.Dispatcher.addListener('collectiondeleted', reloadGrid)\n  SM.Dispatcher.addListener('grant.updated', reloadGrid)\n  SM.Dispatcher.addListener('grant.created', reloadGrid)\n  SM.Dispatcher.addListener('grant.deleted', reloadGrid)\n\n  const thisTab = Ext.getCmp('main-tab-panel').add({\n    id: 'collection-admin-tab',\n    sm_treePath: treePath,\n    iconCls: 'sm-collection-icon',\n    title: 'Collections',\n    closable: true,\n    layout: 'border',\n    border: false,\n    items: [collectionGrid, adminPropsPanel],\n    listeners: {\n      beforedestroy: function () {\n        SM.Dispatcher.removeListener('collectionchanged', reloadGrid)\n        SM.Dispatcher.removeListener('collectioncreated', reloadGrid)\n        SM.Dispatcher.removeListener('collectiondeleted', reloadGrid)\n        SM.Dispatcher.removeListener('grant.updated', reloadGrid)\n        SM.Dispatcher.removeListener('grant.created', reloadGrid)\n        SM.Dispatcher.removeListener('grant.deleted', reloadGrid)\n      \n      \n      }\n    }\n  })\n  thisTab.show()\n\n  collectionGrid.getStore().load()\n}\n\nasync function showAdminCreatePanel() {\n  try {\n    const adminCreatePanel = new SM.Manage.Collection.AdminCreatePanel({\n      btnHandler: async () => {\n        try {\n          let values = adminCreatePanel.getFieldValues()\n          await SM.Manage.Collection.ApiAddOrUpdate(0, values, {\n            elevate: true,\n            showManager: false\n          })\n          appwindow.close()\n        }\n        catch (e) {\n          if (e.responseText) {\n            const response = SM.safeJSONParse(e.responseText)\n            if (response?.detail === 'Duplicate name exists.') {\n              Ext.Msg.alert('Name unavailable', 'The Collection name is unavailable. Please try a different name.')\n            }\n            else {\n              appwindow.close()\n              SM.Error.handleError(e)\n            }\n          }\n        }\n      }\n    })\n\n    const appwindow = new Ext.Window({\n      id: 'window-project-info',\n      cls: 'sm-dialog-window sm-round-panel',\n      title: 'Create Collection',\n      modal: true,\n      width: 800,\n      height: 560,\n      layout: 'fit',\n      plain: false,\n      // bodyStyle: 'padding:5px;',\n      buttonAlign: 'right',\n      items: adminCreatePanel\n    })\n\n    appwindow.show(document.body)\n\n  }\n  catch (e) {\n    SM.Error.handleError(e)\n  }\n}\n\n"
  },
  {
    "path": "client/src/js/collectionManager.js",
    "content": "async function addCollectionManager( params ) {\n\tlet { collectionId, collectionName, treePath } = params\n\ttry {\n\t\tconst tab = Ext.getCmp('main-tab-panel').getItem(`${collectionId}-collection-manager-tab`)\n\t\tif (tab) {\n\t\t\ttab.show()\n\t\t\treturn\n\t\t}\n\t\n\t\tlet collectionGrant = curUser.collectionGrants.find( g => g.collection.collectionId === collectionId )\n\n\t\tlet apiCollection = await Ext.Ajax.requestPromise({\n\t\t\tresponseType: 'json',\n\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${collectionId}`,\n\t\t\tparams: {\n\t\t\t\tprojection: ['grants', 'labels']\n\t\t\t},\n\t\t\tmethod: 'GET'\n\t\t})\n\t\tSM.Cache.updateCollection(apiCollection)\n\n\t\tlet apiFieldSettings = apiCollection.settings.fields\n\n\t\tfunction onFieldSettingsChanged (collectionId, fieldSettings) {\n\t\t\tif (collectionId === apiCollection.collectionId) {\n\t\t\t\tassetGrid.apiFieldSettings = fieldSettings\n\t\t\t}\n\t\t}\n\t\n\t\tlet collectionPanel = new SM.Manage.Collection.Panel({\n\t\t\tcollectionId,\n\t\t\tapiCollection,\n\t\t\ttitle: `Manage Collection (${collectionId})`,\n\t\t\tcls: 'sm-round-panel',\n\t\t\tmargins: { top: SM.Margin.top, right: SM.Margin.adjacent, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n\t\t\tregion: 'west',\n\t\t\twidth: 430,\n\t\t\tminWidth:430,\n\t\t\tpadding: '10px 10px 10px 10px',\n\t\t\tborder: false,\n\t\t\tsplit: true,\n\t\t\tlayout: 'fit',\n\t\t\tcollapsible: true,\n\t\t\tallowDelete: collectionGrant.roleId === 4,\n\t\t\tallowClone: collectionGrant.roleId >= 3 && curUser.privileges.create_collection,\n\t\t\tcanModifyOwners: collectionGrant.roleId === 4,\n\t\t})\n\t\tlet assetGrid = new SM.Manage.Asset.Grid({\n\t\t\tcollectionId: collectionId,\n\t\t\tcollectionName: collectionName,\n\t\t\tapiFieldSettings: apiFieldSettings,\n\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${collectionId}/metrics/summary/asset`,\n\t\t\tcls: 'sm-round-panel',\n\t\t\tmargins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.adjacent, left: SM.Margin.adjacent },\n\t\t\ttitle: 'Assets',\n\t\t\tregion: 'north',\n\t\t\tborder: false,\n\t\t\tsplit: true,\n\t\t\theight: '50%',\n\t\t\tstripeRows: true\n\t\t})\n\t\tlet stigGrid = new SM.Manage.Stig.Grid({\n\t\t\tcollectionId: collectionId,\n\t\t\tcollectionName: collectionName,\n\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${collectionId}/metrics/summary/stig`,\n\t\t\tcls: 'sm-round-panel',\n\t\t\tmargins: { top: SM.Margin.adjacent, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.adjacent },\n\t\t\tborder: false,\n\t\t\ttitle: 'STIGs',\n\t\t\tregion: 'center',\n\t\t\tstripeRows: true\n\t\t})\n\t\tlet managerTab = new Ext.Panel({\n\t\t\tid: `${collectionId}-collection-manager-tab`,\n\t\t\tcollectionId: collectionId,\n\t\t\tcollectionName: collectionName,\n\t\t\ticonCls: 'sm-setting-icon',\n\t\t\tsm_tabMode: 'permanent',\n\t\t\tsm_treePath: treePath,\n\t\t\tclosable: true,\n\t\t\tlayout: 'border',\n\t\t\tlayoutConfig: {\n\t\t\t\ttargetCls: 'sm-border-layout-ct'\n\t\t\t},\n\t\t\tlisteners: {\n\t\t\t\tbeforedestroy: () => {\n\t\t\t\t\tSM.Dispatcher.removeListener('assetchanged', onAssetEvent)\n\t\t\t\t\tSM.Dispatcher.removeListener('assetcreated', onAssetEvent)\n\t\t\t\t\tSM.Dispatcher.removeListener('assetdeleted', onAssetEvent)\n\t\t\t\t\tSM.Dispatcher.removeListener('stigassetschanged', onStigAssetsChanged)\n\t\t\t\t\tSM.Dispatcher.removeListener('labelassetschanged', onLabelAssetsChanged)\n\t\t\t\t\tSM.Dispatcher.removeListener('fieldsettingschanged', onFieldSettingsChanged)\n\t\t\t\t}\n\t\t\t},\n\t\t\titems: [\n\t\t\t\tcollectionPanel,\n\t\t\t\t{\n\t\t\t\t\tregion: 'center',\n\t\t\t\t\tlayout: 'border',\n\t\t\t\t\tborder: false,\n\t\t\t\t\tlayoutConfig: {\n\t\t\t\t\t\ttargetCls: 'sm-border-layout-ct'\n\t\t\t\t\t},\n\t\t\t\t\titems: [\n\t\t\t\t\t\tassetGrid,\n\t\t\t\t\t\tstigGrid\n\t\t\t\t\t]\n\t\n\t\t\t\t}\n\t\t\t]\n\t\t})\n\t\tasync function onAssetEvent (apiAsset) {\n\t\t\tif (apiAsset.collection.collectionId === collectionId) {\n\t\t\t\tassetGrid.getStore().reload()\n\t\t\t\tstigGrid.getStore().reload()\n\t\t\t\t\n\t\t\t\t// update labels grid\n\t\t\t\tconst labels = await Ext.Ajax.requestPromise({\n\t\t\t\t\tresponseType: 'json',\n\t\t\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${collectionId}/labels`,\n\t\t\t\t\tmethod: 'GET'\n\t\t\t\t})\n\t\t\t\tcollectionPanel.labelGrid.setValue(labels)\n\t\t\t}\n\t\t}\n\t\tfunction onStigAssetsChanged (eCollectionId) {\n\t\t\tif (eCollectionId === collectionId) {\n\t\t\t\tassetGrid.getStore().reload()\n\t\t\t\tstigGrid.getStore().reload()\n\t\t\t}\n\t\t}\n\t\tasync function onLabelAssetsChanged(eCollectionId, labelId, apiLabelAssets) {\n\t\t\tif (eCollectionId === collectionId) {\n\t\t\t\tawait assetGrid.getStore().reloadPromise()\n\t\t\t\t// update labels grid\n\t\t\t\tconst labels = await Ext.Ajax.requestPromise({\n\t\t\t\t\tresponseType: 'json',\n\t\t\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${collectionId}/labels`,\n\t\t\t\t\tmethod: 'GET'\n\t\t\t\t})\n\t\t\t\tcollectionPanel.labelGrid.setValue(labels)\n\t\t\t}\n\t\t}\n\n\n\t\tmanagerTab.updateTitle = function () {\n\t\t\tmanagerTab.setTitle(`${managerTab.sm_tabMode === 'ephemeral' ? '<i>':''}${SM.he(managerTab.collectionName)} / Manage${this.sm_tabMode === 'ephemeral' ? '</i>':''}`)\n\t\t}\n\n\t\tmanagerTab.makePermanent = function () {\n\t\t\tmanagerTab.sm_tabMode = 'permanent'\n\t\t\tmanagerTab.updateTitle.call(managerTab)\n\t\t}\n\t\t\n\t\tlet tp = Ext.getCmp('main-tab-panel')\n\t\tlet ephTabIndex = tp.items.findIndex('sm_tabMode', 'ephemeral')\n\t\tlet thisTab\n\t\tif (ephTabIndex !== -1) {\n\t\tlet ephTab = tp.items.itemAt(ephTabIndex)\n\t\ttp.remove(ephTab)\n\t\tthisTab = tp.insert(ephTabIndex, managerTab);\n\t\t} else {\n\t\tthisTab = tp.add( managerTab )\n\t\t}\n\t\tthisTab.updateTitle.call(thisTab)\n\t\tthisTab.show();\n\t\t\n\t\tassetGrid.getStore().load()\n\t\tstigGrid.getStore().load()\n\t\tSM.Dispatcher.addListener('labelassetschanged', onLabelAssetsChanged)\n\t\tSM.Dispatcher.addListener('assetchanged', onAssetEvent)\n\t\tSM.Dispatcher.addListener('assetcreated', onAssetEvent)\n\t\tSM.Dispatcher.addListener('assetdeleted', onAssetEvent)\n\t\tSM.Dispatcher.addListener('stigassetschanged', onStigAssetsChanged)\n\t\tSM.Dispatcher.addListener('fieldsettingschanged', onFieldSettingsChanged)\n\t}\n\tcatch( e) {\n\t\tSM.Error.handleError(e)\n\t}\n\n}\n\n"
  },
  {
    "path": "client/src/js/collectionReview.js",
    "content": "/*\n$Id: collectionReview.js 885 2018-02-20 16:26:08Z bmassey $\n*/\n\n\nasync function addCollectionReview ( params ) {\n\tconst { leaf, selectedRule, selectedAsset, treePath } = params\n\ttry {\n\t\tconst idAppend = '-creview-' + leaf.collectionId + '-' + leaf.benchmarkId.replace(/[. ]/g,'_')\n\t\tconst tab = Ext.getCmp('main-tab-panel').getItem('collection-review-tab' + idAppend)\n\t\tif (tab) {\n\t\t\ttab.show()\n\t\t\treturn\n\t\t}\n\t\n\t\t/******************************************************/\n\t\t// 'Global' colAssets array of objects for reviewsGrid\n\t\t/******************************************************/\n\t\tconst apiCollection = await Ext.Ajax.requestPromise({\n\t\t\tresponseType: 'json',\n\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${leaf.collectionId}`,\n\t\t\tmethod: 'GET',\n\t\t  })\n\t\tlet apiFieldSettings = apiCollection.settings.fields\n\t\tlet apiStatusSettings = apiCollection.settings.status\n\t\n\t\tconst apiAssets = await Ext.Ajax.requestPromise({\n\t\t\tresponseType: 'json',\n\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${leaf.collectionId}/stigs/${leaf.benchmarkId}/assets`,\n\t\t\tmethod: 'GET',\n\t\t  })\t\n\t\tconst colAssets = apiAssets.map( colAsset => ({\n\t\t\tassetId: colAsset.assetId,\n\t\t\tassetName: colAsset.name,\n\t\t\tassetLabelIds: colAsset.assetLabelIds,\n\t\t\taccess: colAsset.access,\n\t\t\tresult: null,\n\t\t\tdetail: null,\n\t\t\tcomment: null,\n\t\t\tautoResult: null,\n\t\t\tuserId: null,\n\t\t\tusername: null,\n\t\t\tts: null,\n\t\t\tstatus: null\n\t\t}))\n\n\t\t/******************************************************/\n\t\t// START Group Grid\n\t\t/******************************************************/\n\t\tconst groupFields = Ext.data.Record.create([\n\t\t\t{\t\n\t\t\t\tname:'oCnt',\n\t\t\t\ttype: 'int',\n\t\t\t\tmapping: 'counts.results.fail'\n\t\t\t},{\t\n\t\t\t\tname:'nfCnt',\n\t\t\t\ttype: 'int',\n\t\t\t\tmapping: 'counts.results.pass'\n\t\t\t},{\t\n\t\t\t\tname:'naCnt',\n\t\t\t\ttype: 'int',\n\t\t\t\tmapping: 'counts.results.notapplicable'\n\t\t\t},{\t\n\t\t\t\tname:'otherCnt',\n\t\t\t\ttype: 'int',\n\t\t\t\tmapping: 'counts.results.other'\n\t\t\t},{\t\n\t\t\t\tname:'approveCnt',\n\t\t\t\ttype: 'int',\n\t\t\t\tmapping: 'counts.statuses.accepted'\n\t\t\t},{\t\n\t\t\t\tname:'rejectCnt',\n\t\t\t\ttype: 'int',\n\t\t\t\tmapping: 'counts.statuses.rejected'\n\t\t\t},{\t\n\t\t\t\tname:'readyCnt',\n\t\t\t\ttype: 'int',\n\t\t\t\tmapping: 'counts.statuses.submitted'\n\t\t\t},{\t\n\t\t\t\tname:'groupId',\n\t\t\t\ttype: 'string',\n\t\t\t\tsortType: sortGroupId\n\t\t\t},{\t\n\t\t\t\tname:'ruleId',\n\t\t\t\ttype: 'string'\n\t\t\t},{\t\n\t\t\t\tname:'version',\n\t\t\t\ttype: 'string'\n\t\t\t},{\n\t\t\t\tname:'groupTitle',\n\t\t\t\ttype: 'string'\n\t\t\t},{\n\t\t\t\tname:'ruleTitle',\n\t\t\t\ttype: 'string'\n\t\t\t},{\n\t\t\t\tname:'severity',\n\t\t\t\ttype:'string'\n\t\t\t},{\n\t\t\t\tname: 'minTouchTs',\n\t\t\t\ttype: 'date',\n\t\t\t\tmapping: 'timestamps.touchTs.min'\n\t\t\t},{\n\t\t\t\tname: 'maxTouchTs',\n\t\t\t\ttype: 'date',\n\t\t\t\tmapping: 'timestamps.touchTs.max'\n\t\t\t}\n\t\t])\n\n\n\t\tconst groupStore = new Ext.data.JsonStore({\n\t\t\tproxy: new Ext.data.HttpProxy({\n\t\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${leaf.collectionId}/checklists/${leaf.benchmarkId}/${leaf.revisionStr}`,\n\t\t\t\tmethod: 'GET'\n\t\t\t}),\n\t\t\troot: '',\n\t\t\tfields: groupFields,\n\t\t\tidProperty: 'ruleId',\n\t\t\tsortInfo: {\n\t\t\t\tfield: 'groupId',\n\t\t\t\tdirection: 'ASC' // or 'DESC' (case sensitive for local sorting)\n\t\t\t},\n\t\t\tlisteners: {\n\t\t\t\tload: function (store,records,options) {\n\t\t\t\t\tconst ourGrid = groupGrid\n\t\t\t\t\t\n\t\t\t\t\t// Preselection\n\t\t\t\t\tif (options.preselect !== undefined) {\n\t\t\t\t\t\tif (options.preselect.ruleId !== undefined) {\n\t\t\t\t\t\t\tconst index = store.find('ruleId',options.preselect.ruleId)\n\t\t\t\t\t\t\tourGrid.getSelectionModel().selectRow(index)\n\t\t\t\t\t\t\tourGrid.getView().focusRow(index)\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tourGrid.getSelectionModel().selectFirstRow()\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\tourGrid.getSelectionModel().selectFirstRow()\n\t\t\t\t\t}\n\t\t\t\t\t// Filter the store\n\t\t\t\t\tfilterGroupStore()\n\t\t\t\t\t\n\t\t\t\t\tgroupGrid?.statSprites?.setText(getGroupStatsString(store))\n\t\t\t\t},\n\t\t\t\tclear: function(){\n\t\t\t\t\tgroupGrid?.statSprites?.setText(getGroupStatsString(store))\n\t\t\t\t},\n\t\t\t\tupdate: function(store) {\n\t\t\t\t\tgroupGrid?.statSprites?.setText(getGroupStatsString(store))\n\t\t\t\t},\n\t\t\t\tdatachanged: function(store) {\n\t\t\t\t\tgroupGrid?.statSprites?.setText(getGroupStatsString(store))\n\t\t\t\t}\n\t\t\t}\n\t\t})\n\n\t\t/******************************************************/\n\t\t// Group grid menus\n\t\t/******************************************************/\n\n\t\tfunction groupRuleColHandler (item) {\n\t\t\tconst {idProp, titleProp} = item.colProps\n\t\t\tconst cm = groupGrid.getColumnModel()\n\t\t\tconst colNames = ['groupId','groupTitle','ruleId','ruleTitle']\n\t\t\tgroupGrid.titleColumnDataIndex = titleProp\n\t\t\tgroupGrid.autoExpandColumn = titleProp + idAppend\n\t\t\tfor (const colName of colNames) {\n\t\t\t\tconst index = cm.findColumnIndex(colName)\n\t\t\t\tconst hide = colName !== idProp && colName !== titleProp\n\t\t\t\tcm.setHidden(index, hide)\n\t\t\t}\n\t\t\tgroupGrid.getView().autoExpand()\n\t\t}\n\t\tconst groupChecklistMenu = new Ext.menu.Menu({\n\t\t\tid: 'groupChecklistMenu' + idAppend,\n\t\t\titems: [\n\t\t\t\t{\n\t\t\t\t\ttext: 'Displayed title',\n\t\t\t\t\thideOnClick: false,\n\t\t\t\t\tmenu: {\n\t\t\t\t\t\titems: [ \n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttext: 'Group ID and Rule title',\n\t\t\t\t\t\t\t\tcolProps: {idProp: 'groupId', titleProp: 'ruleTitle'},\n\t\t\t\t\t\t\t\tchecked: true,\n\t\t\t\t\t\t\t\tgroup: 'titleType' + idAppend,\n\t\t\t\t\t\t\t\thandler: groupRuleColHandler\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttext: 'Group ID and Group title',\n\t\t\t\t\t\t\t\tcolProps: {idProp: 'groupId', titleProp: 'groupTitle'},\n\t\t\t\t\t\t\t\tchecked: false,\n\t\t\t\t\t\t\t\tgroup: 'titleType' + idAppend,\n\t\t\t\t\t\t\t\thandler: groupRuleColHandler\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttext: 'Rule ID and Rule title',\n\t\t\t\t\t\t\t\tcolProps: {idProp: 'ruleId', titleProp: 'ruleTitle'},\n\t\t\t\t\t\t\t\tchecked: false,\n\t\t\t\t\t\t\t\tgroup: 'titleType' + idAppend,\n\t\t\t\t\t\t\t\thandler: groupRuleColHandler\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t]\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\t,{ \n\t\t\t\t\ttext: 'Export result archive',\n\t\t\t\t\tdisabled: false,\n\t\t\t\t\ticonCls: 'sm-export-icon',\n\t\t\t\t\thideOnClick: false,\n\t\t\t\t\tmenu: {\n\t\t\t\t\t\titems: [ \n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttext: 'CKL (STIG Viewer v2)',\n\t\t\t\t\t\t\t\ticonCls: 'sm-export-icon',\n\t\t\t\t\t\t\t\ttooltip: 'Download an archive with results in DISA STIG Viewer format for each asset in the collection',\n\t\t\t\t\t\t\t\thandler: function () {\n\t\t\t\t\t\t\t\t\tconst checklists = apiAssets.map( asset => ({\n\t\t\t\t\t\t\t\t\t\tassetId: asset.assetId,\n\t\t\t\t\t\t\t\t\t\tstigs: [\n\t\t\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t\t\tbenchmarkId:leaf.benchmarkId,\n\t\t\t\t\t\t\t\t\t\t\t\trevisionStr: groupGrid.sm_revisionStr\n\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t]\n\t\t\t\t\t\t\t\t\t}))\n\t\t\t\t\t\t\t\t\tSM.Exports.exportArchiveStreaming({\n\t\t\t\t\t\t\t\t\t\tformat: 'ckl-mono',\n\t\t\t\t\t\t\t\t\t\tcollectionId: leaf.collectionId,\n\t\t\t\t\t\t\t\t\t\tchecklists\n\t\t\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttext: 'CKLB (STIG Viewer v3)',\n\t\t\t\t\t\t\t\ticonCls: 'sm-export-icon',\n\t\t\t\t\t\t\t\ttooltip: 'Download an archive with results in DISA STIG Viewer v3 format for each asset in the collection',\n\t\t\t\t\t\t\t\thandler: function () {\n\t\t\t\t\t\t\t\t\tconst checklists = apiAssets.map( asset => ({\n\t\t\t\t\t\t\t\t\t\tassetId: asset.assetId,\n\t\t\t\t\t\t\t\t\t\tstigs: [\n\t\t\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t\t\tbenchmarkId:leaf.benchmarkId,\n\t\t\t\t\t\t\t\t\t\t\t\trevisionStr: groupGrid.sm_revisionStr\n\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t]\n\t\t\t\t\t\t\t\t\t}))\n\t\t\t\t\t\t\t\t\tSM.Exports.exportArchiveStreaming({\n\t\t\t\t\t\t\t\t\t\tformat: 'cklb-mono',\n\t\t\t\t\t\t\t\t\t\tcollectionId: leaf.collectionId,\n\t\t\t\t\t\t\t\t\t\tchecklists\n\t\t\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttext: 'XCCDF',\n\t\t\t\t\t\t\t\ticonCls: 'sm-export-icon',\n\t\t\t\t\t\t\t\ttooltip: 'Download an archive with results in XCCDF format for each asset in the collection',\n\t\t\t\t\t\t\t\thandler: function () {\n\t\t\t\t\t\t\t\t\tconst checklists = apiAssets.map( asset => ({\n\t\t\t\t\t\t\t\t\t\tassetId: asset.assetId,\n\t\t\t\t\t\t\t\t\t\tstigs: [\n\t\t\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t\t\tbenchmarkId:leaf.benchmarkId,\n\t\t\t\t\t\t\t\t\t\t\t\trevisionStr: groupGrid.sm_revisionStr\n\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t]\n\t\t\t\t\t\t\t\t\t}))\n\t\t\t\t\t\t\t\t\tSM.Exports.exportArchiveStreaming({\n\t\t\t\t\t\t\t\t\t\tformat: 'xccdf',\n\t\t\t\t\t\t\t\t\t\tcollectionId: leaf.collectionId,\n\t\t\t\t\t\t\t\t\t\tchecklists\n\t\t\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t]\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t\t'-'\n\t\t\t]\n\t\t})\n\t\t\n\n\t\t/******************************************************/\n\t\t// Group grid statistics string\n\t\t/******************************************************/\n\t\tfunction getGroupStatsString (store) {\n\t\t\tconst assetCount = apiAssets.length\n\t\t\tconst totalChecks = store.getCount()\n\t\t\tconst stats = store.data.items.reduce((a, c) => {\n\t\t\t\tfor (const prop in a) {\n\t\t\t\t\ta[prop] += c.data[prop]\n\t\t\t\t}\n\t\t\t\treturn a\n\t\t\t}, {\n\t\t\t\tapproveCnt: 0,\n\t\t\t\tnaCnt: 0,\n\t\t\t\tnfCnt: 0,\n\t\t\t\toCnt: 0,\n\t\t\t\totherCnt: 0,\n\t\t\t\treadyCnt: 0,\n\t\t\t\trejectCnt: 0\n\t\t\t})\n\t\t\tconst spriteGroups = []\n\n\n\t\t\tspriteGroups.push(`<span class=\"sm-review-sprite sm-review-sprite-asset\" ext:qtip=\"Assets\">${assetCount}</span> <span class=\"sm-review-sprite sm-assessment-icon\" ext:qtip=\"Required assessments\">${totalChecks*assetCount}</span>`)\n\t\t\t\n\t\t\tspriteGroups.push(\n\t\t\t\t[\n\t\t\t\t\t`${stats.oCnt ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Open\"><span class=\"sm-result-fail\" style=\"font-weight:bolder;\">O </span>${stats.oCnt}</span>` : ''}`,\n\t\t\t\t\t`${stats.nfCnt ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Not a Finding\"><span class=\"sm-result-pass\" style=\"font-weight:bolder;\">NF </span>${stats.nfCnt}</span>` : ''}`,\n\t\t\t\t\t`${stats.naCnt ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Not Applicable\"><span class=\"sm-result-na\" style=\"font-weight:bolder;\">NA </span>${stats.naCnt}</span>` : ''}`,\n\t\t\t\t\t`${stats.otherCnt ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Not Reviewed or has a non-compliance result such as informational\"><span class=\"sm-result-nr\" style=\"font-weight:bolder;\">NR+ </span>${stats.otherCnt}</span>` : ''}`\n\t\t\t\t].filter(Boolean).join(' ')\n\t\t\t)\n\t\t\t\n\t\t\tspriteGroups.push(\n\t\t\t\t[\n\t\t\t\t\t`${stats.readyCnt ? `<span class=\"sm-review-sprite sm-review-sprite-stat-submitted\" ext:qtip=\"Submitted\">${stats.readyCnt}</span>` : ''}`,\n\t\t\t\t\t`${stats.rejectCnt ? `<span class=\"sm-review-sprite sm-review-sprite-stat-rejected\" ext:qtip=\"Rejected\">${stats.rejectCnt}</span>` : ''}`,\n\t\t\t\t\t`${stats.approveCnt ? `<span class=\"sm-review-sprite sm-review-sprite-stat-accepted\" ext:qtip=\"Accepted\">${stats.approveCnt}</span>` : ''}`\n\t\t\t\t].filter(Boolean).join(' ')\n\t\t\t)\n\t\t\t\n\t\t\treturn spriteGroups.filter(Boolean).join('<span class=\"sm-xtb-sep\"></span>')\n\t\t}\n\n\t\t/******************************************************/\n\t\t// The group grid\n\t\t/******************************************************/\n\t\tconst groupExportBtn = new Ext.ux.ExportButton({\n\t\t\thasMenu: false,\n\t\t\texportType: 'grid',\n\t\t\tgridBasename: `${leaf.benchmarkId}`,\n\t\t\ticonCls: 'sm-export-icon',\n\t\t\ttext: 'CSV'\n\t\t})\n\n\t\t// Chrome bug: can't access groupGrid before initialization in store's datachanged handler\n\t\tvar groupGrid = new Ext.grid.GridPanel({\n\t\t\tstateful: true,\n\t\t\tstateId: `collection-review-grid-${leaf.collectionId}-${leaf.benchmarkId}`,\n\t\t\tcls: 'sm-round-panel',\n\t\t\tmargins: { top: SM.Margin.top, right: SM.Margin.adjacent, bottom: SM.Margin.adjacent, left: SM.Margin.edge },\n\t\t\tborder: false,\n\t\t\tregion: 'north',\n\t\t\tsm_benchmarkId: leaf.benchmarkId,\n\t\t\tsm_revisionStr: leaf.revisionStr,\n\t\t\tfilterState: 'All',\n\t\t\ttitle: 'Checklist',\n\t\t\tsplit:true,\n\t\t\ttitleColumnDataIndex: 'ruleTitle', // STIG Manager defined property\n\t\t\t//collapsible: true,\n\t\t\tstore: groupStore,\n\t\t\tstripeRows:true,\n\t\t\tsm: new Ext.grid.RowSelectionModel ({\n\t\t\t\tsingleSelect: true,\n\t\t\t\tlisteners: {\n\t\t\t\t\trowselect: {\n\t\t\t\t\t\tfn: function(sm,index,record) {\n\t\t\t\t\t\t\thandleGroupSelectionForCollection(record, idAppend, leaf, groupGrid.sm_benchmarkId, groupGrid.sm_revisionStr) // defined below\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}),\n\t\t\tview: new SM.ColumnFilters.GridView({\n\t\t\t\tforceFit:false,\n\t\t\t\temptyText: '',\n\t\t\t\t// These listeners keep the grid in the same scroll position after the store is reloaded\n\t\t\t\tholdPosition: true, // HACK to be used with override\n\t\t\t\tlastHide: new Date(),\n\t\t\t\tdeferEmptyText:false,\n\t\t\t\tlisteners: {\n\t\t\t\t\tfilterschanged: function (view, item, value) {\n\t\t\t\t\t\tgroupStore.filter(view.getFilterFns())\n\t\t\t\t\t\tconst statusText = getGroupStatsString(groupStore)\n\t\t\t\t\t\tgroupGrid.statSprites?.setText(statusText)\n\t\t\t\t\t}\n\t\t\t\t},\t\t\n\n\t\t\t\tonColumnSplitterMoved : function(cellIndex, width) {\n\t\t\t\t\t// override that does NOT set userResized and calls autoExpand()\n\t\t\t\t\t// this.userResized = true\n\t\t\t\t\tthis.grid.colModel.setColumnWidth(cellIndex, width, true)\n\t\n\t\t\t\t\tif (this.forceFit) {\n\t\t\t\t\t\t\tthis.fitColumns(true, false, cellIndex)\n\t\t\t\t\t\t\tthis.updateAllColumnWidths()\n\t\t\t\t\t} else {\n\t\t\t\t\t\t\tthis.updateColumnWidth(cellIndex, width)\n\t\t\t\t\t\t\tthis.syncHeaderScroll()\n\t\t\t\t\t}\n\t\t\t\t\tthis.grid.fireEvent('columnresize', cellIndex, width)\n\t\t\t\t\tthis.autoExpand()\n\t\t\t\t}\n\t\t\t}),\n\t\t\tcolumns: [\n\t\t\t\t{ \t\n\t\t\t\t\tid:'cat' + idAppend,\n\t\t\t\t\theader: \"CAT\", \n\t\t\t\t\twidth: 44,\n\t\t\t\t\talign: 'left',\n\t\t\t\t\tdataIndex: 'severity',\n\t\t\t\t\tfixed: true,\n\t\t\t\t\tsortable: true,\n\t\t\t\t\trenderer: renderSeverity,\n\t\t\t\t\tfilter: {\n\t\t\t\t\t\ttype: 'values',\n\t\t\t\t\t\tcomparer: SM.ColumnFilters.CompareFns.severity,\n\t\t\t\t\t\trenderer: SM.ColumnFilters.Renderers.severity\n\t\t\t\t\t}\t\n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'version' + idAppend,\n\t\t\t\t\theader: \"STIG Id\",\n\t\t\t\t\twidth: 105,\n\t\t\t\t\tdataIndex: 'version',\n\t\t\t\t\tsortable: true,\n\t\t\t\t\thidden: true,\n\t\t\t\t\thideable: true,\n\t\t\t\t\talign: 'left',\n\t\t\t\t\trenderer: (v, attrs) => {\n\t\t\t\t\t\tattrs.css = 'sm-direction-rtl'\n\t\t\t\t\t\treturn v\n\t\t\t\t\t},\t\n\t\t\t\t\tfilter: {\n\t\t\t\t\t\ttype: 'string'\n\t\t\t\t\t}\t\n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'groupId' + idAppend,\n\t\t\t\t\theader: \"Group\",\n\t\t\t\t\twidth: 85,\n\t\t\t\t\tdataIndex: 'groupId',\n\t\t\t\t\tsortable: true,\n\t\t\t\t\thidden: false,\n\t\t\t\t\thideable: false,\n\t\t\t\t\talign: 'left',\n\t\t\t\t\tfilter: {\n\t\t\t\t\t\ttype: 'string'\n\t\t\t\t\t}\t\n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'ruleId' + idAppend,\n\t\t\t\t\theader: \"Rule Id\",\n\t\t\t\t\twidth: 105,\n\t\t\t\t\tdataIndex: 'ruleId',\n\t\t\t\t\tsortable: true,\n\t\t\t\t\thidden: true,\n\t\t\t\t\thideable: false,\n\t\t\t\t\talign: 'left',\n\t\t\t\t\tfilter: {\n\t\t\t\t\t\ttype: 'string'\n\t\t\t\t\t}\t\n\t\t\t\t},\n\t\t\t\t{ \n\t\t\t\t\tid:'groupTitle' + idAppend,\n\t\t\t\t\theader: \"Group Title\",\n\t\t\t\t\twidth: 80,\n\t\t\t\t\tdataIndex: 'groupTitle',\n\t\t\t\t\trenderer: columnWrap,\n\t\t\t\t\thidden: true,\n\t\t\t\t\thideable: false,\n\t\t\t\t\tsortable: true,\n\t\t\t\t\tfilter: {\n\t\t\t\t\t\ttype: 'string'\n\t\t\t\t\t}\t\n\t\t\t\t},\n\t\t\t\t{ \n\t\t\t\t\tid:'ruleTitle' + idAppend,\n\t\t\t\t\theader: \"Rule Title\",\n\t\t\t\t\twidth: 80,\n\t\t\t\t\tdataIndex: 'ruleTitle',\n\t\t\t\t\trenderer: columnWrap,\n\t\t\t\t\thidden: false,\n\t\t\t\t\thideable: false,\n\t\t\t\t\tsortable: true,\n\t\t\t\t\tfilter: {\n\t\t\t\t\t\ttype: 'string'\n\t\t\t\t\t}\t\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tid: 'minTouchTs' + idAppend,\n\t\t\t\t\theader: 'Oldest',\n\t\t\t\t\tfixed: true,\n\t\t\t\t\thidden: true,\n\t\t\t\t\twidth: 64,\n\t\t\t\t\talign: 'center',\n\t\t\t\t\tdataIndex: 'minTouchTs',\n\t\t\t\t\tsortable: true,\n\t\t\t\t\trenderer: renderDurationToNow\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tid: 'maxTouchTs' + idAppend,\n\t\t\t\t\theader: 'Newest',\n\t\t\t\t\tfixed: true,\n\t\t\t\t\thidden: true,\n\t\t\t\t\twidth: 64,\n\t\t\t\t\talign: 'center',\n\t\t\t\t\tdataIndex: 'maxTouchTs',\n\t\t\t\t\tsortable: true,\n\t\t\t\t\trenderer: renderDurationToNow\n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'oCnt' + idAppend,\n\t\t\t\t\theader: '<div class=\"sm-result-fail\" style=\"font-weight:bolder;\" exportvalue=\"O\">O</div>', \n\t\t\t\t\twidth: 40,\n\t\t\t\t\talign: 'center',\n\t\t\t\t\tdataIndex: 'oCnt',\n\t\t\t\t\trenderer:renderOpen,\n\t\t\t\t\tfixed: true,\n\t\t\t\t\tsortable: true\n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'nfCnt' + idAppend,\n\t\t\t\t\theader: '<div class=\"sm-result-pass\" style=\"font-weight:bolder;\" exportvalue=\"NF\">NF</div>', \n\t\t\t\t\twidth: 40,\n\t\t\t\t\talign: 'center',\n\t\t\t\t\trenderer:renderCounts,\n\t\t\t\t\tdataIndex: 'nfCnt',\n\t\t\t\t\tfixed: true,\n\t\t\t\t\tsortable: true\n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'naCnt' + idAppend,\n\t\t\t\t\theader: '<div class=\"sm-result-na\" style=\"font-weight:bolder;\" exportvalue=\"NA\">NA</div>', \n\t\t\t\t\twidth: 40,\n\t\t\t\t\talign: 'center',\n\t\t\t\t\trenderer:renderCounts,\n\t\t\t\t\tdataIndex: 'naCnt',\n\t\t\t\t\tfixed: true,\n\t\t\t\t\tsortable: true\n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'otherCnt' + idAppend,\n\t\t\t\t\theader: '<div class=\"sm-result-nr\" style=\"font-weight:bolder;\" exportvalue=\"NR+\">NR+</div>', \n\t\t\t\t\twidth: 44,\n\t\t\t\t\talign: 'center',\n\t\t\t\t\trenderer:renderOpen,\n\t\t\t\t\tdataIndex: 'otherCnt',\n\t\t\t\t\tfixed: true,\n\t\t\t\t\tsortable: true\n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'readyCnt' + idAppend,\n\t\t\t\t\theader: '<img src=img/ready-16.png width=12 height=12 exportvalue=\"Submitted\">', \n\t\t\t\t\twidth: 40,\n\t\t\t\t\talign: 'center',\n\t\t\t\t\tdataIndex: 'readyCnt',\n\t\t\t\t\tfixed: true,\n\t\t\t\t\trenderer:renderStatusCounts,\n\t\t\t\t\tsortable: true\n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'rejectCnt' + idAppend,\n\t\t\t\t\theader: '<img src=img/rejected-16.png width=12 height=12 exportvalue=\"Rejected\">', \n\t\t\t\t\twidth: 40,\n\t\t\t\t\talign: 'center',\n\t\t\t\t\tdataIndex: 'rejectCnt',\n\t\t\t\t\tfixed: true,\n\t\t\t\t\trenderer:renderStatusCounts,\n\t\t\t\t\tsortable: true\n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'approveCnt' + idAppend,\n\t\t\t\t\theader: '<img src=img/star.svg width=12 height=12 exportvalue=\"Approved\">', \n\t\t\t\t\twidth: 40,\n\t\t\t\t\talign: 'center',\n\t\t\t\t\tdataIndex: 'approveCnt',\n\t\t\t\t\tfixed: true,\n\t\t\t\t\trenderer:renderStatusCounts,\n\t\t\t\t\tsortable: true\n\t\t\t\t}\n\t\t\t],\n\t\t\tautoExpandColumn:'ruleTitle' + idAppend,\n\t\t\t//width: '33%',\n\t\t\theight: '50%',\n\t\t\tloadMask: {msg: ''},\n\t\t\ttbar: new Ext.Toolbar({\n\t\t\t\titems: [\n\t\t\t\t\t{\n\t\t\t\t\t\txtype: 'tbbutton',\n\t\t\t\t\t\ticonCls: 'sm-checklist-icon',  // <-- icon\n\t\t\t\t\t\ttext: 'Checklist',\n\t\t\t\t\t\tmenu: groupChecklistMenu\n\t\t\t\t\t}\n\t\t\t\t]\n\t\t\t}),\n\t\t\tbbar: [\n\t\t\t\t{\n\t\t\t\t\txtype: 'tbbutton',\n\t\t\t\t\ticonCls: 'icon-refresh',\n\t\t\t\t\ttooltip: 'Reload this grid',\n\t\t\t\t\twidth: 20,\n\t\t\t\t\thandler: function(btn){\n\t\t\t\t\t\tgroupGrid.getStore().reload()\n\t\t\t\t\t\tExt.getCmp('content-panel' + idAppend).update('')\n\t\t\t\t\t\treviewsGrid.getStore().removeAll(true)\n\t\t\t\t\t\treviewsGrid.getView().refresh()\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\txtype: 'tbseparator'\n\t\t\t\t},\n\t\t\t\tgroupExportBtn,\n\t\t\t\t'->',\n\t\t\t\t{\n\t\t\t\t\txtype: 'tbtext',\n\t\t\t\t\tref: '../statSprites'\n\t\t\t\t},\n\t\t\t\t'-',\n\t\t\t\tnew SM.RowCountTextItem({store:groupStore, noun:'rule', iconCls: 'sm-stig-icon'})\n\t\t\t]\n\t\t})\n\t\t\n\t\tconst handleRevisionMenu = function (item, eventObject) {\n\t\t\tconst store = groupGrid.getStore()\n\t\t\tstore.proxy.setUrl(`${STIGMAN.Env.apiBase}/collections/${leaf.collectionId}/checklists/${leaf.benchmarkId}/${item.revisionStr}`, true)\n\t\t\tstore.load()\n\t\t\tloadRevisionMenu(leaf.benchmarkId, item.revisionStr, idAppend)\n\t\t\tgroupGrid.sm_revisionStr = item.revisionStr\n\t\t}\n\t\t\n\t\tasync function loadRevisionMenu(benchmarkId, activeRevisionStr, idAppend) {\n\t\t\ttry {\n\t\t\tconst revisions = await Ext.Ajax.requestPromise({\n\t\t\t\tresponseType: 'json',\n\t\t\t\turl: `${STIGMAN.Env.apiBase}/stigs/${benchmarkId}/revisions`,\n\t\t\t\tmethod: 'GET'\n\t\t\t})\n\t\t\tconst revisionObject = getRevisionObj(revisions, activeRevisionStr, idAppend)\n\t\t\tif (Ext.getCmp('revision-menuItem' + idAppend) === undefined) {\n\t\t\t\tExt.getCmp('groupChecklistMenu' + idAppend).addItem(revisionObject.menu)\n\t\t\t}\n\t\t\tgroupGrid.setTitle(SM.he(revisionObject.activeRevisionLabel))\n\t\t\t}\n\t\t\tcatch (e) {\n\t\t\t\tSM.Error.handleError(e)\n\t\t\t}\n\t\t}\n\t\t\n\t\tconst getRevisionObj = function (revisions, activeRevisionStr, idAppend) {\n\t\t\tconst returnObject = {}\n\t\t\tconst menu = {\n\t\t\tid: 'revision-menuItem' + idAppend,\n\t\t\ttext: 'Revisions',\n\t\t\thideOnClick: false,\n\t\t\tmenu: {\n\t\t\t\titems: []\n\t\t\t}\n\t\t\t}\n\t\t\tfor (let i = 0; i < revisions.length; i++) {\n\t\t\tconst r = revisions[i]\n\t\t\tconst benchmarkDateJs = new Date(r.benchmarkDate)\n\t\t\tconst item = {\n\t\t\t\tid: `revision-submenu${r.benchmarkId}-${r.version}-${r.release}${idAppend}`,\n\t\t\t\ttext: SM.he(`Version ${r.version} Release ${r.release} (${benchmarkDateJs.format('j M Y')})`),\n\t\t\t\t// revId: `${r.benchmarkId}-${r.version}-${r.release}`,\n\t\t\t\trevisionStr: r.revisionStr,\n\t\t\t\tgroup: 'revision-submenu-group' + idAppend,\n\t\t\t\thandler: handleRevisionMenu\n\t\t\t}\n\t\t\tif (item.revisionStr == activeRevisionStr || (activeRevisionStr === 'latest' && i === 0)) {\n\t\t\t\titem.checked = true\n\t\t\t\treturnObject.activeRevisionLabel = item.text\n\t\t\t} else {\n\t\t\t\titem.checked = false\n\t\t\t}\n\t\t\tmenu.menu.items.push(item)\n\t\t\t}\n\t\t\treturnObject.menu = menu\n\t\t\treturn returnObject\n\t\t}\n\t\t\t\n\t\tfunction filterGroupStore () {\n\t\t\tgroupStore.filter(groupGrid.getView().getFilterFns())\n\n\n\t\t}\n\t/******************************************************/\n\t// END Group Grid\n\t/******************************************************/\n\n\t/******************************************************/\n\t// START Reviews Panel\n\t/******************************************************/\n\t\tfunction getReviewsStatsString (store) {\n\t\t\tconst stats = store.data.items.reduce((a, c) => {\n\t\t\t\tswitch (c.data.result) {\n\t\t\t\t\tcase 'fail':\n\t\t\t\t\t\ta.fail++\n\t\t\t\t\t\tbreak\n\t\t\t\t\tcase 'pass':\n\t\t\t\t\t\ta.pass++\n\t\t\t\t\t\tbreak\n\t\t\t\t\tcase 'notapplicable':\n\t\t\t\t\t\ta.notapplicable++\n\t\t\t\t\t\tbreak\n\t\t\t\t\tdefault:\n\t\t\t\t\t\ta.other++\n\t\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t\tif (c.data.engineResult) a[c.data.engineResult]++\n\t\t\t\tif (c.data.status) a[c.data.status]++\n\t\t\t\treturn a\n\t\t\t}, {\n\t\t\t\tpass: 0,\n\t\t\t\tfail: 0,\n\t\t\t\tnotapplicable: 0,\n\t\t\t\tother: 0,\n\t\t\t\tsaved: 0,\n\t\t\t\tsubmitted: 0,\n\t\t\t\trejected: 0,\n\t\t\t\taccepted: 0,\n\t\t\t\toverride: 0,\n\t\t\t\tmanual: 0,\n\t\t\t\tengine: 0\n\t\t\t})\n\t\t\tconst spriteGroups = []\n\n\t\t\tspriteGroups.push(\n\t\t\t\t[\n\t\t\t\t\t`${stats.manual ? `<span class=\"sm-review-sprite sm-engine-manual-icon\" ext:qtip=\"Manual\">${stats.manual}</span>` : ''}`,\n\t\t\t\t\t`${stats.engine ? `<span class=\"sm-review-sprite sm-engine-result-icon\" ext:qtip=\"Result engine\">${stats.engine}</span>` : ''}`,\n\t\t\t\t\t`${stats.override ? `<span class=\"sm-review-sprite sm-engine-override-icon\" ext:qtip=\"Overriden result engine\">${stats.override}</span>` : ''}`\n\t\t\t\t].filter(Boolean).join(' '))\n\t\t\t\n\t\t\tspriteGroups.push(\n\t\t\t\t[\n\t\t\t\t\t`${stats.saved ? `<span class=\"sm-review-sprite sm-review-sprite-stat-saved\" ext:qtip=\"Saved\">${stats.saved}</span>` : ''}`,\n\t\t\t\t\t`${stats.submitted ? `<span class=\"sm-review-sprite sm-review-sprite-stat-submitted\" ext:qtip=\"Submitted\">${stats.submitted}</span>` : ''}`,\n\t\t\t\t\t`${stats.rejected ? `<span class=\"sm-review-sprite sm-review-sprite-stat-rejected\" ext:qtip=\"Rejected\"> ${stats.rejected}</span>` : ''}`,\n\t\t\t\t\t`${stats.accepted ? `<span class=\"sm-review-sprite sm-review-sprite-stat-accepted\" ext:qtip=\"Accepted\">${stats.accepted}</span>` : ''}`\n\t\t\t\t].filter(Boolean).join(' '))\n\n\t\t\tspriteGroups.push(\n\t\t\t\t[\n\t\t\t\t\t`${stats.fail ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Open\"><span class=\"sm-result-fail\" style=\"font-weight:bolder;\">O </span>${stats.fail}</span>` : ''}`,\n\t\t\t\t\t`${stats.pass ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Not a Finding\"><span class=\"sm-result-pass\" style=\"font-weight:bolder;\">NF </span>${stats.pass}</span>` : ''}`,\n\t\t\t\t\t`${stats.notapplicable ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Not Applicable\"><span class=\"sm-result-na\" style=\"font-weight:bolder;\">NA </span> ${stats.notapplicable}</span>` : ''}`,\n\t\t\t\t\t`${stats.other ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Not Reviewed or has a non-compliance result such as informational\"><span class=\"sm-result-nr\" style=\"font-weight:bolder;\">NR+ </span>${stats.other}</span>` : ''}`\n\t\t\t\t].filter(Boolean).join(' '))\n\n\t\t\treturn spriteGroups.filter(Boolean).join('<span class=\"sm-xtb-sep\"></span>')\n\n\t\t}\n\t\tfunction engineResultConverter (v,r) {\n\t\t\tconst conv = r.resultEngine ? \n\t\t\t\t(r.resultEngine.overrides?.length ? 'override' : 'engine') : \n\t\t\t\t(r.result ? 'manual' : '')\n\t\t\t\treturn conv\n\t\t}\n\n\t\tconst reviewsFields = Ext.data.Record.create([\n\t\t\t{\t\n\t\t\t\tname:'assetId',\n\t\t\t\ttype: 'string'\n\t\t\t},\n\t\t\t{\t\n\t\t\t\tname:'assetName',\n\t\t\t\ttype: 'string'\n\t\t\t},\n\t\t\t{\t\n\t\t\t\tname:'assetLabelIds'\n\t\t\t},\n\t\t\t{\n\t\t\t\tname:'ruleId',\n\t\t\t\ttype: 'string'\n\t\t\t},\n\t\t\t{\n\t\t\t\tname:'result',\n\t\t\t\ttype: 'string'\n\t\t\t},\n\t    'resultEngine',\n\t\t\t'touchTs',\n\t\t\t{\n\t\t\t\tname: 'engineResult',\n\t\t\t\tconvert: engineResultConverter\n\t\t\t},\n\t\t\t{\n\t\t\t\tname:'detail',\n\t\t\t\ttype:'string'\n\t\t\t},\n\t\t\t{\n\t\t\t\tname:'comment',\n\t\t\t\ttype:'string'\n\t\t\t},\n\t\t\t{\n\t\t\t\tname:'autoResult',\n\t\t\t\ttype:'boolean'\n\t\t\t},\n\t\t\t{\n\t\t\t\tname:'userId',\n\t\t\t\ttype:'string'\n\t\t\t},\n\t\t\t{\n\t\t\t\tname:'username',\n\t\t\t\ttype:'string'\n\t\t\t},\n\t\t\t'ts',\n\t\t\t{\n\t\t\t\tname:'status',\n\t\t\t\ttype:'string',\n\t\t\t\tmapping: 'status?.label'\n\t\t\t},\n\t\t\t'access'\n\t\t])\n\t\t\n\t\tconst reviewsStore = new Ext.data.JsonStore({\n\t\t\tstoreId: 'reviewsStore' + idAppend,\n\t\t\tsortInfo: {\n\t\t\t\tfield: 'assetName',\n\t\t\t\tdirection: 'ASC' // or 'DESC' (case sensitive for local sorting)\n\t\t\t},\n\n\t\t\troot: '',\n\t\t\tfields: reviewsFields,\n\t\t\tlisteners: {\n\t\t\t\tsave: function ( store, batch, data ) {\n\t\t\t\t\tsetReviewsGridButtonStates()\n\t\t\t\t\treviewsGrid?.statSprites?.setText(getReviewsStatsString(store))\n\t\t\t\t\tExt.getBody().unmask()\n\t\t\t\t},\n\t\t\t\tdatachanged: function (store) {\n\t\t\t\t\treviewsGrid?.statSprites?.setText(getReviewsStatsString(store))\n\t\t\t\t}\n\t\t\t},\n\t\t\tidProperty: 'assetId',\n\t\t\tgetSelectableCount: function () {\n\t\t\t\tlet count =  0\n\t\t\t\tfor (const item of this.data.items) {\n\t\t\t\t\tif (item.data.access === 'rw') {\n\t\t\t\t\t\tcount++\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn count\n\t\t\t}\n\t\t})\n\n\t\tfunction SetCheckboxSelModelHeaderState(sm) {\n\t\t\tconst hd = sm.grid.view.innerHd.querySelector('.x-grid3-hd-inner.x-grid3-hd-checker')\n\t\t\tif (hd) {\n\t\t\t\tconst hdState = sm.selections.length === 0 ? null : sm.grid.store.getSelectableCount() === sm.selections.length ? 'on' : 'ind'\n\t\t\t\thd.classList.remove('x-grid3-hd-checker-on')\n\t\t\t\thd.classList.remove('x-grid3-hd-checker-ind')\n\t\t\t\tif (hdState) {\n\t\t\t\t\t\thd.classList.add(`x-grid3-hd-checker-${hdState}`)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tconst sm = new Ext.grid.CheckboxSelectionModel ({\n\t\t\tsingleSelect: false,\n\t\t\tcheckOnly: false,\n\t\t\trenderer: function (v, p, record) {\n\t\t\t\treturn `<div class=${record.data.access === 'r' ? '\"sm-row-readonly-icon\" ext:qtip=\"Read only\"' : '\"x-grid3-row-checker\"'}>&#160;</div>`\n\t\t\t},\n\t\t\t// override selectRow to suspend events when clearing existing selections > 1\n\t\t\tselectRow: function (index, keepExisting, preventViewNotify) {\n\t\t\t\tif (this.isLocked() || (index < 0 || index >= this.grid.store.getCount()) || (keepExisting && this.isSelected(index))) {\n\t\t\t\t\treturn\n\t\t\t\t}\n\t\t\t\tconst r = this.grid.store.getAt(index)\n\t\t\t\t\n\t\t\t\tif (r && this.fireEvent('beforerowselect', this, index, keepExisting, r) !== false) {\n\t\t\t\t\tif (r.data.access === 'r') return\n\t\t\t\t\tif (!keepExisting || this.singleSelect) {\n\t\t\t\t\t\tif (this.selections.length > 1) {\n\t\t\t\t\t\t\tthis.suspendEvents(false)\n\t\t\t\t\t\t\tthis.clearSelections()\n\t\t\t\t\t\t\tthis.resumeEvents()\n\t\t\t\t\t\t}\n\t\t\t\t\t\telse {\n\t\t\t\t\t\t\tthis.clearSelections()\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tthis.selections.add(r)\n\t\t\t\t\tthis.last = this.lastActive = index\n\t\t\t\t\tif (!preventViewNotify) {\n\t\t\t\t\t\tthis.grid.getView().onRowSelect(index)\n\t\t\t\t\t}\n\t\t\t\t\tif (!this.silent) {\n\t\t\t\t\t\tthis.fireEvent('rowselect', this, index, r)\n\t\t\t\t\t\tthis.fireEvent('selectionchange', this)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t},\n\t\t\t// override our override to set header state based on selectable record count\n\t\t\tonMouseDown : function(e, t){\n        if(e.button === 0 && t.className == 'x-grid3-row-checker'){ // Only fire if left-click\n            e.stopEvent();\n            var row = e.getTarget('.x-grid3-row');\n            if(row){\n                var index = row.rowIndex;\n                if(this.isSelected(index)){\n                    this.deselectRow(index);\n                }else{\n                    this.selectRow(index, true);\n                    this.grid.getView().focusRow(index);\n                }\n            }\n            const hd = this.grid.view.innerHd.querySelector('.x-grid3-hd-row .x-grid3-td-checker .x-grid3-hd-checker')\n\n            if (hd) {\n                const hdState = this.selections.length === 0 ? null : this.grid.store.getSelectableCount() === this.selections.length ? 'on' : 'ind'\n                hd.classList.remove('x-grid3-hd-checker-on')\n                hd.classList.remove('x-grid3-hd-checker-ind')\n                if (hdState) {\n                    hd.classList.add(`x-grid3-hd-checker-${hdState}`)\n                }\n            }\n        }\n    \t},\n\t\t\tlisteners: {\n\t\t\t\tbeforerowselect: function (sm, rowIndex, keepExisting, record) {\n\t\t\t\t\treturn record.data.access === 'rw'\n\t\t\t\t},\n\t\t\t\tselectionchange: function (sm) {\n\t\t\t\t\tif (sm.getCount() <= 1) { // single or no row selected\n\t\t\t\t\t\tbatchEditBtn.disable()\n\t\t\t\t\t} else {\n\t\t\t\t\t\tbatchEditBtn.enable()\n\n\t\t\t\t\t}\n\t\t\t\t\tsetReviewsGridButtonStates()\n\t\t\t\t\tSetCheckboxSelModelHeaderState(sm)\n\t\t\t\t}\n\t\t\t}\n\t\t})\n\t\t\n\t\tconst reviewsCm = new Ext.grid.ColumnModel({\n\t\t\tcolumns: [\n\t\t\t\tsm,\n\t      {\n\t\t\t\t\theader: '<div exportvalue=\"Engine\" class=\"sm-engine-result-icon\"></div>',\n\t\t\t\t\twidth: 24,\n\t\t\t\t\tfixed: true,\n\t\t\t\t\tdataIndex: 'engineResult',\n\t\t\t\t\tsortable: true,\n\t\t\t\t\trenderer: renderEngineResult,\n\t\t\t\t\tfilter: {\n\t\t\t\t\t\ttype: 'values',\n\t\t\t\t\t\trenderer: SM.ColumnFilters.Renderers.engineResult\n\t\t\t\t\t} \n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'status' + idAppend,\n\t\t\t\t\theader: \"Status\", \n\t\t\t\t\talign: 'center',\n\t\t\t\t\twidth: 50,\n\t\t\t\t\tfixed: true,\n\t\t\t\t\tdataIndex: 'status',\n\t\t\t\t\tsortable: true,\n\t\t\t\t\trenderer: renderStatuses,\n\t\t\t\t\tfilter: {\n\t\t\t\t\t\ttype: 'values',\n\t\t\t\t\t\trenderer: SM.ColumnFilters.Renderers.status\n\t\t\t\t\t} \n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'target' + idAppend,\n\t\t\t\t\theader: \"Asset\",\n\t\t\t\t\twidth: 50,\n\t\t\t\t\t//fixed: true,\n\t\t\t\t\tdataIndex: 'assetName',\n\t\t\t\t\tsortable: true,\n\t\t\t\t\talign: 'left',\n\t\t\t\t\tfilter: {\n\t\t\t\t\t\ttype: 'string'\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\theader: \"Labels\",\n\t\t\t\t\twidth: 50,\n\t\t\t\t\tdataIndex: 'assetLabelIds',\n\t\t\t\t\tsortable: false,\n\t\t\t\t\tfilter: {\n\t\t\t\t\t\t\ttype: 'multi-value', \n\t\t\t\t\t\t\tcollectionId: apiCollection.collectionId,\n\t\t\t\t\t\t\tcomparer: function (a, b) {\n\t\t\t\t\t\t\t\treturn SM.ColumnFilters.CompareFns.labelIds(a, b, apiCollection.collectionId)\n\t\t\t\t\t\t\t\t},  \n\t\t\t\t\t\t\trenderer: SM.ColumnFilters.Renderers.labels\n\t\t\t\t\t},\n\t\t\t\t\trenderer: function (value, metadata) {\n\t\t\t\t\t\t\tconst labels = []\n\t\t\t\t\t\t\tfor (const labelId of value) {\n\t\t\t\t\t\t\t\tconst label = SM.Cache.getCollectionLabel(apiCollection.collectionId, labelId)\n\t\t\t\t\t\t\t\tif (label) labels.push(label)\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tlabels.sort((a,b) => a.name.localeCompare(b.name))\n\t\t\t\t\t\t\tmetadata.attr = 'style=\"white-space:nowrap;text-overflow:clip;\"'\n\t\t\t\t\t\t\treturn SM.Manage.Collection.LabelArrayTpl.apply(labels)\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t\t{ \n\t\t\t\t\tid:'Result' + idAppend,\n\t\t\t\t\theader: '<span exportvalue=\"Result\">Result<i class= \"fa fa-question-circle sm-question-circle\"></i></span>',\n\t\t\t\t\twidth: 70,\n\t\t\t\t\tfixed: true,\n\t\t\t\t\tdataIndex: 'result',\n\t\t\t\t\teditor: new Ext.form.ComboBox({\n\t\t\t\t\t\tid: 'reviewsGrid-editor-resultCombo' + idAppend,\n\t\t\t\t\t\tmode: 'local',\n\t\t\t\t\t\tforceSelection: true,\n\t\t\t\t\t\tautoSelect: true,\n\t\t\t\t\t\teditable: false,\n\t\t\t\t\t\tstore: new Ext.data.SimpleStore({\n\t\t\t\t\t\t\tfields: ['result', 'resultStr'],\n\t\t\t\t\t\t\tdata: [\n\t\t\t\t\t\t\t\t['pass', 'NF'],\n\t\t\t\t\t\t\t\t['notapplicable', 'NA'],\n\t\t\t\t\t\t\t\t['fail', 'O'],\n\t\t\t\t\t\t\t\t['informational', 'I'],\n\t\t\t\t\t\t\t\t['notchecked', 'NR']\n\t\t\t\t\t\t\t]\n\t\t\t\t\t\t}),\n\t\t\t\t\t\tvalueField:'result',\n\t\t\t\t\t\tdisplayField:'resultStr',\n\t\t\t\t\t\tmonitorValid: false,\n\t\t\t\t\t\tlisteners: {\n\t\t\t\t\t\t\tselect: function (combo,record,index) {\n\t\t\t\t\t\t\t\tif (combo.startValue !== combo.value ) {\n\t\t\t\t\t\t\t\t\tcombo.fireEvent(\"blur\")\n\t\t\t\t\t\t\t\t} \n\t\t\t\t\t\t\t\telse {\n\t\t\t\t\t\t\t\t\tconsole.log('No Change')\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t},\n\t\t\t\t\t\ttriggerAction: 'all'\n\t\t\t\t\t}),\n\t\t\t\t\trenderer: renderResult,\n\t\t\t\t\tsortable: true,\n\t\t\t\t\tfilter: {\n\t\t\t\t\t\ttype: 'values',\n\t\t\t\t\t\trenderer: SM.ColumnFilters.Renderers.result\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'Detail' + idAppend,\n\t\t\t\t\theader: '<span exportvalue=\"Detail\">Detail<i class= \"fa fa-question-circle sm-question-circle\"></i></span>', \n\t\t\t\t\twidth: 100,\n\t\t\t\t\tdataIndex: 'detail',\n\t\t\t\t\trenderer: function (v) {\n\t\t\t\t\t\tv = v?.length > SM.TruncateLimit ? v.slice(0,SM.TruncateLimit) + '...' : SM.styledEmptyRenderer(v)\n\t\t\t\t\t\treturn v\n\t\t\t\t\t},\n\t\t\t\t\tsortable: true,\n\t\t\t\t\tfilter: {\n\t\t\t\t\t\ttype: 'string'\n\t\t\t\t\t},\n\t\t\t\t\teditor: new Ext.form.TextArea({\n\t\t\t\t\t\tid: 'reviewsGrid-editor-detail' + idAppend,\n\t\t\t\t\t\t//height: 150\n\t\t\t\t\t\tgrow: true,\n\t\t\t\t\t\tgrowMax: 200,\n\t\t\t\t\t\tlisteners: {\n\t\t\t\t\t\t\t// focus and blur handlers enable/disable IE workaround\n\t\t\t\t\t\t\tfocus: function (cmp) {\n\t\t\t\t\t\t\t\treviewsGrid.getEl().set({\n\t\t\t\t\t\t\t\t\tonselectstart: 'return true;'\n\t\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tblur: function (cmp) {\n\t\t\t\t\t\t\t\treviewsGrid.getEl().set({\n\t\t\t\t\t\t\t\t\tonselectstart: 'return false;'\n\t\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\trender: function (ta) {\n\t\t\t\t\t\t\t\tta.el.dom.maxLength = 32767\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t})\n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'Comment' + idAppend,\n\t\t\t\t\theader: '<span exportvalue=\"Comment\">Comment<i class= \"fa fa-question-circle sm-question-circle\"></i></span>', \n\t\t\t\t\twidth: 100,\n\t\t\t\t\tdataIndex: 'comment',\n\t\t\t\t\trenderer: function (v) {\n\t\t\t\t\t\tv = v?.length > SM.TruncateLimit ? v.slice(0,SM.TruncateLimit) + '...' : SM.styledEmptyRenderer(v)\n\t\t\t\t\t\treturn v\n\t\t\t\t\t},\n\t\t\t\t\tfilter: {\n\t\t\t\t\t\ttype: 'string'\n\t\t\t\t\t},\n\t\t\t\t\teditor: new Ext.form.TextArea({\n\t\t\t\t\t\tid: 'reviewsGrid-editor-comment' + idAppend,\n\t\t\t\t\t\tgrow: true,\n\t\t\t\t\t\tgrowMax: 200,\n\t\t\t\t\t\tlisteners: {\n\t\t\t\t\t\t\t// focus and blur handlers enable/disable IE workaround\n\t\t\t\t\t\t\tfocus: function (cmp) {\n\t\t\t\t\t\t\t\treviewsGrid.getEl().set({\n\t\t\t\t\t\t\t\t\tonselectstart: 'return true;'\n\t\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tblur: function (cmp) {\n\t\t\t\t\t\t\t\treviewsGrid.getEl().set({\n\t\t\t\t\t\t\t\t\tonselectstart: 'return false;'\n\t\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\trender: function (ta) {\n\t\t\t\t\t\t\t\tta.el.dom.maxLength = 32767\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}),\n\t\t\t\t\tsortable: true\n\t\t\t\t},\n\t\t\t\t{ \t\n\t\t\t\t\tid:'userName' + idAppend,\n\t\t\t\t\theader: \"User\", \n\t\t\t\t\twidth: 100,\n\t\t\t\t\tdataIndex: 'username',\n\t\t\t\t\tfixed: 50,\n\t\t\t\t\tsortable: true,\n\t\t\t\t\tfilter: {\n\t\t\t\t\t\ttype: 'values'\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tid: 'touchTs' + idAppend,\n\t\t\t\t\theader: '<div exportvalue=\"touchTs\" class=\"sm-history-icon\" ext:qtip=\"Last action\"></div>',\n\t\t\t\t\tfixed: true,\n\t\t\t\t\twidth: 48,\n\t\t\t\t\talign: 'center',\n\t\t\t\t\tdataIndex: 'touchTs',\n\t\t\t\t\tsortable: true,\n\t\t\t\t\trenderer: renderDurationToNow\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\theader: '',\n\t\t\t\t\twidth: 50,\n\t\t\t\t\tfixed: true,\n\t\t\t\t\tsortable: false,\n\t\t\t\t\trenderer: function (v, m, r) {\n\t\t\t\t\t\treturn r.data.ts ? \n\t\t\t\t\t\t`<div class=\"sm-grid-cell-with-toolbar-2\">\n\t\t\t\t\t\t\t\t<div class=\"sm-dynamic-width\">\n\t\t\t\t\t\t\t\t\t<div class=\"sm-info\">         \n\t\t\t\t\t\t\t\t\t\t&nbsp;\n\t\t\t\t\t\t\t\t\t</div>\n\t\t\t\t\t\t\t\t</div>\n\t\t\t\t\t\t\t\t<div class=\"sm-static-width\">\n\t\t\t\t\t\t\t\t\t<span class=\"sm-grid-cell-tool\" style=\"padding-right:4px\"><img data-action=\"showHistory\" ext:qtip=\"History\" src=\"img/clock.svg\" width=\"14\" height=\"14\"></span>                \n\t\t\t\t\t\t\t\t\t<span class=\"sm-grid-cell-tool\" style=\"padding-right:4px\"><img data-action=\"showAttachments\" ext:qtip=\"Attachments\" src=\"img/attachment.svg\" width=\"14\" height=\"14\"></span>                \n\t\t\t\t\t\t\t\t</div>\n\t\t\t\t\t\t\t</div>` : ''\n\t\t\t\t\t},\n\t\t\t\t\tlisteners: {\n\t\t\t\t\t\tmousedown: function (col, grid, index, e) {\n\t\t\t\t\t\t\tif (e.target.dataset?.action) {\n\t\t\t\t\t\t\t\treturn false\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t],\n\t\t\tisCellEditable: function(col, row) {\n\t\t\t\tconst record = reviewsStore.getAt(row)\n\n\t\t\t\tif (!record.data.result  && this.getDataIndex(col) !== 'result') { // review is not created yet\n\t\t\t\t\treturn false\n\t\t\t\t}\n\n\t\t\t\tswitch (this.getDataIndex(col)) {\n\t\t\t\t\tcase 'result':\n\t\t\t\t\t\treturn true\n\t\t\t\t\tcase 'detail':\n\t\t\t\t\t\tif (apiFieldSettings.detail.enabled === 'always') {\n\t\t\t\t\t\t\treturn true\n\t\t\t\t\t\t}\n\t\t\t\t\t\tif (apiFieldSettings.detail.enabled === 'findings') {\n\t\t\t\t\t\t\treturn record.data.result === 'fail'\n\t\t\t\t\t\t}\n\t\t\t\t\t\tbreak\n\t\t\t\t\tcase 'comment':\n\t\t\t\t\t\tif (apiFieldSettings.comment.enabled === 'always') {\n\t\t\t\t\t\t\treturn true\n\t\t\t\t\t\t}\n\t\t\t\t\t\tif (apiFieldSettings.comment.enabled === 'findings') {\n\t\t\t\t\t\t\treturn record.data.result === 'fail'\n\t\t\t\t\t\t}\n\t\t\t\t\t\tbreak\n\t\t\t\t}\n\n\t\t\t\treturn Ext.grid.ColumnModel.prototype.isCellEditable.call(this, col, row)\n\t\t\t}\n\t\t})\n\n\t\tconst toolHandlers = {\n      showHistory,\n      showAttachments\n    }\n\n\t\tasync function getHistory({collectionId, assetId, ruleId}) {\n\t\t\ttry {\n\t\t\t\tconst result = await Ext.Ajax.requestPromise({\n\t\t\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${collectionId}/reviews/${assetId}/${ruleId}`,\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\tparams: {\n\t\t\t\t\t\tprojection: ['history']\n\t\t\t\t\t}\n\t\t\t\t})\n\t\t\t\tif (result.response.status === 200) {\n\t\t\t\t\tconst apiReview = JSON.parse(result.response.responseText)\n\t\t\t\t\t//TODO: Set the history (does not set history on handleGroupSelectionForCollection)\n\t\t\t\t\t//append the current state of the review to history\n\t\t\t\t\tconst currentReview = {\n\t\t\t\t\t\truleId: apiReview.ruleId,\n\t\t\t\t\t\tcomment: apiReview.comment,\n\t\t\t\t\t\tresultEngine: apiReview.resultEngine,\n\t\t\t\t\t\tautoResult: apiReview.autoResult,\n\t\t\t\t\t\trejectText: apiReview.rejectText,\n\t\t\t\t\t\tresult: apiReview.result,\n\t\t\t\t\t\tdetail: apiReview.detail,\n\t\t\t\t\t\tstatus: apiReview.status,\n\t\t\t\t\t\tts: apiReview.ts,\n\t\t\t\t\t\ttouchTs: apiReview.touchTs,\n\t\t\t\t\t\tuserId: apiReview.userId,\n\t\t\t\t\t\tusername: apiReview.username\n\t\t\t\t\t}\n\t\t\t\t\tapiReview.history.push(currentReview)\n\t\t\t\t\treturn apiReview.history\n\t\t\t\t}\n\t\t\t}\n\t\t\tcatch (e){\n\t\t\t\tSM.Error.handleError(e)\n\t\t\t}\n\t\t}\n\n\t\tasync function showHistory(data, record) {\n\t\t\ttry {\n\t\t\t\tconst historyGrid = new Sm_HistoryData().grid\n\t\t\t\thistoryGrid.getStore().loadData(await getHistory({collectionId: leaf.collectionId, assetId: data.assetId, ruleId: data.ruleId}))\n\t\t\t\tconst appwindow = new Ext.Window({\n\t\t\t\t\ttitle: 'Review History',\n\t\t\t\t\tlayout: 'fit',\n\t\t\t\t\twidth: 600,\n\t\t\t\t\theight: 600,\n\t\t\t\t\tmodal: true,\n\t\t\t\t\tpadding: 20,\n\t\t\t\t\tcloseAction: 'destroy',\n\t\t\t\t\titems: historyGrid\n\t\t\t\t})\n\t\t\t\tappwindow.show()\n\t\t\t}\n\t\t\tcatch (e){\n\t\t\t\tSM.Error.handleError(e)\n\t\t\t}\n\t\t}\n\n\t\tfunction showAttachments(data, record) {\n\t\t\tconst attachmentsGrid = new SM.Attachments.Grid({\n\t\t\t\tcollectionId: leaf.collectionId,\n\t\t\t\tassetId: data.assetId,\n\t\t\t\truleId: data.ruleId,\n\t\t\t\tborder: true\n\t\t\t})\n\t\t\tattachmentsGrid.fileUploadField.setDisabled(data.access !== 'rw')\n\t\t\tconst appwindow = new Ext.Window({\n\t\t\t\ttitle: 'Attachments',\n\t\t\t\tlayout: 'fit',\n\t\t\t\twidth: 600,\n\t\t\t\theight: 600,\n\t\t\t\tmodal: true,\n\t\t\t\tpadding: 20,\n\t\t\t\tcloseAction: 'destroy',\n\t\t\t\titems: attachmentsGrid\n\t\t\t})\n\t\t\tappwindow.show()\n\t\t\tattachmentsGrid.loadArtifacts()\n\t\t}\n\n    function cellclick(grid, rowIndex, columnIndex, e) {\n      if (e.target.tagName === \"IMG\" && e.target.dataset?.action) {\n\t\t\t\te.stopEvent()\n        const record = grid.getStore().getAt(rowIndex)\n        toolHandlers[e.target.dataset.action](record.data, record)\n      }\n    }\n\n\t\tfunction showAcceptBtn () {\n\t\t\tconst collectionGrant = curUser.collectionGrants.find(i => i.collection.collectionId === leaf.collectionId).roleId\n\t\t\tconst grantCondition =  collectionGrant >= apiStatusSettings.minAcceptGrant\n\t\t\tconst settingsCondition = apiStatusSettings.canAccept\n\t\t\treturn grantCondition && settingsCondition \n\t\t}\n\n\t\tconst reviewsExportBtn = new Ext.ux.ExportButton({\n\t\t\thasMenu: false,\n\t\t\texportType: 'grid',\n\t\t\tgridBasename: `${leaf.benchmarkId}-Rule`,\n\t\t\ticonCls: 'sm-export-icon',\n\t\t\ttext: 'CSV'\n\t\t})\n\n\t\tconst batchEditBtn = new Ext.Button({\n\t\t\tdisabled: true,\n\t\t\ticonCls: 'icon-edit',\n\t\t\tid: 'reviewsGrid-batchButton' + idAppend,\n\t\t\ttext: 'Batch edit',\n\t\t\thandler: function (btn) {\n\t\t\t\thandleBatchEdit(btn.findParentByType('grid'))\n\t\t\t}\n\t\t})\n\n\t\tconst lineIncrementBtn = new Ext.Button({\n\t\t\ticonCls: 'sm-line-height-up',\n\t\t\ttooltip: 'Increase row height',\n\t\t\thandler: function (btn) {\n\t\t\t\tconst newLineClamp = reviewsGrid.view.lineClamp + 1\n\t\t\t\tconst newRowHeight = (15*newLineClamp)+6\n\t\t\t\treviewsGrid.view.changeRowHeight(newRowHeight, newLineClamp)\n\t\t\t\tlineDecrementBtn.setDisabled(newLineClamp <= 1)\n\t\t\t\tbtn.setDisabled(newLineClamp >= 10)\n\t\t\t}\n\t\t})\n\t\tconst lineDecrementBtn = new Ext.Button({\n\t\t\ticonCls: 'sm-line-height-down',\n\t\t\ttooltip: 'Decrease row height',\n\t\t\thandler: function (btn) {\n\t\t\t\tconst newLineClamp = reviewsGrid.view.lineClamp - 1\n\t\t\t\tconst newRowHeight = (15*newLineClamp)+6\n\t\t\t\treviewsGrid.view.changeRowHeight(newRowHeight, newLineClamp)\n\t\t\t\tbtn.setDisabled(newLineClamp <= 1)\n\t\t\t\tlineIncrementBtn.setDisabled(newLineClamp >= 10)\n\t\t\t}\n\t\t})\n\n\t\tconst reviewsGrid = new Ext.grid.EditorGridPanel({\n\t\t\tcls: 'sm-round-panel',\n\t\t\ttrackMouseOver: true,\n\t\t\tmargins: { top: SM.Margin.adjacent, right: SM.Margin.adjacent, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n\t\t\tborder: false,\n\t\t\tregion: 'center',\n\t\t\tlayout: 'fit',\n\t\t\tid: 'reviewsGrid' + idAppend,\n\t\t\ttitle: 'Reviews',\n\t\t\tstore: reviewsStore,\n\t\t\tstripeRows:true,\n\t\t\tcolModel: reviewsCm,\n\t\t\tupdateGroupStore: function (reviewsGrid) {\n\t\t\t\tconst reviewRecords = reviewsGrid.getStore().getRange()\n\t\t\t\tconst checklistRecord = reviewsGrid.currentChecklistRecord\n\t\t\t\tconst counts = {\n\t\t\t\t\toCnt: 0,\n\t\t\t\t\tnfCnt: 0,\n\t\t\t\t\tnaCnt: 0,\n\t\t\t\t\totherCnt: 0,\n\t\t\t\t\tapproveCnt: 0,\n\t\t\t\t\trejectCnt: 0,\n\t\t\t\t\treadyCnt: 0\n\t\t\t\t}\n\t\t\t\tfor (const record of reviewRecords) {\n\t\t\t\t\tswitch (record.data.result) {\n\t\t\t\t\t\tcase 'pass':\n\t\t\t\t\t\t\tcounts.nfCnt++\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t\tcase 'fail':\n\t\t\t\t\t\t\tcounts.oCnt++\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t\tcase 'notapplicable':\n\t\t\t\t\t\t\tcounts.naCnt++\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t\tdefault:\n\t\t\t\t\t\t\tcounts.otherCnt++\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t}\n\t\t\t\t\tswitch (record.data.status) {\n\t\t\t\t\t\tcase 'submitted':\n\t\t\t\t\t\t\tcounts.readyCnt++\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t\tcase 'accepted':\n\t\t\t\t\t\t\tcounts.approveCnt++\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t\tcase 'rejected':\n\t\t\t\t\t\t\tcounts.rejectCnt++\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tfor (const key of Object.keys(counts)) {\n\t\t\t\t\tchecklistRecord.data[key] = counts[key]\n\t\t\t\t}\n\t\t\t\tchecklistRecord.commit()\t\t\t\t\n\t\t\t},\n\t\t\tsm,\n\t\t\tlisteners: {\n\t\t\t\t// fix weird problem shift-selecting grid rows in IE\n\t\t\t\t// have to override this if the textarea editors are focused\n\t\t\t\tafterrender: function (cmp) {\n\t\t\t\t\tcmp.getEl().set({\n\t\t\t\t\t\tonselectstart: 'return false;'\n\t\t\t\t\t})\n\t\t\t\t},\n\t\t\t\tafteredit: async function (e) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tlet jsonData = {}\n\t\t\t\t\t\tlet apiReview\n\t\t\t\t\t\tif (e.record.data.status) {\n\t\t\t\t\t\t\tjsonData[e.field] = e.value\n\t\t\t\t\t\t\t// unset autoResult if the result has changed\n\t\t\t\t\t\t\tif (e.field === 'result' && e.originalValue !== e.value) {\n\t\t\t\t\t\t\t\tif (e.record.data.resultEngine) {\n\t\t\t\t\t\t\t\t\tjsonData.resultEngine = null\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tif (e.record.data.autoResult) {\n\t\t\t\t\t\t\t\t\tjsonData.autoResult = false\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tapiReview = await Ext.Ajax.requestPromise({\n\t\t\t\t\t\t\t\tresponseType: 'json',\n\t\t\t\t\t\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${leaf.collectionId}/reviews/${e.record.data.assetId}/${e.grid.currentRuleId}`,\n\t\t\t\t\t\t\t\tmethod: 'PATCH',\n\t\t\t\t\t\t\t\tjsonData\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t}\n\t\t\t\t\t\telse {\n\t\t\t\t\t\t\t// new review\n\t\t\t\t\t\t\tjsonData = {\n\t\t\t\t\t\t\t\tresult: e.record.data.result,\n\t\t\t\t\t\t\t\tdetail: null,\n\t\t\t\t\t\t\t\tcomment: null,\n\t\t\t\t\t\t\t\tautoResult: false,\n\t\t\t\t\t\t\t\tstatus: 'saved'\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tapiReview = await Ext.Ajax.requestPromise({\n\t\t\t\t\t\t\t\tresponseType: 'json',\n\t\t\t\t\t\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${leaf.collectionId}/reviews/${e.record.data.assetId}/${e.grid.currentRuleId}`,\n\t\t\t\t\t\t\t\tmethod: 'PUT',\n\t\t\t\t\t\t\t\tjsonData\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// e.grid.getStore().loadData(apiReview, true)\n\t\t\t\t\t\tconst f = e.grid.store.reader.recordType.prototype.fields\n\t\t\t\t\t\tconst fi = f.items\n\t\t\t\t\t\tconst fl = f.length\n\t\t\t\t\t\tconst newData = e.grid.store.reader.extractValues(apiReview, fi, fl)\n\t\t\t\t\t\te.record.data = newData\n\t\t\t\t\t\te.record.commit()\n\n\t\t\t\t\t\t// hack to reselect the record for setReviewsGridButtonStates()\n\t\t\t\t\t\te.grid.getSelectionModel().onRefresh()\n\n\t\t\t\t\t\tsetReviewsGridButtonStates()\n\t\t\n\t\t\t\t\t\te.grid.updateGroupStore(e.grid)\n\t\n\t\t\t\t\t}\n\t\t\t\t\tcatch(e) {\n\t\t\t\t\t\tSM.Error.handleError(e)\n\t\t\t\t\t}\n\n\n\t\t\t\t},\n\t\t\t\tkeydown: SM.CtrlAGridHandler,\n\t\t\t\tcellclick\n\t\t\t},\n\t\t\tview: new SM.ColumnFilters.GridViewBuffered({\n\t\t\t\tforceFit:true,\n        cellSelectorDepth: 0,\n\t\t\t\tholdPosition: true,\n\t\t\t\tautoFill:true,\n\t\t\t\temptyText: 'No data to display.',\n\t\t\t\tdeferEmptyText:false,\n\t\t\t\t// custom row height\n\t\t\t\trowHeight: (15*3)+6,\n\t\t\t\tlineClamp: 3,\n\t\t\t\tborderHeight: 2,\n\t\t\t\t// render rows as they come into viewable area.\n\t\t\t\tscrollDelay: false,\n\t\t\t\tlisteners: {\n\t\t\t\t\tfilterschanged: function (view, item, value) {\n\t\t\t\t\t\treviewsStore.filter(view.getFilterFns())  \n\t\t\t\t\t},\n\t\t\t\t\trefresh: function (view) {\n\t\t\t\t\t\t// Setup the tooltips\n\t\t\t\t\t\tconst columns = view.grid.getColumnModel().columns\n\t\t\t\t\t\tfor( let x = 0; x < columns.length; x++ ) {\n\t\t\t\t\t\t\t// Look for colums with the FontAwesome class\n\t\t\t\t\t\t\tconst tipEl = view.getHeaderCell(x).getElementsByClassName('fa')[0]\n\t\t\t\t\t\t\tif ( tipEl ) {\n\t\t\t\t\t\t\t\tconst idPrefix = columns[x].id.split('-')[0]\n\t\t\t\t\t\t\t\t// idPrefix should be 'result', 'detail', or 'comment'\n\t\t\t\t\t\t\t\tnew Ext.ToolTip({\n\t\t\t\t\t\t\t\t\ttarget: tipEl,\n\t\t\t\t\t\t\t\t\tshowDelay: 0,\n\t\t\t\t\t\t\t\t\tdismissDelay: 0,\n\t\t\t\t\t\t\t\t\tautoWidth: true,\n\t\t\t\t\t\t\t\t\ttpl: SM[`${idPrefix}TipTpl`],\n\t\t\t\t\t\t\t\t\tdata: apiFieldSettings[idPrefix.toLowerCase()] ?? {}\n\t\t\t\t\t\t\t\t}) \n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\t\t\t\t\t\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t\t// getRowClass: function (record) {\n\t\t\t\t// \treturn record.data.access === 'r' ? 'sm-row-read' : ''\n\t\t\t\t// }\n\t\t\t}),\n\t\t\t// width: 300,\n\t\t\ttbar: new Ext.Toolbar({\n\t\t\t\titems: [\n\t\t\t\t\t{\n\t\t\t\t\t\txtype: 'tbbutton',\n\t\t\t\t\t\tdisabled: true,\n\t\t\t\t\t\ticonCls: 'sm-star-icon-16',\n\t\t\t\t\t\tid: 'reviewsGrid-approveButton' + idAppend,\n\t\t\t\t\t\ttext: 'Accept',\n\t\t\t\t\t\thidden: !showAcceptBtn(),\n\t\t\t\t\t\thandler: function (btn) {\n\t\t\t\t\t\t\tconst selModel = reviewsGrid.getSelectionModel()\n\t\t\t\t\t\t\thandleStatusChange (reviewsGrid,selModel,'accepted')\n\t\t\t\t\t\t}\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\txtype: 'tbspacer', \n\t\t\t\t\t\twidth: 10\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\txtype: 'tbbutton',\n\t\t\t\t\t\tdisabled: true,\n\t\t\t\t\t\ticonCls: 'sm-rejected-icon',\n\t\t\t\t\t\tid: 'reviewsGrid-rejectButton' + idAppend,\n\t\t\t\t\t\ttext: 'Reject...',\n\t\t\t\t\t\thidden: !showAcceptBtn(),\n\t\t\t\t\t\thandler: function (btn) {\n\t\t\t\t\t\t\tconst selModel = reviewsGrid.getSelectionModel()\n\t\t\t\t\t\t\thandleStatusChange (reviewsGrid,selModel,'rejected')\n\t\t\t\t\t\t}\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\txtype: 'tbseparator',\n\t\t\t\t\t\thidden: !showAcceptBtn()\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\txtype: 'tbbutton',\n\t\t\t\t\t\tdisabled: true,\n\t\t\t\t\t\ticon: 'img/ready-16.png',\n\t\t\t\t\t\tid: 'reviewsGrid-submitButton' + idAppend,\n\t\t\t\t\t\ttext: 'Submit',\n\t\t\t\t\t\thandler: function (btn) {\n\t\t\t\t\t\t\tconst selModel = reviewsGrid.getSelectionModel()\n\t\t\t\t\t\t\thandleStatusChange (reviewsGrid,selModel,'submitted')\n\t\t\t\t\t\t}\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\txtype: 'tbspacer', \n\t\t\t\t\t\twidth: 10\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\txtype: 'tbbutton',\n\t\t\t\t\t\tdisabled: true,\n\t\t\t\t\t\ticonCls: 'sm-disk-icon',\n\t\t\t\t\t\tid: 'reviewsGrid-unsubmitButton' + idAppend,\n\t\t\t\t\t\ttext: 'Unsubmit',\n\t\t\t\t\t\thandler: function (btn) {\n\t\t\t\t\t\t\tconst selModel = reviewsGrid.getSelectionModel()\n\t\t\t\t\t\t\thandleStatusChange (reviewsGrid,selModel,'saved')\n\t\t\t\t\t\t}\n\t\t\t\t\t},\n\t\t\t\t\t'-',\n\t\t\t\t\tbatchEditBtn,\n\t\t\t\t\t'->',\n\t\t\t\t\tlineDecrementBtn,\n\t\t\t\t\t{xtype: 'tbspacer', width: 10},\n\t\t\t\t\tlineIncrementBtn\n\t\t\t\t]\n\t\t\t}),\n\t\t\tbbar: [\n\t\t\t\treviewsExportBtn,\n\t\t\t\t'->',\n\t\t\t\t{\n\t\t\t\t\txtype: 'tbtext',\n\t\t\t\t\tref: '../statSprites'\n\t\t\t\t},\n\t\t\t\t'-',\n\t\t\t\tnew SM.RowCountTextItem({store:reviewsStore, noun:'review', iconCls:'sm-assessment-icon'})\n\t\t\t],\n\t\t\temptyText: 'No data to display'\n\t\t})\n\n\t\treviewsGrid.on('beforeedit', beforeEdit, this )\n\n\t\tfunction onFieldSettingsChanged (collectionId, fieldSettings) {\n\t\t\tif (collectionId === apiCollection.collectionId) {\n\t\t\t\tapiFieldSettings = fieldSettings\n\t\t\t\tsetReviewsGridButtonStates()\n\t\t\t}\n\t\t}\n\t\tSM.Dispatcher.addListener('statussettingschanged', onStatusSettingsChanged)\n\t\tfunction onStatusSettingsChanged (collectionId, statusSettings) {\n\t\t\tif (collectionId === apiCollection.collectionId) {\n\t\t\t\tapiStatusSettings = statusSettings\n\t\t\t\tsetReviewsGridButtonStates()\n\t\t\t}\n\t\t}\n\t\tSM.Dispatcher.addListener('fieldsettingschanged', onFieldSettingsChanged)\n\t\n\t\tasync function getContent(benchmarkId, revisionStr, ruleId, groupId) {\n\t\t\ttry {\n\t\t\t\t// Content panel\n\t\t\t\tconst contentPanel = Ext.getCmp('content-panel' + idAppend)\n\t\t\t\tconst content = await Ext.Ajax.requestPromise({\n\t\t\t\t\tresponseType: 'json',\n\t\t\t\t\turl: `${STIGMAN.Env.apiBase}/stigs/${benchmarkId}/revisions/${revisionStr}/rules/${ruleId}`,\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\tparams: {\n\t\t\t\t\t\tprojection: ['detail','ccis','check','fix']\n\t\t\t\t\t}\n\t\t\t\t})\n\t\t\t\tcontentPanel.update(content)\n\t\t\t\tcontentPanel.setTitle('Rule for Group ' + SM.he(groupId))\n\t\t\t}\n\t\t\tcatch (e) {\n\t\t\t\tSM.Error.handleError(e)\n\t\t\t}\n\t\t}\n\n\t\tasync function getReviews(collectionId, record) {\n\t\t\tlet maskTimer\n\t\t\ttry {\n\t\t\t\t// Reviews grid\n\t\t\t\tconst reviewsGrid = Ext.getCmp('reviewsGrid' + idAppend)\n\t\t\t\tmaskTimer = setTimeout(() => reviewsGrid.bwrap.mask(''), 150)\n\t\t\t\tconst fetchedReviews = await Ext.Ajax.requestPromise({\n\t\t\t\t\tresponseType: 'json',\n\t\t\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${collectionId}/reviews`,\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\tparams: {\n\t\t\t\t\t\trules: 'all',\n\t\t\t\t\t\truleId: record.data.ruleId,\n\t\t\t\t\t}\n\t\t\t\t})\n\t\t\t\tconst fetchedReviewsLookup = {}\n\t\t\t\tfor (const fetchedReview of fetchedReviews) {\n\t\t\t\t\tfetchedReviewsLookup[fetchedReview.assetId] = fetchedReview\n\t\t\t\t}\n\t\t\t\tconst colReviews = colAssets.map(colAsset => {\n\t\t\t\t\t// Won't have a review.ruleId if there is no review for the asset yet\n\t\t\t\t\tif (!fetchedReviewsLookup[colAsset.assetId]) {\n\t\t\t\t\t\treturn { ...colAsset, ...{ruleId: record.data.ruleId} }\n\t\t\t\t\t}\n\t\t\t\t\telse {\n\t\t\t\t\t\treturn {...colAsset, ...fetchedReviewsLookup[colAsset.assetId]}\n\t\t\t\t\t}\n\t\t\t\t})\n\t\t\t\n\t\t\t\treviewsGrid.getStore().loadData(colReviews)\n\t\t\t\treviewsGrid.setTitle(`Reviews of ${SM.he(record.data.ruleId)}`)\n\t\t\t\treviewsGrid.currentChecklistRecord = record\n\t\t\t\treviewsGrid.currentRuleId = record.data.ruleId\n\t\t\t\treviewsExportBtn.gridBasename = `${leaf.benchmarkId}-${record.data.ruleId}`\n\t\t\t}\n\t\t\tcatch (e) {\n\t\t\t\tSM.Error.handleError(e)\n\t\t\t}\n\t\t\tfinally {\n\t\t\t\tclearTimeout(maskTimer)\n\t\t\t\treviewsGrid.bwrap.unmask()\n\t\t\t}\n\t\t}\n\t\t\n\t\tfunction handleGroupSelectionForCollection(record, idAppend, leaf, benchmarkId, revisionStr) {\n\t\t\tgetContent(benchmarkId, revisionStr, record.data.ruleId, record.data.groupId)\n\t\t\tgetReviews(leaf.collectionId, record)\n\t\t\t//when new group is selected, deselect rows from reviews grid (to make resources panel clear)\n\t\t\treviewsGrid.getSelectionModel().clearSelections()\n\t\t}\n\n\t\tfunction isReviewComplete (result, rcomment, acomment) {\n\t\t\tif (!result) return false\n\t\t\tif (result !== 'pass' && result !== 'fail' && result !== 'notapplicable') return false\n      if (apiFieldSettings.detail.required === 'always' && !rcomment) return false\n      if (apiFieldSettings.detail.required === 'findings' \n        && result === 'fail'\n        && !rcomment) return false\n      if (apiFieldSettings.comment.required === 'always'\n        && (!acomment)) return false\n      if (apiFieldSettings.comment.required === 'findings'\n        && result === 'fail'\n        && (!acomment)) return false\n      return true\n\n\t\t}\n\n\t\tfunction setReviewsGridButtonStates() {\n\t\t\tconst sm = reviewsGrid.getSelectionModel()\n\t\t\tconst approveBtn = Ext.getCmp('reviewsGrid-approveButton' + idAppend)\n\t\t\tconst rejectBtn = Ext.getCmp('reviewsGrid-rejectButton' + idAppend)\n\t\t\tconst submitBtn = Ext.getCmp('reviewsGrid-submitButton' + idAppend)\n\t\t\tconst unsubmitBtn = Ext.getCmp('reviewsGrid-unsubmitButton' + idAppend)\n\n\t\t\tconst selections = sm.getSelections()\n\t\t\tconst selLength = selections.length\n\t\t\tlet approveBtnEnabled, rejectBtnEnabled, submitBtnEnabled, unsubmitBtnEnabled\n\t\t\tapproveBtnEnabled = rejectBtnEnabled = submitBtnEnabled = unsubmitBtnEnabled = true\n\n\t\t\tif (selLength === 0) {\n\t\t\t\tapproveBtnEnabled = rejectBtnEnabled = submitBtnEnabled = unsubmitBtnEnabled = false\n\t\t\t}\n\t\t\telse if (selLength === 1) {\n\t\t\t\tconst selection = selections[0]\n\t\t\t\tif (!selection.data.status) { // a review doesn't exist\n\t\t\t\t\tapproveBtnEnabled = rejectBtnEnabled = submitBtnEnabled = unsubmitBtnEnabled = false\n\t\t\t\t}\n\t\t\t\telse {\n\t\t\t\t\tconst status = selection.data.status\n\t\t\t\t\tswitch (status) {\n\t\t\t\t\t\tcase 'saved': // in progress\n\t\t\t\t\t\t\tif (isReviewComplete(\n\t\t\t\t\t\t\t\tselection.data.result,\n\t\t\t\t\t\t\t\tselection.data.detail,\n\t\t\t\t\t\t\t\tselection.data.comment\n\t\t\t\t\t\t\t\t)) {\n\t\t\t\t\t\t\t\t\tapproveBtnEnabled = false\n\t\t\t\t\t\t\t\t\trejectBtnEnabled = false\n\t\t\t\t\t\t\t\t\tsubmitBtnEnabled = true\n\t\t\t\t\t\t\t\t\tunsubmitBtnEnabled = false\n\t\t\t\t\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\tapproveBtnEnabled = false\n\t\t\t\t\t\t\t\tsubmitBtnEnabled = false\n\t\t\t\t\t\t\t\tunsubmitBtnEnabled = false\n\t\t\t\t\t\t\t\trejectBtnEnabled = false\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t\tcase 'submitted':\n\t\t\t\t\t\t\tapproveBtnEnabled = true\n\t\t\t\t\t\t\tsubmitBtnEnabled = false\n\t\t\t\t\t\t\tunsubmitBtnEnabled = true\n\t\t\t\t\t\t\trejectBtnEnabled = true\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t\tcase 'rejected':\n\t\t\t\t\t\t\tapproveBtnEnabled = true\n\t\t\t\t\t\t\tsubmitBtnEnabled = true\n\t\t\t\t\t\t\tunsubmitBtnEnabled = true\n\t\t\t\t\t\t\trejectBtnEnabled = true\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t\tcase 'accepted':\n\t\t\t\t\t\t\tapproveBtnEnabled = false\n\t\t\t\t\t\t\tsubmitBtnEnabled = false\n\t\t\t\t\t\t\tunsubmitBtnEnabled = true\n\t\t\t\t\t\t\trejectBtnEnabled = false\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} \n\t\t\telse { // multiple selections\n\t\t\t\tconst counts = {\n\t\t\t\t\tunsaved: 0,\n\t\t\t\t\tsavedComplete:0,\n\t\t\t\t\tsaved:0,\n\t\t\t\t\tsubmitted:0,\n\t\t\t\t\trejected:0,\n\t\t\t\t\taccepted:0\n\t\t\t\t}\n\t\t\t\tfor (let i=0; i < selections.length; i++) {\n\t\t\t\t\tif (!selections[i].data.status) { // a review doesn't exist\n\t\t\t\t\t\tcounts.unsaved++\n\t\t\t\t\t\tbreak\n\t\t\t\t\t}\n\t\t\t\t\tconst status = selections[i].data.status\n\t\t\t\t\tif (status === 'saved') {\n\t\t\t\t\t\tif (isReviewComplete(\n\t\t\t\t\t\t\tselections[i].data.result,\n\t\t\t\t\t\t\tselections[i].data.detail,\n\t\t\t\t\t\t\tselections[i].data.comment\n\t\t\t\t\t\t)) {\n\t\t\t\t\t\t\tcounts.savedComplete++\n\t\t\t\t\t\t} \n\t\t\t\t\t\telse {\n\t\t\t\t\t\t\tcounts.saved++\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\telse {\n\t\t\t\t\t\tcounts[status]++\n\t\t\t\t\t}\t\n\t\t\t\t}\n\t\t\t\tapproveBtnEnabled = (counts.submitted || counts.rejected) && (!counts.unsaved && !counts.saved && !counts.savedComplete)  && (counts.accepted !== selLength)\n\t\t\t\tsubmitBtnEnabled = (counts.savedComplete || counts.submitted || counts.accepted || counts.rejected) && (!counts.unsaved && !counts.saved) && (counts.submitted !== selLength)\n\t\t\t\tunsubmitBtnEnabled = (counts.submitted || counts.accepted || counts.rejected) && (!counts.unsaved && !counts.saved)\n\t\t\t\trejectBtnEnabled = counts.submitted && (!counts.unsaved && !counts.saved && !counts.savedComplete && !counts.accepted && !counts.rejected)\n\t\t\n\t\t\t}\n\t\t\tapproveBtn.setDisabled(!approveBtnEnabled)\n\t\t\trejectBtn.setDisabled(!rejectBtnEnabled)\n\t\t\tsubmitBtn.setDisabled(!submitBtnEnabled)\n\t\t\tunsubmitBtn.setDisabled(!unsubmitBtnEnabled)\n\t\t}\n\n\t\tasync function handleBatchEdit(grid) {\n\t\t\tconst records = grid.getSelectionModel().getSelections()\n\t\t\tif (!records.length) return\n\t\t\tconst resultsSet = new Set(records.map( r => r.data.result ))\n\t\t\tlet initialResult = null\n\t\t\tif (resultsSet.size === 1) {\n\t\t\t\tinitialResult = records[0].data.result\n\t\t\t}\n\n\t\t\tconst review = await SM.BatchReview.showDialog(apiFieldSettings, initialResult)\n\t\t\tconst ruleIds = [grid.currentChecklistRecord.data.ruleId]\n\t\t\tconst assetIds = []\n\t\t\tfor (let i = 0, l = records.length; i < l; i++) {\n\t\t\t\tif (review.resultEngine && review.result !== records[i].data.result) {\n\t\t\t\t\treview.resultEngine = null\n\t\t\t\t}\n\t\t\t\tassetIds.push(records[i].data.assetId)\n\t\t\t}\n\t\t\tconst jsonData = {\n\t\t\t\tsource: {\n\t\t\t\t\treview\n\t\t\t\t},\n\t\t\t\tassets: {\n\t\t\t\t\tassetIds\n\t\t\t\t},\n\t\t\t\trules: {\n\t\t\t\t\truleIds\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tgrid.bwrap.mask(`Updating ${records.length} reviews`)\n\t\t\ttry {\n\t\t\t\tawait Ext.Ajax.requestPromise({\n\t\t\t\t\tresponseType: 'json',\n\t\t\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${leaf.collectionId}/reviews`,\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t\tjsonData\n\t\t\t\t})\n\t\t\t}\n\t\t\tcatch (e) {\n\t\t\t\tSM.Error.handleError(e)\n\t\t\t}\n\t\t\tfinally {\n\t\t\t\tgrid.bwrap.unmask()\n\t\t\t}\n\n\t\t\tconst record = groupGrid.getSelectionModel().getSelected()\n\t\t\tawait getReviews(leaf.collectionId, record)\n\t\t\t\n\t\t\t// hack to reselect the records\n\t\t\tconst sm =reviewsGrid.getSelectionModel()\n\t\t\tsm.onRefresh()\n\t\t\tsm.fireEvent('selectionchange', sm)\n\n\t\t\tgrid.updateGroupStore(grid)\n\t\t\tsetReviewsGridButtonStates()\n\t\t}\n\n\t\tfunction promptForStatusText () {\n\t\t\treturn new Promise ((resolve, reject) => {\n\t\t\t\tconst textArea = new Ext.form.TextArea({\n\t\t\t\t\temptyText: 'Provide feedback explaining this rejection.',\n\t\t\t\t\tmaxLength: 511,\n\t\t\t\t\tenableKeyEvents: true,\n\t\t\t\t\tlisteners: {\n\t\t\t\t\t\tkeyup: (field) => {\n\t\t\t\t\t\t\tif (field.isValid() && field.getValue().trim().length > 0) {\n\t\t\t\t\t\t\t\tsubmitBtn.enable()\n\t\t\t\t\t\t\t} \n\t\t\t\t\t\t\telse {\n\t\t\t\t\t\t\t\tsubmitBtn.disable()\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t})\n\t\t\t\tconst submitBtn = new Ext.Button({\n\t\t\t\t\ttext: 'Reject with this feedback',\n\t\t\t\t\taction: 'reject',\n\t\t\t\t\ticonCls: 'sm-rejected-icon',\n\t\t\t\t\tdisabled: true,\n\t\t\t\t\thandler\n\t\t\t\t})\n\t\t\t\tconst cancelBtn = new Ext.Button(\t{\n\t\t\t\t\ttext: 'Cancel',\n\t\t\t\t\taction: 'cancel',\n\t\t\t\t\thandler\n\t\t\t\t})\n\t\t\t\tfunction handler (btn) {\n\t\t\t\t\tconst value = textArea.getValue()\n\t\t\t\t\tif (btn.action === 'reject'){\n\t\t\t\t\t\tfpwindow.close()\n\t\t\t\t\t\tresolve(value)\n\t\t\t\t\t}\n\t\t\t\t\telse{\n\t\t\t\t\t\tfpwindow.close()\n\t\t\t\t\t\treject()\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tconst fpwindow = new Ext.Window({\n\t\t\t\t\ttitle: `Reject Reviews`,\n\t\t\t\t\tmodal: true,\n\t\t\t\t\tresizable: false,\n\t\t\t\t\tclosable: false,\n\t\t\t\t\twidth: 400,\n\t\t\t\t\theight: 300,\n\t\t\t\t\tlayout: 'fit',\n\t\t\t\t\tplain: true,\n\t\t\t\t\tbodyStyle: 'padding:5px;',\n\t\t\t\t\tbuttonAlign: 'center',\n\t\t\t\t\titems: [textArea],\n\t\t\t\t\tbuttons: [cancelBtn,submitBtn]\n\t\t\t\t})\n\t\t\t\tfpwindow.show()\n\t\t\t})\n\t\t}\n\t\t\n\t\tasync function handleStatusChange (grid, sm, status) {\n\t\t\ttry {\n\t\t\t\tif (status === 'rejected') {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst text = await promptForStatusText()\n\t\t\t\t\t\tstatus = {label: status, text}\n\t\t\t\t\t}\n\t\t\t\t\tcatch (e) {\n\t\t\t\t\t\treturn\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tconst selections = sm.getSelections()\n\t\t\t\tif (selections.length === 1) {\n\t\t\t\t\tawait Ext.Ajax.requestPromise({\n\t\t\t\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${leaf.collectionId}/reviews/${selections[0].data.assetId}/${grid.currentRuleId}`,\n\t\t\t\t\t\tmethod: 'PATCH',\n\t\t\t\t\t\tjsonData: {\n\t\t\t\t\t\t\tstatus\n\t\t\t\t\t\t}\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\tif (selections.length > 1) {\n\t\t\t\t\tconst ruleIds = [grid.currentRuleId]\n\t\t\t\t\tconst assetIds = selections.map( record => record.data.assetId)\n\t\t\t\t\tconst review = {status}\n\t\t\t\t\tconst jsonData = {\n\t\t\t\t\t\tsource: {\n\t\t\t\t\t\t\treview\n\t\t\t\t\t\t},\n\t\t\t\t\t\tassets: {\n\t\t\t\t\t\t\tassetIds\n\t\t\t\t\t\t},\n\t\t\t\t\t\trules: {\n\t\t\t\t\t\t\truleIds\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tgrid.bwrap.mask(`Updating ${selections.length} reviews`)\n\t\t\t\t\tawait Ext.Ajax.requestPromise({\n\t\t\t\t\t\tresponseType: 'json',\n\t\t\t\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${leaf.collectionId}/reviews`,\n\t\t\t\t\t\tmethod: 'POST',\n\t\t\t\t\t\tjsonData\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\t// ugly code follows\n\t\t\t\tconst record = groupGrid.getSelectionModel().getSelected()\n\t\t\t\tawait getReviews(leaf.collectionId, record)\n\t\t\t\t\n\t\t\t\t// hack to reselect the records\n\t\t\t\tconst reviewsGridSm = reviewsGrid.getSelectionModel()\n\t\t\t\treviewsGridSm.onRefresh()\n\t\t\t\treviewsGridSm.fireEvent('selectionchange', sm)\n\n\t\t\t\tgrid.updateGroupStore(grid)\n\t\t\t\tsetReviewsGridButtonStates()\n\t\t\t}\n\t\t\tcatch (e) {\n\t\t\t\tSM.Error.handleError(e)\n\t\t\t}\n\t\t\tfinally {\n\t\t\t\tgrid.bwrap.unmask()\n\t\t\t}\n\t\t}\n\n\t\tfunction beforeEdit(e) {\n\t\t\tif (e.record.data.access === 'r') {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (e.field == 'result') {\n\t\t\t\tconst editor = e.grid.getColumnModel().getCellEditor(e.column,e.row)\n\t\t\t\teditor.gridRecord = e.record\n\t\t\t}\n\t\t}\n\t\t\n\t/******************************************************/\n\t// END Reviews Panel\n\t/******************************************************/\n\n\t\tconst contentTpl = SM.RuleContentTpl\n\n\t\tconst tabItems2 = [\n\t\t\t{\n\t\t\t\txtype: 'panel',\n\t\t\t\tregion: 'east',\n\t\t\t\twidth: 430,\n\t\t\t\tminWidth: 330,\n\t\t\t\tborder: false,\n\t\t\t\tsplit:true,\n\t\t\t\tcollapsible: true,\n\t\t\t\tcls: 'sm-round-panel',\n\t\t\t\tmargins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.adjacent },\n\t\t\t\tborder: false,\n\t\t\t\tpadding: 20,\n\t\t\t\tautoScroll: true,\n\t\t\t\tid: 'content-panel' + idAppend,\n\t\t\t\ttitle: 'Rule',\n\t\t\t\ttpl: contentTpl\n\t\t\t},\n\t\t\t{\n\t\t\t\tregion: 'center',\n\t\t\t\tlayout: 'border',\n\t\t\t\tborder: false,\n\t\t\t\tsplit:true,\n\t\t\t\tcollapsible: false,\n\t\t\t\tid: 'center-panel' + idAppend,\n\t\t\t\titems: [\n\t\t\t\t\tgroupGrid,\n\t\t\t\t\treviewsGrid,\n\t\t\t\t\t// {\n\t\t\t\t\t// \tregion: 'south',\n\t\t\t\t\t// \txtype: 'tabpanel',\n\t\t\t\t\t// \tcls: 'sm-round-panel',\n\t\t\t\t\t// \tstyle: {\n\t\t\t\t\t// \t\t'background-color': 'transparent'\n\t\t\t\t\t// \t},\n\t\t\t\t\t// \tmargins: { top: SM.Margin.adjacent, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.adjacent },\n\t\t\t\t\t// \tborder: false,\n\t\t\t\t\t// \tid: 'resources-tab-panel' + idAppend,\n\t\t\t\t\t// \theight: '33%',\n\t\t\t\t\t// \tsplit:true,\n\t\t\t\t\t// \tcollapsible: false,\n\t\t\t\t\t// \tactiveTab: 'history',\n\t\t\t\t\t// \titems: [\n\t\t\t\t\t// \t\t{\n\t\t\t\t\t// \t\t\ttitle: 'History',\n\t\t\t\t\t// \t\t\titemId: 'history',\n\t\t\t\t\t// \t\t\tlayout: 'fit',\n\t\t\t\t\t// \t\t\tid: 'history-tab' + idAppend,\n\t\t\t\t\t// \t\t\titems: historyData.grid\n\t\t\t\t\t// \t\t},\n\t\t\t\t\t// \t\t{\n\t\t\t\t\t// \t\t\ttitle: 'Attachments',\n\t\t\t\t\t// \t\t\tid: 'attachment-panel' + idAppend,\n\t\t\t\t\t// \t\t\tlayout: 'fit',\n\t\t\t\t\t// \t\t\titems: attachmentsGrid\n\t\t\t\t\t// \t\t}\n\t\t\t\t\t// \t]\n\t\t\t\t\t// }\n\t\t\t\t]\n\t\t\t}\n\t\t]\n\t\t\n\t\tconst colReviewTab = new Ext.Panel ({\n\t\t\tid: 'collection-review-tab' + idAppend,\n\t\t\ticonCls: 'sm-stig-icon',\n\t\t\ttitle: '',\n\t\t\tcollectionId: leaf.collectionId,\n\t\t\tbenchmarkId: leaf.benchmarkId,\n\t\t\tcollectionName: apiCollection.name,\n\t\t\tstigName: leaf.benchmarkId,\n\t\t\tclosable:true,\n\t\t\tlayout: 'border',\n\t\t\tborder: false,\n\t\t\titems: tabItems2,\n\t\t\tsm_TabType: 'asset_review',\n\t\t\tsm_tabMode: 'ephemeral',\n\t\t\tsm_treePath: treePath,\n\t\t\tlisteners: {\n\t\t\t\tbeforedestroy: () => {\n\t\t\t\t\tSM.Dispatcher.removeListener('fieldsettingschanged', onFieldSettingsChanged)\n\t\t\t\t\tSM.Dispatcher.removeListener('statussettingschanged', onStatusSettingsChanged)\n\t\t\t\t}\n\t\t\t}\t\t\t\n\t\t})\n\t\tcolReviewTab.updateTitle = function () {\n\t\t\tcolReviewTab.setTitle(`${this.sm_tabMode === 'ephemeral' ? '<i>':''}${SM.he(this.collectionName)} / ${SM.he(this.stigName)}${this.sm_tabMode === 'ephemeral' ? '</i>':''}`)\n\t\t}\n\t\tcolReviewTab.makePermanent = function () {\n\t\t\tcolReviewTab.sm_tabMode = 'permanent'\n\t\t\tcolReviewTab.updateTitle.call(colReviewTab)\n\t\t}\n\t\t\n\t\tconst tp = Ext.getCmp('main-tab-panel')\n\t\tconst ephTabIndex = tp.items.findIndex('sm_tabMode', 'ephemeral')\n\t\tlet thisTab\n\t\tif (ephTabIndex !== -1) {\n\t\t  const ephTab = tp.items.itemAt(ephTabIndex)\n\t\t  tp.remove(ephTab)\n\t\t  thisTab = tp.insert(ephTabIndex, colReviewTab)\n\t\t} else {\n\t\t  thisTab = tp.add( colReviewTab )\n\t\t}\n\t\tthisTab.updateTitle.call(thisTab)\n\t\tthisTab.show()\n\n\t\tgroupGrid.getStore().load({\n\t\t\tpreselect: {\n\t\t\t\truleId: selectedRule,\n\t\t\t\tassetId: selectedAsset\n\t\t\t}\t\t\n\t\t})\n\t\tloadRevisionMenu(leaf.benchmarkId, leaf.revisionStr, idAppend)\n\t}\n\tcatch (e) {\n\t\tSM.Error.handleError(e)\n\t}\n\n}\n\n\nfunction renderOpen(value, metaData, record, rowIndex, colIndex, store) {\n\tlet returnValue = value\n\tif (value > 0) {\n\t\tmetaData.css = 'sm-cell-red'\n\t} else {\n\t\treturnValue = '-'\n\t\tmetaData.css = 'sm-cell-green'\n\t}\n\treturn returnValue\n}\n\nfunction renderCounts(value, metaData, record, rowIndex, colIndex, store) {\n\tlet returnValue = value\n\tif (value == 0) { returnValue = '-' }\n\tmetaData.css = 'sm-cell-grey'\n\treturn returnValue\n}\n\nfunction renderStatusCounts(value, metaData, record, rowIndex, colIndex, store) {\n\tlet returnValue = value\n\tif (value == 0) { returnValue = '-' }\n\tmetaData.css = 'sm-cell-status'\n\treturn returnValue\n}\n"
  },
  {
    "path": "client/src/js/completionStatus.js",
    "content": "function addCompletionStatus( params) {\n\tconst { collectionId, collectionName, treePath } = params\n\n\tvar summary = new Ext.ux.grid.GroupSummary();\n\n\tconst statusStore = new Ext.data.GroupingStore ({\n\t\tproxy: new Ext.data.HttpProxy({\n\t\t\turl: `${STIGMAN.Env.apiBase}/collections/${collectionId}/status`,\n\t\t\tmethod: 'GET',\n\t\t}),\n\t\tsortInfo: {\n\t\t\tfield: 'assetName'\n\t\t},\n\t\tgroupField: 'benchmarkId',\n\t\treader: new Ext.data.JsonReader({\n\t\t\troot: '',\n\t\t\tfields: [\n\t\t\t\t{name:'assetId',type:'int'},\n\t\t\t\t'assetName',\n\t\t\t\t'assetLabelIds',\n\t\t\t\t{name:'benchmarkId',type:'string'},\n\t\n\t\t\t\t{name:'rulesTotal', type:'int', mapping: 'rules.total'},\n\t\t\t\t\n\n\t\t\t\t{name:'savedTotal',type:'int', mapping: 'status.saved.total'},\n\t\n\t\t\t\t{name:'submittedTotal',type:'int', mapping: 'status.submitted.total'},\n\t\n\t\t\t\t{name:'rejectedTotal',type:'int', mapping: 'status.rejected.total'},\n\t\n\t\t\t\t{name:'acceptedTotal',type:'int', mapping: 'status.accepted.total'},\n\t\n\t\t\t\t{name:'highCount',type:'int', mapping: 'findings.high'},\n\t\t\t\t{name:'mediumCount',type:'int', mapping: 'findings.medium'},\n\t\t\t\t{name:'lowCount',type:'int', mapping: 'findings.low'},\n\t\t\t\t{name:'minTs',type:'date'},\n\t\t\t\t{name:'maxTs',type:'date'},\n\t\t\t\t{name:'notCheckedTotal',type:'int', convert: function (v, r) { \n\t\t\t\t\treturn r.rules.total - (r.status.saved.total + r.status.submitted.total + r.status.rejected.total + r.status.accepted.total) \n\t\t\t\t} },\n\n\t\t\t],\n\t\t\tidProperty: (v) => {\n\t\t\t\treturn v.assetId + v.benchmarkId\n\t\t\t}\t\n\t\t})\n\t})\n\tconst totalTextCmp = new SM.RowCountTextItem({store:statusStore})\n\n\tvar completionGrid = new Ext.grid.GridPanel({\n\t\tid: 'completionGrid-' + collectionId,\n\t\tcls: 'sm-round-panel',\n\t\tmargins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n        plugins: summary,\n\t\tregion:'center',\n\t\tlayout:'fit',\n\t\tstore: statusStore,\n\t\tcolumns: [\n\t\t\t{\n\t\t\t\theader: \"Asset\",width:35,dataIndex:'assetName',sortable:true,\n\t\t\t\tsummaryRenderer: function(v, params, data){\n          return \"Totals\";\n        },\n\t\t\t},\n\t\t\t{\n\t\t\t\theader: \"Labels\",\n\t\t\t\tid: `status-labels-${collectionId}`,\n\t\t\t\twidth: 30,\n\t\t\t\tdataIndex: 'assetLabelIds',\n\t\t\t\tsortable: false,\n\t\t\t\trenderer: function (value, metadata) {\n\t\t\t\t\t\tconst labels = []\n\t\t\t\t\t\tfor (const labelId of value) {\n\t\t\t\t\t\t\t\tconst label = SM.Cache.getCollectionLabel(collectionId, labelId)\n\t\t\t\t\t\t\t\tif (label) labels.push(label)\n\t\t\t\t\t\t}\n\t\t\t\t\t\tlabels.sort((a,b) => a.name.localeCompare(b.name))\n\t\t\t\t\t\tmetadata.attr = 'style=\"white-space:normal;\"'\n\t\t\t\t\t\treturn SM.Manage.Collection.LabelArrayTpl.apply(labels)\n\t\t\t\t}\n\t\t\t},\n\t\t\t{\n\t\t\t\theader: \"Checklist\",width:35,dataIndex:'benchmarkId',sortable:true,id:'completionGrid-'+ collectionId + 'becnhmarkId',\n\t\t\t\tsummaryRenderer: function(v, params, data){\n          return \"Totals\";\n        },\n\t\t\t},\n\t\t\t{header: \"Checks\",width:10,dataIndex:'rulesTotal',sortable:true,align:'right',renderer:renderGrey,summaryType: 'sum'},\n\t\t\t{header: \"Not Checked\",width:10,dataIndex:'notCheckedTotal',sortable:true,align:'right',renderer:renderCat23,summaryType: 'sum'},\n\t\t\t{header: \"Oldest\",width:10,dataIndex:'minTs',sortable:true,align:'center',renderer:renderDurationToNow,summaryType: 'min'},\n\t\t\t{header: \"Newest\",width:10,dataIndex:'maxTs',sortable:true,align:'center',renderer:renderDurationToNow,summaryType: 'max'},\n\t\t\t{header: \"Saved\",width:10,dataIndex:'savedTotal',sortable:true,align:'right',renderer:renderGrey,summaryType: 'sum'},\n\t\t\t{header: \"<img src=img/ready-16.png width=12 height=12 exportvalue='Submitted'> Submitted\",width:10,dataIndex:'submittedTotal',sortable:true,align:'right',renderer:renderGrey,summaryType: 'sum'},\n\t\t\t{header: \"<img src=img/rejected-16.png width=12 height=12 exportvalue='Rejected'> Rejected\",width:10,dataIndex:'rejectedTotal',sortable:true,align:'right',renderer:renderGrey,summaryType: 'sum'},\n\t\t\t{header: \"<img src=img/star.svg width=12 height=12 exportvalue='Accepted'> Accepted\",width:10,dataIndex:'acceptedTotal',sortable:true,align:'right',renderer:renderGrey,summaryType: 'sum'},\n\t\t\t{header: \"Cat 1\",width:10,dataIndex:'highCount',sortable:true,align:'right',renderer:renderCat1,summaryType: 'sum'},\t\t\t\n\t\t\t{header: \"Cat 2\",width:10,dataIndex:'mediumCount',sortable:true,align:'right',renderer:renderCat23,summaryType: 'sum'},\t\t\t\n\t\t\t{header: \"Cat 3\",width:10,dataIndex:'lowCount',sortable:true,align:'right',renderer:renderCat23,summaryType: 'sum'}\n\t\t\t\n\t\t],\n\t\tloadMask: {msg: ''},\n\t\tstripeRows: true,\n\t\tview: new Ext.grid.GroupingView({\n\t\t\tenableGrouping:true,\n\t\t\thideGroupedColumn: true,\n\t\t\tforceFit:true,\n\t\t\temptyText: 'No records found.',\n\t\t\tgroupTextTpl: '{[SM.he(values.text)]} ({[values.rs.length]} {[values.text.split(\":\")[0] == \"Asset\" ? \"checklist\" : \"asset\"]}{[values.rs.length > 1 ? \"s assigned\" : \" assigned\"]})',\n\t\t\tgetRowClass: function(record, rowIndex, rp, ds){ // rp = rowParams\n\t\t\t\tif (record.data.stigTitle == '!! NO STIG ASSIGNMENTS !!') {\n\t\t\t\t\treturn 'sm-grid3-row-black';\n\t\t\t\t}\n\t\t\t}\n\t\t}),\n\t\tsm: new Ext.grid.RowSelectionModel ({\n\t\t}),\n\t\tlisteners: {\n\t\t\trowdblclick: {\n\t\t\t\tfn: function (grid, rowIndex) {\n\t\t\t\t\tconst r = grid.getStore().getAt(rowIndex);\n\t\t\t\t\tif (r.get('stigTitle') != '!! NO STIG ASSIGNMENTS !!') {\n\t\t\t\t\t\tconst leaf = {\n\t\t\t\t\t\t\tcollectionId, \n\t\t\t\t\t\t\tassetId: r.data.assetId,\n\t\t\t\t\t\t\tassetName: r.data.assetName,\n\t\t\t\t\t\t\tassetLabelIds: r.data.assetLabelIds,\n\t\t\t\t\t\t\tbenchmarkId: r.data.benchmarkId,\n\t\t\t\t\t\t\tstigName: r.data.benchmarkId,\n\t\t\t\t\t\t}\n\t\t\t\t\t\taddReview({leaf})\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\ttbar: new Ext.Toolbar({\n\t\t\titems: [\n\t\t\t\t// START Grouping control\n\t\t\t\t{\n\t\t\t\t\txtype: 'buttongroup',\n\t\t\t\t\ttitle: 'Grouping',\n\t\t\t\t\titems: [\n\t\t\t\t\t{\n\t\t\t\t\t\txtype: 'tbbutton',\n\t\t\t\t\t\ticonCls: 'sm-stig-icon',\n\t\t\t\t\t\ttooltip: 'Group by STIG',\n\t\t\t\t\t\ttoggleGroup: 'completionGrid-groupBy' + collectionId,\n\t\t\t\t\t\tenableToggle:true,\n\t\t\t\t\t\tallowDepress: false,\n\t\t\t\t\t\tpressed: true,\n\t\t\t\t\t\twidth: 20,\n\t\t\t\t\t\thandler: function(btn){\n\t\t\t\t\t\t\tif (btn.pressed) {\n\t\t\t\t\t\t\t\tExt.getCmp('completionGrid-expandButton' + collectionId).enable();\n\t\t\t\t\t\t\t\tExt.getCmp('completionGrid-collapseButton' + collectionId).enable();\n\t\t\t\t\t\t\t\tcompletionGrid.getStore().groupBy('benchmarkId');\n\t\t\t\t\t\t\t\tconst cm = completionGrid.getColumnModel() \n\t\t\t\t\t\t\t\tcm.setHidden(cm.getIndexById(`status-labels-${collectionId}`), false)\n\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\tExt.getCmp('completionGrid-expandButton' + collectionId).disable();\n\t\t\t\t\t\t\t\tExt.getCmp('completionGrid-collapseButton' + collectionId).disable();\n\t\t\t\t\t\t\t\tcompletionGrid.getStore().clearGrouping();\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t},{\n\t\t\t\t\t\txtype: 'tbbutton',\n\t\t\t\t\t\ticonCls: 'sm-asset-icon',\n\t\t\t\t\t\ttooltip: 'Group by asset',\n\t\t\t\t\t\ttoggleGroup: 'completionGrid-groupBy' + collectionId,\n\t\t\t\t\t\tenableToggle:true,\n\t\t\t\t\t\tallowDepress: false,\n\t\t\t\t\t\twidth: 20,\n\t\t\t\t\t\thandler: function(btn){\n\t\t\t\t\t\t\tif (btn.pressed) {\n\t\t\t\t\t\t\t\tExt.getCmp('completionGrid-expandButton' + collectionId).enable();\n\t\t\t\t\t\t\t\tExt.getCmp('completionGrid-collapseButton' + collectionId).enable();\n\t\t\t\t\t\t\t\tcompletionGrid.getStore().groupBy('assetName');\n\t\t\t\t\t\t\t\tconst cm = completionGrid.getColumnModel() \n\t\t\t\t\t\t\t\tcm.setHidden(cm.getIndexById(`status-labels-${collectionId}`), true)\n\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\tExt.getCmp('completionGrid-expandButton' + collectionId).disable();\n\t\t\t\t\t\t\t\tExt.getCmp('completionGrid-collapseButton' + collectionId).disable();\n\t\t\t\t\t\t\t\tcompletionGrid.getStore().clearGrouping();\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t},{\n\t\t\t\t\t\txtype: 'tbseparator'\n\t\t\t\t\t},{\n\t\t\t\t\t\txtype: 'tbbutton',\n\t\t\t\t\t\ticon: 'img/minus-grey.png',\n\t\t\t\t\t\tid: 'completionGrid-collapseButton' + collectionId,\n\t\t\t\t\t\ttooltip: 'Collapse all groups',\n\t\t\t\t\t\twidth: 20,\n\t\t\t\t\t\thandler: function(btn){\n\t\t\t\t\t\t\tcompletionGrid.getView().collapseAllGroups();\n\t\t\t\t\t\t}\n\t\t\t\t\t},{\n\t\t\t\t\t\txtype: 'tbbutton',\n\t\t\t\t\t\ticon: 'img/plus-grey.png',\n\t\t\t\t\t\tid: 'completionGrid-expandButton' + collectionId,\n\t\t\t\t\t\ttooltip: 'Expand all groups',\n\t\t\t\t\t\twidth: 20,\n\t\t\t\t\t\thandler: function(btn){\n\t\t\t\t\t\t\tcompletionGrid.getView().expandAllGroups();\n\t\t\t\t\t\t}\n\t\t\t\t\t}]\n\t\t\t\t// END Grouping control\n\t\t\t\t}\n\t\t\t]\n\t\t}),\n\t\tbbar: new Ext.Toolbar({\n\t\t\titems: [\n\t\t\t{\n\t\t\t\txtype: 'tbbutton',\n\t\t\t\ticonCls: 'icon-refresh',\n\t\t\t\ttooltip: 'Reload this grid',\n\t\t\t\twidth: 20,\n\t\t\t\thandler: function(btn){\n\t\t\t\t\tcompletionGrid.getStore().reload();\n\t\t\t\t}\n\t\t\t},{\n\t\t\t\txtype: 'tbseparator'\n\t\t\t}\n\t\t\t,{\n\t\t\t\txtype: 'exportbutton',\n\t\t\t\thasMenu: false,\n\t\t\t\texportType: 'grid',\n\t\t\t\tgridBasename: 'Status (grid)',\n\t\t\t\ticonCls: 'sm-export-icon',\n\t\t\t\ttext: 'CSV'\n\t\t\t},\n\t\t\t{\n\t\t\t\txtype: 'tbfill'\n\t\t\t},{\n\t\t\t\txtype: 'tbseparator'\n\t\t\t},\n\t\t\ttotalTextCmp]\n\t\t})\n\t})\n\n\tlet statusTab = new Ext.Panel({\n\t\tid: 'completionTab-' + collectionId,\n\t\tcollectionId: collectionId,\n\t\tcollectionName: collectionName,\n\t\ticonCls: 'sm-report-icon',\n\t\ttitle: '',\n\t\tclosable:true,\n\t\tlayout: 'border',\n\t\tsm_tabMode: 'permanent',\n\t\tsm_treePath: treePath,\n\t\titems: [completionGrid]\n\t})\n\n\tstatusTab.updateTitle = function () {\n\t\tstatusTab.setTitle(`${statusTab.sm_tabMode === 'ephemeral' ? '<i>':''}${SM.he(statusTab.collectionName)} / Status${statusTab.sm_tabMode === 'ephemeral' ? '</i>':''}`)\n\t}\n\tstatusTab.makePermanent = function () {\n\t\tstatusTab.sm_tabMode = 'permanent'\n\t\tstatusTab.updateTitle()\n\t}\n\n\tlet tp = Ext.getCmp('main-tab-panel')\n\tlet ephTabIndex = tp.items.findIndex('sm_tabMode', 'ephemeral')\n\tlet thisTab\n\tif (ephTabIndex !== -1) {\n\t  let ephTab = tp.items.itemAt(ephTabIndex)\n\t  tp.remove(ephTab)\n\t  thisTab = tp.insert(ephTabIndex, statusTab);\n\t} else {\n\t  thisTab = tp.add( statusTab )\n\t}\n\tthisTab.updateTitle.call(thisTab)\n\tthisTab.show();\n\t\n\tcompletionGrid.getStore().load();\n\n}; //end addCompletionReport();\n\nfunction renderGrey(value, metaData, record, rowIndex, colIndex, store) {\n\tmetaData.css = 'sm-cell-grey';\n\treturn value;\n}\nfunction renderDays(value, metaData, record, rowIndex, colIndex, store) {\n\tmetaData.css = 'sm-cell-grey';\n\tif (isNaN(value)) {\n\t\treturn '-';\n\t} else if (value == 0) {\n\t\treturn 'Today';\n\t} else if (value == 1) {\n\t\treturn value + ' day';\n\t} else {\n\t\treturn value + ' days';\n\t}\n}\n\nfunction renderCat1(value, metaData, record, rowIndex, colIndex, store) {\n\tif (value > 0) {\n\t\tmetaData.css = 'sm-cell-red';\n\t} else {\n\t\tmetaData.css = 'sm-cell-green';\n\t}\n\treturn value;\n}\n\nfunction renderCat23(value, metaData, record, rowIndex, colIndex, store) {\n\tif (value > 0) {\n\t\tmetaData.css = 'sm-cell-orange';\n\t} else {\n\t\tmetaData.css = 'sm-cell-green';\n\t}\n\treturn value;\n}\n\nfunction renderUndone(value, metaData, record, rowIndex, colIndex, store) {\n\tif (value == 0) {\n\t\tmetaData.css = 'sm-cell-green';\n\t} else {\n\t\tmetaData.css = 'sm-cell-red';\n\t}\n\treturn value\n}\nfunction renderDone(value, metaData, record, rowIndex, colIndex, store) {\n\tif (value == record.data.totalCheckCount) {\n\t\tmetaData.css = 'sm-cell-green';\n\t} else {\n\t\tmetaData.css = 'sm-cell-red';\n\t}\n\treturn value\n}\n\nfunction renderChecklist(value, metaData, record, rowIndex, colIndex, store) {\n\tmetaData.css = 'sm-cell-checklist';\n\treturn value;\n}\n\nfunction renderAsset(value, metaData, record, rowIndex, colIndex, store) {\n\tmetaData.css = 'sm-cell-asset';\n\treturn value;\n}\n\n"
  },
  {
    "path": "client/src/js/diff.js",
    "content": "(function (global, factory) {\n  typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :\n  typeof define === 'function' && define.amd ? define(['exports'], factory) :\n  (global = global || self, factory(global.Diff = {}));\n}(this, (function (exports) { 'use strict';\n\n  function Diff() {}\n  Diff.prototype = {\n    diff: function diff(oldString, newString) {\n      var options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};\n      var callback = options.callback;\n\n      if (typeof options === 'function') {\n        callback = options;\n        options = {};\n      }\n\n      this.options = options;\n      var self = this;\n\n      function done(value) {\n        if (callback) {\n          setTimeout(function () {\n            callback(undefined, value);\n          }, 0);\n          return true;\n        } else {\n          return value;\n        }\n      } // Allow subclasses to massage the input prior to running\n\n\n      oldString = this.castInput(oldString);\n      newString = this.castInput(newString);\n      oldString = this.removeEmpty(this.tokenize(oldString));\n      newString = this.removeEmpty(this.tokenize(newString));\n      var newLen = newString.length,\n          oldLen = oldString.length;\n      var editLength = 1;\n      var maxEditLength = newLen + oldLen;\n\n      if (options.maxEditLength) {\n        maxEditLength = Math.min(maxEditLength, options.maxEditLength);\n      }\n\n      var bestPath = [{\n        newPos: -1,\n        components: []\n      }]; // Seed editLength = 0, i.e. the content starts with the same values\n\n      var oldPos = this.extractCommon(bestPath[0], newString, oldString, 0);\n\n      if (bestPath[0].newPos + 1 >= newLen && oldPos + 1 >= oldLen) {\n        // Identity per the equality and tokenizer\n        return done([{\n          value: this.join(newString),\n          count: newString.length\n        }]);\n      } // Main worker method. checks all permutations of a given edit length for acceptance.\n\n\n      function execEditLength() {\n        for (var diagonalPath = -1 * editLength; diagonalPath <= editLength; diagonalPath += 2) {\n          var basePath = void 0;\n\n          var addPath = bestPath[diagonalPath - 1],\n              removePath = bestPath[diagonalPath + 1],\n              _oldPos = (removePath ? removePath.newPos : 0) - diagonalPath;\n\n          if (addPath) {\n            // No one else is going to attempt to use this value, clear it\n            bestPath[diagonalPath - 1] = undefined;\n          }\n\n          var canAdd = addPath && addPath.newPos + 1 < newLen,\n              canRemove = removePath && 0 <= _oldPos && _oldPos < oldLen;\n\n          if (!canAdd && !canRemove) {\n            // If this path is a terminal then prune\n            bestPath[diagonalPath] = undefined;\n            continue;\n          } // Select the diagonal that we want to branch from. We select the prior\n          // path whose position in the new string is the farthest from the origin\n          // and does not pass the bounds of the diff graph\n\n\n          if (!canAdd || canRemove && addPath.newPos < removePath.newPos) {\n            basePath = clonePath(removePath);\n            self.pushComponent(basePath.components, undefined, true);\n          } else {\n            basePath = addPath; // No need to clone, we've pulled it from the list\n\n            basePath.newPos++;\n            self.pushComponent(basePath.components, true, undefined);\n          }\n\n          _oldPos = self.extractCommon(basePath, newString, oldString, diagonalPath); // If we have hit the end of both strings, then we are done\n\n          if (basePath.newPos + 1 >= newLen && _oldPos + 1 >= oldLen) {\n            return done(buildValues(self, basePath.components, newString, oldString, self.useLongestToken));\n          } else {\n            // Otherwise track this path as a potential candidate and continue.\n            bestPath[diagonalPath] = basePath;\n          }\n        }\n\n        editLength++;\n      } // Performs the length of edit iteration. Is a bit fugly as this has to support the\n      // sync and async mode which is never fun. Loops over execEditLength until a value\n      // is produced, or until the edit length exceeds options.maxEditLength (if given),\n      // in which case it will return undefined.\n\n\n      if (callback) {\n        (function exec() {\n          setTimeout(function () {\n            if (editLength > maxEditLength) {\n              return callback();\n            }\n\n            if (!execEditLength()) {\n              exec();\n            }\n          }, 0);\n        })();\n      } else {\n        while (editLength <= maxEditLength) {\n          var ret = execEditLength();\n\n          if (ret) {\n            return ret;\n          }\n        }\n      }\n    },\n    pushComponent: function pushComponent(components, added, removed) {\n      var last = components[components.length - 1];\n\n      if (last && last.added === added && last.removed === removed) {\n        // We need to clone here as the component clone operation is just\n        // as shallow array clone\n        components[components.length - 1] = {\n          count: last.count + 1,\n          added: added,\n          removed: removed\n        };\n      } else {\n        components.push({\n          count: 1,\n          added: added,\n          removed: removed\n        });\n      }\n    },\n    extractCommon: function extractCommon(basePath, newString, oldString, diagonalPath) {\n      var newLen = newString.length,\n          oldLen = oldString.length,\n          newPos = basePath.newPos,\n          oldPos = newPos - diagonalPath,\n          commonCount = 0;\n\n      while (newPos + 1 < newLen && oldPos + 1 < oldLen && this.equals(newString[newPos + 1], oldString[oldPos + 1])) {\n        newPos++;\n        oldPos++;\n        commonCount++;\n      }\n\n      if (commonCount) {\n        basePath.components.push({\n          count: commonCount\n        });\n      }\n\n      basePath.newPos = newPos;\n      return oldPos;\n    },\n    equals: function equals(left, right) {\n      if (this.options.comparator) {\n        return this.options.comparator(left, right);\n      } else {\n        return left === right || this.options.ignoreCase && left.toLowerCase() === right.toLowerCase();\n      }\n    },\n    removeEmpty: function removeEmpty(array) {\n      var ret = [];\n\n      for (var i = 0; i < array.length; i++) {\n        if (array[i]) {\n          ret.push(array[i]);\n        }\n      }\n\n      return ret;\n    },\n    castInput: function castInput(value) {\n      return value;\n    },\n    tokenize: function tokenize(value) {\n      return value.split('');\n    },\n    join: function join(chars) {\n      return chars.join('');\n    }\n  };\n\n  function buildValues(diff, components, newString, oldString, useLongestToken) {\n    var componentPos = 0,\n        componentLen = components.length,\n        newPos = 0,\n        oldPos = 0;\n\n    for (; componentPos < componentLen; componentPos++) {\n      var component = components[componentPos];\n\n      if (!component.removed) {\n        if (!component.added && useLongestToken) {\n          var value = newString.slice(newPos, newPos + component.count);\n          value = value.map(function (value, i) {\n            var oldValue = oldString[oldPos + i];\n            return oldValue.length > value.length ? oldValue : value;\n          });\n          component.value = diff.join(value);\n        } else {\n          component.value = diff.join(newString.slice(newPos, newPos + component.count));\n        }\n\n        newPos += component.count; // Common case\n\n        if (!component.added) {\n          oldPos += component.count;\n        }\n      } else {\n        component.value = diff.join(oldString.slice(oldPos, oldPos + component.count));\n        oldPos += component.count; // Reverse add and remove so removes are output first to match common convention\n        // The diffing algorithm is tied to add then remove output and this is the simplest\n        // route to get the desired output with minimal overhead.\n\n        if (componentPos && components[componentPos - 1].added) {\n          var tmp = components[componentPos - 1];\n          components[componentPos - 1] = components[componentPos];\n          components[componentPos] = tmp;\n        }\n      }\n    } // Special case handle for when one terminal is ignored (i.e. whitespace).\n    // For this case we merge the terminal into the prior string and drop the change.\n    // This is only available for string mode.\n\n\n    var lastComponent = components[componentLen - 1];\n\n    if (componentLen > 1 && typeof lastComponent.value === 'string' && (lastComponent.added || lastComponent.removed) && diff.equals('', lastComponent.value)) {\n      components[componentLen - 2].value += lastComponent.value;\n      components.pop();\n    }\n\n    return components;\n  }\n\n  function clonePath(path) {\n    return {\n      newPos: path.newPos,\n      components: path.components.slice(0)\n    };\n  }\n\n  var characterDiff = new Diff();\n  function diffChars(oldStr, newStr, options) {\n    return characterDiff.diff(oldStr, newStr, options);\n  }\n\n  function generateOptions(options, defaults) {\n    if (typeof options === 'function') {\n      defaults.callback = options;\n    } else if (options) {\n      for (var name in options) {\n        /* istanbul ignore else */\n        if (options.hasOwnProperty(name)) {\n          defaults[name] = options[name];\n        }\n      }\n    }\n\n    return defaults;\n  }\n\n  //\n  // Ranges and exceptions:\n  // Latin-1 Supplement, 0080–00FF\n  //  - U+00D7  × Multiplication sign\n  //  - U+00F7  ÷ Division sign\n  // Latin Extended-A, 0100–017F\n  // Latin Extended-B, 0180–024F\n  // IPA Extensions, 0250–02AF\n  // Spacing Modifier Letters, 02B0–02FF\n  //  - U+02C7  ˇ &#711;  Caron\n  //  - U+02D8  ˘ &#728;  Breve\n  //  - U+02D9  ˙ &#729;  Dot Above\n  //  - U+02DA  ˚ &#730;  Ring Above\n  //  - U+02DB  ˛ &#731;  Ogonek\n  //  - U+02DC  ˜ &#732;  Small Tilde\n  //  - U+02DD  ˝ &#733;  Double Acute Accent\n  // Latin Extended Additional, 1E00–1EFF\n\n  var extendedWordChars = /^[A-Za-z\\xC0-\\u02C6\\u02C8-\\u02D7\\u02DE-\\u02FF\\u1E00-\\u1EFF]+$/;\n  var reWhitespace = /\\S/;\n  var wordDiff = new Diff();\n\n  wordDiff.equals = function (left, right) {\n    if (this.options.ignoreCase) {\n      left = left.toLowerCase();\n      right = right.toLowerCase();\n    }\n\n    return left === right || this.options.ignoreWhitespace && !reWhitespace.test(left) && !reWhitespace.test(right);\n  };\n\n  wordDiff.tokenize = function (value) {\n    // All whitespace symbols except newline group into one token, each newline - in separate token\n    var tokens = value.split(/([^\\S\\r\\n]+|[()[\\]{}'\"\\r\\n]|\\b)/); // Join the boundary splits that we do not consider to be boundaries. This is primarily the extended Latin character set.\n\n    for (var i = 0; i < tokens.length - 1; i++) {\n      // If we have an empty string in the next field and we have only word chars before and after, merge\n      if (!tokens[i + 1] && tokens[i + 2] && extendedWordChars.test(tokens[i]) && extendedWordChars.test(tokens[i + 2])) {\n        tokens[i] += tokens[i + 2];\n        tokens.splice(i + 1, 2);\n        i--;\n      }\n    }\n\n    return tokens;\n  };\n\n  function diffWords(oldStr, newStr, options) {\n    options = generateOptions(options, {\n      ignoreWhitespace: true\n    });\n    return wordDiff.diff(oldStr, newStr, options);\n  }\n  function diffWordsWithSpace(oldStr, newStr, options) {\n    return wordDiff.diff(oldStr, newStr, options);\n  }\n\n  var lineDiff = new Diff();\n\n  lineDiff.tokenize = function (value) {\n    var retLines = [],\n        linesAndNewlines = value.split(/(\\n|\\r\\n)/); // Ignore the final empty token that occurs if the string ends with a new line\n\n    if (!linesAndNewlines[linesAndNewlines.length - 1]) {\n      linesAndNewlines.pop();\n    } // Merge the content and line separators into single tokens\n\n\n    for (var i = 0; i < linesAndNewlines.length; i++) {\n      var line = linesAndNewlines[i];\n\n      if (i % 2 && !this.options.newlineIsToken) {\n        retLines[retLines.length - 1] += line;\n      } else {\n        if (this.options.ignoreWhitespace) {\n          line = line.trim();\n        }\n\n        retLines.push(line);\n      }\n    }\n\n    return retLines;\n  };\n\n  function diffLines(oldStr, newStr, callback) {\n    return lineDiff.diff(oldStr, newStr, callback);\n  }\n  function diffTrimmedLines(oldStr, newStr, callback) {\n    var options = generateOptions(callback, {\n      ignoreWhitespace: true\n    });\n    return lineDiff.diff(oldStr, newStr, options);\n  }\n\n  var sentenceDiff = new Diff();\n\n  sentenceDiff.tokenize = function (value) {\n    return value.split(/(\\S.+?[.!?])(?=\\s+|$)/);\n  };\n\n  function diffSentences(oldStr, newStr, callback) {\n    return sentenceDiff.diff(oldStr, newStr, callback);\n  }\n\n  var cssDiff = new Diff();\n\n  cssDiff.tokenize = function (value) {\n    return value.split(/([{}:;,]|\\s+)/);\n  };\n\n  function diffCss(oldStr, newStr, callback) {\n    return cssDiff.diff(oldStr, newStr, callback);\n  }\n\n  function _typeof(obj) {\n    \"@babel/helpers - typeof\";\n\n    if (typeof Symbol === \"function\" && typeof Symbol.iterator === \"symbol\") {\n      _typeof = function (obj) {\n        return typeof obj;\n      };\n    } else {\n      _typeof = function (obj) {\n        return obj && typeof Symbol === \"function\" && obj.constructor === Symbol && obj !== Symbol.prototype ? \"symbol\" : typeof obj;\n      };\n    }\n\n    return _typeof(obj);\n  }\n\n  function _toConsumableArray(arr) {\n    return _arrayWithoutHoles(arr) || _iterableToArray(arr) || _unsupportedIterableToArray(arr) || _nonIterableSpread();\n  }\n\n  function _arrayWithoutHoles(arr) {\n    if (Array.isArray(arr)) return _arrayLikeToArray(arr);\n  }\n\n  function _iterableToArray(iter) {\n    if (typeof Symbol !== \"undefined\" && Symbol.iterator in Object(iter)) return Array.from(iter);\n  }\n\n  function _unsupportedIterableToArray(o, minLen) {\n    if (!o) return;\n    if (typeof o === \"string\") return _arrayLikeToArray(o, minLen);\n    var n = Object.prototype.toString.call(o).slice(8, -1);\n    if (n === \"Object\" && o.constructor) n = o.constructor.name;\n    if (n === \"Map\" || n === \"Set\") return Array.from(o);\n    if (n === \"Arguments\" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _arrayLikeToArray(o, minLen);\n  }\n\n  function _arrayLikeToArray(arr, len) {\n    if (len == null || len > arr.length) len = arr.length;\n\n    for (var i = 0, arr2 = new Array(len); i < len; i++) arr2[i] = arr[i];\n\n    return arr2;\n  }\n\n  function _nonIterableSpread() {\n    throw new TypeError(\"Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.\");\n  }\n\n  var objectPrototypeToString = Object.prototype.toString;\n  var jsonDiff = new Diff(); // Discriminate between two lines of pretty-printed, serialized JSON where one of them has a\n  // dangling comma and the other doesn't. Turns out including the dangling comma yields the nicest output:\n\n  jsonDiff.useLongestToken = true;\n  jsonDiff.tokenize = lineDiff.tokenize;\n\n  jsonDiff.castInput = function (value) {\n    var _this$options = this.options,\n        undefinedReplacement = _this$options.undefinedReplacement,\n        _this$options$stringi = _this$options.stringifyReplacer,\n        stringifyReplacer = _this$options$stringi === void 0 ? function (k, v) {\n      return typeof v === 'undefined' ? undefinedReplacement : v;\n    } : _this$options$stringi;\n    return typeof value === 'string' ? value : JSON.stringify(canonicalize(value, null, null, stringifyReplacer), stringifyReplacer, '  ');\n  };\n\n  jsonDiff.equals = function (left, right) {\n    return Diff.prototype.equals.call(jsonDiff, left.replace(/,([\\r\\n])/g, '$1'), right.replace(/,([\\r\\n])/g, '$1'));\n  };\n\n  function diffJson(oldObj, newObj, options) {\n    return jsonDiff.diff(oldObj, newObj, options);\n  } // This function handles the presence of circular references by bailing out when encountering an\n  // object that is already on the \"stack\" of items being processed. Accepts an optional replacer\n\n  function canonicalize(obj, stack, replacementStack, replacer, key) {\n    stack = stack || [];\n    replacementStack = replacementStack || [];\n\n    if (replacer) {\n      obj = replacer(key, obj);\n    }\n\n    var i;\n\n    for (i = 0; i < stack.length; i += 1) {\n      if (stack[i] === obj) {\n        return replacementStack[i];\n      }\n    }\n\n    var canonicalizedObj;\n\n    if ('[object Array]' === objectPrototypeToString.call(obj)) {\n      stack.push(obj);\n      canonicalizedObj = new Array(obj.length);\n      replacementStack.push(canonicalizedObj);\n\n      for (i = 0; i < obj.length; i += 1) {\n        canonicalizedObj[i] = canonicalize(obj[i], stack, replacementStack, replacer, key);\n      }\n\n      stack.pop();\n      replacementStack.pop();\n      return canonicalizedObj;\n    }\n\n    if (obj && obj.toJSON) {\n      obj = obj.toJSON();\n    }\n\n    if (_typeof(obj) === 'object' && obj !== null) {\n      stack.push(obj);\n      canonicalizedObj = {};\n      replacementStack.push(canonicalizedObj);\n\n      var sortedKeys = [],\n          _key;\n\n      for (_key in obj) {\n        /* istanbul ignore else */\n        if (obj.hasOwnProperty(_key)) {\n          sortedKeys.push(_key);\n        }\n      }\n\n      sortedKeys.sort();\n\n      for (i = 0; i < sortedKeys.length; i += 1) {\n        _key = sortedKeys[i];\n        canonicalizedObj[_key] = canonicalize(obj[_key], stack, replacementStack, replacer, _key);\n      }\n\n      stack.pop();\n      replacementStack.pop();\n    } else {\n      canonicalizedObj = obj;\n    }\n\n    return canonicalizedObj;\n  }\n\n  var arrayDiff = new Diff();\n\n  arrayDiff.tokenize = function (value) {\n    return value.slice();\n  };\n\n  arrayDiff.join = arrayDiff.removeEmpty = function (value) {\n    return value;\n  };\n\n  function diffArrays(oldArr, newArr, callback) {\n    return arrayDiff.diff(oldArr, newArr, callback);\n  }\n\n  function parsePatch(uniDiff) {\n    var options = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};\n    var diffstr = uniDiff.split(/\\r\\n|[\\n\\v\\f\\r\\x85]/),\n        delimiters = uniDiff.match(/\\r\\n|[\\n\\v\\f\\r\\x85]/g) || [],\n        list = [],\n        i = 0;\n\n    function parseIndex() {\n      var index = {};\n      list.push(index); // Parse diff metadata\n\n      while (i < diffstr.length) {\n        var line = diffstr[i]; // File header found, end parsing diff metadata\n\n        if (/^(\\-\\-\\-|\\+\\+\\+|@@)\\s/.test(line)) {\n          break;\n        } // Diff index\n\n\n        var header = /^(?:Index:|diff(?: -r \\w+)+)\\s+(.+?)\\s*$/.exec(line);\n\n        if (header) {\n          index.index = header[1];\n        }\n\n        i++;\n      } // Parse file headers if they are defined. Unified diff requires them, but\n      // there's no technical issues to have an isolated hunk without file header\n\n\n      parseFileHeader(index);\n      parseFileHeader(index); // Parse hunks\n\n      index.hunks = [];\n\n      while (i < diffstr.length) {\n        var _line = diffstr[i];\n\n        if (/^(Index:|diff|\\-\\-\\-|\\+\\+\\+)\\s/.test(_line)) {\n          break;\n        } else if (/^@@/.test(_line)) {\n          index.hunks.push(parseHunk());\n        } else if (_line && options.strict) {\n          // Ignore unexpected content unless in strict mode\n          throw new Error('Unknown line ' + (i + 1) + ' ' + JSON.stringify(_line));\n        } else {\n          i++;\n        }\n      }\n    } // Parses the --- and +++ headers, if none are found, no lines\n    // are consumed.\n\n\n    function parseFileHeader(index) {\n      var fileHeader = /^(---|\\+\\+\\+)\\s+(.*)$/.exec(diffstr[i]);\n\n      if (fileHeader) {\n        var keyPrefix = fileHeader[1] === '---' ? 'old' : 'new';\n        var data = fileHeader[2].split('\\t', 2);\n        var fileName = data[0].replace(/\\\\\\\\/g, '\\\\');\n\n        if (/^\".*\"$/.test(fileName)) {\n          fileName = fileName.substr(1, fileName.length - 2);\n        }\n\n        index[keyPrefix + 'FileName'] = fileName;\n        index[keyPrefix + 'Header'] = (data[1] || '').trim();\n        i++;\n      }\n    } // Parses a hunk\n    // This assumes that we are at the start of a hunk.\n\n\n    function parseHunk() {\n      var chunkHeaderIndex = i,\n          chunkHeaderLine = diffstr[i++],\n          chunkHeader = chunkHeaderLine.split(/@@ -(\\d+)(?:,(\\d+))? \\+(\\d+)(?:,(\\d+))? @@/);\n      var hunk = {\n        oldStart: +chunkHeader[1],\n        oldLines: typeof chunkHeader[2] === 'undefined' ? 1 : +chunkHeader[2],\n        newStart: +chunkHeader[3],\n        newLines: typeof chunkHeader[4] === 'undefined' ? 1 : +chunkHeader[4],\n        lines: [],\n        linedelimiters: []\n      }; // Unified Diff Format quirk: If the chunk size is 0,\n      // the first number is one lower than one would expect.\n      // https://www.artima.com/weblogs/viewpost.jsp?thread=164293\n\n      if (hunk.oldLines === 0) {\n        hunk.oldStart += 1;\n      }\n\n      if (hunk.newLines === 0) {\n        hunk.newStart += 1;\n      }\n\n      var addCount = 0,\n          removeCount = 0;\n\n      for (; i < diffstr.length; i++) {\n        // Lines starting with '---' could be mistaken for the \"remove line\" operation\n        // But they could be the header for the next file. Therefore prune such cases out.\n        if (diffstr[i].indexOf('--- ') === 0 && i + 2 < diffstr.length && diffstr[i + 1].indexOf('+++ ') === 0 && diffstr[i + 2].indexOf('@@') === 0) {\n          break;\n        }\n\n        var operation = diffstr[i].length == 0 && i != diffstr.length - 1 ? ' ' : diffstr[i][0];\n\n        if (operation === '+' || operation === '-' || operation === ' ' || operation === '\\\\') {\n          hunk.lines.push(diffstr[i]);\n          hunk.linedelimiters.push(delimiters[i] || '\\n');\n\n          if (operation === '+') {\n            addCount++;\n          } else if (operation === '-') {\n            removeCount++;\n          } else if (operation === ' ') {\n            addCount++;\n            removeCount++;\n          }\n        } else {\n          break;\n        }\n      } // Handle the empty block count case\n\n\n      if (!addCount && hunk.newLines === 1) {\n        hunk.newLines = 0;\n      }\n\n      if (!removeCount && hunk.oldLines === 1) {\n        hunk.oldLines = 0;\n      } // Perform optional sanity checking\n\n\n      if (options.strict) {\n        if (addCount !== hunk.newLines) {\n          throw new Error('Added line count did not match for hunk at line ' + (chunkHeaderIndex + 1));\n        }\n\n        if (removeCount !== hunk.oldLines) {\n          throw new Error('Removed line count did not match for hunk at line ' + (chunkHeaderIndex + 1));\n        }\n      }\n\n      return hunk;\n    }\n\n    while (i < diffstr.length) {\n      parseIndex();\n    }\n\n    return list;\n  }\n\n  // Iterator that traverses in the range of [min, max], stepping\n  // by distance from a given start position. I.e. for [0, 4], with\n  // start of 2, this will iterate 2, 3, 1, 4, 0.\n  function distanceIterator (start, minLine, maxLine) {\n    var wantForward = true,\n        backwardExhausted = false,\n        forwardExhausted = false,\n        localOffset = 1;\n    return function iterator() {\n      if (wantForward && !forwardExhausted) {\n        if (backwardExhausted) {\n          localOffset++;\n        } else {\n          wantForward = false;\n        } // Check if trying to fit beyond text length, and if not, check it fits\n        // after offset location (or desired location on first iteration)\n\n\n        if (start + localOffset <= maxLine) {\n          return localOffset;\n        }\n\n        forwardExhausted = true;\n      }\n\n      if (!backwardExhausted) {\n        if (!forwardExhausted) {\n          wantForward = true;\n        } // Check if trying to fit before text beginning, and if not, check it fits\n        // before offset location\n\n\n        if (minLine <= start - localOffset) {\n          return -localOffset++;\n        }\n\n        backwardExhausted = true;\n        return iterator();\n      } // We tried to fit hunk before text beginning and beyond text length, then\n      // hunk can't fit on the text. Return undefined\n\n    };\n  }\n\n  function applyPatch(source, uniDiff) {\n    var options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};\n\n    if (typeof uniDiff === 'string') {\n      uniDiff = parsePatch(uniDiff);\n    }\n\n    if (Array.isArray(uniDiff)) {\n      if (uniDiff.length > 1) {\n        throw new Error('applyPatch only works with a single input.');\n      }\n\n      uniDiff = uniDiff[0];\n    } // Apply the diff to the input\n\n\n    var lines = source.split(/\\r\\n|[\\n\\v\\f\\r\\x85]/),\n        delimiters = source.match(/\\r\\n|[\\n\\v\\f\\r\\x85]/g) || [],\n        hunks = uniDiff.hunks,\n        compareLine = options.compareLine || function (lineNumber, line, operation, patchContent) {\n      return line === patchContent;\n    },\n        errorCount = 0,\n        fuzzFactor = options.fuzzFactor || 0,\n        minLine = 0,\n        offset = 0,\n        removeEOFNL,\n        addEOFNL;\n    /**\n     * Checks if the hunk exactly fits on the provided location\n     */\n\n\n    function hunkFits(hunk, toPos) {\n      for (var j = 0; j < hunk.lines.length; j++) {\n        var line = hunk.lines[j],\n            operation = line.length > 0 ? line[0] : ' ',\n            content = line.length > 0 ? line.substr(1) : line;\n\n        if (operation === ' ' || operation === '-') {\n          // Context sanity check\n          if (!compareLine(toPos + 1, lines[toPos], operation, content)) {\n            errorCount++;\n\n            if (errorCount > fuzzFactor) {\n              return false;\n            }\n          }\n\n          toPos++;\n        }\n      }\n\n      return true;\n    } // Search best fit offsets for each hunk based on the previous ones\n\n\n    for (var i = 0; i < hunks.length; i++) {\n      var hunk = hunks[i],\n          maxLine = lines.length - hunk.oldLines,\n          localOffset = 0,\n          toPos = offset + hunk.oldStart - 1;\n      var iterator = distanceIterator(toPos, minLine, maxLine);\n\n      for (; localOffset !== undefined; localOffset = iterator()) {\n        if (hunkFits(hunk, toPos + localOffset)) {\n          hunk.offset = offset += localOffset;\n          break;\n        }\n      }\n\n      if (localOffset === undefined) {\n        return false;\n      } // Set lower text limit to end of the current hunk, so next ones don't try\n      // to fit over already patched text\n\n\n      minLine = hunk.offset + hunk.oldStart + hunk.oldLines;\n    } // Apply patch hunks\n\n\n    var diffOffset = 0;\n\n    for (var _i = 0; _i < hunks.length; _i++) {\n      var _hunk = hunks[_i],\n          _toPos = _hunk.oldStart + _hunk.offset + diffOffset - 1;\n\n      diffOffset += _hunk.newLines - _hunk.oldLines;\n\n      for (var j = 0; j < _hunk.lines.length; j++) {\n        var line = _hunk.lines[j],\n            operation = line.length > 0 ? line[0] : ' ',\n            content = line.length > 0 ? line.substr(1) : line,\n            delimiter = _hunk.linedelimiters[j];\n\n        if (operation === ' ') {\n          _toPos++;\n        } else if (operation === '-') {\n          lines.splice(_toPos, 1);\n          delimiters.splice(_toPos, 1);\n          /* istanbul ignore else */\n        } else if (operation === '+') {\n          lines.splice(_toPos, 0, content);\n          delimiters.splice(_toPos, 0, delimiter);\n          _toPos++;\n        } else if (operation === '\\\\') {\n          var previousOperation = _hunk.lines[j - 1] ? _hunk.lines[j - 1][0] : null;\n\n          if (previousOperation === '+') {\n            removeEOFNL = true;\n          } else if (previousOperation === '-') {\n            addEOFNL = true;\n          }\n        }\n      }\n    } // Handle EOFNL insertion/removal\n\n\n    if (removeEOFNL) {\n      while (!lines[lines.length - 1]) {\n        lines.pop();\n        delimiters.pop();\n      }\n    } else if (addEOFNL) {\n      lines.push('');\n      delimiters.push('\\n');\n    }\n\n    for (var _k = 0; _k < lines.length - 1; _k++) {\n      lines[_k] = lines[_k] + delimiters[_k];\n    }\n\n    return lines.join('');\n  } // Wrapper that supports multiple file patches via callbacks.\n\n  function applyPatches(uniDiff, options) {\n    if (typeof uniDiff === 'string') {\n      uniDiff = parsePatch(uniDiff);\n    }\n\n    var currentIndex = 0;\n\n    function processIndex() {\n      var index = uniDiff[currentIndex++];\n\n      if (!index) {\n        return options.complete();\n      }\n\n      options.loadFile(index, function (err, data) {\n        if (err) {\n          return options.complete(err);\n        }\n\n        var updatedContent = applyPatch(data, index, options);\n        options.patched(index, updatedContent, function (err) {\n          if (err) {\n            return options.complete(err);\n          }\n\n          processIndex();\n        });\n      });\n    }\n\n    processIndex();\n  }\n\n  function structuredPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, newHeader, options) {\n    if (!options) {\n      options = {};\n    }\n\n    if (typeof options.context === 'undefined') {\n      options.context = 4;\n    }\n\n    var diff = diffLines(oldStr, newStr, options);\n\n    if (!diff) {\n      return;\n    }\n\n    diff.push({\n      value: '',\n      lines: []\n    }); // Append an empty value to make cleanup easier\n\n    function contextLines(lines) {\n      return lines.map(function (entry) {\n        return ' ' + entry;\n      });\n    }\n\n    var hunks = [];\n    var oldRangeStart = 0,\n        newRangeStart = 0,\n        curRange = [],\n        oldLine = 1,\n        newLine = 1;\n\n    var _loop = function _loop(i) {\n      var current = diff[i],\n          lines = current.lines || current.value.replace(/\\n$/, '').split('\\n');\n      current.lines = lines;\n\n      if (current.added || current.removed) {\n        var _curRange;\n\n        // If we have previous context, start with that\n        if (!oldRangeStart) {\n          var prev = diff[i - 1];\n          oldRangeStart = oldLine;\n          newRangeStart = newLine;\n\n          if (prev) {\n            curRange = options.context > 0 ? contextLines(prev.lines.slice(-options.context)) : [];\n            oldRangeStart -= curRange.length;\n            newRangeStart -= curRange.length;\n          }\n        } // Output our changes\n\n\n        (_curRange = curRange).push.apply(_curRange, _toConsumableArray(lines.map(function (entry) {\n          return (current.added ? '+' : '-') + entry;\n        }))); // Track the updated file position\n\n\n        if (current.added) {\n          newLine += lines.length;\n        } else {\n          oldLine += lines.length;\n        }\n      } else {\n        // Identical context lines. Track line changes\n        if (oldRangeStart) {\n          // Close out any changes that have been output (or join overlapping)\n          if (lines.length <= options.context * 2 && i < diff.length - 2) {\n            var _curRange2;\n\n            // Overlapping\n            (_curRange2 = curRange).push.apply(_curRange2, _toConsumableArray(contextLines(lines)));\n          } else {\n            var _curRange3;\n\n            // end the range and output\n            var contextSize = Math.min(lines.length, options.context);\n\n            (_curRange3 = curRange).push.apply(_curRange3, _toConsumableArray(contextLines(lines.slice(0, contextSize))));\n\n            var hunk = {\n              oldStart: oldRangeStart,\n              oldLines: oldLine - oldRangeStart + contextSize,\n              newStart: newRangeStart,\n              newLines: newLine - newRangeStart + contextSize,\n              lines: curRange\n            };\n\n            if (i >= diff.length - 2 && lines.length <= options.context) {\n              // EOF is inside this hunk\n              var oldEOFNewline = /\\n$/.test(oldStr);\n              var newEOFNewline = /\\n$/.test(newStr);\n              var noNlBeforeAdds = lines.length == 0 && curRange.length > hunk.oldLines;\n\n              if (!oldEOFNewline && noNlBeforeAdds && oldStr.length > 0) {\n                // special case: old has no eol and no trailing context; no-nl can end up before adds\n                // however, if the old file is empty, do not output the no-nl line\n                curRange.splice(hunk.oldLines, 0, '\\\\ No newline at end of file');\n              }\n\n              if (!oldEOFNewline && !noNlBeforeAdds || !newEOFNewline) {\n                curRange.push('\\\\ No newline at end of file');\n              }\n            }\n\n            hunks.push(hunk);\n            oldRangeStart = 0;\n            newRangeStart = 0;\n            curRange = [];\n          }\n        }\n\n        oldLine += lines.length;\n        newLine += lines.length;\n      }\n    };\n\n    for (var i = 0; i < diff.length; i++) {\n      _loop(i);\n    }\n\n    return {\n      oldFileName: oldFileName,\n      newFileName: newFileName,\n      oldHeader: oldHeader,\n      newHeader: newHeader,\n      hunks: hunks\n    };\n  }\n  function formatPatch(diff) {\n    if (!diff.hunks.length) {\n      return ''\n    }\n    var ret = [];\n\n    if (diff.oldFileName == diff.newFileName) {\n      ret.push('Index: ' + diff.oldFileName);\n    }\n\n    ret.push('===================================================================');\n    ret.push('--- ' + diff.oldFileName + (typeof diff.oldHeader === 'undefined' ? '' : '\\t' + diff.oldHeader));\n    ret.push('+++ ' + diff.newFileName + (typeof diff.newHeader === 'undefined' ? '' : '\\t' + diff.newHeader));\n\n    for (var i = 0; i < diff.hunks.length; i++) {\n      var hunk = diff.hunks[i]; // Unified Diff Format quirk: If the chunk size is 0,\n      // the first number is one lower than one would expect.\n      // https://www.artima.com/weblogs/viewpost.jsp?thread=164293\n\n      if (hunk.oldLines === 0) {\n        hunk.oldStart -= 1;\n      }\n\n      if (hunk.newLines === 0) {\n        hunk.newStart -= 1;\n      }\n\n      ret.push('@@ -' + hunk.oldStart + ',' + hunk.oldLines + ' +' + hunk.newStart + ',' + hunk.newLines + ' @@');\n      ret.push.apply(ret, hunk.lines);\n    }\n\n    return ret.join('\\n') + '\\n';\n  }\n  function createTwoFilesPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, newHeader, options) {\n    return formatPatch(structuredPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, newHeader, options));\n  }\n  function createPatch(fileName, oldStr, newStr, oldHeader, newHeader, options) {\n    return createTwoFilesPatch(fileName, fileName, oldStr, newStr, oldHeader, newHeader, options);\n  }\n\n  function arrayEqual(a, b) {\n    if (a.length !== b.length) {\n      return false;\n    }\n\n    return arrayStartsWith(a, b);\n  }\n  function arrayStartsWith(array, start) {\n    if (start.length > array.length) {\n      return false;\n    }\n\n    for (var i = 0; i < start.length; i++) {\n      if (start[i] !== array[i]) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  function calcLineCount(hunk) {\n    var _calcOldNewLineCount = calcOldNewLineCount(hunk.lines),\n        oldLines = _calcOldNewLineCount.oldLines,\n        newLines = _calcOldNewLineCount.newLines;\n\n    if (oldLines !== undefined) {\n      hunk.oldLines = oldLines;\n    } else {\n      delete hunk.oldLines;\n    }\n\n    if (newLines !== undefined) {\n      hunk.newLines = newLines;\n    } else {\n      delete hunk.newLines;\n    }\n  }\n  function merge(mine, theirs, base) {\n    mine = loadPatch(mine, base);\n    theirs = loadPatch(theirs, base);\n    var ret = {}; // For index we just let it pass through as it doesn't have any necessary meaning.\n    // Leaving sanity checks on this to the API consumer that may know more about the\n    // meaning in their own context.\n\n    if (mine.index || theirs.index) {\n      ret.index = mine.index || theirs.index;\n    }\n\n    if (mine.newFileName || theirs.newFileName) {\n      if (!fileNameChanged(mine)) {\n        // No header or no change in ours, use theirs (and ours if theirs does not exist)\n        ret.oldFileName = theirs.oldFileName || mine.oldFileName;\n        ret.newFileName = theirs.newFileName || mine.newFileName;\n        ret.oldHeader = theirs.oldHeader || mine.oldHeader;\n        ret.newHeader = theirs.newHeader || mine.newHeader;\n      } else if (!fileNameChanged(theirs)) {\n        // No header or no change in theirs, use ours\n        ret.oldFileName = mine.oldFileName;\n        ret.newFileName = mine.newFileName;\n        ret.oldHeader = mine.oldHeader;\n        ret.newHeader = mine.newHeader;\n      } else {\n        // Both changed... figure it out\n        ret.oldFileName = selectField(ret, mine.oldFileName, theirs.oldFileName);\n        ret.newFileName = selectField(ret, mine.newFileName, theirs.newFileName);\n        ret.oldHeader = selectField(ret, mine.oldHeader, theirs.oldHeader);\n        ret.newHeader = selectField(ret, mine.newHeader, theirs.newHeader);\n      }\n    }\n\n    ret.hunks = [];\n    var mineIndex = 0,\n        theirsIndex = 0,\n        mineOffset = 0,\n        theirsOffset = 0;\n\n    while (mineIndex < mine.hunks.length || theirsIndex < theirs.hunks.length) {\n      var mineCurrent = mine.hunks[mineIndex] || {\n        oldStart: Infinity\n      },\n          theirsCurrent = theirs.hunks[theirsIndex] || {\n        oldStart: Infinity\n      };\n\n      if (hunkBefore(mineCurrent, theirsCurrent)) {\n        // This patch does not overlap with any of the others, yay.\n        ret.hunks.push(cloneHunk(mineCurrent, mineOffset));\n        mineIndex++;\n        theirsOffset += mineCurrent.newLines - mineCurrent.oldLines;\n      } else if (hunkBefore(theirsCurrent, mineCurrent)) {\n        // This patch does not overlap with any of the others, yay.\n        ret.hunks.push(cloneHunk(theirsCurrent, theirsOffset));\n        theirsIndex++;\n        mineOffset += theirsCurrent.newLines - theirsCurrent.oldLines;\n      } else {\n        // Overlap, merge as best we can\n        var mergedHunk = {\n          oldStart: Math.min(mineCurrent.oldStart, theirsCurrent.oldStart),\n          oldLines: 0,\n          newStart: Math.min(mineCurrent.newStart + mineOffset, theirsCurrent.oldStart + theirsOffset),\n          newLines: 0,\n          lines: []\n        };\n        mergeLines(mergedHunk, mineCurrent.oldStart, mineCurrent.lines, theirsCurrent.oldStart, theirsCurrent.lines);\n        theirsIndex++;\n        mineIndex++;\n        ret.hunks.push(mergedHunk);\n      }\n    }\n\n    return ret;\n  }\n\n  function loadPatch(param, base) {\n    if (typeof param === 'string') {\n      if (/^@@/m.test(param) || /^Index:/m.test(param)) {\n        return parsePatch(param)[0];\n      }\n\n      if (!base) {\n        throw new Error('Must provide a base reference or pass in a patch');\n      }\n\n      return structuredPatch(undefined, undefined, base, param);\n    }\n\n    return param;\n  }\n\n  function fileNameChanged(patch) {\n    return patch.newFileName && patch.newFileName !== patch.oldFileName;\n  }\n\n  function selectField(index, mine, theirs) {\n    if (mine === theirs) {\n      return mine;\n    } else {\n      index.conflict = true;\n      return {\n        mine: mine,\n        theirs: theirs\n      };\n    }\n  }\n\n  function hunkBefore(test, check) {\n    return test.oldStart < check.oldStart && test.oldStart + test.oldLines < check.oldStart;\n  }\n\n  function cloneHunk(hunk, offset) {\n    return {\n      oldStart: hunk.oldStart,\n      oldLines: hunk.oldLines,\n      newStart: hunk.newStart + offset,\n      newLines: hunk.newLines,\n      lines: hunk.lines\n    };\n  }\n\n  function mergeLines(hunk, mineOffset, mineLines, theirOffset, theirLines) {\n    // This will generally result in a conflicted hunk, but there are cases where the context\n    // is the only overlap where we can successfully merge the content here.\n    var mine = {\n      offset: mineOffset,\n      lines: mineLines,\n      index: 0\n    },\n        their = {\n      offset: theirOffset,\n      lines: theirLines,\n      index: 0\n    }; // Handle any leading content\n\n    insertLeading(hunk, mine, their);\n    insertLeading(hunk, their, mine); // Now in the overlap content. Scan through and select the best changes from each.\n\n    while (mine.index < mine.lines.length && their.index < their.lines.length) {\n      var mineCurrent = mine.lines[mine.index],\n          theirCurrent = their.lines[their.index];\n\n      if ((mineCurrent[0] === '-' || mineCurrent[0] === '+') && (theirCurrent[0] === '-' || theirCurrent[0] === '+')) {\n        // Both modified ...\n        mutualChange(hunk, mine, their);\n      } else if (mineCurrent[0] === '+' && theirCurrent[0] === ' ') {\n        var _hunk$lines;\n\n        // Mine inserted\n        (_hunk$lines = hunk.lines).push.apply(_hunk$lines, _toConsumableArray(collectChange(mine)));\n      } else if (theirCurrent[0] === '+' && mineCurrent[0] === ' ') {\n        var _hunk$lines2;\n\n        // Theirs inserted\n        (_hunk$lines2 = hunk.lines).push.apply(_hunk$lines2, _toConsumableArray(collectChange(their)));\n      } else if (mineCurrent[0] === '-' && theirCurrent[0] === ' ') {\n        // Mine removed or edited\n        removal(hunk, mine, their);\n      } else if (theirCurrent[0] === '-' && mineCurrent[0] === ' ') {\n        // Their removed or edited\n        removal(hunk, their, mine, true);\n      } else if (mineCurrent === theirCurrent) {\n        // Context identity\n        hunk.lines.push(mineCurrent);\n        mine.index++;\n        their.index++;\n      } else {\n        // Context mismatch\n        conflict(hunk, collectChange(mine), collectChange(their));\n      }\n    } // Now push anything that may be remaining\n\n\n    insertTrailing(hunk, mine);\n    insertTrailing(hunk, their);\n    calcLineCount(hunk);\n  }\n\n  function mutualChange(hunk, mine, their) {\n    var myChanges = collectChange(mine),\n        theirChanges = collectChange(their);\n\n    if (allRemoves(myChanges) && allRemoves(theirChanges)) {\n      // Special case for remove changes that are supersets of one another\n      if (arrayStartsWith(myChanges, theirChanges) && skipRemoveSuperset(their, myChanges, myChanges.length - theirChanges.length)) {\n        var _hunk$lines3;\n\n        (_hunk$lines3 = hunk.lines).push.apply(_hunk$lines3, _toConsumableArray(myChanges));\n\n        return;\n      } else if (arrayStartsWith(theirChanges, myChanges) && skipRemoveSuperset(mine, theirChanges, theirChanges.length - myChanges.length)) {\n        var _hunk$lines4;\n\n        (_hunk$lines4 = hunk.lines).push.apply(_hunk$lines4, _toConsumableArray(theirChanges));\n\n        return;\n      }\n    } else if (arrayEqual(myChanges, theirChanges)) {\n      var _hunk$lines5;\n\n      (_hunk$lines5 = hunk.lines).push.apply(_hunk$lines5, _toConsumableArray(myChanges));\n\n      return;\n    }\n\n    conflict(hunk, myChanges, theirChanges);\n  }\n\n  function removal(hunk, mine, their, swap) {\n    var myChanges = collectChange(mine),\n        theirChanges = collectContext(their, myChanges);\n\n    if (theirChanges.merged) {\n      var _hunk$lines6;\n\n      (_hunk$lines6 = hunk.lines).push.apply(_hunk$lines6, _toConsumableArray(theirChanges.merged));\n    } else {\n      conflict(hunk, swap ? theirChanges : myChanges, swap ? myChanges : theirChanges);\n    }\n  }\n\n  function conflict(hunk, mine, their) {\n    hunk.conflict = true;\n    hunk.lines.push({\n      conflict: true,\n      mine: mine,\n      theirs: their\n    });\n  }\n\n  function insertLeading(hunk, insert, their) {\n    while (insert.offset < their.offset && insert.index < insert.lines.length) {\n      var line = insert.lines[insert.index++];\n      hunk.lines.push(line);\n      insert.offset++;\n    }\n  }\n\n  function insertTrailing(hunk, insert) {\n    while (insert.index < insert.lines.length) {\n      var line = insert.lines[insert.index++];\n      hunk.lines.push(line);\n    }\n  }\n\n  function collectChange(state) {\n    var ret = [],\n        operation = state.lines[state.index][0];\n\n    while (state.index < state.lines.length) {\n      var line = state.lines[state.index]; // Group additions that are immediately after subtractions and treat them as one \"atomic\" modify change.\n\n      if (operation === '-' && line[0] === '+') {\n        operation = '+';\n      }\n\n      if (operation === line[0]) {\n        ret.push(line);\n        state.index++;\n      } else {\n        break;\n      }\n    }\n\n    return ret;\n  }\n\n  function collectContext(state, matchChanges) {\n    var changes = [],\n        merged = [],\n        matchIndex = 0,\n        contextChanges = false,\n        conflicted = false;\n\n    while (matchIndex < matchChanges.length && state.index < state.lines.length) {\n      var change = state.lines[state.index],\n          match = matchChanges[matchIndex]; // Once we've hit our add, then we are done\n\n      if (match[0] === '+') {\n        break;\n      }\n\n      contextChanges = contextChanges || change[0] !== ' ';\n      merged.push(match);\n      matchIndex++; // Consume any additions in the other block as a conflict to attempt\n      // to pull in the remaining context after this\n\n      if (change[0] === '+') {\n        conflicted = true;\n\n        while (change[0] === '+') {\n          changes.push(change);\n          change = state.lines[++state.index];\n        }\n      }\n\n      if (match.substr(1) === change.substr(1)) {\n        changes.push(change);\n        state.index++;\n      } else {\n        conflicted = true;\n      }\n    }\n\n    if ((matchChanges[matchIndex] || '')[0] === '+' && contextChanges) {\n      conflicted = true;\n    }\n\n    if (conflicted) {\n      return changes;\n    }\n\n    while (matchIndex < matchChanges.length) {\n      merged.push(matchChanges[matchIndex++]);\n    }\n\n    return {\n      merged: merged,\n      changes: changes\n    };\n  }\n\n  function allRemoves(changes) {\n    return changes.reduce(function (prev, change) {\n      return prev && change[0] === '-';\n    }, true);\n  }\n\n  function skipRemoveSuperset(state, removeChanges, delta) {\n    for (var i = 0; i < delta; i++) {\n      var changeContent = removeChanges[removeChanges.length - delta + i].substr(1);\n\n      if (state.lines[state.index + i] !== ' ' + changeContent) {\n        return false;\n      }\n    }\n\n    state.index += delta;\n    return true;\n  }\n\n  function calcOldNewLineCount(lines) {\n    var oldLines = 0;\n    var newLines = 0;\n    lines.forEach(function (line) {\n      if (typeof line !== 'string') {\n        var myCount = calcOldNewLineCount(line.mine);\n        var theirCount = calcOldNewLineCount(line.theirs);\n\n        if (oldLines !== undefined) {\n          if (myCount.oldLines === theirCount.oldLines) {\n            oldLines += myCount.oldLines;\n          } else {\n            oldLines = undefined;\n          }\n        }\n\n        if (newLines !== undefined) {\n          if (myCount.newLines === theirCount.newLines) {\n            newLines += myCount.newLines;\n          } else {\n            newLines = undefined;\n          }\n        }\n      } else {\n        if (newLines !== undefined && (line[0] === '+' || line[0] === ' ')) {\n          newLines++;\n        }\n\n        if (oldLines !== undefined && (line[0] === '-' || line[0] === ' ')) {\n          oldLines++;\n        }\n      }\n    });\n    return {\n      oldLines: oldLines,\n      newLines: newLines\n    };\n  }\n\n  // See: http://code.google.com/p/google-diff-match-patch/wiki/API\n  function convertChangesToDMP(changes) {\n    var ret = [],\n        change,\n        operation;\n\n    for (var i = 0; i < changes.length; i++) {\n      change = changes[i];\n\n      if (change.added) {\n        operation = 1;\n      } else if (change.removed) {\n        operation = -1;\n      } else {\n        operation = 0;\n      }\n\n      ret.push([operation, change.value]);\n    }\n\n    return ret;\n  }\n\n  function convertChangesToXML(changes) {\n    var ret = [];\n\n    for (var i = 0; i < changes.length; i++) {\n      var change = changes[i];\n\n      if (change.added) {\n        ret.push('<ins>');\n      } else if (change.removed) {\n        ret.push('<del>');\n      }\n\n      ret.push(escapeHTML(change.value));\n\n      if (change.added) {\n        ret.push('</ins>');\n      } else if (change.removed) {\n        ret.push('</del>');\n      }\n    }\n\n    return ret.join('');\n  }\n\n  function escapeHTML(s) {\n    var n = s;\n    n = n.replace(/&/g, '&amp;');\n    n = n.replace(/</g, '&lt;');\n    n = n.replace(/>/g, '&gt;');\n    n = n.replace(/\"/g, '&quot;');\n    return n;\n  }\n\n  exports.Diff = Diff;\n  exports.applyPatch = applyPatch;\n  exports.applyPatches = applyPatches;\n  exports.canonicalize = canonicalize;\n  exports.convertChangesToDMP = convertChangesToDMP;\n  exports.convertChangesToXML = convertChangesToXML;\n  exports.createPatch = createPatch;\n  exports.createTwoFilesPatch = createTwoFilesPatch;\n  exports.diffArrays = diffArrays;\n  exports.diffChars = diffChars;\n  exports.diffCss = diffCss;\n  exports.diffJson = diffJson;\n  exports.diffLines = diffLines;\n  exports.diffSentences = diffSentences;\n  exports.diffTrimmedLines = diffTrimmedLines;\n  exports.diffWords = diffWords;\n  exports.diffWordsWithSpace = diffWordsWithSpace;\n  exports.merge = merge;\n  exports.parsePatch = parsePatch;\n  exports.structuredPatch = structuredPatch;\n\n  Object.defineProperty(exports, '__esModule', { value: true });\n\n})));\n"
  },
  {
    "path": "client/src/js/findingsSummary.js",
    "content": "/*\n$Id: findingsSummary.js 807 2017-07-27 13:04:19Z csmig $\n*/\n\nfunction addFindingsSummary( params ) {\n\tconst { collectionId, collectionName, treePath } = params\n\tconst tab = Ext.getCmp('main-tab-panel').getItem('findingsTab-' + collectionId)\n\tif (tab) {\n\t\ttab.show()\n\t\treturn\n\t}\n\n\n\tconst aggregator = 'groupId'\n\n\tconst findingsPanel = new SM.Findings.FindingsPanel({\n\t\tcollectionId: collectionId,\n\t\taggregator: aggregator\n\t})\n\n\tconst findingsTab = new Ext.Panel ({\n\t\tid: 'findingsTab-' + collectionId,\n\t\tcollectionId: collectionId,\n\t\tcollectionName: collectionName,\n\t\ticonCls: 'sm-report-icon',\n\t\ttitle: '',\n\t\tclosable: true,\n\t\tlayout: 'fit',\n\t\tsm_tabMode: 'permanent',\n\t\tsm_treePath: treePath,\n\t\titems: [findingsPanel]\n\t})\n\n\tfindingsTab.updateTitle = function () {\n\t\tfindingsTab.setTitle(`${findingsTab.sm_tabMode === 'ephemeral' ? '<i>':''}${SM.he(findingsTab.collectionName)} / Findings${findingsTab.sm_tabMode === 'ephemeral' ? '</i>':''}`)\n\t}\n\tfindingsTab.makePermanent = function () {\n\t\tfindingsTab.sm_tabMode = 'permanent'\n\t\tfindingsTab.updateTitle(findingsTab)\n\t}\n\n\tlet tp = Ext.getCmp('main-tab-panel')\n\tlet ephTabIndex = tp.items.findIndex('sm_tabMode', 'ephemeral')\n\tlet thisTab\n\tif (ephTabIndex !== -1) {\n\t  let ephTab = tp.items.itemAt(ephTabIndex)\n\t  tp.remove(ephTab)\n\t  thisTab = tp.insert(ephTabIndex, findingsTab);\n\t} else {\n\t  thisTab = tp.add( findingsTab )\n\t}\n\tthisTab.updateTitle(thisTab)\n\tthisTab.show();\n  \n\tfindingsPanel.parent.getStore().load({\n\t\tparams: {\n\t\t\taggregator: aggregator\n\t\t}\n\t})\n\n}; //end addCompletionReport();\n"
  },
  {
    "path": "client/src/js/init.js",
    "content": "import { stylesheets, scripts, isMinimizedSource } from './resources.js'\n\n(async function () {\n  if (STIGMAN.Env.consoleMode !== 'development') {\n    console.log = function () { }\n    console.warn = function () { }\n    console.error = function () { }\n    console.debug = function () { }\n  }\n  const statusEl = document.getElementById(\"loading-text\")\n  let OW // aka window.oidcWorker, created in setupOidcWorker()\n  if (!window.isSecureContext) {\n    appendStatus(`SECURE CONTEXT REQUIRED<br><br>\n    The App is not executing in a <a href=https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts target=\"_blank\">secure context</a> and cannot continue.\n    <br><br>To be considered secure, resources that are not local must be served over https:// URLs and the security \n    properties of the network channel used to deliver the resource must not be considered deprecated.`)\n    return\n  }\n\n  try {\n    if (STIGMAN.Env.stateEvents) {\n      await setupStateWorker()\n    }\n    else {\n      console.log('[init] STIGMAN_CLIENT_STATE_EVENTS is false; skipping state worker setup')\n    }\n    await setupOidcWorker() \n    await bootstrap()\n  } \n  catch (error) {\n    console.error(`[init] Error during initialization:`, error)\n    appendError(error.message || 'Unknown error during initialization', !error.message?.includes('Timeout waiting for API state event stream'))\n  }\n\n  async function bootstrap() {\n\n    const url = new URL(window.location.href)\n    const redirectUri = `${url.origin}${url.pathname}`\n\n    const response = await initializeOidcWorker(redirectUri)\n    if (response.error) {\n      appendError(response.error)\n      return\n    }\n    OW.channelName = response.channelName\n    const bc = new BroadcastChannel(window.oidcWorker.channelName)\n    bc.onmessage = (event) => {\n      if (event.data.type === 'accessToken') {\n        console.log('{init] Received from worker:', event.type, event.data)\n        OW.token = event.data.accessToken\n        OW.tokenParsed = event.data.accessTokenPayload\n      }\n      else if (event.data.type === 'noToken') {\n        console.log('{init] Received from worker:', event.type, event.data)\n        OW.token = null\n        OW.tokenParsed = null\n      }\n    }\n    appendStatus(`Authorizing`)\n\n    const paramStr = extractParamString(url)\n    if (paramStr) {\n      return handleRedirectAndParameters(redirectUri, paramStr)\n    }\n    else {\n      return handleNoParameters()\n    }\n  \n  }\n\n  async function getOidcMetadata() {\n    const url = `${STIGMAN.Env.oauth.authority}/.well-known/openid-configuration`\n    const response = await fetch(url)\n    if (!response.ok) {\n      throw new Error(`failed to get: ${url}`)\n    }\n    try {\n      return await response.json()\n    } catch (error) {\n      console.error(`[init] Error fetching OIDC metadata:`, error)\n      throw new Error(`failed to parse: ${url}`)\n    }\n  }\n\n  async function initializeOidcWorker(redirectUri) {\n    const response = await OW.sendWorkerRequest({ request: 'getStatus' })\n    if (response.error) {\n      throw new Error(`OIDC Worker getStatus error: ${response.error}`)\n    }\n    if (response.initialized) {\n      return response\n    }\n    const oidcConfiguration = await getOidcMetadata()\n    return OW.sendWorkerRequest({ request: 'initialize', redirectUri, oidcConfiguration, env: STIGMAN.Env.oauth })\n  } \n\n  function extractParamString(url) {\n    if (url.hash) return url.hash.substring(1) // Remove the leading '#'\n    if (url.search) return url.search.substring(1) // Remove the leading '?'\n    return ''\n  }\n\n  function processRedirectParams (paramStr) {\n    const params = {}\n    const usp = new URLSearchParams(paramStr)\n    for (const [key, value] of usp) {\n      params[key] = value\n    }\n    return params\n  }\n\n  async function handleNoParameters() {\n    const response = await OW.sendWorkerRequest({ request: 'getAccessToken' })\n    if (response.accessToken) {\n      OW.token = response.accessToken\n      OW.tokenParsed = response.accessTokenPayload\n      // appendStatus(`getAccessToken`)\n      loadResources()\n    } else if (response.redirect) {\n      sessionStorage.setItem('codeVerifier', response.codeVerifier)\n      sessionStorage.setItem('oidcState', response.state)\n      window.location.href = response.redirect\n    }\n  }\n\n  async function handleRedirectAndParameters(redirectUri, paramStr) {\n    const params = processRedirectParams(paramStr)\n    if (!params.code) {\n      let errorMessage = 'No authorization code provided in the URL parameters.'\n      if (params.error) {\n        errorMessage += ` Error: ${params.error}`\n        if (params.error_description) {\n          errorMessage += ` - ${params.error_description}`\n        }\n      }\n      appendError(errorMessage)\n      return\n    }\n    if (!params.state || params.state !== sessionStorage.getItem('oidcState')) {\n      const reauthHref = window.location.origin + window.location.pathname\n      console.log(`[init] State mismatch. Redirecting to ${reauthHref}.`)\n      window.location.href = reauthHref\n      return\n    }\n    const response = await OW.sendWorkerRequest({\n      request: 'exchangeCodeForToken',\n      code: params.code,\n      codeVerifier: sessionStorage.getItem('codeVerifier'),\n      clientId: STIGMAN.Env.oauth.clientId,\n      redirectUri\n    })\n    if (response.success) {\n      OW.token = response.accessToken\n      OW.tokenParsed = response.accessTokenPayload\n      window.history.replaceState(window.history.state, '', redirectUri)\n      sessionStorage.removeItem('codeVerifier')\n      sessionStorage.removeItem('oidcState')\n      loadResources()\n    }\n    else {\n      appendError(response.error || 'Failed to exchange code for token')\n    }\n  }\n\n  function appendStatus(html) {\n    statusEl.innerHTML += `${statusEl.innerHTML ? '<br/><br/>' : ''}${html}`\n  }\n\n  function setStatus(html) {\n    statusEl.innerHTML = html\n  }\n\n  function escapeHtml(str) {\n    return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\"/g, '&quot;').replace(/'/g, '&#39;')\n  }\n\n  function appendError(message, showReauth = true) {\n    const safeMessage = escapeHtml(message)\n    if (showReauth) {\n      const reauthHref = window.location.origin + window.location.pathname\n      statusEl.innerHTML += `<br/><br/><span style=\"color:#ff5757\">Error: ${safeMessage}</span><br><br><a href=\"${reauthHref}\">Retry authorization.</a>`\n    }\n    else {\n      statusEl.innerHTML += `<br/><br/><span style=\"color:#ff5757\">Error: ${safeMessage}</span>`\n    }\n    hideSpinner()\n  }\n\n  async function loadResources() {\n    for (const href of stylesheets) {\n      const link = document.createElement('link')\n      link.href = href\n      link.type = 'text/css'\n      link.rel = 'stylesheet'\n      link.async = false\n      document.head.appendChild(link)\n    }\n\n    const { Chart } = await import('./modules/node_modules/chart.js/auto/auto.js')\n    window.Chart = Chart\n\n    for (const src of scripts) {\n      const script = document.createElement('script')\n      script.src = src\n      script.async = false\n      document.head.appendChild(script)\n    }\n    const { serializeError } = await import('./modules/node_modules/serialize-error/index.js')\n    STIGMAN.serializeError = serializeError\n    STIGMAN.ClientModules = await import('./modules/node_modules/@nuwcdivnpt/stig-manager-client-modules/index.js')\n\n    STIGMAN.isMinimizedSource = isMinimizedSource\n  }\n\n  async function setupOidcWorker() {\n    window.oidcWorker = {\n      logout: async function () {\n        const response = await this.sendWorkerRequest({ request: 'logout' })\n        if (response.success) {\n          this.token = null\n          this.tokenParsed = null\n          window.location.href = response.redirect\n        }\n      },\n      sendWorkerRequest: function (request) {\n        const requestId = crypto.randomUUID()\n        const port = this.worker.port\n        port.postMessage({ ...request, requestId })\n        return new Promise((resolve) => {\n          function handler(event) {\n            if (event.data.requestId === requestId) {\n              port.removeEventListener('message', handler)\n              resolve(event.data.response)\n            }\n          }\n          port.addEventListener('message', handler)\n        })\n      },\n      postContextActiveMessage: function () {\n        this.worker.port.postMessage({ requestId: 'contextActive' })\n      },\n      channelName: null,\n      token: null,\n      tokenParsed: null,\n      worker: new SharedWorker(\"js/workers/oidc-worker.js\", { name: 'stigman-oidc-worker', type: \"module\" })\n    }\n\n    OW = window.oidcWorker\n    OW.worker.port.start()\n  }\n\n  async function setupStateWorker() {\n    window.stateWorker = {\n      worker: new SharedWorker(\"js/workers/state-worker.js\", { name: 'stigman-state-worker', type: \"module\" }),\n      sendWorkerRequest: function (request) {\n        const requestId = crypto.randomUUID()\n        const port = this.worker.port\n        port.postMessage({ ...request, requestId })\n        return new Promise((resolve) => {\n          function handler(event) {\n            if (event.data.requestId === requestId) {\n              port.removeEventListener('message', handler)\n              resolve(event.data.response)\n            }\n          }\n          port.addEventListener('message', handler)\n        })\n      },\n      workerChannel: null,\n      state: null\n    }\n    const SW = window.stateWorker\n    SW.worker.port.start()\n    const response = await SW.sendWorkerRequest({ request: 'initialize', apiBase: new URL(STIGMAN.Env.apiBase, window.location.href).pathname })\n    if (response.error) {\n      console.error(`[init] Error initializing state worker:`, response.error)\n      throw new Error(response.error)\n    }\n    SW.state = JSON.parse(response.state)\n\n    // Set up the workerChannel before waiting for available state\n    SW.workerChannel = new BroadcastChannel(response.channelName)\n    SW.workerChannel.onmessage = (event) => {\n      console.log(`[init] [${SW.workerChannel.name}] Received message:`, event.data)\n      try {\n        SW.state = JSON.parse(event.data.data)\n      } catch (error) {\n        console.error(`[init] [${SW.workerChannel.name}] Error parsing state:`, error)\n        SW.state = null\n      }\n    }\n\n    // Wait for currentState == 'available'\n    function needsWait(state) {\n      if (!state) return true\n      const online = '<span style=\"color:green\">ONLINE</span>'\n      const offline = '<span style=\"color:#ff5757\">OFFLINE</span>'\n      if (state.currentState !== 'available') {\n        setStatus(`The API is currently ${state.currentState}.<br><br>\n          Database status: ${state.dependencies.db ? online : offline}<br>\n          OIDC status: ${state.dependencies.oidc ? online : offline}<br><br>\n          Last update: ${new Date().toISOString()}`)\n        return true\n      }\n      return false\n    }\n\n    if (needsWait(SW.state)) {\n      await new Promise((resolve) => {\n        function checkReady(event) {\n          let stateObj;\n          try {\n            stateObj = JSON.parse(event.data.data)\n          } catch {\n            return\n          }\n          if (!needsWait(stateObj)) {\n            SW.workerChannel.removeEventListener('message', checkReady)\n            SW.state = stateObj\n            resolve()\n          }\n        }\n        SW.workerChannel.addEventListener('message', checkReady)\n      })\n    }\n\n    return true\n  }\n\n  function hideSpinner() {\n    const loadingEl = document.getElementById(\"indicator\")\n    if (loadingEl) {\n      loadingEl.style.background = \"none\"\n    }\n  }\n})();\n"
  },
  {
    "path": "client/src/js/jsonview.bundle.js",
    "content": "var JsonView = (function (exports) {\n  'use strict';\n\n  function _typeof(obj) {\n    \"@babel/helpers - typeof\";\n\n    if (typeof Symbol === \"function\" && typeof Symbol.iterator === \"symbol\") {\n      _typeof = function (obj) {\n        return typeof obj;\n      };\n    } else {\n      _typeof = function (obj) {\n        return obj && typeof Symbol === \"function\" && obj.constructor === Symbol && obj !== Symbol.prototype ? \"symbol\" : typeof obj;\n      };\n    }\n\n    return _typeof(obj);\n  }\n\n  function expandedTemplate() {\n    var params = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};\n    var key = params.key,\n        size = params.size;\n    return \"\\n    <div class=\\\"line\\\">\\n      <div class=\\\"caret-icon\\\"><i class=\\\"sms sm-caret-right\\\"></i></div>\\n      <div class=\\\"json-key\\\">\".concat(SM.he(key), \"</div>\\n      <div class=\\\"json-size\\\">\").concat(size, \"</div>\\n    </div>\\n  \");\n  }\n\n  function notExpandedTemplate() {\n    var params = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};\n    var key = params.key,\n        value = params.value,\n        type = params.type;\n    return \"\\n    <div class=\\\"line\\\">\\n      <div class=\\\"empty-icon\\\"></div>\\n      <div class=\\\"json-key\\\">\".concat(SM.he(key), \"</div>\\n      <div class=\\\"json-separator\\\">:</div>\\n      <div class=\\\"json-value json-\").concat(type, \"\\\">\").concat(type === 'string' ? SM.he(value).replace(/\\n/g,'<br>') : value, \"</div>\\n    </div>\\n  \");\n  }\n\n  function hideNodeChildren(node) {\n    node.children.forEach(function (child) {\n      child.el.classList.add('hide');\n\n      if (child.isExpanded) {\n        hideNodeChildren(child);\n      }\n    });\n  }\n\n  function showNodeChildren(node) {\n    node.children.forEach(function (child) {\n      child.el.classList.remove('hide');\n\n      if (child.isExpanded) {\n        showNodeChildren(child);\n      }\n    });\n  }\n\n  function setCaretIconDown(node) {\n    if (node.children.length > 0) {\n      var icon = node.el.querySelector('.sms');\n\n      if (icon) {\n        icon.classList.replace('sm-caret-right', 'sm-caret-down');\n      }\n    }\n  }\n\n  function setCaretIconRight(node) {\n    if (node.children.length > 0) {\n      var icon = node.el.querySelector('.sms');\n\n      if (icon) {\n        icon.classList.replace('sm-caret-down', 'sm-caret-right');\n      }\n    }\n  }\n\n  function toggleNode(node) {\n    if (node.isExpanded) {\n      node.isExpanded = false;\n      setCaretIconRight(node);\n      hideNodeChildren(node);\n    } else {\n      node.isExpanded = true;\n      setCaretIconDown(node);\n      showNodeChildren(node);\n    }\n  }\n\n  function createContainerElement() {\n    var el = document.createElement('div');\n    el.className = 'json-container';\n    return el;\n  }\n\n  function createNodeElement(node) {\n    var el = document.createElement('div');\n\n    var getSizeString = function getSizeString(node) {\n      var len = node.children.length;\n      if (node.type === 'array') return \"[\".concat(len, \"]\");\n      if (node.type === 'object') return \"{\".concat(len, \"}\");\n      return null;\n    };\n\n    if (node.children.length > 0) {\n      el.innerHTML = expandedTemplate({\n        key: node.key,\n        size: getSizeString(node)\n      });\n      var caretEl = el.querySelector('.caret-icon');\n      caretEl.addEventListener('click', function () {\n        toggleNode(node);\n      });\n    } else {\n      el.innerHTML = notExpandedTemplate({\n        key: node.key,\n        value: node.value,\n        type: _typeof(node.value)\n      });\n    }\n\n    var lineEl = el.children[0];\n\n    if (node.parent !== null && !node.parent.isExpanded) {\n      lineEl.classList.add('hide');\n    }\n\n    lineEl.style = 'margin-left: ' + node.depth * 18 + 'px;';\n    return lineEl;\n  }\n\n  function getDataType(val) {\n    var type = _typeof(val);\n\n    if (Array.isArray(val)) type = 'array';\n    if (val instanceof Date && !isNaN(val)) type = 'date'\n    if (val === null) type = 'null';\n    return type;\n  }\n\n  function traverseTree(node, callback) {\n    callback(node);\n\n    if (node.children.length > 0) {\n      node.children.forEach(function (child) {\n        traverseTree(child, callback);\n      });\n    }\n  }\n\n  function createNode() {\n    var opt = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};\n    return {\n      key: opt.key || null,\n      parent: opt.parent || null,\n      value: opt.hasOwnProperty('value') ? opt.value : null,\n      isExpanded: opt.isExpanded || false,\n      type: opt.type || null,\n      children: opt.children || [],\n      el: opt.el || null,\n      depth: opt.depth || 0\n    };\n  }\n\n  function createSubnode(data, node) {\n    if (_typeof(data) === 'object' && node.type !== 'date') {\n      for (var key in data) {\n        var child = createNode({\n          value: data[key],\n          key: key,\n          depth: node.depth + 1,\n          type: getDataType(data[key]),\n          parent: node\n        });\n        node.children.push(child);\n        createSubnode(data[key], child);\n      }\n    }\n  }\n\n  function createTree(jsonData) {\n    var data = typeof jsonData === 'string' ? JSON.parse(jsonData) : jsonData;\n    var rootNode = createNode({\n      value: data,\n      key: getDataType(data),\n      type: getDataType(data)\n    });\n    createSubnode(data, rootNode);\n    return rootNode;\n  }\n\n  function renderJSON(jsonData, targetElement) {\n    var parsedData = typeof jsonData === 'string' ? JSON.parse(jsonData) : jsonData;\n    var tree = createTree(parsedData);\n    render(tree, targetElement);\n    return tree;\n  }\n\n  function render(tree, targetElement) {\n    var containerEl = createContainerElement();\n    traverseTree(tree, function (node) {\n      node.el = createNodeElement(node);\n      if (node.isExpanded) {\n        setCaretIconDown(node);\n      }\n      containerEl.appendChild(node.el);\n    });\n    targetElement.appendChild(containerEl);\n  }\n\n  function expandChildren(node) {\n    traverseTree(node, function (child) {\n      child.el.classList.remove('hide');\n      child.isExpanded = true;\n      setCaretIconDown(child);\n    });\n  }\n\n  function collapseChildren(node) {\n    traverseTree(node, function (child) {\n      child.isExpanded = false;\n      if (child.depth > node.depth) child.el.classList.add('hide');\n      setCaretIconRight(child);\n    });\n  }\n\n  exports.collapseChildren = collapseChildren;\n  exports.createTree = createTree;\n  exports.expandChildren = expandChildren;\n  exports.render = render;\n  exports.renderJSON = renderJSON;\n  exports.traverseTree = traverseTree;\n\n  return exports;\n\n}({}));\n"
  },
  {
    "path": "client/src/js/library.js",
    "content": "async function addLibraryStig( params ) {\n  let { benchmarkId, revisionStr = 'latest', stigTitle, treePath } = params\n  try {\n\t\tconst tab = Ext.getCmp('main-tab-panel').getItem(`library-stig-${benchmarkId}-tab`)\n\t\tif (tab) {\n\t\t\ttab.show()\n\t\t\treturn\n\t\t}\n    const libraryStigTab = new SM.Library.StigPanel({\n      id: `library-stig-${benchmarkId}-tab`,\n      benchmarkId,\n      revisionStr,\n      stigTitle,\n      sm_tabMode: 'ephemeral',\n      sm_treePath: treePath\n    })\n    libraryStigTab.updateTitle = function () {\n\t\t\tthis.setTitle(`${this.sm_tabMode === 'ephemeral' ? '<i>':''}${this.benchmarkId}${this.sm_tabMode === 'ephemeral' ? '</i>':''}`)\n\t\t}\n\t\tlibraryStigTab.makePermanent = function () {\n\t\t\tthis.sm_tabMode = 'permanent'\n\t\t\tthis.updateTitle.call(this)\n\t\t}\n    let tp = Ext.getCmp('main-tab-panel')\n\t\tlet ephTabIndex = tp.items.findIndex('sm_tabMode', 'ephemeral')\n\t\tlet thisTab\n\t\tif (ephTabIndex !== -1) {\n      let ephTab = tp.items.itemAt(ephTabIndex)\n      tp.remove(ephTab)\n      thisTab = tp.insert(ephTabIndex, libraryStigTab);\n\t\t} \n    else {\n\t\t  thisTab = tp.add( libraryStigTab )\n\t\t}\n\t\tthisTab.updateTitle.call(thisTab)\n\t\tthisTab.show()\n    libraryStigTab.load(benchmarkId)\n  }\n  catch (e) {\n    SM.Error.handleError(e)\n  }\n}\n"
  },
  {
    "path": "client/src/js/modules/package.json",
    "content": "{\n  \"dependencies\": {\n    \"@nuwcdivnpt/stig-manager-client-modules\": \"^1.6.7\",\n    \"chart.js\": \"^4.4.2\",\n    \"serialize-error\": \"^11.0.0\"\n  }\n}\n"
  },
  {
    "path": "client/src/js/modules/source-map/source-map.js",
    "content": "!function(e,n){\"object\"==typeof exports&&\"object\"==typeof module?module.exports=n(require(\"fs\"),require(\"path\")):\"function\"==typeof define&&define.amd?define([\"fs\",\"path\"],n):\"object\"==typeof exports?exports.sourceMap=n(require(\"fs\"),require(\"path\")):e.sourceMap=n(e.fs,e.path)}(window,(function(e,n){return function(e){var n={};function t(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return e[r].call(o.exports,o,o.exports,t),o.l=!0,o.exports}return t.m=e,t.c=n,t.d=function(e,n,r){t.o(e,n)||Object.defineProperty(e,n,{enumerable:!0,get:r})},t.r=function(e){\"undefined\"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:\"Module\"}),Object.defineProperty(e,\"__esModule\",{value:!0})},t.t=function(e,n){if(1&n&&(e=t(e)),8&n)return e;if(4&n&&\"object\"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(t.r(r),Object.defineProperty(r,\"default\",{enumerable:!0,value:e}),2&n&&\"string\"!=typeof e)for(var o in e)t.d(r,o,function(n){return e[n]}.bind(null,o));return r},t.n=function(e){var n=e&&e.__esModule?function(){return e.default}:function(){return e};return t.d(n,\"a\",n),n},t.o=function(e,n){return Object.prototype.hasOwnProperty.call(e,n)},t.p=\"\",t(t.s=5)}([function(e,n){n.getArg=function(e,n,t){if(n in e)return e[n];if(3===arguments.length)return t;throw new Error('\"'+n+'\" is a required argument.')};const t=/^(?:([\\w+\\-.]+):)?\\/\\/(?:(\\w+:\\w+)@)?([\\w.-]*)(?::(\\d+))?(.*)$/,r=/^data:.+\\,.+$/;function o(e){const n=e.match(t);return n?{scheme:n[1],auth:n[2],host:n[3],port:n[4],path:n[5]}:null}function i(e){let n=\"\";return e.scheme&&(n+=e.scheme+\":\"),n+=\"//\",e.auth&&(n+=e.auth+\"@\"),e.host&&(n+=e.host),e.port&&(n+=\":\"+e.port),e.path&&(n+=e.path),n}n.urlParse=o,n.urlGenerate=i;const s=function(e){const n=[];return function(t){for(let e=0;e<n.length;e++)if(n[e].input===t){const t=n[0];return n[0]=n[e],n[e]=t,n[0].result}const r=e(t);return n.unshift({input:t,result:r}),n.length>32&&n.pop(),r}}((function(e){let t=e;const r=o(e);if(r){if(!r.path)return e;t=r.path}const s=n.isAbsolute(t),l=[];let a=0,u=0;for(;;){if(a=u,u=t.indexOf(\"/\",a),-1===u){l.push(t.slice(a));break}for(l.push(t.slice(a,u));u<t.length&&\"/\"===t[u];)u++}let c=0;for(u=l.length-1;u>=0;u--){const e=l[u];\".\"===e?l.splice(u,1):\"..\"===e?c++:c>0&&(\"\"===e?(l.splice(u+1,c),c=0):(l.splice(u,2),c--))}return t=l.join(\"/\"),\"\"===t&&(t=s?\"/\":\".\"),r?(r.path=t,i(r)):t}));function l(e,n){\"\"===e&&(e=\".\"),\"\"===n&&(n=\".\");const t=o(n),l=o(e);if(l&&(e=l.path||\"/\"),t&&!t.scheme)return l&&(t.scheme=l.scheme),i(t);if(t||n.match(r))return n;if(l&&!l.host&&!l.path)return l.host=n,i(l);const a=\"/\"===n.charAt(0)?n:s(e.replace(/\\/+$/,\"\")+\"/\"+n);return l?(l.path=a,i(l)):a}n.normalize=s,n.join=l,n.isAbsolute=function(e){return\"/\"===e.charAt(0)||t.test(e)},n.relative=function(e,n){\"\"===e&&(e=\".\"),e=e.replace(/\\/$/,\"\");let t=0;for(;0!==n.indexOf(e+\"/\");){const r=e.lastIndexOf(\"/\");if(r<0)return n;if((e=e.slice(0,r)).match(/^([^\\/]+:\\/)?\\/*$/))return n;++t}return Array(t+1).join(\"../\")+n.substr(e.length+1)};const a=!(\"__proto__\"in Object.create(null));function u(e){return e}function c(e){if(!e)return!1;const n=e.length;if(n<9)return!1;if(95!==e.charCodeAt(n-1)||95!==e.charCodeAt(n-2)||111!==e.charCodeAt(n-3)||116!==e.charCodeAt(n-4)||111!==e.charCodeAt(n-5)||114!==e.charCodeAt(n-6)||112!==e.charCodeAt(n-7)||95!==e.charCodeAt(n-8)||95!==e.charCodeAt(n-9))return!1;for(let t=n-10;t>=0;t--)if(36!==e.charCodeAt(t))return!1;return!0}function g(e,n){return e===n?0:null===e?1:null===n?-1:e>n?1:-1}n.toSetString=a?u:function(e){return c(e)?\"$\"+e:e},n.fromSetString=a?u:function(e){return c(e)?e.slice(1):e},n.compareByOriginalPositions=function(e,n,t){let r=g(e.source,n.source);return 0!==r?r:(r=e.originalLine-n.originalLine,0!==r?r:(r=e.originalColumn-n.originalColumn,0!==r||t?r:(r=e.generatedColumn-n.generatedColumn,0!==r?r:(r=e.generatedLine-n.generatedLine,0!==r?r:g(e.name,n.name)))))},n.compareByGeneratedPositionsDeflated=function(e,n,t){let r=e.generatedLine-n.generatedLine;return 0!==r?r:(r=e.generatedColumn-n.generatedColumn,0!==r||t?r:(r=g(e.source,n.source),0!==r?r:(r=e.originalLine-n.originalLine,0!==r?r:(r=e.originalColumn-n.originalColumn,0!==r?r:g(e.name,n.name)))))},n.compareByGeneratedPositionsInflated=function(e,n){let t=e.generatedLine-n.generatedLine;return 0!==t?t:(t=e.generatedColumn-n.generatedColumn,0!==t?t:(t=g(e.source,n.source),0!==t?t:(t=e.originalLine-n.originalLine,0!==t?t:(t=e.originalColumn-n.originalColumn,0!==t?t:g(e.name,n.name)))))},n.parseSourceMapInput=function(e){return JSON.parse(e.replace(/^\\)]}'[^\\n]*\\n/,\"\"))},n.computeSourceURL=function(e,n,t){if(n=n||\"\",e&&(\"/\"!==e[e.length-1]&&\"/\"!==n[0]&&(e+=\"/\"),n=e+n),t){const e=o(t);if(!e)throw new Error(\"sourceMapURL could not be parsed\");if(e.path){const n=e.path.lastIndexOf(\"/\");n>=0&&(e.path=e.path.substring(0,n+1))}n=l(i(e),n)}return s(n)}},function(e,n,t){const r=t(2),o=t(0),i=t(3).ArraySet,s=t(7).MappingList;class l{constructor(e){e||(e={}),this._file=o.getArg(e,\"file\",null),this._sourceRoot=o.getArg(e,\"sourceRoot\",null),this._skipValidation=o.getArg(e,\"skipValidation\",!1),this._sources=new i,this._names=new i,this._mappings=new s,this._sourcesContents=null}static fromSourceMap(e){const n=e.sourceRoot,t=new l({file:e.file,sourceRoot:n});return e.eachMapping((function(e){const r={generated:{line:e.generatedLine,column:e.generatedColumn}};null!=e.source&&(r.source=e.source,null!=n&&(r.source=o.relative(n,r.source)),r.original={line:e.originalLine,column:e.originalColumn},null!=e.name&&(r.name=e.name)),t.addMapping(r)})),e.sources.forEach((function(r){let i=r;null!==n&&(i=o.relative(n,r)),t._sources.has(i)||t._sources.add(i);const s=e.sourceContentFor(r);null!=s&&t.setSourceContent(r,s)})),t}addMapping(e){const n=o.getArg(e,\"generated\"),t=o.getArg(e,\"original\",null);let r=o.getArg(e,\"source\",null),i=o.getArg(e,\"name\",null);this._skipValidation||this._validateMapping(n,t,r,i),null!=r&&(r=String(r),this._sources.has(r)||this._sources.add(r)),null!=i&&(i=String(i),this._names.has(i)||this._names.add(i)),this._mappings.add({generatedLine:n.line,generatedColumn:n.column,originalLine:null!=t&&t.line,originalColumn:null!=t&&t.column,source:r,name:i})}setSourceContent(e,n){let t=e;null!=this._sourceRoot&&(t=o.relative(this._sourceRoot,t)),null!=n?(this._sourcesContents||(this._sourcesContents=Object.create(null)),this._sourcesContents[o.toSetString(t)]=n):this._sourcesContents&&(delete this._sourcesContents[o.toSetString(t)],0===Object.keys(this._sourcesContents).length&&(this._sourcesContents=null))}applySourceMap(e,n,t){let r=n;if(null==n){if(null==e.file)throw new Error('SourceMapGenerator.prototype.applySourceMap requires either an explicit source file, or the source map\\'s \"file\" property. Both were omitted.');r=e.file}const s=this._sourceRoot;null!=s&&(r=o.relative(s,r));const l=this._mappings.toArray().length>0?new i:this._sources,a=new i;this._mappings.unsortedForEach((function(n){if(n.source===r&&null!=n.originalLine){const r=e.originalPositionFor({line:n.originalLine,column:n.originalColumn});null!=r.source&&(n.source=r.source,null!=t&&(n.source=o.join(t,n.source)),null!=s&&(n.source=o.relative(s,n.source)),n.originalLine=r.line,n.originalColumn=r.column,null!=r.name&&(n.name=r.name))}const i=n.source;null==i||l.has(i)||l.add(i);const u=n.name;null==u||a.has(u)||a.add(u)}),this),this._sources=l,this._names=a,e.sources.forEach((function(n){const r=e.sourceContentFor(n);null!=r&&(null!=t&&(n=o.join(t,n)),null!=s&&(n=o.relative(s,n)),this.setSourceContent(n,r))}),this)}_validateMapping(e,n,t,r){if(n&&\"number\"!=typeof n.line&&\"number\"!=typeof n.column)throw new Error(\"original.line and original.column are not numbers -- you probably meant to omit the original mapping entirely and only map the generated position. If so, pass null for the original mapping instead of an object with empty or null values.\");if(e&&\"line\"in e&&\"column\"in e&&e.line>0&&e.column>=0&&!n&&!t&&!r);else if(!(e&&\"line\"in e&&\"column\"in e&&n&&\"line\"in n&&\"column\"in n&&e.line>0&&e.column>=0&&n.line>0&&n.column>=0&&t))throw new Error(\"Invalid mapping: \"+JSON.stringify({generated:e,source:t,original:n,name:r}))}_serializeMappings(){let e,n,t,i,s=0,l=1,a=0,u=0,c=0,g=0,p=\"\";const h=this._mappings.toArray();for(let m=0,d=h.length;m<d;m++){if(n=h[m],e=\"\",n.generatedLine!==l)for(s=0;n.generatedLine!==l;)e+=\";\",l++;else if(m>0){if(!o.compareByGeneratedPositionsInflated(n,h[m-1]))continue;e+=\",\"}e+=r.encode(n.generatedColumn-s),s=n.generatedColumn,null!=n.source&&(i=this._sources.indexOf(n.source),e+=r.encode(i-g),g=i,e+=r.encode(n.originalLine-1-u),u=n.originalLine-1,e+=r.encode(n.originalColumn-a),a=n.originalColumn,null!=n.name&&(t=this._names.indexOf(n.name),e+=r.encode(t-c),c=t)),p+=e}return p}_generateSourcesContent(e,n){return e.map((function(e){if(!this._sourcesContents)return null;null!=n&&(e=o.relative(n,e));const t=o.toSetString(e);return Object.prototype.hasOwnProperty.call(this._sourcesContents,t)?this._sourcesContents[t]:null}),this)}toJSON(){const e={version:this._version,sources:this._sources.toArray(),names:this._names.toArray(),mappings:this._serializeMappings()};return null!=this._file&&(e.file=this._file),null!=this._sourceRoot&&(e.sourceRoot=this._sourceRoot),this._sourcesContents&&(e.sourcesContent=this._generateSourcesContent(e.sources,e.sourceRoot)),e}toString(){return JSON.stringify(this.toJSON())}}l.prototype._version=3,n.SourceMapGenerator=l},function(e,n,t){const r=t(6);n.encode=function(e){let n,t=\"\",o=function(e){return e<0?1+(-e<<1):0+(e<<1)}(e);do{n=31&o,o>>>=5,o>0&&(n|=32),t+=r.encode(n)}while(o>0);return t}},function(e,n){class t{constructor(){this._array=[],this._set=new Map}static fromArray(e,n){const r=new t;for(let t=0,o=e.length;t<o;t++)r.add(e[t],n);return r}size(){return this._set.size}add(e,n){const t=this.has(e),r=this._array.length;t&&!n||this._array.push(e),t||this._set.set(e,r)}has(e){return this._set.has(e)}indexOf(e){const n=this._set.get(e);if(n>=0)return n;throw new Error('\"'+e+'\" is not in the set.')}at(e){if(e>=0&&e<this._array.length)return this._array[e];throw new Error(\"No element indexed by \"+e)}toArray(){return this._array.slice()}}n.ArraySet=t},function(e,n,t){(function(n){if(function(){return\"undefined\"!=typeof window&&this===window}.call()){let n=null;e.exports=function(){if(\"string\"==typeof n)return fetch(n).then(e=>e.arrayBuffer());if(n instanceof ArrayBuffer)return Promise.resolve(n);throw new Error(\"You must provide the string URL or ArrayBuffer contents of lib/mappings.wasm by calling SourceMapConsumer.initialize({ 'lib/mappings.wasm': ... }) before using SourceMapConsumer\")},e.exports.initialize=e=>n=e}else{const r=t(10),o=t(11);e.exports=function(){return new Promise((e,t)=>{const i=o.join(n,\"mappings.wasm\");r.readFile(i,null,(n,r)=>{n?t(n):e(r.buffer)})})},e.exports.initialize=e=>{console.debug(\"SourceMapConsumer.initialize is a no-op when running in node.js\")}}}).call(this,\"/\")},function(e,n,t){n.SourceMapGenerator=t(1).SourceMapGenerator,n.SourceMapConsumer=t(8).SourceMapConsumer,n.SourceNode=t(13).SourceNode},function(e,n){const t=\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\".split(\"\");n.encode=function(e){if(0<=e&&e<t.length)return t[e];throw new TypeError(\"Must be between 0 and 63: \"+e)}},function(e,n,t){const r=t(0);n.MappingList=class{constructor(){this._array=[],this._sorted=!0,this._last={generatedLine:-1,generatedColumn:0}}unsortedForEach(e,n){this._array.forEach(e,n)}add(e){!function(e,n){const t=e.generatedLine,o=n.generatedLine,i=e.generatedColumn,s=n.generatedColumn;return o>t||o==t&&s>=i||r.compareByGeneratedPositionsInflated(e,n)<=0}(this._last,e)?(this._sorted=!1,this._array.push(e)):(this._last=e,this._array.push(e))}toArray(){return this._sorted||(this._array.sort(r.compareByGeneratedPositionsInflated),this._sorted=!0),this._array}}},function(e,n,t){const r=t(0),o=t(9),i=t(3).ArraySet,s=(t(2),t(4)),l=t(12),a=Symbol(\"smcInternal\");class u{constructor(e,n){return e==a?Promise.resolve(this):function(e,n){let t=e;\"string\"==typeof e&&(t=r.parseSourceMapInput(e));const o=null!=t.sections?new g(t,n):new c(t,n);return Promise.resolve(o)}(e,n)}static initialize(e){s.initialize(e[\"lib/mappings.wasm\"])}static fromSourceMap(e,n){return function(e,n){return c.fromSourceMap(e,n)}(e,n)}static async with(e,n,t){const r=await new u(e,n);try{return await t(r)}finally{r.destroy()}}_parseMappings(e,n){throw new Error(\"Subclasses must implement _parseMappings\")}eachMapping(e,n,t){throw new Error(\"Subclasses must implement eachMapping\")}allGeneratedPositionsFor(e){throw new Error(\"Subclasses must implement allGeneratedPositionsFor\")}destroy(){throw new Error(\"Subclasses must implement destroy\")}}u.prototype._version=3,u.GENERATED_ORDER=1,u.ORIGINAL_ORDER=2,u.GREATEST_LOWER_BOUND=1,u.LEAST_UPPER_BOUND=2,n.SourceMapConsumer=u;class c extends u{constructor(e,n){return super(a).then(t=>{let o=e;\"string\"==typeof e&&(o=r.parseSourceMapInput(e));const s=r.getArg(o,\"version\");let a=r.getArg(o,\"sources\");const u=r.getArg(o,\"names\",[]);let c=r.getArg(o,\"sourceRoot\",null);const g=r.getArg(o,\"sourcesContent\",null),p=r.getArg(o,\"mappings\"),h=r.getArg(o,\"file\",null);if(s!=t._version)throw new Error(\"Unsupported version: \"+s);return c&&(c=r.normalize(c)),a=a.map(String).map(r.normalize).map((function(e){return c&&r.isAbsolute(c)&&r.isAbsolute(e)?r.relative(c,e):e})),t._names=i.fromArray(u.map(String),!0),t._sources=i.fromArray(a,!0),t._absoluteSources=t._sources.toArray().map((function(e){return r.computeSourceURL(c,e,n)})),t.sourceRoot=c,t.sourcesContent=g,t._mappings=p,t._sourceMapURL=n,t.file=h,t._computedColumnSpans=!1,t._mappingsPtr=0,t._wasm=null,l().then(e=>(t._wasm=e,t))})}_findSourceIndex(e){let n=e;if(null!=this.sourceRoot&&(n=r.relative(this.sourceRoot,n)),this._sources.has(n))return this._sources.indexOf(n);for(let n=0;n<this._absoluteSources.length;++n)if(this._absoluteSources[n]==e)return n;return-1}static fromSourceMap(e,n){return new c(e.toString())}get sources(){return this._absoluteSources.slice()}_getMappingsPtr(){return 0===this._mappingsPtr&&this._parseMappings(this._mappings,this.sourceRoot),this._mappingsPtr}_parseMappings(e,n){const t=e.length,r=this._wasm.exports.allocate_mappings(t),o=new Uint8Array(this._wasm.exports.memory.buffer,r,t);for(let n=0;n<t;n++)o[n]=e.charCodeAt(n);const i=this._wasm.exports.parse_mappings(r);if(!i){const e=this._wasm.exports.get_last_error();let n=`Error parsing mappings (code ${e}): `;switch(e){case 1:n+=\"the mappings contained a negative line, column, source index, or name index\";break;case 2:n+=\"the mappings contained a number larger than 2**32\";break;case 3:n+=\"reached EOF while in the middle of parsing a VLQ\";break;case 4:n+=\"invalid base 64 character while parsing a VLQ\";break;default:n+=\"unknown error code\"}throw new Error(n)}this._mappingsPtr=i}eachMapping(e,n,t){const o=n||null,i=t||u.GENERATED_ORDER,s=this.sourceRoot;this._wasm.withMappingCallback(n=>{null!==n.source&&(n.source=this._sources.at(n.source),n.source=r.computeSourceURL(s,n.source,this._sourceMapURL),null!==n.name&&(n.name=this._names.at(n.name))),e.call(o,n)},()=>{switch(i){case u.GENERATED_ORDER:this._wasm.exports.by_generated_location(this._getMappingsPtr());break;case u.ORIGINAL_ORDER:this._wasm.exports.by_original_location(this._getMappingsPtr());break;default:throw new Error(\"Unknown order of iteration.\")}})}allGeneratedPositionsFor(e){let n=r.getArg(e,\"source\");const t=r.getArg(e,\"line\"),o=e.column||0;if(n=this._findSourceIndex(n),n<0)return[];if(t<1)throw new Error(\"Line numbers must be >= 1\");if(o<0)throw new Error(\"Column numbers must be >= 0\");const i=[];return this._wasm.withMappingCallback(e=>{let n=e.lastGeneratedColumn;this._computedColumnSpans&&null===n&&(n=1/0),i.push({line:e.generatedLine,column:e.generatedColumn,lastColumn:n})},()=>{this._wasm.exports.all_generated_locations_for(this._getMappingsPtr(),n,t-1,\"column\"in e,o)}),i}destroy(){0!==this._mappingsPtr&&(this._wasm.exports.free_mappings(this._mappingsPtr),this._mappingsPtr=0)}computeColumnSpans(){this._computedColumnSpans||(this._wasm.exports.compute_column_spans(this._getMappingsPtr()),this._computedColumnSpans=!0)}originalPositionFor(e){const n={generatedLine:r.getArg(e,\"line\"),generatedColumn:r.getArg(e,\"column\")};if(n.generatedLine<1)throw new Error(\"Line numbers must be >= 1\");if(n.generatedColumn<0)throw new Error(\"Column numbers must be >= 0\");let t,o=r.getArg(e,\"bias\",u.GREATEST_LOWER_BOUND);if(null==o&&(o=u.GREATEST_LOWER_BOUND),this._wasm.withMappingCallback(e=>t=e,()=>{this._wasm.exports.original_location_for(this._getMappingsPtr(),n.generatedLine-1,n.generatedColumn,o)}),t&&t.generatedLine===n.generatedLine){let e=r.getArg(t,\"source\",null);null!==e&&(e=this._sources.at(e),e=r.computeSourceURL(this.sourceRoot,e,this._sourceMapURL));let n=r.getArg(t,\"name\",null);return null!==n&&(n=this._names.at(n)),{source:e,line:r.getArg(t,\"originalLine\",null),column:r.getArg(t,\"originalColumn\",null),name:n}}return{source:null,line:null,column:null,name:null}}hasContentsOfAllSources(){return!!this.sourcesContent&&(this.sourcesContent.length>=this._sources.size()&&!this.sourcesContent.some((function(e){return null==e})))}sourceContentFor(e,n){if(!this.sourcesContent)return null;const t=this._findSourceIndex(e);if(t>=0)return this.sourcesContent[t];let o,i=e;if(null!=this.sourceRoot&&(i=r.relative(this.sourceRoot,i)),null!=this.sourceRoot&&(o=r.urlParse(this.sourceRoot))){const e=i.replace(/^file:\\/\\//,\"\");if(\"file\"==o.scheme&&this._sources.has(e))return this.sourcesContent[this._sources.indexOf(e)];if((!o.path||\"/\"==o.path)&&this._sources.has(\"/\"+i))return this.sourcesContent[this._sources.indexOf(\"/\"+i)]}if(n)return null;throw new Error('\"'+i+'\" is not in the SourceMap.')}generatedPositionFor(e){let n=r.getArg(e,\"source\");if(n=this._findSourceIndex(n),n<0)return{line:null,column:null,lastColumn:null};const t={source:n,originalLine:r.getArg(e,\"line\"),originalColumn:r.getArg(e,\"column\")};if(t.originalLine<1)throw new Error(\"Line numbers must be >= 1\");if(t.originalColumn<0)throw new Error(\"Column numbers must be >= 0\");let o,i=r.getArg(e,\"bias\",u.GREATEST_LOWER_BOUND);if(null==i&&(i=u.GREATEST_LOWER_BOUND),this._wasm.withMappingCallback(e=>o=e,()=>{this._wasm.exports.generated_location_for(this._getMappingsPtr(),t.source,t.originalLine-1,t.originalColumn,i)}),o&&o.source===t.source){let e=o.lastGeneratedColumn;return this._computedColumnSpans&&null===e&&(e=1/0),{line:r.getArg(o,\"generatedLine\",null),column:r.getArg(o,\"generatedColumn\",null),lastColumn:e}}return{line:null,column:null,lastColumn:null}}}c.prototype.consumer=u,n.BasicSourceMapConsumer=c;class g extends u{constructor(e,n){return super(a).then(t=>{let o=e;\"string\"==typeof e&&(o=r.parseSourceMapInput(e));const s=r.getArg(o,\"version\"),l=r.getArg(o,\"sections\");if(s!=t._version)throw new Error(\"Unsupported version: \"+s);t._sources=new i,t._names=new i,t.__generatedMappings=null,t.__originalMappings=null,t.__generatedMappingsUnsorted=null,t.__originalMappingsUnsorted=null;let a={line:-1,column:0};return Promise.all(l.map(e=>{if(e.url)throw new Error(\"Support for url field in sections not implemented.\");const t=r.getArg(e,\"offset\"),o=r.getArg(t,\"line\"),i=r.getArg(t,\"column\");if(o<a.line||o===a.line&&i<a.column)throw new Error(\"Section offsets must be ordered and non-overlapping.\");a=t;return new u(r.getArg(e,\"map\"),n).then(e=>({generatedOffset:{generatedLine:o+1,generatedColumn:i+1},consumer:e}))})).then(e=>(t._sections=e,t))})}get _generatedMappings(){return this.__generatedMappings||this._sortGeneratedMappings(),this.__generatedMappings}get _originalMappings(){return this.__originalMappings||this._sortOriginalMappings(),this.__originalMappings}get _generatedMappingsUnsorted(){return this.__generatedMappingsUnsorted||this._parseMappings(this._mappings,this.sourceRoot),this.__generatedMappingsUnsorted}get _originalMappingsUnsorted(){return this.__originalMappingsUnsorted||this._parseMappings(this._mappings,this.sourceRoot),this.__originalMappingsUnsorted}_sortGeneratedMappings(){const e=this._generatedMappingsUnsorted;e.sort(r.compareByGeneratedPositionsDeflated),this.__generatedMappings=e}_sortOriginalMappings(){const e=this._originalMappingsUnsorted;e.sort(r.compareByOriginalPositions),this.__originalMappings=e}get sources(){const e=[];for(let n=0;n<this._sections.length;n++)for(let t=0;t<this._sections[n].consumer.sources.length;t++)e.push(this._sections[n].consumer.sources[t]);return e}originalPositionFor(e){const n={generatedLine:r.getArg(e,\"line\"),generatedColumn:r.getArg(e,\"column\")},t=o.search(n,this._sections,(function(e,n){const t=e.generatedLine-n.generatedOffset.generatedLine;return t||e.generatedColumn-n.generatedOffset.generatedColumn})),i=this._sections[t];return i?i.consumer.originalPositionFor({line:n.generatedLine-(i.generatedOffset.generatedLine-1),column:n.generatedColumn-(i.generatedOffset.generatedLine===n.generatedLine?i.generatedOffset.generatedColumn-1:0),bias:e.bias}):{source:null,line:null,column:null,name:null}}hasContentsOfAllSources(){return this._sections.every((function(e){return e.consumer.hasContentsOfAllSources()}))}sourceContentFor(e,n){for(let n=0;n<this._sections.length;n++){const t=this._sections[n].consumer.sourceContentFor(e,!0);if(t)return t}if(n)return null;throw new Error('\"'+e+'\" is not in the SourceMap.')}generatedPositionFor(e){for(let n=0;n<this._sections.length;n++){const t=this._sections[n];if(-1===t.consumer._findSourceIndex(r.getArg(e,\"source\")))continue;const o=t.consumer.generatedPositionFor(e);if(o){return{line:o.line+(t.generatedOffset.generatedLine-1),column:o.column+(t.generatedOffset.generatedLine===o.line?t.generatedOffset.generatedColumn-1:0)}}}return{line:null,column:null}}_parseMappings(e,n){const t=this.__generatedMappingsUnsorted=[],o=this.__originalMappingsUnsorted=[];for(let e=0;e<this._sections.length;e++){const n=this._sections[e],i=[];n.consumer.eachMapping(e=>i.push(e));for(let e=0;e<i.length;e++){const s=i[e];let l=r.computeSourceURL(n.consumer.sourceRoot,null,this._sourceMapURL);this._sources.add(l),l=this._sources.indexOf(l);let a=null;s.name&&(this._names.add(s.name),a=this._names.indexOf(s.name));const u={source:l,generatedLine:s.generatedLine+(n.generatedOffset.generatedLine-1),generatedColumn:s.generatedColumn+(n.generatedOffset.generatedLine===s.generatedLine?n.generatedOffset.generatedColumn-1:0),originalLine:s.originalLine,originalColumn:s.originalColumn,name:a};t.push(u),\"number\"==typeof u.originalLine&&o.push(u)}}}eachMapping(e,n,t){const o=n||null;let i;switch(t||u.GENERATED_ORDER){case u.GENERATED_ORDER:i=this._generatedMappings;break;case u.ORIGINAL_ORDER:i=this._originalMappings;break;default:throw new Error(\"Unknown order of iteration.\")}const s=this.sourceRoot;i.map((function(e){let n=null;return null!==e.source&&(n=this._sources.at(e.source),n=r.computeSourceURL(s,n,this._sourceMapURL)),{source:n,generatedLine:e.generatedLine,generatedColumn:e.generatedColumn,originalLine:e.originalLine,originalColumn:e.originalColumn,name:null===e.name?null:this._names.at(e.name)}}),this).forEach(e,o)}_findMapping(e,n,t,r,i,s){if(e[t]<=0)throw new TypeError(\"Line must be greater than or equal to 1, got \"+e[t]);if(e[r]<0)throw new TypeError(\"Column must be greater than or equal to 0, got \"+e[r]);return o.search(e,n,i,s)}allGeneratedPositionsFor(e){const n=r.getArg(e,\"line\"),t={source:r.getArg(e,\"source\"),originalLine:n,originalColumn:r.getArg(e,\"column\",0)};if(t.source=this._findSourceIndex(t.source),t.source<0)return[];if(t.originalLine<1)throw new Error(\"Line numbers must be >= 1\");if(t.originalColumn<0)throw new Error(\"Column numbers must be >= 0\");const i=[];let s=this._findMapping(t,this._originalMappings,\"originalLine\",\"originalColumn\",r.compareByOriginalPositions,o.LEAST_UPPER_BOUND);if(s>=0){let t=this._originalMappings[s];if(void 0===e.column){const e=t.originalLine;for(;t&&t.originalLine===e;){let e=t.lastGeneratedColumn;this._computedColumnSpans&&null===e&&(e=1/0),i.push({line:r.getArg(t,\"generatedLine\",null),column:r.getArg(t,\"generatedColumn\",null),lastColumn:e}),t=this._originalMappings[++s]}}else{const e=t.originalColumn;for(;t&&t.originalLine===n&&t.originalColumn==e;){let e=t.lastGeneratedColumn;this._computedColumnSpans&&null===e&&(e=1/0),i.push({line:r.getArg(t,\"generatedLine\",null),column:r.getArg(t,\"generatedColumn\",null),lastColumn:e}),t=this._originalMappings[++s]}}}return i}destroy(){for(let e=0;e<this._sections.length;e++)this._sections[e].consumer.destroy()}}n.IndexedSourceMapConsumer=g},function(e,n){n.GREATEST_LOWER_BOUND=1,n.LEAST_UPPER_BOUND=2,n.search=function(e,t,r,o){if(0===t.length)return-1;let i=function e(t,r,o,i,s,l){const a=Math.floor((r-t)/2)+t,u=s(o,i[a],!0);return 0===u?a:u>0?r-a>1?e(a,r,o,i,s,l):l==n.LEAST_UPPER_BOUND?r<i.length?r:-1:a:a-t>1?e(t,a,o,i,s,l):l==n.LEAST_UPPER_BOUND?a:t<0?-1:t}(-1,t.length,e,t,r,o||n.GREATEST_LOWER_BOUND);if(i<0)return-1;for(;i-1>=0&&0===r(t[i],t[i-1],!0);)--i;return i}},function(n,t){n.exports=e},function(e,t){e.exports=n},function(e,n,t){const r=t(4);function o(){this.generatedLine=0,this.generatedColumn=0,this.lastGeneratedColumn=null,this.source=null,this.originalLine=null,this.originalColumn=null,this.name=null}let i=null;e.exports=function(){if(i)return i;const e=[];return i=r().then(n=>WebAssembly.instantiate(n,{env:{mapping_callback(n,t,r,i,s,l,a,u,c,g){const p=new o;p.generatedLine=n+1,p.generatedColumn=t,r&&(p.lastGeneratedColumn=i-1),s&&(p.source=l,p.originalLine=a+1,p.originalColumn=u,c&&(p.name=g)),e[e.length-1](p)},start_all_generated_locations_for(){console.time(\"all_generated_locations_for\")},end_all_generated_locations_for(){console.timeEnd(\"all_generated_locations_for\")},start_compute_column_spans(){console.time(\"compute_column_spans\")},end_compute_column_spans(){console.timeEnd(\"compute_column_spans\")},start_generated_location_for(){console.time(\"generated_location_for\")},end_generated_location_for(){console.timeEnd(\"generated_location_for\")},start_original_location_for(){console.time(\"original_location_for\")},end_original_location_for(){console.timeEnd(\"original_location_for\")},start_parse_mappings(){console.time(\"parse_mappings\")},end_parse_mappings(){console.timeEnd(\"parse_mappings\")},start_sort_by_generated_location(){console.time(\"sort_by_generated_location\")},end_sort_by_generated_location(){console.timeEnd(\"sort_by_generated_location\")},start_sort_by_original_location(){console.time(\"sort_by_original_location\")},end_sort_by_original_location(){console.timeEnd(\"sort_by_original_location\")}}})).then(n=>({exports:n.instance.exports,withMappingCallback:(n,t)=>{e.push(n);try{t()}finally{e.pop()}}})).then(null,e=>{throw i=null,e}),i}},function(e,n,t){const r=t(1).SourceMapGenerator,o=t(0),i=/(\\r?\\n)/,s=\"$$$isSourceNode$$$\";class l{constructor(e,n,t,r,o){this.children=[],this.sourceContents={},this.line=null==e?null:e,this.column=null==n?null:n,this.source=null==t?null:t,this.name=null==o?null:o,this[s]=!0,null!=r&&this.add(r)}static fromStringWithSourceMap(e,n,t){const r=new l,s=e.split(i);let a=0;const u=function(){return e()+(e()||\"\");function e(){return a<s.length?s[a++]:void 0}};let c,g=1,p=0,h=null;return n.eachMapping((function(e){if(null!==h){if(!(g<e.generatedLine)){c=s[a]||\"\";const n=c.substr(0,e.generatedColumn-p);return s[a]=c.substr(e.generatedColumn-p),p=e.generatedColumn,m(h,n),void(h=e)}m(h,u()),g++,p=0}for(;g<e.generatedLine;)r.add(u()),g++;p<e.generatedColumn&&(c=s[a]||\"\",r.add(c.substr(0,e.generatedColumn)),s[a]=c.substr(e.generatedColumn),p=e.generatedColumn),h=e}),this),a<s.length&&(h&&m(h,u()),r.add(s.splice(a).join(\"\"))),n.sources.forEach((function(e){const i=n.sourceContentFor(e);null!=i&&(null!=t&&(e=o.join(t,e)),r.setSourceContent(e,i))})),r;function m(e,n){if(null===e||void 0===e.source)r.add(n);else{const i=t?o.join(t,e.source):e.source;r.add(new l(e.originalLine,e.originalColumn,i,n,e.name))}}}add(e){if(Array.isArray(e))e.forEach((function(e){this.add(e)}),this);else{if(!e[s]&&\"string\"!=typeof e)throw new TypeError(\"Expected a SourceNode, string, or an array of SourceNodes and strings. Got \"+e);e&&this.children.push(e)}return this}prepend(e){if(Array.isArray(e))for(let n=e.length-1;n>=0;n--)this.prepend(e[n]);else{if(!e[s]&&\"string\"!=typeof e)throw new TypeError(\"Expected a SourceNode, string, or an array of SourceNodes and strings. Got \"+e);this.children.unshift(e)}return this}walk(e){let n;for(let t=0,r=this.children.length;t<r;t++)n=this.children[t],n[s]?n.walk(e):\"\"!==n&&e(n,{source:this.source,line:this.line,column:this.column,name:this.name})}join(e){let n,t;const r=this.children.length;if(r>0){for(n=[],t=0;t<r-1;t++)n.push(this.children[t]),n.push(e);n.push(this.children[t]),this.children=n}return this}replaceRight(e,n){const t=this.children[this.children.length-1];return t[s]?t.replaceRight(e,n):\"string\"==typeof t?this.children[this.children.length-1]=t.replace(e,n):this.children.push(\"\".replace(e,n)),this}setSourceContent(e,n){this.sourceContents[o.toSetString(e)]=n}walkSourceContents(e){for(let n=0,t=this.children.length;n<t;n++)this.children[n][s]&&this.children[n].walkSourceContents(e);const n=Object.keys(this.sourceContents);for(let t=0,r=n.length;t<r;t++)e(o.fromSetString(n[t]),this.sourceContents[n[t]])}toString(){let e=\"\";return this.walk((function(n){e+=n})),e}toStringWithSourceMap(e){const n={code:\"\",line:1,column:0},t=new r(e);let o=!1,i=null,s=null,l=null,a=null;return this.walk((function(e,r){n.code+=e,null!==r.source&&null!==r.line&&null!==r.column?(i===r.source&&s===r.line&&l===r.column&&a===r.name||t.addMapping({source:r.source,original:{line:r.line,column:r.column},generated:{line:n.line,column:n.column},name:r.name}),i=r.source,s=r.line,l=r.column,a=r.name,o=!0):o&&(t.addMapping({generated:{line:n.line,column:n.column}}),i=null,o=!1);for(let s=0,l=e.length;s<l;s++)10===e.charCodeAt(s)?(n.line++,n.column=0,s+1===l?(i=null,o=!1):o&&t.addMapping({source:r.source,original:{line:r.line,column:r.column},generated:{line:n.line,column:n.column},name:r.name})):n.column++})),this.walkSourceContents((function(e,n){t.setSourceContent(e,n)})),{code:n.code,map:t}}}n.SourceNode=l}])}));"
  },
  {
    "path": "client/src/js/overrides.js",
    "content": "// override top-ancestor initComponent to normalize the 'stateful' property\n// since other framework code checks 'if (this.stateful !== false)'\nExt.Component.prototype.initComponent = function(){\n    if(this.listeners){\n        this.on(this.listeners);\n        delete this.listeners;\n    }\n    this.enableBubble(this.bubbleEvents);\n    // an absent property is explicitly set to false\n    this.stateful = !!this.stateful\n};\n\nExt.override(Ext.grid.EditorGridPanel, {\n    initEvents : function(){\n        Ext.grid.EditorGridPanel.superclass.initEvents.call(this);\n        // do not want the framework's handling of mousewheel\n        // this.getGridEl().on('mousewheel', this.stopEditing.createDelegate(this, [true]), this);\n        this.on('columnresize', this.stopEditing, this, [true]);\n\n        if(this.clicksToEdit == 1){\n            this.on(\"cellclick\", this.onCellDblClick, this);\n        }else {\n            var view = this.getView();\n            if(this.clicksToEdit == 'auto' && view.mainBody){\n                view.mainBody.on('mousedown', this.onAutoEditClick, this);\n            }\n            this.on('celldblclick', this.onCellDblClick, this);\n        }\n    }\n})\nExt.override(Ext.grid.CheckboxSelectionModel, {\n    onMouseDown : function(e, t){\n        if(e.button === 0 && t.className == 'x-grid3-row-checker'){ // Only fire if left-click\n            e.stopEvent();\n            var row = e.getTarget('.x-grid3-row');\n            if(row){\n                var index = row.rowIndex;\n                if(this.isSelected(index)){\n                    this.deselectRow(index);\n                }else{\n                    this.selectRow(index, true);\n                    this.grid.getView().focusRow(index);\n                }\n            }\n            const hd = this.grid.view.innerHd.querySelector('.x-grid3-hd-row .x-grid3-td-checker .x-grid3-hd-checker')\n\n            if (hd) {\n                const hdState = this.selections.length === 0 ? null : this.grid.store.getCount() === this.selections.length ? 'on' : 'ind'\n                hd.classList.remove('x-grid3-hd-checker-on')\n                hd.classList.remove('x-grid3-hd-checker-ind')\n                if (hdState) {\n                    hd.classList.add(`x-grid3-hd-checker-${hdState}`)\n                }\n            }\n        }\n    },\n    onHdMouseDown : function(e, t) {\n        if(t.className == 'x-grid3-hd-checker'){\n            e.stopEvent()\n            var hd = Ext.fly(t.parentNode);\n            var isChecked = hd.hasClass('x-grid3-hd-checker-on')\n            var isIndeterminate = hd.hasClass('x-grid3-hd-checker-ind')\n            if (isChecked ) {\n                hd.removeClass('x-grid3-hd-checker-on')\n                this.suspendEvents(false)\n                this.deselectRange(0, this.grid.store.getCount() - 1)\n                this.resumeEvents()\n                this.fireEvent('selectionchange', this)\n\n            }\n            else {\n                if (isIndeterminate) hd.removeClass('x-grid3-hd-checker-ind')\n                hd.addClass('x-grid3-hd-checker-on')\n                this.suspendEvents(false)\n                this.selectRange(0, this.grid.store.getCount() - 1)\n                this.resumeEvents()\n                this.fireEvent('selectionchange', this)\n        \n            }\n        }\n    }\n})\n\n\n// Replace Ext.getBody() to return the Ext.Element below the\n// classification banner, if one is present\nconst origGetBody = Ext.getBody\nExt.getBody = function () {\n    return SM.contentEl || origGetBody()\n}\nExt.LoadMask.prototype.onBeforeLoad = function() {\n    if(!this.disabled){\n        if (this.store.smMaskDelay) {\n            if (this.smTask) {\n                clearTimeout(this.smTask)\n            }\n            this.smTask = setTimeout(this.el.mask.bind(this.el), this.store.smMaskDelay, this.msg, this.msgCls)\n        }\n        else {\n            this.el.mask(this.msg, this.msgCls)\n        }\n    }\n}\nExt.LoadMask.prototype.onLoad = function() {\n    if (this.smTask) {\n        clearTimeout(this.smTask)\n    }\n    this.el.unmask(this.removeMask);\n}\n\n// patch DragDropMgr to prevent a \"hung\" drop with cursor stuck\n// Source: carl.a.smigielski@saic.com\nExt.dd.DragDropMgr.getZIndex = function(element) {\n    var body = document.body,\n        z,\n        zIndex = -1;\n\n    element = Ext.getDom(element);\n    // patch to ensure element is not null\n    while (element && element !== body) {\n        if (!isNaN(z = Number(Ext.fly(element).getStyle('zIndex')))) {\n            zIndex = z;\n        }\n        element = element.parentNode;\n    }\n    return zIndex;\n}\n\n// replace 'window' with 'node' as scope: this.directFn.apply(node, args);\n// Source: carl.a.smigielski@saic.com\nExt.override(Ext.tree.TreeLoader, {\n    requestData : function(node, callback, scope){\n        if(this.fireEvent(\"beforeload\", this, node, callback) !== false){\n            if(this.directFn){\n                var args = this.getParams(node);\n                args.push(this.processDirectResponse.createDelegate(this, [{callback: callback, node: node, scope: scope}], true));\n                // replace 'window' with 'node' as scope\n                this.directFn.apply(node, args);\n            }else{\n                this.transId = Ext.Ajax.request({\n                    method:this.requestMethod,\n                    url: this.dataUrl||this.url,\n                    success: this.handleResponse,\n                    failure: this.handleFailure,\n                    scope: this,\n                    argument: {callback: callback, node: node, scope: scope},\n                    params: this.getParams(node)\n                });\n            }\n        }else{\n            // if the load is cancelled, make sure we notify\n            // the node that we are done\n            this.runCallback(callback, scope || node, []);\n        }\n    }\n})\n\n// // Lower default z-index value from 11000 to 9000\n// // Source: carl.a.smigielski@saic.com\n// Ext.override(Ext.Layer, {\n//     getZIndex: function(){\n//         return this.zindex || parseInt((this.getShim() || this).getStyle('z-index'), 10) || 9000;\n//     }\n// });\n\n// Prevent changing readOnly checkboxes\n// Source: https://forum.sencha.com/forum/showthread.php?90531-Readonly-Checkbox-Override\nExt.override(Ext.form.Checkbox, {\n    onClick: function (e,o) {\n     if (this.readOnly === true){\n          e.preventDefault();\n     } else {\n        if(this.el.dom.checked != this.checked){\n        this.setValue(this.el.dom.checked);\n        }\n     }\n    }\n});\n\n// ext-base.js adds a 'remove' method to Array.prototype\n// By default, that property is enumerated by for ... in\n// This breaks fast-xml-parser 3.14.3 (among others?) so we make the property not enumerable\n// Source: carl.a.smigielski@saic.com\nObject.defineProperty(Array.prototype, 'remove', { enumerable: false })\n\n// Column xtype for UNIX timestamps\n// Source: carl.a.smigielski@saic.com\nExt.grid.Column.types.timestampcolumn = Ext.extend(Ext.grid.Column, {\n    /**\n     * @cfg {String} format\n     * A formatting string as used by {@link Date#format} to format a Date for this Column\n     * (defaults to <tt>'m/d/Y'</tt>).\n     */\n    format : 'Y-m-d H:i:s',\n    constructor: function(cfg){\n        Ext.grid.Column.types.timestampcolumn.superclass.constructor.call(this, cfg);\n        this.renderer = (v) => v ? Ext.util.Format.date(new Date(v * 1000), this.format) : \"None\"\n    }\n});\n\n\n// Flat style Windows by default\n// Source: carl.a.smigielski@saic.com\nExt.override(Ext.Window, {\n    cls: 'sm-round-panel',\n    frame: false,\n    resizable: false,\n    shadow: false,\n    // private\n    onRender : function(ct, position){\n        Ext.Window.superclass.onRender.call(this, ct, position);\n\n        if(this.plain){\n            this.el.addClass('x-window-plain');\n        }\n\n        // this element allows the Window to be focused for keyboard events\n        this.focusEl = this.el.createChild({\n                    tag: 'a', href:'#', cls:'x-dlg-focus',\n                    tabIndex:'-1', html: '&#160;'});\n        this.focusEl.swallowEvent('click', true);\n\n        this.proxy = this.el.createProxy('x-window-proxy');\n        this.proxy.enableDisplayMode('block');\n\n        if(this.modal){\n            this.mask = this.container.createChild({cls:'ext-el-mask-modal'}, this.el.dom);\n            this.mask.enableDisplayMode('block');\n            this.mask.hide();\n            this.mon(this.mask, 'click', this.focus, this);\n        }\n        if(this.maximizable){\n            this.mon(this.header, 'dblclick', this.toggleMaximize, this);\n        }\n    },\n\n})\n\n// Form.getFieldValues\n// Add boolean parameter to return disabled fields\n// Source: carl.a.smigielski@saic.com\nExt.override(Ext.form.BasicForm, {\n    getFieldValues: function(dirtyOnly, getDisabled){\n        var o = {},\n            n,\n            key,\n            val;\n        this.items.each(function(f) {\n            if ((!f.disabled || getDisabled) && (dirtyOnly !== true || f.isDirty())) {\n                n = f.getName();\n                key = o[n];\n                val = f.getValue();\n\n                if(Ext.isDefined(key)){\n                    if(Ext.isArray(key)){\n                        o[n].push(val);\n                    }else{\n                        o[n] = [key, val];\n                    }\n                }else{\n                    o[n] = val;\n                }\n            }\n        });\n        return o;\n    }\n})\n\n// Promisfied Ajax.request() method\n// Source: Carl Smigielski\nExt.override(Ext.Ajax, {\n    requestPromise : async function (optionsIn) {\n        const _this = this\n        function requestPromisfied (options) {\n            return new Promise ( (resolve, reject) => {\n                _this.request({\n                    ...options,        \n                    success: function (response, options) {\n                        resolve ({\n                            response: response,\n                            options: options\n                        })\n                    },\n                    failure: function (response, options) {\n                        reject ({\n                            message: `${options.method} ${options.url}\\n${response.responseText}`,\n                            response: response,\n                            options: options\n                        })\n                    },\n                })\n            })\n        }\n        let response, options\n        try {\n            ;({response, options} = await requestPromisfied(optionsIn))\n        }\n        catch (e) {\n            throw new SM.Error.ExtRequestError(e)\n        }\n        if (optionsIn.responseType !== 'json') {\n            return {response, options}   \n        }\n        try {\n            return JSON.parse(response.responseText || '\"\"')\n        }\n        catch (e) {\n            throw new SM.Error.NonJsonResponse({response, options, parseError: e})\n        }\n    }\n})\n\n// Promisfied Ext.MessageBox.confirm method\n// Source: Carl Smigielski\nSM.confirmPromise = function (title, msg) {\n    return new Promise ( (resolve, reject) => {\n        callback = function (id) {\n            if (id !== undefined) {\n                resolve (id)\n            }\n            else {\n                reject (id)\n            }\n        }\n        Ext.Msg.confirm( title, msg, callback )\n    })\n}\n\n// custom Vtype for vtype:'IPAddress'\nExt.apply(Ext.form.VTypes, {\n    IPAddress:  function(v) {\n        //return /^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$/.test(v);\n\t\treturn /^(?=\\d+\\.\\d+\\.\\d+\\.\\d+$)(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[0-9])\\.?){4}$/.test(v);\n    },\n    IPAddressText: 'Must be an IP address (n.n.n.n)',\n    IPAddressMask: /[\\d\\.]/i\n});\n\n// Asterisk for required form fields\nExt.override(Ext.layout.FormLayout, {\n    getTemplateArgs: function(field) {\n        var noLabelSep = !field.fieldLabel || field.hideLabel;\n        var labelSep = (typeof field.labelSeparator == 'undefined' ? this.labelSeparator : field.labelSeparator);\n        if (field.allowBlank === false) labelSep += '<span style=\"color: #808080; padding-left: 2px;\">*</span>';\n        return {\n            id: field.id,\n            label: field.fieldLabel,\n            labelStyle: field.labelStyle||this.labelStyle||'',\n            elementStyle: this.elementStyle||'',\n            labelSeparator: noLabelSep ? '' : labelSep,\n            itemCls: (field.itemCls||this.container.itemCls||'') + (field.hideLabel ? ' x-hide-label' : ''),\n            clearCls: field.clearCls || 'x-form-clear-left'\n        };\n    }\n});\n\nExt.override(Ext.TabPanel, {\n\tidDelimiter: \"!!\"\n});\n\n// Grid hold position\nExt.override(Ext.grid.GridView, {\n   // holdPosition: false,\n    onLoad : function(){\n        if (!this.holdPosition) this.scrollToTop();\n        //this.holdPosition = false\n    }\n});\n\n// Force fit Min & Max\nExt.override(Ext.grid.GridView, {\n    initElements : function() {\n        var Element  = Ext.Element,\n            el       = Ext.get(this.grid.getGridEl().dom.firstChild),\n            mainWrap = new Element(el.child('div.x-grid3-viewport')),\n            mainHd   = new Element(mainWrap.child('div.x-grid3-header')),\n            scroller = new Element(mainWrap.child('div.x-grid3-scroller'));\n        \n        if (this.grid.hideHeaders) {\n            mainHd.setDisplayed(false);\n        }\n        \n        // Removed setting overflow-x to 'hidden' in scroller\n        \n        Ext.apply(this, {\n            el      : el,\n            mainWrap: mainWrap,\n            scroller: scroller,\n            mainHd  : mainHd,\n            innerHd : mainHd.child('div.x-grid3-header-inner').dom,\n            mainBody: new Element(Element.fly(scroller).child('div.x-grid3-body')),\n            focusEl : new Element(Element.fly(scroller).child('a')),\n            \n            resizeMarker: new Element(el.child('div.x-grid3-resize-marker')),\n            resizeProxy : new Element(el.child('div.x-grid3-resize-proxy'))\n        });\n        \n        this.focusEl.swallowEvent('click', true);\n    },\n    layout : function(initial) {\n        if (!this.mainBody) {\n            return; // not rendered\n        }\n\n        var grid       = this.grid,\n            gridEl     = grid.getGridEl(),\n            gridSize   = gridEl.getSize(true),\n            gridWidth  = gridSize.width,\n            gridHeight = gridSize.height,\n            scroller   = this.scroller,\n            scrollStyle, headerHeight, scrollHeight,\n            // added support for forceFitMin and forceFitMax\n            forceFitMin = this.forceFitMin || 0,\n            forceFitMax = this.forceFitMax || Infinity;\n        \n        if (gridWidth < 20 || gridHeight < 20) {\n            return;\n        }\n        \n        if (grid.autoHeight) {\n            scrollStyle = scroller.dom.style;\n            scrollStyle.overflow = 'visible';\n            \n            if (Ext.isWebKit) {\n                scrollStyle.position = 'static';\n            }\n        } else {\n            this.el.setSize(gridWidth, gridHeight);\n            \n            headerHeight = this.mainHd.getHeight();\n            scrollHeight = gridHeight - headerHeight;\n            \n            scroller.setSize(gridWidth, scrollHeight);\n            \n            if (this.innerHd) {\n                this.innerHd.style.width = (gridWidth) + \"px\";\n            }\n        }\n        \n        // added support for forceFitMin and forceFitMax\n        if (this.forceFit && (gridWidth > forceFitMin  && gridWidth < forceFitMax )|| (initial === true && this.autoFill)) {\n            if (this.lastViewWidth != gridWidth) {\n                this.fitColumns(false, false);\n                this.lastViewWidth = gridWidth;\n            }\n        } else {\n            this.autoExpand();\n            this.syncHeaderScroll();\n        }\n        \n        this.onLayout(gridWidth, scrollHeight);\n    },\n    fitColumns : function(preventRefresh, onlyExpand, omitColumn) {\n        // OVERRIDE: change test for being uninitialized, remove hack using gridWidth\n        // This fails in Firefox when this.getGridInnerWidth() calculates using the scroller width.\n        // In Firefox,the default is to show scrollbars on hover only, otherwise the width is only 2px.\n        // If fitColumns() is not stopped, it will set column widths in a manner that makes the last column very narrow.\n        // Substitute a test for this.mainBody existing, which it shouldn't while the view is not initialized.\n        var grid          = this.grid,\n            colModel      = this.cm,\n            totalColWidth = colModel.getTotalWidth(false),\n            gridWidth     = this.getGridInnerWidth(),\n            extraWidth    = gridWidth - totalColWidth,\n            columns       = [],\n            extraCol      = 0,\n            width         = 0,\n            colWidth, fraction, i;\n        \n        // not initialized, so don't screw up the default widths\n        // if (gridWidth < 20 || extraWidth === 0) {\n        //     return false;\n        // }\n        if (!this.mainBody) {\n            return false;\n        }\n        \n        var visibleColCount = colModel.getColumnCount(true),\n            totalColCount   = colModel.getColumnCount(false),\n            adjCount        = visibleColCount - (Ext.isNumber(omitColumn) ? 1 : 0);\n        \n        if (adjCount === 0) {\n            adjCount = 1;\n            omitColumn = undefined;\n        }\n        \n        //FIXME: the algorithm used here is odd and potentially confusing. Includes this for loop and the while after it.\n        for (i = 0; i < totalColCount; i++) {\n            if (!colModel.isFixed(i) && i !== omitColumn) {\n                colWidth = colModel.getColumnWidth(i);\n                columns.push(i, colWidth);\n                \n                if (!colModel.isHidden(i)) {\n                    extraCol = i;\n                    width += colWidth;\n                }\n            }\n        }\n        \n        fraction = (gridWidth - colModel.getTotalWidth()) / width;\n        \n        while (columns.length) {\n            colWidth = columns.pop();\n            i        = columns.pop();\n            \n            colModel.setColumnWidth(i, Math.max(grid.minColumnWidth, Math.floor(colWidth + colWidth * fraction)), true);\n        }\n        \n        //this has been changed above so remeasure now\n        totalColWidth = colModel.getTotalWidth(false);\n        \n        if (totalColWidth > gridWidth) {\n            var adjustCol = (adjCount == visibleColCount) ? extraCol : omitColumn,\n                newWidth  = Math.max(1, colModel.getColumnWidth(adjustCol) - (totalColWidth - gridWidth));\n            \n            colModel.setColumnWidth(adjustCol, newWidth, true);\n        }\n        \n        if (preventRefresh !== true) {\n            this.updateAllColumnWidths();\n        }\n        \n        return true;\n    },\n\n})\n\n// Two overrides below keep the backscape in a readOnly text field from causing the browser to go back in history\nExt.override(Ext.form.TextField, {\n\tenableKeyEvents : true,\n\tonKeyDown: function(e) {\n\t\tif ((this.readOnly == true || this.editable == false) && e.getCharCode() == e.BACKSPACE) {\n\t\t\te.preventDefault();\n\t\t}\n\t\tthis.fireEvent('keydown', this, e);\n\t}\n});\nExt.override(Ext.form.TextArea, {\n\tenableKeyEvents : true,\n\tonKeyDown: function(e) {\n\t\tif ((this.readOnly == true || this.editable == false) && e.getCharCode() == e.BACKSPACE) {\n\t\t\te.preventDefault();\n\t\t}\n\t\tthis.fireEvent('keydown', this, e);\n\t}\n});\n\n// Useful override for clearing the dirty flag for all form fields\nExt.override(Ext.form.BasicForm, {\n    clearDirty: function() {\n        var i, it = this.items.items, l = it.length, c;\n        for (i = 0; i < l; i++) {\n            c = it[i];\n            c.originalValue = String(c.getValue());\n            if(c.xtype == \"compositefield\") {\n                var j, jt = c.items.items, ljt = jt.length, d;\n                for (j = 0; j < ljt; j++) {\n                    d = jt[j];\n                    d.originalValue = String(d.getValue());\n                }            \t\n            }\n        }\n    }\n});\n\n// START WEBKIT FIX\nif (!Ext.isDefined(Ext.webKitVersion)) {\n    Ext.webKitVersion = Ext.isWebKit ? parseFloat(/AppleWebKit\\/([\\d.]+)/.exec(navigator.userAgent)[1], 10) : NaN;\n}\n/*\n * Box-sizing was changed beginning with Chrome v19.  For background information, see:\n * http://code.google.com/p/chromium/issues/detail?id=124816\n * https://bugs.webkit.org/show_bug.cgi?id=78412\n * https://bugs.webkit.org/show_bug.cgi?id=87536\n * http://www.sencha.com/forum/showthread.php?198124-Grids-are-rendered-differently-in-upcoming-versions-of-Google-Chrome&p=824367\n *\n * */\nif (Ext.isWebKit && Ext.webKitVersion >= 535.2) { // probably not the exact version, but the issues started appearing in chromium 19\n    Ext.override(Ext.grid.ColumnModel, {\n        getTotalWidth: function (includeHidden) {\n            if (!this.totalWidth) {\n                var boxsizeadj = 2;\n                this.totalWidth = 0;\n                for (var i = 0, len = this.config.length; i < len; i++) {\n                    if (includeHidden || !this.isHidden(i)) {\n                        this.totalWidth += (this.getColumnWidth(i) + boxsizeadj);\n                    }\n                }\n            }\n            return this.totalWidth;\n        }\n    });\n\n\n    Ext.onReady(function() {\n        Ext.get(document.body).addClass('ext-chrome-fixes');\n        Ext.util.CSS.createStyleSheet('@media screen and (-webkit-min-device-pixel-ratio:0) {.x-grid3-cell{box-sizing: border-box !important;}}', 'chrome-fixes-box-sizing');\n    });\n}\n// END WEB KIT FIX\n\n// START Border layout with percentages\nExt.override(Ext.layout.BorderLayout, {\n onLayout : function(ct, target){\n  var collapsed;\n  var size = target.getViewSize(), w = size.width, h = size.height;\n  if(!this.rendered){\n   target.position();\n   target.addClass('x-border-layout-ct');\n   collapsed = [];\n   var items = ct.items.items;\n   for(var i = 0, len = items.length; i < len; i++) {\n    var c = items[i];\n    var pos = c.region;\n    if(c.collapsed){\n     collapsed.push(c);\n    }\n    c.collapsed = false;\n    var r = this[pos] = pos != 'center' && c.split ?\n     new Ext.layout.BorderLayout.SplitRegion(this, c.initialConfig, pos) :\n     new Ext.layout.BorderLayout.Region(this, c.initialConfig, pos);\n    if(pos == 'north' || pos == 'south'){\n     if(typeof c.height == 'string' && c.relHeight === undefined){\n      var p = c.height.match(/(\\d+)%/);\n      if(p[1]){\n       c.relHeight = parseInt(p[1], 10) * .01;\n      }\n     }\n     if(c.relHeight !== undefined){\n      if(typeof c.relHeight != 'number'){\n       c.relHeight = parseFloat(c.relHeight);\n      }\n      c.height = h * c.relHeight;\n     }\n     r.minSize = r.minSize || r.minHeight;\n     r.maxSize = r.maxSize || r.maxHeight;\n    } else if(pos == 'east' || pos == 'west'){\n     if(typeof c.width == 'string' && c.relWidth === undefined){\n      var p = c.width.match(/(\\d+)%/);\n      if(p[1]){\n       c.relWidth = parseInt(p[1], 10) * .01;\n      }\n     }\n     if(c.relWidth !== undefined){\n      if(typeof c.relWidth != 'number'){\n       c.relWidth = parseFloat(c.relWidth);\n      }\n      c.width = w * c.relWidth;\n     }\n     r.minSize = r.minSize || r.minWidth;\n     r.maxSize = r.maxSize || r.maxWidth;\n    }\n    if(!c.rendered){\n     c.cls = c.cls ? c.cls +' x-border-panel' : 'x-border-panel';\n     c.render(target, i);\n    }\n    r.render(target, c);\n   }\n   this.rendered = true;\n  }\n  if(w < 20 || h < 20){\n   if(collapsed){\n    this.restoreCollapsed = collapsed;\n   }\n   return;\n  }else if(this.restoreCollapsed){\n   collapsed = this.restoreCollapsed;\n   delete this.restoreCollapsed;\n  }\n  var centerW = w, centerH = h, centerY = 0, centerX = 0;\n  var n = this.north, s = this.south, west = this.west, e = this.east, c = this.center;\n  if(!c && Ext.layout.BorderLayout.WARN !== false){\n   throw 'No center region defined in BorderLayout ' + ct.id;\n  }\n  if(n && n.isVisible()){\n   var b = n.getSize();\n   var m = n.getMargins();\n   b.width = w - (m.left+m.right);\n   if(n.panel.relHeight !== undefined){\n    n.height = Math.round(h * n.panel.relHeight);\n    b.height = n.minSize && n.height < n.minSize ? n.minSize :\n     (n.maxSize && n.height > n.maxSize ? n.maxSize : n.height);\n   }\n   b.x = m.left;\n   b.y = m.top;\n   centerY = b.height + b.y + m.bottom;\n   centerH -= centerY;\n   n.applyLayout(b);\n  }\n  if(s && s.isVisible()){\n   var b = s.getSize();\n   var m = s.getMargins();\n   b.width = w - (m.left+m.right);\n   if(s.panel.relHeight !== undefined){\n    s.height = Math.round(h * s.panel.relHeight);\n    b.height = s.minSize && s.height < s.minSize ? s.minSize :\n     (s.maxSize && s.height > s.maxSize ? s.maxSize : s.height);\n   }\n   b.x = m.left;\n   var totalHeight = (b.height + m.top + m.bottom);\n   b.y = h - totalHeight + m.top;\n   centerH -= totalHeight;\n   s.applyLayout(b);\n  }\n  if(west && west.isVisible()){\n   var b = west.getSize();\n   var m = west.getMargins();\n   b.height = centerH - (m.top+m.bottom);\n   if(west.panel.relWidth !== undefined){\n    west.width = Math.round(w * west.panel.relWidth);\n    b.width = west.minSize && west.width < west.minSize ? west.minSize :\n     (west.maxSize && west.width > west.maxSize ? west.maxSize : west.width);\n   }\n   b.x = m.left;\n   b.y = centerY + m.top;\n   var totalWidth = (b.width + m.left + m.right);\n   centerX += totalWidth;\n   centerW -= totalWidth;\n   west.applyLayout(b);\n  }\n  if(e && e.isVisible()){\n   var b = e.getSize();\n   var m = e.getMargins();\n   b.height = centerH - (m.top+m.bottom);\n   if(e.panel.relWidth !== undefined){\n    e.width = Math.round(w * e.panel.relWidth);\n    b.width = e.minSize && e.width < e.minSize ? e.minSize :\n     (e.maxSize && e.width > e.maxSize ? e.maxSize : e.width);\n   }\n   var totalWidth = (b.width + m.left + m.right);\n   b.x = w - totalWidth + m.left;\n   b.y = centerY + m.top;\n   centerW -= totalWidth;\n   e.applyLayout(b);\n  }\n  if(c){\n   var m = c.getMargins();\n   var centerBox = {\n    x: centerX + m.left,\n    y: centerY + m.top,\n    width: centerW - (m.left+m.right),\n    height: centerH - (m.top+m.bottom)\n   };\n   c.applyLayout(centerBox);\n  }\n  if(collapsed){\n   for(var i = 0, len = collapsed.length; i < len; i++){\n    collapsed[i].collapse(false);\n   }\n  }\n  if(Ext.isIE && Ext.isStrict){\n   target.repaint();\n  }\n }\n});\nExt.override(Ext.layout.BorderLayout.SplitRegion, {\n onSplitMove : function(split, newSize){\n  var s = this.panel.getSize();\n  this.lastSplitSize = newSize;\n  if(this.position == 'north' || this.position == 'south'){\n   this.panel.setSize(s.width, newSize);\n   if(this.panel.relHeight !== undefined){\n    this.state.relHeight = this.panel.relHeight *= newSize / this.height;\n   }else{\n    this.state.height = newSize;\n   }\n  }else{\n   this.panel.setSize(newSize, s.height);\n   if(this.panel.relWidth !== undefined){\n    this.state.relWidth = this.panel.relWidth *= newSize / this.width;\n   }else{\n    this.state.width = newSize;\n   }\n  }\n  this.layout.layout();\n  this.panel.saveState();\n  return false;\n }\n}); \n// END Border layout with percentages\n\n\n// START enable comboBox setValue() to fire the select event\nExt.override(Ext.form.ComboBox, {\n    setValue : function(v, fireSelect){\n        var text = v;\n        if(this.valueField){\n            var r = this.findRecord(this.valueField, v);\n            if(r){\n                text = r.data[this.displayField];\n                if (fireSelect || this.fireSelectOnSetValue) {\n\t\t\t\t\tvar index = this.store.indexOf(r);\n\t\t\t\t\tthis.selectedIndex = index;\n                    this.fireEvent('select', this, r, index);\n                }\n            }else if(Ext.isDefined(this.valueNotFoundText)){\n                text = this.valueNotFoundText;\n            }\n        }\n        this.lastSelectionText = text;\n        if(this.hiddenField){\n            this.hiddenField.value = v;\n        }\n        Ext.form.ComboBox.superclass.setValue.call(this, text);\n        this.value = v;\n        return this;\n    },\n    onSelect : function(record, index){\n        if(this.fireEvent('beforeselect', this, record, index) !== false){\n            this.setValue(record.data[this.valueField || this.displayField]);\n            this.collapse();\n            if (!this.fireSelectOnSetValue) {\n                this.fireEvent('select', this, record, index);\n            }\n        }\n    },\n\n});\n// END enable comboBox setValue() to fire the select event\n\nExt.override(Ext.grid.RowSelectionModel, {\n    handleMouseDown : function(g, rowIndex, e){\n        if(e.button !== 0 || this.isLocked()){\n            return;\n        }\n        var view = this.grid.getView();\n        if(e.shiftKey && !this.singleSelect && this.last !== false){\n            var last = this.last;\n            this.selectRange(last, rowIndex, e.ctrlKey || e.shiftKey); //csmig added || e.shiftKey \n            this.last = last; // reset the last\n            view.focusRow(rowIndex);\n        }else{\n            var isSelected = this.isSelected(rowIndex);\n            if(e.ctrlKey && isSelected){\n                this.deselectRow(rowIndex);\n            }else if(!isSelected || this.getCount() > 1){\n                this.selectRow(rowIndex, e.ctrlKey || e.shiftKey);\n                view.focusRow(rowIndex);\n            }\n        }\n    }\n});\n\n// Add support for dismissDelay in QuickTip markup\nExt.override(Ext.QuickTip, {\n\tdismissDelay: 0,\n    tagConfig : {\n        namespace : \"ext\",\n        attribute : \"qtip\",\n        width : \"qwidth\",\n        target : \"target\",\n        title : \"qtitle\",\n        hide : \"hide\",\n        cls : \"qclass\",\n        align : \"qalign\",\n        anchor : \"anchor\",\n        dismissDelay : \"qdmdelay\",\n   },\n    onTargetOver : function(e){\n        if(this.disabled){\n            return;\n        }\n        this.targetXY = e.getXY();\n        var t = e.getTarget();\n        if(!t || t.nodeType !== 1 || t == document || t == document.body){\n            return;\n        }\n        if(this.activeTarget && ((t == this.activeTarget.el) || Ext.fly(this.activeTarget.el).contains(t))){\n            this.clearTimer('hide');\n            this.show();\n            return;\n        }\n        if(t && this.targets[t.id]){\n            this.activeTarget = this.targets[t.id];\n            this.activeTarget.el = t;\n            this.anchor = this.activeTarget.anchor;\n            if(this.anchor){\n                this.anchorTarget = t;\n            }\n            this.delayShow();\n            return;\n        }\n        var ttp, et = Ext.fly(t), cfg = this.tagConfig, ns = cfg.namespace;\n        if(ttp = this.getTipCfg(e)){\n            var autoHide = et.getAttribute(cfg.hide, ns);\n            this.activeTarget = {\n                el: t,\n                text: ttp,\n                width: et.getAttribute(cfg.width, ns),\n                autoHide: autoHide != \"user\" && autoHide !== 'false',\n                title: et.getAttribute(cfg.title, ns),\n                cls: et.getAttribute(cfg.cls, ns),\n                align: et.getAttribute(cfg.align, ns)\n                ,dismissDelay: parseInt(et.getAttribute(cfg.dismissDelay, ns),10) \n            };\n            this.anchor = et.getAttribute(cfg.anchor, ns);\n            if(this.anchor){\n                this.anchorTarget = t;\n            }\n            this.delayShow();\n        }\n    }\n});\n\n// Plugin to TabPanel that allows tabs \n// - to be closed with middle-click (mouse wheel)\n// - to be made non-ephemeral when double-clicked\n// - to expand the navigation tree to the source node \n// In TabPanel configuration, set \"plugins: new SM.TabEnhancements()\"\n// Modified from Daniel Jagszent's example at: \n// https://forum.sencha.com/forum/showthread.php?36414-Closing-a-tab-with-the-mouse-wheel...-how&p=172321&viewfull=1#post172321\n// Source: carl.a.smigielski@saic.com\nSM.TabEnhancements = function(){\n    let tabs;\n    function onMouseDown(e){\n        e.preventDefault()\n        const t = tabs.findTargets(e)\n        const b = e.browserEvent.button\n        const w = e.browserEvent.which\n        const clickCount = e.browserEvent.detail\n        const isMiddleButtonPressed = (w === null || w === undefined) ? b==1 : w==2; // browser dependent: http://unixpapa.com/js/mouse.html\n        const isLeftButtonPressed = (w === null || w === undefined) ? b==0 : w==1;\n\n        if (t.item) {\n            // expand the navigation tree to the source node\n            if (!t.close && t.item.sm_treePath) {\n                Ext.getCmp('app-nav-tree').selectPath(t.item.sm_treePath)\n            }\n            // make tab non-ephemeral\n            if (isLeftButtonPressed && clickCount === 2  && t.item.sm_tabMode === 'ephemeral') {\n                t.item.makePermanent()\n            }         \n            // close tab on middle-click\n            if (isMiddleButtonPressed) {\n                if (t.item.closable) {\n                    if (t.item.fireEvent('beforeclose', t.item) !== false) {\n                        t.item.fireEvent('close', t.item)\n                        tabs.remove(t.item)\n                    }\n                } else {\n                    e.stopPropagation()\n                }\n            }\n        }\n    } \n    function onRender() {\n        tabs.strip.on('mousedown', onMouseDown)\n    }\n    this.init = function(tp) {\n        tabs = tp\n        tabs.on('render', onRender)\n    }\n}\n\n// GridView masterTpl: rendered without href=\"#\", which suppresses Chrome status bar\n// doRender, refreshRow: htmlEncode of record.data\n// Source: Carl Smigielski\nExt.override(Ext.grid.GridView,{\n    masterTpl: new Ext.Template(\n        '<div class=\"x-grid3\" hidefocus=\"true\">',\n            '<div class=\"x-grid3-viewport\">',\n                '<div class=\"x-grid3-header\">',\n                    '<div class=\"x-grid3-header-inner\">',\n                        '<div class=\"x-grid3-header-offset\" style=\"{ostyle}\">{header}</div>',\n                    '</div>',\n                    '<div class=\"x-clear\"></div>',\n                '</div>',\n                '<div class=\"x-grid3-scroller\">',\n                    '<div class=\"x-grid3-body\" style=\"{bstyle}\">{body}</div>',\n                    '<a class=\"x-grid3-focus\" tabIndex=\"-1\"></a>',\n                '</div>',\n            '</div>',\n            '<div class=\"x-grid3-resize-marker\">&#160;</div>',\n            '<div class=\"x-grid3-resize-proxy\">&#160;</div>',\n        '</div>'\n    ),\n    doRender : function(columns, records, store, startRow, colCount, stripe) {\n        var templates = this.templates,\n            cellTemplate = templates.cell,\n            rowTemplate = templates.row,\n            last = colCount - 1,\n            tstyle = 'width:' + this.getTotalWidth() + ';',\n            // buffers\n            rowBuffer = [],\n            colBuffer = [],\n            rowParams = {tstyle: tstyle},\n            meta = {},\n            len  = records.length,\n            alt,\n            column,\n            record, i, j, rowIndex;\n    \n        //build up each row's HTML\n        for (j = 0; j < len; j++) {\n            record    = records[j];\n            colBuffer = [];\n    \n            rowIndex = j + startRow;\n    \n            //build up each column's HTML\n            for (i = 0; i < colCount; i++) {\n                column = columns[i];\n                \n                meta.id    = column.id;\n                meta.css   = i === 0 ? 'x-grid3-cell-first ' : (i == last ? 'x-grid3-cell-last ' : '');\n                meta.attr  = meta.cellAttr = '';\n                meta.style = column.style;\n                meta.value = column.renderer.call(column.scope, typeof record.data[column.name] === 'string' ? SM.he(record.data[column.name]) : record.data[column.name], meta, record, rowIndex, i, store);\n    \n                if (Ext.isEmpty(meta.value)) {\n                    meta.value = '&#160;';\n                }\n    \n                if (this.markDirty && record.dirty && typeof record.modified[column.name] != 'undefined') {\n                    meta.css += ' x-grid3-dirty-cell';\n                }\n    \n                colBuffer[colBuffer.length] = cellTemplate.apply(meta);\n            }\n    \n            alt = [];\n            //set up row striping and row dirtiness CSS classes\n            if (stripe && ((rowIndex + 1) % 2 === 0)) {\n                alt[0] = 'x-grid3-row-alt';\n            }\n    \n            if (record.dirty) {\n                alt[1] = ' x-grid3-dirty-row';\n            }\n    \n            rowParams.cols = colCount;\n    \n            if (this.getRowClass) {\n                alt[2] = this.getRowClass(record, rowIndex, rowParams, store);\n            }\n    \n            rowParams.alt   = alt.join(' ');\n            rowParams.cells = colBuffer.join('');\n    \n            rowBuffer[rowBuffer.length] = rowTemplate.apply(rowParams);\n        }\n    \n        return rowBuffer.join('');\n    },\n    refreshRow: function(record) {\n        var store     = this.ds,\n            colCount  = this.cm.getColumnCount(),\n            columns   = this.getColumnData(),\n            last      = colCount - 1,\n            cls       = ['x-grid3-row'],\n            rowParams = {\n                tstyle: String.format(\"width: {0};\", this.getTotalWidth())\n            },\n            colBuffer = [],\n            cellTpl   = this.templates.cell,\n            rowIndex, row, column, meta, css, i;\n        \n        if (Ext.isNumber(record)) {\n            rowIndex = record;\n            record   = store.getAt(rowIndex);\n        } else {\n            rowIndex = store.indexOf(record);\n        }\n        \n        //the record could not be found\n        if (!record || rowIndex < 0) {\n            return;\n        }\n        \n        //builds each column in this row\n        for (i = 0; i < colCount; i++) {\n            column = columns[i];\n            \n            if (i == 0) {\n                css = 'x-grid3-cell-first';\n            } else {\n                css = (i == last) ? 'x-grid3-cell-last ' : '';\n            }\n            \n            meta = {\n                id      : column.id,\n                style   : column.style,\n                css     : css,\n                attr    : \"\",\n                cellAttr: \"\"\n            };\n            // Need to set this after, because we pass meta to the renderer\n            meta.value = column.renderer.call(column.scope, typeof record.data[column.name] === 'string' ? SM.he(record.data[column.name]) : record.data[column.name], meta, record, rowIndex, i, store);\n            \n            if (Ext.isEmpty(meta.value)) {\n                meta.value = '&#160;';\n            }\n            \n            if (this.markDirty && record.dirty && typeof record.modified[column.name] != 'undefined') {\n                meta.css += ' x-grid3-dirty-cell';\n            }\n            \n            colBuffer[i] = cellTpl.apply(meta);\n        }\n        \n        row = this.getRow(rowIndex);\n        row.className = '';\n        \n        if (this.grid.stripeRows && ((rowIndex + 1) % 2 === 0)) {\n            cls.push('x-grid3-row-alt');\n        }\n        \n        if (this.getRowClass) {\n            rowParams.cols = colCount;\n            cls.push(this.getRowClass(record, rowIndex, rowParams, store));\n        }\n        \n        this.fly(row).addClass(cls).setStyle(rowParams.tstyle);\n        rowParams.cells = colBuffer.join(\"\");\n        row.innerHTML = this.templates.rowInner.apply(rowParams);\n        \n        this.fireEvent('rowupdated', this, rowIndex, record);\n    },\n    renderHeaders : function() {\n      let colModel   = this.cm,\n          templates  = this.templates,\n          headerTpl  = templates.hcell,\n          properties = {},\n          colCount   = colModel.getColumnCount(),\n          last       = colCount - 1,\n          cells      = [],\n          i, cssCls;\n      \n      for (i = 0; i < colCount; i++) {\n          if (i == 0) {\n              cssCls = 'x-grid3-cell-first ';\n          } else {\n              cssCls = i == last ? 'x-grid3-cell-last ' : '';\n          }\n          \n          properties = {\n              id     : colModel.getColumnId(i),\n              value  : colModel.getColumnHeader(i) || '',\n              style  : this.getColumnStyle(i, true),\n              css    : cssCls,\n              tooltip: this.getColumnTooltip(i)\n          };\n          \n          if (colModel.config[i].align == 'right') {\n              // changed from framework default of 16px\n              properties.istyle = 'padding-right: 4px;';\n          } else {\n              delete properties.istyle;\n          }\n          \n          cells[i] = headerTpl.apply(properties);\n      }\n      \n      return templates.header.apply({\n          cells : cells.join(\"\"),\n          tstyle: String.format(\"width: {0};\", this.getTotalWidth())\n      });\n    }\n})\n\n// TreeNodeUI rendered without href=\"#\", which supresses Chrome status bar\n// Move checkbox before icon\n// Support radio buttons if TreePanel has property \"radio\" set to true\n// Source: Carl Smigielski\nExt.override(Ext.tree.TreeNodeUI,{\n    renderElements : function(n, a, targetNode, bulkRender){\n        // add some indent caching, this helps performance when rendering a large tree\n        this.indentMarkup = n.parentNode ? n.parentNode.ui.getChildIndent() : '';\n\n        let cb = Ext.isBoolean(a.checked),\n            nel,\n            cbType = n.ownerTree.radio ? '\"radio\" name=\"rg\"' : '\"checkbox\"',\n            buf = [\n                '<li class=\"x-tree-node\"><div ext:tree-node-id=\"',\n                n.id,\n                '\" class=\"x-tree-node-el x-tree-node-leaf x-unselectable ',\n                 a.cls,\n                 '\" unselectable=\"on\">',\n                '<span class=\"x-tree-node-indent\">',\n                this.indentMarkup,\n                \"</span>\",\n                '<img alt=\"\" src=\"', \n                this.emptyIcon, \n                '\" class=\"x-tree-ec-icon x-tree-elbow\" />',\n                cb ? ('<input class=\"x-tree-node-cb\" type=' + cbType + ' ' + (a.checked ? 'checked=\"checked\" />' : '/>')) : '',\n                '<img alt=\"\" src=\"',\n                a.icon || this.emptyIcon, \n                '\" class=\"x-tree-node-icon',\n                (a.icon ? \" x-tree-node-inline-icon\" : \"\"),\n                (a.iconCls ? \" \"+a.iconCls : \"\"),\n                '\" unselectable=\"on\" />',\n                '<a hidefocus=\"on\" class=\"x-tree-node-anchor\" tabIndex=\"1\" ',\n                a.hrefTarget ? ' target=\"'+a.hrefTarget+'\"' : \"\", \n                '><span unselectable=\"on\">',\n                n.text,\n                \"</span></a></div>\",\n                '<ul class=\"x-tree-node-ct\" style=\"display:none;\"></ul>',\n                \"</li>\"\n            ].join('');\n\n        if(bulkRender !== true && n.nextSibling && (nel = n.nextSibling.ui.getEl())){\n            this.wrap = Ext.DomHelper.insertHtml(\"beforeBegin\", nel, buf);\n        }else{\n            this.wrap = Ext.DomHelper.insertHtml(\"beforeEnd\", targetNode, buf);\n        }\n\n        this.elNode = this.wrap.childNodes[0];\n        this.ctNode = this.wrap.childNodes[1];\n        let cs = this.elNode.childNodes;\n        this.indentNode = cs[0];\n        this.ecNode = cs[1];\n        let index = 3;\n        if(cb){\n            this.iconNode = cs[3];\n            this.checkbox = cs[2];\n            // fix for IE6\n            this.checkbox.defaultChecked = this.checkbox.checked;\n            index++;\n        }\n        else {\n            this.iconNode = cs[2];\n        }\n        this.anchor = cs[index];\n        this.textNode = cs[index].firstChild;\n    }\n})\n\n// TabPanel rendered without href=\"#\", which supresses Chrome status bar\n// Source: Carl Smigielski\nExt.override(Ext.TabPanel, {\n    itemTpl: new Ext.Template(\n        '<li class=\"{cls}\" id=\"{id}\"><a class=\"x-tab-strip-close\"></a>',\n        '<a class=\"x-tab-right\"><em class=\"x-tab-left\">',\n        '<span class=\"x-tab-strip-inner\"><span class=\"x-tab-strip-text {iconCls}\">{text}</span></span>',\n        '</em></a></li>'\n   )\n})\n\n// Send query parameters even when there is JSON data for the body\n// Allows PUT and POST requests to have query parameters\n// Source: Carl Smigielski\nExt.override(Ext.data.HttpProxy, {\n    /**\n * HttpProxy implementation of DataProxy#doRequest\n * @param {String} action The crud action type (create, read, update, destroy)\n * @param {Ext.data.Record/Ext.data.Record[]} rs If action is load, rs will be null\n * @param {Object} params An object containing properties which are to be used as HTTP parameters\n * for the request to the remote server.\n * @param {Ext.data.DataReader} reader The Reader object which converts the data\n * object into a block of Ext.data.Records.\n * @param {Function} callback\n * <div class=\"sub-desc\"><p>A function to be called after the request.\n * The <tt>callback</tt> is passed the following arguments:<ul>\n * <li><tt>r</tt> : Ext.data.Record[] The block of Ext.data.Records.</li>\n * <li><tt>options</tt>: Options object from the action request</li>\n * <li><tt>success</tt>: Boolean success indicator</li></ul></p></div>\n * @param {Object} scope The scope (<code>this</code> reference) in which the callback function is executed. Defaults to the browser window.\n * @param {Object} arg An optional argument which is passed to the callback as its second parameter.\n * @protected\n */\ndoRequest : function(action, rs, params, reader, cb, scope, arg) {\n    var  o = {\n        method: (this.api[action]) ? this.api[action]['method'] : undefined,\n        request: {\n            callback : cb,\n            scope : scope,\n            arg : arg\n        },\n        reader: reader,\n        callback : this.createCallback(action, rs),\n        scope: this\n    };\n\n    // If possible, transmit data using jsonData || xmlData on Ext.Ajax.request (An installed DataWriter would have written it there.).\n    // Use std HTTP params otherwise.\n    if (params.jsonData) {\n        // csmig modification start\n        let {jsonData, ...notJsonData } = params\n        o.jsonData = jsonData;\n        o.params = notJsonData || {}\n        // csmig modification stop\n    } else if (params.xmlData) {\n        o.xmlData = params.xmlData;\n    } else {\n        o.params = params || {};\n    }\n    // Set the connection url.  If this.conn.url is not null here,\n    // the user must have overridden the url during a beforewrite/beforeload event-handler.\n    // this.conn.url is nullified after each request.\n    this.conn.url = this.buildUrl(action, rs);\n\n    if(this.useAjax){\n\n        Ext.applyIf(o, this.conn);\n\n        // If a currently running read request is found, abort it\n        if (action == Ext.data.Api.actions.read && this.activeRequest[action]) {\n            Ext.Ajax.abort(this.activeRequest[action]);\n        }\n        this.activeRequest[action] = Ext.Ajax.request(o);\n    }else{\n        this.conn.request(o);\n    }\n    // request is sent, nullify the connection url in preparation for the next request\n    this.conn.url = null;\n}\n})\n\n// Promisified JsonStore.load() method\n// Source: Carl Smigielski\nExt.override(Ext.data.JsonStore, {\n    loadPromise : function (params) {\n        return new Promise ( (resolve, reject) => {\n            this.load({\n                params: params,\n                callback: function (records, options, success) {\n                    if (success) {\n                        resolve ({\n                            records: records,\n                            options: options\n                        })\n                    } else {\n                        reject ('Load failed')\n                    }\n                }\n            })\n        })\n    },\n    reloadPromise : function (params) {\n        return new Promise ( (resolve, reject) => {\n            this.reload({\n                params: params,\n                callback: function (records, options, success) {\n                    if (success) {\n                        resolve ({\n                            records: records,\n                            options: options\n                        })\n                    } else {\n                        reject ('Reload failed')\n                    }\n                }\n            })\n        })\n    }\n\n})\n\n// replace the Ext.Element.mask() method\nExt.Element.addMethods({\n        /**\n     * Puts a mask over this element to disable user interaction. Requires core.css.\n     * This method can only be applied to elements which accept child nodes.\n     * @param {String} msg (optional) A message to display in the mask\n     * @param {String} msgCls (optional) A css class to apply to the msg element\n     * @return {Element} The mask element\n     */\n    mask : function(msg, msgCls) {\n        var me  = this,\n            dom = me.dom,\n            dh  = Ext.DomHelper,\n            EXTELMASKMSG = \"ext-el-mask-msg\",\n            XMASKED = \"x-masked\",\n            XMASKEDRELATIVE = \"x-masked-relative\",\n            el,\n            mask,\n            data = Ext.Element.data;\n\n        if (el = data(dom, 'maskMsgDiv')) {\n            el.innerHTML = msg\n            return\n        }\n\n        if (!/^body/i.test(dom.tagName) && me.getStyle('position') == 'static') {\n            me.addClass(XMASKEDRELATIVE);\n        }\n        if (el = data(dom, 'maskMsg')) {\n            el.remove();\n        }\n        if (el = data(dom, 'mask')) {\n            el.remove();\n        }\n\n        mask = dh.append(dom, {cls : \"ext-el-mask\"}, true);\n        data(dom, 'mask', mask);\n\n        me.addClass(XMASKED);\n        mask.setDisplayed(true);\n        \n        if (typeof msg == 'string') {\n            // change the tag to <span> instead of <div>, to support CSS-only spinner\n            const cn = msg ? [{tag:'div'},{tag:'span'}] : {tag:'span'}\n            var mm = dh.append(dom, {cls : EXTELMASKMSG, cn}, true);\n            data(dom, 'maskMsg', mm);\n            mm.dom.className = msgCls ? EXTELMASKMSG + \" \" + msgCls : EXTELMASKMSG;\n            if (msg) {\n                mm.dom.firstChild.innerHTML = msg;\n                data(dom, 'maskMsgDiv', mm.dom.firstChild);\n            }\n            mm.setDisplayed(true);\n            // Don't calculate centering, let CSS take care of it\n            // mm.center(me);\n        }\n        \n        // ie will not expand full height automatically\n        if (Ext.isIE && !(Ext.isIE7 && Ext.isStrict) && me.getStyle('height') == 'auto') {\n            mask.setSize(undefined, me.getHeight());\n        }\n        \n        return mask;\n    },\n    /**\n     * Removes a previously applied mask.\n     */\n    unmask : function() {\n        const data = Ext.Element.data\n        const me = this,\n        dom = me.dom,\n        mask = data(dom, 'mask'),\n        maskMsg = data(dom, 'maskMsg'),\n        maskMsgDiv = data(dom, 'maskMsgDiv'),\n        XMASKED = \"x-masked\",\n        XMASKEDRELATIVE = \"x-masked-relative\";\n\n        if (mask) {\n            if (maskMsg) {\n                maskMsg.remove();\n                data(dom, 'maskMsg', undefined);\n                if (maskMsgDiv) {\n                    data(dom, 'maskMsgDiv', undefined);\n                }\n            }\n            \n            mask.remove();\n            data(dom, 'mask', undefined);\n            me.removeClass([XMASKED, XMASKEDRELATIVE]);\n        }\n    }\n})\n// fix addStyles to account for fractional scaling\nExt.Element.prototype.addStyles = function(sides, styles){\n    let ttlSize = 0,\n        sidesArr = sides.match(/\\w/g),\n        side,\n        size,\n        i,\n        len = sidesArr.length;\n    for (i = 0; i < len; i++) {\n        side = sidesArr[i];\n        // replace parseInt call with parseFloat to account for fractional scaling\n        size = side && Math.round(parseFloat(this.getStyle(styles[side])));\n        if (size) {\n            ttlSize += Math.abs(size);\n        }\n    }\n    return ttlSize;\n}\n"
  },
  {
    "path": "client/src/js/resources-dist.js",
    "content": "const stylesheets = [\n  'ext/resources/css/ext-all.css',\n  'ext/resources/css/xtheme-gray.css',\n  'css/stigman.css',\n  'css/font-awesome.min.css',\n  'ext/ux/fileuploadfield/css/fileuploadfield.css',\n  'css/RowEditor.css',\n  'css/jsonview.bundle.css',\n  'css/diff2html.min.css',\n  'css/dark-mode.css',\n  'ext/ux/css/LockingGridView.css'\n]\n\nconst scripts = [\n  'ext/adapter/ext/ext-base.js',\n  'ext/ext-all.js',\n  'ext/ux/GroupSummary.js',\n  'js/modules/source-map/source-map.js',\n  'js/stig-manager.min.js'\n]\n\nconst isMinimizedSource = true\n\nexport {\n  stylesheets,\n  scripts,\n  isMinimizedSource\n}\n"
  },
  {
    "path": "client/src/js/resources.js",
    "content": "const stylesheets = [\n  'ext/resources/css/ext-all.css',\n  'ext/resources/css/xtheme-gray.css',\n  'css/stigman.css',\n  'css/font-awesome.min.css',\n  'ext/ux/fileuploadfield/css/fileuploadfield.css',\n  'css/RowEditor.css',\n  'css/jsonview.bundle.css',\n  'css/diff2html.min.css',\n  'css/dark-mode.css',\n  'ext/ux/css/LockingGridView.css'\n]\n\nconst scripts = [\n  'ext/adapter/ext/ext-base-debug.js',\n  'ext/ext-all-debug-w-comments.js',\n  'ext/ux/GroupSummary.js',\n  'js/diff.js',\n  'js/diff2html.min.js',\n  'js/stigmanUtils.js',\n  'js/SM/Global.js',\n  'js/SM/Error.js',\n  'js/SM/ActivityHandler.js',\n  'js/SM/FlexboxLayout.js',\n  'js/BufferView.js',\n  'js/SM/EventDispatcher.js',\n  'js/SM/Cache.js',\n  'js/SM/ServiceWorker.js',\n  'js/SM/State.js',\n  'js/SM/TipContent.js',\n  'js/SM/Ajax.js',\n  'js/SM/Classification.js',\n  'js/SM/MainPanel.js',\n  'js/SM/WhatsNew.js',\n  'js/FileUploadField.js',\n  'js/MessageBox.js',\n  'js/overrides.js',\n  'js/RowEditor.js',\n  'js/RowExpander.js',\n  'js/SM/SelectingGridToolbar.js',\n  'js/SM/NavTree.js',\n  'js/SM/RowEditorToolbar.js',\n  'js/SM/BatchReview.js',\n  'js/SM/CollectionClone.js',\n  'js/SM/Grant.js',\n  'js/SM/Manage.js',\n  'js/SM/CollectionPanel.js',\n  'js/SM/MetaPanel.js',\n  'js/LockingGridView.js',\n  'js/SM/ColumnFilters.js',\n  'js/SM/FindingsPanel.js',\n  'js/SM/Acl.js',\n  'js/SM/Attachments.js',\n  'js/SM/Exports.js',\n  'js/SM/Review.js',\n  'js/SM/ReviewsImport.js',\n  'js/SM/TransferAssets.js',\n  'js/SM/Library.js',\n  'js/SM/StigRevision.js',\n  'js/SM/Inventory.js',\n  'js/SM/AssetSelection.js',\n  'js/SM/User.js',\n  'js/SM/UserGroup.js',\n  'js/SM/AppInfo.js',\n  'js/SM/AppData.js',\n  'js/SM/Job.js',\n  'js/library.js',\n  'js/collectionAdmin.js',\n  'js/collectionManager.js',\n  'js/stigAdmin.js',\n  'js/completionStatus.js',\n  'js/findingsSummary.js',\n  'js/review.js',\n  'js/collectionReview.js',\n  'js/ExportButton.js',\n  'js/jszip.min.js',\n  'js/FileSaver.js',\n  'js/jsonview.bundle.js',\n  'js/SM/LogStream.js',\n  'js/SM/ApiState.js',\n  'js/stigman.js'\n]\n\nconst isMinimizedSource = false\n\nexport {\n  stylesheets,\n  scripts,\n  isMinimizedSource\n}\n"
  },
  {
    "path": "client/src/js/review.js",
    "content": "async function addReview( params ) {\n  let { leaf, selectedRule, selectedResource, treePath, dblclick = false } = params\n  const idAppend = '-areview-' + leaf.assetId + '-' + leaf.benchmarkId.replace(/[. ]/g,'_');\n  const tab = Ext.getCmp('main-tab-panel').getItem('reviewTab' + idAppend);\n  if (tab) {\n    if (dblclick) {\n      tab.makePermanent()\n    }\n    tab.show()\n    if (selectedRule) {\n      tab.selectRule(selectedRule)\n    }\n    return\n  }\n\n\n  const apiCollection = await Ext.Ajax.requestPromise({\n    responseType: 'json',\n    url: `${STIGMAN.Env.apiBase}/collections/${leaf.collectionId}`,\n    method: 'GET'\n  })\n  const apiFieldSettings = apiCollection.settings.fields\n  const apiStatusSettings = apiCollection.settings.status\n  const roleId = curUser.collectionGrants.filter(g => g.collection.collectionId == apiCollection.collectionId)[0].roleId\n  const canAccept = apiStatusSettings.canAccept && roleId >= apiStatusSettings.minAcceptGrant\n\n\n  // Classic compatability. Remove after modernization\n  if (leaf.stigRevStr) {\n    let match = leaf.stigRevStr.match(/V(\\d+)R(\\d+)/)\n    leaf.revId = `${leaf.benchmarkId}-${match[1]}-${match[2]}`\n  }\n  var unsavedChangesPrompt = 'You have modified your review. Would you like to save your changes?';\n\n  /******************************************************/\n  // START Group Grid\n  /******************************************************/\n  function engineResultConverter (v,r) {\n    return r.resultEngine ? \n      (r.resultEngine.overrides?.length ? 'override' : 'engine') : \n      (r.result ? 'manual' : '')\n  }\n  var groupFields = Ext.data.Record.create([\n    'assetId',\n    {\n      name: 'groupId',\n      type: 'string',\n      sortType: sortGroupId\n    },\n    {\n      name: 'ruleId',\n      type: 'string',\n      sortType: sortRuleId\n    },\n    {\n      name: 'groupTitle',\n      type: 'string'\n    },\n    {\n      name: 'ruleTitle',\n      type: 'string'\n    },\n    {\n      name: 'version',\n      type: 'string'\n    },\n    {\n      name: 'severity',\n      type: 'string',\n      sortType: sortSeverity\n    },\n    {\n      name: 'result',\n      type: 'string'\n    },\n    {\n      name: 'status',\n      type: 'string'\n    },\n    {\n      name: 'hasAttach',\n      type: 'boolean'\n    }, \n    'resultEngine',\n    {\n      name: 'engineResult',\n      convert: engineResultConverter\n    },\n    {\n      name: 'touchTs',\n      type: 'date'\n    }\n  ]);\n\n\n  var groupStore = new Ext.data.JsonStore({\n    proxy: new Ext.data.HttpProxy({\n      url: `${STIGMAN.Env.apiBase}/assets/${leaf.assetId}/checklists/${leaf.benchmarkId}/${leaf.revisionStr}?format=json-access`,\n      method: 'GET'\n    }),\n    root: 'checklist',\n    storeId: 'groupStore' + idAppend,\n    fields: groupFields,\n    idProperty: 'ruleId',\n    sortInfo: {\n      field: 'ruleId',\n      direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n    },\n    listeners: {\n      load: function (store, records) {\n        const access = store.reader.jsonData.access\n        reviewForm.defaultAccess = access\n        attachmentsGrid.fileUploadField.setDisabled(access !== 'rw')\n        groupChecklistMenu.importItem.setVisible(access === 'rw')\n        groupGrid.accessStr = `<span class=\"sm-label-sprite sm-checklist-${access === 'rw' ? 'read-write\">Writeable' : 'read\">Read only'}</span>`\n        // Were we passed a specific rule to select?\n        if ('undefined' !== typeof selectedRule) {\n          var index = store.find('ruleId', selectedRule);\n          groupGrid.getSelectionModel().selectRow(index);\n\n          var rowEl = groupGrid.getView().getRow(index);\n          //rowEl.scrollIntoView(ourGrid.getGridEl(), false);\n          rowEl.scrollIntoView();\n          //ourGrid.getView().focusRow(index+5);\n        } else {\n          groupGrid.getSelectionModel().selectFirstRow();\n        }\n\n        groupGrid.statSprites.setText(getStatsString(store))\n      },\n      clear: function () {\n        groupGrid.statSprites.setText(getStatsString(store));\n      },\n      update: function (store) {\n        groupGrid.statSprites.setText(getStatsString(store));\n      },\n      datachanged: function (store) {\n        groupGrid?.statSprites.setText(getStatsString(store));\n      }\n    }\n  });\n\n  /******************************************************/\n  // Group grid menus\n  /******************************************************/\n  function groupRuleColHandler (item) {\n    const {idProp, titleProp} = item.colProps\n    const cm = groupGrid.getColumnModel()\n    const colNames = ['groupId','groupTitle','ruleId','ruleTitle']\n    const cols = {}\n    groupGrid.titleColumnDataIndex = titleProp\n    groupGrid.autoExpandColumn = titleProp + idAppend\n    for (const colName of colNames) {\n      const index = cm.findColumnIndex(colName)\n      const hide = colName !== idProp && colName !== titleProp\n      cm.setHidden(index, hide)\n    }\n    groupGrid.getView().autoExpand()\n  }\n\n  var groupChecklistMenu = new Ext.menu.Menu({\n    id: 'groupChecklistMenu' + idAppend,\n    items: [\n      {\n        text: 'Group/Rule display',\n        hideOnClick: false,\n        menu: {\n          items: [\n            {\n              text: 'Group ID and Rule title',\n              colProps: {idProp: 'groupId', titleProp: 'ruleTitle'},\n              checked: true,\n              group: 'titleType' + idAppend,\n              handler: groupRuleColHandler\n            },\n            {\n              text: 'Group ID and Group title',\n              colProps: {idProp: 'groupId', titleProp: 'groupTitle'},\n              checked: false,\n              group: 'titleType' + idAppend,\n              handler: groupRuleColHandler\n            },\n            {\n              text: 'Rule ID and Rule title',\n              colProps: {idProp: 'ruleId', titleProp: 'ruleTitle'},\n              checked: false,\n              group: 'titleType' + idAppend,\n              handler: groupRuleColHandler\n            }\n          ]\n        }\n      },\n      '-',\n      {\n        text: 'Export to file',\n        iconCls: 'sm-export-icon',\n        tooltip: 'Download this checklist and/or attachments',\n        hideOnClick: false,\n        menu: {\n          items: [\n            {\n              text: 'CKL - STIG Viewer v2',\n              iconCls: 'sm-export-icon',\n              tooltip: 'Download this checklist in DISA STIG Viewer V2 format',\n              handler: async function (item, eventObject) {\n                try {\n                  document.body.style.cursor = 'wait'\n                  let ckl = await item.getCkl(leaf)\n                  saveAs(ckl.blob, ckl.filename)\n                  document.body.style.cursor = 'default'\n                }\n                catch (e) {\n                  SM.Error.handleError(e)\n                }\n              },\n              getCkl: function (leaf) {\n                return new Promise( async (resolve, reject) => {\n                  var xhr = new XMLHttpRequest()\n                  var url = `${STIGMAN.Env.apiBase}/assets/${leaf.assetId}/checklists/${groupGrid.sm_benchmarkId}/${groupGrid.sm_revisionStr}?format=ckl`\n                  xhr.open('GET', url)\n                  xhr.responseType = 'blob'\n                  \n                  xhr.setRequestHeader('Authorization', 'Bearer ' + window.oidcWorker.token)\n                  xhr.onload = function () {\n                    if (this.status >= 200 && this.status < 300) {\n                      var contentDispo = this.getResponseHeader('Content-Disposition')\n                      var fileName = contentDispo.match(/filename\\*?=['\"]?(?:UTF-\\d['\"]*)?([^\\r\\n\"']*)['\"]?;?/)[1]\n                      resolve({\n                        blob: xhr.response,\n                        filename: fileName\n                      })\n                    } else {\n                      reject({\n                        status: this.status,\n                        message: xhr.statusText\n                      })\n                    }\n                  }\n                  xhr.onerror = function () {\n                    reject({\n                      status: this.status,\n                      message: xhr.responseText\n                    })\n                  }\n                  xhr.send()\n                })\n              }\n            },\n            {\n              text: 'CKLB - STIG Viewer v3',\n              iconCls: 'sm-export-icon',\n              tooltip: 'Download this checklist in DISA STIG Viewer V3 format',\n              handler: async function (item, eventObject) {\n                try {\n                  document.body.style.cursor = 'wait'\n                  let ckl = await item.getCklb(leaf)\n                  saveAs(ckl.blob, ckl.filename)\n                  document.body.style.cursor = 'default'\n                }\n                catch (e) {\n                  SM.Error.handleError(e)\n                }\n              },\n              getCklb: function (leaf) {\n                return new Promise( async (resolve, reject) => {\n                  var xhr = new XMLHttpRequest()\n                  var url = `${STIGMAN.Env.apiBase}/assets/${leaf.assetId}/checklists/${groupGrid.sm_benchmarkId}/${groupGrid.sm_revisionStr}?format=cklb`\n                  xhr.open('GET', url)\n                  xhr.responseType = 'blob'\n                  \n                  xhr.setRequestHeader('Authorization', 'Bearer ' + window.oidcWorker.token)\n                  xhr.onload = function () {\n                    if (this.status >= 200 && this.status < 300) {\n                      var contentDispo = this.getResponseHeader('Content-Disposition')\n                      var fileName = contentDispo.match(/filename\\*?=['\"]?(?:UTF-\\d['\"]*)?([^\\r\\n\"']*)['\"]?;?/)[1]\n                      resolve({\n                        blob: xhr.response,\n                        filename: fileName\n                      })\n                    } else {\n                      reject({\n                        status: this.status,\n                        message: xhr.statusText\n                      })\n                    }\n                  }\n                  xhr.onerror = function () {\n                    reject({\n                      status: this.status,\n                      message: xhr.responseText\n                    })\n                  }\n                  xhr.send()\n                })\n              }\n            },\n            {\n              text: 'XCCDF',\n              iconCls: 'sm-export-icon',\n              tooltip: 'Download this checklist in XCCDF format',\n              handler: async function (item, eventObject) {\n                try {\n                  document.body.style.cursor = 'wait'\n                  await item.getXccdf(leaf)\n                  document.body.style.cursor = 'default'\n                }\n                catch (e) {\n                  SM.Error.handleError(e)\n                }\n              },\n              getXccdf: async function (leaf) {\n                \n                const url = `${STIGMAN.Env.apiBase}/assets/${leaf.assetId}/checklists/${groupGrid.sm_benchmarkId}/${groupGrid.sm_revisionStr}?format=xccdf`\n                let response = await fetch(url, {\n                  method: 'GET',\n                  headers: new Headers({\n                    'Authorization': `Bearer ${window.oidcWorker.token}`\n                  })\n                })\n                const contentDispo = response.headers.get(\"content-disposition\")\n                if (contentDispo) {\n                  const filename = contentDispo.match(/filename\\*?=['\"]?(?:UTF-\\d['\"]*)?([^\\r\\n\"']*)['\"]?;?/)[1]\n                  console.log(filename)\n                  const blob = await response.blob()\n                  saveAs(blob, filename)\n                }\n                else {\n                  throw new SM.Error.SmError('No Content-Disposition header')\n                }           \n              }\n            },\n            '-',\n            {\n              text: 'Attachments Archive',\n              iconCls: 'sm-export-icon',\n              tooltip: 'Download all review attachments as a ZIP archive',\n              handler: async function () {\n                try {\n                  document.body.style.cursor = 'wait'\n                  await exportArtifacts(leaf)\n                  document.body.style.cursor = 'default'\n                }\n                catch (e) {\n                  document.body.style.cursor = 'default'\n                  SM.Error.handleError(e)\n                }\n              }\n            }\n          ]\n        }\n      },\n      {\n        text: 'Import Results...',\n        ref: 'importItem',\n        iconCls: 'sm-import-icon',\n        handler: function () {\n          showImportResultFile( {...leaf, revisionStr: groupGrid.sm_revisionStr, store: groupStore, fieldSettings: apiFieldSettings} );            \n        }\n      }\n    ]\n  });\n\n  /******************************************************/\n  // Export Artifacts function\n  /******************************************************/\n  async function exportArtifacts(leaf) {\n    try {\n      // Fetch all reviews for this asset with metadata projection\n      const url = `${STIGMAN.Env.apiBase}/collections/${leaf.collectionId}/reviews/${leaf.assetId}?benchmarkId=${leaf.benchmarkId}&projection=metadata`\n      const response = await fetch(url, {\n        method: 'GET',\n        headers: new Headers({\n          'Authorization': `Bearer ${window.oidcWorker.token}`\n        })\n      })\n      \n      if (!response.ok) {\n        throw new Error(`Failed to fetch reviews: ${response.statusText}`)\n      }\n      \n      const reviews = await response.json()\n      \n      // Create a new ZIP file\n      const zip = new JSZip()\n      let hasArtifacts = false\n      \n      // Process each review that has artifacts\n      for (const review of reviews) {\n        if (review.metadata && review.metadata.artifacts) {\n          let artifacts\n          try {\n            artifacts = JSON.parse(review.metadata.artifacts)\n          } catch (e) {\n            console.warn(`Failed to parse artifacts for rule ${review.ruleId}:`, e)\n            continue\n          }\n          \n          if (artifacts && artifacts.length > 0) {\n            hasArtifacts = true\n            // Create folder for this rule\n            const ruleFolder = zip.folder(`Rule_${review.ruleId}`)\n            \n            // Add each artifact to the rule folder\n            for (const artifact of artifacts) {\n              try {\n                // Get the artifact data from metadata using the digest as key\n                const base64Data = review.metadata[artifact.digest]\n                if (base64Data) {\n                  // Add file to the rule folder\n                  ruleFolder.file(artifact.name, base64Data, { base64: true })\n                } else {\n                  console.warn(`No data found for artifact ${artifact.name} (digest: ${artifact.digest}) in rule ${review.ruleId}`)\n                }\n              } catch (e) {\n                console.warn(`Error processing artifact ${artifact.name} for rule ${review.ruleId}:`, e)\n              }\n            }\n          }\n        }\n      }\n      \n      if (!hasArtifacts) {\n        Ext.Msg.show({\n          title: 'No Attachments',\n          msg: 'No attachments found for this checklist.',\n          buttons: Ext.Msg.OK,\n        })\n        return\n      }\n      \n      // Generate and download the ZIP file\n      const content = await zip.generateAsync({ type: 'blob' })\n      const filename = `${leaf.assetName}-${leaf.benchmarkId}-attachments_${SM.Global.filenameComponentFromDate()}.zip`\n      saveAs(content, filename)\n      \n    } catch (e) {\n      throw new Error(`Failed to export artifacts: ${e.message}`)\n    }\n  }\n\n  /******************************************************/\n  // Group grid statistics string\n  /******************************************************/\n  function getStatsString(store) {\n    const stats = store.data.items.reduce((a, c) => {\n      switch (c.data.result) {\n        case 'fail':\n          a.fail++\n          break\n        case 'pass':\n          a.pass++\n          break\n        case 'notapplicable':\n          a.notapplicable++\n          break\n        default:\n          a.other++\n          break\n      }\n      if (c.data.engineResult) a[c.data.engineResult]++\n      if (c.data.status) a[c.data.status]++\n      return a\n    }, {\n      pass: 0,\n      fail: 0,\n      notapplicable: 0,\n      other: 0,\n      saved: 0,\n      submitted: 0,\n      rejected: 0,\n      accepted: 0,\n      override: 0,\n      manual: 0,\n      engine: 0\n    })\n\n    const spriteGroups = []\n    spriteGroups.push(\n      [\n        `${stats.fail ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Open\"><span class=\"sm-result-fail\" style=\"font-weight:bolder;\">O </span> ${stats.fail}</span>` : ''}`,\n        `${stats.pass ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Not a Finding\"><span class=\"sm-result-pass\" style=\"font-weight:bolder;\">NF </span> ${stats.pass}</span>` : ''}`,\n        `${stats.notapplicable ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Not Applicable\"><span class=\"sm-result-na\" style=\"font-weight:bolder;\">NA</span> ${stats.notapplicable}</span>` : ''}`,\n        `${stats.other ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Not Reviewed or has a non-compliance result such as informational\"><span class=\"sm-result-nr\" style=\"font-weight:bolder;\">NR+</span> ${stats.other}</span>` : ''}`\n      ].filter(Boolean).join(' '))\n\n    spriteGroups.push(\n      [\n        `${stats.manual ? `<span class=\"sm-review-sprite sm-engine-manual-icon\" ext:qtip=\"Manual\"> ${stats.manual}</span>` : ''}`,\n        `${stats.engine ? `<span class=\"sm-review-sprite sm-engine-result-icon\" ext:qtip=\"Result engine\"> ${stats.engine}</span>` : ''}`,\n        `${stats.override ? `<span class=\"sm-review-sprite sm-engine-override-icon\" ext:qtip=\"Overriden result engine\"> ${stats.override}</span>` : ''}`\n      ].filter(Boolean).join(' '))\n\n    spriteGroups.push(\n      [\n        `${stats.saved ? `<span class=\"sm-review-sprite sm-review-sprite-stat-saved\" ext:qtip=\"Saved\"> ${stats.saved || '-'}</span>` : ''}`,\n        `${stats.submitted ? `<span class=\"sm-review-sprite sm-review-sprite-stat-submitted\" ext:qtip=\"Submitted\"> ${stats.submitted}</span>` : ''}`,\n        `${stats.rejected ? `<span class=\"sm-review-sprite sm-review-sprite-stat-rejected\" ext:qtip=\"Rejected\"> ${stats.rejected}</span>` : ''}`,\n        `${stats.accepted ? `<span class=\"sm-review-sprite sm-review-sprite-stat-accepted\" ext:qtip=\"Accepted\"> ${stats.accepted}</span>` : ''}`\n      ].filter(Boolean).join(' '))\n    return spriteGroups.filter(Boolean).join('<span class=\"sm-xtb-sep\"></span>')\n  };\n\n  /******************************************************/\n  // The group grid\n  /******************************************************/\n  const groupExportBtn = new Ext.ux.ExportButton({\n    hasMenu: false,\n    exportType: 'grid',\n    gridBasename: `${leaf.assetName}-${leaf.benchmarkId}`,\n    iconCls: 'sm-export-icon',\n    text: 'CSV'\n  })\n\n  const groupGridView = new SM.ColumnFilters.GridView({\n    forceFit: false,\n    emptyText: 'No checks to display',\n    // These listeners keep the grid in the same scroll position after the store is reloaded\n    holdPosition: true, // HACK to be used with override\n    deferEmptyText: false,\n    lastHide: new Date(),\n    onColumnSplitterMoved : function(cellIndex, width) {\n      // override that does NOT set userResized and calls autoExpand()\n      // this.userResized = true;\n      this.grid.colModel.setColumnWidth(cellIndex, width, true);\n\n      if (this.forceFit) {\n          this.fitColumns(true, false, cellIndex);\n          this.updateAllColumnWidths();\n      } else {\n          this.updateColumnWidth(cellIndex, width);\n          this.syncHeaderScroll();\n      }\n      this.grid.fireEvent('columnresize', cellIndex, width);\n      this.autoExpand()\n    },\n    listeners: {\n      filterschanged: function (view, item, value) {\n        groupStore.filter(view.getFilterFns())  \n      }\n    }\n  })\n\n  var groupGrid = new Ext.grid.GridPanel({\n    stateful: true,\n    cls: 'sm-round-panel',\n    margins: { top: SM.Margin.top, right: SM.Margin.adjacent, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n    border: false,\n    region: 'west',\n    id: 'groupGrid' + idAppend,\n    sm_benchmarkId: leaf.benchmarkId,\n    sm_revisionStr: leaf.revisionStr,\n    width: '35%',\n    minWidth: 340,\n    hideMode: 'offsets',\n    enableColumnMove: false,\n    title: 'Checklist',\n    split: true,\n    store: groupStore,\n    stripeRows: true,\n    sm: new Ext.grid.RowSelectionModel({\n      singleSelect: true,\n      listeners: {\n        beforerowselect: function (sm, index, keepExisting, record) {\n          if (reviewForm.groupGridRecord != record) { // perhaps the row select is the result of a view refresh\n            var isDirty = reviewForm.reviewChanged();\n            var isValid = reviewForm.getForm().isValid();\n\n            if (isDirty && isValid && reviewForm.isLoaded) {\n              Ext.Msg.show({\n                title: 'Save Changes?',\n                msg: unsavedChangesPrompt,\n                // buttons: Ext.Msg.YESNOCANCEL,\n                buttons: {yes: 'Save', no: 'Discard', cancel: 'Cancel'},\n                fn: function (buttonId, text, opt) {\n                  switch (buttonId) {\n                    case 'yes':\n                      saveReview({\n                        source: \"selectGroup\",\n                        sm: sm,\n                        index: index,\n                        type: 'save'\n                      });\n                      reviewForm.isLoaded = false;\n                      break;\n                    case 'no':\n                      reviewForm.isLoaded = false;\n                      sm.selectRow(index);\n                      break;\n                    case 'cancel':\n                      break;\n                  }\n\n                }\n              });\n              return false;\n            } else {\n              return true;\n            }\n          }\n          return true;\n        },\n        rowselect: {\n          fn: function (sm, index, record) {\n            handleGroupSelectionForAsset(record, leaf.collectionId, leaf.assetId, idAppend, groupGrid.sm_benchmarkId, groupGrid.sm_revisionStr);\n          }\n        }\n      }\n    }),\n    view: groupGridView,\n    columns: [\n      {\n        id: 'severity' + idAppend,\n        header: \"CAT\",\n        fixed: true,\n        width: 48,\n        align: 'left',\n        dataIndex: 'severity',\n        sortable: true,        \n        renderer: renderSeverity,\n        filter: {\n          type: 'values',\n          renderer: renderSeverity,\n          comparer: SM.ColumnFilters.CompareFns.severity\n        } \n      },\n      {\n        id: 'version' + idAppend,\n        header: \"STIG Id\",\n        width: 100,\n        dataIndex: 'version',\n        hidden: true,\n        sortable: true,\n        align: 'left',\n        renderer: (v, attrs) => {\n          attrs.css = 'sm-direction-rtl'\n          return v\n        },\n        filter: {\n          type: 'string'\n        }\n      },\n      {\n        id: 'groupId' + idAppend,\n        header: \"Group\",\n        width: 95,\n        dataIndex: 'groupId',\n        sortable: true,\n        hidden: false,\n        align: 'left',\n        filter: {\n          type: 'string'\n        }\n      },\n      {\n        id: 'ruleId' + idAppend,\n        header: \"Rule Id\",\n        width: 100,\n        dataIndex: 'ruleId',\n        hidden: true,\n        sortable: true,\n        align: 'left',\n        filter: {\n          type: 'string'\n        }\n      },\n      {\n        id: 'groupTitle' + idAppend,\n        header: \"Group Title\",\n        width: 80,\n        hidden: true,\n        dataIndex: 'groupTitle',\n        renderer: columnWrap,\n        sortable: true,\n        filter: {\n          type: 'string'\n        }\n      },\n      {\n        id: 'ruleTitle' + idAppend,\n        header: \"Rule Title\",\n        width: 80,\n        hidden: false,\n        dataIndex: 'ruleTitle',\n        renderer: columnWrap,\n        sortable: true,\n        filter: {\n          type: 'string'\n        }\n      },\n      {\n        id: 'result' + idAppend,\n        header: 'Result',\n        width: 44,\n        fixed: true,\n        dataIndex: 'result',\n        sortable: true,\n        renderer: renderResult,\n        filter: {\n          type: 'values',\n          renderer: SM.ColumnFilters.Renderers.result\n        } \n      },\n      {\n        id: 'engineResult' + idAppend,\n        header: '<div exportvalue=\"Engine\" class=\"sm-engine-result-icon\"></div>',\n        width: 24,\n        fixed: true,\n        dataIndex: 'engineResult',\n        sortable: true,\n        renderer: renderEngineResult,\n        filter: {\n          type: 'values',\n          renderer: SM.ColumnFilters.Renderers.engineResult\n        } \n      },\n      {\n        id: 'status' + idAppend,\n        header: \"Status\",\n        fixed: true,\n        width: 44,\n        align: 'center',\n        dataIndex: 'status',\n        sortable: true,\n        renderer: renderStatuses,\n        filter: {\n          type: 'values',\n          renderer: SM.ColumnFilters.Renderers.status\n        } \n      },\n      {\n        id: 'touchTs' + idAppend,\n        header: '<div exportvalue=\"touchTs\" class=\"sm-history-icon\" ext:qtip=\"Last action\"></div>',\n        fixed: true,\n        width: 44,\n        align: 'center',\n        dataIndex: 'touchTs',\n        sortable: true,\n        renderer: renderDurationToNow\n      }\n    ],\n    autoExpandColumn: 'ruleTitle' + idAppend,\n    loadMask: {msg: ''},\n    tbar: new Ext.Toolbar({\n      items: [\n        {\n          xtype: 'tbbutton',\n          iconCls: 'sm-checklist-icon',  // <-- icon\n          text: 'Checklist',\n          menu: groupChecklistMenu\n        }\n      ]\n    }),\n    bbar: [\n      {\n        xtype: 'tbbutton',\n        iconCls: 'icon-refresh',\n        tooltip: 'Reload this grid',\n        width: 20,\n        handler: function (btn) {\n          groupGrid.getStore().reload();\n          //hostGrid.getStore().removeAll();\n        }\n      }, {\n        xtype: 'tbseparator'\n      },\n      groupExportBtn,\n      '->',\n      {\n        xtype: 'tbtext',\n        ref: '../statSprites'\n      },\n      '-',\n      new SM.RowCountTextItem({store:groupStore, noun:'rule', iconCls:'sm-stig-icon'})\n    ]\n  });\n\n  var handleRevisionMenu = function (item, eventObject) {\n    let store = groupGrid.getStore()\n    store.proxy.setUrl(`${STIGMAN.Env.apiBase}/assets/${leaf.assetId}/checklists/${leaf.benchmarkId}/${item.revisionStr}?format=json-access`, true)\n    store.load();\n    loadRevisionMenu(leaf.benchmarkId, item.revisionStr, idAppend)\n    groupGrid.sm_revisionStr = item.revisionStr\n  };\n\n  async function loadRevisionMenu(benchmarkId, activeRevisionStr, idAppend) {\n    try {\n      let revisions = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/stigs/${benchmarkId}/revisions`,\n        method: 'GET'\n      })\n      let revisionObject = getRevisionObj(revisions, activeRevisionStr, idAppend)\n      if (groupChecklistMenu.revisionMenuItem === undefined) {\n        groupChecklistMenu.addItem(revisionObject.menu);\n      }\n      groupGrid.setTitle(`${SM.he(revisionObject.activeRevisionLabel)} ${groupGrid.accessStr}`);\n    }\n    catch (e) {\n      SM.Error.handleError(e)\n    }\n  }\n\n  let getRevisionObj = function (revisions, activeRevisionStr, idAppend) {\n    let returnObject = {}\n    var menu = {\n      id: 'revision-menuItem' + idAppend,\n      ref: 'revisionMenuItem',\n      text: 'Revisions',\n      hideOnClick: false,\n      menu: {\n        items: []\n      }\n    };\n    for (var i = 0; i < revisions.length; i++) {\n      let r = revisions[i]\n      let benchmarkDateJs = new Date(r.benchmarkDate)\n      let item = {\n        id: `revision-submenu${r.benchmarkId}-${r.version}-${r.release}${idAppend}`,\n        text: SM.he(`Version ${r.version} Release ${r.release} (${benchmarkDateJs.format('j M Y')})`),\n        // revId: `${r.benchmarkId}-${r.version}-${r.release}`,\n        revisionStr: r.revisionStr,\n        group: 'revision-submenu-group' + idAppend,\n        handler: handleRevisionMenu\n      }\n      if (item.revisionStr == activeRevisionStr || (activeRevisionStr === 'latest' && i === 0)) {\n        item.checked = true;\n        groupGrid.sm_revisionStr = item.revisionStr\n        returnObject.activeRevisionLabel = item.text;\n      } else {\n        item.checked = false;\n      }\n      menu.menu.items.push(item);\n    }\n    returnObject.menu = menu;\n    return returnObject;\n  };\n\n  function filterGroupStore() {\n    groupStore.filter(groupGridView.getFilterFns())\n  }\n\n\n  /******************************************************/\n  // END Group Grid\n  /******************************************************/\n\n  let contentTpl = SM.RuleContentTpl\n\n  /******************************************************/\n  // START Resources panel\n  /******************************************************/\n\n  /******************************************************/\n  // START Other Grid\n  /******************************************************/\n\n  var otherFields = Ext.data.Record.create([\n    {\n      name: 'assetName',\n      type: 'string'\n    },\n    {\n      name: 'assetLabelIds',\n    },\n    {\n      name: 'status',\n      type: 'string',\n      mapping: 'status.label'\n    },\n    {\n      name: 'result',\n      type: 'string'\n    },\n    'resultEngine',\n    'touchTs',\n    {\n      name: 'engineResult',\n      convert: engineResultConverter\n    },\n    {\n      name: 'username',\n      type: 'string'\n    },\n    {\n      name: 'detail',\n      type: 'string'\n    },\n    {\n      name: 'comment',\n      type: 'string'\n    },\n    {\n      name: 'reviewId',\n      type: 'int'\n    }\n  ]);\n\n  var otherStore = new Ext.data.JsonStore({\n    root: '',\n    id: 'otherStore' + idAppend,\n    fields: otherFields,\n    sortInfo: {\n      field: 'assetName',\n      direction: 'ASC' // or 'DESC' (case sensitive for local sorting)\n    },\n    idProperty: 'reviewId',\n    listeners: {\n      datachanged: function (store) {\n        otherGrid.statSprites?.setText(getStatsString(store))\n      }\n    }\n  });\n\n  const otherExportBtn = new Ext.ux.ExportButton({\n    hasMenu: false,\n    exportType: 'grid',\n    gridBasename: `Other-Reviews`,\n    iconCls: 'sm-export-icon',\n    text: 'CSV'\n  })\n\n  const otherGrid = new Ext.grid.GridPanel({\n    enableDragDrop: true,\n    ddGroup: 'gridDDGroup',\n    layout: 'fit',\n    height: 350,\n    border: false,\n    id: 'otherGrid' + idAppend,\n    store: otherStore,\n    stripeRows: true,\n    sm: new Ext.grid.RowSelectionModel({\n      singleSelect: true\n    }),\n    view: new SM.ColumnFilters.GridViewBuffered({\n      forceFit: true,\n      emptyText: 'No other assets to display.',\n      deferEmptyText: false,\n      // custom row height\n      rowHeight: 21,\n      borderHeight: 2,\n      // render rows as they come into viewable area.\n      scrollDelay: false,\n      listeners: {\n        filterschanged: function (view, item, value) {\n          otherStore.filter(view.getFilterFns())  \n        }\n      }  \n    }),\n    bbar: [\n      otherExportBtn,\n      '->',\n      {\n        xtype: 'tbtext',\n        ref: '../statSprites'\n      },\n      '-',\n      new SM.RowCountTextItem({store:otherStore, noun:'asset', iconCls:'sm-asset-icon'})\n    ],\n    columns: [\n      {\n        id: 'target' + idAppend,\n        header: \"Asset\",\n        width: 120,\n        dataIndex: 'assetName',\n        sortable: true,\n        align: 'left',\n        renderer: function (value, metaData, record, rowIndex, colIndex, store) {\n          metaData.css += ' sm-cell-asset';\n          return value;\n        },\n        filter: {\n          type: 'string'\n        }\n      },\n      {\n        header: \"Labels\",\n        width: 120,\n        dataIndex: 'assetLabelIds',\n        sortable: false,\n        filter: {\n            type: 'multi-value', \n            collectionId: apiCollection.collectionId,\n            renderer: SM.ColumnFilters.Renderers.labels\n        },\n        renderer: function (value, metadata) {\n            const labels = []\n            for (const labelId of value) {\n                const label = SM.Cache.getCollectionLabel(apiCollection.collectionId, labelId)\n                if (label) labels.push(label)\n            }\n            labels.sort((a,b) => a.name.localeCompare(b.name))\n            metadata.attr = 'style=\"white-space:nowrap;text-overflow:clip\"'\n            return SM.Manage.Collection.LabelArrayTpl.apply(labels)\n        }\n      },\n      {\n        id: 'state' + idAppend,\n        header: \"Result\",\n\t\t\t\twidth: 50,\n\t\t\t\tfixed: true,\n        dataIndex: 'result',\n        sortable: true,\n        renderer: renderResult,\n        filter: {\n          type: 'values',\n          renderer: SM.ColumnFilters.Renderers.result\n        }\n      },\n      {\n        header: '<div exportvalue=\"Engine\" class=\"sm-engine-result-icon\"></div>',\n        width: 24,\n        fixed: true,\n        dataIndex: 'engineResult',\n        sortable: true,\n        renderer: renderEngineResult,\n        filter: {\n          type: 'values',\n          renderer: SM.ColumnFilters.Renderers.engineResult\n        } \n      },\n      { \t\n\t\t\t\theader: \"Status\", \n\t\t\t\twidth: 44,\n\t\t\t\tfixed: true,\n        align: 'center',\n\t\t\t\tdataIndex: 'status',\n\t\t\t\tsortable: true,\n\t\t\t\trenderer: function (val, metaData, record, rowIndex, colIndex, store) {\n          return renderStatuses(val, metaData, record, rowIndex, colIndex, store)\n        },\n        filter: {\n          type: 'values',\n          renderer: SM.ColumnFilters.Renderers.status\n        }\n\t\t\t},\n      {\n        id: 'touchTs' + idAppend,\n        header: '<div exportvalue=\"touchTs\" class=\"sm-history-icon\" ext:qtip=\"Last action\"></div>',\n        fixed: true,\n        width: 44,\n        align: 'center',\n        dataIndex: 'touchTs',\n        sortable: true,\n        renderer: renderDurationToNow\n      },\n\t\t\t{ \t\n\t\t\t\theader: \"User\", \n\t\t\t\twidth: 50,\n\t\t\t\tdataIndex: 'username',\n\t\t\t\tsortable: true,\n        filter: {\n          type: 'values'         \n        }\n\t\t\t}\n    ],\n    // width: 300,\n    loadMask: {msg: ''},\n    autoExpandColumn: 'target' + idAppend,\n    emptyText: 'No other assets to display'\n  });\n\n  otherGrid.rowTipTpl = new Ext.XTemplate(\n    '<tpl>',\n      '<i style=\"color:#999;\">Double-click row to view full review contents.</i>',\n      '<tpl if=\"data.detail\">',\n        '<p><b>Detail:</b> {[SM.Truncate(values, \"detail\")]}</p>',\n      '</tpl>',\n      '<tpl if=\"data.comment\">',\n        '<p><b>Comment:</b> {[SM.Truncate(values, \"comment\")]}</p>',\n      '</tpl>',\n    '</tpl>'\n  )\n\n\n  otherGrid.on('rowdblclick', function (grid, rowIndex, e) {\n    const record = grid.getStore().getAt(rowIndex)\n    const data = record.json\n\n    const resultMap = {\n      pass: 'Not a Finding',\n      notapplicable: 'Not Applicable',\n      fail: 'Open',\n      informational: 'Informational',\n      notchecked: 'Not Reviewed'\n    }\n\n    const resultDisplay = resultMap[data.result]\n    const formPanel = new Ext.FormPanel({\n      bodyStyle: 'padding: 12px; font-size: 13px;',\n      autoScroll: true,\n      defaults: {\n        labelWidth: 60,\n      },\n      items: [\n        {\n          xtype: 'fieldset',\n          title: 'Evaluation',\n          style: 'margin-bottom: 10px; padding: 10px; border-radius: 8px; border: 1px solid #3e4446;',\n          items: [\n            {\n              xtype: 'displayfield',\n              fieldLabel: 'Result',\n              value: resultDisplay,\n              style: 'margin-bottom: 12px;'\n            },\n            new SM.Review.Form.DetailTextArea({\n              fieldLabel: 'Detail',\n              value: data.detail,\n              readOnly: true,\n              style: 'margin-bottom: 12px; padding: 6px; height: 200px; overflow: auto; width: 570px;'\n            }),\n            new SM.Review.Form.CommentTextArea({\n              fieldLabel: 'Comment',\n              value: data.comment,\n              readOnly: true,\n              style: 'margin-bottom: 12px; padding: 6px; height: 200px; overflow: auto; width: 570px'\n            })\n          ]\n        },\n        {\n          xtype: 'fieldset',\n          title: 'Attributions',\n          style: 'margin-bottom: 6px; padding: 10px; border-radius: 8px; border: 1px solid #3e4446;',\n          items: [\n            new SM.Review.Form.EvaluatedAttributions({\n              value: {\n                ts: data.ts,\n                username: data.username,\n                ruleId: data.ruleId,\n                ruleIds: data.ruleIds\n              },\n              style: 'margin-bottom: 8px;'\n            }),\n            new SM.Review.Form.StatusedAttributions({\n              value: {\n                ts: data.touchTs,\n                user: { username: data.username },\n                label: data.status.label\n              },\n              style: 'margin-bottom: 8px;'\n            })\n          ]\n        }\n      ]\n    })\n\n    const win = new Ext.Window({\n      title: `Review on ${data.assetName}`,\n      modal: true,\n      width: 700,\n      height: 760,\n      layout: 'fit',\n      autoScroll: true,\n      cls: 'sm-round-panel',\n      bodyCssClass: 'sm-review-form',\n      footerCssClass: 'sm-review-footer',\n      items: [formPanel],\n      buttons: [\n        {\n          text: 'Close',\n          handler: function () {\n            win.close()\n          }\n        }\n      ]\n    })\n    win.show()\n  })\n\n\n  otherGrid.on('render', function (grid) {\n    const store = grid.getStore()  \n    const view = grid.getView() \n    grid.tip = new Ext.ToolTip({\n      target: view.mainBody,   \n      delegate: '.x-grid3-row',\n      trackMouse: true,\n      renderTo: document.body,\n      constrainPosition: true,\n      onMouseMove: function (e) { //override built-in method\n        var t = this.delegate ? e.getTarget(this.delegate) : this.triggerElement = true;\n        if (t) {\n          this.targetXY = e.getXY();\n          if (t === this.triggerElement) {\n            if (!this.hidden && this.trackMouse) {\n              // call showAt() instead of setPagePosition()\n              Ext.ToolTip.superclass.showAt.call(this, this.getTargetXY())\n            }\n          } else {\n            this.hide();\n            this.lastActive = new Date(0);\n            this.onTargetOver(e);\n          }\n        } else if (!this.closable && this.isVisible()) {\n          this.hide();\n        }\n      },\n      listeners: {\n        beforeshow: function updateTipBody(tip) {\n          const rowIndex = view.findRowIndex(tip.triggerElement)\n          tip.body.dom.innerHTML = grid.rowTipTpl.apply(store.getAt(rowIndex))\n        }\n      }\n    })\n  })\n\n  /******************************************************/\n  // END Other Grid\n  /******************************************************/\n\n  /******************************************************/\n  // START Attachments Panel\n  /******************************************************/\n  const attachmentsGrid = new SM.Attachments.Grid({\n    id: 'attachmentsGrid' + idAppend,\n    title: 'Attachments',\n    collectionId: leaf.collectionId,\n    assetId: leaf.assetId\n  })\n  \n  // Track whether a review exists in the database\n  attachmentsGrid.reviewExists = false\n  \n  /******************************************************/\n  // END Attachments Panel\n  /******************************************************/\n  /******************************************************/\n  // START History Panel\n  /******************************************************/\n\n  var historyData = new Sm_HistoryData(idAppend);\n\n  /******************************************************/\n  // END History Panel\n  /******************************************************/\n\n  var resourcesPanel = new Ext.Panel({\n    cls: 'sm-round-panel',\n    margins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.adjacent, left: SM.Margin.adjacent },\n    border: false,\n    region: 'center',\n    title: 'Review Resources',\n    layout: 'fit',\n    items: [{\n      xtype: 'tabpanel',\n      border: false,\n      deferredRender: false,\n      id: 'resources-tabs' + idAppend,\n      activeTab: ('undefined' !== typeof selectedResource ? selectedResource : 'history-tab' + idAppend),\n      listeners: {\n        tabchange: async function (tabs, tab) {\n          if (tab.id === 'other-tab' + idAppend) {\n            await loadOtherGridData()\n          }\n        }\n      },\n      items: [\n        {\n          title: 'History',\n          layout: 'fit',\n          id: 'history-tab' + idAppend,\n          items: historyData.grid\n        },\n        {\n          title: 'Other Assets',\n          border: false,\n          layout: 'fit',\n          id: 'other-tab' + idAppend,\n          items: otherGrid\n        },\n        attachmentsGrid,\n        {\n          title: 'Status Text',\n          ref: '../statusTextPanel',\n          padding: 10,\n          autoScroll: true,\n          bodyStyle: {\n              'white-space': 'pre-wrap',\n              'overflow-wrap': 'break-word'\n          }\n        }\n      ]\n    }]\n  })\n\n\n  async function loadOtherGridData() {\n    const selected = groupGrid.getSelectionModel().getSelected()\n    if (!selected) {\n      otherGrid.getStore().removeAll()\n      return\n    }\n    try {\n      otherGrid.getEl().mask()\n      const reviews = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/collections/${leaf.collectionId}/reviews`,\n        method: 'GET',\n        params: {\n          rules: 'all',\n          ruleId: selected.data.ruleId\n        }\n      })\n      const otherReviews = reviews.filter(r => r.assetId != leaf.assetId)\n      otherGrid.getStore().loadData(otherReviews)\n    } catch (e) {\n      otherGrid.getStore().removeAll()\n      SM.Error.handleError(e)\n    } finally {\n      otherGrid.getEl().unmask()\n    }\n  }\n\n\n  groupGrid.getSelectionModel().on('rowselect', async function () {\n    const tabs = Ext.getCmp('resources-tabs' + idAppend)\n    if (tabs.getActiveTab().id === 'other-tab' + idAppend) {\n      await loadOtherGridData()\n    }\n  })\n\n  /******************************************************/\n  // END Resources panel\n  /******************************************************/\n  /******************************************************/\n  // START Input form\n  /******************************************************/\n  let labelSpans\n  if (leaf.assetLabels) {\n    labelSpans = SM.Manage.Collection.LabelArrayTpl.apply(leaf.assetLabels)\n  }\n  else {\n    const labels = []\n    for (const labelId of leaf.assetLabelIds) {\n        const label = SM.Cache.getCollectionLabel(apiCollection.collectionId, labelId)\n        if (label) labels.push(label)\n    }\n    labels.sort((a,b) => a.name.localeCompare(b.name))\n    labelSpans = SM.Manage.Collection.LabelArrayTpl.apply(labels)\n  }\n\n  const reviewForm = new SM.Review.Form.Panel({\n    cls: 'sm-round-panel',\n    bodyCssClass: 'sm-review-form',\n    border: false,\n    margins: { top: SM.Margin.adjacent, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.adjacent },\n    region: 'south',\n    split: true,\n    height: '65%',\n    minHeight: 320,\n    id: 'reviewForm' + idAppend,\n    title: `Review on ${SM.he(leaf.assetName)} ${labelSpans}`,\n    padding: 10,\n    labelWidth: 54,\n    canAccept,\n    fieldSettings: apiFieldSettings,\n    btnHandler: function (btn) {\n      saveReview({\n        source: 'form',\n        type: btn.actionType\n      })\n    }\n  })\n\n  function onFieldSettingsChanged (collectionId, fieldSettings) {\n    if (collectionId === apiCollection.collectionId) {\n      reviewForm.fieldSettings = fieldSettings\n      reviewForm.setReviewFormItemStates()\n      reviewForm.setReviewFormTips()\n    }\n  }\n  SM.Dispatcher.addListener('fieldsettingschanged', onFieldSettingsChanged)\n\n\n  async function handleGroupSelectionForAsset (groupGridRecord, collectionId, assetId, idAppend, benchmarkId, revisionStr) {\n    let maskTimer\n    try {\n      maskTimer = setTimeout(() => {\n        reviewTab.contentPanel.bwrap.mask('')\n        reviewForm.bwrap.mask('')\n        resourcesPanel.bwrap.mask('') \n      }, 250)\n\n      const requests = [\n        Ext.Ajax.requestPromise({\n          responseType: 'json',\n          url: `${STIGMAN.Env.apiBase}/stigs/${benchmarkId}/revisions/${revisionStr}/rules/${groupGridRecord.data.ruleId}`,\n          method: 'GET',\n          params: {\n            projection: ['detail','ccis','check','fix']\n          }\n        }),\n        Ext.Ajax.requestPromise({\n          responseType: 'json',\n          url: `${STIGMAN.Env.apiBase}/collections/${collectionId}/reviews/${assetId}/${groupGridRecord.data.ruleId}`,\n          method: 'GET',\n          params: { \n            projection: ['history']\n          }\n        })      \n      ]\n\n      const [content, reviewProjected] = await Promise.all(requests)\n\n      // CONTENT\n      reviewTab.contentPanel.update(content)\n      reviewTab.contentPanel.setTitle('Rule for Group ' + SM.he(groupGridRecord.data.groupId))\n  \n      // REVIEW\n  \n      // load review\n      let form = reviewForm.getForm()\n      form.reset();\n      reviewForm.isLoaded = false\n        \n      // Display the review\n      reviewForm.groupGridRecord = groupGridRecord\n      reviewForm.loadValues(reviewProjected)\n      reviewForm.isLoaded = true\n      \n      // Check if review exists in database and update attachment button accordingly\n      attachmentsGrid.reviewExists = !!reviewProjected\n      attachmentsGrid.updateAttachmentButtonState(attachmentsGrid.reviewExists, reviewForm.defaultAccess === 'rw')\n      \n      reviewForm.setReviewFormItemStates()\n  \n      if (! reviewProjected) {\n        historyData.store.removeAll()\n        attachmentsGrid.getStore().removeAll()\n      }\n      if (reviewProjected.history) {\n        // append current state of review to history grid\n        let currentReview = {\n          ruleId: reviewProjected.ruleId,\n          comment: reviewProjected.comment,\n          resultEngine: reviewProjected.resultEngine,\n          rejectText: reviewProjected.rejectText,\n          result: reviewProjected.result,\n          detail: reviewProjected.detail,\n          status: reviewProjected.status,\n          ts: reviewProjected.ts,\n          touchTs: reviewProjected.touchTs,\n          userId: reviewProjected.userId,\n          username: reviewProjected.username\n        }\n        reviewProjected.history.push(currentReview)\n        historyData.store.loadData(reviewProjected.history)\n      }\n      // Feedback\n      resourcesPanel.statusTextPanel.update(reviewProjected.status?.text)\n  \n      // Attachments\n      attachmentsGrid.ruleId = groupGridRecord.data.ruleId\n      attachmentsGrid.loadArtifacts()\n    }\n    catch (e) {\n      SM.Error.handleError(e)\n    }\n    finally {\n      clearTimeout(maskTimer)\n      reviewTab.contentPanel.bwrap.unmask()\n      reviewForm.bwrap.unmask()\n      resourcesPanel.bwrap.unmask()\n\n    }\n  }\t\n  \n  /******************************************************/\n  // END input form\n  /******************************************************/\n  var reviewItems = [\n    groupGrid,\n    {\n      cls: 'sm-round-panel',\n      margins: { top: SM.Margin.top, right: SM.Margin.adjacent, bottom: SM.Margin.bottom, left: SM.Margin.adjacent },\n      border: false,\n      region: 'center',\n      xtype: 'panel',\n      split: true,\n      collapsible: false,\n      padding: 20,\n      autoScroll: true,\n      id: 'content-panel' + idAppend,\n      ref: 'contentPanel',\n      title: 'Rule',\n      tpl: contentTpl\n    }\n    ,\n    {\n      region: 'east',\n      layout: 'border',\n      width: '35%',\n      minWidth: 340,\n      border: false,\n      split: true,\n      collapsible: false,\n      id: 'east-panel' + idAppend,\n      items: [resourcesPanel, reviewForm]\n    }\n  ];\n\n  let reviewTab = new Ext.Panel ({\n    id: 'reviewTab' + idAppend,\n    border: false,\n    collectionId: leaf.collectionId,\n    collectionName: apiCollection.name,\n    assetName: leaf.assetName,\n    stigName: leaf.stigName,\n    iconCls: 'sm-stig-icon',\n    title: ' ',\n    closable: true,\n    layout: 'border',\n    sm_tabMode: 'ephemeral',\n    sm_treePath: treePath,\n    sm_TabType: 'asset_review',\n    sm_GroupGridView: groupGrid.getView(),\n    items: reviewItems,\n    listeners: {\n      beforedestroy: () => {\n        SM.Dispatcher.removeListener('fieldsettingschanged', onFieldSettingsChanged)\n      },\n      beforeclose: function (p) {\n        var isDirty = reviewForm.reviewChanged();\n        var isValid = reviewForm.getForm().isValid();\n\n        if (isDirty && isValid) {\n          Ext.Msg.show({\n            title: 'Save Changes?',\n            msg: unsavedChangesPrompt,\n            buttons: Ext.Msg.YESNOCANCEL,\n            fn: function (buttonId, text, opt) {\n              switch (buttonId) {\n                case 'yes':\n                  saveReview({\n                    source: 'closeTab',\n                    type: 'save'\n                  });\n                  break;\n                case 'no':\n                  p.ownerCt.remove(p)\n                  break;\n                case 'cancel':\n                  break;\n              }\n\n            }\n          });\n          return false;\n        } else {\n          return true;\n        }\n      }\n    },\n    selectRule: function (ruleId) {\n      const index = groupStore.find('ruleId', selectedRule);\n      groupGrid.getSelectionModel().selectRow(index);\n      var rowEl = groupGrid.getView().getRow(index);\n      rowEl.scrollIntoView();\n    }\n  })\n  reviewTab.updateTitle = function () {\n    reviewTab.setTitle(`${this.sm_tabMode === 'ephemeral' ? '<i>':''}${SM.he(this.collectionName)} / ${SM.he(this.assetName)} / ${SM.he(this.stigName)}${this.sm_tabMode === 'ephemeral' ? '</i>':''}`)\n  }\n  reviewTab.makePermanent = function () {\n    reviewTab.sm_tabMode = 'permanent'\n    reviewTab.updateTitle.call(reviewTab)\n  }\n\n  let tp = Ext.getCmp('main-tab-panel')\n  let ephTabIndex = tp.items.findIndex('sm_tabMode', 'ephemeral')\n  let thisTab\n  if (ephTabIndex !== -1) {\n    let ephTab = tp.items.itemAt(ephTabIndex)\n    tp.remove(ephTab)\n    thisTab = tp.insert(ephTabIndex, reviewTab);\n  } else {\n    thisTab = tp.add( reviewTab )\n  }\n  thisTab.updateTitle.call(thisTab)\n  thisTab.show();\n\n  await groupGrid.getStore().loadPromise()\n  loadRevisionMenu(leaf.benchmarkId, leaf.revisionStr, idAppend)\n\n  async function saveReview(saveParams) {\n    // saveParams = {\n    // source,\n    // sm,\n    // index,\n    // type\n    // }\n    let fp\n    try {\n      fp = reviewForm\n      fp.getEl().mask('Saving...')\n\n      const fvalues = fp.getForm().getFieldValues(false, true) // dirtyOnly=false, getDisabled=true\n      \n      let method, status\n      switch (saveParams.type) {\n        case 'accept':\n        case 'submit':\n        case 'unsubmit':\n          status = saveParams.type == 'submit' ? 'submitted' : saveParams.type === 'accept' ? 'accepted' : 'saved'\n          method = 'PATCH'\n          break\n        case 'save':\n        case 'save and unsubmit':\n          status = 'saved'\n          method = 'PUT'\n          break\n        case 'save and submit':\n          status = 'submitted'\n          method = 'PUT'\n          break\n      }\n\n      const jsonData = method === 'PUT' ? {\n        result: fvalues.result,\n        detail: fvalues.detail,\n        comment: fvalues.comment,\n        resultEngine: fp.resultChanged() ? null : fvalues.resultEngine,\n        status\n      } : { status }\n\n      const reviewFromApi = await Ext.Ajax.requestPromise({\n        responseType: 'json',\n        url: `${STIGMAN.Env.apiBase}/collections/${leaf.collectionId}/reviews/${leaf.assetId}/${fp.groupGridRecord.data.ruleId}`,\n        headers: { 'Content-Type': 'application/json;charset=utf-8' },\n        params: {\n          projection: 'history'\n        },\n        method,\n        jsonData\n      })\n\n      // Update group grid\n      fp.groupGridRecord.data.result = reviewFromApi.result\n      fp.groupGridRecord.data.status = reviewFromApi.status.label\n      fp.groupGridRecord.data.touchTs = reviewFromApi.touchTs\n      fp.groupGridRecord.data.resultEngine = reviewFromApi.resultEngine\n      fp.groupGridRecord.data.engineResult = engineResultConverter('', reviewFromApi)\n      fp.groupGridRecord.commit()\n      filterGroupStore()\n\n      // Update reviewForm\n      reviewForm.loadValues(reviewFromApi)\n\n      // Update statusText\n      resourcesPanel.statusTextPanel.update(reviewFromApi.status?.text)\n\n      // Update history\n      // append current state of review to history grid\n      let currentReview = {\n        ruleId: reviewFromApi.ruleId,\n        comment: reviewFromApi.comment,\n        autoResult: reviewFromApi.autoResult,\n        rejectText: reviewFromApi.rejectText,\n        result: reviewFromApi.result,\n        detail: reviewFromApi.detail,\n        status: reviewFromApi.status,\n        ts: reviewFromApi.ts,\n        touchTs: reviewFromApi.touchTs,\n        userId: reviewFromApi.userId,\n        username: reviewFromApi.username\n      }\n      reviewFromApi.history.push(currentReview)\n      historyData.store.loadData(reviewFromApi.history)\n\n      //Continue the action that triggered this save (if any):\t\t\t\t\t\n      if (saveParams.source == \"closeTab\") {\n        Ext.getCmp('main-tab-panel').remove('reviewTab' + idAppend)\n        return\n      }\n      else if (saveParams.source == \"selectGroup\") {\n        saveParams.sm.selectRow(saveParams.index);\n        return\n      }\n      \n      // After successful save, review now exists in database\n      attachmentsGrid.reviewExists = true\n      attachmentsGrid.updateAttachmentButtonState(true, reviewForm.defaultAccess === 'rw')\n      \n      reviewForm.setReviewFormItemStates(reviewForm)\n    }\n    catch (e) {\n      SM.Error.handleError(e)\n    }\n    finally {\n      fp.getEl().unmask()\n    }\n  } \n};\n"
  },
  {
    "path": "client/src/js/stigAdmin.js",
    "content": "function addStigAdmin( params ) {\n\tlet { treePath } = params\n\tconst tab = Ext.getCmp('main-tab-panel').getItem('stig-admin-tab')\n\tif (tab) {\n\t\ttab.show()\n\t\treturn\n\t}\n\n\tconst stigGrid = new SM.StigRevision.StigGrid({\n\t\tcls: 'sm-round-panel',\n\t\tmargins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.edge },\n\t\tregion: 'center',\n\t\tstripeRows:true,\n\t\tloadMask: {msg: ''}\n\t})\n\n\tvar thisTab = Ext.getCmp('main-tab-panel').add({\n\t\tid: 'stig-admin-tab',\n\t\tsm_treePath: treePath,\n\t\ticonCls: 'sm-stig-icon',\n\t\ttitle: 'STIG checklists',\n\t\tclosable:true,\n\t\tlayout: 'border',\n\t\titems: [stigGrid]\n\t});\n\t\n\t// Show the tab\n\tthisTab.show();\n\tstigGrid.getStore().load();\n} // end addStigAdmin()"
  },
  {
    "path": "client/src/js/stigman.js",
    "content": "Ext.Ajax.timeout = 30000000\r\nExt.Msg.minWidth = 300\r\nExt.USE_NATIVE_JSON = true\r\nExt.Ajax.disableCaching = false\r\n\r\nstart()\r\n\r\nfunction GetXmlHttpObject() {\r\n\tif (window.XMLHttpRequest)\r\n\t  {\r\n\t  // code for IE7+, Firefox, Chrome, Opera, Safari\r\n\t  return new XMLHttpRequest();\r\n\t  }\r\n\tif (window.ActiveXObject)\r\n\t  {\r\n\t  // code for IE6, IE5\r\n\t   return new ActiveXObject(\"Microsoft.XMLHTTP\");\r\n\t  }\r\n\treturn null;\r\n}\r\n\r\nfunction myContextMenu (e,t,eOpts) {\r\n\t// only show the browser context menu in text areas\r\n\tif (!Ext.fly(e.getTarget()).hasClass('x-form-textarea')){\r\n\t\te.preventDefault();\r\n\t\treturn false;\r\n\t}\r\n}\r\n\r\nasync function start () {\r\n\tconst el = Ext.get('loading-text').dom\r\n\r\n\ttry {\r\n\t\tif ('serviceWorker' in navigator) {\r\n\t\t\tawait navigator.serviceWorker.register('js/workers/service-worker.js')\r\n\t\t}\r\n\t\tel.innerHTML += \"<br/><br/>Fetching user data\"\r\n\t\ttry {\r\n\t\t\tawait SM.GetUserObject()\r\n\t\t}\r\n\t\tcatch (e) {\r\n\t\t\tel.innerHTML += `<br/><br/>Error Fetching user data`\r\n\t\t\tthrow(e)\r\n\t\t}\r\n\t\tloadApp();\r\n\t}\r\n\tcatch (e) {\r\n\t\tconst ta = document.createElement('textarea')\r\n\t\tta.className = 'sm-bootstrap-error'\r\n\t\tta.setAttribute('wrap', 'off')\r\n\t\tta.rows = 24\r\n\t\tta.cols = 80\r\n\t\tta.style.fontSize = '10px'\r\n\t\tta.readOnly = true\r\n\t\tta.value = JSON.stringify(STIGMAN.serializeError(e), null, 2)\r\n\t\tel.appendChild(document.createElement('br'))\r\n\t\tel.appendChild(document.createElement('br'))\r\n\t\tel.appendChild(ta)\r\n\t}\r\n}\r\n\r\nasync function loadApp () {\r\n\ttry {\r\n\t\tExt.isReady = true // a bit of a hack, for Firefox\r\n\t\tExt.BLANK_IMAGE_URL=Ext.isIE6||Ext.isIE7||Ext.isAir? \"/ext/resources/images/default/s.gif\" : \"data:image/gif;base64,R0lGODlhAQABAID/AMDAwAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==\";\r\n\t\tExt.getBody().on(\"contextmenu\", myContextMenu);  \r\n\t\tExt.QuickTips.init();\r\n\t\tExt.apply(Ext.QuickTips.getQuickTip(), {\r\n\t\t\tmaxWidth: 200,\r\n\t\t\tminWidth: 10,\r\n\t\t\tshowDelay: 500,      // Show ms after entering target\r\n\t\t\ttrackMouse: false\r\n\t\t});\r\n\t\t\r\n\t\t// Set the dark mode based on user preferences\r\n\t\tdocument.querySelector(\"link[href='css/dark-mode.css']\").disabled = !curUser.webPreferences?.darkMode\r\n\r\n\t\tExt.state.Manager.setProvider(new SM.State.LocalStorageProvider())\r\n\t\tExt.data.DataProxy.on('exception', function(proxy, type, action, e) {\r\n\t\t\tSM.Error.handleError(new SM.Error.ExtDataProxyError(e))\r\n\t\t})\r\n\r\n\t\tconst oidcWorkerChannel = new BroadcastChannel(window.oidcWorker.channelName)\r\n\t\toidcWorkerChannel.onmessage = broadcastHandler\r\n\r\n\t\tSTIGMAN.webPreferencesChannel = new BroadcastChannel('stigman-web-preferences')\r\n\t\tSTIGMAN.webPreferencesChannel.onmessage = function (event) {\r\n\t\t\tif (event.data.darkMode !== undefined) {\r\n\t\t\t\tSM.Dispatcher.fireEvent('themechanged', event.data.darkMode ? 'dark' : 'light', 'broadcast')\r\n\t\t\t}\r\n\t\t}\r\n\r\n\t\tconst opRequests = [\r\n\t\t\tExt.Ajax.requestPromise({\r\n\t\t\t\tresponseType: 'json',\r\n\t\t\t\turl: `${STIGMAN.Env.apiBase}/op/configuration`,\r\n\t\t\t\tmethod: 'GET'\r\n\t\t\t}),\r\n\t\t\tExt.Ajax.requestPromise({\r\n\t\t\t\tresponseType: 'json',\r\n\t\t\t\turl: `${STIGMAN.Env.apiBase}/op/definition`,\r\n\t\t\t\tmethod: 'GET'\r\n\t\t\t})\r\n\t\t]\r\n\t\tconst opResponses = await Promise.all(opRequests)\r\n\t\r\n\t\tSTIGMAN.apiConfig = opResponses[0]\r\n\t\tSTIGMAN.apiDefinition = opResponses[1]\r\n\t\t\r\n\t\tconst mainNavTree = new SM.NavTree.TreePanel({\r\n\t\t\tid: 'app-nav-tree',\r\n\t\t\tcls: 'sm-round-panel',\r\n\t\t\tmargins: {top:10, right:5, bottom:10, left:10},\r\n\t\t\tborder: false,\r\n\t\t\tregion: 'west'\r\n\t\t})\r\n\t\tSM.Global.mainNavTree = mainNavTree\r\n\t\tconst mainTabPanel = new SM.MainTabPanel({\r\n\t\t\tid: 'main-tab-panel',\r\n\t\t\tregion: 'center',\r\n\t\t\tmargins: {top:5, right:10, bottom:10, left:5},\r\n\t\t\tborder: false\r\n\t\t})\r\n\r\n\t\t// Register a quick tip for the version element\r\n\t\tExt.QuickTips.register({\r\n\t\t\ttarget: 'sm-home-version-sprite',\r\n\t\t\ttitle: 'Commit info',\r\n\t\t\ttext: `branch: ${STIGMAN.Env.commit.branch}&lt;br/&gt;sha: ${STIGMAN.Env.commit.sha}&lt;br/&gt;describe: ${STIGMAN.Env.commit.describe}`,\r\n\t\t\twidth: 200,\r\n\t\t\tdismissDelay: 0 // Show while cursor is over element\r\n\t\t})\r\n\r\n\t\tconst appTitleHtml = `<div class='sm-home-title'>\r\n\t\tSTIG Manager<span id='sm-home-oss-sprite'>OSS</span><span id='sm-home-version-sprite'>${STIGMAN.Env.version}</span></div>`\r\n\t\tconst homeTab = new SM.HomeTab({\r\n\t\t\tborder: false,\r\n\t\t\tregion: 'center',\r\n\t\t\tlayout: 'vbox',\r\n\t\t\tlayoutConfig: {\r\n\t\t\t\talign: 'stretch',\r\n\t\t\t},\r\n\t\t\titems: [\r\n\t\t\t\t{\r\n\t\t\t\t\thtml: appTitleHtml,\r\n\t\t\t\t\theight: 80,\r\n\t\t\t\t\tborder: false\r\n\t\t\t\t},\r\n\t\t\t\t{\r\n\t\t\t\t\tlayout: 'sm-flexbox',\r\n\t\t\t\t\tflex: 1,\r\n\t\t\t\t\tborder: false,\r\n\t\t\t\t\titems: [\r\n\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\txtype: 'sm-home-widget-welcome'\r\n\t\t\t\t\t\t},\r\n\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\txtype: 'sm-home-widget-doc'\r\n\t\t\t\t\t\t},\r\n\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\txtype: 'sm-home-widget-resources'\r\n\t\t\t\t\t\t},\r\n\t\t\t\t\t\t...(STIGMAN.Env.displayAppManagers ? [{ xtype: 'sm-home-widget-app-managers' }] : [])\r\n\t\t\t\t\t]\r\n\t\t\t\t}\r\n\t\t\t]\r\n\t\t})\r\n\r\n\t\t// mainTabPanel.add(homeTab)\r\n\t\tmainTabPanel.add({\r\n\t\t\tlayout: 'border',\r\n\t\t\tborder: false,\r\n\t\t\ttitle: 'Home',\r\n\t\t\ticonCls: 'sm-stig-icon',\r\n\t\t\titems: [\r\n\t\t\t\t{\r\n\t\t\t\t\tregion: 'center',\r\n\t\t\t\t\tcls: 'sm-round-panel',\r\n\t\t\t\t\tborder: false,\r\n\t\t\t\t\tmargins: { top: SM.Margin.top, right: SM.Margin.edge, bottom: SM.Margin.bottom, left: SM.Margin.edge },\r\n\t\t\t\t\tlayout: 'fit',\r\n\t\t\t\t\t// html: 'Hi there'\r\n\t\t\t\t\titems: homeTab\r\n\t\t\t\t}\r\n\t\t\t]\r\n\t\t})\r\n\r\n\t\tlet viewportConfig = {\r\n\t\t\tid: 'app-viewport',\r\n\t\t\tlayout: 'border',\r\n\t\t\titems: [],\r\n\t\t}\r\n\t\r\n\t\tlet classification = new Classification(STIGMAN.apiConfig?.classification)\r\n\t\tlet contentPanel\r\n\t\tif (classification.showBanner) {\r\n\t\t\tcontentPanel = new Ext.Panel({\r\n\t\t\t\tregion: 'center',\r\n\t\t\t\tlayout: 'border',\r\n\t\t\t\tborder: false,\r\n\t\t\t\titems: [mainNavTree, mainTabPanel]\r\n\t\t\t})\r\n\t\t\tlet bannerTpl = new Ext.XTemplate(\r\n\t\t\t\t`<div class=sm-banner-{classificationCls}>`,\r\n\t\t\t\t`<div class='sm-banner-body-text'>{classificationText}</div>`\r\n\t\t\t) \r\n\t\t\tlet classificationBanner = new Ext.Panel({\r\n\t\t\t\tregion: 'north',\r\n\t\t\t\theight: 20,\r\n\t\t\t\tborder: false,\r\n\t\t\t\ttpl: bannerTpl,\r\n\t\t\t\tdata: {\r\n\t\t\t\t\tclassificationCls: classification.classificationCls,\r\n\t\t\t\t\tclassificationText: classification.classificationText,\r\n\t\t\t\t}\r\n\t\t\t})\r\n\t\r\n\t\t\tviewportConfig.items.push( classificationBanner, contentPanel)\r\n\t\t}\r\n\t\telse {\r\n\t\t\tviewportConfig.items.push( mainNavTree, mainTabPanel )\r\n\t\t}\r\n\t\t\r\n\t\tnew Ext.Viewport(viewportConfig)\r\n\t\tif (contentPanel) SM.contentEl = contentPanel.getEl()\r\n\r\n\t\tSM.WhatsNew.autoShow()\r\n\t\r\n\t\tExt.get('loading').remove();\r\n\t\tExt.get('loading-mask').fadeOut({duration: 0.5, remove:true});\r\n\t\t// Register a quick tip for the version element\r\n\t\tExt.QuickTips.register({\r\n\t\t\ttarget: 'sm-home-version-sprite',\r\n\t\t\ttitle: 'Commit info',\r\n\t\t\ttext: `branch: ${STIGMAN.Env.commit.branch}<br/>sha: ${STIGMAN.Env.commit.sha}<br/>describe: ${STIGMAN.Env.commit.describe}`,\r\n\t\t\twidth: 200,\r\n\t\t\tdismissDelay: 60000 // Show while cursor is over element\r\n\t\t})\r\n\r\n\t\twindow.addEventListener('keydown', function (e) {\r\n\t\t\t// prevent ctrl-a from being handled by the browser\r\n\t\t\tif (e.key === 'a' && e.ctrlKey) {\r\n\t\t\t\tif (e.target.tagName !== 'TEXTAREA') {\r\n\t\t\t\t\te.preventDefault()\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t\t})\r\n\r\n\t\twindow.addEventListener('error', function (e) {\r\n\t\t\tSM.Error.handleError(e)\r\n\t\t})\r\n\r\n\t\tSM.Dispatcher.addListener('themechanged', onThemeChanged)\r\n\t\tasync function onThemeChanged (theme, source) {\r\n\t\t\tcurUser.webPreferences.darkMode = theme === 'dark'\r\n\t\t\tdocument.querySelector(\"link[href='css/dark-mode.css']\").disabled = theme !== 'dark'\r\n\t\t\tif (source === 'local') {\r\n\t\t\t\tSTIGMAN.webPreferencesChannel.postMessage({ darkMode: theme === 'dark' })\r\n\t\t\t\ttry {\r\n\t\t\t\t\tawait Ext.Ajax.requestPromise({\r\n\t\t\t\t\t\tresponseType: 'json',\r\n\t\t\t\t\t\turl: `${STIGMAN.Env.apiBase}/user/web-preferences`,\r\n\t\t\t\t\t\tmethod: 'PATCH',\r\n\t\t\t\t\t\tjsonData: {darkMode: theme === 'dark'}\r\n\t\t\t\t\t})\r\n\t\t\t\t} catch (error) {\r\n\t\t\t\t\t\tSM.Error.handleError(error)\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t\t}\t\r\n\r\n\t\tconst isAdmin = curUser.privileges.admin\r\n\t\tSM.ActivityHandler.reportActivity = (STIGMAN.Env.oauth.idleTimeoutUser && !isAdmin) || (STIGMAN.Env.oauth.idleTimeoutAdmin && isAdmin)\r\n\t\tSM.ActivityHandler.add()\r\n\r\n\t}\r\n\tcatch (e) {\r\n\t\tExt.get( 'indicator' ).dom.innerHTML = SM.he(e.message)\r\n\t}\r\n\r\n} //end loadApp()\r\n\r\nlet reauthAlert, reauthWindow, reauthPopup, reauthTab\r\nfunction broadcastHandler (event)  {\r\n\tconsole.log('[stigman] Received from worker:', event.type, event.data)\r\n\tif (event.data.type === 'noToken') {\r\n\t\tSM.ActivityHandler.remove()\r\n\t\treauthenticate(event.data)\r\n\t}\r\n\telse if (event.data.type === 'accessToken') {\r\n\t\tSM.ActivityHandler.add()\r\n\t\treauthAlert?.close()\r\n\r\n\t\treauthWindow?.close()\r\n\t\treauthWindow = null\r\n\r\n\t\treauthTab?.close()\r\n\t\treauthTab = null\r\n\r\n\t\treauthPopup?.close()\r\n\t\treauthPopup = null\r\n\t}\r\n}\r\n\r\nfunction reauthenticate({ codeVerifier, redirect, state, isIdle }) {\r\n\treauthAlert?.close()\r\n\treauthAlert = null\r\n\treauthWindow?.close()\r\n\treauthWindow = null\r\n\treauthTab?.close()\r\n\treauthTab = null\r\n\treauthPopup?.close()\r\n\treauthPopup = null\r\n\r\n\tconst reauthText = STIGMAN.Env.oauth.reauthAction === 'reload' ? 'reload the app' : 'sign in again'\r\n\tconst reauthBtnText = STIGMAN.Env.oauth.reauthAction === 'reload' ? 'Reload' : 'Sign In'\r\n\tconst reauthBtnIcon = STIGMAN.Env.oauth.reauthAction === 'reload' ? 'icon-refresh' : 'sm-login-icon'\r\n\t\r\n\tconst reauthButton = new Ext.Button({\r\n\t\ttext: reauthBtnText,\r\n\t\ticonCls: reauthBtnIcon,\r\n\t\thandler: reauthHandler,\r\n\t})\r\n\r\n\tfunction reauthHandler () {\r\n\t\tconst width = 600\r\n\t\tconst height = 740\r\n\t\tconst left = window.screenX + (window.outerWidth - width) / 2\r\n\t\tconst top = window.screenY + (window.outerHeight - height) / 2\r\n\t\t\r\n\t\t\r\n\t\tconst action = STIGMAN.Env.oauth.reauthAction || 'popup'\r\n\t\tif (action !== 'reload') {\r\n\t\t\tlocalStorage.setItem('reauth-codeVerifier', codeVerifier)\r\n\t\t\tlocalStorage.setItem('reauth-oidcState', state)\r\n\t\t}\r\n\t\tif (action === 'popup') {\r\n\t\t\tif (!reauthPopup || reauthPopup.closed || reauthPopup.closed === undefined) {\r\n\t\t\t\treauthPopup = window.open(\r\n\t\t\t\t\tredirect,\r\n\t\t\t\t\t'_blank',\r\n\t\t\t\t\t`popup=yes,width=${width},height=${height},left=${left},top=${top}`\r\n\t\t\t\t\t)\r\n\t\t\t\t}\t\r\n\t\t\telse {\r\n\t\t\t\treauthPopup.focus()\r\n\t\t\t}\r\n\t\t}\r\n\t\telse if (action === 'iframe') {\r\n\t\t\tif (!reauthWindow) {\r\n\t\t\t\treauthWindow = new Ext.Window({\r\n\t\t\t\t\theader: false,\r\n\t\t\t\t\tlayout: 'fit',\r\n\t\t\t\t\ttitle: 'STIG Manager Sign In',\r\n\t\t\t\t\twidth,\r\n\t\t\t\t\theight,\r\n\t\t\t\t\tmodal: false,\r\n\t\t\t\t\tcloseAction: 'hide',\r\n\t\t\t\t\thtml: `<iframe src=\"${redirect}\" width=\"100%\" height=\"100%\" frameborder=\"0\"></iframe>`,\r\n\t\t\t\t})\r\n\t\t\t}\r\n\t\t\treauthWindow.show()\r\n\t\t}\r\n\t\telse if (action === 'tab') {\r\n\t\t\tif (!reauthTab || reauthTab.closed || reauthTab.closed === undefined) {\r\n\t\t\t\treauthTab = window.open(\r\n\t\t\t\t\tredirect,\r\n\t\t\t\t\t'_blank'\r\n\t\t\t\t)\r\n\t\t\t}\t\r\n\t\t\telse {\r\n\t\t\t\treauthTab.focus()\r\n\t\t\t}\r\n\t\t}\r\n\t\telse if (action === 'reload') {\r\n\t\t\twindow.location.reload()\r\n\t\t}\t\r\n\t}\r\n\r\n\treauthAlert = new Ext.Window({\r\n\t\ttitle: `<div class=\"sm-alert-icon\" style=\"padding-left:20px\">${isIdle ? 'Session Timeout' : 'Credentials Expired'}</div>`,\r\n\t\twidth: 400,\r\n\t\theight: 110,\r\n\t\tmodal: true,\r\n\t\thtml: `<div style=\"padding: 10px\">Your ${isIdle ? 'session has timed out' : 'credentials have expired'} and we need you to ${reauthText}.</div>`,\r\n\t\tclosable: false,\r\n\t\tbuttons: [reauthButton]\r\n\t})\r\n\treauthAlert.show()\r\n}\r\n"
  },
  {
    "path": "client/src/js/stigmanUtils.js",
    "content": "var statusText;\n\nfunction renderPct ( v, m, r ) {\n\tconst pct = v > 0 && v <= 0.5 ? 1 : v >= 99.5 && v < 100 ? 99 : Math.round(v)\n\tconst symbol = v > 0 && v < 1 ? '<' : v > 99 && v < 100 ? '>' : ''\n\tconst mercuryCls = pct >= 100 ? 'sm-cell-mercury-low' : pct >= 50 ? 'sm-cell-mercury-medium' : 'sm-cell-mercury-high'\n\tlet markup = `\n\t<div class=\"sm-cell-thermometer-text\">\n\t\t${symbol}${pct}%\n\t</div>\n\t<div class=\"sm-cell-thermometer-bg\">\n\t\t<div class=\"${mercuryCls}\" style=\"width: ${pct}%;\">&nbsp;</div>\n\t</div>`\n\treturn markup\n}\n\nfunction renderPctAllHigh ( v, m, r, ri, ci, s ) {\n\tconst pct = v > 0 && v <= 0.5 ? 1 : v >= 99.5 && v < 100 ? 99 : Math.round(v)\n\tconst symbol = v > 0 && v < 1 ? '<' : v > 99 && v < 100 ? '>' : ''\n\tconst mercuryCls = 'sm-cell-mercury-high'\n\tlet markup = `\n\t<div class=\"sm-cell-thermometer-text\">\n\t\t${symbol}${pct}%\n\t</div>\n\t<div class=\"sm-cell-thermometer-bg\">\n\t\t<div class=\"${mercuryCls}\" style=\"width: ${pct}%;\">&nbsp;</div>\n\t</div>`\n\treturn markup\n}\n\nfunction durationToNow(date, ago = false) {\n\tif (!(date instanceof Date)) {\n\t\tdate = new Date(date)\n\t}\n\tlet d = Math.abs(date - new Date()) / 1000 // delta\n\tconst r = {} // result\n\tconst s = { // structure\n\t\t\t// year: 31536000,\n\t\t\t// month: 2592000,\n\t\t\t// week: 604800, // uncomment row to ignore\n\t\t\tday: 86400,   // feel free to add your own row\n\t\t\thour: 3600,\n\t\t\tminute: 60,\n\t\t\tsecond: 1\n\t};\n\t\n\tObject.keys(s).forEach(function(key){\n\t\t\tr[key] = Math.floor(d / s[key]);\n\t\t\td -= r[key] * s[key];\n\t})\n\tlet durationStr = r.day > 0 ? `${r.day} d` : r.hour > 0 ? `${r.hour} h` : r.minute > 0 ? `${r.minute} m` : `now`\n\tif (ago && durationStr !== 'now') {\n\t\tdurationStr += ' ago'\n\t}\n\treturn durationStr\n}\n\nfunction renderDurationToNow(date, md = {}) {\n\tif (!date) {\n\t\treturn '-'\n\t}\n\tif (!(date instanceof Date)) {\n\t\tdate = new Date(date)\n\t}\n\tconst durationStr = durationToNow(date)\n\tlet dateFormatted = Ext.util.Format.date(date,'Y-m-d H:i T')\n\tmd.attr = ` ext:qwidth=130 ext:qtip=\"${dateFormatted}\"`;\n\treturn durationStr \n}\n\nfunction initProgress (title,text,storeId,iframe) {\n\tvar pb = new Ext.ProgressBar({\n\t\ttext: text\n\t\t,id: 'pbar1'\n\t\t,flex: 0\n\t\t,textLog: ''\n\t\t,listeners: {\n\t\t\tdestroy: function () {\n\t\t\t\tvar one = 1;\n\t\t\t}\n\t\t}\n\t});\n\t\n\tvar st = new Ext.form.TextArea({\n\t\tid: 'statusText1'\n\t\t,cls: 'sm-progress-textarea'\n\t\t,readOnly: true\n\t\t,flex: 3\n\t\t,margins: {\n\t\t\ttop: 10\n\t\t\t,bottom: 0\n\t\t\t,left: 0\n\t\t\t,right: 0\n\t\t}\n\t});\n\t//\tpb.reset();\n\n\tvar pbWindow = new Ext.Window({\n\t\ttitle: title,\n\t\tmodal: true,\n\t\tclosable: true, // 'false' for production\n\t\twidth: '50%',\n\t\theight: 600,\n\t\tid: 'uploadWindow',\n\t\tlayout: {\n\t\t\ttype: 'vbox',\n\t\t\talign: 'stretch'\n\t\t},\n\t\tplain:true,\n\t\tbodyStyle:'padding:5px;',\n\t\tlisteners: {\n\t\t\tclose: function () {\n\t\t\t\tif (storeId != undefined) {\n\t\t\t\t\treloadStore(storeId);\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\tbuttons: [{\n\t\t\txtype: 'tbbutton'\n\t\t\t,text: 'Save log...'\n\t\t\t,download: 'log.txt'\n\t\t\t,disabled: false\n\t\t\t,handler: function(btn,e) {\n\t\t\t\tlet logtext = Ext.getCmp(\"statusText1\").getRawValue();\n\t\t\t\tlet blob = new Blob([logtext],{type:\"text/plain;charset=utf-8\"});\n\t\t\t\tif (window.navigator.msSaveOrOpenBlob){\n\t\t\t\t\tnavigator.msSaveOrOpenBlob(blob,btn.download);\n\t\t\t\t} else {\n\t\t\t\t\tlet a = window.document.createElement(\"a\");\n\t\t\t\t\ta.style.display=\"none\";\n\t\t\t\t\ta.href = window.URL.createObjectURL(blob);\n\t\t\t\t\ta.download = btn.download;\n\t\t\t\t\tdocument.body.appendChild(a);\n\t\t\t\t\ta.click();\n\t\t\t\t\tdocument.body.removeChild(a);\n\t\t\t\t\t//let href = encodeURI(\"data:text/plain;charset=utf-8,\" + logtext)\n\t\t\t\t\t//btn.setHref(href);\n\t\t\t\t}\n\t\t\t}\n\t\t},{\n\t\t\ttext: 'Close'\n\t\t\t,disabled: false\n\t\t\t,handler: function(btn,e){\n\t\t\t\tpbWindow.close();\n\t\t\t}\n\t\t}],\n\t\tbuttonAlign:'center',\n\t\titems: [pb,st]\n\t});\n\tstatusText = '';\n\tpbWindow.show(Ext.getBody());\n\n}\n\nfunction updateProgress (value,text) {\n\tvar pb = Ext.getCmp(\"pbar1\");\n\tpb.updateProgress(value,SM.he(text));\n}\n\nfunction updateStatusText (text, noNL, replace) {\n\tvar noNL = noNL || false;\n\tvar st = Ext.getCmp(\"statusText1\");\n\tif (noNL) {\n\t\tstatusText += text;\n\t} else {\n\t\tstatusText += text + \"\\n\";\n\t}\n\tst.setRawValue(statusText);\n\tst.getEl().dom.scrollTop = 99999; // scroll to bottom\n}\n\nfunction resetProgress () {\n\tvar pb = Ext.getCmp(\"pbar1\");\n\tpb.updateProgress(0,\"\");\n}\n\nfunction closeProgress () {\n\tvar uw = Ext.getCmp(\"uploadWindow\");\n\tuw.close();\n}\n\nfunction reloadStore (id) {\n\tvar store = Ext.StoreMgr.lookup(id);\n\tstore.reload();\n}\n\nfunction Sm_HistoryData (idAppend) {\n\tconst _this = this\n\tfunction engineResultConverter (v,r) {\n    return r.resultEngine ? \n      (r.resultEngine.overrides?.length ? 'override' : 'engine') : \n      (r.result ? 'manual' : '')\n  }\n\n\tfunction getStatsString(store) {\n    const stats = store.data.items.reduce((a, c) => {\n      switch (c.data.result) {\n        case 'fail':\n          a.fail++\n          break\n        case 'pass':\n          a.pass++\n          break\n        case 'notapplicable':\n          a.notapplicable++\n          break\n        default:\n          a.other++\n          break\n      }\n      if (c.data.engineResult) a[c.data.engineResult]++\n      if (c.data.statusLabel) a[c.data.statusLabel]++\n      return a\n    }, {\n      pass: 0,\n      fail: 0,\n      notapplicable: 0,\n      other: 0,\n      saved: 0,\n      submitted: 0,\n      rejected: 0,\n      accepted: 0,\n      override: 0,\n      manual: 0,\n      engine: 0\n    })\n\n    const spriteGroups = []\n    spriteGroups.push(\n      [\n        `${stats.fail ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Open\"><span class=\"sm-result-fail\" style=\"font-weight:bolder;\">O </span> ${stats.fail}</span>` : ''}`,\n        `${stats.pass ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Not a Finding\"><span class=\"sm-result-pass\" style=\"font-weight:bolder;\">NF </span> ${stats.pass}</span>` : ''}`,\n        `${stats.notapplicable ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Not Applicable\"><span class=\"sm-result-na\" style=\"font-weight:bolder;\">NA</span> ${stats.notapplicable}</span>` : ''}`,\n        `${stats.other ? `<span class=\"sm-review-sprite sm-review-sprite-stat-result\" ext:qtip=\"Not Reviewed or has a non-compliance result such as informational\"><span class=\"sm-result-nr\" style=\"font-weight:bolder;\">NR+</span> ${stats.other}</span>` : ''}`\n      ].filter(Boolean).join(' '))\n\n    spriteGroups.push(\n      [\n        `${stats.manual ? `<span class=\"sm-review-sprite sm-engine-manual-icon\" ext:qtip=\"Manual\"> ${stats.manual}</span>` : ''}`,\n        `${stats.engine ? `<span class=\"sm-review-sprite sm-engine-result-icon\" ext:qtip=\"Result engine\"> ${stats.engine}</span>` : ''}`,\n        `${stats.override ? `<span class=\"sm-review-sprite sm-engine-override-icon\" ext:qtip=\"Overriden result engine\"> ${stats.override}</span>` : ''}`\n      ].filter(Boolean).join(' '))\n\n    spriteGroups.push(\n        [\n          `${stats.saved ? `<span class=\"sm-review-sprite sm-review-sprite-stat-saved\" ext:qtip=\"Saved\"> ${stats.saved || '-'}</span>` : ''}`,\n          `${stats.submitted ? `<span class=\"sm-review-sprite sm-review-sprite-stat-submitted\" ext:qtip=\"Submitted\"> ${stats.submitted}</span>` : ''}`,\n          `${stats.rejected ? `<span class=\"sm-review-sprite sm-review-sprite-stat-rejected\" ext:qtip=\"Rejected\"> ${stats.rejected}</span>` : ''}`,\n          `${stats.accepted ? `<span class=\"sm-review-sprite sm-review-sprite-stat-accepted\" ext:qtip=\"Accepted\"> ${stats.accepted}</span>` : ''}`\n        ].filter(Boolean).join(' '))\n    return spriteGroups.filter(Boolean).join('<span class=\"sm-xtb-sep\"></span>')\n  };\n\n\tthis.fields = Ext.data.Record.create([\n\t\t{\n\t\t\tname:'ruleId',\n\t\t\ttype: 'string'\n\t\t},\n\t\t{\n\t\t\tname:'result',\n\t\t\ttype: 'string'\n\t\t},\n\t\t{\n\t\t\tname:'detail',\n\t\t\ttype:'string'\n\t\t},\n\t\t{\n\t\t\tname:'comment',\n\t\t\ttype:'string'\n\t\t},\n    'resultEngine',\n    {\n      name: 'engineResult',\n      convert: engineResultConverter\n    },\n\t\t{\n\t\t\tname:'userId',\n\t\t\ttype:'string'\n\t\t},{\n\t\t\tname:'username',\n\t\t\ttype:'string'\n\t\t},\n\t\t{\n\t\t\tname:'touchTs',\n\t\t\ttype:'date',\n\t\t\tdateFormat: 'c'\n\t\t},\n\t\t{\n\t\t\tname:'statusLabel',\n\t\t\ttype:'string',\n\t\t\tmapping: 'status.label'\n\t\t},\n\t\t'status'\n\t]);\n\n\tthis.store = new Ext.data.JsonStore({\n\t\troot: '',\n\t\tstoreId: 'historyStore' + idAppend,\n\t\tfields: this.fields,\n\t\tsortInfo: {\n\t\t\tfield: 'touchTs',\n\t\t\tdirection: 'DESC' // or 'DESC' (case sensitive for local sorting)\n\t\t},\n\t\tlisteners: {\n      datachanged: function (store) {\n        _this.grid?.statSprites?.setText(getStatsString(store))\n      }\n    },\n\t\tidProperty: (v) => {\n\t\t\treturn v.touchTs\n\t\t}\n\t});\n\n\texpander = new Ext.ux.grid.RowExpander2({\n\t\ttpl: new Ext.XTemplate(\n\t\t\t'<tpl if=\"data.detail\">',\n\t\t  '<p><b>Detail:</b> {[SM.TruncateRecordProperty(values, \"detail\")]}</p>',\n\t\t  '</tpl>',\n\t\t  '<tpl if=\"data.comment\">',\n\t\t  '<p><b>Comment:</b> {[SM.TruncateRecordProperty(values, \"comment\")]}</p>',\n\t\t  '</tpl>',\n\t\t  '<tpl if=\"data.status\">',\n\t\t  '<p><b>Status user:</b> {[SM.he(values.data.status.user.username)]}</p>',\n\t\t  '</tpl>',\n\t\t  '<tpl if=\"data.status\">',\n\t\t  '<p><b>Status text:</b> {[SM.he(values.data.status.text)]}</p>',\n\t\t  '</tpl>'\n\t\t)\n\t})\n\n\tconst historyTotalTextCmp = new SM.RowCountTextItem ({\n    store: this.store,\n\t\tnoun: 'review',\n\t\ticonCls: 'sm-stig-icon'\n  })\n\n\tconst historyExportBtn = new Ext.ux.ExportButton({\n\t\thasMenu: false,\n\t\texportType: 'grid',\n\t\tgridBasename: `Log`,\n\t\ticonCls: 'sm-export-icon',\n\t\ttext: 'CSV'\n\t})\n\t\t\n\tthis.grid = new Ext.grid.GridPanel({\n\t\tlayout: 'fit',\n    enableDragDrop: true,\n    ddGroup: 'gridDDGroup',\n\t\tplugins: expander,\n\t\tborder: true,\n\t\tid: 'historyGrid' + idAppend,\n\t\tstore: this.store,\n\t\tstripeRows:true,\n\t\tview: new SM.ColumnFilters.GridView({\n\t\t\tforceFit:true,\n\t\t\temptyText: 'No log to display.',\n\t\t\tdeferEmptyText:false,\n\t\t\tlisteners: {\n\t\t\t\tfilterschanged: function (view, item, value) {\n\t\t\t\t  _this.store.filter(view.getFilterFns())  \n\t\t\t\t}\n\t\t\t}\t\t\n\t\t}),\n    bbar: [\n\t\t\thistoryExportBtn,\n\t\t\t'->',\n\t\t\t{\n\t\t\t\txtype: 'tbtext',\n\t\t\t\tref: '../statSprites'\n\t\t\t},\n\t\t\t'-',\t\n\t\t\thistoryTotalTextCmp\n\t\t],\n\t\tcolumns: [\n\t\t\texpander,\n\t\t\t{ \t\n\t\t\t\theader: \"Timestamp\",\n\t\t\t\twidth: 120,\n\t\t\t\tresizeable: false,\n\t\t\t\tdataIndex: 'touchTs',\n\t\t\t\tsortable: true,\n\t\t\t\talign: 'left',\n\t\t\t\txtype: 'datecolumn',\n\t\t\t\tformat:\t'Y-m-d H:i:s T'\n\t\t\t},\n\t\t\t{ \n\t\t\t\tid:'ruleId' + idAppend,\n\t\t\t\theader: \"Rule\",\n\t\t\t\twidth: 140,\n\t\t\t\tfixed: true,\n\t\t\t\tdataIndex: 'ruleId',\n\t\t\t\t// renderer: renderResult,\n\t\t\t\tsortable: true,\n\t\t\t\tfilter: {type:'values', renderer: SM.ColumnFilters.Renderers.result}\n\t\t\t},\n\t\t\t{ \n\t\t\t\tid:'result' + idAppend,\n\t\t\t\theader: \"Result\",\n\t\t\t\twidth: 50,\n\t\t\t\tfixed: true,\n\t\t\t\tdataIndex: 'result',\n\t\t\t\trenderer: renderResult,\n\t\t\t\tsortable: true,\n\t\t\t\tfilter: {type:'values', renderer: SM.ColumnFilters.Renderers.result}\n\t\t\t},\n      {\n        header: '<div exportvalue=\"Engine\" class=\"sm-engine-result-icon\"></div>',\n        width: 24,\n        fixed: true,\n        dataIndex: 'engineResult',\n        sortable: true,\n        renderer: renderEngineResult,\n        filter: {\n          type: 'values',\n          renderer: SM.ColumnFilters.Renderers.engineResult\n        } \n      },\n\t\t\t{ \t\n\t\t\t\theader: \"Status\", \n\t\t\t\twidth: 50,\n\t\t\t\tfixed: true,\n\t\t\t\talign: 'center',\n\t\t\t\tdataIndex: 'statusLabel',\n\t\t\t\tsortable: true,\n\t\t\t\trenderer: renderStatuses,\n\t\t\t\tfilter: {type:'values', renderer: SM.ColumnFilters.Renderers.status}\n\t\t\t},\n\t\t\t{ \t\n\t\t\t\theader: \"User\", \n\t\t\t\twidth: 50,\n\t\t\t\tdataIndex: 'username',\n\t\t\t\tsortable: true,\n\t\t\t\tfilter: {type:'values'}\n\t\t\t}\n\t\t]\n\t});\n}\n\nfunction sortGroupId (groupId) {\n\tfunction padZero(a,b){\n\t\treturn(1e15+a+\"\").slice(-b)\n\t};\n\tvar vNum = groupId.match(/^V-(\\d+)/);\n\tif (vNum == null) {\n\t\treturn groupId;\n\t} else {\n\t\treturn padZero(vNum[1],8);\n\t}\n}\n\nfunction sortRuleId (ruleId) {\n\tfunction padZero(a,b){\n\t\treturn(1e15+a+\"\").slice(-b)\n\t};\n\tvar vNum = ruleId.match(/^SV-(\\d+)r*/);\n\tif (vNum == null) {\n\t\treturn ruleId;\n\t} else {\n\t\treturn padZero(vNum[1],8);\n\t}\n}\n\nfunction sortSeverity (severity) {\n\tswitch (severity) {\n\t\tcase 'mixed':\n\t\t\treturn 0\n\t\tcase 'low':\n\t\t\treturn 1\n\t\tcase 'medium':\n\t\t\treturn 2\n\t\tcase 'high':\n\t\t\treturn 3\n\t}\n}\n\nfunction getFileIcon (filename) {\n\tvar extension = filename.substr((~-filename.lastIndexOf(\".\") >>> 0) + 2).toLowerCase(); //http://stackoverflow.com/questions/190852/how-can-i-get-file-extensions-with-javascript/1203361#1203361\n\tswitch (extension) {\n\t\tcase 'doc':\n\t\tcase 'docx':\n\t\t\treturn 'img/page_word.png';\n\t\tcase 'pdf':\n\t\t\treturn 'img/page_white_acrobat.png';\n\t\tcase 'jpg':\n\t\tcase 'png':\n\t\tcase 'gif':\n\t\tcase 'bmp':\n\t\t\treturn 'img/page_white_camera.png';\n\t\tcase 'xls':\n\t\tcase 'xlsx':\n\t\t\treturn 'img/page_excel.png';\n\t\tcase 'ppt':\n\t\tcase 'pptx':\n\t\t\treturn 'img/page_white_powerpoint.png';\n\t\tcase 'zip':\n\t\t\treturn 'img/page_white_compressed.png';\n\t\tdefault:\n\t\t\treturn 'img/page.png';\n\t}\n}\n\n// encodeSm(): String\n// returns JSON encoded array\nfunction encodeSm (sm,field) {\n\tvar myArray = new Array;\n\tvar selArray = sm.getSelections();\n\tfor (var i=0; i < selArray.length; i++) {\n\t\tmyArray.push(selArray[i].data[field]);\n\t}\n\treturn JSON.stringify(myArray);\n}\n\nfunction renderResult(val, metaData, record, rowIndex, colIndex, store) {\n\tif (!val) return ''\n\treturn `<div class=\"sm-grid-result-sprite ${SM.RenderResult[val]?.css}\" ext:qtip=\"${val}\">${SM.RenderResult[val]?.textDisa}</div>`\n}\n\nfunction renderEngineResult(val, metadata) {\n\tif (!val) return ''\n\tlet iconCls, tipText\n\tswitch (val) {\n\t\tcase 'engine':\n\t\t\tmetadata.attr = 'exportvalue=\"engine\"'\n\t\t\ttipText = 'Engine result',\n\t\t\ticonCls = 'sm-engine-result-icon'\n\t\t\tbreak\n\t\tcase 'override':\n\t\t\tmetadata.attr = 'exportvalue=\"override\"'\n\t\t\ttipText = 'Engine override',\n\t\t\ticonCls = 'sm-engine-override-icon'\n\t\t\tbreak\n\t\tcase 'manual':\n\t\t\tmetadata.attr = 'exportvalue=\"manual\"'\n\t\t\ttipText = 'Manual result',\n\t\t\ticonCls = 'sm-engine-manual-icon'\n\t\t\tbreak\n\t\t\t\n\t}\n\treturn `<div class=\"${iconCls}\" ext:qtip=\"${tipText}\"></div>`\n}\n\nfunction renderStatuses(val, metaData, record, rowIndex, colIndex, store) {\n\tvar statusIcons = '';\n\tconst exportvalues = [] \n\tswitch (val) {\n\t\tcase 'saved':\n\t\t\texportvalues.push('Saved')\n\t\t\tstatusIcons += '<img src=\"img/save-icon.svg\" width=12 height=12 ext:qtip=\"Saved\" style=\"padding-top: 1px;\">';\n\t\t\tbreak;\n\t\tcase 'submitted':\n\t\t\texportvalues.push('Submitted')\n\t\t\tstatusIcons += '<img src=\"img/ready-16.png\" width=12 height=12 ext:qtip=\"Submitted\" style=\"padding-top: 1px;\">';\n\t\t\tbreak;\n\t\tcase 'rejected':\n\t\t\texportvalues.push('Rejected')\n\t\t\tstatusIcons += '<img src=\"img/rejected-16.png\" width=12 height=12 ext:qtip=\"Rejected\" style=\"padding-top: 1px;\">';\n\t\t\tbreak;\n\t\tcase 'accepted':\n\t\t\texportvalues.push('Accepted')\n\t\t\tstatusIcons += '<img src=\"img/star.svg\" width=12 height=12 ext:qtip=\"Accepted\" style=\"padding-top: 1px;\">';\n\t\t\tbreak;\n\t\tdefault:\n\t\t\tstatusIcons += '<img src=\"img/pixel.gif\" width=12 height=12>';\n\t\t\tbreak;\n\t}\n\t// statusIcons += '<img src=\"img/pixel.gif\" width=4 height=12>';\n\t// if (record.data.resultEngine && !record.data.resultEngine.overrides?.length) {\n\t// \texportvalues.push('ResultEngine')\n\t// \tstatusIcons += '<img src=\"img/bot.svg\" width=12 height=12 ext:qtip=\"Automated evaluation\" style=\"padding-top: 1px;\">';\n\t// } else {\n\t// \tstatusIcons += '<img src=\"img/pixel.gif\" width=12 height=12>';\n\t// }\n\tmetaData.attr = `exportvalue=\"${exportvalues.join(',')}\"`\n\treturn statusIcons;\n}\n\nfunction renderStatus(val) {\n\tswitch (val) {\n\t\tcase 'submitted':\n\t\t\treturn '<img src=\"img/ready-16.png\" width=12 height=12 ext:qtip=\"Submitted\">';\n\t\tcase 'rejected':\n\t\t\treturn '<img src=\"img/rejected-16.png\" width=12 height=12 ext:qtip=\"Rejected\">';\n\t\tcase 'accepted':\n\t\t\treturn '<img src=\"img/star.svg\" width=12 height=12 ext:qtip=\"Accepted\">';\n\t\tdefault:\n\t\t\treturn '<img src=\"img/pixel.gif\" width=12 height=12>';\n\t}\n}\n\nconst renderSeverity = (val) => {\n\tswitch (val) {\n\t\tcase 'high':\n\t\t\treturn '<span class=\"sm-grid-sprite sm-severity-high\">CAT 1</span>'\n\t\tcase 'medium':\n\t\t\treturn '<span class=\"sm-grid-sprite sm-severity-medium\">CAT 2</span>'\n\t\tcase 'low':\n\t\t\treturn '<span class=\"sm-grid-sprite sm-severity-low\">CAT 3</span>'\n\t\tcase 'mixed':\n\t\t\treturn '<span class=\"sm-grid-sprite sm-severity-low\">Mixed</span>'\n\t\tdefault:\n\t\t\treturn '<span class=\"sm-grid-sprite sm-severity-low\">U</span>'\n\t}\n}\n\n\nfunction columnWrap(val, meta){\n\tmeta.css = 'sm-col-wrap'\n\treturn val\n}\n\n// quick access to css classes by risk rating\nfunction getRiskClass(riskRating) {\n  switch (riskRating) {\n    case 'Very High': return 'sm-cora-risk-very-high';\n    case 'High': return 'sm-cora-risk-high';\n    case 'Moderate': return 'sm-cora-risk-moderate';\n    case 'Low': return 'sm-cora-risk-low';\n    case 'Very Low': return 'sm-cora-risk-very-low';\n  }\n}\n\n\nfunction calculateCoraRiskRating(metrics) {\n  const weights = {\n    catI: 10,\n    catII: 4,\n    catIII: 1\n  }\n\n  const assessments = metrics.assessmentsBySeverity\n  const assessed = metrics.assessedBySeverity\n  const findings = metrics.findings \n\n  // CAT I (High)\n  const assignedHigh = assessments.high\n  const assessedHigh = assessed.high\n  const findingsHigh = findings.high\n  const rawCatI = assignedHigh > 0 ? ((assignedHigh - assessedHigh) + findingsHigh) / assignedHigh: 0\n\n  // CAT II (Medium)\n  const assignedMed = assessments.medium\n  const assessedMed = assessed.medium\n  const findingsMed = findings.medium\n  const rawCatII = assignedMed > 0 ? ((assignedMed - assessedMed) + findingsMed) / assignedMed: 0\n\n  // CAT III (Low)\n  const assignedLow = assessments.low\n  const assessedLow = assessed.low\n  const findingsLow = findings.low\n  const rawCatIII = assignedLow > 0 ? ((assignedLow - assessedLow) + findingsLow) / assignedLow : 0\n\n  let totalWeight = 0\n  let totalWeightedRisk = 0\n\n  if (assignedHigh > 0) {\n    totalWeightedRisk += rawCatI * weights.catI\n    totalWeight += weights.catI\n  }\n\n  if (assignedMed > 0) {\n    totalWeightedRisk += rawCatII * weights.catII\n    totalWeight += weights.catII\n  }\n\n  if (assignedLow > 0) {\n    totalWeightedRisk += rawCatIII * weights.catIII\n    totalWeight += weights.catIII\n  }\n\n  const weightedAvg = totalWeight > 0 ? totalWeightedRisk / totalWeight : 0\n\n  const weightedCatI = totalWeight > 0 && assignedHigh > 0 ? (rawCatI * weights.catI) / totalWeight : 0;\n  const weightedCatII = totalWeight > 0 && assignedMed > 0 ? (rawCatII * weights.catII) / totalWeight : 0;\n  const weightedCatIII = totalWeight > 0 && assignedLow > 0 ? (rawCatIII * weights.catIII) / totalWeight : 0;\n\n  let riskRating = ''\n  const isVeryLowRisk = rawCatI === 0 && rawCatII === 0 && rawCatIII === 0\n  const isLowRisk = rawCatI === 0 && rawCatII < 0.05 && rawCatIII < 0.05\n\n  if (isVeryLowRisk) {\n    riskRating = 'Very Low'\n  } else if (isLowRisk) {\n    riskRating = 'Low'\n  } else if (weightedAvg >= 0.2) {\n    riskRating = 'Very High'\n  } else if (weightedAvg >= 0.1) {\n    riskRating = 'High'\n  } else if (weightedAvg > 0) {\n    riskRating = 'Moderate'\n  }\n\n  return {\n    weightedAvg,\n    riskRating,\n    percentages: {\n      catI: rawCatI,\n      catII: rawCatII,\n      catIII: rawCatIII\n    },\n    weightedContributions: {\n      catI: weightedCatI,\n      catII: weightedCatII,\n      catIII: weightedCatIII\n    }\n  }\n}"
  },
  {
    "path": "client/src/js/workers/oidc-worker.js",
    "content": "const logPrefix = '[OIDCWorker]:'\n\n// Private state\nconst tokens = {\n  accessToken: null,\n  refreshToken: null\n}\nlet ENV = null\nlet oidcConfiguration = null\nlet initialized = false\nlet authorizations = {}\nlet accessTimeoutId = null\nlet refreshTimeoutId = null\nlet redirectUri = null\nconst channelName = crypto.randomUUID()\nconst bc = new BroadcastChannel(channelName)\nlet idleTimeoutId = null\nlet idleTimeoutM = null\nlet isIdle = false\n\n// Worker entry point\nonconnect = function (e) {\n  const port = e.ports[0]\n  port.onmessage = onMessage\n  port.start()\n}\n\n// Message handlers\nconst messageHandlers = {\n  getAccessToken,\n  exchangeCodeForToken,\n  initialize,\n  getStatus,\n  logout\n}\n\nfunction getAccessToken() {\n  if (!tokens.accessToken) {\n    console.log(logPrefix, 'getAccessToken, redirecting to authorization')\n    return createAuthorization()\n  }\n  return {\n    accessToken: tokens.accessToken,\n    accessTokenPayload: decodeToken(tokens.accessToken)\n  }\n}\n\nasync function exchangeCodeForToken({ code, codeVerifier, clientId = ENV.clientId, redirectUri }) {\n  if (authorizations[redirectUri] && authorizations[redirectUri].codeVerifier !== codeVerifier) {\n    // verifier does not match the saved redirectUri\n    console.error(logPrefix, 'Code verifier does not match the saved redirectUri', redirectUri, authorizations[redirectUri])\n    return { success: false, error: 'Code verifier does not match the saved redirectUri' }\n  }\n\n  console.log(logPrefix, 'Exchange code for token', code, codeVerifier)\n\n  delete authorizations[redirectUri]\n  const params = new URLSearchParams()\n  params.append('grant_type', 'authorization_code')\n  params.append('client_id', clientId)\n  params.append('redirect_uri', redirectUri)\n  params.append('code', code)\n  params.append('code_verifier', codeVerifier)\n\n  try {\n    isIdle = false\n    await fetchTokens(params)\n    return {\n      success: true,\n      accessToken: tokens.accessToken,\n      accessTokenPayload: decodeToken(tokens.accessToken)\n    }\n  }\n  catch (e) {\n    return { success: false, error: e.message}\n  }\n}\n\nasync function initialize(options) {\n  if (!initialized) {\n    initialized = true\n    const parsedRedirectUri = new URL(options.redirectUri)\n    if (!parsedRedirectUri.protocol.startsWith('http')) {\n      return { success: false, error: `Invalid redirectUri scheme: ${parsedRedirectUri.protocol}` }\n    }\n    redirectUri = options.redirectUri\n    ENV = options.env || null\n\n    try {\n      oidcConfiguration = options.oidcConfiguration || await fetchOpenIdConfiguration()\n    }\n    catch (e) {\n      console.error(logPrefix, 'Failed to fetch OIDC configuration', e)\n      return { success: false, error: 'Cannot connect to the Sign-in Service.' }\n    }\n    const validation = validateOidcConfiguration()\n    if (!validation.success) {\n      console.error(logPrefix, 'OIDC configuration validation failed', validation.error)\n      return { success: false, error: validation.error }\n    }\n  }\n  return { success: true, env: ENV, channelName }\n}\n\nasync function getStatus() {\n  return {\n    initialized,\n    redirectUri,\n    env: ENV,\n    channelName\n  }\n}\n\nfunction logout() {\n  if (!oidcConfiguration.end_session_endpoint) {\n    return { success: false, error: 'Logout not available' }\n  }\n  return { success: true, redirect: oidcConfiguration.end_session_endpoint }\n}\n\nasync function onMessage(e) {\n  const port = e.target\n  const { requestId, request, ...options } = e.data\n  if (requestId === 'contextActive' && tokens.accessToken && idleTimeoutM) {\n      console.log(logPrefix, 'Received contextActive message, setting idle handler')\n      isIdle = false\n      setIdleHandler()\n  } else {\n    const handler = messageHandlers[request]\n    if (handler) {\n      try {\n        const response = await handler(options)\n        port.postMessage({ requestId, response })\n      } catch (error) {\n        port.postMessage({ requestId, error: error.message })\n      }\n    } else {\n      port.postMessage({ requestId, error: 'Unknown request' })\n    }\n  }\n}\n\n// Support functions\nfunction dec2hex(dec) {\n  return ('0' + dec.toString(16)).substr(-2)\n}\n\nfunction generateRandomString() {\n  const array = new Uint32Array(56 / 2)\n  crypto.getRandomValues(array)\n  return Array.from(array, dec2hex).join('')\n}\n\nasync function sha256(plain) {\n  const encoder = new TextEncoder()\n  const data = encoder.encode(plain)\n  return crypto.subtle.digest('SHA-256', data)\n}\n\nfunction base64UrlEncode(a) {\n  let str = ''\n  const bytes = new Uint8Array(a)\n  const len = bytes.byteLength\n  for (let i = 0; i < len; i++) {\n    str += String.fromCharCode(bytes[i])\n  }\n  return btoa(str).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\nasync function challengeFromVerifier(v) {\n  const hashed = await sha256(v)\n  const base64encoded = base64UrlEncode(hashed)\n  return base64encoded\n}\n\nfunction decodeToken(str) {\n  try {\n    str = str.split('.')[1]\n    str = str.replace(/-/g, '+')\n    str = str.replace(/_/g, '/')\n    switch (str.length % 4) {\n      case 0: break\n      case 2: str += '=='; break\n      case 3: str += '='; break\n      default: throw new Error('Invalid token')\n    }\n    str = decodeURIComponent(escape(atob(str)))\n    str = JSON.parse(str)\n    return str\n  } catch {\n    return false\n  }\n}\n\nfunction validateOidcConfiguration() {\n  const result = {\n    success: true\n  }\n  if (!oidcConfiguration.authorization_endpoint) {\n    result.success = false\n    result.error = 'Missing authorization endpoint in OIDC configuration'\n  } else if (!oidcConfiguration.token_endpoint) {\n    result.success = false\n    result.error = 'Missing token endpoint in OIDC configuration'\n  } else if (ENV.strictPkce && !oidcConfiguration.code_challenge_methods_supported?.includes('S256')) {\n    result.success = false\n    result.error = 'OP does not advertise PKCE and STIGMAN_CLIENT_STRICT_PKCE=true'\n  } else if (oidcConfiguration.end_session_endpoint) {\n    try {\n      const parsed = new URL(oidcConfiguration.end_session_endpoint)\n      if (!parsed.protocol.startsWith('http')) {\n        console.warn(logPrefix, 'end_session_endpoint has invalid scheme, logout will be unavailable:', oidcConfiguration.end_session_endpoint)\n        oidcConfiguration.end_session_endpoint = null\n      }\n    }\n    catch {\n      console.warn(logPrefix, 'end_session_endpoint is not a valid URL, logout will be unavailable:', oidcConfiguration.end_session_endpoint)\n      oidcConfiguration.end_session_endpoint = null\n    }\n  }\n  return result\n}\n\nfunction getScopeStr() {\n  const scopePrefix = ENV.scopePrefix\n  let scopes = [\n    `openid`,\n    `${scopePrefix}stig-manager:stig`,\n    `${scopePrefix}stig-manager:stig:read`,\n    `${scopePrefix}stig-manager:collection`,\n    `${scopePrefix}stig-manager:user`,\n    `${scopePrefix}stig-manager:user:read`,\n    `${scopePrefix}stig-manager:op`\n  ]\n  if (ENV.extraScopes) {\n    scopes.push(...ENV.extraScopes.split(\" \"))\n  }\n  return scopes.join(\" \")\n}\n\nasync function fetchOpenIdConfiguration() {\n  if (oidcConfiguration) {\n    return oidcConfiguration\n  }\n  const url = `${ENV.authority}/.well-known/openid-configuration`\n  const response = await fetch(url)\n  if (!response.ok) {\n    throw new Error(`failed to get: ${url}`)\n  }\n  oidcConfiguration = await response.json()\n  return oidcConfiguration\n}\n\nasync function createAuthorization(_redirectUri = redirectUri) {\n  if (authorizations[_redirectUri]) return authorizations[_redirectUri]\n  const pkce = await getPkce()\n  const state = crypto.randomUUID()\n  const params = new URLSearchParams()\n  params.append('client_id', ENV.clientId)\n  params.append('redirect_uri', _redirectUri)\n  params.append('state', state)\n  params.append('response_mode', ENV.responseMode)\n  params.append('response_type', 'code')\n  params.append('scope', getScopeStr())\n  params.append('nonce', crypto.randomUUID())\n  params.append('code_challenge', pkce.codeChallenge)\n  params.append('code_challenge_method', 'S256')\n\n  const authEndpoint = oidcConfiguration.authorization_endpoint\n  const redirect = `${authEndpoint}?${params.toString()}`\n  authorizations[_redirectUri] = { redirect, codeVerifier: pkce.codeVerifier, state }\n  return authorizations[_redirectUri]\n}\n\nasync function getPkce() {\n  const codeVerifier = generateRandomString()\n  const codeChallenge = await challengeFromVerifier(codeVerifier)\n  return { codeChallenge, codeVerifier }\n}\n\nasync function broadcastNoToken() {\n  console.log(logPrefix, 'Broadcasting no token')\n  let baseRedirectUri = redirectUri?.endsWith('index.html')\n    ? redirectUri.slice(0, -'index.html'.length)\n    : redirectUri\n\n  const auth = await createAuthorization(`${baseRedirectUri}reauth.html`)\n  bc.postMessage({ type: 'noToken', ...auth, isIdle })\n}\n\nfunction broadcastToken() {\n    bc.postMessage({\n    type: 'accessToken',\n    accessToken: tokens.accessToken,\n    accessTokenPayload: decodeToken(tokens.accessToken)\n  })\n}\n\nfunction clearAccessTokenTimer() {\n  if (accessTimeoutId) {\n    clearTimeout(accessTimeoutId)\n    accessTimeoutId = null\n  }\n}\n\nfunction clearRefreshTokenTimer() {\n  if (refreshTimeoutId) {\n    clearTimeout(refreshTimeoutId)\n    refreshTimeoutId = null\n  }\n}\n\nfunction setAccessTokenTimer(delayMs) {\n  clearAccessTokenTimer()\n  accessTimeoutId = setTimeout(async () => {\n    if (tokens.accessToken) {\n      clearAccessToken()\n      console.log(logPrefix, 'Access token timeout handler is attempting refresh')\n      await refreshAccessToken()\n    }\n  }, delayMs)\n}\n\nfunction setRefreshTokenTimer(delayMs) {\n  clearRefreshTokenTimer()\n  refreshTimeoutId = setTimeout(async () => {\n    if (tokens.refreshToken) {\n      console.log(logPrefix, 'Refresh token timeout handler is broadcasting no token')\n      clearTokens(true) // broadcast no token\n    }\n  }, delayMs)\n}\n\nfunction getTokenTimes(token, timeoutBufferS = 10) {\n  const expS = decodeToken(token)?.exp\n  if (!expS) {\n    console.log(logPrefix, 'No access token expiration claim')\n    return null\n  }\n  const nowMs = Date.now()\n  const nowS = Math.floor(nowMs / 1000)\n  const expiresDate = new Date(expS * 1000)\n  const expiresDateISO = expiresDate.toISOString()\n  const expiresInS = expS - nowS\n  const expiresInMs = expiresInS * 1000\n  const timeoutInS = Math.min(expiresInS - timeoutBufferS, 2147483) // max timeout for setTimeout\n  const timeoutInMs = timeoutInS * 1000\n  const timeoutDate = new Date((nowS + timeoutInS) * 1000)\n  const timeoutDateISO = timeoutDate.toISOString()\n\n  return {\n    expS,\n    expiresDate,\n    expiresDateISO,\n    expiresInS,\n    expiresInMs,\n    timeoutDate,\n    timeoutDateISO,\n    timeoutInS,\n    timeoutInMs\n  }\n}\n\nfunction setTokensAccessOnly(tokensResponse) {\n  const accessTimes = getTokenTimes(tokensResponse.access_token)\n  if (!accessTimes || accessTimes.timeoutInS <= 0) {\n    broadcastNoToken()\n    return\n  }\n  tokens.accessToken = tokensResponse.access_token\n  broadcastToken()\n  console.log(logPrefix, 'Access token expires: ', accessTimes.expiresDateISO, ' timeout: ', accessTimes.timeoutDateISO)\n  setAccessTokenTimer(accessTimes.timeoutInMs)\n  if (idleTimeoutM && !idleTimeoutId) {\n    setIdleHandler()\n  }\n\n}\n\nfunction setTokensWithRefresh(tokensResponse) {\n  const accessTimes = getTokenTimes(tokensResponse.access_token)\n  const refreshTimes = getTokenTimes(tokensResponse.refresh_token, 0) // no timeout buffer for refresh token\n\n  if (accessTimes?.timeoutInS <= 0) {\n    broadcastNoToken()\n    return\n  } else {\n    tokens.accessToken = tokensResponse.access_token\n    broadcastToken()\n  }\n  if (refreshTimes?.timeoutInS > 0) {\n    tokens.refreshToken = tokensResponse.refresh_token\n    console.log(logPrefix, 'Refresh token expires: ', refreshTimes.expiresDateISO, ' timeout: ', refreshTimes.timeoutDateISO)\n    setRefreshTokenTimer(refreshTimes.timeoutInMs)\n  } else {\n    console.log(logPrefix, 'Refresh expiration unknown or zero, Access token expires: ', accessTimes.expiresDateISO, ' timeout: ', accessTimes.timeoutDateISO)\n    tokens.refreshToken = tokensResponse.refresh_token ?? null\n    setAccessTokenTimer(accessTimes.timeoutInMs)\n    return\n  }\n  if (accessTimes.expiresInS < refreshTimes?.expiresInS) {\n    console.log(logPrefix, 'Access token expires: ', accessTimes.expiresDateISO, ' timeout: ', accessTimes.timeoutDateISO)\n    setAccessTokenTimer(accessTimes.timeoutInMs)\n  } else {\n    console.log(logPrefix, 'Access token expires: ', accessTimes.expiresDateISO, ' timeout disabled')\n  }\n  if (idleTimeoutM && !idleTimeoutId) {\n    setIdleHandler()\n  }\n}\n\nfunction validateTokensResponse(tokensResponse) {\n  if (!tokensResponse.access_token) {\n    throw new Error('No access_token in tokensResponse')\n  }\n  const accessPayload = decodeToken(tokensResponse.access_token)\n  if (!accessPayload) {\n    throw new Error('Invalid access_token in tokensResponse')\n  }\n  validateAudience(accessPayload)\n  validateClaims(accessPayload)\n  return true\n}\n\nfunction validateScope(scopeValue, isAdmin = false) {\n  // Depending on OIDC provider, scopeValue can be a space-separated string (the standard) or an array of scopes. If a string, split it on spaces into an array.\n  const scopes = typeof scopeValue === 'string' ? scopeValue.split(' ')\n\t    : Array.isArray(scopeValue) ? scopeValue\n\t    : []\n  const hasScope = (s) => scopes.includes(s)\n\n  // Required scopes for each privilege\n  const requiredAdminScopes = [\n    'stig-manager:stig',\n    'stig-manager:user',\n    'stig-manager:op',\n    'stig-manager:collection'\n  ]\n  const requiredUserScopes = [\n    'stig-manager:stig:read',\n    'stig-manager:user:read',\n    'stig-manager:collection'\n  ]\n\n  // Top-level scope grants all\n  if (hasScope('stig-manager')) return true\n\n  const required = isAdmin ? requiredAdminScopes : requiredUserScopes\n  for (const s of required) {\n    if (!hasScope(s)) {\n      throw new Error(`Missing required scope \"${ENV.scopePrefix}${s}\" for ${isAdmin ? 'admin' : 'user'} in access token payload. Received scopes: ${JSON.stringify(scopeValue)}`)\n    }\n  }\n  return true\n}\n\nfunction validateClaims(payload) {\n  if (!payload[ENV.claims.scope]) {\n    throw new Error(`Missing scope claim (${ENV.claims.scope}) in access token payload`)\n  }\n  if (!payload[ENV.claims.username]) {\n    throw new Error(`Missing username claim (${ENV.claims.username}) in access token payload`)\n  }\n  \n  const privilegeChain = ENV.claims.privileges.split('.').map(p => p.replace(/(^\")|(\"$)/g, ''))\n  const privileges = privilegeChain.reduce((obj, key) => obj?.[key], payload)\n  if (!privileges) {\n    throw new Error(`Missing privileges claim (${ENV.claims.privileges}) in access token payload`)\n  }\n\n  // move idle handling out of here eventually\n  if (privileges.includes('admin')) {\n    idleTimeoutM = ENV.idleTimeoutAdmin\n  } else {\n    idleTimeoutM = ENV.idleTimeoutUser\n  }\n\n  validateScope(payload[ENV.claims.scope], privileges.includes('admin'))\n\n  return true\n}\n\nfunction validateAudience(payload) {\n  if (ENV.audienceValue) {\n    if (Array.isArray(payload.aud)) {\n      if (!payload.aud.includes(ENV.audienceValue)) {\n        throw new Error(`Invalid audience in access token payload: ${payload.aud.join(', ')}, expected: ${ENV.audienceValue}`)\n      } \n    }\n    else if (typeof payload.aud === 'string') {\n      if (payload.aud !== ENV.audienceValue) {\n        throw new Error(`Invalid audience in access token payload: ${payload.aud}, expected: ${ENV.audienceValue}`)\n      }\n    } else {\n      throw new Error(`Invalid audience type in access token payload: ${typeof payload.aud}, expected string or array`)\n    }\n  }\n  return true\n}\n\nfunction setTokens(tokensResponse) {\n  clearTokens()\n  if (tokensResponse.access_token && tokensResponse.refresh_token) {\n    setTokensWithRefresh(tokensResponse)\n    return true\n  }\n  if (tokensResponse.access_token) {\n    setTokensAccessOnly(tokensResponse)\n    return true\n  }\n}\n\nfunction clearAccessToken(sendBroadcast = false) {\n  tokens.accessToken = null\n  clearAccessTokenTimer()\n  if (sendBroadcast) broadcastNoToken()\n}\n\nfunction clearTokens(sendBroadcast = false) {\n  tokens.accessToken = null\n  tokens.refreshToken = null\n  clearAccessTokenTimer()\n  clearRefreshTokenTimer()\n  if (sendBroadcast) broadcastNoToken()\n}\n\nasync function fetchTokens(params) {\n  if (isIdle) {\n    console.log(logPrefix, 'Contexts are idle, will not fetch tokens')\n    return\n  }\n  const response = await fetch(oidcConfiguration.token_endpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: params\n  })\n  if (isIdle) {\n    console.log(logPrefix, 'Contexts are idle, will not get tokens response')\n    return\n  }\n  const tokensResponse = await response.json()\n  console.log(logPrefix, 'Tokens response received', Date.now(), tokensResponse)\n  if (isIdle) {\n    console.log(logPrefix, 'Contexts are idle, will not validate and set tokens')\n    return\n  }\n\n  if (!response.ok) {\n    throw new Error(tokensResponse.error_description)\n  }\n  validateTokensResponse(tokensResponse)\n  setTokens(tokensResponse)\n}\n\nasync function refreshAccessToken() {\n  if (!tokens.refreshToken) {\n    await broadcastNoToken()\n    return\n  }\n  const params = new URLSearchParams()\n  params.append('grant_type', 'refresh_token')\n  params.append('client_id', ENV.clientId)\n  params.append('refresh_token', tokens.refreshToken)\n\n  try {\n    return await fetchTokens(params)\n  }\n  catch (e) {\n    clearTokens(true) // broadcast no token\n    return { success: false, error: e.message}\n  }\n}\n\nfunction setIdleHandler() {\n  clearTimeout(idleTimeoutId)\n  if (idleTimeoutM) {\n    const idleTimeoutMs = idleTimeoutM * 60 * 1000 // convert minutes to milliseconds\n    const idleTimeoutDate = new Date(Date.now() + idleTimeoutMs).toISOString()\n    idleTimeoutId = setTimeout(() => {\n      console.log(logPrefix, 'Idle timeout reached, clearing tokens with broadcast')\n      idleTimeoutId = null\n      isIdle = true\n      clearTokens(true) // broadcast no token\n    }, idleTimeoutMs) // default to 15 minutes if not set\n    console.log(logPrefix, 'Idle handler installed, timeout set for', idleTimeoutDate)\n  }\n}\n\n"
  },
  {
    "path": "client/src/js/workers/service-worker.js",
    "content": "let counter = 0\nconst requests = {}\n\nasync function fetchAttachment (url, init, attachment) {\n  const fetchResponse = await fetch(url, init)\n  const headers = {...fetchResponse.headers, 'content-disposition': `attachment; filename=\"${attachment}\"`}\n  return new Response(\n    fetchResponse.body, \n    {\n      headers,\n      status: fetchResponse.status,\n      statusText: fetchResponse.statusText\n    }\n  )\n}\n\nself.addEventListener('install', (event) => {\n  event.waitUntil(self.skipWaiting())\n})\n\nself.addEventListener('activate', (event) => {\n  event.waitUntil(self.clients.claim())\n})\n\nself.onmessage = (event) => {\n  if (event.data?.type === 'proxy-url-request' && event.data.request) {\n    const port = event.ports[0]\n    const ourCounter = ++counter\n    requests[`${ourCounter}`] = event.data.request\n    port.postMessage(`service-proxy-${ourCounter}`)  \n  }\n}\n\nself.onfetch = (event) => {\n  if (event.request.url.includes('service-proxy-')) {\n    const key = event.request.url.match(/service-proxy-(\\d+)/)[1]\n    const {url, attachment, ...init} = requests[key]\n    delete requests[key]\n    if (attachment) {\n      event.respondWith(fetchAttachment(url, init, attachment))\n    }\n    else {\n      event.respondWith(fetch(url, init))\n    }\n  } \n}\n"
  },
  {
    "path": "client/src/js/workers/state-worker.js",
    "content": "\n// Shared worker for API state monitoring via SSE (Server-Sent Events)\n//\n// Handles messages 'initialize', 'getApiState'.\n// The 'initialize' message returns immediately if already initialized by another browsing context.\n// Otherwise, it connects to the EventSource endpoint and waits up to 5 seconds for the first message.\n// This is designed to error out for deployments where the SSE endpoint is buffered (no immediate message).\n// The worker broadcasts all received events to all connected contexts via BroadcastChannel.\n// Implements custom reconnect logic that retries connections even on 502 errors from reverse proxies.\n\nconst logPrefix = '[state-worker]:'\nconst retryInterval = 3000; // 3-second retry delay\nconst channelName = crypto.randomUUID()\nconst stateWorkerChannel = new BroadcastChannel(channelName); // Used to broadcast state events\n\nlet initialized = false // True if any context has initialized the worker\nlet apiBase = ''        // Base URL for API endpoints\nlet state = null        // Last known state from the API\nlet eventSource = null  // Current EventSource connection\n\n// Message handlers for the shared worker\n// 'initialize': sets up the SSE connection and broadcasts state\n// 'getApiState': fetches the current API state via HTTP\nconst messageHandlers = {\n  initialize,\n  getApiState\n}\n\n// Shared worker entry point: handle new connections from browsing contexts\nonconnect = function (e) {\n  const port = e.ports[0]\n  port.onmessage = onMessage\n  port.start()\n}\n\n// Handles 'initialize' message from a context. If already initialized, returns immediately.\n// Otherwise, connects to the SSE endpoint and waits for the first message (with a 5s timeout).\n// Broadcasts the first state, then attaches persistent listeners for future events.\nfunction initialize(options) {\n  if (initialized) return Promise.resolve({ success: true, channelName, state });\n\n  return new Promise((resolve) => {\n    apiBase = options.apiBase;\n    let timeoutId;\n    eventSource = new EventSource(`${apiBase}/op/state/sse`);\n\n    // Handle SSE errors, which are usually disconnections\n    eventSource.onerror = (event) => {\n      if (!initialized) {\n        clearTimeout(timeoutId);\n        resolve({ success: false, error: 'API connection error' });\n      }\n      reconnectSSE();\n    };\n\n    // One-time handler for the first SSE message\n    const onFirstMessage = (event) => {\n      clearTimeout(timeoutId);\n      stateWorkerChannel.postMessage({ type: event.type, data: event.data });\n      state = event.data;\n      addListeners();\n      initialized = true;\n      resolve({ success: true, channelName, state });\n    };\n    eventSource.addEventListener('state-report', onFirstMessage, { once: true });\n\n    // If the first message doesn't arrive in 5 seconds, treat as error (e.g., buffered SSE endpoint)\n    timeoutId = setTimeout(() => {\n      eventSource.removeEventListener('state-report', onFirstMessage);\n      stateWorkerChannel.postMessage({ type: 'state-error', data: 'Timeout waiting for first SSE message' });\n      resolve({success: false, error: `Timeout waiting for API state event stream.<br><br>\n        A reverse proxy may be buffering responses from ${eventSource.url}.<br><br>\n        To disable using event stream, set STIGMAN_CLIENT_STATE_EVENTS=false` });\n    }, 5000);\n  });\n}\n\n\n// Handles 'getApiState' message: fetches the current API state via HTTP\nasync function getApiState() {\n  const url = `${apiBase}/op/state`\n  const response = await fetch(url)\n  if (!response.ok) {\n    return {success: false, error: `Failed to get API state: ${response.status} ${response.statusText}`}\n  }\n  const data = await response.json()\n  return { success: true, data }\n}\n\n\n// Handles messages from all connected contexts\nasync function onMessage(e) {\n  const port = e.target\n  const { requestId, request, ...options } = e.data\n  const handler = messageHandlers[request]\n  if (handler) {\n    try {\n      const response = await handler(options)\n      port.postMessage({ requestId, response })\n    } catch (error) {\n      port.postMessage({ requestId, response: { success: false, error: error.message } })\n    }\n  } else {\n    port.postMessage({ requestId, error: 'Unknown request' })\n  }\n}\n\n\n// Custom reconnect logic for SSE: retries connections even on 502 errors from reverse proxies\nfunction reconnectSSE() {\n  if (eventSource) eventSource.close();\n  eventSource = new EventSource(`${apiBase}/op/state/sse`);\n\n  eventSource.onopen = function (event) {\n    addListeners();\n  };\n  eventSource.onerror = function (error) {\n    stateWorkerChannel.postMessage({ type: 'state-error', data: {message: `Cannot connect to ${error.target.url}` } });\n    eventSource.close(); // Close the failed connection\n    // Delay before retrying\n    setTimeout(() => {\n      reconnectSSE();\n    }, retryInterval);\n  };\n}\n\n// Attach persistent listeners for all relevant SSE events and broadcast them to all contexts\nfunction addListeners() {\n  const events = ['state-report', 'state-changed', 'dependency-changed'];\n  const listener = (event) => {\n    stateWorkerChannel.postMessage({ type: event.type, data: event.data });\n    state = event.data;\n  }\n  for (const eventName of events) {\n    eventSource.addEventListener(eventName, listener);\n  }\n  eventSource.addEventListener('error', () => {\n    for (const eventName of events) {\n      eventSource.removeEventListener(eventName, listener);\n    }\n  }, { once: true });\n}\n\n"
  },
  {
    "path": "client/src/reauth.html",
    "content": "<!DOCTYPE html>\n<html lang=\"en\">\n\n<head>\n  <meta charset=\"UTF-8\">\n  <title>STIG Manager Authenticate</title>\n\t<link rel=\"stylesheet\" type=\"text/css\" href=\"css/init.css\" />\n</head>\n\n<body>\n\t\t<div id=\"loading-mask\">\n\t\t\t<div id=\"loading\">\n\t\t\t\t<div id=\"indicator\" class=\"loading-indicator\">\n\t\t\t\t\t<img src=\"img/shield-green-check.svg\" alt=\"Green shield with check\" width=\"48px\" height=\"48px\" style=\"position: relative;bottom: -7px;left: 0px;\">\n\t\t\t\t\t<div id=\"loading-text\"></div>\n\t\t\t\t</div>\n\t\t\t</div>\n\t\t</div>\n  <script type=\"module\">\n    const statusEl = document.getElementById(\"loading-text\")\n    const OW = new SharedWorker(\"js/workers/oidc-worker.js\", { name: 'stigman-oidc-worker', type: \"module\" })\n    OW.port.start()\n    const init = await sendWorkerRequest({ request: 'getStatus' })\n    if (init.initialized) {\n      await run()\n    }\n    else {\n      appendError('OIDC Worker is not initialized.')\n    }\n\n    // Helper functions\n    function sendWorkerRequest(request) {\n      const requestId = crypto.randomUUID()\n      OW.port.postMessage({ ...request, requestId })\n      return new Promise((resolve) => {\n        function handler(event) {\n          if (event.data.requestId === requestId) {\n            OW.port.removeEventListener('message', handler)\n            resolve(event.data.response)\n          }\n        }\n        OW.port.addEventListener('message', handler)\n      })\n    }\n\n    async function run() {\n      appendStatus('Processing OIDC redirect...')\n      const url = new URL(window.location.href)\n      const redirectUri = `${url.origin}${url.pathname}`\n      const paramStr = extractParamString(url)\n      if (!paramStr) {\n        appendError('No parameters found in the URL.')\n        return\n      }\n      const response = await handleRedirectAndParameters(redirectUri, paramStr, init.env.clientId)\n      if (response.success) {\n        window.close()\n      } else {\n        appendError('Error exchanging code for token: ' + response.error)\n      }\n\n      function extractParamString(url) {\n        if (url.hash) return url.hash.substring(1) // Remove the leading '#'\n        if (url.search) return url.search.substring(1) // Remove the leading '?'\n        return ''\n      }\n    }\n\n    async function handleRedirectAndParameters(redirectUri, paramStr, clientId) {\n      const params = processRedirectParams(paramStr)\n      if (!params.code) {\n        let errorMessage = 'No authorization code provided in the URL parameters.'\n        if (params.error) {\n          errorMessage += ` Error: ${params.error}`\n          if (params.error_description) {\n            errorMessage += ` - ${params.error_description}`\n          }\n        }\n        appendError(errorMessage)\n        return\n      }\n      if (!params.state || params.state !== localStorage.getItem('reauth-oidcState')) {\n        appendError('State mismatch. The state parameter does not match the expected value.')\n        return\n      }\n      const response = await sendWorkerRequest({\n        request: 'exchangeCodeForToken',\n        code: params.code,\n        codeVerifier: localStorage.getItem('reauth-codeVerifier'),\n        clientId,\n        redirectUri\n      })\n      localStorage.removeItem('reauth-oidcState')\n      localStorage.removeItem('reauth-codeVerifier')\n      return response\n\n      function processRedirectParams(paramStr) {\n        const params = {}\n        const usp = new URLSearchParams(paramStr)\n        for (const [key, value] of usp) {\n          params[key] = value\n        }\n        return params\n      }\n    }\n\n    function appendStatus(html) {\n      statusEl.innerHTML += `${statusEl.innerHTML ? '<br/><br/>' : ''}${html}`\n    }\n\n    function escapeHtml(str) {\n      return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\"/g, '&quot;').replace(/'/g, '&#39;')\n    }\n\n    function appendError(message) {\n      const cleanHref = window.location.origin + window.location.pathname\n      statusEl.innerHTML += `<br/><br/><span style=\"color:#ff5757\">Error: ${escapeHtml(message)}</span><br><br><a href=\"${cleanHref}\">Retry authorization.</a>`\n      hideSpinner()\n    }\n    function hideSpinner() {\n      const loadingEl = document.getElementById(\"indicator\")\n      if (loadingEl) {\n        loadingEl.style.background = \"none\"\n      }\n    }\n\n\n\n  </script>\n</body>\n\n</html>"
  },
  {
    "path": "data/appdata/README.md",
    "content": "## Demonstration Application Data\n\nSample data that demonstrates the features of STIG Manager is provided in the `data/appdata` directory of the project repo.  This data is intended to be loaded into a fresh STIG Manager installation, as loading it will wipe out all existing data in the system.  The sample data was automatically generated and does not represent an actual system.\n\nThe sample data can be loaded from the web client:\n\n- `Application Management -> Export/Import Data -> Replace Application Data...`\n- Select the `data/appdata/demo-appdata.jsonl.gz` file from the repo. The data may take a few 10s of seconds to load.\n\n\nRefresh the browser to see the new data. \n\nIf you are not running with our demonstration Keycloak container, you may need to grant yourself access to the Collections included in the sample data using the `Application Management -> Collections` interface.\n"
  },
  {
    "path": "data/schemas/_manifest.json",
    "content": "{\n  \"$schema\": \"https://json-schema.org/draft-07/schema\",\n  \"$id\": \"https://github.com/NUWCDIVNPT/stig-manager/blob/main/data/schemas/_manifest.json\",\n  \"type\": \"object\",\n  \"required\": [\n      \"started\",\n      \"finished\",\n      \"errorCount\",\n      \"errors\",\n      \"memberCount\",\n      \"members\",\n      \"requestParams\"\n  ],\n  \"properties\": {\n      \"started\": {\n          \"type\": \"string\",\n          \"format\": \"date-time\"\n      },\n      \"finished\": {\n          \"type\": \"string\",\n          \"format\": \"date-time\"\n      },\n      \"errorCount\": {\n          \"type\": \"integer\"\n      },\n      \"errors\": {\n          \"type\": \"array\",\n          \"items\": {\n              \"type\": \"object\",\n              \"required\": [\n                  \"assetId\",\n                  \"assetName\",\n                  \"stigs\",\n                  \"error\"\n              ],\n              \"properties\": {\n                  \"assetId\": {\n                      \"type\": \"string\"\n                  },\n                  \"assetName\": {\n                      \"type\": \"string\"\n                  },\n                  \"stigs\": {\n                      \"type\": \"array\",\n                      \"items\": {\n                          \"type\": \"object\",\n                          \"required\": [\n                              \"benchmarkId\",\n                              \"revisionStr\"\n                          ],\n                          \"properties\": {\n                              \"benchmarkId\": {\n                                  \"type\": \"string\"\n                              },\n                              \"revisionStr\": {\n                                  \"type\": \"string\"\n                              }\n                          }\n                      }\n                  },\n                  \"error\": {\n                      \"type\": \"object\",\n                      \"required\": [\n                          \"message\",\n                          \"stack\"\n                      ],\n                      \"properties\": {\n                          \"message\": {\n                              \"type\": \"string\"\n                          },\n                          \"stack\": {\n                              \"type\": \"string\"\n                          }\n                      }\n                  }\n              }\n          }\n      },\n      \"memberCount\": {\n          \"type\": \"integer\"\n      },\n      \"members\": {\n          \"type\": \"array\",\n          \"items\": {\n              \"type\": \"string\"\n          }\n      },\n      \"requestParams\": {\n          \"type\": \"object\",\n          \"required\": [\n              \"collection\",\n              \"assetStigs\"\n          ],\n          \"properties\": {\n              \"collection\": {\n                  \"type\": \"object\",\n                  \"required\": [\n                      \"collectionId\",\n                      \"name\"\n                  ],\n                  \"properties\": {\n                      \"collectionId\": {\n                          \"type\": \"string\"\n                      },\n                      \"name\": {\n                          \"type\": \"string\"\n                      }\n                  }\n              },\n              \"assetStigs\": {\n                  \"type\": \"array\",\n                  \"items\": {\n                      \"type\": \"object\",\n                      \"required\": [\n                          \"assetId\",\n                          \"stigs\"\n                      ],\n                      \"properties\": {\n                          \"assetId\": {\n                              \"type\": \"string\"\n                          },\n                          \"stigs\": {\n                              \"type\": \"array\",\n                              \"items\": {\n                                  \"oneOf\": [{\n                                      \"type\": \"string\"\n                                  },\n                                  {\n                                      \"type\": \"object\",\n                                      \"required\": [\n                                          \"benchmarkId\",\n                                          \"revisionStr\"\n                                      ],\n                                      \"properties\": {\n                                          \"benchmarkId\": {\n                                              \"type\": \"string\"\n                                          },\n                                          \"revisionStr\": {\n                                              \"type\": \"string\"\n                                          }\n                                      }\n                                  }]\n                              }\n                          }\n                      }\n                  }\n              }\n          }\n      }\n  }\n}\n"
  },
  {
    "path": "docker-build.sh",
    "content": "#!/bin/bash\n\n# This script must be run from the top-level of the repo.\n\n./client/build.sh\n./docs/build.sh\n\nBRANCH=$(git symbolic-ref --short HEAD)\nSHA=$(git rev-parse --short=10 HEAD)\nDESCRIBE=$(git describe --tags)\nTAG=$(git describe --tags --abbrev=0)\n\ndocker build \\\n  --build-arg=COMMIT_BRANCH=$BRANCH \\\n  --build-arg=COMMIT_SHA=$SHA \\\n  --build-arg=COMMIT_DESCRIBE=$DESCRIBE \\\n  --build-arg=COMMIT_TAG=$TAG \\\n  --no-cache=true \\\n  --tag stig-manager:$TAG .\n\ndocker tag stig-manager:$TAG stig-manager:latest\n"
  },
  {
    "path": "docs/.nojekyll",
    "content": ""
  },
  {
    "path": "docs/Dockerfile",
    "content": "FROM sphinxdoc/sphinx:7.4.7\r\n\r\nWORKDIR /docs\r\nADD requirements.txt /docs\r\nRUN pip3 install -r requirements.txt\r\n"
  },
  {
    "path": "docs/Makefile",
    "content": "# Minimal makefile for Sphinx documentation\n#\n\n# You can set these variables from the command line, and also\n# from the environment for the first two.\nSPHINXOPTS    ?=\nSPHINXBUILD   ?= sphinx-build\nSOURCEDIR     = .\nBUILDDIR      = _build\n\n# Put it first so that \"make\" without argument is like \"make help\".\nhelp:\n\t@$(SPHINXBUILD) -M help \"$(SOURCEDIR)\" \"$(BUILDDIR)\" $(SPHINXOPTS) $(O)\n\n.PHONY: help Makefile\n\n# Catch-all target: route all unknown targets to Sphinx using the new\n# \"make mode\" option.  $(O) is meant as a shortcut for $(SPHINXOPTS).\n%: Makefile\n\t@$(SPHINXBUILD) -M $@ \"$(SOURCEDIR)\" \"$(BUILDDIR)\" $(SPHINXOPTS) $(O)\n"
  },
  {
    "path": "docs/STIG-Manager-OSS.ckl",
    "content": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!-- STIG Manager 1.5.2 -->\n<!-- Classification: NONE -->\n<CHECKLIST>\n  <ASSET>\n    <ROLE>None</ROLE>\n    <ASSET_TYPE>Non-Computing</ASSET_TYPE>\n    <MARKING>NONE</MARKING>\n    <HOST_NAME>STIG-Manager-OSS</HOST_NAME>\n    <HOST_IP/>\n    <HOST_MAC/>\n    <HOST_GUID/>\n    <HOST_FQDN/>\n    <TECH_AREA/>\n    <TARGET_KEY>2777</TARGET_KEY>\n    <WEB_OR_DATABASE>false</WEB_OR_DATABASE>\n    <WEB_DB_SITE/>\n    <WEB_DB_INSTANCE/>\n  </ASSET>\n  <STIGS>\n    <iSTIG>\n      <STIG_INFO>\n        <SI_DATA>\n          <SID_NAME>version</SID_NAME>\n          <SID_DATA>6</SID_DATA>\n        </SI_DATA>\n        <SI_DATA>\n          <SID_NAME>classification</SID_NAME>\n        </SI_DATA>\n        <SI_DATA>\n          <SID_NAME>customname</SID_NAME>\n        </SI_DATA>\n        <SI_DATA>\n          <SID_NAME>stigid</SID_NAME>\n          <SID_DATA>Application_Security_Development_STIG</SID_DATA>\n        </SI_DATA>\n        <SI_DATA>\n          <SID_NAME>description</SID_NAME>\n          <SID_DATA>This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</SID_DATA>\n        </SI_DATA>\n        <SI_DATA>\n          <SID_NAME>filename</SID_NAME>\n          <SID_DATA>stig-manager-oss</SID_DATA>\n        </SI_DATA>\n        <SI_DATA>\n          <SID_NAME>releaseinfo</SID_NAME>\n          <SID_DATA>Release: 2 Benchmark Date: 30 Jan 2025</SID_DATA>\n        </SI_DATA>\n        <SI_DATA>\n          <SID_NAME>title</SID_NAME>\n          <SID_DATA>Application Security and Development Security Technical Implementation Guide</SID_DATA>\n        </SI_DATA>\n        <SI_DATA>\n          <SID_NAME>uuid</SID_NAME>\n          <SID_DATA>391aad33-3cc3-4d9a-b5f7-0d7538b7b5a2</SID_DATA>\n        </SI_DATA>\n        <SI_DATA>\n          <SID_NAME>notice</SID_NAME>\n          <SID_DATA>terms-of-use</SID_DATA>\n        </SI_DATA>\n        <SI_DATA>\n          <SID_NAME>source</SID_NAME>\n        </SI_DATA>\n      </STIG_INFO>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222387</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000001</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222387r960735_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000010</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide a capability to limit the number of logon sessions per user.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application management includes the ability to control the number of users and user sessions that utilize an application. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to DoS attacks.\n\nThis requirement may be met via the application or by utilizing information system session control provided by a web server or other underlying solution that provides specialized session management capabilities.\n\nIf it has been specified that this requirement will be handled by the application, the capability to limit the maximum number of concurrent single user sessions must be designed and built into the application.\n\nThis requirement addresses concurrent sessions for individual system accounts and does not address concurrent sessions by single users via multiple system accounts.\n\nThe maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>For production environments;  Review the system documentation, identify the number of application user logon sessions allowed per user, identify the methods utilized for user session management or have application administrator describe how the application implements user session management.\n\nUtilize the management interface that is used to set the user session values, or examine configuration files in order to review user session configuration settings.\n\nEnsure the number of sessions allowed per user is specified in accordance with the organizational requirements.\n\nFor development environments;  have the developer provide design documentation or demonstrate how the application is designed to limit the number of simultaneous user logon sessions.\n\nIf the application is not configured to limit the number of logon sessions per user as defined by the organization, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to specify the number of logon sessions that are allowed per user.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000054</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The User Session layer, including concurrent session handling, is implemented by an external OpenID Connect (OIDC) Provider that issues OAuth2 tokens.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222388</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000295</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222388r1043182_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000060</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must clear temporary storage and cookies when the session is terminated.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Persistent cookies are a primary means by which a web application will store application state and user information.  Since HTTP is a stateless protocol, this persistence allows the web application developer to provide a robust and customizable user experience.\n\nHowever, if a web application stores user authentication information within a persistent cookie or other temporary storage mechanism, this information can be stolen and used to compromise the users account.\n\nLikewise, HTML 5 provides the developer with a client storage capability where application data larger than the 4K cookie size limit can be stored on the local client.  While this can be beneficial to the developer, this is considered insecure storage and should not be used for storing sensitive session or security tokens.  A cross site scripting attack can put this data at risk.\n\nWeb applications must clear sensitive data from files and storage areas on the client when the session is terminated.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review application design documentation and interview application administrator to identify how the application makes use of temporary client storage and cookies.  Identify cookie and web storage locations on the client.  Clear all browser cookies and web cache.\n\nLog on to the application and perform several standard operations, noting if the application ever prompts the user to accept a cookie. If prompted by the browser to save the user ID and password (decline to save the user ID and password), this is a finding. \n\nLog out of the application and close the browser. Reopen the browser and examine the stored cookies. The cookies displayed should be related to the application website.\n\nThe procedure to view cookies will vary according to the browser used. Some modern browsers are making use of SQLite databases to store cookie data so use of a SQLite db reader/browser may be required.\n\nOpen the cookies related to the application website and search for any identification or authentication information. While authentication information can vary on a per application basis, this is most often specified as &quot;username=x&quot;, or &quot;password=x&quot;.\n\nIf the web application prompts the user to save their password, or if a username or password value exists within a cookie or within local storage locations, even if hashed, this is a finding.\n\nThe application may use means other than cookies to store user information. If the reviewer detects an alternative mechanism for storing information locally, examine the data storage to ensure no authentication or other sensitive information is present.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to clear sensitive data from cookies and local storage when the user logs out of the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002361</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The Web Client does not persist storage of any user information, including OAuth2 tokens.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222389</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000295</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222389r1043182_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000070</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must automatically terminate the non-privileged user session and log off non-privileged users after a 15 minute idle time period has elapsed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Leaving a user’s application session established for an indefinite period of time increases the risk of session hijacking.\n\nSession termination terminates an individual user&apos;s logical application session after 15 minutes of application inactivity at which time the user must re-authenticate and a new session must be established if the user desires to continue work in the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative to demonstrate the configuration setting where the idle time out value is defined.\n\nAlternatively, logon with a regular application user account and let the session sit idle for 15 minutes.\n\nAttempt to access the application after 15 minutes of inactivity.\n\nIf the configuration setting is not set to time out user sessions after 15 minutes of inactivity, or if the regular user session used for testing does not time out after 15 minutes of inactivity, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to terminate the non-privileged users session after 15 minutes of inactivity.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002361</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The User Session layer, including idle session handling, is implemented by an external OpenID Connect (OIDC) Provider that issues OAuth2 tokens.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222390</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000295</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222390r1043182_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000080</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must automatically terminate the admin user session and log off admin users after a 10 minute idle time period is exceeded.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Leaving an admin user&apos;s application session established for an indefinite period of time increases the risk of session hijacking.\n\nSession termination terminates an individual user&apos;s logical application session after 10 minutes of application inactivity at which time the user must re-authenticate and a new session must be established if the user desires to continue work in the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative to demonstrate the application configuration setting where the idle time out value is defined for admin users.\n\nAlternatively, logon with an admin user account and let the session sit idle for 10 minutes.\n\nAttempt to access the application after 10 minutes of inactivity.\n\nIf the configuration setting is not set to time out admin user sessions after 10 minutes of inactivity, or if the session used for testing does not time out after 10 minutes of inactivity, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to terminate the admin users session after 10 minutes of inactivity.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002361</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The User Session layer, including idle session handling, is implemented by an external OpenID Connect (OIDC) Provider that issues OAuth2 tokens.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222391</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000296</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222391r961224_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000090</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications requiring user access authentication must provide a logoff capability for user initiated communication session.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If a user cannot explicitly end an application session, the session may remain open and be exploited by an attacker.  Applications providing user access must provide the ability for users to manually terminate their sessions and log off.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application does not provide an interface for interactive user access, this is not applicable.\n\nLog on to the application with a valid user account. Examine the user interface. Identify the command or link that provides the logoff function.\n\nActivate the user logoff function.\n\nObserve user interface and attempt to interact with the application.  Confirm user interaction with the application is no longer possible.\n\nIf the user session is not terminated or if the logoff function does not exist, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to provide all users with the capability to manually terminate their application session.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002363</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The Web Client requests logoff service from the OIDC Provider after user interaction with a DOM element whose innerText = &apos;Logout&apos;</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222392</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000297</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222392r961227_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000100</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must display an explicit logoff message to users indicating the reliable termination of authenticated communications sessions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If a user is not explicitly notified that their application session has been terminated, they cannot be certain that their session did not remain open. Applications with a user access interface must provide an explicit logoff message to the user upon successful termination of the user session.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application does not provide an interface for interactive user access, this is not applicable.\n\nLog on to the application with a valid user account. Examine the user interface. Identify the command or link that provides the logoff function.\n\nActivate the user logoff function.\n\nIf the application does not provide an explicit logoff message indicating the user session has been terminated, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to provide an explicit logoff message to users indicating a successful logoff has occurred upon user session termination.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002364</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The SPA does not itself display an explicit &apos;logged out&apos; screen, it immediately redirects the user to the logout screen of the configured OIDC Provider, which handles session termination.\n        </FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222393</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000311</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222393r961269_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000110</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in storage.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without the association of security attributes to information, there is no basis for the application to make security related access-control decisions.\n\nSecurity attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information.\n\nThese attributes are typically associated with internal data structures (e.g., records, buffers, files) within the information system and are used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy.\n\nOne example includes marking data as classified or FOUO. These security attributes may be assigned manually or during data processing but either way, it is imperative these assignments are maintained while the data is in storage. If the security attributes are lost when the data is stored, there is the risk of a data compromise.\n\nClassify the system hosting the application with default classification.  Treat all unmarked data at the highest classification as the overall hosting system is classified.  If there is no classification, mark system high.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nDetermine if the application processes classified, FOUO, or other data that is required to be marked and identify if the application requirements specify data markings of any other types of data.\n\nIf the application does not contain classified, FOUO, or other data that is required to be marked, this requirement is not applicable.\n\nReview the database or other storage mechanism and have the application administrator identify and demonstrate how the application assigns and maintains data markings while the data is in storage.\n\nTypical methods for marking data include utilizing a table or data base field that contains the marking information and associating the marking information with the data.\n\nIf application data required to be marked is not marked and does not retain its marking while it is being stored, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to assign data marking and ensure the marking is retained when the data is stored.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002262</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API scaffolds each new database instance with the classification specified by the environment variable STIGMAN_CLASSIFICATION. This value is stored in the &apos;configuration&apos; table and represents the default classification for all data that is stored by the database instance, served by the API, and received by the Web Client.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222394</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000313</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222394r961272_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000120</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in process.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without the association of security attributes to information, there is no basis for the application to make security related access-control decisions.\n\nSecurity attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information.\n\nThese attributes are typically associated with internal data structures (e.g., records, buffers, files) within the information system and are used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy.\n\nOne example includes marking data as classified or FOUO. These security attributes may be assigned manually or during data processing but either way, it is imperative these assignments are maintained while the data is in process. If the security attributes are lost when the data is being processed, there is the risk of a data compromise.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify if the application requirements include data marking.  Also determine if the application processes classified, FOUO or other data that is required to be marked.\n\nIf the application does not contain classified, FOUO or have data marking requirements, this requirement is not applicable.\n\nAccess the user interface for the application and navigate through the application. Perform several application actions that will manipulate data contained within the application.\n\nFor example, create a test record and assign a data marking to the data element. Save the test record, close the data entry fields and navigate to display the test record. Perform an edit action on the test data that does not edit the marking itself or perform any other form of data processing such as assigning the data to another users work queue for review or printing the data, ensure the data marking is retained throughout the data processing actions.\n\nIf application data required to be marked does not retain its marking while it is being processed by the application, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to retain the data marking when processing data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002263</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Individual objects do not contain data markings. An API endpoint returns the data marking for all data served by the API. The Web Client displays a banner that represents the data marking for all data received by the Client. Processing the data does not alter this banner in any circumstances.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222395</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000314</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222395r961275_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000130</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without the association of security attributes to information, there is no basis for the application to make security related access-control decisions.\n\nSecurity attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information.\n\nThese attributes are typically associated with internal data structures (e.g., records, buffers, files) within the information system and are used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy.\n\nOne example includes marking data as classified or FOUO. These security attributes may be assigned manually or during data processing but either way, it is imperative these assignments are maintained while the data is in transmission. If the security attributes are lost when the data is being transmitted, there is the risk of a data compromise.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify if the application requirements include data marking also determine if the application processes classified, FOUO or other data that is required to be marked.\n\nAccess the user interface for the application and navigate through the application. Perform an application action that will transmit marked data that is contained within the application.\n\nIf the application does not contain classified, FOUO or have data marking requirements, or if the application does not transmit data, this requirement is not applicable.\n\nE.g., create a test record and assign a data marking to the data element. Save the test record, close the data entry fields and navigate to display the test record. Initiate the application processes to transmit data. Access remote system or have person with access to remote system verify the data marking is retained after the data transmission.\n\nIf application data required to be marked does not retain its marking when it is being transmitted by the application, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to retain the data marking when transmitting data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002264</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Individual objects do not contain data markings. An API endpoint returns the data marking for all data served by the API. The Web Client displays a banner that represents the data marking for all data received by the Client. Data transmission does not alter this banner in any circumstances.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222396</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000014</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222396r960759_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000160</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must implement DoD-approved encryption to protect the confidentiality of remote access sessions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\n\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\n\nEncryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection thereby providing a degree of confidentiality. The encryption strength of mechanism is selected based on the security categorization of the information.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the system administrator.\n\nIdentify the application encryption capabilities and methods for implementing encryption protection.\n\nFor web based applications; open the web browser and access the website URL. Use the browser and determine if the session is protected via TLS. A secure connection is usually indicated in the upper left hand corner of the URL by a padlock icon. Click on the padlock icon and examine the connection information. Determine if TLS encryption is used to secure the session.\n\nFor non-web based applications, determine the TCP/IP port, protocol and method used for establishing client connections to the remote server. Review application configuration settings to ensure encryption is specified and  via TLS.\n\nIf the connection is not secured with TLS, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure applications to use TLS encryption to protect the confidentiality of remote access sessions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000068</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The documentation recommends deployments locate the application behind a TLS reverse proxy.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222397</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000015</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222397r960762_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000170</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must implement cryptographic mechanisms to protect the integrity of remote access sessions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without integrity protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\n\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\n\nEncryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection. Without integrity protection mechanisms, unauthorized individuals may be able to insert inauthentic content into a remote session. The encryption strength of mechanism is selected based on the security categorization of the information.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the system administrator.\n\nIdentify the application encryption capabilities and methods for implementing encryption protection.\n\nFor web based applications; open the web browser and access the website URL. Use the browser and determine if the session is protected via TLS. A secure connection is usually indicated in the upper left hand corner of the URL by a padlock icon. Click on the padlock icon and examine the connection information. Determine if TLS encryption is used to secure the session.\n\nFor non-web based applications, determine the TCP/IP port, protocol and method used for establishing client connections to the remote server. Review application configuration settings to ensure encryption is specified and  via TLS.\n\nIf the connection is not secured with TLS, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure applications to use TLS encryption to protect the integrity of remote access sessions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001453</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The documentation recommends deployments locate the application behind a TLS reverse proxy.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222398</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000015</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222398r960762_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000180</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications with SOAP messages requiring integrity must include the following message elements:-Message ID-Service Request-Timestamp-SAML Assertion (optionally included in messages) and all elements of the message must be digitally signed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Digitally signed SOAP messages provide message integrity and authenticity of the signer of the message independent of the transport layer. Service requests may be intercepted and changed in transit and the data integrity may be at risk if the SOAP message is not digitally signed.\n\nFunctional architecture aspects of the application security plan identify the application data elements that require data integrity protection.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation, system security plan, application architecture diagrams and interview the application administrator.\n\nReview the design document for web services using SOAP messages.\n\nIf the application does not utilize SOAP messages, this check is not applicable.\n\nReview the design document and SOAP messages.\nVerify the Message ID, Service Request, Timestamp, and SAML Assertion are included in the SOAP message.\nIf they are included, verify they are signed with a certificate.\n\nIf SOAP messages requiring integrity do not have the Message ID, Service Request, Timestamp, and SAML Assertion signed, or if any part of the message is not digitally signed, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to sign the following message elements for SOAP messages requiring integrity:\n\n- Message ID\n- Service Request\n- Timestamp\n- SAML Assertion\n- Message elements</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001453</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The SPA does not utilize SOAP messages.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222399</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000014</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222399r960759_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000190</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Messages protected with WS_Security must use time stamps with creation and expiration times.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The lack of time stamps could lead to the eventual replay of the message, leaving the application susceptible to replay events which may result in an immediate loss of confidentiality.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative for the design document. Review the design document for web services using WS-Security tokens.\n\nIf the application does not utilize WS-Security tokens, this check is not applicable.\n\nExamine the contents of a SOAP message using WS Security; all messages should contain time stamps, sequence numbers, and expiration.\n\nIf messages using WS Security do not contain time stamps, sequence numbers, and expiration, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure applications using WS-Security messages to use time stamps with creation and expiration times and sequence numbers.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000068</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The SPA does not utilize WS-Security tokens.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222400</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000014</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222400r960759_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000200</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Validity periods must be verified on all application messages using WS-Security or SAML assertions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When using WS-Security in SOAP messages, the application should check the validity of the time stamps with creation and expiration times. Time stamps that are not validated may lead to a replay event and provide immediate unauthorized access of the application. Unauthorized access results in an immediate loss of confidentiality.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative for the design document.\n\nReview the design document for web services.\n\nIf the application does not utilize WSS or SAML assertions, this requirement is not applicable.\n\nReview the design document and verify validity periods are checked on all messages using WS-Security or SAML assertions.\n\nIf the design document does not exist, or does not indicate validity periods are checked on messages using WS-Security or SAML assertions, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to use validity periods, ensure validity periods are verified on all WS-Security token profiles and SAML Assertions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000068</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The SPA does not utilize WSS or SAML assertions.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222401</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000014</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222401r960759_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000210</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must ensure each unique asserting party provides unique assertion ID references for each SAML assertion.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SAML is a standard for exchanging authentication and authorization data between security domains. SAML uses security tokens containing assertions to pass information about a principal (usually an end user) between a SAML authority, (identity provider), and a SAML consumer, (service provider). SAML assertions are usually made about a subject, (user) represented by the &lt;Subject&gt; element. SAML assertion identifiers should be unique across a system implementation. Duplicate SAML assertion identifiers could lead to unauthorized access to a web service.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative for the design document.\n\nReview the design document for web services using SAML assertions.\n\nIf the application does not utilize SAML assertions, this check is not applicable.\n\nReview the design document and verify SAML assertion identifiers are not reused by a single asserting party.\n\nIf the design document does not exist, or does not indicate SAML assertion identifiers which are unique for each asserting party, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure each SAML assertion authority to use unique assertion identifiers.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000068</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The SPA does not utilize SAML assertions.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222402</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000014</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222402r960759_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000220</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must ensure encrypted assertions, or equivalent confidentiality protections are used when assertion data is passed through an intermediary, and confidentiality of the assertion data is required when passing through the intermediary.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SAML is a standard for exchanging authentication and authorization data between security domains.  SAML uses security tokens containing assertions to pass information about a principal (usually an end user) between a SAML authority, (identity provider), and a SAML consumer, (service provider).  SAML assertions are usually made about a subject, (user) represented by the &lt;Subject&gt; element.   \n\nThe confidentially of the data in a message as the message is passed through an intermediary web service may be required to be restricted by the intermediary web service. The intermediary web service may leak or distribute the data contained in a message if not encrypted or protected.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative for the design document.\n\nReview the design document for web services using WS-Security tokens.  \n\nIf the application does not utilize WS-Security tokens, this check is not applicable.\n\nVerify all WS-Security tokens are transmitted via an approved encryption method.\n\nIf the design document does not exist, or does not indicate all WS-Security tokens are only transmitted via an approved encryption method, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Encrypt assertions or use equivalent confidentiality when sensitive assertion data is passed through an intermediary.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000068</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The SPA does not utilize WS-Security tokens</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222403</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000014</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222403r960759_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000230</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must use the NotOnOrAfter condition when using the SubjectConfirmation element in a SAML assertion.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SAML is a standard for exchanging authentication and authorization data between security domains.  SAML uses security tokens containing assertions to pass information about a principal (usually an end user) between a SAML authority, (identity provider), and a SAML consumer, (service provider).  SAML assertions are usually made about a subject, (user) represented by the &lt;Subject&gt; element.\n\nWhen a SAML assertion is used with a &lt;SubjectConfirmation&gt; element, a begin and end time for the &lt;SubjectConfirmation&gt; should be set to prevent reuse of the message at a later time. Not setting a specific time period for the &lt;SubjectConfirmation&gt;, may grant immediate access to an attacker and result in an immediate loss of confidentiality.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative for the design document.\n\nReview the design document for web services using SAML assertions.\n\nIf the application does not utilize SAML assertions, this check is not applicable.\n\nExamine the contents of a SOAP message using the &lt;SubjectConfirmation&gt; element. All messages should contain the &lt;NotOnOrAfter&gt; element. This can be accomplished if the application allows the ability to view XML messages or via a protocol analyzer like Wireshark.\n\nIf SOAP messages do not contain &lt;NotOnOrAfter&gt; elements, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to use the &lt;NotOnOrAfter&gt; condition when using the &lt;SubjectConfirmation&gt; element in a SAML assertion.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000068</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The SPA does not utilize SAML assertions.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222404</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000014</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222404r960759_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000240</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must use both the NotBefore and NotOnOrAfter elements or OneTimeUse element when using the Conditions element in a SAML assertion.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SAML is a standard for exchanging authentication and authorization data between security domains.  SAML uses security tokens containing assertions to pass information about a principal (usually an end user) between a SAML authority, (identity provider), and a SAML consumer, (service provider).  SAML assertions are usually made about a subject, (user) represented by the &lt;Subject&gt; element.\n\nWhen a SAML assertion is used with a &lt;Conditions&gt; element, a begin and end time for the &lt;Conditions&gt; element should be set in order to specify a timeframe in which the assertion is valid. Not setting a specific time period for the &lt;Conditions&gt; element, the possibility exists of granting immediate access or elevated privileges to an attacker which results in an immediate loss of confidentiality.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative for the design document.\n\nReview the design document for web services using SAML assertions.\n\nIf the application does not utilize SAML assertions, this check is not applicable.\n\nExamine the contents of a SOAP message using the &lt;Conditions&gt; element; all messages should contain the &lt;NotBefore&gt; and &lt;NotOnOrAfter&gt; or &lt;OneTimeUse&gt; element when in a SAML Assertion. This can be accomplished using a protocol analyzer such as Wireshark.\n\nIf SOAP using the &lt;Conditions&gt; element does not contain &lt;NotBefore&gt; and &lt;NotOnOrAfter&gt; or &lt;OneTimeUse&gt; elements, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to implement the use of the &lt;NotBefore&gt; and &lt;NotOnOrAfter&gt; or &lt;OneTimeUse&gt; when using the &lt;Conditions&gt; element in a SAML assertion.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000068</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The SPA does not utilize SAML assertions.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222405</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000014</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222405r960759_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000250</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must ensure if a OneTimeUse element is used in an assertion, there is only one of the same used in the Conditions element portion of an assertion.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Multiple &lt;OneTimeUse&gt; elements used in a SAML assertion can lead to elevation of privileges, if the application does not process SAML assertions correctly.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative for the design document.\n\nReview the design document for web services using SAML assertions.\n\nIf the application does not utilize SAML assertions, this check is not applicable.\n\nExamine the contents of a SOAP message using the OneTimeUse element; all messages should contain only one instance of a &lt;OneTimeUse&gt; element in a SAML assertion. This can be accomplished using a protocol analyzer such as Wireshark.\n\nIf SOAP message uses more than one, OneTimeUse element in a SAML assertion, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When using OneTimeUse elements in a SAML assertion only allow one, OneTimeUse element to be used in the conditions element of a SAML assertion.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000068</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The SPA does not utilize SAML assertions.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222406</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000014</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222406r960759_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000260</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must ensure messages are encrypted when the SessionIndex is tied to privacy data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When the SessionIndex is tied to privacy data (e.g., attributes containing privacy data) the message should be encrypted. If the message is not encrypted there is the possibility of compromise of privacy data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative for the design document.\n\nReview the design document for web services using SAML assertions.\n\nIf the application does not utilize SAML assertions, this check is not applicable.\n\nExamine the contents of a SOAP message using a SessionIndex in the SAML element AuthnStatement. Verify the information which is tied to the SessionIndex.\n\nIf the SessionIndex is tied to privacy information, and it is not encrypted, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Encrypt messages when the SessionIndex is tied to privacy data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000068</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The SPA does not utilize SAML assertions.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222407</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000023</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222407r1043176_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000280</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide automated mechanisms for supporting account management functions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Enterprise environments make application account management challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error.\n\nManual examples include but are not limited to admin staff logging into the system or systems and manually performing step by step actions affecting user accounts that could otherwise be automated.  This does not include any manual steps taken to initiate automated processes or the use of automated systems.\n\nA comprehensive application account management process that includes automation helps to ensure accounts designated as requiring attention are consistently and promptly addressed. Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended or terminated or by disabling accounts located in non-centralized account stores such as multiple servers. This requirement applies to all account types, including individual/user, shared, group, system, guest/anonymous, emergency, developer/manufacturer/vendor, temporary, and service.\n\nThe application must be configured to automatically provide account management functions and these functions must immediately enforce the organization&apos;s current account policy. The automated mechanisms may reside within the application itself or may be offered by the operating system or other infrastructure providing automated account management capabilities. Automated mechanisms may be comprised of differing technologies that when placed together contain an overall automated mechanism supporting an organization&apos;s automated account management requirements.\n\nAccount management functions include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to automatically notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephonic notification to report atypical system account usage.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify the account management methods, processes and procedures that are used.\n\nIf the application is utilizing a centralized authentication mechanism such as Active Directory or LDAP, verify all user account activity is conducted via that solution and no local user accounts that circumvent the automated solution are used.\n\nDetermine if automated mechanisms are used when managing application user accounts and taking management action on application user accounts. Automated methods include but are not limited to:\n\nTaking action on accounts that have been determined to be inactive, suspended, terminated, or disabled.\n\nAutomated action examples include: deleting such accounts, reactivating accounts in conjunction with a validation or verification process, or sending notifications or reminders to the account holders that their account is about to be disabled or deleted.\n\nVerify the action that is taken is automated and repeatable.\n\nIf the account management process is manual in nature, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use automated processes and mechanisms for account management functions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000015</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222408</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000317</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222408r1015683_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000290</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Shared/group account credentials must be terminated when members leave the group.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If shared/group account credentials are not terminated when individuals leave the group, the user that left the group can still gain access even though they are no longer authorized. A shared/group account credential is a shared form of authentication that allows multiple individuals to access the application using a single account. There may also be instances when specific user actions need to be performed on the information system without unique user identification or authentication. Examples of credentials include passwords and group membership certificates.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and determine if there is a requirement for shared or group accounts.\n\nIf there is no official requirement for shared or group application accounts, this requirement is Not Applicable.\n\nInterview the application representative and identify shared/group accounts.\n\nHave the application representative provide their procedures for account management as it pertains to group users.\n\nValidate there is a procedure for deleting either member accounts or the entire group account when member leave the group.\n\nIf there is no process for handling group account credentials, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Create a procedure for deleting either member accounts or the entire group account when members leave the group.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002142</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004045</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222409</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000024</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222409r960771_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000300</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must automatically remove or disable temporary user accounts 72 hours after account creation.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation.\n\nTemporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation.\n\nIf temporary accounts are used, the application must be configured to automatically terminate these types of accounts after a DoD-defined time period of 72 hours starting from the point of account creation.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access mechanisms meeting or exceeding access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If official documentation exist that disallows the use of temporary user accounts within the application, this requirement is not applicable.\n\nExamine the application documentation or interview the application representative to identify how the application users are managed.\n\nNavigate to the screen where user accounts are configured.\n\nCreate a test account and determine if there is a setting to specify the user account as being temporary in nature.\n\nDetermine if there is an available setting to expire the account after a period of time.\n\nIf the application has no ability to specify a user account as being temporary in nature, or if the account has no ability to automatically disable or remove the account after 72 hours after account creation, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure temporary accounts to be automatically removed or disabled after 72 hours after account creation.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000016</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222410</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222410r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000310</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must have a process, feature or function that prevents removal or disabling of emergency accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Emergency accounts are administrator accounts which are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes.\n\nIf these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability.\n\nEmergency accounts are different from infrequently used accounts (i.e., local logon accounts used by system administrators when network or normal logon/access is not available). Infrequently used accounts also remain available and are not subject to automatic termination dates. However, an emergency account is normally a different account which is created for use by vendors or system maintainers.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator. Identify if emergency accounts are ever used. \n\nIf emergency accounts are not used, this requirement is not applicable.\n\nIf emergency accounts are used, validate a procedure, process, feature or function exists that will prevent the emergency account from being deleted or disabled during a crisis situation.\n\nExamples include but are not limited to adding a flag to the account to ensure it is not deleted during a specified emergency period or placing the account in a designated group that is monitored and controlled in accordance with the crisis.\n\nIf a process, procedure, function or feature designed to prevent emergency accounts from being  deleted or disabled during a crisis situation is not available, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Identify accounts that are created in an emergency situation and ensure procedures or processes are in place to prevent disabling or deleting the account while the emergency is underway.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000366</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222411</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222411r960774_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000320</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must automatically disable accounts after a 35 day period of account inactivity.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Attackers that are able to exploit an inactive account can potentially obtain and maintain undetected access to an application. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Applications need to track periods of user inactivity and disable accounts after 35 days of inactivity. Such a process greatly reduces the risk that accounts will be hijacked, leading to a data compromise.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.\n\nThis policy does not apply to either emergency accounts or infrequently used accounts. Infrequently used accounts are local logon administrator accounts used by system administrators when network or normal logon/access is not available. Emergency accounts are administrator accounts created in response to crisis situations.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Examine the application documentation or interview the application representative to identify how the application users are managed.\n\nInterview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory (AD) for user management or if the application manages user accounts within the application.\n\nIf the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable.\n\nIf the application handles the management tasks for user accounts, access the applications user management utility.\n\nNavigate to the screen where user accounts are configured to be disabled after 35 days of inactivity.\n\nConfirm this setting is active.\n\nIf the application is not set to expire inactive accounts after 35 days, or if the application has no ability to expire accounts after 35 days of inactivity, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to expire user accounts after 35 days of inactivity.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000017</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222412</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222412r960774_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000330</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Unnecessary application accounts must be disabled, or deleted.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Test or demonstration accounts are sometimes created during the application installation process. This creates a security risk as these accounts often remain after the initial installation process and can be used to gain unauthorized access to the application. Applications must be designed and configured to disable or delete any unnecessary accounts that may be created. \n\nCare must be taken to ensure valid accounts used for valid application operations are not disabled or deleted when this requirement is applied.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and identify any valid application accounts that are required in order for the application to operate. Accounts the application itself uses in order to function are not in scope for this requirement.\n\nHave the application administrator generate a list of all application users. This should include relevant user metadata such as phone numbers or department identifiers.\n\nHave the application administrator identify and validate all user accounts.\n\nIf any accounts cannot be validated and are deemed to be unnecessary, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design the application so unessential user accounts are not created during installation. Disable or delete all unnecessary application user accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000017</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222413</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000026</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222413r960777_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000340</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must automatically audit account creation.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Once an attacker establishes initial access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Auditing of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail documents the creation of application user accounts and, as required, notifies administrators and/or application owners exists. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms meeting or exceeding access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Examine the application documentation to identify how the application users are managed.\n\nInterview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application.\n\nIf the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable.\n\nIdentify the location of the audit logs and review the end of the logs.\n\nAccess the user account management functionality and create a new user account.\n\nExamine the log file again and determine if the account creation event was logged. The information logged should, at a minimum, include enough detail to determine which account was created and when.\n\nIf the account creation event was not logged, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to write a log entry when a new user account is created.\n\nAt a minimum, ensure account name, date and time of the event are recorded.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000018</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222414</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000027</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222414r960780_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000350</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must automatically audit account modification.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>One way for an attacker to establish persistent access is for the attacker to modify or copy an existing account. Auditing of account modification is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail documents the modification of application user accounts. Such a process greatly reduces the risk that accounts will be surreptitiously modified and provides logging that can be used for forensic purposes.\n\nTo address account requirements and to ensure application accounts follow requirements consistently, application developers are strongly encouraged to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Examine the application documentation to identify how the application users are managed.\n\nInterview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application.\n\nIf the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable.\n\nIdentify the location of the audit logs and review the end of the logs.\n\nAccess the user account management functionality and modify a test user account.\n\nExamine the log file again and determine if the account event was logged. The information logged should, at a minimum, include enough detail to determine which account was modified and when.\n\nIf the account modification event information was not logged, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to write a log entry when a user account is modified.\n\nAt a minimum, ensure account name, date and time of the event are recorded.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001403</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222415</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000028</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222415r960783_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000360</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must automatically audit account disabling actions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When application accounts are disabled, user accessibility is affected. Accounts are utilized for identifying individual application users or for identifying the application processes themselves. In order to detect and respond to events affecting user accessibility and application processing, applications must audit account disabling actions and, as required, notify the appropriate individuals, so they can investigate the event. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and provides logging that can be used for forensic purposes. \n\nApplication developers are encouraged to integrate their applications with enterprise-level authentication/access/audit mechanisms such as Syslog, Active Directory or LDAP.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Examine the application documentation to identify how the application users are managed.\n\nInterview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application.\n\nIf the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable.\n\nIdentify the location of the audit logs and review the end of the logs.\n\nAccess the user account management functionality and disable a test user account.\n\nExamine the log file again and determine if the account disable event was logged. The information logged should, at a minimum, include enough detail to determine which account was disabled and when.\n\nIf the account disabling event information was not logged, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to write a log entry when a user account is disabled.\n\nAt a minimum, ensure account name, date and time of the event are recorded.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001404</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222416</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000029</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222416r960786_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000370</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must automatically audit account removal actions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When application accounts are removed, user accessibility is affected. Accounts are utilized for identifying individual application users or for identifying the application processes themselves. In order to detect and respond to events affecting user accessibility and application processing, applications must audit account removal actions and, as required, notify the appropriate individuals, so they can investigate the event. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and provides logging that can be used for forensic purposes.\n\nApplication developers are encouraged to integrate their applications with enterprise-level authentication/access/audit mechanisms such as Syslog, Active Directory or LDAP.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Examine the application documentation to identify how the application users are managed.\n\nInterview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application.\n\nIf the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable.\n\nIdentify the location of the audit logs and review the end of the logs.\n\nAccess the user account management functionality and remove a test user account.\n\nExamine the log file again and determine if the account removal event was logged. The information logged should, at a minimum, include enough detail to determine which account was disabled and when.\n\nIf the account removal event information was not logged, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to write a log entry when a user account is removed.\n\nAt a minimum, ensure account name, date and time of the event are recorded.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001405</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222417</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000291</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222417r1015684_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000380</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are created.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Notification of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the creation of application user accounts and notifies administrators and ISSOs such accounts exist. This type of process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to offload those access control functions and focus on core application features and functionality.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application and system documentation.\n\nInterview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application.\n\nIf the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is Not Applicable.\n\nEnsure the application is configured to notify SAs when new accounts are created by identifying SAs who will be notified, creating a test account, and checking with SAs to verify the notification was received.\n\nIf SAs and ISSOs are not notified when accounts are created, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to notify the SA and the ISSO when application accounts are created.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000015</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001683</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222418</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000292</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222418r1015685_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000390</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are modified.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Notification of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the modification of application user accounts and notifies administrators and ISSOs such accounts were modified. This type of process greatly reduces the risk that accounts will be surreptitiously modified and provides logging that can be used for forensic purposes.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to offload those access control functions and focus on core application features and functionality.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application and system documentation.\n\nInterview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application.\n\nIf the application is configured to use an enterprise-based application user management capability that is STIG compliant, this requirement is Not Applicable.\n\nEnsure the application is configured to notify SAs when accounts are modified by identifying the SAs who will be notified when accounts are modified.\n\nModify a test account and check with a SA to verify the notification was received.\n\nIf SAs and ISSOs are not notified when accounts are modified, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to notify the SA and the ISSO when application accounts are modified.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000015</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001684</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222419</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000293</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222419r1015686_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000400</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must notify system administrators (SAs) and information system security officers (ISSOs) of account disabling actions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Notification of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the creation of application user accounts and notifies administrators and ISSOs such accounts exist. This type of process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to offload those access control functions and focus on core application features and functionality.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application and system documentation.\n\nInterview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application.\n\nIf the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is Not Applicable.\n\nEnsure the application is configured to notify SAs when accounts are disabled by identifying the SAs who will be notified when accounts are disabled.\n\nDisable a test account and check with a SA to verify the notification was received.\n\nIf SAs and ISSOs are not notified when accounts are disabled, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to notify the SA and the ISSO when application accounts are disabled.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000015</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001685</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222420</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000294</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222420r1015687_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000410</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must notify system administrators (SAs) and information system security officers (ISSOs) of account removal actions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to remove an account. Notification of account removal is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the removal of application user accounts and notifies administrators and ISSOs such accounts no longer exist. This type of process greatly reduces the risk that accounts will be surreptitiously removed and provides logging that can be used for forensic purposes.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to offload those access control functions and focus on core application features and functionality.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application and system documentation.\n\nInterview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application.\n\nIf the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is Not Applicable.\n\nEnsure the application is configured to notify SAs when accounts are removed by identifying the SAs who will be notified when accounts are removed.\n\nRemove a test account and check with a SA to verify the notification was received.\n\nIf SAs and ISSOs are not notified when accounts are removed, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to notify the SA and the ISSO when application accounts are removed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000015</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001686</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222421</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000319</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222421r961290_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000420</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must automatically audit account enabling actions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When application accounts are enabled, user accessibility is affected. Accounts are utilized for identifying individual application users or for identifying the application processes themselves. In order to detect and respond to events affecting user accessibility and application processing, applications must audit account removal actions and, as required, notify the appropriate individuals, so they can investigate the event. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and provides logging that can be used for forensic purposes.\n\nApplication developers are encouraged to integrate their applications with enterprise-level authentication/access/audit mechanisms such as Syslog, Active Directory or LDAP.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Examine the application documentation or interview the application representative to identify how the application users are managed.\n\nInterview the application administrator and determine if the application is configured to utilize a centralized user management system such as Active Directory for user management or if the application manages user accounts within the application.\n\nIf the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable.\n\nIdentify the location of the audit logs and review the end of the logs.\n\nAccess the user account management functionality and enable a test user account.\n\nExamine the log file again and determine if the account enable event was logged. The information logged should, at a minimum, include enough detail to determine which account was enabled and when.\n\nIf the account enabling event information was not logged, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to write a log entry when a user account is enabled. \n\nAt a minimum, ensure account name, date and time of the event are recorded.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002130</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider..</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222422</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000320</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222422r1015688_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000430</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must notify system administrators (SAs) and information system security officers (ISSOs) of account enabling actions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to enable an account. Notification of account enabling is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the enabling of application user accounts and notifies administrators and ISSOs such accounts exist. This type of process greatly reduces the risk that accounts will be surreptitiously enabled and provides logging that can be used for forensic purposes.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to offload those access control functions and focus on core application features and functionality.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application and system documentation.\n\nInterview application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application.\n\nIf the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is Not Applicable.\n\nEnsure the application is configured to notify SAs when accounts are enabled by identifying the SAs who will be notified when accounts are enabled.\n\nDisable and then enable a test account and check with the SA to verify the notification was received to indicate the account was enabled.\n\nIf SAs and ISSOs are not notified when accounts are enabled, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to notify the SA and the ISSO when application accounts are enabled.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000015</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002132</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account Management services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222423</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000323</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222423r961302_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000440</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application data protection requirements must be identified and documented.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Failure to protect organizational information from data mining may result in a compromise of information. In order to assign the appropriate data protections, application data must be identified and then protection requirements assigned. Access to sensitive data and sensitive data objects should be restricted to those authorized to access the data.\n\nExamples of sensitive data include but are not limited to; Social Security Numbers, Personally Identifiable Information, or any other data that is has been identified as being sensitive in nature by the data owner.\n\nData storage objects include, for example, databases, database records, and database fields.\n\nData mining prevention and detection techniques include, for example: limiting the types of responses provided to database queries; limiting the number/frequency of database queries to increase the work factor needed to determine the contents of such databases; and notifying organizational personnel when atypical database queries or accesses occur.\n\nProtection methods include but are not limited to data encryption, Role-Based Access Controls and access authentication.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative for the documentation that identifies the application data elements, the protection requirements, and any associated steps that are being taken to protect the data.\n\nIf the application data protection requirements are not documented, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Identify and document the application data elements and the data protection requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002346</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The project provides documentation describing its data structures and protection methods, including RBAC and other access controls. These concepts are also expressed and enforced by its use of an appropriate OAS definition.  All app data is persisted in a deployment-provided database that must be configured in accordance with organization requirements.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222424</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000324</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222424r961305_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000450</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must utilize organization-defined data mining detection techniques for organization-defined data storage objects to adequately detect data mining attempts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Failure to protect organizational information from data mining may result in a compromise of information.\n\nData mining occurs when the application is programmatically probed and data is automatically extracted. While there are valid uses for data mining within data sets, the organization should be mindful that adversaries may attempt to use data mining capabilities built into the application in order to completely extract application data so it can be evaluated using methods that are not natively offered by the application. This can provide the adversary with an opportunity to utilize inference attacks or obtain additional insights that might not have been intended when the application was designed.\n\nMethods of extraction include database queries or screen scrapes using the application itself. The entity performing the data mining must have access to the application in order to extract the data. Data mining attacks will usually occur with publicly releasable data access but can also occur when access is limited to authorized or authenticated inside users.\n\nData storage objects include, for example, databases, database records, and database fields.\n\nData mining prevention and detection techniques include, for example: limiting the types of responses provided to database queries; limiting the number/frequency of database queries to increase the work factor needed to determine the contents of such databases; and notifying organizational personnel when atypical database queries or accesses occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the security plan, application and system documentation and interview the application administrator to identify data mining protections that are required of the application.\n\nIf there are no data mining protections required, this requirement is not applicable.\n\nReview the application authentication requirements and permissions.\n\nReview documented protections that have been established to protect from data mining.\n\nThis can include limiting the number of queries allowed.\n\nAutomated alarming on atypical query events.\n\nLimiting the number of records allowed to be returned in a query.\n\nNot allowing data dumps.\n\nIf the application requirements specify protections for data mining and the application administrator is unable to identify or demonstrate that the protections are in place, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Utilize and implement data mining protections when requirements specify it.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002347</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Data mining detection and prevention are to be implemented at the Log Analysis layer, Ingress controller, or elsewhere.  No data mining protection requirements apply to application itself.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222425</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000033</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222425r960792_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000460</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., networks, web servers, and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. \n\nSuccessful authentication must not automatically give an entity access to a restricted asset or security boundary.\n\nAuthorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization.\n\nAuthorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset.\n\nInformation systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include identity-based policies, role-based policies, and attribute-based policies.\n\nAccess enforcement mechanisms include access control lists, access control matrices, and cryptography.\n\nThese policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.\n\nThis requirement is applicable to access control enforcement applications (e.g., authentication servers) and other applications that perform information and system access control functions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nReview application data protection requirements.\n\nIdentify application resources that require protection and authentication over and above the authentication required to access the application itself.\n\nThis can be access to a URL, a folder, a file, a process or a database record that should only be available to certain individuals.\n\nIdentify the access control methods utilized by the application in order to control access to the resource.\n\nExamples include Role-Based Access Control policies (RBAC).\n\nUsing RBAC as an example, utilize a test account placed into a test role.\n\nSet a protection control on a resource and explicitly deny access to the role assigned to the test user account.\n\nTry to access an application resource that is not configured to allow access. Access should be denied.\n\nIf the enforcement of configured access restrictions is not performed, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design or configure the application to enforce access to application resources.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000213</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API ensures proper access to application resources in accordance with Role-Based Access Control (RBAC) and Discretionary Access Control (DAC) mechanisms at the application and Collection levels. No direct database access is provided by the application. See documentation.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222426</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000328</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222426r961317_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000470</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must enforce organization-defined discretionary access control policies over defined subjects and objects.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Discretionary Access Control allows users to determine who is allowed to access their data. To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., networks, web servers, and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.\n\nThis requirement is applicable to access control enforcement applications (e.g., authentication servers) and other applications that perform information and system access control functions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nReview application data protection requirements and application integrated access control methods.\n\nIdentify if the application implements discretionary access control to application resources. Discretionary Access Controls (DAC) allows application users to determine and set permissions on application data and application objects. The result is the user is given the ability to control who has access to the data they control.\n\nIf the application does not implement discretionary access controls, this requirement is not applicable.\n\nResources can be a URL, a folder, a file, a process, a database record, or any other application asset that warrants sharing or authorization permission reassignment.\n\nCreate 3 test accounts.\n\nUsing test account 1 set protection control on a test user 1 controlled resource.\n\nGrant access to test user 2 and only test user 2.\n\nAuthenticate as test user 3 and attempt to access the application resource where test user 1 and test user 2 are granted access. Access should be denied.\n\nIf the enforcement of configured access restrictions is not performed, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to enforce discretionary access control policies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002165</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API ensures proper access to application resources in accordance with Role-Based Access Control (RBAC) and Discretionary Access Control (DAC) mechanisms at the application and Collection levels. No direct database access is provided by the application. See documentation.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222427</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000038</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222427r960801_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000480</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A mechanism to detect and prevent unauthorized communication flow must be configured or provided as part of the system design. If information flow is not enforced based on approved authorizations, the system may become compromised. Information flow control regulates where information is allowed to travel within a system and between interconnected systems. The flow of all system information must be monitored and controlled so it does not introduce any unacceptable risk to the systems or data.\n\nApplication specific examples of enforcement occurs in systems that employ rule sets or establish configuration settings that restrict information system services, or message-filtering capability based on message content (e.g., implementing key word searches or using document characteristics).\n\nThis is usually established by identifying if there are rulesets, policies or other configurations settings provided by the application which serve to control the flow of information within the system. Control of data flow is established by using labels on data and data subsets, evaluating the destination of the data within or without the system (similar security domain) and referencing a corresponding policy that is used to control the flow of data.\n\nApplications providing information flow control must be able to enforce approved authorizations for controlling the flow of information within the system in accordance with applicable policy.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application and system administrators.\n\nReview application features and functions to determine if the application is designed to control the flow of information within the system.\nIdentify:\n\n- rulesets,\n- data labels, and\n- policies\n\nto determine if the application is designed to control the flow of data within the system.\n\nIf the application does not provide data flow control capabilities, the requirement is not applicable.\n\nAccess the system as a user with access rights that allow the creation of test data or use of existing test data.\n\nCreate a test data set and label the data with a data label provided with or by the application, e.g., Personally Identifiable Information (PII) data.\n\nReview the policy to determine where in the system the PII labeled data is allowed and is not allowed to go.\n\nUsing application features and functions, attempt to transmit the labeled data to an area that is prohibited by policy.\n\nVerify the flow control policy was enforced and the data was not transmitted.\n\nIf the application does not enforce the approved authorizations for controlling data flow, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to enforce data flow control in accordance with data flow control policies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001368</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The application does not provide data flow control capabilities, the requirement is not applicable.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222428</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000039</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222428r960804_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000490</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must enforce approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A mechanism to detect and prevent unauthorized communication flow must be configured or provided as part of the system design. If information flow is not enforced based on approved authorizations, the system may become compromised. Information flow control regulates where information is allowed to travel within a system and between interconnected systems. The flow of all system information must be monitored and controlled so it does not introduce any unacceptable risk to the systems or data.\n\nApplication specific examples of enforcement occurs in systems that employ rule sets or establish configuration settings that restrict information system services, or message-filtering capability based on message content (e.g., implementing key word searches or using document characteristics).\n\nThis is usually established by identifying if there are rulesets, policies or other configurations settings provided by the application which serve to control the flow of information within the system. Control of data flow is established by using labels on data and data subsets, evaluating the destination of the data within or without the system (similar security domain) and referencing a corresponding policy that is used to control the flow of data.\n\nApplications providing information flow control must be able to enforce approved authorizations for controlling the flow of information within the system in accordance with applicable policy.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application and system administrators.\n\nIdentify application features and functions to determine if the application is designed to control the flow of information between interconnected systems.\n\nIdentify:\n\n- rulesets,\n- data labels\n- policies\n- systems\n\nto determine if the application is designed to control the flow of data between interconnected systems.\n\nIf the application does not provide data flow control capabilities, the requirement is not applicable.\n\nAccess the system as a user with access rights allowing the creation of test data or use of existing test data.\n\nCreate a test data set and label the data with a data label provided with or by the application (for example, a Personally Identifiable Information (PII) data label).\n\nReview the policy settings to determine where the PII labeled data is allowed and is not allowed.\n\nUsing application features and functions, attempt to transmit the labeled data to an interconnected system that is prohibited by policy.\n\nVerify the flow control policy was enforced and the data was not transmitted.\n\nIf the application does not enforce the approved authorizations for controlling data flow, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to enforce data flow control in accordance with data flow control policies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001414</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The application does not provide data flow control capabilities, the requirement is not applicable.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222429</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000340</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222429r961353_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000500</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Identify the application user account(s) that the application uses to run. These accounts include the application processes (defined by Control Panel Services (Windows) or ps –ef (UNIX)) or for an n-tier application, the account that connects from one service (such as a web server) to another (such as a database server).\n\nDetermine the OS user groups in which each account is a member.\n\nList the user rights assigned to these users and groups and evaluate whether any of them are unnecessary.\n\nIf the OS rights exceed application operational requirements, this is a finding.\n\nIf the application user account is a member of the Administrators group (Windows) or has a User Identification (UID) of 0 (i.e., is equivalent to root in UNIX), this is a finding.\n\nSearch the file system to determine if the application user or groups have ownership or permissions to any files or directories.\n\nReview the list of files and identify any that are outside the scope of the application.\n\nIf there are such files outside the scope of the application, this is a finding.\n\nCheck ownership and permissions; identify permissions beyond the minimum necessary to support the application.\n\nIf there are instances of unnecessary ownership or permissions, this is a finding.\n\nThe finding details should note the full path of the file(s) and the associated issue (i.e., outside scope, permissions improperly granted to user X, etc.).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Modify the application to limit access and prevent the disabling or circumvention of security safeguards.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002235</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The Project publishes container images configured to execute the API as the unprivileged user, &apos;node&apos; whose userId is not 0.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222430</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000342</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222430r961359_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000510</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must execute without excessive account permissions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications are often designed to utilize a user account.  The account represents a means to control application permissions and access to OS resources, application resources or both.  \n\nWhen the application is designed and installed, care must be taken not to assign excessive permissions to the user account that is used by the application.  \n\nAn application operating with unnecessary privileges can potentially give an attacker access to the underlying operating system or if the privileges required for application execution are at a higher level than the privileges assigned to organizational users invoking such applications/programs, those users are indirectly provided with greater privileges than assigned by organizations.\n\nApplications must be designed and configured to operate with only those permissions that are required for proper operation.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation or interview the application representative and identify if the application utilizes an account in order to operate.\n\nDetermine the OS user groups in which each application account is a member.  List the user rights assigned to these users and groups using relevant OS commands and evaluate whether any of them provide admin rights or if they are unnecessary or excessive. \n\nIf the application connects to a database, open an admin console to the database and view the database users, their roles and group rights.\n\nLocate the application user account used to access the database and examine the accounts privileges. This includes group privileges.\n\nIf the application user account has excessive OS privileges such as being in the admin group, database privileges such as being in the DBA role, has the ability to create, drop, alter the database (not application database tables), or if the application user account has other excessive or undefined system privileges, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application accounts with minimalist privileges. Do not allow the application to operate with admin credentials.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002233</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The project supplied container images are configured to run by the limited, unprivileged user, &apos;node&apos;.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222431</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000343</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222431r961362_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000520</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must audit the execution of privileged functions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse, and identify the risk from insider threats and the advanced persistent threat.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Log on to the application as an administrative user.\n\nIdentify functionality within the application that requires utilizing the admin role.\n\nMonitor application logs while performing privileged functions within the application.\n\nPerform administrative types of tasks such as adding or modifying user accounts, modifying application configuration, or managing encryption keys.\n\nReview logs for entries that indicate the administrative actions performed were logged.\n\nEnsure the specific action taken, date and time or event is recorded.\n\nIf the execution of privileged functionality is not logged, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to write log entries when privileged functions are executed. At a minimum, ensure the specific action taken, date and time of event are recorded.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002234</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API emits audit records for privileged functions that document the specific endpoint invoked, the date and time, and all path and query parameters.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222432</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000065</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222432r960840_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000530</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced.\n\nLimits are imposed by locking the account.\n\nUser notification when three failed logon attempts are exceeded is an operational consideration determined by the application owner. In some instances the operational situation may dictate that no notice is to be provided to the user when their account is locked. In other situations, the user may be notified their account is now locked. This decision is left to the application owner based upon their operational scenarios.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>All testing must be performed within a 15-minute window.\n\nLog on to the application with a test user account.\n\nIntentionally enter an incorrect user password or pin.\n\nRepeat 2 times within 15 minutes for a total of three failed attempts.\n\nNotification of a locked account may or may not be provided.\n\nUsing the correct user password or pin, attempt to logon a 4th time.\n\nIf the logon is successful upon the 4th attempt the account was not locked after the third failed attempt and this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to enforce an account lock after 3 failed logon attempts occurring within a 15-minute window.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000044</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>User Account services are provided by a external OIDC Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222433</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000345</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222433r961368_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000540</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application administrator must follow an approved process to unlock locked user accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Once a user account has been locked, it must be unlocked by an administrator.\n\nAn ISSM and ISSO approved process must be created and followed to ensure the user requesting access is properly authenticated prior to access being re-established.\n\nThe process must include having the user provide information only the user would know and having the administrator verify the accuracy of the information prior to unlocking the account. This means having the user provide this information when their account is created so the information can be referenced when they are locked out.    \n\nThe process utilized may be manual in nature, however it is recognized that password resets are a time consuming task. To minimize helpdesk resource constraints related to user lockout requests, procedures may be automated by administrators in order to unlock the account or reset the password.  \n\nAuthentication process examples include having the user provide personal information known only by the user and provided when the account was created and/or using Out-of-Band or side channel communication methods such as text messages to the users established cell phone number in order to provide a temporary password or token that can be used to logon once and reset the password.\n\nThe OWASP site provides an acceptable password reset process that can be used as a reference.  https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet.  \n\nAutomated procedures should follow industry standards and best practice for securely automating password reset/account unlocks and must be reviewed, tested, and then approved by the ISSM and ISSO.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the application administrator and identify the approved process for unlocking user accounts.\n\nThe process may involve a manual or automated reset after the locked out user has identified themselves using standard user identification processes outlined in the vulnerability discussion.\n\nIf the admin does not unlock the account following the approved process, and if the process does not have documented ISSO and ISSM approvals, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Create a standard approved process for unlocking locked application accounts which includes validating user identity prior to unlocking the account.\n\nUse that process when unlocking application user accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002238</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>User Account services are provided by a external OIDC Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222434</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000068</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222434r960843_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000550</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Display of the DoD-approved use notification before granting access to the application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\n\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\n\nThe banner must be formatted in accordance with DTM-08-060. Use the following verbiage for applications that can accommodate banners of 1300 characters:\n\n&quot;You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.&quot;\n\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\n\n&quot;I&apos;ve read &amp; consent to terms in IS user agreem&apos;t.&quot;</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application has no interactive user interface, this requirement is not applicable.\n\nLog on to the application as a user.\n\nObserve the screen and ensure the DoD-approved banner is displayed prior to obtaining access to the application. Refer to the vulnerability discussion for the approved text.\n\nIf the only way to access the application is through the OS console, e.g., a fat client application installed on a GFE desktop or laptop, and that GFE is configured to display the DoD banner, an additional banner is not required at the application level.\n\nIf the standard DoD-approved banner is not displayed prior to obtaining access, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to present the standard DoD-approved banner prior to granting access to the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000048</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The Standard Mandatory DoD Notice and Consent Banner can be displayed by the external OIDC Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222435</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000069</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222435r960846_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000560</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The banner must be acknowledged by the user prior to allowing the user access to the application. This provides assurance that the user has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the user, DoD will not be in compliance with system use notifications required by law.\n\nTo establish acceptance of the application usage policy, a click-through banner at application logon is required. The application must prevent further activity until the user executes a positive action to manifest agreement by clicking on a box indicating &quot;OK&quot;.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application has no interactive user interface, this requirement is not applicable.\n\nIf the user interface is only available via the OS console, e.g., a fat client application installed on a GFE desktop or laptop, and that GFE is configured to display the DoD banner, this requirement is not applicable.\n\nAccess the application and authenticate if necessary. Verify the banner is displayed and action must be taken to accept terms of use.\n\nIf the banner is not displayed or no action must be taken to accept terms of use, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to retain the standard DoD-approved banner until the user accepts the usage conditions prior to granting access to the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000050</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Standard Mandatory DoD Notice and Consent Banner services are provided by a external OIDC Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222436</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000070</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222436r960849_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000570</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The publicly accessible application must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Display of a standardized and approved use notification before granting access to the publicly accessible application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\n\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\n\nThe banner must be formatted in accordance with DTM-08-060. Use the following verbiage for desktops, laptops, and other devices accommodating banners of 1300 characters:\n\n&quot;You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.&quot;\n\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\n\n&quot;I&apos;ve read &amp; consent to terms in IS user agreem&apos;t.&quot;</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>This requirement only applies to publicly accessible applications. If the application is not publicly accessible, this requirement is not applicable.\n\nAccess the application and observe the screen to ensure the DoD-approved banner is displayed prior to obtaining full access to the application. Refer to the vulnerability discussion for the approved banner text.\n\nIf the standard DoD-approved banner is not displayed prior to obtaining access, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to present the standard DoD-approved banner prior to granting access to the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001384</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001385</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001386</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001387</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001388</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Standard Mandatory DoD Notice and Consent Banner services are provided by a external OIDC Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222437</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000075</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222437r987626_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000580</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must display the time and date of the users last successful logon.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Providing a last successful logon date and time stamp notification to the user when they authenticate and access the application allows the user to determine if their application account has been used without their knowledge. \n\nArmed with that information, the user can notify the application administrator and initiate a forensics investigation to identify root cause.  Without providing this information to the user, a potential compromise of user accounts could go unnoticed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIf the application does not provide a user interface, this requirement is not applicable.\n\nLogon to the application as a test user and verify successful authentication by creating test data, navigating the application functionality or otherwise utilizing the application.\n\nNote the date and time access was granted.\n\nLog out of the application.\n\nRe-authenticate to the application as the same user.\n\nValidate the last logon date and time is displayed in the user interface. \n\nIf the date and time the user account was last granted access to the application is not displayed in the user interface, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to display the date and time when the user was last successfully granted access to the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000052</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>User Session services are provided by a external OIDC Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222438</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000080</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222438r960864_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000590</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without non-repudiation, it is impossible to positively attribute an action to an individual (or process acting on behalf of an individual).\n\nNon-repudiation services can be used to determine if information originated from a particular individual, or if an individual took specific actions (e.g., sending an email, signing a contract, approving a procurement request) or received specific information. Non-repudiation protects individuals against later claims by an author of not having authored a particular document, a sender of not having transmitted a message, a receiver of not having received a message, or a signatory of not having signed a document. The application will be configured to provide non-repudiation services for an organization-defined set of commands that are used by the user (or processes action on behalf of the user).\n\nDoD PKI provides for non-repudiation through the use of digital signatures. Non-repudiation requirements will vary from one application to another and will be defined based on application functionality, data sensitivity, and mission requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation, the design requirements if available and interview the application administrator.\n\nIdentify application services or application commands that are formerly required and designed to provide non-repudiation services (e.g., digital signatures).  \n\nIf the application documentation specifically states that non-repudiation services for application users are not defined as part of the application design, this requirement is not applicable.  \n\nEmail is one example of an application specifically required to provide non-repudiation services for application users within the DoD. \n\nInterview the application administrators and have them describe which aspect of the application, if any, is required to provide digital signatures.\n\nAccess the application as a test user or observe the application administrator as they demonstrate the applications signature capabilities.\n\nIf the application is required to provide non-repudiation services and does not, or if the non-repudiation functionality fails on demonstration, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to provide users with a non-repudiation function in the form of digital signatures when it is required by the organization or by the application design and architecture.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000166</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>STIG Manager does not have any non-repudiation requirements as part of its design.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222439</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000086</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222439r960873_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000600</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>For applications providing audit record aggregation, the application must compile audit records from organization-defined information system components into a system-wide audit trail that is time-correlated with an organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without the ability to collate records based on the time when the events occurred, the ability to perform forensic analysis and investigations across multiple components is significantly degraded.\n\nAudit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organization-defined level of tolerance.\n\nThis requirement applies to applications which provide the capability to compile system-wide audit records for multiple systems or system components. However, all applications must provide the relevant log details that are used to aggregate the information.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nDetermine if the application has the ability to compile audit records from multiple systems or system components.\n\nIf the application does not provide log aggregation services, this requirement is not applicable.\n\nIdentify the systems that comprise the application.\n\nAccess each system comprising the application or a random sample of several application systems. Review the application logs and obtain date and time stamps for several random audit events. Record the information.\n\nAccess the server providing the log aggregation. Access the application logs that have been written to the server and compare the samples obtained from the application systems to the aggregated logs. Ensure the dates and time stamps correlate with one another.\n\nIf the log dates and times do not correlate when the logs are aggregated, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to correlate time stamps when aggregating audit records.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000174</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>STIG Manager does not offer log aggregation services. This is expected to be implemented by specific deployments at the Log Analysis level.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222441</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000089</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222441r960879_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000620</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide audit record generation capability for the creation of session IDs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications create session IDs at the onset of a user session in order to manage user access to the application and differentiate between different user sessions. It is important to log the creation of these session ID creation events for forensic purposes.\n\nIt is equally important to not log the session ID itself. Logging the session ID puts active sessions at risk if log data is compromised. Specific session ID information should be removed, masked, sanitized, or encrypted.\n\nA hash value of the session ID that can be mapped to the session ID is an acceptable method for assuring active session protection when logging session ID information. Alternatively, logging protections that protect the logs and defend from unauthorized access are means to assure log confidentiality and protect session integrity.\n\nWeb based applications will often utilize an application server that creates, manages and logs user session IDs.  It is acceptable for the application to delegate this requirement to the application server.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Access the management interface for the application or configuration file and evaluate the log/audit management settings.\n\nDetermine if the setting that enables session ID creation event auditing is activated.\n\nCreate a new user session by logging in to the application.\n\nReview the logs to ensure the session creation event was recorded.\n\nIf the application is not configured to log session ID creation events, or if no creation event was recorded, this is a finding.\n\nIf a web-based application delegates session ID creation to an application server, this is not a finding. \n\nIf the application generates session ID creation event logs by default, and that behavior cannot be disabled, this is not a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Enable session ID creation event auditing.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000169</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web app delegates these duties to an OIDC Provider. The OpenID Connect (OIDC) Provider creates, manages and logs user session data.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222442</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000089</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222442r960879_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000630</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide audit record generation capability for the destruction of session IDs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications should destroy session IDs at the end of a user session in order to terminate user access to the application session and to reduce the possibility of an unauthorized attacker high jacking the session and impersonating the user. It is important to log when session IDs are destroyed for forensic purposes.\n\nWeb based applications will often utilize an application server that creates, manages and logs session IDs.  It is acceptable for the application to delegate this requirement to the application server.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Access the management interface for the application or configuration file and evaluate the log/audit management settings.\n\nDetermine if the setting that enables session ID destruction event auditing is activated.\n\nTerminate a user session within the application and review the logs to ensure the session destruction event was recorded.\n\nIf the application is not configured to log session ID destruction events, or if the application has no means to enable auditing of session ID destruction events, this is a finding.\n\nIf a web-based application delegates session ID destruction to an application server, this is not a finding. \n\nIf the application generates audit logs by default when session IDs are destroyed, and that behavior cannot be disabled, this is not a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Enable session ID destruction event auditing.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000169</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web app delegates these duties to an OIDC Provider. The OpenID Connect (OIDC) Provider creates, manages and logs user session data.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222443</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000089</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222443r960879_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000640</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide audit record generation capability for the renewal of session IDs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application design sometimes requires the renewal of session IDs in order to continue approved user access to the application.\n\nSession renewal is done on a case by case basis under circumstances defined by the application architecture. The following are some examples of when session renewal must be done; whenever there is a change in user privilege such as transitioning from a user to an admin role or when a user changes from an anonymous user to an authenticated user or when a user&apos;s permissions have changed.\n\nFor these types of critical application functionalities, the previous session ID needs to be destroyed or otherwise invalidated and a new session ID must be created.\n\nIt is important to log when session IDs are renewed for forensic purposes.\n\nWeb based applications will often utilize an application server that creates, manages and logs session IDs.  It is acceptable for the application to delegate this requirement to the application server.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the system admin and review the application documentation.\n\nIdentify any web pages or application functionality where a user&apos;s privileges or permissions will change. This is most likely to occur during the authentication stages.\n\nEvaluate the log/audit output by opening the log files and observing changes to the logs.\n\nCreate a new user session by accessing the application.\n\nReview the logs and save the relevant session creation event recorded.\n\nUtilize the application pages that provide privilege escalation.\n\nEscalate privileges by authenticating as a privileged user.\n\nReview the logs and determine if new session information is created and being used.\n\nIf a web-based application delegates session ID renewals to an application server, this is not a finding. \n\nIf the application is not configured to log session ID renewal events this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design or reconfigure the application to log session renewal events on those application events that provide changes in the users privileges or permissions to the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000169</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web app delegates these duties to an OIDC Provider. The OpenID Connect (OIDC) Provider creates, manages and logs user session data.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222444</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000089</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222444r960879_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000650</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must not write sensitive data into the application logs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>It is important to identify and exclude certain types of data that is written into the logs. If the logs are compromised and sensitive data is included in the logs, this could assist an attacker in furthering their attack or it could completely compromise the system.\n\nExamples of such data include but are not limited to; Passwords, Session IDs, Application source code, encryption keys, and sensitive data such as personal health information (PHI), Personally Identifiable Information (PII), or government identifiers (e.g., SSN).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application logs and identify application logging format. Using the format of the log and the requisite search data as a guide to create your search, create search strings that could successfully identify the existence of passwords, session IDs, or other sensitive information such as SSN.\n\nUtilizing the UNIX grep-based search utility include the following examples which are meant to illustrate the purpose of the requirement.\n\nPassword values are usually associated with usernames so searching for &quot;username&quot; in the provided log file will often assist in determining if password values are included.\n\ngrep -i &quot;username&quot; &lt;  logfile.txt\n\nSearch for social security numbers in the provided log file.\n\ngrep -i &quot;[0-9]{3}[-]?[0-9]{2}[-]?[0-9]{4}&quot; &lt;  logfile.txt\n\nUse regular expressions to aid in searching log files. All search syntax cannot be provided within the STIG, the reviewer must utilize their knowledge to create new search criteria based upon the log format used and the potentially sensitive data processed by the application.\n\nIf the application logs sensitive data such as session IDs, application source code, encryption keys, or passwords, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design or reconfigure the application to not write sensitive data to the logs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000169</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API does not emit audit records with sensitive data, including session Ids (not used), encryption keys, or passwords (not used).</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222445</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000089</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222445r960879_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000660</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide audit record generation capability for session timeouts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When a user&apos;s session times out, it is important to be able to identify these events in the application logs.\n\nWithout the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAudit records can be generated from various components within the application (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records.\n\nDoD has defined the list of events for which the application will provide an audit record generation capability as the following:\n\n(i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels);\n\n(ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and\n\n(iii) All account creation, modification, disabling, and termination actions.\n\nWeb-based applications will often utilize an application server that creates, manages, and logs session timeout information. It is acceptable for the application to delegate this requirement to the application server.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify log locations for application session activity.\n\nOpen the log file that tracks user session activity.\n\nAccess the application as a regular user and identify the user session within the log files.\n\nIdentify the session timeout threshold defined by the application.\n\nPerform no action within the application in order to allow the session to timeout.\n\nOnce the session timeout threshold has been exceeded, verify the session has been terminated due to the timeout event and review the logs again to ensure the session timeout event was recorded in the logs.\n\nIf a web-based application delegates session timeout auditing to an application server, this is not a finding. \n\nIf the session timeout event is not recorded in the logs, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to record session timeout events in the logs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000169</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web app delegates these duties to an OIDC Provider. The OpenID Connect (OIDC) Provider creates, manages and logs user session data.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222446</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000089</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222446r960879_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000670</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must record a time stamp indicating when the event occurred.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>It is important to include the time stamps for when an event occurred. Failure to include time stamps in the event logs is detrimental to forensic analysis.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application logs.\n\nIf the time the event occurred is not included as part of the event, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to record the time the event occurred when recording the event.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000169</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API emits audit records that are time stamped.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222447</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000089</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222447r960879_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000680</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide audit record generation capability for HTTP headers including User-Agent, Referer, GET, and POST.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>HTTP header information is a critical component of data that is used when evaluating forensic activity.\n\nWithout the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAudit records can be generated from various components within the application (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records.\n\nDoD has defined the list of events for which the application will provide an audit record generation capability as the following:\n\n(i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels);\n\n(ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and\n\n(iii) All account creation, modification, disabling, and termination actions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify log locations for application session activity.\n\nOpen the log file that tracks user session activity.\n\nAccess the application as a regular user and identify the user session within the log files.\n\nPerform several actions within the application in order to generate HTTP header traffic.\n\nReview the logs to ensure the HTTP header information is recorded in the logs. Header information logged will vary based upon the application and environment. Examples of headers include but are not limited to:\n\nUser-Agent:\nReferer:\nX-Forwarded-For:\nDate:\nExpires:\n\nIf HTTP headers are not logged, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the web application and/or the web server to log HTTP headers.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000169</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Application supports configuration of logging behavior, including log levels that will include request headers in log entries.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222448</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000089</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222448r960879_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000690</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide audit record generation capability for connecting system IP addresses.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAudit records can be generated from various components within the application (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records.\n\nThe IP addresses of remote systems that connect to the application are an important aspect of identifying the sources of application activity. Recording these IP addresses in the application logs provides forensic evidence and aids in investigating and identifying sources of malicious behavior related to security events.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify where audit logs are stored.\n\nReview audit logs and determine if the IP address information of systems that connect to the application is kept in the logs.\n\nIf connecting IP addresses are not seen in the logs, connect to the application remotely and review the logs to determine if the connection was logged.\n\nIf the IP addresses of the systems that connect to the application are not recorded in the logs, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application or application server to log all connecting IP address information</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000169</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records that include the original source IP address.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222449</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000089</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222449r960879_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000700</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must record the username or user ID of the user associated with the event.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When users conduct activity within an application, that user’s identity must be recorded in the audit log. Failing to record the identity of the user responsible for the activity within the application is detrimental to forensic analysis.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review and monitor the application logs.\n\nConnect to the application and perform application activity that is allowed by the user such as accessing data or running reports.\n\nObserve if the log includes an entry to indicate the user ID of the user that conducted the activity.\n\nIf the user ID is not recorded along with the event in the event log, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to record the user ID of the user responsible for the log event entry.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000169</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records that include the OAuth2 token claim configured as representing the requesting entity&apos;s username.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222450</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000091</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222450r960885_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000710</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when successful/unsuccessful attempts to grant privileges occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nWhen a user is granted access or rights to application features and function not afforded to an ordinary user, they have been granted access to privilege and that action must be logged.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application admin to identify application management interfaces and features.\n\nAccess the application management utility and create a test user account or use the account of a regular unprivileged user who is cooperating with the testing.\n\nAccess and open the auditing logs.\n\nUsing an account with the appropriate privileges, grant the user a privilege they previously did not have.\n\nAttempt to grant privileges in a manner that will cause a failure event such as granting privileges to a non-existent user or attempting to grant privileges with an account that doesn&apos;t have the rights to do so.\n\nReview the application logs and ensure both events were captured in the logs. The event data should include the user’s identity and the privilege that was granted and the privilege that failed to be granted.\n\nIf the application does not log when successful and unsuccessful attempts to grant privilege occur, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to audit successful and unsuccessful attempts to grant privileges.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Requests invoking elevated privilege include POST content and JSON reply in audit record.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222451</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000492</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222451r961791_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000720</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when successful/unsuccessful attempts to access security objects occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Security objects represent application objects that provide or require security protections or have a security role within the application. Examples include but are not limited to, files, application modules, folders, and database records. Essentially, if permissions are assigned to protect it, it can be considered a security object. Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify where the application logs are stored.\n\nIdentify application functionality that provides privilege or permission settings to security objects within the application.\nThis can be an application function that assigns privileges to an application object or data element.\n\nAuthenticate to the application as a regular user. Using application functionality, attempt to access the security object within the application.\n\nPerform two attempts, one successfully and one unsuccessfully.\n\nReview the log data and ensure both the successful and unsuccessful access attempts are logged.\n\nIf the application does not generate an audit record when successful and unsuccessful attempts to access security objects occur, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to create an audit record for both successful and unsuccessful attempts to access security objects.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to access security objects (i.e., Collections, Assets, Reviews).</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222452</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000493</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222452r961794_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000730</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when successful/unsuccessful attempts to access security levels occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A security level denotes a permissions or authorization capability within the application. This is most often associated with a user role. Attempts to access a security level can occur when a user attempts an action such as escalating their privilege from within the application itself. Attempts to access a security level can be construed as an attempt to change your user role from within the application. \n\nWithout generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator. Identify where the application logs are stored.\n\nIdentify application functionality that provides privilege escalation or access to additional security levels within the application.\n\nThis can be performing a function that escalates the privileges of the user, or accessing a protected area of the application that requires additional authentication in order to access.\n\nAuthenticate to the application as a regular user. Using application functionality, attempt to access a different security level or domain within the application.\n\nPerform two attempts, one successfully and one unsuccessfully.\n\nReview the log data and ensure both the successful and unsuccessful access attempts are logged.\n\nIf the application does not generate an audit record when successful and unsuccessful attempts to access security levels occur, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to create an audit record for both successful and unsuccessful attempts to access security levels.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to access security levels (i.e., Collection Grants).</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222453</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000494</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222453r961797_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000740</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nCategories of information is information that is identified as being sensitive or requiring additional protection from regular user access. The data is accessed on a need to know basis and has been assigned a category or a classification in order to assign protections and track access.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator. Identify where the application logs are stored.\n\nIdentify any data protections that are required.\n\nIdentify any categories of data or classification of data.\n\nIf the application requirements do not call for compartmentalized data and data protection, this requirement is not applicable.\n\nAuthenticate to the application as a regular user. Using application functionality, attempt to access data that has been assigned to a protected category.\n\nPerform two access attempts, one successful and one unsuccessful.\n\nTesting this will require obtaining access to test data that has been assigned to a protected category, or having an authorized user access the data for you.\n\nReview the log data and ensure both the successful and unsuccessful access attempts are logged.\n\nIf the application does not generate an audit record when successful and unsuccessful attempts to access categories of information occur, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to create an audit record for both successful and unsuccessful attempts to access protected categories of information.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to access all categories of information.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222454</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000495</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222454r961800_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000750</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when successful/unsuccessful attempts to modify privileges occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application admin to identify application management interfaces and features.\n\nAccess the application management utility and create a test user account or use the account of a regular privileged user who is cooperating with the testing.\n\nAccess and open the auditing logs.\n\nUsing an admin account, modify the privileges of a privileged user.\n\nAttempt to modify privileges in a manner that will cause a failure event such as attempting to modify a user’s privileges with an account that doesn&apos;t have the rights to do so.\n\nReview the application logs and ensure both events were captured in the logs. The event data should include the user’s identity and the privilege that was granted and the privilege that failed to be granted.\n\nIf the application does not log when successful and unsuccessful attempts to modify privileges occur, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to audit successful and unsuccessful attempts to modify privileges.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Requests invoking elevated privilege include POST content and JSON reply in audit record.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222455</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000496</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222455r961803_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000760</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when successful/unsuccessful attempts to modify security objects occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify where the application logs are stored.\n\nIdentify application functionality that provides privilege or permission settings to security objects within the application.\nThis can be an application function that assigns privileges to an application object or data element.\n\nAuthenticate to the application as a regular user.  Using application functionality, attempt to modify the security object within the application.\n\nPerform two attempts, one successfully and one unsuccessfully.\n\nReview the log data and ensure the modification events both successful and unsuccessful are logged.\n\nIf the application does not generate an audit record when successful and unsuccessful attempts to modify security objects occur, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to create an audit record for both successful and unsuccessful attempts to modify security objects.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to modify security objects (i.e, Collections, Assets, Reviews and Users).</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222456</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000497</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222456r961806_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000770</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when successful/unsuccessful attempts to modify security levels occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A security level denotes a permissions or authorization capability within the application. This is most often associated with a user role. Attempts to modify a security level can be construed as an attempt to change the configuration of the application so as to create a new security role or modify an existing security role. Some applications may or may not provide this capability.\n\nWithout generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify where the application logs are stored.\n\nIdentify application functionality that provides privilege escalation or access to additional security levels within the application.\n\nThis can be performing a function that escalates the privileges of the user, or accessing a protected area of the application that requires additional authentication in order to access.\n\nAuthenticate to the application as a regular user. Using application functionality, attempt to modify the permissions of a different security level or domain within the application.\n\nPerform two attempts, one successfully and one unsuccessfully.\n\nReview the log data and ensure the modify events, both successful and unsuccessful, are logged.\n\nIf the application does not generate an audit record when successful and unsuccessful attempts to modify the permissions regarding the security levels occur, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to create an audit record for both successful and unsuccessful attempts to modify security levels.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to modify security levels (i.e, Collection Grants).</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222457</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000498</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222457r961809_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000780</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when successful/unsuccessful attempts to modify categories of information (e.g., classification levels) occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify where the application logs are stored.\n\nIdentify any data protections that are required.\n\nIdentify any categories of data or classification of data.\n\nIf the application requirements do not call for compartmentalized data and data protection, this requirement is not applicable.\n\nAuthenticate to the application as a regular user. Using application functionality, attempt to modify data that has been assigned to a protected category.\n\nPerform two modification attempts, one successful and one unsuccessful.\n\nTesting this will require obtaining access to test data that has been assigned to a protected category, or having an authorized user access the data for you.\n\nReview the log data and ensure both the successful and unsuccessful modification attempts are logged.\n\nIf the application does not generate an audit record when successful and unsuccessful attempts to modify categories of information occur, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to create an audit record for both successful and unsuccessful attempts to modify protected categories of information.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to modify categories of information (i.e, Collection Grants, Restricted User Access).</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222458</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000499</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222458r961812_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000790</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when successful/unsuccessful attempts to delete privileges occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application admin to identify application management interfaces and features.\n\nAccess the application management utility and create a test user account or use the account of a regular privileged user who is cooperating with the testing.\n\nAccess and open the auditing logs.\n\nUsing an admin account, delete some or all of the privileges of a privileged user.\n\nAttempt to delete privileges in a manner that will cause a failure event such as attempting to delete a user’s privileges with an account that doesn&apos;t have the rights to do so.\n\nReview the application logs and ensure both events were captured in the logs. The event data should include the user’s identity and the privilege that was granted and the privilege that failed to be granted.\n\nIf the application does not log when successful and unsuccessful attempts to delete privileges occur, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to audit successful and unsuccessful attempts to delete privileges.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Requests invoking elevated privilege include POST content and JSON reply in audit record.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222459</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000500</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222459r961815_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000800</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when successful/unsuccessful attempts to delete security levels occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A security level denotes a permissions or authorization capability within the application. This is most often associated with a user role. Attempts to delete a security level can be construed as an attempt to change the configuration of the application so as to delete an existing security role. Some applications may or may not provide this capability.\n\nWithout generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify where the application logs are stored.\n\nIdentify application functionality that provides privilege escalation or access to additional security levels within the application.\n\nThis can be performing a function that escalates the privileges of the user, or accessing a protected area of the application that requires additional authentication in order to access.\n\nAuthenticate to the application as a regular user. Using application functionality, attempt to delete permissions of a different security level or domain within the application.\n\nPerform two attempts, one successfully and one unsuccessfully.\n\nReview the log data and ensure the deletion events, both successful and unsuccessful are logged.\n\nIf the application does not generate an audit record when successful and unsuccessful attempts to delete permissions regarding the security levels occur, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to create an audit record for both successful and unsuccessful attempts to delete security levels.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to delete security levels  (i.e, Collection Grants, Restricted User Access).</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222460</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000501</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222460r961818_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000810</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when successful/unsuccessful attempts to delete application database security objects occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify where the application logs are stored.\n\nIdentify application functionality that provides privilege or permission settings to database security objects within the application. This can be an application function that assigns privileges to an application object or data element.\n\nAuthenticate to the application as a regular user. Using application functionality, attempt to delete the database security object within the application.\n\nPerform two attempts, one successfully and one unsuccessfully.\n\nReview the log data and ensure the deletion events, both successful and unsuccessful, are logged.\n\nIf the application does not generate an audit record when successful and unsuccessful attempts to delete database security objects occur, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to create an audit record for both successful and unsuccessful attempts to delete database security objects.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API does not implement functionality that manipulates database security objects, including deletions.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222461</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000502</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222461r961821_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000820</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when successful/unsuccessful attempts to delete categories of information (e.g., classification levels) occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify where the application logs are stored.\n\nIdentify any data protections that are required.\n\nIdentify any categories of data or classification of data.\n\nIf the application requirements do not call for compartmentalized data and data protection, this requirement is not applicable.\n\nAuthenticate to the application as a regular user. Using application functionality, attempt to delete data that has been assigned to a protected category.\n\nPerform two modification attempts, one successful and one unsuccessful.\n\nTesting this will require obtaining access to test data that has been assigned to a protected category, or having an authorized user access the data for you.\n\nReview the log data and ensure both the successful and unsuccessful deletion attempts are logged.\n\nIf the application does not generate an audit record when successful and unsuccessful attempts to delete categories of information occur, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to create an audit record for both successful and unsuccessful attempts to delete protected categories of information.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to delete categories of information (i.e, Collection Grants, Restricted User Access).</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222462</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000503</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222462r961824_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000830</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when successful/unsuccessful logon attempts occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nKnowing when a user successfully or unsuccessfully logged on to the application is critical information that aids in forensic analysis.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review and monitor the application logs.\n\nAuthenticate to the application and observe if the log includes an entry to indicate the user’s authentication was successful.\n\nTerminate the user session by logging out.\n\nReauthenticate using invalid user credentials and observe if the log includes an entry to indicate the authentication was unsuccessful.\n\nIf successful and unsuccessful logon events are not recorded in the logs, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application or application server to write a log entry when successful and unsuccessful logon events occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web app delegates these duties to an OIDC Provider. The OpenID Connect (OIDC) Provider creates, manages and logs user session data.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222463</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000504</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222463r961827_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000840</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records for privileged activities or other system-level access.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Privileged activities include the tasks or actions taken by users in an administrative role (admin, backup operator, manager, etc.) which are used to manage or reconfigure application function. Examples include but are not limited to:\n\nModifying application logging verbosity, starting or stopping of application services, application user account management, managing application functionality, or otherwise changing the underlying application capabilities such as adding a new application module or plugin.\n\nPrivileged access does not include an application design which does not modify the application but does provide users with the functionality or the ability to manage their own user specific preferences or otherwise tailor the application to suit individual user needs based upon choices or selections built into the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review and monitor the application logs.\n\nAuthenticate to the application as a privileged user and observe if the log includes an entry to indicate the user’s authentication was successful.\n\nPerform actions as an admin or other privileged user such as modifying the logging verbosity, or starting or stopping an application service, or terminating a test user session.\n\nIf log events that correspond with the actions performed are not recorded in the logs, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to write a log entry when privileged activities or other system-level events occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>By design, privileged access does not include the ability to modify the application or its configuration.  It only provide users with the functionality or the ability to manage their own user specific preferences or otherwise tailor the application to suit individual user needs based upon choices or selections built into the application.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222464</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000505</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222464r961830_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000850</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records showing starting and ending time for user access to the system.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Knowing when a user’s application session began and when it ended is critical information that aids in forensic analysis.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review and monitor the application logs.\n\nInitiate a user session and observe if the log includes a time stamp showing the start of the session.\n\nTerminate the user session and observe if the log includes a time stamp showing the end of the session.\n\nIf the start and the end time of the session are not recorded in the logs, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application or application server to record the start and end time of user session activity.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web app delegates these duties to an OIDC Provider. The OpenID Connect (OIDC) Provider creates, manages and logs user session data.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222465</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000507</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222465r961836_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000860</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when successful/unsuccessful accesses to objects occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nApplication objects are system or application components that comprise the application. This includes but is not limited to; application files, folders, processes and modules.\n\nThis requirement is not intended to force the use of debug logging which would be used for troubleshooting or forensic actions; rather it is intended to assure the application strikes a balance when auditing access to application objects and logs normal and potentially abnormal application activity.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify log locations.\n\nAccess the application logs.\n\nReview the logs and identify if the application is logging both successful and unsuccessful access to application objects such as files, folders, processes, or application modules and sub components, or systems.\n\nIf the application does not log application object access, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to log successful and unsuccessful access to application objects.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to access to application objects (i.e, Collections, Assets, Reviews, Users).</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222466</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000508</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222466r961839_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000870</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records for all direct access to the information system.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nWhen an application provides direct access to underlying OS features and functions, that access must be audited.\nAudit records can be generated from various components within the information system (e.g., module or policy filter).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify if the application implements a direct access feature or function that allows users to directly access the underlying OS.\n\nDirect access includes but is not limited to: executing OS commands, navigating the file system, manipulating system resources such as print queues, or reading files hosted on the OS that are not specifically shared or made available on the website.\n\nIf the application does not provide direct access to the system, this requirement is not applicable.\n\nAccess the application logs.\n\nAccess the application as a user or test user with appropriate permissions and attempt to execute application features and functions that provide direct access to the system.\n\nReview the logs and ensure the actions executed were logged.\n\nLog information must include the user responsible for executing the action, the action executed, and the result of the action.\n\nIf the application does not log all direct access to the system, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to log all direct access to the system.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The application does not provide direct access to the underlying information system.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222467</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000509</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222467r961842_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000880</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records for all account creations, modifications, disabling, and termination events.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When application user accounts are created, modified, disabled or terminated the event must be logged.\n\nCentralized management of user accounts allows for rapid response to user related security events and also provides ease of management.\n\nAllowing the centralized user management solution to log these events is acceptable practice; however, if the application provides a user management interface to manage these tasks, the application must also log these events.\n\nApplication developers are encouraged to integrate their applications with enterprise-level authentication/access/audit mechanisms such as Syslog, Active Directory or LDAP.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Examine the application documentation or interview the application representative to identify how the application users are managed.\n\nInterview the application administrator and determine if the application is configured to utilize a centralized user management system such as Active Directory for user management or if the application manages user accounts within the application.\n\nIf the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable.\n\nIdentify the location of the audit logs and review the end of the logs.\n\nAccess the user account management functionality.\n\nCreate an application test account and then review the log to ensure a log record that documents the event is created.\n\nModify the test account and then review the log to ensure a log record that documents the event is created.\n\nDisable the test account and then review the log to ensure a log record that documents the event is created.\n\nTerminate/remove the test account and then review the log to ensure a log record that documents the event is created.\n\nIf log events are not created that document all of these events, this is a finding.\n\nIf some but not all of the aforementioned events are documented in the logs, this is a finding.\n\nFindings should document which of the events was not logged.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to log user account creation, modification, disabling, and termination events.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web app delegates these duties to an OIDC Provider. The OpenID Connect (OIDC) Provider creates, manages and logs user session data.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222468</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000092</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222468r960888_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000910</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must initiate session auditing upon startup.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application does not begin logging upon startup, important log events could be missed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Examine the application design documentation and interview the application administrator to identify application logging behavior.\n\nIf the application is writing to an existing log or log file:\n\nOpen and monitor the application log.\n\nStart the application service and view the log entries. \n\nLog entries indicating the application is starting should commence as soon as the application starts. Determine if the log events correlate with the time the application was started and if event log entries include an application start up sequence of events.\n\nIf the application writes events to a new log on startup: \n\nIdentify location logs are written to, start the application and then identify and access the new log.\n\nDetermine if the log events correlate with the time the application was started and if event log entries include an application start up sequence of events.\n\nIf the application does not begin logging events upon start up, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to begin logging application events as soon as the application starts up.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001464</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API emits audit records immediately upon the start of its bootstrapping process.\n\nYour local definition of &apos;application startup&apos; may include other components (i.e, OIDC Provider, database, reverse proxies, log servers, etc.) whose compliance with this check must be individually evaluated.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222469</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000095</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222469r960891_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000940</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must log application shutdown events.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Forensics is a large part of security incident response.  Applications must provide a record of their actions so application events can be investigated post-event.  \n\nAttackers may attempt to shut off the application logging capability to cover their activity while on the system.  Recording the shutdown event and the time it occurred in the application or  system logs helps to provide forensic evidence that aids in investigating the events.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review and monitor the application and system logs.\n\nIf an application shutdown event is not recorded in the logs, either initiate a shutdown event and review the logs after reestablishing access or request backup copies of the application or system logs that indicate shutdown events are being recorded.\n\nAlternatively, check for a setting within the application that controls application logging events and determine if application shutdown logging is configured.\n\nIf the application is not recording application shutdown events in either the application or system log, or if the application is not configured to record shutdown events, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application or application server to record application shutdown events in the event logs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000130</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API emits audit records after receiving the SIGINT or SIGTERM signal that initiates a shutdown. \n\nYour local definition of &apos;application shutdown&apos; may include other components (i.e, OIDC Provider, database, reverse proxies, log servers, etc.) whose compliance with this check must be individually evaluated.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222470</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000095</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222470r960891_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000950</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must log destination IP addresses.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The IP addresses of the systems that the application connects to are an important aspect of identifying application network related activity. Recording the IP addresses of the system the application connects to in the application logs provides forensic evidence and aids in investigating and correlating the sources of malicious behavior related to security events. Logging this information can be particularly useful for Service-Oriented Applications where there is application to application connectivity.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application design documentation indicates the application does not initiate connections to remote systems this requirement is not applicable.\n\nNetwork connections to systems used for support services such as DNS, AD, or LDAP may be stored in the system logs. These connections are applicable.\n\nIdentify log source based upon application architecture, design documents and input from application admin.\n\nReview and monitor the application or system logs.\n\nConnect to the application and utilize the application functionality that initiates connections to a destination system.\n\nIf the application routinely connects to remote system on a regular basis you may simply allow the application to operate in the background while the logs are observed.\n\nObserve the log activity and determine if the log includes an entry to indicate the IP address of the destination system.\n\nIf the IP address of the remote system is not recorded along with the event in the event log, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to record the destination IP address of the remote system.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000130</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The API does not initiate any connections to remote systems, only its configured dependencies. The configuration of the OIDC Provider and Database dependencies are locally defined and implemented.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222471</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000095</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222471r960891_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000960</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must log user actions involving access to data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When users access application data, there is risk of data compromise or seepage if the account used to access is compromised or access is granted improperly. To be able to investigate which account accessed data, the account access must be logged. Without establishing when the access event occurred, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAssociating event types with detected events in the application and audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review and monitor the application logs. When accessing data, the logs are most likely database logs.\n\nIf the application design documents include specific data elements that require protection, ensure user access to those data elements are logged.\n\nUtilize the application as a regular user and operate the application so as to access data elements contained within the application. This includes using the application user interface to browse through data elements, query/search data elements and using report generation capability if it exists.\n\nObserve and determine if the application log includes an entry to indicate the user’s access to the data was recorded.\n\nIf successful access to application data elements is not recorded in the logs, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Identify the specific data elements requiring protection and audit access to the data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000130</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records for user actions involving access to data (i.e, Collections, Assets, Reviews, Users).</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222472</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000095</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222472r960891_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000970</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must log user actions involving changes to data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When users change/modify application data, there is risk of data compromise if the account used to access is compromised or access is granted improperly. To be able to investigate which account accessed data, the account making the data changes must be logged. Without establishing when the data change event occurred, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\n\nAssociating event types with detected events in the application and audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review and monitor the application logs. When modifying data, the logs are most likely database logs.\n\nIf the application design documents include specific data elements that require protection, ensure any changes to those specific data elements are logged. Otherwise, a random check is sufficient.\n\nIf the application uses a database configured to use Transaction SQL logging this is not a finding if the application admin can demonstrate a process for reviewing the transaction log for data changes. The process must include using the transaction log and some form of query capability to identify users and the data they changed within the application and vice versa.\n\nUtilize the application as a regular user and operate the application so as to modify a data element contained within the application.\n\nObserve and determine if the application log includes an entry to indicate the users data change event was recorded.\n\nIf successful changes/modifications to application data elements are not recorded in the logs, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to log all changes to application data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000130</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records for user actions involving changes to data (i.e, Collections, Assets, Reviews, Users).</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222473</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000096</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222473r960894_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000980</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must produce audit records containing information to establish when (date and time) the events occurred.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events relating to an incident.\n\nIn order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know when events occurred (date and time).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Access the application logs and review the log entries for date and time. Each event written into the log must have a corresponding date and time stamp associated with it.\n\nIf the audit logs do not have a corresponding date and time associated with each event, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application or application server to include the date and the time of the event in the audit logs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000131</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API emits audit records that are time stamped.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222474</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000097</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222474r960897_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-000990</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must produce audit records containing enough information to establish which component, feature or function of the application triggered the audit event.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>It is impossible to establish, correlate, and investigate the events relating to an incident if the details regarding the source of the event it not available.\n\nIn order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know where within the application the events occurred, such as which application component, application modules, filenames, and functionality.\n\nAssociating information about where the event occurred within the application provides a means of quickly investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review application administration and/or design documents.\n\nIdentify key aspects of application architecture objects and components, e.g., Web Server, Application server, Database server.\n\nInterview the application administrator and identify the log locations.\n\nAccess the application logs and review the log entries for events that indicate the application is auditing the internal components, objects, or functions of the application.\n\nConfirm the event logs provide information as to which component, feature, or functionality of the application triggered the event.\n\nExamples of the types of events to look for are as follows:\n\n- Application and Protocol events. e.g., Application loads or unloads and Protocol use.\n- Data Access events. e.g., Database connections.\n\nEvents could include reference to database library or executable initiating connectivity:\n\n- Middleware events. e.g., Source code initiating calls or being invoked.\n- Name of application modules being loaded or unloaded.\n- Library loads and unloads.\n- Application deployment activity.\n\nEvents written into the log must be able to be traced back to the originating component, feature or function name, service name, application name, library name etcetera in order to establish which aspect of the application triggered the event.\n\nIf the audit logs do not contain enough data in the logs to establish which component, feature or functionality of the application triggered the event, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to log which component, feature or functionality of the application triggered the event.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000132</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API emits audit records that include a component property.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222475</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000098</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222475r960900_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001000</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When using centralized logging; the application must include a unique identifier in order to distinguish itself from other application logs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without establishing the source, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\n\nIn the case of centralized logging, or other instances where log files are consolidated, there is risk that the application&apos;s log data could be co-mingled with other log data.  To address this issue, the application itself must be identified as well as the application host or client name. \n\nIn order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know the source of the event, particularly in the case of centralized logging.\n\nAssociating information about the source of the event within the application provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application is logging locally and does not utilize a centralized logging solution, this requirement is not applicable.\n\nReview system documentation and identify log location.  Access the application logs.\n\nReview the application logs.\n\nEnsure the application is uniquely identified either within the logs themselves or via log storage mechanisms.\n\nEnsure the hosts or client names hosting the application are also identified.  Either hostname or IP address is acceptable.\n\nIf the application name and the hosts or client names are not identified, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application logs or the centralized log storage facility so the application name and the hosts hosting the application are uniquely identified in the logs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000133</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API emits audit records that include an instance property.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222476</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000099</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222476r960903_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001010</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must produce audit records that contain information to establish the outcome of the events.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the system.\n\nEvent outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the information system after the event occurred). As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.\n\nSuccessful application events are expected to far outnumber errors.   Therefore, success events may be implied by default and not specified in the logs if this behavior is documented.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review system and application documentation to identify application operation and function.\n\nAccess the application logs and review the logs to determine if the results of application operations are logged.\n\nSuccessful application events are expected to far outnumber errors.   Therefore, success events may be implied by default and not specified in the logs if this behavior is documented.\n\nThe outcome will be a log record that displays the application event/operation that occurred followed by the result of the operation such as &quot;ERROR&quot;, &quot;FAILURE&quot;, &quot;SUCCESS&quot; or &quot;PASS&quot;.\n\nOperation outcomes may also be indicated by numeric code where a &quot;1&quot; might indicate success and a &quot;0&quot; may indicate operation failure.\n\nIf the application does not produce audit records that contain information regarding the results of application operations, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to include the outcome of application functions or events.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000134</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records that contain the response status code.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222477</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000100</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222477r960906_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001020</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records containing information that establishes the identity of any individual or process associated with the event.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.\n\nEvent identifiers (if authenticated or otherwise known) include, but are not limited to, user database tables, primary key values, user names, or process identifiers.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review system documentation and discuss application operation with application administrator.\n\nIdentify application processes and application users.\nIdentify application components, e.g., application features framework and function. Identify server components, such as web server, database server.\n\nReview application logs. Ensure the application event logs include an identifier or identifiers that will allow an investigator to determine the user or the application process responsible for the application event.\n\nIf the event logs do not include the appropriate identifier or identifiers, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to log the identity of the user and/or the process associated with the event.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001487</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records that include the OAuth2 token claim configured as representing the requesting entity&apos;s username.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222478</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000101</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222478r960909_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001030</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nOrganizations consider limiting the additional audit information to only that information explicitly needed for specific audit requirements. The additional information required is dependent on the type of information (i.e., sensitivity of the data and the environment within which it resides). At a minimum, the organization must audit either full-text recording of privileged commands or the individual identities of group users, or both. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. \n\nIn addition, the application must have the capability to include organization-defined additional, more detailed information in the audit records for audit events.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review application documentation and interview application administrator. Identify audit log locations and review audit logs.\n\nAccess the system as a privileged user and execute privileged commands.\n\nReview the application logs and ensure that the logs contain all details of the actions performed.  \n\nIf a privileged command was typed within the application that command text must be included in the logs. Authentication information provided as part of the text must NOT be logged, just the commands.\n\nIf an action was performed, such as activating a check box, that action must be logged.\n\nReview group account users, review logs to determine if the individual users of group accounts are identified in the logs.\n\nIf the application does not log the full text recording of privileged commands or if the application does not identify and log the individuals associated with group accounts, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to log the full text recording of privileged commands or the individual identities of group users.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000135</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, if the request includes parameter &apos;elevate&apos; == true, the API emits audit records that include the JSON POST content and the JSON reply\n        </FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222479</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000101</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222479r960909_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001040</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must implement transaction recovery logs when transaction based.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without required logging and access control, security issues related to data changes will not be identified. This could lead to security compromises such as data misuse, unauthorized changes, or unauthorized access.\n\nTransaction logs contain a sequential record of all changes to the database. Using a transaction log helps with maintaining application availability and aids in speedy recovery. Transactional logging should be enabled whenever the application database offers the transactional logging capability.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.  Have the application administrator provide configuration settings that demonstrate transaction logging is enabled.\n\nReview configuration settings for the location of transaction specific logs and verify transaction logs exist and the log records access and changes to the data.\n\nIf the application is not configured to utilize transaction logging, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application database to utilize transactional logging.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000135</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Implemented by the Data Storage layer</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222480</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000356</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222480r985972_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001050</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide centralized management and configuration of the content to be captured in audit records generated by all application components.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without the ability to centrally manage the content captured in the audit records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack.\n\nThis requirement requires that the content captured in audit records be managed from a central location (necessitating automation). Centralized management of audit records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Application components requiring centralized audit log management must have the capability to support centralized management.\n\nThis requirement applies to centralized management applications or similar types of applications designed to manage and configure audit record capture.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to determine the logging architecture of the application.\n\nIf the application is configured to log application event entries to a centralized, enterprise based logging solution that meets this requirement, this requirement is Not Applicable.\n\nReview the application components and the log management capabilities of the application.\n\nVerify the application log management interface includes the ability to centrally manage the configuration of what is captured in the logs of all application components. \n\nIf the application does not provide the ability to centrally manage the content captured in the audit logs, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to utilize a centralized log management system that provides the capability to configure the content of audit records.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000154</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222481</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000358</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222481r961395_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001070</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must off-load audit records onto a different system or media than the system being audited.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Information stored in one location is vulnerable to accidental or incidental deletion or alteration.  In addition, attackers often manipulate logs to hide or obfuscate their activity.\n\nThe goal is to off-load application logs to a separate server as quickly and efficiently as possible so as to mitigate these risks.  \n\nA centralized logging solution offering applications an enterprise designed and managed logging capability which is the desired solution.\n\nHowever, when a centralized logging solution is not an option due to the operational environment or other situations where the risk has been officially recognized and accepted, off-loading is a common process utilized to address this type of scenario.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review application documentation and interview application administrator.  Identify log functionality and locations of log files.  Obtain risk acceptance documentation and task scheduling information.\n\nIf the application is configured to utilize a centralized logging solution, this requirement is not applicable.\n\nEvaluate log management processes and determine if there are automated tasks that move the logs off of the system hosting the application.   \n\nVerify automated tasks are performed on an ISSO approved schedule (hourly, daily etc.).  Automation can be via scripting, log management oriented tools or other automated means.\n\nReview risk acceptance documentation for not utilizing a centralized logging solution.\n\nIf the logs are not automatically moved off the system as per approved schedule, or if there is no formal risk acceptance documentation, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to off-load audit records onto a different system as per approved schedule.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001851</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222482</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000515</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222482r961860_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001080</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must be configured to write application logs to a centralized log repository.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Information stored in one location is vulnerable to accidental or incidental deletion or alteration.  In addition, attackers often manipulate logs to hide or obfuscate their activity.\n\nOff-loading is a common process in information systems with limited audit storage capacity or when trying to assure log availability and integrity.\n\nThis requirement is meant to address space limitations and integrity issues that can be encountered when storing logs on the local server.\n\nThe goal of the requirement being to offload application logs to a separate server as quickly and efficiently as possible so as to mitigate these risks.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review application documentation and interview application administrator.\n\nEvaluate application log management processes and determine if the system is configured to utilize a centralized log management system for the hosting and management of application audit logs.\n\nIf the system is not configured to write the application logs to the centralized log management repository in an expeditious manner, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to utilize a centralized log repository and ensure the logs are off-loaded from the application system as quickly as possible.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001851</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222483</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000359</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222483r961398_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001090</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide an immediate warning to the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If security personnel are not notified immediately upon storage volume utilization reaching 75%, they are unable to plan for storage capacity expansion.\n\nDue to variances in application usage and audit records storage usage, the SA and the ISSO may evaluate usage patterns and determine if a higher percentage of usage is warranted before an alarm is sent.  The intent of the requirement is to provide a warning that will allow the SA and ISSO ample time to plan and implement an audit storage capacity expansion that will provide for the increased audit log storage requirements without forcing an emergency or otherwise negatively impacting the recording of audit events.\n\nThe requirement will take into account a reasonable amount of processing time such as 1 or 2 minutes that may be required of the system in order to satisfy the requirement.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review system documentation and interview application administrator for details regarding logging configuration. \n\nIf the application utilizes a centralized logging system that provides storage capacity alarming, this requirement is not applicable.\n\nIdentify application alarming capability relating to storage capacity alarming for the log repository. Coordinate with the appropriate personnel regarding the generation of test alarms.\n\nReview log alarm settings and ensure audit log storage capacity alarming is enabled and set to alarm when the storage threshold exceeds 75% of disk storage capacity or the capacity value the SA and ISSO have determined will provide adequate time to plan for capacity expansion.\n\nEnsure the alarm will be sent to the ISSO and the application administrator when the utilization threshold is exceeded by changing the threshold settings to below the current disk space utilization. An alarm should be triggered at that point and forwarded to the ISSO and the SA/application admin.\n\nIf the application is not configured to send an alarm when storage volume exceeds 75% of disc capacity or if the designated alarm recipients did not receive an alarm when the test was conducted, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to send an immediate alarm to the application admin/SA and the ISSO when the allocated log storage capacity exceeds 75% of usage or exceeds the capacity value the SA and ISSO have determined will provide adequate time to plan for capacity expansion.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001855</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222484</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000360</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222484r961401_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001100</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications categorized as having a moderate or high impact must provide an immediate real-time alert to the SA and ISSO (at a minimum) for all audit failure events.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications that are categorized as having a high or moderate impact on the organization must provide immediate alerts when encountering failures with the application audit system.  It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. \n\nAudit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.\n\nWhile alerts provide organizations with urgent messages containing important information regarding application audit log activity, real-time alerts provide these messages at information technology speed (i.e., the time from event detection to alert occurs in seconds or no more than 1-2 minutes).  \n\nWithout a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review system documentation and interview application administrator for details regarding application security categorization and logging configuration.\n\nIf the application utilizes a centralized logging system that provides the real-time alarms, this requirement is not applicable.\n\nReview application log alert configuration.\n\nIdentify audit failure events and associated alarming configuration.\n\nIf the application is categorized as having a moderate or high impact and is not configured to provide a real-time alert that indicates the audit system has failed or is failing, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the log alerts to send an alarm when the audit system is in danger of failing or has failed.  \n\nConfigure the log alerts to be immediately sent to the application admin/SA and ISSO.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001858</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222485</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000108</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222485r960912_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001110</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. \n\nAudit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.\n\nThis requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review system documentation and interview application administrator for details regarding logging configuration.\n\nIf the application utilizes a centralized logging system that provides the audit processing failure alarms, this requirement is not applicable.\n\nIdentify application alarming capability regarding audit processing failure events.\n\nVerify the application is configured to alarm when the auditing system fails.\n\nExample alarm events include but are not limited to: \n\nhardware failure events\nfailures to capture audit record events\naudit storage errors\n\nIf the application is not configured to alarm on alerts that indicate the audit system has failed or is failing, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to send an alarm in the event the audit system has failed or is failing.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000139</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222486</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000109</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222486r1043188_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001120</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must shut down by default upon audit failure (unless availability is an overriding concern).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>It is critical that when the application is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include: software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode.\n\nWhen availability is an overriding concern, other approved actions in response to an audit failure are as follows: \n\n(i) If the failure was caused by the lack of audit record storage capacity, the application must continue generating audit records if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner.\n\n(ii) If audit records are sent to a centralized collection server and communication with this server is lost or the server fails, the application must queue audit records locally until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local audit data with the collection server.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review system documentation and interview application administrator for details regarding logging configuration.\n\nIdentify application shut down capability regarding audit processing failure events.  Locate and verify application logging settings that specify the application will halt processing on detected audit failure.\n\nIf ISSO approval to continue operating and not shut down the application upon an audit failure exists and is documented, validate the application is configured as follows:\n\nIf logging locally and the failure is attributed to a lack of disk space:\n\nEnsure the application is configured to overwrite the oldest logs first so as to maintain the most up to date audit events in the event of an audit failure.\n\nWhen logging centrally:\n\nEnsure the application is configured to locally spool/queue audit events in the event an audit failure is detected with the centralized system.\n\nIf the application does not shut down processing when an audit failure is detected, or if the application does not take steps needed to ensure audit events are not lost due to audit failure, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to cease processing if the audit system fails or configure the application to continue logging in a manner that compensates for the audit failure.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000140</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution. Application must be stopped by the Container Platform layer (e.g., k8s).</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222487</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000111</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222487r960918_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001130</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide the capability to centrally review and analyze audit records from multiple components within the system.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Successful incident response and auditing relies on timely, accurate system information and analysis in order to allow the organization to identify and respond to potential incidents in a proficient manner. If the application does not provide the ability to centrally review the application logs, forensic analysis is negatively impacted.\n\nSegregation of logging data to multiple disparate computer systems is counterproductive and makes log analysis and log event alarming difficult to implement and manage, particularly when the system or application has multiple logging components written to different locations or systems.\n\nAutomated mechanisms for centralized reviews and analyses include, for example, Security Information Management products.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review system documentation and interview application administrator for details regarding application architecture and logging configuration.  Identify the application components, the logs that are associated with the components and the locations of the logs.\n\nIf the application utilizes a centralized logging system that provides the capability to review the log files from one central location, this requirement is not applicable.\n\nAccess the application&apos;s log management utility and review the log files.  Ensure all of the applications logs are reviewable from within the centralized log management function and access to other systems in order to review application logs are not required.\n\nIf all of the application logs are not reviewable from a central location, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application so all of the applications logs are available for review from one centralized location.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000154</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222488</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000115</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222488r960924_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001140</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide the capability to filter audit records for events of interest based upon organization-defined criteria.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The ability to specify the event criteria that are of interest provides the persons reviewing the logs with the ability to quickly isolate and identify these events without having to review entries that are of little or no consequence to the investigation. Without this capability, forensic investigations are impeded.\n\nEvents of interest can be identified by the content of specific audit record fields including, for example, identities of individuals, event types, event locations, event times, event dates, system resources involved, IP addresses involved, or information objects accessed. Organizations may define audit event criteria to any degree of granularity required, for example, locations selectable by general networking location (e.g., by network or subnetwork) or selectable by specific information system component. This requires applications to provide the capability to customize audit record reports based on organization-defined criteria.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration.\n\nIdentify the application components and the logs associated with the components as well as the locations of the logs.\n\nIf the application utilizes a centralized logging system that provides the capability to filter log events based upon the following events, this requirement is not applicable.\n\nReview the application log management utility.\n\nEnsure the application provides the ability to filter on audit events based upon the following minimum criteria:\n\nUsers: e.g., specific users or groups\nEvent types:\nEvent dates and time:\nSystem resources involved: e.g., application components or modules.\nIP addresses:\nInformation objects accessed:\nEvent level categories: e.g., high, critical, warning, error\nKey words: e.g., a specific search string\n\nAdditional details may be logged as needed or prescribed by operational requirements.\n\nIf the application does not provide the ability to filter audit events, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application filters to search event logs based on defined criteria.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000158</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222489</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000181</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222489r961056_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001150</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide an audit reduction capability that supports on-demand reporting requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The ability to generate on-demand reports, including after the audit data has been subjected to audit reduction, greatly facilitates the organization&apos;s ability to generate incident reports as needed to better handle larger-scale or more complex security incidents.\n\nAudit reduction is a process that manipulates collected audit information and organizes such information in a summary format that is more meaningful to analysts. The report generation capability provided by the application must support on-demand (i.e., customizable, ad-hoc, and as-needed) reports.\n\nThis requirement is specific to applications with audit reduction capabilities; however, applications need to support on-demand audit review and analysis.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration.\n\nIdentify the application components and the logs associated with the components.\n\nIf the application utilizes a centralized logging system that provides the capability to generate reports based on filtered log events, this requirement is not applicable.\n\nUsing the relevant application features for generating reports and/or searching application data, (this is usually executed directly within a logging utility or within a reports feature or function) configure a filter based on any of the security criteria provided below.\n\nAlternatively, you can use security-oriented criteria provided by the application administrator.\n\nOnce the data filter has been selected, filter the audit event data so only filtered data is displayed and generate the report.\n\nThe report can be any combination of screen-based, soft copy, or a printed report.\n\nCriteria:\nUsers: e.g., specific users or groups\nEvent types:\nEvent dates and time:\nSystem resources involved: e.g., application components or modules.\nIP addresses:\nInformation objects accessed:\nEvent level categories: e.g., high, critical, warning, error\n\nIf the application does not provide on demand reports based on the filtered audit event data, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to generate soft copy, hard copy and/or screen-based reports based on the selected filtered event data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001876</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222490</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000364</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222490r961413_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001160</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide an audit reduction capability that supports on-demand audit review and analysis.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The ability to perform on-demand audit review and analysis, including after the audit data has been subjected to audit reduction, greatly facilitates the organization&apos;s ability to generate incident reports as needed to better handle larger-scale or more complex security incidents.\n\nAudit reduction is a technique used to reduce the volume of audit records in order to facilitate a manual review. Audit reduction does not alter original audit records. The report generation capability provided by the application must support on-demand (i.e., customizable, ad-hoc, and as-needed) reports.\n\nThis requirement is specific to applications with audit reduction capabilities; however, applications need to support on-demand audit review and analysis.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration.\n\nIdentify the application components and the logs associated with the components.\n\nIf the application utilizes a centralized logging system that provides the capability to generate reports based on filtered log events, this requirement is not applicable.\n\nUsing the relevant application features for generating reports and/or searching application data, (this is usually executed directly within a logging utility or within a reports feature or function) configure a filter based on any of the security criteria provided below.\n\nAlternatively, you can use security-oriented criteria provided by the application administrator.\n\nOnce the data filter has been selected, filter the audit event data so only filtered data is displayed and generate the report.\n\nThe report can be any combination of screen-based, soft copy, or a printed report.\n\nCriteria:\nUsers: e.g., specific users or groups\nEvent types:\nEvent dates and time:\nSystem resources involved: e.g., application components or modules.\nIP addresses:\nInformation objects accessed:\nEvent level categories: e.g., high, critical, warning, error\n\nIf the application does not provide an audit reduction capability that supports on-demand reports based on the filtered audit event data, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to log to a centralized auditing capability that provides on-demand reports based on the filtered audit event data or design or configure the application to meet the requirement.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001875</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222491</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000365</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222491r961416_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001170</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide an audit reduction capability that supports after-the-fact investigations of security incidents.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the audit reduction capability does not support after-the-fact investigations, it is difficult to establish, correlate, and investigate the events leading up to an outage or attack, or identify those responses for one. This capability is also required to comply with applicable Federal laws and DoD policies.\n\nAudit reduction capability must support after-the-fact investigations of security incidents either natively or through the use of third-party tools.\n\nThis requirement is specific to applications with audit reduction capabilities.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review application documentation and interview application administrator for details regarding audit reduction (log record event filtering).\n\nAccess the application with user rights sufficient to read and filter audit records.\n\nNavigate the application user interface and select the application functionality that provides access and interface to audit records and audit reduction (event filtering).\n\nIf the application uses a centralized logging solution that performs the audit reduction (event filtering) functions, the requirement is not applicable.\n\nExamine the log files; take note of dates and times of events such as logon events.\n\nNote: dates and times as well as the original content and any unique record identifiers.\n\nRecord the identifying information as well as the dates and times and content of the audit records.\n\nApply filters to reduce the amount of audit records displayed to just the logon events for the day.\n\nReview the records and ensure the application provides the ability to filter on audit events.\n\nIf the application does not provide an audit reduction (event filtering) capability, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to provide an audit reduction capability that supports forensic investigations.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001877</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222492</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000366</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222492r961419_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001180</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide a report generation capability that supports on-demand audit review and analysis.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The report generation capability must support on-demand review and analysis in order to facilitate the organization&apos;s ability to generate incident reports as needed to better handle larger-scale or more complex security incidents.\n\nReport generation must be capable of generating on-demand (i.e., customizable, ad-hoc, and as-needed) reports. On-demand reporting allows personnel to report issues more rapidly to more effectively meet reporting requirements. Collecting log data and aggregating it to present the data in a single, consolidated report achieves this objective.\n\nAudit reduction and report generation capabilities do not always reside on the same information system or within the same organizational entities conducting auditing activities. The audit reduction capability can include, for example, modern data mining techniques with advanced data filters to identify anomalous behavior in audit records. The report generation capability provided by the information system can generate customizable reports. Time ordering of audit records can be a significant issue if the granularity of the time stamp in the record is insufficient.\n\nThis requirement is specific to applications with report generation capabilities; however, applications need to support on-demand audit review and analysis.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering).\n\nAccess the application with user rights sufficient to read and filter audit records.\n\nNavigate the application user interface and select the application functionality that provides access and interface to audit records and audit reporting.\n\nIf the application uses a centralized logging solution that provides immediate, customizable audit review and analysis functions, the requirement is not applicable.\n\nCreate an event report. Report data can be based on date ranges, times or events, or other criteria that could be used in an investigation. Use of data from previous checks for audit reduction is encouraged.\n\nReview the report and ensure the data in the report coincides with event filters used to create the report.\n\nIf the application does not provide an immediate, ad-hoc audit review and analysis capability, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design or configure the application to provide an immediate audit review capability or utilize a centralized utility designed for the purpose of on-demand log management and reporting.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001878</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222493</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000367</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222493r961422_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001190</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide a report generation capability that supports on-demand reporting requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The report generation capability must support on-demand reporting in order to facilitate the organization&apos;s ability to generate incident reports as needed to better handle larger-scale or more complex security incidents.\n\nThe report generation capability provided by the application must be capable of generating on-demand (i.e., customizable, ad-hoc, and as-needed) reports. On-demand reporting allows personnel to report issues more rapidly to more effectively meet reporting requirements. Collecting log data and aggregating it to present the data in a single, consolidated report achieves this objective.\n\nThis requirement is specific to applications with report generation capabilities; however, applications need to support on-demand reporting requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering).\n\nAccess the application with user rights sufficient to read and filter audit records.\n\nNavigate the application user interface and select the application functionality that provides access and interface to audit records and audit reduction (event filtering).\n\nIf the application uses a centralized logging solution that provides immediate, customizable, ad-hoc report generation functions, the requirement is not applicable.\n\nCreate an event report. Report data can be based on date ranges, times or events, or other criteria that could be used in an investigation. Use of data from previous checks for audit reduction is encouraged.\n\nReview the report and ensure the data in the report coincides with event filters used to create the report.\n\nIf the application does not provide customizable, immediate, ad-hoc audit log reporting, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design or configure the application to provide an on-demand report generation capability or utilize a centralized utility designed for the purpose of on-demand log management and reporting.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001879</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222494</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000368</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222494r961425_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001200</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide a report generation capability that supports after-the-fact investigations of security incidents.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the report generation capability does not support after-the-fact investigations, it is difficult to establish, correlate, and investigate the events leading up to an outage or attack, or identify those responses for one. This capability is also required to comply with applicable Federal laws and DoD policies.\n\nThe report generation capability must support after-the-fact investigations of security incidents either natively or through the use of third-party tools.\n\nThis requirement is specific to applications with report generation capabilities; however, applications need to support on-demand reporting requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering).\n\nAccess the application with user rights sufficient to read and filter audit records.\n\nNavigate the application user interface and select the application functionality that provides access and interface to audit records and audit reduction (event filtering).\n\nIf the application uses a centralized logging solution that performs the report generation functions, the requirement is not applicable.\n\nCreate an event report. Report data can be based on date ranges, times or events, or other criteria that could be used in an investigation. Use of data from previous checks for audit reduction is encouraged.\n\nReview the report and ensure the data in the report coincides with event filters used to create the report.\n\nIf the application does not have a report generation capability that supports after the fact security investigations, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design or configure the application to provide after-the-fact report generation capability or utilize a centralized utility designed for the purpose of log management and reporting.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001880</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222495</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000369</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222495r961428_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001210</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide an audit reduction capability that does not alter original content or time ordering of audit records.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the audit reduction capability alters the content or time ordering of audit records, the integrity of the audit records is compromised, and the records are no longer usable for forensic analysis. Time ordering refers to the chronological organization of records based on time stamps. The degree of time stamp precision can affect this.\n\nAudit reduction is a process that manipulates collected audit information and organizes such information in a summary format that is more meaningful to analysts.\n\nThis requirement is specific to applications with audit reduction capabilities; however, applications need to support on-demand audit review and analysis.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering).\n\nAccess the application with user rights sufficient to read and filter audit records.\n\nNavigate the application user interface and select the application functionality that provides access and interface to audit records and audit reduction (event filtering).\n\nIf the application uses a centralized logging solution that performs the audit reduction (event filtering) functions, the requirement is not applicable.\n\nExamine the log files; take note of dates and times of events such as logon events.\n\nNote: dates and times as well as the original content and any unique record identifiers.\n\nRecord the identifying information as well as the dates and times and content of the audit records.\n\nApply filters to reduce the amount of audit records displayed to just the logon events for the day.\n\nReview the records and ensure nothing in the records has changed. Once validated, clear the filter and review the records again to validate nothing changed within the audit record itself.\n\nIf the application of event filters modifies the original log records, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to not alter original log content or time ordering of audit records.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001881</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222496</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000370</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222496r961431_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001220</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide a report generation capability that does not alter original content or time ordering of audit records.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the audit report generation capability alters the original content or time ordering of audit records, the integrity of the audit records is compromised, and the records are no longer usable for forensic analysis. Time ordering refers to the chronological organization of records based on time stamps. The degree of time stamp precision can affect this.\n\nThe report generation capability provided by the application can generate customizable reports.\n\nThis requirement is specific to applications with audit reduction capabilities; however, applications need to support on-demand audit review and analysis.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering).\n\nAccess the application with user rights sufficient to read and filter audit records.\n\nNavigate the application user interface and select the application functionality that provides access and interface to audit records and audit reduction (event filtering).\n\nIf the application does not provide a report generation capability, the requirement is not applicable.\n\nExamine the log files; take note of dates and times of events such as logon events.\n\nNote: dates and times as well as the original content and any unique record identifiers.\n\nRecord the identifying information as well as the dates and times and content of the audit records.\n\nApply filters to reduce the amount of audit records displayed to just the logon events for the day.\n\nReview the records and ensure nothing in the records has changed. Once validated, clear the filter and review the records again to validate nothing changed within the audit record itself.\n\nIf the application of event filters modifies the original log records, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure and design the application to not modify source logs when filtering events.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001882</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222497</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000116</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222497r960927_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001250</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The applications must use internal system clocks to generate time stamps for audit records.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without an internal clock used as the reference for the time stored on each event to provide a trusted common reference for the time, forensic analysis would be impeded. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events.\n\nIf the internal clock is not used, the system may not be able to provide time stamps for log messages. Additionally, externally generated time stamps may not be accurate. Applications can use the capability of an operating system or purpose-built module for this purpose.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration.\n\nIdentify the application components and the logs associated with the components.\n\nEnsure the time written into the logs coincides with the OS timeclock.\n\nAccess random audit records and review the most recent logs.\n \nAccess the system OS hosting the application and use the related OS commands to determine the time of the system.\n\nPerform an action in the application that causes a log event to be written and review the log to ensure the system times and the application log times correlate; compensating for any time delays that may have occurred between running the OS time command and running the application action.\n\nIf the application doesn&apos;t use the internal system clocks to generate time stamps for the audit event logs, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to use the hosting systems internal clock for audit record generation.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000159</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API emits audit records with a time stamp generated from the system clock.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222498</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000374</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222498r961443_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001260</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis.\n\nTime stamps generated by the application include date and time. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration.\n\nIdentify the application components and the logs associated with the components. \n\nIf the application utilizes the underlying OS system clock, and the system clock is mapped to UTC or GMT, this is not a finding.\n\nIdentify where clock settings are configured within the application.\n\nAccess the configuration settings and determine if the application is configured to set the time stamps for audit records according to UTC or GMT (e.g., East coast standard time is represented as GMT -5, east coast daylight savings time is represented as GMT-4).\n\nIf the application is not configured to map to UTC or GMT, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to use the underlying system clock that maps to relevant UTC or GMT timezone.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001890</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API emits audit records with the time stamp represented as an ISO-8601 string, including time zone.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222499</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000375</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222499r961446_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001270</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without sufficient granularity of time stamps, it is not possible to adequately determine the chronological order of records.\n\nTime stamps generated by the application include date and time. Granularity of time measurements refers to the degree of synchronization between information system clocks and reference clocks.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator to determine where application audit logs are written and how time stamps are recorded.\n\nIf the application utilizes the underlying OS for time stamping and time synchronization when writing the audit logs, this requirement is not applicable.\n\nAccess and review log files over a period of at least 10 minutes; compare time stamps written in the application log to the system clock to ensure time is synchronized to within 1 second of precision.\n\nIf the application audit log time stamps differ from the OS time source by more than one second, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to leverage the underlying operating system as the time source when recording time stamps or design the application to ensure granularity of 1 second as the minimum degree of precision.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001889</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API emits audit records with millisecond time stamp precision.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222500</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000118</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222500r960930_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001280</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must protect audit information from any type of unauthorized read access.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult if not impossible to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage.\n\nTo ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, and copy access.\n\nThis requirement can be achieved through multiple methods which will depend upon system architecture and design. Commonly employed methods for protecting audit information include least privilege permissions as well as restricting the location and number of log file repositories.\n\nAdditionally, applications with user interfaces to audit records should not allow for the unfettered manipulation of or access to those records via the application. If the application provides access to the audit data, the application becomes accountable for ensuring audit information is protected from unauthorized access.\n\nAudit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration.\n\nIdentify the application components and the logs associated with the components.\n\nIdentify the roles and users allowed to access audit information and the circumstances in which they are allowed to read or otherwise access the data.\n\nIdentify the methods used to manage audit records and audit components. Typical methods are file system-based, via an application user interface via database access or a combination thereof.\n\nFor file system access: Review file system permissions to ensure the audit logs and the application audit components such as executable files and libraries are protected by adequate file permission restrictions.\n\nPermissions must be configured to limit access to only those who have been identified and whose access has been approved.\n\nIf file permissions are configured to allow unapproved access, this is a finding.\n\nFor application-oriented and database access: Identify the application module that provides access to audit settings and audit data. Attempt to access audit configuration features and logs by using a regular non-privileged application or database user account.\n\nIf a non-privileged user account is allowed to access the audit data or the audit configuration settings, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to protect audit data from unauthorized access. Limit users to roles that are assigned the rights to view, edit or copy audit data, and establish permissions that control access to the audit logs and audit configuration settings.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000162</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222501</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000119</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222501r960933_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001290</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must protect audit information from unauthorized modification.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\n\nTo ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification.\n\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\n\nApplications providing a user interface to audit data will leverage user permissions and roles identifying the user accessing the data and the corresponding rights that the user enjoys in order to make access decisions regarding the modification of audit data.\n\nAudit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration.\n\nIdentify the application components and the logs associated with the components.\n\nIdentify the roles and users allowed to modify audit information and the circumstances in which they are allowed to modify the data.\n\nIdentify the methods used to manage audit records and audit components. Typical methods are file system-based, via an application user interface via database access or a combination thereof.\n\nFor file system access: Review file system permissions to ensure the audit logs and the application audit components such as executable files and libraries are protected by adequate file permission restrictions.\n\nPermissions must be configured to limit write/modify access to only those who have been identified and whose access has been approved.\n\nIf file permissions are configured to allow unapproved write/modify access, this is a finding.\n\nFor application oriented and database access: Identify the application module that provides access to audit settings and audit data. Attempt to access audit configuration features and logs by using a regular non-privileged application or database user account. Once access has been established, attempt to modify an audit record and attempt to modify the audit settings.\n\nIf a non-privileged user account is allowed to modify the audit data or the audit configuration settings, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to protect audit data from unauthorized modification and changes. Limit users to roles that are assigned the rights to edit audit data and establish permissions that control access to the audit logs and audit configuration settings.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000163</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222502</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000120</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222502r960936_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001300</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must protect audit information from unauthorized deletion.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\n\nTo ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized deletion. This requirement can be achieved through multiple methods, which will depend upon system architecture and design.\n\nSome commonly employed methods include: ensuring log files receive the proper file system permissions utilizing file system protections, restricting access, and backing up log data to ensure log data is retained.\n\nApplications providing a user interface to audit data will leverage user permissions and roles identifying the user accessing the data and the corresponding rights the user enjoys in order make access decisions regarding the deletion of audit data.\n\nAudit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. Audit information may include data from other applications or be included with the audit application itself.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration.\n\nIdentify the application components and the logs associated with the components.\n\nIdentify the roles and users allowed to delete audit information and the circumstances in which they are allowed to delete the data.\n\nIdentify the methods used to manage audit records and audit components. Typical methods are file system-based, via an application user interface via database access or a combination thereof.\n\nFor file system access: Review file system permissions to ensure the audit logs and the application audit components such as executable files and libraries are protected by adequate file permission restrictions.\n\nPermissions must be configured to limit deletions to only those who have been identified and whose rights to delete audit data and audit configurations has been approved.\n\nIf file permissions are configured to allow unapproved deletions of audit settings and data, this is a finding.\n\nFor application oriented and database access: Identify the application module that provides access to audit settings and audit data. Attempt to access audit configuration features and logs by using a regular non-privileged application or database user account. Once access has been established, attempt to delete a test audit record and attempt to delete a test audit settings.\n\nIf a non-privileged user account is allowed to delete the audit data or the audit configuration settings, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to protect audit data from unauthorized deletion. Limit users to roles that are assigned the rights to delete audit data and establish permissions that control access to the audit logs and audit configuration settings.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000164</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222503</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000121</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222503r960939_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001310</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must protect audit tools from unauthorized access.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data.\n\nApplications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the access to audit tools.\n\nAudit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and audit tools.\n\nIdentify the application audit tools and their locations.\n\nIf the application does not provide a distinct audit tool oriented functionality that is a separate tool with an ability to view and manipulate log data, this requirement is not applicable.\n\nIdentify the methods used for implementing the audit tool functionality within the application. Typical methods are file system-based, e.g., a separate executable file that when invoked provides audit functionality, an application user interface to an audit module, or a combination thereof.\n\nFor file system access: Review file system permissions to ensure the application audit components such as executable files and libraries are protected by adequate file permission restrictions.\n\nPermissions must be configured to limit access to only those who have been identified and whose access has been approved.\n\nIf file permissions are configured to allow unapproved access, this is a finding.\n\nFor circumstances where audit tools are accessed via application sub-modules or menus: Identify the application module that provides access to audit settings and audit data. Attempt to access audit configuration features and logs by using a regular non-privileged application or database user account.\n\nIf a non-privileged user account is allowed to access the audit data or the audit configuration settings, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to protect audit data from unauthorized access. Limit users to roles that are assigned the rights to view, edit or copy audit data, and establish file permissions that control access to the audit tools and audit tool capabilities and configuration settings.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001493</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222504</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000122</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222504r960942_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001320</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must protect audit tools from unauthorized modification.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data.\n\nApplications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the modification of audit tools.\n\nAudit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and provided audit tools.\n\nIdentify the application audit tools and their locations.\n\nIf the application does not provide a distinct audit tool oriented functionality that is a separate tool with an ability to view and manipulate log data, this requirement is not applicable.\n\nIdentify the methods used for implementing an audit tool functionality that is separate from the application. Typical methods are file-oriented in nature, e.g., the application includes a separate executable file or library that when invoked allows users to view and manipulate logs.\n\nIdentify the users with the rights to modify the audit tools. This capability will usually be reserved for admin staff.\n\nReview file system permissions to ensure the application audit components such as executable files and libraries are protected by adequate file permission restrictions.\n\nFile permissions must be configured to limit access to only those users who have been identified and whose access has been approved.\n\nIf file permissions are configured so as to allow unapproved modifications to the audit tools, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to protect audit tools from unauthorized modifications. Limit users to roles that are assigned the rights to edit or update audit tools and establish file permissions that control access to the audit tools and audit tool capabilities and configuration settings.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001494</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222505</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000123</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222505r960945_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001330</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must protect audit tools from unauthorized deletion.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data.\n\nApplications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the deletion of audit tools.\n\nAudit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator for details regarding application architecture, audit methods and provided audit tools.\n\nIdentify the application audit tools and their locations.\n\nIf the application does not provide a distinct audit tool oriented functionality that is a separate tool with an ability to view and manipulate log data, this requirement is not applicable.\n\nIdentify the methods used for implementing an audit tool functionality that is separate from the application. Typical methods are file-oriented in nature, e.g., the application includes a separate executable file or library that when invoked allows users to view and manipulate logs.\n\nIdentify the users with the rights to delete the audit tools. This capability is normally reserved for admin staff.\n\nReview file system permissions to ensure the application audit components such as executable files and libraries are protected by adequate file permission restrictions.\n\nFile permissions must be configured to limit access to only those users who have been identified and whose access has been approved.\n\nIf file permissions are configured to allow unapproved deletions of the audit tools, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to protect audit tools from unauthorized deletions. Limit users to roles that are assigned the rights to edit or delete audit tools and establish file permissions that control access to the audit tools and audit tool capabilities and configuration settings.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001495</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222506</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000125</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222506r960948_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001340</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must back up audit records at least every seven days onto a different system or system component than the system or component being audited.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to a different system or onto separate media than the system being audited on an organizationally defined frequency helps to assure in the event of a catastrophic system failure, the audit records will be retained.\n\nThis helps to ensure a compromise of the information system being audited does not also result in a compromise of the audit records.\n\nThis requirement only applies to applications that have a native backup capability for audit records. Operating system backup requirements cover applications that do not provide native backup functions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify log functionality and locations of log files.\n\nIf the application does not include a built-in backup capability for backing up its own audit records, this requirement is not applicable.\n\nAccess the management interface for configuring application audit logs and review the backup settings.\n\nIf the application backup settings are not configured to backup application audit records every 7 days, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure application backup settings to backup application audit logs every 7 days.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001348</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222507</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000126</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222507r960951_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001350</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must use cryptographic mechanisms to protect the integrity of audit information.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Audit records may be tampered with; if the integrity of audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\n\nProtection of audit records and audit data is of critical importance. Cryptographic mechanisms are the industry established standard used to protect the integrity of audit data. An example of a cryptographic mechanism is the computation and application of a cryptographic-signed hash using asymmetric cryptography.\n\nThis requirement applies to applications that generate, process or manage audit records and is applied once audit processing has completed and the audit record is being stored.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and provided audit tools.\n\nIdentify the location of the application audit information.\n\nIf the application is configured to utilize a centralized audit log solution that uses cryptographic methods that meet this requirement such as creating cryptographic hash values or message digests that can be used to validate integrity of audit files, the requirement is not applicable.\n\nAsk application administrator to demonstrate the cryptographic mechanisms used to protect the integrity of audit data.\n\nVerify when application logs are stored on the file system, a process that includes the creation of an integrity check of the audit file being stored is utilized. This integrity check can be the creation of a checksum, message digest or other one-way cryptographic hash of the audit file that is created.\n\nIf an integrity check is not created to protect the integrity of the audit information, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to create an integrity check consisting of a cryptographic hash or one-way digest that can be used to establish the integrity when storing log files.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001350</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222508</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000290</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222508r961206_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001360</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application audit tools must be cryptographically hashed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Protecting the integrity of the tools used for auditing purposes is a critical step to ensuring the integrity of audit data. Audit data includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.\n\nAudit tools include, but are not limited to, vendor provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.\n\nIt is not uncommon for attackers to replace the audit tools or inject code into the existing tools with the purpose of providing the capability to hide or erase system activity from the audit logs.\n\nTo address this risk, audit tools must be cryptographically signed/hashed and the resulting value securely stored in order to provide the capability to identify when the audit tools have been modified, manipulated or replaced.\n\nSome OSs provide a native command line tool capable of extracting or creating a hash value. Care must be taken to ensure any hashing algorithm strength used is acceptable.  An example is UNIX OS variants that provide the &quot;shasum&quot; utility with SHA256 capabilities.  Windows is not known to provide a native cryptographic tool that utilizes an acceptable hashing algorithm.  The Windows fciv.exe checksum tool currently only utilizes MD5 and SHA1 which are not acceptable hashing algorithms.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and provided audit tools.\n\nIdentify the location of the application audit tools.\n\nSeparate audit tools will be file-oriented in nature, e.g., the application includes a separate executable file or library that when invoked allows users to view and manipulate logs.\n\nIf the application does not provide a separate tool in the form of a file which provides an ability to view and manipulate application log data, query data, or generate reports, this requirement is not applicable.\n\nIf the system hosting the application has a separate file monitoring utility installed that is configured to identify changes to audit tools and alarm on changes to audit tools, this is not applicable.\n\nAsk application administrator to demonstrate the cryptographic hashing mechanisms used to create the one way hashes that can be used to validate the integrity of audit tools.\n\nFor example, &quot;shasum /path/to/file &gt; checksum.filename&quot;.\n\nAsk the application administrator to provide the list of checksum values and the associated file names of the audit tools.\n\nIf a cryptographic checksum or hash value of the audit tool file is not created for future reference, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Cryptographically hash the audit tool files used by the application. Store and protect the generated hash values for future reference.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001496</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution. The project does not provide a separate tool in the form of a file which provides an ability to view and manipulate application log data, query data, or generate reports</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222509</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000290</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222509r961206_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001370</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The integrity of the audit tools must be validated by checking the files for changes in the cryptographic hash value.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Protecting the integrity of the tools used for auditing purposes is a critical step to ensuring the integrity of audit data. Audit data includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.\n\nAudit tools include, but are not limited to, vendor provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.\n\nIt is not uncommon for attackers to replace the audit tools or inject code into the existing tools with the purpose of providing the capability to hide or erase system activity from the audit logs. \n\nTo address this risk, audit tools must be cryptographically signed/hashed in order to provide the capability to identify when the audit tools have been modified, manipulated or replaced. An example is a checksum hash of the file or files.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and provided audit tools.\n\nIdentify the location of the application audit tools.\n\nSeparate audit tools will be file-oriented in nature, e.g., the application includes a separate executable file or library that when invoked allows users to view and manipulate logs.\n\nIf the application does not provide a separate tool in the form of a file which provides an ability to view and manipulate application log data, query data or generate reports, this requirement is not applicable.\n\nIf the system hosting the application has a separate file monitoring utility installed that is configured to identify changes to audit tools and alarm on changes to audit tools, this is not applicable.\n\nAsk the application administrator to provide their process for periodically checking the list of checksum values against the associated file names of the audit tools to ensure none of the audit tools have been tampered with.\n\nIf a cryptographic checksum or hash value of the audit tool file is not periodically checked to ensure the integrity of audit tools, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Establish a process to periodically check the audit tool cryptographic hashes to ensure the audit tools have not been tampered with.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001496</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution. The project does not provide a separate tool in the form of a file which provides an ability to view and manipulate application log data, query data or generate reports.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222510</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000378</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222510r1015689_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001390</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must prohibit user installation of software without explicit privileged status.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Allowing regular users to install software without explicit privileges creates the risk that untested or potentially malicious software will be installed on the system. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user.\n\nApplication functionality will vary, and while users are not permitted to install unapproved applications, there may be instances where the organization allows the user to install approved software packages such as from an approved software repository.\n\nThe application must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose pedigree with regard to being potentially malicious is unknown or suspect) by the organization.\n\nFor example, this requirement applies to applications that provide the ability to extend application functionality (e.g., plug-ins, add-ons) and software management applications.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to determine the capabilities of the application as it relates to software installation or product function extension.\n\nIdentify any software configuration change capabilities which are allowed by design and incorporated into the user interface. An example is utilizing a known software repository of tested and approved extensions, plugins, or modules which can be used by application users to extend application features or functions.\n\nIf the application does not provide the ability to install software components, modules, plugins, or extensions, the requirement is Not Applicable.\n\nAccess the application user interface as a regular user, navigate to the application screen that provides the software installation function and attempt to install software components, modules, extensions, or plugins.\n\nIf the application utilizes an approved repository of approved software that has been tested and approved for all application users to install, this is not a finding.\n\nIf the application allows regular users to install untested or unapproved software components, extensions, modules, or plugins without explicit authorization, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to prohibit user installation of software without explicit permission.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001812</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003980</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The project does not provide the ability to install software components, modules, plugins, or extensions,</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222511</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000380</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222511r961461_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001410</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must enforce access restrictions associated with changes to application configuration.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Failure to provide logical access restrictions associated with changes to application configuration may have significant effects on the overall security of the system.\n\nWhen dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system.\n\nAccordingly, only qualified and authorized individuals should be allowed to obtain access to application components for the purposes of initiating changes, including upgrades and modifications.\n\nLogical access restrictions include, for example, controls that restrict access to workflow automation, media libraries, abstract layers (e.g., changes implemented into third-party interfaces rather than directly into information systems), and change windows (e.g., changes occur only during specified times, making unauthorized changes easy to discover).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and configuration settings.\n\nAccess the application configuration settings interface as a regular non-privileged user. Attempt to make configuration changes to the application.\n\nIf configuration changes can be made by regular non-privileged users, this is a finding.\n\nReview the locations of all configuration files used by the application.\n\nExamine the file permission settings and determine who has access to the configuration files.\n\nIf access permissions to configuration files are not restricted to application administrators, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to limit access to configuration settings to only authorized users.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001813</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The application cannot configure itself, and does not offer any configuration mechanisms that are affected by users or config files.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222512</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000381</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222512r1015690_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001420</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must audit who makes configuration changes to the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without auditing the enforcement of access restrictions against changes to the application configuration, it will be difficult to identify attempted attacks and an audit trail will not be available for forensic investigation for after-the-fact actions.\n\nEnforcement actions are the methods or mechanisms used to prevent unauthorized changes to configuration settings. Enforcement action methods may be as simple as denying access to a file based on the application of file permissions (access restriction). Audit items may consist of lists of actions blocked by access restrictions or changes identified after the fact.\n\nIf application configuration is maintained by using a text editor to modify a configuration file, this function may be delegated to an operating system file monitoring/auditing capability.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and configuration settings.\n\nAccess the application configuration settings interface as a privileged user.\n\nMake configuration changes to the application.\n\nReview the application audit logs and ensure a log entry is made identifying the privileged user account that was used to make the changes.\n\nIf application configuration is maintained by using a text editor to modify a configuration file, modify the configuration file with a text editor. Review the system logs and ensure a log entry is made for the file modification that identifies the user that was used to make the changes.\n\nIf the user account is not logged, or is a group account such as &quot;root&quot;, this is a finding.\n\nIf the user account used to make the changes is not logged in the audit records, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to create log entries that can be used to identify the user accounts that make application configuration changes.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001814</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003938</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The application cannot configure itself, and does not offer any configuration mechanisms that are affected by users or config files. The project should be deployed with a Application Services layer (Container Platform such as k8s)  that audits configuration changes to the application.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222513</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000131</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222513r1015691_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001430</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must have the capability to prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Changes to any software components can have significant effects on the overall security of the application. Verifying software components have been digitally signed using a certificate that is recognized and approved by the organization ensures the software has not been tampered with and that it has been provided by a trusted vendor.\n\nAccordingly, patches, service packs, or application components must be signed with a certificate recognized and approved by the organization.\n\nVerifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The application should not have to verify the software again. This requirement does not mandate DOD certificates for this purpose; however, the certificate used to verify the software must be from an approved certificate authority (CA).\n\nIf this capability is not present, the vendor must provide a cryptographic hash value that can be verified by a system administrator prior to installation.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to determine the process and commands used for patching the application.\n\nAccess application configuration settings.\n\nReview commands and procedures used to patch the application and ensure a capability exists to prevent unsigned patches from being applied.\n\nIf the application is not capable of preventing installation of patches and packages that are not signed, or if the vendor does not provide a cryptographic hash value that can be manually checked prior to installation, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to have the capability to prevent unsigned patches and packages from being installed.\n\nProvide a cryptographic hash value that can be verified by a system administrator prior to installation.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001749</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003992</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The application is offered as containerized API/Web Client builds that are signed using Docker Content Trust.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222514</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000133</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222514r960960_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001440</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The applications must limit privileges to change the software resident within software libraries.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.\n\nThis requirement applies to applications with software libraries that are accessible and configurable, as in the case of interpreted languages. Software libraries also include privileged programs which execute with escalated privileges. Only qualified and authorized individuals will be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify the application architecture.\n\nIdentify application folders where application libraries are stored.\n\nReview permissions of application folders and library files contained with the folders to ensure file permissions restrict access to authorized users or processes.\n\nAccess application configuration settings.\n\nExamine settings for capability to update software libraries or extend application functionality via the application.\n\nReview user roles and access rights within the application to determine if access to this capability is restricted to authorized users.\n\nIf file restrictions do not limit write access to library files and if the application does not restrict access to library update functionality, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application OS file permissions to restrict access to software libraries and configure the application to restrict user access regarding software library update functionality to only authorized users or processes.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001499</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The API is designed to be stateless and runnable in a read-only  container.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222515</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222515r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001460</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>An application vulnerability assessment must be conducted.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>An application vulnerability assessment is a test conducted in order to identify weaknesses and security vulnerabilities that may exist within an application.  The testing must cover all aspects and components of the application architecture.  If an application consists of a web server and a database, then both components must be tested for vulnerabilities to the fullest extent possible.\n\nVulnerability assessment tests normally utilize a combination of specialized software called application vulnerability scanners as well as custom scripts and manual tests.  In some instances, multiple tools are required in order to test all aspects of application features, functions and architecture.  The vulnerability scanner is typically configured to communicate with the application through the user interface or via an applications communication port.  In addition to using automated tools, manual tests conducted from the OS console such as executing custom scripts or reviewing configuration settings for known vulnerabilities may also be included as part of the test.\n\nTesters will typically utilize application user test accounts in order to test application features and functionality such as adding content, executing queries and completing transactions. The vulnerability testing software utilizes user actions and access as well as a list of known security vulnerabilities in order to detect and identify weak security controls or misconfigurations that could potentially be manipulated by the user or create a security vulnerability.\n\nThe Open Web Application Security Project (OWASP) top 10 for 2013 includes the following top issues that should be tested.  The site is available by pointing your browser to https://www.owasp.org. \n\nA1 Injection\nA2 Weak authentication and session management\nA3 XSS\nA4 Insecure Direct Object References\nA5 Security Misconfiguration\nA6 Sensitive Data Exposure\nA7 Missing Function Level Access Control\nA8 Cross Site Request Forgery\nA9 Using Components with Known Vulnerabilities\nA10 Unvalidated Redirects and Forwards\n\nThe OWASP top 10 are categories of tests that can be applied to most but not necessarily all applications and are provided as an example of what to test for.  Scanning tools include a multitude of tests that fall under these categories but may refer to these tests by a different name.\n\nTesting must be conducted on a periodic basis while the application is in production and subsequent to system changes to ensure any changes made to the system do not introduce new security vulnerabilities.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation to understand application architecture.\n\nInterview the application administrator, obtain and review their application vulnerability scanning process.\n\nRequest the latest scan results including scan configuration settings.\n\nReview scan configurations and ensure coverage of all application architecture has been tested.  The proper scanning tool or combination of tools must be utilized in order to ensure the full range of application features and functionality is tested. \n\nFor example, if the application includes a web interface and a SQL database, then ensure test results for web and SQL vulnerabilities are provided.  Although web and SQL applications are included as examples and are the prevalent types of applications, this requirement is not intended to be limited to just the aforementioned application architectures.   Ensure test results are provided from all testing tools employed during vulnerability testing.\n\nIf high risk security vulnerabilities are identified in the scan results, request subsequent test results that indicate the issues have been fixed or mitigated.\n\nIf the high risk issues identified in the report have not been fixed or mitigated to a level accepted by the ISSO and the ISSM, or if the application administrator cannot produce vulnerability security testing results that cover the range of application functionality, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application vulnerability scanners to test all components of the application, conduct vulnerability scans on a regular basis and remediate identified issues.  Retain scan results for compliance verification.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000366</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Deployments must be scanned according to individual or organizational policies. Developers scan the codebase regularly in a test environment, but this is only one component of a functioning production deployment.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000384</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222516r961473_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001480</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must prevent program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Control of application execution is a mechanism used to prevent execution of unauthorized applications in order to follow the rules of least privilege. Some applications may provide a capability that runs counter to the mission or provides users with functionality that exceeds mission requirements.\n\nSome of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Removal of executable programs is not always possible; therefore, establishing a method of preventing program execution is critical to maintaining a secure system baseline.\n\nSoftware program restrictions include restricting execution of programs in certain environments, while preventing execution in other environments; or limiting execution of certain application functionality based on organization-defined criteria (e.g., privileges, subnets, sandboxed environments, security managers, roles).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to determine if policies, rules, or restrictions exist regarding application usage or terms which authorize the conditions of application use.\n\nIf the policy, terms, or conditions state there are no usage restrictions, this requirement is not applicable.\n\nInterview the application administrator, review policy, terms, and conditions documents to determine what the terms and conditions of application usage are.\n\nHave the application administrator demonstrate how the program execution is restricted in accordance with the policy terms and conditions. Typical methods include but are not limited to the use of Windows Group Policy, AppLocker, Software Restriction Policies, Java Security Manager, and Role-Based Access Control (RBAC).\n\nIf application requirements or policy documents specify application execution restriction requirements and the execution of the application or its subcomponents are not restricted in accordance with requirements or policy, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Restrict application execution in accordance with the policy, terms, and conditions specified.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001764</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage are determined locally and not by the project.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222517</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000386</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222517r961479_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001490</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must employ a deny-all, permit-by-exception (whitelist) policy to allow the execution of authorized software programs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities.\n\nThe organization must identify authorized software programs and permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.\n\nVerification of whitelisted software can occur either prior to execution or at system startup.\n\nThis requirement applies to configuration management applications or similar types of applications designed to manage system processes and configurations (e.g., HBSS and software wrappers).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application is not a configuration management or similar type of application designed to manage system processes and configurations, this requirement is not applicable.\n\nReview the application documentation and interview the application administrator to identify if application whitelisting specifying which applications or application subcomponents are allowed to execute is in use.\n\nCheck for the existence of policy settings or policy files that can be configured to restrict application execution. Have the application administrator demonstrate how the program execution is restricted. Look for a deny-all, permit-by-exception policy of restriction.\n\nSome methods for restricting execution include but are not limited to the use of custom capabilities built into the application or leveraging of Windows Group Policy, AppLocker, Software Restriction Policies, Java Security Manager or Role-Based Access Controls (RBAC).\n\nIf application whitelisting is not utilized or does not follow a deny-all, permit-by-exception (whitelist) policy, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to utilize a deny-all, permit-by-exception policy when allowing the execution of authorized software.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001774</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The application is not a configuration management or similar type of application designed to manage system processes and configurations, this requirement is not applicable.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222518</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000141</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222518r960963_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001500</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must be configured to disable non-essential capabilities.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\n\nApplications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).\n\nExamples of non-essential capabilities include, but are not limited to, advertising software or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but cannot be disabled.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application guidance, application requirements documentation, and interview the application administrator.\n\nIdentify the application&apos;s operational requirements and what services the application is intended to provide users.\n\nReview the overall application features and functionality via the user interface.\n\nReview and identify installed application software modules via configuration settings.\n\nUsing the relevant OS commands, identify services running on the system and have the application administrator identify the services related to the application.\n\nIf the application is operating with extraneous capabilities that have not been defined as required in order to meet mission objectives, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Disable application extraneous application functionality that is not required in order to fulfill the application&apos;s mission.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000381</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The application runs only essential services needed for operation.  Container images are based on either the Alpine Linux distribution or the Iron Bank Universal Base Image (UBI).</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222519</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000142</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222519r1043177_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001510</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must be configured to use only functions, ports, and protocols permitted to it in the PPSM CAL.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\n\nApplications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services; however, doing so increases risk over limiting the services provided by any one component.\n\nTo support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and configuration.\n\nInterview the application administrator.\n\nIdentify the network ports and protocols that are utilized by the application.\n\nUsing a combination of relevant OS commands and application configuration utilities, identify the TCP/IP port numbers the application is configured to utilize and is utilizing.\n\nReview the PPSM Category Assurance List (CAL) at: \n\nhttps://cyber.mil/ppsm/cal/\n\nVerify the ports used by the application are approved by the PPSM CAL.\n\nIf the ports are not approved by the PPSM CAL, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to utilize application ports approved by the PPSM CAL.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000382</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>PPS features are implemented by the Container Platform service.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222520</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000389</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222520r1050664_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001520</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without reauthentication, users may access resources or perform tasks for which they do not have authorization.\n\nWhen applications provide the capability to change security roles or escalate the functional capability of the application, it is critical the user reauthenticate.\n\nIn addition to the reauthentication requirements associated with session locks, organizations may require reauthentication of individuals and/or devices in other situations, including (but not limited to) the following circumstances:\n\n(i) When authenticators change;\n(ii) When roles change;\n(iii) When security categories of information systems change;\n(iv) When the execution of privileged functions occurs;\n(v) After a fixed period of time;\nor\n(vi) Periodically.\n\nWithin the DOD, the minimum circumstances requiring reauthentication are privilege escalation and role changes.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application guidance and interview the application administrator.\n\nIdentify the application user roles.\n\nIdentify the methods and manner in which an application user is allowed to escalate their privileges or change their role.\n\nCreate or utilize an account that has two roles within the application, both should be nonadministrator.\nExample: User role and Report Creator role.\n\nAuthenticate to the application as the user in the User role.\n\nAccess the application functionality that allows the user to change their role and change from the User role to the Report Creator role.\n\nIf the user is not prompted to reauthenticate before the user’s role is changed, this is a finding.\n\nLog out of the application and log back in as the User role.\n\nAccess the application functionality that allows the user to escalate their privileges to an administrative user.\n\nAttempt to escalate the privileges of the user.\n\nIf the user is not prompted to reauthenticate before the user is allowed to proceed with escalated privileges, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to require reauthentication before user privilege is escalated and user roles are changed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002038</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004895</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider. Reauthentication policies are locally defined and implemented.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222521</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000390</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222521r985974_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001530</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must require devices to reauthenticate when organization-defined circumstances or situations requiring reauthentication.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without reauthenticating devices, unidentified or unknown devices may be introduced; thereby facilitating malicious activity.\n\nIn addition to the reauthentication requirements associated with session locks, organizations may require reauthentication of devices, including (but not limited to), the following other situations:\n\n(i) When authenticators change;\n(ii) When roles change;\n(iii) When security categories of information systems change;\n(iv) After a fixed period of time;\nor\n(v) Periodically.\n\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification decisions (as opposed to the actual identifiers) to the services that need to act on those decisions.\n\nGateways and SOA applications are examples of where this requirement would apply.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application guidance and interview the application administrator.\n\nIdentify the methods and manner in which application devices such as an XML gateway, SOA application gateway, or application firewall is allowed to access the application. Most devices themselves will not change role or authenticators once they are established but will need to periodically reauthenticate.\n\nReview the configuration setting in the application where the time period is set to force the device to reauthenticate.\n\nReview local policy requirements to determine if reauthentication intervals are specified.\n\nIf the device is not forced to reauthenticate periodically, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to require reauthentication periodically.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002038</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider. Reauthentication policies are locally defined and implemented.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222522</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000148</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222522r1051115_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001540</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). \n\nOrganizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following:\n\n(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and \n(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to determine how organizational users access the application.\n\nIf the application is publicly available, providing access to publicly releasable data and the users are non-organizational users such as individuals who no longer have a CAC (e.g., retirees) or  members of the public with no requirement for DoD credentials, this requirement is not applicable.\n\nThe requirement still applies to DoD organizational users and admins when accessing the non-public data areas or system resources of the system.\n\nAttempt to access the application and confirm that a unique user account and password or CAC token and pin are required in order to access the application.\n\nIf the application does not uniquely identify and authenticate users, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to uniquely identify and authenticate users and user processes.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000764</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222523</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000149</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222523r960972_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001550</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must use multifactor (Alt. Token) authentication for network access to privileged accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Multifactor authentication requires using two or more factors to achieve authentication and access.\n\nFactors include:\n(i) something a user knows (e.g., password/PIN);\n(ii) something a user has (e.g., cryptographic identification device, token); or\n(iii) something a user is (e.g., biometric).\n\nMultifactor authentication decreases the attack surface by virtue of the fact that attackers must obtain two factors, a physical token or a biometric and a PIN, in order to authenticate.  It is not enough to simply steal a user&apos;s password to obtain access.  \n\nA privileged account is defined as an information system account with authorizations of a privileged user.  \n\nAn Alt. Token is a separate CAC like token used specifically for administrative account access and serves as a separate identifier much like a separate user account.\n\nNetwork access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the Internet).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application access methods.\n\nAsk the application administrator to present both their primary CAC and their Alt. Token.  Ask the application administrator to log on to the application using application relevant network based access methods.  Attempt to use both CAC and Alt. Tokens to authenticate to the application. \n\nValidate the application requests the user to input their CAC PIN and that they cannot perform administrative functions.\n\nHave user logoff and reauthenticate with their Alt. Token and that they can perform administrative functions.\n\nIf the application allows administrative access to the application without requiring an Alt. Token, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to use an Alt. Token when providing network access to privileged application accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000765</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222524</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000391</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222524r961494_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001560</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must accept Personal Identity Verification (PIV) credentials.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\n\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application access methods.\n\nIf the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable.\n\nAsk the application administrator to log on to the application. Have the application admin use their non-privileged credentials.\n\nValidate the application prompts the user to provide a certificate from the CAC.\n\nIf the application allows access without requiring a CAC, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to require CAC authentication.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001953</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222525</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000392</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222525r961497_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001570</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must electronically verify Personal Identity Verification (PIV) credentials.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\n\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.\n\nIf the application does not verify the credentials provided, user authentication cannot be established which places the integrity and confidentiality of the application at risk.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application access methods.\n\nIf the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable.\n\nAsk the application administrator to log on to the application.\n\nValidate the application prompts the user to provide a certificate from the CAC.\n\nValidate the application requests the user to input their CAC PIN.\n\nIf the application allows access without requiring a CAC, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to require CAC authentication.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001954</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider. Reauthentication policies are locally defined and implemented.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222526</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000150</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222526r960975_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001580</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must use multifactor (e.g., CAC, Alt. Token) authentication for network access to non-privileged accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.\n\nMultifactor authentication uses two or more factors to achieve authentication.\n\nFactors include:\n\n(i) Something you know (e.g., password/PIN);\n(ii) Something you have (e.g., cryptographic identification device, CAC/SIPRNet token); or\n(iii) Something you are (e.g., biometric).\n\nA non-privileged account is any information system account with authorizations of a non-privileged user.\n\nNetwork access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection.\n\nApplications integrating with the DoD Active Directory and utilize the DoD CAC are an example of compliant multifactor authentication solutions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application access methods.\n\nIf the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable.\n\nAsk the application administrator to log on to the application. Have the application admin use their non-privileged credentials.\n\nValidate the application prompts the user to provide a certificate from the CAC.\n\nValidate the application requests the user to input their CAC PIN. \n\nIf the application allows access without requiring a CAC or Alt. Token, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to require CAC or Alt. Token authentication for non-privileged network access to non-privileged accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000766</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222527</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000151</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222527r1015693_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001590</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must use multifactor (Alt. Token) authentication for local access to privileged accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Multifactor authentication (MFA) requires using two or more factors to achieve authentication and access.\n\nFactors include:\n(i) something a user knows (e.g., password/PIN);\n(ii) something a user has (e.g., cryptographic identification device, token); or\n(iii) something a user is (e.g., biometric).\n\nMFA decreases the attack surface by virtue of the fact that attackers must obtain two factors, a physical token or a biometric and a PIN, in order to authenticate. It is not enough to simply steal a user&apos;s password to obtain access. \n\nA privileged account is defined as an information system account with authorizations of a privileged user.\n\nAn Alt. Token is a separate CAC or token used specifically for administrative account access and serves as a separate identifier much like a separate user account.\n\nLocal access is defined as access to an organizational information system by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application access methods.\n\nAsk the application administrator to present both their primary CAC and their Alt. Token. Ask the application administrator to log on to the application using the local application console. \n\nAttempt to use both the CAC and Alt. Tokens to authenticate to the application.\n\nValidate the application requests the user to input their CAC PIN and that they cannot perform administrative functions.\n\nHave user log off and reauthenticate with their Alt. Token and verify they can perform administrative functions.\n\nIf the application allows administrative access to the application without requiring an Alt. Token, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to only use Alt. Tokens when locally accessing privileged application accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000765</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000767</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222528</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000152</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222528r1015694_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001600</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must use multifactor (e.g., CAC, Alt. Token) authentication for local access to nonprivileged accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>To assure accountability, prevent unauthenticated access, and prevent misuse of the system, privileged users must utilize multifactor authentication (MFA) for local access.\n\nMFA is defined as using two or more factors to achieve authentication.\n\nFactors include:\n(i) Something a user knows (e.g., password/PIN);\n(ii) Something a user has (e.g., cryptographic identification device, token); or\n(iii) Something a user is (e.g., biometric).\n\nA nonprivileged account is defined as an information system account with authorizations of a regular or nonprivileged user.\n\nLocal access is defined as access to an organizational information system by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network.\n\nApplications integrating with the DOD Active Directory and utilize the DOD CAC are examples of compliant multifactor authentication solutions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application access methods.\n\nIf the application is not PKI-enabled due to the hosted data being publicly releasable, this check is Not Applicable.\n\nAsk the application administrator to log on to the application. Have the application admin use their nonprivileged credentials.\n\nValidate the application prompts the user to provide a certificate from the CAC.\n\nValidate the application requests the user to input their CAC PIN.\n\nIf the application allows access without requiring a CAC or Alt. Token, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to require CAC or Alt. Token authentication for nonprivileged network access.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000766</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000768</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222529</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000153</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222529r1015695_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001610</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must ensure users are authenticated with an individual authenticator prior to using a group authenticator.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>To ensure individual accountability and prevent unauthorized access, application users must be individually identified and authenticated. Individual accountability mandates that each user is uniquely identified.\n\nA group authenticator is a shared account or some other form of authentication that allows multiple unique individuals to access the application using a single account.\n\nIf an application allows or provides for group authenticators, it must first individually authenticate users prior to implementing group authenticator functionality.\n\nSome applications may not have the need to provide a group authenticator; this is considered a matter of application design. In those instances where the application design includes the use of a group authenticator, this requirement will apply.\n\nThere may also be instances when specific user actions need to be performed on the information system without unique user identification or authentication. An example of this type of access is a web server which contains publicly releasable information.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation, examine user accounts and group membership, and interview the application administrator to identify group or shared accounts. Document the group or shared account information.\n\nIf the application does not use group or shared accounts, this requirement is Not Applicable.\n\nCreate a test account or use an existing group member account.\n\nEnsure the test account is not authenticated to the application and attempt to access the application with the group account credentials.\n\nIf the application allows access without first requiring the group member to authenticate with their individual credentials, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to individually authenticate group account members prior to allowing access.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000770</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004045</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The project does not use group or shared accounts.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222530</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000156</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222530r960993_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001620</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must implement replay-resistant authentication mechanisms for network access to privileged accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack.\n\nAn authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message.\n\nA privileged account is any information system account with authorizations of a privileged user.\n\nTechniques used to address this include protocols using nonces (e.g., numbers generated for a specific one time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review application documentation and interview application administrator to identify what authentication mechanisms are used when accessing the application.\n\nIf the application is hosting publicly releasable information that does not require authentication, or if the application users are not eligible for a DoD CAC as per DoD 8520, this requirement is not applicable.\n\nReview to ensure the application is utilizing TLSV1.2 or greater to protect communication and privileged user authentication traffic.\n\nVerify the application utilizes a strong authentication mechanism such as Kerberos, IPSEC, or Secure Shell (SSH).\n\n- Cryptographically sign web services packets.\n- Time stamps and cryptographic hashes are used with web services packets.\n- Use WS_Security for web services.\n\nRequest the most recent vulnerability scan results and configuration settings.\n\nVerify the configuration is set to test for known replay vulnerabilities.\n\nRequest code review results (if available) and review for issues that have been identified as potential replay attack vulnerabilities.\n\nVerify identified issues have been remediated.\n\nIf the application is not implementing replay-resistant authentication methods applicable to the application architecture, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to utilize replay-resistant mechanisms when authenticating privileged accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001941</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Replay-resistant authentication mechanisms are implemented by the OIDC Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222531</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000157</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222531r1015696_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001630</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A replay attack is a man-in-the-middle style attack which allows an attacker to repeat or alter a valid data transmission that may enable unauthorized access to the application. Authentication sessions between the authenticating client and the application server validating the user credentials must not be vulnerable to a replay attack.\n\nThe protection methods selected to protect against a replay attack will vary according to the application architecture.\n\nAn authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message.\n\nA nonprivileged account is any operating system account with authorizations of a nonprivileged user.\n\nTechniques used to address this include protocols using nonces (e.g., numbers generated for a specific one time use), challenges (e.g., TLS, WS_Security), and PKI certificates. Additional techniques include time-synchronous or challenge-response one-time authenticators.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify what authentication mechanisms are used when accessing the application.\n\nIf the application is hosting publicly releasable information that does not require authentication, or if the application users are not eligible for a DOD CAC as per DOD 8520, this requirement is Not Applicable.\n\nReview to ensure the application is utilizing TLSV1.2 or greater to protect communication and nonprivileged user authentication traffic.\n\nVerify the application utilizes a strong authentication mechanism such as Kerberos, IPSEC, or Secure Shell (SSH).\n\n- Cryptographically sign web services packets.\n- Time stamps and cryptographic hashes are used with web services packets.\n- Use WS_Security for web services.\n\nRequest the most recent vulnerability scan results and configuration settings.\n\nVerify the configuration is set to test for known replay vulnerabilities.\n\nRequest code review results (if available) and review for issues that have been identified as potential replay attack vulnerabilities.\n\nVerify identified issues have been remediated.\n\nIf the application is not implementing replay-resistant authentication methods applicable to the application architecture, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to utilize replay-resistant mechanisms when authenticating nonprivileged accounts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001941</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001942</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Replay-resistant authentication mechanisms are implemented by the OIDC Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222532</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000158</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222532r960999_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001640</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must utilize mutual authentication when endpoint device non-repudiation protections are required by DoD policy or by the data owner.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\n\nWith one way SSL authentication which is the typical form of SSL authentication done between a web browser client and a web server, the client requests the server certificate to validate the server&apos;s identity and establish a secure connection.\n\nWhen SSL mutual authentication is used, the server is configured to request the client’s certificate as well so the server can also identify the client.\n\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification decisions (as opposed to the actual identifiers) to the services that need to act on those decisions.\n\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including but not limited to: workstations, printers, servers (outside a datacenter), VoIP Phones, VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nDetermine if mutual authentication is mandated by the data owner or by mission data protection objectives and data type.\n\nReview application architecture and design documents.\n\nIdentify endpoint devices that interact with the application. These can be SOA gateways, VOIP phones, or other devices that are used to connect to and exchange data with the application.\n\nIf the design documentation specifies, this could potentially also include remote client workstations.\n\nIn order for two way SSL/mutual authentication to work properly, the server must be configured to request client certificates.\n\nAccess the applications management console.\n\nNavigate to the SSL management utility or web page that is used to configure two way mutual authentication.\n\nVerify endpoints are configured for client authentication (mutual authentication).\n\nSome application architectures such as Java configure their settings in text/xml formatted files; in that case, have the application administrator identify the configuration files used by the application.\nE.g., web.xml stored in WEB-INF/ sub directory of the application root folder.\n\nOpen the web.xml file using a text editor.\n\nVerify the application deployment descriptor for the application and the resource requiring protection under the &quot;login-config&quot; element is set to CLIENT-CERT.\n\nIf SSL mutual authentication is required and is not being utilized, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to utilize mutual authentication when specified by data protection requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000778</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Mutual authentication mechanisms are implemented by the OIDC Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222533</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000394</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222533r961503_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001650</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must authenticate all network connected endpoint devices before establishing any connection.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\n\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions.\n\nIn such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions.\n\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including but not limited to: workstations, printers, servers (outside a datacenter), VoIP Phones, VTC CODECs).\n\nGateways and SOA applications are examples of where this requirement would apply.\n\nEnd point devices are not:\nClient desktop workstations only offer browser-based web application access where the user authenticates at the app layer.\n\nDevice authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation, implementation documentation and interview the application administrator.\n\nIdentify if the application utilizes Web Services/Service-Oriented Architecture (SOA). Using the web services framework that has been implemented, have the application administrator identify the remote devices allowed to communicate to the service provider.\n\nIf the application is designed to provide end-user, interactive application access only and does not use web services or allow connections from remote devices, this requirement is not applicable.\n\nIdentify the authentication mechanism used to authenticate the remote consumers/devices. Commonly available authentication methods are Client Certificate Authentication and Basic Authentication.\n\nThe Basic Authentication method provides insufficient protection for authentication sessions and is not allowed.\n\nIf no authentication mechanism is used to authenticate remote service consumers/devices, or if Basic Authentication is used to authentication remote service consumers/devices, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to authenticate all network connected endpoint devices/service consumers before establishing connections.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001958</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>All API endpoint access requires a valid OAuth2 token issued by the application OIDC Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222534</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000395</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222534r961506_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001660</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Service-Oriented Applications handling non-releasable data must authenticate endpoint devices via mutual SSL/TLS.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\n\nOne way SSL/TLS authentication is the typical form of  authentication done between a web browser client and a web server. The client requests the server certificate to validate the server&apos;s identity and establish a secure connection.\n\nWhen SSL/TLS mutual authentication is used, the server is configured to request the client’s certificate as well so the server can also identify the client. This form of authentication is normally chosen for system to system communications that leverage HTTP as the transport.\n\nIt should be noted that SSL is being deprecated and replaced with TLS.\n\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification decisions (as opposed to the actual identifiers) to the services that need to act on those decisions.\n\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including but not limited to: workstations, printers, servers (outside a datacenter), VoIP Phones, VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review application documentation and interview application administrator.\n\nIdentify application data elements and determine if the application is handling/processing non-releasable data.\n\nReview the application architecture and design documents.\n\nIdentify endpoint devices that interact with the application. These can be SOA gateways, VOIP phones, or other devices that are used to connect to and exchange data with the application.\n\nIf the design documentation specifies it, this could also include remote client workstations. However, this requirement is usually reserved for system-oriented endpoints rather than client workstations.\n\nIn order for two way SSL/TLS mutual authentication to work properly, the server must be configured to request client certificates.\n\nAccess the applications management console and navigate to the SSL/TLS management utility or web page that is used to configure two-way mutual authentication.\n\nVerify endpoints are configured for client authentication (mutual authentication).\n\nSome application architectures configure their settings in text/xml formatted files; in that case, have the application administrator identify the configuration files used by the application (e.g., web.xml stored in WEB-INF/ sub directory of the application root folder).\n\nOpen the web.xml file using a text editor and verify the application deployment descriptor for the application and the resource requiring protection under the &quot;login-config&quot; element is set to CLIENT-CERT.\n\nIf SSL/TLS mutual authentication is required due to the application processing non-releasable data and SSL/TLS mutual authentication not being utilized, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to utilize mutual authentication when the application is processing non-releasable data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001967</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.  Devices should perform mutual authentication with the OIDC Provider via the  &apos;client credentials&apos; flow with Signed JWT or equivalent  PKI technologies.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222535</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000163</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222535r1015697_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001670</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must disable device identifiers after 35 days of inactivity unless a cryptographic certificate is used for authentication.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Device identifiers are used to identify hardware devices that interact with the application much like a user account is used to identify an application user. Examples of hardware devices include but are not limited to mobile phones, application gateways, or other types of smart hardware.\n\nThis requirement does not apply to individual application user accounts.\n\nThis requirement is not applicable to shared information system accounts, application groups, or roles (e.g., guest and anonymous accounts) that are used by the application itself in order to function. Care must be taken to not disable identifiers that are used by the application in order to function.\n\nInactive device identifiers pose a risk to systems and applications. Attackers that are able to exploit an inactive identifier can potentially obtain and maintain undetected access to the application.\n\nApplications need to track periods of device inactivity and disable the device identifier after 35 days of inactivity. This is usually accomplished by disabling the account used by the device to access the application.\n\nApplications that use cryptographic certificates for device authentication may use the expiration date assigned to the certificate to meet this requirement with the understanding that the certificate is created and managed in accordance with DOD PKI policy and can be revoked by a trusted certificate authority (CA).\n\nTo avoid having to build complex device management capabilities directly into their application, developers should leverage the underlying OS or other account management infrastructure (AD, LDAP) that is already in place within the organization and meets organizational user account management requirements.\n\nApplications are encouraged to utilize a centralized data store such as Active Directory or LDAP to offload device management requirements and ensure compliance with policy requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIf the application is not designed to authenticate devices (such as mobile phones, gateways or other smart devices), or uses DOD PKI certificates to authenticate these devices, this requirement is Not Applicable.\n\nAccess the user management interface for the application.\n\nIdentify application device IDs.\n\nIf the application utilizes approved certificates or a centralized authentication store (Active Directory or LDAP) as the authoritative source for application authentication, and the authentication store is configured to meet the requirement to disable device IDs after 35 days of inactivity, this is not a finding.\n\nAccounts such as guest and anonymous as well as roles and groups or other identities used to operate the application or to provide limited guest access are not applicable.\n\nAccess the application user management interface and review the account settings that pertain to devices.\n\nVerify the application is configured to disable device accounts that have not been active or logged into the application for the past 35 days.\n\nIf the application does not disable accounts used to authenticate devices after 35 days of inactivity, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to disable device accounts after 35 days of inactivity or to utilize DOD PKI certificates that provide an expiration date.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000795</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003627</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider. Devices should perform mutual authentication with the OIDC Provider via the  &apos;client credentials&apos; flow with Signed JWT or equivalent PKI technologies.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222536</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000164</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222536r1015698_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001680</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must enforce a minimum 15-character password length.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.\n\nUse of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\n\nExamples of situations where a user ID and password might be used include but are not limited to:\n\n- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor.\n- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.\n- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.\n\nPassword complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.\n\nUse of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.\n\nIf the application does not use passwords, this requirement is Not Applicable.\n\nAccess the application management interface and create a test user account or log on to the system with a test account and access the functionality that provides password change capabilities.\n\nWhen prompted to provide the password, attempt to create a password shorter than 15 characters in length.\n\nIf a password shorter than 15 characters can be created, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to require 15 characters in the password.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000205</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004066</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222537</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000166</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222537r1015699_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001690</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must enforce password complexity by requiring that at least one uppercase character be used.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\n\nExamples of situations where a user ID and password might be used include but are not limited to:\n\n- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor.\n- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.\n- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.\n\nUse of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.\n\nIf the application does not use passwords, this requirement is Not Applicable.\n\nAccess the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities.\n\nWhen prompted to provide the password, attempt to create a password that does not have one uppercase character.\n\nIf a password without at least one upper-case character can be created, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to require at least one uppercase character in the password.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000192</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004066</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222538</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000167</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222538r1015700_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001700</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must enforce password complexity by requiring that at least one lowercase character be used.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\n\nExamples of situations where a user ID and password might be used include but are not limited to:\n\n- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor.\n- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.\n- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.\n\nUse of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.\n\nIf the application does not use passwords, this requirement is Not Applicable.\n\nAccess the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities.\n\nWhen prompted to provide the password, attempt to create a password that does not have one lowercase character.\n\nIf a password without at least one lower-case character can be created, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to require at least one lowercase character in the password.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000193</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004066</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222539</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000168</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222539r1015701_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001710</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must enforce password complexity by requiring that at least one numeric character be used.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\n\nExamples of situations where a user ID and password might be used include but are not limited to:\n\n- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor.\n- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.\n- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.\n\nUse of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.\n\nIf the application does not use passwords, this requirement is Not Applicable.\n\nAccess the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities.\n\nWhen prompted to provide the password, attempt to create a password that does not have one numeric character.\n\nIf a password without at least one numeric character can be created, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to require at least one numeric character in the password.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000194</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004066</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222540</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000169</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222540r1015702_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001720</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must enforce password complexity by requiring that at least one special character be used.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\n\nExamples of situations where a user ID and password might be used include but are not limited to:\n\n- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor.\n- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.\n- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.\n\nUse of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.\n\nIf the application does not use passwords, this requirement is Not Applicable.\n\nAccess the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities.\n\nWhen prompted to provide the password, attempt to create a password that does not have one special character.\n\nIf a password without at least one special character can be created, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to require at least one special character in the password.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001619</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004066</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222541</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000170</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222541r1043189_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001730</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must require the change of at least eight of the total number of characters when passwords are changed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\n\nExamples of situations where a user ID and password might be used include but are not limited to:\n\n- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor.\n- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.\n- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.\n\nUse of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.\n\nIf the application does not use passwords, this requirement is Not Applicable.\n\nAccess the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities.\n\nWhen prompted to provide the password, attempt to change less than 8 characters of the total number of characters in the password.\n\nIf less than 8 characters of the password are changed, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to require the change of at least eight characters in the password when passwords are changed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000195</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004066</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222542</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000171</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222542r1015704_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001740</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must only store cryptographic representations of passwords.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\n\nExamples of situations where a user ID and password might be used include but are not limited to:\n\n- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor.\n- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.\n- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.\n\nPasswords need to be protected at all times and using a strong one-way hashing encryption algorithm with a salt is the standard method for providing a means to validate a user&apos;s password without having to store the actual password. \n\nPerformance and time required to access are factors that must be considered and the one way hash is the most feasible means of securing the password and providing an acceptable measure of password security. If passwords are stored in clear text, they can be plainly read and easily compromised.\n\nIn many instances, verifying the user knows a password is performed using a password verifier. In its simplest form, a password verifier is a computational function that is capable of creating a hash of a password and determining if the value provided by the user matches the hash. \n\nA more secure version of verifying a user knowing a password is to store the result of an iterating hash function and a large random SALT value as follows:\n\nH0 = H(pwd, H(salt))\nHn = H(Hn-1,H(salt))\n\nWhere n is a cryptographically-strong random [*3] number. Hn is stored, along with the salt. When the application wishes to verify that the user knows a password, it simply repeats the process and compares Hn with the stored Hn.\n\nA SALT is essentially a fixed-length cryptographically-strong random value. \n\nAnother method used is utilizing a keyed hash message authentication code (HMAC). HMAC calculates a message authentication code via a cryptographic hash function used in conjunction with an encryption key. The key must be protected as with any private key.\n \nApplications must only store passwords that have been cryptographically protected.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.\n\nIf the application does not use passwords, this requirement is Not Applicable.\n\nHave the application administrator identify the application&apos;s password storage locations. Potential locations include the local file system where the application is stored or in an application-related database table that should not be accessible to application users.\n\nReview application files and folders using a text editor or by using a database tool that allows you to view data stored in database tables. Look for indications of stored user information and review that information. Determine if password strings are readable/discernable.\n\nDetermine if the application uses the MD5 hashing algorithm to create password hashes.\n\nIf the passwords are readable or there is no indication the application utilizes cryptographic hashing to protect passwords, or if the MD5 hash algorithm is used to create password hashes, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use strong cryptographic hash functions when creating password hash values.\n\nUtilize random salt values when creating the password hash.\n\nEnsure strong access control permissions on data files containing authentication data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000196</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004062</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222543</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222543r961029_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001750</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must transmit only cryptographically-protected passwords.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\n\nExamples of situations where a user ID and password might be used include but are not limited to:\n\n- When the application user base does not have a CAC and is not a current DoD employee, member of the military, or a DoD contractor.\n\n- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.\n\nand\n\n- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.\n\nPasswords need to be protected at all times and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.\n\nApplications can accomplish this by making direct function calls to encryption modules or by leveraging operating system encryption capabilities.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.\n\nIf the application does not use passwords, the requirement is not applicable.\n\nIdentify when the application transmits passwords. This will most likely be when the user authenticates to the application or when the application authenticates to another resource.\n\nAccess the application management interface with a test account and access the functionality that requires a password be provided. If the interface is via a web browser, verify the web browser has gone secure prior to entering any password or authentication information.\n\nThis can be done by viewing the browser and observing a “lock” icon displayed somewhere in the browser as well as an https:// to indicate an SSL connection. Most browsers display this in the upper left hand corner.\n\nIf the application is transmitting the password rather than the user, obtain design documentation from the application admin that provides the details on how they are protecting the password during transmission. This will usually be via a TLS/SSL tunneled connection or VPN.\n\nIf the passwords are not encrypted when being transmitted, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to encrypt passwords when they are being transmitted.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000197</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222544</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000173</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222544r1015705_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001760</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must enforce 24 hours/1 day as the minimum password lifetime.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\n\nExamples of situations where a user ID and password might be used include but are not limited to:\n\n- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor.\n- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.\n- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.\n\nEnforcing a minimum password lifetime helps prevent repeated password changes to defeat the password reuse or history enforcement requirement.\n\nRestricting this setting limits the user&apos;s ability to change their password. Passwords need to be changed at specific policy-based intervals; however, if the application allows the user to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization&apos;s policy regarding password reuse.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.\n\nIf the application does not use passwords, this requirement is Not Applicable.\n\nAccess the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities.\n\nAttempt to change the password more than once.\n\nIf a password can be changed more than once within 24 hours, the minimum lifetime setting is not set and this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to have a minimum password lifetime of 24 hours.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000198</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004066</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222545</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000174</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222545r1043190_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001770</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must enforce a 60-day maximum password lifetime restriction.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\n\nExamples of situations where a user ID and password might be used include but are not limited to:\n\n- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor.\n- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.\n- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.\n\nAny password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed at specific intervals.\n\nOne method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised.\n\nThis requirement does not include emergency administration accounts which are meant for access to the application in case of failure. These accounts are not required to have maximum password lifetime restrictions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.\n\nIf the application does not use passwords, this requirement is Not Applicable.\n\nAccess the application management interface and view the user password settings page.\n\nReview user password settings and validate the application is configured to expire and force a password change after 60 days.\n\nIf user passwords are not configured to expire after 60 days, or if the application does not have the ability to control this setting, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to have a maximum password lifetime of 60 days.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000199</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004066</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222546</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000165</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222546r1015267_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001780</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must prohibit password reuse for a minimum of five generations.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\n\nExamples of situations where a user ID and password might be used include but are not limited to:\n\n- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor.\n- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.\n- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.\n\nPassword complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nTo meet password policy requirements, passwords need to be changed at specific policy-based intervals.\n\nIf the information system or application allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed as per policy requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.\n\nIf the application does not use passwords, this requirement is Not Applicable.\n\nAccess the application management interface and view the user password settings page.\n\nReview user password settings and validate the application is configured to prohibit password reuse for a minimum of five password generations.\n\nIf the application does not prevent users from reusing their previous five passwords, or if the application does not have the ability to control this setting, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to prohibit password reuse for up to five passwords.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004061</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222547</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000397</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222547r985976_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001790</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must allow the use of a temporary password for system logons with an immediate change to a permanent password.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of passwords for application authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\n\nExamples of situations where a user ID and password might be used include but are not limited to:\n\n- When the application user base does not have a CAC and is not a current DOD employee, member of the military, or a DOD contractor.\n- When an application user has been officially designated as a Temporary Exception User; one who is temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.\n- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.\n\nWithout providing this capability, an account may be created without a password. Nonrepudiation cannot be guaranteed once an account is created if a user is not forced to change the temporary password upon initial logon.\n\nTemporary passwords are typically used to allow access to applications when new accounts are created or passwords are changed. It is common practice for administrators to create temporary passwords for user accounts which allow the users to log on, yet force them to change the password once they have successfully authenticated.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.\n\nIf the application does not use passwords, this requirement is Not Applicable.\n\nAccess the application management interface and view the user password settings page.\n\nReview user password settings and validate the application is configured to specify when a password is temporary and force a password change when the administrator either creates a new user account or changes a user’s password.\n\nIf the application can not specify a password as temporary and force the user to change the temporary password upon successful authentication, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to specify when a password is temporary and change the temporary password on the first use.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000366</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222548</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222548r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001795</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application password must not be changeable by users other than the administrator or the user with which the password is associated.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application allows user A to change user B&apos;s password,  user B can be locked out of the application, and user A is provided the ability to grant themselves access to the application as user B.  This violates application integrity and availability principles.\n\nMany applications provide a password reset capability that allows the user to reset their password if they forget it.\n\nProtections must be utilized when establishing a password change or reset capability to prevent user A from changing user B&apos;s password.\n\nProtection is usually accomplished by having each user provide an out of bounds (OOB) communication address such as a separate email address or SMS/text address (mobile phone) that can be used to transmit password reset/change information.\n\nThis  OOB information is usually provided by the user when the user account is created.   The OOB information is validated as part of the user account creation process by sending an account validation request to the OOB address and having the user respond to the request.\n\nApplications must prevent users other than the administrator or the user associated with the account from changing the account password.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview application administrator.\n\nDetermine if the application utilizes passwords. If the application does not utilize passwords, the requirement is NA.\n\nIdentify the processes, commands or web pages the application uses to allow application users to change their own passwords. This includes but is not limited to password resets.\n\nIf the application does not allow users to change or reset their passwords, the requirement is NA.\n\nObtain two application test accounts, referred to here as User A and User B. Access the application as User A. Utilize the application password reset or change processes and determine if User A is allowed to specify or otherwise force a password change for User B.\n\nIf User A is allowed to change or force a reset of User B&apos;s password, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use a CAC to authenticate users instead of using passwords. If application users are prohibited or prevented from obtaining a CAC due to DoD policy requirements and passwords are the only viable option, design the application to utilize a secure password change or password reset process.\n\nUtilize out of band (OOB) communication techniques to communicate password change requests to users.\n\nEnsure verification processes exist that allow users to validate the change request prior to implementing the password change.\n\nEnsure users are only allowed to change their own passwords.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000184</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222549</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000400</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222549r961521_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001800</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must terminate existing user sessions upon account deletion.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must ensure that a user does not retain any rights that may have been granted or retain access to the application after the user&apos;s authorization or role within the application has been deleted or modified.  This means once a user&apos;s role/account within the application has been modified, deleted or disabled, the changes must be enforced immediately within the application.  Any privileges or access the user had prior to the change must not be retained.  For example; any application sessions that the user may have already established prior to the configuration change must be terminated when the user account changes occur.\n\nSimply removing a user from a web application without terminating any existing application user sessions can introduce a scenario where the deleted user still has access to the application even though their account has been deleted from the authentication store. This can be attributed to browser caching and session management on the web server.\n\nTo address this, the web application must provide a means for ensuring this type of &quot;zombie&quot; access does not occur. Applications must provide a user management feature or function that will terminate any existing user sessions at the same time or just before the user account is terminated from the authoritative authentication source.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify the user management functions of the application and create a test user account.\n\nAccess the application and perform application functions as the test user.\n\nAccess the user management functions and delete the test account while the test user sessions are still active.\n\nVerify the test user application sessions are terminated by attempting to perform additional application functions.\n\nIf the test user retains access after the test account has been deleted, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to terminate existing sessions of users whose accounts are deleted.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002007</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider. Low-latency session termination should be configured on the OIDC Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222550</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000175</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222550r961038_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001810</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted.\n\nA trust anchor is an authoritative entity represented via a public key and associated data. It is used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC.\n\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA.\n\nThis requirement verifies that a certification path to an accepted trust anchor is used for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Validation of the certificate status information is out of scope for this requirement.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation, the application architecture and interview the application administrator to identify the method employed by the application for validating certificates.\n\nReview the method to determine if a certification path that includes status information is constructed when certificate validation occurs.\n\nSome applications may utilize underlying OS certificate validation and certificate path building capabilities while others may build the capability into the application itself.\n\nThe certification path will include the intermediary certificate CAs along with a status of the CA server&apos;s signing certificate and will end at the trusted root anchor.\n\nIf the application does not construct a certificate path to an accepted trust anchor, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design the application to construct a certification path to an accepted trust anchor when using PKI-based authentication.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000185</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222551</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000176</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222551r961041_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001820</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application, when using PKI-based authentication, must enforce authorized access to the corresponding private key.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure.\n\nThe cornerstone of the PKI is the private key used to encrypt or digitally sign information.\n\nIf the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user.\n\nBoth the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify where the application&apos;s private key is stored.\n\nIf the application does not perform code signing or other cryptographic tasks requiring a private key, this requirement is not applicable.\n\nAsk the administrator to demonstrate where the application private key(s) are stored. Examine access restrictions and ensure access controls are in place to restrict access to the private key(s).\n\nIf the key(s) are stored on the file system, ensure adequate file permissions are set so as to only allow authorized users and processes.\n\nIf the key(s) are maintained or available via an application interface, ensure the application provides access controls that limit access via the application interface to only authorized users and processes.\n\nReview access controls and attempt to use a relevant user account, group or application role that is not allowed access to the private key.\n\nVerify access to the keys is denied.\n\nIf unauthorized access is granted to the private key(s), this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application or relevant access control mechanism to enforce authorized access to the application private key(s).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000186</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222552</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000177</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222552r961044_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001830</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must map the authenticated identity to the individual user or group account for PKI-based authentication.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without mapping the certificate used to authenticate to a corresponding user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.\n\nSome CAs will include identifying information like an email address within the certificate itself. When the email is assigned to an individual, this helps to identify the individual user who has been assigned the certificate. When identifying information is not available within the certificate itself, the application must provide a mapping that allows administrators to quickly determine who the owner of the certificate is. When responding to a security incident, particularly involving user access violations, time is of the essence so this information must be readily available to investigators.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify how the application maps individual user certificates or group accounts to individual users.\n\nAccess the application as a regular user while reviewing the application logs to determine if the application records the individual name of the user or if the application only includes certificate information.\n\nIf the application only logs certificate information which contains no discernable user data, ask the system admin what their process is for mapping the certificate information to the user.\n\nIf the application does not map the certificate data to an individual user or group, or if the administrator has no automated process established for determining the identity of the user, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to map certificate information to individual users or group accounts or create a process for automatically determining the individual user or group based on certificate information provided in the logs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000187</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222553</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000401</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222553r1015707_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001840</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application, for PKI-based authentication, must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A local cache of revocation data is also known as a CRL list. This list contains a list of revoked certificates and can be periodically downloaded to ensure certificates can still be checked for revocation when network access is not available or access to the Online Certificate Status Protocol (OCSP) server is not available.\n\nWithout configuring a local cache of revocation data, there is the potential to allow access to users who are no longer authorized (users with revoked certificates).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the system administrator to identify how the application checks certificate revocation.\n\nIf the application resides on the SIPRnet and does not have access to the root CAs, this requirement is Not Applicable.\n\nDifferent application frameworks may handle this requirement for the developer or the developer may have chosen to implement their own implementation for managing and implementing the CRL.\n\nHave the administrator demonstrate the process used for obtaining and importing the CRL. CAs may publish the CRL in an LDAP directory or it may be posted to an HTTP server.\n\nVerify the application is configured to import the CRL on a regular basis.\n\nHave the administrator demonstrate the configuration setting that enables CRL checking in the event the OCSP server is not available.\n\nIf the application is not configured to implement a CRL, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Implement a CRL import process and configure the application to check the CRL if OCSP is not available.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001991</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004068</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222554</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000178</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222554r961047_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001850</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must not display passwords/PINs as clear text.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>To prevent the compromise of authentication information such as passwords during the authentication process, the feedback from the information system must not provide any information that would allow an unauthorized user to compromise the authentication mechanism.\n\nObfuscation of user-provided information when typed into the system is a method used in addressing this risk.\n\nFor example, displaying asterisks when a user types in a password is an example of obscuring feedback of authentication information.\n\nAnother method is to display authentication feedback for a very limited time, usually in fractions of a second. This occurs during password character entry where the password characters are displayed for a very small window of time and then automatically obfuscated. This allows users with just enough time to confirm their password as they type it while limiting the ability of &quot;shoulder surfers&quot; to covertly witness the values.\n\nA common tactic employed to circumvent password obfuscation is to copy the obfuscated password and paste it to a text file.  Proper obfuscation techniques will not paste the clear text password.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application admin to log on to the application.\n\nObserve the authentication process and verify any display feedback provided when the admin enters her/his password is obfuscated and not clear text.\n\nFor applications that display authentication feedback for a very limited time, ensure the feedback time the character is displayed is only momentary i.e., fractions of a second.\n\nUsing a text editor, copy the obfuscated password and paste to a text file.  Do not save the file.\n\nIf the application displays clear text when the password/PIN is entered, or if the time period for displayed feedback exceeds fractions of a second, or if the clear text password/PIN is displayed when pasted, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to obfuscate passwords and PINs when they are being entered so they cannot be read.\n\nDesign the application so obfuscated passwords cannot be copied and then pasted as clear text.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000206</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222555</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000179</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222555r961050_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001860</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must use mechanisms meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A cryptographic module is a hardware or software device or component that performs cryptographic operations securely within a physical or logical boundary, using a hardware, software or hybrid cryptographic engine contained within the boundary, and cryptographic keys that do not leave the boundary.\nBased on the criticality of the application, system designers might choose to utilize a hardware based cryptographic module due to the protections and security benefits a hardware based solution provides over a software based solution. Due to various factors, including expense, hardware based encryption modules are usually relegated to only those applications where the system requirements specify it as a required protection. Examples include applications that handle extremely sensitive data or those used in life and death situations, e.g., weapons systems. \n\nGeneral purpose applications such as a web site will often opt to leverage an underlying software based encryption capability that is offered by the OS, database or application development framework.  Operating systems or database products often provide their own cryptographic modules that are FIPS 140-2 compliant and can meet the authentication to the crypto module requirement via their Role Based Access Controls (users and groups) built into the product.  \nIn all cases, user’s accessing the cryptographic module must be authenticated and granted the appropriate rights in order to access the encryption module.  Any encryption utilized by the access control mechanisms must be FIPS 140-2 compliant.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify if the application provides access to cryptographic modules and if access is required in order to manage cryptographic modules contained within the application.\n\nIf the application does not provide authenticated access to a cryptographic module, the requirement is not applicable.\n\nReview and identify the cryptographic module. Refer to the NIST website listing all FIPS-approved cryptographic modules.\n\nhttp://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm\n\nIf the cryptographic module that requires authentication is not on the FIPS-approved module list, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use FIPS-approved cryptographic modules.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000803</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222556</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000180</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222556r961053_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001870</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Lack of authentication and identification enables non-organizational users to gain access to the application or possibly other information systems and provides an opportunity for intruders to compromise resources within the application or information system.\n\nNon-organizational users include all information system users other than organizational users which include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors and guest researchers).\n\nNon-organizational users must be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization when related to the use of anonymous access, such as accessing a web server.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIf the application does not host non-organizational users, this requirement is not applicable.\n\nReview the application and verify authentication is enabled and required in order for users to access the application.\n\nReview the application user base and determine if all user accounts are documented and assigned to a unique individual.\n\nReview risk acceptance documentation to determine if there are specific accesses identified that do not require authentication.\n\nIf the application does not identify and authenticate non-organizational users and there is no risk acceptance documentation approving the exception, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to identify and authenticate all non-organizational users.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000804</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222557</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000402</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222557r961527_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001880</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must accept Personal Identity Verification (PIV) credentials from other federal agencies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Access may be denied to authorized users if federal agency PIV credentials are not accepted.\n\nPersonal Identity Verification (PIV) credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidance documents. OMB Memorandum 11-11 requires federal agencies to continue implementing the requirements specified in HSPD-12 to enable agency-wide use of PIV credentials.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application access methods.\n\nIf the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable.\n\nIf the application is only deployed to SIPRNet, this requirement is not applicable.\n\nIf the application is not intended to be available to Federal government (non-DoD) partners this requirement is not applicable.\n\nAsk the application administrator to demonstrate how the application is configured to allow the use of PIV credentials from other agencies.\n\nIf the application is required to provide authenticated access to Federal agencies and it does not accept a PIV, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to accept PIV credentials when utilizing authentication provided by Federal (Non-DoD) agencies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002009</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222558</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000403</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222558r961530_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001890</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must electronically verify Personal Identity Verification (PIV) credentials from other federal agencies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Inappropriate access may be granted to unauthorized users if federal agency PIV credentials are not electronically verified.\n\nPersonal Identity Verification (PIV) credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidance documents. OMB Memorandum 11-11 requires federal agencies to continue implementing the requirements specified in HSPD-12 to enable agency-wide use of PIV credentials.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application access methods.\n\nIf the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable.\n\nIf the application is only deployed to SIPRNet, this requirement is not applicable.\n\nIf the application is not intended to be available to Federal government (non-DoD) partners this requirement is not applicable.\n\nAsk the application administrator to demonstrate how the application is configured to verify the PIV credentials from other agencies when they are presented as an authentication token.\n\nIf the application is required to provide authenticated access to Federal agencies and it does not verify the PIV, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to verify the PIV credentials presented when utilizing authentication provided by Federal (Non-DoD) agencies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002010</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222559</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000404</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222559r1015708_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001900</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must accept Federal Identity, Credential, and Access Management (FICAM)-approved third-party credentials.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>FICAM establishes a federated identity framework for the federal government. FICAM provides government-wide services for common Identity, Credential and Access Management (ICAM) requirements. The FICAM Trust Framework Solutions (TFS) is the federated identity framework for the U.S. federal government.\n The TFS is a process by which Industry Trust Frameworks (The codification of requirements for credentials and their issuance, privacy and security requirements, as well as auditing qualifications and processes) are evaluated and assessed for potential use by the government. \n\nA Trust Framework that is comparable to federal standards is adopted through this process, which allows federal government Relying Parties (Federal Government websites or RP&apos;s) to trust Credential Service Providers (a.k.a. Identity Providers) that have been assessed under that particular trust framework. This allows federal government relying parties to trust such credentials at their approved assurance levels. \n\nThis requirement only applies to applications that are intended to be accessible to nonfederal government agencies and other partners through FICAM. \n\nThird-party credentials are those credentials issued by nonfederal government entities approved by the FICAM TFS initiative.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application access methods.\n\nIf the application is not PKI-enabled due to the hosted data being publicly releasable, this check is Not Applicable.\n\nIf the application is only deployed to SIPRNet, this requirement is Not Applicable.\n\nIf the application is not intended to be available to federal government partners this requirement is Not Applicable.\n\nAsk the application administrator to demonstrate how the application is configured to allow the use of third-party credentials, verify the third-party credentials are FICAM approved.\n\nIf the application does not accept FICAM-approved credentials when accepting third-party credentials, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure applications intended to be accessible to nonfederal government agencies to use FICAM-approved third-party credentials.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002011</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004083</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Authentication services are provided by an external (OIDC) OpenID Connect Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222560</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000405</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222560r1015709_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001910</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must conform to Federal Identity, Credential, and Access Management (FICAM)-issued profiles.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>FICAM establishes a federated identity framework for the federal government. FICAM provides government-wide services for common Identity, Credential, and Access Management (ICAM) requirements. The FICAM Trust Framework Solutions (TFS) is the federated identity framework for the U.S. federal government.\n The TFS is a process by which Industry Trust Frameworks (The codification of requirements for credentials and their issuance, privacy and security requirements, as well as auditing qualifications and processes) are evaluated and assessed for potential use by the government. \n\nThis requirement only applies to applications that are intended to be accessible to nonfederal government agencies and other partners or nonorganizational (non-DOD) users.\n\nWithout conforming to FICAM-issued profiles, the information system may not be interoperable with FICAM-authentication protocols, such as SAML 2.0, OpenID 2.0 or other protocols such as the FICAM backend Attribute Exchange.\n\nThis requirement addresses open identity management standards. More information regarding these standards is available here: info.idmanagement.gov/2012/10/what-are-ficam-technical-profiles-and.html</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application access methods.\n\nIf the application is not PKI-enabled due to the hosted data being publicly releasable, this check is Not Applicable.\n\nIf the application is only deployed to SIPRnet, this requirement is Not Applicable.\n\nIf the application is not intended to be available to federal government partners this requirement is Not Applicable.\n\nThis requirement applies to DOD service providers who are relying parties of external (federal government) identity providers.\n \nAsk the application administrator to demonstrate how the application conforms to FICAM issued profiles such as SAML or OPENID. \n\nIf the application is designed to be a service provider utilizing an external identify provider and doesn&apos;t conform to FICAM-issued profiles, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to conform to FICAM-issued technical profiles when providing services that rely on external (federal government) identity providers.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002014</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004085</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The project conforms to OpenID Connect, a FICAM issued profile.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222561</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000409</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222561r961548_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001930</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications used for non-local maintenance sessions must audit non-local maintenance and diagnostic sessions for organization-defined auditable events.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Non-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection.\n\nIf events associated with non-local administrative access or diagnostic sessions are not logged and audited, a major tool for assessing and investigating attacks would not be available.\n\nThis requirement addresses auditing-related issues associated with maintenance tools used specifically for diagnostic and repair actions on organizational information systems.\n\nThis requirement applies to hardware/software diagnostic test equipment or tools. This requirement does not cover hardware/software components that may support information system maintenance, yet are a part of the system (e.g., the software implementing &quot;ping,&quot; &quot;ls,&quot; &quot;ipconfig,&quot; or the hardware and software implementing the monitoring port of an Ethernet switch).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application maintenance functions.\n\nIf the application does not provide non-local maintenance and diagnostic capability, this requirement is not applicable.\n\nIdentify the maintenance functions/capabilities that are provided by the application and performed by an individual which can be performed remotely.\n\nFor example, the application may provide the ability to clean up a folder of temporary files, add users, remove users, restart processes, backup certain files, manage logs, or execute diagnostic sessions.\n\nIdentify and open the audit logs that capture maintenance actions performed by the application.\n\nAccessing the application in the appropriate role to execute maintenance tasks, perform several maintenance tasks and observe the logs.\n\nIf the application provides maintenance functions and capabilities and those functions are not logged when they are executed, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to log when application maintenance functionality is executed remotely.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002884</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The project does not provide non-local maintenance and diagnostic capability.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222562</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000411</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222562r961554_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001940</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications used for non-local maintenance sessions must implement cryptographic mechanisms to protect the integrity of non-local maintenance and diagnostic communications.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Privileged access contains control and configuration information which is particularly sensitive, so additional protections are necessary. This is maintained by using cryptographic mechanisms to protect integrity.\n\nNon-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection.\n\nThis requirement applies to hardware/software diagnostic test equipment or tools. This requirement does not cover hardware/software components that may support information system maintenance, yet are a part of the system (e.g., the software implementing &quot;ping,&quot; &quot;ls,&quot; &quot;ipconfig,&quot; or the hardware and software implementing the monitoring port of an Ethernet switch).\n\nThe application can meet this requirement through leveraging a cryptographic module.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application maintenance functions.\n\nIf the application does not provide non-local maintenance and diagnostic capability, this requirement is not applicable.\n\nIdentify the maintenance functions/capabilities that are provided by the application and performed by an individual which can be performed remotely.\n\nFor example, the application may provide the ability to clean up a folder of temporary files, add users, remove users, restart processes, backup certain files, manage logs, or execute diagnostic sessions.\n\nAccess the application in the appropriate role needed to execute maintenance tasks. Observe the manner in which the application is connecting and ensure the session is being encrypted.\n\nFor example, observe the browser to ensure the session is being encrypted with TLS/SSL.\n\nIf the application provides remote access to maintenance functions and capabilities and the remote access methods are not encrypted, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to encrypt remote application maintenance sessions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002890</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The project does not provide non-local maintenance and diagnostic capability.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222563</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000412</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222563r961557_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001950</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications used for non-local maintenance sessions must implement cryptographic mechanisms to protect the confidentiality of non-local maintenance and diagnostic communications.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Privileged access contains control and configuration information which is particularly sensitive, so additional protections are necessary. This is maintained by using cryptographic mechanisms to protect confidentiality.\n\nNon-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection.\n\nThe application can meet this requirement through leveraging a cryptographic module.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application maintenance functions.\n\nIf the application does not provide non-local maintenance and diagnostic capability, this requirement is not applicable.\n\nIdentify the maintenance functions/capabilities that are provided by the application and performed by an individual which can be performed remotely.\n\nFor example, the application may provide the ability to clean up a folder of temporary files, add users, remove users, restart processes, backup certain files, manage logs, or execute diagnostic sessions.\n\nAccess the application in the appropriate role needed to execute maintenance tasks. Observe the manner in which the application is connecting and verify the session is being encrypted.\n\nFor example, observe the browser to ensure the session is being encrypted with TLS/SSL.\n\nIf the application provides remote access to maintenance functions and capabilities and the remote access methods are not encrypted, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to encrypt remote application maintenance sessions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003123</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The project does not provide non-local maintenance and diagnostic capability.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222564</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000413</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222564r961560_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001960</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications used for non-local maintenance sessions must verify remote disconnection at the termination of non-local maintenance and diagnostic sessions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Non-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection.\n\nIf the remote connection is not closed and verified as closed, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. Remote connections must be disconnected and verified as disconnected when non-local maintenance sessions have been terminated and are no longer available for use.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application maintenance functions.\n\nIf the application does not provide non-local maintenance and diagnostic capability, this requirement is not applicable.\n\nIdentify the maintenance functions/capabilities that are provided by the application, performed by an individual/admin and which can be performed remotely.\n\nExamples include but are not limited to:\n\nThe application may provide the ability to clean up a folder of temporary files, add users, remove users, restart processes, backup certain files, manage logs, or execute diagnostic sessions.\n\nIdentify the IP address of the source system used to originate testing traffic. The IP address will be used to identify sessions on the application host so verify traffic is not traversing a proxy connection in order to reach the application host.\n\nAccess the operating system of the application host and execute the relevant OS commands to identify active TCP/IP sessions on the application host.\n\nFor example, the &quot;netstat -a&quot; command will provide a status of all TCP/IP connections on both Windows and UNIX systems.\n\nNetstat output can be redirected to a file or the grep command can be used on UNIX systems to identify the specific application processes and network connections.\n\nnetstat -a |grep -i &quot;application process name&quot; &gt; filename\nor\nnetstat  -a |grep -i source IP address &gt; filename\n\nUtilizing the application, access using the appropriate role needed to execute maintenance tasks.\n\nExecute a maintenance task or tasks from within the application.\n\nRe-execute the netstat commands and identify what network connections and process IDs were created to handle the new application session.\n\nTerminate the application session via the application interface and then execute the netstat commands a third time. The network connections should terminate or change to a state that indicates the connections are closed or are in the process of closing. Continue to execute netstat command until it is verified that the application has terminated the process sessions and closed the network connections.\n\nReview the application logs to ensure the application has logged the disconnection event thereby verifying the disconnection.\n\nIf the application provides remote access to maintenance functions and capabilities and the remote access connections are not terminated and then verified, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to verify termination of remote maintenance sessions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002891</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The project does not provide non-local maintenance and diagnostic capability.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222565</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000185</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222565r961062_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001970</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must employ strong authenticators in the establishment of non-local maintenance and diagnostic sessions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If maintenance tools are used by unauthorized personnel, they may accidentally or intentionally damage or compromise the system. The act of managing systems and applications includes the ability to access sensitive application information, such as, system configuration details, diagnostic information, user information, and potentially sensitive application data.\n\nNon-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection.\n\nTypically, strong authentication requires authenticators that are resistant to replay attacks and employ multifactor authentication. Strong authenticators include, for example, PKI where certificates are stored on a token protected by a password, passphrase, or biometric.\n\nThis requirement applies to hardware/software diagnostic test equipment or tools. This requirement does not cover hardware/software components that may support information system maintenance, yet are a part of the system (e.g., the software implementing &quot;ping,&quot; &quot;ls,&quot; &quot;ipconfig,&quot; or the hardware and software implementing the monitoring port of an Ethernet switch).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify application maintenance functions.\n\nIf the application does not provide non-local maintenance and diagnostic capability, this requirement is not applicable.\n\nIdentify the maintenance functions/capabilities that are provided by the application, performed by an individual/admin and which can be performed remotely.\n\nExamples include but are not limited to:\n\nThe application may provide the ability to clean up a folder of temporary files, add users, remove users, restart processes, backup certain files, manage logs, or execute diagnostic sessions.\n\nHave the application admin authenticate to the application in an administrative role and verify that strong credentials (CAC) are required to access when performing application maintenance.\n\nHave the application admin authenticate to the application host OS and verify that strong credentials (CAC) are required to access when performing application maintenance.\n\nIf the application administrator is prevented from accessing the OS by policy requirement or separation of duties requirements, this is not a finding.\n\nIf a CAC is not used when remotely accessing the application for maintenance or diagnostic sessions, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to use strong authentication (CAC) when accessing the application for maintenance purposes.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000877</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The project does not provide non-local maintenance and diagnostic capability.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222566</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000186</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222566r985978_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001980</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must terminate all sessions and network connections when nonlocal maintenance is completed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If a maintenance session or connection remains open after maintenance is completed, it may be hijacked by an attacker and used to compromise or damage the system.\n\nNonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection.\n\nThis requirement applies to hardware/software diagnostic test equipment or tools. This requirement does not cover hardware/software components that may support information system maintenance, yet are a part of the system (e.g., the software implementing &quot;ping,&quot; &quot;ls,&quot; &quot;ipconfig,&quot; or the hardware and software implementing the monitoring port of an Ethernet switch).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the system administrator to determine how the application is configured to terminate network sessions after sessions have been idle for a period of time. Identify any documented exceptions.\n\nIf the application does not provide nonlocal maintenance and diagnostic capability, this requirement is Not Applicable.\n\nFor privileged management sessions the period of time is 10 minutes of inactivity.\n\nFor regular user or nonprivileged sessions, the period of time is 15 minutes of inactivity.\n\nAuthenticate to the application using normal in-band access methods and as an application admin.\n\nPerform any operation to verify access and then leave the session idle for 10 minutes and perform no activity within the application.\n\nAccess the application after the period of inactivity has expired and determine if the application still allows access.\n\nIf necessary, logout of the application, clear the browser cache, and repeat the same test procedure using the account privileges of a regular user. Leave the session inactive for 15 minutes.\n\nIf the application does not deny access after each user session has exceeded the relevant idle timeout period and there is no documented risk exceptions needed to fulfill mission requirements, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to expire idle user sessions after 10 minutes of inactivity for admin users and after 15 minutes of inactivity for regular users.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-004190</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The project does not provide non-local maintenance and diagnostic capability.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222567</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222567r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-001995</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must not be vulnerable to race conditions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A race condition is a timing event within an application that can become a security vulnerability.  A race condition can occur when a pair of programming calls operating simultaneously do not work in a sequential or coordinated manner.  A race condition is a timing event within software that can become a security vulnerability if the calls are not performed in the correct order.  \n\nThere are different types of race conditions and they are dependent upon the action that the application is undertaking when the race condition occurs.  Some examples of race conditions include but are not limited to:\n\n- Time of check, time of use: the time in which a given resource is checked, and the time that resource is used.\n- Thread based: two threads of execution use a resource simultaneously, resource may be invalid when used.\n- Switch based: variable switches values while switch statement is in progress.\n\nDevelopers must be cognizant of programming sequence and use sanity checks to validate data prior to acting upon it.\n\nA code review or a static code analysis is the method used to identify race conditions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and architecture.\n\nIf the application is a COTS application and the vendor will not provide code review test results that demonstrate the application has been tested and is not susceptible to race conditions, the requirement is NA.\n\nInterview the application admin and identify the most recent code testing and analysis that has been conducted.\n\nReview the test results; verify configuration of analysis tools are set to check for the existence of  race conditions.  \n\nIf race conditions are identified in the test results, verify the latest test results are being used, if not, ensure remediation has been completed.\n\nIf the test results show race conditions exist and no remediation evidence is presented, or if test results are not available, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Be aware of potential timing issues related to application programming calls when designing and building the application.\n\nValidate that variable values do not change while a switch event is occurring.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000366</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003178</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Code review by SonarCloud tests reveal no race conditions.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222568</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000190</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222568r961068_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002000</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must terminate all network connections associated with a communications session at the end of the session.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Networked applications routinely open connections to and from other systems as part of their design and function.  When connections are opened by the application, system resources are consumed.  Terminating the network connection at the end of the application session frees up these resources for later use and aids in maintaining system stability. \n\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level, or de-allocating networking assignments at the application level if multiple application sessions are using a single, operating system level network connection. \n\nThis does not mean that the application terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.\n\nMany applications rely on the underlying OS to control the network connection aspect of the application which is perfectly acceptable.\n\nAdditionally, application specific operational issues may occasionally be encountered which dictate exceptions be granted to this requirement in order to ensure continuity of operations and application availability.\n\nWhen the aforementioned type of situation occurs, the root cause of the issue as well as the mitigations implemented in order to prevent a loss of availability must be documented.   Common mitigation procedures include but are not limited to stopping and restarting application or system services in order to manually release system resources.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the system administrator to determine how the application is designed and configured to terminate network connections at the end of the application session.\n\nIdentify any documented exceptions to the requirement and review associated mitigations.\n\nIf the application provides a management interface for controlling or monitoring application network sessions, access that management interface.  Monitor application network activity.  \n\nIf the application utilizes the underlying OS to control network connections, access the command prompt of the OS.  Run the OS command for observing network connections at the OS.  For Windows and Unix OS&apos;s, use the &quot;netstat&quot; command.  Include command parameters that identify the application and/or process ID. netstat /? or -h provides the list of available parameters.\n\nObserve network activity and associate application processes with network connections.  Repeat use of the command to identify changing network state.\n\nDetermine if application session network connections are being terminated at the end of the session by observing the &quot;state&quot; column of the netstat command output with each iteration.\n\nIf the application does not terminate network connections when application sessions end, this is a finding.\n\nIf exceptions are documented with no mitigation this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure or design the application to terminate application network sessions at the end of the session.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001133</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The application relies on the underlying OS to control the network connection aspect of the application which is perfectly acceptable.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222570</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000514</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222570r961857_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002020</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must utilize FIPS-validated cryptographic modules when signing application components.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications that distribute components of the application must sign the components to provide an identity assurance to consumers of the application component. Components can include application messages or application code.\n\nUse of weak or untested encryption algorithms undermines the purposes of utilizing encryption to validate the author of application components. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance the modules have been tested and validated.\n\nIf the application resides on a National Security System (NSS) it must not use algorithms weaker than SHA-384.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify the cryptographic modules used by the application.\n\nReview the application components and application requirements. Interview application developers and application admins to determine if code signing is performed on distributable application components, files or packages.  \n\nFor example, a developer may sign application code components or an admin may sign application files or packages in order to provide application consumers with integrity assurances.\n\nIf signing has been identified in the application security plan as not being required and if a documented acceptance of risk is provided, this is not a finding.\n\nHave the application admin or the developer demonstrate how the signing algorithms are used and how signing of components including files, code and packages is performed.\n\nWhile SHA1 is currently FIPS-140-2 approved, due to known vulnerabilities with this algorithm, DoD PKI policy prohibits the use of SHA1 as of December 2016.  See DoD CIO Memo Subject: Revised Schedule to Update DoD Public Key Infrastructure Certificates to Secure Hash Algorithm-256. \n\nIf the application signing process does not use FIPS validated cryptographic modules, or if the signing process includes SHA1 or MD5 hashing algorithms, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Utilize FIPS-validated algorithms when signing application components.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002450</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Container images are signed via Docker Content Trust, which uses SHA256 digests.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222571</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000514</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222571r961857_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002030</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must utilize FIPS-validated cryptographic modules when generating cryptographic hashes.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\n\nIf the application resides on a National Security System (NSS) it must not use a hashing algorithm weaker than SHA-384.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application components and the application requirements to determine if the application is capable of generating cryptographic hashes.\n\nReview the application documentation and interview the application developer or administrator to identify the cryptographic modules used by the application.\n\nIf hashing of application components has been identified in the application security plan as not being required and if a documented acceptance of risk is provided, this is not a finding.\n\nHave the application admin or the developer demonstrate how the application generates hashes and what hashing algorithms are used when generating a hash value.\n\nWhile SHA1 is currently FIPS-140-2 approved, due to known vulnerabilities with this algorithm, DoD PKI policy prohibits the use of SHA1 as of December 2016.  See DoD CIO Memo Subject: Revised Schedule to Update DoD Public Key Infrastructure Certificates to Secure Hash Algorithm-256. \n\nIf the application resides on a National Security System (NSS) and uses an algorithm weaker than SHA-384, this is a finding.\n\nIf FIPS-validated cryptographic modules are not used when generating hashes or if the application is configured to use the MD5 or SHA1 hashing algorithm, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to use a FIPS-validated hashing algorithm when creating a cryptographic hash.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002450</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Container images are signed via Docker Content Trust, which uses SHA256 digests.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222572</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000514</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222572r961857_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002040</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must utilize FIPS-validated cryptographic modules when protecting unclassified information that requires cryptographic protection.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the system administrator, review the application components, and the application requirements to determine if the application processes data requiring cryptographic protection.\n\nReview the application documentation and interview the application administrator to identify the cryptographic modules used by the application.\n\nAccess the NIST site to determine if the cryptographic modules used by the application have been FIPS-validated.\n\nhttp://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm\n\nIf the application is using cryptographic modules that are not FIPS-validated to protect unclassified data, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to use a FIPS-validated cryptographic module.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002450</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Conformant data protection techniques should be implemented by the Data Storage service, and/or by Ingress configuration of the Container Platform.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222573</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000514</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222573r961857_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002050</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications making SAML assertions must use FIPS-approved random numbers in the generation of SessionIndex in the SAML element AuthnStatement.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A predictable SessionIndex could lead to an attacker computing a future SessionIndex, thereby, possibly compromising the application.\n\nUse of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the system administrator, review the application components, and the application requirements to determine if the application uses SAML assertions.\n\nIf the application does not use SAML assertions, the requirement is not applicable.\n\nReview the application documentation and interview he application administrator to identify the cryptographic modules used by the application.\n\nAccess the NIST site to determine if the cryptographic modules used by the application have been FIPS-validated.\n\nhttp://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm\n\nIf the application is using cryptographic modules that are not FIPS-validated when generating the SessionIndex in the SAML AuthnStatement, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to use a FIPS-validated cryptographic module.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002450</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The project does not use SAML assertions.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222574</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000211</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222574r961095_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002150</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application user interface must be either physically or logically separated from data storage and management interfaces.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application management functionality includes functions necessary for administration and requires privileged user access. Allowing non-privileged users to access application management functionality capabilities increases the risk that non-privileged users may obtain elevated privileges.\n\nThe separation of user functionality from information system management functionality is either physical or logical and is accomplished by using different computers, different central processing units, different instances of the operating system, different network addresses, different TCP/UDP ports, virtualization techniques, combinations of these methods, or other methods, as appropriate.\n\nAn example of this type of separation is observed in web administrative interfaces that use separate authentication methods for users of any other information system resources. This may include isolating the administrative interface on a different security domain and with additional access controls.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nReview the design documents and the interfaces used by the application.\n\nVerify that the application provides separate interfaces for user traffic and for management traffic. The separation may be virtual in nature (virtual host, virtual NIC, virtual network) or physically separate.\n\nIf the application user interface and the application management interface are shared, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application so user interface to the application and management interface to the application is separated.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001082</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Web application is logically separated from data storage layer.  Authorization for privileged access determined by the OIDC Provider, also logically separated. Web application offers no application configuration functionality in the application itself.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222575</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000219</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222575r1043178_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002210</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must set the HTTPOnly flag on session cookies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>HTTPOnly is a flag included in a Set-Cookie HTTP response header. If the HTTPOnly flag is included in the HTTP response header, the cookie cannot be accessed through client side scripts like JavaScript.\n\nIf the HTTPOnly flag is set, even if a cross-site scripting (XSS) flaw in the application exists, and a user accidentally accesses a link that exploits this flaw, the browser will not reveal the cookie to a third party.\n\nThe HTTPOnly setting is browser dependent however most popular browsers support the feature. If a browser does not support HTTPOnly and a website attempts to set an HTTPOnly cookie, the HTTPOnly flag will be ignored by the browser, thus creating a traditional, script accessible cookie. As a result, the cookie (typically the session cookie) becomes vulnerable to theft or modification by a malicious script running on the client system.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify when session cookies are created.\n\nIdentify any mitigating controls the application developer may have implemented. Examples include utilizing a separate Web Application Firewall that is configured to provide this capability or configuring the web server with Mod_Security or ESAPI WAF with the HTTPOnly flag directives enabled.\n\nReference the most recent vulnerability scan documentation.\n\nVerify the configuration settings for the scan include web application checks including HTTPOnly tests.\n\nReview the scan results and determine if vulnerabilities related to HTTPOnly flag not being set for session cookies have been identified.\n\nUtilize a web browser or other web application diagnostic tool to view the session cookies the application sets on the client.\n\nInternet Explorer versions 8, 9, and 10 includes a utility called Developer tools.\n\nAccess the application website and establish an application session.\n\nAccess the page that sets the session cookie.\n\nPress “F12” to open Developer Tools.\n\nSelect &quot;cache&quot; and then &quot;view cookie information&quot;.\n\nIdentify the session cookies. An example of an HTTPOnly session cookie is as follows:\n\nSet-Cookie: SessionId=z5ymkk45aworjo2l31tlhqqv; path=/; HttpOnly\n\nIf the application does not set the HTTPOnly flag on session cookies or if the application administrator cannot demonstrate mitigating controls, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to set the HTTPOnly flag on session cookies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001184</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web application does not set session cookies. OIDC Provider must be configured appropriately.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222576</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000219</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222576r1043178_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002220</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must set the secure flag on session cookies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Many web development frameworks such as PHP, .NET, ASP as well as application servers include their own mechanisms for session management. Whenever possible it is recommended to utilize the provided session management framework.\n\nSetting the secure bit on session cookie ensures the session cookie is only sent via TLS/SSL HTTPS connections.  This helps to ensure confidentiality as the session cookie is not able to be viewed by unauthorized parties as it transits the network.\n\nSetting the secure flag on all cookies may also be warranted depending upon application design but at a minimum, the session cookie must always be secured.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify when session cookies are created.\n\nIf vulnerability scan results are available, reference the most recent vulnerability scan results.\n\nVerify that the scan configuration includes checks for the secure flag on session cookies.  If scan configuration settings are not available, follow the manual procedure provided below.\n\nReview the scan results and determine if the secure flag not being set was identified as a vulnerability.\n\nTo manually perform the check, open a web browser, logon to the web application and use the web browser to view the new session cookie.  \n\nThe procedures used for viewing and clearing browser cookies will vary based upon the web browser used.  Providing steps for every browser is outside the scope of the STIG.  There are numerous sites that document how to view cookies using various web browsers.\n\nFor IE11:\nAlt-X &gt;&gt; Internet options &gt;&gt; General &gt;&gt; Settings &gt;&gt; View Files\n\nA windows explorer box will open that contains the contents of the Temporary Internet Files.  Browse the folder and locate the application session cookie(s).  View the contents of the cookie(s).\n\nIf the &quot;secure&quot; flag is not set on the session cookie, or if the vulnerability scan results indicate the application does not set the secure flag on cookies, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to ensure the secure flag is set on session cookies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001184</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web application does not set session cookies. OIDC Provider must be configured appropriately.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222577</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000219</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222577r1043178_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002230</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must not expose session IDs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.\n\nApplication communication sessions are protected utilizing transport encryption protocols, such as SSL or TLS. SSL/TLS provides web applications with a means to be able to authenticate user sessions and encrypt application traffic. Session authentication can be single (one-way) or mutual (two-way) in nature. Single authentication authenticates the server for the client, whereas mutual authentication provides a means for both the client and the server to authenticate each other.\n\nThis requirement applies to applications that utilize communications sessions. This includes, but is not limited to, web-based applications and Service-Oriented Architectures (SOA).\n\nThis requirement addresses communications protection at the application session, versus the network packet, and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/SOA will require the use of SSL/TLS mutual authentication (two-way/bidirectional).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and configuration.\n\nInterview the application administrator and obtain implementation documentation identifying system architecture.\n\nIdentify the application communication paths. This includes system to system communication and client to server communication that transmit session identifiers over the network.\n\nHave the application administrator identify the methods and mechanisms used to protect the application session ID traffic. Acceptable methods include SSL/TLS both one-way and two-way and VPN tunnel.\n\nThe protections must be implemented on a point-to-point basis based upon the architecture of the application.\n\nFor example; a web application hosting static data will provide SSL/TLS encryption from web client to the web server. More complex designs may encrypt from application server to application server (if applicable) and application server to database as well.\n\nIf the session IDs are unencrypted across network segments, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to protect session IDs from interception or from manipulation.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001184</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web application does not set session cookies. OIDC Provider must be configured appropriately.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222578</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000220</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222578r1043179_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002240</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must destroy the session ID value and/or cookie on logoff or browser close.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Many web development frameworks such as PHP, .NET, and ASP include their own mechanisms for session management. Whenever possible it is recommended to utilize the provided session management framework.\n\nSession cookies contain application session information that can be used to impersonate the web application user or hijack their application session. Once the user&apos;s session has terminated, these session IDs must be destroyed and not reused.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify how the application destroys session IDs.\n\nIf using a web development framework, ask the application administrator to provide details on the framework&apos;s session configuration.\n\nReview framework configuration setting to determine how the session identifiers are destroyed.\n\nReview the client system and using a browser or other tool capable of viewing client cookies, identify cookies set by the application and verify that application session ID cookies are destroyed once the user has logged off or the browser has closed.\n\nIf the session IDs and associated cookies are not destroyed on logoff or browser close, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to destroy session ID cookies once the application session has terminated.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001185</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web application does not set session cookies. OIDC Provider must be configured appropriately.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222579</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000223</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222579r1043180_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002250</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications must use system-generated session identifiers that protect against session fixation.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Session fixation allows an attacker to hijack a valid user’s application session. The attack focuses on the manner in which a web application manages the user’s session ID. Applications become vulnerable when they do not assign a new session ID when authenticating users thereby using the existing session ID.\n\nMany web development frameworks such as PHP, .NET, and ASP include their own mechanisms for session management. Whenever possible it is recommended to utilize the provided session management framework.\n\nIn many cases, creating a new session ID cookie containing a new unique value whenever authentication is performed will address the issue of session fixation.\n\nAllowing the user to submit a session ID also introduces the risk that the application could be subject to a session fixation attack.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify how the application generates user session IDs.\n\nApplication session testing is required in order to verify this requirement.\n\nRequest the latest application vulnerability or penetration test results.\n\nVerify the test configuration includes session handling vulnerability tests.\n\nIf the application is re-using/copying the users existing session ID that was created on one system in order to maintain user state when traversing multiple application servers in the same domain, this is not a finding.\n\nIf the session testing results indicate application session IDs are re-used after the user has logged out, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design the application to generate new session IDs with unique values when authenticating user sessions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001664</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web application does not set session cookies. OIDC Provider must be configured appropriately.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222580</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000223</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222580r1043180_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002260</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications must validate session identifiers.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Many web development frameworks such as PHP, .NET, and ASP include their own mechanisms for session management. Whenever possible it is recommended to utilize the provided session management framework.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify how the application validates session IDs.\n\nIf using a web development framework, ask the application administrator to provide details on the framework&apos;s session configuration as it relates to session validation.\n\nIf the application is not configured to validate user session identifiers, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to configure user session identifiers.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001664</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web application does not set session cookies. OIDC Provider must be configured appropriately.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222581</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000223</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222581r1043180_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002270</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications must not use URL embedded session IDs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Many web development frameworks such as PHP, .NET, and ASP include their own mechanisms for session management. Whenever possible it is recommended to utilize the provided session management framework.\n\nUsing a session ID that is copied to the URL introduces the risks that the session ID information will be written to log files, made available in browser history files, or made publicly available within the URL.\n\nUsing cookies to establish session ID information is desired.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify how the application generates session IDs.\n\nIf using a web development framework, ask the application administrator to provide details on the framework&apos;s session configuration.\n\nReview the framework configuration setting to determine how the session identifiers are created.\n\nIdentify any compensating controls that may be leveraged to minimize risk to user sessions.\n\nIf the framework or the application is configured to transmit cookies within the URL or via URL rewriting, or if the session ID is created using a GET method and there are no compensating controls configured to address user session security, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to transmit session ID information via cookies.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001664</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web application does not set session cookies. OIDC Provider must be configured appropriately.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222582</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000223</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222582r1043180_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002280</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must not re-use or recycle session IDs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Many web development frameworks such as PHP, .NET, and ASP include their own mechanisms for session management. Whenever possible it is recommended to utilize the provided session management framework.\n\nSession identifiers are assigned to application users so they can be uniquely identified. This allows the user to customize their web application experience and also allows the developer to differentiate between users thereby providing the opportunity to customize the user’s features and functions.\n\nOnce a user has logged out of the application or had their session terminated, their session IDs should not be re-used. Session IDs should also not be used for other purposes such as creating unique file names and they should also not be re-assigned to other users once the original user has logged out or otherwise quit the application.\n\nAllowing session ID reuse increases the risk of replay attacks.\n\nSession testing is a detailed undertaking and is usually done in the course of a web application vulnerability or penetration assessment.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify how the application generates user session IDs.\n\nApplication session testing is required in order to verify this requirement.\n\nRequest the latest application vulnerability or penetration test results.\n\nVerify the test configuration includes session handling vulnerability tests.\n\nIf the application is re-using/copying the users existing session ID that was created on one system in order to maintain user state when traversing multiple application servers in the same domain, this is not a finding.\n\nIf the session testing results indicate application session IDs are re-used after the user has logged out, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design the application to not re-use session IDs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001664</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web application does not set session cookies. OIDC Provider must be configured appropriately.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222583</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000224</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222583r1051270_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002290</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate a unique session identifier using a FIPS 140-2/140-3 approved random number generator.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application server will use session IDs to communicate between modules or applications within the application server and between the application server and users. The session ID allows the application to track the communications along with credentials that may have been used to authenticate users or modules.\n\nUnique session IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session identifiers help to reduce predictability of those identifiers.\n\nUnique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application server configuration and documentation to determine if the application server uses a FIPS 140-2/140-3 approved random number generator to create unique session identifiers.\n\nHave a user log on to the application server to determine if the session IDs generated are random and unique.\n\nIf the application server does not generate unique session identifiers and does not use a FIPS 140-2/140-3 random number generator to create the randomness of the session ID, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application server to generate unique session identifiers and to use a FIPS 140-2/140-3 random number generator to generate the randomness of the session identifiers.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001188</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The web application does not set session cookies. OIDC Provider must be configured appropriately.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222584</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000427</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222584r961596_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002300</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must only allow the use of DoD-approved certificate authorities for verification of the establishment of protected sessions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoD-approved CA, trust of this CA has not been established.\n\nThe DoD will only accept PKI certificates obtained from a DoD-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of SSL/TLS certificates.\n\nThis requirement focuses on communications protection for the application session rather than for the network packet.\n\nThis requirement applies to applications that utilize communications sessions. This includes, but is not limited to, web-based applications and Service-Oriented Architectures (SOA).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify certificate location.\n\nInternet Explorer can be used to view certificate information:\n\nSelect “Tools”\nSelect “Internet Options”\nSelect “Content” tab\nSelect “Certificates”\nSelect the certificate used for authentication:\n\nClick “View”\nSelect “Details” tab\nSelect “Issuer”\n\nIf the application utilizes PKI certificates other than DoD-approved PKI and ECA certificates, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to utilize DoD-approved PKI established CAs when verifying DoD-signed certificates.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002470</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects DoD-approved CAs to be referenced by the OIDC Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222585</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000225</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222585r961122_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002310</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Failure to a known safe state helps prevent systems from failing to a state that may cause loss of data or unauthorized access to system resources. Applications or systems that fail suddenly and with no incorporated failure state planning may leave the hosting system available but with a reduced security protection capability. Preserving information system state information also facilitates system restart and return to the operational mode of the organization with less disruption of mission-essential processes.\n\nIn general, application security mechanisms should be designed so that a failure will follow the same execution path as disallowing the operation. For example, security methods, such as isAuthorized(), isAuthenticated(), and validate(), should all return false if there is an exception during processing. If security controls can throw exceptions, they must be very clear about exactly what that condition means.\n\nAbort refers to stopping a program or function before it has finished naturally. The term abort refers to both requested and unexpected terminations.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review application design documentation, vulnerability scanner reports and interview application administrator to identify application components.\n\nThe design of the application should account for the following:\n\n- Connections to databases are left open\n- Access control mechanisms are disabled\n- Data left in temporary locations\n\nTesting application failure will require taking down parts of the application.\n\nReview the vulnerability assessment configuration settings included in vulnerability report.\n\nExamine the application test plans and procedures to determine if this type of failure was previously tested.\n\nIf test plans exist, validate the tests by performing a subset of the checks.\n\nIf test plans do not exist, an application failure must be simulated.\n\nSimulate a failure. This can be accomplished by stopping the web server service and/or the database service. Also, for applications using web services stop the web service and/or the database.\n\nCheck to ensure that application data is still protected. Some examples of tests follow:\n\n- Try to submit SQL queries to the database. Verify that the database requires authentication before returning data.\n- Try to read the application source files; access should not be granted to these files because the application is not operating.\n- Try to open database files; data should not be available because the application is not operational.\n\nIf the application fails in such a way that the application security controls are rendered inoperable, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Fix any vulnerability found when the application is an insecure state (initialization, shutdown and aborts).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001190</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects fail-safe procedures to be implemented by the Container Platform (i.e, k8s).  The web application is provided as a stateless container that caches no data and will not respond with data to requests when components are inoperable or inaccessible.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222586</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000226</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222586r961125_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002320</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>In the event of a system failure, applications must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. Preserving application state information helps to facilitate application restart and return to the operational mode of the organization with less disruption to mission-essential processes.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review application documentation, interview application administrator to identify how the application logs error events.\n\nThe application operational requirements documentation should provide the specific information that must be preserved in order to return the application back into operation as quickly and efficiently as possible. The application administrator will need to identify and provide the information based upon operational requirements documents.\n\nApplication diagnostic information should be kept in logs for evaluation and investigation into root cause.\n\nIf documentation is provided stating that no particular information needs to be retained in order to expediently bring the application back online, this is not a finding.\n\nIf the application does not log the data required to determine root cause of application failure, or if information specified as required in order to expediently bring the application back online is not retained, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Create operational configuration documentation that identifies information needed for the application to return back into service or specify no such data is required, and retain data required to determine root cause of application failures.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001665</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects fail-safe procedures to be implemented by the Container Platform (i.e, k8s).  The web application is provided as a stateless container that caches no data and will not respond with data to requests when components are inoperable or inaccessible.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222587</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000231</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222587r961128_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002330</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must protect the confidentiality and integrity of stored information when required by DoD policy or the information owner.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive and tape drive) within an organizational information system. Mobile devices, laptops, desktops, and storage devices can be either lost or stolen, and the contents of their data storage (e.g., hard drives and non-volatile memory) can be read, copied, or altered. \n\nApplications and application users generate information throughout the course of their application use, including data that is stored in areas of volatile memory.  Volatile memory must not be overlooked when assigning protections.\n\nThis requirement addresses protection of user-generated data, as well as, operating system-specific configuration data. \n\nApplications must employ mechanisms to achieve confidentiality and integrity protections, as appropriate, in accordance with the security category and/or classification of the information.\n\nThis can include segmenting and controlling access to the data such as utilizing file permissions to restrict access, using role based controls to restrict access or applying a cryptographic hash to the data and evaluating hash values for changes made to data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify the data processed by the application and the accompanying data protection requirements.\n\nDetermine if the data owner has specified stored data protection requirements.\n\nDetermine if the application is processing publicly releasable, FOUO or classified stored data.\n\nDetermine if the application configuration information contains sensitive information.\n\nAccess the data repository and have the application administrator, application developer or designer identify the data integrity and confidentiality protections utilized to protect stored data.\n\nIf the application processes classified data or if the data owner has specified data protection requirements and the application administrator is unable to demonstrate how the data is protected, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Identify data elements that require protection. Document the data types and specify protection requirements and methods used.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001199</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects conformant data storage procedures to be implemented by the Data Storage layer.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222588</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000428</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222588r961599_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002340</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must implement approved cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined information system components.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications handling data requiring &quot;data at rest&quot; protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.\n\nSelection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the documentation and interview the application administrator.\n\nIdentify the data processed by the application and the accompanying data protection requirements.\n\nDetermine if the data owner has specified data protection encryption requirements regarding modification of data.\n\nDetermine if the application is processing publicly releasable, FOUO or classified data.\n\nDetermine if the application configuration information contains sensitive information.\n\nIf the data is strictly publicly releasable information and system documentation specifies no data encryption is required for any hosted application data, this is not applicable.\n\nAccess the data repository and have the application administrator identify the encryption protections that are utilized.\n\nIf the application processes classified data or if the data owner has specified encryption requirements and the application administrator is unable to demonstrate how the data is encrypted, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Identify data elements that require protection.\n\nDocument the data types and specify encryption requirements.\n\nEncrypt data according to DoD policy or data owner requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002475</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects conformant data storage procedures to be implemented by the Data Storage layer.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222589</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000429</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222589r961602_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002350</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must use appropriate cryptography in order to protect stored DoD information when required by the information owner or DoD policy.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications handling data requiring &quot;data at rest&quot; protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.\n\nSelection of a cryptographic mechanism is based on the need to protect the confidentiality of organizational information. The strength of mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields).\n\nSpecial care must be taken to cryptographically protect classified data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify the data processed by the application and the accompanying data protection requirements.\n\nDetermine if the application is processing publicly releasable, SBU, FOUO, or classified data.\n\nIf the data is strictly publicly releasable information with no SBU, FOUO, or classified and system documentation specifies no data encryption is required for any hosted application data, this requirement is not applicable.\n\nHave the application administrator identify the encryption protections that are utilized.\n\nValidate the application is using encryption protections that are commensurate with the data being protected.\n\nIf the application is processing classified data, type 1, suite B cryptography, or hardware-based encryption solutions; meeting NSA encryption requirements for classified data processing and storage is required.\n\nIf the application processes classified data or if the data owner has specified encryption requirements and the application administrator is unable to demonstrate the type of encryption used or if the application processes classified and does not use type 1, suite B, or NSA-approved hardware-based encryption, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Identify data elements that require protection.\n\nDocument the data types and specify encryption requirements.\n\nEncrypt classified data using Type 1, Suite B, or other NSA-approved encryption solutions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002476</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects conformant data storage procedures to be implemented by the Data Storage layer.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222590</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000233</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222590r961131_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002360</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must isolate security functions from non-security functions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>An isolation boundary provides access control and protects the integrity of the hardware, software, and firmware that perform security functions.\n\nSecurity functions are the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based.\n\nDevelopers and implementers can increase the assurance in security functions by employing well-defined security policy models; structured, disciplined, and rigorous hardware and software development techniques; and sound system/security engineering principles. Implementation may include isolation of memory space and libraries. Applications restrict access to security functions through the use of access control mechanisms and by implementing least privilege capabilities.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify if the application utilizes access controls.\n\nCommonly employed access controls include Role-Based Access Controls (RBAC), Access Control Lists (ACL) and Mandatory Access Controls (MAC).\n\nEnsure the application utilizes a control structure that is capable of protecting security assets such as policy and configuration settings from unauthorized modification.\n\nIf the application does not protect security functions that enforce security policy and protect security configuration settings, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Implement controls within the application that limits access to security configuration functionality and isolates regular application function from security-oriented function.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001084</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The project RBAC is described in the documentation.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222591</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000431</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222591r961608_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002370</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must maintain a separate execution domain for each executing process.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications can maintain separate execution domains for each executing process by assigning each process a separate address space. Each process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.\n\nAn example is a web browser with process isolation that provides tabs that are separate processes using separate address spaces to prevent one tab crashing the entire browser.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation, the architecture documentation and interview the application administrator.\n\nIdentify if the application architecture provides the capability to sandbox executing processes so as to prevent a process in one application domain from sharing another application domain.\n\nAsk the application administrator to demonstrate how the application processes are separated. This may be demonstrated by examining the OS processes running on the system and identifying the separate application processes.\n\nIf the application does not maintain a separate execution domain for each executing process, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure applications to maintain a separate execution domain for each executing process.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002530</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The project should be deployed as an immutable, stateless container that runs in a single, isolated execution domain.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222592</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000243</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222592r961149_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002380</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications must prevent unauthorized and unintended information transfer via shared system resources.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection.\n\nThis requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DoD or other government agencies.\n\nThere may be shared resources with configurable protections (e.g., files on storage) that may be assessed on specific information system components.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify if the application shares information resources via file sharing protocol or if the application includes configuration settings that provide access to data files on the hard drive.\n\nAlso determine if the application transfers data via shared system resources.\n\nIf the application shares system resources with other applications, verify that a security boundary exists which controls and prevents other applications, processes, or users from accessing application data. The control mechanism will vary based upon the resource that is being shared. Hard disk sharing could possibly utilize file permissions restrictions, whereas shared overall system resources could implement virtualization or containers that restrict access.\n\nIf the application does not prevent unauthorized and unintended information transfer via shared system resources, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure or design the application to utilize a security control that will implement a boundary that will prevent unauthorized and unintended information transfer via shared system resources.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001090</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The project should be deployed as an immutable, stateless container that is isolated from other host processes (i.e, k8s)</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222593</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000435</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222593r961620_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002390</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>XML-based applications must mitigate DoS attacks by using XML filters, parser options, or gateways.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity.\n\nXML-based applications are susceptible to DoS attacks due to the nature of XML parsing being processor intensive and complicated.\n\nBest practice for parsing XML to avoid DoS include:\n\n- Using a proven XML parser\n- Using an XML gateway that provides DoS protection\n- Using parser options that provide limits on recursive payloads, oversized payloads, and entity expansion.\n\nThis requirement addresses the configuration of applications to mitigate the impact of DoS attacks that have occurred or are ongoing on application availability. For each application, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or restricting the number of sessions the application opens at one time). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application architecture documentation and interview the application administrator to identify what steps have been taken to protect the XML aspect of the application from DoS attacks.\n\nIf the application does not contain or utilize XML, the requirement is not applicable.\n\nAsk the application administrator to demonstrate how the application is configured to provide the following protections:\n\n- Validation against recursive payloads\n- Validation against oversized payloads\n- Protection against XML entity expansion\n- Validation against overlong element names\n- Optimized configuration for maximum message throughput\n\nIf the application administrator cannot demonstrate how these protections are implemented either within the application itself or by third-party tools or utilities like an XML gateway, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Implement:\n\n- Validation against recursive payloads\n- Validation against oversized payloads\n- Protection against XML entity expansion\n- Validation against overlong element names\n- Optimized configuration for maximum message throughput in order to ensure DoS attacks against web services are limited.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002385</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The project uses the library &apos;fast-xml-parser&apos; a maintained library whose development pipeline tests itself against XML based attacks.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222594</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000246</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222594r961152_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002400</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must restrict the ability to launch Denial of Service (DoS) attacks against itself or other information systems.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Denial of Service (DoS) is a condition where a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity.\n\nIndividuals of concern can include hostile insiders or external adversaries that have access or have successfully breached the information system and are using the system as a platform to launch cyber attacks on the application, the application host or other third-parties.\n\nApplication developers and application administrators must take the steps needed to ensure an application cannot be used to launch DoS attacks against the application itself, the application host or other systems and networks. \n\nApplication developers should be cognizant that many attackers using DoS techniques will attempt to identify resource intensive processes and functions within the application.  For web applications, this can be application objects that perform database queries or other resource intensive tasks.  Improper application memory management can also lead to memory leaks which can exhaust system resources forcing a system or application restart.  \n\nLimiting attempts to repeatedly execute application processes by validating the requests also reduces the ability to launch some DoS attacks.\n\nFor application administrators, ensuring network access controls are in place to protect the application host.\n\nThe methods employed to counter DoS risks are dependent upon the application layer methods that can be used to exploit it.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nAsk the application administrator if any anti-DoS technology or anti-DoS emergency response services are deployed to protect the application.\n\nCheck for code review, penetration or vulnerability test results that attempt to DoS the application or use the application as a DoS tool.\n\nExamine test results and testing configuration to ensure that the application was tested and the application was not reported as being susceptible to DoS attacks either from external sources or from the application itself. Also verify the testing results show that the application cannot be weaponized to attack other systems.\n\nIf the test results indicate the application is susceptible to DoS attacks or can be weaponized to attack other applications or systems, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and deploy the application to utilize controls that will prevent the application from being affected by DoS attacks or being used to attack other systems. This includes but is not limited to utilizing throttling techniques for application traffic such as QoS or implementing logic controls within the application code itself that prevents application use that results in network or system capabilities being exceeded.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001094</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects to be deployed in a Container Platform that resists DoS attacks.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222595</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000247</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222595r961155_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002410</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The web service design must include redundancy mechanisms when used with high-availability systems.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity.\n\nIn the case of application DoS attacks, care must be taken when designing the application to ensure the application makes the best use of system resources. SQL queries have the potential to consume large amounts of CPU cycles if they are not tuned for optimal performance. Web services containing complex calculations requiring large amounts of time to complete can bog down if too many requests for the service are encountered within a short period of time.\n\nThe methods employed to meet this requirement will vary depending upon the technology the application utilizes. However, a variety of technologies exist to limit or, in some cases, eliminate the effects of application related DoS attacks. Employing increased capacity and bandwidth combined with specialized application layer protection devices and service redundancy may reduce the susceptibility to some DoS attacks.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the application administrator and review the system documentation to determine if the application has been designated as a high availability system and if the application is designed to operate in a high availability environment.\n\nIf the application has not been designated as a high availability system, this requirement is not applicable.\n\nReview the application architecture documentation and identify solutions that provide application DoS protections. \n\nVerify the application has been built to work in a clustered or otherwise high availability environment in accordance with documented availability requirements.\n\nThis includes:\n\n- load balancers\n- redundant systems such as multiple web, application servers or DB servers\n- high bandwidth or redundant data circuits\n- multiple data centers (geographic dispersal)\n- server clusters\n\nIf the application has been designated as high availability but the architecture is not built to high availability standards, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Build the application to address issues that are found in a redundant environment and utilize redundancy mechanisms to provide high availability.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001095</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects to be deployed in a Container Platform that provides high-availability services.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222596</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000439</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222596r961632_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002440</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must protect the confidentiality and integrity of transmitted information.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered.\n\nThis requirement applies  to those applications that transmit data, or allow access to data non-locally. Application and data owners have a responsibility for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. \n\nApplication and data owners need to identify the data that requires cryptographic protection. If no data protection requirements are defined as to what specific data must be encrypted and what data is non-sensitive and doesn&apos;t require encryption, all data must be encrypted.\n \nWhen transmitting data, applications need to leverage transmission protection mechanisms, such as TLS, SSL VPNs, or IPSEC.\n\nCommunication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify application clients, servers and associated network connections including application networking ports.  \n\nIdentify the types of data processed by the application and review any documented data protection requirements.\n\nIdentify the application communication protocols.\n\nReview application documents for instructions or guidance on configuring application encryption settings.\n\nVerify the application is configured to enable encryption protections for data in accordance with the data protection requirements. If no data protection requirements exist, ensure all application data is encrypted.\n\nIf the application does not utilize TLS, IPsec or other approved encryption mechanism to protect the confidentiality and integrity of transmitted information, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure all of the application systems to require TLS encryption in accordance with data protection requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002418</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects to be deployed in a Container Platform that protects the confidentiality and integrity of transmitted information.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222597</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000440</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222597r961635_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002450</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Data is subject to manipulation and other integrity related attacks whenever that data is transferred across a network. To protect data integrity during transmission, the application must implement mechanisms to ensure the integrity of all transmitted information.\n\nAll transmitted information means that the protections are not restricted to just the data itself. Protection mechanisms must be extended to include data labels, security parameters, or metadata if data protection requirements specify.\n\nModern web application data transfer methods can be complex and are not necessarily just point-to-point in nature. Service-Oriented Architecture (SOA) and RESTFUL web services allow for XML-based application data to be transmitted in a manner similar to network traffic wherein the application data is transmitted along multiple servers&apos; hops.\n\nIn such cases, point-to-point protection methods like TLS or SSL may not be the best choice for ensuring data integrity and alternative data integrity protection methods like XML Integrity Signature protections where the XML payload itself is signed may be required as part of the application design.\n\nOverall application design and architecture must always be taken into account when establishing data integrity protection mechanisms. Custom-developed solutions that provide a file transfer capability should implement data integrity checks for incoming and outgoing files. Transmitted information requires mechanisms to ensure the data integrity (e.g., digital signatures, SSL, TLS, or cryptographic hashing).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation, the application architecture designs and interview the application administrator.\n\nAsk the application admin to identify the network path taken by the application data and demonstrate the application support integrity mechanisms for transmission of both incoming and outgoing files and any transmitted data.\n\nFor example, hashing/digital signature and cyclic redundancy checks (CRCs) can be used to confirm integrity on data streams and transmitted files.\n\nUse of TLS can be used to assure integrity in point-to-point communication sessions.\n\nWhen the application uses messaging or web services or other technologies where the data can traverse multiple hops, the individual message or packet must be encrypted to protect the integrity of the message.\n\nIf the application is not configured to provide cryptographic protections to application data while it is transmitted unless protected by alternative safety measures like a PDS, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to use cryptographic protections to prevent unauthorized disclosure of application data based upon the application architecture.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002421</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects to be deployed in a Container Platform that protects the confidentiality and integrity of transmitted information.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222598</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000441</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222598r961638_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002460</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must maintain the confidentiality and integrity of information during preparation for transmission.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Data is subject to manipulation and other integrity related attacks whenever that data is transferred across a network. To protect data integrity during transmission, the application must implement mechanisms to ensure the integrity of all transmitted information. All transmitted information means that the protections are not restricted to just the data itself. Protection mechanisms must be extended to include data labels, security parameters or metadata if data protection requirements specify. Modern web application data transfer methods can be complex and are not necessarily just point-to-point in nature. Service-Oriented Architecture (SOA) and RESTFUL web services allow for XML-based application data to be transmitted in a manner similar to network traffic wherein the application data is transmitted along multiple servers&apos; hops. In such cases, point-to-point protection methods like TLS or SSL may not be the best choice for ensuring data integrity and alternative data integrity protection methods like XML Integrity Signature protections where the XML payload itself is signed may be required as part of the application design. Overall application design and architecture must always be taken into account when establishing data integrity protection mechanisms. Custom-developed solutions that provide a file transfer capability should implement data integrity checks for incoming and outgoing files. Transmitted information requires mechanisms to ensure the data integrity (e.g., digital signatures, SSL, TLS, or cryptographic hashing).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify web servers and associated network connections.\n\nAccess the application with a web browser.\n\nVerify the web browser goes secure automatically by automatically redirecting the browser to a secure port running TLS encryption, or ensure the port used by the application uses TLS encryption by default.\n\nFor tiered applications, (web server, application server, database server) verify the communication channels between the tiers is also encrypted.\n\nIf the application does not utilize TLS to protect the confidentiality and integrity of transmitted information, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure all of the application systems to require TLS encryption.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002420</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects to be deployed in a Container Platform that protects the confidentiality and integrity of transmitted information.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222599</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000442</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222599r961641_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002470</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must maintain the confidentiality and integrity of information during reception.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Data is subject to manipulation and other integrity related attacks whenever that data is transferred across a network. To protect data integrity during transmission, the application must implement mechanisms to ensure the integrity of all transmitted information. All transmitted information means that the protections are not restricted to just the data itself. Protection mechanisms must be extended to include data labels, security parameters or metadata if data protection requirements specify. Modern web application data transfer methods can be complex and are not necessarily just point-to-point in nature. Service-Oriented Architecture (SOA) and RESTFUL web services allow for XML-based application data to be transmitted in a manner similar to network traffic wherein the application data is transmitted along multiple servers&apos; hops. In such cases, point-to-point protection methods like TLS or SSL may not be the best choice for ensuring data integrity and alternative data integrity protection methods like XML Integrity Signature protections where the XML payload itself is signed may be required as part of the application design. Overall application design and architecture must always be taken into account when establishing data integrity protection mechanisms. Custom-developed solutions that provide a file transfer capability should implement data integrity checks for incoming and outgoing files. Transmitted information requires mechanisms to ensure the data integrity (e.g., digital signatures, SSL, TLS, or cryptographic hashing).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify web servers and associated network connections.\n\nAccess the application with a web browser.\n\nVerify the web browser goes secure automatically by automatically redirecting the browser to a secure port running TLS encryption, or ensure the port used by the application uses TLS encryption by default.\n\nFor tiered applications, (web server, application server, database server) ensure the communication channels between the tiers is also encrypted.\n\nIf the application does not utilize TLS to protect the confidentiality and integrity of transmitted information, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure all of the application systems to require TLS encryption.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002422</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects to be deployed in a Container Platform that protects the confidentiality and integrity of transmitted information.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222600</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000441</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222600r961638_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002480</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must not disclose unnecessary information to users.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Applications should not disclose information not required for the transaction. (e.g., a web application should not divulge the fact there is a SQL server database and/or its version).\n\nThese events usually occur when the web application has not been configured to send specific error messages for error events. Instead, when a processing anomaly occurs, the application displays technical information about the type of application server, database in use, or other technical details.\n\nThis provides attackers additional information which they can use to find other attack avenues, or tailor specific attacks, on the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application system documentation and interview the application administrators.\n\nAsk them to demonstrate how the web server and application configuration does not disclose any information about the application which could be used by an attacker to gain access to the application.\n\nAsk the application representative to logon as a non-privileged user and review all screens of the application to identify any potential data that should not be disclosed to the user.\n\nReview web server configuration and determine if custom error pages are configured to display on error events.\n\nReview error pages sent to application users to verify the pages are generic in nature and provide no technical details related to application architecture.\n\nIf the application displays any application technical data such as database version, application server information, or any other technical details that should not be disclosed to a regular user, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to not display technical details about the application architecture on error events.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002420</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Error messages do not include sensitive or privileged information.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222601</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000441</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222601r961638_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002485</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must not store sensitive information in hidden fields.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Hidden fields allow developers to process application data without having to display it on the screen.  Using hidden fields to pass data in forms is a common practice among web applications and by itself is not a security risk.  \n\nHowever, hidden fields are not secure and can be easily manipulated by users.  Information requiring confidentiality or integrity protections must not be placed in a hidden field.   If data that is sensitive must be stored in a hidden field, it must be encrypted.\n\nFurthermore, hidden fields used to control access decisions can lead to a complete compromise of access control mechanisms allowing immediate compromise of the user&apos;s application session.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview application administrator and review application documentation to identify and familiarize with the application features and functions.\n\nRequest most recent code review and vulnerability scan results.  Review test configuration to ensure testing for hidden fields was conducted.  Review test results for incidents of hidden data fields.  \n\nExamine identified hidden fields and determine what type of data is stored in the hidden fields.\n\nIf the data stored in the hidden fields are determined to be authentication or session related data, or if the code review or vulnerability scan results are not available and configured to test for hidden fields, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to not store sensitive information in hidden fields.  \n\nEncrypt sensitive information stored in hidden fields using DoD-approved encryption and use server side session management techniques for user session management.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002420</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>No sensitive authentication or session data is stored in hidden fields. \nSonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222602</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000251</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222602r961158_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002490</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must protect from Cross-Site Scripting (XSS) vulnerabilities.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>XSS attacks are essentially code injection attacks against the various language interpreters contained within the browser. XSS can be executed via HTML, JavaScript, VBScript, ActiveX; essentially any scripting language a browser is capable of processing.\n\nXSS vulnerabilities are created when a website does not properly sanitize, escape, or encode user input. For example, &quot;&lt;&quot; is the HTML encoding for the &quot;&lt;&quot; character. If the encoding is performed, the script code will not execute.\n\nThere are 3 parties involved in an XSS attack, the attacker, the trusted and vulnerable website, and the victim. An attacker will take advantage of a vulnerable website that does not properly validate user input by inserting malicious code into any data entry field.\n\nWhen the victim visits the trusted website and clicks on the malicious link left by the attacker, the attacker’s script is executed in the victims browser with the trust permissions assigned to the site.\n\nThere are several different types of XSS attack and the complete details regarding XSS cannot be described completely here.\n\nTo address the issue of XSS, web application developers must escape, encode or otherwise validate all user input that is processed and output by the web server. They should also use web templates or a web development framework that provides the capability to encode or otherwise validate user input.\n\nExamples of XSS vulnerabilities can be obtained from the Open Web Application Security Project (OWASP) website.\n  \nThe site is available by pointing your browser to https://www.owasp.org.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and the vulnerability assessment scan results from automated vulnerability assessment tools.\n\nVerify scan configuration settings include web-based applications settings which include XSS tests.\n\nReview scan results for XSS vulnerabilities.\n\nIf the scan results indicate aspects of the application are vulnerable to XSS, request subsequent scan data that shows the XSS vulnerabilities previously detected have been fixed.\n\nIf results that show compliance are not available, request proof of any steps that have been taken to mitigate the risk. This can include using network-based IPS to detect and prevent XSS attacks from occurring.\n\nIf scan results are not available, perform manual testing in various data entry fields to determine if XSS exist.\n\nNavigate through the web application as a regular user and identify any data entry fields where data can be input.\n\nInput the following strings:\n\n&lt;script&gt;alert(&apos;hello&apos;)&lt;/script&gt;\n&lt;img src=x onerror=&quot;alert(document.cookie);&quot;\n\nIf the script pop up box is displayed, or if scan reports show unremediated XSS results and no mitigating steps have been taken, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Verify user input is validated and encode or escape user input to prevent embedded script code from executing.\n\nDevelop your application using a web template system or a web application development framework that provides auto escaping features rather than building your own escape logic.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001310</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>SonarCloud scans, OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222603</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000251</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222603r961158_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002500</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must protect from Cross-Site Request Forgery (CSRF) vulnerabilities.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Cross-Site Request Forgery (CSRF) is an attack where a website user is forced to execute an unwanted action on a website that he or she is currently authenticated to. An attacker, through social engineering (e.g., e-mail or chat) creates a hyperlink which executes unwanted actions on the website the victim is authenticated to and sends it to the victim. If the victim clicks on the link, the action is executed unbeknownst to the victim.\n\nA CSRF attack executes a website request on behalf of the user which can lead to a compromise of the user’s data. What is needed to be successful is for the attacker to know the URL, an authenticated application user, and trick the user into clicking the malicious link.\n\nWhile XSS is not needed for a CSRF attack to work, XSS vulnerabilities can provide the attacker with a vector to obtain information from the user that may be used in mitigating the risk. The application must not be vulnerable to XSS as an XSS attack can be used to help defeat token, double-submit cookie, referrer and origin-based CSRF defenses.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation, the code review reports and the vulnerability assessment scan results from the automated vulnerability assessment tools.\n\nVerify scan configuration settings include web-based application settings which include XSS tests.\n\nReview the scan results for CSRF vulnerabilities.\n\nIf the scan results indicate aspects of the application are vulnerable to CSRF, request subsequent scan data that shows the CSRF vulnerabilities previously detected have been fixed.\n\nIf results that show compliance are not available, request proof of any steps that have been taken to mitigate the risk.\n\nMitigation steps include using web reputation filters to identify sources of exploits delivered via CSRF, web application firewalls that validate cookie and the referrer field in the HTTP headers, or product specific IPS filters that identify and intercept known CSRF vulnerabilities in web-based applications.\n\nIf scan results are not available ask the application administrator to provide evidence that shows the application is designed to address CSRF security issues. There are various methods for mitigating the risk, including using a challenge token that is tied to the users session.\n\nIf application scan results show an unremediated CSRF vulnerability, or if no scan results are available, or no mitigations have been enabled, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to use unpredictable challenge tokens and check the HTTP referrer to ensure the request was issued from the site itself.  Implement mitigating controls as required such as using web reputation services.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001310</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222604</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000251</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222604r961158_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002510</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must protect from command injection.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A command injection attack is an attack on a vulnerable application where improperly validated input is passed to a command shell setup in the application. The result is the ability of an attacker to execute OS commands via the application.\n\nA command injection allows an attacker to execute their own commands with the same privileges as the application executing.\n\nThe following is an example of a URL based command injection attack.\n\nBefore alteration:\nhttp://sitename/cgi-bin/userData.pl?doc=user1.txt\n\nExample URL modified: \nhttp://sitename/cgi-bin/userData.pl?doc=/bin/ls|\n\nThe result is the execution of the command “/bin/ls” which could allow the attacker to list contents of the directory via the browser.\n\nThe following is a list of functions vulnerable to command injection sorted according to language.  \n\nLanguage Functions/Characters\n- C/C++  - system(), popen(), execlp(), execvp(), ShellExecute(), ShellExecuteEx(), _wsystem()\n- Perl - system, exec, `,open, |, eval, /e\n- Python - exec, eval, os.system, os.popen, execfile, input, compile\n- Java - Class.forName(), Class.newInstance(), Runtime.exec()</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and the system configuration settings.\n\nInterview the application administrator for details regarding security assessment including automated code review and vulnerability scans conducted to test for command injection.\n\nReview the scan results from the entire application.\n\nVerify scan configuration is set to check for command injection vulnerabilities.\n\nIf results indicate vulnerability, verify a subsequent scan has been run to ensure the issue has been remediated.\n\nManual test procedures are available on the OWASP website. Procedures may need to be modified to suit application architecture.\n\nhttps://www.owasp.org/index.php/Testing_for_Command_Injection_%28OTG-INPVAL-013%29\n\nIf testing results are not provided demonstrating the vulnerability does not exist, or if the application representative cannot demonstrate how actions are taken to identify and protect from command injection vulnerabilities, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Modify the application so as to escape/sanitize special character input or configure the system to protect against command injection attacks based on application architecture.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001310</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222605</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000251</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222605r961158_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002520</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must protect from canonical representation vulnerabilities.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Canonical representation vulnerabilities can occur when a data conversion process does not convert the data to its simplest form resulting in the possible misrepresentation of the data.\n\nThe application may behave in an unexpected manner when acting on input that has not been sanitized or normalized.\n\nVulnerable application code is written to expect one form of data and executes its program logic on another form of data thereby creating instability or unexpected behavior.\n\nThe Open Web Application Security Project (OWASP) website provides test and remediation procedures that can be used for testing if vulnerability scan tools or results are not available.\n\nThe site is available by pointing your browser to https://www.owasp.org.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator for details regarding security assessment code reviews or vulnerability scans.\n\nReview the scan results from the entire application. This can be provided as results from an automated code review or a vulnerability scanning tool.\n\nReview the scan results to determine if there are any existing canonical representation vulnerabilities.\n\nReview web server and application configuration.\n\nThe OWASP website provides the following test procedures:\n\n&quot;Investigate the web application to determine if it asserts an internal code page, locale, or culture.\n\nIf the default character set, locale is not asserted it will be one of the following:\n\nHTTP Posts. Interesting tidbit: All HTTP posts are required to be ISO 8859-1, which will lose data for most double byte character sets. You must test your application with your supported browsers to determine if they pass in fully encoded double byte characters safely\n\nHTTP Gets. Depends on the previously rendered page and per-browser implementations, but URL encoding is not properly defined for double byte character sets. IE can be optionally forced to do all submits as UTF-8 which is then properly canonicalized on the server\n\n.NET: Unicode (little endian)\n\nJSP implementations, such as Tomcat: UTF8 - see “javaEncoding” in web.xml by many servlet containers\n\nJava: Unicode (UTF-16, big endian, or depends on the OS during JVM startup)\n\nPHP: Set in php.ini, ISO 8859-1”\n\nIf the results are not provided or the application representative cannot demonstrate that the application does not use Unicode encoding, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A suitable canonical form should be chosen and all user input canonicalized into that form before any authorization decisions are performed.\n\nSecurity checks should be carried out after decoding is completed. Moreover, it is recommended to check that the encoding method chosen is a valid canonical encoding for the symbol it represents.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001310</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>SonarCloud scans, OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222606</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000251</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222606r961158_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002530</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must validate all input.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Checking the valid syntax and semantics of information system inputs (e.g., character set, length, numerical range, and acceptable values) verifies that inputs match specified definitions for format and content. Software applications typically follow well-defined protocols that use structured messages (i.e., commands or queries) to communicate between software modules or system components. \n\nStructured messages can contain raw or unstructured data interspersed with metadata or control information. If software applications use attacker-supplied inputs to construct structured messages without properly encoding such messages, then the attacker could insert malicious commands or special characters that can cause the data to be interpreted as control information or metadata. \n\nConsequently, the module or component that receives the tainted output will perform the wrong operations or otherwise interpret the data incorrectly. Prescreening inputs prior to passing to interpreters prevents the content from being unintentionally interpreted as commands. Input validation helps to ensure accurate and correct inputs and prevent attacks such as cross-site scripting and a variety of injection attacks.\n\nAbsence of input validation opens an application to improper manipulation of data. The lack of input validation can lead immediate access of application, denial of service, and corruption of data.\n\nInvalid input includes presence of scripting tags within text fields, query string manipulation, and invalid data types and sizes.\n\nWhen an application validates input, it will only execute provided input after it has evaluated the input, validated the input and determined the data is in an expected format, and content is not extraneous or malformed.\n\nComprehensive application security testing and code reviews are required to ensure the application is not vulnerable to input validation vulnerabilities.\n\nApplication security code reviews should be conducted during the development phase to find and address input validation errors. When code reviews are not possible, fuzz testing can be performed on the application to attempt and identify vulnerable data input fields.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation, the code review reports and the vulnerability assessment scan results from automated vulnerability assessment tools.\n\nVerify scan configuration settings include input validation and fuzzing tests.\n\nTest data entry fields on all pages/screens of the application.\n\nProcedures on testing input are relevant to the architecture of the application.\n\nA reference on input validation testing is included at the OWASP website. The site includes testing procedures for input validation that affect many different technologies.\n\nIdentify the relevant testing procedures based upon the application architecture and components being tested.\n\nhttps://www.owasp.org/index.php/Testing_for_Input_Validation\n\nIf test results include input validation errors, or if no test results exist, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design and configure the application to validate input prior to executing commands.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001310</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>API input is validated against the OAS definition. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222607</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000251</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222607r961158_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002540</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must not be vulnerable to SQL Injection.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SQL Injection is a code injection attack against database applications. Malicious SQL statements are inserted into an application data entry field where they are submitted to the database and executed. This is a direct result of not validating input that is used by the application to perform a command or execute an action.\n\nSuccessful attacks can read data, write data, execute administrative functions within the database, shutdown the DBMS, and in some cases execute OS commands.\n\nBest practices to reduce the potential for SQL Injection vulnerabilities include:\n\nNot using concatenation or replacement to build SQL queries.\n\nUsing prepared statements with parameterized queries that have been tested and validated not to be vulnerable to SQL Injection.\n\nUsing stored procedures that have been tested and validated not to be vulnerable to SQL Injection.\n\nEscaping all user supplied input.\n\nAdditional steps to prevent SQL Injection can be found at the OWASP website:\n\nhttps://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nRequest the latest vulnerability scan test results.\n\nVerify the scan configuration is configured to test for SQL injection flaws.\n\nReview the scan results to determine if any SQL injection flaws were detected during application testing.\n\nIf SQL injection flaws were discovered, request a subsequent scan that will show that the issues have been remediated.\n\nIf the scan results are not available, identify the database product in use and refer to the OWASP web application testing guide for detailed instructions on performing a manual SQL injection test. The instructions are located here and many tests are organized by database product:\n\nhttps://www.owasp.org/index.php/Testing_for_SQL_Injection_%28OTG-INPVAL-005%29\n\nIf the application is vulnerable to SQL injection attack, contains SQL injection flaws, or if scan results do not exist, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Modify the application and remove SQL injection vulnerabilities.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001310</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>All SQL queries that process user input are parameterized. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222608</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000251</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222608r961158_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002550</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must not be vulnerable to XML-oriented attacks.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Extensible Markup Language (XML) is widely employed in web technology and applications like web services (SOAP, REST, and WSDL) and is also used for configuration files. XML vulnerability examples include XML injection, XML Spoofing, XML-based Denial of Service attacks and information disclosure attacks.\n\nWhen utilizing XML, web applications must take steps to ensure they are addressing XML-related security issues. This is accomplished by choosing well-designed application components, building application code that follows security best practices and by patching application components when vulnerabilities are identified.\n\nXML firewalls or gateways may be employed to assist in protecting applications by controlling access to XML-based applications, filtering XML content, rate-limiting requests, and validating XML traffic.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation, the application architecture and interview the application administrator.\n\nIdentify any XML-based web services or XML functionality performed by the application.\n\nDetermine if an XML firewall is deployed to protect application from XML-related attacks.\n\nIf the application does not process XML, the requirement is not applicable.\n\nReview the latest application vulnerability assessment and verify the scan was configured to test for XML-related vulnerabilities and security issues.\n\nExamples include but are not limited to:\n\nXML Injection\nXML related Denial of Service\nXPATH injection\nXML Signature attacks\nXML Spoofing\n\nIf an XML firewall is deployed, request configuration information regarding the application and validate the firewall is configured to protect the application.\n\nIf the vulnerability scan is not configured to scan for XML-oriented vulnerabilities, if no scan results exist, or if the XML firewall is not configured to protect the application, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design the application to utilize components that are not vulnerable to XML attacks.\n\nPatch the application components when vulnerabilities are discovered.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001310</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>SonarCloud scans are run regularly to identify XML vulnerabilities. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222609</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000447</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222609r961656_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002560</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must not be subject to input handling vulnerabilities.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A common application vulnerability is unpredictable behavior due to improper input validation. This requirement guards against adverse or unintended system behavior caused by invalid inputs, where information system responses to the invalid input may be disruptive or cause the system to fail into an unsafe state.\n\nData received from the user should always be suspected as being malicious and always validated prior to using it as input to the application.\n\nSome examples of input methods:\n\n- Forms Data\n- URL parameters\n- Hidden Fields\n- Cookies\n- HTTP Headers or anything in the HTTP request\n- Client data entry fields\n\nItems to validate:\n\n- Out of range values/Boundary \n- Data length \n- Validate types of characters allowed\n- Whitelist validation for known good data input while denying all other input.\n\nOther recommendations include: \n\n- Using drop down menus for lists\n- Validating input on the server, not on the client.\n\nIf validating on the client, also validate on the server:\n\n- Using regular expressions to validate input\n- Using HTML filter libraries that implement input validation tasks.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIf working with the developer, request documentation on their development processes and what their standard operating procedure is for sanitizing all application input.\n\nIdentify the latest vulnerability scan results.\n\nReview the scan results and scan configuration settings.\n\nVerify the scan was configured to identify input validation vulnerabilities.\n\nIf the scan results detected high risk vulnerabilities, verify a more recent scan shows remediation of the vulnerabilities is available for examination.\n\nReview any risk acceptance documentation that indicates the ISSO has reviewed and accepted the risk.\n\nIf the vulnerability scan is not configured to test for input validation vulnerabilities if the most recent scan results show that high risk input validation vulnerabilities exist and a documented risk acceptance from the ISSO is not available, or if the scan results do not exist, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Follow best practice when accepting user input and verify that all input is validated before the application processes the input.\n\nRemediate identified vulnerabilities and obtain documented risk acceptance for those issues that cannot be remediated immediately.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002754</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>All user input is validated on both the client and the server. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222610</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000266</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222610r961167_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002570</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization&apos;s operational state or can identify application components. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives.\n\nThe structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.\n\nError messages should not include variable names, variable types, SQL strings, or source code. Errors that contain field names from the screen and a description of what should be in the field should not be considered a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator for details regarding how the application displays error messages.\n\nUtilize the application as a non-privileged user and attempt to execute functionality that will generate error messages.\n\nReview the error messages displayed to ensure no sensitive information is provided to end users.\n\nIf error messages are designed to provide users with just enough detail to pass along to support staff in order to aid in troubleshooting such as date, time, or other generic information, this is not a finding.\n\nIf variable names, SQL strings, system path information, or source or program code are displayed in error messages sent to non-privileged users, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the server to not send error messages containing system information or sensitive data to users.\n\nUse generic error messages.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001312</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Error messages do not include sensitive or privileged information.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222611</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000267</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222611r961170_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002580</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must reveal error messages only to the ISSO, ISSM, or SA.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization&apos;s operational state or can identify application components. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives.\n\nThe structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.\n\nError messages should not include variable names, variable types, SQL strings, or source code. Errors that contain field names from the screen and a description of what should be in the field should not be considered a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator for details regarding how the application displays error messages.\n\nAuthenticate to the application as a non-privileged user and attempt to execute functionality that will generate error messages.\n\nReview the error messages displayed to ensure no sensitive information is provided to end users.\n\nAuthenticate as a privileged user and repeat tests.\n\nIf error messages are designed to provide users with just enough detail to pass along to support staff in order to aid in troubleshooting such as date, time or other generic information, this is not a finding.\n\nIf detailed error messages are provided to privileged users, this is not a finding.\n\nIf variable names, SQL strings, system path information, or source or program code are displayed in error messages sent to non-privileged users, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the server to only send error messages containing system information or sensitive data to privileged users.\n\nUse generic error messages for non-privileged users.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001314</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Error messages do not include sensitive or privileged information.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222612</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000450</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222612r961665_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002590</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must not be vulnerable to overflow attacks.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A buffer overflow occurs when a program exceeds the amount of data allocated to a buffer. The buffer is a sequential section of memory and when the data is written outside the memory bounds, the program can crash or malicious code can be executed.\n\nSecurity safeguards employed to protect memory include, for example, data execution prevention and address space layout randomization. Data execution prevention safeguards can either be hardware-enforced or software-enforced with hardware providing the greater strength of mechanism.\n\nBuffer overflows can manifest as stack overflows, heap overflows integer overflows and format string overflows. Each type of overflow is dependent upon the underlying application language and the context in which the overflow is executed.\n\nInteger overflows can lead to infinite looping when loop index variables are compromised and cause a denial of service.  If the integer is used in data references, the data can become corrupt. Also, using the integer in memory allocation can cause buffer overflows, and a denial of service.  Integers used in access control mechanisms can potentially trigger buffer overflows, which can be used to execute arbitrary code. \n\nAlmost all known web servers, application servers, and web application environments are susceptible to buffer overflows. Proper validation of user input is required to mitigate the risk. Notably, limiting the size of the strings a user is allowed to input to a program to a predetermined, acceptable length.\n\nA code review, static code analysis or active vulnerability or fuzz testing are methods used to identify overflows within application code.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and architecture.\n\nInterview the application admin and identify the most recent code testing and analysis that has been conducted.\n\nReview the test results; verify configuration of analysis tools are set to check for the existence of overflows. This includes but is not limited to buffer overflows, stack overflows, heap overflows, integer overflows and format string overflows.\n\nIf overflows are identified in the test results, verify the latest test results are being used, if not, ensure remediation has been completed.\n\nIf the test results show overflows exist and no remediation evidence is presented, or if test results are not available, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design the application to use a language or compiler that performs automatic bounds checking.\n\nUse an abstraction library to abstract away risky APIs.\n\nUse compiler-based canary mechanisms such as StackGuard, ProPolice, and the Microsoft Visual Studio/GS flag.\n\nUse OS-level preventative functionality and control user input validation.\n\nPatch applications when overflows are identified in vendor products.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002824</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>SonarCloud scans, OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222613</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000454</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222613r961677_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002610</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must remove organization-defined software components after updated versions have been installed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products may remove older versions of software automatically from the information system.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application admin to identify application locations on system.\n\nIdentify application versions that are installed on the system.\n\nReview the file system structure to see if older versions of the application are still installed.\n\nIf old versions of the application or components are still installed on the system, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure or design the application to remove old components when updating.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002617</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Dependabot services provided by GitHub to identify vulnerable software components. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222614</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000456</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222614r961683_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002630</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Security-relevant software updates and patches must be kept up to date.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously.\n\nOrganization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw).\n\nThis requirement will apply to software patch management solutions that are used to install patches across the enclave and also to applications themselves that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means that the time period utilized must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process.\n\nThe application, or the patch management solution that is configured to patch the application, must be configured to check for and install security-relevant software updates and patches at least weekly. Patches must be applied immediately or in accordance with POA&amp;Ms, IAVMs, CTOs, DTMs or other authoritative patching guidelines or sources.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation to identify application versions and patching.\n\nInterview the application administrator and inquire about patching process.\n\nReview IAVMs and CTOs to determine if the application is being updated in accordance with authoritative sources.\n\nIf application updates are not checked on at least on a weekly basis and applied immediately or in accordance with POA&amp;Ms, IAVMs, CTOs, DTMs or other authoritative patching guidelines or sources, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Check for application updates at least weekly and apply patches immediately or in accordance with POA&amp;Ms, IAVMs, CTOs, DTMs or other authoritative patching guidelines or sources.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002605</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Dependabot services provided by GitHub to identify vulnerable software components. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222615</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000472</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222615r961731_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002760</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application performing organization-defined security functions must verify correct operation of security functions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without verification, security functions may not operate correctly and this failure may go unnoticed.\n\nSecurity function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\n\nThis requirement applies to applications performing security functions and security function verification/testing.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the system administrator to determine if the application performs security function testing.\n\nIf the application is not designed or intended to perform security function testing, the requirement is not applicable.\n\nAccess the application design documents and determine if the application is designed to verify the correct operation of security functions.\n\nReview application logs and take note of log entries that indicate security function testing is being performed and verified.\n\nIf the application is designed to perform security function testing and does not verify the correct operation of security functions, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design the application to verify the correct operation of security functions.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002696</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The application is not designed or intended to perform security function testing.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222616</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000473</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222616r961734_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002770</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must perform verification of the correct operation of security functions: upon system startup and/or restart; upon command by a user with privileged access; and/or every 30 days.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without verification, security functions may not operate correctly and this failure may go unnoticed.\n\nSecurity function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\n\nNotifications provided by information systems include, for example, electronic alerts to system administrators, messages to local computer consoles, and/or hardware indications, such as lights.\n\nThis requirement applies to applications performing security functions and the applications performing security function verification/testing.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the system administrator to determine if the application performs security function testing.\n\nIf the application is not designed or intended to perform security function testing, the requirement is not applicable.\n\nAccess the application design documents or have the system administrator provide proof if the application is designed to verify the correct operation of security functions.\n\nReview application logs and take note of log entries that indicate security function testing is being performed and verified on startup, restart, or on command by an authorized user.\n\nIf the application is designed to perform security function testing and does not verify the correct operation of security functions on startup, restart, or upon command by a privileged user, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design the application to verify the correct operation of security functions on command and on application startup and restart.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002699</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The application is not designed or intended to perform security function testing.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222617</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000275</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222617r961185_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002780</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must notify the ISSO and ISSM of failed security verification tests.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If personnel are not notified of failed security verification tests, they will not be able to take corrective action and the unsecure condition(s) will remain.\n\nSecurity function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\n\nNotifications provided by information systems include messages to local computer consoles, and/or hardware indications, such as lights.\n\nThis requirement applies to applications performing security functions and the applications performing security function verification/testing.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the system administrator to determine if the application performs security function testing.\n\nIf the application is not designed or intended to perform security function testing, the requirement is not applicable.\n\nAccess the application design documents or have the system administrator provide proof the application is designed to verify the correct operation of security functions.\n\nReview application logs and take note of log entries that indicate security function testing is being performed and verified on startup, restart, or on command by an authorized user.\n\nReview logs to identify if the application has sent notifications to ISSO and ISSM when security verification tests fail.\n\nReview application features and function to identify areas of the management interfaces that specify where failed security verifications tests are to be sent and validate the ISSO and ISSM are configured as recipients.\n \nIf the application is designed to perform security function testing and does not notify the ISSO and ISSM of failed verification tests, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to send notices to the ISSO and ISSM indicating the application failed a verification test.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001294</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>The application is not designed or intended to perform security function testing.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222618</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000206</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222618r961083_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002870</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Unsigned Category 1A mobile code must not be used in the application in accordance with DoD policy.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of un-trusted Level 1A mobile code technologies can introduce security vulnerabilities and malicious code into the client system.\n\n1A code is defined as:\n\n- ActiveX controls\n- Mobile code script (JavaScript, VBScript)\n- Windows Scripting Host (WSH) (downloaded via URL or email)\n\nWhen JavaScript and VBScript execute within the browser they are Category 3, however, when they execute in WSH, they are 1A.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify any mobile code that is provided by the application for client consumption.\n\nIf the application does not contain mobile code, or if the mobile code executes within the client browser, this is not applicable.\n\nThe URL of the application must be added to the Trusted Sites zone. This is accomplished via the Tools, Internet Options, and “Security” Tab.\n\nSelect the “Trusted Sites” zone.\nClick the “sites” button.\nEnter the URL into the text box below the “Add this site to this zone” message.\nClick &quot;Add”.\nClick “OK”.\n\nNote: This requires administrator privileges to add URL to sites on a STIG compliant workstation.\n\nNext, test the application. This testing should include functional testing from all major components of the application.\n\nIf mobile code is in use, the browser will prompt to download the control. At the download prompt, the browser will indicate that code has been digitally signed.\n\nIf the code has not been signed or the application warns that a control cannot be invoked due to security settings, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application so Category 1A mobile code is signed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001166</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Applicable</STATUS>\n        <FINDING_DETAILS>No Category 1A present in the application. The SPA mobile code executes within the client browser.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222619</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222619r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002880</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The ISSO must ensure an account management process is implemented, verifying only authorized users can gain access to the application, and individual accounts designated as inactive, suspended, or terminated are promptly removed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A comprehensive account management process will ensure that only authorized users can gain access to applications and that individual accounts designated as inactive, suspended, or terminated are promptly deactivated. Such a process greatly reduces the risk that accounts will be misused, hijacked, or data compromised.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the application representative to verify that a documented process exists for user and system account creation, termination, and expiration.\n\nObtain a list of recently departed personnel and verify that their accounts were removed or deactivated on all systems in a timely manner (e.g., less than two days).\n \nIf a documented account management process does not exist or unauthorized users have active accounts, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Establish an account management process.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002121</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Account management services are provided by the external OpenID Connect (OIDC) Provider.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222620</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222620r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002890</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application web servers must be on a separate network segment from the application and database servers if it is a tiered application operating in the DoD DMZ.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A tiered application usually consists of 3 tiers, the web layer (presentation tier), the application layer (application logic tier), and the database layer (data storage tier).\n\nUsing one system for hosting all 3 tiers introduces risk that if one tier is compromised, there are no additional protection layers available to defend the other tiers.\nSecurity controls must be in place in order to provide different levels and types of defenses for each type of server based upon data protection requirements identified by policy or data owner.\n\nDoD DMZ policy specifies that logical separation is allowed but when hosting different data types on the same server, physical separation is required.\n\n1) Unrestricted web servers and Restricted web servers must be on separate virtual or physical servers from Private web servers, application servers, or database servers.\n2) Unrestricted web servers and Restricted web servers can either be on separate physical servers from each other, or they can be on separate virtual servers.\n3) If application and database servers have been separated by service type into Unrestricted, Restricted, and Private servers (permitted but not required in Increment 1 Phase 1), they must be on separate virtual or physical servers from each other by server type (Application or Database) and by service type (Unrestricted, Restricted, or Private).\n\nReference the DoD DMZ STIG for details on data types and separation requirements.\n\nSecurity controls include firewalls or other forms of access controls that restrict the ability to traverse the network from one system to the other.\n\nSeparation can be performed either physically or logically based upon data protection and application protection design requirements.\n\nPhysically separate networks require distinct physical network devices for connections (e.g., two separate switches or two separate routers).\n\nPhysically separate machines utilize a non-virtual OS.\n\nLogically separate networks are usually implemented via a VLAN.\n\nLogically separate systems are implemented with virtual machines or other system emulation.\n\nSecurity controls are firewall rules or ACLs that provide access restrictions on network traffic and limit communications between systems to only application and application/system support traffic.\n\nFor complete explanation of DoD DMZ requirements, reference DoD DMZ requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation.\n\nReview the application data protection requirements and identify if all data types hosted on server are identical.\n\nReview the network diagram and identify web servers/web services, web application servers, and database servers.\n\nIf the application is not hosted in the DoD DMZ, this requirement is not applicable.\n\nVerify the application web servers are separated from the application and database servers if the application is a tiered design as per DoD DMZ STIG requirements.\n\nIf the application is tiered and the network infrastructure hosting the application is not configured to provide separation and security access controls between the tiered layers in accordance with DoD DMZ requirements, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Separate web server from other application tiers and place it on a separate network segment apart from the application and database servers in accordance with DoD DMZ data access controls requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002225</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Determined by deployment configuration.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222621</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222621r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002900</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The ISSO must ensure application audit trails are retained for at least 1 year for applications without SAMI data, and 5 years for applications including SAMI data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Log files are a requirement to trace intruder activity or to audit user activity.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Verify a process is in place to retain application audit log files for one year and five years for SAMI data.\n\nIf audit logs have not been retained for one year or five years for SAMI data, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Retain application audit log files for one year and five years for SAMI data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000167</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222622</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222622r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002910</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The ISSO must review audit trails periodically based on system documentation recommendations or immediately upon system security events.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without access control the data is not secure. It can be compromised, misused, or changed by unauthorized access at any time.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the application representative and ask for the system documentation that states how often audit logs are reviewed. Also, determine when the audit logs were last reviewed.\n\nIf the application representative cannot provide system documentation identifying how often the auditing logs are reviewed, or has not audited within the last time period stated in the system documentation, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Establish a scheduled process for reviewing logs.\n\nMaintain a log or records of dates and times audit logs are reviewed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001872</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.  Application log entries are written to the container&apos;s STDOUT, to be captured by the deployment&apos;s preferred and compliant logging solution.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222623</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222623r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002920</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The ISSO must report all suspected violations of IA policies in accordance with DoD information system IA procedures.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Violations of IA policies must be reviewed and reported. If there are no policies regarding the reporting of IA violations, IA violations may not be tracked or addressed in a proper manner.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the application representative and review the SOPs to ensure that violations of IA policies are analyzed and reported.\n \nIf there is no policy for reporting IA violations, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Create and maintain a policy to report IA violations.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000149</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222624</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222624r1051272_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002930</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The ISSO must ensure active vulnerability testing is performed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of automated scanning tools accompanied with manual testing/validation which confirms or expands on the automated test results is an accepted best practice when performing application security testing. Automated scanning tools expedite and help to standardize security testing, they can incorporate known attack methods and procedures, test for libraries and other software modules known to be vulnerable to attack and utilize a test method known as &quot;fuzz testing&quot;. Fuzz testing is a testing process where the application is provided invalid, unexpected, or random data. Poorly designed and coded applications will become unstable or crash. Properly designed and coded applications will reject improper and unexpected data input from application clients and remain stable.\n\nMany vulnerability scanning tools provide automated fuzz testing capabilities for the testing of web applications. All of these tools help to identify a wide range of application vulnerabilities including, but not limited to; buffer overflows, cross-site scripting flaws, denial of service format bugs and SQL injection, all of which can lead to a successful compromise of the system or result in a denial of service.\n\nDue to changes in the production environment, it is a good practice to schedule periodic active testing of production web applications. Ideally, this will occur prior to deployment and after updates or changes to the application production environment.\n\nIt is imperative that automated scanning tools are configured properly to ensure that all of the application components that can be tested are tested. In the case of web applications, some of the application code base may be accessible on the website and could potentially be corrected by a knowledgeable system administrator. Active testing is different from code review testing in that active testing does not require access to the application source code base. A code review requires complete code base access and is normally performed by the development team.\n\nIf vulnerability testing is not conducted, there is the distinct potential that security vulnerabilities could be unknowingly introduced into the application environment.\n\nThe following website provides an overview of fuzz testing and examples:\n\nhttp://www.owasp.org/index.php/Fuzzing</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative to provide vulnerability test procedures and vulnerability test results.\n\nAsk the application representative to provide the settings that were used to conduct the vulnerability testing.\n\nVerify the automated vulnerability scanning tool was appropriately configured to ensure as complete a test as possible of the application architecture components (e.g., if the application includes a web server, web server tests must be included).\n\nIf the vulnerability scan report includes informational and/or noncritical results, this is not a finding.\n\nIf previously identified vulnerabilities have subsequently been resolved, this is not a finding.\n\nIf the application test procedures and test results do not include active vulnerability and fuzz testing, this is a finding.\n\nIf the vulnerability scan results include critical vulnerabilities 21 business days or older, this is a finding.\n\nIf the vulnerability scanning tests are not relevant to the architecture of the application, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Perform active vulnerability and fuzz testing of the application.\n\nVerify the vulnerability scanning tool is configured to test all application components and functionality.\n\nAddress discovered vulnerabilities.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000256</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.\nProject test procedures are available in the documentation.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222625</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222625r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002950</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Execution flow diagrams and design documents must be created to show how deadlock and recursion issues in web services are being mitigated.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>In order to understand data flows within web services, the process flow of data must be developed and documented.\n\nThere are several different ways that web service deadlock occurs, many times it is due to when a client invokes a synchronous method on a web service, the client will block waiting for the method to complete. If attempts to call the client (invoke a callback) while the client is waiting for the original method to complete, then each party will deadlock waiting for the other.\n\nThis is referred to as deadlock. The same situation could occur if a callback handler attempted to call a synchronous method on its caller.\n\nApplications that utilize web services must account for and document how they deal with a deadlock issue. This can be accomplished by documenting data flow and specifically accounting for the risk in the design of the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and the system diagrams detailing application system to system and service to service communication methods.\n\nInterview the application admin to identify any application web services that are deployed by the application.\n\nIf the application does not deploy web services, the requirement is not applicable.\n\nIf the application consumes web services but is not responsible for development of the services, the requirement is not applicable.\n\nReview the data flow diagrams and the system documentation to determine if the issue of web service deadlock is addressed.\n\nIf the issue is not addressed in the documentation or configuration settings, ask the application admin to demonstrate how deadlock issues are addressed.\n\nIf deadlock issues are not being addressed via documented web service configuration or design, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Develop web services to account for deadlock issues.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000336</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000366</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>By design, the application web service is not subject to deadlocking as it does not call the client.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222626</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222626r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002960</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The designer must ensure the application does not store configuration and control files in the same directory as user data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application configuration settings and user data are required to be stored in separate locations in order to prevent application users from possibly being able to access application configuration settings or application data files. Without proper access controls and separation of application configuration settings from user data, there is the potential that existing code or configuration settings could be changed by users. These changes in code can lead to a Denial of Service (DoS) attack or allow malicious code to be placed within the application. In addition, collocating application data and code complicates many issues such as backup, recovery, directory access privilege, and upgrades.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nAsk the application administrator or examine the application documentation to determine the file location of the application configuration settings and user data.\n\nIdentify the directory where the application code, configuration settings and other application control data are located.\n\nIdentify where user data is stored.\n\nExamine file permissions to application folder.\n\nIf the application user data is located in the same directory as the application configuration settings or control files, or if the file permissions allow application users write access to application configuration settings, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Separate the application user data into a different directory than the application code and user file permissions to restrict user access to application configuration settings.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000345</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Application is provided as a stateless container.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222627</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222627r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002970</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The ISSO must ensure if a DoD STIG or NSA guide is not available, a third-party product will be configured by following available guidance.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Not all COTS products are covered by a STIG. Those products not covered by a STIG, should follow commercially accepted best practices, independent testing results and vendors lock down guides and recommendations if they are available.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation to identify application name, features and version.\n\nIdentify if a DoD STIG or NSA guide is available.\n\nIf no STIG is available for the product, the application and application components must be configured by the following as available: \n\n- commercially accepted practices, \n- independent testing results, or \n- vendor literature and lock down guides.\n\nIf the application and application components do not have DoD STIG or NSA guidance available and are not configured according to: \ncommercially accepted practices, \nindependent testing results,\nor vendor literature and lock down guides, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application according to the product STIG or when a STIG is not available, utilize:\n\n- commercially accepted practices,\n- independent testing results, or\n- vendor literature and lock down guides.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000363</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.  Deployment and security guidance available in project documentation.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222628</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222628r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002980</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>New IP addresses, data services, and associated ports used by the application must be submitted to the appropriate approving authority for the organization, which in turn will be submitted through the DoD Ports, Protocols, and Services Management (DoD PPSM)</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Failure to comply with DoD Ports, Protocols, and Services (PPS) Vulnerability Analysis and associated PPS mitigations may result in compromise of enclave boundary protections and/or functionality of the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>All application ports, protocols, and services needed for application operation need to be in compliance with the DoD Ports and Protocols guidance.\n\nCheck:\n\nhttp://iase.disa.mil/ppsm/Pages/index.aspx\n\nto verify the ports, protocols, and services are in compliance with the PPS CAL.\n\nCheck all necessary ports and protocols needed for application operation (only those accessed from outside the local enclave) are checked against the DoD Ports and Protocols guidance to ensure compliance.\n\nIdentify the ports needed for the application:\n\n- Look at System Security Plan/Accreditation documentation\n- Ask System Administrator\n- Go to Network Administrator\n- Go to Network Reviewer\n- If a network scan is available, use it\n- Use netstat/task manager\n- Check /etc./services\n\nIf the application is not in compliance with DoD Ports and Protocols guidance, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Verify the accreditation documentation lists all interfaces and the ports, protocols, and services used.\n\nVerify that all ports, protocols, and services are used in accordance with the DoD PPSM.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000388</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222629</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222629r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002990</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must be registered with the DoD Ports and Protocols Database.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Failure to register the applications usage of ports, protocols, and services with the DoD PPS Database may result in a Denial of Service (DoS) because of enclave boundary protections at other end points within the network.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Verify registration of the application and ports in the Ports and Protocols Database for a production site.\n\nIf the application requires registration, and is not registered or all ports used have not been identified in the database, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Register the application and ports in the Ports and Protocols Database.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000388</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222630</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222630r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002995</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The Configuration Management (CM) repository must be properly patched and STIG compliant.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A Configuration Management (CM) repository is used to manage application code versions and to securely store application code.\n\nFailure to properly apply security patches and secure the software Configuration Management system could affect the confidentiality and integrity of the application source-code.  \n\nCompromise of the Configuration Management system could lead to unauthorized changes to applications including the addition of malware, root kits, back doors, logic bombs or other malicious functions into valid application code.   \n\nThis requirement is intended to be applied to application developers or organizations responsible for code management or who have and operate an application CM repository.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application system documentation and interview the application administrator.\n\nIdentify if the STIG is being applied to application developers or organizations responsible for code management or who have and operate an application CM repository. If this is not the case, the requirement is not applicable.\n\nReview CM patch management processes and procedures.  Have the system and CM admins demonstrate their patch management processes and verify the system has the latest security patches applied.  \n\nReview the ATO documentation and verify the system that operates the CM repository software has had all relevant STIGs applied.\n\nIf CM repository is not at the latest security patch level and is not operating on a STIG compliant system, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Patch the CM system when new security patches are made available and apply the relevant STIGs.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001795</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Configuration management dependent on organizational compliance and processes.  Application code hosted on GitHub according to Code.mil guidance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222631</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222631r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003000</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Access privileges to the Configuration Management (CM) repository must be reviewed every three months.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A Configuration Management (CM) repository is used to manage application code versions and to securely store application code.\n\nIncorrect access privileges to the CM repository can lead to malicious code or unintentional code being introduced into the application.\n\nThis requirement is intended to be applied to application developers or organizations responsible for code management or who have and operate an application CM repository.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application system documentation.\n\nInterview the application administrator.\n\nIdentify if development of the application is done in house and if application configuration management repository exists.\n\nIf application development is not done in house and if a code configuration management repository does not exist, the requirement is not applicable.\n\nReview CM management processes and procedures.\n\nVerify the CM repository access permissions are reviewed at least every three months.\n\nAsk the application administrator or the CM administrator when the last time the CM access privileges were reviewed.\n\nIf CM access privileges have not been reviewed within the last three months, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review access privileges to the CM repository at least every three months.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001795</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Configuration management dependent on organizational compliance and processes.  Application code hosted on GitHub according to Code.mil guidance. Codebase access restricted to repository administrators, which are publicly listed on the project&apos;s GitHub site.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222632</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222632r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003010</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A Software Configuration Management (SCM) plan describing the configuration control and change management process of application objects developed by the organization and the roles and responsibilities of the organization must be created and maintained.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Software Configuration Management (SCM) is very important in tracking code releases, baselines, and managing access to the configuration management repository. The SCM plan identifies what should be under configuration management control.\n\nWithout an SCM plan that addresses code security issues, code releases can be tracked and vulnerabilities can be inserted intentionally or unintentionally into the code base of the application.\n\nThis requirement is intended to be applied to application developers or organizations responsible for code management or who have and operate an application configuration management repository (CMR).\n\nThe SCM plan identifies all objects created during the development process subject to configuration control.\n\nThe SCM plan maintains procedures for identifying individual application components, as well as, entire application releases during all phases of the software development lifecycle.\n\nThe SCM plan identifies and tracks all actions and changes resulting from a change request from initiation to release.\n\nThe SCM plan contains procedures to identify, document, review, and authorize any change requests to the application.\n\nThe SCM plan defines the responsibilities, the actions to be performed, the tools, techniques and methodologies, and defines an initial set of baselined software components.\n\nThe SCM plan objects have security classifications labels.\n\nThe SCM plan identifies tools and version numbers used in the software development lifecycle.\n\nThe SCM plan identifies mechanisms for controlled access of simultaneous individuals updating the same application component.\n\nThe SCM plan assures only authorized changes by authorized persons are possible.\n\nThe SCM plan identifies mechanisms to control access and audit changes between different versions of objects subject to configuration control.\n\nThe SCM plan identifies mechanisms to track and audit all modifications of objects under configuration control.  Audits include the originator and date and time of the modification.\n\nThe SCM plan should contain the following:\n\n- Description of the configuration control and change management process\n- Types of objects developed\n- Roles and responsibilities of the organization\n\nThe SCM plan should also contain the following:\n\n- Defined responsibilities\n- Actions to be performed\n- Tools used in the process\n- Techniques and methodologies\n- Initial set of baselined software components\n\nThe SCM plan should identify all objects that are under configuration management control.\n\nThe SCM plan should identify third-party tools and respective version numbers.\n\nThe SCM plan should identify mechanisms for controlled access of individuals simultaneously updating the same application component.\n\nThe SCM plan assures only authorized changes by authorized persons are allowed.\n\nThe SCM plan should identify mechanisms to control access and audit changes between different versions of objects subject to configuration control.\n\nThe SCM plan should have procedures for label versions of application components and application builds under configuration management control.\n\nThe configuration management repository (CMR) should track change requests from beginning to end.\n\nThe configuration management repository (CMR) should authorize change requests to the application.\n \nThe configuration management repository (CMR) should contain security classification labels for code and documentation in the repository. Classification labels are not applicable to unclassified systems.\n\nThe configuration management repository (CMR) should monitor all objects under CMR control for auditing.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview ISSM or application administrator.\n\nIdentify if development of the application is done in house and if application configuration management repository exists.\n\nIf application development is not done in house and if a code configuration management repository does not exist, the requirement is not applicable.\n\nVerify the SCM plan identifies all objects created during the development process subject to configuration control.\n\nVerify the SCM plan maintains procedures for identifying individual application components, as well as, entire application releases during all phases of the software development lifecycle.\n\nVerify the SCM plan identifies and tracks all actions and changes resulting from a change request from initiation to release.\n\nVerify the SCM plan contains procedures to identify, document, review, and authorize any change requests to the application.\n\nVerify the SCM plan defines the responsibilities, the actions to be performed, the tools, techniques and methodologies, and defines an initial set of base-lined software components.\n\nVerify the SCM plan objects have security classifications labels if processing classified data.\n\nVerify the SCM plan identifies tools and version numbers used in the software development lifecycle.\n\nVerify the SCM plan identifies mechanisms for controlled access of simultaneous individuals updating the same application component.\n\nVerify the SCM plan assures only authorized changes by authorized persons are possible.\n\nVerify the SCM plan identifies mechanisms to control access and audit changes between different versions of objects subject to configuration control.\n\nVerify the SCM plan identifies mechanisms to track and audit all modifications of objects under configuration control. Audits will include the originator and date and time of the modification.\n\nAsk the application representative to review the applications SCM plan.\n\nThe SCM plan should contain the following:\n\n- Description of the configuration control and change management process\n- Types of objects developed\n- Roles and responsibilities of the organization\n- Defined responsibilities\n- Actions to be performed\n- Tools used in the process\n- Techniques and methodologies\n- Initial set of baselined software components\n\nIf the SCM plan does not include the above, this is a finding.\n\nThe SCM plan should identify all objects that are under configuration management control. Ask the application representative to provide access to the CMR and to identify the objects shown in the SCM plan.\n\nIf the application representative cannot display all types of objects under CMR control, this is a finding.\n\nThe SCM plan should identify third-party tools and respective version numbers.\n\nIf the SCM plan does not identify third-party tools, this is a finding.\n\nThe SCM plan should identify mechanisms for controlled access of individuals simultaneously updating the same application component.\n\nIf the SCM plan does not identify mechanisms for controlled access, this is a finding.\n\nThe SCM plan assures only authorized changes by authorized persons are allowed.\n\nIf the SCM plan does not assure only authorized changes are made, this is a finding.\n\nThe SCM plan should identify the mechanisms used to control access and audit changes between different versions of objects subject to CMR control.\n\nIf the SCM plan does not identify mechanisms used to control access and to audit changes between different versions of objects subject to CMR control, this is a finding.\n\nThe SCM plan should have procedures for label versions of application components and application builds under configuration management control. Ask the application representative to demonstrate the CMR and ensure it contains versions and releases of the application. Ask the application representative to create a build or demonstrate a current release of the application that can be recreated.\n\nIf the application representative cannot display releases and application component versions, this is a finding.\n\nThe CMR should track change requests from beginning to end. Ask the application representative to display a completed or in-process change request.\n\nIf the CMR cannot track change requests, this is a finding.\n\nIf the application has just completed its first release, there may not be any change requests logged in the CMR.  In this case, this finding is not applicable.\n\nThe CMR should authorize change requests to the application. Ask the application representative to display an authorized change request and identify who is responsible for authorizing change requests.\n\nIf the CMR does not track authorized change requests, this is a finding.\n\nIf the application has just completed its first release, there may not be any change requests logged in the CMR. In this case, this finding is not applicable.\n\nThe CMR should contain security classification labels for code and documentation in the repository. \n\nClassification labels are not applicable to unclassified systems.  If the applications managed by the CMR are not classified, this requirement is not applicable.\n\nIf the CMR manages classified applications and there are no classification labels of code and documentation in the CMR, this is a finding.\n\nThe CMR should audit all objects under CM control for modification.\n\nIf the CMR does not audit for modifications, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Create and update a SCM plan describing the configuration control and change management process of application objects developed by the organization and the roles and responsibilities of the organization.  Configure CMR to comply.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001795</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Configuration management dependent on organizational compliance and processes.  All project artifacts are publicly available on the GitHub site, in accordance with Code.mil guidance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222633</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222633r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003020</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A Configuration Control Board (CCB) that meets at least every release cycle, for managing the Configuration Management (CM) process must be established.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Software Configuration Management (SCM) is very important in tracking code releases, baselines, and managing access to the configuration management repository. An SCM plan or charter identifies what should be under configuration management control. Without an SCM plan and a CCB, application releases can&apos;t be tracked and vulnerabilities can be inserted intentionally or unintentionally into the code base of the application.\n\nThis requirement is intended to be applied to application developers or organizations responsible for code management or who have and operate an application CM repository.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the application representative and determine if application development is performed on site by the organization.\n\nIf application development is not done in house, the requirement is not applicable.\n\nIf so, determine if a CCB exists. Ask about the membership of the CCB, and identify the primary members. Ask if there is CCB charter documentation.\n\nInterview the application representative and determine how often the CCB meets.\n\nAsk if there is CCB charter documentation. The CCB charter documentation should indicate how often the CCB meets.\n\nIf there is no charter documentation, ask when the last time the CCB met and when was the last release of the application.\n\nCCBs do not have to physically meet, and the CCB chair may authorize a release based on phone and/or e-mail conversations.\n\nIf there is no evidence of CCB activity or meetings prior to the last release cycle, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Setup and maintain a Configuration Control Board.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001795</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Configuration management dependent on organizational compliance and processes.  All project artifacts are publicly available on the GitHub site, in accordance with Code.mil guidance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222634</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000387</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222634r987685_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003030</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application services and interfaces must be compatible with and ready for IPv6 networks.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application has not been upgraded to execute on an IPv6-only network, there is a possibility the application will not execute properly, and as a result, a denial of service could occur.\n\nIn order to operate on an IPV6 network, the application must be capable of making IPV6 compatible network socket calls.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Verify the application environment is compliant with all DoD IPv6 Standards Profile for IPv6 Capable Products guidance for servers.\n\nIf the application environment is not compliant with all DoD IPv6 Standards Profile for IPv6 Capable Products guidance for servers, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Design application to be compliant with all Department of Defense (DoD) Information Technology Standards Registry (DISR) IPv6 profiles.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002853</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on specific deployment. Web application is a Node.js application that includes support for IPv6.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222635</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222635r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003040</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must not be hosted on a general purpose machine if the application is designated as critical or high availability by the ISSO.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Critical applications should not be hosted on a multi-purpose server with other applications. Applications that share resources are susceptible to the other shared application security defects. Even if the critical application is designed and deployed securely, an application that is not designed and deployed securely, can cause resource issues and possibly crash effecting the critical application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative to review the servers where the application is deployed. \n\nAsk what other applications are deployed on those servers.\n\nIdentify the criticality of the applications installed on the system.\n\nIf a mission critical application is deployed onto the same server as non-mission critical applications, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Deploy mission critical applications on servers that are not shared by other less critical applications.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002828</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222636</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222636r1051323_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003050</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A contingency plan must exist in accordance with DOD policy based on the application&apos;s availability requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Contingency planning for systems is part of an overall program for achieving continuity of operations for organizational mission and business functions. Contingency planning addresses system restoration and implementation of alternative mission or business processes when systems are compromised or breached. \n\nAll applications must document procedures to include business recovery plans, system contingency plans, facility disaster recovery plans, and plan acceptance.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review contingency plans.\n\nFor high availability applications, verify the contingency plan exists and provides for the smooth transfer of all mission or business essential functions to an alternate site for the duration of an event with little or no loss of operational continuity.\n \nFor moderate availability applications, verify the contingency plan exists and provides for the resumption of mission or business essential functions within 12 hours activation or as defined in the contingency plan.\n\nFor low availability applications, verify the contingency plan exists and provides for the partial resumption of mission or business essential functions within 5 to 30 days of activation as defined in the contingency plan.\n \nIf the contingency plan does not exist or does not meet the severity level requirements, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Create and maintain a contingency plan that identifies essential mission and business functions and associated contingency requirements.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000445</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222637</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222637r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003060</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Recovery procedures and technical system features must exist so recovery is performed in a secure and verifiable manner. The ISSO will document circumstances inhibiting a trusted recovery.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without a disaster recovery plan, the application is susceptible to interruption in service due to damage within the processing site.\n\nIf the application is part of the site’s disaster recovery plan, ensure that the plan contains detailed instructions pertaining to the application. Verify that recovery procedures indicate the steps needed for secure and trusted recovery.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review disaster recovery plan.\n\nVerify that a disaster recovery plan is in place for the application.\n\nVerify that the recovery procedures include any special considerations for trusted recovery.\n\nIf the application is not part of the site’s disaster recovery plan, or if any special considerations for trusted recovery are not documented, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Create and maintain a disaster recovery plan.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000448</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222638</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222638r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003070</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Data backup must be performed at required intervals in accordance with DoD policy.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without proper backups, the application is not protected from the loss of data or the operating environment in the event of hardware or software failure.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the application and system admins and review documented backup procedures.\n\nCheck the following based on the risk level of the application.\n\nFor low risk applications:\n\nValidate backup procedures exist and are performed at least weekly.\n\nA sampling of system backups should be checked to ensure compliance with the control.\n\nFor medium risk applications:\n\nValidate backup procedures exist and are performed at least daily.\n\nValidate recovery media is stored at an off-site location and ensure the data is protected in accordance with its risk category and confidentiality level. This validation can be performed by examining an SLA or MOU/MOA that states the protection levels of the data and how it should be stored.\n\nA sampling of system backups should be checked to ensure compliance with the control.\n\nVerify that the organization tests backup information to ensure media reliability and information integrity.\n\nVerify that the organization selectively uses backup information in the restoration of information system functions as part of annual contingency plan testing.\n\nFor high risk applications:\n\nValidate that the procedures have been defined for system redundancy and they are properly implemented and are executing the procedures.\n\nVerify that the redundant system is properly separated from the primary system (i.e., located in a different building or in a different city). This validation should be performed by examining the secondary system and ensuring its operation.\n\nExamine the SLA or MOU/MOA to ensure redundant capability is addressed. Finding details should indicate the type of validation performed. Examine the mirror capability testing procedures and results to insure the capability is properly tested at 6 month minimum intervals.\n\nIf any of the requirements above for the associated risk level of the application are not met, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Develop and implement backup procedures based on risk level of the system and in accordance with DoD policy.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000537</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222639</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222639r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003080</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Back-up copies of the application software or source code must be stored in a fire-rated container or stored separately (offsite).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application developers and application administrators must take steps to ensure continuity of development effort and operations should a disaster strike.  \n\nSteps include protecting back-up copies of development code and application software.\n\nImproper storage of the back-up copies can result in extended outages of the information system in the event of a fire or other situation that results in destruction of the back-up as well as the operating copy.\n\nTo address this risk, copies of application software and application source code must be stored in a fire-rated container or separately (offsite) from the operational or development environments.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When reviewing a COTS or GOTS application, verify that a back-up copy of the software is stored in a fire rated container or is stored separately (offsite) from the operational environment.\n\nDetermine if application development is done in-house. \n\nIf application development occurs in-house and source code is available, verify a back-up copy of the source code is kept in a fire-rated container or stored offsite from the development environment.\n\nIf back-up copies of the application software or source code are not stored in a fire-rated container or stored separately (offsite) from their respective environments, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Store a back-up copy of the application software and source code in a fire-rated container or store it separately (offsite) from their respective environments.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000540</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Application codebase is stored in a GitHub repository (offsite).</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222640</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222640r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003090</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Procedures must be in place to assure the appropriate physical and technical protection of the backup and restoration of the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Protection of backup and restoration assets is essential for the successful restore of operations after a catastrophic failure or damage to the system or data files. Failure to follow proper procedures may result in the permanent loss of system data and/or the loss of system capability resulting in failure of the customer’s mission.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Validate that backup and recovery procedures incorporate protection of the backup and restoration assets.\n\nVerify assets housing the backup data (e.g., SANS, tapes, backup directories, software) and the assets used for restoration (e.g., equipment and system software) are included in the backup and recovery procedures.\n\nIf backup and restoration devices are not included in the recovery procedures, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Develop and implement procedures to insure that backup and restoration assets are properly protected and stored in an area/location where it is unlikely they would be affected by an event that would affect the primary assets.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000540</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222641</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222641r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003100</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must use encryption to implement key exchange and authenticate endpoints prior to establishing a communication channel for key exchange.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application does not use encryption and authenticate endpoints prior to establishing a communication channel and prior to transmitting encryption keys, these keys may be intercepted, and could be used to decrypt the traffic of the current session, leading to potential loss or compromise of DoD data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application does not implement key exchange, this check is not applicable.\n\nIdentify all application or supporting infrastructure features using key exchange.\n\nVerify the application is using FIPS-140-2 validated cryptographic modules for encryption of keys during key exchange.\n\nIf the application does not implement encryption for key exchange, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use encryption for key exchange.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000201</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects other layers to provide appropriate data protection via compliant cryptography.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222642</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222642r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003110</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must not contain embedded authentication data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Authentication data stored in code could potentially be read and used by anonymous users to gain access to a backend database or application servers. This could lead to compromise of application data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and any available source code; this includes configuration files such as global.asa, if present, scripts, HTML files, and any ASCII files.\n\nIdentify any instances of passwords, certificates, or sensitive data included in code.\n\nIf credentials were found, check the file permissions and ownership of the offending file.\n\nIf access to the folder hosting the file is not restricted to the related application process and administrative users, this is a finding.\n\nThe finding details should note specifically where the offending credentials or data were located and what resources they enabled.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Remove embedded authentication data stored in code, configuration files, scripts, HTML file, or any ASCII files.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002367</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>No passwords, certificates, or sensitive data are included in the source code.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222643</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222643r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003120</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must have the capability to mark sensitive/classified output when required.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Failure to properly mark output could result in a disclosure of sensitive or classified data which is an immediate loss in confidentiality.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nAsk the application representative for the application’s classification guide. This guide should document the data elements and their classification.\n\nDetermine which application functions to examine, giving preference to report generation capabilities and the most common user transactions that involve sensitive data (FOUO, secret or above).\n\nLog on to the application and perform these in sequence, printing output when applicable. The application representative’s assistance may be required to perform these steps. For each function, note whether the appropriate markings appear on the displayed and printed output. If a classification document does not exist, data must be marked at the highest classification of the system.\n\nAppropriate markings for an application are as follows: For classified data, markings are required at a minimum at the top and the bottom of screens and reports.\n\nFor FOUO data, markings are required at a minimum of the bottom of the screen or report. In some cases, technology may prohibit the appropriate markings on printed documents. For example, in some cases, it is not possible to mark all pages top and bottom when a user prints from a browser. If this is the case, ask the application representative if user procedures exist for manually marking printed documents. If procedures do exist, examine the procedures to verify if the users were to follow the procedures the data would be marked correctly.\n\nAsk how these procedures are distributed to the users.\n\nIf appropriate markings are not present within the application and it is technically possible to have the markings present, this is a finding.\n\nIf it is not technically feasible to meet the minimum marking requirement and no user procedures exist or if followed the procedures will result in incorrect markings, or the procedures are not readily available to users, this is a finding.\n\nIn any case of a finding, the finding details should specify which functions failed to produce the desired results.\n\nAfter completing the test, destroy all printed output using the site’s preferred method for disposal. For example: utilizing a shredder or disposal in burn bags.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Enable the application to adequately mark sensitive/classified output.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001010</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The application interface indicates its configured classification, and all exports are marked with the configured classification.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222644</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222644r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003130</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Prior to each release of the application, updates to system, or applying patches; tests plans and procedures must be created and executed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without test plans and procedures for application releases or updates, unexpected results may occur which could lead to a denial of service to the application or components.\n\nThis requirement is meant to apply to developers or organizations that are doing development work when releasing a version update or a patch to the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the review is not being done with the developer of the application, this requirement is not applicable.\n\nAsk the application representative to provide tests plans, procedures, and results to ensure they are updated for each application release or updates to system patches.\n\nIf test plans, procedures, and results do not exist, or are not updated for each application release, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Execute tests plans prior to release or patch update.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003004</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Github workflows test functionality and access controls before release.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222645</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222645r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003140</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application files must be cryptographically hashed prior to deploying to DoD operational networks.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When application code and binaries are transferred from one environment to another, there is the potential for malware to be introduced into either the application code or even the application binaries themselves. Care must be taken to ensure that application code and binaries are validated for integrity prior to deployment into a production environment.\n\nTo ensure file integrity, application files and/or application packages are cryptographically hashed using a strong hashing algorithm. Comparing hashes after transferring the files makes it possible to detect changes in files that could indicate potential integrity issues with the application.\n\nCurrently, SHA256 is the DoD approved standard for cryptographic hash functions. DoD application developers must use SHA256 when creating cryptographic hashes; however, some non-DoD vendors might still use MD5 or SHA1 when generating a checksum hash for their application packages. It is important to use the same algorithms when validating the hash. If a non DoD vendor uses SHA1 when hashing their files, you must use SHA1 to validate the hash. Otherwise, the hashes will not match and a false positive indication of tampering will result.\n\nPrior to release of the application receiving an ATO/IATO for deployment into a DoD operational network, the application must be validated for integrity to ensure no tampering of source code or binaries has occurred. Failure to validate the integrity of application code and/or application binaries prior to deploying an application into a production environment may compromise the operational network.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative to demonstrate their cryptographic hash validation process or provide process documentation. The validation process will vary based upon the operating system used as there are numerous clients available that will display a file&apos;s cryptographic hash for validation purposes.\n\nLinux operating systems include the &quot;sha256sum&quot; utility. For Linux systems using sha256sum command syntax is: sha256sum [OPTION]... [FILE]...\n\nRecent Windows PowerShell versions include the &quot;get-filehash&quot; PowerShell cmdlet. The default algorithm value used is SHA256.\n\nSyntax is: \nGet-FileHash\n[-Path] &lt;String[]&gt;\n[-Algorithm &lt;String&gt;]\n[&lt;CommonParameters&gt;] \n\nA validation process involves obtaining the application files’ cryptographic hash value from the programs author or other authoritative source such as the application&apos;s website. A utility like the &quot;sha256sum&quot; utility is then run using the downloaded application file name as the argument. The output is the files&apos; hash value. The two hash values are compared and if they match, then file integrity is ensured.\n\nIf the application being reviewed is a COTS product and the vendor used a SHA1 or MD5 algorithm to generate a hash value, this is not a finding.\n\nIf the application being reviewed is a COTS product and the vendor did not provide a hash value for validating the package, this is not a finding.\n\nIf the integrity of the application files/code is not validated prior to deployment to DoD operational networks, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Developers/release managers create cryptographic hash values of application files and/or application packages prior to transitioning the application from test to a production environment. They protect cryptographic hash information so it cannot be altered and make a read copy of the hash information available to application Admins so they can validate application packages and files after they download the files.\n\nApplication Admins validate cryptographic hashes prior to deploying the application to production.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000698</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The application is offered as containerized API/Web Client builds that are signed using Docker Content Trust. Signed containers are also available on Iron Bank.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222646</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222646r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003150</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>At least one tester must be designated to test for security flaws in addition to functional testing.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If there is no person designated to test for security flaws, vulnerabilities can potentially be missed during testing.\n\nThis requirement is meant to apply to developers or organizations that are doing development work.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the organization chart and interview the admin staff.\n\nIdentify personnel designated as application security testers.\n\nIf the organization operating the application is not doing development work, this requirement is not applicable.\n\nIf the organization has not designated personnel to conduct security testing, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Designate personnel to conduct security testing on the applications.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003182</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Automated feature and access control tests are run against every commit to the release branch. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Policy for more information.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222647</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222647r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003160</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Test procedures must be created and at least annually executed to ensure system initialization, shutdown, and aborts are configured to verify the system remains in a secure state.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Secure state assurance cannot be accomplished without testing the system state at least annually to ensure the system remains in a secure state upon initialization, shutdown, and aborts.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the process documentation and interview the admin staff.\n\nIdentify if testing procedures exist and if they include annual testing to ensure the application remains in a secure state on initialization, shutdown, and aborts.\n\nChecks should include at a minimum, attempts to access the application and application configuration settings without credentials or with improper credentials both locally and remotely.\n\nDates should be noted as to the last date of testing.\n\nIf annual testing procedures do not exist, or if administrators are unable to provide testing dates that indicate the tests were conducted within the last year, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Create test procedures to test the security state of the application and exercise test procedures annually.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003182</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222648</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222648r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003170</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>An application code review must be performed on the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>A code review is a systematic evaluation of computer source code conducted for the purposes of identifying and remediating the security flaws in the software.\n\nThis requirement is meant to apply to developers or organizations that are doing application development work and have the responsibility for maintaining the application source code.\n\nExamples of security flaws include but are not limited to:\n\n- format string exploits\n- memory leaks \n- buffer overflows \n- race conditions\n- sql injection\n- dead/unused/commented code\n- input validation exploits\n\nThe code review is conducted during the application development phase, this allows discovered security issues to be corrected prior to release.\n\nCode reviews performed after the development phase must eventually go back to development for correction so conducting the code review during development is the logical and preferred action.\n\nAutomated code review tools are to be used whenever reviewing application source code. These tools are often incorporated into Integrated Development Environments (IDE) so code reviews can be conducted during all stages of the development life cycle. Periodically reviewing code during the development phase makes transition to a production environment easier as flaws are continually identified and addressed during the development phase rather than en masse at the end of the development effort.\n\nCode review processes and the tools used to conduct the code review analysis will vary depending upon application architecture and the development languages utilized.\n\nIn addition to automated testing, manual code reviews may also be used to validate or augment automated code review results. Larger projects will have a large code base and will require the use of automated code review tools in order to achieve complete code review coverage.\n\nA manual code review may consist of a peer review wherein other programmers on the team manually examine source code and automated code review results for known flaws that introduce security bugs into the application.\n\nAs with any testing, there is no single best approach and the tests must be tailored to the application architecture. Use of automated tools along with manual review of code and testing results is considered a best practice when conducting code reviews. This method is the most likely way to ensure the maximum number of errors are caught and addressed prior to implementing the application in a production environment.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>This requirement is meant to apply to developers or organizations that are doing the application development work and have the responsibility for maintaining the application source code.  Otherwise, the requirement is not applicable.\n\nReview the system documentation and ask the application representative to describe the code review process or provide documentation outlining the organizations code review process.\n\nIf code reviews are conducted with software tools, have the application representative provide the latest code review report for the application.\n\nEnsure the code review looks for all known security flaws including but not limited to:\n\n- format string exploits\n- memory leaks\n- buffer overflows\n- race conditions\n- sql injection\n- dead/unused/commented code\n- input validation exploits\n\nIf the organization does not conduct code reviews on the application that attempt to identify all known and potential security issues, or if code review results are not available for review, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Conduct and document code reviews on the application during development and identify and remediate all known and potential security vulnerabilities prior to releasing the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003187</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>SonarCloud scans, including OWASP tests and code reviews, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Policy for more information.  Application source code is publicly available, and may be scanned at any time by any organization.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222649</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222649r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003180</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Code coverage statistics must be maintained for each release of the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>This requirement is meant to apply to developers or organizations that are doing application development work.\n\nCode coverage statistics describes the overall functionality provided by the application and how much of the source code has been tested during the release cycle.\n\nTo avoid the potential for testing the same pieces of code over and over again, code coverage statistics are used to track which aspects or modules of the application are tested.\n\nSome applications are so large that it is not feasible to test every last bit of the application code on one release cycle. In those instances, it is acceptable to prioritize and identify the modules that are critical to the applications security posture and test those first. Rolling over to test other modules later as resources permit. E.g., testing functionality that performs authentication and authorization before testing printing capabilities.\n\nApplication developers should keep statistics that show all of the modules of the application and identify which modules were tested and when. This will help testers to keep track of what has been tested and help to verify all functionality is tested.\n\nThe developer makes sure that flaws are documented in a defect tracking system.\n\nIf the application is smaller in nature and all aspects of the application can be tested, the code coverage statistics would be 100%.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the organization does not do or manage the application development work for the application, this requirement is not applicable.\n\nAsk the application representative to provide code coverage statistics maintained for the application.\n\nIf these code coverage statistics do not exist, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Track application testing and maintain statistics that show how much of the application function was tested.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003188</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Code coverage assessed for development using Node.js c8 and newman tests. Reports available upon request.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222650</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222650r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003190</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Flaws found during a code review must be tracked in a defect tracking system.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>This requirement is meant to apply to developers or organizations that are doing application development work.\n\nIf flaws are not tracked they may possibly be forgotten to be included in a release. Tracking flaws in the configuration management repository will help identify code elements to be changed, as well as the requested change.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>This requirement is meant to apply to developers or organizations that are doing application development work.\n\nIf application development is not being done or managed by the organization, this requirement is not applicable.\n\nAsk the application representative to demonstrate that the configuration management repository captures flaws in the code review process. The configuration management repository may consist of a separate application for capturing code defects.\n\nIf there is no configuration management repository or the code review flaws are not captured in the configuration management repository, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Track software defects in a defect tracking system.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003161</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>All known code defects are tracked as Issues on the project&apos;s GitHub site, or developer&apos;s SonarCloud management page.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222651</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222651r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003200</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The changes to the application must be assessed for IA and accreditation impact prior to implementation.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When changes are made to an application, either in the code or in the configuration of underlying components such as the OS or the web or application server, there is the potential for security vulnerabilities to be opened up on the system.\n\nIA assessment of proposed changes is necessary to verify security integrity is maintained within the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the application and system administrators and determine if changes to the application are assessed for IA impact prior to implementation.\n\nReview the CCB process documentation to ensure potential changes to the application are evaluated to determine impact. An informal group may be tasked with impact assessment of upcoming version changes.\n\nIf IA impact analysis is not performed, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review IA impact to the system prior to implementing changes.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003173</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222652</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222652r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003210</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Security flaws must be fixed or addressed in the project plan.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>This requirement is meant to apply to developers or organizations that are doing application development work.\n\nApplication development efforts include the creation of a project plan to track and organize the development work.\n\nIf security flaws are not tracked within the project plan, it is possible the flaws will be overlooked and included in a release.\n\nTracking flaws in the project plan will help identify code elements to be changed as well as the requested change.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>This requirement is meant to apply to developers or organizations that are doing application development work. If the organization managing the application is not performing or managing the development of the application the requirement is not applicable.\n\nAsk the application representative to demonstrate how security flaws are integrated into the project plan.\n\nIf security flaws are not addressed in the project plan or there is no process to introduce security flaws into the project plan, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Address security flaws within a project plan to ensure they are tracked and addressed by management.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003178</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Policy page on GitHub for more info.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222653</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222653r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003215</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application development team must follow a set of coding standards.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Coding standards are guidelines established by the development team or individual developers that recommend programming style, practices and methods.  The coding standards employed will vary based upon the programming language that is being used to develop the application and the development team.\n\nCoding standards often cover the use of white space characters, variable naming conventions, function naming conventions, and comment styles.  Implementing coding standards provides many benefits to the development process.  These benefits include code readability, coding consistency among both individual and teams of developers as well as ease of code integration.  \n\nThe following are examples of what will typically be in a coding standards document.  This list is an example of what one can expect to find in typical coding standard documents and is not a comprehensive list:\n\n- Indent style conventions\n- Naming conventions\n- Line length conventions\n- Comment conventions\n- Programming best practices\n- Programming style conventions\n\nCoding standards allow developers to quickly adapt to code which has been developed by various members of a development team.  Coding standards are useful in the code review process as well as in situations where a team member leaves and duties must then be assigned to another team member.  \n\nCode conforming to a standard format is easier to read, especially if someone other than the original developer is examining the code.  In addition, formatted code can be debugged and corrected faster than unformatted code.\n\nIntroducing coding standards can help increase the consistency, reliability, and security of the application by ensuring common programming structures and tasks are handled by similar methods, as well as, reducing the occurrence of common logic errors.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>This requirement is meant to apply to developers or organizations that are doing application development work. If the organization operating the application under review is not doing the development or managing the development of the application, the requirement is not applicable.\n\nAsk the application representative about their coding standards. Ask for a coding standards document, review the document and ask the developers if they are aware of and if they use the coding standards. Make a determination if the application developers follow the coding standard. \n\nIf the developers do not follow a coding standard, or if a coding standard document does not exist, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Create and maintain a coding standard process and documentation for developers to follow. \n\nInclude programming best practices based on the languages being used for application development. Include items that should be standardized across the team that deals with how developers write their application code.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003233</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>SonarCloud scans, OWASP tests, and tests for coding standards, are run regularly to identify vulnerabilities.  Manual testing also performed. \n SonarLint and SonarCloud quality gates are also used.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222654</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222654r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003220</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The designer must create and update the Design Document for each release of the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>This requirement is meant to apply to developers or organizations that are doing application development work.\n\nThe application design document or configuration guide includes configuration settings, recommendations and best practices that pertain to the secure deployment of the application.\n\nIt also contains the detailed functional architecture as well as any changes to the application architecture corresponding to a new version release and must be documented to ensure all risks are assessed and mitigated to the maximum extent practical.\n\nFailure to do so may result in unexposed risk, and failure to mitigate the risk leading to failure or compromise of the system.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>This requirement is meant to apply to developers or organizations that are doing application development work. If the organization operating the application is not doing the development or managing the development of the application, the requirement is not applicable.\n\nAsk the application representative for the design document for the application. Review the design document.\n\nExamine the design document and/or the threat model for the application and verify the following information is documented:\n\n- All external interfaces.\n- The nature of information being exchanged\n- Any protections on the external interface\n- User roles required for access control and the access privileges assigned to each role\n- Unique security requirements (e.g., encryption of key data elements at rest)\n- Categories of sensitive information processed by the application and their specific protection plans (e.g., PII, HIPAA).\n- Restoration priority of subsystems, processes, or information\n- Verify the organization includes documentation describing the design and implementation details of the security controls employed within the information system with sufficient detail\n- Application incident response plan that provides details on how to provide the development team with application vulnerability or bug information.\n\nIf the design document is incomplete, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Create and maintain the Design Document for each release of the application and identify the following:\n\n- All external interfaces (from the threat model)\n- The nature of information being exchanged\n- Categories of sensitive information processed or stored and their specific protection plans\n- The protection mechanisms associated with each interface\n- User roles required for access control\n- Access privileges assigned to each role\n- Unique application security requirements\n- Categories of sensitive information processed or stored and specific protection plans (e.g., Privacy Act, HIPAA, etc.)\n- Restoration priority of subsystems, processes, or information.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003233</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Requires organizational compliance, project documentation, and project Security Policy.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222655</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222655r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003230</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Threat models must be documented and reviewed for each application release and updated as required by design and functionality changes or when new threats are discovered.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Threat modeling is an approach for analyzing the security of an application. It is a structured approach that enables you to identify, quantify, and address the security risks associated with an application. Threat modeling is not an approach to reviewing code, but it does complement the security code review process.\n\nThreat modeling can optimize application security by identifying objectives and vulnerabilities, and then defining countermeasures to prevent, or mitigate the effects of, threats to the system.\n\nThe lack of threat modeling will potentially leave unidentified threats for attackers to utilize to gain access to the application. To execute a threat model you should do the following:\n\n- Decompose the Application. The first step in the threat modeling process is gaining an understanding of the application and how it interacts with external entities. This includes identifying application components such as web server, application server, database server and languages used by the application. It also includes identifying network connections and the means utilized to access the application.\n\n- Determine and rank threats. Use a threat categorization methodology to understand the different threat categories.\nE.g., Auditing, authentication, configuration management and data protection. The goal of the threat categorization is to help identify threats both from the attacker perspective and the defensive perspective.\n\n- Determine countermeasures and mitigation. A lack of protection against a threat might indicate a vulnerability whose risk exposure could be mitigated with the implementation of a countermeasure.\n\nCountermeasures could include using application firewalls, IDS/IPS to block or identify known attacks against the architecture and alarming on audit log events.\n\nRefer to the OWASP website for additional details on application threat modeling.\n\nhttps://www.owasp.org/index.php/Application_Threat_Modeling</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>This requirement is meant to apply to developers or organizations that are doing application development work.\n\nIf the organization operating the application is not doing the development or is not managing the development of the application, the requirement is not applicable.\n\nReview the threat model document and identify the following sections are present:\n\n- Identified threats\n- Potential vulnerabilities\n- Counter measures taken\n- Potential mitigations\n- Mitigations selected based on risk analysis\n\nReview the identified threats, vulnerabilities, and countermeasures.\nCountermeasures could include implementing application firewalls or IDS/IPS and configuring certain IDS filters.\n\nReview the application documentation.\nVerify the architecture and components of the application match with the components in the threat model document.\nVerify identified threats and vulnerabilities are addressed or mitigated and the ISSO and ISSM have reviewed and approved the document.\n\nIf the described threat model documentation does not exist, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Establish and maintain threat models and review for each application release and when new threats are discovered. Identify potential mitigations to identified threats. Verify mitigations are implemented to threats based on their risk analysis.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003256</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Requires organizational compliance, project documentation, and project Security Policy.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222656</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222656r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003235</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must not be subject to error handling vulnerabilities.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Error handling is the failure to check the return values of functions or catch top level exceptions within a program. Improper error handling in an application can lead to an application failure or possibly result in the application entering an insecure state. \n\nThe primary way to detect error handling vulnerabilities is to perform code reviews. If a manual code review cannot be performed, static code analysis tools should be employed in conjunction with tests to help force the error conditions by specifying invalid input (such as fuzzed data and malformed filenames) and by using different accounts to run the application. These tests may give indications of vulnerability, but they are not comprehensive.\n\nIn order to minimize error handling errors, ensure proper return code and exception handling is implemented throughout the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation, code review reports and the results from static code analysis tools.\n\nIdentify the most recent security scans and code analysis testing conducted.  Verify testing configuration includes tests for error handling issues.\n\nCheck test results for identified error handling vulnerabilities within the application.\n\nIf the test results indicate the existence of error handling vulnerabilities and no remediation evidence is presented, this is a finding.\n\nIf no test results are available for review, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ensure proper return code and exception handling is implemented throughout the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003272</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Automated feature and access control tests are run against every commit to the release branch. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Policy for more information.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222657</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222657r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003236</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application development team must provide an application incident response plan.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>An application incident response process is managed by the development team and should include a method for individuals to submit potential security vulnerabilities to the development or maintenance team. \n\nThe plan should dictate what is to be done with the reported vulnerabilities. Reported vulnerabilities must be tracked throughout the process to ensure they are triaged, corrected, and tested. The corresponding update is released to the user community and the user community is notified of the availability of the application update.\n\nWithout an established application incident management plan and process, discovered issues and vulnerabilities will go unreported.   Vulnerabilities will not be triaged and managed, and there may be delays in corrective actions.\n\nInformation on how to submit bug and vulnerability reports must also be included in the application design document or configuration guide.\n\nThis requirement is meant to be applied when reviewing an application with the development team.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application is a COTS application and the development team is not accessible to interview this requirement is not applicable.\n\nInterview the application development team members. Request and review the application incident response plan. \n\nEnsure the plan includes an implemented process that:\n\n- Tracks reported vulnerabilities and bugs\n- Confirms reported vulnerabilities and bugs\n- Tracks remediation effort\n- Notifies application users of available updates that address the reported issues.\n\nIf the application incident response plan does not exist and at a minimum does not implement the aforementioned processes, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The development team creates an application incident response plan documenting and establishing a process that at a minimum:\n\n- Tracks reported vulnerabilities and bugs\n- Confirms reported vulnerabilities and bugs\n- Tracks remediation effort\n- Notifies application users of available updates that address the reported issues.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003289</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>See project documentation and Security Policy attached to the project repository on GitHub.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222658</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222658r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003240</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>All products must be supported by the vendor or the development team.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Unsupported commercial and government developed software products should not be used because fixes to newly identified bugs will not be implemented by the vendor or development team. The lack of security updates can result in potential vulnerabilities.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator.\n\nIdentify all software components.\n\nReview the version information and identify the vendor if COTS software.\n\nAccess the vendor website to verify the version is still supported.\n\nAsk the application representative for proof that the application and all of its components are supported.\n\nExamples of proof may include:\n\ndesign documentation that includes support information, support specific contract documentation, successful creation of vendor support tickets, website toll free support phone numbers etcetera.\n\nIf any of the software components are not supported by a COTS vendor or a GOTS organization, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Remove or decommission all unsupported software products in the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003376</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Application is currently being actively maintained and supported.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222659</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222659r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003250</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must be decommissioned when maintenance or support is no longer available.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Unsupported software products should not be used because fixes to newly identified bugs will not be implemented by the vendor or development team. The lack of security updates can result in potential vulnerabilities.\n\nWhen maintenance updates and patches are no longer available, the application is no longer considered supported, and should be decommissioned.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the application representative and determine if all the application components are under maintenance contract. The entire application may be covered by a single maintenance agreement. The application should be decommissioned if maintenance or security support is no longer being provided by the vendor or by the development staff of a custom developed application.\n\nIf the application or any of the application components are not being maintained, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ensure there is maintenance for the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003376</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Application is currently being actively maintained and supported.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222660</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222660r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003260</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Procedures must be in place to notify users when an application is decommissioned.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When maintenance no longer exists for an application, there are no individuals responsible for making security updates. The application support staff should maintain procedures for decommissioning. The decommissioning process should include notifying users of the pending decommissioning event. If the users are not informed of the decommissioning event, attackers may be able to stand up similar looking system and fool users into attempting to log onto a duplicate system. This can be as simple as a banner informing users.\n\nThis risk is primarily geared towards insider threat scenarios and externally accessible applications that provide access to publicly releasable data but should also be applied to internal systems as a best practice.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the application representative to determine if provisions are in place to notify users when an application is decommissioned.\n \nIf provisions are not in place to notify users when an application is decommissioned, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Create and establish procedures to notify users when an application is decommissioned.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003374</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222661</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222661r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003270</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Unnecessary built-in application accounts must be disabled.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Default passwords and properties of built-in accounts are often publicly available. Anyone with necessary knowledge, internal or external, can compromise an application using built-in accounts.\n\nBuilt-in accounts are those that are added as part of the installation of the application software. These accounts exist for many common Commercial Off-the-Shelf (COTS) or open source components of enterprise applications (e.g., OS, web browser or database software).</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and identify if the application creates or utilizes built-in accounts.\n\nExamine the account list for obvious examples (e.g., accounts with vendor names such as Oracle or Tivoli).\n\nVerify that these accounts have been removed or disabled.\n\nIf enabled built-in accounts are present, ask the application representative the reason for their existence.\n\nIf the account is required in order for the application to operate properly, verify the account password has been changed to a DoD acceptable value.\n\nIf these accounts are not necessary to run the application, or if the accounts are required and the password has not been changed to meet DoD password requirements, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Disable unnecessary built-in userids, use other strong authentication when possible and use strong passwords if accounts are necessary for application operation.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003109</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Application has no built-in user accounts.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222662</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>high</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222662r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003280</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Default passwords must be changed.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Default passwords can easily be compromised by attackers allowing immediate access to the applications.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Identify the application name and version and do an Internet search for the product name and the string &quot;default password&quot;.\n\nIf default passwords are found, attempt to authenticate with the published default passwords.\n\nIf authentication is successful, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to use strong authenticators instead of passwords when possible. Otherwise, change default passwords to a DoD-approved strength password and follow all guidance for passwords.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003109</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Application has no default passwords.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222663</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222663r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003285</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>An Application Configuration Guide must be created and included with the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The Application Configuration Guide is any document or collection of documents used to configure the application.  These documents may be part of a user guide, secure configuration guide, or any guidance that satisfies the requirements provided herein.  \n\nConfiguration examples include but are not limited to:\n\n - Encryption Settings\n - PKI Certificate Configuration Settings\n - Password Settings\n - Auditing configuration\n - AD configuration\n - Backup and disaster recovery settings\n - List of hosting enclaves and network connection requirements\n - Deployment configuration settings \n - Known security assumptions, implications, system level protections, best practices, and required permissions\n\nDevelopment systems, build systems, and test systems must operate in a standardized environment. These settings are to be documented in the Application Configuration Guide.\n\nExamples include but are not limited to:\n\n - List of development systems, build systems, and test systems. \n - Versions of compilers used\n - Build options when creating applications and components\n - Versions of COTS software (used as part of the application)\n - Operating systems and versions\n - For web applications, which browsers and what versions are supported.\n \nAll deployment configuration settings are to be documented in the Application Configuration Guide and the Application Configuration Guide must be made available to application hosting providers and application/system administrators.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the application administrator.  Request and review the Application Configuration Guide. \n\nVerify the configuration guide at a minimum provides configuration details for the following examples.  The examples provided herein are not intended to limit the configuration settings that are documented in the guide.\n\nConfiguration examples include but are not limited to:\n\n - Encryption Settings\n - PKI Certificate Configuration Settings\n - Password Settings\n - Auditing configuration\n - AD configuration\n - Backup and disaster recovery settings\n - List of hosting enclaves and network connection requirements\n - Deployment configuration settings \n - Known security assumptions, implications, system level protections, best practices, and required permissions\n\nReview the Application Configuration Guide and determine if development systems are documented.  If no development is being performed where the application is hosted, this part of the requirement is NA.\n\nDevelopment systems, build systems, and test systems must operate in a standardized environment.\n\nExamples include but are not limited to:\n\n - List of development systems, build systems, and test systems. \n - Versions of compilers used\n - Build options when creating applications and components\n - Versions of COTS software (used as part of the application)\n - Operating systems and versions\n - For web applications, which browsers and what versions are supported.\n\nIf there is no application configuration guide included with the application, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Create the application configuration guide in accordance with configuration examples provided in the vulnerability discussion and check.\n\nVerify the application configuration guide is distributed along  with the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003124</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Project Documentation is provided.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222664</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222664r1051277_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003290</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application contains classified data, a Security Classification Guide must exist containing data elements and their classification.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Without a classification guide the marking, storage, and output media of classified material can be inadvertently mixed with unclassified material, leading to its possible loss or compromise.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>If the application does not process classified information, this check is not applicable.\n \nThe application may already be covered by a higher level program or other classification guide. If the classification guide is not written specifically to the application, the sensitive application data should be reviewed to determine whether it is contained in the classification guide.\n\nDOD 5200.01 Volume 1 identifies requirements for security classification and declassification guides.\n\nhttps://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/520001m_vol1.pdf\n\nSecurity classification guides must provide the following information:\n\nIdentify specific items, elements, or categories of information to be protected.\n\nState the specific classification to be assigned to each item or element of information and, when useful, specify items of information that are unclassified.\n\nProvide declassification instructions for each item or element of information, including the applicable exemption category for information exempted from automatic declassification.\n\nState a concise reason for classification for each item, element, or category of information that, at a minimum, cites the applicable classification categories in Section 1.5 of E.O. 12958.\n\nIdentify any special handling caveats that apply to items, elements, or categories of information.\n\nIdentify, by name or personal identifier and position title, the original classification authority approving the guide and the date of that approval.\n\nProvide a point of contact for questions about the guide and suggestions for improvement.\n\nFor information exempted from automatic declassification because its disclosure would reveal foreign government information or violate a statute, treaty, or international agreement, the security classification guide will identify the government or specify the applicable statute, treaty, or international agreement, as appropriate.\n\nIf the security classification guide does not exist, or does not contain application data elements and their classification, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Create and maintain a security classification guide.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-003124</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222665</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222665r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003300</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The designer must ensure uncategorized or emerging mobile code is not used in applications.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>By definition, mobile code is software obtained from remote systems outside the enclave boundary, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient.  \n\nFor a complete list of mobile code categorizations, refer to the overview document included with this STIG.\nCategorized mobile code includes but is not limited to:\n\n- ActiveX\n- Windows Scripting Host when used as mobile code\n- Unix Shell Scripts when used as mobile code\n- DOS batch scripts when used as mobile code\n- Java applets and other Java mobile code\n- Visual Basic for Applications (VBA)\n- LotusScript\n- PerfectScript\n- Postscript\n- JavaScript (including Jscript and ECMAScript variants)\n- VBScript\n- Portable Document Format (PDF)\n- Shockwave/Flash\n- Rich Internet Applications\n\nThe following technologies are not currently designated as mobile code:\n\n- XML\n- SMIL\n- QuickTime\n- VRML (exclusive of any associated Java applets or JavaScript scripts)\n\nThe following are outside the scope of the mobile code requirements:\n\n- Scripts and applets embedded in or linked to web pages and executed in the context of the web server.  Examples of this are Java servlets, Java Server pages, CGI, Active Server Pages, CFML, PHP, SSI, server-side JavaScript, server-side LotusScript.\n- Local programs and command scripts \n- Distributed object-oriented programming systems (e.g., CORBA, DCOM).\n- Software patches, updates, including self-extracting updates - software updates that must be invoked explicitly by the user are outside the mobile code policy.  Examples of technologies in this area include: Netscape SmartUpdate, Microsoft Windows Update, Netscape web browser plug-ins and Linux.\n\nIf other types of mobile code technologies are present that are not listed here, a written waiver must be granted by the CIO (allowing use of emerging mobile code technology). Also uncategorized mobile code must be submitted for AO approval.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview application administrator.\n\nDetermine what mobile code types are used by the application.\n\nIf uncategorized mobile code types are found, ask the application administrator to provide the documented waiver and risk acceptance. If the application is using uncategorized or emerging mobile code and there is no waiver provided, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Remove uncategorized or emerging mobile code from the application or obtain a waiver and risk acceptance to operate.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001167</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Application uses only Category 3 mobile code. (Javascript that runs client side in a web browser)</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222666</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222666r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003310</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Production database exports must have database administration credentials and sensitive data removed before releasing the export.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Production database exports are often used to populate development databases. Test and development environments do not typically have the same rigid security protections that production environments do. When production data is used in test and development, the production database exports will need to be scrubbed to prevent information like passwords and other sensitive data from becoming available to development and test staff that may not have a need to know. Sensitive data should not be included in database exports because of classification, privacy, and other types of data protection requirement issues. Not all application developers have need-to-know sensitive information such as HIPAA data, Privacy Act Data, production admin passwords or classified data.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and identify the existence of databases within the application architecture.\n\nAsk the application admin to identify when data exports from this database are imported to test or development databases.\n \nIf no data is exported to test or development databases, this check is not applicable.\n\nIf there are such data exports, ask if the production database includes sensitive data identified by the data owner as sensitive such as passwords, financial, personnel, personal, HIPAA, Privacy Act, or classified data is included.\n\nIf any database exports include sensitive data and that data is not sanitized or removed prior to or immediately after import to the development database, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Remove sensitive data from production database exports.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002478</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222667</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222667r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003320</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Protections against DoS attacks must be implemented.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Known DoS threats documented in the threat model should be mitigated, to prevent DoS type attacks.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Ask the application representative for the threat model document.\n\nExamine the threat model document and determine if DoS attacks are specified as a threat.\n\nIf there are no DoS threats identified in the threat model, the requirement is not applicable.\n\nVerify the mitigations provided for DoS attacks are implemented from the threat model.\n\nIf mitigations for DoS attacks are identified in the threat model but are not implemented, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Implement mitigations from the threat model for DOS attacks.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002386</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Threat model dependent on organizational requirements. The project expects to be deployed in a Container Platform that resists DoS attacks.  DoS mitigations expected to be implemented at Container Platform Ingress layer or otherwise fulfilled by specific deployment configurations.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222668</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222668r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003330</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The system must alert an administrator when low resource conditions are encountered.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>In order to prevent DoS type attacks, applications should be monitored when resource conditions reach a predefined threshold. This could indicate the onset of a DoS attack or could be the precursor to an application outage.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the system documentation and interview the application and system administrators.\n\nExamine the system to determine if an automated, continuous on-line monitoring and audit trail creation capability is present with the capability to immediately alert personnel of any unusual or inappropriate activity with potential IA implications, and with a user configurable capability to automatically disable the system if serious IA violations are detected.\n\nIf this monitoring capability does not exist, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Implement mechanisms to alert system administrators about a low resource condition.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001274</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects to be deployed in a Container Platform that monitors resource conditions.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222669</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222669r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003340</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>At least one application administrator must be registered to receive update notifications, or security alerts, when automated alerts are available.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Administrators should register for updates to all COTS and custom-developed software, so when security flaws are identified, they can be tracked for testing and updates of the application can be applied.\n\nAdmin personnel should be registered to receive updates to all components of the application, such as Web Server, Application Servers, and Database Servers. Also, if update notifications are provided for any custom-developed software, libraries or third-party tools, deployment personnel must also register for these updates.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the components of the application.\n\nAsk the application representative to demonstrate deployment personnel are registered to receive notifications for update notification for all of the application components including custom-developed software, libraries and third-party tools.\n\nIf no deployment personnel are registered to receive the alerts, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Register administrators to receive update notifications so they can patch and update applications and application components.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001285</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organization compliance.  Update notifications are available by subscription on GitHub project page.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222670</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222670r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003345</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must provide notifications or alerts when product update and security related patches are available.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>An application vulnerability management and update process must be in place to notify and provide users and administrators with a means of obtaining security patches and updates for the application.\n\nAn important part of the maintenance phase of an application is managing vulnerabilities for updated versions of the application after the application is released.  When a security flaw is discovered in an application deployed in a production environment, notification to the user community must take place as quickly as possible. \n\nThis notification should be planned for in the design phase of the application. This notification should be a warning of any potential risks to the application or data. A notification mechanism will be established to notify users of the vulnerability and the potential risks, the availability of a solution, and/or potential mitigations reducing risks to the application.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the components of the application.  Interview the application administrator.\n\nHave the application administrator demonstrate the application notification process that occurs when a security patch or product update is available.\n\nThe process must include a brief description of the issue and any potential risks related to the issue.\n\nThe process must also include information regarding the availability of the patch or update and how it can be obtained as well as any potential mitigations that can be utilized in the interim.\n\nIf there is no application security patch or update notification process, this is a finding.\n\nIf the application notification process does not include a brief description, information on risks, how to obtain the patch or update and any potential mitigations, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Provide a distribution mechanism for obtaining updates to the application.\n\nInclude a description of the issue, a summary of risk as well as potential mitigations and how to obtain the update.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001286</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>Update notifications are available by subscription on GitHub project page.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222671</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222671r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003350</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Connections between the DoD enclave and the Internet or other public or commercial wide area networks must require a DMZ.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>In order to protect DoD data and systems, all remote access to DoD information systems must be mediated through a managed access control point, such as a remote access server in a DMZ.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Interview the application representative and determine if the application is publicly accessible.\n\nIf the application is publicly accessible and traffic is not being routed through a DMZ, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Setup a DMZ between DoD and public networks.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-001119</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>Dependent on organizational compliance.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222672</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>low</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000506</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222672r961833_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003360</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must generate audit records when concurrent logons from different workstations occur.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>When an application provides users with the ability to concurrently logon, an event must be recorded that indicates the user has logged on from different workstations. It is important to ensure that audit logs differentiate between the two sessions.\n\nThe event data must include the user ID, the workstation information and application session information that provides the details necessary to determine which application session executed what action on the system.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation and interview the application administrator to identify where log records are stored.\n\nAccess log records then log on to the application as a regular user from one workstation. Take note of workstation IP address and confirm the address as the source workstation.\n\nHave the application administrator log on to the application from another workstation using the same account.\n\nValidate the IP address of the second workstation is recorded in the logs.\n\nIf the application does not create an audit record when concurrent logons occur from different workstations, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure the application to log concurrent logons from different workstations.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-000172</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>When logging endpoint requests, the API emits audit records that include the original source IP address.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-222673</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000516</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-222673r961863_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-003400</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The Program Manager must verify all levels of program management, designers, developers, and testers receive annual security training pertaining to their job function.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Many application team members may not be aware of the security implications regarding the code that they design, write and test.  To address this concern, the Program Manager will ensure all levels of program management receive security training regarding the necessity, impact, and benefits of integrating secure development practices into the development lifecycle.  \n\nThis training is in addition to DoD 8570 training requirements as DoD 8570 annual security training does not presently cover application SDLC security concerns.\n\nThe Program Manager will ensure development team members are provided training on secure design principles for the entire SDLC and newly discovered vulnerability types on, at least, an annual basis. \n\nDevelopment team members include:\n\n- Designers/Application Architects\n- Developers/Programmers\n- Testers\n- Application managers\n\nThis requirement applies to development teams or individual application developers and does not apply when reviewing a COTS application or an application hosted at a DECC or other hosting facility when the application team is not available to interview.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>This requirement is meant to be applied to developers and development teams only, otherwise, this requirement is not applicable.  \n\nInterview the application representative.\n\nAsk for evidence of annual security training for application managers, designers, developers, and testers. \n\nExamples of evidence include course completion certificates and a class roster. At a minimum, security training should include security awareness training pertaining to overall principles of secure application development.\n\nTraining must be in addition to DoD 8570 training requirements as DoD 8570 annual security training does not presently cover application SDLC security concerns. \n\nIf there is no evidence of security training, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Provide application development/operational related security specific annual training for managers, designers, developers, and testers.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002052</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>NotAFinding</STATUS>\n        <FINDING_DETAILS>The current developers are subject to annual security training requirements.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n      <VULN>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>V-265634</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Severity</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>medium</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Weight</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>10.0</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Group_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SRG-APP-000625</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>SV-265634r997307_rule</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>APSC-DV-002010</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Rule_Title</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>The application must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Vuln_Discuss</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect classified data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\n \nAdvanced Encryption Standard (AES)\nSymmetric block cipher used for information protection\nFIPS Pub 197\nUse 256 bit keys to protect up to TOP SECRET\n\nElliptic Curve Diffie-Hellman (ECDH) Key Exchange\nAsymmetric algorithm used for key establishment\nNIST SP 800-56A\nUse Curve P-384 to protect up to TOP SECRET.\n\nElliptic Curve Digital Signature Algorithm (ECDSA)\nAsymmetric algorithm used for digital signatures\nFIPS Pub 186-4\nUse Curve P-384 to protect up to TOP SECRET.\n\nSecure Hash Algorithm (SHA)\nAlgorithm used for computing a condensed representation of information\nFIPS Pub 180-4\n\nUse SHA-384 to protect up to TOP SECRET.\n \nDiffie-Hellman (DH) Key Exchange\nAsymmetric algorithm used for key establishment\nIETF RFC 3526 \nMinimum 3072-bit modulus to protect up to TOP SECRET\n\nRSA\nAsymmetric algorithm used for key establishment\nNIST SP 800-56B rev 1\nMinimum 3072-bit modulus to protect up to TOP SECRET\n\nRSA \nAsymmetric algorithm used for digital signatures\nFIPS PUB 186-4\nMinimum 3072 bit-modulus to protect up to TOP SECRET.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>IA_Controls</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Check_Content</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Review the application documentation, system security plan and interview the application administrator to determine if the application processes classified data.\n\nIf the application does not process classified data, this requirement is not applicable.\n\nIdentify the data classifications and the cryptographic protections established to protect the application data.\n\nVerify the application is configured to utilize the appropriate encryption based upon data classification, cryptographic tasks that need to be performed (information protection, hashing, signing) and information protection requirements.\n\nNIST-certified cryptography must be used to store classified non-Sources and Methods Intelligence (SAMI) information if required by the information owner.\n\nNSA-validated type-1 encryption must be used for all SAMI data stored in the enclave.\n\nIf the application is not configured to utilize the NSA-approved cryptographic modules in accordance with data protection requirements specified in the security plan, this is a finding.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Fix_Text</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Configure application to encrypt stored classified information; Ensure encryption is performed using NIST FIPS 140-2-validated encryption.\n\nEncrypt stored, non-SAMI classified information using NIST FIPS 140-2-validated encryption.\n\nImplement NSA-validated type-1 encryption of all SAMI data stored in the enclave.</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Positives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>False_Negatives</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Documentable</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>false</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigations</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Potential_Impact</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Third_Party_Tools</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Mitigation_Control</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Responsibility</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>Security_Override_Guidance</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA/>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>STIGRef</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>Application Security and Development Security Technical Implementation Guide :: Version 6, Release: 2 Benchmark Date: 30 Jan 2025</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STIG_DATA>\n          <VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE>\n          <ATTRIBUTE_DATA>CCI-002450</ATTRIBUTE_DATA>\n        </STIG_DATA>\n        <STATUS>Not_Reviewed</STATUS>\n        <FINDING_DETAILS>The project expects other layers to provide appropriate data protection via compliant cryptography. It supports interactions with the Data Storage layer via TLS. The project containers are read-only, stateless builds.</FINDING_DETAILS>\n        <COMMENTS></COMMENTS>\n        <SEVERITY_OVERRIDE/>\n        <SEVERITY_JUSTIFICATION/>\n      </VULN>\n    </iSTIG>\n  </STIGS>\n</CHECKLIST>\n"
  },
  {
    "path": "docs/_build/.gitignore",
    "content": "## Directory for the STIG Manager Sphinx documentation build\n\n# Content can be written here by executing:\n# $ ../build.sh\n#\n# This file hopes to prevent commits to this directory\n\n# Ignore everything in this directory\n*\n\n# Except this file and the html directory\n!html\n!.gitignore\n"
  },
  {
    "path": "docs/_build/html/.gitignore",
    "content": "## Directory for the STIG Manager Sphinx documentation HTML files\n\n# Content can be written here by executing:\n# $ ../build.sh\n#\n# This file hopes to prevent commits to this directory\n\n# Ignore everything in this directory\n*\n\n# Except this file\n!.gitignore\n"
  },
  {
    "path": "docs/_static/css/custom-pydata-theme.css",
    "content": ".tight-table td {\r\n    white-space:normal !important;\r\n}\r\n\r\n.wy-nav-content {\r\n    width: 100%;\r\n    max-width: 1100px !important;\r\n}\r\n\r\n\r\n.document a:visited {\r\n  color: #2980b9;\r\n}\r\n\r\n.document a {\r\n  font-weight: bold;\r\n}\r\n\r\n\r\nh4 {\r\n  font-size: 100%;\r\n}\r\n\r\np.rubric {\r\n  margin-bottom: 12px;\r\n  font-size: 125%;\r\n}\r\n\r\np.rubric2 {\r\n  margin-bottom: 12px;\r\n  font-size: 150%;\r\n}\r\n\r\np.rubric3 {\r\n  margin-bottom: 12px;\r\n  font-size: 100%;\r\n}\r\n\r\n.container-fluid, .container-lg, .container-md, .container-sm, .container-xl {\r\n  width: 100%;\r\n  padding-right: 15px;\r\n  padding-left: 15px;\r\n  margin-right: auto;\r\n  margin-left: 0;\r\n}\r\n\r\n/* .rst-content .toctree-wrapper>p.caption, h1, h2, h3, h4, h5, h6, legend {\r\n  margin-top: 0;\r\n  font-weight: 700;\r\n  font-family: Roboto Slab,ff-tisa-web-pro,Georgia,Arial,sans-serif;\r\n} */\r\n\r\n\r\n\r\n/* \r\n\r\na:visited {\r\n  color: #2980b9;\r\n}\r\n.wy-menu-vertical a:visited {\r\n\tcolor: #d9d9d9\r\n}\r\n\r\n.wy-side-nav-search>a:visited {\r\n\tcolor: #d9d9d9\r\n} */\r\n\r\n\r\n/* a {\r\n  font-weight: bold;\r\n} */\r\n\r\n/* [1] The container */\r\n/* .img-hover-zoom { */\r\n    /* height: 300px !important; [1.1] Set it as per your need */\r\n    /* scale: 25% !important; [1.1] Set it as per your need */\r\n    /* overflow: hidden; [1.2] Hide the overflowing of child elements */\r\n  /* } */\r\n  \r\n  /* [2] Transition property for smooth transformation of images */\r\n  /* .img-hover-zoom img {\r\n    transform-origin: 0 0;\r\n    transition: transform .5s ease;\r\n  } */\r\n  \r\n  /* [3] Finally, transforming the image when container gets hovered */\r\n  /* .img-hover-zoom:hover img {\r\n    transform: scale(2.2);\r\n  } */\r\n\r\n  "
  },
  {
    "path": "docs/_static/css/custom.css",
    "content": ".rst-content .line-block { \r\n  margin-bottom: 0;\r\n}\r\n\r\nfigcaption {\r\n  padding-top: 10px;\r\n  font-size: 85%;\r\n  font-style: italic;\r\n}\r\n\r\n.tight-table td {\r\n    white-space:normal !important;\r\n}\r\n\r\n.wy-nav-content {\r\n    width: 100%;\r\n    max-width: 1100px !important;\r\n}\r\n\r\n\r\n.document a:visited {\r\n  color: #2980b9;\r\n}\r\n\r\n.document a {\r\n  font-weight: bold;\r\n}\r\n\r\n\r\nh4 {\r\n  font-size: 100%;\r\n}\r\n\r\np.rubric {\r\n  margin-bottom: 12px;\r\n  font-size: 125%;\r\n}\r\n\r\np.rubric2 {\r\n  margin-bottom: 12px;\r\n  font-size: 150%;\r\n}\r\n\r\np.rubric3 {\r\n  margin-bottom: 12px;\r\n  font-size: 100%;\r\n}\r\n\r\np.rubric-big {\r\n  margin-bottom: 12px;\r\n  font-size: 200%;\r\n}\r\n\r\n\r\n.rst-content .toctree-wrapper>p.caption, h1, h2, h3, h4, h5, h6, legend {\r\n  margin-top: 0;\r\n  font-weight: 700;\r\n  font-family: Lato,ff-tisa-web-pro,Georgia,Arial,sans-serif;\r\n}\r\n\r\n\r\n\r\n/* \r\n\r\na:visited {\r\n  color: #2980b9;\r\n}\r\n.wy-menu-vertical a:visited {\r\n\tcolor: #d9d9d9\r\n}\r\n\r\n.wy-side-nav-search>a:visited {\r\n\tcolor: #d9d9d9\r\n} */\r\n\r\n\r\n/* a {\r\n  font-weight: bold;\r\n} */\r\n\r\n/* [1] The container */\r\n/* .img-hover-zoom { */\r\n    /* height: 300px !important; [1.1] Set it as per your need */\r\n    /* scale: 25% !important; [1.1] Set it as per your need */\r\n    /* overflow: hidden; [1.2] Hide the overflowing of child elements */\r\n  /* } */\r\n  \r\n  /* [2] Transition property for smooth transformation of images */\r\n  /* .img-hover-zoom img {\r\n    transform-origin: 0 0;\r\n    transition: transform .5s ease;\r\n  } */\r\n  \r\n  /* [3] Finally, transforming the image when container gets hovered */\r\n  /* .img-hover-zoom:hover img {\r\n    transform: scale(2.2);\r\n  } */\r\n\r\n  "
  },
  {
    "path": "docs/admin-guide/admin-guide.rst",
    "content": ".. _admin-guide-doc:\r\n\r\n\r\nSTIGMan Application Management Guide \r\n###############################################\r\n\r\nSTIGMan App Manager Guide\r\n==================================\r\n\r\nLists functionality available to App Managers (often called \"admins\" for short) in the STIG Manager app.  For information about administering a deployment of STIG Manager, please see :ref:`installation-and-setup-index`.\r\n\r\nNavigation Tree\r\n--------------------\r\nApp Managers will see the Application Management branch in the Navigation tree, as well as the Collections branch available to all users.\r\n\r\n.. index::\r\n   single: Administration Branch\r\n\r\n.. _Administration Branch:\r\n\r\nApplication Management Branch\r\n==================================\r\nThe Application Management branch provides access to the following Application Management panels. \r\n\r\nCollections Admin Panel\r\n--------------------------------\r\nThis Panel lists every Collection in the STIGMan system, and allows you to create, delete, and alter them with the buttons at the top.\r\nThe columns list the Collection Name, Description, Owners, total User members, total Assets, total assigned STIGs, and the date of creation.\r\n\r\n\r\n.. note::\r\n   Be sure to assign a new Collection an Owner, or no one except for App Managers will be able to see it!\r\n\r\n\r\n.. thumbnail:: /assets/images/admin-collections.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Collection Administration\r\n\r\n\r\n----------------------\r\n\r\nUsers Admin Panel\r\n---------------------------------\r\nThis Panel lists every User known to the STIGMan system. The columns display usernames, Display Name, Status, Groups, date of first User access, last User access, User's privileges ( Create Collection or Administrator), and their internal userid.\r\n\r\nSTIG Manager's Users are automatically created when they have successfully used your Authentication Provider to authenticate and are redirected back to the STIGMan application.\r\n\r\nUsers can be pre-registered before they have authenticated with your Authentication Provider, but the username must match exactly.\r\n\r\nUsers can be Unregistered from STIG Manager. If the User has never accessed the system, their User record will be deleted. If the User has accessed the system, the User's Grant and Group assignments will be removed, but their User record will be retained for auditing and attribution purposes. The User will still be able to access the system if granted access by the Authentication Provider.\r\n\r\nApplication Managers can change a User's Status by selecting the user, and clicking the \"Set Un/Available\" button in the toolbar. \r\n\r\nUser Statuses:\r\n  - **Available** - Default Status. Allows an authenticated User access to the system and allows them to be assigned Grants and Group memberships.\r\n  - **Unavailable** - The User will not be able to access the system, and will not appear in User lists for the purposes of assigning Grants or Group membership. \r\n\r\nWhen an App Manager sets a User's Status to \"Unavailable,\" all the User's existing Grants and Group memberships will be removed. The User's record will remain in the system for auditing and attribution purposes.\r\n\r\nBy default, the Users Admin panel enables a filter on the \"Status\" column, so that only \"Available\" Users are displayed. To view all Users, check the \"(Select All)\" box in the Status column filter.\r\n\r\n\r\n.. thumbnail:: /assets/images/admin-users.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Users Administration\r\n\r\n|\r\n\r\nUser Properties\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nDouble-click on a User, or select a user and click the \"Modify User...\" button to view that User's Grants and other information. \r\nThe pop-up will list the User's email address and other Info, as well as the User's Group Membership and Grants. The Direct Grants tab lists the Grants that have been specifically applied to the User, and the \"Effective Grants\" panel includes Collection Grants for Groups the User is a member of. The \"Last Claims\" tab displays the OIDC access token information received the last time the User accessed the application. \r\n\r\n.. thumbnail:: /assets/images/admin-user-properties.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: User Properties\r\n\r\n|\r\n\r\nUser Groups Admin Panel\r\n---------------------------------\r\n\r\nThis Panel lists the groups created in the STIGMan system. The columns display the Group Name, Description, Creation Date, the number of Users in the group, and the number of Collections the group has access to.\r\n\r\nOnly Application Managers can create or modify Groups and their User membership. Once a Group is created, it becomes available to all Collection Owners and Managers to be assigned Grants in their Collections. \r\n\r\n\r\n.. thumbnail:: /assets/images/admin-user-groups.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: User Groups Administration\r\n      \r\n\r\nGroups can be created, deleted, and modified with the buttons at the top of the panel. Users can be added to or removed from groups by double-clicking on the group, or selecting a group and clicking the \"Modify Group...\" button.\r\n\r\nChange the Users in the group by selecting the User and clicking the arrow buttons to move them between the \"Available Users\" and \"Group Members\" lists. Group membership changes take effect immediately. \r\n\r\n\r\n.. thumbnail:: /assets/images/admin-user-groups-popup.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: User Group Popup Users Tab\r\n\r\nAssign Collection Grants to the Group by selecting the \"Direct Grants\" tab. Select one or more Collections from either list, and click the the appropriate arrow button to assign or remove the Grant for the Group. Grant changes take effect immediately.\r\n\r\n.. thumbnail:: /assets/images/admin-user-groups-popup-grants.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: User Group Popup Grants Tab\r\n\r\n\r\n\r\nSTIG Benchmarks Admin Panel\r\n-----------------------------------------\r\nThis panel lists every STIG that has been loaded into STIG Manager and allows App Managers to import new STIGs into STIG Manager.\r\nThe panel indicates the Benchmark ID, STIG Title, status, Current Revision, Revision Date, number of Rules, and number of potentially automated Rules for each STIG.\r\n\r\nUse the buttons at the top to add new STIGS, delete entire STIGs or specific revisions. STIGs can be imported individually, or as a .zip library of many STIGs.\r\n\r\n.. note::\r\n      By default, if the imported file contains a STIG Revision that already exists in the STIG Manager system, STIG Manager will retain the existing revision. To overwrite existing revisions, select the \"Replace existing Revisions\" checkbox when importing.\r\n\r\n\r\n.. thumbnail:: /assets/images/admin-stigs.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: STIGs Administration\r\n\r\n\r\n.. note::\r\n   STIG Manager only knows about the STIGs you have imported into the system. This action must be performed by App Managers, often quarterly to keep pace with DISA releases.  Once a new STIG revision is imported, that revision becomes the default STIG that is presented for Review to the User. Reviews for old STIGs still in the system can be viewed with the Checklist->Revisions menu item in the Asset Review workspace for that STIG.\r\n\r\n\r\n\r\n-------------------------\r\n\r\n.. _service-jobs:\r\n\r\nService Jobs Panel\r\n------------------------------------\r\n\r\nThis panel allows App Managers to control and view the background Service Jobs that have been created in the STIGMan database. It includes information about the jobs, their schedule, component tasks, status, run history and output.  App Managers can create, modify, schedule, delete, and run jobs from this panel.  Jobs created by `system` cannot be deleted, but they can be disabled and their schedule can be modified. \r\n\r\n.. thumbnail:: /assets/images/admin-service-jobs.png\r\n      :width: 75% \r\n      :show_caption: True\r\n      :title: Service Jobs Administration\r\n\r\nThe Service Jobs feature provides a framework for managing scheduled background operations in STIG Manager. This feature enables both system-defined and user-defined jobs that can run one or more predefined tasks either on a schedule or immediately on demand.\r\n\r\nThe initial implementation provides database maintenance and cleanup tasks. However, Service Jobs will serve as the foundation for future capabilities, including Review aging operations and time-based snapshots and analysis.\r\n\r\n.. rubric:: Job Types\r\n\r\n**System Jobs**\r\n   Pre-defined jobs created and maintained by STIG Manager for essential database operations. System jobs cannot be deleted and have restricted modification permissions - only their scheduling (event) properties can be modified by administrators.\r\n\r\n**User Jobs**  \r\n   Custom jobs created by App Managers to meet specific organizational needs. User jobs provide full flexibility in task selection, scheduling, and configuration.\r\n\r\nThe feature provides several built-in System Jobs that are disabled by default. It is highly recommended that you enable and schedule these jobs to maintain the health of your STIG Manager database. Scheduling these jobs to run during off-peak hours is advisable to minimize any potential performance impact on users and reduce resource usage.\r\n\r\nSystem-provided Jobs:\r\n - **Cleanup Database**: Removes database records related to deleted Collections and Assets and their associated reviews. Disabled by default.\r\n - **Delete Unmapped Asset Reviews**: Delete reviews for rules in STIGs that are no longer assigned to an Asset.  This can occur when STIGs are unassigned from an Asset by a Collection Manager. Disabled by default.\r\n - **Delete Unmapped Reviews**: Delete reviews that no longer match any STIG Rule in the system. This can occur when old Reference STIGs are removed from the system by an App Manager. Disabled by default.\r\n\r\n\r\n.. note::\r\n   These database maintenance Jobs are not enabled by default. Administrators must enable the Jobs they wish to use. Exercise caution when modifying or running database maintenance jobs, as these operations can affect system data. Always ensure you have appropriate backups before running destructive maintenance operations.\r\n\r\n.. rubric:: Job Components\r\n\r\nEach job consists of the following components:\r\n\r\n**Tasks**\r\n   Individual operations that perform specific functions. Tasks are pre-defined by the system and can include database maintenance operations, cleanup procedures, and analytical functions. Multiple tasks can be assigned to a single job, and will be run sequentially.\r\n\r\n   The system provides various pre-defined tasks for common maintenance operations. These tasks can be combined into jobs as needed:\r\n   * **WipeDeletedObjects**: Removes soft-deleted records from the database\r\n   * **DeleteUnmappedReviews**: Cleans up reviews that are no longer mapped to current STIG requirements\r\n   * **DeleteUnmappedAssetReviews**: Removes unmapped reviews specific to individual assets\r\n   * **AnalyzeReviewTables**: Runs the `ANALYZE TABLE` command on review-related database tables to optimize query performance   \r\n\r\n**Schedule (Event)**\r\n   Optional scheduling configuration that determines when and how frequently a job runs:\r\n   \r\n   * **One-time**: Executes at a specific date and time\r\n   * **Recurring**: Executes on a repeating schedule with configurable intervals (daily, weekly, monthly, etc.)\r\n   * **Manual**: No schedule - runs only when triggered manually\r\n\r\n**Job Properties**\r\n   Basic job information including name, description, creator, and modification history.\r\n\r\n\r\n.. thumbnail:: /assets/images/admin-service-job-properties.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Service Job Properties   \r\n\r\n.. rubric:: Managing Jobs\r\n\r\n**Creating Jobs**\r\n   Use the \"Create\" button to define new user jobs. Specify the job name, description, select one or more tasks, and optionally configure a schedule.\r\n\r\n**Modifying Jobs**\r\n   Existing jobs can be modified using the \"Modify\" button. User jobs allow full modification of all properties, while system jobs only permit schedule modifications.\r\n\r\n**Running Jobs Immediately**\r\n   Any job can be executed immediately using the \"Run now...\" button, regardless of its scheduled configuration.\r\n\r\n**Removing Jobs**\r\n   User jobs can be deleted using the \"Remove\" button. System jobs cannot be deleted.\r\n\r\n.. rubric:: Monitoring Job Execution\r\n\r\nThe Service Jobs interface provides detailed execution monitoring:\r\n\r\n**Job Runs**\r\n   View complete execution history with run states (running, completed, failed, shutdown), start times, duration, and detailed output logs. \r\n\r\n**Real-time Output**\r\n   Monitor job execution in real-time with detailed task-level output including timestamps, message types, and execution status.\r\n\r\n**Run Management**\r\n   Individual job runs can be deleted from the execution history as needed for maintenance purposes with the Trash button in the Job Run row.\r\n\r\n\r\n\r\n-------------------------\r\n\r\n.. _app-info:\r\n\r\nApplication Info Panel\r\n------------------------------------\r\n\r\n\r\nThis panel provides App Managers with a report on the current state, performance, and utilization of the STIGMan application.  \r\n\r\nThe toolbar allows users to load and save report data files, as well as fetch a new report from the API. The \"Save for sharing\" button will download a .json file of the current report data with the option to replace specific deployment data such as Collection and User names with generated identifiers. \r\n\r\nThe report displays the data source, date, and STIG Manager version at the top. Report data is displayed in the following tabs:\r\n\r\n  - **Requests**: Information regarding the requests made to each API endpoint, organized by operationId. This data includes the count of requests, max duration, average duration, response length, error counts, and other useful metrics.  Endpoints with ``projection`` parameters will populate the \"Projections\" panel with a subset of these metrics. This report also indicates users and clients that made the requests, as well as counts of any error code responses.\r\n  - **Collections**: High level metrics about the size and state of all Collections, including \"disabled\" Collections and Assets, total Reviews, grants, etc. This report offers additional tabs reporting Grants, Labels, STIG Assignments, and Settings by Collection. The \"Access Control Lists\" panel lists users and applicable access control rules for users with limited access to the Collection, such as those with Restricted-type grants. \r\n  - **Users**: A report of all users of the system, their privileges, grants, and last active date.  This report also includes panels summarizing overall user counts by privilege, and by last activity date (last 30/90 days).\r\n  - **Groups**: A report of all User Groups in the system, their User count, grants, and creation date. \r\n  - **MySQL**: Information about the managed data, configuration, and status of the MySQL database. \r\n  - **NodeJs**: Information about the configuration of the STIGMan application, as well as status of the NodeJs server, including the version, uptime, and memory usage.\r\n  - **JSON Tree** : A tree view of the data that is available in the report. Equivalent to the contents of the .json file that can be downloaded with the \"Save\" button.\r\n\r\n\r\n.. note::\r\n   Help the STIG Manager team improve the application by sharing this report if you encounter issues or have suggestions for improvement. You can email the report to the team at RMF_Tools@us.navy.mil\r\n\r\n\r\n.. thumbnail:: /assets/images/admin-app-info.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Application Info Report\r\n\r\n\r\n|\r\n\r\n\r\n-------------------------\r\n\r\n.. _log-stream:\r\n\r\nLog Stream Workspace Overview\r\n------------------------------------\r\n\r\n\r\nThis Workspace provides App Managers with real-time streaming of log records from the STIG Manager backend to the web client. This can help troubleshoot issues that would otherwise require direct access to the backend logs. \r\nLog records are transmitted over a WebSocket connection, which requires a properly configured reverse proxy or firewall to allow WebSocket traffic. In compatible browsers, the stream can be recorded to a file for later analysis. Reverse Proxy configuration guidance can be found in the :ref:`reverse-proxy`.\r\n\r\nThis feature is experimental, however it is enabled by default. It can be disabled by setting the ``STIGMAN_EXPERIMENTAL_LOGSTREAM`` environment variable to ``false``. \r\n\r\n\r\n.. thumbnail:: /assets/images/admin-log-stream.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Application Log Stream\r\n\r\n\r\nThe Log Stream Workspace contains the Log Stream Panel, JSON Tree Panel, and API Transactions Panel.\r\n\r\n\r\nLog Stream Panel\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThe Log Stream panel contains a toolbar with controls to start and stop the log stream, record the stream to a file, and filter log records by level and component.\r\n\r\n\r\n- Click the \"Stream\" button to open a WebSocket connection to the backend and begin receiving log records. The log records will appear in the panel in real-time as they are generated by the backend. Click the \"down\" arrow portion of the Stream button to expand the filter options for this function.\r\n\r\n.. thumbnail:: /assets/images/admin-log-stream-filter.png\r\n      :width: 25% \r\n      :show_caption: True\r\n      :title: Application Log Stream Filter Options\r\n\r\n\r\n\r\n- Click the \"Record\" button to start recording the log stream to a file, and again to stop the recording. The \"Record\" function is not available in Firefox.\r\n- The \"Preserve Log\" checkbox will retain log entries in the panel when the stream is stopped and then started again. \r\n- The \"Wrap\" button will toggle line wrapping in the panel. \r\n- The \"Clear\" button will clear all log entries from the panel.\r\n\r\nJSON Tree Panel\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nClicking a Log entry in the Log Stream Panel or API Transactions Panel will display that log entry in a structured tree format in the JSON Tree panel. Each log record can be expanded to view its individual fields and values. \r\n\r\n\r\nAPI Transactions Panel\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThis panel displays a grid-style view of the API transactions visible in the raw Log Stream Panel (``rest`` in the Log Stream filter). \r\nSelecting an entry in this grid will auto-select the corresponding log entry in the Log Stream Panel, and display it in the JSON Tree Panel.\r\n\r\n\r\n\r\n-------------------------\r\n\r\n.. _app-data:\r\n\r\nExport/Import Data Panel\r\n------------------------------------\r\n\r\nThis panel allows App Managers to stream JSONL records from the STIG Manager backend database to a file, with an option to GZip compress the stream. The final size of the file is unknown when the operation starts, so no progress indication can be provided. Transfer rates will be higher if the server does not compress the stream, but the final file may be up to 10x larger.\r\n\r\nThe downloaded file can be imported into the same or a different STIG Manager instance. All existing data will be overwritten. Importing a Gzip compressed file will reduce upload time and memory usage on the API service.\r\n\r\nThis feature must be enabled for the deployment by setting the ``STIGMAN_EXPERIMENTAL_APPDATA`` environment variable to ``true``. \r\n\r\n.. warning::\r\n   This feature is Experimental and continues to be developed, breaking changes may happen. Use at your own risk and rely on daily database backups to maintain your data.  ALL data in the destination instance will be replaced.\r\n\r\n.. thumbnail:: /assets/images/admin-app-data.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Application Data Import/Export\r\n\r\n\r\n|\r\n\r\n"
  },
  {
    "path": "docs/admin-guide/admin-quickstart.rst",
    "content": ".. _admin-quickstart:\r\n\r\n\r\nSTIGMan Application Manager (Administrator) Walkthrough\r\n########################################################################\r\n\r\n\r\nThis Application Manager Walkthrough will walk you through typical responsibilities for a STIG Manager User with the App Manager role (often called \"admin\" for short and labeled that way in Keycloak). This Walkthrough assumes you are familiar with the terms and features specified in the :ref:`user-guide-doc`.\r\nBeyond the permissions granted to normal Users, App Managers have the ability to:\r\n\r\n   * Update STIG Benchmarks in STIG Manager\r\n   * Alter Collections to which they have not been specifically granted access\r\n   * Alter User Grants\r\n   * Export and Import Application Data (Experimental feature for now.)\r\n\r\n\r\n**The most important responsibility of the Application Manager is importing and updating the set of STIGs the system will use to calculate statistics, assign to Assets, populate the Library, and reference in all other functions.  This should be done quarterly, with the release of new STIG Library Compilations,  or individually as new STIGs are released.**\r\n\r\nThis update is quite simple, and is described below. \r\n\r\n\r\nApplication Manager Menu\r\n============================\r\n\r\nApp Managers in STIG Manager have access to 4 additional App Management tabs that other users do not, accessible from the Navigation Tree.\r\n\r\n\r\n.. _stig-import:\r\n.. _stig-updates:\r\n\r\nSTIG Benchmarks\r\n============================\r\n\r\n\r\nThis tab shows you a list of STIGs known to this instance of STIG Manager along with some basic statistics about them, such as their rule count and revision date. This interface also allows you to import new STIGs. \r\n\r\n.. rubric:: Importing and Updating STIGs\r\n\r\nDISA releases new versions of many of their STIGs every Quarter.  They also occasionally release them off this schedule. Keep an eye on DISA's  `https://public.cyber.mil/stigs/ <https://public.cyber.mil/stigs/>`_ and `https://cyber.mil/stigs/ <https://cyber.mil/stigs/>`_ sites for updates. \r\n\r\nThese updates must be brought into STIG Manager if you wish the updates to be reflected in STIG Manager's reports and presentation. STIGs must be imported by someone with Application Manager privileges in the STIG Manager instance:\r\n\r\n#. Download the STIGs you want to update from `DISA. <https://public.cyber.mil/stigs/>`_\r\n#. Upload the .zip files to STIG Manager via \"Import STIGs\" button in the ``Application Management -> STIG Benchmarks`` workspace accessed via the Navigation Tree. By default, if the file contains a STIG Revision that already exists in the STIG Manager system, STIG Manager will retain the existing revision. To overwrite existing revisions, select the \"Replace existing Revisions\" checkbox when importing.\r\n#. The import may run for several minutes. When finished, the workspace will be populated with the STIG IDs and other information about the STIGs you imported.  These STIGs will now be available to users to assign to their Assets and for evaluations.\r\n\r\n.. note::\r\n  You can import entire .zip archives of the Quarterly Library Compilations at once, or individual STIGs. \r\n\r\n.. thumbnail:: /assets/images/admin-stigs.png\r\n   :width: 50% \r\n   :show_caption: True\r\n   :alt: STIG Management\r\n   :title: STIG Management\r\n\r\n|\r\n\r\n.. ATTENTION::\r\n   **STIG Manager OSS will not be able to function as intended if you have not imported STIGs into the system.** The STIGs you import should be the ones published by DISA, as they will be used as the reference STIG for almost all STIG Manager functions.  STIGs must be imported before any Asset-STIG assignments can be made, manual evaluations performed, or .ckl files can be imported. All statistics are calculated against the latest (default) version of the STIG.\r\n\r\n\r\n\r\nBy default, STIG Manager displays Checklists and Reviews according to the latest version of the STIG.  It will also recalculate statistics against the latest version(s) of the STIGs. No other action is needed after an update. When a new STIG is imported from this interface, ALL assets in the system will reflect new version of the imported STIG as the default. Older revisions of STIGs can still be selected from the Review or Collection Review Workspace checklist pulldown menu. \r\n\r\n\r\n.. thumbnail:: /assets/images/asset-review-stig-revisions.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: STIG Revision Selection\r\n\r\n|\r\n\r\n\r\nSTIG Manager tracks Reviews by their Rule Version (often called \"STIG ID\") and that Rule's Check Content. In most cases, new STIG revisions will have substantially the same rule content as previous revisions. This means that most of the time, when you update Reference STIGs in STIG Manager, most Assets will carry most of their existing reviews forward and you will not have to start from scratch.\r\n\r\n.. _stig-delete:\r\n\r\nDelete Stigs or Revisions\r\n-------------------------------\r\n\r\nMany STIGs are released quarterly, and old STIGs quickly lose their relevance.  To keep a handle on Database growth and simplify the user experience, you may want to delete old STIG revisions. We have found it is not especially useful to keep STIGs greater than 1 revision away from the current one around, as they are no longer valid for most purposes. \r\n\r\nYou might also delete a STIG revision if you have updated STIGs but would prefer to revert to an older one as the default (hopefully not for long!).  In this case, you might want to delete the current STIG revision.  \r\n\r\n.. warning::\r\n      When you delete a STIG or a specific STIG revision, Reviews for rules **that only appear in that revision** will be deleted. If the rules in that STIG are found in other STIGs or revisions, the reviews will remain.\r\n\r\n\r\n|\r\n\r\n\r\n\r\n\r\nCollections Tab\r\n============================\r\n\r\nThis tab presents a list of all Collections in STIG Manager, as well as some statistics about the Collection.  It also includes buttons to create, delete, and alter Collection properties and grants. \r\n\r\nIn most cases, Collection Owners should be administering their own Collections. However, in cases where the Owner is unavailable, or has accidentally removed all owners from a Collection, this interface allows an App Manager to assign new Owner Grants to Collections by double-clicking the Collection or using the \"Collection Properties\" button. The App Manager can also delete Collections if required.\r\n\r\n.. thumbnail:: /assets/images/admin-collections.png\r\n   :width: 50% \r\n   :show_caption: True\r\n   :alt: Collection Admin\r\n   :title: Collection Admin\r\n\r\n\r\n----------------------------------\r\n\r\n.. _pre-registering-users:\r\n\r\nUser Grants\r\n============================\r\n\r\nThis tab presents a lit of all users known to STIG Manager, as well as some statistics about them. \r\nIt also includes buttons to pre-register User, unregister User, and modify User Grants. \r\n\r\n\r\n.. ATTENTION::\r\n   Being an App Manager in STIG Manager does not give you the ability to *create* new users or assign them new Application Privileges (Admin or Collection Creator). Creating users and assigning Application Privileges can only be done in the Authentication provider (often the Keycloak Management Console), and you must have the proper permissions on your Authentication Provider to do this.\r\n\r\nPre-registering Users\r\n----------------------------\r\n\r\nSTIG Manager will automatically creates a user record when a new Authenticated User accesses the system.  If you want to make assignments to users before they have accessed the system, it is possible to pre-register them from the ``Administration -> User Grants`` workspace.  Click the Pre-register User button, and enter their username. This username must match exactly the username that will be provided by the Authentication Provider when the user eventually shows up. \r\n\r\nIt is important to note that the pre-register function does not grant access to STIG Manager. User *access* is solely managed via your Authentication Provider (Keycloak, Okta, etc). Pre-registering a user in STIG Manager will create a user record in the STIG Manager database that can be given Collection Grants before the user has accessed the system, but they will not be able to access the system until they have authenticated with the Authentication Provider.\r\n\r\nA pre-registered user will have *No value* in the Last Access column of this screen until they actually access STIG Manager. \r\n\r\n\r\n.. thumbnail:: /assets/images/user-admin-prereg-button.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Pre-register User button\r\n\r\n.. thumbnail:: /assets/images/user-admin-prereg-popup.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Pre-register User popup\r\n\r\n|\r\n\r\n.. _deregistering-users:\r\n.. _unregistering-users:\r\n.. _delete-user:\r\n\r\n\r\nUnregistering Users\r\n--------------------------\r\n\r\nOverall access to STIG Manager is controlled by your deployment's OIDC Provider (ie. Keycloak).  Unregistering Users will remove all their Collection Grants, but will not prevent access to STIG Manager unless the user is also disabled/deleted/altered in the Authentication Provider.  However, once un-registered they will not have access to any information in STIG Manager besides the STIG Library. \r\n\r\nTo unregister a User, select the User, and click the \"Unregister User\" button. The selected user will have all their Collection Grants removed.  The User's other info will remain, so that any reviews or other actions they have performed will continue to have attribution. \r\n\r\n\r\n.. note::\r\n      If you want to prevent a user from having any access at all to STIG Manager, you must contact your OIDC Provider POC and ask that they perform this action. This can be accomplished in different ways that will depend on your specific deployment. \r\n\r\n\r\nModifying Users\r\n-----------------------\r\n\r\nThe only changes that can be made to Users in the STIG Manager interface is their Collection Grants or Group Membership. All other data in the User pop-up is derived from information in the access token, which is managed in the Authentication Provider.\r\n\r\n.. thumbnail:: /assets/images/userAdmin.png\r\n   :width: 50% \r\n   :show_caption: True\r\n   :alt: User Admin\r\n   :title: User Admin\r\n\r\n\r\n-------------------------------\r\n\r\n.. _enable-service-jobs:\r\n\r\nEnable Service Jobs\r\n============================\r\n\r\nService Jobs are scheduled background operations that perform essential database maintenance tasks in STIG Manager. **It is highly recommended that you enable and schedule these jobs to maintain the health of your STIG Manager database.** These jobs help keep your database lean and performant by cleaning up unreferenced data that can accumulate over time.\r\n\r\n.. thumbnail:: /assets/images/admin-service-jobs.png\r\n      :width: 75%\r\n      :show_caption: True\r\n      :title: Service Jobs Administration\r\n\r\n.. rubric:: Recommended Setup\r\n\r\nAccess the Service Jobs interface from ``Application Management -> Service Jobs`` in the Navigation Tree. You'll see three system-provided jobs that are disabled by default. Double-click each job to modify its properties and set up a schedule:\r\n\r\n#. **Cleanup Database** - Removes records related to deleted Collections and Assets. **Recommended cadence: Weekly**\r\n#. **Delete Unmapped Reviews** - Cleans up reviews that no longer match any STIG Rule in the system (often because old Reference STIGs were removed). **Recommended cadence: Monthly**\r\n#. **Delete Unmapped Asset Reviews** - Removes reviews for STIGs that are no longer assigned to Assets. **Recommended cadence: Every 90 days**\r\n\r\nSchedule these jobs to run during off-peak hours to minimize performance impact. You can also run any job immediately using the \"Run now...\" button if needed. Be sure to click the \"Enabled\" checkbox to activate each job after configuring its schedule, and Save.\r\n\r\n.. thumbnail:: /assets/images/admin-service-job-properties.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Service Job Properties   \r\n\r\n.. note::\r\n   Always ensure you have appropriate database backups before enabling these jobs for the first time. See the :ref:`service-jobs` section of the Admin Guide for detailed information about job configuration and monitoring.\r\n\r\n\r\n.. _automated-imports:\r\n\r\nConfigure a Source of Automated Evaluations\r\n==================================================\r\n\r\nThere are several tools available that will automatically assess many of your STIGs, and provide output in .ckl or XCCDF output.  Tools such as Evaluate STIG and SCC can be configured to populate file system folders with their evaluation results. If you find yourself with a lot of these .ckl files, you may find the STIGMan Watcher tool useful.  \r\n\r\nSTIGMan Watcher is a lightweight command line utility that can be configured to monitor a file system folder for .ckl files or XCCDF results, and automatically submit them to a Collection on a STIG Manager instance.  You could potentially have many STIGMan Watchers running, each monitoring a file folder and importing results into particular STIGMan Collections. \r\n\r\nMore information can be found along with the source code on `GitHub <https://github.com/NUWCDIVNPT/stigman-watcher>`_ and with the `NodeJs package. <https://www.npmjs.com/package/stigman-watcher>`_\r\n\r\n\r\n.. note::\r\n   Be sure to give the STIGMan Watcher user permissions on your Collection!\r\n"
  },
  {
    "path": "docs/admin-guide/index.rst",
    "content": "\r\n.. _admin-guide-index:\r\n\r\nFor Admins\r\n===============\r\n\r\n.. meta::\r\n  :description: These pages describe how to Admin use STIG Manager.\r\n\r\nThese pages describes the Admin-level functions of STIG Manager.\r\n\r\n.. note:\r\n   This section is still under development.\r\n\r\n\r\n.. toctree::\r\n\t:maxdepth: 2\r\n\t:numbered: 4\r\n\t:caption: Contents:\r\n\r\n\tadmin-quickstart\r\n\tadmin-guide\r\n\t"
  },
  {
    "path": "docs/build.sh",
    "content": "#!/bin/bash\n\nSPHINX_IMAGE_W_REQUIREMENTS=sphinx-w-requirements\n\n# Change to this script directory\ncd \"$(dirname \"$(realpath \"$0\")\")\"\n\nfind _build -type f -not -name '.gitignore' -delete\nfind _build -type d -empty -delete\n\ndocker build -t $SPHINX_IMAGE_W_REQUIREMENTS .\n\ndocker run --rm -v $(pwd):/docs $SPHINX_IMAGE_W_REQUIREMENTS"
  },
  {
    "path": "docs/conf.py",
    "content": "# Configuration file for the Sphinx documentation builder.\r\n#\r\n# This file only contains a selection of the most common options. For a full\r\n# list see the documentation:\r\n# https://www.sphinx-doc.org/en/master/usage/configuration.html\r\n\r\n# -- Path setup --------------------------------------------------------------\r\n\r\n# If extensions (or modules to document with autodoc) are in another directory,\r\n# add these directories to sys.path here. If the directory is relative to the\r\n# documentation root, use os.path.abspath to make it absolute, like shown here.\r\n#\r\n# import os\r\n# import sys\r\n# sys.path.insert(0, os.path.abspath('.'))\r\nimport sphinx_rtd_theme\r\n\r\n\r\n# -- Project information -----------------------------------------------------\r\n\r\nproject = 'STIG Manager'\r\ncopyright = '2026 U.S. Federal Government (in countries where recognized)'\r\nauthor = 'cd-rite'\r\n\r\n\r\n# -- General configuration ---------------------------------------------------\r\n\r\n# Add any Sphinx extension module names here, as strings. They can be\r\n# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom\r\n# ones.\r\n# extensions = [\r\n# ]\r\nextensions = [\r\n    'sphinx_rtd_theme',\r\n    'sphinxcontrib.images',\r\n    'sphinx.ext.todo',\r\n    'myst_parser',    \r\n    'sphinx_tabs.tabs',\r\n    'sphinx_rtd_dark_mode'\r\n]\r\n\r\ntodo_include_todos = True\r\n# user starts in light or dark mode\r\ndefault_dark_mode = True\r\n\r\nimages_config = {\r\n    'override_image_directive': True,\r\n    'default_image_width': '50%',\r\n    'default_group': 'default'\r\n}\r\n\r\n\r\n# Add any paths that contain templates here, relative to this directory.\r\ntemplates_path = ['_templates']\r\n\r\n# List of patterns, relative to source directory, that match files and\r\n# directories to ignore when looking for source files.\r\n# This pattern also affects html_static_path and html_extra_path.\r\nexclude_patterns = ['_build', 'Thumbs.db', '.DS_Store']\r\n\r\n\r\n# -- Options for HTML output -------------------------------------------------\r\n\r\n# The theme to use for HTML and HTML Help pages.  See the documentation for\r\n# a list of builtin themes.\r\n#\r\n# html_theme = 'alabaster'\r\n# html_theme = \"pydata_sphinx_theme\"\r\nhtml_theme = \"sphinx_rtd_theme\"\r\nhtml_theme_options = {\r\n    'prev_next_buttons_location': 'both',\r\n    # 'logo_only': True,\r\n    'sticky_navigation': True\r\n}\r\n\r\n# html_style = 'css/default.css'\r\n\r\ngithub_doc_root = 'https://github.com/cd-rite/stig-manager/tree/readTheDocs/docs'\r\n\r\n\r\n# html_logo = './_static/images\\shield-green-check.svg'\r\nhtml_logo = 'assets/images/shield-green-check.svg'\r\n\r\n# Add any paths that contain custom static files (such as style sheets) here,\r\n# relative to this directory. They are copied after the builtin static files,\r\n# so a file named \"default.css\" will overwrite the builtin \"default.css\".\r\nhtml_static_path = ['_static']\r\n\r\n# These paths are either relative to html_static_path\r\n# or fully qualified paths (eg. https://...)\r\nhtml_css_files = [\r\n    'css/custom.css',\r\n    # 'css/custom-pydata-theme.css',\r\n]\r\n\r\nhtml_js_files = [\r\n    'js/custom.js',\r\n]\r\n\r\n# html_context = {\r\n# \"display_github\": True, # Add 'Edit on Github' link instead of 'View page source'\r\n# \"last_updated\": True,\r\n# \"commit\": False,\r\n# \"github_url\": 'https://github.com/cd-rite/stig-manager/tree/readTheDocs/docs'\r\n\r\n# }\r\n\r\n"
  },
  {
    "path": "docs/features/common-tasks.rst",
    "content": "\r\n.. _common-tasks:\r\n\r\n\r\n\r\n.. rubric:: STIG Manager Simplifies Common Tasks\r\n   :class: rubric-big\r\n\r\n\r\n######################################\r\n\r\n\r\nBuild A Collection with .ckl or XCCDF Files\r\n===============================================\r\n\r\nCreate your Collection (with the `+Create Collection...` node of the Nav Tree) and go to its Collection Management workspace by clicking the \"gear\" icon on the node for your Collection in the Nav Tree. You can also Manage your Collection by opening the main Collection Dashboard and clicking the \"Manage\" button in the Inventory block.\r\nFrom the Collection Management Workspace, select the \"Import CKL or XCCDF...\" button in the Asset Panel, then check out the :ref:`Collection Builder` portion of our User Guide for more info.\r\n\r\n\r\nReview a STIG on an Asset\r\n===================================\r\n\r\nMany STIGs do not have automated evaluations, and even after automated results are imported, many Rules may still require additional manual Evaluation.  The Asset Review Workspace in STIG Manager provides a comprehensive environment for Users to complete Evaluations of a specific STIG on an an Asset, and set statuses that can be used to gauge progress.\r\n\r\nUse the :ref:`Asset Review Workspace` to manually review individual STIG Rules, import results from .ckl or XCCDF files, compare Reviews to other Assets in the Collection, and to see a History of Reviews for that Asset. \r\n\r\n\r\nReview an entire Collection at once\r\n=============================================\r\n\r\nMany Collections will contain Assets that are assigned the same STIG.  The Collection Review Workspace allows Evaluators and Validators to step through each Rule in the STIG and view each Asset's Review and Status in one place. Restricted Users will only see the Assets they have been assigned, while Users with higher grants to the Collection will see every Asset.  Comments, Evaluations, and Statuses can all be edited via this interface, which also offers bulk actions for Submitting and Accepting Reviews.  This interface also provides an export option that will produce a .zip archive of .ckls representing the state of every Asset in the Collection that has this STIG. \r\n\r\nSee the User Guide's section on the :ref:`Collection Review Workspace` for more information. \r\n\r\n\r\nSet the Default STIG Revision for a Collection\r\n=================================================\r\n\r\nBy default, STIG Manager presents and calculates all Metrics against the latest Revision of STIG in the system.  To override this behavior, Collection Owners and Managers can \"Pin\" their Collection to a specific Revision of a STIG.  All Review Workspaces for the Collection will open with the pinned Revision, and all Metrics will be calculated against the pinned Revision. \r\n\r\nSee the User Guide's section on  :ref:`Revision Pinning <pin-revision>` for more information. \r\n\r\n\r\nAccept and Reject STIG Reviews\r\n====================================\r\n\r\nTo help advance through the RMF process, Collection Owners (often RMF Validators) can Accept STIG Reviews individually or in bulk using the :ref:`Collection Review Workspace`.  Collection Owners can also \"Reject\" Reviews and provide a Feedback comment to the Reviewer, which will require them to make further modification before submitting the Review again. \r\n\r\nCheck out the :ref:`Collection Review Workspace` portion of the User Guide for more information. \r\n\r\n\r\nAnalyze Findings and generate a POA&M\r\n==============================================\r\n\r\nThe Findings Report provides a roll-up of every \"Open\" Evaluation in a Collection, and allows you to drill down into the contributing Asset Reviews.  A POA&M-style spreadsheet of these Findings can also be exported.\r\n\r\nCheck the User Guide for more information about the :ref:`Findings Report`.\r\n\r\n\r\nCheck evaluation progress\r\n==============================\r\n\r\nThe :ref:`Collection Dashboard` allows Users to gauge the work involved and the progress made towards evaluating every Asset and STIG in their Collection.  \r\n\r\nThe :ref:`Collection Dashboard` also tallies the number of \"Open\" findings and their severity. \r\n\r\n\r\nAdd Users\r\n==============================\r\n\r\nTo a Collection\r\n-------------------\r\n\r\nIf you have a Manage or Owner Role in a Collection, you can assign Roles to other Users or User Groups with a Collection Grant. \r\nCheck the :ref:`User Walkthrough <create-a-grant>` for the quick steps to create a Grant, and the :ref:`Collection Management section of the User Guide <grants-panel>` for a detailed look at the UI components that affect Grants.\r\n\r\n\r\nTo the System\r\n------------------\r\n\r\nAdding a user to STIG Manager will be dependent on the way your Organization has configured your Authentication Provider. Check out the :ref:`Adding Users` portion of the Setup Guide for more information. \r\n\r\n\r\nExport Results\r\n===============================\r\n\r\nFrom the Collection Management panel, you can export Results for Assets to another Collection, or download a .zip Archive of .ckl files for your entire Collection or some portion of it.  \r\n\r\nThese exports are available organized :ref:`by Asset <export-by-asset>` or :ref:`by STIG. <export-by-stig>`\r\n\r\nTransfer Assets to Another Collection\r\n==========================================\r\n\r\nAssets can be moved from one Collection to another if a User has \"Manage\" or \"Owner\" grants on both Collections. \r\n\r\nTransfer Assets with the :ref:`\"Transfer To\" button in the Manage Collection Workspace.<transfer-asset>`\r\n\r\n\r\nTag Assets with Labels\r\n=========================\r\n\r\nIf you have Manage or Owner access to a Collection, you can create labels in your Collection that can be used to tag Assets. Tagging assets can allow you set up groups of Assets, or mark them them as a certain team's responsibility, or sort them more effectively.\r\n\r\nCheck out the :ref:`Labels <labels-tab>` section of the user guide for a further description of this feature. \r\n\r\n\r\nCreate a new set of STIG Assignments based on an existing set\r\n===================================================================================\r\n\r\nYou can assign a new STIG to a set of Assets that already have a particular STIG assigned to them. You might do this if you have a set of Assets assigned a Windows STIG, and want to assign all those Assets the Windows Defender STIG, or if the latest DISA STIG release changed the Benchmark ID of a STIG to something new (for example, from **MS_**\\ WINDOWS_10_STIG to WINDOWS_10_STIG). \r\n\r\nFrom the Manage Collection interface:\r\n   #. In the lower right panel, select the STIG you want to base the new set of assignments off of and click the \"Modify...\" button.\r\n   #. From the resulting STIG Assignments pop-up, select the pull-down button from the STIG Selector.\r\n   #. Scroll and/or filter to find the STIG you want, and select it.\r\n   #. Select any other desired Assets for assignment. \r\n   #. Click \"Save\".\r\n\r\nA new set of Assignments will be created for the new STIG. \r\n\r\n\r\nUpdate Reference STIGs\r\n========================\r\n\r\nDISA releases new STIGs every quarter (and often in-between scheduled releases).  STIG Manager will retain older STIG revisions that have been imported as long as the Benchmark ID in the STIG remains the same.  All STIG Assignments made to Assets will be preserved, and will refer to the latest version of the STIG that was imported (unless otherwise pinned to a specific Revision in the Collection [This feature is not yet fully implemented]).\r\n\r\nMost STIG updates only change a small fraction of the Rules therein. STIG Manager tracks reviews using the Rule Version and Rule Check Content, so in most cases a completely reviewed Asset with a new STIG will still have most of the Reviews already populated and in the same state they were in before the update. \r\n\r\n\r\nDownload the new STIGs from DISA, and upload the STIGs you want to update using the :ref:`STIGS Import interface. <stig-updates>`\r\n\r\n\r\nHaving a problem? Let us know and submit an issue on GitHub!\r\n===================================================================\r\n\r\n`Visit our GitHUB Issues page to submit Issues. <https://github.com/NUWCDIVNPT/stig-manager/issues>`_\r\n\r\n"
  },
  {
    "path": "docs/features/index.rst",
    "content": "\r\n.. _features-index:\r\n\r\nIntroduction and Features\r\n############################\r\n\r\n.. _Introduction:\r\n\r\n\r\nWhat is STIG Manager?\r\n======================\r\n\r\nSTIG Manager is an Open Source API and Web client for managing the assessment of Information Systems for compliance with `security checklists <https://public.cyber.mil/stigs/>`_ published by the United States (U.S.) Defense Information Systems Agency (DISA). STIG Manager supports DISA checklists `distributed <https://public.cyber.mil/stigs/downloads/>`_ as either a Security Technical Implementation Guide (STIG) or a Security Requirements Guide (SRG) in the XCCDF format.\r\n\r\nOur Project incorporates software developed since 2012 by the `U.S. Naval Undersea Warfare Center Division Newport (NUWCDIVNPT) <https://www.navsea.navy.mil/Home/Warfare-Centers/NUWC-Newport/>`_. More information, and the software itself, is available on GitHub: `STIG Manager <https://github.com/NUWCDIVNPT/stig-manager/>`_\r\n\r\n\r\n\r\nThe Single Source of Truth throughout Steps 3 and 4 of the RMF Process\r\n===========================================================================================\r\n\r\nThroughout the RMF process, STIG Manager serves as the single source of truth for users, evaluators, managers, RMF Package reviewers, ISSEs, NQVs, and automated tools about Assets, STIGs, and their current assessment status.  By allowing everyone involved in the process to refer to the same set of data and reports, the RMF process can be executed efficiently and its progress monitored effectively.  STIG Managers API allows automated tools to submit scan results, as well as access data for direction on what STIGs they should scan.\r\n\r\nSTIG Manager provides data structures, assessment workspaces, and Reports for managing these Steps of the RMF process.  \r\n\r\n\r\n.. raw:: html\r\n\r\n  <iframe width=\"560\" height=\"315\" src=\"https://www.youtube.com/embed/wv_Gdbl_LrU\" title=\"YouTube video player\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen></iframe>\r\n\r\n--------------------\r\n\r\n\r\nFeatures and Capabilities Overview\r\n====================================\r\n\r\n\r\nSTIG Evaluation Data, Freed From .CKL Files\r\n----------------------------------------------------\r\n\r\nSTIG Manager maintains a canonical set of STIGs as published by DISA, and relates all Reviews to that set. Working with this data directly in STIGMan, rather than passing .ckl files around, eliminates the possibility of STIG Evaluators using the wrong STIG revision, changing severity, creating malformed .ckls, and other issues that can hamper the efficient flow of Evaluations to Validators.  STIG Manager will import .ckl files and create Reviews that match their contents. Any remaining Evaluation gaps can be reviewed manually in the STIGMan interface, or added to with additional imports. STIGMan provide a unified view of overall Evaluation progress, and are not tied to any specific .ckl file.  \r\n\r\nInstead of relying on .CKL files that could be altered, overridden, or have missing fields, properly formed .CKLs are generated from the current Evaluation state of Assets. Once Validators verify that all reviews are as they want them, they can create an archive of .CKLs on demand for import into eMASS. \r\n\r\n\r\nRMF Package data represented as Collections, Assets, STIGs, and Reviews\r\n----------------------------------------------------------------------------------\r\n\r\nSTIG Manager's primary organizational structure is the Collection. A Collection can be created to mirror components of an RMF Package, requirements identified in a Security Assessment Plan, or an entirely different principle that may be more convenient, such as by an organization's Lab or by Asset OS.\r\n\r\nCollections are composed of:\r\n  * Assets\r\n  * STIGs attached to those Assets\r\n  * Reviews of the Rules that compose each attached STIG\r\n  * User Grants providing access to some or all of the Assets/STIGs in that Collection\r\n  * Reports providing Status and Findings information\r\n\r\n\r\nCreate Collections From Your Existing .CKL Files\r\n------------------------------------------------------------\r\n  \r\nMigrating to STIG Manager is easy because it can use your existing artifacts to build and update Collections. Assets, STIGs, and Reviews can be populated with the .ckls produced by STIG Viewer or the automated STIG assessments in XCCDF format produced by the SCC tool, as well as manually from the Collection Configuration tab.  Once a Collection is created in STIG Manager, Users can be granted access to see the current results for each STIG on an Asset, or the whole Collection. Users can see automated tool evaluations, and Rules that still require evaluation.\r\n\r\n.. note::\r\n  STIG Manager does not maintain a repository of uploaded checklists. Instead, it maintains a current state of evaluations for an asset, and will create new .ckls for you on demand with the most current results.\r\n\r\n\r\n-------------------------\r\n\r\nWorkspaces for Understanding and Tracking Your Evaluation Data\r\n-------------------------------------------------------------------------------------\r\n\r\nThe STIG Manager Client provides efficient workspaces for creating Collections of Assets and their associated STIGs, and assigning specific Users to evaluate those STIGs. User tasking can be managed in real time by granting Collection roles with varying levels of access, down to individual STIGs on specific Assets. Users have access to efficient STIG Review workspaces that provide resources to guide their evaluations, such as their previous answers for other Assets, as well as allow them to evaluate multiple Assets at once.  Every User gets real time reports and statistics about their progress and the status of their Reviews, scoped to their level of access in each Collection. \r\n\r\n\r\n.. raw:: html\r\n\r\n  <iframe width=\"560\" height=\"315\" src=\"https://www.youtube.com/embed/ZwVJ0eO2d_I\" title=\"YouTube video player\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen></iframe>\r\n\r\n-------------------\r\n\r\n\r\nSophisticated Algorithm Tracks Reviews Across STIG Revision Changes, Eliminating Redundant Work\r\n---------------------------------------------------------------------------------------------------\r\n\r\nSTIG Manager tracks Reviews using the Rule Version and Rule Check Content, so that When STIGs are updated, all Reviews for Rules with unchanged content are carried forward to the new STIG. This allows STIG Evaluators to focus on the Rules that have changed, and not repeat work that has already been done.\r\n\r\nSee our section on :ref:`Review Handling and Matching<review-handling>` for more information about how STIGMan tracks Reviews.\r\n\r\nCustomizable Review Requirements to Help Progress Towards a POA&M\r\n---------------------------------------------------------------------\r\n\r\nSTIG Manager supports customizable Review Requirements that allow designated Collection Owners to \"Reject\" Reviews to evaluators for further revision or clarification, such as when a Finding requires further Detailing. Collection Owners can also \"Accept\" a Review, potentially marking it as a candidate for their POA&M. \r\n\r\nReporting on Findings and Evaluation Status\r\n---------------------------------------------------\r\n\r\nReports adjust as new STIGs are assigned, results imported, or when new DISA STIG revisions are imported, to provide information on the status and progress of evaluations.\r\n\r\nThe Collection Configuration workspace provides real-time totals for level of work required as changes to Assets and STIGs are made.\r\n\r\nUser Access Controls to Limit Access to Your Data\r\n-----------------------------------------------------------\r\n\r\nSTIG Manager provides granular Role-Based Access Controls that can give Users access to some or all of the Assets and their STIGs in a Collection.\r\n\r\nSTIG Manager is CCI-aware\r\n-----------------------------------\r\n\r\nSTIG Manager maintains relationships between STIG Rules and their associated CCIs and Assessment Procedures. Reports can be pivoted to show Open Findings sorted by Rule, CCI, or Group.\r\n\r\nSTIG Manager can produce a pre-populated POA&M-style spreadsheet that lists findings already decomposed into their related CCIs. \r\n\r\n\r\nSTIG Manager Integrates with the Continuous RMF Lifecycle approach\r\n----------------------------------------------------------------------\r\n\r\nSTIG Manager is ready to support a life-cycle approach to RMF. Your most current STIG Assessments are always available in STIGManager. When new STIGs are released, system or SAP changes occur, or new STIGs are applied, only the new content needs to be assessed.  STIG Manager also timestamps every review, to help determine compliance with the Continuous Evaluation approach. STIG Manager also maintains a history of every Review performed so Review changes over time can be referenced.\r\n\r\n\r\n\r\n..\r\n  Collaborate on Steps 3 and 4 of the RMF Process\r\n  ===================================================\r\n\r\n  STIGMan separates your evaluation data from the .ckls that previously contained them. \r\n  Instead of sending .ckls around ahving to check that they are in order, perfect .ckls are generated on demand.\r\n  STIG Manager produces .ckls that represent \r\n\r\n  Based off a canonical STIG, so you don't have to worry if the .ckl STIG is altered.\r\n\r\n\r\n  Collaborate on STIG Evaluation and management. Make use of others expertise.\r\n\r\n  Collaboratively manage your STIG assessments.\r\n\r\n  Single source of truth for all parties to reference. \r\n\r\n  Multiple workspaces for different user approaches and responsibilitiies.\r\n\r\n  Multiple workspaces for each \r\n\r\n  organize and perform STIG evaluations\r\n  Collection Management\r\n  Asset\r\n  STIG Evaluations\r\n  Approve evaluations\r\n  Report on Status, Progress, and Findings.\r\n  Analyze Evaluation progress.\r\n\r\n  Complete API\r\n\r\n  Role and Assignmnet based access controls\r\n\r\n  combine inputs from individuals and automated results\r\n\r\n\r\n\r\n  STIG Manager serves as a central reference for current STIG Assignments, Evaluations, and progress for all parties involved in Package creation. \r\n\r\n\r\n  Rather than passing .ckl files around, which, by their nature, are instantly out of date, STIG Manager provides the authoritative source for current STIG Evaluations and Package progress. \r\n\r\n\r\n  Evaluate, validate, and check status of an entire Package at once. Track exactly when an Evaluation was last performed, both from automated, imported results and manual entries. \r\n\r\n\r\n  Import XCCDF results or .ckl files using STIG Manager's convenient interface to build a Collection of Assets, and get a handle on their current Evaluation Status. \r\n\r\n\r\n  Manual STIGs, and STIGs with incomplete automation can be completed right in STIG Manager's UI, either individually or as a group. Convenient references, such as Evaluations for other Assets in the Collection and a history of Rule Evaluations are easily accessible. IF applicable, Reviews for other Assets can be dragged and dropped right into another Assets Evaluation. \r\n\r\n  Work as a team. Stig Manager can show Evaluations you or your team have provided for other Assets in your Collection. \r\n\r\n\r\n\r\n  STIG Manager tracks Reviews using the Rule Version and Rule Check Content, so that When STIGs are updated, all Reviews for Rules with unchanged content are carried forward to the new STIG. \r\n\r\n\r\n  Enhance STIG Manager with utilities and clients of your own. STIG Manager was built with a well-documented RESTful API to enable convenient integration with other tools. \r\n\r\n\r\n  * Single source of truth for Evaluations and STIG Status.\r\n\r\n\r\n  Targeted Remediation Efforts\r\n  Use provided tools to target specific high value Vulnerabilities across all Assets in your Collection. Stigman does not remediate vulnerabilities, it represents accumulated data from manual evaluations and automated scans. \r\n\r\n\r\n  Targeted Evaluation Efforts\r\n\r\n\r\n  Track Evaluations at the Rule content level. When a STIG updates, if the Rule content does not change, that result persists to the new version. \r\n\r\n\r\n\r\n  * Automatically create a collection of Assets from your existing .ckl files.\r\n  * Review all your assets at once with the Collection Review workspace.\r\n  * Provide a workspace for viewing manual and automated STIG evaluations together.\r\n  * Enforce a Review Requirements for your Collection.\r\n  * Reports for Findings.\r\n  * Status reports, showing STIG Evaluation completeness\r\n  * Generate POAM-style spreadsheets from your findings.\r\n  * Single source of truth for Evaluations and STIG Status.\r\n\r\n  Workspaces\r\n  ----------------\r\n\r\n  Collection Builder\r\n  ----------------------\r\n\r\n  Reporting\r\n  -----------------\r\n\r\n\r\n\r\n\r\n########################\r\n\r\n\r\n.. toctree::\r\n   :maxdepth: 1\r\n   :caption: Common Tasks:\r\n\r\n   common-tasks\r\n\r\n\r\n\r\n\r\n---------------------\r\n\r\n|\r\n\r\n\r\n"
  },
  {
    "path": "docs/index.html",
    "content": "<meta http-equiv=\"refresh\" content=\"0; url=./_build/html/index.html\" />"
  },
  {
    "path": "docs/index.rst",
    "content": ".. STIG Manager documentation master file, created by\r\n   sphinx-quickstart on Sun Feb  7 02:40:25 2021.\r\n   You can adapt this file completely to your liking, but it should at least\r\n   contain the root `toctree` directive.\r\n\r\nWelcome to STIG Manager's documentation!\r\n========================================\r\n\r\n\r\nWhat is STIG Manager?\r\n-------------------------------\r\nSTIG Manager is an Open Source API and Web client for managing the assessment of Information Systems for compliance with `security checklists <https://public.cyber.mil/stigs/>`_ published by the United States (U.S.) Defense Information Systems Agency (DISA). STIG Manager supports DISA checklists `distributed <https://public.cyber.mil/stigs/downloads/>`_ as either a Security Technical Implementation Guide (STIG) or a Security Requirements Guide (SRG) in the XCCDF format.\r\n\r\nOur Project incorporates software developed since 2012 by the `U.S. Naval Undersea Warfare Center Division Newport (NUWCDIVNPT) <https://www.navsea.navy.mil/Home/Warfare-Centers/NUWC-Newport/>`_. More information, and the software itself, is available on GitHub: `STIG Manager <https://github.com/NUWCDIVNPT/stig-manager/>`_\r\n\r\n\r\n\r\n.. toctree::\r\n   :maxdepth: 1\r\n   :caption: Contents:\r\n\r\n   features/index\r\n   installation-and-setup/index\r\n   user-guide/index\r\n   admin-guide/index\r\n   the-project/index\r\n   the-project/contributing\r\n   reference/index\r\n\r\n* :ref:`genindex`\r\n\r\n\r\n.. toctree::\r\n   :maxdepth: 1\r\n   :caption: Common Tasks:\r\n\r\n   features/common-tasks\r\n\r\n---------------------\r\n\r\n\r\nGetting Started with STIG Manager\r\n======================================\r\n\r\n.. raw:: html\r\n\r\n  <iframe width=\"560\" height=\"315\" src=\"https://www.youtube.com/embed/wv_Gdbl_LrU\" title=\"YouTube video player\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen></iframe>\r\n\r\n------------------------\r\n\r\n.. raw:: html\r\n\r\n  <iframe width=\"560\" height=\"315\" src=\"https://www.youtube.com/embed/ZwVJ0eO2d_I\" title=\"YouTube video player\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen></iframe>\r\n\r\n-----------------------------------\r\n\r\nThese videos and others are available on our `YouTube channel. <https://www.youtube.com/channel/UC3kkvP64MRKsTaqcQQ8QA9A>`_\r\n\r\n---------------------------\r\n\r\n|\r\n\r\n\r\nReporting Bugs & Issues\r\n===================================\r\n\r\nPlease file bug reports or feature requests on the `STIG Manager \r\nissue tracker <https://github.com/NUWCDIVNPT/stig-manager/issues>`__. When reporting a bug, please provide as much detail as possible to help us understand and reproduce the issue. Include:\r\n\r\n-  Install type: Hosted, Local, Docker, etc\r\n-  Detailed steps to reproduce the issue\r\n-  Action taken\r\n-  Expected result\r\n-  Actual result\r\n-  Screenshots or logs (if relevant)\r\n-  Your environment details (OS, browser version, etc.)\r\n\r\nLicenses\r\n========================\r\n\r\nThe  repository is licensed under the `MIT License <https://github.com/NUWCDIVNPT/stig-manager/blob/main/LICENSE.md>`__, with the exception of the client, which is licensed under the `GNU GPL\r\nv3 <https://github.com/NUWCDIVNPT/stig-manager/blob/main/LICENSE.md>`__.\r\n\r\n"
  },
  {
    "path": "docs/installation-and-setup/authentication.rst",
    "content": ".. _authentication:\r\n\r\n\r\nAuthentication and Identity\r\n########################################\r\n\r\nThe API requires an OAuth2 JSON Web Token (JWT) that conforms to the OpenID Connect specification to determine client and user access. The STIG Manager OSS Project suggests the use of the **Authorization Code Flow with Proof Key for Code Exchange** (PKCE)​ flavor of OAuth 2.0​ for use with the project web application.  To support users that wish to develop their own utilities, we also suggest enabling the Device Authorization Grant Flow.\r\n\r\nSTIG Manager OSS has been tested to work with Keycloak, Okta, and AzureAD as OIDC providers.  It is expected to work with other OIDC providers if they can be configured to provide a token that meets the requirements specified below. Please create an Issue with details on our GitHub project if you experience issues with other providers.\r\n\r\n.. note::\r\n  If you are using the demonstration Keycloak container from the Project's Docker Hub page, you may not need to change any settings or variables described in this section. \r\n\r\n\r\n.. _jwt_requirements:\r\n\r\nJSON Web Token (JWT) Requirements\r\n----------------------------------\r\n\r\nThe JWT produced by the Identity Provider should provide the claims specified below. Some of them may have different names in your configuration, and can be specified in STIGMan's environment variables if they differ from the default values:\r\n    \r\n    * Username - ``STIGMAN_JWT_USERNAME_CLAIM`` - **default:** ``preferred_username``\r\n    * User Full Name - ``STIGMAN_JWT_NAME_CLAIM`` - (optional) **default:** ``name``\r\n    * User Email - ``STIGMAN_JWT_EMAIL_CLAIM`` - (optional) **default:** ``email``\r\n    * User Privileges - ``STIGMAN_JWT_PRIVILEGES_CLAIM`` - **default:** ``realm_access.roles``\r\n    * Scope - ``STIGMAN_JWT_SCOPE_CLAIM`` **default:** ``scope``. Some OIDC Providers (Okta, Azure Entra ID) use the claim ``scp`` to enumerate scopes.\r\n    * Assertion ID - ``STIGMAN_JWT_ASSERTION_CLAIM`` **default** ``jti``. Some OIDC Providers (ADFS, Azure Entra ID?) use the claim ``uti`` instead of ``jti`` to protect against replay attacks.\r\n    * Service Name - ``STIGMAN_JWT_SERVICENAME_CLAIM`` - **default:** ``clientId``. Used for service account clients.\r\n    * Audience - ``STIGMAN_JWT_AUD_VALUE`` - (optional) **no default**. If specified, the ``aud`` claim must include this value.\r\n\r\n.. important::\r\n   **Claim Value Formats**\r\n\r\n   The token values found at each claim location must use the following formats:\r\n\r\n   * **Username**, **Name**, **Email**, **Assertion ID**, **Service Name**: String\r\n   * **Scope**: A space-separated string per OAuth 2.0 RFC 6749 (e.g., ``\"openid stig-manager:collection stig-manager:stig:read\"``)\r\n   * **Privileges**: An array of strings (e.g., ``[\"admin\", \"create_collection\"]``) or ``null``. \r\n   * **Audience**: String or array of strings. If ``STIGMAN_JWT_AUD_VALUE`` is set, it must be present in the ``aud`` claim value.\r\n\r\n.. note::\r\n  STIG Manager will use the value specified in the ``STIGMAN_JWT_USERNAME_CLAIM`` environment variable as the Claim that should hold a users unique username. This value defaults to the Keycloak default, which is ``preferred_username``\r\n\r\n\r\n.. code-block:: JSON\r\n   :caption: The decoded data payload of a sample JWT, with some relevant claims highlighted.\r\n   :name: A Decoded JWT\r\n   :emphasize-lines: 18,19,20,40,42\r\n\r\n    {\r\n      \"exp\": 1695154418,\r\n      \"iat\": 1630360166,\r\n      \"auth_time\": 1630354418,\r\n      \"jti\": \"5b17970e-428a-4b54-a0bd-7ed29a436803\",\r\n      \"iss\": \"http://localhost:8080/auth/realms/stigman\",\r\n      \"aud\": [\r\n        \"realm-management\",\r\n        \"account\"\r\n      ],\r\n      \"sub\": \"eb965d15-aa78-43fc-a2a6-3d86258c1eec\",\r\n      \"typ\": \"Bearer\",\r\n      \"azp\": \"stig-manager\",\r\n      \"nonce\": \"2a6a0726-6795-47f5-88a6-00eb8aed9e23\",\r\n      \"session_state\": \"dca9233f-3d5b-4237-9e6e-be52d90cebdc\",\r\n      \"acr\": \"0\",\r\n      \"realm_access\": {\r\n        \"roles\": [\r\n          \"create_collection\",\r\n          \"admin\",\r\n          \"user\"\r\n        ]\r\n      },\r\n      \"resource_access\": {\r\n        \"realm-management\": {\r\n          \"roles\": [\r\n            \"view-users\",\r\n            \"query-groups\",\r\n            \"query-users\"\r\n          ]\r\n        },\r\n        \"account\": {\r\n          \"roles\": [\r\n            \"manage-account\",\r\n            \"manage-account-links\",\r\n            \"view-profile\"\r\n          ]\r\n        }\r\n      },\r\n      \"scope\": \"openid stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:op stig-manager:user stig-manager:stig\",\r\n      \"email_verified\": false,\r\n      \"preferred_username\": \"Jane Stigsdottir\"\r\n    }\r\n\r\n\r\nThe fields highlighted in the sample token above control the access and information STIG Manager requires to allow users to access the application.  The token your OIDC provider creates does not need to look exactly like this, but where it differs the relevant claims must be specified using STIG Manager Environment Variables. \r\n\r\n\r\nCross-Origin Resource Sharing (CORS)\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nIf your deployment environment has your OIDC Provider and the STIGMan Client in different origins (ie. domains), you will need to specify the Client origin in the Web Origins configuration options of your OIDC Provider. This will set the ``Access-Control-Allow-Origin`` header in the OIDC Provider's responses, and permit browsers to make subsequent requests to the OIDC provider.  \r\n\r\nAlternatively, you could situate your OIDC Provider and the Client server behind a reverse proxy that is configured to present them both as coming from the same origin, avoiding the problem. \r\n\r\n\r\n\r\nService Account Client Setup\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nIf you are using a service account to connect to the STIGMan API, the ``STIGMAN_JWT_SERVICENAME_CLAIM`` Environment Variable must specify the claim that will hold the client ID. The default is ``clientId``. There may be other OIDC Provider configuration required. \r\n\r\n\r\n.. _oidc-scopes:\r\n\r\nScopes, and Privileges\r\n---------------------------------\r\n\r\nThe STIG Manager API restricts endpoint access using the \"scope\" claims in the JWT. See the `API specification <https://github.com/NUWCDIVNPT/stig-manager/blob/main/api/source/specification/stig-manager.yaml>`_ for details. \r\n\r\nThe guide provided below maps scopes to various Realm Roles that are then assigned to Users. \r\nThese Roles and Scopes can be provided to users in various ways, using Client Roles, Client Groups, defaults, etc. Please refer to the `Keycloak Documentation <https://www.keycloak.org/documentation>`_ for more information. \r\n\r\nThe **Roles** specified in the JWT map to Privileges in STIG Manager that allow varying levels of access and abilities. See the :ref:`user-roles-privs` section of the Setup Guide for more information. \r\n\r\nThe **Scopes** specified in the JWT control access to API endpoints as specified in the OpenAPI spec.  See the :ref:`STIG Manager Client Scopes and Roles <oidc-scopes-table>` table below for a suggestion on how to allocate these scopes using OIDC roles, and more information. \r\n\r\nIf your OIDC Provider requires the STIG Manager Web App to request additional scopes when redirecting to the OIDC Provider, you can provide those as values to the envvar ``STIGMAN_CLIENT_EXTRA_SCOPES``. An example would be Okta, which requires the scope ``offline_access`` be requested in order to generate a refresh token.\r\n\r\n.. _keycloak:\r\n\r\nAuthentication Example - RedHat Keycloak 19\r\n-------------------------------------------------------\r\n\r\n.. note::\r\n  The Keycloak project updates frequently, and may introduce changes that will make this guide incompatible with later versions. The information provided below is just one way to configure Keycloak 19 to provide a JWT that will work with STIG Manager. Please make sure you configure Keycloak in accordance with your organization's Security Policy.\r\n\r\nThe web client is an OpenID Connect (OIDC) OAuth2 Relying Party and the API is an OAuth2 Resource Server. User authentication is provided by an external Identity Provider (IdP). All API access is controlled by OAUth2 JSON Web Tokens (JWTs) issued by the IdP. User privileges are extracted from token claims and endpoint access is controlled by token scope. \r\nKeycloak is readily available, actively maintained by a major OSS vendor, supports Identity Brokering and User Federation, and is used by major DoD projects such as Air Force Iron Bank.\r\nKeycloak supports many External Identity Providers, but has only been tested using its own authentication. \r\n`More information about RedHat Keycloak. <https://www.keycloak.org/documentation>`_\r\n\r\nA sample Docker-compose orchestration, using a Keycloak image configured as specified below and containing Demo users, can be found `on our Docker Hub page. <https://hub.docker.com/r/nuwcdivnpt/stig-manager>`_\r\n\r\nKeycloak 19 Configuration\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThe configuration offered below is just one way to create a Keycloak Realm that will authenticate Users for the STIGMan API and Client. The following items in the Keycloak installation must be created and configured appropriately, and their values passed to STIG Manager in the appropriate Environment Variable: \r\n\r\n* Keycloak Realm - suggested value: stigman\r\n* Client ID - suggested value: stig-manager\r\n\r\nKeycloak settings for the \"stigman\" realm:\r\n\r\n* Configure->Roles->Realm Roles - Add the following roles:\r\n\r\n  * user\r\n  * create_collection\r\n  * admin\r\n\r\n.. note::\r\n  These roles can also be set up at the Client level, rather than the Realm level. Make adjustments accordingly.\r\n\r\n* Configure->Roles->Default Roles - Recommended: set \"user\" and \"create_collection\" as default roles.   \r\n* Configure->Client Scopes - Create the following scopes, and assign them the specified roles in that scope's \"Scope\" tab (Role assignment only required if using Roles to assign scopes, rather than setting them as Default Client Scopes): \r\n\r\n.. _oidc-scopes-table:\r\n\r\n\r\n  .. list-table:: STIG Manager Client Scopes and Roles: \r\n   :widths: 20 70\r\n   :header-rows: 1\r\n   :class: tight-table\r\n\r\n   * - Client Scopes\r\n     - Roles\r\n   * - stig-manager:collection\r\n     - user, admin\r\n   * - stig-manager:collection:read\r\n     - user\r\n   * - stig-manager:op\r\n     - admin\r\n   * - stig-manager:op:read\r\n     - user\r\n   * - stig-manager:stig\r\n     - admin\r\n   * - stig-manager:stig:read\r\n     - user\r\n   * - stig-manager:user\r\n     - user, admin \r\n   * - stig-manager:user:read\r\n     - user\r\n   * - stig-manager\r\n     - Alternative catch-all scope for all roles above.\r\n\r\n* Configure->Clients->stig-manager:\r\n\r\n  * Settings:\r\n\r\n    * Enable Authorization Code Flow with PKCE (Called \"Standard Flow\" in Keycloak)\r\n    * Valid Redirect URIs - The URI at which your users will access STIG Manager\r\n    * Web Origins - Configure according to Organizational requirements. Often the same as the Valid Redirect URIs\r\n\r\n  * Client Scopes:\r\n\r\n    * Add the scopes created above as either Assigned Optional Client Scopes or Default Client Scopes.\r\n\r\n\r\nOther suggested Keycloak settings for the stig-manager client:\r\n\r\n  * Revoke refresh token: yes\r\n  * Refresh Token Max Reuse: 0\r\n  * Client or SSO Session Idle: 10 minutes\r\n  * The \"preferred_username\" claim in the token should hold the username you intend to be used in STIG Manager (this is the default setting). If changed, use ``STIGMAN_JWT_USER_CLAIM`` to specify.\r\n  * Set \"OAuth 2.0 Device Authorization Grant Enabled\" to \"On.\"\r\n\r\nFor other settings, the default Keycloak settings should work.\r\n\r\nConfigure STIG Manager to use your Authentication provider\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nMost commonly, STIG Manager will require the below Environment Variable to be specified, unless their default values are appropriate.  Check the :ref:`Environment Variables` document for an exhaustive list of Environment Variables and their default values.\r\n\r\n * ``STIGMAN_OIDC_PROVIDER`` - Sample value:  ``http://localhost:8080/auth/realms/stigman`` - The base URL of the OIDC provider issuing signed JWTs for the API.  The string ``/.well-known/openid-configuration`` will be appended when fetching metadata.\r\n * ``STIGMAN_CLIENT_OIDC_PROVIDER``  - Default value: Value of ``STIGMAN_OIDC_PROVIDER`` - Client override of the base URL of the OIDC provider issuing signed JWTs for the API.  The string ``/.well-known/openid-configuration`` will be appended by the client when fetching metadata.\r\n * ``STIGMAN_CLIENT_KEYCLOAK_CLIENTID`` - Suggested value: ``stig-manager``\r\n * ``STIGMAN_JWT_PRIVILEGES_CLAIM`` - Sample value: ``realm_access.roles``\r\n * ``STIGMAN_CLIENT_EXTRA_SCOPES`` - Sample value: ``offline_access`` \r\n\r\n\r\nA sample Keycloak image, recommended only for testing purposes, is available on `Docker Hub. <https://hub.docker.com/repository/docker/nuwcdivnpt/stig-manager-auth>`_ Most of the default values for the above Environment variables will work with this image. \r\n\r\n.. _stigman_client_reauth_action:\r\n\r\n``STIGMAN_CLIENT_REAUTH_ACTION``\r\n-------------------------------------------------------\r\n\r\nThe ``STIGMAN_CLIENT_REAUTH_ACTION`` environment variable controls how the STIG Manager web application responds when a user's credentials have expired and re-authentication is required. This setting determines **where** and **how** the OIDC (OpenID Connect) authorization flow is initiated for the user.\r\n\r\nPossible Values\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\n**popup** (default)  \r\n    Opens the OIDC authorization endpoint in a new browser popup window.\r\n\r\n**iframe**  \r\n    Opens the OIDC authorization endpoint in an embedded iframe within the app.\r\n\r\n**tab**  \r\n    Opens the OIDC authorization endpoint in a new browser tab.\r\n\r\n**reload**  \r\n    Reloads the current application tab, which will trigger the authentication redirect.\r\n\r\nComparison Table\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\n.. list-table:: STIGMAN_CLIENT_REAUTH_ACTION Options\r\n   :widths: 10 10 30 30\r\n   :header-rows: 1\r\n   :class: tight-table\r\n\r\n\r\n   * - Action\r\n     - UX\r\n     - Upsides\r\n     - Downsides\r\n   * - **popup**\r\n     - Good\r\n     - - Keeps the main application context intact. User can complete authentication without reloading the main app.\r\n       - Permitted natively by browsers, since the popup is opened by a user action.\r\n     - May be blocked by third-party browser popup blockers, requiring user intervention.  \r\n   * - **iframe**\r\n     - Best\r\n     - - No new browser windows or tabs, the main application remains loaded and visible.\r\n     - The OIDC Provider must allow being embedded in an iframe by setting an appropriate ``frame_ancestors`` directive in the Content-Security-Policy (CSP) header. See `frame_ancestors documentation on MDN <https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors>`_ 🔗\r\n   * - **tab**\r\n     - Acceptable  \r\n     - - Less likely to be blocked by third-party popup blockers compared to popups.\r\n       - Main application remains open in the original tab.\r\n     - User will be switched back to the original tab after authentication, which can be confusing if multiple tabs are open.\r\n   * - **reload**\r\n     - Poor\r\n     - - Compatible with all browsers and OIDC providers.  \r\n       - No issues with popup blockers or CSP.\r\n     - The application state is lost; any unsaved work will be discarded.  \r\n\r\n"
  },
  {
    "path": "docs/installation-and-setup/data-and-permissions.rst",
    "content": "\r\n.. _data-and-permissions:\r\n\r\nSTIG Manager API Data Representations and Permissions\r\n##########################################################################\r\n\r\n\r\n\r\n\r\nData Model\r\n====================================================\r\n\r\nSTIG Manager's primary organizational structure is the Collection. A Collection can be created to mirror components of an RMF Package, requirements identified in a Security Assessment Plan, or an entirely different principle that may be more convenient, such as by an organization's Lab or by Asset OS.\r\n\r\nCollections are composed of:\r\n  * Assets\r\n  * STIGs attached to those Assets\r\n  * Reviews of the Rules that compose each attached STIG\r\n  * Grants to Users or Groups providing access to some or all of the Assets/STIGs in that Collection\r\n  * Metrics providing Status and Findings counts for each Asset and STIG in the Collection\r\n\r\n\r\n\r\nMetadata\r\n---------------------------------------------\r\n\r\nCollections, Assets, and Reviews all support a JSON field called \"metadata\" for general use that can be used to enhance functionality and associate arbitrary data with those elements. The project is exploring best practices and uses for this feature. Third-party Clients that \"play nice\" with this field would be expected to preserve metadata already there unless they put it there, perhaps in a nested object with their client name as the Key.\r\n\r\nThe Project Clients and API make use of the following metadata keys. These keys are reserved for use by the STIG Manager project and should not be used by third-party Clients:\r\n\r\n* Collection Metadata:\r\n    - ``importOptions`` - Guidance for clients to follow when posting reviews for this collection that are NOT enforced by the API. See :ref:`import-options` for more information.\r\n* Asset Metadata\r\n    - ``cklWebOrDatabase`` - A boolean indicating whether the Asset is a Web or Database server. See :ref:`ckl-processing`\r\n    - ``cklHostName`` - The hostname of the Asset as it appears in a .ckl file. See :ref:`ckl-processing`\r\n    - ``cklWebDbSite`` - The Web or Database Site of the Asset as it appears in a .ckl file. See :ref:`ckl-processing`\r\n    - ``cklWebDbInstance`` - The Web or Database Instance of the Asset as it appears in a .ckl file. See :ref:`ckl-processing`\r\n* Review Metadata\r\n    - ``artifacts`` - Array of objects describing the artifacts attached to the review. Each item includes name, type, size, description, user, timestamp, and digest of the artifact content. \r\n    - ``<digest-specified-by-artifact-object>`` - Base64-encoded content of the artifact.\r\n\r\n.. note::\r\n   This usage of Review metadata for artifacts is experimental and subject to change or deprecation.  \r\n\r\n\r\nReference STIGs\r\n---------------------------------------------\r\n\r\nSTIG Manager uses a set of Reference STIGs that it makes available for assignment to Assets, tracks Rule evaluation, and against which it calculates all metrics. \r\nThese Reference STIGs must be imported and updated periodically as new STIGs are released or updates are made. It is responsibility of a User with the \"Application Management\" (ie. \"admin\") privilege to import these official STIGs and keep them updated. Usually, these STIGs are released by DISA on a quarterly schedule. \r\n\r\nWherever the content of a STIG is displayed (STIG Rules, Rule Titles, Rule Descriptions, Fix Texts, Severities, etc.) this data is drawn from the Reference STIG imported by the Application Manager. It is important to note the distinction here between STIG content and \"Review\" content, which is usually drawn from imported .ckl files or manual results inputted into STIG Manager by Reviewers. This \"Review\" content only affects the \"Review\" or \"Evaluation\" portion of the data displayed in STIG Manager. They cannot change Reference STIG content via .ckl imports. \r\n\r\n\r\n\"Checklists\" - .ckl/b and XCCDF \r\n---------------------------------------------\r\n\r\nAssets and the STIGs assigned to them are generally presented as Checklists, the lists of Rules and Checks that compose the assigned STIG, and the Reviews that satisfy those Rules. STIG Manager associates Reviews with specific content of Rules (Rule Version and Rule Check Content), independent of the STIGs that are assigned to Assets. This allows for different and more useful presentations of the data than when the Reviews are expressed in flat files, such as .ckl or XCCDF files. \r\n\r\nIt is important to note that STIG Manager does not retain the actual .ckl or XCCDF files that are imported into it in any way. The files are parsed for the information they contain, and that information is stored in the database. Manual edits via the UI and new imports all contribute to the current state of an Asset's reviews as presented by the UI and API. NEW .ckl/b or XCCDF files are generated on demand reflecting the current state of a Collections Assets, STIGs, and reviews. \r\nThis approach provides several advantages:\r\n\r\n- Reviews are associated with the specific content of a Rule (Rule Version and Rule Check Content).\r\n- Review attribution info, status, and metadata can be attached to each individual Review. \r\n- Checklists are generated using the **Reference** STIGs imported and maintained by the Application Manager. This alleviates issues with partial checklists, unauthorized overrides, etc.  \r\n\r\n\r\n\r\n\r\n.. _ckl-processing:\r\n\r\nProcessing .ckl Files \r\n________________________\r\n\r\nWhen the STIG Manager Client imports data from :term:`.ckl files <ckl>`, in the simplest case it will attempt to match (and, in some instances, create) the Asset specified in the .ckl's ``<HOST_NAME>`` element.  However, if the ``<ASSET><WEB_OR_DATABASE>`` element in the .ckl has a value of ``true``, special processing is invoked. This processing will attempt to match the ``<HOST_NAME>``, ``<WEB_DB_SITE>`` and ``<WEB_DB_INSTANCE>`` values in the .ckl with Asset metadata when identifying the Asset.  When the STIG Manager Client creates Assets from .ckls with these elements populated, it will populate the same Asset metadata according to the table below. \r\n\r\nConversely, when STIG Manager produces a .ckl file from an Asset that has the below metadata values set, it will populate the appropriate .ckl elements. \r\n\r\nThe following metadata properties are used when the value of ``<ASSET><WEB_OR_DATABASE>``  is ``true``:\r\n\r\n.. list-table:: **CKL elements map to STIG Manager Asset metadata**\r\n   :widths: 20 20 60\r\n   :header-rows: 1\r\n   :class: tight-table\r\n\r\n   * - ``<ASSET>`` Child Element\r\n     - Asset metadata\r\n     - Note\r\n   * - ``<WEB_OR_DATABASE>``\r\n     - ``cklWebOrDatabase``    \r\n     - When set to true, invokes additional processing using the below elements and metadata     \r\n   * - ``<HOST_NAME>``\r\n     - ``cklHostName``    \r\n     - This value will populate the ``<HOST_NAME>`` element of a ckl, as opposed to the Asset name in other cases.\r\n   * - ``<WEB_DB_SITE>``\r\n     - ``cklWebDbSite``\r\n     - No specific purpose for STIG Manager, other than contributing to Asset identification \r\n   * - ``<WEB_DB_INSTANCE>``\r\n     - ``cklWebDbInstance``          \r\n     - No specific purpose for STIG Manager, other than contributing to Asset identification \r\n\r\n   \r\nIf the importer needs to create an Asset, it will set this metadata and set the initial Asset name to ``<HOST_NAME>-[<WEB_DB_SITE> | \"NA\"]-[<WEB_DB_INSTANCE> | \"NA\"]``. The Asset name is not meaningful (to STIG Manager) and it can be changed by the user later, if required.\r\n\r\n\r\n.. thumbnail:: /assets/images/asset-metadata-and-ckl-elements.png\r\n      :width: 75% \r\n      :show_caption: True\r\n      :title: Corresponding Asset Metadata and .ckl elements\r\n\r\n\r\n|\r\n\r\n.. note::\r\n   See the :ref:`import-options` section of this document for information about STIG Manager's review import options.  \r\n\r\n\r\n|\r\n\r\nProcessing XCCDF Files\r\n__________________________________\r\n\r\nSTIG Manager supports serializing Reviews in XCCDF format with a STIG Manager namespace (``xmlns:sm=\"http://github.com/nuwcdivnpt/stig-manager\"``). Correct serialization was validated using `the official NIST validation tool <https://csrc.nist.gov/CSRC/media/Projects/Security-Content-Automation-Protocol/specifications/xccdf/1.2/xccdfval-1.2.0.zip>`_.\r\n\r\nThe XCCDF format is more expressive and extensible than the .ckl format, so additional data can be included.\r\nNot all tools will recognize elements making use of the STIG Manager namespace, but the files will still validate and test result information will be recognized. STIG Manager itself can re-import it's own XCCDF files and will understand the STIGMan namespace fields. \r\n\r\nSTIGMan serializes elements containing data that are STIGMan specific, as well as other elements required to express test results and stay in accordance with the NIST XCCDF specification:\r\n\r\n  - A STIGMan XCCDF file contains these elements and features:\r\n\r\n    - ``<Benchmark><metadata>``\r\n    - ``<Benchmark><Group>`` and required children\r\n    - ``<Benchmark><TestResult>`` and required children\r\n  - Identifies STIG Manager as the test system ``cpe:/a:nuwcdivnpt:stig-manager:[version]``\r\n  - Serializes STIG Manager Asset properties and metadata as children of ``<Benchmark><TestResult><target-facts>``\r\n    - Asset properties are described by ``<fact name=\"tag:stig-manager@users.noreply.github.com,2020:asset:[property]\" ``\r\n    - If an Asset metadata key begins with ``urn:``, the fact name is equal to the metadata key\r\n    - All other Asset metadata items are described by ``<fact name=\"tag:stig-manager@users.noreply.github.com,2020:asset:metadata:[key]\"``\r\n  - Serializes STIG Manager Review properties (detail, comment, resultEngine) as child elements under ``<Benchmark><TestResult><rule-result><check><check-content>``. Each child element is scoped to the STIG Manager namespace. The following elements are used:\r\n\r\n    - ``sm:detail``\r\n    - ``sm:comment``\r\n    - ``sm:resultEngine``\r\n\r\n      -  ``sm:type``\r\n      - ``sm:product``\r\n      - ``sm:version``\r\n      - ``sm:time``\r\n      - ``sm:checkContent``\r\n\r\n        - ``sm:location``\r\n        - ``sm:component``\r\n      - ``sm:overrides``\r\n\r\n        - ``sm:authority``\r\n        - ``sm:oldResult``\r\n        - ``sm:newResult``\r\n        - ``sm:remark``\r\n\r\n\r\n\r\n\r\nApplication Access\r\n=============================\r\n\r\n\r\nAPI Endpoints, Scopes, and Privilege Invocation\r\n------------------------------------------------------------------------\r\n\r\nOverall access to the STIG Manager application is controlled by the OIDC provider. \r\n\r\nSTIG Manager recognizes two \"privileges\" that can be granted to users via configuration in the OIDC provider. \r\n\r\nUsers with the **create_collection** privilege can create new Collections of their own, but are otherwise ordinary users. \r\n\r\nUsers with the **admin** privilege may explicitly invoke the ``elevate`` parameter in API requests to act as a privileged principal. The elevation mechanism is designed so that an admin user does not need a separate privileged account on the identity provider — the same account is used, and the user opts into elevated mode on a per-request basis.\r\n\r\nWhen a request includes ``?elevate=true``, it is governed by the elevation access model rather than by any Collection Grant the user may also hold. Elevation is scoped exclusively to Collection management and application administration operations:\r\n\r\n- Enumerate, create, and delete Collections\r\n- Read and modify a Collection's name and description\r\n- Create, modify, and delete Grants on any Collection, assigning any Role to any User or User Group (without supplying an ACL)\r\n- Manage Users and User Groups\r\n\r\nElevation does **not** grant access to collection content. An elevated admin cannot read or write Reviews, access Asset or STIG checklist data, or modify a Collection's settings, labels, metadata, or Grant ACLs — even with ``?elevate=true`` supplied. These operations require a Collection Grant and are performed via normal (non-elevated) requests.\r\n\r\nIn the reference UI, the ``elevate`` parameter is sent when \"Application Management\" functions are invoked, such as importing new Reference STIGs, listing all Collections, or creating a Grant in a Collection the admin does not otherwise have access to.\r\n\r\n.. note::\r\n   An elevated admin can create a Grant giving themselves any Role in any Collection. This is intentional: it avoids requiring admins who also need content access to maintain a second OIDC account. The accepted control is that **every elevated request — including self-grant operations — has its complete request and response bodies written to the application log**, regardless of whether the request succeeds. Administrators responsible for deploying STIG Manager should ensure elevated-request log entries are retained and reviewed.\r\n\r\nThese **privileges** must be present in the token presented to the API in order to be successfully invoked. \r\n\r\nAccess to specific endpoints is controlled by the **scopes** present in a user's token. The scopes granted to users can be configured in the OIDC provider. Certain user types may only need access to certain scopes. For example, an \"Application Manager\" type user might need access to the ``stig-manager:stig`` scope so that they can update the Reference STIGs in the app, but normal users might only need the ``stig-manager:stig:read`` scope, granting them read-only access to the Reference STIGs.  All configuration of this type is done in the OIDC provider. \r\n  \r\nSee our :ref:`Authentication and Identity <authentication>` documentation and our `API Specification <https://github.com/NUWCDIVNPT/stig-manager/blob/main/api/source/specification/stig-manager.yaml>`_ for more information about how these scopes and privileges interrelate. \r\n\r\n\r\n.. note::\r\n    An authorized user will not have access to Collection data until they have been assigned a Grant to one by a Collection Owner or Manager, or create a Collection themselves.\r\n    See :ref:`roles-and-access` for more information about how Grants are managed. \r\n\r\n\r\nDatabase Entity Relationship Diagrams\r\n===============================================\r\n\r\nThe following diagram may not always be up to date. Always refer to the implemented db structure as the authoritative source for this information. \r\n\r\n\r\n.. thumbnail:: /assets/images/eer-stigman.png\r\n      :width: 75% \r\n      :show_caption: True\r\n      :title: Entity Relationship Diagram representation of STIG Manager's MySQL data. \r\n\r\n`View the enlarged ERD Document here. <../_images/eer-stigman1.png>`_\r\n"
  },
  {
    "path": "docs/installation-and-setup/db.rst",
    "content": ".. _db:\r\n\r\n\r\nDatabase \r\n########################################\r\n\r\n\r\nThe STIGMan API was developed with a Controller-Service model that allows additional database services to be developed while using the same Controller code. However, the only database currently supported is MySQL.\r\n\r\n\r\nDatabase Requirements\r\n-----------------------------------\r\n\r\nThe STIG Manager API requires a dedicated MySQL database (equivalent to a schema in other RDBMS products). The API connects to MySQL with an account that must have a full grant to the dedicated database but does not require server administration privileges. On first bootstrap, all database tables, views, and static data will be created.\r\n\r\n\r\n.. _mySQL:\r\n\r\n\r\nDatabase - MySQL Latest 8.x\r\n-----------------------------\r\n\r\nThe STIG Manager API is tested with the latest 2 minor versions of the MySQL 8.0.x and 8.4.x series, and 8.0.24.\r\nWhile STIG Manager will bootstrap when provided with an 8.0.24+ MySQL database, it is strongly recommended you use the latest version of MySQL 8.4.x available.\r\n\r\nThe API requires knowledge of 1) the DB address/port, 2) which schema (database) is used for STIG Manager, and 3) User credentials with necessary privileges on that schema. `More information about MySQL. <https://dev.mysql.com/doc/>`_\r\n\r\n.. note::\r\n   The API includes a database migration function which tracks the database schema version and if necessary can automatically update the schema at launch. The initial run of the API scaffolds all database objects and static data.  Releases that require a database change will include a message in the release notes.\r\n\r\n\r\nConfigure MySQL\r\n~~~~~~~~~~~~~~~~~~~~\r\n\r\nExample commands to prepare MySQL for initial API execution:\r\n\r\n  * Create database: ``CREATE DATABASE stigman``\r\n  * Create API user account - ``CREATE USER 'stigman'@'%' IDENTIFIED BY 'new_password'``\r\n  * Grant API user account all privileges on created database ``GRANT ALL ON stigman.* TO 'stigman'``\r\n\r\n.. note::\r\n   Important MySQL configuration for optimal performance:\r\n    - ``innodb_buffer_pool_size`` - Set to at least 8GB (8589934592) for typical deployments, 16GB (17179869184) or more for larger deployments (>10,000 Assets) and those supporting many concurrent users. \r\n    - ``sort_buffer_size`` - Set to 16M (16777216).\r\n    - ``innodb_redo_log_capacity`` - Set to 1G (1073741824).\r\n    - ``tmp_table_size`` - Set to 256M (268435456).\r\n    - ``max_heap_table_size`` - Set to 256M (268435456).\r\n\r\n\r\nDetailed MySQL Privilege Requirements\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThe example above uses ``GRANT ALL ON stigman.*`` and assumes the user and db are both ``stigman`` for simplicity. ``GRANT ALL`` is suggested for easier maintenance, especially when new features are introduced that may require additional privileges. If you require more granular privilege assignment, the following privileges are required by STIG Manager for initial setup, migrations, and runtime operations:\r\n\r\n.. code-block:: sql\r\n\r\n   -- Data manipulation\r\n   GRANT SELECT, INSERT, UPDATE, DELETE ON stigman.* TO 'stigman'@'%';\r\n\r\n   -- DDL privileges\r\n   GRANT CREATE, DROP, ALTER ON stigman.* TO 'stigman'@'%';\r\n   GRANT INDEX ON stigman.* TO 'stigman'@'%';\r\n   GRANT REFERENCES ON stigman.* TO 'stigman'@'%';\r\n   GRANT CREATE VIEW ON stigman.* TO 'stigman'@'%';\r\n   GRANT LOCK TABLES ON stigman.* TO 'stigman'@'%';\r\n\r\n   -- Stored procedures \r\n   GRANT CREATE ROUTINE, ALTER ROUTINE ON stigman.* TO 'stigman'@'%';\r\n   GRANT EXECUTE ON stigman.* TO 'stigman'@'%';\r\n\r\n   -- Event scheduler \r\n   GRANT EVENT ON stigman.* TO 'stigman'@'%';\r\n\r\n   -- Temporary tables \r\n   GRANT CREATE TEMPORARY TABLES ON stigman.* TO 'stigman'@'%';\r\n\r\n   -- System schema read access (for introspection and monitoring)\r\n   GRANT SELECT ON performance_schema.* TO 'stigman'@'%';\r\n   -- Note: information_schema access is automatic and cannot be explicitly granted\r\n\r\n.. note::\r\n   The Jobs feature uses MySQL Events and Stored Procedures for scheduled task execution. The ``EVENT`` privilege is required to enable and manage the event scheduler. The event scheduler itself is usually enabled by default in MySQL 8.x. If needed, verify with ``SELECT @@global.event_scheduler;`` or enable with ``SET GLOBAL event_scheduler = ON;``\r\n\r\n\r\n\r\nConfigure STIG Manager to use your MySQL Database and User\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nSpecify your MySQL DB and User information with the following Environment Variables:\r\n\r\n * *STIGMAN_DB_HOST* - Default: localhost - The database hostname or IP from to the API server\r\n * *STIGMAN_DB_PORT* - Default: 3306 - The database TCP port relative to the API server\r\n * *STIGMAN_DB_USER* - Default: stigman - The user account used to login to the database\r\n * *STIGMAN_DB_SCHEMA* - Default: stigman - The schema where the STIG Manager object are found\r\n * *STIGMAN_DB_PASSWORD* - The database user password. Not required if configuring client certificate connection, as shown below.\r\n\r\n\r\nAdditional MySQL Connection Configuration Options\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nTLS Connection\r\n+++++++++++++++++++\r\n\r\nConfigure MySQL to use TLS by altering the ``/etc/mysql/conf.d/tls.cnf`` file, specifying the certificates it should use, and requiring TLS connections.\r\n\r\n.. code-block::\r\n  :caption: Sample Configuration\r\n\r\n  [mysqld]\r\n  ssl-ca=/etc/certs/ca.pem\r\n  ssl-cert=/etc/certs/server-cert.pem\r\n  ssl-key=/etc/certs/server-key.pem\r\n  require_secure_transport=ON\r\n\r\nPlace the certificates in the locations specified in the .cnf file. This sample tls.cnf file can be found in our `sample orchestration repo on GitHub <https://github.com/NUWCDIVNPT/stig-manager-docker-compose/blob/main/tls/mysql/tls.cnf>`_.\r\n\r\nThe STIG Manager API must be configured to establish TLS connections to the MySQL database. The following environment variable must be set:\r\n\r\n  * ``STIGMAN_DB_TLS_CA_FILE`` - An absolute path or a path relative to the API /tls directory that contains the PEM encoded CA certificate used to sign the database TLS certificate. Setting this variable enables TLS connections to the database. \r\n\r\n.. note::\r\n   For existing deployments using relative paths: Paths are resolved relative to the API /tls directory for backward compatibility. For new deployments: Absolute paths are recommended and align with the pattern used for server TLS and OIDC certificates. If using the STIG Manager API container, the CA certificate file must be mounted to the container at the specified path.\r\n\r\n\r\nAuthenticate with Client Certificate\r\n++++++++++++++++++++++++++++++++++++++\r\n\r\nTo authenticate to MySQL with a client certificate, the following environment variables must be set:\r\n\r\n  * *STIGMAN_DB_TLS_CERT_FILE* - An absolute path or a path relative to the API /tls directory that contains the PEM encoded Client certificate used when authenticating the database client.\r\n  * *STIGMAN_DB_TLS_KEY_FILE* - An absolute path or a path relative to the API /tls directory that contains the PEM encoded Client private key used when authenticating the database client.\r\n\r\n.. note::\r\n   For existing deployments using relative paths: Paths are resolved relative to the API /tls directory for backward compatibility. For new deployments: Absolute paths are recommended and align with the pattern used for server TLS and OIDC certificates. If using the STIG Manager API container, the client certificate and key files must be mounted to the container at the specified path.\r\n\r\nThe stigman API user must be altered in MySQL such that it is identified by the subject of the valid X.509 certificate it will use to authenticate. The following command, customized to suit your certificates, will accomplish this:\r\n``ALTER USER stigman@'%' IDENTIFIED BY '' REQUIRE SUBJECT '/C=US/ST=California/L=Santa Clara/CN=fake-client';``\r\n\r\n\r\n`A sample orchestration for STIG Manager configured for TLS to MySQL is available. <https://github.com/NUWCDIVNPT/stig-manager-docker-compose>`_ This sample orchestration uses self-signed certificates and should be used for testing purposes only.\r\n\r\n`More information about configuring MySQL to use encrypted connections. <https://dev.mysql.com/doc/refman/8.0/en/using-encrypted-connections.html>`_\r\n\r\n\r\n\r\n\r\n"
  },
  {
    "path": "docs/installation-and-setup/environment-variables.rst",
    "content": "\r\n.. _Environment Variables:\r\n\r\nEnvironment Variables\r\n=========================\r\n\r\nSTIG Manager is configured via its Environment Variables\r\n\r\n.. note::\r\n  Environment variables starting with ``STIGMAN_DEV_`` should generally not be changed from their default values in a production environment.\r\n\r\n\r\n.. csv-table:: STIG Manager Environment Variables\r\n  :file: envvars.csv\r\n  :widths: 20, 70, 10 \r\n  :header-rows: 1\r\n  :align: left\r\n  :class: tight-table\r\n\r\n\r\n\r\n\r\n.. csv-table:: Useful Node.js Environment Variables\r\n  :file: envvars-node.csv\r\n  :widths: 20, 70, 10 \r\n  :header-rows: 1\r\n  :align: left\r\n  :class: tight-table\r\n"
  },
  {
    "path": "docs/installation-and-setup/envvars-node.csv",
    "content": "\"Variable\",\"Description\",\"Affects\"\n\"NODE_EXTRA_CA_CERTS\",\"**[your CA certificate file path]**  Set this Node.js environment variable to direct Node to accept CA certificates you have provided, in addition to its built-in CA certs. This is an alternative method to specify additional CAs to trust when connecting to the OIDC Provider endpoints over https.\",\"Node.js, API\"\n"
  },
  {
    "path": "docs/installation-and-setup/envvars.csv",
    "content": "\"Variable\",\"Description\",\"Affects\"\n\"STIGMAN_API_ADDRESS\",\"| **Default** ``0.0.0.0``\n| The IP address on which the the API server will listen \",\"API\"\n\"STIGMAN_API_MAX_JSON_BODY\",\"| **Default** ``5242880``\n| The maximum size in bytes of the request body when Content-Type is application/json\",\"API\"\n\"STIGMAN_API_MAX_UPLOAD\",\"| **Default** ``1073741824``\n| The maximum size in bytes of the file uploaded with Content-Type multipart/form-data\",\"API\"\n\"STIGMAN_API_PORT\",\"| **Default** ``54000``\n| The TCP port on which the server will listen \",\"API\"\n\"STIGMAN_API_TLS_CERT_FILE\",\"| **No default**\n| A absolute path to the file that contains the PEM encoded Server certificate used for TLS. Additionally requires setting ``STIGMAN_API_TLS_KEY_FILE`` to enable TLS.\",\"API\"\n\"STIGMAN_API_TLS_KEY_FILE\",\"| **No default**\n| A absolute path to the file that contains the PEM encoded Server private key used for TLS. Additionally requires setting ``STIGMAN_API_TLS_CERT_FILE`` to enable TLS.\",\"API\"\n\"STIGMAN_API_TLS_KEY_PASSPHRASE\",\"| **No default**\n| If necessary, the passphrase that decrypts the PEM encoded Server private key used for TLS. Additionally requires setting ``STIGMAN_API_TLS_CERT_FILE`` to enable TLS.\",\"API\"\n\"STIGMAN_CLASSIFICATION\",\"| **Default** ``U``\n| Sets the classification banner, if any. Available values: ``NONE`` ``U`` ``CUI`` ``C`` ``S`` ``TS`` ``SCI`` \",\"API, Client\"\n\"STIGMAN_CLIENT_ADMIN_TIMEOUT\",\"| **Default** ``0``\n| The maximum time (in minutes) a user with admin privileges can be inactive in the web client before discarding their access token and requiring reauthorization. Activity is defined as mouse click, keypress, or scrolling in any tab or window of a same-origin browsing context group. Set to zero to disable idle detection.\",\"Client\"\n\"STIGMAN_CLIENT_API_BASE\",\"| **Default** ``api``\n| The base URL for Client requests to the API relative to ``window.location`` \",\"Client\"\n\"STIGMAN_CLIENT_CONSOLE_MODE\",\"| **Default** ``production``\n| The console mode of the web client, setting to ``development`` enables console logging which is otherwise disabled\",\"Client\"\n\"STIGMAN_CLIENT_DIRECTORY\",\"| **Default** ``./clients``\n| The location of the web client files, relative to the API source directory. Note that if running source from a clone of the GitHub repository, the client is located at `../../clients` relative to the API directory. \",\"API, Client\"\n\"STIGMAN_CLIENT_DISABLED\",\"| **Default** ``false``\n| Whether to *not* serve the reference web client\",\"Client\"\n\"STIGMAN_CLIENT_DISPLAY_APPMANAGERS\",\"| **Default** ``true``\n| Whether to display application managers the home page of web client\",\"Client\"\n\"STIGMAN_CLIENT_EXTRA_SCOPES\",\"| **No default**\n| A space separated list of OAuth2 scopes to request in addition to ``stig-manager:stig`` ``stig-manager:stig:read`` ``stig-manager:collection`` ``stig-manager:user`` ``stig-manager:user:read`` ``stig-manager:op``. Some OIDC providers (Okta) generate a refresh token only if the scope ``offline_access`` is requested\",\"Client\"\n\"STIGMAN_CLIENT_ID\",\"| **Default** ``stig-manager``\n| The OIDC clientId of the web client\",\"Client\"\n\"STIGMAN_CLIENT_OIDC_PROVIDER\",\"| **Default** Value of ``STIGMAN_OIDC_PROVIDER``\n| Client override of the base URL of the OIDC provider issuing signed JWTs for the API.  The string ``/.well-known/openid-configuration`` will be appended by the client when fetching metadata.\",\"Client \"\n\"STIGMAN_CLIENT_REAUTH_ACTION\",\"| **Default** ``popup``\n| How to prompt for re-authentication when user credentials expire. Available values: ``popup``, ``iframe``, ``tab``, or ``reload``. See :ref:`stigman_client_reauth_action` in the Authentication document for details.\",\"Client\"\n\"STIGMAN_CLIENT_RESPONSE_MODE\",\"| **Default** ``fragment``\n| The response_mode the web client should specify when requesting an authorization code from the OIDC provider. Available values: ``fragment``, ``query`` \",\"Client\"\n\"STIGMAN_CLIENT_SCOPE_PREFIX\",\"| **No default**\n| String used as a prefix for each scope when authenticating to the OIDC Provider. Some providers (Azure AD) expect scope requests in the format ``api://<application_id>/<scope>``, where ``api://<application_id>/`` is the required prefix.\",\"Client\"\n\"STIGMAN_CLIENT_STATE_EVENTS\",\"| **Default** ``true``\n| Whether the web client listens for server sent events (SSE) about the API state. Should only be disabled temporarily while resolving buffering issues on a reverse proxy.\",\"Client\"\n\"STIGMAN_CLIENT_STRICT_PKCE\",\"| **Default** ``true``\n| Whether the web client verifies the OIDC provider is advertising PKCE/S256 support in compliance with RFC 8414. A non-compliant provider supports PKCE/S256 without advertising it. Independent of this value, the web client always exclusively uses PKCE/S256 in the Authorization Code Flow.\",\"Client\"\n\"STIGMAN_CLIENT_USER_TIMEOUT\",\"| **Default** ``0``\n| The maximum time (in minutes) a regular user can be inactive in the web client before discarding their access token and requiring reauthorization. Activity is defined as mouse click, keypress, or scrolling in any tab or window of a same-origin browsing context group. Set to zero to disable idle detection.\",\"Client\"\n\"STIGMAN_CLIENT_WELCOME_IMAGE \",\"| **No default**\n| The URL of an image hosted elsewhere that will be rendered in the Home tab Welcome widget. The STIGMan app does not serve the image itself, only the reference to it. The URL should be in relation to and accessible from the client's browser. The image will be scaled to a max width or height of 125 pixels - If no alternate image is specified, the seal of the Department of the Navy (the project sponsor)  will be displayed. \",\"Client Appearance\"\n\"STIGMAN_CLIENT_WELCOME_LINK\",\"| **No default**\n| Value of an optional link that will follow the Welcome message in the Home tab Welcome widget. \",\"Client Appearance\"\n\"STIGMAN_CLIENT_WELCOME_MESSAGE \",\"| **No default**\n| Text that will be displayed in the Home tab Welcome widget.\",\"Client Appearance\"\n\"STIGMAN_CLIENT_WELCOME_TITLE \",\"| **Default** ``Support``\n| The tile that will be displayed for the custom Home tab Welcome message.\",\"Client Appearance\"\n\"STIGMAN_DB_HOST\",\"| **Default** ``localhost``\n| The database hostname or IP from to the API server\",\"API\"\n\"STIGMAN_DB_MAX_CONNECTIONS\",\"| **Default** ``25``\n| The maximum size of the database connection pool \",\"API\"\n\"STIGMAN_DB_PASSWORD\",\"| **No default**\n| The password used to login to the database \",\"API\"\n\"STIGMAN_DB_PORT\",\"| **Default** ``3306``\n| The database TCP port relative to the API server\",\"API\"\n\"STIGMAN_DB_SCHEMA\",\"| **Default** ``stigman``\n| The schema where the STIG Manager object are found\",\"API\"\n\"STIGMAN_DB_TLS_CA_FILE\",\"| **No default**\n| An absolute path or a path relative to the API /tls directory that contains the PEM encoded CA certificate used to sign the database TLS certificate. Setting this variable enables TLS connections to the database.\",\"API\"\n\"STIGMAN_DB_TLS_CERT_FILE\",\"| **No default**\n| An absolute path or a path relative to the API /tls directory that contains the PEM encoded Client certificate used when authenticating the database client. Additionally requires setting values for ``STIGMAN_DB_TLS_CA_FILE`` and ``STIGMAN_DB_TLS_KEY_FILE``. \",\"API\"\n\"STIGMAN_DB_TLS_KEY_FILE\",\"| **No default**\n| An absolute path or a path relative to the API /tls directory that contains the PEM encoded Client private key used when authenticating the database client. Additionally requires setting values for ``STIGMAN_DB_TLS_CA_FILE`` and ``STIGMAN_DB_TLS_CERT_FILE``.\",\"API\"\n\"STIGMAN_DB_USER\",\"| **Default** ``stigman``\n| The user account used to login to the database \",\"API\"\n\"STIGMAN_DEPENDENCY_RETRIES\",\"| **Default** ``24``\n| During startup, the number of attempts made to establish connections to the database and OIDC Provider. Retries are made every 5 seconds and the API process exits if unsuccessful.\",\"API\"\n\"STIGMAN_DEV_ALLOW_INSECURE_TOKENS\",\"| **Default** ``false``\n| Controls whether known insecure JWT signing keys are allowed. Only for development/testing purposes. Setting to 'true' is NOT recommended for production environments. \",\"API\"\n\"STIGMAN_DEV_LOG_OPT_STATS\",\"| **Default** ``true``\n| Controls whether the API will track API operation statistics used for populating ``Requests`` portion of ``/op/appinfo`` response body. Setting to 'false' is NOT recommended for production environments, as this info can be useful for troubleshooting. \",\"API\"\n\"STIGMAN_DEV_RESPONSE_VALIDATION\",\"| **Default** ``none``\n| Controls whether the API will perform response validation on API responses. If set to 'logOnly' the API will output log entries indicating deviations from the OAS specification. Intended for development/testing purposes. Available values: ``none``, ``logOnly`` \",\"API\"\n\"STIGMAN_DOCS_DIRECTORY\",\"| **Default** ``./docs``\n| The location of the documentation files, relative to the API source directory. Note that if running source from a clone of the GitHub repository, the docs are located at `../../docs/_build/html` relative to the API directory. \",\"API, Documentation\"\n\"STIGMAN_DOCS_DISABLED\",\"| **Default** ``false``\n| Whether to *not* serve the project Documentation.  NOTE: If you choose to serve the Client from the API container but not the Documentation, the links do the Docs on the home page will not work. \",\"Documentation\"\n\"STIGMAN_EXPERIMENTAL_APPDATA\",\"| **Default**  ``false``\n| Set to ``true`` to enable the experimental AppData import/export API endpoints and User Interface. \",\"API, Client\"\n\"STIGMAN_EXPERIMENTAL_LOGSTREAM\",\"| **Default**  ``true``\n| Set to ``false`` to disable the experimental WebSocket for streaming API logs and the corresponding User Interface. \",\"API, Client\"\n\"STIGMAN_LOG_LEVEL\",\"| **Default** ``3``\n| Controls the granularity of the generated log output, from 1 to 4. Each level is inclusive of the ones before it. Level 1 will log only errors, level 2 includes warnings, level 3 includes status and transaction logs, and level 4 includes debug-level logs\",\"API\"\n\"STIGMAN_LOG_MODE\",\"| **Default** ``combined``\n| Controls whether the logs will create one “combined” log entry for http requests that includes both the request and response information; or two separate log entries, one for the request and one for the response, that can be correlated via a generated Request GUID in each entry\",\"API\"\n\"STIGMAN_JWKS_CACHE_MAX_AGE\",\"| **Default** ``10``\n| The time in minutes after which the API's cache of JWT signing keys is deemed stale and the API becomes unavailable. Cache refreshes are scheduled at intervals of half this value and also occur when an unknown signing key is presented. Scheduled refresh failures are retried every 10 seconds.\",\"API\"\n\"STIGMAN_JWT_ASSERTION_CLAIM\",\"| **Default** ``jti``\n| The access token claim whose value is the OIDC provider's Assertion ID. Updates to this value trigger the API to update a User's ``lastClaims`` property. The claim MUST NOT be nested and MUST be a valid ECMAScript identifier. See :ref:`jwt_requirements` for token value format requirements.\",\"API\"\n\"STIGMAN_JWT_AUD_VALUE\",\"| **No default**\n| If present, a string which must be included in the access token ``aud`` claim for requests to endpoints requiring authorization. See :ref:`jwt_requirements` for token value format requirements.\",\"API\"\n\"STIGMAN_JWT_EMAIL_CLAIM\",\"| **Default** ``email``\n| The access token claim whose value is the user's email address. The claim MUST NOT be nested and MUST be a valid ECMAScript identifier. See :ref:`jwt_requirements` for token value format requirements.\",\"API, Client\"\n\"STIGMAN_JWT_NAME_CLAIM\",\"| **Default** ``name``\n| The access token claim whose value is the user's full name. The claim MUST NOT be nested and MUST be a valid ECMAScript identifier. See :ref:`jwt_requirements` for token value format requirements.\",\"API, Client\"\n\"STIGMAN_JWT_PRIVILEGES_CLAIM\",\"| **Default** ``realm_access.roles``\n| The access token claim whose value is the user's privileges. The claim MAY be nested but SHOULD avoid invalid ECMAScript identifiers. See :ref:`jwt_requirements` for token value format requirements.\",\"API, Client\"\n\"STIGMAN_JWT_SCOPE_CLAIM\",\"| **Default** ``scope``\n| The access token claim whose value is the user's scopes. Some OIDC Providers (Okta, Azure AD) use the claim ``scp`` to enumerate scopes. The claim MUST NOT be nested and MUST be a valid ECMAScript identifier. See :ref:`jwt_requirements` for token value format requirements.\",\"API, Client\"\n\"STIGMAN_JWT_SERVICENAME_CLAIM\",\"| **Default** ``clientId``\n| The access token claim whose value is the service account's client. The claim MUST NOT be nested and MUST be a valid ECMAScript identifier. See :ref:`jwt_requirements` for token value format requirements.\",\"API, Client\"\n\"STIGMAN_JWT_USERNAME_CLAIM\",\"| **Default** ``preferred_username``\n| The access token claim whose value is the user's username. The claim MUST NOT be nested and MUST be a valid ECMAScript identifier. See :ref:`jwt_requirements` for token value format requirements.\",\"API, Client\"\n\"STIGMAN_OIDC_CA_CERTS\",\"| **No default**\n| The full path to a file with one or more PEM-encoded CA certificates for validating TLS connections to the OIDC Provider.\",\"API\"\n\"STIGMAN_OIDC_PROVIDER\",\"| **Default** ``http://localhost:8080/auth/realms/stigman``\n| The base URL of the OIDC provider issuing signed JWTs for the API.  The string ``/.well-known/openid-configuration`` will be appended when fetching metadata.\",\"API, Client\"\n\"STIGMAN_SWAGGER_ENABLED\",\"| **Default** ``false``\n| Whether to enable the SwaggerUI SPA at /api-docs \",\"API\"\n\"STIGMAN_SWAGGER_OIDC_PROVIDER\",\"| **Default** Value of ``STIGMAN_OIDC_PROVIDER``\n| SwaggerUI override of the base URL of the OIDC provider issuing signed JWTs for the API.  The string ``/.well-known/openid-configuration`` will be appended by the SwaggerUI when fetching metadata.\",\"API\"\n\"STIGMAN_SWAGGER_REDIRECT\",\"| **Default** ``http://localhost:54000/api-docs/oauth2-redirect.html``\n| The redirect URL sent by SwaggerUI to the OIDC provider when authorizing\",\"API\"\n\"STIGMAN_SWAGGER_SERVER\",\"| **Default** ``http://localhost:54000/api``\n| The API server URL relative to the SwaggerUI \",\"API\"\n"
  },
  {
    "path": "docs/installation-and-setup/index.rst",
    "content": "\r\n.. _installation-and-setup-index:\r\n\r\nSetup and Deployment\r\n===============================\r\n\r\n.. meta::\r\n  :description: These pages describe how to use STIG Manager.\r\n\r\nThese pages describe how to deploy STIG Manager.\r\n\r\n.. note:\r\n   This section is still under development.\r\n\r\n\r\n.. toctree::\r\n\t:maxdepth: 2\r\n\t:numbered: 4\r\n\t:caption: Contents:\r\n\r\n\tinstallation-and-setup\r\n\tauthentication\r\n\tdb\r\n\tlogging\r\n\treverse-proxy\r\n\tdata-and-permissions\r\n\tenvironment-variables\r\n\tsecuring\r\n\r\n"
  },
  {
    "path": "docs/installation-and-setup/installation-and-setup.rst",
    "content": "\r\n.. _installation-and-setup:\r\n\r\nSTIG Manager OSS Setup and Technical Information\r\n##########################################################\r\n\r\nThe STIG Manager open-source project provides an API and Web Client designed for deployment in various environments - from single laptop demonstrations to enterprise-level orchestrations. While containerization is recommended for security, scalability, and maintenance benefits, the application supports multiple deployment methods to meet diverse organizational requirements.\r\n\r\n.. note::\r\n  All deployments require integration with deployer-provided infrastructure services. This document provides configuration guidance while respecting that deployers will have varying needs and requirements for their specific implementations.\r\n\r\n\r\nArchitecture & Core Components\r\n===============================\r\n\r\n.. thumbnail:: /assets/images/stigman-components-basic.svg\r\n  :width: 50%\r\n  :show_caption: True\r\n  :title: Component Diagram\r\n\r\n\r\n\r\nRequired Components\r\n-------------------\r\n\r\nEvery STIG Manager deployment consists of:\r\n\r\n**STIG Manager API** (Core Component, provided by the STIGMan project)\r\n  - RESTful API on Node.js LTS with Express framework\r\n  - Stateless service exposing a single HTTP port\r\n  - Handles all application logic and data operations\r\n  - No persistent storage - all data flows to MySQL\r\n\r\n**Web Client** (User Interface, provided by the STIGMan project)\r\n  - Single Page Application using ExtJS 3.4\r\n  - Served as static content from the API container\r\n  - Provides interactive access for users\r\n\r\n**OpenID Connect (OIDC) Provider** (Authentication Service, deployer-provided)\r\n  - Manages user accounts and authentication\r\n  - Issues OAuth2 JWT tokens for API access\r\n  - Tested providers: Red Hat Keycloak, Okta, F5, Azure Entra\r\n  - Must support Authorization Code Flow with PKCE for web clients\r\n\r\n**MySQL Database** (Data Persistence, deployer-provided)\r\n  - Stores all application data\r\n  - Supports TLS and mutual TLS authentication\r\n  - Version 8.4+ recommended for optimal performance\r\n  - Deployer responsible for backups and security\r\n\r\n.. important::\r\n  STIG Manager provides only the API and Web Client. All other components (OIDC Provider, MySQL, reverse proxy) must be provisioned and configured according to your organizational requirements and security policies.\r\n\r\nRecommended Infrastructure\r\n-------------------------------------------\r\n\r\n**Reverse Proxy/Load Balancer** (Recommended, deployer-provided)\r\n  - Required for mTLS/CAC/PKI client certificate authentication\r\n  - May be required by environmental or security policies\r\n  - Must support streaming responses and Server-Sent Events (SSE)\r\n  - Examples: nginx, Apache, HAProxy, Kubernetes Ingress\r\n  - Note: STIG Manager supports native TLS - reverse proxy not required for basic HTTPS\r\n\r\n**Container Orchestration** (Recommended Deployment Method, deployer-provided)\r\n  - Docker, Kubernetes, OpenShift, or similar\r\n  - Enables scalability and high availability\r\n  - Simplifies updates and rollbacks\r\n  - Sample orchestrations available for reference\r\n\r\n\r\nCritical Configuration Requirements\r\n====================================\r\n\r\nBefore deploying STIG Manager, ensure your infrastructure meets these essential requirements:\r\n\r\nDatabase Configuration\r\n----------------------\r\n\r\nMySQL 8.0+ is required with proper configuration for performance and security.\r\n\r\n**Key Requirements:**\r\n  - Dedicated database/schema with appropriate grants\r\n  - Buffer pool sized for your deployment (8GB minimum)\r\n  - TLS support for secure connections\r\n  - Regular backup strategy\r\n\r\n:ref:`MySQL setup and configuration <mySQL>`\r\n\r\nAuthentication (OIDC) Configuration\r\n------------------------------------\r\n\r\nSTIG Manager requires an OpenID Connect provider for authentication and authorization.\r\n\r\n**Key Requirements:**\r\n  - Support for Authorization Code Flow with PKCE\r\n  - Proper JWT claims configuration (username, privileges, scopes)\r\n  - CORS configuration if OIDC and API are on different domains\r\n  - User privilege mapping (admin, create_collection, user roles)\r\n\r\n:ref:`Authentication setup and JWT requirements <authentication>`\r\n\r\nTLS and Proxy Configuration\r\n---------------------------\r\n\r\n.. important::\r\n  The STIG Manager Web Client requires a secure context (HTTPS) to function. For non-localhost connections, you must configure either native TLS or deploy behind a reverse proxy providing HTTPS. Localhost connections (127.0.0.1, ::1) can use HTTP.\r\n\r\nSTIG Manager supports native TLS connections configured via environment variables. A reverse proxy is only required for mTLS/CAC authentication or when mandated by environmental requirements.\r\n\r\n**Native TLS:**\r\n  - Configure HTTPS directly using environment variables\r\n  - No reverse proxy needed for basic TLS encryption\r\n  - See :ref:`Environment Variables` beginning with ``STIGMAN_API_TLS_*`` for TLS configuration options\r\n\r\n**Reverse Proxy (when required):**\r\n  - Required for mTLS/CAC/PKI client certificate authentication\r\n  - Must support streaming responses and Server-Sent Events (SSE)\r\n  - Must handle unbuffered responses for specific endpoints\r\n  - See :ref:`Proxy configuration <reverse-proxy>` for details\r\n\r\nAdditional Suggested Configuration\r\n=======================================\r\n\r\nCustomize Welcome Message and Logo\r\n-----------------------------------\r\n\r\nThe Welcome Message and Image can be customized with environment variables to present additional information or guidance to users upon login. These variables all begin with ``STIGMAN_CLIENT_WELCOME_``. See the :ref:`Environment Variables` reference for more information.\r\n\r\n.. thumbnail:: /assets/images/welcome-message-customizable-elements.png\r\n  :width: 25%\r\n  :show_caption: True \r\n  :title: Welcome Message Customizable Elements\r\n\r\nAdd Extra CA Certificates\r\n------------------------------------------------\r\n\r\nIf your deployment requires trusting additional Certificate Authorities (CAs) beyond those built into Node.js, you can provide these via a file. You might do this if the API is connecting to an OIDC Provider using https. You can set these specifically for STIG Manager by using the ``STIGMAN_OIDC_CA_CERTS`` environment variable to point to a file containing the additional CA certificates in PEM format. See :ref:`Environment Variables` for TLS configuration options.\r\n\r\nAlternatively, set the ``NODE_EXTRA_CA_CERTS=file-path`` Node.js environment variable to direct Node itself to accept CA certificates you have provided, in addition to its built-in CA certs.  If using containers and an external CA file, ensure this file is mounted into the container at that path.\r\n\r\n\r\nIron Bank images include DoD certificates at: ``/etc/pki/ca-trust/source/anchors/Certificates_PKCS7_v5.7_DoD.pem``\r\nCheck the `Node.js documentation for more information. <https://nodejs.org/api/cli.html#cli_node_extra_ca_certs_file>`_\r\n\r\n\r\nLogging and Monitoring\r\n----------------------\r\n\r\nSTIG Manager outputs structured JSON logs to STDOUT for collection by your logging infrastructure.\r\n\r\n:ref:`Logging reference <logging>`\r\n\r\nSecurity Hardening\r\n------------------\r\n\r\nFor deployments requiring compliance with security frameworks:\r\n\r\n**Key Areas:**\r\n  - Container security and image scanning\r\n  - ASD STIG compliance considerations\r\n  - Data flow and access control validation\r\n  - TLS configuration for all components\r\n\r\n:ref:`Security and assessment guidance <securing>`\r\n\r\n\r\nEssential Environment Variables\r\n----------------------------------\r\n\r\nSTIG Manager is configured via :ref:`Environment Variables <Environment Variables>`\r\n passed to the API container or process.  At minimum, configure:\r\n\r\n**Database Connection:**\r\n  - ``STIGMAN_DB_HOST`` - MySQL server address\r\n  - ``STIGMAN_DB_PORT`` - MySQL port (default: 3306)\r\n  - ``STIGMAN_DB_USER`` - Database username\r\n  - ``STIGMAN_DB_PASSWORD`` (unless using TLS for authentication)\r\n  - ``STIGMAN_DB_TLS_CA_FILE`` - CA certificate file for TLS connection to DB\r\n  - ``STIGMAN_DB_TLS_CERT_FILE`` (unless using password for authentication)\r\n  - ``STIGMAN_DB_TLS_KEY_FILE`` (unless using password for authentication)\r\n\r\n**OIDC Integration:**\r\n  - ``STIGMAN_OIDC_PROVIDER`` - OIDC discovery URL for API\r\n  - ``STIGMAN_CLIENT_OIDC_PROVIDER`` - OIDC URL for Web Client (if different)\r\n\r\n**API Configuration:**\r\n  - ``STIGMAN_API_ADDRESS`` - API bind address\r\n  - ``STIGMAN_API_PORT`` - API port (default: 54000)\r\n  - ``STIGMAN_CLASSIFICATION`` - System classification banner\r\n\r\n:ref:`Complete environment variables reference <Environment Variables>`\r\n\r\nSample Orchestrations\r\n---------------------\r\n\r\nThe project provides reference implementations demonstrating these configurations:\r\n\r\n- `Docker Hub Quick Start <https://hub.docker.com/r/nuwcdivnpt/stig-manager>`_ - Basic orchestration with Keycloak and MySQL\r\n- `CAC Authentication Sample <https://github.com/NUWCDIVNPT/stigman-orchestration>`_ - Full setup with nginx proxy and CAC support\r\n\r\n\r\nDeployment Scenarios\r\n====================\r\n\r\nChoose a deployment method based on your infrastructure and requirements:\r\n\r\n.. _deploy-docker-compose:\r\n\r\nQuick Start with Docker Compose\r\n--------------------------------\r\n\r\nFor demonstration or development environments, use our `Docker Hub Quick Start <https://hub.docker.com/r/nuwcdivnpt/stig-manager>`_ orchestration.\r\n\r\n**Includes:** STIG Manager API, Web Client, Keycloak, MySQL\r\n\r\n**Requirements:** Docker and Docker Compose\r\n\r\n.. _deploy-docker-compose-CAC:\r\n\r\nCAC Authentication Deployment\r\n------------------------------\r\n\r\nFor deployments requiring CAC/PKI authentication, see the `STIGMan Orchestration repository <https://github.com/NUWCDIVNPT/stigman-orchestration>`_.\r\n\r\n**Includes:** Full stack with nginx proxy configured for CAC\r\n\r\n**Requirements:** Docker Compose, PKI certificates\r\n\r\n.. _deploy-container:\r\n\r\nIndividual Container Deployment\r\n--------------------------------\r\n\r\nDeploy STIG Manager using Docker or any container runtime. Suitable for Kubernetes, OpenShift, or standalone Docker hosts.\r\n\r\n**Requirements:**\r\n\r\n  - Container runtime (Docker, Podman, etc.)\r\n  - Configured OIDC Provider and MySQL database\r\n  - Network connectivity between components\r\n\r\n**Basic Steps:**\r\n\r\n#. Pull the image: ``docker pull nuwcdivnpt/stig-manager:latest-ironbank``\r\n#. Configure environment variables for your infrastructure\r\n#. Run the container:\r\n\r\n   .. code-block:: bash\r\n\r\n      docker run --name stig-manager -d \\\r\n      -p 54000:54000 \\\r\n      -e STIGMAN_DB_HOST=<DATABASE_IP> \\\r\n      -e STIGMAN_OIDC_PROVIDER=<OIDC_URL> \\\r\n      nuwcdivnpt/stig-manager\r\n\r\n#. Verify startup in logs: ``docker logs stig-manager``\r\n\r\nSee :ref:`keycloak` and :ref:`mySQL` for detailed component setup.\r\n\r\n\r\n.. _deploy-from-source:\r\n\r\nDeployment from Source Code\r\n----------------------------\r\n\r\nRun STIG Manager directly from source code using Node.js. Suitable for development or non-containerized environments.\r\n\r\n**Requirements:**\r\n\r\n- Node.js LTS\r\n- Configured OIDC Provider and MySQL\r\n- Git (recommended)\r\n\r\n**Basic Steps:**\r\n\r\n#. Clone repository: ``git clone https://github.com/NUWCDIVNPT/stig-manager.git``\r\n#. Navigate to ``/api/source``\r\n#. Install dependencies: ``npm ci``\r\n#. Set environment variables\r\n#. Start application: ``node index.js``\r\n\r\n.. tip::\r\n  Use a process manager like `PM2 <https://github.com/Unitech/pm2>`_ for production deployments from source.\r\n\r\n.. _deploy-with-binaries:\r\n\r\nDeployment with Precompiled Binaries\r\n-------------------------------------\r\n\r\nDeploy using precompiled executables without requiring Node.js runtime.\r\n\r\n**Requirements:**\r\n\r\n- Platform-specific binary from `releases <https://github.com/NUWCDIVNPT/stig-manager/releases>`_\r\n- Configured OIDC Provider and MySQL\r\n\r\n**Basic Steps:**\r\n\r\n#. Download binary for your platform\r\n#. Set environment variables\r\n#. Run the executable\r\n\r\n.. tip::\r\n  Use a process manager for production deployments.\r\n\r\n\r\nUpdating STIG Manager\r\n---------------------\r\n\r\nUpdates are straightforward due to the stateless API design:\r\n\r\n#. Deploy the new version with the same configuration\r\n#. The API will automatically handle any database migrations\r\n#. Check release notes for migration warnings on large datasets\r\n\r\n.. warning::\r\n  Downgrading requires database restoration from a backup. Always backup before updates.\r\n\r\n\r\n\r\n\r\nFirst Steps\r\n==============\r\n\r\n.. index::\r\n   single: Add Users\r\n\r\n.. _Adding Users:\r\n.. _Add Users:\r\n.. _user-roles-privs:\r\n\r\nConfigure Users\r\n--------------------------\r\n\r\nUsers are not created in the STIG Manager application itself. All users must be created and authenticated by your Authentication Provider (often, Keycloak), which must provide the appropriate tokens, scopes, and privileges before they can access the system. Upon first access after successful Authentication, STIGMan will create a user profile to which it assigns Collection Grants and assignments. \r\n\r\nUser privileges are controlled by the OIDC Provider. This can be done by configuring the OIDC provider to generate tokens for Users that include their privileges and scopes in the specified claims (``STIGMAN_JWT_PRIVILEGES_CLAIM`` and ``STIGMAN_JWT_SCOPE_CLAIM``).  In most OIDC Providers, this can be done in multiple ways, depending on your use case.  One option for Keycloak is using the \"Role Mappings\" tab for that user, or you can set these privileges as defaults using the Configure->Roles->Default Roles interface.  See the :ref:`Authentication and Identity<authentication>` section for more information. \r\n\r\nAssign at least one User the ``admin`` privilege when setting up STIG Manager for the first time. \r\n\r\n.. list-table:: STIG Manager User Types, STIG Manager Privileges, and possible Keycloak Roles: \r\n  :widths: 20 60 20\r\n  :header-rows: 1\r\n  :class: tight-table\r\n\r\n  * - User Type\r\n    - Privileges\r\n    - Keycloak Roles\r\n  * - Administrator User\r\n    - Access STIG Manager, Manage Collections, Import STIGs, Manage Users, Import/Export App data\r\n    - admin, user\r\n  * - Collection Creator User\r\n    - Access STIG Manager, Create Collections\r\n    - user, create_collection\r\n  * - User\r\n    - Access STIG Manager\r\n    - user\r\n\r\n.. note::\r\n   All Users must be explicitly granted access to Collections in order to see the Assets, STIGs, and Evaluations contained therein. Administrators can grant themselves or others access to any Collection. \r\n\r\nIt is recommended that most users should be \"Collection Creator Users\"(ie. assigned the \"create_collection\" privilege).  Collection Creator Users can create and manage their own collections, as well as be assigned grants from other users.\r\n\r\nSTIG Manager will automatically create its own user associations for Collection grants once an authenticated user accesses the system. User Privileges (ie. \"admin\" and/or \"create_collection\") are visible in the User administrative tab, but must be managed in the Authentication Provider. Specific Grants to Collections and Assets/STIGs are managed in the STIG Manager app.\r\n\r\n\r\nImport STIGs\r\n------------------\r\n\r\nUp until this point, the setup has concerned the actual operational deployment of the app.  For this function, and additional functions of the App, STIG Manager Users are required.  See the :term:`User` for more information on their different roles and privileges. \r\n\r\n#. Download the latest `quarterly STIG Library Compilations from DISA <https://public.cyber.mil/stigs/compilations/>`_ and import it into STIG Manager. \r\n\r\n#. Log in to STIG Manager using an Administrator user to import STIGs. For information on how to do this, and other STIG Manager Admin functions, see the :ref:`stig-import` portion of the :ref:`admin-quickstart`. \r\n\r\n\r\nFor additional information about getting started with STIG Manager, see the :ref:`Admin Walkthrough <admin-quickstart>`."
  },
  {
    "path": "docs/installation-and-setup/logging.rst",
    "content": ".. _logging:\r\n\r\n\r\nLogging \r\n########################################\r\n\r\n\r\nSTIG Manager streams structured JSON logging objects to standard output (STDOUT). \r\nYou should capture and persist these logging objects in accordance with your Organizational requirements. \r\n\r\n\r\nLogging schemas\r\n---------------\r\n\r\nThe full JSON Schema (Draft 07) definition of our logging objects is available here. This documentation is organized to describe each \r\nlogging component separately and presents the relevant sub-schemas.\r\n\r\nCommon\r\n------\r\n\r\n.. tabs::\r\n\r\n  .. code-tab:: json\r\n\r\n    {\r\n      \"$schema\": \"https://json-schema.org/draft-07/schema\",\r\n      \"$id\": \"http://yourdomain.com/schemas/myschema.json\",\r\n      \"type\": \"object\",\r\n      \"properties\": {\r\n        \"date\": {\r\n          \"type\": \"string\",\r\n          \"format\": \"date-time\"\r\n        },\r\n        \"level\": {\r\n          \"type\": \"integer\",\r\n          \"minimum\": 1,\r\n          \"maximum\": 4\r\n        },\r\n        \"component\": {\r\n          \"type\": \"string\",\r\n          \"enum\": [\r\n            \"index\",\r\n            \"initData\",\r\n            \"oidc\",\r\n            \"mysql\",\r\n            \"static\",\r\n            \"rest\",\r\n            \"logger\"\r\n          ]\r\n        },\r\n        \"type\": {\r\n          \"type\": \"string\"\r\n        },\r\n        \"data\": {\r\n          \"type\": \"object\"\r\n        }\r\n      },\r\n      \"required\": [\r\n        \"date\",\r\n        \"level\",\r\n        \"component\",\r\n        \"type\",\r\n        \"data\"\r\n      ],\r\n      \"additionalProperties\": false\r\n    }\r\n\r\n  .. code-tab:: yaml\r\n\r\n    \"$schema\": https://json-schema.org/draft-07/schema\r\n    \"$id\": http://yourdomain.com/schemas/myschema.json\r\n    type: object\r\n    properties:\r\n      date:\r\n        type: string\r\n        format: date-time\r\n      level:\r\n        type: integer\r\n        minimum: 1\r\n        maximum: 4\r\n      component:\r\n        type: string\r\n        enum:\r\n        - index\r\n        - initData\r\n        - oidc\r\n        - mysql\r\n        - static\r\n        - rest\r\n        - logger\r\n      type:\r\n        type: string\r\n      data:\r\n        type: object\r\n    required:\r\n    - date\r\n    - level\r\n    - component\r\n    - type\r\n    - data\r\n    additionalProperties: false\r\n\r\n\r\n\r\n\r\nThe ``data`` object is extensible and will contain structured details concerning the event. \r\n\r\nThe contents of the logs can be controlled with the following :ref:`Environment Variables`: \r\n\r\nSTIGMAN_LOG_LEVEL\r\n    - Default: ``3``\r\n    - Controls the granularity of the generated log output, from 1 to 4. Each level is inclusive of the ones before it. Level 1 will log only errors, level 2 includes warnings, level 3 includes status and transaction logs, and level 4 includes debug-level logs. \r\n\r\nSTIGMAN_LOG_MODE\r\n    - Default: ``combined``\r\n    - Controls whether the API will create one \"combined\" log entry for http requests that includes both the request and response information; or two separate log entries, one for the request and one for the response, that can be correlated via a generated Request GUID in each entry.  Any value other than \"combined\" will produce separate log entries. \r\n\r\n\r\n"
  },
  {
    "path": "docs/installation-and-setup/reverse-proxy.rst",
    "content": ".. _reverse-proxy:\r\n\r\n\r\nDeploy with Reverse Proxy\r\n########################################\r\n\r\n\r\n\r\nReverse Proxy or Kubernetes Ingress Controller for mTLS/CAC Authentication\r\n-----------------------------------------------------------------------------------------\r\n\r\nSTIG Manager supports native TLS connections without requiring a reverse proxy. You can configure HTTPS directly in the application using environment variables. See the :ref:`Environment Variables` beginning with ``STIGMAN_API_TLS_*`` in the documentation for details on enabling native TLS.\r\n\r\nA reverse proxy or Kubernetes Ingress Controller is still required for:\r\n\r\n- **mTLS (Mutual TLS)** for client certificate authentication (ie. CAC/PIV)\r\n- **Environmental requirements** such as centralized TLS termination, load balancing, or security policies\r\n- **Additional proxy features** like request filtering, rate limiting, or advanced routing\r\n\r\nIf you need a reverse proxy, configure it (such as nginx) or your Kubernetes Ingress Controller in accordance with publisher documentation, local security requirements, and OIDC Provider (eg. Keycloak) documentation.\r\n\r\n**Keycloak Configuration for Reverse Proxy Environments:**\r\n\r\n- **Keycloak 26+**: Set ``KC_PROXY_HEADERS=xforwarded`` and ``KC_HTTP_ENABLED=true`` (if TLS terminates at proxy)\r\n- Ensure your proxy forwards appropriate headers (X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Host)\r\n\r\n\r\nThe STIG Manager OSS team provides a repository on GitHub with a sample nginx deployment, with a configuration file that may be useful to those setting up a Production deployment:\r\n\r\n\r\nhttps://github.com/NUWCDIVNPT/stigman-orchestration\r\n\r\n\r\n------------------------------------------\r\n\r\n.. thumbnail:: /assets/images/component-diagram.svg\r\n  :width: 50%\r\n  :show_caption: True \r\n  :title: Component Diagram with Reverse Proxy\r\n\r\n---------------------------\r\n\r\n.. thumbnail:: /assets/images/k8-component-diagram.svg\r\n  :width: 50%\r\n  :show_caption: True \r\n  :title: Component Diagram with Kubernetes\r\n\r\n\r\n\r\nProxy Configuration \r\n--------------------------------------------------------------\r\n\r\nProxy configuration will vary greatly depending on your environment, desired network structure, and choice of reverse proxy software. Below are some general guidelines and considerations when configuring your reverse proxy for use with STIG Manager.\r\n\r\n\r\nMax Request Body Size\r\n________________________________________________________\r\n\r\n\r\nSome proxies such as nginx may have default limits on request body size that are quite small (e.g. 5MB). You will likely need to increase this limit using the appropriate directive (e.g. ``client_max_body_size 100M;`` in nginx). A 100MB limit is a reasonable starting point.\r\n\r\n\r\nProxy Requirements for Streaming, SSE, and WebSocket Endpoints\r\n________________________________________________________________________________\r\n\r\n\r\n.. important::\r\n\r\n   STIG Manager uses streaming responses, Server-Sent Events (SSE), and WebSocket connections for real-time operations. These may require specific proxy configuration to function properly.\r\n\r\nFor proper operation of streaming, SSE, and WebSocket endpoints, your proxy must:\r\n\r\n1. **Disable response buffering** for streaming endpoints\r\n2. **Pass through streaming headers** without modification\r\n3. **Maintain persistent connections** for SSE and WebSocket endpoints\r\n4. **Support HTTP connection upgrade** for WebSocket endpoints\r\n\r\nThe application automatically sets the ``x-accel-buffering: no`` header which nginx (and Azure Application Gateway) honors by default to disable buffering. Other proxies may require explicit configuration.\r\n\r\n.. warning::\r\n\r\n   If your proxy is configured to:\r\n\r\n   - Override or ignore response headers\r\n   - Force buffering on all responses\r\n   - Have aggressive timeout settings for long-lived connections\r\n\r\n   You MUST adjust your proxy configuration to exempt the endpoints listed below.\r\n\r\nEssential Streaming Endpoints\r\n________________________________________________________\r\n\r\nThe following endpoints require unbuffered, real-time response streaming:\r\n\r\n**Streaming Responses (NDJSON):**\r\n\r\n  - ``POST /collections/{collectionId}/export-to/{dstCollectionId}``\r\n\r\n    - Content-Type: ``application/x-ndjson``\r\n    - Operation: Collection export with progress updates\r\n    - API operationId: ``exportToCollection``\r\n\r\n  - ``POST /collections/{collectionId}/clone``\r\n\r\n    - Content-Type: ``application/x-ndjson``\r\n    - Operation: Collection cloning with progress updates\r\n    - API operationId: ``cloneCollection``\r\n\r\n**Server-Sent Events (SSE):**\r\n\r\n  - ``GET /op/state/sse``\r\n\r\n    - Content-Type: ``text/event-stream``\r\n    - Operation: Real-time operation state updates\r\n    - API operationId: ``streamStateSse``\r\n\r\n**WebSocket Connection:**\r\n\r\n  - ``GET <origin>/socket/log-socket``\r\n\r\n    - Requires HTTP connection upgrade to WebSocket protocol\r\n    - Operation: Real-time log streaming over WebSocket\r\n\r\n\r\nProxy-Specific Configuration Examples\r\n________________________________________________________\r\n\r\n\r\nWhile specific configuration varies by proxy, here are the key settings to verify:\r\n\r\n**nginx:**\r\n  - Honors ``x-accel-buffering: no`` header automatically (no configuration needed)\r\n  - Ensure ``proxy_buffering`` is not forced to ``on`` globally\r\n  - Add support for WebSockets in ``stigman`` location block::\r\n\r\n      proxy_http_version      1.1;\r\n      proxy_set_header        Upgrade $http_upgrade;\r\n      proxy_set_header        Connection \"upgrade\";\r\n      proxy_set_header        Host $host;\r\n      proxy_read_timeout      3600s;  # Also affects SSE connections\r\n\r\n**Apache (mod_proxy_http):**\r\n  - Basic ``ProxyPass`` with HTTP backends typically works for SSE\r\n  - Use ``ProxyPreserveHost On`` for proper host header forwarding\r\n  - If issues occur, may need to adjust Keep-Alive or timeout settings for SSE endpoints\r\n\r\n**HAProxy:**\r\n  - Typically works without modification\r\n  - Verify ``timeout server`` and ``timeout client`` for long connections\r\n\r\n**Other Proxies:**\r\n  - Most modern proxies automatically detect and handle SSE (Content-Type: text/event-stream)\r\n  - Consult proxy documentation for buffering and timeout configuration if issues occur\r\n\r\nVerifying Proper Configuration\r\n________________________________________________________\r\n\r\n\r\n**Test SSE Endpoint:**\r\n\r\nAfter deployment, test the SSE endpoint to verify proper streaming::\r\n\r\n  curl -N http://<api-url>/op/state/sse\r\n\r\nOr open in a browser::\r\n\r\n  http://<api-url>/op/state/sse\r\n\r\n**Expected behavior:**\r\n  - Immediate initial response (within 1-2 seconds)\r\n  - Periodic keepalive events every 30 seconds\r\n  - No long delay before first response\r\n\r\n**If issues occur:**\r\n  - Long delay before any response → Proxy is buffering\r\n  - Connection drops after timeout → Timeout settings too aggressive\r\n  - No events received → Headers being stripped or modified\r\n\r\nTroubleshooting Option\r\n________________________________________________________\r\n\r\nIf you experience persistent buffering issues that cannot be resolved through proxy configuration, STIG Manager provides an environment variable to temporarily disable SSE functionality:\r\n  ``STIGMAN_CLIENT_STATE_EVENTS=false``\r\n\r\nThis disables the web client's SSE listening for API state events. This should only be used temporarily while resolving proxy buffering issues, as it disables real-time operation monitoring.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n"
  },
  {
    "path": "docs/installation-and-setup/securing.rst",
    "content": ".. _securing:\n\n\nSecuring and Assessing STIG Manager Deployments\n##########################################################\n\n.. warning::\n  You must secure and assess your deployments in compliance with your individual or organizational security requirements. The discussions below are educational. Encouragement to do things a particular way does not constitute advice that overrides your specific requirements.\n\n\nThe STIG Manager application can be orchestrated several ways, each with unique security requirements and goals. We know many deployments must comply with the Application Security and Development STIG - commonly known as the ASD. Therefore we have organized this section around ASD requirements, to provide guidance for those tasked with securing and assessing STIG-compliant STIG Manager deployments.\n\n.. note::\n  The ASD assesses many application components, and application governance, using a single checklist of 286 checks (as of V5R1).  Unfortunately, the current ASD provides limited guidance if you're using modern security technologies such as Single Sign On, OpenID Connect, OAuth2 authorization, and containerization. If you are required to complete an ASD assessment, we encourage focusing on the spirit of the checklist until it is updated or re-imagined.\n\nSecuring Your Deployment\n========================\n\nThese are some common security topics to review when designing a secure STIG Manager application deployment.\n\nContainer Security\n------------------\n\nWe strongly encourage STIG Manager deployments to be containerized. Containerization has built-in security advantages such as immutability, image signing, transparency, modularity, small attack surface, secure updates, and environment parity. The content of container images and their runtime behavior require security evaluations, as in traditional deployments, but provide the advantage of image layer inheritance.\n\n.. note::\n  If you are subject to ASD-compliance you are likely subject to other DoD requirements. We encourage an in-depth familiarity with the `Container Image Creation and Deployment Guide <https://dl.dod.cyber.mil/wp-content/uploads/devsecops/pdf/DevSecOps_Enterprise_Container_Image_Creation_and_Deployment_Guide_2.6-Public-Release.pdf>`_ from DISA. The STIG Manager Project adheres to DISA image creation guidance when defining and building container images, and we encourage STIG Manager deployments to follow the container deployment guidance.\n\nImage Choices\n~~~~~~~~~~~~~~~~~~~~~~~~\n\nMany deployments might directly orchestrate `one of our images published on Docker Hub <https://hub.docker.com/r/nuwcdivnpt/stig-manager>`_. For most ASD-compliant deployments, you may want to deploy one of our `images offered on Iron Bank. <https://ironbank.dso.mil/repomap/details;registry1Path=opensource%252Fstig-manager%252Fstig-manager?page=1&sort=0&order=1&cardsPerPage=3>`_  Our Iron Bank images are built from the Iron Bank Nodejs-slim images, hardened images with reduced surface area that are based on the Iron Bank Alpine Linux Image.  To use Iron Bank Images, you will need an account at https://ironbank.dso.mil/.\n\nSome deployments might prefer a custom container image of STIG Manager created by `modifying the Dockerfile from our repo <https://github.com/NUWCDIVNPT/stig-manager/blob/main/Dockerfile>`_ or basing their custom image on one of our published images. In these cases, we strongly encourage use of the relevant Iron Bank base images. \n\nIf you need to understand how a container image was built, we encourage familiarity with the `docker history` command.\n\n\nVulnerability Scanning\n~~~~~~~~~~~~~~~~~~~~~~\n\nWe encourage all deployments to perform vulnerability scanning of our published container images and source code. The Project makes use of automated tools such as GitHub Dependabot, Docker Scout, and Iron Bank scan reports to respond to any vulnerability issues.  Iron Bank makes their scan result artifacts `available on the STIG Manager page on Iron Bank. <https://ironbank.dso.mil/repomap/details;registry1Path=opensource%252Fstig-manager%252Fstig-manager?page=1&sort=0&order=1&cardsPerPage=3>`_\n\nOrganizations should consider deploying their own container registry with embedded image scanning. Choices include the open-source Harbor registry with built-in Clair testing, and cloud-based offerings from Amazon, Azure and Google.\n\nValidating Image Signatures\n~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nThe Project signs each image we publish to Docker Hub using Docker Content Trust (DCT). Images on Iron Bank are `automatically signed by that platform. <https://docs-ironbank.dso.mil/tutorials/cosign/>`_ \n\n.. note::\n  For secure DCT image verification, you should understand trust-pinning. The default \"Trust On First Use\" (TOFU) behavior of the docker CE client may not be appropriate for your security requirements. Our `root.json <https://github.com/NUWCDIVNPT/stig-manager/blob/main/root.json>`_ file will be helpful if you wish to pin trust on our signing key.\n\n\nData Flow\n---------\n\nSeveral ASD checks refer to SOAP, WS-Security and SAML, early protocols for implementing and securing online APIs. None of the checks refer to REST or OIDC/OAuth2, modern alternatives that are commonly used in cloud-ready software such as STIG Manager. The checks that address SOAP, etc. state that if you aren't using those technologies, the assessment is 'not applicable'.\n\n.. note::\n  The discussion below assumes the reader has prerequisite knowledge of REST principles, `OAuth2 flows as defined in RFC 6749 <https://datatracker.ietf.org/doc/html/rfc6749>`_ and the `Open ID Connect Core 1.0 specification <https://openid.net/developers/specs/>`_\n\n.. thumbnail:: /assets/images/data-flow-01b.svg\n  :width: 75%\n  :show_caption: True \n  :title: Data Flow Diagram\n\n|\n\nREST and OpenAPI Specification (OAS)\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nThe STIG Manager API and Web Client exchange data across a REST architecture that enforces the STIG Manager `OAS definition <https://github.com/NUWCDIVNPT/stig-manager/blob/main/api/source/specification/stig-manager.yaml>`_.\n\nAccess to individual endpoints is controlled by the OAuth2 ``scope`` claims listed in each endpoint's ``security.oauth`` property in the OAS. Oauth2 is discussed further below.\n\nDiscretionary Access Control (DAC) and Role Based Access Control (RBAC)\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nThe API grants or denies access to STIG Manager data objects (Collections, Assets, Asset/STIG maps, and Reviews) based on the the OAuth2 ``username`` claim (or configured equivalent). The username value indexes into the internal STIG Manager DAC system which includes per-Collection RBAC lists (i.e, Collection Grants and Restricted User Access Lists).\n\nCorrect implementation of the STIG Manager data flow, especially the DAC and RBAC logic, is verified by an `automated workflow <https://github.com/NUWCDIVNPT/stig-manager/blob/main/.github/workflows/>`_ that is performed when any change to the codebase is proposed (a Pull Request or PR). Over 2000 assertions are evaluated using `tests you can review here. <https://github.com/NUWCDIVNPT/stig-manager/tree/main/test/api>`_ These tests are run against every commit to the release branch to evaluate all features of the API and actively try to cross defined access boundaries to test our DAC and RBAC implementations. \n\nOpenID Connect (OIDC) and OAuth2\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nThe claims described in the sections above are contained in OAuth2 JWT formatted access_tokens issued by an OIDC Provider to remote clients, such as the Project's Web Client and the STIG Manager Watcher bot.\n\nThe Web Client on startup redirects users to the OIDC Provider to authenticate and obtain an access token that defines the scope of API access the user grants that client. For most ASD-compliant deployments, the connection to the OIDC Provider's authorization_endpoint will use MTLS and CAC PKI.\n\n.. note::\n  Communication between the API and clients include the access_token and should occur using TLS but do not require Mutual TLS (MTLS). \n\nThe Web Client is a single-page application (SPA) that executes entirely in the browser. Browsers are low- to zero-trust environments where OAuth2 access tokens should have short lifetimes to mitigate the risk of token diversion. Just what is considered 'short' is for you (or your organization) to decide, but 15 minutes or even less is not uncommon.\n\nThe Web Client will not engage in an OIDC implicit flow. The OIDC Provider must provide tokens using the OIDC Authorization Code Flow with Proof Key for Code Exchange (PKCE). To work with bots such as STIG Manager Watcher, the OIDC Provider should also support the client_credentials flow with Signed JWT authentication.\n\nIf your OIDC Provider issues refresh tokens (encouraged for a better user experience), those tokens usually have longer lifetimes than the access_token but should be rotated and limited to a single use. Policies vary greatly, but refresh token lifetime is sometimes correlated to the SSO session lifetime. Attempts to reuse a refresh_token should be logged by the OIDC Provider and generate alerts.\n\nUser Sessions\n-------------\n\n.. note::\n  The discussion below assumes the reader has knowledge of their specific OIDC Provider and any user federation or identity brokering features it is configured to use.\n\nSeveral ASD checks address the management of user login sessions. It is important to understand how your OIDC Provider controls user sessions, performs user management, and audits its activities.\n\nDatabase\n--------\n\n.. note::\n  The discussion below assumes the reader has prerequisite knowledge of MySQL and how to perform PKI user authentication (if required), secure data storage, and secure data backups.\n\nSeveral ASD checks address the management of data storage. It is important to understand how to configure MySQL in accordance with local security requirements, such as the Oracle MySQL 8.0 STIG. Ideally, your organization will provision MySQL instances from a hardened cloud subscription that requires a smaller set of customer-responsible security settings.\n\nLogging and Analysis\n-----------------------\n\nMany ASD checks specify requirements for how application log entries should collected, aggregated, managed, audited, and analysed. The STIG Manager application role in this is simple: it outputs all its log entries to STDOUT.  These log entries must be captured and retained in accordance with your log retention policy.  The developers of the STIG Manager API component have made efforts to ensure that the logs the application emits conform to requirements specified in the ASD where appropriate. However, there are several other components of a successful deployment that will produce logs that may also require management by your logging solution, such as the OIDC Provider, Database, and Container Platform.  \n\nTransport Layer Security\n---------------------------\n\nThe ASD specifies the use of TLS-secured connections to the application. STIG Manager supports native TLS connections that can be configured using environment variables (see :ref:`Environment Variables` beginning with ``STIGMAN_API_TLS_*``).\n\nA reverse proxy is still required to meet ASD requirements for mTLS authentication with DoD Common Access Cards (CAC) or client certificate authentication. The reverse proxy should be configured to handle TLS client certificate authentication and forward appropriate headers to the application. See :ref:`Deploy with Reverse Proxy <reverse-proxy>` for detailed configuration guidance.\n\nSecurity Updates, Advisories, and Policies\n---------------------------------------------\n\nThe ASD requires application deployment representatives to be aware of application updates, advisories, processes, and policies.  The project's Security Policy and Security Advisories can be found on the `Security page of our GitHub site. <https://github.com/NUWCDIVNPT/stig-manager/security>`_  We encourage you to acquaint yourself with our published Security Policy, subscribe for notifications of new releases, and report any vulnerabilities you may find on your own in a responsible way. \n\n\nAssessing Your Deployment\n=============================\n\nThe documentation and artifacts provided here are intended to help teams that are deploying STIG Manager in an environment that is subject to the Application Security and Development STIG.  Below, you can find a summary and STIG information, `including a .ckl <https://github.com/NUWCDIVNPT/stig-manager/blob/main/docs/STIG-Manager-OSS.ckl>`_, relevant to this effort. \n\nWhere applicable, we have self-evaluated portions of the ASD **as if** we were developer members of a deployed application's team. For most deployments, though, we are NOT part of your team and therefore the checks covering development practices might be properly evaluated as not applicable. Even in this case, however, we hope our self-evaluation provides useful insight into how the Project integrates security into our practice.\n\nAPI and Web Client\n------------------\n\nAbout a third of the checks in the ASD assess application components provided by this Project - the API and Web Client. These checks assess both their behavior and how they are developed. All other checks are dependent on specific deployment configurations, but we have provided some guidance where we can.\n\n\n.. warning::\n  You must evaluate your deployment independently in accordance with your individual security requirements. Our self-evaluation CANNOT and DOES NOT represent a valid assessment of your deployment!\n\n\nIt is always possible to configure your deployment into an insecure state. \nThe provided assessments may not apply to the way you have configured your deployment! They are to be used only as a guide or as reference for your own assessments.  In general, we have followed this convention when providing assessments:\n\n  - Reviews are marked **Not a Finding** if they are considered by the STIGMan team to be compliant with the ASD by nature of the design and practices executed by the developers. \n\n  - Reviews are marked **Not Applicable** only if the project design meets conditions provided in rule guidance. It is always possible that your deployment configuration makes that particular STIG check \"applicable.\"\n\n  - Reviews marked **Informational** or **Not Reviewed** may have useful details to be used as reference for assessments but cannot be satisfied by the project application alone. \n\nThe results displayed in the table below are also available as a `.ckl file in our GitHub repo <https://github.com/NUWCDIVNPT/stig-manager/blob/main/docs/STIG-Manager-OSS.ckl>`_, suitable for importing into STIG Manager. \n\n\n.. csv-table:: Application Security and Development STIG Self Assessment\n  :file: stigman-asd-full.csv\n  :widths: 10, 25, 10, 25 \n  :header-rows: 1\n  :stub-columns: 1\n  :align: left\n  :class: tight-table\n\n\n\n\n"
  },
  {
    "path": "docs/installation-and-setup/stigman-asd-full.csv",
    "content": "Vuln,Title,result,Detail\nV-222387,\"The application must provide a capability to limit the number of logon sessions per user.\",\"Informational \",\"The User Session layer, including concurrent session handling, is implemented by an external OpenID Connect (OIDC) Provider that issues OAuth2 tokens.\"\nV-222388,\"The application must clear temporary storage and cookies when the session is terminated.\",\"Not a Finding \",\"The Web Client does not persist storage of any user information, including OAuth2 tokens.\"\nV-222389,\"The application must automatically terminate the non-privileged user session and log off non-privileged users after a 15 minute idle time period has elapsed.\",\"Informational \",\"The User Session layer, including idle session handling, is implemented by an external OpenID Connect (OIDC) Provider that issues OAuth2 tokens.\"\nV-222390,\"The application must automatically terminate the admin user session and log off admin users after a 10 minute idle time period is exceeded.\",\"Informational \",\"The User Session layer, including idle session handling, is implemented by an external OpenID Connect (OIDC) Provider that issues OAuth2 tokens.\"\nV-222391,\"Applications requiring user access authentication must provide a logoff capability for user initiated communication session.\",\"Not a Finding \",\"The Web Client requests logoff service from the OIDC Provider after user interaction with a DOM element whose innerText = 'Logout'\"\nV-222392,\"The application must display an explicit logoff message to users indicating the reliable termination of authenticated communications sessions.\",\"Not a Finding \",\"The SPA does not display an explicit 'logged out' screen, it immediately redirects to the login screen of the configured OIDC Provider.\n\nAddressed by Issue #485\"\nV-222393,\"The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in storage.\",\"Not a Finding \",\"The API scaffolds each new database instance with the classification specified by the environment variable STIGMAN_CLASSIFICATION. This value is stored in the 'configuration' table and represents the default classification for all data that is stored by the database instance, served by the API, and received by the Web Client.\"\nV-222394,\"The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in process.\",\"Not a Finding \",\"Individual objects do not contain data markings. An API endpoint returns the data marking for all data served by the API. The Web Client displays a banner that represents the data marking for all data received by the Client. Processing the data does not alter this banner in any circumstances.\"\nV-222395,\"The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission.\",\"Not a Finding \",\"Individual objects do not contain data markings. An API endpoint returns the data marking for all data served by the API. The Web Client displays a banner that represents the data marking for all data received by the Client. Data transmission does not alter this banner in any circumstances.\"\nV-222396,\"The application must implement DoD-approved encryption to protect the confidentiality of remote access sessions.\",\"Informational \",\"The documentation recommends deployments locate the application behind a TLS reverse proxy.\"\nV-222397,\"The application must implement cryptographic mechanisms to protect the integrity of remote access sessions.\",\"Informational \",\"The documentation recommends deployments locate the application behind a TLS reverse proxy.\"\nV-222398,\"Applications with SOAP messages requiring integrity must include the following message elements:-Message ID-Service Request-Timestamp-SAML Assertion (optionally included in messages) and all elements of the message must be digitally signed.\",\"Not Applicable \",\"The SPA does not utilize SOAP messages.\"\nV-222399,\"Messages protected with WS_Security must use time stamps with creation and expiration times.\",\"Not Applicable \",\"The SPA does not utilize WS-Security tokens.\"\nV-222400,\"Validity periods must be verified on all application messages using WS-Security or SAML assertions.\",\"Not Applicable \",\"The SPA does not utilize WSS or SAML assertions.\"\nV-222401,\"The application must ensure each unique asserting party provides unique assertion ID references for each SAML assertion.\",\"Not Applicable \",\"The SPA does not utilize SAML assertions.\"\nV-222402,\"The application must ensure encrypted assertions, or equivalent confidentiality protections are used when assertion data is passed through an intermediary, and confidentiality of the assertion data is required when passing through the intermediary.\",\"Not Applicable \",\"The SPA does not utilize WS-Security tokens\"\nV-222403,\"The application must use the NotOnOrAfter condition when using the SubjectConfirmation element in a SAML assertion.\",\"Not Applicable \",\"The SPA does not utilize SAML assertions.\"\nV-222404,\"The application must use both the NotBefore and NotOnOrAfter elements or OneTimeUse element when using the Conditions element in a SAML assertion.\",\"Not Applicable \",\"The SPA does not utilize SAML assertions.\"\nV-222405,\"The application must ensure if a OneTimeUse element is used in an assertion, there is only one of the same used in the Conditions element portion of an assertion.\",\"Not Applicable \",\"The SPA does not utilize SAML assertions.\"\nV-222406,\"The application must ensure messages are encrypted when the SessionIndex is tied to privacy data.\",\"Not Applicable \",\"The SPA does not utilize SAML assertions.\"\nV-222407,\"The application must provide automated mechanisms for supporting account management functions.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222408,\"Shared/group account credentials must be terminated when members leave the group.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222409,\"The application must automatically remove or disable temporary user accounts 72 hours after account creation.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222410,\"The application must have a process, feature or function that prevents removal or disabling of emergency accounts.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222411,\"The application must automatically disable accounts after a 35 day period of account inactivity.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222412,\"Unnecessary application accounts must be disabled, or deleted.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222413,\"The application must automatically audit account creation.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222414,\"The application must automatically audit account modification.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222415,\"The application must automatically audit account disabling actions.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222416,\"The application must automatically audit account removal actions.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222417,\"The application must notify System Administrators and Information System Security Officers when accounts are created.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222418,\"The application must notify System Administrators and Information System Security Officers when accounts are modified.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222419,\"The application must notify System Administrators and Information System Security Officers of account disabling actions.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222420,\"The application must notify System Administrators and Information System Security Officers of account removal actions.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222421,\"The application must automatically audit account enabling actions.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222422,\"The application must notify System Administrators and Information System Security Officers of account enabling actions.\",\"Informational \",\"Account Management services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222423,\"Application data protection requirements must be identified and documented.\",\"Not a Finding \",\"The project provides documentation describing its data structures and protection methods, including RBAC and other access controls. These concepts are also expressed and enforced by its use of an appropriate OAS definition.  All app data is persisted in a deployment-provided database that must be configured in accordance with organization requirements.\"\nV-222424,\"The application must utilize organization-defined data mining detection techniques for organization-defined data storage objects to adequately detect data mining attempts.\",\"Informational \",\"Data mining detection and prevention are to be implemented at the Log Analysis layer, Ingress controller, or elsewhere.  No data mining protection requirements apply to application itself.\"\nV-222425,\"The application must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.\",\"Not a Finding \",\"The API ensures proper access to application resources in accordance with Role-Based Access Control (RBAC) and Discretionary Access Control (DAC) mechanisms at the application and Collection levels. No direct database access is provided by the application. See documentation.\"\nV-222426,\"The application must enforce organization-defined discretionary access control policies over defined subjects and objects.\",\"Not a Finding \",\"The API ensures proper access to application resources in accordance with Role-Based Access Control (RBAC) and Discretionary Access Control (DAC) mechanisms at the application and Collection levels. No direct database access is provided by the application. See documentation.\"\nV-222427,\"The application must enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.\",\"Informational \",\"The application does not provide data flow control capabilities, the requirement is not applicable.\"\nV-222428,\"The application must enforce approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.\",\"Informational \",\"The application does not provide data flow control capabilities, the requirement is not applicable.\"\nV-222429,\"The application must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.\",\"Not a Finding \",\"The Project publishes container images configured to execute the API as the unprivileged user, 'node' whose userId is not 0.\"\nV-222430,\"The application must execute without excessive account permissions.\",\"Not a Finding \",\"The project supplied container images are configured to run by the limited, unprivileged user, 'node'.\"\nV-222431,\"The application must audit the execution of privileged functions.\",\"Not a Finding \",\"The API emits audit records for privileged functions that document the specific endpoint invoked, the date and time, and all path and query parameters.\"\nV-222432,\"The application must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period.\",\"Informational \",\"User Account services are provided by a external OIDC Provider.\"\nV-222433,\"The application administrator must follow an approved process to unlock locked user accounts.\",\"Informational \",\"User Account services are provided by a external OIDC Provider.\"\nV-222434,\"The application must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.\",\"Informational \",\"The Standard Mandatory DoD Notice and Consent Banner can be displayed by the external OIDC Provider.\"\nV-222435,\"The application must retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.\",\"Informational \",\"Standard Mandatory DoD Notice and Consent Banner services are provided by a external OIDC Provider.\"\nV-222436,\"The publicly accessible application must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.\",\"Informational \",\"Standard Mandatory DoD Notice and Consent Banner services are provided by a external OIDC Provider.\"\nV-222437,\"The application must display the time and date of the users last successful logon.\",\"Informational \",\"User Session services are provided by a external OIDC Provider.\"\nV-222438,\"The application must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.\",\"Informational \",\"STIG Manager does not have any non-repudiation requirements as part of its design.\"\nV-222439,\"For applications providing audit record aggregation, the application must compile audit records from organization-defined information system components into a system-wide audit trail that is time-correlated with an organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail.\",\"Informational \",\"STIG Manager does not offer log aggregation services. This is expected to be implemented by specific deployments at the Log Analysis level.\"\nV-222441,\"The application must provide audit record generation capability for the creation of session IDs.\",\"Informational \",\"The web app delegates these duties to an OIDC Provider. The OpenID Connect (OIDC) Provider creates, manages and logs user session data.\"\nV-222442,\"The application must provide audit record generation capability for the destruction of session IDs.\",\"Informational \",\"The web app delegates these duties to an OIDC Provider. The OpenID Connect (OIDC) Provider creates, manages and logs user session data.\"\nV-222443,\"The application must provide audit record generation capability for the renewal of session IDs.\",\"Informational \",\"The web app delegates these duties to an OIDC Provider. The OpenID Connect (OIDC) Provider creates, manages and logs user session data.\"\nV-222444,\"The application must not write sensitive data into the application logs.\",\"Not a Finding \",\"The API does not emit audit records with sensitive data, including session Ids (not used), encryption keys, or passwords (not used).\"\nV-222445,\"The application must provide audit record generation capability for session timeouts.\",\"Informational \",\"The web app delegates these duties to an OIDC Provider. The OpenID Connect (OIDC) Provider creates, manages and logs user session data.\"\nV-222446,\"The application must record a time stamp indicating when the event occurred.\",\"Not a Finding \",\"The API emits audit records that are time stamped.\"\nV-222447,\"The application must provide audit record generation capability for HTTP headers including User-Agent, Referer, GET, and POST.\",\"Not a Finding \",\"Addressed by Issue #179, allowing different log levels and configuration to affect headers included in audit record.\"\nV-222448,\"The application must provide audit record generation capability for connecting system IP addresses.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records that include the original source IP address.\"\nV-222449,\"The application must record the username or user ID of the user associated with the event.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records that include the OAuth2 token claim configured as representing the requesting entity's username.\"\nV-222450,\"The application must generate audit records when successful/unsuccessful attempts to grant privileges occur.\",\"Not a Finding \",\"Addressed by Issue #179, must include POST content and JSON reply in audit record.\"\nV-222451,\"The application must generate audit records when successful/unsuccessful attempts to access security objects occur.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to access security objects (i.e., Collections, Assets, Reviews).\"\nV-222452,\"The application must generate audit records when successful/unsuccessful attempts to access security levels occur.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to access security levels (i.e., Collection Grants).\"\nV-222453,\"The application must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to access all categories of information.\"\nV-222454,\"The application must generate audit records when successful/unsuccessful attempts to modify privileges occur.\",\"Not a Finding \",\"Addressed by Issue #179, must include POST content and JSON reply in audit record.\"\nV-222455,\"The application must generate audit records when successful/unsuccessful attempts to modify security objects occur.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to modify security objects (i.e, Collections, Assets, Reviews and Users).\"\nV-222456,\"The application must generate audit records when successful/unsuccessful attempts to modify security levels occur.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to modify security levels (i.e, Collection Grants).\"\nV-222457,\"The application must generate audit records when successful/unsuccessful attempts to modify categories of information (e.g., classification levels) occur.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to modify categories of information (i.e, Collection Grants, Restricted User Access).\"\nV-222458,\"The application must generate audit records when successful/unsuccessful attempts to delete privileges occur.\",\"Not a Finding \",\"Addressed by Issue #179, must include POST content and JSON reply in audit record.\"\nV-222459,\"The application must generate audit records when successful/unsuccessful attempts to delete security levels occur.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to delete security levels  (i.e, Collection Grants, Restricted User Access).\"\nV-222460,\"The application must generate audit records when successful/unsuccessful attempts to delete application database security objects occur.\",\"Not a Finding \",\"The API does not implement functionality that manipulates database security objects, including deletions.\"\nV-222461,\"The application must generate audit records when successful/unsuccessful attempts to delete categories of information (e.g., classification levels) occur.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to delete categories of information (i.e, Collection Grants, Restricted User Access).\"\nV-222462,\"The application must generate audit records when successful/unsuccessful logon attempts occur.\",\"Informational \",\"The web app delegates these duties to an OIDC Provider. The OpenID Connect (OIDC) Provider creates, manages and logs user session data.\"\nV-222463,\"The application must generate audit records for privileged activities or other system-level access.\",\"Informational \",\"By design, privileged access does not include the ability to modify the application or its configuration.  It only provide users with the functionality or the ability to manage their own user specific preferences or otherwise tailor the application to suit individual user needs based upon choices or selections built into the application.\"\nV-222464,\"The application must generate audit records showing starting and ending time for user access to the system.\",\"Informational \",\"The web app delegates these duties to an OIDC Provider. The OpenID Connect (OIDC) Provider creates, manages and logs user session data.\"\nV-222465,\"The application must generate audit records when successful/unsuccessful accesses to objects occur.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records for successful and unsuccessful attempts to access to application objects (i.e, Collections, Assets, Reviews, Users).\"\nV-222466,\"The application must generate audit records for all direct access to the information system.\",\"Informational \",\"The application does not provide direct access to the underlying information system.\"\nV-222467,\"The application must generate audit records for all account creations, modifications, disabling, and termination events.\",\"Informational \",\"The web app delegates these duties to an OIDC Provider. The OpenID Connect (OIDC) Provider creates, manages and logs user session data.\"\nV-222468,\"The application must initiate session auditing upon startup.\",\"Not a Finding \",\"The API emits audit records immediately upon the start of its bootstrapping process.\n\nYour local definition of 'application startup' may include other components (i.e, OIDC Provider, database, reverse proxies, log servers, etc.) whose compliance with this check must be individually evaluated.\"\nV-222469,\"The application must log application shutdown events.\",\"Not a Finding \",\"The API emits audit records after receiving the SIGINT or SIGTERM signal that initiates a shutdown. Addressed by Issue #484\n\nYour local definition of 'application shutdown' may include other components (i.e, OIDC Provider, database, reverse proxies, log servers, etc.) whose compliance with this check must be individually evaluated.\"\nV-222470,\"The application must log destination IP addresses.\",\"Not a Finding \",\"The API emits audit records containing the destination IP when retrieving token signing keys from the OIDC Provider or when optionally downloading STIG compilations during  the initial database bootstrap.\"\nV-222471,\"The application must log user actions involving access to data.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records for user actions involving access to data (i.e, Collections, Assets, Reviews, Users).\"\nV-222472,\"The application must log user actions involving changes to data.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records for user actions involving changes to data (i.e, Collections, Assets, Reviews, Users).\"\nV-222473,\"The application must produce audit records containing information to establish when (date and time) the events occurred.\",\"Not a Finding \",\"The API emits audit records that are time stamped.\"\nV-222474,\"The application must produce audit records containing enough information to establish which component, feature or function of the application triggered the audit event.\",\"Not a Finding \",\"The API emits audit records that include a component property. \n\"\nV-222475,\"When using centralized logging; the application must include a unique identifier in order to distinguish itself from other application logs.\",\"Not a Finding \",\"The API emits audit records that include an instance property.\"\nV-222476,\"The application must produce audit records that contain information to establish the outcome of the events.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records that contain the response status code.\"\nV-222477,\"The application must generate audit records containing information that establishes the identity of any individual or process associated with the event.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records that include the OAuth2 token claim configured as representing the requesting entity's username.\"\nV-222478,\"The application must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users.\",\"Not a Finding \",\"When logging endpoint requests, if the request includes parameter 'elevate' == true, the API emits audit records that include the JSON POST content and the JSON reply\n\nAddressed by Issue #179\"\nV-222479,\"The application must implement transaction recovery logs when transaction based.\",\"Informational \",\"Implemented by the Data Storage layer\"\nV-222480,\"The application must provide centralized management and configuration of the content to be captured in audit records generated by all application components.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222481,\"The application must off-load audit records onto a different system or media than the system being audited.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222482,\"The application must be configured to write application logs to a centralized log repository.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222483,\"The application must provide an immediate warning to the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222484,\"Applications categorized as having a moderate or high impact must provide an immediate real-time alert to the SA and ISSO (at a minimum) for all audit failure events.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222485,\"The application must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222486,\"The application must shut down by default upon audit failure (unless availability is an overriding concern).\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution. Application must be stopped by the Container Platform layer (e.g., k8s).\"\nV-222487,\"The application must provide the capability to centrally review and analyze audit records from multiple components within the system.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222488,\"The application must provide the capability to filter audit records for events of interest based upon organization-defined criteria.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222489,\"The application must provide an audit reduction capability that supports on-demand reporting requirements.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222490,\"The application must provide an audit reduction capability that supports on-demand audit review and analysis.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222491,\"The application must provide an audit reduction capability that supports after-the-fact investigations of security incidents.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222492,\"The application must provide a report generation capability that supports on-demand audit review and analysis.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222493,\"The application must provide a report generation capability that supports on-demand reporting requirements.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222494,\"The application must provide a report generation capability that supports after-the-fact investigations of security incidents.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222495,\"The application must provide an audit reduction capability that does not alter original content or time ordering of audit records.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222496,\"The application must provide a report generation capability that does not alter original content or time ordering of audit records.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222497,\"The applications must use internal system clocks to generate time stamps for audit records.\",\"Not a Finding \",\"The API emits audit records with a time stamp generated from the system clock.\"\nV-222498,\"The application must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).\",\"Not a Finding \",\"The API emits audit records with the time stamp represented as an ISO-8601 string, including time zone.\"\nV-222499,\"The application must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.\",\"Not a Finding \",\"The API emits audit records with millisecond time stamp precision.\"\nV-222500,\"The application must protect audit information from any type of unauthorized read access.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222501,\"The application must protect audit information from unauthorized modification.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222502,\"The application must protect audit information from unauthorized deletion.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222503,\"The application must protect audit tools from unauthorized access.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222504,\"The application must protect audit tools from unauthorized modification.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222505,\"The application must protect audit tools from unauthorized deletion.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222506,\"The application must back up audit records at least every seven days onto a different system or system component than the system or component being audited.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222507,\"The application must use cryptographic mechanisms to protect the integrity of audit information.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222508,\"Application audit tools must be cryptographically hashed.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution. The project does not provide a separate tool in the form of a file which provides an ability to view and manipulate application log data, query data, or generate reports\"\nV-222509,\"The integrity of the audit tools must be validated by checking the files for changes in the cryptographic hash value.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution. The project does not provide a separate tool in the form of a file which provides an ability to view and manipulate application log data, query data or generate reports.\"\nV-222510,\"The application must prohibit user installation of software without explicit privileged status.\",\"Informational \",\"The project does not provide the ability to install software components, modules, plugins, or extensions,\"\nV-222511,\"The application must enforce access restrictions associated with changes to application configuration.\",\"Informational \",\"The application cannot configure itself, and does not offer any configuration mechanisms that are affected by users or config files.\"\nV-222512,\"The application must audit who makes configuration changes to the application.\",\"Informational \",\"The application cannot configure itself, and does not offer any configuration mechanisms that are affected by users or config files. The project should be deployed with a Application Services layer (Container Platform such as k8s)  that audits configuration changes to the application.\"\nV-222513,\"The application must have the capability to prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.\",\"Informational \",\"The application is offered as containerized API/Web Client builds that are signed using Docker Content Trust.\"\nV-222514,\"The applications must limit privileges to change the software resident within software libraries.\",\"Not a Finding \",\"The API is designed to be stateless and runnable in a read-only  container.\"\nV-222515,\"An application vulnerability assessment must be conducted.\",\"Informational \",\"Deployments must be scanned according to individual or organizational policies. Developers scan the codebase regularly in a test environment, but this is only one component of a functioning production deployment.\"\nV-222516,\"The application must prevent program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage.\",\"Informational \",\"Organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage are determined locally and not by the project.\"\nV-222517,\"The application must employ a deny-all, permit-by-exception (whitelist) policy to allow the execution of authorized software programs.\",\"Not Applicable \",\"The application is not a configuration management or similar type of application designed to manage system processes and configurations, this requirement is not applicable.\"\nV-222518,\"The application must be configured to disable non-essential capabilities.\",\"Not a Finding \",\"The application runs only essential services needed for operation.  Container images are based on either the Alpine Linux distribution or the Iron Bank Universal Base Image (UBI).\"\nV-222519,\"The application must be configured to use only functions, ports, and protocols permitted to it in the PPSM CAL.\",\"Informational \",\"PPS features are implemented by the Container Platform service.\"\nV-222520,\"The application must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider. Reauthentication policies are locally defined and implemented.\"\nV-222521,\"The application must require devices to reauthenticate when organization-defined circumstances or situations requiring reauthentication.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider. Reauthentication policies are locally defined and implemented.\"\nV-222522,\"The application must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222523,\"The application must use multifactor (Alt. Token) authentication for network access to privileged accounts.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222524,\"The application must accept Personal Identity Verification (PIV) credentials.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222525,\"The application must electronically verify Personal Identity Verification (PIV) credentials.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider. Reauthentication policies are locally defined and implemented.\"\nV-222526,\"The application must use multifactor (e.g., CAC, Alt. Token) authentication for network access to non-privileged accounts.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222527,\"The application must use multifactor (Alt. Token) authentication for local access to privileged accounts.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222528,\"The application must use multifactor (e.g., CAC, Alt. Token) authentication for local access to non-privileged accounts.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222529,\"The application must ensure users are authenticated with an individual authenticator prior to using a group authenticator.\",\"Not Applicable \",\"The project does not use group or shared accounts.\"\nV-222530,\"The application must implement replay-resistant authentication mechanisms for network access to privileged accounts.\",\"Informational \",\"Replay-resistant authentication mechanisms are implemented by the OIDC Provider.\"\nV-222531,\"The application must implement replay-resistant authentication mechanisms for network access to non-privileged accounts.\",\"Informational \",\"Replay-resistant authentication mechanisms are implemented by the OIDC Provider.\"\nV-222532,\"The application must utilize mutual authentication when endpoint device non-repudiation protections are required by DoD policy or by the data owner.\",\"Informational \",\"Mutual authentication mechanisms are implemented by the OIDC Provider.\"\nV-222533,\"The application must authenticate all network connected endpoint devices before establishing any connection.\",\"Not a Finding \",\"All API endpoint access requires a valid OAuth2 token issued by the application OIDC Provider.\"\nV-222534,\"Service-Oriented Applications handling non-releasable data must authenticate endpoint devices via mutual SSL/TLS.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.  Devices should perform mutual authentication with the OIDC Provider via the  'client credentials' flow with Signed JWT or equivalent  PKI technologies.\"\nV-222535,\"The application must disable device identifiers after 35 days of inactivity unless a cryptographic certificate is used for authentication.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider. Devices should perform mutual authentication with the OIDC Provider via the  'client credentials' flow with Signed JWT or equivalent  PKI technologies.\"\nV-222536,\"The application must enforce a minimum 15-character password length.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222537,\"The application must enforce password complexity by requiring that at least one upper-case character be used.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222538,\"The application must enforce password complexity by requiring that at least one lower-case character be used.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222539,\"The application must enforce password complexity by requiring that at least one numeric character be used.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222540,\"The application must enforce password complexity by requiring that at least one special character be used.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222541,\"The application must require the change of at least 8 of the total number of characters when passwords are changed.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222542,\"The application must only store cryptographic representations of passwords.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222543,\"The application must transmit only cryptographically-protected passwords.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222544,\"The application must enforce 24 hours/1 day as the minimum password lifetime.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222545,\"The application must enforce a 60-day maximum password lifetime restriction.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222546,\"The application must prohibit password reuse for a minimum of five generations.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222547,\"The application must allow the use of a temporary password for system logons with an immediate change to a permanent password.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222548,\"The application password must not be changeable by users other than the administrator or the user with which the password is associated.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222549,\"The application must terminate existing user sessions upon account deletion.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider. Low-latency session termination should be configured on the OIDC Provider.\"\nV-222550,\"The application, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222551,\"The application, when using PKI-based authentication, must enforce authorized access to the corresponding private key.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222552,\"The application must map the authenticated identity to the individual user or group account for PKI-based authentication.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222553,\"The application, for PKI-based authentication, must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222554,\"The application must not display passwords/PINs as clear text.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222555,\"The application must use mechanisms meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222556,\"The application must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222557,\"The application must accept Personal Identity Verification (PIV) credentials from other federal agencies.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222558,\"The application must electronically verify Personal Identity Verification (PIV) credentials from other federal agencies.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222559,\"The application must accept FICAM-approved third-party credentials.\",\"Informational \",\"Authentication services are provided by an external (OIDC) OpenID Connect Provider.\"\nV-222560,\"The application must conform to FICAM-issued profiles.\",\"Not a Finding \",\"The project conforms to OpenID Connect, a FICAM issued profile.\"\nV-222561,\"Applications used for non-local maintenance sessions must audit non-local maintenance and diagnostic sessions for organization-defined auditable events.\",\"Not Applicable \",\"The project does not provide non-local maintenance and diagnostic capability.\"\nV-222562,\"Applications used for non-local maintenance sessions must implement cryptographic mechanisms to protect the integrity of non-local maintenance and diagnostic communications.\",\"Not Applicable \",\"The project does not provide non-local maintenance and diagnostic capability.\"\nV-222563,\"Applications used for non-local maintenance sessions must implement cryptographic mechanisms to protect the confidentiality of non-local maintenance and diagnostic communications.\",\"Not Applicable \",\"The project does not provide non-local maintenance and diagnostic capability.\"\nV-222564,\"Applications used for non-local maintenance sessions must verify remote disconnection at the termination of non-local maintenance and diagnostic sessions.\",\"Not Applicable \",\"The project does not provide non-local maintenance and diagnostic capability.\"\nV-222565,\"The application must employ strong authenticators in the establishment of non-local maintenance and diagnostic sessions.\",\"Not Applicable \",\"The project does not provide non-local maintenance and diagnostic capability.\"\nV-222566,\"The application must terminate all sessions and network connections when non-local maintenance is completed.\",\"Not Applicable \",\"The project does not provide non-local maintenance and diagnostic capability.\"\nV-222567,\"The application must not be vulnerable to race conditions.\",\"Not a Finding \",\"Code review by SonarCloud tests reveal no race conditions.\"\nV-222568,\"The application must terminate all network connections associated with a communications session at the end of the session.\",\"Not a Finding \",\"The application relies on the underlying OS to control the network connection aspect of the application which is perfectly acceptable.\"\nV-222569,\"The application must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.\",\"Informational \",\"The project expects other layers to provide appropriate data protection via compliant cryptography. It supports interactions with the Data Storage layer via TLS. The project containers are read-only, stateless builds.\"\nV-222570,\"The application must utilize FIPS-validated cryptographic modules when signing application components.\",\"Not a Finding \",\"Container images are signed via Docker Content Trust, which uses SHA256 digests.\"\nV-222571,\"The application must utilize FIPS-validated cryptographic modules when generating cryptographic hashes.\",\"Not a Finding \",\"Container images are signed via Docker Content Trust, which uses SHA256 digests.\"\nV-222572,\"The application must utilize FIPS-validated cryptographic modules when protecting unclassified information that requires cryptographic protection.\",\"Informational \",\"Conformant data protection techniques should be implemented by the Data Storage service, and/or by Ingress configuration of the Container Platform.\"\nV-222573,\"Applications making SAML assertions must use FIPS-approved random numbers in the generation of SessionIndex in the SAML element AuthnStatement.\",\"Not Applicable \",\"The project does not use SAML assertions.\"\nV-222574,\"The application user interface must be either physically or logically separated from data storage and management interfaces.\",\"Not a Finding \",\"Web application is logically separated from data storage layer.  Authorization for privileged access determined by the OIDC Provider, also logically separated. Web application offers no application configuration functionality in the application itself.\"\nV-222575,\"The application must set the HTTPOnly flag on session cookies.\",\"Informational \",\"The web application does not set session cookies. OIDC Provider must be configured appropriately.\"\nV-222576,\"The application must set the secure flag on session cookies.\",\"Informational \",\"The web application does not set session cookies. OIDC Provider must be configured appropriately.\"\nV-222577,\"The application must not expose session IDs.\",\"Informational \",\"The web application does not set session cookies. OIDC Provider must be configured appropriately.\"\nV-222578,\"The application must destroy the session ID value and/or cookie on logoff or browser close.\",\"Informational \",\"The web application does not set session cookies. OIDC Provider must be configured appropriately.\"\nV-222579,\"Applications must use system-generated session identifiers that protect against session fixation.\",\"Informational \",\"The web application does not set session cookies. OIDC Provider must be configured appropriately.\"\nV-222580,\"Applications must validate session identifiers.\",\"Informational \",\"The web application does not set session cookies. OIDC Provider must be configured appropriately.\"\nV-222581,\"Applications must not use URL embedded session IDs.\",\"Informational \",\"The web application does not set session cookies. OIDC Provider must be configured appropriately.\"\nV-222582,\"The application must not re-use or recycle session IDs.\",\"Informational \",\"The web application does not set session cookies. OIDC Provider must be configured appropriately.\"\nV-222583,\"The application must use the Federal Information Processing Standard (FIPS) 140-2-validated cryptographic modules and random number generator if the application implements encryption, key exchange, digital signature, and hash functionality.\",\"Informational \",\"The web application expects OAuth2 tokens to be signed by the OIDC Provider using FIP-140-2 validated algorithms .\"\nV-222584,\"The application must only allow the use of DoD-approved certificate authorities for verification of the establishment of protected sessions.\",\"Informational \",\"The project expects DoD-approved CAs to be referenced by the OIDC Provider.\"\nV-222585,\"The application must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.\",\"Informational \",\"The project expects fail-safe procedures to be implemented by the Container Platform (i.e, k8s).  The web application is provided as a stateless container that caches no data and will not respond with data to requests when components are inoperable or inaccessible.\"\nV-222586,\"In the event of a system failure, applications must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.\",\"Informational \",\"The project expects fail-safe procedures to be implemented by the Container Platform (i.e, k8s).  The web application is provided as a stateless container that caches no data and will not respond with data to requests when components are inoperable or inaccessible.\"\nV-222587,\"The application must protect the confidentiality and integrity of stored information when required by DoD policy or the information owner.\",\"Informational \",\"The project expects conformant data storage procedures to be implemented by the Data Storage layer.\"\nV-222588,\"The application must implement approved cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined information system components.\",\"Informational \",\"The project expects conformant data storage procedures to be implemented by the Data Storage layer.\"\nV-222589,\"The application must use appropriate cryptography in order to protect stored DoD information when required by the information owner or DoD policy.\",\"Informational \",\"The project expects conformant data storage procedures to be implemented by the Data Storage layer.\"\nV-222590,\"The application must isolate security functions from non-security functions.\",\"Not a Finding \",\"The project RBAC is described in the documentation.\"\nV-222591,\"The application must maintain a separate execution domain for each executing process.\",\"Not a Finding \",\"The project should be deployed as an immutable, stateless container that runs in a single, isolated execution domain.\"\nV-222592,\"Applications must prevent unauthorized and unintended information transfer via shared system resources.\",\"Not a Finding \",\"The project should be deployed as an immutable, stateless container that is isolated from other host processes (i.e, k8s)\"\nV-222593,\"XML-based applications must mitigate DoS attacks by using XML filters, parser options, or gateways.\",\"Not a Finding \",\"The project uses the library 'fast-xml-parser' a maintained library whose development pipeline tests itself against XML based attacks.\"\nV-222594,\"The application must restrict the ability to launch Denial of Service (DoS) attacks against itself or other information systems.\",\"Informational \",\"The project expects to be deployed in a Container Platform that resists DoS attacks.\"\nV-222595,\"The web service design must include redundancy mechanisms when used with high-availability systems.\",\"Informational \",\"The project expects to be deployed in a Container Platform that provides high-availability services.\"\nV-222596,\"The application must protect the confidentiality and integrity of transmitted information.\",\"Informational \",\"The project expects to be deployed in a Container Platform that protects the confidentiality and integrity of transmitted information.\"\nV-222597,\"The application must implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS).\",\"Informational \",\"The project expects to be deployed in a Container Platform that protects the confidentiality and integrity of transmitted information.\"\nV-222598,\"The application must maintain the confidentiality and integrity of information during preparation for transmission.\",\"Informational \",\"The project expects to be deployed in a Container Platform that protects the confidentiality and integrity of transmitted information.\"\nV-222599,\"The application must maintain the confidentiality and integrity of information during reception.\",\"Informational \",\"The project expects to be deployed in a Container Platform that protects the confidentiality and integrity of transmitted information.\"\nV-222600,\"The application must not disclose unnecessary information to users.\",\"Not a Finding \",\"Error messages addressed by Issue #483\"\nV-222601,\"The application must not store sensitive information in hidden fields.\",\"Not a Finding \",\"No sensitive authentication or session data is stored in hidden fields. \nSonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.\"\nV-222602,\"The application must protect from Cross-Site Scripting (XSS) vulnerabilities.\",\"Not a Finding \",\"SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.\"\nV-222603,\"The application must protect from Cross-Site Request Forgery (CSRF) vulnerabilities.\",\"Not a Finding \",\"SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.\"\nV-222604,\"The application must protect from command injection.\",\"Not a Finding \",\"SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.\"\nV-222605,\"The application must protect from canonical representation vulnerabilities.\",\"Not a Finding \",\"SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.\"\nV-222606,\"The application must validate all input.\",\"Not a Finding \",\"API input is validated against the OAS definition. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.\"\nV-222607,\"The application must not be vulnerable to SQL Injection.\",\"Not a Finding \",\"All SQL queries that process user input are parameterized. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.\"\nV-222608,\"The application must not be vulnerable to XML-oriented attacks.\",\"Not a Finding \",\"SonarCloud scans are run regularly to identify XML vulnerabilities. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.\"\nV-222609,\"The application must not be subject to input handling vulnerabilities.\",\"Not a Finding \",\"All user input is validated on both the client and the server. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.\"\nV-222610,\"The application must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.\",\"Not a Finding \",\"Error messages addressed by Issue #483\"\nV-222611,\"The application must reveal error messages only to the ISSO, ISSM, or SA.\",\"Not a Finding \",\"Error messages addressed by Issue #483\"\nV-222612,\"The application must not be vulnerable to overflow attacks.\",\"Not a Finding \",\"SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.\"\nV-222613,\"The application must remove organization-defined software components after updated versions have been installed.\",\"Not a Finding \",\"Dependabot services provided by GitHub to identify vulnerable software components. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.\"\nV-222614,\"Security-relevant software updates and patches must be kept up to date.\",\"Not a Finding \",\"Dependabot services provided by GitHub to identify vulnerable software components. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Advisories page on GitHub for any known vulnerabilities.\"\nV-222615,\"The application performing organization-defined security functions must verify correct operation of security functions.\",\"Not Applicable \",\"The application is not designed or intended to perform security function testing.\"\nV-222616,\"The application must perform verification of the correct operation of security functions: upon system startup and/or restart; upon command by a user with privileged access; and/or every 30 days.\",\"Not Applicable \",\"The application is not designed or intended to perform security function testing.\"\nV-222617,\"The application must notify the ISSO and ISSM of failed security verification tests.\",\"Not Applicable \",\"The application is not designed or intended to perform security function testing.\"\nV-222618,\"Unsigned Category 1A mobile code must not be used in the application in accordance with DoD policy.\",\"Not Applicable \",\"No Category 1A present in the application. The SPA mobile code executes within the client browser.\"\nV-222619,\"The ISSO must ensure an account management process is implemented, verifying only authorized users can gain access to the application, and individual accounts designated as inactive, suspended, or terminated are promptly removed.\",\"Informational \",\"Account management services are provided by the external OpenID Connect (OIDC) Provider.\"\nV-222620,\"Application web servers must be on a separate network segment from the application and database servers if it is a tiered application operating in the DoD DMZ.\",\"Informational \",\"Determined by deployment configuration.\"\nV-222621,\"The ISSO must ensure application audit trails are retained for at least 1 year for applications without SAMI data, and 5 years for applications including SAMI data.\",\"Informational \",\"Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222622,\"The ISSO must review audit trails periodically based on system documentation recommendations or immediately upon system security events.\",\"Informational \",\"Dependent on organizational compliance.  Application log entries are written to the container's STDOUT, to be captured by the deployment's preferred and compliant logging solution.\"\nV-222623,\"The ISSO must report all suspected violations of IA policies in accordance with DoD information system IA procedures.\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222624,\"The ISSO must ensure active vulnerability testing is performed.\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222625,\"Execution flow diagrams and design documents must be created to show how deadlock and recursion issues in web services are being mitigated.\",\"Not a Finding \",\"By design, the application web service is not subject to deadlocking as it does not call the client.\"\nV-222626,\"The designer must ensure the application does not store configuration and control files in the same directory as user data.\",\"Not a Finding \",\"Application is provided as a stateless container.\"\nV-222627,\"The ISSO must ensure if a DoD STIG or NSA guide is not available, a third-party product will be configured by following available guidance.\",\"Informational \",\"Dependent on organizational compliance.  Deployment and security guidance available in project documentation.\"\nV-222628,\"New IP addresses, data services, and associated ports used by the application must be submitted to the appropriate approving authority for the organization, which in turn will be submitted through the DoD Ports, Protocols, and Services Management (DoD PPSM)\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222629,\"The application must be registered with the DoD Ports and Protocols Database.\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222630,\"The Configuration Management (CM) repository must be properly patched and STIG compliant.\",\"Informational \",\"Configuration management dependent on organizational compliance and processes.  Application code hosted on GitHub according to Code.mil guidance.\"\nV-222631,\"Access privileges to the Configuration Management (CM) repository must be reviewed every three months.\",\"Informational \",\"Configuration management dependent on organizational compliance and processes.  Application code hosted on GitHub according to Code.mil guidance. Codebase access restricted to repository administrators, which are publicly listed on the project's GitHub site.\"\nV-222632,\"A Software Configuration Management (SCM) plan describing the configuration control and change management process of application objects developed by the organization and the roles and responsibilities of the organization must be created and maintained.\",\"Informational \",\"Configuration management dependent on organizational compliance and processes.  All project artifacts are publicly available on the GitHub site, in accordance with Code.mil guidance.\"\nV-222633,\"A Configuration Control Board (CCB) that meets at least every release cycle, for managing the Configuration Management (CM) process must be established.\",\"Informational \",\"Configuration management dependent on organizational compliance and processes.  All project artifacts are publicly available on the GitHub site, in accordance with Code.mil guidance.\"\nV-222634,\"The application services and interfaces must be compatible with and ready for IPv6 networks.\",\"Informational \",\"Dependent on specific deployment. Web application is a Node.js application that includes support for IPv6.\"\nV-222635,\"The application must not be hosted on a general purpose machine if the application is designated as critical or high availability by the ISSO.\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222636,\"A disaster recovery/continuity plan must exist in accordance with DoD policy based on the applications availability requirements.\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222637,\"Recovery procedures and technical system features must exist so recovery is performed in a secure and verifiable manner. The ISSO will document circumstances inhibiting a trusted recovery.\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222638,\"Data backup must be performed at required intervals in accordance with DoD policy.\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222639,\"Back-up copies of the application software or source code must be stored in a fire-rated container or stored separately (offsite).\",\"Not a Finding \",\"Application codebase is stored in a GitHub repository (offsite).\"\nV-222640,\"Procedures must be in place to assure the appropriate physical and technical protection of the backup and restoration of the application.\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222641,\"The application must use encryption to implement key exchange and authenticate endpoints prior to establishing a communication channel for key exchange.\",\"Informational \",\"The project expects other layers to provide appropriate data protection via compliant cryptography.\"\nV-222642,\"The application must not contain embedded authentication data.\",\"Not a Finding \",\"No passwords, certificates, or sensitive data are included in the source code.\"\nV-222643,\"The application must have the capability to mark sensitive/classified output when required.\",\"Not a Finding \",\"The application interface indicates its configured classification, and all exports are marked with the configured classification.\"\nV-222644,\"Prior to each release of the application, updates to system, or applying patches; tests plans and procedures must be created and executed.\",\"Not a Finding \",\"Github workflows test functionality and access controls before release.\"\nV-222645,\"Application files must be cryptographically hashed prior to deploying to DoD operational networks.\",\"Not a Finding \",\"The application is offered as containerized API/Web Client builds that are signed using Docker Content Trust.\"\nV-222646,\"At least one tester must be designated to test for security flaws in addition to functional testing.\",\"Not a Finding \",\"Automated feature and access control tests are run against every commit to the release branch. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Policy for more information.\"\nV-222647,\"Test procedures must be created and at least annually executed to ensure system initialization, shutdown, and aborts are configured to verify the system remains in a secure state.\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222648,\"An application code review must be performed on the application.\",\"Informational \",\"SonarCloud scans, including OWASP tests and code reviews, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Policy for more information.  Application source code is publicly available, and may be scanned at any time by any organization.\"\nV-222649,\"Code coverage statistics must be maintained for each release of the application.\",\"Informational \",\"Code coverage assessed for development using Node.js c8 and newman tests. Reports available upon request.\"\nV-222650,\"Flaws found during a code review must be tracked in a defect tracking system.\",\"Informational \",\"All known code defects are tracked as Issues on the project's GitHub site, or developer's SonarCloud management page.\"\nV-222651,\"The changes to the application must be assessed for IA and accreditation impact prior to implementation.\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222652,\"Security flaws must be fixed or addressed in the project plan.\",\"Informational \",\"SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Policy page on GitHub for more info.\"\nV-222653,\"The application development team must follow a set of coding standards.\",\"Informational \",\"SonarCloud scans, including OWASP tests, and tests for coding standards, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Policy page on GitHub for more info.\"\nV-222654,\"The designer must create and update the Design Document for each release of the application.\",\"Informational \",\"Requires organizational compliance, project documentation, and project Security Policy.\"\nV-222655,\"Threat models must be documented and reviewed for each application release and updated as required by design and functionality changes or when new threats are discovered.\",\"Informational \",\"Requires organizational compliance, project documentation, and project Security Policy.\"\nV-222656,\"The application must not be subject to error handling vulnerabilities.\",\"Not a Finding \",\"Automated feature and access control tests are run against every commit to the release branch. SonarCloud scans, including OWASP tests, are run regularly to identify vulnerabilities.  Manual testing also performed. See project Security Policy for more information.\"\nV-222657,\"The application development team must provide an application incident response plan.\",\"Not a Finding \",\"See project documentation and Security Policy.\"\nV-222658,\"All products must be supported by the vendor or the development team.\",\"Not a Finding \",\"Application is currently being actively maintained and supported.\"\nV-222659,\"The application must be decommissioned when maintenance or support is no longer available.\",\"Not a Finding \",\"Application is currently being actively maintained and supported.\"\nV-222660,\"Procedures must be in place to notify users when an application is decommissioned.\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222661,\"Unnecessary built-in application accounts must be disabled.\",\"Not a Finding \",\"Application has no built-in user accounts.\"\nV-222662,\"Default passwords must be changed.\",\"Not a Finding \",\"Application has no default passwords.\"\nV-222663,\"An Application Configuration Guide must be created and included with the application.\",\"Not a Finding \",\"Project Documentation is provided.\"\nV-222664,\"If the application contains classified data, a Security Classification Guide must exist containing data elements and their classification.\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222665,\"The designer must ensure uncategorized or emerging mobile code is not used in applications.\",\"Not a Finding \",\"Application uses only Category 3 mobile code. (Javascript that runs client side in a web browser)\"\nV-222666,\"Production database exports must have database administration credentials and sensitive data removed before releasing the export.\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222667,\"Protections against DoS attacks must be implemented.\",\"Informational \",\"Threat model dependent on organizational requirements. The project expects to be deployed in a Container Platform that resists DoS attacks.  DoS mitigations expected to be implemented at Container Platform Ingress layer or otherwise fulfilled by specific deployment configurations.\"\nV-222668,\"The system must alert an administrator when low resource conditions are encountered.\",\"Informational \",\"The project expects to be deployed in a Container Platform that monitors resource conditions.\"\nV-222669,\"At least one application administrator must be registered to receive update notifications, or security alerts, when automated alerts are available.\",\"Informational \",\"Dependent on organization compliance.  Update notifications are available by subscription on GitHub project page.\"\nV-222670,\"The application must provide notifications or alerts when product update and security related patches are available.\",\"Not a Finding \",\"Update notifications are available by subscription on GitHub project page.\"\nV-222671,\"Connections between the DoD enclave and the Internet or other public or commercial wide area networks must require a DMZ.\",\"Informational \",\"Dependent on organizational compliance.\"\nV-222672,\"The application must generate audit records when concurrent logons from different workstations occur.\",\"Not a Finding \",\"When logging endpoint requests, the API emits audit records that include the original source IP address.\"\nV-222673,\"The Program Manager must verify all levels of program management, designers, developers, and testers receive annual security training pertaining to their job function.\",\"Not a Finding \",\"The current developers are subject to annual security training requirements.\"\n"
  },
  {
    "path": "docs/make.bat",
    "content": "@ECHO OFF\r\n\r\npushd %~dp0\r\n\r\nREM Command file for Sphinx documentation\r\n\r\nif \"%SPHINXBUILD%\" == \"\" (\r\n\tset SPHINXBUILD=sphinx-build\r\n)\r\nset SOURCEDIR=.\r\nset BUILDDIR=_build\r\n\r\nif \"%1\" == \"\" goto help\r\n\r\n%SPHINXBUILD% >NUL 2>NUL\r\nif errorlevel 9009 (\r\n\techo.\r\n\techo.The 'sphinx-build' command was not found. Make sure you have Sphinx\r\n\techo.installed, then set the SPHINXBUILD environment variable to point\r\n\techo.to the full path of the 'sphinx-build' executable. Alternatively you\r\n\techo.may add the Sphinx directory to PATH.\r\n\techo.\r\n\techo.If you don't have Sphinx installed, grab it from\r\n\techo.http://sphinx-doc.org/\r\n\texit /b 1\r\n)\r\n\r\n%SPHINXBUILD% -M %1 %SOURCEDIR% %BUILDDIR% %SPHINXOPTS% %O%\r\ngoto end\r\n\r\n:help\r\n%SPHINXBUILD% -M help %SOURCEDIR% %BUILDDIR% %SPHINXOPTS% %O%\r\n\r\n:end\r\npopd\r\n"
  },
  {
    "path": "docs/reference/index.rst",
    "content": ".. _terminology:\r\n\r\nTerminology and Concepts\r\n===================================\r\n\r\n\r\nThis is a glossary with definitions for terms like :term:`Asset`:\r\n\r\n\r\n.. glossary::\r\n\r\n    Access Control List\r\n        A list of Access Control Rules applied to a grant to determine what the Grantee can access in a Collection.  Access Control Lists are managed in the Grants panel of the Manage Collection interface.  See :ref:`roles-and-access` for more information.\r\n\r\n    Access Control Rule\r\n        An individual item describing varying levels of Access to the components of a Collection, such as specific Assets, STIGs, Labels, or the entire Collection. The overall Access Control List for a Grant is composed of these Access Control Rules. See :ref:`roles-and-access` for more information.\r\n\r\n    ACL\r\n        See :term:`Access Control List` \r\n\r\n    Asset\r\n        An Asset is any component to which a STIG may be attached. Assets are created and changed in the Collection Configuration screen. To conform to the Navy RMF Process, an Asset must have a Name, IP Address, MAC Address, and Fully Qualified Domain Name unless it is designated \"Non-Computing.\" The Asset Properties screen allows you to set all these properties, as well as attach STIGs.\r\n\r\n    checklist\r\n        The list of Rules that compose a STIG, and optionally, their Evaluations. Often encoded in the :term:`ckl` format. \r\n\r\n    ckl\r\n        An xml file format used by some common STIG tools. STIG Manager can import and export checklists in the .ckl format compatible with STIG Viewer and eMASS. \r\n        \r\n        STIG Manager maps its own data fields into and out of .ckl format as follows:\r\n\r\n        .. list-table:: STIG Manager <-> STIG Viewer <-> .ckl Mappings: \r\n            :widths: 20 20 40\r\n            :header-rows: 1\r\n            :class: tight-table\r\n\r\n            * - STIGMan Field\r\n              - STIG Viewer Field\r\n              - .ckl Tag\r\n            * - Evaluation Result\r\n              - Status\r\n              - <CHECKLIST><STIGS><iSTIG><VULN> **<STATUS>**\r\n            * - Detail\r\n              - Finding Detail \r\n              - <CHECKLIST><STIGS><iSTIG><VULN> **<FINDING_DETAILS>**\r\n            * - Comment \r\n              - Comments\r\n              - <CHECKLIST><STIGS><iSTIG><VULN> **<COMMENTS>**\r\n\r\n        .. note::\r\n            STIG Manager will import and export .ckl files differently depending on the values of certain .ckl elements and Asset metadata. See :ref:`ckl-processing` for more information. \r\n\r\n\r\n    Collection \r\n        The Collection is STIG Manager's primary organizational component.\r\n\r\n        Collections are composed of:\r\n\r\n            * :term:`Assets <Asset>`\r\n            * :term:`STIGs <STIG>` attached to those Assets\r\n            * :term:`Grants <Grant>` providing access to some or all of the Assets/STIGs in that Collection for a User or Group\r\n            * :term:`Reviews <Review>`\r\n            * Settings that control the behavior of the Collection, such as whether to require a Detail or Comment for each Review, Review History records, etc.\r\n            * :term:`Labels <Label>` that can be applied to Assets in the Collection.\r\n        \r\n        **Collections can be structured as an RMF Package, but do not need to be.** It is recommended that large packages be broken up into more easily-manageable Collections, to which Users can be granted higher access and, therefore, greater autonomy. \r\n\r\n    Evaluation\r\n        The Result or compliance state, either by a user or automated process, of a Review for a particular STIG Requirement on an Asset. \r\n\r\n    Finding\r\n        A :term:`Review` with a Result of Open.\r\n    \r\n    Grant\r\n        A Grant is a record of a User or User Group being given a Role in a Collection.  A User can have Grants in multiple Collections, and have different Roles in each Collection. Collection Owners or Managers can create/remove/modify Grants. :term:`Access Control List` rules can be applied to Grants to further refine the User's access to the Collection.  See :ref:`roles-and-access` for more information.\r\n\r\n    Grantee\r\n        The User or User Group that is the recipient of a Grant. See :ref:`roles-and-access` for more information.\r\n\r\n    Label\r\n        A Label is a user-defined tag that can be applied to Assets in a Collection. Labels can be used to filter Assets in the Collection Dashboard and other views, and can be used in Access Control Rules to restrict or enable access to Assets based on their Labels.\r\n\r\n    Review\r\n        A Review is the result of an Evaluation of a STIG Requirement that a User or automated tool has performed. These Reviews are composed of Review Evaluation Content and Status properties.  Each of these pieces carry an \"Attribution\" that includes the User that set that Content or Status and a timestamp indicating when they did so.  \r\n\t\t\r\n        * Review Evaluation Content - Requirements configured via Collection Settings.\r\n            * Result - Not a Finding, Not Applicable, Open, Informational, or Not Reviewed\r\n            * Detail - Details describing the selected Result. Available according to Collection Settings.\r\n            * Comment - Additional information included in the Review. Available according to Collection Settings. \r\n            * Result Sprites - Colored flags indicating whether the result originated from an automated scan or manual source. Hover over these sprites for more info. \r\n\t\t\t\r\n        * Status - The current state of the Review in the system. Configured via Collection Settings.\r\n            * Status Label - Saved, Submitted, Accepted, or Rejected (Depends on Collection Settings.)\r\n            * Status Text - Contextual text describing status change. Most often used when a Review is \"Rejected\" and requires further work by the original Evaluator.\r\n\t\t\r\n          * In order to be Submitted, the Evaluation must have a Result of \"Not A Finding,\" \"Not Applicable,\" or \"Open,\" and must meet any additional requirements set for that Collection. Hover over the ``(?)`` symbol for submission requirements. \r\n          * In order to be Rejected, the Owner must specify a Rejection Comment, providing direction to the Evaluator.\r\n\r\n    \tEach Review maintains a History, which is available to the User in the Review Resources panel. Contextual data such as the User who evaluated the Requirement, the user who set the Status of a Review, and timestamps for those actions are also collected.\r\n\r\n        The use of Review Status fields is **optional**, but many users find it handy to \"Save\" Reviews in progress, and then mark them \"Submitted\" when they consider it complete.  Collection Owners (or, optionally, Managers) then have the option to set an \"Accepted\" Status for Reviews they might submit as part of an RMF package, or \"Reject\" Reviews that are unsatisfactory in their current state, or needs clarification.  This Status will be visible to the User that evaluated the Review, and they can re-Submit the review once they have made changes.   \r\n\r\n        See our section on :ref:`Review Handling and Matching<review-handling>` for more information about how STIGMan tracks Reviews.\r\n\r\n    Role\r\n        A Role is a set of permissions that can be granted to a User or User Group in a Collection. Roles are used to determine what actions a User can perform in a Collection, and what default access they have to Assets and Reviews. \r\n\r\n        There are four Roles available in STIG Manager. Roles differ in the actions they can perform in a Collection, and their default Access to Assets and Reviews.  See :ref:`roles-and-access` for more information.\r\n\r\n\r\n    STIG\r\n        Secure Technical Implementation Guidelines published by the Defense Information Security Agency. STIGs are published in XCCDF format that can be imported into STIG Manager. Automated results in XCCDF format, such as those produced by the DISA SCC Tool, can also be imported. Manually evaluated STIG Results are often recorded in a .ckl file, a different format, which is produced by the DISA tool STIG Viewer, and can also be imported into STIG Manager. \r\n\t\t\r\n    User\r\n        Any User in STIG Manager can be assigned a grant that provides access to a Collection by the Collection Owner or Manager.\r\n\r\n        * When you grant Users access to your Collection, or when you are granted access to another Collection by someone else, that Collection will appear in the Nav Tree on the left upon refresh of the app. \r\n\r\n        For each Collection they are granted access to, Users can have one of 4 :term:`Roles <Role>` , providing different capabilities and default access to your Collection.  See :ref:`roles-and-access` for more information. \r\n\r\n        Users can also be given one of 2 **Privileges** on the STIG Manager system. These privileges can be administered in your Authentication Provider (such as Keycloak):\r\n            * Collection Creator: Gives the User the ability to create their own Collections in STIG Manager.\r\n            * Administrator (Application Manager): Gives the user the ability to invoke elevated access via the \"Application Management\" node of the Nav Tree. The Administrator Privilege allows the User to:\r\n\r\n                * Import new STIGs into STIG Manager, as well as Delete them.\r\n                * Enumerate, Create, and Delete Collections, and view a Collection's name and description.\r\n                * Create and modify Grants (without ACLs) on any Collection.\r\n                * Create and Alter Users and User Groups.\r\n                * Import and Export Application Data.\r\n                * The Administrator privilege does not grant access to collection content. An admin cannot read or write Reviews, access Asset or STIG checklist data, or modify a Collection's settings, labels, metadata, or Grant ACLs without holding a Collection Grant. These operations require a normal (non-elevated) request governed by a Grant.\r\n\r\n    User Group\r\n        A named collection of Users that can be granted access to a Collection as a single entity. User Groups can be created and modified in the User Groups interface available to Application Managers. User Groups are  available to all Collection Owners and Managers for use in the Grants panel.  See :ref:`roles-and-access` for more information.\r\n\r\n\r\n    XCCDF\r\n        An XML formatted schema for encoding STIGs and their Evaluations. \r\n\r\n        STIG Manager maps its own data fields into and out of XCCDF format as follows:\r\n\r\n        .. list-table:: STIG Manager <-> XCCDF Mappings: \r\n            :widths: 20 70\r\n            :header-rows: 1\r\n            :class: tight-table\r\n\r\n            * - STIGMan Field\r\n              - XCCDF Tag\r\n            * - Evaluation Result\r\n              - <TestResult><rule-result> **<result>**    \r\n            * - Detail\r\n              - <TestResult><rule-result> **<message>**\r\n            * - Comment \r\n              - <TestResult><rule-result> **<metadata action-comment>** \r\n\r\n        .. note::\r\n            The STIG Manager API supports all XCCDF rule result enumerations: fail, pass, notapplicable, notchecked, informational, error, notselected, unknown, and fixed. However, only the first 5 can be selected in the manual evaluation portions of the GUI. Those 5 results are mapped to display as Open, Not a Finding, Not Applicable, Not Reviewed, and Informational respectively, as these terms are commonly used during the RMF Process.  \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n"
  },
  {
    "path": "docs/requirements.txt",
    "content": "babel==2.16.0\r\nbuild==1.2.2.post1\r\ncertifi==2024.12.14\r\nchardet==5.2.0\r\ncharset-normalizer==3.4.1\r\nclick==8.1.8\r\ncolorama==0.4.6\r\ncolorclass==2.2.2\r\ncommonmark==0.9.1\r\ndocopt==0.6.2\r\ndocutils==0.21.2\r\nidna==3.10\r\nimagesize==1.4.1\r\nJinja2==3.1.6\r\nMarkdown==3.8.1\r\nmarkdown-it-py==3.0.0\r\nMarkupSafe==3.0.2\r\nmdit-py-plugins==0.4.2\r\nmdurl==0.1.2\r\nmyst-parser==4.0.0\r\npackaging==24.2\r\npip-review==1.3.0\r\npip-tools==7.4.1\r\npip-upgrader==1.4.15\r\nPygments==2.20.0\r\npyparsing==3.2.1\r\npyproject_hooks==1.2.0\r\npytz==2024.2\r\nPyYAML==6.0.2\r\nrequests==2.33.0\r\nsnowballstemmer==2.2.0\r\nsphinx==7.4.7\r\nsphinx-rtd-dark-mode==1.3.0\r\nsphinx-rtd-theme==3.0.2\r\nsphinx-tabs==3.4.7\r\nsphinxcontrib-applehelp==2.0.0\r\nsphinxcontrib-devhelp==2.0.0\r\nsphinxcontrib-htmlhelp==2.1.0\r\nsphinxcontrib-images==1.0.1\r\nsphinxcontrib-jquery==4.1\r\nsphinxcontrib-jsmath==1.0.1\r\nsphinxcontrib-qthelp==2.0.0\r\nsphinxcontrib-serializinghtml==2.0.0\r\nterminaltables==3.1.10\r\nurllib3==2.6.3\r\n"
  },
  {
    "path": "docs/the-project/DockerHub_Readme.md",
    "content": "# STIG Manager OSS on Docker Hub\n\nSTIG Manager is an API and Web client for managing the assessment of Information Systems for compliance with [security checklists](https://public.cyber.mil/stigs/) published by the United States (U.S.) Defense Information Systems Agency (DISA). STIG Manager supports DISA checklists [distributed](https://public.cyber.mil/stigs/downloads/) as either a Security Technical Implementation Guide (STIG) or a Security Requirements Guide (SRG).\n\n**Documentation:** [https://stig-manager.readthedocs.io/en/latest/](https://stig-manager.readthedocs.io/en/latest/)\n\n**Source:** [https://github.com/NUWCDIVNPT/stig-manager](https://github.com/NUWCDIVNPT/stig-manager)\n\n## Supported tags\n\nBuilt from the current HEAD of our `main` branch: \n  - `nuwcdivnpt/stig-manager:latest`\n    - uses the `node:lts-alpine` base image\n  - `nuwcdivnpt/stig-manager:latest-ironbank`\n    - uses the [Iron Bank Node.js base image](https://repo1.dso.mil/dsop/opensource/nodejs/nodejs18/)\n\n\nBuilt from a point release tag on our `main` branch:\n  - `nuwcdivnpt/stig-manager:<point-release>`\n    - uses the `node:lts-alpine` base image\n  - `nuwcdivnpt/stig-manager:<point-release>-ironbank`\n    - uses the [Iron Bank Node.js base image](https://repo1.dso.mil/dsop/opensource/nodejs/nodejs18/)\n  - For example, `nuwcdivnpt/stig-manager:1.5.2` or `nuwcdivnpt/stig-manager:1.5.2-ironbank`\n\n## Quick Start Orchestration\n\n**IMPORTANT: The Quick Start orchestration is not a production-ready deployment. It is offered as a basic example showing how the API can be configured to integrate with a MySQL instance and an OAuth2 Provider. It is offered for demonstration purposes only and is missing key features such as, but not limited to: CAC authentication, Active Directory integration, persistent data storage, MTLS database connections, logfile archiving, etc.**\n\n*The Quick Start steps require the [official MySQL 8 image](https://hub.docker.com/_/mysql) and a [custom Keycloak image](https://hub.docker.com/r/nuwcdivnpt/stig-manager-auth).*\n\n### docker-compose.yml\n```\n# STIG Manager docker-compose orchestration\n\nservices:\n  auth:\n    image: nuwcdivnpt/stig-manager-auth\n    ports:\n      - \"8080:8080\"\n  db:\n    image: mysql:8.0\n    ports:\n      - \"50001:3306\"\n    environment:\n      - MYSQL_ROOT_PASSWORD=rootpw\n      - MYSQL_USER=stigman\n      - MYSQL_PASSWORD=stigman\n      - MYSQL_DATABASE=stigman\n    command: --innodb-buffer-pool-size=1024M --sort_buffer_size=16M \n\n    cap_add:\n      - SYS_NICE  # workaround MySQL logging bug => mbind: Operation not permitted \n  api:\n    image: nuwcdivnpt/stig-manager:latest\n    environment:\n      - STIGMAN_OIDC_PROVIDER=http://auth:8080/realms/stigman\n      - STIGMAN_CLASSIFICATION=U\n      - STIGMAN_DB_HOST=db\n      - STIGMAN_DB_PASSWORD=stigman\n      # Change envvar below if non-localhost browsers will access the API\n      - STIGMAN_CLIENT_OIDC_PROVIDER=http://localhost:8080/realms/stigman\n      # Customize the Welcome widget on the Home tab\n      # - STIGMAN_CLIENT_WELCOME_IMAGE=<client-relative-url-to-your-logo>\n      - STIGMAN_CLIENT_WELCOME_TITLE=Deployment Information\n      - STIGMAN_CLIENT_WELCOME_MESSAGE=Your deployment's Support process can be described here. You can provide a link below.\n      - STIGMAN_CLIENT_WELCOME_LINK=http://link_to_help_pages\n\n    init: true\n    ports:\n      - \"54000:54000\"\n```\n### Steps\n- Create a ```docker-compose.yml``` file with the content above.\n- From the directory containing ```docker-compose.yml```, run:\n```\n$ docker-compose up -d && docker-compose logs -f\n```\n- STIG Manager will wait for MySQL and Keycloak to become ready\n- When MySQL is ready, STIG Manager will perform an initial migration and create the necessary schema objects.\n- When STIG Manager is ready to handle requests, it will output a JSON log entry similar to:\n```\n{\"date\":\"2022-02-18T18:25:50.749Z\",\"level\":3,\"component\":\"index\",\"type\":\"started\",\"data\":{\"durationS\":0.956811184,\"port\":\"54000\",\"api\":\"/api\",\"client\":\"/\",\"documentation\":\"/docs\",\"swagger\":\"/api-docs\"}}\n```\n- Navigate to ```http://localhost:54000```\n- Login using credentials \"admin/password\", as documented for [the demonstration Keycloak image](https://hub.docker.com/r/nuwcdivnpt/stig-manager-auth)\n- Refer to the documentation to create your first Collection\n\n## STIG Manager OSS Environment Variables\n\nRefer to our documentation for the [environment variables consumed by STIG Manager](https://stig-manager.readthedocs.io/en/latest/installation-and-setup/environment-variables.html) \n\n## STIG Manager Container Healthcheck\n\nThe container's Healthcheck starts 120 seconds after startup, and polls the API /op/configuration endpoint every 30 seconds for an acceptable status code.\n\n## Running as individual containers\n### Keycloak\n```\ndocker run --name stig-manager-auth \\\n  -p 8080:8080 \\\n  -p 8443:8443 \\\n  nuwcdivnpt/stig-manager-auth\n```\n\n### Mysql\n```\ndocker run --name stig-manager-db \\\n  -p 50001:3306 \\\n  -e MYSQL_ROOT_PASSWORD=rootpw \\\n  -e MYSQL_DATABASE=stigman \\\n  -e MYSQL_USER=stigman \\\n  -e MYSQL_PASSWORD=stigman \\\n  mysql:8 --innodb-buffer-pool-size=1024M --sort_buffer_size=16M\n```\n\n### API\n```\ndocker run --name stig-manager-api \\\n  -p 54000:54000 \\\n  -e STIGMAN_DB_HOST=<DATABASE_IP> \\\n  -e STIGMAN_DB_PORT=<DATABASE_PORT> \\\n  -e STIGMAN_OIDC_PROVIDER=http://<KEYCLOAK_IP>:<KEYCLOAK_PORT>/auth/realms/stigman \\\n  nuwcdivnpt/stig-manager\n```\n\n"
  },
  {
    "path": "docs/the-project/clients.rst",
    "content": ".. _clients:\r\n\r\n\r\nClients\r\n#############################################################\r\n\r\nThe STIG Manager project consists of an API and a UI. `The API is designed so that other contributors can create Clients, GUI or CLI, to take advantage of and expand on its capabilities. <https://github.com/NUWCDIVNPT/stig-manager/blob/main/api/source/specification/stig-manager.yaml>`_\r\n\r\n\r\nProvided Clients\r\n======================================\r\n\r\nSTIG Manager OSS Reference GUI\r\n---------------------------------\r\nA GUI client that makes use of the Project API is available in our Repo.  Its features are described elsewhere in this documentation. \r\n\r\nSee the client `README.md <https://github.com/NUWCDIVNPT/stig-manager/tree/main/client/README.md>`_ for more information on developing or building the client.\r\n\r\n\r\n\r\nSTIG Manager Watcher\r\n-------------------------\r\nA command-line client that will monitor a file-system directory and upload .ckl/.cklb or XCCDF results to a STIG Manager API instance: `STIG Manger Watcher. <https://github.com/NUWCDIVNPT/stigman-watcher>`_  It is maintained by the main STIGMan OSS dev group, and also available as `an npm package. <https://www.npmjs.com/package/stigman-watcher>`_  Check the gitHub repo's `wiki for further documentation. <https://github.com/NUWCDIVNPT/stigman-watcher/wiki>`_\r\n\r\nProposed Clients\r\n====================\r\nSeveral additional Clients may be found useful, but are not a priority for development by the STIG Manager OSS team at this time. Some potential ideas for these clients:\r\n\r\n    - A utility that checks for and fetches new STIGs from `DISA <https://public.cyber.mil/stigs/downloads/>`_ and imports them into STIG Manager. \r\n    - A utility to fetch and email regular reports to certain Users. \r\n    - A utility to facilitate some data exchange with the eMASS API directly, rather than have to use .ckl files as the mode of exchange. \r\n    - Analytics   \r\n    - Tools to update STIG Assessments based on published CVEs that affect appropriate controls\r\n    - Utility to import from an HBSS instance for STIG Evaluations\r\n\r\n\r\n\r\nCreate a new Client for the STIG Manager API\r\n==================================================\r\n\r\nThe STIG Manager API was created so that other clients could take advantage of the data it manages. `The API is fully defined using the OpenAPI 3.0.1 specification here. <https://github.com/NUWCDIVNPT/stig-manager/blob/main/api/source/specification/stig-manager.yaml>`_ \r\n\r\nClients will need to authenticate with the OpenID Connect Identity provider their target API is configured to use.  Particular authentication flows and configurations supported may vary by deployment. \r\n\r\n\r\nClient Development Resources\r\n==================================================\r\n\r\nThe STIG Manager team maintains a separate repository containing useful javascript modules for developing clients.  These modules are used in both the STIG Manager GUI and STIGMan Watcher, and are provided as a resource to assist the creation of clients that import checklist files or batch updates to the API. \r\n\r\nThese modules are available `in the stig-manager-client-modules repository. <https://github.com/NUWCDIVNPT/stig-manager-client-modules>`_  Check the gitHub repo's README.md and documentation for more specific information about using them.\r\n\r\n - `ReviewParser.js` Provides parsers for .ckl, .cklb, and XCCDF data.  These modules will process data in the checklist format specified, and return a JSON object that can be used to create or update Assets, STIG Assignments, and Reviews in the STIG Manager API. The parsers incorporate processing that will ensure Reviews conform to the Import Options specified by the target Collections in the API, if specified.  \r\n    - reviewsFromCkl\r\n    - reviewsFromCklb\r\n    - reviewsFromXccdf\r\n - `TaskObject.js` Takes parsed checklist data, as well as the current state of a Collection's Assets and the STIGs available in the system, and create a TaskObject. The TaskObject defines Assets and Assignments that need to be created or updated, as well as the Reviews that were identified in the parsed checklist data for those Assets.\r\n\r\n"
  },
  {
    "path": "docs/the-project/contributing.rst",
    "content": ".. _contributing:\r\n\r\n\r\nContribution Guide\r\n########################################\r\n\r\n\r\nReporting Bugs & Issues\r\n=============================\r\n\r\nPlease file bug reports or feature requests on the `STIG Manager \r\nissue tracker <https://github.com/NUWCDIVNPT/stig-manager/issues>`__. When reporting a bug, please provide as much detail as possible to help us understand and reproduce the issue. Include:\r\n\r\n-  Install type: Hosted, Local, Docker, etc\r\n-  Detailed steps to reproduce the issue\r\n-  Action taken\r\n-  Expected result\r\n-  Actual result\r\n-  Screenshots or logs (if relevant)\r\n-  Your environment details (OS, browser version, etc.)\r\n\r\n\r\nCode Contributions\r\n======================================\r\n\r\nSTIG Manager is being developed using a `Forking Workflow <https://www.atlassian.com/git/tutorials/comparing-workflows/forking-workflow>`_. All contributions to the codebase are expected to come via a GitHub Pull Request(PR) from a fork of the appropriate repository. \r\n\r\nContributors should be comfortable with the `licences <https://github.com/NUWCDIVNPT/stig-manager/blob/main/LICENSE.md>`__ governing the project and any other conditions specified in the Project's `Contributing.md <https://github.com/NUWCDIVNPT/stig-manager/blob/main/CONTRIBUTING.md>`_ document.\r\n\r\nTo ensure smooth integration and maintain project quality, please adhere to these guidelines:\r\n\r\n1. **Reference an Issue**: \r\n\r\n   - Every PR should reference an existing issue in the repository. \r\n   - If no relevant issue exists, create one describing the bug or feature you intend to address before submitting your PR.\r\n\r\n2. **Testing**: \r\n\r\n   - PRs should pass all existing tests.\r\n   - Provide additional tests for new features or bug fixes when applicable.\r\n   - If automated tests aren't suitable, include a clear testing procedure in your PR description.\r\n\r\n3. **First-time Contributors**:\r\n\r\n   - Add yourself to the `CONTRIBUTORS.md <https://github.com/NUWCDIVNPT/stig-manager/blob/main/CONTRIBUTORS.md>`_ file.\r\n   - By doing so, you agree to abide by the Developer's Certificate of Origin as outlined in `CONTRIBUTING.md <https://github.com/NUWCDIVNPT/stig-manager/blob/main/CONTRIBUTING.md>`_.\r\n   - A project maintainer will send an email to the address you provided in CONTRIBUTORS.md. You must respond to this email before your PR can be accepted.\r\n\r\n4. **Code Quality**:\r\n\r\n   - Follow the project's coding style and conventions.\r\n   - Write clear, self-documenting code with appropriate comments.\r\n   - Keep commits focused and use meaningful commit messages.\r\n\r\n5. **Documentation**:\r\n\r\n   - Update relevant documentation to reflect your changes.\r\n   - Include inline documentation for new code when necessary.\r\n\r\n6. **Review Process**:\r\n\r\n   - Be responsive to review comments and change requests.\r\n   - Make requested changes promptly or provide a clear explanation if you disagree.\r\n\r\n7. **PR Branch Permissions**:\r\n\r\n   - When creating a PR, enable the \"Allow edits from maintainers\" option. This gives project maintainers the ability to make updates to your PR if needed.   \r\n\r\n8. **Licensing**:\r\n\r\n   - Ensure your contributions comply with the project's `licenses <https://github.com/NUWCDIVNPT/stig-manager/blob/main/LICENSE.md>`_.\r\n\r\nPRs that meet these criteria will be reviewed by project maintainers. Upon successful review and email verification, contributions will be merged into the main branch.\r\n\r\nBefore contributing, please familiarize yourself with the project structure, coding standards, and development environment setup. If you have any questions or need clarification on any aspect of the contribution process, please open a discussion in the project's  `GitHub Discussions <https://github.com/NUWCDIVNPT/stig-manager/discussions>`_ area.\r\n\r\nWe appreciate your interest in contributing to STIG Manager and look forward to your contributions!\r\n\r\n\r\nDevelopment functional components\r\n======================================\r\n\r\nThis section outlines the main components of the STIG Manager project, their technologies, and current maintainers. We welcome contributions in all these areas. If you would like to contribute, check our  `Issues on GitHub <https://github.com/NUWCDIVNPT/stig-manager/issues>`__ for items labeled `good first issue <https://github.com/NUWCDIVNPT/stig-manager/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22>`__, or for specific areas you would like to help with. \r\n\r\n\r\n.. list-table:: **API**\r\n   :widths: 20 20 10 40 10\r\n   :header-rows: 1\r\n   :class: tight-table\r\n\r\n   * - Component\r\n     - Technology\r\n     - Maintainers\r\n     - Roadmap Goals\r\n     - GitHub Label(s)\r\n   * - API definition\r\n     - OpenAPI 3.0\r\n     - @csmig\r\n     - - Refine API Definition to enable automated validation of API responses. \r\n       - Update to OpenAPI Spec 3.1 when suitable middleware support is available. \r\n     - `OAS <https://github.com/NUWCDIVNPT/stig-manager/issues?q=is%3Aissue+is%3Aopen+label%3AOAS>`__\r\n   * - Express middleware\r\n     - | Node.js\r\n       | Express\r\n     - @csmig\r\n     - - Identify suitable middleware replacement for oas-tools, which does not seem well supported at the moment, and includes unneeded dependencies. \r\n     - | `API <https://github.com/NUWCDIVNPT/stig-manager/issues?q=is%3Aopen+is%3Aissue+label%3AAPI>`__\r\n       | `dependencies <https://github.com/NUWCDIVNPT/stig-manager/issues?q=is%3Aopen+is%3Aissue+label%3Adependencies>`__\r\n   * - MySQL service\r\n     - | Node.js\r\n       | MySQL 8\r\n     - @csmig\r\n     - - Keep in sync with MSSQL Server service, which is the primary development focus at the moment. \r\n     - | `DB <https://github.com/NUWCDIVNPT/stig-manager/issues?q=is%3Aopen+is%3Aissue+label%3ADB>`__\r\n       | `API <https://github.com/NUWCDIVNPT/stig-manager/issues?q=is%3Aopen+is%3Aissue+label%3AAPI>`__\r\n   * - Microsoft SQL Server service\r\n     - | Node.js\r\n       | MSSQL 2019\r\n     - @csmig\r\n     - - Implementation of MS SQL Server service to match or exceed current MySQL feature support.\r\n     - | `DB <https://github.com/NUWCDIVNPT/stig-manager/issues?q=is%3Aopen+is%3Aissue+label%3ADB>`__\r\n       | `API <https://github.com/NUWCDIVNPT/stig-manager/issues?q=is%3Aopen+is%3Aissue+label%3AAPI>`__\r\n   * - Test suites\r\n     - | Mocha\r\n       | Chai\r\n       | Chai-http\r\n     - @cd-rite\r\n     - - Automated UI Testing\r\n       - Help would be appreciated identifying additional test cases. \r\n     - `tests <https://github.com/NUWCDIVNPT/stig-manager/issues?q=is%3Aopen+is%3Aissue+label%3Atests>`__\r\n   * - CI/CD pipelines\r\n     - | GitHub Actions\r\n       | Docker\r\n     - | @cd-rite\r\n       | @csmig\r\n     - - Integration of additional automated security scanning. \r\n     - `workflow <https://github.com/NUWCDIVNPT/stig-manager/issues?q=is%3Aopen+is%3Aissue+label%3Aworkflow>`__\r\n   * - Documentation\r\n     - | Python\r\n       | sphinx\r\n     - @cd-rite\r\n     - - Addition and integration of JSDoc notation to code and documentation. \r\n     - `documentation <https://github.com/NUWCDIVNPT/stig-manager/issues?q=is%3Aopen+is%3Aissue+label%3Adocumentation>`__\r\n\r\n     \r\n\r\n.. list-table:: **Clients**\r\n   :widths: 20 20 10 40 10\r\n   :header-rows: 1\r\n   :class: tight-table\r\n\r\n   * - Component\r\n     - Technology\r\n     - Maintainers\r\n     - Goals\r\n     - GitHub Label(s)\r\n   * - NAVSEA single-page web app\r\n     - ExtJS 3.4\r\n     - @csmig\r\n     - - Additional reports and analytical presentations of STIGMan data.\r\n     - `UI <https://github.com/NUWCDIVNPT/stig-manager/issues?q=is%3Aopen+is%3Aissue+label%3AUI>`__     \r\n   * - `STIGMAN Watcher <https://github.com/NUWCDIVNPT/stigman-watcher>`__\r\n     - | Node.js\r\n     - @csmig\r\n     - - Report of logged Watcher actions.\r\n     - `Issues <https://github.com/NUWCDIVNPT/stigman-watcher/issues>`__     \r\n   * - Documentation\r\n     - | Python\r\n       | sphinx\r\n     - | @cd-rite\r\n       | @csmig\r\n     - - There is always more documentation to write. \r\n     - `documentation <https://github.com/NUWCDIVNPT/stig-manager/issues?q=is%3Aopen+is%3Aissue+label%3Adocumentation>`__     \r\n   * - Integration with other services\r\n     - Varied\r\n     - | @cd-rite\r\n       | @csmig\r\n     - - Integrations with other services to enhance functionality, such as blob storage services for artifact storage, or Machine Learning for automated review approvals. \r\n     - `enhancement <https://github.com/NUWCDIVNPT/stig-manager/issues?q=is%3Aopen+is%3Aissue+label%3Aenhancement>`__          \r\n\r\n\r\nData Flow Diagram\r\n---------------------------\r\n\r\n.. thumbnail:: /assets/images/data-flow-01b.svg\r\n  :width: 75%\r\n  :show_caption: True \r\n  :title: Data Flow Diagram\r\n\r\n\r\nRequired Tools\r\n-----------------\r\n\r\nThe team regularly uses these tools:\r\n\r\n  - git: For version control\r\n  - Docker: For containerization and testing\r\n  - VS Code: Recommended IDE for development\r\n  - Node.js: For running the application and tests\r\n  - Mocha, Chai, Chai-http: For writing and running tests\r\n\r\n\r\nSoftware Components\r\n-----------------------\r\n\r\nSee :ref:`requirements-and-dependencies` and :ref:`project-description` for more information about project components and dependencies.\r\n\r\n\r\nLicenses\r\n-----------------\r\n\r\nThe repository is licensed under the `MIT License <https://github.com/NUWCDIVNPT/stig-manager/blob/main/LICENSE.md>`__, with the exception of the client, which is licensed under the `GNU GPL\r\nv3 <https://github.com/NUWCDIVNPT/stig-manager/blob/main/LICENSE.md>`__.\r\n\r\n"
  },
  {
    "path": "docs/the-project/documentation.rst",
    "content": ".. _documentation:\r\n\r\n\r\nDocumentation\r\n########################################\r\n\r\n\r\nThe STIG Manager OSS Documentation is written in reStructuredText. Sphinx and the Read The Docs theme is used to generate the site, which is located in the project repo and hosted on Read The Docs: `stig-manager.readthedocs.io <https://stig-manager.readthedocs.io/>`_ \r\n\r\n\r\nDocumentation Build\r\n----------------------\r\n\r\nBuild with Docker\r\n+++++++++++++++++++++\r\n\r\n#. Clone the STIG Manager repository from GitHub.\r\n#. Navigate to /docs folder of the repository. \r\n#. Build the Docker image using the following command: ``docker build -t sphinx-w-requirements .``\r\n#. Run the Docker image using the following command: ``docker run --rm -v \"$(pwd):/docs\" sphinx-w-requirements``\r\n#. The build product is located in ``_build`` in the docs directory.\r\n\r\nAlternatively, you can run the ``build.sh`` script located in the /docs directory of the repository. This script will build the Docker image and run the container, generating the documentation.\r\n\r\nBuild with Python\r\n+++++++++++++++++++++\r\n\r\nTo build the documentation locally:\r\n\r\n#. Clone the STIG Manager repository from GitHub.\r\n#. Install Python\r\n#. Install Sphinx ``pip install sphinx``\r\n#. Navigate to /docs folder of the repository. \r\n#. Install the documentation build requirements ``pip install -r requirements.txt``\r\n#. Depending on the OS you are using, build the documentation using make.bat or the Makefile, and specify html as the format. Windows PowerShell example: ``./make html``\r\n\r\nBy default, the build product is located in ``_build`` in the docs directory. \r\n\r\n\r\n\r\n\r\n"
  },
  {
    "path": "docs/the-project/examples.rst",
    "content": ".. _examples:\r\n\r\n\r\nExamples and Sample Data\r\n#############################################################\r\n\r\n\r\nThis document lists examples and sample data resources maintained by the STIG Manager Team.  These examples are intended to demonstrate the functions of the project, and should not be used for Production Deployments without modification. \r\n\r\n\r\n\r\nSample Data\r\n===================\r\n\r\n`Sample data to populate STIG Manager with an assortment of generated Collections, Assets, STIG Assignments, and Reviews is available in our repo. <https://github.com/NUWCDIVNPT/stig-manager/tree/main/data/appdata>`_\r\n\r\nLoad this data with the feature described here :ref:`app-data`\r\n\r\n\r\n\r\nContainers\r\n======================================\r\n\r\nThe STIG Manager project delivers the application in the form of two container images on Docker Hub. \r\nSeveral sample containers and Docker orchestrations are also provided to easily bring the App up in demonstration or test configurations. \r\n\r\n\r\nSTIGMan OSS\r\n--------------\r\n\r\nalpine Image\r\n~~~~~~~~~~~~~\r\n\r\nBased on the latest `NodeJS LTS alpine Linux base image: <https://hub.docker.com/_/node/>`_\r\n\r\n`STIGMan OSS based on alpine linux <https://hub.docker.com/r/nuwcdivnpt/stig-manager>`_\r\n\r\n\r\nIron Bank Image\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nIron Bank images are hardened images produced by a Department of Defense effort and `available to the public here. <https://repo1.dso.mil/>`_\r\n\r\nThe Image we make available on Docker Hub is based on the `latest image available here. <https://repo1.dso.mil/dsop/opensource/nodejs/nodejs18/-/tree/master>`_\r\n\r\n`STIGMan OSS based on Iron Bank NodeJS LTS (RHEL UBI) <https://hub.docker.com/r/nuwcdivnpt/stig-manager>`_\r\n\r\n\r\nKeycloak\r\n==============\r\n\r\n`Sample Keycloak configured for Username/Password <https://hub.docker.com/r/nuwcdivnpt/stig-manager-auth>`_\r\n\r\nMySQL\r\n=================\r\n\r\nThe standard `MySQL Image available on Docker Hub <https://hub.docker.com/_/mysql>`_ will work, when started with Environment Variables specified in the Sample Orchestration below. \r\n\r\n\r\n\r\n\r\nSTIG Manager Orchestration with nginx, Keycloak, and CAC Authentication\r\n=============================================================================\r\n\r\nThe STIG Manager OSS team maintains a repository on GitHub with a sample orchestration that includes nginx and Keycloak implementing TLS and CAC Authentication: `<https://github.com/NUWCDIVNPT/stigman-orchestration>`_\r\n\r\n\r\n\r\n\r\n"
  },
  {
    "path": "docs/the-project/index.rst",
    "content": "\r\n.. _the-project:\r\n\r\nThe STIG Manager Project\r\n#####################################\r\n\r\n\r\n\r\n.. meta::\r\n  :description: Information about the STIG Manager project itself.\r\n\r\nThese pages describe the STIG Manager project.\r\n\r\n.. note:\r\n   This section is still under development.\r\n\r\n\r\n.. toctree::\r\n\t:maxdepth: 1\r\n\t:caption: Contents:\r\n\r\n\tproject-description\r\n\tcontributing\r\n\ttesting\r\n\tdocumentation\r\n\texamples\r\n\trequirements-and-dependencies\r\n\tclients\r\n\trelated-repos\r\n\tDockerHub_Readme.md\r\n\r\n\r\nSTIG Manager is an active, Open Source project maintained by NUWCDIVNPT\r\n========================================================================\r\n\r\nSTIG Manager is actively under development. Get the latest info here: `STIG Manager <https://github.com/NUWCDIVNPT/stig-manager/>`_\r\n\r\n\r\nSTIG Manager is participating in the `Code.mil Open Source initiative <https://code.mil/>`_.\r\n\r\nThe STIG Manager project is chiefly composed of the STIG Manager API and the STIG Manager Client. `The STIG Manager API provides a well-defined programmatic interface for engaging with the resources and data it maintains. <https://github.com/NUWCDIVNPT/stig-manager/blob/main/api/source/specification/stig-manager.yaml>`_ The STIG Manager Client is just one use of the API that this architecture enables. In a modern, open source microservice-oriented ecosystem, other developers will be able to contribute new utilities and services that will expand functionality. User Stories, Feature Requests, Bugs, and Issues will be tracked in GitHub to help determine future efforts. \r\n\r\n\r\nSTIG Manager Operations\r\n----------------------------------\r\n\r\nSTIG Manager is a modern, containerized application built to take full advantage of a CI/CD DevOps pipeline. Updates to STIG Manager will trigger automatic testing and image creation. Organizations will have the option to engage with the pipeline to automatically deploy new versions to their test environments, or directly to production.\r\n\r\n\r\n\r\n\r\n|\r\n\r\n"
  },
  {
    "path": "docs/the-project/project-description.rst",
    "content": ".. _project-description:\r\n\r\n\r\nProject Description and Resources\r\n########################################\r\n\r\n\r\nThis document describes the purpose, requirements, deliverables, artifacts, tools, resources, and technologies that contribute to the STIG Manager Project. \r\nAll project materials, including this document, are available from the `Project Repository on GitHub. <https://github.com/NUWCDIVNPT/stig-manager>`__ \r\n\r\nPurpose\r\n=====================\r\n\r\nSTIG Manager is an Open Source API and Web app for managing the assessment of Information Systems for compliance with security checklists published by the United States (U.S.) Defense Information Systems Agency (DISA).  STIG Manager supports the RMF process by managing STIG assessments throughout the lifecycle of a system. Data owners can expose assessment data using role-based access controls and track the progress of their assessment teams. By serving as the single source of truth about Assets, STIGs, and their current assessment status, STIG Manager enables an efficient and auditable RMF Process.  \r\n\r\nThe STIG Manager OSS Project is developed under a DoD initiative to create and maintain cloud-ready Open Source software with a fully-defined API, reference clients, documentation, and other needed resources. \r\n\r\nAll source code and materials are tracked and available on GitHub in the Project Repository.  The Project repository is the authoritative source for all project materials.  All project materials are licensed under the `MIT License <https://github.com/NUWCDIVNPT/stig-manager/blob/main/LICENSE.md>`__, with the exception of the client, which is licensed under the `GNU GPL v3 <https://github.com/NUWCDIVNPT/stig-manager/blob/main/LICENSE.md>`__.\r\n\r\nThe Project maintainers and contributors comply with the policies specified in the `Project's CONTRIBUTING.md document and the Developer's Certificate of Origin (DCO). <https://github.com/NUWCDIVNPT/stig-manager/blob/main/CONTRIBUTING.md>`__\r\n\r\nProject maintainers regularly engage and consult with the user community to solicit feedback, ensure the project is meeting the needs of the user community, and develop ideas for future feature development.\r\n\r\n\r\nAssets and Resources Maintained\r\n===================================\r\n\r\n\r\n**Deliverable Artifacts:**\r\n\r\n- OpenAPI 3.1 Specification\r\n\r\n  - Fully defined OpenAPI 3.1 Specification \r\n  - Fully defined to validate both request and response objects\r\n  - Appropriate scopes and endpoint security definitions\r\n\r\n- Web Application \r\n\r\n  - Reference UI client making significant use of API endpoints\r\n  - STIG Manager: https://github.com/NUWCDIVNPT/stig-manager\r\n\r\n- Command Line Utilities\r\n\r\n  - Reference CLI client for automating .ckl or XCCDF imports\r\n  - STIGMan Watcher: https://github.com/NUWCDIVNPT/stigman-watcher\r\n\r\n- Containers\r\n\r\n  - Docker Hub: https://hub.docker.com/u/nuwcdivnpt\r\n  - Iron Bank: https://repo1.dso.mil/dsop/opensource/stig-manager\r\n\r\n- Executables\r\n\r\n  - STIG Manager: https://github.com/NUWCDIVNPT/stig-manager\r\n  - STIGMan Watcher: https://github.com/NUWCDIVNPT/stigman-watcher\r\n\r\n- Sample Orchestration\r\n\r\n  - STIG Manager Demonstration Orchestration: https://github.com/NUWCDIVNPT/stigman-orchestration\r\n\r\n- Documentation\r\n\r\n  - Continuous Documentation updates included as part of Project Repository\r\n  - Publicly hosted on ReadTheDocs: https://stig-manager.readthedocs.io/en/latest/the-project/project-description.html\r\n  - Security Policy\r\n  - Deployment guidance\r\n  - Extensive deployment security and STIG assessment guidance to assist in ATO process.\r\n  - User Guides and Tutorials on YouTube\r\n\r\n\t\t\r\n**Automated Workflows**\r\n\r\n- Comprehensive API endpoint testing spanning all user grants and privileges\r\n- API response validation testing\r\n- Automated delivery to Docker, Iron Bank, and other platforms\r\n- Security scanning\r\n\r\n\r\n**Comprehensive Documentation and User Guide Materials**\r\n\r\n- Public Documentation website: https://stig-manager.readthedocs.io\r\n- Tutorial videos on Youtube: https://www.youtube.com/@stigmanager8057/videos\r\n\r\n**Deployment and Developer Resources**\r\n\r\n- Sample orchestration demonstrating functionality with DoD CAC, reverse proxy, Keycloak realm\r\n- Sample command-line client utilities\r\n\r\n**Management and Engagement on Flank Speed Teams**\r\n\r\n- Weekly Office Hours open to all interested parties\r\n- User/Deployer queries\tin Help channel\r\n- Release Announcements\r\n\r\n\r\n\r\nProducts, Systems, Tools and Methods Used\r\n=================================================\r\n\r\n**Languages and Frameworks**\r\n\r\n-  Javascript\r\n-  NodeJS\r\n-  Express\r\n-  ExtJS 3.4+\r\n-  Sphinx Document Generation\r\n\r\n\r\n**Database**\r\n\r\n-  MySQL\r\n\r\n\r\n**Operating Systems and Environments**\r\n\r\n-  Linux\r\n-  Docker\r\n-  Open Container Initiative (OCI) Images\r\n-  Cloud-Ready Container Images and Deployment Options\r\n\r\n\r\n**Commercial Off the Shelf Products, Standards, Processes, and Knowledge Areas**\r\n\r\n-  GitHub\r\n-  GitHub Codespaces\r\n-  GitHub Actions\r\n-  Docker\r\n-  Docker Compose\r\n-  Keycloak\r\n-  OAuth 2.0\r\n-  OIDC\r\n-  OpenAPI 3.0+\r\n-  Azure\r\n-  Keycloak\r\n-  Mocha\r\n-  Chai\r\n-  Chai-http\r\n-  DoD Iron Bank\r\n-  npm\r\n-  git\r\n-  ReStructured Text\r\n-  JSON Structured Logging\r\n-  ReadTheDocs\r\n-  Visual Studio Code\r\n-  XCCDF\r\n-  STIG Viewer features \r\n-  STIG Viewer .ckl format\r\n-  RMF Process and requirements\r\n-  API First development\r\n-  Agile Development\r\n-  code.mil guidelines\r\n-  code.gov guidelines\r\n-  DoD Software Development and Open Source Software guidelines\r\n-  18F Open Source Policy guidelines\r\n-  DoD Enterprise DevSecOps Reference Design (2022) guidelines\r\n-  Application Security and Development STIG\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n"
  },
  {
    "path": "docs/the-project/related-repos.rst",
    "content": ".. _related-repos-doc:\r\n\r\n\r\nRelated Repositories\r\n#############################################################\r\n\r\n`The STIG Manager OSS API is designed and documented such that additional clients can be developed to enhance its utility for users. <https://github.com/NUWCDIVNPT/stig-manager/blob/main/api/source/specification/stig-manager.yaml>`_\r\n\r\nThe STIG Manager OSS project provides the main reference UI Client, described in this documentation, as part of the main repository on GitHub.\r\n\r\nIf other projects want to contribute a client or other stand-alone enhancements to the tool, create a Pull Request and we will link to them here.\r\n\r\n\r\n\r\nSTIGMan Watcher\r\n===========================\r\n\r\nThe STIG Manager Watcher utility is separately maintained by a member of the NUWCDIVNPT STIG Manager team, and serves as the reference Command Line Utility. It is a Node.js app that will monitor a specific folder for .ckl or XCCDF .xml files and automatically import them into a designated Collection. \r\n\r\nSee the `STIGMan Watcher Repo <https://github.com/NUWCDIVNPT/stigman-watcher>`_ for more details. \r\n\r\n\r\nSTIGMan Orchestration\r\n===========================\r\n\r\nThe STIG Manager Demonstration Orchestration offers a sample configuration for a deployment of STIG Manager that offers CAC-Authentication with an nginx reverse proxy, as well as pre-configured Keycloak OIDC Authentication and MySql Database containers. \r\n\r\n\r\nSee the `STIGMan Orchestration <https://github.com/NUWCDIVNPT/stigman-orchestration>`_ for more details. \r\n\r\n\r\nSTIGMan Client Modules\r\n==================================================\r\n\r\nThe STIG Manager team maintains a separate repository containing useful javascript modules for developing clients.  These modules are used in both the STIG Manager GUI and STIGMan Watcher, and are provided as a resource to assist the creation of clients that import checklist files or batch updates to the API. \r\n\r\nThese modules are available `in the stig-manager-client-modules repository. <https://github.com/NUWCDIVNPT/stig-manager-client-modules>`_  Check the gitHub repo's README.md and documentation for more specific information about using them.\r\n\r\n - `ReviewParser.js` Provides parsers for .ckl, .cklb, and XCCDF data.  These modules will process data in the checklist format specified, and return a JSON object that can be used to create or update Assets, STIG Assignments, and Reviews in the STIG Manager API. The parsers incorporate processing that will ensure Reviews conform to the Import Options specified by the target Collections in the API, if specified.  \r\n    - reviewsFromCkl\r\n    - reviewsFromCklb\r\n    - reviewsFromXccdf\r\n - `TaskObject.js` Takes parsed checklist data, as well as the current state of a Collection's Assets and the STIGs available in the system, and create a TaskObject. The TaskObject defines Assets and Assignments that need to be created or updated, as well as the Reviews that were identified in the parsed checklist data for those Assets.\r\n\r\n\r\n"
  },
  {
    "path": "docs/the-project/requirements-and-dependencies.rst",
    "content": ".. _requirements-and-dependencies:\r\n\r\n\r\nRequirements and Dependencies\r\n#############################################\r\n\r\nSTIG Manager is under active development. Only the latest `release <https://github.com/NUWCDIVNPT/stig-manager/releases>`_ will be supported. If you experience any problems, we encourage you to make sure you are running the latest release before creating an issue. \r\n\r\n\r\nRequirements\r\n======================================\r\n\r\nSoftware Requirements\r\n------------------------\r\n- Node.js LTS\r\n- MySql 8.0.24+\r\n- OIDC Provider (Such as RedHat Keycloak 19+)\r\n\r\n\r\nTested with:\r\n\r\n- Docker 20.10.2\r\n- NodeJs provided by node:lts-alpine image on Docker Hub\r\n- MySQL - latest 3 minor versions of the MySQL 8.0.x series available on Docker Hub.\r\n- RedHat Keycloak 19+\r\n\r\n.. note::\r\n  The STIG Manager API itself is stateless, and persists no data. All application data is stored in the deployer-provided MySQL database. Responsibility for data security and backup is entirely the responsibility of the deployer maintaining the database. \r\n  Likewise, the OIDC Provider is responsible for user authentication and authorization, and the deployer is responsible for the security and backup of the OIDC Provider.\r\n\r\n\r\nDependencies\r\n======================================\r\n\r\nPlease see the `package-lock.json file in our repo. <https://github.com/NUWCDIVNPT/stig-manager/blob/main/api/source/package-lock.json>`_\r\n\r\n\r\n\r\n\r\n\r\n"
  },
  {
    "path": "docs/the-project/testing.rst",
    "content": ".. _testing:\r\n\r\n\r\nAPI Testing Guide\r\n########################################\r\n\r\n\r\nThe STIG Manager project currently tests its API using a Mocha/Chai/Chai-HTTP and specific test data, which can be found in the repo.\r\n\r\nThe tests are run automatically with Mocha via github actions whenever a Pull Request is made to the project.\r\n\r\nThe tests focus on proper functioning of the API, and verification that appropriate data is returned to Users.\r\nThe tests run in several iterations, simulating Users accessing the system with varying privileges, Grants, Roles and ACLs, and checks that they can only receive and alter appropriate data.\r\n\r\n\r\n\r\nRunning the API Tests Locally\r\n=============================================\r\n\r\nSee the test `README.md <https://github.com/NUWCDIVNPT/stig-manager/tree/main/test/api/README.md>`_ for more information on running the tests and test data."
  },
  {
    "path": "docs/user-guide/Stig-Manager-Asset-Batch-Import.csv",
    "content": "Name,Description,IP,FQDN,MAC,Non-Computing,STIGs,Labels,Metadata\nAsset 1,Asset1 Description,1.1.1.1,Asset-1.f.q.d.n,AB-12-AB-12-AB,TRUE,\"VPN_SRG_TEST\nWindows_10_STIG_TEST\",\"Label1\nLabel2\nLabel3\nLabel5 \",\"{\"\"key:3\"\":\"\"value:3\"\"}\"\nAsset 2,,,,,,,,\n"
  },
  {
    "path": "docs/user-guide/index.rst",
    "content": "\r\n.. _user-guide-index:\r\n\r\nFor Users\r\n==========\r\n\r\n.. meta::\r\n  :description: These pages describe how to use STIG Manager.\r\n\r\nThese pages describe how to use STIG Manager.\r\n\r\n.. note:\r\n   This section is still under development.\r\n\r\n\r\n.. toctree::\r\n\t:numbered: 5\r\n\t:maxdepth: 3\r\n\t:caption: Contents:\r\n\r\n\r\n\t\t\r\n\tuser-quickstart\r\n\tuser-guide\r\n\troles-and-access\r\n\treview-handling\r\n\trule-exceptions\r\n\t\r\n\t\r\n\t"
  },
  {
    "path": "docs/user-guide/republished-rules.csv",
    "content": "\"Rule\",\"STIG Revisions (date)\"\r\nSV-205740r569188_rule,\"Windows_Server_2019_STIG-2-1(2020-11-13) || Windows_Server_2019_STIG-2-2(2021-05-04) || Windows_Server_2019_STIG-2-3(2021-11-01) || Windows_Server_2019_STIG-2-4(2022-05-31)\"\r\nSV-220699r569187_rule,\"Windows_10_STIG-2-1(2020-11-13) || Windows_10_STIG-2-2(2021-05-04) || Windows_10_STIG-2-3(2021-11-01) || MS_Windows_10_STIG-2-4(2022-05-31)\"\r\nSV-222602r561263_rule,\"Application_Security_Development_STIG-5-1(2020-10-23) || Application_Security_Development_STIG-5-2(2022-10-27)\"\r\nSV-222605r561266_rule,\"Application_Security_Development_STIG-5-1(2020-10-23) || Application_Security_Development_STIG-5-2(2022-10-27)\"\r\nSV-224864r569186_rule,\"Windows_Server_2016_STIG-2-1(2020-11-13) || Windows_Server_2016_STIG-2-2(2021-05-04) || Windows_Server_2016_STIG-2-3(2021-11-01) || Windows_Server_2016_STIG-2-4(2022-05-31) || Windows_Server_2016_STIG-2-5(2022-11-14)\"\r\nSV-224865r569186_rule,\"Windows_Server_2016_STIG-2-1(2020-11-13) || Windows_Server_2016_STIG-2-2(2021-05-04) || Windows_Server_2016_STIG-2-3(2021-11-01) || Windows_Server_2016_STIG-2-4(2022-05-31) || Windows_Server_2016_STIG-2-5(2022-11-14)\"\r\nSV-224971r569186_rule,\"Windows_Server_2016_STIG-2-1(2020-11-13) || Windows_Server_2016_STIG-2-2(2021-05-04) || Windows_Server_2016_STIG-2-3(2021-11-01) || Windows_Server_2016_STIG-2-4(2022-05-31)\"\r\nSV-228852r559734_rule,\"Palo_Alto_Networks_ALG_STIG-2-1(2020-10-23) || Palo_Alto_Networks_ALG_STIG-2-2(2021-07-23) || Palo_Alto_Networks_ALG_STIG-2-3(2022-10-27)\"\r\nSV-230768r599842_rule,\"Apple_macOS_11_STIG-1-1(2020-11-20) || Apple_macOS_11_STIG-1-2(2021-04-23) || Apple_macOS_11_STIG-1-3(2021-07-23) || Apple_macOS_11_STIG-1-4(2021-10-27) || Apple_macOS_11_STIG-1-5(2022-01-27) || Apple_macOS_11_STIG-1-6(2022-04-27)\"\r\nSV-230790r599842_rule,\"Apple_macOS_11_STIG-1-1(2020-11-20) || Apple_macOS_11_STIG-1-2(2021-04-23) || Apple_macOS_11_STIG-1-3(2021-07-23) || Apple_macOS_11_STIG-1-4(2021-10-27) || Apple_macOS_11_STIG-1-5(2022-01-27) || Apple_macOS_11_STIG-1-6(2022-04-27) || Apple_macOS_11_STIG-1-7(2023-01-26)\"\r\nSV-230813r599842_rule,\"Apple_macOS_11_STIG-1-1(2020-11-20) || Apple_macOS_11_STIG-1-2(2021-04-23) || Apple_macOS_11_STIG-1-3(2021-07-23) || Apple_macOS_11_STIG-1-4(2021-10-27) || Apple_macOS_11_STIG-1-5(2022-01-27) || Apple_macOS_11_STIG-1-6(2022-04-27)\"\r\nSV-230820r599842_rule,\"Apple_macOS_11_STIG-1-1(2020-11-20) || Apple_macOS_11_STIG-1-2(2021-04-23) || Apple_macOS_11_STIG-1-3(2021-07-23) || Apple_macOS_11_STIG-1-4(2021-10-27) || Apple_macOS_11_STIG-1-5(2022-01-27) || Apple_macOS_11_STIG-1-6(2022-04-27) || Apple_macOS_11_STIG-1-7(2023-01-26)\"\r\nSV-233295r604135_rule,\"Juniper_Router_RTR_STIG-2-1(2021-01-22) || Juniper_Router_RTR_STIG-2-3(2022-04-27) || Juniper_Router_RTR_STIG-2-4(2022-07-27)\"\r\nSV-233298r604135_rule,\"Juniper_Router_RTR_STIG-2-1(2021-01-22) || Juniper_Router_RTR_STIG-2-3(2022-04-27) || Juniper_Router_RTR_STIG-2-4(2022-07-27)\"\r\nSV-242469r717088_rule,\"VMW_vSphere_6-7_Virtual_Machine_STIG-1-1(2021-03-09) || VMW_vSphere_6-7_Virtual_Machine_STIG-1-2(2022-02-08)\"\r\n"
  },
  {
    "path": "docs/user-guide/review-handling.rst",
    "content": ".. _review-handling:\r\n\r\n\r\nSTIG Review Handling and Matching\r\n########################################\r\n\r\n\r\nSTIG Manager treats STIGs as checklists broken out into hundreds of individual Rules.  These Rules include Check Content elements that describe the actual check that must be performed to Evaluate the Rule. \r\n\r\n**Each Review for a Rule is tracked using a key created from the Check Contents and Version of the Rule being evaluated, independent of a specific STIG. This allows STIG Manager to track Reviews across STIG revisions as long as the Check Content has stayed the same.**\r\n\r\nWhen DISA Reference STIG releases are imported into STIG Manager, the Check Content is recorded for each Rule in that revision.  When viewing Review workspaces, STIG Manager will present the Rules contained in the selected STIG Revision, and all the Reviews that are attached to those Rule's specific keys.\r\n\r\n**This behavior lets a large proportion of Reviews that were performed with the previous STIG Revision to be presented when viewing the new STIG Revision. Reviewers will only need to perform Reviews on the Rules that have been added or where the actual Check they are performing has changed.**\r\n\r\n.. note::\r\n  To be exactly technical, STIG Manager uses a combination of the following identifiers to track Reviews:\r\n    - Rule \"Version\" (often called \"STIG Id\")\r\n    - The Rule's check content, in the form of a unique SHA-256 digest of that Check Content.\r\n\r\n\r\n\r\nReview Handling Comparison with STIG Viewer\r\n=======================================================\r\n\r\nSTIG Viewer can perform a similar function, matching the left-hand component of the RuleIds in older .ckl files and applying them to Rules in the current STIG. Our Sponsor and Users have rejected that approach because it applies Reviews to Rules even if the Check Content was changed. They have funded the more sophisticated approach taken by STIG Manager, that looks at whether or not the actual Check Content for a Rule has changed between Revisions.\r\n\r\nThe STIG Viewer User Guide cautions against using their matching feature too freely, and mentions the specific use case that STIG Manager addresses with its approach:\r\n\r\n.. thumbnail:: /assets/images/stig-viewer-user-guide.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: STIG Viewer User Guide\r\n\r\n|\r\n\r\nRule Matching Example\r\n----------------------------------------------------\r\n\r\n\r\nSTIG Viewer is limited because it operates only on the current set of STIGs, while STIG Manager has a history of older STIG Revisions. This means STIGMan can compare Rule Check Content between STIG and Rule changes, and only present Reviews that exactly match the Check Content of the Rule being evaluated.\r\n\r\nBelow is a screenshot of the STIGMan STIG Compare tool, showing a one-character difference between two related Rules from different STIG revisions.  The STIG Viewer feature would apply the Review from the previous STIG revision to the new Rule, even though the Check Content has changed.\r\n\r\n.. thumbnail:: /assets/images/check-change-example-stig-viewer-crop2.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Two versions of the same STIG Rule, with a one-character difference in the Check Content\r\n\r\n| \r\n\r\nThis is a small but significant change. Applying the previous Review as STIG Viewer would to the new version of the Rule would be a mistake, and could lead to a state where a system was using an invalid Certificate Authority.\r\n\r\nBy contrast, STIG Manager will not present the previous Review for this related Rule, because the Check Content has changed. The Reviewer or an automated tool will need to perform a new Review for this Rule, verifying that the correct CAs are being used.\r\n\r\n"
  },
  {
    "path": "docs/user-guide/roles-and-access.rst",
    "content": ".. _roles-and-access:\r\n\r\n\r\nCollection Grants, Roles, and Access Control\r\n####################################################\r\n\r\nSTIG Manager implements a Role-Based Access Control (RBAC) system to manage access to Collections.  This system allows the Collection Owner or Manager to Grant Users a Role in their Collection, and optionally create an Access Control List (ACL) for each Grant.\r\n\r\nThis page describes the concepts of Grants, Roles, and ACLs in STIG Manager, and how they affect access to Collections.\r\nCheck the :ref:`User Walkthrough <create-a-grant>` for the quick steps to create a Grant, and the :ref:`Collection Management section of the User Guide <grants-panel>` for a detailed look at the UI components that affect Grants.\r\n\r\n\r\n.. note:: \r\n\r\n  Collection Grants are specific to each Collection and its contents. They are distinct from :ref:`User Privileges<user-roles-privs>`, which allow Application-wide management functions and Collection creation. User Privileges are managed through the configured OIDC Provider. \r\n\r\n\r\nGrants\r\n--------------------------------------------------------\r\n\r\nA Grant is a record of a User or User Group being given a Role in a Collection.  A User or Group can be given Grants in multiple Collections, with different Roles in each Collection. Users with the Owner or Manage Role can create, modify, and remove Grants to the Collection.\r\n\r\nGrants are composed of the following elements:\r\n\r\n  - **Grantee:** The User or Group who is being granted a Role in the Collection.\r\n  - **Role:** The Role that the Grantee is being given in the Collection.\r\n  - **Access Control List:** Rules that define which Reviews the Grantee can see and Evaluate in the Collection.\r\n\r\n\r\nRoles\r\n--------------------------------------------------------\r\n\r\nThere are four Roles available in STIG Manager, defined below. The Roles differ based on:\r\n\r\n    - **Collection Management Capabilities:** Actions the user can perform on the Collection itself.\r\n    - **Default Access:** The base level of access allowed to Reviews. This access can be further refined by an ACL.\r\n\r\nEach Role is also given a **Priority**, to handle scenarios where a User is a member of multiple Groups having Grants with different Roles.\r\n\r\nThe following Collection Roles are available:\r\n\r\n.. list-table:: \r\n    :widths: 20 40 40 10\r\n    :header-rows: 1\r\n    :class: tight-table\r\n\r\n    * - Role\r\n      - Collection Management Capabilities  \r\n      - Default Access\r\n      - Priority\r\n    * - Owner\r\n      - Add/Remove/Modify Assets, STIG assignments, Labels, and Grants. Can delete the Collection. Can \"Accept\" and \"Reject\" reviews from evaluators.\r\n      - Read/Write access to Reviews for all Assets/STIGs\r\n      - 4\r\n    * - Manage\r\n      - Add/Remove/Modify Assets, STIG assignments, Labels, and Grants with the exception of \"Owner\" grants. Optionally can \"Accept\" and \"Reject\" reviews from evaluators.\r\n      - Read/Write access to Reviews for all Assets/STIGs\r\n      - 3\r\n    * - Full\r\n      - None\r\n      - Read/Write access to Reviews for all Assets/STIGs\r\n      - 2\r\n    * - Restricted\r\n      - None\r\n      - None (Access derived solely from the ACL)\r\n      - 1\r\n\r\n\r\n.. _EffectiveGrant:\r\n\r\nEffective Grant\r\n--------------------------------------------------------\r\n\r\nWhen a User interacts with a Collection, STIG Manager selects the User's Effective Grant from the User and Group Grants that include the User. These rules are followed when selecting the Effective Grant:\r\n\r\n**1. Direct Grants to Users take precedence over Group Grants**\r\n\r\n  If User1 is a member of Group1, and both User1 and Group1 have Grants in the Collection, only the Grant given directly to User1 will apply. The Grant given to Group1 will be ignored for User1.\r\n\r\n**2. When a User belongs to multiple Groups given Grants, the Group Grant with the highest Role Priority is selected**\r\n\r\n  If User1 is a member of Group1 and Group2, and Group1 has a \"Manage\" Role and Group2 has a \"Full\" Role in the Collection, User1 will have the \"Manage\" Role in the Collection.\r\n\r\n**3. When a User belongs to multiple Groups given Grants with an identical highest Role Priority, the Effective Grant is for that Role and the Grant ACLs will be merged**\r\n\r\n  If User1 is a member of Group1 and Group2, and Group1 and Group2 both have a \"Full\" Role in the Collection, User1 will have the \"Full\" Role in the Collection and their :ref:`Effective ACL<EffectiveACL>` will merge rules from both Group Grants.\r\n\r\nAccess Control List (ACL)\r\n--------------------------------------------------------\r\n\r\nA Grant's ACL includes one or more Access Rules, which allow fine-grained management of which Reviews users can view and modify in a Collection. They are particularly important for users with the Restricted role, as these users have no default access.\r\n\r\n.. note::\r\n  For Grants having the Owner, Manage or Full Role, an ACL is optional and used only to disallow Write Access to Resources. By default, these Roles have Read/Write access to all Reviews in the Collection.\r\n\r\n\r\nAccess Rules\r\n--------------------------------------------------------\r\n\r\nRules are composed of a **Resource** and an **Access** level.\r\n\r\nA **Resource** is defined from the following elements:\r\n\r\n  - **Collection**: All Assets in the Collection and their assigned STIGs.\r\n  - **Asset**: An Asset and its assigned STIGs. Can be combined with a STIG element.\r\n  - **STIG**: A STIG and its assigned Assets. Can be combined with an Asset or a Label element.\r\n  - **Label**: All Assets tagged with the Label and their assigned STIGs. Can be combined with a STIG element.\r\n\r\nThe **Access** level is set as one of three values:\r\n\r\n  - **Read**: Can view reviews, but cannot create or modify them\r\n  - **Read/Write**: Can view, create and modify reviews\r\n  - **None**: No access (available only in ACLs for the Restricted role)\r\n\r\n\r\n.. note::\r\n  The order of Rules in an ACL is not significant.\r\n\r\n\r\nRules can be defined for individual Assets, STIGs, or Labels, or can be combined to create complex access rules. For example, a user could be allowed Read access to the \"Database\" label, and Read/Write access to the \"PostgreSQL_9-x_STIG\" STIG. This will have the effect of letting the user **view** reviews for all STIGs assigned to Assets tagged with the \"Database\" label, but also **create and modify** reviews for the PostgreSQL STIG on those Assets.\r\n\r\n\r\n.. _EffectiveACL:\r\n\r\nEffective ACL\r\n--------------------------------------------------------\r\n\r\nWhen determining a User's access to Resources in a Collection, STIG Manager calculates an Effective ACL from the ACL of the User's :ref:`Effective Grant<EffectiveGrant>`. In the Effective ACL, each rule is an Asset/STIG combination and an Access level.\r\n\r\n\r\n.. note::\r\n  In many cases, only one Grant's ACL needs to be considered. However, if a User belongs to multiple Groups, and those Groups have Grants with an identical highest Role Priority, the Effective ACL is calculated after merging the Rules from each Group's ACL.\r\n\r\n\r\nThe following rules are applied when calculating the Effective ACL:\r\n\r\n**1. When an Asset/STIG matches multiple Rules, the Rule with the most specific Resource takes precedence.**\r\n\r\nSpecificity is calculated from the elements of the Resource, by summing each element where Asset = 1, STIG = 1, Label = 1, and Asset/STIG = 1. Therefore, a Collection resource has specificity of 0. Resources defined by only an Asset, STIG or Label have specificity of 1. A Label/STIG resource has specificity of 2, and an Asset/STIG resource has specificity of 3.\r\n\r\nFor example, Asset-123 has the label \"Windows Workstation\" and is assigned the Windows_10_STIG. A User is requesting access to the Windows_10_STIG on Asset-123. Their Effective Grant has an ACL with the following rules:\r\n\r\n.. list-table::\r\n    :widths: 40 10\r\n    :header-rows: 1\r\n    :class: tight-table\r\n\r\n    * - Resource\r\n      - Access  \r\n    * - Asset \"Asset-123\" + STIG \"Windows_10_STIG\"\r\n      - Read/Write\r\n    * - Label \"Windows Workstation\" + STIG \"Windows_10_STIG\"\r\n      - Read\r\n\r\nIn this case, even though Asset-123 has the label \"Windows Workstation\", the first rule takes precedence because it has higher specificity. STIG Manager will allow Read/Write access to the Windows_10_STIG on Asset-123, and Read only access to the Windows_10_STIG on other Assets with the \"Windows Workstation\" label.\r\n\r\n**2. When Access levels conflict, the most restrictive Access level is applied.**\r\n\r\nFor example, Asset-123 has the label \"Current Priorities\" and is assigned the Windows_10_STIG. A User is requesting access to the Windows_10_STIG on Asset-123. Their Effective Grant has an ACL with the following rules:\r\n\r\n.. list-table::\r\n    :widths: 40 10\r\n    :header-rows: 1\r\n    :class: tight-table\r\n\r\n    * - Resource\r\n      - Access  \r\n    * - Label \"Current Priorities\"\r\n      - Read/Write\r\n    * - STIG \"Windows_10_STIG\"\r\n      - Read\r\n\r\nIn this case, since Asset-123 has Label \"Current Priorities\" and is also assigned Windows_10_STIG, both rules could apply since they have the same specificity. However, Read access is more restrictive so STIG Manager would allow only Read access to the Windows_10_STIG on Asset-123. \r\n\r\nTo display the Effective ACL for a User, navigate to the Users tab in the Manage Collection interface. Hover over the row for a User and click the target icon to open the display.\r\n\r\nExamples of ACL Management\r\n--------------------------------------------------------\r\n\r\nAll examples below apply to Grants to both Users or User Groups. \r\nThese actions can be performed by a Collection Owner or Manager in the Manage Collection interface.\r\nTo edit the ACL for a Grant, click the \"Edit ACL\" button displayed when hovering over the Grant.\r\n\r\n.. thumbnail:: /assets/images/collection-manage-grants-w-edit-acl-highlighted-trimmed.png\r\n      :width: 25% \r\n      :show_caption: True\r\n      :title: Click the Edit ACL button to manage the ACL for a Grant.\r\n\r\n\r\n**Grant Read/Write on an entire Collection**\r\n  - Create a Grant for the User or Group with the Full Role\r\n  - No specific ACL is required. Default access for the Full Role allows Read/Write access to Reviews for all Assets and STIGs in the Collection.\r\n  \r\n**Allow a User to change Reviews for all Assets and STIGs in a Collection, except for those with the \"For Reference\" label**\r\n  - Grant the User a Full, Manage, or Owner Role\r\n  - Click the \"Edit ACL\" button displayed when hovering over the Grant.\r\n  - Select \"For Reference\" from the \"Labels\" node of the Collection Resources tree, and \"Add -> with Read Only\" access. Save.\r\n  - By default, these roles have Read/Write access to all Assets and STIGs in the Collection. Adding this rule restricts access to Assets with the \"For Reference\" label to \"Read Only\".\r\n\r\n\r\n**Make the entire Collection Read-only for a specific User or Group**\r\n  - Grant the User any Role\r\n  - Click the \"Edit ACL\" button displayed when hovering over the Grant.\r\n  - Select the \"Collection\" node in the Collection Resources Tree.\r\n  - Click the \"Add\" button and select \"with Read Only access.\" Save.\r\n  \r\n\r\n.. thumbnail:: /assets/images/collection-manage-acl-popup-collection-selected.png\r\n      :width: 25% \r\n      :show_caption: True\r\n      :title: Select the Collection, and \"Add with Read Only access.\"\r\n  \r\n\r\n"
  },
  {
    "path": "docs/user-guide/rule-exceptions.rst",
    "content": ".. _rule-exceptions:\r\n\r\n\r\nSTIG Rule Exceptions\r\n########################################\r\n\r\nDISA has republished a number of Rules with same Rule ID but different content. These rule make up a only a tiny fraction of a percent (0.014%) of the total Rules published in the DISA Reference STIGs, but do have some consequences for evaluation. \r\n\r\nIf a STIG Rule has been republished, only the LATEST version of the Rule will maintain a Review. \r\nThe correct STIG Rule content will be displayed when viewing an older Revision of a STIG, but the Review displayed will be the Review for the latest version of the Rule. Updates made to that particular Review when viewing old Revisions will only affect the latest STIG's Review.\r\n\r\nThe STIG Manager team is developing a method for approaching these particular cases, but for now the tool will work in the way described above. \r\n\r\n.. note::\r\n  For more information on DISA's policy towards republishing Rules, please contact DISA at their help email address: disa.stig_spt@mail.mil.\r\n\r\nRepublished Rules \r\n================================\r\n\r\n\r\n.. csv-table:: Republished Rules (2022-present)\r\n  :file: republished-rules.csv\r\n  :widths: 30, 70\r\n  :header-rows: 1\r\n  :align: left\r\n  :class: tight-table"
  },
  {
    "path": "docs/user-guide/user-guide.rst",
    "content": ".. _user-guide-doc:\r\n\r\n\r\n\r\nSTIG Manager User Guide \r\n############################################\r\n\r\n\r\n\r\n.. rubric:: The STIG Manager User Interface\r\n\r\nThis Document describes every part of the STIG Manager UI available to all STIG Manager Users. This guide assumes the suggested setup, in which most Users have the Collection Creator privilege. This guide also assumes that the user has some familiarity with the terms and data associated with STIGs and tools commonly used in their evaluation. For more info about the data STIG Manager manages and the terms and concepts used to describe it, check out our :ref:`glossary <terminology>` or :ref:`data and permissions document <data-and-permissions>`.\r\n\r\nPlease see the :ref:`admin-guide-doc` for Administrative functions.\r\n\r\nThe videos below may be useful in getting familiar with STIG Manager's layout and functions, though they may not be as up to date as this documentation.\r\n\r\n\r\n.. raw:: html\r\n\r\n  <iframe width=\"560\" height=\"315\" src=\"https://www.youtube.com/embed/wv_Gdbl_LrU\" title=\"YouTube video player\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen></iframe>\r\n\r\n-------------------------\r\n\r\n.. raw:: html\r\n\r\n  <iframe width=\"560\" height=\"315\" src=\"https://www.youtube.com/embed/ZwVJ0eO2d_I\" title=\"YouTube video player\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen></iframe>\r\n\r\n------------------------------------\r\n\r\n|\r\n\r\n.. rubric:: Overall Organization\r\n   :class: rubric3\r\n\r\nWhen first logging into STIG Manager, the User is presented with the Navigation Tree in the leftmost panel and the Content Panel to the right. Clicking on a Collection in the Nav Tree will open up the corresponding Collection Dashboard in the Content space to the right. \r\n\r\nUse the Navigation tree to navigate **between** different Collections, as well as the STIG Library, User Interface Preferences, and Application Management functions. Use the Collection Dashboard to navigate to different workspaces **within** a Collection.  \r\n\r\n\r\n.. thumbnail:: /assets/images/nav-tree-and-collection-panel.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Navigation Tree and Collection Dashboard\r\n\r\n\r\n|\r\n\r\nContent Panel\r\n=====================\r\nThe Home tab is always available in the Content Panel. \r\nThe Content Panel will be populated with tabs opened by clicking on a Collection in the Navigation Tree or opening up Workspaces from the Collection Dashboard.\r\n\r\n.. note::\r\n   When a Review Workspace tab is opened from the Collection Dashboard, it opens in a Preview tab in the Content Panel. This tab will be replaced by the next tab that is opened. To make this tab permanent, double-click on the tab title at the top of the Content Panel.\r\n\r\n.. index::\r\n   single: Home Panel\r\n\r\n\r\nHome Tab\r\n=======================\r\nThe Home tab is always available in the Content Panel. \r\nThis Tab provides links to useful information, such as this Documentation, DISA STIGs, and the RMF Process reference.\r\nThe Home Panel also provides information about the STIG Manager Open Source Software Project, and links to the `STIG Manager OSS Project on GitHub <https://github.com/NUWCDIVNPT/stig-manager/>`_ for submitting Issues with the software.\r\n\r\n.. thumbnail:: /assets/images/home-tab.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Home Tab\r\n\r\n====================================\r\n\r\n.. index::\r\n   single: Navigation Tree\r\n\r\n\r\nNavigation Tree\r\n====================\r\nThe Navigation Tree (Nav Tree) is in the leftmost panel of the STIG Manager app. The User can find all their accessible Collections via this interface, as well as the installed STIG Library and Interface Options. The Nav Tree also offers Application Management functions for those with App Management privileges. \r\n\r\nAt the top of the Navigation Tree panel is the Users Name and a logout button. Hover over the User to view their Authentication Token information. \r\n\r\nClicking on a Collection will open up the Collection Dashboard in the Content Panel to the right. If you are a Collection's Owner or Manager, a gear icon will also appear next to that Collection in the Nav Tree. Click it to jump directly to the Manage Collection Workspace.\r\n\r\n.. thumbnail:: /assets/images/nav-tree.png\r\n      :width: 25% \r\n      :show_caption: True\r\n      :title: Navigation Tree\r\n\r\n|\r\n\r\n.. index::\r\n   single: Collection Node\r\n\r\nCollections \r\n----------------------\r\nThe Collection Node lists all the Collections accessible to the User, as well as the *+Create Collection...* option, for those with that privilege.\r\n\r\n+Create Collection...\r\n~~~~~~~~~~~~~~~~~~~~~~~~~\r\nIf you have the Collection Creator privilege, this option will appear. Click this item in the Nav Tree to create a new Collection. See the  :ref:`Manage Collection <manage-collection-workspace>` section of this document for more information about the settings available here. \r\n\r\n.. thumbnail:: /assets/images/create-collection-popup.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Create Collection popup\r\n\r\n| \r\n\r\nManage Collection\r\n~~~~~~~~~~~~~~~~~~~~~\r\nIf you have :term:`Manager or Owner Collection Grants <User>` on a Collection, you will have a gear icon next to :ref:`manage <manage-collection-workspace>` that Collection. This will allow you to add Assets, STIG Assignments, and Users to the Collection.\r\n\r\nSee :ref:`manage-collection-workspace` for more info.\r\n\r\n-------------------------\r\n\r\n\r\nSTIG Library Tools\r\n----------------------\r\n\r\nThe STIG Library node provides tools to browse your imported Reference STIGs, and compare two Revisions of a STIG.  These features are available to all STIG Manager OSS Users, even those without specific Collection Grants. \r\n\r\n\r\nBrowse STIGs\r\n~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nBrowse the contents of all the Reference STIGs and the various Revisions stored in the STIG Manager App.\r\n\r\n\r\n.. thumbnail:: /assets/images/stig-library.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: STIG Library\r\n\r\n|\r\n\r\n\r\nCompare Revisions\r\n~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThe \"Compare Revisions\" feature allows you to compare two Revisions of a STIG, and get a report of what exact Rules and fields changed between the two. \r\n\r\n\r\n.. thumbnail:: /assets/images/stig-compare-tool.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: STIG Revision Compare Tool\r\n\r\n|\r\n\r\n\r\nInterface \r\n----------------------\r\nThis Node offers User Interface options, like Dark Mode, and a view of all available \"What's New\" pop-up messages.  \r\n\r\n.. thumbnail:: /assets/images/nav-tree-interface-options.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: User Interface Options\r\n\r\n|\r\n\r\n\r\n__________________________________\r\n\r\n\r\n.. index::\r\n   single: Collection Dashboard\r\n\r\n.. _collection dashboard:\r\n\r\nCollection Dashboard \r\n====================\r\n\r\nThe Collection Dashboard provides a view of the overall Status and Evaluation progress of an entire Collection, as well as metrics export options and various pivoted presentations of a Collection's assessment statistics.\r\n\r\nThis Panel also allows you to open up individual Asset or STIG Review Workspaces, as well as the Findings Report and Collection Management Workspace. \r\n\r\n\r\n.. _assessment note:\r\n\r\n.. note::\r\n      **For the purposes of this report, only Reviews with Not a Finding, Not Applicable, or Open Results are considered \"Assessed.\" Those Reviews that are \"Saved\" with a Result other than those three do not contribute to the tallies presented here. In order to be Submitted or Accepted, a Review must have one of those 3 Results.**\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-panel.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: The Collection Dashboard\r\n\r\n|\r\n\r\nThe components of the Collection Dashboard are described below. \r\n\r\n\r\nCollection Overview \r\n----------------------------\r\n\r\nThe Collection Overview section at the left of the Collection Dashboard provides high-level statistics about the Collection. \r\n\r\nThe Assets and STIGS presented in the Collection Dashboard can be filtered by clicking on the Label icon at the top of the Collection Overview Panel. Only those Assets with at least one of the selected Labels will contribute to the metrics summaries presented in this panel. \r\n\r\n.. thumbnail:: /assets/images/collection-panel-overview.png\r\n      :width: 25% \r\n      :show_caption: True\r\n      :title: Collection Overview\r\n\r\n|\r\n\r\n\r\n      - **Progress Chart** - Presents the proportion of Reviews that have been Assessed out of the total number of Assessments required in a Collection (ie. The total number of Rules contained in all STIGs that have been assigned to all Assets). The number of Assessed Reviews is further broken down by the Status of each of those Reviews. Depending on your process, you may want all your Reviews to wind up with an \"Assessed,\" \"Submitted,\" or \"Accepted\" status (The \"Assessed\" proportion here is the number of Reviews that have been \"Saved\" with :ref:`a valid Assessment Result <assessment note>`).  **The \"Import...\" button allows users to update their Reviews by importing .ckl(b) or XCCDF checklist files. Imports will NOT create new Assets and STIG assignments when initiated from the Collection Dashboard.**\r\n      - **CORA** - CORA scoring is calculated from a Weighted Average that reflects the number and severity of Open or Unassessed  rules.  The CORA panel displays a count of Open or Unassessed Rules for each Severity Category, the overall Weighted Percentage, and the Risk Rating for the Collection. The Risk Rating is color-coded to indicate the level of risk, with categories ranging from Very Low to Very High. The CORA panel is responsive to the filters applied in the Dashboard. The same scoring is available more granularly in the grid displays of the STIGs, Assets, and Labels tabs. See below for more information about the CORA Score calculation.\r\n      - **Inventory** - Total number of Assets, unique STIGs, and checklists (STIGs assigned to Assets) in this Collection. If you are a Manager or Owner for this Collection, you will see a \"Manage\" button on the right of this box's header. Click it to open the  :ref:`manage-collection-workspace`.\r\n      - **Findings** - Total number of \"Open\" Findings in a Collection, broken down by Severity Category. Click the \"Details\" button on the right of this box's header to open the Findings Report. The Findings Report provides a way to engage with all \"Open\" findings in a Collection, and generate a precursor POA&M from them. See :ref:`Findings Report` for more info.\r\n      - **Review Ages** - The age of the oldest Review in a Collection and the newest Review in a Collection. Whenever Review *content* (Result or commentary) is modified, its timestamp is updated, and this is used to calculate the ages presented here as \"oldest\" and \"newest.\" The \"Updated\" block represents the last time the *Status* of a Review changed (ie. when a Saved, Submitted, Accepted, or Rejected status was applied).\r\n      - **Export Metrics** - Various ways to export the data presented in this report. See below for more details. \r\n\r\n.. note::\r\n      Any filters applied to the Collection Overview panel carry forward to the presentation of STIGs, Assets, and Labels tabs on the right of the Collection Dashboard. \r\n      \r\n      .. thumbnail:: /assets/images/collection-panel-filters.png\r\n            :width: 25% \r\n            :show_caption: True\r\n            :title: Collection Dashboard Filtering\r\n\r\n|\r\n\r\n\r\nCORA Score Calculation\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\n**Cyber Operational Readiness Assessment (CORA)** evaluates the effectiveness of security controls and operational processes.\r\n\r\n**Risk Rating** is calculated from a **Weighted Average** that reflects the number and severity of *open* or *unassessed* rules.\r\nReviews with *Open*, *Not a Finding*, or *Not Applicable* results are considered *assessed*.\r\nReviews with other results (such as *Not Reviewed* or *Informational*) are treated as *unassessed*.\r\n\r\nEach severity category (CAT I, II, III) is weighted differently when calculating the overall score:\r\n\r\n**Weighted Average** formula:\r\n\r\n``(p₁·w₁ + p₂·w₂ + p₃·w₃) / (w₁ + w₂ + w₃)``\r\n\r\nwhere:\r\n  - ``pₙ`` = % of open + unassessed rules in that category\r\n  - ``wₙ`` = weight **(CAT I = 10, CAT II = 4, CAT III = 1)**\r\n\r\nThe **Risk Rating** is primarily determined by the **Weighted Average**, except for the special \"Low\" risk condition. If a score would be evaluated as \"Moderate\" but meets the requirements for \"Low\" risk, it is assigned \"Low\" risk instead:\r\n\r\n- **Very High:** **≥ 20%**\r\n- **High:** **≥ 10% and < 20%**\r\n- **Moderate:** **> 0% and < 10%**\r\n- **Low:** **CAT I = 0; CAT II & III each < 5%** *unweighted*\r\n- **Very Low:** **0% total**\r\n\r\n\r\nMetrics Export Options\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThis panel provides various ways to export the metrics that STIG Manager maintains about your Collection:\r\n\r\n      - Grouped By: - The data presented in this report can be exported using several different grouping options:\r\n            - **Collection** - Will produce an entry with one line, aggregating all metrics data for every Asset/STIG in a Collection together.\r\n            - **Asset** - Will produce one entry per Asset in a Collection, tallying all the metrics data for all STIGs assigned to that Asset.\r\n            - **STIG** - Will produce one entry per unique STIG in a Collection, tallying metrics data for all Assets that are assigned that STIG.\r\n            - **Label** - Will produce one entry per Label in a Collection, tallying the metrics data for each Asset that has been assigned that Label, and all of those Asset's assigned STIGs. *Note:* Because Assets can be assigned more than one Label, individual Assets can contribute to more than one Label entry, and the total Asset count may total more than the number of Assets in a Collection. \r\n            - **Ungrouped** - Will produce an entry for each STIG assigned to each Asset in the Collection. \r\n      - Style: - The granularity of the metrics data exported:\r\n            - **Summary** - Presents data fields found to be relevant for the most common use cases.  See the table below for field descriptions. \r\n            - **Detail** - Very granular data, providing counts for all supported Result values, and subtotals for Reviews that were performed by an automated tool. See the table below for field descriptions. \r\n      - Format: - Data format of the download: \r\n            - **CSV** - Comma-Separated Values, suitable for manipulation in a spreadsheet editor.\r\n            - **JSON** - JavaScript Object Notation - Useful for most other, non-spreadsheet, applications. \r\n\r\n\r\nAvailable Metrics Data Fields\r\n++++++++++++++++++++++++++++++++++++++++++\r\n\r\nThe table below describes the fields that are included in the exports available from the Collection Dashboard Metrics Export interface.  \r\n\r\n\r\n  .. list-table:: STIG Manager Metrics Data Fields, and the Report Styles that Include Them.\r\n   :widths: 20 70 10 10\r\n   :header-rows: 1\r\n   :class: tight-table\r\n\r\n   * - Data Field\r\n     - Description\r\n     - Summary\r\n     - Detail\r\n   * - assessments\r\n     - Total number of required Evaluations assigned to this item (ie. total number of Rules in all assigned STIGs). \r\n     - **X**\r\n     - **X**\r\n   * - assessmentsLow\r\n     - Total number of Rules assigned to this item with a Severity 3 category \r\n     - **X**\r\n     - **X**\r\n   * - assessmentsMedium\r\n     - Total number of Rules assigned to this item with a Severity 2 category \r\n     - **X**\r\n     - **X**\r\n   * - assessmentsHigh\r\n     - Total number of Rules assigned to this item with a Severity 1 category \r\n     - **X**\r\n     - **X**\r\n   * - assessed\r\n     - Total number of Reviews that have been marked \"pass,\" \"fail,\" or \"notapplicable.\"\r\n     - **X**\r\n     - **X**\r\n   * - assessedLow\r\n     - Number of assessed Rules with a Severity 3 category. \r\n     - **X**\r\n     - **X**\r\n   * - assessedMedium\r\n     - Number of assessed Rules with a Severity 2 category. \r\n     - **X**\r\n     - **X**\r\n   * - assessedHigh\r\n     - Number of assessed Rules with a Severity 1 category. \r\n     - **X**\r\n     - **X**     \r\n   * - minTs\r\n     - Date of the Evaluation of the oldest Review in the Collection. \r\n     - **X**\r\n     - **X**\r\n   * - maxTs\r\n     - Date of the Evaluation of the newest Review in the Collection. \r\n     - **X**\r\n     - **X**\r\n   * - maxTouch\r\n     - Date of the last time the *Status* of a Review in a Collection was changed (ie. when a review was last saved, submitted, accepted, or rejected). \r\n     - **X**\r\n     - **X**\r\n   * - low\r\n     - Number of failed Reviews for rules with a Severity 3 category. \r\n     - **X**\r\n     - **X**\r\n   * - medium\r\n     - Number of failed Reviews for rules with a Severity 2 category. \r\n     - **X**\r\n     - **X**\r\n   * - high\r\n     - Number of failed Reviews for rules with a Severity 1 category. \r\n     - **X**\r\n     - **X**\r\n   * - saved\r\n     - Total number of Reviews with a \"saved\" status. \r\n     - **X**\r\n     - **X**\r\n   * - savedResultEngine\r\n     - Number of Reviews with a \"saved\" status that were evaluated by an automated tool. \r\n     - \r\n     - **X**\r\n   * - submitted\r\n     - Total number of Reviews with a \"submitted\" status. \r\n     - **X**\r\n     - **X**\r\n   * - submittedResultEngine\r\n     - Number of Reviews with a \"submitted\" status that were evaluated by an automated tool. \r\n     - \r\n     - **X**\r\n   * - accepted\r\n     - Total number of Reviews with a \"accepted\" status. \r\n     - **X**\r\n     - **X**\r\n   * - acceptedResultEngine\r\n     - Number of Reviews with a \"accepted\" status that were evaluated by an automated tool. \r\n     - \r\n     - **X**\r\n   * - rejected\r\n     - Total number of Reviews with a \"rejected\" status. \r\n     - **X**\r\n     - **X**\r\n   * - rejectedResultEngine\r\n     - Number of Reviews with a \"rejected\" status that were evaluated by an automated tool. \r\n     - \r\n     - **X**\r\n   * - pass\r\n     - Total number of Reviews with a \"pass\" result. \r\n     - **X**\r\n     - **X**\r\n   * - passResultEngine\r\n     - Number of Reviews with a \"pass\" result that were evaluated by an automated tool. \r\n     - \r\n     - **X**\r\n   * - fail\r\n     - Total number of Reviews with a \"fail\" result. \r\n     - **X**\r\n     - **X**\r\n   * - failResultEngine\r\n     - Number of Reviews with a \"fail\" result that were evaluated by an automated tool. \r\n     - \r\n     - **X**\r\n   * - notapplicable\r\n     - Total number of Reviews with a \"notapplicable\" result. \r\n     - **X**\r\n     - **X**\r\n   * - notapplicableResultEngine\r\n     - Number of Reviews with a \"notapplicable\" result that were evaluated by an automated tool. \r\n     - \r\n     - **X**\r\n   * - other\r\n     - Total number of Reviews with a result that is NOT \"pass\", \"fail\", or \"notapplicable\". \r\n     - **X**\r\n     -      \r\n   * - notchecked\r\n     - Total number of Reviews with a \"notchecked\" result. \r\n     - \r\n     - **X**\r\n   * - notcheckedResultEngine\r\n     - Number of Reviews with a \"notchecked\" result that were evaluated by an automated tool. \r\n     - \r\n     - **X**\r\n   * - unknown\r\n     - Total number of Reviews with a \"unknown\" result. \r\n     - \r\n     - **X**\r\n   * - unknownResultEngine\r\n     - Number of Reviews with a \"unknown\" result that were evaluated by an automated tool. \r\n     - \r\n     - **X**\r\n   * - error\r\n     - Total number of Reviews with a \"error\" result. \r\n     - \r\n     - **X**\r\n   * - errorResultEngine\r\n     - Number of Reviews with a \"error\" result that were evaluated by an automated tool. \r\n     - \r\n     - **X**\r\n   * - notselected\r\n     - Total number of Reviews with a \"notselected\" result. \r\n     - \r\n     - **X**\r\n   * - notselectedResultEngine\r\n     - Number of Reviews with a \"notselected\" result that were evaluated by an automated tool. \r\n     - \r\n     - **X**\r\n   * - informational\r\n     - Total number of Reviews with a \"informational\" result. \r\n     - \r\n     - **X**\r\n   * - informationalResultEngine\r\n     - Number of Reviews with a \"informational\" result that were evaluated by an automated tool. \r\n     - \r\n     - **X**\r\n   * - fixed\r\n     - Total number of Reviews with a \"fixed\" result. \r\n     - \r\n     - **X**\r\n   * - fixedResultEngine\r\n     - Number of Reviews with a \"fixed\" result that were evaluated by an automated tool. \r\n     - \r\n     - **X**\r\n\r\n|\r\n\r\n_______________________________________\r\n\r\n\r\nCollection Checklist Navigation \r\n---------------------------------------\r\n\r\nThe right side of the Collection Dashboard provides various ways to navigate the Checklist data maintained by STIG Manager, as well as many useful Metrics. This data can be presented aggregated by Asset, Labels, or STIGs by selecting the appropriate tab. Each panel allows you to drill down to the individual Assets or STIGs in those groupings. Each panel can also be exported individually as a .csv using the down-arrow icon at the bottom of each panel.\r\n\r\nEach tab and grid of the Collection Dashboard presents the total number of Checks associated with each Asset or STIG across the Collection, depending on how it was grouped and what filters have been applied.  The grids also list the number of Checks with no Evaluation at all, and Checks that have been Saved, Submitted, Rejected, or Accepted as a way to gauge overall Evaluation progress of the Collection.  The total number of \"Open\" Severity Category 1, 2, and 3 Rules is also displayed to give an indication of the vulnerability status of the Collection.\r\n\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-panel-checklist-navigation.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Checklists in the STIGs tab of the Collection Dashboard\r\n\r\n\r\n|\r\n\r\n\r\nSTIGs Tab\r\n-------------------------\r\n\r\nThe STIGs tab on the right of the Collection Dashboard provides a list of every STIG that is assigned to at least one Asset in this Collection (that the User has access to). \r\n\r\n\r\nDouble-click a STIG, or click the Shield icon when hovering over a STIG, to access to the :ref:`Collection Review Workspace`, from which the User can review ALL the assets they have access to for the STIG selected.\r\n\r\nSee :ref:`Collection Review Workspace` for more info.\r\n\r\nAsset Checklists by STIG\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nClicking on a STIG will load the Assets that have been assigned that STIG in the bottom grid. Double-click on an Asset, or click on the Shield icon, to access the :ref:`Asset Review Workspace` for that STIG-Asset.\r\n\r\n\r\n\r\nAssets Tab\r\n----------------------\r\n\r\nThe Assets Tab on the right of the Collection Dashboard provides a list of every Asset that the User has been granted access to in the Collection.\r\n\r\n.. thumbnail:: /assets/images/collection-panel-assets.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Checklists in the Assets tab of the Collection Dashboard\r\n\r\n\r\n|\r\n\r\n\r\nSTIG Checklists by Asset\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nClicking on a particular Asset will load the bottom grid with a list of every STIG the User has access to that has been assigned to that Asset. \r\n\r\nDouble-click on a STIG, or click on the Shield icon, to access the :ref:`Asset Review Workspace` for that STIG-Asset.\r\n\r\nLabels Tab\r\n----------------------\r\n\r\nThe Labels Tab on the right of the Collection Dashboard provides a list of every Label that has been assigned to an Asset that the User has been granted access to in the Collection.\r\n\r\n.. thumbnail:: /assets/images/collection-panel-labels.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Checklists in the Labels tab of the Collection Dashboard\r\n\r\n\r\n|\r\n\r\n\r\nAssets by Label\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nClicking on a particular Label will populate the Assets grid with a list of every Asset the User has access to that has been assigned the selected Label. \r\n\r\n\r\nSTIG Checklists by Asset and Label\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nClicking on a particular Asset will load the bottom grid with a list of every STIG the User has access to that has been assigned to that Asset. \r\n\r\nDouble-click on a STIG, or click on the Shield icon, to access the :ref:`Asset Review Workspace` for that STIG-Asset.\r\n\r\n\r\n\r\n===================================\r\n\r\n.. index::\r\n   single: Meta Collection Dashboard\r\n\r\n.. _meta collection dashboard:\r\n\r\nMeta-Collection Dashboard \r\n======================================\r\n\r\nThe Meta Dashboard provides totals and metrics for some or all of your Collections at a glance. The Collections Tab shows top-level metrics for each Collection, while the STIGs tab shows metrics for each STIG across Collections. The dashboard also allows you to open up individual Collection, Asset, or STIG Review Workspaces.\r\n\r\nAccess the Meta Dashboard by clicking on the Report icon in the top-level Collections node of the Navigation Tree.\r\n\r\n\r\n.. thumbnail:: /assets/images/meta-collection-icon.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Click to open the Meta Dashboard\r\n\r\n|\r\n\r\n.. thumbnail:: /assets/images/meta-collection-dashboard.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: The Meta Dashboard\r\n\r\n\r\n|      \r\n\r\n\r\nMeta-Collection Overview \r\n----------------------------\r\n\r\nThe Meta-Collection Overview section at the left of the Meta Dashboard provides high-level statistics about your Collections. \r\n\r\nThe Collections presented in the Meta-Collection Dashboard can be filtered by clicking on the Collection icon at the top of the Overview Panel. \r\n\r\n\r\n.. note::\r\n      Any filters applied to the Meta Dashboard Overview panel carry forward to the presentation of Collections, STIGs, and Assets on the right of the Dashboard. \r\n      \r\n      .. thumbnail:: /assets/images/meta-collection-panel-overview-filters.png\r\n                  :width: 25% \r\n                  :show_caption: True\r\n                  :title: Meta-Collection Overview with Filters\r\n\r\n|\r\n\r\n\r\nCollections Tab\r\n----------------------\r\n\r\nThe Collections Tab on the right of the Collection Dashboard provides a list of every Collection that the User has been granted access to in the system.  Select a Collection to populate the STIGs panel with every STIG assigned to any Asset in that Collection. Select a STIG to see the Assets assigned that STIG.\r\n\r\n.. thumbnail:: /assets/images/meta-collection-dashboard-collections-tab.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Collections Tab of the Meta-Collection Dashboard\r\n\r\n|\r\n\r\n\r\nSTIGs Tab\r\n-------------------------\r\n\r\nThe STIGs tab on the right of the Collection Dashboard provides a list of every STIG that is assigned to any Asset in any Collection that the User has access to. Clicking on a STIG will load any Collections that contain Assets that have been assigned that STIG into the center panel. Selecting a Collection from the center panel will populate the Assets panel with a list of every Asset in that Collection that has been assigned the selected STIG.\r\n\r\n.. thumbnail:: /assets/images/meta-collection-dashboard-stigs-tab.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Collections Tab of the Meta-Collection Dashboard\r\n\r\n|\r\n\r\n===================================\r\n\r\n.. index::\r\n   single: Collection Review\r\n\r\n.. _Collection Review Workspace:\r\n\r\nCollection Review Workspace\r\n==============================\r\nThe Collection Review Workspace allows the user to assess all the Assets they have access to that have been assigned the selected STIG. It can be accessed by clicking the Shield icon or double-clicking on a STIG in the STIGs Tab of the Collection Dashboard. \r\n\r\n.. thumbnail:: /assets/images/collection-review.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Collection Review Workspace\r\n\r\n\r\n-------------------------------\r\n\r\n\r\nChecklist with Review Summary Panel\r\n---------------------------------------\r\nThis checklist provides a list of Rules for the selected STIG, and a summary of the Evaluations associated with every Asset in the Collection.  Select a Rule in this Panel to see and assess the individual Assets in the Reviews Panel to the right.\r\n\r\n\r\nMenu Bar functions\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nFrom the Menu, some Options.\r\nBy default, the most current STIG is displayed. The User can also select older revisions of the STIG, if they have been imported into the system by an Admin.\r\n\r\n.. thumbnail:: /assets/images/collection-review-stig-revisions.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: STIG Revision Selection\r\n\r\n|\r\n\r\n\r\nColumns\r\n~~~~~~~~~~~~~~\r\nThe columns in this panel represent the Rule Severity Category, Rule Id, Rule Title, and aggregated Review Columns for Open (O), Not a Finding (NF), Not Applicable (NA), Not Reviewed (NR), Submitted, Rejected, and Accepted. \r\n\r\nAdditional Columns and filtering options are available by clicking the column headers. Column selections will persist for the Collection across user sessions.\r\n\r\n.. thumbnail:: /assets/images/collection-workspace-checklist-ages.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Column Selection\r\n\r\n|\r\n\r\n\r\n\r\n\r\n\r\nRule Info Panel\r\n-------------------------\r\nThis Panel provides the Rule Info for the selected Rule in the panel above. \r\n\r\nReviews Panel\r\n----------------\r\nThis panel provides a list of the Reviews for the selected Rule for every Asset in the Collection.\r\nThe Reviews can be Submitted, Accepted, and modified from this panel. \r\n\r\n\r\n\r\nMenu Bar functions\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nAccept/Reject (for Collection Managers or Owners only) and Submit/Unsubmit actions are available. These actions will apply to any Assets selected. Multiple assets can be selected with Shift-Click, Ctrl-Click, or the checkboxes, and edited as a group by clicking one of the Status buttons, or the \"Batch Edit...\" button.\r\n\r\nReview Actions\r\n~~~~~~~~~~~~~~~~~~~~~~~\r\nDouble-click on the Result, Detail, or Comment parts of the Review Evaluation for an Asset to change that field.  \r\n\r\n\r\nBatch Editing\r\n--------------------\r\nSelect more than one Review with Shift-Click, Ctrl-Click, or the checkboxes, and click the \"Batch Edit...\" button to open the Batch Editing interface.\r\n\r\n.. thumbnail:: /assets/images/collection-review-batch-edit.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Edit Multiple Reviews at Once with Batch Editing\r\n\r\n|\r\n\r\nIf a User has Read-Only access to Assets in this Collection, the checkboxes for those Assets will be replaced with a read-only icon, and they will not be able to change those Reviews.\r\n\r\n.. thumbnail:: /assets/images/collection-review-read-only.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Assets are Read-Only for this User\r\n\r\n|\r\n\r\nAdditional Review Resources\r\n-----------------------------------\r\n\r\nReview History\r\n~~~~~~~~~~~~~~~~~~~~\r\nClick the \"clock\" icon that appears when hovering over an Asset to see the Review History for that Asset. \r\n\r\nAttachments \r\n~~~~~~~~~~~~~~~~~\r\nClick the \"paperclip\" icon that appears when hovering over an Asset to see or add attachments to a Review. Hover over a specific attachment to see buttons for viewing or deleting that attachment. The attachments button becomes available once there is an Evaluation Result for the Review. \r\n\r\n\r\n================================\r\n\r\n.. index::\r\n   single: Asset Review\r\n\r\n.. _Asset Review Workspace:\r\n\r\nAsset Review Workspace\r\n====================================\r\nThe Asset Review Workspace allows you to view and modify all the Reviews for a specific STIG on the selected Asset. It also presents useful information such as the Reviews for the same Rule on other Assets, the Review's Log, and Status Text.\r\nUsers can also import and export results in .ckl or XCCDF checklist formats. \r\nThis workspace can be accessed by clicking the Shield icon or double-clicking on an Asset in the STIGs or Assets Tabs of the Collection Dashboard. \r\n\r\n\r\n.. thumbnail:: /assets/images/asset-review.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Asset Review Workspace\r\n\r\n|\r\n\r\n\r\n-------------------------------\r\n\r\nChecklist Panel\r\n-------------------\r\nThe Checklist Panel presents a list of the Rules associated with the selected STIG. By default, the latest version of the STIG is displayed, along with the Severity Category, Rule ID, Rule Title, Evaluation Result, Result origin, and :term:`Review Status <Review>`.  The \"gear\" column in the checklist panel provides information about the Result stored in STIG Manager. The \"user\" icon indicates the Review was performed manually. The \"gear\" icon indicates an automated tool evaluated the Review. The arrow icon indicates an automated tool produced the result with the help of User input, such as an XCCDF Override or an Evaluate STIG Answer File. Additional Columns and filtering options are available by clicking the column headers. \r\n\r\nFrom the Checklist menu in the Menu Bar, the User can:\r\n   * Toggle between Rule and Group displays of the Checklist Panel.\r\n   * Export a .ckl or XCCDF representation of this Assets STIG results.\r\n   * Import STIG results for this Asset in .ckl or XCCDF form.\r\n   * Switch between Revisions of the STIG being displayed.\r\n\r\n\r\nThe menu bar also supports a variety of status and Title filters, and indicates if the Reviews for this Asset can be changed by the User.\r\n\r\n.. thumbnail:: /assets/images/asset-review-writeable.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Reviews can be changed by this User.\r\n\r\n.. thumbnail:: /assets/images/asset-review-read-only.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Reviews cannot be changed by this User.\r\n\r\n\r\n\r\n.. note::\r\n   STIG Manager does not retain the .ckl or XCCDF files that are imported. The files are parsed and the individual Reviews are stored in STIG Manager's Database. STIG Manager can produce a new .ckl representation of its Reviews on demand. \r\n\r\n.. note::\r\n   STIG Manager will import and export .ckl files differently depending on the values of certain .ckl elements and Asset metadata. See :ref:`ckl-processing` for more information.    \r\n\r\nRule Info Panel\r\n-------------------\r\nThe Rule Info Panel provides the text of the Rule. \r\nIt also provides information about the Controls associated with this Rule, including CCI, AP Acronym, and RMF Control.\r\n\r\n\r\nReview Resources Panel\r\n------------------------\r\nThis Panel provides resources that may be useful in performing the Rule's Evaluation.\r\n\r\n\r\nOther Assets Tab\r\n~~~~~~~~~~~~~~~~~\r\nThe Other Assets tab shows Evaluations that have been performed against other Assets in the same Collection that the User has access to.  The Reviews from this list of assets can be dragged and dropped onto the selected Asset's Review Panel below.\r\n\r\nAttachments Tab\r\n~~~~~~~~~~~~~~~~~\r\nThe Attachments tab allows Reviewers to attach images that support their assessment to their Review. Hover over a specific attachment to see buttons for viewing or deleting that attachment. The \"Attach Image...\" button becomes available once there is an Evaluation Result for the Review. Support for additional file formats may be added if `Feature Requests <https://github.com/NUWCDIVNPT/stig-manager/issues/new/choose>`_ are submitted. \r\n\r\n.. thumbnail:: /assets/images/attachments-hover-crop.png\r\n      :width: 25% \r\n      :show_caption: True\r\n      :title: Attachments Tab\r\n\r\n|\r\n\r\n.. thumbnail:: /assets/images/attachments-preview-crop.png\r\n      :width: 25% \r\n      :show_caption: True\r\n      :title: Attachment Preview\r\n\r\n|\r\n\r\nStatus Text Tab\r\n~~~~~~~~~~~~~~~~~~\r\nIf this Review has been Rejected, any feedback that may have been provided by the Collection Owner is displayed here.\r\n\r\nLog Tab\r\n~~~~~~~~~~~~~~~~~\r\nThis Log tab displays how this Review has changed over time.\r\n\r\n\r\nReview Panel\r\n----------------------------\r\nThe Review panel contains the Evaluation and any required details or commentary for this Review.\r\n\r\nEvaluation\r\n~~~~~~~~~~~~~~~~~~\r\nThe Evaluation holds the actual Result of a compliance decision about this Rule on the selected Asset, and the required Details and/or Comment. The Results supported are: Open (O), Not a Finding (NF), Not Applicable (NA), Informational (I), and Not Reviewed (NR).  The colored sprites next to the Result provide additional information about the source of the Result. \r\n\r\n\r\nReviews can be set to Saved or Submitted statuses from this interface. \"Saved\" simply indicates that the review has been logged to the system. The \"Submitted\" status indicates that the Evaluator considers the review to be \"complete\"  and may be optionally be \"Accepted\" or \"Rejected\" by a User with proper grants in the Collection.\r\n\r\nThe requirements for a Review to be set to \"Submitted\" status can be configured in the Collection Management Workspace by Collection Owners and Managers. These requirements will be displayed in this interface if you hover over the ``(?)`` icon next to each field label. \r\n\r\nThe default Settings for Reviews in Collections are:\r\n      - Always display the Detail field.\r\n      - Require text in the Detail field in order to Submit. \r\n      - Display the Comment field for \"Findings only\".\r\n      - Require text in the Comment field for \"Findings only\" in order to Submit.\r\n      - Review must have an Evaluation Result of \"Not A Finding,\" \"Not Applicable,\" or \"Open. (Not Configurable)\r\n\r\n\r\n.. thumbnail:: /assets/images/review-requirements-popup.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Review Requirements\r\n\r\n\r\n|\r\n\r\n\r\nAttributions\r\n~~~~~~~~~~~~~~~\r\n\r\nSTIG Manager tracks the actual Evaluation (The Result, Detail, and Comment) portion of a Review separately from the Status (Saved, Submitted, Accepted, Rejected) portion of a Review. Information about these parts of a Review is displayed in the Attributions panel. \r\n\r\n- Modified: The User and Timestamp associated with the last change to the Evaluation content of the Review.\r\n\r\n  - The RuleId that was submitted with the last change to the Review. Hover over this RuleId to view a popup listing the other RuleIds with matching Check Content and STIG Id that this Review also applies to. \r\n  \r\n- Status: Changes to the status of a Review (Saved, Submitted, Accepted, or Rejected), and the User that made that change, are tracked separately and displayed here.\r\n\r\n.. thumbnail:: /assets/images/review-attributions-panel.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Review Evaluation Panel with Attributions\r\n\r\n|\r\n\r\nSave, Save/Submit, and Accept Buttons\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nThe buttons on the bottom of the Review Panel allow the User to simply Save the review for later, to Submit the Review, or to Accept the Review (if they have the proper Collection Grant).  In most use cases, the goal for Evaluators will be to get every Review into a \"Submitted\" state.  Once Submitted, the Collection Owner can set the Review to \"Accepted\" to indicate they have ok'd it. The Collection Owner can also Reject the Review with Feedback, which will be marked so that the Reviewer can fix any issue with the commentary, or attempt to Close an Open Finding.\r\n\r\nAutomated \"Result Engine\" Information\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nIf a Review was imported from a source of automated assessments, such as Evaluate STIG or SCC, they may be marked as such in the UI.  The origin of Reviews (Automated, Manual, Override/Answer File) is indicated in the \"gear\" checklist column, and with colored informational sprites next to the Result in the Review Evaluation Panel. Hover over the sprites for more info. \r\n\r\n\r\n.. thumbnail:: /assets/images/asset-review-autoresult.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Asset Review Workspace with Automated Results indicated.\r\n\r\n|\r\n\r\n.. thumbnail:: /assets/images/asset-review-autoresult-with-override.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Review Panel with Overidden Automated Result.      \r\n\r\n|\r\n\r\n.. ATTENTION:: \r\n      If a user modifies the Result of an \"Automated\" Review, it will lose its Automated status. This is indicated with the replacement of the \"Automated\" badge with a \"Manual\" one next to the Result, and the absence of the gear symbol for that rule in the Checklist panel. \r\n\r\n\r\n==============================\r\n\r\n.. index::\r\n   single: Findings Report\r\n\r\n.. _Findings Report:\r\n\r\nFindings Report Workspace\r\n=====================================\r\nThe Findings Report provides a view of all Open Reviews in the Collection that the User has access to.\r\n\r\n.. thumbnail:: /assets/images/findings-report.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Findings Report\r\n\r\n\r\n-------------------------------\r\n\r\nAggregated Findings\r\n--------------------------\r\nThe Aggregated Findings Panel provides a view of all Rule Ids that have at least one \"Open\" Evaluation in a Collection. By default this view is aggregated by Group ID, and includes the columns: Severity Category, Group ID, Group Title, Number of Assets, and relevant STIG.\r\n\r\nMenu Bar\r\n~~~~~~~~~~~~\r\nThe Menu Bar allows the User to aggregate this view by Group ID, Rule ID, or CCI.  It also allows the User to filter the list by STIG. \r\n\r\nExport a .csv or POA&M-style Spreadsheet\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nAt the bottom of this panel are Export and Generate POA&M... buttons.  The Export button exports a .csv file, and the POA&M button will ask the User to set a few options and will then produce a pre-populated POA&M reference file.\r\n\r\nPOA&Ms can take different forms, and track more information than is available in STIG Manager. The POA&M output from STIG Manager is intended to be used for reference when populating your official POA&M documents with STIG finding information, and not as a replacement for artifacts that may be directly imported into eMASS or other RMF tools.\r\n\r\n\r\nIndividual Findings\r\n-----------------------\r\nSelect an aggregated finding in the left panel, to bring up information about the specific assets with that finding in the Individual Findings Panel.\r\nInformation about the Asset, Rule, Last Changed Date, and applicable STIG or STIGs can be found in the default columns, with additional Review info in the expanding Rows.\r\n\r\nThis section of the Report can be exported on its own.\r\n\r\n\r\n===========================================\r\n\r\n\r\n.. index::\r\n   single: Manage Collection\r\n\r\n.. _manage-collection-workspace:\r\n\r\nCollection Management Workspace\r\n===================================\r\nAllows a Collection Manager or Owner to Manage their Collection.\r\nFrom this Workspace, the User can:\r\n\r\n   * Alter the Name, Description, Settings, and Metadata associated with the Collection\r\n   * Add/Modify/Remove Grants and Access Control Lists for Users and User Groups in the Collection\r\n   * Batch import CKL or XCCDF files to automatically scaffold or add to their Collection\r\n   * Batch export CKL or XCCDF files for external tools such as eMASS\r\n   * Add/Modify/Remove Assets in the Collection \r\n   * Create and Apply Labels to Assets in the Collection. \r\n   * Transfer Assets to another Collection\r\n   * Add or remove STIGs from the Collection (STIGs must be assigned to at least 1 Asset to be associated with a Collection)\r\n   * Delete the Collection (if Collection Owner)\r\n\r\n.. thumbnail:: /assets/images/manage-collection-workspace.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: The Manage Collections Workspace\r\n\r\n\r\n-------------------------------\r\n\r\n\r\nCollection Properties Panel\r\n--------------------------------\r\nThis Panel allows Collection Managers and Owners to change the name of the Collection, it's description, settings, grants, and any associated Metadata.  Collection Owners can also delete this Collection. \r\n\r\n.. thumbnail:: /assets/images/collection-properties.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Collection Properties\r\n\r\n|\r\n\r\n.. _clone-collection:\r\n\r\n\r\nClone Collection\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThe \"Clone Collection\" button allows Managers or Owners to create another Collection that is a copy of the one they are currently viewing.  \r\nThis feature can be useful for creating a \"snapshot\" of a Collection at a particular point in time that could be used to support certain process or reporting needs. At clone time, the new Collection can be created with all its STIGs \"pinned\" to the default Revisions of the Source Collection, which will ensure the Clone's reviews and metrics do not change when Reference STIGs are updated. \r\n\r\n\r\n.. thumbnail:: /assets/images/collection-manage-clone-button.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: The Collection Clone Button\r\n\r\n|\r\n\r\nThe new Collection can be substantially identical to the original, but must have a different name.\r\n\r\nUsers can choose to copy the Assets, their STIGs, Labels, and/or Reviews from the original Collection into the new one.  They can also choose to copy the User Grants from the original Collection into the new one, and pin STIG Revisions to their current values. \r\n\r\n.. note::\r\n   Whether or not the User Grants are copied, the User who created the new Collection will be an Owner of the new Collection.\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-manage-clone-options.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Collection Clone Options\r\n\r\n|\r\n\r\nOnce the clone operation has started, a status bar will appear at the bottom of the screen.  The User can continue to use STIG Manager while the clone operation is in progress. The status bar will update when the clone is complete.\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-manage-clone-status-bar.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Collection Clone Status Bar\r\n\r\n|\r\n\r\n.. thumbnail:: /assets/images/collection-manage-clone-status-complete.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Collection Clone Complete\r\n\r\n|\r\n\r\n\r\n.. warning::\r\n      Large Collections can take several minutes to clone! During this time, Users will likely see a performance impact when accessing the source Collection. Making changes to the source Collection while it is being cloned may lead to inconsistent results in the cloned Collection.\r\n      \r\n      You may want to alert your users before cloning a large Collection.\r\n\r\n|\r\n\r\n.. _grants-panel:\r\n\r\n\r\nGrants Tab\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThis Tab displays all the Users and Groups that have been given a Grant to some portion of this Collection.\r\n\r\nUser/Group Grants can be added or removed using the toolbar buttons at the top of this Panel. When hovering over a Grant, click the \"pencil\" icon to change the User or Role associated with the Grant. Click the \"target\" icon to change the Access Control List applied to the Grant.  Click the \"trash\" icon to remove the Grant.\r\n\r\nYou can expand individual Groups listed in the \"Available Grantees\" panel to see the Users in that Group.\r\n\r\nSee the :ref:`Roles and Access<roles-and-access>` section for more information about Grants, Roles, and Access Control.\r\n\r\n.. thumbnail:: /assets/images/collection-manage-new-grants-popup.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: The User Grants Panel\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-manage-edit-grant.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Edit or reassign an existing Grant\r\n\r\n-------------------------------\r\n\r\nEvery Grant is associated with a User or Group, an Access Control List, and Role in the Collection.  The Access Control List can be used to restrict or expand the Grant's access to certain Assets, STIGs, or Labels in the Collection.  By default, the Full, Manage, and Owner Roles have Read/Write access to all Reviews in a Collection, and the Restricted Role has no access to any Reviews.  The Access Control List can be used to further restrict or expand access for any of these Roles.\r\n\r\nManagers and Owners have additional Collection capabilities that let them add or remove Assets, STIG assignments, and Grants to the Collection. \r\nSee the :ref:`Roles and Access<roles-and-access>` section for more information about Grants, Roles, and Access Control.\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-manage-acl-popup.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: The Access Control List Popup\r\n\r\n|\r\n\r\n\r\n\r\n.. _users-panel:\r\n\r\nUsers Tab\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThis tab displays all the Users that have been granted access to this Collection, with either a Direct Grant to the User or via a Grant to a User Group. Hover over a Grant and click the \"target\" icon to view an expanded list of every Asset and STIG that the User has access to in this Collection. This view is the \"effective access\" of the User to the Collection that has been calculated based on the User's Role and the Access Control Lists associated with their Grant.\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-manage-effective-access.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Users Effective Access\r\n\r\n|\r\n\r\nCollection Settings Tab\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nIf you have the proper Grant to a Collection, you can modify settings that affect the behavior of this Collection and its Reviews. \r\n\r\n\r\nReview Fields \r\n++++++++++++++++++++++++++++++++++++\r\n\r\n\r\nIf you have the proper Grant to this Collection, you can set the fields that will be required for Reviews to be Submitted in this Collection. \r\n\r\nThe default Settings for Review Submission in Collections are:\r\n      - Always display the Detail field.\r\n      - Require text in the Detail field in order to Submit. \r\n      - Display the Comment field for \"Findings only\".\r\n      - Require text in the Comment field for \"Findings only\" in order to Submit.\r\n      - Review must have an Evaluation Result of \"Not A Finding,\" \"Not Applicable,\" or \"Open. (Not Configurable)\r\n \r\n\r\nReview Status \r\n++++++++++++++++++++++++++++++++++++\r\n\r\n\r\nReview Status Settings control the behavior of the Status fields of a Review.  Collection Owners or Managers can control whether they  want to allow certain Users to Accept or Reject reviews. The Grant levels required to do this can also be selected. \r\n\r\nThe default Settings for Review Status are: \r\n      - Reset Status to \"Saved\" only when the Review Result changes (As opposed to ANY Review field change, such as the Detail or Comments).\r\n      - Enable Reviews to be set to either Accepted or Rejected Status \r\n\r\n        * User must have \"Manage or Owner\" Grants to \"Accept or Reject\" Reviews (As opposed to just Owners)\r\n\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-manage-review-fields.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Review Requirements\r\n\r\n\r\n|\r\n\r\nReview History\r\n++++++++++++++++++++++++++++++++++++\r\n\r\nEvery time an individual Review for an Asset changes, a History record of its previous state is recorded.  For each Collection, Owners and Managers can now limit how many of these History records they keep for for each Review, or turn Review History off entirely\r\n\r\nBy default, the number of History records is capped at 15 for each Review. \r\n\r\n.. thumbnail:: /assets/images/collection-manage-review-history-setting.png \r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Review history setting\r\n\r\n\r\n|\r\n\r\n\r\n.. _import-options:\r\n\r\n\r\nImport Options\r\n++++++++++++++++++++++++++++++++++++\r\n\r\n\r\nThe options described below allow you to have fine-grained control over how the reviews from .ckl and XCCDF files are imported into your STIG Manager Collection.  The settings specified here will become the default behavior for all users importing results from files into the collection.  **This includes any instances of the STIGMan Watcher utility that may be importing into your Collection.**  \r\n\r\nThese import setting preferences can be locked for your Collection, or you can allow other users to customize them as they see fit when they perform their own imports. \r\n\r\n.. thumbnail:: /assets/images/collection-manage-review-import-options.png \r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Review Import Options Fields\r\n      \r\n|\r\n\r\n\r\nReview Status Per Result:\r\n  This setting allows you to define the desired Review Status—Accepted, Submitted, Saved, or Keep Existing if possible (for existing reviews)—for each result type: Fail, Not Applicable, or Pass.\r\n  \r\n  - **Keep Existing**: Keep the existing Status, if possible. New reviews are set to \"Saved\" status. The resulting Status will also take into consideration the \"Reset to Saved\" configuration that is set in the Review Status section of Collection Settings. \r\n  - **Accepted**: If importing user has the proper grant, set Review to \"Accepted.\" If they cannot Accept, Reviews will be set to \"Submitted.\" If review does not meet Submit requirements, Review will be set to \"Saved.\"\r\n  - **Submitted**: Set Review to \"Submitted\" status. If review does not meet Submit requirements, Review will be set to Saved.\r\n  - **Saved**:(**default setting**) Set Reviews to \"Saved\" status.\r\n\r\n\r\nInclude Unreviewed Rules:\r\n  Should Rule Results without a compliance result (NF, NA, O) be imported?\r\n\r\n  - **Never**: Ignore these rules. Existing STIG Manager results will not change.  \r\n  - **Having Comments**: (**default setting**) Import these rules only if Detail or Comment is provided. Existing STIG Manager Reviews will be overwritten with the provided Result and Commentary.\r\n  - **Always**: Always import these reviews. Replace any existing Review content.\r\n\r\nUnreviewed with a comment is:\r\n  If import includes reviews that do not have a compliance result (NF, NA, O), but includes Detail or Comment information, STIG Manager should import these Reviews with a Result of:\r\n\r\n  - **Informational**: (**default setting**) Set Result to \"Informational\" to distinguish it from those Reviews that have no commentary. \r\n  - **Not Reviewed**: Leave the result as \"Not_Reviewed\"\r\n\r\n\r\nEmpty Detail text is:\r\n  If the file includes Reviews with empty Detail text, the Detail text field will be:\r\n\r\n  - **Ignored**: (**default setting**) Retain any existing Detail content already stored in STIG Manager. \r\n  - **Replaced**: Create a generic message indicating the fact that the imported Review had no content here. (This message will become the Detail text for the purposes of meeting submission requirements)\r\n  - **Imported**: This will have the effect of removing any existing Detail text in STIG Manager.\r\n\r\nEmpty Comment text is:\r\n  If the file includes Reviews with empty Comment text, the Comment text field will be:\r\n\r\n  - **Ignored**: (**default setting**) Retain any existing Comment content already stored in STIG Manager. \r\n  - **Replaced**: Create a generic message indicating the fact that the imported Review had no content here. (This message will become the Comment text for the purposes of meeting submission requirements)\r\n  - **Imported**: This will have the effect of removing any existing Comment text in STIG Manager.\r\n\r\nOptions can be customized for each import:\r\n  Allow users to customize these import options to suit their needs. The options specified here will always be the initial settings presented to all users for this Collection. (**default: allow**)\r\n\r\n\r\n\r\n-------------------------------\r\n\r\n\r\nMetadata Tab\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThis Tab allows Users with proper access to record miscellaneous data to associate with this Collection. \r\n\r\n-------------------------------\r\n\r\n\r\n.. _labels-tab:\r\n\r\n\r\nLabels Tab\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThis Tab allows you to create various Labels and apply them to Assets. Labels are specific to Collections, and will be removed from Assets if they are moved to a different Collection. Labels exist only as an organizing tool, they do not affect the processing or function of the Assets or their Reviews. \r\n\r\nCreate a label by clicking the \"New Label\" button. Labels can be assigned a name, optional description, and color. \r\nDouble-click an existing label to edit it. \r\n\r\n.. thumbnail:: /assets/images/collection-manage-labels.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Collection Labels Tab\r\n\r\n|      \r\n\r\n.. thumbnail:: /assets/images/collection-manage-new-label.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Create a New Label\r\n\r\n-------------------------------\r\n\r\nWhen a Label is selected in Label tab of the Collection Properties Panel, the \"Tag Assets...\" button is enabled. Click the \"Tag Assets...\" button to view and tag Assets with the selected Label. Hover over the Asset's name to see its currently assigned STIGs. Click on a column header to filter on that column's data, or to add or remove columns of Asset information.\r\n\r\n.. thumbnail:: /assets/images/collection-manage-tag-assets-modal.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: View and tag Assets with the selected Label\r\n\r\n|\r\n\r\n\r\n       \r\nAssets Panel\r\n------------------\r\nThis panel lists the Assets that are a part of this Collection. An Asset's properties can be modified by double-clicking on the Asset row or by choosing \"Change Asset Properties...\" from the toolbar.\r\n\r\nThe menu bar provides several functions, allowing the User to Create, Delete, and Change Assets in the Collection.\r\nThe :ref:`Collection Builder` option allows the User to create many Assets and their STIG Assignments at once. \r\n\r\n.. thumbnail:: /assets/images/assets-panel-toolbar.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Collection -> Manage -> Assets toolbar\r\n\r\n|\r\n\r\nClick on the \"Labels\" column header, or any other column header, to filter the Asset grid by the data in the selected column(s).\r\n\r\n.. thumbnail:: /assets/images/collection-manage-asset-panel-label-filtering.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Asset Panel Label Filtering\r\n\r\n\r\n-------------------------------\r\n\r\n\r\nCreate Asset\r\n~~~~~~~~~~~~~~~\r\nClick the Create Asset button to create an Asset manually. Enter relevant Asset info in the popup window that appears. STIGs and labels can also be assigned to the new Asset from this interface.\r\n\r\n.. thumbnail:: /assets/images/collection-manage-asset-label-edit.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Create an Asset\r\n\r\n\r\n-------------------------------\r\n\r\nCreate Asset Batch\r\n~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nExample CSV File that can be used to create multiple Assets at once:  \r\n:download:`Download Sample Asset CSV </user-guide/Stig-Manager-Asset-Batch-Import.csv>`\r\n\r\nThe uploaded CSV must follow this format:\r\n\r\n.. list-table:: \r\n   :header-rows: 1\r\n\r\n   * - Column Name\r\n     - Description\r\n     - Data Requirements\r\n   * - Name\r\n     - The name of the asset\r\n     - (Required) Must be between 1 and 255 characters long. \r\n   * - Description\r\n     - Description of the asset\r\n     - (Optional) 255 characters max, any characters over 255 will be truncated\r\n   * - IP\r\n     - The IP address of the asset\r\n     - (Optional) 255 characters max, any characters over 255 will be truncated\r\n   * - FQDN\r\n     -  Fully Qualified Domain Name of the asset\r\n     - (Optional) 255 characters max, any characters over 255 will be truncated\r\n   * - MAC\r\n     - The MAC address of the asset\r\n     - (Optional) 255 characters max, any characters over 255 will be truncated\r\n   * - Non-Computing\r\n     - Indicates if the asset is a non-computing device\r\n     - (Optional) Will default to FALSE if not provided. Valid values are TRUE or FALSE.\r\n   * - STIGs\r\n     - The STIGs to be assigned to the asset\r\n     - (Optional) Newline separated list of STIG BenchmarkIds. STIG installed in STIG Manager before they can be assigned to an Asset.\r\n   * - Labels\r\n     - The labels to be assigned to the asset\r\n     - (Optional) Newline separated list of Label Names. Labels in the file will be created if they do not already exist in the Collection.\r\n   * - Metadata\r\n     - The metadata to be assigned to the asset\r\n     - (Optional) JSON-encoded object for key-value metadata. Only one layer deep is supported. The keys and the values must be strings. The keys must be unique within the object.\r\n\r\n\r\nClick the Import Assets CSV to create an Asset from a CSV File. \r\n\r\n.. thumbnail:: /assets/images/collection-manage-csv-batch-create.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Select 'Import Assets CSV' button\r\n\r\n\r\nBegin by selecting a CSV that contains asset data. Once uploaded, the importer parses each row, validating the entries before proceeding. Only rows with valid data are considered for submission — any invalid rows are automatically ignored for submission with the respective errors on that row shown. During validation, the importer checks for non-existing labels referenced in the CSV and automatically marks them to be created upon submission. After validation completes, the user can submit the data. Submission is only enabled if at least one valid asset is detected.\r\n\r\n.. thumbnail:: /assets/images/collection-manage-asset-csv-importer.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: View the Report of the Asset CSV Importer\r\n\r\n\r\n-------------------------------------------------------------------------------------------\r\n\r\n\r\nExport Assets CSV File\r\n~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nTo Export Assets as CSV, select one or more Assets (no assets selected will imply all assets), and click the \"Export Assets CSV\" button. The CSV export will contain the Asset Name, Description, IP, FQDN, MAC, Non-Computing, STIGs, Labels, and Metadata. The CSV will also contain the STIGs assigned to each Asset in the Collection.\r\n\r\n.. thumbnail:: /assets/images/collection-manage-results-export-assets-csv.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Export Assets CSV Button\r\n\r\n|\r\n\r\n-------------------------------\r\n\r\n\r\n.. index::\r\n   single: Collection Builder\r\n\r\n.. _Collection Builder:\r\n\r\nImport CKL or XCCDF files to Build or Update Your Collection\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nSTIG Manager lets you populate your entire Collection from scratch or add to an existing Collection with a bulk import of .ckl and XCCDF files. This feature will create any new Assets you submit files for, and assign them the STIGs specified in the imported files.  If the Asset already exists, the newly imported STIGs will be assigned to them. The User can also choose whether or not to import the Reviews in the imported files, or just create the Assets and STIG Assignments.\r\n\r\nThe Asset Name must match exactly. Check the :term:`ckl` and :term:`XCCDF` glossary entries for how their individual fields map to STIG Manager fields. \r\n\r\n.. note::\r\n   When STIG Manager creates an Asset from an imported file, it will populate the Name, FQDN, IP, and MAC fields if they are present in the file. If the asset is already created, those fields are NOT updated when a file is imported. \r\n\r\n\r\n.. note::\r\n   STIG Manager does not retain the .ckl or XCCDF files that are imported. The files are parsed and the Reviews stored in STIG Manager's Database. STIG Manager can produce a new .ckl representation of its Reviews on demand. \r\n\r\nCollection Builder Process\r\n++++++++++++++++++++++++++++++++++++\r\n\r\n\r\nFrom the Collection Management workspace, click the \"Import CKL or XCCDF...\" button at the top of the Assets panel .\r\n\r\n.. thumbnail:: /assets/images/collection-builder-files.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Collection Builder File Select\r\n\r\n|\r\n\r\nDrag and drop or Select one or more .ckl or XCCDF files.\r\nSee the :ref:`import-options` section of this document for information about the options presented. \r\n\r\n-------------------------------\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-builder-errors-and-warnings.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Collection Builder Errors and Warnings\r\n\r\n\r\n|\r\n\r\nIf there is an issue with the files you selected, they will appear here. One error you may encounter is that the STIG in the selected file is not installed in STIG Manager. If this is the case, contact a STIG Manager Administrator to have them install it.\r\n\r\nIf you provide multiple files for the same Asset and STIG, only the latest will be imported. \r\n\r\nThis screen will be skipped if there are no issues with the files you have selected.\r\n\r\n-------------------------------\r\n\r\n.. thumbnail:: /assets/images/collection-builder-options.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Collection Builder Options and Summary\r\n\r\n\r\n|\r\n\r\nYou will be presented with a summary view of the files you have submitted.\r\nThis view shows the Assets, STIGs, Review totals, filenames and date of the data contained in the submitted files. \r\n\r\nNew Assets and new STIG assignments that will result from this import are indicated with a (+) after the Asset or STIG name.\r\n\r\nIf the summary is appropriate, click the \"Add to Collection...\" button.\r\n\r\n-------------------------------\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-builder-import.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Collection Builder Import Log\r\n\r\n|\r\n\r\nThe user is presented with the log of the import. Select an item in the top grid for information about any \"rejected\" Reviews that were unable to be imported into STIG Manager. This may happen for Rules that are not currently assigned to this Asset, or for versions of STIGs that have not been loaded into STIG Manager.\r\n\r\n\r\n.. note::\r\n   STIG Manager does not retain the .ckl or XCCDF files that are imported. The files are parsed and the Reviews stored in STIG Manager's Database. STIG Manager can produce a new .ckl representation of its Reviews on demand. \r\n\r\n.. note::\r\n   STIG Manager will import and export .ckl files differently depending on the values of certain .ckl elements and Asset metadata. See :ref:`ckl-processing` for more information.    \r\n\r\n-------------------------------\r\n\r\n\r\n.. _export-by-asset:\r\n\r\nExport Results by Asset\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThe \"Export Results...\" button in the Assets Panel Toolbar will open a pop-up interface with a checkbox selection tree.  Selections can be made for any combination in the tree, from the individual STIG-Asset level, whole Asset level, or every Asset in the Collection. \r\n\r\nWhen Assets have been pre-selected in the Assets panel, only the selected Assets will be presented in the checkbox selection tree.\r\n\r\nUse the radio buttons in the pop-up to select the type of export you would like to perform.\r\n\r\nExport Results to Another Collection\r\n+++++++++++++++++++++++++++++++++++++++++++++++\r\n\r\nThe user can export results from Assets in the current Collection to another Collection. The user must have \"Manage\" or \"Owner\" levels of access in the destination Collection. You will only see Collections that you have sufficient access to in the \"Export To\" pulldown.\r\nIf the destination Collection does not have an Asset of the same name as the one being exported, a new Asset will be created in the destination Collection. If the destination Collection already has an Asset of the same name, any STIGs that are not already assigned to the Asset in the destination Collection will be assigned to it.  Any STIGs that are already assigned to the Asset in the destination Collection will be updated with the new results in accordance with the Collection settings of the destination.\r\n\r\n.. note::\r\n      The \"Export Results to Another Collection\" option is limited to a maximum of 100 Assets at one time.\r\n\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-manage-results-export-asset-collection.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Checklist Archive Export by Asset\r\n\r\n|\r\n\r\n\r\n\r\nExport Results as CKL or XCCDF Archive\r\n+++++++++++++++++++++++++++++++++++++++++++++++\r\n\r\nThe user can select whether single-STIG .ckls, multi-STIG .ckls, or XCCDF files will be generated for every Asset selected. The package of files will be presented as a .zip file that will also contain a ``_manifest.json`` file describing its contents and any errors encountered while producing it.  Check the :term:`ckl` glossary entry for exact mappings of fields from STIG Manger to .ckl file.\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-manage-results-export-asset-archive.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Checklist Archive Export by Asset\r\n\r\n|\r\n\r\n.. thumbnail:: /assets/images/checklist-archive-export-log.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Checklist Archive Export log\r\n\r\n\r\n--------------------------\r\n\r\nDelete Asset\r\n~~~~~~~~~~~~~~~~~~~~\r\nTo Delete an Asset, select an Asset and click the Delete Asset button. A popup will ask you to confirm the action. \r\n\r\n\r\n.. _transfer-asset:\r\n\r\nTransfer Asset(s) to Another Collection\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nSelect one or more(with Shift+Click) Assets, click the \"Transfer To\" button, and select the destination Collection.  You will be prompted with a confirmation pop-up. Click \"Yes\" to transfer the Assets to the new Collection. \r\n\r\nYou must have \"Manage\" or \"Owner\" levels of access on both the originating and destination Collections. You will only see Collections that you have sufficient access to in the \"Transfer To\" pulldown.  \r\nIndividual Asset-STIG assignments to Restricted Users are removed when an Asset is moved to a new Collection. All other information (STIG Assignments, Assessments, etc.) transfers with the Asset.  \r\n\r\n\r\n.. thumbnail:: /assets/images/transfer-asset.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Transfer Assets to Another Collection\r\n\r\n\r\n-------------------------------\r\n\r\n\r\nChange Asset Properties\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nTo alter an Asset's properties or tag it with Labels, select an Asset and click this button, or double-click the Asset row.\r\n\r\n.. thumbnail:: /assets/images/collection-manage-asset-label-edit.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Asset Properties\r\n\r\n\r\n-------------------------------\r\n\r\nSTIGs Panel\r\n-------------------\r\nThis panel lists all the STIGs that have been assigned to at least one Asset in the Collection. STIG Assignments can also be added or removed from Assets with the buttons at the top of this panel. You can also \"pin\" a specific Revision of a STIG to the Collection. This will lock this Collection to that specific Revision of a STIG, rather than use the default behavior of always using the latest Revision of a STIG.\r\n\r\n.. thumbnail:: /assets/images/stigs-panel.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: STIGs Panel\r\n\r\n\r\n-------------------------------\r\n\r\n\r\nAssign STIG\r\n~~~~~~~~~~~~~~~~~~~~~~\r\nSelect Assign STIG to add a new STIG to the Collection. A popup will allow you to view any Assets that are assigned the selected STIG, and to assign that STIG to new Assets. Hover over the Asset's name to see its currently assigned STIGs. Click on a column header to filter on that column's data, or to add or remove columns of Asset information.\r\n\r\n.. thumbnail:: /assets/images/stig-assignments.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: STIG Assignments\r\n\r\n\r\n-------------------------------\r\n\r\n\r\n.. _pin-revision:\r\n\r\nSet a Default STIG Revision\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nYou can \"Pin\" a specific Revision of a STIG to the Collection. This will lock this Collection to that specific Revision of a STIG, rather than use the default behavior of always using the latest Revision of a STIG. This will affect all calculated Metrics as well as the initial Revision of a STIG presented in all Workspaces. \r\n\r\nTo set a specific default Revision of a STIG for a Collection, open the STIG Assignment window with the \"Assign STIG\" button or double-click on the Revision in the STIGs panel. Select the desired Revision from the \"Default revision\" dropdown menu, and click \"Update.\"  To revert to the default behavior, select \"Most Recent Revision\" from the dropdown menu and click \"Update.\"\r\n\r\nThe Update action may take a moment, as STIG Manager will need to recalculate all metrics based on the new Revision.\r\n\r\nThe \"pinned\" Revision is indicated with a pin icon in the STIGs Panel and Collection Dashboard.\r\n\r\n.. note::\r\n    A STIG must be assigned to at least one Asset in a Collection in order to be Pinned!\r\n\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-manage-revision-pinning.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Pin a STIG Revision\r\n\r\n-------------------------------\r\n\r\n\r\nRemove STIG\r\n~~~~~~~~~~~~~~~~~~~~~\r\nThe Remove STIG button will remove the selected STIG from all Assets that are assigned it in this Collection.\r\n\r\n\r\n\r\nChange Assigned Assets\r\n~~~~~~~~~~~~~~~~~~~~~~~~\r\nSelect \"Change assigned Assets...\" or double-click a STIG to change what Assets are assigned this STIG in this Collection.\r\n\r\n\r\n.. _export-by-stig:\r\n\r\n\r\nExport Results by STIG\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThe \"Export Results...\" button in the STIGs Panel Toolbar will open a pop-up interface with a checkbox selection tree.  Selections can be made for any combination in the tree, from the individual STIG-Asset level or every Asset in the Collection. \r\n\r\nWhen STIGs have been pre-selected in the STIGs panel, only the selected STIGs will be presented in the checkbox selection tree.\r\n\r\nUse the radio buttons in the pop-up to select the type of export you would like to perform.\r\n\r\nExport Results to Another Collection\r\n+++++++++++++++++++++++++++++++++++++++++++++++\r\n\r\nThe user can export results from STIGs in the current Collection to another Collection. The user must have \"Manage\" or \"Owner\" levels of access in the destination Collection. You will only see Collections that you have sufficient access to in the \"Export To\" pulldown.\r\nIf the destination Collection does not have an Asset of the same name as the one being exported, a new Asset will be created in the destination Collection. If the destination Collection already has an Asset of the same name, any STIGs that are not already assigned to the Asset in the destination Collection will be assigned to it.  Any STIGs that are already assigned to the Asset in the destination Collection will be updated with the new results in accordance with the Collection settings of the destination.\r\n\r\n.. note::\r\n      The \"Export Results to Another Collection\" option is limited to a maximum of 100 Assets at one time.\r\n\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-manage-results-export-asset-collection.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Checklist Archive Export by Asset\r\n\r\n|\r\n\r\n\r\n\r\nExport Results as CKL or XCCDF Archive\r\n+++++++++++++++++++++++++++++++++++++++++++++++\r\n\r\nThe user can select whether single-STIG .ckls, multi-STIG .ckls, or XCCDF files will be generated for every Asset selected. The package of files will be presented as a .zip file that will also contain a ``_manifest.json`` file describing its contents and any errors encountered while producing it.  Check the :term:`ckl` glossary entry for exact mappings of fields from STIG Manger to .ckl file.\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-manage-results-export-asset-archive.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Checklist Archive Export by Asset\r\n\r\n|\r\n\r\n.. thumbnail:: /assets/images/checklist-archive-export-log.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :title: Checklist Archive Export log\r\n\r\n\r\n|\r\n\r\n\r\n.. _ckl-processing-brief:\r\n\r\nA Note on .CKL Processing\r\n=================================\r\n\r\nWhen the STIG Manager Client imports data from :term:`.ckl files <ckl>`, in the simplest case it will attempt to match (and, in some instances, create) the Asset specified in the .ckl's ``<HOST_NAME>`` element.  However, if the ``<ASSET><WEB_OR_DATABASE>`` element in the .ckl has a value of ``true``, special processing is invoked. This processing will attempt to match the ``<HOST_NAME>``, ``<WEB_DB_SITE>`` and ``<WEB_DB_INSTANCE>`` values in the .ckl with Asset metadata when identifying the Asset. \r\n\r\nSee the :ref:`ckl-processing` section of this Documentation for more information. \r\n\r\n|\r\n\r\n.. note::\r\n   See the :ref:`import-options` section of this document for information about STIG Manager's review import options.  \r\n\r\n\r\n|\r\n\r\n\r\n"
  },
  {
    "path": "docs/user-guide/user-quickstart.rst",
    "content": ".. _user-quickstart:\r\n\r\n\r\nSTIG Manager User Walkthrough\r\n########################################\r\n\r\nThis User Walkthrough will walk you through a typical use case for STIG Manager, from creating your own Collection, creating Assets in that Collection, to evaluating STIGs and creating a POAM-style spreadsheet from your findings. Depending on your role in your organization, not all of these steps may apply to you, but should be helpful in providing context for the use of this tool. If you are comfortable, feel free to skip around using the sidebar navigation to the left.\r\n\r\nFor more detailed information about every STIG Manager function available to users, please see the :ref:`user-guide-doc`.\r\n\r\nSTIG Manager's primary organizational structure is the :term:`Collection`. \r\nCollections are composed of:\r\n\r\n* :term:`Assets <Asset>`\r\n* :term:`STIGs <STIG>` attached to those Assets\r\n* :term:`User Grants <User>` providing access to some or all of the Assets/STIGs in that Collection\r\n* :term:`Reviews <Review>`\r\n\r\nThis Walkthrough will step you through creating each of these items. \r\n\r\n.. ATTENTION::\r\n   **Collections can be structured as an RMF Package, but do not need to be.** It is recommended that large packages be broken up into more easily-manageable Collections, to which Users can be granted higher access and, therefore, greater autonomy. \r\n\r\n\r\n\r\n.. raw:: html\r\n\r\n  <iframe width=\"560\" height=\"315\" src=\"https://www.youtube.com/embed/wv_Gdbl_LrU\" title=\"YouTube video player\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen></iframe>\r\n\r\n----------------------\r\n\r\n.. raw:: html\r\n\r\n  <iframe width=\"560\" height=\"315\" src=\"https://www.youtube.com/embed/ZwVJ0eO2d_I\" title=\"YouTube video player\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen></iframe>\r\n\r\nAuthentication \r\n================\r\n\r\nWhen first accessing STIG Manager, you will be redirected to the Authentication Provider's Log In screen (Keycloak, Okta, F5, etc.).  Your method of authentication will depend on your Organization's specific deployment (CAC, username/password, account brokering, etc). Once complete, you will be redirected back to the STIG Manager User Interface. \r\n\r\n\r\nThe Navigation Tree\r\n======================================\r\n\r\nThe Nav Tree is located in STIG Managers leftmost panel, and provides Users a list of the Collections they have access to, the STIG Library, and User Interface options. For Users with the appropriate Privileges and Grants, Administrative and Configuration functions are also available.\r\n\r\n\r\nCreate your first Collection\r\n======================================\r\n\r\n* **You may have already been given access to some Collections in STIG Manager, or you may not have the Collection Creator privilege. If your Nav Tree is already sufficiently populated, feel free to skip to the Evaluate Asset STIG Compliance section.**\r\n\r\nBy default, most users will have the Collection Creator role, allowing them to create their own Collection of Assets and their STIGs, and to provide access to them to other users in the system. \r\n\r\n#. After logging into the system, click the *+Create Collection* item in the Nav Tree on the left.\r\n\r\n.. thumbnail:: /assets/images/nav-tree.png\r\n      :width: 25% \r\n      :show_caption: True\r\n      :title: Navigation Tree\r\n\r\n\r\n#. You will be prompted for your Collection name and a description.  On Save, you will be automatically made an Owner of the new collection, and will be taken to the Collection Configuration tab for this new Collection. You can access this Collection Configuration tab later using the \"gear\" icon next to your Collection in the Nav Tree, or the \"Manage\" button from the Collection Dashboard.\r\n\r\n\r\n   .. thumbnail:: /assets/images/create-collection-popup.png\r\n      :width: 50%\r\n      :show_caption: True \r\n      :alt: Create Collection Popup\r\n      :title: Create Collection Popup\r\n\r\n\r\n\r\nCreate Assets in your Collection\r\n======================================\r\n\r\n#. From the Collection Configuration tab, use the \"Create Asset...\" button in the Asset panel toolbar to create a couple sample assets. You can also attach STIGs from the \"Create new Asset\" popup at this time. The only required field is \"Name,\" which must be unique in this Collection.\r\n   * You can change all the properties of your asset, including attached STIGs later by double-clicking an asset or using the \"Change Asset properties...\" button in the Assets toolbar.  \r\n\r\n.. thumbnail:: /assets/images/collection-manage-asset-create-button.png\r\n   :width: 50% \r\n   :show_caption: True\r\n   :alt: Create Asset Button\r\n   :title: Create Asset Button\r\n\r\n\r\n.. note::\r\n   Assets and their STIG attachments can also be created automatically in bulk by importing STIG Viewer .ckl or XCCDF files using the \"Import CKL or XCCDF...\" button. :ref:`More info about the Collection Builder function can be found in the User Guide.<Collection Builder>`\r\n\r\n\r\nAttach STIGs to Assets in your Collection\r\n============================================\r\n\r\n#. Add or remove STIGs by double-clicking on an Asset in the Collection Management screen, and making the desired changes in the Asset Pop-up. Click the \"Assign STIG\" button in the popup to do this. Try to attach the same STIG to more than one Asset. It will help demonstrate the Collection Review feature later. Click \"Save\" on the popup when finished.\r\n#. STIGs can also be assigned by double-clicking on a STIG in the Collection Configuration tab, and clicking \"Assign Assets\" button in the popup. \r\n\r\n.. thumbnail:: /assets/images/AssetCreationPopup.png\r\n   :width: 50% \r\n   :show_caption: True\r\n   :alt: Asset Creation Popup\r\n   :title: Asset Creation Popup\r\n\r\n\r\n* The Assets you create and the STIGs you attach to them are presented in the Collection Management tab (In the Asset and STIG panels on the right) as well as the Nav Tree entry for that collection on the left.\r\n\r\n\r\n.. _create-a-grant:\r\n\r\nGrant Users Roles in your Collection\r\n======================================\r\n\r\n#. Grant other Users access to your Collection by clicking the \"New Grant\" button in the Grants panel toolbar. Grants are composed of a Grantee and a Role. See the :ref:`Roles and Access<roles-and-access>` section for more information.\r\n\r\n\r\n   - When you grant Users access to your Collection, or when you are granted access to another Collection by someone else, that Collection will appear in the Nav Tree on the left upon refresh of the app.\r\n\r\n#. By default, Users with a Restricted Role cannot access any Assets in your Collection. Create an Access Control List for these users by clicking on the \"target\" hover icon in the Grants panel. \r\n\r\n   * This will open a popup where you can select specific Assets, STIGs, or Labels that this User can access. Multiple Rules can be created with varying level of Access (Read, Read/Write, or None) to the Assets in the Collection.  Click \"Save\" when finished.\r\n\r\n\r\n.. thumbnail:: /assets/images/collection-manage-grants.png\r\n   :width: 40% \r\n   :show_caption: True\r\n   :alt: Add Collection Grant\r\n   :title: Add Collection Grant\r\n\r\n.. thumbnail:: /assets/images/collection-manage-new-grants-popup.png\r\n   :width: 40% \r\n   :show_caption: True\r\n   :alt: User Pulldown\r\n   :title: User Pulldown\r\n\r\n\r\n|\r\n\r\n\r\n\r\n.. thumbnail:: /assets/images/CollectionConfig_Populated.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :alt: Collection Management panel with demo Assets\r\n      :title: Collection Management panel with demo Assets\r\n\r\n|\r\n\r\nEvaluate an Asset for STIG compliance\r\n======================================\r\n\r\n\r\n#. In the Nav Tree, click on the Collection you just created to open the Collection Dashboard.\r\n#. Select the \"Assets\" tab on the right of the Collection Dashboard.\r\n#. Select an Asset to see its associated STIGs.\r\n#. Double-click on a STIG listed under the Asset, or click the \"shield\" icon that appears when hovering over that row.\r\n\r\n   * You will now be presented with the Evaluation tab for that STIG on that Asset, which contains several panels. The first Rule in the STIG will be selected for you. \r\n\r\n      * The **STIG Checklist panel** on the left lists every rule in the STIG, their evaluation status, and some other helpful info. Click a Rule to load that Rules information, and start a Review of it.\r\n      * The **Rule Content panel** in the center contains the selected Rule's info such as the Rule Title, Manual Checks, Fix info, and associated CCIs.\r\n      * The **Review Resources panel** in the top right contains other Reviews you have performed for the selected Rule against other assets, a history of this Review's status, and any Feedback you have received about this Review from the Collection Owner. Reviews from \"Other Assets\" can be dragged and dropped onto the current assets Review.\r\n      * The **Review panel** in the lower right is where you will actually log your Evaluation of the Rule.  It contains fields to record Review Results, Detail, and Comments.  This panel also indicates who last modified the Review in the \"Attributions\" box. \r\n\r\n      .. thumbnail:: /assets/images/asset-review.png\r\n         :width: 50% \r\n         :show_caption: True\r\n         :alt: Asset Review Workspace\r\n         :title: Asset Review Workspace \r\n\r\n\r\n#. Select a few Rules and save some Evaluations of them. For now, set a few to \"Open,\" and provide a Comment.  You will notice that you have the option to \"Save without submitting\" or \"Save and Submit\" the Evaluations. The \"Submitted\" status is available if you meet the Review Settings configured for your Collection. Hover over the ``(?)`` symbol to view the applicable :ref:`Collection Settings<manage-collection-workspace>` for Reviews in this Collection. \r\n\r\n   * As you perform reviews, the STIG Checklist panel will update the status columns of each Rule. The bar at the bottom of this panel indicates overall status of the checklist. The toolbar at the top provides options for filtering the current view of the checklist, and the \"Checklist\" menu provides various functions, including importing results (in .ckl or XCCDF formats) and exporting results in the .ckl format.\r\n   * These evaluations are summarized and reported in the Reports node of the Nav Tree. Findings present just the Open rule evaluations, and can be exported as a .csv or a POAM-style spreadsheet. Status presents an overall summary of evaluations, showing completion statuses and other info. \r\n\r\n\r\nEvaluate multiple Assets at once for STIG compliance\r\n======================================================\r\n\r\n#. From the Collection Dashboard, select a STIG from the STIGs panel in the Collection you just created.\r\n\r\n   * If you select a STIG, you will see a list of Assets that have that STIG assigned to it. Double-clicking on one of these Assets (or clicking the shield icon in that row) will open the Evaluation tab described in the previous section.\r\n\r\n#. Double-click on the STIG you want to evaluate to open up the Collection Review Workspace. \r\n\r\n   * The Collection Review tab presents similar information to the Evaluation tab, but in a condensed view that allows you to review this STIG against all Assets you have access to in this Collection at once. \r\n\r\n   .. thumbnail:: /assets/images/collection-review-being-edited.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :alt: Editing in the Collection Review panel\r\n      :title: Editing in the Collection Review panel\r\n\r\n#. Select a Rule to review in the top left STIG Checklist Panel. Rule Info will appear in the panel below it.\r\n#. Select an Asset in the Assets panel in the top right. Double-clicking in the Result, Detail, or Comment columns will allow you to edit those fields, either in a pull-down or a text box, as appropriate. Results are saved automatically.\r\n\r\n   * Columns in the STIG Checklist panel will update with Statuses and Results as you review.\r\n\r\n#. Once Assets are reviewed appropriately, the \"Submit\" or \"Accept\" (for Owners only) buttons in the Asset toolbar become available. Click them to set that Asset's Review status. You can set Status on multiple Assets at once by selecting them with a Shift+Click, and then clicking the appropriate toolbar button.\r\n#. If you are an Owner of the Collection, you have the option to \"Reject\" unsatisfactory Reviews. Select a review and then click the \"Reject\" button in the top toolbar. Provide some feedback in the popup that will guide the Evaluator in fixing their Review. Click \"Reject review with this feedback.\" This review will now be set to a Rejected status, and show up in the Evaluators \"Rejected Reviews\" report for their further action or review. \r\n#. If you are an Owner of the Collection, and the option is enabled in Collection Settings, you can set Reviews in your Collection to \"Accepted.\"  \r\n\r\nSTIG Manager Reports\r\n======================================\r\n\r\nFindings Report\r\n-------------------\r\n\r\n#. From the Collection Dashboard, click the \"Details\" button in the header of the \"Findings\" box.\r\n\r\n   * This report lists every Open review in the Collection. It can be aggregated by Rule, Group, or CCI, and filtered by STIG.\r\n   * From the bottom bar of the Aggregated Findings panel, a .csv and a POAM-style spreadsheet export is available for the Rule and Group aggregations.\r\n\r\n#. Select a Finding in the Aggregated Findings panel on the left to display the Assets with those findings in the Individual Findings Panel on the right. \r\n#. Click the \"Generate POA&M...\" button in the bottom bar of the Aggregated Findings panel.\r\n\r\n   * You will be prompted for a little more information, which will be prepopulated into the POA&M cells that will be generated for you.\r\n   * POA&Ms can take different forms, and track more information than is available in STIG Manager. The POA&M output from STIG Manager is intended to be used for reference when populating your official POA&M documents with STIG finding information, and not as a replacement for artifacts that may be directly imported into eMASS or other RMF tools.\r\n\r\n\r\n.. thumbnail:: /assets/images/findings-report.png\r\n      :width: 50% \r\n      :show_caption: True\r\n      :alt: The Findings Report\r\n      :title: The Findings report\r\n\r\n\r\n \r\n\r\n| \r\n\r\n.. rubric:: Congratulations! You've just Managed some STIGs!\r\n\r\n"
  },
  {
    "path": "release-notes.rst",
    "content": "1.6.9\r\n-------\r\n\r\nChanges:\r\n\r\n  - (API) Added guard to prevent elevated requests from modifying collection ``settings``, ``labels``, or ``metadata`` on create/replace/update\r\n  - (API) Simplified asset collection retrieval in controllers\r\n  - (API) Refactored JWKS cache error logging\r\n  - (API) Replaced direct string interpolation in SQL query construction with parameterized binds in MetricsService and JobService\r\n  - (UI) New ``STIGMAN_CLIENT_CONSOLE_MODE`` environment variable to suppress console output in non-development environments\r\n  - (UI) Various escaping and DOM insertion improvements across multiple SM components\r\n  - (UI) Updated OIDC worker initialization\r\n  - (Docs) Clarified data and permissions documentation for elevated actions\r\n  - (Tests) Added regression tests for cross-collection write access; updated test utilities and collection test fixtures to align with API behavior\r\n  - (Dependencies) Update ``fast-xml-parser`` to v5.7.1 and remove the ``uuid`` runtime dependency from the API\r\n  - (Dependencies) Update ``@nuwcdivnpt/stig-manager-client-modules`` to v1.6.7\r\n  - (Dependencies) Various security and maintenance updates\r\n\r\n1.6.8\r\n-------\r\n\r\nChanges:\r\n\r\n  - (Security) Fix reflected XSS in OIDC error handling (init.js, reauth.html)\r\n\r\n1.6.7\r\n-------\r\n\r\nChanges:\r\n\r\n  - (API) feature: Add projections to getChecklistByAssetStig\r\n  - (API/UI) feature: Add updateAssetProps flag and UI for asset information updates on checklist import\r\n  - (API) chore: Remove lodash dependency\r\n  - (Dependencies) Various security and maintenance updates\r\n\r\n1.6.6\r\n-------\r\n\r\nChanges:\r\n\r\n  - (Dependencies) Update npm and pip dependencies\r\n\r\n1.6.5\r\n-------\r\n\r\nChanges:\r\n\r\n  - (Dependencies) Update fast-xml-parser to 5.5.8 with processEntities configuration for STIG checklist compatibility\r\n\r\n1.6.4\r\n-------\r\n\r\nChanges:\r\n\r\n  - (Dependencies) Security update of package undici\r\n\r\n1.6.3\r\n-------\r\n\r\nChanges:\r\n\r\n  - (API) fix: resolve discrepancies in fresh install stored procedures vs migration for Service Jobs feature\r\n  - (API) refactor: replace asyncapi-validator with lightweight AsyncApiValidator class to reduce dependency bloat and improve performance\r\n  - (Docs) Updated build dependency\r\n  - (Client: Dependencies) Update to latest stig-manager-client-modules (1.6.3)\r\n  - (API/Client: Dependencies) Various security and maintenance updates\r\n\r\nNote: This release includes a database migration to resolve discrepancies in the database stored procedures for the Service Jobs feature that could occur on fresh installs. \r\n\r\n\r\n1.6.2\r\n-------\r\n\r\nChanges:\r\n\r\n  - (API) Updated launcher templates\r\n  - (Docs) Updated build dependency\r\n  - (Dependencies) Various security and maintenance updates\r\n\r\n1.6.1\r\n-------\r\n\r\nChanges:\r\n\r\n  - (Dependencies) Various security and maintenance updates\r\n\r\n1.6.0\r\n-------\r\n\r\nChanges:\r\n\r\n  - (Docs) Update license/contributors for 2025\r\n  - (Docs) Describe token value format requirements\r\n  - (Dependencies) chore: Update API dependencies\r\n\r\n1.5.17\r\n-------\r\n\r\nChanges:\r\n  - (Dependencies) Various security and maintenance updates\r\n\r\n1.5.16\r\n-------\r\n\r\nChanges:\r\n  - (API) feature: Native TLS server support with new environment variables `STIGMAN_API_TLS_CERT_FILE` and `STIGMAN_API_TLS_KEY_FILE`\r\n  - (API) feature: Custom CA certificate support for OIDC provider TLS validation via `STIGMAN_OIDC_CA_CERTS` environment variable\r\n  - (API) enhancement: Database TLS certificate paths now support absolute paths while maintaining backward compatibility with relative paths\r\n  - (API) feature: Complete label objects (labelId, name, color) included in API responses alongside existing labelIds arrays\r\n  - (API) feature: revisionDate added to STIG metrics summary responses\r\n  - (API) fix: Missing control field in ccis projection responses\r\n  - (Docs) Updated README.md and screenshots\r\n  - (Dependencies) Various security and maintenance updates\r\n\r\nNote: This release introduces native TLS server support for the API. TLS is enabled by setting both `STIGMAN_API_TLS_CERT_FILE` and `STIGMAN_API_TLS_KEY_FILE` environment variables. If the private key is encrypted, provide the passphrase via `STIGMAN_API_TLS_KEY_PASSPHRASE`. Additionally, deployments using custom or internal certificate authorities for their OIDC provider can now specify a CA certificate file via `STIGMAN_OIDC_CA_CERTS`. Database TLS certificate environment variables (`STIGMAN_DB_TLS_CA_FILE`, `STIGMAN_DB_TLS_CERT_FILE`, `STIGMAN_DB_TLS_KEY_FILE`) now support absolute paths; existing deployments using relative paths continue to work without modification.\r\n\r\n1.5.15\r\n-------\r\n\r\nChanges:\r\n  - (API/UI) feature: New Log Stream feature for Application Managers\r\n  - (API/UI) feature: Bulk assignment of Collection Grants to User Groups\r\n  - (UI) enhancement: Handle cross-origin OIDC with mTLS by pre-fetching openid-config from main thread\r\n  - (UI) enhancement: handle state mismatch by auto redirecting to OIDC Provider for smoother reauth UX\r\n\r\nNote: This release includes the new Log Stream feature. If STIGMan has been deployed behind a reverse proxy, additional configuration may be required for it to function correctly. Please refer to the [STIG Manager documentation](https://stig-manager.readthedocs.io/en/latest/installation-and-setup/reverse-proxy.html#proxy-requirements-for-streaming-sse-and-websocket-endpoints) for guidance on configuring your reverse proxy to support streaming endpoints and WebSockets. This feature can be disabled by setting the environment variable `STIGMAN_EXPERIMENTAL_LOGSTREAM` to `false` if necessary.\r\n\r\n1.5.14\r\n-------\r\n\r\nChanges:\r\n  - (API) feature: New Service Jobs feature for managing automated database maintenance and cleanup tasks\r\n  - (API) feature: Additional MySQL variable and status data in the AppInfo report\r\n  - (UI) fix: workers initialize with random channelName to avoid cross-tab conflicts\r\n  - (UI) fix: use conditional chain in error handler for showAssetProps\r\n  - (API) fix: Update POAM columns to align with new template; clarify feature use in documentation\r\n  - (Docs) Updates describing additional reverse proxy configuration, database configuration, Service Job features, \"POAM\" clarification.\r\n  - (Workflows) Ensure appropriate workflows run when build.sh is modified\r\n\r\nNote: This release includes a database migration to support the Service Jobs feature. The initial implementation provides database maintenance and cleanup jobs that are disabled by default. It is highly recommended that Application Managers enable and schedule these jobs to run periodically to help maintain optimal system performance and minimize resource usage. Documentation and guidance is available in the [STIGMan Application Manager Walkthrough](https://stig-manager.readthedocs.io/en/latest/admin-guide/admin-quickstart.html#enable-service-jobs) and [Guide](https://stig-manager.readthedocs.io/en/latest/admin-guide/admin-guide.html#service-jobs-panel).\r\n\r\n\r\n1.5.13\r\n-------\r\n\r\nChanges:\r\n  - (API) feature: New endpoint using Server Sent Events (SSE) to provide real-time API status\r\n  - (UI) feature: UI responds to new state endpoint to provide real-time API status (configurable with envvar)\r\n  - (API) feature: Streaming responses now include `x-accel-buffering: no` header to prevent buffering with nginx-compatible proxies\r\n  - (API) feature: Update to 800-53 Rev 5 based CCIs and AP mappings (DB Migration included)\r\n  - (API) Remove compression middleware\r\n  - (Docs) Updates describing streaming endpoint proxy configuration\r\n  - (Container) Dockerfile defaults to empty string for build arguments\r\n  - (Workflows) Testing against latest 2 MySQL versions for 8.0.x and 8.4.x tracks\r\n  - (Workflows) Update to new SonarQube scanner action\r\n  - (Dependencies) Update to stig-manager-client-modules 1.5.7\r\n\r\nNote 1: For the API state endpoint SSEs to be effective, proxies should be configured not to buffer responses from that endpoint (`/op/state/sse`). Many proxies honor the `x-accel-buffering: no` header that is now being sent with these responses, but your proxy may require additional configuration. Client use of the new API state reporting endpoint can be disabled by setting the environment variable `STIGMAN_CLIENT_STATE_EVENTS` to `false`.  This should only be disabled temporarily while resolving buffering issues on a reverse proxy. Proxy buffering can also interfere with responses that stream status of long-running operations, such as Collection cloning. [Check the documentation for a further discussion on proxy requirements.](https://stig-manager.readthedocs.io/en/latest/installation-and-setup/reverse-proxy.html#proxy-configuration-for-streaming-and-sse-endpoints)\r\n\r\nNote 2: This release includes a database migration to update CCIs and AP mappings to reflect changes in NIST SP 800-53 Revision 5.\r\n\r\n\r\n1.5.12\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI) feature: Enhanced filters for grid columns with multiple values\r\n  - (UI) feature: Theme syncing across open tabs. \r\n  - (UI) fix: batch edit Enable 'Apply Review' only if the result is selected or changed.\r\n  - (API) feat: report semver with build info\r\n  - (API) fix: STIG Version in .cklb output is now a string \r\n  - (API/UI) feat: Lighter-weight option for fetching App Info: with or without (default) exact row counts \r\n  - (UI) Dependencies: Update to latest stig-manager-client-modules (1.5.6)\r\n\r\n\r\n1.5.11\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI) feature: Support for specifying idle timeout values that will cause the web app to discard its tokens, forcing reauthentication, after the specified period of inactivity.\r\n  - (API/UI) feature: Persist user web preferences in the API database rather than browser local storage\r\n  - (UI) feature: Prefix filenames of exported checklists/archives with appropriate U/CUI markings\r\n  - (UI) enhancement: Add \"Select All\" button to Dashboard Overview Filters, move \"Apply\" button to the top of filter menu\r\n  - (API) enhancement: Exclude disabled collections when recalculating metrics for better performance\r\n  - (UI) enhancement: Meta-Collection Dashboard button now always visible in NavTree\r\n  - (UI) fix: Suppress error when label color is not in predefined palette\r\n  - (UI) fix: Prevent silent failure when attaching artifact to unsaved Review\r\n  - (UI) fix: Store refresh tokens even if they can't be read\r\n  - (API) Dependencies: Various security updates\r\n\r\n  Note 1: This release includes a database migration to support new features.\r\n  Note 2: Web App Idle thresholds can be set separately for Users and Admins with the new environment variables `STIGMAN_CLIENT_USER_TIMEOUT` and `STIGMAN_CLIENT_ADMIN_TIMEOUT`. The default setting is \"0\", which means no timeout. \r\n\r\n1.5.10\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI) feature: New OIDC SharedWorker implementation for better token management across browser tabs allows STIG Manager to be used in more than one browser tab at once. \r\n  - (UI) feature: New options for Client reauthentication: popup window (new default), tab, iframe, or traditional redirect (the old behavior). When configured to use any of the first three options, when a session expires, users will be prompted to reauthenticate without losing the current state of their workspace. Control with new envvar: `STIGMAN_CLIENT_REAUTH_ACTION`. \r\n  - (UI) feature: Added support for opaque refresh tokens to improve compatibility with various OIDC providers\r\n  - (UI) enhancement: Better error handling during app startup\r\n  - (UI) performance: \"Other Assets\" data now loads only when that tab is opened, improving load times\r\n  - (API) enhancement: Easier handling of disabled Assets and Collections with database views\r\n  - (API) fix: Better handling of reviews posted for disabled Assets and Collections\r\n  - (API) fix: Allow \"unavailable\" user properties to be set if the request also changes their status to \"available\" \r\n  - (UI) enhancement: Updated to stigman-client-modules v1.5.5 for improved duplicate asset name detection and handling\r\n  - (API) Dependencies: Various security updates\r\n\r\n  Note 1: This release includes a database migration to support new features.\r\n  Note 2: Some OIDC providers do not properly advertise their support of the Authorization Code Flow with PKCE in their configuration metadata. If you experience issues with OIDC authentication, you may need to set the environment variable `STIGMAN_CLIENT_STRICT_PKCE =false` to disable the strict PKCE check by the STIG Manager client. STIG Manager Client will still use PKCE for the OIDC flow, but will not require the OIDC provider to advertise its support for PKCE in its metadata. \r\n\r\n1.5.9\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI) feature: CORA Scoring added to Collection and Meta Dashboard panels and grids\r\n  - (UI) feature: Double-click on a Review in the \"Other Assets\" tab will now open a modal presenting the entire review\r\n  - (UI) feature: Download individual Review Attachments or an Archive of all Attachments for a Checklist\r\n  - (API) fix: Clone Collection operation now clones AssessedBySeverity columns\r\n  - (UI) fix: correctly handles new response for duplicate asset name\r\n  - (API) Dependency updates\r\n  \r\n  \r\n1.5.8\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI/API) feature: Offer granular import options to specify desired Status for each Result when importing Reviews\r\n  - (UI/Dependency) Update stig-manager-client-modules to 1.5.4 to support new import options\r\n  - (API) feature: New JWKS caching implementation to improve performance and resiliency when connection to OIDC provider is degraded\r\n  - (UI) fix: disappearing gear icon after modifying collection\r\n  - (UI) fix: use optional chaining in generateSharable in AppInfo\r\n  - (UI) fix: Collection Metapanel labels showing error when navigating directly to STIGs tab\r\n\r\n  Note 1: Update STIGMan Watcher to 1.5.2 to take advantage of new granular import options feature\r\n  Note 2: This release includes a database migration to support new features.\r\n  Note 3: API Breaking Change - The autoStatus property in Collection Settings Import Options has been expanded into an object to hold import preferences for each result type.\r\n\r\n\r\n1.5.7\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI/API) feature: Support for Batch Asset creation via CSV import; export CSV representation of Collection Assets\r\n  - (UI/API) feature: User Status feature added to User Admin panel; allows for disabling of users without removing them from the database.\r\n  - (UI/API) feature: Added AssessedBySeverity breakout to summary and detail metrics responses (Available in metrics downloads from UI)\r\n  - (UI/API) feature: support for alternate OAUTH2 response_mode `query` \r\n  - (API) chore: update baseline DB schema and static data \r\n  - (UI) bugfix: filter issue on Results column in Collection Review Workspace\r\n  - (UI) bugfix: case-insensitive check for duplicate label names\r\n  - (API) bugfix: handle absent projection in getFindingsByCollection\r\n  - (UI) Updated to stigman-client-modules v1.5.3 for new CSV parser and other bugfixes \r\n  - (UI/API) dependency updates\r\n\r\n  Note 1: This release includes a database migration to support new features.\r\n  Note 2: API Breaking Change - The API now stores Collection Import Options in the Collection Settings object rather than Collection Metadata.\r\n\r\n\r\n1.5.6\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI) feature: Asset STIG assignment interface updated to present STIGs with the Available/Assigned convention used elsewhere in the UI\r\n  - (API/OAS) feature: Added endpoint to support the creation of multiple Assets in a Collection\r\n  - (API/OAS) feature: Created state module to consolidate API process flow, exit, and dependency retries; endpoint to report API state.\r\n  - (API) feature: Changes to support detection and response to database outage conditions; integrated with state module\r\n  - (API) feature: Added behavior that prevents bootstrap when OIDC provider is using insecure key Ids, and rejects requests made with tokens signed by such keys.\r\n  - (Workflows) Only generate coverage report from end-to-end API tests\r\n  - (Docs) Updated to describe envvars that should only be changed in Dev/Test environments.\r\n  - (API/Docs) Dependency Updates\r\n\r\n**NOTE:** \r\n  This release changes the behavior of the API when configured to use an OIDC provider that presents realm keys identified by Key Ids used in this project's automated testing.  The API will no longer start if the initial realm keys specified by the OIDC Provider are identified by the same Key Ids used in our testing, and if started, will reject all requests that present a token signed by these keys.\r\n\r\n  This condition may occur if your deployment is using a Keycloak container based on one of our Demo containers without making additional changes. If STIGMan refuses to start and outputs a log indicating \"insecure_kid - JWKS contains insecure key IDs\", you should update your realm's signing keys immediately. To change the signing keys used by Keycloak, check [their documentation on generating realm keys](https://www.keycloak.org/docs/latest/server_admin/index.html#realm_keys).\r\n\r\n\r\n1.5.5\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI) fix: Display Collection Properties panel in App Management->Collections interface\r\n  - (APIs) fix: return 404 on elevated requests for unknown collectionId\r\n  - (OAS) Added fully defined appInfo schema to OAS\r\n\r\n1.5.4\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI/API) Display Application Managers in Home Tab (configurable with envvar)\r\n  - (API/Docs) fix: Handle STIGMAN_JWT_PRIVILEGES_CLAIM values with `-` characters and other characters that require double-quoting; Clarification of valid token claim values\r\n  - (API) New projections \"stigs\" and \"ruleIds\" added to GET /stigs/rules/{ruleId} endpoint\r\n  - (API) Refactor and modularize index.js\r\n  - (UI) fix: When deregistering User, remove them from all User Groups\r\n  - (Docs) added missing descriptions for a few detailed metrics\r\n  - (Workflows) Binary test workflow updates\r\n  - (Workflows) Replace deprecated `pkg` package with supported fork\r\n  - (API) Dependency Updates\r\n\r\n1.5.3\r\n-------\r\n\r\nChanges:\r\n\r\n  - (API/UI/DB) The Collection Grants system has been significantly reworked to allow for more dynamic and flexible Grant management. The new Grant system also allows for \"Read Only\" access to Collection Reviews. Details of the new Role-Based Access Control system are found in the [STIG Manager documentation](https://stig-manager.readthedocs.io/en/latest/user-guide/roles-and-access.html).\r\n  - (API/UI/DB) [New User Groups feature.](https://stig-manager.readthedocs.io/en/latest/admin-guide/admin-guide.html#user-groups-admin-panel)\r\n  - (UI) The Collection Review Workspace has been reworked to give more room to Checklist statistics columns and enable future expansion. The display should now be significantly less constrained, especially when viewing extra columns that are usually hidden by default.\r\n  - (OAS/API) Updates to the OpenAPI definition. \r\n  - (API) Refactoring of API token validation processing. \r\n  - (Docs) Updated sphinx and other documentation build dependencies.\r\n  - (Build) Fixed issue preventing binary versions from creating POA&M.\r\n  - (Workflows) Automated testing of linux binaries.\r\n\r\n**NOTES:** \r\n  - This release includes a database migration to support new features. \r\n  - This release changes the minimum required MySQL version from 8.0.21 => 8.0.24\r\n  - This migration will convert any existing \"Asset-STIG\" style assignments for Restricted Users to the equivalent Access Control List style Grants under the new system. After migration, you may want to remove the granular Access Control Rules and create new ones with the more flexible system (for example, creating one Access Control Rule granting access to an entire Asset, rather than each individual Asset-STIG).\r\n  - **This release introduces \"breaking\" changes to the API and STIG Manager OpenAPI definition.** If you have custom integrations or clients that rely on the STIG Manager API, you may need to update them to accommodate these changes. Check the [rbac v2 implementation Pull Request](https://github.com/NUWCDIVNPT/stig-manager/pull/1487) for details of the changes to the API with this release.\r\n\r\n1.5.2\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI) fix: Meta-Collection Dashboard Asset labels now display properly.\r\n  - (UI) fix: Meta-Collection Dashboard correctly handles double-click action on Collections rows.\r\n  - (API/DB) fix: Change review_history.historyId to a bigint to support deployments that have created large numbers of history records. \r\n  - (Workflows) Publish containers to Docker Hub for both AMD64 and ARM64 platforms. \r\n\r\n  - **NOTE:** This release includes a database migration that changes the data type of the review_history.historyId column to a bigint. This migration may take quite some time to complete on deployments maintaining large numbers of Review History records.  \r\n\r\n1.5.1\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI) fix: Handle STIG Ids with spaces \r\n\r\n1.5.0\r\n-------\r\n\r\nChanges:\r\n\r\n  - (API) chore: Update dependencies\r\n  - (UI) Update stigman-client-modules to 1.5.0\r\n  - (UI) provide detailed status during web app bootstrap; handle token errors; test oidc state before token request\r\n  - (Docs) Update license/contributors for 2025\r\n  - (Docs) Update build dependency\r\n\r\n1.4.19\r\n-------\r\n\r\nChanges:\r\n\r\n  - (API) chore: Update dependency Cross-Spawn \r\n  - (API) fix: Allow for use and proper handling of backslashes in metadata values\r\n\r\n1.4.18\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI) feat: Support for importing Evaluate-STIG style XCCDF test results.\r\n  - (UI) fix: Ensure integer size when fractional scaling is applied to UI\r\n  - (UI) fix: Column filters for CCIs in STIG Library \r\n  - (API) feat: XCCDF exports now pass NIST XCCDF validation\r\n  - (API) feat: Avoid incrementing userIds when updating existing user_data records\r\n  - (tests) fix: Use UUIDs when generating test data to avoid collisions\r\n  - (API) Dependency updates\r\n\r\n1.4.17\r\n--------\r\n\r\nChanges:\r\n\r\n  - (UI/API) feat: New, more capable App Data Export/Import feature\r\n  - (API) feat: Handle duplicate CCI elements in Rules from latest DISA Reference STIGs\r\n  - (API) feat: add index for asset/collection state columns in database for better performance\r\n  - (docs) Clarifications and updates for new feature\r\n\r\n  - **NOTE:** This release includes a database migration that adds an index for the ``state`` columns in the ``asset`` and ``collection`` tables. \r\n\r\n1.4.16\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI/API) feat: New enhanced Application Info report available to Application Managers\r\n  - (API) feat: support custom jwt assertion claim (#1401)\r\n  - (API) feat: handle ported MySQL version string when enforcing minimum version (#1398)\r\n  - (docs) Clarifications and updates\r\n  - (tests) New testing framework implemented with Mocha/Chai\r\n  - (API) chore: dependency updates\r\n  - (build) refactor: simplified workflow names\r\n  - (info) New contact information for Application Info and Security Policy reports: RMF_Tools@us.navy.mil\r\n  - **NOTE:** The \"Experimental\" Export/Import Data feature that used to share the \"App Info\" tab must now be enabled explicitly with an Environment Variable (`STIGMAN_EXPERIMENTAL_APPDATA=true`). When enabled, it will have its own node in the Application Management NavTree. See the documentation for more details.\r\n\r\n1.4.15\r\n-------\r\n\r\nChanges:\r\n\r\n  - (API) fix: further improved performance for endpoints that call getCollection (#1363)\r\n  - (API) fix: ensure updateDefaultRev is called as part of a transaction (#1370)\r\n  - (UI) feature: enhanced column filters\r\n  - (API) chore: dependency updates\r\n\r\n1.4.14\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI/API) feat: USMC MCCAST formatted POAM export option (#1345, thank you, @whalenda and NIWC/MCBOSS)\r\n  - (API) fix: pass collectionId to getCollectionLabels() when known for better performance (#1363)\r\n  - (API) fix: metadata query param parsing (#1359)\r\n  - (API) fix: getStigById/getUserByUserId return 404 for nonexistent resources (#1358)\r\n  - (API) enhancement: updated contribution guide\r\n  - (build) enhancement: skips sonarcloud actions when PR form fork (#1351) \r\n  - (API) chore: update mysql init scripts\r\n  - (API) chore: dependency updates\r\n\r\n1.4.13\r\n-------\r\n\r\nChanges:\r\n\r\n  - (API) feat: More “Anonymized Deployment Details” report enhancements\r\n  - (UI/API) fix: Enforce elevate=true parameter for Reference STIG imports\r\n  - (UI) feat: Added load mask to Deployment Details report\r\n  - (UI) feat: Sort labels in column filters\r\n  - (UI) refactor: Adjust rendering for invalid asset labels\r\n  - (UI) refactor: Remove unneeded labels projection from initial Collections request \r\n  - (UI) refactor: Suppress unneeded requests for dashboard data when first loaded  \r\n  - (API) chore: dependency updates\r\n\r\n1.4.12\r\n-------\r\n\r\nChanges:\r\n\r\n  - (API) feat: “Anonymized Deployment Details” report enhancements\r\n  - (UI/API) feat: Date/time added to filenames for exported/generated files\r\n  - (API) fix: Asset updates without collectionId property preserves labels\r\n  - (API) fix: default_rev and stats updated when current STIG revision is removed\r\n  - (API) fix: Resolved issue preventing new deployments from using alternative DB user\r\n  - (build) fix: resolved issue building images with uglify.js\r\n  - (UI/API) feat: Default review history records setting for new Collections set to 5\r\n  - (UI/API) feat: Max review history records setting limited to 15\r\n  - (build) chore: dependency updates\r\n  - **Includes database migration to update settings for existing Collections to reflect the new Review History cap where appropriate. No history is altered as part of the migration, history entries will be trimmed to new max as Reviews are subsequently updated.**\r\n\r\n1.4.11\r\n-------\r\n\r\nChanges:\r\n\r\n  - (UI/API) Removing feature from Release 1.4.8 adding resultEngine, user, statusUser columns to Detail metrics exports. The feature was found to cause poor performance in large deployments. \r\n\r\n1.4.10\r\n-------\r\n\r\nChanges:\r\n\r\n  - (API) bugfix: Resolves issue allowing Collection Owner/Managers to create restricted grant assignments outside of Collection boundary\r\n  \r\n1.4.9\r\n------\r\n\r\nChanges:\r\n\r\n  - (UI) bugfix: Resolves issue preventing node expansion in the Export Results interface\r\n\r\n\r\n1.4.8\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API) feat: Added resultEngine, user, statusUser columns to Detail metrics exports.\r\n  - (API) feat: Listen on STIGMAN_API_PORT on startup and respond with status while bootstrap process is running.\r\n  - (API) chore: Remove Dockerfile healthcheck\r\n  - (API) chore: Refactor controllers to use a set of common functions when checking a collection grant or invoking elevation\r\n  - (Docs) chore: Minor updates and clarifications\r\n\r\n1.4.7\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API) dependency: Update mysql2 library in response to CVE-2024-21511\r\n  - (UI) bugfix: STIG Management UI now displays system-wide count of Collections using a STIG.\r\n\r\n1.4.6\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API) dependency: Update mysql2 library in response to CVE-2024-21508, CVE-2024-21509, CVE-2024-21507\r\n  - (API) Refactor API definition for better maintainability\r\n  - (API) Refactor db query construction for consistency\r\n\r\n1.4.5\r\n-----\r\n\r\nChanges:\r\n\r\n  - (UI/API) feat: Status text field expanded to 511 characters.\r\n  - (UI) bugfix: Review `resultEngine` no longer keeps old value when using drag & drop from Other Assets. \r\n  - (API/DB) chore: Remove unused current_group_rule table and view. \r\n  - (API) bugfix: Review `resultEngine` now only set to null when PATCH'd with a `result` and no `resultEngine`.\r\n  - (API) feat: DB bootstrap improvements, build script, static data.\r\n  - (API) chore: Update dependency in response to CVE-2022-25881\r\n  - **Includes database migration**\r\n\r\n1.4.4\r\n-----\r\n\r\nChanges:\r\n\r\n  - (UI/API) Review Ages exposed in more interfaces: Asset Review, Collection Review, Other Assets\r\n  - (UI/API) Review min/max ages in Collection Review checklist presentations\r\n  - (UI) Bulk .ckl[b]/xccdf imports from Collection Dashboard for all users (for Review updates only)\r\n  - (UI) Reject Status Text validation\r\n  - (UI) bugfix: Collection metadata deletes\r\n  - (API) bugfix: Timestamp update misbehavior in some circumstances\r\n  - (API) Dependency updates in response to CVE-2024-28849; CVE-2024-28176\r\n  - (Docs) Guidance for updating deployments\r\n  - (Docs) Database schemas and diagram updates  \r\n\r\n1.4.3\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API/UI) Added multi-asset patch endpoint with delete support for better performance when deleting large numbers of Assets\r\n  - (UI) Switch to newly-published stig-manager-client-modules package on npm\r\n  - (Docs) Updates to documentation publish process\r\n  - (API) Code cleanup\r\n  - (Docs) Updated STIGMan ASD reference checklist version\r\n\r\n1.4.2\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API/UI) Meta-Collection Dashboard feature\r\n  - (Docs) Documentation updates\r\n  - (Demo/Docs) Demo data updates, include STIGs for demo data.\r\n  - (API) Code cleanup\r\n  - (API/Dependency) Dependency updates  \r\n\r\n  \r\n1.4.1\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API) Fix regression preventing TLS connection to MySQL database\r\n\r\n\r\n  1.4.0\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API/UI) Prevent invalid label assignments that could occur in some circumstances\r\n  - (API) Fix for incorrect import statistics when importing multi-STIG ckl files\r\n  - (API) Remove STIGMAN_DB_TYPE configuration option\r\n  - (API) Refactor service folder structure and references\r\n  - (Docs) Refactor documentation build process\r\n  - (Workflows) Remove Iron Bank images from matrix testing workflow\r\n  - (API) Change default behavior for STIGMAN_JWT_SERVICENAME_CLAIM processing to prefer standard OIDC claim\r\n  - (API) Reject requests when valid username cannot be identified\r\n  - (API/Dependency) Change default Iron Bank base image tag in response to vulnerability\r\n\r\n\r\n1.3.14\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API/UI) Fixed issue that could create invalid filenames for export when Asset/Collection names used reserved characters\r\n  - (UI) Fixed issue that caused borders of certain UI elements to disappear when zoomed\r\n  - (API) Refactored post/put/patch asset review handling\r\n  - (API) Fixed issue that could cause Review status to not reset in certain cases\r\n  - (API/Dependency) Updated axios dependency in response to vulnerability\r\n\r\n1.3.13\r\n-----\r\n\r\nChanges:\r\n\r\n  - (UI/fix) Addressed bug in .cklb parsing preventing import.\r\n\r\n\r\n1.3.12\r\n-----\r\n\r\nChanges:\r\n\r\n  - (UI) Asset Label and STIG Assignment interface update\r\n  - (UI) Resolved issue affecting updating reviews from Collection Review Workspace that were created with old RuleIds. \r\n  - (UI) Addressed issue affecting delimiter handling for inventory exports \r\n  - (API) Resolved issue that could be created when submitting Reviews for Rules with identical ids/fingerprints\r\n  - (API) Statistics were not being recalculated when STIG Assignments were made using PUT endpoint\r\n  - (Workflows) Refactored to incorporate SonarCloud analysis and matrix testing\r\n  - (API) Remove automatic STIG download on first start\r\n  - (Docs) Build dependency update\r\n  - (API) Refactoring service references for clarity\r\n\r\n\r\n1.3.11\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API/UI) Export Reviews to another Collection feature\r\n  - (API) Transfer Asset Labels when moving Assets between Collections\r\n  - (API/UI) Inventory Export feature\r\n\r\n\r\n1.3.10\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API/UI) Provisional .cklb import/export feature.\r\n  - (UI) Added CCIs column to STIG Library grid.\r\n  - (API/fix) XML double-encoding regression after upgrading fast-xml-parser \r\n  - (API/fix) Handle missing description in xccdf benchmark\r\n  - (UI/fix) Remove non-compliant elevate parameter, fix regression preventing app management interface from updating Collections\r\n  - (UI/fix) Workaround non-standard what's new dates\r\n  - (UI/fix) Duplicate collection name detection\r\n\r\n1.3.9\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API/UI) Collection Cloning feature\r\n  - (API/UI) Modify Delete handling for Collections, Assets, and Users to mark records 'disabled' rather than removing them from the database.\r\n  - (UI) Grid text selection moved to right-click function\r\n  - (API/UI) Added STIG Title to metrics endpoint responses, added STIG Title column (hidden by default) to Collection Metrics grids/exports.\r\n\r\n1.3.8\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API/UI) Revision Pinning feature\r\n  - (API/UI) Modify User Delete function to retain users that have accessed the system.\r\n  - (API) OAS cleanup\r\n  - (UI) More explanatory message when User attempts to create Collections or Assets with names that already exist.\r\n  - (API) Dependency updates\r\n\r\n\r\n1.3.7\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API) Update fast-xml-parser dependency to address CVE-2023-34104 (#1012)\r\n  - (API) Addd stack trace to API error responses (#1011)  \r\n\r\n\r\n1.3.6\r\n-----\r\n\r\nChanges:\r\n\r\n  - (APP) tally sprites have been added to the bottom toolbars of grids that display Review data. These sprites show the relevant counts for the various rows, results, and statuses displayed in the grids above. (#992)\r\n  - (App) Resolved Application Deployment Stats download issue. (#994)\r\n  - (App) Resolved issue causing error when persistent Collection Review tab was re-opened.(#997)\r\n  - (App) Resolved issue with errorEvents causing errors in error handler. (#998)\r\n  - (Docs) Additional info about Review handling and tracking between STIG revisions. (#999)\r\n\r\n1.3.5\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API) Review carry-forward feature implemented. Reviews are now associated with a key composed of the calculated digest of Rule Check Content and the Rule Version (\"STIG ID\"), rather than specific RuleIds. This will allow a much greater proportion of Reviews to apply across changes between STIG Revisions (#957).\r\n  - (App) Last modified RuleId context now displayed in Attributions Panel, with hover text indicating other applicable RuleIds.\r\n  - (App) OIDC Library refactor (#775).\r\n  - (API/App) Assessment counts by severity now included in \"Detailed\" Metrics exports (#898).\r\n\r\n\r\n1.3.4\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API/Hotfix) Resolves an issue with missing rule-CCI associations that was causing Findings report miscounts and incomplete Rule Info presentation. \r\n  - (API/Hotfix) Resolves issue that could exclude Findings for Rules that did not have an associated CCI.\r\n  - (App/Hotfix) Removed asmCrypto dependency, replaced with native browser crypto functions.\r\n  - (App) Added more informative error handling messages. \r\n  - (App) Resolved issue preventing Application Managers from creating/modifying Owner grants via the User Admin panel.\r\n  - (API) Refactored Collection Checklist query to improve performance.\r\n  - (Workflows) Updated GitHub workflows to generate test coverage reports, build and sign binary artifacts, audit npm dependencies.\r\n  - (Workflows) The Iron Bank-based image offering on Docker Hub is now based on the Iron Bank Alpine Node image (nodejs18:18-slim), which scans much cleaner than the previously used RHEL UBI. [Reverted]\r\n\r\n\r\n1.3.3\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API/Hotfix) Resolves issue that could lead to inaccurate metrics percentages after Releases 1.3.1 and 1.3.2.\r\n  - (API/Hotfix) Resolves issue that could cause migration 0020 to fail when populating identical duplicate multi-check content fields.\r\n\r\n1.3.2\r\n-----\r\n\r\nChanges:\r\n\r\n  - (App) Pass clobber parameter when recursing zip file.\r\n  - (API) Replace dependency `got` with `axios`.\r\n  - (Docs) Project description, copyright, link updates; Disable failing pdf generation.\r\n  - (App) Restores XSS protections inadvertently removed in 1.3.1.\r\n  - (App) Display STIG Rule differences even if RuleId stayed the same; indicate RuleId change with badge as well as highlighting.\r\n  - (App) Fix Swagger display issue in binary artifacts.\r\n\r\n1.3.1\r\n-----\r\n\r\nChanges:\r\n\r\n\r\n  - (App/API) Allow users to replace existing STIG Revisions when importing reference benchmarks.\r\n  - (App) Restrict Collections Managers from creating or altering Owner Grants. (#934)\r\n  - (App) Parse and import XCCDF with root-level TestResult element (Found in SCAP scan results performed by HBSS or ACAS).\r\n  - (App/API) Support for importing known forms of non-DISA STIGs (vmWare STIG Readiness Guides).\r\n  - (App) Made grid text selectable in most places.\r\n  - (API) Added granular STIG Severity counts to metrics. (#915)\r\n  - (API) Include controls associated with CCIs in CCI projection responses. \r\n  - (API) Updated dependencies identified as vulnerable by Dependabot. (#925) (#918)\r\n  - (Docs) Various updates to documentation describing feature and behavior changes.\r\n  - (API) Removed remaining references to unused \"global\" privilege. (#909)\r\n  - (App/API/DB) Database and API changes to enable future features, including storing the hash of Rule Check Content and refining STIG Revision and Rule/content associations.\r\n\r\n1.3.0\r\n-----\r\n\r\nChanges:\r\n\r\n  - (App) New Collection Dashboard replaces much of the navigation previously performed in the Navigation Tree, as well as the separate Metrics report. \r\n  - (App) New STIG Revision Compare tool available from STIG Library node in Navigation Tree. \r\n  - (App) Addressed issue causing error when empty or undefined review arrays were POSTed.\r\n  - (API) Increased default value for STIGMAN_API_MAX_JSON_BODY to 30MB.\r\n  - (App) Updated dependencies to address dependabot-identified vulnerabilities.\r\n  - (App) Adjusted matching criteria for Assets with website/db extended names. \r\n\r\n1.2.22\r\n-----\r\n\r\nChanges:\r\n\r\n  - (App/API) Added support for display of additional Rule property \"Version\" (aka \"STIG Id\" aka \"Rule_Ver\") information in checklists, STIG Library, and Rule Content Panel (#871)\r\n  - (API/Fix) Resolved issue preventing certain characters from being added to Review text fields (#874)\r\n  - (App/Fix) Resolved issue preventing new user grants from being properly handled in windowed panel (#869)\r\n  - (App) Prevent display grids from preserving state until specifically invoked (#865)\r\n  - (App) Adjusted label for \"Null\" Status import option for better clarity (#878)\r\n  - (App) Added UI indication and disabled Reject button when provided Status Text is longer than defined in specification (#876)\r\n  - (Test) Updated expired test user tokens  (#864)\r\n\r\n1.2.21\r\n-----\r\n\r\nChanges:\r\n\r\n  - (App) Added CSV export button to User App Admin panel. (#856)\r\n  - (App/Fix) Sort Assets in NavTree when building tree node (#855)\r\n  - (API) Updates to node package dependencies (#845)\r\n  - (App) Added a distinct logout button to navtree header (#844)\r\n  - (App) Collection review workspace enhancements, batch editing uses new API endpoints for better performance (#835)\r\n  - (App/Fix) Resolved overly persistent stig grid reload mask (#836)\r\n  - (App/Fix) Fallback to navy logo on img error (#839)\r\n  - (App/Fix) Enabled User grant delete button from User Admin interface (#840)\r\n  - (App) Added sourcemap to support client debugging (#841)\r\n  - (API/Fix) Fixed issue preventing AppData from loading reviewHistory > 5000 characters (#830)\r\n  - (API) Added endpoints for batch POST of reviews (#832)\r\n  - (App) Render rows to a markup cache in BufferView for better performance (#831)\r\n  - (API) Refactor migrations; avoid mysql2 bugs by removing charset/collation directives (#829)\r\n  - (Ops) Removed unused Docker-compose file envvars (#842)\r\n\r\n1.2.20\r\n-----\r\n\r\nChanges:\r\n\r\n  - (Fix) Resolved an issue that could prevent Asset Review Workspace tabs from opening. \r\n  - (Ops) Explicitly including csv-stringify module in pkg build config.\r\n\r\n1.2.19\r\n-----\r\n\r\nChanges:\r\n\r\n  - (Fix) Fixed an issue preventing export of grid data with buffered views. \r\n  - (App) Various CSS and UI optimizations and enhancements.\r\n  - (App) Accept .ckl file imports with untraditional releaseinfo data.\r\n  - (App) Disable submit option if review does not have a valid compliance result.\r\n\r\n1.2.18\r\n-----\r\n\r\nChanges:\r\n\r\n  - (App) Added tooltips to display \"Other Assets\" review content. \r\n  - (App) Preserve column filters when loading grid data.\r\n  - (Fix) Addressed a bug causing an alert when viewing metrics with fresh reviews.\r\n  - (Fix) Addressed a bug preventing Assets from being transferred to other Collections. \r\n  - (Fix) Addressed a bug preventing new Reviews from being manually changed when no commentary is provided by the user.\r\n  - (Fix) Addressed a bug causing text to wrap instead of being truncated in the Collection Review workspace.\r\n  - (Fix) Addressed a bug that could cause display issues for buffered grids at certain zoom levels.\r\n  - (API) Addressed performance issue when querying Assets from large Collections by removing unnecessary grouping clauses.\r\n\r\n1.2.17\r\n-----\r\n\r\nChanges:\r\n\r\n  - (App) Added buffered views for Grids with poor performance when displaying very large Collection data.\r\n  - (API) Adjustment to Metrics endpoints so that they serve data formerly returned from the statusStats projection.\r\n  - (Fix) The two changes above comprise a hotfix addressing poor performance in some areas with very large Collections. \r\n  - (API) Compression enabled for API responses where appropriate.\r\n  - (Tests) Adjusted STIGs used in tests to avoid collisions with standard benchmarkIds. \r\n\r\n\r\n1.2.16\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API/App) New Metrics Report replaces old Status Report; additional API endpoints added to support this feature.\r\n  - (App) Various changes to UI for look/feel tuning.\r\n  - (App) Local storage state provider added to preserve some user configuration of views across sessions.\r\n\r\n\r\n1.2.15\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API/App) Auto-prune review history records using value specified in new Collection Setting. \r\n  - (API) hotfix: stig-asset update preserves existing mappings \r\n  - (API) Retry transactions on deadlock\r\n  - (API/App/OAS) Remove special treatment for SCAP data, as all resultEngines are represented with equal prominence. \r\n  - (App) Limit service worker interceptions \r\n\r\n\r\n1.2.14\r\n-----\r\n\r\nChanges:\r\n\r\n  - (App) Added a service worker to handle streaming downloads. \r\n  - (API) Added new endpoints to return datasets related to \"unreviewed\" rules for Assets. \r\n  - (API) Enhance request body for archive endpoints. \r\n  - (API) XCCDF export and parser changes\r\n  - (OAS) Updates to OAS to better define acceptable requests. \r\n  - (API/OAS) Updates to pre-calculated statistics for STIG/Assets. Now includes totals for every possible result and status state, as well as totals for those states with \"resultEngine\" data.  \r\n\r\n\r\n1.2.13\r\n-----\r\n\r\nChanges:\r\n\r\n  - (UI) Hotfix addressing issue where CKL serializer was failing when parsing CKL with no root XML comment.\r\n\r\n\r\n1.2.12\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API) Hotfix addressing issue #721: API is incorrectly storing and returning a JSON zero (0) instead of null for resultEngine. \r\n\r\n\r\n1.2.11\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API/App/OAS) Experimental streaming archive export of ckl files from Collection Management screen. \r\n  - (App) Easily create a new set of Asset-STIG assignments based off of a set of existing assignments. New filter behavior when selecting STIGs. \r\n  - (App) Added checkbox selection and CTRL-A shortcut options for selecting multiple grid items in several views. \r\n  - (API) New presentation for User grants includes Usernames and Display Names. Filtering now applies to Username and Display Name components, if present.\r\n  - (API/App/OAS) Review Detail and Comment text fields are now limited to 32767 characters. \r\n\r\n1.2.10\r\n-----\r\n\r\nChanges:\r\n\r\n  - (App) Refactored token handling for better Azure AD and Okta compatibility. Added new Envvars for configuration.\r\n  - (App) Truncate the display of long Detail and Comment fields for increased performance and readability. Full text available when editing or by clicking \"Full text\" link.\r\n  - (API) Updated SCAP map to reflect current differences between SCAP IDs and STIG IDs.  \r\n  - (API/App/OAS) Updated checklist statistic calculations to account for new result Id options. Changed column name to \"Other\" to better reflect its contents. \r\n  - (API) Updated got dependency to 11.8.5\r\n\r\n1.2.9\r\n-----\r\n\r\nChanges:\r\n\r\n  - (App) Preview of Batch Edit feature in the Collection Review Workspace.\r\n  - (App) Resolved an issue that could cause error pop-ups when tabs were closed. \r\n  - (App) Adjusted expected Eval STIG info elements.\r\n  - (API) Updated dependencies (multer and express-openapi-validator) to resolve vulnerability found in one of their dependencies (dicer).\r\n  - (API) Log response bodies for elevated requests.\r\n\r\n\r\n1.2.8\r\n-----\r\n\r\nChanges:\r\n\r\n  - (App) Added \"What's New\" pop-up feature\r\n  - (App) Added \"Dark Mode\" preview feature\r\n  - (App) Added Import Options to Collection Settings for granular control over the way Reviews imported from files are posted to the API. \r\n  - (API/OAS) Adjusted API and OAS to bring them into agreement.\r\n  - (App) Added \"Accept\" button to Asset Review Workspace\r\n  - (App) Updated fast-xml-parser to 4.0.7\r\n  - (App) Created common Parser file that can be shared across the UI and stigman-watcher\r\n  - (App) Updates to parser to support processing of Evaluate STIG comments, used to populate ResultEngine data. \r\n\r\n  - (DB) Includes a MySQL migration that:\r\n    - Adds indexes to ``resultEngine`` JSON properties. \r\n    - Removes data in column ``resultEngine`` of ``review`` and ``review_history`` tables where it was automatically populated in previous migration.  \r\n\r\n  **We recommend backing up your database before updating to any release with a database migration.**\r\n\r\n\r\nCommits:\r\n\r\n- 6e543c3d docs: Replaced \"what's new\" latin with more userbase-friendly English text, new pics, small documentation changes.\r\n- 6bbc763c initial SM.WhatsNew\r\n- 050baa41 dark-mode preview (#660)\r\n- 009d1dca feat: control behavior of CKL/XCCDF imports (#659)\r\n- fb7be174 fix: added schema \"CollectionStatistics\" for statistics property in the Collection(s)Projected response schema.  Resolves: #477 (#654)\r\n- b96d7181 fix: further OAS/API reconciliation. (#650)\r\n- 72397da4 fix: Client was looking for display, rather than displayName.  (#649)\r\n- 1fa850da fix: Initial adjustments to OAS and API to bring the two into alignment. (#648)\r\n- 03932e58 feat: accept button in asset review panel (#646)\r\n- 2365895a deps: update client fast-xml-parser to 4.0.7 (#642)\r\n- 8710da53 Update build.sh\r\n- b53807ec workflow: checkout main for alpine workflow too\r\n\r\n1.2.7\r\n-----\r\n\r\nChanges:\r\n\r\n  - (API) Update dependency `minimist` to address a High severity vulnerability\r\n  - (API/Tests) Review History endpoint fixes and new CI tests\r\n  - (App) In the Collection/STIG Review checklist grid, the columns that count O, NF, NA, and NR were expanded to accommodate up to 4 digits. These columns remain fixed width and are not re-sizable by the user.\r\n  - (App) In both the Asset/STIG Review and Collection/STIG Review checklist grids, the default visible columns were changed from \"Group ID and Group Title\" to \"Group ID and Rule Title\". This more closely reflects the observed preferences of many users.\r\n  - (API) resultEngine property added to Review schema. This property is intended to hold data about automated sources of the Review Results. See the API Specification for more details. \r\n\r\n  - (DB) Includes a MySQL migration that:\r\n    \r\n    - Adds JSON column ``resultEngine`` to ``review`` and ``review_history`` tables. \r\n    - Where ``autoResult`` column is set to 1, sets value of resultEngine to  ``{type: \"scap\", product: \"scc\"}``\r\n\r\n  **We recommend backing up your database before updating to any release with a database migration.**\r\n\r\n\r\nCommits:\r\n\r\n  - 9936c15 refactor: remove references to globalAccess and unneeded try/catch (#632)\r\n  - 428784e feat: widen columns; default to groupId/ruleTitle (#640)\r\n  - 99e6e17 feat: resultEngine property added to Review schema (#638)\r\n  - 070b060 docs: include stub html directory (#639)\r\n  - 62011d8 build: add doc build; build images on commit and tag (#637)\r\n  - 4b2d0b9 mixed: Review History tests and fixes to structure and calculation dates  (#631)\r\n  - a6b1c0c chore(deps): bump minimist from 1.2.5 to 1.2.6 in /api/source (#630)\r\n\r\n1.2.6\r\n-----\r\n\r\nChanges:\r\n\r\n  - (App) Rows in the Status and Finding report link to the corresponding Review tabs\r\n  - (API/App) CKL filenames contain the STIG revision string\r\n  - (App) Ensure the Label icon in the NavTree displays in all deployments\r\n\r\nCommits:\r\n\r\n  - 3ad3f21 fix: modify path to label.svg in NavTree (#626)\r\n  - 17c4705 fix: provide specific revision string in suggested filename, in place of \"latest\" (#623)\r\n  - ec8ebde feat: dblclick on a Status/Finding row opens the corresponding Review tab (#616)\r\n\r\n1.2.5\r\n-----\r\n​\r\nChanges:\r\n\r\n  - (API/App) Release of new Asset Labelling feature. Tag Assets in a Collection with Labels \r\n  - (App) Navigation Tree filtering on Asset Labels. \r\n  - (App) Asset Labels are now displayed in various places in UI. \r\n  - (Docs) Documentation for new Asset Label feature available. See sections on the `Navigation Tree <https://stig-manager.readthedocs.io/en/latest/user-guide/user-guide.html#navigation-tree>`_ and `Collection Management - Labels <https://stig-manager.readthedocs.io/en/latest/user-guide/user-guide.html#labels-tab`_.\r\n  - (App) Adjusted language used in Review Panel Attribution box for clarity.\r\n  - (App) Restricted Collection modification options available in Application Management interface to better reflect overall application security approach. \r\n  - (App) Adjusted line spacing to loosen up grid views a little.\r\n\r\nCommits:\r\n\r\n- b662de4 feat: Collection labels (#605)\r\n- 78b8db6 fix: remove listeners on destroy (#606)\r\n\r\n1.2.4\r\n-----\r\n\r\nChanges:\r\n\r\n- (API/App) Endpoint and UI for deployment-wide usage statistics\r\n- (App) CKL export fixes\r\n- (App) Changed incorrectly named column headers on the Collection Manage workspace\r\n- (API/App) Require a compliance result (pass, fail, notapplicable) to submit a Review\r\n- (Docs) Updates regarding \"submit\" status requirements\r\n  \r\nCommits:\r\n\r\n- 8f0905f docs: updates regarding \"submit\" status requirements (#595)\r\n- 86a9890 fix: require a compliance result to submit review (#594)\r\n- b506920 fix: headers don't match API (#592)\r\n- 0c7ecf5 fix: CKL export fails to include all rules (#591)\r\n- 98025ce feat: endpoint and ui for /op/details (#570)\r\n\r\n1.2.3\r\n-----\r\n\r\nChanges:\r\n\r\n  - (App) Trim white space from exported CSV values\r\n  - (API) Include request body when logging at level 4\r\n  - (App) Corrected web app logic for XCCDF imports\r\n\r\nCommits:\r\n\r\n- a93f6fe fix: web app xccdf import logic (#582)\r\n- 22cbfe7 feat: log request body when logLevel = 4 (#581)\r\n- 4319979 feat: ExportButton trims values (#576)\r\n\r\n\r\n1.2.2\r\n-----\r\nChanges:\r\n\r\n- Fix a UI regresssion that incorrectly hides the \"Accept\" button and disables the \"Reject\" feature\r\n- The experimental AppData feature now supports Review history items\r\n\r\nCommits:\r\n\r\n- fix: accept button incorrectly hidden (#571)\r\n- feat: include review history in appdata export/import (#562)\r\n- remove: CORS proxy for OIDC (#558)\r\n- refactor: fetchStig/Scap logging (#557)\r\n- chore: Build updates (#556) \r\n- doc: remove videos from source and build\r\n\r\n1.2.1\r\n-----\r\nChanges:\r\n\r\n- BREAKING API CHANGE: The OpenAPI schema for Collection was revised. ``Collection.workflow`` was removed. ``Collection.settings`` was introduced and is mandatory for POST/PUT requests.\r\n- Resolved a bug where ``Collection.description`` was not being saved (#547)\r\n\r\nIncludes a MySQL migration that:\r\n\r\n- Drops column ``collection.workflow``\r\n- Adds column ``collection.settings`` as type ``JSON``\r\n- Sets the value of column ``settings`` for each record in table ``collection`` based on the value of ``metadata.fieldSettings`` if it exists, and ``metadata.statusSettings`` if it exists. If those values do not exist, then the default value of settings is used.\r\n\r\n  .. code-block:: json\r\n    \r\n    {\r\n      \"fields\": {\r\n        \"detail\": {\r\n          \"enabled\": \"findings\",\r\n          \"required\": \"findings\"\r\n        },\r\n        \"comment\": {\r\n          \"enabled\": \"always\",\r\n          \"required\": \"always\"\r\n        }\r\n      },\r\n      \"status\": {\r\n        \"canAccept\": true,\r\n        \"minAcceptGrant\": 3,\r\n        \"resetCriteria\": \"result\"\r\n      }\r\n    }\r\n\r\n- Removes the keys ``fieldSettings`` and ``statusSettings`` from the value of column ``metadata`` for each record in table ``collection``\r\n\r\n**We recommend backing up your database before updating to any release with a database migration.**\r\n\r\nCommits: \r\n\r\n- 6622d39 test: collection settings; object creation (#550)\r\n- 675e031 feat: adds Collection.settings (#548)\r\n- fa55151 doc: synchronize build with source (#543)\r\n- 9c071ff fix: add additional images to client dist (#544)\r\n\r\n1.2.0\r\n-----\r\nChanges:\r\n\r\n- structured logging output from the API as a JSON stream\r\n- build script to generate a minimized client distrubution\r\n- build script to generate signed binaries of the API for Windows and Linux\r\n- updates to the CD workflows\r\n- dependency updates which resolve recently reported security vulnerabilities\r\n- minor bug fixes\r\n\r\nCommits:\r\n\r\n- 13e4d1a dev: api distribution build script (#541)\r\n- 434e984 refactor: remove client from event path (#540)\r\n- b1903c6 fix: register xtype for STIG revision grid (#539)\r\n- bb374d1 fix: escape quotes in Welcome title and message (#538)\r\n- 459ef3e refactor: JSON_EXTRACT() instead of JSON_VALUE() (#537)\r\n- 19892dc chore: increment copyright year (#536)\r\n- d93bb4d chore: update node modules (#535)\r\n- 7fad835 dev: client distribution build script (#534)\r\n- dff8a9e feat: JSON logging and supporting code (#530)\r\n- 3ac29a5 docs:  updated Logging, Environment Variables, Setup and Deployment docs. (#524)\r\n\r\n1.1.0\r\n-----\r\nIncludes breaking changes to the OpenAPI definition that affect clients such as `STIG Manager Watcher <https://github.com/NUWCDIVNPT/stigman-watcher>`_. Some properties of the schemas for ``Review...`` and ``ReviewHistory...`` have been changed, renamed or removed:\r\n\r\n- ``resultComment`` is renamed to ``detail``\r\n- ``actionComment`` is renamed to ``comment``\r\n- ``action`` is removed\r\n- ``status`` value can be either a string or an object. See the definition for details.\r\n\r\nIncludes a MySQL migration that changes the schema for tables ``review`` and ``reviewHistory``. \r\n\r\n- The running time of the migration depends on the number of records in those tables. \r\n- The migration also drops the small, static table ``action``.\r\n- We recommend backing up the database before updating to any release with a database migration. \r\n\r\nCommits:\r\n\r\n- ui: styling tweaks (#517)\r\n- docs: consolidated some redundant docs, added info about collection settings, updated screenshots (#514)\r\n- feat: update UI labels (#513)\r\n- feat: review status handling (#511)\r\n  \r\n1.0.42\r\n------\r\n- fix: CKL comments restored (#505)\r\n- oas: Various OAS changes to enable better response validation (#500)\r\n- fix: always sort Collection Review to top (#501)\r\n\r\n1.0.41\r\n------\r\n- fix: filter grid on asset name (#498)\r\n- feat: UI support for STIG/revision delete (#491)\r\n- refactor: unhandled rejections (#490)\r\n- doc: Additional documentation updates, links. (#489)\r\n- doc: Added project security policy, security docs, docker trust public key, stigman sample .ckl (#486)\r\n- feat: choice to export mono- or multi-STIG CKLs (#480)\r\n- refactor: await _migrations table (#476)\r\n\r\n1.0.40\r\n------\r\n- fix: allowReserved for office query param (#474)\r\n- deps: rm connect,compression, request; update xlsx-template (#473)\r\n- feat: STIG Library feature introduced (#472)\r\n- refactor: ui rendering (#471)\r\n- refactor: reduce web client smells (#470)\r\n- feat: column filters (#469)\r\n- chore: fictionalize appdata city (#468)\r\n- chore: remove unused client dockerfile (#467)\r\n- fix: encode office query param (#466)\r\n- feat: userObject.display tries username or servicename (#463)\r\n\r\n1.0.0-beta.39\r\n-----------------------\r\nThis is the last release to have a `beta` designation. Several UI enhancements are introduced, including:\r\n\r\n- `New names for the Review commentary fields <https://stig-manager.readthedocs.io/en/latest/user-guide/user-guide.html#review-panel>`_\r\n- `New settings for Reviews in Collection Management <https://stig-manager.readthedocs.io/en/latest/user-guide/user-guide.html#collection-settings-tab>`_\r\n- `Ability to display a custom image and text in the Home tab Welcome panel <https://stig-manager.readthedocs.io/en/latest/installation-and-setup/environment-variables.html#id3>`_\r\n\r\nThere is a database migration included in this release that moves the data in table stats_asset_stig to stig_asset_map.\r\n\r\n- feat: Welcome message enhancements (#461)\r\n- feat: experimental CORS proxy for OIDC (#460)\r\n- docs: updated screenshots, added care and feeding, autoresult, and CORS sections, updated terminology, many other small fixes. (#462)\r\n- feat: welcome widget icon/text can be customized (#458)\r\n- feat: UI support for rejectedCount, minTs, maxTs (#456)\r\n- feat: updated loading screen for the UI (#457)\r\n- feat: statusStats with rejectCount, minTs, maxTs (#454)\r\n- fix: query param inadvertently marked as path param in Asset/getChecklistByAsset (#453)\r\n- feat: GET /op/definition endpoint with JSONPath (#452)\r\n- feat: Web app updates (#442)\r\n- feat: relaxed CKL revision checks by default (#450)\r\n- deps: remove unused patch-package (#449)\r\n- test: limit bootstrap wait to 45 seconds (#448)\r\n- deps: updating jwks-rsa to 2.0.4 removes axios (#446)\r\n- refactor: move stats to stig_asset_map (#431)\r\n- refactor: reduce duplicated code for data migrations (#433)\r\n- feat: adds new review-history endpoints (#417)\r\n\r\n1.0.0-beta.38\r\n-----------------------\r\n- fix: don't sort for history projection (#419)\r\n- doc: include build in Docker image and serve with express (#414)\r\n- fix: setting stig-asset access was generating 404 incorrectly  (#416)\r\n- fix: don't sort reviews to workaround MySQL bug (#411)\r\n- feat: deleting a STIG updates related tables (#409)\r\n- feat: UI keeps tokens refreshed (#408)\r\n\r\n1.0.0-beta.37\r\n-----------------------\r\n- feat: support generic OIDC providers (#403)\r\n- fix: cci param, added checks for projections to tests (#404)\r\n- feat: Adds metadata handling for Assets and Collections (#396)\r\n- feat: STIGMAN_DEV_RESPONSE_VALIDATION environment variable (#398)\r\n- fix: access control checks for assets (#400)\r\n- chore: update sample appdata (#394)\r\n- fix: implement delete STIG revision (#383)\r\n- feat: Removed global_access privilege (#386)\r\n- feat: UI for asset transfers (#385)\r\n- feat: switched OpenAPI validation/router library to express-openapi-validator (#382)\r\n- feat: continue on corrupted member of STIG zip (#377)\r\n- feat: continue on error when importing zips of STIGs (#376)\r\n- feat: All users can access Collection Review (#375)\r\n- fix: use promise interface for conn.query() (#372)\r\n- fix: implement CCI endpoints (#363)\r\n- fix: recalculate stats on Review delete (#367)\r\n- feat: add name and email to User object (#369)\r\n- fix: UI sends correct projections (#368)\r\n- fix: implement GET /stigs/rules/{ruleId} (#354)\r\n\r\nIntroduced new envvars, which deprecate existing envvars in some cases:\r\n\r\n- ``STIGMAN_OIDC_PROVIDER`` deprecates ``STIGMAN_API_AUTHORITY``\r\n- ``STIGMAN_CLIENT_EXTRA_SCOPES`` is new\r\n- ``STIGMAN_CLIENT_ID`` deprecates ``STIGMAN_CLIENT_KEYCLOAK_CLIENTID``\r\n- ``STIGMAN_CLIENT_OIDC_PROVIDER`` deprecates ``STIGMAN_CLIENT_KEYCLOAK_AUTH`` and ``STIGMAN_CLIENT_KEYCLOAK_REALM``\r\n- ``STIGMAN_JWT_PRIVILEGES_CLAIM`` deprecates ``STIGMAN_JWT_ROLES_CLAIM``\r\n- ``STIGMAN_SWAGGER_OIDC_PROVIDER`` deprecates ``STIGMAN_SWAGGER_AUTHORITY``\r\n\r\n1.0.0-beta.36\r\n-----------------------\r\n- fix: UI now handles missing vulnDiscussion (#361)\r\n- doc: Fixed link to create new github issues (#358)\r\n\r\n1.0.0-beta.35\r\n-----------------------\r\n- doc: document Attachment feature; reorganize with minor terminology changes. (#357)\r\n- feat: Review metadata and attachments (#353)\r\n- fix: implement MySQL deleteReviewByAssetRule method (#351)\r\n- chore: remove CKL/SCAP import endpoint (#343)\r\n- doc: Updates to contribution docs, node.js envvar setting (#339)\r\n- fix: Format roles claim for optional chaining (#338)\r\n\r\nThere is a database migration included in this release that adds a metadata column to the review table with a default value of {}. No other changes are made to the schemas and no data is moved, modified, or deleted.\r\n\r\n\r\n1.0.0-beta.34\r\n-----------------------\r\n- fix: Refactor Env.js/keycloak.json handling (#335)\r\n- feat: SCAP benchmarkId Map (#329)\r\n- feat: History -> Log, include current Review (#328)\r\n- feat: Dynamically generate Env.js and keycloak.json (#327)\r\n- feat: Verbose logging of AUTH bootstrap errors (#325)\r\n- docs: contributing information updated (#326)\r\n- build(deps): bump urllib3 from 1.26.4 to 1.26.5 in /docs (#321)\r\n- docs: Updates to project Contributing docs (#318)\r\n- chore: Matched workflow name and job name\r\n- feat: gave Iron Bank its own workflow file so it can be run independently (#315)\r\n\r\n1.0.0-beta.33\r\n-----------------------\r\n- doc: relative link to video was wrong for top-level index.rst file (#311)\r\n- doc: updates to docs and tests relating to Not Reviewed functionality. Workflow change for new Test Collection folder. (#308)\r\n- feat: Accept all XCCDF result values (#307)\r\n\r\n1.0.0-beta.32\r\n-----------------------\r\n- fix: Throttle requests for Submit All (#306)\r\n- docs: follow code.mil guidance on license.md file (#301)\r\n- build(deps): bump hosted-git-info from 2.8.8 to 2.8.9 in /api/source (#302)\r\n- fix: Check for collectionId in event handlers (#299)\r\n- build(deps): bump handlebars from 4.7.6 to 4.7.7 in /api/source (#296)\r\n- build(deps): bump lodash from 4.17.19 to 4.17.21 in /api/source (#297)\r\n- fix: Asset endpoints: test coverage, implementation (#295)\r\n\r\n1.0.0-beta.31\r\n-----------------------\r\n- fix #275: handle rule-result without check (#290)\r\n- feat: Drag from Review History (#288)\r\n- fix #145: Review vetting for all users (#285)\r\n- feat: Endpoint updates (#284)\r\n- docs: Added default_group to prevent guid generation, removed doctrees, added a bit of info to Contributing doc. (#281)\r\n- chore: remove obsolete docker dir (#278)\r\n- fix #276: remove reference to database 'stigman'\r\n\r\n1.0.0-beta.30\r\n-----------------------\r\n- fix #270: ROLE element default value 'None' (#272)\r\n- fix #266: sanitize exported filenames (#273)\r\n- ironbank => development sign+image\r\n\r\n1.0.0-beta.29\r\n-----------------------\r\n- fix #256: CKL site/instance handling; UI refactor (#268)\r\n\r\n1.0.0-beta.28\r\n-----------------------\r\n- fix #264: Display feedback for rejected reviews (#265)\r\n- fix: Filter members only on .xml extension  (#260)\r\n- fix: New/Delete => Assign/Unassign (#261)\r\n- fix: SET NAME to utf8mb4 encoding (#262)\r\n- feat: format roles claim with bracket notation and optional chaining (#190)\r\n- fix: cast userId as char (#249)\r\n- fix: handle property chains with hyphens (#257)\r\n- fix: create date is not ISO8601 UTC (#189)\r\n- fix: response schema for /opt/configuration (#147)\r\n- fix: Attach => Assign STIG (#118)\r\n- fix: log servicename if present (#198)\r\n\r\n1.0.0-beta.27\r\n-----------------------\r\nMigrates MySQL\r\nMigration notes included in #251 \r\n\r\n- feat: Ext.LoadMask looks for store.smMaskDelay (#254)\r\n- fix: batch import continues on error, refreshes grids (#252)\r\n- fix: increased length of asset name,ip,mac,fqdn and allow more nulls  (#251)\r\n\r\n1.0.0-beta.26\r\n-----------------------\r\n- fix: sticky bit for world-writable dirs created by npm (#245)\r\n- feat: mercury-medium color is more blue (#243)\r\n- feat: Tooltips for Review labels and headers (#240) (#242)\r\n- doc: updates regarding ckl -> stigman field mappings, clients folder when running from source (#241)\r\n- build(deps): bump urllib3 from 1.26.3 to 1.26.4 in /docs (#238)\r\n- feat: Manage Assets -> multi-delete (#232), columns (#236)\r\n\r\n1.0.0-beta.25\r\n-----------------------\r\n- chore: remove unused oracledb dependency (#229)\r\n- Multiple fix and features (#228)\r\n- fix: fetch STIG/SCAP if configured at bootstrap (#227)\r\n\r\n1.0.0-beta.24\r\n-----------------------\r\n- Multiple fixes and features (#225)\r\n- fix: Exports on multiple reports (#224)\r\n- doc: Added a little more about .ckl and data handling (#223)\r\n- build(deps): bump y18n from 3.2.1 to 3.2.2 in /api/source\r\n- fix: reduce deadlock potential (#216)\r\n\r\n1.0.0-beta.23\r\n-----------------------\r\n- fix: remove hard-coded reference to schema (#211)\r\n- feat: UI shows collectionId (#210)\r\n- feat: progress bar styling (#209)\r\n- Common tasks elaboration, other edits (#208)\r\n- feat: case-sensitive collation for benchmarkId in MySQL (#206)\r\n- feat: name-match params and duplicate handling (#204)\r\n- doc: Added some documentation about new .ckl archive export feature. (#203)\r\n- adjust path to docker readme (#196)\r\n\r\n1.0.0-beta.22\r\n-----------------------\r\n- fix: Improved output when importing STIG XML (#192)\r\n- fix: case-insensitive filename matching (#192)\r\n- feat: Collection export management (#169)\r\n- docs: Build documentation with Sphinx (#188)\r\n\r\n1.0.0-beta.21\r\n-----------------------\r\n\r\n- fix: Set Ext.Layer z-index default = 9000 (#185)\r\n\r\n1.0.0-beta.20\r\n------------------\r\n- fix: Log username for unauthorized requests (#178)\r\n- feat: File uploads use memory storage (#180)\r\n\r\n1.0.0-beta.19\r\n---------------\r\n- feat: Export Collection-STIG CKL archive (#176)\r\n- fix: inline row editors (#167) (#174)\r\n\r\n1.0.0-beta.18\r\n--------------------\r\n- feat: Preview tabs for workspaces (#172)\r\n\r\n1.0.0-beta.17\r\n----------------------\r\n- fix: Reviews for non-current ruleIds (#155)\r\n- fix: Saving unchanged Review updates timestamp (#153)\r\n- fix: increase test coverage (#151)\r\n\r\n1.0.0-beta.16\r\n-----------------------\r\n- feat: Asset-STIG CKL import UI enhancements (#86) (#143)\r\n- fix: GET /collections/{collectionId}/poam fail with 500 (#141) (#142)\r\n- fix: Implement submit all from Asset-STIG UI (#88)\r\n- feat: Iron Bank base image in CD workflow (#139)\r\n- feat: HEALTHCHECK and FROM argument (#108)\r\n- feat: Support older MySQL syntax and check minimum version (PR #137)\r\n- fix: access is set for lvl1 users only (#121)\r\n- fix: Make note of accessLevel requirements (#102)\r\n- fix: Remove unused Findings projections (#101)\r\n\r\n1.0.0-beta.15\r\n-----------------------\r\n- feat: check MySQL version during startup (#136)\r\n- fix: Support older MySQL syntax for now (#135)\r\n- fix: access is set for lvl1 users only (#121)\r\n- fix: Make note of accessLevel requirements (#102)\r\n- fix: Remove unused Findings projections (#101)\r\n\r\n1.0.0-beta.14\r\n-------------------------\r\n- fix: Remove standard feedback widget (#120)\r\n- more info about workflow, possible configurations, and default db port update (#127)\r\n- Merge PR #119 from cd-rite\r\n- Added commented-out test for Issue #113 (#115)\r\n- API testing README (#114)\r\n\r\n1.0.0-beta.13\r\n------------------------\r\n- fix: API issues #97 #98 (#111)\r\n- fix: Tab stays open on Collection Delete (#92)\r\n- fix: Individual Findings not listing STIG (#96)\r\n- fix: Delete Grant is always active (#81)\r\n\r\n1.0.0-beta.12\r\n-------------------------\r\n- Merge pull request #93\r\n- Remove typeCast handling for JSON (#62)\r\n- fix: UI Import results completion message (#58)\r\n- fix: collection review filter (#64)\r\n- HTML entities in CKL are not decoded (#63)\r\n- Update jwks-rsa to 1.12.1(#74)\r\n\r\n1.0.0-beta.11\r\n---------------------\r\n- Experimental appdata example (#66)\r\n\r\n1.0.0-beta.10\r\n------------------------\r\n- Bump ini from 1.3.5 to 1.3.8 in /api/source (#60)\r\n- Action Comments do not import if there is no Action (#61)\r\n\r\n1.0.0-beta.9\r\n------------------------\r\n- Provide guidance for non-localhost browsers (#54)\r\n- Client CKL/SCAP import less verbose (#55)\r\n- (fix) UI: Metadata has malformed History property\r\n- Comment out unimplemented endpoints\r\n\r\n1.0.0-beta.8\r\n-----------------------\r\n- (fix) #47 ungranted reviews for lvl1 (#48)\r\n- Update import_realm.json\r\n- redirects include HTTPS and remove MQTT\r\n- (fix) Empty string scope not failing #42\r\n- Added more comprehensive testing, altered workflow for efficiency (#43)\r\n\r\n1.0.0-beta.7\r\n-------------------\r\n- (fix) stigGrant projection #40\r\n\r\n1.0.0-beta.6\r\n--------------------\r\n- ovalCount based on ruleId instead of benchmarkId\r\n\r\n1.0.0-beta.5\r\n------------------------\r\n- Migration of v_current_rev to support draft STIGs\r\n\r\n1.0.0-beta.4\r\n----------------------\r\n- BUG: \"All checks\" drop down filter doesn't work (#32)\r\n- Additional collection review updates\r\n- Version in package.json\r\n- Handle concurrent Ext.Ajax requests that delete pub.headers\r\n\r\n1.0.0-beta.3\r\n-----------------\r\nFixes:\r\n- UI: Collection->Reports->Findings workspace failed to open\r\n- API: Issue #29 max json body and upload envvars\r\n- UI: Closing message box was confirming action\r\n- UI: Import STIG message box mistitled\r\n- UI: Call updateToken() before direct fetch/xhr\r\n\r\n1.0.0-beta.2\r\n-------------------\r\nFixed GitHub Issue #27. STIG checklist imports were critically affected by a regression introduced with beta.1\r\n\r\n1.0.0-beta.1\r\n----------------------\r\nNumerous enhancements and bug fixes, including token handling and better concurrency. The project is ready for non-production deployments and pilots to demonstrate suitability for first production release.\r\n\r\n1.0.0-beta\r\n-------------------\r\n\r\nThis is the initial beta release of STIG Manager\r\n\r\n\r\n\r\n\r\n"
  },
  {
    "path": "root.json",
    "content": "{\"signed\":{\"_type\":\"Root\",\"consistent_snapshot\":false,\"expires\":\"2031-04-03T21:12:39.405464711-04:00\",\"keys\":{\"1c1093efb5f321a1d3c2301f9fbb19472ade88167deb3ba1b2701884c4965a01\":{\"keytype\":\"ecdsa\",\"keyval\":{\"private\":null,\"public\":\"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfko1LAradRhcunef8BrjfnZ32ZDu6KflLHEEg0/5nivp/1b0fgSHyLPk76B6dADQ+37X0YB0V/+5zLbcMOrHHw==\"}},\"4de56d1d989a0bbd42b3491f24a5943c6a5ea1d94dcfd18c4feacf4517f55e16\":{\"keytype\":\"ecdsa-x509\",\"keyval\":{\"private\":null,\"public\":\"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJqRENDQVRHZ0F3SUJBZ0lRSEtxM3VrVGdsUDU0eHVxbnZwaVlEREFLQmdncWhrak9QUVFEQWpBc01Tb3cKS0FZRFZRUURFeUZrYjJOclpYSXVhVzh2Ym5WM1kyUnBkbTV3ZEM5emRHbG5MVzFoYm1GblpYSXdIaGNOTWpFdwpOREEyTURFeE1qRTJXaGNOTXpFd05EQTBNREV4TWpFMldqQXNNU293S0FZRFZRUURFeUZrYjJOclpYSXVhVzh2CmJuVjNZMlJwZG01d2RDOXpkR2xuTFcxaGJtRm5aWEl3V1RBVEJnY3Foa2pPUFFJQkJnZ3Foa2pPUFFNQkJ3TkMKQUFTeFdZdjZOWVBMV1pXVkEyd2VxakN1Q3JpNTljMWV1NDRTUlI3VDJMYjhHTFBvVmpjZUF4UVlGZDcyKzhiUQplbGNWZHBMSFdEYm50dXBOaGdWTVdPcG1velV3TXpBT0JnTlZIUThCQWY4RUJBTUNCYUF3RXdZRFZSMGxCQXd3CkNnWUlLd1lCQlFVSEF3TXdEQVlEVlIwVEFRSC9CQUl3QURBS0JnZ3Foa2pPUFFRREFnTkpBREJHQWlFQXVjcFAKb2FOK0ppSG5iVFV2ZUFrbm0wdm1ITVRpd0ZsRGVDcVhneUdmUmE4Q0lRRDh5ZUkwY04vQ0lhT2VmUkVnaXRXTwp0cGdSWWhKSkx5blRhODBKSzVEbmlnPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\"}},\"68e10044836715c44a9086d9ed382790d47850701f5eee16e1c5553236b32c0f\":{\"keytype\":\"ecdsa\",\"keyval\":{\"private\":null,\"public\":\"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEaRJyCdrRD6097sUInuifcCytYOfbxmaS6njxCLJQmHMPk4cx9U6/IY9dBfNf52K7H2X88xocuvSBFwlGYT80HQ==\"}},\"c07503efde7064fcbae59e59df46b4de01245eaf0faaa03a5a1e01af43453977\":{\"keytype\":\"ecdsa\",\"keyval\":{\"private\":null,\"public\":\"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeyiOKhfy9sMsAPuGCs/+A3htQiifeDpQglM+6qhM/aCkxxzbh6QdBnCLWmESPJaKRDsyg5WJheqQZ+eIxOHnuQ==\"}}},\"roles\":{\"root\":{\"keyids\":[\"4de56d1d989a0bbd42b3491f24a5943c6a5ea1d94dcfd18c4feacf4517f55e16\"],\"threshold\":1},\"snapshot\":{\"keyids\":[\"1c1093efb5f321a1d3c2301f9fbb19472ade88167deb3ba1b2701884c4965a01\"],\"threshold\":1},\"targets\":{\"keyids\":[\"c07503efde7064fcbae59e59df46b4de01245eaf0faaa03a5a1e01af43453977\"],\"threshold\":1},\"timestamp\":{\"keyids\":[\"68e10044836715c44a9086d9ed382790d47850701f5eee16e1c5553236b32c0f\"],\"threshold\":1}},\"version\":1},\"signatures\":[{\"keyid\":\"4de56d1d989a0bbd42b3491f24a5943c6a5ea1d94dcfd18c4feacf4517f55e16\",\"method\":\"ecdsa\",\"sig\":\"nq7EaNG9UmgwE5t+BAgjYyhHQ0LK9ZQZCKSZZjhSN5SrAmU7276O0NYuAkPr1osp/892YRgxu2cHZMhIf7bTiQ==\"}]}"
  },
  {
    "path": "test/api/README.md",
    "content": "# API testing\nThis project contains a set of Mocha and Chai tests for stig-manager.\n\n## Runtime environment\n### Authentication Server\nRun ***ONE*** of the following:\n- A container instance of [our demo Keycloak image](https://hub.docker.com/r/nuwcdivnpt/stig-manager-auth) \n   > Example with docker\n    ```\n   docker run --name stig-manager-auth -p 8080:8080 nuwcdivnpt/stig-manager-auth\n   ```\n  \n\n- An HTTP server on port 8080 that accepts requests for the content in `./mock-keycloak`\n\n   > Example with Python3:\n\n   ```\n   cd mock-keycloak && python3 -m http.server 8080 &\n   ```\n\n### Database\n- Run an instance of [the official MySQL image](https://hub.docker.com/_/mysql)\n\n   > Example with docker\n    ```\n   docker run --name stig-manager-db \\\n  -p 3306:3306 \\\n  -e MYSQL_ROOT_PASSWORD=rootpw \\\n  -e MYSQL_DATABASE=stigman \\\n  -e MYSQL_USER=stigman \\\n  -e MYSQL_PASSWORD=stigman \\\n  mysql:8\n   ```\n\n### API\n- Run the API so it answering requests at `localhost:64001/api`, and can communicate with the Authentication Server and database.\n- The API can be run in a dev environment such as Visual Studio Code or in a container\n\n   > Example with docker\n   ```\n  docker run --name stig-manager-api \\\n  -p 64001:54000 \\\n  nuwcdivnpt/stig-manager\n   ```\n\n\n\n## Installation\n\nTo install the dependencies required to run the test suite, run this command from the test folder:\n\n```\nnpm install\n```\n\nEnsure that testConfig.js is configured correctly. This file contains the base URL for the API and access token for the admin test user. \n```test/api/mocha/testConfig.js```\n\n\n## Usage\n\nThe test suite uses Mocha as the test runner and Chai for assertions. \n\nTo run the tests for local development, use the following bash script:\n\n```test/api/runMocha.sh``` (use -h flag for help)\n\nIn CI/CD use ```npm test``` to run tests. \n\n\n\n\n## How to Write Tests\n\nThe test suite follows these conventions:\n\n- All access tokens used in the tests are valid when using the [\"test\" keycloak container maintained here.](https://github.com/NUWCDIVNPT/stig-manager-auth). \n- The main directory for all testing files is located at ```test/api/mocha```.\n- Tests validating the basic functionality of our endpoints are found in ```test/api/mocha/data```.\n- Each subdirectory within ```test/api/mocha/data``` is organized by API tag\n- Test files generally adhere to the naming convention ```<apiTag><HTTPMethod>.test.js``` (e.g., ```assetPatch.test.js```).\n- The ```test/api/mocha/crossBoundary``` directory contains tests for Level 1 cross-boundary scenarios.\n- Integration tests are located in ```test/api/mocha/integration```. Integration tests, as defined here, involve calling a set of related endpoints together to validate major application functionalities. These differ from the more focused, unit-like data tests that target individual API endpoints.\n- ```iterations.js``` defines the various iterations a test or group of tests will execute. This structure supports running the same test across multiple scenarios. Iterations contain an iteration name (often the test user name), a user Id as found in the test data set, and a test access token for that user.\n- Most tests reference corresponding ```referenceData.js``` and ```expectations.js``` files. These files contain the \"answers\" or expected data against which the API responses are validated.\n  - ```referenceData.js``` typically contains static or more global data about the tests or API paths.\n   - ```expectations.js``` contains data specific to the current test iterations (e.g., different user scenarios) and controls whether a test should run for a particular iteration.\n\n\n#### Test Naming conventions\n\n- top-level describe: ```describe('<HTTPMethod> - <APITag>', function () ``` Example: ```describe('DELETE - Asset', function ()```\n- Iteration-specific describe (used by runMocha.sh to run for a specific iteration): ```describe(iteration:${iteration.name}`, function () ```\n- Endpoint-level describe: ```describe('<operationId> - <endpointPath>', function ()``` Example: ```describe('deleteAssetMetadataKey - /assets/{assetId}/metadata/keys/{key}', function ()```\n\nMake sure these files are correctly set up before running the tests.\n\n## Test Policy\n\n- All PRs to the project repo must pass all API tests before they will be accepted.\n- All PRs to the project repo should include new or updated API tests that cover the changes made by the PR to the API.\n\n## Test Coverage\n\n- The API tests cover all endpoints of the API, and all HTTP methods supported by the API.\n- The PR Workflow running the tests will also generate a coverage report showing how much of the API code is covered by the tests.\n\n\n"
  },
  {
    "path": "test/api/appdata/appdata-meta-metrics-with-pin.jsonl",
    "content": "{\"version\":\"1.6.2\",\"commit\":{\"branch\":\"na\",\"sha\":\"na\",\"tag\":\"na\",\"describe\":\"na\"},\"date\":\"2026-03-09T22:46:13.214Z\",\"lastMigration\":46}\n{\"tables\":[{\"table\":\"asset\",\"rowCount\":5},{\"table\":\"check_content\",\"rowCount\":615},{\"table\":\"collection\",\"rowCount\":2},{\"table\":\"collection_grant\",\"rowCount\":9},{\"table\":\"collection_grant_acl\",\"rowCount\":2},{\"table\":\"collection_label\",\"rowCount\":2},{\"table\":\"collection_label_asset_map\",\"rowCount\":3},{\"table\":\"collection_rev_map\",\"rowCount\":1},{\"table\":\"current_rev\",\"rowCount\":5},{\"table\":\"default_rev\",\"rowCount\":3},{\"table\":\"fix_text\",\"rowCount\":615},{\"table\":\"rev_group_rule_cci_map\",\"rowCount\":6922},{\"table\":\"rev_group_rule_map\",\"rowCount\":701},{\"table\":\"review\",\"rowCount\":14},{\"table\":\"review_history\",\"rowCount\":5},{\"table\":\"revision\",\"rowCount\":6},{\"table\":\"rule_version_check_digest\",\"rowCount\":619},{\"table\":\"stig\",\"rowCount\":5},{\"table\":\"stig_asset_map\",\"rowCount\":6},{\"table\":\"user_data\",\"rowCount\":10},{\"table\":\"user_group\",\"rowCount\":0},{\"table\":\"user_group_user_map\",\"rowCount\":0}],\"totalRows\":9550}\n{\"table\":\"asset\",\"columns\":\"`assetId`,`collectionId`,`description`,`fqdn`,`ip`,`mac`,`metadata`,`name`,`noncomputing`,`state`,`stateDate`,`stateUserId`\",\"rowCount\":5}\n[29,21,\"\",null,\"10.0.0.18\",null,\"{}\",\"ACHERNAR_Collection_X_asset\",false,\"enabled\",null,null]\n[42,21,\"\",null,\"\",null,\"{}\",\"Collection_X_lvl1_asset-1\",true,\"enabled\",null,null]\n[62,21,\"\",null,\"10.1.1.1\",null,\"{}\",\"Collection_X_asset\",false,\"enabled\",null,null]\n[153,83,\"\",null,\"\",null,\"{}\",\"Collection_Y_lvl_1_asset-1\",false,\"enabled\",null,null]\n[240,83,\"\",null,\"\",null,\"{}\",\"Collection_Y_asset-noGrants\",false,\"enabled\",null,null]\n{\"table\":\"check_content\",\"columns\":\"`ccId`,`content`\",\"rowCount\":615}\n[15,\"Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution.\\n\\nIf there is no anti-virus solution installed on the system, this is a finding.\"]\n[537,\"Verify the VPN Gateway has an inbound and outbound traffic security policy which is in compliance with information flow control policies (e.g., IPsec policy configuration).\\n\\nReview network device configurations and topology diagrams. Verify encapsulated or encrypted traffic received from other enclaves with different security policies terminate at the perimeter for filtering and content inspection by a firewall and IDPS before gaining access to the private network.\\n\\nIf the VPN Gateway does not ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies, this is a finding.\"]\n[618,\"This check content has been replaced!\"]\n[4436,\"Verify domain-joined systems are using Windows 10 Enterprise Edition 64-bit version.\\n\\nFor standalone systems, this is NA.\\n\\nOpen \\\"Settings\\\".\\n\\nSelect \\\"System\\\", then \\\"About\\\".\\n\\nIf \\\"Edition\\\" is not \\\"Windows 10 Enterprise\\\", this is a finding.\\n\\nIf \\\"System type\\\" is not \\\"64-bit operating system…\\\", this is a finding.\"]\n[4437,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Installer\\\\\\n\\nValue Name: EnableUserControl\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4438,\"Verify domain-joined systems have a TPM enabled and ready for use.\\n\\nFor standalone systems, this is NA.\\n\\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nVerify the system has a TPM and is ready for use.\\nRun \\\"tpm.msc\\\".\\nReview the sections in the center pane.\\n\\\"Status\\\" must indicate it has been configured with a message such as \\\"The TPM is ready for use\\\" or \\\"The TPM is on and ownership has been taken\\\".\\nTPM Manufacturer Information - Specific Version = 2.0 or 1.2\\n\\nIf a TPM is not found or is not ready for use, this is a finding.\"]\n[4439,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Installer\\\\\\n\\nValue Name: AlwaysInstallElevated\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4440,\"The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system.\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Installer\\\\\\n\\nValue Name: SafeForScripting\\n\\nValue Type: REG_DWORD\\nValue: 0 (or if the Value Name does not exist)\"]\n[4441,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: DisableAutomaticRestartSignOn\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4442,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Client\\\\\\n\\nValue Name: AllowBasic\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4443,\"Verify all Windows 10 information systems (including SIPRNet) employ BitLocker for full disk encryption.\\n\\nFor virtual desktop implementations (VDIs) in which the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nIf full disk encryption using BitLocker is not implemented, this is a finding.\\n\\nVerify BitLocker is turned on for the operating system drive and any fixed data drives.\\n\\nOpen \\\"BitLocker Drive Encryption\\\" from the Control Panel.\\n\\nIf the operating system drive or any fixed data drives have \\\"Turn on BitLocker\\\", this is a finding.\\n\\nNOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).\"]\n[4444,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Client\\\\\\n\\nValue Name: AllowUnencryptedTraffic\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4445,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Client\\\\\\n\\nValue Name: AllowDigest\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4446,\"Verify DoD approved HBSS software is installed, configured, and properly operating. Ask the operator to document the HBSS software installation and configuration.\\n\\nIf the operator is not able to provide a documented configuration for an installed HBSS or if the HBSS software is not properly configured, maintained, or used, this is a finding.\"]\n[4447,\"This is applicable to unclassified systems; for other systems this is NA.\\n\\nVerify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. This must include packaged apps such as the universals apps installed by default on systems.\\n\\nIf an application whitelisting program is not in use on the system, this is a finding.\\n\\nConfiguration of whitelisting applications will vary by the program.\\n\\nAppLocker is a whitelisting application built into Windows 10 Enterprise.  A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules.\\n\\nIf AppLocker is used, perform the following to view the configuration of AppLocker:\\nRun \\\"PowerShell\\\".\\n\\nExecute the following command, substituting [c:\\\\temp\\\\file.xml] with a location and file name appropriate for the system:\\nGet-AppLockerPolicy -Effective -XML > c:\\\\temp\\\\file.xml\\n\\nThis will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review.\\n\\nImplementation guidance for AppLocker is available in the NSA paper \\\"Application Whitelisting using Microsoft AppLocker\\\" at the following link:\\n\\nhttps://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm\"]\n[4448,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Service\\\\\\n\\nValue Name: AllowBasic\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4449,\"Run \\\"winver.exe\\\".\\n\\nIf the \\\"About Windows\\\" dialog box does not display:\\n\\n\\\"Microsoft Windows Version 1803 (OS Build 17134.0)\\\"\\n\\nor greater, this is a finding.\\n\\nNote: Microsoft has extended support for previous versions providing critical and important updates for Windows 10 Enterprise.\\n\\nMicrosoft scheduled end of support dates for current Semi-Annual Channel versions:\\nv1709 - 13 October 2020\\nv1803 - 10 November 2020\\nv1809 - 13 April 2021\\nv1903 - 8 December 2020\\n\\nNo preview versions will be used in a production environment.\\n\\nSpecial purpose systems using the Long-Term Servicing Branch\\\\Channel (LTSC\\\\B) may be at following versions which are not a finding:\\n\\nv1507 (Build 10240)\\nv1607 (Build 14393)\\nv1809 (Build 17763)\"]\n[4450,\"Run \\\"Computer Management\\\".\\nNavigate to Storage >> Disk Management.\\n\\nIf the \\\"File System\\\" column does not indicate \\\"NTFS\\\" for each volume assigned a drive letter, this is a finding.\\n\\nThis does not apply to system partitions such the Recovery and EFI System Partition.\"]\n[4451,\"Verify the system does not include other operating system installations.\\n\\nRun \\\"Advanced System Settings\\\".\\nSelect the \\\"Advanced\\\" tab.\\nClick the \\\"Settings\\\" button in the \\\"Startup and Recovery\\\" section.\\n\\nIf the drop-down list box \\\"Default operating system:\\\" shows any operating system other than Windows 10, this is a finding.\"]\n[4452,\"Non system-created shares should not typically exist on workstations.\\n\\nIf only system-created shares exist on the system this is NA.\\n\\nRun \\\"Computer Management\\\".\\nNavigate to System Tools >> Shared Folders >> Shares.\\n\\nIf the only shares listed are \\\"ADMIN$\\\", \\\"C$\\\" and \\\"IPC$\\\", this is NA.\\n(Selecting Properties for system-created shares will display a message that it has been shared for administrative purposes.)\\n\\nRight click any non-system-created shares.\\nSelect \\\"Properties\\\".\\nSelect the \\\"Share Permissions\\\" tab.\\n\\nVerify the necessity of any shares found.\\nIf the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.\\n\\nSelect the \\\"Security\\\" tab.\\n\\nIf the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.\"]\n[4453,\"Run \\\"PowerShell\\\".\\nCopy the lines below to the PowerShell window and enter.\\n\\n\\\"([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach {\\n   $user = ([ADSI]$_.Path)\\n   $lastLogin = $user.Properties.LastLogin.Value\\n   $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2\\n   if ($lastLogin -eq $null) {\\n      $lastLogin = 'Never'\\n   }\\n   Write-Host $user.Name $lastLogin $enabled \\n}\\\"\\n\\nThis will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False).\\nFor example: User1  10/31/2015  5:49:56  AM  True\\n\\nReview the list to determine the finding validity for each account reported.\\n\\nExclude the following accounts:\\nBuilt-in administrator account (Disabled, SID ending in 500)\\nBuilt-in guest account (Disabled, SID ending in 501)\\nBuilt-in DefaultAccount (Disabled, SID ending in 503)\\nLocal administrator account\\n\\nIf any enabled accounts have not been logged on to within the past 35 days, this is a finding.\\n\\nInactive accounts that have been reviewed and deemed to be required must be documented with the ISSO.\"]\n[4454,\"Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Groups.\\nReview the members of the Administrators group.\\nOnly the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.\\n\\nFor domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.\\n\\nStandard user accounts must not be members of the local administrator group.\\n\\nIf prohibited accounts are members of the local administrators group, this is a finding.\\n\\nThe built-in Administrator account or other required administrative accounts would not be a finding.\"]\n[4455,\"Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Groups.\\nReview the members of the Backup Operators group.\\n\\nIf the group contains no accounts, this is not a finding.\\n\\nIf the group contains any accounts, the accounts must be specifically for backup functions.\\n\\nIf the group contains any standard user accounts used for performing normal user tasks, this is a finding.\"]\n[4456,\"If a hosted hypervisor (Hyper-V, VMware Workstation, etc.) is installed on the system, verify only authorized user accounts are allowed to run virtual machines.\\n\\nFor Hyper-V, Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Groups.\\nDouble click on \\\"Hyper-V Administrators\\\".\\n\\nIf any unauthorized groups or user accounts are listed in \\\"Members:\\\", this is a finding.\\n\\nFor hosted hypervisors other than Hyper-V, verify only authorized user accounts have access to run the virtual machines. Restrictions may be enforced by access to the physical system, software restriction policies, or access restrictions built in to the application.\\n\\nIf any unauthorized groups or user accounts have access to create or run virtual machines, this is a finding.\\n\\nAll users authorized to create or run virtual machines must be documented with the ISSM/ISSO. Accounts nested within group accounts must be documented as individual accounts and not the group accounts.\"]\n[4457,\"Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Users.\\n\\nIf local users other than the accounts listed below exist on a workstation in a domain, this is a finding.\\n\\nBuilt-in Administrator account (Disabled)\\nBuilt-in Guest account (Disabled)\\nBuilt-in DefaultAccount (Disabled)\\nBuilt-in defaultuser0 (Disabled)\\nBuilt-in WDAGUtilityAccount (Disabled)\\nLocal administrator account(s)\\n\\nAll of the built-in accounts may not exist on a system, depending on the Windows 10 version.\"]\n[4458,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Service\\\\\\n\\nValue Name: AllowUnencryptedTraffic\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4459,\"Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Users.\\nDouble click each active account.\\n\\nIf \\\"Password never expires\\\" is selected for any account, this is a finding.\"]\n[4460,\"The default file system permissions are adequate when the Security Option \\\"Network access: Let Everyone permissions apply to anonymous users\\\" is set to \\\"Disabled\\\" (WN10-SO-000160).\\n\\nIf the default file system permissions are maintained and the referenced option is set to \\\"Disabled\\\", this is not a finding.\\n\\nVerify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)\\n\\nViewing in File Explorer:\\nSelect the \\\"Security\\\" tab, and the \\\"Advanced\\\" button.\\n\\nC:\\\\\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nAdministrators - Full control - This folder, subfolders and files\\nSYSTEM - Full control - This folder, subfolders and files\\nUsers - Read & execute - This folder, subfolders and files\\nAuthenticated Users - Modify - Subfolders and files only\\nAuthenticated Users - Create folders / append data - This folder only\\n\\n\\\\Program Files\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nTrustedInstaller - Full control - This folder and subfolders\\nSYSTEM - Modify - This folder only\\nSYSTEM - Full control - Subfolders and files only\\nAdministrators - Modify - This folder only\\nAdministrators - Full control - Subfolders and files only\\nUsers - Read & execute - This folder, subfolders and files\\nCREATOR OWNER - Full control - Subfolders and files only\\nALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files\\nALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders and files\\n\\n\\\\Windows\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nTrustedInstaller - Full control - This folder and subfolders\\nSYSTEM - Modify - This folder only\\nSYSTEM - Full control - Subfolders and files only\\nAdministrators - Modify - This folder only\\nAdministrators - Full control - Subfolders and files only\\nUsers - Read & execute - This folder, subfolders and files\\nCREATOR OWNER - Full control - Subfolders and files only\\nALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files\\nALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders and files\\n\\nAlternately use icacls.\\n\\nRun \\\"CMD\\\" as administrator.\\nEnter \\\"icacls\\\" followed by the directory.\\n\\nicacls c:\\\\\\nicacls \\\"c:\\\\program files\\\"\\nicacls c:\\\\windows\\n\\nThe following results will be displayed as each is entered:\\n\\nc:\\\\\\nBUILTIN\\\\Administrators:(OI)(CI)(F)\\nNT AUTHORITY\\\\SYSTEM:(OI)(CI)(F)\\nBUILTIN\\\\Users:(OI)(CI)(RX)\\nNT AUTHORITY\\\\Authenticated Users:(OI)(CI)(IO)(M)\\nNT AUTHORITY\\\\Authenticated Users:(AD)\\nMandatory Label\\\\High Mandatory Level:(OI)(NP)(IO)(NW)\\nSuccessfully processed 1 files; Failed processing 0 files\\n\\nc:\\\\program files \\nNT SERVICE\\\\TrustedInstaller:(F)\\nNT SERVICE\\\\TrustedInstaller:(CI)(IO)(F)\\nNT AUTHORITY\\\\SYSTEM:(M)\\nNT AUTHORITY\\\\SYSTEM:(OI)(CI)(IO)(F)\\nBUILTIN\\\\Administrators:(M)\\nBUILTIN\\\\Administrators:(OI)(CI)(IO)(F)\\nBUILTIN\\\\Users:(RX)\\nBUILTIN\\\\Users:(OI)(CI)(IO)(GR,GE)\\nCREATOR OWNER:(OI)(CI)(IO)(F)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES:(RX)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL RESTRICTED APPLICATION PACKAGES:(RX)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\\nSuccessfully processed 1 files; Failed processing 0 files\\n\\nc:\\\\windows\\nNT SERVICE\\\\TrustedInstaller:(F)\\nNT SERVICE\\\\TrustedInstaller:(CI)(IO)(F)\\nNT AUTHORITY\\\\SYSTEM:(M)\\nNT AUTHORITY\\\\SYSTEM:(OI)(CI)(IO)(F)\\nBUILTIN\\\\Administrators:(M)\\nBUILTIN\\\\Administrators:(OI)(CI)(IO)(F)\\nBUILTIN\\\\Users:(RX)\\nBUILTIN\\\\Users:(OI)(CI)(IO)(GR,GE)\\nCREATOR OWNER:(OI)(CI)(IO)(F)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES:(RX)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL RESTRICTED APPLICATION PACKAGES:(RX)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\\nSuccessfully processed 1 files; Failed processing 0 files\"]\n[4461,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Service\\\\\\n\\nValue Name: DisableRunAs\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4462,\"IIS is not installed by default.  Verify it has not been installed on the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows features on or off\\\".\\n\\nIf the entries for \\\"Internet Information Services\\\" or \\\"Internet Information Services Hostable Web Core\\\" are selected, this is a finding.\\n\\nIf an application requires IIS or a subset to be installed to function, this needs be documented with the ISSO.  In addition, any applicable requirements from the IIS STIG must be addressed.\"]\n[4463,\"\\\"SNMP\\\" is not installed by default.  Verify it has not been installed.\\n\\nNavigate to the Windows\\\\System32 directory.\\n\\nIf the \\\"SNMP\\\" application exists, this is a finding.\"]\n[4464,\"\\\"Simple TCP/IP Services\\\" is not installed by default.  Verify it has not been installed.\\n\\nRun \\\"Services.msc\\\".\\n\\nIf \\\"Simple TCP/IP Services\\\" is listed, this is a finding.\"]\n[4465,\"The \\\"Telnet Client\\\" is not installed by default.  Verify it has not been installed.\\n\\nNavigate to the Windows\\\\System32 directory.\\n\\nIf the \\\"telnet\\\" application exists, this is a finding.\"]\n[4466,\"The \\\"TFTP Client\\\" is not installed by default.  Verify it has not been installed.\\n\\nNavigate to the Windows\\\\System32 directory.\\n\\nIf the \\\"TFTP\\\" application exists, this is a finding.\"]\n[4467,\"Search all drives for *.p12 and *.pfx files.\\n\\nIf any files with these extensions exist, this is a finding.\\n\\nThis does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.\"]\n[4468,\"Determine if a host-based firewall is installed and enabled on the system.  If a host-based firewall is not installed and enabled on the system, this is a finding.\\n\\nThe configuration requirements will be determined by the applicable firewall STIG.\"]\n[4469,\"Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts.\\n\\nIf allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding.\\n\\nReview inbound firewall exceptions.\\nComputer Configuration >> Windows Settings >> Security Settings >> Windows Defender Firewall with Advanced Security >> Windows Defender Firewall with Advanced Security >> Inbound Rules (this link will be in the right pane)\\n\\nFor any inbound rules that allow connections view the Scope for Remote IP address. This may be defined as an IP address, subnet, or range. The rule must apply to all firewall profiles.\\n\\nIf a third-party firewall is used, ensure comparable settings are in place.\"]\n[4470,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy.\\n\\nIf the \\\"Account lockout duration\\\" is less than \\\"15\\\" minutes (excluding \\\"0\\\"), this is a finding.\\n\\nConfiguring this to \\\"0\\\", requiring an administrator to unlock the account, is more restrictive and is not a finding.\"]\n[4471,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy.\\n\\nIf the \\\"Account lockout threshold\\\" is \\\"0\\\" or more than \\\"3\\\" attempts, this is a finding.\"]\n[4472,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy.\\n\\nIf the \\\"Reset account lockout counter after\\\" value is less than \\\"15\\\" minutes, this is a finding.\"]\n[4473,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for \\\"Enforce password history\\\" is less than \\\"24\\\" passwords remembered, this is a finding.\"]\n[4474,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for the \\\"Maximum password age\\\" is greater than \\\"60\\\" days, this is a finding.  If the value is set to \\\"0\\\" (never expires), this is a finding.\"]\n[4475,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for the \\\"Minimum password age\\\" is less than \\\"1\\\" day, this is a finding.\"]\n[4476,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for the \\\"Minimum password length,\\\" is less than \\\"14\\\" characters, this is a finding.\"]\n[4477,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for \\\"Password must meet complexity requirements\\\" is not set to \\\"Enabled\\\", this is a finding.\\n\\nIf the site is using a password filter that requires this setting be set to \\\"Disabled\\\" for the filter to be used, this would not be considered a finding.\"]\n[4478,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for \\\"Store password using reversible encryption\\\" is not set to \\\"Disabled\\\", this is a finding.\"]\n[4479,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nAccount Logon >> Credential Validation - Failure\"]\n[4480,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nAccount Logon >> Credential Validation - Success\"]\n[4481,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nAccount Management >> Security Group Management - Success\"]\n[4482,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nAccount Management >> User Account Management - Failure\"]\n[4483,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nAccount Management >> User Account Management - Success\"]\n[4484,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nDetailed Tracking >> Plug and Play Events - Success\"]\n[4485,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nDetailed Tracking >> Process Creation - Success\"]\n[4486,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Group Membership - Success\"]\n[4487,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Logoff - Success\"]\n[4488,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Logon - Failure\"]\n[4489,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Logon - Success\"]\n[4490,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Special Logon - Success\"]\n[4491,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nObject Access >> Removable Storage - Failure\\n\\nSome virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.  This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.\"]\n[4492,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nObject Access >> Removable Storage - Success\\n\\nSome virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.  This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.\"]\n[4493,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nPolicy Change >> Audit Policy Change - Success\"]\n[4494,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nPolicy Change >> Authentication Policy Change - Success\"]\n[4495,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nPrivilege Use >> Sensitive Privilege Use - Failure\"]\n[4496,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nPrivilege Use >> Sensitive Privilege Use - Success\"]\n[4497,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> IPSec Driver - Failure\"]\n[4498,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> Other System Events - Success\"]\n[4499,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> Other System Events - Failure\"]\n[4500,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> Security State Change - Success\"]\n[4501,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> Security System Extension - Success\"]\n[4502,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> System Integrity - Failure\"]\n[4503,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> System Integrity - Success\"]\n[4504,\"If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\EventLog\\\\Application\\\\\\n\\nValue Name:  MaxSize\\n\\nValue Type:  REG_DWORD\\nValue:  0x00008000 (32768) (or greater)\"]\n[4505,\"If the system is configured to send audit records directly to an audit server, this is NA. This must be documented with the ISSO.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\EventLog\\\\Security\\\\\\n\\nValue Name: MaxSize\\n\\nValue Type: REG_DWORD\\nValue: 0x000fa000 (1024000) (or greater)\"]\n[4506,\"If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\EventLog\\\\System\\\\\\n\\nValue Name:  MaxSize\\n\\nValue Type:  REG_DWORD\\nValue:  0x00008000 (32768) (or greater)\"]\n[4507,\"Verify the permissions on the Application event log (Application.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory. They may have been moved to another folder.\\n\\nIf the permissions for these files are not as restrictive as the ACLs listed, this is a finding.\\n\\nNOTE: If \\\"APPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES\\\" has Special Permissions, this would not be a finding.\"]\n[4508,\"Verify the permissions on the Security event log (Security.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory. They may have been moved to another folder.\\n\\nIf the permissions for these files are not as restrictive as the ACLs listed, this is a finding.\\n\\nNOTE: If \\\"APPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES\\\" has Special Permissions, this would not be a finding.\"]\n[4509,\"Verify the permissions on the System event log (System.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory. They may have been moved to another folder.\\n\\nIf the permissions for these files are not as restrictive as the ACLs listed, this is a finding.\\n\\nNOTE: If \\\"APPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES\\\" has Special Permissions, this would not be a finding.\"]\n[4510,\"If the device does not have a camera, this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Personalization\\\\\\n\\nValue Name: NoLockScreenCamera\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4511,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Personalization\\\\\\n\\nValue Name: NoLockScreenSlideshow\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4512,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip6\\\\Parameters\\\\\\n\\nValue Name: DisableIpSourceRouting\\n\\nValue Type: REG_DWORD\\nValue: 2\"]\n[4513,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters\\\\\\n\\nValue Name: DisableIPSourceRouting\\n\\nValue Type: REG_DWORD\\nValue: 2\"]\n[4514,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters\\\\\\n\\nValue Name: EnableICMPRedirect\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4515,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netbt\\\\Parameters\\\\\\n\\nValue Name:  NoNameReleaseOnDemand\\n\\nValue Type:  REG_DWORD\\nValue:  1\"]\n[4516,\"Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\LanmanWorkstation\\\\\\n\\nValue Name: AllowInsecureGuestAuth\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[4517,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nIf the following registry values do not exist or are not configured as specified, this is a finding.\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\NetworkProvider\\\\HardenedPaths\\\\\\n\\nValue Name:  \\\\\\\\*\\\\NETLOGON\\nValue Type:  REG_SZ\\nValue:  RequireMutualAuthentication=1, RequireIntegrity=1\\n\\nValue Name:  \\\\\\\\*\\\\SYSVOL\\nValue Type:  REG_SZ\\nValue:  RequireMutualAuthentication=1, RequireIntegrity=1\\n\\nAdditional entries would not be a finding.\"]\n[4518,\"Verify the DoD Root CA certificates are installed as Trusted Root Certification Authorities.\\n\\nThe certificates and thumbprints referenced below apply to unclassified systems; see PKE documentation for other networks.\\n\\nRun \\\"PowerShell\\\" as an administrator.\\n\\nExecute the following command:\\n\\nGet-ChildItem -Path Cert:Localmachine\\\\root | Where Subject -Like \\\"*DoD*\\\" | FL Subject, Thumbprint, NotAfter\\n\\nIf the following certificate \\\"Subject\\\" and \\\"Thumbprint\\\" information is not displayed, this is finding. \\n\\nIf an expired certificate (\\\"NotAfter\\\" date) is not listed in the results, this is not a finding.\\n\\nSubject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561\\nNotAfter: 12/5/2029\\n\\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB\\nNotAfter: 12/30/2029\\n\\nSubject: CN=DoD Root CA 4, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026\\nNotAfter: 7/25/2032\\n\\nSubject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B\\nNotAfter: 6/14/2041\\n\\nAlternately use the Certificates MMC snap-in:\\n\\nRun \\\"MMC\\\".\\n\\nSelect \\\"File\\\", \\\"Add/Remove Snap-in\\\".\\n\\nSelect \\\"Certificates\\\", click \\\"Add\\\".\\n\\nSelect \\\"Computer account\\\", click \\\"Next\\\".\\n\\nSelect \\\"Local computer: (the computer this console is running on)\\\", click \\\"Finish\\\".\\n\\nClick \\\"OK\\\".\\n\\nExpand \\\"Certificates\\\" and navigate to \\\"Trusted Root Certification Authorities >> Certificates\\\".\\n\\nFor each of the DoD Root CA certificates noted below:\\n\\nRight-click on the certificate and select \\\"Open\\\".\\n\\nSelect the \\\"Details\\\" Tab.\\n\\nScroll to the bottom and select \\\"Thumbprint\\\".\\n\\nIf the DoD Root CA certificates below are not listed or the value for the \\\"Thumbprint\\\" field is not as noted, this is a finding.\\n\\nIf an expired certificate (\\\"Valid to\\\" date) is not listed in the results, this is not a finding.\\n\\nDoD Root CA 2\\nThumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561\\nValid to: Wednesday, December 5, 2029\\n\\nDoD Root CA 3\\nThumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB\\nValid to: Sunday, December 30, 2029\\n\\nDoD Root CA 4\\nThumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026\\nValid to: Sunday, July 25, 2032\\n\\nDoD Root CA 5\\nThumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B\\nValid to: Friday, June 14, 2041\"]\n[4519,\"The default behavior for \\\"Minimize the number of simultaneous connections to the Internet or a Windows Domain\\\" is \\\"Enabled\\\".\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WcmSvc\\\\GroupPolicy\\\\\\n\\nValue Name: fMinimizeConnections\\n\\nValue Type: REG_DWORD\\nValue: 1 (or if the Value Name does not exist)\"]\n[4520,\"Verify the ECA Root CA certificates are installed on unclassified systems as Trusted Root Certification Authorities.\\n\\nRun \\\"PowerShell\\\" as an administrator.\\n\\nExecute the following command:\\n\\nGet-ChildItem -Path Cert:Localmachine\\\\root | Where Subject -Like \\\"*ECA*\\\" | FL Subject, Thumbprint, NotAfter\\n\\nIf the following certificate \\\"Subject\\\" and \\\"Thumbprint\\\" information is not displayed, this is finding. \\n\\nIf an expired certificate (\\\"NotAfter\\\" date) is not listed in the results, this is not a finding.\\n\\nSubject: CN=ECA Root CA 2, OU=ECA, O=U.S. Government, C=US\\nThumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4\\nNotAfter: 3/30/2028\\n\\nSubject: CN=ECA Root CA 4, OU=ECA, O=U.S. Government, C=US\\nThumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582\\nNotAfter: 12/30/2029\\n\\nAlternately use the Certificates MMC snap-in:\\n\\nRun \\\"MMC\\\".\\n\\nSelect \\\"File\\\", \\\"Add/Remove Snap-in\\\".\\n\\nSelect \\\"Certificates\\\", click \\\"Add\\\".\\n\\nSelect \\\"Computer account\\\", click \\\"Next\\\".\\n\\nSelect \\\"Local computer: (the computer this console is running on)\\\", click \\\"Finish\\\".\\n\\nClick \\\"OK\\\".\\n\\nExpand \\\"Certificates\\\" and navigate to \\\"Trusted Root Certification Authorities >> Certificates\\\".\\n\\nFor each of the ECA Root CA certificates noted below:\\n\\nRight-click on the certificate and select \\\"Open\\\".\\n\\nSelect the \\\"Details\\\" Tab.\\n\\nScroll to the bottom and select \\\"Thumbprint\\\".\\n\\nIf the ECA Root CA certificates below are not listed or the value for the \\\"Thumbprint\\\" field is not as noted, this is a finding.\\n\\nIf an expired certificate (\\\"Valid to\\\" date) is not listed in the results, this is not a finding.\\n\\nECA Root CA 2\\nThumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4\\nValid to: Thursday, March 30, 2028\\n\\nECA Root CA 4\\nThumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582\\nValid to: Sunday, December 30, 2029\"]\n[4521,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WcmSvc\\\\GroupPolicy\\\\\\n\\nValue Name: fBlockNonDomain\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4522,\"Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates.\\n\\nRun \\\"PowerShell\\\" as an administrator.\\n\\nExecute the following command:\\n\\nGet-ChildItem -Path Cert:Localmachine\\\\disallowed | Where {$_.Issuer -Like \\\"*DoD Interoperability*\\\" -and $_.Subject -Like \\\"*DoD*\\\"} | FL Subject, Issuer, Thumbprint, NotAfter\\n\\nIf the following certificate \\\"Subject\\\", \\\"Issuer\\\", and \\\"Thumbprint\\\", information is not displayed, this is finding. \\n\\nIf an expired certificate (\\\"NotAfter\\\" date) is found, this is a finding.\\n\\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nIssuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341\\nNotAfter: 1/22/2022\\n \\nSubject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nIssuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02\\nNotAfter: 8/26/2022 \\n\\nAlternately use the Certificates MMC snap-in:\\n\\nRun \\\"MMC\\\".\\n\\nSelect \\\"File\\\", \\\"Add/Remove Snap-in\\\".\\n\\nSelect \\\"Certificates\\\", click \\\"Add\\\".\\n\\nSelect \\\"Computer account\\\", click \\\"Next\\\".\\n\\nSelect \\\"Local computer: (the computer this console is running on)\\\", click \\\"Finish\\\".\\n\\nClick \\\"OK\\\".\\n\\nExpand \\\"Certificates\\\" and navigate to \\\"Untrusted Certificates >> Certificates\\\".\\n\\nFor each certificate with \\\"DoD Root CA…\\\" under \\\"Issued To\\\" and \\\"DoD Interoperability Root CA…\\\" under \\\"Issued By\\\":\\n\\nRight-click on the certificate and select \\\"Open\\\".\\n\\nSelect the \\\"Details\\\" Tab.\\n\\nScroll to the bottom and select \\\"Thumbprint\\\".\\n\\nIf the certificates below are not listed or the value for the \\\"Thumbprint\\\" field is not as noted, this is a finding.\\n\\nIf an expired certificate (\\\"Valid to\\\" date) is not listed in the results, this is not a finding.\\n\\nIssued To: DoD Root CA 2\\nIssued By: DoD Interoperability Root CA 1\\nThumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02\\nValid to: Friday, August 26, 2022\\n\\nIssued To: DoD Root CA 3\\nIssued By: DoD Interoperability Root CA 2\\nThumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341\\nValid to: Saturday, January 22, 2022\"]\n[4523,\"Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate.\\n\\nRun \\\"PowerShell\\\" as an administrator.\\n\\nExecute the following command:\\n\\nGet-ChildItem -Path Cert:Localmachine\\\\disallowed | Where Issuer -Like \\\"*CCEB Interoperability*\\\" | FL Subject, Issuer, Thumbprint, NotAfter\\n\\nIf the following certificate \\\"Subject\\\", \\\"Issuer\\\", and \\\"Thumbprint\\\", information is not displayed, this is finding. \\n\\nIf an expired certificate (\\\"NotAfter\\\" date) is found, this is a finding.\\n\\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nIssuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S.Government, C=US\\nThumbprint: AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9\\nNotAfter: 8/26/2022 9:07:50 AM\\n\\nAlternately use the Certificates MMC snap-in:\\n\\nRun \\\"MMC\\\".\\n\\nSelect \\\"File\\\", \\\"Add/Remove Snap-in\\\".\\n\\nSelect \\\"Certificates\\\", click \\\"Add\\\".\\n\\nSelect \\\"Computer account\\\", click \\\"Next\\\".\\n\\nSelect \\\"Local computer: (the computer this console is running on)\\\", click \\\"Finish\\\".\\n\\nClick \\\"OK\\\".\\n\\nExpand \\\"Certificates\\\" and navigate to \\\"Untrusted Certificates >> Certificates\\\".\\n\\nFor each certificate with \\\"US DoD CCEB Interoperability Root CA …\\\" under \\\"Issued By\\\":\\n\\nRight-click on the certificate and select \\\"Open\\\".\\n\\nSelect the \\\"Details\\\" tab.\\n\\nScroll to the bottom and select \\\"Thumbprint\\\".\\n\\nIf the certificate below is not listed or the value for the \\\"Thumbprint\\\" field is not as noted, this is a finding.\\n\\nIf an expired certificate (\\\"Valid to\\\" date) is not listed in the results, this is not a finding.\\n\\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nIssuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S.Government, C=US\\nThumbprint: AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9\\nNotAfter: 8/26/2022 9:07:50 AM\"]\n[4524,\"This is NA as of v1803 of Windows 10; Wi-Fi sense is no longer available.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\WcmSvc\\\\wifinetworkmanager\\\\config\\\\\\n\\nValue Name: AutoConnectAllowedOEM\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[4525,\"Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.\\n\\nIf any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.\\n\\nRun \\\"Regedit\\\".\\nRight click on the registry areas noted below.\\nSelect \\\"Permissions...\\\" and the \\\"Advanced\\\" button.\\n\\nHKEY_LOCAL_MACHINE\\\\SECURITY\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nSYSTEM - Full Control - This key and subkeys\\nAdministrators - Special - This key and subkeys\\n\\nHKEY_LOCAL_MACHINE\\\\SOFTWARE\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nUsers - Read - This key and subkeys\\nAdministrators - Full Control - This key and subkeys\\nSYSTEM - Full Control - This key and subkeys\\nCREATOR OWNER - Full Control - This key and subkeys\\nALL APPLICATION PACKAGES - Read - This key and subkeys\\n\\nHKEY_LOCAL_MACHINE\\\\SYSTEM\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nUsers - Read - This key and subkeys\\nAdministrators - Full Control - This key and subkeys\\nSYSTEM - Full Control - This key and subkeys\\nCREATOR OWNER - Full Control - This key and subkeys\\nALL APPLICATION PACKAGES - Read - This key and subkeys\\n\\nOther subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.\\n\\nMicrosoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.\\n\\nS-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681\\n\\nIf the defaults have not been changed, these are not a finding.\"]\n[4526,\"Confirm Virtualization Based Security is enabled and running with Secure Boot or Secure Boot and DMA Protection.\\n\\nFor those devices that support virtualization based security (VBS) features, including Credential Guard or protection of code integrity, this must be enabled. If the system meets the hardware and firmware dependencies for enabling VBS but it is not enabled, this is a CAT III finding.\\n\\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nRun \\\"PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter the following:\\n\\n\\\"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\"\\n\\nIf \\\"RequiredSecurityProperties\\\" does not include a value of \\\"2\\\" indicating \\\"Secure Boot\\\" (e.g., \\\"{1, 2}\\\"), this is a finding.\\n\\nIf \\\"Secure Boot and DMA Protection\\\" is configured, \\\"3\\\" will also be displayed in the results (e.g., \\\"{1, 2, 3}\\\").\\n\\nIf \\\"VirtualizationBasedSecurityStatus\\\" is not a value of \\\"2\\\" indicating \\\"Running\\\", this is a finding.\\n\\nAlternately:\\n\\nRun \\\"System Information\\\".\\n\\nUnder \\\"System Summary\\\", verify the following:\\n\\nIf \\\"Device Guard Virtualization based security\\\" does not display \\\"Running\\\", this is finding.\\n\\nIf \\\"Device Guard Required Security Properties\\\" does not display \\\"Base Virtualization Support, Secure Boot\\\", this is finding.\\n\\nIf \\\"Secure Boot and DMA Protection\\\" is configured, \\\"DMA Protection\\\" will also be displayed (e.g., \\\"Base Virtualization Support, Secure Boot, DMA Protection\\\").\\n\\nThe policy settings referenced in the Fix section will configure the following registry values. However due to hardware requirements, the registry values alone do not ensure proper function.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\\\\n\\nValue Name: EnableVirtualizationBasedSecurity\\nValue Type: REG_DWORD\\nValue: 1\\n\\nValue Name: RequirePlatformSecurityFeatures\\nValue Type: REG_DWORD\\nValue: 1 (Secure Boot only) or 3 (Secure Boot and DMA Protection)\\n\\nA Microsoft article on Credential Guard system requirement can be found at the following link:\\n\\nhttps://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard-requirements\\n\\nNOTE:  The severity level for the requirement will be upgraded to CAT II starting January 2020.\"]\n[4527,\"If the system is not a member of a domain, this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: LocalAccountTokenFilterPolicy\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[4528,\"Confirm Credential Guard is running on domain-joined systems.\\n\\nFor those devices that support Credential Guard, this feature must be enabled. Organizations need to take the appropriate action to acquire and implement compatible hardware with Credential Guard enabled.\\n\\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nRun \\\"PowerShell\\\" with elevated privileges (run as administrator).\\nEnter the following:\\n\\\"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\"\\n\\nIf \\\"SecurityServicesRunning\\\" does not include a value of \\\"1\\\" (e.g., \\\"{1, 2}\\\"), this is a finding.\\n\\nAlternately:\\n\\nRun \\\"System Information\\\".\\nUnder \\\"System Summary\\\", verify the following:\\nIf \\\"Device Guard Security Services Running\\\" does not list \\\"Credential Guard\\\", this is finding.\\n\\nThe policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\\\\n\\nValue Name: LsaCfgFlags\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1) (Enabled with UEFI lock)\"]\n[4529,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Accounts: Administrator account status\\\" is not set to \\\"Disabled\\\", this is a finding.\"]\n[4530,\"The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy is to enforce \\\"Good, unknown and bad but critical\\\" (preventing \\\"bad\\\").\\n\\nIf the registry value name below does not exist, this a finding.\\n\\nIf it exists and is configured with a value of \\\"7\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Policies\\\\EarlyLaunch\\\\\\n\\nValue Name: DriverLoadPolicy\\n\\nValue Type: REG_DWORD\\nValue: 1, 3, or 8 \\n\\nPossible values for this setting are:\\n8 - Good only\\n1 - Good and unknown\\n3 - Good, unknown and bad but critical\\n7 - All (which includes \\\"Bad\\\" and would be a finding)\"]\n[4531,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Group Policy\\\\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\\n\\nValue Name: NoGPOListChanges\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4532,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Accounts: Guest account status\\\" is not set to \\\"Disabled\\\", this is a finding.\"]\n[4533,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Printers\\\\\\n\\nValue Name: DisableWebPnPDownload\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4534,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: LimitBlankPasswordUse\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4535,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Accounts: Rename administrator account\\\" is set to \\\"Administrator\\\", this is a finding.\"]\n[4536,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\\\n\\nValue Name: NoWebServices\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4537,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Printers\\\\\\n\\nValue Name: DisableHTTPPrinting\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4538,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Accounts: Rename guest account\\\" is set to \\\"Guest\\\", this is a finding.\"]\n[4539,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nThe default behavior for \\\"Support device authentication using certificate\\\" is \\\"Automatic\\\".\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is a finding.\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Kerberos\\\\Parameters\\\\\\n\\nValue Name:  DevicePKInitEnabled\\nValue Type:  REG_DWORD\\nValue:  1 (or if the Value Name does not exist)\"]\n[4540,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: DontDisplayNetworkSelectionUI\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4541,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: EnumerateLocalUsers\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4542,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: SCENoApplyLegacyAuditPolicy\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4543,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: RequireSignOrSeal\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4544,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: SealSecureChannel\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4545,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Power\\\\PowerSettings\\\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\\\\\\n\\nValue Name: DCSettingIndex\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4546,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: SignSecureChannel\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4547,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Power\\\\PowerSettings\\\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\\\\\\n\\nValue Name: ACSettingIndex\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4548,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: fAllowToGetHelp\\n \\nValue Type: REG_DWORD\\nValue: 0\"]\n[4549,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: DisablePasswordChange\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4550,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Rpc\\\\\\n\\nValue Name: RestrictRemoteClients\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4551,\"Windows 10 LTSC\\\\B versions do not support the Microsoft Store and modern apps; this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: MSAOptional\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[4552,\"This is the default configuration for this setting (30 days).\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: MaximumPasswordAge\\n\\nValue Type: REG_DWORD\\nValue: 0x0000001e (30)  (or less, excluding 0)\"]\n[4553,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\AppCompat\\\\\\n\\nValue Name: DisableInventory\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4554,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: RequireStrongKey\\n\\nValue Type: REG_DWORD\\nValue: 1\\n \\nWarning: This setting may prevent a system from being joined to a domain if not configured consistently between systems.\"]\n[4555,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Explorer\\\\\\n\\nValue Name: NoAutoplayfornonVolume\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4556,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: InactivityTimeoutSecs\\n\\nValue Type: REG_DWORD\\nValue: 0x00000384 (900) (or less, excluding \\\"0\\\" which is effectively disabled)\"]\n[4557,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\\\n\\nValue Name: NoAutorun\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4558,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\policies\\\\Explorer\\\\\\n\\nValue Name: NoDriveTypeAutoRun\\n\\nValue Type: REG_DWORD\\nValue: 0x000000ff (255)\\n\\nNote: If the value for NoDriveTypeAutorun is entered manually, it must be entered as \\\"ff\\\" when Hexadecimal is selected, or \\\"255\\\" with Decimal selected.  Using the policy value specified in the Fix section will enter it correctly.\"]\n[4559,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: LegalNoticeText\\n\\nValue Type: REG_SZ\\nValue: \\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details.\"]\n[4560,\"Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Biometrics\\\\FacialFeatures\\\\\\n\\nValue Name: EnhancedAntiSpoofing\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[4561,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\CredUI\\\\\\n\\nValue Name: EnumerateAdministrators\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4562,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: LegalNoticeCaption\\n\\nValue Type: REG_SZ\\nValue: See message title above\\n\\n\\\"DoD Notice and Consent Banner\\\", \\\"US Department of Defense Warning Statement\\\" or a site-defined equivalent, this is a finding.\\n\\nIf a site-defined title is used, it can in no case contravene or modify the language of the banner text required in WN10-SO-000075.\"]\n[4563,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DataCollection\\\\\\n\\nValue Name: AllowTelemetry\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0) (Security)\\n0x00000001 (1) (Basic)\\n\\nIf an organization is using v1709 or later of Windows 10 this may be configured to \\\"Enhanced\\\" to support Windows Analytics. V-82145 must also be configured to limit the Enhanced diagnostic data to the minimum required by Windows Analytics. This registry value will then be 0x00000002 (2).\"]\n[4564,\"This is applicable to unclassified systems, for other systems this is NA.\\n\\nIf the following registry values do not exist or are not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: EnableSmartScreen\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\\n\\nAnd\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: ShellSmartScreenLevel\\n\\nValue Type: REG_SZ\\nValue: Block\\n\\nv1607 LTSB:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: EnableSmartScreen\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\\n\\nv1507 LTSB:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: EnableSmartScreen\\n\\nValue Type: REG_DWORD\\nValue: 0x00000002 (2)\"]\n[4565,\"This is the default configuration for this setting (10 logons to cache).\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE \\nRegistry Path:  \\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\\\n\\nValue Name:  CachedLogonsCount\\n\\nValue Type:  REG_SZ\\nValue:  10 (or less)\\n\\nThis setting only applies to domain-joined systems, however, it is configured by default on all systems.\"]\n[4566,\"The default behavior is for data execution prevention to be turned on for file explorer.\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Explorer\\\\\\n\\nValue Name: NoDataExecutionPrevention\\n\\nValue Type: REG_DWORD\\nValue: 0 (or if the Value Name does not exist)\"]\n[4567,\"The default behavior is for File Explorer heap termination on corruption to be enabled.\\n\\nIf the registry Value Name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Explorer\\\\\\n\\nValue Name: NoHeapTerminationOnCorruption\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0) (or if the Value Name does not exist)\"]\n[4568,\"The default behavior is for shell protected mode to be turned on for file explorer.\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\\\n\\nValue Name: PreXPSP2ShellProtocolBehavior\\n\\nValue Type: REG_DWORD\\nValue: 0 (or if the Value Name does not exist)\"]\n[4569,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\\\n\\nValue Name:  SCRemoveOption\\n\\nValue Type:  REG_SZ\\nValue:  1 (Lock Workstation) or 2 (Force Logoff)\\n\\nThis can be left not configured or set to \\\"No action\\\" on workstations with the following conditions.  This must be documented with the ISSO.\\n-The setting cannot be configured due to mission needs, or because it interferes with applications.\\n-Policy must be in place that users manually lock workstations when leaving them unattended.\\n-The screen saver is properly configured to lock as required.\"]\n[4570,\"This is applicable to unclassified systems, for other systems this is NA.\\n\\nWindows 10 LTSC\\\\B versions do not include Microsoft Edge, this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\PhishingFilter\\\\\\n\\nValue Name: PreventOverride\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[4571,\"This is applicable to unclassified systems, for other systems this is NA.\\n\\nWindows 10 LTSC\\\\B versions do not include Microsoft Edge, this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\PhishingFilter\\\\\\n\\nValue Name: PreventOverrideAppRepUnknown\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[4572,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanmanWorkstation\\\\Parameters\\\\\\n\\nValue Name: RequireSecuritySignature\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4573,\"Windows 10 LTSC\\\\B versions do not include Microsoft Edge, this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\Main\\\\\\n\\nValue Name: FormSuggest Passwords\\n\\nType: REG_SZ\\nValue: no\"]\n[4574,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanmanWorkstation\\\\Parameters\\\\\\n\\nValue Name:  EnablePlainTextPassword\\n\\nValue Type:  REG_DWORD\\nValue:  0\"]\n[4575,\"This is applicable to unclassified systems, for other systems this is NA.\\n\\nWindows 10 LTSC\\\\B versions do not include Microsoft Edge, this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\PhishingFilter\\\\\\n\\nValue Name: EnabledV9\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[4576,\"Virtual desktop implementations currently may not support the use of TPMs. For virtual desktop implementations where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\PassportForWork\\\\\\n\\nValue Name: RequireSecurityDevice\\n\\nType: REG_DWORD\\nValue: 1\"]\n[4577,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanManServer\\\\Parameters\\\\\\n\\nValue Name: RequireSecuritySignature\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4578,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\PassportForWork\\\\PINComplexity\\\\\\n\\nValue Name:  MinimumPINLength\\n\\nType:  REG_DWORD\\nValue:  6 (or greater)\"]\n[4579,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: DisablePasswordSaving\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4580,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: fDisableCdm\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4581,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: fPromptForPassword\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4582,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: fEncryptRPCTraffic\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4583,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Network access: Allow anonymous SID/Name translation\\\" is not set to \\\"Disabled\\\", this is a finding.\"]\n[4584,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: MinEncryptionLevel\\n\\nValue Type: REG_DWORD\\nValue: 3\"]\n[4585,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Internet Explorer\\\\Feeds\\\\\\n\\nValue Name: DisableEnclosureDownload\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4586,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: RestrictAnonymousSAM\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4587,\"The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections.\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Internet Explorer\\\\Feeds\\\\\\n\\nValue Name: AllowBasicAuthInClear\\n\\nValue Type: REG_DWORD\\nValue: 0 (or if the Value Name does not exist)\"]\n[4588,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: RestrictAnonymous\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4589,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Windows Search\\\\\\n\\nValue Name: AllowIndexingEncryptedStoresOrItems\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4590,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: EveryoneIncludesAnonymous\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4591,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanManServer\\\\Parameters\\\\\\n\\nValue Name: RestrictNullSessAccess\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4592,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\LSA\\\\MSV1_0\\\\\\n\\nValue Name: allownullsessionfallback\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4593,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\LSA\\\\pku2u\\\\\\n\\nValue Name: AllowOnlineID\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4594,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Kerberos\\\\Parameters\\\\\\n\\nValue Name: SupportedEncryptionTypes\\n\\nValue Type: REG_DWORD\\nValue: 0x7ffffff8 (2147483640)\"]\n[4595,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: NoLMHash\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4596,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: LmCompatibilityLevel\\n\\nValue Type: REG_DWORD\\nValue: 5\"]\n[4597,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LDAP\\\\\\n\\nValue Name: LDAPClientIntegrity\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4598,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\MSV1_0\\\\\\n\\nValue Name: NTLMMinClientSec\\n\\nValue Type: REG_DWORD\\nValue: 0x20080000 (537395200)\"]\n[4599,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\MSV1_0\\\\\\n\\nValue Name: NTLMMinServerSec\\n\\nValue Type: REG_DWORD\\nValue: 0x20080000 (537395200)\"]\n[4600,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\FIPSAlgorithmPolicy\\\\\\n\\nValue Name: Enabled\\n\\nValue Type: REG_DWORD\\nValue: 1\\n \\nWarning: Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms.  Both the browser and web server must be configured to use TLS otherwise the browser will not be able to connect to a secure site.\"]\n[4601,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\\\n\\nValue Name: ProtectionMode\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4602,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: FilterAdministratorToken\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4603,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: ConsentPromptBehaviorAdmin\\n\\nValue Type: REG_DWORD\\nValue: 2 (Prompt for consent on the secure desktop)\"]\n[4604,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: ConsentPromptBehaviorUser\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4605,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: EnableInstallerDetection\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4606,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: EnableSecureUIAPaths\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4607,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: EnableLUA\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4608,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: EnableVirtualization\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4609,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\PushNotifications\\\\\\n\\nValue Name: NoToastApplicationNotificationOnLockScreen\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4610,\"The default behavior is for Windows to mark file attachments with their zone information.\\n\\nIf the registry Value Name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"2\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Attachments\\\\\\n\\nValue Name: SaveZoneInformation\\n\\nValue Type: REG_DWORD\\nValue: 0x00000002 (2) (or if the Value Name does not exist)\"]\n[4611,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Access Credential Manager as a trusted caller\\\" user right, this is a finding.\"]\n[4612,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Access this computer from the network\\\" user right, this is a finding:\\n\\nAdministrators\\nRemote Desktop Users\\n\\nIf a domain application account such as for a management tool requires this user right, this would not be a finding.\\n\\nVendor documentation must support the requirement for having the user right.\\n\\nThe requirement must be documented with the ISSO.\\n\\nThe application account, managed at the domain level, must meet requirements for application account passwords, such as length and frequency of changes as defined in the Windows server STIGs.\"]\n[4613,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts (to include administrators), are granted the \\\"Act as part of the operating system\\\" user right, this is a finding.\"]\n[4614,\"Verify the effective setting in Local Group Policy Editor.\\n\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Allow log on locally\\\" user right, this is a finding:\\n\\nAdministrators\\nUsers\"]\n[4615,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Back up files and directories\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[4616,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Change the system time\\\" user right, this is a finding:\\n\\nAdministrators\\nLOCAL SERVICE\\nNT SERVICE\\\\autotimesvc is added in v1909 cumulative update.\"]\n[4617,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Create a pagefile\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[4618,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Create a token object\\\" user right, this is a finding.\"]\n[4619,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Create global objects\\\" user right, this is a finding:\\n\\nAdministrators\\nLOCAL SERVICE\\nNETWORK SERVICE\\nSERVICE\"]\n[4620,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Create permanent shared objects\\\" user right, this is a finding.\"]\n[4621,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Create symbolic links\\\" user right, this is a finding:\\n\\nAdministrators\\n\\nIf the workstation has an approved use of Hyper-V, such as being used as a dedicated admin workstation using Hyper-V to separate administration and standard user functions, \\\"NT VIRTUAL MACHINES\\\\VIRTUAL MACHINE\\\" may be assigned this user right and is not a finding.\"]\n[4622,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Debug Programs\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[4623,\"Verify the effective setting in Local Group Policy Editor.\\n\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny access to this computer from the network\\\" right, this is a finding:\\n\\nDomain Systems Only:\\nEnterprise Admins group\\nDomain Admins group\\nLocal account (see Note below)\\n\\nAll Systems:\\nGuests group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nNote: \\\"Local account\\\" is a built-in security group used to assign user rights and permissions to all local accounts.\"]\n[4624,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nVerify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny log on as a batch job\\\" right, this is a finding:\\n\\nDomain Systems Only:\\nEnterprise Admin Group\\nDomain Admin Group\"]\n[4625,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nVerify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny log on as a service\\\" right , this is a finding:\\n\\nDomain Systems Only:\\nEnterprise Admins Group\\nDomain Admins Group\"]\n[4626,\"Verify the effective setting in Local Group Policy Editor.\\n\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny log on locally\\\" right, this is a finding.\\n\\nDomain Systems Only:\\nEnterprise Admins Group\\nDomain Admins Group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nAll Systems:\\nGuests Group\"]\n[4627,\"Verify the effective setting in Local Group Policy Editor.\\n\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny log on through Remote Desktop Services\\\" right, this is a finding:\\n\\nIf Remote Desktop Services is not used by the organization, the \\\"Everyone\\\" group can replace all of the groups listed below.\\n\\nDomain Systems Only:\\nEnterprise Admins group\\nDomain Admins group\\nLocal account (see Note below)\\n\\nAll Systems:\\nGuests group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nNote: \\\"Local account\\\" is a built-in security group used to assign user rights and permissions to all local accounts.\"]\n[4628,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Enable computer and user accounts to be trusted for delegation\\\" user right, this is a finding.\"]\n[4629,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Force shutdown from a remote system\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[4630,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Impersonate a client after authentication\\\" user right, this is a finding:\\n\\nAdministrators\\nLOCAL SERVICE\\nNETWORK SERVICE\\nSERVICE\"]\n[4631,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Load and unload device drivers\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[4632,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Lock pages in memory\\\" user right, this is a finding.\"]\n[4633,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Manage auditing and security log\\\" user right, this is a finding:\\n\\nAdministrators\\n\\nIf the organization has an \\\"Auditors\\\" group the assignment of this group to the user right would not be a finding.\"]\n[4634,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Modify firmware environment values\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[4635,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Perform volume maintenance tasks\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[4636,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Profile single process\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[4637,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Restore files and directories\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[4638,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Take ownership of files or other objects\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[4639,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DeliveryOptimization\\\\\\n\\nValue Name: DODownloadMode\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0) - No peering (HTTP Only)\\n0x00000001 (1) - Peers on same NAT only (LAN)\\n0x00000002 (2) - Local Network / Private group peering (Group)\\n0x00000063 (99) - Simple download mode, no peering (Simple)\\n0x00000064 (100) - Bypass mode, Delivery Optimization not used (Bypass)\\n\\nA value of 0x00000003 (3), Internet, is a finding.\\n\\nv1507 LTSB:\\nDomain joined systems:\\nVerify the registry value above.\\nIf the value is not 0x00000000 (0) or 0x00000001 (1), this is a finding.\\n\\nStandalone systems (configured in Settings):\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\DeliveryOptimization\\\\Config\\\\\\n\\nValue Name: DODownloadMode\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0) - Off\\n0x00000001 (1) - LAN\"]\n[4640,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE \\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Audit\\\\\\n\\nValue Name: ProcessCreationIncludeCmdLine_Enabled\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4641,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE \\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\PowerShell\\\\ScriptBlockLogging\\\\\\n\\nValue Name: EnableScriptBlockLogging\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[4642,\"Verify the DEP configuration.\\nOpen a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).\\nEnter \\\"BCDEdit /enum {current}\\\". (If using PowerShell \\\"{current}\\\" must be enclosed in quotes.)\\nIf the value for \\\"nx\\\" is not \\\"OptOut\\\", this is a finding.\\n(The more restrictive configuration of \\\"AlwaysOn\\\" would not be a finding.)\"]\n[4643,\"This is applicable to Windows 10 prior to v1709.\\n\\nVerify SEHOP is turned on.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\kernel\\\\\\n\\nValue Name: DisableExceptionChainValidation\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[4644,\"Run \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter the following:\\nGet-WindowsOptionalFeature -Online | Where FeatureName -like *PowerShellv2*\\n\\nIf either of the following have a \\\"State\\\" of \\\"Enabled\\\", this is a finding.\\n\\nFeatureName : MicrosoftWindowsPowerShellV2\\nState : Enabled\\nFeatureName : MicrosoftWindowsPowerShellV2Root\\nState : Enabled\\n\\nAlternately:\\nSearch for \\\"Features\\\".\\n\\nSelect \\\"Turn Windows features on or off\\\".\\n\\nIf \\\"Windows PowerShell 2.0\\\" (whether the subcategory of \\\"Windows PowerShell 2.0 Engine\\\" is selected or not) is selected, this is a finding.\"]\n[4645,\"Different methods are available to disable SMBv1 on Windows 10.  This is the preferred method, however if V-74723 and V-74725 are configured, this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter the following:\\nGet-WindowsOptionalFeature -Online | Where FeatureName -eq SMB1Protocol\\n\\nIf \\\"State : Enabled\\\" is returned, this is a finding.\\n\\nAlternately:\\nSearch for \\\"Features\\\".\\n\\nSelect \\\"Turn Windows features on or off\\\".\\n\\nIf \\\"SMB 1.0/CIFS File Sharing Support\\\" is selected, this is a finding.\"]\n[4646,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Account Lockout - Failure\"]\n[4647,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n-Open a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n-Enter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding.\\n\\nPolicy Change >> Authorization Policy Change - Success\"]\n[4648,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\SecurityProviders\\\\Wdigest\\\\\\n\\nValue Name: UseLogonCredential\\n\\nType: REG_DWORD\\nValue:  0x00000000 (0)\"]\n[4649,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Network Connections\\\\\\n\\nValue Name: NC_ShowSharedAccessUI\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[4650,\"Windows 10 v1507 LTSB version does not include this setting, it is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: RestrictRemoteSAM\\n\\nValue Type: REG_SZ\\nValue: O:BAG:BAD:(A;;RC;;;BA)\"]\n[4651,\"Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\CloudContent\\\\\\n\\nValue Name: DisableWindowsConsumerFeatures\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[4652,\"If the following registry values do not exist or are not configured as specified, this is a finding.\\nThe policy configures the same Value Name, Type and Value under four different registry paths.\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Paths:  \\n\\\\SOFTWARE\\\\Classes\\\\batfile\\\\shell\\\\runasuser\\\\\\n\\\\SOFTWARE\\\\Classes\\\\cmdfile\\\\shell\\\\runasuser\\\\\\n\\\\SOFTWARE\\\\Classes\\\\exefile\\\\shell\\\\runasuser\\\\\\n\\\\SOFTWARE\\\\Classes\\\\mscfile\\\\shell\\\\runasuser\\\\\\n\\nValue Name:  SuppressionPolicy\\n\\nType:  REG_DWORD\\nValue:  0x00001000 (4096)\"]\n[4653,\"This is NA if the system does not have Bluetooth.\\n\\nVerify the Bluetooth radio is turned off unless approved by the organization. If it is not, this is a finding.\\n\\nApproval must be documented with the ISSO.\"]\n[4654,\"This is NA if the system does not have Bluetooth.\\n\\nVerify the organization has a policy to turn off Bluetooth when not in use and personnel are trained. If it does not, this is a finding.\"]\n[4655,\"This is NA if the system does not have Bluetooth, or if Bluetooth is turned off per the organizations policy.\\n\\nSearch for \\\"Bluetooth\\\".\\nView Bluetooth Settings.\\nSelect \\\"More Bluetooth Options\\\"\\nIf \\\"Alert me when a new Bluetooth device wants to connect\\\" is not checked, this is a finding.\"]\n[4656,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen PowerShell or a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following:\\n\\nObject Access >> Other Object Access Events - Failure\\n\\nIf the system does not audit the above, this is a finding.\"]\n[4657,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen PowerShell or a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following:\\n\\nObject Access >> Other Object Access Events - Success\\n\\nIf the system does not audit the above, this is a finding.\"]\n[4658,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Cryptography\\\\Configuration\\\\SSL\\\\00010002\\\\\\n\\nValue Name: EccCurves\\n\\nValue Type: REG_MULTI_SZ\\nValue: NistP384 NistP256\"]\n[4659,\"This is NA for Windows 10 LTSC\\\\B versions 1507 and 1607.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\GameDVR\\\\\\n\\nValue Name: AllowGameDVR\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[4660,\"This is NA for Windows 10 LTSC\\\\B versions 1507 and 1607.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\CredentialsDelegation\\\\\\n\\nValue Name: AllowProtectedCreds\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[4661,\"Run \\\"Services.msc\\\".\\n\\nLocate the \\\"Secondary Logon\\\" service.\\n\\nIf the \\\"Startup Type\\\" is not \\\"Disabled\\\" or the \\\"Status\\\" is \\\"Running\\\", this is a finding.\"]\n[4662,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen PowerShell or a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following:\\n\\nObject Access >> File Share - Success\\n\\nIf the system does not audit the above, this is a finding.\"]\n[4663,\"Different methods are available to disable SMBv1 on Windows 10, if V-70639 is configured, this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanmanServer\\\\Parameters\\\\\\n\\nValue Name: SMB1\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[4664,\"Different methods are available to disable SMBv1 on Windows 10, if V-70639 is configured, this is NA.\\n\\nIf the following registry value is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\mrxsmb10\\\\\\n\\nValue Name: Start\\n\\nType: REG_DWORD\\nValue: 0x00000004 (4)\"]\n[4665,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen PowerShell or a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following:\\n\\nObject Access >> File Share - Failure\\n\\nIf the system does not audit the above, this is a finding.\"]\n[4666,\"Review the effective User Rights setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nReview each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of \\\"*S-1-…\\\".)\\n\\nIf any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.\"]\n[4667,\"For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nVerify the system firmware is configured to run in UEFI mode, not Legacy BIOS.\\n\\nRun \\\"System Information\\\".\\n\\nUnder \\\"System Summary\\\", if \\\"BIOS Mode\\\" does not display \\\"UEFI\\\", this is finding.\"]\n[4668,\"Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows 10 hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. \\n\\nFor virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nRun \\\"System Information\\\".\\n\\nUnder \\\"System Summary\\\", if \\\"Secure Boot State\\\" does not display \\\"On\\\", this is finding.\"]\n[4669,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"DEP: Enable\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[4670,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"ASLR: BottomUp\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[4671,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"CFG: Enable\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[4672,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"SEHOP: Enable\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[4673,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"Heap: TerminateOnError\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[4674,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name Acrobat.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4675,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name AcroRd32.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot= False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4676,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name chrome.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverrideDEP: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4677,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name EXCEL.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4678,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name firefox.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: On\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4679,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name FLTLDR.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False \\nOverrideExportAddressFilterPlus: False \\nOverrideImportAddressFilter: False \\nOverrideEnableRopStackPivot: False \\nOverrideEnableRopCallerCheck: False \\nOverrideEnableRopSimExec: False\\n\\nChild Process:\\nOverrideChildProcess: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4680,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name GROOVE.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverrideDEP: False\\n\\nASLR:\\nForceRelocateImages: On\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nChild Process:\\nOverrideChildProcess: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here.  If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4681,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name iexplore.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4682,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name INFOPATH.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4683,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name [application name]\\\" with each of the following substituted for [application name]:\\njava.exe, javaw.exe, and javaws.exe\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4684,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name lync.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4685,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name MSACCESS.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4686,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name MSPUB.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4687,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name OneDrive.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nOverrideRelocateImages: NOTSET\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False \\nOverrideExportAddressFilterPlus: False \\nOverrideImportAddressFilter: False \\nOverrideEnableRopStackPivot: False \\nOverrideEnableRopCallerCheck: False \\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4688,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name OIS.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverrideDEP: False\\n\\nPayload:\\nOverrideEnableExportAddressFilter: False\\nOverrideEnableExportAddressFilterPlus: False\\nOverrideEnableImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4689,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name OUTLOOK.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4690,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name plugin-container.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status of \\\"ON\\\" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4691,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name POWERPNT.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4692,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name PPTVIEW.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4693,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name VISIO.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4694,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name VPREVIEW.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4695,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name WINWORD.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4696,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name wmplayer.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4697,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name wordpad.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[4698,\"Determine whether administrative accounts are prevented from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration.\\n\\nThe organization must have a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.\\n\\nTechnical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet. \\n\\nIf accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding.\"]\n[4699,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\Software\\\\Policies\\\\Microsoft\\\\OneDrive\\\\\\n\\nValue Name: DisablePersonalSync\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[4700,\"This setting is applicable starting with v1809 of Windows 10; it is NA for prior versions.\\n\\nWindows 10 LTSC\\\\B versions do not include Microsoft Edge; this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\Internet Settings\\\\\\n\\nValue Name: PreventCertErrorOverrides\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[4701,\"This setting requires v1709 or later of Windows 10; it is NA for prior versions.\\n\\nIf \\\"Enhanced\\\" level is enabled for telemetry, this must be configured. If \\\"Security\\\" or \\\"Basic\\\" are configured, this is NA. (See V-63683).\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DataCollection\\\\\\n\\nValue Name: LimitEnhancedDiagnosticDataWindowsAnalytics\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[4702,\"If the organization is using a DoD instance of OneDrive, verify synchronizing is only allowed to the organization's DoD instance.\\n\\nIf the organization does not have an instance of OneDrive, verify this is configured with the noted dummy entry to prevent synchronizing with other instances.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\OneDrive\\\\AllowTenantList\\\\\\n\\nValue Name: Organization's Tenant GUID\\n\\nValue Type: REG_SZ\\nValue: Organization's Tenant GUID\\n\\nIf the organization does not have an instance of OneDrive the Value Name and Value must be 1111-2222-3333-4444, if not this is a finding.\"]\n[4703,\"This setting requires v1903 or later of Windows 10; it is NA for prior versions.  The setting is NA when the “Allow voice activation” policy is configured to disallow applications to be activated with voice for all users.\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\AppPrivacy\\\\\\n\\nValue Name: LetAppsActivateWithVoiceAboveLock\\n\\nType: REG_DWORD\\nValue: 0x00000002 (2)\\n\\nIf the following registry value exists and is configured as specified, requirement is NA. \\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\AppPrivacy\\\\\\n\\nValue Name: LetAppsActivateWithVoice\\n\\nType: REG_DWORD\\nValue: 0x00000002 (2)\"]\n[4704,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\FVE\\\\\\n\\nValue Name: UseAdvancedStartup\\nType: REG_DWORD\\nValue: 0x00000001 (1)\\n\\nIf one of the following registry values does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\FVE\\\\\\n\\nValue Name: UseTPMPIN\\nType: REG_DWORD\\nValue: 0x00000001 (1)\\n\\nValue Name: UseTPMKeyPIN\\nType: REG_DWORD\\nValue: 0x00000001 (1)\\n\\n\\nBitLocker network unlock may be used in conjunction with a BitLocker PIN. See the article below regarding information about network unlock.\\n\\nhttps://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock\"]\n[4705,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\FVE\\\\\\n\\nValue Name: MinimumPIN\\nType: REG_DWORD\\nValue: 0x00000006 (6) or greater\"]\n[4706,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff  >> Other Logon/Logoff Events - Failure\"]\n[4707,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff  >> Other Logon/Logoff Events - Success\"]\n[4708,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nObject Access  >> Detailed File Share - Failure\"]\n[4709,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nPolicy Change  >> MPSSVC Rule-Level Policy Change - Success\"]\n[4710,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nPolicy Change  >> MPSSVC Rule-Level Policy Change - Failure\"]\n[4711,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nPolicy Change  >> Other Policy Change Events - Success\"]\n[4712,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nPolicy Change  >> Other Policy Change Events - Failure\"]\n[4713,\"Review the password last set date for the enabled local Administrator account.\\n\\nOn the local domain joined workstation:\\n\\nOpen \\\"PowerShell\\\".\\n\\nEnter \\\"Get-LocalUser –Name * | Select-Object *”\\n\\nIf the \\\"PasswordLastSet\\\" date is greater than \\\"60\\\" days old for the local Administrator account for administering the computer/domain, this is a finding.\"]\n[4714,\"This is NA prior to v1803 of Windows 10.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\Kernel DMA Protection\\n\\nValue Name: DeviceEnumerationPolicy\\nValue Type: REG_DWORD\\nValue: 0\"]\n[4715,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\n\\nValue Name: AllowDomainPINLogon\\nValue Type: REG_DWORD\\nValue data: 0\"]\n[4716,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\Software\\\\Policies\\\\Microsoft\\\\WindowsInkWorkspace\\n\\nValue Name: AllowWindowsInkWorkspace\\nValue Type: REG_DWORD\\nValue data: 1\"]\n[4717,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding: \\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\CloudContent\\\\\\n\\nValue Name: DisableThirdPartySuggestions\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[4718,\"If the device or operating system does not have a camera installed, this requirement is not applicable.\\n\\nThis requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local AO decision.\\n\\nThis requirement is not applicable to dedicated VTC suites located in approved VTC locations that are centrally managed.\\n\\nFor an external camera, if there is not a method for the operator to manually disconnect camera at the end of collaborative computing sessions, this is a finding.\\n\\nFor a built-in camera, the camera must be protected by a camera cover (e.g. laptop camera cover slide) when not in use. If the built-in camera is not protected with a camera cover, or if the built-in\\ncamera is not disabled in the bios, this is a finding.\\n\\nIf the camera is not disconnected or covered, the following registry entry is required:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistryPath\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\CapabilityAccessManager\\\\ConsentStore\\\\webcam\\n\\nValue Name: Deny\\n\\nIf \\\"Value Name\\\" is set to a value other than \\\"Deny\\\" and the collaborative computing device has not been authorized for use, this is a finding.\"]\n[4719,\"Ensure there is a documented policy or procedure in place that non-persistent VM sessions do not exceed 24 hours.\\n\\nIf there is no such documented policy or procedure in place, this is a finding.\"]\n[4720,\"If the following registry values do not exist or are not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\n\\nValue Name: NoPreviewPane\\n\\nValue Type: REG_DWORD\\n\\nValue: 1\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\n\\nValue Name: NoReadingPane\\n\\nValue Type: REG_DWORD\\n\\nValue: 1\"]\n[4721,\"If the system is a member of a domain this is Not Applicable.\\n\\nIf one of the following settings does not exist and is not populated, this is a finding: \\n\\nComputer\\\\HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Cryptography\\\\Calais\\\\Readers\\nComputer\\\\HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Cryptography\\\\Calais\\\\SmartCards\"]\n[4723,\"Verify the file permissions, ownership, and group membership of system files and commands match the vendor values.\\n\\nCheck the default file permissions, ownership, and group membership of system files and commands with the following command:\\n\\n# for i in `rpm -Va | egrep -i '^\\\\.[M|U|G|.]{8}' | cut -d \\\" \\\" -f4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump | cut -d \\\" \\\" -f1,5,6,7 | grep $i;done;done\\n\\n/var/log/gdm 040755 root root\\n/etc/audisp/audisp-remote.conf 0100640 root root\\n/usr/bin/passwd 0104755 root root\\n\\nFor each file returned, verify the current permissions, ownership, and group membership:\\n# ls -la <filename>\\n\\n-rw-------. 1 root root 133 Jan 11 13:25 /etc/audisp/audisp-remote.conf\\n\\nIf the file is more permissive than the default permissions, this is a finding.\\n\\nIf the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding.\\n\\nIf the file is not a member of the default group and is not documented with the Information System Security Officer (ISSO), this is a finding.\"]\n[4724,\"Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a graphical user logon.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nCheck to see if the operating system displays a banner at the logon screen with the following command:\\n\\n# grep banner-message-enable /etc/dconf/db/local.d/*\\nbanner-message-enable=true\\n\\nIf \\\"banner-message-enable\\\" is set to \\\"false\\\" or is missing, this is a finding.\"]\n[4725,\"Verify the operating system displays the approved Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a graphical user logon.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nCheck that the operating system displays the exact approved Standard Mandatory DoD Notice and Consent Banner text with the command:\\n\\n# grep banner-message-text /etc/dconf/db/local.d/*\\nbanner-message-text=\\n'You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\\\n-At any time, the USG may inspect and seize data stored on this IS.\\\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. '\\n\\nNote: The \\\"\\\\n \\\" characters are for formatting only. They will not be displayed on the GUI.\\n\\nIf the banner does not match the approved Standard Mandatory DoD Notice and Consent Banner, this is a finding.\"]\n[4726,\"Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a command line user logon.\\n\\nCheck to see if the operating system displays a banner at the command line logon screen with the following command:\\n\\n# more /etc/issue\\n\\nThe command should return the following text:\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nIf the operating system does not display a graphical logon banner or the banner does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.\\n\\nIf the text in the \\\"/etc/issue\\\" file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.\"]\n[4727,\"Verify the operating system enables a user's session lock until that user re-establishes access using established identification and authentication procedures. The screen program must be installed to lock sessions on the console.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCheck to see if the screen lock is enabled with the following command:\\n\\n# grep -i lock-enabled /etc/dconf/db/local.d/*\\nlock-enabled=true\\n\\nIf the \\\"lock-enabled\\\" setting is missing or is not set to \\\"true\\\", this is a finding.\"]\n[4728,\"Verify the operating system uniquely identifies and authenticates users using multifactor authentication via a graphical user logon.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nDetermine which profile the system database is using with the following command:\\n\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nNote: The example is using the database local for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than local is being used.\\n\\n# grep enable-smartcard-authentication /etc/dconf/db/local.d/*\\n\\nenable-smartcard-authentication=true\\n\\nIf \\\"enable-smartcard-authentication\\\" is set to \\\"false\\\" or the keyword is missing, this is a finding.\"]\n[4729,\"Verify the operating system initiates a screensaver after a 15-minute period of inactivity for graphical user interfaces. The screen program must be installed to lock sessions on the console.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCheck to see if GNOME is configured to display a screensaver after a 15 minute delay with the following command:\\n\\n# grep -i idle-delay /etc/dconf/db/local.d/*\\nidle-delay=uint32 900\\n\\nIf the \\\"idle-delay\\\" setting is missing or is not set to \\\"900\\\" or less, this is a finding.\"]\n[4730,\"Verify the operating system prevents a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\\n\\nDetermine which profile the system database is using with the following command:\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nCheck for the lock delay setting with the following command:\\n\\nNote: The example below is using the database \\\"local\\\" for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than \\\"local\\\" is being used.\\n\\n# grep -i lock-delay /etc/dconf/db/local.d/locks/*\\n\\n/org/gnome/desktop/screensaver/lock-delay\\n\\nIf the command does not return a result, this is a finding.\"]\n[4731,\"Verify the operating system prevents a user from overriding session idle delay after a 15-minute period of inactivity for graphical user interfaces. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console. \\n\\nDetermine which profile the system database is using with the following command:\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nCheck for the session idle delay setting with the following command:\\n\\nNote: The example below is using the database \\\"local\\\" for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than \\\"local\\\" is being used.\\n\\n# grep -i idle-delay /etc/dconf/db/local.d/locks/*\\n\\n/org/gnome/desktop/session/idle-delay\\n\\nIf the command does not return a result, this is a finding.\"]\n[4732,\"Verify the operating system has the screen package installed.\\n\\nCheck to see if the screen package is installed with the following command:\\n\\n# yum list installed screen\\nscreen-4.3.1-3-x86_64.rpm\\n\\nIf the screen package is not installed, check to see if the tmux package is installed with the following command:\\n\\n#yum list installed tmux\\ntmux-1.8-4.el7.x86_64.rpm \\n\\nIf either the screen package or the tmux package is not installed, this is a finding.\"]\n[4733,\"Verify the operating system initiates a session lock after a 15-minute period of inactivity for graphical user interfaces. The screen program must be installed to lock sessions on the console.\\n\\nNote: If the system does not have a Graphical User Interface installed, this requirement is Not Applicable.\\n\\nCheck for the session lock settings with the following commands:\\n\\n# grep -i idle-activation-enabled /etc/dconf/db/local.d/*\\n\\nidle-activation-enabled=true\\n\\nIf \\\"idle-activation-enabled\\\" is not set to \\\"true\\\", this is a finding.\"]\n[4734,\"Verify the operating system prevents a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\\n\\nDetermine which profile the system database is using with the following command:\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nCheck for the idle-activation-enabled setting with the following command:\\n\\nNote: The example below is using the database \\\"local\\\" for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than \\\"local\\\" is being used.\\n\\n# grep -i idle-activation-enabled /etc/dconf/db/local.d/locks/*\\n\\n/org/gnome/desktop/screensaver/idle-activation-enabled\\n\\nIf the command does not return a result, this is a finding.\"]\n[4735,\"Verify the operating system initiates a session lock a for graphical user interfaces when the screensaver is activated. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\\n\\nIf GNOME is installed, check to see a session lock occurs when the screensaver is activated with the following command:\\n\\n# grep -i lock-delay /etc/dconf/db/local.d/*\\nlock-delay=uint32 5\\n\\nIf the \\\"lock-delay\\\" setting is missing, or is not set to \\\"5\\\" or less, this is a finding.\"]\n[4736,\"Verify that /etc/pam.d/passwd is configured to use /etc/pam.d/system-auth when changing passwords:\\n\\n# cat /etc/pam.d/passwd | grep -i substack | grep -i system-auth\\npassword     substack     system-auth\\n\\nIf no results are returned, the line is commented out, this is a finding.\"]\n[4737,\"Verify the operating system uses \\\"pwquality\\\" to enforce the password complexity rules. \\n\\nCheck for the use of \\\"pwquality\\\" with the following command:\\n\\n# cat /etc/pam.d/system-auth | grep pam_pwquality\\n\\npassword required pam_pwquality.so retry=3\\n\\nIf the command does not return an uncommented line containing the value \\\"pam_pwquality.so\\\", this is a finding.\\n\\nIf the value of \\\"retry\\\" is set to \\\"0\\\" or greater than \\\"3\\\", this is a finding.\"]\n[4738,\"Note: The value to require a number of upper-case characters to be set is expressed as a negative number in \\\"/etc/security/pwquality.conf\\\".\\n\\nCheck the value for \\\"ucredit\\\" in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep ucredit /etc/security/pwquality.conf \\nucredit = -1\\n\\nIf the value of \\\"ucredit\\\" is not set to a negative value, this is a finding.\"]\n[4739,\"Note: The value to require a number of lower-case characters to be set is expressed as a negative number in \\\"/etc/security/pwquality.conf\\\".\\n\\nCheck the value for \\\"lcredit\\\" in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep lcredit /etc/security/pwquality.conf \\nlcredit = -1 \\n\\nIf the value of \\\"lcredit\\\" is not set to a negative value, this is a finding.\"]\n[4740,\"Note: The value to require a number of numeric characters to be set is expressed as a negative number in \\\"/etc/security/pwquality.conf\\\".\\n\\nCheck the value for \\\"dcredit\\\" in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep dcredit /etc/security/pwquality.conf \\ndcredit = -1 \\n\\nIf the value of \\\"dcredit\\\" is not set to a negative value, this is a finding.\"]\n[4741,\"Verify the operating system enforces password complexity by requiring that at least one special character be used.\\n\\nNote: The value to require a number of special characters to be set is expressed as a negative number in \\\"/etc/security/pwquality.conf\\\".\\n\\nCheck the value for \\\"ocredit\\\" in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep ocredit /etc/security/pwquality.conf \\nocredit=-1\\n\\nIf the value of \\\"ocredit\\\" is not set to a negative value, this is a finding.\"]\n[4742,\"The \\\"difok\\\" option sets the number of characters in a password that must not be present in the old password.\\n\\nCheck for the value of the \\\"difok\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep difok /etc/security/pwquality.conf \\ndifok = 8\\n\\nIf the value of \\\"difok\\\" is set to less than \\\"8\\\", this is a finding.\"]\n[4743,\"The \\\"minclass\\\" option sets the minimum number of required classes of characters for the new password (digits, upper-case, lower-case, others).\\n\\nCheck for the value of the \\\"minclass\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep minclass /etc/security/pwquality.conf \\nminclass = 4\\n\\nIf the value of \\\"minclass\\\" is set to less than \\\"4\\\", this is a finding.\"]\n[4744,\"The \\\"maxrepeat\\\" option sets the maximum number of allowed same consecutive characters in a new password.\\n\\nCheck for the value of the \\\"maxrepeat\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep maxrepeat /etc/security/pwquality.conf \\nmaxrepeat = 3\\n\\nIf the value of \\\"maxrepeat\\\" is set to more than \\\"3\\\", this is a finding.\"]\n[4745,\"The \\\"maxclassrepeat\\\" option sets the maximum number of allowed same consecutive characters in the same class in the new password.\\n\\nCheck for the value of the \\\"maxclassrepeat\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep maxclassrepeat /etc/security/pwquality.conf \\nmaxclassrepeat = 4\\n\\nIf the value of \\\"maxclassrepeat\\\" is set to more than \\\"4\\\", this is a finding.\"]\n[4746,\"Verify the PAM system service is configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is SHA512.\\n\\nCheck that the system is configured to create SHA512 hashed passwords with the following command:\\n\\n# grep password /etc/pam.d/system-auth /etc/pam.d/password-auth\\n\\nOutcome should look like following:\\n/etc/pam.d/system-auth-ac:password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\\n/etc/pam.d/password-auth:password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\\n\\nIf the \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" configuration files allow for password hashes other than SHA512 to be used, this is a finding.\"]\n[4747,\"Verify the system's shadow file is configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is SHA512.\\n\\nCheck that the system is configured to create SHA512 hashed passwords with the following command:\\n\\n# grep -i encrypt /etc/login.defs\\nENCRYPT_METHOD SHA512\\n\\nIf the \\\"/etc/login.defs\\\" configuration file does not exist or allows for password hashes other than SHA512 to be used, this is a finding.\"]\n[4748,\"Verify the user and group account administration utilities are configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is \\\"SHA512\\\".\\n\\nCheck that the system is configured to create \\\"SHA512\\\" hashed passwords with the following command:\\n\\n# grep -i sha512 /etc/libuser.conf \\n\\ncrypt_style = sha512\\n\\nIf the \\\"crypt_style\\\" variable is not set to \\\"sha512\\\", is not in the defaults section, is commented out, or does not exist, this is a finding.\"]\n[4749,\"Verify the operating system enforces 24 hours/1 day as the minimum password lifetime for new user accounts.\\n\\nCheck for the value of \\\"PASS_MIN_DAYS\\\" in \\\"/etc/login.defs\\\" with the following command: \\n\\n# grep -i pass_min_days /etc/login.defs\\nPASS_MIN_DAYS     1\\n\\nIf the \\\"PASS_MIN_DAYS\\\" parameter value is not \\\"1\\\" or greater, or is commented out, this is a finding.\"]\n[4750,\"Check whether the minimum time period between password changes for each user account is one day or greater.\\n\\n# awk -F: '$4 < 1 {print $1 \\\" \\\" $4}' /etc/shadow\\n\\nIf any results are returned that are not associated with a system account, this is a finding.\"]\n[4751,\"If passwords are not being used for authentication, this is Not Applicable.\\n\\nVerify the operating system enforces a 60-day maximum password lifetime restriction for new user accounts.\\n\\nCheck for the value of \\\"PASS_MAX_DAYS\\\" in \\\"/etc/login.defs\\\" with the following command:\\n\\n# grep -i pass_max_days /etc/login.defs\\nPASS_MAX_DAYS 60\\n\\nIf the \\\"PASS_MAX_DAYS\\\" parameter value is not 60 or less, or is commented out, this is a finding.\"]\n[4752,\"Check whether the maximum time period for existing passwords is restricted to 60 days.\\n\\n# awk -F: '$5 > 60 {print $1 \\\" \\\" $5}' /etc/shadow\\n\\nIf any results are returned that are not associated with a system account, this is a finding.\"]\n[4753,\"Verify the operating system prohibits password reuse for a minimum of five generations.\\n\\nCheck for the value of the \\\"remember\\\" argument in \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" with the following command:\\n\\n# grep -i remember /etc/pam.d/system-auth /etc/pam.d/password-auth\\n\\npassword    requisite     pam_pwhistory.so use_authtok remember=5 retry=3\\n\\nIf the line containing the \\\"pam_pwhistory.so\\\" line does not have the \\\"remember\\\" module argument set, is commented out, or the value of the \\\"remember\\\" module argument is set to less than \\\"5\\\", this is a finding.\"]\n[4754,\"Verify the operating system enforces a minimum 15-character password length. The \\\"minlen\\\" option sets the minimum number of characters in a new password.\\n\\nCheck for the value of the \\\"minlen\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep minlen /etc/security/pwquality.conf\\nminlen = 15\\n\\nIf the command does not return a \\\"minlen\\\" value of 15 or greater, this is a finding.\"]\n[4755,\"To verify that null passwords cannot be used, run the following command: \\n\\n# grep nullok /etc/pam.d/system-auth /etc/pam.d/password-auth\\n\\nIf this produces any output, it may be possible to log on with accounts with empty passwords.\\n\\nIf null passwords can be used, this is a finding.\"]\n[4756,\"To determine how the SSH daemon's \\\"PermitEmptyPasswords\\\" option is set, run the following command:\\n\\n# grep -i PermitEmptyPasswords /etc/ssh/sshd_config\\nPermitEmptyPasswords no\\n\\nIf no line, a commented line, or a line indicating the value \\\"no\\\" is returned, the required value is set.\\n\\nIf the required value is not set, this is a finding.\"]\n[4757,\"If passwords are not being used for authentication, this is Not Applicable.\\n\\nVerify the operating system disables account identifiers (individuals, groups, roles, and devices) after the password expires with the following command:\\n\\n# grep -i inactive /etc/default/useradd\\nINACTIVE=0\\n\\nIf the value is not set to \\\"0\\\", is commented out, or is not defined, this is a finding.\"]\n[4758,\"Check that the system locks an account for a minimum of 15 minutes after three unsuccessful logon attempts within a period of 15 minutes with the following command:\\n\\n# grep pam_faillock.so /etc/pam.d/password-auth\\n\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so \\n\\nIf the \\\"deny\\\" parameter is set to \\\"0\\\" or a value less than \\\"3\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"even_deny_root\\\" parameter is not set on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"fail_interval\\\" parameter is set to \\\"0\\\" or is set to a value less than \\\"900\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"unlock_time\\\" parameter is not set to \\\"0\\\", \\\"never\\\", or is set to a value less than \\\"900\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nNote: The maximum configurable value for \\\"unlock_time\\\" is \\\"604800\\\". \\n\\nIf any line referencing the \\\"pam_faillock.so\\\" module is commented out, this is a finding.\\n\\n# grep pam_faillock.so /etc/pam.d/system-auth\\n\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so \\n\\nIf the \\\"deny\\\" parameter is set to \\\"0\\\" or a value less than \\\"3\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"even_deny_root\\\" parameter is not set on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"fail_interval\\\" parameter is set to \\\"0\\\" or is set to a value less than \\\"900\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"unlock_time\\\" parameter is not set to \\\"0\\\", \\\"never\\\", or is set to a value less than \\\"900\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module or is missing from these lines, this is a finding.\\n\\nNote: The maximum configurable value for \\\"unlock_time\\\" is \\\"604800\\\". \\nIf any line referencing the \\\"pam_faillock.so\\\" module is commented out, this is a finding.\"]\n[4759,\"Verify the operating system automatically locks the root account until it is released by an administrator when three unsuccessful logon attempts in 15 minutes are made.\\n\\n# grep pam_faillock.so /etc/pam.d/password-auth\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900 \\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900 \\naccount required pam_faillock.so\\n\\nIf the \\\"even_deny_root\\\" setting is not defined on both lines with the \\\"pam_faillock.so\\\" module, is commented out, or is missing from a line, this is a finding.\\n\\n# grep pam_faillock.so /etc/pam.d/system-auth\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900 \\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so\\n\\nIf the \\\"even_deny_root\\\" setting is not defined on both lines with the \\\"pam_faillock.so\\\" module, is commented out, or is missing from a line, this is a finding.\"]\n[4760,\"If passwords are not being used for authentication, this is Not Applicable.\\n\\nVerify the operating system requires users to supply a password for privilege escalation.\\n\\nCheck the configuration of the \\\"/etc/sudoers\\\" and \\\"/etc/sudoers.d/*\\\" files with the following command:\\n\\n# grep -i nopasswd /etc/sudoers /etc/sudoers.d/*\\n\\nIf any uncommented line is found with a \\\"NOPASSWD\\\" tag, this is a finding.\"]\n[4761,\"Verify the operating system requires users to reauthenticate for privilege escalation.\\n\\nCheck the configuration of the \\\"/etc/sudoers\\\" and \\\"/etc/sudoers.d/*\\\" files with the following command:\\n\\n# grep -i authenticate /etc/sudoers /etc/sudoers.d/*\\n\\nIf any uncommented line is found with a \\\"!authenticate\\\" tag, this is a finding.\"]\n[4762,\"Verify the operating system enforces a delay of at least four seconds between console logon prompts following a failed logon attempt.\\n\\nCheck the value of the \\\"fail_delay\\\" parameter in the \\\"/etc/login.defs\\\" file with the following command:\\n\\n# grep -i fail_delay /etc/login.defs\\nFAIL_DELAY 4\\n\\nIf the value of \\\"FAIL_DELAY\\\" is not set to \\\"4\\\" or greater, or the line is commented out, this is a finding.\"]\n[4763,\"Verify the operating system does not allow an unattended or automatic logon to the system via a graphical user interface.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nCheck for the value of the \\\"AutomaticLoginEnable\\\" in the \\\"/etc/gdm/custom.conf\\\" file with the following command:\\n\\n# grep -i automaticloginenable /etc/gdm/custom.conf\\nAutomaticLoginEnable=false\\n\\nIf the value of \\\"AutomaticLoginEnable\\\" is not set to \\\"false\\\", this is a finding.\"]\n[4764,\"Verify the operating system does not allow an unrestricted logon to the system via a graphical user interface.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nCheck for the value of the \\\"TimedLoginEnable\\\" parameter in \\\"/etc/gdm/custom.conf\\\" file with the following command:\\n\\n# grep -i timedloginenable /etc/gdm/custom.conf\\nTimedLoginEnable=false\\n\\nIf the value of \\\"TimedLoginEnable\\\" is not set to \\\"false\\\", this is a finding.\"]\n[4765,\"Verify the operating system does not allow users to override environment variables to the SSH daemon.\\n\\nCheck for the value of the \\\"PermitUserEnvironment\\\" keyword with the following command:\\n\\n# grep -i permituserenvironment /etc/ssh/sshd_config\\nPermitUserEnvironment no\\n\\nIf the \\\"PermitUserEnvironment\\\" keyword is not set to \\\"no\\\", is missing, or is commented out, this is a finding.\"]\n[4766,\"Verify the operating system does not allow a non-certificate trusted host SSH logon to the system.\\n\\nCheck for the value of the \\\"HostbasedAuthentication\\\" keyword with the following command:\\n\\n# grep -i hostbasedauthentication /etc/ssh/sshd_config\\nHostbasedAuthentication no\\n\\nIf the \\\"HostbasedAuthentication\\\" keyword is not set to \\\"no\\\", is missing, or is commented out, this is a finding.\"]\n[4767,\"For systems that use UEFI, this is Not Applicable.\\nFor systems that are running RHEL 7.2 or newer, this is Not Applicable.\\n\\nCheck to see if an encrypted root password is set. On systems that use a BIOS, use the following command:\\n\\n# grep -i password_pbkdf2 /boot/grub2/grub.cfg\\n\\npassword_pbkdf2 [superusers-account] [password-hash]\\n\\nIf the root password entry does not begin with \\\"password_pbkdf2\\\", this is a finding.\\n\\nIf the \\\"superusers-account\\\" is not set to \\\"root\\\", this is a finding.\"]\n[4768,\"Verify the operating system must require authentication upon booting into single-user and maintenance modes.\\n\\nCheck that the operating system requires authentication upon booting into single-user mode with the following command:\\n\\n# grep -i execstart /usr/lib/systemd/system/rescue.service | grep -i sulogin\\n\\nExecStart=-/bin/sh -c \\\"/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default\\\"\\n\\nIf \\\"ExecStart\\\" does not have \\\"/usr/sbin/sulogin\\\" as an option, this is a finding.\"]\n[4769,\"For systems that use UEFI, this is Not Applicable.\\n\\nFor systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\\n\\nCheck to see if an encrypted root password is set. On systems that use a BIOS, use the following command:\\n\\n# grep -iw grub2_password /boot/grub2/user.cfg\\nGRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]\\n\\nIf the root password does not begin with \\\"grub.pbkdf2.sha512\\\", this is a finding.\\n\\nVerify that the \\\"root\\\" account is set as the \\\"superusers\\\":\\n\\n# grep -iw \\\"superusers\\\" /boot/grub2/grub.cfg\\n    set superusers=\\\"root\\\"\\n    export superusers\\n\\nIf \\\"superusers\\\" is not set to \\\"root\\\", this is a finding.\"]\n[4770,\"For systems that use BIOS, this is Not Applicable.\\nFor systems that are running RHEL 7.2 or newer, this is Not Applicable.\\n\\nCheck to see if an encrypted root password is set. On systems that use UEFI, use the following command:\\n\\n# grep -i password /boot/efi/EFI/redhat/grub.cfg\\n\\npassword_pbkdf2 [superusers-account] [password-hash]\\n\\nIf the root password entry does not begin with \\\"password_pbkdf2\\\", this is a finding.\\n\\nIf the \\\"superusers-account\\\" is not set to \\\"root\\\", this is a finding.\"]\n[4771,\"For systems that use BIOS, this is Not Applicable.\\n\\nFor systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\\n\\nCheck to see if an encrypted root password is set. On systems that use UEFI, use the following command:\\n\\n# grep -iw grub2_password /boot/efi/EFI/redhat/user.cfg\\nGRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]\\n\\nIf the root password does not begin with \\\"grub.pbkdf2.sha512\\\", this is a finding.\\n\\nVerify that the \\\"root\\\" account is set as the \\\"superusers\\\":\\n\\n# grep -iw \\\"superusers\\\" /boot/efi/EFI/redhat/grub.cfg\\n    set superusers=\\\"root\\\"\\n    export superusers\\n\\nIf \\\"superusers\\\" is not set to \\\"root\\\", this is a finding.\"]\n[4772,\"Verify the operating system requires multifactor authentication to uniquely identify organizational users using multifactor authentication.\\n\\nCheck to see if smartcard authentication is enforced on the system:\\n\\n# authconfig --test | grep \\\"pam_pkcs11 is enabled\\\"\\n\\nIf no results are returned, this is a finding.\\n\\n# authconfig --test | grep \\\"smartcard removal action\\\"\\n\\nIf \\\"smartcard removal action\\\" is blank, this is a finding.\\n\\n# authconfig --test | grep \\\"smartcard module\\\"\\n\\nIf \\\"smartcard module\\\" is blank, this is a finding.\"]\n[4773,\"Check to see if the rsh-server package is installed with the following command:\\n\\n# yum list installed rsh-server\\n\\nIf the rsh-server package is installed, this is a finding.\"]\n[4774,\"The NIS service provides an unencrypted authentication service that does not provide for the confidentiality and integrity of user passwords or the remote session.\\n\\nCheck to see if the \\\"ypserve\\\" package is installed with the following command:\\n\\n# yum list installed ypserv\\n\\nIf the \\\"ypserv\\\" package is installed, this is a finding.\"]\n[4775,\"If an HBSS or HIPS is active on the system, this is Not Applicable.\\n\\nVerify the operating system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.\\n\\nGet a list of authorized users (other than System Administrator and guest accounts) for the system.\\n\\nCheck the list against the system by using the following command:\\n\\n# semanage login -l | more\\nLogin Name SELinux User MLS/MCS Range Service\\n__default__ user_u s0-s0:c0.c1023 *\\nroot unconfined_u s0-s0:c0.c1023 *\\nsystem_u system_u s0-s0:c0.c1023 *\\njoe staff_u s0-s0:c0.c1023 *\\n\\nAll administrators must be mapped to the \\\"sysadm_u\\\" or \\\"staff_u\\\" users role.\\n\\nAll authorized non-administrative users must be mapped to the \\\"user_u\\\" role.\\n\\nIf they are not mapped in this way, this is a finding.\"]\n[4776,\"Verify the operating system routinely checks the baseline configuration for unauthorized changes.\\n\\nNote: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed at least once per week.\\n\\nCheck to see if AIDE is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the SA how file integrity checks are performed on the system.\\n\\nCheck for the presence of a cron job running daily or weekly on the system that executes AIDE daily to scan for changes to the system baseline. The command used in the example will use a daily occurrence.\\n\\nCheck the cron directories for a script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:\\n\\n# ls -al /etc/cron.* | grep aide\\n-rwxr-xr-x 1 root root 29 Nov 22 2015 aide\\n\\n# grep aide /etc/crontab /var/spool/cron/root\\n/etc/crontab: 30 04 * * * /root/aide\\n/var/spool/cron/root: 30 04 * * * /root/aide\\n\\nIf the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, this is a finding.\"]\n[4777,\"Verify the operating system notifies designated personnel if baseline configurations are changed in an unauthorized manner.\\n\\nNote: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed and notify specified individuals via email or an alert.\\n\\nCheck to see if AIDE is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the SA how file integrity checks are performed on the system. \\n\\nCheck for the presence of a cron job running routinely on the system that executes AIDE to scan for changes to the system baseline. The commands used in the example will use a daily occurrence.\\n\\nCheck the cron directories for a \\\"crontab\\\" script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:\\n\\n# ls -al /etc/cron.* | grep aide\\n-rwxr-xr-x 1 root root 32 Jul 1 2011 aide\\n\\n# grep aide /etc/crontab /var/spool/cron/root\\n/etc/crontab: 30 04 * * * /root/aide\\n/var/spool/cron/root: 30 04 * * * /root/aide\\n\\nAIDE does not have a configuration that will send a notification, so the cron job uses the mail application on the system to email the results of the file integrity run as in the following example:\\n\\n# more /etc/cron.daily/aide\\n#!/bin/bash\\n\\n/usr/sbin/aide --check | /bin/mail -s \\\"$HOSTNAME - Daily aide integrity check run\\\" root@sysname.mil\\n\\nIf the file integrity application does not notify designated personnel of changes, this is a finding.\"]\n[4778,\"Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components from a repository without verification that they have been digitally signed using a certificate that is recognized and approved by the organization.\\n\\nCheck that yum verifies the signature of packages from a repository prior to install with the following command:\\n\\n# grep gpgcheck /etc/yum.conf\\ngpgcheck=1\\n\\nIf \\\"gpgcheck\\\" is not set to \\\"1\\\", or if options are missing or commented out, ask the System Administrator how the certificates for patches and other operating system components are verified. \\n\\nIf there is no process to validate certificates that is approved by the organization, this is a finding.\"]\n[4779,\"Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components of local packages without verification that they have been digitally signed using a certificate that is recognized and approved by the organization.\\n\\nCheck that yum verifies the signature of local packages prior to install with the following command:\\n\\n# grep localpkg_gpgcheck /etc/yum.conf\\nlocalpkg_gpgcheck=1\\n\\nIf \\\"localpkg_gpgcheck\\\" is not set to \\\"1\\\", or if options are missing or commented out, ask the System Administrator how the signatures of local packages and other operating system components are verified. \\n\\nIf there is no process to validate the signatures of local packages that is approved by the organization, this is a finding.\"]\n[4780,\"If there is an HBSS with a Device Control Module and a Data Loss Prevention mechanism, this requirement is not applicable.\\n\\nVerify the operating system disables the ability to load the USB Storage kernel module.\\n\\n# grep -r usb-storage /etc/modprobe.d/* | grep -i \\\"/bin/true\\\" | grep -v \\\"^#\\\"\\n\\ninstall usb-storage /bin/true\\n\\nIf the command does not return any output, or the line is commented out, and use of USB Storage is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\\n\\nVerify the operating system disables the ability to use USB mass storage devices.\\n\\nCheck to see if USB mass storage is disabled with the following command:\\n\\n# grep usb-storage /etc/modprobe.d/* | grep -i \\\"blacklist\\\" | grep -v \\\"^#\\\"\\nblacklist usb-storage\\n\\nIf the command does not return any output or the output is not \\\"blacklist usb-storage\\\", and use of USB storage devices is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[4781,\"Verify the operating system disables the ability to load the DCCP kernel module.\\n\\n# grep -r dccp /etc/modprobe.d/* | grep -i \\\"/bin/true\\\" | grep -v \\\"^#\\\"\\n\\ninstall dccp /bin/true\\n\\nIf the command does not return any output, or the line is commented out, and use of DCCP is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\\n\\nVerify the operating system disables the ability to use the DCCP kernel module.\\n\\nCheck to see if the DCCP kernel module is disabled with the following command:\\n\\n# grep -i dccp /etc/modprobe.d/* | grep -i \\\"blacklist\\\" | grep -v \\\"^#\\\"\\n\\nblacklist dccp\\n\\nIf the command does not return any output or the output is not \\\"blacklist dccp\\\", and use of the dccp kernel module is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[4782,\"Verify the operating system disables the ability to automount devices.\\n\\nCheck to see if automounter service is active with the following command:\\n\\n# systemctl status autofs\\nautofs.service - Automounts filesystems on demand\\n   Loaded: loaded (/usr/lib/systemd/system/autofs.service; disabled)\\n   Active: inactive (dead)\\n\\nIf the \\\"autofs\\\" status is set to \\\"active\\\" and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[4783,\"Verify the operating system removes all software components after updated versions have been installed.\\n\\nCheck if yum is configured to remove unneeded packages with the following command:\\n\\n# grep -i clean_requirements_on_remove /etc/yum.conf\\nclean_requirements_on_remove=1\\n\\nIf \\\"clean_requirements_on_remove\\\" is not set to \\\"1\\\", \\\"True\\\", or \\\"yes\\\", or is not set in \\\"/etc/yum.conf\\\", this is a finding.\"]\n[4784,\"If an HBSS or HIPS is active on the system, this is Not Applicable.\\n\\nVerify the operating system verifies correct operation of all security functions.\\n\\nCheck if \\\"SELinux\\\" is active and in \\\"Enforcing\\\" mode with the following command:\\n\\n# getenforce\\nEnforcing\\n\\nIf \\\"SELinux\\\" is not active and not in \\\"Enforcing\\\" mode, this is a finding.\"]\n[4785,\"If an HBSS or HIPS is active on the system, this is Not Applicable.\\n\\nVerify the operating system verifies correct operation of all security functions.\\n\\nCheck if \\\"SELinux\\\" is active and is enforcing the targeted policy with the following command:\\n\\n# sestatus\\n\\nSELinux status: enabled\\n\\nSELinuxfs mount: /selinux\\n\\nSELinux root directory: /etc/selinux\\n\\nLoaded policy name: targeted\\n\\nCurrent mode: enforcing\\n\\nMode from config file: enforcing\\n\\nPolicy MLS status: enabled\\n\\nPolicy deny_unknown status: allowed\\n\\nMax kernel policy version: 28\\n\\nIf the \\\"Loaded policy name\\\" is not set to \\\"targeted\\\", this is a finding.\\n\\nVerify that the /etc/selinux/config file is configured to the \\\"SELINUXTYPE\\\" to \\\"targeted\\\":\\n\\n# grep -i \\\"selinuxtype\\\" /etc/selinux/config | grep -v '^#'\\n\\nSELINUXTYPE = targeted\\n\\nIf no results are returned or \\\"SELINUXTYPE\\\" is not set to \\\"targeted\\\", this is a finding.\"]\n[4786,\"Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed.\\n\\nCheck that the ctrl-alt-del.target is masked and not active with the following command:\\n\\n# systemctl status ctrl-alt-del.target\\n\\nctrl-alt-del.target\\nLoaded: masked (/dev/null; bad)\\nActive: inactive (dead)\\n\\nIf the ctrl-alt-del.target is not masked, this is a finding.\\n\\nIf the ctrl-alt-del.target is active, this is a finding.\"]\n[4787,\"Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed.\\n\\nCheck that the ctrl-alt-del.target is masked and not active in the GUI with the following command:\\n\\n# grep logout /etc/dconf/local.d/*\\n\\nlogout=''\\n\\nIf \\\"logout\\\" is not set to use two single quotations, or is missing, this is a finding.\"]\n[4788,\"Verify the operating system defines default permissions for all authenticated users in such a way that the user can only read and modify their own files.\\n\\nCheck for the value of the \\\"UMASK\\\" parameter in \\\"/etc/login.defs\\\" file with the following command:\\n\\nNote: If the value of the \\\"UMASK\\\" parameter is set to \\\"000\\\" in \\\"/etc/login.defs\\\" file, the Severity is raised to a CAT I.\\n\\n# grep -i umask /etc/login.defs\\nUMASK  077\\n\\nIf the value for the \\\"UMASK\\\" parameter is not \\\"077\\\", or the \\\"UMASK\\\" parameter is missing or is commented out, this is a finding.\"]\n[4789,\"Verify the version of the operating system is vendor supported.\\n\\nCheck the version of the operating system with the following command:\\n\\n# cat /etc/redhat-release\\n\\nRed Hat Enterprise Linux Server release 7.4 (Maipo)\\n\\nCurrent End of Life for RHEL 7.1 is 31 March 2017.\\n\\nCurrent End of Life for RHEL 7.2 is 30 November 2017.\\n\\nCurrent End of Life for RHEL 7.3 is 30 November 2018.\\n\\nCurrent End of Life for RHEL 7.4 is 31 August 2019.\\n\\nCurrent End of Life for RHEL 7.5 is 30 April 2020.\\n\\nCurrent End of Life for RHEL 7.6 is 31 October 2020.\\n\\nCurrent End of Life for RHEL 7.7 is 30 August 2021.\\n\\nIf the release is not supported by the vendor, this is a finding.\"]\n[4790,\"Verify the operating system security patches and updates are installed and up to date. Updates are required to be applied with a frequency determined by the site or Program Management Office (PMO). \\n\\nObtain the list of available package security updates from Red Hat. The URL for updates is https://rhn.redhat.com/errata/. It is important to note that updates provided by Red Hat may not be present on the system if the underlying packages are not installed.\\n\\nCheck that the available package security updates have been installed on the system with the following command:\\n\\n# yum history list | more\\nLoaded plugins: langpacks, product-id, subscription-manager\\nID     | Command line             | Date and time    | Action(s)      | Altered\\n-------------------------------------------------------------------------------\\n    70 | install aide             | 2016-05-05 10:58 | Install       |     1   \\n    69 | update -y                | 2016-05-04 14:34 | Update     |   18 EE\\n    68 | install vlc                | 2016-04-21 17:12 | Install        |   21   \\n    67 | update -y                | 2016-04-21 17:04 | Update     |     7 EE\\n    66 | update -y                | 2016-04-15 16:47 | E, I, U         |   84 EE\\n\\nIf package updates have not been performed on the system within the timeframe that the site/program documentation requires, this is a finding. \\n\\nTypical update frequency may be overridden by Information Assurance Vulnerability Alert (IAVA) notifications from CYBERCOM.\\n\\nIf the operating system is in non-compliance with the Information Assurance Vulnerability Management (IAVM) process, this is a finding.\"]\n[4791,\"Verify all accounts on the system are assigned to an active system, application, or user account.\\n\\nObtain the list of authorized system accounts from the Information System Security Officer (ISSO).\\n\\nCheck the system accounts on the system with the following command:\\n\\n# more /etc/passwd\\nroot:x:0:0:root:/root:/bin/bash\\nbin:x:1:1:bin:/bin:/sbin/nologin\\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\\nsync:x:5:0:sync:/sbin:/bin/sync\\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown\\nhalt:x:7:0:halt:/sbin:/sbin/halt\\ngames:x:12:100:games:/usr/games:/sbin/nologin\\ngopher:x:13:30:gopher:/var/gopher:/sbin/nologin\\n\\nAccounts such as \\\"games\\\" and \\\"gopher\\\" are not authorized accounts as they do not support authorized system functions. \\n\\nIf the accounts on the system do not match the provided documentation, or accounts that do not support an authorized system function are present, this is a finding.\"]\n[4792,\"Verify all GIDs referenced in the \\\"/etc/passwd\\\" file are defined in the \\\"/etc/group\\\" file.\\n\\nCheck that all referenced GIDs exist with the following command:\\n\\n# pwck -r\\n\\nIf GIDs referenced in \\\"/etc/passwd\\\" file are returned as not defined in \\\"/etc/group\\\" file, this is a finding.\"]\n[4793,\"Check the system for duplicate UID \\\"0\\\" assignments with the following command:\\n\\n# awk -F: '$3 == 0 {print $1}' /etc/passwd\\n\\nIf any accounts other than root have a UID of \\\"0\\\", this is a finding.\"]\n[4794,\"Verify all files and directories on the system have a valid owner.\\n\\nCheck the owner of all files and directories with the following command:\\n\\nNote: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\\n\\n# find / -fstype xfs -nouser\\n\\nIf any files on the system do not have an assigned owner, this is a finding.\"]\n[4795,\"Verify all files and directories on the system have a valid group.\\n\\nCheck the owner of all files and directories with the following command:\\n\\nNote: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\\n\\n# find / -fstype xfs -nogroup\\n\\nIf any files on the system do not have an assigned group, this is a finding.\"]\n[4796,\"Verify local interactive users on the system have a home directory assigned.\\n\\nCheck for missing local interactive user home directories with the following command:\\n\\n# pwck -r\\nuser 'lp': directory '/var/spool/lpd' does not exist\\nuser 'news': directory '/var/spool/news' does not exist\\nuser 'uucp': directory '/var/spool/uucp' does not exist\\nuser 'smithj': directory '/home/smithj' does not exist\\n\\nAsk the System Administrator (SA) if any users found without home directories are local interactive users. If the SA is unable to provide a response, check for users with a User Identifier (UID) of 1000 or greater with the following command:\\n\\n# cut -d: -f 1,3 /etc/passwd | egrep \\\":[1-4][0-9]{2}$|:[0-9]{1,2}$\\\"\\n\\nIf any interactive users do not have a home directory assigned, this is a finding.\"]\n[4797,\"Verify all local interactive users on the system are assigned a home directory upon creation.\\n\\nCheck to see if the system is configured to create home directories for local interactive users with the following command:\\n\\n# grep -i create_home /etc/login.defs\\nCREATE_HOME yes\\n\\nIf the value for \\\"CREATE_HOME\\\" parameter is not set to \\\"yes\\\", the line is missing, or the line is commented out, this is a finding.\"]\n[4798,\"Verify the assigned home directory of all local interactive users on the system exists.\\n\\nCheck the home directory assignment for all local interactive non-privileged users on the system with the following command:\\n\\n# cut -d: -f 1,3,6 /etc/passwd | egrep \\\":[1-4][0-9]{3}\\\"\\n\\nsmithj:1001:/home/smithj\\n\\nNote: This may miss interactive users that have been assigned a privileged UID. Evidence of interactive use may be obtained from a number of log files containing system logon information.\\n\\nCheck that all referenced home directories exist with the following command:\\n\\n# pwck -r\\nuser 'smithj': directory '/home/smithj' does not exist\\n\\nIf any home directories referenced in \\\"/etc/passwd\\\" are returned as not defined, this is a finding.\"]\n[4799,\"Verify the assigned home directory of all local interactive users has a mode of \\\"0750\\\" or less permissive.\\n\\nCheck the home directory assignment for all non-privileged users on the system with the following command:\\n\\nNote: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information.\\n\\n# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6)\\n-rwxr-x--- 1 smithj users  18 Mar  5 17:06 /home/smithj\\n\\nIf home directories referenced in \\\"/etc/passwd\\\" do not have a mode of \\\"0750\\\" or less permissive, this is a finding.\"]\n[4800,\"Verify the assigned home directory of all local interactive users on the system exists.\\n\\nCheck the home directory assignment for all local interactive users on the system with the following command:\\n\\n# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6)\\n\\n-rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj\\n\\nIf any home directories referenced in \\\"/etc/passwd\\\" are not owned by the interactive user, this is a finding.\"]\n[4801,\"Verify the assigned home directory of all local interactive users is group-owned by that user's primary GID.\\n\\nCheck the home directory assignment for all local interactive users on the system with the following command:\\n\\n# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6)\\n\\n-rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj\\n\\nCheck the user's primary group with the following command:\\n\\n# grep users /etc/group\\n\\nusers:x:250:smithj,jonesj,jacksons\\n\\nIf the user home directory referenced in \\\"/etc/passwd\\\" is not group-owned by that user's primary GID, this is a finding.\"]\n[4802,\"Verify all files and directories in a local interactive user's home directory are owned by the user.\\n\\nCheck the owner of all files and directories in a local interactive user's home directory with the following command:\\n\\nNote: The example will be for the user \\\"smithj\\\", who has a home directory of \\\"/home/smithj\\\".\\n\\n# ls -lLR /home/smithj\\n-rw-r--r-- 1 smithj smithj  18 Mar  5 17:06 file1\\n-rw-r--r-- 1 smithj smithj 193 Mar  5 17:06 file2\\n-rw-r--r-- 1 smithj smithj 231 Mar  5 17:06 file3\\n\\nIf any files are found with an owner different than the home directory user, this is a finding.\"]\n[4803,\"Verify all files and directories in a local interactive user home directory are group-owned by a group the user is a member of.\\n\\nCheck the group owner of all files and directories in a local interactive user's home directory with the following command:\\n\\nNote: The example will be for the user \\\"smithj\\\", who has a home directory of \\\"/home/smithj\\\".\\n\\n# ls -lLR /<home directory>/<users home directory>/\\n-rw-r--r-- 1 smithj smithj  18 Mar  5 17:06 file1\\n-rw-r--r-- 1 smithj smithj 193 Mar  5 17:06 file2\\n-rw-r--r-- 1 smithj sa        231 Mar  5 17:06 file3\\n\\nIf any files are found with an owner different than the group home directory user, check to see if the user is a member of that group with the following command:\\n\\n# grep smithj /etc/group\\nsa:x:100:juan,shelley,bob,smithj \\nsmithj:x:521:smithj\\n\\nIf the user is not a member of a group that group owns file(s) in a local interactive user's home directory, this is a finding.\"]\n[4804,\"Verify all files and directories contained in a local interactive user home directory, excluding local initialization files, have a mode of \\\"0750\\\".\\n\\nCheck the mode of all non-initialization files in a local interactive user home directory with the following command:\\n\\nFiles that begin with a \\\".\\\" are excluded from this requirement.\\n\\nNote: The example will be for the user \\\"smithj\\\", who has a home directory of \\\"/home/smithj\\\".\\n\\n# ls -lLR /home/smithj\\n-rwxr-x--- 1 smithj smithj  18 Mar  5 17:06 file1\\n-rwxr----- 1 smithj smithj 193 Mar  5 17:06 file2\\n-rw-r-x--- 1 smithj smithj 231 Mar  5 17:06 file3\\n\\nIf any files are found with a mode more permissive than \\\"0750\\\", this is a finding.\"]\n[4805,\"Verify the local initialization files of all local interactive users are group-owned by that user's primary Group Identifier (GID).\\n\\nCheck the home directory assignment for all non-privileged users on the system with the following command:\\n\\nNote: The example will be for the smithj user, who has a home directory of \\\"/home/smithj\\\" and a primary group of \\\"users\\\".\\n\\n# cut -d: -f 1,4,6 /etc/passwd | egrep \\\":[1-4][0-9]{3}\\\"\\nsmithj:1000:/home/smithj\\n\\n# grep 1000 /etc/group\\nusers:x:1000:smithj,jonesj,jacksons \\n\\nNote: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information.\\n\\nCheck the group owner of all local interactive user's initialization files with the following command:\\n\\n# ls -al /home/smithj/.[^.]* | more\\n\\n-rwxr-xr-x 1 smithj users 896 Mar 10 2011 .profile\\n-rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login\\n-rwxr-xr-x 1 smithj users 886 Jan 6 2007 .something\\n\\nIf all local interactive user's initialization files are not group-owned by that user's primary GID, this is a finding.\"]\n[4806,\"Verify that all local initialization files have a mode of \\\"0740\\\" or less permissive.\\n\\nCheck the mode on all local initialization files with the following command:\\n\\nNote: The example will be for the \\\"smithj\\\" user, who has a home directory of \\\"/home/smithj\\\".\\n\\n# ls -al /home/smithj/.[^.]* | more\\n\\n-rwxr----- 1 smithj users 896 Mar 10 2011 .profile\\n-rwxr----- 1 smithj users 497 Jan 6 2007 .login\\n-rwxr----- 1 smithj users 886 Jan 6 2007 .something\\n\\nIf any local initialization files have a mode more permissive than \\\"0740\\\", this is a finding.\"]\n[4807,\"Verify that all local interactive user initialization files' executable search path statements do not contain statements that will reference a working directory other than the users' home directory.\\n\\nCheck the executable search path statement for all local interactive user initialization files in the users' home directory with the following commands:\\n\\nNote: The example will be for the smithj user, which has a home directory of \\\"/home/smithj\\\".\\n\\n# grep -i path /home/smithj/.*\\n/home/smithj/.bash_profile:PATH=$PATH:$HOME/.local/bin:$HOME/bin\\n/home/smithj/.bash_profile:export PATH\\n\\nIf any local interactive user initialization files have executable search path statements that include directories outside of their home directory, this is a finding.\"]\n[4808,\"Verify that local initialization files do not execute world-writable programs.\\n\\nCheck the system for world-writable files with the following command:\\n\\n# find / -xdev -perm -002 -type f -exec ls -ld {} \\\\; | more\\n\\nFor all files listed, check for their presence in the local initialization files with the following commands:\\n\\nNote: The example will be for a system that is configured to create users' home directories in the \\\"/home\\\" directory.\\n\\n# grep <file> /home/*/.*\\n\\nIf any local initialization files are found to reference world-writable files, this is a finding.\"]\n[4809,\"Verify that all system device files are correctly labeled to prevent unauthorized modification.\\n\\nList all device files on the system that are incorrectly labeled with the following commands:\\n\\nNote: Device files are normally found under \\\"/dev\\\", but applications may place device files in other directories and may necessitate a search of the entire system.\\n\\n#find /dev -context *:device_t:* \\\\( -type c -o -type b \\\\) -printf \\\"%p %Z\\\\n\\\"\\n\\n#find /dev -context *:unlabeled_t:* \\\\( -type c -o -type b \\\\) -printf \\\"%p %Z\\\\n\\\"\\n\\nNote: There are device files, such as \\\"/dev/vmci\\\", that are used when the operating system is a host virtual machine. They will not be owned by a user on the system and require the \\\"device_t\\\" label to operate. These device files are not a finding.\\n\\nIf there is output from either of these commands, other than already noted, this is a finding.\"]\n[4810,\"Verify file systems that contain user home directories are mounted with the \\\"nosuid\\\" option.\\n\\nFind the file system(s) that contain the user home directories with the following command:\\n\\nNote: If a separate file system has not been created for the user home directories (user home directories are mounted under \\\"/\\\"), this is not a finding as the \\\"nosuid\\\" option cannot be used on the \\\"/\\\" system.\\n\\n# cut -d: -f 1,3,6 /etc/passwd | egrep \\\":[1-4][0-9]{3}\\\"\\nsmithj:1001:/home/smithj\\nthomasr:1002:/home/thomasr\\n\\nCheck the file systems that are mounted at boot time with the following command:\\n\\n# more /etc/fstab\\n\\nUUID=a411dc99-f2a1-4c87-9e05-184977be8539 /home   ext4   rw,relatime,discard,data=ordered,nosuid 0 2\\n                                                            \\nIf a file system found in \\\"/etc/fstab\\\" refers to the user home directory file system and it does not have the \\\"nosuid\\\" option set, this is a finding.\"]\n[4811,\"Verify file systems that are used for removable media are mounted with the \\\"nosuid\\\" option.\\n\\nCheck the file systems that are mounted at boot time with the following command:\\n\\n# more /etc/fstab\\n\\nUUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat noauto,owner,ro,nosuid 0 0\\n\\nIf a file system found in \\\"/etc/fstab\\\" refers to removable media and it does not have the \\\"nosuid\\\" option set, this is a finding.\"]\n[4812,\"Verify file systems that are being NFS imported are configured with the \\\"nosuid\\\" option.\\n\\nFind the file system(s) that contain the directories being exported with the following command:\\n\\n# more /etc/fstab | grep nfs\\n\\nUUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d /store nfs rw,nosuid 0 0\\n\\nIf a file system found in \\\"/etc/fstab\\\" refers to NFS and it does not have the \\\"nosuid\\\" option set, this is a finding.\\n\\nVerify the NFS is mounted with the \\\"nosuid\\\" option:\\n\\n# mount | grep nfs | grep nosuid\\nIf no results are returned, this is a finding.\"]\n[4813,\"Verify file systems that are being NFS imported are configured with the \\\"noexec\\\" option.\\n\\nFind the file system(s) that contain the directories being imported with the following command:\\n\\n# more /etc/fstab | grep nfs\\n\\nUUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d /store nfs rw,noexec 0 0\\n\\nIf a file system found in \\\"/etc/fstab\\\" refers to NFS and it does not have the \\\"noexec\\\" option set, and use of NFS imported binaries is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\\n\\nVerify the NFS is mounted with the \\\"noexec\\\"option:\\n\\n# mount | grep nfs | grep noexec\\nIf no results are returned and use of NFS imported binaries is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[4814,\"Verify that the \\\"nodev\\\" option is configured for /dev/shm:\\n\\n\\n# cat /etc/fstab | grep /dev/shm\\ntmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0\\n\\nIf any results are returned and the \\\"nodev\\\" option is not listed, this is a finding.\\n\\nVerify \\\"/dev/shm\\\" is mounted with the \\\"nodev\\\" option:\\n\\n# mount | grep \\\"/dev/shm\\\" | grep nodev\\n\\nIf no results are returned, this is a finding.\"]\n[4815,\"Verify that the \\\"nosuid\\\" option is configured for /dev/shm:\\n\\n# cat /etc/fstab | grep /dev/shm\\n\\ntmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0\\n\\nIf any results are returned and the \\\"nosuid\\\" option is not listed, this is a finding.\\n\\nVerify \\\"/dev/shm\\\" is mounted with the \\\"nosuid\\\" option:\\n\\n# mount | grep \\\"/dev/shm\\\" | grep nosuid\\n\\nIf no results are returned, this is a finding.\"]\n[4816,\"Verify that the \\\"noexec\\\" option is configured for /dev/shm:\\n\\n# cat /etc/fstab | grep /dev/shm\\n\\ntmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0\\n\\nIf any results are returned and the \\\"noexec\\\" option is not listed, this is a finding.\\n\\nVerify \\\"/dev/shm\\\" is mounted with the \\\"noexec\\\" option:\\n\\n# mount | grep \\\"/dev/shm\\\" | grep noexec\\n\\nIf no results are returned, this is a finding.\"]\n[4817,\"Verify all world-writable directories are group-owned by root, sys, bin, or an application group.\\n\\nCheck the system for world-writable directories with the following command:\\n\\nNote: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\\n\\n# find / -xdev -perm -002 -type d -fstype xfs -exec ls -lLd {} \\\\;\\ndrwxrwxrwt 2 root root 40 Aug 26 13:07 /dev/mqueue\\ndrwxrwxrwt 2 root root 220 Aug 26 13:23 /dev/shm\\ndrwxrwxrwt 14 root root 4096 Aug 26 13:29 /tmp\\n\\nIf any world-writable directories are not owned by root, sys, bin, or an application group associated with the directory, this is a finding.\"]\n[4818,\"Verify that the default umask for all local interactive users is \\\"077\\\".\\n\\nIdentify the locations of all local interactive user home directories by looking at the \\\"/etc/passwd\\\" file.\\n\\nCheck all local interactive user initialization files for interactive users with the following command:\\n\\nNote: The example is for a system that is configured to create users home directories in the \\\"/home\\\" directory.\\n\\n# grep -i umask /home/*/.*\\n\\nIf any local interactive user initialization files are found to have a umask statement that has a value less restrictive than \\\"077\\\", this is a finding.\"]\n[4819,\"Verify that \\\"rsyslog\\\" is configured to log cron events.\\n\\nCheck the configuration of \\\"/etc/rsyslog.conf\\\" or \\\"/etc/rsyslog.d/*.conf\\\" files for the cron facility with the following command:\\n\\nNote: If another logging package is used, substitute the utility configuration file for \\\"/etc/rsyslog.conf\\\" or \\\"/etc/rsyslog.d/*.conf\\\" files.\\n\\n# grep cron /etc/rsyslog.conf  /etc/rsyslog.d/*.conf\\ncron.* /var/log/cron.log\\n\\nIf the command does not return a response, check for cron logging all facilities by inspecting the \\\"/etc/rsyslog.conf\\\" or \\\"/etc/rsyslog.d/*.conf\\\" files.\\n\\nLook for the following entry:\\n\\n*.* /var/log/messages\\n\\nIf \\\"rsyslog\\\" is not logging messages for the cron facility or all facilities, this is a finding.\"]\n[4820,\"Verify that the \\\"cron.allow\\\" file is owned by root.\\n\\nCheck the owner of the \\\"cron.allow\\\" file with the following command:\\n\\n# ls -al /etc/cron.allow\\n-rw------- 1 root root 6 Mar  5  2011 /etc/cron.allow\\n\\nIf the \\\"cron.allow\\\" file exists and has an owner other than root, this is a finding.\"]\n[4821,\"Verify that the \\\"cron.allow\\\" file is group-owned by root.\\n\\nCheck the group owner of the \\\"cron.allow\\\" file with the following command:\\n\\n# ls -al /etc/cron.allow\\n-rw------- 1 root root 6 Mar  5  2011 /etc/cron.allow\\n\\nIf the \\\"cron.allow\\\" file exists and has a group owner other than root, this is a finding.\"]\n[4822,\"Verify that kernel core dumps are disabled unless needed.\\n\\nCheck the status of the \\\"kdump\\\" service with the following command:\\n\\n# systemctl status kdump.service\\nkdump.service - Crash recovery kernel arming\\n   Loaded: loaded (/usr/lib/systemd/system/kdump.service; enabled)\\n   Active: active (exited) since Wed 2015-08-26 13:08:09 EDT; 43min ago\\n Main PID: 1130 (code=exited, status=0/SUCCESS)\\nkernel arming.\\n\\nIf the \\\"kdump\\\" service is active, ask the System Administrator if the use of the service is required and documented with the Information System Security Officer (ISSO).\\n\\nIf the service is active and is not documented, this is a finding.\"]\n[4823,\"Verify that a separate file system/partition has been created for non-privileged local interactive user home directories.\\n\\nCheck the home directory assignment for all non-privileged users (those with a UID greater than 1000) on the system with the following command:\\n\\n#cut -d: -f 1,3,6,7 /etc/passwd | egrep \\\":[1-4][0-9]{3}\\\" | tr \\\":\\\" \\\"\\\\t\\\"\\n\\nadamsj /home/adamsj /bin/bash\\njacksonm /home/jacksonm /bin/bash\\nsmithj /home/smithj /bin/bash\\n\\nThe output of the command will give the directory/partition that contains the home directories for the non-privileged users on the system (in this example, /home) and users' shell. All accounts with a valid shell (such as /bin/bash) are considered interactive users.\\n\\nCheck that a file system/partition has been created for the non-privileged interactive users with the following command:\\n\\nNote: The partition of /home is used in the example.\\n\\n# grep /home /etc/fstab\\nUUID=333ada18    /home                   ext4    noatime,nobarrier,nodev  1 2\\n\\nIf a separate entry for the file system/partition that contains the non-privileged interactive users' home directories does not exist, this is a finding.\"]\n[4824,\"Verify that a separate file system/partition has been created for \\\"/var\\\".\\n\\nCheck that a file system/partition has been created for \\\"/var\\\" with the following command:\\n\\n# grep /var /etc/fstab\\nUUID=c274f65f    /var                    ext4    noatime,nobarrier        1 2\\n\\nIf a separate entry for \\\"/var\\\" is not in use, this is a finding.\"]\n[4825,\"Determine if the operating system is configured to have the \\\"/var/log/audit\\\" path is on a separate file system.\\n\\n# grep /var/log/audit /etc/fstab\\n\\nIf no result is returned, or the operating system is not configured to have \\\"/var/log/audit\\\" on a separate file system, this is a finding.\\n\\nVerify that \\\"/var/log/audit\\\" is mounted on a separate file system:\\n\\n# mount | grep \\\"/var/log/audit\\\"\\n\\nIf no result is returned, or \\\"/var/log/audit\\\" is not on a separate file system, this is a finding.\"]\n[4826,\"Verify that a separate file system/partition has been created for \\\"/tmp\\\".\\n\\nCheck that a file system/partition has been created for \\\"/tmp\\\" with the following command:\\n\\n# systemctl is-enabled tmp.mount\\nenabled\\n\\nIf the \\\"tmp.mount\\\" service is not enabled, check to see if \\\"/tmp\\\" is defined in the fstab with a device and mount point:\\n\\n# grep -i /tmp /etc/fstab\\nUUID=a411dc99-f2a1-4c87-9e05-184977be8539 /tmp   ext4   rw,relatime,discard,data=ordered,nosuid,noexec, 0 0\\n\\nIf \\\"tmp.mount\\\" service is not enabled and the \\\"/tmp\\\" directory is not defined in the fstab with a device and mount point, this is a finding.\"]\n[4827,\"Verify the operating system implements DoD-approved encryption to protect the confidentiality of remote access sessions.\\n\\nCheck to see if the \\\"dracut-fips\\\" package is installed with the following command:\\n\\n# yum list installed dracut-fips\\n\\ndracut-fips-033-360.el7_2.x86_64.rpm\\n\\nIf a \\\"dracut-fips\\\" package is installed, check to see if the kernel command line is configured to use FIPS mode with the following command:\\n\\nNote: GRUB 2 reads its configuration from the \\\"/boot/grub2/grub.cfg\\\" file on traditional BIOS-based machines and from the \\\"/boot/efi/EFI/redhat/grub.cfg\\\" file on UEFI machines.\\n\\n# grep fips /boot/grub2/grub.cfg\\n/vmlinuz-3.8.0-0.40.el7.x86_64 root=/dev/mapper/rhel-root ro rd.md=0 rd.dm=0 rd.lvm.lv=rhel/swap crashkernel=auto rd.luks=0 vconsole.keymap=us rd.lvm.lv=rhel/root rhgb fips=1 quiet\\n\\nIf the kernel command line is configured to use FIPS mode, check to see if the system is in FIPS mode with the following command:\\n\\n# cat /proc/sys/crypto/fips_enabled \\n1\\n\\nIf a \\\"dracut-fips\\\" package is not installed, the kernel command line does not have a fips entry, or the system has a value of \\\"0\\\" for \\\"fips_enabled\\\" in \\\"/proc/sys/crypto\\\", this is a finding.\"]\n[4828,\"Verify the file integrity tool is configured to verify ACLs.\\n\\nCheck to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. \\n\\nIf there is no application installed to perform file integrity checks, this is a finding.\\n\\nNote: AIDE is highly configurable at install time. These commands assume the \\\"aide.conf\\\" file is under the \\\"/etc\\\" directory. \\n\\nUse the following command to determine if the file is in another location:\\n\\n# find / -name aide.conf\\n\\nCheck the \\\"aide.conf\\\" file to determine if the \\\"acl\\\" rule has been added to the rule list being applied to the files and directories selection lists.\\n\\nAn example rule that includes the \\\"acl\\\" rule is below:\\n\\nAll= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\\n/bin All # apply the custom rule to the files in bin \\n/sbin All # apply the same custom rule to the files in sbin \\n\\nIf the \\\"acl\\\" rule is not being used on all uncommented selection lines in the \\\"/etc/aide.conf\\\" file, or ACLs are not being checked by another file integrity tool, this is a finding.\"]\n[4829,\"Verify the file integrity tool is configured to verify extended attributes.\\n\\nCheck to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system.\\n\\nIf there is no application installed to perform file integrity checks, this is a finding.\\n\\nNote: AIDE is highly configurable at install time. These commands assume the \\\"aide.conf\\\" file is under the \\\"/etc\\\" directory.\\n\\nUse the following command to determine if the file is in another location:\\n\\n# find / -name aide.conf\\n\\nCheck the \\\"aide.conf\\\" file to determine if the \\\"xattrs\\\" rule has been added to the rule list being applied to the files and directories selection lists.\\n\\nAn example rule that includes the \\\"xattrs\\\" rule follows:\\n\\nAll= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\\n/bin All # apply the custom rule to the files in bin \\n/sbin All # apply the same custom rule to the files in sbin \\n\\nIf the \\\"xattrs\\\" rule is not being used on all uncommented selection lines in the \\\"/etc/aide.conf\\\" file, or extended attributes are not being checked by another file integrity tool, this is a finding.\"]\n[4830,\"Verify the file integrity tool is configured to use FIPS 140-2 approved cryptographic hashes for validating file contents and directories.\\n\\nNote: If RHEL-07-021350 is a finding, this is automatically a finding too as the system cannot implement FIPS 140-2 approved cryptographic algorithms and hashes.\\n\\nCheck to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. \\n\\nIf there is no application installed to perform file integrity checks, this is a finding.\\n\\nNote: AIDE is highly configurable at install time. These commands assume the \\\"aide.conf\\\" file is under the \\\"/etc\\\" directory. \\n\\nUse the following command to determine if the file is in another location:\\n\\n# find / -name aide.conf\\n\\nCheck the \\\"aide.conf\\\" file to determine if the \\\"sha512\\\" rule has been added to the rule list being applied to the files and directories selection lists.\\n\\nAn example rule that includes the \\\"sha512\\\" rule follows:\\n\\nAll=p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\\n/bin All # apply the custom rule to the files in bin \\n/sbin All # apply the same custom rule to the files in sbin \\n\\nIf the \\\"sha512\\\" rule is not being used on all uncommented selection lines in the \\\"/etc/aide.conf\\\" file, or another file integrity tool is not using FIPS 140-2 approved cryptographic hashes for validating file contents and directories, this is a finding.\"]\n[4831,\"Verify the system is not configured to use a boot loader on removable media.\\n\\nNote: GRUB 2 reads its configuration from the \\\"/boot/grub2/grub.cfg\\\" file on traditional BIOS-based machines and from the \\\"/boot/efi/EFI/redhat/grub.cfg\\\" file on UEFI machines.\\n\\nCheck for the existence of alternate boot loader configuration files with the following command:\\n\\n# find / -name grub.cfg\\n/boot/grub2/grub.cfg\\n\\nIf a \\\"grub.cfg\\\" is found in any subdirectories other than \\\"/boot/grub2\\\" and \\\"/boot/efi/EFI/redhat\\\", ask the System Administrator if there is documentation signed by the ISSO to approve the use of removable media as a boot loader. \\n\\nCheck that the grub configuration file has the set root command in each menu entry with the following commands:\\n\\n# grep -c menuentry /boot/grub2/grub.cfg\\n1\\n# grep 'set root' /boot/grub2/grub.cfg\\nset root=(hd0,1)\\n\\nIf the system is using an alternate boot loader on removable media, and documentation does not exist approving the alternate configuration, this is a finding.\"]\n[4832,\"Verify the operating system is configured to disable non-essential capabilities. The most secure way of ensuring a non-essential capability is disabled is to not have the capability installed.\\n\\nThe telnet service provides an unencrypted remote access service that does not provide for the confidentiality and integrity of user passwords or the remote session.\\n\\nIf a privileged user were to log on using this service, the privileged user password could be compromised. \\n\\nCheck to see if the telnet-server package is installed with the following command:\\n\\n# yum list installed telnet-server\\n\\nIf the telnet-server package is installed, this is a finding.\"]\n[4833,\"Verify the operating system produces audit records containing information to establish when (date and time) the events occurred.\\n\\nCheck to see if auditing is active by issuing the following command:\\n\\n# systemctl is-active auditd.service\\nactive\\n\\nIf the \\\"auditd\\\" status is not active, this is a finding.\"]\n[4834,\"Confirm the audit configuration regarding how auditing processing failures are handled.\\n\\nCheck to see what level \\\"auditctl\\\" is set to with following command: \\n\\n# auditctl -s | grep -i \\\"fail\\\"\\n\\nfailure 2\\n\\nIf the value of \\\"failure\\\" is set to \\\"2\\\", the system is configured to panic (shut down) in the event of an auditing failure.\\n\\nIf the value of \\\"failure\\\" is set to \\\"1\\\", the system is configured to only send information to the kernel log regarding the failure.\\n\\nIf the \\\"failure\\\" setting is not set, this is a CAT I finding.\\n\\nIf the \\\"failure\\\" setting is set to any value other than \\\"1\\\" or \\\"2\\\", this is a CAT II finding.\\n\\nIf the \\\"failure\\\" setting is set to \\\"1\\\" but the availability concern is not documented or there is no monitoring of the kernel log, this is a CAT III finding.\"]\n[4835,\"Verify the \\\"au-remote\\\" plugin is active on the system:\\n\\n# grep \\\"active\\\" /etc/audisp/plugins.d/au-remote.conf\\n\\nactive = yes\\n\\nIf the \\\"active\\\" setting is not set to \\\"yes\\\", or the line is commented out, this is a finding.\"]\n[4836,\"Verify the \\\"au-remote\\\" plugin is configured to always off-load audit logs using the audisp-remote daemon:\\n\\n# cat /etc/audisp/plugins.d/au-remote.conf | grep -v \\\"^#\\\"\\n\\nactive = yes\\ndirection = out\\npath = /sbin/audisp-remote\\ntype = always\\nformat = string\\n\\nIf the \\\"direction\\\" setting is not set to \\\"out\\\", or the line is commented out, this is a finding.\\n\\nIf the \\\"path\\\" setting is not set to \\\"/sbin/audisp-remote\\\", or the line is commented out, this is a finding.\\n\\nIf the \\\"type\\\" setting is not set to \\\"always\\\", or the line is commented out, this is a finding.\"]\n[4837,\"Verify the audisp daemon is configured to take an appropriate action when the internal queue is full:\\n\\n# grep \\\"overflow_action\\\" /etc/audisp/audispd.conf\\n\\noverflow_action = syslog\\n\\nIf the \\\"overflow_action\\\" option is not \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\", or the line is commented out, this is a finding.\"]\n[4838,\"Verify the audisp daemon is configured to label all off-loaded audit logs:\\n\\n# grep \\\"name_format\\\" /etc/audisp/audispd.conf\\n\\nname_format = hostname\\n\\nIf the \\\"name_format\\\" option is not \\\"hostname\\\", \\\"fqd\\\", or \\\"numeric\\\", or the line is commented out, this is a finding.\"]\n[4839,\"Verify the operating system off-loads audit records onto a different system or media from the system being audited.\\n\\nTo determine the remote server that the records are being sent to, use the following command:\\n\\n# grep -i remote_server /etc/audisp/audisp-remote.conf\\nremote_server = 10.0.21.1\\n\\nIf a remote server is not configured, or the line is commented out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. \\n\\nIf there is no evidence that the audit logs are being off-loaded to another system or media, this is a finding.\"]\n[4840,\"Verify the operating system encrypts audit records off-loaded onto a different system or media from the system being audited.\\n\\nTo determine if the transfer is encrypted, use the following command:\\n\\n# grep -i enable_krb5 /etc/audisp/audisp-remote.conf\\nenable_krb5 = yes\\n\\nIf the value of the \\\"enable_krb5\\\" option is not set to \\\"yes\\\" or the line is commented out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. \\n\\nIf there is no evidence that the transfer of the audit logs being off-loaded to another system or media is encrypted, this is a finding.\"]\n[4841,\"Verify the action the operating system takes if the disk the audit records are written to becomes full.\\n\\nTo determine the action that takes place if the disk is full on the remote server, use the following command:\\n\\n# grep -i disk_full_action /etc/audisp/audisp-remote.conf\\ndisk_full_action = single\\n\\nIf the value of the \\\"disk_full_action\\\" option is not \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\", or the line is commented out, this is a finding.\"]\n[4842,\"Verify the action the operating system takes if there is an error sending audit records to a remote system.\\n\\nCheck the action that takes place if there is an error sending audit records to a remote system with the following command:\\n\\n# grep -i network_failure_action /etc/audisp/audisp-remote.conf\\nnetwork_failure_action = syslog\\n\\nIf the value of the \\\"network_failure_action\\\" option is not \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\", or the line is commented out, this is a finding.\"]\n[4843,\"Verify the operating system initiates an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\\n\\nCheck the system configuration to determine the partition the audit records are being written to with the following command:\\n\\n# grep -iw log_file /etc/audit/auditd.conf\\nlog_file = /var/log/audit/audit.log\\n\\nCheck the size of the partition that audit records are written to (with the example being \\\"/var/log/audit/\\\"):\\n\\n# df -h /var/log/audit/\\n0.9G /var/log/audit\\n\\nIf the audit records are not being written to a partition specifically created for audit records (in this example \\\"/var/log/audit\\\" is a separate partition), determine the amount of space other files in the partition are currently occupying with the following command:\\n\\n# du -sh <partition>\\n1.8G /var\\n\\nDetermine what the threshold is for the system to take action when 75 percent of the repository maximum audit record storage capacity is reached:\\n\\n# grep -iw space_left /etc/audit/auditd.conf\\nspace_left = 225 \\n\\nIf the value of the \\\"space_left\\\" keyword is not set to 25 percent of the total partition size, this is a finding.\"]\n[4844,\"Verify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\\n\\nCheck what action the operating system takes when the threshold for the repository maximum audit record storage capacity is reached with the following command:\\n\\n# grep -i space_left_action  /etc/audit/auditd.conf\\nspace_left_action = email\\n\\nIf the value of the \\\"space_left_action\\\" keyword is not set to \\\"email\\\", this is a finding.\"]\n[4845,\"Verify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the threshold for the repository maximum audit record storage capacity is reached.\\n\\nCheck what account the operating system emails when the threshold for the repository maximum audit record storage capacity is reached with the following command:\\n\\n# grep -i action_mail_acct  /etc/audit/auditd.conf\\naction_mail_acct = root\\n\\nIf the value of the \\\"action_mail_acct\\\" keyword is not set to \\\"root\\\" and other accounts for security personnel, this is a finding.\"]\n[4846,\"Verify the operating system audits the execution of privileged functions using the following command:\\n\\n# grep -iw execve /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid\\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid\\n-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid\\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid\\n\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules for \\\"SUID\\\" files are not defined, this is a finding.\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules for \\\"SGID\\\" files are not defined, this is a finding.\"]\n[4847,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chown\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw chown /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"chown\\\" syscall, this is a finding.\"]\n[4848,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fchown\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw fchown /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fchown\\\" syscall, this is a finding.\"]\n[4849,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"lchown\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw lchown /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"lchown\\\" syscall, this is a finding.\"]\n[4850,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fchownat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw fchownat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fchownat\\\" syscall, this is a finding.\"]\n[4851,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chmod\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw chmod /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"chmod\\\" syscall, this is a finding.\"]\n[4852,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fchmod\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw fchmod /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fchmod\\\" syscall, this is a finding.\"]\n[4853,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fchmodat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw fchmodat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fchmodat\\\" syscall, this is a finding.\"]\n[4854,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"setxattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw setxattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"setxattr\\\" syscall, this is a finding.\"]\n[4855,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fsetxattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw fsetxattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fsetxattr\\\" syscall, this is a finding.\"]\n[4856,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"lsetxattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw lsetxattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"lsetxattr\\\" syscall, this is a finding.\"]\n[4857,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"removexattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw removexattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"removexattr\\\" syscall, this is a finding.\"]\n[4858,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fremovexattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw fremovexattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fremovexattr\\\" syscall, this is a finding.\"]\n[4859,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"lremovexattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw lremovexattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"lremovexattr\\\" syscall, this is a finding.\"]\n[4860,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"creat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw creat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S creat F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"creat\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[4861,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"open\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw open /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"open\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[4862,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"openat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw openat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"openat\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[4863,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"open_by_handle_at\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw open_by_handle_at /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"open_by_handle_at\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[4864,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"truncate\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw truncate /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"truncate\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[4865,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"ftruncate\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw ftruncate /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"ftruncate\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[4866,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"semanage\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/sbin/semanage /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[4867,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"setsebool\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/sbin/setsebool /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[4868,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chcon\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/bin/chcon /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[4869,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"setfiles\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw /usr/sbin/setfiles /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[4870,\"Verify the operating system generates audit records when unsuccessful account access events occur. \\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following commands: \\n\\n# grep -i /var/run/faillock /etc/audit/audit.rules\\n\\n-w /var/run/faillock -p wa -k logins\\n\\nIf the command does not return any output, this is a finding.\"]\n[4871,\"Verify the operating system generates audit records when successful account access events occur. \\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands: \\n\\n# grep -i /var/log/lastlog /etc/audit/audit.rules\\n\\n-w /var/log/lastlog -p wa -k logins \\n\\nIf the command does not return any output, this is a finding.\"]\n[4872,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"passwd\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/bin/passwd /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[4873,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"unix_chkpwd\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw /usr/sbin/unix_chkpwd /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[4874,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"gpasswd\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/bin/gpasswd /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[4875,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chage\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/bin/chage /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[4876,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"userhelper\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/sbin/userhelper /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[4877,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"su\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/bin/su /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[4878,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"sudo\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/bin/sudo /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[4879,\"Verify the operating system generates audit records when successful/unsuccessful attempts to access the \\\"/etc/sudoers\\\" file and files in the \\\"/etc/sudoers.d/\\\" directory. \\n\\nCheck for modification of the following files being audited by performing the following commands to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -i \\\"/etc/sudoers\\\" /etc/audit/audit.rules\\n\\n-w /etc/sudoers -p wa -k privileged-actions\\n\\n# grep -i \\\"/etc/sudoers.d/\\\" /etc/audit/audit.rules\\n\\n-w /etc/sudoers.d/ -p wa -k privileged-actions\\n\\nIf the commands do not return output that match the examples, this is a finding.\"]\n[4880,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"newgrp\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -i /usr/bin/newgrp /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[4881,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chsh\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -i /usr/bin/chsh /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[4882,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"mount\\\" command and syscall occur.\\n\\nCheck that the following system call is being audited by performing the following series of commands to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw \\\"mount\\\" /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n-a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"mount\\\" syscall, this is a finding.\\n\\nIf all uses of the \\\"mount\\\" command are not being audited, this is a finding.\"]\n[4883,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"umount\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following series of commands to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw \\\"/usr/bin/umount\\\" /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=4294967295 -k privileged-mount \\n\\nIf the command does not return any output, this is a finding.\"]\n[4884,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"postdrop\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/sbin/postdrop /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=4294967295 -k privileged-postfix\\n\\nIf the command does not return any output, this is a finding.\"]\n[4885,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"postqueue\\\" command occur. \\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/sbin/postqueue /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=4294967295 -k privileged-postfix\\n\\nIf the command does not return any output, this is a finding.\"]\n[4886,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"ssh-keysign\\\" command occur. \\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/libexec/openssh/ssh-keysign /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=4294967295 -k privileged-ssh\\n\\nIf the command does not return any output, this is a finding.\"]\n[4887,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"crontab\\\" command occur. \\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/bin/crontab /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=4294967295 -k privileged-cron\\n\\nIf the command does not return any output, this is a finding.\"]\n[4888,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"pam_timestamp_check\\\" command occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw \\\"/usr/sbin/pam_timestamp_check\\\" /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F auid>=1000 -F auid!=4294967295 -k privileged-pam \\n\\nIf the command does not return any output, this is a finding.\"]\n[4889,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"create_module\\\" syscall occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw create_module /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S create_module -k module-change\\n\\n-a always,exit -F arch=b64 -S create_module -k module-change\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"create_module\\\" syscall, this is a finding.\"]\n[4890,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"init_module\\\" syscall occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw init_module /etc/audit/audit.rules \\n\\n-a always,exit -F arch=b32 -S init_module -k module-change\\n\\n-a always,exit -F arch=b64 -S init_module -k module-change\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"init_module\\\" syscall, this is a finding.\"]\n[4891,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"finit_module\\\" syscall occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw finit_module /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S finit_module -k module-change\\n\\n-a always,exit -F arch=b64 -S finit_module -k module-change\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"finit_module\\\" syscall, this is a finding.\"]\n[4892,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"delete_module\\\" syscall occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw delete_module /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S delete_module -k module-change\\n\\n-a always,exit -F arch=b64 -S delete_module -k module-change\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"delete_module\\\" syscall, this is a finding.\"]\n[4893,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"kmod\\\" command occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw kmod /etc/audit/audit.rules\\n\\n-w /usr/bin/kmod -p x -F auid!=4294967295 -k module-change\\n\\nIf the command does not return any output, this is a finding.\"]\n[4894,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/passwd\\\".\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/passwd /etc/audit/audit.rules\\n\\n-w /etc/passwd -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[4895,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/group\\\".\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/group /etc/audit/audit.rules\\n\\n-w /etc/group -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[4896,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/gshadow\\\".\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/gshadow /etc/audit/audit.rules\\n\\n-w /etc/gshadow -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[4897,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/shadow /etc/audit/audit.rules\\n\\n-w /etc/shadow -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[4898,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/security/opasswd /etc/audit/audit.rules\\n\\n-w /etc/security/opasswd -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[4899,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"rename\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw rename /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"rename\\\" syscall, this is a finding.\"]\n[4900,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"renameat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw renameat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"renameat\\\" syscall, this is a finding.\"]\n[4901,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"rmdir\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw rmdir /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"rmdir\\\" syscall, this is a finding.\"]\n[4902,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"unlink\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw unlink /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"unlink\\\" syscall, this is a finding.\"]\n[4903,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"unlinkat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw unlinkat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"unlinkat\\\" syscall, this is a finding.\"]\n[4904,\"Verify \\\"rsyslog\\\" is configured to send all messages to a log aggregation server.\\n\\nCheck the configuration of \\\"rsyslog\\\" with the following command:\\n\\nNote: If another logging package is used, substitute the utility configuration file for \\\"/etc/rsyslog.conf\\\".\\n\\n# grep @ /etc/rsyslog.conf /etc/rsyslog.d/*.conf\\n*.* @@logagg.site.mil\\n\\nIf there are no lines in the \\\"/etc/rsyslog.conf\\\" or \\\"/etc/rsyslog.d/*.conf\\\" files that contain the \\\"@\\\" or \\\"@@\\\" symbol(s), and the lines with the correct symbol(s) to send output to another system do not cover all \\\"rsyslog\\\" output, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. \\n\\nIf the lines are commented out or there is no evidence that the audit logs are being sent to another system, this is a finding.\"]\n[4905,\"Verify that the system is not accepting \\\"rsyslog\\\" messages from other systems unless it is documented as a log aggregation server.\\n\\nCheck the configuration of \\\"rsyslog\\\" with the following command:\\n\\n# grep imtcp /etc/rsyslog.conf\\n$ModLoad imtcp\\n# grep imudp /etc/rsyslog.conf\\n$ModLoad imudp\\n# grep imrelp /etc/rsyslog.conf\\n$ModLoad imrelp\\n\\nIf any of the above modules are being loaded in the \\\"/etc/rsyslog.conf\\\" file, ask to see the documentation for the system being used for log aggregation.\\n\\nIf the documentation does not exist, or does not specify the server as a log aggregation system, this is a finding.\"]\n[4906,\"Verify the operating system limits the number of concurrent sessions to \\\"10\\\" for all accounts and/or account types by issuing the following command:\\n\\n# grep \\\"maxlogins\\\" /etc/security/limits.conf /etc/security/limits.d/*.conf\\n\\n* hard maxlogins 10\\n\\nThis can be set as a global domain (with the * wildcard) but may be set differently for multiple domains.\\n\\nIf the \\\"maxlogins\\\" item is missing, commented out, or the value is not set to \\\"10\\\" or less for all domains that have the \\\"maxlogins\\\" item assigned, this is a finding.\"]\n[4907,\"Inspect the firewall configuration and running services to verify that it is configured to prohibit or restrict the use of functions, ports, protocols, and/or services that are unnecessary or prohibited.\\n\\nCheck which services are currently active with the following command:\\n\\n# firewall-cmd --list-all\\npublic (default, active)\\n  interfaces: enp0s3\\n  sources: \\n  services: dhcpv6-client dns http https ldaps rpc-bind ssh\\n  ports: \\n  masquerade: no\\n  forward-ports: \\n  icmp-blocks: \\n  rich rules: \\n\\nAsk the System Administrator for the site or program PPSM CLSA. Verify the services allowed by the firewall match the PPSM CLSA. \\n\\nIf there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols, or services that are prohibited by the PPSM Category Assurance List (CAL), this is a finding.\"]\n[4908,\"Verify the operating system uses mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.\\n\\nNote: If RHEL-07-021350 is a finding, this is automatically a finding as the system cannot implement FIPS 140-2-approved cryptographic algorithms and hashes.\\n\\nThe location of the \\\"sshd_config\\\" file may vary if a different daemon is in use.\\n\\nInspect the \\\"Ciphers\\\" configuration with the following command:\\n\\n# grep -i ciphers /etc/ssh/sshd_config\\nCiphers aes128-ctr,aes192-ctr,aes256-ctr\\n\\nIf any ciphers other than \\\"aes128-ctr\\\", \\\"aes192-ctr\\\", or \\\"aes256-ctr\\\" are listed, the \\\"Ciphers\\\" keyword is missing, or the returned line is commented out, this is a finding.\"]\n[4909,\"Verify the operating system terminates all network connections associated with a communications session at the end of the session or based on inactivity.\\n\\nCheck the value of the system inactivity timeout with the following command:\\n\\n# grep -i tmout /etc/profile.d/*\\n\\netc/profile.d/tmout.sh:TMOUT=600\\n\\n/etc/profile.d/tmout.sh:readonly TMOUT\\n\\n/etc/profile.d/tmout.sh:export TMOUT\\n\\nIf \\\"TMOUT\\\" is not set to \\\"600\\\" or less in a script located in the /etc/profile.d/ directory to enforce session termination after inactivity, this is a finding.\"]\n[4910,\"Verify any publicly accessible connection to the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\\n\\nCheck for the location of the banner file being used with the following command:\\n\\n# grep -i banner /etc/ssh/sshd_config\\n\\nbanner /etc/issue\\n\\nThis command will return the banner keyword and the name of the file that contains the ssh banner (in this case \\\"/etc/issue\\\").\\n\\nIf the line is commented out, this is a finding.\\n\\nView the file specified by the banner keyword to check that it matches the text of the Standard Mandatory DoD Notice and Consent Banner:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nIf the system does not display a graphical logon banner or the banner does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.\\n\\nIf the text in the file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.\"]\n[4911,\"If LDAP is not being utilized, this requirement is Not Applicable.\\n\\nVerify the operating system implements cryptography to protect the integrity of remote LDAP authentication sessions.\\n\\nTo determine if LDAP is being used for authentication, use the following command:\\n\\n# systemctl status sssd.service\\nsssd.service - System Security Services Daemon\\nLoaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\\nActive: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\\n\\nIf the \\\"sssd.service\\\" is \\\"active\\\", then LDAP is being used. \\n\\nDetermine the \\\"id_provider\\\" the LDAP is currently using:\\n\\n# grep -i \\\"id_provider\\\" /etc/sssd/sssd.conf\\n\\nid_provider = ad\\n\\nIf \\\"id_provider\\\" is set to \\\"ad\\\", this is Not Applicable.\\n\\nEnsure that LDAP is configured to use TLS by using the following command:\\n\\n# grep -i \\\"start_tls\\\" /etc/sssd/sssd.conf\\nldap_id_use_start_tls = true\\n\\nIf the \\\"ldap_id_use_start_tls\\\" option is not \\\"true\\\", this is a finding.\"]\n[4912,\"If LDAP is not being utilized, this requirement is Not Applicable.\\n\\nVerify the operating system implements cryptography to protect the integrity of remote LDAP access sessions.\\n\\nTo determine if LDAP is being used for authentication, use the following command:\\n\\n# systemctl status sssd.service\\nsssd.service - System Security Services Daemon\\nLoaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\\nActive: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\\n\\nIf the \\\"sssd.service\\\" is \\\"active\\\", then LDAP is being used. \\n\\nDetermine the \\\"id_provider\\\" the LDAP is currently using:\\n\\n# grep -i \\\"id_provider\\\" /etc/sssd/sssd.conf\\n\\nid_provider = ad\\n\\nIf \\\"id_provider\\\" is set to \\\"ad\\\", this is Not Applicable.\\n\\nVerify the sssd service is configured to require the use of certificates:\\n\\n# grep -i tls_reqcert /etc/sssd/sssd.conf\\nldap_tls_reqcert = demand\\n\\nIf the \\\"ldap_tls_reqcert\\\" setting is missing, commented out, or does not exist, this is a finding.\\n\\nIf the \\\"ldap_tls_reqcert\\\" setting is not set to \\\"demand\\\" or \\\"hard\\\", this is a finding.\"]\n[4913,\"If LDAP is not being utilized, this requirement is Not Applicable.\\n\\nVerify the operating system implements cryptography to protect the integrity of remote LDAP access sessions.\\n\\nTo determine if LDAP is being used for authentication, use the following command:\\n\\n# systemctl status sssd.service\\nsssd.service - System Security Services Daemon\\nLoaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\\nActive: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\\n\\nIf the \\\"sssd.service\\\" is \\\"active\\\", then LDAP is being used.\\n\\nDetermine the \\\"id_provider\\\" that the LDAP is currently using:\\n\\n# grep -i \\\"id_provider\\\" /etc/sssd/sssd.conf\\n\\nid_provider = ad\\n\\nIf \\\"id_provider\\\" is set to \\\"ad\\\", this is Not Applicable.\\n\\nCheck the path to the X.509 certificate for peer authentication with the following command:\\n\\n# grep -i tls_cacert /etc/sssd/sssd.conf\\n\\nldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt\\n\\nVerify the \\\"ldap_tls_cacert\\\" option points to a file that contains the trusted CA certificate.\\n\\nIf this file does not exist, or the option is commented out or missing, this is a finding.\"]\n[4914,\"Verify the operating system implements virtual address space randomization.\\n\\n# grep kernel.randomize_va_space /etc/sysctl.conf /etc/sysctl.d/*\\n\\nkernel.randomize_va_space = 2\\n\\nIf \\\"kernel.randomize_va_space\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \\\"2\\\", this is a finding.\\n\\nCheck that the operating system implements virtual address space randomization with the following command:\\n\\n# /sbin/sysctl -a | grep kernel.randomize_va_space \\n\\nkernel.randomize_va_space = 2\\n\\nIf \\\"kernel.randomize_va_space\\\" does not have a value of \\\"2\\\", this is a finding.\"]\n[4915,\"Check to see if sshd is installed with the following command:\\n\\n# yum list installed \\\\*ssh\\\\*\\nlibssh2.x86_64 1.4.3-8.el7 @anaconda/7.1\\nopenssh.x86_64 6.6.1p1-11.el7 @anaconda/7.1\\nopenssh-server.x86_64 6.6.1p1-11.el7 @anaconda/7.1\\n\\nIf the \\\"SSH server\\\" package is not installed, this is a finding.\"]\n[4916,\"Verify SSH is loaded and active with the following command:\\n\\n# systemctl status sshd\\nsshd.service - OpenSSH server daemon\\nLoaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)\\nActive: active (running) since Tue 2015-11-17 15:17:22 EST; 4 weeks 0 days ago\\nMain PID: 1348 (sshd)\\nCGroup: /system.slice/sshd.service\\n1053 /usr/sbin/sshd -D\\n\\nIf \\\"sshd\\\" does not show a status of \\\"active\\\" and \\\"running\\\", this is a finding.\"]\n[4917,\"Verify the operating system automatically terminates a user session after inactivity time-outs have expired.\\n\\nCheck for the value of the \\\"ClientAliveInterval\\\" keyword with the following command:\\n\\n# grep -iw clientaliveinterval /etc/ssh/sshd_config\\n\\nClientAliveInterval 600\\n\\nIf \\\"ClientAliveInterval\\\" is not configured, commented out, or has a value of \\\"0\\\", this is a finding.\\n\\nIf \\\"ClientAliveInterval\\\" has a value that is greater than \\\"600\\\" and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[4918,\"Check the version of the operating system with the following command:\\n\\n# cat /etc/redhat-release\\n\\nIf the release is 7.4 or newer this requirement is Not Applicable.\\n\\nVerify the SSH daemon does not allow authentication using RSA rhosts authentication.\\n\\nTo determine how the SSH daemon's \\\"RhostsRSAAuthentication\\\" option is set, run the following command:\\n\\n# grep RhostsRSAAuthentication /etc/ssh/sshd_config\\nRhostsRSAAuthentication no\\n\\nIf the value is returned as \\\"yes\\\", the returned line is commented out, or no output is returned, this is a finding.\"]\n[4919,\"Verify the operating system automatically terminates a user session after inactivity time-outs have expired.\\n\\nCheck for the value of the \\\"ClientAliveCountMax\\\" keyword with the following command:\\n\\n# grep -i clientalivecount /etc/ssh/sshd_config\\nClientAliveCountMax 0\\n\\nIf \\\"ClientAliveCountMax\\\" is not set to \\\"0\\\", this is a finding.\"]\n[4920,\"Verify the SSH daemon does not allow authentication using known hosts authentication.\\n\\nTo determine how the SSH daemon's \\\"IgnoreRhosts\\\" option is set, run the following command:\\n\\n# grep -i IgnoreRhosts /etc/ssh/sshd_config\\n\\nIgnoreRhosts yes\\n\\nIf the value is returned as \\\"no\\\", the returned line is commented out, or no output is returned, this is a finding.\"]\n[4921,\"Verify SSH provides users with feedback on when account accesses last occurred.\\n\\nCheck that \\\"PrintLastLog\\\" keyword in the sshd daemon configuration file is used and set to \\\"yes\\\" with the following command:\\n\\n# grep -i printlastlog /etc/ssh/sshd_config\\nPrintLastLog yes\\n\\nIf the \\\"PrintLastLog\\\" keyword is set to \\\"no\\\", is missing, or is commented out, this is a finding.\"]\n[4922,\"Verify remote access using SSH prevents users from logging on directly as root.\\n\\nCheck that SSH prevents users from logging on directly as root with the following command:\\n\\n# grep -i permitrootlogin /etc/ssh/sshd_config\\nPermitRootLogin no\\n\\nIf the \\\"PermitRootLogin\\\" keyword is set to \\\"yes\\\", is missing, or is commented out, this is a finding.\"]\n[4923,\"Verify the SSH daemon does not allow authentication using known hosts authentication.\\n\\nTo determine how the SSH daemon's \\\"IgnoreUserKnownHosts\\\" option is set, run the following command:\\n\\n# grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config\\n\\nIgnoreUserKnownHosts yes\\n\\nIf the value is returned as \\\"no\\\", the returned line is commented out, or no output is returned, this is a finding.\"]\n[4924,\"Check the version of the operating system with the following command:\\n\\n# cat /etc/redhat-release\\n\\nIf the release is 7.4 or newer this requirement is Not Applicable.\\n\\nVerify the SSH daemon is configured to only use the SSHv2 protocol.\\n\\nCheck that the SSH daemon is configured to only use the SSHv2 protocol with the following command:\\n\\n# grep -i protocol /etc/ssh/sshd_config\\nProtocol 2\\n#Protocol 1,2\\n\\nIf any protocol line other than \\\"Protocol 2\\\" is uncommented, this is a finding.\"]\n[4925,\"Verify the SSH daemon is configured to only use MACs employing FIPS 140-2-approved ciphers.\\n\\nNote: If RHEL-07-021350 is a finding, this is automatically a finding as the system cannot implement FIPS 140-2-approved cryptographic algorithms and hashes.\\n\\nCheck that the SSH daemon is configured to only use MACs employing FIPS 140-2-approved ciphers with the following command:\\n\\n# grep -i macs /etc/ssh/sshd_config\\nMACs hmac-sha2-256,hmac-sha2-512\\n\\nIf any ciphers other than \\\"hmac-sha2-256\\\" or \\\"hmac-sha2-512\\\" are listed or the returned line is commented out, this is a finding.\"]\n[4926,\"Verify the SSH public host key files have mode \\\"0644\\\" or less permissive.\\n\\nNote: SSH public key files may be found in other directories on the system depending on the installation.\\n\\nThe following command will find all SSH public key files on the system:\\n\\n# find /etc/ssh -name '*.pub' -exec ls -lL {} \\\\;\\n\\n-rw-r--r-- 1 root root 618 Nov 28 06:43 ssh_host_dsa_key.pub\\n-rw-r--r-- 1 root root 347 Nov 28 06:43 ssh_host_key.pub\\n-rw-r--r-- 1 root root 238 Nov 28 06:43 ssh_host_rsa_key.pub\\n\\nIf any file has a mode more permissive than \\\"0644\\\", this is a finding.\"]\n[4927,\"Verify the SSH private host key files have mode \\\"0640\\\" or less permissive.\\n\\nThe following command will find all SSH private key files on the system and list their modes:\\n\\n# find / -name '*ssh_host*key' | xargs ls -lL\\n\\n-rw-r----- 1 root ssh_keys 668 Nov 28 06:43 ssh_host_dsa_key\\n-rw-r----- 1 root ssh_keys 582 Nov 28 06:43 ssh_host_key\\n-rw-r----- 1 root ssh_keys 887 Nov 28 06:43 ssh_host_rsa_key\\n\\nIf any file has a mode more permissive than \\\"0640\\\", this is a finding.\"]\n[4928,\"Verify the SSH daemon does not permit GSSAPI authentication unless approved.\\n\\nCheck that the SSH daemon does not permit GSSAPI authentication with the following command:\\n\\n# grep -i gssapiauth /etc/ssh/sshd_config\\nGSSAPIAuthentication no\\n\\nIf the \\\"GSSAPIAuthentication\\\" keyword is missing, is set to \\\"yes\\\" and is not documented with the Information System Security Officer (ISSO), or the returned line is commented out, this is a finding.\"]\n[4929,\"Verify the SSH daemon does not permit Kerberos to authenticate passwords unless approved.\\n\\nCheck that the SSH daemon does not permit Kerberos to authenticate passwords with the following command:\\n\\n# grep -i kerberosauth /etc/ssh/sshd_config\\nKerberosAuthentication no\\n\\nIf the \\\"KerberosAuthentication\\\" keyword is missing, or is set to \\\"yes\\\" and is not documented with the Information System Security Officer (ISSO), or the returned line is commented out, this is a finding.\"]\n[4930,\"Verify the SSH daemon performs strict mode checking of home directory configuration files.\\n\\nThe location of the \\\"sshd_config\\\" file may vary if a different daemon is in use.\\n\\nInspect the \\\"sshd_config\\\" file with the following command:\\n\\n# grep -i strictmodes /etc/ssh/sshd_config\\n\\nStrictModes yes\\n\\nIf \\\"StrictModes\\\" is set to \\\"no\\\", is missing, or the returned line is commented out, this is a finding.\"]\n[4931,\"Verify the SSH daemon performs privilege separation.\\n\\nCheck that the SSH daemon performs privilege separation with the following command:\\n\\n# grep -i usepriv /etc/ssh/sshd_config\\n\\nUsePrivilegeSeparation sandbox\\n\\nIf the \\\"UsePrivilegeSeparation\\\" keyword is set to \\\"no\\\", is missing, or the returned line is commented out, this is a finding.\"]\n[4932,\"Verify the SSH daemon performs compression after a user successfully authenticates.\\n\\nCheck that the SSH daemon performs compression after a user successfully authenticates with the following command:\\n\\n# grep -i compression /etc/ssh/sshd_config\\nCompression delayed\\n\\nIf the \\\"Compression\\\" keyword is set to \\\"yes\\\", is missing, or the returned line is commented out, this is a finding.\"]\n[4933,\"Check to see if NTP is running in continuous mode:\\n\\n# ps -ef | grep ntp\\n\\nIf NTP is not running, check to see if \\\"chronyd\\\" is running in continuous mode:\\n\\n# ps -ef | grep chronyd\\n\\nIf NTP or \\\"chronyd\\\" is not running, this is a finding.\\n\\nIf the NTP process is found, then check the \\\"ntp.conf\\\" file for the \\\"maxpoll\\\" option setting:\\n\\n# grep maxpoll /etc/ntp.conf\\n\\nserver 0.rhel.pool.ntp.org iburst maxpoll 10\\n\\nIf the option is set to \\\"17\\\" or is not set, this is a finding.\\n\\nIf the file does not exist, check the \\\"/etc/cron.daily\\\" subdirectory for a crontab file controlling the execution of the \\\"ntpd -q\\\" command.\\n\\n# grep -i \\\"ntpd -q\\\" /etc/cron.daily/*\\n# ls -al /etc/cron.* | grep ntp\\n\\nntp\\n\\nIf a crontab file does not exist in the \\\"/etc/cron.daily\\\" that executes the \\\"ntpd -q\\\" command, this is a finding.\\n\\nIf the \\\"chronyd\\\" process is found, then check the \\\"chrony.conf\\\" file for the \\\"maxpoll\\\" option setting:\\n\\n# grep maxpoll /etc/chrony.conf\\n\\nserver 0.rhel.pool.ntp.org iburst maxpoll 10\\n\\nIf the option is not set or the line is commented out, this is a finding.\"]\n[4934,\"Verify the operating system enabled an application firewall.\\n\\nCheck to see if \\\"firewalld\\\" is installed with the following command:\\n\\n# yum list installed firewalld\\nfirewalld-0.3.9-11.el7.noarch.rpm\\n\\nIf the \\\"firewalld\\\" package is not installed, ask the System Administrator if another firewall application (such as iptables) is installed. \\n\\nIf an application firewall is not installed, this is a finding. \\n\\nCheck to see if the firewall is loaded and active with the following command:\\n\\n# systemctl status firewalld\\nfirewalld.service - firewalld - dynamic firewall daemon\\n\\n   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)\\n   Active: active (running) since Tue 2014-06-17 11:14:49 CEST; 5 days ago\\n\\nIf \\\"firewalld\\\" does not show a status of \\\"loaded\\\" and \\\"active\\\", this is a finding. \\n\\nCheck the state of the firewall:\\n\\n# firewall-cmd --state \\nrunning\\n\\nIf \\\"firewalld\\\" does not show a state of \\\"running\\\", this is a finding.\"]\n[4935,\"Verify users are provided with feedback on when account accesses last occurred.\\n\\nCheck that \\\"pam_lastlog\\\" is used and not silent with the following command:\\n\\n# grep pam_lastlog /etc/pam.d/postlogin\\nsession required pam_lastlog.so showfailed\\n\\nIf \\\"pam_lastlog\\\" is missing from \\\"/etc/pam.d/postlogin\\\" file, or the silent option is present, this is a finding.\"]\n[4936,\"Verify there are no \\\".shosts\\\" files on the system.\\n\\nCheck the system for the existence of these files with the following command:\\n\\n# find / -name '*.shosts'\\n\\nIf any \\\".shosts\\\" files are found on the system, this is a finding.\"]\n[4937,\"Verify there are no \\\"shosts.equiv\\\" files on the system.\\n\\nCheck the system for the existence of these files with the following command:\\n\\n# find / -name shosts.equiv\\n\\nIf any \\\"shosts.equiv\\\" files are found on the system, this is a finding.\"]\n[4938,\"Determine whether the system is using local or DNS name resolution with the following command:\\n\\n# grep hosts /etc/nsswitch.conf\\nhosts:   files dns\\n\\nIf the DNS entry is missing from the host's line in the \\\"/etc/nsswitch.conf\\\" file, the \\\"/etc/resolv.conf\\\" file must be empty.\\n\\nVerify the \\\"/etc/resolv.conf\\\" file is empty with the following command:\\n\\n# ls -al /etc/resolv.conf\\n-rw-r--r--  1 root root        0 Aug 19 08:31 resolv.conf\\n\\nIf local host authentication is being used and the \\\"/etc/resolv.conf\\\" file is not empty, this is a finding.\\n\\nIf the DNS entry is found on the host's line of the \\\"/etc/nsswitch.conf\\\" file, verify the operating system is configured to use two or more name servers for DNS resolution.\\n\\nDetermine the name servers used by the system with the following command:\\n\\n# grep nameserver /etc/resolv.conf\\nnameserver 192.168.1.2\\nnameserver 192.168.1.3\\n\\nIf less than two lines are returned that are not commented out, this is a finding.\"]\n[4939,\"Verify the system does not accept IPv4 source-routed packets.\\n\\n# grep net.ipv4.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*\\n\\nnet.ipv4.conf.all.accept_source_route = 0\\n\\nIf \\\" net.ipv4.conf.all.accept_source_route \\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.conf.all.accept_source_route\\nnet.ipv4.conf.all.accept_source_route = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[4940,\"Verify the system uses a reverse-path filter for IPv4:\\n\\n# grep net.ipv4.conf.all.rp_filter /etc/sysctl.conf /etc/sysctl.d/*\\nnet.ipv4.conf.all.rp_filter = 1\\n\\nIf \\\"net.ipv4.conf.all.rp_filter\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"1\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.conf.all.rp_filter\\nnet.ipv4.conf.all.rp_filter = 1\\n\\nIf the returned line does not have a value of \\\"1\\\", this is a finding.\"]\n[4941,\"Verify the system uses a reverse-path filter for IPv4:\\n\\n# grep net.ipv4.conf.default.rp_filter /etc/sysctl.conf /etc/sysctl.d/*\\nnet.ipv4.conf.default.rp_filter = 1\\n\\nIf \\\"net.ipv4.conf.default.rp_filter\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"1\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.conf.default.rp_filter\\nnet.ipv4.conf.default.rp_filter = 1\\n\\nIf the returned line does not have a value of \\\"1\\\", this is a finding.\"]\n[4942,\"Verify the system does not accept IPv4 source-routed packets by default.\\n\\n# grep net.ipv4.conf.default.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*\\nnet.ipv4.conf.default.accept_source_route = 0\\n\\nIf \\\" net.ipv4.conf.default.accept_source_route \\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.conf.default.accept_source_route\\nnet.ipv4.conf.default.accept_source_route = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[4943,\"Verify the system does not respond to IPv4 ICMP echoes sent to a broadcast address.\\n\\n# grep net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\" net.ipv4.icmp_echo_ignore_broadcasts\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"1\\\", this is a finding.\\n\\nCheck that the operating system implements the \\\"icmp_echo_ignore_broadcasts\\\" variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.icmp_echo_ignore_broadcasts\\nnet.ipv4.icmp_echo_ignore_broadcasts = 1\\n\\nIf the returned line does not have a value of \\\"1\\\", this is a finding.\"]\n[4944,\"Verify the system will not accept IPv4 ICMP redirect messages.\\n\\n# grep 'net.ipv4.conf.default.accept_redirects' /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\" net.ipv4.conf.default.accept_redirects \\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the value of the \\\"accept_redirects\\\" variables with the following command:\\n\\n# /sbin/sysctl -a | grep 'net.ipv4.conf.default.accept_redirects'\\nnet.ipv4.conf.default.accept_redirects = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[4945,\"Verify the system ignores IPv4 ICMP redirect messages.\\n\\n# grep 'net.ipv4.conf.all.accept_redirects' /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\" net.ipv4.conf.all.accept_redirects \\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the \\\"accept_redirects\\\" variables with the following command:\\n\\n# /sbin/sysctl -a | grep 'net.ipv4.conf.all.accept_redirects'\\n\\nnet.ipv4.conf.all.accept_redirects = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[4946,\"Verify the system does not allow interfaces to perform IPv4 ICMP redirects by default.\\n\\n# grep 'net.ipv4.conf.default.send_redirects' /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\"net.ipv4.conf.default.send_redirects\\\" is not configured in the \\\"/etc/sysctl.conf\\\" file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the \\\"default send_redirects\\\" variables with the following command:\\n\\n# /sbin/sysctl -a | grep 'net.ipv4.conf.default.send_redirects'\\n\\nnet.ipv4.conf.default.send_redirects = 0 \\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[4947,\"Verify the system does not send IPv4 ICMP redirect messages.\\n\\n# grep 'net.ipv4.conf.all.send_redirects' /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\"net.ipv4.conf.all.send_redirects\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the \\\"all send_redirects\\\" variables with the following command:\\n\\n# /sbin/sysctl -a | grep 'net.ipv4.conf.all.send_redirects'\\n\\nnet.ipv4.conf.all.send_redirects = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[4948,\"Verify network interfaces are not in promiscuous mode unless approved by the ISSO and documented.\\n\\nCheck for the status with the following command:\\n\\n# ip link | grep -i promisc\\n\\nIf network interfaces are found on the system in promiscuous mode and their use has not been approved by the ISSO and documented, this is a finding.\"]\n[4949,\"Verify the system is configured to prevent unrestricted mail relaying.\\n\\nDetermine if \\\"postfix\\\" is installed with the following commands:\\n\\n# yum list installed postfix\\npostfix-2.6.6-6.el7.x86_64.rpm \\n\\nIf postfix is not installed, this is Not Applicable.\\n\\nIf postfix is installed, determine if it is configured to reject connections from unknown or untrusted networks with the following command:\\n\\n# postconf -n smtpd_client_restrictions\\nsmtpd_client_restrictions = permit_mynetworks, reject\\n\\nIf the \\\"smtpd_client_restrictions\\\" parameter contains any entries other than \\\"permit_mynetworks\\\" and \\\"reject\\\", this is a finding.\"]\n[4950,\"Verify an FTP server has not been installed on the system.\\n\\nCheck to see if an FTP server has been installed with the following commands:\\n\\n# yum list installed vsftpd\\n\\n vsftpd-3.0.2.el7.x86_64.rpm\\n\\nIf \\\"vsftpd\\\" is installed and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[4951,\"Verify a TFTP server has not been installed on the system.\\n\\nCheck to see if a TFTP server has been installed with the following command:\\n\\n# yum list installed tftp-server\\ntftp-server-0.49-9.el7.x86_64.rpm\\n\\nIf TFTP is installed and the requirement for TFTP is not documented with the ISSO, this is a finding.\"]\n[4952,\"Verify remote X connections for interactive users are encrypted.\\n\\nCheck that remote X connections are encrypted with the following command:\\n\\n# grep -i x11forwarding /etc/ssh/sshd_config | grep -v \\\"^#\\\"\\n\\nX11Forwarding yes\\n\\nIf the \\\"X11Forwarding\\\" keyword is set to \\\"no\\\" or is missing, this is a finding.\"]\n[4953,\"Verify the TFTP daemon is configured to operate in secure mode.\\n\\nCheck to see if a TFTP server has been installed with the following commands:\\n\\n# yum list installed tftp-server\\ntftp-server.x86_64 x.x-x.el7 rhel-7-server-rpms\\n\\nIf a TFTP server is not installed, this is Not Applicable.\\n\\nIf a TFTP server is installed, check for the server arguments with the following command: \\n\\n# grep server_args /etc/xinetd.d/tftp\\nserver_args = -s /var/lib/tftpboot\\n\\nIf the \\\"server_args\\\" line does not have a \\\"-s\\\" option and a subdirectory is not assigned, this is a finding.\"]\n[4954,\"Verify that if the system has X Windows System installed, it is authorized.\\n\\nCheck for the X11 package with the following command:\\n\\n# rpm -qa | grep xorg | grep server\\n\\nAsk the System Administrator if use of the X Windows System is an operational requirement.\\n\\nIf the use of X Windows on the system is not documented with the Information System Security Officer (ISSO), this is a finding.\"]\n[4955,\"Verify the system is not performing packet forwarding, unless the system is a router.\\n\\n# grep net.ipv4.ip_forward /etc/sysctl.conf /etc/sysctl.d/*\\n\\nnet.ipv4.ip_forward = 0\\n\\nIf \\\"net.ipv4.ip_forward\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system does not implement IP forwarding using the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.ip_forward\\nnet.ipv4.ip_forward = 0\\n\\nIf IP forwarding value is \\\"1\\\" and the system is hosting any application, database, or web servers, this is a finding.\"]\n[4956,\"Verify \\\"AUTH_GSS\\\" is being used to authenticate NFS mounts.\\n\\nTo check if the system is importing an NFS file system, look for any entries in the \\\"/etc/fstab\\\" file that have a file system type of \\\"nfs\\\" with the following command:\\n\\n# cat /etc/fstab | grep nfs\\n192.168.21.5:/mnt/export /data1 nfs4 rw,sync ,soft,sec=krb5:krb5i:krb5p\\n\\nIf the system is mounting file systems via NFS and has the sec option without the \\\"krb5:krb5i:krb5p\\\" settings, the \\\"sec\\\" option has the \\\"sys\\\" setting, or the \\\"sec\\\" option is missing, this is a finding.\"]\n[4957,\"Verify that a system using SNMP is not using default community strings.\\n\\nCheck to see if the \\\"/etc/snmp/snmpd.conf\\\" file exists with the following command:\\n\\n# ls -al /etc/snmp/snmpd.conf\\n -rw-------   1 root root      52640 Mar 12 11:08 snmpd.conf\\n\\nIf the file does not exist, this is Not Applicable.\\n\\nIf the file does exist, check for the default community strings with the following commands:\\n\\n# grep public /etc/snmp/snmpd.conf\\n# grep private /etc/snmp/snmpd.conf\\n\\nIf either of these commands returns any output, this is a finding.\"]\n[4958,\"If the \\\"firewalld\\\" package is not installed, ask the System Administrator (SA) if another firewall application (such as iptables) is installed. If an application firewall is not installed, this is a finding. \\n\\nVerify the system's access control program is configured to grant or deny system access to specific hosts.\\n\\nCheck to see if \\\"firewalld\\\" is active with the following command:\\n\\n# systemctl status firewalld\\nfirewalld.service - firewalld - dynamic firewall daemon\\nLoaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)\\nActive: active (running) since Sun 2014-04-20 14:06:46 BST; 30s ago\\n\\nIf \\\"firewalld\\\" is active, check to see if it is configured to grant or deny access to specific hosts or services with the following commands:\\n\\n# firewall-cmd --get-default-zone\\npublic\\n\\n# firewall-cmd --list-all --zone=public\\npublic (active)\\ntarget: default\\nicmp-block-inversion: no\\ninterfaces: eth0\\nsources:\\nservices: mdns ssh\\nports:\\nprotocols:\\nmasquerade: no\\nforward-ports:\\nicmp-blocks:\\n\\nIf \\\"firewalld\\\" is not active, determine whether \\\"tcpwrappers\\\" is being used by checking whether the \\\"hosts.allow\\\" and \\\"hosts.deny\\\" files are empty with the following commands:\\n\\n# ls -al /etc/hosts.allow\\nrw-r----- 1 root root 9 Aug 2 23:13 /etc/hosts.allow\\n\\n# ls -al /etc/hosts.deny\\n-rw-r----- 1 root root 9 Apr 9 2007 /etc/hosts.deny\\n\\nIf \\\"firewalld\\\" and \\\"tcpwrappers\\\" are not installed, configured, and active, ask the SA if another access control program (such as iptables) is installed and active. Ask the SA to show that the running configuration grants or denies access to specific hosts or services.\\n\\nIf \\\"firewalld\\\" is active and is not configured to grant access to specific hosts or \\\"tcpwrappers\\\" is not configured to grant or deny access to specific hosts, this is a finding.\"]\n[4959,\"Verify the system does not have unauthorized IP tunnels configured.\\n\\nCheck to see if \\\"libreswan\\\" is installed with the following command:\\n\\n# yum list installed libreswan\\nlibreswan.x86-64 3.20-5.el7_4\\n\\nIf \\\"libreswan\\\" is installed, check to see if the \\\"IPsec\\\" service is active with the following command:\\n\\n# systemctl status ipsec\\nipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec\\nLoaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled)\\nActive: inactive (dead)\\n\\nIf the \\\"IPsec\\\" service is active, check to see if any tunnels are configured in \\\"/etc/ipsec.conf\\\" and \\\"/etc/ipsec.d/\\\" with the following commands:\\n\\n# grep -iw conn /etc/ipsec.conf /etc/ipsec.d/*.conf\\n\\nIf there are indications that a \\\"conn\\\" parameter is configured for a tunnel, ask the System Administrator if the tunnel is documented with the ISSO. \\n\\nIf \\\"libreswan\\\" is installed, \\\"IPsec\\\" is active, and an undocumented tunnel is active, this is a finding.\"]\n[4960,\"If IPv6 is not enabled, the key will not exist, and this is Not Applicable.\\n\\nVerify the system does not accept IPv6 source-routed packets.\\n\\n# grep net.ipv6.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*\\n\\nnet.ipv6.conf.all.accept_source_route = 0\\n\\nIf \\\"net.ipv6.conf.all.accept_source_route\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv6.conf.all.accept_source_route\\nnet.ipv6.conf.all.accept_source_route = 0\\n\\nIf the returned lines do not have a value of \\\"0\\\", this is a finding.\"]\n[4961,\"Verify the operating system has the packages required for multifactor authentication installed.\\n\\nCheck for the presence of the packages required to support multifactor authentication with the following commands:\\n\\n# yum list installed esc\\nesc-1.1.0-26.el7.noarch.rpm\\n\\n# yum list installed pam_pkcs11\\npam_pkcs11-0.6.2-14.el7.noarch.rpm\\n\\n\\nIf the \\\"esc\\\" and \\\"pam_pkcs11\\\" packages are not installed, this is a finding.\"]\n[4962,\"Verify the operating system implements multifactor authentication for remote access to privileged accounts via pluggable authentication modules (PAM).\\n\\nCheck the \\\"/etc/sssd/sssd.conf\\\" file for the authentication services that are being used with the following command:\\n\\n# grep services /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf\\n\\nservices = nss, pam\\n\\nIf the \\\"pam\\\" service is not present on all \\\"services\\\" lines, this is a finding.\"]\n[4963,\"Verify the operating system implements certificate status checking for PKI authentication.\\n\\nCheck to see if Online Certificate Status Protocol (OCSP) is enabled on the system with the following command:\\n\\n# grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep -v \\\"^#\\\"\\n\\ncert_policy = ca, ocsp_on, signature;\\ncert_policy = ca, ocsp_on, signature;\\ncert_policy = ca, ocsp_on, signature;\\n\\nThere should be at least three lines returned. \\n\\nIf \\\"ocsp_on\\\" is not present in all uncommented \\\"cert_policy\\\" lines in \\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\", this is a finding.\"]\n[4964,\"Verify that there are no wireless interfaces configured on the system.\\n\\nThis is N/A for systems that do not have wireless network adapters.\\n\\nCheck for the presence of active wireless interfaces with the following command:\\n\\n# nmcli device\\nDEVICE TYPE STATE\\neth0 ethernet connected\\nwlp3s0 wifi disconnected\\nlo loopback unmanaged\\n\\nIf a wireless interface is configured and its use on the system is not documented with the Information System Security Officer (ISSO), this is a finding.\"]\n[4965,\"Verify the cryptographic hash of system files and commands match the vendor values.\\n\\nCheck the cryptographic hash of system files and commands with the following command:\\n\\nNote: System configuration files (indicated by a \\\"c\\\" in the second column) are expected to change over time. Unusual modifications should be investigated through the system audit log.\\n\\n# rpm -Va --noconfig | grep '^..5'\\n\\nIf there is any output from the command for system files or binaries, this is a finding.\"]\n[4966,\"Ask the SA or ISSO if a host-based intrusion detection application is loaded on the system. Per OPORD 16-0080, the preferred intrusion detection system is McAfee HBSS available through the U.S. Cyber Command (USCYBERCOM).\\n\\nIf another host-based intrusion detection application is in use, such as SELinux, this must be documented and approved by the local Authorizing Official.\\n\\nProcedure:\\nExamine the system to determine if the Host Intrusion Prevention System (HIPS) is installed:\\n\\n# rpm -qa | grep MFEhiplsm\\n\\nVerify that the McAfee HIPS module is active on the system:\\n\\n# ps -ef | grep -i “hipclient”\\n\\nIf the MFEhiplsm package is not installed, check for another intrusion detection system:\\n\\n# find / -name <daemon name>\\n\\nWhere <daemon name> is the name of the primary application daemon to determine if the application is loaded on the system.\\n\\nDetermine if the application is active on the system:\\n\\n# ps -ef | grep -i <daemon name>\\n\\nIf the MFEhiplsm package is not installed and an alternate host-based intrusion detection application has not been documented for use, this is a finding.\\n\\nIf no host-based intrusion detection system is installed and running on the system, this is a finding.\"]\n[4967,\"Verify the operating system prevents a user from overriding the screensaver lock-enabled setting for the graphical user interface. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\\n\\nDetermine which profile the system database is using with the following command:\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nCheck for the lock-enabled setting with the following command:\\n\\nNote: The example below is using the database \\\"local\\\" for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than \\\"local\\\" is being used.\\n\\n# grep -i lock-enabled /etc/dconf/db/local.d/locks/*\\n\\n/org/gnome/desktop/screensaver/lock-enabled\\n\\nIf the command does not return a result, this is a finding.\"]\n[4972,\"If the user/remote client connection banner is the same as the banner configured as part of the NDM SRG, then this is not applicable.\\n\\nDetermine if the network device is configured to present a DoD-approved banner that is formatted in accordance with DoD policy. \\n\\nIf the Remote Access VPN Gateway or VPN client does not display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network, this is a finding.\"]\n[4973,\"If the user/remote client connection banner is the same as the banner configured as part of the NDM SRG, then this is not applicable.\\n\\nVerify the ALG retains the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and takes explicit actions to log on for further access.\\n\\nIf the Remote Access VPN Gateway and/or client does not retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access, this is a finding.\"]\n[4974,\"Verify the publicly accessible VPN Gateway displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.  The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for network elements that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\\n\\nIf the publicly accessible VPN Gateway does not display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system, this is a finding.\"]\n[4975,\"Determine if the VPN Gateway is either configured to notify the administrator of the number of unsuccessful login attempts since the last successful login or configured to use an authentication server which would perform this function. If the administrator is not notified of the number of unsuccessful login attempts since the last successful login, this is a finding.\\n\\nIf the VPN Gateway does not notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access), this is a finding.\"]\n[4976,\"Inspect the VPN Gateway configuration. Verify the number of concurrent sessions for user accounts to 1 or to an organization-defined number (defined in the SSP).\\n\\nIf the VPN Gateway does not limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number, this is a finding.\"]\n[4977,\"Verify the TLS VPN Gateway is configured to use  TLS 1.2 or higher to protect the confidentiality of sensitive data during transmission.\\n\\nIf the TLS VPN Gateway does not use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during transmission, this is a finding.\"]\n[4978,\"Verify the remote access VPN Gateway uses a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.\\n\\nIf the remote access VPN Gateway does not use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions, this is a finding.\"]\n[4979,\"Verify the VPN Gateway uses IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.\\n\\nIf the VPN Gateway does not use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions, this is a finding.\"]\n[4980,\"Verify all IKE proposals are set to use a FIPS-validated dh-group.\\n\\nView the IKE options dh-group option.\\n\\nIf the IKE option is not set to a FIPS 140-2 validated dh-group, this is a finding.\"]\n[4981,\"Verify the VPN Gateway generates log records containing information to establish what type of events occurred.\\n\\nIf the VPN Gateway does not generate log records containing information to establish what type of events occurred, this is a finding.\"]\n[4982,\"Configure the VPN Gateway generates log records containing information to establish when (date and time) the events occurred.\\n\\nIf the VPN Gateway does not generate log records containing information to establish when (date and time) the events occurred, this is a finding.\"]\n[4983,\"Verify the VPN Gateway generates log records containing information that establishes the identity of any individual or process associated with the event.\\n\\nIf the VPN Gateway does not generate log records containing information that establishes the identity of any individual or process associated with the event, this is a finding.\"]\n[4984,\"Verify the VPN Gateway generates  log records containing information to establish where the events occurred.\\n\\nIf the VPN Gateway does not generate log records containing information to establish where the events occurred, this is a finding.\"]\n[4985,\"Verify the VPN Gateway  generates log records containing information to establish the source of the events.\\n\\nIf the VPN Gateway does not generate log records containing information to establish the source of the events, this is a finding.\"]\n[4986,\"Examine the log configuration on the VPN Gateway or view several alert events on the organization's central audit server. Alternatively, examine the Central Log Server to see if it contains information about success or failure of client connection attempts or other events.\\n\\nIf the traffic log entries do not include the success or failure of connection attempts and other events, this is a finding.\"]\n[4987,\"Verify the VPN Gateway protects log information from unauthorized read access if all or some of this data is stored locally.\\n\\nIf the VPN Gateway does not protect log information from unauthorized read access if all or some of this data is stored locally, this is a finding.\"]\n[4988,\"Verify the VPN Gateway log is configured to protect audit information from unauthorized modification when stored locally.\\n\\nThe VPN Gateway log must protect audit information from unauthorized modification when stored locally, this is a finding.\"]\n[4989,\"Verify the VPN Gateway is configured to protect audit information from unauthorized deletion when stored locally.\\n\\nIf the VPN Gateway does not protect audit information from unauthorized deletion when stored locally, this is a finding.\"]\n[4990,\"View the configured security  services.\\n\\nCompare the services that are enabled, including the port, services, protocols, and functions.\\n\\nIf functions, ports, protocols, and services identified on the PPSM CAL are not disabled, this is a finding.\"]\n[4991,\"Verify the IPsec VPN Gateway uses IKEv2 for IPsec VPN security associations.\\n\\nIf the IPsec VPN Gateway must use IKEv2 for IPsec VPN security associations, this is a finding.\"]\n[4992,\"Verify the VPN Gateway is configured to prohibit PPTP and L2F.\\n\\nIf the VPN Gateway does not be configured to prohibit PPTP and L2F, this is a finding.\"]\n[4993,\"If L2TP communications protocol is not used, this is not applicable.\\n\\nVerify the VPN Gateway or another network element (e.g., firewall) is configure to block or deny L2TP packets with a destination address within the private network of the enclave.\\n\\nIf L2TP communications are  allowed to cross the security boundary into the private network of the enclave, this is a finding.\"]\n[4994,\"Verify the VPN Gateway is configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).\\n\\nIf the VPN Gateway does not uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users), this is a finding.\"]\n[4995,\"Verify the VPN Gateway uses multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.\\n\\nIf the VPN Gateway does not use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts, this is a finding.\"]\n[4996,\"Verify the VPN Client implements multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.\\n\\nIf the VPN Client does not implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access, this is a finding.\"]\n[4997,\"Verify the TLS VPN Gateway is configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts.\\n\\nIf the TLS VPN is not configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts, this is a finding.\"]\n[4998,\"Verify the IPsec VPN Gateway  uses anti-replay mechanisms for security associations.\\n\\nIf the IPsec VPN Gateway does not use anti-replay mechanisms for security associations, this is a finding.\"]\n[4999,\"Verify the VPN Gateway uniquely identifies all network-connected endpoint devices before establishing a connection.\\n\\nIf the VPN Gateway does not uniquely identify all network-connected endpoint devices before establishing a connection, this is a finding.\"]\n[5000,\"Verify the VPN Gateway to use PKI-based authentication that validates certificates by constructing a certification path (which includes status information) to an accepted trust anchor.\\n\\nIf PKI-based authentication does not validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor, this is a finding.\"]\n[5001,\"If PKI-based authentication is not being used for device authentication, this is not applicable.\\n\\nVerify the site-to-site VPN that uses certificate-based device authentication uses a FIPS-compliant key management process.\\n\\nIf the site-to-site VPN that uses certificate-based device authentication does not use a FIPS-compliant key management process, this is a finding.\"]\n[5002,\"Verify the Remote Access VPN Gateway is configured to use a physically separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.\\n\\nIf the Remote Access VPN Gateway does not use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication, this is a finding.\"]\n[5003,\"Verify the VPN Gateway maps the authenticated identity to the user account for PKI-based authentication.\\n\\nIf the VPN Gateway does not map the authenticated identity to the user account for PKI-based authentication, this is a finding.\"]\n[5004,\"Verify the VPN Gateway uses FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).\\n\\nIf the VPN Gateway does not use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only), this is a finding.\"]\n[5005,\"Configure the VPN Gateway to uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).\\n\\nIf the VPN Gateway does not uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users), this is a finding.\"]\n[5006,\"Verify the VPN Gateway routes sessions to an IDPS for inspection.\\n\\nIf the VPN Gateway is not  configured to route sessions to an IDPS for inspection, this is a finding.\"]\n[5007,\"Verify the VPN Gateway terminates all network connections associated with a communications session at the end of the session.\\n\\nIf the VPN Gateway does not terminate all network connections associated with a communications session at the end of the session, this is a finding.\"]\n[5008,\"Verify the VPN Gateway uses FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.\\n\\nIf the VPN Gateway does not use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module, this is a finding.\"]\n[5009,\"Verify the IPsec VPN Gateway uses IKE with SHA1 or greater to protect the authenticity of communications sessions.\\n\\nIf the IPsec VPN Gateway is not configured to use IKE with SHA1 or greater to protect the authenticity of communications sessions, this is a finding.\"]\n[5010,\"Verify the VPN Gateway invalidates session identifiers upon user logoff or other session termination.\\n\\nIf the VPN Gateway does not invalidate session identifiers upon user logoff or other session termination, this is a finding.\"]\n[5011,\"Verify the VPN Gateway recognizes only system-generated session identifiers.\\n\\nIf the VPN Gateway does not recognize only system-generated session identifiers, this is a finding.\"]\n[5012,\"Verify the VPN Gateway generates unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.\\n\\nIf the VPN Gateway does not generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm, this is a finding.\"]\n[5013,\"Verify the VPN Gateway is configured to fail to a secure state if system initialization fails, shutdown fails, or aborts fail.\\n\\nIf the VPN Gateway does not fail to a secure state if system initialization fails, shutdown fails, or aborts fail, this is a finding.\"]\n[5014,\"Verify the VPN Gateway is configured to perform an organization-defined action if the audit reveals unauthorized activity.\\n\\nIf the VPN Gateway does not be configured to perform an organization-defined action if the audit reveals unauthorized activity, this is a finding.\"]\n[5015,\"Configure the VPN Gateway for functionality, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack. \\n\\nConfigure authorized system administrator accounts to allow them to disconnect or disable remote access to remove user under circumstances defined in the VPN SSP.\\n\\nIf the VPN Gateway administrator accounts or security policy is not configured to allow the system administrator to immediately disconnect or disable remote access to devices and/or users when needed, this is a finding.\"]\n[5016,\"Verify all IKE proposals are set to use the AES encryption algorithm.\\n\\nView the value of the encryption algorithm for each defined proposal.\\n\\nIf the value of the encryption algorithm for any IKE proposal is not set to use an AES algorithm, this is a finding.\"]\n[5017,\"Verify the VPN Gateway transmits organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.\\n\\nIf the VPN Gateway does not transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions, this is a finding.\"]\n[5018,\"Verity the VPN Gateway notifies the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).\\n\\nIf the VPN Gateway does not notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access), this is a finding.\"]\n[5019,\"Verify the VPN Gateway provides centralized management and configuration of the content to be captured in log records generated by all network components.\\n\\nIf the VPN Gateway does not provide centralized management and configuration of the content to be captured in log records generated by all network components, this is a finding.\"]\n[5020,\"Verify the VPN Gateway off-loads log records onto a different system or media than the system being audited.\\n\\nIf the VPN Gateway does not off-load audit records onto a different system or media than the system being audited, this is a finding.\"]\n[5021,\"Verify the VPN Gateway generates a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.\\n\\nIf the VPN Gateway does not generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server, this is a finding.\"]\n[5022,\"Verify that in the event that communications with the Central Log Server is lost, the VPN Gateway is configured to continue to queue traffic log records locally.\\n\\nIf the VPN Gateway does not continue to queue traffic log records locally when communications with the Central Log Server is lost, this is a finding.\"]\n[5023,\"Verify the IPsec VPN Gateway renegotiates the security association after 8 hours or less, or an organization-defined period.\\n\\nIf the IPsec VPN Gateway does not renegotiate the security association after 8 hours or less, or an organization-defined period, this is a finding.\"]\n[5024,\"Verify the VPN Gateway renegotiates the security association after 24 hours or less or as defined by the organization.\\n\\nIf the VPN Gateway does not renegotiate the security association after 24 hours or less or as defined by the organization, this is a finding.\"]\n[5025,\"Verify the VPN Gateway accepts Personal Identity Verification (PIV) credentials.\\n\\nIf the VPN Gateway does not accept Personal Identity Verification (PIV) credentials, this is a finding.\"]\n[5026,\"Verify the VPN Gateway electronically verifies Personal Identity Verification (PIV) credentials.\\n\\nIf the VPN Gateway does not electronically verify Personal Identity Verification (PIV) credentials, this is a finding.\"]\n[5027,\"Verity the VPN Gateway  authenticates all network-connected endpoint devices before establishing a connection.\\n\\nIf the VPN Gateway does not authenticate all network-connected endpoint devices before establishing a connection, this is a finding.\"]\n[5028,\"Verify the VPN Gateway uses an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.\\n\\nIf the VPN Gateway does not use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network, this is a finding.\"]\n[5029,\"Verify the VPN Gateway disables split-tunneling for remote clients VPNs.\\n\\nIf the VPN Gateway does not disable split-tunneling for remote clients VPNs, this is a finding.\"]\n[5030,\"Verify the IPsec VPN Gateway specifies Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.\\n\\nIf the IPsec VPN Gateway does not specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation, this is a finding.\"]\n[5031,\"Verify the VPN Gateway and the remote access client are configured to protect the confidentiality and integrity of transmitted information.\\n\\nIf VPN Gateway and Client does not protect the confidentiality and integrity of transmitted information, this is a finding.\"]\n[5032,\"Verify the IPsec VPN Gateway uses Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.\\n\\nIf the IPsec VPN Gateway must use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations, this is a finding.\"]\n[5033,\"For accounts using password authentication, verify the VPN Gateway uses FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.\\n\\nFor accounts using password authentication, if the VPN Gateway does not use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process, this is a finding.\"]\n[5034,\"Verify the VPN Gateway generates log records when successful and/or unsuccessful VPN connection attempts occur.\\n\\nIf the VPN Gateway does not generate log records when successful and/or unsuccessful VPN connection attempts occur, this is a finding.\"]\n[5035,\"Verify the VPN Gateway uses a FIPS-validated cryptographic module to generate cryptographic hashes.\\n\\nIf the VPN Gateway does not use a FIPS-validated cryptographic module to generate cryptographic hashes, this is a finding.\"]\n[5036,\"Verify the VPN Gateway uses a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.\\n\\nIf the VPN Gateway does not use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality, this is a finding.\"]\n[5037,\"Verify the IPsec VPN Gateway IKE uses a NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.\\n\\nIf the IPsec VPN Gateway IKE does not use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic, this is a finding.\"]\n[5038,\"Verify the IKE protocol is specified for all IPsec VPNs.\\n\\nIf the IKE protocol is not specified as an option on all VPN gateways, this is a finding.\"]\n[5039,\"Verify the VPN Gateway does not accept certificates that have been revoked when using PKI for authentication.\\n\\nIf the VPN Gateway accepts certificates that have been revoked when using PKI for authentication, this is a finding.\"]\n[5040,\"Verify the VPN Client logout function is configured to terminate the session on/with the VPN Gateway.\\n\\nIf the VPN Client logout function does not terminate the session on/with the VPN Gateway, this is a finding.\"]\n[5041,\"Verify the VPN Client displays an explicit logout message to users indicating the reliable termination of authenticated communications sessions.\\n\\nIf the VPN Client does not display an explicit logout message to users indicating the reliable termination of authenticated communications sessions, this is a finding.\"]\n[5042,\"Verify the VPN Gateway stores only cryptographic representations of the PSK.\\n\\nIf the VPN Gateway does not store only cryptographic representations of the PSK, this is a finding.\"]\n[5043,\"Verify all Internet Key Exchange (IKE) proposals are set to use the AES encryption algorithm.\\n\\nView the value of the encryption algorithm for each defined proposal.\\n\\nIf the value of the encryption algorithm for any IPsec proposal is not set to use an AES algorithm, this is a finding.\"]\n[5044,\"Verify the TLS VPN Gateway that supports Government-only services prohibits client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.\\n\\nIf the TLS VPN Gateway that supports Government-only services does not prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0, this is a finding.\"]\n[5045,\"Verify the TLS VPN Gateway that supports citizen- or business-facing network devices prohibits client negotiation to SSL 2.0 or SSL 3.0.\\n\\nIf the TLS VPN Gateway that supports citizen- or business-facing network devices does not prohibit client negotiation to SSL 2.0 or SSL 3.0, this is a finding.\"]\n[5046,\"Verify the VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) is configured to use SNMPv3 to use FIPS-validated AES cipher block algorithm.\\n\\nIf the VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) does not configure SNMPv3 to use FIPS-validated AES cipher block algorithm, this is a finding.\"]\n[5047,\"Verify the VPN Gateway uses an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.\\n\\nIf the VPN Gateway does not use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network, this is a finding.\"]\n[5048,\"Verify the IPsec VPN Gateway Internet Key Exchange (IKE) uses cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.\\n\\nIf the IPsec VPN Gateway Internet Key Exchange (IKE) does not use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network, this is a finding.\"]\n[5049,\"Verify the VPN Gateway validates TLS certificates by performing RFC 5280-compliant certification path validation.\\n\\nIf the VPN Gateway does not validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation, this is a finding.\"]\n[5050,\"Verify the VPN Gateway uses FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).\\n\\nIf the VPN Gateway does not use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use), this is a finding.\"]\n[5051,\"If L2TP communications protocol is not used, this is not applicable.\\n\\nVerify L2TPv3 sessions are configured to authenticate the traffic before transit. L2TPv3 sessions must be authenticated prior to transporting traffic.\\n\\nIf L2TPv3 sessions do not require authentication, this is a finding.\"]\n[5052,\"Verify xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx the VPN Gateway has an inbound and outbound traffic security policy which is in compliance with information flow control policies (e.g., IPsec policy configuration).\\n\\nReview network device configurations and topology diagrams. Verify encapsulated or encrypted traffic received from other enclaves with different security policies terminate at the perimeter for filtering and content inspection by a firewall and IDPS before gaining access to the private network.\\n\\nIf the VPN Gateway does not ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies, this is a finding.\"]\n{\"table\":\"collection\",\"columns\":\"`collectionId`,`created`,`createdUserId`,`description`,`metadata`,`name`,`settings`,`state`,`stateDate`,`stateUserId`\",\"rowCount\":2}\n[21,\"2024-10-23 10:03:48\",null,null,\"{\\\"reqRar\\\": \\\"true\\\", \\\"pocName\\\": \\\"poc2Patched\\\", \\\"pocEmail\\\": \\\"pocEmail@email.com\\\", \\\"pocPhone\\\": \\\"12342\\\"}\",\"Collection X\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 15}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n[83,\"2024-10-23 10:03:48\",null,null,\"{\\\"reqRar\\\": \\\"true\\\", \\\"pocName\\\": \\\"string\\\", \\\"pocEmail\\\": \\\"string\\\", \\\"pocPhone\\\": \\\"string\\\"}\",\"Collection Y\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 15}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n{\"table\":\"collection_grant\",\"columns\":\"`collectionId`,`grantId`,`roleId`,`userGroupId`,`userId`\",\"rowCount\":9}\n[21,1352,1,null,86]\n[21,1353,1,null,85]\n[21,1354,2,null,21]\n[21,1355,3,null,44]\n[21,1356,4,null,87]\n[21,1357,4,null,1]\n[21,1358,4,null,45]\n[83,1359,4,null,87]\n[83,1360,4,null,1]\n{\"table\":\"collection_grant_acl\",\"columns\":\"`access`,`assetId`,`benchmarkId`,`cgAclId`,`clId`,`grantId`,`modifiedDate`,`modifiedUserId`\",\"rowCount\":2}\n[\"rw\",42,\"VPN_SRG_TEST\",1,null,1353,null,null]\n[\"rw\",42,\"Windows_10_STIG_TEST\",2,null,1352,null,null]\n{\"table\":\"collection_label\",\"columns\":\"`clId`,`collectionId`,`color`,`description`,`name`,`uuid`\",\"rowCount\":2}\n[253,21,\"FF99CC\",\"\",\"test-label-full\",{\"type\":\"Buffer\",\"data\":\"base64:EeyaaHVbiiixvAJCrBEAAg==\"}]\n[254,21,\"99CCFF\",\"\",\"test-label-lvl1\",{\"type\":\"Buffer\",\"data\":\"base64:EeyaaFEw3ISxvAJCrBEAAg==\"}]\n{\"table\":\"collection_label_asset_map\",\"columns\":\"`assetId`,`claId`,`clId`\",\"rowCount\":3}\n[42,391,253]\n[42,393,254]\n[62,392,253]\n{\"table\":\"collection_rev_map\",\"columns\":\"`benchmarkId`,`collectionId`,`crId`,`revId`\",\"rowCount\":1}\n[\"VPN_SRG_TEST\",83,12,\"VPN_SRG_TEST-1-0\"]\n{\"table\":\"current_rev\",\"columns\":\"`active`,`benchmarkDate`,`benchmarkDateSql`,`benchmarkId`,`checkCount`,`description`,`fixCount`,`groupCount`,`highCount`,`lowCount`,`marking`,`mediumCount`,`release`,`revId`,`status`,`statusDate`,`version`\",\"rowCount\":5}\n[1,\"31 Mar 2020\",\"2020-03-31\",\"RHEL_7_STIG_TEST\",247,\"This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.\",247,247,29,14,null,201,\"0.3\",\"RHEL_7_STIG_TEST-3-0.3\",\"draft\",\"2020-03-27\",3]\n[1,\"19 Jul 2001\",\"2001-07-19\",\"VPN_SRG_OTHER\",2,\"This description replaces the old description\",2,2,0,0,null,2,\"2\",\"VPN_SRG_OTHER-2-2\",\"accepted\",\"2001-07-26\",2]\n[1,\"19 Jul 2001\",\"2001-07-19\",\"VPN_SRG_Rule-fingerprint-match-test\",3,\"This description replaces the old description\",3,3,0,0,null,3,\"2\",\"VPN_SRG_Rule-fingerprint-match-test-2-2\",\"accepted\",\"2001-07-26\",2]\n[1,\"19 Jul 2019\",\"2019-07-19\",\"VPN_SRG_TEST\",81,\"This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",81,81,11,7,null,63,\"1\",\"VPN_SRG_TEST-1-1\",\"accepted\",\"2019-07-26\",1]\n[1,\"17 Jun 2020\",\"2020-06-17\",\"Windows_10_STIG_TEST\",287,\"The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",287,287,26,18,null,243,\"23\",\"Windows_10_STIG_TEST-1-23\",\"accepted\",\"2020-06-15\",1]\n{\"table\":\"default_rev\",\"columns\":\"`benchmarkId`,`collectionId`,`revId`,`revisionPinned`,`vdId`\",\"rowCount\":3}\n[\"Windows_10_STIG_TEST\",21,\"Windows_10_STIG_TEST-1-23\",0,1723]\n[\"VPN_SRG_TEST\",21,\"VPN_SRG_TEST-1-1\",0,1724]\n[\"VPN_SRG_TEST\",83,\"VPN_SRG_TEST-1-0\",1,1728]\n{\"table\":\"fix_text\",\"columns\":\"`ftId`,`text`\",\"rowCount\":615}\n[1,\"Use Windows 10 Enterprise 64-bit version for domain-joined systems.\"]\n[2,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> \\\"Allow user control over installs\\\" to \\\"Disabled\\\".\"]\n[3,\"For standalone systems, this is NA.\\n\\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nEnsure domain-joined systems must have a Trusted Platform Module (TPM) that is configured for use. (Versions 2.0 or 1.2 support Credential Guard.)\\n\\nThe TPM must be enabled in the firmware.\\nRun \\\"tpm.msc\\\" for configuration options in Windows.\"]\n[4,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> \\\"Always install with elevated privileges\\\" to \\\"Disabled\\\".\"]\n[5,\"The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> \\\"Prevent Internet Explorer security prompt for Windows Installer scripts\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[6,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Logon Options >> \\\"Sign-in last interactive user automatically after a system-initiated restart\\\" to \\\"Disabled\\\".\"]\n[7,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> \\\"Allow Basic authentication\\\" to \\\"Disabled\\\".\"]\n[8,\"Enable full disk encryption on all information systems (including SIPRNet) using BitLocker.\\n\\nBitLocker, included in Windows, can be enabled in the Control Panel under \\\"BitLocker Drive Encryption\\\" as well as other management tools.\\n\\nNOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).\"]\n[9,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> \\\"Allow unencrypted traffic\\\" to \\\"Disabled\\\".\"]\n[10,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> \\\"Disallow Digest authentication\\\" to \\\"Enabled\\\".\"]\n[11,\"Install DoD approved HBSS software and ensure it is operating continuously.\"]\n[12,\"Configure an application whitelisting program to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.\\n\\nConfiguration of whitelisting applications will vary by the program.  AppLocker is a whitelisting application built into Windows 10 Enterprise.\\n\\nIf AppLocker is used, it is configured through group policy in Computer Configuration >> Windows Settings >> Security Settings >> Application Control Policies >> AppLocker.\\n\\nImplementation guidance for AppLocker is available in the NSA paper \\\"Application Whitelisting using Microsoft AppLocker\\\" at the following link:\\n\\nhttps://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm\"]\n[13,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> \\\"Allow Basic authentication\\\" to \\\"Disabled\\\".\"]\n[14,\"Update systems on the Semi-Annual Channel to \\\"Microsoft Windows Version 1709 (OS Build 16299.0)\\\" or greater.\\n\\nIt is recommended systems be upgraded to the most recently released version.\\n\\nSpecial purpose systems using the Long-Term Servicing Branch\\\\Channel (LTSC\\\\B) may be at the following versions:\\n\\nv1507 (Build 10240)\\nv1607 (Build 14393)\\nv1809 (Build 17763)\"]\n[15,\"Install an anti-virus solution on the system.\"]\n[16,\"Format all local volumes to use NTFS.\"]\n[17,\"Ensure Windows 10 is the only operating system on a device.  Remove alternate operating systems.\"]\n[18,\"If a non system-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it.\\n\\nRemove any unnecessary non-system created shares.\"]\n[19,\"Regularly review local accounts and verify their necessity.  Disable or delete any active accounts that have not been used in the last 35 days.\"]\n[20,\"Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group.\\n\\nFor domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.\\n\\nRemove any standard user accounts.\"]\n[21,\"Create separate accounts for backup operations for users with this privilege.\"]\n[22,\"For Hyper-V, remove any unauthorized groups or user accounts from the \\\"Hyper-V Administrators\\\" group.\\n\\nFor hosted hypervisors other than Hyper-V, restrict access to create or run virtual machines to authorized user accounts only.\"]\n[23,\"Limit local user accounts on domain-joined systems.  Remove any unauthorized local accounts.\"]\n[24,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> \\\"Allow unencrypted traffic\\\" to \\\"Disabled\\\".\"]\n[25,\"Configure all passwords to expire.\\nRun \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Users.\\nDouble click each active account.\\nEnsure \\\"Password never expires\\\" is not checked on all active accounts.\"]\n[26,\"Maintain the default file system permissions and configure the Security Option: \\\"Network access: Let everyone permissions apply to anonymous users\\\" to \\\"Disabled\\\" (WN10-SO-000160).\"]\n[27,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> \\\"Disallow WinRM from storing RunAs credentials\\\" to \\\"Enabled\\\".\"]\n[28,\"Uninstall \\\"Internet Information Services\\\" or \\\"Internet Information Services Hostable Web Core\\\" from the system.\"]\n[29,\"Uninstall \\\"Simple Network Management Protocol (SNMP)\\\" from the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows Features on or off\\\".\\nDe-select \\\"Simple Network Management Protocol (SNMP)\\\".\"]\n[30,\"Uninstall \\\"Simple TCPIP Services (i.e. echo, daytime etc)\\\" from the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows Features on or off\\\".\\nDe-select \\\"Simple TCPIP Services (i.e. echo, daytime etc)\\\".\"]\n[31,\"Uninstall \\\"Telnet Client\\\" from the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows Features on or off\\\".\\n\\nDe-select \\\"Telnet Client\\\".\"]\n[32,\"Uninstall \\\"TFTP Client\\\" from the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows Features on or off\\\".\\n\\nDe-select \\\"TFTP Client\\\".\"]\n[33,\"Remove any certificate installation files (*.p12 and *.pfx) found on a system.\\n\\nNote: This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or Adobe PreFlight certificate files.\"]\n[34,\"Install and enable a host-based firewall on the system.\"]\n[35,\"Configure firewall exceptions to inbound connections on domain workstations to include only authorized remote management hosts.\\n\\nConfigure only inbound connection exceptions for authorized remote management hosts.\\nComputer Configuration >> Windows Settings >> Security Settings >> Windows Defender Firewall with Advanced Security >> Windows Defender Firewall with Advanced Security >> Inbound Rules (this link will be in the right pane)\\n\\nFor any inbound rules that allow connections, configure the Scope for Remote IP address to those of authorized remote management hosts. This may be defined as an IP address, subnet or range. Apply the rule to all firewall profiles.\\n\\nIf a third-party firewall is used, configure inbound exceptions to only include authorized remote management hosts.\"]\n[36,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> \\\"Account lockout duration\\\" to \\\"15\\\" minutes or greater.\\n\\nA value of \\\"0\\\" is also acceptable, requiring an administrator to unlock the account.\"]\n[37,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> \\\"Account lockout threshold\\\" to \\\"3\\\" or less invalid logon attempts (excluding \\\"0\\\" which is unacceptable).\"]\n[38,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> \\\"Reset account lockout counter after\\\" to \\\"15\\\" minutes.\"]\n[39,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Enforce password history\\\" to \\\"24\\\" passwords remembered.\"]\n[40,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Maximum Password Age\\\" to \\\"60\\\" days or less (excluding \\\"0\\\" which is unacceptable).\"]\n[41,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Minimum Password Age\\\" to at least \\\"1\\\" day.\"]\n[42,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Minimum password length\\\" to \\\"14\\\" characters.\"]\n[43,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Password must meet complexity requirements\\\" to \\\"Enabled\\\".\"]\n[44,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Store passwords using reversible encryption\\\" to \\\"Disabled\\\".\"]\n[45,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> \\\"Audit Credential Validation\\\" with \\\"Failure\\\" selected.\"]\n[46,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> \\\"Audit Credential Validation\\\" with \\\"Success\\\" selected.\"]\n[47,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> \\\"Audit Security Group Management\\\" with \\\"Success\\\" selected.\"]\n[48,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> \\\"Audit User Account Management\\\" with \\\"Failure\\\" selected.\"]\n[49,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> \\\"Audit User Account Management\\\" with \\\"Success\\\" selected.\"]\n[50,\"Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> \\\"Audit PNP Activity\\\" with \\\"Success\\\" selected.\"]\n[51,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> \\\"Audit Process Creation\\\" with \\\"Success\\\" selected.\"]\n[52,\"Configure the policy value for Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Group Membership\\\" with \\\"Success\\\" selected.\"]\n[53,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Logoff\\\" with \\\"Success\\\" selected.\"]\n[54,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Logon\\\" with \\\"Failure\\\" selected.\"]\n[55,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Logon\\\" with \\\"Success\\\" selected.\"]\n[56,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Special Logon\\\" with \\\"Success\\\" selected.\"]\n[57,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit Removable Storage\\\" with \\\"Failure\\\" selected.\"]\n[58,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit Removable Storage\\\" with \\\"Success\\\" selected.\"]\n[59,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> \\\"Audit Audit Policy Change\\\" with \\\"Success\\\" selected.\"]\n[60,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> \\\"Audit Authentication Policy Change\\\" with \\\"Success\\\" selected.\"]\n[61,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> \\\"Audit Sensitive Privilege Use\\\" with \\\"Failure\\\" selected.\"]\n[62,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> \\\"Audit Sensitive Privilege Use\\\" with \\\"Success\\\" selected.\"]\n[63,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit IPSec Driver\\\" with \\\"Failure\\\" selected.\"]\n[64,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit Other System Events\\\" with \\\"Success\\\" selected.\"]\n[65,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit Other System Events\\\" with \\\"Failure\\\" selected.\"]\n[66,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit Security State Change\\\" with \\\"Success\\\" selected.\"]\n[67,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit Security System Extension\\\" with \\\"Success\\\" selected.\"]\n[68,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit System Integrity\\\" with \\\"Failure\\\" selected.\"]\n[69,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit System Integrity\\\" with \\\"Success\\\" selected.\"]\n[70,\"If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Application >> \\\"Specify the maximum log file size (KB)\\\" to \\\"Enabled\\\" with a \\\"Maximum Log Size (KB)\\\" of \\\"32768\\\" or greater.\"]\n[71,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Security >> \\\"Specify the maximum log file size (KB)\\\" to \\\"Enabled\\\" with a \\\"Maximum Log Size (KB)\\\" of \\\"1024000\\\" or greater.\\n\\nIf the system is configured to send audit records directly to an audit server, documented with the ISSO.\"]\n[72,\"If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> System >> \\\"Specify the maximum log file size (KB)\\\" to \\\"Enabled\\\" with a \\\"Maximum Log Size (KB)\\\" of \\\"32768\\\" or greater.\"]\n[73,\"Ensure the permissions on the Application event log (Application.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory.\\n\\nIf the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as \\\"NT Service\\\\Eventlog\\\".\"]\n[74,\"Ensure the permissions on the Security event log (Security.evtx) are configured to prevent standard user accounts or groups from having access.  The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory.\\n\\nIf the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as \\\"NT Service\\\\Eventlog\\\".\"]\n[75,\"Ensure the permissions on the System event log (System.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory.\\n\\nIf the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as \\\"NT Service\\\\Eventlog\\\".\"]\n[76,\"If the device does not have a camera, this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Control Panel >> Personalization >> \\\"Prevent enabling lock screen camera\\\" to \\\"Enabled\\\".\"]\n[77,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Control Panel >> Personalization >> \\\"Prevent enabling lock screen slide show\\\" to \\\"Enabled\\\".\"]\n[78,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> \\\"MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)\\\" to \\\"Highest protection, source routing is completely disabled\\\".\\n\\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \\\"MSS-Legacy.admx\\\" and \\\" MSS-Legacy.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[79,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> \\\"MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)\\\" to \\\"Highest protection, source routing is completely disabled\\\".\\n\\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \\\"MSS-Legacy.admx\\\" and \\\" MSS-Legacy.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[80,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> \\\"MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes\\\" to \\\"Disabled\\\".\\n\\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \\\"MSS-Legacy.admx\\\" and \\\" MSS-Legacy.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[81,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> \\\"MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers\\\" to \\\"Enabled\\\".\\n\\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \\\"MSS-Legacy.admx\\\" and \\\" MSS-Legacy.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[82,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Lanman Workstation >> \\\"Enable insecure guest logons\\\" to \\\"Disabled\\\".\"]\n[83,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Network Provider >> \\\"Hardened UNC Paths\\\" to \\\"Enabled\\\" with at least the following configured in \\\"Hardened UNC Paths:\\\" (click the \\\"Show\\\" button to display).\\n\\nValue Name: \\\\\\\\*\\\\SYSVOL\\nValue: RequireMutualAuthentication=1, RequireIntegrity=1\\n\\nValue Name: \\\\\\\\*\\\\NETLOGON\\nValue: RequireMutualAuthentication=1, RequireIntegrity=1\"]\n[84,\"Install the DoD Root CA certificates.\\nDoD Root CA 2\\nDoD Root CA 3\\nDoD Root CA 4\\nDoD Root CA 5\\n\\nThe InstallRoot tool is available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.\"]\n[85,\"The default behavior for \\\"Minimize the number of simultaneous connections to the Internet or a Windows Domain\\\" is \\\"Enabled\\\".\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Windows Connection Manager >> \\\"Minimize the number of simultaneous connections to the Internet or a Windows Domain\\\" to \\\"Enabled\\\".\"]\n[86,\"Install the ECA Root CA certificates on unclassified systems.\\nECA Root CA 2\\nECA Root CA 4\\n\\nThe InstallRoot tool is available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.\"]\n[87,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Windows Connection Manager >> \\\"Prohibit connection to non-domain networks when connected to domain authenticated network\\\" to \\\"Enabled\\\".\"]\n[88,\"Install the DoD Interoperability Root CA cross-certificates on unclassified systems.\\n\\nIssued To - Issued By - Thumbprint\\nDoD Root CA 2 - DoD Interoperability Root CA 1 - A8C27332CCB4CA49554CE55D34062A7DD2850C02\\nDoD Root CA 3 - DoD Interoperability Root CA 2 - AC06108CA348CC03B53795C64BF84403C1DBD341\\n\\nThe certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.\"]\n[89,\"Install the US DoD CCEB Interoperability Root CA cross-certificate on unclassified systems.\\n\\nIssued To - Issued By - Thumbprint\\nDoD Root CA 3 - US DoD CCEB Interoperability Root CA 2 - AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9\\n\\nThe certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.\"]\n[90,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> WLAN Service >> WLAN Settings>> \\\"Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services\\\" to \\\"Disabled\\\".   \\n\\nv1507 LTSB does not include this group policy setting.  It may be configured through other means such as using group policy from a later version of Windows 10 or a registry update.\"]\n[91,\"Maintain the default permissions for the HKEY_LOCAL_MACHINE registry hive.\\n\\nThe default permissions of the higher level keys are noted below.\\n\\nHKEY_LOCAL_MACHINE\\\\SECURITY\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nSYSTEM - Full Control - This key and subkeys\\nAdministrators - Special - This key and subkeys\\n\\nHKEY_LOCAL_MACHINE\\\\SOFTWARE\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nUsers - Read - This key and subkeys\\nAdministrators - Full Control - This key and subkeys\\nSYSTEM - Full Control - This key and subkeys\\nCREATOR OWNER - Full Control - This key and subkeys\\nALL APPLICATION PACKAGES - Read - This key and subkeys\\n\\nHKEY_LOCAL_MACHINE\\\\SYSTEM\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nUsers - Read - This key and subkeys\\nAdministrators - Full Control - This key and subkeys\\nSYSTEM - Full Control - This key and subkeys\\nCREATOR OWNER - Full Control - This key and subkeys\\nALL APPLICATION PACKAGES - Read - This key and subkeys\\n\\nMicrosoft has also given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID.\\n\\nS-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681\"]\n[92,\"Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> \\\"Turn On Virtualization Based Security\\\" to \\\"Enabled\\\" with \\\"Secure Boot\\\" or \\\"Secure Boot and DMA Protection\\\" selected for \\\"Select Platform Security Level:\\\".\\n\\nA Microsoft article on Credential Guard system requirement can be found at the following link.\\nhttps://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard-requirements\"]\n[93,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Apply UAC restrictions to local accounts on network logons\\\" to \\\"Enabled\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package.  \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[94,\"Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nFor VDIs with persistent desktops, this may be downgraded to a CAT II only where administrators have specific tokens for the VDI. Administrator accounts on virtual desktops must only be used on systems in the VDI; they may not have administrative privileges on any other systems such as servers and physical workstations.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> \\\"Turn On Virtualization Based Security\\\" to \\\"Enabled\\\" with \\\"Enabled with UEFI lock\\\" selected for \\\"Credential Guard Configuration:\\\".\\n\\nv1507 LTSB does not include selection options; select \\\"Enable Credential Guard\\\".\\n\\nA Microsoft TechNet article on Credential Guard, including system requirement details, can be found at the following link:\\n\\nhttps://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard\"]\n[95,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Administrator account status\\\" to \\\"Disabled\\\".\"]\n[96,\"Ensure that Early Launch Antimalware - Boot-Start Driver Initialization policy is set to enforce \\\"Good, unknown and bad but critical\\\" (preventing \\\"bad\\\").\\n\\nIf this needs to be corrected configure the policy value for Computer Configuration >> Administrative Templates >> System >> Early Launch Antimalware >> \\\"Boot-Start Driver Initialization Policy\\\" to \\\"Enabled” with \\\"Good, unknown and bad but critical\\\" selected.\"]\n[97,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Group Policy >> \\\"Configure registry policy processing\\\" to \\\"Enabled\\\" and select the option \\\"Process even if the Group Policy objects have not changed\\\".\"]\n[98,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Guest account status\\\" to \\\"Disabled\\\".\"]\n[99,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> \\\"Turn off downloading of print drivers over HTTP\\\" to \\\"Enabled\\\".\"]\n[100,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Limit local account use of blank passwords to console logon only\\\" to \\\"Enabled\\\".\"]\n[101,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Rename administrator account\\\" to a name other than \\\"Administrator\\\".\"]\n[102,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> \\\"Turn off Internet download for Web publishing and online ordering wizards\\\" to \\\"Enabled\\\".\"]\n[103,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> \\\"Turn off printing over HTTP\\\" to \\\"Enabled\\\".\"]\n[104,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Rename guest account\\\" to a name other than \\\"Guest\\\".\"]\n[105,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nThe default behavior for \\\"Support device authentication using certificate\\\" is \\\"Automatic\\\".\\n\\nIf this needs to be corrected, configured the policy value for Computer Configuration >> Administrative Templates >> System >> Kerberos >> \\\"Support device authentication using certificate\\\" to \\\"Not Configured or \\\"Enabled\\\" with either option selected in \\\"Device authentication behavior using certificate:\\\".\"]\n[106,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> \\\"Do not display network selection UI\\\" to \\\"Enabled\\\".\"]\n[107,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> \\\"Enumerate local users on domain-joined computers\\\" to \\\"Disabled\\\".\"]\n[108,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" to \\\"Enabled\\\".\"]\n[109,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Digitally encrypt or sign secure channel data (always)\\\" to \\\"Enabled\\\".\"]\n[110,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Digitally encrypt secure channel data (when possible)\\\" to \\\"Enabled\\\".\"]\n[111,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> \\\"Require a password when a computer wakes (on battery)\\\" to \\\"Enabled\\\".\"]\n[112,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Digitally sign secure channel data (when possible)\\\" to \\\"Enabled\\\".\"]\n[113,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> \\\"Require a password when a computer wakes (plugged in)\\\" to \\\"Enabled\\\".\"]\n[114,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Remote Assistance >> \\\"Configure Solicited Remote Assistance\\\" to \\\"Disabled\\\".\"]\n[115,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Disable machine account password changes\\\" to \\\"Disabled\\\".\"]\n[116,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Remote Procedure Call >> \\\"Restrict Unauthenticated RPC clients\\\" to \\\"Enabled\\\" and \\\"Authenticated\\\".\"]\n[117,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Runtime >> \\\"Allow Microsoft accounts to be optional\\\" to \\\"Enabled\\\".\"]\n[118,\"This is the default configuration for this setting (30 days).\\n\\nConfigure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Maximum machine account password age\\\" to \\\"30\\\" or less (excluding 0 which is unacceptable).\"]\n[119,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Application Compatibility >> \\\"Turn off Inventory Collector\\\" to \\\"Enabled\\\".\"]\n[120,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Require strong (Windows 2000 or Later) session key\\\" to \\\"Enabled\\\".\"]\n[121,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> \\\"Disallow Autoplay for non-volume devices\\\" to \\\"Enabled\\\".\"]\n[122,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Machine inactivity limit\\\" to \\\"900\\\" seconds\\\" or less, excluding \\\"0\\\" which is effectively disabled.\"]\n[123,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> \\\"Set the default behavior for AutoRun\\\" to \\\"Enabled:Do not execute any autorun commands\\\".\"]\n[124,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> \\\"Turn off AutoPlay\\\" to \\\"Enabled:All Drives\\\".\"]\n[125,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Message text for users attempting to log on\\\" to the following.\\n\\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details.\"]\n[126,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Biometrics >> Facial Features >> \\\"Configure enhanced anti-spoofing\\\" to \\\"Enabled\\\". \\n\\nv1607:\\nThe policy name is \\\"Use enhanced anti-spoofing when available\\\".\"]\n[127,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Credential User Interface >> \\\"Enumerate administrator accounts on elevation\\\" to \\\"Disabled\\\".\"]\n[128,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Message title for users attempting to log on\\\" to \\\"DoD Notice and Consent Banner\\\", \\\"US Department of Defense Warning Statement\\\", or a site-defined equivalent.\\n\\nIf a site-defined title is used, it can in no case contravene or modify the language of the banner text required in WN10-SO-000075.\"]\n[129,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Data Collection and Preview Builds >> \\\"Allow Telemetry\\\" to \\\"Enabled\\\" with \\\"0 - Security [Enterprise Only]\\\" or \\\"1 - Basic\\\" selected in \\\"Options:\\\".   \\n\\nIf an organization is using v1709 or later of Windows 10 this may be configured to \\\"2 - Enhanced\\\" to support Windows Analytics. V-82145 must also be configured to limit the Enhanced diagnostic data to the minimum required by Windows Analytics.\"]\n[130,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Configure Windows Defender SmartScreen\\\" to \\\"Enabled\\\" with \\\"Warn and prevent bypass\\\" selected. \\n\\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Explorer.\\n\\nv1607 LTSB:\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Configure Windows SmartScreen\\\" to \\\"Enabled\\\". (Selection options are not available.)\\n\\nv1507 LTSB:\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Configure Windows SmartScreen\\\" to \\\"Enabled\\\" with \\\"Require approval from an administrator before running downloaded unknown software\\\" selected.\"]\n[131,\"This is the default configuration for this setting (10 logons to cache).\\n\\nConfigure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Number of previous logons to cache (in case domain controller is not available)\\\" to \\\"10\\\" logons or less.\\n\\nThis setting only applies to domain-joined systems, however, it is configured by default on all systems.\"]\n[132,\"The default behavior is for data execution prevention to be turned on for file explorer.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Turn off Data Execution Prevention for Explorer\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[133,\"The default behavior is for File Explorer heap termination on corruption to be enabled.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Turn off heap termination on corruption\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[134,\"The default behavior is for shell protected mode to be turned on for file explorer.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Turn off shell protocol protected mode\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[135,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Smart card removal behavior\\\" to  \\\"Lock Workstation\\\" or \\\"Force Logoff\\\".\"]\n[136,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Prevent bypassing Windows Defender SmartScreen prompts for sites\\\" to \\\"Enabled\\\". \\n\\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.\"]\n[137,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Prevent bypassing Windows Defender SmartScreen prompts for files\\\" to \\\"Enabled\\\". \\n\\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.\"]\n[138,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Microsoft network client: Digitally sign communications (always)\\\" to \\\"Enabled\\\".\"]\n[139,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Configure Password Manager\\\" to \\\"Disabled\\\".\"]\n[140,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Microsoft network client: Send unencrypted password to third-party SMB servers\\\" to \\\"Disabled\\\".\"]\n[141,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Configure Windows Defender SmartScreen\\\" to \\\"Enabled\\\". \\n\\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.\"]\n[142,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Hello for Business >> \\\"Use a hardware security device\\\" to \\\"Enabled\\\". \\n\\nv1507 LTSB:\\nThe policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Passport for Work.\"]\n[143,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Microsoft network server: Digitally sign communications (always)\\\" to \\\"Enabled\\\".\"]\n[144,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> PIN Complexity >> \\\"Minimum PIN length\\\" to \\\"6\\\" or greater. \\n\\nv1607 LTSB:\\nThe policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Windows Hello for Business >> Pin Complexity.\\n\\nv1507 LTSB:\\nThe policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Passport for Work >> Pin Complexity.\"]\n[145,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Connection Client >> \\\"Do not allow passwords to be saved\\\" to \\\"Enabled\\\".\"]\n[146,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Device and Resource Redirection >> \\\"Do not allow drive redirection\\\" to \\\"Enabled\\\".\"]\n[147,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> \\\"Always prompt for password upon connection\\\" to \\\"Enabled\\\".\"]\n[148,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security \\\"Require secure RPC communication\\\" to \\\"Enabled\\\".\"]\n[149,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Allow anonymous SID/Name translation\\\" to \\\"Disabled\\\".\"]\n[150,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> \\\"Set client connection encryption level\\\" to \\\"Enabled\\\" and \\\"High Level\\\".\"]\n[151,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> \\\"Prevent downloading of enclosures\\\" to \\\"Enabled\\\".\"]\n[152,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Do not allow anonymous enumeration of SAM accounts\\\" to \\\"Enabled\\\".\"]\n[153,\"The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> \\\"Turn on Basic feed authentication over HTTP\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[154,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Do not allow anonymous enumeration of SAM accounts and shares\\\" to \\\"Enabled\\\".\"]\n[155,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Search >> \\\"Allow indexing of encrypted files\\\" to \\\"Disabled\\\".\"]\n[156,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Let Everyone permissions apply to anonymous users\\\" to \\\"Disabled\\\".\"]\n[157,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Restrict anonymous access to Named Pipes and Shares\\\" to \\\"Enabled\\\".\"]\n[158,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Allow LocalSystem NULL session fallback\\\" to \\\"Disabled\\\".\"]\n[159,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Allow PKU2U authentication requests to this computer to use online identities\\\" to \\\"Disabled\\\".\"]\n[160,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Configure encryption types allowed for Kerberos\\\" to \\\"Enabled\\\" with only the following selected:\\n\\nAES128_HMAC_SHA1\\nAES256_HMAC_SHA1\\nFuture encryption types\"]\n[161,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Do not store LAN Manager hash value on next password change\\\" to \\\"Enabled\\\".\"]\n[162,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: LAN Manager authentication level\\\" to \\\"Send NTLMv2 response only. Refuse LM & NTLM\\\".\"]\n[163,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: LDAP client signing requirements\\\" to \\\"Negotiate signing\\\" at a minimum.\"]\n[164,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Minimum session security for NTLM SSP based (including secure RPC) clients\\\" to \\\"Require NTLMv2 session security\\\" and \\\"Require 128-bit encryption\\\" (all options selected).\"]\n[165,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Minimum session security for NTLM SSP based (including secure RPC) servers\\\" to \\\"Require NTLMv2 session security\\\" and \\\"Require 128-bit encryption\\\" (all options selected).\"]\n[166,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing\\\" to \\\"Enabled\\\".\"]\n[167,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"System objects: Strengthen default permissions of internal system objects (e.g. Symbolic links)\\\" to \\\"Enabled\\\".\"]\n[168,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Admin Approval Mode for the Built-in Administrator account\\\" to \\\"Enabled\\\".\"]\n[169,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode\\\" to \\\"Prompt for consent on the secure desktop\\\".\"]\n[170,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Behavior of the elevation prompt for standard users\\\" to \\\"Automatically deny elevation requests\\\".\"]\n[171,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Detect application installations and prompt for elevation\\\" to \\\"Enabled\\\".\"]\n[172,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Only elevate UIAccess applications that are installed in secure locations\\\" to \\\"Enabled\\\".\"]\n[173,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Run all administrators in Admin Approval Mode\\\" to \\\"Enabled\\\".\"]\n[174,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Virtualize file and registry write failures to per-user locations\\\" to \\\"Enabled\\\".\"]\n[175,\"Configure the policy value for User Configuration >> Administrative Templates >> Start Menu and Taskbar >> Notifications >> \\\"Turn off toast notifications on the lock screen\\\" to \\\"Enabled\\\".\"]\n[176,\"The default behavior is for Windows to mark file attachments with their zone information.\\n\\nIf this needs to be corrected, configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Attachment Manager >> \\\"Do not preserve zone information in file attachments\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[177,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Access Credential Manager as a trusted caller\\\" to be defined but containing no entries (blank).\"]\n[178,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Access this computer from the network\\\" to only include the following groups or accounts:\\n\\nAdministrators   \\nRemote Desktop Users\"]\n[179,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Act as part of the operating system\\\" to be defined but containing no entries (blank).\"]\n[180,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Allow log on locally\\\" to only include the following groups or accounts:\\n\\nAdministrators\\nUsers\"]\n[181,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Back up files and directories\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[182,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Change the system time\\\" to only include the following groups or accounts:\\n\\nAdministrators\\nLOCAL SERVICE\\nNT SERVICE\\\\autotimesvc is added in v1909 cumulative update.\"]\n[183,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create a pagefile\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[184,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create a token object\\\" to be defined but containing no entries (blank).\"]\n[185,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create global objects\\\" to only include the following groups or accounts:\\n\\nAdministrators\\nLOCAL SERVICE\\nNETWORK SERVICE\\nSERVICE\"]\n[186,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create permanent shared objects\\\" to be defined but containing no entries (blank).\"]\n[187,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create symbolic links\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[188,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Debug programs\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[189,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny access to this computer from the network\\\" to include the following.\\n\\nDomain Systems Only:\\nEnterprise Admins group\\nDomain Admins group\\nLocal account (see Note below)\\n\\nAll Systems:\\nGuests group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nNote: \\\"Local account\\\" is a built-in security group used to assign user rights and permissions to all local accounts.\"]\n[190,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny log on as a batch job\\\" to include the following.\\n\\nDomain Systems Only:\\nEnterprise Admin Group\\nDomain Admin Group\"]\n[191,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny log on as a service\\\" to include the following.\\n\\nDomain Systems Only:\\nEnterprise Admins Group\\nDomain Admins Group\"]\n[192,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny log on locally\\\" to include the following.\\n\\nDomain Systems Only:\\nEnterprise Admins Group\\nDomain Admins Group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nAll Systems:\\nGuests Group\"]\n[193,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny log on through Remote Desktop Services\\\" to include the following.\\n\\nIf Remote Desktop Services is not used by the organization, assign the Everyone group this right to prevent all access.\\n\\nDomain Systems Only:\\nEnterprise Admins group\\nDomain Admins group\\nLocal account (see Note below)\\n\\nAll Systems:\\nGuests group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nNote: \\\"Local account\\\" is a built-in security group used to assign user rights and permissions to all local accounts.\"]\n[194,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Enable computer and user accounts to be trusted for delegation\\\" to be defined but containing no entries (blank).\"]\n[195,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Force shutdown from a remote system\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[196,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Impersonate a client after authentication\\\" to only include the following groups or accounts:\\n\\nAdministrators\\nLOCAL SERVICE\\nNETWORK SERVICE\\nSERVICE\"]\n[197,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Load and unload device drivers\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[198,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Lock pages in memory\\\" to be defined but containing no entries (blank).\"]\n[199,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Manage auditing and security log\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[200,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Modify firmware environment values\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[201,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Perform volume maintenance tasks\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[202,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Profile single process\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[203,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Restore files and directories\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[204,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Take ownership of files or other objects\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[205,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Delivery Optimization >> \\\"Download Mode\\\" to \\\"Enabled\\\" with any option except \\\"Internet\\\" selected.\\n\\nAcceptable selections include:\\nBypass (100)\\nGroup (2)\\nHTTP only (0)\\nLAN (1)\\nSimple (99)\\n\\nv1507 (LTSB) does not include this group policy setting locally. For domain joined systems, configure through domain group policy as \\\"HTTP only (0)\\\" or \\\"Lan (1)\\\". Standalone systems configure using Settings >> Update & Security >> Windows Update >> Advanced Options >> \\\"Choose how updates are delivered\\\" with either \\\"Off\\\" or \\\"PCs on my local network\\\" selected.\"]\n[206,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Audit Process Creation >> \\\"Include command line in process creation events\\\" to \\\"Enabled\\\".\"]\n[207,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> \\\"Turn on PowerShell Script Block Logging\\\" to \\\"Enabled\\\".\"]\n[208,\"Configure DEP to at least OptOut.\\n\\nNote: Suspend BitLocker before making changes to the DEP configuration.\\n\\nOpen a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).\\nEnter \\\"BCDEDIT /set {current} nx OptOut\\\".  (If using PowerShell \\\"{current}\\\" must be enclosed in quotes.)\\n\\\"AlwaysOn\\\", a more restrictive selection, is also valid but does not allow applications that do not function properly to be opted out of DEP.\\n\\nOpted out exceptions can be configured in the \\\"System Properties\\\".\\n\\nOpen \\\"System\\\" in Control Panel.\\nSelect \\\"Advanced system settings\\\".\\nClick \\\"Settings\\\" in the \\\"Performance\\\" section.\\nSelect the \\\"Data Execution Prevention\\\" tab.\\nApplications that are opted out are configured in the window below the selection \\\"Turn on DEP for all programs and services except those I select:\\\".\"]\n[209,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Enable Structured Exception Handling Overwrite Protection (SEHOP)\\\" to \\\"Enabled\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package. \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[210,\"Disable \\\"Windows PowerShell 2.0\\\" on the system.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\nEnter the following:\\nDisable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root\\n\\nThis command should disable both \\\"MicrosoftWindowsPowerShellV2Root\\\" and \\\"MicrosoftWindowsPowerShellV2\\\" which correspond to \\\"Windows PowerShell 2.0\\\" and \\\"Windows PowerShell 2.0 Engine\\\" respectively in \\\"Turn Windows features on or off\\\".\\n\\nAlternately:\\nSearch for \\\"Features\\\".\\nSelect \\\"Turn Windows features on or off\\\".\\nDe-select \\\"Windows PowerShell 2.0\\\".\"]\n[211,\"Disable the SMBv1 protocol.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter the following:\\nDisable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol\\n\\nAlternately:\\nSearch for \\\"Features\\\".\\n\\nSelect \\\"Turn Windows features on or off\\\".\\n\\nDe-select \\\"SMB 1.0/CIFS File Sharing Support\\\".\"]\n[212,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Account Lockout\\\" with \\\"Failure\\\" selected.\"]\n[213,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> \\\"Audit Authorization Policy Change\\\" with \\\"Success\\\" selected.\"]\n[214,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"WDigest Authentication (disabling may require KB2871997)\\\" to \\\"Disabled\\\".\\n\\nThe patch referenced in the policy title is not required for Windows 10.\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package.  \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[215,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Network Connections >> \\\"Prohibit use of Internet Connection Sharing on your DNS domain network\\\" to \\\"Enabled\\\".\"]\n[216,\"Navigate to the policy Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Restrict clients allowed to make remote calls to SAM\\\".\\n\\nSelect \\\"Edit Security\\\" to configure the \\\"Security descriptor:\\\".\\n\\nAdd \\\"Administrators\\\" in \\\"Group or user names:\\\" if it is not already listed (this is the default).\\n\\nSelect \\\"Administrators\\\" in \\\"Group or user names:\\\".\\n\\nSelect \\\"Allow\\\" for \\\"Remote Access\\\" in \\\"Permissions for \\\"Administrators\\\".\\n\\nClick \\\"OK\\\".\\n\\nThe \\\"Security descriptor:\\\" must be populated with \\\"O:BAG:BAD:(A;;RC;;;BA) for the policy to be enforced.\"]\n[217,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Cloud Content >> \\\"Turn off Microsoft consumer experiences\\\" to \\\"Enabled\\\".\"]\n[218,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Remove \\\"Run as Different User\\\" from context menus\\\" to \\\"Enabled\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package.  \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[219,\"Turn off Bluetooth radios not organizationally approved. Establish an organizational policy for the use of Bluetooth.\"]\n[220,\"Turn off Bluetooth radios when not in use. Establish an organizational policy for the use of Bluetooth to include training of personnel.\"]\n[221,\"Configure Bluetooth to notify users if devices attempt to connect.\\nView Bluetooth Settings.\\nEnsure \\\"Alert me when a new Bluetooth device wants to connect\\\" is checked.\"]\n[222,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit Other Object Access Events\\\" with \\\"Failure\\\" selected.\"]\n[223,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit Other Object Access Events\\\" with \\\"Success\\\" selected.\"]\n[224,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> SSL Configuration Settings >> \\\"ECC Curve Order\\\" to \\\"Enabled\\\" with \\\"ECC Curve Order:\\\" including the following in the order listed:\\n\\nNistP384\\nNistP256\"]\n[225,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Game Recording and Broadcasting >> \\\"Enables or disables Windows Game Recording and Broadcasting\\\" to \\\"Disabled\\\".\"]\n[226,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Credentials Delegation >> \\\"Remote host allows delegation of non-exportable credentials\\\" to \\\"Enabled\\\".\"]\n[227,\"Configure the \\\"Secondary Logon\\\" service \\\"Startup Type\\\" to \\\"Disabled\\\".\"]\n[228,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit File Share\\\" with \\\"Success\\\" selected.\"]\n[229,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Configure SMBv1 Server\\\" to \\\"Disabled\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package. \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.   \\n\\nThe system must be restarted for the change to take effect.\"]\n[230,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Configure SMBv1 client driver\\\" to \\\"Enabled\\\" with \\\"Disable driver (recommended)\\\" selected for \\\"Configure MrxSmb10 driver\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package. \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.   \\n\\nThe system must be restarted for the changes to take effect.\"]\n[231,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit File Share\\\" with \\\"Failure\\\" selected.\"]\n[232,\"Remove any unresolved SIDs found in User Rights assignments and determined to not be for currently valid accounts or groups by removing the accounts or groups from the appropriate group policy.\"]\n[233,\"Configure UEFI firmware to run in UEFI mode, not Legacy BIOS mode.\"]\n[234,\"Enable Secure Boot in the system firmware.\"]\n[235,\"Ensure Exploit Protection system-level mitigation, \\\"Data Execution Prevention (DEP)\\\", is turned on.  The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Data Execution Prevention (DEP)\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn DEP on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <DEP Enable=\\\"true\\\"></DEP>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[236,\"Ensure Exploit Protection system-level mitigation, \\\"Randomize memory allocations (Bottom-Up ASLR)\\\" is turned on. The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Randomize memory allocations (Bottom-Up ASLR)\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn Bottom-Up ASLR on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <ASLR BottomUp=\\\"true\\\"</ASLR>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[237,\"Ensure Exploit Protection system-level mitigation, \\\"Control flow guard (CFG)\\\", is turned on. The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Control flow guard (CFG)\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn CFG on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <ControlFlowGuard Enable=\\\"true\\\"></ControlFlowGuard>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[238,\"Ensure Exploit Protection system-level mitigation, \\\"Validate exception chains (SEHOP)\\\", is turned on. The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Validate exception chains (SEHOP)\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn SEHOP on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <SEHOP Enable=\\\"true\\\"></SEHOP>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[239,\"Ensure Exploit Protection system-level mitigation, \\\"Validate heap integrity\\\" is turned on. The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Validate heap integrity\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn Validate heap integrity on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <Heap TerminateOnError=\\\"true\\\"></Heap>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[240,\"Ensure the following mitigations are configured as shown for Acrobat.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[241,\"Ensure the following mitigations are configured as shown for AcroRd32.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot= False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[242,\"Ensure the following mitigations are configured as shown forchrome.exe:\\n\\nDEP:\\nOverrideDEP: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[243,\"Ensure the following mitigations are configured as shown for EXCEL.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[244,\"Ensure the following mitigations are configured as shown  firefox.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: On\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[245,\"Ensure the following mitigations are configured as shown for FLTLDR.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False \\nOverrideExportAddressFilterPlus: False \\nOverrideImportAddressFilter: False \\nOverrideEnableRopStackPivot: False \\nOverrideEnableRopCallerCheck: False \\nOverrideEnableRopSimExec: False\\n\\nChild Process:\\nOverrideChildProcess: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[246,\"Ensure the following mitigations are configured as shown GROOVE.EXE:\\n\\nDEP:\\nOverrideDEP: False\\n\\nASLR:\\nOverrideBlockRemoteImages: False\\n\\nImageLoad:\\nForceRelocateImages: True\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nChild Process:\\nOverrideChildProcess: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[247,\"Ensure the following mitigations are configured as shown for iexplore.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[248,\"Ensure the following mitigations are configured as shown for INFOPATH.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[249,\"Ensure the following mitigations are configured for java.exe, javaw.exe, and javaws.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[250,\"Ensure the following mitigations are configured as shown for lync.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[251,\"Ensure the following mitigations are configured as shown for MSACCESS.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[252,\"Ensure the following mitigations are configured as shown for MSPUB.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[253,\"Ensure the following mitigations are configured for OneDrive.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nOverrideRelocateImages: NOTSET\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False \\nOverrideExportAddressFilterPlus: False \\nOverrideImportAddressFilter: False \\nOverrideEnableRopStackPivot: False \\nOverrideEnableRopCallerCheck: False \\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[254,\"Ensure the following mitigations are configured as shown for OIS.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[255,\"Ensure the following mitigations are configured as shown for OUTLOOK.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[256,\"Ensure the following mitigations are configured as shown forplugin-container.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[257,\"Ensure the following mitigations are configured as shown for POWERPNT.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[258,\"Ensure the following mitigations are configured as shown for PPTVIEW.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[259,\"Ensure the following mitigations are configured as shown for VISIO.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[260,\"Ensure the following mitigations are configured as shown for VPREVIEW.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[261,\"Ensure the following mitigations are configured as shown for WINWORD.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[262,\"Ensure the following mitigations are configured as shown for wmplayer.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[263,\"Ensure the following mitigations are configured as shown for wordpad.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[264,\"Establish and enforce a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. Define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.\\n\\nImplement technical measures where feasible such as removal of applications or use of application whitelisting to restrict the use of applications that can access the Internet.\"]\n[265,\"Configure the policy value for User Configuration >> Administrative Templates >> OneDrive >> \\\"Prevent users from synchronizing personal OneDrive accounts\\\" to \\\"Enabled\\\".   \\n\\nGroup policy files for OneDrive are located on a system with OneDrive in \\\"%localappdata%\\\\Microsoft\\\\OneDrive\\\\BuildNumber\\\\adm\\\\\\\".\\n\\nCopy the OneDrive.admx and .adml files to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[266,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Prevent certificate error overrides\\\" to \\\"Enabled\\\".\"]\n[267,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Data Collection and Preview Builds >> \\\"Limit Enhanced diagnostic data to the minimum required by Windows Analytics\\\" to \\\"Enabled\\\" with \\\"Enable Windows Analytics collection\\\" selected in \\\"Options:\\\".\"]\n[268,\"Configure the policy value for Computer Configuration >> Administrative Templates >> OneDrive >> \\\"Allow syncing OneDrive accounts for only specific organizations\\\", with the Tenant GUID of the organization's DoD instance in the format 1111-2222-3333-4444.\\n\\nIf the organization does not have an instance of OneDrive, configure the Tenant GUID with \\\"1111-2222-3333-4444\\\".\\n\\nGroup policy files for OneDrive are located on a system with OneDrive in \\\"%localappdata%\\\\Microsoft\\\\OneDrive\\\\BuildNumber\\\\adm\\\\\\\".\\n\\nCopy the OneDrive.admx and .adml files to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[269,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> \\\"Let Windows apps activate with voice while the system is locked\\\" to \\\"Enabled\\\" with “Default for all Apps:” set to “Force Deny”. \\n\\nThe requirement is NA if the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> \\\"Let Windows apps activate with voice\\\" is configured to \\\"Enabled\\\" with “Default for all Apps:” set to “Force Deny”.\"]\n[270,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> BitLocker Drive Encryption >> Operating System Drives \\\"Require additional authentication at startup\\\" to \\\"Enabled\\\" with \\\"Configure TPM Startup PIN:\\\" set to \\\"Require startup PIN with TPM\\\" or with \\\"Configure TPM startup key and PIN:\\\" set to \\\"Require startup key and PIN with TPM\\\".\"]\n[271,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> BitLocker Drive Encryption >> Operating System Drives \\\"Configure minimum PIN length for startup\\\" to \\\"Enabled\\\" with \\\"Minimum characters:\\\" set to \\\"6\\\" or greater.\"]\n[272,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Other Logon/Logoff Events\\\" with \\\"Failure\\\" selected.\"]\n[273,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Other Logon/Logoff Events\\\" with \\\"Success\\\" selected.\"]\n[274,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> “Detailed File Share\\\" with \\\"Failure\\\" selected.\"]\n[275,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> “Audit MPSSVC Rule-Level Policy Change\\\" with \\\"Success\\\" selected.\"]\n[276,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> “Audit MPSSVC Rule-Level Policy Change\\\" with \\\"Failure\\\" selected.\"]\n[277,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change>> \\\"Audit Other Policy Change Events\\\" with \\\"Success\\\" selected.\"]\n[278,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change>> \\\"Audit Other Policy Change Events\\\" with \\\"Failure\\\" selected.\"]\n[279,\"Change the enabled local Administrator account password at least every \\\"60\\\" days.\\n\\nAutomated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to meet this requirement.\"]\n[280,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Kernel DMA Protection >> \\\"Enumeration policy for external devices incompatible with Kernel DMA Protection\\\" to \\\"Enabled\\\" with \\\"Enumeration Policy\\\" set to \\\"Block All\\\".\"]\n[281,\"Disable the convenience PIN sign-in. \\n\\nIf this needs to be corrected configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> Set \\\"Turn on convenience PIN sign-in\\\" to \\\"Disabled”.\"]\n[282,\"Disable the convenience PIN sign-in. \\n\\nIf this needs to be corrected configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Ink Workspace   >> Set \\\" Allow Windows Ink Workspace\\\" to \\\"Enabled” Set Options ‘On, but disallow access above lock”.\"]\n[283,\"Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Cloud Content >> \\\"Do not suggest third-party content in Windows spotlight\\\" to \\\"Enabled\"]\n[284,\"If the camera is not disconnected or covered, the following registry entry is required.\\n \\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistryPath\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\CapabilityAccessManager\\\\ConsentStore\\\\webcam\\n\\nValue Name: Deny\"]\n[285,\"Set non-persistent VM sessions to not exceed 24 hours.\"]\n[286,\"Ensure the following settings are configured for Windows 10 locally or applied through group policy. \\n\\nConfigure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane \\\"Turn off Preview Pane\\\" to \\\"Enabled\\\".\\n\\nConfigure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane \\\"Turn on or off details pane\\\" to \\\"Enabled\\\" and \\\"Configure details pane\\\" to \\\"Always hide\\\".\"]\n[287,\"For non-domain joined systems, configuring Windows Hello for sign on options would be suggested based on the organizations needs and capabilities.\\n \\nNote: Before applying, the supplemental guidance provided with the STIG should be consulted to ensure continued access to the operating system.\"]\n[288,\"Run the following command to determine which package owns the file:\\n\\n# rpm -qf <filename>\\n\\nReset the user and group ownership of files within a package with the following command:\\n\\n#rpm --setugids <packagename>\\n\\n\\nReset the permissions of files within a package with the following command:\\n\\n#rpm --setperms <packagename>\"]\n[289,\"Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCreate a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command:\\n\\n# touch /etc/dconf/db/local.d/01-banner-message\\n\\nAdd the following line to the [org/gnome/login-screen] section of the \\\"/etc/dconf/db/local.d/01-banner-message\\\":\\n\\n[org/gnome/login-screen]\\nbanner-message-enable=true\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[290,\"Configure the operating system to display the approved Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCreate a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command:\\n\\n# touch /etc/dconf/db/local.d/01-banner-message\\n\\nAdd the following line to the [org/gnome/login-screen] section of the \\\"/etc/dconf/db/local.d/01-banner-message\\\":\\n\\n[org/gnome/login-screen]\\n\\nbanner-message-enable=true\\n\\nbanner-message-text='You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\\\n-At any time, the USG may inspect and seize data stored on this IS.\\\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. '\\n\\nNote: The \\\"\\\\n \\\" characters are for formatting only. They will not be displayed on the GUI.\\n\\nRun the following command to update the database:\\n# dconf update\"]\n[291,\"Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via the command line by editing the \\\"/etc/issue\\\" file.\\n\\nReplace the default text with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is:\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details.\\\"\"]\n[292,\"Configure the operating system to enable a user's session lock until that user re-establishes access using established identification and authentication procedures.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following example:\\n\\n# touch /etc/dconf/db/local.d/00-screensaver\\n\\nEdit the \\\"[org/gnome/desktop/screensaver]\\\" section of the database file and add or update the following lines:\\n\\n# Set this to true to lock the screen when the screensaver activates\\nlock-enabled=true\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[293,\"Configure the operating system to uniquely identify and authenticate users using multifactor authentication via a graphical user logon.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example is using the database local for the system, so if the system is using another database in \\\"/etc/dconf/profile/user\\\", the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/00-defaults\\n\\nEdit \\\"[org/gnome/login-screen]\\\" and add or update the following line:\\nenable-smartcard-authentication=true   \\n\\nUpdate the system databases:\\n# dconf update\"]\n[294,\"Configure the operating system to initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command:\\n\\n# touch /etc/dconf/db/local.d/00-screensaver\\n\\nEdit /etc/dconf/db/local.d/00-screensaver and add or update the following lines:\\n\\n[org/gnome/desktop/session]\\n# Set the lock time out to 900 seconds before the session is considered idle\\nidle-delay=uint32 900\\n\\nYou must include the \\\"uint32\\\" along with the integer key values as shown.\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[295,\"Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example below is using the database \\\"local\\\" for the system, so if the system is using another database in \\\"/etc/dconf/profile/user\\\", the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/locks/session\\n\\nAdd the setting to lock the screensaver lock delay:\\n\\n/org/gnome/desktop/screensaver/lock-delay\"]\n[296,\"Configure the operating system to prevent a user from overriding a session lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example below is using the database \\\"local\\\" for the system, so if the system is using another database in /etc/dconf/profile/user, the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/locks/session\\n\\nAdd the setting to lock the session idle delay:\\n\\n/org/gnome/desktop/session/idle-delay\"]\n[297,\"Install the screen package to allow the initiation of a session lock after a 15-minute period of inactivity.\\n\\nInstall the screen program (if it is not on the system) with the following command:\\n\\n# yum install screen   \\n\\nOR\\n\\nInstall the tmux program (if it is not on the system) with the following command:\\n\\n#yum install tmux\"]\n[298,\"Configure the operating system to initiate a session lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\n# touch /etc/dconf/db/local.d/00-screensaver\\n\\nAdd the setting to enable screensaver locking after 15 minutes of inactivity:\\n\\n[org/gnome/desktop/screensaver]\\n\\nidle-activation-enabled=true\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[299,\"Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example below is using the database \\\"local\\\" for the system, so if the system is using another database in \\\"/etc/dconf/profile/user\\\", the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/locks/session\\n\\nAdd the setting to lock the screensaver idle-activation-enabled setting:\\n\\n/org/gnome/desktop/screensaver/idle-activation-enabled\"]\n[300,\"Configure the operating system to initiate a session lock for graphical user interfaces when a screensaver is activated.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\n# touch /etc/dconf/db/local.d/00-screensaver\\n\\nAdd the setting to enable session locking when a screensaver is activated:\\n\\n[org/gnome/desktop/screensaver]\\nlock-delay=uint32 5\\n\\nThe \\\"uint32\\\" must be included along with the integer key values as shown.\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[301,\"Configure PAM to utilize /etc/pam.d/system-auth when changing passwords.\\n\\nAdd the following line to \\\"/etc/pam.d/passwd\\\" (or modify the line to have the required value):\\n\\npassword     substack    system-auth\"]\n[302,\"Configure the operating system to use \\\"pwquality\\\" to enforce password complexity rules.\\n\\nAdd the following line to \\\"/etc/pam.d/system-auth\\\" (or modify the line to have the required value):\\n\\npassword required pam_pwquality.so retry=3\\n\\nNote: The value of \\\"retry\\\" should be between \\\"1\\\" and \\\"3\\\".\"]\n[303,\"Configure the operating system to enforce password complexity by requiring that at least one upper-case character be used by setting the \\\"ucredit\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" (or modify the line to have the required value):\\n\\nucredit = -1\"]\n[304,\"Configure the system to require at least one lower-case character when creating or changing a password.\\n\\nAdd or modify the following line \\nin \\\"/etc/security/pwquality.conf\\\":\\n\\nlcredit = -1\"]\n[305,\"Configure the operating system to enforce password complexity by requiring that at least one numeric character be used by setting the \\\"dcredit\\\" option.\\n\\nAdd the following line to /etc/security/pwquality.conf (or modify the line to have the required value):\\n\\ndcredit = -1\"]\n[306,\"Configure the operating system to enforce password complexity by requiring that at least one special character be used by setting the \\\"ocredit\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" (or modify the line to have the required value):\\n\\nocredit = -1\"]\n[307,\"Configure the operating system to require the change of at least eight of the total number of characters when passwords are changed by setting the \\\"difok\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" (or modify the line to have the required value):\\n\\ndifok = 8\"]\n[308,\"Configure the operating system to require the change of at least four character classes when passwords are changed by setting the \\\"minclass\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf conf\\\" (or modify the line to have the required value):\\n\\nminclass = 4\"]\n[309,\"Configure the operating system to require the change of the number of repeating consecutive characters when passwords are changed by setting the \\\"maxrepeat\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf conf\\\" (or modify the line to have the required value):\\n\\nmaxrepeat = 3\"]\n[310,\"Configure the operating system to require the change of the number of repeating characters of the same character class when passwords are changed by setting the \\\"maxclassrepeat\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" conf (or modify the line to have the required value):\\n\\nmaxclassrepeat = 4\"]\n[311,\"Configure the operating system to store only SHA512 encrypted representations of passwords.\\n\\nAdd the following line in \\\"/etc/pam.d/system-auth\\\":\\npam_unix.so sha512 shadow try_first_pass use_authtok\\n\\nAdd the following line in \\\"/etc/pam.d/password-auth\\\":\\npam_unix.so sha512 shadow try_first_pass use_authtok\\n\\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[312,\"Configure the operating system to store only SHA512 encrypted representations of passwords.\\n\\nAdd or update the following line in \\\"/etc/login.defs\\\":\\n\\nENCRYPT_METHOD SHA512\"]\n[313,\"Configure the operating system to store only SHA512 encrypted representations of passwords.\\n\\nAdd or update the following line in \\\"/etc/libuser.conf\\\" in the [defaults] section: \\n\\ncrypt_style = sha512\"]\n[314,\"Configure the operating system to enforce 24 hours/1 day as the minimum password lifetime.\\n\\nAdd the following line in \\\"/etc/login.defs\\\" (or modify the line to have the required value):\\n\\nPASS_MIN_DAYS     1\"]\n[315,\"Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime:\\n\\n# chage -m 1 [user]\"]\n[316,\"Configure the operating system to enforce a 60-day maximum password lifetime restriction.\\n\\nAdd the following line in \\\"/etc/login.defs\\\" (or modify the line to have the required value):\\n\\nPASS_MAX_DAYS     60\"]\n[317,\"Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction.\\n\\n# chage -M 60 [user]\"]\n[318,\"Configure the operating system to prohibit password reuse for a minimum of five generations.\\n\\nAdd the following line in \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" (or modify the line to have the required value):\\n\\npassword    requisite     pam_pwhistory.so use_authtok remember=5 retry=3\\n   \\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[319,\"Configure operating system to enforce a minimum 15-character password length.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" (or modify the line to have the required value):\\n\\nminlen = 15\"]\n[320,\"If an account is configured for password authentication but does not have an assigned password, it may be possible to log on to the account without authenticating.\\n\\nRemove any instances of the \\\"nullok\\\" option in \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" to prevent logons with empty passwords.\\n\\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[321,\"To explicitly disallow remote logon from accounts with empty passwords, add or correct the following line in \\\"/etc/ssh/sshd_config\\\":\\n\\nPermitEmptyPasswords no\\n\\nThe SSH service must be restarted for changes to take effect.  Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.\"]\n[322,\"Configure the operating system to disable account identifiers (individuals, groups, roles, and devices) after the password expires.\\n\\nAdd the following line to \\\"/etc/default/useradd\\\" (or modify the line to have the required value):\\n\\nINACTIVE=0\"]\n[323,\"Configure the operating system to lock an account for the maximum period when three unsuccessful logon attempts in 15 minutes are made.\\n\\nModify the first three lines of the auth section and the first line of the account section of the \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" files to match the following lines:\\n\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\nauth sufficient pam_unix.so try_first_pass\\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so   \\n\\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[324,\"Configure the operating system to lock automatically the root account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are made.\\n\\nModify the first three lines of the auth section and the first line of the account section of the \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" files to match the following lines:\\n\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\nauth sufficient pam_unix.so try_first_pass\\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so\\n\\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[325,\"Configure the operating system to require users to supply a password for privilege escalation.\\n\\nCheck the configuration of the \\\"/etc/sudoers\\\" file with the following command:\\n# visudo\\n\\nRemove any occurrences of \\\"NOPASSWD\\\" tags in the file.   \\n\\nCheck the configuration of the /etc/sudoers.d/* files with the following command:\\n# grep -i nopasswd /etc/sudoers.d/*\\n\\nRemove any occurrences of \\\"NOPASSWD\\\" tags in the file.\"]\n[326,\"Configure the operating system to require users to reauthenticate for privilege escalation.\\n\\nCheck the configuration of the \\\"/etc/sudoers\\\" file with the following command:\\n\\n# visudo\\nRemove any occurrences of \\\"!authenticate\\\" tags in the file.\\n\\nCheck the configuration of the \\\"/etc/sudoers.d/*\\\" files with the following command:\\n\\n# grep -i authenticate /etc/sudoers /etc/sudoers.d/*\\nRemove any occurrences of \\\"!authenticate\\\" tags in the file(s).\"]\n[327,\"Configure the operating system to enforce a delay of at least four seconds between logon prompts following a failed console logon attempt.\\n\\nModify the \\\"/etc/login.defs\\\" file to set the \\\"FAIL_DELAY\\\" parameter to \\\"4\\\" or greater:\\n\\nFAIL_DELAY 4\"]\n[328,\"Configure the operating system to not allow an unattended or automatic logon to the system via a graphical user interface.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nAdd or edit the line for the \\\"AutomaticLoginEnable\\\" parameter in the [daemon] section of the \\\"/etc/gdm/custom.conf\\\" file to \\\"false\\\":\\n\\n[daemon]\\nAutomaticLoginEnable=false\"]\n[329,\"Configure the operating system to not allow an unrestricted account to log on to the system via a graphical user interface.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nAdd or edit the line for the \\\"TimedLoginEnable\\\" parameter in the [daemon] section of the \\\"/etc/gdm/custom.conf\\\" file to \\\"false\\\":\\n\\n[daemon]\\nTimedLoginEnable=false\"]\n[330,\"Configure the operating system to not allow users to override environment variables to the SSH daemon.\\n\\nEdit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for \\\"PermitUserEnvironment\\\" keyword and set the value to \\\"no\\\":\\n\\nPermitUserEnvironment no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[331,\"Configure the operating system to not allow a non-certificate trusted host SSH logon to the system.\\n\\nEdit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for \\\"HostbasedAuthentication\\\" keyword and set the value to \\\"no\\\":\\n\\nHostbasedAuthentication no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[332,\"Configure the system to encrypt the boot password for root.\\n\\nGenerate an encrypted grub2 password for root with the following command:\\n\\nNote: The hash generated is an example.\\n\\n# grub2-mkpasswd-pbkdf2\\n\\nEnter Password:\\nReenter Password:\\nPBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45\\n\\nEdit \\\"/etc/grub.d/40_custom\\\" and add the following lines below the comments:\\n\\n# vi /etc/grub.d/40_custom\\n\\nset superusers=\\\"root\\\"\\n\\npassword_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command}\\n\\nGenerate a new \\\"grub.conf\\\" file with the new password with the following commands:\\n\\n# grub2-mkconfig --output=/tmp/grub2.cfg\\n# mv /tmp/grub2.cfg /boot/grub2/grub.cfg\"]\n[333,\"Configure the operating system to require authentication upon booting into single-user and maintenance modes.\\n\\nAdd or modify the \\\"ExecStart\\\" line in \\\"/usr/lib/systemd/system/rescue.service\\\" to include \\\"/usr/sbin/sulogin\\\":\\n\\nExecStart=-/bin/sh -c \\\"/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default\\\"\"]\n[334,\"Configure the system to encrypt the boot password for root.\\n\\nGenerate an encrypted grub2 password for root with the following command:\\n\\nNote: The hash generated is an example.\\n  \\n# grub2-setpassword\\nEnter password:\\nConfirm password:\\n\\nEdit the /boot/grub2/grub.cfg file and add or modify the following lines in the \\\"### BEGIN /etc/grub.d/01_users ###\\\" section:\\n\\nset superusers=\\\"root\\\"\\nexport superusers\"]\n[335,\"Configure the system to encrypt the boot password for root.\\n\\nGenerate an encrypted grub2 password for root with the following command:\\n\\nNote: The hash generated is an example.\\n\\n# grub2-mkpasswd-pbkdf2\\n\\nEnter Password:\\nReenter Password:\\nPBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45\\n\\nEdit \\\"/etc/grub.d/40_custom\\\" and add the following lines below the comments:\\n\\n# vi /etc/grub.d/40_custom\\n\\nset superusers=\\\"root\\\"\\n\\npassword_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command}\\n\\nGenerate a new \\\"grub.conf\\\" file with the new password with the following commands:\\n\\n# grub2-mkconfig --output=/tmp/grub2.cfg\\n# mv /tmp/grub2.cfg /boot/efi/EFI/redhat/grub.cfg\"]\n[336,\"Configure the system to encrypt the boot password for root.\\n\\nGenerate an encrypted grub2 password for root with the following command:\\n\\nNote: The hash generated is an example.\\n  \\n# grub2-setpassword\\nEnter password:\\nConfirm password:\\n\\nEdit the /boot/efi/EFI/redhat/grub.cfg file and add or modify the following lines in the \\\"### BEGIN /etc/grub.d/01_users ###\\\" section:\\n\\nset superusers=\\\"root\\\"\\nexport superusers\"]\n[337,\"Configure the operating system to require individuals to be authenticated with a multifactor authenticator.\\n\\nEnable smartcard logons with the following commands:\\n\\n# authconfig --enablesmartcard --smartcardaction=0 --update\\n# authconfig --enablerequiresmartcard -update\\n\\nModify the \\\"/etc/pam_pkcs11/pkcs11_eventmgr.conf\\\" file to uncomment the following line:\\n\\n#/usr/X11R6/bin/xscreensaver-command -lock\\n\\nModify the \\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" file to use the cackey module if required.\"]\n[338,\"Configure the operating system to disable non-essential capabilities by removing the rsh-server package from the system with the following command:\\n\\n# yum remove rsh-server\"]\n[339,\"Configure the operating system to disable non-essential capabilities by removing the \\\"ypserv\\\" package from the system with the following command:\\n\\n# yum remove ypserv\"]\n[340,\"Configure the operating system to prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.\\n\\nUse the following command to map a new user to the \\\"sysdam_u\\\" role: \\n\\n#semanage login -a -s sysadm_u <username>\\n\\nUse the following command to map an existing user to the \\\"sysdam_u\\\" role:\\n\\n#semanage login -m -s sysadm_u <username>\\n\\nUse the following command to map a new user to the \\\"staff_u\\\" role:\\n\\n#semanage login -a -s staff_u <username>\\n\\nUse the following command to map an existing user to the \\\"staff_u\\\" role:\\n\\n#semanage login -m -s staff_u <username>\\n\\nUse the following command to map a new user to the \\\"user_u\\\" role:\\n\\n# semanage login -a -s user_u <username>\\n\\nUse the following command to map an existing user to the \\\"user_u\\\" role:\\n\\n# semanage login -m -s user_u <username>\"]\n[341,\"Configure the file integrity tool to run automatically on the system at least weekly. The following example output is generic. It will set cron to run AIDE daily, but other file integrity tools may be used:  \\n\\n# more /etc/cron.daily/aide\\n#!/bin/bash\\n\\n/usr/sbin/aide --check | /bin/mail -s \\\"$HOSTNAME - Daily aide integrity check run\\\" root@sysname.mil\"]\n[342,\"Configure the operating system to notify designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system. \\n\\nThe following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis. \\n\\n# more /etc/cron.daily/aide\\n\\n/usr/sbin/aide --check | /bin/mail -s \\\"$HOSTNAME - Daily aide integrity check run\\\" root@sysname.mil\"]\n[343,\"Configure the operating system to verify the signature of packages from a repository prior to install by setting the following option in the \\\"/etc/yum.conf\\\" file:\\n\\ngpgcheck=1\"]\n[344,\"Configure the operating system to verify the signature of local packages prior to install by setting the following option in the \\\"/etc/yum.conf\\\" file:\\n\\nlocalpkg_gpgcheck=1\"]\n[345,\"Configure the operating system to disable the ability to use the USB Storage kernel module.\\n\\nCreate a file under \\\"/etc/modprobe.d\\\" with the following command:\\n\\n# touch /etc/modprobe.d/usb-storage.conf\\n\\nAdd the following line to the created file:\\n\\ninstall usb-storage /bin/true\\n\\nConfigure the operating system to disable the ability to use USB mass storage devices.\\n\\n# vi /etc/modprobe.d/blacklist.conf\\n\\nAdd or update the line:\\n\\nblacklist usb-storage\"]\n[346,\"Configure the operating system to disable the ability to use the DCCP kernel module.\\n\\nCreate a file under \\\"/etc/modprobe.d\\\" with the following command:\\n\\n# touch /etc/modprobe.d/dccp.conf\\n\\nAdd the following line to the created file:\\n\\ninstall dccp /bin/true\\n\\nEnsure that the DCCP module is blacklisted: \\n\\n# vi /etc/modprobe.d/blacklist.conf\\n\\nAdd or update the line:\\n\\nblacklist dccp\"]\n[347,\"Configure the operating system to disable the ability to automount devices.\\n\\nTurn off the automount service with the following commands:\\n\\n# systemctl stop autofs\\n# systemctl disable autofs\\n\\nIf \\\"autofs\\\" is required for Network File System (NFS), it must be documented with the ISSO.\"]\n[348,\"Configure the operating system to remove all software components after updated versions have been installed.\\n\\nSet the \\\"clean_requirements_on_remove\\\" option to \\\"1\\\" in the \\\"/etc/yum.conf\\\" file:\\n\\nclean_requirements_on_remove=1\"]\n[349,\"Configure the operating system to verify correct operation of all security functions.\\n\\nSet the \\\"SELinux\\\" status and the \\\"Enforcing\\\" mode by modifying the \\\"/etc/selinux/config\\\" file to have the following line:\\n\\nSELINUX=enforcing\\n\\nA reboot is required for the changes to take effect.\"]\n[350,\"Configure the operating system to verify correct operation of all security functions.\\n\\nSet the \\\"SELinuxtype\\\" to the \\\"targeted\\\" policy by modifying the \\\"/etc/selinux/config\\\" file to have the following line:\\n\\nSELINUXTYPE=targeted\\n\\nA reboot is required for the changes to take effect.\"]\n[351,\"Configure the system to disable the Ctrl-Alt-Delete sequence for the command line with the following command:\\n\\n# systemctl mask ctrl-alt-del.target\"]\n[352,\"Configure the system to disable the Ctrl-Alt-Delete sequence for the GUI with the following command:\\n\\n# touch /etc/dconf/db/local.d/00-disable-CAD \\n\\nAdd the setting to disable the Ctrl-Alt-Delete sequence for GNOME:\\n\\n[org/gnome/settings-daemon/plugins/media-keys]\\nlogout=''\"]\n[353,\"Configure the operating system to define default permissions for all authenticated users in such a way that the user can only read and modify their own files.\\n\\nAdd or edit the line for the \\\"UMASK\\\" parameter in \\\"/etc/login.defs\\\" file to \\\"077\\\":\\n\\nUMASK  077\"]\n[354,\"Upgrade to a supported version of the operating system.\"]\n[355,\"Install the operating system patches or updated packages available from Red Hat within 30 days or sooner as local policy dictates.\"]\n[356,\"Configure the system so all accounts on the system are assigned to an active system, application, or user account. \\n\\nRemove accounts that do not support approved system activities or that allow for a normal user to perform administrative-level actions. \\n\\nDocument all authorized accounts on the system.\"]\n[357,\"Configure the system to define all GIDs found in the \\\"/etc/passwd\\\" file by modifying the \\\"/etc/group\\\" file to add any non-existent group referenced in the \\\"/etc/passwd\\\" file, or change the GIDs referenced in the \\\"/etc/passwd\\\" file to a group that exists in \\\"/etc/group\\\".\"]\n[358,\"Change the UID of any account on the system, other than root, that has a UID of \\\"0\\\". \\n\\nIf the account is associated with system commands or applications, the UID should be changed to one greater than \\\"0\\\" but less than \\\"1000\\\". Otherwise, assign a UID of greater than \\\"1000\\\" that has not already been assigned.\"]\n[359,\"Either remove all files and directories from the system that do not have a valid user, or assign a valid user to all unowned files and directories on the system with the \\\"chown\\\" command:\\n\\n# chown <user> <file>\"]\n[360,\"Either remove all files and directories from the system that do not have a valid group, or assign a valid group to all files and directories on the system with the \\\"chgrp\\\" command:\\n\\n# chgrp <group> <file>\"]\n[361,\"Assign home directories to all local interactive users that currently do not have a home directory assigned.\"]\n[362,\"Configure the operating system to assign home directories to all new local interactive users by setting the \\\"CREATE_HOME\\\" parameter in \\\"/etc/login.defs\\\" to \\\"yes\\\" as follows.\\n\\nCREATE_HOME yes\"]\n[363,\"Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in \\\"/etc/ passwd\\\":\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\", a UID of \\\"smithj\\\", and a Group Identifier (GID) of \\\"users\\\" assigned in \\\"/etc/passwd\\\".\\n\\n# mkdir /home/smithj \\n# chown smithj /home/smithj\\n# chgrp users /home/smithj\\n# chmod 0750 /home/smithj\"]\n[364,\"Change the mode of interactive user's home directories to \\\"0750\\\". To change the mode of a local interactive user's home directory, use the following command:\\n\\nNote: The example will be for the user \\\"smithj\\\".\\n\\n# chmod 0750 /home/smithj\"]\n[365,\"Change the owner of a local interactive user's home directories to that owner. To change the owner of a local interactive user's home directory, use the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\".\\n\\n# chown smithj /home/smithj\"]\n[366,\"Change the group owner of a local interactive user's home directory to the group found in \\\"/etc/passwd\\\". To change the group owner of a local interactive user's home directory, use the following command:\\n\\nNote: The example will be for the user \\\"smithj\\\", who has a home directory of \\\"/home/smithj\\\", and has a primary group of users.\\n\\n# chgrp users /home/smithj\"]\n[367,\"Change the owner of a local interactive user's files and directories to that owner. To change the owner of a local interactive user's files and directories, use the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\".\\n\\n# chown smithj /home/smithj/<file or directory>\"]\n[368,\"Change the group of a local interactive user's files and directories to a group that the interactive user is a member of. To change the group owner of a local interactive user's files and directories, use the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\" and is a member of the users group.\\n\\n# chgrp users /home/smithj/<file>\"]\n[369,\"Set the mode on files and directories in the local interactive user home directory with the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\" and is a member of the users group.\\n\\n# chmod 0750 /home/smithj/<file>\"]\n[370,\"Set the owner of the local initialization files for interactive users to either the directory owner or root with the following command:\\n\\nNote: The example will be for the smithj user, who has a home directory of \\\"/home/smithj\\\".\\n\\n# chown smithj /home/smithj/.[^.]*\"]\n[371,\"Change the group owner of a local interactive user's files to the group found in \\\"/etc/passwd\\\" for the user. To change the group owner of a local interactive user's home directory, use the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\", and has a primary group of users.\\n\\n# chgrp users /home/smithj/.[^.]*\"]\n[372,\"Set the mode of the local initialization files to \\\"0740\\\" with the following command:\\n\\nNote: The example will be for the \\\"smithj\\\" user, who has a home directory of \\\"/home/smithj\\\".\\n\\n# chmod 0740 /home/smithj/.[^.]*\"]\n[373,\"Edit the local interactive user initialization files to change any PATH variable statements that reference directories other than their home directory. \\n\\nIf a local interactive user requires path variables to reference a directory owned by the application, it must be documented with the ISSO.\"]\n[374,\"Set the mode on files being executed by the local initialization files with the following command:\\n\\n# chmod 0755 <file>\"]\n[375,\"Run the following command to determine which package owns the device file:\\n\\n# rpm -qf <filename>\\n\\nThe package can be reinstalled from a yum repository using the command:\\n\\n# sudo yum reinstall <packagename>\\n\\nAlternatively, the package can be reinstalled from trusted media using the command:\\n\\n# sudo rpm -Uvh <packagename>\"]\n[376,\"Configure the \\\"/etc/fstab\\\" to use the \\\"nosuid\\\" option on file systems that contain user home directories.\"]\n[377,\"Configure the \\\"/etc/fstab\\\" to use the \\\"nosuid\\\" option on file systems that are associated with removable media.\"]\n[378,\"Configure the \\\"/etc/fstab\\\" to use the \\\"nosuid\\\" option on file systems that are being imported via NFS.\"]\n[379,\"Configure the \\\"/etc/fstab\\\" to use the \\\"noexec\\\" option on file systems that are being imported via NFS.\"]\n[380,\"Configure the system so that /dev/shm is mounted with the \\\"nodev\\\" option.\"]\n[381,\"Configure the system so that /dev/shm is mounted with the \\\"nosuid\\\" option.\"]\n[382,\"Configure the system so that /dev/shm is mounted with the \\\"noexec\\\" option.\"]\n[383,\"Change the group of the world-writable directories to root with the following command:\\n\\n# chgrp root <directory>\"]\n[384,\"Remove the umask statement from all local interactive user's initialization files. \\n\\nIf the account is for an application, the requirement for a umask less restrictive than \\\"077\\\" can be documented with the Information System Security Officer, but the user agreement for access to the account must specify that the local interactive user must log on to their account first and then switch the user to the application account with the correct option to gain the account's environment variables.\"]\n[385,\"Configure \\\"rsyslog\\\" to log all cron messages by adding or updating the following line to \\\"/etc/rsyslog.conf\\\" or a configuration file in the /etc/rsyslog.d/ directory:\\n\\ncron.* /var/log/cron.log\"]\n[386,\"Set the owner on the \\\"/etc/cron.allow\\\" file to root with the following command:\\n\\n# chown root /etc/cron.allow\"]\n[387,\"Set the group owner on the \\\"/etc/cron.allow\\\" file to root with the following command:\\n\\n# chgrp root /etc/cron.allow\"]\n[388,\"If kernel core dumps are not required, disable the \\\"kdump\\\" service with the following command:\\n\\n# systemctl disable kdump.service\\n\\nIf kernel core dumps are required, document the need with the ISSO.\"]\n[389,\"Migrate the \\\"/home\\\" directory onto a separate file system/partition.\"]\n[390,\"Migrate the \\\"/var\\\" path onto a separate file system.\"]\n[391,\"Migrate the system audit data path onto a separate file system.\"]\n[392,\"Start the \\\"tmp.mount\\\" service with the following command:\\n\\n# systemctl enable tmp.mount\\n   \\nOR\\n\\nEdit the \\\"/etc/fstab\\\" file and ensure the \\\"/tmp\\\" directory is defined in the fstab with a device and mount point.\"]\n[393,\"Configure the operating system to implement DoD-approved encryption by installing the dracut-fips package.\\n\\nTo enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel command line during system installation so key generation is done with FIPS-approved algorithms and continuous monitoring tests in place.\\n\\nConfigure the operating system to implement DoD-approved encryption by following the steps below: \\n\\nThe fips=1 kernel option needs to be added to the kernel command line during system installation so that key generation is done with FIPS-approved algorithms and continuous monitoring tests in place. Users should also ensure that the system has plenty of entropy during the installation process by moving the mouse around, or if no mouse is available, ensuring that many keystrokes are typed. The recommended amount of keystrokes is 256 and more. Less than 256 keystrokes may generate a non-unique key.\\n\\nInstall the dracut-fips package with the following command:\\n\\n# yum install dracut-fips\\n\\nRecreate the \\\"initramfs\\\" file with the following command:\\n\\nNote: This command will overwrite the existing \\\"initramfs\\\" file.\\n\\n# dracut -f\\n\\nModify the kernel command line of the current kernel in the \\\"grub.cfg\\\" file by adding the following option to the GRUB_CMDLINE_LINUX key in the \\\"/etc/default/grub\\\" file and then rebuild the \\\"grub.cfg\\\" file:\\n\\nfips=1\\n\\nChanges to \\\"/etc/default/grub\\\" require rebuilding the \\\"grub.cfg\\\" file as follows:\\n\\nOn BIOS-based machines, use the following command:\\n\\n# grub2-mkconfig -o /boot/grub2/grub.cfg\\n\\nOn UEFI-based machines, use the following command:\\n\\n# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg\\n\\nIf /boot or /boot/efi reside on separate partitions, the kernel parameter boot=<partition of /boot or /boot/efi> must be added to the kernel command line. You can identify a partition by running the df /boot or df /boot/efi command:\\n\\n# df /boot\\nFilesystem 1K-blocks Used Available Use% Mounted on\\n/dev/sda1 495844 53780 416464 12% /boot\\n\\nTo ensure the \\\"boot=\\\" configuration option will work even if device naming changes occur between boots, identify the universally unique identifier (UUID) of the partition with the following command:\\n\\n# blkid /dev/sda1\\n/dev/sda1: UUID=\\\"05c000f1-a213-759e-c7a2-f11b7424c797\\\" TYPE=\\\"ext4\\\"\\n\\nFor the example above, append the following string to the kernel command line:\\n\\nboot=UUID=05c000f1-a213-759e-c7a2-f11b7424c797\\n\\nReboot the system for the changes to take effect.\"]\n[394,\"Configure the file integrity tool to check file and directory ACLs. \\n\\nIf AIDE is installed, ensure the \\\"acl\\\" rule is present on all uncommented file and directory selection lists.\"]\n[395,\"Configure the file integrity tool to check file and directory extended attributes. \\n\\nIf AIDE is installed, ensure the \\\"xattrs\\\" rule is present on all uncommented file and directory selection lists.\"]\n[396,\"Configure the file integrity tool to use FIPS 140-2 cryptographic hashes for validating file and directory contents. \\n\\nIf AIDE is installed, ensure the \\\"sha512\\\" rule is present on all uncommented file and directory selection lists.\"]\n[397,\"Remove alternate methods of booting the system from removable media or document the configuration to boot from removable media with the ISSO.\"]\n[398,\"Configure the operating system to disable non-essential capabilities by removing the telnet-server package from the system with the following command:\\n\\n# yum remove telnet-server\"]\n[399,\"Configure the operating system to produce audit records containing information to establish when (date and time) the events occurred.\\n\\nEnable the auditd service with the following command:\\n\\n# systemctl start auditd.service\"]\n[400,\"Configure the operating system to shut down in the event of an audit processing failure.\\n\\nAdd or correct the option to shut down the operating system with the following command:\\n\\n# auditctl -f 2\\n\\nEdit the \\\"/etc/audit/rules.d/audit.rules\\\" file and add the following line:\\n\\n-f 2\\n\\nIf availability has been determined to be more important, and this decision is documented with the ISSO, configure the operating system to notify system administration staff and ISSO staff in the event of an audit processing failure with the following command:\\n\\n# auditctl -f 1\\n\\nEdit the \\\"/etc/audit/rules.d/audit.rules\\\" file and add the following line:\\n\\n-f 1\\n\\nKernel log monitoring must also be configured to properly alert designated staff.\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[401,\"Edit the /etc/audisp/plugins.d/au-remote.conf file and change the value of \\\"active\\\" to \\\"yes\\\".\\n\\nThe audit daemon must be restarted for changes to take effect:\\n\\n# service auditd restart\"]\n[402,\"Edit the /etc/audisp/plugins.d/au-remote.conf file and add or update the following values:\\n\\ndirection = out\\npath = /sbin/audisp-remote\\ntype = always\\n\\nThe audit daemon must be restarted for changes to take effect:\\n\\n# service auditd restart\"]\n[403,\"Edit the /etc/audisp/audispd.conf file and add or update the \\\"overflow_action\\\" option:\\n\\noverflow_action = syslog\\n\\nThe audit daemon must be restarted for changes to take effect:\\n\\n# service auditd restart\"]\n[404,\"Edit the /etc/audisp/audispd.conf file and add or update the \\\"name_format\\\" option:\\n\\nname_format = hostname\\n\\nThe audit daemon must be restarted for changes to take effect:\\n\\n# service auditd restart\"]\n[405,\"Configure the operating system to off-load audit records onto a different system or media from the system being audited.\\n\\nSet the remote server option in \\\"/etc/audisp/audisp-remote.conf\\\" with the IP address of the log aggregation server.\"]\n[406,\"Configure the operating system to encrypt the transfer of off-loaded audit records onto a different system or media from the system being audited.\\n\\nUncomment the \\\"enable_krb5\\\" option in \\\"/etc/audisp/audisp-remote.conf\\\" and set it with the following line:\\n\\nenable_krb5 = yes\"]\n[407,\"Configure the action the operating system takes if the disk the audit records are written to becomes full.\\n\\nUncomment or edit the \\\"disk_full_action\\\" option in \\\"/etc/audisp/audisp-remote.conf\\\" and set it to \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\", such as the following line:\\n\\ndisk_full_action = single\"]\n[408,\"Configure the action the operating system takes if there is an error sending audit records to a remote system.\\n\\nUncomment the \\\"network_failure_action\\\" option in \\\"/etc/audisp/audisp-remote.conf\\\" and set it to \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\".\\n\\nnetwork_failure_action = syslog\"]\n[409,\"Configure the operating system to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\\n\\nCheck the system configuration to determine the partition the audit records are being written to: \\n\\n# grep -iw log_file /etc/audit/auditd.conf\\n\\nDetermine the size of the partition that audit records are written to (with the example being \\\"/var/log/audit/\\\"):\\n\\n# df -h /var/log/audit/\\n\\nSet the value of the \\\"space_left\\\" keyword in \\\"/etc/audit/auditd.conf\\\" to 25 percent of the partition size.\"]\n[410,\"Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached.\\n\\nUncomment or edit the \\\"space_left_action\\\" keyword in \\\"/etc/audit/auditd.conf\\\" and set it to \\\"email\\\". \\n \\nspace_left_action = email\"]\n[411,\"Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached.\\n\\nUncomment or edit the \\\"action_mail_acct\\\" keyword in \\\"/etc/audit/auditd.conf\\\" and set it to root and any other accounts associated with security personnel. \\n \\naction_mail_acct = root\"]\n[412,\"Configure the operating system to audit the execution of privileged functions.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid\\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid\\n-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid\\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[413,\"Add or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[414,\"Add or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[415,\"Add or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[416,\"Add or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[417,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"chmod\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[418,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"fchmod\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[419,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"fchmodat\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[420,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"setxattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[421,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"fsetxattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[422,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"lsetxattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[423,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"removexattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[424,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"fremovexattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[425,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"lremovexattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[426,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"creat\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules:\\n\\n-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[427,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"open\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[428,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"openat\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[429,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"open_by_handle_at\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[430,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"truncate\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[431,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"ftruncate\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[432,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"semanage\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[433,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"setsebool\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[434,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"chcon\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[435,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"setfiles\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[436,\"Configure the operating system to generate audit records when unsuccessful account access events occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-w /var/run/faillock -p wa -k logins\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[437,\"Configure the operating system to generate audit records when successful account access events occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-w /var/log/lastlog -p wa -k logins\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[438,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"passwd\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[439,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"unix_chkpwd\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[440,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"gpasswd\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[441,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"chage\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[442,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"userhelper\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[443,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"su\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change \\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[444,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"sudo\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change \\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[445,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to access the \\\"/etc/sudoers\\\" file and files in the \\\"/etc/sudoers.d/\\\" directory.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/sudoers -p wa -k privileged-actions\\n\\n-w /etc/sudoers.d/ -p wa -k privileged-actions\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[446,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"newgrp\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[447,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"chsh\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[448,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"mount\\\" command and syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n-a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[449,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"umount\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[450,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"postdrop\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=4294967295 -k privileged-postfix\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[451,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"postqueue\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=4294967295 -k privileged-postfix\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[452,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"ssh-keysign\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=4294967295 -k privileged-ssh\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[453,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"crontab\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=4294967295 -k privileged-cron\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[454,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"pam_timestamp_check\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F auid>=1000 -F auid!=4294967295 -k privileged-pam\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[455,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"create_module\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S create_module -k module-change\\n\\n-a always,exit -F arch=b64 -S create_module -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[456,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"init_module\\\" syscall occur. \\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S init_module -k module-change\\n\\n-a always,exit -F arch=b64 -S init_module -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[457,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"finit_module\\\" syscall occur. \\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F arch=b32 -S finit_module -k module-change\\n\\n-a always,exit -F arch=b64 -S finit_module -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[458,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"delete_module\\\" syscall occur. \\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F arch=b32 -S delete_module -k module-change\\n\\n-a always,exit -F arch=b64 -S delete_module -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[459,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"kmod\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /usr/bin/kmod -p x -F auid!=4294967295 -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[460,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/passwd\\\".\\n\\nAdd or update the following rule \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/passwd -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[461,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/group\\\".\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/group -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[462,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/gshadow\\\".\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/gshadow -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[463,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.\\n\\nAdd or update the following file system rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/shadow -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[464,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.\\n\\nAdd or update the following file system rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/security/opasswd -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect:\\n# systemctl restart auditd\"]\n[465,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"rename\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[466,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"renameat\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[467,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"rmdir\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[468,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"unlink\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[469,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"unlinkat\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[470,\"Modify the \\\"/etc/rsyslog.conf\\\" or an \\\"/etc/rsyslog.d/*.conf\\\" file to contain a configuration line to send all \\\"rsyslog\\\" output to a log aggregation system:\\n*.* @@<log aggregation system name>\"]\n[471,\"Modify the \\\"/etc/rsyslog.conf\\\" file to remove the \\\"ModLoad imtcp\\\", \\\"ModLoad imudp\\\", and \\\"ModLoad imrelp\\\" configuration lines, or document the system as being used for log aggregation.\"]\n[472,\"Configure the operating system to limit the number of concurrent sessions to \\\"10\\\" for all accounts and/or account types.\\n\\nAdd the following line to the top of the /etc/security/limits.conf or in a \\\".conf\\\" file defined in /etc/security/limits.d/ :\\n\\n* hard maxlogins 10\"]\n[473,\"Update the host's firewall settings and/or running services to comply with the PPSM CLSA for the site or program and the PPSM CAL.\"]\n[474,\"Configure SSH to use FIPS 140-2 approved cryptographic algorithms.\\n\\nAdd the following line (or modify the line to have the required value) to the \\\"/etc/ssh/sshd_config\\\" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor).\\n\\nCiphers aes128-ctr,aes192-ctr,aes256-ctr\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[475,\"Configure the operating system to terminate all network connections associated with a communications session at the end of the session or after a period of inactivity.\\n\\nCreate a script to enforce the inactivity timeout (for example /etc/profile.d/tmout.sh) such as:\\n\\n#!/bin/bash\\n\\nTMOUT=600\\nreadonly TMOUT\\nexport TMOUT\"]\n[476,\"Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via the ssh.\\n\\nEdit the \\\"/etc/ssh/sshd_config\\\" file to uncomment the banner keyword and configure it to point to a file that will contain the logon banner (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). An example configuration line is:\\n\\nbanner /etc/issue\\n\\nEither create the file containing the banner or replace the text in the file with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n \\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[477,\"Configure the operating system to implement cryptography to protect the integrity of LDAP authentication sessions.\\n\\nAdd or modify the following line in \\\"/etc/sssd/sssd.conf\\\":\\n\\nldap_id_use_start_tls = true\"]\n[478,\"Configure the operating system to implement cryptography to protect the integrity of LDAP remote access sessions.\\n\\nAdd or modify the following line in \\\"/etc/sssd/sssd.conf\\\":\\n\\nldap_tls_reqcert = demand\"]\n[479,\"Configure the operating system to implement cryptography to protect the integrity of LDAP remote access sessions.\\n\\nAdd or modify the following line in \\\"/etc/sssd/sssd.conf\\\":\\n\\nldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt\"]\n[480,\"Configure the operating system implement virtual address space randomization.\\n\\nSet the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a config file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nkernel.randomize_va_space = 2\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[481,\"Install SSH packages onto the host with the following commands:\\n\\n# yum install openssh-server.x86_64\"]\n[482,\"Configure the SSH service to automatically start after reboot with the following command:\\n\\n# systemctl enable sshd.service\"]\n[483,\"Configure the operating system to automatically terminate a user session after inactivity time-outs have expired or at shutdown.\\n\\nAdd the following line (or modify the line to have the required value) to the \\\"/etc/ssh/sshd_config\\\" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nClientAliveInterval 600\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[484,\"Configure the SSH daemon to not allow authentication using RSA rhosts authentication.\\n\\nAdd the following line in \\\"/etc/ssh/sshd_config\\\", or uncomment the line and set the value to \\\"no\\\":\\n\\nRhostsRSAAuthentication no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[485,\"Configure the operating system to terminate automatically a user session after inactivity time-outs have expired or at shutdown.\\n\\nAdd the following line (or modify the line to have the required value) to the \\\"/etc/ssh/sshd_config\\\" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nClientAliveCountMax 0\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[486,\"Configure the SSH daemon to not allow authentication using known hosts authentication.\\n\\nAdd the following line in \\\"/etc/ssh/sshd_config\\\", or uncomment the line and set the value to \\\"yes\\\":\\n\\nIgnoreRhosts yes\"]\n[487,\"Configure SSH to provide users with feedback on when account accesses last occurred by setting the required configuration options in \\\"/etc/pam.d/sshd\\\" or in the \\\"sshd_config\\\" file used by the system (\\\"/etc/ssh/sshd_config\\\" will be used in the example) (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor).\\n\\nModify the \\\"PrintLastLog\\\" line in \\\"/etc/ssh/sshd_config\\\" to match the following:\\n\\nPrintLastLog yes\\n\\nThe SSH service must be restarted for changes to \\\"sshd_config\\\" to take effect.\"]\n[488,\"Configure SSH to stop users from logging on remotely as the root user.\\n\\nEdit the appropriate  \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for the \\\"PermitRootLogin\\\" keyword and set its value to \\\"no\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nPermitRootLogin no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[489,\"Configure the SSH daemon to not allow authentication using known hosts authentication.\\n\\nAdd the following line in \\\"/etc/ssh/sshd_config\\\", or uncomment the line and set the value to \\\"yes\\\":\\n\\nIgnoreUserKnownHosts yes\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[490,\"Remove all Protocol lines that reference version \\\"1\\\" in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). The \\\"Protocol\\\" line must be as follows:\\n\\nProtocol 2\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[491,\"Edit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for the \\\"MACs\\\" keyword and set its value to \\\"hmac-sha2-256\\\" and/or \\\"hmac-sha2-512\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nMACs hmac-sha2-256,hmac-sha2-512\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[492,\"Note: SSH public key files may be found in other directories on the system depending on the installation. \\n\\nChange the mode of public host key files under \\\"/etc/ssh\\\" to \\\"0644\\\" with the following command:\\n\\n# chmod 0644 /etc/ssh/*.key.pub\"]\n[493,\"Configure the mode of SSH private host key files under \\\"/etc/ssh\\\" to \\\"0640\\\" with the following command:\\n\\n# chmod 0640 /path/to/file/ssh_host*key\"]\n[494,\"Uncomment the \\\"GSSAPIAuthentication\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \\\"no\\\": \\n\\nGSSAPIAuthentication no\\n\\nThe SSH service must be restarted for changes to take effect.\\n\\nIf GSSAPI authentication is required, it must be documented, to include the location of the configuration file, with the ISSO.\"]\n[495,\"Uncomment the \\\"KerberosAuthentication\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \\\"no\\\":\\n\\nKerberosAuthentication no\\n\\nThe SSH service must be restarted for changes to take effect.\\n\\nIf Kerberos authentication is required, it must be documented, to include the location of the configuration file, with the ISSO.\"]\n[496,\"Uncomment the \\\"StrictModes\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \\\"yes\\\":\\n\\nStrictModes yes\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[497,\"Uncomment the \\\"UsePrivilegeSeparation\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \\\"sandbox\\\" or \\\"yes\\\":\\n\\nUsePrivilegeSeparation sandbox\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[498,\"Uncomment the \\\"Compression\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) on the system and set the value to \\\"delayed\\\" or \\\"no\\\":\\n\\nCompression no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[499,\"Edit the \\\"/etc/ntp.conf\\\" or \\\"/etc/chrony.conf\\\" file and add or update an entry to define \\\"maxpoll\\\" to \\\"10\\\" as follows:\\n\\nserver 0.rhel.pool.ntp.org iburst maxpoll 10\\n\\nIf NTP was running and \\\"maxpoll\\\" was updated, the NTP service must be restarted:\\n\\n# systemctl restart ntpd\\n\\nIf NTP was not running, it must be started:\\n\\n# systemctl start ntpd \\n\\nIf \\\"chronyd\\\" was running and \\\"maxpoll\\\" was updated, the service must be restarted:\\n\\n# systemctl restart chronyd.service\\n\\nIf \\\"chronyd\\\" was not running, it must be started:\\n\\n# systemctl start chronyd.service\"]\n[500,\"Ensure the operating system's application firewall is enabled.\\n\\nInstall the \\\"firewalld\\\" package, if it is not on the system, with the following command:\\n\\n# yum install firewalld\\n\\nStart the firewall via \\\"systemctl\\\" with the following command:\\n\\n# systemctl start firewalld\"]\n[501,\"Configure the operating system to provide users with feedback on when account accesses last occurred by setting the required configuration options in \\\"/etc/pam.d/postlogin\\\". \\n\\nAdd the following line to the top of \\\"/etc/pam.d/postlogin\\\":\\n\\nsession required pam_lastlog.so showfailed\"]\n[502,\"Remove any found \\\".shosts\\\" files from the system.\\n\\n# rm /[path]/[to]/[file]/.shosts\"]\n[503,\"Remove any found \\\"shosts.equiv\\\" files from the system.\\n\\n# rm /[path]/[to]/[file]/shosts.equiv\"]\n[504,\"Configure the operating system to use two or more name servers for DNS resolution.\\n\\nEdit the \\\"/etc/resolv.conf\\\" file to uncomment or add the two or more \\\"nameserver\\\" option lines with the IP address of local authoritative name servers. If local host resolution is being performed, the \\\"/etc/resolv.conf\\\" file must be empty. An empty \\\"/etc/resolv.conf\\\" file can be created as follows:\\n\\n# echo -n > /etc/resolv.conf\\n\\nAnd then make the file immutable with the following command:\\n\\n# chattr +i /etc/resolv.conf\\n\\nIf the \\\"/etc/resolv.conf\\\" file must be mutable, the required configuration must be documented with the Information System Security Officer (ISSO) and the file must be verified by the system file integrity tool.\"]\n[505,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.all.accept_source_route = 0   \\n\\nIssue the following command to make the changes take effect:\\n \\n# sysctl -system\"]\n[506,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.all.rp_filter = 1 \\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[507,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.default.rp_filter = 1 \\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[508,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.default.accept_source_route = 0   \\n\\nIssue the following command to make the changes take effect:\\n \\n# sysctl --system\"]\n[509,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.icmp_echo_ignore_broadcasts = 1\\n\\nIssue the following command to make the changes take effect: \\n\\n# sysctl --system\"]\n[510,\"Set the system to not accept IPv4 ICMP redirect messages by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.default.accept_redirects = 0   \\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[511,\"Set the system to ignore IPv4 ICMP redirect messages by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.all.accept_redirects = 0   \\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[512,\"Configure the system to not allow interfaces to perform IPv4 ICMP redirects by default. \\n\\nSet the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.default.send_redirects = 0\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[513,\"Configure the system to not allow interfaces to perform IPv4 ICMP redirects. \\n\\nSet the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.all.send_redirects = 0\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[514,\"Configure network interfaces to turn off promiscuous mode unless approved by the ISSO and documented.\\n\\nSet the promiscuous mode of an interface to off with the following command:\\n\\n#ip link set dev <devicename> multicast off promisc off\"]\n[515,\"If \\\"postfix\\\" is installed, modify the \\\"/etc/postfix/main.cf\\\" file to restrict client connections to the local network with the following command:\\n\\n# postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'\"]\n[516,\"Document the \\\"vsftpd\\\" package with the ISSO as an operational requirement or remove it from the system with the following command:\\n\\n# yum remove vsftpd\"]\n[517,\"Remove the TFTP package from the system with the following command:\\n\\n# yum remove tftp-server\"]\n[518,\"Configure SSH to encrypt connections for interactive users.\\n\\nEdit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for the \\\"X11Forwarding\\\" keyword and set its value to \\\"yes\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nX11Forwarding yes\\n\\nThe SSH service must be restarted for changes to take effect:\\n\\n# systemctl restart sshd\"]\n[519,\"Configure the TFTP daemon to operate in secure mode by adding the following line to \\\"/etc/xinetd.d/tftp\\\" (or modify the line to have the required value):\\n\\nserver_args = -s /var/lib/tftpboot\"]\n[520,\"Document the requirement for an X Windows server with the ISSO or remove the related packages with the following commands:\\n\\n# rpm -e xorg-x11-server-common\"]\n[521,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.ip_forward = 0\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[522,\"Update the \\\"/etc/fstab\\\" file so the option \\\"sec\\\" is defined for each NFS mounted file system and the \\\"sec\\\" option does not have the \\\"sys\\\" setting. \\n\\nEnsure the \\\"sec\\\" option is defined as \\\"krb5:krb5i:krb5p\\\".\"]\n[523,\"If the \\\"/etc/snmp/snmpd.conf\\\" file exists, modify any lines that contain a community string value of \\\"public\\\" or \\\"private\\\" to another string value.\"]\n[524,\"If \\\"firewalld\\\" is installed and active on the system, configure rules for allowing specific services and hosts. \\n\\nIf \\\"firewalld\\\" is not \\\"active\\\", enable \\\"tcpwrappers\\\" by configuring \\\"/etc/hosts.allow\\\" and \\\"/etc/hosts.deny\\\" to allow or deny access to specific hosts.\"]\n[525,\"Remove all unapproved tunnels from the system, or document them with the ISSO.\"]\n[526,\"Set the system to the required kernel parameter, if IPv6 is enabled, by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv6.conf.all.accept_source_route = 0\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[527,\"Configure the operating system to implement multifactor authentication by installing the required packages.\\n\\nInstall the \\\"esc\\\" and \\\"pam_pkcs11\\\" packages on the system with the following command:\\n\\n# yum install esc pam_pkcs11\"]\n[528,\"Configure the operating system to implement multifactor authentication for remote access to privileged accounts via pluggable authentication modules (PAM).\\n\\nModify all of the services lines in \\\"/etc/sssd/sssd.conf\\\" or in configuration files found under \\\"/etc/sssd/conf.d\\\" to include pam.\"]\n[529,\"Configure the operating system to do certificate status checking for PKI authentication.\\n\\nModify all of the \\\"cert_policy\\\" lines in \\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" to include \\\"ocsp_on\\\".\"]\n[530,\"Configure the system to disable all wireless network interfaces with the following command:\\n\\n#nmcli radio wifi off\"]\n[531,\"Run the following command to determine which package owns the file:\\n\\n# rpm -qf <filename>\\n\\nThe package can be reinstalled from a yum repository using the command:\\n\\n# sudo yum reinstall <packagename>\\n\\nAlternatively, the package can be reinstalled from trusted media using the command:\\n\\n# sudo rpm -Uvh <packagename>\"]\n[532,\"Install and enable the latest McAfee HIPS package, available from USCYBERCOM.\\n\\nNote: If the system does not support the McAfee HIPS package, install and enable a supported intrusion detection system application and document its use with the Authorizing Official.\"]\n[533,\"Install an antivirus solution on the system.\"]\n[534,\"Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example below is using the database \\\"local\\\" for the system, so if the system is using another database in \\\"/etc/dconf/profile/user\\\", the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/locks/session\\n\\nAdd the setting to lock the screensaver lock-enabled setting:\\n\\n/org/gnome/desktop/screensaver/lock-enabled\"]\n[535,\"Configure the VPN Gateway to ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies (e.g., IPsec policy configuration). Also, configure the VPN gateway to forward encapsulated or encrypted traffic received from other enclaves with different security policies to the perimeter firewall and IDPS before traffic is passed to the private network.\"]\n[536,\"Configure the Remote Access VPN to display the Standard Mandatory DoD Notice and Consent Banner in accordance with DoD policy before granting access to the device. Use the following verbiage for applications that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n-At any time, the USG may inspect and seize data stored on this IS.\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\"]\n[537,\"Configure the Remote Access VPN Gateway and/or client to retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.\"]\n[538,\"Configure the publicly accessible VPN Gateway to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\"]\n[539,\"Configure the VPN Gateway to notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access).\"]\n[540,\"Configure the VPN Gateway to limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number, as documented in the SSP.\"]\n[541,\"Configure the TLS VPN Gateway to use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data for transmission.\"]\n[542,\"Configure the remote access VPN Gateway to use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.\"]\n[543,\"Configure the VPN Gateway to use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.\"]\n[544,\"Configure the IPsec VPN to us the FIPS 140-2 DH group. The following command is an example of how to configure the IKE (phase 1) proposals. \\n\\nThe following groups are allowed for use in DoD: \\nDH Groups 14 (2048-bit MODP) \\n- 19 (256-bit Random ECP), 20 (384-bit Random ECP), 5 (1536-bit MODP), 24 (2048-bit MODP with 256-bit POS).\"]\n[545,\"Configure the VPN Gateway to generate log records containing information to establish what type of events occurred.\"]\n[546,\"Configure the VPN Gateway to generate log records containing information to establish when (date and time) the events occurred.\"]\n[547,\"Configure the VPN Gateway to generate log records containing information that establishes the identity of any individual or process associated with the event.\"]\n[548,\"Configure the VPN Gateway to generates log records containing information to establish where the events occurred.\"]\n[549,\"Configure the VPN Gateway to generate log records containing information to establish the source of the events.\"]\n[550,\"Configure the VPN Gateway to generate log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the client connection attempts.\"]\n[551,\"Configure the VPN Gateway to protect log information from unauthorized read access if all or some of this data is stored locally.\"]\n[552,\"Configure the VPN Gateway log to protect audit information from unauthorized modification when stored locally. The method used depends on system architecture and design. Examples: ensuring log files receive the proper file system permissions and limiting log data locations.\"]\n[553,\"Configure the VPN Gateway to protect audit information from unauthorized deletion when stored locally. Ensure log files receive the proper file system permissions and limiting log data locations.\"]\n[554,\"Ensure functions, ports, protocols, and services identified on the PPSM CAL are not used for system services configuration.\\n\\nView the configured security  services.\\n\\nCompare the services that are enabled, including the port, services, protocols, and functions.\\n\\nConsult the product knowledge base and configuration guides to determine the commands for disabling each port, protocols, services, or functions that is not in compliance with the PPSM CAL and vulnerability assessments.\"]\n[555,\"Configure the IPsec VPN Gateway to use IKEv2 for IPsec VPN security associations.\"]\n[556,\"Configure the VPN Gateway to prohibit PPTP and L2F.\"]\n[557,\"If L2TP is used for encapsulation, configure the VPN Gateway or other network element to block or deny this communications protocol unencrypted L2TP packets across the security boundary and into the private network of the enclave.\"]\n[558,\"Configure the VPN Gateway to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).\"]\n[559,\"Configure the VPN Gateway to use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.\"]\n[560,\"Configure the VPN Client to implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.\"]\n[561,\"Configure the TLS VPN Gateway to use replay-resistant authentication mechanisms for network access to non-privileged accounts.\"]\n[562,\"Configure the IPsec VPN Gateway to use anti-replay mechanisms for security associations.\"]\n[563,\"Configure the VPN Gateway to uniquely identify all network-connected endpoint devices before establishing a connection.\"]\n[564,\"Configure the  VPN Gateway to use PKI-based authentication that validates certificates by constructing a certification path (which includes status information) to an accepted trust anchor.\"]\n[565,\"Configure the site-to-site VPN that uses certificate-based device authentication to use a FIPS-compliant key management process.\"]\n[566,\"Configure the Remote Access VPN Gateway to use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.\"]\n[567,\"Configure the VPN Gateway to map the authenticated identity to the user account for PKI-based authentication.\"]\n[568,\"Configure the VPN Gateway to use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).\"]\n[569,\"Configure the VPN Gateway to uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).\"]\n[570,\"Configure the VPN Gateway to route sessions to an IDPS for inspection.\"]\n[571,\"Configure the VPN Gateway to terminate all network connections associated with a communications session at the end of the session.\"]\n[572,\"Configure the VPN Gateway to use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.\"]\n[573,\"Configure the IPsec VPN Gateway to use IKE with SHA1 or greater to protect the authenticity of communications sessions.\"]\n[574,\"Configure the VPN Gateway to invalidate session identifiers upon user logoff or other session termination.\"]\n[575,\"Configure the VPN Gateway to recognize only system-generated session identifiers.\"]\n[576,\"Configure the VPN Gateway to generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.\"]\n[577,\"Configure the VPN Gateway to fail to a secure state if system initialization fails, shutdown fails, or aborts fail.\"]\n[578,\"Configure the VPN Gateway to be configured to perform an organization-defined action if the audit reveals unauthorized activity.\"]\n[579,\"Configure the VPN Gateway for functionality, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack. \\n\\nConfigure authorized system administrator accounts to allow them to disconnect or disable remote access to remove user under circumstances defined in the VPN SSP.\"]\n[580,\"Configure the IPsec Gateway to use AES with IKE. The option on the IKE Phase 1 proposal may also be configured to use the  aes-128-cbc, aes-192-cbc, or aes-256-cbc algorithms.\"]\n[581,\"Configure the VPN Gateway to transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.\"]\n[582,\"Configure the VPN Gateway to notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).\"]\n[583,\"Configure the VPN Gateway to provide centralized management and configuration of the content to be captured in log records generated by all network components.\"]\n[584,\"Configure the VPN Gateway to off-load audit records onto a different system or media than the system being audited.\"]\n[585,\"Configure the VPN Gateway to generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.\"]\n[586,\"Configure the VPN Gateway to continue to queue traffic log records locally when communications with the Central Log Server is lost.\"]\n[587,\"Configure the IPsec VPN Gateway to renegotiate the security association after 8 hours or less, or an organization-defined period.\"]\n[588,\"Configure the VPN Gateway to renegotiate the security association after 24 hours or less or as defined by the organization.\"]\n[589,\"Configure the VPN Gateway to accept Personal Identity Verification (PIV) credentials.\"]\n[590,\"Configure the VPN Gateway to electronically verify Personal Identity Verification (PIV) credentials.\"]\n[591,\"Configure the VPN Gateway to authenticate all network-connected endpoint devices before establishing a connection.\"]\n[592,\"Configure the VPN Gateway to use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.\"]\n[593,\"Configure the VPN Gateway to disable split-tunneling for remote clients VPNs.\"]\n[594,\"Configure the IPsec VPN Gateway to specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.\"]\n[595,\"Configure the VPN Gateway and the remote access client to protect the confidentiality and integrity of transmitted information.\"]\n[596,\"Configure the IPsec VPN Gateway to use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.\"]\n[597,\"For accounts using password authentication, configure the VPN Gateway to use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.\"]\n[598,\"Configure the VPN Gateway to generate log records when successful and/or unsuccessful VPN connection attempts occur.\"]\n[599,\"Configure the VPN Gateway to use a FIPS-validated cryptographic module to generate cryptographic hashes.\"]\n[600,\"Configure the VPN Gateway to use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.\"]\n[601,\"Configure the IPsec VPN Gateway IKE to use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.\"]\n[602,\"Configure the IPsec VPN Gateway to use IKE and IPsec VPN SAs.\"]\n[603,\"Configure the VPN Gateway to not accept certificates that have been revoked when using PKI for authentication.\"]\n[604,\"Configure the VPN Client logout log out function must be configured to terminate the session on/with the VPN Gateway.\"]\n[605,\"Configure the VPN Client to display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.\"]\n[606,\"Configure the VPN Gateway to store only cryptographic representations of the PSK.\"]\n[607,\"Configure the IPsec Gateway to use AES for the IPsec proposal. The following example commands configure the IPsec (phase 2) proposals. The option may also be configured to use the aes-128-cbc, aes-192-cbc, or aes-256-cbc algorithms.\"]\n[608,\"Configure the TLS VPN Gateway that supports Government-only services to prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.\"]\n[609,\"Configure the TLS VPN Gateway that supports citizen- or business-facing network devices to prohibit client negotiation to SSL 2.0 or SSL 3.0.\"]\n[610,\"The VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.\"]\n[611,\"Configure the VPN Gateway to use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.\"]\n[612,\"Configure the IPsec VPN Gateway Internet Key Exchange (IKE) to use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.\"]\n[613,\"Configure the VPN Gateway to validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.\"]\n[614,\"Configure the VPN Gateway to use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).\"]\n[615,\"If the site-to-site VPN implementation uses L2TPv3, configure L2TPv3 sessions to authenticate the traffic before transit.\"]\n{\"table\":\"rev_group_rule_cci_map\",\"columns\":\"`cci`,`rgrccId`,`rgrId`\",\"rowCount\":6922}\n[\"000366\",1,1]\n[\"001812\",2,2]\n[\"000366\",3,3]\n[\"001812\",4,4]\n[\"000366\",5,5]\n[\"000366\",6,6]\n[\"000877\",7,7]\n[\"001199\",8,8]\n[\"002475\",9,8]\n[\"002476\",10,8]\n[\"002890\",11,9]\n[\"003123\",12,9]\n[\"000877\",13,10]\n[\"001233\",14,11]\n[\"001774\",15,12]\n[\"000877\",16,13]\n[\"000366\",17,14]\n[\"000366\",18,15]\n[\"000213\",19,16]\n[\"000366\",20,17]\n[\"001090\",21,18]\n[\"000795\",22,19]\n[\"002235\",23,20]\n[\"000366\",24,21]\n[\"000381\",25,22]\n[\"000366\",26,23]\n[\"002890\",27,24]\n[\"003123\",28,24]\n[\"000199\",29,25]\n[\"002165\",30,26]\n[\"002038\",31,27]\n[\"000381\",32,28]\n[\"000382\",33,29]\n[\"000381\",34,30]\n[\"000382\",35,31]\n[\"000382\",36,32]\n[\"000366\",37,33]\n[\"000366\",38,34]\n[\"000366\",39,35]\n[\"002238\",40,36]\n[\"000044\",41,37]\n[\"000044\",42,38]\n[\"002238\",43,38]\n[\"000200\",44,39]\n[\"000199\",45,40]\n[\"000198\",46,41]\n[\"000205\",47,42]\n[\"000192\",48,43]\n[\"000193\",49,43]\n[\"000194\",50,43]\n[\"001619\",51,43]\n[\"000196\",52,44]\n[\"000172\",53,45]\n[\"000172\",54,46]\n[\"000018\",55,47]\n[\"000172\",56,47]\n[\"001403\",57,47]\n[\"001404\",58,47]\n[\"001405\",59,47]\n[\"002130\",60,47]\n[\"002234\",61,47]\n[\"000018\",62,48]\n[\"000172\",63,48]\n[\"001403\",64,48]\n[\"001404\",65,48]\n[\"001405\",66,48]\n[\"002130\",67,48]\n[\"002234\",68,48]\n[\"000018\",69,49]\n[\"000172\",70,49]\n[\"001403\",71,49]\n[\"001404\",72,49]\n[\"001405\",73,49]\n[\"002130\",74,49]\n[\"002234\",75,49]\n[\"000172\",76,50]\n[\"000172\",77,51]\n[\"000172\",78,52]\n[\"000067\",79,53]\n[\"000172\",80,53]\n[\"000067\",81,54]\n[\"000172\",82,54]\n[\"000067\",83,55]\n[\"000172\",84,55]\n[\"000172\",85,56]\n[\"000172\",86,57]\n[\"000172\",87,58]\n[\"000172\",88,59]\n[\"000172\",89,60]\n[\"002234\",90,60]\n[\"000172\",91,61]\n[\"002234\",92,61]\n[\"000172\",93,62]\n[\"002234\",94,62]\n[\"000172\",95,63]\n[\"000172\",96,64]\n[\"000172\",97,65]\n[\"000172\",98,66]\n[\"002234\",99,66]\n[\"000172\",100,67]\n[\"002234\",101,67]\n[\"000172\",102,68]\n[\"002234\",103,68]\n[\"000172\",104,69]\n[\"002234\",105,69]\n[\"001849\",106,70]\n[\"001849\",107,71]\n[\"001849\",108,72]\n[\"000162\",109,73]\n[\"000163\",110,73]\n[\"000164\",111,73]\n[\"000162\",112,74]\n[\"000163\",113,74]\n[\"000164\",114,74]\n[\"000162\",115,75]\n[\"000163\",116,75]\n[\"000164\",117,75]\n[\"000381\",118,76]\n[\"000381\",119,77]\n[\"000366\",120,78]\n[\"000366\",121,79]\n[\"000366\",122,80]\n[\"002385\",123,81]\n[\"000366\",124,82]\n[\"000366\",125,83]\n[\"000185\",126,84]\n[\"002470\",127,84]\n[\"000366\",128,85]\n[\"000185\",129,86]\n[\"000366\",130,87]\n[\"000185\",131,88]\n[\"002470\",132,88]\n[\"000185\",133,89]\n[\"002470\",134,89]\n[\"000366\",135,90]\n[\"002235\",136,91]\n[\"000366\",137,92]\n[\"001084\",138,93]\n[\"000366\",139,94]\n[\"000764\",140,95]\n[\"000366\",141,96]\n[\"000366\",142,97]\n[\"000804\",143,98]\n[\"000381\",144,99]\n[\"000366\",145,100]\n[\"000366\",146,101]\n[\"000381\",147,102]\n[\"000381\",148,103]\n[\"000366\",149,104]\n[\"000366\",150,105]\n[\"000381\",151,106]\n[\"000381\",152,107]\n[\"000169\",153,108]\n[\"002418\",154,109]\n[\"002421\",155,109]\n[\"002418\",156,110]\n[\"002421\",157,110]\n[\"002038\",158,111]\n[\"002418\",159,112]\n[\"002421\",160,112]\n[\"002038\",161,113]\n[\"001090\",162,114]\n[\"000366\",163,115]\n[\"001967\",164,116]\n[\"000366\",165,117]\n[\"000366\",166,118]\n[\"000381\",167,119]\n[\"002418\",168,120]\n[\"002421\",169,120]\n[\"001764\",170,121]\n[\"000057\",171,122]\n[\"001764\",172,123]\n[\"001764\",173,124]\n[\"000048\",174,125]\n[\"000050\",175,125]\n[\"001384\",176,125]\n[\"001385\",177,125]\n[\"001386\",178,125]\n[\"001387\",179,125]\n[\"001388\",180,125]\n[\"000366\",181,126]\n[\"001084\",182,127]\n[\"000048\",183,128]\n[\"001384\",184,128]\n[\"001385\",185,128]\n[\"001386\",186,128]\n[\"001387\",187,128]\n[\"001388\",188,128]\n[\"000366\",189,129]\n[\"000381\",190,130]\n[\"000366\",191,131]\n[\"002824\",192,132]\n[\"002385\",193,133]\n[\"000366\",194,134]\n[\"000366\",195,135]\n[\"000366\",196,136]\n[\"000366\",197,137]\n[\"002418\",198,138]\n[\"002421\",199,138]\n[\"000366\",200,139]\n[\"000197\",201,140]\n[\"000366\",202,141]\n[\"000366\",203,142]\n[\"002418\",204,143]\n[\"002421\",205,143]\n[\"000366\",206,144]\n[\"002038\",207,145]\n[\"001090\",208,146]\n[\"002038\",209,147]\n[\"001453\",210,148]\n[\"000366\",211,149]\n[\"000068\",212,150]\n[\"002890\",213,150]\n[\"000366\",214,151]\n[\"000366\",215,152]\n[\"000381\",216,153]\n[\"001090\",217,154]\n[\"000381\",218,155]\n[\"000366\",219,156]\n[\"001090\",220,157]\n[\"000366\",221,158]\n[\"000366\",222,159]\n[\"000803\",223,160]\n[\"000196\",224,161]\n[\"000366\",225,162]\n[\"000366\",226,163]\n[\"000366\",227,164]\n[\"000366\",228,165]\n[\"002450\",229,166]\n[\"000366\",230,167]\n[\"002038\",231,168]\n[\"001084\",232,169]\n[\"002038\",233,170]\n[\"001084\",234,171]\n[\"001084\",235,172]\n[\"002038\",236,173]\n[\"001084\",237,174]\n[\"000381\",238,175]\n[\"000366\",239,176]\n[\"002235\",240,177]\n[\"000213\",241,178]\n[\"002235\",242,179]\n[\"000213\",243,180]\n[\"002235\",244,181]\n[\"002235\",245,182]\n[\"002235\",246,183]\n[\"002235\",247,184]\n[\"002235\",248,185]\n[\"002235\",249,186]\n[\"002235\",250,187]\n[\"002235\",251,188]\n[\"000213\",252,189]\n[\"000213\",253,190]\n[\"000213\",254,191]\n[\"000213\",255,192]\n[\"000213\",256,193]\n[\"002314\",257,193]\n[\"002235\",258,194]\n[\"002235\",259,195]\n[\"002235\",260,196]\n[\"002235\",261,197]\n[\"002235\",262,198]\n[\"000162\",263,199]\n[\"000163\",264,199]\n[\"000164\",265,199]\n[\"000171\",266,199]\n[\"001914\",267,199]\n[\"002235\",268,200]\n[\"002235\",269,201]\n[\"002235\",270,202]\n[\"002235\",271,203]\n[\"002235\",272,204]\n[\"000366\",273,205]\n[\"000135\",274,206]\n[\"000135\",275,207]\n[\"002824\",276,208]\n[\"002824\",277,209]\n[\"000381\",278,210]\n[\"000381\",279,211]\n[\"000172\",280,212]\n[\"000172\",281,213]\n[\"000381\",282,214]\n[\"000381\",283,215]\n[\"002235\",284,216]\n[\"000381\",285,217]\n[\"000381\",286,218]\n[\"000381\",287,219]\n[\"000381\",288,220]\n[\"000366\",289,221]\n[\"000172\",290,222]\n[\"000172\",291,223]\n[\"000803\",292,224]\n[\"000381\",293,225]\n[\"000366\",294,226]\n[\"000381\",295,227]\n[\"000172\",296,228]\n[\"000381\",297,229]\n[\"000381\",298,230]\n[\"000172\",299,231]\n[\"000366\",300,232]\n[\"000366\",301,233]\n[\"000366\",302,234]\n[\"000366\",303,235]\n[\"002824\",304,236]\n[\"000366\",305,237]\n[\"000366\",306,238]\n[\"000366\",307,239]\n[\"000366\",308,240]\n[\"000366\",309,241]\n[\"000366\",310,242]\n[\"000366\",311,243]\n[\"000366\",312,244]\n[\"000366\",313,245]\n[\"000366\",314,246]\n[\"000366\",315,247]\n[\"000366\",316,248]\n[\"000366\",317,249]\n[\"000366\",318,250]\n[\"000366\",319,251]\n[\"000366\",320,252]\n[\"000366\",321,253]\n[\"000366\",322,254]\n[\"000366\",323,255]\n[\"000366\",324,256]\n[\"000366\",325,257]\n[\"000366\",326,258]\n[\"000366\",327,259]\n[\"000366\",328,260]\n[\"000366\",329,261]\n[\"000366\",330,262]\n[\"000366\",331,263]\n[\"000366\",332,264]\n[\"000381\",333,265]\n[\"000366\",334,266]\n[\"000366\",335,267]\n[\"000366\",336,268]\n[\"000056\",337,269]\n[\"001199\",338,270]\n[\"002475\",339,270]\n[\"002476\",340,270]\n[\"001199\",341,271]\n[\"002475\",342,271]\n[\"002476\",343,271]\n[\"000130\",344,272]\n[\"000130\",345,273]\n[\"000130\",346,274]\n[\"000130\",347,275]\n[\"000130\",348,276]\n[\"000130\",349,277]\n[\"000130\",350,278]\n[\"000199\",351,279]\n[\"001090\",352,280]\n[\"000381\",353,281]\n[\"000381\",354,282]\n[\"000381\",355,283]\n[\"000381\",356,284]\n[\"001199\",357,285]\n[\"000366\",358,286]\n[\"000765\",359,287]\n[\"000766\",360,287]\n[\"000767\",361,287]\n[\"000768\",362,287]\n[\"001494\",512,288]\n[\"001496\",513,288]\n[\"002165\",514,288]\n[\"002235\",515,288]\n[\"000048\",516,289]\n[\"000048\",517,290]\n[\"000048\",518,291]\n[\"000056\",519,292]\n[\"001948\",520,293]\n[\"001953\",521,293]\n[\"001954\",522,293]\n[\"000057\",523,294]\n[\"000057\",524,295]\n[\"000057\",525,296]\n[\"000057\",526,297]\n[\"000057\",527,298]\n[\"000057\",528,299]\n[\"000057\",529,300]\n[\"000192\",530,301]\n[\"000192\",531,302]\n[\"000192\",532,303]\n[\"000193\",533,304]\n[\"000194\",534,305]\n[\"001619\",535,306]\n[\"000195\",536,307]\n[\"000195\",537,308]\n[\"000195\",538,309]\n[\"000195\",539,310]\n[\"000196\",540,311]\n[\"000196\",541,312]\n[\"000196\",542,313]\n[\"000198\",543,314]\n[\"000198\",544,315]\n[\"000199\",545,316]\n[\"000199\",546,317]\n[\"000200\",547,318]\n[\"000205\",548,319]\n[\"000366\",549,320]\n[\"000766\",550,321]\n[\"000795\",551,322]\n[\"000044\",552,323]\n[\"002236\",553,323]\n[\"002237\",554,323]\n[\"002238\",555,323]\n[\"002238\",556,324]\n[\"002038\",557,325]\n[\"002038\",558,326]\n[\"000366\",559,327]\n[\"000366\",560,328]\n[\"000366\",561,329]\n[\"000366\",562,330]\n[\"000366\",563,331]\n[\"000213\",564,332]\n[\"000213\",565,333]\n[\"000213\",566,334]\n[\"000213\",567,335]\n[\"000213\",568,336]\n[\"000766\",569,337]\n[\"000381\",570,338]\n[\"000381\",571,339]\n[\"002165\",572,340]\n[\"002235\",573,340]\n[\"001744\",574,341]\n[\"001744\",575,342]\n[\"001749\",576,343]\n[\"001749\",577,344]\n[\"000366\",579,345]\n[\"000778\",578,345]\n[\"001958\",580,345]\n[\"001958\",581,346]\n[\"000366\",582,347]\n[\"000778\",583,347]\n[\"001958\",584,347]\n[\"002617\",585,348]\n[\"002165\",587,349]\n[\"002696\",586,349]\n[\"002165\",589,350]\n[\"002696\",588,350]\n[\"000366\",590,351]\n[\"000366\",591,352]\n[\"000366\",592,353]\n[\"000366\",593,354]\n[\"000366\",594,355]\n[\"000366\",595,356]\n[\"000764\",596,357]\n[\"000366\",597,358]\n[\"002165\",598,359]\n[\"002165\",599,360]\n[\"000366\",600,361]\n[\"000366\",601,362]\n[\"000366\",602,363]\n[\"000366\",603,364]\n[\"000366\",604,365]\n[\"000366\",605,366]\n[\"000366\",606,367]\n[\"000366\",607,368]\n[\"000366\",608,369]\n[\"000366\",609,370]\n[\"000366\",610,371]\n[\"000366\",611,372]\n[\"000366\",612,373]\n[\"000366\",613,374]\n[\"000318\",615,375]\n[\"000368\",614,375]\n[\"001812\",616,375]\n[\"001813\",617,375]\n[\"001814\",618,375]\n[\"000366\",619,376]\n[\"000366\",620,377]\n[\"000366\",621,378]\n[\"000366\",622,379]\n[\"001764\",623,380]\n[\"001764\",624,381]\n[\"001764\",625,382]\n[\"000366\",626,383]\n[\"000318\",628,384]\n[\"000368\",627,384]\n[\"001812\",631,384]\n[\"001813\",630,384]\n[\"001814\",629,384]\n[\"000366\",632,385]\n[\"000366\",633,386]\n[\"000366\",634,387]\n[\"000366\",635,388]\n[\"000366\",636,389]\n[\"000366\",637,390]\n[\"000366\",638,391]\n[\"000366\",639,392]\n[\"000068\",641,393]\n[\"001199\",640,393]\n[\"002450\",642,393]\n[\"002476\",643,393]\n[\"000366\",644,394]\n[\"000366\",645,395]\n[\"000366\",646,396]\n[\"000318\",648,397]\n[\"000368\",647,397]\n[\"001812\",651,397]\n[\"001813\",649,397]\n[\"001814\",650,397]\n[\"000381\",652,398]\n[\"000126\",654,399]\n[\"000131\",653,399]\n[\"000139\",655,400]\n[\"001851\",656,401]\n[\"001851\",657,402]\n[\"001851\",658,403]\n[\"001851\",659,404]\n[\"001851\",660,405]\n[\"001851\",661,406]\n[\"001851\",662,407]\n[\"001851\",663,408]\n[\"001855\",664,409]\n[\"001855\",665,410]\n[\"001855\",666,411]\n[\"002234\",667,412]\n[\"000126\",669,413]\n[\"000172\",668,413]\n[\"000126\",670,414]\n[\"000172\",671,414]\n[\"000126\",673,415]\n[\"000172\",672,415]\n[\"000126\",674,416]\n[\"000172\",675,416]\n[\"000172\",676,417]\n[\"000172\",677,418]\n[\"000172\",678,419]\n[\"000172\",679,420]\n[\"000172\",680,421]\n[\"000172\",681,422]\n[\"000172\",682,423]\n[\"000172\",683,424]\n[\"000172\",684,425]\n[\"000172\",685,426]\n[\"002884\",686,426]\n[\"000172\",687,427]\n[\"002884\",688,427]\n[\"000172\",689,428]\n[\"002884\",690,428]\n[\"000172\",691,429]\n[\"002884\",692,429]\n[\"000172\",693,430]\n[\"002884\",694,430]\n[\"000172\",695,431]\n[\"002884\",696,431]\n[\"000172\",697,432]\n[\"002884\",698,432]\n[\"000172\",699,433]\n[\"002884\",700,433]\n[\"000172\",701,434]\n[\"002884\",702,434]\n[\"000172\",703,435]\n[\"002884\",704,435]\n[\"000126\",705,436]\n[\"000172\",706,436]\n[\"002884\",707,436]\n[\"000126\",708,437]\n[\"000172\",709,437]\n[\"002884\",710,437]\n[\"000135\",712,438]\n[\"000172\",711,438]\n[\"002884\",713,438]\n[\"000135\",714,439]\n[\"000172\",715,439]\n[\"002884\",716,439]\n[\"000135\",717,440]\n[\"000172\",718,440]\n[\"002884\",719,440]\n[\"000135\",721,441]\n[\"000172\",720,441]\n[\"002884\",722,441]\n[\"000135\",723,442]\n[\"000172\",724,442]\n[\"002884\",725,442]\n[\"000130\",728,443]\n[\"000135\",727,443]\n[\"000172\",726,443]\n[\"002884\",729,443]\n[\"000130\",730,444]\n[\"000135\",731,444]\n[\"000172\",732,444]\n[\"002884\",733,444]\n[\"000130\",736,445]\n[\"000135\",735,445]\n[\"000172\",734,445]\n[\"002884\",737,445]\n[\"000130\",738,446]\n[\"000135\",739,446]\n[\"000172\",740,446]\n[\"002884\",741,446]\n[\"000130\",743,447]\n[\"000135\",744,447]\n[\"000172\",742,447]\n[\"002884\",745,447]\n[\"000135\",746,448]\n[\"002884\",747,448]\n[\"000135\",748,449]\n[\"002884\",749,449]\n[\"000135\",750,450]\n[\"002884\",751,450]\n[\"000135\",752,451]\n[\"002884\",753,451]\n[\"000135\",754,452]\n[\"000172\",755,452]\n[\"002884\",756,452]\n[\"000135\",758,453]\n[\"000172\",757,453]\n[\"002884\",759,453]\n[\"000172\",760,454]\n[\"000172\",761,455]\n[\"000172\",762,456]\n[\"000172\",763,457]\n[\"000172\",764,458]\n[\"000172\",765,459]\n[\"000018\",767,460]\n[\"000172\",766,460]\n[\"001403\",769,460]\n[\"002130\",768,460]\n[\"000018\",770,461]\n[\"000172\",771,461]\n[\"001403\",772,461]\n[\"002130\",773,461]\n[\"000018\",775,462]\n[\"000172\",774,462]\n[\"001403\",777,462]\n[\"002130\",776,462]\n[\"000018\",778,463]\n[\"000172\",779,463]\n[\"001403\",780,463]\n[\"002130\",781,463]\n[\"000018\",782,464]\n[\"000172\",783,464]\n[\"001403\",785,464]\n[\"002130\",784,464]\n[\"000172\",786,465]\n[\"002884\",787,465]\n[\"000172\",788,466]\n[\"002884\",789,466]\n[\"000172\",790,467]\n[\"002884\",791,467]\n[\"000172\",792,468]\n[\"002884\",793,468]\n[\"000172\",794,469]\n[\"002884\",795,469]\n[\"000366\",796,470]\n[\"000318\",797,471]\n[\"000368\",798,471]\n[\"001812\",800,471]\n[\"001813\",801,471]\n[\"001814\",799,471]\n[\"000054\",802,472]\n[\"000382\",803,473]\n[\"002314\",804,473]\n[\"000068\",807,474]\n[\"000366\",805,474]\n[\"000803\",806,474]\n[\"001133\",808,475]\n[\"002361\",809,475]\n[\"000048\",815,476]\n[\"000050\",816,476]\n[\"001384\",810,476]\n[\"001385\",811,476]\n[\"001386\",812,476]\n[\"001387\",813,476]\n[\"001388\",814,476]\n[\"001453\",817,477]\n[\"001453\",818,478]\n[\"001453\",819,479]\n[\"000366\",820,480]\n[\"002418\",821,481]\n[\"002420\",822,481]\n[\"002421\",823,481]\n[\"002422\",824,481]\n[\"002418\",827,482]\n[\"002420\",828,482]\n[\"002421\",825,482]\n[\"002422\",826,482]\n[\"001133\",829,483]\n[\"002361\",830,483]\n[\"000366\",831,484]\n[\"001133\",832,485]\n[\"002361\",833,485]\n[\"000366\",834,486]\n[\"000366\",835,487]\n[\"000366\",836,488]\n[\"000366\",837,489]\n[\"000197\",838,490]\n[\"000366\",839,490]\n[\"001453\",840,491]\n[\"000366\",841,492]\n[\"000366\",842,493]\n[\"000318\",843,494]\n[\"000368\",844,494]\n[\"001812\",845,494]\n[\"001813\",847,494]\n[\"001814\",846,494]\n[\"000318\",849,495]\n[\"000368\",848,495]\n[\"001812\",852,495]\n[\"001813\",851,495]\n[\"001814\",850,495]\n[\"000366\",853,496]\n[\"000366\",854,497]\n[\"000366\",855,498]\n[\"001891\",857,499]\n[\"002046\",856,499]\n[\"000366\",858,500]\n[\"000366\",859,501]\n[\"000366\",860,502]\n[\"000366\",861,503]\n[\"000366\",862,504]\n[\"000366\",863,505]\n[\"000366\",864,506]\n[\"000366\",865,507]\n[\"000366\",866,508]\n[\"000366\",867,509]\n[\"000366\",868,510]\n[\"000366\",869,511]\n[\"000366\",870,512]\n[\"000366\",871,513]\n[\"000366\",872,514]\n[\"000366\",873,515]\n[\"000366\",874,516]\n[\"000318\",875,517]\n[\"000368\",876,517]\n[\"001812\",878,517]\n[\"001813\",877,517]\n[\"001814\",879,517]\n[\"000366\",880,518]\n[\"000366\",881,519]\n[\"000366\",882,520]\n[\"000366\",883,521]\n[\"000366\",884,522]\n[\"000366\",885,523]\n[\"000366\",886,524]\n[\"000366\",887,525]\n[\"000366\",888,526]\n[\"001948\",890,527]\n[\"001953\",891,527]\n[\"001954\",889,527]\n[\"001948\",893,528]\n[\"001953\",892,528]\n[\"001954\",894,528]\n[\"001948\",896,529]\n[\"001953\",897,529]\n[\"001954\",895,529]\n[\"001443\",898,530]\n[\"001444\",899,530]\n[\"002418\",900,530]\n[\"000057\",901,534]\n[\"001414\",1023,535]\n[\"000048\",1024,536]\n[\"001414\",1026,537]\n[\"000048\",1027,538]\n[\"000050\",1028,539]\n[\"001384\",1029,540]\n[\"001385\",1030,540]\n[\"001386\",1031,540]\n[\"001387\",1032,540]\n[\"001388\",1033,540]\n[\"000053\",1034,541]\n[\"000054\",1035,542]\n[\"000068\",1036,543]\n[\"001453\",1037,544]\n[\"001453\",1038,545]\n[\"000068\",1039,546]\n[\"000130\",1040,547]\n[\"000131\",1041,548]\n[\"001487\",1042,549]\n[\"000132\",1043,550]\n[\"000133\",1044,551]\n[\"000134\",1045,552]\n[\"000162\",1046,553]\n[\"000163\",1047,554]\n[\"000164\",1048,555]\n[\"000382\",1049,556]\n[\"000382\",1050,557]\n[\"000382\",1051,558]\n[\"000382\",1052,559]\n[\"000764\",1053,560]\n[\"000766\",1054,561]\n[\"001939\",1055,562]\n[\"001942\",1056,563]\n[\"001942\",1057,564]\n[\"000778\",1058,565]\n[\"000185\",1059,566]\n[\"000186\",1060,567]\n[\"000187\",1061,568]\n[\"000187\",1062,569]\n[\"000803\",1063,570]\n[\"000804\",1064,571]\n[\"001097\",1065,572]\n[\"001133\",1066,573]\n[\"001184\",1067,574]\n[\"001184\",1068,575]\n[\"001185\",1069,576]\n[\"001664\",1070,577]\n[\"001188\",1071,578]\n[\"001190\",1072,579]\n[\"002314\",1073,580]\n[\"002322\",1074,581]\n[\"000068\",1075,582]\n[\"002353\",1076,583]\n[\"002250\",1077,584]\n[\"001844\",1078,585]\n[\"001851\",1079,586]\n[\"001858\",1080,587]\n[\"001861\",1081,588]\n[\"002038\",1082,589]\n[\"002038\",1083,590]\n[\"001953\",1084,591]\n[\"001954\",1085,592]\n[\"001958\",1086,593]\n[\"002450\",1087,594]\n[\"002397\",1088,595]\n[\"002418\",1089,596]\n[\"002418\",1090,597]\n[\"002423\",1091,598]\n[\"000197\",1092,599]\n[\"000172\",1093,600]\n[\"002450\",1094,601]\n[\"002450\",1095,602]\n[\"002450\",1096,603]\n[\"000366\",1097,604]\n[\"000366\",1098,605]\n[\"002363\",1099,606]\n[\"002364\",1100,607]\n[\"000196\",1101,608]\n[\"000068\",1102,609]\n[\"001453\",1103,610]\n[\"001453\",1104,611]\n[\"001967\",1105,612]\n[\"002450\",1106,613]\n[\"002450\",1107,614]\n[\"000185\",1108,615]\n[\"000803\",1109,616]\n[\"000068\",1110,617]\n[\"001414\",1153,618]\n[\"000048\",1154,619]\n[\"001414\",1156,620]\n[\"001414\",1157,621]\n[\"000048\",1158,622]\n[\"000366\",1159,623]\n[\"001812\",1160,624]\n[\"000366\",1161,625]\n[\"001812\",1162,626]\n[\"000366\",1163,627]\n[\"000366\",1164,628]\n[\"000877\",1165,629]\n[\"001199\",1166,630]\n[\"002475\",1167,630]\n[\"002476\",1168,630]\n[\"002890\",1169,631]\n[\"003123\",1170,631]\n[\"000877\",1171,632]\n[\"001233\",1172,633]\n[\"001774\",1173,634]\n[\"000877\",1174,635]\n[\"000366\",1175,636]\n[\"000366\",1176,637]\n[\"000213\",1177,638]\n[\"000366\",1178,639]\n[\"001090\",1179,640]\n[\"000795\",1180,641]\n[\"002235\",1181,642]\n[\"000366\",1182,643]\n[\"000381\",1183,644]\n[\"000366\",1184,645]\n[\"002890\",1185,646]\n[\"003123\",1186,646]\n[\"000199\",1187,647]\n[\"002165\",1188,648]\n[\"002038\",1189,649]\n[\"000381\",1190,650]\n[\"000382\",1191,651]\n[\"000381\",1192,652]\n[\"000382\",1193,653]\n[\"000382\",1194,654]\n[\"000366\",1195,655]\n[\"000366\",1196,656]\n[\"000366\",1197,657]\n[\"002238\",1198,658]\n[\"000044\",1199,659]\n[\"000044\",1200,660]\n[\"002238\",1201,660]\n[\"000200\",1202,661]\n[\"000199\",1203,662]\n[\"000198\",1204,663]\n[\"000205\",1205,664]\n[\"000192\",1206,665]\n[\"000193\",1207,665]\n[\"000194\",1208,665]\n[\"001619\",1209,665]\n[\"000196\",1210,666]\n[\"000172\",1211,667]\n[\"000172\",1212,668]\n[\"000018\",1213,669]\n[\"000172\",1214,669]\n[\"001403\",1215,669]\n[\"001404\",1216,669]\n[\"001405\",1217,669]\n[\"002130\",1218,669]\n[\"002234\",1219,669]\n[\"000018\",1220,670]\n[\"000172\",1221,670]\n[\"001403\",1222,670]\n[\"001404\",1223,670]\n[\"001405\",1224,670]\n[\"002130\",1225,670]\n[\"002234\",1226,670]\n[\"000018\",1227,671]\n[\"000172\",1228,671]\n[\"001403\",1229,671]\n[\"001404\",1230,671]\n[\"001405\",1231,671]\n[\"002130\",1232,671]\n[\"002234\",1233,671]\n[\"000172\",1234,672]\n[\"000172\",1235,673]\n[\"000172\",1236,674]\n[\"000067\",1237,675]\n[\"000172\",1238,675]\n[\"000067\",1239,676]\n[\"000172\",1240,676]\n[\"000067\",1241,677]\n[\"000172\",1242,677]\n[\"000172\",1243,678]\n[\"000172\",1244,679]\n[\"000172\",1245,680]\n[\"000172\",1246,681]\n[\"000172\",1247,682]\n[\"002234\",1248,682]\n[\"000172\",1249,683]\n[\"002234\",1250,683]\n[\"000172\",1251,684]\n[\"002234\",1252,684]\n[\"000172\",1253,685]\n[\"000172\",1254,686]\n[\"000172\",1255,687]\n[\"000172\",1256,688]\n[\"002234\",1257,688]\n[\"000172\",1258,689]\n[\"002234\",1259,689]\n[\"000172\",1260,690]\n[\"002234\",1261,690]\n[\"000172\",1262,691]\n[\"002234\",1263,691]\n[\"001849\",1264,692]\n[\"001849\",1265,693]\n[\"001849\",1266,694]\n[\"000162\",1267,695]\n[\"000163\",1268,695]\n[\"000164\",1269,695]\n[\"000162\",1270,696]\n[\"000163\",1271,696]\n[\"000164\",1272,696]\n[\"000162\",1273,697]\n[\"000163\",1274,697]\n[\"000164\",1275,697]\n[\"000381\",1276,698]\n[\"000381\",1277,699]\n[\"000366\",1278,700]\n[\"000366\",1279,701]\n[\"000366\",1280,702]\n[\"002385\",1281,703]\n[\"000366\",1282,704]\n[\"000366\",1283,705]\n[\"000185\",1284,706]\n[\"002470\",1285,706]\n[\"000366\",1286,707]\n[\"000185\",1287,708]\n[\"000366\",1288,709]\n[\"000185\",1289,710]\n[\"002470\",1290,710]\n[\"000185\",1291,711]\n[\"002470\",1292,711]\n[\"000366\",1293,712]\n[\"002235\",1294,713]\n[\"000366\",1295,714]\n[\"001084\",1296,715]\n[\"000366\",1297,716]\n[\"000764\",1298,717]\n[\"000366\",1299,718]\n[\"000366\",1300,719]\n[\"000804\",1301,720]\n[\"000381\",1302,721]\n[\"000366\",1303,722]\n[\"000366\",1304,723]\n[\"000381\",1305,724]\n[\"000381\",1306,725]\n[\"000366\",1307,726]\n[\"000366\",1308,727]\n[\"000381\",1309,728]\n[\"000381\",1310,729]\n[\"000169\",1311,730]\n[\"002418\",1312,731]\n[\"002421\",1313,731]\n[\"002418\",1314,732]\n[\"002421\",1315,732]\n[\"002038\",1316,733]\n[\"002418\",1317,734]\n[\"002421\",1318,734]\n[\"002038\",1319,735]\n[\"001090\",1320,736]\n[\"000366\",1321,737]\n[\"001967\",1322,738]\n[\"000366\",1323,739]\n[\"000366\",1324,740]\n[\"000381\",1325,741]\n[\"002418\",1326,742]\n[\"002421\",1327,742]\n[\"001764\",1328,743]\n[\"000057\",1329,744]\n[\"001764\",1330,745]\n[\"001764\",1331,746]\n[\"000048\",1332,747]\n[\"000050\",1333,747]\n[\"001384\",1334,747]\n[\"001385\",1335,747]\n[\"001386\",1336,747]\n[\"001387\",1337,747]\n[\"001388\",1338,747]\n[\"000366\",1339,748]\n[\"001084\",1340,749]\n[\"000048\",1341,750]\n[\"001384\",1342,750]\n[\"001385\",1343,750]\n[\"001386\",1344,750]\n[\"001387\",1345,750]\n[\"001388\",1346,750]\n[\"000366\",1347,751]\n[\"000381\",1348,752]\n[\"000366\",1349,753]\n[\"002824\",1350,754]\n[\"002385\",1351,755]\n[\"000366\",1352,756]\n[\"000366\",1353,757]\n[\"000366\",1354,758]\n[\"000366\",1355,759]\n[\"002418\",1356,760]\n[\"002421\",1357,760]\n[\"000366\",1358,761]\n[\"000197\",1359,762]\n[\"000366\",1360,763]\n[\"000366\",1361,764]\n[\"002418\",1362,765]\n[\"002421\",1363,765]\n[\"000366\",1364,766]\n[\"002038\",1365,767]\n[\"001090\",1366,768]\n[\"002038\",1367,769]\n[\"001453\",1368,770]\n[\"000366\",1369,771]\n[\"000068\",1370,772]\n[\"002890\",1371,772]\n[\"000366\",1372,773]\n[\"000366\",1373,774]\n[\"000381\",1374,775]\n[\"001090\",1375,776]\n[\"000381\",1376,777]\n[\"000366\",1377,778]\n[\"001090\",1378,779]\n[\"000366\",1379,780]\n[\"000366\",1380,781]\n[\"000803\",1381,782]\n[\"000196\",1382,783]\n[\"000366\",1383,784]\n[\"000366\",1384,785]\n[\"000366\",1385,786]\n[\"000366\",1386,787]\n[\"002450\",1387,788]\n[\"000366\",1388,789]\n[\"002038\",1389,790]\n[\"001084\",1390,791]\n[\"002038\",1391,792]\n[\"001084\",1392,793]\n[\"001084\",1393,794]\n[\"002038\",1394,795]\n[\"001084\",1395,796]\n[\"000381\",1396,797]\n[\"000366\",1397,798]\n[\"002235\",1398,799]\n[\"000213\",1399,800]\n[\"002235\",1400,801]\n[\"000213\",1401,802]\n[\"002235\",1402,803]\n[\"002235\",1403,804]\n[\"002235\",1404,805]\n[\"002235\",1405,806]\n[\"002235\",1406,807]\n[\"002235\",1407,808]\n[\"002235\",1408,809]\n[\"002235\",1409,810]\n[\"000213\",1410,811]\n[\"000213\",1411,812]\n[\"000213\",1412,813]\n[\"000213\",1413,814]\n[\"000213\",1414,815]\n[\"002314\",1415,815]\n[\"002235\",1416,816]\n[\"002235\",1417,817]\n[\"002235\",1418,818]\n[\"002235\",1419,819]\n[\"002235\",1420,820]\n[\"000162\",1421,821]\n[\"000163\",1422,821]\n[\"000164\",1423,821]\n[\"000171\",1424,821]\n[\"001914\",1425,821]\n[\"002235\",1426,822]\n[\"002235\",1427,823]\n[\"002235\",1428,824]\n[\"002235\",1429,825]\n[\"002235\",1430,826]\n[\"000366\",1431,827]\n[\"000135\",1432,828]\n[\"000135\",1433,829]\n[\"002824\",1434,830]\n[\"002824\",1435,831]\n[\"000381\",1436,832]\n[\"000381\",1437,833]\n[\"000172\",1438,834]\n[\"000172\",1439,835]\n[\"000381\",1440,836]\n[\"000381\",1441,837]\n[\"002235\",1442,838]\n[\"000381\",1443,839]\n[\"000381\",1444,840]\n[\"000381\",1445,841]\n[\"000381\",1446,842]\n[\"000366\",1447,843]\n[\"000172\",1448,844]\n[\"000172\",1449,845]\n[\"000803\",1450,846]\n[\"000381\",1451,847]\n[\"000366\",1452,848]\n[\"000381\",1453,849]\n[\"000172\",1454,850]\n[\"000381\",1455,851]\n[\"000381\",1456,852]\n[\"000172\",1457,853]\n[\"000366\",1458,854]\n[\"000366\",1459,855]\n[\"000366\",1460,856]\n[\"000366\",1461,857]\n[\"002824\",1462,858]\n[\"000366\",1463,859]\n[\"000366\",1464,860]\n[\"000366\",1465,861]\n[\"000366\",1466,862]\n[\"000366\",1467,863]\n[\"000366\",1468,864]\n[\"000366\",1469,865]\n[\"000366\",1470,866]\n[\"000366\",1471,867]\n[\"000366\",1472,868]\n[\"000366\",1473,869]\n[\"000366\",1474,870]\n[\"000366\",1475,871]\n[\"000366\",1476,872]\n[\"000366\",1477,873]\n[\"000366\",1478,874]\n[\"000366\",1479,875]\n[\"000366\",1480,876]\n[\"000366\",1481,877]\n[\"000366\",1482,878]\n[\"000366\",1483,879]\n[\"000366\",1484,880]\n[\"000366\",1485,881]\n[\"000366\",1486,882]\n[\"000366\",1487,883]\n[\"000366\",1488,884]\n[\"000366\",1489,885]\n[\"000366\",1490,886]\n[\"000381\",1491,887]\n[\"000366\",1492,888]\n[\"000366\",1493,889]\n[\"000366\",1494,890]\n[\"000056\",1495,891]\n[\"001199\",1496,892]\n[\"002475\",1497,892]\n[\"002476\",1498,892]\n[\"001199\",1499,893]\n[\"002475\",1500,893]\n[\"002476\",1501,893]\n[\"000130\",1502,894]\n[\"000130\",1503,895]\n[\"000130\",1504,896]\n[\"000130\",1505,897]\n[\"000130\",1506,898]\n[\"000130\",1507,899]\n[\"000130\",1508,900]\n[\"000199\",1509,901]\n[\"001090\",1510,902]\n[\"000381\",1511,903]\n[\"000381\",1512,904]\n[\"000381\",1513,905]\n[\"000381\",1514,906]\n[\"001199\",1515,907]\n[\"000366\",1516,908]\n[\"000765\",1517,909]\n[\"000766\",1518,909]\n[\"000767\",1519,909]\n[\"000768\",1520,909]\n[\"001494\",1670,910]\n[\"001496\",1671,910]\n[\"002165\",1672,910]\n[\"002235\",1673,910]\n[\"000048\",1674,911]\n[\"000048\",1675,912]\n[\"000048\",1676,913]\n[\"000056\",1677,914]\n[\"001948\",1678,915]\n[\"001953\",1679,915]\n[\"001954\",1680,915]\n[\"000057\",1681,916]\n[\"000057\",1682,917]\n[\"000057\",1683,918]\n[\"000057\",1684,919]\n[\"000057\",1685,920]\n[\"000057\",1686,921]\n[\"000057\",1687,922]\n[\"000192\",1688,923]\n[\"000192\",1689,924]\n[\"000192\",1690,925]\n[\"000193\",1691,926]\n[\"000194\",1692,927]\n[\"001619\",1693,928]\n[\"000195\",1694,929]\n[\"000195\",1695,930]\n[\"000195\",1696,931]\n[\"000195\",1697,932]\n[\"000196\",1698,933]\n[\"000196\",1699,934]\n[\"000196\",1700,935]\n[\"000198\",1701,936]\n[\"000198\",1702,937]\n[\"000199\",1703,938]\n[\"000199\",1704,939]\n[\"000200\",1705,940]\n[\"000205\",1706,941]\n[\"000366\",1707,942]\n[\"000766\",1708,943]\n[\"000795\",1709,944]\n[\"000044\",1710,945]\n[\"002236\",1711,945]\n[\"002237\",1712,945]\n[\"002238\",1713,945]\n[\"002238\",1714,946]\n[\"002038\",1715,947]\n[\"002038\",1716,948]\n[\"000366\",1717,949]\n[\"000366\",1718,950]\n[\"000366\",1719,951]\n[\"000366\",1720,952]\n[\"000366\",1721,953]\n[\"000213\",1722,954]\n[\"000213\",1723,955]\n[\"000213\",1724,956]\n[\"000213\",1725,957]\n[\"000213\",1726,958]\n[\"000766\",1727,959]\n[\"000381\",1728,960]\n[\"000381\",1729,961]\n[\"002165\",1730,962]\n[\"002235\",1731,962]\n[\"001744\",1732,963]\n[\"001744\",1733,964]\n[\"001749\",1734,965]\n[\"001749\",1735,966]\n[\"000366\",1737,967]\n[\"000778\",1736,967]\n[\"001958\",1738,967]\n[\"001958\",1739,968]\n[\"000366\",1740,969]\n[\"000778\",1741,969]\n[\"001958\",1742,969]\n[\"002617\",1743,970]\n[\"002165\",1745,971]\n[\"002696\",1744,971]\n[\"002165\",1747,972]\n[\"002696\",1746,972]\n[\"000366\",1748,973]\n[\"000366\",1749,974]\n[\"000366\",1750,975]\n[\"000366\",1751,976]\n[\"000366\",1752,977]\n[\"000366\",1753,978]\n[\"000764\",1754,979]\n[\"000366\",1755,980]\n[\"002165\",1756,981]\n[\"002165\",1757,982]\n[\"000366\",1758,983]\n[\"000366\",1759,984]\n[\"000366\",1760,985]\n[\"000366\",1761,986]\n[\"000366\",1762,987]\n[\"000366\",1763,988]\n[\"000366\",1764,989]\n[\"000366\",1765,990]\n[\"000366\",1766,991]\n[\"000366\",1767,992]\n[\"000366\",1768,993]\n[\"000366\",1769,994]\n[\"000366\",1770,995]\n[\"000366\",1771,996]\n[\"000318\",1773,997]\n[\"000368\",1772,997]\n[\"001812\",1774,997]\n[\"001813\",1775,997]\n[\"001814\",1776,997]\n[\"000366\",1777,998]\n[\"000366\",1778,999]\n[\"000366\",1779,1000]\n[\"000366\",1780,1001]\n[\"001764\",1781,1002]\n[\"001764\",1782,1003]\n[\"001764\",1783,1004]\n[\"000366\",1784,1005]\n[\"000318\",1786,1006]\n[\"000368\",1785,1006]\n[\"001812\",1789,1006]\n[\"001813\",1788,1006]\n[\"001814\",1787,1006]\n[\"000366\",1790,1007]\n[\"000366\",1791,1008]\n[\"000366\",1792,1009]\n[\"000366\",1793,1010]\n[\"000366\",1794,1011]\n[\"000366\",1795,1012]\n[\"000366\",1796,1013]\n[\"000366\",1797,1014]\n[\"000068\",1799,1015]\n[\"001199\",1798,1015]\n[\"002450\",1800,1015]\n[\"002476\",1801,1015]\n[\"000366\",1802,1016]\n[\"000366\",1803,1017]\n[\"000366\",1804,1018]\n[\"000318\",1806,1019]\n[\"000368\",1805,1019]\n[\"001812\",1809,1019]\n[\"001813\",1807,1019]\n[\"001814\",1808,1019]\n[\"000381\",1810,1020]\n[\"000126\",1812,1021]\n[\"000131\",1811,1021]\n[\"000139\",1813,1022]\n[\"001851\",1814,1023]\n[\"001851\",1815,1024]\n[\"001851\",1816,1025]\n[\"001851\",1817,1026]\n[\"001851\",1818,1027]\n[\"001851\",1819,1028]\n[\"001851\",1820,1029]\n[\"001851\",1821,1030]\n[\"001855\",1822,1031]\n[\"001855\",1823,1032]\n[\"001855\",1824,1033]\n[\"002234\",1825,1034]\n[\"000126\",1827,1035]\n[\"000172\",1826,1035]\n[\"000126\",1828,1036]\n[\"000172\",1829,1036]\n[\"000126\",1831,1037]\n[\"000172\",1830,1037]\n[\"000126\",1832,1038]\n[\"000172\",1833,1038]\n[\"000172\",1834,1039]\n[\"000172\",1835,1040]\n[\"000172\",1836,1041]\n[\"000172\",1837,1042]\n[\"000172\",1838,1043]\n[\"000172\",1839,1044]\n[\"000172\",1840,1045]\n[\"000172\",1841,1046]\n[\"000172\",1842,1047]\n[\"000172\",1843,1048]\n[\"002884\",1844,1048]\n[\"000172\",1845,1049]\n[\"002884\",1846,1049]\n[\"000172\",1847,1050]\n[\"002884\",1848,1050]\n[\"000172\",1849,1051]\n[\"002884\",1850,1051]\n[\"000172\",1851,1052]\n[\"002884\",1852,1052]\n[\"000172\",1853,1053]\n[\"002884\",1854,1053]\n[\"000172\",1855,1054]\n[\"002884\",1856,1054]\n[\"000172\",1857,1055]\n[\"002884\",1858,1055]\n[\"000172\",1859,1056]\n[\"002884\",1860,1056]\n[\"000172\",1861,1057]\n[\"002884\",1862,1057]\n[\"000126\",1863,1058]\n[\"000172\",1864,1058]\n[\"002884\",1865,1058]\n[\"000126\",1866,1059]\n[\"000172\",1867,1059]\n[\"002884\",1868,1059]\n[\"000135\",1870,1060]\n[\"000172\",1869,1060]\n[\"002884\",1871,1060]\n[\"000135\",1872,1061]\n[\"000172\",1873,1061]\n[\"002884\",1874,1061]\n[\"000135\",1875,1062]\n[\"000172\",1876,1062]\n[\"002884\",1877,1062]\n[\"000135\",1879,1063]\n[\"000172\",1878,1063]\n[\"002884\",1880,1063]\n[\"000135\",1881,1064]\n[\"000172\",1882,1064]\n[\"002884\",1883,1064]\n[\"000130\",1886,1065]\n[\"000135\",1885,1065]\n[\"000172\",1884,1065]\n[\"002884\",1887,1065]\n[\"000130\",1888,1066]\n[\"000135\",1889,1066]\n[\"000172\",1890,1066]\n[\"002884\",1891,1066]\n[\"000130\",1894,1067]\n[\"000135\",1893,1067]\n[\"000172\",1892,1067]\n[\"002884\",1895,1067]\n[\"000130\",1896,1068]\n[\"000135\",1897,1068]\n[\"000172\",1898,1068]\n[\"002884\",1899,1068]\n[\"000130\",1901,1069]\n[\"000135\",1902,1069]\n[\"000172\",1900,1069]\n[\"002884\",1903,1069]\n[\"000135\",1904,1070]\n[\"002884\",1905,1070]\n[\"000135\",1906,1071]\n[\"002884\",1907,1071]\n[\"000135\",1908,1072]\n[\"002884\",1909,1072]\n[\"000135\",1910,1073]\n[\"002884\",1911,1073]\n[\"000135\",1912,1074]\n[\"000172\",1913,1074]\n[\"002884\",1914,1074]\n[\"000135\",1916,1075]\n[\"000172\",1915,1075]\n[\"002884\",1917,1075]\n[\"000172\",1918,1076]\n[\"000172\",1919,1077]\n[\"000172\",1920,1078]\n[\"000172\",1921,1079]\n[\"000172\",1922,1080]\n[\"000172\",1923,1081]\n[\"000018\",1925,1082]\n[\"000172\",1924,1082]\n[\"001403\",1927,1082]\n[\"002130\",1926,1082]\n[\"000018\",1928,1083]\n[\"000172\",1929,1083]\n[\"001403\",1930,1083]\n[\"002130\",1931,1083]\n[\"000018\",1933,1084]\n[\"000172\",1932,1084]\n[\"001403\",1935,1084]\n[\"002130\",1934,1084]\n[\"000018\",1936,1085]\n[\"000172\",1937,1085]\n[\"001403\",1938,1085]\n[\"002130\",1939,1085]\n[\"000018\",1940,1086]\n[\"000172\",1941,1086]\n[\"001403\",1943,1086]\n[\"002130\",1942,1086]\n[\"000172\",1944,1087]\n[\"002884\",1945,1087]\n[\"000172\",1946,1088]\n[\"002884\",1947,1088]\n[\"000172\",1948,1089]\n[\"002884\",1949,1089]\n[\"000172\",1950,1090]\n[\"002884\",1951,1090]\n[\"000172\",1952,1091]\n[\"002884\",1953,1091]\n[\"000366\",1954,1092]\n[\"000318\",1955,1093]\n[\"000368\",1956,1093]\n[\"001812\",1958,1093]\n[\"001813\",1959,1093]\n[\"001814\",1957,1093]\n[\"000054\",1960,1094]\n[\"000382\",1961,1095]\n[\"002314\",1962,1095]\n[\"000068\",1965,1096]\n[\"000366\",1963,1096]\n[\"000803\",1964,1096]\n[\"001133\",1966,1097]\n[\"002361\",1967,1097]\n[\"000048\",1973,1098]\n[\"000050\",1974,1098]\n[\"001384\",1968,1098]\n[\"001385\",1969,1098]\n[\"001386\",1970,1098]\n[\"001387\",1971,1098]\n[\"001388\",1972,1098]\n[\"001453\",1975,1099]\n[\"001453\",1976,1100]\n[\"001453\",1977,1101]\n[\"000366\",1978,1102]\n[\"002418\",1979,1103]\n[\"002420\",1980,1103]\n[\"002421\",1981,1103]\n[\"002422\",1982,1103]\n[\"002418\",1985,1104]\n[\"002420\",1986,1104]\n[\"002421\",1983,1104]\n[\"002422\",1984,1104]\n[\"001133\",1987,1105]\n[\"002361\",1988,1105]\n[\"000366\",1989,1106]\n[\"001133\",1990,1107]\n[\"002361\",1991,1107]\n[\"000366\",1992,1108]\n[\"000366\",1993,1109]\n[\"000366\",1994,1110]\n[\"000366\",1995,1111]\n[\"000197\",1996,1112]\n[\"000366\",1997,1112]\n[\"001453\",1998,1113]\n[\"000366\",1999,1114]\n[\"000366\",2000,1115]\n[\"000318\",2001,1116]\n[\"000368\",2002,1116]\n[\"001812\",2003,1116]\n[\"001813\",2005,1116]\n[\"001814\",2004,1116]\n[\"000318\",2007,1117]\n[\"000368\",2006,1117]\n[\"001812\",2010,1117]\n[\"001813\",2009,1117]\n[\"001814\",2008,1117]\n[\"000366\",2011,1118]\n[\"000366\",2012,1119]\n[\"000366\",2013,1120]\n[\"001891\",2015,1121]\n[\"002046\",2014,1121]\n[\"000366\",2016,1122]\n[\"000366\",2017,1123]\n[\"000366\",2018,1124]\n[\"000366\",2019,1125]\n[\"000366\",2020,1126]\n[\"000366\",2021,1127]\n[\"000366\",2022,1128]\n[\"000366\",2023,1129]\n[\"000366\",2024,1130]\n[\"000366\",2025,1131]\n[\"000366\",2026,1132]\n[\"000366\",2027,1133]\n[\"000366\",2028,1134]\n[\"000366\",2029,1135]\n[\"000366\",2030,1136]\n[\"000366\",2031,1137]\n[\"000366\",2032,1138]\n[\"000318\",2033,1139]\n[\"000368\",2034,1139]\n[\"001812\",2036,1139]\n[\"001813\",2035,1139]\n[\"001814\",2037,1139]\n[\"000366\",2038,1140]\n[\"000366\",2039,1141]\n[\"000366\",2040,1142]\n[\"000366\",2041,1143]\n[\"000366\",2042,1144]\n[\"000366\",2043,1145]\n[\"000366\",2044,1146]\n[\"000366\",2045,1147]\n[\"000366\",2046,1148]\n[\"001948\",2048,1149]\n[\"001953\",2049,1149]\n[\"001954\",2047,1149]\n[\"001948\",2051,1150]\n[\"001953\",2050,1150]\n[\"001954\",2052,1150]\n[\"001948\",2054,1151]\n[\"001953\",2055,1151]\n[\"001954\",2053,1151]\n[\"001443\",2056,1152]\n[\"001444\",2057,1152]\n[\"002418\",2058,1152]\n[\"000057\",2059,1156]\n[\"001414\",2181,1157]\n[\"000048\",2182,1158]\n[\"001414\",2184,1159]\n[\"000048\",2185,1160]\n[\"000050\",2186,1161]\n[\"001384\",2187,1162]\n[\"001385\",2188,1162]\n[\"001386\",2189,1162]\n[\"001387\",2190,1162]\n[\"001388\",2191,1162]\n[\"000053\",2192,1163]\n[\"000054\",2193,1164]\n[\"000068\",2194,1165]\n[\"001453\",2195,1166]\n[\"001453\",2196,1167]\n[\"000068\",2197,1168]\n[\"000130\",2198,1169]\n[\"000131\",2199,1170]\n[\"001487\",2200,1171]\n[\"000132\",2201,1172]\n[\"000133\",2202,1173]\n[\"000134\",2203,1174]\n[\"000162\",2204,1175]\n[\"000163\",2205,1176]\n[\"000164\",2206,1177]\n[\"000382\",2207,1178]\n[\"000382\",2208,1179]\n[\"000382\",2209,1180]\n[\"000382\",2210,1181]\n[\"000764\",2211,1182]\n[\"000766\",2212,1183]\n[\"001939\",2213,1184]\n[\"001942\",2214,1185]\n[\"001942\",2215,1186]\n[\"000778\",2216,1187]\n[\"000185\",2217,1188]\n[\"000186\",2218,1189]\n[\"000187\",2219,1190]\n[\"000187\",2220,1191]\n[\"000803\",2221,1192]\n[\"000804\",2222,1193]\n[\"001097\",2223,1194]\n[\"001133\",2224,1195]\n[\"001184\",2225,1196]\n[\"001184\",2226,1197]\n[\"001185\",2227,1198]\n[\"001664\",2228,1199]\n[\"001188\",2229,1200]\n[\"001190\",2230,1201]\n[\"002314\",2231,1202]\n[\"002322\",2232,1203]\n[\"000068\",2233,1204]\n[\"002353\",2234,1205]\n[\"002250\",2235,1206]\n[\"001844\",2236,1207]\n[\"001851\",2237,1208]\n[\"001858\",2238,1209]\n[\"001861\",2239,1210]\n[\"002038\",2240,1211]\n[\"002038\",2241,1212]\n[\"001953\",2242,1213]\n[\"001954\",2243,1214]\n[\"001958\",2244,1215]\n[\"002450\",2245,1216]\n[\"002397\",2246,1217]\n[\"002418\",2247,1218]\n[\"002418\",2248,1219]\n[\"002423\",2249,1220]\n[\"000197\",2250,1221]\n[\"000172\",2251,1222]\n[\"002450\",2252,1223]\n[\"002450\",2253,1224]\n[\"002450\",2254,1225]\n[\"000366\",2255,1226]\n[\"000366\",2256,1227]\n[\"002363\",2257,1228]\n[\"002364\",2258,1229]\n[\"000196\",2259,1230]\n[\"000068\",2260,1231]\n[\"001453\",2261,1232]\n[\"001453\",2262,1233]\n[\"001967\",2263,1234]\n[\"002450\",2264,1235]\n[\"002450\",2265,1236]\n[\"000185\",2266,1237]\n[\"000803\",2267,1238]\n[\"000068\",2268,1239]\n[\"001414\",2311,1240]\n[\"000048\",2312,1241]\n[\"001414\",2314,1242]\n[\"001414\",2315,1243]\n[\"000048\",2316,1244]\n[\"000366\",2317,1245]\n[\"001812\",2318,1246]\n[\"000366\",2319,1247]\n[\"001812\",2320,1248]\n[\"000366\",2321,1249]\n[\"000366\",2322,1250]\n[\"000877\",2323,1251]\n[\"001199\",2324,1252]\n[\"002475\",2325,1252]\n[\"002476\",2326,1252]\n[\"002890\",2327,1253]\n[\"003123\",2328,1253]\n[\"000877\",2329,1254]\n[\"001233\",2330,1255]\n[\"001774\",2331,1256]\n[\"000877\",2332,1257]\n[\"000366\",2333,1258]\n[\"000366\",2334,1259]\n[\"000213\",2335,1260]\n[\"000366\",2336,1261]\n[\"001090\",2337,1262]\n[\"000795\",2338,1263]\n[\"002235\",2339,1264]\n[\"000366\",2340,1265]\n[\"000381\",2341,1266]\n[\"000366\",2342,1267]\n[\"002890\",2343,1268]\n[\"003123\",2344,1268]\n[\"000199\",2345,1269]\n[\"002165\",2346,1270]\n[\"002038\",2347,1271]\n[\"000381\",2348,1272]\n[\"000382\",2349,1273]\n[\"000381\",2350,1274]\n[\"000382\",2351,1275]\n[\"000382\",2352,1276]\n[\"000366\",2353,1277]\n[\"000366\",2354,1278]\n[\"000366\",2355,1279]\n[\"002238\",2356,1280]\n[\"000044\",2357,1281]\n[\"000044\",2358,1282]\n[\"002238\",2359,1282]\n[\"000200\",2360,1283]\n[\"000199\",2361,1284]\n[\"000198\",2362,1285]\n[\"000205\",2363,1286]\n[\"000192\",2364,1287]\n[\"000193\",2365,1287]\n[\"000194\",2366,1287]\n[\"001619\",2367,1287]\n[\"000196\",2368,1288]\n[\"000172\",2369,1289]\n[\"000172\",2370,1290]\n[\"000018\",2371,1291]\n[\"000172\",2372,1291]\n[\"001403\",2373,1291]\n[\"001404\",2374,1291]\n[\"001405\",2375,1291]\n[\"002130\",2376,1291]\n[\"002234\",2377,1291]\n[\"000018\",2378,1292]\n[\"000172\",2379,1292]\n[\"001403\",2380,1292]\n[\"001404\",2381,1292]\n[\"001405\",2382,1292]\n[\"002130\",2383,1292]\n[\"002234\",2384,1292]\n[\"000018\",2385,1293]\n[\"000172\",2386,1293]\n[\"001403\",2387,1293]\n[\"001404\",2388,1293]\n[\"001405\",2389,1293]\n[\"002130\",2390,1293]\n[\"002234\",2391,1293]\n[\"000172\",2392,1294]\n[\"000172\",2393,1295]\n[\"000172\",2394,1296]\n[\"000067\",2395,1297]\n[\"000172\",2396,1297]\n[\"000067\",2397,1298]\n[\"000172\",2398,1298]\n[\"000067\",2399,1299]\n[\"000172\",2400,1299]\n[\"000172\",2401,1300]\n[\"000172\",2402,1301]\n[\"000172\",2403,1302]\n[\"000172\",2404,1303]\n[\"000172\",2405,1304]\n[\"002234\",2406,1304]\n[\"000172\",2407,1305]\n[\"002234\",2408,1305]\n[\"000172\",2409,1306]\n[\"002234\",2410,1306]\n[\"000172\",2411,1307]\n[\"000172\",2412,1308]\n[\"000172\",2413,1309]\n[\"000172\",2414,1310]\n[\"002234\",2415,1310]\n[\"000172\",2416,1311]\n[\"002234\",2417,1311]\n[\"000172\",2418,1312]\n[\"002234\",2419,1312]\n[\"000172\",2420,1313]\n[\"002234\",2421,1313]\n[\"001849\",2422,1314]\n[\"001849\",2423,1315]\n[\"001849\",2424,1316]\n[\"000162\",2425,1317]\n[\"000163\",2426,1317]\n[\"000164\",2427,1317]\n[\"000162\",2428,1318]\n[\"000163\",2429,1318]\n[\"000164\",2430,1318]\n[\"000162\",2431,1319]\n[\"000163\",2432,1319]\n[\"000164\",2433,1319]\n[\"000381\",2434,1320]\n[\"000381\",2435,1321]\n[\"000366\",2436,1322]\n[\"000366\",2437,1323]\n[\"000366\",2438,1324]\n[\"002385\",2439,1325]\n[\"000366\",2440,1326]\n[\"000366\",2441,1327]\n[\"000185\",2442,1328]\n[\"002470\",2443,1328]\n[\"000366\",2444,1329]\n[\"000185\",2445,1330]\n[\"000366\",2446,1331]\n[\"000185\",2447,1332]\n[\"002470\",2448,1332]\n[\"000185\",2449,1333]\n[\"002470\",2450,1333]\n[\"000366\",2451,1334]\n[\"002235\",2452,1335]\n[\"000366\",2453,1336]\n[\"001084\",2454,1337]\n[\"000366\",2455,1338]\n[\"000764\",2456,1339]\n[\"000366\",2457,1340]\n[\"000366\",2458,1341]\n[\"000804\",2459,1342]\n[\"000381\",2460,1343]\n[\"000366\",2461,1344]\n[\"000366\",2462,1345]\n[\"000381\",2463,1346]\n[\"000381\",2464,1347]\n[\"000366\",2465,1348]\n[\"000366\",2466,1349]\n[\"000381\",2467,1350]\n[\"000381\",2468,1351]\n[\"000169\",2469,1352]\n[\"002418\",2470,1353]\n[\"002421\",2471,1353]\n[\"002418\",2472,1354]\n[\"002421\",2473,1354]\n[\"002038\",2474,1355]\n[\"002418\",2475,1356]\n[\"002421\",2476,1356]\n[\"002038\",2477,1357]\n[\"001090\",2478,1358]\n[\"000366\",2479,1359]\n[\"001967\",2480,1360]\n[\"000366\",2481,1361]\n[\"000366\",2482,1362]\n[\"000381\",2483,1363]\n[\"002418\",2484,1364]\n[\"002421\",2485,1364]\n[\"001764\",2486,1365]\n[\"000057\",2487,1366]\n[\"001764\",2488,1367]\n[\"001764\",2489,1368]\n[\"000048\",2490,1369]\n[\"000050\",2491,1369]\n[\"001384\",2492,1369]\n[\"001385\",2493,1369]\n[\"001386\",2494,1369]\n[\"001387\",2495,1369]\n[\"001388\",2496,1369]\n[\"000366\",2497,1370]\n[\"001084\",2498,1371]\n[\"000048\",2499,1372]\n[\"001384\",2500,1372]\n[\"001385\",2501,1372]\n[\"001386\",2502,1372]\n[\"001387\",2503,1372]\n[\"001388\",2504,1372]\n[\"000366\",2505,1373]\n[\"000381\",2506,1374]\n[\"000366\",2507,1375]\n[\"002824\",2508,1376]\n[\"002385\",2509,1377]\n[\"000366\",2510,1378]\n[\"000366\",2511,1379]\n[\"000366\",2512,1380]\n[\"000366\",2513,1381]\n[\"002418\",2514,1382]\n[\"002421\",2515,1382]\n[\"000366\",2516,1383]\n[\"000197\",2517,1384]\n[\"000366\",2518,1385]\n[\"000366\",2519,1386]\n[\"002418\",2520,1387]\n[\"002421\",2521,1387]\n[\"000366\",2522,1388]\n[\"002038\",2523,1389]\n[\"001090\",2524,1390]\n[\"002038\",2525,1391]\n[\"001453\",2526,1392]\n[\"000366\",2527,1393]\n[\"000068\",2528,1394]\n[\"002890\",2529,1394]\n[\"000366\",2530,1395]\n[\"000366\",2531,1396]\n[\"000381\",2532,1397]\n[\"001090\",2533,1398]\n[\"000381\",2534,1399]\n[\"000366\",2535,1400]\n[\"001090\",2536,1401]\n[\"000366\",2537,1402]\n[\"000366\",2538,1403]\n[\"000803\",2539,1404]\n[\"000196\",2540,1405]\n[\"000366\",2541,1406]\n[\"000366\",2542,1407]\n[\"000366\",2543,1408]\n[\"000366\",2544,1409]\n[\"002450\",2545,1410]\n[\"000366\",2546,1411]\n[\"002038\",2547,1412]\n[\"001084\",2548,1413]\n[\"002038\",2549,1414]\n[\"001084\",2550,1415]\n[\"001084\",2551,1416]\n[\"002038\",2552,1417]\n[\"001084\",2553,1418]\n[\"000381\",2554,1419]\n[\"000366\",2555,1420]\n[\"002235\",2556,1421]\n[\"000213\",2557,1422]\n[\"002235\",2558,1423]\n[\"000213\",2559,1424]\n[\"002235\",2560,1425]\n[\"002235\",2561,1426]\n[\"002235\",2562,1427]\n[\"002235\",2563,1428]\n[\"002235\",2564,1429]\n[\"002235\",2565,1430]\n[\"002235\",2566,1431]\n[\"002235\",2567,1432]\n[\"000213\",2568,1433]\n[\"000213\",2569,1434]\n[\"000213\",2570,1435]\n[\"000213\",2571,1436]\n[\"000213\",2572,1437]\n[\"002314\",2573,1437]\n[\"002235\",2574,1438]\n[\"002235\",2575,1439]\n[\"002235\",2576,1440]\n[\"002235\",2577,1441]\n[\"002235\",2578,1442]\n[\"000162\",2579,1443]\n[\"000163\",2580,1443]\n[\"000164\",2581,1443]\n[\"000171\",2582,1443]\n[\"001914\",2583,1443]\n[\"002235\",2584,1444]\n[\"002235\",2585,1445]\n[\"002235\",2586,1446]\n[\"002235\",2587,1447]\n[\"002235\",2588,1448]\n[\"000366\",2589,1449]\n[\"000135\",2590,1450]\n[\"000135\",2591,1451]\n[\"002824\",2592,1452]\n[\"002824\",2593,1453]\n[\"000381\",2594,1454]\n[\"000381\",2595,1455]\n[\"000172\",2596,1456]\n[\"000172\",2597,1457]\n[\"000381\",2598,1458]\n[\"000381\",2599,1459]\n[\"002235\",2600,1460]\n[\"000381\",2601,1461]\n[\"000381\",2602,1462]\n[\"000381\",2603,1463]\n[\"000381\",2604,1464]\n[\"000366\",2605,1465]\n[\"000172\",2606,1466]\n[\"000172\",2607,1467]\n[\"000803\",2608,1468]\n[\"000381\",2609,1469]\n[\"000366\",2610,1470]\n[\"000381\",2611,1471]\n[\"000172\",2612,1472]\n[\"000381\",2613,1473]\n[\"000381\",2614,1474]\n[\"000172\",2615,1475]\n[\"000366\",2616,1476]\n[\"000366\",2617,1477]\n[\"000366\",2618,1478]\n[\"000366\",2619,1479]\n[\"002824\",2620,1480]\n[\"000366\",2621,1481]\n[\"000366\",2622,1482]\n[\"000366\",2623,1483]\n[\"000366\",2624,1484]\n[\"000366\",2625,1485]\n[\"000366\",2626,1486]\n[\"000366\",2627,1487]\n[\"000366\",2628,1488]\n[\"000366\",2629,1489]\n[\"000366\",2630,1490]\n[\"000366\",2631,1491]\n[\"000366\",2632,1492]\n[\"000366\",2633,1493]\n[\"000366\",2634,1494]\n[\"000366\",2635,1495]\n[\"000366\",2636,1496]\n[\"000366\",2637,1497]\n[\"000366\",2638,1498]\n[\"000366\",2639,1499]\n[\"000366\",2640,1500]\n[\"000366\",2641,1501]\n[\"000366\",2642,1502]\n[\"000366\",2643,1503]\n[\"000366\",2644,1504]\n[\"000366\",2645,1505]\n[\"000366\",2646,1506]\n[\"000366\",2647,1507]\n[\"000366\",2648,1508]\n[\"000381\",2649,1509]\n[\"000366\",2650,1510]\n[\"000366\",2651,1511]\n[\"000366\",2652,1512]\n[\"000056\",2653,1513]\n[\"001199\",2654,1514]\n[\"002475\",2655,1514]\n[\"002476\",2656,1514]\n[\"001199\",2657,1515]\n[\"002475\",2658,1515]\n[\"002476\",2659,1515]\n[\"000130\",2660,1516]\n[\"000130\",2661,1517]\n[\"000130\",2662,1518]\n[\"000130\",2663,1519]\n[\"000130\",2664,1520]\n[\"000130\",2665,1521]\n[\"000130\",2666,1522]\n[\"000199\",2667,1523]\n[\"001090\",2668,1524]\n[\"000381\",2669,1525]\n[\"000381\",2670,1526]\n[\"000381\",2671,1527]\n[\"000381\",2672,1528]\n[\"001199\",2673,1529]\n[\"000366\",2674,1530]\n[\"000765\",2675,1531]\n[\"000766\",2676,1531]\n[\"000767\",2677,1531]\n[\"000768\",2678,1531]\n[\"001494\",2828,1532]\n[\"001496\",2829,1532]\n[\"002165\",2830,1532]\n[\"002235\",2831,1532]\n[\"000048\",2832,1533]\n[\"000048\",2833,1534]\n[\"000048\",2834,1535]\n[\"000056\",2835,1536]\n[\"001948\",2836,1537]\n[\"001953\",2837,1537]\n[\"001954\",2838,1537]\n[\"000057\",2839,1538]\n[\"000057\",2840,1539]\n[\"000057\",2841,1540]\n[\"000057\",2842,1541]\n[\"000057\",2843,1542]\n[\"000057\",2844,1543]\n[\"000057\",2845,1544]\n[\"000192\",2846,1545]\n[\"000192\",2847,1546]\n[\"000192\",2848,1547]\n[\"000193\",2849,1548]\n[\"000194\",2850,1549]\n[\"001619\",2851,1550]\n[\"000195\",2852,1551]\n[\"000195\",2853,1552]\n[\"000195\",2854,1553]\n[\"000195\",2855,1554]\n[\"000196\",2856,1555]\n[\"000196\",2857,1556]\n[\"000196\",2858,1557]\n[\"000198\",2859,1558]\n[\"000198\",2860,1559]\n[\"000199\",2861,1560]\n[\"000199\",2862,1561]\n[\"000200\",2863,1562]\n[\"000205\",2864,1563]\n[\"000366\",2865,1564]\n[\"000766\",2866,1565]\n[\"000795\",2867,1566]\n[\"000044\",2868,1567]\n[\"002236\",2869,1567]\n[\"002237\",2870,1567]\n[\"002238\",2871,1567]\n[\"002238\",2872,1568]\n[\"002038\",2873,1569]\n[\"002038\",2874,1570]\n[\"000366\",2875,1571]\n[\"000366\",2876,1572]\n[\"000366\",2877,1573]\n[\"000366\",2878,1574]\n[\"000366\",2879,1575]\n[\"000213\",2880,1576]\n[\"000213\",2881,1577]\n[\"000213\",2882,1578]\n[\"000213\",2883,1579]\n[\"000213\",2884,1580]\n[\"000766\",2885,1581]\n[\"000381\",2886,1582]\n[\"000381\",2887,1583]\n[\"002165\",2888,1584]\n[\"002235\",2889,1584]\n[\"001744\",2890,1585]\n[\"001744\",2891,1586]\n[\"001749\",2892,1587]\n[\"001749\",2893,1588]\n[\"000366\",2895,1589]\n[\"000778\",2894,1589]\n[\"001958\",2896,1589]\n[\"001958\",2897,1590]\n[\"000366\",2898,1591]\n[\"000778\",2899,1591]\n[\"001958\",2900,1591]\n[\"002617\",2901,1592]\n[\"002165\",2903,1593]\n[\"002696\",2902,1593]\n[\"002165\",2905,1594]\n[\"002696\",2904,1594]\n[\"000366\",2906,1595]\n[\"000366\",2907,1596]\n[\"000366\",2908,1597]\n[\"000366\",2909,1598]\n[\"000366\",2910,1599]\n[\"000366\",2911,1600]\n[\"000764\",2912,1601]\n[\"000366\",2913,1602]\n[\"002165\",2914,1603]\n[\"002165\",2915,1604]\n[\"000366\",2916,1605]\n[\"000366\",2917,1606]\n[\"000366\",2918,1607]\n[\"000366\",2919,1608]\n[\"000366\",2920,1609]\n[\"000366\",2921,1610]\n[\"000366\",2922,1611]\n[\"000366\",2923,1612]\n[\"000366\",2924,1613]\n[\"000366\",2925,1614]\n[\"000366\",2926,1615]\n[\"000366\",2927,1616]\n[\"000366\",2928,1617]\n[\"000366\",2929,1618]\n[\"000318\",2931,1619]\n[\"000368\",2930,1619]\n[\"001812\",2932,1619]\n[\"001813\",2933,1619]\n[\"001814\",2934,1619]\n[\"000366\",2935,1620]\n[\"000366\",2936,1621]\n[\"000366\",2937,1622]\n[\"000366\",2938,1623]\n[\"001764\",2939,1624]\n[\"001764\",2940,1625]\n[\"001764\",2941,1626]\n[\"000366\",2942,1627]\n[\"000318\",2944,1628]\n[\"000368\",2943,1628]\n[\"001812\",2947,1628]\n[\"001813\",2946,1628]\n[\"001814\",2945,1628]\n[\"000366\",2948,1629]\n[\"000366\",2949,1630]\n[\"000366\",2950,1631]\n[\"000366\",2951,1632]\n[\"000366\",2952,1633]\n[\"000366\",2953,1634]\n[\"000366\",2954,1635]\n[\"000366\",2955,1636]\n[\"000068\",2957,1637]\n[\"001199\",2956,1637]\n[\"002450\",2958,1637]\n[\"002476\",2959,1637]\n[\"000366\",2960,1638]\n[\"000366\",2961,1639]\n[\"000366\",2962,1640]\n[\"000318\",2964,1641]\n[\"000368\",2963,1641]\n[\"001812\",2967,1641]\n[\"001813\",2965,1641]\n[\"001814\",2966,1641]\n[\"000381\",2968,1642]\n[\"000126\",2970,1643]\n[\"000131\",2969,1643]\n[\"000139\",2971,1644]\n[\"001851\",2972,1645]\n[\"001851\",2973,1646]\n[\"001851\",2974,1647]\n[\"001851\",2975,1648]\n[\"001851\",2976,1649]\n[\"001851\",2977,1650]\n[\"001851\",2978,1651]\n[\"001851\",2979,1652]\n[\"001855\",2980,1653]\n[\"001855\",2981,1654]\n[\"001855\",2982,1655]\n[\"002234\",2983,1656]\n[\"000126\",2985,1657]\n[\"000172\",2984,1657]\n[\"000126\",2986,1658]\n[\"000172\",2987,1658]\n[\"000126\",2989,1659]\n[\"000172\",2988,1659]\n[\"000126\",2990,1660]\n[\"000172\",2991,1660]\n[\"000172\",2992,1661]\n[\"000172\",2993,1662]\n[\"000172\",2994,1663]\n[\"000172\",2995,1664]\n[\"000172\",2996,1665]\n[\"000172\",2997,1666]\n[\"000172\",2998,1667]\n[\"000172\",2999,1668]\n[\"000172\",3000,1669]\n[\"000172\",3001,1670]\n[\"002884\",3002,1670]\n[\"000172\",3003,1671]\n[\"002884\",3004,1671]\n[\"000172\",3005,1672]\n[\"002884\",3006,1672]\n[\"000172\",3007,1673]\n[\"002884\",3008,1673]\n[\"000172\",3009,1674]\n[\"002884\",3010,1674]\n[\"000172\",3011,1675]\n[\"002884\",3012,1675]\n[\"000172\",3013,1676]\n[\"002884\",3014,1676]\n[\"000172\",3015,1677]\n[\"002884\",3016,1677]\n[\"000172\",3017,1678]\n[\"002884\",3018,1678]\n[\"000172\",3019,1679]\n[\"002884\",3020,1679]\n[\"000126\",3021,1680]\n[\"000172\",3022,1680]\n[\"002884\",3023,1680]\n[\"000126\",3024,1681]\n[\"000172\",3025,1681]\n[\"002884\",3026,1681]\n[\"000135\",3028,1682]\n[\"000172\",3027,1682]\n[\"002884\",3029,1682]\n[\"000135\",3030,1683]\n[\"000172\",3031,1683]\n[\"002884\",3032,1683]\n[\"000135\",3033,1684]\n[\"000172\",3034,1684]\n[\"002884\",3035,1684]\n[\"000135\",3037,1685]\n[\"000172\",3036,1685]\n[\"002884\",3038,1685]\n[\"000135\",3039,1686]\n[\"000172\",3040,1686]\n[\"002884\",3041,1686]\n[\"000130\",3044,1687]\n[\"000135\",3043,1687]\n[\"000172\",3042,1687]\n[\"002884\",3045,1687]\n[\"000130\",3046,1688]\n[\"000135\",3047,1688]\n[\"000172\",3048,1688]\n[\"002884\",3049,1688]\n[\"000130\",3052,1689]\n[\"000135\",3051,1689]\n[\"000172\",3050,1689]\n[\"002884\",3053,1689]\n[\"000130\",3054,1690]\n[\"000135\",3055,1690]\n[\"000172\",3056,1690]\n[\"002884\",3057,1690]\n[\"000130\",3059,1691]\n[\"000135\",3060,1691]\n[\"000172\",3058,1691]\n[\"002884\",3061,1691]\n[\"000135\",3062,1692]\n[\"002884\",3063,1692]\n[\"000135\",3064,1693]\n[\"002884\",3065,1693]\n[\"000135\",3066,1694]\n[\"002884\",3067,1694]\n[\"000135\",3068,1695]\n[\"002884\",3069,1695]\n[\"000135\",3070,1696]\n[\"000172\",3071,1696]\n[\"002884\",3072,1696]\n[\"000135\",3074,1697]\n[\"000172\",3073,1697]\n[\"002884\",3075,1697]\n[\"000172\",3076,1698]\n[\"000172\",3077,1699]\n[\"000172\",3078,1700]\n[\"000172\",3079,1701]\n[\"000172\",3080,1702]\n[\"000172\",3081,1703]\n[\"000018\",3083,1704]\n[\"000172\",3082,1704]\n[\"001403\",3085,1704]\n[\"002130\",3084,1704]\n[\"000018\",3086,1705]\n[\"000172\",3087,1705]\n[\"001403\",3088,1705]\n[\"002130\",3089,1705]\n[\"000018\",3091,1706]\n[\"000172\",3090,1706]\n[\"001403\",3093,1706]\n[\"002130\",3092,1706]\n[\"000018\",3094,1707]\n[\"000172\",3095,1707]\n[\"001403\",3096,1707]\n[\"002130\",3097,1707]\n[\"000018\",3098,1708]\n[\"000172\",3099,1708]\n[\"001403\",3101,1708]\n[\"002130\",3100,1708]\n[\"000172\",3102,1709]\n[\"002884\",3103,1709]\n[\"000172\",3104,1710]\n[\"002884\",3105,1710]\n[\"000172\",3106,1711]\n[\"002884\",3107,1711]\n[\"000172\",3108,1712]\n[\"002884\",3109,1712]\n[\"000172\",3110,1713]\n[\"002884\",3111,1713]\n[\"000366\",3112,1714]\n[\"000318\",3113,1715]\n[\"000368\",3114,1715]\n[\"001812\",3116,1715]\n[\"001813\",3117,1715]\n[\"001814\",3115,1715]\n[\"000054\",3118,1716]\n[\"000382\",3119,1717]\n[\"002314\",3120,1717]\n[\"000068\",3123,1718]\n[\"000366\",3121,1718]\n[\"000803\",3122,1718]\n[\"001133\",3124,1719]\n[\"002361\",3125,1719]\n[\"000048\",3131,1720]\n[\"000050\",3132,1720]\n[\"001384\",3126,1720]\n[\"001385\",3127,1720]\n[\"001386\",3128,1720]\n[\"001387\",3129,1720]\n[\"001388\",3130,1720]\n[\"001453\",3133,1721]\n[\"001453\",3134,1722]\n[\"001453\",3135,1723]\n[\"000366\",3136,1724]\n[\"002418\",3137,1725]\n[\"002420\",3138,1725]\n[\"002421\",3139,1725]\n[\"002422\",3140,1725]\n[\"002418\",3143,1726]\n[\"002420\",3144,1726]\n[\"002421\",3141,1726]\n[\"002422\",3142,1726]\n[\"001133\",3145,1727]\n[\"002361\",3146,1727]\n[\"000366\",3147,1728]\n[\"001133\",3148,1729]\n[\"002361\",3149,1729]\n[\"000366\",3150,1730]\n[\"000366\",3151,1731]\n[\"000366\",3152,1732]\n[\"000366\",3153,1733]\n[\"000197\",3154,1734]\n[\"000366\",3155,1734]\n[\"001453\",3156,1735]\n[\"000366\",3157,1736]\n[\"000366\",3158,1737]\n[\"000318\",3159,1738]\n[\"000368\",3160,1738]\n[\"001812\",3161,1738]\n[\"001813\",3163,1738]\n[\"001814\",3162,1738]\n[\"000318\",3165,1739]\n[\"000368\",3164,1739]\n[\"001812\",3168,1739]\n[\"001813\",3167,1739]\n[\"001814\",3166,1739]\n[\"000366\",3169,1740]\n[\"000366\",3170,1741]\n[\"000366\",3171,1742]\n[\"001891\",3173,1743]\n[\"002046\",3172,1743]\n[\"000366\",3174,1744]\n[\"000366\",3175,1745]\n[\"000366\",3176,1746]\n[\"000366\",3177,1747]\n[\"000366\",3178,1748]\n[\"000366\",3179,1749]\n[\"000366\",3180,1750]\n[\"000366\",3181,1751]\n[\"000366\",3182,1752]\n[\"000366\",3183,1753]\n[\"000366\",3184,1754]\n[\"000366\",3185,1755]\n[\"000366\",3186,1756]\n[\"000366\",3187,1757]\n[\"000366\",3188,1758]\n[\"000366\",3189,1759]\n[\"000366\",3190,1760]\n[\"000318\",3191,1761]\n[\"000368\",3192,1761]\n[\"001812\",3194,1761]\n[\"001813\",3193,1761]\n[\"001814\",3195,1761]\n[\"000366\",3196,1762]\n[\"000366\",3197,1763]\n[\"000366\",3198,1764]\n[\"000366\",3199,1765]\n[\"000366\",3200,1766]\n[\"000366\",3201,1767]\n[\"000366\",3202,1768]\n[\"000366\",3203,1769]\n[\"000366\",3204,1770]\n[\"001948\",3206,1771]\n[\"001953\",3207,1771]\n[\"001954\",3205,1771]\n[\"001948\",3209,1772]\n[\"001953\",3208,1772]\n[\"001954\",3210,1772]\n[\"001948\",3212,1773]\n[\"001953\",3213,1773]\n[\"001954\",3211,1773]\n[\"001443\",3214,1774]\n[\"001444\",3215,1774]\n[\"002418\",3216,1774]\n[\"000057\",3217,1778]\n[\"001414\",3339,1779]\n[\"000048\",3340,1780]\n[\"001414\",3342,1781]\n[\"000048\",3343,1782]\n[\"000050\",3344,1783]\n[\"001384\",3345,1784]\n[\"001385\",3346,1784]\n[\"001386\",3347,1784]\n[\"001387\",3348,1784]\n[\"001388\",3349,1784]\n[\"000053\",3350,1785]\n[\"000054\",3351,1786]\n[\"000068\",3352,1787]\n[\"001453\",3353,1788]\n[\"001453\",3354,1789]\n[\"000068\",3355,1790]\n[\"000130\",3356,1791]\n[\"000131\",3357,1792]\n[\"001487\",3358,1793]\n[\"000132\",3359,1794]\n[\"000133\",3360,1795]\n[\"000134\",3361,1796]\n[\"000162\",3362,1797]\n[\"000163\",3363,1798]\n[\"000164\",3364,1799]\n[\"000382\",3365,1800]\n[\"000382\",3366,1801]\n[\"000382\",3367,1802]\n[\"000382\",3368,1803]\n[\"000764\",3369,1804]\n[\"000766\",3370,1805]\n[\"001939\",3371,1806]\n[\"001942\",3372,1807]\n[\"001942\",3373,1808]\n[\"000778\",3374,1809]\n[\"000185\",3375,1810]\n[\"000186\",3376,1811]\n[\"000187\",3377,1812]\n[\"000187\",3378,1813]\n[\"000803\",3379,1814]\n[\"000804\",3380,1815]\n[\"001097\",3381,1816]\n[\"001133\",3382,1817]\n[\"001184\",3383,1818]\n[\"001184\",3384,1819]\n[\"001185\",3385,1820]\n[\"001664\",3386,1821]\n[\"001188\",3387,1822]\n[\"001190\",3388,1823]\n[\"002314\",3389,1824]\n[\"002322\",3390,1825]\n[\"000068\",3391,1826]\n[\"002353\",3392,1827]\n[\"002250\",3393,1828]\n[\"001844\",3394,1829]\n[\"001851\",3395,1830]\n[\"001858\",3396,1831]\n[\"001861\",3397,1832]\n[\"002038\",3398,1833]\n[\"002038\",3399,1834]\n[\"001953\",3400,1835]\n[\"001954\",3401,1836]\n[\"001958\",3402,1837]\n[\"002450\",3403,1838]\n[\"002397\",3404,1839]\n[\"002418\",3405,1840]\n[\"002418\",3406,1841]\n[\"002423\",3407,1842]\n[\"000197\",3408,1843]\n[\"000172\",3409,1844]\n[\"002450\",3410,1845]\n[\"002450\",3411,1846]\n[\"002450\",3412,1847]\n[\"000366\",3413,1848]\n[\"000366\",3414,1849]\n[\"002363\",3415,1850]\n[\"002364\",3416,1851]\n[\"000196\",3417,1852]\n[\"000068\",3418,1853]\n[\"001453\",3419,1854]\n[\"001453\",3420,1855]\n[\"001967\",3421,1856]\n[\"002450\",3422,1857]\n[\"002450\",3423,1858]\n[\"000185\",3424,1859]\n[\"000803\",3425,1860]\n[\"000068\",3426,1861]\n[\"001414\",3469,1862]\n[\"000048\",3470,1863]\n[\"001414\",3472,1864]\n[\"001414\",3473,1865]\n[\"000048\",3474,1866]\n[\"000366\",3475,1867]\n[\"001812\",3476,1868]\n[\"000366\",3477,1869]\n[\"001812\",3478,1870]\n[\"000366\",3479,1871]\n[\"000366\",3480,1872]\n[\"000877\",3481,1873]\n[\"001199\",3482,1874]\n[\"002475\",3483,1874]\n[\"002476\",3484,1874]\n[\"002890\",3485,1875]\n[\"003123\",3486,1875]\n[\"000877\",3487,1876]\n[\"001233\",3488,1877]\n[\"001774\",3489,1878]\n[\"000877\",3490,1879]\n[\"000366\",3491,1880]\n[\"000366\",3492,1881]\n[\"000213\",3493,1882]\n[\"000366\",3494,1883]\n[\"001090\",3495,1884]\n[\"000795\",3496,1885]\n[\"002235\",3497,1886]\n[\"000366\",3498,1887]\n[\"000381\",3499,1888]\n[\"000366\",3500,1889]\n[\"002890\",3501,1890]\n[\"003123\",3502,1890]\n[\"000199\",3503,1891]\n[\"002165\",3504,1892]\n[\"002038\",3505,1893]\n[\"000381\",3506,1894]\n[\"000382\",3507,1895]\n[\"000381\",3508,1896]\n[\"000382\",3509,1897]\n[\"000382\",3510,1898]\n[\"000366\",3511,1899]\n[\"000366\",3512,1900]\n[\"000366\",3513,1901]\n[\"002238\",3514,1902]\n[\"000044\",3515,1903]\n[\"000044\",3516,1904]\n[\"002238\",3517,1904]\n[\"000200\",3518,1905]\n[\"000199\",3519,1906]\n[\"000198\",3520,1907]\n[\"000205\",3521,1908]\n[\"000192\",3522,1909]\n[\"000193\",3523,1909]\n[\"000194\",3524,1909]\n[\"001619\",3525,1909]\n[\"000196\",3526,1910]\n[\"000172\",3527,1911]\n[\"000172\",3528,1912]\n[\"000018\",3529,1913]\n[\"000172\",3530,1913]\n[\"001403\",3531,1913]\n[\"001404\",3532,1913]\n[\"001405\",3533,1913]\n[\"002130\",3534,1913]\n[\"002234\",3535,1913]\n[\"000018\",3536,1914]\n[\"000172\",3537,1914]\n[\"001403\",3538,1914]\n[\"001404\",3539,1914]\n[\"001405\",3540,1914]\n[\"002130\",3541,1914]\n[\"002234\",3542,1914]\n[\"000018\",3543,1915]\n[\"000172\",3544,1915]\n[\"001403\",3545,1915]\n[\"001404\",3546,1915]\n[\"001405\",3547,1915]\n[\"002130\",3548,1915]\n[\"002234\",3549,1915]\n[\"000172\",3550,1916]\n[\"000172\",3551,1917]\n[\"000172\",3552,1918]\n[\"000067\",3553,1919]\n[\"000172\",3554,1919]\n[\"000067\",3555,1920]\n[\"000172\",3556,1920]\n[\"000067\",3557,1921]\n[\"000172\",3558,1921]\n[\"000172\",3559,1922]\n[\"000172\",3560,1923]\n[\"000172\",3561,1924]\n[\"000172\",3562,1925]\n[\"000172\",3563,1926]\n[\"002234\",3564,1926]\n[\"000172\",3565,1927]\n[\"002234\",3566,1927]\n[\"000172\",3567,1928]\n[\"002234\",3568,1928]\n[\"000172\",3569,1929]\n[\"000172\",3570,1930]\n[\"000172\",3571,1931]\n[\"000172\",3572,1932]\n[\"002234\",3573,1932]\n[\"000172\",3574,1933]\n[\"002234\",3575,1933]\n[\"000172\",3576,1934]\n[\"002234\",3577,1934]\n[\"000172\",3578,1935]\n[\"002234\",3579,1935]\n[\"001849\",3580,1936]\n[\"001849\",3581,1937]\n[\"001849\",3582,1938]\n[\"000162\",3583,1939]\n[\"000163\",3584,1939]\n[\"000164\",3585,1939]\n[\"000162\",3586,1940]\n[\"000163\",3587,1940]\n[\"000164\",3588,1940]\n[\"000162\",3589,1941]\n[\"000163\",3590,1941]\n[\"000164\",3591,1941]\n[\"000381\",3592,1942]\n[\"000381\",3593,1943]\n[\"000366\",3594,1944]\n[\"000366\",3595,1945]\n[\"000366\",3596,1946]\n[\"002385\",3597,1947]\n[\"000366\",3598,1948]\n[\"000366\",3599,1949]\n[\"000185\",3600,1950]\n[\"002470\",3601,1950]\n[\"000366\",3602,1951]\n[\"000185\",3603,1952]\n[\"000366\",3604,1953]\n[\"000185\",3605,1954]\n[\"002470\",3606,1954]\n[\"000185\",3607,1955]\n[\"002470\",3608,1955]\n[\"000366\",3609,1956]\n[\"002235\",3610,1957]\n[\"000366\",3611,1958]\n[\"001084\",3612,1959]\n[\"000366\",3613,1960]\n[\"000764\",3614,1961]\n[\"000366\",3615,1962]\n[\"000366\",3616,1963]\n[\"000804\",3617,1964]\n[\"000381\",3618,1965]\n[\"000366\",3619,1966]\n[\"000366\",3620,1967]\n[\"000381\",3621,1968]\n[\"000381\",3622,1969]\n[\"000366\",3623,1970]\n[\"000366\",3624,1971]\n[\"000381\",3625,1972]\n[\"000381\",3626,1973]\n[\"000169\",3627,1974]\n[\"002418\",3628,1975]\n[\"002421\",3629,1975]\n[\"002418\",3630,1976]\n[\"002421\",3631,1976]\n[\"002038\",3632,1977]\n[\"002418\",3633,1978]\n[\"002421\",3634,1978]\n[\"002038\",3635,1979]\n[\"001090\",3636,1980]\n[\"000366\",3637,1981]\n[\"001967\",3638,1982]\n[\"000366\",3639,1983]\n[\"000366\",3640,1984]\n[\"000381\",3641,1985]\n[\"002418\",3642,1986]\n[\"002421\",3643,1986]\n[\"001764\",3644,1987]\n[\"000057\",3645,1988]\n[\"001764\",3646,1989]\n[\"001764\",3647,1990]\n[\"000048\",3648,1991]\n[\"000050\",3649,1991]\n[\"001384\",3650,1991]\n[\"001385\",3651,1991]\n[\"001386\",3652,1991]\n[\"001387\",3653,1991]\n[\"001388\",3654,1991]\n[\"000366\",3655,1992]\n[\"001084\",3656,1993]\n[\"000048\",3657,1994]\n[\"001384\",3658,1994]\n[\"001385\",3659,1994]\n[\"001386\",3660,1994]\n[\"001387\",3661,1994]\n[\"001388\",3662,1994]\n[\"000366\",3663,1995]\n[\"000381\",3664,1996]\n[\"000366\",3665,1997]\n[\"002824\",3666,1998]\n[\"002385\",3667,1999]\n[\"000366\",3668,2000]\n[\"000366\",3669,2001]\n[\"000366\",3670,2002]\n[\"000366\",3671,2003]\n[\"002418\",3672,2004]\n[\"002421\",3673,2004]\n[\"000366\",3674,2005]\n[\"000197\",3675,2006]\n[\"000366\",3676,2007]\n[\"000366\",3677,2008]\n[\"002418\",3678,2009]\n[\"002421\",3679,2009]\n[\"000366\",3680,2010]\n[\"002038\",3681,2011]\n[\"001090\",3682,2012]\n[\"002038\",3683,2013]\n[\"001453\",3684,2014]\n[\"000366\",3685,2015]\n[\"000068\",3686,2016]\n[\"002890\",3687,2016]\n[\"000366\",3688,2017]\n[\"000366\",3689,2018]\n[\"000381\",3690,2019]\n[\"001090\",3691,2020]\n[\"000381\",3692,2021]\n[\"000366\",3693,2022]\n[\"001090\",3694,2023]\n[\"000366\",3695,2024]\n[\"000366\",3696,2025]\n[\"000803\",3697,2026]\n[\"000196\",3698,2027]\n[\"000366\",3699,2028]\n[\"000366\",3700,2029]\n[\"000366\",3701,2030]\n[\"000366\",3702,2031]\n[\"002450\",3703,2032]\n[\"000366\",3704,2033]\n[\"002038\",3705,2034]\n[\"001084\",3706,2035]\n[\"002038\",3707,2036]\n[\"001084\",3708,2037]\n[\"001084\",3709,2038]\n[\"002038\",3710,2039]\n[\"001084\",3711,2040]\n[\"000381\",3712,2041]\n[\"000366\",3713,2042]\n[\"002235\",3714,2043]\n[\"000213\",3715,2044]\n[\"002235\",3716,2045]\n[\"000213\",3717,2046]\n[\"002235\",3718,2047]\n[\"002235\",3719,2048]\n[\"002235\",3720,2049]\n[\"002235\",3721,2050]\n[\"002235\",3722,2051]\n[\"002235\",3723,2052]\n[\"002235\",3724,2053]\n[\"002235\",3725,2054]\n[\"000213\",3726,2055]\n[\"000213\",3727,2056]\n[\"000213\",3728,2057]\n[\"000213\",3729,2058]\n[\"000213\",3730,2059]\n[\"002314\",3731,2059]\n[\"002235\",3732,2060]\n[\"002235\",3733,2061]\n[\"002235\",3734,2062]\n[\"002235\",3735,2063]\n[\"002235\",3736,2064]\n[\"000162\",3737,2065]\n[\"000163\",3738,2065]\n[\"000164\",3739,2065]\n[\"000171\",3740,2065]\n[\"001914\",3741,2065]\n[\"002235\",3742,2066]\n[\"002235\",3743,2067]\n[\"002235\",3744,2068]\n[\"002235\",3745,2069]\n[\"002235\",3746,2070]\n[\"000366\",3747,2071]\n[\"000135\",3748,2072]\n[\"000135\",3749,2073]\n[\"002824\",3750,2074]\n[\"002824\",3751,2075]\n[\"000381\",3752,2076]\n[\"000381\",3753,2077]\n[\"000172\",3754,2078]\n[\"000172\",3755,2079]\n[\"000381\",3756,2080]\n[\"000381\",3757,2081]\n[\"002235\",3758,2082]\n[\"000381\",3759,2083]\n[\"000381\",3760,2084]\n[\"000381\",3761,2085]\n[\"000381\",3762,2086]\n[\"000366\",3763,2087]\n[\"000172\",3764,2088]\n[\"000172\",3765,2089]\n[\"000803\",3766,2090]\n[\"000381\",3767,2091]\n[\"000366\",3768,2092]\n[\"000381\",3769,2093]\n[\"000172\",3770,2094]\n[\"000381\",3771,2095]\n[\"000381\",3772,2096]\n[\"000172\",3773,2097]\n[\"000366\",3774,2098]\n[\"000366\",3775,2099]\n[\"000366\",3776,2100]\n[\"000366\",3777,2101]\n[\"002824\",3778,2102]\n[\"000366\",3779,2103]\n[\"000366\",3780,2104]\n[\"000366\",3781,2105]\n[\"000366\",3782,2106]\n[\"000366\",3783,2107]\n[\"000366\",3784,2108]\n[\"000366\",3785,2109]\n[\"000366\",3786,2110]\n[\"000366\",3787,2111]\n[\"000366\",3788,2112]\n[\"000366\",3789,2113]\n[\"000366\",3790,2114]\n[\"000366\",3791,2115]\n[\"000366\",3792,2116]\n[\"000366\",3793,2117]\n[\"000366\",3794,2118]\n[\"000366\",3795,2119]\n[\"000366\",3796,2120]\n[\"000366\",3797,2121]\n[\"000366\",3798,2122]\n[\"000366\",3799,2123]\n[\"000366\",3800,2124]\n[\"000366\",3801,2125]\n[\"000366\",3802,2126]\n[\"000366\",3803,2127]\n[\"000366\",3804,2128]\n[\"000366\",3805,2129]\n[\"000366\",3806,2130]\n[\"000381\",3807,2131]\n[\"000366\",3808,2132]\n[\"000366\",3809,2133]\n[\"000366\",3810,2134]\n[\"000056\",3811,2135]\n[\"001199\",3812,2136]\n[\"002475\",3813,2136]\n[\"002476\",3814,2136]\n[\"001199\",3815,2137]\n[\"002475\",3816,2137]\n[\"002476\",3817,2137]\n[\"000130\",3818,2138]\n[\"000130\",3819,2139]\n[\"000130\",3820,2140]\n[\"000130\",3821,2141]\n[\"000130\",3822,2142]\n[\"000130\",3823,2143]\n[\"000130\",3824,2144]\n[\"000199\",3825,2145]\n[\"001090\",3826,2146]\n[\"000381\",3827,2147]\n[\"000381\",3828,2148]\n[\"000381\",3829,2149]\n[\"000381\",3830,2150]\n[\"001199\",3831,2151]\n[\"000366\",3832,2152]\n[\"000765\",3833,2153]\n[\"000766\",3834,2153]\n[\"000767\",3835,2153]\n[\"000768\",3836,2153]\n[\"001494\",3986,2154]\n[\"001496\",3987,2154]\n[\"002165\",3988,2154]\n[\"002235\",3989,2154]\n[\"000048\",3990,2155]\n[\"000048\",3991,2156]\n[\"000048\",3992,2157]\n[\"000056\",3993,2158]\n[\"001948\",3994,2159]\n[\"001953\",3995,2159]\n[\"001954\",3996,2159]\n[\"000057\",3997,2160]\n[\"000057\",3998,2161]\n[\"000057\",3999,2162]\n[\"000057\",4000,2163]\n[\"000057\",4001,2164]\n[\"000057\",4002,2165]\n[\"000057\",4003,2166]\n[\"000192\",4004,2167]\n[\"000192\",4005,2168]\n[\"000192\",4006,2169]\n[\"000193\",4007,2170]\n[\"000194\",4008,2171]\n[\"001619\",4009,2172]\n[\"000195\",4010,2173]\n[\"000195\",4011,2174]\n[\"000195\",4012,2175]\n[\"000195\",4013,2176]\n[\"000196\",4014,2177]\n[\"000196\",4015,2178]\n[\"000196\",4016,2179]\n[\"000198\",4017,2180]\n[\"000198\",4018,2181]\n[\"000199\",4019,2182]\n[\"000199\",4020,2183]\n[\"000200\",4021,2184]\n[\"000205\",4022,2185]\n[\"000366\",4023,2186]\n[\"000766\",4024,2187]\n[\"000795\",4025,2188]\n[\"000044\",4026,2189]\n[\"002236\",4027,2189]\n[\"002237\",4028,2189]\n[\"002238\",4029,2189]\n[\"002238\",4030,2190]\n[\"002038\",4031,2191]\n[\"002038\",4032,2192]\n[\"000366\",4033,2193]\n[\"000366\",4034,2194]\n[\"000366\",4035,2195]\n[\"000366\",4036,2196]\n[\"000366\",4037,2197]\n[\"000213\",4038,2198]\n[\"000213\",4039,2199]\n[\"000213\",4040,2200]\n[\"000213\",4041,2201]\n[\"000213\",4042,2202]\n[\"000766\",4043,2203]\n[\"000381\",4044,2204]\n[\"000381\",4045,2205]\n[\"002165\",4046,2206]\n[\"002235\",4047,2206]\n[\"001744\",4048,2207]\n[\"001744\",4049,2208]\n[\"001749\",4050,2209]\n[\"001749\",4051,2210]\n[\"000366\",4053,2211]\n[\"000778\",4052,2211]\n[\"001958\",4054,2211]\n[\"001958\",4055,2212]\n[\"000366\",4056,2213]\n[\"000778\",4057,2213]\n[\"001958\",4058,2213]\n[\"002617\",4059,2214]\n[\"002165\",4061,2215]\n[\"002696\",4060,2215]\n[\"002165\",4063,2216]\n[\"002696\",4062,2216]\n[\"000366\",4064,2217]\n[\"000366\",4065,2218]\n[\"000366\",4066,2219]\n[\"000366\",4067,2220]\n[\"000366\",4068,2221]\n[\"000366\",4069,2222]\n[\"000764\",4070,2223]\n[\"000366\",4071,2224]\n[\"002165\",4072,2225]\n[\"002165\",4073,2226]\n[\"000366\",4074,2227]\n[\"000366\",4075,2228]\n[\"000366\",4076,2229]\n[\"000366\",4077,2230]\n[\"000366\",4078,2231]\n[\"000366\",4079,2232]\n[\"000366\",4080,2233]\n[\"000366\",4081,2234]\n[\"000366\",4082,2235]\n[\"000366\",4083,2236]\n[\"000366\",4084,2237]\n[\"000366\",4085,2238]\n[\"000366\",4086,2239]\n[\"000366\",4087,2240]\n[\"000318\",4089,2241]\n[\"000368\",4088,2241]\n[\"001812\",4090,2241]\n[\"001813\",4091,2241]\n[\"001814\",4092,2241]\n[\"000366\",4093,2242]\n[\"000366\",4094,2243]\n[\"000366\",4095,2244]\n[\"000366\",4096,2245]\n[\"001764\",4097,2246]\n[\"001764\",4098,2247]\n[\"001764\",4099,2248]\n[\"000366\",4100,2249]\n[\"000318\",4102,2250]\n[\"000368\",4101,2250]\n[\"001812\",4105,2250]\n[\"001813\",4104,2250]\n[\"001814\",4103,2250]\n[\"000366\",4106,2251]\n[\"000366\",4107,2252]\n[\"000366\",4108,2253]\n[\"000366\",4109,2254]\n[\"000366\",4110,2255]\n[\"000366\",4111,2256]\n[\"000366\",4112,2257]\n[\"000366\",4113,2258]\n[\"000068\",4115,2259]\n[\"001199\",4114,2259]\n[\"002450\",4116,2259]\n[\"002476\",4117,2259]\n[\"000366\",4118,2260]\n[\"000366\",4119,2261]\n[\"000366\",4120,2262]\n[\"000318\",4122,2263]\n[\"000368\",4121,2263]\n[\"001812\",4125,2263]\n[\"001813\",4123,2263]\n[\"001814\",4124,2263]\n[\"000381\",4126,2264]\n[\"000126\",4128,2265]\n[\"000131\",4127,2265]\n[\"000139\",4129,2266]\n[\"001851\",4130,2267]\n[\"001851\",4131,2268]\n[\"001851\",4132,2269]\n[\"001851\",4133,2270]\n[\"001851\",4134,2271]\n[\"001851\",4135,2272]\n[\"001851\",4136,2273]\n[\"001851\",4137,2274]\n[\"001855\",4138,2275]\n[\"001855\",4139,2276]\n[\"001855\",4140,2277]\n[\"002234\",4141,2278]\n[\"000126\",4143,2279]\n[\"000172\",4142,2279]\n[\"000126\",4144,2280]\n[\"000172\",4145,2280]\n[\"000126\",4147,2281]\n[\"000172\",4146,2281]\n[\"000126\",4148,2282]\n[\"000172\",4149,2282]\n[\"000172\",4150,2283]\n[\"000172\",4151,2284]\n[\"000172\",4152,2285]\n[\"000172\",4153,2286]\n[\"000172\",4154,2287]\n[\"000172\",4155,2288]\n[\"000172\",4156,2289]\n[\"000172\",4157,2290]\n[\"000172\",4158,2291]\n[\"000172\",4159,2292]\n[\"002884\",4160,2292]\n[\"000172\",4161,2293]\n[\"002884\",4162,2293]\n[\"000172\",4163,2294]\n[\"002884\",4164,2294]\n[\"000172\",4165,2295]\n[\"002884\",4166,2295]\n[\"000172\",4167,2296]\n[\"002884\",4168,2296]\n[\"000172\",4169,2297]\n[\"002884\",4170,2297]\n[\"000172\",4171,2298]\n[\"002884\",4172,2298]\n[\"000172\",4173,2299]\n[\"002884\",4174,2299]\n[\"000172\",4175,2300]\n[\"002884\",4176,2300]\n[\"000172\",4177,2301]\n[\"002884\",4178,2301]\n[\"000126\",4179,2302]\n[\"000172\",4180,2302]\n[\"002884\",4181,2302]\n[\"000126\",4182,2303]\n[\"000172\",4183,2303]\n[\"002884\",4184,2303]\n[\"000135\",4186,2304]\n[\"000172\",4185,2304]\n[\"002884\",4187,2304]\n[\"000135\",4188,2305]\n[\"000172\",4189,2305]\n[\"002884\",4190,2305]\n[\"000135\",4191,2306]\n[\"000172\",4192,2306]\n[\"002884\",4193,2306]\n[\"000135\",4195,2307]\n[\"000172\",4194,2307]\n[\"002884\",4196,2307]\n[\"000135\",4197,2308]\n[\"000172\",4198,2308]\n[\"002884\",4199,2308]\n[\"000130\",4202,2309]\n[\"000135\",4201,2309]\n[\"000172\",4200,2309]\n[\"002884\",4203,2309]\n[\"000130\",4204,2310]\n[\"000135\",4205,2310]\n[\"000172\",4206,2310]\n[\"002884\",4207,2310]\n[\"000130\",4210,2311]\n[\"000135\",4209,2311]\n[\"000172\",4208,2311]\n[\"002884\",4211,2311]\n[\"000130\",4212,2312]\n[\"000135\",4213,2312]\n[\"000172\",4214,2312]\n[\"002884\",4215,2312]\n[\"000130\",4217,2313]\n[\"000135\",4218,2313]\n[\"000172\",4216,2313]\n[\"002884\",4219,2313]\n[\"000135\",4220,2314]\n[\"002884\",4221,2314]\n[\"000135\",4222,2315]\n[\"002884\",4223,2315]\n[\"000135\",4224,2316]\n[\"002884\",4225,2316]\n[\"000135\",4226,2317]\n[\"002884\",4227,2317]\n[\"000135\",4228,2318]\n[\"000172\",4229,2318]\n[\"002884\",4230,2318]\n[\"000135\",4232,2319]\n[\"000172\",4231,2319]\n[\"002884\",4233,2319]\n[\"000172\",4234,2320]\n[\"000172\",4235,2321]\n[\"000172\",4236,2322]\n[\"000172\",4237,2323]\n[\"000172\",4238,2324]\n[\"000172\",4239,2325]\n[\"000018\",4241,2326]\n[\"000172\",4240,2326]\n[\"001403\",4243,2326]\n[\"002130\",4242,2326]\n[\"000018\",4244,2327]\n[\"000172\",4245,2327]\n[\"001403\",4246,2327]\n[\"002130\",4247,2327]\n[\"000018\",4249,2328]\n[\"000172\",4248,2328]\n[\"001403\",4251,2328]\n[\"002130\",4250,2328]\n[\"000018\",4252,2329]\n[\"000172\",4253,2329]\n[\"001403\",4254,2329]\n[\"002130\",4255,2329]\n[\"000018\",4256,2330]\n[\"000172\",4257,2330]\n[\"001403\",4259,2330]\n[\"002130\",4258,2330]\n[\"000172\",4260,2331]\n[\"002884\",4261,2331]\n[\"000172\",4262,2332]\n[\"002884\",4263,2332]\n[\"000172\",4264,2333]\n[\"002884\",4265,2333]\n[\"000172\",4266,2334]\n[\"002884\",4267,2334]\n[\"000172\",4268,2335]\n[\"002884\",4269,2335]\n[\"000366\",4270,2336]\n[\"000318\",4271,2337]\n[\"000368\",4272,2337]\n[\"001812\",4274,2337]\n[\"001813\",4275,2337]\n[\"001814\",4273,2337]\n[\"000054\",4276,2338]\n[\"000382\",4277,2339]\n[\"002314\",4278,2339]\n[\"000068\",4281,2340]\n[\"000366\",4279,2340]\n[\"000803\",4280,2340]\n[\"001133\",4282,2341]\n[\"002361\",4283,2341]\n[\"000048\",4289,2342]\n[\"000050\",4290,2342]\n[\"001384\",4284,2342]\n[\"001385\",4285,2342]\n[\"001386\",4286,2342]\n[\"001387\",4287,2342]\n[\"001388\",4288,2342]\n[\"001453\",4291,2343]\n[\"001453\",4292,2344]\n[\"001453\",4293,2345]\n[\"000366\",4294,2346]\n[\"002418\",4295,2347]\n[\"002420\",4296,2347]\n[\"002421\",4297,2347]\n[\"002422\",4298,2347]\n[\"002418\",4301,2348]\n[\"002420\",4302,2348]\n[\"002421\",4299,2348]\n[\"002422\",4300,2348]\n[\"001133\",4303,2349]\n[\"002361\",4304,2349]\n[\"000366\",4305,2350]\n[\"001133\",4306,2351]\n[\"002361\",4307,2351]\n[\"000366\",4308,2352]\n[\"000366\",4309,2353]\n[\"000366\",4310,2354]\n[\"000366\",4311,2355]\n[\"000197\",4312,2356]\n[\"000366\",4313,2356]\n[\"001453\",4314,2357]\n[\"000366\",4315,2358]\n[\"000366\",4316,2359]\n[\"000318\",4317,2360]\n[\"000368\",4318,2360]\n[\"001812\",4319,2360]\n[\"001813\",4321,2360]\n[\"001814\",4320,2360]\n[\"000318\",4323,2361]\n[\"000368\",4322,2361]\n[\"001812\",4326,2361]\n[\"001813\",4325,2361]\n[\"001814\",4324,2361]\n[\"000366\",4327,2362]\n[\"000366\",4328,2363]\n[\"000366\",4329,2364]\n[\"001891\",4331,2365]\n[\"002046\",4330,2365]\n[\"000366\",4332,2366]\n[\"000366\",4333,2367]\n[\"000366\",4334,2368]\n[\"000366\",4335,2369]\n[\"000366\",4336,2370]\n[\"000366\",4337,2371]\n[\"000366\",4338,2372]\n[\"000366\",4339,2373]\n[\"000366\",4340,2374]\n[\"000366\",4341,2375]\n[\"000366\",4342,2376]\n[\"000366\",4343,2377]\n[\"000366\",4344,2378]\n[\"000366\",4345,2379]\n[\"000366\",4346,2380]\n[\"000366\",4347,2381]\n[\"000366\",4348,2382]\n[\"000318\",4349,2383]\n[\"000368\",4350,2383]\n[\"001812\",4352,2383]\n[\"001813\",4351,2383]\n[\"001814\",4353,2383]\n[\"000366\",4354,2384]\n[\"000366\",4355,2385]\n[\"000366\",4356,2386]\n[\"000366\",4357,2387]\n[\"000366\",4358,2388]\n[\"000366\",4359,2389]\n[\"000366\",4360,2390]\n[\"000366\",4361,2391]\n[\"000366\",4362,2392]\n[\"001948\",4364,2393]\n[\"001953\",4365,2393]\n[\"001954\",4363,2393]\n[\"001948\",4367,2394]\n[\"001953\",4366,2394]\n[\"001954\",4368,2394]\n[\"001948\",4370,2395]\n[\"001953\",4371,2395]\n[\"001954\",4369,2395]\n[\"001443\",4372,2396]\n[\"001444\",4373,2396]\n[\"002418\",4374,2396]\n[\"000057\",4375,2400]\n[\"001414\",4497,2401]\n[\"000048\",4498,2402]\n[\"001414\",4500,2403]\n[\"000048\",4501,2404]\n[\"000050\",4502,2405]\n[\"001384\",4503,2406]\n[\"001385\",4504,2406]\n[\"001386\",4505,2406]\n[\"001387\",4506,2406]\n[\"001388\",4507,2406]\n[\"000053\",4508,2407]\n[\"000054\",4509,2408]\n[\"000068\",4510,2409]\n[\"001453\",4511,2410]\n[\"001453\",4512,2411]\n[\"000068\",4513,2412]\n[\"000130\",4514,2413]\n[\"000131\",4515,2414]\n[\"001487\",4516,2415]\n[\"000132\",4517,2416]\n[\"000133\",4518,2417]\n[\"000134\",4519,2418]\n[\"000162\",4520,2419]\n[\"000163\",4521,2420]\n[\"000164\",4522,2421]\n[\"000382\",4523,2422]\n[\"000382\",4524,2423]\n[\"000382\",4525,2424]\n[\"000382\",4526,2425]\n[\"000764\",4527,2426]\n[\"000766\",4528,2427]\n[\"001939\",4529,2428]\n[\"001942\",4530,2429]\n[\"001942\",4531,2430]\n[\"000778\",4532,2431]\n[\"000185\",4533,2432]\n[\"000186\",4534,2433]\n[\"000187\",4535,2434]\n[\"000187\",4536,2435]\n[\"000803\",4537,2436]\n[\"000804\",4538,2437]\n[\"001097\",4539,2438]\n[\"001133\",4540,2439]\n[\"001184\",4541,2440]\n[\"001184\",4542,2441]\n[\"001185\",4543,2442]\n[\"001664\",4544,2443]\n[\"001188\",4545,2444]\n[\"001190\",4546,2445]\n[\"002314\",4547,2446]\n[\"002322\",4548,2447]\n[\"000068\",4549,2448]\n[\"002353\",4550,2449]\n[\"002250\",4551,2450]\n[\"001844\",4552,2451]\n[\"001851\",4553,2452]\n[\"001858\",4554,2453]\n[\"001861\",4555,2454]\n[\"002038\",4556,2455]\n[\"002038\",4557,2456]\n[\"001953\",4558,2457]\n[\"001954\",4559,2458]\n[\"001958\",4560,2459]\n[\"002450\",4561,2460]\n[\"002397\",4562,2461]\n[\"002418\",4563,2462]\n[\"002418\",4564,2463]\n[\"002423\",4565,2464]\n[\"000197\",4566,2465]\n[\"000172\",4567,2466]\n[\"002450\",4568,2467]\n[\"002450\",4569,2468]\n[\"002450\",4570,2469]\n[\"000366\",4571,2470]\n[\"000366\",4572,2471]\n[\"002363\",4573,2472]\n[\"002364\",4574,2473]\n[\"000196\",4575,2474]\n[\"000068\",4576,2475]\n[\"001453\",4577,2476]\n[\"001453\",4578,2477]\n[\"001967\",4579,2478]\n[\"002450\",4580,2479]\n[\"002450\",4581,2480]\n[\"000185\",4582,2481]\n[\"000803\",4583,2482]\n[\"000068\",4584,2483]\n[\"001414\",4627,2484]\n[\"000048\",4628,2485]\n[\"001414\",4630,2486]\n[\"001414\",4631,2487]\n[\"000048\",4632,2488]\n[\"000366\",4633,2489]\n[\"001812\",4634,2490]\n[\"000366\",4635,2491]\n[\"001812\",4636,2492]\n[\"000366\",4637,2493]\n[\"000366\",4638,2494]\n[\"000877\",4639,2495]\n[\"001199\",4640,2496]\n[\"002475\",4641,2496]\n[\"002476\",4642,2496]\n[\"002890\",4643,2497]\n[\"003123\",4644,2497]\n[\"000877\",4645,2498]\n[\"001233\",4646,2499]\n[\"001774\",4647,2500]\n[\"000877\",4648,2501]\n[\"000366\",4649,2502]\n[\"000366\",4650,2503]\n[\"000213\",4651,2504]\n[\"000366\",4652,2505]\n[\"001090\",4653,2506]\n[\"000795\",4654,2507]\n[\"002235\",4655,2508]\n[\"000366\",4656,2509]\n[\"000381\",4657,2510]\n[\"000366\",4658,2511]\n[\"002890\",4659,2512]\n[\"003123\",4660,2512]\n[\"000199\",4661,2513]\n[\"002165\",4662,2514]\n[\"002038\",4663,2515]\n[\"000381\",4664,2516]\n[\"000382\",4665,2517]\n[\"000381\",4666,2518]\n[\"000382\",4667,2519]\n[\"000382\",4668,2520]\n[\"000366\",4669,2521]\n[\"000366\",4670,2522]\n[\"000366\",4671,2523]\n[\"002238\",4672,2524]\n[\"000044\",4673,2525]\n[\"000044\",4674,2526]\n[\"002238\",4675,2526]\n[\"000200\",4676,2527]\n[\"000199\",4677,2528]\n[\"000198\",4678,2529]\n[\"000205\",4679,2530]\n[\"000192\",4680,2531]\n[\"000193\",4681,2531]\n[\"000194\",4682,2531]\n[\"001619\",4683,2531]\n[\"000196\",4684,2532]\n[\"000172\",4685,2533]\n[\"000172\",4686,2534]\n[\"000018\",4687,2535]\n[\"000172\",4688,2535]\n[\"001403\",4689,2535]\n[\"001404\",4690,2535]\n[\"001405\",4691,2535]\n[\"002130\",4692,2535]\n[\"002234\",4693,2535]\n[\"000018\",4694,2536]\n[\"000172\",4695,2536]\n[\"001403\",4696,2536]\n[\"001404\",4697,2536]\n[\"001405\",4698,2536]\n[\"002130\",4699,2536]\n[\"002234\",4700,2536]\n[\"000018\",4701,2537]\n[\"000172\",4702,2537]\n[\"001403\",4703,2537]\n[\"001404\",4704,2537]\n[\"001405\",4705,2537]\n[\"002130\",4706,2537]\n[\"002234\",4707,2537]\n[\"000172\",4708,2538]\n[\"000172\",4709,2539]\n[\"000172\",4710,2540]\n[\"000067\",4711,2541]\n[\"000172\",4712,2541]\n[\"000067\",4713,2542]\n[\"000172\",4714,2542]\n[\"000067\",4715,2543]\n[\"000172\",4716,2543]\n[\"000172\",4717,2544]\n[\"000172\",4718,2545]\n[\"000172\",4719,2546]\n[\"000172\",4720,2547]\n[\"000172\",4721,2548]\n[\"002234\",4722,2548]\n[\"000172\",4723,2549]\n[\"002234\",4724,2549]\n[\"000172\",4725,2550]\n[\"002234\",4726,2550]\n[\"000172\",4727,2551]\n[\"000172\",4728,2552]\n[\"000172\",4729,2553]\n[\"000172\",4730,2554]\n[\"002234\",4731,2554]\n[\"000172\",4732,2555]\n[\"002234\",4733,2555]\n[\"000172\",4734,2556]\n[\"002234\",4735,2556]\n[\"000172\",4736,2557]\n[\"002234\",4737,2557]\n[\"001849\",4738,2558]\n[\"001849\",4739,2559]\n[\"001849\",4740,2560]\n[\"000162\",4741,2561]\n[\"000163\",4742,2561]\n[\"000164\",4743,2561]\n[\"000162\",4744,2562]\n[\"000163\",4745,2562]\n[\"000164\",4746,2562]\n[\"000162\",4747,2563]\n[\"000163\",4748,2563]\n[\"000164\",4749,2563]\n[\"000381\",4750,2564]\n[\"000381\",4751,2565]\n[\"000366\",4752,2566]\n[\"000366\",4753,2567]\n[\"000366\",4754,2568]\n[\"002385\",4755,2569]\n[\"000366\",4756,2570]\n[\"000366\",4757,2571]\n[\"000185\",4758,2572]\n[\"002470\",4759,2572]\n[\"000366\",4760,2573]\n[\"000185\",4761,2574]\n[\"000366\",4762,2575]\n[\"000185\",4763,2576]\n[\"002470\",4764,2576]\n[\"000185\",4765,2577]\n[\"002470\",4766,2577]\n[\"000366\",4767,2578]\n[\"002235\",4768,2579]\n[\"000366\",4769,2580]\n[\"001084\",4770,2581]\n[\"000366\",4771,2582]\n[\"000764\",4772,2583]\n[\"000366\",4773,2584]\n[\"000366\",4774,2585]\n[\"000804\",4775,2586]\n[\"000381\",4776,2587]\n[\"000366\",4777,2588]\n[\"000366\",4778,2589]\n[\"000381\",4779,2590]\n[\"000381\",4780,2591]\n[\"000366\",4781,2592]\n[\"000366\",4782,2593]\n[\"000381\",4783,2594]\n[\"000381\",4784,2595]\n[\"000169\",4785,2596]\n[\"002418\",4786,2597]\n[\"002421\",4787,2597]\n[\"002418\",4788,2598]\n[\"002421\",4789,2598]\n[\"002038\",4790,2599]\n[\"002418\",4791,2600]\n[\"002421\",4792,2600]\n[\"002038\",4793,2601]\n[\"001090\",4794,2602]\n[\"000366\",4795,2603]\n[\"001967\",4796,2604]\n[\"000366\",4797,2605]\n[\"000366\",4798,2606]\n[\"000381\",4799,2607]\n[\"002418\",4800,2608]\n[\"002421\",4801,2608]\n[\"001764\",4802,2609]\n[\"000057\",4803,2610]\n[\"001764\",4804,2611]\n[\"001764\",4805,2612]\n[\"000048\",4806,2613]\n[\"000050\",4807,2613]\n[\"001384\",4808,2613]\n[\"001385\",4809,2613]\n[\"001386\",4810,2613]\n[\"001387\",4811,2613]\n[\"001388\",4812,2613]\n[\"000366\",4813,2614]\n[\"001084\",4814,2615]\n[\"000048\",4815,2616]\n[\"001384\",4816,2616]\n[\"001385\",4817,2616]\n[\"001386\",4818,2616]\n[\"001387\",4819,2616]\n[\"001388\",4820,2616]\n[\"000366\",4821,2617]\n[\"000381\",4822,2618]\n[\"000366\",4823,2619]\n[\"002824\",4824,2620]\n[\"002385\",4825,2621]\n[\"000366\",4826,2622]\n[\"000366\",4827,2623]\n[\"000366\",4828,2624]\n[\"000366\",4829,2625]\n[\"002418\",4830,2626]\n[\"002421\",4831,2626]\n[\"000366\",4832,2627]\n[\"000197\",4833,2628]\n[\"000366\",4834,2629]\n[\"000366\",4835,2630]\n[\"002418\",4836,2631]\n[\"002421\",4837,2631]\n[\"000366\",4838,2632]\n[\"002038\",4839,2633]\n[\"001090\",4840,2634]\n[\"002038\",4841,2635]\n[\"001453\",4842,2636]\n[\"000366\",4843,2637]\n[\"000068\",4844,2638]\n[\"002890\",4845,2638]\n[\"000366\",4846,2639]\n[\"000366\",4847,2640]\n[\"000381\",4848,2641]\n[\"001090\",4849,2642]\n[\"000381\",4850,2643]\n[\"000366\",4851,2644]\n[\"001090\",4852,2645]\n[\"000366\",4853,2646]\n[\"000366\",4854,2647]\n[\"000803\",4855,2648]\n[\"000196\",4856,2649]\n[\"000366\",4857,2650]\n[\"000366\",4858,2651]\n[\"000366\",4859,2652]\n[\"000366\",4860,2653]\n[\"002450\",4861,2654]\n[\"000366\",4862,2655]\n[\"002038\",4863,2656]\n[\"001084\",4864,2657]\n[\"002038\",4865,2658]\n[\"001084\",4866,2659]\n[\"001084\",4867,2660]\n[\"002038\",4868,2661]\n[\"001084\",4869,2662]\n[\"000381\",4870,2663]\n[\"000366\",4871,2664]\n[\"002235\",4872,2665]\n[\"000213\",4873,2666]\n[\"002235\",4874,2667]\n[\"000213\",4875,2668]\n[\"002235\",4876,2669]\n[\"002235\",4877,2670]\n[\"002235\",4878,2671]\n[\"002235\",4879,2672]\n[\"002235\",4880,2673]\n[\"002235\",4881,2674]\n[\"002235\",4882,2675]\n[\"002235\",4883,2676]\n[\"000213\",4884,2677]\n[\"000213\",4885,2678]\n[\"000213\",4886,2679]\n[\"000213\",4887,2680]\n[\"000213\",4888,2681]\n[\"002314\",4889,2681]\n[\"002235\",4890,2682]\n[\"002235\",4891,2683]\n[\"002235\",4892,2684]\n[\"002235\",4893,2685]\n[\"002235\",4894,2686]\n[\"000162\",4895,2687]\n[\"000163\",4896,2687]\n[\"000164\",4897,2687]\n[\"000171\",4898,2687]\n[\"001914\",4899,2687]\n[\"002235\",4900,2688]\n[\"002235\",4901,2689]\n[\"002235\",4902,2690]\n[\"002235\",4903,2691]\n[\"002235\",4904,2692]\n[\"000366\",4905,2693]\n[\"000135\",4906,2694]\n[\"000135\",4907,2695]\n[\"002824\",4908,2696]\n[\"002824\",4909,2697]\n[\"000381\",4910,2698]\n[\"000381\",4911,2699]\n[\"000172\",4912,2700]\n[\"000172\",4913,2701]\n[\"000381\",4914,2702]\n[\"000381\",4915,2703]\n[\"002235\",4916,2704]\n[\"000381\",4917,2705]\n[\"000381\",4918,2706]\n[\"000381\",4919,2707]\n[\"000381\",4920,2708]\n[\"000366\",4921,2709]\n[\"000172\",4922,2710]\n[\"000172\",4923,2711]\n[\"000803\",4924,2712]\n[\"000381\",4925,2713]\n[\"000366\",4926,2714]\n[\"000381\",4927,2715]\n[\"000172\",4928,2716]\n[\"000381\",4929,2717]\n[\"000381\",4930,2718]\n[\"000172\",4931,2719]\n[\"000366\",4932,2720]\n[\"000366\",4933,2721]\n[\"000366\",4934,2722]\n[\"000366\",4935,2723]\n[\"002824\",4936,2724]\n[\"000366\",4937,2725]\n[\"000366\",4938,2726]\n[\"000366\",4939,2727]\n[\"000366\",4940,2728]\n[\"000366\",4941,2729]\n[\"000366\",4942,2730]\n[\"000366\",4943,2731]\n[\"000366\",4944,2732]\n[\"000366\",4945,2733]\n[\"000366\",4946,2734]\n[\"000366\",4947,2735]\n[\"000366\",4948,2736]\n[\"000366\",4949,2737]\n[\"000366\",4950,2738]\n[\"000366\",4951,2739]\n[\"000366\",4952,2740]\n[\"000366\",4953,2741]\n[\"000366\",4954,2742]\n[\"000366\",4955,2743]\n[\"000366\",4956,2744]\n[\"000366\",4957,2745]\n[\"000366\",4958,2746]\n[\"000366\",4959,2747]\n[\"000366\",4960,2748]\n[\"000366\",4961,2749]\n[\"000366\",4962,2750]\n[\"000366\",4963,2751]\n[\"000366\",4964,2752]\n[\"000381\",4965,2753]\n[\"000366\",4966,2754]\n[\"000366\",4967,2755]\n[\"000366\",4968,2756]\n[\"000056\",4969,2757]\n[\"001199\",4970,2758]\n[\"002475\",4971,2758]\n[\"002476\",4972,2758]\n[\"001199\",4973,2759]\n[\"002475\",4974,2759]\n[\"002476\",4975,2759]\n[\"000130\",4976,2760]\n[\"000130\",4977,2761]\n[\"000130\",4978,2762]\n[\"000130\",4979,2763]\n[\"000130\",4980,2764]\n[\"000130\",4981,2765]\n[\"000130\",4982,2766]\n[\"000199\",4983,2767]\n[\"001090\",4984,2768]\n[\"000381\",4985,2769]\n[\"000381\",4986,2770]\n[\"000381\",4987,2771]\n[\"000381\",4988,2772]\n[\"001199\",4989,2773]\n[\"000366\",4990,2774]\n[\"000765\",4991,2775]\n[\"000766\",4992,2775]\n[\"000767\",4993,2775]\n[\"000768\",4994,2775]\n[\"001494\",5144,2776]\n[\"001496\",5145,2776]\n[\"002165\",5146,2776]\n[\"002235\",5147,2776]\n[\"000048\",5148,2777]\n[\"000048\",5149,2778]\n[\"000048\",5150,2779]\n[\"000056\",5151,2780]\n[\"001948\",5152,2781]\n[\"001953\",5153,2781]\n[\"001954\",5154,2781]\n[\"000057\",5155,2782]\n[\"000057\",5156,2783]\n[\"000057\",5157,2784]\n[\"000057\",5158,2785]\n[\"000057\",5159,2786]\n[\"000057\",5160,2787]\n[\"000057\",5161,2788]\n[\"000192\",5162,2789]\n[\"000192\",5163,2790]\n[\"000192\",5164,2791]\n[\"000193\",5165,2792]\n[\"000194\",5166,2793]\n[\"001619\",5167,2794]\n[\"000195\",5168,2795]\n[\"000195\",5169,2796]\n[\"000195\",5170,2797]\n[\"000195\",5171,2798]\n[\"000196\",5172,2799]\n[\"000196\",5173,2800]\n[\"000196\",5174,2801]\n[\"000198\",5175,2802]\n[\"000198\",5176,2803]\n[\"000199\",5177,2804]\n[\"000199\",5178,2805]\n[\"000200\",5179,2806]\n[\"000205\",5180,2807]\n[\"000366\",5181,2808]\n[\"000766\",5182,2809]\n[\"000795\",5183,2810]\n[\"000044\",5184,2811]\n[\"002236\",5185,2811]\n[\"002237\",5186,2811]\n[\"002238\",5187,2811]\n[\"002238\",5188,2812]\n[\"002038\",5189,2813]\n[\"002038\",5190,2814]\n[\"000366\",5191,2815]\n[\"000366\",5192,2816]\n[\"000366\",5193,2817]\n[\"000366\",5194,2818]\n[\"000366\",5195,2819]\n[\"000213\",5196,2820]\n[\"000213\",5197,2821]\n[\"000213\",5198,2822]\n[\"000213\",5199,2823]\n[\"000213\",5200,2824]\n[\"000766\",5201,2825]\n[\"000381\",5202,2826]\n[\"000381\",5203,2827]\n[\"002165\",5204,2828]\n[\"002235\",5205,2828]\n[\"001744\",5206,2829]\n[\"001744\",5207,2830]\n[\"001749\",5208,2831]\n[\"001749\",5209,2832]\n[\"000366\",5211,2833]\n[\"000778\",5210,2833]\n[\"001958\",5212,2833]\n[\"001958\",5213,2834]\n[\"000366\",5214,2835]\n[\"000778\",5215,2835]\n[\"001958\",5216,2835]\n[\"002617\",5217,2836]\n[\"002165\",5219,2837]\n[\"002696\",5218,2837]\n[\"002165\",5221,2838]\n[\"002696\",5220,2838]\n[\"000366\",5222,2839]\n[\"000366\",5223,2840]\n[\"000366\",5224,2841]\n[\"000366\",5225,2842]\n[\"000366\",5226,2843]\n[\"000366\",5227,2844]\n[\"000764\",5228,2845]\n[\"000366\",5229,2846]\n[\"002165\",5230,2847]\n[\"002165\",5231,2848]\n[\"000366\",5232,2849]\n[\"000366\",5233,2850]\n[\"000366\",5234,2851]\n[\"000366\",5235,2852]\n[\"000366\",5236,2853]\n[\"000366\",5237,2854]\n[\"000366\",5238,2855]\n[\"000366\",5239,2856]\n[\"000366\",5240,2857]\n[\"000366\",5241,2858]\n[\"000366\",5242,2859]\n[\"000366\",5243,2860]\n[\"000366\",5244,2861]\n[\"000366\",5245,2862]\n[\"000318\",5247,2863]\n[\"000368\",5246,2863]\n[\"001812\",5248,2863]\n[\"001813\",5249,2863]\n[\"001814\",5250,2863]\n[\"000366\",5251,2864]\n[\"000366\",5252,2865]\n[\"000366\",5253,2866]\n[\"000366\",5254,2867]\n[\"001764\",5255,2868]\n[\"001764\",5256,2869]\n[\"001764\",5257,2870]\n[\"000366\",5258,2871]\n[\"000318\",5260,2872]\n[\"000368\",5259,2872]\n[\"001812\",5263,2872]\n[\"001813\",5262,2872]\n[\"001814\",5261,2872]\n[\"000366\",5264,2873]\n[\"000366\",5265,2874]\n[\"000366\",5266,2875]\n[\"000366\",5267,2876]\n[\"000366\",5268,2877]\n[\"000366\",5269,2878]\n[\"000366\",5270,2879]\n[\"000366\",5271,2880]\n[\"000068\",5273,2881]\n[\"001199\",5272,2881]\n[\"002450\",5274,2881]\n[\"002476\",5275,2881]\n[\"000366\",5276,2882]\n[\"000366\",5277,2883]\n[\"000366\",5278,2884]\n[\"000318\",5280,2885]\n[\"000368\",5279,2885]\n[\"001812\",5283,2885]\n[\"001813\",5281,2885]\n[\"001814\",5282,2885]\n[\"000381\",5284,2886]\n[\"000126\",5286,2887]\n[\"000131\",5285,2887]\n[\"000139\",5287,2888]\n[\"001851\",5288,2889]\n[\"001851\",5289,2890]\n[\"001851\",5290,2891]\n[\"001851\",5291,2892]\n[\"001851\",5292,2893]\n[\"001851\",5293,2894]\n[\"001851\",5294,2895]\n[\"001851\",5295,2896]\n[\"001855\",5296,2897]\n[\"001855\",5297,2898]\n[\"001855\",5298,2899]\n[\"002234\",5299,2900]\n[\"000126\",5301,2901]\n[\"000172\",5300,2901]\n[\"000126\",5302,2902]\n[\"000172\",5303,2902]\n[\"000126\",5305,2903]\n[\"000172\",5304,2903]\n[\"000126\",5306,2904]\n[\"000172\",5307,2904]\n[\"000172\",5308,2905]\n[\"000172\",5309,2906]\n[\"000172\",5310,2907]\n[\"000172\",5311,2908]\n[\"000172\",5312,2909]\n[\"000172\",5313,2910]\n[\"000172\",5314,2911]\n[\"000172\",5315,2912]\n[\"000172\",5316,2913]\n[\"000172\",5317,2914]\n[\"002884\",5318,2914]\n[\"000172\",5319,2915]\n[\"002884\",5320,2915]\n[\"000172\",5321,2916]\n[\"002884\",5322,2916]\n[\"000172\",5323,2917]\n[\"002884\",5324,2917]\n[\"000172\",5325,2918]\n[\"002884\",5326,2918]\n[\"000172\",5327,2919]\n[\"002884\",5328,2919]\n[\"000172\",5329,2920]\n[\"002884\",5330,2920]\n[\"000172\",5331,2921]\n[\"002884\",5332,2921]\n[\"000172\",5333,2922]\n[\"002884\",5334,2922]\n[\"000172\",5335,2923]\n[\"002884\",5336,2923]\n[\"000126\",5337,2924]\n[\"000172\",5338,2924]\n[\"002884\",5339,2924]\n[\"000126\",5340,2925]\n[\"000172\",5341,2925]\n[\"002884\",5342,2925]\n[\"000135\",5344,2926]\n[\"000172\",5343,2926]\n[\"002884\",5345,2926]\n[\"000135\",5346,2927]\n[\"000172\",5347,2927]\n[\"002884\",5348,2927]\n[\"000135\",5349,2928]\n[\"000172\",5350,2928]\n[\"002884\",5351,2928]\n[\"000135\",5353,2929]\n[\"000172\",5352,2929]\n[\"002884\",5354,2929]\n[\"000135\",5355,2930]\n[\"000172\",5356,2930]\n[\"002884\",5357,2930]\n[\"000130\",5360,2931]\n[\"000135\",5359,2931]\n[\"000172\",5358,2931]\n[\"002884\",5361,2931]\n[\"000130\",5362,2932]\n[\"000135\",5363,2932]\n[\"000172\",5364,2932]\n[\"002884\",5365,2932]\n[\"000130\",5368,2933]\n[\"000135\",5367,2933]\n[\"000172\",5366,2933]\n[\"002884\",5369,2933]\n[\"000130\",5370,2934]\n[\"000135\",5371,2934]\n[\"000172\",5372,2934]\n[\"002884\",5373,2934]\n[\"000130\",5375,2935]\n[\"000135\",5376,2935]\n[\"000172\",5374,2935]\n[\"002884\",5377,2935]\n[\"000135\",5378,2936]\n[\"002884\",5379,2936]\n[\"000135\",5380,2937]\n[\"002884\",5381,2937]\n[\"000135\",5382,2938]\n[\"002884\",5383,2938]\n[\"000135\",5384,2939]\n[\"002884\",5385,2939]\n[\"000135\",5386,2940]\n[\"000172\",5387,2940]\n[\"002884\",5388,2940]\n[\"000135\",5390,2941]\n[\"000172\",5389,2941]\n[\"002884\",5391,2941]\n[\"000172\",5392,2942]\n[\"000172\",5393,2943]\n[\"000172\",5394,2944]\n[\"000172\",5395,2945]\n[\"000172\",5396,2946]\n[\"000172\",5397,2947]\n[\"000018\",5399,2948]\n[\"000172\",5398,2948]\n[\"001403\",5401,2948]\n[\"002130\",5400,2948]\n[\"000018\",5402,2949]\n[\"000172\",5403,2949]\n[\"001403\",5404,2949]\n[\"002130\",5405,2949]\n[\"000018\",5407,2950]\n[\"000172\",5406,2950]\n[\"001403\",5409,2950]\n[\"002130\",5408,2950]\n[\"000018\",5410,2951]\n[\"000172\",5411,2951]\n[\"001403\",5412,2951]\n[\"002130\",5413,2951]\n[\"000018\",5414,2952]\n[\"000172\",5415,2952]\n[\"001403\",5417,2952]\n[\"002130\",5416,2952]\n[\"000172\",5418,2953]\n[\"002884\",5419,2953]\n[\"000172\",5420,2954]\n[\"002884\",5421,2954]\n[\"000172\",5422,2955]\n[\"002884\",5423,2955]\n[\"000172\",5424,2956]\n[\"002884\",5425,2956]\n[\"000172\",5426,2957]\n[\"002884\",5427,2957]\n[\"000366\",5428,2958]\n[\"000318\",5429,2959]\n[\"000368\",5430,2959]\n[\"001812\",5432,2959]\n[\"001813\",5433,2959]\n[\"001814\",5431,2959]\n[\"000054\",5434,2960]\n[\"000382\",5435,2961]\n[\"002314\",5436,2961]\n[\"000068\",5439,2962]\n[\"000366\",5437,2962]\n[\"000803\",5438,2962]\n[\"001133\",5440,2963]\n[\"002361\",5441,2963]\n[\"000048\",5447,2964]\n[\"000050\",5448,2964]\n[\"001384\",5442,2964]\n[\"001385\",5443,2964]\n[\"001386\",5444,2964]\n[\"001387\",5445,2964]\n[\"001388\",5446,2964]\n[\"001453\",5449,2965]\n[\"001453\",5450,2966]\n[\"001453\",5451,2967]\n[\"000366\",5452,2968]\n[\"002418\",5453,2969]\n[\"002420\",5454,2969]\n[\"002421\",5455,2969]\n[\"002422\",5456,2969]\n[\"002418\",5459,2970]\n[\"002420\",5460,2970]\n[\"002421\",5457,2970]\n[\"002422\",5458,2970]\n[\"001133\",5461,2971]\n[\"002361\",5462,2971]\n[\"000366\",5463,2972]\n[\"001133\",5464,2973]\n[\"002361\",5465,2973]\n[\"000366\",5466,2974]\n[\"000366\",5467,2975]\n[\"000366\",5468,2976]\n[\"000366\",5469,2977]\n[\"000197\",5470,2978]\n[\"000366\",5471,2978]\n[\"001453\",5472,2979]\n[\"000366\",5473,2980]\n[\"000366\",5474,2981]\n[\"000318\",5475,2982]\n[\"000368\",5476,2982]\n[\"001812\",5477,2982]\n[\"001813\",5479,2982]\n[\"001814\",5478,2982]\n[\"000318\",5481,2983]\n[\"000368\",5480,2983]\n[\"001812\",5484,2983]\n[\"001813\",5483,2983]\n[\"001814\",5482,2983]\n[\"000366\",5485,2984]\n[\"000366\",5486,2985]\n[\"000366\",5487,2986]\n[\"001891\",5489,2987]\n[\"002046\",5488,2987]\n[\"000366\",5490,2988]\n[\"000366\",5491,2989]\n[\"000366\",5492,2990]\n[\"000366\",5493,2991]\n[\"000366\",5494,2992]\n[\"000366\",5495,2993]\n[\"000366\",5496,2994]\n[\"000366\",5497,2995]\n[\"000366\",5498,2996]\n[\"000366\",5499,2997]\n[\"000366\",5500,2998]\n[\"000366\",5501,2999]\n[\"000366\",5502,3000]\n[\"000366\",5503,3001]\n[\"000366\",5504,3002]\n[\"000366\",5505,3003]\n[\"000366\",5506,3004]\n[\"000318\",5507,3005]\n[\"000368\",5508,3005]\n[\"001812\",5510,3005]\n[\"001813\",5509,3005]\n[\"001814\",5511,3005]\n[\"000366\",5512,3006]\n[\"000366\",5513,3007]\n[\"000366\",5514,3008]\n[\"000366\",5515,3009]\n[\"000366\",5516,3010]\n[\"000366\",5517,3011]\n[\"000366\",5518,3012]\n[\"000366\",5519,3013]\n[\"000366\",5520,3014]\n[\"001948\",5522,3015]\n[\"001953\",5523,3015]\n[\"001954\",5521,3015]\n[\"001948\",5525,3016]\n[\"001953\",5524,3016]\n[\"001954\",5526,3016]\n[\"001948\",5528,3017]\n[\"001953\",5529,3017]\n[\"001954\",5527,3017]\n[\"001443\",5530,3018]\n[\"001444\",5531,3018]\n[\"002418\",5532,3018]\n[\"000057\",5533,3022]\n[\"001414\",5655,3023]\n[\"000048\",5656,3024]\n[\"001414\",5658,3025]\n[\"000048\",5659,3026]\n[\"000050\",5660,3027]\n[\"001384\",5661,3028]\n[\"001385\",5662,3028]\n[\"001386\",5663,3028]\n[\"001387\",5664,3028]\n[\"001388\",5665,3028]\n[\"000053\",5666,3029]\n[\"000054\",5667,3030]\n[\"000068\",5668,3031]\n[\"001453\",5669,3032]\n[\"001453\",5670,3033]\n[\"000068\",5671,3034]\n[\"000130\",5672,3035]\n[\"000131\",5673,3036]\n[\"001487\",5674,3037]\n[\"000132\",5675,3038]\n[\"000133\",5676,3039]\n[\"000134\",5677,3040]\n[\"000162\",5678,3041]\n[\"000163\",5679,3042]\n[\"000164\",5680,3043]\n[\"000382\",5681,3044]\n[\"000382\",5682,3045]\n[\"000382\",5683,3046]\n[\"000382\",5684,3047]\n[\"000764\",5685,3048]\n[\"000766\",5686,3049]\n[\"001939\",5687,3050]\n[\"001942\",5688,3051]\n[\"001942\",5689,3052]\n[\"000778\",5690,3053]\n[\"000185\",5691,3054]\n[\"000186\",5692,3055]\n[\"000187\",5693,3056]\n[\"000187\",5694,3057]\n[\"000803\",5695,3058]\n[\"000804\",5696,3059]\n[\"001097\",5697,3060]\n[\"001133\",5698,3061]\n[\"001184\",5699,3062]\n[\"001184\",5700,3063]\n[\"001185\",5701,3064]\n[\"001664\",5702,3065]\n[\"001188\",5703,3066]\n[\"001190\",5704,3067]\n[\"002314\",5705,3068]\n[\"002322\",5706,3069]\n[\"000068\",5707,3070]\n[\"002353\",5708,3071]\n[\"002250\",5709,3072]\n[\"001844\",5710,3073]\n[\"001851\",5711,3074]\n[\"001858\",5712,3075]\n[\"001861\",5713,3076]\n[\"002038\",5714,3077]\n[\"002038\",5715,3078]\n[\"001953\",5716,3079]\n[\"001954\",5717,3080]\n[\"001958\",5718,3081]\n[\"002450\",5719,3082]\n[\"002397\",5720,3083]\n[\"002418\",5721,3084]\n[\"002418\",5722,3085]\n[\"002423\",5723,3086]\n[\"000197\",5724,3087]\n[\"000172\",5725,3088]\n[\"002450\",5726,3089]\n[\"002450\",5727,3090]\n[\"002450\",5728,3091]\n[\"000366\",5729,3092]\n[\"000366\",5730,3093]\n[\"002363\",5731,3094]\n[\"002364\",5732,3095]\n[\"000196\",5733,3096]\n[\"000068\",5734,3097]\n[\"001453\",5735,3098]\n[\"001453\",5736,3099]\n[\"001967\",5737,3100]\n[\"002450\",5738,3101]\n[\"002450\",5739,3102]\n[\"000185\",5740,3103]\n[\"000803\",5741,3104]\n[\"000068\",5742,3105]\n[\"001414\",5785,3106]\n[\"000048\",5786,3107]\n[\"001414\",5788,3108]\n[\"001414\",5789,3109]\n[\"000048\",5790,3110]\n[\"000366\",5791,3111]\n[\"001812\",5792,3112]\n[\"000366\",5793,3113]\n[\"001812\",5794,3114]\n[\"000366\",5795,3115]\n[\"000366\",5796,3116]\n[\"000877\",5797,3117]\n[\"001199\",5798,3118]\n[\"002475\",5799,3118]\n[\"002476\",5800,3118]\n[\"002890\",5801,3119]\n[\"003123\",5802,3119]\n[\"000877\",5803,3120]\n[\"001233\",5804,3121]\n[\"001774\",5805,3122]\n[\"000877\",5806,3123]\n[\"000366\",5807,3124]\n[\"000366\",5808,3125]\n[\"000213\",5809,3126]\n[\"000366\",5810,3127]\n[\"001090\",5811,3128]\n[\"000795\",5812,3129]\n[\"002235\",5813,3130]\n[\"000366\",5814,3131]\n[\"000381\",5815,3132]\n[\"000366\",5816,3133]\n[\"002890\",5817,3134]\n[\"003123\",5818,3134]\n[\"000199\",5819,3135]\n[\"002165\",5820,3136]\n[\"002038\",5821,3137]\n[\"000381\",5822,3138]\n[\"000382\",5823,3139]\n[\"000381\",5824,3140]\n[\"000382\",5825,3141]\n[\"000382\",5826,3142]\n[\"000366\",5827,3143]\n[\"000366\",5828,3144]\n[\"000366\",5829,3145]\n[\"002238\",5830,3146]\n[\"000044\",5831,3147]\n[\"000044\",5832,3148]\n[\"002238\",5833,3148]\n[\"000200\",5834,3149]\n[\"000199\",5835,3150]\n[\"000198\",5836,3151]\n[\"000205\",5837,3152]\n[\"000192\",5838,3153]\n[\"000193\",5839,3153]\n[\"000194\",5840,3153]\n[\"001619\",5841,3153]\n[\"000196\",5842,3154]\n[\"000172\",5843,3155]\n[\"000172\",5844,3156]\n[\"000018\",5845,3157]\n[\"000172\",5846,3157]\n[\"001403\",5847,3157]\n[\"001404\",5848,3157]\n[\"001405\",5849,3157]\n[\"002130\",5850,3157]\n[\"002234\",5851,3157]\n[\"000018\",5852,3158]\n[\"000172\",5853,3158]\n[\"001403\",5854,3158]\n[\"001404\",5855,3158]\n[\"001405\",5856,3158]\n[\"002130\",5857,3158]\n[\"002234\",5858,3158]\n[\"000018\",5859,3159]\n[\"000172\",5860,3159]\n[\"001403\",5861,3159]\n[\"001404\",5862,3159]\n[\"001405\",5863,3159]\n[\"002130\",5864,3159]\n[\"002234\",5865,3159]\n[\"000172\",5866,3160]\n[\"000172\",5867,3161]\n[\"000172\",5868,3162]\n[\"000067\",5869,3163]\n[\"000172\",5870,3163]\n[\"000067\",5871,3164]\n[\"000172\",5872,3164]\n[\"000067\",5873,3165]\n[\"000172\",5874,3165]\n[\"000172\",5875,3166]\n[\"000172\",5876,3167]\n[\"000172\",5877,3168]\n[\"000172\",5878,3169]\n[\"000172\",5879,3170]\n[\"002234\",5880,3170]\n[\"000172\",5881,3171]\n[\"002234\",5882,3171]\n[\"000172\",5883,3172]\n[\"002234\",5884,3172]\n[\"000172\",5885,3173]\n[\"000172\",5886,3174]\n[\"000172\",5887,3175]\n[\"000172\",5888,3176]\n[\"002234\",5889,3176]\n[\"000172\",5890,3177]\n[\"002234\",5891,3177]\n[\"000172\",5892,3178]\n[\"002234\",5893,3178]\n[\"000172\",5894,3179]\n[\"002234\",5895,3179]\n[\"001849\",5896,3180]\n[\"001849\",5897,3181]\n[\"001849\",5898,3182]\n[\"000162\",5899,3183]\n[\"000163\",5900,3183]\n[\"000164\",5901,3183]\n[\"000162\",5902,3184]\n[\"000163\",5903,3184]\n[\"000164\",5904,3184]\n[\"000162\",5905,3185]\n[\"000163\",5906,3185]\n[\"000164\",5907,3185]\n[\"000381\",5908,3186]\n[\"000381\",5909,3187]\n[\"000366\",5910,3188]\n[\"000366\",5911,3189]\n[\"000366\",5912,3190]\n[\"002385\",5913,3191]\n[\"000366\",5914,3192]\n[\"000366\",5915,3193]\n[\"000185\",5916,3194]\n[\"002470\",5917,3194]\n[\"000366\",5918,3195]\n[\"000185\",5919,3196]\n[\"000366\",5920,3197]\n[\"000185\",5921,3198]\n[\"002470\",5922,3198]\n[\"000185\",5923,3199]\n[\"002470\",5924,3199]\n[\"000366\",5925,3200]\n[\"002235\",5926,3201]\n[\"000366\",5927,3202]\n[\"001084\",5928,3203]\n[\"000366\",5929,3204]\n[\"000764\",5930,3205]\n[\"000366\",5931,3206]\n[\"000366\",5932,3207]\n[\"000804\",5933,3208]\n[\"000381\",5934,3209]\n[\"000366\",5935,3210]\n[\"000366\",5936,3211]\n[\"000381\",5937,3212]\n[\"000381\",5938,3213]\n[\"000366\",5939,3214]\n[\"000366\",5940,3215]\n[\"000381\",5941,3216]\n[\"000381\",5942,3217]\n[\"000169\",5943,3218]\n[\"002418\",5944,3219]\n[\"002421\",5945,3219]\n[\"002418\",5946,3220]\n[\"002421\",5947,3220]\n[\"002038\",5948,3221]\n[\"002418\",5949,3222]\n[\"002421\",5950,3222]\n[\"002038\",5951,3223]\n[\"001090\",5952,3224]\n[\"000366\",5953,3225]\n[\"001967\",5954,3226]\n[\"000366\",5955,3227]\n[\"000366\",5956,3228]\n[\"000381\",5957,3229]\n[\"002418\",5958,3230]\n[\"002421\",5959,3230]\n[\"001764\",5960,3231]\n[\"000057\",5961,3232]\n[\"001764\",5962,3233]\n[\"001764\",5963,3234]\n[\"000048\",5964,3235]\n[\"000050\",5965,3235]\n[\"001384\",5966,3235]\n[\"001385\",5967,3235]\n[\"001386\",5968,3235]\n[\"001387\",5969,3235]\n[\"001388\",5970,3235]\n[\"000366\",5971,3236]\n[\"001084\",5972,3237]\n[\"000048\",5973,3238]\n[\"001384\",5974,3238]\n[\"001385\",5975,3238]\n[\"001386\",5976,3238]\n[\"001387\",5977,3238]\n[\"001388\",5978,3238]\n[\"000366\",5979,3239]\n[\"000381\",5980,3240]\n[\"000366\",5981,3241]\n[\"002824\",5982,3242]\n[\"002385\",5983,3243]\n[\"000366\",5984,3244]\n[\"000366\",5985,3245]\n[\"000366\",5986,3246]\n[\"000366\",5987,3247]\n[\"002418\",5988,3248]\n[\"002421\",5989,3248]\n[\"000366\",5990,3249]\n[\"000197\",5991,3250]\n[\"000366\",5992,3251]\n[\"000366\",5993,3252]\n[\"002418\",5994,3253]\n[\"002421\",5995,3253]\n[\"000366\",5996,3254]\n[\"002038\",5997,3255]\n[\"001090\",5998,3256]\n[\"002038\",5999,3257]\n[\"001453\",6000,3258]\n[\"000366\",6001,3259]\n[\"000068\",6002,3260]\n[\"002890\",6003,3260]\n[\"000366\",6004,3261]\n[\"000366\",6005,3262]\n[\"000381\",6006,3263]\n[\"001090\",6007,3264]\n[\"000381\",6008,3265]\n[\"000366\",6009,3266]\n[\"001090\",6010,3267]\n[\"000366\",6011,3268]\n[\"000366\",6012,3269]\n[\"000803\",6013,3270]\n[\"000196\",6014,3271]\n[\"000366\",6015,3272]\n[\"000366\",6016,3273]\n[\"000366\",6017,3274]\n[\"000366\",6018,3275]\n[\"002450\",6019,3276]\n[\"000366\",6020,3277]\n[\"002038\",6021,3278]\n[\"001084\",6022,3279]\n[\"002038\",6023,3280]\n[\"001084\",6024,3281]\n[\"001084\",6025,3282]\n[\"002038\",6026,3283]\n[\"001084\",6027,3284]\n[\"000381\",6028,3285]\n[\"000366\",6029,3286]\n[\"002235\",6030,3287]\n[\"000213\",6031,3288]\n[\"002235\",6032,3289]\n[\"000213\",6033,3290]\n[\"002235\",6034,3291]\n[\"002235\",6035,3292]\n[\"002235\",6036,3293]\n[\"002235\",6037,3294]\n[\"002235\",6038,3295]\n[\"002235\",6039,3296]\n[\"002235\",6040,3297]\n[\"002235\",6041,3298]\n[\"000213\",6042,3299]\n[\"000213\",6043,3300]\n[\"000213\",6044,3301]\n[\"000213\",6045,3302]\n[\"000213\",6046,3303]\n[\"002314\",6047,3303]\n[\"002235\",6048,3304]\n[\"002235\",6049,3305]\n[\"002235\",6050,3306]\n[\"002235\",6051,3307]\n[\"002235\",6052,3308]\n[\"000162\",6053,3309]\n[\"000163\",6054,3309]\n[\"000164\",6055,3309]\n[\"000171\",6056,3309]\n[\"001914\",6057,3309]\n[\"002235\",6058,3310]\n[\"002235\",6059,3311]\n[\"002235\",6060,3312]\n[\"002235\",6061,3313]\n[\"002235\",6062,3314]\n[\"000366\",6063,3315]\n[\"000135\",6064,3316]\n[\"000135\",6065,3317]\n[\"002824\",6066,3318]\n[\"002824\",6067,3319]\n[\"000381\",6068,3320]\n[\"000381\",6069,3321]\n[\"000172\",6070,3322]\n[\"000172\",6071,3323]\n[\"000381\",6072,3324]\n[\"000381\",6073,3325]\n[\"002235\",6074,3326]\n[\"000381\",6075,3327]\n[\"000381\",6076,3328]\n[\"000381\",6077,3329]\n[\"000381\",6078,3330]\n[\"000366\",6079,3331]\n[\"000172\",6080,3332]\n[\"000172\",6081,3333]\n[\"000803\",6082,3334]\n[\"000381\",6083,3335]\n[\"000366\",6084,3336]\n[\"000381\",6085,3337]\n[\"000172\",6086,3338]\n[\"000381\",6087,3339]\n[\"000381\",6088,3340]\n[\"000172\",6089,3341]\n[\"000366\",6090,3342]\n[\"000366\",6091,3343]\n[\"000366\",6092,3344]\n[\"000366\",6093,3345]\n[\"002824\",6094,3346]\n[\"000366\",6095,3347]\n[\"000366\",6096,3348]\n[\"000366\",6097,3349]\n[\"000366\",6098,3350]\n[\"000366\",6099,3351]\n[\"000366\",6100,3352]\n[\"000366\",6101,3353]\n[\"000366\",6102,3354]\n[\"000366\",6103,3355]\n[\"000366\",6104,3356]\n[\"000366\",6105,3357]\n[\"000366\",6106,3358]\n[\"000366\",6107,3359]\n[\"000366\",6108,3360]\n[\"000366\",6109,3361]\n[\"000366\",6110,3362]\n[\"000366\",6111,3363]\n[\"000366\",6112,3364]\n[\"000366\",6113,3365]\n[\"000366\",6114,3366]\n[\"000366\",6115,3367]\n[\"000366\",6116,3368]\n[\"000366\",6117,3369]\n[\"000366\",6118,3370]\n[\"000366\",6119,3371]\n[\"000366\",6120,3372]\n[\"000366\",6121,3373]\n[\"000366\",6122,3374]\n[\"000381\",6123,3375]\n[\"000366\",6124,3376]\n[\"000366\",6125,3377]\n[\"000366\",6126,3378]\n[\"000056\",6127,3379]\n[\"001199\",6128,3380]\n[\"002475\",6129,3380]\n[\"002476\",6130,3380]\n[\"001199\",6131,3381]\n[\"002475\",6132,3381]\n[\"002476\",6133,3381]\n[\"000130\",6134,3382]\n[\"000130\",6135,3383]\n[\"000130\",6136,3384]\n[\"000130\",6137,3385]\n[\"000130\",6138,3386]\n[\"000130\",6139,3387]\n[\"000130\",6140,3388]\n[\"000199\",6141,3389]\n[\"001090\",6142,3390]\n[\"000381\",6143,3391]\n[\"000381\",6144,3392]\n[\"000381\",6145,3393]\n[\"000381\",6146,3394]\n[\"001199\",6147,3395]\n[\"000366\",6148,3396]\n[\"000765\",6149,3397]\n[\"000766\",6150,3397]\n[\"000767\",6151,3397]\n[\"000768\",6152,3397]\n[\"001494\",6302,3398]\n[\"001496\",6303,3398]\n[\"002165\",6304,3398]\n[\"002235\",6305,3398]\n[\"000048\",6306,3399]\n[\"000048\",6307,3400]\n[\"000048\",6308,3401]\n[\"000056\",6309,3402]\n[\"001948\",6310,3403]\n[\"001953\",6311,3403]\n[\"001954\",6312,3403]\n[\"000057\",6313,3404]\n[\"000057\",6314,3405]\n[\"000057\",6315,3406]\n[\"000057\",6316,3407]\n[\"000057\",6317,3408]\n[\"000057\",6318,3409]\n[\"000057\",6319,3410]\n[\"000192\",6320,3411]\n[\"000192\",6321,3412]\n[\"000192\",6322,3413]\n[\"000193\",6323,3414]\n[\"000194\",6324,3415]\n[\"001619\",6325,3416]\n[\"000195\",6326,3417]\n[\"000195\",6327,3418]\n[\"000195\",6328,3419]\n[\"000195\",6329,3420]\n[\"000196\",6330,3421]\n[\"000196\",6331,3422]\n[\"000196\",6332,3423]\n[\"000198\",6333,3424]\n[\"000198\",6334,3425]\n[\"000199\",6335,3426]\n[\"000199\",6336,3427]\n[\"000200\",6337,3428]\n[\"000205\",6338,3429]\n[\"000366\",6339,3430]\n[\"000766\",6340,3431]\n[\"000795\",6341,3432]\n[\"000044\",6342,3433]\n[\"002236\",6343,3433]\n[\"002237\",6344,3433]\n[\"002238\",6345,3433]\n[\"002238\",6346,3434]\n[\"002038\",6347,3435]\n[\"002038\",6348,3436]\n[\"000366\",6349,3437]\n[\"000366\",6350,3438]\n[\"000366\",6351,3439]\n[\"000366\",6352,3440]\n[\"000366\",6353,3441]\n[\"000213\",6354,3442]\n[\"000213\",6355,3443]\n[\"000213\",6356,3444]\n[\"000213\",6357,3445]\n[\"000213\",6358,3446]\n[\"000766\",6359,3447]\n[\"000381\",6360,3448]\n[\"000381\",6361,3449]\n[\"002165\",6362,3450]\n[\"002235\",6363,3450]\n[\"001744\",6364,3451]\n[\"001744\",6365,3452]\n[\"001749\",6366,3453]\n[\"001749\",6367,3454]\n[\"000366\",6369,3455]\n[\"000778\",6368,3455]\n[\"001958\",6370,3455]\n[\"001958\",6371,3456]\n[\"000366\",6372,3457]\n[\"000778\",6373,3457]\n[\"001958\",6374,3457]\n[\"002617\",6375,3458]\n[\"002165\",6377,3459]\n[\"002696\",6376,3459]\n[\"002165\",6379,3460]\n[\"002696\",6378,3460]\n[\"000366\",6380,3461]\n[\"000366\",6381,3462]\n[\"000366\",6382,3463]\n[\"000366\",6383,3464]\n[\"000366\",6384,3465]\n[\"000366\",6385,3466]\n[\"000764\",6386,3467]\n[\"000366\",6387,3468]\n[\"002165\",6388,3469]\n[\"002165\",6389,3470]\n[\"000366\",6390,3471]\n[\"000366\",6391,3472]\n[\"000366\",6392,3473]\n[\"000366\",6393,3474]\n[\"000366\",6394,3475]\n[\"000366\",6395,3476]\n[\"000366\",6396,3477]\n[\"000366\",6397,3478]\n[\"000366\",6398,3479]\n[\"000366\",6399,3480]\n[\"000366\",6400,3481]\n[\"000366\",6401,3482]\n[\"000366\",6402,3483]\n[\"000366\",6403,3484]\n[\"000318\",6405,3485]\n[\"000368\",6404,3485]\n[\"001812\",6406,3485]\n[\"001813\",6407,3485]\n[\"001814\",6408,3485]\n[\"000366\",6409,3486]\n[\"000366\",6410,3487]\n[\"000366\",6411,3488]\n[\"000366\",6412,3489]\n[\"001764\",6413,3490]\n[\"001764\",6414,3491]\n[\"001764\",6415,3492]\n[\"000366\",6416,3493]\n[\"000318\",6418,3494]\n[\"000368\",6417,3494]\n[\"001812\",6421,3494]\n[\"001813\",6420,3494]\n[\"001814\",6419,3494]\n[\"000366\",6422,3495]\n[\"000366\",6423,3496]\n[\"000366\",6424,3497]\n[\"000366\",6425,3498]\n[\"000366\",6426,3499]\n[\"000366\",6427,3500]\n[\"000366\",6428,3501]\n[\"000366\",6429,3502]\n[\"000068\",6431,3503]\n[\"001199\",6430,3503]\n[\"002450\",6432,3503]\n[\"002476\",6433,3503]\n[\"000366\",6434,3504]\n[\"000366\",6435,3505]\n[\"000366\",6436,3506]\n[\"000318\",6438,3507]\n[\"000368\",6437,3507]\n[\"001812\",6441,3507]\n[\"001813\",6439,3507]\n[\"001814\",6440,3507]\n[\"000381\",6442,3508]\n[\"000126\",6444,3509]\n[\"000131\",6443,3509]\n[\"000139\",6445,3510]\n[\"001851\",6446,3511]\n[\"001851\",6447,3512]\n[\"001851\",6448,3513]\n[\"001851\",6449,3514]\n[\"001851\",6450,3515]\n[\"001851\",6451,3516]\n[\"001851\",6452,3517]\n[\"001851\",6453,3518]\n[\"001855\",6454,3519]\n[\"001855\",6455,3520]\n[\"001855\",6456,3521]\n[\"002234\",6457,3522]\n[\"000126\",6459,3523]\n[\"000172\",6458,3523]\n[\"000126\",6460,3524]\n[\"000172\",6461,3524]\n[\"000126\",6463,3525]\n[\"000172\",6462,3525]\n[\"000126\",6464,3526]\n[\"000172\",6465,3526]\n[\"000172\",6466,3527]\n[\"000172\",6467,3528]\n[\"000172\",6468,3529]\n[\"000172\",6469,3530]\n[\"000172\",6470,3531]\n[\"000172\",6471,3532]\n[\"000172\",6472,3533]\n[\"000172\",6473,3534]\n[\"000172\",6474,3535]\n[\"000172\",6475,3536]\n[\"002884\",6476,3536]\n[\"000172\",6477,3537]\n[\"002884\",6478,3537]\n[\"000172\",6479,3538]\n[\"002884\",6480,3538]\n[\"000172\",6481,3539]\n[\"002884\",6482,3539]\n[\"000172\",6483,3540]\n[\"002884\",6484,3540]\n[\"000172\",6485,3541]\n[\"002884\",6486,3541]\n[\"000172\",6487,3542]\n[\"002884\",6488,3542]\n[\"000172\",6489,3543]\n[\"002884\",6490,3543]\n[\"000172\",6491,3544]\n[\"002884\",6492,3544]\n[\"000172\",6493,3545]\n[\"002884\",6494,3545]\n[\"000126\",6495,3546]\n[\"000172\",6496,3546]\n[\"002884\",6497,3546]\n[\"000126\",6498,3547]\n[\"000172\",6499,3547]\n[\"002884\",6500,3547]\n[\"000135\",6502,3548]\n[\"000172\",6501,3548]\n[\"002884\",6503,3548]\n[\"000135\",6504,3549]\n[\"000172\",6505,3549]\n[\"002884\",6506,3549]\n[\"000135\",6507,3550]\n[\"000172\",6508,3550]\n[\"002884\",6509,3550]\n[\"000135\",6511,3551]\n[\"000172\",6510,3551]\n[\"002884\",6512,3551]\n[\"000135\",6513,3552]\n[\"000172\",6514,3552]\n[\"002884\",6515,3552]\n[\"000130\",6518,3553]\n[\"000135\",6517,3553]\n[\"000172\",6516,3553]\n[\"002884\",6519,3553]\n[\"000130\",6520,3554]\n[\"000135\",6521,3554]\n[\"000172\",6522,3554]\n[\"002884\",6523,3554]\n[\"000130\",6526,3555]\n[\"000135\",6525,3555]\n[\"000172\",6524,3555]\n[\"002884\",6527,3555]\n[\"000130\",6528,3556]\n[\"000135\",6529,3556]\n[\"000172\",6530,3556]\n[\"002884\",6531,3556]\n[\"000130\",6533,3557]\n[\"000135\",6534,3557]\n[\"000172\",6532,3557]\n[\"002884\",6535,3557]\n[\"000135\",6536,3558]\n[\"002884\",6537,3558]\n[\"000135\",6538,3559]\n[\"002884\",6539,3559]\n[\"000135\",6540,3560]\n[\"002884\",6541,3560]\n[\"000135\",6542,3561]\n[\"002884\",6543,3561]\n[\"000135\",6544,3562]\n[\"000172\",6545,3562]\n[\"002884\",6546,3562]\n[\"000135\",6548,3563]\n[\"000172\",6547,3563]\n[\"002884\",6549,3563]\n[\"000172\",6550,3564]\n[\"000172\",6551,3565]\n[\"000172\",6552,3566]\n[\"000172\",6553,3567]\n[\"000172\",6554,3568]\n[\"000172\",6555,3569]\n[\"000018\",6557,3570]\n[\"000172\",6556,3570]\n[\"001403\",6559,3570]\n[\"002130\",6558,3570]\n[\"000018\",6560,3571]\n[\"000172\",6561,3571]\n[\"001403\",6562,3571]\n[\"002130\",6563,3571]\n[\"000018\",6565,3572]\n[\"000172\",6564,3572]\n[\"001403\",6567,3572]\n[\"002130\",6566,3572]\n[\"000018\",6568,3573]\n[\"000172\",6569,3573]\n[\"001403\",6570,3573]\n[\"002130\",6571,3573]\n[\"000018\",6572,3574]\n[\"000172\",6573,3574]\n[\"001403\",6575,3574]\n[\"002130\",6574,3574]\n[\"000172\",6576,3575]\n[\"002884\",6577,3575]\n[\"000172\",6578,3576]\n[\"002884\",6579,3576]\n[\"000172\",6580,3577]\n[\"002884\",6581,3577]\n[\"000172\",6582,3578]\n[\"002884\",6583,3578]\n[\"000172\",6584,3579]\n[\"002884\",6585,3579]\n[\"000366\",6586,3580]\n[\"000318\",6587,3581]\n[\"000368\",6588,3581]\n[\"001812\",6590,3581]\n[\"001813\",6591,3581]\n[\"001814\",6589,3581]\n[\"000054\",6592,3582]\n[\"000382\",6593,3583]\n[\"002314\",6594,3583]\n[\"000068\",6597,3584]\n[\"000366\",6595,3584]\n[\"000803\",6596,3584]\n[\"001133\",6598,3585]\n[\"002361\",6599,3585]\n[\"000048\",6605,3586]\n[\"000050\",6606,3586]\n[\"001384\",6600,3586]\n[\"001385\",6601,3586]\n[\"001386\",6602,3586]\n[\"001387\",6603,3586]\n[\"001388\",6604,3586]\n[\"001453\",6607,3587]\n[\"001453\",6608,3588]\n[\"001453\",6609,3589]\n[\"000366\",6610,3590]\n[\"002418\",6611,3591]\n[\"002420\",6612,3591]\n[\"002421\",6613,3591]\n[\"002422\",6614,3591]\n[\"002418\",6617,3592]\n[\"002420\",6618,3592]\n[\"002421\",6615,3592]\n[\"002422\",6616,3592]\n[\"001133\",6619,3593]\n[\"002361\",6620,3593]\n[\"000366\",6621,3594]\n[\"001133\",6622,3595]\n[\"002361\",6623,3595]\n[\"000366\",6624,3596]\n[\"000366\",6625,3597]\n[\"000366\",6626,3598]\n[\"000366\",6627,3599]\n[\"000197\",6628,3600]\n[\"000366\",6629,3600]\n[\"001453\",6630,3601]\n[\"000366\",6631,3602]\n[\"000366\",6632,3603]\n[\"000318\",6633,3604]\n[\"000368\",6634,3604]\n[\"001812\",6635,3604]\n[\"001813\",6637,3604]\n[\"001814\",6636,3604]\n[\"000318\",6639,3605]\n[\"000368\",6638,3605]\n[\"001812\",6642,3605]\n[\"001813\",6641,3605]\n[\"001814\",6640,3605]\n[\"000366\",6643,3606]\n[\"000366\",6644,3607]\n[\"000366\",6645,3608]\n[\"001891\",6647,3609]\n[\"002046\",6646,3609]\n[\"000366\",6648,3610]\n[\"000366\",6649,3611]\n[\"000366\",6650,3612]\n[\"000366\",6651,3613]\n[\"000366\",6652,3614]\n[\"000366\",6653,3615]\n[\"000366\",6654,3616]\n[\"000366\",6655,3617]\n[\"000366\",6656,3618]\n[\"000366\",6657,3619]\n[\"000366\",6658,3620]\n[\"000366\",6659,3621]\n[\"000366\",6660,3622]\n[\"000366\",6661,3623]\n[\"000366\",6662,3624]\n[\"000366\",6663,3625]\n[\"000366\",6664,3626]\n[\"000318\",6665,3627]\n[\"000368\",6666,3627]\n[\"001812\",6668,3627]\n[\"001813\",6667,3627]\n[\"001814\",6669,3627]\n[\"000366\",6670,3628]\n[\"000366\",6671,3629]\n[\"000366\",6672,3630]\n[\"000366\",6673,3631]\n[\"000366\",6674,3632]\n[\"000366\",6675,3633]\n[\"000366\",6676,3634]\n[\"000366\",6677,3635]\n[\"000366\",6678,3636]\n[\"001948\",6680,3637]\n[\"001953\",6681,3637]\n[\"001954\",6679,3637]\n[\"001948\",6683,3638]\n[\"001953\",6682,3638]\n[\"001954\",6684,3638]\n[\"001948\",6686,3639]\n[\"001953\",6687,3639]\n[\"001954\",6685,3639]\n[\"001443\",6688,3640]\n[\"001444\",6689,3640]\n[\"002418\",6690,3640]\n[\"000057\",6691,3644]\n[\"001414\",6813,3645]\n[\"000048\",6814,3646]\n[\"001414\",6816,3647]\n[\"000048\",6817,3648]\n[\"000050\",6818,3649]\n[\"001384\",6819,3650]\n[\"001385\",6820,3650]\n[\"001386\",6821,3650]\n[\"001387\",6822,3650]\n[\"001388\",6823,3650]\n[\"000053\",6824,3651]\n[\"000054\",6825,3652]\n[\"000068\",6826,3653]\n[\"001453\",6827,3654]\n[\"001453\",6828,3655]\n[\"000068\",6829,3656]\n[\"000130\",6830,3657]\n[\"000131\",6831,3658]\n[\"001487\",6832,3659]\n[\"000132\",6833,3660]\n[\"000133\",6834,3661]\n[\"000134\",6835,3662]\n[\"000162\",6836,3663]\n[\"000163\",6837,3664]\n[\"000164\",6838,3665]\n[\"000382\",6839,3666]\n[\"000382\",6840,3667]\n[\"000382\",6841,3668]\n[\"000382\",6842,3669]\n[\"000764\",6843,3670]\n[\"000766\",6844,3671]\n[\"001939\",6845,3672]\n[\"001942\",6846,3673]\n[\"001942\",6847,3674]\n[\"000778\",6848,3675]\n[\"000185\",6849,3676]\n[\"000186\",6850,3677]\n[\"000187\",6851,3678]\n[\"000187\",6852,3679]\n[\"000803\",6853,3680]\n[\"000804\",6854,3681]\n[\"001097\",6855,3682]\n[\"001133\",6856,3683]\n[\"001184\",6857,3684]\n[\"001184\",6858,3685]\n[\"001185\",6859,3686]\n[\"001664\",6860,3687]\n[\"001188\",6861,3688]\n[\"001190\",6862,3689]\n[\"002314\",6863,3690]\n[\"002322\",6864,3691]\n[\"000068\",6865,3692]\n[\"002353\",6866,3693]\n[\"002250\",6867,3694]\n[\"001844\",6868,3695]\n[\"001851\",6869,3696]\n[\"001858\",6870,3697]\n[\"001861\",6871,3698]\n[\"002038\",6872,3699]\n[\"002038\",6873,3700]\n[\"001953\",6874,3701]\n[\"001954\",6875,3702]\n[\"001958\",6876,3703]\n[\"002450\",6877,3704]\n[\"002397\",6878,3705]\n[\"002418\",6879,3706]\n[\"002418\",6880,3707]\n[\"002423\",6881,3708]\n[\"000197\",6882,3709]\n[\"000172\",6883,3710]\n[\"002450\",6884,3711]\n[\"002450\",6885,3712]\n[\"002450\",6886,3713]\n[\"000366\",6887,3714]\n[\"000366\",6888,3715]\n[\"002363\",6889,3716]\n[\"002364\",6890,3717]\n[\"000196\",6891,3718]\n[\"000068\",6892,3719]\n[\"001453\",6893,3720]\n[\"001453\",6894,3721]\n[\"001967\",6895,3722]\n[\"002450\",6896,3723]\n[\"002450\",6897,3724]\n[\"000185\",6898,3725]\n[\"000803\",6899,3726]\n[\"000068\",6900,3727]\n[\"001414\",6943,3728]\n[\"000048\",6944,3729]\n[\"001414\",6946,3730]\n[\"001414\",6947,3731]\n[\"000048\",6948,3732]\n[\"001414\",6949,3733]\n[\"000048\",6950,3734]\n[\"000050\",6951,3735]\n[\"001384\",6952,3736]\n[\"001385\",6953,3736]\n[\"001386\",6954,3736]\n[\"001387\",6955,3736]\n[\"001388\",6956,3736]\n[\"000053\",6957,3737]\n[\"000054\",6958,3738]\n[\"000068\",6959,3739]\n[\"001453\",6960,3740]\n[\"001453\",6961,3741]\n[\"000068\",6962,3742]\n[\"000130\",6963,3743]\n[\"000131\",6964,3744]\n[\"001487\",6965,3745]\n[\"000132\",6966,3746]\n[\"000133\",6967,3747]\n[\"000134\",6968,3748]\n[\"000162\",6969,3749]\n[\"000163\",6970,3750]\n[\"000164\",6971,3751]\n[\"000382\",6972,3752]\n[\"000382\",6973,3753]\n[\"000382\",6974,3754]\n[\"000382\",6975,3755]\n[\"000764\",6976,3756]\n[\"000766\",6977,3757]\n[\"001939\",6978,3758]\n[\"001942\",6979,3759]\n[\"001942\",6980,3760]\n[\"000778\",6981,3761]\n[\"000185\",6982,3762]\n[\"000186\",6983,3763]\n[\"000187\",6984,3764]\n[\"000187\",6985,3765]\n[\"000803\",6986,3766]\n[\"000804\",6987,3767]\n[\"001097\",6988,3768]\n[\"001133\",6989,3769]\n[\"001184\",6990,3770]\n[\"001184\",6991,3771]\n[\"001185\",6992,3772]\n[\"001664\",6993,3773]\n[\"001188\",6994,3774]\n[\"001190\",6995,3775]\n[\"002314\",6996,3776]\n[\"002322\",6997,3777]\n[\"000068\",6998,3778]\n[\"002353\",6999,3779]\n[\"002250\",7000,3780]\n[\"001844\",7001,3781]\n[\"001851\",7002,3782]\n[\"001858\",7003,3783]\n[\"001861\",7004,3784]\n[\"002038\",7005,3785]\n[\"002038\",7006,3786]\n[\"001953\",7007,3787]\n[\"001954\",7008,3788]\n[\"001958\",7009,3789]\n[\"002450\",7010,3790]\n[\"002397\",7011,3791]\n[\"002418\",7012,3792]\n[\"002418\",7013,3793]\n[\"002423\",7014,3794]\n[\"000197\",7015,3795]\n[\"000172\",7016,3796]\n[\"002450\",7017,3797]\n[\"002450\",7018,3798]\n[\"002450\",7019,3799]\n[\"000366\",7020,3800]\n[\"000366\",7021,3801]\n[\"002363\",7022,3802]\n[\"002364\",7023,3803]\n[\"000196\",7024,3804]\n[\"000068\",7025,3805]\n[\"001453\",7026,3806]\n[\"001453\",7027,3807]\n[\"001967\",7028,3808]\n[\"002450\",7029,3809]\n[\"002450\",7030,3810]\n[\"000185\",7031,3811]\n[\"000803\",7032,3812]\n[\"000068\",7033,3813]\n[\"000366\",7076,3814]\n[\"001812\",7077,3815]\n[\"000366\",7078,3816]\n[\"001812\",7079,3817]\n[\"000366\",7080,3818]\n[\"000366\",7081,3819]\n[\"000877\",7082,3820]\n[\"001199\",7083,3821]\n[\"002475\",7084,3821]\n[\"002476\",7085,3821]\n[\"002890\",7086,3822]\n[\"003123\",7087,3822]\n[\"000877\",7088,3823]\n[\"001233\",7089,3824]\n[\"001774\",7090,3825]\n[\"000877\",7091,3826]\n[\"000366\",7092,3827]\n[\"000366\",7093,3828]\n[\"000213\",7094,3829]\n[\"000366\",7095,3830]\n[\"001090\",7096,3831]\n[\"000795\",7097,3832]\n[\"002235\",7098,3833]\n[\"000366\",7099,3834]\n[\"000381\",7100,3835]\n[\"000366\",7101,3836]\n[\"002890\",7102,3837]\n[\"003123\",7103,3837]\n[\"000199\",7104,3838]\n[\"002165\",7105,3839]\n[\"002038\",7106,3840]\n[\"000381\",7107,3841]\n[\"000382\",7108,3842]\n[\"000381\",7109,3843]\n[\"000382\",7110,3844]\n[\"000382\",7111,3845]\n[\"000366\",7112,3846]\n[\"000366\",7113,3847]\n[\"000366\",7114,3848]\n[\"002238\",7115,3849]\n[\"000044\",7116,3850]\n[\"000044\",7117,3851]\n[\"002238\",7118,3851]\n[\"000200\",7119,3852]\n[\"000199\",7120,3853]\n[\"000198\",7121,3854]\n[\"000205\",7122,3855]\n[\"000192\",7123,3856]\n[\"000193\",7124,3856]\n[\"000194\",7125,3856]\n[\"001619\",7126,3856]\n[\"000196\",7127,3857]\n[\"000172\",7128,3858]\n[\"000172\",7129,3859]\n[\"000018\",7130,3860]\n[\"000172\",7131,3860]\n[\"001403\",7132,3860]\n[\"001404\",7133,3860]\n[\"001405\",7134,3860]\n[\"002130\",7135,3860]\n[\"002234\",7136,3860]\n[\"000018\",7137,3861]\n[\"000172\",7138,3861]\n[\"001403\",7139,3861]\n[\"001404\",7140,3861]\n[\"001405\",7141,3861]\n[\"002130\",7142,3861]\n[\"002234\",7143,3861]\n[\"000018\",7144,3862]\n[\"000172\",7145,3862]\n[\"001403\",7146,3862]\n[\"001404\",7147,3862]\n[\"001405\",7148,3862]\n[\"002130\",7149,3862]\n[\"002234\",7150,3862]\n[\"000172\",7151,3863]\n[\"000172\",7152,3864]\n[\"000172\",7153,3865]\n[\"000067\",7154,3866]\n[\"000172\",7155,3866]\n[\"000067\",7156,3867]\n[\"000172\",7157,3867]\n[\"000067\",7158,3868]\n[\"000172\",7159,3868]\n[\"000172\",7160,3869]\n[\"000172\",7161,3870]\n[\"000172\",7162,3871]\n[\"000172\",7163,3872]\n[\"000172\",7164,3873]\n[\"002234\",7165,3873]\n[\"000172\",7166,3874]\n[\"002234\",7167,3874]\n[\"000172\",7168,3875]\n[\"002234\",7169,3875]\n[\"000172\",7170,3876]\n[\"000172\",7171,3877]\n[\"000172\",7172,3878]\n[\"000172\",7173,3879]\n[\"002234\",7174,3879]\n[\"000172\",7175,3880]\n[\"002234\",7176,3880]\n[\"000172\",7177,3881]\n[\"002234\",7178,3881]\n[\"000172\",7179,3882]\n[\"002234\",7180,3882]\n[\"001849\",7181,3883]\n[\"001849\",7182,3884]\n[\"001849\",7183,3885]\n[\"000162\",7184,3886]\n[\"000163\",7185,3886]\n[\"000164\",7186,3886]\n[\"000162\",7187,3887]\n[\"000163\",7188,3887]\n[\"000164\",7189,3887]\n[\"000162\",7190,3888]\n[\"000163\",7191,3888]\n[\"000164\",7192,3888]\n[\"000381\",7193,3889]\n[\"000381\",7194,3890]\n[\"000366\",7195,3891]\n[\"000366\",7196,3892]\n[\"000366\",7197,3893]\n[\"002385\",7198,3894]\n[\"000366\",7199,3895]\n[\"000366\",7200,3896]\n[\"000185\",7201,3897]\n[\"002470\",7202,3897]\n[\"000366\",7203,3898]\n[\"000185\",7204,3899]\n[\"000366\",7205,3900]\n[\"000185\",7206,3901]\n[\"002470\",7207,3901]\n[\"000185\",7208,3902]\n[\"002470\",7209,3902]\n[\"000366\",7210,3903]\n[\"002235\",7211,3904]\n[\"000366\",7212,3905]\n[\"001084\",7213,3906]\n[\"000366\",7214,3907]\n[\"000764\",7215,3908]\n[\"000366\",7216,3909]\n[\"000366\",7217,3910]\n[\"000804\",7218,3911]\n[\"000381\",7219,3912]\n[\"000366\",7220,3913]\n[\"000366\",7221,3914]\n[\"000381\",7222,3915]\n[\"000381\",7223,3916]\n[\"000366\",7224,3917]\n[\"000366\",7225,3918]\n[\"000381\",7226,3919]\n[\"000381\",7227,3920]\n[\"000169\",7228,3921]\n[\"002418\",7229,3922]\n[\"002421\",7230,3922]\n[\"002418\",7231,3923]\n[\"002421\",7232,3923]\n[\"002038\",7233,3924]\n[\"002418\",7234,3925]\n[\"002421\",7235,3925]\n[\"002038\",7236,3926]\n[\"001090\",7237,3927]\n[\"000366\",7238,3928]\n[\"001967\",7239,3929]\n[\"000366\",7240,3930]\n[\"000366\",7241,3931]\n[\"000381\",7242,3932]\n[\"002418\",7243,3933]\n[\"002421\",7244,3933]\n[\"001764\",7245,3934]\n[\"000057\",7246,3935]\n[\"001764\",7247,3936]\n[\"001764\",7248,3937]\n[\"000048\",7249,3938]\n[\"000050\",7250,3938]\n[\"001384\",7251,3938]\n[\"001385\",7252,3938]\n[\"001386\",7253,3938]\n[\"001387\",7254,3938]\n[\"001388\",7255,3938]\n[\"000366\",7256,3939]\n[\"001084\",7257,3940]\n[\"000048\",7258,3941]\n[\"001384\",7259,3941]\n[\"001385\",7260,3941]\n[\"001386\",7261,3941]\n[\"001387\",7262,3941]\n[\"001388\",7263,3941]\n[\"000366\",7264,3942]\n[\"000381\",7265,3943]\n[\"000366\",7266,3944]\n[\"002824\",7267,3945]\n[\"002385\",7268,3946]\n[\"000366\",7269,3947]\n[\"000366\",7270,3948]\n[\"000366\",7271,3949]\n[\"000366\",7272,3950]\n[\"002418\",7273,3951]\n[\"002421\",7274,3951]\n[\"000366\",7275,3952]\n[\"000197\",7276,3953]\n[\"000366\",7277,3954]\n[\"000366\",7278,3955]\n[\"002418\",7279,3956]\n[\"002421\",7280,3956]\n[\"000366\",7281,3957]\n[\"002038\",7282,3958]\n[\"001090\",7283,3959]\n[\"002038\",7284,3960]\n[\"001453\",7285,3961]\n[\"000366\",7286,3962]\n[\"000068\",7287,3963]\n[\"002890\",7288,3963]\n[\"000366\",7289,3964]\n[\"000366\",7290,3965]\n[\"000381\",7291,3966]\n[\"001090\",7292,3967]\n[\"000381\",7293,3968]\n[\"000366\",7294,3969]\n[\"001090\",7295,3970]\n[\"000366\",7296,3971]\n[\"000366\",7297,3972]\n[\"000803\",7298,3973]\n[\"000196\",7299,3974]\n[\"000366\",7300,3975]\n[\"000366\",7301,3976]\n[\"000366\",7302,3977]\n[\"000366\",7303,3978]\n[\"002450\",7304,3979]\n[\"000366\",7305,3980]\n[\"002038\",7306,3981]\n[\"001084\",7307,3982]\n[\"002038\",7308,3983]\n[\"001084\",7309,3984]\n[\"001084\",7310,3985]\n[\"002038\",7311,3986]\n[\"001084\",7312,3987]\n[\"000381\",7313,3988]\n[\"000366\",7314,3989]\n[\"002235\",7315,3990]\n[\"000213\",7316,3991]\n[\"002235\",7317,3992]\n[\"000213\",7318,3993]\n[\"002235\",7319,3994]\n[\"002235\",7320,3995]\n[\"002235\",7321,3996]\n[\"002235\",7322,3997]\n[\"002235\",7323,3998]\n[\"002235\",7324,3999]\n[\"002235\",7325,4000]\n[\"002235\",7326,4001]\n[\"000213\",7327,4002]\n[\"000213\",7328,4003]\n[\"000213\",7329,4004]\n[\"000213\",7330,4005]\n[\"000213\",7331,4006]\n[\"002314\",7332,4006]\n[\"002235\",7333,4007]\n[\"002235\",7334,4008]\n[\"002235\",7335,4009]\n[\"002235\",7336,4010]\n[\"002235\",7337,4011]\n[\"000162\",7338,4012]\n[\"000163\",7339,4012]\n[\"000164\",7340,4012]\n[\"000171\",7341,4012]\n[\"001914\",7342,4012]\n[\"002235\",7343,4013]\n[\"002235\",7344,4014]\n[\"002235\",7345,4015]\n[\"002235\",7346,4016]\n[\"002235\",7347,4017]\n[\"000366\",7348,4018]\n[\"000135\",7349,4019]\n[\"000135\",7350,4020]\n[\"002824\",7351,4021]\n[\"002824\",7352,4022]\n[\"000381\",7353,4023]\n[\"000381\",7354,4024]\n[\"000172\",7355,4025]\n[\"000172\",7356,4026]\n[\"000381\",7357,4027]\n[\"000381\",7358,4028]\n[\"002235\",7359,4029]\n[\"000381\",7360,4030]\n[\"000381\",7361,4031]\n[\"000381\",7362,4032]\n[\"000381\",7363,4033]\n[\"000366\",7364,4034]\n[\"000172\",7365,4035]\n[\"000172\",7366,4036]\n[\"000803\",7367,4037]\n[\"000381\",7368,4038]\n[\"000366\",7369,4039]\n[\"000381\",7370,4040]\n[\"000172\",7371,4041]\n[\"000381\",7372,4042]\n[\"000381\",7373,4043]\n[\"000172\",7374,4044]\n[\"000366\",7375,4045]\n[\"000366\",7376,4046]\n[\"000366\",7377,4047]\n[\"000366\",7378,4048]\n[\"002824\",7379,4049]\n[\"000366\",7380,4050]\n[\"000366\",7381,4051]\n[\"000366\",7382,4052]\n[\"000366\",7383,4053]\n[\"000366\",7384,4054]\n[\"000366\",7385,4055]\n[\"000366\",7386,4056]\n[\"000366\",7387,4057]\n[\"000366\",7388,4058]\n[\"000366\",7389,4059]\n[\"000366\",7390,4060]\n[\"000366\",7391,4061]\n[\"000366\",7392,4062]\n[\"000366\",7393,4063]\n[\"000366\",7394,4064]\n[\"000366\",7395,4065]\n[\"000366\",7396,4066]\n[\"000366\",7397,4067]\n[\"000366\",7398,4068]\n[\"000366\",7399,4069]\n[\"000366\",7400,4070]\n[\"000366\",7401,4071]\n[\"000366\",7402,4072]\n[\"000366\",7403,4073]\n[\"000366\",7404,4074]\n[\"000366\",7405,4075]\n[\"000366\",7406,4076]\n[\"000366\",7407,4077]\n[\"000381\",7408,4078]\n[\"000366\",7409,4079]\n[\"000366\",7410,4080]\n[\"000366\",7411,4081]\n[\"000056\",7412,4082]\n[\"001199\",7413,4083]\n[\"002475\",7414,4083]\n[\"002476\",7415,4083]\n[\"001199\",7416,4084]\n[\"002475\",7417,4084]\n[\"002476\",7418,4084]\n[\"000130\",7419,4085]\n[\"000130\",7420,4086]\n[\"000130\",7421,4087]\n[\"000130\",7422,4088]\n[\"000130\",7423,4089]\n[\"000130\",7424,4090]\n[\"000130\",7425,4091]\n[\"000199\",7426,4092]\n[\"001090\",7427,4093]\n[\"000381\",7428,4094]\n[\"000381\",7429,4095]\n[\"000381\",7430,4096]\n[\"000381\",7431,4097]\n[\"001199\",7432,4098]\n[\"000366\",7433,4099]\n[\"000765\",7434,4100]\n[\"000766\",7435,4100]\n[\"000767\",7436,4100]\n[\"000768\",7437,4100]\n[\"001494\",7587,4101]\n[\"001496\",7588,4101]\n[\"002165\",7589,4101]\n[\"002235\",7590,4101]\n[\"000048\",7591,4102]\n[\"000048\",7592,4103]\n[\"000048\",7593,4104]\n[\"000056\",7594,4105]\n[\"001948\",7595,4106]\n[\"001953\",7596,4106]\n[\"001954\",7597,4106]\n[\"000057\",7598,4107]\n[\"000057\",7599,4108]\n[\"000057\",7600,4109]\n[\"000057\",7601,4110]\n[\"000057\",7602,4111]\n[\"000057\",7603,4112]\n[\"000057\",7604,4113]\n[\"000192\",7605,4114]\n[\"000192\",7606,4115]\n[\"000192\",7607,4116]\n[\"000193\",7608,4117]\n[\"000194\",7609,4118]\n[\"001619\",7610,4119]\n[\"000195\",7611,4120]\n[\"000195\",7612,4121]\n[\"000195\",7613,4122]\n[\"000195\",7614,4123]\n[\"000196\",7615,4124]\n[\"000196\",7616,4125]\n[\"000196\",7617,4126]\n[\"000198\",7618,4127]\n[\"000198\",7619,4128]\n[\"000199\",7620,4129]\n[\"000199\",7621,4130]\n[\"000200\",7622,4131]\n[\"000205\",7623,4132]\n[\"000366\",7624,4133]\n[\"000766\",7625,4134]\n[\"000795\",7626,4135]\n[\"000044\",7627,4136]\n[\"002236\",7628,4136]\n[\"002237\",7629,4136]\n[\"002238\",7630,4136]\n[\"002238\",7631,4137]\n[\"002038\",7632,4138]\n[\"002038\",7633,4139]\n[\"000366\",7634,4140]\n[\"000366\",7635,4141]\n[\"000366\",7636,4142]\n[\"000366\",7637,4143]\n[\"000366\",7638,4144]\n[\"000213\",7639,4145]\n[\"000213\",7640,4146]\n[\"000213\",7641,4147]\n[\"000213\",7642,4148]\n[\"000213\",7643,4149]\n[\"000766\",7644,4150]\n[\"000381\",7645,4151]\n[\"000381\",7646,4152]\n[\"002165\",7647,4153]\n[\"002235\",7648,4153]\n[\"001744\",7649,4154]\n[\"001744\",7650,4155]\n[\"001749\",7651,4156]\n[\"001749\",7652,4157]\n[\"000366\",7654,4158]\n[\"000778\",7653,4158]\n[\"001958\",7655,4158]\n[\"001958\",7656,4159]\n[\"000366\",7657,4160]\n[\"000778\",7658,4160]\n[\"001958\",7659,4160]\n[\"002617\",7660,4161]\n[\"002165\",7662,4162]\n[\"002696\",7661,4162]\n[\"002165\",7664,4163]\n[\"002696\",7663,4163]\n[\"000366\",7665,4164]\n[\"000366\",7666,4165]\n[\"000366\",7667,4166]\n[\"000366\",7668,4167]\n[\"000366\",7669,4168]\n[\"000366\",7670,4169]\n[\"000764\",7671,4170]\n[\"000366\",7672,4171]\n[\"002165\",7673,4172]\n[\"002165\",7674,4173]\n[\"000366\",7675,4174]\n[\"000366\",7676,4175]\n[\"000366\",7677,4176]\n[\"000366\",7678,4177]\n[\"000366\",7679,4178]\n[\"000366\",7680,4179]\n[\"000366\",7681,4180]\n[\"000366\",7682,4181]\n[\"000366\",7683,4182]\n[\"000366\",7684,4183]\n[\"000366\",7685,4184]\n[\"000366\",7686,4185]\n[\"000366\",7687,4186]\n[\"000366\",7688,4187]\n[\"000318\",7690,4188]\n[\"000368\",7689,4188]\n[\"001812\",7691,4188]\n[\"001813\",7692,4188]\n[\"001814\",7693,4188]\n[\"000366\",7694,4189]\n[\"000366\",7695,4190]\n[\"000366\",7696,4191]\n[\"000366\",7697,4192]\n[\"001764\",7698,4193]\n[\"001764\",7699,4194]\n[\"001764\",7700,4195]\n[\"000366\",7701,4196]\n[\"000318\",7703,4197]\n[\"000368\",7702,4197]\n[\"001812\",7706,4197]\n[\"001813\",7705,4197]\n[\"001814\",7704,4197]\n[\"000366\",7707,4198]\n[\"000366\",7708,4199]\n[\"000366\",7709,4200]\n[\"000366\",7710,4201]\n[\"000366\",7711,4202]\n[\"000366\",7712,4203]\n[\"000366\",7713,4204]\n[\"000366\",7714,4205]\n[\"000068\",7716,4206]\n[\"001199\",7715,4206]\n[\"002450\",7717,4206]\n[\"002476\",7718,4206]\n[\"000366\",7719,4207]\n[\"000366\",7720,4208]\n[\"000366\",7721,4209]\n[\"000318\",7723,4210]\n[\"000368\",7722,4210]\n[\"001812\",7726,4210]\n[\"001813\",7724,4210]\n[\"001814\",7725,4210]\n[\"000381\",7727,4211]\n[\"000126\",7729,4212]\n[\"000131\",7728,4212]\n[\"000139\",7730,4213]\n[\"001851\",7731,4214]\n[\"001851\",7732,4215]\n[\"001851\",7733,4216]\n[\"001851\",7734,4217]\n[\"001851\",7735,4218]\n[\"001851\",7736,4219]\n[\"001851\",7737,4220]\n[\"001851\",7738,4221]\n[\"001855\",7739,4222]\n[\"001855\",7740,4223]\n[\"001855\",7741,4224]\n[\"002234\",7742,4225]\n[\"000126\",7744,4226]\n[\"000172\",7743,4226]\n[\"000126\",7745,4227]\n[\"000172\",7746,4227]\n[\"000126\",7748,4228]\n[\"000172\",7747,4228]\n[\"000126\",7749,4229]\n[\"000172\",7750,4229]\n[\"000172\",7751,4230]\n[\"000172\",7752,4231]\n[\"000172\",7753,4232]\n[\"000172\",7754,4233]\n[\"000172\",7755,4234]\n[\"000172\",7756,4235]\n[\"000172\",7757,4236]\n[\"000172\",7758,4237]\n[\"000172\",7759,4238]\n[\"000172\",7760,4239]\n[\"002884\",7761,4239]\n[\"000172\",7762,4240]\n[\"002884\",7763,4240]\n[\"000172\",7764,4241]\n[\"002884\",7765,4241]\n[\"000172\",7766,4242]\n[\"002884\",7767,4242]\n[\"000172\",7768,4243]\n[\"002884\",7769,4243]\n[\"000172\",7770,4244]\n[\"002884\",7771,4244]\n[\"000172\",7772,4245]\n[\"002884\",7773,4245]\n[\"000172\",7774,4246]\n[\"002884\",7775,4246]\n[\"000172\",7776,4247]\n[\"002884\",7777,4247]\n[\"000172\",7778,4248]\n[\"002884\",7779,4248]\n[\"000126\",7780,4249]\n[\"000172\",7781,4249]\n[\"002884\",7782,4249]\n[\"000126\",7783,4250]\n[\"000172\",7784,4250]\n[\"002884\",7785,4250]\n[\"000135\",7787,4251]\n[\"000172\",7786,4251]\n[\"002884\",7788,4251]\n[\"000135\",7789,4252]\n[\"000172\",7790,4252]\n[\"002884\",7791,4252]\n[\"000135\",7792,4253]\n[\"000172\",7793,4253]\n[\"002884\",7794,4253]\n[\"000135\",7796,4254]\n[\"000172\",7795,4254]\n[\"002884\",7797,4254]\n[\"000135\",7798,4255]\n[\"000172\",7799,4255]\n[\"002884\",7800,4255]\n[\"000130\",7803,4256]\n[\"000135\",7802,4256]\n[\"000172\",7801,4256]\n[\"002884\",7804,4256]\n[\"000130\",7805,4257]\n[\"000135\",7806,4257]\n[\"000172\",7807,4257]\n[\"002884\",7808,4257]\n[\"000130\",7811,4258]\n[\"000135\",7810,4258]\n[\"000172\",7809,4258]\n[\"002884\",7812,4258]\n[\"000130\",7813,4259]\n[\"000135\",7814,4259]\n[\"000172\",7815,4259]\n[\"002884\",7816,4259]\n[\"000130\",7818,4260]\n[\"000135\",7819,4260]\n[\"000172\",7817,4260]\n[\"002884\",7820,4260]\n[\"000135\",7821,4261]\n[\"002884\",7822,4261]\n[\"000135\",7823,4262]\n[\"002884\",7824,4262]\n[\"000135\",7825,4263]\n[\"002884\",7826,4263]\n[\"000135\",7827,4264]\n[\"002884\",7828,4264]\n[\"000135\",7829,4265]\n[\"000172\",7830,4265]\n[\"002884\",7831,4265]\n[\"000135\",7833,4266]\n[\"000172\",7832,4266]\n[\"002884\",7834,4266]\n[\"000172\",7835,4267]\n[\"000172\",7836,4268]\n[\"000172\",7837,4269]\n[\"000172\",7838,4270]\n[\"000172\",7839,4271]\n[\"000172\",7840,4272]\n[\"000018\",7842,4273]\n[\"000172\",7841,4273]\n[\"001403\",7844,4273]\n[\"002130\",7843,4273]\n[\"000018\",7845,4274]\n[\"000172\",7846,4274]\n[\"001403\",7847,4274]\n[\"002130\",7848,4274]\n[\"000018\",7850,4275]\n[\"000172\",7849,4275]\n[\"001403\",7852,4275]\n[\"002130\",7851,4275]\n[\"000018\",7853,4276]\n[\"000172\",7854,4276]\n[\"001403\",7855,4276]\n[\"002130\",7856,4276]\n[\"000018\",7857,4277]\n[\"000172\",7858,4277]\n[\"001403\",7860,4277]\n[\"002130\",7859,4277]\n[\"000172\",7861,4278]\n[\"002884\",7862,4278]\n[\"000172\",7863,4279]\n[\"002884\",7864,4279]\n[\"000172\",7865,4280]\n[\"002884\",7866,4280]\n[\"000172\",7867,4281]\n[\"002884\",7868,4281]\n[\"000172\",7869,4282]\n[\"002884\",7870,4282]\n[\"000366\",7871,4283]\n[\"000318\",7872,4284]\n[\"000368\",7873,4284]\n[\"001812\",7875,4284]\n[\"001813\",7876,4284]\n[\"001814\",7874,4284]\n[\"000054\",7877,4285]\n[\"000382\",7878,4286]\n[\"002314\",7879,4286]\n[\"000068\",7882,4287]\n[\"000366\",7880,4287]\n[\"000803\",7881,4287]\n[\"001133\",7883,4288]\n[\"002361\",7884,4288]\n[\"000048\",7890,4289]\n[\"000050\",7891,4289]\n[\"001384\",7885,4289]\n[\"001385\",7886,4289]\n[\"001386\",7887,4289]\n[\"001387\",7888,4289]\n[\"001388\",7889,4289]\n[\"001453\",7892,4290]\n[\"001453\",7893,4291]\n[\"001453\",7894,4292]\n[\"000366\",7895,4293]\n[\"002418\",7896,4294]\n[\"002420\",7897,4294]\n[\"002421\",7898,4294]\n[\"002422\",7899,4294]\n[\"002418\",7902,4295]\n[\"002420\",7903,4295]\n[\"002421\",7900,4295]\n[\"002422\",7901,4295]\n[\"001133\",7904,4296]\n[\"002361\",7905,4296]\n[\"000366\",7906,4297]\n[\"001133\",7907,4298]\n[\"002361\",7908,4298]\n[\"000366\",7909,4299]\n[\"000366\",7910,4300]\n[\"000366\",7911,4301]\n[\"000366\",7912,4302]\n[\"000197\",7913,4303]\n[\"000366\",7914,4303]\n[\"001453\",7915,4304]\n[\"000366\",7916,4305]\n[\"000366\",7917,4306]\n[\"000318\",7918,4307]\n[\"000368\",7919,4307]\n[\"001812\",7920,4307]\n[\"001813\",7922,4307]\n[\"001814\",7921,4307]\n[\"000318\",7924,4308]\n[\"000368\",7923,4308]\n[\"001812\",7927,4308]\n[\"001813\",7926,4308]\n[\"001814\",7925,4308]\n[\"000366\",7928,4309]\n[\"000366\",7929,4310]\n[\"000366\",7930,4311]\n[\"001891\",7932,4312]\n[\"002046\",7931,4312]\n[\"000366\",7933,4313]\n[\"000366\",7934,4314]\n[\"000366\",7935,4315]\n[\"000366\",7936,4316]\n[\"000366\",7937,4317]\n[\"000366\",7938,4318]\n[\"000366\",7939,4319]\n[\"000366\",7940,4320]\n[\"000366\",7941,4321]\n[\"000366\",7942,4322]\n[\"000366\",7943,4323]\n[\"000366\",7944,4324]\n[\"000366\",7945,4325]\n[\"000366\",7946,4326]\n[\"000366\",7947,4327]\n[\"000366\",7948,4328]\n[\"000366\",7949,4329]\n[\"000318\",7950,4330]\n[\"000368\",7951,4330]\n[\"001812\",7953,4330]\n[\"001813\",7952,4330]\n[\"001814\",7954,4330]\n[\"000366\",7955,4331]\n[\"000366\",7956,4332]\n[\"000366\",7957,4333]\n[\"000366\",7958,4334]\n[\"000366\",7959,4335]\n[\"000366\",7960,4336]\n[\"000366\",7961,4337]\n[\"000366\",7962,4338]\n[\"000366\",7963,4339]\n[\"001948\",7965,4340]\n[\"001953\",7966,4340]\n[\"001954\",7964,4340]\n[\"001948\",7968,4341]\n[\"001953\",7967,4341]\n[\"001954\",7969,4341]\n[\"001948\",7971,4342]\n[\"001953\",7972,4342]\n[\"001954\",7970,4342]\n[\"001443\",7973,4343]\n[\"001444\",7974,4343]\n[\"002418\",7975,4343]\n[\"000057\",7976,4347]\n[\"001414\",8098,4348]\n[\"000048\",8099,4349]\n[\"001414\",8101,4350]\n[\"000048\",8102,4351]\n[\"000050\",8103,4352]\n[\"001384\",8104,4353]\n[\"001385\",8105,4353]\n[\"001386\",8106,4353]\n[\"001387\",8107,4353]\n[\"001388\",8108,4353]\n[\"000053\",8109,4354]\n[\"000054\",8110,4355]\n[\"000068\",8111,4356]\n[\"001453\",8112,4357]\n[\"001453\",8113,4358]\n[\"000068\",8114,4359]\n[\"000130\",8115,4360]\n[\"000131\",8116,4361]\n[\"001487\",8117,4362]\n[\"000132\",8118,4363]\n[\"000133\",8119,4364]\n[\"000134\",8120,4365]\n[\"000162\",8121,4366]\n[\"000163\",8122,4367]\n[\"000164\",8123,4368]\n[\"000382\",8124,4369]\n[\"000382\",8125,4370]\n[\"000382\",8126,4371]\n[\"000382\",8127,4372]\n[\"000764\",8128,4373]\n[\"000766\",8129,4374]\n[\"001939\",8130,4375]\n[\"001942\",8131,4376]\n[\"001942\",8132,4377]\n[\"000778\",8133,4378]\n[\"000185\",8134,4379]\n[\"000186\",8135,4380]\n[\"000187\",8136,4381]\n[\"000187\",8137,4382]\n[\"000803\",8138,4383]\n[\"000804\",8139,4384]\n[\"001097\",8140,4385]\n[\"001133\",8141,4386]\n[\"001184\",8142,4387]\n[\"001184\",8143,4388]\n[\"001185\",8144,4389]\n[\"001664\",8145,4390]\n[\"001188\",8146,4391]\n[\"001190\",8147,4392]\n[\"002314\",8148,4393]\n[\"002322\",8149,4394]\n[\"000068\",8150,4395]\n[\"002353\",8151,4396]\n[\"002250\",8152,4397]\n[\"001844\",8153,4398]\n[\"001851\",8154,4399]\n[\"001858\",8155,4400]\n[\"001861\",8156,4401]\n[\"002038\",8157,4402]\n[\"002038\",8158,4403]\n[\"001953\",8159,4404]\n[\"001954\",8160,4405]\n[\"001958\",8161,4406]\n[\"002450\",8162,4407]\n[\"002397\",8163,4408]\n[\"002418\",8164,4409]\n[\"002418\",8165,4410]\n[\"002423\",8166,4411]\n[\"000197\",8167,4412]\n[\"000172\",8168,4413]\n[\"002450\",8169,4414]\n[\"002450\",8170,4415]\n[\"002450\",8171,4416]\n[\"000366\",8172,4417]\n[\"000366\",8173,4418]\n[\"002363\",8174,4419]\n[\"002364\",8175,4420]\n[\"000196\",8176,4421]\n[\"000068\",8177,4422]\n[\"001453\",8178,4423]\n[\"001453\",8179,4424]\n[\"001967\",8180,4425]\n[\"002450\",8181,4426]\n[\"002450\",8182,4427]\n[\"000185\",8183,4428]\n[\"000803\",8184,4429]\n[\"000068\",8185,4430]\n[\"001414\",8228,4431]\n[\"000048\",8229,4432]\n[\"001414\",8231,4433]\n[\"001414\",8232,4434]\n[\"000048\",8233,4435]\n[\"000366\",8234,4436]\n[\"001812\",8235,4437]\n[\"000366\",8236,4438]\n[\"001812\",8237,4439]\n[\"000366\",8238,4440]\n[\"000366\",8239,4441]\n[\"000877\",8240,4442]\n[\"001199\",8241,4443]\n[\"002475\",8242,4443]\n[\"002476\",8243,4443]\n[\"002890\",8244,4444]\n[\"003123\",8245,4444]\n[\"000877\",8246,4445]\n[\"001233\",8247,4446]\n[\"001774\",8248,4447]\n[\"000877\",8249,4448]\n[\"000366\",8250,4449]\n[\"000366\",8251,4450]\n[\"000213\",8252,4451]\n[\"000366\",8253,4452]\n[\"001090\",8254,4453]\n[\"000795\",8255,4454]\n[\"002235\",8256,4455]\n[\"000366\",8257,4456]\n[\"000381\",8258,4457]\n[\"000366\",8259,4458]\n[\"002890\",8260,4459]\n[\"003123\",8261,4459]\n[\"000199\",8262,4460]\n[\"002165\",8263,4461]\n[\"002038\",8264,4462]\n[\"000381\",8265,4463]\n[\"000382\",8266,4464]\n[\"000381\",8267,4465]\n[\"000382\",8268,4466]\n[\"000382\",8269,4467]\n[\"000366\",8270,4468]\n[\"000366\",8271,4469]\n[\"000366\",8272,4470]\n[\"002238\",8273,4471]\n[\"000044\",8274,4472]\n[\"000044\",8275,4473]\n[\"002238\",8276,4473]\n[\"000200\",8277,4474]\n[\"000199\",8278,4475]\n[\"000198\",8279,4476]\n[\"000205\",8280,4477]\n[\"000192\",8281,4478]\n[\"000193\",8282,4478]\n[\"000194\",8283,4478]\n[\"001619\",8284,4478]\n[\"000196\",8285,4479]\n[\"000172\",8286,4480]\n[\"000172\",8287,4481]\n[\"000018\",8288,4482]\n[\"000172\",8289,4482]\n[\"001403\",8290,4482]\n[\"001404\",8291,4482]\n[\"001405\",8292,4482]\n[\"002130\",8293,4482]\n[\"002234\",8294,4482]\n[\"000018\",8295,4483]\n[\"000172\",8296,4483]\n[\"001403\",8297,4483]\n[\"001404\",8298,4483]\n[\"001405\",8299,4483]\n[\"002130\",8300,4483]\n[\"002234\",8301,4483]\n[\"000018\",8302,4484]\n[\"000172\",8303,4484]\n[\"001403\",8304,4484]\n[\"001404\",8305,4484]\n[\"001405\",8306,4484]\n[\"002130\",8307,4484]\n[\"002234\",8308,4484]\n[\"000172\",8309,4485]\n[\"000172\",8310,4486]\n[\"000172\",8311,4487]\n[\"000067\",8312,4488]\n[\"000172\",8313,4488]\n[\"000067\",8314,4489]\n[\"000172\",8315,4489]\n[\"000067\",8316,4490]\n[\"000172\",8317,4490]\n[\"000172\",8318,4491]\n[\"000172\",8319,4492]\n[\"000172\",8320,4493]\n[\"000172\",8321,4494]\n[\"000172\",8322,4495]\n[\"002234\",8323,4495]\n[\"000172\",8324,4496]\n[\"002234\",8325,4496]\n[\"000172\",8326,4497]\n[\"002234\",8327,4497]\n[\"000172\",8328,4498]\n[\"000172\",8329,4499]\n[\"000172\",8330,4500]\n[\"000172\",8331,4501]\n[\"002234\",8332,4501]\n[\"000172\",8333,4502]\n[\"002234\",8334,4502]\n[\"000172\",8335,4503]\n[\"002234\",8336,4503]\n[\"000172\",8337,4504]\n[\"002234\",8338,4504]\n[\"001849\",8339,4505]\n[\"001849\",8340,4506]\n[\"001849\",8341,4507]\n[\"000162\",8342,4508]\n[\"000163\",8343,4508]\n[\"000164\",8344,4508]\n[\"000162\",8345,4509]\n[\"000163\",8346,4509]\n[\"000164\",8347,4509]\n[\"000162\",8348,4510]\n[\"000163\",8349,4510]\n[\"000164\",8350,4510]\n[\"000381\",8351,4511]\n[\"000381\",8352,4512]\n[\"000366\",8353,4513]\n[\"000366\",8354,4514]\n[\"000366\",8355,4515]\n[\"002385\",8356,4516]\n[\"000366\",8357,4517]\n[\"000366\",8358,4518]\n[\"000185\",8359,4519]\n[\"002470\",8360,4519]\n[\"000366\",8361,4520]\n[\"000185\",8362,4521]\n[\"000366\",8363,4522]\n[\"000185\",8364,4523]\n[\"002470\",8365,4523]\n[\"000185\",8366,4524]\n[\"002470\",8367,4524]\n[\"000366\",8368,4525]\n[\"002235\",8369,4526]\n[\"000366\",8370,4527]\n[\"001084\",8371,4528]\n[\"000366\",8372,4529]\n[\"000764\",8373,4530]\n[\"000366\",8374,4531]\n[\"000366\",8375,4532]\n[\"000804\",8376,4533]\n[\"000381\",8377,4534]\n[\"000366\",8378,4535]\n[\"000366\",8379,4536]\n[\"000381\",8380,4537]\n[\"000381\",8381,4538]\n[\"000366\",8382,4539]\n[\"000366\",8383,4540]\n[\"000381\",8384,4541]\n[\"000381\",8385,4542]\n[\"000169\",8386,4543]\n[\"002418\",8387,4544]\n[\"002421\",8388,4544]\n[\"002418\",8389,4545]\n[\"002421\",8390,4545]\n[\"002038\",8391,4546]\n[\"002418\",8392,4547]\n[\"002421\",8393,4547]\n[\"002038\",8394,4548]\n[\"001090\",8395,4549]\n[\"000366\",8396,4550]\n[\"001967\",8397,4551]\n[\"000366\",8398,4552]\n[\"000366\",8399,4553]\n[\"000381\",8400,4554]\n[\"002418\",8401,4555]\n[\"002421\",8402,4555]\n[\"001764\",8403,4556]\n[\"000057\",8404,4557]\n[\"001764\",8405,4558]\n[\"001764\",8406,4559]\n[\"000048\",8407,4560]\n[\"000050\",8408,4560]\n[\"001384\",8409,4560]\n[\"001385\",8410,4560]\n[\"001386\",8411,4560]\n[\"001387\",8412,4560]\n[\"001388\",8413,4560]\n[\"000366\",8414,4561]\n[\"001084\",8415,4562]\n[\"000048\",8416,4563]\n[\"001384\",8417,4563]\n[\"001385\",8418,4563]\n[\"001386\",8419,4563]\n[\"001387\",8420,4563]\n[\"001388\",8421,4563]\n[\"000366\",8422,4564]\n[\"000381\",8423,4565]\n[\"000366\",8424,4566]\n[\"002824\",8425,4567]\n[\"002385\",8426,4568]\n[\"000366\",8427,4569]\n[\"000366\",8428,4570]\n[\"000366\",8429,4571]\n[\"000366\",8430,4572]\n[\"002418\",8431,4573]\n[\"002421\",8432,4573]\n[\"000366\",8433,4574]\n[\"000197\",8434,4575]\n[\"000366\",8435,4576]\n[\"000366\",8436,4577]\n[\"002418\",8437,4578]\n[\"002421\",8438,4578]\n[\"000366\",8439,4579]\n[\"002038\",8440,4580]\n[\"001090\",8441,4581]\n[\"002038\",8442,4582]\n[\"001453\",8443,4583]\n[\"000366\",8444,4584]\n[\"000068\",8445,4585]\n[\"002890\",8446,4585]\n[\"000366\",8447,4586]\n[\"000366\",8448,4587]\n[\"000381\",8449,4588]\n[\"001090\",8450,4589]\n[\"000381\",8451,4590]\n[\"000366\",8452,4591]\n[\"001090\",8453,4592]\n[\"000366\",8454,4593]\n[\"000366\",8455,4594]\n[\"000803\",8456,4595]\n[\"000196\",8457,4596]\n[\"000366\",8458,4597]\n[\"000366\",8459,4598]\n[\"000366\",8460,4599]\n[\"000366\",8461,4600]\n[\"002450\",8462,4601]\n[\"000366\",8463,4602]\n[\"002038\",8464,4603]\n[\"001084\",8465,4604]\n[\"002038\",8466,4605]\n[\"001084\",8467,4606]\n[\"001084\",8468,4607]\n[\"002038\",8469,4608]\n[\"001084\",8470,4609]\n[\"000381\",8471,4610]\n[\"000366\",8472,4611]\n[\"002235\",8473,4612]\n[\"000213\",8474,4613]\n[\"002235\",8475,4614]\n[\"000213\",8476,4615]\n[\"002235\",8477,4616]\n[\"002235\",8478,4617]\n[\"002235\",8479,4618]\n[\"002235\",8480,4619]\n[\"002235\",8481,4620]\n[\"002235\",8482,4621]\n[\"002235\",8483,4622]\n[\"002235\",8484,4623]\n[\"000213\",8485,4624]\n[\"000213\",8486,4625]\n[\"000213\",8487,4626]\n[\"000213\",8488,4627]\n[\"000213\",8489,4628]\n[\"002314\",8490,4628]\n[\"002235\",8491,4629]\n[\"002235\",8492,4630]\n[\"002235\",8493,4631]\n[\"002235\",8494,4632]\n[\"002235\",8495,4633]\n[\"000162\",8496,4634]\n[\"000163\",8497,4634]\n[\"000164\",8498,4634]\n[\"000171\",8499,4634]\n[\"001914\",8500,4634]\n[\"002235\",8501,4635]\n[\"002235\",8502,4636]\n[\"002235\",8503,4637]\n[\"002235\",8504,4638]\n[\"002235\",8505,4639]\n[\"000366\",8506,4640]\n[\"000135\",8507,4641]\n[\"000135\",8508,4642]\n[\"002824\",8509,4643]\n[\"002824\",8510,4644]\n[\"000381\",8511,4645]\n[\"000381\",8512,4646]\n[\"000172\",8513,4647]\n[\"000172\",8514,4648]\n[\"000381\",8515,4649]\n[\"000381\",8516,4650]\n[\"002235\",8517,4651]\n[\"000381\",8518,4652]\n[\"000381\",8519,4653]\n[\"000381\",8520,4654]\n[\"000381\",8521,4655]\n[\"000366\",8522,4656]\n[\"000172\",8523,4657]\n[\"000172\",8524,4658]\n[\"000803\",8525,4659]\n[\"000381\",8526,4660]\n[\"000366\",8527,4661]\n[\"000381\",8528,4662]\n[\"000172\",8529,4663]\n[\"000381\",8530,4664]\n[\"000381\",8531,4665]\n[\"000172\",8532,4666]\n[\"000366\",8533,4667]\n[\"000366\",8534,4668]\n[\"000366\",8535,4669]\n[\"000366\",8536,4670]\n[\"002824\",8537,4671]\n[\"000366\",8538,4672]\n[\"000366\",8539,4673]\n[\"000366\",8540,4674]\n[\"000366\",8541,4675]\n[\"000366\",8542,4676]\n[\"000366\",8543,4677]\n[\"000366\",8544,4678]\n[\"000366\",8545,4679]\n[\"000366\",8546,4680]\n[\"000366\",8547,4681]\n[\"000366\",8548,4682]\n[\"000366\",8549,4683]\n[\"000366\",8550,4684]\n[\"000366\",8551,4685]\n[\"000366\",8552,4686]\n[\"000366\",8553,4687]\n[\"000366\",8554,4688]\n[\"000366\",8555,4689]\n[\"000366\",8556,4690]\n[\"000366\",8557,4691]\n[\"000366\",8558,4692]\n[\"000366\",8559,4693]\n[\"000366\",8560,4694]\n[\"000366\",8561,4695]\n[\"000366\",8562,4696]\n[\"000366\",8563,4697]\n[\"000366\",8564,4698]\n[\"000366\",8565,4699]\n[\"000381\",8566,4700]\n[\"000366\",8567,4701]\n[\"000366\",8568,4702]\n[\"000366\",8569,4703]\n[\"000056\",8570,4704]\n[\"001199\",8571,4705]\n[\"002475\",8572,4705]\n[\"002476\",8573,4705]\n[\"001199\",8574,4706]\n[\"002475\",8575,4706]\n[\"002476\",8576,4706]\n[\"000130\",8577,4707]\n[\"000130\",8578,4708]\n[\"000130\",8579,4709]\n[\"000130\",8580,4710]\n[\"000130\",8581,4711]\n[\"000130\",8582,4712]\n[\"000130\",8583,4713]\n[\"000199\",8584,4714]\n[\"001090\",8585,4715]\n[\"000381\",8586,4716]\n[\"000381\",8587,4717]\n[\"000381\",8588,4718]\n[\"000381\",8589,4719]\n[\"001199\",8590,4720]\n[\"000366\",8591,4721]\n[\"000765\",8592,4722]\n[\"000766\",8593,4722]\n[\"000767\",8594,4722]\n[\"000768\",8595,4722]\n[\"001494\",8745,4723]\n[\"001496\",8746,4723]\n[\"002165\",8747,4723]\n[\"002235\",8748,4723]\n[\"000048\",8749,4724]\n[\"000048\",8750,4725]\n[\"000048\",8751,4726]\n[\"000056\",8752,4727]\n[\"001948\",8753,4728]\n[\"001953\",8754,4728]\n[\"001954\",8755,4728]\n[\"000057\",8756,4729]\n[\"000057\",8757,4730]\n[\"000057\",8758,4731]\n[\"000057\",8759,4732]\n[\"000057\",8760,4733]\n[\"000057\",8761,4734]\n[\"000057\",8762,4735]\n[\"000192\",8763,4736]\n[\"000192\",8764,4737]\n[\"000192\",8765,4738]\n[\"000193\",8766,4739]\n[\"000194\",8767,4740]\n[\"001619\",8768,4741]\n[\"000195\",8769,4742]\n[\"000195\",8770,4743]\n[\"000195\",8771,4744]\n[\"000195\",8772,4745]\n[\"000196\",8773,4746]\n[\"000196\",8774,4747]\n[\"000196\",8775,4748]\n[\"000198\",8776,4749]\n[\"000198\",8777,4750]\n[\"000199\",8778,4751]\n[\"000199\",8779,4752]\n[\"000200\",8780,4753]\n[\"000205\",8781,4754]\n[\"000366\",8782,4755]\n[\"000766\",8783,4756]\n[\"000795\",8784,4757]\n[\"000044\",8785,4758]\n[\"002236\",8786,4758]\n[\"002237\",8787,4758]\n[\"002238\",8788,4758]\n[\"002238\",8789,4759]\n[\"002038\",8790,4760]\n[\"002038\",8791,4761]\n[\"000366\",8792,4762]\n[\"000366\",8793,4763]\n[\"000366\",8794,4764]\n[\"000366\",8795,4765]\n[\"000366\",8796,4766]\n[\"000213\",8797,4767]\n[\"000213\",8798,4768]\n[\"000213\",8799,4769]\n[\"000213\",8800,4770]\n[\"000213\",8801,4771]\n[\"000766\",8802,4772]\n[\"000381\",8803,4773]\n[\"000381\",8804,4774]\n[\"002165\",8805,4775]\n[\"002235\",8806,4775]\n[\"001744\",8807,4776]\n[\"001744\",8808,4777]\n[\"001749\",8809,4778]\n[\"001749\",8810,4779]\n[\"000366\",8812,4780]\n[\"000778\",8811,4780]\n[\"001958\",8813,4780]\n[\"001958\",8814,4781]\n[\"000366\",8815,4782]\n[\"000778\",8816,4782]\n[\"001958\",8817,4782]\n[\"002617\",8818,4783]\n[\"002165\",8820,4784]\n[\"002696\",8819,4784]\n[\"002165\",8822,4785]\n[\"002696\",8821,4785]\n[\"000366\",8823,4786]\n[\"000366\",8824,4787]\n[\"000366\",8825,4788]\n[\"000366\",8826,4789]\n[\"000366\",8827,4790]\n[\"000366\",8828,4791]\n[\"000764\",8829,4792]\n[\"000366\",8830,4793]\n[\"002165\",8831,4794]\n[\"002165\",8832,4795]\n[\"000366\",8833,4796]\n[\"000366\",8834,4797]\n[\"000366\",8835,4798]\n[\"000366\",8836,4799]\n[\"000366\",8837,4800]\n[\"000366\",8838,4801]\n[\"000366\",8839,4802]\n[\"000366\",8840,4803]\n[\"000366\",8841,4804]\n[\"000366\",8842,4805]\n[\"000366\",8843,4806]\n[\"000366\",8844,4807]\n[\"000366\",8845,4808]\n[\"000366\",8846,4809]\n[\"000318\",8848,4810]\n[\"000368\",8847,4810]\n[\"001812\",8849,4810]\n[\"001813\",8850,4810]\n[\"001814\",8851,4810]\n[\"000366\",8852,4811]\n[\"000366\",8853,4812]\n[\"000366\",8854,4813]\n[\"000366\",8855,4814]\n[\"001764\",8856,4815]\n[\"001764\",8857,4816]\n[\"001764\",8858,4817]\n[\"000366\",8859,4818]\n[\"000318\",8861,4819]\n[\"000368\",8860,4819]\n[\"001812\",8864,4819]\n[\"001813\",8863,4819]\n[\"001814\",8862,4819]\n[\"000366\",8865,4820]\n[\"000366\",8866,4821]\n[\"000366\",8867,4822]\n[\"000366\",8868,4823]\n[\"000366\",8869,4824]\n[\"000366\",8870,4825]\n[\"000366\",8871,4826]\n[\"000366\",8872,4827]\n[\"000068\",8874,4828]\n[\"001199\",8873,4828]\n[\"002450\",8875,4828]\n[\"002476\",8876,4828]\n[\"000366\",8877,4829]\n[\"000366\",8878,4830]\n[\"000366\",8879,4831]\n[\"000318\",8881,4832]\n[\"000368\",8880,4832]\n[\"001812\",8884,4832]\n[\"001813\",8882,4832]\n[\"001814\",8883,4832]\n[\"000381\",8885,4833]\n[\"000126\",8887,4834]\n[\"000131\",8886,4834]\n[\"000139\",8888,4835]\n[\"001851\",8889,4836]\n[\"001851\",8890,4837]\n[\"001851\",8891,4838]\n[\"001851\",8892,4839]\n[\"001851\",8893,4840]\n[\"001851\",8894,4841]\n[\"001851\",8895,4842]\n[\"001851\",8896,4843]\n[\"001855\",8897,4844]\n[\"001855\",8898,4845]\n[\"001855\",8899,4846]\n[\"002234\",8900,4847]\n[\"000126\",8902,4848]\n[\"000172\",8901,4848]\n[\"000126\",8903,4849]\n[\"000172\",8904,4849]\n[\"000126\",8906,4850]\n[\"000172\",8905,4850]\n[\"000126\",8907,4851]\n[\"000172\",8908,4851]\n[\"000172\",8909,4852]\n[\"000172\",8910,4853]\n[\"000172\",8911,4854]\n[\"000172\",8912,4855]\n[\"000172\",8913,4856]\n[\"000172\",8914,4857]\n[\"000172\",8915,4858]\n[\"000172\",8916,4859]\n[\"000172\",8917,4860]\n[\"000172\",8918,4861]\n[\"002884\",8919,4861]\n[\"000172\",8920,4862]\n[\"002884\",8921,4862]\n[\"000172\",8922,4863]\n[\"002884\",8923,4863]\n[\"000172\",8924,4864]\n[\"002884\",8925,4864]\n[\"000172\",8926,4865]\n[\"002884\",8927,4865]\n[\"000172\",8928,4866]\n[\"002884\",8929,4866]\n[\"000172\",8930,4867]\n[\"002884\",8931,4867]\n[\"000172\",8932,4868]\n[\"002884\",8933,4868]\n[\"000172\",8934,4869]\n[\"002884\",8935,4869]\n[\"000172\",8936,4870]\n[\"002884\",8937,4870]\n[\"000126\",8938,4871]\n[\"000172\",8939,4871]\n[\"002884\",8940,4871]\n[\"000126\",8941,4872]\n[\"000172\",8942,4872]\n[\"002884\",8943,4872]\n[\"000135\",8945,4873]\n[\"000172\",8944,4873]\n[\"002884\",8946,4873]\n[\"000135\",8947,4874]\n[\"000172\",8948,4874]\n[\"002884\",8949,4874]\n[\"000135\",8950,4875]\n[\"000172\",8951,4875]\n[\"002884\",8952,4875]\n[\"000135\",8954,4876]\n[\"000172\",8953,4876]\n[\"002884\",8955,4876]\n[\"000135\",8956,4877]\n[\"000172\",8957,4877]\n[\"002884\",8958,4877]\n[\"000130\",8961,4878]\n[\"000135\",8960,4878]\n[\"000172\",8959,4878]\n[\"002884\",8962,4878]\n[\"000130\",8963,4879]\n[\"000135\",8964,4879]\n[\"000172\",8965,4879]\n[\"002884\",8966,4879]\n[\"000130\",8969,4880]\n[\"000135\",8968,4880]\n[\"000172\",8967,4880]\n[\"002884\",8970,4880]\n[\"000130\",8971,4881]\n[\"000135\",8972,4881]\n[\"000172\",8973,4881]\n[\"002884\",8974,4881]\n[\"000130\",8976,4882]\n[\"000135\",8977,4882]\n[\"000172\",8975,4882]\n[\"002884\",8978,4882]\n[\"000135\",8979,4883]\n[\"002884\",8980,4883]\n[\"000135\",8981,4884]\n[\"002884\",8982,4884]\n[\"000135\",8983,4885]\n[\"002884\",8984,4885]\n[\"000135\",8985,4886]\n[\"002884\",8986,4886]\n[\"000135\",8987,4887]\n[\"000172\",8988,4887]\n[\"002884\",8989,4887]\n[\"000135\",8991,4888]\n[\"000172\",8990,4888]\n[\"002884\",8992,4888]\n[\"000172\",8993,4889]\n[\"000172\",8994,4890]\n[\"000172\",8995,4891]\n[\"000172\",8996,4892]\n[\"000172\",8997,4893]\n[\"000172\",8998,4894]\n[\"000018\",9000,4895]\n[\"000172\",8999,4895]\n[\"001403\",9002,4895]\n[\"002130\",9001,4895]\n[\"000018\",9003,4896]\n[\"000172\",9004,4896]\n[\"001403\",9005,4896]\n[\"002130\",9006,4896]\n[\"000018\",9008,4897]\n[\"000172\",9007,4897]\n[\"001403\",9010,4897]\n[\"002130\",9009,4897]\n[\"000018\",9011,4898]\n[\"000172\",9012,4898]\n[\"001403\",9013,4898]\n[\"002130\",9014,4898]\n[\"000018\",9015,4899]\n[\"000172\",9016,4899]\n[\"001403\",9018,4899]\n[\"002130\",9017,4899]\n[\"000172\",9019,4900]\n[\"002884\",9020,4900]\n[\"000172\",9021,4901]\n[\"002884\",9022,4901]\n[\"000172\",9023,4902]\n[\"002884\",9024,4902]\n[\"000172\",9025,4903]\n[\"002884\",9026,4903]\n[\"000172\",9027,4904]\n[\"002884\",9028,4904]\n[\"000366\",9029,4905]\n[\"000318\",9030,4906]\n[\"000368\",9031,4906]\n[\"001812\",9033,4906]\n[\"001813\",9034,4906]\n[\"001814\",9032,4906]\n[\"000054\",9035,4907]\n[\"000382\",9036,4908]\n[\"002314\",9037,4908]\n[\"000068\",9040,4909]\n[\"000366\",9038,4909]\n[\"000803\",9039,4909]\n[\"001133\",9041,4910]\n[\"002361\",9042,4910]\n[\"000048\",9048,4911]\n[\"000050\",9049,4911]\n[\"001384\",9043,4911]\n[\"001385\",9044,4911]\n[\"001386\",9045,4911]\n[\"001387\",9046,4911]\n[\"001388\",9047,4911]\n[\"001453\",9050,4912]\n[\"001453\",9051,4913]\n[\"001453\",9052,4914]\n[\"000366\",9053,4915]\n[\"002418\",9054,4916]\n[\"002420\",9055,4916]\n[\"002421\",9056,4916]\n[\"002422\",9057,4916]\n[\"002418\",9060,4917]\n[\"002420\",9061,4917]\n[\"002421\",9058,4917]\n[\"002422\",9059,4917]\n[\"001133\",9062,4918]\n[\"002361\",9063,4918]\n[\"000366\",9064,4919]\n[\"001133\",9065,4920]\n[\"002361\",9066,4920]\n[\"000366\",9067,4921]\n[\"000366\",9068,4922]\n[\"000366\",9069,4923]\n[\"000366\",9070,4924]\n[\"000197\",9071,4925]\n[\"000366\",9072,4925]\n[\"001453\",9073,4926]\n[\"000366\",9074,4927]\n[\"000366\",9075,4928]\n[\"000318\",9076,4929]\n[\"000368\",9077,4929]\n[\"001812\",9078,4929]\n[\"001813\",9080,4929]\n[\"001814\",9079,4929]\n[\"000318\",9082,4930]\n[\"000368\",9081,4930]\n[\"001812\",9085,4930]\n[\"001813\",9084,4930]\n[\"001814\",9083,4930]\n[\"000366\",9086,4931]\n[\"000366\",9087,4932]\n[\"000366\",9088,4933]\n[\"001891\",9090,4934]\n[\"002046\",9089,4934]\n[\"000366\",9091,4935]\n[\"000366\",9092,4936]\n[\"000366\",9093,4937]\n[\"000366\",9094,4938]\n[\"000366\",9095,4939]\n[\"000366\",9096,4940]\n[\"000366\",9097,4941]\n[\"000366\",9098,4942]\n[\"000366\",9099,4943]\n[\"000366\",9100,4944]\n[\"000366\",9101,4945]\n[\"000366\",9102,4946]\n[\"000366\",9103,4947]\n[\"000366\",9104,4948]\n[\"000366\",9105,4949]\n[\"000366\",9106,4950]\n[\"000366\",9107,4951]\n[\"000318\",9108,4952]\n[\"000368\",9109,4952]\n[\"001812\",9111,4952]\n[\"001813\",9110,4952]\n[\"001814\",9112,4952]\n[\"000366\",9113,4953]\n[\"000366\",9114,4954]\n[\"000366\",9115,4955]\n[\"000366\",9116,4956]\n[\"000366\",9117,4957]\n[\"000366\",9118,4958]\n[\"000366\",9119,4959]\n[\"000366\",9120,4960]\n[\"000366\",9121,4961]\n[\"001948\",9123,4962]\n[\"001953\",9124,4962]\n[\"001954\",9122,4962]\n[\"001948\",9126,4963]\n[\"001953\",9125,4963]\n[\"001954\",9127,4963]\n[\"001948\",9129,4964]\n[\"001953\",9130,4964]\n[\"001954\",9128,4964]\n[\"001443\",9131,4965]\n[\"001444\",9132,4965]\n[\"002418\",9133,4965]\n[\"000057\",9134,4969]\n[\"001414\",9256,4970]\n[\"000048\",9257,4971]\n[\"001414\",9259,4972]\n[\"000048\",9260,4973]\n[\"000050\",9261,4974]\n[\"001384\",9262,4975]\n[\"001385\",9263,4975]\n[\"001386\",9264,4975]\n[\"001387\",9265,4975]\n[\"001388\",9266,4975]\n[\"000053\",9267,4976]\n[\"000054\",9268,4977]\n[\"000068\",9269,4978]\n[\"001453\",9270,4979]\n[\"001453\",9271,4980]\n[\"000068\",9272,4981]\n[\"000130\",9273,4982]\n[\"000131\",9274,4983]\n[\"001487\",9275,4984]\n[\"000132\",9276,4985]\n[\"000133\",9277,4986]\n[\"000134\",9278,4987]\n[\"000162\",9279,4988]\n[\"000163\",9280,4989]\n[\"000164\",9281,4990]\n[\"000382\",9282,4991]\n[\"000382\",9283,4992]\n[\"000382\",9284,4993]\n[\"000382\",9285,4994]\n[\"000764\",9286,4995]\n[\"000766\",9287,4996]\n[\"001939\",9288,4997]\n[\"001942\",9289,4998]\n[\"001942\",9290,4999]\n[\"000778\",9291,5000]\n[\"000185\",9292,5001]\n[\"000186\",9293,5002]\n[\"000187\",9294,5003]\n[\"000187\",9295,5004]\n[\"000803\",9296,5005]\n[\"000804\",9297,5006]\n[\"001097\",9298,5007]\n[\"001133\",9299,5008]\n[\"001184\",9300,5009]\n[\"001184\",9301,5010]\n[\"001185\",9302,5011]\n[\"001664\",9303,5012]\n[\"001188\",9304,5013]\n[\"001190\",9305,5014]\n[\"002314\",9306,5015]\n[\"002322\",9307,5016]\n[\"000068\",9308,5017]\n[\"002353\",9309,5018]\n[\"002250\",9310,5019]\n[\"001844\",9311,5020]\n[\"001851\",9312,5021]\n[\"001858\",9313,5022]\n[\"001861\",9314,5023]\n[\"002038\",9315,5024]\n[\"002038\",9316,5025]\n[\"001953\",9317,5026]\n[\"001954\",9318,5027]\n[\"001958\",9319,5028]\n[\"002450\",9320,5029]\n[\"002397\",9321,5030]\n[\"002418\",9322,5031]\n[\"002418\",9323,5032]\n[\"002423\",9324,5033]\n[\"000197\",9325,5034]\n[\"000172\",9326,5035]\n[\"002450\",9327,5036]\n[\"002450\",9328,5037]\n[\"002450\",9329,5038]\n[\"000366\",9330,5039]\n[\"000366\",9331,5040]\n[\"002363\",9332,5041]\n[\"002364\",9333,5042]\n[\"000196\",9334,5043]\n[\"000068\",9335,5044]\n[\"001453\",9336,5045]\n[\"001453\",9337,5046]\n[\"001967\",9338,5047]\n[\"002450\",9339,5048]\n[\"002450\",9340,5049]\n[\"000185\",9341,5050]\n[\"000803\",9342,5051]\n[\"000068\",9343,5052]\n[\"001414\",9386,5053]\n[\"000048\",9387,5054]\n[\"001414\",9389,5055]\n[\"001414\",9390,5056]\n[\"000048\",9391,5057]\n[\"001414\",9392,5058]\n[\"000048\",9393,5059]\n[\"000050\",9394,5060]\n[\"001384\",9395,5061]\n[\"001385\",9396,5061]\n[\"001386\",9397,5061]\n[\"001387\",9398,5061]\n[\"001388\",9399,5061]\n[\"000053\",9400,5062]\n[\"000054\",9401,5063]\n[\"000068\",9402,5064]\n[\"001453\",9403,5065]\n[\"001453\",9404,5066]\n[\"000068\",9405,5067]\n[\"000130\",9406,5068]\n[\"000131\",9407,5069]\n[\"001487\",9408,5070]\n[\"000132\",9409,5071]\n[\"000133\",9410,5072]\n[\"000134\",9411,5073]\n[\"000162\",9412,5074]\n[\"000163\",9413,5075]\n[\"000164\",9414,5076]\n[\"000382\",9415,5077]\n[\"000382\",9416,5078]\n[\"000382\",9417,5079]\n[\"000382\",9418,5080]\n[\"000764\",9419,5081]\n[\"000766\",9420,5082]\n[\"001939\",9421,5083]\n[\"001942\",9422,5084]\n[\"001942\",9423,5085]\n[\"000778\",9424,5086]\n[\"000185\",9425,5087]\n[\"000186\",9426,5088]\n[\"000187\",9427,5089]\n[\"000187\",9428,5090]\n[\"000803\",9429,5091]\n[\"000804\",9430,5092]\n[\"001097\",9431,5093]\n[\"001133\",9432,5094]\n[\"001184\",9433,5095]\n[\"001184\",9434,5096]\n[\"001185\",9435,5097]\n[\"001664\",9436,5098]\n[\"001188\",9437,5099]\n[\"001190\",9438,5100]\n[\"002314\",9439,5101]\n[\"002322\",9440,5102]\n[\"000068\",9441,5103]\n[\"002353\",9442,5104]\n[\"002250\",9443,5105]\n[\"001844\",9444,5106]\n[\"001851\",9445,5107]\n[\"001858\",9446,5108]\n[\"001861\",9447,5109]\n[\"002038\",9448,5110]\n[\"002038\",9449,5111]\n[\"001953\",9450,5112]\n[\"001954\",9451,5113]\n[\"001958\",9452,5114]\n[\"002450\",9453,5115]\n[\"002397\",9454,5116]\n[\"002418\",9455,5117]\n[\"002418\",9456,5118]\n[\"002423\",9457,5119]\n[\"000197\",9458,5120]\n[\"000172\",9459,5121]\n[\"002450\",9460,5122]\n[\"002450\",9461,5123]\n[\"002450\",9462,5124]\n[\"000366\",9463,5125]\n[\"000366\",9464,5126]\n[\"002363\",9465,5127]\n[\"002364\",9466,5128]\n[\"000196\",9467,5129]\n[\"000068\",9468,5130]\n[\"001453\",9469,5131]\n[\"001453\",9470,5132]\n[\"001967\",9471,5133]\n[\"002450\",9472,5134]\n[\"002450\",9473,5135]\n[\"000185\",9474,5136]\n[\"000803\",9475,5137]\n[\"000068\",9476,5138]\n{\"table\":\"rev_group_rule_map\",\"columns\":\"`checkDigest`,`checkSystem`,`documentable`,`falseNegatives`,`falsePositives`,`fixDigest`,`fixref`,`groupId`,`groupSeverity`,`groupTitle`,`iaControls`,`mitigationControl`,`mitigations`,`potentialImpacts`,`responsibility`,`revId`,`rgrId`,`ruleId`,`severity`,`severityOverrideGuidance`,`thirdPartyTools`,`title`,`version`,`vulnDiscussion`,`weight`\",\"rowCount\":701}\n[{\"type\":\"Buffer\",\"data\":\"base64:vchgPhpapNXqH1070giShdvTrztio49eNJBWV74F3HU=\"},\"C-64053r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:w9I2ThmrWkLjEEgN5LZe5U8Sfp5fyYhIItBlZdSaJLE=\"},\"F-69237r2_fix\",\"V-63319\",\"medium\",\"WN10-00-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4436,\"SV-77809r3_rule\",\"medium\",null,null,\"Domain-joined systems must use Windows 10 Enterprise Edition 64-bit version.\",\"WN10-00-000005\",\"Features such as Credential Guard use virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Virtualization based security and Credential Guard are only available with Windows 10 Enterprise 64-bit version.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kaQFP+qv+/U0A5jz+BdWIpTTdtyktf1MP4WKqmlH3c4=\"},\"C-64055r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kepSgRivzMqHnK/2OMM0E1Wcu7H9wPx3R/EaQdHuCGA=\"},\"F-69239r1_fix\",\"V-63321\",\"medium\",\"WN10-CC-000310\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4437,\"SV-77811r1_rule\",\"medium\",null,null,\"Users must be prevented from changing installation options.\",\"WN10-CC-000310\",\"Installation options for applications are typically controlled by administrators.  This setting prevents users from changing installation options that may bypass security features.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LSSb1gLDf7uiXzn44Bg4EplFPsBwaprDmRrselWEvyE=\"},\"C-94059r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C69LdFRRLIKAEvN52sOWyR1XOoNaliZ20V7Ahi2TgE4=\"},\"F-71517r1_fix\",\"V-63323\",\"medium\",\"WN10-00-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4438,\"SV-77813r6_rule\",\"medium\",null,null,\"Windows 10 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.\",\"WN10-00-000010\",\"Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zv0vssTime65YEhFGjHDqU96ACMkZRxJDowM/Qv+sCo=\"},\"C-64059r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:WYWzs/LVbBJCV5p6sevrFQeIj+kgYqP53QgZoLCvajY=\"},\"F-69243r1_fix\",\"V-63325\",\"high\",\"WN10-CC-000315\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4439,\"SV-77815r1_rule\",\"high\",null,null,\"The Windows Installer Always install with elevated privileges must be disabled.\",\"WN10-CC-000315\",\"Standard user accounts must not be granted elevated privileges.  Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pBxUW2Mg4ubB2d75emmojt2R7TlPrd+/K+K4/cfdRCw=\"},\"C-64061r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sUyefRSp12AcSvLBKGiUxVCfWftGYjo3Xl9Pa+qQv5U=\"},\"F-69245r1_fix\",\"V-63329\",\"medium\",\"WN10-CC-000320\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4440,\"SV-77819r1_rule\",\"medium\",null,null,\"Users must be notified if a web-based program attempts to install software.\",\"WN10-CC-000320\",\"Web-based programs may attempt to install malicious software on a system.  Ensuring users are notified if a web-based program attempts to install software allows them to refuse the installation.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zkVu4Ox1MUjKEwFzsfX/ILQ/ZYHNPsu/JvNQeqZ228Y=\"},\"C-64067r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6kR9cAoufh12SxDcuUMPIlGdSV7Xnh2IK/uFUgsv5vk=\"},\"F-69251r1_fix\",\"V-63333\",\"medium\",\"WN10-CC-000325\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4441,\"SV-77823r1_rule\",\"medium\",null,null,\"Automatically signing in the last interactive user after a system-initiated restart must be disabled.\",\"WN10-CC-000325\",\"Windows can be configured to automatically sign the user back in after a Windows Update restart.  Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fdOFEUfWZvFxvtQyeYZ2AqTmF5GEfPF1uWfwWrblF5o=\"},\"C-64071r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FAsYZP3B2AC9MJAS9X+8yJy62Xj08bP/bThl9CR1e2E=\"},\"F-69255r1_fix\",\"V-63335\",\"high\",\"WN10-CC-000330\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4442,\"SV-77825r1_rule\",\"high\",null,null,\"The Windows Remote Management (WinRM) client must not use Basic authentication.\",\"WN10-CC-000330\",\"Basic authentication uses plain text passwords that could be used to compromise a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WJmapvaFU3fBFpTg+ufcMx2LC53rImDSpxqCEpTRTeE=\"},\"C-94061r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1qz4vDTsDlQKNl7HjZBswvv/xw5Z6+IAI5Vjmop+PuE=\"},\"F-100987r3_fix\",\"V-63337\",\"medium\",\"WN10-00-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4443,\"SV-77827r5_rule\",\"medium\",null,null,\"Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.\",\"WN10-00-000030\",\"If data at rest is unencrypted, it is vulnerable to disclosure.  Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls.   Encrypting the data ensures that confidentiality is protected even when the operating system is not running.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b3jhzOOdG7cVXgpSQQKPwd6xwSdfSPk98Epls0Yl+iY=\"},\"C-64075r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9wQwtSKZvc96iE+h8e50nFFTu3ZivGD9/+QhuwRZZOQ=\"},\"F-69259r1_fix\",\"V-63339\",\"medium\",\"WN10-CC-000335\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4444,\"SV-77829r1_rule\",\"medium\",null,null,\"The Windows Remote Management (WinRM) client must not allow unencrypted traffic.\",\"WN10-CC-000335\",\"Unencrypted remote access to a system can allow sensitive information to be compromised.  Windows remote management connections must be encrypted to prevent this.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nkjCE6RM8DNItyD6rVqHkapLyfMeCxO61yv23MB6TIM=\"},\"C-64079r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SSUaZxp2e3lrtlRvHn/MbHLzmo8TT8Gt7ESsNHEpoN4=\"},\"F-69263r1_fix\",\"V-63341\",\"medium\",\"WN10-CC-000360\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4445,\"SV-77831r2_rule\",\"medium\",null,null,\"The Windows Remote Management (WinRM) client must not use Digest authentication.\",\"WN10-CC-000360\",\"Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HCOGZgkq+yjHfU54mGFmUULh8th2DmZrWdDxdOWGa1I=\"},\"C-93975r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SCb7yomQ0gnALvtdYQ0Wfiqr79Wy9XDD7zCwrSrCFVo=\"},\"F-100903r1_fix\",\"V-63343\",\"medium\",\"WN10-00-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4446,\"SV-77833r2_rule\",\"medium\",null,null,\"Windows 10 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).\",\"WN10-00-000025\",\"An approved tool for continuous network scanning must be installed and configured to run.\\n\\nWithout the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws.\\n\\nTo support this requirement, the operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools, as specified in the requirement.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qqusfdR/p7eKP2jELMMeLdSrRy4vsHPTO1wfCg44MTA=\"},\"C-69225r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:GlCAt+DFqUcIiFpLGGP/s22dZRqXxVkiX9prKdNXawc=\"},\"F-69267r3_fix\",\"V-63345\",\"medium\",\"WN10-00-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4447,\"SV-77835r3_rule\",\"medium\",null,null,\"The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.\",\"WN10-00-000035\",\"Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities.\\n\\nThe organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yd5HlJZjtzvpiWMc+q7EtjdFutkSfgvcIU2keNcxYzA=\"},\"C-64081r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Q0+/kPQ+TMoFU6R/R3baauhZk8VsT5OP1El8uRmgkNI=\"},\"F-69265r1_fix\",\"V-63347\",\"high\",\"WN10-CC-000345\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4448,\"SV-77837r1_rule\",\"high\",null,null,\"The Windows Remote Management (WinRM) service must not use Basic authentication.\",\"WN10-CC-000345\",\"Basic authentication uses plain text passwords that could be used to compromise a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:or6yezNX5dbJzbcRUwG9A6vn2Nwe1/eA0vaJqpY6LqY=\"},\"C-94063r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ehIkgFNdMcE1az7ZnoCD3OKmAwmBi0GzVNa1FmkTgLA=\"},\"F-98031r3_fix\",\"V-63349\",\"high\",\"WN10-00-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4449,\"SV-77839r11_rule\",\"high\",null,null,\"Windows 10 systems must be maintained at a supported servicing level.\",\"WN10-00-000040\",\"Windows 10 is maintained by Microsoft at servicing levels for specific periods of time to support Windows as a Service. Systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities which leaves them subject to exploitation.\\n\\nNew versions with feature updates are planned to be released on a semi-annual basis with an estimated support timeframe of 18 to 30 months depending on the release. Support for previously released versions has been extended for Enterprise editions.\\n\\nA separate servicing branch intended for special purpose systems is the Long-Term Servicing Channel (LTSC, formerly Branch - LTSB) which will receive security updates for 10 years but excludes feature updates.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9LhzdHuv/khleaS+BQu9ZlUcdjdohBUoq5bjuJZdhK8=\"},\"C-76169r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gXX1vxZNLMEKJ906VeqO6VwfiDp3BnRhlIF8SZ5PQRA=\"},\"F-83183r1_fix\",\"V-63351\",\"high\",\"WN10-00-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4450,\"SV-77841r4_rule\",\"high\",null,null,\"The Windows 10 system must use an anti-virus program.\",\"WN10-00-000045\",\"Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jyG27jY3W9Aj4bDrKfA/dk1GvzTU+D+IeEpDzIASblA=\"},\"C-73999r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SyAsNp8smmdI+Hij4hPNLGBhi2NmilH/PyQdzV2pUIU=\"},\"F-69273r1_fix\",\"V-63353\",\"high\",\"WN10-00-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4451,\"SV-77843r2_rule\",\"high\",null,null,\"Local volumes must be formatted using NTFS.\",\"WN10-00-000050\",\"The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system.  To support this, volumes must be formatted using the NTFS file system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gGc0LjWq95X1V62ZlIHcMLmkQPw2oUyILFgDEIeCFgc=\"},\"C-64093r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Lt3NME40vnlwPhHHTosrR9dZcR8XhMnFcLHuB2Lq3Lc=\"},\"F-69275r1_fix\",\"V-63355\",\"medium\",\"WN10-00-000055\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4452,\"SV-77845r1_rule\",\"medium\",null,null,\"Alternate operating systems must not be permitted on the same system.\",\"WN10-00-000055\",\"Allowing other operating systems to run on a secure system may allow security to be circumvented.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dOGGLjicLHA/RGjJYYBp+48oN0T8aKpZdwp8uPV5/Ic=\"},\"C-64095r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:isAxddtT+0Fm0OAsblf9Ghf+iS4NGqA3jzgSbGNsF5U=\"},\"F-69277r1_fix\",\"V-63357\",\"medium\",\"WN10-00-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4453,\"SV-77847r1_rule\",\"medium\",null,null,\"Non system-created file shares on a system must limit access to groups that require it.\",\"WN10-00-000060\",\"Shares which provide network access, should not typically exist on a workstation except for system-created administrative shares, and could potentially expose sensitive information.  If a share is necessary, share permissions, as well as NTFS permissions, must be reconfigured to give the minimum access to those accounts that require it.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:O7e8OfTlyzjmCELOYfMlW3c1bFSd2cM7R7YSkTfN3OA=\"},\"C-64097r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:t5Ggv9sKI7GKzesnJIeO3bOI2A5P40Pr9pN0Hn1Dpa8=\"},\"F-69279r1_fix\",\"V-63359\",\"low\",\"WN10-00-000065\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4454,\"SV-77849r1_rule\",\"low\",null,null,\"Unused accounts must be disabled or removed from the system after 35 days of inactivity.\",\"WN10-00-000065\",\"Outdated or unused accounts provide penetration points that may go undetected.  Inactive accounts must be deleted if no longer necessary or, if still required, disable until needed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8UtBp2DVYD1LJb6gnT+x7kAd1QHqhk+0hwQmESyWDy8=\"},\"C-81365r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Rq0Drnciefrchb4v+sf+grCmTAk/HDHLAtw9M5xF5jY=\"},\"F-88437r1_fix\",\"V-63361\",\"high\",\"WN10-00-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4455,\"SV-77851r2_rule\",\"high\",null,null,\"Only accounts responsible for the administration of a system must have Administrator rights on the system.\",\"WN10-00-000070\",\"An account that does not have Administrator duties must not have Administrator rights.  Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack.\\n\\nSystem administrators must log on to systems only using accounts with the minimum level of authority necessary.\\n\\nFor domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group (see V-36434 in the Active Directory Domain STIG).  Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks.\\n\\nStandard user accounts must not be members of the local administrators group.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OHRlA26i4Hoz3B5fPGaNDpMcdjxDEW48a+7+FxI491c=\"},\"C-64101r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SBfE7TkDd2NcS786G5LlI557gc60VE7A4bfB4w2U9VU=\"},\"F-69283r1_fix\",\"V-63363\",\"medium\",\"WN10-00-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4456,\"SV-77853r1_rule\",\"medium\",null,null,\"Only accounts responsible for the backup operations must be members of the Backup Operators group.\",\"WN10-00-000075\",\"Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it.  Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes.  Members of the Backup Operators group must have separate logon accounts for performing backup duties.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KQ8lRy8FDBQ4580tUO1vy4jkMlou6sCG5kmgRB26zTA=\"},\"C-94005r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PkuQ7BkZk2mwCeDlNGawCqd9XTXG/RQJCtw9/XPYoIk=\"},\"F-100933r1_fix\",\"V-63365\",\"medium\",\"WN10-00-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4457,\"SV-77855r3_rule\",\"medium\",null,null,\"Only authorized user accounts must be allowed to create or run virtual machines on Windows 10 systems.\",\"WN10-00-000080\",\"Allowing other operating systems to run on a secure system may allow users to circumvent security. For Hyper-V, preventing unauthorized users from being assigned to the Hyper-V Administrators group will prevent them from accessing or creating virtual machines on the system. The Hyper-V Hypervisor is used by Virtualization Based Security features such as Credential Guard on Windows 10; however, it is not the full Hyper-V installation.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bUQ3g8z8lvNafFtEoebv7L8OC/vCz5bDJEA+19YUMfY=\"},\"C-80207r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oPJakZz+TKXqsUByLyv8N2iXv/UZvp2SaRktzs5napc=\"},\"F-69287r1_fix\",\"V-63367\",\"low\",\"WN10-00-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4458,\"SV-77857r2_rule\",\"low\",null,null,\"Standard local user accounts must not exist on a system in a domain.\",\"WN10-00-000085\",\"To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain.  Users must log onto workstations in a domain with their domain accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:EIBNySof2OFl+QthlhxU04xnAsa1Q0mr/BmTT/yWVGw=\"},\"C-64109r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HzewPVEXvJy/3vqK0uHB7ZYVifjTyHImWH6bHFnZXaY=\"},\"F-69289r1_fix\",\"V-63369\",\"medium\",\"WN10-CC-000350\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4459,\"SV-77859r1_rule\",\"medium\",null,null,\"The Windows Remote Management (WinRM) service must not allow unencrypted traffic.\",\"WN10-CC-000350\",\"Unencrypted remote access to a system can allow sensitive information to be compromised.  Windows remote management connections must be encrypted to prevent this.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MaaeK83VUHrwbWkTbzyV8UO0uqMO9TDhxJaX5AYk0dg=\"},\"C-64111r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:z4g9j8oDjZ68rUOX8fTSATLvKjQdLa09fHE0FoV8Z4c=\"},\"F-69291r1_fix\",\"V-63371\",\"medium\",\"WN10-00-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4460,\"SV-77861r1_rule\",\"medium\",null,null,\"Accounts must be configured to require password expiration.\",\"WN10-00-000090\",\"Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nU7vAsnPVGyMIHLfdjvPC2Bq5ULx/4Moe5DQgjWZP+E=\"},\"C-77003r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aBhkLk4yDDuxvJapoccThWMsCEzDpFPSHDP96o7GBfw=\"},\"F-69295r1_fix\",\"V-63373\",\"medium\",\"WN10-00-000095\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4461,\"SV-77863r2_rule\",\"medium\",null,null,\"Permissions for system files and directories must conform to minimum requirements.\",\"WN10-00-000095\",\"Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rF9EqXhMnWgSBUWWkmTth67EEUxryI/ybsO2eNuHvzU=\"},\"C-64113r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ne7bvvVkhxxwqQKzB0FZOhG5Dme7RArzYI/oxTFDmyU=\"},\"F-69293r1_fix\",\"V-63375\",\"medium\",\"WN10-CC-000355\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4462,\"SV-77865r1_rule\",\"medium\",null,null,\"The Windows Remote Management (WinRM) service must not store RunAs credentials.\",\"WN10-CC-000355\",\"Storage of administrative credentials could allow unauthorized access.  Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PQtPLZt9kjWgPV2hRYy2GI3OB/Iw5D032IDo7oY5zKw=\"},\"C-64117r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:7DClVm96u/PlUj0xa9B6Fpm/yZc6tH4hip//MHDgktY=\"},\"F-69297r1_fix\",\"V-63377\",\"high\",\"WN10-00-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4463,\"SV-77867r1_rule\",\"high\",null,null,\"Internet Information System (IIS) or its subcomponents must not be installed on a workstation.\",\"WN10-00-000100\",\"Installation of Internet Information System (IIS) may allow unauthorized internet services to be hosted.  Websites must only be hosted on servers that have been designed for that purpose and can be adequately secured.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TRPtutJnGn43Yj6o6o250dQEb4BOKYZixgC8OVRcNIo=\"},\"C-64121r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KcSVrisllTzlLbwwjD3aQjBbkfHtbxafvagxpaTuXSw=\"},\"F-69301r1_fix\",\"V-63381\",\"medium\",\"WN10-00-000105\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4464,\"SV-77871r1_rule\",\"medium\",null,null,\"Simple Network Management Protocol (SNMP) must not be installed on the system.\",\"WN10-00-000105\",\"Some protocols and services do not support required security features, such as encrypting passwords or traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YwindgjytVWnrAw7yMnV/6hfzMIONOOroZJQi53YVkg=\"},\"C-64125r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:UqUD9iUd/SyuIamYPkPhF5kf20WKpuY45B7aNfPWC2U=\"},\"F-69305r1_fix\",\"V-63383\",\"medium\",\"WN10-00-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4465,\"SV-77873r1_rule\",\"medium\",null,null,\"Simple TCP/IP Services must not be installed on the system.\",\"WN10-00-000110\",\"Some protocols and services do not support required security features, such as encrypting passwords or traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7Tr9YNXYybZpCvPg9E2lPUrKLG7+7N1se4RCmhXyPzE=\"},\"C-64127r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MBXoPmdfwx5WkAgXM2CWQZpFkT+DsNuewTcElUoIp7I=\"},\"F-69307r1_fix\",\"V-63385\",\"medium\",\"WN10-00-000115\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4466,\"SV-77875r1_rule\",\"medium\",null,null,\"The Telnet Client must not be installed on the system.\",\"WN10-00-000115\",\"Some protocols and services do not support required security features, such as encrypting passwords or traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IYTubfVbsZBz/2eFUf+4u7kuvTO77HcoVONuJRZJyzw=\"},\"C-64133r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:IEsbmFKizofkSQo4ofAFKrgclkCswtyCio8fk2M+Ja8=\"},\"F-69313r1_fix\",\"V-63389\",\"medium\",\"WN10-00-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4467,\"SV-77879r1_rule\",\"medium\",null,null,\"The TFTP Client must not be installed on the system.\",\"WN10-00-000120\",\"Some protocols and services do not support required security features, such as encrypting passwords or traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:B/OnPBA2G41jIXn2STFlRDpkMuzALJv21OFtakZOH9Y=\"},\"C-94065r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JKikEHNST7nGZraERoaKA0mibzuZzeNB/9NH3JyuuQ0=\"},\"F-100989r1_fix\",\"V-63393\",\"medium\",\"WN10-00-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4468,\"SV-77883r2_rule\",\"medium\",null,null,\"Software certificate installation files must be removed from Windows 10.\",\"WN10-00-000130\",\"Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fz8dkAgamwTuH5yyEwnl11W4wiTXnoygvOnaEaNj80A=\"},\"C-64147r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cA+3JZQpKpbDYPqpt+bArmFwhZxvmpRu2uDMTKnSaRI=\"},\"F-69327r1_fix\",\"V-63399\",\"medium\",\"WN10-00-000135\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4469,\"SV-77889r1_rule\",\"medium\",null,null,\"A host-based firewall must be installed and enabled on the system.\",\"WN10-00-000135\",\"A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wkHOfqgUvzr6nhiu0W8JznAIxTY88dEtZD1HETyM13Y=\"},\"C-94067r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:maSrCn/JTRi30EOHIhnTKUmRWD1TUrLuQWyxGw6bW34=\"},\"F-100991r1_fix\",\"V-63403\",\"medium\",\"WN10-00-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4470,\"SV-77893r2_rule\",\"medium\",null,null,\"Inbound exceptions to the firewall on Windows 10 domain workstations must only allow authorized remote management hosts.\",\"WN10-00-000140\",\"Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised.  Limiting inbound connections only from authorized remote management systems will help limit this exposure.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:iZIWtAKLFv0mnxWoPykNAd+yxoNoNuOAn/rsuRkGkBw=\"},\"C-74549r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jLRL3Ym/q1F3d0J4TpzAIREp+e+yRky+vjqjf9GGYaM=\"},\"F-81277r1_fix\",\"V-63405\",\"medium\",\"WN10-AC-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4471,\"SV-77895r2_rule\",\"medium\",null,null,\"Windows 10 account lockout duration must be configured to 15 minutes or greater.\",\"WN10-AC-000005\",\"The account lockout feature, when enabled, prevents brute-force password attacks on the system.   This parameter specifies the amount of time that an account will remain locked after the specified number of failed logon attempts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IeyN47N358ORV6Naa7eZ9JrcWdBvGlkKd07eHuOVVhQ=\"},\"C-64157r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5eZS64e/4nkwIBidUMYDnXVjcP3P+Q0Fa25x/nq2z1Y=\"},\"F-69337r1_fix\",\"V-63409\",\"medium\",\"WN10-AC-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4472,\"SV-77899r1_rule\",\"medium\",null,null,\"The number of allowed bad logon attempts must be configured to 3 or less.\",\"WN10-AC-000010\",\"The account lockout feature, when enabled, prevents brute-force password attacks on the system.  The higher this value is, the less effective the account lockout feature will be in protecting the local system.  The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:14aXfEafYKcgX8JWb5u3N/8DD5cx/FDR9uuxUhwPlSE=\"},\"C-64161r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MmMbe6A7LFKZ6HzPvNVdObtI5SQclsP1bclC8xe3ZvA=\"},\"F-69341r1_fix\",\"V-63413\",\"medium\",\"WN10-AC-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4473,\"SV-77903r1_rule\",\"medium\",null,null,\"The period of time before the bad logon counter is reset must be configured to 15 minutes.\",\"WN10-AC-000015\",\"The account lockout feature, when enabled, prevents brute-force password attacks on the system.  This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to 0.  The smaller this value is, the less effective the account lockout feature will be in protecting the local system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:o8VKo4BFEQi8vohXvm9npwy451RfLEpCEbuLlXnX9P4=\"},\"C-64163r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ySeUZF7neYw++ikB4UQxqpm8qej7Jy5BBVEeZPielDw=\"},\"F-69343r1_fix\",\"V-63415\",\"medium\",\"WN10-AC-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4474,\"SV-77905r2_rule\",\"medium\",null,null,\"The password history must be configured to 24 passwords remembered.\",\"WN10-AC-000020\",\"A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change a password to a unique password on a regularly scheduled basis.  This enables users to effectively negate the purpose of mandating periodic password changes.  The default value is 24 for Windows domain systems.  DoD has decided this is the appropriate value for all Windows systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OOSpmvJlTsCD444uc+1xJVXu6qS4JR7e8tmYahCVG9Q=\"},\"C-64167r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MPgQHZ8NOu+FYExJTAdPyuM60k7VNM2/HJvp0Z9aChc=\"},\"F-69347r1_fix\",\"V-63419\",\"medium\",\"WN10-AC-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4475,\"SV-77909r1_rule\",\"medium\",null,null,\"The maximum password age must be configured to 60 days or less.\",\"WN10-AC-000025\",\"The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords.   Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rtkmX+JYKFPLvLYlRGgdiaDWULPSxr3ntwT4Qq5G0gE=\"},\"C-64169r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4/1Ch5tWbxP+WIVYjouyk/HOJ0XDti4tjAN693o+91E=\"},\"F-69349r1_fix\",\"V-63421\",\"medium\",\"WN10-AC-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4476,\"SV-77911r1_rule\",\"medium\",null,null,\"The minimum password age must be configured to at least 1 day.\",\"WN10-AC-000030\",\"Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database.  This enables users to effectively negate the purpose of mandating periodic password changes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gADtcufL0rvkhSygty7DNDG6rjm7eHO0Y8vlxc/cJOw=\"},\"C-64171r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OGyxCX5DTHE1ARwtV3m5eLeOpqYLijS3M8zhjRnBkzM=\"},\"F-69351r1_fix\",\"V-63423\",\"medium\",\"WN10-AC-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4477,\"SV-77913r1_rule\",\"medium\",null,null,\"Passwords must, at a minimum, be 14 characters.\",\"WN10-AC-000035\",\"Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9N++lDyFOQnR8saWfC585SvXvrRukpsO+VUybL0SJ3I=\"},\"C-64175r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TtARJnIt4fAJ70CJNv7xxjsDm7PL3wI22DNMIUqNCXg=\"},\"F-69355r1_fix\",\"V-63427\",\"medium\",\"WN10-AC-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4478,\"SV-77917r1_rule\",\"medium\",null,null,\"The built-in Microsoft password complexity filter must be enabled.\",\"WN10-AC-000040\",\"The use of complex passwords increases their strength against guessing and brute-force attacks.  This setting configures the system to verify that newly created passwords conform to the Windows password complexity policy.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YJ3a9bdA7M956htDthFs6pM+dAbD3AcqGyWDkl4iTa4=\"},\"C-64177r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VGo1Nu2SJaq9I64JszyAAHcEh0AfgVawMKsOTAwL1dk=\"},\"F-69357r1_fix\",\"V-63429\",\"high\",\"WN10-AC-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4479,\"SV-77919r1_rule\",\"high\",null,null,\"Reversible password encryption must be disabled.\",\"WN10-AC-000045\",\"Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords. For this reason, this policy must never be enabled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sDp/d6cGeheQPSyDdqeABiqG2UKTGaaxfw8wIcMeQHs=\"},\"C-64181r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aA7TirNm7zPIdrLVzY9gUwi2WnKWGnEBB1HObtUaMdg=\"},\"F-69359r1_fix\",\"V-63431\",\"medium\",\"WN10-AU-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4480,\"SV-77921r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Logon - Credential Validation failures.\",\"WN10-AU-000005\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nCredential validation records events related to validation tests on credentials for a user account logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U2zZ7WbIs6xdLIKg5f+SK3W4lP14JKnsnLrhnXtzY8A=\"},\"C-64183r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YCkv04RndmdzyZCcB6O5+KYAOvsm7/89d5qqX0GhgSQ=\"},\"F-69363r1_fix\",\"V-63435\",\"medium\",\"WN10-AU-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4481,\"SV-77925r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Logon - Credential Validation successes.\",\"WN10-AU-000010\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nCredential validation records events related to validation tests on credentials for a user account logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Wm8Z9go4ijvi1hXPZNlNfvaEeTTCHlNCHL0r4Y+YBog=\"},\"C-64193r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gg/v2f3vUfMRkCkHvHXOt9BCfQqKfFN4a8DgK+qrvsQ=\"},\"F-69373r1_fix\",\"V-63445\",\"medium\",\"WN10-AU-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4482,\"SV-77935r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Management - Security Group Management successes.\",\"WN10-AU-000030\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSecurity Group Management records events such as creating, deleting or changing of security groups, including changes in group members.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3K8Cr0W8KyJySAjHnIKhBoSL7BMlQwmSIgNxt27SU90=\"},\"C-64195r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pVd0NovBldiHaHPFa0tAv011pF2RjRALQ7tnRADE91E=\"},\"F-69375r1_fix\",\"V-63447\",\"medium\",\"WN10-AU-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4483,\"SV-77937r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Management - User Account Management failures.\",\"WN10-AU-000035\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nUser Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hFq/VN5iy8nq4TtmL91tbvNef3uqC1tTzH5qxWfTUFY=\"},\"C-64197r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/xdrvVHV4IePqacc8MtQYqmIYGMhrwIztaVynBDnuLA=\"},\"F-69377r1_fix\",\"V-63449\",\"medium\",\"WN10-AU-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4484,\"SV-77939r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Management - User Account Management successes.\",\"WN10-AU-000040\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nUser Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6OLuCTq6MxuisuBFoZTFhVa37PfJJ79XxKFbZyUXh0w=\"},\"C-64199r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qOA4YL9f41Ns4hyJL9uPQqiGJGBe7icqz/ppQklVGv0=\"},\"F-69379r1_fix\",\"V-63451\",\"medium\",\"WN10-AU-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4485,\"SV-77941r1_rule\",\"medium\",null,null,\"The system must be configured to audit Detailed Tracking - PNP Activity successes.\",\"WN10-AU-000045\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nPlug and Play activity records events related to the successful connection of external devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TRV0JYavJNEISA42NPNpnVnUp5myoEbm7eqpR1DJJFo=\"},\"C-64201r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NBU2MzWYsGPC3gi/4RxDiS7NfuwoELGkXTJaeq9BrdU=\"},\"F-69381r1_fix\",\"V-63453\",\"medium\",\"WN10-AU-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4486,\"SV-77943r1_rule\",\"medium\",null,null,\"The system must be configured to audit Detailed Tracking - Process Creation successes.\",\"WN10-AU-000050\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nProcess creation records events related to the creation of a process and the source.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BvILRXAXQabjIlzA8GIEo277mORYvfi8NWsVMyjd+bs=\"},\"C-64205r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MkFjBW+wTXKM+bVOaMTYtYSOvoBL6TyGajba0WYKVoQ=\"},\"F-69385r2_fix\",\"V-63457\",\"medium\",\"WN10-AU-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4487,\"SV-77947r2_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Group Membership successes.\",\"WN10-AU-000060\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Group Membership records information related to the group membership of a user's logon token.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2DObiHB1tJi8nMxl9dgsi2/LMp3YdlL60aFyLwFw3R4=\"},\"C-64207r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:K5M4KmaUozWIzaU+v4pu+F3Oz6hud2YaO8zive2VMNQ=\"},\"F-69387r1_fix\",\"V-63459\",\"medium\",\"WN10-AU-000065\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4488,\"SV-77951r1_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Logoff successes.\",\"WN10-AU-000065\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nLogoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:V/vAvDNZ6xrqpdV/w1nyyY3RzAUSErMEtiv1Xc/qROg=\"},\"C-64211r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ja15obCbbcDYxnTR9GfasZC2z6rW5C077asl2QRc9ig=\"},\"F-69391r1_fix\",\"V-63463\",\"medium\",\"WN10-AU-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4489,\"SV-77953r1_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Logon failures.\",\"WN10-AU-000070\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nLogon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BE/T6AoSLhPnWZOeS6illZZoNnn6TQQMBBvTmt+LfNg=\"},\"C-64215r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2tufLSka7fFObhLBDXhZmY7CFoqtM5BQkY9Xx2urDHE=\"},\"F-69395r1_fix\",\"V-63467\",\"medium\",\"WN10-AU-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4490,\"SV-77957r1_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Logon successes.\",\"WN10-AU-000075\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nLogon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HwmQqAec5Zb6el866c2comWk7ZfJ+ixTZEXIw7pzUOU=\"},\"C-64219r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RJZC6BfSuklLHfD8/AdYU36eUuB5I07rIDS9TecjKqM=\"},\"F-69399r1_fix\",\"V-63469\",\"medium\",\"WN10-AU-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4491,\"SV-77959r1_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Special Logon successes.\",\"WN10-AU-000080\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSpecial Logon records special logons which have administrative privileges and can be used to elevate processes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1acXIWzqEYhMqmAFLJ2OFPWy5wyiClFRK0blgMdIxBY=\"},\"C-79559r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zSmfHuoXc0jrD2YrzBzIQ/XZ0Y954LULEdzdIVTClMw=\"},\"F-69401r1_fix\",\"V-63471\",\"medium\",\"WN10-AU-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4492,\"SV-77961r2_rule\",\"medium\",null,null,\"The system must be configured to audit Object Access - Removable Storage failures.\",\"WN10-AU-000085\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing object access for removable media records events related to access attempts on file system objects on removable storage devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LGJqueVXVNwDFVXUpGxRZQ4Wny/BOBHeceC7sx3PXzs=\"},\"C-79561r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zqpREYRg1Kxz138PJty6cYN9gO7tgJH8CBCn0kPzqyI=\"},\"F-69403r1_fix\",\"V-63473\",\"medium\",\"WN10-AU-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4493,\"SV-77963r2_rule\",\"medium\",null,null,\"The system must be configured to audit Object Access - Removable Storage successes.\",\"WN10-AU-000090\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing object access for removable media records events related to access attempts on file system objects on removable storage devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I1vZMy69tT8kq1UjsGKufBSv8WZnqduCw713X+syDqw=\"},\"C-64229r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wKnsWqty0H9nWg2aaRDOv7IxI9QTQpCDaGjIgbj0MBQ=\"},\"F-69409r2_fix\",\"V-63479\",\"medium\",\"WN10-AU-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4494,\"SV-77969r2_rule\",\"medium\",null,null,\"The system must be configured to audit Policy Change - Audit Policy Change successes.\",\"WN10-AU-000100\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Policy Change records events related to changes in audit policy.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:W/aNcLuy+E+akBMmzfflre1wQ9pk0xdJKZ8MsmhQgJg=\"},\"C-64231r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aKP1kHP2CONM78C0dxE8QkGqPoT1aq80NDZc6RL/OBI=\"},\"F-69411r1_fix\",\"V-63481\",\"medium\",\"WN10-AU-000105\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4495,\"SV-77971r1_rule\",\"medium\",null,null,\"The system must be configured to audit Policy Change - Authentication Policy Change successes.\",\"WN10-AU-000105\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuthentication Policy Change records events related to changes in authentication policy including Kerberos policy and Trust changes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uK/4Mc8psjVa5hc9xcQ/VvM1L3p/Z2PR5oXrXVdT3AA=\"},\"C-64235r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lP2Tm71qQIYsyXZjSgjcxXH47CRJMJhyJ8U+5zDT7N0=\"},\"F-69413r1_fix\",\"V-63483\",\"medium\",\"WN10-AU-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4496,\"SV-77973r1_rule\",\"medium\",null,null,\"The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.\",\"WN10-AU-000110\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSensitive Privilege Use records events related to use of sensitive privileges, such as \\\"Act as part of the operating system\\\" or \\\"Debug programs\\\".\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ub+bzRw9nK5FMqhg0cvtHTPXc0ZoY14WwJJpfePsTU0=\"},\"C-64237r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pNLEyv3K1YNdXEba5N6YcjSqJdolvf811azquiZVsIE=\"},\"F-69417r1_fix\",\"V-63487\",\"medium\",\"WN10-AU-000115\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4497,\"SV-77977r1_rule\",\"medium\",null,null,\"The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.\",\"WN10-AU-000115\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSensitive Privilege Use records events related to use of sensitive privileges, such as \\\"Act as part of the operating system\\\" or \\\"Debug programs\\\".\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pI4rSYXdO2I17sVUgVGEC9waoXmSE152j9vxVgdtn58=\"},\"C-64241r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FlfPwFuyGa353w6vq+ReJyYvcWU+jXAQhHZmDQsabcY=\"},\"F-69421r1_fix\",\"V-63491\",\"medium\",\"WN10-AU-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4498,\"SV-77981r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - IPSec Driver failures.\",\"WN10-AU-000120\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nIPSec Driver records events related to the IPSec Driver such as dropped packets.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XjzZBXSARGyTD/PfUuDeFm28fIvcIV4qygTV08sLVKo=\"},\"C-64249r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qbnkfxvcxqsHUumpyx/QPMSvTcHG0EHf5OmWf+44R34=\"},\"F-69429r2_fix\",\"V-63499\",\"medium\",\"WN10-AU-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4499,\"SV-77989r2_rule\",\"medium\",null,null,\"The system must be configured to audit System - Other System Events successes.\",\"WN10-AU-000130\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other System Events records information related to cryptographic key operations and the Windows Firewall service.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:t6WHp+ZUHBml263lvCguGrlkMzldPXsFEy5VNUVNBrI=\"},\"C-64253r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wKOwXbSL3PoqzLvUb4JGzDXw9Mj8ree+SlnSn2RvDi0=\"},\"F-69433r2_fix\",\"V-63503\",\"medium\",\"WN10-AU-000135\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4500,\"SV-77993r2_rule\",\"medium\",null,null,\"The system must be configured to audit System - Other System Events failures.\",\"WN10-AU-000135\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other System Events records information related to cryptographic key operations and the Windows Firewall service.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Er5CsYJ2r9pG46ajyyQ8LR2k5mWoAMurGm8u9Uh/Iuw=\"},\"C-64257r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:t48oe6m1PGxij2Hfz7wB0b6JoXbXl6dq0nX27AkSkw4=\"},\"F-69437r1_fix\",\"V-63507\",\"medium\",\"WN10-AU-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4501,\"SV-77997r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - Security State Change successes.\",\"WN10-AU-000140\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSecurity State Change records events related to changes in the security state, such as startup and shutdown of the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WuYFQVOva2y1AbhfejrStyjDyv4BFq3G2voT7JCBA8Y=\"},\"C-64263r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TncMv3Jzlg2v7g/aMq6s8u8VuBYs6+jp0w8uYjkuiBc=\"},\"F-69443r1_fix\",\"V-63513\",\"medium\",\"WN10-AU-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4502,\"SV-78003r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - Security System Extension successes.\",\"WN10-AU-000150\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSecurity System Extension records events related to extension code being loaded by the security subsystem.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xgvxweAhj8P+1t428K3s8SDMbeLf2/MINiEDTjiVtRk=\"},\"C-64265r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y1Aff8aSD5qwlONaGrPOmAJVqIiaG/LHZhiOPu2pfmc=\"},\"F-69445r1_fix\",\"V-63515\",\"medium\",\"WN10-AU-000155\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4503,\"SV-78005r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - System Integrity failures.\",\"WN10-AU-000155\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSystem Integrity records events related to violations of integrity to the security subsystem.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:liPGtSRilvM45JUUHGb3NoDoAKAmonqQZH/MaCqLC/s=\"},\"C-64267r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:x6KrpOs1hxxhfHX/dlnzpNji0JTFvBRWVnCw7WX2AOE=\"},\"F-69447r1_fix\",\"V-63517\",\"medium\",\"WN10-AU-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4504,\"SV-78007r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - System Integrity successes.\",\"WN10-AU-000160\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSystem Integrity records events related to violations of integrity to the security subsystem.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DyO6WQCEJJlinj5BDeq/RINvUFeMQ73GuBqzRcFDqQQ=\"},\"C-64269r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oqaP95MfT4NLwBuXhTFAOcC96NQT8kstSKpuuSkgPwY=\"},\"F-69449r1_fix\",\"V-63519\",\"medium\",\"WN10-AU-000500\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4505,\"SV-78009r1_rule\",\"medium\",null,null,\"The Application event log size must be configured to 32768 KB or greater.\",\"WN10-AU-000500\",\"Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/3CmjRBIzvZC9yK/MCEjxBoeg+MF3xkIhnLP5Zgo/2M=\"},\"C-79597r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hCKZP4gqx2/fQTmOmUUQ561GsS0cToKGHWLnjt1JE80=\"},\"F-86735r1_fix\",\"V-63523\",\"medium\",\"WN10-AU-000505\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4506,\"SV-78013r2_rule\",\"medium\",null,null,\"The Security event log size must be configured to 1024000 KB or greater.\",\"WN10-AU-000505\",\"Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rIpcAlB/RefJGwA84BZ7ULacK5uTqcC4TpZy9gfOwdk=\"},\"C-64277r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:V/1VRJCtUyree39Mg/Yp6XswbQtFsUiWSUtW3sC4gx0=\"},\"F-69457r1_fix\",\"V-63527\",\"medium\",\"WN10-AU-000510\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4507,\"SV-78017r1_rule\",\"medium\",null,null,\"The System event log size must be configured to 32768 KB or greater.\",\"WN10-AU-000510\",\"Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Au90rsoIgKKpDJ+88Qps0bQDZf/CKYRvQpZFpv2MOUA=\"},\"C-94069r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HvM9zFQwtSYA7tWqPQldVml2FC87Y1REgJ28eU0K7h0=\"},\"F-69463r1_fix\",\"V-63533\",\"medium\",\"WN10-AU-000515\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4508,\"SV-78023r2_rule\",\"medium\",null,null,\"Windows 10 permissions for the Application event log must prevent access by non-privileged accounts.\",\"WN10-AU-000515\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Application event log may be  susceptible to tampering if proper permissions are not applied.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KvaUNjf9HpHOvMKNKYYGrc5t+RjNh70OiFd7YXyR7TI=\"},\"C-94071r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NpbK/A9boxa1fvOWbf1Chof5scXWC2vQJMszQTt1u+Y=\"},\"F-69467r1_fix\",\"V-63537\",\"medium\",\"WN10-AU-000520\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4509,\"SV-78027r2_rule\",\"medium\",null,null,\"Windows 10 permissions for the Security event log must prevent access by non-privileged accounts.\",\"WN10-AU-000520\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Security event log may disclose sensitive information or be  susceptible to tampering if proper permissions are not applied.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kwjLPtx2Qf2ICgGtbJvcwowGSS5n1iOSY0sAbgRUseA=\"},\"C-94073r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/4pSofCd9Cq60jubDSnxx+57hw8xf9384evWVHaDk+w=\"},\"F-69471r1_fix\",\"V-63541\",\"medium\",\"WN10-AU-000525\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4510,\"SV-78031r2_rule\",\"medium\",null,null,\"Windows 10 permissions for the System event log must prevent access by non-privileged accounts.\",\"WN10-AU-000525\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The System event log may be  susceptible to tampering if proper permissions are not applied.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:n/VYybwadURq9gktZ5pPv9NpPwlE/OX7X34avyRIxn0=\"},\"C-64295r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rLQmxWfvja477xAg4uFTM+6sxpkTd5/YLxzvM0Fq2FQ=\"},\"F-69475r1_fix\",\"V-63545\",\"medium\",\"WN10-CC-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4511,\"SV-78035r1_rule\",\"medium\",null,null,\"Camera access from the lock screen must be disabled.\",\"WN10-CC-000005\",\"Enabling camera access from the lock screen could allow for unauthorized use.  Requiring logon will ensure the device is only used by authorized personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wD5HvAQgiCsU2Pbe6EawPD0843pDzk9QjNocpT9i8RI=\"},\"C-64299r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9w83wkd0gVC9qElvSUtSE641xHX0nJ5OKujjokrvMSo=\"},\"F-69479r1_fix\",\"V-63549\",\"medium\",\"WN10-CC-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4512,\"SV-78039r1_rule\",\"medium\",null,null,\"The display of slide shows on the lock screen must be disabled.\",\"WN10-CC-000010\",\"Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel.  Turning off this feature will limit access to the information to a logged on user.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A6fibgthh14b9Op4gFZQuUPcG2SB+c4/OCpJZl+JW/o=\"},\"C-64305r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pZWVc24salB5/U1HmWA4W6W1HuWSlK4IR5FLuphT3/I=\"},\"F-69485r1_fix\",\"V-63555\",\"medium\",\"WN10-CC-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4513,\"SV-78045r1_rule\",\"medium\",null,null,\"IPv6 source routing must be configured to highest protection.\",\"WN10-CC-000020\",\"Configuring the system to disable IPv6 source routing protects against spoofing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QwUV9MHbwXjDlNhviMU3RJgonXD84IWB/u1SaVD04HU=\"},\"C-64309r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/gYQBG7Wcx3jx0tMxsPSgc5qqAfkxIp4WUL6Tsp5d3E=\"},\"F-69489r1_fix\",\"V-63559\",\"medium\",\"WN10-CC-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4514,\"SV-78049r1_rule\",\"medium\",null,null,\"The system must be configured to prevent IP source routing.\",\"WN10-CC-000025\",\"Configuring the system to disable IP source routing protects against spoofing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DJn8qS8Z+LUFfJVdHOYY3y3chtd5shcIjisdTgSjqYk=\"},\"C-64313r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8Uv8OZEB4zBbtzRn6Z0BsKlAlG9jeileDqxL7Ggm4ks=\"},\"F-69493r1_fix\",\"V-63563\",\"low\",\"WN10-CC-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4515,\"SV-78053r1_rule\",\"low\",null,null,\"The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.\",\"WN10-CC-000030\",\"Allowing ICMP redirect of routes can lead to traffic not being routed properly.   When disabled, this forces ICMP to be routed via shortest path first.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OLmEHTREwzxLEYjHSP9Vs9v/hFwEi7JLaoSgaF8tAzI=\"},\"C-64317r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gJpOKNLcanyruAumtszxLLcnQ/GFp8dB80gTbU8dM4Y=\"},\"F-69497r1_fix\",\"V-63567\",\"low\",\"WN10-CC-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4516,\"SV-78057r1_rule\",\"low\",null,null,\"The system must be configured to ignore NetBIOS name release requests except from WINS servers.\",\"WN10-CC-000035\",\"Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:R57XJmpmTusQFUQzPHbDgL50AUYv/vR8uoIKyz7Vpzs=\"},\"C-81357r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Wd53AX2vIP+U41A35FoDx4GW6LTTJZ8oS3Mv3hOj/AI=\"},\"F-69499r2_fix\",\"V-63569\",\"medium\",\"WN10-CC-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4517,\"SV-78059r2_rule\",\"medium\",null,null,\"Insecure logons to an SMB server must be disabled.\",\"WN10-CC-000040\",\"Insecure guest logons allow unauthenticated access to shared folders.  Shared resources on a system must require authentication to establish proper access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:61r9+JyE4FdTPKoO2j03RuHoicsSx+y5TDVRs+6Lxk8=\"},\"C-64327r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6eFOhwebc7IktMzsdu/X6CFpnwwdXDnqdPZXnULUBPY=\"},\"F-69507r1_fix\",\"V-63577\",\"medium\",\"WN10-CC-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4518,\"SV-78067r1_rule\",\"medium\",null,null,\"Hardened UNC Paths must be defined to require mutual authentication and integrity for at least the \\\\\\\\*\\\\SYSVOL and \\\\\\\\*\\\\NETLOGON shares.\",\"WN10-CC-000050\",\"Additional security requirements are applied to Universal Naming Convention (UNC) paths specified in Hardened UNC paths before allowing access them.  This aids in preventing tampering with or spoofing of connections to these paths.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vBYNU1MOZTMT14yG0uwLTnJNZd27pnHRrsvC0HPMX0s=\"},\"C-80175r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qW/yvLi6pjd31ZPwUriE4/jZaYVO9VBepn68ejyghvY=\"},\"F-87307r1_fix\",\"V-63579\",\"medium\",\"WN10-PK-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4519,\"SV-78069r4_rule\",\"medium\",null,null,\"The DoD Root CA certificates must be installed in the Trusted Root Store.\",\"WN10-PK-000005\",\"To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root Certificate Authorities (CAs). The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c4QEIcRFMsJ0fLK2itIk4vhS7BejsCbOOCX+PUzaf1o=\"},\"C-64331r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nIaCTWblFcQ8963AsTavhUs6fngasKR5TbX3Oe3Jhr4=\"},\"F-69511r1_fix\",\"V-63581\",\"medium\",\"WN10-CC-000055\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4520,\"SV-78071r2_rule\",\"medium\",null,null,\"Simultaneous connections to the Internet or a Windows domain must be limited.\",\"WN10-CC-000055\",\"Multiple network connections can provide additional attack vectors to a system and must be limited. The \\\"Minimize the number of simultaneous connections to the Internet or a Windows Domain\\\" setting prevents systems from automatically establishing multiple connections.  When both wired and wireless connections are available, for example, the less preferred connection (typically wireless) will be disconnected.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4xWh6wamWmIOeIO59RNtRdwcCFtu7mD7qVIiEWhU49I=\"},\"C-80177r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6hfbBPdICANHXibauoRbwr56X1UfaZHIVdr6tdBHtRw=\"},\"F-76981r2_fix\",\"V-63583\",\"medium\",\"WN10-PK-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4521,\"SV-78073r3_rule\",\"medium\",null,null,\"The External Root CA certificates must be installed in the Trusted Root Store on unclassified systems.\",\"WN10-PK-000010\",\"To ensure secure websites protected with External Certificate Authority (ECA) server certificates are properly validated, the system must trust the ECA Root CAs. The ECA root certificates will ensure the trust chain is established for server certificates issued from the External CAs. This requirement only applies to unclassified systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wmSMFUgwk1JCHLOyalyRfJCbYd8VKcplfwvV5bapJBY=\"},\"C-64335r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2l+idlgBtTvnKFVa9VTf4zXsNEBWfO4m8plTIhF/DyE=\"},\"F-69515r1_fix\",\"V-63585\",\"medium\",\"WN10-CC-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4522,\"SV-78075r1_rule\",\"medium\",null,null,\"Connections to non-domain networks when connected to a domain authenticated network must be blocked.\",\"WN10-CC-000060\",\"Multiple network connections can provide additional attack vectors to a system and should be limited.  When connected to a domain, communication must go through the domain connection.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FKy5u6ln+y0mzvOV4HzwGH2CwpZj3IQ2DhcZHGowfYk=\"},\"C-91397r6_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vnsW+684faBn7v70CiiRfuLg3ZjpK4esKbO68gE27us=\"},\"F-98441r5_fix\",\"V-63587\",\"medium\",\"WN10-PK-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4523,\"SV-78077r6_rule\",\"medium\",null,null,\"The DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.\",\"WN10-PK-000015\",\"To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VNS7bkHAgOyfB6SjEoQf8o+x0lzbHQcxS5EZbR1kz64=\"},\"C-91399r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zKlpVqXd27JZ5EOCpoOs1uN43E0aHvghtWtFAEWFqE0=\"},\"F-98443r4_fix\",\"V-63589\",\"medium\",\"WN10-PK-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4524,\"SV-78079r5_rule\",\"medium\",null,null,\"The US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.\",\"WN10-PK-000020\",\"To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ev+o/KN0GgLzFlT2mWhE43+O9wbhzEnibMOjO1WuHo0=\"},\"C-81355r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qpCS/S/xqllHFnTYVWBNcXOwR4c/H0d+j+1IuGA91GM=\"},\"F-88431r2_fix\",\"V-63591\",\"medium\",\"WN10-CC-000065\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4525,\"SV-78081r2_rule\",\"medium\",null,null,\"Wi-Fi Sense must be disabled.\",\"WN10-CC-000065\",\"Wi-Fi Sense automatically connects the system to known hotspots and networks that contacts have shared.  It also allows the sharing of the system's known networks to contacts.  Automatically connecting to hotspots and shared networks can expose a system to unsecured or potentially malicious systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+gNTwi6NPYxK/l/EIlkhsqMLUMX3yk8p8qOXrOuTUD8=\"},\"C-91427r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ykTGg9spp0NKYR5+ZyC3oLERNxBbzK8ql0M2w5JsGF8=\"},\"F-98471r1_fix\",\"V-63593\",\"medium\",\"WN10-RG-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4526,\"SV-78083r2_rule\",\"medium\",null,null,\"Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.\",\"WN10-RG-000005\",\"The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DgPD2H4FRf1aoEW+JdUiSywje5awdelYTOHDeJ/jku8=\"},\"C-94075r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:G6lcect0y/g9UT0Y3z0L92t2RhMCjFw4ExV2g8zRFOo=\"},\"F-74851r3_fix\",\"V-63595\",\"low\",\"WN10-CC-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4527,\"SV-78085r6_rule\",\"low\",null,null,\"Virtualization Based Security must be enabled on Windows 10 with the platform security level configured to Secure Boot or Secure Boot with DMA Protection.\",\"WN10-CC-000070\",\"Virtualization Based Security (VBS) provides the platform for the additional security features, Credential Guard and Virtualization based protection of code integrity.  Secure Boot is the minimum security level with DMA protection providing additional memory protection.  DMA Protection requires a CPU that supports input/output memory management unit (IOMMU).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZB/zbtMEaShUymYYFvs3E2/5ygQ24pqyeGDPPNJ9udg=\"},\"C-72029r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SdkFWEyc7gjSU/lmjQKEMVDHJyCAq4AuDOkoUTPQUdU=\"},\"F-78099r3_fix\",\"V-63597\",\"medium\",\"WN10-CC-000037\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4528,\"SV-78087r2_rule\",\"medium\",null,null,\"Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.\",\"WN10-CC-000037\",\"A compromised local administrator account can provide means for an attacker to move laterally between domain systems.\\n\\nWith User Account Control enabled, filtering the privileged token for built-in administrator accounts will prevent the elevated privileges of these accounts from being used over the network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PJ2hg0H5j3JxumOw1ESdMmYSago1hh7d1jPoC7NiknU=\"},\"C-94077r6_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:j63Fbih99ATORGtI1MEEIxg37mR6MGAYmAiyypVcg1E=\"},\"F-88433r2_fix\",\"V-63599\",\"high\",\"WN10-CC-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4529,\"SV-78089r9_rule\",\"high\",null,null,\"Credential Guard must be running on Windows 10 domain-joined systems.\",\"WN10-CC-000075\",\"Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. This authentication information, which was stored in the Local Security Authority (LSA) in previous versions of Windows, is isolated from the rest of operating system and can only be accessed by privileged system software.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gu4gtZX1rR01eoH7S8OImC8dbc8fZ9Js8wyj3Hq8AQA=\"},\"C-64351r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HXfLFOqu+1s5ssE/guTf0G+p+E1y4Zp/jbZafzC2X8A=\"},\"F-69531r1_fix\",\"V-63601\",\"medium\",\"WN10-SO-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4530,\"SV-78091r1_rule\",\"medium\",null,null,\"The built-in administrator account must be disabled.\",\"WN10-SO-000005\",\"The built-in administrator account is a well-known account subject to attack.  It also provides no accountability to individual administrators on a system.  It must be disabled to prevent its use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MOtPlfIGo1RyaFuE2rfSMX3os4OtOKSymnMJWGrlUXI=\"},\"C-64357r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:i6Q2heKseDABr9dNSExMDPTbOHjPMPjTHR818GtjOVE=\"},\"F-69537r5_fix\",\"V-63607\",\"medium\",\"WN10-CC-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4531,\"SV-78097r2_rule\",\"medium\",null,null,\"Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers.\",\"WN10-CC-000085\",\"By being launched first by the kernel, ELAM ( Early Launch Antimalware) is ensured to be launched before any third-party software, and is therefore able to detect malware in the boot process and prevent it from initializing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:x6lWvjXJOJaFvBJV1Zg8dV8fRzPlgg6/m3YcFFE/VLE=\"},\"C-64359r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6VXJSqwF1zyWEd3Q5/6djx7mrB1JQSvdwnOXfetGibc=\"},\"F-69539r1_fix\",\"V-63609\",\"medium\",\"WN10-CC-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4532,\"SV-78099r1_rule\",\"medium\",null,null,\"Group Policy objects must be reprocessed even if they have not changed.\",\"WN10-CC-000090\",\"Enabling this setting and then selecting the \\\"Process even if the Group Policy objects have not changed\\\" option ensures that the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3H53KZC2kWuaeW6IYY71llirhuaVVZpEWoqEEkwfsC4=\"},\"C-64361r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cZIhh4M84G9S28SE0Eimt5O7VnLgH9tIurbqqRNRzv4=\"},\"F-69541r1_fix\",\"V-63611\",\"medium\",\"WN10-SO-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4533,\"SV-78101r1_rule\",\"medium\",null,null,\"The built-in guest account must be disabled.\",\"WN10-SO-000010\",\"A system faces an increased vulnerability threat if the built-in guest account is not disabled.  This account is a known account that exists on all Windows systems and cannot be deleted.  This account is initialized during the installation of the operating system with no password assigned.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:UFrGn+U27y3pnKkpO5lkjLvaccdBipAxfmB1NDMupKc=\"},\"C-64365r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/BowXRM3tJKXibXXxqKggyjs1ejtzmV1tj5Y6tuOML0=\"},\"F-69545r1_fix\",\"V-63615\",\"medium\",\"WN10-CC-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4534,\"SV-78105r1_rule\",\"medium\",null,null,\"Downloading print driver packages over HTTP must be prevented.\",\"WN10-CC-000100\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents the computer from downloading print driver packages over HTTP.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:J5uvaJtjjYnwV4ewXXHS2Y/F1moPfjj95l8OgEmAcHg=\"},\"C-64367r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MIISVbnumAOzsSQ0LnkOmibChxPx5xKPCAOIijlVP5Y=\"},\"F-69547r1_fix\",\"V-63617\",\"medium\",\"WN10-SO-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4535,\"SV-78107r1_rule\",\"medium\",null,null,\"Local accounts with blank passwords must be restricted to prevent access from the network.\",\"WN10-SO-000015\",\"An account without a password can allow unauthorized access to a system as only the username would be required.  Password policies should prevent accounts with blank passwords from existing on a system.  However, if a local account with a blank password did exist, enabling this setting will prevent network access, limiting the account to local console logon only.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CgDvkF7Lpc1r6ZB1knUBa/Na6DAh5qTekx4xkJVDJKU=\"},\"C-64371r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YeCBg180cLlpfYI2tR2YOQnoZKTsqgA2DUoYey1lDeI=\"},\"F-69551r1_fix\",\"V-63619\",\"medium\",\"WN10-SO-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4536,\"SV-78109r1_rule\",\"medium\",null,null,\"The built-in administrator account must be renamed.\",\"WN10-SO-000020\",\"The built-in administrator account is a well-known account subject to attack.  Renaming this account to an unidentified name improves the protection of this account and the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PynI4MPELuswd9LSVn4o7lJ1Gj5XkceRgYo1jYFWcyE=\"},\"C-64369r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oU5hOUYBLIYzJj1qziKaQNZ/YLYfQl5M/74gsNYEh0A=\"},\"F-69549r1_fix\",\"V-63621\",\"medium\",\"WN10-CC-000105\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4537,\"SV-78111r1_rule\",\"medium\",null,null,\"Web publishing and online ordering wizards must be prevented from downloading a list of providers.\",\"WN10-CC-000105\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents Windows from downloading a list of providers for the Web publishing and online ordering wizards.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eHWGorFu8rp07FggxF3KQzzzIDdCofw07d6YU7EPPQg=\"},\"C-64373r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VXzJXyUcgf8hv77wrcIGqLeZvieVy1yeE+Hw1MhHtY0=\"},\"F-69553r1_fix\",\"V-63623\",\"medium\",\"WN10-CC-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4538,\"SV-78113r1_rule\",\"medium\",null,null,\"Printing over HTTP must be prevented.\",\"WN10-CC-000110\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Sp6+sZWFJ+5qIfMxuZM1X4FQ9Q3VaCCrivEnw2hO+VE=\"},\"C-64375r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JQMn5/vnaierr1Bn8RdFDmS3S/rF6buFn2nIXZkcNV8=\"},\"F-69555r1_fix\",\"V-63625\",\"medium\",\"WN10-SO-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4539,\"SV-78115r1_rule\",\"medium\",null,null,\"The built-in guest account must be renamed.\",\"WN10-SO-000025\",\"The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password.  This can allow access to system resources by unauthorized users.  Renaming this account to an unidentified name improves the protection of this account and the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1cHjpZpWasXrNs38blIHXTCAsBeBydKm/FoVbD6YN9E=\"},\"C-64377r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:V7ZlwpHZNkAvZqc5or/lGETYCwAVfpt6oCJMf/fAvo8=\"},\"F-69557r1_fix\",\"V-63627\",\"medium\",\"WN10-CC-000115\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4540,\"SV-78117r1_rule\",\"medium\",null,null,\"Systems must at least attempt device authentication using certificates.\",\"WN10-CC-000115\",\"Using certificates to authenticate devices to the domain provides increased security over passwords.  By default systems will attempt to authenticate using certificates and fall back to passwords if the domain controller does not support certificates for devices.  This may also be configured to always use certificates for device authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJyg5YyGdmvNFobvn1b619ahBQSWRDA6UUW//FX4+mk=\"},\"C-64379r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lY/eHejF7uvV0G4iI3mWusJXcTrrzEH03ruzrhvLCmo=\"},\"F-69559r1_fix\",\"V-63629\",\"medium\",\"WN10-CC-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4541,\"SV-78119r1_rule\",\"medium\",null,null,\"The network selection user interface (UI) must not be displayed on the logon screen.\",\"WN10-CC-000120\",\"Enabling interaction with the network selection UI allows users to change connections to available networks without signing into Windows.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uFh0+SOkPBhoY4cKXKJkJcnyQ6+Tp4ycDdOaJohcCxk=\"},\"C-64385r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:S3TWBmC/Q5xYvT6ZGwAqTSxXSjKl6ycojEqE2r5j7fE=\"},\"F-69565r1_fix\",\"V-63633\",\"medium\",\"WN10-CC-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4542,\"SV-78123r1_rule\",\"medium\",null,null,\"Local users on domain-joined computers must not be enumerated.\",\"WN10-CC-000130\",\"The username is one part of logon credentials that could be used to gain access to a system.  Preventing the enumeration of users limits this information to authorized personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h25vRZXLu1TOtMH5HMSKvo8N5a+Q/ueTRDZ1vspmoQE=\"},\"C-64383r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MSIOrVvh0qZYj2W996i9HW1IJqNJZEwMkJGxNuP+Muw=\"},\"F-69563r1_fix\",\"V-63635\",\"medium\",\"WN10-SO-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4543,\"SV-78125r1_rule\",\"medium\",null,null,\"Audit policy using subcategories must be enabled.\",\"WN10-SO-000030\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.  This setting allows administrators to enable more precise auditing capabilities.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XPkkPkWSdvWEzxDy2sUWix6KC7aJBbG9RBZ/ZnYOGEs=\"},\"C-64389r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:LEy76jPorTWw92lJJwWwEpX5AWnnZBJsINVU5Ic6wqw=\"},\"F-69567r1_fix\",\"V-63639\",\"medium\",\"WN10-SO-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4544,\"SV-78129r1_rule\",\"medium\",null,null,\"Outgoing secure channel traffic must be encrypted or signed.\",\"WN10-SO-000035\",\"Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted.  If this policy is enabled, outgoing secure channel traffic will be encrypted and signed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wy/VGGvzW3UlJ37hiY+I8pUms7MXbP2SNpPKfNy1KIA=\"},\"C-64393r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B6kdQ18Xgf9RP4i2hQ6xycrV4CJUF/AJ5A51qWEH8H4=\"},\"F-69573r1_fix\",\"V-63643\",\"medium\",\"WN10-SO-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4545,\"SV-78133r1_rule\",\"medium\",null,null,\"Outgoing secure channel traffic must be encrypted when possible.\",\"WN10-SO-000040\",\"Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted.  If this policy is enabled, outgoing secure channel traffic will be encrypted.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i3fRKcUyn6PmTSkp0ufLDEGZMye3xAQxD4OpV2pM+0E=\"},\"C-64395r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y1MVZH5v2L2aqAimA3zA6ZxTn0xqMdKaQ22coYGtUro=\"},\"F-69575r1_fix\",\"V-63645\",\"medium\",\"WN10-CC-000145\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4546,\"SV-78135r1_rule\",\"medium\",null,null,\"Users must be prompted for a password on resume from sleep (on battery).\",\"WN10-CC-000145\",\"Authentication must always be required when accessing a system.  This setting ensures the user is prompted for a password on resume from sleep (on battery).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/cJizcUtpE2HLtuWkhVN3GiOSFjewXuYn9IJu3enAXg=\"},\"C-64397r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rRnpzXQnQ5Wg5SL2m++bXGkzUESeCy/W5r2TeBxdxbg=\"},\"F-69577r1_fix\",\"V-63647\",\"medium\",\"WN10-SO-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4547,\"SV-78137r1_rule\",\"medium\",null,null,\"Outgoing secure channel traffic must be signed when possible.\",\"WN10-SO-000045\",\"Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked.  If this policy is enabled, outgoing secure channel traffic will be signed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xC0vDkioBtR1JLW2HOIxcJl4n0eOz6yTkhlZetuLhI8=\"},\"C-64399r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KH892YjfVsGxJYUZGSE0lrd0LppIf/7wFaiIkL6y2mw=\"},\"F-69579r1_fix\",\"V-63649\",\"medium\",\"WN10-CC-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4548,\"SV-78139r1_rule\",\"medium\",null,null,\"The user must be prompted for a password on resume from sleep (plugged in).\",\"WN10-CC-000150\",\"Authentication must always be required when accessing a system.  This setting ensures the user is prompted for a password on resume from sleep (plugged in).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NSgu6s8JKNnXMJ+7CGkFNsLqlJAeYQviKDinQTL+FHo=\"},\"C-64401r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SCyv3bW6lq4Ib1jbv9NTvnfRDTnThjV154hBBpa9mpA=\"},\"F-69581r1_fix\",\"V-63651\",\"high\",\"WN10-CC-000155\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4549,\"SV-78141r1_rule\",\"high\",null,null,\"Solicited Remote Assistance must not be allowed.\",\"WN10-CC-000155\",\"Remote assistance allows another user to view or take control of the local session of a user.  Solicited assistance is help that is specifically requested by the local user.  This may allow unauthorized parties access to the resources on the computer.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:z2vvY1cDmkJvQsHfPOfw8QGJtMOKrIQz9lM3Dc0ytLo=\"},\"C-64707r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:r1bXexq2A1T9qVaB1K5kWuqDXKMQxIjhQ7WYiQDjmxA=\"},\"F-69885r1_fix\",\"V-63653\",\"low\",\"WN10-SO-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4550,\"SV-78143r1_rule\",\"low\",null,null,\"The computer account password must not be prevented from being reset.\",\"WN10-SO-000050\",\"Computer account passwords are changed automatically on a regular basis.  Disabling automatic password changes can make the system more vulnerable to malicious access.  Frequent password changes can be a significant safeguard for your system.  A new password for the computer account will be generated every 30 days.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:14JhGWVp+3S3ydTw3+p8k3X7npjABreOsd4BluBaRyo=\"},\"C-64405r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:AJ6JG4Bk6Dmp1BoAnVEPIilP5krfqcIj8GC43w2lHpQ=\"},\"F-69585r1_fix\",\"V-63657\",\"medium\",\"WN10-CC-000165\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4551,\"SV-78147r1_rule\",\"medium\",null,null,\"Unauthenticated RPC clients must be restricted from connecting to the RPC server.\",\"WN10-CC-000165\",\"Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZJbz3VhLvqjcd2z7NP6j6DC8M0Ltzl3HDFROf1Cpu4o=\"},\"C-81359r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:D1jcVX/W+b0YHzhQERbs67mDWibaHlED0dBMhDjh+wM=\"},\"F-69587r1_fix\",\"V-63659\",\"low\",\"WN10-CC-000170\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4552,\"SV-78149r2_rule\",\"low\",null,null,\"The setting to allow Microsoft accounts to be optional for modern style apps must be enabled.\",\"WN10-CC-000170\",\"Control of credentials and the system must be maintained within the enterprise.  Enabling this setting allows enterprise credentials to be used with modern style apps that support this, instead of Microsoft accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LaaMQgJOQrkO4EB1mnVDnZdeYz6iDashNKpqfHpNCck=\"},\"C-64409r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dL89jp1SO4omws1FGgPrtRlbGuoByCOZPICM5E1jDiY=\"},\"F-69589r1_fix\",\"V-63661\",\"low\",\"WN10-SO-000055\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4553,\"SV-78151r1_rule\",\"low\",null,null,\"The maximum age for machine account passwords must be configured to 30 days or less.\",\"WN10-SO-000055\",\"Computer account passwords are changed automatically on a regular basis.  This setting controls the maximum password age that a machine account may have.  This setting must be set to no more than 30 days, ensuring the machine changes its password monthly.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ye6LltMKmAmswLhHjkhNL7Oek9ZBv20d40WEFxLqoNg=\"},\"C-64411r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sCxZiiwjgSm8OBwRBkMz35gsmx1vpXnwyeoVinYH7r0=\"},\"F-69591r1_fix\",\"V-63663\",\"low\",\"WN10-CC-000175\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4554,\"SV-78153r1_rule\",\"low\",null,null,\"The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.\",\"WN10-CC-000175\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kcyr2a0EWEiUBvmVmyDq0M6j4K7/nBHuXmLhXDDtMf0=\"},\"C-64413r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:t+sRZ4X7MaovbPwgqWxtT6hCeHZM05XnF3CRYEMVCGI=\"},\"F-69593r1_fix\",\"V-63665\",\"medium\",\"WN10-SO-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4555,\"SV-78155r1_rule\",\"medium\",null,null,\"The system must be configured to require a strong session key.\",\"WN10-SO-000060\",\"A computer connecting to a domain controller will establish a secure channel.  Requiring strong session keys enforces 128-bit encryption between systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BLkX1RSbTxRJ+95+jkVEEKAtY1YFGp7VUwcyz/Na6PU=\"},\"C-64415r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ci3qw7pjUYic7vCIX1T40x6Xh/O32MzD07IpvzY758M=\"},\"F-69595r1_fix\",\"V-63667\",\"high\",\"WN10-CC-000180\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4556,\"SV-78157r1_rule\",\"high\",null,null,\"Autoplay must be turned off for non-volume devices.\",\"WN10-CC-000180\",\"Allowing autoplay to execute may introduce malicious code to a system.  Autoplay begins reading from a drive as soon as you insert media in the drive.  As a result, the setup file of programs or music on audio media may start.  This setting will disable autoplay for non-volume devices (such as Media Transfer Protocol (MTP) devices).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mhjrBvHTfJT/OuyLZFDHWxfbvJ3FuijQKPyHh2cvxks=\"},\"C-81353r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mfhw1BAvPFkq7MsuxZE2GyQ/AevVwWiMvufEzfNp6VE=\"},\"F-88429r1_fix\",\"V-63669\",\"medium\",\"WN10-SO-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4557,\"SV-78159r2_rule\",\"medium\",null,null,\"The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.\",\"WN10-SO-000070\",\"Unattended systems are susceptible to unauthorized use and should be locked when unattended.  The screen saver should be set at a maximum of 15 minutes and be password protected.  This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/dizhsZDVZiRpJUm04AvJkfxcjGg5bvtRPbE3Iajy3s=\"},\"C-64419r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Gr1LIZVQ5mNlMy66aYVrA/OKjqKZjPX33xTO3LoND90=\"},\"F-69599r1_fix\",\"V-63671\",\"high\",\"WN10-CC-000185\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4558,\"SV-78161r1_rule\",\"high\",null,null,\"The default autorun behavior must be configured to prevent autorun commands.\",\"WN10-CC-000185\",\"Allowing autorun commands to execute may introduce malicious code to a system.  Configuring this setting prevents autorun commands from executing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CffkXvxske/bT7jvs4za5BpRLmJrKhgTOflYgSJF+X8=\"},\"C-64423r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:IUYeFsIgc0Up3cMziGmWNHQALhhDmlYfxEV3mw5cFBY=\"},\"F-69603r1_fix\",\"V-63673\",\"high\",\"WN10-CC-000190\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4559,\"SV-78163r1_rule\",\"high\",null,null,\"Autoplay must be disabled for all drives.\",\"WN10-CC-000190\",\"Allowing autoplay to execute may introduce malicious code to a system.  Autoplay begins reading from a drive as soon as you insert media in the drive.  As a result, the setup file of programs or music on audio media may start.  By default, autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives.  If you enable this policy, you can also disable autoplay on all drives.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XgzulLjMBxHaNi0V9FHGyZ4It0yWcGbG1JwlFE+T+gk=\"},\"C-64421r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:98laJ6VbZ66jMMUQv5GDvBJWVZDOUd4XtWFuq8asTIo=\"},\"F-69601r2_fix\",\"V-63675\",\"medium\",\"WN10-SO-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4560,\"SV-78165r2_rule\",\"medium\",null,null,\"The required legal notice must be configured to display before console logon.\",\"WN10-SO-000075\",\"Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OHgYhVcmu/l9dVrJ0J5Uo4d4+lLD5rAkwUYwACRT+m0=\"},\"C-81361r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:inbVIW+zQG3/ufZ8fCHtpsqygHo1uhE9Z0Shi7JWHpw=\"},\"F-88435r1_fix\",\"V-63677\",\"medium\",\"WN10-CC-000195\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4561,\"SV-78167r3_rule\",\"medium\",null,null,\"Enhanced anti-spoofing for facial recognition must be enabled on Window 10.\",\"WN10-CC-000195\",\"Enhanced anti-spoofing provides additional protections when using facial recognition with devices that support it.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ofnzmLY6Mws9d7/NtnKBQB4fhzW4stZa4Q8pqud3RuA=\"},\"C-64429r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eLSnY8PHloz7mHtwdf09lPI2PMpuTsKmw/S+HhFSiGg=\"},\"F-69607r1_fix\",\"V-63679\",\"medium\",\"WN10-CC-000200\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4562,\"SV-78169r1_rule\",\"medium\",null,null,\"Administrator accounts must not be enumerated during elevation.\",\"WN10-CC-000200\",\"Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user.  This setting configures the system to always require users to type in a username and password to elevate a running application.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PHPF3Sy5sq6u5phRafA9yRglmtGg7XcKsUmsucub7jI=\"},\"C-64427r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gIHgnFLTdgMMsxBcIBxDElwInOkJE+8HJcwwDdRpq1w=\"},\"F-69609r1_fix\",\"V-63681\",\"low\",\"WN10-SO-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4563,\"SV-78171r1_rule\",\"low\",null,null,\"The Windows dialog box title for the legal banner must be configured.\",\"WN10-SO-000080\",\"Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:32jv43ZfzeffcLH0aNzUt/YSBnCyNLyRuby1CRN3yVw=\"},\"C-81949r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PzcejMlMlof9m/YZ/3j1NJUegoGppEgEiwd19VfFIm8=\"},\"F-89003r2_fix\",\"V-63683\",\"medium\",\"WN10-CC-000205\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4564,\"SV-78173r3_rule\",\"medium\",null,null,\"Windows Telemetry must not be configured to Full.\",\"WN10-CC-000205\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The \\\"Security\\\" option for Telemetry configures the lowest amount of data, effectively none outside of the Malicious Software Removal Tool (MSRT), Defender and telemetry client settings. \\\"Basic\\\" sends basic diagnostic and usage data and may be required to support some Microsoft services. \\\"Enhanced\\\" includes additional information on how Windows and apps are used and advanced reliability data. Windows Analytics can use a \\\"limited enhanced\\\" level to provide information such as health data for devices.  This requires the configuration of an additional setting available with v1709 and later of Windows 10. \",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SoCQzVKKVy7D5huRMI4Q7iyWO6PyUB9uG8vv4geQuQA=\"},\"C-91419r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jQ03pjP3CjGlYCQ/xCpujUMyYmW/fh9NqhCgqPd06zo=\"},\"F-98461r1_fix\",\"V-63685\",\"medium\",\"WN10-CC-000210\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4565,\"SV-78175r6_rule\",\"medium\",null,null,\"The Windows Defender SmartScreen for Explorer must be enabled.\",\"WN10-CC-000210\",\"Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling Windows Defender SmartScreen will warn or prevent users from running potentially malicious programs.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OtsqfrQg9GojUClvvmL4jzwvRg7kIHzjol+WcskfN8k=\"},\"C-64433r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+8vO2vy7uTxR2XHqPadadMrjS2Rni8BOSZVXO6X2Avk=\"},\"F-69615r1_fix\",\"V-63687\",\"low\",\"WN10-SO-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4566,\"SV-78177r1_rule\",\"low\",null,null,\"Caching of logon credentials must be limited.\",\"WN10-SO-000085\",\"The default Windows configuration caches the last logon credentials for users who log on interactively to a system.  This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable.  Even though the credential cache is well-protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pwvSQ+QN5KMngq6whT389oqgH7svUP44geVmJrGKA/Y=\"},\"C-64437r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:i2FiglDJfXybGpBxBjVYKAGi+YYUMg5nL518GU9EkhY=\"},\"F-69617r1_fix\",\"V-63689\",\"medium\",\"WN10-CC-000215\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4567,\"SV-78179r1_rule\",\"medium\",null,null,\"Explorer Data Execution Prevention must be enabled.\",\"WN10-CC-000215\",\"Data Execution Prevention (DEP) provides additional protection by performing  checks on memory to help prevent malicious code from running.  This setting will prevent Data Execution Prevention from being turned off for File Explorer.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FNuzYuatOsVqoAEfYyh44rPDU4p+dXmH2F/22ijPNG8=\"},\"C-72013r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dad3JOoYi4XhqeCDfFPaRfjDET/qOlbEcf8JrcuFYnU=\"},\"F-78109r3_fix\",\"V-63691\",\"low\",\"WN10-CC-000220\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4568,\"SV-78181r3_rule\",\"low\",null,null,\"Turning off File Explorer heap termination on corruption must be disabled.\",\"WN10-CC-000220\",\"Legacy plug-in applications may continue to function when a File Explorer session has become corrupt.  Disabling this feature will prevent this.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ka0gdKnu1i6pDqDBmfSv/etIgqsSnYvxwHo6vjDl/lA=\"},\"C-64443r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8iVJn6AEeEs7abM6FXII1UWcGL2f5acmsBIocVJzJ74=\"},\"F-69623r1_fix\",\"V-63695\",\"medium\",\"WN10-CC-000225\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4569,\"SV-78185r1_rule\",\"medium\",null,null,\"File Explorer shell protocol must run in protected mode.\",\"WN10-CC-000225\",\"The shell protocol will  limit the set of folders applications can open when run in protected mode.  Restricting files an application can open, to a limited set of folders, increases the security of Windows.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v8lM7FP7aQdAEqhdWAElG8v5N9aKZNjsXI3sO16UBJ8=\"},\"C-64445r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cjPwupCSR0TrHEYD/6TMlvONcdLHPWcCMHuTwwt9ubw=\"},\"F-69625r1_fix\",\"V-63697\",\"medium\",\"WN10-SO-000095\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4570,\"SV-78187r1_rule\",\"medium\",null,null,\"The Smart Card removal option must be configured to Force Logoff or Lock Workstation.\",\"WN10-SO-000095\",\"Unattended systems are susceptible to unauthorized use and must be locked.  Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nBBbWUKMYR0oBuDR1T1+MwPCSPwa/PvvTXckuCFHxcY=\"},\"C-79101r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B9S7hFWHqEWN+xF+QGr88dcbc2DFAnUZfPLb3qgLQUE=\"},\"F-98463r1_fix\",\"V-63699\",\"medium\",\"WN10-CC-000230\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4571,\"SV-78189r6_rule\",\"medium\",null,null,\"Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for malicious websites in Microsoft Edge.\",\"WN10-CC-000230\",\"The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites and file downloads.  If users are allowed to ignore warnings from the Windows Defender SmartScreen filter they could still access malicious websites.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nWoWY5Y4H2PjarlDCeZzumdmSKNqLLbQWB6PRDqTQik=\"},\"C-79105r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5BF6ShWtQQz6m2f5qGYgXrEcVyiHrphKl41vORKvwJo=\"},\"F-98465r1_fix\",\"V-63701\",\"medium\",\"WN10-CC-000235\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4572,\"SV-78191r6_rule\",\"medium\",null,null,\"Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for unverified files in Microsoft Edge.\",\"WN10-CC-000235\",\"The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites and file downloads.  If users are allowed to ignore warnings from the Windows Defender SmartScreen filter they could still download potentially malicious files.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YHHxKYwoRYjDWym4IH18cuhmeP93GyehRyGY9+eWOlM=\"},\"C-64451r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4OStpL8M7nd4yILh53YYVghkFMSc6KpjP7exx+P68bw=\"},\"F-69629r1_fix\",\"V-63703\",\"medium\",\"WN10-SO-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4573,\"SV-78193r1_rule\",\"medium\",null,null,\"The Windows SMB client must be configured to always perform SMB packet signing.\",\"WN10-SO-000100\",\"The server message block (SMB) protocol provides the basis for many network operations.  Digitally signed SMB packets aid in preventing man-in-the-middle attacks.  If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Vnj02lH1OuXdBOVVSKAmO3ADzTn5+Ujz8I1pVPj59vU=\"},\"C-79113r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:t8fAWmoC9793q7yjTkKodZAFyvN8+EQyAnQ3eKujeO8=\"},\"F-83245r1_fix\",\"V-63709\",\"medium\",\"WN10-CC-000245\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4574,\"SV-78199r4_rule\",\"medium\",null,null,\"The password manager function in the Edge browser must be disabled.\",\"WN10-CC-000245\",\"Passwords save locally for re-use when browsing may be subject to compromise.  Disabling the Edge password manager will prevent this for the browser.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I1hZ4Drt9YDDg3F9ZAzn33a90Yrg1/tAw/QcCCksE3A=\"},\"C-64459r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Tg8MEMQePeMwS+qS8PbB/4y6EDpxaFlUaj84ph6zmG4=\"},\"F-69639r1_fix\",\"V-63711\",\"medium\",\"WN10-SO-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4575,\"SV-78201r1_rule\",\"medium\",null,null,\"Unencrypted passwords must not be sent to third-party SMB Servers.\",\"WN10-SO-000110\",\"Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication.  Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment.  Check with the vendor of the SMB server to see if there is a way to support encrypted password authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2biNxxxfwe7Qz0rZRb+comoTPxV6tZ2FWyVQ8NR0XLI=\"},\"C-79115r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hTbZqwZ4fsK7/V09FctidZHUoPHmeOqxSidCPX6IxrM=\"},\"F-98467r1_fix\",\"V-63713\",\"medium\",\"WN10-CC-000250\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4576,\"SV-78203r6_rule\",\"medium\",null,null,\"The Windows Defender SmartScreen filter for Microsoft Edge must be enabled.\",\"WN10-CC-000250\",\"The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:K8//OPyNM3tMbqVbeoAI5KxKu5UgN3dLo2qeJqTTARk=\"},\"C-79119r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:p49q6xq7593kHJDfmQQpw38MtEgtBNAo+DiVb+PZ8PQ=\"},\"F-83247r2_fix\",\"V-63717\",\"medium\",\"WN10-CC-000255\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4577,\"SV-78207r5_rule\",\"medium\",null,null,\"The use of a hardware security device with Windows Hello for Business must be enabled.\",\"WN10-CC-000255\",\"The use of a Trusted Platform Module (TPM) to store keys for Windows Hello for Business provides additional security.  Keys stored in the TPM may only be used on that system while keys stored using software are more susceptible to compromise and could be used on other systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m4mVWgszCk8aLeRg9wcZWG+Rs/f7KjQGvMB6lRJ5A+M=\"},\"C-64467r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TlsXbmbT8RHk4qTd4l7iQC/kxVlACAHUoUo7IBK62Ag=\"},\"F-69647r1_fix\",\"V-63719\",\"medium\",\"WN10-SO-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4578,\"SV-78209r1_rule\",\"medium\",null,null,\"The Windows SMB server must be configured to always perform SMB packet signing.\",\"WN10-SO-000120\",\"The server message block (SMB) protocol provides the basis for many network operations.  Digitally signed SMB packets aid in preventing man-in-the-middle attacks.  If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GJyj8KhT2aDTkrVyy9e0G2Fw3bcs2GwK50H4fhiljcA=\"},\"C-64469r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2vvlS11rewnsG4aJFvEFbTIXj6FDxFe+II7GRviyH8Y=\"},\"F-98469r2_fix\",\"V-63721\",\"medium\",\"WN10-CC-000260\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4579,\"SV-78211r6_rule\",\"medium\",null,null,\"Windows 10 must be configured to require a minimum pin length of six characters or greater.\",\"WN10-CC-000260\",\"Windows allows the use of PINs as well as biometrics for authentication without sending a password to a network or website where it could be compromised.  Longer minimum PIN lengths increase the available combinations an attacker would have to attempt.  Shorter minimum length significantly reduces the strength.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RzUSnNAkaFL0vjIzRXyocD/1metNOIhllvi1eHyUE/0=\"},\"C-64479r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:seII/mAuw6P+r2G+ksL9Z1Aks3FE2FZ6U+SN6Gtn1r4=\"},\"F-69657r1_fix\",\"V-63729\",\"medium\",\"WN10-CC-000270\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4580,\"SV-78219r1_rule\",\"medium\",null,null,\"Passwords must not be saved in the Remote Desktop Client.\",\"WN10-CC-000270\",\"Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system.  The system must be configured to prevent users from saving passwords in the Remote Desktop Client.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9Pbb8VW3GGoFqiMEMNsF6+ETyP17aJ7LEE/EwiZmXLY=\"},\"C-64481r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FLcKXmX9gyKTpr/8udHNEwcKZ4rFm5s3IrSYYuIhZio=\"},\"F-69659r1_fix\",\"V-63731\",\"medium\",\"WN10-CC-000275\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4581,\"SV-78221r1_rule\",\"medium\",null,null,\"Local drives must be prevented from sharing with Remote Desktop Session Hosts.\",\"WN10-CC-000275\",\"Preventing users from sharing the local drives on their client computers to Remote Session Hosts that they access helps reduce possible exposure of sensitive data.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pOkacn9XsLUUPvPCp7BiIdMobs3MmyoiiFdmo2S1Jh4=\"},\"C-64483r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VvnnQJPqecT+hGCdyEjfV7HVGJGunhW9nSTQ3QH37Ig=\"},\"F-69661r1_fix\",\"V-63733\",\"medium\",\"WN10-CC-000280\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4582,\"SV-78223r1_rule\",\"medium\",null,null,\"Remote Desktop Services must always prompt a client for passwords upon connection.\",\"WN10-CC-000280\",\"This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection.  Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:db4NX5ePYijTdjIZhHi6AMQwXOH25jy1YMRAOPp6z8o=\"},\"C-64487r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RM0/gj1Qt707JlUYlmbLvA1fy/6G/giJ85DeOs8B6dc=\"},\"F-69665r1_fix\",\"V-63737\",\"medium\",\"WN10-CC-000285\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4583,\"SV-78227r1_rule\",\"medium\",null,null,\"The Remote Desktop Session Host must require secure RPC communications.\",\"WN10-CC-000285\",\"Allowing unsecure RPC communication exposes the system to man in the middle attacks and data disclosure attacks. A man in the middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5oFtb8E3qwiXU282gaObtdqYpKDg1HKwTV1n0yGLwdM=\"},\"C-64489r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9sj/XY7wTDukfNd098czduTVWQutMeqhJuSaISLQsag=\"},\"F-69667r1_fix\",\"V-63739\",\"high\",\"WN10-SO-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4584,\"SV-78229r1_rule\",\"high\",null,null,\"Anonymous SID/Name translation must not be allowed.\",\"WN10-SO-000140\",\"Allowing anonymous SID/Name translation can provide sensitive information for accessing a system.  Only authorized users must be able to perform such translations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XK40On1j1swkBQC4KHrqqKtA3+PU7O8didBZ9X2v3mU=\"},\"C-64491r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9UXyqEvrfJKY1Z3d2vJfrn9DoiXbrUvbEcBkOzErot8=\"},\"F-69669r1_fix\",\"V-63741\",\"medium\",\"WN10-CC-000290\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4585,\"SV-78231r1_rule\",\"medium\",null,null,\"Remote Desktop Services must be configured with the client connection encryption set to the required level.\",\"WN10-CC-000290\",\"Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting \\\"High Level\\\" will ensure encryption of Remote Desktop Services sessions in both directions.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D+Br9Bp34FIbXISTUzTyziluj9wIh2NeP3T7rqIlBeU=\"},\"C-64495r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:yKSPAaHSRXGDmYNqGS2PbbzeQyT5KHe1NkItcInDozg=\"},\"F-69671r1_fix\",\"V-63743\",\"medium\",\"WN10-CC-000295\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4586,\"SV-78233r1_rule\",\"medium\",null,null,\"Attachments must be prevented from being downloaded from RSS feeds.\",\"WN10-CC-000295\",\"Attachments from RSS feeds may not be secure.  This setting will prevent attachments from being downloaded from RSS feeds.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:q4amaRBeQBzWaWDuh+jg7+M6Q2vE1slnyWZ9vRYL1BU=\"},\"C-64493r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:80tL2NQiJzWA+nvWYN6N/dITCvP4z3gJpjfnPCQLSx0=\"},\"F-69673r1_fix\",\"V-63745\",\"high\",\"WN10-SO-000145\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4587,\"SV-78235r1_rule\",\"high\",null,null,\"Anonymous enumeration of SAM accounts must not be allowed.\",\"WN10-SO-000145\",\"Anonymous enumeration of SAM accounts allows anonymous log on users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2hvdFSkHFd/jxnDg7QHAFnPQALuFWOVvLZGgRROj5l8=\"},\"C-64497r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kHkfZTI+A4AbE13Gdmo2ILJcZzgniSLt8HUZ5HyExjw=\"},\"F-69675r1_fix\",\"V-63747\",\"medium\",\"WN10-CC-000300\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4588,\"SV-78237r1_rule\",\"medium\",null,null,\"Basic authentication for RSS feeds over HTTP must not be used.\",\"WN10-CC-000300\",\"Basic authentication uses plain text passwords that could be used to compromise a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PH+4N2yTf3KYeI3LzoMmv9I7NMVl4gENYVtdt5aHEQ4=\"},\"C-64499r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YJU6GsJ3MJkZ8CijAZUKemQUh76XEXi6kyN5hwgRL4k=\"},\"F-69677r1_fix\",\"V-63749\",\"high\",\"WN10-SO-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4589,\"SV-78239r1_rule\",\"high\",null,null,\"Anonymous enumeration of shares must be restricted.\",\"WN10-SO-000150\",\"Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MT/QRJ+7T5KdEYjB1CflYUeHypJvbgQA/NoSivDno44=\"},\"C-64501r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ouSnIupvvqC0crPccT7gBXrFmsWkb2i86WiVIUjCbqs=\"},\"F-69679r1_fix\",\"V-63751\",\"medium\",\"WN10-CC-000305\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4590,\"SV-78241r1_rule\",\"medium\",null,null,\"Indexing of encrypted files must be turned off.\",\"WN10-CC-000305\",\"Indexing of encrypted files may expose sensitive data.  This setting prevents encrypted files from being indexed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PPMakW1bUBUuTQXNZEWFXjV3n8bqxzcAep6WCv0LA6I=\"},\"C-64505r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CIxgreCun2hEbE39zaL6XRLXsvYRN0yNWQFu3yL064E=\"},\"F-69683r1_fix\",\"V-63755\",\"medium\",\"WN10-SO-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4591,\"SV-78245r1_rule\",\"medium\",null,null,\"The system must be configured to prevent anonymous users from having the same rights as the Everyone group.\",\"WN10-SO-000160\",\"Access by anonymous users must be restricted.  If this setting is enabled, then anonymous users have the same rights and permissions as the built-in Everyone group.  Anonymous users must not have these permissions or rights.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+CqVPSzadLgqURUz9jpa2vfnE9s9rDLe5PbBuASRgh0=\"},\"C-64509r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lmEqFepqElh4JHMGSs+lVIjqQ7WBg0SLMTdPF7FkJuo=\"},\"F-69687r1_fix\",\"V-63759\",\"high\",\"WN10-SO-000165\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4592,\"SV-78249r1_rule\",\"high\",null,null,\"Anonymous access to Named Pipes and Shares must be restricted.\",\"WN10-SO-000165\",\"Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access.  This setting restricts access to those defined in \\\"Network access: Named Pipes that can be accessed anonymously\\\" and \\\"Network access: Shares that can be accessed anonymously\\\",  both of which must be blank under other requirements.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m79WMkHt8ZOH03cNAv+YgwDxku23Nclna/dukfCHBwE=\"},\"C-64517r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/pAKglnnL1IEuLqBC+c6SyiwacUUiL1rDYa3onzxiNc=\"},\"F-69693r1_fix\",\"V-63765\",\"medium\",\"WN10-SO-000180\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4593,\"SV-78255r1_rule\",\"medium\",null,null,\"NTLM must be prevented from falling back to a Null session.\",\"WN10-SO-000180\",\"NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bu7KdaDw/5/s3TIiuDAAhnNsO3EvwivuJyQ8TxBRC2k=\"},\"C-64519r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:L0C4ySCZnL+TtFW8F+lv8g72upyUuF1Zn/Zw3K0bzl0=\"},\"F-69695r1_fix\",\"V-63767\",\"medium\",\"WN10-SO-000185\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4594,\"SV-78257r1_rule\",\"medium\",null,null,\"PKU2U authentication using online identities must be prevented.\",\"WN10-SO-000185\",\"PKU2U is a peer-to-peer authentication protocol.   This setting prevents online identities from authenticating to domain-joined systems.  Authentication will be centrally managed with Windows user accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WBduyUoS7ji0lJWOQsFV1TVIPhzv+GArzEJ9SaioyCg=\"},\"C-64545r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TGki+/+ykJXJ/k/DudIIisxNEy93XM3iv0yGY2fiKO8=\"},\"F-69723r2_fix\",\"V-63795\",\"medium\",\"WN10-SO-000190\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4595,\"SV-78285r1_rule\",\"medium\",null,null,\"Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.\",\"WN10-SO-000190\",\"Certain encryption types are no longer considered secure.  This setting configures a minimum encryption type for Kerberos, preventing the use of the DES and RC4 encryption suites.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:esvIIQzIXuuV6UAZCui3VcV9VGJeNpc//UNi3KoTS1w=\"},\"C-64547r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1Cv95OKFzyvZ4bRINC7Cv4fXGMtlaacMtNSowP9y7Ao=\"},\"F-69725r1_fix\",\"V-63797\",\"high\",\"WN10-SO-000195\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4596,\"SV-78287r1_rule\",\"high\",null,null,\"The system must be configured to prevent the storage of the LAN Manager hash of passwords.\",\"WN10-SO-000195\",\"The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords.  This setting controls whether or not a LAN Manager hash of the password is stored in the SAM the next time the password is changed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5qXivRds1q8g/9HnQ9nxJHz6twXtapACZhIt29psYMg=\"},\"C-64551r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0wdY1oOmLJZYVMb3ewPDolyocCYSxXOPJ+0XcVfOE5o=\"},\"F-69729r1_fix\",\"V-63801\",\"high\",\"WN10-SO-000205\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4597,\"SV-78291r1_rule\",\"high\",null,null,\"The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.\",\"WN10-SO-000205\",\"The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts.  NTLM, which is less secure, is retained in later Windows versions  for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it.  It is also used to authenticate logons to stand-alone computers that are running later versions.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YGadfMPpS3VMGBFW+r3ZcBbI9dYCCdc/zyMG4vKxtCU=\"},\"C-64553r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:UfsUJ6+QhNp9kcpFKuqZcTmy3ALjhtMSAGFmNACo9AY=\"},\"F-69731r1_fix\",\"V-63803\",\"medium\",\"WN10-SO-000210\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4598,\"SV-78293r1_rule\",\"medium\",null,null,\"The system must be configured to the required LDAP client signing level.\",\"WN10-SO-000210\",\"This setting controls the signing requirements for LDAP clients.  This setting must be set to Negotiate signing or Require signing, depending on the environment and type of LDAP server in use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wPbkf7isP1x09ZPgzKuJL8TtdkHaTA1/d8tDtGfpybs=\"},\"C-64555r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1+ExGyHoKNbg9f2hPevtLVyViy0jw9P1CLvJYNnLXyA=\"},\"F-69733r1_fix\",\"V-63805\",\"medium\",\"WN10-SO-000215\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4599,\"SV-78295r1_rule\",\"medium\",null,null,\"The system must be configured to meet the minimum session security requirement for NTLM SSP based clients.\",\"WN10-SO-000215\",\"Microsoft has implemented a variety of security support providers for use with RPC sessions.  All of the options must be enabled to ensure the maximum security level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gvDKD+YMxXb3Dbh+NdpQ/LmlaxOytN56P+kbBAhz7EA=\"},\"C-64557r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cx68iW81VjvTZ8JCOTGJY+ZkDwZAyi58zqvh9W0D+oY=\"},\"F-69735r1_fix\",\"V-63807\",\"medium\",\"WN10-SO-000220\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4600,\"SV-78297r1_rule\",\"medium\",null,null,\"The system must be configured to meet the minimum session security requirement for NTLM SSP based servers.\",\"WN10-SO-000220\",\"Microsoft has implemented a variety of security support providers for use with RPC sessions.  All of the options must be enabled to ensure the maximum security level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QgLpxb9vltYJFW7KY8eBS23IB732VOg5sO/3heYiTSY=\"},\"C-64561r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:93DcQLMka1EstIPvjGFGOJ5foKzfD1YZE+HUfIx9paw=\"},\"F-69739r1_fix\",\"V-63811\",\"medium\",\"WN10-SO-000230\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4601,\"SV-78301r1_rule\",\"medium\",null,null,\"The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.\",\"WN10-SO-000230\",\"This setting ensures that the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing.  FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QiljZhB01LqOQfbiDH4gdszZSQwiokE7rvHMNETmntI=\"},\"C-64565r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dCyIjTSOsteLs196W+MDtMhL8jnRdoLpKwA+nvvWzmg=\"},\"F-69743r1_fix\",\"V-63815\",\"low\",\"WN10-SO-000240\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4602,\"SV-78305r1_rule\",\"low\",null,null,\"The default permissions of global system objects must be increased.\",\"WN10-SO-000240\",\"Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. If this policy is enabled, the default DACL is stronger, allowing non-admin users to read shared objects, but not modify shared objects that they did not create.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9xKCBYF3X03GOrS60NZkKP1tRU65uLNh/SvSEhv7qzY=\"},\"C-64567r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1f85JbcxwG6eJsI6OJtbVtsrFjIPElpHt9NkyJmdOBc=\"},\"F-69745r1_fix\",\"V-63817\",\"medium\",\"WN10-SO-000245\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4603,\"SV-78307r1_rule\",\"medium\",null,null,\"User Account Control approval mode for the built-in Administrator must be enabled.\",\"WN10-SO-000245\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures the built-in Administrator account so that it runs in Admin Approval Mode.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6anIfcvLd9P3Qqj21QYsvMEK1vkh6OjqA8kxfY/qKRI=\"},\"C-64569r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:m0c1pC4N9864TRC68Ar0oJjxRt++R+ocV6OA/6pOhUQ=\"},\"F-69747r1_fix\",\"V-63819\",\"medium\",\"WN10-SO-000250\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4604,\"SV-78309r1_rule\",\"medium\",null,null,\"User Account Control must, at minimum, prompt administrators for consent on the secure desktop.\",\"WN10-SO-000250\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures the elevation requirements for logged on administrators to complete a task that requires raised privileges.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2Mf6LpRtxqJ2Xi014C6XdUKrfkVm1If47khfoSg5IPk=\"},\"C-64571r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:N/o1L9Q+AUc8QsP9dAiLMwg8rm0IExtcCSPzA1bf5Po=\"},\"F-69749r1_fix\",\"V-63821\",\"medium\",\"WN10-SO-000255\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4605,\"SV-78311r1_rule\",\"medium\",null,null,\"User Account Control must automatically deny elevation requests for standard users.\",\"WN10-SO-000255\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  Denying elevation requests from standard user accounts requires tasks that need elevation to be initiated by accounts with administrative privileges.  This ensures correct accounts are used on the system for privileged tasks to help mitigate credential theft.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xIxQC3EFtKo4/I03k/uVVwqUkFC9effmNV1HiiiVNas=\"},\"C-64575r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:c3FJiPcRTQKsbimXW346V6o1aEmBxxUjtvc6xMkzBuk=\"},\"F-69753r1_fix\",\"V-63825\",\"medium\",\"WN10-SO-000260\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4606,\"SV-78315r1_rule\",\"medium\",null,null,\"User Account Control must be configured to detect application installations and prompt for elevation.\",\"WN10-SO-000260\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting requires Windows to respond to application installation requests by prompting for credentials.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8HK3jPasJRJpBZDqSPFQU1vxUyg5+aAI6SAka9PPlvc=\"},\"C-64577r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9i1/CQ1T55XT7+qRqaJr58Gz7WiZB48LYgpipcVwl8Y=\"},\"F-69755r1_fix\",\"V-63827\",\"medium\",\"WN10-SO-000265\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4607,\"SV-78317r1_rule\",\"medium\",null,null,\"User Account Control must only elevate UIAccess applications that are installed in secure locations.\",\"WN10-SO-000265\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\\\\System32 folders, to run with elevated privileges.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TXh7CT8eDFg9PQd3GuTWW0B0BM4p6bzG9FF1T+9Vv8s=\"},\"C-64579r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:A7Xg19vCL5Q1xW+Fj+Az/f5vpJcs5u/SrRq9BClkS1w=\"},\"F-69757r1_fix\",\"V-63829\",\"medium\",\"WN10-SO-000270\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4608,\"SV-78319r1_rule\",\"medium\",null,null,\"User Account Control must run all administrators in Admin Approval Mode, enabling UAC.\",\"WN10-SO-000270\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting enables UAC.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jTdDk2qrsY7wk2fxd9JsCbcokx4k7p+QSN/VYmbUB9k=\"},\"C-64581r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Xl6F0faD877NphGnac4TlBR9h7CQODCKRBJEbkazvZw=\"},\"F-69759r1_fix\",\"V-63831\",\"medium\",\"WN10-SO-000275\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4609,\"SV-78321r1_rule\",\"medium\",null,null,\"User Account Control must virtualize file and registry write failures to per-user locations.\",\"WN10-SO-000275\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures non-UAC compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ps+f+j5cOJetWmfgZFHPTjOUfHH002d19GW01SZ35RY=\"},\"C-64589r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kTK1HAiRWb7wh2x/972MVh76uwhKv3aK9KX756oAZUQ=\"},\"F-69767r1_fix\",\"V-63839\",\"low\",\"WN10-UC-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4610,\"SV-78329r1_rule\",\"low\",null,null,\"Toast notifications to the lock screen must be turned off.\",\"WN10-UC-000015\",\"Toast notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel.  Turning off this feature will limit access to the information to a logged on user.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:31JR/6WQp6TuKxIQqNorrp6RBoUM0yhGJ95MVdPpzUw=\"},\"C-72015r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5Ot0vgTp8BQIqeYRzGXU6jF6SmJwLU7WpTomfAop3sk=\"},\"F-78717r1_fix\",\"V-63841\",\"medium\",\"WN10-UC-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4611,\"SV-78331r2_rule\",\"medium\",null,null,\"Zone information must be preserved when saving attachments.\",\"WN10-UC-000020\",\"Preserving zone of origin (internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4Q6F4dio1jN4MtIZbfGfkZnYkN6zfJazb6nB793l6nQ=\"},\"C-64593r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0P5EtYikbUi9E8oJtKWDfYRy9/apYtbEE8kRho3lm2s=\"},\"F-69771r1_fix\",\"V-63843\",\"medium\",\"WN10-UR-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4612,\"SV-78333r1_rule\",\"medium\",null,null,\"The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.\",\"WN10-UR-000005\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Access Credential Manager as a trusted caller\\\" user right may be able to retrieve the credentials of other accounts from Credential Manager.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:at5fqeVaC1Sm9FnXQjZ7YLh8ehuVr9z5FoeJZMIMABA=\"},\"C-78091r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dkn7S+ZGNYR6EDPqRbNd2XSN1OwzgDnpb8htRCC7PzI=\"},\"F-81289r1_fix\",\"V-63845\",\"medium\",\"WN10-UR-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4613,\"SV-78335r3_rule\",\"medium\",null,null,\"The Access this computer from the network user right must only be assigned to the Administrators and Remote Desktop Users groups.\",\"WN10-UR-000010\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Access this computer from the network\\\" user right may access resources on the system, and must be limited to those that require it.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8xkuF4nDSjRiPP+9oGCPnfWYPGGSOi17d7FbL0XhlU0=\"},\"C-64597r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lH+1d+CUETOJmmgPi4Eh1CmVaFGByIFqLf5MAj1QNCg=\"},\"F-69775r1_fix\",\"V-63847\",\"high\",\"WN10-UR-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4614,\"SV-78337r1_rule\",\"high\",null,null,\"The Act as part of the operating system user right must not be assigned to any groups or accounts.\",\"WN10-UR-000015\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Act as part of the operating system\\\" user right can assume the identity of any user and gain access to resources that user is authorized to access.  Any accounts with this right can take complete control of a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dq7TXJZ0aBQkd+AjwMgoDVp+n4UvOG8n1gEF82FEBlE=\"},\"C-81367r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Xl4LzBTTkELkCIZqGakC2Cs0g1urWrbMdVhJLuVCRPs=\"},\"F-88439r1_fix\",\"V-63851\",\"medium\",\"WN10-UR-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4615,\"SV-78341r2_rule\",\"medium\",null,null,\"The Allow log on locally user right must only be assigned to the Administrators and Users groups.\",\"WN10-UR-000025\",\"Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\\n\\nAccounts with the \\\"Allow log on locally\\\" user right can log on interactively to a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KEKE0PGxslNV0A6vemAzaWjzbx9nYy/RbiPhNJ3aL20=\"},\"C-64603r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wjp/q1GocHJDSKu6HUfJsuOtQPP0kDgmTKsCC7cxZyQ=\"},\"F-69781r1_fix\",\"V-63853\",\"medium\",\"WN10-UR-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4616,\"SV-78343r1_rule\",\"medium\",null,null,\"The Back up files and directories user right must only be assigned to the Administrators group.\",\"WN10-UR-000030\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Back up files and directories\\\" user right can circumvent file and directory permissions and could allow access to sensitive data.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cDiaxsqIK6oeD+TiOA04U8bzW/Xipep+PGUIszW1Ddg=\"},\"C-64605r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:U/cFLnQ/p+ew1NO2jk7jx27uLjZ7K4bhawkMyDg8moo=\"},\"F-69783r2_fix\",\"V-63855\",\"medium\",\"WN10-UR-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4617,\"SV-78345r2_rule\",\"medium\",null,null,\"The Change the system time user right must only be assigned to Administrators and Local Service and NT SERVICE\\\\autotimesvc.\",\"WN10-UR-000035\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Change the system time\\\" user right can change the system time, which can impact authentication, as well as affect time stamps on event log entries.\\n\\nThe NT SERVICE\\\\autotimesvc is added in v1909 cumulative update. \",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Wzi+dcfocDaL/BL8ZywSuiDTEG4Zv3kI5qdXUcl3y8E=\"},\"C-64607r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8zMCD/IKqVJ/fXFhi/Wm5Gh/E5mOCHccloPzGxq/4iE=\"},\"F-69785r1_fix\",\"V-63857\",\"medium\",\"WN10-UR-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4618,\"SV-78347r1_rule\",\"medium\",null,null,\"The Create a pagefile user right must only be assigned to the Administrators group.\",\"WN10-UR-000040\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Create a pagefile\\\" user right can change the size of a pagefile, which could affect system performance.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m3olQQDR+ylJqlRWob7mYvRuzE60jAwPG6gvqc+QNq4=\"},\"C-64609r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bG2PZaJNs9ecO6qKJICBZlSrM78VxxabO9H3M3EUQqc=\"},\"F-69787r2_fix\",\"V-63859\",\"high\",\"WN10-UR-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4619,\"SV-78349r1_rule\",\"high\",null,null,\"The Create a token object user right must not be assigned to any groups or accounts.\",\"WN10-UR-000045\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Create a token object\\\" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:srfyN9VEgB5cnpXOBY292RFK5lJspJquvD0ZD4TIQLE=\"},\"C-64611r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:3GTvWhd/A8LO+nyZwqP9YKzU+SgKstcEDws2u6mZ+To=\"},\"F-69789r1_fix\",\"V-63861\",\"medium\",\"WN10-UR-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4620,\"SV-78351r1_rule\",\"medium\",null,null,\"The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.\",\"WN10-UR-000050\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Create global objects\\\" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KcAj9nx0K1Jq/IEktNS9qbRss/b4npcbS1XEQ+S/Xm0=\"},\"C-64613r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:X34pPeycBlL0GZKXjB7Mt7WYIKastRoN1JjKquwVZIU=\"},\"F-69791r1_fix\",\"V-63863\",\"medium\",\"WN10-UR-000055\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4621,\"SV-78353r1_rule\",\"medium\",null,null,\"The Create permanent shared objects user right must not be assigned to any groups or accounts.\",\"WN10-UR-000055\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Create permanent shared objects\\\" user right could expose sensitive data by creating shared objects.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3c6IOQPBsJcn8+IGDfwZ5oHJ/hbHObilnQESAeOLePs=\"},\"C-76167r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SRTeMQOurz8bQYLytMEFTmCJvFFV5XxEwmHuSvNvjgc=\"},\"F-69793r1_fix\",\"V-63865\",\"medium\",\"WN10-UR-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4622,\"SV-78355r2_rule\",\"medium\",null,null,\"The Create symbolic links user right must only be assigned to the Administrators group.\",\"WN10-UR-000060\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Create symbolic links\\\" user right can create pointers to other objects, which could potentially expose the system to attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PgmqvkJqmLhRaPCQpSZZxUPFDDIdB1muY7/23B1nyZM=\"},\"C-64619r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TWMfw7k3V5v/oNV0mZHixqfTQgolQ5/LURmoZBPNyl8=\"},\"F-69797r1_fix\",\"V-63869\",\"high\",\"WN10-UR-000065\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4623,\"SV-78359r1_rule\",\"high\",null,null,\"The Debug programs user right must only be assigned to the Administrators group.\",\"WN10-UR-000065\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Debug Programs\\\" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components.  This right is given to Administrators in the default configuration.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qj88J123Y6ALiPB3Uh+vm0KvR68nqjRVdYVnlzC1rII=\"},\"C-81369r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:koH0FsedyUbc3GTxXlLNXKaLwWT6ld4COb/PHndEwvA=\"},\"F-88441r1_fix\",\"V-63871\",\"medium\",\"WN10-UR-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4624,\"SV-78361r3_rule\",\"medium\",null,null,\"The Deny access to this computer from the network user right on workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.\",\"WN10-UR-000070\",\"Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\\n\\nThe \\\"Deny access to this computer from the network\\\" right defines the accounts that are prevented from logging on from the network.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.\\n\\nLocal accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks.\\n\\nThe Guests group must be assigned this right to prevent unauthenticated access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gRYqjlzcylziTXB0rod7QdHFL/L5BST/gimkIhHW/vk=\"},\"C-64623r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QR8rMbfP0bYem6CaUDF4p4InJIAIp/WARLl1wr24J+U=\"},\"F-69801r1_fix\",\"V-63873\",\"medium\",\"WN10-UR-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4625,\"SV-78363r1_rule\",\"medium\",null,null,\"The Deny log on as a batch job user right on domain-joined workstations must be configured to prevent access from highly privileged domain accounts.\",\"WN10-UR-000075\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Deny log on as a batch job\\\" right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Hn5uwnn6gC1VwYXthEGUgC6ziFRTZscKIoUS++3Rjto=\"},\"C-94081r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:A3nadAl1DlKeOYbXl4/6ZUtaau9FUhRhgRq2BSyoVmg=\"},\"F-100993r1_fix\",\"V-63875\",\"medium\",\"WN10-UR-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4626,\"SV-78365r2_rule\",\"medium\",null,null,\"The Deny log on as a service user right on Windows 10 domain-joined workstations must be configured to prevent access from highly privileged domain accounts.\",\"WN10-UR-000080\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Deny log on as a service\\\" right defines accounts that are denied log on as a service.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain.\\n\\nIncorrect configurations could prevent services from starting and result in a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XTQwo3vFeHtIVTshIduv4IWitfBFRakuEQXlLRuSS24=\"},\"C-81371r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9VeeDgwQVkT/exUSjv6Ovcl8SUv7kU7mYlxF4qZCtb4=\"},\"F-88443r1_fix\",\"V-63877\",\"medium\",\"WN10-UR-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4627,\"SV-78367r2_rule\",\"medium\",null,null,\"The Deny log on locally user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems.\",\"WN10-UR-000085\",\"Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\\n\\nThe \\\"Deny log on locally\\\" right defines accounts that are prevented from logging on interactively.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.\\n\\nThe Guests group must be assigned this right to prevent unauthenticated access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oDnTVUc7IVAYvvMQbb1Wz03I5+3OQ5gnInH/2FTM+UQ=\"},\"C-94083r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nywkeJfphs8p9QmHEW6QIIy0cJ5ghfBoRh69uQw90SQ=\"},\"F-88445r1_fix\",\"V-63879\",\"medium\",\"WN10-UR-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4628,\"SV-78369r4_rule\",\"medium\",null,null,\"The Deny log on through Remote Desktop Services user right on Windows 10 workstations must at a minimum be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.\",\"WN10-UR-000090\",\"Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\\n\\nThe \\\"Deny log on through Remote Desktop Services\\\" right defines the accounts that are prevented from logging on using Remote Desktop Services.\\n\\nIf Remote Desktop Services is not used by the organization, the Everyone group must be assigned this right to prevent all access.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.\\n\\nLocal accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks.\\n\\nThe Guests group must be assigned this right to prevent unauthenticated access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HCUwYAohklOWhKjdCkwUXELBicl1aKdYsLlX2ENO5ZQ=\"},\"C-64631r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8hf+ttnXrBz3tjm15xWFy1gfNWxyAsg6g235d3bMNCU=\"},\"F-69809r1_fix\",\"V-63881\",\"medium\",\"WN10-UR-000095\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4629,\"SV-78371r1_rule\",\"medium\",null,null,\"The Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts.\",\"WN10-UR-000095\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Enable computer and user accounts to be trusted for delegation\\\" user right allows the \\\"Trusted for Delegation\\\" setting to be changed. This could potentially allow unauthorized users to impersonate other users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h8rwAYISD/28YdzSDaeuG5FpPZBqNPB9wT86XIfoUdE=\"},\"C-64633r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:esgXWycKuQZruggJyh9Ol7GwmEzQJm9SGb0QT0yUtfk=\"},\"F-69811r1_fix\",\"V-63883\",\"medium\",\"WN10-UR-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4630,\"SV-78373r1_rule\",\"medium\",null,null,\"The Force shutdown from a remote system user right must only be assigned to the Administrators group.\",\"WN10-UR-000100\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Force shutdown from a remote system\\\" user right can remotely shut down a system which could result in a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8ZljbVob0XqSwiA5dOYkrIecCXdmnQCug5ybd0v/x1Q=\"},\"C-64639r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:doKzrhFXOcBUCa8mb8oq2DvsmDq5V1THjTE/n8l3Qpk=\"},\"F-69817r1_fix\",\"V-63889\",\"medium\",\"WN10-UR-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4631,\"SV-78379r1_rule\",\"medium\",null,null,\"The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.\",\"WN10-UR-000110\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Impersonate a client after authentication\\\" user right allows a program to impersonate another user or account to run on their behalf. An attacker could potentially use this to elevate privileges.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zxCJ1n+/xpv4SXNOQLm6wAQSmkH1udVPy4xRJNH22s0=\"},\"C-64667r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SUCrurhykryvVKTz9GWJ3w9cTzGoZuL4CwNKapjj4Nk=\"},\"F-69845r1_fix\",\"V-63917\",\"medium\",\"WN10-UR-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4632,\"SV-78407r1_rule\",\"medium\",null,null,\"The Load and unload device drivers user right must only be assigned to the Administrators group.\",\"WN10-UR-000120\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Load and unload device drivers\\\" user right allows device drivers to dynamically be loaded on a system by a user. This could potentially be used to install malicious code by an attacker.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pvOcEpA+TB34F4cWCOGMSfSEkxZAfBUxITpDJmb9+K4=\"},\"C-64675r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6e9tpU5sJRuxuqMaLyEeFRtnGNCyAkndOHctlQh/p+U=\"},\"F-69853r1_fix\",\"V-63925\",\"medium\",\"WN10-UR-000125\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4633,\"SV-78415r1_rule\",\"medium\",null,null,\"The Lock pages in memory user right must not be assigned to any groups or accounts.\",\"WN10-UR-000125\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Lock pages in memory\\\" user right allows physical memory to be assigned to processes, which could cause performance issues or a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ntgurAdRh2vPTZ6v6uIm1vEBH6EsSEipSMq20DsG+D8=\"},\"C-64677r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KwWbfMfFZql+AKxylOLvygdGadkfUHQIq36+h28fZbI=\"},\"F-69855r1_fix\",\"V-63927\",\"medium\",\"WN10-UR-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4634,\"SV-78417r1_rule\",\"medium\",null,null,\"The Manage auditing and security log user right must only be assigned to the Administrators group.\",\"WN10-UR-000130\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Manage auditing and security log\\\" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zpJA36QZjPMfklit+NRW9GEdI9+UG+zGf4DOGG8XG6Y=\"},\"C-64681r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:T4llh+VCxuV2Fyk12sbY99zVphPSqjyrvbbuIsk6Koo=\"},\"F-69859r1_fix\",\"V-63931\",\"medium\",\"WN10-UR-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4635,\"SV-78421r1_rule\",\"medium\",null,null,\"The Modify firmware environment values user right must only be assigned to the Administrators group.\",\"WN10-UR-000140\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Modify firmware environment values\\\" user right can change hardware configuration environment variables. This could result in hardware failures or a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6Vr6sSumF5z/+2j4Jut2d6KaK1Nl8c/eF71h3mZz84s=\"},\"C-64683r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:58eSIVL8m7QzY3SYimfFF/nDuwl11WTOchEf/D6tXr4=\"},\"F-69861r1_fix\",\"V-63933\",\"medium\",\"WN10-UR-000145\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4636,\"SV-78423r1_rule\",\"medium\",null,null,\"The Perform volume maintenance tasks user right must only be assigned to the Administrators group.\",\"WN10-UR-000145\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Perform volume maintenance tasks\\\" user right can manage volume and disk configurations. They could potentially delete volumes, resulting in, data loss or a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U1jQim/n6VHAUZXYJaQi/HWtt7Q3k/5g/dZtKPgRpRQ=\"},\"C-64685r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+3g+iyx8lV+Qihe18EjHZbZtYJZYLaQjpr7hF1kjYls=\"},\"F-69863r1_fix\",\"V-63935\",\"medium\",\"WN10-UR-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4637,\"SV-78425r1_rule\",\"medium\",null,null,\"The Profile single process user right must only be assigned to the Administrators group.\",\"WN10-UR-000150\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Profile single process\\\" user right can monitor non-system processes performance. An attacker could potentially use this to identify processes to attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F0RPJGfwD1qORt7UmHAIsqA20ktqswUXeKiEMO4DFEw=\"},\"C-64691r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vS+hQSlGNf4MpRQS97hEvCTsa8GXWltEE7+gZiRNfqM=\"},\"F-69867r1_fix\",\"V-63939\",\"medium\",\"WN10-UR-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4638,\"SV-78429r1_rule\",\"medium\",null,null,\"The Restore files and directories user right must only be assigned to the Administrators group.\",\"WN10-UR-000160\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Restore files and directories\\\" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to over-write more current data.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hO/PQW/5C6I5rdjEwZhLARaC8GglwdI3lTW+tbXMeS4=\"},\"C-64693r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jVS0vRb7tWvU1r/KiIBkXQ8TK4yQsSDiLOS1ExWWxSk=\"},\"F-69869r1_fix\",\"V-63941\",\"medium\",\"WN10-UR-000165\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4639,\"SV-78431r1_rule\",\"medium\",null,null,\"The Take ownership of files or other objects user right must only be assigned to the Administrators group.\",\"WN10-UR-000165\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Take ownership of files or other objects\\\" user right can take ownership of objects and make changes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJSxQGzb7YGcY1mgBjeFquoDAw5e1lp1zoNJaIM2u2U=\"},\"C-76221r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B+8s7YEQR2Jk3MpIl5LKgCGEyxi7T3p2M4KNz6wxSII=\"},\"F-83251r4_fix\",\"V-65681\",\"low\",\"WN10-CC-000206\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4640,\"SV-80171r3_rule\",\"low\",null,null,\"Windows Update must not obtain updates from other PCs on the Internet.\",\"WN10-CC-000206\",\"Windows 10 allows Windows Update to obtain updates from additional sources instead of Microsoft. In addition to Microsoft, updates can be obtained from and sent to PCs on the local network as well as on the Internet. This is part of the Windows Update trusted process, however to minimize outside exposure, obtaining updates from or sending to systems on the Internet must be prevented.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nB5yZlxqxo8iNwRqReGtHbsRcruqk84xPSKCKzfrudk=\"},\"C-69305r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qf04bkgmMh7/Xtq1/PBpX+EZO4hz59RpQOM81gGA5K4=\"},\"F-74987r1_fix\",\"V-68817\",\"medium\",\"WN10-CC-000066\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4641,\"SV-83409r1_rule\",\"medium\",null,null,\"Command line data must be included in process creation events.\",\"WN10-CC-000066\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nEnabling \\\"Include command line data for process creation events\\\" will record the command line information with the process creation events in the log.  This can provide additional detail when malware has run on a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tlcocN55ZYxvkWqCrlKzS308hz23N1rtV+8aFeDnhcQ=\"},\"C-94087r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QdYlaeg3zVAWdJ4P3hyvRlPDwr0KB2zjCtlJZ+liF6c=\"},\"F-74989r1_fix\",\"V-68819\",\"medium\",\"WN10-CC-000326\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4642,\"SV-83411r2_rule\",\"medium\",null,null,\"PowerShell script block logging must be enabled on Windows 10.\",\"WN10-CC-000326\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nEnabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts.  This can provide additional detail when malware has run on a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:95Wge0r7A1nMcqH3gMcG1tsaCxT6bDaub3VeK5nHEcY=\"},\"C-77535r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:W9OT6/yKCLuomlNSX3QJrCYyprmuohy6rVi6tbgiyb8=\"},\"F-75017r2_fix\",\"V-68845\",\"high\",\"WN10-00-000145\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4643,\"SV-83439r2_rule\",\"high\",null,null,\"Data Execution Prevention (DEP) must be configured to at least OptOut.\",\"WN10-00-000145\",\"Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windows and other programs.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7XgAgPXMwnWi7uSIC/fqd46LXQjEefiQggfQCfHL7K8=\"},\"C-80163r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:irQUQvrkSAAacEmAqilJbT3/LE5inxDiqZKlYKlWBrE=\"},\"F-87295r1_fix\",\"V-68849\",\"high\",\"WN10-00-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4644,\"SV-83445r4_rule\",\"high\",null,null,\"Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.\",\"WN10-00-000150\",\"Attackers are constantly looking for vulnerabilities in systems and applications. Structured Exception Handling Overwrite Protection (SEHOP) blocks exploits that use the Structured Exception Handling overwrite technique, a common buffer overflow attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8QaHQQT2a/xX1mHR9JZYds+zZe9VKc6wZnVv2nVWTwg=\"},\"C-91429r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zTiS3h97x2piMq/0m0GdZt8rbZHJxutHF7zDTCd4M4U=\"},\"F-76869r1_fix\",\"V-70637\",\"medium\",\"WN10-00-000155\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4645,\"SV-85259r2_rule\",\"medium\",null,null,\"The Windows PowerShell 2.0 feature must be disabled on the system.\",\"WN10-00-000155\",\"Windows PowerShell 5.0 added advanced logging features which can provide additional detail when malware has been run on a system.  Disabling the Windows PowerShell 2.0 mitigates against a downgrade attack that evades the Windows PowerShell 5.0 script block logging feature.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LoHFxrEqFXMSEB8aLzNbxWm1sZAEoJAELFfMvbeXJWA=\"},\"C-74581r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rOBoCm3gFi8A59Xsp7O0G7tiYN6JL2ya9ecafxQRRDo=\"},\"F-76871r2_fix\",\"V-70639\",\"medium\",\"WN10-00-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4646,\"SV-85261r2_rule\",\"medium\",null,null,\"The Server Message Block (SMB) v1 protocol must be disabled on the system.\",\"WN10-00-000160\",\"SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.\\n\\nDisabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older Network Attached Storage (NAS) devices may only support SMBv1.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VfJcv2oibH4fO+7O/16d0DnpaUWHMb9vOGAlg65RKTw=\"},\"C-72017r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tY7XMVbdAbMzjSFZqqVfir/m4Sw0RJr73TvI0ORMx0c=\"},\"F-78111r2_fix\",\"V-71759\",\"medium\",\"WN10-AU-000054\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4647,\"SV-86383r2_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Account Lockout failures.\",\"WN10-AU-000054\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAccount Lockout events can be used to identify potentially malicious logon attempts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:spd2YfnamQST1NlVqvAqNOfFgfZkdothjKXNWgXmfX8=\"},\"C-72019r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XAYh9ZCmsN2u9vza7wzaPkjBtlPqL/UbBVes+PcPB/8=\"},\"F-78113r1_fix\",\"V-71761\",\"medium\",\"WN10-AU-000107\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4648,\"SV-86385r1_rule\",\"medium\",null,null,\"The system must be configured to audit Policy Change - Authorization Policy Change successes.\",\"WN10-AU-000107\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuthorization Policy Change records events related to changes in user rights, such as Create a token object.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cLWTmB4pH7+xPBjUvZx8mpG3gs+QxeJQobWa4u/txeE=\"},\"C-72021r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dLnDVN8s/91ti09nXwJxNczSs5bPSptsa4aYD4hcjvc=\"},\"F-78115r4_fix\",\"V-71763\",\"medium\",\"WN10-CC-000038\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4649,\"SV-86387r1_rule\",\"medium\",null,null,\"WDigest Authentication must be disabled.\",\"WN10-CC-000038\",\"When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft.  WDigest is disabled by default in Windows 10.  This setting ensures this is enforced.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A69vy1PsYlLcAzLy5BVJjqB9jb4HUwisI/dMcPrDcBI=\"},\"C-72023r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:IgFL5XwyUdOYZfdnbKixtFP+EGlN8oDS3gbBsSbv5Yw=\"},\"F-78117r2_fix\",\"V-71765\",\"medium\",\"WN10-CC-000044\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4650,\"SV-86389r1_rule\",\"medium\",null,null,\"Internet connection sharing must be disabled.\",\"WN10-CC-000044\",\"Internet connection sharing makes it possible for an existing internet connection, such as through wireless, to be shared and used by other systems essentially creating a mobile hotspot.  This exposes the system sharing the connection to others with potentially malicious purpose.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bnGEzcuJUAwCNZ4Ws5wyS5j2lY5Jgzk6QrlcnBXgb8o=\"},\"C-76223r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eGXZ+DOsdSkcmF3ldc2wW5VrVYYyaaP4oY0KtvzQ/Mg=\"},\"F-78121r3_fix\",\"V-71769\",\"medium\",\"WN10-SO-000167\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4651,\"SV-86393r3_rule\",\"medium\",null,null,\"Remote calls to the Security Account Manager (SAM) must be restricted to Administrators.\",\"WN10-SO-000167\",\"The Windows Security Account Manager (SAM) stores users' passwords.  Restricting remote rpc connections to the SAM to Administrators helps protect those credentials.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uqablBEdj8fYHH8criFKQSHGko9Gb2nm3ANEizuP+08=\"},\"C-81363r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Be1MLyR/Z+nSYWeOYKQpPWP0Df/FA9g0clocFDsx5wE=\"},\"F-78123r1_fix\",\"V-71771\",\"low\",\"WN10-CC-000197\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4652,\"SV-86395r2_rule\",\"low\",null,null,\"Microsoft consumer experiences must be turned off.\",\"WN10-CC-000197\",\"Microsoft consumer experiences provides suggestions and notifications to users, which may include the installation of Windows Store apps.  Organizations may control the execution of applications through other means such as whitelisting.  Turning off Microsoft consumer experiences will help prevent the unwanted installation of suggested applications.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:azduH/rGDaA9J8WfIbKquOL5RoDMag7lQ/2PBt2QE8s=\"},\"C-72563r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:M5rwZagEaLNTaJKOXPYqxrB71orJ89nWwRBonZ+GsJs=\"},\"F-78683r2_fix\",\"V-72329\",\"medium\",\"WN10-CC-000039\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4653,\"SV-86953r1_rule\",\"medium\",null,null,\"Run as different user must be removed from context menus.\",\"WN10-CC-000039\",\"The \\\"Run as different user\\\" selection from context menus allows the use of credentials other than the currently logged on user.  Using privileged credentials in a standard user session can expose those credentials to theft.  Removing this option from context menus helps prevent this from occurring.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QUy5rMKrmSVFuZRi8lijI352v840T0gzGD5qak7wNbk=\"},\"C-72913r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:A2l+hvl/8exaBSN6YCIsffw0hfHkhBy+P3AKlVVpFAw=\"},\"F-79175r1_fix\",\"V-72765\",\"medium\",\"WN10-00-000210\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4654,\"SV-87403r1_rule\",\"medium\",null,null,\"Bluetooth must be turned off unless approved by the organization.\",\"WN10-00-000210\",\"If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OLU1Ki32nfmwHE1geqvJmNi7m2t/bTSrs5FI1qvvg5o=\"},\"C-72915r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2am2H7Doa4rGmj6G+kS9wKTwC5Nme9hPQFpYKniqeB4=\"},\"F-79177r1_fix\",\"V-72767\",\"medium\",\"WN10-00-000220\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4655,\"SV-87405r1_rule\",\"medium\",null,null,\"Bluetooth must be turned off when not in use.\",\"WN10-00-000220\",\"If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VC4MssCw0YPNf5Ku7vwfsCk462cMswOvsMCGoxhRGaU=\"},\"C-72917r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Pb5TafjPaP+LTOixhDns54D9iLk838ohVuYebZ2RvcY=\"},\"F-79179r1_fix\",\"V-72769\",\"medium\",\"WN10-00-000230\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4656,\"SV-87407r2_rule\",\"medium\",null,null,\"The system must notify the user when a Bluetooth device attempts to connect.\",\"WN10-00-000230\",\"If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hktzVHG38mzOhb1tNzgXaCky+9tk/sTzqf2ayzkUh0A=\"},\"C-74295r6_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9fnPpiozrI0OKjv+pcmSSl17/I8MN2dILhQcCidat/E=\"},\"F-80951r4_fix\",\"V-74409\",\"medium\",\"WN10-AU-000084\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4657,\"SV-89083r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Object Access - Other Object Access Events failures.\",\"WN10-AU-000084\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing for other object access records events related to the management of task scheduler jobs and COM+ objects.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+dPx0n8JfTUXKdPsMAw42NTXs2lAb7HwDFC8m/Frthk=\"},\"C-74297r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vd8EsTrkNYhogosEeLUKmcGtT/0kDmTjGQjR7pYHTFc=\"},\"F-80953r2_fix\",\"V-74411\",\"medium\",\"WN10-AU-000083\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4658,\"SV-89085r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Object Access - Other Object Access Events successes.\",\"WN10-AU-000083\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing for other object access records events related to the management of task scheduler jobs and COM+ objects.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HPKwv55aIzf3+HquubSdJocG/rCtCTbtxNECCDpyxPk=\"},\"C-94089r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BYVODkXyQ1zz05xobiYtyYf0nPtZ/GjmyoBPKUesI84=\"},\"F-80955r1_fix\",\"V-74413\",\"medium\",\"WN10-CC-000052\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4659,\"SV-89087r2_rule\",\"medium\",null,null,\"Windows 10 must be configured to prioritize ECC Curves with longer key lengths first.\",\"WN10-CC-000052\",\"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. By default Windows uses ECC curves with shorter key lengths first.  Requiring ECC curves with longer key lengths to be prioritized first helps ensure more secure algorithms are used.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gd3/nmYTFouE7yNfONwiOI09OM4xvvtC7p5aHSm3+rk=\"},\"C-91423r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rNae1lECfwUQzq7cVpoyPLhfSkChOADC8SJ+dmqF7bc=\"},\"F-80959r1_fix\",\"V-74417\",\"medium\",\"WN10-CC-000252\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4660,\"SV-89091r2_rule\",\"medium\",null,null,\"Windows 10 must be configured to disable Windows Game Recording and Broadcasting.\",\"WN10-CC-000252\",\"Windows Game Recording and Broadcasting is intended for use with games, however it could potentially record screen shots of other applications and expose sensitive data.  Disabling the feature will prevent this from occurring.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p3Km58ax+vwtXp6vt/jvLyGVTgesTT2NKlz+BVoeGAk=\"},\"C-91425r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vS35zhZGlAylBppLd2YkbVv5mYh6dEBH9Lg9/Qx2sCQ=\"},\"F-81317r1_fix\",\"V-74699\",\"medium\",\"WN10-CC-000068\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4661,\"SV-89373r2_rule\",\"medium\",null,null,\"Windows 10 must be configured to enable Remote host allows delegation of non-exportable credentials.\",\"WN10-CC-000068\",\"An exportable version of credentials is provided to remote hosts when using credential delegation which exposes them to theft on the remote host.  Restricted Admin mode or Remote Credential Guard allow delegation of non-exportable credentials providing additional protection of the credentials.  Enabling this configures the host to support Restricted Admin mode or Remote Credential Guard.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kmONnQi8hUqCu/WJgM8CHWQrxsQLtOxhWR7c6bEt12Y=\"},\"C-94093r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6LaK2VcIqK9oUGu0jqwrijFrhQ5H371NKRriYM6+TB4=\"},\"F-81333r1_fix\",\"V-74719\",\"medium\",\"WN10-00-000175\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4662,\"SV-89393r2_rule\",\"medium\",null,null,\"The Secondary Logon service must be disabled on Windows 10.\",\"WN10-00-000175\",\"The Secondary Logon service provides a means for entering alternate credentials, typically used to run commands with elevated privileges.  Using privileged credentials in a standard user session can expose those credentials to theft.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJq3SMQlkiH7VSnlxXWdCkxlPWIUUAHF7pAJRBLRDOU=\"},\"C-74575r5_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eZpj+IITXq5ums6eQxFjnoGoYPhzGIVD4fSfvb1yD0g=\"},\"F-81335r3_fix\",\"V-74721\",\"medium\",\"WN10-AU-000082\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4663,\"SV-89395r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Object Access - File Share successes.\",\"WN10-AU-000082\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing file shares records events related to connection to shares on a system including system shares such as C$.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AcIhp89UhB4v65rG4+1OlkrKzpAPGx+nVXwXtWlRxtw=\"},\"C-74577r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TSmMu0ZHsAd1fzROhv0xiffJsLGIkQoOrLRxkBCNjPU=\"},\"F-81337r2_fix\",\"V-74723\",\"medium\",\"WN10-00-000165\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4664,\"SV-89397r1_rule\",\"medium\",null,null,\"The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.\",\"WN10-00-000165\",\"SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.\\n\\nDisabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bH2zYG4O8rv2T9lCQ0x5K3UStABQyU0MGrR7XdmZxm4=\"},\"C-74579r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vrvlutyLqr3NGe5hhKWoLyJi7MftxvLvZBtgAHlh3sg=\"},\"F-81339r3_fix\",\"V-74725\",\"medium\",\"WN10-00-000170\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4665,\"SV-89399r1_rule\",\"medium\",null,null,\"The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.\",\"WN10-00-000170\",\"SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.\\n\\nDisabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pP6wExXu7hx0kSxYXKfJVrzTaRizYrfD1RMLqHWYrFY=\"},\"C-74879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JfK0hPvOcoRwMHqq7hLD/z12EWwkRlJQFjlqGg7QcEA=\"},\"F-81643r1_fix\",\"V-75027\",\"medium\",\"WN10-AU-000081\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4666,\"SV-89701r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Object Access - File Share failures.\",\"WN10-AU-000081\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing file shares records events related to connection to shares on a system including system shares such as C$.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2j27+jG0GZFs6PCwCbPpklgetUgKU7XZetxNDvK30ho=\"},\"C-76171r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:DrB1/dhFAcMIz4jr6xajtN8beSutIcDkV9SZc5jmaz4=\"},\"F-83185r1_fix\",\"V-76505\",\"medium\",\"WN10-00-000190\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4667,\"SV-91201r1_rule\",\"medium\",null,null,\"Orphaned security identifiers (SIDs) must be removed from user rights on Windows 10.\",\"WN10-00-000190\",\"Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups.  If the account or group objects are reanimated, there is a potential they may still have rights no longer intended.  Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:G++c76EF2dug3yxJ1mWjWuE/wznHG9SVXyS+eCsoMKE=\"},\"C-86429r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:AVzpNK+DyFAXlwjznEhrrAG4I22Sg+pYLab7wZSj95Y=\"},\"F-83781r1_fix\",\"V-77083\",\"medium\",\"WN10-00-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4668,\"SV-91779r3_rule\",\"medium\",null,null,\"Windows 10 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.\",\"WN10-00-000015\",\"UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in Legacy BIOS mode will not support these security features.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:UyAIBRFH+PIeD9UnW2uuScJwGHi1TzbEGDoaMPRL1nM=\"},\"C-86431r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TRTnlaC83paER7O+Xt96qk6Vk3HwozJXAzJuSrP/hKs=\"},\"F-83783r1_fix\",\"V-77085\",\"low\",\"WN10-00-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4669,\"SV-91781r2_rule\",\"low\",null,null,\"Secure Boot must be enabled on Windows 10 systems.\",\"WN10-00-000020\",\"Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wZQbFTwW94OSVmQOtJRreFTXD/cIx6cp6SMGeIT/5Q0=\"},\"C-79579r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:woCzI+ry5rY5WpxHM5I31gu2dqoVFaTbd4coSFbSgYo=\"},\"F-86717r3_fix\",\"V-77091\",\"medium\",\"WN10-EP-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4670,\"SV-91787r3_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Data Execution Prevention (DEP), must be on.\",\"WN10-EP-000020\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Data Execution Prevention (DEP)\\\", are enabled by default at the system level. DEP prevents code from being run from data-only memory pages. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:seoeJ0TVdyPF1IZOglTdU3YY9kcGzHzPhCDGtAE3tkM=\"},\"C-79581r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mWshO11tryJTCql4hk/spdqg+E1bzL8t2tI5Lm9xlwA=\"},\"F-86719r3_fix\",\"V-77095\",\"medium\",\"WN10-EP-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4671,\"SV-91791r4_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Randomize memory allocations (Bottom-Up ASLR), must be on.\",\"WN10-EP-000030\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Randomize memory allocations (Bottom-Up ASLR)\\\", are enabled by default at the system level. Bottom-Up ASLR (address space layout randomization) randomizes locations for virtual memory allocations, including those for system structures. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I4uQfS2NjZHDkDdoRvwEOJ9Cn5UEOwkvBoMVv0IlL4w=\"},\"C-79583r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lMnpP4ynhAZVatRsYBaTTKBOmTVGXa68O1WqgFozVek=\"},\"F-86721r2_fix\",\"V-77097\",\"medium\",\"WN10-EP-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4672,\"SV-91793r3_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Control flow guard (CFG), must be on.\",\"WN10-EP-000040\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Control flow guard (CFG)\\\", are enabled by default at the system level. CFG ensures flow integrity for indirect calls. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kFzIaNPWT2wqsaqKjSiKaNxW40sevexLR9vPMcm9edQ=\"},\"C-79585r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CagwaL6jYeJAB8F7kV6A1VgcgO0qo2LyozS2WSl9LV0=\"},\"F-86723r2_fix\",\"V-77101\",\"medium\",\"WN10-EP-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4673,\"SV-91797r3_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Validate exception chains (SEHOP), must be on.\",\"WN10-EP-000050\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Validate exception chains (SEHOP)\\\", are enabled by default at the system level. SEHOP (structured exception handling overwrite protection) ensures the integrity of an exception chain during exception dispatch. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:g7RfvBxx636aPhixMi/6iDCzMbVFIx9shebxkreQe48=\"},\"C-79587r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y+Jwz4SlaCP0uDfdPN7A2Kkk2w9cH6/sCOOpTuFkp5Y=\"},\"F-86725r2_fix\",\"V-77103\",\"medium\",\"WN10-EP-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4674,\"SV-91799r3_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Validate heap integrity, must be on.\",\"WN10-EP-000060\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Validate heap integrity\\\", are enabled by default at the system level. \\\"Validate heap integrity\\\" terminates a process when heap corruption is detected. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/kelpkvOVtEhlqeho3DqaACavzCa3fwBSBE55Uza0+E=\"},\"C-94095r9_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:akIn3OR8SKnyLhrjzkf6C+t63Ll3bFZcny/I2uJNO0w=\"},\"F-84325r8_fix\",\"V-77189\",\"medium\",\"WN10-EP-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4675,\"SV-91885r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for Acrobat.exe.\",\"WN10-EP-000070\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MubhtefZIzGkvhlY2PmYFuDlH+8Uqku0fltszVjOuxU=\"},\"C-94097r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:go1d0UhD/s44LKtOJi7giiQmLfHwsIDsomswW5bEhEw=\"},\"F-84329r7_fix\",\"V-77191\",\"medium\",\"WN10-EP-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4676,\"SV-91887r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for AcroRd32.exe.\",\"WN10-EP-000080\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fg2f0FG3EIVUBqMtVXqVYKHERgkwZW3I0YbnLTVAsX8=\"},\"C-94099r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:UtLy/lhF+3qJsptN1S7+/BnmRwSuoKQLUjCcTfPFVmQ=\"},\"F-84333r5_fix\",\"V-77195\",\"medium\",\"WN10-EP-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4677,\"SV-91891r4_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for chrome.exe.\",\"WN10-EP-000090\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pNmbpGc9jee+bzjZjzmnqgZeocNv6buCv3Ipvsb5pXo=\"},\"C-94101r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:G7GA5EjlQapB+o33giDLY13tf4ks4V+aVerdQAKmg3o=\"},\"F-84337r7_fix\",\"V-77201\",\"medium\",\"WN10-EP-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4678,\"SV-91897r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for EXCEL.EXE.\",\"WN10-EP-000100\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:spszjT7BTTddnp6oFJqi/T4F3rA0UBbm/6GzPBqBcWo=\"},\"C-79777r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lmq37rPV73c8QL9fNQTktgAYlAIm/VcmeVQUR5N+QPM=\"},\"F-86915r3_fix\",\"V-77205\",\"medium\",\"WN10-EP-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4679,\"SV-91901r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for firefox.exe.\",\"WN10-EP-000110\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mtl2VgiudtjEJVh9KeXvbi749Hr3urnyB+DwqMQJz2Y=\"},\"C-94103r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bwz+hhci2hrUCxhD+VWhV+aLmorsS7M6HVezP2NZtNw=\"},\"F-84341r6_fix\",\"V-77209\",\"medium\",\"WN10-EP-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4680,\"SV-91905r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for FLTLDR.EXE.\",\"WN10-EP-000120\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LsXrxcaxVB8zrRJjNYRpPBfOKTGaqj32TPrT80sjdFE=\"},\"C-94105r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:v3QdCidDWVcmfH52W7787MqM06FhUQwodFBWSACop7M=\"},\"F-84343r6_fix\",\"V-77213\",\"medium\",\"WN10-EP-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4681,\"SV-91909r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for GROOVE.EXE.\",\"WN10-EP-000130\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:amDpgsaRxthlet+rsvJeTvWJu1llLyepQcXyc5K4O7w=\"},\"C-94107r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Q7yxXUAX6curMWW1+63uLbDcl9ljTbRXUFw1GGJVd2c=\"},\"F-84347r6_fix\",\"V-77217\",\"medium\",\"WN10-EP-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4682,\"SV-91913r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for iexplore.exe.\",\"WN10-EP-000140\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lY+AXYfe/AluR4WGTqo0FEqJ5tSSl5HZ39f56ylKTs4=\"},\"C-94109r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:GulQPjdDC+qlUbS2TlpaM3J62Vs0lZh5wMmcUEsC1uA=\"},\"F-84349r6_fix\",\"V-77221\",\"medium\",\"WN10-EP-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4683,\"SV-91917r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for INFOPATH.EXE.\",\"WN10-EP-000150\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fe/FsLxtBWOXdM4WX+ESyWqxz8i/+CYiH84HrxQGTKM=\"},\"C-94111r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nB+4od41f5NQMsWDyaK8/k0TJse8+H0mHNA2tCIAMTA=\"},\"F-84353r5_fix\",\"V-77223\",\"medium\",\"WN10-EP-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4684,\"SV-91919r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for java.exe, javaw.exe, and javaws.exe.\",\"WN10-EP-000160\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mh9IH1clzy+A1OOIBzjvUuybaU9xSwmJekh7crMQoVI=\"},\"C-94113r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:63zaP2KKzTXpl+NIgXAfQSDlkk8SmqPAW2nW9p/6B/c=\"},\"F-84357r7_fix\",\"V-77227\",\"medium\",\"WN10-EP-000170\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4685,\"SV-91923r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for lync.exe.\",\"WN10-EP-000170\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dEwmjiXxS3GnMegQ2bUU71KYoXG5Dd/AZ7wdyDMWJGQ=\"},\"C-94115r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MDpvhRQniNCiKGQAJSKnHWQ00gPj8bYf9lxw0wxnoBU=\"},\"F-84359r6_fix\",\"V-77231\",\"medium\",\"WN10-EP-000180\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4686,\"SV-91927r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for MSACCESS.EXE.\",\"WN10-EP-000180\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xgIlihjGuLyZbqGDLM1SWEpzSqmldIb/KD1X6dqFPeQ=\"},\"C-94117r5_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OexQ8kEncBJsMQKalFDXdL/ElicZV/YRKjUyPX4zpLY=\"},\"F-84361r6_fix\",\"V-77233\",\"medium\",\"WN10-EP-000190\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4687,\"SV-91929r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for MSPUB.EXE.\",\"WN10-EP-000190\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5Ph3UBC9p+Akj+j+IR75pArMHpuq1OdgoJE3yVDf11E=\"},\"C-94119r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BCa1+WSHpwNFQlicOVJTT7MO9RB9aBAbcT3ARZQ/k2E=\"},\"F-84321r7_fix\",\"V-77235\",\"medium\",\"WN10-EP-000210\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4688,\"SV-91931r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for OneDrive.exe.\",\"WN10-EP-000210\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lILMjdtbWDfww7YCEZdpYCS81lAL+dJlad4M/TVlfcQ=\"},\"C-94121r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NwmgFiA9NckdN5TeGEUGMcRrS12KDExHspvp62uYU+Q=\"},\"F-84315r7_fix\",\"V-77239\",\"medium\",\"WN10-EP-000200\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4689,\"SV-91935r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for OIS.EXE.\",\"WN10-EP-000200\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GXA5f/UA68emJFB8jqN9ewGYIe84bEvyYg7xSGas3I4=\"},\"C-94123r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:GYLqyqrHfdyE4k3QM4zwGeUyRS9mmnEGZBpRqxsMKqI=\"},\"F-84363r6_fix\",\"V-77243\",\"medium\",\"WN10-EP-000220\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4690,\"SV-91939r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for OUTLOOK.EXE.\",\"WN10-EP-000220\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MUCQyakZZLfc2Ap5HiFf5ipmQj0p92vkKHKV9h/lKZA=\"},\"C-94125r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eD5WaRu5VcwvSfrT2UxDYynPsF16jaqIicn0D7W7yXU=\"},\"F-84365r8_fix\",\"V-77245\",\"medium\",\"WN10-EP-000230\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4691,\"SV-91941r4_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for plugin-container.exe.\",\"WN10-EP-000230\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Tc2J0p3mLuCyswLMHwCyLpY+3kVedt6NP6VLBTCWYjA=\"},\"C-94127r5_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pc/w19DZVMih+ciy86Y9JMYlyvH/jIeElYtpCZZoHyE=\"},\"F-84503r8_fix\",\"V-77247\",\"medium\",\"WN10-EP-000240\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4692,\"SV-91943r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for POWERPNT.EXE.\",\"WN10-EP-000240\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MQNLsBE4TEp2/6ROgBSTJO9fJkNfyMcnLhI9YtT5BXI=\"},\"C-94129r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:WsF1epd1aFpIa9jDy3bcmb6qVRoEa5866L5rVCMQAzU=\"},\"F-84505r7_fix\",\"V-77249\",\"medium\",\"WN10-EP-000250\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4693,\"SV-91945r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for PPTVIEW.EXE.\",\"WN10-EP-000250\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pHMGWcsdxpl8Z+8pYTfwp4+n7EAO3II6SBPoR0qmkV8=\"},\"C-94131r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:prizP85kj6huvXs/G4ghxyH4LZWTIOMFXs00Svnjh3A=\"},\"F-84507r8_fix\",\"V-77255\",\"medium\",\"WN10-EP-000260\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4694,\"SV-91951r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for VISIO.EXE.\",\"WN10-EP-000260\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8vOgdCfinZFo71HQ6cBJRAa/ITYhJrZWDk+MZttTzFg=\"},\"C-94133r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hPsWkcNQxMjXoLg+pAJQVJfUxZbyUac/dEBdQd8Deqk=\"},\"F-84509r7_fix\",\"V-77259\",\"medium\",\"WN10-EP-000270\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4695,\"SV-91955r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for VPREVIEW.EXE.\",\"WN10-EP-000270\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wzRqhQROBVJlE1q3nxtUM1GkAJigG01hupg8bXE1iSA=\"},\"C-94135r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NfdZ24hCWsRX4GyoitZP1gOvqm9KxehEDibz/R35NPU=\"},\"F-84511r7_fix\",\"V-77263\",\"medium\",\"WN10-EP-000280\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4696,\"SV-91959r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for WINWORD.EXE.\",\"WN10-EP-000280\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/mZrNq1dEWU1tMYc71JTRfkRtNHkdPGHX2E03f0Jppc=\"},\"C-94137r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tXGn2pX+eEr6Q8FblEWmysB+EYqlH0J64+XJJHHbztU=\"},\"F-84513r7_fix\",\"V-77267\",\"medium\",\"WN10-EP-000290\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4697,\"SV-91963r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for wmplayer.exe.\",\"WN10-EP-000290\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i7E2vv6pd35hawlK+qV+2UpXcaVnUkBR1V3CR/Rcg7M=\"},\"C-94139r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:V/BKBf3pVG0DtiNhcIN8772kUA7FsIV4gQZ5YiOqAjk=\"},\"F-84515r7_fix\",\"V-77269\",\"medium\",\"WN10-EP-000300\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4698,\"SV-91965r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for wordpad.exe.\",\"WN10-EP-000300\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:99vRhcTZ40z21olaz2KCAKJlYMIhAMYv5z3B0U4Tt7E=\"},\"C-77703r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4yYwGe5746/lZUu5mItEq1GkKqM7qXqbJZqcipCDsu8=\"},\"F-84851r1_fix\",\"V-78129\",\"high\",\"WN10-00-000240\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4699,\"SV-92835r1_rule\",\"high\",null,null,\"Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.\",\"WN10-00-000240\",\"Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account.\\n\\nSince administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy requires administrative accounts to not access the Internet or use applications, such as email.\\n\\nThe policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.\\n\\nTechnical means such as application whitelisting can be used to enforce the policy to ensure compliance.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ewDvbXkRfIkCeWiNsw3OWO1nlDe4SsgnCecA5Am1j5Q=\"},\"C-81935r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:W9CRIHTIvuwyTuYRNeqcLnBcDyK6y5LJmcZdO2HC4Kw=\"},\"F-88989r2_fix\",\"V-82137\",\"medium\",\"WN10-UC-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4700,\"SV-96851r1_rule\",\"medium\",null,null,\"The use of personal accounts for OneDrive synchronization must be disabled.\",\"WN10-UC-000005\",\"OneDrive provides access to external services for data storage, which must be restricted to authorized instances. Enabling this setting will prevent the use of personal OneDrive accounts for synchronization.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Yc8MBcfVv6vNjndIl1SGBkgIuoDRlU+d8I5bNlbhm5k=\"},\"C-81939r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NYJvEfLe6qqpfrqg9mcbQtXqcwpfjyCZ3kza554KJAA=\"},\"F-88993r1_fix\",\"V-82139\",\"medium\",\"WN10-CC-000238\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4701,\"SV-96853r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to prevent certificate error overrides in Microsoft Edge.\",\"WN10-CC-000238\",\"Web security certificates provide an indication whether a site is legitimate. This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rj3OnjRCg+zI0qrs9i/7QAUeW1hgVcDx11HNsPktgsU=\"},\"C-81943r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RHLyDoJJQoQLYBXIbpvnNPrKKHX099LvJyUf7L2XMmI=\"},\"F-88997r2_fix\",\"V-82145\",\"medium\",\"WN10-CC-000204\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4702,\"SV-96859r1_rule\",\"medium\",null,null,\"If Enhanced diagnostic data is enabled it must be limited to the minimum required to support Windows Analytics.\",\"WN10-CC-000204\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The \\\"Enhanced\\\" level for telemetry includes additional information beyond \\\"Security\\\" and \\\"Basic\\\" on how Windows and apps are used and advanced reliability data. Windows Analytics can use a \\\"limited enhanced\\\" level to provide information such as health data for devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2tk48SuLjCC1zEZDnJEJwFssANaf8w1hwLA0yFQDwt0=\"},\"C-87895r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VHeKoAaG7leI8VWo6O7ZVX0+8WiDV/Oct8xTAZwnQPY=\"},\"F-94945r4_fix\",\"V-88203\",\"medium\",\"WN10-CC-000340\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4703,\"SV-98853r3_rule\",\"medium\",null,null,\"OneDrive must only allow synchronizing of accounts for DoD organization instances.\",\"WN10-CC-000340\",\"OneDrive provides access to external services for data storage, which must be restricted to authorized instances if enabled. Configuring this setting will restrict synchronizing of OneDrive accounts to DoD organization instances.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xCK9AnopZ/PLEiEfFd+fF29a3GvfMV+H4kBtncaC+w4=\"},\"C-93909r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mPWqIsb0n06wTF7qh1aYHnPiwDdpF2h7PhHFwsmZUqY=\"},\"F-100837r3_fix\",\"V-94719\",\"medium\",\"WN10-CC-000365\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4704,\"SV-104549r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to prevent Windows apps from being activated by voice while the system is locked.\",\"WN10-CC-000365\",\"Allowing Windows apps to be activated by voice from the lock screen could allow for unauthorized use. Requiring logon will ensure the apps are only used by authorized personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hSVsi+qUuuUyVINtO7WeONuyh47CyGSc32+FLd4Ul1Q=\"},\"C-94055r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+pJv8+F1yFio0LjRDpj7dffhIDVp0nEY8jvnE+wrX4w=\"},\"F-100983r2_fix\",\"V-94859\",\"medium\",\"WN10-00-000031\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4705,\"SV-104689r1_rule\",\"medium\",null,null,\"Windows 10 systems must use a BitLocker PIN for pre-boot authentication.\",\"WN10-00-000031\",\"If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SIUT9VltMgIdU+iQ11p1JXZ1wRhtZVpC4mS/QVMSxf0=\"},\"C-94057r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bZOkFz4V8Ui/FunBETLbYY6kWJHTUI5wFoQlPtlZiqU=\"},\"F-100985r1_fix\",\"V-94861\",\"medium\",\"WN10-00-000032\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4706,\"SV-104691r2_rule\",\"medium\",null,null,\"Windows 10 systems must use a BitLocker PIN with a minimum length of 6 digits for pre-boot authentication.\",\"WN10-00-000032\",\"If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives. Increasing the pin length requires a greater number of guesses for an attacker.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ma4nqZH+wIDRjwzJLcPKvIvKb/+DvmWJQSbZYwt0kjY=\"},\"C-98389r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rcAafIXouE+3wT6heNODo54W6/EDFFC9IGCWJ8/HefA=\"},\"F-105225r1_fix\",\"V-99541\",\"medium\",\"WN10-AU-000565\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4707,\"SV-108645r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit other Logon/Logoff Events Failures.\",\"WN10-AU-000565\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aHDwysX9OO7lInhWR4rNHU0Ms5aHv+DvTtpIpt7OrPU=\"},\"C-98393r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BEdoMF9S2cOQGD2GXgg9s6wgMJrbDpokNMz6l9nTjv0=\"},\"F-105227r1_fix\",\"V-99543\",\"medium\",\"WN10-AU-000560\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4708,\"SV-108647r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit other Logon/Logoff Events Successes.\",\"WN10-AU-000560\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1xCrwLo/Iq6qUeIrA32JKdJWhv9UJ8i93khTh00F31M=\"},\"C-98395r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:K470rD17EN41ERiWYr5a6WRrSS6wvqHUSlWy+iX1BCY=\"},\"F-105229r1_fix\",\"V-99545\",\"medium\",\"WN10-AU-000570\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4709,\"SV-108649r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Detailed File Share Failures.\",\"WN10-AU-000570\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Detailed File Share allows you to audit attempts to access files and folders on a shared folder.\\nThe Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xN9N4TyNWncZnuydNiSn1AFbgDuZlrOZk/FpvfCXbCw=\"},\"C-98397r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Og8bqxxj38uPecH7EfrawZ+rB2jQ+W6bSi3cC899qhE=\"},\"F-105231r1_fix\",\"V-99547\",\"medium\",\"WN10-AU-000575\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4710,\"SV-108651r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Successes.\",\"WN10-AU-000575\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). \\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AwE4aTQA41II3JBpLcuFwxr2s+SdrBU5NkQnKMmh+34=\"},\"C-98399r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:3kKmtcMstjT4aZm8opTuiNQyeFx5VSsOlN0KLpSlQeU=\"},\"F-105233r1_fix\",\"V-99549\",\"medium\",\"WN10-AU-000580\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4711,\"SV-108653r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Failures.\",\"WN10-AU-000580\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). \\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JLf0igfVeeCGPtuP0G5jtsBt5SLWDy8/40lxLhTjp+A=\"},\"C-98401r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fnFr59iMjWuCLW0+oFtD3LoOgcVyLzjCmKhn0eBtvf4=\"},\"F-105235r1_fix\",\"V-99551\",\"medium\",\"WN10-AU-000550\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4712,\"SV-108655r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Other Policy Change Events Successes.\",\"WN10-AU-000550\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0JIEYxGjLJCW+XDuQSNKZLiOraun/N4xAz9pc3iPnC4=\"},\"C-98403r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:J94I4bXHjDSMsn8zktbNFAlWp+zRBwXxG+yxPDD9mvA=\"},\"F-105237r1_fix\",\"V-99553\",\"medium\",\"WN10-AU-000555\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4713,\"SV-108657r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Other Policy Change Events Failures.\",\"WN10-AU-000555\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WiWO+yrYgzS9BRfJ95tCnETPOIU/k/YYuPYQakQM+IM=\"},\"C-98405r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JXGq7aDhtWNDrivMOMTSMI94M0jJatF+Nj93C8VgSrs=\"},\"F-105239r2_fix\",\"V-99555\",\"medium\",\"WN10-SO-000280\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4714,\"SV-108659r2_rule\",\"medium\",null,null,\"Passwords for enabled local Administrator accounts must be changed at least every 60 days.\",\"WN10-SO-000280\",\"The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. A local Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for enabled Administrator accounts on a regular basis will limit its exposure.\\n\\nOrganizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every \\\"30\\\" days by default.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vk0EeybuvPD5mu6kz6fCWWqDopo0zsPMlVMjqvlYb5I=\"},\"C-98407r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bJdExunHBewJYBF6G0nwK51NbFw+0zp5HCOqjnETyCQ=\"},\"F-105241r4_fix\",\"V-99557\",\"medium\",\"WN10-EP-000310\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4715,\"SV-108661r1_rule\",\"medium\",null,null,\"Windows 10 Kernel (Direct Memory Access) DMA Protection must be enabled.\",\"WN10-EP-000310\",\"Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. Drive-by DMA attacks can lead to disclosure of sensitive information residing on a PC, or even injection of malware that allows attackers to bypass the lock screen or control PCs remotely.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QBQK/tnwXZkWJDaqU/JtL7zWbHA0F4hsxCD2qrMtB98=\"},\"C-98409r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gmXzLE+C5v8pYM8+S6Iego7iYhlC18ZgH4ozkLXCTvE=\"},\"F-105243r1_fix\",\"V-99559\",\"medium\",\"WN10-CC-000370\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4716,\"SV-108663r1_rule\",\"medium\",null,null,\"The convenience PIN for Windows 10 must be disabled.\",\"WN10-CC-000370\",\"This policy controls whether a domain user can sign in using a convenience PIN to prevent enabling (Password Stuffer).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:d1pbzJigO85rKAMstf6sSkdP/ACDK1pRyqaLfXxwivI=\"},\"C-98411r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:i0Z+IG92JiLzmzLx6tQ74snoRBL6KKFk5hh5XykDo7s=\"},\"F-105245r1_fix\",\"V-99561\",\"medium\",\"WN10-CC-000385\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4717,\"SV-108665r1_rule\",\"medium\",null,null,\"Windows Ink Workspace configured but disallow access above the lock.\",\"WN10-CC-000385\",\"Securing Windows Ink which contains application and features oriented towards pen computing. \",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rD1r31DjrTFhcjSKe05lznNWs43/fc9RD+ZPg5DX/ZA=\"},\"C-98413r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KfW44fGASN+DiEKxrOxRxC/y1q1o/IzZsuqfPyZVbE4=\"},\"F-105247r1_fix\",\"V-99563\",\"low\",\"WN10-CC-000390\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4718,\"SV-108667r1_rule\",\"low\",null,null,\"Windows 10 should be configured to prevent users from receiving suggestions for third-party or additional applications.\",\"WN10-CC-000390\",\"Windows spotlight features may suggest apps and content from third-party software publishers in addition to Microsoft apps and content. \",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FGmuM87xdJUUKhYyergOAvk1Q+FhFTf1uOoIl5+4vOQ=\"},\"C-98943r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:uDOK3Fjq2yLJbn3WYZKpUUc41LjFQmsFAugtp+V755g=\"},\"F-105777r3_fix\",\"V-100093\",\"medium\",\"SRG-OS-000095-GPOS-00049\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4719,\"SV-109197r1_rule\",\"medium\",null,null,\"Windows 10 must cover or disable the built-in or attached camera when not in use.\",\"WN10-CC-000007\",\"It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\\n\\nFailing to disconnect from collaborative computing devices (i.e. cameras) can result in subsequent compromises of organizational information. Providing easy methods to physically disconnect from such devices after a collaborative computing session helps to ensure that participants actually carry out the disconnect activity without having to go through complex and tedious procedures.\\n\\nSatisfies: SRG-OS-000095-GPOS-00049, SRG-OS-000370-GPOS-00155\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HTJfh6HdzWTnnVR96iuoJZ0PnIvio+5FoDwpQDtzoTk=\"},\"C-101347r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4wZyYpTBO45VsCc6wvm7l2eGkIhtOrcxbBb0SGvAieE=\"},\"F-108159r2_fix\",\"V-102611\",\"medium\",\"WN10-00-000250\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4720,\"SV-111557r1_rule\",\"medium\",null,null,\"Windows 10 non-persistent VM sessions should not exceed 24 hours.\",\"WN10-00-000250\",\"For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, the organization should enforce that sessions be terminated within 24 hours. This would ensure any data stored on the VM that is not encrypted or covered by Credential Guard is deleted.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dbiUpUgiJb2+wzenGvBgb7gCtpsKZcFOnZmCT6u1k3s=\"},\"C-101355r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Og0Ct9ilCO63e8VppKdOiDA8j8y3ZH3RTayXtTMnHqE=\"},\"F-108147r3_fix\",\"V-102617\",\"medium\",\"WN10-CC-000328\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4721,\"SV-111563r1_rule\",\"medium\",null,null,\"The Windows Explorer Preview pane must be disabled for Windows 10.\",\"WN10-CC-000328\",\"A known vulnerability in Windows 10 could allow the execution of malicious code by either opening a compromised document or viewing it in the Windows Preview pane.\\n\\nOrganizations must disable the Windows Preview pane and Windows Detail pane.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aGZaMr7JCYhdhYIbyDmHK2zx8fjqDpXXjEY01sUoNo4=\"},\"C-101365r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:h9sVNjmtZbTh4890fOEZpilU6aj+nDNbUGjH9jf1Tzs=\"},\"F-108157r1_fix\",\"V-102627\",\"medium\",\"WN10-SO-000251\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4722,\"SV-111577r1_rule\",\"medium\",null,null,\"Windows 10 must use multifactor authentication for local and network access to privileged and non-privileged accounts.\",\"WN10-SO-000251\",\"Without the use of multifactor authentication, the ease of access to privileged and non-privileged functions is greatly increased. \\n\\nAll domain accounts must be enabled for multifactor authentication with the exception of local emergency accounts. \\n\\nMultifactor authentication requires using two or more factors to achieve authentication.\\n\\nFactors include: \\n\\n1) Something a user knows (e.g., password/PIN);\\n\\n2) Something a user has (e.g., cryptographic identification device, token); and\\n\\n3) Something a user is (e.g., biometric).\\n\\nA privileged account is defined as an information system account with authorizations of a privileged user.\\n\\nNetwork access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the Internet).\\n\\nLocal access is defined as access to an organizational information system by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network.\\n\\nThe DoD CAC with DoD-approved PKI is an example of multifactor authentication.\\n\\nSatisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nkk6VkjluuUxkzsszOk8eTgHlUakS2R/bR95QTwbAM8=\"},\"C-4516r88368_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:171piPtMwULALIZ14So5l0MBIPd4Xcr2rWsmNy6Dx/g=\"},\"F-4516r88369_fix\",\"V-204392\",\"high\",\"SRG-OS-000257-GPOS-00098\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4723,\"SV-204392r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values.\",\"RHEL-07-010010\",\"Discretionary access control is weakened if a user or group has access permissions to system files and directories greater than the default.\\n\\nSatisfies: SRG-OS-000257-GPOS-00098, SRG-OS-000278-GPOS-00108\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:t3pLu4RByPjTmSyEGSrDsv2WpOjBnMxFcux4WTKpzsg=\"},\"C-4517r88371_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hYWkn5qu+JVb8C0/FpEXNp2r5VMsXVv/bIRrPHmoQNU=\"},\"F-4517r88372_fix\",\"V-204393\",\"medium\",\"SRG-OS-000023-GPOS-00006\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4724,\"SV-204393r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.\",\"RHEL-07-010030\",\"Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\n\\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b7cLLXAJwWiYlb+ZLVM/YmYEKrJOElbc2DI7KzdElaY=\"},\"C-4518r88374_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:w+OPWXVI1Kw0bo/mliM4bt1VuO10x/y6qOatUlCmTLA=\"},\"F-4518r88375_fix\",\"V-204394\",\"medium\",\"SRG-OS-000023-GPOS-00006\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4725,\"SV-204394r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the approved Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.\",\"RHEL-07-010040\",\"Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9ShQfZRP37ZylVTOj7a7tmzPRP/DZmVauIWv5cK5IgU=\"},\"C-4519r88377_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VxFoDAct2ic13XgKRn+E/ACi/TSpmK9WNulzRc3rOxY=\"},\"F-4519r88378_fix\",\"V-204395\",\"medium\",\"SRG-OS-000023-GPOS-00006\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4726,\"SV-204395r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.\",\"RHEL-07-010050\",\"Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Eg7oETP6JdEiW9fWb3CWsCNr1Ee+e9COo/1vPyjLJyA=\"},\"C-4520r88380_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MnA1wjFQqLCk55goNlJqa3e9IQiF1U+1NIeoMR43fSU=\"},\"F-4520r88381_fix\",\"V-204396\",\"medium\",\"SRG-OS-000028-GPOS-00009\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4727,\"SV-204396r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must enable a user session lock until that user re-establishes access using established identification and authentication procedures.\",\"RHEL-07-010060\",\"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.\\n\\nThe session lock is implemented at the point where session activity can be determined.\\n\\nRegardless of where the session lock is determined and implemented, once invoked, the session lock must remain in place until the user reauthenticates. No other activity aside from reauthentication must unlock the system.\\n\\nSatisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v8r3y4wndT3MrdoqZ+IXfrOkoGx9bEvFFDEL4eMv6bI=\"},\"C-4521r88383_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FJ09r9gGAOoBlB3ANwPG10/GW3aeCVvnhJwFpBEgyrg=\"},\"F-4521r88384_fix\",\"V-204397\",\"medium\",\"SRG-OS-000375-GPOS-00160\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4728,\"SV-204397r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate users using multifactor authentication via a graphical user logon.\",\"RHEL-07-010061\",\"To assure accountability and prevent unauthenticated access, users must be identified and authenticated to prevent potential misuse and compromise of the system.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\\n\\nSatisfies: SRG-OS-000375-GPOS-00161,SRG-OS-000375-GPOS-00162\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4Vhryn3qYojwlbzNOTBxhlYOCH+6lGP9nQktKh5cvso=\"},\"C-4522r88386_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:txbQErX0FRuka0ET9MkbOIEBnV+bAVMYgBP6oH/i79o=\"},\"F-4522r88387_fix\",\"V-204398\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4729,\"SV-204398r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces.\",\"RHEL-07-010070\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9A9hqWAZ5NS1n2W3Z6epeuVuWBbbbPCEc/zuKz7IiSM=\"},\"C-4523r88389_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vl4SP0SyLICEo1UBg5mI/85sJQuDzfImBjmKGkVysKs=\"},\"F-4523r88390_fix\",\"V-204399\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4730,\"SV-204399r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver lock-delay setting for the graphical user interface.\",\"RHEL-07-010081\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1r/d1v914jFv+PeIiRAnO8w+OdA0cucmU9N4uS9npIU=\"},\"C-4524r88392_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dnQ2OlAztdPf5rQ9gH8GFI1O36kYCEF3B2vcP6Jh8vI=\"},\"F-4524r88393_fix\",\"V-204400\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4731,\"SV-204400r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent a user from overriding the session idle-delay setting for the graphical user interface.\",\"RHEL-07-010082\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BdYvtV85bZiRNU3aVsf9P0v0mUKO7gFFdyTulpf63UA=\"},\"C-4525r88395_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Et1UGeqvKWmnbOPO51FwzssEelKOLZsQzNg/Wj9Vi0M=\"},\"F-4525r88396_fix\",\"V-204401\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4732,\"SV-204401r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must have the screen package installed.\",\"RHEL-07-010090\",\":  A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe screen and tmux packages allow for a session lock to be implemented and configured.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SJj4kDOYlogEinGYl4UBtzYvD0sUOtC0Zc+GkbM/nQg=\"},\"C-4526r88398_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RHDbTLpscT3JPNQs8VWSai2xSgAZqUcMgIRNSBG1V5o=\"},\"F-4526r88399_fix\",\"V-204402\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4733,\"SV-204402r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must initiate a session lock for the screensaver after a period of inactivity for graphical user interfaces.\",\"RHEL-07-010100\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wLqPaWBvxUmRKRMMSiJj2pj0F8NCk7mvWKECb9jxRgw=\"},\"C-4527r88401_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ktylcJOE83aWAU3yVOV6uQjr4EguM93Bhe66FymU9bE=\"},\"F-4527r88402_fix\",\"V-204403\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4734,\"SV-204403r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface.\",\"RHEL-07-010101\",\"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.\\n\\nThe session lock is implemented at the point where session activity can be determined.\\n\\nThe ability to enable/disable a session lock is given to the user by default. Disabling the user's ability to disengage the graphical user interface session lock provides the assurance that all sessions will lock after the specified period of time.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:orUMwfifYhVDl5eCyl7LEBXY8R0QtYf4FB3AikYOR0Q=\"},\"C-4528r88404_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:7pgCXmTq1+tSHD6gmAtfroDMvoebl9KLtd/SK4N3WTo=\"},\"F-4528r88405_fix\",\"V-204404\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4735,\"SV-204404r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must initiate a session lock for graphical user interfaces when the screensaver is activated.\",\"RHEL-07-010110\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:87KK1t2KJmsVqwDVxcvH3F6erHGSjt6gU3lODHDY4FI=\"},\"C-4529r88407_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wV2rv2IVWyQHIuIZzNN7jDzLimBra9QVKxEfwm4p0nc=\"},\"F-4529r88408_fix\",\"V-204405\",\"medium\",\"SRG-OS-000069-GPOS-00037\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4736,\"SV-204405r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that /etc/pam.d/passwd implements /etc/pam.d/system-auth when changing passwords.\",\"RHEL-07-010118\",\"Pluggable authentication modules (PAM) allow for a modular approach to integrating authentication methods. PAM operates in a top-down processing model and if the modules are not listed in the correct order, an important security function could be bypassed if stack entries are not centralized.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NVVlZz6DnbTO6YEa+HkLTRE6ApJBkX8N7oXza495krA=\"},\"C-4530r88410_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ty0BX1+S2CNa7NTV6x02Hdkv+nFbpdfLxv2kxmTzuoA=\"},\"F-4530r88411_fix\",\"V-204406\",\"medium\",\"SRG-OS-000069-GPOS-00037\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4737,\"SV-204406r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.\",\"RHEL-07-010119\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. \\\"pwquality\\\" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZZsZT55sjZiOw8YvdeG/PuTRrOJNXQ9fXpNFx1alZS0=\"},\"C-4531r88413_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:50c24SpAy6lZUa/raxhyzfeiBWAPtMEV8VJDkehahfI=\"},\"F-4531r88414_fix\",\"V-204407\",\"medium\",\"SRG-OS-000069-GPOS-00037\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4738,\"SV-204407r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one upper-case character.\",\"RHEL-07-010120\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5mP42vXD7dbHMk2adGpM5o78xd9tfHYGp4AY1olXPug=\"},\"C-4532r88416_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:K9vm1++ZIJVabRWXzHTee4LsRs4K42zsOdnMaBs894A=\"},\"F-4532r88417_fix\",\"V-204408\",\"medium\",\"SRG-OS-000070-GPOS-00038\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4739,\"SV-204408r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one lower-case character.\",\"RHEL-07-010130\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+ZxB96680QpTXOUhL+JNnhQFv/FKeRTfkrvRL3PV5S8=\"},\"C-4533r88419_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C2+B8kPWnlF62QWrO/V35CnYRxq/BrtDWAlCFrqLPPg=\"},\"F-4533r88420_fix\",\"V-204409\",\"medium\",\"SRG-OS-000071-GPOS-00039\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4740,\"SV-204409r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are assigned, the new password must contain at least one numeric character.\",\"RHEL-07-010140\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:abrw002NXrRQ66PzmbZYPT3hHRpQytzeYoaeJHhVEhU=\"},\"C-4534r88422_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RU7Q7o3Ev0u3LKqF5gyOeGtE+4224DgffB3yxG3HXzA=\"},\"F-4534r88423_fix\",\"V-204410\",\"medium\",\"SRG-OS-000266-GPOS-00101\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4741,\"SV-204410r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one special character.\",\"RHEL-07-010150\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CKBfpvZELPLxUExAGYDADab38Se08BtvG5UpBNIazBI=\"},\"C-4535r88425_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SV7aVMHMV2pg9CvBTy267KcjoYRu/NtX4vDqa6ogG+k=\"},\"F-4535r88426_fix\",\"V-204411\",\"medium\",\"SRG-OS-000072-GPOS-00040\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4742,\"SV-204411r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed a minimum of eight of the total number of characters must be changed.\",\"RHEL-07-010160\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wHEY2x4CvlXeh/wo8XesGOqxBrsYGWbUXOPbniv8Eec=\"},\"C-4536r88428_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ywBdYcG6riksarMvU8GLYRkgHnsMvClRGhpO80dIryk=\"},\"F-4536r88429_fix\",\"V-204412\",\"medium\",\"SRG-OS-000072-GPOS-00040\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4743,\"SV-204412r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed a minimum of four character classes must be changed.\",\"RHEL-07-010170\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:50yiX31ofIr+hd8aTkGds0o0cG1XWzi9CajHGO80y9s=\"},\"C-4537r88431_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sQgH4GxCCq+ysoBMnYh5H31rp93G+5yz2Gg2jTWAOMA=\"},\"F-4537r88432_fix\",\"V-204413\",\"medium\",\"SRG-OS-000072-GPOS-00040\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4744,\"SV-204413r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed the number of repeating consecutive characters must not be more than three characters.\",\"RHEL-07-010180\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:B5/JCBM3+y8mI0Wx//3vcvLxaBJUTuafPhnRMesP9F4=\"},\"C-4538r88434_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:E9p40X59ObEVCYByBc8xAxmZqPEKUNQhFuScvnelbvE=\"},\"F-4538r88435_fix\",\"V-204414\",\"medium\",\"SRG-OS-000072-GPOS-00040\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4745,\"SV-204414r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed the number of repeating characters of the same character class must not be more than four characters.\",\"RHEL-07-010190\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:EWkE5ArbnCtRXt1tYfKaQZxY82bf5+ySftE5x3A7rUw=\"},\"C-4539r88437_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4ddTsadW6QqrmIoLUDmcDiTBzxaIozFG0eOuiHCk7RE=\"},\"F-4539r88438_fix\",\"V-204415\",\"medium\",\"SRG-OS-000073-GPOS-00041\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4746,\"SV-204415r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the PAM system service is configured to store only encrypted representations of passwords.\",\"RHEL-07-010200\",\"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:szDJRfipxjLUpU4siSaUz52MOYPESOCSPqgSYGrG8h8=\"},\"C-4540r88440_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gOQ3eksWP5ENmWWzc/DMM0RZ2jLEEkon1gajsl35tsI=\"},\"F-4540r88441_fix\",\"V-204416\",\"medium\",\"SRG-OS-000073-GPOS-00041\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4747,\"SV-204416r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to use the shadow file to store only encrypted representations of passwords.\",\"RHEL-07-010210\",\"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:37jX9s+legYelkYfnf62nyYfMX4Svx6S53TO09s9e7U=\"},\"C-4541r88443_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hRyf1t19z5DMc75LIoHPuvVnrO2HP0zkmJIFEox5KzE=\"},\"F-4541r88444_fix\",\"V-204417\",\"medium\",\"SRG-OS-000073-GPOS-00041\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4748,\"SV-204417r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.\",\"RHEL-07-010220\",\"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+bzaAS/aDWQDJP8ZUOuMk/ISS9nWHhkC1peC0GEcbKo=\"},\"C-4542r88446_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1T7sJCq5OM2unDp6aEqf5HsDoTTlARZDq3qfpQyM8uU=\"},\"F-4542r88447_fix\",\"V-204418\",\"medium\",\"SRG-OS-000075-GPOS-00043\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4749,\"SV-204418r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords for new users are restricted to a 24 hours/1 day minimum lifetime.\",\"RHEL-07-010230\",\"Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MrAAW3p9KHUSNIIDH94flLWi6pGLzydp9PgU+RlvGC4=\"},\"C-4543r88449_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JrE+xgTMLgDmwuA8WAdXAxbHE2r7VM2qSE/TkRg8DMw=\"},\"F-4543r88450_fix\",\"V-204419\",\"medium\",\"SRG-OS-000075-GPOS-00043\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4750,\"SV-204419r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords are restricted to a 24 hours/1 day minimum lifetime.\",\"RHEL-07-010240\",\"Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aD2m4e2s0uh65x94BQAdZnXh7LZzUYWOg1jlF0xaYe4=\"},\"C-4544r88452_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OP0loBodphliC5wIAx2xt3COiJwLHbScpisnDs0leHU=\"},\"F-4544r88453_fix\",\"V-204420\",\"medium\",\"SRG-OS-000076-GPOS-00044\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4751,\"SV-204420r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords for new users are restricted to a 60-day maximum lifetime.\",\"RHEL-07-010250\",\"Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Xq5u0Pw/Zw4wuAxFngAnRjHsza6G0aVM5vVkmV9EUkw=\"},\"C-4545r88455_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OW+LFcNscBOuumegSBomC31jM5LYWiBJDmBDcCJqtOk=\"},\"F-4545r88456_fix\",\"V-204421\",\"medium\",\"SRG-OS-000076-GPOS-00044\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4752,\"SV-204421r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that existing passwords are restricted to a 60-day maximum lifetime.\",\"RHEL-07-010260\",\"Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N2xDTbhTE+RFh0/Sm++3xu/AV9xHzSY7hXbPJaaNeEk=\"},\"C-4546r88458_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jqBEArvHLQLeliRKzl6iU7Hesu2gNm2CHdGbqTUxHa4=\"},\"F-4546r88459_fix\",\"V-204422\",\"medium\",\"SRG-OS-000077-GPOS-00045\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4753,\"SV-204422r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords are prohibited from reuse for a minimum of five generations.\",\"RHEL-07-010270\",\"Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If the information system or application allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed per policy requirements.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wnEfB+iBnuzOMM868Vy5hLj72C0iU0CFAkGqCn3lcV8=\"},\"C-4547r88461_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Zxvk6/+F0erAfuKv1q4yUSpM0vr7+nIlyKzfzaKdc6s=\"},\"F-4547r88462_fix\",\"V-204423\",\"medium\",\"SRG-OS-000078-GPOS-00046\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4754,\"SV-204423r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords are a minimum of 15 characters in length.\",\"RHEL-07-010280\",\"The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.\\n\\nPassword complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dxEV5bGuHZP4iVsWXTtnKnb7HW9YuqytYqEfO4SaQlk=\"},\"C-4548r88464_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+qsYjWciZYQUB/V88VGdKnDuQXUV0QqGX56udWYJrmU=\"},\"F-4548r88465_fix\",\"V-204424\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4755,\"SV-204424r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have accounts configured with blank or null passwords.\",\"RHEL-07-010290\",\"If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fGovMAyL0HmlG0cv8i7GIrnPdYDI2Uu2j1CXqheXU6U=\"},\"C-4549r88467_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Q8iotl6ux8+dPdOwKWmbwKgIf/7rwz4a2+PNesYZhmo=\"},\"F-4549r88468_fix\",\"V-204425\",\"high\",\"SRG-OS-000106-GPOS-00053\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4756,\"SV-204425r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using an empty password.\",\"RHEL-07-010300\",\"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HWvW+5i4DGfbBRQ5ePFMe8hnoLMZwFwyu8jP8qD13B4=\"},\"C-4550r88470_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mx7sNoaABjDtoHiw3EcuJ31CMmR6HHu0qfKxJDkLskM=\"},\"F-4550r88471_fix\",\"V-204426\",\"medium\",\"SRG-OS-000118-GPOS-00060\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4757,\"SV-204426r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must disable account identifiers (individuals, groups, roles, and devices) if the password expires.\",\"RHEL-07-010310\",\"Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained.\\n\\nOperating systems need to track periods of inactivity and disable application identifiers after zero days of inactivity.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:H9mT1qdHOp9+ZyEy2fFxjTE/8tI1xhFtEvJORCJqd1k=\"},\"C-4551r88473_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:E9XDhr/n24vkAWIMtfMkvXTpFhXZwpvolrqLLmC13Kg=\"},\"F-4551r88474_fix\",\"V-204427\",\"medium\",\"SRG-OS-000329-GPOS-00128\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4758,\"SV-204427r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to lock accounts for a minimum of 15 minutes after three unsuccessful logon attempts within a 15-minute timeframe.\",\"RHEL-07-010320\",\"By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.\\n\\nSatisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oD6nmwpiJW9D5Cp/XXFX9UYRA755KWJpjrae9YSJLcA=\"},\"C-4552r88476_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+WHWx4dcfhcx4Ze8G9gIFM5wrU0gKeYCHmkrhqBKy/E=\"},\"F-4552r88477_fix\",\"V-204428\",\"medium\",\"SRG-OS-000329-GPOS-00128\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4759,\"SV-204428r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must lock the associated account after three unsuccessful root logon attempts are made within a 15-minute period.\",\"RHEL-07-010330\",\"By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.\\n\\nSatisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GEhzlPPnk+CAcWnOXaLRDP95b6T65/xq1qVqL/b84vw=\"},\"C-4553r88479_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hpjpsRKaPPJ3Ia1RY19t5pVGQb6/g/VXlMgaZLlmwcQ=\"},\"F-4553r88480_fix\",\"V-204429\",\"medium\",\"SRG-OS-000373-GPOS-00156\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4760,\"SV-204429r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that users must provide a password for privilege escalation.\",\"RHEL-07-010340\",\"Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \\n\\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate.\\n\\nSatisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SxSLBVVTtBtxKalJaRaw/6lgbVU0UOBOkgcTTRhHxD8=\"},\"C-4554r88482_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HYAeYfwCZZs8ctZhnvnSv2ucQ1JdxKYPJg0CTd18h14=\"},\"F-4554r88483_fix\",\"V-204430\",\"medium\",\"SRG-OS-000373-GPOS-00156\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4761,\"SV-204430r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that users must re-authenticate for privilege escalation.\",\"RHEL-07-010350\",\"Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \\n\\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate.\\n\\nSatisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+hZzZLys3BX7zWBUfBAVBQPgw6OXD+II7GH5BWOLMCI=\"},\"C-4555r88485_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JdoMO19GhKJDPOBHzoFLCHF7oQmEy7Lx/L1/9sWeXg0=\"},\"F-4555r88486_fix\",\"V-204431\",\"medium\",\"SRG-OS-000480-GPOS-00226\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4762,\"SV-204431r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the delay between logon prompts following a failed console logon attempt is at least four seconds.\",\"RHEL-07-010430\",\"Configuring the operating system to implement organization-wide security implementation guides and security checklists verifies compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\\n\\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example, registry settings; account, file, and directory permission settings; and settings for functions, ports, protocols, services, and remote connections.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wXo7iqYH5XGZTi7xVyPo9OMFKHuQ4XH2hIqOWqKo2ig=\"},\"C-4556r88488_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rtXajOQZci6vKdIVOpf9wOu2ZeYZ0LvKIOal4TwIexs=\"},\"F-4556r88489_fix\",\"V-204432\",\"high\",\"SRG-OS-000480-GPOS-00229\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4763,\"SV-204432r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not allow an unattended or automatic logon to the system via a graphical user interface.\",\"RHEL-07-010440\",\"Failure to restrict system access to authenticated users negatively impacts operating system security.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9DWDKCqiCDCdPaBAR1JnUJ2FgBKkNaNW7tQqAq+dw08=\"},\"C-4557r88491_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oWh+Qz6WRTlWrb5lARfKshYDIa+p6dDR188hrq5F5ds=\"},\"F-4557r88492_fix\",\"V-204433\",\"high\",\"SRG-OS-000480-GPOS-00229\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4764,\"SV-204433r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not allow an unrestricted logon to the system.\",\"RHEL-07-010450\",\"Failure to restrict system access to authenticated users negatively impacts operating system security.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rBMTU13BrvFeKQ+LVw9CSDaXjsTTmFaQjUCP5WUmK4E=\"},\"C-4558r88494_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gihecVT6zHmRSdYksj/6YGJOT2uA9gZTcH/QhkIQsq0=\"},\"F-4558r88495_fix\",\"V-204434\",\"medium\",\"SRG-OS-000480-GPOS-00229\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4765,\"SV-204434r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not allow users to override SSH environment variables.\",\"RHEL-07-010460\",\"Failure to restrict system access to authenticated users negatively impacts operating system security.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/uoCfeW8Df/g/XGQoBkg5WVbTAykMMBn4oMkJdNUEyA=\"},\"C-4559r88497_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:K+3n1t+ObwIUM11QMDTdGh98yONjdBtmdx5Ur9N3C0g=\"},\"F-4559r88498_fix\",\"V-204435\",\"medium\",\"SRG-OS-000480-GPOS-00229\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4766,\"SV-204435r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not allow a non-certificate trusted host SSH logon to the system.\",\"RHEL-07-010470\",\"Failure to restrict system access to authenticated users negatively impacts operating system security.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PVRLHuZ9kP5FJwKwYPDiChFJ5ZxZtcp0ro/wCh+st1A=\"},\"C-4560r88500_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:76sWDqXPiYk1zWHA8hQVZen2OkN3ppblRPJFE441EC4=\"},\"F-4560r88501_fix\",\"V-204436\",\"high\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4767,\"SV-204436r241939_rule\",\"high\",null,null,\"Red Hat Enterprise Linux operating systems prior to version 7.2 with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010480\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:y7xDq5NT2XNGrsamdbkoYKBvisZGFnS1fyg5AKvdfUQ=\"},\"C-4561r88503_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XBRfse8u4CBaisSjZn1V5+mBtSHoq8qleEOMU7NPS8Q=\"},\"F-4561r88504_fix\",\"V-204437\",\"medium\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4768,\"SV-204437r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010481\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tSZDrM1hWlCATKGgxqXsqEoIbIpJlq97X+0R6excyuQ=\"},\"C-4562r88506_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:geJjmG2xvtU8KsOo0NYpCklrqXG0GveHvbfaGe11AP4=\"},\"F-4562r88507_fix\",\"V-204438\",\"high\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4769,\"SV-204438r241939_rule\",\"high\",null,null,\"Red Hat Enterprise Linux operating systems version 7.2 or newer with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010482\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N8tSABUcJlBAkZ3vrmMcMUQscjNj485lQceECmBpBqY=\"},\"C-4563r88509_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9Hgkiy5EBfmBhvQw2thdKK4Mitvv2nkfcXFu2Yjvd8M=\"},\"F-4563r88510_fix\",\"V-204439\",\"high\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4770,\"SV-204439r241939_rule\",\"high\",null,null,\"Red Hat Enterprise Linux operating systems prior to version 7.2 using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010490\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3DS5zKmPA1/pZTvKSZLzlkwx6ZjRlk5GytGTDgvav+s=\"},\"C-4564r88512_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sLNLxYLCF4BkYkTMQlqtKlmz2CCiO2PBBy4/Xxulzds=\"},\"F-4564r88513_fix\",\"V-204440\",\"high\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4771,\"SV-204440r241939_rule\",\"high\",null,null,\"Red Hat Enterprise Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010491\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JTVgaY1LZdMLglvZK8C9tixEgj79wwesQdbeHi7a7Rk=\"},\"C-4565r88515_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XC9ckGWSpFsFRlPTdc3d5Ywv6RikA3tYpya5heE8HWw=\"},\"F-4565r88516_fix\",\"V-204441\",\"medium\",\"SRG-OS-000104-GPOS-00051\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4772,\"SV-204441r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users) using multifactor authentication.\",\"RHEL-07-010500\",\"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\\n\\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following:\\n\\n1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; \\n\\nand\\n\\n2) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\\n\\nSatisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000109-GPOS-00056, SRG-OS-000108-GPOS-00055, SRG-OS-000108-GPOS-00057, SRG-OS-000108-GPOS-00058\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mkc5HGb9gHNlg2WnY/djvfYdh8TcEe1wjVMoosFw32o=\"},\"C-4566r88518_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PkPXfMM5WKryVY7en8MTyQdFX7MPh1hx5HeAzwkHuGw=\"},\"F-4566r88519_fix\",\"V-204442\",\"high\",\"SRG-OS-000095-GPOS-00049\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4773,\"SV-204442r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have the rsh-server package installed.\",\"RHEL-07-020000\",\"It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\\n\\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).\\n\\nThe rsh-server service provides an unencrypted remote access service that does not provide for the confidentiality and integrity of user passwords or the remote session and has very weak authentication.\\n\\nIf a privileged user were to log on using this service, the privileged user password could be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:L6nJ9zxJTEu9H+NPMBNKXjZF11fxVnKsHJ0WDDygoYg=\"},\"C-4567r88521_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:i7hMFNAgwkh8GP0WW51DeT3l5PIPKAHm3h1ELi0DDSI=\"},\"F-4567r88522_fix\",\"V-204443\",\"high\",\"SRG-OS-000095-GPOS-00049\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4774,\"SV-204443r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have the ypserv package installed.\",\"RHEL-07-020010\",\"Removing the \\\"ypserv\\\" package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sfB3iHYcODrsGQIdQzi9S4OiWXlzCjwowCqvtusaGKY=\"},\"C-4568r88524_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pSF5drERdMpLPSu+WvmeYr2Pe+SlgFgTtHkBYI2QcAY=\"},\"F-4568r88525_fix\",\"V-204444\",\"medium\",\"SRG-OS-000324-GPOS-00125\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4775,\"SV-204444r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.\",\"RHEL-07-020020\",\"Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\\n\\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:toAqPFxuUxre2EEjoCzKlhcSnOb9RFpEln3MtuVIT9Q=\"},\"C-4569r88527_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XEeDzj3T3s/5C075RaI2/RVS5MmLUSOtmPLFh/sy/mk=\"},\"F-4569r88528_fix\",\"V-204445\",\"medium\",\"SRG-OS-000363-GPOS-00150\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4776,\"SV-204445r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that a file integrity tool verifies the baseline operating system configuration at least weekly.\",\"RHEL-07-020030\",\"Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\\n\\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NzJUcxxFJi8pit5evzZxnwQLQXWBf4/ftLMFNB6yiGw=\"},\"C-4570r88530_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RY/t3dX5Ty9FJRH+/noSp1Svd2G6xR3hYhL59PhK/G4=\"},\"F-4570r88531_fix\",\"V-204446\",\"medium\",\"SRG-OS-000363-GPOS-00150\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4777,\"SV-204446r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that designated personnel are notified if baseline configurations are changed in an unauthorized manner.\",\"RHEL-07-020040\",\"Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\\n\\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i6TlhYJkq+XnxoK0jdYhyvmrG0/kVGWgegQHFyIbH8Y=\"},\"C-4571r88533_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Eg5EIdHVVwh9ZqgphMoirHxJPHn0A2ZP4Q2vx9opqNY=\"},\"F-4571r88534_fix\",\"V-204447\",\"high\",\"SRG-OS-000366-GPOS-00153\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4778,\"SV-204447r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that\",\"RHEL-07-020050\",\"Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor.\\n\\nAccordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.\\n\\nVerifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SKIqa4iromN1/ld/zYxiQSOEbtGDJiFaQ30mjK6UgUY=\"},\"C-4572r88536_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BiV0UQMmksXuCOkEvhmjfxtdVdFaJetcBXhZERMG7fo=\"},\"F-4572r88537_fix\",\"V-204448\",\"high\",\"SRG-OS-000366-GPOS-00153\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4779,\"SV-204448r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that\",\"RHEL-07-020060\",\"Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor.\\n\\nAccordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.\\n\\nVerifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/bMIprnmuyHCZfwMhN53JacAU9Bw8vUNAz6FpcIsWeU=\"},\"C-4573r88539_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Z3a1S06/4F5C4Lp5cixp7Nu0E7my4W0IeMi33IalQW0=\"},\"F-4573r88540_fix\",\"V-204449\",\"medium\",\"SRG-OS-000114-GPOS-00059\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4780,\"SV-204449r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to disable USB mass storage.\",\"RHEL-07-020100\",\"USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity.\\n\\nSatisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7C8lXVeU00V8ySil2p6/I+nVauuGAbjK42d5ow1J2Y4=\"},\"C-4574r88542_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:uZz3nYMMEKXMiPBl6Xy/ScYOm9HzRk5qWZYzHGUx4bU=\"},\"F-4574r88543_fix\",\"V-204450\",\"medium\",\"SRG-OS-000378-GPOS-00163\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4781,\"SV-204450r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the Datagram Congestion Control Protocol (DCCP) kernel module is disabled unless required.\",\"RHEL-07-020101\",\"Disabling DCCP protects the system against exploitation of any flaws in the protocol implementation.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fvHgDUJGBMB+FLi/4z9egnoRgc5XNsyChWvVL+OV66I=\"},\"C-4575r88545_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Hq9mrYHDvGHmBtdMFIdfUqolkM1cMduz/gaG9QiC6yA=\"},\"F-4575r88546_fix\",\"V-204451\",\"medium\",\"SRG-OS-000114-GPOS-00059\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4782,\"SV-204451r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must disable the file system automounter unless required.\",\"RHEL-07-020110\",\"Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.\\n\\nSatisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ECU3PcokYJ0iTOaeFC4vceGeElsR/zrQCO1UeE3DreQ=\"},\"C-4576r88548_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oI+PCfg0U2LYXCzs78eVO/laVLbdDfv02bzMmbnUXsc=\"},\"F-4576r88549_fix\",\"V-204452\",\"low\",\"SRG-OS-000437-GPOS-00194\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4783,\"SV-204452r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must remove all software components after updated versions have been installed.\",\"RHEL-07-020200\",\"Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products may remove older versions of software automatically from the information system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mc80MJb4r7Qc8AmVFz9tOOJczWkzT3PVQISn5ZtRXSE=\"},\"C-4577r88551_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4FSreFL+qldPVF/mR4X7EaNlwgkKsQjPaFXx4S83Csk=\"},\"F-4577r88552_fix\",\"V-204453\",\"high\",\"SRG-OS-000445-GPOS-00199\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4784,\"SV-204453r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must enable SELinux.\",\"RHEL-07-020210\",\"Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\\n\\nThis requirement applies to operating systems performing security function verification/testing and/or systems and environments that require this functionality.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qFfBME/2o77yTMuxtpA4P0I8o2NQnfoVfThRiWzo6Lk=\"},\"C-4578r88554_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:3Ajev4/zwRAqY3q24YSLe6K9Ush9+wKs5BkHwER9b6M=\"},\"F-4578r88555_fix\",\"V-204454\",\"high\",\"SRG-OS-000445-GPOS-00199\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4785,\"SV-204454r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must enable the SELinux targeted policy.\",\"RHEL-07-020220\",\"Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\\n\\nThis requirement applies to operating systems performing security function verification/testing and/or systems and environments that require this functionality.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F70pc4lFutrB1aZSKBDOLu0diT12WqlYfaQrxFvOlBg=\"},\"C-4579r88557_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y6yG9b4+Sk91rD7DfkS/MXgAxBlsBoMeQBPFUWN95vw=\"},\"F-4579r88558_fix\",\"V-204455\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4786,\"SV-204455r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled on the command line.\",\"RHEL-07-020230\",\"A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:brL/cUNHx6LqwmVc7ML2OUn/P9TF3UTZ+dZ6dn6tjNY=\"},\"C-4580r88560_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JkiLXAedT0k6bEQvwqxohF7tHLjWbU2pGzkDN55NRYM=\"},\"F-4580r88561_fix\",\"V-204456\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4787,\"SV-204456r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled in the GUI.\",\"RHEL-07-020231\",\"A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:41T5JYxmVoKU+kVdsnjUa+6f5+dfkDIeSb6GFuUm5Dw=\"},\"C-4581r88563_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cpYv58/8Flvc4/bkLc1YNsLlr1YRlw72yf+/DFBGHGY=\"},\"F-4581r88564_fix\",\"V-204457\",\"medium\",\"SRG-OS-000480-GPOS-00228\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4788,\"SV-204457r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.\",\"RHEL-07-020240\",\"Setting the most restrictive default permissions ensures that when new accounts are created, they do not have unnecessary access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BKBVXasUfiVr7ygcFP+LUlFT+KaO5mryWRKA5v63Lzg=\"},\"C-4582r88566_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Cp4nKIw9SPZbUroGRU18fIv29Pew+EPDZcmgSeSx8EY=\"},\"F-4582r88567_fix\",\"V-204458\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4789,\"SV-204458r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be a vendor supported release.\",\"RHEL-07-020250\",\"An operating system release is considered \\\"supported\\\" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gzK9MUt7PjwGBJ/p/j6hcmkkkGmVE6qTD/BqPIvnN/E=\"},\"C-4583r88569_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:E9gT32RHBVbik+Je7pTMExJ4L7DJjyk7GysYa+7h2vQ=\"},\"F-4583r88570_fix\",\"V-204459\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4790,\"SV-204459r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system security patches and updates must be installed and up to date.\",\"RHEL-07-020260\",\"Timely patching is critical for maintaining the operational availability, confidentiality, and integrity of information technology (IT) systems. However, failure to keep operating system and application software patched is a common mistake made by IT professionals. New patches are released daily, and it is often difficult for even experienced System Administrators to keep abreast of all the new patches. When new weaknesses in an operating system exist, patches are usually made available by the vendor to resolve the problems. If the most recent security patches and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The lack of prompt attention to patching could result in a system compromise.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BIJOSScjxtLqA/SKv6NkIB3IGMa3Q+LPB+L/geOe7ok=\"},\"C-4584r88572_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:on/oOg7GrAbVYe62qKzCDcHBVJ+735gUHbX6wCQX7Tk=\"},\"F-4584r88573_fix\",\"V-204460\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4791,\"SV-204460r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not have unnecessary accounts.\",\"RHEL-07-020270\",\"Accounts providing no operational purpose provide additional opportunities for system compromise. Unnecessary accounts include user accounts for individuals not requiring access to the system and application accounts for applications not installed on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Xk8zYUvsnzovMiPLfQR6KgfXOkgeBn2KDtxaaMW0pGs=\"},\"C-4585r88575_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:x6Sb8AhbFuFgBMcB8fQ2DaX8SPkRfxrtvMQ5l7SngQQ=\"},\"F-4585r88576_fix\",\"V-204461\",\"low\",\"SRG-OS-000104-GPOS-00051\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4792,\"SV-204461r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all Group Identifiers (GIDs) referenced in the /etc/passwd file are defined in the /etc/group file.\",\"RHEL-07-020300\",\"If a user is assigned the GID of a group not existing on the system, and a group with the GID is subsequently created, the user may have unintended rights to any files associated with the group.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mmPdRsWMT1RXStEFvhbFi2NPQhPau7t1mLPRqSfrlso=\"},\"C-4586r88578_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:y96yxmL2BuOT8czP6029uRiO6H3TBaJbbwlQckB5Hzw=\"},\"F-4586r88579_fix\",\"V-204462\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4793,\"SV-204462r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the root account must be the only account having unrestricted access to the system.\",\"RHEL-07-020310\",\"If an account other than root also has a User Identifier (UID) of \\\"0\\\", it has root authority, giving that account unrestricted access to the entire operating system. Multiple accounts with a UID of \\\"0\\\" afford an opportunity for potential intruders to guess a password for a privileged account.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MCpiixKAw6iysD7QdBwvf/0nHCrKyrAMLWQ4JNX0Bl4=\"},\"C-4587r88581_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:GsC5G7HipGtW+62NgiZQXAkutlZWBE/GXEKtN8U0I/Q=\"},\"F-4587r88582_fix\",\"V-204463\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4794,\"SV-204463r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories have a valid owner.\",\"RHEL-07-020320\",\"Unowned files and directories may be unintentionally inherited if a user is assigned the same User Identifier \\\"UID\\\" as the UID of the un-owned files.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PkSBdKqiF+1CoNw6WAjSOHw0QMu48lpgS7hmAFLNKw8=\"},\"C-4588r88584_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vovSWqnTRcIm/6qmsLOTgH+/9w+W/vFltxdwhBfPZKA=\"},\"F-4588r88585_fix\",\"V-204464\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4795,\"SV-204464r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories have a valid group owner.\",\"RHEL-07-020330\",\"Files without a valid group owner may be unintentionally inherited if a group is assigned the same Group Identifier (GID) as the GID of the files without a valid group owner.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DgsJDDQVqbrezHTaPjQzaqTduH3lEoKAMNNMCRj803k=\"},\"C-4589r88587_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XGxN69S1ERxDxrpoViLVhQRmBwhqv05Lu3rnmLO0oJ4=\"},\"F-4589r88588_fix\",\"V-204465\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4796,\"SV-204465r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive users have a home directory assigned in the /etc/passwd file.\",\"RHEL-07-020600\",\"If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nJKpEfqumuAlnJnurMfT8V8fSO3ydCuFSVHs1UY9GPo=\"},\"C-4590r88590_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OeDu1aipDedHmc19/Hzvj5ebEOIbnKBqTl8bOptR+Go=\"},\"F-4590r88591_fix\",\"V-204466\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4797,\"SV-204466r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user accounts, upon creation, are assigned a home directory.\",\"RHEL-07-020610\",\"If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KjHexj1LNSBP7CHmbNY3vvDc8KQeFRj4apAjjK7uRz8=\"},\"C-4591r88593_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vwYoTQjccTE77nR+wCGdiEu6mm4DUZtTWHdqEzVbIDk=\"},\"F-4591r88594_fix\",\"V-204467\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4798,\"SV-204467r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are defined in the /etc/passwd file.\",\"RHEL-07-020620\",\"If a local interactive user has a home directory defined that does not exist, the user may be given access to the / directory as the current working directory upon logon. This could create a Denial of Service because the user would not be able to access their logon configuration files, and it may give them visibility to system files they normally would not be able to access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IUowyh9fpAWNacEDCWcoW0ywTTeAFy1QJWtS37N3CvU=\"},\"C-4592r88596_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:f13Hkn8e4tzMje7pXIcxv5nytn7jo//XK+PrDi1dyWs=\"},\"F-4592r88597_fix\",\"V-204468\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4799,\"SV-204468r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories have mode 0750 or less permissive.\",\"RHEL-07-020630\",\"Excessive permissions on local interactive user home directories may allow unauthorized access to user files by other users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RVZyk6n7GgpVN69UGZjh42yXz3qHC+E11xMgNQqKqeA=\"},\"C-4593r88599_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fkXJCERE3hQ+ziCN+fp8Iy0BGhZ2sENcZRYvDy9Zp4M=\"},\"F-4593r88600_fix\",\"V-204469\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4800,\"SV-204469r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are owned by their respective users.\",\"RHEL-07-020640\",\"If a local interactive user does not own their home directory, unauthorized users could access or modify the user's files, and the users may not be able to access their own files.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4jt4mkKBzSe4CWKOCChBtcLEVdWyrxsrtYUDQqOWPb4=\"},\"C-4594r88602_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:V6lI0oDUoQokm4czgGuQfbxZHuD5cf984TnzjPNE6AI=\"},\"F-4594r88603_fix\",\"V-204470\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4801,\"SV-204470r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are group-owned by the home directory owners primary group.\",\"RHEL-07-020650\",\"If the Group Identifier (GID) of a local interactive user's home directory is not the same as the primary GID of the user, this would allow unauthorized access to the user's files, and users that share the same group may not be able to access files that they legitimately should.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AK8GPupR9o9w4Bpqm2vkAfSZfDDOTxHxIQYgJ4RNCtU=\"},\"C-4595r88605_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PDyQBeVHE7VC7Z4oNAi4BsMfmcg/7HUqDYEmFDrrYhc=\"},\"F-4595r88606_fix\",\"V-204471\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4802,\"SV-204471r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories are owned by the owner of the home directory.\",\"RHEL-07-020660\",\"If local interactive users do not own the files in their directories, unauthorized users may be able to access them. Additionally, if files are not owned by the user, this could be an indication of system compromise.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CUecwNXz6GFSUPJZXW1ugeOxM+oEICWaiuiBIttVcmE=\"},\"C-4596r88608_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2ynIHTJxW/hjjVBnoE3aH3Dx64kMUvPw3sE8bQ/tZFg=\"},\"F-4596r88609_fix\",\"V-204472\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4803,\"SV-204472r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member.\",\"RHEL-07-020670\",\"If a local interactive user's files are group-owned by a group of which the user is not a member, unintended users may be able to access them.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v1B+Day0uLquC3G3rkAZLvKRlB/UsiRznWww8MhD2Ns=\"},\"C-4597r88611_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2KJKevWHOUHMQKjoQwxaE2WAGIXLMzDOWnovDK4DZns=\"},\"F-4597r88612_fix\",\"V-204473\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4804,\"SV-204473r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories have a mode of 0750 or less permissive.\",\"RHEL-07-020680\",\"If a local interactive user files have excessive permissions, unintended users may be able to access or modify them.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uxK1tQMsGtXuIVRNHQgns3AeLuOfO8jy94kjoPQ2L+g=\"},\"C-4598r88614_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XV3izjAIenixvx0nqsZoW+XWGaX6te1P3K0d1un2MOM=\"},\"F-4598r88615_fix\",\"V-204474\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4805,\"SV-204474r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local initialization files for interactive users are owned by the home directory user or root.\",\"RHEL-07-020690\",\"Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uxK1tQMsGtXuIVRNHQgns3AeLuOfO8jy94kjoPQ2L+g=\"},\"C-4599r88617_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zgcP3101YueZ5H1sOBSOtCI20rSAHZPmMQIWD74FgfY=\"},\"F-4599r88618_fix\",\"V-204475\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4806,\"SV-204475r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local initialization files for local interactive users are be group-owned by the users primary group or root.\",\"RHEL-07-020700\",\"Local initialization files for interactive users are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vX6dN7EfNthdimlLaFh0Q9z6OmJUHbzovDHwg8c8NHU=\"},\"C-4600r88620_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hED2+/cZGpIdVgJ0q4fRlhVaRWUvsLQbvwPtOtoQWxY=\"},\"F-4600r88621_fix\",\"V-204476\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4807,\"SV-204476r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local initialization files have mode 0740 or less permissive.\",\"RHEL-07-020710\",\"Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nMN0kK1ic7h1eLInaM6SrG+c+t8cGPkmMerp3/LQra8=\"},\"C-4601r88623_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lfpVJ/f47cYlqC2Iqf5QP2GfumZTqSvKzQqeqevyjkw=\"},\"F-4601r88624_fix\",\"V-204477\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4808,\"SV-204477r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user initialization files executable search paths contain only paths that resolve to the users home directory.\",\"RHEL-07-020720\",\"The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory (other than the user's home directory), executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two consecutive colons, this is interpreted as the current working directory. If deviations from the default system search path for the local interactive user are required, they must be documented with the Information System Security Officer (ISSO).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Jjjq7xVAWflOe4CoFgZpUiv9Y1NWKcp73tzANZZz+gw=\"},\"C-4602r88626_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:c71mt3rovTr0gD67mVjW85xuJx1Gn3YVBPAifDNyrVc=\"},\"F-4602r88627_fix\",\"V-204478\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4809,\"SV-204478r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that local initialization files do not execute world-writable programs.\",\"RHEL-07-020730\",\"If user start-up files execute world-writable programs, especially in unprotected directories, they could be maliciously modified to destroy user files or otherwise compromise the system at the user level. If the system is compromised at the user level, it is easier to elevate privileges to eventually compromise the system at the root and network level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:X06vDs2tR3QGoQ+xoPHCwRpZHEYU9e6HRZHfgAas1TE=\"},\"C-4603r88629_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bAJKBf4BozI/fviaN/J4hW6lYCK5730YjnmMZI8SZhY=\"},\"F-4603r88630_fix\",\"V-204479\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4810,\"SV-204479r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all system device files are correctly labeled to prevent unauthorized modification.\",\"RHEL-07-020900\",\"If an unauthorized or modified device is allowed to exist on the system, there is the possibility the system may perform unintended or unauthorized operations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rTAfVwmsa16lr6s7L1HVMt53f8c4APqViMHCPG3PQ0c=\"},\"C-4604r88632_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MCtlDRYVTGx0QAFvjnLcwUlRaRnKewVZwCEqHsR69vc=\"},\"F-4604r88633_fix\",\"V-204480\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4811,\"SV-204480r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that file systems containing user home directories are mounted to prevent files with the setuid and setgid bit set from being executed.\",\"RHEL-07-021000\",\"The \\\"nosuid\\\" mount option causes the system to not execute setuid and setgid files with owner privileges. This option must be used for mounting any file system not containing approved setuid and setguid files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oNIXrV8IrUz3LBKHcpc5OkB5AAV30a49EWBJw8tFGRI=\"},\"C-4605r88635_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:A9U1/Kh+oVjKN0jAypf2fLI0wUE+tPD5KlslHPZ6aQw=\"},\"F-4605r88636_fix\",\"V-204481\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4812,\"SV-204481r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.\",\"RHEL-07-021010\",\"The \\\"nosuid\\\" mount option causes the system to not execute \\\"setuid\\\" and \\\"setgid\\\" files with owner privileges. This option must be used for mounting any file system not containing approved \\\"setuid\\\" and \\\"setguid\\\" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:u7P2t9CBo4bVxiR7YZbGpIUx/LFmWm/tqN+oNRgHAME=\"},\"C-4606r88638_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B30lyHn2hJcrEol+Itn5ztKfCEjGM7iuUWexOnyqja0=\"},\"F-4606r88639_fix\",\"V-204482\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4813,\"SV-204482r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are being imported via Network File System (NFS).\",\"RHEL-07-021020\",\"The \\\"nosuid\\\" mount option causes the system to not execute \\\"setuid\\\" and \\\"setgid\\\" files with owner privileges. This option must be used for mounting any file system not containing approved \\\"setuid\\\" and \\\"setguid\\\" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bNGETuyi+t5ZcClrjc42GS9cWGj/6HLIX7UykCKyI9I=\"},\"C-4607r88641_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:izR6tZbtPgWAisBlIjGs3YMJNpiPvp0YrUH300TXERk=\"},\"F-4607r88642_fix\",\"V-204483\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4814,\"SV-204483r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent binary files from being executed on file systems that are being imported via Network File System (NFS).\",\"RHEL-07-021021\",\"The \\\"noexec\\\" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files as they may be incompatible. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+rITfa9uPWXKr2BTckVmwYe0uqE2Xqu4VJaGlyUb/tU=\"},\"C-4608r88644_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:LyHAJsCX564T9Ld2guDnewiwJ2c5r5nZSosa5H1Xdu8=\"},\"F-4608r88645_fix\",\"V-204484\",\"low\",\"SRG-OS-000368-GPOS-00154\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4815,\"SV-204484r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must mount /dev/shm with the nodev option.\",\"RHEL-07-021022\",\"The \\\"nodev\\\" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c76gZ1SY4u9l79FnrsQHACwNc4CL62N+zPqo7zmpzkA=\"},\"C-4609r88647_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:txPPE7KSlIBN9F/tup+d+px5xHuUHHHEq3zGVD74WZ8=\"},\"F-4609r88648_fix\",\"V-204485\",\"low\",\"SRG-OS-000368-GPOS-00154\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4816,\"SV-204485r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must mount /dev/shm with the nosuid option.\",\"RHEL-07-021023\",\"The \\\"nosuid\\\" mount option causes the system to not execute \\\"setuid\\\" and \\\"setgid\\\" files with owner privileges. This option must be used for mounting any file system not containing approved \\\"setuid\\\" and \\\"setguid\\\" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+Cd2E8o4ONaUdrAAVpMr0bFQJFkRt9EDcw+xhFpcySU=\"},\"C-4610r88650_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oHUhPRya0ZChLM+Nhu19UnAx5gOJ6gN6DT+c0ZfQLjo=\"},\"F-4610r88651_fix\",\"V-204486\",\"low\",\"SRG-OS-000368-GPOS-00154\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4817,\"SV-204486r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must mount /dev/shm with the noexec option.\",\"RHEL-07-021024\",\"The \\\"noexec\\\" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files as they may be incompatible. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:68kXW4hDQ+wT9SdXi8wMj/sov4EvnCOjABVhUZDBnBo=\"},\"C-4611r88653_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:83kRFa5no0nmunBS+gSPgjh4XcsNZklC+6sA2t8+kXo=\"},\"F-4611r88654_fix\",\"V-204487\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4818,\"SV-204487r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all world-writable directories are group-owned by root, sys, bin, or an application group.\",\"RHEL-07-021030\",\"If a world-writable directory has the sticky bit set and is not group-owned by a privileged Group Identifier (GID), unauthorized users may be able to modify files created by others.\\n\\nThe only authorized public directories are those temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage, (e.g., /tmp), and for directories requiring global read/write access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1XgmUIRB6alinIiV63h8l4a4c+FpBsGbCgpB3sm/gQ4=\"},\"C-4612r88656_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:u0/cFHEM/xlDUYJ90JmsaS3bdmwY8gRr+EjqVIoj7vM=\"},\"F-4612r88657_fix\",\"V-204488\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4819,\"SV-204488r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must set the umask value to 077 for all local interactive user accounts.\",\"RHEL-07-021040\",\"The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 700 or less permissive. Although umask can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be \\\"0\\\". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MnVJuhcg4+npgMSzOK+ZI3jYbv9R79L3Pw0sG4OGjuY=\"},\"C-4613r88659_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ml9/OTeVKu9RrgGyw3MUaFEGuvSL9eoIA/iBk14uSbQ=\"},\"F-4613r88660_fix\",\"V-204489\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4820,\"SV-204489r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must have cron logging implemented.\",\"RHEL-07-021100\",\"Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hAE8/s/q+2bPxB0JEqCor5YiRwtPpCKQTpKO19s+CsE=\"},\"C-4614r88662_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HoJ5w5/OwkGpsfXKH28H0ocQMj/3zOwF8e8Lr8glasY=\"},\"F-4614r88663_fix\",\"V-204490\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4821,\"SV-204490r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists, is owned by root.\",\"RHEL-07-021110\",\"If the owner of the \\\"cron.allow\\\" file is not set to root, the possibility exists for an unauthorized user to view or to edit sensitive information.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2dsipNSSkkuhCPSuvfUEnxPPKLhEefb0wQ5pWOxGi1s=\"},\"C-4615r88665_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:WJ6fBifQQVq1bOrhsHodd56xXHAwG48s2i17d+TgZP8=\"},\"F-4615r88666_fix\",\"V-204491\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4822,\"SV-204491r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists, is group-owned by root.\",\"RHEL-07-021120\",\"If the group owner of the \\\"cron.allow\\\" file is not set to root, sensitive information could be viewed or edited by unauthorized users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ouKxFOOPpBEfihfWTLMVhsHI14OUZyPa8UIIzq+9aDM=\"},\"C-4616r88668_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nr5wfFxT0WmrANwdPMiqK5tUbpZe7VTGB5cXzmlYXWE=\"},\"F-4616r88669_fix\",\"V-204492\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4823,\"SV-204492r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must disable Kernel core dumps unless needed.\",\"RHEL-07-021300\",\"Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps may consume a considerable amount of disk space and may result in denial of service by exhausting the available space on the target file system partition.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7PN7qrWKJmcvXiHYyWoVhaf0vMJwkBzlYvMLMqakubE=\"},\"C-4617r88671_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FESCG4d/9iAZyFfuPeXnTNkZi64m9INnnm4n9aC52FI=\"},\"F-4617r88672_fix\",\"V-204493\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4824,\"SV-204493r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that a separate file system is used for user home directories (such as /home or an equivalent).\",\"RHEL-07-021310\",\"The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1cCc49bcm+M75v2YFAybr7leYSlE+gJkFfU7F/sl09M=\"},\"C-4618r88674_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C2bv9rIevJ1z1iyzLf8xYIUwpYUQWtFzgJ0EtVzj1b0=\"},\"F-4618r88675_fix\",\"V-204494\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4825,\"SV-204494r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must use a separate file system for /var.\",\"RHEL-07-021320\",\"The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XJvN48pmi8HAcsDkJM/G14Kd6I6pzdqyNmh7aTUWPog=\"},\"C-4619r88677_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NPfLVxGk1uPQ98SX656t+VIJsK19BOAD7ay7Qu0w7ck=\"},\"F-4619r88678_fix\",\"V-204495\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4826,\"SV-204495r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must use a separate file system for the system audit data path.\",\"RHEL-07-021330\",\"The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:18y0TK+OVu1ckq6VVHACpujYOUOuHE9k0lnFU7vZePY=\"},\"C-4620r88680_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B9gPCX4PFcoRc5Vm3y0wzQEuWJY0O+DtUXFoEcYdlSY=\"},\"F-4620r88681_fix\",\"V-204496\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4827,\"SV-204496r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must use a separate file system for /tmp (or equivalent).\",\"RHEL-07-021340\",\"The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Eqvpa3O8L/43+F/dfd3RCBJOqej2+xWuUq9l9HGqyf8=\"},\"C-4621r88683_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jXW05QbpEzlIDpcMBVrdzEstoZVo3Ubv2bc8/2DTpac=\"},\"F-4621r88684_fix\",\"V-204497\",\"high\",\"SRG-OS-000033-GPOS-00014\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4828,\"SV-204497r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with a\",\"RHEL-07-021350\",\"Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\\n\\nSatisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000185-GPOS-00079, SRG-OS-000396-GPOS-00176, SRG-OS-000405-GPOS-00184, SRG-OS-000478-GPOS-00223\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gqquU+6877zdN2QBJVLYBJLAgY9YaeAMGXWhfOMdJDc=\"},\"C-4622r88686_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:340oKSUye0fhpJyu4pBuORuPrLVb6J7Ia64/DF2LHHM=\"},\"F-4622r88687_fix\",\"V-204498\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4829,\"SV-204498r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the file integrity tool is configured to verify Access Control Lists (ACLs).\",\"RHEL-07-021600\",\"ACLs can provide permissions beyond those permitted through the file mode and must be verified by file integrity tools.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BuBYuHuQAvXuOxcqP3DStX9B4QilMV8GArQJSwKL4qk=\"},\"C-4623r88689_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+f/QFLk9K+H3NQDA2eP/vOV+0hz8XlNBateHJaucadA=\"},\"F-4623r88690_fix\",\"V-204499\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4830,\"SV-204499r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the file integrity tool is configured to verify extended attributes.\",\"RHEL-07-021610\",\"Extended attributes in file systems are used to contain arbitrary data and file metadata with security implications.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nqqG2GW71CBVy4Zbpx5pP8sJyDtQRHFZG9xO9W+fhaY=\"},\"C-4624r88692_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QMPyNe4roXVyfO/NnAf18sgASR0e2B1wqdT6D4qATSY=\"},\"F-4624r88693_fix\",\"V-204500\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4831,\"SV-204500r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must use a file integrity tool that is configured to use FIPS 140-2 approved cryptographic hashes for validating file contents and directories.\",\"RHEL-07-021620\",\"File integrity tools use cryptographic hashes for verifying file contents and directories have not been altered. These hashes must be FIPS 140-2 approved cryptographic hashes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:APlAz7ZItAMZCPrk0PRupBAoTrM5Bx3+9xNBo4579+0=\"},\"C-4625r88695_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cMCdYD5AiShSbfVloMRt6g3gUP7LLewSgx2SyXMlHFk=\"},\"F-4625r88696_fix\",\"V-204501\",\"medium\",\"SRG-OS-000364-GPOS-00151\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4832,\"SV-204501r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not allow removable media to be used as the boot loader unless approved.\",\"RHEL-07-021700\",\"Malicious users with removable boot media can gain access to a system configured to use removable media as the boot loader. If removable media is designed to be used as the boot loader, the requirement must be documented with the Information System Security Officer (ISSO).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cp2RMg6QxCqTvmqP37SKwG1FqsgipFxqR3t5FU4PXLk=\"},\"C-4626r88698_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+JK6qsOZ0/f3jw+GVOKxXzJfdL75RKoM5+nkeNBSwDo=\"},\"F-4626r88699_fix\",\"V-204502\",\"high\",\"SRG-OS-000095-GPOS-00049\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4833,\"SV-204502r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have the telnet-server package installed.\",\"RHEL-07-021710\",\"It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\\n\\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).\\n\\nExamples of non-essential capabilities include, but are not limited to, games, software packages, tools, and demonstration software not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Z7b6Mm6lUqwXG2sdLSsdV3B3gZr1qR0O9kZkWEmbxrM=\"},\"C-4627r88701_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/4EWh8HGiUPHSSmWJEeEoA7QVt/i4fYiGMgMiSXKZPA=\"},\"F-4627r88702_fix\",\"V-204503\",\"high\",\"SRG-OS-000038-GPOS-00016\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4834,\"SV-204503r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of th\",\"RHEL-07-030000\",\"Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nAudit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.\\n\\nAssociating event types with detected events in the operating system audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured operating system.\\n\\nSatisfies: SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000042-GPOS-00021, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qglSyMZMvG/rrLNnILUfVZ3YuFZFi5T6+KZGiWAdQ/A=\"},\"C-4628r88704_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6xjMdWgrCBOAv09QpXdtDYvHZLQ+b9mnJgExj1C/Nrc=\"},\"F-4628r88705_fix\",\"V-204504\",\"medium\",\"SRG-OS-000046-GPOS-00022\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4835,\"SV-204504r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must shut down upon audit processing failure, unless availability is an overriding concern. If availability is a concern, the system must alert the designated staff (System Administrator [SA] and Information S\",\"RHEL-07-030010\",\"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.\\n\\nAudit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.\\n\\nThis requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.\\n\\nSatisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000047-GPOS-00023\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GlCYNKZ4IKbMHrBwdJyaGeNDUtXvok0O5JQhengD9bI=\"},\"C-4629r88707_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ytY6syQ7DRKurVfyuaATJjO7HK1ts6aQR0tZCIf8Ie4=\"},\"F-4629r88708_fix\",\"V-204505\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4836,\"SV-204505r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to use the au-remote plugin.\",\"RHEL-07-030200\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nWithout the configuration of the \\\"au-remote\\\" plugin, the audisp-remote daemon will not off-load the logs from the system being audited.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BqnXskmzv0Fml5dUryA9empCvoF4uJVgP7gSzNJBG5Q=\"},\"C-4630r88710_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OzaEK+xwE4QT0b0pQEOvNF6OWexP72bOIc5JEdcUGuk=\"},\"F-4630r88711_fix\",\"V-204506\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4837,\"SV-204506r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must configure the au-remote plugin to off-load audit logs using the audisp-remote daemon.\",\"RHEL-07-030201\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nWithout the configuration of the \\\"au-remote\\\" plugin, the audisp-remote daemon will not off load the logs from the system being audited.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:l+C+NK9AgsqOtIckjdTH4jH0PdnaS4ciKjpNRfQiUbQ=\"},\"C-4631r88713_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:p4NuyS6snIbSrRC2m6yASdhY1FUZkGFyIQRGi5/wXk4=\"},\"F-4631r88714_fix\",\"V-204507\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4838,\"SV-204507r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must take appropriate action when the audisp-remote buffer is full.\",\"RHEL-07-030210\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nWhen the remote buffer is full, audit logs will not be collected and sent to the central log server.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hcASCCaQ6DCZhsOVgtG2fCLYh13EpBUcl5ehg9PF3Js=\"},\"C-4632r88716_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:U6YLDhJ893R7sPbp7NC27z+9DeVXlqe980JXLuAfpPo=\"},\"F-4632r88717_fix\",\"V-204508\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4839,\"SV-204508r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must label all off-loaded audit logs before sending them to the central log server.\",\"RHEL-07-030211\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nWhen audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be analyzed and tied back to the correct system.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XkQ6DCdOAKS0GwAwhQplZEj8R1FV2bl5hQua4nPED4k=\"},\"C-4633r88719_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kSsD36pnjKCClXikSWuQ1pP1rZFh01i/y53w3iNUhVI=\"},\"F-4633r88720_fix\",\"V-204509\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4840,\"SV-204509r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must off-load audit records onto a different system or media from the system being audited.\",\"RHEL-07-030300\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Bf2fWApv0APcqeZ5XF4R3RXo/goqg4pCstdRuIGQtss=\"},\"C-4634r88722_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:giS9pFUiCrhO1TkbbeSyXejUIjjJKDujN4BntbuGaXU=\"},\"F-4634r88723_fix\",\"V-204510\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4841,\"SV-204510r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited.\",\"RHEL-07-030310\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:M4dQIiEBGtvfjwdGLgcnbZPAohqROn1I34DQD4YRp64=\"},\"C-4635r88725_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sXHGhtqxex7BLAMaVPnlDAgGWULXebvIAQ4yeHY17bw=\"},\"F-4635r88726_fix\",\"V-204511\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4842,\"SV-204511r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the audit system takes appropriate action when the audit storage volume is full.\",\"RHEL-07-030320\",\"Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3wu6Xlq+C0xzTcZhVKXS6/ol6uXxhMPvS8I8O+1XaqI=\"},\"C-4636r88728_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:le7qN6zmE7PQ4gZdn8UO/rZlhQCMUymKprBd07poQN4=\"},\"F-4636r88729_fix\",\"V-204512\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4843,\"SV-204512r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the audit system takes appropriate action when there is an error sending audit records to a remote system.\",\"RHEL-07-030321\",\"Taking appropriate action when there is an error sending audit records to a remote system will minimize the possibility of losing audit records.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aflWrGGmEaadkYGyiV9fTBb/AxbzyQb2JEc+iSI+NkM=\"},\"C-4637r88731_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qCZZZ4TWBFpqEjjkyQQ2aorhUNgEHavtO0hiaWBbmRQ=\"},\"F-4637r88732_fix\",\"V-204513\",\"medium\",\"SRG-OS-000343-GPOS-00134\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4844,\"SV-204513r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must initiate an action to notify the System Administrator (SA) and Information System Security Officer ISSO, at a minimum, when allocated audit record storage volume reaches 75% of the repository maximum audi\",\"RHEL-07-030330\",\"If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to plan for audit record storage capacity expansion.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ltVAshO8pttoqEyqG6qijiNJqOl2Qg26et8YkE7jF5s=\"},\"C-4638r88734_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KxzZV1AXjjqRD/m745HcjAVzzwYXjKxl5If3x0jrZMw=\"},\"F-4638r88735_fix\",\"V-204514\",\"medium\",\"SRG-OS-000343-GPOS-00134\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4845,\"SV-204514r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) via email when the threshold for the repository maximum audit record storage capacity is reac\",\"RHEL-07-030340\",\"If security personnel are not notified immediately when the threshold for the repository maximum audit record storage capacity is reached, they are unable to expand the audit record storage capacity before records are lost.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Uw4E5/qhIYn2a7XqoO/vCVOGSvxQjO5QMCJ7MHUh3po=\"},\"C-4639r88737_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:F3IcvKBWmicK+KdP03BYHkfQVcnycYYa3Ww3CsjMnjw=\"},\"F-4639r88738_fix\",\"V-204515\",\"medium\",\"SRG-OS-000343-GPOS-00134\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4846,\"SV-204515r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached.\",\"RHEL-07-030350\",\"If security personnel are not notified immediately when the threshold for the repository maximum audit record storage capacity is reached, they are unable to expand the audit record storage capacity before records are lost.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pb9zyKyDrGizMm2SQJsP9iE6S0NT/TD/ykIFMramKTU=\"},\"C-4640r88740_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Jk4zqxy0xY2nrp1dYXkiE3RgwNuE7VZK0/ZJdueJ1ZI=\"},\"F-4640r88741_fix\",\"V-204516\",\"medium\",\"SRG-OS-000327-GPOS-00127\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4847,\"SV-204516r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all executions of privileged functions.\",\"RHEL-07-030360\",\"Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tfgd6xmJ2tetubGheG+rBYQusickUOomvWf+fpjbT7Q=\"},\"C-4641r88743_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:N/N8R/5EbzaxWpnadedKVzeEjXbqgmOONNwPn+bHRRs=\"},\"F-4641r88744_fix\",\"V-204517\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4848,\"SV-204517r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chown syscall.\",\"RHEL-07-030370\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IRTfp4gJecK//m5Q762/0oGsBdPOyjw0rySHurIS8LE=\"},\"C-4642r88746_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Lzjw0z9I6F2iClv12SH/CGeb1U1kLA6Vs1zPNHLvVuQ=\"},\"F-4642r88747_fix\",\"V-204518\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4849,\"SV-204518r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fchown syscall.\",\"RHEL-07-030380\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c3BG+SR2o14aicE+yhq3PtQvfjs3cmTzFbE8tHrvpUA=\"},\"C-4643r88749_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VT1ZFsd5F6gX89ldnJ4WQwNzKVn+O05wg2pOqSoa4Bk=\"},\"F-4643r88750_fix\",\"V-204519\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4850,\"SV-204519r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the lchown syscall.\",\"RHEL-07-030390\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2XtliP/rksJDS7Xvfpls8GPXpBFZoWsdnTomfRmL9QU=\"},\"C-4644r88752_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:a9pQ+UYmeonAb+q0O5K0HvydTCOnpSRwNCVZ1qPIzxM=\"},\"F-4644r88753_fix\",\"V-204520\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4851,\"SV-204520r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fchownat syscall.\",\"RHEL-07-030400\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NQ4XbflQ44GaE3zsieP8DlRi/3mPxweIdroLWHOE4Pg=\"},\"C-4645r88755_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lrdjsFKfpaOe12ODjIvaz6pGUQDdDwa3dj2P2AvnQO8=\"},\"F-4645r88756_fix\",\"V-204521\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4852,\"SV-204521r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chmod syscall.\",\"RHEL-07-030410\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ct96QUF8s7jdqE0Ojh304JzeK8kmZYLbQaQReE84rXs=\"},\"C-4646r88758_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YaQBZRFREVaeABtSVI8wvC8DzIeJkWLuP9gdN4onkGc=\"},\"F-4646r88759_fix\",\"V-204522\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4853,\"SV-204522r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fchmod syscall.\",\"RHEL-07-030420\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rDncDz9FOlJO5zuVTZJbynkJ6dX2Vmq6oI6860tKW3g=\"},\"C-4647r88761_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cqwA8+hvx3TIV+pEBCaRFI8mXzSRXFlA/o8IN6XPhtg=\"},\"F-4647r88762_fix\",\"V-204523\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4854,\"SV-204523r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fchmodat syscall.\",\"RHEL-07-030430\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8tsf1iL2uCKUxO1hoNkCKyC3IFWiTzlQVJpKPEwK0QI=\"},\"C-4648r88764_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4/Y9rUqyPdcCD9Ee+D7kKjsQpUrVo3Y2fNse7I+PSs4=\"},\"F-4648r88765_fix\",\"V-204524\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4855,\"SV-204524r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the setxattr syscall.\",\"RHEL-07-030440\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SvFkHfPrdOQKr5ne1xqIFighaKbfQ/sihawpHb7p7rA=\"},\"C-4649r88767_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wLwqr7Awa4pIak8mi9ElXBAr4HnVTHOllj07wZTbP2M=\"},\"F-4649r88768_fix\",\"V-204525\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4856,\"SV-204525r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fsetxattr syscall.\",\"RHEL-07-030450\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xCC65vU4a0dx3uNjyFYVXGG1SRtdEiyjqGvJjghYeow=\"},\"C-4650r88770_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SIoz7aeiUTREx9WK/3oog5vv1qzPOYJ0E0oTAI8mJ8c=\"},\"F-4650r88771_fix\",\"V-204526\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4857,\"SV-204526r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the lsetxattr syscall.\",\"RHEL-07-030460\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kE1xvX7cLhAoPe9cvYdrUdLUAfjE7eLXYem3Gw8DNLs=\"},\"C-4651r88773_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:F6IhUU6xp6NUpuB/qpY3XXNN1ASs9zdvMmmF9/zPDwU=\"},\"F-4651r88774_fix\",\"V-204527\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4858,\"SV-204527r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the removexattr syscall.\",\"RHEL-07-030470\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vnSamAe2+/Hr+nfPkTqL9I0bWVmWTIFQpYfsqnVG9F8=\"},\"C-4652r88776_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Lg3LvhwYivRIIFbmUNu5aXJNKKGBMSEBPbjWRrOtSuM=\"},\"F-4652r88777_fix\",\"V-204528\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4859,\"SV-204528r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fremovexattr syscall.\",\"RHEL-07-030480\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qHpyKM8i0QhH/xmWGRB3HGZ+olnqtUnASbAZecaifiM=\"},\"C-4653r88779_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NgalkY0uC0B3Y5qlj+v1Efd1XY1ykcDyIwUBqXjsfLA=\"},\"F-4653r88780_fix\",\"V-204529\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4860,\"SV-204529r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the lremovexattr syscall.\",\"RHEL-07-030490\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9kmHZoiuoiL6AsWMWz23RZbKzak8ErxyC7YO6g8muqE=\"},\"C-4654r88782_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5sGvUlB7gnIf90PrEFOfkewhURxAI1SWz7kIMnanjXg=\"},\"F-4654r88783_fix\",\"V-204530\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4861,\"SV-204530r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the creat syscall.\",\"RHEL-07-030500\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QLmTItOwmEnfzdlxDbgeaEgT0GU0Nbb70w5rFh7+ClA=\"},\"C-4655r88785_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6zBN3awVnJJxpbFDd7rNtN56UvR4PeH9i+8VXL2iq1Y=\"},\"F-4655r88786_fix\",\"V-204531\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4862,\"SV-204531r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the open syscall.\",\"RHEL-07-030510\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/PZC/00fiKOLVTTaP7vTKSayzSFdhYJTeG7hNLk4+gE=\"},\"C-4656r88788_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bvOEkYRfhusdNwFelT4MbDopZr6A0Sge446avyeOeUw=\"},\"F-4656r88789_fix\",\"V-204532\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4863,\"SV-204532r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the openat syscall.\",\"RHEL-07-030520\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jhuvdlST3755aQuU9dw8itd/oBXZUB3VR1y2ygyl5FI=\"},\"C-4657r88791_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:r/0O2zTE5O+392jpkFNgse//67/OEAkktr2AzRD7wyU=\"},\"F-4657r88792_fix\",\"V-204533\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4864,\"SV-204533r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the open_by_handle_at syscall.\",\"RHEL-07-030530\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tA45OvJ+kaPqzTLBG3AsIdZ+y1Fsg6ea5iZ7tEfE1dQ=\"},\"C-4658r88794_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FiHAEf5+7+wojzlrnbsH3ebzF+bOSRMAJ7VNN4gVzlA=\"},\"F-4658r88795_fix\",\"V-204534\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4865,\"SV-204534r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the truncate syscall.\",\"RHEL-07-030540\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aAoxDRfMkHNrqAeotAp74gpKHv9wOXogrgjeQ7eJGQA=\"},\"C-4659r88797_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:iBhBh/4FwIsthObBlwNsPC4Max9BYz/32jCUuYl0CN0=\"},\"F-4659r88798_fix\",\"V-204535\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4866,\"SV-204535r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the ftruncate syscall.\",\"RHEL-07-030550\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yz9ySMXJdb86u8eDi3onAaj+kp672EFyUXztQ5ZavCQ=\"},\"C-4660r88800_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ymhy4VaIZ29+cduBZAwVKhyxZg169tdaJfCPbSkNg34=\"},\"F-4660r88801_fix\",\"V-204536\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4867,\"SV-204536r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the semanage command.\",\"RHEL-07-030560\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:H82QTLuiCWDcZMXUpQQdTEKNJvGkX6x49d2pDZHpYyU=\"},\"C-4661r88803_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CXZ3wbxKuyfW7Hc7A2xWF2jcCkvrJDk5n4MpKx7Jh9Y=\"},\"F-4661r88804_fix\",\"V-204537\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4868,\"SV-204537r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the setsebool command.\",\"RHEL-07-030570\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ERmkPloadjyA5EWZSqAGmmsmSh9yhFCpxtM/g7u2MVY=\"},\"C-4662r88806_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hsy8XmPVJmQFKltnYTmWxXXQKPpivHC8PhsbYMru5+A=\"},\"F-4662r88807_fix\",\"V-204538\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4869,\"SV-204538r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chcon command.\",\"RHEL-07-030580\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yWWSgcAdr7toWF3W2KVSsJEAivLZ/eCE17DkDnuxdnU=\"},\"C-4663r88809_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:H29Zf7IMzj0c2WDyCqJqraBoGasM7wdb72Tx2zKgjKg=\"},\"F-4663r88810_fix\",\"V-204539\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4870,\"SV-204539r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the setfiles command.\",\"RHEL-07-030590\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YXNsFsD1BNTH+UuPUScRJc2/DURz1Fj+3uIcvrRMNdg=\"},\"C-4664r88812_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wKbglrH2LXUYH8odc79kGiaqkdnpz/Ngn/mBGCvfPwM=\"},\"F-4664r88813_fix\",\"V-204540\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4871,\"SV-204540r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all unsuccessful account access events.\",\"RHEL-07-030610\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lJjp0a4I1yjr202W8rakaUjmlWknnhRtwWTbPOgaIB8=\"},\"C-4665r88815_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0mQC9d5eP+LU7s5b1OUMtNKAKQvhAb4VH4Nki+oZvQ4=\"},\"F-4665r88816_fix\",\"V-204541\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4872,\"SV-204541r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all successful account access events.\",\"RHEL-07-030620\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2qmfNcP9ypf8f5/1I1ZWKnvrnO4JwwU1bWjsI78D6KE=\"},\"C-4666r88818_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:j23KNnfT4y4Q+T3/PLJIu9AcgBC+3v1oNGcCzWq9JYc=\"},\"F-4666r88819_fix\",\"V-204542\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4873,\"SV-204542r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the passwd command.\",\"RHEL-07-030630\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gya/2JPlteqFjlFszdxnLFZfGW3EV7vQah2z8gDWTmo=\"},\"C-4667r88821_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KY2hZNWLmBuQzt6IyL5juMxrVmftwMn4HlQ1jU6oLQQ=\"},\"F-4667r88822_fix\",\"V-204543\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4874,\"SV-204543r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the unix_chkpwd command.\",\"RHEL-07-030640\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gi8ZMeceL+SSmRb14wgW06ZvRE7tuolGOXprwyUf+k0=\"},\"C-4668r88824_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:xrqKVwPbs5aekaA17oyUETQ7stRF/qHmet1N2+lY7jU=\"},\"F-4668r88825_fix\",\"V-204544\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4875,\"SV-204544r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the gpasswd command.\",\"RHEL-07-030650\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9sL5nx6+vlT67EKHKU4R5qqJ5n3moOZWw1AikH8pTXk=\"},\"C-4669r88827_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kcjN8hHDyHYyzY66Xm/orQ/6+t3DXU2t/6Mr4aeNajU=\"},\"F-4669r88828_fix\",\"V-204545\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4876,\"SV-204545r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chage command.\",\"RHEL-07-030660\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gqtgtLcu9IdW8tgI/Z/PEk9biRBlGBOHv5LMDpPdpL4=\"},\"C-4670r88830_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QLNijN+/ktoVMtSf8FWijh8WKQU1DpxKnvsPs9TYHoo=\"},\"F-4670r88831_fix\",\"V-204546\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4877,\"SV-204546r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the userhelper command.\",\"RHEL-07-030670\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Yez5vz3QxFhKWn3gCF8yxjW5wBeRRzXNuSoPn6GIO0s=\"},\"C-4671r88833_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:thytcFLh5cIHZuy2u4BfgOSALBemyZQ6F5s/ne6qOzo=\"},\"F-4671r88834_fix\",\"V-204547\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4878,\"SV-204547r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the su command.\",\"RHEL-07-030680\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hC1vcQxqT0u80KTFQPLu/SIk7krmukM+EtUTAUW4Q4A=\"},\"C-4672r88836_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:p4OzTKKgjGDSV/pUdpE/hubQn9MK/F9MZ2hD2sQz0WM=\"},\"F-4672r88837_fix\",\"V-204548\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4879,\"SV-204548r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the sudo command.\",\"RHEL-07-030690\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sTsM/uo7uY/03QywYVZf+XXWwPePPwd6hv1n+aUTiXo=\"},\"C-4673r88839_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qLVnnaX3JtzfwaSqYQolunAg9vfuILgBOx5TwS9/CBI=\"},\"F-4673r88840_fix\",\"V-204549\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4880,\"SV-204549r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.\",\"RHEL-07-030700\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tU3v9z4QSrPw6soKYZKEo2o/9C6DfQXE4mmzVlVGsw8=\"},\"C-4674r88842_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:taMxKHlvcSHa5MrWHLREp57+jZB7dbnWuVFkd/HqAtY=\"},\"F-4674r88843_fix\",\"V-204550\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4881,\"SV-204550r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the newgrp command.\",\"RHEL-07-030710\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:C0RoeHp6aYd9h/bi32FTCOUFtJwNd9lElDmsQIq+wF4=\"},\"C-4675r88845_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2jUfmU4AEu8hT4NZW9E/7rjdUjRflMUEFfPgxFUXZVU=\"},\"F-4675r88846_fix\",\"V-204551\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4882,\"SV-204551r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chsh command.\",\"RHEL-07-030720\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pafqBQ37fC9z4g2ywAqLpjl+XAFqcgxwjjyxs/Verx4=\"},\"C-4676r88848_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cLxeUP3mZ1M9jzX8TTPjs0vy6QD75+qQtPlaSAgSQiw=\"},\"F-4676r88849_fix\",\"V-204552\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4883,\"SV-204552r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the mount command and syscall.\",\"RHEL-07-030740\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged mount commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:caNUlUAL0QTWs82AAVnnqegh0qk/ScQg+zi9M6mXN3Q=\"},\"C-4677r88851_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Zy0AlQ/AK9jrYk7YF0IxUlXJhlHPbVzCfRh1hkQFab4=\"},\"F-4677r88852_fix\",\"V-204553\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4884,\"SV-204553r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the umount command.\",\"RHEL-07-030750\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged mount commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FS0w5y0Nv2J8GgXgjl0+kwNnGa1SOyKNV0kAzuc0Lhc=\"},\"C-4678r88854_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Yn3YWTHi6QKZmIAKqFQXHjUm9ZMaG4AYKwOihst12sU=\"},\"F-4678r88855_fix\",\"V-204554\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4885,\"SV-204554r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the postdrop command.\",\"RHEL-07-030760\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dqcxu/FPpiMQY4drQDT3SVl/Op48vP4lYINaQ/7qycE=\"},\"C-4679r88857_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:L5sMqlW6oTeIfAOPicSMgQJzP1frnBRoZo1ULE8ms5Q=\"},\"F-4679r88858_fix\",\"V-204555\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4886,\"SV-204555r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the postqueue command.\",\"RHEL-07-030770\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mDysNGysefS+eTvNiUFriD9n8ubTJ8X27LObMHof9qM=\"},\"C-4680r88860_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mnbgP41kF+eQDWC3XJbpprjbfNG3To5n7QMtd2b3zDU=\"},\"F-4680r88861_fix\",\"V-204556\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4887,\"SV-204556r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the ssh-keysign command.\",\"RHEL-07-030780\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged ssh commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rEz96y1do/MI6pN7zRcF7HR19einFw1A4ikBHs19nzQ=\"},\"C-4681r88863_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/BAQvnDiTkOcDy7+7rcXBio88IJFaCJV+rp937iHZCo=\"},\"F-4681r88864_fix\",\"V-204557\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4888,\"SV-204557r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the crontab command.\",\"RHEL-07-030800\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ady1u6dO6xtC3UnQhdVbuDv992JbS9UEl9bHXFlDfeU=\"},\"C-4682r88866_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tepGwcttTXBlSxRZeiYWKPNpqYhqMyY67Pq5SGyx9UY=\"},\"F-4682r88867_fix\",\"V-204558\",\"medium\",\"SRG-OS-000471-GPOS-00215\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4889,\"SV-204558r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the pam_timestamp_check command.\",\"RHEL-07-030810\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ktrDKQOFniBjtBla/5sCoFWD4QpBziBp6d3yNj4wSxc=\"},\"C-4683r88869_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NhupFdh9BrfCnk+UCoM9U5iNxBlErlgobWDBG3cY7+0=\"},\"F-4683r88870_fix\",\"V-204559\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4890,\"SV-204559r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the create_module syscall.\",\"RHEL-07-030819\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FKYTZs9Omb9gpZvDDN+VFtmbOEANwAA79jfnk0fdo+4=\"},\"C-4684r88872_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:iyYMEQ9NY1jsBg8aYvinfh87kCf0fxDIHYE5F5wvjD8=\"},\"F-4684r88873_fix\",\"V-204560\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4891,\"SV-204560r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the init_module syscall.\",\"RHEL-07-030820\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DJ473QpyrOIOL4YWEvv/UhC/pdcGoEXF+NICnIw8kXE=\"},\"C-4685r88875_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YO20sjKaSgwWzo5K5zpbLlsrBJRARNcRaQ/WCvAqqPw=\"},\"F-4685r88876_fix\",\"V-204561\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4892,\"SV-204561r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the finit_module syscall.\",\"RHEL-07-030821\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yaISAkFMNlE1gd40ss3E4raZaPutmNF5nUPZxy/dVxE=\"},\"C-4686r88878_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gukXW2K0LmzgeHJsVdPKWm0Dnc8XLdjMo47vFIReIm0=\"},\"F-4686r88879_fix\",\"V-204562\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4893,\"SV-204562r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the delete_module syscall.\",\"RHEL-07-030830\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oBDs5Z67EFgAVh+xQ4UWmvl8l68JaD3MlIWHxZV7Ivg=\"},\"C-4687r88881_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qYL963ACq1nVDqG81Nhwogvxn4pCVk5zYGa6U82IWPo=\"},\"F-4687r88882_fix\",\"V-204563\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4894,\"SV-204563r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the kmod command.\",\"RHEL-07-030840\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yo+7DvmHZV8hyRCSWad1ZfWbs115vSFezvQEM11an2w=\"},\"C-4688r88884_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:DrLGYbRrLcqkaFlvsUgsi805zP8GM1q0BhY+8TbEB80=\"},\"F-4688r88885_fix\",\"V-204564\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4895,\"SV-204564r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.\",\"RHEL-07-030870\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XCeo82R8xQFLoiWbWwslLhkjyDvBriCPlnTPaVCU0O0=\"},\"C-4689r88887_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:iTfdgBwwZUc5xUl78eUFlJ7r99OVpSSYuyt0c9t1ylw=\"},\"F-4689r88888_fix\",\"V-204565\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4896,\"SV-204565r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.\",\"RHEL-07-030871\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mregkcdfFGH6lVk6ARZub4pIX77ZBmx54DG508a9aww=\"},\"C-4690r88890_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SzNb0MZd7tDXe9zrz9tBQl9AKYU9vxCoW/YZ+j5Z2D8=\"},\"F-4690r88891_fix\",\"V-204566\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4897,\"SV-204566r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.\",\"RHEL-07-030872\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lXRvTRQWN34A1q+mXN0yVv2AZrR0vT3Ts/aM1h5LkOo=\"},\"C-4691r88893_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YuxlbzicCJTuUCw8UKAD2dfrvHtiLclVxDfcu6yBHkA=\"},\"F-4691r88894_fix\",\"V-204567\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4898,\"SV-204567r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.\",\"RHEL-07-030873\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:688w5yaOgi6yS2MMu0BXElzK0Nc1j4e7a91fW45De2A=\"},\"C-4692r88896_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9wbu2UEQZg5W0c5/58K+CG9s0WnYuEVRf2xHahsYjn4=\"},\"F-4692r88897_fix\",\"V-204568\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4899,\"SV-204568r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.\",\"RHEL-07-030874\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:umcgNuAsnB59XSjy1I6U++dXqM23CWYChhlv86x8Xuw=\"},\"C-4693r88899_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:w4c+iD078TSfI/nVvVGCuK9E5rXnbgH3VaanYWKniTg=\"},\"F-4693r88900_fix\",\"V-204569\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4900,\"SV-204569r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the rename syscall.\",\"RHEL-07-030880\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mE0MJl83yHmgx0kwKQuKZgNSsnJD2tRsSDRy+kJVHUo=\"},\"C-4694r88902_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MqMWdx8HoJFr5CPVtrttoFouIYkzuaAu0iZSsT0BuvE=\"},\"F-4694r88903_fix\",\"V-204570\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4901,\"SV-204570r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the renameat syscall.\",\"RHEL-07-030890\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SvB0fmN1dM3PsEjEvg5vyZ0zWzSJPOTnbJAICsSPMMU=\"},\"C-4695r88905_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JIX2VnlSvH0MpceK8GMELEnC5U1Vb81fXOVkFOJh0TE=\"},\"F-4695r88906_fix\",\"V-204571\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4902,\"SV-204571r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the rmdir syscall.\",\"RHEL-07-030900\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DS0Fydb5T+qrwtZc8yHRMbt0kZVQKXZvEJkk2pfaoa0=\"},\"C-4696r88908_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:k6ETZYpiAtsCcl8sbY0lyjEPIpX1437rhb9RcZo7Ii4=\"},\"F-4696r88909_fix\",\"V-204572\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4903,\"SV-204572r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the unlink syscall.\",\"RHEL-07-030910\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gQjaLKPqvRmJxPutSuCF2raYWv3G7pqqkl4RYi2CQjI=\"},\"C-4697r88911_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fvZmzi/j1WxOacjuN66vVRNeVl+kmTNB5n2eXA4RUmA=\"},\"F-4697r88912_fix\",\"V-204573\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4904,\"SV-204573r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the unlinkat syscall.\",\"RHEL-07-030920\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:189mZdbWFnTmb/pv12S5jXM09zjsiaBRlTlxaxSpVrA=\"},\"C-4698r88914_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KazPPixn9iBMTwVpaMRQK8IKHGzNe7t2JaJgXt03JSs=\"},\"F-4698r88915_fix\",\"V-204574\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4905,\"SV-204574r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must send rsyslog output to a log aggregation server.\",\"RHEL-07-031000\",\"Sending rsyslog output to another system ensures that the logs cannot be removed or modified in the event that the system is compromised or has a hardware failure.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MwPcFaS7XSTh86tBjhVDJe6I76OH8QTJFy8ThExOTCg=\"},\"C-4699r88917_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pVmbVwyfPytRATXlXvn+p76ybxM6O3oBPglyqw8yf4s=\"},\"F-4699r88918_fix\",\"V-204575\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4906,\"SV-204575r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.\",\"RHEL-07-031010\",\"Unintentionally running a rsyslog server accepting remote messages puts the system at increased risk. Malicious rsyslog messages sent to the server could exploit vulnerabilities in the server software itself, could introduce misleading information in to the system's logs, or could fill the system's storage leading to a Denial of Service.\\n\\nIf the system is intended to be a log aggregation server its use must be documented with the ISSO.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DhilIZI4XItLrdeaFbC8ICZgBN1OCgHuPfD1k8e78sc=\"},\"C-4700r88920_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tuh0npx6WnyQC2URDIxyB9urDMEvi0gcwpWFR4v0veU=\"},\"F-4700r88921_fix\",\"V-204576\",\"low\",\"SRG-OS-000027-GPOS-00008\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4907,\"SV-204576r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must limit the number of concurrent sessions to 10 for all accounts and/or account types.\",\"RHEL-07-040000\",\"Operating system management includes the ability to control the number of users and user sessions that utilize an operating system. Limiting the number of allowed users and sessions per user is helpful in reducing the risks related to DoS attacks.\\n\\nThis requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based on mission needs and the operational environment for each system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:O1hlu7Cy9bkTgUpdl/8swEZmVqrdSxecwRgqIv7TKeI=\"},\"C-4701r88923_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8Ow3JzDo50tPnuuLfgcdLIb5/F/dXCIIRBWsKvJeWWk=\"},\"F-4701r88924_fix\",\"V-204577\",\"medium\",\"SRG-OS-000096-GPOS-00050\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4908,\"SV-204577r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA) an\",\"RHEL-07-040100\",\"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\\n\\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component.\\n\\nTo support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.\\n\\nSatisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JDnnCT7i6KXIu1+6ypsCHBmdw6EQtsr4dSd3kFFR2B4=\"},\"C-4702r88926_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C9wtDic6D6IxHIwpBEoADN3UNF1n/zkJ4DO1Rmx3sR8=\"},\"F-4702r88927_fix\",\"V-204578\",\"medium\",\"SRG-OS-000033-GPOS-00014\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4909,\"SV-204578r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must use a FIPS 140-2 approved cryptographic algorithm for SSH communications.\",\"RHEL-07-040110\",\"Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised.\\n\\nOperating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules.\\n\\nFIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system.\\n\\nSatisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YGctoNEqGYp37D0V7f4JEnaQwZUWRJ16N85m3V1dTA4=\"},\"C-4703r88929_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:7V/YZskuZIFMWUmgA0F+WowCfC79F3qEk3hNicn9Juc=\"},\"F-4703r88930_fix\",\"V-204579\",\"medium\",\"SRG-OS-000163-GPOS-00072\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4910,\"SV-204579r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all network connections associated with a communication session are terminated at the end of the session or after 10 minutes of inactivity from the user at a command prompt, except t\",\"RHEL-07-040160\",\"Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element. \\n\\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kPgd3nZYx8oNc7jNrMPf7SaMkgI7Mpqc+C0Gesho7w0=\"},\"C-4704r88932_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CbJrOqZc9aUjytjiQipH2FQttO6A0xmJSPRZ2xNAGKQ=\"},\"F-4704r88933_fix\",\"V-204580\",\"medium\",\"SRG-OS-000023-GPOS-00006\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4911,\"SV-204580r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner immediately prior to, or as part of, remote access logon prompts.\",\"RHEL-07-040170\",\"Display of a standardized and approved use notification before granting access to the publicly accessible operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007 , SRG-OS-000228-GPOS-00088\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gICjVQBlC2CyjSEDRHoAr3hm79aABc0TAYCd4cyGREM=\"},\"C-4705r88935_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ze0CDAPHd/Z+DRoWsy7rlbe1B/FAjmxymeuyFUVxLGU=\"},\"F-4705r88936_fix\",\"V-204581\",\"medium\",\"SRG-OS-000250-GPOS-00093\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4912,\"SV-204581r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications.\",\"RHEL-07-040180\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IgR19ArnuG58zoGRs25ETsbszS2t2pU66+rmh1ALJZg=\"},\"C-4706r88938_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:67sjwMBDYQYyIYP5nO6e9SccjTN96sfDcHNkmpYO6W0=\"},\"F-4706r88939_fix\",\"V-204582\",\"medium\",\"SRG-OS-000250-GPOS-00093\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4913,\"SV-204582r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.\",\"RHEL-07-040190\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7XIsGNddY755GhU000GYrT04RXf5RlJxt9a8QpJOgWM=\"},\"C-4707r88941_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aDzdhKgdToIxgIHOdlmP6tQ+bOd58icfm4R3mYwxebk=\"},\"F-4707r88942_fix\",\"V-204583\",\"medium\",\"SRG-OS-000250-GPOS-00093\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4914,\"SV-204583r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.\",\"RHEL-07-040200\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zNpBjI7gKD5CGJeHa0TgLmFXquRzktJOpNM1MitUcYA=\"},\"C-4708r88944_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QzcqROrmTjc9BOoYr4nEK3uqGdgRV8SuOfDsOICf/ko=\"},\"F-4708r88945_fix\",\"V-204584\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4915,\"SV-204584r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement virtual address space randomization.\",\"RHEL-07-040201\",\"Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code he or she has introduced into a process's address space during an attempt at exploitation. Additionally, ASLR also makes it more difficult for an attacker to know the location of existing code in order to repurpose it using return-oriented programming (ROP) techniques.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tu8dUs1zi+TVniquX91HB2mrznXWiYevRt36mw4oUc0=\"},\"C-4709r88947_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OeCoQ29Jes44dR6OzCMZZ1F/PQNZix/au38A40JM/Lw=\"},\"F-4709r88948_fix\",\"V-204585\",\"medium\",\"SRG-OS-000423-GPOS-00187\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4916,\"SV-204585r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all networked systems have SSH installed.\",\"RHEL-07-040300\",\"Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. \\n\\nThis requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. \\n\\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, logical means (cryptography) do not have to be employed, and vice versa.\\n\\nSatisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U0+kiCOWAxM37Dm2rN333KIvx6YqKjJfXh9Z8SO0Hw0=\"},\"C-4710r88950_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rDZF521/oH8A2KYzjDsmXNuXcTWUxjr1+bnB8N78kog=\"},\"F-4710r88951_fix\",\"V-204586\",\"medium\",\"SRG-OS-000423-GPOS-00187\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4917,\"SV-204586r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all networked systems use SSH for confidentiality and integrity of transmitted and received information as well as information during preparation for transmission.\",\"RHEL-07-040310\",\"Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. \\n\\nThis requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. \\n\\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.\\n\\nSatisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000423-GPOS-00188, SRG-OS-000423-GPOS-00189, SRG-OS-000423-GPOS-00190\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dkh4lOXziNuIqVk4eaOVLxaMcoWI12sofxv7jKQaw+8=\"},\"C-4711r88953_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Q+ge+udsPuOSaneNaoRiP6qT0I7v5utOt7Yi+ZrWtSE=\"},\"F-4711r88954_fix\",\"V-204587\",\"medium\",\"SRG-OS-000163-GPOS-00072\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4918,\"SV-204587r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all network connections associated with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity, except to fulfill documented and validated mission req\",\"RHEL-07-040320\",\"Terminating an idle SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element.\\n\\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.\\n\\nSatisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KFrNyXlrwufl0fTSC2Xb2SJFGIHk5O3cfMQ8TP0OUcU=\"},\"C-4712r88956_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KCD2uLmWRsM8aj9IlQqXERBKxYqg3/WNWb6mZ9Dl1J4=\"},\"F-4712r88957_fix\",\"V-204588\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4919,\"SV-204588r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using RSA rhosts authentication.\",\"RHEL-07-040330\",\"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:s3HPGztH6jOvI74wiywU7WSmWcHTK8Aw+JzBeFJeV+o=\"},\"C-4713r88959_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aRr6Q+KVIsrwZ81agKF3kJQ+D4tBZOI9I1ZsEqiMojk=\"},\"F-4713r88960_fix\",\"V-204589\",\"medium\",\"SRG-OS-000163-GPOS-00072\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4920,\"SV-204589r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all network connections associated with SSH traffic terminate after a period of inactivity.\",\"RHEL-07-040340\",\"Terminating an idle SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element.\\n\\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.\\n\\nSatisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4oJTyVwrO2R6TmqIF+bsE92/Eo5rArioW/qSFId8tfc=\"},\"C-4714r88962_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Z66CFYVnPNn7K3huS7XeWE1O5Vz7Og//viy4jwSZVH8=\"},\"F-4714r88963_fix\",\"V-204590\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4921,\"SV-204590r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using rhosts authentication.\",\"RHEL-07-040350\",\"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2znyQY3TQ9xKT6QoY0lQ8dx0S8AN67MOq5v/U8DLEh4=\"},\"C-4715r88965_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ydTBWcCVdqH9GwZPSxCb1+Mha35cyxZQZ+PtJTBBj/E=\"},\"F-4715r88966_fix\",\"V-204591\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4922,\"SV-204591r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the date and time of the last successful account logon upon an SSH logon.\",\"RHEL-07-040360\",\"Providing users with feedback on when account accesses via SSH last occurred facilitates user recognition and reporting of unauthorized account use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yX1X8uJ+vqpiTI1YneKPRT+wM/BMopO1gSTrMWwXbLY=\"},\"C-4716r88968_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JJ5Ox1vSig/SsGTtHJKKVEa5/xuzhEH/+pAXuYqInTQ=\"},\"F-4716r88969_fix\",\"V-204592\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4923,\"SV-204592r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not permit direct logons to the root account using remote access via SSH.\",\"RHEL-07-040370\",\"Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging on directly as root. In addition, logging on with a user-specific account provides individual accountability of actions performed on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XefiLkI57brJK6zs5DReGOyqdxXR/FR0JRYBWt4XivE=\"},\"C-4717r88971_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jCt7XP2/joML7K4rmp5RRkBW4Ghsyim2Haa5MjMDry4=\"},\"F-4717r88972_fix\",\"V-204593\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4924,\"SV-204593r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using known hosts authentication.\",\"RHEL-07-040380\",\"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0dqZel9WfGVpxO6OVdTQca14awO4upKlmd0SHcwofA8=\"},\"C-4718r88974_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:e1QPacknVGwhQrTRKO9ch3+12rJP4nUsDzOeg2RKrEY=\"},\"F-4718r88975_fix\",\"V-204594\",\"high\",\"SRG-OS-000074-GPOS-00042\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4925,\"SV-204594r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use the SSHv2 protocol.\",\"RHEL-07-040390\",\"SSHv1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system.\\n\\nSatisfies: SRG-OS-000074-GPOS-00042, SRG-OS-000480-GPOS-00227\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xTLJjvdq15UZDw8G16bCt7+I8XiP/RxZCLmJQpOTmC0=\"},\"C-4719r88977_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:usvEwYL9OkEILqrk7anH3bP3g4cqO6Ot64CCfaWLB20=\"},\"F-4719r88978_fix\",\"V-204595\",\"medium\",\"SRG-OS-000250-GPOS-00093\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4926,\"SV-204595r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.\",\"RHEL-07-040400\",\"DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions. The only SSHv2 hash algorithm meeting this requirement is SHA.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZrwBro/CqOpHuLOT920+WMMOrhs4KR7xtuVSg83ADyY=\"},\"C-4720r88980_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dU8FWoZwp7g+jY/DWHe5T7TwjzaY/5wKrRaYlRza5Ig=\"},\"F-4720r88981_fix\",\"V-204596\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4927,\"SV-204596r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH public host key files have mode 0644 or less permissive.\",\"RHEL-07-040410\",\"If a public host key file is modified by an unauthorized user, the SSH service may be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h0blgpw29xSnpbeqXLAlK16DNURlD9WDnqL8KrTVoVg=\"},\"C-4721r88983_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ZD8sBCF6rqsIMhMVh7zuafBe82s55AJKOiZVo44+sNA=\"},\"F-4721r88984_fix\",\"V-204597\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4928,\"SV-204597r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH private host key files have mode 0640 or less permissive.\",\"RHEL-07-040420\",\"If an unauthorized user obtains the private SSH host key file, the host could be impersonated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LuF6kqpOF9eNjNyaM7lVHX3f2Ce7dRDM7eZK2TV8w6Q=\"},\"C-4722r88986_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eS00OlwHK5cCVIs4PslmH3lcsroembapbUdNCYZMVHs=\"},\"F-4722r88987_fix\",\"V-204598\",\"medium\",\"SRG-OS-000364-GPOS-00151\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4929,\"SV-204598r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.\",\"RHEL-07-040430\",\"GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:95XKdYxzx1qHEALj0vVcUgfFdzE+HDbKJn+kj2tRtCY=\"},\"C-4723r88989_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:q8f6Jmtw61OMK7wrwD6lUOd8HB4HcM3fOlMH3PkuZgg=\"},\"F-4723r88990_fix\",\"V-204599\",\"medium\",\"SRG-OS-000364-GPOS-00151\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4930,\"SV-204599r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed.\",\"RHEL-07-040440\",\"Kerberos authentication for SSH is often implemented using Generic Security Service Application Program Interface (GSSAPI). If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementation may then be subject to exploitation. To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be disabled for systems not using this capability.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XRT3D2vqhfiWwUMNKp1iT0NPdaECtsiOv+PkO9tvPIQ=\"},\"C-4724r88992_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jQUn3D+sFRAlgnGUSH9cqqjkv9PoNyIrXnrGPGcEv5k=\"},\"F-4724r88993_fix\",\"V-204600\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4931,\"SV-204600r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon performs strict mode checking of home directory configuration files.\",\"RHEL-07-040450\",\"If other users have access to modify user-specific SSH configuration files, they may be able to log on to the system as another user.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uaQWPHqYSfcx2Hsbsz6oSx3/NvJ2S9ZZWyR1AaamE3c=\"},\"C-4725r88995_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zZpuieBctwldmi6eIcERNzoXGyEr3faLqs3fQtGyyVw=\"},\"F-4725r88996_fix\",\"V-204601\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4932,\"SV-204601r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon uses privilege separation.\",\"RHEL-07-040460\",\"SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would decrease the impact of software vulnerabilities in the unprivileged section.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZEDgUUGRtYwtdg/7IGePmM+mO77jBmQ2y6qQSJnzh88=\"},\"C-4726r88998_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KYaVM1r633+W0Wve0UtUbhlZczsFNuL7IEagI+ikd2I=\"},\"F-4726r88999_fix\",\"V-204602\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4933,\"SV-204602r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow compression or only allows compression after successful authentication.\",\"RHEL-07-040470\",\"If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vFy+LSYNEqK8q0jlqPSRN9R2KTNP4oH9DkTCn3+F6lU=\"},\"C-4727r89001_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:M/hOba2r0QaIPkgCW9PuPUW++WJrYiNkoxWDWBk0TpA=\"},\"F-4727r89002_fix\",\"V-204603\",\"medium\",\"SRG-OS-000355-GPOS-00143\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4934,\"SV-204603r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must, for networked systems, synchronize clocks with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, a time server designated for the appropriate DoD\",\"RHEL-07-040500\",\"Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.\\n\\nSynchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network.\\n\\nOrganizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints).\\n\\nSatisfies: SRG-OS-000355-GPOS-00143, SRG-OS-000356-GPOS-00144\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cXVgQoJtqPP16H6INhLNMDk5sX6o5q6ee0+MombCLUE=\"},\"C-4728r89004_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ZtOVMm1z0V1iMbun6RkRK9SwQrwqJLpq5eClGiG/Nk4=\"},\"F-4728r89005_fix\",\"V-204604\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4935,\"SV-204604r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must enable an application firewall, if available.\",\"RHEL-07-040520\",\"Firewalls protect computers from network attacks by blocking or limiting access to open network ports. Application firewalls limit which applications are allowed to communicate over the network.\\n\\nSatisfies: SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5AeStZQDNTFP8dyAN+kdFOwEHd7ujN7N8QOsth1BYFI=\"},\"C-4729r89007_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HVYPccbIpDKZ3GH14dxeoC/9Y07YDJ2ua3K1XD8mRwM=\"},\"F-4729r89008_fix\",\"V-204605\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4936,\"SV-204605r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must display the date and time of the last successful account logon upon logon.\",\"RHEL-07-040530\",\"Providing users with feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2MW4CbQWQSdnWTn+vJjAqUXxy39KvlIkThmnSy/UnmI=\"},\"C-4730r89010_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zG2ejNhnMKFBTuhN2Dwb6ws3PtZqpdwum63IT4dN2Do=\"},\"F-4730r89011_fix\",\"V-204606\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4937,\"SV-204606r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not contain .shosts files.\",\"RHEL-07-040540\",\"The .shosts files are used to configure host-based authentication for individual users or the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v4IA4z20DXRjhaVy+lPUHGEq1PKWrz2BRO+w5yuY2A4=\"},\"C-4731r89013_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:iAG2eQUIiF6iF8xBCRDdrpYX7SYLm6n7X1rzAuRhTyA=\"},\"F-4731r89014_fix\",\"V-204607\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4938,\"SV-204607r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not contain shosts.equiv files.\",\"RHEL-07-040550\",\"The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rZwRT3O4olP1cUbfaVWLtsV55GMO6FG1urqqL7Z5if0=\"},\"C-4732r89016_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oTf9BJoMwzWXGsPa9JPAVvuMhtDZFy83jaBTDB/KFpo=\"},\"F-4732r89017_fix\",\"V-204608\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4939,\"SV-204608r241939_rule\",\"low\",null,null,\"For Red Hat Enterprise Linux operating systems using DNS resolution, at least two name servers must be configured.\",\"RHEL-07-040600\",\"To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eQBkLoCxbhLSL0FSX13w71XInyURAJYddveh0zcMYZs=\"},\"C-4733r89019_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:y+24JzwqotIYx7gqe5g6jITwUglOdhYm/qTYhNtdFZk=\"},\"F-4733r89020_fix\",\"V-204609\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4940,\"SV-204609r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets.\",\"RHEL-07-040610\",\"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FwLT66vNGmWrFses/sAjJSSaKxtlj7doQb3MZgBImX8=\"},\"C-4734r89022_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HO2PKACks+73FSunYYTdtPYisctn2lnasLL69QkZx4I=\"},\"F-4734r89023_fix\",\"V-204610\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4941,\"SV-204610r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces.\",\"RHEL-07-040611\",\"Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p1jUPBQZCsvZDLRRitg2VYMt2+J7ICQQdk58h8+Ceww=\"},\"C-4735r89025_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Gq/vTd0tjUvdnU5c0TxXUZhM6dJK0L6q1WsBW6Y6gPU=\"},\"F-4735r89026_fix\",\"V-204611\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4942,\"SV-204611r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when possible by default.\",\"RHEL-07-040612\",\"Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cG2bpeEieasuM4Qt7PgAX0WNy3Jg+IohvlZC3bDIxnk=\"},\"C-4736r89028_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NTL219/6bYDMTON9XSc9S9cWfktEkrQPTcTrRGmhtSc=\"},\"F-4736r89029_fix\",\"V-204612\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4943,\"SV-204612r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default.\",\"RHEL-07-040620\",\"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MRRtJ87d9codxHSiwiP6FQaDVF9nRZZKpZzZKdkt8tc=\"},\"C-4737r89031_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:85PUYBt8Wup7sfq95PhD6gnuL6/s7LBJQuexpMb9+KA=\"},\"F-4737r89032_fix\",\"V-204613\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4944,\"SV-204613r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not respond to Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.\",\"RHEL-07-040630\",\"Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8YTZ6fEoQgsCaCCADaJpdHZaoc+u9wlTzoxXW92DDXI=\"},\"C-4738r89034_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fjCX0oYjs4K4WUl6cdO3QKoRLCxTiAc8/80ZgMIjPqY=\"},\"F-4738r89035_fix\",\"V-204614\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4945,\"SV-204614r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted.\",\"RHEL-07-040640\",\"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/GqImo5AYk9oB6VesRt32EX9qhNxt0bsSwz/JfdpsTM=\"},\"C-4739r89037_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tWci+stkNSEw1rQydP4hqVP4Es8/V0uGvLQAjq4FXy0=\"},\"F-4739r89038_fix\",\"V-204615\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4946,\"SV-204615r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.\",\"RHEL-07-040641\",\"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rajjUFaPBiT4Sd2KHjdKE74EwKfpgWlkjrCk3HupPOg=\"},\"C-4740r89040_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tnpYW+PKr3HpfMAGcg1EJcUhn3xPz0d5BdCvz0h23oM=\"},\"F-4740r89041_fix\",\"V-204616\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4947,\"SV-204616r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not allow interfaces to perform Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects by default.\",\"RHEL-07-040650\",\"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly revealing portions of the network topology.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eI/kCnLWasuxYrqINFrqYvnYRusBETB3PyweSidvuS0=\"},\"C-4741r89043_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cBYZZiaWYKmFjEYKjwUnAbM7tZwSJVrfhYpOGfbhXdk=\"},\"F-4741r89044_fix\",\"V-204617\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4948,\"SV-204617r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects.\",\"RHEL-07-040660\",\"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly revealing portions of the network topology.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ehZyYb58GoVTgK7yVpGqpPJBA7NKrWkkjvGCe4/cHMw=\"},\"C-4742r89046_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:yhEK6NuW4WdRcxfcoTRtFQgiYsMbK57qrVfbNbfQZ9M=\"},\"F-4742r89047_fix\",\"V-204618\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4949,\"SV-204618r241939_rule\",\"medium\",null,null,\"Network interfaces configured on the Red Hat Enterprise Linux operating system must not be in promiscuous mode.\",\"RHEL-07-040670\",\"Network interfaces in promiscuous mode allow for the capture of all network traffic visible to the system. If unauthorized individuals can access these applications, it may allow then to collect information such as logon IDs, passwords, and key exchanges between systems.\\n\\nIf the system is being used to perform a network troubleshooting function, the use of these tools must be documented with the Information System Security Officer (ISSO) and restricted to only authorized personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6FOjMjnPE6o/2RQfLIQ7oCu1NiuJoXu8ZloEh6aQnOc=\"},\"C-4743r89049_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cyM0WmnGxvBXRRp0YFSiJZeW7vUye4blZdY444e0/no=\"},\"F-4743r89050_fix\",\"V-204619\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4950,\"SV-204619r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to prevent unrestricted mail relaying.\",\"RHEL-07-040680\",\"If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay for the purpose of sending spam or other unauthorized activity.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GYLgPoC9dWO6EQnX8n402yDsuMPAnK9fUZjDeNJuVlQ=\"},\"C-4744r89052_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RRWH8/X8wLuvfQSBfZasWwuL/5PBM9a/OsDIO6uaWzo=\"},\"F-4744r89053_fix\",\"V-204620\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4951,\"SV-204620r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have a File Transfer Protocol (FTP) server package installed unless needed.\",\"RHEL-07-040690\",\"The FTP service provides an unencrypted remote access that does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised. SSH or other encrypted file transfer methods must be used in place of this service.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bjTPHU4AZoK6BfgfQVubbfWkNDK50eujmcmoDTDukmw=\"},\"C-4745r89055_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gFY0nCBxuLCZzgbZxxi0+UGWs4WK6U6lg0G4nGms8+c=\"},\"F-4745r89056_fix\",\"V-204621\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4952,\"SV-204621r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have the Trivial File Transfer Protocol (TFTP) server package installed if not required for operational support.\",\"RHEL-07-040700\",\"If TFTP is required for operational support (such as the transmission of router configurations) its use must be documented with the Information System Security Officer (ISSO), restricted to only authorized personnel, and have access control rules established.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N0HT3nvX0nacPF0nic2Fvo+QoxFewqWUvw8Cb2dpdyE=\"},\"C-4746r89058_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/ZanvCC0BUgOEU2xiMkMW8jn2JFseHUzGwkoLvPO7Ww=\"},\"F-4746r89059_fix\",\"V-204622\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4953,\"SV-204622r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that remote X connections for interactive users are encrypted.\",\"RHEL-07-040710\",\"Open X displays allow an attacker to capture keystrokes and execute commands remotely.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BQENP4a828YEZSXVXQtFoPetmYEFb8+83NfUr43aZ74=\"},\"C-4747r89061_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oZYVTfOCZj0stqUz9kKUxX7h+6FupXnYdOdIzRnl0mU=\"},\"F-4747r89062_fix\",\"V-204623\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4954,\"SV-204623r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that if the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon is configured to operate in secure mode.\",\"RHEL-07-040720\",\"Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting system files.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nW951brbjAkAlDNfMZI++v9EZTA23qYKprHAkBSWFUY=\"},\"C-4748r89064_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:g8ZkdpWH96vEPFX5ESHd9ky+MZd0MVuZXesCggS6m34=\"},\"F-4748r89065_fix\",\"V-204624\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4955,\"SV-204624r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not have an X Windows display manager installed unless approved.\",\"RHEL-07-040730\",\"Internet services that are not required for system or application processes must not be active to decrease the attack surface of the system. X Windows has a long history of security vulnerabilities and will not be used unless approved and documented.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ng0nTd+F1YUu4CUZtk3DYlhWROBAoM4ie5InHAQthN4=\"},\"C-4749r89067_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QmMprBr2eZLDrQvdHB9GdZ86VNbOdUvsiMmqhIdbkqg=\"},\"F-4749r89068_fix\",\"V-204625\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4956,\"SV-204625r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not be performing packet forwarding unless the system is a router.\",\"RHEL-07-040740\",\"Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this software is used when not required, system network information may be unnecessarily transmitted across the network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MkXnVi+BfZNKD8HBi1BdRhBwQYqAqk37hdGW0wzHsBo=\"},\"C-4750r89070_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:j6VcelJRgVA4Y3z+Ne5pwBUGCh8q+WYi4U0tTn1l/pU=\"},\"F-4750r89071_fix\",\"V-204626\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4957,\"SV-204626r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.\",\"RHEL-07-040750\",\"When an NFS server is configured to use RPCSEC_SYS, a selected userid and groupid are used to handle requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The RPCSEC_GSS method of authentication uses certificates on the server and client systems to more securely authenticate the remote mount request.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LPkkcM3GKLloG2iIqGS//40g7fdb9hulnGjTO5OPl/c=\"},\"C-4751r89073_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:EaHp4BPOrxxdG+2wJpgynKF1UEZ8Z9HXXq1HwFQhoq4=\"},\"F-4751r89074_fix\",\"V-204627\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4958,\"SV-204627r241939_rule\",\"high\",null,null,\"SNMP community strings on the Red Hat Enterprise Linux operating system must be changed from the default.\",\"RHEL-07-040800\",\"Whether active or not, default Simple Network Management Protocol (SNMP) community strings must be changed to maintain security. If the service is running with the default authenticators, anyone can gather data about the system and the network and use the information to potentially compromise the integrity of the system or network(s). It is highly recommended that SNMP version 3 user authentication and message encryption be used in place of the version 2 community strings.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aj2+q1FDm7tuIsdCJ6yjAVx2dNimOetQj7BToo/VlEg=\"},\"C-4752r89076_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/D2dqEXX4V/I16RqUkyCnszvssRqNUU7YHRl6wMHa/Y=\"},\"F-4752r89077_fix\",\"V-204628\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4959,\"SV-204628r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system access control program must be configured to grant or deny system access to specific hosts and services.\",\"RHEL-07-040810\",\"If the systems access control program is not configured with appropriate rules for allowing and denying access to system network resources, services may be accessible to unauthorized hosts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kkwHgTSKsJctRdFnhk7oBugs+k0hSvrAHTNBODYlnRY=\"},\"C-4753r89079_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CJFIHGHu/Ahf1QpfA3b6XDDdhlwGDdNBStawu9T5tho=\"},\"F-4753r89080_fix\",\"V-204629\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4960,\"SV-204629r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not have unauthorized IP tunnels configured.\",\"RHEL-07-040820\",\"IP tunneling mechanisms can be used to bypass network filtering. If tunneling is required, it must be documented with the Information System Security Officer (ISSO).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A4M7YDCBxwn82FM8E2pYn9DdV8RWXiiwlGjESBKWFWc=\"},\"C-4754r89082_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tLQQARe7p90gWnNRXyllJC/m16NksdyCY9EyUOeRuHM=\"},\"F-4754r89083_fix\",\"V-204630\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4961,\"SV-204630r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not forward IPv6 source-routed packets.\",\"RHEL-07-040830\",\"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:duPPEkYg4Z6hIj9Yd6lOp0gvtSraIDw+nJz6zxmFvqE=\"},\"C-4755r89085_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YSqpQKIwhp2ZC1jrJSTdg7d4cJRA6Hbv++u8d3+ahfQ=\"},\"F-4755r89086_fix\",\"V-204631\",\"medium\",\"SRG-OS-000375-GPOS-00160\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4962,\"SV-204631r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must have the required packages for multifactor authentication installed.\",\"RHEL-07-041001\",\"Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\\n\\nA privileged account is defined as an information system account with authorizations of a privileged user.\\n\\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management).\\n\\nSatisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:C1LYFgaAqeuTh7Gtm38t3OcPVMq8CySBTILHzdSksbQ=\"},\"C-4756r89088_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XDloiqHMj2ldT1rBcJmIwqmYeKadE4QFbz+ypjK1Xd8=\"},\"F-4756r89089_fix\",\"V-204632\",\"medium\",\"SRG-OS-000375-GPOS-00160\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4963,\"SV-204632r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement multifactor authentication for access to privileged accounts via pluggable authentication modules (PAM).\",\"RHEL-07-041002\",\"Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\\n\\nA privileged account is defined as an information system account with authorizations of a privileged user.\\n\\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management).\\n\\nSatisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:o86wCHVnLXklbvao4gX06PkNKLM2n2dr61EHb3iOGuE=\"},\"C-4757r89091_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C+smaI80UgLR6sPJuLau7SkZhyN+Yirf5Yht9/ba90A=\"},\"F-4757r89092_fix\",\"V-204633\",\"medium\",\"SRG-OS-000375-GPOS-00160\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4964,\"SV-204633r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement certificate status checking for PKI authentication.\",\"RHEL-07-041003\",\"Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\\n\\nA privileged account is defined as an information system account with authorizations of a privileged user.\\n\\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management).\\n\\nSatisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2hPpDflNaMEbweY8kZ9GeMsYvJyW3OYECrRyUBb7WFU=\"},\"C-4758r89094_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TQIFjLZmV+wLHWdHvzMcJFt32vRR6Kijwnw5xWu5MqY=\"},\"F-4758r89095_fix\",\"V-204634\",\"medium\",\"SRG-OS-000424-GPOS-00188\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4965,\"SV-204634r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all wireless network adapters are disabled.\",\"RHEL-07-041010\",\"The use of wireless networking can introduce many different attack vectors into the organization's network. Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to create a denial of service to valid network resources.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:iSqVW4RiHyBVvrAYsGNx9SrOT+nAF6gnNHhGSMv/OPg=\"},\"C-15999r192362_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oOI5Mi24TV+g/qDOT1oyHshUdmQD3N1tU88YFY33XM8=\"},\"F-15997r192363_fix\",\"V-214799\",null,\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4966,\"SV-214799r241939_rule\",null,null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the cryptographic hash of system files and commands matches vendor values.\",\"RHEL-07-010020\",\"Without cryptographic integrity protections, system command and files can be altered by unauthorized users without detection.\\n\\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pp7LtbhvevdAe+ue4EVnM1uccxy7pW3XZ+xC9xFfmNk=\"},\"C-16000r192365_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:EcCFM8f6faJ+Y2AqXcOa7IfRS6V57umK55VW3UkAc1A=\"},\"F-15998r192366_fix\",\"V-214800\",null,\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4967,\"SV-214800r241939_rule\",null,null,null,\"The Red Hat Enterprise Linux operating system must have a host-based intrusion detection tool installed.\",\"RHEL-07-020019\",\"Adding host-based intrusion detection tools can provide the capability to automatically take actions in response to malicious behavior, which can provide additional agility in reacting to network threats. These tools also often include a reporting capability to provide network awareness of the system, which may not otherwise exist in an organization's systems management regime.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9LhzdHuv/khleaS+BQu9ZlUcdjdohBUoq5bjuJZdhK8=\"},\"C-16001r192368_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OcfCs3Q0wVovyUOOu9z0LWAjnT/FA3EL8ebXHSrlehs=\"},\"F-15999r192369_fix\",\"V-214801\",null,\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4968,\"SV-214801r241939_rule\",null,null,null,\"The Red Hat Enterprise Linux operating system must use a virus scan program.\",\"RHEL-07-032000\",\"Virus scanning software can be used to protect a system from penetration from computer viruses and to limit their spread through intermediate systems.  \\n\\nThe virus scanning software should be configured to perform scans dynamically on accessed files. If this capability is not available, the system must be configured to scan, at a minimum, all altered files on the system on a daily basis.\\n\\nIf the system processes inbound SMTP mail, the virus scanner must be configured to scan all received mail.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:M7pACkppJDi/CsMl2CmLoXQL4s2zAFRVxqwbrcNQ3+k=\"},\"C-16137r193200_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2Gkgp8uVI1bLYW6K55h7LR8klUBCa5UWZ6TUZAdA86Y=\"},\"F-16135r193201_fix\",\"V-214937\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",4969,\"SV-214937r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.\",\"RHEL-07-010062\",\"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.\\n\\nThe session lock is implemented at the point where session activity can be determined.\\n\\nThe ability to enable/disable a session lock is given to the user by default. Disabling the user’s ability to disengage the graphical user interface session lock provides the assurance that all sessions will lock after the specified period of time.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4972,\"SV-106179r1_rule\",\"medium\",null,null,\"The VPN Gateway must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:slm2UFIqnUUPyOpfIcsxSew4LGvsTesU9C6Ju5XJ3mw=\"},\"C-95879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fgzhbaQbILFSeEwIwlOogRZtoeuNS7Kr0AHwx84IKLg=\"},\"F-102723r1_fix\",\"V-97043\",\"medium\",\"SRG-NET-000041-VPN-000110\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4973,\"SV-106181r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.\",\"SRG-NET-000041-VPN-000110\",\"Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n \\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jc6QW12gqdTKEPqvls4bilVyDJExcCoSskTVyO0VtC8=\"},\"C-95881r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QOTNmZJgq99GtXVEhYObEaDdxa5uT73FDkpBccGCe5Q=\"},\"F-102725r1_fix\",\"V-97045\",\"medium\",\"SRG-NET-000042-VPN-000120\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4974,\"SV-106183r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must enforce a policy to retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.\",\"SRG-NET-000042-VPN-000120\",\"The banner must be acknowledged by the user prior to allowing the user access to the network. This provides assurance that the user has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the user, DoD will not be in compliance with system use notifications required by law. \\n\\nThe banner is usually configured in NDM for client presentation as well as local logon.\\n\\nTo establish acceptance of the application usage policy, a click-through banner at application logon is required. The VPN gateway must prevent further activity until the user executes a positive action to manifest agreement by clicking on a box indicating \\\"OK\\\". \\n\\nThis applies to gateways that have the concept of a user account and have the login function residing on the gateway or the gateway acts as a user intermediary.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4cT/S3JRnRG1/bjkxCCl0FvJ2jFBPQxR6xd/ho3iPwU=\"},\"C-95883r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zvj+8RueEc8AGER4mc5vsA+JPLux2r9T3RERyvr6GqU=\"},\"F-102727r1_fix\",\"V-97047\",\"medium\",\"SRG-NET-000043-VPN-000130\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4975,\"SV-106185r1_rule\",\"medium\",null,null,\"The publicly accessible VPN Gateway must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\",\"SRG-NET-000043-VPN-000130\",\"Display of a standardized and approved use notification before granting access to the publicly accessible VPN gateway ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with DTM-08-060. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IdemsTDQGwPd7bokQxIIvpGCFpuH2a0LMkx43UGqWUA=\"},\"C-95885r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zwSBwQLPqjyi/Vwm1CxWQnlXRWyZZB59z9HGXUELgyQ=\"},\"F-102729r1_fix\",\"V-97049\",\"low\",\"SRG-NET-000049-VPN-000150\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4976,\"SV-106187r1_rule\",\"low\",null,null,\"The VPN Gateway must notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access).\",\"SRG-NET-000049-VPN-000150\",\"Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the number of unsuccessful attempts that were made to login to their account allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators.\\n\\nThis applies to gateways that have the concept of a user account and have the login function residing on the gateway or the gateway acts as a user intermediary.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aVWTWelue2vPX4PPQhsVdenoG0JoZrePs1txZu8Tn9w=\"},\"C-95887r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Bxnvb6aexynxn1Y2nmdyofyqfjFnX0xOt15KQeL53to=\"},\"F-102731r1_fix\",\"V-97051\",\"medium\",\"SRG-NET-000053-VPN-000170\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4977,\"SV-106189r1_rule\",\"medium\",null,null,\"The VPN Gateway must limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number.\",\"SRG-NET-000053-VPN-000170\",\"VPN gateway management includes the ability to control the number of users and user sessions that utilize a VPN gateway. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to DoS attacks.\\n\\nThis requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.\\n\\nThe intent of this policy is to ensure the number of concurrent sessions is deliberately set to a number based on the site's mission and not left unlimited.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CyTJHLIKQ2Ojkg9rwcZ3x7T66VHLzHB54n+nmQfac2E=\"},\"C-95889r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:H+ZsJRqo1BYEq9Wumb38YWMb+3wdolcYgDCbwGXeDJo=\"},\"F-102733r1_fix\",\"V-97053\",\"high\",\"SRG-NET-000062-VPN-000200\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4978,\"SV-106191r1_rule\",\"high\",null,null,\"The TLS VPN Gateway must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during transmission.\",\"SRG-NET-000062-VPN-000200\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nNIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b0U2i/2oFdeOwmGlTBap86LUQ1gHdfQ3eL4us+64fpw=\"},\"C-95891r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:J8KVE+KgBfuYvKemq7ovYBGF4IuGwoDzawSXyCaOyAQ=\"},\"F-102735r1_fix\",\"V-97055\",\"medium\",\"SRG-NET-000063-VPN-000210\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4979,\"SV-106193r1_rule\",\"medium\",null,null,\"The remote access VPN Gateway must use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.\",\"SRG-NET-000063-VPN-000210\",\"Without integrity protection, unauthorized changes may be made to the log files and reliable forensic analysis and discovery of the source of malicious system activity may be degraded.\\n\\nRemote access (e.g., RDP) is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless.\\n\\nIntegrity checks include cryptographic checksums, digital signatures, or hash functions. Federal Information Processing Standard (FIPS) 186-4, Digital Signature Standard (DSS), specifies three NIST-approved algorithms: DSA, RSA, and ECDSA. All three are used to generate and verify digital signatures in conjunction with an approved hash function.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v3WpQRoQigeTzLi65BYsrw9t+ZEEROlTq1kxXFTTLlc=\"},\"C-95893r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0D+opAzf5nzDclgwdIOkAD6j3JJiMTsVJtgVtp12Gss=\"},\"F-102737r1_fix\",\"V-97057\",\"medium\",\"SRG-NET-000063-VPN-000220\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4980,\"SV-106195r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.\",\"SRG-NET-000063-VPN-000220\",\"Without strong cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThe remote access VPN provides access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+B3+7JmTL1p1pvXgkAa8wGoCkVHYXHjICDWeklY1MTk=\"},\"C-95895r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:M9780XhNnUX+zVJLNXdHbTc95ro/kqEEj3UK2rL6hHI=\"},\"F-102739r1_fix\",\"V-97059\",\"high\",\"SRG-NET-000074-VPN-000250\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4981,\"SV-106197r1_rule\",\"high\",null,null,\"The IPsec VPN must implement a FIPS 140-2 validated Diffie-Hellman (DH) group.\",\"SRG-NET-000074-VPN-000250\",\"Use of an approved DH algorithm ensures the Internet Key Exchange (IKE) (phase 1) proposal uses FIPS-validated key management techniques and processes in the production, storage, and control of private/secret cryptographic keys. The security of the DH key exchange is based on the difficulty of solving the discrete logarithm in which the key was derived from. Hence, the larger the modulus, the more secure the generated key is considered to be.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YlctilOwQ2MBW7zoqYuhAoiJN5c5NYVKUMH7L8KW2VE=\"},\"C-95899r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:13l80RWe85t3TbQcxGDY1TeqhIv8oq9LWDSwKSmwv2c=\"},\"F-102743r1_fix\",\"V-97061\",\"low\",\"SRG-NET-000077-VPN-000280\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4982,\"SV-106199r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish what type of events occurred.\",\"SRG-NET-000077-VPN-000280\",\"Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nVPN gateways often have a separate audit log for capturing VPN status and other information about the traffic (as opposed to the log capturing administrative and configuration actions). Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.\\n\\nAssociating event types with detected events in the VPN gateway logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HGobFrLp43KBzaBeaBiQba6hjKEcpQn11VJTJJwwmMo=\"},\"C-95901r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1960KI2uASwT2grDyD1D8glCHawNm1LCT+mppgDNAG4=\"},\"F-102745r1_fix\",\"V-97063\",\"low\",\"SRG-NET-000078-VPN-000290\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4983,\"SV-106201r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish when (date and time) the events occurred.\",\"SRG-NET-000078-VPN-000290\",\"Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nVPN gateways often have a separate audit log for capturing VPN status and other information about the traffic (as opposed to the log capturing administrative and configuration actions).\\n\\nAssociating event types with detected events in the network audit logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:P/zyghBUSYmw8eYcF6kqAgE8TeMANzSroGoCNq9DxmU=\"},\"C-95903r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jl3z7pSS/5EUBqiypkdJCKqCZ9U+KdO46Z7KbtxpUpI=\"},\"F-102747r1_fix\",\"V-97065\",\"medium\",\"SRG-NET-000079-VPN-000300\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4984,\"SV-106203r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records containing information that establishes the identity of any individual or process associated with the event.\",\"SRG-NET-000079-VPN-000300\",\"Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/9F2orQ7S4UyHUeIF5MNwyf2YqTtEcZKOu6Lyy3dl0w=\"},\"C-95905r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8Jh0XPz5tsLOV5OOHxTog1U4Ld3GURTDC/neBufCCRc=\"},\"F-102749r1_fix\",\"V-97067\",\"medium\",\"SRG-NET-000088-VPN-000310\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4985,\"SV-106205r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records containing information to establish where the events occurred.\",\"SRG-NET-000088-VPN-000310\",\"Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nIn order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know where events occurred, such as VPN gateway components, modules, device identifiers, node names, and functionality.\\n\\nAssociating information about where the event occurred within the network provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TBiXTAY2X10uilSJ/Zo764Ce7gxa+BC604igCvR21Ys=\"},\"C-95907r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fdhbsyNKzbH4WTd1xvpZy3y/UYX8uj3SGwmY5U6RSTM=\"},\"F-102751r1_fix\",\"V-97069\",\"low\",\"SRG-NET-000089-VPN-000330\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4986,\"SV-106207r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish the source of the events.\",\"SRG-NET-000089-VPN-000330\",\"Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event.\\n\\nIn addition to logging where events occur within the network, the log records must also identify sources of events such as IP addresses, processes, and node or device names.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2+gLZEUpQFGiiXTLj5vTvPMeNuYVSesoUBq5osjiwyA=\"},\"C-95909r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+Hhc/f/5x1WDFzGN2o6Zu1Zd4z5P5GcPUtxEuGkAWCk=\"},\"F-102753r1_fix\",\"V-97071\",\"medium\",\"SRG-NET-000091-VPN-000350\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4987,\"SV-106209r1_rule\",\"medium\",null,null,\"The VPN Gateway must produce log records containing information to establish the outcome of the events.\",\"SRG-NET-000091-VPN-000350\",\"Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the network.\\n\\nEvent outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the network after the event occurred). As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mi17ibh62O4cda5bcRUSENaNZI+A+wHMQdsAhZaeELQ=\"},\"C-95911r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:uA4H2p1A7Ll9hacECizf787pb/UA7IqAnIHhct/QrEM=\"},\"F-102755r1_fix\",\"V-97073\",\"low\",\"SRG-NET-000098-VPN-000370\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4988,\"SV-106211r1_rule\",\"low\",null,null,\"The VPN Gateway must protect log information from unauthorized read access if all or some of this data is stored locally.\",\"SRG-NET-000098-VPN-000370\",\"Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured VPN gateway. Thus, it is imperative that the collected log data from the various VPN gateways, as well as the auditing tools, be secured and can only be accessed by authorized personnel.\\n\\nThis requirement pertains to securing the VPN log as it is stored locally, on the box temporarily, or while being encapsulated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xx7dyKjP3tr449DemD15SwuRdkEieFRE1AhuT429Hbk=\"},\"C-95913r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0Ev7nKBuQufWeKLn3k7Wr/z0hb8pni2MRJGUGCqohj8=\"},\"F-102757r1_fix\",\"V-97075\",\"medium\",\"SRG-NET-000099-VPN-000380\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4989,\"SV-106213r1_rule\",\"medium\",null,null,\"The VPN Gateway log must protect audit information from unauthorized modification when stored locally.\",\"SRG-NET-000099-VPN-000380\",\"If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\\n\\nThis requirement pertains to securing the VPN log as it is stored locally, on the box temporarily, or while being encapsulated.\\n\\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\\n\\nAudit information includes all information (e.g., log records, audit settings, and audit reports) needed to successfully audit information system activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LurVSxZqQlUG4THAxXLsYwtoOIQkH9C5vFm75lhPk+M=\"},\"C-95915r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PRb2voDcKub8xxvNSpdygBWfbLpwWfUE85OlSdeFxMU=\"},\"F-102759r1_fix\",\"V-97077\",\"medium\",\"SRG-NET-000100-VPN-000390\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4990,\"SV-106215r1_rule\",\"medium\",null,null,\"The VPN Gateway must protect audit information from unauthorized deletion when stored locally.\",\"SRG-NET-000100-VPN-000390\",\"If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\\n\\nTo ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification.\\n\\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\\n\\nAudit information includes all information (e.g., log records, audit settings, and audit reports) needed to successfully audit information system activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:R+x0KRiQIKJIbqWDk9OWXOHA/tx5c83O7HSpjbaqItQ=\"},\"C-95917r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4gmYRDVBlFkpvQ5jFnJALH34Q1qS7urLI7Yjatvv5Ks=\"},\"F-102761r1_fix\",\"V-97079\",\"medium\",\"SRG-NET-000132-VPN-000450\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4991,\"SV-106217r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.\",\"SRG-NET-000132-VPN-000450\",\"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\\n\\nDoD continually assesses the ports, protocols, and services that can be used for network communications. Some protocols or services have known exploits or security weaknesses. Network traffic using these ports, protocols, and services must be prohibited or restricted in accordance with DoD policy. The PPSM CAL and vulnerability assessments provide an authoritative source for ports, protocols, and services that are unauthorized or restricted across boundaries on DoD networks.\\n\\nThe VPN Gateway must be configured to prevent or restrict the use of prohibited ports, protocols, and services throughout the network by filtering the network traffic and disallowing or redirecting traffic as necessary. Default and updated policy filters from the vendors will disallow older version of protocols and applications and will address most known non-secure ports, protocols, and/or services.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6xznw8iyFeJRJwk1JYCPRsiNwv5VE1E6oPOibHnQepY=\"},\"C-95919r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BV4FIuZmpkNnwep3K+axA7S7eorRTT2tR14EUOT7U0Y=\"},\"F-102763r1_fix\",\"V-97081\",\"medium\",\"SRG-NET-000132-VPN-000460\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4992,\"SV-106219r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use IKEv2 for IPsec VPN security associations.\",\"SRG-NET-000132-VPN-000460\",\"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\\n\\nUse of IKEv2 leverages DoS protections because of improved bandwidth management and leverages more secure encryption algorithms.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U9u5kkzq19uYYwdfbvK93u00swz2+lLKN/KXYD1SLPM=\"},\"C-95921r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CZLDS9pX8n0hhkw38hCbPDJhpjz0SK1r40ll/eFYuDI=\"},\"F-102765r1_fix\",\"V-97083\",\"medium\",\"SRG-NET-000132-VPN-000470\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4993,\"SV-106221r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and L2F.\",\"SRG-NET-000132-VPN-000470\",\"The PPTP and L2F are obsolete method for implementing virtual private networks. Both protocols may be easy to use and readily available, but they have many well-known security issues and exploits. Encryption and authentication are both weak.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qL67vWiduAPXEoBZfFyKtQr8Xx5q0lifYoN8/VKeiXk=\"},\"C-95923r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fRSUaDiTIxiKHwtXC7xhS028BxmoqEKmcdKtfdEYU8A=\"},\"F-102767r1_fix\",\"V-97085\",\"medium\",\"SRG-NET-000132-VPN-000480\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4994,\"SV-106223r1_rule\",\"medium\",null,null,\"For site-to-site VPN implementations, the  L2TP protocol must be blocked or denied at the security boundary with the private network so unencrypted L2TP packets cannot traverse into the private network of the enclave.\",\"SRG-NET-000132-VPN-000480\",\"Unlike GRE (a simple encapsulating header) L2TP is a full-fledged communications protocol with control channel, data channels, and a robust command structure. In addition to PPP, other link layer types (called pseudowires) can be and are defined for delivery in L2TP by separate RFC documents. Further complexity is created by the capability to define vender-specific parameters beyond those defined in the L2TP specifications.\\n\\nThe endpoint devices of an L2TP connection can be an L2TP Access Concentrator (LAC) in which case it inputs/outputs the layer 2 protocol to/from the L2TP tunnel. Otherwise, it is an L2TP Network Server (LNS), in which case it inputs/outputs the layer 3 (IP) protocol to/from the L2TP tunnel. The specifications describe three reference models: LAC-LNS, LAC-LAC, and LNS-LNS, the first of which is the most common case. The LAC-LNS model allows a remote access user to reach his home network or ISP from a remote location. The remote access user connects to  a LAC device which tunnels his connection home to an awaiting LNS. The LAC could also be located on the remote user's laptop, which connects to an LNS at home using some generic internet connection. The other reference models may be used for more obscure scenarios.\\n\\nAlthough the L2TP protocol does not contain encryption capability, it can be operated over IPsec, which would provide authentication and confidentiality. A remote user in the LAC-LNS model would most likely obtain a dynamically assigned IP address from the home network to ultimately use through the tunnel back to the home network. Secondly, the outer IP source address used to send the L2TP tunnel packet to the home network is likely to be unknown or highly variable. Thirdly, since the LNS provides the remote user with a dynamic IP address to use, the firewall at the home network would have to be dynamically updated to accept this address in conjunction with the outer tunnel address. Finally, there is also the issue of authentication of the remote user prior to divulging an acceptable IP address. Because of all of these complications, the strict filtering rules applied to the IP-in-IP and GRE tunneling cases will likely not be possible in the L2TP scenario.\\n\\nIn addition to the difficulty of enforcing addresses and endpoints (as explained above), the L2TP protocol itself is a security concern if allowed through a security boundary. In particular:\\n\\n1) L2TP potentially allows link layer protocols to be delivered from afar. These protocols were intended for link-local scope only, are less defended, and not as well-known,\\n2) The L2TP tunnels can carry IP packets that are very difficult to see and filter because of the additional layer 2 overhead,\\n3) L2TP is highly complex and variable (vender-specific variability) and therefore would be a viable target that is difficult to defend. It is better left outside of the main firewall where less damage occurs if the L2TP-processing node is compromised,\\n4) Filtering cannot be used to detect and prevent other unintended layer 2 protocols from being tunneled. The strength of the application layer code would have to be relied on to achieve this task,\\n5) Regardless of whether the L2TP is handled inside or outside of the main network, a secondary layer of IP filtering is required; therefore bringing it inside does not save resources.\\n\\nTherefore, it is not recommended to allow unencrypted L2TP packets across the security boundary into the network's protected areas. Reference the Backbone Transport STIG for additional L2TP guidance and use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mmyK/9p+kkBzjw391gSBn/5JwQ6rUWRXc0i0deZcJlY=\"},\"C-95925r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PTCfoKcCD5hDW7K47sK1D7FeehVzMR67iHZOHpTiBJE=\"},\"F-102769r1_fix\",\"V-97087\",\"medium\",\"SRG-NET-000138-VPN-000490\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4995,\"SV-106225r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).\",\"SRG-NET-000138-VPN-000490\",\"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\\n\\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses except the following.\\n\\n(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\\n\\n(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals' in-group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN or proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D7dgt3RnYA25LvMASqDp9YTrG7KfSDck59y/cwVd1j4=\"},\"C-95927r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Rh+GrFD8y7n/BlVOr9JDOC5ROFB+DmI+8x461DH5A1Q=\"},\"F-102771r1_fix\",\"V-97089\",\"high\",\"SRG-NET-000140-VPN-000500\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4996,\"SV-106227r1_rule\",\"high\",null,null,\"The VPN Gateway must use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.\",\"SRG-NET-000140-VPN-000500\",\"To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.\\n\\nMultifactor authentication uses two or more factors to achieve authentication. Use of password for user remote access for non-privileged account is not authorized.\\n\\nFactors include:\\n(i) Something you know (e.g., password/PIN);\\n(ii) Something you have (e.g., cryptographic identification device, token); or\\n(iii) Something you are (e.g., biometric).\\n\\nA non-privileged account is any information system account with authorizations of a non-privileged user.\\n\\nNetwork access is any access to a network element by a user (or a process acting on behalf of a user) communicating through a network.\\n\\nThe DoD CAC with DoD-approved PKI is an example of multifactor authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KKZUM28vxti/o8G6lxUgCF8Wx8ura3+B1TExgJuWCGA=\"},\"C-95929r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:n8I5AADucbxW3nhWpeZCsAbA1ZwIJ9+ypR/dgDeDkbA=\"},\"F-102773r1_fix\",\"V-97091\",\"medium\",\"SRG-NET-000145-VPN-000510\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4997,\"SV-106229r1_rule\",\"medium\",null,null,\"The VPN Client must implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.\",\"SRG-NET-000145-VPN-000510\",\"Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD common access card.\\n\\nA non-privileged account is any information system account with authorizations of a non-privileged user.\\n\\nNetwork access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:koWH1S5xZuAZ4H9vnFXHr/qz4c6UDJH7P29FdfhEPZg=\"},\"C-95931r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/05962IPiIdyt4V5PSfPjQ8gsSvFmLoQb7Ih1O9CdmI=\"},\"F-102775r1_fix\",\"V-97093\",\"medium\",\"SRG-NET-000147-VPN-000520\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4998,\"SV-106231r1_rule\",\"medium\",null,null,\"The TLS VPN must be configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts.\",\"SRG-NET-000147-VPN-000520\",\"A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack.\\n\\nAn authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message.\\n\\nA non-privileged account is any operating system account with authorizations of a non-privileged user.\\n\\nTechniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:53vjl7nhxJZkAmPcXBfrWgxe2N8vSeOA4P5KeOUv1cA=\"},\"C-95933r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tvtLSoQBIUhFi1DUAx/IQFts2ZxCAJGEu1MMnqECcNE=\"},\"F-102777r1_fix\",\"V-97095\",\"medium\",\"SRG-NET-000147-VPN-000530\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",4999,\"SV-106233r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use anti-replay mechanisms for security associations.\",\"SRG-NET-000147-VPN-000530\",\"Anti-replay is an IPsec security mechanism at a packet level, which helps to avoid unwanted users from intercepting and modifying an ESP packet.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PQvyQqpQfxH4QYcuFED9dQWGmLZ5NjYVdg+5ViJyzMc=\"},\"C-95935r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PKYcfwohvuVW06x1QmIrzJEC7yX68OlFaic/tTj3y3A=\"},\"F-102779r1_fix\",\"V-97097\",\"medium\",\"SRG-NET-000148-VPN-000540\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5000,\"SV-106235r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify all network-connected endpoint devices before establishing a connection.\",\"SRG-NET-000148-VPN-000540\",\"Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\\n\\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification decisions (as opposed to the actual identifiers) to the services that need to act on those decisions.\\n\\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers (outside a datacenter), VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v5/IfNoYuNBZdJW3TnihRjv14rrPD9SLxquxNn9HMf0=\"},\"C-95937r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4mEma8P0Dv4vj5cqKTp53/Xgkv8CV31yYo/9WqBJF7I=\"},\"F-102781r1_fix\",\"V-97099\",\"medium\",\"SRG-NET-000164-VPN-000560\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5001,\"SV-106237r1_rule\",\"medium\",null,null,\"The VPN Gateway, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.\",\"SRG-NET-000164-VPN-000560\",\"Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. To meet this requirement, the information system must create trusted channels between itself and remote trusted authorized IT product (e.g., syslog server) entities that protect the confidentiality and integrity of communications. The information system must create trusted paths between itself and remote administrators and users that protect the confidentiality and integrity of communications.\\n\\nA trust anchor is an authoritative entity represented via a public key and associated data. It is most often used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. However, applications that do not use a trusted path are not approved for non-local and remote management of DoD information systems.\\n\\nUse of SSHv2 to establish a trusted channel is approved. Use of FTP, TELNET, HTTP, and SNMPV1 is not approved since they violate the trusted channel rule set. Use of web management tools that are not validated by common criteria may also violate the trusted channel rule set.\\n\\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA.\\n\\nThis requirement verifies that a certification path to an accepted trust anchor is used for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Validation of the certificate status information is out of scope for this requirement.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4L7fYYyaq26bvadPv3JCcQ3yEjurb6JgRmYQ/U0UV1c=\"},\"C-95939r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kHIpuc9rQ7c3thtVDQNITMH7ftHuWzgXExpBIujEdHQ=\"},\"F-102783r1_fix\",\"V-97101\",\"medium\",\"SRG-NET-000165-VPN-000570\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5002,\"SV-106239r1_rule\",\"medium\",null,null,\"The site-to-site VPN, when using PKI-based authentication for devices, must enforce authorized access to the corresponding private key.\",\"SRG-NET-000165-VPN-000570\",\"If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure.\\n\\nThe cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to authenticate to network devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ar3GvJuXEKD4A/Af2IozOGlLJBjfNqRbiW1i8k/7Y9g=\"},\"C-95941r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5j0XBOP7B/DfiJ4RQcUK0zsSkNS1ZJgD+jERXi5h0IM=\"},\"F-102785r1_fix\",\"V-97103\",\"medium\",\"SRG-NET-000166-VPN-000580\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5003,\"SV-106241r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway must use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.\",\"SRG-NET-000166-VPN-000580\",\"The VPN interacts directly with public networks and devices and should not contain user authentication information for all users. AAA network security services provide the primary framework through which a network administrator can set up access control and authorization on network points of entry or network access servers. It is not advisable to configure access control on the VPN gateway or remote access server. Separation of services provides added assurance to the network if the access control server is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:f0b/RYI3SCPeEqjHsb3psBWUdGRTKfgqRrq51hB7yfE=\"},\"C-95953r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Oi4jUVTD6ycPdzvYBP8T+rY1x1IUvcpUVTHSlQ5ZZHM=\"},\"F-102797r1_fix\",\"V-97113\",\"medium\",\"SRG-NET-000166-VPN-000590\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5004,\"SV-106251r1_rule\",\"medium\",null,null,\"The VPN Gateway must map the authenticated identity to the user account for PKI-based authentication.\",\"SRG-NET-000166-VPN-000590\",\"Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of a user (e.g., VPN or ALG. This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MRKxPi/bbsDz8wNN9vXmb7hhgMU8M3+JU6oyqsrMnZk=\"},\"C-95955r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pSURQgwBF8TrM2BF5TWiE9Mm2xRU9ilNiN8qenfhfhs=\"},\"F-102799r1_fix\",\"V-97115\",\"medium\",\"SRG-NET-000168-VPN-000600\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5005,\"SV-106253r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).\",\"SRG-NET-000168-VPN-000600\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nNonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through either an external network (e.g., the Internet) or an internal network.\\n\\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\\n\\nApplications also include HMAC, KDFs, Random Bit Generation, and hash-only applications (e.g., hashing passwords and using SHA-1 or higher to compute a checksum). For digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use where needed.\\n\\nSeparate requirements for configuring applications and protocols used by each product (e.g., SNMPv3, SSH, NTP, and other protocols and applications that require server/client authentication) are required to implement this requirement.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:L26csqRjhPU0fgblV8qX1BlmvtAHZjw4Yyp+bb0mDKw=\"},\"C-95957r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:srWnJLZc/eBKJFIWlsEIupfvJph4j2NGvFXosOihlzk=\"},\"F-102801r1_fix\",\"V-97117\",\"medium\",\"SRG-NET-000169-VPN-000610\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5006,\"SV-106255r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).\",\"SRG-NET-000169-VPN-000610\",\"Lack of authentication and identification enables non-organizational users to gain access to the network or possibly a VPN gateway that provides opportunity for intruders to compromise resources within the network infrastructure.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of a non-organizational user.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OyTG982E0CMxr4y2rmBaYCCpTY7srBWAv/cZQUt/Y+w=\"},\"C-95959r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1p/ev5FaVReOsAiB4Yypz9PuTHTIq8DZEOVu8/pAPZo=\"},\"F-102803r1_fix\",\"V-97119\",\"medium\",\"SRG-NET-000205-VPN-000710\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5007,\"SV-106257r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to route sessions to an IDPS for inspection.\",\"SRG-NET-000205-VPN-000710\",\"Remote access devices, such as those providing remote access to network devices and information systems, which lack automated, capabilities increase risk and makes remote user access management difficult at best.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nAutomated monitoring of remote access sessions allows organizations to detect cyber attacks and ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, from a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lOVVOo0oYWR1BZZb2TwnHXMbM18YttAN6G4GrHPWbyw=\"},\"C-95961r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lQAodzF2vAPdkyT4THpjERChTagkjNx3KaYEZBi/5HM=\"},\"F-102805r1_fix\",\"V-97121\",\"low\",\"SRG-NET-000213-VPN-000720\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5008,\"SV-106259r1_rule\",\"low\",null,null,\"The VPN Gateway must terminate all network connections associated with a communications session at the end of the session.\",\"SRG-NET-000213-VPN-000720\",\"Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These “orphaned” sessions use up valuable router resources and can be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keep alive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the TCP keep alive message, the sending router will clear the connection and free resources allocated to the session.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZitF7N9m7tBrFLBSFvvFyer2Cj1EN7TGddhFoon9a2g=\"},\"C-95963r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:EuB8U2wr3QUgtcHmLsicOw6VzQ5t4flKS602zwr3K7I=\"},\"F-102807r1_fix\",\"V-97123\",\"medium\",\"SRG-NET-000230-VPN-000770\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5009,\"SV-106261r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.\",\"SRG-NET-000230-VPN-000770\",\"Unapproved mechanisms that are used for authentication to the cryptographic module are not verified, and therefore cannot be relied upon to provide confidentiality or integrity and DoD data may be compromised.\\n\\nVPN gateways utilizing encryption are required to use FIPS compliant mechanisms for authenticating to cryptographic modules.\\n\\nFIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uJQ31o/f/Vqkllw6K1glewYI9Xlo0bRZIER2AGlLICw=\"},\"C-95965r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5d33UFWeSYVRhZGzYH0+0+VJ6rVugjCYj6LlTRa+nqY=\"},\"F-102809r1_fix\",\"V-97125\",\"high\",\"SRG-NET-000230-VPN-000780\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5010,\"SV-106263r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use Internet Key Exchange (IKE) with SHA-1 or greater to protect the authenticity of communications sessions.\",\"SRG-NET-000230-VPN-000780\",\"Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/SOA will require the use of mutual authentication (two-way/bidirectional).\\n\\nAn IPsec Security Associations (SA) is established using either IKE or manual configuration.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KPLBOeYMBZIxBbaWyihbjnI+iXUnrab0mkIE2hzbTk8=\"},\"C-95967r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QTXhy5bkfpQRsWuE/X3R1behSbs9HPpQP63IlKE7Z9A=\"},\"F-102811r1_fix\",\"V-97127\",\"medium\",\"SRG-NET-000231-VPN-000790\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5011,\"SV-106265r1_rule\",\"medium\",null,null,\"The VPN Gateway must invalidate session identifiers upon user logoff or other session termination.\",\"SRG-NET-000231-VPN-000790\",\"Captured sessions can be reused in \\\"replay\\\" attacks. This requirement limits the ability of adversaries from capturing and continuing to employ previously valid session IDs.\\n\\nSession IDs are tokens generated by web applications to uniquely identify an application user's session. Unique session identifiers or IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. When a user logs out, or when any other session termination event occurs, the VPN gateway must terminate the user session to minimize the potential for an attacker to hijack that particular user session.\\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet.\\n\\nThis requirement applies only to any VPN gateway that is an intermediary of individual sessions (e.g., proxy, ALG, or SSL VPN). This requirement focuses on communications protection at the application session, versus network packet level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p+iB5XlL+If6inJuLfQ+r3VNT86JXC5NhnV2vOeozxg=\"},\"C-95969r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tbmOT/VG86p0EWsjZLm3s8Y4/9kcKFGaAevpuHrUlfg=\"},\"F-102813r1_fix\",\"V-97129\",\"medium\",\"SRG-NET-000233-VPN-000800\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5012,\"SV-106267r1_rule\",\"medium\",null,null,\"The VPN Gateway must recognize only system-generated session identifiers.\",\"SRG-NET-000233-VPN-000800\",\"VPN gateways (depending on function) utilize sessions and session identifiers to control application behavior and user access. If an attacker can guess the session identifier, or can inject or manually insert session information, the valid user's application session can be compromised.\\n\\nUnique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions.\\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet.\\n\\nThis requirement applies to any VPN gateway that is an intermediary of individual sessions (e.g., proxy, ALG, TLS VPN). VPN gateways that perform these functions must be able to identify which session identifiers were generated when the sessions were established.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ktJIe/Y+HEIOo7bAwQCz3X/2hQkiqoTyl8BVpkZpHYk=\"},\"C-95971r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TniVNe2bo64DYrBZv1sEf0zR9SKcbwn0jWfXR3l8iz0=\"},\"F-102815r1_fix\",\"V-97131\",\"medium\",\"SRG-NET-000234-VPN-000810\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5013,\"SV-106269r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.\",\"SRG-NET-000234-VPN-000810\",\"Both IPsec and TLS gateways use the RNG to strengthen the security of the protocols. Using a weak RNG will weaken the protocol and make it more vulnerable.\\n\\nUse of a FIPS validated RNG that is not DRGB mitigates to a CAT III.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D9gD2h3b8ZDEWmQokEZllnWlmTLY7M//Hjdn7DqBOf8=\"},\"C-95973r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KB4RBRRC9piCCQ/V/rwpAJ5Z4Df6Bh3k50+VVARART8=\"},\"F-102817r1_fix\",\"V-97133\",\"medium\",\"SRG-NET-000235-VPN-000820\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5014,\"SV-106271r1_rule\",\"medium\",null,null,\"The VPN Gateway must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.\",\"SRG-NET-000235-VPN-000820\",\"Failure to a known safe state helps prevent systems from failing to a state that may cause loss of data or unauthorized access to system resources. VPN gateways that fail suddenly and with no incorporated failure state planning may leave the hosting system available but with a reduced security protection capability. Preserving information system state information also facilitates system restart and return to the operational mode of the organization with less disruption to mission-essential processes.\\n\\nAbort refers to stopping a program or function before it has finished naturally. The term abort refers to both requested and unexpected terminations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:72eP2Vo/dCHVQ+6f/2RQyYnBi119Hq+RWYm1m2WqoLc=\"},\"C-95975r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KOCFObJ10AgHLn2PIX9FSde4QkGSCpnBOYQLWTFTSDo=\"},\"F-102819r1_fix\",\"V-97135\",\"medium\",\"SRG-NET-000313-VPN-001050\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5015,\"SV-106273r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to perform an organization-defined action if the audit reveals unauthorized activity.\",\"SRG-NET-000313-VPN-001050\",\"Remote access devices, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and makes remote user access management difficult at best.\\n\\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\\n\\nRemote access functionality, such as remote access servers, VPN concentrators, and IDS/IPS devices, must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:w9yL+z+t1qYSt9kk+sxVflN/xG/naaJ9QP4VRCcqw6Q=\"},\"C-95977r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:COjdhT7YeatypyTtARxEDYM/VBCnUmEevQq0bspvHSk=\"},\"F-102821r1_fix\",\"V-97137\",\"medium\",\"SRG-NET-000314-VPN-001060\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5016,\"SV-106275r1_rule\",\"medium\",null,null,\"The VPN Gateway administrator accounts or security policy must be configured to allow the system administrator to immediately disconnect or disable remote access to devices and/or users when needed.\",\"SRG-NET-000314-VPN-001060\",\"Without the ability to immediately disconnect or disable remote access, an attack or other compromise taking progress would not be immediately stopped.\\n\\nRemote access functionality must have the capability to immediately disconnect current users remotely accessing the information system and/or disable further remote access. The speed of disconnect or disablement varies based on the criticality of mission functions and the need to eliminate immediate or future remote access to organizational information systems.\\n\\nThe remote access functionality (e.g., VPN, ALG, and RAS) may implement features, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:afNm41YNd2Z2QwHOtNNm/ZsgKpPtQhY3FaPrGqRWnTw=\"},\"C-95979r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HIQBC9ZU7AuTIdllzK3oRjj9cc4DrzRsdkjLzrUOnSE=\"},\"F-102823r1_fix\",\"V-97139\",\"high\",\"SRG-NET-000317-VPN-001090\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5017,\"SV-106277r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use AES encryption for the Internet Key Exchange (IKE) proposal to protect confidentiality of remote access sessions.\",\"SRG-NET-000317-VPN-001090\",\"Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nAES is the FIPS-validated cipher block cryptographic algorithm approved for use in DoD. For an algorithm implementation to be listed on a FIPS 140-2 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. Currently, NIST has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:n4616xCQqSEJ5LDbI/BvogDwAhTFLCqs6qsCNm2y6qM=\"},\"C-95981r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:o94iAavW4v2w03yRo2xl3upVmak75NTVDj/Dy2pNCbA=\"},\"F-102825r1_fix\",\"V-97141\",\"medium\",\"SRG-NET-000320-VPN-001120\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5018,\"SV-106279r1_rule\",\"medium\",null,null,\"The VPN Gateway must transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.\",\"SRG-NET-000320-VPN-001120\",\"Protecting authentication communications between the client, the VPN Gateway, and the authentication server keeps this critical information from being exploited.\\n\\nIn distributed information systems, authorization processes and access control decisions may occur in separate parts of the systems. In such instances, authorization information is transmitted securely so timely access control decisions can be enforced at the appropriate locations. To support the access control decisions, it may be necessary to transmit as part of the access authorization information, supporting security attributes. This is due to the fact that in distributed information systems, there are various access control decisions that need to be made and different entities (e.g., services) make these decisions in a serial fashion, each requiring some security attributes to make the decisions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qrumTMQiLLqavZ4GBAcbIfp6Kibky5yDpODJYsUNU6k=\"},\"C-95983r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:liEE0SFmmeFRP77fVgYsXwcMaxPrYjZRWHQv5JaTXXg=\"},\"F-102827r1_fix\",\"V-97143\",\"low\",\"SRG-NET-000330-VPN-001220\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5019,\"SV-106281r1_rule\",\"low\",null,null,\"The VPN Gateway must notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).\",\"SRG-NET-000330-VPN-001220\",\"Users need to be aware of activity that occurs regarding their account. Providing users with information deemed important by the organization may aid in the discovery of unauthorized access or thwart a potential attacker.\\n\\nOrganizations should consider the risks to the specific information system being accessed and the threats presented by the device to the environment when configuring this option. An excessive or unnecessary amount of information presented to the user at logon is not recommended.\\n\\nThis requirement applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bzo/kYUviBi8fH0VVF4kMJsdAnZOcFeOl3REDgnED8o=\"},\"C-95985r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:P8pkANj/XLaqdv6hJakyvgLuueJH8cGpKoldzmEq82g=\"},\"F-102829r1_fix\",\"V-97145\",\"medium\",\"SRG-NET-000333-VPN-001250\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5020,\"SV-106283r1_rule\",\"medium\",null,null,\"The VPN Gateway must provide centralized management and configuration of the content to be captured in log records generated by all network components.\",\"SRG-NET-000333-VPN-001250\",\"Without the ability to centrally manage the content captured in the log records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack.\\n\\nThe content captured in log records must be managed from a central location (necessitating automation). Centralized management of log records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Network components requiring centralized audit log management must have the capability to support centralized management.\\n\\nThe DoD requires centralized management of all network component audit record content.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cvSX2fNtb/9d5KoCFv38r/vk1P66QvbknutRPO++RHQ=\"},\"C-95987r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4LMA3u9siEI56MkwasqV8o7t4fUD89q8QT8ld4InCNY=\"},\"F-102831r1_fix\",\"V-97147\",\"medium\",\"SRG-NET-000334-VPN-001260\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5021,\"SV-106285r1_rule\",\"medium\",null,null,\"The VPN Gateway must off-load audit records onto a different system or media than the system being audited.\",\"SRG-NET-000334-VPN-001260\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rpLsrhPbwk1f+JYoA5pOhGpi71+wEYHZA7WhvDHOZ+M=\"},\"C-95989r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ZbcudZvV1BQEgFZtq1Hz/2teLVGVbnWW0bcryt+9lXk=\"},\"F-102833r1_fix\",\"V-97149\",\"medium\",\"SRG-NET-000335-VPN-001270\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5022,\"SV-106287r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.\",\"SRG-NET-000335-VPN-001270\",\"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected.\\n\\nAlerts provide organizations with urgent messages. Automated alerts can be conveyed in a variety of ways, including, for example, telephonically, via electronic mail, via text message, or via websites. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded.\\n\\nWhile this requirement also applies to the event monitoring system (e.g., Syslog, Security Information and Event Management [SIEM], or SNMP servers), the VPN Gateway must also be configured to generate a message to the administrator console.\\n\\nThe VPN daemon facility and log facility are messages in the log, which capture actions performed or errors encountered by system processes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lKiTDkfAGyG9SqJoJw3IBMHEt9m1XfYEXjJcJ6N2O4I=\"},\"C-95991r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:98ovgM7bqc4Ya1AKRRjI0MOMt8I2xMdngADds6VQJgc=\"},\"F-102835r1_fix\",\"V-97151\",\"medium\",\"SRG-NET-000336-VPN-001280\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5023,\"SV-106289r1_rule\",\"medium\",null,null,\"When communications with the Central Log Server is lost, the VPN Gateway must continue to queue traffic log records locally.\",\"SRG-NET-000336-VPN-001280\",\"If the system were to continue processing after audit failure, actions can be taken on the system that cannot be tracked and recorded for later forensic analysis.\\n\\nBecause of the importance of ensuring mission/business continuity, organizations may determine that the nature of the audit failure is not so severe that it warrants a complete shutdown of the application supporting the core organizational missions/business operations. In those instances, partial application shutdowns or operating in a degraded mode with reduced capability may be viable alternatives.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fVzjNA9x7fe7XKuKOy79M7wLwKGgdGCnV3TChwORocM=\"},\"C-95993r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:7kFOvG6IkBGOVLyO9MRlIA10BFwkb7/m/gpclcr3GP8=\"},\"F-102837r1_fix\",\"V-97153\",\"medium\",\"SRG-NET-000337-VPN-001290\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5024,\"SV-106291r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must renegotiate the security association after 8 hours or less, or an organization-defined period.\",\"SRG-NET-000337-VPN-001290\",\"The IPsec SA and its corresponding key will expire either after the number of seconds or amount of traffic volume has exceeded the configured limit. A new SA is negotiated before the lifetime threshold of the existing SA is reached to ensure that a new SA is ready for use when the old one expires. The longer the lifetime of the IPsec SA, the longer the lifetime of the session key used to protect IP traffic. The SA is less secure with a longer lifetime because an attacker has a greater opportunity to collect traffic encrypted by the same key and subject it to cryptanalysis. However, a shorter lifetime causes IPsec peers to renegotiate Phase II more often resulting in the expenditure of additional resources.\\n\\nSpecify the lifetime (in seconds) of an Internet Key Exchange (IKE) security association (SA). When the SA expires, it is replaced by a new SA, the security parameter index (SPI), or terminated if the peer cannot be contacted for renegotiation.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yIMWyLqQ5KjJhVIE0sO7kOy3MFZ/mr8G1UsF2vpFezs=\"},\"C-95995r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HEQrvy4/s8jokXmlLC3sxlKZoNheJdGUClzKnI45P1o=\"},\"F-102839r1_fix\",\"V-97155\",\"medium\",\"SRG-NET-000337-VPN-001300\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5025,\"SV-106293r1_rule\",\"medium\",null,null,\"The VPN Gateway must renegotiate the security association after 24 hours or less or as defined by the organization.\",\"SRG-NET-000337-VPN-001300\",\"When a VPN gateway creates an IPsec Security Association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway’s inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3Vk1c0ULGwB+JNxtAcJe82imefTrQUiXMXW0gSoV5sI=\"},\"C-95997r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:xBCJWam1YJOEk/Y3uRcCt4tDlmUHwgij/XAGpODs0PQ=\"},\"F-102841r1_fix\",\"V-97157\",\"medium\",\"SRG-NET-000341-VPN-001350\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5026,\"SV-106295r1_rule\",\"medium\",null,null,\"The VPN Gateway must accept Personal Identity Verification (PIV) credentials.\",\"SRG-NET-000341-VPN-001350\",\"The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\\n\\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U2xkrpdDd5fbE89oPVhqhnurz+BzWOL7MBkXI3iyc44=\"},\"C-95999r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:DWEbV0DVPuJ7OTfvbUkhrgxsgpWLM8sKjC8MjkQOMA4=\"},\"F-102843r1_fix\",\"V-97159\",\"medium\",\"SRG-NET-000342-VPN-001360\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5027,\"SV-106297r1_rule\",\"medium\",null,null,\"The VPN Gateway must electronically verify Personal Identity Verification (PIV) credentials.\",\"SRG-NET-000342-VPN-001360\",\"The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\\n\\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tY5W3SOCbPKTMPPTVFP0FpXqFdrxc15JZY9C5N1Jp3E=\"},\"C-96015r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C2DPURp+P/TJg1Bmt9fhJFi9259gGRXNzSqAORnuD3g=\"},\"F-102859r1_fix\",\"V-97177\",\"medium\",\"SRG-NET-000343-VPN-001370\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5028,\"SV-106315r1_rule\",\"medium\",null,null,\"The VPN Gateway must authenticate all network-connected endpoint devices before establishing a connection.\",\"SRG-NET-000343-VPN-001370\",\"Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\\n\\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions.\\n\\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers (outside a datacenter), VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.\\n\\nDevice authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bVroOwdA0e1yfLelH5K0/LjEPzRuPTDt+xgTDMzMsWA=\"},\"C-96017r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y/+l8kwggjnCbQ11WRfSGhCjui6kGNchR0wer8LCVos=\"},\"F-102861r1_fix\",\"V-97179\",\"medium\",\"SRG-NET-000352-VPN-001460\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5029,\"SV-106317r1_rule\",\"medium\",null,null,\"The VPN Gateway must use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.\",\"SRG-NET-000352-VPN-001460\",\"Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.\\n\\nThe National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by NIST and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future required Suite B implementations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1maPMRSAJQc9CCcE9i3+e/pBNygIhmu9m1GajIh4WrA=\"},\"C-96019r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:c81cg0K0ERMsQOfw3hMhzc4N9PuesRPEfIK2UBPat/E=\"},\"F-102863r1_fix\",\"V-97181\",\"medium\",\"SRG-NET-000369-VPN-001620\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5030,\"SV-106319r1_rule\",\"medium\",null,null,\"The VPN Gateway must disable split-tunneling for remote clients VPNs.\",\"SRG-NET-000369-VPN-001620\",\"Split tunneling would in effect allow unauthorized external connections, making the system more vulnerable to attack and to exfiltration of organizational information.\\n\\nA VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the Internet. With split tunneling enabled, a remote client has access to the Internet while at the same time has established a secured path to the enclave via an IPsec tunnel. A remote client connected to the Internet that has been compromised by an attacker in the Internet, provides an attack base to the enclave’s private network via the IPsec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:W5E6fpSFPSjZsDhRm6JBdbhvWCdb4iIQ29kz4GWDM20=\"},\"C-96021r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PzvaYVGXC+ztLTE2ZozeA+R4K4I1v/fBf/opSADlvJ0=\"},\"F-102865r1_fix\",\"V-97183\",\"medium\",\"SRG-NET-000371-VPN-001640\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5031,\"SV-106321r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.\",\"SRG-NET-000371-VPN-001640\",\"PFS generates each new encryption key independently from the previous key. Without PFS, compromise of one key will compromise all communications.\\n\\nThe phase 2 (Quick Mode) Security Association (SA) is used to create an IPsec session key. Hence, its rekey or key regeneration procedure is very important. The phase 2 rekey can be performed with or without Perfect Forward Secrecy (PFS). With PFS, every time a new IPsec Security Association is negotiated during the Quick Mode, a new Diffie-Hellman (DH) exchange occurs. The new DH shared secret will be included with original keying material (SYKEID_d, initiator nonce, and responder nonce from phase 1 for generating a new IPsec session key. If PFS is not used, the IPsec session key will always be completely dependent on the original keying material from the Phase-1. Hence, if an older key is compromised at any time, it is possible that all new keys may be compromised.\\n\\nThe DH exchange is performed in the same manner as was done in phase 1 (Main or Aggressive Mode). However, the phase 2 exchange is protected by encrypting the phase 2 packets with the key derived from the phase 1 negotiation. Because DH negotiations during phase 2 are encrypted, the new IPsec session key has an added element of secrecy.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rqcFP9ktgfb343ahB5Mv16lTwTPf1/ELOUg9C3CgAj8=\"},\"C-96023r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:j/fsWDohMzN1oclh4BAauCakys23bebITKpZxWpK2Qk=\"},\"F-102867r1_fix\",\"V-97185\",\"high\",\"SRG-NET-000371-VPN-001650\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5032,\"SV-106323r1_rule\",\"high\",null,null,\"The VPN Gateway and Client must be configured to protect the confidentiality and integrity of transmitted information.\",\"SRG-NET-000371-VPN-001650\",\"Without protection of the transmitted information, confidentiality and integrity may be compromised as unprotected communications can be intercepted and either read or altered.\\n\\nThis requirement also applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification.\\n\\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.\\n\\nFor example, configure all ISAKMP policies to use AES for Internet Key Exchange (IKE) cryptographic encryption operations and SHA-1 to protect data integrity.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+vnSRs+ZokA+P5inP7i24jyzDoJ+8dRGwCZAF72bzfw=\"},\"C-96025r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:F3uzs5G3+v3iJx/kCrPtcrdW/gsCjZHZOAXufRJxNgY=\"},\"F-102869r1_fix\",\"V-97187\",\"medium\",\"SRG-NET-000375-VPN-001690\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5033,\"SV-106325r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.\",\"SRG-NET-000375-VPN-001690\",\"ESP provides confidentiality, data origin authentication, integrity, and anti-replay services within the IPsec suite of protocols. ESP in tunnel mode ensures a secure path for communications for site-to-site VPNs and gateway to endpoints, including header information.\\n\\nESP can be deployed in either transport or tunnel mode. Transport mode is used to create a secured session between two hosts. It can also be used when two hosts simply want to authenticate each IP packet with IPsec authentication header (AH). With ESP transport mode, only the payload (transport layer) is encrypted, whereas with tunnel mode, the entire IP packet is encrypted and encapsulated with a new IP header. Tunnel mode is used to encrypt traffic between secure IPsec gateways or between an IPsec gateway and an end-station running IPsec software. Hence, it is the only method to provide a secured path to transport traffic between remote sites or end-stations and the central site.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fU8zq6dLn1EHMKbL2KwqzdBun1CXedlYFT1NSzY5Zw0=\"},\"C-96027r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:AN4m35Ma+yxdnoD7gJy8bvR+ZHLR8Sqmd04QY4ipeyM=\"},\"F-102871r1_fix\",\"V-97189\",\"medium\",\"SRG-NET-000400-VPN-001940\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5034,\"SV-106327r1_rule\",\"medium\",null,null,\"For site-to-site VPN, for accounts using password authentication, the VPN Gateway must use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.\",\"SRG-NET-000400-VPN-001940\",\"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThe information system must specify the hash algorithm used for authenticating passwords. Implementation of this requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GOcfn7YCnFViHL4Sv9yLScid+jFSlnVek7L1omc1Mjw=\"},\"C-96029r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4MYR7ku3/EgXleyLtcxftc2BDi8OAuC5GMzuGE2BIhY=\"},\"F-102873r1_fix\",\"V-97191\",\"medium\",\"SRG-NET-000492-VPN-001980\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5035,\"SV-106329r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records when successful and/or unsuccessful VPN connection attempts occur.\",\"SRG-NET-000492-VPN-001980\",\"Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\\n\\nLog records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nThis requirement only applies to components where this is specific to the function of the device, such as application layer gateway (ALG), which provides these access control and auditing functions on behalf of an application. This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D0/SC7O2V3JZ4+Sewx7Qn6Z7ZSrkdje8orXuKxcEjpo=\"},\"C-96031r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NNq3b5rAHl25ZbWpIy/Y+Q7WJgEfjrSCsg45dAZ/hYA=\"},\"F-102875r1_fix\",\"V-97193\",\"medium\",\"SRG-NET-000510-VPN-002160\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5036,\"SV-106331r1_rule\",\"medium\",null,null,\"The VPN Gateway must use a FIPS-validated cryptographic module to generate cryptographic hashes.\",\"SRG-NET-000510-VPN-002160\",\"FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plain text. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.\\n\\nThe cryptographic module used must have at least one validated hash algorithm. This validated hash algorithm must be used to generate cryptographic hashes for all cryptographic security function within the product being evaluated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GNvczQqQ8RSDNiGZgHykTH9Fl/06XwpsXibtlkPH4AM=\"},\"C-96033r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wpU2wZ1uyf3RUQgJzjcuMubJFwKQTMsVYABGtyetAu0=\"},\"F-102877r1_fix\",\"V-97195\",\"medium\",\"SRG-NET-000510-VPN-002170\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5037,\"SV-106333r1_rule\",\"medium\",null,null,\"The VPN Gateway must use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.\",\"SRG-NET-000510-VPN-002170\",\"FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plain text. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.\\n\\nThe cryptographic module used must have one FIPS-validated encryption algorithm (i.e., validated Advanced Encryption Standard [AES]). This validated algorithm must be used for encryption for cryptographic security function within the product being evaluated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nrioFfQyWAyHyqPYTDE2+pXaDoeycQE/PjC2vrEL9Jo=\"},\"C-96035r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zi3v1EJgN7RWCshcZkpIFWwckY19Ow6NkWzZdajmLjM=\"},\"F-102879r1_fix\",\"V-97197\",\"medium\",\"SRG-NET-000510-VPN-002180\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5038,\"SV-106335r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway IKE must use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.\",\"SRG-NET-000510-VPN-002180\",\"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hDgoEHbOPyCRLlTAZ0Qqx1kkok77I93P01NwpDJNEE8=\"},\"C-96037r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qUzVSTw+n8v2UFfLxBraBDENI28bgIEBRVGPthivu9U=\"},\"F-102881r1_fix\",\"V-97199\",\"high\",\"SRG-NET-000512-VPN-002220\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5039,\"SV-106337r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use Internet Key Exchange (IKE) for IPsec VPN Security Associations (SAs).\",\"SRG-NET-000512-VPN-002220\",\"Without IKE, the SPI is manually specified for each security association. IKE peers will negotiate the encryption algorithm and authentication or hashing methods as well as generate the encryption keys.\\n\\nAn IPsec SA is established using either Internet Key Exchange (IKE) or manual configuration. When using IKE, the security associations are established when needed and expire after a period of time or volume of traffic threshold. If manually configured, they are established as soon as the configuration is complete at both end points and they do not expire. When using IKE, the Security Parameter Index (SPI) for each security association is a pseudo-randomly derived number.\\n\\nWith manual configuration of the IPsec security association, both the cipher key and authentication key are static. Hence, if the keys are compromised, the traffic being protected by the current IPsec tunnel can be decrypted as well as traffic in any future tunnels established by this SA. Furthermore, the peers are not authenticated prior to establishing the SA, which could result in a rogue device establishing an IPsec SA with either of the VPN end points.\\n\\nIKE provides primary authentication to verify the identity of the remote system before negotiation begins. This feature is lost when the IPsec security associations are manually configured, which results in a non-terminating session using static pre-shared keys.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IzzOyrG05CKpFAWFrkEoNJ5rxjb3elkLNtjevgCQdtw=\"},\"C-96039r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:xx84wPMsMSSAo4CeASGVN5MvUIu7DiKqar4aWbsOerA=\"},\"F-102883r1_fix\",\"V-97201\",\"high\",\"SRG-NET-000512-VPN-002230\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5040,\"SV-106339r1_rule\",\"high\",null,null,\"The VPN Gateway must not accept certificates that have been revoked when using PKI for authentication.\",\"SRG-NET-000512-VPN-002230\",\"Situations may arise in which the certificate issued by a Certificate Authority (CA) may need to be revoked before the lifetime of the certificate expires. For example, the certificate is known to have been compromised.\\n\\nWhen an incoming Internet Key Exchange (IKE) session is initiated for a remote client or peer whose certificate is revoked, the revocation list configured for use by the VPN server is checked to see if the certificate is valid; if the certificate is revoked, IKE will fail and an IPsec security association will not be established for the remote endpoint.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GrHgK/pBnHrsn1Seh0qJujIqrWqRLPE0eaA+ZAqQMjo=\"},\"C-96041r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:X8wHzcaz0980HXxuy93EVyk4VDWyVtsDF0WbqVlaX/w=\"},\"F-102885r1_fix\",\"V-97203\",\"medium\",\"SRG-NET-000518-VPN-002280\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5041,\"SV-106341r1_rule\",\"medium\",null,null,\"The VPN Client logout function must be configured to terminate the session on/with the VPN Gateway.\",\"SRG-NET-000518-VPN-002280\",\"If a user cannot explicitly end a session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session.\\n\\nHowever, for some types of interactive sessions including, for example, remote login, information systems typically send logout messages as final messages prior to terminating sessions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+WzKvuFJw2Hd2tINf3CAdDXjeroLc9pIuZQ8rxqAqW8=\"},\"C-96043r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+tCpOllw27HEiCrQcnfBz1Mp9uGAIFb0WolLkLykCm4=\"},\"F-102887r1_fix\",\"V-97205\",\"medium\",\"SRG-NET-000519-VPN-002290\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5042,\"SV-106343r1_rule\",\"medium\",null,null,\"The VPN Client must display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.\",\"SRG-NET-000519-VPN-002290\",\"If a user cannot explicitly end a session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. Users need to be aware of whether or not the session has been terminated.\\n\\nLogout messages for access, for example, can be displayed after authenticated sessions have been terminated. However, for some types of interactive sessions including, for example, remote login, information systems typically send logout messages as final messages prior to terminating sessions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WFTjVjonYKh95+ufS3SeRtMzKzxvcuYhkuGqLkDzAdQ=\"},\"C-96045r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fy0MhQs22gOsjCy8Ui4Xr8MpXyFw2N5p7qTSc67sOzM=\"},\"F-102889r1_fix\",\"V-97207\",\"medium\",\"SRG-NET-000522-VPN-002320\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5043,\"SV-106345r1_rule\",\"medium\",null,null,\"For site-to-site VPN Gateway must store only cryptographic representations of Pre-shared Keys (PSKs).\",\"SRG-NET-000522-VPN-002320\",\"Pre-shared keys need to be protected at all times, and encryption is the standard method for protecting passwords. If PSKs are not encrypted, they can be plainly read and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\\n\\nPSKs used for site-to-site VPNs are considered by the SRG as a type of password. If this shared secret is already encrypted and not in plaintext, this meets this requirement. This requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption. This method uses a one-way hashing encryption algorithm with a salt value to validate a user's password without having to store the actual password. Performance and time required to access are factors that must be considered, and the one-way hash is the most feasible means of securing the password and providing an acceptable measure of password security.\\n\\nUse a keyed hash message authentication code (HMAC). HMAC calculates a message authentication code via a cryptographic hash function used in conjunction with an encryption key. The key must be protected as with any private key.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WvHtCxF8aHRpizWQnHhcRWZ2GSo4LpYF4C+7vAKUMGY=\"},\"C-96047r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lOGJxdtWr9FVthiaj/+UbIRNwkTQqM0TzcIWviq/0Jk=\"},\"F-102891r1_fix\",\"V-97209\",\"high\",\"SRG-NET-000525-VPN-002330\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5044,\"SV-106347r1_rule\",\"high\",null,null,\"The IPsec VPN must use Advanced Encryption Standard (AES) encryption for the IPsec proposal to protect the confidentiality of remote access sessions.\",\"SRG-NET-000525-VPN-002330\",\"Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nA block cipher mode is an algorithm that features the use of a symmetric key block cipher algorithm to provide an information service, such as confidentiality or authentication.\\n\\nAES is the FIPS-validated cipher block cryptographic algorithm approved for use in DoD. For an algorithm implementation to be listed on a FIPS 140-2 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. Currently, NIST has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hK46dRZBIlXNdxH/0rgMhBXqrBF8nwMTFp1UUvsZ2/w=\"},\"C-96049r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:f3H1Fnk3Mq9sTlW4p0spIywjLsmMT5ZgZN+1SV7bU2U=\"},\"F-102893r1_fix\",\"V-97211\",\"medium\",\"SRG-NET-000530-VPN-002340\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5045,\"SV-106349r1_rule\",\"medium\",null,null,\"The TLS VPN Gateway that supports Government-only services must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.\",\"SRG-NET-000530-VPN-002340\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nThis requirement applies to TLS gateways (also known as SSL gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Oyy/mFzHcQy1sAgTQ9gS+b99/s9IcmH4xTl+n0Pf6Rw=\"},\"C-96051r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tG7QZxAuAcqmA4gmuAeWEA9ZEnLVfGT5NFaUDibQfFE=\"},\"F-102895r1_fix\",\"V-97213\",\"medium\",\"SRG-NET-000540-VPN-002350\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5046,\"SV-106351r1_rule\",\"medium\",null,null,\"The TLS VPN Gateway that supports citizen- or business-facing network devices must prohibit client negotiation to SSL 2.0 or SSL 3.0.\",\"SRG-NET-000540-VPN-002350\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nThis requirement applies to public-facing or external-facing devices such as TLS gateways (also known as SSL gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance.\\n\\nThe minimum TLS version required by DoD is 1.2. However, devices and applications may allow client negotiation for systems supporting citizen- and business-facing applications. These devices may be configured to support TLS version 1.1 and 1.0 to enable interaction with citizens and businesses. These devices must not support SSL version 3.0 or earlier.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0WoWCtzpWtYJ2vxCT7vXvLruiskYzBOwEVdaxJWlGbM=\"},\"C-96053r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nHHSH5iwaGyboJNtWTygHWn0yTU3Rug61FYQH6Ni/Ek=\"},\"F-102897r1_fix\",\"V-97215\",\"medium\",\"SRG-NET-000550-VPN-002360\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5047,\"SV-106353r1_rule\",\"medium\",null,null,\"The VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.\",\"SRG-NET-000550-VPN-002360\",\"Without device-to-device authentication, communications with malicious devices may be established. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk.\\n\\nSNMPv3 supports authentication, authorization, access control, and privacy while previous versions of the protocol contained well-known security weaknesses, which were easily exploited. SNMPv3 can be configured for identification and bidirectional, cryptographically based authentication.\\n\\nA typical SNMP implementation includes three components: Managed device, SNMP agent, and NMS. The SNMP agent is the SNMP process that resides on the managed device and communicates with the network management system. The NMS is a combination of hardware and software that is used to monitor and administer a network. The SNMP data is stored in a highly-structured, hierarchical format known as a management information base (MIB). The SNMP manager collects information about network connectivity, activity, and events by polling managed devices.\\n\\nSNMPv3 defines a user-based security model (USM), and a view-based access control model (VACM). SNMPv3 USM provides data integrity, data origin authentication, message replay protection, and protection against disclosure of the message payload. SNMPv3 VACM provides access control to determine whether a specific type of access (read or write) to the management information is allowed. Implement both VACM and USM for full protection.\\n\\nSNMPv3 server services must not be configured on products whose primary purpose is not to provide SNMP services. SNMP client services may be configured on the VPN gateway, application, or operating system to allow limited monitoring or querying of the device from by an SNMP server for management purposes. SNMP of any version will not be used to make configuration changes to the device. SNMPv3 must be disabled by default and enabled only if used. SNMP v3 provides security feature enhancements to SNMP, including encryption and message authentication.\\n\\nCurrently, the AES cipher block algorithm can be used for both applying cryptographic protection (e.g., encryption) and removing or verifying the protection that was previously applied (e.g., decryption) in DoD. The use of FIPS-approved algorithms for both cryptographic mechanisms is required. If any version of SNMP is used for remote administration, default SNMP community strings such as “public” and “private” should be removed before real community strings are put into place. If the defaults are not removed, an attacker could retrieve real community strings from the device using the default string.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RFq+xtylI0rdth+CO8xXpnUCA7eBYGNXjStRxU/Sh2g=\"},\"C-96055r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:snkiXNFPpO0+kw0zQco5SKVgkORHDhyOH3PpUq4/k30=\"},\"F-102899r1_fix\",\"V-97217\",\"high\",\"SRG-NET-000565-VPN-002390\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5048,\"SV-106355r1_rule\",\"high\",null,null,\"The VPN Gateway must use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.\",\"SRG-NET-000565-VPN-002390\",\"Use of improperly configured or lower assurance equipment and solutions could compromise high-value information.\\n\\nThe National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by the National Institute of Standards and Technology (NIST) and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future Suite B implementations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p7UCHJrDUnFC2jp6mXGtSAilZeT3BjF1NVmG5ykWcy4=\"},\"C-96057r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KIex1ZGWMlFIxubnYXqgVjEDQ6/8SNR9c5AVbsZNKEA=\"},\"F-102901r1_fix\",\"V-97219\",\"high\",\"SRG-NET-000565-VPN-002400\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5049,\"SV-106357r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway Internet Key Exchange (IKE) must use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.\",\"SRG-NET-000565-VPN-002400\",\"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\\n\\nRFC 6379 Suite B Cryptographic Suites for IPsec defines four cryptographic user interface suites for deploying IPsec. Each suite provides choices for Encapsulating Security Payload (ESP) and IKE. The four suites are differentiated by the choice of IKE authentication and key exchange, cryptographic algorithm strengths, and whether ESP is to provide both confidentiality and integrity or integrity only. The suite names are based on the Advanced Encryption Standard (AES) mode and AES key length specified for ESP. Two suites are defined for transporting classified information up to SECRET level—one for both confidentiality and integrity and one for integrity only. There are also two suites defined for transporting classified information up to TOP SECRET level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F8wZynyPCZXbSCQKsDAa3RDhSkunUmMAhgYUP9Yu014=\"},\"C-96059r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sJ4ufacKRyx88U9iliMjZLvETY3nQgVUnTBTVlqZ1YA=\"},\"F-102903r1_fix\",\"V-97221\",\"medium\",\"SRG-NET-000580-VPN-002410\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5050,\"SV-106359r1_rule\",\"medium\",null,null,\"The VPN Gateway must validate certificates used for Transport Layer Security (TLS) functions by performing RFC 5280-compliant certification path validation.\",\"SRG-NET-000580-VPN-002410\",\"A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate.\\n\\nCertification path validation includes checks such as certificate issuer trust, time validity, and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WOsWkwp7rHKriDcEPQi1g0VQp3X0XA14Kw+soZYNvnw=\"},\"C-96061r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jLNfObMjTtI/+Xyh7vDwZR17rLmudLzlz6NwxhVITKs=\"},\"F-102905r1_fix\",\"V-97223\",\"medium\",\"SRG-NET-000585-VPN-002420\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5051,\"SV-106361r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).\",\"SRG-NET-000585-VPN-002420\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Use only SHA-2 for Digital signature generation applications and functions. SHA-2 is strongly preferred for use by DoD for non-signature generation functions.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\\n\\nFor digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use only if needed for business critical applications.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5JYnVzed7VNQLssmYLnmi+secKLvHnAiNpVnw5LnOy0=\"},\"C-96063r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0MUtJg0aE03Glc9kBOBNI3y2a6+ptn7NTc3Xse+sN6w=\"},\"F-102907r1_fix\",\"V-97225\",\"medium\",\"SRG-NET-000075-VPN-000260\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",5052,\"SV-106363r1_rule\",\"medium\",null,null,\"If the site-to-site VPN implementation uses L2TP, L2TPv3 sessions must be authenticated prior to transporting traffic.\",\"SRG-NET-000075-VPN-000260\",\"L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP tunnels can also carry IP packets that are very difficult to filter because of the additional encapsulation. Hence, it is imperative that L2TP sessions are authenticated prior to transporting traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_OTHER-2-2\",5053,\"SV-106179r1_xxxx\",\"medium\",null,null,\"This rule title has been replaced.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"C-95879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fgzhbaQbILFSeEwIwlOogRZtoeuNS7Kr0AHwx84IKLg=\"},\"F-102723r1_fix\",\"V-97043\",\"medium\",\"SRG-NET-000041-VPN-000110\",null,null,null,null,null,\"VPN_SRG_OTHER-2-2\",5054,\"SV-106181r1_xxxx\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.\",\"SRG-NET-000041-VPN-000110\",\"Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n \\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_Rule-fingerprint-match-test-2-2\",5055,\"SV-106179r1_xxxx\",\"medium\",null,null,\"This rule title has been replaced.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_Rule-fingerprint-match-test-2-2\",5056,\"SV-106179r1_zzzzzz\",\"medium\",null,null,\"This rule title has been replaced.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"C-95879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fgzhbaQbILFSeEwIwlOogRZtoeuNS7Kr0AHwx84IKLg=\"},\"F-102723r1_fix\",\"V-97043\",\"medium\",\"SRG-NET-000041-VPN-000110\",null,null,null,null,null,\"VPN_SRG_Rule-fingerprint-match-test-2-2\",5057,\"SV-106181r1_xxxx\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.\",\"SRG-NET-000041-VPN-000110\",\"Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n \\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:71oeJLYU9tjMIiRqSWuNoIKcrvLfKW7xfh7cI6OhvFc=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5058,\"SV-106179r123456789_rule\",\"medium\",null,null,\"The VPN Gateway must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:slm2UFIqnUUPyOpfIcsxSew4LGvsTesU9C6Ju5XJ3mw=\"},\"C-95879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fgzhbaQbILFSeEwIwlOogRZtoeuNS7Kr0AHwx84IKLg=\"},\"F-102723r1_fix\",\"V-97043\",\"medium\",\"SRG-NET-000041-VPN-000110\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5059,\"SV-106181r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.\",\"SRG-NET-000041-VPN-000110\",\"Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n \\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jc6QW12gqdTKEPqvls4bilVyDJExcCoSskTVyO0VtC8=\"},\"C-95881r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QOTNmZJgq99GtXVEhYObEaDdxa5uT73FDkpBccGCe5Q=\"},\"F-102725r1_fix\",\"V-97045\",\"medium\",\"SRG-NET-000042-VPN-000120\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5060,\"SV-106183r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must enforce a policy to retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.\",\"SRG-NET-000042-VPN-000120\",\"The banner must be acknowledged by the user prior to allowing the user access to the network. This provides assurance that the user has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the user, DoD will not be in compliance with system use notifications required by law. \\n\\nThe banner is usually configured in NDM for client presentation as well as local logon.\\n\\nTo establish acceptance of the application usage policy, a click-through banner at application logon is required. The VPN gateway must prevent further activity until the user executes a positive action to manifest agreement by clicking on a box indicating \\\"OK\\\". \\n\\nThis applies to gateways that have the concept of a user account and have the login function residing on the gateway or the gateway acts as a user intermediary.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4cT/S3JRnRG1/bjkxCCl0FvJ2jFBPQxR6xd/ho3iPwU=\"},\"C-95883r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zvj+8RueEc8AGER4mc5vsA+JPLux2r9T3RERyvr6GqU=\"},\"F-102727r1_fix\",\"V-97047\",\"medium\",\"SRG-NET-000043-VPN-000130\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5061,\"SV-106185r1_rule\",\"medium\",null,null,\"The publicly accessible VPN Gateway must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\",\"SRG-NET-000043-VPN-000130\",\"Display of a standardized and approved use notification before granting access to the publicly accessible VPN gateway ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with DTM-08-060. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IdemsTDQGwPd7bokQxIIvpGCFpuH2a0LMkx43UGqWUA=\"},\"C-95885r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zwSBwQLPqjyi/Vwm1CxWQnlXRWyZZB59z9HGXUELgyQ=\"},\"F-102729r1_fix\",\"V-97049\",\"low\",\"SRG-NET-000049-VPN-000150\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5062,\"SV-106187r1_rule\",\"low\",null,null,\"The VPN Gateway must notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access).\",\"SRG-NET-000049-VPN-000150\",\"Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the number of unsuccessful attempts that were made to login to their account allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators.\\n\\nThis applies to gateways that have the concept of a user account and have the login function residing on the gateway or the gateway acts as a user intermediary.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aVWTWelue2vPX4PPQhsVdenoG0JoZrePs1txZu8Tn9w=\"},\"C-95887r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Bxnvb6aexynxn1Y2nmdyofyqfjFnX0xOt15KQeL53to=\"},\"F-102731r1_fix\",\"V-97051\",\"medium\",\"SRG-NET-000053-VPN-000170\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5063,\"SV-106189r1_rule\",\"medium\",null,null,\"The VPN Gateway must limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number.\",\"SRG-NET-000053-VPN-000170\",\"VPN gateway management includes the ability to control the number of users and user sessions that utilize a VPN gateway. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to DoS attacks.\\n\\nThis requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.\\n\\nThe intent of this policy is to ensure the number of concurrent sessions is deliberately set to a number based on the site's mission and not left unlimited.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CyTJHLIKQ2Ojkg9rwcZ3x7T66VHLzHB54n+nmQfac2E=\"},\"C-95889r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:H+ZsJRqo1BYEq9Wumb38YWMb+3wdolcYgDCbwGXeDJo=\"},\"F-102733r1_fix\",\"V-97053\",\"high\",\"SRG-NET-000062-VPN-000200\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5064,\"SV-106191r1_rule\",\"high\",null,null,\"The TLS VPN Gateway must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during transmission.\",\"SRG-NET-000062-VPN-000200\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nNIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b0U2i/2oFdeOwmGlTBap86LUQ1gHdfQ3eL4us+64fpw=\"},\"C-95891r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:J8KVE+KgBfuYvKemq7ovYBGF4IuGwoDzawSXyCaOyAQ=\"},\"F-102735r1_fix\",\"V-97055\",\"medium\",\"SRG-NET-000063-VPN-000210\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5065,\"SV-106193r1_rule\",\"medium\",null,null,\"The remote access VPN Gateway must use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.\",\"SRG-NET-000063-VPN-000210\",\"Without integrity protection, unauthorized changes may be made to the log files and reliable forensic analysis and discovery of the source of malicious system activity may be degraded.\\n\\nRemote access (e.g., RDP) is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless.\\n\\nIntegrity checks include cryptographic checksums, digital signatures, or hash functions. Federal Information Processing Standard (FIPS) 186-4, Digital Signature Standard (DSS), specifies three NIST-approved algorithms: DSA, RSA, and ECDSA. All three are used to generate and verify digital signatures in conjunction with an approved hash function.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v3WpQRoQigeTzLi65BYsrw9t+ZEEROlTq1kxXFTTLlc=\"},\"C-95893r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0D+opAzf5nzDclgwdIOkAD6j3JJiMTsVJtgVtp12Gss=\"},\"F-102737r1_fix\",\"V-97057\",\"medium\",\"SRG-NET-000063-VPN-000220\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5066,\"SV-106195r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.\",\"SRG-NET-000063-VPN-000220\",\"Without strong cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThe remote access VPN provides access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+B3+7JmTL1p1pvXgkAa8wGoCkVHYXHjICDWeklY1MTk=\"},\"C-95895r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:M9780XhNnUX+zVJLNXdHbTc95ro/kqEEj3UK2rL6hHI=\"},\"F-102739r1_fix\",\"V-97059\",\"high\",\"SRG-NET-000074-VPN-000250\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5067,\"SV-106197r1_rule\",\"high\",null,null,\"The IPsec VPN must implement a FIPS 140-2 validated Diffie-Hellman (DH) group.\",\"SRG-NET-000074-VPN-000250\",\"Use of an approved DH algorithm ensures the Internet Key Exchange (IKE) (phase 1) proposal uses FIPS-validated key management techniques and processes in the production, storage, and control of private/secret cryptographic keys. The security of the DH key exchange is based on the difficulty of solving the discrete logarithm in which the key was derived from. Hence, the larger the modulus, the more secure the generated key is considered to be.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YlctilOwQ2MBW7zoqYuhAoiJN5c5NYVKUMH7L8KW2VE=\"},\"C-95899r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:13l80RWe85t3TbQcxGDY1TeqhIv8oq9LWDSwKSmwv2c=\"},\"F-102743r1_fix\",\"V-97061\",\"low\",\"SRG-NET-000077-VPN-000280\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5068,\"SV-106199r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish what type of events occurred.\",\"SRG-NET-000077-VPN-000280\",\"Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nVPN gateways often have a separate audit log for capturing VPN status and other information about the traffic (as opposed to the log capturing administrative and configuration actions). Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.\\n\\nAssociating event types with detected events in the VPN gateway logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HGobFrLp43KBzaBeaBiQba6hjKEcpQn11VJTJJwwmMo=\"},\"C-95901r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1960KI2uASwT2grDyD1D8glCHawNm1LCT+mppgDNAG4=\"},\"F-102745r1_fix\",\"V-97063\",\"low\",\"SRG-NET-000078-VPN-000290\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5069,\"SV-106201r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish when (date and time) the events occurred.\",\"SRG-NET-000078-VPN-000290\",\"Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nVPN gateways often have a separate audit log for capturing VPN status and other information about the traffic (as opposed to the log capturing administrative and configuration actions).\\n\\nAssociating event types with detected events in the network audit logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:P/zyghBUSYmw8eYcF6kqAgE8TeMANzSroGoCNq9DxmU=\"},\"C-95903r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jl3z7pSS/5EUBqiypkdJCKqCZ9U+KdO46Z7KbtxpUpI=\"},\"F-102747r1_fix\",\"V-97065\",\"medium\",\"SRG-NET-000079-VPN-000300\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5070,\"SV-106203r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records containing information that establishes the identity of any individual or process associated with the event.\",\"SRG-NET-000079-VPN-000300\",\"Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/9F2orQ7S4UyHUeIF5MNwyf2YqTtEcZKOu6Lyy3dl0w=\"},\"C-95905r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8Jh0XPz5tsLOV5OOHxTog1U4Ld3GURTDC/neBufCCRc=\"},\"F-102749r1_fix\",\"V-97067\",\"medium\",\"SRG-NET-000088-VPN-000310\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5071,\"SV-106205r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records containing information to establish where the events occurred.\",\"SRG-NET-000088-VPN-000310\",\"Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nIn order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know where events occurred, such as VPN gateway components, modules, device identifiers, node names, and functionality.\\n\\nAssociating information about where the event occurred within the network provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TBiXTAY2X10uilSJ/Zo764Ce7gxa+BC604igCvR21Ys=\"},\"C-95907r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fdhbsyNKzbH4WTd1xvpZy3y/UYX8uj3SGwmY5U6RSTM=\"},\"F-102751r1_fix\",\"V-97069\",\"low\",\"SRG-NET-000089-VPN-000330\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5072,\"SV-106207r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish the source of the events.\",\"SRG-NET-000089-VPN-000330\",\"Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event.\\n\\nIn addition to logging where events occur within the network, the log records must also identify sources of events such as IP addresses, processes, and node or device names.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2+gLZEUpQFGiiXTLj5vTvPMeNuYVSesoUBq5osjiwyA=\"},\"C-95909r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+Hhc/f/5x1WDFzGN2o6Zu1Zd4z5P5GcPUtxEuGkAWCk=\"},\"F-102753r1_fix\",\"V-97071\",\"medium\",\"SRG-NET-000091-VPN-000350\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5073,\"SV-106209r1_rule\",\"medium\",null,null,\"The VPN Gateway must produce log records containing information to establish the outcome of the events.\",\"SRG-NET-000091-VPN-000350\",\"Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the network.\\n\\nEvent outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the network after the event occurred). As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mi17ibh62O4cda5bcRUSENaNZI+A+wHMQdsAhZaeELQ=\"},\"C-95911r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:uA4H2p1A7Ll9hacECizf787pb/UA7IqAnIHhct/QrEM=\"},\"F-102755r1_fix\",\"V-97073\",\"low\",\"SRG-NET-000098-VPN-000370\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5074,\"SV-106211r1_rule\",\"low\",null,null,\"The VPN Gateway must protect log information from unauthorized read access if all or some of this data is stored locally.\",\"SRG-NET-000098-VPN-000370\",\"Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured VPN gateway. Thus, it is imperative that the collected log data from the various VPN gateways, as well as the auditing tools, be secured and can only be accessed by authorized personnel.\\n\\nThis requirement pertains to securing the VPN log as it is stored locally, on the box temporarily, or while being encapsulated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xx7dyKjP3tr449DemD15SwuRdkEieFRE1AhuT429Hbk=\"},\"C-95913r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0Ev7nKBuQufWeKLn3k7Wr/z0hb8pni2MRJGUGCqohj8=\"},\"F-102757r1_fix\",\"V-97075\",\"medium\",\"SRG-NET-000099-VPN-000380\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5075,\"SV-106213r1_rule\",\"medium\",null,null,\"The VPN Gateway log must protect audit information from unauthorized modification when stored locally.\",\"SRG-NET-000099-VPN-000380\",\"If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\\n\\nThis requirement pertains to securing the VPN log as it is stored locally, on the box temporarily, or while being encapsulated.\\n\\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\\n\\nAudit information includes all information (e.g., log records, audit settings, and audit reports) needed to successfully audit information system activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LurVSxZqQlUG4THAxXLsYwtoOIQkH9C5vFm75lhPk+M=\"},\"C-95915r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PRb2voDcKub8xxvNSpdygBWfbLpwWfUE85OlSdeFxMU=\"},\"F-102759r1_fix\",\"V-97077\",\"medium\",\"SRG-NET-000100-VPN-000390\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5076,\"SV-106215r1_rule\",\"medium\",null,null,\"The VPN Gateway must protect audit information from unauthorized deletion when stored locally.\",\"SRG-NET-000100-VPN-000390\",\"If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\\n\\nTo ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification.\\n\\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\\n\\nAudit information includes all information (e.g., log records, audit settings, and audit reports) needed to successfully audit information system activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:R+x0KRiQIKJIbqWDk9OWXOHA/tx5c83O7HSpjbaqItQ=\"},\"C-95917r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4gmYRDVBlFkpvQ5jFnJALH34Q1qS7urLI7Yjatvv5Ks=\"},\"F-102761r1_fix\",\"V-97079\",\"medium\",\"SRG-NET-000132-VPN-000450\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5077,\"SV-106217r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.\",\"SRG-NET-000132-VPN-000450\",\"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\\n\\nDoD continually assesses the ports, protocols, and services that can be used for network communications. Some protocols or services have known exploits or security weaknesses. Network traffic using these ports, protocols, and services must be prohibited or restricted in accordance with DoD policy. The PPSM CAL and vulnerability assessments provide an authoritative source for ports, protocols, and services that are unauthorized or restricted across boundaries on DoD networks.\\n\\nThe VPN Gateway must be configured to prevent or restrict the use of prohibited ports, protocols, and services throughout the network by filtering the network traffic and disallowing or redirecting traffic as necessary. Default and updated policy filters from the vendors will disallow older version of protocols and applications and will address most known non-secure ports, protocols, and/or services.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6xznw8iyFeJRJwk1JYCPRsiNwv5VE1E6oPOibHnQepY=\"},\"C-95919r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BV4FIuZmpkNnwep3K+axA7S7eorRTT2tR14EUOT7U0Y=\"},\"F-102763r1_fix\",\"V-97081\",\"medium\",\"SRG-NET-000132-VPN-000460\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5078,\"SV-106219r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use IKEv2 for IPsec VPN security associations.\",\"SRG-NET-000132-VPN-000460\",\"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\\n\\nUse of IKEv2 leverages DoS protections because of improved bandwidth management and leverages more secure encryption algorithms.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U9u5kkzq19uYYwdfbvK93u00swz2+lLKN/KXYD1SLPM=\"},\"C-95921r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CZLDS9pX8n0hhkw38hCbPDJhpjz0SK1r40ll/eFYuDI=\"},\"F-102765r1_fix\",\"V-97083\",\"medium\",\"SRG-NET-000132-VPN-000470\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5079,\"SV-106221r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and L2F.\",\"SRG-NET-000132-VPN-000470\",\"The PPTP and L2F are obsolete method for implementing virtual private networks. Both protocols may be easy to use and readily available, but they have many well-known security issues and exploits. Encryption and authentication are both weak.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qL67vWiduAPXEoBZfFyKtQr8Xx5q0lifYoN8/VKeiXk=\"},\"C-95923r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fRSUaDiTIxiKHwtXC7xhS028BxmoqEKmcdKtfdEYU8A=\"},\"F-102767r1_fix\",\"V-97085\",\"medium\",\"SRG-NET-000132-VPN-000480\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5080,\"SV-106223r1_rule\",\"medium\",null,null,\"For site-to-site VPN implementations, the  L2TP protocol must be blocked or denied at the security boundary with the private network so unencrypted L2TP packets cannot traverse into the private network of the enclave.\",\"SRG-NET-000132-VPN-000480\",\"Unlike GRE (a simple encapsulating header) L2TP is a full-fledged communications protocol with control channel, data channels, and a robust command structure. In addition to PPP, other link layer types (called pseudowires) can be and are defined for delivery in L2TP by separate RFC documents. Further complexity is created by the capability to define vender-specific parameters beyond those defined in the L2TP specifications.\\n\\nThe endpoint devices of an L2TP connection can be an L2TP Access Concentrator (LAC) in which case it inputs/outputs the layer 2 protocol to/from the L2TP tunnel. Otherwise, it is an L2TP Network Server (LNS), in which case it inputs/outputs the layer 3 (IP) protocol to/from the L2TP tunnel. The specifications describe three reference models: LAC-LNS, LAC-LAC, and LNS-LNS, the first of which is the most common case. The LAC-LNS model allows a remote access user to reach his home network or ISP from a remote location. The remote access user connects to  a LAC device which tunnels his connection home to an awaiting LNS. The LAC could also be located on the remote user's laptop, which connects to an LNS at home using some generic internet connection. The other reference models may be used for more obscure scenarios.\\n\\nAlthough the L2TP protocol does not contain encryption capability, it can be operated over IPsec, which would provide authentication and confidentiality. A remote user in the LAC-LNS model would most likely obtain a dynamically assigned IP address from the home network to ultimately use through the tunnel back to the home network. Secondly, the outer IP source address used to send the L2TP tunnel packet to the home network is likely to be unknown or highly variable. Thirdly, since the LNS provides the remote user with a dynamic IP address to use, the firewall at the home network would have to be dynamically updated to accept this address in conjunction with the outer tunnel address. Finally, there is also the issue of authentication of the remote user prior to divulging an acceptable IP address. Because of all of these complications, the strict filtering rules applied to the IP-in-IP and GRE tunneling cases will likely not be possible in the L2TP scenario.\\n\\nIn addition to the difficulty of enforcing addresses and endpoints (as explained above), the L2TP protocol itself is a security concern if allowed through a security boundary. In particular:\\n\\n1) L2TP potentially allows link layer protocols to be delivered from afar. These protocols were intended for link-local scope only, are less defended, and not as well-known,\\n2) The L2TP tunnels can carry IP packets that are very difficult to see and filter because of the additional layer 2 overhead,\\n3) L2TP is highly complex and variable (vender-specific variability) and therefore would be a viable target that is difficult to defend. It is better left outside of the main firewall where less damage occurs if the L2TP-processing node is compromised,\\n4) Filtering cannot be used to detect and prevent other unintended layer 2 protocols from being tunneled. The strength of the application layer code would have to be relied on to achieve this task,\\n5) Regardless of whether the L2TP is handled inside or outside of the main network, a secondary layer of IP filtering is required; therefore bringing it inside does not save resources.\\n\\nTherefore, it is not recommended to allow unencrypted L2TP packets across the security boundary into the network's protected areas. Reference the Backbone Transport STIG for additional L2TP guidance and use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mmyK/9p+kkBzjw391gSBn/5JwQ6rUWRXc0i0deZcJlY=\"},\"C-95925r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PTCfoKcCD5hDW7K47sK1D7FeehVzMR67iHZOHpTiBJE=\"},\"F-102769r1_fix\",\"V-97087\",\"medium\",\"SRG-NET-000138-VPN-000490\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5081,\"SV-106225r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).\",\"SRG-NET-000138-VPN-000490\",\"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\\n\\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses except the following.\\n\\n(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\\n\\n(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals' in-group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN or proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D7dgt3RnYA25LvMASqDp9YTrG7KfSDck59y/cwVd1j4=\"},\"C-95927r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Rh+GrFD8y7n/BlVOr9JDOC5ROFB+DmI+8x461DH5A1Q=\"},\"F-102771r1_fix\",\"V-97089\",\"high\",\"SRG-NET-000140-VPN-000500\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5082,\"SV-106227r1_rule\",\"high\",null,null,\"The VPN Gateway must use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.\",\"SRG-NET-000140-VPN-000500\",\"To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.\\n\\nMultifactor authentication uses two or more factors to achieve authentication. Use of password for user remote access for non-privileged account is not authorized.\\n\\nFactors include:\\n(i) Something you know (e.g., password/PIN);\\n(ii) Something you have (e.g., cryptographic identification device, token); or\\n(iii) Something you are (e.g., biometric).\\n\\nA non-privileged account is any information system account with authorizations of a non-privileged user.\\n\\nNetwork access is any access to a network element by a user (or a process acting on behalf of a user) communicating through a network.\\n\\nThe DoD CAC with DoD-approved PKI is an example of multifactor authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KKZUM28vxti/o8G6lxUgCF8Wx8ura3+B1TExgJuWCGA=\"},\"C-95929r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:n8I5AADucbxW3nhWpeZCsAbA1ZwIJ9+ypR/dgDeDkbA=\"},\"F-102773r1_fix\",\"V-97091\",\"medium\",\"SRG-NET-000145-VPN-000510\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5083,\"SV-106229r1_rule\",\"medium\",null,null,\"The VPN Client must implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.\",\"SRG-NET-000145-VPN-000510\",\"Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD common access card.\\n\\nA non-privileged account is any information system account with authorizations of a non-privileged user.\\n\\nNetwork access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:koWH1S5xZuAZ4H9vnFXHr/qz4c6UDJH7P29FdfhEPZg=\"},\"C-95931r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/05962IPiIdyt4V5PSfPjQ8gsSvFmLoQb7Ih1O9CdmI=\"},\"F-102775r1_fix\",\"V-97093\",\"medium\",\"SRG-NET-000147-VPN-000520\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5084,\"SV-106231r1_rule\",\"medium\",null,null,\"The TLS VPN must be configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts.\",\"SRG-NET-000147-VPN-000520\",\"A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack.\\n\\nAn authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message.\\n\\nA non-privileged account is any operating system account with authorizations of a non-privileged user.\\n\\nTechniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:53vjl7nhxJZkAmPcXBfrWgxe2N8vSeOA4P5KeOUv1cA=\"},\"C-95933r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tvtLSoQBIUhFi1DUAx/IQFts2ZxCAJGEu1MMnqECcNE=\"},\"F-102777r1_fix\",\"V-97095\",\"medium\",\"SRG-NET-000147-VPN-000530\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5085,\"SV-106233r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use anti-replay mechanisms for security associations.\",\"SRG-NET-000147-VPN-000530\",\"Anti-replay is an IPsec security mechanism at a packet level, which helps to avoid unwanted users from intercepting and modifying an ESP packet.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PQvyQqpQfxH4QYcuFED9dQWGmLZ5NjYVdg+5ViJyzMc=\"},\"C-95935r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PKYcfwohvuVW06x1QmIrzJEC7yX68OlFaic/tTj3y3A=\"},\"F-102779r1_fix\",\"V-97097\",\"medium\",\"SRG-NET-000148-VPN-000540\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5086,\"SV-106235r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify all network-connected endpoint devices before establishing a connection.\",\"SRG-NET-000148-VPN-000540\",\"Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\\n\\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification decisions (as opposed to the actual identifiers) to the services that need to act on those decisions.\\n\\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers (outside a datacenter), VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v5/IfNoYuNBZdJW3TnihRjv14rrPD9SLxquxNn9HMf0=\"},\"C-95937r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4mEma8P0Dv4vj5cqKTp53/Xgkv8CV31yYo/9WqBJF7I=\"},\"F-102781r1_fix\",\"V-97099\",\"medium\",\"SRG-NET-000164-VPN-000560\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5087,\"SV-106237r1_rule\",\"medium\",null,null,\"The VPN Gateway, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.\",\"SRG-NET-000164-VPN-000560\",\"Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. To meet this requirement, the information system must create trusted channels between itself and remote trusted authorized IT product (e.g., syslog server) entities that protect the confidentiality and integrity of communications. The information system must create trusted paths between itself and remote administrators and users that protect the confidentiality and integrity of communications.\\n\\nA trust anchor is an authoritative entity represented via a public key and associated data. It is most often used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. However, applications that do not use a trusted path are not approved for non-local and remote management of DoD information systems.\\n\\nUse of SSHv2 to establish a trusted channel is approved. Use of FTP, TELNET, HTTP, and SNMPV1 is not approved since they violate the trusted channel rule set. Use of web management tools that are not validated by common criteria may also violate the trusted channel rule set.\\n\\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA.\\n\\nThis requirement verifies that a certification path to an accepted trust anchor is used for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Validation of the certificate status information is out of scope for this requirement.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4L7fYYyaq26bvadPv3JCcQ3yEjurb6JgRmYQ/U0UV1c=\"},\"C-95939r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kHIpuc9rQ7c3thtVDQNITMH7ftHuWzgXExpBIujEdHQ=\"},\"F-102783r1_fix\",\"V-97101\",\"medium\",\"SRG-NET-000165-VPN-000570\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5088,\"SV-106239r1_rule\",\"medium\",null,null,\"The site-to-site VPN, when using PKI-based authentication for devices, must enforce authorized access to the corresponding private key.\",\"SRG-NET-000165-VPN-000570\",\"If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure.\\n\\nThe cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to authenticate to network devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ar3GvJuXEKD4A/Af2IozOGlLJBjfNqRbiW1i8k/7Y9g=\"},\"C-95941r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5j0XBOP7B/DfiJ4RQcUK0zsSkNS1ZJgD+jERXi5h0IM=\"},\"F-102785r1_fix\",\"V-97103\",\"medium\",\"SRG-NET-000166-VPN-000580\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5089,\"SV-106241r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway must use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.\",\"SRG-NET-000166-VPN-000580\",\"The VPN interacts directly with public networks and devices and should not contain user authentication information for all users. AAA network security services provide the primary framework through which a network administrator can set up access control and authorization on network points of entry or network access servers. It is not advisable to configure access control on the VPN gateway or remote access server. Separation of services provides added assurance to the network if the access control server is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:f0b/RYI3SCPeEqjHsb3psBWUdGRTKfgqRrq51hB7yfE=\"},\"C-95953r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Oi4jUVTD6ycPdzvYBP8T+rY1x1IUvcpUVTHSlQ5ZZHM=\"},\"F-102797r1_fix\",\"V-97113\",\"medium\",\"SRG-NET-000166-VPN-000590\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5090,\"SV-106251r1_rule\",\"medium\",null,null,\"The VPN Gateway must map the authenticated identity to the user account for PKI-based authentication.\",\"SRG-NET-000166-VPN-000590\",\"Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of a user (e.g., VPN or ALG. This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MRKxPi/bbsDz8wNN9vXmb7hhgMU8M3+JU6oyqsrMnZk=\"},\"C-95955r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pSURQgwBF8TrM2BF5TWiE9Mm2xRU9ilNiN8qenfhfhs=\"},\"F-102799r1_fix\",\"V-97115\",\"medium\",\"SRG-NET-000168-VPN-000600\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5091,\"SV-106253r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).\",\"SRG-NET-000168-VPN-000600\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nNonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through either an external network (e.g., the Internet) or an internal network.\\n\\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\\n\\nApplications also include HMAC, KDFs, Random Bit Generation, and hash-only applications (e.g., hashing passwords and using SHA-1 or higher to compute a checksum). For digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use where needed.\\n\\nSeparate requirements for configuring applications and protocols used by each product (e.g., SNMPv3, SSH, NTP, and other protocols and applications that require server/client authentication) are required to implement this requirement.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:L26csqRjhPU0fgblV8qX1BlmvtAHZjw4Yyp+bb0mDKw=\"},\"C-95957r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:srWnJLZc/eBKJFIWlsEIupfvJph4j2NGvFXosOihlzk=\"},\"F-102801r1_fix\",\"V-97117\",\"medium\",\"SRG-NET-000169-VPN-000610\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5092,\"SV-106255r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).\",\"SRG-NET-000169-VPN-000610\",\"Lack of authentication and identification enables non-organizational users to gain access to the network or possibly a VPN gateway that provides opportunity for intruders to compromise resources within the network infrastructure.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of a non-organizational user.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OyTG982E0CMxr4y2rmBaYCCpTY7srBWAv/cZQUt/Y+w=\"},\"C-95959r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1p/ev5FaVReOsAiB4Yypz9PuTHTIq8DZEOVu8/pAPZo=\"},\"F-102803r1_fix\",\"V-97119\",\"medium\",\"SRG-NET-000205-VPN-000710\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5093,\"SV-106257r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to route sessions to an IDPS for inspection.\",\"SRG-NET-000205-VPN-000710\",\"Remote access devices, such as those providing remote access to network devices and information systems, which lack automated, capabilities increase risk and makes remote user access management difficult at best.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nAutomated monitoring of remote access sessions allows organizations to detect cyber attacks and ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, from a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lOVVOo0oYWR1BZZb2TwnHXMbM18YttAN6G4GrHPWbyw=\"},\"C-95961r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lQAodzF2vAPdkyT4THpjERChTagkjNx3KaYEZBi/5HM=\"},\"F-102805r1_fix\",\"V-97121\",\"low\",\"SRG-NET-000213-VPN-000720\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5094,\"SV-106259r1_rule\",\"low\",null,null,\"The VPN Gateway must terminate all network connections associated with a communications session at the end of the session.\",\"SRG-NET-000213-VPN-000720\",\"Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These “orphaned” sessions use up valuable router resources and can be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keep alive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the TCP keep alive message, the sending router will clear the connection and free resources allocated to the session.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZitF7N9m7tBrFLBSFvvFyer2Cj1EN7TGddhFoon9a2g=\"},\"C-95963r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:EuB8U2wr3QUgtcHmLsicOw6VzQ5t4flKS602zwr3K7I=\"},\"F-102807r1_fix\",\"V-97123\",\"medium\",\"SRG-NET-000230-VPN-000770\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5095,\"SV-106261r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.\",\"SRG-NET-000230-VPN-000770\",\"Unapproved mechanisms that are used for authentication to the cryptographic module are not verified, and therefore cannot be relied upon to provide confidentiality or integrity and DoD data may be compromised.\\n\\nVPN gateways utilizing encryption are required to use FIPS compliant mechanisms for authenticating to cryptographic modules.\\n\\nFIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uJQ31o/f/Vqkllw6K1glewYI9Xlo0bRZIER2AGlLICw=\"},\"C-95965r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5d33UFWeSYVRhZGzYH0+0+VJ6rVugjCYj6LlTRa+nqY=\"},\"F-102809r1_fix\",\"V-97125\",\"high\",\"SRG-NET-000230-VPN-000780\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5096,\"SV-106263r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use Internet Key Exchange (IKE) with SHA-1 or greater to protect the authenticity of communications sessions.\",\"SRG-NET-000230-VPN-000780\",\"Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/SOA will require the use of mutual authentication (two-way/bidirectional).\\n\\nAn IPsec Security Associations (SA) is established using either IKE or manual configuration.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KPLBOeYMBZIxBbaWyihbjnI+iXUnrab0mkIE2hzbTk8=\"},\"C-95967r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QTXhy5bkfpQRsWuE/X3R1behSbs9HPpQP63IlKE7Z9A=\"},\"F-102811r1_fix\",\"V-97127\",\"medium\",\"SRG-NET-000231-VPN-000790\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5097,\"SV-106265r1_rule\",\"medium\",null,null,\"The VPN Gateway must invalidate session identifiers upon user logoff or other session termination.\",\"SRG-NET-000231-VPN-000790\",\"Captured sessions can be reused in \\\"replay\\\" attacks. This requirement limits the ability of adversaries from capturing and continuing to employ previously valid session IDs.\\n\\nSession IDs are tokens generated by web applications to uniquely identify an application user's session. Unique session identifiers or IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. When a user logs out, or when any other session termination event occurs, the VPN gateway must terminate the user session to minimize the potential for an attacker to hijack that particular user session.\\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet.\\n\\nThis requirement applies only to any VPN gateway that is an intermediary of individual sessions (e.g., proxy, ALG, or SSL VPN). This requirement focuses on communications protection at the application session, versus network packet level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p+iB5XlL+If6inJuLfQ+r3VNT86JXC5NhnV2vOeozxg=\"},\"C-95969r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tbmOT/VG86p0EWsjZLm3s8Y4/9kcKFGaAevpuHrUlfg=\"},\"F-102813r1_fix\",\"V-97129\",\"medium\",\"SRG-NET-000233-VPN-000800\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5098,\"SV-106267r1_rule\",\"medium\",null,null,\"The VPN Gateway must recognize only system-generated session identifiers.\",\"SRG-NET-000233-VPN-000800\",\"VPN gateways (depending on function) utilize sessions and session identifiers to control application behavior and user access. If an attacker can guess the session identifier, or can inject or manually insert session information, the valid user's application session can be compromised.\\n\\nUnique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions.\\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet.\\n\\nThis requirement applies to any VPN gateway that is an intermediary of individual sessions (e.g., proxy, ALG, TLS VPN). VPN gateways that perform these functions must be able to identify which session identifiers were generated when the sessions were established.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ktJIe/Y+HEIOo7bAwQCz3X/2hQkiqoTyl8BVpkZpHYk=\"},\"C-95971r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TniVNe2bo64DYrBZv1sEf0zR9SKcbwn0jWfXR3l8iz0=\"},\"F-102815r1_fix\",\"V-97131\",\"medium\",\"SRG-NET-000234-VPN-000810\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5099,\"SV-106269r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.\",\"SRG-NET-000234-VPN-000810\",\"Both IPsec and TLS gateways use the RNG to strengthen the security of the protocols. Using a weak RNG will weaken the protocol and make it more vulnerable.\\n\\nUse of a FIPS validated RNG that is not DRGB mitigates to a CAT III.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D9gD2h3b8ZDEWmQokEZllnWlmTLY7M//Hjdn7DqBOf8=\"},\"C-95973r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KB4RBRRC9piCCQ/V/rwpAJ5Z4Df6Bh3k50+VVARART8=\"},\"F-102817r1_fix\",\"V-97133\",\"medium\",\"SRG-NET-000235-VPN-000820\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5100,\"SV-106271r1_rule\",\"medium\",null,null,\"The VPN Gateway must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.\",\"SRG-NET-000235-VPN-000820\",\"Failure to a known safe state helps prevent systems from failing to a state that may cause loss of data or unauthorized access to system resources. VPN gateways that fail suddenly and with no incorporated failure state planning may leave the hosting system available but with a reduced security protection capability. Preserving information system state information also facilitates system restart and return to the operational mode of the organization with less disruption to mission-essential processes.\\n\\nAbort refers to stopping a program or function before it has finished naturally. The term abort refers to both requested and unexpected terminations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:72eP2Vo/dCHVQ+6f/2RQyYnBi119Hq+RWYm1m2WqoLc=\"},\"C-95975r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KOCFObJ10AgHLn2PIX9FSde4QkGSCpnBOYQLWTFTSDo=\"},\"F-102819r1_fix\",\"V-97135\",\"medium\",\"SRG-NET-000313-VPN-001050\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5101,\"SV-106273r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to perform an organization-defined action if the audit reveals unauthorized activity.\",\"SRG-NET-000313-VPN-001050\",\"Remote access devices, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and makes remote user access management difficult at best.\\n\\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\\n\\nRemote access functionality, such as remote access servers, VPN concentrators, and IDS/IPS devices, must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:w9yL+z+t1qYSt9kk+sxVflN/xG/naaJ9QP4VRCcqw6Q=\"},\"C-95977r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:COjdhT7YeatypyTtARxEDYM/VBCnUmEevQq0bspvHSk=\"},\"F-102821r1_fix\",\"V-97137\",\"medium\",\"SRG-NET-000314-VPN-001060\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5102,\"SV-106275r1_rule\",\"medium\",null,null,\"The VPN Gateway administrator accounts or security policy must be configured to allow the system administrator to immediately disconnect or disable remote access to devices and/or users when needed.\",\"SRG-NET-000314-VPN-001060\",\"Without the ability to immediately disconnect or disable remote access, an attack or other compromise taking progress would not be immediately stopped.\\n\\nRemote access functionality must have the capability to immediately disconnect current users remotely accessing the information system and/or disable further remote access. The speed of disconnect or disablement varies based on the criticality of mission functions and the need to eliminate immediate or future remote access to organizational information systems.\\n\\nThe remote access functionality (e.g., VPN, ALG, and RAS) may implement features, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:afNm41YNd2Z2QwHOtNNm/ZsgKpPtQhY3FaPrGqRWnTw=\"},\"C-95979r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HIQBC9ZU7AuTIdllzK3oRjj9cc4DrzRsdkjLzrUOnSE=\"},\"F-102823r1_fix\",\"V-97139\",\"high\",\"SRG-NET-000317-VPN-001090\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5103,\"SV-106277r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use AES encryption for the Internet Key Exchange (IKE) proposal to protect confidentiality of remote access sessions.\",\"SRG-NET-000317-VPN-001090\",\"Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nAES is the FIPS-validated cipher block cryptographic algorithm approved for use in DoD. For an algorithm implementation to be listed on a FIPS 140-2 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. Currently, NIST has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:n4616xCQqSEJ5LDbI/BvogDwAhTFLCqs6qsCNm2y6qM=\"},\"C-95981r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:o94iAavW4v2w03yRo2xl3upVmak75NTVDj/Dy2pNCbA=\"},\"F-102825r1_fix\",\"V-97141\",\"medium\",\"SRG-NET-000320-VPN-001120\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5104,\"SV-106279r1_rule\",\"medium\",null,null,\"The VPN Gateway must transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.\",\"SRG-NET-000320-VPN-001120\",\"Protecting authentication communications between the client, the VPN Gateway, and the authentication server keeps this critical information from being exploited.\\n\\nIn distributed information systems, authorization processes and access control decisions may occur in separate parts of the systems. In such instances, authorization information is transmitted securely so timely access control decisions can be enforced at the appropriate locations. To support the access control decisions, it may be necessary to transmit as part of the access authorization information, supporting security attributes. This is due to the fact that in distributed information systems, there are various access control decisions that need to be made and different entities (e.g., services) make these decisions in a serial fashion, each requiring some security attributes to make the decisions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qrumTMQiLLqavZ4GBAcbIfp6Kibky5yDpODJYsUNU6k=\"},\"C-95983r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:liEE0SFmmeFRP77fVgYsXwcMaxPrYjZRWHQv5JaTXXg=\"},\"F-102827r1_fix\",\"V-97143\",\"low\",\"SRG-NET-000330-VPN-001220\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5105,\"SV-106281r1_rule\",\"low\",null,null,\"The VPN Gateway must notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).\",\"SRG-NET-000330-VPN-001220\",\"Users need to be aware of activity that occurs regarding their account. Providing users with information deemed important by the organization may aid in the discovery of unauthorized access or thwart a potential attacker.\\n\\nOrganizations should consider the risks to the specific information system being accessed and the threats presented by the device to the environment when configuring this option. An excessive or unnecessary amount of information presented to the user at logon is not recommended.\\n\\nThis requirement applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bzo/kYUviBi8fH0VVF4kMJsdAnZOcFeOl3REDgnED8o=\"},\"C-95985r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:P8pkANj/XLaqdv6hJakyvgLuueJH8cGpKoldzmEq82g=\"},\"F-102829r1_fix\",\"V-97145\",\"medium\",\"SRG-NET-000333-VPN-001250\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5106,\"SV-106283r1_rule\",\"medium\",null,null,\"The VPN Gateway must provide centralized management and configuration of the content to be captured in log records generated by all network components.\",\"SRG-NET-000333-VPN-001250\",\"Without the ability to centrally manage the content captured in the log records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack.\\n\\nThe content captured in log records must be managed from a central location (necessitating automation). Centralized management of log records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Network components requiring centralized audit log management must have the capability to support centralized management.\\n\\nThe DoD requires centralized management of all network component audit record content.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cvSX2fNtb/9d5KoCFv38r/vk1P66QvbknutRPO++RHQ=\"},\"C-95987r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4LMA3u9siEI56MkwasqV8o7t4fUD89q8QT8ld4InCNY=\"},\"F-102831r1_fix\",\"V-97147\",\"medium\",\"SRG-NET-000334-VPN-001260\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5107,\"SV-106285r1_rule\",\"medium\",null,null,\"The VPN Gateway must off-load audit records onto a different system or media than the system being audited.\",\"SRG-NET-000334-VPN-001260\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rpLsrhPbwk1f+JYoA5pOhGpi71+wEYHZA7WhvDHOZ+M=\"},\"C-95989r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ZbcudZvV1BQEgFZtq1Hz/2teLVGVbnWW0bcryt+9lXk=\"},\"F-102833r1_fix\",\"V-97149\",\"medium\",\"SRG-NET-000335-VPN-001270\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5108,\"SV-106287r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.\",\"SRG-NET-000335-VPN-001270\",\"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected.\\n\\nAlerts provide organizations with urgent messages. Automated alerts can be conveyed in a variety of ways, including, for example, telephonically, via electronic mail, via text message, or via websites. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded.\\n\\nWhile this requirement also applies to the event monitoring system (e.g., Syslog, Security Information and Event Management [SIEM], or SNMP servers), the VPN Gateway must also be configured to generate a message to the administrator console.\\n\\nThe VPN daemon facility and log facility are messages in the log, which capture actions performed or errors encountered by system processes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lKiTDkfAGyG9SqJoJw3IBMHEt9m1XfYEXjJcJ6N2O4I=\"},\"C-95991r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:98ovgM7bqc4Ya1AKRRjI0MOMt8I2xMdngADds6VQJgc=\"},\"F-102835r1_fix\",\"V-97151\",\"medium\",\"SRG-NET-000336-VPN-001280\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5109,\"SV-106289r1_rule\",\"medium\",null,null,\"When communications with the Central Log Server is lost, the VPN Gateway must continue to queue traffic log records locally.\",\"SRG-NET-000336-VPN-001280\",\"If the system were to continue processing after audit failure, actions can be taken on the system that cannot be tracked and recorded for later forensic analysis.\\n\\nBecause of the importance of ensuring mission/business continuity, organizations may determine that the nature of the audit failure is not so severe that it warrants a complete shutdown of the application supporting the core organizational missions/business operations. In those instances, partial application shutdowns or operating in a degraded mode with reduced capability may be viable alternatives.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fVzjNA9x7fe7XKuKOy79M7wLwKGgdGCnV3TChwORocM=\"},\"C-95993r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:7kFOvG6IkBGOVLyO9MRlIA10BFwkb7/m/gpclcr3GP8=\"},\"F-102837r1_fix\",\"V-97153\",\"medium\",\"SRG-NET-000337-VPN-001290\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5110,\"SV-106291r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must renegotiate the security association after 8 hours or less, or an organization-defined period.\",\"SRG-NET-000337-VPN-001290\",\"The IPsec SA and its corresponding key will expire either after the number of seconds or amount of traffic volume has exceeded the configured limit. A new SA is negotiated before the lifetime threshold of the existing SA is reached to ensure that a new SA is ready for use when the old one expires. The longer the lifetime of the IPsec SA, the longer the lifetime of the session key used to protect IP traffic. The SA is less secure with a longer lifetime because an attacker has a greater opportunity to collect traffic encrypted by the same key and subject it to cryptanalysis. However, a shorter lifetime causes IPsec peers to renegotiate Phase II more often resulting in the expenditure of additional resources.\\n\\nSpecify the lifetime (in seconds) of an Internet Key Exchange (IKE) security association (SA). When the SA expires, it is replaced by a new SA, the security parameter index (SPI), or terminated if the peer cannot be contacted for renegotiation.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yIMWyLqQ5KjJhVIE0sO7kOy3MFZ/mr8G1UsF2vpFezs=\"},\"C-95995r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HEQrvy4/s8jokXmlLC3sxlKZoNheJdGUClzKnI45P1o=\"},\"F-102839r1_fix\",\"V-97155\",\"medium\",\"SRG-NET-000337-VPN-001300\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5111,\"SV-106293r1_rule\",\"medium\",null,null,\"The VPN Gateway must renegotiate the security association after 24 hours or less or as defined by the organization.\",\"SRG-NET-000337-VPN-001300\",\"When a VPN gateway creates an IPsec Security Association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway’s inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3Vk1c0ULGwB+JNxtAcJe82imefTrQUiXMXW0gSoV5sI=\"},\"C-95997r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:xBCJWam1YJOEk/Y3uRcCt4tDlmUHwgij/XAGpODs0PQ=\"},\"F-102841r1_fix\",\"V-97157\",\"medium\",\"SRG-NET-000341-VPN-001350\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5112,\"SV-106295r1_rule\",\"medium\",null,null,\"The VPN Gateway must accept Personal Identity Verification (PIV) credentials.\",\"SRG-NET-000341-VPN-001350\",\"The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\\n\\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U2xkrpdDd5fbE89oPVhqhnurz+BzWOL7MBkXI3iyc44=\"},\"C-95999r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:DWEbV0DVPuJ7OTfvbUkhrgxsgpWLM8sKjC8MjkQOMA4=\"},\"F-102843r1_fix\",\"V-97159\",\"medium\",\"SRG-NET-000342-VPN-001360\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5113,\"SV-106297r1_rule\",\"medium\",null,null,\"The VPN Gateway must electronically verify Personal Identity Verification (PIV) credentials.\",\"SRG-NET-000342-VPN-001360\",\"The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\\n\\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tY5W3SOCbPKTMPPTVFP0FpXqFdrxc15JZY9C5N1Jp3E=\"},\"C-96015r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C2DPURp+P/TJg1Bmt9fhJFi9259gGRXNzSqAORnuD3g=\"},\"F-102859r1_fix\",\"V-97177\",\"medium\",\"SRG-NET-000343-VPN-001370\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5114,\"SV-106315r1_rule\",\"medium\",null,null,\"The VPN Gateway must authenticate all network-connected endpoint devices before establishing a connection.\",\"SRG-NET-000343-VPN-001370\",\"Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\\n\\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions.\\n\\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers (outside a datacenter), VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.\\n\\nDevice authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bVroOwdA0e1yfLelH5K0/LjEPzRuPTDt+xgTDMzMsWA=\"},\"C-96017r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y/+l8kwggjnCbQ11WRfSGhCjui6kGNchR0wer8LCVos=\"},\"F-102861r1_fix\",\"V-97179\",\"medium\",\"SRG-NET-000352-VPN-001460\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5115,\"SV-106317r1_rule\",\"medium\",null,null,\"The VPN Gateway must use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.\",\"SRG-NET-000352-VPN-001460\",\"Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.\\n\\nThe National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by NIST and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future required Suite B implementations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1maPMRSAJQc9CCcE9i3+e/pBNygIhmu9m1GajIh4WrA=\"},\"C-96019r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:c81cg0K0ERMsQOfw3hMhzc4N9PuesRPEfIK2UBPat/E=\"},\"F-102863r1_fix\",\"V-97181\",\"medium\",\"SRG-NET-000369-VPN-001620\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5116,\"SV-106319r1_rule\",\"medium\",null,null,\"The VPN Gateway must disable split-tunneling for remote clients VPNs.\",\"SRG-NET-000369-VPN-001620\",\"Split tunneling would in effect allow unauthorized external connections, making the system more vulnerable to attack and to exfiltration of organizational information.\\n\\nA VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the Internet. With split tunneling enabled, a remote client has access to the Internet while at the same time has established a secured path to the enclave via an IPsec tunnel. A remote client connected to the Internet that has been compromised by an attacker in the Internet, provides an attack base to the enclave’s private network via the IPsec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:W5E6fpSFPSjZsDhRm6JBdbhvWCdb4iIQ29kz4GWDM20=\"},\"C-96021r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PzvaYVGXC+ztLTE2ZozeA+R4K4I1v/fBf/opSADlvJ0=\"},\"F-102865r1_fix\",\"V-97183\",\"medium\",\"SRG-NET-000371-VPN-001640\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5117,\"SV-106321r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.\",\"SRG-NET-000371-VPN-001640\",\"PFS generates each new encryption key independently from the previous key. Without PFS, compromise of one key will compromise all communications.\\n\\nThe phase 2 (Quick Mode) Security Association (SA) is used to create an IPsec session key. Hence, its rekey or key regeneration procedure is very important. The phase 2 rekey can be performed with or without Perfect Forward Secrecy (PFS). With PFS, every time a new IPsec Security Association is negotiated during the Quick Mode, a new Diffie-Hellman (DH) exchange occurs. The new DH shared secret will be included with original keying material (SYKEID_d, initiator nonce, and responder nonce from phase 1 for generating a new IPsec session key. If PFS is not used, the IPsec session key will always be completely dependent on the original keying material from the Phase-1. Hence, if an older key is compromised at any time, it is possible that all new keys may be compromised.\\n\\nThe DH exchange is performed in the same manner as was done in phase 1 (Main or Aggressive Mode). However, the phase 2 exchange is protected by encrypting the phase 2 packets with the key derived from the phase 1 negotiation. Because DH negotiations during phase 2 are encrypted, the new IPsec session key has an added element of secrecy.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rqcFP9ktgfb343ahB5Mv16lTwTPf1/ELOUg9C3CgAj8=\"},\"C-96023r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:j/fsWDohMzN1oclh4BAauCakys23bebITKpZxWpK2Qk=\"},\"F-102867r1_fix\",\"V-97185\",\"high\",\"SRG-NET-000371-VPN-001650\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5118,\"SV-106323r1_rule\",\"high\",null,null,\"The VPN Gateway and Client must be configured to protect the confidentiality and integrity of transmitted information.\",\"SRG-NET-000371-VPN-001650\",\"Without protection of the transmitted information, confidentiality and integrity may be compromised as unprotected communications can be intercepted and either read or altered.\\n\\nThis requirement also applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification.\\n\\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.\\n\\nFor example, configure all ISAKMP policies to use AES for Internet Key Exchange (IKE) cryptographic encryption operations and SHA-1 to protect data integrity.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+vnSRs+ZokA+P5inP7i24jyzDoJ+8dRGwCZAF72bzfw=\"},\"C-96025r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:F3uzs5G3+v3iJx/kCrPtcrdW/gsCjZHZOAXufRJxNgY=\"},\"F-102869r1_fix\",\"V-97187\",\"medium\",\"SRG-NET-000375-VPN-001690\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5119,\"SV-106325r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.\",\"SRG-NET-000375-VPN-001690\",\"ESP provides confidentiality, data origin authentication, integrity, and anti-replay services within the IPsec suite of protocols. ESP in tunnel mode ensures a secure path for communications for site-to-site VPNs and gateway to endpoints, including header information.\\n\\nESP can be deployed in either transport or tunnel mode. Transport mode is used to create a secured session between two hosts. It can also be used when two hosts simply want to authenticate each IP packet with IPsec authentication header (AH). With ESP transport mode, only the payload (transport layer) is encrypted, whereas with tunnel mode, the entire IP packet is encrypted and encapsulated with a new IP header. Tunnel mode is used to encrypt traffic between secure IPsec gateways or between an IPsec gateway and an end-station running IPsec software. Hence, it is the only method to provide a secured path to transport traffic between remote sites or end-stations and the central site.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fU8zq6dLn1EHMKbL2KwqzdBun1CXedlYFT1NSzY5Zw0=\"},\"C-96027r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:AN4m35Ma+yxdnoD7gJy8bvR+ZHLR8Sqmd04QY4ipeyM=\"},\"F-102871r1_fix\",\"V-97189\",\"medium\",\"SRG-NET-000400-VPN-001940\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5120,\"SV-106327r1_rule\",\"medium\",null,null,\"For site-to-site VPN, for accounts using password authentication, the VPN Gateway must use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.\",\"SRG-NET-000400-VPN-001940\",\"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThe information system must specify the hash algorithm used for authenticating passwords. Implementation of this requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GOcfn7YCnFViHL4Sv9yLScid+jFSlnVek7L1omc1Mjw=\"},\"C-96029r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4MYR7ku3/EgXleyLtcxftc2BDi8OAuC5GMzuGE2BIhY=\"},\"F-102873r1_fix\",\"V-97191\",\"medium\",\"SRG-NET-000492-VPN-001980\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5121,\"SV-106329r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records when successful and/or unsuccessful VPN connection attempts occur.\",\"SRG-NET-000492-VPN-001980\",\"Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\\n\\nLog records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nThis requirement only applies to components where this is specific to the function of the device, such as application layer gateway (ALG), which provides these access control and auditing functions on behalf of an application. This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D0/SC7O2V3JZ4+Sewx7Qn6Z7ZSrkdje8orXuKxcEjpo=\"},\"C-96031r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NNq3b5rAHl25ZbWpIy/Y+Q7WJgEfjrSCsg45dAZ/hYA=\"},\"F-102875r1_fix\",\"V-97193\",\"medium\",\"SRG-NET-000510-VPN-002160\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5122,\"SV-106331r1_rule\",\"medium\",null,null,\"The VPN Gateway must use a FIPS-validated cryptographic module to generate cryptographic hashes.\",\"SRG-NET-000510-VPN-002160\",\"FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plain text. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.\\n\\nThe cryptographic module used must have at least one validated hash algorithm. This validated hash algorithm must be used to generate cryptographic hashes for all cryptographic security function within the product being evaluated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GNvczQqQ8RSDNiGZgHykTH9Fl/06XwpsXibtlkPH4AM=\"},\"C-96033r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wpU2wZ1uyf3RUQgJzjcuMubJFwKQTMsVYABGtyetAu0=\"},\"F-102877r1_fix\",\"V-97195\",\"medium\",\"SRG-NET-000510-VPN-002170\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5123,\"SV-106333r1_rule\",\"medium\",null,null,\"The VPN Gateway must use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.\",\"SRG-NET-000510-VPN-002170\",\"FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plain text. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.\\n\\nThe cryptographic module used must have one FIPS-validated encryption algorithm (i.e., validated Advanced Encryption Standard [AES]). This validated algorithm must be used for encryption for cryptographic security function within the product being evaluated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nrioFfQyWAyHyqPYTDE2+pXaDoeycQE/PjC2vrEL9Jo=\"},\"C-96035r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zi3v1EJgN7RWCshcZkpIFWwckY19Ow6NkWzZdajmLjM=\"},\"F-102879r1_fix\",\"V-97197\",\"medium\",\"SRG-NET-000510-VPN-002180\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5124,\"SV-106335r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway IKE must use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.\",\"SRG-NET-000510-VPN-002180\",\"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hDgoEHbOPyCRLlTAZ0Qqx1kkok77I93P01NwpDJNEE8=\"},\"C-96037r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qUzVSTw+n8v2UFfLxBraBDENI28bgIEBRVGPthivu9U=\"},\"F-102881r1_fix\",\"V-97199\",\"high\",\"SRG-NET-000512-VPN-002220\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5125,\"SV-106337r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use Internet Key Exchange (IKE) for IPsec VPN Security Associations (SAs).\",\"SRG-NET-000512-VPN-002220\",\"Without IKE, the SPI is manually specified for each security association. IKE peers will negotiate the encryption algorithm and authentication or hashing methods as well as generate the encryption keys.\\n\\nAn IPsec SA is established using either Internet Key Exchange (IKE) or manual configuration. When using IKE, the security associations are established when needed and expire after a period of time or volume of traffic threshold. If manually configured, they are established as soon as the configuration is complete at both end points and they do not expire. When using IKE, the Security Parameter Index (SPI) for each security association is a pseudo-randomly derived number.\\n\\nWith manual configuration of the IPsec security association, both the cipher key and authentication key are static. Hence, if the keys are compromised, the traffic being protected by the current IPsec tunnel can be decrypted as well as traffic in any future tunnels established by this SA. Furthermore, the peers are not authenticated prior to establishing the SA, which could result in a rogue device establishing an IPsec SA with either of the VPN end points.\\n\\nIKE provides primary authentication to verify the identity of the remote system before negotiation begins. This feature is lost when the IPsec security associations are manually configured, which results in a non-terminating session using static pre-shared keys.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IzzOyrG05CKpFAWFrkEoNJ5rxjb3elkLNtjevgCQdtw=\"},\"C-96039r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:xx84wPMsMSSAo4CeASGVN5MvUIu7DiKqar4aWbsOerA=\"},\"F-102883r1_fix\",\"V-97201\",\"high\",\"SRG-NET-000512-VPN-002230\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5126,\"SV-106339r1_rule\",\"high\",null,null,\"The VPN Gateway must not accept certificates that have been revoked when using PKI for authentication.\",\"SRG-NET-000512-VPN-002230\",\"Situations may arise in which the certificate issued by a Certificate Authority (CA) may need to be revoked before the lifetime of the certificate expires. For example, the certificate is known to have been compromised.\\n\\nWhen an incoming Internet Key Exchange (IKE) session is initiated for a remote client or peer whose certificate is revoked, the revocation list configured for use by the VPN server is checked to see if the certificate is valid; if the certificate is revoked, IKE will fail and an IPsec security association will not be established for the remote endpoint.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GrHgK/pBnHrsn1Seh0qJujIqrWqRLPE0eaA+ZAqQMjo=\"},\"C-96041r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:X8wHzcaz0980HXxuy93EVyk4VDWyVtsDF0WbqVlaX/w=\"},\"F-102885r1_fix\",\"V-97203\",\"medium\",\"SRG-NET-000518-VPN-002280\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5127,\"SV-106341r1_rule\",\"medium\",null,null,\"The VPN Client logout function must be configured to terminate the session on/with the VPN Gateway.\",\"SRG-NET-000518-VPN-002280\",\"If a user cannot explicitly end a session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session.\\n\\nHowever, for some types of interactive sessions including, for example, remote login, information systems typically send logout messages as final messages prior to terminating sessions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+WzKvuFJw2Hd2tINf3CAdDXjeroLc9pIuZQ8rxqAqW8=\"},\"C-96043r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+tCpOllw27HEiCrQcnfBz1Mp9uGAIFb0WolLkLykCm4=\"},\"F-102887r1_fix\",\"V-97205\",\"medium\",\"SRG-NET-000519-VPN-002290\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5128,\"SV-106343r1_rule\",\"medium\",null,null,\"The VPN Client must display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.\",\"SRG-NET-000519-VPN-002290\",\"If a user cannot explicitly end a session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. Users need to be aware of whether or not the session has been terminated.\\n\\nLogout messages for access, for example, can be displayed after authenticated sessions have been terminated. However, for some types of interactive sessions including, for example, remote login, information systems typically send logout messages as final messages prior to terminating sessions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WFTjVjonYKh95+ufS3SeRtMzKzxvcuYhkuGqLkDzAdQ=\"},\"C-96045r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fy0MhQs22gOsjCy8Ui4Xr8MpXyFw2N5p7qTSc67sOzM=\"},\"F-102889r1_fix\",\"V-97207\",\"medium\",\"SRG-NET-000522-VPN-002320\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5129,\"SV-106345r1_rule\",\"medium\",null,null,\"For site-to-site VPN Gateway must store only cryptographic representations of Pre-shared Keys (PSKs).\",\"SRG-NET-000522-VPN-002320\",\"Pre-shared keys need to be protected at all times, and encryption is the standard method for protecting passwords. If PSKs are not encrypted, they can be plainly read and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\\n\\nPSKs used for site-to-site VPNs are considered by the SRG as a type of password. If this shared secret is already encrypted and not in plaintext, this meets this requirement. This requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption. This method uses a one-way hashing encryption algorithm with a salt value to validate a user's password without having to store the actual password. Performance and time required to access are factors that must be considered, and the one-way hash is the most feasible means of securing the password and providing an acceptable measure of password security.\\n\\nUse a keyed hash message authentication code (HMAC). HMAC calculates a message authentication code via a cryptographic hash function used in conjunction with an encryption key. The key must be protected as with any private key.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WvHtCxF8aHRpizWQnHhcRWZ2GSo4LpYF4C+7vAKUMGY=\"},\"C-96047r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lOGJxdtWr9FVthiaj/+UbIRNwkTQqM0TzcIWviq/0Jk=\"},\"F-102891r1_fix\",\"V-97209\",\"high\",\"SRG-NET-000525-VPN-002330\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5130,\"SV-106347r1_rule\",\"high\",null,null,\"The IPsec VPN must use Advanced Encryption Standard (AES) encryption for the IPsec proposal to protect the confidentiality of remote access sessions.\",\"SRG-NET-000525-VPN-002330\",\"Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nA block cipher mode is an algorithm that features the use of a symmetric key block cipher algorithm to provide an information service, such as confidentiality or authentication.\\n\\nAES is the FIPS-validated cipher block cryptographic algorithm approved for use in DoD. For an algorithm implementation to be listed on a FIPS 140-2 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. Currently, NIST has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hK46dRZBIlXNdxH/0rgMhBXqrBF8nwMTFp1UUvsZ2/w=\"},\"C-96049r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:f3H1Fnk3Mq9sTlW4p0spIywjLsmMT5ZgZN+1SV7bU2U=\"},\"F-102893r1_fix\",\"V-97211\",\"medium\",\"SRG-NET-000530-VPN-002340\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5131,\"SV-106349r1_rule\",\"medium\",null,null,\"The TLS VPN Gateway that supports Government-only services must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.\",\"SRG-NET-000530-VPN-002340\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nThis requirement applies to TLS gateways (also known as SSL gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Oyy/mFzHcQy1sAgTQ9gS+b99/s9IcmH4xTl+n0Pf6Rw=\"},\"C-96051r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tG7QZxAuAcqmA4gmuAeWEA9ZEnLVfGT5NFaUDibQfFE=\"},\"F-102895r1_fix\",\"V-97213\",\"medium\",\"SRG-NET-000540-VPN-002350\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5132,\"SV-106351r1_rule\",\"medium\",null,null,\"The TLS VPN Gateway that supports citizen- or business-facing network devices must prohibit client negotiation to SSL 2.0 or SSL 3.0.\",\"SRG-NET-000540-VPN-002350\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nThis requirement applies to public-facing or external-facing devices such as TLS gateways (also known as SSL gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance.\\n\\nThe minimum TLS version required by DoD is 1.2. However, devices and applications may allow client negotiation for systems supporting citizen- and business-facing applications. These devices may be configured to support TLS version 1.1 and 1.0 to enable interaction with citizens and businesses. These devices must not support SSL version 3.0 or earlier.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0WoWCtzpWtYJ2vxCT7vXvLruiskYzBOwEVdaxJWlGbM=\"},\"C-96053r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nHHSH5iwaGyboJNtWTygHWn0yTU3Rug61FYQH6Ni/Ek=\"},\"F-102897r1_fix\",\"V-97215\",\"medium\",\"SRG-NET-000550-VPN-002360\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5133,\"SV-106353r1_rule\",\"medium\",null,null,\"The VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.\",\"SRG-NET-000550-VPN-002360\",\"Without device-to-device authentication, communications with malicious devices may be established. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk.\\n\\nSNMPv3 supports authentication, authorization, access control, and privacy while previous versions of the protocol contained well-known security weaknesses, which were easily exploited. SNMPv3 can be configured for identification and bidirectional, cryptographically based authentication.\\n\\nA typical SNMP implementation includes three components: Managed device, SNMP agent, and NMS. The SNMP agent is the SNMP process that resides on the managed device and communicates with the network management system. The NMS is a combination of hardware and software that is used to monitor and administer a network. The SNMP data is stored in a highly-structured, hierarchical format known as a management information base (MIB). The SNMP manager collects information about network connectivity, activity, and events by polling managed devices.\\n\\nSNMPv3 defines a user-based security model (USM), and a view-based access control model (VACM). SNMPv3 USM provides data integrity, data origin authentication, message replay protection, and protection against disclosure of the message payload. SNMPv3 VACM provides access control to determine whether a specific type of access (read or write) to the management information is allowed. Implement both VACM and USM for full protection.\\n\\nSNMPv3 server services must not be configured on products whose primary purpose is not to provide SNMP services. SNMP client services may be configured on the VPN gateway, application, or operating system to allow limited monitoring or querying of the device from by an SNMP server for management purposes. SNMP of any version will not be used to make configuration changes to the device. SNMPv3 must be disabled by default and enabled only if used. SNMP v3 provides security feature enhancements to SNMP, including encryption and message authentication.\\n\\nCurrently, the AES cipher block algorithm can be used for both applying cryptographic protection (e.g., encryption) and removing or verifying the protection that was previously applied (e.g., decryption) in DoD. The use of FIPS-approved algorithms for both cryptographic mechanisms is required. If any version of SNMP is used for remote administration, default SNMP community strings such as “public” and “private” should be removed before real community strings are put into place. If the defaults are not removed, an attacker could retrieve real community strings from the device using the default string.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RFq+xtylI0rdth+CO8xXpnUCA7eBYGNXjStRxU/Sh2g=\"},\"C-96055r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:snkiXNFPpO0+kw0zQco5SKVgkORHDhyOH3PpUq4/k30=\"},\"F-102899r1_fix\",\"V-97217\",\"high\",\"SRG-NET-000565-VPN-002390\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5134,\"SV-106355r1_rule\",\"high\",null,null,\"The VPN Gateway must use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.\",\"SRG-NET-000565-VPN-002390\",\"Use of improperly configured or lower assurance equipment and solutions could compromise high-value information.\\n\\nThe National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by the National Institute of Standards and Technology (NIST) and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future Suite B implementations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p7UCHJrDUnFC2jp6mXGtSAilZeT3BjF1NVmG5ykWcy4=\"},\"C-96057r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KIex1ZGWMlFIxubnYXqgVjEDQ6/8SNR9c5AVbsZNKEA=\"},\"F-102901r1_fix\",\"V-97219\",\"high\",\"SRG-NET-000565-VPN-002400\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5135,\"SV-106357r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway Internet Key Exchange (IKE) must use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.\",\"SRG-NET-000565-VPN-002400\",\"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\\n\\nRFC 6379 Suite B Cryptographic Suites for IPsec defines four cryptographic user interface suites for deploying IPsec. Each suite provides choices for Encapsulating Security Payload (ESP) and IKE. The four suites are differentiated by the choice of IKE authentication and key exchange, cryptographic algorithm strengths, and whether ESP is to provide both confidentiality and integrity or integrity only. The suite names are based on the Advanced Encryption Standard (AES) mode and AES key length specified for ESP. Two suites are defined for transporting classified information up to SECRET level—one for both confidentiality and integrity and one for integrity only. There are also two suites defined for transporting classified information up to TOP SECRET level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F8wZynyPCZXbSCQKsDAa3RDhSkunUmMAhgYUP9Yu014=\"},\"C-96059r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sJ4ufacKRyx88U9iliMjZLvETY3nQgVUnTBTVlqZ1YA=\"},\"F-102903r1_fix\",\"V-97221\",\"medium\",\"SRG-NET-000580-VPN-002410\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5136,\"SV-106359r1_rule\",\"medium\",null,null,\"The VPN Gateway must validate certificates used for Transport Layer Security (TLS) functions by performing RFC 5280-compliant certification path validation.\",\"SRG-NET-000580-VPN-002410\",\"A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate.\\n\\nCertification path validation includes checks such as certificate issuer trust, time validity, and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WOsWkwp7rHKriDcEPQi1g0VQp3X0XA14Kw+soZYNvnw=\"},\"C-96061r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jLNfObMjTtI/+Xyh7vDwZR17rLmudLzlz6NwxhVITKs=\"},\"F-102905r1_fix\",\"V-97223\",\"medium\",\"SRG-NET-000585-VPN-002420\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5137,\"SV-106361r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).\",\"SRG-NET-000585-VPN-002420\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Use only SHA-2 for Digital signature generation applications and functions. SHA-2 is strongly preferred for use by DoD for non-signature generation functions.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\\n\\nFor digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use only if needed for business critical applications.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5JYnVzed7VNQLssmYLnmi+secKLvHnAiNpVnw5LnOy0=\"},\"C-96063r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0MUtJg0aE03Glc9kBOBNI3y2a6+ptn7NTc3Xse+sN6w=\"},\"F-102907r1_fix\",\"V-97225\",\"medium\",\"SRG-NET-000075-VPN-000260\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",5138,\"SV-106363r1_rule\",\"medium\",null,null,\"If the site-to-site VPN implementation uses L2TP, L2TPv3 sessions must be authenticated prior to transporting traffic.\",\"SRG-NET-000075-VPN-000260\",\"L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP tunnels can also carry IP packets that are very difficult to filter because of the additional encapsulation. Hence, it is imperative that L2TP sessions are authenticated prior to transporting traffic.\",\"10.0\"]\n{\"table\":\"review\",\"columns\":\"`assetId`,`autoResult`,`checkDigest`,`comment`,`detail`,`metadata`,`resultEngine`,`resultId`,`reviewId`,`ruleId`,`statusId`,`statusText`,`statusTs`,`statusUserId`,`ts`,`userId`,`version`\",\"rowCount\":14}\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"idk\",\"test\\nvisible to lvl1\",\"{\\\"testkey\\\": \\\"testvalue\\\"}\",null,3,1,\"SV-106179r1_rule\",1,null,\"2021-07-16 03:34:02\",1,\"2021-07-16 03:34:02\",1,\"SRG-NET-000019-VPN-000040\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:slm2UFIqnUUPyOpfIcsxSew4LGvsTesU9C6Ju5XJ3mw=\"},\"\",\"test\\nvisible to lvl1\\nhas history\",\"{}\",null,2,2,\"SV-106181r1_rule\",1,null,\"2022-02-03 00:07:07\",87,\"2022-02-03 00:07:05\",87,\"SRG-NET-000041-VPN-000110\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:jc6QW12gqdTKEPqvls4bilVyDJExcCoSskTVyO0VtC8=\"},\"test\\nvisible to lvl1\",\"test\\nvisible to lvl1\",\"{}\",null,4,3,\"SV-106183r1_rule\",1,null,\"2020-08-11 22:27:26\",1,\"2020-08-11 22:27:26\",1,\"SRG-NET-000042-VPN-000120\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:4cT/S3JRnRG1/bjkxCCl0FvJ2jFBPQxR6xd/ho3iPwU=\"},\"test\\nvisible to lvl1\",\"test\\nvisible to lvl1\",\"{}\",null,4,4,\"SV-106185r1_rule\",1,null,\"2020-08-11 22:28:27\",1,\"2020-08-11 22:28:27\",1,\"SRG-NET-000043-VPN-000130\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:IdemsTDQGwPd7bokQxIIvpGCFpuH2a0LMkx43UGqWUA=\"},\"test\\nvisible to lvl1\",\"test\\nvisible to lvl1\",\"{}\",null,4,5,\"SV-106187r1_rule\",1,null,\"2020-08-11 22:28:17\",1,\"2020-08-11 22:28:17\",1,\"SRG-NET-000049-VPN-000150\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:aVWTWelue2vPX4PPQhsVdenoG0JoZrePs1txZu8Tn9w=\"},null,\"test\\nvisible to lvl1\\nunbumitted\\n\",\"{}\",null,3,6,\"SV-106189r1_rule\",0,null,\"2020-08-11 22:28:42\",1,\"2020-08-11 22:28:42\",1,\"SRG-NET-000053-VPN-000170\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:vchgPhpapNXqH1070giShdvTrztio49eNJBWV74F3HU=\"},null,\"test\\nvisible to lvl2 and above\",\"{}\",null,3,7,\"SV-77809r3_rule\",0,null,\"2020-08-11 22:29:16\",1,\"2020-08-11 22:29:16\",1,\"WN10-00-000005\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:kaQFP+qv+/U0A5jz+BdWIpTTdtyktf1MP4WKqmlH3c4=\"},null,\"test\\nvisible to lvl2 and above\",\"{}\",null,3,8,\"SV-77811r1_rule\",1,null,\"2020-08-11 22:29:30\",1,\"2020-08-11 22:29:30\",1,\"WN10-CC-000310\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:LSSb1gLDf7uiXzn44Bg4EplFPsBwaprDmRrselWEvyE=\"},\"test\\nlvl2\",\"test\\nlvl2\",\"{}\",null,4,9,\"SV-77813r6_rule\",1,null,\"2020-08-18 20:48:29\",1,\"2020-08-18 20:48:29\",1,\"WN10-00-000010\"]\n[62,false,{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"\",\"test\\nvisible to lvl1\",\"{}\",null,2,10,\"SV-106179r1_rule\",1,null,\"2022-01-26 01:23:06\",87,\"2022-01-26 01:23:06\",87,\"SRG-NET-000019-VPN-000040\"]\n[62,false,{\"type\":\"Buffer\",\"data\":\"base64:slm2UFIqnUUPyOpfIcsxSew4LGvsTesU9C6Ju5XJ3mw=\"},null,\"test\\nvisible to lvl1\",\"{}\",null,2,11,\"SV-106181r1_rule\",1,null,\"2020-08-11 23:37:48\",1,\"2020-08-11 23:37:48\",1,\"SRG-NET-000041-VPN-000110\"]\n[62,false,{\"type\":\"Buffer\",\"data\":\"base64:jc6QW12gqdTKEPqvls4bilVyDJExcCoSskTVyO0VtC8=\"},null,\"test\\nvisible to lvl1\",\"{}\",null,4,12,\"SV-106183r1_rule\",0,null,\"2020-08-11 23:37:53\",1,\"2020-08-11 23:37:53\",1,\"SRG-NET-000042-VPN-000120\"]\n[153,false,{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},null,\"test\\nvisible to lvl1\",\"{}\",null,3,13,\"SV-106179r1_rule\",1,null,\"2020-08-18 02:22:56\",1,\"2020-08-18 02:22:56\",1,\"SRG-NET-000019-VPN-000040\"]\n[240,false,{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},null,\"test\\nno one but admin users should see this.\",\"{}\",null,3,14,\"SV-106179r1_rule\",0,null,\"2020-08-18 02:22:23\",1,\"2020-08-18 02:22:23\",1,\"SRG-NET-000019-VPN-000040\"]\n{\"table\":\"review_history\",\"columns\":\"`autoResult`,`comment`,`detail`,`historyId`,`resultEngine`,`resultId`,`reviewId`,`ruleId`,`statusId`,`statusText`,`statusTs`,`statusUserId`,`touchTs`,`ts`,`userId`\",\"rowCount\":5}\n[false,null,\"test\\nvisible to lvl1\",360,null,3,1,\"SV-106179r1_rule\",1,null,\"2020-08-11 23:37:45\",1,\"2020-08-11 23:37:45\",\"2020-08-11 23:37:45\",1]\n[false,null,\"test\\nvisible to lvl1\",361,null,3,1,\"SV-106179r1_rule\",0,null,\"2020-08-11 23:37:45\",87,\"2020-08-11 23:37:45\",\"2020-08-11 23:37:45\",1]\n[false,null,\"test\\nvisible to lvl1\",362,null,2,2,\"SV-106181r1_rule\",1,null,\"2020-08-11 22:26:50\",1,\"2020-08-11 22:26:50\",\"2020-08-11 22:26:50\",1]\n[false,null,\"test\\nvisible to lvl1\",363,null,2,2,\"SV-106181r1_rule\",0,null,\"2020-08-11 22:26:50\",87,\"2020-08-11 22:26:50\",\"2020-08-11 22:26:50\",1]\n[false,\"\",\"test\\nvisible to lvl1\\nhas history\",364,null,2,2,\"SV-106181r1_rule\",0,null,\"2022-02-03 00:07:05\",87,\"2022-02-03 00:07:05\",\"2022-02-03 00:07:05\",87]\n{\"table\":\"revision\",\"columns\":\"`active`,`benchmarkDate`,`benchmarkDateSql`,`benchmarkId`,`checkCount`,`description`,`fixCount`,`groupCount`,`highCount`,`lowCount`,`marking`,`mediumCount`,`release`,`revId`,`status`,`statusDate`,`version`\",\"rowCount\":6}\n[1,\"31 Mar 2020\",\"2020-03-31\",\"RHEL_7_STIG_TEST\",247,\"This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.\",247,247,29,14,null,201,\"0.3\",\"RHEL_7_STIG_TEST-3-0.3\",\"draft\",\"2020-03-27\",3]\n[1,\"19 Jul 2001\",\"2001-07-19\",\"VPN_SRG_OTHER\",2,\"This description replaces the old description\",2,2,0,0,null,2,\"2\",\"VPN_SRG_OTHER-2-2\",\"accepted\",\"2001-07-26\",2]\n[1,\"19 Jul 2001\",\"2001-07-19\",\"VPN_SRG_Rule-fingerprint-match-test\",3,\"This description replaces the old description\",3,3,0,0,null,3,\"2\",\"VPN_SRG_Rule-fingerprint-match-test-2-2\",\"accepted\",\"2001-07-26\",2]\n[1,\"19 Jul 2010\",\"2010-07-19\",\"VPN_SRG_TEST\",81,\"This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",81,81,11,7,null,63,\"0\",\"VPN_SRG_TEST-1-0\",\"accepted\",\"2010-07-26\",1]\n[1,\"19 Jul 2019\",\"2019-07-19\",\"VPN_SRG_TEST\",81,\"This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",81,81,11,7,null,63,\"1\",\"VPN_SRG_TEST-1-1\",\"accepted\",\"2019-07-26\",1]\n[1,\"17 Jun 2020\",\"2020-06-17\",\"Windows_10_STIG_TEST\",287,\"The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",287,287,26,18,null,243,\"23\",\"Windows_10_STIG_TEST-1-23\",\"accepted\",\"2020-06-15\",1]\n{\"table\":\"rule_version_check_digest\",\"columns\":\"`checkDigest`,`ruleId`,`version`\",\"rowCount\":619}\n[{\"type\":\"Buffer\",\"data\":\"base64:nkk6VkjluuUxkzsszOk8eTgHlUakS2R/bR95QTwbAM8=\"},\"SV-204392r241939_rule\",\"RHEL-07-010010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:iSqVW4RiHyBVvrAYsGNx9SrOT+nAF6gnNHhGSMv/OPg=\"},\"SV-214799r241939_rule\",\"RHEL-07-010020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:t3pLu4RByPjTmSyEGSrDsv2WpOjBnMxFcux4WTKpzsg=\"},\"SV-204393r241939_rule\",\"RHEL-07-010030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b7cLLXAJwWiYlb+ZLVM/YmYEKrJOElbc2DI7KzdElaY=\"},\"SV-204394r241939_rule\",\"RHEL-07-010040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9ShQfZRP37ZylVTOj7a7tmzPRP/DZmVauIWv5cK5IgU=\"},\"SV-204395r241939_rule\",\"RHEL-07-010050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Eg7oETP6JdEiW9fWb3CWsCNr1Ee+e9COo/1vPyjLJyA=\"},\"SV-204396r241939_rule\",\"RHEL-07-010060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v8r3y4wndT3MrdoqZ+IXfrOkoGx9bEvFFDEL4eMv6bI=\"},\"SV-204397r241939_rule\",\"RHEL-07-010061\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:M7pACkppJDi/CsMl2CmLoXQL4s2zAFRVxqwbrcNQ3+k=\"},\"SV-214937r241939_rule\",\"RHEL-07-010062\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4Vhryn3qYojwlbzNOTBxhlYOCH+6lGP9nQktKh5cvso=\"},\"SV-204398r241939_rule\",\"RHEL-07-010070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9A9hqWAZ5NS1n2W3Z6epeuVuWBbbbPCEc/zuKz7IiSM=\"},\"SV-204399r241939_rule\",\"RHEL-07-010081\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1r/d1v914jFv+PeIiRAnO8w+OdA0cucmU9N4uS9npIU=\"},\"SV-204400r241939_rule\",\"RHEL-07-010082\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BdYvtV85bZiRNU3aVsf9P0v0mUKO7gFFdyTulpf63UA=\"},\"SV-204401r241939_rule\",\"RHEL-07-010090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SJj4kDOYlogEinGYl4UBtzYvD0sUOtC0Zc+GkbM/nQg=\"},\"SV-204402r241939_rule\",\"RHEL-07-010100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wLqPaWBvxUmRKRMMSiJj2pj0F8NCk7mvWKECb9jxRgw=\"},\"SV-204403r241939_rule\",\"RHEL-07-010101\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:orUMwfifYhVDl5eCyl7LEBXY8R0QtYf4FB3AikYOR0Q=\"},\"SV-204404r241939_rule\",\"RHEL-07-010110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:87KK1t2KJmsVqwDVxcvH3F6erHGSjt6gU3lODHDY4FI=\"},\"SV-204405r241939_rule\",\"RHEL-07-010118\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NVVlZz6DnbTO6YEa+HkLTRE6ApJBkX8N7oXza495krA=\"},\"SV-204406r241939_rule\",\"RHEL-07-010119\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZZsZT55sjZiOw8YvdeG/PuTRrOJNXQ9fXpNFx1alZS0=\"},\"SV-204407r241939_rule\",\"RHEL-07-010120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5mP42vXD7dbHMk2adGpM5o78xd9tfHYGp4AY1olXPug=\"},\"SV-204408r241939_rule\",\"RHEL-07-010130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+ZxB96680QpTXOUhL+JNnhQFv/FKeRTfkrvRL3PV5S8=\"},\"SV-204409r241939_rule\",\"RHEL-07-010140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:abrw002NXrRQ66PzmbZYPT3hHRpQytzeYoaeJHhVEhU=\"},\"SV-204410r241939_rule\",\"RHEL-07-010150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CKBfpvZELPLxUExAGYDADab38Se08BtvG5UpBNIazBI=\"},\"SV-204411r241939_rule\",\"RHEL-07-010160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wHEY2x4CvlXeh/wo8XesGOqxBrsYGWbUXOPbniv8Eec=\"},\"SV-204412r241939_rule\",\"RHEL-07-010170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:50yiX31ofIr+hd8aTkGds0o0cG1XWzi9CajHGO80y9s=\"},\"SV-204413r241939_rule\",\"RHEL-07-010180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:B5/JCBM3+y8mI0Wx//3vcvLxaBJUTuafPhnRMesP9F4=\"},\"SV-204414r241939_rule\",\"RHEL-07-010190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:EWkE5ArbnCtRXt1tYfKaQZxY82bf5+ySftE5x3A7rUw=\"},\"SV-204415r241939_rule\",\"RHEL-07-010200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:szDJRfipxjLUpU4siSaUz52MOYPESOCSPqgSYGrG8h8=\"},\"SV-204416r241939_rule\",\"RHEL-07-010210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:37jX9s+legYelkYfnf62nyYfMX4Svx6S53TO09s9e7U=\"},\"SV-204417r241939_rule\",\"RHEL-07-010220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+bzaAS/aDWQDJP8ZUOuMk/ISS9nWHhkC1peC0GEcbKo=\"},\"SV-204418r241939_rule\",\"RHEL-07-010230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MrAAW3p9KHUSNIIDH94flLWi6pGLzydp9PgU+RlvGC4=\"},\"SV-204419r241939_rule\",\"RHEL-07-010240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aD2m4e2s0uh65x94BQAdZnXh7LZzUYWOg1jlF0xaYe4=\"},\"SV-204420r241939_rule\",\"RHEL-07-010250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Xq5u0Pw/Zw4wuAxFngAnRjHsza6G0aVM5vVkmV9EUkw=\"},\"SV-204421r241939_rule\",\"RHEL-07-010260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N2xDTbhTE+RFh0/Sm++3xu/AV9xHzSY7hXbPJaaNeEk=\"},\"SV-204422r241939_rule\",\"RHEL-07-010270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wnEfB+iBnuzOMM868Vy5hLj72C0iU0CFAkGqCn3lcV8=\"},\"SV-204423r241939_rule\",\"RHEL-07-010280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dxEV5bGuHZP4iVsWXTtnKnb7HW9YuqytYqEfO4SaQlk=\"},\"SV-204424r241939_rule\",\"RHEL-07-010290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fGovMAyL0HmlG0cv8i7GIrnPdYDI2Uu2j1CXqheXU6U=\"},\"SV-204425r241939_rule\",\"RHEL-07-010300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HWvW+5i4DGfbBRQ5ePFMe8hnoLMZwFwyu8jP8qD13B4=\"},\"SV-204426r241939_rule\",\"RHEL-07-010310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:H9mT1qdHOp9+ZyEy2fFxjTE/8tI1xhFtEvJORCJqd1k=\"},\"SV-204427r241939_rule\",\"RHEL-07-010320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oD6nmwpiJW9D5Cp/XXFX9UYRA755KWJpjrae9YSJLcA=\"},\"SV-204428r241939_rule\",\"RHEL-07-010330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GEhzlPPnk+CAcWnOXaLRDP95b6T65/xq1qVqL/b84vw=\"},\"SV-204429r241939_rule\",\"RHEL-07-010340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SxSLBVVTtBtxKalJaRaw/6lgbVU0UOBOkgcTTRhHxD8=\"},\"SV-204430r241939_rule\",\"RHEL-07-010350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+hZzZLys3BX7zWBUfBAVBQPgw6OXD+II7GH5BWOLMCI=\"},\"SV-204431r241939_rule\",\"RHEL-07-010430\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wXo7iqYH5XGZTi7xVyPo9OMFKHuQ4XH2hIqOWqKo2ig=\"},\"SV-204432r241939_rule\",\"RHEL-07-010440\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9DWDKCqiCDCdPaBAR1JnUJ2FgBKkNaNW7tQqAq+dw08=\"},\"SV-204433r241939_rule\",\"RHEL-07-010450\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rBMTU13BrvFeKQ+LVw9CSDaXjsTTmFaQjUCP5WUmK4E=\"},\"SV-204434r241939_rule\",\"RHEL-07-010460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/uoCfeW8Df/g/XGQoBkg5WVbTAykMMBn4oMkJdNUEyA=\"},\"SV-204435r241939_rule\",\"RHEL-07-010470\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PVRLHuZ9kP5FJwKwYPDiChFJ5ZxZtcp0ro/wCh+st1A=\"},\"SV-204436r241939_rule\",\"RHEL-07-010480\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:y7xDq5NT2XNGrsamdbkoYKBvisZGFnS1fyg5AKvdfUQ=\"},\"SV-204437r241939_rule\",\"RHEL-07-010481\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tSZDrM1hWlCATKGgxqXsqEoIbIpJlq97X+0R6excyuQ=\"},\"SV-204438r241939_rule\",\"RHEL-07-010482\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N8tSABUcJlBAkZ3vrmMcMUQscjNj485lQceECmBpBqY=\"},\"SV-204439r241939_rule\",\"RHEL-07-010490\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3DS5zKmPA1/pZTvKSZLzlkwx6ZjRlk5GytGTDgvav+s=\"},\"SV-204440r241939_rule\",\"RHEL-07-010491\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JTVgaY1LZdMLglvZK8C9tixEgj79wwesQdbeHi7a7Rk=\"},\"SV-204441r241939_rule\",\"RHEL-07-010500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mkc5HGb9gHNlg2WnY/djvfYdh8TcEe1wjVMoosFw32o=\"},\"SV-204442r241939_rule\",\"RHEL-07-020000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:L6nJ9zxJTEu9H+NPMBNKXjZF11fxVnKsHJ0WDDygoYg=\"},\"SV-204443r241939_rule\",\"RHEL-07-020010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pp7LtbhvevdAe+ue4EVnM1uccxy7pW3XZ+xC9xFfmNk=\"},\"SV-214800r241939_rule\",\"RHEL-07-020019\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sfB3iHYcODrsGQIdQzi9S4OiWXlzCjwowCqvtusaGKY=\"},\"SV-204444r241939_rule\",\"RHEL-07-020020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:toAqPFxuUxre2EEjoCzKlhcSnOb9RFpEln3MtuVIT9Q=\"},\"SV-204445r241939_rule\",\"RHEL-07-020030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NzJUcxxFJi8pit5evzZxnwQLQXWBf4/ftLMFNB6yiGw=\"},\"SV-204446r241939_rule\",\"RHEL-07-020040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i6TlhYJkq+XnxoK0jdYhyvmrG0/kVGWgegQHFyIbH8Y=\"},\"SV-204447r241939_rule\",\"RHEL-07-020050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SKIqa4iromN1/ld/zYxiQSOEbtGDJiFaQ30mjK6UgUY=\"},\"SV-204448r241939_rule\",\"RHEL-07-020060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/bMIprnmuyHCZfwMhN53JacAU9Bw8vUNAz6FpcIsWeU=\"},\"SV-204449r241939_rule\",\"RHEL-07-020100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7C8lXVeU00V8ySil2p6/I+nVauuGAbjK42d5ow1J2Y4=\"},\"SV-204450r241939_rule\",\"RHEL-07-020101\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fvHgDUJGBMB+FLi/4z9egnoRgc5XNsyChWvVL+OV66I=\"},\"SV-204451r241939_rule\",\"RHEL-07-020110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ECU3PcokYJ0iTOaeFC4vceGeElsR/zrQCO1UeE3DreQ=\"},\"SV-204452r241939_rule\",\"RHEL-07-020200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mc80MJb4r7Qc8AmVFz9tOOJczWkzT3PVQISn5ZtRXSE=\"},\"SV-204453r241939_rule\",\"RHEL-07-020210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qFfBME/2o77yTMuxtpA4P0I8o2NQnfoVfThRiWzo6Lk=\"},\"SV-204454r241939_rule\",\"RHEL-07-020220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F70pc4lFutrB1aZSKBDOLu0diT12WqlYfaQrxFvOlBg=\"},\"SV-204455r241939_rule\",\"RHEL-07-020230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:brL/cUNHx6LqwmVc7ML2OUn/P9TF3UTZ+dZ6dn6tjNY=\"},\"SV-204456r241939_rule\",\"RHEL-07-020231\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:41T5JYxmVoKU+kVdsnjUa+6f5+dfkDIeSb6GFuUm5Dw=\"},\"SV-204457r241939_rule\",\"RHEL-07-020240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BKBVXasUfiVr7ygcFP+LUlFT+KaO5mryWRKA5v63Lzg=\"},\"SV-204458r241939_rule\",\"RHEL-07-020250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gzK9MUt7PjwGBJ/p/j6hcmkkkGmVE6qTD/BqPIvnN/E=\"},\"SV-204459r241939_rule\",\"RHEL-07-020260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BIJOSScjxtLqA/SKv6NkIB3IGMa3Q+LPB+L/geOe7ok=\"},\"SV-204460r241939_rule\",\"RHEL-07-020270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Xk8zYUvsnzovMiPLfQR6KgfXOkgeBn2KDtxaaMW0pGs=\"},\"SV-204461r241939_rule\",\"RHEL-07-020300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mmPdRsWMT1RXStEFvhbFi2NPQhPau7t1mLPRqSfrlso=\"},\"SV-204462r241939_rule\",\"RHEL-07-020310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MCpiixKAw6iysD7QdBwvf/0nHCrKyrAMLWQ4JNX0Bl4=\"},\"SV-204463r241939_rule\",\"RHEL-07-020320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PkSBdKqiF+1CoNw6WAjSOHw0QMu48lpgS7hmAFLNKw8=\"},\"SV-204464r241939_rule\",\"RHEL-07-020330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DgsJDDQVqbrezHTaPjQzaqTduH3lEoKAMNNMCRj803k=\"},\"SV-204465r241939_rule\",\"RHEL-07-020600\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nJKpEfqumuAlnJnurMfT8V8fSO3ydCuFSVHs1UY9GPo=\"},\"SV-204466r241939_rule\",\"RHEL-07-020610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KjHexj1LNSBP7CHmbNY3vvDc8KQeFRj4apAjjK7uRz8=\"},\"SV-204467r241939_rule\",\"RHEL-07-020620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IUowyh9fpAWNacEDCWcoW0ywTTeAFy1QJWtS37N3CvU=\"},\"SV-204468r241939_rule\",\"RHEL-07-020630\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RVZyk6n7GgpVN69UGZjh42yXz3qHC+E11xMgNQqKqeA=\"},\"SV-204469r241939_rule\",\"RHEL-07-020640\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4jt4mkKBzSe4CWKOCChBtcLEVdWyrxsrtYUDQqOWPb4=\"},\"SV-204470r241939_rule\",\"RHEL-07-020650\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AK8GPupR9o9w4Bpqm2vkAfSZfDDOTxHxIQYgJ4RNCtU=\"},\"SV-204471r241939_rule\",\"RHEL-07-020660\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CUecwNXz6GFSUPJZXW1ugeOxM+oEICWaiuiBIttVcmE=\"},\"SV-204472r241939_rule\",\"RHEL-07-020670\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v1B+Day0uLquC3G3rkAZLvKRlB/UsiRznWww8MhD2Ns=\"},\"SV-204473r241939_rule\",\"RHEL-07-020680\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uxK1tQMsGtXuIVRNHQgns3AeLuOfO8jy94kjoPQ2L+g=\"},\"SV-204474r241939_rule\",\"RHEL-07-020690\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uxK1tQMsGtXuIVRNHQgns3AeLuOfO8jy94kjoPQ2L+g=\"},\"SV-204475r241939_rule\",\"RHEL-07-020700\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vX6dN7EfNthdimlLaFh0Q9z6OmJUHbzovDHwg8c8NHU=\"},\"SV-204476r241939_rule\",\"RHEL-07-020710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nMN0kK1ic7h1eLInaM6SrG+c+t8cGPkmMerp3/LQra8=\"},\"SV-204477r241939_rule\",\"RHEL-07-020720\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Jjjq7xVAWflOe4CoFgZpUiv9Y1NWKcp73tzANZZz+gw=\"},\"SV-204478r241939_rule\",\"RHEL-07-020730\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:X06vDs2tR3QGoQ+xoPHCwRpZHEYU9e6HRZHfgAas1TE=\"},\"SV-204479r241939_rule\",\"RHEL-07-020900\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rTAfVwmsa16lr6s7L1HVMt53f8c4APqViMHCPG3PQ0c=\"},\"SV-204480r241939_rule\",\"RHEL-07-021000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oNIXrV8IrUz3LBKHcpc5OkB5AAV30a49EWBJw8tFGRI=\"},\"SV-204481r241939_rule\",\"RHEL-07-021010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:u7P2t9CBo4bVxiR7YZbGpIUx/LFmWm/tqN+oNRgHAME=\"},\"SV-204482r241939_rule\",\"RHEL-07-021020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bNGETuyi+t5ZcClrjc42GS9cWGj/6HLIX7UykCKyI9I=\"},\"SV-204483r241939_rule\",\"RHEL-07-021021\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+rITfa9uPWXKr2BTckVmwYe0uqE2Xqu4VJaGlyUb/tU=\"},\"SV-204484r241939_rule\",\"RHEL-07-021022\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c76gZ1SY4u9l79FnrsQHACwNc4CL62N+zPqo7zmpzkA=\"},\"SV-204485r241939_rule\",\"RHEL-07-021023\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+Cd2E8o4ONaUdrAAVpMr0bFQJFkRt9EDcw+xhFpcySU=\"},\"SV-204486r241939_rule\",\"RHEL-07-021024\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:68kXW4hDQ+wT9SdXi8wMj/sov4EvnCOjABVhUZDBnBo=\"},\"SV-204487r241939_rule\",\"RHEL-07-021030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1XgmUIRB6alinIiV63h8l4a4c+FpBsGbCgpB3sm/gQ4=\"},\"SV-204488r241939_rule\",\"RHEL-07-021040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MnVJuhcg4+npgMSzOK+ZI3jYbv9R79L3Pw0sG4OGjuY=\"},\"SV-204489r241939_rule\",\"RHEL-07-021100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hAE8/s/q+2bPxB0JEqCor5YiRwtPpCKQTpKO19s+CsE=\"},\"SV-204490r241939_rule\",\"RHEL-07-021110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2dsipNSSkkuhCPSuvfUEnxPPKLhEefb0wQ5pWOxGi1s=\"},\"SV-204491r241939_rule\",\"RHEL-07-021120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ouKxFOOPpBEfihfWTLMVhsHI14OUZyPa8UIIzq+9aDM=\"},\"SV-204492r241939_rule\",\"RHEL-07-021300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7PN7qrWKJmcvXiHYyWoVhaf0vMJwkBzlYvMLMqakubE=\"},\"SV-204493r241939_rule\",\"RHEL-07-021310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1cCc49bcm+M75v2YFAybr7leYSlE+gJkFfU7F/sl09M=\"},\"SV-204494r241939_rule\",\"RHEL-07-021320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XJvN48pmi8HAcsDkJM/G14Kd6I6pzdqyNmh7aTUWPog=\"},\"SV-204495r241939_rule\",\"RHEL-07-021330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:18y0TK+OVu1ckq6VVHACpujYOUOuHE9k0lnFU7vZePY=\"},\"SV-204496r241939_rule\",\"RHEL-07-021340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Eqvpa3O8L/43+F/dfd3RCBJOqej2+xWuUq9l9HGqyf8=\"},\"SV-204497r241939_rule\",\"RHEL-07-021350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gqquU+6877zdN2QBJVLYBJLAgY9YaeAMGXWhfOMdJDc=\"},\"SV-204498r241939_rule\",\"RHEL-07-021600\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BuBYuHuQAvXuOxcqP3DStX9B4QilMV8GArQJSwKL4qk=\"},\"SV-204499r241939_rule\",\"RHEL-07-021610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nqqG2GW71CBVy4Zbpx5pP8sJyDtQRHFZG9xO9W+fhaY=\"},\"SV-204500r241939_rule\",\"RHEL-07-021620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:APlAz7ZItAMZCPrk0PRupBAoTrM5Bx3+9xNBo4579+0=\"},\"SV-204501r241939_rule\",\"RHEL-07-021700\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cp2RMg6QxCqTvmqP37SKwG1FqsgipFxqR3t5FU4PXLk=\"},\"SV-204502r241939_rule\",\"RHEL-07-021710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Z7b6Mm6lUqwXG2sdLSsdV3B3gZr1qR0O9kZkWEmbxrM=\"},\"SV-204503r241939_rule\",\"RHEL-07-030000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qglSyMZMvG/rrLNnILUfVZ3YuFZFi5T6+KZGiWAdQ/A=\"},\"SV-204504r241939_rule\",\"RHEL-07-030010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GlCYNKZ4IKbMHrBwdJyaGeNDUtXvok0O5JQhengD9bI=\"},\"SV-204505r241939_rule\",\"RHEL-07-030200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BqnXskmzv0Fml5dUryA9empCvoF4uJVgP7gSzNJBG5Q=\"},\"SV-204506r241939_rule\",\"RHEL-07-030201\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:l+C+NK9AgsqOtIckjdTH4jH0PdnaS4ciKjpNRfQiUbQ=\"},\"SV-204507r241939_rule\",\"RHEL-07-030210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hcASCCaQ6DCZhsOVgtG2fCLYh13EpBUcl5ehg9PF3Js=\"},\"SV-204508r241939_rule\",\"RHEL-07-030211\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XkQ6DCdOAKS0GwAwhQplZEj8R1FV2bl5hQua4nPED4k=\"},\"SV-204509r241939_rule\",\"RHEL-07-030300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Bf2fWApv0APcqeZ5XF4R3RXo/goqg4pCstdRuIGQtss=\"},\"SV-204510r241939_rule\",\"RHEL-07-030310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:M4dQIiEBGtvfjwdGLgcnbZPAohqROn1I34DQD4YRp64=\"},\"SV-204511r241939_rule\",\"RHEL-07-030320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3wu6Xlq+C0xzTcZhVKXS6/ol6uXxhMPvS8I8O+1XaqI=\"},\"SV-204512r241939_rule\",\"RHEL-07-030321\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aflWrGGmEaadkYGyiV9fTBb/AxbzyQb2JEc+iSI+NkM=\"},\"SV-204513r241939_rule\",\"RHEL-07-030330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ltVAshO8pttoqEyqG6qijiNJqOl2Qg26et8YkE7jF5s=\"},\"SV-204514r241939_rule\",\"RHEL-07-030340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Uw4E5/qhIYn2a7XqoO/vCVOGSvxQjO5QMCJ7MHUh3po=\"},\"SV-204515r241939_rule\",\"RHEL-07-030350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pb9zyKyDrGizMm2SQJsP9iE6S0NT/TD/ykIFMramKTU=\"},\"SV-204516r241939_rule\",\"RHEL-07-030360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tfgd6xmJ2tetubGheG+rBYQusickUOomvWf+fpjbT7Q=\"},\"SV-204517r241939_rule\",\"RHEL-07-030370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IRTfp4gJecK//m5Q762/0oGsBdPOyjw0rySHurIS8LE=\"},\"SV-204518r241939_rule\",\"RHEL-07-030380\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c3BG+SR2o14aicE+yhq3PtQvfjs3cmTzFbE8tHrvpUA=\"},\"SV-204519r241939_rule\",\"RHEL-07-030390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2XtliP/rksJDS7Xvfpls8GPXpBFZoWsdnTomfRmL9QU=\"},\"SV-204520r241939_rule\",\"RHEL-07-030400\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NQ4XbflQ44GaE3zsieP8DlRi/3mPxweIdroLWHOE4Pg=\"},\"SV-204521r241939_rule\",\"RHEL-07-030410\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ct96QUF8s7jdqE0Ojh304JzeK8kmZYLbQaQReE84rXs=\"},\"SV-204522r241939_rule\",\"RHEL-07-030420\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rDncDz9FOlJO5zuVTZJbynkJ6dX2Vmq6oI6860tKW3g=\"},\"SV-204523r241939_rule\",\"RHEL-07-030430\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8tsf1iL2uCKUxO1hoNkCKyC3IFWiTzlQVJpKPEwK0QI=\"},\"SV-204524r241939_rule\",\"RHEL-07-030440\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SvFkHfPrdOQKr5ne1xqIFighaKbfQ/sihawpHb7p7rA=\"},\"SV-204525r241939_rule\",\"RHEL-07-030450\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xCC65vU4a0dx3uNjyFYVXGG1SRtdEiyjqGvJjghYeow=\"},\"SV-204526r241939_rule\",\"RHEL-07-030460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kE1xvX7cLhAoPe9cvYdrUdLUAfjE7eLXYem3Gw8DNLs=\"},\"SV-204527r241939_rule\",\"RHEL-07-030470\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vnSamAe2+/Hr+nfPkTqL9I0bWVmWTIFQpYfsqnVG9F8=\"},\"SV-204528r241939_rule\",\"RHEL-07-030480\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qHpyKM8i0QhH/xmWGRB3HGZ+olnqtUnASbAZecaifiM=\"},\"SV-204529r241939_rule\",\"RHEL-07-030490\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9kmHZoiuoiL6AsWMWz23RZbKzak8ErxyC7YO6g8muqE=\"},\"SV-204530r241939_rule\",\"RHEL-07-030500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QLmTItOwmEnfzdlxDbgeaEgT0GU0Nbb70w5rFh7+ClA=\"},\"SV-204531r241939_rule\",\"RHEL-07-030510\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/PZC/00fiKOLVTTaP7vTKSayzSFdhYJTeG7hNLk4+gE=\"},\"SV-204532r241939_rule\",\"RHEL-07-030520\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jhuvdlST3755aQuU9dw8itd/oBXZUB3VR1y2ygyl5FI=\"},\"SV-204533r241939_rule\",\"RHEL-07-030530\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tA45OvJ+kaPqzTLBG3AsIdZ+y1Fsg6ea5iZ7tEfE1dQ=\"},\"SV-204534r241939_rule\",\"RHEL-07-030540\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aAoxDRfMkHNrqAeotAp74gpKHv9wOXogrgjeQ7eJGQA=\"},\"SV-204535r241939_rule\",\"RHEL-07-030550\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yz9ySMXJdb86u8eDi3onAaj+kp672EFyUXztQ5ZavCQ=\"},\"SV-204536r241939_rule\",\"RHEL-07-030560\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:H82QTLuiCWDcZMXUpQQdTEKNJvGkX6x49d2pDZHpYyU=\"},\"SV-204537r241939_rule\",\"RHEL-07-030570\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ERmkPloadjyA5EWZSqAGmmsmSh9yhFCpxtM/g7u2MVY=\"},\"SV-204538r241939_rule\",\"RHEL-07-030580\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yWWSgcAdr7toWF3W2KVSsJEAivLZ/eCE17DkDnuxdnU=\"},\"SV-204539r241939_rule\",\"RHEL-07-030590\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YXNsFsD1BNTH+UuPUScRJc2/DURz1Fj+3uIcvrRMNdg=\"},\"SV-204540r241939_rule\",\"RHEL-07-030610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lJjp0a4I1yjr202W8rakaUjmlWknnhRtwWTbPOgaIB8=\"},\"SV-204541r241939_rule\",\"RHEL-07-030620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2qmfNcP9ypf8f5/1I1ZWKnvrnO4JwwU1bWjsI78D6KE=\"},\"SV-204542r241939_rule\",\"RHEL-07-030630\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gya/2JPlteqFjlFszdxnLFZfGW3EV7vQah2z8gDWTmo=\"},\"SV-204543r241939_rule\",\"RHEL-07-030640\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gi8ZMeceL+SSmRb14wgW06ZvRE7tuolGOXprwyUf+k0=\"},\"SV-204544r241939_rule\",\"RHEL-07-030650\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9sL5nx6+vlT67EKHKU4R5qqJ5n3moOZWw1AikH8pTXk=\"},\"SV-204545r241939_rule\",\"RHEL-07-030660\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gqtgtLcu9IdW8tgI/Z/PEk9biRBlGBOHv5LMDpPdpL4=\"},\"SV-204546r241939_rule\",\"RHEL-07-030670\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Yez5vz3QxFhKWn3gCF8yxjW5wBeRRzXNuSoPn6GIO0s=\"},\"SV-204547r241939_rule\",\"RHEL-07-030680\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hC1vcQxqT0u80KTFQPLu/SIk7krmukM+EtUTAUW4Q4A=\"},\"SV-204548r241939_rule\",\"RHEL-07-030690\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sTsM/uo7uY/03QywYVZf+XXWwPePPwd6hv1n+aUTiXo=\"},\"SV-204549r241939_rule\",\"RHEL-07-030700\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tU3v9z4QSrPw6soKYZKEo2o/9C6DfQXE4mmzVlVGsw8=\"},\"SV-204550r241939_rule\",\"RHEL-07-030710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:C0RoeHp6aYd9h/bi32FTCOUFtJwNd9lElDmsQIq+wF4=\"},\"SV-204551r241939_rule\",\"RHEL-07-030720\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pafqBQ37fC9z4g2ywAqLpjl+XAFqcgxwjjyxs/Verx4=\"},\"SV-204552r241939_rule\",\"RHEL-07-030740\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:caNUlUAL0QTWs82AAVnnqegh0qk/ScQg+zi9M6mXN3Q=\"},\"SV-204553r241939_rule\",\"RHEL-07-030750\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FS0w5y0Nv2J8GgXgjl0+kwNnGa1SOyKNV0kAzuc0Lhc=\"},\"SV-204554r241939_rule\",\"RHEL-07-030760\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dqcxu/FPpiMQY4drQDT3SVl/Op48vP4lYINaQ/7qycE=\"},\"SV-204555r241939_rule\",\"RHEL-07-030770\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mDysNGysefS+eTvNiUFriD9n8ubTJ8X27LObMHof9qM=\"},\"SV-204556r241939_rule\",\"RHEL-07-030780\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rEz96y1do/MI6pN7zRcF7HR19einFw1A4ikBHs19nzQ=\"},\"SV-204557r241939_rule\",\"RHEL-07-030800\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ady1u6dO6xtC3UnQhdVbuDv992JbS9UEl9bHXFlDfeU=\"},\"SV-204558r241939_rule\",\"RHEL-07-030810\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ktrDKQOFniBjtBla/5sCoFWD4QpBziBp6d3yNj4wSxc=\"},\"SV-204559r241939_rule\",\"RHEL-07-030819\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FKYTZs9Omb9gpZvDDN+VFtmbOEANwAA79jfnk0fdo+4=\"},\"SV-204560r241939_rule\",\"RHEL-07-030820\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DJ473QpyrOIOL4YWEvv/UhC/pdcGoEXF+NICnIw8kXE=\"},\"SV-204561r241939_rule\",\"RHEL-07-030821\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yaISAkFMNlE1gd40ss3E4raZaPutmNF5nUPZxy/dVxE=\"},\"SV-204562r241939_rule\",\"RHEL-07-030830\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oBDs5Z67EFgAVh+xQ4UWmvl8l68JaD3MlIWHxZV7Ivg=\"},\"SV-204563r241939_rule\",\"RHEL-07-030840\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yo+7DvmHZV8hyRCSWad1ZfWbs115vSFezvQEM11an2w=\"},\"SV-204564r241939_rule\",\"RHEL-07-030870\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XCeo82R8xQFLoiWbWwslLhkjyDvBriCPlnTPaVCU0O0=\"},\"SV-204565r241939_rule\",\"RHEL-07-030871\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mregkcdfFGH6lVk6ARZub4pIX77ZBmx54DG508a9aww=\"},\"SV-204566r241939_rule\",\"RHEL-07-030872\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lXRvTRQWN34A1q+mXN0yVv2AZrR0vT3Ts/aM1h5LkOo=\"},\"SV-204567r241939_rule\",\"RHEL-07-030873\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:688w5yaOgi6yS2MMu0BXElzK0Nc1j4e7a91fW45De2A=\"},\"SV-204568r241939_rule\",\"RHEL-07-030874\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:umcgNuAsnB59XSjy1I6U++dXqM23CWYChhlv86x8Xuw=\"},\"SV-204569r241939_rule\",\"RHEL-07-030880\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mE0MJl83yHmgx0kwKQuKZgNSsnJD2tRsSDRy+kJVHUo=\"},\"SV-204570r241939_rule\",\"RHEL-07-030890\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SvB0fmN1dM3PsEjEvg5vyZ0zWzSJPOTnbJAICsSPMMU=\"},\"SV-204571r241939_rule\",\"RHEL-07-030900\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DS0Fydb5T+qrwtZc8yHRMbt0kZVQKXZvEJkk2pfaoa0=\"},\"SV-204572r241939_rule\",\"RHEL-07-030910\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gQjaLKPqvRmJxPutSuCF2raYWv3G7pqqkl4RYi2CQjI=\"},\"SV-204573r241939_rule\",\"RHEL-07-030920\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:189mZdbWFnTmb/pv12S5jXM09zjsiaBRlTlxaxSpVrA=\"},\"SV-204574r241939_rule\",\"RHEL-07-031000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MwPcFaS7XSTh86tBjhVDJe6I76OH8QTJFy8ThExOTCg=\"},\"SV-204575r241939_rule\",\"RHEL-07-031010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9LhzdHuv/khleaS+BQu9ZlUcdjdohBUoq5bjuJZdhK8=\"},\"SV-214801r241939_rule\",\"RHEL-07-032000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DhilIZI4XItLrdeaFbC8ICZgBN1OCgHuPfD1k8e78sc=\"},\"SV-204576r241939_rule\",\"RHEL-07-040000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:O1hlu7Cy9bkTgUpdl/8swEZmVqrdSxecwRgqIv7TKeI=\"},\"SV-204577r241939_rule\",\"RHEL-07-040100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JDnnCT7i6KXIu1+6ypsCHBmdw6EQtsr4dSd3kFFR2B4=\"},\"SV-204578r241939_rule\",\"RHEL-07-040110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YGctoNEqGYp37D0V7f4JEnaQwZUWRJ16N85m3V1dTA4=\"},\"SV-204579r241939_rule\",\"RHEL-07-040160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kPgd3nZYx8oNc7jNrMPf7SaMkgI7Mpqc+C0Gesho7w0=\"},\"SV-204580r241939_rule\",\"RHEL-07-040170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gICjVQBlC2CyjSEDRHoAr3hm79aABc0TAYCd4cyGREM=\"},\"SV-204581r241939_rule\",\"RHEL-07-040180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IgR19ArnuG58zoGRs25ETsbszS2t2pU66+rmh1ALJZg=\"},\"SV-204582r241939_rule\",\"RHEL-07-040190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7XIsGNddY755GhU000GYrT04RXf5RlJxt9a8QpJOgWM=\"},\"SV-204583r241939_rule\",\"RHEL-07-040200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zNpBjI7gKD5CGJeHa0TgLmFXquRzktJOpNM1MitUcYA=\"},\"SV-204584r241939_rule\",\"RHEL-07-040201\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tu8dUs1zi+TVniquX91HB2mrznXWiYevRt36mw4oUc0=\"},\"SV-204585r241939_rule\",\"RHEL-07-040300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U0+kiCOWAxM37Dm2rN333KIvx6YqKjJfXh9Z8SO0Hw0=\"},\"SV-204586r241939_rule\",\"RHEL-07-040310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dkh4lOXziNuIqVk4eaOVLxaMcoWI12sofxv7jKQaw+8=\"},\"SV-204587r241939_rule\",\"RHEL-07-040320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KFrNyXlrwufl0fTSC2Xb2SJFGIHk5O3cfMQ8TP0OUcU=\"},\"SV-204588r241939_rule\",\"RHEL-07-040330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:s3HPGztH6jOvI74wiywU7WSmWcHTK8Aw+JzBeFJeV+o=\"},\"SV-204589r241939_rule\",\"RHEL-07-040340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4oJTyVwrO2R6TmqIF+bsE92/Eo5rArioW/qSFId8tfc=\"},\"SV-204590r241939_rule\",\"RHEL-07-040350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2znyQY3TQ9xKT6QoY0lQ8dx0S8AN67MOq5v/U8DLEh4=\"},\"SV-204591r241939_rule\",\"RHEL-07-040360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yX1X8uJ+vqpiTI1YneKPRT+wM/BMopO1gSTrMWwXbLY=\"},\"SV-204592r241939_rule\",\"RHEL-07-040370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XefiLkI57brJK6zs5DReGOyqdxXR/FR0JRYBWt4XivE=\"},\"SV-204593r241939_rule\",\"RHEL-07-040380\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0dqZel9WfGVpxO6OVdTQca14awO4upKlmd0SHcwofA8=\"},\"SV-204594r241939_rule\",\"RHEL-07-040390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xTLJjvdq15UZDw8G16bCt7+I8XiP/RxZCLmJQpOTmC0=\"},\"SV-204595r241939_rule\",\"RHEL-07-040400\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZrwBro/CqOpHuLOT920+WMMOrhs4KR7xtuVSg83ADyY=\"},\"SV-204596r241939_rule\",\"RHEL-07-040410\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h0blgpw29xSnpbeqXLAlK16DNURlD9WDnqL8KrTVoVg=\"},\"SV-204597r241939_rule\",\"RHEL-07-040420\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LuF6kqpOF9eNjNyaM7lVHX3f2Ce7dRDM7eZK2TV8w6Q=\"},\"SV-204598r241939_rule\",\"RHEL-07-040430\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:95XKdYxzx1qHEALj0vVcUgfFdzE+HDbKJn+kj2tRtCY=\"},\"SV-204599r241939_rule\",\"RHEL-07-040440\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XRT3D2vqhfiWwUMNKp1iT0NPdaECtsiOv+PkO9tvPIQ=\"},\"SV-204600r241939_rule\",\"RHEL-07-040450\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uaQWPHqYSfcx2Hsbsz6oSx3/NvJ2S9ZZWyR1AaamE3c=\"},\"SV-204601r241939_rule\",\"RHEL-07-040460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZEDgUUGRtYwtdg/7IGePmM+mO77jBmQ2y6qQSJnzh88=\"},\"SV-204602r241939_rule\",\"RHEL-07-040470\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vFy+LSYNEqK8q0jlqPSRN9R2KTNP4oH9DkTCn3+F6lU=\"},\"SV-204603r241939_rule\",\"RHEL-07-040500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cXVgQoJtqPP16H6INhLNMDk5sX6o5q6ee0+MombCLUE=\"},\"SV-204604r241939_rule\",\"RHEL-07-040520\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5AeStZQDNTFP8dyAN+kdFOwEHd7ujN7N8QOsth1BYFI=\"},\"SV-204605r241939_rule\",\"RHEL-07-040530\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2MW4CbQWQSdnWTn+vJjAqUXxy39KvlIkThmnSy/UnmI=\"},\"SV-204606r241939_rule\",\"RHEL-07-040540\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v4IA4z20DXRjhaVy+lPUHGEq1PKWrz2BRO+w5yuY2A4=\"},\"SV-204607r241939_rule\",\"RHEL-07-040550\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rZwRT3O4olP1cUbfaVWLtsV55GMO6FG1urqqL7Z5if0=\"},\"SV-204608r241939_rule\",\"RHEL-07-040600\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eQBkLoCxbhLSL0FSX13w71XInyURAJYddveh0zcMYZs=\"},\"SV-204609r241939_rule\",\"RHEL-07-040610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FwLT66vNGmWrFses/sAjJSSaKxtlj7doQb3MZgBImX8=\"},\"SV-204610r241939_rule\",\"RHEL-07-040611\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p1jUPBQZCsvZDLRRitg2VYMt2+J7ICQQdk58h8+Ceww=\"},\"SV-204611r241939_rule\",\"RHEL-07-040612\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cG2bpeEieasuM4Qt7PgAX0WNy3Jg+IohvlZC3bDIxnk=\"},\"SV-204612r241939_rule\",\"RHEL-07-040620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MRRtJ87d9codxHSiwiP6FQaDVF9nRZZKpZzZKdkt8tc=\"},\"SV-204613r241939_rule\",\"RHEL-07-040630\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8YTZ6fEoQgsCaCCADaJpdHZaoc+u9wlTzoxXW92DDXI=\"},\"SV-204614r241939_rule\",\"RHEL-07-040640\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/GqImo5AYk9oB6VesRt32EX9qhNxt0bsSwz/JfdpsTM=\"},\"SV-204615r241939_rule\",\"RHEL-07-040641\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rajjUFaPBiT4Sd2KHjdKE74EwKfpgWlkjrCk3HupPOg=\"},\"SV-204616r241939_rule\",\"RHEL-07-040650\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eI/kCnLWasuxYrqINFrqYvnYRusBETB3PyweSidvuS0=\"},\"SV-204617r241939_rule\",\"RHEL-07-040660\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ehZyYb58GoVTgK7yVpGqpPJBA7NKrWkkjvGCe4/cHMw=\"},\"SV-204618r241939_rule\",\"RHEL-07-040670\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6FOjMjnPE6o/2RQfLIQ7oCu1NiuJoXu8ZloEh6aQnOc=\"},\"SV-204619r241939_rule\",\"RHEL-07-040680\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GYLgPoC9dWO6EQnX8n402yDsuMPAnK9fUZjDeNJuVlQ=\"},\"SV-204620r241939_rule\",\"RHEL-07-040690\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bjTPHU4AZoK6BfgfQVubbfWkNDK50eujmcmoDTDukmw=\"},\"SV-204621r241939_rule\",\"RHEL-07-040700\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N0HT3nvX0nacPF0nic2Fvo+QoxFewqWUvw8Cb2dpdyE=\"},\"SV-204622r241939_rule\",\"RHEL-07-040710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BQENP4a828YEZSXVXQtFoPetmYEFb8+83NfUr43aZ74=\"},\"SV-204623r241939_rule\",\"RHEL-07-040720\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nW951brbjAkAlDNfMZI++v9EZTA23qYKprHAkBSWFUY=\"},\"SV-204624r241939_rule\",\"RHEL-07-040730\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ng0nTd+F1YUu4CUZtk3DYlhWROBAoM4ie5InHAQthN4=\"},\"SV-204625r241939_rule\",\"RHEL-07-040740\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MkXnVi+BfZNKD8HBi1BdRhBwQYqAqk37hdGW0wzHsBo=\"},\"SV-204626r241939_rule\",\"RHEL-07-040750\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LPkkcM3GKLloG2iIqGS//40g7fdb9hulnGjTO5OPl/c=\"},\"SV-204627r241939_rule\",\"RHEL-07-040800\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aj2+q1FDm7tuIsdCJ6yjAVx2dNimOetQj7BToo/VlEg=\"},\"SV-204628r241939_rule\",\"RHEL-07-040810\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kkwHgTSKsJctRdFnhk7oBugs+k0hSvrAHTNBODYlnRY=\"},\"SV-204629r241939_rule\",\"RHEL-07-040820\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A4M7YDCBxwn82FM8E2pYn9DdV8RWXiiwlGjESBKWFWc=\"},\"SV-204630r241939_rule\",\"RHEL-07-040830\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:duPPEkYg4Z6hIj9Yd6lOp0gvtSraIDw+nJz6zxmFvqE=\"},\"SV-204631r241939_rule\",\"RHEL-07-041001\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:C1LYFgaAqeuTh7Gtm38t3OcPVMq8CySBTILHzdSksbQ=\"},\"SV-204632r241939_rule\",\"RHEL-07-041002\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:o86wCHVnLXklbvao4gX06PkNKLM2n2dr61EHb3iOGuE=\"},\"SV-204633r241939_rule\",\"RHEL-07-041003\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2hPpDflNaMEbweY8kZ9GeMsYvJyW3OYECrRyUBb7WFU=\"},\"SV-204634r241939_rule\",\"RHEL-07-041010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"SV-106179r1_xxxx\",\"SRG-NET-000019-VPN-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"SV-106179r1_zzzzzz\",\"SRG-NET-000019-VPN-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"SV-106179r1_rule\",\"SRG-NET-000019-VPN-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:71oeJLYU9tjMIiRqSWuNoIKcrvLfKW7xfh7cI6OhvFc=\"},\"SV-106179r123456789_rule\",\"SRG-NET-000019-VPN-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"SV-106181r1_xxxx\",\"SRG-NET-000041-VPN-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:slm2UFIqnUUPyOpfIcsxSew4LGvsTesU9C6Ju5XJ3mw=\"},\"SV-106181r1_rule\",\"SRG-NET-000041-VPN-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jc6QW12gqdTKEPqvls4bilVyDJExcCoSskTVyO0VtC8=\"},\"SV-106183r1_rule\",\"SRG-NET-000042-VPN-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4cT/S3JRnRG1/bjkxCCl0FvJ2jFBPQxR6xd/ho3iPwU=\"},\"SV-106185r1_rule\",\"SRG-NET-000043-VPN-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IdemsTDQGwPd7bokQxIIvpGCFpuH2a0LMkx43UGqWUA=\"},\"SV-106187r1_rule\",\"SRG-NET-000049-VPN-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aVWTWelue2vPX4PPQhsVdenoG0JoZrePs1txZu8Tn9w=\"},\"SV-106189r1_rule\",\"SRG-NET-000053-VPN-000170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CyTJHLIKQ2Ojkg9rwcZ3x7T66VHLzHB54n+nmQfac2E=\"},\"SV-106191r1_rule\",\"SRG-NET-000062-VPN-000200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b0U2i/2oFdeOwmGlTBap86LUQ1gHdfQ3eL4us+64fpw=\"},\"SV-106193r1_rule\",\"SRG-NET-000063-VPN-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v3WpQRoQigeTzLi65BYsrw9t+ZEEROlTq1kxXFTTLlc=\"},\"SV-106195r1_rule\",\"SRG-NET-000063-VPN-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+B3+7JmTL1p1pvXgkAa8wGoCkVHYXHjICDWeklY1MTk=\"},\"SV-106197r1_rule\",\"SRG-NET-000074-VPN-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5JYnVzed7VNQLssmYLnmi+secKLvHnAiNpVnw5LnOy0=\"},\"SV-106363r1_rule\",\"SRG-NET-000075-VPN-000260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YlctilOwQ2MBW7zoqYuhAoiJN5c5NYVKUMH7L8KW2VE=\"},\"SV-106199r1_rule\",\"SRG-NET-000077-VPN-000280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HGobFrLp43KBzaBeaBiQba6hjKEcpQn11VJTJJwwmMo=\"},\"SV-106201r1_rule\",\"SRG-NET-000078-VPN-000290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:P/zyghBUSYmw8eYcF6kqAgE8TeMANzSroGoCNq9DxmU=\"},\"SV-106203r1_rule\",\"SRG-NET-000079-VPN-000300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/9F2orQ7S4UyHUeIF5MNwyf2YqTtEcZKOu6Lyy3dl0w=\"},\"SV-106205r1_rule\",\"SRG-NET-000088-VPN-000310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TBiXTAY2X10uilSJ/Zo764Ce7gxa+BC604igCvR21Ys=\"},\"SV-106207r1_rule\",\"SRG-NET-000089-VPN-000330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2+gLZEUpQFGiiXTLj5vTvPMeNuYVSesoUBq5osjiwyA=\"},\"SV-106209r1_rule\",\"SRG-NET-000091-VPN-000350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mi17ibh62O4cda5bcRUSENaNZI+A+wHMQdsAhZaeELQ=\"},\"SV-106211r1_rule\",\"SRG-NET-000098-VPN-000370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xx7dyKjP3tr449DemD15SwuRdkEieFRE1AhuT429Hbk=\"},\"SV-106213r1_rule\",\"SRG-NET-000099-VPN-000380\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LurVSxZqQlUG4THAxXLsYwtoOIQkH9C5vFm75lhPk+M=\"},\"SV-106215r1_rule\",\"SRG-NET-000100-VPN-000390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:R+x0KRiQIKJIbqWDk9OWXOHA/tx5c83O7HSpjbaqItQ=\"},\"SV-106217r1_rule\",\"SRG-NET-000132-VPN-000450\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6xznw8iyFeJRJwk1JYCPRsiNwv5VE1E6oPOibHnQepY=\"},\"SV-106219r1_rule\",\"SRG-NET-000132-VPN-000460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U9u5kkzq19uYYwdfbvK93u00swz2+lLKN/KXYD1SLPM=\"},\"SV-106221r1_rule\",\"SRG-NET-000132-VPN-000470\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qL67vWiduAPXEoBZfFyKtQr8Xx5q0lifYoN8/VKeiXk=\"},\"SV-106223r1_rule\",\"SRG-NET-000132-VPN-000480\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mmyK/9p+kkBzjw391gSBn/5JwQ6rUWRXc0i0deZcJlY=\"},\"SV-106225r1_rule\",\"SRG-NET-000138-VPN-000490\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D7dgt3RnYA25LvMASqDp9YTrG7KfSDck59y/cwVd1j4=\"},\"SV-106227r1_rule\",\"SRG-NET-000140-VPN-000500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KKZUM28vxti/o8G6lxUgCF8Wx8ura3+B1TExgJuWCGA=\"},\"SV-106229r1_rule\",\"SRG-NET-000145-VPN-000510\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:koWH1S5xZuAZ4H9vnFXHr/qz4c6UDJH7P29FdfhEPZg=\"},\"SV-106231r1_rule\",\"SRG-NET-000147-VPN-000520\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:53vjl7nhxJZkAmPcXBfrWgxe2N8vSeOA4P5KeOUv1cA=\"},\"SV-106233r1_rule\",\"SRG-NET-000147-VPN-000530\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PQvyQqpQfxH4QYcuFED9dQWGmLZ5NjYVdg+5ViJyzMc=\"},\"SV-106235r1_rule\",\"SRG-NET-000148-VPN-000540\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v5/IfNoYuNBZdJW3TnihRjv14rrPD9SLxquxNn9HMf0=\"},\"SV-106237r1_rule\",\"SRG-NET-000164-VPN-000560\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4L7fYYyaq26bvadPv3JCcQ3yEjurb6JgRmYQ/U0UV1c=\"},\"SV-106239r1_rule\",\"SRG-NET-000165-VPN-000570\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ar3GvJuXEKD4A/Af2IozOGlLJBjfNqRbiW1i8k/7Y9g=\"},\"SV-106241r1_rule\",\"SRG-NET-000166-VPN-000580\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:f0b/RYI3SCPeEqjHsb3psBWUdGRTKfgqRrq51hB7yfE=\"},\"SV-106251r1_rule\",\"SRG-NET-000166-VPN-000590\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MRKxPi/bbsDz8wNN9vXmb7hhgMU8M3+JU6oyqsrMnZk=\"},\"SV-106253r1_rule\",\"SRG-NET-000168-VPN-000600\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:L26csqRjhPU0fgblV8qX1BlmvtAHZjw4Yyp+bb0mDKw=\"},\"SV-106255r1_rule\",\"SRG-NET-000169-VPN-000610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OyTG982E0CMxr4y2rmBaYCCpTY7srBWAv/cZQUt/Y+w=\"},\"SV-106257r1_rule\",\"SRG-NET-000205-VPN-000710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lOVVOo0oYWR1BZZb2TwnHXMbM18YttAN6G4GrHPWbyw=\"},\"SV-106259r1_rule\",\"SRG-NET-000213-VPN-000720\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZitF7N9m7tBrFLBSFvvFyer2Cj1EN7TGddhFoon9a2g=\"},\"SV-106261r1_rule\",\"SRG-NET-000230-VPN-000770\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uJQ31o/f/Vqkllw6K1glewYI9Xlo0bRZIER2AGlLICw=\"},\"SV-106263r1_rule\",\"SRG-NET-000230-VPN-000780\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KPLBOeYMBZIxBbaWyihbjnI+iXUnrab0mkIE2hzbTk8=\"},\"SV-106265r1_rule\",\"SRG-NET-000231-VPN-000790\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p+iB5XlL+If6inJuLfQ+r3VNT86JXC5NhnV2vOeozxg=\"},\"SV-106267r1_rule\",\"SRG-NET-000233-VPN-000800\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ktJIe/Y+HEIOo7bAwQCz3X/2hQkiqoTyl8BVpkZpHYk=\"},\"SV-106269r1_rule\",\"SRG-NET-000234-VPN-000810\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D9gD2h3b8ZDEWmQokEZllnWlmTLY7M//Hjdn7DqBOf8=\"},\"SV-106271r1_rule\",\"SRG-NET-000235-VPN-000820\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:72eP2Vo/dCHVQ+6f/2RQyYnBi119Hq+RWYm1m2WqoLc=\"},\"SV-106273r1_rule\",\"SRG-NET-000313-VPN-001050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:w9yL+z+t1qYSt9kk+sxVflN/xG/naaJ9QP4VRCcqw6Q=\"},\"SV-106275r1_rule\",\"SRG-NET-000314-VPN-001060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:afNm41YNd2Z2QwHOtNNm/ZsgKpPtQhY3FaPrGqRWnTw=\"},\"SV-106277r1_rule\",\"SRG-NET-000317-VPN-001090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:n4616xCQqSEJ5LDbI/BvogDwAhTFLCqs6qsCNm2y6qM=\"},\"SV-106279r1_rule\",\"SRG-NET-000320-VPN-001120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qrumTMQiLLqavZ4GBAcbIfp6Kibky5yDpODJYsUNU6k=\"},\"SV-106281r1_rule\",\"SRG-NET-000330-VPN-001220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bzo/kYUviBi8fH0VVF4kMJsdAnZOcFeOl3REDgnED8o=\"},\"SV-106283r1_rule\",\"SRG-NET-000333-VPN-001250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cvSX2fNtb/9d5KoCFv38r/vk1P66QvbknutRPO++RHQ=\"},\"SV-106285r1_rule\",\"SRG-NET-000334-VPN-001260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rpLsrhPbwk1f+JYoA5pOhGpi71+wEYHZA7WhvDHOZ+M=\"},\"SV-106287r1_rule\",\"SRG-NET-000335-VPN-001270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lKiTDkfAGyG9SqJoJw3IBMHEt9m1XfYEXjJcJ6N2O4I=\"},\"SV-106289r1_rule\",\"SRG-NET-000336-VPN-001280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fVzjNA9x7fe7XKuKOy79M7wLwKGgdGCnV3TChwORocM=\"},\"SV-106291r1_rule\",\"SRG-NET-000337-VPN-001290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yIMWyLqQ5KjJhVIE0sO7kOy3MFZ/mr8G1UsF2vpFezs=\"},\"SV-106293r1_rule\",\"SRG-NET-000337-VPN-001300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3Vk1c0ULGwB+JNxtAcJe82imefTrQUiXMXW0gSoV5sI=\"},\"SV-106295r1_rule\",\"SRG-NET-000341-VPN-001350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U2xkrpdDd5fbE89oPVhqhnurz+BzWOL7MBkXI3iyc44=\"},\"SV-106297r1_rule\",\"SRG-NET-000342-VPN-001360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tY5W3SOCbPKTMPPTVFP0FpXqFdrxc15JZY9C5N1Jp3E=\"},\"SV-106315r1_rule\",\"SRG-NET-000343-VPN-001370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bVroOwdA0e1yfLelH5K0/LjEPzRuPTDt+xgTDMzMsWA=\"},\"SV-106317r1_rule\",\"SRG-NET-000352-VPN-001460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1maPMRSAJQc9CCcE9i3+e/pBNygIhmu9m1GajIh4WrA=\"},\"SV-106319r1_rule\",\"SRG-NET-000369-VPN-001620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:W5E6fpSFPSjZsDhRm6JBdbhvWCdb4iIQ29kz4GWDM20=\"},\"SV-106321r1_rule\",\"SRG-NET-000371-VPN-001640\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rqcFP9ktgfb343ahB5Mv16lTwTPf1/ELOUg9C3CgAj8=\"},\"SV-106323r1_rule\",\"SRG-NET-000371-VPN-001650\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+vnSRs+ZokA+P5inP7i24jyzDoJ+8dRGwCZAF72bzfw=\"},\"SV-106325r1_rule\",\"SRG-NET-000375-VPN-001690\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fU8zq6dLn1EHMKbL2KwqzdBun1CXedlYFT1NSzY5Zw0=\"},\"SV-106327r1_rule\",\"SRG-NET-000400-VPN-001940\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GOcfn7YCnFViHL4Sv9yLScid+jFSlnVek7L1omc1Mjw=\"},\"SV-106329r1_rule\",\"SRG-NET-000492-VPN-001980\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D0/SC7O2V3JZ4+Sewx7Qn6Z7ZSrkdje8orXuKxcEjpo=\"},\"SV-106331r1_rule\",\"SRG-NET-000510-VPN-002160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GNvczQqQ8RSDNiGZgHykTH9Fl/06XwpsXibtlkPH4AM=\"},\"SV-106333r1_rule\",\"SRG-NET-000510-VPN-002170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nrioFfQyWAyHyqPYTDE2+pXaDoeycQE/PjC2vrEL9Jo=\"},\"SV-106335r1_rule\",\"SRG-NET-000510-VPN-002180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hDgoEHbOPyCRLlTAZ0Qqx1kkok77I93P01NwpDJNEE8=\"},\"SV-106337r1_rule\",\"SRG-NET-000512-VPN-002220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IzzOyrG05CKpFAWFrkEoNJ5rxjb3elkLNtjevgCQdtw=\"},\"SV-106339r1_rule\",\"SRG-NET-000512-VPN-002230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GrHgK/pBnHrsn1Seh0qJujIqrWqRLPE0eaA+ZAqQMjo=\"},\"SV-106341r1_rule\",\"SRG-NET-000518-VPN-002280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+WzKvuFJw2Hd2tINf3CAdDXjeroLc9pIuZQ8rxqAqW8=\"},\"SV-106343r1_rule\",\"SRG-NET-000519-VPN-002290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WFTjVjonYKh95+ufS3SeRtMzKzxvcuYhkuGqLkDzAdQ=\"},\"SV-106345r1_rule\",\"SRG-NET-000522-VPN-002320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WvHtCxF8aHRpizWQnHhcRWZ2GSo4LpYF4C+7vAKUMGY=\"},\"SV-106347r1_rule\",\"SRG-NET-000525-VPN-002330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hK46dRZBIlXNdxH/0rgMhBXqrBF8nwMTFp1UUvsZ2/w=\"},\"SV-106349r1_rule\",\"SRG-NET-000530-VPN-002340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Oyy/mFzHcQy1sAgTQ9gS+b99/s9IcmH4xTl+n0Pf6Rw=\"},\"SV-106351r1_rule\",\"SRG-NET-000540-VPN-002350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0WoWCtzpWtYJ2vxCT7vXvLruiskYzBOwEVdaxJWlGbM=\"},\"SV-106353r1_rule\",\"SRG-NET-000550-VPN-002360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RFq+xtylI0rdth+CO8xXpnUCA7eBYGNXjStRxU/Sh2g=\"},\"SV-106355r1_rule\",\"SRG-NET-000565-VPN-002390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p7UCHJrDUnFC2jp6mXGtSAilZeT3BjF1NVmG5ykWcy4=\"},\"SV-106357r1_rule\",\"SRG-NET-000565-VPN-002400\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F8wZynyPCZXbSCQKsDAa3RDhSkunUmMAhgYUP9Yu014=\"},\"SV-106359r1_rule\",\"SRG-NET-000580-VPN-002410\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WOsWkwp7rHKriDcEPQi1g0VQp3X0XA14Kw+soZYNvnw=\"},\"SV-106361r1_rule\",\"SRG-NET-000585-VPN-002420\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vchgPhpapNXqH1070giShdvTrztio49eNJBWV74F3HU=\"},\"SV-77809r3_rule\",\"WN10-00-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LSSb1gLDf7uiXzn44Bg4EplFPsBwaprDmRrselWEvyE=\"},\"SV-77813r6_rule\",\"WN10-00-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:G++c76EF2dug3yxJ1mWjWuE/wznHG9SVXyS+eCsoMKE=\"},\"SV-91779r3_rule\",\"WN10-00-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:UyAIBRFH+PIeD9UnW2uuScJwGHi1TzbEGDoaMPRL1nM=\"},\"SV-91781r2_rule\",\"WN10-00-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HCOGZgkq+yjHfU54mGFmUULh8th2DmZrWdDxdOWGa1I=\"},\"SV-77833r2_rule\",\"WN10-00-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WJmapvaFU3fBFpTg+ufcMx2LC53rImDSpxqCEpTRTeE=\"},\"SV-77827r5_rule\",\"WN10-00-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hSVsi+qUuuUyVINtO7WeONuyh47CyGSc32+FLd4Ul1Q=\"},\"SV-104689r1_rule\",\"WN10-00-000031\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SIUT9VltMgIdU+iQ11p1JXZ1wRhtZVpC4mS/QVMSxf0=\"},\"SV-104691r2_rule\",\"WN10-00-000032\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qqusfdR/p7eKP2jELMMeLdSrRy4vsHPTO1wfCg44MTA=\"},\"SV-77835r3_rule\",\"WN10-00-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:or6yezNX5dbJzbcRUwG9A6vn2Nwe1/eA0vaJqpY6LqY=\"},\"SV-77839r11_rule\",\"WN10-00-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9LhzdHuv/khleaS+BQu9ZlUcdjdohBUoq5bjuJZdhK8=\"},\"SV-77841r4_rule\",\"WN10-00-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jyG27jY3W9Aj4bDrKfA/dk1GvzTU+D+IeEpDzIASblA=\"},\"SV-77843r2_rule\",\"WN10-00-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gGc0LjWq95X1V62ZlIHcMLmkQPw2oUyILFgDEIeCFgc=\"},\"SV-77845r1_rule\",\"WN10-00-000055\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dOGGLjicLHA/RGjJYYBp+48oN0T8aKpZdwp8uPV5/Ic=\"},\"SV-77847r1_rule\",\"WN10-00-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:O7e8OfTlyzjmCELOYfMlW3c1bFSd2cM7R7YSkTfN3OA=\"},\"SV-77849r1_rule\",\"WN10-00-000065\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8UtBp2DVYD1LJb6gnT+x7kAd1QHqhk+0hwQmESyWDy8=\"},\"SV-77851r2_rule\",\"WN10-00-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OHRlA26i4Hoz3B5fPGaNDpMcdjxDEW48a+7+FxI491c=\"},\"SV-77853r1_rule\",\"WN10-00-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KQ8lRy8FDBQ4580tUO1vy4jkMlou6sCG5kmgRB26zTA=\"},\"SV-77855r3_rule\",\"WN10-00-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bUQ3g8z8lvNafFtEoebv7L8OC/vCz5bDJEA+19YUMfY=\"},\"SV-77857r2_rule\",\"WN10-00-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MaaeK83VUHrwbWkTbzyV8UO0uqMO9TDhxJaX5AYk0dg=\"},\"SV-77861r1_rule\",\"WN10-00-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nU7vAsnPVGyMIHLfdjvPC2Bq5ULx/4Moe5DQgjWZP+E=\"},\"SV-77863r2_rule\",\"WN10-00-000095\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PQtPLZt9kjWgPV2hRYy2GI3OB/Iw5D032IDo7oY5zKw=\"},\"SV-77867r1_rule\",\"WN10-00-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TRPtutJnGn43Yj6o6o250dQEb4BOKYZixgC8OVRcNIo=\"},\"SV-77871r1_rule\",\"WN10-00-000105\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YwindgjytVWnrAw7yMnV/6hfzMIONOOroZJQi53YVkg=\"},\"SV-77873r1_rule\",\"WN10-00-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7Tr9YNXYybZpCvPg9E2lPUrKLG7+7N1se4RCmhXyPzE=\"},\"SV-77875r1_rule\",\"WN10-00-000115\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IYTubfVbsZBz/2eFUf+4u7kuvTO77HcoVONuJRZJyzw=\"},\"SV-77879r1_rule\",\"WN10-00-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:B/OnPBA2G41jIXn2STFlRDpkMuzALJv21OFtakZOH9Y=\"},\"SV-77883r2_rule\",\"WN10-00-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fz8dkAgamwTuH5yyEwnl11W4wiTXnoygvOnaEaNj80A=\"},\"SV-77889r1_rule\",\"WN10-00-000135\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wkHOfqgUvzr6nhiu0W8JznAIxTY88dEtZD1HETyM13Y=\"},\"SV-77893r2_rule\",\"WN10-00-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:95Wge0r7A1nMcqH3gMcG1tsaCxT6bDaub3VeK5nHEcY=\"},\"SV-83439r2_rule\",\"WN10-00-000145\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7XgAgPXMwnWi7uSIC/fqd46LXQjEefiQggfQCfHL7K8=\"},\"SV-83445r4_rule\",\"WN10-00-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8QaHQQT2a/xX1mHR9JZYds+zZe9VKc6wZnVv2nVWTwg=\"},\"SV-85259r2_rule\",\"WN10-00-000155\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LoHFxrEqFXMSEB8aLzNbxWm1sZAEoJAELFfMvbeXJWA=\"},\"SV-85261r2_rule\",\"WN10-00-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AcIhp89UhB4v65rG4+1OlkrKzpAPGx+nVXwXtWlRxtw=\"},\"SV-89397r1_rule\",\"WN10-00-000165\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bH2zYG4O8rv2T9lCQ0x5K3UStABQyU0MGrR7XdmZxm4=\"},\"SV-89399r1_rule\",\"WN10-00-000170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kmONnQi8hUqCu/WJgM8CHWQrxsQLtOxhWR7c6bEt12Y=\"},\"SV-89393r2_rule\",\"WN10-00-000175\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2j27+jG0GZFs6PCwCbPpklgetUgKU7XZetxNDvK30ho=\"},\"SV-91201r1_rule\",\"WN10-00-000190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QUy5rMKrmSVFuZRi8lijI352v840T0gzGD5qak7wNbk=\"},\"SV-87403r1_rule\",\"WN10-00-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OLU1Ki32nfmwHE1geqvJmNi7m2t/bTSrs5FI1qvvg5o=\"},\"SV-87405r1_rule\",\"WN10-00-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VC4MssCw0YPNf5Ku7vwfsCk462cMswOvsMCGoxhRGaU=\"},\"SV-87407r2_rule\",\"WN10-00-000230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:99vRhcTZ40z21olaz2KCAKJlYMIhAMYv5z3B0U4Tt7E=\"},\"SV-92835r1_rule\",\"WN10-00-000240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HTJfh6HdzWTnnVR96iuoJZ0PnIvio+5FoDwpQDtzoTk=\"},\"SV-111557r1_rule\",\"WN10-00-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:iZIWtAKLFv0mnxWoPykNAd+yxoNoNuOAn/rsuRkGkBw=\"},\"SV-77895r2_rule\",\"WN10-AC-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IeyN47N358ORV6Naa7eZ9JrcWdBvGlkKd07eHuOVVhQ=\"},\"SV-77899r1_rule\",\"WN10-AC-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:14aXfEafYKcgX8JWb5u3N/8DD5cx/FDR9uuxUhwPlSE=\"},\"SV-77903r1_rule\",\"WN10-AC-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:o8VKo4BFEQi8vohXvm9npwy451RfLEpCEbuLlXnX9P4=\"},\"SV-77905r2_rule\",\"WN10-AC-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OOSpmvJlTsCD444uc+1xJVXu6qS4JR7e8tmYahCVG9Q=\"},\"SV-77909r1_rule\",\"WN10-AC-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rtkmX+JYKFPLvLYlRGgdiaDWULPSxr3ntwT4Qq5G0gE=\"},\"SV-77911r1_rule\",\"WN10-AC-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gADtcufL0rvkhSygty7DNDG6rjm7eHO0Y8vlxc/cJOw=\"},\"SV-77913r1_rule\",\"WN10-AC-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9N++lDyFOQnR8saWfC585SvXvrRukpsO+VUybL0SJ3I=\"},\"SV-77917r1_rule\",\"WN10-AC-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YJ3a9bdA7M956htDthFs6pM+dAbD3AcqGyWDkl4iTa4=\"},\"SV-77919r1_rule\",\"WN10-AC-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sDp/d6cGeheQPSyDdqeABiqG2UKTGaaxfw8wIcMeQHs=\"},\"SV-77921r1_rule\",\"WN10-AU-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U2zZ7WbIs6xdLIKg5f+SK3W4lP14JKnsnLrhnXtzY8A=\"},\"SV-77925r1_rule\",\"WN10-AU-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Wm8Z9go4ijvi1hXPZNlNfvaEeTTCHlNCHL0r4Y+YBog=\"},\"SV-77935r1_rule\",\"WN10-AU-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3K8Cr0W8KyJySAjHnIKhBoSL7BMlQwmSIgNxt27SU90=\"},\"SV-77937r1_rule\",\"WN10-AU-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hFq/VN5iy8nq4TtmL91tbvNef3uqC1tTzH5qxWfTUFY=\"},\"SV-77939r1_rule\",\"WN10-AU-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6OLuCTq6MxuisuBFoZTFhVa37PfJJ79XxKFbZyUXh0w=\"},\"SV-77941r1_rule\",\"WN10-AU-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TRV0JYavJNEISA42NPNpnVnUp5myoEbm7eqpR1DJJFo=\"},\"SV-77943r1_rule\",\"WN10-AU-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VfJcv2oibH4fO+7O/16d0DnpaUWHMb9vOGAlg65RKTw=\"},\"SV-86383r2_rule\",\"WN10-AU-000054\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BvILRXAXQabjIlzA8GIEo277mORYvfi8NWsVMyjd+bs=\"},\"SV-77947r2_rule\",\"WN10-AU-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2DObiHB1tJi8nMxl9dgsi2/LMp3YdlL60aFyLwFw3R4=\"},\"SV-77951r1_rule\",\"WN10-AU-000065\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:V/vAvDNZ6xrqpdV/w1nyyY3RzAUSErMEtiv1Xc/qROg=\"},\"SV-77953r1_rule\",\"WN10-AU-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BE/T6AoSLhPnWZOeS6illZZoNnn6TQQMBBvTmt+LfNg=\"},\"SV-77957r1_rule\",\"WN10-AU-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HwmQqAec5Zb6el866c2comWk7ZfJ+ixTZEXIw7pzUOU=\"},\"SV-77959r1_rule\",\"WN10-AU-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pP6wExXu7hx0kSxYXKfJVrzTaRizYrfD1RMLqHWYrFY=\"},\"SV-89701r1_rule\",\"WN10-AU-000081\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJq3SMQlkiH7VSnlxXWdCkxlPWIUUAHF7pAJRBLRDOU=\"},\"SV-89395r1_rule\",\"WN10-AU-000082\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+dPx0n8JfTUXKdPsMAw42NTXs2lAb7HwDFC8m/Frthk=\"},\"SV-89085r1_rule\",\"WN10-AU-000083\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hktzVHG38mzOhb1tNzgXaCky+9tk/sTzqf2ayzkUh0A=\"},\"SV-89083r1_rule\",\"WN10-AU-000084\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1acXIWzqEYhMqmAFLJ2OFPWy5wyiClFRK0blgMdIxBY=\"},\"SV-77961r2_rule\",\"WN10-AU-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LGJqueVXVNwDFVXUpGxRZQ4Wny/BOBHeceC7sx3PXzs=\"},\"SV-77963r2_rule\",\"WN10-AU-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I1vZMy69tT8kq1UjsGKufBSv8WZnqduCw713X+syDqw=\"},\"SV-77969r2_rule\",\"WN10-AU-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:W/aNcLuy+E+akBMmzfflre1wQ9pk0xdJKZ8MsmhQgJg=\"},\"SV-77971r1_rule\",\"WN10-AU-000105\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:spd2YfnamQST1NlVqvAqNOfFgfZkdothjKXNWgXmfX8=\"},\"SV-86385r1_rule\",\"WN10-AU-000107\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uK/4Mc8psjVa5hc9xcQ/VvM1L3p/Z2PR5oXrXVdT3AA=\"},\"SV-77973r1_rule\",\"WN10-AU-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ub+bzRw9nK5FMqhg0cvtHTPXc0ZoY14WwJJpfePsTU0=\"},\"SV-77977r1_rule\",\"WN10-AU-000115\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pI4rSYXdO2I17sVUgVGEC9waoXmSE152j9vxVgdtn58=\"},\"SV-77981r1_rule\",\"WN10-AU-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XjzZBXSARGyTD/PfUuDeFm28fIvcIV4qygTV08sLVKo=\"},\"SV-77989r2_rule\",\"WN10-AU-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:t6WHp+ZUHBml263lvCguGrlkMzldPXsFEy5VNUVNBrI=\"},\"SV-77993r2_rule\",\"WN10-AU-000135\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Er5CsYJ2r9pG46ajyyQ8LR2k5mWoAMurGm8u9Uh/Iuw=\"},\"SV-77997r1_rule\",\"WN10-AU-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WuYFQVOva2y1AbhfejrStyjDyv4BFq3G2voT7JCBA8Y=\"},\"SV-78003r1_rule\",\"WN10-AU-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xgvxweAhj8P+1t428K3s8SDMbeLf2/MINiEDTjiVtRk=\"},\"SV-78005r1_rule\",\"WN10-AU-000155\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:liPGtSRilvM45JUUHGb3NoDoAKAmonqQZH/MaCqLC/s=\"},\"SV-78007r1_rule\",\"WN10-AU-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DyO6WQCEJJlinj5BDeq/RINvUFeMQ73GuBqzRcFDqQQ=\"},\"SV-78009r1_rule\",\"WN10-AU-000500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/3CmjRBIzvZC9yK/MCEjxBoeg+MF3xkIhnLP5Zgo/2M=\"},\"SV-78013r2_rule\",\"WN10-AU-000505\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rIpcAlB/RefJGwA84BZ7ULacK5uTqcC4TpZy9gfOwdk=\"},\"SV-78017r1_rule\",\"WN10-AU-000510\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Au90rsoIgKKpDJ+88Qps0bQDZf/CKYRvQpZFpv2MOUA=\"},\"SV-78023r2_rule\",\"WN10-AU-000515\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KvaUNjf9HpHOvMKNKYYGrc5t+RjNh70OiFd7YXyR7TI=\"},\"SV-78027r2_rule\",\"WN10-AU-000520\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kwjLPtx2Qf2ICgGtbJvcwowGSS5n1iOSY0sAbgRUseA=\"},\"SV-78031r2_rule\",\"WN10-AU-000525\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JLf0igfVeeCGPtuP0G5jtsBt5SLWDy8/40lxLhTjp+A=\"},\"SV-108655r1_rule\",\"WN10-AU-000550\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0JIEYxGjLJCW+XDuQSNKZLiOraun/N4xAz9pc3iPnC4=\"},\"SV-108657r1_rule\",\"WN10-AU-000555\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aHDwysX9OO7lInhWR4rNHU0Ms5aHv+DvTtpIpt7OrPU=\"},\"SV-108647r1_rule\",\"WN10-AU-000560\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ma4nqZH+wIDRjwzJLcPKvIvKb/+DvmWJQSbZYwt0kjY=\"},\"SV-108645r1_rule\",\"WN10-AU-000565\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1xCrwLo/Iq6qUeIrA32JKdJWhv9UJ8i93khTh00F31M=\"},\"SV-108649r1_rule\",\"WN10-AU-000570\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xN9N4TyNWncZnuydNiSn1AFbgDuZlrOZk/FpvfCXbCw=\"},\"SV-108651r1_rule\",\"WN10-AU-000575\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AwE4aTQA41II3JBpLcuFwxr2s+SdrBU5NkQnKMmh+34=\"},\"SV-108653r1_rule\",\"WN10-AU-000580\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:n/VYybwadURq9gktZ5pPv9NpPwlE/OX7X34avyRIxn0=\"},\"SV-78035r1_rule\",\"WN10-CC-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FGmuM87xdJUUKhYyergOAvk1Q+FhFTf1uOoIl5+4vOQ=\"},\"SV-109197r1_rule\",\"WN10-CC-000007\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wD5HvAQgiCsU2Pbe6EawPD0843pDzk9QjNocpT9i8RI=\"},\"SV-78039r1_rule\",\"WN10-CC-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A6fibgthh14b9Op4gFZQuUPcG2SB+c4/OCpJZl+JW/o=\"},\"SV-78045r1_rule\",\"WN10-CC-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QwUV9MHbwXjDlNhviMU3RJgonXD84IWB/u1SaVD04HU=\"},\"SV-78049r1_rule\",\"WN10-CC-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DJn8qS8Z+LUFfJVdHOYY3y3chtd5shcIjisdTgSjqYk=\"},\"SV-78053r1_rule\",\"WN10-CC-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OLmEHTREwzxLEYjHSP9Vs9v/hFwEi7JLaoSgaF8tAzI=\"},\"SV-78057r1_rule\",\"WN10-CC-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZB/zbtMEaShUymYYFvs3E2/5ygQ24pqyeGDPPNJ9udg=\"},\"SV-78087r2_rule\",\"WN10-CC-000037\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cLWTmB4pH7+xPBjUvZx8mpG3gs+QxeJQobWa4u/txeE=\"},\"SV-86387r1_rule\",\"WN10-CC-000038\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:azduH/rGDaA9J8WfIbKquOL5RoDMag7lQ/2PBt2QE8s=\"},\"SV-86953r1_rule\",\"WN10-CC-000039\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:R57XJmpmTusQFUQzPHbDgL50AUYv/vR8uoIKyz7Vpzs=\"},\"SV-78059r2_rule\",\"WN10-CC-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A69vy1PsYlLcAzLy5BVJjqB9jb4HUwisI/dMcPrDcBI=\"},\"SV-86389r1_rule\",\"WN10-CC-000044\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:61r9+JyE4FdTPKoO2j03RuHoicsSx+y5TDVRs+6Lxk8=\"},\"SV-78067r1_rule\",\"WN10-CC-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HPKwv55aIzf3+HquubSdJocG/rCtCTbtxNECCDpyxPk=\"},\"SV-89087r2_rule\",\"WN10-CC-000052\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c4QEIcRFMsJ0fLK2itIk4vhS7BejsCbOOCX+PUzaf1o=\"},\"SV-78071r2_rule\",\"WN10-CC-000055\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wmSMFUgwk1JCHLOyalyRfJCbYd8VKcplfwvV5bapJBY=\"},\"SV-78075r1_rule\",\"WN10-CC-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ev+o/KN0GgLzFlT2mWhE43+O9wbhzEnibMOjO1WuHo0=\"},\"SV-78081r2_rule\",\"WN10-CC-000065\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nB5yZlxqxo8iNwRqReGtHbsRcruqk84xPSKCKzfrudk=\"},\"SV-83409r1_rule\",\"WN10-CC-000066\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p3Km58ax+vwtXp6vt/jvLyGVTgesTT2NKlz+BVoeGAk=\"},\"SV-89373r2_rule\",\"WN10-CC-000068\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DgPD2H4FRf1aoEW+JdUiSywje5awdelYTOHDeJ/jku8=\"},\"SV-78085r6_rule\",\"WN10-CC-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PJ2hg0H5j3JxumOw1ESdMmYSago1hh7d1jPoC7NiknU=\"},\"SV-78089r9_rule\",\"WN10-CC-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MOtPlfIGo1RyaFuE2rfSMX3os4OtOKSymnMJWGrlUXI=\"},\"SV-78097r2_rule\",\"WN10-CC-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:x6lWvjXJOJaFvBJV1Zg8dV8fRzPlgg6/m3YcFFE/VLE=\"},\"SV-78099r1_rule\",\"WN10-CC-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:UFrGn+U27y3pnKkpO5lkjLvaccdBipAxfmB1NDMupKc=\"},\"SV-78105r1_rule\",\"WN10-CC-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PynI4MPELuswd9LSVn4o7lJ1Gj5XkceRgYo1jYFWcyE=\"},\"SV-78111r1_rule\",\"WN10-CC-000105\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eHWGorFu8rp07FggxF3KQzzzIDdCofw07d6YU7EPPQg=\"},\"SV-78113r1_rule\",\"WN10-CC-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1cHjpZpWasXrNs38blIHXTCAsBeBydKm/FoVbD6YN9E=\"},\"SV-78117r1_rule\",\"WN10-CC-000115\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJyg5YyGdmvNFobvn1b619ahBQSWRDA6UUW//FX4+mk=\"},\"SV-78119r1_rule\",\"WN10-CC-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uFh0+SOkPBhoY4cKXKJkJcnyQ6+Tp4ycDdOaJohcCxk=\"},\"SV-78123r1_rule\",\"WN10-CC-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i3fRKcUyn6PmTSkp0ufLDEGZMye3xAQxD4OpV2pM+0E=\"},\"SV-78135r1_rule\",\"WN10-CC-000145\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xC0vDkioBtR1JLW2HOIxcJl4n0eOz6yTkhlZetuLhI8=\"},\"SV-78139r1_rule\",\"WN10-CC-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NSgu6s8JKNnXMJ+7CGkFNsLqlJAeYQviKDinQTL+FHo=\"},\"SV-78141r1_rule\",\"WN10-CC-000155\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:14JhGWVp+3S3ydTw3+p8k3X7npjABreOsd4BluBaRyo=\"},\"SV-78147r1_rule\",\"WN10-CC-000165\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZJbz3VhLvqjcd2z7NP6j6DC8M0Ltzl3HDFROf1Cpu4o=\"},\"SV-78149r2_rule\",\"WN10-CC-000170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ye6LltMKmAmswLhHjkhNL7Oek9ZBv20d40WEFxLqoNg=\"},\"SV-78153r1_rule\",\"WN10-CC-000175\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BLkX1RSbTxRJ+95+jkVEEKAtY1YFGp7VUwcyz/Na6PU=\"},\"SV-78157r1_rule\",\"WN10-CC-000180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/dizhsZDVZiRpJUm04AvJkfxcjGg5bvtRPbE3Iajy3s=\"},\"SV-78161r1_rule\",\"WN10-CC-000185\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CffkXvxske/bT7jvs4za5BpRLmJrKhgTOflYgSJF+X8=\"},\"SV-78163r1_rule\",\"WN10-CC-000190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OHgYhVcmu/l9dVrJ0J5Uo4d4+lLD5rAkwUYwACRT+m0=\"},\"SV-78167r3_rule\",\"WN10-CC-000195\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uqablBEdj8fYHH8criFKQSHGko9Gb2nm3ANEizuP+08=\"},\"SV-86395r2_rule\",\"WN10-CC-000197\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ofnzmLY6Mws9d7/NtnKBQB4fhzW4stZa4Q8pqud3RuA=\"},\"SV-78169r1_rule\",\"WN10-CC-000200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rj3OnjRCg+zI0qrs9i/7QAUeW1hgVcDx11HNsPktgsU=\"},\"SV-96859r1_rule\",\"WN10-CC-000204\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:32jv43ZfzeffcLH0aNzUt/YSBnCyNLyRuby1CRN3yVw=\"},\"SV-78173r3_rule\",\"WN10-CC-000205\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJSxQGzb7YGcY1mgBjeFquoDAw5e1lp1zoNJaIM2u2U=\"},\"SV-80171r3_rule\",\"WN10-CC-000206\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SoCQzVKKVy7D5huRMI4Q7iyWO6PyUB9uG8vv4geQuQA=\"},\"SV-78175r6_rule\",\"WN10-CC-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pwvSQ+QN5KMngq6whT389oqgH7svUP44geVmJrGKA/Y=\"},\"SV-78179r1_rule\",\"WN10-CC-000215\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FNuzYuatOsVqoAEfYyh44rPDU4p+dXmH2F/22ijPNG8=\"},\"SV-78181r3_rule\",\"WN10-CC-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ka0gdKnu1i6pDqDBmfSv/etIgqsSnYvxwHo6vjDl/lA=\"},\"SV-78185r1_rule\",\"WN10-CC-000225\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nBBbWUKMYR0oBuDR1T1+MwPCSPwa/PvvTXckuCFHxcY=\"},\"SV-78189r6_rule\",\"WN10-CC-000230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nWoWY5Y4H2PjarlDCeZzumdmSKNqLLbQWB6PRDqTQik=\"},\"SV-78191r6_rule\",\"WN10-CC-000235\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Yc8MBcfVv6vNjndIl1SGBkgIuoDRlU+d8I5bNlbhm5k=\"},\"SV-96853r1_rule\",\"WN10-CC-000238\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Vnj02lH1OuXdBOVVSKAmO3ADzTn5+Ujz8I1pVPj59vU=\"},\"SV-78199r4_rule\",\"WN10-CC-000245\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2biNxxxfwe7Qz0rZRb+comoTPxV6tZ2FWyVQ8NR0XLI=\"},\"SV-78203r6_rule\",\"WN10-CC-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gd3/nmYTFouE7yNfONwiOI09OM4xvvtC7p5aHSm3+rk=\"},\"SV-89091r2_rule\",\"WN10-CC-000252\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:K8//OPyNM3tMbqVbeoAI5KxKu5UgN3dLo2qeJqTTARk=\"},\"SV-78207r5_rule\",\"WN10-CC-000255\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GJyj8KhT2aDTkrVyy9e0G2Fw3bcs2GwK50H4fhiljcA=\"},\"SV-78211r6_rule\",\"WN10-CC-000260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RzUSnNAkaFL0vjIzRXyocD/1metNOIhllvi1eHyUE/0=\"},\"SV-78219r1_rule\",\"WN10-CC-000270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9Pbb8VW3GGoFqiMEMNsF6+ETyP17aJ7LEE/EwiZmXLY=\"},\"SV-78221r1_rule\",\"WN10-CC-000275\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pOkacn9XsLUUPvPCp7BiIdMobs3MmyoiiFdmo2S1Jh4=\"},\"SV-78223r1_rule\",\"WN10-CC-000280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:db4NX5ePYijTdjIZhHi6AMQwXOH25jy1YMRAOPp6z8o=\"},\"SV-78227r1_rule\",\"WN10-CC-000285\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XK40On1j1swkBQC4KHrqqKtA3+PU7O8didBZ9X2v3mU=\"},\"SV-78231r1_rule\",\"WN10-CC-000290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D+Br9Bp34FIbXISTUzTyziluj9wIh2NeP3T7rqIlBeU=\"},\"SV-78233r1_rule\",\"WN10-CC-000295\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2hvdFSkHFd/jxnDg7QHAFnPQALuFWOVvLZGgRROj5l8=\"},\"SV-78237r1_rule\",\"WN10-CC-000300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MT/QRJ+7T5KdEYjB1CflYUeHypJvbgQA/NoSivDno44=\"},\"SV-78241r1_rule\",\"WN10-CC-000305\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kaQFP+qv+/U0A5jz+BdWIpTTdtyktf1MP4WKqmlH3c4=\"},\"SV-77811r1_rule\",\"WN10-CC-000310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zv0vssTime65YEhFGjHDqU96ACMkZRxJDowM/Qv+sCo=\"},\"SV-77815r1_rule\",\"WN10-CC-000315\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pBxUW2Mg4ubB2d75emmojt2R7TlPrd+/K+K4/cfdRCw=\"},\"SV-77819r1_rule\",\"WN10-CC-000320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zkVu4Ox1MUjKEwFzsfX/ILQ/ZYHNPsu/JvNQeqZ228Y=\"},\"SV-77823r1_rule\",\"WN10-CC-000325\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tlcocN55ZYxvkWqCrlKzS308hz23N1rtV+8aFeDnhcQ=\"},\"SV-83411r2_rule\",\"WN10-CC-000326\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dbiUpUgiJb2+wzenGvBgb7gCtpsKZcFOnZmCT6u1k3s=\"},\"SV-111563r1_rule\",\"WN10-CC-000328\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fdOFEUfWZvFxvtQyeYZ2AqTmF5GEfPF1uWfwWrblF5o=\"},\"SV-77825r1_rule\",\"WN10-CC-000330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b3jhzOOdG7cVXgpSQQKPwd6xwSdfSPk98Epls0Yl+iY=\"},\"SV-77829r1_rule\",\"WN10-CC-000335\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2tk48SuLjCC1zEZDnJEJwFssANaf8w1hwLA0yFQDwt0=\"},\"SV-98853r3_rule\",\"WN10-CC-000340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yd5HlJZjtzvpiWMc+q7EtjdFutkSfgvcIU2keNcxYzA=\"},\"SV-77837r1_rule\",\"WN10-CC-000345\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:EIBNySof2OFl+QthlhxU04xnAsa1Q0mr/BmTT/yWVGw=\"},\"SV-77859r1_rule\",\"WN10-CC-000350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rF9EqXhMnWgSBUWWkmTth67EEUxryI/ybsO2eNuHvzU=\"},\"SV-77865r1_rule\",\"WN10-CC-000355\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nkjCE6RM8DNItyD6rVqHkapLyfMeCxO61yv23MB6TIM=\"},\"SV-77831r2_rule\",\"WN10-CC-000360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xCK9AnopZ/PLEiEfFd+fF29a3GvfMV+H4kBtncaC+w4=\"},\"SV-104549r1_rule\",\"WN10-CC-000365\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QBQK/tnwXZkWJDaqU/JtL7zWbHA0F4hsxCD2qrMtB98=\"},\"SV-108663r1_rule\",\"WN10-CC-000370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:d1pbzJigO85rKAMstf6sSkdP/ACDK1pRyqaLfXxwivI=\"},\"SV-108665r1_rule\",\"WN10-CC-000385\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rD1r31DjrTFhcjSKe05lznNWs43/fc9RD+ZPg5DX/ZA=\"},\"SV-108667r1_rule\",\"WN10-CC-000390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wZQbFTwW94OSVmQOtJRreFTXD/cIx6cp6SMGeIT/5Q0=\"},\"SV-91787r3_rule\",\"WN10-EP-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:seoeJ0TVdyPF1IZOglTdU3YY9kcGzHzPhCDGtAE3tkM=\"},\"SV-91791r4_rule\",\"WN10-EP-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I4uQfS2NjZHDkDdoRvwEOJ9Cn5UEOwkvBoMVv0IlL4w=\"},\"SV-91793r3_rule\",\"WN10-EP-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kFzIaNPWT2wqsaqKjSiKaNxW40sevexLR9vPMcm9edQ=\"},\"SV-91797r3_rule\",\"WN10-EP-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:g7RfvBxx636aPhixMi/6iDCzMbVFIx9shebxkreQe48=\"},\"SV-91799r3_rule\",\"WN10-EP-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/kelpkvOVtEhlqeho3DqaACavzCa3fwBSBE55Uza0+E=\"},\"SV-91885r5_rule\",\"WN10-EP-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MubhtefZIzGkvhlY2PmYFuDlH+8Uqku0fltszVjOuxU=\"},\"SV-91887r5_rule\",\"WN10-EP-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fg2f0FG3EIVUBqMtVXqVYKHERgkwZW3I0YbnLTVAsX8=\"},\"SV-91891r4_rule\",\"WN10-EP-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pNmbpGc9jee+bzjZjzmnqgZeocNv6buCv3Ipvsb5pXo=\"},\"SV-91897r5_rule\",\"WN10-EP-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:spszjT7BTTddnp6oFJqi/T4F3rA0UBbm/6GzPBqBcWo=\"},\"SV-91901r5_rule\",\"WN10-EP-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mtl2VgiudtjEJVh9KeXvbi749Hr3urnyB+DwqMQJz2Y=\"},\"SV-91905r5_rule\",\"WN10-EP-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LsXrxcaxVB8zrRJjNYRpPBfOKTGaqj32TPrT80sjdFE=\"},\"SV-91909r5_rule\",\"WN10-EP-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:amDpgsaRxthlet+rsvJeTvWJu1llLyepQcXyc5K4O7w=\"},\"SV-91913r5_rule\",\"WN10-EP-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lY+AXYfe/AluR4WGTqo0FEqJ5tSSl5HZ39f56ylKTs4=\"},\"SV-91917r5_rule\",\"WN10-EP-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fe/FsLxtBWOXdM4WX+ESyWqxz8i/+CYiH84HrxQGTKM=\"},\"SV-91919r5_rule\",\"WN10-EP-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mh9IH1clzy+A1OOIBzjvUuybaU9xSwmJekh7crMQoVI=\"},\"SV-91923r5_rule\",\"WN10-EP-000170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dEwmjiXxS3GnMegQ2bUU71KYoXG5Dd/AZ7wdyDMWJGQ=\"},\"SV-91927r5_rule\",\"WN10-EP-000180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xgIlihjGuLyZbqGDLM1SWEpzSqmldIb/KD1X6dqFPeQ=\"},\"SV-91929r5_rule\",\"WN10-EP-000190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lILMjdtbWDfww7YCEZdpYCS81lAL+dJlad4M/TVlfcQ=\"},\"SV-91935r5_rule\",\"WN10-EP-000200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5Ph3UBC9p+Akj+j+IR75pArMHpuq1OdgoJE3yVDf11E=\"},\"SV-91931r5_rule\",\"WN10-EP-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GXA5f/UA68emJFB8jqN9ewGYIe84bEvyYg7xSGas3I4=\"},\"SV-91939r5_rule\",\"WN10-EP-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MUCQyakZZLfc2Ap5HiFf5ipmQj0p92vkKHKV9h/lKZA=\"},\"SV-91941r4_rule\",\"WN10-EP-000230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Tc2J0p3mLuCyswLMHwCyLpY+3kVedt6NP6VLBTCWYjA=\"},\"SV-91943r5_rule\",\"WN10-EP-000240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MQNLsBE4TEp2/6ROgBSTJO9fJkNfyMcnLhI9YtT5BXI=\"},\"SV-91945r5_rule\",\"WN10-EP-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pHMGWcsdxpl8Z+8pYTfwp4+n7EAO3II6SBPoR0qmkV8=\"},\"SV-91951r5_rule\",\"WN10-EP-000260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8vOgdCfinZFo71HQ6cBJRAa/ITYhJrZWDk+MZttTzFg=\"},\"SV-91955r5_rule\",\"WN10-EP-000270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wzRqhQROBVJlE1q3nxtUM1GkAJigG01hupg8bXE1iSA=\"},\"SV-91959r5_rule\",\"WN10-EP-000280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/mZrNq1dEWU1tMYc71JTRfkRtNHkdPGHX2E03f0Jppc=\"},\"SV-91963r5_rule\",\"WN10-EP-000290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i7E2vv6pd35hawlK+qV+2UpXcaVnUkBR1V3CR/Rcg7M=\"},\"SV-91965r5_rule\",\"WN10-EP-000300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vk0EeybuvPD5mu6kz6fCWWqDopo0zsPMlVMjqvlYb5I=\"},\"SV-108661r1_rule\",\"WN10-EP-000310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vBYNU1MOZTMT14yG0uwLTnJNZd27pnHRrsvC0HPMX0s=\"},\"SV-78069r4_rule\",\"WN10-PK-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4xWh6wamWmIOeIO59RNtRdwcCFtu7mD7qVIiEWhU49I=\"},\"SV-78073r3_rule\",\"WN10-PK-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FKy5u6ln+y0mzvOV4HzwGH2CwpZj3IQ2DhcZHGowfYk=\"},\"SV-78077r6_rule\",\"WN10-PK-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VNS7bkHAgOyfB6SjEoQf8o+x0lzbHQcxS5EZbR1kz64=\"},\"SV-78079r5_rule\",\"WN10-PK-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+gNTwi6NPYxK/l/EIlkhsqMLUMX3yk8p8qOXrOuTUD8=\"},\"SV-78083r2_rule\",\"WN10-RG-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gu4gtZX1rR01eoH7S8OImC8dbc8fZ9Js8wyj3Hq8AQA=\"},\"SV-78091r1_rule\",\"WN10-SO-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3H53KZC2kWuaeW6IYY71llirhuaVVZpEWoqEEkwfsC4=\"},\"SV-78101r1_rule\",\"WN10-SO-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:J5uvaJtjjYnwV4ewXXHS2Y/F1moPfjj95l8OgEmAcHg=\"},\"SV-78107r1_rule\",\"WN10-SO-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CgDvkF7Lpc1r6ZB1knUBa/Na6DAh5qTekx4xkJVDJKU=\"},\"SV-78109r1_rule\",\"WN10-SO-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Sp6+sZWFJ+5qIfMxuZM1X4FQ9Q3VaCCrivEnw2hO+VE=\"},\"SV-78115r1_rule\",\"WN10-SO-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h25vRZXLu1TOtMH5HMSKvo8N5a+Q/ueTRDZ1vspmoQE=\"},\"SV-78125r1_rule\",\"WN10-SO-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XPkkPkWSdvWEzxDy2sUWix6KC7aJBbG9RBZ/ZnYOGEs=\"},\"SV-78129r1_rule\",\"WN10-SO-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wy/VGGvzW3UlJ37hiY+I8pUms7MXbP2SNpPKfNy1KIA=\"},\"SV-78133r1_rule\",\"WN10-SO-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/cJizcUtpE2HLtuWkhVN3GiOSFjewXuYn9IJu3enAXg=\"},\"SV-78137r1_rule\",\"WN10-SO-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:z2vvY1cDmkJvQsHfPOfw8QGJtMOKrIQz9lM3Dc0ytLo=\"},\"SV-78143r1_rule\",\"WN10-SO-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LaaMQgJOQrkO4EB1mnVDnZdeYz6iDashNKpqfHpNCck=\"},\"SV-78151r1_rule\",\"WN10-SO-000055\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kcyr2a0EWEiUBvmVmyDq0M6j4K7/nBHuXmLhXDDtMf0=\"},\"SV-78155r1_rule\",\"WN10-SO-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mhjrBvHTfJT/OuyLZFDHWxfbvJ3FuijQKPyHh2cvxks=\"},\"SV-78159r2_rule\",\"WN10-SO-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XgzulLjMBxHaNi0V9FHGyZ4It0yWcGbG1JwlFE+T+gk=\"},\"SV-78165r2_rule\",\"WN10-SO-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PHPF3Sy5sq6u5phRafA9yRglmtGg7XcKsUmsucub7jI=\"},\"SV-78171r1_rule\",\"WN10-SO-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OtsqfrQg9GojUClvvmL4jzwvRg7kIHzjol+WcskfN8k=\"},\"SV-78177r1_rule\",\"WN10-SO-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v8lM7FP7aQdAEqhdWAElG8v5N9aKZNjsXI3sO16UBJ8=\"},\"SV-78187r1_rule\",\"WN10-SO-000095\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YHHxKYwoRYjDWym4IH18cuhmeP93GyehRyGY9+eWOlM=\"},\"SV-78193r1_rule\",\"WN10-SO-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I1hZ4Drt9YDDg3F9ZAzn33a90Yrg1/tAw/QcCCksE3A=\"},\"SV-78201r1_rule\",\"WN10-SO-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m4mVWgszCk8aLeRg9wcZWG+Rs/f7KjQGvMB6lRJ5A+M=\"},\"SV-78209r1_rule\",\"WN10-SO-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5oFtb8E3qwiXU282gaObtdqYpKDg1HKwTV1n0yGLwdM=\"},\"SV-78229r1_rule\",\"WN10-SO-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:q4amaRBeQBzWaWDuh+jg7+M6Q2vE1slnyWZ9vRYL1BU=\"},\"SV-78235r1_rule\",\"WN10-SO-000145\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PH+4N2yTf3KYeI3LzoMmv9I7NMVl4gENYVtdt5aHEQ4=\"},\"SV-78239r1_rule\",\"WN10-SO-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PPMakW1bUBUuTQXNZEWFXjV3n8bqxzcAep6WCv0LA6I=\"},\"SV-78245r1_rule\",\"WN10-SO-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+CqVPSzadLgqURUz9jpa2vfnE9s9rDLe5PbBuASRgh0=\"},\"SV-78249r1_rule\",\"WN10-SO-000165\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bnGEzcuJUAwCNZ4Ws5wyS5j2lY5Jgzk6QrlcnBXgb8o=\"},\"SV-86393r3_rule\",\"WN10-SO-000167\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m79WMkHt8ZOH03cNAv+YgwDxku23Nclna/dukfCHBwE=\"},\"SV-78255r1_rule\",\"WN10-SO-000180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bu7KdaDw/5/s3TIiuDAAhnNsO3EvwivuJyQ8TxBRC2k=\"},\"SV-78257r1_rule\",\"WN10-SO-000185\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WBduyUoS7ji0lJWOQsFV1TVIPhzv+GArzEJ9SaioyCg=\"},\"SV-78285r1_rule\",\"WN10-SO-000190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:esvIIQzIXuuV6UAZCui3VcV9VGJeNpc//UNi3KoTS1w=\"},\"SV-78287r1_rule\",\"WN10-SO-000195\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5qXivRds1q8g/9HnQ9nxJHz6twXtapACZhIt29psYMg=\"},\"SV-78291r1_rule\",\"WN10-SO-000205\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YGadfMPpS3VMGBFW+r3ZcBbI9dYCCdc/zyMG4vKxtCU=\"},\"SV-78293r1_rule\",\"WN10-SO-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wPbkf7isP1x09ZPgzKuJL8TtdkHaTA1/d8tDtGfpybs=\"},\"SV-78295r1_rule\",\"WN10-SO-000215\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gvDKD+YMxXb3Dbh+NdpQ/LmlaxOytN56P+kbBAhz7EA=\"},\"SV-78297r1_rule\",\"WN10-SO-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QgLpxb9vltYJFW7KY8eBS23IB732VOg5sO/3heYiTSY=\"},\"SV-78301r1_rule\",\"WN10-SO-000230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QiljZhB01LqOQfbiDH4gdszZSQwiokE7rvHMNETmntI=\"},\"SV-78305r1_rule\",\"WN10-SO-000240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9xKCBYF3X03GOrS60NZkKP1tRU65uLNh/SvSEhv7qzY=\"},\"SV-78307r1_rule\",\"WN10-SO-000245\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6anIfcvLd9P3Qqj21QYsvMEK1vkh6OjqA8kxfY/qKRI=\"},\"SV-78309r1_rule\",\"WN10-SO-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aGZaMr7JCYhdhYIbyDmHK2zx8fjqDpXXjEY01sUoNo4=\"},\"SV-111577r1_rule\",\"WN10-SO-000251\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2Mf6LpRtxqJ2Xi014C6XdUKrfkVm1If47khfoSg5IPk=\"},\"SV-78311r1_rule\",\"WN10-SO-000255\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xIxQC3EFtKo4/I03k/uVVwqUkFC9effmNV1HiiiVNas=\"},\"SV-78315r1_rule\",\"WN10-SO-000260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8HK3jPasJRJpBZDqSPFQU1vxUyg5+aAI6SAka9PPlvc=\"},\"SV-78317r1_rule\",\"WN10-SO-000265\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TXh7CT8eDFg9PQd3GuTWW0B0BM4p6bzG9FF1T+9Vv8s=\"},\"SV-78319r1_rule\",\"WN10-SO-000270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jTdDk2qrsY7wk2fxd9JsCbcokx4k7p+QSN/VYmbUB9k=\"},\"SV-78321r1_rule\",\"WN10-SO-000275\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WiWO+yrYgzS9BRfJ95tCnETPOIU/k/YYuPYQakQM+IM=\"},\"SV-108659r2_rule\",\"WN10-SO-000280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ewDvbXkRfIkCeWiNsw3OWO1nlDe4SsgnCecA5Am1j5Q=\"},\"SV-96851r1_rule\",\"WN10-UC-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ps+f+j5cOJetWmfgZFHPTjOUfHH002d19GW01SZ35RY=\"},\"SV-78329r1_rule\",\"WN10-UC-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:31JR/6WQp6TuKxIQqNorrp6RBoUM0yhGJ95MVdPpzUw=\"},\"SV-78331r2_rule\",\"WN10-UC-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4Q6F4dio1jN4MtIZbfGfkZnYkN6zfJazb6nB793l6nQ=\"},\"SV-78333r1_rule\",\"WN10-UR-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:at5fqeVaC1Sm9FnXQjZ7YLh8ehuVr9z5FoeJZMIMABA=\"},\"SV-78335r3_rule\",\"WN10-UR-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8xkuF4nDSjRiPP+9oGCPnfWYPGGSOi17d7FbL0XhlU0=\"},\"SV-78337r1_rule\",\"WN10-UR-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dq7TXJZ0aBQkd+AjwMgoDVp+n4UvOG8n1gEF82FEBlE=\"},\"SV-78341r2_rule\",\"WN10-UR-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KEKE0PGxslNV0A6vemAzaWjzbx9nYy/RbiPhNJ3aL20=\"},\"SV-78343r1_rule\",\"WN10-UR-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cDiaxsqIK6oeD+TiOA04U8bzW/Xipep+PGUIszW1Ddg=\"},\"SV-78345r2_rule\",\"WN10-UR-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Wzi+dcfocDaL/BL8ZywSuiDTEG4Zv3kI5qdXUcl3y8E=\"},\"SV-78347r1_rule\",\"WN10-UR-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m3olQQDR+ylJqlRWob7mYvRuzE60jAwPG6gvqc+QNq4=\"},\"SV-78349r1_rule\",\"WN10-UR-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:srfyN9VEgB5cnpXOBY292RFK5lJspJquvD0ZD4TIQLE=\"},\"SV-78351r1_rule\",\"WN10-UR-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KcAj9nx0K1Jq/IEktNS9qbRss/b4npcbS1XEQ+S/Xm0=\"},\"SV-78353r1_rule\",\"WN10-UR-000055\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3c6IOQPBsJcn8+IGDfwZ5oHJ/hbHObilnQESAeOLePs=\"},\"SV-78355r2_rule\",\"WN10-UR-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PgmqvkJqmLhRaPCQpSZZxUPFDDIdB1muY7/23B1nyZM=\"},\"SV-78359r1_rule\",\"WN10-UR-000065\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qj88J123Y6ALiPB3Uh+vm0KvR68nqjRVdYVnlzC1rII=\"},\"SV-78361r3_rule\",\"WN10-UR-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gRYqjlzcylziTXB0rod7QdHFL/L5BST/gimkIhHW/vk=\"},\"SV-78363r1_rule\",\"WN10-UR-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Hn5uwnn6gC1VwYXthEGUgC6ziFRTZscKIoUS++3Rjto=\"},\"SV-78365r2_rule\",\"WN10-UR-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XTQwo3vFeHtIVTshIduv4IWitfBFRakuEQXlLRuSS24=\"},\"SV-78367r2_rule\",\"WN10-UR-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oDnTVUc7IVAYvvMQbb1Wz03I5+3OQ5gnInH/2FTM+UQ=\"},\"SV-78369r4_rule\",\"WN10-UR-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HCUwYAohklOWhKjdCkwUXELBicl1aKdYsLlX2ENO5ZQ=\"},\"SV-78371r1_rule\",\"WN10-UR-000095\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h8rwAYISD/28YdzSDaeuG5FpPZBqNPB9wT86XIfoUdE=\"},\"SV-78373r1_rule\",\"WN10-UR-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8ZljbVob0XqSwiA5dOYkrIecCXdmnQCug5ybd0v/x1Q=\"},\"SV-78379r1_rule\",\"WN10-UR-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zxCJ1n+/xpv4SXNOQLm6wAQSmkH1udVPy4xRJNH22s0=\"},\"SV-78407r1_rule\",\"WN10-UR-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pvOcEpA+TB34F4cWCOGMSfSEkxZAfBUxITpDJmb9+K4=\"},\"SV-78415r1_rule\",\"WN10-UR-000125\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ntgurAdRh2vPTZ6v6uIm1vEBH6EsSEipSMq20DsG+D8=\"},\"SV-78417r1_rule\",\"WN10-UR-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zpJA36QZjPMfklit+NRW9GEdI9+UG+zGf4DOGG8XG6Y=\"},\"SV-78421r1_rule\",\"WN10-UR-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6Vr6sSumF5z/+2j4Jut2d6KaK1Nl8c/eF71h3mZz84s=\"},\"SV-78423r1_rule\",\"WN10-UR-000145\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U1jQim/n6VHAUZXYJaQi/HWtt7Q3k/5g/dZtKPgRpRQ=\"},\"SV-78425r1_rule\",\"WN10-UR-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F0RPJGfwD1qORt7UmHAIsqA20ktqswUXeKiEMO4DFEw=\"},\"SV-78429r1_rule\",\"WN10-UR-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hO/PQW/5C6I5rdjEwZhLARaC8GglwdI3lTW+tbXMeS4=\"},\"SV-78431r1_rule\",\"WN10-UR-000165\"]\n{\"table\":\"stig\",\"columns\":\"`benchmarkId`,`title`\",\"rowCount\":5}\n[\"RHEL_7_STIG_TEST\",\"Red Hat Enterprise Linux 7 Security Technical Implementation Guide\"]\n[\"VPN_SRG_TEST\",\"Virtual Private Network (VPN) Security Requirements Guide\"]\n[\"VPN_SRG_OTHER\",\"Virtual Private Network (VPN) Security Requirements Guide - replaced\"]\n[\"VPN_SRG_Rule-fingerprint-match-test\",\"Virtual Private Network (VPN) Security Requirements Guide - replaced\"]\n[\"Windows_10_STIG_TEST\",\"Windows 10 Security Technical Implementation Guide\"]\n{\"table\":\"stig_asset_map\",\"columns\":\"`accepted`,`acceptedResultEngine`,`assessedHighCount`,`assessedLowCount`,`assessedMediumCount`,`assetId`,`benchmarkId`,`error`,`errorResultEngine`,`fail`,`failResultEngine`,`fixed`,`fixedResultEngine`,`highCount`,`informational`,`informationalResultEngine`,`lowCount`,`maxTouchTs`,`maxTs`,`mediumCount`,`minTs`,`notapplicable`,`notapplicableResultEngine`,`notchecked`,`notcheckedResultEngine`,`notselected`,`notselectedResultEngine`,`pass`,`passResultEngine`,`rejected`,`rejectedResultEngine`,`saId`,`saved`,`savedResultEngine`,`submitted`,`submittedResultEngine`,`unknown`,`unknownResultEngine`,`userIds`\",\"rowCount\":6}\n[0,0,0,1,5,42,\"VPN_SRG_TEST\",0,0,3,0,0,0,0,0,0,1,\"2022-02-03 00:07:07\",\"2022-02-03 00:07:05\",2,\"2020-08-11 22:27:26\",1,0,0,0,0,0,2,0,0,0,1064,1,0,5,0,0,0,\"[85]\"]\n[0,0,0,0,3,42,\"Windows_10_STIG_TEST\",0,0,1,0,0,0,0,0,0,0,\"2020-08-18 20:48:29\",\"2020-08-18 20:48:29\",1,\"2020-08-11 22:29:16\",0,0,0,0,0,0,2,0,0,0,1065,1,0,2,0,0,0,\"[86]\"]\n[0,0,0,0,3,62,\"VPN_SRG_TEST\",0,0,1,0,0,0,0,0,0,0,\"2022-01-26 01:23:06\",\"2022-01-26 01:23:06\",1,\"2020-08-11 23:37:48\",2,0,0,0,0,0,0,0,0,0,1066,1,0,2,0,0,0,\"[]\"]\n[0,0,0,0,0,62,\"Windows_10_STIG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,1067,0,0,0,0,0,0,\"[]\"]\n[0,0,0,0,0,153,\"VPN_SRG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,1068,0,0,0,0,0,0,\"[]\"]\n[0,0,0,0,0,240,\"VPN_SRG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,1069,0,0,0,0,0,0,\"[]\"]\n{\"table\":\"user_data\",\"columns\":\"`created`,`lastAccess`,`lastClaims`,`status`,`statusDate`,`statusUser`,`userId`,`username`,`webPreferences`\",\"rowCount\":10}\n[\"2024-10-23 10:03:48\",1744054041,\"{\\\"acr\\\": \\\"0\\\", \\\"aud\\\": [\\\"realm-management\\\", \\\"account\\\"], \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1864681035, \\\"iat\\\": 1670540236, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman\\\", \\\"jti\\\": \\\"47f9aa7d-bac4-4098-9be8-ace75513aa7f\\\", \\\"sid\\\": \\\"87365b33-2c76-4b3c-8485-fba5dbff4b9f\\\", \\\"sub\\\": \\\"b7c78a62-b84f-4578-a983-2ebc66fd9efe\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"name\\\": \\\"STIGMAN Admin\\\", \\\"nonce\\\": \\\"3378daff-0404-43b3-b4ab-ee31ff7340ac\\\", \\\"scope\\\": \\\"openid stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:op stig-manager:collection:read stig-manager:op:read stig-manager:user stig-manager stig-manager:stig\\\", \\\"auth_time\\\": 1670540235, \\\"given_name\\\": \\\"STIGMAN\\\", \\\"family_name\\\": \\\"Admin\\\", \\\"realm_access\\\": {\\\"roles\\\": [\\\"create_collection\\\", \\\"default-roles-stigman\\\", \\\"admin\\\"]}, \\\"session_state\\\": \\\"87365b33-2c76-4b3c-8485-fba5dbff4b9f\\\", \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}, \\\"realm-management\\\": {\\\"roles\\\": [\\\"view-users\\\", \\\"query-groups\\\", \\\"query-users\\\"]}}, \\\"preferred_username\\\": \\\"stigmanadmin\\\"}\",\"available\",\"2024-10-23 10:03:48\",null,1,\"stigmanadmin\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:03:48\",1705546498,\"{\\\"acr\\\": \\\"0\\\", \\\"aud\\\": [\\\"realm-management\\\", \\\"account\\\"], \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1864709074, \\\"iat\\\": 1670568275, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman\\\", \\\"jti\\\": \\\"03f49efc-cc71-4712-9ac7-14f9c6b475da\\\", \\\"sid\\\": \\\"c6e2e826-1333-4f07-9788-79410c9f2d06\\\", \\\"sub\\\": \\\"c137d637-f056-4c72-9bef-ec2af7c1abc7\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"name\\\": \\\"lvl2\\\", \\\"nonce\\\": \\\"49369e7f-a2df-491a-8b44-a042caf238ec\\\", \\\"scope\\\": \\\"openid stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:collection:read\\\", \\\"auth_time\\\": 1670568274, \\\"given_name\\\": \\\"lvl2\\\", \\\"realm_access\\\": {\\\"roles\\\": [\\\"default-roles-stigman\\\"]}, \\\"session_state\\\": \\\"c6e2e826-1333-4f07-9788-79410c9f2d06\\\", \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}, \\\"realm-management\\\": {\\\"roles\\\": [\\\"view-users\\\", \\\"query-groups\\\", \\\"query-users\\\"]}}, \\\"preferred_username\\\": \\\"lvl2\\\"}\",\"available\",\"2024-10-23 10:03:48\",null,21,\"lvl2\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:03:48\",null,\"{}\",\"available\",\"2024-10-23 10:03:48\",null,22,\"wf-test\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:03:48\",null,\"{}\",\"available\",\"2024-10-23 10:03:48\",null,43,\"workforce-60\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:03:48\",1705546498,\"{\\\"acr\\\": \\\"0\\\", \\\"aud\\\": [\\\"realm-management\\\", \\\"account\\\"], \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1864709125, \\\"iat\\\": 1670568325, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman\\\", \\\"jti\\\": \\\"852926ff-1c38-4006-960b-d9a4bca271f9\\\", \\\"sid\\\": \\\"318d8cff-0ce5-4739-812c-b5b467e1d6c1\\\", \\\"sub\\\": \\\"35fabc06-076e-4ff4-8bde-f325ea7dd4fb\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"nonce\\\": \\\"416c0bbd-2f69-4fd0-82a5-7cd0f6de7535\\\", \\\"scope\\\": \\\"openid stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:collection:read\\\", \\\"auth_time\\\": 1670568325, \\\"realm_access\\\": {\\\"roles\\\": [\\\"default-roles-stigman\\\"]}, \\\"session_state\\\": \\\"318d8cff-0ce5-4739-812c-b5b467e1d6c1\\\", \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}, \\\"realm-management\\\": {\\\"roles\\\": [\\\"view-users\\\", \\\"query-groups\\\", \\\"query-users\\\"]}}, \\\"preferred_username\\\": \\\"lvl3\\\"}\",\"available\",\"2024-10-23 10:03:48\",null,44,\"lvl3\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:03:48\",1705546498,\"{\\\"acr\\\": \\\"0\\\", \\\"aud\\\": [\\\"realm-management\\\", \\\"account\\\"], \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1864709163, \\\"iat\\\": 1670568364, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman\\\", \\\"jti\\\": \\\"7180f59c-d4d3-442f-b5e5-76f120a947aa\\\", \\\"sid\\\": \\\"bf4ccf4c-7e40-47b6-b02b-cfd09d71989f\\\", \\\"sub\\\": \\\"902cfa46-61b3-49a7-8e8a-6f70a93c2a97\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"name\\\": \\\"lvl4\\\", \\\"nonce\\\": \\\"1eaa8441-dafb-4a93-87ff-1d73437e0eca\\\", \\\"scope\\\": \\\"openid stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:collection:read\\\", \\\"auth_time\\\": 1670568363, \\\"given_name\\\": \\\"lvl4\\\", \\\"realm_access\\\": {\\\"roles\\\": [\\\"default-roles-stigman\\\"]}, \\\"session_state\\\": \\\"bf4ccf4c-7e40-47b6-b02b-cfd09d71989f\\\", \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}, \\\"realm-management\\\": {\\\"roles\\\": [\\\"view-users\\\", \\\"query-groups\\\", \\\"query-users\\\"]}}, \\\"preferred_username\\\": \\\"lvl4\\\"}\",\"available\",\"2024-10-23 10:03:48\",null,45,\"lvl4\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:03:48\",1705546498,\"{\\\"acr\\\": \\\"0\\\", \\\"aud\\\": [\\\"realm-management\\\", \\\"account\\\"], \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1864709200, \\\"iat\\\": 1670568400, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman\\\", \\\"jti\\\": \\\"da751cd7-b1bd-481d-9e81-57a47a6f4eb8\\\", \\\"sid\\\": \\\"b6dcf279-8fb4-444b-8506-2f48d2a763bd\\\", \\\"sub\\\": \\\"dd48f19e-81f0-44cf-a418-c4de98b6b783\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"name\\\": \\\"collection creator\\\", \\\"nonce\\\": \\\"227ee242-1bbb-4b56-86fa-67ef646edc93\\\", \\\"scope\\\": \\\"openid stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:collection:read\\\", \\\"auth_time\\\": 1670568400, \\\"given_name\\\": \\\"collection\\\", \\\"family_name\\\": \\\"creator\\\", \\\"realm_access\\\": {\\\"roles\\\": [\\\"create_collection\\\", \\\"default-roles-stigman\\\"]}, \\\"session_state\\\": \\\"b6dcf279-8fb4-444b-8506-2f48d2a763bd\\\", \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}, \\\"realm-management\\\": {\\\"roles\\\": [\\\"view-users\\\", \\\"query-groups\\\", \\\"query-users\\\"]}}, \\\"preferred_username\\\": \\\"collectioncreator\\\"}\",\"available\",\"2024-10-23 10:03:48\",null,82,\"collectioncreator\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:03:48\",1705546498,\"{\\\"acr\\\": \\\"1\\\", \\\"aud\\\": [\\\"realm-management\\\", \\\"account\\\"], \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1864708984, \\\"iat\\\": 1670568184, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman\\\", \\\"jti\\\": \\\"108f0760-0bf9-4df1-b143-96836bfbc363\\\", \\\"sid\\\": \\\"b4a3acf1-9dc7-45e1-98f8-d35362aec4c7\\\", \\\"sub\\\": \\\"e3ae27b8-da20-4c42-9df8-6089f70f763b\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"name\\\": \\\"restricted\\\", \\\"nonce\\\": \\\"14fa9d7d-0fe0-4426-8fd9-69d74a6f3464\\\", \\\"scope\\\": \\\"openid stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:collection:read\\\", \\\"auth_time\\\": 1670568184, \\\"given_name\\\": \\\"restricted\\\", \\\"realm_access\\\": {\\\"roles\\\": [\\\"default-roles-stigman\\\"]}, \\\"session_state\\\": \\\"b4a3acf1-9dc7-45e1-98f8-d35362aec4c7\\\", \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}, \\\"realm-management\\\": {\\\"roles\\\": [\\\"view-users\\\", \\\"query-groups\\\", \\\"query-users\\\"]}}, \\\"preferred_username\\\": \\\"lvl1\\\"}\",\"available\",\"2024-10-23 10:03:48\",null,85,\"lvl1\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:03:48\",null,\"{}\",\"available\",\"2024-10-23 10:03:48\",null,86,\"bizarroLvl1\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:03:48\",1773096373,\"{\\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 2057787828, \\\"iat\\\": 1742427828, \\\"iss\\\": \\\"http://localhost:8080/realms/stigman\\\", \\\"jti\\\": \\\"fb064b55-c896-4e57-a697-8ef4f153cb6d\\\", \\\"sid\\\": \\\"38a7409c-4a63-4311-ab62-5de78f573d5c\\\", \\\"sub\\\": \\\"bf87a16f-39e6-46d9-8971-f0ef51dd3f85\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"name\\\": \\\"Admin Burke\\\", \\\"scope\\\": \\\"stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:op stig-manager:user stig-manager:stig\\\", \\\"auth_time\\\": 1742427221, \\\"given_name\\\": \\\"Admin\\\", \\\"family_name\\\": \\\"Burke\\\", \\\"realm_access\\\": {\\\"roles\\\": [\\\"create_collection\\\", \\\"admin\\\"]}, \\\"preferred_username\\\": \\\"admin\\\"}\",\"available\",\"2024-10-23 10:03:48\",null,87,\"admin\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n{\"table\":\"user_group\",\"columns\":\"`createdDate`,`createdUserId`,`description`,`modifiedDate`,`modifiedUserId`,`name`,`userGroupId`\",\"rowCount\":0}\n{\"table\":\"user_group_user_map\",\"columns\":\"`ugumId`,`userGroupId`,`userId`\",\"rowCount\":0}\n"
  },
  {
    "path": "test/api/appdata/appdata.jsonl",
    "content": "{\"version\":\"1.6.2\",\"commit\":{\"branch\":\"na\",\"sha\":\"na\",\"tag\":\"na\",\"describe\":\"na\"},\"date\":\"2026-03-09T22:46:17.627Z\",\"lastMigration\":46}\n{\"tables\":[{\"table\":\"asset\",\"rowCount\":16},{\"table\":\"check_content\",\"rowCount\":614},{\"table\":\"collection\",\"rowCount\":8},{\"table\":\"collection_grant\",\"rowCount\":24},{\"table\":\"collection_grant_acl\",\"rowCount\":4},{\"table\":\"collection_label\",\"rowCount\":3},{\"table\":\"collection_label_asset_map\",\"rowCount\":3},{\"table\":\"collection_rev_map\",\"rowCount\":0},{\"table\":\"current_rev\",\"rowCount\":5},{\"table\":\"default_rev\",\"rowCount\":8},{\"table\":\"fix_text\",\"rowCount\":615},{\"table\":\"rev_group_rule_cci_map\",\"rowCount\":844},{\"table\":\"rev_group_rule_map\",\"rowCount\":620},{\"table\":\"review\",\"rowCount\":20},{\"table\":\"review_history\",\"rowCount\":7},{\"table\":\"revision\",\"rowCount\":5},{\"table\":\"rule_version_check_digest\",\"rowCount\":618},{\"table\":\"stig\",\"rowCount\":5},{\"table\":\"stig_asset_map\",\"rowCount\":17},{\"table\":\"user_data\",\"rowCount\":10},{\"table\":\"user_group\",\"rowCount\":1},{\"table\":\"user_group_user_map\",\"rowCount\":1}],\"totalRows\":3448}\n{\"table\":\"asset\",\"columns\":\"`assetId`,`collectionId`,`description`,`fqdn`,`ip`,`mac`,`metadata`,`name`,`noncomputing`,`state`,`stateDate`,`stateUserId`\",\"rowCount\":16}\n[29,21,\"\",null,\"10.0.0.18\",null,\"{}\",\"ACHERNAR_Collection_X_asset\",false,\"enabled\",null,null]\n[34,1,\"test desc\",null,\"1.1.1.1\",null,\"{}\",\"test asset stigmanadmin\",true,\"enabled\",null,null]\n[38,1,\"\",null,\"10.0.0.27\",null,\"{}\",\"FOMALHAUT\",false,\"enabled\",null,null]\n[42,21,\"\",null,\"\",null,\"{\\\"testkey\\\": \\\"testvalue\\\"}\",\"Collection_X_lvl1_asset-1\",true,\"enabled\",null,null]\n[62,21,\"\",null,\"10.1.1.1\",null,\"{}\",\"Collection_X_asset\",false,\"enabled\",null,null]\n[153,83,\"\",null,\"\",null,\"{}\",\"Collection_Y_lvl_1_asset-1\",false,\"enabled\",null,null]\n[154,21,\"\",null,\"\",null,\"{}\",\"Collection_X_lvl1_asset-2\",false,\"enabled\",null,null]\n[240,83,\"\",null,\"\",null,\"{}\",\"Collection_Y_asset-noGrants\",false,\"enabled\",null,null]\n[241,1,\"test desc\",null,\"1.1.1.1\",null,\"{}\",\"test asset POST stigmanadmin\",true,\"enabled\",null,null]\n[242,85,\"\",null,\"\",null,\"{}\",\"testasset\",false,\"enabled\",null,null]\n[243,85,\"\",null,\"\",null,\"{}\",\"testasset111\",false,\"enabled\",null,null]\n[244,85,\"\",null,\"\",null,\"{}\",\"wat\",false,\"enabled\",null,null]\n[245,92,\"test desc\",null,\"\",null,\"{}\",\"testasset\",false,\"enabled\",null,null]\n[246,92,\"\",null,\"\",null,\"{}\",\"tesetest\",false,\"enabled\",null,null]\n[247,93,\"test desc\",\"\",\"1.1.1.1\",\"\",\"{}\",\"deletedAsset\",true,\"disabled\",\"2024-10-23 21:13:22\",87]\n[248,21,\"\",\"\",\"\",\"\",\"{}\",\"DeletedAsset\",false,\"disabled\",\"2025-05-30 21:07:55\",87]\n{\"table\":\"check_content\",\"columns\":\"`ccId`,`content`\",\"rowCount\":614}\n[1,\"Verify domain-joined systems are using Windows 10 Enterprise Edition 64-bit version.\\n\\nFor standalone systems, this is NA.\\n\\nOpen \\\"Settings\\\".\\n\\nSelect \\\"System\\\", then \\\"About\\\".\\n\\nIf \\\"Edition\\\" is not \\\"Windows 10 Enterprise\\\", this is a finding.\\n\\nIf \\\"System type\\\" is not \\\"64-bit operating system…\\\", this is a finding.\"]\n[2,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Installer\\\\\\n\\nValue Name: EnableUserControl\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[3,\"Verify domain-joined systems have a TPM enabled and ready for use.\\n\\nFor standalone systems, this is NA.\\n\\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nVerify the system has a TPM and is ready for use.\\nRun \\\"tpm.msc\\\".\\nReview the sections in the center pane.\\n\\\"Status\\\" must indicate it has been configured with a message such as \\\"The TPM is ready for use\\\" or \\\"The TPM is on and ownership has been taken\\\".\\nTPM Manufacturer Information - Specific Version = 2.0 or 1.2\\n\\nIf a TPM is not found or is not ready for use, this is a finding.\"]\n[4,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Installer\\\\\\n\\nValue Name: AlwaysInstallElevated\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[5,\"The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system.\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Installer\\\\\\n\\nValue Name: SafeForScripting\\n\\nValue Type: REG_DWORD\\nValue: 0 (or if the Value Name does not exist)\"]\n[6,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: DisableAutomaticRestartSignOn\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[7,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Client\\\\\\n\\nValue Name: AllowBasic\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[8,\"Verify all Windows 10 information systems (including SIPRNet) employ BitLocker for full disk encryption.\\n\\nFor virtual desktop implementations (VDIs) in which the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nIf full disk encryption using BitLocker is not implemented, this is a finding.\\n\\nVerify BitLocker is turned on for the operating system drive and any fixed data drives.\\n\\nOpen \\\"BitLocker Drive Encryption\\\" from the Control Panel.\\n\\nIf the operating system drive or any fixed data drives have \\\"Turn on BitLocker\\\", this is a finding.\\n\\nNOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).\"]\n[9,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Client\\\\\\n\\nValue Name: AllowUnencryptedTraffic\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[10,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Client\\\\\\n\\nValue Name: AllowDigest\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[11,\"Verify DoD approved HBSS software is installed, configured, and properly operating. Ask the operator to document the HBSS software installation and configuration.\\n\\nIf the operator is not able to provide a documented configuration for an installed HBSS or if the HBSS software is not properly configured, maintained, or used, this is a finding.\"]\n[12,\"This is applicable to unclassified systems; for other systems this is NA.\\n\\nVerify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. This must include packaged apps such as the universals apps installed by default on systems.\\n\\nIf an application whitelisting program is not in use on the system, this is a finding.\\n\\nConfiguration of whitelisting applications will vary by the program.\\n\\nAppLocker is a whitelisting application built into Windows 10 Enterprise.  A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules.\\n\\nIf AppLocker is used, perform the following to view the configuration of AppLocker:\\nRun \\\"PowerShell\\\".\\n\\nExecute the following command, substituting [c:\\\\temp\\\\file.xml] with a location and file name appropriate for the system:\\nGet-AppLockerPolicy -Effective -XML > c:\\\\temp\\\\file.xml\\n\\nThis will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review.\\n\\nImplementation guidance for AppLocker is available in the NSA paper \\\"Application Whitelisting using Microsoft AppLocker\\\" at the following link:\\n\\nhttps://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm\"]\n[13,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Service\\\\\\n\\nValue Name: AllowBasic\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[14,\"Run \\\"winver.exe\\\".\\n\\nIf the \\\"About Windows\\\" dialog box does not display:\\n\\n\\\"Microsoft Windows Version 1803 (OS Build 17134.0)\\\"\\n\\nor greater, this is a finding.\\n\\nNote: Microsoft has extended support for previous versions providing critical and important updates for Windows 10 Enterprise.\\n\\nMicrosoft scheduled end of support dates for current Semi-Annual Channel versions:\\nv1709 - 13 October 2020\\nv1803 - 10 November 2020\\nv1809 - 13 April 2021\\nv1903 - 8 December 2020\\n\\nNo preview versions will be used in a production environment.\\n\\nSpecial purpose systems using the Long-Term Servicing Branch\\\\Channel (LTSC\\\\B) may be at following versions which are not a finding:\\n\\nv1507 (Build 10240)\\nv1607 (Build 14393)\\nv1809 (Build 17763)\"]\n[15,\"Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution.\\n\\nIf there is no anti-virus solution installed on the system, this is a finding.\"]\n[16,\"Run \\\"Computer Management\\\".\\nNavigate to Storage >> Disk Management.\\n\\nIf the \\\"File System\\\" column does not indicate \\\"NTFS\\\" for each volume assigned a drive letter, this is a finding.\\n\\nThis does not apply to system partitions such the Recovery and EFI System Partition.\"]\n[17,\"Verify the system does not include other operating system installations.\\n\\nRun \\\"Advanced System Settings\\\".\\nSelect the \\\"Advanced\\\" tab.\\nClick the \\\"Settings\\\" button in the \\\"Startup and Recovery\\\" section.\\n\\nIf the drop-down list box \\\"Default operating system:\\\" shows any operating system other than Windows 10, this is a finding.\"]\n[18,\"Non system-created shares should not typically exist on workstations.\\n\\nIf only system-created shares exist on the system this is NA.\\n\\nRun \\\"Computer Management\\\".\\nNavigate to System Tools >> Shared Folders >> Shares.\\n\\nIf the only shares listed are \\\"ADMIN$\\\", \\\"C$\\\" and \\\"IPC$\\\", this is NA.\\n(Selecting Properties for system-created shares will display a message that it has been shared for administrative purposes.)\\n\\nRight click any non-system-created shares.\\nSelect \\\"Properties\\\".\\nSelect the \\\"Share Permissions\\\" tab.\\n\\nVerify the necessity of any shares found.\\nIf the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.\\n\\nSelect the \\\"Security\\\" tab.\\n\\nIf the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.\"]\n[19,\"Run \\\"PowerShell\\\".\\nCopy the lines below to the PowerShell window and enter.\\n\\n\\\"([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach {\\n   $user = ([ADSI]$_.Path)\\n   $lastLogin = $user.Properties.LastLogin.Value\\n   $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2\\n   if ($lastLogin -eq $null) {\\n      $lastLogin = 'Never'\\n   }\\n   Write-Host $user.Name $lastLogin $enabled \\n}\\\"\\n\\nThis will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False).\\nFor example: User1  10/31/2015  5:49:56  AM  True\\n\\nReview the list to determine the finding validity for each account reported.\\n\\nExclude the following accounts:\\nBuilt-in administrator account (Disabled, SID ending in 500)\\nBuilt-in guest account (Disabled, SID ending in 501)\\nBuilt-in DefaultAccount (Disabled, SID ending in 503)\\nLocal administrator account\\n\\nIf any enabled accounts have not been logged on to within the past 35 days, this is a finding.\\n\\nInactive accounts that have been reviewed and deemed to be required must be documented with the ISSO.\"]\n[20,\"Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Groups.\\nReview the members of the Administrators group.\\nOnly the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.\\n\\nFor domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.\\n\\nStandard user accounts must not be members of the local administrator group.\\n\\nIf prohibited accounts are members of the local administrators group, this is a finding.\\n\\nThe built-in Administrator account or other required administrative accounts would not be a finding.\"]\n[21,\"Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Groups.\\nReview the members of the Backup Operators group.\\n\\nIf the group contains no accounts, this is not a finding.\\n\\nIf the group contains any accounts, the accounts must be specifically for backup functions.\\n\\nIf the group contains any standard user accounts used for performing normal user tasks, this is a finding.\"]\n[22,\"If a hosted hypervisor (Hyper-V, VMware Workstation, etc.) is installed on the system, verify only authorized user accounts are allowed to run virtual machines.\\n\\nFor Hyper-V, Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Groups.\\nDouble click on \\\"Hyper-V Administrators\\\".\\n\\nIf any unauthorized groups or user accounts are listed in \\\"Members:\\\", this is a finding.\\n\\nFor hosted hypervisors other than Hyper-V, verify only authorized user accounts have access to run the virtual machines. Restrictions may be enforced by access to the physical system, software restriction policies, or access restrictions built in to the application.\\n\\nIf any unauthorized groups or user accounts have access to create or run virtual machines, this is a finding.\\n\\nAll users authorized to create or run virtual machines must be documented with the ISSM/ISSO. Accounts nested within group accounts must be documented as individual accounts and not the group accounts.\"]\n[23,\"Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Users.\\n\\nIf local users other than the accounts listed below exist on a workstation in a domain, this is a finding.\\n\\nBuilt-in Administrator account (Disabled)\\nBuilt-in Guest account (Disabled)\\nBuilt-in DefaultAccount (Disabled)\\nBuilt-in defaultuser0 (Disabled)\\nBuilt-in WDAGUtilityAccount (Disabled)\\nLocal administrator account(s)\\n\\nAll of the built-in accounts may not exist on a system, depending on the Windows 10 version.\"]\n[24,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Service\\\\\\n\\nValue Name: AllowUnencryptedTraffic\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[25,\"Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Users.\\nDouble click each active account.\\n\\nIf \\\"Password never expires\\\" is selected for any account, this is a finding.\"]\n[26,\"The default file system permissions are adequate when the Security Option \\\"Network access: Let Everyone permissions apply to anonymous users\\\" is set to \\\"Disabled\\\" (WN10-SO-000160).\\n\\nIf the default file system permissions are maintained and the referenced option is set to \\\"Disabled\\\", this is not a finding.\\n\\nVerify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)\\n\\nViewing in File Explorer:\\nSelect the \\\"Security\\\" tab, and the \\\"Advanced\\\" button.\\n\\nC:\\\\\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nAdministrators - Full control - This folder, subfolders and files\\nSYSTEM - Full control - This folder, subfolders and files\\nUsers - Read & execute - This folder, subfolders and files\\nAuthenticated Users - Modify - Subfolders and files only\\nAuthenticated Users - Create folders / append data - This folder only\\n\\n\\\\Program Files\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nTrustedInstaller - Full control - This folder and subfolders\\nSYSTEM - Modify - This folder only\\nSYSTEM - Full control - Subfolders and files only\\nAdministrators - Modify - This folder only\\nAdministrators - Full control - Subfolders and files only\\nUsers - Read & execute - This folder, subfolders and files\\nCREATOR OWNER - Full control - Subfolders and files only\\nALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files\\nALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders and files\\n\\n\\\\Windows\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nTrustedInstaller - Full control - This folder and subfolders\\nSYSTEM - Modify - This folder only\\nSYSTEM - Full control - Subfolders and files only\\nAdministrators - Modify - This folder only\\nAdministrators - Full control - Subfolders and files only\\nUsers - Read & execute - This folder, subfolders and files\\nCREATOR OWNER - Full control - Subfolders and files only\\nALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files\\nALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders and files\\n\\nAlternately use icacls.\\n\\nRun \\\"CMD\\\" as administrator.\\nEnter \\\"icacls\\\" followed by the directory.\\n\\nicacls c:\\\\\\nicacls \\\"c:\\\\program files\\\"\\nicacls c:\\\\windows\\n\\nThe following results will be displayed as each is entered:\\n\\nc:\\\\\\nBUILTIN\\\\Administrators:(OI)(CI)(F)\\nNT AUTHORITY\\\\SYSTEM:(OI)(CI)(F)\\nBUILTIN\\\\Users:(OI)(CI)(RX)\\nNT AUTHORITY\\\\Authenticated Users:(OI)(CI)(IO)(M)\\nNT AUTHORITY\\\\Authenticated Users:(AD)\\nMandatory Label\\\\High Mandatory Level:(OI)(NP)(IO)(NW)\\nSuccessfully processed 1 files; Failed processing 0 files\\n\\nc:\\\\program files \\nNT SERVICE\\\\TrustedInstaller:(F)\\nNT SERVICE\\\\TrustedInstaller:(CI)(IO)(F)\\nNT AUTHORITY\\\\SYSTEM:(M)\\nNT AUTHORITY\\\\SYSTEM:(OI)(CI)(IO)(F)\\nBUILTIN\\\\Administrators:(M)\\nBUILTIN\\\\Administrators:(OI)(CI)(IO)(F)\\nBUILTIN\\\\Users:(RX)\\nBUILTIN\\\\Users:(OI)(CI)(IO)(GR,GE)\\nCREATOR OWNER:(OI)(CI)(IO)(F)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES:(RX)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL RESTRICTED APPLICATION PACKAGES:(RX)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\\nSuccessfully processed 1 files; Failed processing 0 files\\n\\nc:\\\\windows\\nNT SERVICE\\\\TrustedInstaller:(F)\\nNT SERVICE\\\\TrustedInstaller:(CI)(IO)(F)\\nNT AUTHORITY\\\\SYSTEM:(M)\\nNT AUTHORITY\\\\SYSTEM:(OI)(CI)(IO)(F)\\nBUILTIN\\\\Administrators:(M)\\nBUILTIN\\\\Administrators:(OI)(CI)(IO)(F)\\nBUILTIN\\\\Users:(RX)\\nBUILTIN\\\\Users:(OI)(CI)(IO)(GR,GE)\\nCREATOR OWNER:(OI)(CI)(IO)(F)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES:(RX)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL RESTRICTED APPLICATION PACKAGES:(RX)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\\nSuccessfully processed 1 files; Failed processing 0 files\"]\n[27,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Service\\\\\\n\\nValue Name: DisableRunAs\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[28,\"IIS is not installed by default.  Verify it has not been installed on the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows features on or off\\\".\\n\\nIf the entries for \\\"Internet Information Services\\\" or \\\"Internet Information Services Hostable Web Core\\\" are selected, this is a finding.\\n\\nIf an application requires IIS or a subset to be installed to function, this needs be documented with the ISSO.  In addition, any applicable requirements from the IIS STIG must be addressed.\"]\n[29,\"\\\"SNMP\\\" is not installed by default.  Verify it has not been installed.\\n\\nNavigate to the Windows\\\\System32 directory.\\n\\nIf the \\\"SNMP\\\" application exists, this is a finding.\"]\n[30,\"\\\"Simple TCP/IP Services\\\" is not installed by default.  Verify it has not been installed.\\n\\nRun \\\"Services.msc\\\".\\n\\nIf \\\"Simple TCP/IP Services\\\" is listed, this is a finding.\"]\n[31,\"The \\\"Telnet Client\\\" is not installed by default.  Verify it has not been installed.\\n\\nNavigate to the Windows\\\\System32 directory.\\n\\nIf the \\\"telnet\\\" application exists, this is a finding.\"]\n[32,\"The \\\"TFTP Client\\\" is not installed by default.  Verify it has not been installed.\\n\\nNavigate to the Windows\\\\System32 directory.\\n\\nIf the \\\"TFTP\\\" application exists, this is a finding.\"]\n[33,\"Search all drives for *.p12 and *.pfx files.\\n\\nIf any files with these extensions exist, this is a finding.\\n\\nThis does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.\"]\n[34,\"Determine if a host-based firewall is installed and enabled on the system.  If a host-based firewall is not installed and enabled on the system, this is a finding.\\n\\nThe configuration requirements will be determined by the applicable firewall STIG.\"]\n[35,\"Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts.\\n\\nIf allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding.\\n\\nReview inbound firewall exceptions.\\nComputer Configuration >> Windows Settings >> Security Settings >> Windows Defender Firewall with Advanced Security >> Windows Defender Firewall with Advanced Security >> Inbound Rules (this link will be in the right pane)\\n\\nFor any inbound rules that allow connections view the Scope for Remote IP address. This may be defined as an IP address, subnet, or range. The rule must apply to all firewall profiles.\\n\\nIf a third-party firewall is used, ensure comparable settings are in place.\"]\n[36,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy.\\n\\nIf the \\\"Account lockout duration\\\" is less than \\\"15\\\" minutes (excluding \\\"0\\\"), this is a finding.\\n\\nConfiguring this to \\\"0\\\", requiring an administrator to unlock the account, is more restrictive and is not a finding.\"]\n[37,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy.\\n\\nIf the \\\"Account lockout threshold\\\" is \\\"0\\\" or more than \\\"3\\\" attempts, this is a finding.\"]\n[38,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy.\\n\\nIf the \\\"Reset account lockout counter after\\\" value is less than \\\"15\\\" minutes, this is a finding.\"]\n[39,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for \\\"Enforce password history\\\" is less than \\\"24\\\" passwords remembered, this is a finding.\"]\n[40,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for the \\\"Maximum password age\\\" is greater than \\\"60\\\" days, this is a finding.  If the value is set to \\\"0\\\" (never expires), this is a finding.\"]\n[41,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for the \\\"Minimum password age\\\" is less than \\\"1\\\" day, this is a finding.\"]\n[42,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for the \\\"Minimum password length,\\\" is less than \\\"14\\\" characters, this is a finding.\"]\n[43,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for \\\"Password must meet complexity requirements\\\" is not set to \\\"Enabled\\\", this is a finding.\\n\\nIf the site is using a password filter that requires this setting be set to \\\"Disabled\\\" for the filter to be used, this would not be considered a finding.\"]\n[44,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for \\\"Store password using reversible encryption\\\" is not set to \\\"Disabled\\\", this is a finding.\"]\n[45,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nAccount Logon >> Credential Validation - Failure\"]\n[46,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nAccount Logon >> Credential Validation - Success\"]\n[47,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nAccount Management >> Security Group Management - Success\"]\n[48,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nAccount Management >> User Account Management - Failure\"]\n[49,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nAccount Management >> User Account Management - Success\"]\n[50,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nDetailed Tracking >> Plug and Play Events - Success\"]\n[51,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nDetailed Tracking >> Process Creation - Success\"]\n[52,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Group Membership - Success\"]\n[53,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Logoff - Success\"]\n[54,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Logon - Failure\"]\n[55,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Logon - Success\"]\n[56,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Special Logon - Success\"]\n[57,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nObject Access >> Removable Storage - Failure\\n\\nSome virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.  This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.\"]\n[58,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nObject Access >> Removable Storage - Success\\n\\nSome virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.  This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.\"]\n[59,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nPolicy Change >> Audit Policy Change - Success\"]\n[60,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nPolicy Change >> Authentication Policy Change - Success\"]\n[61,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nPrivilege Use >> Sensitive Privilege Use - Failure\"]\n[62,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nPrivilege Use >> Sensitive Privilege Use - Success\"]\n[63,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> IPSec Driver - Failure\"]\n[64,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> Other System Events - Success\"]\n[65,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> Other System Events - Failure\"]\n[66,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> Security State Change - Success\"]\n[67,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> Security System Extension - Success\"]\n[68,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> System Integrity - Failure\"]\n[69,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> System Integrity - Success\"]\n[70,\"If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\EventLog\\\\Application\\\\\\n\\nValue Name:  MaxSize\\n\\nValue Type:  REG_DWORD\\nValue:  0x00008000 (32768) (or greater)\"]\n[71,\"If the system is configured to send audit records directly to an audit server, this is NA. This must be documented with the ISSO.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\EventLog\\\\Security\\\\\\n\\nValue Name: MaxSize\\n\\nValue Type: REG_DWORD\\nValue: 0x000fa000 (1024000) (or greater)\"]\n[72,\"If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\EventLog\\\\System\\\\\\n\\nValue Name:  MaxSize\\n\\nValue Type:  REG_DWORD\\nValue:  0x00008000 (32768) (or greater)\"]\n[73,\"Verify the permissions on the Application event log (Application.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory. They may have been moved to another folder.\\n\\nIf the permissions for these files are not as restrictive as the ACLs listed, this is a finding.\\n\\nNOTE: If \\\"APPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES\\\" has Special Permissions, this would not be a finding.\"]\n[74,\"Verify the permissions on the Security event log (Security.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory. They may have been moved to another folder.\\n\\nIf the permissions for these files are not as restrictive as the ACLs listed, this is a finding.\\n\\nNOTE: If \\\"APPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES\\\" has Special Permissions, this would not be a finding.\"]\n[75,\"Verify the permissions on the System event log (System.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory. They may have been moved to another folder.\\n\\nIf the permissions for these files are not as restrictive as the ACLs listed, this is a finding.\\n\\nNOTE: If \\\"APPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES\\\" has Special Permissions, this would not be a finding.\"]\n[76,\"If the device does not have a camera, this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Personalization\\\\\\n\\nValue Name: NoLockScreenCamera\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[77,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Personalization\\\\\\n\\nValue Name: NoLockScreenSlideshow\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[78,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip6\\\\Parameters\\\\\\n\\nValue Name: DisableIpSourceRouting\\n\\nValue Type: REG_DWORD\\nValue: 2\"]\n[79,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters\\\\\\n\\nValue Name: DisableIPSourceRouting\\n\\nValue Type: REG_DWORD\\nValue: 2\"]\n[80,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters\\\\\\n\\nValue Name: EnableICMPRedirect\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[81,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netbt\\\\Parameters\\\\\\n\\nValue Name:  NoNameReleaseOnDemand\\n\\nValue Type:  REG_DWORD\\nValue:  1\"]\n[82,\"Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\LanmanWorkstation\\\\\\n\\nValue Name: AllowInsecureGuestAuth\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[83,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nIf the following registry values do not exist or are not configured as specified, this is a finding.\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\NetworkProvider\\\\HardenedPaths\\\\\\n\\nValue Name:  \\\\\\\\*\\\\NETLOGON\\nValue Type:  REG_SZ\\nValue:  RequireMutualAuthentication=1, RequireIntegrity=1\\n\\nValue Name:  \\\\\\\\*\\\\SYSVOL\\nValue Type:  REG_SZ\\nValue:  RequireMutualAuthentication=1, RequireIntegrity=1\\n\\nAdditional entries would not be a finding.\"]\n[84,\"Verify the DoD Root CA certificates are installed as Trusted Root Certification Authorities.\\n\\nThe certificates and thumbprints referenced below apply to unclassified systems; see PKE documentation for other networks.\\n\\nRun \\\"PowerShell\\\" as an administrator.\\n\\nExecute the following command:\\n\\nGet-ChildItem -Path Cert:Localmachine\\\\root | Where Subject -Like \\\"*DoD*\\\" | FL Subject, Thumbprint, NotAfter\\n\\nIf the following certificate \\\"Subject\\\" and \\\"Thumbprint\\\" information is not displayed, this is finding. \\n\\nIf an expired certificate (\\\"NotAfter\\\" date) is not listed in the results, this is not a finding.\\n\\nSubject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561\\nNotAfter: 12/5/2029\\n\\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB\\nNotAfter: 12/30/2029\\n\\nSubject: CN=DoD Root CA 4, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026\\nNotAfter: 7/25/2032\\n\\nSubject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B\\nNotAfter: 6/14/2041\\n\\nAlternately use the Certificates MMC snap-in:\\n\\nRun \\\"MMC\\\".\\n\\nSelect \\\"File\\\", \\\"Add/Remove Snap-in\\\".\\n\\nSelect \\\"Certificates\\\", click \\\"Add\\\".\\n\\nSelect \\\"Computer account\\\", click \\\"Next\\\".\\n\\nSelect \\\"Local computer: (the computer this console is running on)\\\", click \\\"Finish\\\".\\n\\nClick \\\"OK\\\".\\n\\nExpand \\\"Certificates\\\" and navigate to \\\"Trusted Root Certification Authorities >> Certificates\\\".\\n\\nFor each of the DoD Root CA certificates noted below:\\n\\nRight-click on the certificate and select \\\"Open\\\".\\n\\nSelect the \\\"Details\\\" Tab.\\n\\nScroll to the bottom and select \\\"Thumbprint\\\".\\n\\nIf the DoD Root CA certificates below are not listed or the value for the \\\"Thumbprint\\\" field is not as noted, this is a finding.\\n\\nIf an expired certificate (\\\"Valid to\\\" date) is not listed in the results, this is not a finding.\\n\\nDoD Root CA 2\\nThumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561\\nValid to: Wednesday, December 5, 2029\\n\\nDoD Root CA 3\\nThumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB\\nValid to: Sunday, December 30, 2029\\n\\nDoD Root CA 4\\nThumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026\\nValid to: Sunday, July 25, 2032\\n\\nDoD Root CA 5\\nThumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B\\nValid to: Friday, June 14, 2041\"]\n[85,\"The default behavior for \\\"Minimize the number of simultaneous connections to the Internet or a Windows Domain\\\" is \\\"Enabled\\\".\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WcmSvc\\\\GroupPolicy\\\\\\n\\nValue Name: fMinimizeConnections\\n\\nValue Type: REG_DWORD\\nValue: 1 (or if the Value Name does not exist)\"]\n[86,\"Verify the ECA Root CA certificates are installed on unclassified systems as Trusted Root Certification Authorities.\\n\\nRun \\\"PowerShell\\\" as an administrator.\\n\\nExecute the following command:\\n\\nGet-ChildItem -Path Cert:Localmachine\\\\root | Where Subject -Like \\\"*ECA*\\\" | FL Subject, Thumbprint, NotAfter\\n\\nIf the following certificate \\\"Subject\\\" and \\\"Thumbprint\\\" information is not displayed, this is finding. \\n\\nIf an expired certificate (\\\"NotAfter\\\" date) is not listed in the results, this is not a finding.\\n\\nSubject: CN=ECA Root CA 2, OU=ECA, O=U.S. Government, C=US\\nThumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4\\nNotAfter: 3/30/2028\\n\\nSubject: CN=ECA Root CA 4, OU=ECA, O=U.S. Government, C=US\\nThumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582\\nNotAfter: 12/30/2029\\n\\nAlternately use the Certificates MMC snap-in:\\n\\nRun \\\"MMC\\\".\\n\\nSelect \\\"File\\\", \\\"Add/Remove Snap-in\\\".\\n\\nSelect \\\"Certificates\\\", click \\\"Add\\\".\\n\\nSelect \\\"Computer account\\\", click \\\"Next\\\".\\n\\nSelect \\\"Local computer: (the computer this console is running on)\\\", click \\\"Finish\\\".\\n\\nClick \\\"OK\\\".\\n\\nExpand \\\"Certificates\\\" and navigate to \\\"Trusted Root Certification Authorities >> Certificates\\\".\\n\\nFor each of the ECA Root CA certificates noted below:\\n\\nRight-click on the certificate and select \\\"Open\\\".\\n\\nSelect the \\\"Details\\\" Tab.\\n\\nScroll to the bottom and select \\\"Thumbprint\\\".\\n\\nIf the ECA Root CA certificates below are not listed or the value for the \\\"Thumbprint\\\" field is not as noted, this is a finding.\\n\\nIf an expired certificate (\\\"Valid to\\\" date) is not listed in the results, this is not a finding.\\n\\nECA Root CA 2\\nThumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4\\nValid to: Thursday, March 30, 2028\\n\\nECA Root CA 4\\nThumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582\\nValid to: Sunday, December 30, 2029\"]\n[87,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WcmSvc\\\\GroupPolicy\\\\\\n\\nValue Name: fBlockNonDomain\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[88,\"Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates.\\n\\nRun \\\"PowerShell\\\" as an administrator.\\n\\nExecute the following command:\\n\\nGet-ChildItem -Path Cert:Localmachine\\\\disallowed | Where {$_.Issuer -Like \\\"*DoD Interoperability*\\\" -and $_.Subject -Like \\\"*DoD*\\\"} | FL Subject, Issuer, Thumbprint, NotAfter\\n\\nIf the following certificate \\\"Subject\\\", \\\"Issuer\\\", and \\\"Thumbprint\\\", information is not displayed, this is finding. \\n\\nIf an expired certificate (\\\"NotAfter\\\" date) is found, this is a finding.\\n\\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nIssuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341\\nNotAfter: 1/22/2022\\n \\nSubject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nIssuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02\\nNotAfter: 8/26/2022 \\n\\nAlternately use the Certificates MMC snap-in:\\n\\nRun \\\"MMC\\\".\\n\\nSelect \\\"File\\\", \\\"Add/Remove Snap-in\\\".\\n\\nSelect \\\"Certificates\\\", click \\\"Add\\\".\\n\\nSelect \\\"Computer account\\\", click \\\"Next\\\".\\n\\nSelect \\\"Local computer: (the computer this console is running on)\\\", click \\\"Finish\\\".\\n\\nClick \\\"OK\\\".\\n\\nExpand \\\"Certificates\\\" and navigate to \\\"Untrusted Certificates >> Certificates\\\".\\n\\nFor each certificate with \\\"DoD Root CA…\\\" under \\\"Issued To\\\" and \\\"DoD Interoperability Root CA…\\\" under \\\"Issued By\\\":\\n\\nRight-click on the certificate and select \\\"Open\\\".\\n\\nSelect the \\\"Details\\\" Tab.\\n\\nScroll to the bottom and select \\\"Thumbprint\\\".\\n\\nIf the certificates below are not listed or the value for the \\\"Thumbprint\\\" field is not as noted, this is a finding.\\n\\nIf an expired certificate (\\\"Valid to\\\" date) is not listed in the results, this is not a finding.\\n\\nIssued To: DoD Root CA 2\\nIssued By: DoD Interoperability Root CA 1\\nThumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02\\nValid to: Friday, August 26, 2022\\n\\nIssued To: DoD Root CA 3\\nIssued By: DoD Interoperability Root CA 2\\nThumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341\\nValid to: Saturday, January 22, 2022\"]\n[89,\"Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate.\\n\\nRun \\\"PowerShell\\\" as an administrator.\\n\\nExecute the following command:\\n\\nGet-ChildItem -Path Cert:Localmachine\\\\disallowed | Where Issuer -Like \\\"*CCEB Interoperability*\\\" | FL Subject, Issuer, Thumbprint, NotAfter\\n\\nIf the following certificate \\\"Subject\\\", \\\"Issuer\\\", and \\\"Thumbprint\\\", information is not displayed, this is finding. \\n\\nIf an expired certificate (\\\"NotAfter\\\" date) is found, this is a finding.\\n\\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nIssuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S.Government, C=US\\nThumbprint: AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9\\nNotAfter: 8/26/2022 9:07:50 AM\\n\\nAlternately use the Certificates MMC snap-in:\\n\\nRun \\\"MMC\\\".\\n\\nSelect \\\"File\\\", \\\"Add/Remove Snap-in\\\".\\n\\nSelect \\\"Certificates\\\", click \\\"Add\\\".\\n\\nSelect \\\"Computer account\\\", click \\\"Next\\\".\\n\\nSelect \\\"Local computer: (the computer this console is running on)\\\", click \\\"Finish\\\".\\n\\nClick \\\"OK\\\".\\n\\nExpand \\\"Certificates\\\" and navigate to \\\"Untrusted Certificates >> Certificates\\\".\\n\\nFor each certificate with \\\"US DoD CCEB Interoperability Root CA …\\\" under \\\"Issued By\\\":\\n\\nRight-click on the certificate and select \\\"Open\\\".\\n\\nSelect the \\\"Details\\\" tab.\\n\\nScroll to the bottom and select \\\"Thumbprint\\\".\\n\\nIf the certificate below is not listed or the value for the \\\"Thumbprint\\\" field is not as noted, this is a finding.\\n\\nIf an expired certificate (\\\"Valid to\\\" date) is not listed in the results, this is not a finding.\\n\\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nIssuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S.Government, C=US\\nThumbprint: AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9\\nNotAfter: 8/26/2022 9:07:50 AM\"]\n[90,\"This is NA as of v1803 of Windows 10; Wi-Fi sense is no longer available.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\WcmSvc\\\\wifinetworkmanager\\\\config\\\\\\n\\nValue Name: AutoConnectAllowedOEM\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[91,\"Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.\\n\\nIf any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.\\n\\nRun \\\"Regedit\\\".\\nRight click on the registry areas noted below.\\nSelect \\\"Permissions...\\\" and the \\\"Advanced\\\" button.\\n\\nHKEY_LOCAL_MACHINE\\\\SECURITY\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nSYSTEM - Full Control - This key and subkeys\\nAdministrators - Special - This key and subkeys\\n\\nHKEY_LOCAL_MACHINE\\\\SOFTWARE\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nUsers - Read - This key and subkeys\\nAdministrators - Full Control - This key and subkeys\\nSYSTEM - Full Control - This key and subkeys\\nCREATOR OWNER - Full Control - This key and subkeys\\nALL APPLICATION PACKAGES - Read - This key and subkeys\\n\\nHKEY_LOCAL_MACHINE\\\\SYSTEM\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nUsers - Read - This key and subkeys\\nAdministrators - Full Control - This key and subkeys\\nSYSTEM - Full Control - This key and subkeys\\nCREATOR OWNER - Full Control - This key and subkeys\\nALL APPLICATION PACKAGES - Read - This key and subkeys\\n\\nOther subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.\\n\\nMicrosoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.\\n\\nS-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681\\n\\nIf the defaults have not been changed, these are not a finding.\"]\n[92,\"Confirm Virtualization Based Security is enabled and running with Secure Boot or Secure Boot and DMA Protection.\\n\\nFor those devices that support virtualization based security (VBS) features, including Credential Guard or protection of code integrity, this must be enabled. If the system meets the hardware and firmware dependencies for enabling VBS but it is not enabled, this is a CAT III finding.\\n\\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nRun \\\"PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter the following:\\n\\n\\\"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\"\\n\\nIf \\\"RequiredSecurityProperties\\\" does not include a value of \\\"2\\\" indicating \\\"Secure Boot\\\" (e.g., \\\"{1, 2}\\\"), this is a finding.\\n\\nIf \\\"Secure Boot and DMA Protection\\\" is configured, \\\"3\\\" will also be displayed in the results (e.g., \\\"{1, 2, 3}\\\").\\n\\nIf \\\"VirtualizationBasedSecurityStatus\\\" is not a value of \\\"2\\\" indicating \\\"Running\\\", this is a finding.\\n\\nAlternately:\\n\\nRun \\\"System Information\\\".\\n\\nUnder \\\"System Summary\\\", verify the following:\\n\\nIf \\\"Device Guard Virtualization based security\\\" does not display \\\"Running\\\", this is finding.\\n\\nIf \\\"Device Guard Required Security Properties\\\" does not display \\\"Base Virtualization Support, Secure Boot\\\", this is finding.\\n\\nIf \\\"Secure Boot and DMA Protection\\\" is configured, \\\"DMA Protection\\\" will also be displayed (e.g., \\\"Base Virtualization Support, Secure Boot, DMA Protection\\\").\\n\\nThe policy settings referenced in the Fix section will configure the following registry values. However due to hardware requirements, the registry values alone do not ensure proper function.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\\\\n\\nValue Name: EnableVirtualizationBasedSecurity\\nValue Type: REG_DWORD\\nValue: 1\\n\\nValue Name: RequirePlatformSecurityFeatures\\nValue Type: REG_DWORD\\nValue: 1 (Secure Boot only) or 3 (Secure Boot and DMA Protection)\\n\\nA Microsoft article on Credential Guard system requirement can be found at the following link:\\n\\nhttps://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard-requirements\\n\\nNOTE:  The severity level for the requirement will be upgraded to CAT II starting January 2020.\"]\n[93,\"If the system is not a member of a domain, this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: LocalAccountTokenFilterPolicy\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[94,\"Confirm Credential Guard is running on domain-joined systems.\\n\\nFor those devices that support Credential Guard, this feature must be enabled. Organizations need to take the appropriate action to acquire and implement compatible hardware with Credential Guard enabled.\\n\\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nRun \\\"PowerShell\\\" with elevated privileges (run as administrator).\\nEnter the following:\\n\\\"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\"\\n\\nIf \\\"SecurityServicesRunning\\\" does not include a value of \\\"1\\\" (e.g., \\\"{1, 2}\\\"), this is a finding.\\n\\nAlternately:\\n\\nRun \\\"System Information\\\".\\nUnder \\\"System Summary\\\", verify the following:\\nIf \\\"Device Guard Security Services Running\\\" does not list \\\"Credential Guard\\\", this is finding.\\n\\nThe policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\\\\n\\nValue Name: LsaCfgFlags\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1) (Enabled with UEFI lock)\"]\n[95,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Accounts: Administrator account status\\\" is not set to \\\"Disabled\\\", this is a finding.\"]\n[96,\"The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy is to enforce \\\"Good, unknown and bad but critical\\\" (preventing \\\"bad\\\").\\n\\nIf the registry value name below does not exist, this a finding.\\n\\nIf it exists and is configured with a value of \\\"7\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Policies\\\\EarlyLaunch\\\\\\n\\nValue Name: DriverLoadPolicy\\n\\nValue Type: REG_DWORD\\nValue: 1, 3, or 8 \\n\\nPossible values for this setting are:\\n8 - Good only\\n1 - Good and unknown\\n3 - Good, unknown and bad but critical\\n7 - All (which includes \\\"Bad\\\" and would be a finding)\"]\n[97,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Group Policy\\\\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\\n\\nValue Name: NoGPOListChanges\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[98,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Accounts: Guest account status\\\" is not set to \\\"Disabled\\\", this is a finding.\"]\n[99,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Printers\\\\\\n\\nValue Name: DisableWebPnPDownload\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[100,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: LimitBlankPasswordUse\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[101,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Accounts: Rename administrator account\\\" is set to \\\"Administrator\\\", this is a finding.\"]\n[102,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\\\n\\nValue Name: NoWebServices\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[103,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Printers\\\\\\n\\nValue Name: DisableHTTPPrinting\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[104,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Accounts: Rename guest account\\\" is set to \\\"Guest\\\", this is a finding.\"]\n[105,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nThe default behavior for \\\"Support device authentication using certificate\\\" is \\\"Automatic\\\".\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is a finding.\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Kerberos\\\\Parameters\\\\\\n\\nValue Name:  DevicePKInitEnabled\\nValue Type:  REG_DWORD\\nValue:  1 (or if the Value Name does not exist)\"]\n[106,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: DontDisplayNetworkSelectionUI\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[107,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: EnumerateLocalUsers\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[108,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: SCENoApplyLegacyAuditPolicy\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[109,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: RequireSignOrSeal\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[110,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: SealSecureChannel\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[111,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Power\\\\PowerSettings\\\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\\\\\\n\\nValue Name: DCSettingIndex\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[112,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: SignSecureChannel\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[113,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Power\\\\PowerSettings\\\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\\\\\\n\\nValue Name: ACSettingIndex\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[114,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: fAllowToGetHelp\\n \\nValue Type: REG_DWORD\\nValue: 0\"]\n[115,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: DisablePasswordChange\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[116,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Rpc\\\\\\n\\nValue Name: RestrictRemoteClients\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[117,\"Windows 10 LTSC\\\\B versions do not support the Microsoft Store and modern apps; this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: MSAOptional\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[118,\"This is the default configuration for this setting (30 days).\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: MaximumPasswordAge\\n\\nValue Type: REG_DWORD\\nValue: 0x0000001e (30)  (or less, excluding 0)\"]\n[119,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\AppCompat\\\\\\n\\nValue Name: DisableInventory\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[120,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: RequireStrongKey\\n\\nValue Type: REG_DWORD\\nValue: 1\\n \\nWarning: This setting may prevent a system from being joined to a domain if not configured consistently between systems.\"]\n[121,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Explorer\\\\\\n\\nValue Name: NoAutoplayfornonVolume\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[122,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: InactivityTimeoutSecs\\n\\nValue Type: REG_DWORD\\nValue: 0x00000384 (900) (or less, excluding \\\"0\\\" which is effectively disabled)\"]\n[123,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\\\n\\nValue Name: NoAutorun\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[124,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\policies\\\\Explorer\\\\\\n\\nValue Name: NoDriveTypeAutoRun\\n\\nValue Type: REG_DWORD\\nValue: 0x000000ff (255)\\n\\nNote: If the value for NoDriveTypeAutorun is entered manually, it must be entered as \\\"ff\\\" when Hexadecimal is selected, or \\\"255\\\" with Decimal selected.  Using the policy value specified in the Fix section will enter it correctly.\"]\n[125,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: LegalNoticeText\\n\\nValue Type: REG_SZ\\nValue: \\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details.\"]\n[126,\"Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Biometrics\\\\FacialFeatures\\\\\\n\\nValue Name: EnhancedAntiSpoofing\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[127,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\CredUI\\\\\\n\\nValue Name: EnumerateAdministrators\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[128,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: LegalNoticeCaption\\n\\nValue Type: REG_SZ\\nValue: See message title above\\n\\n\\\"DoD Notice and Consent Banner\\\", \\\"US Department of Defense Warning Statement\\\" or a site-defined equivalent, this is a finding.\\n\\nIf a site-defined title is used, it can in no case contravene or modify the language of the banner text required in WN10-SO-000075.\"]\n[129,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DataCollection\\\\\\n\\nValue Name: AllowTelemetry\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0) (Security)\\n0x00000001 (1) (Basic)\\n\\nIf an organization is using v1709 or later of Windows 10 this may be configured to \\\"Enhanced\\\" to support Windows Analytics. V-82145 must also be configured to limit the Enhanced diagnostic data to the minimum required by Windows Analytics. This registry value will then be 0x00000002 (2).\"]\n[130,\"This is applicable to unclassified systems, for other systems this is NA.\\n\\nIf the following registry values do not exist or are not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: EnableSmartScreen\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\\n\\nAnd\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: ShellSmartScreenLevel\\n\\nValue Type: REG_SZ\\nValue: Block\\n\\nv1607 LTSB:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: EnableSmartScreen\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\\n\\nv1507 LTSB:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: EnableSmartScreen\\n\\nValue Type: REG_DWORD\\nValue: 0x00000002 (2)\"]\n[131,\"This is the default configuration for this setting (10 logons to cache).\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE \\nRegistry Path:  \\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\\\n\\nValue Name:  CachedLogonsCount\\n\\nValue Type:  REG_SZ\\nValue:  10 (or less)\\n\\nThis setting only applies to domain-joined systems, however, it is configured by default on all systems.\"]\n[132,\"The default behavior is for data execution prevention to be turned on for file explorer.\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Explorer\\\\\\n\\nValue Name: NoDataExecutionPrevention\\n\\nValue Type: REG_DWORD\\nValue: 0 (or if the Value Name does not exist)\"]\n[133,\"The default behavior is for File Explorer heap termination on corruption to be enabled.\\n\\nIf the registry Value Name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Explorer\\\\\\n\\nValue Name: NoHeapTerminationOnCorruption\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0) (or if the Value Name does not exist)\"]\n[134,\"The default behavior is for shell protected mode to be turned on for file explorer.\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\\\n\\nValue Name: PreXPSP2ShellProtocolBehavior\\n\\nValue Type: REG_DWORD\\nValue: 0 (or if the Value Name does not exist)\"]\n[135,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\\\n\\nValue Name:  SCRemoveOption\\n\\nValue Type:  REG_SZ\\nValue:  1 (Lock Workstation) or 2 (Force Logoff)\\n\\nThis can be left not configured or set to \\\"No action\\\" on workstations with the following conditions.  This must be documented with the ISSO.\\n-The setting cannot be configured due to mission needs, or because it interferes with applications.\\n-Policy must be in place that users manually lock workstations when leaving them unattended.\\n-The screen saver is properly configured to lock as required.\"]\n[136,\"This is applicable to unclassified systems, for other systems this is NA.\\n\\nWindows 10 LTSC\\\\B versions do not include Microsoft Edge, this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\PhishingFilter\\\\\\n\\nValue Name: PreventOverride\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[137,\"This is applicable to unclassified systems, for other systems this is NA.\\n\\nWindows 10 LTSC\\\\B versions do not include Microsoft Edge, this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\PhishingFilter\\\\\\n\\nValue Name: PreventOverrideAppRepUnknown\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[138,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanmanWorkstation\\\\Parameters\\\\\\n\\nValue Name: RequireSecuritySignature\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[139,\"Windows 10 LTSC\\\\B versions do not include Microsoft Edge, this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\Main\\\\\\n\\nValue Name: FormSuggest Passwords\\n\\nType: REG_SZ\\nValue: no\"]\n[140,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanmanWorkstation\\\\Parameters\\\\\\n\\nValue Name:  EnablePlainTextPassword\\n\\nValue Type:  REG_DWORD\\nValue:  0\"]\n[141,\"This is applicable to unclassified systems, for other systems this is NA.\\n\\nWindows 10 LTSC\\\\B versions do not include Microsoft Edge, this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\PhishingFilter\\\\\\n\\nValue Name: EnabledV9\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[142,\"Virtual desktop implementations currently may not support the use of TPMs. For virtual desktop implementations where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\PassportForWork\\\\\\n\\nValue Name: RequireSecurityDevice\\n\\nType: REG_DWORD\\nValue: 1\"]\n[143,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanManServer\\\\Parameters\\\\\\n\\nValue Name: RequireSecuritySignature\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[144,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\PassportForWork\\\\PINComplexity\\\\\\n\\nValue Name:  MinimumPINLength\\n\\nType:  REG_DWORD\\nValue:  6 (or greater)\"]\n[145,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: DisablePasswordSaving\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[146,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: fDisableCdm\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[147,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: fPromptForPassword\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[148,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: fEncryptRPCTraffic\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[149,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Network access: Allow anonymous SID/Name translation\\\" is not set to \\\"Disabled\\\", this is a finding.\"]\n[150,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: MinEncryptionLevel\\n\\nValue Type: REG_DWORD\\nValue: 3\"]\n[151,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Internet Explorer\\\\Feeds\\\\\\n\\nValue Name: DisableEnclosureDownload\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[152,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: RestrictAnonymousSAM\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[153,\"The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections.\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Internet Explorer\\\\Feeds\\\\\\n\\nValue Name: AllowBasicAuthInClear\\n\\nValue Type: REG_DWORD\\nValue: 0 (or if the Value Name does not exist)\"]\n[154,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: RestrictAnonymous\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[155,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Windows Search\\\\\\n\\nValue Name: AllowIndexingEncryptedStoresOrItems\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[156,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: EveryoneIncludesAnonymous\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[157,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanManServer\\\\Parameters\\\\\\n\\nValue Name: RestrictNullSessAccess\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[158,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\LSA\\\\MSV1_0\\\\\\n\\nValue Name: allownullsessionfallback\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[159,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\LSA\\\\pku2u\\\\\\n\\nValue Name: AllowOnlineID\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[160,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Kerberos\\\\Parameters\\\\\\n\\nValue Name: SupportedEncryptionTypes\\n\\nValue Type: REG_DWORD\\nValue: 0x7ffffff8 (2147483640)\"]\n[161,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: NoLMHash\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[162,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: LmCompatibilityLevel\\n\\nValue Type: REG_DWORD\\nValue: 5\"]\n[163,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LDAP\\\\\\n\\nValue Name: LDAPClientIntegrity\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[164,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\MSV1_0\\\\\\n\\nValue Name: NTLMMinClientSec\\n\\nValue Type: REG_DWORD\\nValue: 0x20080000 (537395200)\"]\n[165,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\MSV1_0\\\\\\n\\nValue Name: NTLMMinServerSec\\n\\nValue Type: REG_DWORD\\nValue: 0x20080000 (537395200)\"]\n[166,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\FIPSAlgorithmPolicy\\\\\\n\\nValue Name: Enabled\\n\\nValue Type: REG_DWORD\\nValue: 1\\n \\nWarning: Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms.  Both the browser and web server must be configured to use TLS otherwise the browser will not be able to connect to a secure site.\"]\n[167,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\\\n\\nValue Name: ProtectionMode\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[168,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: FilterAdministratorToken\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[169,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: ConsentPromptBehaviorAdmin\\n\\nValue Type: REG_DWORD\\nValue: 2 (Prompt for consent on the secure desktop)\"]\n[170,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: ConsentPromptBehaviorUser\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[171,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: EnableInstallerDetection\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[172,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: EnableSecureUIAPaths\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[173,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: EnableLUA\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[174,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: EnableVirtualization\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[175,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\PushNotifications\\\\\\n\\nValue Name: NoToastApplicationNotificationOnLockScreen\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[176,\"The default behavior is for Windows to mark file attachments with their zone information.\\n\\nIf the registry Value Name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"2\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Attachments\\\\\\n\\nValue Name: SaveZoneInformation\\n\\nValue Type: REG_DWORD\\nValue: 0x00000002 (2) (or if the Value Name does not exist)\"]\n[177,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Access Credential Manager as a trusted caller\\\" user right, this is a finding.\"]\n[178,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Access this computer from the network\\\" user right, this is a finding:\\n\\nAdministrators\\nRemote Desktop Users\\n\\nIf a domain application account such as for a management tool requires this user right, this would not be a finding.\\n\\nVendor documentation must support the requirement for having the user right.\\n\\nThe requirement must be documented with the ISSO.\\n\\nThe application account, managed at the domain level, must meet requirements for application account passwords, such as length and frequency of changes as defined in the Windows server STIGs.\"]\n[179,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts (to include administrators), are granted the \\\"Act as part of the operating system\\\" user right, this is a finding.\"]\n[180,\"Verify the effective setting in Local Group Policy Editor.\\n\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Allow log on locally\\\" user right, this is a finding:\\n\\nAdministrators\\nUsers\"]\n[181,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Back up files and directories\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[182,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Change the system time\\\" user right, this is a finding:\\n\\nAdministrators\\nLOCAL SERVICE\\nNT SERVICE\\\\autotimesvc is added in v1909 cumulative update.\"]\n[183,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Create a pagefile\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[184,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Create a token object\\\" user right, this is a finding.\"]\n[185,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Create global objects\\\" user right, this is a finding:\\n\\nAdministrators\\nLOCAL SERVICE\\nNETWORK SERVICE\\nSERVICE\"]\n[186,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Create permanent shared objects\\\" user right, this is a finding.\"]\n[187,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Create symbolic links\\\" user right, this is a finding:\\n\\nAdministrators\\n\\nIf the workstation has an approved use of Hyper-V, such as being used as a dedicated admin workstation using Hyper-V to separate administration and standard user functions, \\\"NT VIRTUAL MACHINES\\\\VIRTUAL MACHINE\\\" may be assigned this user right and is not a finding.\"]\n[188,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Debug Programs\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[189,\"Verify the effective setting in Local Group Policy Editor.\\n\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny access to this computer from the network\\\" right, this is a finding:\\n\\nDomain Systems Only:\\nEnterprise Admins group\\nDomain Admins group\\nLocal account (see Note below)\\n\\nAll Systems:\\nGuests group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nNote: \\\"Local account\\\" is a built-in security group used to assign user rights and permissions to all local accounts.\"]\n[190,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nVerify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny log on as a batch job\\\" right, this is a finding:\\n\\nDomain Systems Only:\\nEnterprise Admin Group\\nDomain Admin Group\"]\n[191,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nVerify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny log on as a service\\\" right , this is a finding:\\n\\nDomain Systems Only:\\nEnterprise Admins Group\\nDomain Admins Group\"]\n[192,\"Verify the effective setting in Local Group Policy Editor.\\n\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny log on locally\\\" right, this is a finding.\\n\\nDomain Systems Only:\\nEnterprise Admins Group\\nDomain Admins Group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nAll Systems:\\nGuests Group\"]\n[193,\"Verify the effective setting in Local Group Policy Editor.\\n\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny log on through Remote Desktop Services\\\" right, this is a finding:\\n\\nIf Remote Desktop Services is not used by the organization, the \\\"Everyone\\\" group can replace all of the groups listed below.\\n\\nDomain Systems Only:\\nEnterprise Admins group\\nDomain Admins group\\nLocal account (see Note below)\\n\\nAll Systems:\\nGuests group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nNote: \\\"Local account\\\" is a built-in security group used to assign user rights and permissions to all local accounts.\"]\n[194,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Enable computer and user accounts to be trusted for delegation\\\" user right, this is a finding.\"]\n[195,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Force shutdown from a remote system\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[196,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Impersonate a client after authentication\\\" user right, this is a finding:\\n\\nAdministrators\\nLOCAL SERVICE\\nNETWORK SERVICE\\nSERVICE\"]\n[197,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Load and unload device drivers\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[198,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Lock pages in memory\\\" user right, this is a finding.\"]\n[199,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Manage auditing and security log\\\" user right, this is a finding:\\n\\nAdministrators\\n\\nIf the organization has an \\\"Auditors\\\" group the assignment of this group to the user right would not be a finding.\"]\n[200,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Modify firmware environment values\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[201,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Perform volume maintenance tasks\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[202,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Profile single process\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[203,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Restore files and directories\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[204,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Take ownership of files or other objects\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[205,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DeliveryOptimization\\\\\\n\\nValue Name: DODownloadMode\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0) - No peering (HTTP Only)\\n0x00000001 (1) - Peers on same NAT only (LAN)\\n0x00000002 (2) - Local Network / Private group peering (Group)\\n0x00000063 (99) - Simple download mode, no peering (Simple)\\n0x00000064 (100) - Bypass mode, Delivery Optimization not used (Bypass)\\n\\nA value of 0x00000003 (3), Internet, is a finding.\\n\\nv1507 LTSB:\\nDomain joined systems:\\nVerify the registry value above.\\nIf the value is not 0x00000000 (0) or 0x00000001 (1), this is a finding.\\n\\nStandalone systems (configured in Settings):\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\DeliveryOptimization\\\\Config\\\\\\n\\nValue Name: DODownloadMode\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0) - Off\\n0x00000001 (1) - LAN\"]\n[206,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE \\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Audit\\\\\\n\\nValue Name: ProcessCreationIncludeCmdLine_Enabled\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[207,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE \\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\PowerShell\\\\ScriptBlockLogging\\\\\\n\\nValue Name: EnableScriptBlockLogging\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[208,\"Verify the DEP configuration.\\nOpen a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).\\nEnter \\\"BCDEdit /enum {current}\\\". (If using PowerShell \\\"{current}\\\" must be enclosed in quotes.)\\nIf the value for \\\"nx\\\" is not \\\"OptOut\\\", this is a finding.\\n(The more restrictive configuration of \\\"AlwaysOn\\\" would not be a finding.)\"]\n[209,\"This is applicable to Windows 10 prior to v1709.\\n\\nVerify SEHOP is turned on.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\kernel\\\\\\n\\nValue Name: DisableExceptionChainValidation\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[210,\"Run \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter the following:\\nGet-WindowsOptionalFeature -Online | Where FeatureName -like *PowerShellv2*\\n\\nIf either of the following have a \\\"State\\\" of \\\"Enabled\\\", this is a finding.\\n\\nFeatureName : MicrosoftWindowsPowerShellV2\\nState : Enabled\\nFeatureName : MicrosoftWindowsPowerShellV2Root\\nState : Enabled\\n\\nAlternately:\\nSearch for \\\"Features\\\".\\n\\nSelect \\\"Turn Windows features on or off\\\".\\n\\nIf \\\"Windows PowerShell 2.0\\\" (whether the subcategory of \\\"Windows PowerShell 2.0 Engine\\\" is selected or not) is selected, this is a finding.\"]\n[211,\"Different methods are available to disable SMBv1 on Windows 10.  This is the preferred method, however if V-74723 and V-74725 are configured, this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter the following:\\nGet-WindowsOptionalFeature -Online | Where FeatureName -eq SMB1Protocol\\n\\nIf \\\"State : Enabled\\\" is returned, this is a finding.\\n\\nAlternately:\\nSearch for \\\"Features\\\".\\n\\nSelect \\\"Turn Windows features on or off\\\".\\n\\nIf \\\"SMB 1.0/CIFS File Sharing Support\\\" is selected, this is a finding.\"]\n[212,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Account Lockout - Failure\"]\n[213,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n-Open a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n-Enter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding.\\n\\nPolicy Change >> Authorization Policy Change - Success\"]\n[214,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\SecurityProviders\\\\Wdigest\\\\\\n\\nValue Name: UseLogonCredential\\n\\nType: REG_DWORD\\nValue:  0x00000000 (0)\"]\n[215,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Network Connections\\\\\\n\\nValue Name: NC_ShowSharedAccessUI\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[216,\"Windows 10 v1507 LTSB version does not include this setting, it is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: RestrictRemoteSAM\\n\\nValue Type: REG_SZ\\nValue: O:BAG:BAD:(A;;RC;;;BA)\"]\n[217,\"Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\CloudContent\\\\\\n\\nValue Name: DisableWindowsConsumerFeatures\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[218,\"If the following registry values do not exist or are not configured as specified, this is a finding.\\nThe policy configures the same Value Name, Type and Value under four different registry paths.\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Paths:  \\n\\\\SOFTWARE\\\\Classes\\\\batfile\\\\shell\\\\runasuser\\\\\\n\\\\SOFTWARE\\\\Classes\\\\cmdfile\\\\shell\\\\runasuser\\\\\\n\\\\SOFTWARE\\\\Classes\\\\exefile\\\\shell\\\\runasuser\\\\\\n\\\\SOFTWARE\\\\Classes\\\\mscfile\\\\shell\\\\runasuser\\\\\\n\\nValue Name:  SuppressionPolicy\\n\\nType:  REG_DWORD\\nValue:  0x00001000 (4096)\"]\n[219,\"This is NA if the system does not have Bluetooth.\\n\\nVerify the Bluetooth radio is turned off unless approved by the organization. If it is not, this is a finding.\\n\\nApproval must be documented with the ISSO.\"]\n[220,\"This is NA if the system does not have Bluetooth.\\n\\nVerify the organization has a policy to turn off Bluetooth when not in use and personnel are trained. If it does not, this is a finding.\"]\n[221,\"This is NA if the system does not have Bluetooth, or if Bluetooth is turned off per the organizations policy.\\n\\nSearch for \\\"Bluetooth\\\".\\nView Bluetooth Settings.\\nSelect \\\"More Bluetooth Options\\\"\\nIf \\\"Alert me when a new Bluetooth device wants to connect\\\" is not checked, this is a finding.\"]\n[222,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen PowerShell or a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following:\\n\\nObject Access >> Other Object Access Events - Failure\\n\\nIf the system does not audit the above, this is a finding.\"]\n[223,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen PowerShell or a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following:\\n\\nObject Access >> Other Object Access Events - Success\\n\\nIf the system does not audit the above, this is a finding.\"]\n[224,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Cryptography\\\\Configuration\\\\SSL\\\\00010002\\\\\\n\\nValue Name: EccCurves\\n\\nValue Type: REG_MULTI_SZ\\nValue: NistP384 NistP256\"]\n[225,\"This is NA for Windows 10 LTSC\\\\B versions 1507 and 1607.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\GameDVR\\\\\\n\\nValue Name: AllowGameDVR\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[226,\"This is NA for Windows 10 LTSC\\\\B versions 1507 and 1607.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\CredentialsDelegation\\\\\\n\\nValue Name: AllowProtectedCreds\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[227,\"Run \\\"Services.msc\\\".\\n\\nLocate the \\\"Secondary Logon\\\" service.\\n\\nIf the \\\"Startup Type\\\" is not \\\"Disabled\\\" or the \\\"Status\\\" is \\\"Running\\\", this is a finding.\"]\n[228,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen PowerShell or a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following:\\n\\nObject Access >> File Share - Success\\n\\nIf the system does not audit the above, this is a finding.\"]\n[229,\"Different methods are available to disable SMBv1 on Windows 10, if V-70639 is configured, this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanmanServer\\\\Parameters\\\\\\n\\nValue Name: SMB1\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[230,\"Different methods are available to disable SMBv1 on Windows 10, if V-70639 is configured, this is NA.\\n\\nIf the following registry value is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\mrxsmb10\\\\\\n\\nValue Name: Start\\n\\nType: REG_DWORD\\nValue: 0x00000004 (4)\"]\n[231,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen PowerShell or a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following:\\n\\nObject Access >> File Share - Failure\\n\\nIf the system does not audit the above, this is a finding.\"]\n[232,\"Review the effective User Rights setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nReview each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of \\\"*S-1-…\\\".)\\n\\nIf any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.\"]\n[233,\"For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nVerify the system firmware is configured to run in UEFI mode, not Legacy BIOS.\\n\\nRun \\\"System Information\\\".\\n\\nUnder \\\"System Summary\\\", if \\\"BIOS Mode\\\" does not display \\\"UEFI\\\", this is finding.\"]\n[234,\"Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows 10 hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. \\n\\nFor virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nRun \\\"System Information\\\".\\n\\nUnder \\\"System Summary\\\", if \\\"Secure Boot State\\\" does not display \\\"On\\\", this is finding.\"]\n[235,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"DEP: Enable\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[236,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"ASLR: BottomUp\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[237,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"CFG: Enable\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[238,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"SEHOP: Enable\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[239,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"Heap: TerminateOnError\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[240,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name Acrobat.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[241,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name AcroRd32.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot= False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[242,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name chrome.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverrideDEP: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[243,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name EXCEL.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[244,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name firefox.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: On\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[245,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name FLTLDR.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False \\nOverrideExportAddressFilterPlus: False \\nOverrideImportAddressFilter: False \\nOverrideEnableRopStackPivot: False \\nOverrideEnableRopCallerCheck: False \\nOverrideEnableRopSimExec: False\\n\\nChild Process:\\nOverrideChildProcess: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[246,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name GROOVE.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverrideDEP: False\\n\\nASLR:\\nForceRelocateImages: On\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nChild Process:\\nOverrideChildProcess: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here.  If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[247,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name iexplore.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[248,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name INFOPATH.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[249,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name [application name]\\\" with each of the following substituted for [application name]:\\njava.exe, javaw.exe, and javaws.exe\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[250,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name lync.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[251,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name MSACCESS.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[252,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name MSPUB.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[253,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name OneDrive.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nOverrideRelocateImages: NOTSET\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False \\nOverrideExportAddressFilterPlus: False \\nOverrideImportAddressFilter: False \\nOverrideEnableRopStackPivot: False \\nOverrideEnableRopCallerCheck: False \\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[254,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name OIS.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverrideDEP: False\\n\\nPayload:\\nOverrideEnableExportAddressFilter: False\\nOverrideEnableExportAddressFilterPlus: False\\nOverrideEnableImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[255,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name OUTLOOK.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[256,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name plugin-container.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status of \\\"ON\\\" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[257,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name POWERPNT.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[258,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name PPTVIEW.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[259,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name VISIO.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[260,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name VPREVIEW.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[261,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name WINWORD.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[262,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name wmplayer.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[263,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name wordpad.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[264,\"Determine whether administrative accounts are prevented from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration.\\n\\nThe organization must have a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.\\n\\nTechnical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet. \\n\\nIf accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding.\"]\n[265,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\Software\\\\Policies\\\\Microsoft\\\\OneDrive\\\\\\n\\nValue Name: DisablePersonalSync\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[266,\"This setting is applicable starting with v1809 of Windows 10; it is NA for prior versions.\\n\\nWindows 10 LTSC\\\\B versions do not include Microsoft Edge; this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\Internet Settings\\\\\\n\\nValue Name: PreventCertErrorOverrides\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[267,\"This setting requires v1709 or later of Windows 10; it is NA for prior versions.\\n\\nIf \\\"Enhanced\\\" level is enabled for telemetry, this must be configured. If \\\"Security\\\" or \\\"Basic\\\" are configured, this is NA. (See V-63683).\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DataCollection\\\\\\n\\nValue Name: LimitEnhancedDiagnosticDataWindowsAnalytics\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[268,\"If the organization is using a DoD instance of OneDrive, verify synchronizing is only allowed to the organization's DoD instance.\\n\\nIf the organization does not have an instance of OneDrive, verify this is configured with the noted dummy entry to prevent synchronizing with other instances.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\OneDrive\\\\AllowTenantList\\\\\\n\\nValue Name: Organization's Tenant GUID\\n\\nValue Type: REG_SZ\\nValue: Organization's Tenant GUID\\n\\nIf the organization does not have an instance of OneDrive the Value Name and Value must be 1111-2222-3333-4444, if not this is a finding.\"]\n[269,\"This setting requires v1903 or later of Windows 10; it is NA for prior versions.  The setting is NA when the “Allow voice activation” policy is configured to disallow applications to be activated with voice for all users.\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\AppPrivacy\\\\\\n\\nValue Name: LetAppsActivateWithVoiceAboveLock\\n\\nType: REG_DWORD\\nValue: 0x00000002 (2)\\n\\nIf the following registry value exists and is configured as specified, requirement is NA. \\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\AppPrivacy\\\\\\n\\nValue Name: LetAppsActivateWithVoice\\n\\nType: REG_DWORD\\nValue: 0x00000002 (2)\"]\n[270,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\FVE\\\\\\n\\nValue Name: UseAdvancedStartup\\nType: REG_DWORD\\nValue: 0x00000001 (1)\\n\\nIf one of the following registry values does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\FVE\\\\\\n\\nValue Name: UseTPMPIN\\nType: REG_DWORD\\nValue: 0x00000001 (1)\\n\\nValue Name: UseTPMKeyPIN\\nType: REG_DWORD\\nValue: 0x00000001 (1)\\n\\n\\nBitLocker network unlock may be used in conjunction with a BitLocker PIN. See the article below regarding information about network unlock.\\n\\nhttps://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock\"]\n[271,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\FVE\\\\\\n\\nValue Name: MinimumPIN\\nType: REG_DWORD\\nValue: 0x00000006 (6) or greater\"]\n[272,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff  >> Other Logon/Logoff Events - Failure\"]\n[273,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff  >> Other Logon/Logoff Events - Success\"]\n[274,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nObject Access  >> Detailed File Share - Failure\"]\n[275,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nPolicy Change  >> MPSSVC Rule-Level Policy Change - Success\"]\n[276,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nPolicy Change  >> MPSSVC Rule-Level Policy Change - Failure\"]\n[277,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nPolicy Change  >> Other Policy Change Events - Success\"]\n[278,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nPolicy Change  >> Other Policy Change Events - Failure\"]\n[279,\"Review the password last set date for the enabled local Administrator account.\\n\\nOn the local domain joined workstation:\\n\\nOpen \\\"PowerShell\\\".\\n\\nEnter \\\"Get-LocalUser –Name * | Select-Object *”\\n\\nIf the \\\"PasswordLastSet\\\" date is greater than \\\"60\\\" days old for the local Administrator account for administering the computer/domain, this is a finding.\"]\n[280,\"This is NA prior to v1803 of Windows 10.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\Kernel DMA Protection\\n\\nValue Name: DeviceEnumerationPolicy\\nValue Type: REG_DWORD\\nValue: 0\"]\n[281,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\n\\nValue Name: AllowDomainPINLogon\\nValue Type: REG_DWORD\\nValue data: 0\"]\n[282,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\Software\\\\Policies\\\\Microsoft\\\\WindowsInkWorkspace\\n\\nValue Name: AllowWindowsInkWorkspace\\nValue Type: REG_DWORD\\nValue data: 1\"]\n[283,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding: \\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\CloudContent\\\\\\n\\nValue Name: DisableThirdPartySuggestions\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[284,\"If the device or operating system does not have a camera installed, this requirement is not applicable.\\n\\nThis requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local AO decision.\\n\\nThis requirement is not applicable to dedicated VTC suites located in approved VTC locations that are centrally managed.\\n\\nFor an external camera, if there is not a method for the operator to manually disconnect camera at the end of collaborative computing sessions, this is a finding.\\n\\nFor a built-in camera, the camera must be protected by a camera cover (e.g. laptop camera cover slide) when not in use. If the built-in camera is not protected with a camera cover, or if the built-in\\ncamera is not disabled in the bios, this is a finding.\\n\\nIf the camera is not disconnected or covered, the following registry entry is required:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistryPath\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\CapabilityAccessManager\\\\ConsentStore\\\\webcam\\n\\nValue Name: Deny\\n\\nIf \\\"Value Name\\\" is set to a value other than \\\"Deny\\\" and the collaborative computing device has not been authorized for use, this is a finding.\"]\n[285,\"Ensure there is a documented policy or procedure in place that non-persistent VM sessions do not exceed 24 hours.\\n\\nIf there is no such documented policy or procedure in place, this is a finding.\"]\n[286,\"If the following registry values do not exist or are not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\n\\nValue Name: NoPreviewPane\\n\\nValue Type: REG_DWORD\\n\\nValue: 1\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\n\\nValue Name: NoReadingPane\\n\\nValue Type: REG_DWORD\\n\\nValue: 1\"]\n[287,\"If the system is a member of a domain this is Not Applicable.\\n\\nIf one of the following settings does not exist and is not populated, this is a finding: \\n\\nComputer\\\\HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Cryptography\\\\Calais\\\\Readers\\nComputer\\\\HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Cryptography\\\\Calais\\\\SmartCards\"]\n[288,\"Verify the file permissions, ownership, and group membership of system files and commands match the vendor values.\\n\\nCheck the default file permissions, ownership, and group membership of system files and commands with the following command:\\n\\n# for i in `rpm -Va | egrep -i '^\\\\.[M|U|G|.]{8}' | cut -d \\\" \\\" -f4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump | cut -d \\\" \\\" -f1,5,6,7 | grep $i;done;done\\n\\n/var/log/gdm 040755 root root\\n/etc/audisp/audisp-remote.conf 0100640 root root\\n/usr/bin/passwd 0104755 root root\\n\\nFor each file returned, verify the current permissions, ownership, and group membership:\\n# ls -la <filename>\\n\\n-rw-------. 1 root root 133 Jan 11 13:25 /etc/audisp/audisp-remote.conf\\n\\nIf the file is more permissive than the default permissions, this is a finding.\\n\\nIf the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding.\\n\\nIf the file is not a member of the default group and is not documented with the Information System Security Officer (ISSO), this is a finding.\"]\n[289,\"Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a graphical user logon.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nCheck to see if the operating system displays a banner at the logon screen with the following command:\\n\\n# grep banner-message-enable /etc/dconf/db/local.d/*\\nbanner-message-enable=true\\n\\nIf \\\"banner-message-enable\\\" is set to \\\"false\\\" or is missing, this is a finding.\"]\n[290,\"Verify the operating system displays the approved Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a graphical user logon.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nCheck that the operating system displays the exact approved Standard Mandatory DoD Notice and Consent Banner text with the command:\\n\\n# grep banner-message-text /etc/dconf/db/local.d/*\\nbanner-message-text=\\n'You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\\\n-At any time, the USG may inspect and seize data stored on this IS.\\\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. '\\n\\nNote: The \\\"\\\\n \\\" characters are for formatting only. They will not be displayed on the GUI.\\n\\nIf the banner does not match the approved Standard Mandatory DoD Notice and Consent Banner, this is a finding.\"]\n[291,\"Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a command line user logon.\\n\\nCheck to see if the operating system displays a banner at the command line logon screen with the following command:\\n\\n# more /etc/issue\\n\\nThe command should return the following text:\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nIf the operating system does not display a graphical logon banner or the banner does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.\\n\\nIf the text in the \\\"/etc/issue\\\" file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.\"]\n[292,\"Verify the operating system enables a user's session lock until that user re-establishes access using established identification and authentication procedures. The screen program must be installed to lock sessions on the console.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCheck to see if the screen lock is enabled with the following command:\\n\\n# grep -i lock-enabled /etc/dconf/db/local.d/*\\nlock-enabled=true\\n\\nIf the \\\"lock-enabled\\\" setting is missing or is not set to \\\"true\\\", this is a finding.\"]\n[293,\"Verify the operating system uniquely identifies and authenticates users using multifactor authentication via a graphical user logon.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nDetermine which profile the system database is using with the following command:\\n\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nNote: The example is using the database local for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than local is being used.\\n\\n# grep enable-smartcard-authentication /etc/dconf/db/local.d/*\\n\\nenable-smartcard-authentication=true\\n\\nIf \\\"enable-smartcard-authentication\\\" is set to \\\"false\\\" or the keyword is missing, this is a finding.\"]\n[294,\"Verify the operating system initiates a screensaver after a 15-minute period of inactivity for graphical user interfaces. The screen program must be installed to lock sessions on the console.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCheck to see if GNOME is configured to display a screensaver after a 15 minute delay with the following command:\\n\\n# grep -i idle-delay /etc/dconf/db/local.d/*\\nidle-delay=uint32 900\\n\\nIf the \\\"idle-delay\\\" setting is missing or is not set to \\\"900\\\" or less, this is a finding.\"]\n[295,\"Verify the operating system prevents a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\\n\\nDetermine which profile the system database is using with the following command:\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nCheck for the lock delay setting with the following command:\\n\\nNote: The example below is using the database \\\"local\\\" for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than \\\"local\\\" is being used.\\n\\n# grep -i lock-delay /etc/dconf/db/local.d/locks/*\\n\\n/org/gnome/desktop/screensaver/lock-delay\\n\\nIf the command does not return a result, this is a finding.\"]\n[296,\"Verify the operating system prevents a user from overriding session idle delay after a 15-minute period of inactivity for graphical user interfaces. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console. \\n\\nDetermine which profile the system database is using with the following command:\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nCheck for the session idle delay setting with the following command:\\n\\nNote: The example below is using the database \\\"local\\\" for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than \\\"local\\\" is being used.\\n\\n# grep -i idle-delay /etc/dconf/db/local.d/locks/*\\n\\n/org/gnome/desktop/session/idle-delay\\n\\nIf the command does not return a result, this is a finding.\"]\n[297,\"Verify the operating system has the screen package installed.\\n\\nCheck to see if the screen package is installed with the following command:\\n\\n# yum list installed screen\\nscreen-4.3.1-3-x86_64.rpm\\n\\nIf the screen package is not installed, check to see if the tmux package is installed with the following command:\\n\\n#yum list installed tmux\\ntmux-1.8-4.el7.x86_64.rpm \\n\\nIf either the screen package or the tmux package is not installed, this is a finding.\"]\n[298,\"Verify the operating system initiates a session lock after a 15-minute period of inactivity for graphical user interfaces. The screen program must be installed to lock sessions on the console.\\n\\nNote: If the system does not have a Graphical User Interface installed, this requirement is Not Applicable.\\n\\nCheck for the session lock settings with the following commands:\\n\\n# grep -i idle-activation-enabled /etc/dconf/db/local.d/*\\n\\nidle-activation-enabled=true\\n\\nIf \\\"idle-activation-enabled\\\" is not set to \\\"true\\\", this is a finding.\"]\n[299,\"Verify the operating system prevents a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\\n\\nDetermine which profile the system database is using with the following command:\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nCheck for the idle-activation-enabled setting with the following command:\\n\\nNote: The example below is using the database \\\"local\\\" for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than \\\"local\\\" is being used.\\n\\n# grep -i idle-activation-enabled /etc/dconf/db/local.d/locks/*\\n\\n/org/gnome/desktop/screensaver/idle-activation-enabled\\n\\nIf the command does not return a result, this is a finding.\"]\n[300,\"Verify the operating system initiates a session lock a for graphical user interfaces when the screensaver is activated. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\\n\\nIf GNOME is installed, check to see a session lock occurs when the screensaver is activated with the following command:\\n\\n# grep -i lock-delay /etc/dconf/db/local.d/*\\nlock-delay=uint32 5\\n\\nIf the \\\"lock-delay\\\" setting is missing, or is not set to \\\"5\\\" or less, this is a finding.\"]\n[301,\"Verify that /etc/pam.d/passwd is configured to use /etc/pam.d/system-auth when changing passwords:\\n\\n# cat /etc/pam.d/passwd | grep -i substack | grep -i system-auth\\npassword     substack     system-auth\\n\\nIf no results are returned, the line is commented out, this is a finding.\"]\n[302,\"Verify the operating system uses \\\"pwquality\\\" to enforce the password complexity rules. \\n\\nCheck for the use of \\\"pwquality\\\" with the following command:\\n\\n# cat /etc/pam.d/system-auth | grep pam_pwquality\\n\\npassword required pam_pwquality.so retry=3\\n\\nIf the command does not return an uncommented line containing the value \\\"pam_pwquality.so\\\", this is a finding.\\n\\nIf the value of \\\"retry\\\" is set to \\\"0\\\" or greater than \\\"3\\\", this is a finding.\"]\n[303,\"Note: The value to require a number of upper-case characters to be set is expressed as a negative number in \\\"/etc/security/pwquality.conf\\\".\\n\\nCheck the value for \\\"ucredit\\\" in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep ucredit /etc/security/pwquality.conf \\nucredit = -1\\n\\nIf the value of \\\"ucredit\\\" is not set to a negative value, this is a finding.\"]\n[304,\"Note: The value to require a number of lower-case characters to be set is expressed as a negative number in \\\"/etc/security/pwquality.conf\\\".\\n\\nCheck the value for \\\"lcredit\\\" in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep lcredit /etc/security/pwquality.conf \\nlcredit = -1 \\n\\nIf the value of \\\"lcredit\\\" is not set to a negative value, this is a finding.\"]\n[305,\"Note: The value to require a number of numeric characters to be set is expressed as a negative number in \\\"/etc/security/pwquality.conf\\\".\\n\\nCheck the value for \\\"dcredit\\\" in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep dcredit /etc/security/pwquality.conf \\ndcredit = -1 \\n\\nIf the value of \\\"dcredit\\\" is not set to a negative value, this is a finding.\"]\n[306,\"Verify the operating system enforces password complexity by requiring that at least one special character be used.\\n\\nNote: The value to require a number of special characters to be set is expressed as a negative number in \\\"/etc/security/pwquality.conf\\\".\\n\\nCheck the value for \\\"ocredit\\\" in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep ocredit /etc/security/pwquality.conf \\nocredit=-1\\n\\nIf the value of \\\"ocredit\\\" is not set to a negative value, this is a finding.\"]\n[307,\"The \\\"difok\\\" option sets the number of characters in a password that must not be present in the old password.\\n\\nCheck for the value of the \\\"difok\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep difok /etc/security/pwquality.conf \\ndifok = 8\\n\\nIf the value of \\\"difok\\\" is set to less than \\\"8\\\", this is a finding.\"]\n[308,\"The \\\"minclass\\\" option sets the minimum number of required classes of characters for the new password (digits, upper-case, lower-case, others).\\n\\nCheck for the value of the \\\"minclass\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep minclass /etc/security/pwquality.conf \\nminclass = 4\\n\\nIf the value of \\\"minclass\\\" is set to less than \\\"4\\\", this is a finding.\"]\n[309,\"The \\\"maxrepeat\\\" option sets the maximum number of allowed same consecutive characters in a new password.\\n\\nCheck for the value of the \\\"maxrepeat\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep maxrepeat /etc/security/pwquality.conf \\nmaxrepeat = 3\\n\\nIf the value of \\\"maxrepeat\\\" is set to more than \\\"3\\\", this is a finding.\"]\n[310,\"The \\\"maxclassrepeat\\\" option sets the maximum number of allowed same consecutive characters in the same class in the new password.\\n\\nCheck for the value of the \\\"maxclassrepeat\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep maxclassrepeat /etc/security/pwquality.conf \\nmaxclassrepeat = 4\\n\\nIf the value of \\\"maxclassrepeat\\\" is set to more than \\\"4\\\", this is a finding.\"]\n[311,\"Verify the PAM system service is configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is SHA512.\\n\\nCheck that the system is configured to create SHA512 hashed passwords with the following command:\\n\\n# grep password /etc/pam.d/system-auth /etc/pam.d/password-auth\\n\\nOutcome should look like following:\\n/etc/pam.d/system-auth-ac:password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\\n/etc/pam.d/password-auth:password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\\n\\nIf the \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" configuration files allow for password hashes other than SHA512 to be used, this is a finding.\"]\n[312,\"Verify the system's shadow file is configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is SHA512.\\n\\nCheck that the system is configured to create SHA512 hashed passwords with the following command:\\n\\n# grep -i encrypt /etc/login.defs\\nENCRYPT_METHOD SHA512\\n\\nIf the \\\"/etc/login.defs\\\" configuration file does not exist or allows for password hashes other than SHA512 to be used, this is a finding.\"]\n[313,\"Verify the user and group account administration utilities are configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is \\\"SHA512\\\".\\n\\nCheck that the system is configured to create \\\"SHA512\\\" hashed passwords with the following command:\\n\\n# grep -i sha512 /etc/libuser.conf \\n\\ncrypt_style = sha512\\n\\nIf the \\\"crypt_style\\\" variable is not set to \\\"sha512\\\", is not in the defaults section, is commented out, or does not exist, this is a finding.\"]\n[314,\"Verify the operating system enforces 24 hours/1 day as the minimum password lifetime for new user accounts.\\n\\nCheck for the value of \\\"PASS_MIN_DAYS\\\" in \\\"/etc/login.defs\\\" with the following command: \\n\\n# grep -i pass_min_days /etc/login.defs\\nPASS_MIN_DAYS     1\\n\\nIf the \\\"PASS_MIN_DAYS\\\" parameter value is not \\\"1\\\" or greater, or is commented out, this is a finding.\"]\n[315,\"Check whether the minimum time period between password changes for each user account is one day or greater.\\n\\n# awk -F: '$4 < 1 {print $1 \\\" \\\" $4}' /etc/shadow\\n\\nIf any results are returned that are not associated with a system account, this is a finding.\"]\n[316,\"If passwords are not being used for authentication, this is Not Applicable.\\n\\nVerify the operating system enforces a 60-day maximum password lifetime restriction for new user accounts.\\n\\nCheck for the value of \\\"PASS_MAX_DAYS\\\" in \\\"/etc/login.defs\\\" with the following command:\\n\\n# grep -i pass_max_days /etc/login.defs\\nPASS_MAX_DAYS 60\\n\\nIf the \\\"PASS_MAX_DAYS\\\" parameter value is not 60 or less, or is commented out, this is a finding.\"]\n[317,\"Check whether the maximum time period for existing passwords is restricted to 60 days.\\n\\n# awk -F: '$5 > 60 {print $1 \\\" \\\" $5}' /etc/shadow\\n\\nIf any results are returned that are not associated with a system account, this is a finding.\"]\n[318,\"Verify the operating system prohibits password reuse for a minimum of five generations.\\n\\nCheck for the value of the \\\"remember\\\" argument in \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" with the following command:\\n\\n# grep -i remember /etc/pam.d/system-auth /etc/pam.d/password-auth\\n\\npassword    requisite     pam_pwhistory.so use_authtok remember=5 retry=3\\n\\nIf the line containing the \\\"pam_pwhistory.so\\\" line does not have the \\\"remember\\\" module argument set, is commented out, or the value of the \\\"remember\\\" module argument is set to less than \\\"5\\\", this is a finding.\"]\n[319,\"Verify the operating system enforces a minimum 15-character password length. The \\\"minlen\\\" option sets the minimum number of characters in a new password.\\n\\nCheck for the value of the \\\"minlen\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep minlen /etc/security/pwquality.conf\\nminlen = 15\\n\\nIf the command does not return a \\\"minlen\\\" value of 15 or greater, this is a finding.\"]\n[320,\"To verify that null passwords cannot be used, run the following command: \\n\\n# grep nullok /etc/pam.d/system-auth /etc/pam.d/password-auth\\n\\nIf this produces any output, it may be possible to log on with accounts with empty passwords.\\n\\nIf null passwords can be used, this is a finding.\"]\n[321,\"To determine how the SSH daemon's \\\"PermitEmptyPasswords\\\" option is set, run the following command:\\n\\n# grep -i PermitEmptyPasswords /etc/ssh/sshd_config\\nPermitEmptyPasswords no\\n\\nIf no line, a commented line, or a line indicating the value \\\"no\\\" is returned, the required value is set.\\n\\nIf the required value is not set, this is a finding.\"]\n[322,\"If passwords are not being used for authentication, this is Not Applicable.\\n\\nVerify the operating system disables account identifiers (individuals, groups, roles, and devices) after the password expires with the following command:\\n\\n# grep -i inactive /etc/default/useradd\\nINACTIVE=0\\n\\nIf the value is not set to \\\"0\\\", is commented out, or is not defined, this is a finding.\"]\n[323,\"Check that the system locks an account for a minimum of 15 minutes after three unsuccessful logon attempts within a period of 15 minutes with the following command:\\n\\n# grep pam_faillock.so /etc/pam.d/password-auth\\n\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so \\n\\nIf the \\\"deny\\\" parameter is set to \\\"0\\\" or a value less than \\\"3\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"even_deny_root\\\" parameter is not set on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"fail_interval\\\" parameter is set to \\\"0\\\" or is set to a value less than \\\"900\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"unlock_time\\\" parameter is not set to \\\"0\\\", \\\"never\\\", or is set to a value less than \\\"900\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nNote: The maximum configurable value for \\\"unlock_time\\\" is \\\"604800\\\". \\n\\nIf any line referencing the \\\"pam_faillock.so\\\" module is commented out, this is a finding.\\n\\n# grep pam_faillock.so /etc/pam.d/system-auth\\n\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so \\n\\nIf the \\\"deny\\\" parameter is set to \\\"0\\\" or a value less than \\\"3\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"even_deny_root\\\" parameter is not set on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"fail_interval\\\" parameter is set to \\\"0\\\" or is set to a value less than \\\"900\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"unlock_time\\\" parameter is not set to \\\"0\\\", \\\"never\\\", or is set to a value less than \\\"900\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module or is missing from these lines, this is a finding.\\n\\nNote: The maximum configurable value for \\\"unlock_time\\\" is \\\"604800\\\". \\nIf any line referencing the \\\"pam_faillock.so\\\" module is commented out, this is a finding.\"]\n[324,\"Verify the operating system automatically locks the root account until it is released by an administrator when three unsuccessful logon attempts in 15 minutes are made.\\n\\n# grep pam_faillock.so /etc/pam.d/password-auth\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900 \\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900 \\naccount required pam_faillock.so\\n\\nIf the \\\"even_deny_root\\\" setting is not defined on both lines with the \\\"pam_faillock.so\\\" module, is commented out, or is missing from a line, this is a finding.\\n\\n# grep pam_faillock.so /etc/pam.d/system-auth\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900 \\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so\\n\\nIf the \\\"even_deny_root\\\" setting is not defined on both lines with the \\\"pam_faillock.so\\\" module, is commented out, or is missing from a line, this is a finding.\"]\n[325,\"If passwords are not being used for authentication, this is Not Applicable.\\n\\nVerify the operating system requires users to supply a password for privilege escalation.\\n\\nCheck the configuration of the \\\"/etc/sudoers\\\" and \\\"/etc/sudoers.d/*\\\" files with the following command:\\n\\n# grep -i nopasswd /etc/sudoers /etc/sudoers.d/*\\n\\nIf any uncommented line is found with a \\\"NOPASSWD\\\" tag, this is a finding.\"]\n[326,\"Verify the operating system requires users to reauthenticate for privilege escalation.\\n\\nCheck the configuration of the \\\"/etc/sudoers\\\" and \\\"/etc/sudoers.d/*\\\" files with the following command:\\n\\n# grep -i authenticate /etc/sudoers /etc/sudoers.d/*\\n\\nIf any uncommented line is found with a \\\"!authenticate\\\" tag, this is a finding.\"]\n[327,\"Verify the operating system enforces a delay of at least four seconds between console logon prompts following a failed logon attempt.\\n\\nCheck the value of the \\\"fail_delay\\\" parameter in the \\\"/etc/login.defs\\\" file with the following command:\\n\\n# grep -i fail_delay /etc/login.defs\\nFAIL_DELAY 4\\n\\nIf the value of \\\"FAIL_DELAY\\\" is not set to \\\"4\\\" or greater, or the line is commented out, this is a finding.\"]\n[328,\"Verify the operating system does not allow an unattended or automatic logon to the system via a graphical user interface.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nCheck for the value of the \\\"AutomaticLoginEnable\\\" in the \\\"/etc/gdm/custom.conf\\\" file with the following command:\\n\\n# grep -i automaticloginenable /etc/gdm/custom.conf\\nAutomaticLoginEnable=false\\n\\nIf the value of \\\"AutomaticLoginEnable\\\" is not set to \\\"false\\\", this is a finding.\"]\n[329,\"Verify the operating system does not allow an unrestricted logon to the system via a graphical user interface.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nCheck for the value of the \\\"TimedLoginEnable\\\" parameter in \\\"/etc/gdm/custom.conf\\\" file with the following command:\\n\\n# grep -i timedloginenable /etc/gdm/custom.conf\\nTimedLoginEnable=false\\n\\nIf the value of \\\"TimedLoginEnable\\\" is not set to \\\"false\\\", this is a finding.\"]\n[330,\"Verify the operating system does not allow users to override environment variables to the SSH daemon.\\n\\nCheck for the value of the \\\"PermitUserEnvironment\\\" keyword with the following command:\\n\\n# grep -i permituserenvironment /etc/ssh/sshd_config\\nPermitUserEnvironment no\\n\\nIf the \\\"PermitUserEnvironment\\\" keyword is not set to \\\"no\\\", is missing, or is commented out, this is a finding.\"]\n[331,\"Verify the operating system does not allow a non-certificate trusted host SSH logon to the system.\\n\\nCheck for the value of the \\\"HostbasedAuthentication\\\" keyword with the following command:\\n\\n# grep -i hostbasedauthentication /etc/ssh/sshd_config\\nHostbasedAuthentication no\\n\\nIf the \\\"HostbasedAuthentication\\\" keyword is not set to \\\"no\\\", is missing, or is commented out, this is a finding.\"]\n[332,\"For systems that use UEFI, this is Not Applicable.\\nFor systems that are running RHEL 7.2 or newer, this is Not Applicable.\\n\\nCheck to see if an encrypted root password is set. On systems that use a BIOS, use the following command:\\n\\n# grep -i password_pbkdf2 /boot/grub2/grub.cfg\\n\\npassword_pbkdf2 [superusers-account] [password-hash]\\n\\nIf the root password entry does not begin with \\\"password_pbkdf2\\\", this is a finding.\\n\\nIf the \\\"superusers-account\\\" is not set to \\\"root\\\", this is a finding.\"]\n[333,\"Verify the operating system must require authentication upon booting into single-user and maintenance modes.\\n\\nCheck that the operating system requires authentication upon booting into single-user mode with the following command:\\n\\n# grep -i execstart /usr/lib/systemd/system/rescue.service | grep -i sulogin\\n\\nExecStart=-/bin/sh -c \\\"/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default\\\"\\n\\nIf \\\"ExecStart\\\" does not have \\\"/usr/sbin/sulogin\\\" as an option, this is a finding.\"]\n[334,\"For systems that use UEFI, this is Not Applicable.\\n\\nFor systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\\n\\nCheck to see if an encrypted root password is set. On systems that use a BIOS, use the following command:\\n\\n# grep -iw grub2_password /boot/grub2/user.cfg\\nGRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]\\n\\nIf the root password does not begin with \\\"grub.pbkdf2.sha512\\\", this is a finding.\\n\\nVerify that the \\\"root\\\" account is set as the \\\"superusers\\\":\\n\\n# grep -iw \\\"superusers\\\" /boot/grub2/grub.cfg\\n    set superusers=\\\"root\\\"\\n    export superusers\\n\\nIf \\\"superusers\\\" is not set to \\\"root\\\", this is a finding.\"]\n[335,\"For systems that use BIOS, this is Not Applicable.\\nFor systems that are running RHEL 7.2 or newer, this is Not Applicable.\\n\\nCheck to see if an encrypted root password is set. On systems that use UEFI, use the following command:\\n\\n# grep -i password /boot/efi/EFI/redhat/grub.cfg\\n\\npassword_pbkdf2 [superusers-account] [password-hash]\\n\\nIf the root password entry does not begin with \\\"password_pbkdf2\\\", this is a finding.\\n\\nIf the \\\"superusers-account\\\" is not set to \\\"root\\\", this is a finding.\"]\n[336,\"For systems that use BIOS, this is Not Applicable.\\n\\nFor systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\\n\\nCheck to see if an encrypted root password is set. On systems that use UEFI, use the following command:\\n\\n# grep -iw grub2_password /boot/efi/EFI/redhat/user.cfg\\nGRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]\\n\\nIf the root password does not begin with \\\"grub.pbkdf2.sha512\\\", this is a finding.\\n\\nVerify that the \\\"root\\\" account is set as the \\\"superusers\\\":\\n\\n# grep -iw \\\"superusers\\\" /boot/efi/EFI/redhat/grub.cfg\\n    set superusers=\\\"root\\\"\\n    export superusers\\n\\nIf \\\"superusers\\\" is not set to \\\"root\\\", this is a finding.\"]\n[337,\"Verify the operating system requires multifactor authentication to uniquely identify organizational users using multifactor authentication.\\n\\nCheck to see if smartcard authentication is enforced on the system:\\n\\n# authconfig --test | grep \\\"pam_pkcs11 is enabled\\\"\\n\\nIf no results are returned, this is a finding.\\n\\n# authconfig --test | grep \\\"smartcard removal action\\\"\\n\\nIf \\\"smartcard removal action\\\" is blank, this is a finding.\\n\\n# authconfig --test | grep \\\"smartcard module\\\"\\n\\nIf \\\"smartcard module\\\" is blank, this is a finding.\"]\n[338,\"Check to see if the rsh-server package is installed with the following command:\\n\\n# yum list installed rsh-server\\n\\nIf the rsh-server package is installed, this is a finding.\"]\n[339,\"The NIS service provides an unencrypted authentication service that does not provide for the confidentiality and integrity of user passwords or the remote session.\\n\\nCheck to see if the \\\"ypserve\\\" package is installed with the following command:\\n\\n# yum list installed ypserv\\n\\nIf the \\\"ypserv\\\" package is installed, this is a finding.\"]\n[340,\"If an HBSS or HIPS is active on the system, this is Not Applicable.\\n\\nVerify the operating system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.\\n\\nGet a list of authorized users (other than System Administrator and guest accounts) for the system.\\n\\nCheck the list against the system by using the following command:\\n\\n# semanage login -l | more\\nLogin Name SELinux User MLS/MCS Range Service\\n__default__ user_u s0-s0:c0.c1023 *\\nroot unconfined_u s0-s0:c0.c1023 *\\nsystem_u system_u s0-s0:c0.c1023 *\\njoe staff_u s0-s0:c0.c1023 *\\n\\nAll administrators must be mapped to the \\\"sysadm_u\\\" or \\\"staff_u\\\" users role.\\n\\nAll authorized non-administrative users must be mapped to the \\\"user_u\\\" role.\\n\\nIf they are not mapped in this way, this is a finding.\"]\n[341,\"Verify the operating system routinely checks the baseline configuration for unauthorized changes.\\n\\nNote: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed at least once per week.\\n\\nCheck to see if AIDE is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the SA how file integrity checks are performed on the system.\\n\\nCheck for the presence of a cron job running daily or weekly on the system that executes AIDE daily to scan for changes to the system baseline. The command used in the example will use a daily occurrence.\\n\\nCheck the cron directories for a script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:\\n\\n# ls -al /etc/cron.* | grep aide\\n-rwxr-xr-x 1 root root 29 Nov 22 2015 aide\\n\\n# grep aide /etc/crontab /var/spool/cron/root\\n/etc/crontab: 30 04 * * * /root/aide\\n/var/spool/cron/root: 30 04 * * * /root/aide\\n\\nIf the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, this is a finding.\"]\n[342,\"Verify the operating system notifies designated personnel if baseline configurations are changed in an unauthorized manner.\\n\\nNote: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed and notify specified individuals via email or an alert.\\n\\nCheck to see if AIDE is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the SA how file integrity checks are performed on the system. \\n\\nCheck for the presence of a cron job running routinely on the system that executes AIDE to scan for changes to the system baseline. The commands used in the example will use a daily occurrence.\\n\\nCheck the cron directories for a \\\"crontab\\\" script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:\\n\\n# ls -al /etc/cron.* | grep aide\\n-rwxr-xr-x 1 root root 32 Jul 1 2011 aide\\n\\n# grep aide /etc/crontab /var/spool/cron/root\\n/etc/crontab: 30 04 * * * /root/aide\\n/var/spool/cron/root: 30 04 * * * /root/aide\\n\\nAIDE does not have a configuration that will send a notification, so the cron job uses the mail application on the system to email the results of the file integrity run as in the following example:\\n\\n# more /etc/cron.daily/aide\\n#!/bin/bash\\n\\n/usr/sbin/aide --check | /bin/mail -s \\\"$HOSTNAME - Daily aide integrity check run\\\" root@sysname.mil\\n\\nIf the file integrity application does not notify designated personnel of changes, this is a finding.\"]\n[343,\"Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components from a repository without verification that they have been digitally signed using a certificate that is recognized and approved by the organization.\\n\\nCheck that yum verifies the signature of packages from a repository prior to install with the following command:\\n\\n# grep gpgcheck /etc/yum.conf\\ngpgcheck=1\\n\\nIf \\\"gpgcheck\\\" is not set to \\\"1\\\", or if options are missing or commented out, ask the System Administrator how the certificates for patches and other operating system components are verified. \\n\\nIf there is no process to validate certificates that is approved by the organization, this is a finding.\"]\n[344,\"Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components of local packages without verification that they have been digitally signed using a certificate that is recognized and approved by the organization.\\n\\nCheck that yum verifies the signature of local packages prior to install with the following command:\\n\\n# grep localpkg_gpgcheck /etc/yum.conf\\nlocalpkg_gpgcheck=1\\n\\nIf \\\"localpkg_gpgcheck\\\" is not set to \\\"1\\\", or if options are missing or commented out, ask the System Administrator how the signatures of local packages and other operating system components are verified. \\n\\nIf there is no process to validate the signatures of local packages that is approved by the organization, this is a finding.\"]\n[345,\"If there is an HBSS with a Device Control Module and a Data Loss Prevention mechanism, this requirement is not applicable.\\n\\nVerify the operating system disables the ability to load the USB Storage kernel module.\\n\\n# grep -r usb-storage /etc/modprobe.d/* | grep -i \\\"/bin/true\\\" | grep -v \\\"^#\\\"\\n\\ninstall usb-storage /bin/true\\n\\nIf the command does not return any output, or the line is commented out, and use of USB Storage is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\\n\\nVerify the operating system disables the ability to use USB mass storage devices.\\n\\nCheck to see if USB mass storage is disabled with the following command:\\n\\n# grep usb-storage /etc/modprobe.d/* | grep -i \\\"blacklist\\\" | grep -v \\\"^#\\\"\\nblacklist usb-storage\\n\\nIf the command does not return any output or the output is not \\\"blacklist usb-storage\\\", and use of USB storage devices is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[346,\"Verify the operating system disables the ability to load the DCCP kernel module.\\n\\n# grep -r dccp /etc/modprobe.d/* | grep -i \\\"/bin/true\\\" | grep -v \\\"^#\\\"\\n\\ninstall dccp /bin/true\\n\\nIf the command does not return any output, or the line is commented out, and use of DCCP is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\\n\\nVerify the operating system disables the ability to use the DCCP kernel module.\\n\\nCheck to see if the DCCP kernel module is disabled with the following command:\\n\\n# grep -i dccp /etc/modprobe.d/* | grep -i \\\"blacklist\\\" | grep -v \\\"^#\\\"\\n\\nblacklist dccp\\n\\nIf the command does not return any output or the output is not \\\"blacklist dccp\\\", and use of the dccp kernel module is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[347,\"Verify the operating system disables the ability to automount devices.\\n\\nCheck to see if automounter service is active with the following command:\\n\\n# systemctl status autofs\\nautofs.service - Automounts filesystems on demand\\n   Loaded: loaded (/usr/lib/systemd/system/autofs.service; disabled)\\n   Active: inactive (dead)\\n\\nIf the \\\"autofs\\\" status is set to \\\"active\\\" and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[348,\"Verify the operating system removes all software components after updated versions have been installed.\\n\\nCheck if yum is configured to remove unneeded packages with the following command:\\n\\n# grep -i clean_requirements_on_remove /etc/yum.conf\\nclean_requirements_on_remove=1\\n\\nIf \\\"clean_requirements_on_remove\\\" is not set to \\\"1\\\", \\\"True\\\", or \\\"yes\\\", or is not set in \\\"/etc/yum.conf\\\", this is a finding.\"]\n[349,\"If an HBSS or HIPS is active on the system, this is Not Applicable.\\n\\nVerify the operating system verifies correct operation of all security functions.\\n\\nCheck if \\\"SELinux\\\" is active and in \\\"Enforcing\\\" mode with the following command:\\n\\n# getenforce\\nEnforcing\\n\\nIf \\\"SELinux\\\" is not active and not in \\\"Enforcing\\\" mode, this is a finding.\"]\n[350,\"If an HBSS or HIPS is active on the system, this is Not Applicable.\\n\\nVerify the operating system verifies correct operation of all security functions.\\n\\nCheck if \\\"SELinux\\\" is active and is enforcing the targeted policy with the following command:\\n\\n# sestatus\\n\\nSELinux status: enabled\\n\\nSELinuxfs mount: /selinux\\n\\nSELinux root directory: /etc/selinux\\n\\nLoaded policy name: targeted\\n\\nCurrent mode: enforcing\\n\\nMode from config file: enforcing\\n\\nPolicy MLS status: enabled\\n\\nPolicy deny_unknown status: allowed\\n\\nMax kernel policy version: 28\\n\\nIf the \\\"Loaded policy name\\\" is not set to \\\"targeted\\\", this is a finding.\\n\\nVerify that the /etc/selinux/config file is configured to the \\\"SELINUXTYPE\\\" to \\\"targeted\\\":\\n\\n# grep -i \\\"selinuxtype\\\" /etc/selinux/config | grep -v '^#'\\n\\nSELINUXTYPE = targeted\\n\\nIf no results are returned or \\\"SELINUXTYPE\\\" is not set to \\\"targeted\\\", this is a finding.\"]\n[351,\"Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed.\\n\\nCheck that the ctrl-alt-del.target is masked and not active with the following command:\\n\\n# systemctl status ctrl-alt-del.target\\n\\nctrl-alt-del.target\\nLoaded: masked (/dev/null; bad)\\nActive: inactive (dead)\\n\\nIf the ctrl-alt-del.target is not masked, this is a finding.\\n\\nIf the ctrl-alt-del.target is active, this is a finding.\"]\n[352,\"Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed.\\n\\nCheck that the ctrl-alt-del.target is masked and not active in the GUI with the following command:\\n\\n# grep logout /etc/dconf/local.d/*\\n\\nlogout=''\\n\\nIf \\\"logout\\\" is not set to use two single quotations, or is missing, this is a finding.\"]\n[353,\"Verify the operating system defines default permissions for all authenticated users in such a way that the user can only read and modify their own files.\\n\\nCheck for the value of the \\\"UMASK\\\" parameter in \\\"/etc/login.defs\\\" file with the following command:\\n\\nNote: If the value of the \\\"UMASK\\\" parameter is set to \\\"000\\\" in \\\"/etc/login.defs\\\" file, the Severity is raised to a CAT I.\\n\\n# grep -i umask /etc/login.defs\\nUMASK  077\\n\\nIf the value for the \\\"UMASK\\\" parameter is not \\\"077\\\", or the \\\"UMASK\\\" parameter is missing or is commented out, this is a finding.\"]\n[354,\"Verify the version of the operating system is vendor supported.\\n\\nCheck the version of the operating system with the following command:\\n\\n# cat /etc/redhat-release\\n\\nRed Hat Enterprise Linux Server release 7.4 (Maipo)\\n\\nCurrent End of Life for RHEL 7.1 is 31 March 2017.\\n\\nCurrent End of Life for RHEL 7.2 is 30 November 2017.\\n\\nCurrent End of Life for RHEL 7.3 is 30 November 2018.\\n\\nCurrent End of Life for RHEL 7.4 is 31 August 2019.\\n\\nCurrent End of Life for RHEL 7.5 is 30 April 2020.\\n\\nCurrent End of Life for RHEL 7.6 is 31 October 2020.\\n\\nCurrent End of Life for RHEL 7.7 is 30 August 2021.\\n\\nIf the release is not supported by the vendor, this is a finding.\"]\n[355,\"Verify the operating system security patches and updates are installed and up to date. Updates are required to be applied with a frequency determined by the site or Program Management Office (PMO). \\n\\nObtain the list of available package security updates from Red Hat. The URL for updates is https://rhn.redhat.com/errata/. It is important to note that updates provided by Red Hat may not be present on the system if the underlying packages are not installed.\\n\\nCheck that the available package security updates have been installed on the system with the following command:\\n\\n# yum history list | more\\nLoaded plugins: langpacks, product-id, subscription-manager\\nID     | Command line             | Date and time    | Action(s)      | Altered\\n-------------------------------------------------------------------------------\\n    70 | install aide             | 2016-05-05 10:58 | Install       |     1   \\n    69 | update -y                | 2016-05-04 14:34 | Update     |   18 EE\\n    68 | install vlc                | 2016-04-21 17:12 | Install        |   21   \\n    67 | update -y                | 2016-04-21 17:04 | Update     |     7 EE\\n    66 | update -y                | 2016-04-15 16:47 | E, I, U         |   84 EE\\n\\nIf package updates have not been performed on the system within the timeframe that the site/program documentation requires, this is a finding. \\n\\nTypical update frequency may be overridden by Information Assurance Vulnerability Alert (IAVA) notifications from CYBERCOM.\\n\\nIf the operating system is in non-compliance with the Information Assurance Vulnerability Management (IAVM) process, this is a finding.\"]\n[356,\"Verify all accounts on the system are assigned to an active system, application, or user account.\\n\\nObtain the list of authorized system accounts from the Information System Security Officer (ISSO).\\n\\nCheck the system accounts on the system with the following command:\\n\\n# more /etc/passwd\\nroot:x:0:0:root:/root:/bin/bash\\nbin:x:1:1:bin:/bin:/sbin/nologin\\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\\nsync:x:5:0:sync:/sbin:/bin/sync\\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown\\nhalt:x:7:0:halt:/sbin:/sbin/halt\\ngames:x:12:100:games:/usr/games:/sbin/nologin\\ngopher:x:13:30:gopher:/var/gopher:/sbin/nologin\\n\\nAccounts such as \\\"games\\\" and \\\"gopher\\\" are not authorized accounts as they do not support authorized system functions. \\n\\nIf the accounts on the system do not match the provided documentation, or accounts that do not support an authorized system function are present, this is a finding.\"]\n[357,\"Verify all GIDs referenced in the \\\"/etc/passwd\\\" file are defined in the \\\"/etc/group\\\" file.\\n\\nCheck that all referenced GIDs exist with the following command:\\n\\n# pwck -r\\n\\nIf GIDs referenced in \\\"/etc/passwd\\\" file are returned as not defined in \\\"/etc/group\\\" file, this is a finding.\"]\n[358,\"Check the system for duplicate UID \\\"0\\\" assignments with the following command:\\n\\n# awk -F: '$3 == 0 {print $1}' /etc/passwd\\n\\nIf any accounts other than root have a UID of \\\"0\\\", this is a finding.\"]\n[359,\"Verify all files and directories on the system have a valid owner.\\n\\nCheck the owner of all files and directories with the following command:\\n\\nNote: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\\n\\n# find / -fstype xfs -nouser\\n\\nIf any files on the system do not have an assigned owner, this is a finding.\"]\n[360,\"Verify all files and directories on the system have a valid group.\\n\\nCheck the owner of all files and directories with the following command:\\n\\nNote: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\\n\\n# find / -fstype xfs -nogroup\\n\\nIf any files on the system do not have an assigned group, this is a finding.\"]\n[361,\"Verify local interactive users on the system have a home directory assigned.\\n\\nCheck for missing local interactive user home directories with the following command:\\n\\n# pwck -r\\nuser 'lp': directory '/var/spool/lpd' does not exist\\nuser 'news': directory '/var/spool/news' does not exist\\nuser 'uucp': directory '/var/spool/uucp' does not exist\\nuser 'smithj': directory '/home/smithj' does not exist\\n\\nAsk the System Administrator (SA) if any users found without home directories are local interactive users. If the SA is unable to provide a response, check for users with a User Identifier (UID) of 1000 or greater with the following command:\\n\\n# cut -d: -f 1,3 /etc/passwd | egrep \\\":[1-4][0-9]{2}$|:[0-9]{1,2}$\\\"\\n\\nIf any interactive users do not have a home directory assigned, this is a finding.\"]\n[362,\"Verify all local interactive users on the system are assigned a home directory upon creation.\\n\\nCheck to see if the system is configured to create home directories for local interactive users with the following command:\\n\\n# grep -i create_home /etc/login.defs\\nCREATE_HOME yes\\n\\nIf the value for \\\"CREATE_HOME\\\" parameter is not set to \\\"yes\\\", the line is missing, or the line is commented out, this is a finding.\"]\n[363,\"Verify the assigned home directory of all local interactive users on the system exists.\\n\\nCheck the home directory assignment for all local interactive non-privileged users on the system with the following command:\\n\\n# cut -d: -f 1,3,6 /etc/passwd | egrep \\\":[1-4][0-9]{3}\\\"\\n\\nsmithj:1001:/home/smithj\\n\\nNote: This may miss interactive users that have been assigned a privileged UID. Evidence of interactive use may be obtained from a number of log files containing system logon information.\\n\\nCheck that all referenced home directories exist with the following command:\\n\\n# pwck -r\\nuser 'smithj': directory '/home/smithj' does not exist\\n\\nIf any home directories referenced in \\\"/etc/passwd\\\" are returned as not defined, this is a finding.\"]\n[364,\"Verify the assigned home directory of all local interactive users has a mode of \\\"0750\\\" or less permissive.\\n\\nCheck the home directory assignment for all non-privileged users on the system with the following command:\\n\\nNote: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information.\\n\\n# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6)\\n-rwxr-x--- 1 smithj users  18 Mar  5 17:06 /home/smithj\\n\\nIf home directories referenced in \\\"/etc/passwd\\\" do not have a mode of \\\"0750\\\" or less permissive, this is a finding.\"]\n[365,\"Verify the assigned home directory of all local interactive users on the system exists.\\n\\nCheck the home directory assignment for all local interactive users on the system with the following command:\\n\\n# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6)\\n\\n-rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj\\n\\nIf any home directories referenced in \\\"/etc/passwd\\\" are not owned by the interactive user, this is a finding.\"]\n[366,\"Verify the assigned home directory of all local interactive users is group-owned by that user's primary GID.\\n\\nCheck the home directory assignment for all local interactive users on the system with the following command:\\n\\n# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6)\\n\\n-rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj\\n\\nCheck the user's primary group with the following command:\\n\\n# grep users /etc/group\\n\\nusers:x:250:smithj,jonesj,jacksons\\n\\nIf the user home directory referenced in \\\"/etc/passwd\\\" is not group-owned by that user's primary GID, this is a finding.\"]\n[367,\"Verify all files and directories in a local interactive user's home directory are owned by the user.\\n\\nCheck the owner of all files and directories in a local interactive user's home directory with the following command:\\n\\nNote: The example will be for the user \\\"smithj\\\", who has a home directory of \\\"/home/smithj\\\".\\n\\n# ls -lLR /home/smithj\\n-rw-r--r-- 1 smithj smithj  18 Mar  5 17:06 file1\\n-rw-r--r-- 1 smithj smithj 193 Mar  5 17:06 file2\\n-rw-r--r-- 1 smithj smithj 231 Mar  5 17:06 file3\\n\\nIf any files are found with an owner different than the home directory user, this is a finding.\"]\n[368,\"Verify all files and directories in a local interactive user home directory are group-owned by a group the user is a member of.\\n\\nCheck the group owner of all files and directories in a local interactive user's home directory with the following command:\\n\\nNote: The example will be for the user \\\"smithj\\\", who has a home directory of \\\"/home/smithj\\\".\\n\\n# ls -lLR /<home directory>/<users home directory>/\\n-rw-r--r-- 1 smithj smithj  18 Mar  5 17:06 file1\\n-rw-r--r-- 1 smithj smithj 193 Mar  5 17:06 file2\\n-rw-r--r-- 1 smithj sa        231 Mar  5 17:06 file3\\n\\nIf any files are found with an owner different than the group home directory user, check to see if the user is a member of that group with the following command:\\n\\n# grep smithj /etc/group\\nsa:x:100:juan,shelley,bob,smithj \\nsmithj:x:521:smithj\\n\\nIf the user is not a member of a group that group owns file(s) in a local interactive user's home directory, this is a finding.\"]\n[369,\"Verify all files and directories contained in a local interactive user home directory, excluding local initialization files, have a mode of \\\"0750\\\".\\n\\nCheck the mode of all non-initialization files in a local interactive user home directory with the following command:\\n\\nFiles that begin with a \\\".\\\" are excluded from this requirement.\\n\\nNote: The example will be for the user \\\"smithj\\\", who has a home directory of \\\"/home/smithj\\\".\\n\\n# ls -lLR /home/smithj\\n-rwxr-x--- 1 smithj smithj  18 Mar  5 17:06 file1\\n-rwxr----- 1 smithj smithj 193 Mar  5 17:06 file2\\n-rw-r-x--- 1 smithj smithj 231 Mar  5 17:06 file3\\n\\nIf any files are found with a mode more permissive than \\\"0750\\\", this is a finding.\"]\n[370,\"Verify the local initialization files of all local interactive users are group-owned by that user's primary Group Identifier (GID).\\n\\nCheck the home directory assignment for all non-privileged users on the system with the following command:\\n\\nNote: The example will be for the smithj user, who has a home directory of \\\"/home/smithj\\\" and a primary group of \\\"users\\\".\\n\\n# cut -d: -f 1,4,6 /etc/passwd | egrep \\\":[1-4][0-9]{3}\\\"\\nsmithj:1000:/home/smithj\\n\\n# grep 1000 /etc/group\\nusers:x:1000:smithj,jonesj,jacksons \\n\\nNote: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information.\\n\\nCheck the group owner of all local interactive user's initialization files with the following command:\\n\\n# ls -al /home/smithj/.[^.]* | more\\n\\n-rwxr-xr-x 1 smithj users 896 Mar 10 2011 .profile\\n-rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login\\n-rwxr-xr-x 1 smithj users 886 Jan 6 2007 .something\\n\\nIf all local interactive user's initialization files are not group-owned by that user's primary GID, this is a finding.\"]\n[371,\"Verify that all local initialization files have a mode of \\\"0740\\\" or less permissive.\\n\\nCheck the mode on all local initialization files with the following command:\\n\\nNote: The example will be for the \\\"smithj\\\" user, who has a home directory of \\\"/home/smithj\\\".\\n\\n# ls -al /home/smithj/.[^.]* | more\\n\\n-rwxr----- 1 smithj users 896 Mar 10 2011 .profile\\n-rwxr----- 1 smithj users 497 Jan 6 2007 .login\\n-rwxr----- 1 smithj users 886 Jan 6 2007 .something\\n\\nIf any local initialization files have a mode more permissive than \\\"0740\\\", this is a finding.\"]\n[372,\"Verify that all local interactive user initialization files' executable search path statements do not contain statements that will reference a working directory other than the users' home directory.\\n\\nCheck the executable search path statement for all local interactive user initialization files in the users' home directory with the following commands:\\n\\nNote: The example will be for the smithj user, which has a home directory of \\\"/home/smithj\\\".\\n\\n# grep -i path /home/smithj/.*\\n/home/smithj/.bash_profile:PATH=$PATH:$HOME/.local/bin:$HOME/bin\\n/home/smithj/.bash_profile:export PATH\\n\\nIf any local interactive user initialization files have executable search path statements that include directories outside of their home directory, this is a finding.\"]\n[373,\"Verify that local initialization files do not execute world-writable programs.\\n\\nCheck the system for world-writable files with the following command:\\n\\n# find / -xdev -perm -002 -type f -exec ls -ld {} \\\\; | more\\n\\nFor all files listed, check for their presence in the local initialization files with the following commands:\\n\\nNote: The example will be for a system that is configured to create users' home directories in the \\\"/home\\\" directory.\\n\\n# grep <file> /home/*/.*\\n\\nIf any local initialization files are found to reference world-writable files, this is a finding.\"]\n[374,\"Verify that all system device files are correctly labeled to prevent unauthorized modification.\\n\\nList all device files on the system that are incorrectly labeled with the following commands:\\n\\nNote: Device files are normally found under \\\"/dev\\\", but applications may place device files in other directories and may necessitate a search of the entire system.\\n\\n#find /dev -context *:device_t:* \\\\( -type c -o -type b \\\\) -printf \\\"%p %Z\\\\n\\\"\\n\\n#find /dev -context *:unlabeled_t:* \\\\( -type c -o -type b \\\\) -printf \\\"%p %Z\\\\n\\\"\\n\\nNote: There are device files, such as \\\"/dev/vmci\\\", that are used when the operating system is a host virtual machine. They will not be owned by a user on the system and require the \\\"device_t\\\" label to operate. These device files are not a finding.\\n\\nIf there is output from either of these commands, other than already noted, this is a finding.\"]\n[375,\"Verify file systems that contain user home directories are mounted with the \\\"nosuid\\\" option.\\n\\nFind the file system(s) that contain the user home directories with the following command:\\n\\nNote: If a separate file system has not been created for the user home directories (user home directories are mounted under \\\"/\\\"), this is not a finding as the \\\"nosuid\\\" option cannot be used on the \\\"/\\\" system.\\n\\n# cut -d: -f 1,3,6 /etc/passwd | egrep \\\":[1-4][0-9]{3}\\\"\\nsmithj:1001:/home/smithj\\nthomasr:1002:/home/thomasr\\n\\nCheck the file systems that are mounted at boot time with the following command:\\n\\n# more /etc/fstab\\n\\nUUID=a411dc99-f2a1-4c87-9e05-184977be8539 /home   ext4   rw,relatime,discard,data=ordered,nosuid 0 2\\n                                                            \\nIf a file system found in \\\"/etc/fstab\\\" refers to the user home directory file system and it does not have the \\\"nosuid\\\" option set, this is a finding.\"]\n[376,\"Verify file systems that are used for removable media are mounted with the \\\"nosuid\\\" option.\\n\\nCheck the file systems that are mounted at boot time with the following command:\\n\\n# more /etc/fstab\\n\\nUUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat noauto,owner,ro,nosuid 0 0\\n\\nIf a file system found in \\\"/etc/fstab\\\" refers to removable media and it does not have the \\\"nosuid\\\" option set, this is a finding.\"]\n[377,\"Verify file systems that are being NFS imported are configured with the \\\"nosuid\\\" option.\\n\\nFind the file system(s) that contain the directories being exported with the following command:\\n\\n# more /etc/fstab | grep nfs\\n\\nUUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d /store nfs rw,nosuid 0 0\\n\\nIf a file system found in \\\"/etc/fstab\\\" refers to NFS and it does not have the \\\"nosuid\\\" option set, this is a finding.\\n\\nVerify the NFS is mounted with the \\\"nosuid\\\" option:\\n\\n# mount | grep nfs | grep nosuid\\nIf no results are returned, this is a finding.\"]\n[378,\"Verify file systems that are being NFS imported are configured with the \\\"noexec\\\" option.\\n\\nFind the file system(s) that contain the directories being imported with the following command:\\n\\n# more /etc/fstab | grep nfs\\n\\nUUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d /store nfs rw,noexec 0 0\\n\\nIf a file system found in \\\"/etc/fstab\\\" refers to NFS and it does not have the \\\"noexec\\\" option set, and use of NFS imported binaries is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\\n\\nVerify the NFS is mounted with the \\\"noexec\\\"option:\\n\\n# mount | grep nfs | grep noexec\\nIf no results are returned and use of NFS imported binaries is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[379,\"Verify that the \\\"nodev\\\" option is configured for /dev/shm:\\n\\n\\n# cat /etc/fstab | grep /dev/shm\\ntmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0\\n\\nIf any results are returned and the \\\"nodev\\\" option is not listed, this is a finding.\\n\\nVerify \\\"/dev/shm\\\" is mounted with the \\\"nodev\\\" option:\\n\\n# mount | grep \\\"/dev/shm\\\" | grep nodev\\n\\nIf no results are returned, this is a finding.\"]\n[380,\"Verify that the \\\"nosuid\\\" option is configured for /dev/shm:\\n\\n# cat /etc/fstab | grep /dev/shm\\n\\ntmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0\\n\\nIf any results are returned and the \\\"nosuid\\\" option is not listed, this is a finding.\\n\\nVerify \\\"/dev/shm\\\" is mounted with the \\\"nosuid\\\" option:\\n\\n# mount | grep \\\"/dev/shm\\\" | grep nosuid\\n\\nIf no results are returned, this is a finding.\"]\n[381,\"Verify that the \\\"noexec\\\" option is configured for /dev/shm:\\n\\n# cat /etc/fstab | grep /dev/shm\\n\\ntmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0\\n\\nIf any results are returned and the \\\"noexec\\\" option is not listed, this is a finding.\\n\\nVerify \\\"/dev/shm\\\" is mounted with the \\\"noexec\\\" option:\\n\\n# mount | grep \\\"/dev/shm\\\" | grep noexec\\n\\nIf no results are returned, this is a finding.\"]\n[382,\"Verify all world-writable directories are group-owned by root, sys, bin, or an application group.\\n\\nCheck the system for world-writable directories with the following command:\\n\\nNote: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\\n\\n# find / -xdev -perm -002 -type d -fstype xfs -exec ls -lLd {} \\\\;\\ndrwxrwxrwt 2 root root 40 Aug 26 13:07 /dev/mqueue\\ndrwxrwxrwt 2 root root 220 Aug 26 13:23 /dev/shm\\ndrwxrwxrwt 14 root root 4096 Aug 26 13:29 /tmp\\n\\nIf any world-writable directories are not owned by root, sys, bin, or an application group associated with the directory, this is a finding.\"]\n[383,\"Verify that the default umask for all local interactive users is \\\"077\\\".\\n\\nIdentify the locations of all local interactive user home directories by looking at the \\\"/etc/passwd\\\" file.\\n\\nCheck all local interactive user initialization files for interactive users with the following command:\\n\\nNote: The example is for a system that is configured to create users home directories in the \\\"/home\\\" directory.\\n\\n# grep -i umask /home/*/.*\\n\\nIf any local interactive user initialization files are found to have a umask statement that has a value less restrictive than \\\"077\\\", this is a finding.\"]\n[384,\"Verify that \\\"rsyslog\\\" is configured to log cron events.\\n\\nCheck the configuration of \\\"/etc/rsyslog.conf\\\" or \\\"/etc/rsyslog.d/*.conf\\\" files for the cron facility with the following command:\\n\\nNote: If another logging package is used, substitute the utility configuration file for \\\"/etc/rsyslog.conf\\\" or \\\"/etc/rsyslog.d/*.conf\\\" files.\\n\\n# grep cron /etc/rsyslog.conf  /etc/rsyslog.d/*.conf\\ncron.* /var/log/cron.log\\n\\nIf the command does not return a response, check for cron logging all facilities by inspecting the \\\"/etc/rsyslog.conf\\\" or \\\"/etc/rsyslog.d/*.conf\\\" files.\\n\\nLook for the following entry:\\n\\n*.* /var/log/messages\\n\\nIf \\\"rsyslog\\\" is not logging messages for the cron facility or all facilities, this is a finding.\"]\n[385,\"Verify that the \\\"cron.allow\\\" file is owned by root.\\n\\nCheck the owner of the \\\"cron.allow\\\" file with the following command:\\n\\n# ls -al /etc/cron.allow\\n-rw------- 1 root root 6 Mar  5  2011 /etc/cron.allow\\n\\nIf the \\\"cron.allow\\\" file exists and has an owner other than root, this is a finding.\"]\n[386,\"Verify that the \\\"cron.allow\\\" file is group-owned by root.\\n\\nCheck the group owner of the \\\"cron.allow\\\" file with the following command:\\n\\n# ls -al /etc/cron.allow\\n-rw------- 1 root root 6 Mar  5  2011 /etc/cron.allow\\n\\nIf the \\\"cron.allow\\\" file exists and has a group owner other than root, this is a finding.\"]\n[387,\"Verify that kernel core dumps are disabled unless needed.\\n\\nCheck the status of the \\\"kdump\\\" service with the following command:\\n\\n# systemctl status kdump.service\\nkdump.service - Crash recovery kernel arming\\n   Loaded: loaded (/usr/lib/systemd/system/kdump.service; enabled)\\n   Active: active (exited) since Wed 2015-08-26 13:08:09 EDT; 43min ago\\n Main PID: 1130 (code=exited, status=0/SUCCESS)\\nkernel arming.\\n\\nIf the \\\"kdump\\\" service is active, ask the System Administrator if the use of the service is required and documented with the Information System Security Officer (ISSO).\\n\\nIf the service is active and is not documented, this is a finding.\"]\n[388,\"Verify that a separate file system/partition has been created for non-privileged local interactive user home directories.\\n\\nCheck the home directory assignment for all non-privileged users (those with a UID greater than 1000) on the system with the following command:\\n\\n#cut -d: -f 1,3,6,7 /etc/passwd | egrep \\\":[1-4][0-9]{3}\\\" | tr \\\":\\\" \\\"\\\\t\\\"\\n\\nadamsj /home/adamsj /bin/bash\\njacksonm /home/jacksonm /bin/bash\\nsmithj /home/smithj /bin/bash\\n\\nThe output of the command will give the directory/partition that contains the home directories for the non-privileged users on the system (in this example, /home) and users' shell. All accounts with a valid shell (such as /bin/bash) are considered interactive users.\\n\\nCheck that a file system/partition has been created for the non-privileged interactive users with the following command:\\n\\nNote: The partition of /home is used in the example.\\n\\n# grep /home /etc/fstab\\nUUID=333ada18    /home                   ext4    noatime,nobarrier,nodev  1 2\\n\\nIf a separate entry for the file system/partition that contains the non-privileged interactive users' home directories does not exist, this is a finding.\"]\n[389,\"Verify that a separate file system/partition has been created for \\\"/var\\\".\\n\\nCheck that a file system/partition has been created for \\\"/var\\\" with the following command:\\n\\n# grep /var /etc/fstab\\nUUID=c274f65f    /var                    ext4    noatime,nobarrier        1 2\\n\\nIf a separate entry for \\\"/var\\\" is not in use, this is a finding.\"]\n[390,\"Determine if the operating system is configured to have the \\\"/var/log/audit\\\" path is on a separate file system.\\n\\n# grep /var/log/audit /etc/fstab\\n\\nIf no result is returned, or the operating system is not configured to have \\\"/var/log/audit\\\" on a separate file system, this is a finding.\\n\\nVerify that \\\"/var/log/audit\\\" is mounted on a separate file system:\\n\\n# mount | grep \\\"/var/log/audit\\\"\\n\\nIf no result is returned, or \\\"/var/log/audit\\\" is not on a separate file system, this is a finding.\"]\n[391,\"Verify that a separate file system/partition has been created for \\\"/tmp\\\".\\n\\nCheck that a file system/partition has been created for \\\"/tmp\\\" with the following command:\\n\\n# systemctl is-enabled tmp.mount\\nenabled\\n\\nIf the \\\"tmp.mount\\\" service is not enabled, check to see if \\\"/tmp\\\" is defined in the fstab with a device and mount point:\\n\\n# grep -i /tmp /etc/fstab\\nUUID=a411dc99-f2a1-4c87-9e05-184977be8539 /tmp   ext4   rw,relatime,discard,data=ordered,nosuid,noexec, 0 0\\n\\nIf \\\"tmp.mount\\\" service is not enabled and the \\\"/tmp\\\" directory is not defined in the fstab with a device and mount point, this is a finding.\"]\n[392,\"Verify the operating system implements DoD-approved encryption to protect the confidentiality of remote access sessions.\\n\\nCheck to see if the \\\"dracut-fips\\\" package is installed with the following command:\\n\\n# yum list installed dracut-fips\\n\\ndracut-fips-033-360.el7_2.x86_64.rpm\\n\\nIf a \\\"dracut-fips\\\" package is installed, check to see if the kernel command line is configured to use FIPS mode with the following command:\\n\\nNote: GRUB 2 reads its configuration from the \\\"/boot/grub2/grub.cfg\\\" file on traditional BIOS-based machines and from the \\\"/boot/efi/EFI/redhat/grub.cfg\\\" file on UEFI machines.\\n\\n# grep fips /boot/grub2/grub.cfg\\n/vmlinuz-3.8.0-0.40.el7.x86_64 root=/dev/mapper/rhel-root ro rd.md=0 rd.dm=0 rd.lvm.lv=rhel/swap crashkernel=auto rd.luks=0 vconsole.keymap=us rd.lvm.lv=rhel/root rhgb fips=1 quiet\\n\\nIf the kernel command line is configured to use FIPS mode, check to see if the system is in FIPS mode with the following command:\\n\\n# cat /proc/sys/crypto/fips_enabled \\n1\\n\\nIf a \\\"dracut-fips\\\" package is not installed, the kernel command line does not have a fips entry, or the system has a value of \\\"0\\\" for \\\"fips_enabled\\\" in \\\"/proc/sys/crypto\\\", this is a finding.\"]\n[393,\"Verify the file integrity tool is configured to verify ACLs.\\n\\nCheck to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. \\n\\nIf there is no application installed to perform file integrity checks, this is a finding.\\n\\nNote: AIDE is highly configurable at install time. These commands assume the \\\"aide.conf\\\" file is under the \\\"/etc\\\" directory. \\n\\nUse the following command to determine if the file is in another location:\\n\\n# find / -name aide.conf\\n\\nCheck the \\\"aide.conf\\\" file to determine if the \\\"acl\\\" rule has been added to the rule list being applied to the files and directories selection lists.\\n\\nAn example rule that includes the \\\"acl\\\" rule is below:\\n\\nAll= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\\n/bin All # apply the custom rule to the files in bin \\n/sbin All # apply the same custom rule to the files in sbin \\n\\nIf the \\\"acl\\\" rule is not being used on all uncommented selection lines in the \\\"/etc/aide.conf\\\" file, or ACLs are not being checked by another file integrity tool, this is a finding.\"]\n[394,\"Verify the file integrity tool is configured to verify extended attributes.\\n\\nCheck to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system.\\n\\nIf there is no application installed to perform file integrity checks, this is a finding.\\n\\nNote: AIDE is highly configurable at install time. These commands assume the \\\"aide.conf\\\" file is under the \\\"/etc\\\" directory.\\n\\nUse the following command to determine if the file is in another location:\\n\\n# find / -name aide.conf\\n\\nCheck the \\\"aide.conf\\\" file to determine if the \\\"xattrs\\\" rule has been added to the rule list being applied to the files and directories selection lists.\\n\\nAn example rule that includes the \\\"xattrs\\\" rule follows:\\n\\nAll= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\\n/bin All # apply the custom rule to the files in bin \\n/sbin All # apply the same custom rule to the files in sbin \\n\\nIf the \\\"xattrs\\\" rule is not being used on all uncommented selection lines in the \\\"/etc/aide.conf\\\" file, or extended attributes are not being checked by another file integrity tool, this is a finding.\"]\n[395,\"Verify the file integrity tool is configured to use FIPS 140-2 approved cryptographic hashes for validating file contents and directories.\\n\\nNote: If RHEL-07-021350 is a finding, this is automatically a finding too as the system cannot implement FIPS 140-2 approved cryptographic algorithms and hashes.\\n\\nCheck to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. \\n\\nIf there is no application installed to perform file integrity checks, this is a finding.\\n\\nNote: AIDE is highly configurable at install time. These commands assume the \\\"aide.conf\\\" file is under the \\\"/etc\\\" directory. \\n\\nUse the following command to determine if the file is in another location:\\n\\n# find / -name aide.conf\\n\\nCheck the \\\"aide.conf\\\" file to determine if the \\\"sha512\\\" rule has been added to the rule list being applied to the files and directories selection lists.\\n\\nAn example rule that includes the \\\"sha512\\\" rule follows:\\n\\nAll=p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\\n/bin All # apply the custom rule to the files in bin \\n/sbin All # apply the same custom rule to the files in sbin \\n\\nIf the \\\"sha512\\\" rule is not being used on all uncommented selection lines in the \\\"/etc/aide.conf\\\" file, or another file integrity tool is not using FIPS 140-2 approved cryptographic hashes for validating file contents and directories, this is a finding.\"]\n[396,\"Verify the system is not configured to use a boot loader on removable media.\\n\\nNote: GRUB 2 reads its configuration from the \\\"/boot/grub2/grub.cfg\\\" file on traditional BIOS-based machines and from the \\\"/boot/efi/EFI/redhat/grub.cfg\\\" file on UEFI machines.\\n\\nCheck for the existence of alternate boot loader configuration files with the following command:\\n\\n# find / -name grub.cfg\\n/boot/grub2/grub.cfg\\n\\nIf a \\\"grub.cfg\\\" is found in any subdirectories other than \\\"/boot/grub2\\\" and \\\"/boot/efi/EFI/redhat\\\", ask the System Administrator if there is documentation signed by the ISSO to approve the use of removable media as a boot loader. \\n\\nCheck that the grub configuration file has the set root command in each menu entry with the following commands:\\n\\n# grep -c menuentry /boot/grub2/grub.cfg\\n1\\n# grep 'set root' /boot/grub2/grub.cfg\\nset root=(hd0,1)\\n\\nIf the system is using an alternate boot loader on removable media, and documentation does not exist approving the alternate configuration, this is a finding.\"]\n[397,\"Verify the operating system is configured to disable non-essential capabilities. The most secure way of ensuring a non-essential capability is disabled is to not have the capability installed.\\n\\nThe telnet service provides an unencrypted remote access service that does not provide for the confidentiality and integrity of user passwords or the remote session.\\n\\nIf a privileged user were to log on using this service, the privileged user password could be compromised. \\n\\nCheck to see if the telnet-server package is installed with the following command:\\n\\n# yum list installed telnet-server\\n\\nIf the telnet-server package is installed, this is a finding.\"]\n[398,\"Verify the operating system produces audit records containing information to establish when (date and time) the events occurred.\\n\\nCheck to see if auditing is active by issuing the following command:\\n\\n# systemctl is-active auditd.service\\nactive\\n\\nIf the \\\"auditd\\\" status is not active, this is a finding.\"]\n[399,\"Confirm the audit configuration regarding how auditing processing failures are handled.\\n\\nCheck to see what level \\\"auditctl\\\" is set to with following command: \\n\\n# auditctl -s | grep -i \\\"fail\\\"\\n\\nfailure 2\\n\\nIf the value of \\\"failure\\\" is set to \\\"2\\\", the system is configured to panic (shut down) in the event of an auditing failure.\\n\\nIf the value of \\\"failure\\\" is set to \\\"1\\\", the system is configured to only send information to the kernel log regarding the failure.\\n\\nIf the \\\"failure\\\" setting is not set, this is a CAT I finding.\\n\\nIf the \\\"failure\\\" setting is set to any value other than \\\"1\\\" or \\\"2\\\", this is a CAT II finding.\\n\\nIf the \\\"failure\\\" setting is set to \\\"1\\\" but the availability concern is not documented or there is no monitoring of the kernel log, this is a CAT III finding.\"]\n[400,\"Verify the \\\"au-remote\\\" plugin is active on the system:\\n\\n# grep \\\"active\\\" /etc/audisp/plugins.d/au-remote.conf\\n\\nactive = yes\\n\\nIf the \\\"active\\\" setting is not set to \\\"yes\\\", or the line is commented out, this is a finding.\"]\n[401,\"Verify the \\\"au-remote\\\" plugin is configured to always off-load audit logs using the audisp-remote daemon:\\n\\n# cat /etc/audisp/plugins.d/au-remote.conf | grep -v \\\"^#\\\"\\n\\nactive = yes\\ndirection = out\\npath = /sbin/audisp-remote\\ntype = always\\nformat = string\\n\\nIf the \\\"direction\\\" setting is not set to \\\"out\\\", or the line is commented out, this is a finding.\\n\\nIf the \\\"path\\\" setting is not set to \\\"/sbin/audisp-remote\\\", or the line is commented out, this is a finding.\\n\\nIf the \\\"type\\\" setting is not set to \\\"always\\\", or the line is commented out, this is a finding.\"]\n[402,\"Verify the audisp daemon is configured to take an appropriate action when the internal queue is full:\\n\\n# grep \\\"overflow_action\\\" /etc/audisp/audispd.conf\\n\\noverflow_action = syslog\\n\\nIf the \\\"overflow_action\\\" option is not \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\", or the line is commented out, this is a finding.\"]\n[403,\"Verify the audisp daemon is configured to label all off-loaded audit logs:\\n\\n# grep \\\"name_format\\\" /etc/audisp/audispd.conf\\n\\nname_format = hostname\\n\\nIf the \\\"name_format\\\" option is not \\\"hostname\\\", \\\"fqd\\\", or \\\"numeric\\\", or the line is commented out, this is a finding.\"]\n[404,\"Verify the operating system off-loads audit records onto a different system or media from the system being audited.\\n\\nTo determine the remote server that the records are being sent to, use the following command:\\n\\n# grep -i remote_server /etc/audisp/audisp-remote.conf\\nremote_server = 10.0.21.1\\n\\nIf a remote server is not configured, or the line is commented out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. \\n\\nIf there is no evidence that the audit logs are being off-loaded to another system or media, this is a finding.\"]\n[405,\"Verify the operating system encrypts audit records off-loaded onto a different system or media from the system being audited.\\n\\nTo determine if the transfer is encrypted, use the following command:\\n\\n# grep -i enable_krb5 /etc/audisp/audisp-remote.conf\\nenable_krb5 = yes\\n\\nIf the value of the \\\"enable_krb5\\\" option is not set to \\\"yes\\\" or the line is commented out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. \\n\\nIf there is no evidence that the transfer of the audit logs being off-loaded to another system or media is encrypted, this is a finding.\"]\n[406,\"Verify the action the operating system takes if the disk the audit records are written to becomes full.\\n\\nTo determine the action that takes place if the disk is full on the remote server, use the following command:\\n\\n# grep -i disk_full_action /etc/audisp/audisp-remote.conf\\ndisk_full_action = single\\n\\nIf the value of the \\\"disk_full_action\\\" option is not \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\", or the line is commented out, this is a finding.\"]\n[407,\"Verify the action the operating system takes if there is an error sending audit records to a remote system.\\n\\nCheck the action that takes place if there is an error sending audit records to a remote system with the following command:\\n\\n# grep -i network_failure_action /etc/audisp/audisp-remote.conf\\nnetwork_failure_action = syslog\\n\\nIf the value of the \\\"network_failure_action\\\" option is not \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\", or the line is commented out, this is a finding.\"]\n[408,\"Verify the operating system initiates an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\\n\\nCheck the system configuration to determine the partition the audit records are being written to with the following command:\\n\\n# grep -iw log_file /etc/audit/auditd.conf\\nlog_file = /var/log/audit/audit.log\\n\\nCheck the size of the partition that audit records are written to (with the example being \\\"/var/log/audit/\\\"):\\n\\n# df -h /var/log/audit/\\n0.9G /var/log/audit\\n\\nIf the audit records are not being written to a partition specifically created for audit records (in this example \\\"/var/log/audit\\\" is a separate partition), determine the amount of space other files in the partition are currently occupying with the following command:\\n\\n# du -sh <partition>\\n1.8G /var\\n\\nDetermine what the threshold is for the system to take action when 75 percent of the repository maximum audit record storage capacity is reached:\\n\\n# grep -iw space_left /etc/audit/auditd.conf\\nspace_left = 225 \\n\\nIf the value of the \\\"space_left\\\" keyword is not set to 25 percent of the total partition size, this is a finding.\"]\n[409,\"Verify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\\n\\nCheck what action the operating system takes when the threshold for the repository maximum audit record storage capacity is reached with the following command:\\n\\n# grep -i space_left_action  /etc/audit/auditd.conf\\nspace_left_action = email\\n\\nIf the value of the \\\"space_left_action\\\" keyword is not set to \\\"email\\\", this is a finding.\"]\n[410,\"Verify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the threshold for the repository maximum audit record storage capacity is reached.\\n\\nCheck what account the operating system emails when the threshold for the repository maximum audit record storage capacity is reached with the following command:\\n\\n# grep -i action_mail_acct  /etc/audit/auditd.conf\\naction_mail_acct = root\\n\\nIf the value of the \\\"action_mail_acct\\\" keyword is not set to \\\"root\\\" and other accounts for security personnel, this is a finding.\"]\n[411,\"Verify the operating system audits the execution of privileged functions using the following command:\\n\\n# grep -iw execve /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid\\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid\\n-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid\\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid\\n\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules for \\\"SUID\\\" files are not defined, this is a finding.\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules for \\\"SGID\\\" files are not defined, this is a finding.\"]\n[412,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chown\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw chown /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"chown\\\" syscall, this is a finding.\"]\n[413,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fchown\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw fchown /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fchown\\\" syscall, this is a finding.\"]\n[414,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"lchown\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw lchown /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"lchown\\\" syscall, this is a finding.\"]\n[415,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fchownat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw fchownat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fchownat\\\" syscall, this is a finding.\"]\n[416,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chmod\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw chmod /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"chmod\\\" syscall, this is a finding.\"]\n[417,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fchmod\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw fchmod /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fchmod\\\" syscall, this is a finding.\"]\n[418,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fchmodat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw fchmodat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fchmodat\\\" syscall, this is a finding.\"]\n[419,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"setxattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw setxattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"setxattr\\\" syscall, this is a finding.\"]\n[420,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fsetxattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw fsetxattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fsetxattr\\\" syscall, this is a finding.\"]\n[421,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"lsetxattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw lsetxattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"lsetxattr\\\" syscall, this is a finding.\"]\n[422,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"removexattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw removexattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"removexattr\\\" syscall, this is a finding.\"]\n[423,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fremovexattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw fremovexattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fremovexattr\\\" syscall, this is a finding.\"]\n[424,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"lremovexattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw lremovexattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"lremovexattr\\\" syscall, this is a finding.\"]\n[425,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"creat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw creat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S creat F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"creat\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[426,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"open\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw open /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"open\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[427,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"openat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw openat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"openat\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[428,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"open_by_handle_at\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw open_by_handle_at /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"open_by_handle_at\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[429,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"truncate\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw truncate /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"truncate\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[430,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"ftruncate\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw ftruncate /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"ftruncate\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[431,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"semanage\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/sbin/semanage /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[432,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"setsebool\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/sbin/setsebool /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[433,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chcon\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/bin/chcon /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[434,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"setfiles\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw /usr/sbin/setfiles /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[435,\"Verify the operating system generates audit records when unsuccessful account access events occur. \\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following commands: \\n\\n# grep -i /var/run/faillock /etc/audit/audit.rules\\n\\n-w /var/run/faillock -p wa -k logins\\n\\nIf the command does not return any output, this is a finding.\"]\n[436,\"Verify the operating system generates audit records when successful account access events occur. \\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands: \\n\\n# grep -i /var/log/lastlog /etc/audit/audit.rules\\n\\n-w /var/log/lastlog -p wa -k logins \\n\\nIf the command does not return any output, this is a finding.\"]\n[437,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"passwd\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/bin/passwd /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[438,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"unix_chkpwd\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw /usr/sbin/unix_chkpwd /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[439,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"gpasswd\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/bin/gpasswd /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[440,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chage\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/bin/chage /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[441,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"userhelper\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/sbin/userhelper /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[442,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"su\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/bin/su /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[443,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"sudo\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/bin/sudo /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[444,\"Verify the operating system generates audit records when successful/unsuccessful attempts to access the \\\"/etc/sudoers\\\" file and files in the \\\"/etc/sudoers.d/\\\" directory. \\n\\nCheck for modification of the following files being audited by performing the following commands to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -i \\\"/etc/sudoers\\\" /etc/audit/audit.rules\\n\\n-w /etc/sudoers -p wa -k privileged-actions\\n\\n# grep -i \\\"/etc/sudoers.d/\\\" /etc/audit/audit.rules\\n\\n-w /etc/sudoers.d/ -p wa -k privileged-actions\\n\\nIf the commands do not return output that match the examples, this is a finding.\"]\n[445,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"newgrp\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -i /usr/bin/newgrp /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[446,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chsh\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -i /usr/bin/chsh /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[447,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"mount\\\" command and syscall occur.\\n\\nCheck that the following system call is being audited by performing the following series of commands to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw \\\"mount\\\" /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n-a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"mount\\\" syscall, this is a finding.\\n\\nIf all uses of the \\\"mount\\\" command are not being audited, this is a finding.\"]\n[448,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"umount\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following series of commands to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw \\\"/usr/bin/umount\\\" /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=4294967295 -k privileged-mount \\n\\nIf the command does not return any output, this is a finding.\"]\n[449,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"postdrop\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/sbin/postdrop /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=4294967295 -k privileged-postfix\\n\\nIf the command does not return any output, this is a finding.\"]\n[450,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"postqueue\\\" command occur. \\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/sbin/postqueue /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=4294967295 -k privileged-postfix\\n\\nIf the command does not return any output, this is a finding.\"]\n[451,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"ssh-keysign\\\" command occur. \\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/libexec/openssh/ssh-keysign /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=4294967295 -k privileged-ssh\\n\\nIf the command does not return any output, this is a finding.\"]\n[452,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"crontab\\\" command occur. \\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/bin/crontab /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=4294967295 -k privileged-cron\\n\\nIf the command does not return any output, this is a finding.\"]\n[453,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"pam_timestamp_check\\\" command occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw \\\"/usr/sbin/pam_timestamp_check\\\" /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F auid>=1000 -F auid!=4294967295 -k privileged-pam \\n\\nIf the command does not return any output, this is a finding.\"]\n[454,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"create_module\\\" syscall occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw create_module /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S create_module -k module-change\\n\\n-a always,exit -F arch=b64 -S create_module -k module-change\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"create_module\\\" syscall, this is a finding.\"]\n[455,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"init_module\\\" syscall occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw init_module /etc/audit/audit.rules \\n\\n-a always,exit -F arch=b32 -S init_module -k module-change\\n\\n-a always,exit -F arch=b64 -S init_module -k module-change\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"init_module\\\" syscall, this is a finding.\"]\n[456,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"finit_module\\\" syscall occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw finit_module /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S finit_module -k module-change\\n\\n-a always,exit -F arch=b64 -S finit_module -k module-change\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"finit_module\\\" syscall, this is a finding.\"]\n[457,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"delete_module\\\" syscall occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw delete_module /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S delete_module -k module-change\\n\\n-a always,exit -F arch=b64 -S delete_module -k module-change\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"delete_module\\\" syscall, this is a finding.\"]\n[458,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"kmod\\\" command occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw kmod /etc/audit/audit.rules\\n\\n-w /usr/bin/kmod -p x -F auid!=4294967295 -k module-change\\n\\nIf the command does not return any output, this is a finding.\"]\n[459,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/passwd\\\".\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/passwd /etc/audit/audit.rules\\n\\n-w /etc/passwd -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[460,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/group\\\".\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/group /etc/audit/audit.rules\\n\\n-w /etc/group -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[461,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/gshadow\\\".\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/gshadow /etc/audit/audit.rules\\n\\n-w /etc/gshadow -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[462,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/shadow /etc/audit/audit.rules\\n\\n-w /etc/shadow -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[463,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/security/opasswd /etc/audit/audit.rules\\n\\n-w /etc/security/opasswd -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[464,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"rename\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw rename /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"rename\\\" syscall, this is a finding.\"]\n[465,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"renameat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw renameat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"renameat\\\" syscall, this is a finding.\"]\n[466,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"rmdir\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw rmdir /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"rmdir\\\" syscall, this is a finding.\"]\n[467,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"unlink\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw unlink /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"unlink\\\" syscall, this is a finding.\"]\n[468,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"unlinkat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw unlinkat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"unlinkat\\\" syscall, this is a finding.\"]\n[469,\"Verify \\\"rsyslog\\\" is configured to send all messages to a log aggregation server.\\n\\nCheck the configuration of \\\"rsyslog\\\" with the following command:\\n\\nNote: If another logging package is used, substitute the utility configuration file for \\\"/etc/rsyslog.conf\\\".\\n\\n# grep @ /etc/rsyslog.conf /etc/rsyslog.d/*.conf\\n*.* @@logagg.site.mil\\n\\nIf there are no lines in the \\\"/etc/rsyslog.conf\\\" or \\\"/etc/rsyslog.d/*.conf\\\" files that contain the \\\"@\\\" or \\\"@@\\\" symbol(s), and the lines with the correct symbol(s) to send output to another system do not cover all \\\"rsyslog\\\" output, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. \\n\\nIf the lines are commented out or there is no evidence that the audit logs are being sent to another system, this is a finding.\"]\n[470,\"Verify that the system is not accepting \\\"rsyslog\\\" messages from other systems unless it is documented as a log aggregation server.\\n\\nCheck the configuration of \\\"rsyslog\\\" with the following command:\\n\\n# grep imtcp /etc/rsyslog.conf\\n$ModLoad imtcp\\n# grep imudp /etc/rsyslog.conf\\n$ModLoad imudp\\n# grep imrelp /etc/rsyslog.conf\\n$ModLoad imrelp\\n\\nIf any of the above modules are being loaded in the \\\"/etc/rsyslog.conf\\\" file, ask to see the documentation for the system being used for log aggregation.\\n\\nIf the documentation does not exist, or does not specify the server as a log aggregation system, this is a finding.\"]\n[471,\"Verify the operating system limits the number of concurrent sessions to \\\"10\\\" for all accounts and/or account types by issuing the following command:\\n\\n# grep \\\"maxlogins\\\" /etc/security/limits.conf /etc/security/limits.d/*.conf\\n\\n* hard maxlogins 10\\n\\nThis can be set as a global domain (with the * wildcard) but may be set differently for multiple domains.\\n\\nIf the \\\"maxlogins\\\" item is missing, commented out, or the value is not set to \\\"10\\\" or less for all domains that have the \\\"maxlogins\\\" item assigned, this is a finding.\"]\n[472,\"Inspect the firewall configuration and running services to verify that it is configured to prohibit or restrict the use of functions, ports, protocols, and/or services that are unnecessary or prohibited.\\n\\nCheck which services are currently active with the following command:\\n\\n# firewall-cmd --list-all\\npublic (default, active)\\n  interfaces: enp0s3\\n  sources: \\n  services: dhcpv6-client dns http https ldaps rpc-bind ssh\\n  ports: \\n  masquerade: no\\n  forward-ports: \\n  icmp-blocks: \\n  rich rules: \\n\\nAsk the System Administrator for the site or program PPSM CLSA. Verify the services allowed by the firewall match the PPSM CLSA. \\n\\nIf there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols, or services that are prohibited by the PPSM Category Assurance List (CAL), this is a finding.\"]\n[473,\"Verify the operating system uses mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.\\n\\nNote: If RHEL-07-021350 is a finding, this is automatically a finding as the system cannot implement FIPS 140-2-approved cryptographic algorithms and hashes.\\n\\nThe location of the \\\"sshd_config\\\" file may vary if a different daemon is in use.\\n\\nInspect the \\\"Ciphers\\\" configuration with the following command:\\n\\n# grep -i ciphers /etc/ssh/sshd_config\\nCiphers aes128-ctr,aes192-ctr,aes256-ctr\\n\\nIf any ciphers other than \\\"aes128-ctr\\\", \\\"aes192-ctr\\\", or \\\"aes256-ctr\\\" are listed, the \\\"Ciphers\\\" keyword is missing, or the returned line is commented out, this is a finding.\"]\n[474,\"Verify the operating system terminates all network connections associated with a communications session at the end of the session or based on inactivity.\\n\\nCheck the value of the system inactivity timeout with the following command:\\n\\n# grep -i tmout /etc/profile.d/*\\n\\netc/profile.d/tmout.sh:TMOUT=600\\n\\n/etc/profile.d/tmout.sh:readonly TMOUT\\n\\n/etc/profile.d/tmout.sh:export TMOUT\\n\\nIf \\\"TMOUT\\\" is not set to \\\"600\\\" or less in a script located in the /etc/profile.d/ directory to enforce session termination after inactivity, this is a finding.\"]\n[475,\"Verify any publicly accessible connection to the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\\n\\nCheck for the location of the banner file being used with the following command:\\n\\n# grep -i banner /etc/ssh/sshd_config\\n\\nbanner /etc/issue\\n\\nThis command will return the banner keyword and the name of the file that contains the ssh banner (in this case \\\"/etc/issue\\\").\\n\\nIf the line is commented out, this is a finding.\\n\\nView the file specified by the banner keyword to check that it matches the text of the Standard Mandatory DoD Notice and Consent Banner:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nIf the system does not display a graphical logon banner or the banner does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.\\n\\nIf the text in the file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.\"]\n[476,\"If LDAP is not being utilized, this requirement is Not Applicable.\\n\\nVerify the operating system implements cryptography to protect the integrity of remote LDAP authentication sessions.\\n\\nTo determine if LDAP is being used for authentication, use the following command:\\n\\n# systemctl status sssd.service\\nsssd.service - System Security Services Daemon\\nLoaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\\nActive: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\\n\\nIf the \\\"sssd.service\\\" is \\\"active\\\", then LDAP is being used. \\n\\nDetermine the \\\"id_provider\\\" the LDAP is currently using:\\n\\n# grep -i \\\"id_provider\\\" /etc/sssd/sssd.conf\\n\\nid_provider = ad\\n\\nIf \\\"id_provider\\\" is set to \\\"ad\\\", this is Not Applicable.\\n\\nEnsure that LDAP is configured to use TLS by using the following command:\\n\\n# grep -i \\\"start_tls\\\" /etc/sssd/sssd.conf\\nldap_id_use_start_tls = true\\n\\nIf the \\\"ldap_id_use_start_tls\\\" option is not \\\"true\\\", this is a finding.\"]\n[477,\"If LDAP is not being utilized, this requirement is Not Applicable.\\n\\nVerify the operating system implements cryptography to protect the integrity of remote LDAP access sessions.\\n\\nTo determine if LDAP is being used for authentication, use the following command:\\n\\n# systemctl status sssd.service\\nsssd.service - System Security Services Daemon\\nLoaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\\nActive: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\\n\\nIf the \\\"sssd.service\\\" is \\\"active\\\", then LDAP is being used. \\n\\nDetermine the \\\"id_provider\\\" the LDAP is currently using:\\n\\n# grep -i \\\"id_provider\\\" /etc/sssd/sssd.conf\\n\\nid_provider = ad\\n\\nIf \\\"id_provider\\\" is set to \\\"ad\\\", this is Not Applicable.\\n\\nVerify the sssd service is configured to require the use of certificates:\\n\\n# grep -i tls_reqcert /etc/sssd/sssd.conf\\nldap_tls_reqcert = demand\\n\\nIf the \\\"ldap_tls_reqcert\\\" setting is missing, commented out, or does not exist, this is a finding.\\n\\nIf the \\\"ldap_tls_reqcert\\\" setting is not set to \\\"demand\\\" or \\\"hard\\\", this is a finding.\"]\n[478,\"If LDAP is not being utilized, this requirement is Not Applicable.\\n\\nVerify the operating system implements cryptography to protect the integrity of remote LDAP access sessions.\\n\\nTo determine if LDAP is being used for authentication, use the following command:\\n\\n# systemctl status sssd.service\\nsssd.service - System Security Services Daemon\\nLoaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\\nActive: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\\n\\nIf the \\\"sssd.service\\\" is \\\"active\\\", then LDAP is being used.\\n\\nDetermine the \\\"id_provider\\\" that the LDAP is currently using:\\n\\n# grep -i \\\"id_provider\\\" /etc/sssd/sssd.conf\\n\\nid_provider = ad\\n\\nIf \\\"id_provider\\\" is set to \\\"ad\\\", this is Not Applicable.\\n\\nCheck the path to the X.509 certificate for peer authentication with the following command:\\n\\n# grep -i tls_cacert /etc/sssd/sssd.conf\\n\\nldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt\\n\\nVerify the \\\"ldap_tls_cacert\\\" option points to a file that contains the trusted CA certificate.\\n\\nIf this file does not exist, or the option is commented out or missing, this is a finding.\"]\n[479,\"Verify the operating system implements virtual address space randomization.\\n\\n# grep kernel.randomize_va_space /etc/sysctl.conf /etc/sysctl.d/*\\n\\nkernel.randomize_va_space = 2\\n\\nIf \\\"kernel.randomize_va_space\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \\\"2\\\", this is a finding.\\n\\nCheck that the operating system implements virtual address space randomization with the following command:\\n\\n# /sbin/sysctl -a | grep kernel.randomize_va_space \\n\\nkernel.randomize_va_space = 2\\n\\nIf \\\"kernel.randomize_va_space\\\" does not have a value of \\\"2\\\", this is a finding.\"]\n[480,\"Check to see if sshd is installed with the following command:\\n\\n# yum list installed \\\\*ssh\\\\*\\nlibssh2.x86_64 1.4.3-8.el7 @anaconda/7.1\\nopenssh.x86_64 6.6.1p1-11.el7 @anaconda/7.1\\nopenssh-server.x86_64 6.6.1p1-11.el7 @anaconda/7.1\\n\\nIf the \\\"SSH server\\\" package is not installed, this is a finding.\"]\n[481,\"Verify SSH is loaded and active with the following command:\\n\\n# systemctl status sshd\\nsshd.service - OpenSSH server daemon\\nLoaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)\\nActive: active (running) since Tue 2015-11-17 15:17:22 EST; 4 weeks 0 days ago\\nMain PID: 1348 (sshd)\\nCGroup: /system.slice/sshd.service\\n1053 /usr/sbin/sshd -D\\n\\nIf \\\"sshd\\\" does not show a status of \\\"active\\\" and \\\"running\\\", this is a finding.\"]\n[482,\"Verify the operating system automatically terminates a user session after inactivity time-outs have expired.\\n\\nCheck for the value of the \\\"ClientAliveInterval\\\" keyword with the following command:\\n\\n# grep -iw clientaliveinterval /etc/ssh/sshd_config\\n\\nClientAliveInterval 600\\n\\nIf \\\"ClientAliveInterval\\\" is not configured, commented out, or has a value of \\\"0\\\", this is a finding.\\n\\nIf \\\"ClientAliveInterval\\\" has a value that is greater than \\\"600\\\" and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[483,\"Check the version of the operating system with the following command:\\n\\n# cat /etc/redhat-release\\n\\nIf the release is 7.4 or newer this requirement is Not Applicable.\\n\\nVerify the SSH daemon does not allow authentication using RSA rhosts authentication.\\n\\nTo determine how the SSH daemon's \\\"RhostsRSAAuthentication\\\" option is set, run the following command:\\n\\n# grep RhostsRSAAuthentication /etc/ssh/sshd_config\\nRhostsRSAAuthentication no\\n\\nIf the value is returned as \\\"yes\\\", the returned line is commented out, or no output is returned, this is a finding.\"]\n[484,\"Verify the operating system automatically terminates a user session after inactivity time-outs have expired.\\n\\nCheck for the value of the \\\"ClientAliveCountMax\\\" keyword with the following command:\\n\\n# grep -i clientalivecount /etc/ssh/sshd_config\\nClientAliveCountMax 0\\n\\nIf \\\"ClientAliveCountMax\\\" is not set to \\\"0\\\", this is a finding.\"]\n[485,\"Verify the SSH daemon does not allow authentication using known hosts authentication.\\n\\nTo determine how the SSH daemon's \\\"IgnoreRhosts\\\" option is set, run the following command:\\n\\n# grep -i IgnoreRhosts /etc/ssh/sshd_config\\n\\nIgnoreRhosts yes\\n\\nIf the value is returned as \\\"no\\\", the returned line is commented out, or no output is returned, this is a finding.\"]\n[486,\"Verify SSH provides users with feedback on when account accesses last occurred.\\n\\nCheck that \\\"PrintLastLog\\\" keyword in the sshd daemon configuration file is used and set to \\\"yes\\\" with the following command:\\n\\n# grep -i printlastlog /etc/ssh/sshd_config\\nPrintLastLog yes\\n\\nIf the \\\"PrintLastLog\\\" keyword is set to \\\"no\\\", is missing, or is commented out, this is a finding.\"]\n[487,\"Verify remote access using SSH prevents users from logging on directly as root.\\n\\nCheck that SSH prevents users from logging on directly as root with the following command:\\n\\n# grep -i permitrootlogin /etc/ssh/sshd_config\\nPermitRootLogin no\\n\\nIf the \\\"PermitRootLogin\\\" keyword is set to \\\"yes\\\", is missing, or is commented out, this is a finding.\"]\n[488,\"Verify the SSH daemon does not allow authentication using known hosts authentication.\\n\\nTo determine how the SSH daemon's \\\"IgnoreUserKnownHosts\\\" option is set, run the following command:\\n\\n# grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config\\n\\nIgnoreUserKnownHosts yes\\n\\nIf the value is returned as \\\"no\\\", the returned line is commented out, or no output is returned, this is a finding.\"]\n[489,\"Check the version of the operating system with the following command:\\n\\n# cat /etc/redhat-release\\n\\nIf the release is 7.4 or newer this requirement is Not Applicable.\\n\\nVerify the SSH daemon is configured to only use the SSHv2 protocol.\\n\\nCheck that the SSH daemon is configured to only use the SSHv2 protocol with the following command:\\n\\n# grep -i protocol /etc/ssh/sshd_config\\nProtocol 2\\n#Protocol 1,2\\n\\nIf any protocol line other than \\\"Protocol 2\\\" is uncommented, this is a finding.\"]\n[490,\"Verify the SSH daemon is configured to only use MACs employing FIPS 140-2-approved ciphers.\\n\\nNote: If RHEL-07-021350 is a finding, this is automatically a finding as the system cannot implement FIPS 140-2-approved cryptographic algorithms and hashes.\\n\\nCheck that the SSH daemon is configured to only use MACs employing FIPS 140-2-approved ciphers with the following command:\\n\\n# grep -i macs /etc/ssh/sshd_config\\nMACs hmac-sha2-256,hmac-sha2-512\\n\\nIf any ciphers other than \\\"hmac-sha2-256\\\" or \\\"hmac-sha2-512\\\" are listed or the returned line is commented out, this is a finding.\"]\n[491,\"Verify the SSH public host key files have mode \\\"0644\\\" or less permissive.\\n\\nNote: SSH public key files may be found in other directories on the system depending on the installation.\\n\\nThe following command will find all SSH public key files on the system:\\n\\n# find /etc/ssh -name '*.pub' -exec ls -lL {} \\\\;\\n\\n-rw-r--r-- 1 root root 618 Nov 28 06:43 ssh_host_dsa_key.pub\\n-rw-r--r-- 1 root root 347 Nov 28 06:43 ssh_host_key.pub\\n-rw-r--r-- 1 root root 238 Nov 28 06:43 ssh_host_rsa_key.pub\\n\\nIf any file has a mode more permissive than \\\"0644\\\", this is a finding.\"]\n[492,\"Verify the SSH private host key files have mode \\\"0640\\\" or less permissive.\\n\\nThe following command will find all SSH private key files on the system and list their modes:\\n\\n# find / -name '*ssh_host*key' | xargs ls -lL\\n\\n-rw-r----- 1 root ssh_keys 668 Nov 28 06:43 ssh_host_dsa_key\\n-rw-r----- 1 root ssh_keys 582 Nov 28 06:43 ssh_host_key\\n-rw-r----- 1 root ssh_keys 887 Nov 28 06:43 ssh_host_rsa_key\\n\\nIf any file has a mode more permissive than \\\"0640\\\", this is a finding.\"]\n[493,\"Verify the SSH daemon does not permit GSSAPI authentication unless approved.\\n\\nCheck that the SSH daemon does not permit GSSAPI authentication with the following command:\\n\\n# grep -i gssapiauth /etc/ssh/sshd_config\\nGSSAPIAuthentication no\\n\\nIf the \\\"GSSAPIAuthentication\\\" keyword is missing, is set to \\\"yes\\\" and is not documented with the Information System Security Officer (ISSO), or the returned line is commented out, this is a finding.\"]\n[494,\"Verify the SSH daemon does not permit Kerberos to authenticate passwords unless approved.\\n\\nCheck that the SSH daemon does not permit Kerberos to authenticate passwords with the following command:\\n\\n# grep -i kerberosauth /etc/ssh/sshd_config\\nKerberosAuthentication no\\n\\nIf the \\\"KerberosAuthentication\\\" keyword is missing, or is set to \\\"yes\\\" and is not documented with the Information System Security Officer (ISSO), or the returned line is commented out, this is a finding.\"]\n[495,\"Verify the SSH daemon performs strict mode checking of home directory configuration files.\\n\\nThe location of the \\\"sshd_config\\\" file may vary if a different daemon is in use.\\n\\nInspect the \\\"sshd_config\\\" file with the following command:\\n\\n# grep -i strictmodes /etc/ssh/sshd_config\\n\\nStrictModes yes\\n\\nIf \\\"StrictModes\\\" is set to \\\"no\\\", is missing, or the returned line is commented out, this is a finding.\"]\n[496,\"Verify the SSH daemon performs privilege separation.\\n\\nCheck that the SSH daemon performs privilege separation with the following command:\\n\\n# grep -i usepriv /etc/ssh/sshd_config\\n\\nUsePrivilegeSeparation sandbox\\n\\nIf the \\\"UsePrivilegeSeparation\\\" keyword is set to \\\"no\\\", is missing, or the returned line is commented out, this is a finding.\"]\n[497,\"Verify the SSH daemon performs compression after a user successfully authenticates.\\n\\nCheck that the SSH daemon performs compression after a user successfully authenticates with the following command:\\n\\n# grep -i compression /etc/ssh/sshd_config\\nCompression delayed\\n\\nIf the \\\"Compression\\\" keyword is set to \\\"yes\\\", is missing, or the returned line is commented out, this is a finding.\"]\n[498,\"Check to see if NTP is running in continuous mode:\\n\\n# ps -ef | grep ntp\\n\\nIf NTP is not running, check to see if \\\"chronyd\\\" is running in continuous mode:\\n\\n# ps -ef | grep chronyd\\n\\nIf NTP or \\\"chronyd\\\" is not running, this is a finding.\\n\\nIf the NTP process is found, then check the \\\"ntp.conf\\\" file for the \\\"maxpoll\\\" option setting:\\n\\n# grep maxpoll /etc/ntp.conf\\n\\nserver 0.rhel.pool.ntp.org iburst maxpoll 10\\n\\nIf the option is set to \\\"17\\\" or is not set, this is a finding.\\n\\nIf the file does not exist, check the \\\"/etc/cron.daily\\\" subdirectory for a crontab file controlling the execution of the \\\"ntpd -q\\\" command.\\n\\n# grep -i \\\"ntpd -q\\\" /etc/cron.daily/*\\n# ls -al /etc/cron.* | grep ntp\\n\\nntp\\n\\nIf a crontab file does not exist in the \\\"/etc/cron.daily\\\" that executes the \\\"ntpd -q\\\" command, this is a finding.\\n\\nIf the \\\"chronyd\\\" process is found, then check the \\\"chrony.conf\\\" file for the \\\"maxpoll\\\" option setting:\\n\\n# grep maxpoll /etc/chrony.conf\\n\\nserver 0.rhel.pool.ntp.org iburst maxpoll 10\\n\\nIf the option is not set or the line is commented out, this is a finding.\"]\n[499,\"Verify the operating system enabled an application firewall.\\n\\nCheck to see if \\\"firewalld\\\" is installed with the following command:\\n\\n# yum list installed firewalld\\nfirewalld-0.3.9-11.el7.noarch.rpm\\n\\nIf the \\\"firewalld\\\" package is not installed, ask the System Administrator if another firewall application (such as iptables) is installed. \\n\\nIf an application firewall is not installed, this is a finding. \\n\\nCheck to see if the firewall is loaded and active with the following command:\\n\\n# systemctl status firewalld\\nfirewalld.service - firewalld - dynamic firewall daemon\\n\\n   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)\\n   Active: active (running) since Tue 2014-06-17 11:14:49 CEST; 5 days ago\\n\\nIf \\\"firewalld\\\" does not show a status of \\\"loaded\\\" and \\\"active\\\", this is a finding. \\n\\nCheck the state of the firewall:\\n\\n# firewall-cmd --state \\nrunning\\n\\nIf \\\"firewalld\\\" does not show a state of \\\"running\\\", this is a finding.\"]\n[500,\"Verify users are provided with feedback on when account accesses last occurred.\\n\\nCheck that \\\"pam_lastlog\\\" is used and not silent with the following command:\\n\\n# grep pam_lastlog /etc/pam.d/postlogin\\nsession required pam_lastlog.so showfailed\\n\\nIf \\\"pam_lastlog\\\" is missing from \\\"/etc/pam.d/postlogin\\\" file, or the silent option is present, this is a finding.\"]\n[501,\"Verify there are no \\\".shosts\\\" files on the system.\\n\\nCheck the system for the existence of these files with the following command:\\n\\n# find / -name '*.shosts'\\n\\nIf any \\\".shosts\\\" files are found on the system, this is a finding.\"]\n[502,\"Verify there are no \\\"shosts.equiv\\\" files on the system.\\n\\nCheck the system for the existence of these files with the following command:\\n\\n# find / -name shosts.equiv\\n\\nIf any \\\"shosts.equiv\\\" files are found on the system, this is a finding.\"]\n[503,\"Determine whether the system is using local or DNS name resolution with the following command:\\n\\n# grep hosts /etc/nsswitch.conf\\nhosts:   files dns\\n\\nIf the DNS entry is missing from the host's line in the \\\"/etc/nsswitch.conf\\\" file, the \\\"/etc/resolv.conf\\\" file must be empty.\\n\\nVerify the \\\"/etc/resolv.conf\\\" file is empty with the following command:\\n\\n# ls -al /etc/resolv.conf\\n-rw-r--r--  1 root root        0 Aug 19 08:31 resolv.conf\\n\\nIf local host authentication is being used and the \\\"/etc/resolv.conf\\\" file is not empty, this is a finding.\\n\\nIf the DNS entry is found on the host's line of the \\\"/etc/nsswitch.conf\\\" file, verify the operating system is configured to use two or more name servers for DNS resolution.\\n\\nDetermine the name servers used by the system with the following command:\\n\\n# grep nameserver /etc/resolv.conf\\nnameserver 192.168.1.2\\nnameserver 192.168.1.3\\n\\nIf less than two lines are returned that are not commented out, this is a finding.\"]\n[504,\"Verify the system does not accept IPv4 source-routed packets.\\n\\n# grep net.ipv4.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*\\n\\nnet.ipv4.conf.all.accept_source_route = 0\\n\\nIf \\\" net.ipv4.conf.all.accept_source_route \\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.conf.all.accept_source_route\\nnet.ipv4.conf.all.accept_source_route = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[505,\"Verify the system uses a reverse-path filter for IPv4:\\n\\n# grep net.ipv4.conf.all.rp_filter /etc/sysctl.conf /etc/sysctl.d/*\\nnet.ipv4.conf.all.rp_filter = 1\\n\\nIf \\\"net.ipv4.conf.all.rp_filter\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"1\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.conf.all.rp_filter\\nnet.ipv4.conf.all.rp_filter = 1\\n\\nIf the returned line does not have a value of \\\"1\\\", this is a finding.\"]\n[506,\"Verify the system uses a reverse-path filter for IPv4:\\n\\n# grep net.ipv4.conf.default.rp_filter /etc/sysctl.conf /etc/sysctl.d/*\\nnet.ipv4.conf.default.rp_filter = 1\\n\\nIf \\\"net.ipv4.conf.default.rp_filter\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"1\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.conf.default.rp_filter\\nnet.ipv4.conf.default.rp_filter = 1\\n\\nIf the returned line does not have a value of \\\"1\\\", this is a finding.\"]\n[507,\"Verify the system does not accept IPv4 source-routed packets by default.\\n\\n# grep net.ipv4.conf.default.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*\\nnet.ipv4.conf.default.accept_source_route = 0\\n\\nIf \\\" net.ipv4.conf.default.accept_source_route \\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.conf.default.accept_source_route\\nnet.ipv4.conf.default.accept_source_route = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[508,\"Verify the system does not respond to IPv4 ICMP echoes sent to a broadcast address.\\n\\n# grep net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\" net.ipv4.icmp_echo_ignore_broadcasts\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"1\\\", this is a finding.\\n\\nCheck that the operating system implements the \\\"icmp_echo_ignore_broadcasts\\\" variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.icmp_echo_ignore_broadcasts\\nnet.ipv4.icmp_echo_ignore_broadcasts = 1\\n\\nIf the returned line does not have a value of \\\"1\\\", this is a finding.\"]\n[509,\"Verify the system will not accept IPv4 ICMP redirect messages.\\n\\n# grep 'net.ipv4.conf.default.accept_redirects' /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\" net.ipv4.conf.default.accept_redirects \\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the value of the \\\"accept_redirects\\\" variables with the following command:\\n\\n# /sbin/sysctl -a | grep 'net.ipv4.conf.default.accept_redirects'\\nnet.ipv4.conf.default.accept_redirects = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[510,\"Verify the system ignores IPv4 ICMP redirect messages.\\n\\n# grep 'net.ipv4.conf.all.accept_redirects' /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\" net.ipv4.conf.all.accept_redirects \\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the \\\"accept_redirects\\\" variables with the following command:\\n\\n# /sbin/sysctl -a | grep 'net.ipv4.conf.all.accept_redirects'\\n\\nnet.ipv4.conf.all.accept_redirects = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[511,\"Verify the system does not allow interfaces to perform IPv4 ICMP redirects by default.\\n\\n# grep 'net.ipv4.conf.default.send_redirects' /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\"net.ipv4.conf.default.send_redirects\\\" is not configured in the \\\"/etc/sysctl.conf\\\" file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the \\\"default send_redirects\\\" variables with the following command:\\n\\n# /sbin/sysctl -a | grep 'net.ipv4.conf.default.send_redirects'\\n\\nnet.ipv4.conf.default.send_redirects = 0 \\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[512,\"Verify the system does not send IPv4 ICMP redirect messages.\\n\\n# grep 'net.ipv4.conf.all.send_redirects' /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\"net.ipv4.conf.all.send_redirects\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the \\\"all send_redirects\\\" variables with the following command:\\n\\n# /sbin/sysctl -a | grep 'net.ipv4.conf.all.send_redirects'\\n\\nnet.ipv4.conf.all.send_redirects = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[513,\"Verify network interfaces are not in promiscuous mode unless approved by the ISSO and documented.\\n\\nCheck for the status with the following command:\\n\\n# ip link | grep -i promisc\\n\\nIf network interfaces are found on the system in promiscuous mode and their use has not been approved by the ISSO and documented, this is a finding.\"]\n[514,\"Verify the system is configured to prevent unrestricted mail relaying.\\n\\nDetermine if \\\"postfix\\\" is installed with the following commands:\\n\\n# yum list installed postfix\\npostfix-2.6.6-6.el7.x86_64.rpm \\n\\nIf postfix is not installed, this is Not Applicable.\\n\\nIf postfix is installed, determine if it is configured to reject connections from unknown or untrusted networks with the following command:\\n\\n# postconf -n smtpd_client_restrictions\\nsmtpd_client_restrictions = permit_mynetworks, reject\\n\\nIf the \\\"smtpd_client_restrictions\\\" parameter contains any entries other than \\\"permit_mynetworks\\\" and \\\"reject\\\", this is a finding.\"]\n[515,\"Verify an FTP server has not been installed on the system.\\n\\nCheck to see if an FTP server has been installed with the following commands:\\n\\n# yum list installed vsftpd\\n\\n vsftpd-3.0.2.el7.x86_64.rpm\\n\\nIf \\\"vsftpd\\\" is installed and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[516,\"Verify a TFTP server has not been installed on the system.\\n\\nCheck to see if a TFTP server has been installed with the following command:\\n\\n# yum list installed tftp-server\\ntftp-server-0.49-9.el7.x86_64.rpm\\n\\nIf TFTP is installed and the requirement for TFTP is not documented with the ISSO, this is a finding.\"]\n[517,\"Verify remote X connections for interactive users are encrypted.\\n\\nCheck that remote X connections are encrypted with the following command:\\n\\n# grep -i x11forwarding /etc/ssh/sshd_config | grep -v \\\"^#\\\"\\n\\nX11Forwarding yes\\n\\nIf the \\\"X11Forwarding\\\" keyword is set to \\\"no\\\" or is missing, this is a finding.\"]\n[518,\"Verify the TFTP daemon is configured to operate in secure mode.\\n\\nCheck to see if a TFTP server has been installed with the following commands:\\n\\n# yum list installed tftp-server\\ntftp-server.x86_64 x.x-x.el7 rhel-7-server-rpms\\n\\nIf a TFTP server is not installed, this is Not Applicable.\\n\\nIf a TFTP server is installed, check for the server arguments with the following command: \\n\\n# grep server_args /etc/xinetd.d/tftp\\nserver_args = -s /var/lib/tftpboot\\n\\nIf the \\\"server_args\\\" line does not have a \\\"-s\\\" option and a subdirectory is not assigned, this is a finding.\"]\n[519,\"Verify that if the system has X Windows System installed, it is authorized.\\n\\nCheck for the X11 package with the following command:\\n\\n# rpm -qa | grep xorg | grep server\\n\\nAsk the System Administrator if use of the X Windows System is an operational requirement.\\n\\nIf the use of X Windows on the system is not documented with the Information System Security Officer (ISSO), this is a finding.\"]\n[520,\"Verify the system is not performing packet forwarding, unless the system is a router.\\n\\n# grep net.ipv4.ip_forward /etc/sysctl.conf /etc/sysctl.d/*\\n\\nnet.ipv4.ip_forward = 0\\n\\nIf \\\"net.ipv4.ip_forward\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system does not implement IP forwarding using the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.ip_forward\\nnet.ipv4.ip_forward = 0\\n\\nIf IP forwarding value is \\\"1\\\" and the system is hosting any application, database, or web servers, this is a finding.\"]\n[521,\"Verify \\\"AUTH_GSS\\\" is being used to authenticate NFS mounts.\\n\\nTo check if the system is importing an NFS file system, look for any entries in the \\\"/etc/fstab\\\" file that have a file system type of \\\"nfs\\\" with the following command:\\n\\n# cat /etc/fstab | grep nfs\\n192.168.21.5:/mnt/export /data1 nfs4 rw,sync ,soft,sec=krb5:krb5i:krb5p\\n\\nIf the system is mounting file systems via NFS and has the sec option without the \\\"krb5:krb5i:krb5p\\\" settings, the \\\"sec\\\" option has the \\\"sys\\\" setting, or the \\\"sec\\\" option is missing, this is a finding.\"]\n[522,\"Verify that a system using SNMP is not using default community strings.\\n\\nCheck to see if the \\\"/etc/snmp/snmpd.conf\\\" file exists with the following command:\\n\\n# ls -al /etc/snmp/snmpd.conf\\n -rw-------   1 root root      52640 Mar 12 11:08 snmpd.conf\\n\\nIf the file does not exist, this is Not Applicable.\\n\\nIf the file does exist, check for the default community strings with the following commands:\\n\\n# grep public /etc/snmp/snmpd.conf\\n# grep private /etc/snmp/snmpd.conf\\n\\nIf either of these commands returns any output, this is a finding.\"]\n[523,\"If the \\\"firewalld\\\" package is not installed, ask the System Administrator (SA) if another firewall application (such as iptables) is installed. If an application firewall is not installed, this is a finding. \\n\\nVerify the system's access control program is configured to grant or deny system access to specific hosts.\\n\\nCheck to see if \\\"firewalld\\\" is active with the following command:\\n\\n# systemctl status firewalld\\nfirewalld.service - firewalld - dynamic firewall daemon\\nLoaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)\\nActive: active (running) since Sun 2014-04-20 14:06:46 BST; 30s ago\\n\\nIf \\\"firewalld\\\" is active, check to see if it is configured to grant or deny access to specific hosts or services with the following commands:\\n\\n# firewall-cmd --get-default-zone\\npublic\\n\\n# firewall-cmd --list-all --zone=public\\npublic (active)\\ntarget: default\\nicmp-block-inversion: no\\ninterfaces: eth0\\nsources:\\nservices: mdns ssh\\nports:\\nprotocols:\\nmasquerade: no\\nforward-ports:\\nicmp-blocks:\\n\\nIf \\\"firewalld\\\" is not active, determine whether \\\"tcpwrappers\\\" is being used by checking whether the \\\"hosts.allow\\\" and \\\"hosts.deny\\\" files are empty with the following commands:\\n\\n# ls -al /etc/hosts.allow\\nrw-r----- 1 root root 9 Aug 2 23:13 /etc/hosts.allow\\n\\n# ls -al /etc/hosts.deny\\n-rw-r----- 1 root root 9 Apr 9 2007 /etc/hosts.deny\\n\\nIf \\\"firewalld\\\" and \\\"tcpwrappers\\\" are not installed, configured, and active, ask the SA if another access control program (such as iptables) is installed and active. Ask the SA to show that the running configuration grants or denies access to specific hosts or services.\\n\\nIf \\\"firewalld\\\" is active and is not configured to grant access to specific hosts or \\\"tcpwrappers\\\" is not configured to grant or deny access to specific hosts, this is a finding.\"]\n[524,\"Verify the system does not have unauthorized IP tunnels configured.\\n\\nCheck to see if \\\"libreswan\\\" is installed with the following command:\\n\\n# yum list installed libreswan\\nlibreswan.x86-64 3.20-5.el7_4\\n\\nIf \\\"libreswan\\\" is installed, check to see if the \\\"IPsec\\\" service is active with the following command:\\n\\n# systemctl status ipsec\\nipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec\\nLoaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled)\\nActive: inactive (dead)\\n\\nIf the \\\"IPsec\\\" service is active, check to see if any tunnels are configured in \\\"/etc/ipsec.conf\\\" and \\\"/etc/ipsec.d/\\\" with the following commands:\\n\\n# grep -iw conn /etc/ipsec.conf /etc/ipsec.d/*.conf\\n\\nIf there are indications that a \\\"conn\\\" parameter is configured for a tunnel, ask the System Administrator if the tunnel is documented with the ISSO. \\n\\nIf \\\"libreswan\\\" is installed, \\\"IPsec\\\" is active, and an undocumented tunnel is active, this is a finding.\"]\n[525,\"If IPv6 is not enabled, the key will not exist, and this is Not Applicable.\\n\\nVerify the system does not accept IPv6 source-routed packets.\\n\\n# grep net.ipv6.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*\\n\\nnet.ipv6.conf.all.accept_source_route = 0\\n\\nIf \\\"net.ipv6.conf.all.accept_source_route\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv6.conf.all.accept_source_route\\nnet.ipv6.conf.all.accept_source_route = 0\\n\\nIf the returned lines do not have a value of \\\"0\\\", this is a finding.\"]\n[526,\"Verify the operating system has the packages required for multifactor authentication installed.\\n\\nCheck for the presence of the packages required to support multifactor authentication with the following commands:\\n\\n# yum list installed esc\\nesc-1.1.0-26.el7.noarch.rpm\\n\\n# yum list installed pam_pkcs11\\npam_pkcs11-0.6.2-14.el7.noarch.rpm\\n\\n\\nIf the \\\"esc\\\" and \\\"pam_pkcs11\\\" packages are not installed, this is a finding.\"]\n[527,\"Verify the operating system implements multifactor authentication for remote access to privileged accounts via pluggable authentication modules (PAM).\\n\\nCheck the \\\"/etc/sssd/sssd.conf\\\" file for the authentication services that are being used with the following command:\\n\\n# grep services /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf\\n\\nservices = nss, pam\\n\\nIf the \\\"pam\\\" service is not present on all \\\"services\\\" lines, this is a finding.\"]\n[528,\"Verify the operating system implements certificate status checking for PKI authentication.\\n\\nCheck to see if Online Certificate Status Protocol (OCSP) is enabled on the system with the following command:\\n\\n# grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep -v \\\"^#\\\"\\n\\ncert_policy = ca, ocsp_on, signature;\\ncert_policy = ca, ocsp_on, signature;\\ncert_policy = ca, ocsp_on, signature;\\n\\nThere should be at least three lines returned. \\n\\nIf \\\"ocsp_on\\\" is not present in all uncommented \\\"cert_policy\\\" lines in \\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\", this is a finding.\"]\n[529,\"Verify that there are no wireless interfaces configured on the system.\\n\\nThis is N/A for systems that do not have wireless network adapters.\\n\\nCheck for the presence of active wireless interfaces with the following command:\\n\\n# nmcli device\\nDEVICE TYPE STATE\\neth0 ethernet connected\\nwlp3s0 wifi disconnected\\nlo loopback unmanaged\\n\\nIf a wireless interface is configured and its use on the system is not documented with the Information System Security Officer (ISSO), this is a finding.\"]\n[530,\"Verify the cryptographic hash of system files and commands match the vendor values.\\n\\nCheck the cryptographic hash of system files and commands with the following command:\\n\\nNote: System configuration files (indicated by a \\\"c\\\" in the second column) are expected to change over time. Unusual modifications should be investigated through the system audit log.\\n\\n# rpm -Va --noconfig | grep '^..5'\\n\\nIf there is any output from the command for system files or binaries, this is a finding.\"]\n[531,\"Ask the SA or ISSO if a host-based intrusion detection application is loaded on the system. Per OPORD 16-0080, the preferred intrusion detection system is McAfee HBSS available through the U.S. Cyber Command (USCYBERCOM).\\n\\nIf another host-based intrusion detection application is in use, such as SELinux, this must be documented and approved by the local Authorizing Official.\\n\\nProcedure:\\nExamine the system to determine if the Host Intrusion Prevention System (HIPS) is installed:\\n\\n# rpm -qa | grep MFEhiplsm\\n\\nVerify that the McAfee HIPS module is active on the system:\\n\\n# ps -ef | grep -i “hipclient”\\n\\nIf the MFEhiplsm package is not installed, check for another intrusion detection system:\\n\\n# find / -name <daemon name>\\n\\nWhere <daemon name> is the name of the primary application daemon to determine if the application is loaded on the system.\\n\\nDetermine if the application is active on the system:\\n\\n# ps -ef | grep -i <daemon name>\\n\\nIf the MFEhiplsm package is not installed and an alternate host-based intrusion detection application has not been documented for use, this is a finding.\\n\\nIf no host-based intrusion detection system is installed and running on the system, this is a finding.\"]\n[532,\"Verify the operating system prevents a user from overriding the screensaver lock-enabled setting for the graphical user interface. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\\n\\nDetermine which profile the system database is using with the following command:\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nCheck for the lock-enabled setting with the following command:\\n\\nNote: The example below is using the database \\\"local\\\" for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than \\\"local\\\" is being used.\\n\\n# grep -i lock-enabled /etc/dconf/db/local.d/locks/*\\n\\n/org/gnome/desktop/screensaver/lock-enabled\\n\\nIf the command does not return a result, this is a finding.\"]\n[537,\"Verify the VPN Gateway has an inbound and outbound traffic security policy which is in compliance with information flow control policies (e.g., IPsec policy configuration).\\n\\nReview network device configurations and topology diagrams. Verify encapsulated or encrypted traffic received from other enclaves with different security policies terminate at the perimeter for filtering and content inspection by a firewall and IDPS before gaining access to the private network.\\n\\nIf the VPN Gateway does not ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies, this is a finding.\"]\n[538,\"If the user/remote client connection banner is the same as the banner configured as part of the NDM SRG, then this is not applicable.\\n\\nDetermine if the network device is configured to present a DoD-approved banner that is formatted in accordance with DoD policy. \\n\\nIf the Remote Access VPN Gateway or VPN client does not display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network, this is a finding.\"]\n[539,\"If the user/remote client connection banner is the same as the banner configured as part of the NDM SRG, then this is not applicable.\\n\\nVerify the ALG retains the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and takes explicit actions to log on for further access.\\n\\nIf the Remote Access VPN Gateway and/or client does not retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access, this is a finding.\"]\n[540,\"Verify the publicly accessible VPN Gateway displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.  The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for network elements that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\\n\\nIf the publicly accessible VPN Gateway does not display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system, this is a finding.\"]\n[541,\"Determine if the VPN Gateway is either configured to notify the administrator of the number of unsuccessful login attempts since the last successful login or configured to use an authentication server which would perform this function. If the administrator is not notified of the number of unsuccessful login attempts since the last successful login, this is a finding.\\n\\nIf the VPN Gateway does not notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access), this is a finding.\"]\n[542,\"Inspect the VPN Gateway configuration. Verify the number of concurrent sessions for user accounts to 1 or to an organization-defined number (defined in the SSP).\\n\\nIf the VPN Gateway does not limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number, this is a finding.\"]\n[543,\"Verify the TLS VPN Gateway is configured to use  TLS 1.2 or higher to protect the confidentiality of sensitive data during transmission.\\n\\nIf the TLS VPN Gateway does not use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during transmission, this is a finding.\"]\n[544,\"Verify the remote access VPN Gateway uses a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.\\n\\nIf the remote access VPN Gateway does not use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions, this is a finding.\"]\n[545,\"Verify the VPN Gateway uses IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.\\n\\nIf the VPN Gateway does not use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions, this is a finding.\"]\n[546,\"Verify all IKE proposals are set to use a FIPS-validated dh-group.\\n\\nView the IKE options dh-group option.\\n\\nIf the IKE option is not set to a FIPS 140-2 validated dh-group, this is a finding.\"]\n[547,\"Verify the VPN Gateway generates log records containing information to establish what type of events occurred.\\n\\nIf the VPN Gateway does not generate log records containing information to establish what type of events occurred, this is a finding.\"]\n[548,\"Configure the VPN Gateway generates log records containing information to establish when (date and time) the events occurred.\\n\\nIf the VPN Gateway does not generate log records containing information to establish when (date and time) the events occurred, this is a finding.\"]\n[549,\"Verify the VPN Gateway generates log records containing information that establishes the identity of any individual or process associated with the event.\\n\\nIf the VPN Gateway does not generate log records containing information that establishes the identity of any individual or process associated with the event, this is a finding.\"]\n[550,\"Verify the VPN Gateway generates  log records containing information to establish where the events occurred.\\n\\nIf the VPN Gateway does not generate log records containing information to establish where the events occurred, this is a finding.\"]\n[551,\"Verify the VPN Gateway  generates log records containing information to establish the source of the events.\\n\\nIf the VPN Gateway does not generate log records containing information to establish the source of the events, this is a finding.\"]\n[552,\"Examine the log configuration on the VPN Gateway or view several alert events on the organization's central audit server. Alternatively, examine the Central Log Server to see if it contains information about success or failure of client connection attempts or other events.\\n\\nIf the traffic log entries do not include the success or failure of connection attempts and other events, this is a finding.\"]\n[553,\"Verify the VPN Gateway protects log information from unauthorized read access if all or some of this data is stored locally.\\n\\nIf the VPN Gateway does not protect log information from unauthorized read access if all or some of this data is stored locally, this is a finding.\"]\n[554,\"Verify the VPN Gateway log is configured to protect audit information from unauthorized modification when stored locally.\\n\\nThe VPN Gateway log must protect audit information from unauthorized modification when stored locally, this is a finding.\"]\n[555,\"Verify the VPN Gateway is configured to protect audit information from unauthorized deletion when stored locally.\\n\\nIf the VPN Gateway does not protect audit information from unauthorized deletion when stored locally, this is a finding.\"]\n[556,\"View the configured security  services.\\n\\nCompare the services that are enabled, including the port, services, protocols, and functions.\\n\\nIf functions, ports, protocols, and services identified on the PPSM CAL are not disabled, this is a finding.\"]\n[557,\"Verify the IPsec VPN Gateway uses IKEv2 for IPsec VPN security associations.\\n\\nIf the IPsec VPN Gateway must use IKEv2 for IPsec VPN security associations, this is a finding.\"]\n[558,\"Verify the VPN Gateway is configured to prohibit PPTP and L2F.\\n\\nIf the VPN Gateway does not be configured to prohibit PPTP and L2F, this is a finding.\"]\n[559,\"If L2TP communications protocol is not used, this is not applicable.\\n\\nVerify the VPN Gateway or another network element (e.g., firewall) is configure to block or deny L2TP packets with a destination address within the private network of the enclave.\\n\\nIf L2TP communications are  allowed to cross the security boundary into the private network of the enclave, this is a finding.\"]\n[560,\"Verify the VPN Gateway is configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).\\n\\nIf the VPN Gateway does not uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users), this is a finding.\"]\n[561,\"Verify the VPN Gateway uses multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.\\n\\nIf the VPN Gateway does not use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts, this is a finding.\"]\n[562,\"Verify the VPN Client implements multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.\\n\\nIf the VPN Client does not implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access, this is a finding.\"]\n[563,\"Verify the TLS VPN Gateway is configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts.\\n\\nIf the TLS VPN is not configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts, this is a finding.\"]\n[564,\"Verify the IPsec VPN Gateway  uses anti-replay mechanisms for security associations.\\n\\nIf the IPsec VPN Gateway does not use anti-replay mechanisms for security associations, this is a finding.\"]\n[565,\"Verify the VPN Gateway uniquely identifies all network-connected endpoint devices before establishing a connection.\\n\\nIf the VPN Gateway does not uniquely identify all network-connected endpoint devices before establishing a connection, this is a finding.\"]\n[566,\"Verify the VPN Gateway to use PKI-based authentication that validates certificates by constructing a certification path (which includes status information) to an accepted trust anchor.\\n\\nIf PKI-based authentication does not validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor, this is a finding.\"]\n[567,\"If PKI-based authentication is not being used for device authentication, this is not applicable.\\n\\nVerify the site-to-site VPN that uses certificate-based device authentication uses a FIPS-compliant key management process.\\n\\nIf the site-to-site VPN that uses certificate-based device authentication does not use a FIPS-compliant key management process, this is a finding.\"]\n[568,\"Verify the Remote Access VPN Gateway is configured to use a physically separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.\\n\\nIf the Remote Access VPN Gateway does not use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication, this is a finding.\"]\n[569,\"Verify the VPN Gateway maps the authenticated identity to the user account for PKI-based authentication.\\n\\nIf the VPN Gateway does not map the authenticated identity to the user account for PKI-based authentication, this is a finding.\"]\n[570,\"Verify the VPN Gateway uses FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).\\n\\nIf the VPN Gateway does not use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only), this is a finding.\"]\n[571,\"Configure the VPN Gateway to uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).\\n\\nIf the VPN Gateway does not uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users), this is a finding.\"]\n[572,\"Verify the VPN Gateway routes sessions to an IDPS for inspection.\\n\\nIf the VPN Gateway is not  configured to route sessions to an IDPS for inspection, this is a finding.\"]\n[573,\"Verify the VPN Gateway terminates all network connections associated with a communications session at the end of the session.\\n\\nIf the VPN Gateway does not terminate all network connections associated with a communications session at the end of the session, this is a finding.\"]\n[574,\"Verify the VPN Gateway uses FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.\\n\\nIf the VPN Gateway does not use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module, this is a finding.\"]\n[575,\"Verify the IPsec VPN Gateway uses IKE with SHA1 or greater to protect the authenticity of communications sessions.\\n\\nIf the IPsec VPN Gateway is not configured to use IKE with SHA1 or greater to protect the authenticity of communications sessions, this is a finding.\"]\n[576,\"Verify the VPN Gateway invalidates session identifiers upon user logoff or other session termination.\\n\\nIf the VPN Gateway does not invalidate session identifiers upon user logoff or other session termination, this is a finding.\"]\n[577,\"Verify the VPN Gateway recognizes only system-generated session identifiers.\\n\\nIf the VPN Gateway does not recognize only system-generated session identifiers, this is a finding.\"]\n[578,\"Verify the VPN Gateway generates unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.\\n\\nIf the VPN Gateway does not generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm, this is a finding.\"]\n[579,\"Verify the VPN Gateway is configured to fail to a secure state if system initialization fails, shutdown fails, or aborts fail.\\n\\nIf the VPN Gateway does not fail to a secure state if system initialization fails, shutdown fails, or aborts fail, this is a finding.\"]\n[580,\"Verify the VPN Gateway is configured to perform an organization-defined action if the audit reveals unauthorized activity.\\n\\nIf the VPN Gateway does not be configured to perform an organization-defined action if the audit reveals unauthorized activity, this is a finding.\"]\n[581,\"Configure the VPN Gateway for functionality, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack. \\n\\nConfigure authorized system administrator accounts to allow them to disconnect or disable remote access to remove user under circumstances defined in the VPN SSP.\\n\\nIf the VPN Gateway administrator accounts or security policy is not configured to allow the system administrator to immediately disconnect or disable remote access to devices and/or users when needed, this is a finding.\"]\n[582,\"Verify all IKE proposals are set to use the AES encryption algorithm.\\n\\nView the value of the encryption algorithm for each defined proposal.\\n\\nIf the value of the encryption algorithm for any IKE proposal is not set to use an AES algorithm, this is a finding.\"]\n[583,\"Verify the VPN Gateway transmits organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.\\n\\nIf the VPN Gateway does not transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions, this is a finding.\"]\n[584,\"Verity the VPN Gateway notifies the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).\\n\\nIf the VPN Gateway does not notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access), this is a finding.\"]\n[585,\"Verify the VPN Gateway provides centralized management and configuration of the content to be captured in log records generated by all network components.\\n\\nIf the VPN Gateway does not provide centralized management and configuration of the content to be captured in log records generated by all network components, this is a finding.\"]\n[586,\"Verify the VPN Gateway off-loads log records onto a different system or media than the system being audited.\\n\\nIf the VPN Gateway does not off-load audit records onto a different system or media than the system being audited, this is a finding.\"]\n[587,\"Verify the VPN Gateway generates a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.\\n\\nIf the VPN Gateway does not generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server, this is a finding.\"]\n[588,\"Verify that in the event that communications with the Central Log Server is lost, the VPN Gateway is configured to continue to queue traffic log records locally.\\n\\nIf the VPN Gateway does not continue to queue traffic log records locally when communications with the Central Log Server is lost, this is a finding.\"]\n[589,\"Verify the IPsec VPN Gateway renegotiates the security association after 8 hours or less, or an organization-defined period.\\n\\nIf the IPsec VPN Gateway does not renegotiate the security association after 8 hours or less, or an organization-defined period, this is a finding.\"]\n[590,\"Verify the VPN Gateway renegotiates the security association after 24 hours or less or as defined by the organization.\\n\\nIf the VPN Gateway does not renegotiate the security association after 24 hours or less or as defined by the organization, this is a finding.\"]\n[591,\"Verify the VPN Gateway accepts Personal Identity Verification (PIV) credentials.\\n\\nIf the VPN Gateway does not accept Personal Identity Verification (PIV) credentials, this is a finding.\"]\n[592,\"Verify the VPN Gateway electronically verifies Personal Identity Verification (PIV) credentials.\\n\\nIf the VPN Gateway does not electronically verify Personal Identity Verification (PIV) credentials, this is a finding.\"]\n[593,\"Verity the VPN Gateway  authenticates all network-connected endpoint devices before establishing a connection.\\n\\nIf the VPN Gateway does not authenticate all network-connected endpoint devices before establishing a connection, this is a finding.\"]\n[594,\"Verify the VPN Gateway uses an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.\\n\\nIf the VPN Gateway does not use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network, this is a finding.\"]\n[595,\"Verify the VPN Gateway disables split-tunneling for remote clients VPNs.\\n\\nIf the VPN Gateway does not disable split-tunneling for remote clients VPNs, this is a finding.\"]\n[596,\"Verify the IPsec VPN Gateway specifies Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.\\n\\nIf the IPsec VPN Gateway does not specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation, this is a finding.\"]\n[597,\"Verify the VPN Gateway and the remote access client are configured to protect the confidentiality and integrity of transmitted information.\\n\\nIf VPN Gateway and Client does not protect the confidentiality and integrity of transmitted information, this is a finding.\"]\n[598,\"Verify the IPsec VPN Gateway uses Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.\\n\\nIf the IPsec VPN Gateway must use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations, this is a finding.\"]\n[599,\"For accounts using password authentication, verify the VPN Gateway uses FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.\\n\\nFor accounts using password authentication, if the VPN Gateway does not use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process, this is a finding.\"]\n[600,\"Verify the VPN Gateway generates log records when successful and/or unsuccessful VPN connection attempts occur.\\n\\nIf the VPN Gateway does not generate log records when successful and/or unsuccessful VPN connection attempts occur, this is a finding.\"]\n[601,\"Verify the VPN Gateway uses a FIPS-validated cryptographic module to generate cryptographic hashes.\\n\\nIf the VPN Gateway does not use a FIPS-validated cryptographic module to generate cryptographic hashes, this is a finding.\"]\n[602,\"Verify the VPN Gateway uses a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.\\n\\nIf the VPN Gateway does not use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality, this is a finding.\"]\n[603,\"Verify the IPsec VPN Gateway IKE uses a NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.\\n\\nIf the IPsec VPN Gateway IKE does not use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic, this is a finding.\"]\n[604,\"Verify the IKE protocol is specified for all IPsec VPNs.\\n\\nIf the IKE protocol is not specified as an option on all VPN gateways, this is a finding.\"]\n[605,\"Verify the VPN Gateway does not accept certificates that have been revoked when using PKI for authentication.\\n\\nIf the VPN Gateway accepts certificates that have been revoked when using PKI for authentication, this is a finding.\"]\n[606,\"Verify the VPN Client logout function is configured to terminate the session on/with the VPN Gateway.\\n\\nIf the VPN Client logout function does not terminate the session on/with the VPN Gateway, this is a finding.\"]\n[607,\"Verify the VPN Client displays an explicit logout message to users indicating the reliable termination of authenticated communications sessions.\\n\\nIf the VPN Client does not display an explicit logout message to users indicating the reliable termination of authenticated communications sessions, this is a finding.\"]\n[608,\"Verify the VPN Gateway stores only cryptographic representations of the PSK.\\n\\nIf the VPN Gateway does not store only cryptographic representations of the PSK, this is a finding.\"]\n[609,\"Verify all Internet Key Exchange (IKE) proposals are set to use the AES encryption algorithm.\\n\\nView the value of the encryption algorithm for each defined proposal.\\n\\nIf the value of the encryption algorithm for any IPsec proposal is not set to use an AES algorithm, this is a finding.\"]\n[610,\"Verify the TLS VPN Gateway that supports Government-only services prohibits client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.\\n\\nIf the TLS VPN Gateway that supports Government-only services does not prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0, this is a finding.\"]\n[611,\"Verify the TLS VPN Gateway that supports citizen- or business-facing network devices prohibits client negotiation to SSL 2.0 or SSL 3.0.\\n\\nIf the TLS VPN Gateway that supports citizen- or business-facing network devices does not prohibit client negotiation to SSL 2.0 or SSL 3.0, this is a finding.\"]\n[612,\"Verify the VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) is configured to use SNMPv3 to use FIPS-validated AES cipher block algorithm.\\n\\nIf the VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) does not configure SNMPv3 to use FIPS-validated AES cipher block algorithm, this is a finding.\"]\n[613,\"Verify the VPN Gateway uses an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.\\n\\nIf the VPN Gateway does not use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network, this is a finding.\"]\n[614,\"Verify the IPsec VPN Gateway Internet Key Exchange (IKE) uses cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.\\n\\nIf the IPsec VPN Gateway Internet Key Exchange (IKE) does not use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network, this is a finding.\"]\n[615,\"Verify the VPN Gateway validates TLS certificates by performing RFC 5280-compliant certification path validation.\\n\\nIf the VPN Gateway does not validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation, this is a finding.\"]\n[616,\"Verify the VPN Gateway uses FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).\\n\\nIf the VPN Gateway does not use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use), this is a finding.\"]\n[617,\"If L2TP communications protocol is not used, this is not applicable.\\n\\nVerify L2TPv3 sessions are configured to authenticate the traffic before transit. L2TPv3 sessions must be authenticated prior to transporting traffic.\\n\\nIf L2TPv3 sessions do not require authentication, this is a finding.\"]\n[618,\"This check content has been replaced!\"]\n{\"table\":\"collection\",\"columns\":\"`collectionId`,`created`,`createdUserId`,`description`,`metadata`,`name`,`settings`,`state`,`stateDate`,`stateUserId`\",\"rowCount\":8}\n[1,\"2024-10-23 10:29:57\",null,null,\"{\\\"reqRar\\\": \\\"true\\\", \\\"pocName\\\": \\\"poc2Put\\\", \\\"pocEmail\\\": \\\"pocEmailPut@email.com\\\", \\\"pocPhone\\\": \\\"12342\\\"}\",\"Collection Z put\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 5}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n[21,\"2024-10-23 10:29:57\",null,null,\"{\\\"reqRar\\\": \\\"true\\\", \\\"pocName\\\": \\\"poc2Patched\\\", \\\"pocEmail\\\": \\\"pocEmail@email.com\\\", \\\"pocPhone\\\": \\\"12342\\\"}\",\"Collection X\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 5}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n[83,\"2024-10-23 10:29:57\",null,null,\"{\\\"reqRar\\\": \\\"true\\\", \\\"pocName\\\": \\\"string\\\", \\\"pocEmail\\\": \\\"string\\\", \\\"pocPhone\\\": \\\"string\\\"}\",\"Collection Y\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 5}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n[84,\"2024-10-23 10:29:57\",null,null,\"{}\",\"delete Collection Admin\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 5}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n[85,\"2024-10-23 10:29:57\",null,null,\"{}\",\"delete Collection lvl4\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 5}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n[86,\"2024-10-23 10:29:57\",null,null,\"{}\",\"delete Collection NONE\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 5}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n[92,\"2024-10-23 10:29:57\",null,null,\"{}\",\"test Collection\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 5}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n[93,\"2024-10-23 21:11:48\",null,\"\",\"{}\",\"deletedCollection\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 5}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"disabled\",\"2024-10-23 21:13:26\",87]\n{\"table\":\"collection_grant\",\"columns\":\"`collectionId`,`grantId`,`roleId`,`userGroupId`,`userId`\",\"rowCount\":24}\n[21,1,1,null,86]\n[21,3,2,null,21]\n[21,4,3,null,44]\n[21,5,4,null,87]\n[21,6,4,null,1]\n[21,7,4,null,45]\n[83,8,4,null,87]\n[83,9,4,null,1]\n[1,10,1,null,86]\n[1,11,2,null,21]\n[1,12,3,null,44]\n[1,13,4,null,87]\n[1,14,4,null,45]\n[1,15,4,null,1]\n[84,16,4,null,87]\n[84,17,4,null,1]\n[85,18,4,null,87]\n[85,19,4,null,1]\n[85,20,4,null,45]\n[92,21,4,null,87]\n[92,22,4,null,1]\n[93,23,4,null,87]\n[93,24,4,null,1]\n[21,32,1,1,null]\n{\"table\":\"collection_grant_acl\",\"columns\":\"`access`,`assetId`,`benchmarkId`,`cgAclId`,`clId`,`grantId`,`modifiedDate`,`modifiedUserId`\",\"rowCount\":4}\n[\"rw\",42,\"Windows_10_STIG_TEST\",2,null,1,null,null]\n[\"rw\",null,\"VPN_SRG_TEST\",9,2,32,\"2024-10-30 19:44:09\",87]\n[\"r\",62,null,10,null,32,\"2024-10-30 19:44:09\",87]\n[\"r\",154,\"VPN_SRG_TEST\",11,null,32,\"2024-10-30 19:44:09\",87]\n{\"table\":\"collection_label\",\"columns\":\"`clId`,`collectionId`,`color`,`description`,`name`,`uuid`\",\"rowCount\":3}\n[1,21,\"FF99CC\",\"\",\"test-label-full\",{\"type\":\"Buffer\",\"data\":\"base64:EeyaaHVbiiixvAJCrBEAAg==\"}]\n[2,21,\"99CCFF\",\"\",\"test-label-lvl1\",{\"type\":\"Buffer\",\"data\":\"base64:EeyaaFEw3ISxvAJCrBEAAg==\"}]\n[3,1,\"99CCFF\",\"scrap label\",\"scrapLabel\",{\"type\":\"Buffer\",\"data\":\"base64:EeygA99OaDaxvAJCrBEAAg==\"}]\n{\"table\":\"collection_label_asset_map\",\"columns\":\"`assetId`,`claId`,`clId`\",\"rowCount\":3}\n[42,2,1]\n[42,3,2]\n[62,1,1]\n{\"table\":\"collection_rev_map\",\"columns\":\"`benchmarkId`,`collectionId`,`crId`,`revId`\",\"rowCount\":0}\n{\"table\":\"current_rev\",\"columns\":\"`active`,`benchmarkDate`,`benchmarkDateSql`,`benchmarkId`,`checkCount`,`description`,`fixCount`,`groupCount`,`highCount`,`lowCount`,`marking`,`mediumCount`,`release`,`revId`,`status`,`statusDate`,`version`\",\"rowCount\":5}\n[1,\"31 Mar 2020\",\"2020-03-31\",\"RHEL_7_STIG_TEST\",247,\"This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.\",247,247,29,14,null,201,\"0.3\",\"RHEL_7_STIG_TEST-3-0.3\",\"draft\",\"2020-03-27\",3]\n[1,\"19 Jul 2001\",\"2001-07-19\",\"VPN_SRG_OTHER\",2,\"This description replaces the old description\",2,2,0,0,null,2,\"2\",\"VPN_SRG_OTHER-2-2\",\"accepted\",\"2001-07-26\",2]\n[1,\"19 Jul 2001\",\"2001-07-19\",\"VPN_SRG_Rule-fingerprint-match-test\",3,\"This description replaces the old description\",3,3,0,0,null,3,\"2\",\"VPN_SRG_Rule-fingerprint-match-test-2-2\",\"accepted\",\"2001-07-26\",2]\n[1,\"19 Jul 2019\",\"2019-07-19\",\"VPN_SRG_TEST\",81,\"This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",81,81,11,7,null,63,\"1\",\"VPN_SRG_TEST-1-1\",\"accepted\",\"2019-07-26\",1]\n[1,\"17 Jun 2020\",\"2020-06-17\",\"Windows_10_STIG_TEST\",287,\"The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",287,287,26,18,null,243,\"23\",\"Windows_10_STIG_TEST-1-23\",\"accepted\",\"2020-06-15\",1]\n{\"table\":\"default_rev\",\"columns\":\"`benchmarkId`,`collectionId`,`revId`,`revisionPinned`,`vdId`\",\"rowCount\":8}\n[\"RHEL_7_STIG_TEST\",1,\"RHEL_7_STIG_TEST-3-0.3\",0,21]\n[\"VPN_SRG_TEST\",1,\"VPN_SRG_TEST-1-1\",0,22]\n[\"VPN_SRG_TEST\",21,\"VPN_SRG_TEST-1-1\",0,23]\n[\"VPN_SRG_TEST\",83,\"VPN_SRG_TEST-1-1\",0,24]\n[\"VPN_SRG_TEST\",93,\"VPN_SRG_TEST-1-1\",0,25]\n[\"Windows_10_STIG_TEST\",1,\"Windows_10_STIG_TEST-1-23\",0,26]\n[\"Windows_10_STIG_TEST\",21,\"Windows_10_STIG_TEST-1-23\",0,27]\n[\"Windows_10_STIG_TEST\",93,\"Windows_10_STIG_TEST-1-23\",0,28]\n{\"table\":\"fix_text\",\"columns\":\"`ftId`,`text`\",\"rowCount\":615}\n[1,\"Use Windows 10 Enterprise 64-bit version for domain-joined systems.\"]\n[2,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> \\\"Allow user control over installs\\\" to \\\"Disabled\\\".\"]\n[3,\"For standalone systems, this is NA.\\n\\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nEnsure domain-joined systems must have a Trusted Platform Module (TPM) that is configured for use. (Versions 2.0 or 1.2 support Credential Guard.)\\n\\nThe TPM must be enabled in the firmware.\\nRun \\\"tpm.msc\\\" for configuration options in Windows.\"]\n[4,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> \\\"Always install with elevated privileges\\\" to \\\"Disabled\\\".\"]\n[5,\"The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> \\\"Prevent Internet Explorer security prompt for Windows Installer scripts\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[6,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Logon Options >> \\\"Sign-in last interactive user automatically after a system-initiated restart\\\" to \\\"Disabled\\\".\"]\n[7,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> \\\"Allow Basic authentication\\\" to \\\"Disabled\\\".\"]\n[8,\"Enable full disk encryption on all information systems (including SIPRNet) using BitLocker.\\n\\nBitLocker, included in Windows, can be enabled in the Control Panel under \\\"BitLocker Drive Encryption\\\" as well as other management tools.\\n\\nNOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).\"]\n[9,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> \\\"Allow unencrypted traffic\\\" to \\\"Disabled\\\".\"]\n[10,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> \\\"Disallow Digest authentication\\\" to \\\"Enabled\\\".\"]\n[11,\"Install DoD approved HBSS software and ensure it is operating continuously.\"]\n[12,\"Configure an application whitelisting program to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.\\n\\nConfiguration of whitelisting applications will vary by the program.  AppLocker is a whitelisting application built into Windows 10 Enterprise.\\n\\nIf AppLocker is used, it is configured through group policy in Computer Configuration >> Windows Settings >> Security Settings >> Application Control Policies >> AppLocker.\\n\\nImplementation guidance for AppLocker is available in the NSA paper \\\"Application Whitelisting using Microsoft AppLocker\\\" at the following link:\\n\\nhttps://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm\"]\n[13,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> \\\"Allow Basic authentication\\\" to \\\"Disabled\\\".\"]\n[14,\"Update systems on the Semi-Annual Channel to \\\"Microsoft Windows Version 1709 (OS Build 16299.0)\\\" or greater.\\n\\nIt is recommended systems be upgraded to the most recently released version.\\n\\nSpecial purpose systems using the Long-Term Servicing Branch\\\\Channel (LTSC\\\\B) may be at the following versions:\\n\\nv1507 (Build 10240)\\nv1607 (Build 14393)\\nv1809 (Build 17763)\"]\n[15,\"Install an anti-virus solution on the system.\"]\n[16,\"Format all local volumes to use NTFS.\"]\n[17,\"Ensure Windows 10 is the only operating system on a device.  Remove alternate operating systems.\"]\n[18,\"If a non system-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it.\\n\\nRemove any unnecessary non-system created shares.\"]\n[19,\"Regularly review local accounts and verify their necessity.  Disable or delete any active accounts that have not been used in the last 35 days.\"]\n[20,\"Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group.\\n\\nFor domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.\\n\\nRemove any standard user accounts.\"]\n[21,\"Create separate accounts for backup operations for users with this privilege.\"]\n[22,\"For Hyper-V, remove any unauthorized groups or user accounts from the \\\"Hyper-V Administrators\\\" group.\\n\\nFor hosted hypervisors other than Hyper-V, restrict access to create or run virtual machines to authorized user accounts only.\"]\n[23,\"Limit local user accounts on domain-joined systems.  Remove any unauthorized local accounts.\"]\n[24,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> \\\"Allow unencrypted traffic\\\" to \\\"Disabled\\\".\"]\n[25,\"Configure all passwords to expire.\\nRun \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Users.\\nDouble click each active account.\\nEnsure \\\"Password never expires\\\" is not checked on all active accounts.\"]\n[26,\"Maintain the default file system permissions and configure the Security Option: \\\"Network access: Let everyone permissions apply to anonymous users\\\" to \\\"Disabled\\\" (WN10-SO-000160).\"]\n[27,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> \\\"Disallow WinRM from storing RunAs credentials\\\" to \\\"Enabled\\\".\"]\n[28,\"Uninstall \\\"Internet Information Services\\\" or \\\"Internet Information Services Hostable Web Core\\\" from the system.\"]\n[29,\"Uninstall \\\"Simple Network Management Protocol (SNMP)\\\" from the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows Features on or off\\\".\\nDe-select \\\"Simple Network Management Protocol (SNMP)\\\".\"]\n[30,\"Uninstall \\\"Simple TCPIP Services (i.e. echo, daytime etc)\\\" from the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows Features on or off\\\".\\nDe-select \\\"Simple TCPIP Services (i.e. echo, daytime etc)\\\".\"]\n[31,\"Uninstall \\\"Telnet Client\\\" from the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows Features on or off\\\".\\n\\nDe-select \\\"Telnet Client\\\".\"]\n[32,\"Uninstall \\\"TFTP Client\\\" from the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows Features on or off\\\".\\n\\nDe-select \\\"TFTP Client\\\".\"]\n[33,\"Remove any certificate installation files (*.p12 and *.pfx) found on a system.\\n\\nNote: This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or Adobe PreFlight certificate files.\"]\n[34,\"Install and enable a host-based firewall on the system.\"]\n[35,\"Configure firewall exceptions to inbound connections on domain workstations to include only authorized remote management hosts.\\n\\nConfigure only inbound connection exceptions for authorized remote management hosts.\\nComputer Configuration >> Windows Settings >> Security Settings >> Windows Defender Firewall with Advanced Security >> Windows Defender Firewall with Advanced Security >> Inbound Rules (this link will be in the right pane)\\n\\nFor any inbound rules that allow connections, configure the Scope for Remote IP address to those of authorized remote management hosts. This may be defined as an IP address, subnet or range. Apply the rule to all firewall profiles.\\n\\nIf a third-party firewall is used, configure inbound exceptions to only include authorized remote management hosts.\"]\n[36,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> \\\"Account lockout duration\\\" to \\\"15\\\" minutes or greater.\\n\\nA value of \\\"0\\\" is also acceptable, requiring an administrator to unlock the account.\"]\n[37,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> \\\"Account lockout threshold\\\" to \\\"3\\\" or less invalid logon attempts (excluding \\\"0\\\" which is unacceptable).\"]\n[38,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> \\\"Reset account lockout counter after\\\" to \\\"15\\\" minutes.\"]\n[39,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Enforce password history\\\" to \\\"24\\\" passwords remembered.\"]\n[40,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Maximum Password Age\\\" to \\\"60\\\" days or less (excluding \\\"0\\\" which is unacceptable).\"]\n[41,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Minimum Password Age\\\" to at least \\\"1\\\" day.\"]\n[42,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Minimum password length\\\" to \\\"14\\\" characters.\"]\n[43,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Password must meet complexity requirements\\\" to \\\"Enabled\\\".\"]\n[44,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Store passwords using reversible encryption\\\" to \\\"Disabled\\\".\"]\n[45,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> \\\"Audit Credential Validation\\\" with \\\"Failure\\\" selected.\"]\n[46,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> \\\"Audit Credential Validation\\\" with \\\"Success\\\" selected.\"]\n[47,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> \\\"Audit Security Group Management\\\" with \\\"Success\\\" selected.\"]\n[48,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> \\\"Audit User Account Management\\\" with \\\"Failure\\\" selected.\"]\n[49,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> \\\"Audit User Account Management\\\" with \\\"Success\\\" selected.\"]\n[50,\"Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> \\\"Audit PNP Activity\\\" with \\\"Success\\\" selected.\"]\n[51,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> \\\"Audit Process Creation\\\" with \\\"Success\\\" selected.\"]\n[52,\"Configure the policy value for Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Group Membership\\\" with \\\"Success\\\" selected.\"]\n[53,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Logoff\\\" with \\\"Success\\\" selected.\"]\n[54,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Logon\\\" with \\\"Failure\\\" selected.\"]\n[55,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Logon\\\" with \\\"Success\\\" selected.\"]\n[56,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Special Logon\\\" with \\\"Success\\\" selected.\"]\n[57,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit Removable Storage\\\" with \\\"Failure\\\" selected.\"]\n[58,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit Removable Storage\\\" with \\\"Success\\\" selected.\"]\n[59,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> \\\"Audit Audit Policy Change\\\" with \\\"Success\\\" selected.\"]\n[60,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> \\\"Audit Authentication Policy Change\\\" with \\\"Success\\\" selected.\"]\n[61,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> \\\"Audit Sensitive Privilege Use\\\" with \\\"Failure\\\" selected.\"]\n[62,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> \\\"Audit Sensitive Privilege Use\\\" with \\\"Success\\\" selected.\"]\n[63,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit IPSec Driver\\\" with \\\"Failure\\\" selected.\"]\n[64,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit Other System Events\\\" with \\\"Success\\\" selected.\"]\n[65,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit Other System Events\\\" with \\\"Failure\\\" selected.\"]\n[66,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit Security State Change\\\" with \\\"Success\\\" selected.\"]\n[67,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit Security System Extension\\\" with \\\"Success\\\" selected.\"]\n[68,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit System Integrity\\\" with \\\"Failure\\\" selected.\"]\n[69,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit System Integrity\\\" with \\\"Success\\\" selected.\"]\n[70,\"If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Application >> \\\"Specify the maximum log file size (KB)\\\" to \\\"Enabled\\\" with a \\\"Maximum Log Size (KB)\\\" of \\\"32768\\\" or greater.\"]\n[71,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Security >> \\\"Specify the maximum log file size (KB)\\\" to \\\"Enabled\\\" with a \\\"Maximum Log Size (KB)\\\" of \\\"1024000\\\" or greater.\\n\\nIf the system is configured to send audit records directly to an audit server, documented with the ISSO.\"]\n[72,\"If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> System >> \\\"Specify the maximum log file size (KB)\\\" to \\\"Enabled\\\" with a \\\"Maximum Log Size (KB)\\\" of \\\"32768\\\" or greater.\"]\n[73,\"Ensure the permissions on the Application event log (Application.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory.\\n\\nIf the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as \\\"NT Service\\\\Eventlog\\\".\"]\n[74,\"Ensure the permissions on the Security event log (Security.evtx) are configured to prevent standard user accounts or groups from having access.  The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory.\\n\\nIf the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as \\\"NT Service\\\\Eventlog\\\".\"]\n[75,\"Ensure the permissions on the System event log (System.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory.\\n\\nIf the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as \\\"NT Service\\\\Eventlog\\\".\"]\n[76,\"If the device does not have a camera, this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Control Panel >> Personalization >> \\\"Prevent enabling lock screen camera\\\" to \\\"Enabled\\\".\"]\n[77,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Control Panel >> Personalization >> \\\"Prevent enabling lock screen slide show\\\" to \\\"Enabled\\\".\"]\n[78,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> \\\"MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)\\\" to \\\"Highest protection, source routing is completely disabled\\\".\\n\\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \\\"MSS-Legacy.admx\\\" and \\\" MSS-Legacy.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[79,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> \\\"MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)\\\" to \\\"Highest protection, source routing is completely disabled\\\".\\n\\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \\\"MSS-Legacy.admx\\\" and \\\" MSS-Legacy.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[80,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> \\\"MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes\\\" to \\\"Disabled\\\".\\n\\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \\\"MSS-Legacy.admx\\\" and \\\" MSS-Legacy.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[81,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> \\\"MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers\\\" to \\\"Enabled\\\".\\n\\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \\\"MSS-Legacy.admx\\\" and \\\" MSS-Legacy.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[82,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Lanman Workstation >> \\\"Enable insecure guest logons\\\" to \\\"Disabled\\\".\"]\n[83,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Network Provider >> \\\"Hardened UNC Paths\\\" to \\\"Enabled\\\" with at least the following configured in \\\"Hardened UNC Paths:\\\" (click the \\\"Show\\\" button to display).\\n\\nValue Name: \\\\\\\\*\\\\SYSVOL\\nValue: RequireMutualAuthentication=1, RequireIntegrity=1\\n\\nValue Name: \\\\\\\\*\\\\NETLOGON\\nValue: RequireMutualAuthentication=1, RequireIntegrity=1\"]\n[84,\"Install the DoD Root CA certificates.\\nDoD Root CA 2\\nDoD Root CA 3\\nDoD Root CA 4\\nDoD Root CA 5\\n\\nThe InstallRoot tool is available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.\"]\n[85,\"The default behavior for \\\"Minimize the number of simultaneous connections to the Internet or a Windows Domain\\\" is \\\"Enabled\\\".\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Windows Connection Manager >> \\\"Minimize the number of simultaneous connections to the Internet or a Windows Domain\\\" to \\\"Enabled\\\".\"]\n[86,\"Install the ECA Root CA certificates on unclassified systems.\\nECA Root CA 2\\nECA Root CA 4\\n\\nThe InstallRoot tool is available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.\"]\n[87,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Windows Connection Manager >> \\\"Prohibit connection to non-domain networks when connected to domain authenticated network\\\" to \\\"Enabled\\\".\"]\n[88,\"Install the DoD Interoperability Root CA cross-certificates on unclassified systems.\\n\\nIssued To - Issued By - Thumbprint\\nDoD Root CA 2 - DoD Interoperability Root CA 1 - A8C27332CCB4CA49554CE55D34062A7DD2850C02\\nDoD Root CA 3 - DoD Interoperability Root CA 2 - AC06108CA348CC03B53795C64BF84403C1DBD341\\n\\nThe certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.\"]\n[89,\"Install the US DoD CCEB Interoperability Root CA cross-certificate on unclassified systems.\\n\\nIssued To - Issued By - Thumbprint\\nDoD Root CA 3 - US DoD CCEB Interoperability Root CA 2 - AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9\\n\\nThe certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.\"]\n[90,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> WLAN Service >> WLAN Settings>> \\\"Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services\\\" to \\\"Disabled\\\".   \\n\\nv1507 LTSB does not include this group policy setting.  It may be configured through other means such as using group policy from a later version of Windows 10 or a registry update.\"]\n[91,\"Maintain the default permissions for the HKEY_LOCAL_MACHINE registry hive.\\n\\nThe default permissions of the higher level keys are noted below.\\n\\nHKEY_LOCAL_MACHINE\\\\SECURITY\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nSYSTEM - Full Control - This key and subkeys\\nAdministrators - Special - This key and subkeys\\n\\nHKEY_LOCAL_MACHINE\\\\SOFTWARE\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nUsers - Read - This key and subkeys\\nAdministrators - Full Control - This key and subkeys\\nSYSTEM - Full Control - This key and subkeys\\nCREATOR OWNER - Full Control - This key and subkeys\\nALL APPLICATION PACKAGES - Read - This key and subkeys\\n\\nHKEY_LOCAL_MACHINE\\\\SYSTEM\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nUsers - Read - This key and subkeys\\nAdministrators - Full Control - This key and subkeys\\nSYSTEM - Full Control - This key and subkeys\\nCREATOR OWNER - Full Control - This key and subkeys\\nALL APPLICATION PACKAGES - Read - This key and subkeys\\n\\nMicrosoft has also given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID.\\n\\nS-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681\"]\n[92,\"Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> \\\"Turn On Virtualization Based Security\\\" to \\\"Enabled\\\" with \\\"Secure Boot\\\" or \\\"Secure Boot and DMA Protection\\\" selected for \\\"Select Platform Security Level:\\\".\\n\\nA Microsoft article on Credential Guard system requirement can be found at the following link.\\nhttps://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard-requirements\"]\n[93,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Apply UAC restrictions to local accounts on network logons\\\" to \\\"Enabled\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package.  \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[94,\"Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nFor VDIs with persistent desktops, this may be downgraded to a CAT II only where administrators have specific tokens for the VDI. Administrator accounts on virtual desktops must only be used on systems in the VDI; they may not have administrative privileges on any other systems such as servers and physical workstations.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> \\\"Turn On Virtualization Based Security\\\" to \\\"Enabled\\\" with \\\"Enabled with UEFI lock\\\" selected for \\\"Credential Guard Configuration:\\\".\\n\\nv1507 LTSB does not include selection options; select \\\"Enable Credential Guard\\\".\\n\\nA Microsoft TechNet article on Credential Guard, including system requirement details, can be found at the following link:\\n\\nhttps://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard\"]\n[95,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Administrator account status\\\" to \\\"Disabled\\\".\"]\n[96,\"Ensure that Early Launch Antimalware - Boot-Start Driver Initialization policy is set to enforce \\\"Good, unknown and bad but critical\\\" (preventing \\\"bad\\\").\\n\\nIf this needs to be corrected configure the policy value for Computer Configuration >> Administrative Templates >> System >> Early Launch Antimalware >> \\\"Boot-Start Driver Initialization Policy\\\" to \\\"Enabled” with \\\"Good, unknown and bad but critical\\\" selected.\"]\n[97,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Group Policy >> \\\"Configure registry policy processing\\\" to \\\"Enabled\\\" and select the option \\\"Process even if the Group Policy objects have not changed\\\".\"]\n[98,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Guest account status\\\" to \\\"Disabled\\\".\"]\n[99,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> \\\"Turn off downloading of print drivers over HTTP\\\" to \\\"Enabled\\\".\"]\n[100,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Limit local account use of blank passwords to console logon only\\\" to \\\"Enabled\\\".\"]\n[101,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Rename administrator account\\\" to a name other than \\\"Administrator\\\".\"]\n[102,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> \\\"Turn off Internet download for Web publishing and online ordering wizards\\\" to \\\"Enabled\\\".\"]\n[103,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> \\\"Turn off printing over HTTP\\\" to \\\"Enabled\\\".\"]\n[104,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Rename guest account\\\" to a name other than \\\"Guest\\\".\"]\n[105,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nThe default behavior for \\\"Support device authentication using certificate\\\" is \\\"Automatic\\\".\\n\\nIf this needs to be corrected, configured the policy value for Computer Configuration >> Administrative Templates >> System >> Kerberos >> \\\"Support device authentication using certificate\\\" to \\\"Not Configured or \\\"Enabled\\\" with either option selected in \\\"Device authentication behavior using certificate:\\\".\"]\n[106,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> \\\"Do not display network selection UI\\\" to \\\"Enabled\\\".\"]\n[107,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> \\\"Enumerate local users on domain-joined computers\\\" to \\\"Disabled\\\".\"]\n[108,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" to \\\"Enabled\\\".\"]\n[109,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Digitally encrypt or sign secure channel data (always)\\\" to \\\"Enabled\\\".\"]\n[110,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Digitally encrypt secure channel data (when possible)\\\" to \\\"Enabled\\\".\"]\n[111,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> \\\"Require a password when a computer wakes (on battery)\\\" to \\\"Enabled\\\".\"]\n[112,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Digitally sign secure channel data (when possible)\\\" to \\\"Enabled\\\".\"]\n[113,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> \\\"Require a password when a computer wakes (plugged in)\\\" to \\\"Enabled\\\".\"]\n[114,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Remote Assistance >> \\\"Configure Solicited Remote Assistance\\\" to \\\"Disabled\\\".\"]\n[115,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Disable machine account password changes\\\" to \\\"Disabled\\\".\"]\n[116,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Remote Procedure Call >> \\\"Restrict Unauthenticated RPC clients\\\" to \\\"Enabled\\\" and \\\"Authenticated\\\".\"]\n[117,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Runtime >> \\\"Allow Microsoft accounts to be optional\\\" to \\\"Enabled\\\".\"]\n[118,\"This is the default configuration for this setting (30 days).\\n\\nConfigure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Maximum machine account password age\\\" to \\\"30\\\" or less (excluding 0 which is unacceptable).\"]\n[119,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Application Compatibility >> \\\"Turn off Inventory Collector\\\" to \\\"Enabled\\\".\"]\n[120,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Require strong (Windows 2000 or Later) session key\\\" to \\\"Enabled\\\".\"]\n[121,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> \\\"Disallow Autoplay for non-volume devices\\\" to \\\"Enabled\\\".\"]\n[122,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Machine inactivity limit\\\" to \\\"900\\\" seconds\\\" or less, excluding \\\"0\\\" which is effectively disabled.\"]\n[123,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> \\\"Set the default behavior for AutoRun\\\" to \\\"Enabled:Do not execute any autorun commands\\\".\"]\n[124,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> \\\"Turn off AutoPlay\\\" to \\\"Enabled:All Drives\\\".\"]\n[125,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Message text for users attempting to log on\\\" to the following.\\n\\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details.\"]\n[126,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Biometrics >> Facial Features >> \\\"Configure enhanced anti-spoofing\\\" to \\\"Enabled\\\". \\n\\nv1607:\\nThe policy name is \\\"Use enhanced anti-spoofing when available\\\".\"]\n[127,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Credential User Interface >> \\\"Enumerate administrator accounts on elevation\\\" to \\\"Disabled\\\".\"]\n[128,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Message title for users attempting to log on\\\" to \\\"DoD Notice and Consent Banner\\\", \\\"US Department of Defense Warning Statement\\\", or a site-defined equivalent.\\n\\nIf a site-defined title is used, it can in no case contravene or modify the language of the banner text required in WN10-SO-000075.\"]\n[129,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Data Collection and Preview Builds >> \\\"Allow Telemetry\\\" to \\\"Enabled\\\" with \\\"0 - Security [Enterprise Only]\\\" or \\\"1 - Basic\\\" selected in \\\"Options:\\\".   \\n\\nIf an organization is using v1709 or later of Windows 10 this may be configured to \\\"2 - Enhanced\\\" to support Windows Analytics. V-82145 must also be configured to limit the Enhanced diagnostic data to the minimum required by Windows Analytics.\"]\n[130,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Configure Windows Defender SmartScreen\\\" to \\\"Enabled\\\" with \\\"Warn and prevent bypass\\\" selected. \\n\\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Explorer.\\n\\nv1607 LTSB:\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Configure Windows SmartScreen\\\" to \\\"Enabled\\\". (Selection options are not available.)\\n\\nv1507 LTSB:\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Configure Windows SmartScreen\\\" to \\\"Enabled\\\" with \\\"Require approval from an administrator before running downloaded unknown software\\\" selected.\"]\n[131,\"This is the default configuration for this setting (10 logons to cache).\\n\\nConfigure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Number of previous logons to cache (in case domain controller is not available)\\\" to \\\"10\\\" logons or less.\\n\\nThis setting only applies to domain-joined systems, however, it is configured by default on all systems.\"]\n[132,\"The default behavior is for data execution prevention to be turned on for file explorer.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Turn off Data Execution Prevention for Explorer\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[133,\"The default behavior is for File Explorer heap termination on corruption to be enabled.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Turn off heap termination on corruption\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[134,\"The default behavior is for shell protected mode to be turned on for file explorer.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Turn off shell protocol protected mode\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[135,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Smart card removal behavior\\\" to  \\\"Lock Workstation\\\" or \\\"Force Logoff\\\".\"]\n[136,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Prevent bypassing Windows Defender SmartScreen prompts for sites\\\" to \\\"Enabled\\\". \\n\\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.\"]\n[137,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Prevent bypassing Windows Defender SmartScreen prompts for files\\\" to \\\"Enabled\\\". \\n\\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.\"]\n[138,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Microsoft network client: Digitally sign communications (always)\\\" to \\\"Enabled\\\".\"]\n[139,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Configure Password Manager\\\" to \\\"Disabled\\\".\"]\n[140,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Microsoft network client: Send unencrypted password to third-party SMB servers\\\" to \\\"Disabled\\\".\"]\n[141,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Configure Windows Defender SmartScreen\\\" to \\\"Enabled\\\". \\n\\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.\"]\n[142,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Hello for Business >> \\\"Use a hardware security device\\\" to \\\"Enabled\\\". \\n\\nv1507 LTSB:\\nThe policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Passport for Work.\"]\n[143,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Microsoft network server: Digitally sign communications (always)\\\" to \\\"Enabled\\\".\"]\n[144,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> PIN Complexity >> \\\"Minimum PIN length\\\" to \\\"6\\\" or greater. \\n\\nv1607 LTSB:\\nThe policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Windows Hello for Business >> Pin Complexity.\\n\\nv1507 LTSB:\\nThe policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Passport for Work >> Pin Complexity.\"]\n[145,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Connection Client >> \\\"Do not allow passwords to be saved\\\" to \\\"Enabled\\\".\"]\n[146,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Device and Resource Redirection >> \\\"Do not allow drive redirection\\\" to \\\"Enabled\\\".\"]\n[147,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> \\\"Always prompt for password upon connection\\\" to \\\"Enabled\\\".\"]\n[148,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security \\\"Require secure RPC communication\\\" to \\\"Enabled\\\".\"]\n[149,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Allow anonymous SID/Name translation\\\" to \\\"Disabled\\\".\"]\n[150,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> \\\"Set client connection encryption level\\\" to \\\"Enabled\\\" and \\\"High Level\\\".\"]\n[151,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> \\\"Prevent downloading of enclosures\\\" to \\\"Enabled\\\".\"]\n[152,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Do not allow anonymous enumeration of SAM accounts\\\" to \\\"Enabled\\\".\"]\n[153,\"The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> \\\"Turn on Basic feed authentication over HTTP\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[154,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Do not allow anonymous enumeration of SAM accounts and shares\\\" to \\\"Enabled\\\".\"]\n[155,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Search >> \\\"Allow indexing of encrypted files\\\" to \\\"Disabled\\\".\"]\n[156,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Let Everyone permissions apply to anonymous users\\\" to \\\"Disabled\\\".\"]\n[157,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Restrict anonymous access to Named Pipes and Shares\\\" to \\\"Enabled\\\".\"]\n[158,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Allow LocalSystem NULL session fallback\\\" to \\\"Disabled\\\".\"]\n[159,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Allow PKU2U authentication requests to this computer to use online identities\\\" to \\\"Disabled\\\".\"]\n[160,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Configure encryption types allowed for Kerberos\\\" to \\\"Enabled\\\" with only the following selected:\\n\\nAES128_HMAC_SHA1\\nAES256_HMAC_SHA1\\nFuture encryption types\"]\n[161,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Do not store LAN Manager hash value on next password change\\\" to \\\"Enabled\\\".\"]\n[162,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: LAN Manager authentication level\\\" to \\\"Send NTLMv2 response only. Refuse LM & NTLM\\\".\"]\n[163,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: LDAP client signing requirements\\\" to \\\"Negotiate signing\\\" at a minimum.\"]\n[164,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Minimum session security for NTLM SSP based (including secure RPC) clients\\\" to \\\"Require NTLMv2 session security\\\" and \\\"Require 128-bit encryption\\\" (all options selected).\"]\n[165,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Minimum session security for NTLM SSP based (including secure RPC) servers\\\" to \\\"Require NTLMv2 session security\\\" and \\\"Require 128-bit encryption\\\" (all options selected).\"]\n[166,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing\\\" to \\\"Enabled\\\".\"]\n[167,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"System objects: Strengthen default permissions of internal system objects (e.g. Symbolic links)\\\" to \\\"Enabled\\\".\"]\n[168,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Admin Approval Mode for the Built-in Administrator account\\\" to \\\"Enabled\\\".\"]\n[169,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode\\\" to \\\"Prompt for consent on the secure desktop\\\".\"]\n[170,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Behavior of the elevation prompt for standard users\\\" to \\\"Automatically deny elevation requests\\\".\"]\n[171,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Detect application installations and prompt for elevation\\\" to \\\"Enabled\\\".\"]\n[172,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Only elevate UIAccess applications that are installed in secure locations\\\" to \\\"Enabled\\\".\"]\n[173,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Run all administrators in Admin Approval Mode\\\" to \\\"Enabled\\\".\"]\n[174,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Virtualize file and registry write failures to per-user locations\\\" to \\\"Enabled\\\".\"]\n[175,\"Configure the policy value for User Configuration >> Administrative Templates >> Start Menu and Taskbar >> Notifications >> \\\"Turn off toast notifications on the lock screen\\\" to \\\"Enabled\\\".\"]\n[176,\"The default behavior is for Windows to mark file attachments with their zone information.\\n\\nIf this needs to be corrected, configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Attachment Manager >> \\\"Do not preserve zone information in file attachments\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[177,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Access Credential Manager as a trusted caller\\\" to be defined but containing no entries (blank).\"]\n[178,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Access this computer from the network\\\" to only include the following groups or accounts:\\n\\nAdministrators   \\nRemote Desktop Users\"]\n[179,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Act as part of the operating system\\\" to be defined but containing no entries (blank).\"]\n[180,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Allow log on locally\\\" to only include the following groups or accounts:\\n\\nAdministrators\\nUsers\"]\n[181,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Back up files and directories\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[182,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Change the system time\\\" to only include the following groups or accounts:\\n\\nAdministrators\\nLOCAL SERVICE\\nNT SERVICE\\\\autotimesvc is added in v1909 cumulative update.\"]\n[183,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create a pagefile\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[184,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create a token object\\\" to be defined but containing no entries (blank).\"]\n[185,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create global objects\\\" to only include the following groups or accounts:\\n\\nAdministrators\\nLOCAL SERVICE\\nNETWORK SERVICE\\nSERVICE\"]\n[186,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create permanent shared objects\\\" to be defined but containing no entries (blank).\"]\n[187,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create symbolic links\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[188,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Debug programs\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[189,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny access to this computer from the network\\\" to include the following.\\n\\nDomain Systems Only:\\nEnterprise Admins group\\nDomain Admins group\\nLocal account (see Note below)\\n\\nAll Systems:\\nGuests group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nNote: \\\"Local account\\\" is a built-in security group used to assign user rights and permissions to all local accounts.\"]\n[190,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny log on as a batch job\\\" to include the following.\\n\\nDomain Systems Only:\\nEnterprise Admin Group\\nDomain Admin Group\"]\n[191,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny log on as a service\\\" to include the following.\\n\\nDomain Systems Only:\\nEnterprise Admins Group\\nDomain Admins Group\"]\n[192,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny log on locally\\\" to include the following.\\n\\nDomain Systems Only:\\nEnterprise Admins Group\\nDomain Admins Group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nAll Systems:\\nGuests Group\"]\n[193,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny log on through Remote Desktop Services\\\" to include the following.\\n\\nIf Remote Desktop Services is not used by the organization, assign the Everyone group this right to prevent all access.\\n\\nDomain Systems Only:\\nEnterprise Admins group\\nDomain Admins group\\nLocal account (see Note below)\\n\\nAll Systems:\\nGuests group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nNote: \\\"Local account\\\" is a built-in security group used to assign user rights and permissions to all local accounts.\"]\n[194,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Enable computer and user accounts to be trusted for delegation\\\" to be defined but containing no entries (blank).\"]\n[195,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Force shutdown from a remote system\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[196,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Impersonate a client after authentication\\\" to only include the following groups or accounts:\\n\\nAdministrators\\nLOCAL SERVICE\\nNETWORK SERVICE\\nSERVICE\"]\n[197,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Load and unload device drivers\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[198,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Lock pages in memory\\\" to be defined but containing no entries (blank).\"]\n[199,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Manage auditing and security log\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[200,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Modify firmware environment values\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[201,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Perform volume maintenance tasks\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[202,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Profile single process\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[203,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Restore files and directories\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[204,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Take ownership of files or other objects\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[205,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Delivery Optimization >> \\\"Download Mode\\\" to \\\"Enabled\\\" with any option except \\\"Internet\\\" selected.\\n\\nAcceptable selections include:\\nBypass (100)\\nGroup (2)\\nHTTP only (0)\\nLAN (1)\\nSimple (99)\\n\\nv1507 (LTSB) does not include this group policy setting locally. For domain joined systems, configure through domain group policy as \\\"HTTP only (0)\\\" or \\\"Lan (1)\\\". Standalone systems configure using Settings >> Update & Security >> Windows Update >> Advanced Options >> \\\"Choose how updates are delivered\\\" with either \\\"Off\\\" or \\\"PCs on my local network\\\" selected.\"]\n[206,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Audit Process Creation >> \\\"Include command line in process creation events\\\" to \\\"Enabled\\\".\"]\n[207,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> \\\"Turn on PowerShell Script Block Logging\\\" to \\\"Enabled\\\".\"]\n[208,\"Configure DEP to at least OptOut.\\n\\nNote: Suspend BitLocker before making changes to the DEP configuration.\\n\\nOpen a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).\\nEnter \\\"BCDEDIT /set {current} nx OptOut\\\".  (If using PowerShell \\\"{current}\\\" must be enclosed in quotes.)\\n\\\"AlwaysOn\\\", a more restrictive selection, is also valid but does not allow applications that do not function properly to be opted out of DEP.\\n\\nOpted out exceptions can be configured in the \\\"System Properties\\\".\\n\\nOpen \\\"System\\\" in Control Panel.\\nSelect \\\"Advanced system settings\\\".\\nClick \\\"Settings\\\" in the \\\"Performance\\\" section.\\nSelect the \\\"Data Execution Prevention\\\" tab.\\nApplications that are opted out are configured in the window below the selection \\\"Turn on DEP for all programs and services except those I select:\\\".\"]\n[209,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Enable Structured Exception Handling Overwrite Protection (SEHOP)\\\" to \\\"Enabled\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package. \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[210,\"Disable \\\"Windows PowerShell 2.0\\\" on the system.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\nEnter the following:\\nDisable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root\\n\\nThis command should disable both \\\"MicrosoftWindowsPowerShellV2Root\\\" and \\\"MicrosoftWindowsPowerShellV2\\\" which correspond to \\\"Windows PowerShell 2.0\\\" and \\\"Windows PowerShell 2.0 Engine\\\" respectively in \\\"Turn Windows features on or off\\\".\\n\\nAlternately:\\nSearch for \\\"Features\\\".\\nSelect \\\"Turn Windows features on or off\\\".\\nDe-select \\\"Windows PowerShell 2.0\\\".\"]\n[211,\"Disable the SMBv1 protocol.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter the following:\\nDisable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol\\n\\nAlternately:\\nSearch for \\\"Features\\\".\\n\\nSelect \\\"Turn Windows features on or off\\\".\\n\\nDe-select \\\"SMB 1.0/CIFS File Sharing Support\\\".\"]\n[212,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Account Lockout\\\" with \\\"Failure\\\" selected.\"]\n[213,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> \\\"Audit Authorization Policy Change\\\" with \\\"Success\\\" selected.\"]\n[214,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"WDigest Authentication (disabling may require KB2871997)\\\" to \\\"Disabled\\\".\\n\\nThe patch referenced in the policy title is not required for Windows 10.\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package.  \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[215,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Network Connections >> \\\"Prohibit use of Internet Connection Sharing on your DNS domain network\\\" to \\\"Enabled\\\".\"]\n[216,\"Navigate to the policy Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Restrict clients allowed to make remote calls to SAM\\\".\\n\\nSelect \\\"Edit Security\\\" to configure the \\\"Security descriptor:\\\".\\n\\nAdd \\\"Administrators\\\" in \\\"Group or user names:\\\" if it is not already listed (this is the default).\\n\\nSelect \\\"Administrators\\\" in \\\"Group or user names:\\\".\\n\\nSelect \\\"Allow\\\" for \\\"Remote Access\\\" in \\\"Permissions for \\\"Administrators\\\".\\n\\nClick \\\"OK\\\".\\n\\nThe \\\"Security descriptor:\\\" must be populated with \\\"O:BAG:BAD:(A;;RC;;;BA) for the policy to be enforced.\"]\n[217,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Cloud Content >> \\\"Turn off Microsoft consumer experiences\\\" to \\\"Enabled\\\".\"]\n[218,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Remove \\\"Run as Different User\\\" from context menus\\\" to \\\"Enabled\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package.  \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[219,\"Turn off Bluetooth radios not organizationally approved. Establish an organizational policy for the use of Bluetooth.\"]\n[220,\"Turn off Bluetooth radios when not in use. Establish an organizational policy for the use of Bluetooth to include training of personnel.\"]\n[221,\"Configure Bluetooth to notify users if devices attempt to connect.\\nView Bluetooth Settings.\\nEnsure \\\"Alert me when a new Bluetooth device wants to connect\\\" is checked.\"]\n[222,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit Other Object Access Events\\\" with \\\"Failure\\\" selected.\"]\n[223,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit Other Object Access Events\\\" with \\\"Success\\\" selected.\"]\n[224,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> SSL Configuration Settings >> \\\"ECC Curve Order\\\" to \\\"Enabled\\\" with \\\"ECC Curve Order:\\\" including the following in the order listed:\\n\\nNistP384\\nNistP256\"]\n[225,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Game Recording and Broadcasting >> \\\"Enables or disables Windows Game Recording and Broadcasting\\\" to \\\"Disabled\\\".\"]\n[226,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Credentials Delegation >> \\\"Remote host allows delegation of non-exportable credentials\\\" to \\\"Enabled\\\".\"]\n[227,\"Configure the \\\"Secondary Logon\\\" service \\\"Startup Type\\\" to \\\"Disabled\\\".\"]\n[228,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit File Share\\\" with \\\"Success\\\" selected.\"]\n[229,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Configure SMBv1 Server\\\" to \\\"Disabled\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package. \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.   \\n\\nThe system must be restarted for the change to take effect.\"]\n[230,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Configure SMBv1 client driver\\\" to \\\"Enabled\\\" with \\\"Disable driver (recommended)\\\" selected for \\\"Configure MrxSmb10 driver\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package. \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.   \\n\\nThe system must be restarted for the changes to take effect.\"]\n[231,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit File Share\\\" with \\\"Failure\\\" selected.\"]\n[232,\"Remove any unresolved SIDs found in User Rights assignments and determined to not be for currently valid accounts or groups by removing the accounts or groups from the appropriate group policy.\"]\n[233,\"Configure UEFI firmware to run in UEFI mode, not Legacy BIOS mode.\"]\n[234,\"Enable Secure Boot in the system firmware.\"]\n[235,\"Ensure Exploit Protection system-level mitigation, \\\"Data Execution Prevention (DEP)\\\", is turned on.  The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Data Execution Prevention (DEP)\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn DEP on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <DEP Enable=\\\"true\\\"></DEP>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[236,\"Ensure Exploit Protection system-level mitigation, \\\"Randomize memory allocations (Bottom-Up ASLR)\\\" is turned on. The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Randomize memory allocations (Bottom-Up ASLR)\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn Bottom-Up ASLR on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <ASLR BottomUp=\\\"true\\\"</ASLR>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[237,\"Ensure Exploit Protection system-level mitigation, \\\"Control flow guard (CFG)\\\", is turned on. The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Control flow guard (CFG)\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn CFG on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <ControlFlowGuard Enable=\\\"true\\\"></ControlFlowGuard>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[238,\"Ensure Exploit Protection system-level mitigation, \\\"Validate exception chains (SEHOP)\\\", is turned on. The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Validate exception chains (SEHOP)\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn SEHOP on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <SEHOP Enable=\\\"true\\\"></SEHOP>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[239,\"Ensure Exploit Protection system-level mitigation, \\\"Validate heap integrity\\\" is turned on. The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Validate heap integrity\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn Validate heap integrity on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <Heap TerminateOnError=\\\"true\\\"></Heap>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[240,\"Ensure the following mitigations are configured as shown for Acrobat.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[241,\"Ensure the following mitigations are configured as shown for AcroRd32.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot= False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[242,\"Ensure the following mitigations are configured as shown forchrome.exe:\\n\\nDEP:\\nOverrideDEP: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[243,\"Ensure the following mitigations are configured as shown for EXCEL.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[244,\"Ensure the following mitigations are configured as shown  firefox.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: On\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[245,\"Ensure the following mitigations are configured as shown for FLTLDR.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False \\nOverrideExportAddressFilterPlus: False \\nOverrideImportAddressFilter: False \\nOverrideEnableRopStackPivot: False \\nOverrideEnableRopCallerCheck: False \\nOverrideEnableRopSimExec: False\\n\\nChild Process:\\nOverrideChildProcess: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[246,\"Ensure the following mitigations are configured as shown GROOVE.EXE:\\n\\nDEP:\\nOverrideDEP: False\\n\\nASLR:\\nOverrideBlockRemoteImages: False\\n\\nImageLoad:\\nForceRelocateImages: True\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nChild Process:\\nOverrideChildProcess: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[247,\"Ensure the following mitigations are configured as shown for iexplore.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[248,\"Ensure the following mitigations are configured as shown for INFOPATH.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[249,\"Ensure the following mitigations are configured for java.exe, javaw.exe, and javaws.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[250,\"Ensure the following mitigations are configured as shown for lync.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[251,\"Ensure the following mitigations are configured as shown for MSACCESS.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[252,\"Ensure the following mitigations are configured as shown for MSPUB.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[253,\"Ensure the following mitigations are configured for OneDrive.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nOverrideRelocateImages: NOTSET\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False \\nOverrideExportAddressFilterPlus: False \\nOverrideImportAddressFilter: False \\nOverrideEnableRopStackPivot: False \\nOverrideEnableRopCallerCheck: False \\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[254,\"Ensure the following mitigations are configured as shown for OIS.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[255,\"Ensure the following mitigations are configured as shown for OUTLOOK.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[256,\"Ensure the following mitigations are configured as shown forplugin-container.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[257,\"Ensure the following mitigations are configured as shown for POWERPNT.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[258,\"Ensure the following mitigations are configured as shown for PPTVIEW.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[259,\"Ensure the following mitigations are configured as shown for VISIO.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[260,\"Ensure the following mitigations are configured as shown for VPREVIEW.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[261,\"Ensure the following mitigations are configured as shown for WINWORD.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[262,\"Ensure the following mitigations are configured as shown for wmplayer.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[263,\"Ensure the following mitigations are configured as shown for wordpad.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[264,\"Establish and enforce a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. Define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.\\n\\nImplement technical measures where feasible such as removal of applications or use of application whitelisting to restrict the use of applications that can access the Internet.\"]\n[265,\"Configure the policy value for User Configuration >> Administrative Templates >> OneDrive >> \\\"Prevent users from synchronizing personal OneDrive accounts\\\" to \\\"Enabled\\\".   \\n\\nGroup policy files for OneDrive are located on a system with OneDrive in \\\"%localappdata%\\\\Microsoft\\\\OneDrive\\\\BuildNumber\\\\adm\\\\\\\".\\n\\nCopy the OneDrive.admx and .adml files to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[266,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Prevent certificate error overrides\\\" to \\\"Enabled\\\".\"]\n[267,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Data Collection and Preview Builds >> \\\"Limit Enhanced diagnostic data to the minimum required by Windows Analytics\\\" to \\\"Enabled\\\" with \\\"Enable Windows Analytics collection\\\" selected in \\\"Options:\\\".\"]\n[268,\"Configure the policy value for Computer Configuration >> Administrative Templates >> OneDrive >> \\\"Allow syncing OneDrive accounts for only specific organizations\\\", with the Tenant GUID of the organization's DoD instance in the format 1111-2222-3333-4444.\\n\\nIf the organization does not have an instance of OneDrive, configure the Tenant GUID with \\\"1111-2222-3333-4444\\\".\\n\\nGroup policy files for OneDrive are located on a system with OneDrive in \\\"%localappdata%\\\\Microsoft\\\\OneDrive\\\\BuildNumber\\\\adm\\\\\\\".\\n\\nCopy the OneDrive.admx and .adml files to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[269,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> \\\"Let Windows apps activate with voice while the system is locked\\\" to \\\"Enabled\\\" with “Default for all Apps:” set to “Force Deny”. \\n\\nThe requirement is NA if the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> \\\"Let Windows apps activate with voice\\\" is configured to \\\"Enabled\\\" with “Default for all Apps:” set to “Force Deny”.\"]\n[270,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> BitLocker Drive Encryption >> Operating System Drives \\\"Require additional authentication at startup\\\" to \\\"Enabled\\\" with \\\"Configure TPM Startup PIN:\\\" set to \\\"Require startup PIN with TPM\\\" or with \\\"Configure TPM startup key and PIN:\\\" set to \\\"Require startup key and PIN with TPM\\\".\"]\n[271,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> BitLocker Drive Encryption >> Operating System Drives \\\"Configure minimum PIN length for startup\\\" to \\\"Enabled\\\" with \\\"Minimum characters:\\\" set to \\\"6\\\" or greater.\"]\n[272,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Other Logon/Logoff Events\\\" with \\\"Failure\\\" selected.\"]\n[273,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Other Logon/Logoff Events\\\" with \\\"Success\\\" selected.\"]\n[274,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> “Detailed File Share\\\" with \\\"Failure\\\" selected.\"]\n[275,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> “Audit MPSSVC Rule-Level Policy Change\\\" with \\\"Success\\\" selected.\"]\n[276,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> “Audit MPSSVC Rule-Level Policy Change\\\" with \\\"Failure\\\" selected.\"]\n[277,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change>> \\\"Audit Other Policy Change Events\\\" with \\\"Success\\\" selected.\"]\n[278,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change>> \\\"Audit Other Policy Change Events\\\" with \\\"Failure\\\" selected.\"]\n[279,\"Change the enabled local Administrator account password at least every \\\"60\\\" days.\\n\\nAutomated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to meet this requirement.\"]\n[280,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Kernel DMA Protection >> \\\"Enumeration policy for external devices incompatible with Kernel DMA Protection\\\" to \\\"Enabled\\\" with \\\"Enumeration Policy\\\" set to \\\"Block All\\\".\"]\n[281,\"Disable the convenience PIN sign-in. \\n\\nIf this needs to be corrected configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> Set \\\"Turn on convenience PIN sign-in\\\" to \\\"Disabled”.\"]\n[282,\"Disable the convenience PIN sign-in. \\n\\nIf this needs to be corrected configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Ink Workspace   >> Set \\\" Allow Windows Ink Workspace\\\" to \\\"Enabled” Set Options ‘On, but disallow access above lock”.\"]\n[283,\"Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Cloud Content >> \\\"Do not suggest third-party content in Windows spotlight\\\" to \\\"Enabled\"]\n[284,\"If the camera is not disconnected or covered, the following registry entry is required.\\n \\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistryPath\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\CapabilityAccessManager\\\\ConsentStore\\\\webcam\\n\\nValue Name: Deny\"]\n[285,\"Set non-persistent VM sessions to not exceed 24 hours.\"]\n[286,\"Ensure the following settings are configured for Windows 10 locally or applied through group policy. \\n\\nConfigure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane \\\"Turn off Preview Pane\\\" to \\\"Enabled\\\".\\n\\nConfigure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane \\\"Turn on or off details pane\\\" to \\\"Enabled\\\" and \\\"Configure details pane\\\" to \\\"Always hide\\\".\"]\n[287,\"For non-domain joined systems, configuring Windows Hello for sign on options would be suggested based on the organizations needs and capabilities.\\n \\nNote: Before applying, the supplemental guidance provided with the STIG should be consulted to ensure continued access to the operating system.\"]\n[288,\"Run the following command to determine which package owns the file:\\n\\n# rpm -qf <filename>\\n\\nReset the user and group ownership of files within a package with the following command:\\n\\n#rpm --setugids <packagename>\\n\\n\\nReset the permissions of files within a package with the following command:\\n\\n#rpm --setperms <packagename>\"]\n[289,\"Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCreate a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command:\\n\\n# touch /etc/dconf/db/local.d/01-banner-message\\n\\nAdd the following line to the [org/gnome/login-screen] section of the \\\"/etc/dconf/db/local.d/01-banner-message\\\":\\n\\n[org/gnome/login-screen]\\nbanner-message-enable=true\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[290,\"Configure the operating system to display the approved Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCreate a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command:\\n\\n# touch /etc/dconf/db/local.d/01-banner-message\\n\\nAdd the following line to the [org/gnome/login-screen] section of the \\\"/etc/dconf/db/local.d/01-banner-message\\\":\\n\\n[org/gnome/login-screen]\\n\\nbanner-message-enable=true\\n\\nbanner-message-text='You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\\\n-At any time, the USG may inspect and seize data stored on this IS.\\\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. '\\n\\nNote: The \\\"\\\\n \\\" characters are for formatting only. They will not be displayed on the GUI.\\n\\nRun the following command to update the database:\\n# dconf update\"]\n[291,\"Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via the command line by editing the \\\"/etc/issue\\\" file.\\n\\nReplace the default text with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is:\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details.\\\"\"]\n[292,\"Configure the operating system to enable a user's session lock until that user re-establishes access using established identification and authentication procedures.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following example:\\n\\n# touch /etc/dconf/db/local.d/00-screensaver\\n\\nEdit the \\\"[org/gnome/desktop/screensaver]\\\" section of the database file and add or update the following lines:\\n\\n# Set this to true to lock the screen when the screensaver activates\\nlock-enabled=true\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[293,\"Configure the operating system to uniquely identify and authenticate users using multifactor authentication via a graphical user logon.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example is using the database local for the system, so if the system is using another database in \\\"/etc/dconf/profile/user\\\", the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/00-defaults\\n\\nEdit \\\"[org/gnome/login-screen]\\\" and add or update the following line:\\nenable-smartcard-authentication=true   \\n\\nUpdate the system databases:\\n# dconf update\"]\n[294,\"Configure the operating system to initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command:\\n\\n# touch /etc/dconf/db/local.d/00-screensaver\\n\\nEdit /etc/dconf/db/local.d/00-screensaver and add or update the following lines:\\n\\n[org/gnome/desktop/session]\\n# Set the lock time out to 900 seconds before the session is considered idle\\nidle-delay=uint32 900\\n\\nYou must include the \\\"uint32\\\" along with the integer key values as shown.\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[295,\"Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example below is using the database \\\"local\\\" for the system, so if the system is using another database in \\\"/etc/dconf/profile/user\\\", the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/locks/session\\n\\nAdd the setting to lock the screensaver lock delay:\\n\\n/org/gnome/desktop/screensaver/lock-delay\"]\n[296,\"Configure the operating system to prevent a user from overriding a session lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example below is using the database \\\"local\\\" for the system, so if the system is using another database in /etc/dconf/profile/user, the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/locks/session\\n\\nAdd the setting to lock the session idle delay:\\n\\n/org/gnome/desktop/session/idle-delay\"]\n[297,\"Install the screen package to allow the initiation of a session lock after a 15-minute period of inactivity.\\n\\nInstall the screen program (if it is not on the system) with the following command:\\n\\n# yum install screen   \\n\\nOR\\n\\nInstall the tmux program (if it is not on the system) with the following command:\\n\\n#yum install tmux\"]\n[298,\"Configure the operating system to initiate a session lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\n# touch /etc/dconf/db/local.d/00-screensaver\\n\\nAdd the setting to enable screensaver locking after 15 minutes of inactivity:\\n\\n[org/gnome/desktop/screensaver]\\n\\nidle-activation-enabled=true\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[299,\"Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example below is using the database \\\"local\\\" for the system, so if the system is using another database in \\\"/etc/dconf/profile/user\\\", the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/locks/session\\n\\nAdd the setting to lock the screensaver idle-activation-enabled setting:\\n\\n/org/gnome/desktop/screensaver/idle-activation-enabled\"]\n[300,\"Configure the operating system to initiate a session lock for graphical user interfaces when a screensaver is activated.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\n# touch /etc/dconf/db/local.d/00-screensaver\\n\\nAdd the setting to enable session locking when a screensaver is activated:\\n\\n[org/gnome/desktop/screensaver]\\nlock-delay=uint32 5\\n\\nThe \\\"uint32\\\" must be included along with the integer key values as shown.\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[301,\"Configure PAM to utilize /etc/pam.d/system-auth when changing passwords.\\n\\nAdd the following line to \\\"/etc/pam.d/passwd\\\" (or modify the line to have the required value):\\n\\npassword     substack    system-auth\"]\n[302,\"Configure the operating system to use \\\"pwquality\\\" to enforce password complexity rules.\\n\\nAdd the following line to \\\"/etc/pam.d/system-auth\\\" (or modify the line to have the required value):\\n\\npassword required pam_pwquality.so retry=3\\n\\nNote: The value of \\\"retry\\\" should be between \\\"1\\\" and \\\"3\\\".\"]\n[303,\"Configure the operating system to enforce password complexity by requiring that at least one upper-case character be used by setting the \\\"ucredit\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" (or modify the line to have the required value):\\n\\nucredit = -1\"]\n[304,\"Configure the system to require at least one lower-case character when creating or changing a password.\\n\\nAdd or modify the following line \\nin \\\"/etc/security/pwquality.conf\\\":\\n\\nlcredit = -1\"]\n[305,\"Configure the operating system to enforce password complexity by requiring that at least one numeric character be used by setting the \\\"dcredit\\\" option.\\n\\nAdd the following line to /etc/security/pwquality.conf (or modify the line to have the required value):\\n\\ndcredit = -1\"]\n[306,\"Configure the operating system to enforce password complexity by requiring that at least one special character be used by setting the \\\"ocredit\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" (or modify the line to have the required value):\\n\\nocredit = -1\"]\n[307,\"Configure the operating system to require the change of at least eight of the total number of characters when passwords are changed by setting the \\\"difok\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" (or modify the line to have the required value):\\n\\ndifok = 8\"]\n[308,\"Configure the operating system to require the change of at least four character classes when passwords are changed by setting the \\\"minclass\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf conf\\\" (or modify the line to have the required value):\\n\\nminclass = 4\"]\n[309,\"Configure the operating system to require the change of the number of repeating consecutive characters when passwords are changed by setting the \\\"maxrepeat\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf conf\\\" (or modify the line to have the required value):\\n\\nmaxrepeat = 3\"]\n[310,\"Configure the operating system to require the change of the number of repeating characters of the same character class when passwords are changed by setting the \\\"maxclassrepeat\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" conf (or modify the line to have the required value):\\n\\nmaxclassrepeat = 4\"]\n[311,\"Configure the operating system to store only SHA512 encrypted representations of passwords.\\n\\nAdd the following line in \\\"/etc/pam.d/system-auth\\\":\\npam_unix.so sha512 shadow try_first_pass use_authtok\\n\\nAdd the following line in \\\"/etc/pam.d/password-auth\\\":\\npam_unix.so sha512 shadow try_first_pass use_authtok\\n\\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[312,\"Configure the operating system to store only SHA512 encrypted representations of passwords.\\n\\nAdd or update the following line in \\\"/etc/login.defs\\\":\\n\\nENCRYPT_METHOD SHA512\"]\n[313,\"Configure the operating system to store only SHA512 encrypted representations of passwords.\\n\\nAdd or update the following line in \\\"/etc/libuser.conf\\\" in the [defaults] section: \\n\\ncrypt_style = sha512\"]\n[314,\"Configure the operating system to enforce 24 hours/1 day as the minimum password lifetime.\\n\\nAdd the following line in \\\"/etc/login.defs\\\" (or modify the line to have the required value):\\n\\nPASS_MIN_DAYS     1\"]\n[315,\"Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime:\\n\\n# chage -m 1 [user]\"]\n[316,\"Configure the operating system to enforce a 60-day maximum password lifetime restriction.\\n\\nAdd the following line in \\\"/etc/login.defs\\\" (or modify the line to have the required value):\\n\\nPASS_MAX_DAYS     60\"]\n[317,\"Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction.\\n\\n# chage -M 60 [user]\"]\n[318,\"Configure the operating system to prohibit password reuse for a minimum of five generations.\\n\\nAdd the following line in \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" (or modify the line to have the required value):\\n\\npassword    requisite     pam_pwhistory.so use_authtok remember=5 retry=3\\n   \\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[319,\"Configure operating system to enforce a minimum 15-character password length.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" (or modify the line to have the required value):\\n\\nminlen = 15\"]\n[320,\"If an account is configured for password authentication but does not have an assigned password, it may be possible to log on to the account without authenticating.\\n\\nRemove any instances of the \\\"nullok\\\" option in \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" to prevent logons with empty passwords.\\n\\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[321,\"To explicitly disallow remote logon from accounts with empty passwords, add or correct the following line in \\\"/etc/ssh/sshd_config\\\":\\n\\nPermitEmptyPasswords no\\n\\nThe SSH service must be restarted for changes to take effect.  Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.\"]\n[322,\"Configure the operating system to disable account identifiers (individuals, groups, roles, and devices) after the password expires.\\n\\nAdd the following line to \\\"/etc/default/useradd\\\" (or modify the line to have the required value):\\n\\nINACTIVE=0\"]\n[323,\"Configure the operating system to lock an account for the maximum period when three unsuccessful logon attempts in 15 minutes are made.\\n\\nModify the first three lines of the auth section and the first line of the account section of the \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" files to match the following lines:\\n\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\nauth sufficient pam_unix.so try_first_pass\\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so   \\n\\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[324,\"Configure the operating system to lock automatically the root account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are made.\\n\\nModify the first three lines of the auth section and the first line of the account section of the \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" files to match the following lines:\\n\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\nauth sufficient pam_unix.so try_first_pass\\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so\\n\\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[325,\"Configure the operating system to require users to supply a password for privilege escalation.\\n\\nCheck the configuration of the \\\"/etc/sudoers\\\" file with the following command:\\n# visudo\\n\\nRemove any occurrences of \\\"NOPASSWD\\\" tags in the file.   \\n\\nCheck the configuration of the /etc/sudoers.d/* files with the following command:\\n# grep -i nopasswd /etc/sudoers.d/*\\n\\nRemove any occurrences of \\\"NOPASSWD\\\" tags in the file.\"]\n[326,\"Configure the operating system to require users to reauthenticate for privilege escalation.\\n\\nCheck the configuration of the \\\"/etc/sudoers\\\" file with the following command:\\n\\n# visudo\\nRemove any occurrences of \\\"!authenticate\\\" tags in the file.\\n\\nCheck the configuration of the \\\"/etc/sudoers.d/*\\\" files with the following command:\\n\\n# grep -i authenticate /etc/sudoers /etc/sudoers.d/*\\nRemove any occurrences of \\\"!authenticate\\\" tags in the file(s).\"]\n[327,\"Configure the operating system to enforce a delay of at least four seconds between logon prompts following a failed console logon attempt.\\n\\nModify the \\\"/etc/login.defs\\\" file to set the \\\"FAIL_DELAY\\\" parameter to \\\"4\\\" or greater:\\n\\nFAIL_DELAY 4\"]\n[328,\"Configure the operating system to not allow an unattended or automatic logon to the system via a graphical user interface.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nAdd or edit the line for the \\\"AutomaticLoginEnable\\\" parameter in the [daemon] section of the \\\"/etc/gdm/custom.conf\\\" file to \\\"false\\\":\\n\\n[daemon]\\nAutomaticLoginEnable=false\"]\n[329,\"Configure the operating system to not allow an unrestricted account to log on to the system via a graphical user interface.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nAdd or edit the line for the \\\"TimedLoginEnable\\\" parameter in the [daemon] section of the \\\"/etc/gdm/custom.conf\\\" file to \\\"false\\\":\\n\\n[daemon]\\nTimedLoginEnable=false\"]\n[330,\"Configure the operating system to not allow users to override environment variables to the SSH daemon.\\n\\nEdit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for \\\"PermitUserEnvironment\\\" keyword and set the value to \\\"no\\\":\\n\\nPermitUserEnvironment no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[331,\"Configure the operating system to not allow a non-certificate trusted host SSH logon to the system.\\n\\nEdit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for \\\"HostbasedAuthentication\\\" keyword and set the value to \\\"no\\\":\\n\\nHostbasedAuthentication no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[332,\"Configure the system to encrypt the boot password for root.\\n\\nGenerate an encrypted grub2 password for root with the following command:\\n\\nNote: The hash generated is an example.\\n\\n# grub2-mkpasswd-pbkdf2\\n\\nEnter Password:\\nReenter Password:\\nPBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45\\n\\nEdit \\\"/etc/grub.d/40_custom\\\" and add the following lines below the comments:\\n\\n# vi /etc/grub.d/40_custom\\n\\nset superusers=\\\"root\\\"\\n\\npassword_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command}\\n\\nGenerate a new \\\"grub.conf\\\" file with the new password with the following commands:\\n\\n# grub2-mkconfig --output=/tmp/grub2.cfg\\n# mv /tmp/grub2.cfg /boot/grub2/grub.cfg\"]\n[333,\"Configure the operating system to require authentication upon booting into single-user and maintenance modes.\\n\\nAdd or modify the \\\"ExecStart\\\" line in \\\"/usr/lib/systemd/system/rescue.service\\\" to include \\\"/usr/sbin/sulogin\\\":\\n\\nExecStart=-/bin/sh -c \\\"/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default\\\"\"]\n[334,\"Configure the system to encrypt the boot password for root.\\n\\nGenerate an encrypted grub2 password for root with the following command:\\n\\nNote: The hash generated is an example.\\n  \\n# grub2-setpassword\\nEnter password:\\nConfirm password:\\n\\nEdit the /boot/grub2/grub.cfg file and add or modify the following lines in the \\\"### BEGIN /etc/grub.d/01_users ###\\\" section:\\n\\nset superusers=\\\"root\\\"\\nexport superusers\"]\n[335,\"Configure the system to encrypt the boot password for root.\\n\\nGenerate an encrypted grub2 password for root with the following command:\\n\\nNote: The hash generated is an example.\\n\\n# grub2-mkpasswd-pbkdf2\\n\\nEnter Password:\\nReenter Password:\\nPBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45\\n\\nEdit \\\"/etc/grub.d/40_custom\\\" and add the following lines below the comments:\\n\\n# vi /etc/grub.d/40_custom\\n\\nset superusers=\\\"root\\\"\\n\\npassword_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command}\\n\\nGenerate a new \\\"grub.conf\\\" file with the new password with the following commands:\\n\\n# grub2-mkconfig --output=/tmp/grub2.cfg\\n# mv /tmp/grub2.cfg /boot/efi/EFI/redhat/grub.cfg\"]\n[336,\"Configure the system to encrypt the boot password for root.\\n\\nGenerate an encrypted grub2 password for root with the following command:\\n\\nNote: The hash generated is an example.\\n  \\n# grub2-setpassword\\nEnter password:\\nConfirm password:\\n\\nEdit the /boot/efi/EFI/redhat/grub.cfg file and add or modify the following lines in the \\\"### BEGIN /etc/grub.d/01_users ###\\\" section:\\n\\nset superusers=\\\"root\\\"\\nexport superusers\"]\n[337,\"Configure the operating system to require individuals to be authenticated with a multifactor authenticator.\\n\\nEnable smartcard logons with the following commands:\\n\\n# authconfig --enablesmartcard --smartcardaction=0 --update\\n# authconfig --enablerequiresmartcard -update\\n\\nModify the \\\"/etc/pam_pkcs11/pkcs11_eventmgr.conf\\\" file to uncomment the following line:\\n\\n#/usr/X11R6/bin/xscreensaver-command -lock\\n\\nModify the \\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" file to use the cackey module if required.\"]\n[338,\"Configure the operating system to disable non-essential capabilities by removing the rsh-server package from the system with the following command:\\n\\n# yum remove rsh-server\"]\n[339,\"Configure the operating system to disable non-essential capabilities by removing the \\\"ypserv\\\" package from the system with the following command:\\n\\n# yum remove ypserv\"]\n[340,\"Configure the operating system to prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.\\n\\nUse the following command to map a new user to the \\\"sysdam_u\\\" role: \\n\\n#semanage login -a -s sysadm_u <username>\\n\\nUse the following command to map an existing user to the \\\"sysdam_u\\\" role:\\n\\n#semanage login -m -s sysadm_u <username>\\n\\nUse the following command to map a new user to the \\\"staff_u\\\" role:\\n\\n#semanage login -a -s staff_u <username>\\n\\nUse the following command to map an existing user to the \\\"staff_u\\\" role:\\n\\n#semanage login -m -s staff_u <username>\\n\\nUse the following command to map a new user to the \\\"user_u\\\" role:\\n\\n# semanage login -a -s user_u <username>\\n\\nUse the following command to map an existing user to the \\\"user_u\\\" role:\\n\\n# semanage login -m -s user_u <username>\"]\n[341,\"Configure the file integrity tool to run automatically on the system at least weekly. The following example output is generic. It will set cron to run AIDE daily, but other file integrity tools may be used:  \\n\\n# more /etc/cron.daily/aide\\n#!/bin/bash\\n\\n/usr/sbin/aide --check | /bin/mail -s \\\"$HOSTNAME - Daily aide integrity check run\\\" root@sysname.mil\"]\n[342,\"Configure the operating system to notify designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system. \\n\\nThe following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis. \\n\\n# more /etc/cron.daily/aide\\n\\n/usr/sbin/aide --check | /bin/mail -s \\\"$HOSTNAME - Daily aide integrity check run\\\" root@sysname.mil\"]\n[343,\"Configure the operating system to verify the signature of packages from a repository prior to install by setting the following option in the \\\"/etc/yum.conf\\\" file:\\n\\ngpgcheck=1\"]\n[344,\"Configure the operating system to verify the signature of local packages prior to install by setting the following option in the \\\"/etc/yum.conf\\\" file:\\n\\nlocalpkg_gpgcheck=1\"]\n[345,\"Configure the operating system to disable the ability to use the USB Storage kernel module.\\n\\nCreate a file under \\\"/etc/modprobe.d\\\" with the following command:\\n\\n# touch /etc/modprobe.d/usb-storage.conf\\n\\nAdd the following line to the created file:\\n\\ninstall usb-storage /bin/true\\n\\nConfigure the operating system to disable the ability to use USB mass storage devices.\\n\\n# vi /etc/modprobe.d/blacklist.conf\\n\\nAdd or update the line:\\n\\nblacklist usb-storage\"]\n[346,\"Configure the operating system to disable the ability to use the DCCP kernel module.\\n\\nCreate a file under \\\"/etc/modprobe.d\\\" with the following command:\\n\\n# touch /etc/modprobe.d/dccp.conf\\n\\nAdd the following line to the created file:\\n\\ninstall dccp /bin/true\\n\\nEnsure that the DCCP module is blacklisted: \\n\\n# vi /etc/modprobe.d/blacklist.conf\\n\\nAdd or update the line:\\n\\nblacklist dccp\"]\n[347,\"Configure the operating system to disable the ability to automount devices.\\n\\nTurn off the automount service with the following commands:\\n\\n# systemctl stop autofs\\n# systemctl disable autofs\\n\\nIf \\\"autofs\\\" is required for Network File System (NFS), it must be documented with the ISSO.\"]\n[348,\"Configure the operating system to remove all software components after updated versions have been installed.\\n\\nSet the \\\"clean_requirements_on_remove\\\" option to \\\"1\\\" in the \\\"/etc/yum.conf\\\" file:\\n\\nclean_requirements_on_remove=1\"]\n[349,\"Configure the operating system to verify correct operation of all security functions.\\n\\nSet the \\\"SELinux\\\" status and the \\\"Enforcing\\\" mode by modifying the \\\"/etc/selinux/config\\\" file to have the following line:\\n\\nSELINUX=enforcing\\n\\nA reboot is required for the changes to take effect.\"]\n[350,\"Configure the operating system to verify correct operation of all security functions.\\n\\nSet the \\\"SELinuxtype\\\" to the \\\"targeted\\\" policy by modifying the \\\"/etc/selinux/config\\\" file to have the following line:\\n\\nSELINUXTYPE=targeted\\n\\nA reboot is required for the changes to take effect.\"]\n[351,\"Configure the system to disable the Ctrl-Alt-Delete sequence for the command line with the following command:\\n\\n# systemctl mask ctrl-alt-del.target\"]\n[352,\"Configure the system to disable the Ctrl-Alt-Delete sequence for the GUI with the following command:\\n\\n# touch /etc/dconf/db/local.d/00-disable-CAD \\n\\nAdd the setting to disable the Ctrl-Alt-Delete sequence for GNOME:\\n\\n[org/gnome/settings-daemon/plugins/media-keys]\\nlogout=''\"]\n[353,\"Configure the operating system to define default permissions for all authenticated users in such a way that the user can only read and modify their own files.\\n\\nAdd or edit the line for the \\\"UMASK\\\" parameter in \\\"/etc/login.defs\\\" file to \\\"077\\\":\\n\\nUMASK  077\"]\n[354,\"Upgrade to a supported version of the operating system.\"]\n[355,\"Install the operating system patches or updated packages available from Red Hat within 30 days or sooner as local policy dictates.\"]\n[356,\"Configure the system so all accounts on the system are assigned to an active system, application, or user account. \\n\\nRemove accounts that do not support approved system activities or that allow for a normal user to perform administrative-level actions. \\n\\nDocument all authorized accounts on the system.\"]\n[357,\"Configure the system to define all GIDs found in the \\\"/etc/passwd\\\" file by modifying the \\\"/etc/group\\\" file to add any non-existent group referenced in the \\\"/etc/passwd\\\" file, or change the GIDs referenced in the \\\"/etc/passwd\\\" file to a group that exists in \\\"/etc/group\\\".\"]\n[358,\"Change the UID of any account on the system, other than root, that has a UID of \\\"0\\\". \\n\\nIf the account is associated with system commands or applications, the UID should be changed to one greater than \\\"0\\\" but less than \\\"1000\\\". Otherwise, assign a UID of greater than \\\"1000\\\" that has not already been assigned.\"]\n[359,\"Either remove all files and directories from the system that do not have a valid user, or assign a valid user to all unowned files and directories on the system with the \\\"chown\\\" command:\\n\\n# chown <user> <file>\"]\n[360,\"Either remove all files and directories from the system that do not have a valid group, or assign a valid group to all files and directories on the system with the \\\"chgrp\\\" command:\\n\\n# chgrp <group> <file>\"]\n[361,\"Assign home directories to all local interactive users that currently do not have a home directory assigned.\"]\n[362,\"Configure the operating system to assign home directories to all new local interactive users by setting the \\\"CREATE_HOME\\\" parameter in \\\"/etc/login.defs\\\" to \\\"yes\\\" as follows.\\n\\nCREATE_HOME yes\"]\n[363,\"Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in \\\"/etc/ passwd\\\":\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\", a UID of \\\"smithj\\\", and a Group Identifier (GID) of \\\"users\\\" assigned in \\\"/etc/passwd\\\".\\n\\n# mkdir /home/smithj \\n# chown smithj /home/smithj\\n# chgrp users /home/smithj\\n# chmod 0750 /home/smithj\"]\n[364,\"Change the mode of interactive user's home directories to \\\"0750\\\". To change the mode of a local interactive user's home directory, use the following command:\\n\\nNote: The example will be for the user \\\"smithj\\\".\\n\\n# chmod 0750 /home/smithj\"]\n[365,\"Change the owner of a local interactive user's home directories to that owner. To change the owner of a local interactive user's home directory, use the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\".\\n\\n# chown smithj /home/smithj\"]\n[366,\"Change the group owner of a local interactive user's home directory to the group found in \\\"/etc/passwd\\\". To change the group owner of a local interactive user's home directory, use the following command:\\n\\nNote: The example will be for the user \\\"smithj\\\", who has a home directory of \\\"/home/smithj\\\", and has a primary group of users.\\n\\n# chgrp users /home/smithj\"]\n[367,\"Change the owner of a local interactive user's files and directories to that owner. To change the owner of a local interactive user's files and directories, use the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\".\\n\\n# chown smithj /home/smithj/<file or directory>\"]\n[368,\"Change the group of a local interactive user's files and directories to a group that the interactive user is a member of. To change the group owner of a local interactive user's files and directories, use the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\" and is a member of the users group.\\n\\n# chgrp users /home/smithj/<file>\"]\n[369,\"Set the mode on files and directories in the local interactive user home directory with the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\" and is a member of the users group.\\n\\n# chmod 0750 /home/smithj/<file>\"]\n[370,\"Set the owner of the local initialization files for interactive users to either the directory owner or root with the following command:\\n\\nNote: The example will be for the smithj user, who has a home directory of \\\"/home/smithj\\\".\\n\\n# chown smithj /home/smithj/.[^.]*\"]\n[371,\"Change the group owner of a local interactive user's files to the group found in \\\"/etc/passwd\\\" for the user. To change the group owner of a local interactive user's home directory, use the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\", and has a primary group of users.\\n\\n# chgrp users /home/smithj/.[^.]*\"]\n[372,\"Set the mode of the local initialization files to \\\"0740\\\" with the following command:\\n\\nNote: The example will be for the \\\"smithj\\\" user, who has a home directory of \\\"/home/smithj\\\".\\n\\n# chmod 0740 /home/smithj/.[^.]*\"]\n[373,\"Edit the local interactive user initialization files to change any PATH variable statements that reference directories other than their home directory. \\n\\nIf a local interactive user requires path variables to reference a directory owned by the application, it must be documented with the ISSO.\"]\n[374,\"Set the mode on files being executed by the local initialization files with the following command:\\n\\n# chmod 0755 <file>\"]\n[375,\"Run the following command to determine which package owns the device file:\\n\\n# rpm -qf <filename>\\n\\nThe package can be reinstalled from a yum repository using the command:\\n\\n# sudo yum reinstall <packagename>\\n\\nAlternatively, the package can be reinstalled from trusted media using the command:\\n\\n# sudo rpm -Uvh <packagename>\"]\n[376,\"Configure the \\\"/etc/fstab\\\" to use the \\\"nosuid\\\" option on file systems that contain user home directories.\"]\n[377,\"Configure the \\\"/etc/fstab\\\" to use the \\\"nosuid\\\" option on file systems that are associated with removable media.\"]\n[378,\"Configure the \\\"/etc/fstab\\\" to use the \\\"nosuid\\\" option on file systems that are being imported via NFS.\"]\n[379,\"Configure the \\\"/etc/fstab\\\" to use the \\\"noexec\\\" option on file systems that are being imported via NFS.\"]\n[380,\"Configure the system so that /dev/shm is mounted with the \\\"nodev\\\" option.\"]\n[381,\"Configure the system so that /dev/shm is mounted with the \\\"nosuid\\\" option.\"]\n[382,\"Configure the system so that /dev/shm is mounted with the \\\"noexec\\\" option.\"]\n[383,\"Change the group of the world-writable directories to root with the following command:\\n\\n# chgrp root <directory>\"]\n[384,\"Remove the umask statement from all local interactive user's initialization files. \\n\\nIf the account is for an application, the requirement for a umask less restrictive than \\\"077\\\" can be documented with the Information System Security Officer, but the user agreement for access to the account must specify that the local interactive user must log on to their account first and then switch the user to the application account with the correct option to gain the account's environment variables.\"]\n[385,\"Configure \\\"rsyslog\\\" to log all cron messages by adding or updating the following line to \\\"/etc/rsyslog.conf\\\" or a configuration file in the /etc/rsyslog.d/ directory:\\n\\ncron.* /var/log/cron.log\"]\n[386,\"Set the owner on the \\\"/etc/cron.allow\\\" file to root with the following command:\\n\\n# chown root /etc/cron.allow\"]\n[387,\"Set the group owner on the \\\"/etc/cron.allow\\\" file to root with the following command:\\n\\n# chgrp root /etc/cron.allow\"]\n[388,\"If kernel core dumps are not required, disable the \\\"kdump\\\" service with the following command:\\n\\n# systemctl disable kdump.service\\n\\nIf kernel core dumps are required, document the need with the ISSO.\"]\n[389,\"Migrate the \\\"/home\\\" directory onto a separate file system/partition.\"]\n[390,\"Migrate the \\\"/var\\\" path onto a separate file system.\"]\n[391,\"Migrate the system audit data path onto a separate file system.\"]\n[392,\"Start the \\\"tmp.mount\\\" service with the following command:\\n\\n# systemctl enable tmp.mount\\n   \\nOR\\n\\nEdit the \\\"/etc/fstab\\\" file and ensure the \\\"/tmp\\\" directory is defined in the fstab with a device and mount point.\"]\n[393,\"Configure the operating system to implement DoD-approved encryption by installing the dracut-fips package.\\n\\nTo enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel command line during system installation so key generation is done with FIPS-approved algorithms and continuous monitoring tests in place.\\n\\nConfigure the operating system to implement DoD-approved encryption by following the steps below: \\n\\nThe fips=1 kernel option needs to be added to the kernel command line during system installation so that key generation is done with FIPS-approved algorithms and continuous monitoring tests in place. Users should also ensure that the system has plenty of entropy during the installation process by moving the mouse around, or if no mouse is available, ensuring that many keystrokes are typed. The recommended amount of keystrokes is 256 and more. Less than 256 keystrokes may generate a non-unique key.\\n\\nInstall the dracut-fips package with the following command:\\n\\n# yum install dracut-fips\\n\\nRecreate the \\\"initramfs\\\" file with the following command:\\n\\nNote: This command will overwrite the existing \\\"initramfs\\\" file.\\n\\n# dracut -f\\n\\nModify the kernel command line of the current kernel in the \\\"grub.cfg\\\" file by adding the following option to the GRUB_CMDLINE_LINUX key in the \\\"/etc/default/grub\\\" file and then rebuild the \\\"grub.cfg\\\" file:\\n\\nfips=1\\n\\nChanges to \\\"/etc/default/grub\\\" require rebuilding the \\\"grub.cfg\\\" file as follows:\\n\\nOn BIOS-based machines, use the following command:\\n\\n# grub2-mkconfig -o /boot/grub2/grub.cfg\\n\\nOn UEFI-based machines, use the following command:\\n\\n# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg\\n\\nIf /boot or /boot/efi reside on separate partitions, the kernel parameter boot=<partition of /boot or /boot/efi> must be added to the kernel command line. You can identify a partition by running the df /boot or df /boot/efi command:\\n\\n# df /boot\\nFilesystem 1K-blocks Used Available Use% Mounted on\\n/dev/sda1 495844 53780 416464 12% /boot\\n\\nTo ensure the \\\"boot=\\\" configuration option will work even if device naming changes occur between boots, identify the universally unique identifier (UUID) of the partition with the following command:\\n\\n# blkid /dev/sda1\\n/dev/sda1: UUID=\\\"05c000f1-a213-759e-c7a2-f11b7424c797\\\" TYPE=\\\"ext4\\\"\\n\\nFor the example above, append the following string to the kernel command line:\\n\\nboot=UUID=05c000f1-a213-759e-c7a2-f11b7424c797\\n\\nReboot the system for the changes to take effect.\"]\n[394,\"Configure the file integrity tool to check file and directory ACLs. \\n\\nIf AIDE is installed, ensure the \\\"acl\\\" rule is present on all uncommented file and directory selection lists.\"]\n[395,\"Configure the file integrity tool to check file and directory extended attributes. \\n\\nIf AIDE is installed, ensure the \\\"xattrs\\\" rule is present on all uncommented file and directory selection lists.\"]\n[396,\"Configure the file integrity tool to use FIPS 140-2 cryptographic hashes for validating file and directory contents. \\n\\nIf AIDE is installed, ensure the \\\"sha512\\\" rule is present on all uncommented file and directory selection lists.\"]\n[397,\"Remove alternate methods of booting the system from removable media or document the configuration to boot from removable media with the ISSO.\"]\n[398,\"Configure the operating system to disable non-essential capabilities by removing the telnet-server package from the system with the following command:\\n\\n# yum remove telnet-server\"]\n[399,\"Configure the operating system to produce audit records containing information to establish when (date and time) the events occurred.\\n\\nEnable the auditd service with the following command:\\n\\n# systemctl start auditd.service\"]\n[400,\"Configure the operating system to shut down in the event of an audit processing failure.\\n\\nAdd or correct the option to shut down the operating system with the following command:\\n\\n# auditctl -f 2\\n\\nEdit the \\\"/etc/audit/rules.d/audit.rules\\\" file and add the following line:\\n\\n-f 2\\n\\nIf availability has been determined to be more important, and this decision is documented with the ISSO, configure the operating system to notify system administration staff and ISSO staff in the event of an audit processing failure with the following command:\\n\\n# auditctl -f 1\\n\\nEdit the \\\"/etc/audit/rules.d/audit.rules\\\" file and add the following line:\\n\\n-f 1\\n\\nKernel log monitoring must also be configured to properly alert designated staff.\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[401,\"Edit the /etc/audisp/plugins.d/au-remote.conf file and change the value of \\\"active\\\" to \\\"yes\\\".\\n\\nThe audit daemon must be restarted for changes to take effect:\\n\\n# service auditd restart\"]\n[402,\"Edit the /etc/audisp/plugins.d/au-remote.conf file and add or update the following values:\\n\\ndirection = out\\npath = /sbin/audisp-remote\\ntype = always\\n\\nThe audit daemon must be restarted for changes to take effect:\\n\\n# service auditd restart\"]\n[403,\"Edit the /etc/audisp/audispd.conf file and add or update the \\\"overflow_action\\\" option:\\n\\noverflow_action = syslog\\n\\nThe audit daemon must be restarted for changes to take effect:\\n\\n# service auditd restart\"]\n[404,\"Edit the /etc/audisp/audispd.conf file and add or update the \\\"name_format\\\" option:\\n\\nname_format = hostname\\n\\nThe audit daemon must be restarted for changes to take effect:\\n\\n# service auditd restart\"]\n[405,\"Configure the operating system to off-load audit records onto a different system or media from the system being audited.\\n\\nSet the remote server option in \\\"/etc/audisp/audisp-remote.conf\\\" with the IP address of the log aggregation server.\"]\n[406,\"Configure the operating system to encrypt the transfer of off-loaded audit records onto a different system or media from the system being audited.\\n\\nUncomment the \\\"enable_krb5\\\" option in \\\"/etc/audisp/audisp-remote.conf\\\" and set it with the following line:\\n\\nenable_krb5 = yes\"]\n[407,\"Configure the action the operating system takes if the disk the audit records are written to becomes full.\\n\\nUncomment or edit the \\\"disk_full_action\\\" option in \\\"/etc/audisp/audisp-remote.conf\\\" and set it to \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\", such as the following line:\\n\\ndisk_full_action = single\"]\n[408,\"Configure the action the operating system takes if there is an error sending audit records to a remote system.\\n\\nUncomment the \\\"network_failure_action\\\" option in \\\"/etc/audisp/audisp-remote.conf\\\" and set it to \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\".\\n\\nnetwork_failure_action = syslog\"]\n[409,\"Configure the operating system to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\\n\\nCheck the system configuration to determine the partition the audit records are being written to: \\n\\n# grep -iw log_file /etc/audit/auditd.conf\\n\\nDetermine the size of the partition that audit records are written to (with the example being \\\"/var/log/audit/\\\"):\\n\\n# df -h /var/log/audit/\\n\\nSet the value of the \\\"space_left\\\" keyword in \\\"/etc/audit/auditd.conf\\\" to 25 percent of the partition size.\"]\n[410,\"Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached.\\n\\nUncomment or edit the \\\"space_left_action\\\" keyword in \\\"/etc/audit/auditd.conf\\\" and set it to \\\"email\\\". \\n \\nspace_left_action = email\"]\n[411,\"Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached.\\n\\nUncomment or edit the \\\"action_mail_acct\\\" keyword in \\\"/etc/audit/auditd.conf\\\" and set it to root and any other accounts associated with security personnel. \\n \\naction_mail_acct = root\"]\n[412,\"Configure the operating system to audit the execution of privileged functions.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid\\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid\\n-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid\\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[413,\"Add or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[414,\"Add or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[415,\"Add or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[416,\"Add or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[417,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"chmod\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[418,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"fchmod\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[419,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"fchmodat\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[420,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"setxattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[421,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"fsetxattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[422,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"lsetxattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[423,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"removexattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[424,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"fremovexattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[425,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"lremovexattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[426,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"creat\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules:\\n\\n-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[427,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"open\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[428,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"openat\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[429,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"open_by_handle_at\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[430,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"truncate\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[431,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"ftruncate\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[432,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"semanage\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[433,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"setsebool\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[434,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"chcon\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[435,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"setfiles\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[436,\"Configure the operating system to generate audit records when unsuccessful account access events occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-w /var/run/faillock -p wa -k logins\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[437,\"Configure the operating system to generate audit records when successful account access events occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-w /var/log/lastlog -p wa -k logins\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[438,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"passwd\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[439,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"unix_chkpwd\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[440,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"gpasswd\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[441,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"chage\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[442,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"userhelper\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[443,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"su\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change \\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[444,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"sudo\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change \\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[445,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to access the \\\"/etc/sudoers\\\" file and files in the \\\"/etc/sudoers.d/\\\" directory.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/sudoers -p wa -k privileged-actions\\n\\n-w /etc/sudoers.d/ -p wa -k privileged-actions\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[446,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"newgrp\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[447,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"chsh\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[448,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"mount\\\" command and syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n-a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[449,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"umount\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[450,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"postdrop\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=4294967295 -k privileged-postfix\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[451,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"postqueue\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=4294967295 -k privileged-postfix\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[452,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"ssh-keysign\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=4294967295 -k privileged-ssh\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[453,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"crontab\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=4294967295 -k privileged-cron\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[454,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"pam_timestamp_check\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F auid>=1000 -F auid!=4294967295 -k privileged-pam\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[455,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"create_module\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S create_module -k module-change\\n\\n-a always,exit -F arch=b64 -S create_module -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[456,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"init_module\\\" syscall occur. \\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S init_module -k module-change\\n\\n-a always,exit -F arch=b64 -S init_module -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[457,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"finit_module\\\" syscall occur. \\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F arch=b32 -S finit_module -k module-change\\n\\n-a always,exit -F arch=b64 -S finit_module -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[458,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"delete_module\\\" syscall occur. \\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F arch=b32 -S delete_module -k module-change\\n\\n-a always,exit -F arch=b64 -S delete_module -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[459,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"kmod\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /usr/bin/kmod -p x -F auid!=4294967295 -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[460,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/passwd\\\".\\n\\nAdd or update the following rule \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/passwd -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[461,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/group\\\".\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/group -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[462,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/gshadow\\\".\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/gshadow -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[463,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.\\n\\nAdd or update the following file system rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/shadow -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[464,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.\\n\\nAdd or update the following file system rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/security/opasswd -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect:\\n# systemctl restart auditd\"]\n[465,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"rename\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[466,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"renameat\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[467,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"rmdir\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[468,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"unlink\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[469,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"unlinkat\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[470,\"Modify the \\\"/etc/rsyslog.conf\\\" or an \\\"/etc/rsyslog.d/*.conf\\\" file to contain a configuration line to send all \\\"rsyslog\\\" output to a log aggregation system:\\n*.* @@<log aggregation system name>\"]\n[471,\"Modify the \\\"/etc/rsyslog.conf\\\" file to remove the \\\"ModLoad imtcp\\\", \\\"ModLoad imudp\\\", and \\\"ModLoad imrelp\\\" configuration lines, or document the system as being used for log aggregation.\"]\n[472,\"Configure the operating system to limit the number of concurrent sessions to \\\"10\\\" for all accounts and/or account types.\\n\\nAdd the following line to the top of the /etc/security/limits.conf or in a \\\".conf\\\" file defined in /etc/security/limits.d/ :\\n\\n* hard maxlogins 10\"]\n[473,\"Update the host's firewall settings and/or running services to comply with the PPSM CLSA for the site or program and the PPSM CAL.\"]\n[474,\"Configure SSH to use FIPS 140-2 approved cryptographic algorithms.\\n\\nAdd the following line (or modify the line to have the required value) to the \\\"/etc/ssh/sshd_config\\\" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor).\\n\\nCiphers aes128-ctr,aes192-ctr,aes256-ctr\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[475,\"Configure the operating system to terminate all network connections associated with a communications session at the end of the session or after a period of inactivity.\\n\\nCreate a script to enforce the inactivity timeout (for example /etc/profile.d/tmout.sh) such as:\\n\\n#!/bin/bash\\n\\nTMOUT=600\\nreadonly TMOUT\\nexport TMOUT\"]\n[476,\"Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via the ssh.\\n\\nEdit the \\\"/etc/ssh/sshd_config\\\" file to uncomment the banner keyword and configure it to point to a file that will contain the logon banner (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). An example configuration line is:\\n\\nbanner /etc/issue\\n\\nEither create the file containing the banner or replace the text in the file with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n \\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[477,\"Configure the operating system to implement cryptography to protect the integrity of LDAP authentication sessions.\\n\\nAdd or modify the following line in \\\"/etc/sssd/sssd.conf\\\":\\n\\nldap_id_use_start_tls = true\"]\n[478,\"Configure the operating system to implement cryptography to protect the integrity of LDAP remote access sessions.\\n\\nAdd or modify the following line in \\\"/etc/sssd/sssd.conf\\\":\\n\\nldap_tls_reqcert = demand\"]\n[479,\"Configure the operating system to implement cryptography to protect the integrity of LDAP remote access sessions.\\n\\nAdd or modify the following line in \\\"/etc/sssd/sssd.conf\\\":\\n\\nldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt\"]\n[480,\"Configure the operating system implement virtual address space randomization.\\n\\nSet the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a config file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nkernel.randomize_va_space = 2\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[481,\"Install SSH packages onto the host with the following commands:\\n\\n# yum install openssh-server.x86_64\"]\n[482,\"Configure the SSH service to automatically start after reboot with the following command:\\n\\n# systemctl enable sshd.service\"]\n[483,\"Configure the operating system to automatically terminate a user session after inactivity time-outs have expired or at shutdown.\\n\\nAdd the following line (or modify the line to have the required value) to the \\\"/etc/ssh/sshd_config\\\" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nClientAliveInterval 600\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[484,\"Configure the SSH daemon to not allow authentication using RSA rhosts authentication.\\n\\nAdd the following line in \\\"/etc/ssh/sshd_config\\\", or uncomment the line and set the value to \\\"no\\\":\\n\\nRhostsRSAAuthentication no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[485,\"Configure the operating system to terminate automatically a user session after inactivity time-outs have expired or at shutdown.\\n\\nAdd the following line (or modify the line to have the required value) to the \\\"/etc/ssh/sshd_config\\\" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nClientAliveCountMax 0\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[486,\"Configure the SSH daemon to not allow authentication using known hosts authentication.\\n\\nAdd the following line in \\\"/etc/ssh/sshd_config\\\", or uncomment the line and set the value to \\\"yes\\\":\\n\\nIgnoreRhosts yes\"]\n[487,\"Configure SSH to provide users with feedback on when account accesses last occurred by setting the required configuration options in \\\"/etc/pam.d/sshd\\\" or in the \\\"sshd_config\\\" file used by the system (\\\"/etc/ssh/sshd_config\\\" will be used in the example) (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor).\\n\\nModify the \\\"PrintLastLog\\\" line in \\\"/etc/ssh/sshd_config\\\" to match the following:\\n\\nPrintLastLog yes\\n\\nThe SSH service must be restarted for changes to \\\"sshd_config\\\" to take effect.\"]\n[488,\"Configure SSH to stop users from logging on remotely as the root user.\\n\\nEdit the appropriate  \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for the \\\"PermitRootLogin\\\" keyword and set its value to \\\"no\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nPermitRootLogin no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[489,\"Configure the SSH daemon to not allow authentication using known hosts authentication.\\n\\nAdd the following line in \\\"/etc/ssh/sshd_config\\\", or uncomment the line and set the value to \\\"yes\\\":\\n\\nIgnoreUserKnownHosts yes\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[490,\"Remove all Protocol lines that reference version \\\"1\\\" in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). The \\\"Protocol\\\" line must be as follows:\\n\\nProtocol 2\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[491,\"Edit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for the \\\"MACs\\\" keyword and set its value to \\\"hmac-sha2-256\\\" and/or \\\"hmac-sha2-512\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nMACs hmac-sha2-256,hmac-sha2-512\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[492,\"Note: SSH public key files may be found in other directories on the system depending on the installation. \\n\\nChange the mode of public host key files under \\\"/etc/ssh\\\" to \\\"0644\\\" with the following command:\\n\\n# chmod 0644 /etc/ssh/*.key.pub\"]\n[493,\"Configure the mode of SSH private host key files under \\\"/etc/ssh\\\" to \\\"0640\\\" with the following command:\\n\\n# chmod 0640 /path/to/file/ssh_host*key\"]\n[494,\"Uncomment the \\\"GSSAPIAuthentication\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \\\"no\\\": \\n\\nGSSAPIAuthentication no\\n\\nThe SSH service must be restarted for changes to take effect.\\n\\nIf GSSAPI authentication is required, it must be documented, to include the location of the configuration file, with the ISSO.\"]\n[495,\"Uncomment the \\\"KerberosAuthentication\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \\\"no\\\":\\n\\nKerberosAuthentication no\\n\\nThe SSH service must be restarted for changes to take effect.\\n\\nIf Kerberos authentication is required, it must be documented, to include the location of the configuration file, with the ISSO.\"]\n[496,\"Uncomment the \\\"StrictModes\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \\\"yes\\\":\\n\\nStrictModes yes\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[497,\"Uncomment the \\\"UsePrivilegeSeparation\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \\\"sandbox\\\" or \\\"yes\\\":\\n\\nUsePrivilegeSeparation sandbox\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[498,\"Uncomment the \\\"Compression\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) on the system and set the value to \\\"delayed\\\" or \\\"no\\\":\\n\\nCompression no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[499,\"Edit the \\\"/etc/ntp.conf\\\" or \\\"/etc/chrony.conf\\\" file and add or update an entry to define \\\"maxpoll\\\" to \\\"10\\\" as follows:\\n\\nserver 0.rhel.pool.ntp.org iburst maxpoll 10\\n\\nIf NTP was running and \\\"maxpoll\\\" was updated, the NTP service must be restarted:\\n\\n# systemctl restart ntpd\\n\\nIf NTP was not running, it must be started:\\n\\n# systemctl start ntpd \\n\\nIf \\\"chronyd\\\" was running and \\\"maxpoll\\\" was updated, the service must be restarted:\\n\\n# systemctl restart chronyd.service\\n\\nIf \\\"chronyd\\\" was not running, it must be started:\\n\\n# systemctl start chronyd.service\"]\n[500,\"Ensure the operating system's application firewall is enabled.\\n\\nInstall the \\\"firewalld\\\" package, if it is not on the system, with the following command:\\n\\n# yum install firewalld\\n\\nStart the firewall via \\\"systemctl\\\" with the following command:\\n\\n# systemctl start firewalld\"]\n[501,\"Configure the operating system to provide users with feedback on when account accesses last occurred by setting the required configuration options in \\\"/etc/pam.d/postlogin\\\". \\n\\nAdd the following line to the top of \\\"/etc/pam.d/postlogin\\\":\\n\\nsession required pam_lastlog.so showfailed\"]\n[502,\"Remove any found \\\".shosts\\\" files from the system.\\n\\n# rm /[path]/[to]/[file]/.shosts\"]\n[503,\"Remove any found \\\"shosts.equiv\\\" files from the system.\\n\\n# rm /[path]/[to]/[file]/shosts.equiv\"]\n[504,\"Configure the operating system to use two or more name servers for DNS resolution.\\n\\nEdit the \\\"/etc/resolv.conf\\\" file to uncomment or add the two or more \\\"nameserver\\\" option lines with the IP address of local authoritative name servers. If local host resolution is being performed, the \\\"/etc/resolv.conf\\\" file must be empty. An empty \\\"/etc/resolv.conf\\\" file can be created as follows:\\n\\n# echo -n > /etc/resolv.conf\\n\\nAnd then make the file immutable with the following command:\\n\\n# chattr +i /etc/resolv.conf\\n\\nIf the \\\"/etc/resolv.conf\\\" file must be mutable, the required configuration must be documented with the Information System Security Officer (ISSO) and the file must be verified by the system file integrity tool.\"]\n[505,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.all.accept_source_route = 0   \\n\\nIssue the following command to make the changes take effect:\\n \\n# sysctl -system\"]\n[506,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.all.rp_filter = 1 \\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[507,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.default.rp_filter = 1 \\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[508,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.default.accept_source_route = 0   \\n\\nIssue the following command to make the changes take effect:\\n \\n# sysctl --system\"]\n[509,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.icmp_echo_ignore_broadcasts = 1\\n\\nIssue the following command to make the changes take effect: \\n\\n# sysctl --system\"]\n[510,\"Set the system to not accept IPv4 ICMP redirect messages by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.default.accept_redirects = 0   \\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[511,\"Set the system to ignore IPv4 ICMP redirect messages by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.all.accept_redirects = 0   \\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[512,\"Configure the system to not allow interfaces to perform IPv4 ICMP redirects by default. \\n\\nSet the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.default.send_redirects = 0\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[513,\"Configure the system to not allow interfaces to perform IPv4 ICMP redirects. \\n\\nSet the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.all.send_redirects = 0\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[514,\"Configure network interfaces to turn off promiscuous mode unless approved by the ISSO and documented.\\n\\nSet the promiscuous mode of an interface to off with the following command:\\n\\n#ip link set dev <devicename> multicast off promisc off\"]\n[515,\"If \\\"postfix\\\" is installed, modify the \\\"/etc/postfix/main.cf\\\" file to restrict client connections to the local network with the following command:\\n\\n# postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'\"]\n[516,\"Document the \\\"vsftpd\\\" package with the ISSO as an operational requirement or remove it from the system with the following command:\\n\\n# yum remove vsftpd\"]\n[517,\"Remove the TFTP package from the system with the following command:\\n\\n# yum remove tftp-server\"]\n[518,\"Configure SSH to encrypt connections for interactive users.\\n\\nEdit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for the \\\"X11Forwarding\\\" keyword and set its value to \\\"yes\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nX11Forwarding yes\\n\\nThe SSH service must be restarted for changes to take effect:\\n\\n# systemctl restart sshd\"]\n[519,\"Configure the TFTP daemon to operate in secure mode by adding the following line to \\\"/etc/xinetd.d/tftp\\\" (or modify the line to have the required value):\\n\\nserver_args = -s /var/lib/tftpboot\"]\n[520,\"Document the requirement for an X Windows server with the ISSO or remove the related packages with the following commands:\\n\\n# rpm -e xorg-x11-server-common\"]\n[521,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.ip_forward = 0\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[522,\"Update the \\\"/etc/fstab\\\" file so the option \\\"sec\\\" is defined for each NFS mounted file system and the \\\"sec\\\" option does not have the \\\"sys\\\" setting. \\n\\nEnsure the \\\"sec\\\" option is defined as \\\"krb5:krb5i:krb5p\\\".\"]\n[523,\"If the \\\"/etc/snmp/snmpd.conf\\\" file exists, modify any lines that contain a community string value of \\\"public\\\" or \\\"private\\\" to another string value.\"]\n[524,\"If \\\"firewalld\\\" is installed and active on the system, configure rules for allowing specific services and hosts. \\n\\nIf \\\"firewalld\\\" is not \\\"active\\\", enable \\\"tcpwrappers\\\" by configuring \\\"/etc/hosts.allow\\\" and \\\"/etc/hosts.deny\\\" to allow or deny access to specific hosts.\"]\n[525,\"Remove all unapproved tunnels from the system, or document them with the ISSO.\"]\n[526,\"Set the system to the required kernel parameter, if IPv6 is enabled, by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv6.conf.all.accept_source_route = 0\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[527,\"Configure the operating system to implement multifactor authentication by installing the required packages.\\n\\nInstall the \\\"esc\\\" and \\\"pam_pkcs11\\\" packages on the system with the following command:\\n\\n# yum install esc pam_pkcs11\"]\n[528,\"Configure the operating system to implement multifactor authentication for remote access to privileged accounts via pluggable authentication modules (PAM).\\n\\nModify all of the services lines in \\\"/etc/sssd/sssd.conf\\\" or in configuration files found under \\\"/etc/sssd/conf.d\\\" to include pam.\"]\n[529,\"Configure the operating system to do certificate status checking for PKI authentication.\\n\\nModify all of the \\\"cert_policy\\\" lines in \\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" to include \\\"ocsp_on\\\".\"]\n[530,\"Configure the system to disable all wireless network interfaces with the following command:\\n\\n#nmcli radio wifi off\"]\n[531,\"Run the following command to determine which package owns the file:\\n\\n# rpm -qf <filename>\\n\\nThe package can be reinstalled from a yum repository using the command:\\n\\n# sudo yum reinstall <packagename>\\n\\nAlternatively, the package can be reinstalled from trusted media using the command:\\n\\n# sudo rpm -Uvh <packagename>\"]\n[532,\"Install and enable the latest McAfee HIPS package, available from USCYBERCOM.\\n\\nNote: If the system does not support the McAfee HIPS package, install and enable a supported intrusion detection system application and document its use with the Authorizing Official.\"]\n[533,\"Install an antivirus solution on the system.\"]\n[534,\"Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example below is using the database \\\"local\\\" for the system, so if the system is using another database in \\\"/etc/dconf/profile/user\\\", the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/locks/session\\n\\nAdd the setting to lock the screensaver lock-enabled setting:\\n\\n/org/gnome/desktop/screensaver/lock-enabled\"]\n[535,\"Configure the VPN Gateway to ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies (e.g., IPsec policy configuration). Also, configure the VPN gateway to forward encapsulated or encrypted traffic received from other enclaves with different security policies to the perimeter firewall and IDPS before traffic is passed to the private network.\"]\n[536,\"Configure the Remote Access VPN to display the Standard Mandatory DoD Notice and Consent Banner in accordance with DoD policy before granting access to the device. Use the following verbiage for applications that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n-At any time, the USG may inspect and seize data stored on this IS.\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\"]\n[537,\"Configure the Remote Access VPN Gateway and/or client to retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.\"]\n[538,\"Configure the publicly accessible VPN Gateway to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\"]\n[539,\"Configure the VPN Gateway to notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access).\"]\n[540,\"Configure the VPN Gateway to limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number, as documented in the SSP.\"]\n[541,\"Configure the TLS VPN Gateway to use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data for transmission.\"]\n[542,\"Configure the remote access VPN Gateway to use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.\"]\n[543,\"Configure the VPN Gateway to use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.\"]\n[544,\"Configure the IPsec VPN to us the FIPS 140-2 DH group. The following command is an example of how to configure the IKE (phase 1) proposals. \\n\\nThe following groups are allowed for use in DoD: \\nDH Groups 14 (2048-bit MODP) \\n- 19 (256-bit Random ECP), 20 (384-bit Random ECP), 5 (1536-bit MODP), 24 (2048-bit MODP with 256-bit POS).\"]\n[545,\"Configure the VPN Gateway to generate log records containing information to establish what type of events occurred.\"]\n[546,\"Configure the VPN Gateway to generate log records containing information to establish when (date and time) the events occurred.\"]\n[547,\"Configure the VPN Gateway to generate log records containing information that establishes the identity of any individual or process associated with the event.\"]\n[548,\"Configure the VPN Gateway to generates log records containing information to establish where the events occurred.\"]\n[549,\"Configure the VPN Gateway to generate log records containing information to establish the source of the events.\"]\n[550,\"Configure the VPN Gateway to generate log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the client connection attempts.\"]\n[551,\"Configure the VPN Gateway to protect log information from unauthorized read access if all or some of this data is stored locally.\"]\n[552,\"Configure the VPN Gateway log to protect audit information from unauthorized modification when stored locally. The method used depends on system architecture and design. Examples: ensuring log files receive the proper file system permissions and limiting log data locations.\"]\n[553,\"Configure the VPN Gateway to protect audit information from unauthorized deletion when stored locally. Ensure log files receive the proper file system permissions and limiting log data locations.\"]\n[554,\"Ensure functions, ports, protocols, and services identified on the PPSM CAL are not used for system services configuration.\\n\\nView the configured security  services.\\n\\nCompare the services that are enabled, including the port, services, protocols, and functions.\\n\\nConsult the product knowledge base and configuration guides to determine the commands for disabling each port, protocols, services, or functions that is not in compliance with the PPSM CAL and vulnerability assessments.\"]\n[555,\"Configure the IPsec VPN Gateway to use IKEv2 for IPsec VPN security associations.\"]\n[556,\"Configure the VPN Gateway to prohibit PPTP and L2F.\"]\n[557,\"If L2TP is used for encapsulation, configure the VPN Gateway or other network element to block or deny this communications protocol unencrypted L2TP packets across the security boundary and into the private network of the enclave.\"]\n[558,\"Configure the VPN Gateway to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).\"]\n[559,\"Configure the VPN Gateway to use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.\"]\n[560,\"Configure the VPN Client to implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.\"]\n[561,\"Configure the TLS VPN Gateway to use replay-resistant authentication mechanisms for network access to non-privileged accounts.\"]\n[562,\"Configure the IPsec VPN Gateway to use anti-replay mechanisms for security associations.\"]\n[563,\"Configure the VPN Gateway to uniquely identify all network-connected endpoint devices before establishing a connection.\"]\n[564,\"Configure the  VPN Gateway to use PKI-based authentication that validates certificates by constructing a certification path (which includes status information) to an accepted trust anchor.\"]\n[565,\"Configure the site-to-site VPN that uses certificate-based device authentication to use a FIPS-compliant key management process.\"]\n[566,\"Configure the Remote Access VPN Gateway to use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.\"]\n[567,\"Configure the VPN Gateway to map the authenticated identity to the user account for PKI-based authentication.\"]\n[568,\"Configure the VPN Gateway to use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).\"]\n[569,\"Configure the VPN Gateway to uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).\"]\n[570,\"Configure the VPN Gateway to route sessions to an IDPS for inspection.\"]\n[571,\"Configure the VPN Gateway to terminate all network connections associated with a communications session at the end of the session.\"]\n[572,\"Configure the VPN Gateway to use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.\"]\n[573,\"Configure the IPsec VPN Gateway to use IKE with SHA1 or greater to protect the authenticity of communications sessions.\"]\n[574,\"Configure the VPN Gateway to invalidate session identifiers upon user logoff or other session termination.\"]\n[575,\"Configure the VPN Gateway to recognize only system-generated session identifiers.\"]\n[576,\"Configure the VPN Gateway to generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.\"]\n[577,\"Configure the VPN Gateway to fail to a secure state if system initialization fails, shutdown fails, or aborts fail.\"]\n[578,\"Configure the VPN Gateway to be configured to perform an organization-defined action if the audit reveals unauthorized activity.\"]\n[579,\"Configure the VPN Gateway for functionality, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack. \\n\\nConfigure authorized system administrator accounts to allow them to disconnect or disable remote access to remove user under circumstances defined in the VPN SSP.\"]\n[580,\"Configure the IPsec Gateway to use AES with IKE. The option on the IKE Phase 1 proposal may also be configured to use the  aes-128-cbc, aes-192-cbc, or aes-256-cbc algorithms.\"]\n[581,\"Configure the VPN Gateway to transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.\"]\n[582,\"Configure the VPN Gateway to notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).\"]\n[583,\"Configure the VPN Gateway to provide centralized management and configuration of the content to be captured in log records generated by all network components.\"]\n[584,\"Configure the VPN Gateway to off-load audit records onto a different system or media than the system being audited.\"]\n[585,\"Configure the VPN Gateway to generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.\"]\n[586,\"Configure the VPN Gateway to continue to queue traffic log records locally when communications with the Central Log Server is lost.\"]\n[587,\"Configure the IPsec VPN Gateway to renegotiate the security association after 8 hours or less, or an organization-defined period.\"]\n[588,\"Configure the VPN Gateway to renegotiate the security association after 24 hours or less or as defined by the organization.\"]\n[589,\"Configure the VPN Gateway to accept Personal Identity Verification (PIV) credentials.\"]\n[590,\"Configure the VPN Gateway to electronically verify Personal Identity Verification (PIV) credentials.\"]\n[591,\"Configure the VPN Gateway to authenticate all network-connected endpoint devices before establishing a connection.\"]\n[592,\"Configure the VPN Gateway to use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.\"]\n[593,\"Configure the VPN Gateway to disable split-tunneling for remote clients VPNs.\"]\n[594,\"Configure the IPsec VPN Gateway to specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.\"]\n[595,\"Configure the VPN Gateway and the remote access client to protect the confidentiality and integrity of transmitted information.\"]\n[596,\"Configure the IPsec VPN Gateway to use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.\"]\n[597,\"For accounts using password authentication, configure the VPN Gateway to use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.\"]\n[598,\"Configure the VPN Gateway to generate log records when successful and/or unsuccessful VPN connection attempts occur.\"]\n[599,\"Configure the VPN Gateway to use a FIPS-validated cryptographic module to generate cryptographic hashes.\"]\n[600,\"Configure the VPN Gateway to use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.\"]\n[601,\"Configure the IPsec VPN Gateway IKE to use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.\"]\n[602,\"Configure the IPsec VPN Gateway to use IKE and IPsec VPN SAs.\"]\n[603,\"Configure the VPN Gateway to not accept certificates that have been revoked when using PKI for authentication.\"]\n[604,\"Configure the VPN Client logout log out function must be configured to terminate the session on/with the VPN Gateway.\"]\n[605,\"Configure the VPN Client to display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.\"]\n[606,\"Configure the VPN Gateway to store only cryptographic representations of the PSK.\"]\n[607,\"Configure the IPsec Gateway to use AES for the IPsec proposal. The following example commands configure the IPsec (phase 2) proposals. The option may also be configured to use the aes-128-cbc, aes-192-cbc, or aes-256-cbc algorithms.\"]\n[608,\"Configure the TLS VPN Gateway that supports Government-only services to prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.\"]\n[609,\"Configure the TLS VPN Gateway that supports citizen- or business-facing network devices to prohibit client negotiation to SSL 2.0 or SSL 3.0.\"]\n[610,\"The VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.\"]\n[611,\"Configure the VPN Gateway to use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.\"]\n[612,\"Configure the IPsec VPN Gateway Internet Key Exchange (IKE) to use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.\"]\n[613,\"Configure the VPN Gateway to validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.\"]\n[614,\"Configure the VPN Gateway to use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).\"]\n[615,\"If the site-to-site VPN implementation uses L2TPv3, configure L2TPv3 sessions to authenticate the traffic before transit.\"]\n{\"table\":\"rev_group_rule_cci_map\",\"columns\":\"`cci`,`rgrccId`,`rgrId`\",\"rowCount\":844}\n[\"000366\",1,1]\n[\"001812\",2,2]\n[\"000366\",3,3]\n[\"001812\",4,4]\n[\"000366\",5,5]\n[\"000366\",6,6]\n[\"000877\",7,7]\n[\"001199\",8,8]\n[\"002475\",9,8]\n[\"002476\",10,8]\n[\"002890\",11,9]\n[\"003123\",12,9]\n[\"000877\",13,10]\n[\"001233\",14,11]\n[\"001774\",15,12]\n[\"000877\",16,13]\n[\"000366\",17,14]\n[\"000366\",18,15]\n[\"000213\",19,16]\n[\"000366\",20,17]\n[\"001090\",21,18]\n[\"000795\",22,19]\n[\"002235\",23,20]\n[\"000366\",24,21]\n[\"000381\",25,22]\n[\"000366\",26,23]\n[\"002890\",27,24]\n[\"003123\",28,24]\n[\"000199\",29,25]\n[\"002165\",30,26]\n[\"002038\",31,27]\n[\"000381\",32,28]\n[\"000382\",33,29]\n[\"000381\",34,30]\n[\"000382\",35,31]\n[\"000382\",36,32]\n[\"000366\",37,33]\n[\"000366\",38,34]\n[\"000366\",39,35]\n[\"002238\",40,36]\n[\"000044\",41,37]\n[\"000044\",42,38]\n[\"002238\",43,38]\n[\"000200\",44,39]\n[\"000199\",45,40]\n[\"000198\",46,41]\n[\"000205\",47,42]\n[\"000192\",48,43]\n[\"000193\",49,43]\n[\"000194\",50,43]\n[\"001619\",51,43]\n[\"000196\",52,44]\n[\"000172\",53,45]\n[\"000172\",54,46]\n[\"000018\",55,47]\n[\"000172\",56,47]\n[\"001403\",57,47]\n[\"001404\",58,47]\n[\"001405\",59,47]\n[\"002130\",60,47]\n[\"002234\",61,47]\n[\"000018\",62,48]\n[\"000172\",63,48]\n[\"001403\",64,48]\n[\"001404\",65,48]\n[\"001405\",66,48]\n[\"002130\",67,48]\n[\"002234\",68,48]\n[\"000018\",69,49]\n[\"000172\",70,49]\n[\"001403\",71,49]\n[\"001404\",72,49]\n[\"001405\",73,49]\n[\"002130\",74,49]\n[\"002234\",75,49]\n[\"000172\",76,50]\n[\"000172\",77,51]\n[\"000172\",78,52]\n[\"000067\",79,53]\n[\"000172\",80,53]\n[\"000067\",81,54]\n[\"000172\",82,54]\n[\"000067\",83,55]\n[\"000172\",84,55]\n[\"000172\",85,56]\n[\"000172\",86,57]\n[\"000172\",87,58]\n[\"000172\",88,59]\n[\"000172\",89,60]\n[\"002234\",90,60]\n[\"000172\",91,61]\n[\"002234\",92,61]\n[\"000172\",93,62]\n[\"002234\",94,62]\n[\"000172\",95,63]\n[\"000172\",96,64]\n[\"000172\",97,65]\n[\"000172\",98,66]\n[\"002234\",99,66]\n[\"000172\",100,67]\n[\"002234\",101,67]\n[\"000172\",102,68]\n[\"002234\",103,68]\n[\"000172\",104,69]\n[\"002234\",105,69]\n[\"001849\",106,70]\n[\"001849\",107,71]\n[\"001849\",108,72]\n[\"000162\",109,73]\n[\"000163\",110,73]\n[\"000164\",111,73]\n[\"000162\",112,74]\n[\"000163\",113,74]\n[\"000164\",114,74]\n[\"000162\",115,75]\n[\"000163\",116,75]\n[\"000164\",117,75]\n[\"000381\",118,76]\n[\"000381\",119,77]\n[\"000366\",120,78]\n[\"000366\",121,79]\n[\"000366\",122,80]\n[\"002385\",123,81]\n[\"000366\",124,82]\n[\"000366\",125,83]\n[\"000185\",126,84]\n[\"002470\",127,84]\n[\"000366\",128,85]\n[\"000185\",129,86]\n[\"000366\",130,87]\n[\"000185\",131,88]\n[\"002470\",132,88]\n[\"000185\",133,89]\n[\"002470\",134,89]\n[\"000366\",135,90]\n[\"002235\",136,91]\n[\"000366\",137,92]\n[\"001084\",138,93]\n[\"000366\",139,94]\n[\"000764\",140,95]\n[\"000366\",141,96]\n[\"000366\",142,97]\n[\"000804\",143,98]\n[\"000381\",144,99]\n[\"000366\",145,100]\n[\"000366\",146,101]\n[\"000381\",147,102]\n[\"000381\",148,103]\n[\"000366\",149,104]\n[\"000366\",150,105]\n[\"000381\",151,106]\n[\"000381\",152,107]\n[\"000169\",153,108]\n[\"002418\",154,109]\n[\"002421\",155,109]\n[\"002418\",156,110]\n[\"002421\",157,110]\n[\"002038\",158,111]\n[\"002418\",159,112]\n[\"002421\",160,112]\n[\"002038\",161,113]\n[\"001090\",162,114]\n[\"000366\",163,115]\n[\"001967\",164,116]\n[\"000366\",165,117]\n[\"000366\",166,118]\n[\"000381\",167,119]\n[\"002418\",168,120]\n[\"002421\",169,120]\n[\"001764\",170,121]\n[\"000057\",171,122]\n[\"001764\",172,123]\n[\"001764\",173,124]\n[\"000048\",174,125]\n[\"000050\",175,125]\n[\"001384\",176,125]\n[\"001385\",177,125]\n[\"001386\",178,125]\n[\"001387\",179,125]\n[\"001388\",180,125]\n[\"000366\",181,126]\n[\"001084\",182,127]\n[\"000048\",183,128]\n[\"001384\",184,128]\n[\"001385\",185,128]\n[\"001386\",186,128]\n[\"001387\",187,128]\n[\"001388\",188,128]\n[\"000366\",189,129]\n[\"000381\",190,130]\n[\"000366\",191,131]\n[\"002824\",192,132]\n[\"002385\",193,133]\n[\"000366\",194,134]\n[\"000366\",195,135]\n[\"000366\",196,136]\n[\"000366\",197,137]\n[\"002418\",198,138]\n[\"002421\",199,138]\n[\"000366\",200,139]\n[\"000197\",201,140]\n[\"000366\",202,141]\n[\"000366\",203,142]\n[\"002418\",204,143]\n[\"002421\",205,143]\n[\"000366\",206,144]\n[\"002038\",207,145]\n[\"001090\",208,146]\n[\"002038\",209,147]\n[\"001453\",210,148]\n[\"000366\",211,149]\n[\"000068\",212,150]\n[\"002890\",213,150]\n[\"000366\",214,151]\n[\"000366\",215,152]\n[\"000381\",216,153]\n[\"001090\",217,154]\n[\"000381\",218,155]\n[\"000366\",219,156]\n[\"001090\",220,157]\n[\"000366\",221,158]\n[\"000366\",222,159]\n[\"000803\",223,160]\n[\"000196\",224,161]\n[\"000366\",225,162]\n[\"000366\",226,163]\n[\"000366\",227,164]\n[\"000366\",228,165]\n[\"002450\",229,166]\n[\"000366\",230,167]\n[\"002038\",231,168]\n[\"001084\",232,169]\n[\"002038\",233,170]\n[\"001084\",234,171]\n[\"001084\",235,172]\n[\"002038\",236,173]\n[\"001084\",237,174]\n[\"000381\",238,175]\n[\"000366\",239,176]\n[\"002235\",240,177]\n[\"000213\",241,178]\n[\"002235\",242,179]\n[\"000213\",243,180]\n[\"002235\",244,181]\n[\"002235\",245,182]\n[\"002235\",246,183]\n[\"002235\",247,184]\n[\"002235\",248,185]\n[\"002235\",249,186]\n[\"002235\",250,187]\n[\"002235\",251,188]\n[\"000213\",252,189]\n[\"000213\",253,190]\n[\"000213\",254,191]\n[\"000213\",255,192]\n[\"000213\",256,193]\n[\"002314\",257,193]\n[\"002235\",258,194]\n[\"002235\",259,195]\n[\"002235\",260,196]\n[\"002235\",261,197]\n[\"002235\",262,198]\n[\"000162\",263,199]\n[\"000163\",264,199]\n[\"000164\",265,199]\n[\"000171\",266,199]\n[\"001914\",267,199]\n[\"002235\",268,200]\n[\"002235\",269,201]\n[\"002235\",270,202]\n[\"002235\",271,203]\n[\"002235\",272,204]\n[\"000366\",273,205]\n[\"000135\",274,206]\n[\"000135\",275,207]\n[\"002824\",276,208]\n[\"002824\",277,209]\n[\"000381\",278,210]\n[\"000381\",279,211]\n[\"000172\",280,212]\n[\"000172\",281,213]\n[\"000381\",282,214]\n[\"000381\",283,215]\n[\"002235\",284,216]\n[\"000381\",285,217]\n[\"000381\",286,218]\n[\"000381\",287,219]\n[\"000381\",288,220]\n[\"000366\",289,221]\n[\"000172\",290,222]\n[\"000172\",291,223]\n[\"000803\",292,224]\n[\"000381\",293,225]\n[\"000366\",294,226]\n[\"000381\",295,227]\n[\"000172\",296,228]\n[\"000381\",297,229]\n[\"000381\",298,230]\n[\"000172\",299,231]\n[\"000366\",300,232]\n[\"000366\",301,233]\n[\"000366\",302,234]\n[\"000366\",303,235]\n[\"002824\",304,236]\n[\"000366\",305,237]\n[\"000366\",306,238]\n[\"000366\",307,239]\n[\"000366\",308,240]\n[\"000366\",309,241]\n[\"000366\",310,242]\n[\"000366\",311,243]\n[\"000366\",312,244]\n[\"000366\",313,245]\n[\"000366\",314,246]\n[\"000366\",315,247]\n[\"000366\",316,248]\n[\"000366\",317,249]\n[\"000366\",318,250]\n[\"000366\",319,251]\n[\"000366\",320,252]\n[\"000366\",321,253]\n[\"000366\",322,254]\n[\"000366\",323,255]\n[\"000366\",324,256]\n[\"000366\",325,257]\n[\"000366\",326,258]\n[\"000366\",327,259]\n[\"000366\",328,260]\n[\"000366\",329,261]\n[\"000366\",330,262]\n[\"000366\",331,263]\n[\"000366\",332,264]\n[\"000381\",333,265]\n[\"000366\",334,266]\n[\"000366\",335,267]\n[\"000366\",336,268]\n[\"000056\",337,269]\n[\"001199\",338,270]\n[\"002475\",339,270]\n[\"002476\",340,270]\n[\"001199\",341,271]\n[\"002475\",342,271]\n[\"002476\",343,271]\n[\"000130\",344,272]\n[\"000130\",345,273]\n[\"000130\",346,274]\n[\"000130\",347,275]\n[\"000130\",348,276]\n[\"000130\",349,277]\n[\"000130\",350,278]\n[\"000199\",351,279]\n[\"001090\",352,280]\n[\"000381\",353,281]\n[\"000381\",354,282]\n[\"000381\",355,283]\n[\"000381\",356,284]\n[\"001199\",357,285]\n[\"000366\",358,286]\n[\"000765\",359,287]\n[\"000766\",360,287]\n[\"000767\",361,287]\n[\"000768\",362,287]\n[\"001494\",512,288]\n[\"001496\",513,288]\n[\"002165\",514,288]\n[\"002235\",515,288]\n[\"000048\",516,289]\n[\"000048\",517,290]\n[\"000048\",518,291]\n[\"000056\",519,292]\n[\"001948\",520,293]\n[\"001953\",521,293]\n[\"001954\",522,293]\n[\"000057\",523,294]\n[\"000057\",524,295]\n[\"000057\",525,296]\n[\"000057\",526,297]\n[\"000057\",527,298]\n[\"000057\",528,299]\n[\"000057\",529,300]\n[\"000192\",530,301]\n[\"000192\",531,302]\n[\"000192\",532,303]\n[\"000193\",533,304]\n[\"000194\",534,305]\n[\"001619\",535,306]\n[\"000195\",536,307]\n[\"000195\",537,308]\n[\"000195\",538,309]\n[\"000195\",539,310]\n[\"000196\",540,311]\n[\"000196\",541,312]\n[\"000196\",542,313]\n[\"000198\",543,314]\n[\"000198\",544,315]\n[\"000199\",545,316]\n[\"000199\",546,317]\n[\"000200\",547,318]\n[\"000205\",548,319]\n[\"000366\",549,320]\n[\"000766\",550,321]\n[\"000795\",551,322]\n[\"000044\",552,323]\n[\"002236\",553,323]\n[\"002237\",554,323]\n[\"002238\",555,323]\n[\"002238\",556,324]\n[\"002038\",557,325]\n[\"002038\",558,326]\n[\"000366\",559,327]\n[\"000366\",560,328]\n[\"000366\",561,329]\n[\"000366\",562,330]\n[\"000366\",563,331]\n[\"000213\",564,332]\n[\"000213\",565,333]\n[\"000213\",566,334]\n[\"000213\",567,335]\n[\"000213\",568,336]\n[\"000766\",569,337]\n[\"000381\",570,338]\n[\"000381\",571,339]\n[\"002165\",572,340]\n[\"002235\",573,340]\n[\"001744\",574,341]\n[\"001744\",575,342]\n[\"001749\",576,343]\n[\"001749\",577,344]\n[\"000366\",579,345]\n[\"000778\",578,345]\n[\"001958\",580,345]\n[\"001958\",581,346]\n[\"000366\",582,347]\n[\"000778\",583,347]\n[\"001958\",584,347]\n[\"002617\",585,348]\n[\"002165\",587,349]\n[\"002696\",586,349]\n[\"002165\",589,350]\n[\"002696\",588,350]\n[\"000366\",590,351]\n[\"000366\",591,352]\n[\"000366\",592,353]\n[\"000366\",593,354]\n[\"000366\",594,355]\n[\"000366\",595,356]\n[\"000764\",596,357]\n[\"000366\",597,358]\n[\"002165\",598,359]\n[\"002165\",599,360]\n[\"000366\",600,361]\n[\"000366\",601,362]\n[\"000366\",602,363]\n[\"000366\",603,364]\n[\"000366\",604,365]\n[\"000366\",605,366]\n[\"000366\",606,367]\n[\"000366\",607,368]\n[\"000366\",608,369]\n[\"000366\",609,370]\n[\"000366\",610,371]\n[\"000366\",611,372]\n[\"000366\",612,373]\n[\"000366\",613,374]\n[\"000318\",615,375]\n[\"000368\",614,375]\n[\"001812\",616,375]\n[\"001813\",617,375]\n[\"001814\",618,375]\n[\"000366\",619,376]\n[\"000366\",620,377]\n[\"000366\",621,378]\n[\"000366\",622,379]\n[\"001764\",623,380]\n[\"001764\",624,381]\n[\"001764\",625,382]\n[\"000366\",626,383]\n[\"000318\",628,384]\n[\"000368\",627,384]\n[\"001812\",631,384]\n[\"001813\",630,384]\n[\"001814\",629,384]\n[\"000366\",632,385]\n[\"000366\",633,386]\n[\"000366\",634,387]\n[\"000366\",635,388]\n[\"000366\",636,389]\n[\"000366\",637,390]\n[\"000366\",638,391]\n[\"000366\",639,392]\n[\"000068\",641,393]\n[\"001199\",640,393]\n[\"002450\",642,393]\n[\"002476\",643,393]\n[\"000366\",644,394]\n[\"000366\",645,395]\n[\"000366\",646,396]\n[\"000318\",648,397]\n[\"000368\",647,397]\n[\"001812\",651,397]\n[\"001813\",649,397]\n[\"001814\",650,397]\n[\"000381\",652,398]\n[\"000126\",654,399]\n[\"000131\",653,399]\n[\"000139\",655,400]\n[\"001851\",656,401]\n[\"001851\",657,402]\n[\"001851\",658,403]\n[\"001851\",659,404]\n[\"001851\",660,405]\n[\"001851\",661,406]\n[\"001851\",662,407]\n[\"001851\",663,408]\n[\"001855\",664,409]\n[\"001855\",665,410]\n[\"001855\",666,411]\n[\"002234\",667,412]\n[\"000126\",669,413]\n[\"000172\",668,413]\n[\"000126\",670,414]\n[\"000172\",671,414]\n[\"000126\",673,415]\n[\"000172\",672,415]\n[\"000126\",674,416]\n[\"000172\",675,416]\n[\"000172\",676,417]\n[\"000172\",677,418]\n[\"000172\",678,419]\n[\"000172\",679,420]\n[\"000172\",680,421]\n[\"000172\",681,422]\n[\"000172\",682,423]\n[\"000172\",683,424]\n[\"000172\",684,425]\n[\"000172\",685,426]\n[\"002884\",686,426]\n[\"000172\",687,427]\n[\"002884\",688,427]\n[\"000172\",689,428]\n[\"002884\",690,428]\n[\"000172\",691,429]\n[\"002884\",692,429]\n[\"000172\",693,430]\n[\"002884\",694,430]\n[\"000172\",695,431]\n[\"002884\",696,431]\n[\"000172\",697,432]\n[\"002884\",698,432]\n[\"000172\",699,433]\n[\"002884\",700,433]\n[\"000172\",701,434]\n[\"002884\",702,434]\n[\"000172\",703,435]\n[\"002884\",704,435]\n[\"000126\",705,436]\n[\"000172\",706,436]\n[\"002884\",707,436]\n[\"000126\",708,437]\n[\"000172\",709,437]\n[\"002884\",710,437]\n[\"000135\",712,438]\n[\"000172\",711,438]\n[\"002884\",713,438]\n[\"000135\",714,439]\n[\"000172\",715,439]\n[\"002884\",716,439]\n[\"000135\",717,440]\n[\"000172\",718,440]\n[\"002884\",719,440]\n[\"000135\",721,441]\n[\"000172\",720,441]\n[\"002884\",722,441]\n[\"000135\",723,442]\n[\"000172\",724,442]\n[\"002884\",725,442]\n[\"000130\",728,443]\n[\"000135\",727,443]\n[\"000172\",726,443]\n[\"002884\",729,443]\n[\"000130\",730,444]\n[\"000135\",731,444]\n[\"000172\",732,444]\n[\"002884\",733,444]\n[\"000130\",736,445]\n[\"000135\",735,445]\n[\"000172\",734,445]\n[\"002884\",737,445]\n[\"000130\",738,446]\n[\"000135\",739,446]\n[\"000172\",740,446]\n[\"002884\",741,446]\n[\"000130\",743,447]\n[\"000135\",744,447]\n[\"000172\",742,447]\n[\"002884\",745,447]\n[\"000135\",746,448]\n[\"002884\",747,448]\n[\"000135\",748,449]\n[\"002884\",749,449]\n[\"000135\",750,450]\n[\"002884\",751,450]\n[\"000135\",752,451]\n[\"002884\",753,451]\n[\"000135\",754,452]\n[\"000172\",755,452]\n[\"002884\",756,452]\n[\"000135\",758,453]\n[\"000172\",757,453]\n[\"002884\",759,453]\n[\"000172\",760,454]\n[\"000172\",761,455]\n[\"000172\",762,456]\n[\"000172\",763,457]\n[\"000172\",764,458]\n[\"000172\",765,459]\n[\"000018\",767,460]\n[\"000172\",766,460]\n[\"001403\",769,460]\n[\"002130\",768,460]\n[\"000018\",770,461]\n[\"000172\",771,461]\n[\"001403\",772,461]\n[\"002130\",773,461]\n[\"000018\",775,462]\n[\"000172\",774,462]\n[\"001403\",777,462]\n[\"002130\",776,462]\n[\"000018\",778,463]\n[\"000172\",779,463]\n[\"001403\",780,463]\n[\"002130\",781,463]\n[\"000018\",782,464]\n[\"000172\",783,464]\n[\"001403\",785,464]\n[\"002130\",784,464]\n[\"000172\",786,465]\n[\"002884\",787,465]\n[\"000172\",788,466]\n[\"002884\",789,466]\n[\"000172\",790,467]\n[\"002884\",791,467]\n[\"000172\",792,468]\n[\"002884\",793,468]\n[\"000172\",794,469]\n[\"002884\",795,469]\n[\"000366\",796,470]\n[\"000318\",797,471]\n[\"000368\",798,471]\n[\"001812\",800,471]\n[\"001813\",801,471]\n[\"001814\",799,471]\n[\"000054\",802,472]\n[\"000382\",803,473]\n[\"002314\",804,473]\n[\"000068\",807,474]\n[\"000366\",805,474]\n[\"000803\",806,474]\n[\"001133\",808,475]\n[\"002361\",809,475]\n[\"000048\",815,476]\n[\"000050\",816,476]\n[\"001384\",810,476]\n[\"001385\",811,476]\n[\"001386\",812,476]\n[\"001387\",813,476]\n[\"001388\",814,476]\n[\"001453\",817,477]\n[\"001453\",818,478]\n[\"001453\",819,479]\n[\"000366\",820,480]\n[\"002418\",821,481]\n[\"002420\",822,481]\n[\"002421\",823,481]\n[\"002422\",824,481]\n[\"002418\",827,482]\n[\"002420\",828,482]\n[\"002421\",825,482]\n[\"002422\",826,482]\n[\"001133\",829,483]\n[\"002361\",830,483]\n[\"000366\",831,484]\n[\"001133\",832,485]\n[\"002361\",833,485]\n[\"000366\",834,486]\n[\"000366\",835,487]\n[\"000366\",836,488]\n[\"000366\",837,489]\n[\"000197\",838,490]\n[\"000366\",839,490]\n[\"001453\",840,491]\n[\"000366\",841,492]\n[\"000366\",842,493]\n[\"000318\",843,494]\n[\"000368\",844,494]\n[\"001812\",845,494]\n[\"001813\",847,494]\n[\"001814\",846,494]\n[\"000318\",849,495]\n[\"000368\",848,495]\n[\"001812\",852,495]\n[\"001813\",851,495]\n[\"001814\",850,495]\n[\"000366\",853,496]\n[\"000366\",854,497]\n[\"000366\",855,498]\n[\"001891\",857,499]\n[\"002046\",856,499]\n[\"000366\",858,500]\n[\"000366\",859,501]\n[\"000366\",860,502]\n[\"000366\",861,503]\n[\"000366\",862,504]\n[\"000366\",863,505]\n[\"000366\",864,506]\n[\"000366\",865,507]\n[\"000366\",866,508]\n[\"000366\",867,509]\n[\"000366\",868,510]\n[\"000366\",869,511]\n[\"000366\",870,512]\n[\"000366\",871,513]\n[\"000366\",872,514]\n[\"000366\",873,515]\n[\"000366\",874,516]\n[\"000318\",875,517]\n[\"000368\",876,517]\n[\"001812\",878,517]\n[\"001813\",877,517]\n[\"001814\",879,517]\n[\"000366\",880,518]\n[\"000366\",881,519]\n[\"000366\",882,520]\n[\"000366\",883,521]\n[\"000366\",884,522]\n[\"000366\",885,523]\n[\"000366\",886,524]\n[\"000366\",887,525]\n[\"000366\",888,526]\n[\"001948\",890,527]\n[\"001953\",891,527]\n[\"001954\",889,527]\n[\"001948\",893,528]\n[\"001953\",892,528]\n[\"001954\",894,528]\n[\"001948\",896,529]\n[\"001953\",897,529]\n[\"001954\",895,529]\n[\"001443\",898,530]\n[\"001444\",899,530]\n[\"002418\",900,530]\n[\"000057\",901,534]\n[\"001414\",1023,535]\n[\"000048\",1024,536]\n[\"001414\",1026,537]\n[\"000048\",1027,538]\n[\"000050\",1028,539]\n[\"001384\",1029,540]\n[\"001385\",1030,540]\n[\"001386\",1031,540]\n[\"001387\",1032,540]\n[\"001388\",1033,540]\n[\"000053\",1034,541]\n[\"000054\",1035,542]\n[\"000068\",1036,543]\n[\"001453\",1037,544]\n[\"001453\",1038,545]\n[\"000068\",1039,546]\n[\"000130\",1040,547]\n[\"000131\",1041,548]\n[\"001487\",1042,549]\n[\"000132\",1043,550]\n[\"000133\",1044,551]\n[\"000134\",1045,552]\n[\"000162\",1046,553]\n[\"000163\",1047,554]\n[\"000164\",1048,555]\n[\"000382\",1049,556]\n[\"000382\",1050,557]\n[\"000382\",1051,558]\n[\"000382\",1052,559]\n[\"000764\",1053,560]\n[\"000766\",1054,561]\n[\"001939\",1055,562]\n[\"001942\",1056,563]\n[\"001942\",1057,564]\n[\"000778\",1058,565]\n[\"000185\",1059,566]\n[\"000186\",1060,567]\n[\"000187\",1061,568]\n[\"000187\",1062,569]\n[\"000803\",1063,570]\n[\"000804\",1064,571]\n[\"001097\",1065,572]\n[\"001133\",1066,573]\n[\"001184\",1067,574]\n[\"001184\",1068,575]\n[\"001185\",1069,576]\n[\"001664\",1070,577]\n[\"001188\",1071,578]\n[\"001190\",1072,579]\n[\"002314\",1073,580]\n[\"002322\",1074,581]\n[\"000068\",1075,582]\n[\"002353\",1076,583]\n[\"002250\",1077,584]\n[\"001844\",1078,585]\n[\"001851\",1079,586]\n[\"001858\",1080,587]\n[\"001861\",1081,588]\n[\"002038\",1082,589]\n[\"002038\",1083,590]\n[\"001953\",1084,591]\n[\"001954\",1085,592]\n[\"001958\",1086,593]\n[\"002450\",1087,594]\n[\"002397\",1088,595]\n[\"002418\",1089,596]\n[\"002418\",1090,597]\n[\"002423\",1091,598]\n[\"000197\",1092,599]\n[\"000172\",1093,600]\n[\"002450\",1094,601]\n[\"002450\",1095,602]\n[\"002450\",1096,603]\n[\"000366\",1097,604]\n[\"000366\",1098,605]\n[\"002363\",1099,606]\n[\"002364\",1100,607]\n[\"000196\",1101,608]\n[\"000068\",1102,609]\n[\"001453\",1103,610]\n[\"001453\",1104,611]\n[\"001967\",1105,612]\n[\"002450\",1106,613]\n[\"002450\",1107,614]\n[\"000185\",1108,615]\n[\"000803\",1109,616]\n[\"000068\",1110,617]\n[\"001414\",1153,618]\n[\"000048\",1154,619]\n[\"001414\",1156,620]\n[\"001414\",1157,621]\n[\"000048\",1158,622]\n{\"table\":\"rev_group_rule_map\",\"columns\":\"`checkDigest`,`checkSystem`,`documentable`,`falseNegatives`,`falsePositives`,`fixDigest`,`fixref`,`groupId`,`groupSeverity`,`groupTitle`,`iaControls`,`mitigationControl`,`mitigations`,`potentialImpacts`,`responsibility`,`revId`,`rgrId`,`ruleId`,`severity`,`severityOverrideGuidance`,`thirdPartyTools`,`title`,`version`,`vulnDiscussion`,`weight`\",\"rowCount\":620}\n[{\"type\":\"Buffer\",\"data\":\"base64:vchgPhpapNXqH1070giShdvTrztio49eNJBWV74F3HU=\"},\"C-64053r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:w9I2ThmrWkLjEEgN5LZe5U8Sfp5fyYhIItBlZdSaJLE=\"},\"F-69237r2_fix\",\"V-63319\",\"medium\",\"WN10-00-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",1,\"SV-77809r3_rule\",\"medium\",null,null,\"Domain-joined systems must use Windows 10 Enterprise Edition 64-bit version.\",\"WN10-00-000005\",\"Features such as Credential Guard use virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Virtualization based security and Credential Guard are only available with Windows 10 Enterprise 64-bit version.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kaQFP+qv+/U0A5jz+BdWIpTTdtyktf1MP4WKqmlH3c4=\"},\"C-64055r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kepSgRivzMqHnK/2OMM0E1Wcu7H9wPx3R/EaQdHuCGA=\"},\"F-69239r1_fix\",\"V-63321\",\"medium\",\"WN10-CC-000310\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",2,\"SV-77811r1_rule\",\"medium\",null,null,\"Users must be prevented from changing installation options.\",\"WN10-CC-000310\",\"Installation options for applications are typically controlled by administrators.  This setting prevents users from changing installation options that may bypass security features.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LSSb1gLDf7uiXzn44Bg4EplFPsBwaprDmRrselWEvyE=\"},\"C-94059r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C69LdFRRLIKAEvN52sOWyR1XOoNaliZ20V7Ahi2TgE4=\"},\"F-71517r1_fix\",\"V-63323\",\"medium\",\"WN10-00-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",3,\"SV-77813r6_rule\",\"medium\",null,null,\"Windows 10 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.\",\"WN10-00-000010\",\"Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zv0vssTime65YEhFGjHDqU96ACMkZRxJDowM/Qv+sCo=\"},\"C-64059r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:WYWzs/LVbBJCV5p6sevrFQeIj+kgYqP53QgZoLCvajY=\"},\"F-69243r1_fix\",\"V-63325\",\"high\",\"WN10-CC-000315\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",4,\"SV-77815r1_rule\",\"high\",null,null,\"The Windows Installer Always install with elevated privileges must be disabled.\",\"WN10-CC-000315\",\"Standard user accounts must not be granted elevated privileges.  Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pBxUW2Mg4ubB2d75emmojt2R7TlPrd+/K+K4/cfdRCw=\"},\"C-64061r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sUyefRSp12AcSvLBKGiUxVCfWftGYjo3Xl9Pa+qQv5U=\"},\"F-69245r1_fix\",\"V-63329\",\"medium\",\"WN10-CC-000320\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",5,\"SV-77819r1_rule\",\"medium\",null,null,\"Users must be notified if a web-based program attempts to install software.\",\"WN10-CC-000320\",\"Web-based programs may attempt to install malicious software on a system.  Ensuring users are notified if a web-based program attempts to install software allows them to refuse the installation.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zkVu4Ox1MUjKEwFzsfX/ILQ/ZYHNPsu/JvNQeqZ228Y=\"},\"C-64067r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6kR9cAoufh12SxDcuUMPIlGdSV7Xnh2IK/uFUgsv5vk=\"},\"F-69251r1_fix\",\"V-63333\",\"medium\",\"WN10-CC-000325\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",6,\"SV-77823r1_rule\",\"medium\",null,null,\"Automatically signing in the last interactive user after a system-initiated restart must be disabled.\",\"WN10-CC-000325\",\"Windows can be configured to automatically sign the user back in after a Windows Update restart.  Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fdOFEUfWZvFxvtQyeYZ2AqTmF5GEfPF1uWfwWrblF5o=\"},\"C-64071r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FAsYZP3B2AC9MJAS9X+8yJy62Xj08bP/bThl9CR1e2E=\"},\"F-69255r1_fix\",\"V-63335\",\"high\",\"WN10-CC-000330\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",7,\"SV-77825r1_rule\",\"high\",null,null,\"The Windows Remote Management (WinRM) client must not use Basic authentication.\",\"WN10-CC-000330\",\"Basic authentication uses plain text passwords that could be used to compromise a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WJmapvaFU3fBFpTg+ufcMx2LC53rImDSpxqCEpTRTeE=\"},\"C-94061r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1qz4vDTsDlQKNl7HjZBswvv/xw5Z6+IAI5Vjmop+PuE=\"},\"F-100987r3_fix\",\"V-63337\",\"medium\",\"WN10-00-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",8,\"SV-77827r5_rule\",\"medium\",null,null,\"Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.\",\"WN10-00-000030\",\"If data at rest is unencrypted, it is vulnerable to disclosure.  Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls.   Encrypting the data ensures that confidentiality is protected even when the operating system is not running.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b3jhzOOdG7cVXgpSQQKPwd6xwSdfSPk98Epls0Yl+iY=\"},\"C-64075r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9wQwtSKZvc96iE+h8e50nFFTu3ZivGD9/+QhuwRZZOQ=\"},\"F-69259r1_fix\",\"V-63339\",\"medium\",\"WN10-CC-000335\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",9,\"SV-77829r1_rule\",\"medium\",null,null,\"The Windows Remote Management (WinRM) client must not allow unencrypted traffic.\",\"WN10-CC-000335\",\"Unencrypted remote access to a system can allow sensitive information to be compromised.  Windows remote management connections must be encrypted to prevent this.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nkjCE6RM8DNItyD6rVqHkapLyfMeCxO61yv23MB6TIM=\"},\"C-64079r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SSUaZxp2e3lrtlRvHn/MbHLzmo8TT8Gt7ESsNHEpoN4=\"},\"F-69263r1_fix\",\"V-63341\",\"medium\",\"WN10-CC-000360\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",10,\"SV-77831r2_rule\",\"medium\",null,null,\"The Windows Remote Management (WinRM) client must not use Digest authentication.\",\"WN10-CC-000360\",\"Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HCOGZgkq+yjHfU54mGFmUULh8th2DmZrWdDxdOWGa1I=\"},\"C-93975r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SCb7yomQ0gnALvtdYQ0Wfiqr79Wy9XDD7zCwrSrCFVo=\"},\"F-100903r1_fix\",\"V-63343\",\"medium\",\"WN10-00-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",11,\"SV-77833r2_rule\",\"medium\",null,null,\"Windows 10 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).\",\"WN10-00-000025\",\"An approved tool for continuous network scanning must be installed and configured to run.\\n\\nWithout the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws.\\n\\nTo support this requirement, the operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools, as specified in the requirement.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qqusfdR/p7eKP2jELMMeLdSrRy4vsHPTO1wfCg44MTA=\"},\"C-69225r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:GlCAt+DFqUcIiFpLGGP/s22dZRqXxVkiX9prKdNXawc=\"},\"F-69267r3_fix\",\"V-63345\",\"medium\",\"WN10-00-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",12,\"SV-77835r3_rule\",\"medium\",null,null,\"The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.\",\"WN10-00-000035\",\"Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities.\\n\\nThe organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yd5HlJZjtzvpiWMc+q7EtjdFutkSfgvcIU2keNcxYzA=\"},\"C-64081r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Q0+/kPQ+TMoFU6R/R3baauhZk8VsT5OP1El8uRmgkNI=\"},\"F-69265r1_fix\",\"V-63347\",\"high\",\"WN10-CC-000345\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",13,\"SV-77837r1_rule\",\"high\",null,null,\"The Windows Remote Management (WinRM) service must not use Basic authentication.\",\"WN10-CC-000345\",\"Basic authentication uses plain text passwords that could be used to compromise a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:or6yezNX5dbJzbcRUwG9A6vn2Nwe1/eA0vaJqpY6LqY=\"},\"C-94063r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ehIkgFNdMcE1az7ZnoCD3OKmAwmBi0GzVNa1FmkTgLA=\"},\"F-98031r3_fix\",\"V-63349\",\"high\",\"WN10-00-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",14,\"SV-77839r11_rule\",\"high\",null,null,\"Windows 10 systems must be maintained at a supported servicing level.\",\"WN10-00-000040\",\"Windows 10 is maintained by Microsoft at servicing levels for specific periods of time to support Windows as a Service. Systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities which leaves them subject to exploitation.\\n\\nNew versions with feature updates are planned to be released on a semi-annual basis with an estimated support timeframe of 18 to 30 months depending on the release. Support for previously released versions has been extended for Enterprise editions.\\n\\nA separate servicing branch intended for special purpose systems is the Long-Term Servicing Channel (LTSC, formerly Branch - LTSB) which will receive security updates for 10 years but excludes feature updates.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9LhzdHuv/khleaS+BQu9ZlUcdjdohBUoq5bjuJZdhK8=\"},\"C-76169r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gXX1vxZNLMEKJ906VeqO6VwfiDp3BnRhlIF8SZ5PQRA=\"},\"F-83183r1_fix\",\"V-63351\",\"high\",\"WN10-00-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",15,\"SV-77841r4_rule\",\"high\",null,null,\"The Windows 10 system must use an anti-virus program.\",\"WN10-00-000045\",\"Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jyG27jY3W9Aj4bDrKfA/dk1GvzTU+D+IeEpDzIASblA=\"},\"C-73999r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SyAsNp8smmdI+Hij4hPNLGBhi2NmilH/PyQdzV2pUIU=\"},\"F-69273r1_fix\",\"V-63353\",\"high\",\"WN10-00-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",16,\"SV-77843r2_rule\",\"high\",null,null,\"Local volumes must be formatted using NTFS.\",\"WN10-00-000050\",\"The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system.  To support this, volumes must be formatted using the NTFS file system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gGc0LjWq95X1V62ZlIHcMLmkQPw2oUyILFgDEIeCFgc=\"},\"C-64093r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Lt3NME40vnlwPhHHTosrR9dZcR8XhMnFcLHuB2Lq3Lc=\"},\"F-69275r1_fix\",\"V-63355\",\"medium\",\"WN10-00-000055\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",17,\"SV-77845r1_rule\",\"medium\",null,null,\"Alternate operating systems must not be permitted on the same system.\",\"WN10-00-000055\",\"Allowing other operating systems to run on a secure system may allow security to be circumvented.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dOGGLjicLHA/RGjJYYBp+48oN0T8aKpZdwp8uPV5/Ic=\"},\"C-64095r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:isAxddtT+0Fm0OAsblf9Ghf+iS4NGqA3jzgSbGNsF5U=\"},\"F-69277r1_fix\",\"V-63357\",\"medium\",\"WN10-00-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",18,\"SV-77847r1_rule\",\"medium\",null,null,\"Non system-created file shares on a system must limit access to groups that require it.\",\"WN10-00-000060\",\"Shares which provide network access, should not typically exist on a workstation except for system-created administrative shares, and could potentially expose sensitive information.  If a share is necessary, share permissions, as well as NTFS permissions, must be reconfigured to give the minimum access to those accounts that require it.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:O7e8OfTlyzjmCELOYfMlW3c1bFSd2cM7R7YSkTfN3OA=\"},\"C-64097r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:t5Ggv9sKI7GKzesnJIeO3bOI2A5P40Pr9pN0Hn1Dpa8=\"},\"F-69279r1_fix\",\"V-63359\",\"low\",\"WN10-00-000065\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",19,\"SV-77849r1_rule\",\"low\",null,null,\"Unused accounts must be disabled or removed from the system after 35 days of inactivity.\",\"WN10-00-000065\",\"Outdated or unused accounts provide penetration points that may go undetected.  Inactive accounts must be deleted if no longer necessary or, if still required, disable until needed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8UtBp2DVYD1LJb6gnT+x7kAd1QHqhk+0hwQmESyWDy8=\"},\"C-81365r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Rq0Drnciefrchb4v+sf+grCmTAk/HDHLAtw9M5xF5jY=\"},\"F-88437r1_fix\",\"V-63361\",\"high\",\"WN10-00-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",20,\"SV-77851r2_rule\",\"high\",null,null,\"Only accounts responsible for the administration of a system must have Administrator rights on the system.\",\"WN10-00-000070\",\"An account that does not have Administrator duties must not have Administrator rights.  Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack.\\n\\nSystem administrators must log on to systems only using accounts with the minimum level of authority necessary.\\n\\nFor domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group (see V-36434 in the Active Directory Domain STIG).  Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks.\\n\\nStandard user accounts must not be members of the local administrators group.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OHRlA26i4Hoz3B5fPGaNDpMcdjxDEW48a+7+FxI491c=\"},\"C-64101r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SBfE7TkDd2NcS786G5LlI557gc60VE7A4bfB4w2U9VU=\"},\"F-69283r1_fix\",\"V-63363\",\"medium\",\"WN10-00-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",21,\"SV-77853r1_rule\",\"medium\",null,null,\"Only accounts responsible for the backup operations must be members of the Backup Operators group.\",\"WN10-00-000075\",\"Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it.  Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes.  Members of the Backup Operators group must have separate logon accounts for performing backup duties.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KQ8lRy8FDBQ4580tUO1vy4jkMlou6sCG5kmgRB26zTA=\"},\"C-94005r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PkuQ7BkZk2mwCeDlNGawCqd9XTXG/RQJCtw9/XPYoIk=\"},\"F-100933r1_fix\",\"V-63365\",\"medium\",\"WN10-00-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",22,\"SV-77855r3_rule\",\"medium\",null,null,\"Only authorized user accounts must be allowed to create or run virtual machines on Windows 10 systems.\",\"WN10-00-000080\",\"Allowing other operating systems to run on a secure system may allow users to circumvent security. For Hyper-V, preventing unauthorized users from being assigned to the Hyper-V Administrators group will prevent them from accessing or creating virtual machines on the system. The Hyper-V Hypervisor is used by Virtualization Based Security features such as Credential Guard on Windows 10; however, it is not the full Hyper-V installation.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bUQ3g8z8lvNafFtEoebv7L8OC/vCz5bDJEA+19YUMfY=\"},\"C-80207r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oPJakZz+TKXqsUByLyv8N2iXv/UZvp2SaRktzs5napc=\"},\"F-69287r1_fix\",\"V-63367\",\"low\",\"WN10-00-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",23,\"SV-77857r2_rule\",\"low\",null,null,\"Standard local user accounts must not exist on a system in a domain.\",\"WN10-00-000085\",\"To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain.  Users must log onto workstations in a domain with their domain accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:EIBNySof2OFl+QthlhxU04xnAsa1Q0mr/BmTT/yWVGw=\"},\"C-64109r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HzewPVEXvJy/3vqK0uHB7ZYVifjTyHImWH6bHFnZXaY=\"},\"F-69289r1_fix\",\"V-63369\",\"medium\",\"WN10-CC-000350\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",24,\"SV-77859r1_rule\",\"medium\",null,null,\"The Windows Remote Management (WinRM) service must not allow unencrypted traffic.\",\"WN10-CC-000350\",\"Unencrypted remote access to a system can allow sensitive information to be compromised.  Windows remote management connections must be encrypted to prevent this.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MaaeK83VUHrwbWkTbzyV8UO0uqMO9TDhxJaX5AYk0dg=\"},\"C-64111r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:z4g9j8oDjZ68rUOX8fTSATLvKjQdLa09fHE0FoV8Z4c=\"},\"F-69291r1_fix\",\"V-63371\",\"medium\",\"WN10-00-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",25,\"SV-77861r1_rule\",\"medium\",null,null,\"Accounts must be configured to require password expiration.\",\"WN10-00-000090\",\"Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nU7vAsnPVGyMIHLfdjvPC2Bq5ULx/4Moe5DQgjWZP+E=\"},\"C-77003r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aBhkLk4yDDuxvJapoccThWMsCEzDpFPSHDP96o7GBfw=\"},\"F-69295r1_fix\",\"V-63373\",\"medium\",\"WN10-00-000095\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",26,\"SV-77863r2_rule\",\"medium\",null,null,\"Permissions for system files and directories must conform to minimum requirements.\",\"WN10-00-000095\",\"Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rF9EqXhMnWgSBUWWkmTth67EEUxryI/ybsO2eNuHvzU=\"},\"C-64113r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ne7bvvVkhxxwqQKzB0FZOhG5Dme7RArzYI/oxTFDmyU=\"},\"F-69293r1_fix\",\"V-63375\",\"medium\",\"WN10-CC-000355\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",27,\"SV-77865r1_rule\",\"medium\",null,null,\"The Windows Remote Management (WinRM) service must not store RunAs credentials.\",\"WN10-CC-000355\",\"Storage of administrative credentials could allow unauthorized access.  Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PQtPLZt9kjWgPV2hRYy2GI3OB/Iw5D032IDo7oY5zKw=\"},\"C-64117r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:7DClVm96u/PlUj0xa9B6Fpm/yZc6tH4hip//MHDgktY=\"},\"F-69297r1_fix\",\"V-63377\",\"high\",\"WN10-00-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",28,\"SV-77867r1_rule\",\"high\",null,null,\"Internet Information System (IIS) or its subcomponents must not be installed on a workstation.\",\"WN10-00-000100\",\"Installation of Internet Information System (IIS) may allow unauthorized internet services to be hosted.  Websites must only be hosted on servers that have been designed for that purpose and can be adequately secured.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TRPtutJnGn43Yj6o6o250dQEb4BOKYZixgC8OVRcNIo=\"},\"C-64121r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KcSVrisllTzlLbwwjD3aQjBbkfHtbxafvagxpaTuXSw=\"},\"F-69301r1_fix\",\"V-63381\",\"medium\",\"WN10-00-000105\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",29,\"SV-77871r1_rule\",\"medium\",null,null,\"Simple Network Management Protocol (SNMP) must not be installed on the system.\",\"WN10-00-000105\",\"Some protocols and services do not support required security features, such as encrypting passwords or traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YwindgjytVWnrAw7yMnV/6hfzMIONOOroZJQi53YVkg=\"},\"C-64125r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:UqUD9iUd/SyuIamYPkPhF5kf20WKpuY45B7aNfPWC2U=\"},\"F-69305r1_fix\",\"V-63383\",\"medium\",\"WN10-00-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",30,\"SV-77873r1_rule\",\"medium\",null,null,\"Simple TCP/IP Services must not be installed on the system.\",\"WN10-00-000110\",\"Some protocols and services do not support required security features, such as encrypting passwords or traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7Tr9YNXYybZpCvPg9E2lPUrKLG7+7N1se4RCmhXyPzE=\"},\"C-64127r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MBXoPmdfwx5WkAgXM2CWQZpFkT+DsNuewTcElUoIp7I=\"},\"F-69307r1_fix\",\"V-63385\",\"medium\",\"WN10-00-000115\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",31,\"SV-77875r1_rule\",\"medium\",null,null,\"The Telnet Client must not be installed on the system.\",\"WN10-00-000115\",\"Some protocols and services do not support required security features, such as encrypting passwords or traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IYTubfVbsZBz/2eFUf+4u7kuvTO77HcoVONuJRZJyzw=\"},\"C-64133r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:IEsbmFKizofkSQo4ofAFKrgclkCswtyCio8fk2M+Ja8=\"},\"F-69313r1_fix\",\"V-63389\",\"medium\",\"WN10-00-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",32,\"SV-77879r1_rule\",\"medium\",null,null,\"The TFTP Client must not be installed on the system.\",\"WN10-00-000120\",\"Some protocols and services do not support required security features, such as encrypting passwords or traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:B/OnPBA2G41jIXn2STFlRDpkMuzALJv21OFtakZOH9Y=\"},\"C-94065r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JKikEHNST7nGZraERoaKA0mibzuZzeNB/9NH3JyuuQ0=\"},\"F-100989r1_fix\",\"V-63393\",\"medium\",\"WN10-00-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",33,\"SV-77883r2_rule\",\"medium\",null,null,\"Software certificate installation files must be removed from Windows 10.\",\"WN10-00-000130\",\"Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fz8dkAgamwTuH5yyEwnl11W4wiTXnoygvOnaEaNj80A=\"},\"C-64147r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cA+3JZQpKpbDYPqpt+bArmFwhZxvmpRu2uDMTKnSaRI=\"},\"F-69327r1_fix\",\"V-63399\",\"medium\",\"WN10-00-000135\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",34,\"SV-77889r1_rule\",\"medium\",null,null,\"A host-based firewall must be installed and enabled on the system.\",\"WN10-00-000135\",\"A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wkHOfqgUvzr6nhiu0W8JznAIxTY88dEtZD1HETyM13Y=\"},\"C-94067r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:maSrCn/JTRi30EOHIhnTKUmRWD1TUrLuQWyxGw6bW34=\"},\"F-100991r1_fix\",\"V-63403\",\"medium\",\"WN10-00-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",35,\"SV-77893r2_rule\",\"medium\",null,null,\"Inbound exceptions to the firewall on Windows 10 domain workstations must only allow authorized remote management hosts.\",\"WN10-00-000140\",\"Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised.  Limiting inbound connections only from authorized remote management systems will help limit this exposure.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:iZIWtAKLFv0mnxWoPykNAd+yxoNoNuOAn/rsuRkGkBw=\"},\"C-74549r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jLRL3Ym/q1F3d0J4TpzAIREp+e+yRky+vjqjf9GGYaM=\"},\"F-81277r1_fix\",\"V-63405\",\"medium\",\"WN10-AC-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",36,\"SV-77895r2_rule\",\"medium\",null,null,\"Windows 10 account lockout duration must be configured to 15 minutes or greater.\",\"WN10-AC-000005\",\"The account lockout feature, when enabled, prevents brute-force password attacks on the system.   This parameter specifies the amount of time that an account will remain locked after the specified number of failed logon attempts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IeyN47N358ORV6Naa7eZ9JrcWdBvGlkKd07eHuOVVhQ=\"},\"C-64157r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5eZS64e/4nkwIBidUMYDnXVjcP3P+Q0Fa25x/nq2z1Y=\"},\"F-69337r1_fix\",\"V-63409\",\"medium\",\"WN10-AC-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",37,\"SV-77899r1_rule\",\"medium\",null,null,\"The number of allowed bad logon attempts must be configured to 3 or less.\",\"WN10-AC-000010\",\"The account lockout feature, when enabled, prevents brute-force password attacks on the system.  The higher this value is, the less effective the account lockout feature will be in protecting the local system.  The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:14aXfEafYKcgX8JWb5u3N/8DD5cx/FDR9uuxUhwPlSE=\"},\"C-64161r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MmMbe6A7LFKZ6HzPvNVdObtI5SQclsP1bclC8xe3ZvA=\"},\"F-69341r1_fix\",\"V-63413\",\"medium\",\"WN10-AC-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",38,\"SV-77903r1_rule\",\"medium\",null,null,\"The period of time before the bad logon counter is reset must be configured to 15 minutes.\",\"WN10-AC-000015\",\"The account lockout feature, when enabled, prevents brute-force password attacks on the system.  This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to 0.  The smaller this value is, the less effective the account lockout feature will be in protecting the local system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:o8VKo4BFEQi8vohXvm9npwy451RfLEpCEbuLlXnX9P4=\"},\"C-64163r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ySeUZF7neYw++ikB4UQxqpm8qej7Jy5BBVEeZPielDw=\"},\"F-69343r1_fix\",\"V-63415\",\"medium\",\"WN10-AC-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",39,\"SV-77905r2_rule\",\"medium\",null,null,\"The password history must be configured to 24 passwords remembered.\",\"WN10-AC-000020\",\"A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change a password to a unique password on a regularly scheduled basis.  This enables users to effectively negate the purpose of mandating periodic password changes.  The default value is 24 for Windows domain systems.  DoD has decided this is the appropriate value for all Windows systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OOSpmvJlTsCD444uc+1xJVXu6qS4JR7e8tmYahCVG9Q=\"},\"C-64167r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MPgQHZ8NOu+FYExJTAdPyuM60k7VNM2/HJvp0Z9aChc=\"},\"F-69347r1_fix\",\"V-63419\",\"medium\",\"WN10-AC-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",40,\"SV-77909r1_rule\",\"medium\",null,null,\"The maximum password age must be configured to 60 days or less.\",\"WN10-AC-000025\",\"The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords.   Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rtkmX+JYKFPLvLYlRGgdiaDWULPSxr3ntwT4Qq5G0gE=\"},\"C-64169r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4/1Ch5tWbxP+WIVYjouyk/HOJ0XDti4tjAN693o+91E=\"},\"F-69349r1_fix\",\"V-63421\",\"medium\",\"WN10-AC-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41,\"SV-77911r1_rule\",\"medium\",null,null,\"The minimum password age must be configured to at least 1 day.\",\"WN10-AC-000030\",\"Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database.  This enables users to effectively negate the purpose of mandating periodic password changes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gADtcufL0rvkhSygty7DNDG6rjm7eHO0Y8vlxc/cJOw=\"},\"C-64171r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OGyxCX5DTHE1ARwtV3m5eLeOpqYLijS3M8zhjRnBkzM=\"},\"F-69351r1_fix\",\"V-63423\",\"medium\",\"WN10-AC-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",42,\"SV-77913r1_rule\",\"medium\",null,null,\"Passwords must, at a minimum, be 14 characters.\",\"WN10-AC-000035\",\"Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9N++lDyFOQnR8saWfC585SvXvrRukpsO+VUybL0SJ3I=\"},\"C-64175r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TtARJnIt4fAJ70CJNv7xxjsDm7PL3wI22DNMIUqNCXg=\"},\"F-69355r1_fix\",\"V-63427\",\"medium\",\"WN10-AC-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",43,\"SV-77917r1_rule\",\"medium\",null,null,\"The built-in Microsoft password complexity filter must be enabled.\",\"WN10-AC-000040\",\"The use of complex passwords increases their strength against guessing and brute-force attacks.  This setting configures the system to verify that newly created passwords conform to the Windows password complexity policy.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YJ3a9bdA7M956htDthFs6pM+dAbD3AcqGyWDkl4iTa4=\"},\"C-64177r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VGo1Nu2SJaq9I64JszyAAHcEh0AfgVawMKsOTAwL1dk=\"},\"F-69357r1_fix\",\"V-63429\",\"high\",\"WN10-AC-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",44,\"SV-77919r1_rule\",\"high\",null,null,\"Reversible password encryption must be disabled.\",\"WN10-AC-000045\",\"Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords. For this reason, this policy must never be enabled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sDp/d6cGeheQPSyDdqeABiqG2UKTGaaxfw8wIcMeQHs=\"},\"C-64181r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aA7TirNm7zPIdrLVzY9gUwi2WnKWGnEBB1HObtUaMdg=\"},\"F-69359r1_fix\",\"V-63431\",\"medium\",\"WN10-AU-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",45,\"SV-77921r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Logon - Credential Validation failures.\",\"WN10-AU-000005\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nCredential validation records events related to validation tests on credentials for a user account logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U2zZ7WbIs6xdLIKg5f+SK3W4lP14JKnsnLrhnXtzY8A=\"},\"C-64183r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YCkv04RndmdzyZCcB6O5+KYAOvsm7/89d5qqX0GhgSQ=\"},\"F-69363r1_fix\",\"V-63435\",\"medium\",\"WN10-AU-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",46,\"SV-77925r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Logon - Credential Validation successes.\",\"WN10-AU-000010\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nCredential validation records events related to validation tests on credentials for a user account logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Wm8Z9go4ijvi1hXPZNlNfvaEeTTCHlNCHL0r4Y+YBog=\"},\"C-64193r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gg/v2f3vUfMRkCkHvHXOt9BCfQqKfFN4a8DgK+qrvsQ=\"},\"F-69373r1_fix\",\"V-63445\",\"medium\",\"WN10-AU-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",47,\"SV-77935r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Management - Security Group Management successes.\",\"WN10-AU-000030\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSecurity Group Management records events such as creating, deleting or changing of security groups, including changes in group members.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3K8Cr0W8KyJySAjHnIKhBoSL7BMlQwmSIgNxt27SU90=\"},\"C-64195r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pVd0NovBldiHaHPFa0tAv011pF2RjRALQ7tnRADE91E=\"},\"F-69375r1_fix\",\"V-63447\",\"medium\",\"WN10-AU-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",48,\"SV-77937r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Management - User Account Management failures.\",\"WN10-AU-000035\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nUser Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hFq/VN5iy8nq4TtmL91tbvNef3uqC1tTzH5qxWfTUFY=\"},\"C-64197r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/xdrvVHV4IePqacc8MtQYqmIYGMhrwIztaVynBDnuLA=\"},\"F-69377r1_fix\",\"V-63449\",\"medium\",\"WN10-AU-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",49,\"SV-77939r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Management - User Account Management successes.\",\"WN10-AU-000040\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nUser Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6OLuCTq6MxuisuBFoZTFhVa37PfJJ79XxKFbZyUXh0w=\"},\"C-64199r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qOA4YL9f41Ns4hyJL9uPQqiGJGBe7icqz/ppQklVGv0=\"},\"F-69379r1_fix\",\"V-63451\",\"medium\",\"WN10-AU-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",50,\"SV-77941r1_rule\",\"medium\",null,null,\"The system must be configured to audit Detailed Tracking - PNP Activity successes.\",\"WN10-AU-000045\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nPlug and Play activity records events related to the successful connection of external devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TRV0JYavJNEISA42NPNpnVnUp5myoEbm7eqpR1DJJFo=\"},\"C-64201r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NBU2MzWYsGPC3gi/4RxDiS7NfuwoELGkXTJaeq9BrdU=\"},\"F-69381r1_fix\",\"V-63453\",\"medium\",\"WN10-AU-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",51,\"SV-77943r1_rule\",\"medium\",null,null,\"The system must be configured to audit Detailed Tracking - Process Creation successes.\",\"WN10-AU-000050\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nProcess creation records events related to the creation of a process and the source.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BvILRXAXQabjIlzA8GIEo277mORYvfi8NWsVMyjd+bs=\"},\"C-64205r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MkFjBW+wTXKM+bVOaMTYtYSOvoBL6TyGajba0WYKVoQ=\"},\"F-69385r2_fix\",\"V-63457\",\"medium\",\"WN10-AU-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",52,\"SV-77947r2_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Group Membership successes.\",\"WN10-AU-000060\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Group Membership records information related to the group membership of a user's logon token.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2DObiHB1tJi8nMxl9dgsi2/LMp3YdlL60aFyLwFw3R4=\"},\"C-64207r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:K5M4KmaUozWIzaU+v4pu+F3Oz6hud2YaO8zive2VMNQ=\"},\"F-69387r1_fix\",\"V-63459\",\"medium\",\"WN10-AU-000065\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",53,\"SV-77951r1_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Logoff successes.\",\"WN10-AU-000065\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nLogoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:V/vAvDNZ6xrqpdV/w1nyyY3RzAUSErMEtiv1Xc/qROg=\"},\"C-64211r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ja15obCbbcDYxnTR9GfasZC2z6rW5C077asl2QRc9ig=\"},\"F-69391r1_fix\",\"V-63463\",\"medium\",\"WN10-AU-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",54,\"SV-77953r1_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Logon failures.\",\"WN10-AU-000070\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nLogon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BE/T6AoSLhPnWZOeS6illZZoNnn6TQQMBBvTmt+LfNg=\"},\"C-64215r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2tufLSka7fFObhLBDXhZmY7CFoqtM5BQkY9Xx2urDHE=\"},\"F-69395r1_fix\",\"V-63467\",\"medium\",\"WN10-AU-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",55,\"SV-77957r1_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Logon successes.\",\"WN10-AU-000075\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nLogon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HwmQqAec5Zb6el866c2comWk7ZfJ+ixTZEXIw7pzUOU=\"},\"C-64219r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RJZC6BfSuklLHfD8/AdYU36eUuB5I07rIDS9TecjKqM=\"},\"F-69399r1_fix\",\"V-63469\",\"medium\",\"WN10-AU-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",56,\"SV-77959r1_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Special Logon successes.\",\"WN10-AU-000080\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSpecial Logon records special logons which have administrative privileges and can be used to elevate processes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1acXIWzqEYhMqmAFLJ2OFPWy5wyiClFRK0blgMdIxBY=\"},\"C-79559r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zSmfHuoXc0jrD2YrzBzIQ/XZ0Y954LULEdzdIVTClMw=\"},\"F-69401r1_fix\",\"V-63471\",\"medium\",\"WN10-AU-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",57,\"SV-77961r2_rule\",\"medium\",null,null,\"The system must be configured to audit Object Access - Removable Storage failures.\",\"WN10-AU-000085\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing object access for removable media records events related to access attempts on file system objects on removable storage devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LGJqueVXVNwDFVXUpGxRZQ4Wny/BOBHeceC7sx3PXzs=\"},\"C-79561r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zqpREYRg1Kxz138PJty6cYN9gO7tgJH8CBCn0kPzqyI=\"},\"F-69403r1_fix\",\"V-63473\",\"medium\",\"WN10-AU-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",58,\"SV-77963r2_rule\",\"medium\",null,null,\"The system must be configured to audit Object Access - Removable Storage successes.\",\"WN10-AU-000090\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing object access for removable media records events related to access attempts on file system objects on removable storage devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I1vZMy69tT8kq1UjsGKufBSv8WZnqduCw713X+syDqw=\"},\"C-64229r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wKnsWqty0H9nWg2aaRDOv7IxI9QTQpCDaGjIgbj0MBQ=\"},\"F-69409r2_fix\",\"V-63479\",\"medium\",\"WN10-AU-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",59,\"SV-77969r2_rule\",\"medium\",null,null,\"The system must be configured to audit Policy Change - Audit Policy Change successes.\",\"WN10-AU-000100\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Policy Change records events related to changes in audit policy.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:W/aNcLuy+E+akBMmzfflre1wQ9pk0xdJKZ8MsmhQgJg=\"},\"C-64231r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aKP1kHP2CONM78C0dxE8QkGqPoT1aq80NDZc6RL/OBI=\"},\"F-69411r1_fix\",\"V-63481\",\"medium\",\"WN10-AU-000105\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",60,\"SV-77971r1_rule\",\"medium\",null,null,\"The system must be configured to audit Policy Change - Authentication Policy Change successes.\",\"WN10-AU-000105\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuthentication Policy Change records events related to changes in authentication policy including Kerberos policy and Trust changes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uK/4Mc8psjVa5hc9xcQ/VvM1L3p/Z2PR5oXrXVdT3AA=\"},\"C-64235r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lP2Tm71qQIYsyXZjSgjcxXH47CRJMJhyJ8U+5zDT7N0=\"},\"F-69413r1_fix\",\"V-63483\",\"medium\",\"WN10-AU-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",61,\"SV-77973r1_rule\",\"medium\",null,null,\"The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.\",\"WN10-AU-000110\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSensitive Privilege Use records events related to use of sensitive privileges, such as \\\"Act as part of the operating system\\\" or \\\"Debug programs\\\".\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ub+bzRw9nK5FMqhg0cvtHTPXc0ZoY14WwJJpfePsTU0=\"},\"C-64237r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pNLEyv3K1YNdXEba5N6YcjSqJdolvf811azquiZVsIE=\"},\"F-69417r1_fix\",\"V-63487\",\"medium\",\"WN10-AU-000115\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",62,\"SV-77977r1_rule\",\"medium\",null,null,\"The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.\",\"WN10-AU-000115\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSensitive Privilege Use records events related to use of sensitive privileges, such as \\\"Act as part of the operating system\\\" or \\\"Debug programs\\\".\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pI4rSYXdO2I17sVUgVGEC9waoXmSE152j9vxVgdtn58=\"},\"C-64241r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FlfPwFuyGa353w6vq+ReJyYvcWU+jXAQhHZmDQsabcY=\"},\"F-69421r1_fix\",\"V-63491\",\"medium\",\"WN10-AU-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",63,\"SV-77981r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - IPSec Driver failures.\",\"WN10-AU-000120\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nIPSec Driver records events related to the IPSec Driver such as dropped packets.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XjzZBXSARGyTD/PfUuDeFm28fIvcIV4qygTV08sLVKo=\"},\"C-64249r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qbnkfxvcxqsHUumpyx/QPMSvTcHG0EHf5OmWf+44R34=\"},\"F-69429r2_fix\",\"V-63499\",\"medium\",\"WN10-AU-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",64,\"SV-77989r2_rule\",\"medium\",null,null,\"The system must be configured to audit System - Other System Events successes.\",\"WN10-AU-000130\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other System Events records information related to cryptographic key operations and the Windows Firewall service.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:t6WHp+ZUHBml263lvCguGrlkMzldPXsFEy5VNUVNBrI=\"},\"C-64253r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wKOwXbSL3PoqzLvUb4JGzDXw9Mj8ree+SlnSn2RvDi0=\"},\"F-69433r2_fix\",\"V-63503\",\"medium\",\"WN10-AU-000135\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",65,\"SV-77993r2_rule\",\"medium\",null,null,\"The system must be configured to audit System - Other System Events failures.\",\"WN10-AU-000135\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other System Events records information related to cryptographic key operations and the Windows Firewall service.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Er5CsYJ2r9pG46ajyyQ8LR2k5mWoAMurGm8u9Uh/Iuw=\"},\"C-64257r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:t48oe6m1PGxij2Hfz7wB0b6JoXbXl6dq0nX27AkSkw4=\"},\"F-69437r1_fix\",\"V-63507\",\"medium\",\"WN10-AU-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",66,\"SV-77997r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - Security State Change successes.\",\"WN10-AU-000140\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSecurity State Change records events related to changes in the security state, such as startup and shutdown of the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WuYFQVOva2y1AbhfejrStyjDyv4BFq3G2voT7JCBA8Y=\"},\"C-64263r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TncMv3Jzlg2v7g/aMq6s8u8VuBYs6+jp0w8uYjkuiBc=\"},\"F-69443r1_fix\",\"V-63513\",\"medium\",\"WN10-AU-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",67,\"SV-78003r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - Security System Extension successes.\",\"WN10-AU-000150\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSecurity System Extension records events related to extension code being loaded by the security subsystem.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xgvxweAhj8P+1t428K3s8SDMbeLf2/MINiEDTjiVtRk=\"},\"C-64265r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y1Aff8aSD5qwlONaGrPOmAJVqIiaG/LHZhiOPu2pfmc=\"},\"F-69445r1_fix\",\"V-63515\",\"medium\",\"WN10-AU-000155\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",68,\"SV-78005r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - System Integrity failures.\",\"WN10-AU-000155\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSystem Integrity records events related to violations of integrity to the security subsystem.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:liPGtSRilvM45JUUHGb3NoDoAKAmonqQZH/MaCqLC/s=\"},\"C-64267r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:x6KrpOs1hxxhfHX/dlnzpNji0JTFvBRWVnCw7WX2AOE=\"},\"F-69447r1_fix\",\"V-63517\",\"medium\",\"WN10-AU-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",69,\"SV-78007r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - System Integrity successes.\",\"WN10-AU-000160\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSystem Integrity records events related to violations of integrity to the security subsystem.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DyO6WQCEJJlinj5BDeq/RINvUFeMQ73GuBqzRcFDqQQ=\"},\"C-64269r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oqaP95MfT4NLwBuXhTFAOcC96NQT8kstSKpuuSkgPwY=\"},\"F-69449r1_fix\",\"V-63519\",\"medium\",\"WN10-AU-000500\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",70,\"SV-78009r1_rule\",\"medium\",null,null,\"The Application event log size must be configured to 32768 KB or greater.\",\"WN10-AU-000500\",\"Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/3CmjRBIzvZC9yK/MCEjxBoeg+MF3xkIhnLP5Zgo/2M=\"},\"C-79597r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hCKZP4gqx2/fQTmOmUUQ561GsS0cToKGHWLnjt1JE80=\"},\"F-86735r1_fix\",\"V-63523\",\"medium\",\"WN10-AU-000505\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",71,\"SV-78013r2_rule\",\"medium\",null,null,\"The Security event log size must be configured to 1024000 KB or greater.\",\"WN10-AU-000505\",\"Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rIpcAlB/RefJGwA84BZ7ULacK5uTqcC4TpZy9gfOwdk=\"},\"C-64277r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:V/1VRJCtUyree39Mg/Yp6XswbQtFsUiWSUtW3sC4gx0=\"},\"F-69457r1_fix\",\"V-63527\",\"medium\",\"WN10-AU-000510\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",72,\"SV-78017r1_rule\",\"medium\",null,null,\"The System event log size must be configured to 32768 KB or greater.\",\"WN10-AU-000510\",\"Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Au90rsoIgKKpDJ+88Qps0bQDZf/CKYRvQpZFpv2MOUA=\"},\"C-94069r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HvM9zFQwtSYA7tWqPQldVml2FC87Y1REgJ28eU0K7h0=\"},\"F-69463r1_fix\",\"V-63533\",\"medium\",\"WN10-AU-000515\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",73,\"SV-78023r2_rule\",\"medium\",null,null,\"Windows 10 permissions for the Application event log must prevent access by non-privileged accounts.\",\"WN10-AU-000515\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Application event log may be  susceptible to tampering if proper permissions are not applied.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KvaUNjf9HpHOvMKNKYYGrc5t+RjNh70OiFd7YXyR7TI=\"},\"C-94071r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NpbK/A9boxa1fvOWbf1Chof5scXWC2vQJMszQTt1u+Y=\"},\"F-69467r1_fix\",\"V-63537\",\"medium\",\"WN10-AU-000520\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",74,\"SV-78027r2_rule\",\"medium\",null,null,\"Windows 10 permissions for the Security event log must prevent access by non-privileged accounts.\",\"WN10-AU-000520\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Security event log may disclose sensitive information or be  susceptible to tampering if proper permissions are not applied.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kwjLPtx2Qf2ICgGtbJvcwowGSS5n1iOSY0sAbgRUseA=\"},\"C-94073r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/4pSofCd9Cq60jubDSnxx+57hw8xf9384evWVHaDk+w=\"},\"F-69471r1_fix\",\"V-63541\",\"medium\",\"WN10-AU-000525\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",75,\"SV-78031r2_rule\",\"medium\",null,null,\"Windows 10 permissions for the System event log must prevent access by non-privileged accounts.\",\"WN10-AU-000525\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The System event log may be  susceptible to tampering if proper permissions are not applied.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:n/VYybwadURq9gktZ5pPv9NpPwlE/OX7X34avyRIxn0=\"},\"C-64295r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rLQmxWfvja477xAg4uFTM+6sxpkTd5/YLxzvM0Fq2FQ=\"},\"F-69475r1_fix\",\"V-63545\",\"medium\",\"WN10-CC-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",76,\"SV-78035r1_rule\",\"medium\",null,null,\"Camera access from the lock screen must be disabled.\",\"WN10-CC-000005\",\"Enabling camera access from the lock screen could allow for unauthorized use.  Requiring logon will ensure the device is only used by authorized personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wD5HvAQgiCsU2Pbe6EawPD0843pDzk9QjNocpT9i8RI=\"},\"C-64299r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9w83wkd0gVC9qElvSUtSE641xHX0nJ5OKujjokrvMSo=\"},\"F-69479r1_fix\",\"V-63549\",\"medium\",\"WN10-CC-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",77,\"SV-78039r1_rule\",\"medium\",null,null,\"The display of slide shows on the lock screen must be disabled.\",\"WN10-CC-000010\",\"Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel.  Turning off this feature will limit access to the information to a logged on user.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A6fibgthh14b9Op4gFZQuUPcG2SB+c4/OCpJZl+JW/o=\"},\"C-64305r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pZWVc24salB5/U1HmWA4W6W1HuWSlK4IR5FLuphT3/I=\"},\"F-69485r1_fix\",\"V-63555\",\"medium\",\"WN10-CC-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",78,\"SV-78045r1_rule\",\"medium\",null,null,\"IPv6 source routing must be configured to highest protection.\",\"WN10-CC-000020\",\"Configuring the system to disable IPv6 source routing protects against spoofing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QwUV9MHbwXjDlNhviMU3RJgonXD84IWB/u1SaVD04HU=\"},\"C-64309r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/gYQBG7Wcx3jx0tMxsPSgc5qqAfkxIp4WUL6Tsp5d3E=\"},\"F-69489r1_fix\",\"V-63559\",\"medium\",\"WN10-CC-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",79,\"SV-78049r1_rule\",\"medium\",null,null,\"The system must be configured to prevent IP source routing.\",\"WN10-CC-000025\",\"Configuring the system to disable IP source routing protects against spoofing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DJn8qS8Z+LUFfJVdHOYY3y3chtd5shcIjisdTgSjqYk=\"},\"C-64313r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8Uv8OZEB4zBbtzRn6Z0BsKlAlG9jeileDqxL7Ggm4ks=\"},\"F-69493r1_fix\",\"V-63563\",\"low\",\"WN10-CC-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",80,\"SV-78053r1_rule\",\"low\",null,null,\"The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.\",\"WN10-CC-000030\",\"Allowing ICMP redirect of routes can lead to traffic not being routed properly.   When disabled, this forces ICMP to be routed via shortest path first.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OLmEHTREwzxLEYjHSP9Vs9v/hFwEi7JLaoSgaF8tAzI=\"},\"C-64317r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gJpOKNLcanyruAumtszxLLcnQ/GFp8dB80gTbU8dM4Y=\"},\"F-69497r1_fix\",\"V-63567\",\"low\",\"WN10-CC-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",81,\"SV-78057r1_rule\",\"low\",null,null,\"The system must be configured to ignore NetBIOS name release requests except from WINS servers.\",\"WN10-CC-000035\",\"Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:R57XJmpmTusQFUQzPHbDgL50AUYv/vR8uoIKyz7Vpzs=\"},\"C-81357r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Wd53AX2vIP+U41A35FoDx4GW6LTTJZ8oS3Mv3hOj/AI=\"},\"F-69499r2_fix\",\"V-63569\",\"medium\",\"WN10-CC-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",82,\"SV-78059r2_rule\",\"medium\",null,null,\"Insecure logons to an SMB server must be disabled.\",\"WN10-CC-000040\",\"Insecure guest logons allow unauthenticated access to shared folders.  Shared resources on a system must require authentication to establish proper access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:61r9+JyE4FdTPKoO2j03RuHoicsSx+y5TDVRs+6Lxk8=\"},\"C-64327r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6eFOhwebc7IktMzsdu/X6CFpnwwdXDnqdPZXnULUBPY=\"},\"F-69507r1_fix\",\"V-63577\",\"medium\",\"WN10-CC-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",83,\"SV-78067r1_rule\",\"medium\",null,null,\"Hardened UNC Paths must be defined to require mutual authentication and integrity for at least the \\\\\\\\*\\\\SYSVOL and \\\\\\\\*\\\\NETLOGON shares.\",\"WN10-CC-000050\",\"Additional security requirements are applied to Universal Naming Convention (UNC) paths specified in Hardened UNC paths before allowing access them.  This aids in preventing tampering with or spoofing of connections to these paths.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vBYNU1MOZTMT14yG0uwLTnJNZd27pnHRrsvC0HPMX0s=\"},\"C-80175r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qW/yvLi6pjd31ZPwUriE4/jZaYVO9VBepn68ejyghvY=\"},\"F-87307r1_fix\",\"V-63579\",\"medium\",\"WN10-PK-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",84,\"SV-78069r4_rule\",\"medium\",null,null,\"The DoD Root CA certificates must be installed in the Trusted Root Store.\",\"WN10-PK-000005\",\"To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root Certificate Authorities (CAs). The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c4QEIcRFMsJ0fLK2itIk4vhS7BejsCbOOCX+PUzaf1o=\"},\"C-64331r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nIaCTWblFcQ8963AsTavhUs6fngasKR5TbX3Oe3Jhr4=\"},\"F-69511r1_fix\",\"V-63581\",\"medium\",\"WN10-CC-000055\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",85,\"SV-78071r2_rule\",\"medium\",null,null,\"Simultaneous connections to the Internet or a Windows domain must be limited.\",\"WN10-CC-000055\",\"Multiple network connections can provide additional attack vectors to a system and must be limited. The \\\"Minimize the number of simultaneous connections to the Internet or a Windows Domain\\\" setting prevents systems from automatically establishing multiple connections.  When both wired and wireless connections are available, for example, the less preferred connection (typically wireless) will be disconnected.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4xWh6wamWmIOeIO59RNtRdwcCFtu7mD7qVIiEWhU49I=\"},\"C-80177r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6hfbBPdICANHXibauoRbwr56X1UfaZHIVdr6tdBHtRw=\"},\"F-76981r2_fix\",\"V-63583\",\"medium\",\"WN10-PK-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",86,\"SV-78073r3_rule\",\"medium\",null,null,\"The External Root CA certificates must be installed in the Trusted Root Store on unclassified systems.\",\"WN10-PK-000010\",\"To ensure secure websites protected with External Certificate Authority (ECA) server certificates are properly validated, the system must trust the ECA Root CAs. The ECA root certificates will ensure the trust chain is established for server certificates issued from the External CAs. This requirement only applies to unclassified systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wmSMFUgwk1JCHLOyalyRfJCbYd8VKcplfwvV5bapJBY=\"},\"C-64335r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2l+idlgBtTvnKFVa9VTf4zXsNEBWfO4m8plTIhF/DyE=\"},\"F-69515r1_fix\",\"V-63585\",\"medium\",\"WN10-CC-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",87,\"SV-78075r1_rule\",\"medium\",null,null,\"Connections to non-domain networks when connected to a domain authenticated network must be blocked.\",\"WN10-CC-000060\",\"Multiple network connections can provide additional attack vectors to a system and should be limited.  When connected to a domain, communication must go through the domain connection.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FKy5u6ln+y0mzvOV4HzwGH2CwpZj3IQ2DhcZHGowfYk=\"},\"C-91397r6_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vnsW+684faBn7v70CiiRfuLg3ZjpK4esKbO68gE27us=\"},\"F-98441r5_fix\",\"V-63587\",\"medium\",\"WN10-PK-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",88,\"SV-78077r6_rule\",\"medium\",null,null,\"The DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.\",\"WN10-PK-000015\",\"To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VNS7bkHAgOyfB6SjEoQf8o+x0lzbHQcxS5EZbR1kz64=\"},\"C-91399r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zKlpVqXd27JZ5EOCpoOs1uN43E0aHvghtWtFAEWFqE0=\"},\"F-98443r4_fix\",\"V-63589\",\"medium\",\"WN10-PK-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",89,\"SV-78079r5_rule\",\"medium\",null,null,\"The US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.\",\"WN10-PK-000020\",\"To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ev+o/KN0GgLzFlT2mWhE43+O9wbhzEnibMOjO1WuHo0=\"},\"C-81355r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qpCS/S/xqllHFnTYVWBNcXOwR4c/H0d+j+1IuGA91GM=\"},\"F-88431r2_fix\",\"V-63591\",\"medium\",\"WN10-CC-000065\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",90,\"SV-78081r2_rule\",\"medium\",null,null,\"Wi-Fi Sense must be disabled.\",\"WN10-CC-000065\",\"Wi-Fi Sense automatically connects the system to known hotspots and networks that contacts have shared.  It also allows the sharing of the system's known networks to contacts.  Automatically connecting to hotspots and shared networks can expose a system to unsecured or potentially malicious systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+gNTwi6NPYxK/l/EIlkhsqMLUMX3yk8p8qOXrOuTUD8=\"},\"C-91427r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ykTGg9spp0NKYR5+ZyC3oLERNxBbzK8ql0M2w5JsGF8=\"},\"F-98471r1_fix\",\"V-63593\",\"medium\",\"WN10-RG-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",91,\"SV-78083r2_rule\",\"medium\",null,null,\"Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.\",\"WN10-RG-000005\",\"The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DgPD2H4FRf1aoEW+JdUiSywje5awdelYTOHDeJ/jku8=\"},\"C-94075r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:G6lcect0y/g9UT0Y3z0L92t2RhMCjFw4ExV2g8zRFOo=\"},\"F-74851r3_fix\",\"V-63595\",\"low\",\"WN10-CC-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",92,\"SV-78085r6_rule\",\"low\",null,null,\"Virtualization Based Security must be enabled on Windows 10 with the platform security level configured to Secure Boot or Secure Boot with DMA Protection.\",\"WN10-CC-000070\",\"Virtualization Based Security (VBS) provides the platform for the additional security features, Credential Guard and Virtualization based protection of code integrity.  Secure Boot is the minimum security level with DMA protection providing additional memory protection.  DMA Protection requires a CPU that supports input/output memory management unit (IOMMU).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZB/zbtMEaShUymYYFvs3E2/5ygQ24pqyeGDPPNJ9udg=\"},\"C-72029r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SdkFWEyc7gjSU/lmjQKEMVDHJyCAq4AuDOkoUTPQUdU=\"},\"F-78099r3_fix\",\"V-63597\",\"medium\",\"WN10-CC-000037\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",93,\"SV-78087r2_rule\",\"medium\",null,null,\"Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.\",\"WN10-CC-000037\",\"A compromised local administrator account can provide means for an attacker to move laterally between domain systems.\\n\\nWith User Account Control enabled, filtering the privileged token for built-in administrator accounts will prevent the elevated privileges of these accounts from being used over the network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PJ2hg0H5j3JxumOw1ESdMmYSago1hh7d1jPoC7NiknU=\"},\"C-94077r6_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:j63Fbih99ATORGtI1MEEIxg37mR6MGAYmAiyypVcg1E=\"},\"F-88433r2_fix\",\"V-63599\",\"high\",\"WN10-CC-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",94,\"SV-78089r9_rule\",\"high\",null,null,\"Credential Guard must be running on Windows 10 domain-joined systems.\",\"WN10-CC-000075\",\"Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. This authentication information, which was stored in the Local Security Authority (LSA) in previous versions of Windows, is isolated from the rest of operating system and can only be accessed by privileged system software.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gu4gtZX1rR01eoH7S8OImC8dbc8fZ9Js8wyj3Hq8AQA=\"},\"C-64351r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HXfLFOqu+1s5ssE/guTf0G+p+E1y4Zp/jbZafzC2X8A=\"},\"F-69531r1_fix\",\"V-63601\",\"medium\",\"WN10-SO-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",95,\"SV-78091r1_rule\",\"medium\",null,null,\"The built-in administrator account must be disabled.\",\"WN10-SO-000005\",\"The built-in administrator account is a well-known account subject to attack.  It also provides no accountability to individual administrators on a system.  It must be disabled to prevent its use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MOtPlfIGo1RyaFuE2rfSMX3os4OtOKSymnMJWGrlUXI=\"},\"C-64357r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:i6Q2heKseDABr9dNSExMDPTbOHjPMPjTHR818GtjOVE=\"},\"F-69537r5_fix\",\"V-63607\",\"medium\",\"WN10-CC-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",96,\"SV-78097r2_rule\",\"medium\",null,null,\"Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers.\",\"WN10-CC-000085\",\"By being launched first by the kernel, ELAM ( Early Launch Antimalware) is ensured to be launched before any third-party software, and is therefore able to detect malware in the boot process and prevent it from initializing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:x6lWvjXJOJaFvBJV1Zg8dV8fRzPlgg6/m3YcFFE/VLE=\"},\"C-64359r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6VXJSqwF1zyWEd3Q5/6djx7mrB1JQSvdwnOXfetGibc=\"},\"F-69539r1_fix\",\"V-63609\",\"medium\",\"WN10-CC-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",97,\"SV-78099r1_rule\",\"medium\",null,null,\"Group Policy objects must be reprocessed even if they have not changed.\",\"WN10-CC-000090\",\"Enabling this setting and then selecting the \\\"Process even if the Group Policy objects have not changed\\\" option ensures that the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3H53KZC2kWuaeW6IYY71llirhuaVVZpEWoqEEkwfsC4=\"},\"C-64361r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cZIhh4M84G9S28SE0Eimt5O7VnLgH9tIurbqqRNRzv4=\"},\"F-69541r1_fix\",\"V-63611\",\"medium\",\"WN10-SO-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",98,\"SV-78101r1_rule\",\"medium\",null,null,\"The built-in guest account must be disabled.\",\"WN10-SO-000010\",\"A system faces an increased vulnerability threat if the built-in guest account is not disabled.  This account is a known account that exists on all Windows systems and cannot be deleted.  This account is initialized during the installation of the operating system with no password assigned.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:UFrGn+U27y3pnKkpO5lkjLvaccdBipAxfmB1NDMupKc=\"},\"C-64365r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/BowXRM3tJKXibXXxqKggyjs1ejtzmV1tj5Y6tuOML0=\"},\"F-69545r1_fix\",\"V-63615\",\"medium\",\"WN10-CC-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",99,\"SV-78105r1_rule\",\"medium\",null,null,\"Downloading print driver packages over HTTP must be prevented.\",\"WN10-CC-000100\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents the computer from downloading print driver packages over HTTP.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:J5uvaJtjjYnwV4ewXXHS2Y/F1moPfjj95l8OgEmAcHg=\"},\"C-64367r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MIISVbnumAOzsSQ0LnkOmibChxPx5xKPCAOIijlVP5Y=\"},\"F-69547r1_fix\",\"V-63617\",\"medium\",\"WN10-SO-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",100,\"SV-78107r1_rule\",\"medium\",null,null,\"Local accounts with blank passwords must be restricted to prevent access from the network.\",\"WN10-SO-000015\",\"An account without a password can allow unauthorized access to a system as only the username would be required.  Password policies should prevent accounts with blank passwords from existing on a system.  However, if a local account with a blank password did exist, enabling this setting will prevent network access, limiting the account to local console logon only.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CgDvkF7Lpc1r6ZB1knUBa/Na6DAh5qTekx4xkJVDJKU=\"},\"C-64371r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YeCBg180cLlpfYI2tR2YOQnoZKTsqgA2DUoYey1lDeI=\"},\"F-69551r1_fix\",\"V-63619\",\"medium\",\"WN10-SO-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",101,\"SV-78109r1_rule\",\"medium\",null,null,\"The built-in administrator account must be renamed.\",\"WN10-SO-000020\",\"The built-in administrator account is a well-known account subject to attack.  Renaming this account to an unidentified name improves the protection of this account and the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PynI4MPELuswd9LSVn4o7lJ1Gj5XkceRgYo1jYFWcyE=\"},\"C-64369r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oU5hOUYBLIYzJj1qziKaQNZ/YLYfQl5M/74gsNYEh0A=\"},\"F-69549r1_fix\",\"V-63621\",\"medium\",\"WN10-CC-000105\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",102,\"SV-78111r1_rule\",\"medium\",null,null,\"Web publishing and online ordering wizards must be prevented from downloading a list of providers.\",\"WN10-CC-000105\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents Windows from downloading a list of providers for the Web publishing and online ordering wizards.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eHWGorFu8rp07FggxF3KQzzzIDdCofw07d6YU7EPPQg=\"},\"C-64373r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VXzJXyUcgf8hv77wrcIGqLeZvieVy1yeE+Hw1MhHtY0=\"},\"F-69553r1_fix\",\"V-63623\",\"medium\",\"WN10-CC-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",103,\"SV-78113r1_rule\",\"medium\",null,null,\"Printing over HTTP must be prevented.\",\"WN10-CC-000110\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Sp6+sZWFJ+5qIfMxuZM1X4FQ9Q3VaCCrivEnw2hO+VE=\"},\"C-64375r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JQMn5/vnaierr1Bn8RdFDmS3S/rF6buFn2nIXZkcNV8=\"},\"F-69555r1_fix\",\"V-63625\",\"medium\",\"WN10-SO-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",104,\"SV-78115r1_rule\",\"medium\",null,null,\"The built-in guest account must be renamed.\",\"WN10-SO-000025\",\"The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password.  This can allow access to system resources by unauthorized users.  Renaming this account to an unidentified name improves the protection of this account and the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1cHjpZpWasXrNs38blIHXTCAsBeBydKm/FoVbD6YN9E=\"},\"C-64377r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:V7ZlwpHZNkAvZqc5or/lGETYCwAVfpt6oCJMf/fAvo8=\"},\"F-69557r1_fix\",\"V-63627\",\"medium\",\"WN10-CC-000115\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",105,\"SV-78117r1_rule\",\"medium\",null,null,\"Systems must at least attempt device authentication using certificates.\",\"WN10-CC-000115\",\"Using certificates to authenticate devices to the domain provides increased security over passwords.  By default systems will attempt to authenticate using certificates and fall back to passwords if the domain controller does not support certificates for devices.  This may also be configured to always use certificates for device authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJyg5YyGdmvNFobvn1b619ahBQSWRDA6UUW//FX4+mk=\"},\"C-64379r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lY/eHejF7uvV0G4iI3mWusJXcTrrzEH03ruzrhvLCmo=\"},\"F-69559r1_fix\",\"V-63629\",\"medium\",\"WN10-CC-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",106,\"SV-78119r1_rule\",\"medium\",null,null,\"The network selection user interface (UI) must not be displayed on the logon screen.\",\"WN10-CC-000120\",\"Enabling interaction with the network selection UI allows users to change connections to available networks without signing into Windows.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uFh0+SOkPBhoY4cKXKJkJcnyQ6+Tp4ycDdOaJohcCxk=\"},\"C-64385r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:S3TWBmC/Q5xYvT6ZGwAqTSxXSjKl6ycojEqE2r5j7fE=\"},\"F-69565r1_fix\",\"V-63633\",\"medium\",\"WN10-CC-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",107,\"SV-78123r1_rule\",\"medium\",null,null,\"Local users on domain-joined computers must not be enumerated.\",\"WN10-CC-000130\",\"The username is one part of logon credentials that could be used to gain access to a system.  Preventing the enumeration of users limits this information to authorized personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h25vRZXLu1TOtMH5HMSKvo8N5a+Q/ueTRDZ1vspmoQE=\"},\"C-64383r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MSIOrVvh0qZYj2W996i9HW1IJqNJZEwMkJGxNuP+Muw=\"},\"F-69563r1_fix\",\"V-63635\",\"medium\",\"WN10-SO-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",108,\"SV-78125r1_rule\",\"medium\",null,null,\"Audit policy using subcategories must be enabled.\",\"WN10-SO-000030\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.  This setting allows administrators to enable more precise auditing capabilities.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XPkkPkWSdvWEzxDy2sUWix6KC7aJBbG9RBZ/ZnYOGEs=\"},\"C-64389r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:LEy76jPorTWw92lJJwWwEpX5AWnnZBJsINVU5Ic6wqw=\"},\"F-69567r1_fix\",\"V-63639\",\"medium\",\"WN10-SO-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",109,\"SV-78129r1_rule\",\"medium\",null,null,\"Outgoing secure channel traffic must be encrypted or signed.\",\"WN10-SO-000035\",\"Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted.  If this policy is enabled, outgoing secure channel traffic will be encrypted and signed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wy/VGGvzW3UlJ37hiY+I8pUms7MXbP2SNpPKfNy1KIA=\"},\"C-64393r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B6kdQ18Xgf9RP4i2hQ6xycrV4CJUF/AJ5A51qWEH8H4=\"},\"F-69573r1_fix\",\"V-63643\",\"medium\",\"WN10-SO-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",110,\"SV-78133r1_rule\",\"medium\",null,null,\"Outgoing secure channel traffic must be encrypted when possible.\",\"WN10-SO-000040\",\"Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted.  If this policy is enabled, outgoing secure channel traffic will be encrypted.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i3fRKcUyn6PmTSkp0ufLDEGZMye3xAQxD4OpV2pM+0E=\"},\"C-64395r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y1MVZH5v2L2aqAimA3zA6ZxTn0xqMdKaQ22coYGtUro=\"},\"F-69575r1_fix\",\"V-63645\",\"medium\",\"WN10-CC-000145\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",111,\"SV-78135r1_rule\",\"medium\",null,null,\"Users must be prompted for a password on resume from sleep (on battery).\",\"WN10-CC-000145\",\"Authentication must always be required when accessing a system.  This setting ensures the user is prompted for a password on resume from sleep (on battery).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/cJizcUtpE2HLtuWkhVN3GiOSFjewXuYn9IJu3enAXg=\"},\"C-64397r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rRnpzXQnQ5Wg5SL2m++bXGkzUESeCy/W5r2TeBxdxbg=\"},\"F-69577r1_fix\",\"V-63647\",\"medium\",\"WN10-SO-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",112,\"SV-78137r1_rule\",\"medium\",null,null,\"Outgoing secure channel traffic must be signed when possible.\",\"WN10-SO-000045\",\"Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked.  If this policy is enabled, outgoing secure channel traffic will be signed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xC0vDkioBtR1JLW2HOIxcJl4n0eOz6yTkhlZetuLhI8=\"},\"C-64399r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KH892YjfVsGxJYUZGSE0lrd0LppIf/7wFaiIkL6y2mw=\"},\"F-69579r1_fix\",\"V-63649\",\"medium\",\"WN10-CC-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",113,\"SV-78139r1_rule\",\"medium\",null,null,\"The user must be prompted for a password on resume from sleep (plugged in).\",\"WN10-CC-000150\",\"Authentication must always be required when accessing a system.  This setting ensures the user is prompted for a password on resume from sleep (plugged in).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NSgu6s8JKNnXMJ+7CGkFNsLqlJAeYQviKDinQTL+FHo=\"},\"C-64401r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SCyv3bW6lq4Ib1jbv9NTvnfRDTnThjV154hBBpa9mpA=\"},\"F-69581r1_fix\",\"V-63651\",\"high\",\"WN10-CC-000155\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",114,\"SV-78141r1_rule\",\"high\",null,null,\"Solicited Remote Assistance must not be allowed.\",\"WN10-CC-000155\",\"Remote assistance allows another user to view or take control of the local session of a user.  Solicited assistance is help that is specifically requested by the local user.  This may allow unauthorized parties access to the resources on the computer.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:z2vvY1cDmkJvQsHfPOfw8QGJtMOKrIQz9lM3Dc0ytLo=\"},\"C-64707r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:r1bXexq2A1T9qVaB1K5kWuqDXKMQxIjhQ7WYiQDjmxA=\"},\"F-69885r1_fix\",\"V-63653\",\"low\",\"WN10-SO-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",115,\"SV-78143r1_rule\",\"low\",null,null,\"The computer account password must not be prevented from being reset.\",\"WN10-SO-000050\",\"Computer account passwords are changed automatically on a regular basis.  Disabling automatic password changes can make the system more vulnerable to malicious access.  Frequent password changes can be a significant safeguard for your system.  A new password for the computer account will be generated every 30 days.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:14JhGWVp+3S3ydTw3+p8k3X7npjABreOsd4BluBaRyo=\"},\"C-64405r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:AJ6JG4Bk6Dmp1BoAnVEPIilP5krfqcIj8GC43w2lHpQ=\"},\"F-69585r1_fix\",\"V-63657\",\"medium\",\"WN10-CC-000165\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",116,\"SV-78147r1_rule\",\"medium\",null,null,\"Unauthenticated RPC clients must be restricted from connecting to the RPC server.\",\"WN10-CC-000165\",\"Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZJbz3VhLvqjcd2z7NP6j6DC8M0Ltzl3HDFROf1Cpu4o=\"},\"C-81359r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:D1jcVX/W+b0YHzhQERbs67mDWibaHlED0dBMhDjh+wM=\"},\"F-69587r1_fix\",\"V-63659\",\"low\",\"WN10-CC-000170\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",117,\"SV-78149r2_rule\",\"low\",null,null,\"The setting to allow Microsoft accounts to be optional for modern style apps must be enabled.\",\"WN10-CC-000170\",\"Control of credentials and the system must be maintained within the enterprise.  Enabling this setting allows enterprise credentials to be used with modern style apps that support this, instead of Microsoft accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LaaMQgJOQrkO4EB1mnVDnZdeYz6iDashNKpqfHpNCck=\"},\"C-64409r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dL89jp1SO4omws1FGgPrtRlbGuoByCOZPICM5E1jDiY=\"},\"F-69589r1_fix\",\"V-63661\",\"low\",\"WN10-SO-000055\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",118,\"SV-78151r1_rule\",\"low\",null,null,\"The maximum age for machine account passwords must be configured to 30 days or less.\",\"WN10-SO-000055\",\"Computer account passwords are changed automatically on a regular basis.  This setting controls the maximum password age that a machine account may have.  This setting must be set to no more than 30 days, ensuring the machine changes its password monthly.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ye6LltMKmAmswLhHjkhNL7Oek9ZBv20d40WEFxLqoNg=\"},\"C-64411r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sCxZiiwjgSm8OBwRBkMz35gsmx1vpXnwyeoVinYH7r0=\"},\"F-69591r1_fix\",\"V-63663\",\"low\",\"WN10-CC-000175\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",119,\"SV-78153r1_rule\",\"low\",null,null,\"The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.\",\"WN10-CC-000175\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kcyr2a0EWEiUBvmVmyDq0M6j4K7/nBHuXmLhXDDtMf0=\"},\"C-64413r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:t+sRZ4X7MaovbPwgqWxtT6hCeHZM05XnF3CRYEMVCGI=\"},\"F-69593r1_fix\",\"V-63665\",\"medium\",\"WN10-SO-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",120,\"SV-78155r1_rule\",\"medium\",null,null,\"The system must be configured to require a strong session key.\",\"WN10-SO-000060\",\"A computer connecting to a domain controller will establish a secure channel.  Requiring strong session keys enforces 128-bit encryption between systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BLkX1RSbTxRJ+95+jkVEEKAtY1YFGp7VUwcyz/Na6PU=\"},\"C-64415r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ci3qw7pjUYic7vCIX1T40x6Xh/O32MzD07IpvzY758M=\"},\"F-69595r1_fix\",\"V-63667\",\"high\",\"WN10-CC-000180\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",121,\"SV-78157r1_rule\",\"high\",null,null,\"Autoplay must be turned off for non-volume devices.\",\"WN10-CC-000180\",\"Allowing autoplay to execute may introduce malicious code to a system.  Autoplay begins reading from a drive as soon as you insert media in the drive.  As a result, the setup file of programs or music on audio media may start.  This setting will disable autoplay for non-volume devices (such as Media Transfer Protocol (MTP) devices).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mhjrBvHTfJT/OuyLZFDHWxfbvJ3FuijQKPyHh2cvxks=\"},\"C-81353r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mfhw1BAvPFkq7MsuxZE2GyQ/AevVwWiMvufEzfNp6VE=\"},\"F-88429r1_fix\",\"V-63669\",\"medium\",\"WN10-SO-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",122,\"SV-78159r2_rule\",\"medium\",null,null,\"The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.\",\"WN10-SO-000070\",\"Unattended systems are susceptible to unauthorized use and should be locked when unattended.  The screen saver should be set at a maximum of 15 minutes and be password protected.  This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/dizhsZDVZiRpJUm04AvJkfxcjGg5bvtRPbE3Iajy3s=\"},\"C-64419r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Gr1LIZVQ5mNlMy66aYVrA/OKjqKZjPX33xTO3LoND90=\"},\"F-69599r1_fix\",\"V-63671\",\"high\",\"WN10-CC-000185\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",123,\"SV-78161r1_rule\",\"high\",null,null,\"The default autorun behavior must be configured to prevent autorun commands.\",\"WN10-CC-000185\",\"Allowing autorun commands to execute may introduce malicious code to a system.  Configuring this setting prevents autorun commands from executing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CffkXvxske/bT7jvs4za5BpRLmJrKhgTOflYgSJF+X8=\"},\"C-64423r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:IUYeFsIgc0Up3cMziGmWNHQALhhDmlYfxEV3mw5cFBY=\"},\"F-69603r1_fix\",\"V-63673\",\"high\",\"WN10-CC-000190\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",124,\"SV-78163r1_rule\",\"high\",null,null,\"Autoplay must be disabled for all drives.\",\"WN10-CC-000190\",\"Allowing autoplay to execute may introduce malicious code to a system.  Autoplay begins reading from a drive as soon as you insert media in the drive.  As a result, the setup file of programs or music on audio media may start.  By default, autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives.  If you enable this policy, you can also disable autoplay on all drives.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XgzulLjMBxHaNi0V9FHGyZ4It0yWcGbG1JwlFE+T+gk=\"},\"C-64421r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:98laJ6VbZ66jMMUQv5GDvBJWVZDOUd4XtWFuq8asTIo=\"},\"F-69601r2_fix\",\"V-63675\",\"medium\",\"WN10-SO-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",125,\"SV-78165r2_rule\",\"medium\",null,null,\"The required legal notice must be configured to display before console logon.\",\"WN10-SO-000075\",\"Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OHgYhVcmu/l9dVrJ0J5Uo4d4+lLD5rAkwUYwACRT+m0=\"},\"C-81361r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:inbVIW+zQG3/ufZ8fCHtpsqygHo1uhE9Z0Shi7JWHpw=\"},\"F-88435r1_fix\",\"V-63677\",\"medium\",\"WN10-CC-000195\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",126,\"SV-78167r3_rule\",\"medium\",null,null,\"Enhanced anti-spoofing for facial recognition must be enabled on Window 10.\",\"WN10-CC-000195\",\"Enhanced anti-spoofing provides additional protections when using facial recognition with devices that support it.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ofnzmLY6Mws9d7/NtnKBQB4fhzW4stZa4Q8pqud3RuA=\"},\"C-64429r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eLSnY8PHloz7mHtwdf09lPI2PMpuTsKmw/S+HhFSiGg=\"},\"F-69607r1_fix\",\"V-63679\",\"medium\",\"WN10-CC-000200\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",127,\"SV-78169r1_rule\",\"medium\",null,null,\"Administrator accounts must not be enumerated during elevation.\",\"WN10-CC-000200\",\"Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user.  This setting configures the system to always require users to type in a username and password to elevate a running application.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PHPF3Sy5sq6u5phRafA9yRglmtGg7XcKsUmsucub7jI=\"},\"C-64427r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gIHgnFLTdgMMsxBcIBxDElwInOkJE+8HJcwwDdRpq1w=\"},\"F-69609r1_fix\",\"V-63681\",\"low\",\"WN10-SO-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",128,\"SV-78171r1_rule\",\"low\",null,null,\"The Windows dialog box title for the legal banner must be configured.\",\"WN10-SO-000080\",\"Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:32jv43ZfzeffcLH0aNzUt/YSBnCyNLyRuby1CRN3yVw=\"},\"C-81949r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PzcejMlMlof9m/YZ/3j1NJUegoGppEgEiwd19VfFIm8=\"},\"F-89003r2_fix\",\"V-63683\",\"medium\",\"WN10-CC-000205\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",129,\"SV-78173r3_rule\",\"medium\",null,null,\"Windows Telemetry must not be configured to Full.\",\"WN10-CC-000205\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The \\\"Security\\\" option for Telemetry configures the lowest amount of data, effectively none outside of the Malicious Software Removal Tool (MSRT), Defender and telemetry client settings. \\\"Basic\\\" sends basic diagnostic and usage data and may be required to support some Microsoft services. \\\"Enhanced\\\" includes additional information on how Windows and apps are used and advanced reliability data. Windows Analytics can use a \\\"limited enhanced\\\" level to provide information such as health data for devices.  This requires the configuration of an additional setting available with v1709 and later of Windows 10. \",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SoCQzVKKVy7D5huRMI4Q7iyWO6PyUB9uG8vv4geQuQA=\"},\"C-91419r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jQ03pjP3CjGlYCQ/xCpujUMyYmW/fh9NqhCgqPd06zo=\"},\"F-98461r1_fix\",\"V-63685\",\"medium\",\"WN10-CC-000210\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",130,\"SV-78175r6_rule\",\"medium\",null,null,\"The Windows Defender SmartScreen for Explorer must be enabled.\",\"WN10-CC-000210\",\"Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling Windows Defender SmartScreen will warn or prevent users from running potentially malicious programs.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OtsqfrQg9GojUClvvmL4jzwvRg7kIHzjol+WcskfN8k=\"},\"C-64433r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+8vO2vy7uTxR2XHqPadadMrjS2Rni8BOSZVXO6X2Avk=\"},\"F-69615r1_fix\",\"V-63687\",\"low\",\"WN10-SO-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",131,\"SV-78177r1_rule\",\"low\",null,null,\"Caching of logon credentials must be limited.\",\"WN10-SO-000085\",\"The default Windows configuration caches the last logon credentials for users who log on interactively to a system.  This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable.  Even though the credential cache is well-protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pwvSQ+QN5KMngq6whT389oqgH7svUP44geVmJrGKA/Y=\"},\"C-64437r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:i2FiglDJfXybGpBxBjVYKAGi+YYUMg5nL518GU9EkhY=\"},\"F-69617r1_fix\",\"V-63689\",\"medium\",\"WN10-CC-000215\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",132,\"SV-78179r1_rule\",\"medium\",null,null,\"Explorer Data Execution Prevention must be enabled.\",\"WN10-CC-000215\",\"Data Execution Prevention (DEP) provides additional protection by performing  checks on memory to help prevent malicious code from running.  This setting will prevent Data Execution Prevention from being turned off for File Explorer.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FNuzYuatOsVqoAEfYyh44rPDU4p+dXmH2F/22ijPNG8=\"},\"C-72013r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dad3JOoYi4XhqeCDfFPaRfjDET/qOlbEcf8JrcuFYnU=\"},\"F-78109r3_fix\",\"V-63691\",\"low\",\"WN10-CC-000220\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",133,\"SV-78181r3_rule\",\"low\",null,null,\"Turning off File Explorer heap termination on corruption must be disabled.\",\"WN10-CC-000220\",\"Legacy plug-in applications may continue to function when a File Explorer session has become corrupt.  Disabling this feature will prevent this.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ka0gdKnu1i6pDqDBmfSv/etIgqsSnYvxwHo6vjDl/lA=\"},\"C-64443r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8iVJn6AEeEs7abM6FXII1UWcGL2f5acmsBIocVJzJ74=\"},\"F-69623r1_fix\",\"V-63695\",\"medium\",\"WN10-CC-000225\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",134,\"SV-78185r1_rule\",\"medium\",null,null,\"File Explorer shell protocol must run in protected mode.\",\"WN10-CC-000225\",\"The shell protocol will  limit the set of folders applications can open when run in protected mode.  Restricting files an application can open, to a limited set of folders, increases the security of Windows.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v8lM7FP7aQdAEqhdWAElG8v5N9aKZNjsXI3sO16UBJ8=\"},\"C-64445r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cjPwupCSR0TrHEYD/6TMlvONcdLHPWcCMHuTwwt9ubw=\"},\"F-69625r1_fix\",\"V-63697\",\"medium\",\"WN10-SO-000095\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",135,\"SV-78187r1_rule\",\"medium\",null,null,\"The Smart Card removal option must be configured to Force Logoff or Lock Workstation.\",\"WN10-SO-000095\",\"Unattended systems are susceptible to unauthorized use and must be locked.  Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nBBbWUKMYR0oBuDR1T1+MwPCSPwa/PvvTXckuCFHxcY=\"},\"C-79101r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B9S7hFWHqEWN+xF+QGr88dcbc2DFAnUZfPLb3qgLQUE=\"},\"F-98463r1_fix\",\"V-63699\",\"medium\",\"WN10-CC-000230\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",136,\"SV-78189r6_rule\",\"medium\",null,null,\"Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for malicious websites in Microsoft Edge.\",\"WN10-CC-000230\",\"The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites and file downloads.  If users are allowed to ignore warnings from the Windows Defender SmartScreen filter they could still access malicious websites.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nWoWY5Y4H2PjarlDCeZzumdmSKNqLLbQWB6PRDqTQik=\"},\"C-79105r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5BF6ShWtQQz6m2f5qGYgXrEcVyiHrphKl41vORKvwJo=\"},\"F-98465r1_fix\",\"V-63701\",\"medium\",\"WN10-CC-000235\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",137,\"SV-78191r6_rule\",\"medium\",null,null,\"Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for unverified files in Microsoft Edge.\",\"WN10-CC-000235\",\"The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites and file downloads.  If users are allowed to ignore warnings from the Windows Defender SmartScreen filter they could still download potentially malicious files.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YHHxKYwoRYjDWym4IH18cuhmeP93GyehRyGY9+eWOlM=\"},\"C-64451r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4OStpL8M7nd4yILh53YYVghkFMSc6KpjP7exx+P68bw=\"},\"F-69629r1_fix\",\"V-63703\",\"medium\",\"WN10-SO-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",138,\"SV-78193r1_rule\",\"medium\",null,null,\"The Windows SMB client must be configured to always perform SMB packet signing.\",\"WN10-SO-000100\",\"The server message block (SMB) protocol provides the basis for many network operations.  Digitally signed SMB packets aid in preventing man-in-the-middle attacks.  If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Vnj02lH1OuXdBOVVSKAmO3ADzTn5+Ujz8I1pVPj59vU=\"},\"C-79113r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:t8fAWmoC9793q7yjTkKodZAFyvN8+EQyAnQ3eKujeO8=\"},\"F-83245r1_fix\",\"V-63709\",\"medium\",\"WN10-CC-000245\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",139,\"SV-78199r4_rule\",\"medium\",null,null,\"The password manager function in the Edge browser must be disabled.\",\"WN10-CC-000245\",\"Passwords save locally for re-use when browsing may be subject to compromise.  Disabling the Edge password manager will prevent this for the browser.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I1hZ4Drt9YDDg3F9ZAzn33a90Yrg1/tAw/QcCCksE3A=\"},\"C-64459r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Tg8MEMQePeMwS+qS8PbB/4y6EDpxaFlUaj84ph6zmG4=\"},\"F-69639r1_fix\",\"V-63711\",\"medium\",\"WN10-SO-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",140,\"SV-78201r1_rule\",\"medium\",null,null,\"Unencrypted passwords must not be sent to third-party SMB Servers.\",\"WN10-SO-000110\",\"Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication.  Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment.  Check with the vendor of the SMB server to see if there is a way to support encrypted password authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2biNxxxfwe7Qz0rZRb+comoTPxV6tZ2FWyVQ8NR0XLI=\"},\"C-79115r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hTbZqwZ4fsK7/V09FctidZHUoPHmeOqxSidCPX6IxrM=\"},\"F-98467r1_fix\",\"V-63713\",\"medium\",\"WN10-CC-000250\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",141,\"SV-78203r6_rule\",\"medium\",null,null,\"The Windows Defender SmartScreen filter for Microsoft Edge must be enabled.\",\"WN10-CC-000250\",\"The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:K8//OPyNM3tMbqVbeoAI5KxKu5UgN3dLo2qeJqTTARk=\"},\"C-79119r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:p49q6xq7593kHJDfmQQpw38MtEgtBNAo+DiVb+PZ8PQ=\"},\"F-83247r2_fix\",\"V-63717\",\"medium\",\"WN10-CC-000255\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",142,\"SV-78207r5_rule\",\"medium\",null,null,\"The use of a hardware security device with Windows Hello for Business must be enabled.\",\"WN10-CC-000255\",\"The use of a Trusted Platform Module (TPM) to store keys for Windows Hello for Business provides additional security.  Keys stored in the TPM may only be used on that system while keys stored using software are more susceptible to compromise and could be used on other systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m4mVWgszCk8aLeRg9wcZWG+Rs/f7KjQGvMB6lRJ5A+M=\"},\"C-64467r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TlsXbmbT8RHk4qTd4l7iQC/kxVlACAHUoUo7IBK62Ag=\"},\"F-69647r1_fix\",\"V-63719\",\"medium\",\"WN10-SO-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",143,\"SV-78209r1_rule\",\"medium\",null,null,\"The Windows SMB server must be configured to always perform SMB packet signing.\",\"WN10-SO-000120\",\"The server message block (SMB) protocol provides the basis for many network operations.  Digitally signed SMB packets aid in preventing man-in-the-middle attacks.  If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GJyj8KhT2aDTkrVyy9e0G2Fw3bcs2GwK50H4fhiljcA=\"},\"C-64469r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2vvlS11rewnsG4aJFvEFbTIXj6FDxFe+II7GRviyH8Y=\"},\"F-98469r2_fix\",\"V-63721\",\"medium\",\"WN10-CC-000260\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",144,\"SV-78211r6_rule\",\"medium\",null,null,\"Windows 10 must be configured to require a minimum pin length of six characters or greater.\",\"WN10-CC-000260\",\"Windows allows the use of PINs as well as biometrics for authentication without sending a password to a network or website where it could be compromised.  Longer minimum PIN lengths increase the available combinations an attacker would have to attempt.  Shorter minimum length significantly reduces the strength.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RzUSnNAkaFL0vjIzRXyocD/1metNOIhllvi1eHyUE/0=\"},\"C-64479r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:seII/mAuw6P+r2G+ksL9Z1Aks3FE2FZ6U+SN6Gtn1r4=\"},\"F-69657r1_fix\",\"V-63729\",\"medium\",\"WN10-CC-000270\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",145,\"SV-78219r1_rule\",\"medium\",null,null,\"Passwords must not be saved in the Remote Desktop Client.\",\"WN10-CC-000270\",\"Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system.  The system must be configured to prevent users from saving passwords in the Remote Desktop Client.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9Pbb8VW3GGoFqiMEMNsF6+ETyP17aJ7LEE/EwiZmXLY=\"},\"C-64481r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FLcKXmX9gyKTpr/8udHNEwcKZ4rFm5s3IrSYYuIhZio=\"},\"F-69659r1_fix\",\"V-63731\",\"medium\",\"WN10-CC-000275\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",146,\"SV-78221r1_rule\",\"medium\",null,null,\"Local drives must be prevented from sharing with Remote Desktop Session Hosts.\",\"WN10-CC-000275\",\"Preventing users from sharing the local drives on their client computers to Remote Session Hosts that they access helps reduce possible exposure of sensitive data.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pOkacn9XsLUUPvPCp7BiIdMobs3MmyoiiFdmo2S1Jh4=\"},\"C-64483r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VvnnQJPqecT+hGCdyEjfV7HVGJGunhW9nSTQ3QH37Ig=\"},\"F-69661r1_fix\",\"V-63733\",\"medium\",\"WN10-CC-000280\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",147,\"SV-78223r1_rule\",\"medium\",null,null,\"Remote Desktop Services must always prompt a client for passwords upon connection.\",\"WN10-CC-000280\",\"This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection.  Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:db4NX5ePYijTdjIZhHi6AMQwXOH25jy1YMRAOPp6z8o=\"},\"C-64487r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RM0/gj1Qt707JlUYlmbLvA1fy/6G/giJ85DeOs8B6dc=\"},\"F-69665r1_fix\",\"V-63737\",\"medium\",\"WN10-CC-000285\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",148,\"SV-78227r1_rule\",\"medium\",null,null,\"The Remote Desktop Session Host must require secure RPC communications.\",\"WN10-CC-000285\",\"Allowing unsecure RPC communication exposes the system to man in the middle attacks and data disclosure attacks. A man in the middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5oFtb8E3qwiXU282gaObtdqYpKDg1HKwTV1n0yGLwdM=\"},\"C-64489r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9sj/XY7wTDukfNd098czduTVWQutMeqhJuSaISLQsag=\"},\"F-69667r1_fix\",\"V-63739\",\"high\",\"WN10-SO-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",149,\"SV-78229r1_rule\",\"high\",null,null,\"Anonymous SID/Name translation must not be allowed.\",\"WN10-SO-000140\",\"Allowing anonymous SID/Name translation can provide sensitive information for accessing a system.  Only authorized users must be able to perform such translations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XK40On1j1swkBQC4KHrqqKtA3+PU7O8didBZ9X2v3mU=\"},\"C-64491r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9UXyqEvrfJKY1Z3d2vJfrn9DoiXbrUvbEcBkOzErot8=\"},\"F-69669r1_fix\",\"V-63741\",\"medium\",\"WN10-CC-000290\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",150,\"SV-78231r1_rule\",\"medium\",null,null,\"Remote Desktop Services must be configured with the client connection encryption set to the required level.\",\"WN10-CC-000290\",\"Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting \\\"High Level\\\" will ensure encryption of Remote Desktop Services sessions in both directions.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D+Br9Bp34FIbXISTUzTyziluj9wIh2NeP3T7rqIlBeU=\"},\"C-64495r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:yKSPAaHSRXGDmYNqGS2PbbzeQyT5KHe1NkItcInDozg=\"},\"F-69671r1_fix\",\"V-63743\",\"medium\",\"WN10-CC-000295\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",151,\"SV-78233r1_rule\",\"medium\",null,null,\"Attachments must be prevented from being downloaded from RSS feeds.\",\"WN10-CC-000295\",\"Attachments from RSS feeds may not be secure.  This setting will prevent attachments from being downloaded from RSS feeds.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:q4amaRBeQBzWaWDuh+jg7+M6Q2vE1slnyWZ9vRYL1BU=\"},\"C-64493r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:80tL2NQiJzWA+nvWYN6N/dITCvP4z3gJpjfnPCQLSx0=\"},\"F-69673r1_fix\",\"V-63745\",\"high\",\"WN10-SO-000145\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",152,\"SV-78235r1_rule\",\"high\",null,null,\"Anonymous enumeration of SAM accounts must not be allowed.\",\"WN10-SO-000145\",\"Anonymous enumeration of SAM accounts allows anonymous log on users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2hvdFSkHFd/jxnDg7QHAFnPQALuFWOVvLZGgRROj5l8=\"},\"C-64497r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kHkfZTI+A4AbE13Gdmo2ILJcZzgniSLt8HUZ5HyExjw=\"},\"F-69675r1_fix\",\"V-63747\",\"medium\",\"WN10-CC-000300\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",153,\"SV-78237r1_rule\",\"medium\",null,null,\"Basic authentication for RSS feeds over HTTP must not be used.\",\"WN10-CC-000300\",\"Basic authentication uses plain text passwords that could be used to compromise a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PH+4N2yTf3KYeI3LzoMmv9I7NMVl4gENYVtdt5aHEQ4=\"},\"C-64499r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YJU6GsJ3MJkZ8CijAZUKemQUh76XEXi6kyN5hwgRL4k=\"},\"F-69677r1_fix\",\"V-63749\",\"high\",\"WN10-SO-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",154,\"SV-78239r1_rule\",\"high\",null,null,\"Anonymous enumeration of shares must be restricted.\",\"WN10-SO-000150\",\"Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MT/QRJ+7T5KdEYjB1CflYUeHypJvbgQA/NoSivDno44=\"},\"C-64501r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ouSnIupvvqC0crPccT7gBXrFmsWkb2i86WiVIUjCbqs=\"},\"F-69679r1_fix\",\"V-63751\",\"medium\",\"WN10-CC-000305\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",155,\"SV-78241r1_rule\",\"medium\",null,null,\"Indexing of encrypted files must be turned off.\",\"WN10-CC-000305\",\"Indexing of encrypted files may expose sensitive data.  This setting prevents encrypted files from being indexed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PPMakW1bUBUuTQXNZEWFXjV3n8bqxzcAep6WCv0LA6I=\"},\"C-64505r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CIxgreCun2hEbE39zaL6XRLXsvYRN0yNWQFu3yL064E=\"},\"F-69683r1_fix\",\"V-63755\",\"medium\",\"WN10-SO-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",156,\"SV-78245r1_rule\",\"medium\",null,null,\"The system must be configured to prevent anonymous users from having the same rights as the Everyone group.\",\"WN10-SO-000160\",\"Access by anonymous users must be restricted.  If this setting is enabled, then anonymous users have the same rights and permissions as the built-in Everyone group.  Anonymous users must not have these permissions or rights.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+CqVPSzadLgqURUz9jpa2vfnE9s9rDLe5PbBuASRgh0=\"},\"C-64509r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lmEqFepqElh4JHMGSs+lVIjqQ7WBg0SLMTdPF7FkJuo=\"},\"F-69687r1_fix\",\"V-63759\",\"high\",\"WN10-SO-000165\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",157,\"SV-78249r1_rule\",\"high\",null,null,\"Anonymous access to Named Pipes and Shares must be restricted.\",\"WN10-SO-000165\",\"Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access.  This setting restricts access to those defined in \\\"Network access: Named Pipes that can be accessed anonymously\\\" and \\\"Network access: Shares that can be accessed anonymously\\\",  both of which must be blank under other requirements.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m79WMkHt8ZOH03cNAv+YgwDxku23Nclna/dukfCHBwE=\"},\"C-64517r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/pAKglnnL1IEuLqBC+c6SyiwacUUiL1rDYa3onzxiNc=\"},\"F-69693r1_fix\",\"V-63765\",\"medium\",\"WN10-SO-000180\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",158,\"SV-78255r1_rule\",\"medium\",null,null,\"NTLM must be prevented from falling back to a Null session.\",\"WN10-SO-000180\",\"NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bu7KdaDw/5/s3TIiuDAAhnNsO3EvwivuJyQ8TxBRC2k=\"},\"C-64519r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:L0C4ySCZnL+TtFW8F+lv8g72upyUuF1Zn/Zw3K0bzl0=\"},\"F-69695r1_fix\",\"V-63767\",\"medium\",\"WN10-SO-000185\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",159,\"SV-78257r1_rule\",\"medium\",null,null,\"PKU2U authentication using online identities must be prevented.\",\"WN10-SO-000185\",\"PKU2U is a peer-to-peer authentication protocol.   This setting prevents online identities from authenticating to domain-joined systems.  Authentication will be centrally managed with Windows user accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WBduyUoS7ji0lJWOQsFV1TVIPhzv+GArzEJ9SaioyCg=\"},\"C-64545r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TGki+/+ykJXJ/k/DudIIisxNEy93XM3iv0yGY2fiKO8=\"},\"F-69723r2_fix\",\"V-63795\",\"medium\",\"WN10-SO-000190\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",160,\"SV-78285r1_rule\",\"medium\",null,null,\"Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.\",\"WN10-SO-000190\",\"Certain encryption types are no longer considered secure.  This setting configures a minimum encryption type for Kerberos, preventing the use of the DES and RC4 encryption suites.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:esvIIQzIXuuV6UAZCui3VcV9VGJeNpc//UNi3KoTS1w=\"},\"C-64547r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1Cv95OKFzyvZ4bRINC7Cv4fXGMtlaacMtNSowP9y7Ao=\"},\"F-69725r1_fix\",\"V-63797\",\"high\",\"WN10-SO-000195\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",161,\"SV-78287r1_rule\",\"high\",null,null,\"The system must be configured to prevent the storage of the LAN Manager hash of passwords.\",\"WN10-SO-000195\",\"The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords.  This setting controls whether or not a LAN Manager hash of the password is stored in the SAM the next time the password is changed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5qXivRds1q8g/9HnQ9nxJHz6twXtapACZhIt29psYMg=\"},\"C-64551r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0wdY1oOmLJZYVMb3ewPDolyocCYSxXOPJ+0XcVfOE5o=\"},\"F-69729r1_fix\",\"V-63801\",\"high\",\"WN10-SO-000205\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",162,\"SV-78291r1_rule\",\"high\",null,null,\"The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.\",\"WN10-SO-000205\",\"The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts.  NTLM, which is less secure, is retained in later Windows versions  for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it.  It is also used to authenticate logons to stand-alone computers that are running later versions.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YGadfMPpS3VMGBFW+r3ZcBbI9dYCCdc/zyMG4vKxtCU=\"},\"C-64553r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:UfsUJ6+QhNp9kcpFKuqZcTmy3ALjhtMSAGFmNACo9AY=\"},\"F-69731r1_fix\",\"V-63803\",\"medium\",\"WN10-SO-000210\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",163,\"SV-78293r1_rule\",\"medium\",null,null,\"The system must be configured to the required LDAP client signing level.\",\"WN10-SO-000210\",\"This setting controls the signing requirements for LDAP clients.  This setting must be set to Negotiate signing or Require signing, depending on the environment and type of LDAP server in use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wPbkf7isP1x09ZPgzKuJL8TtdkHaTA1/d8tDtGfpybs=\"},\"C-64555r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1+ExGyHoKNbg9f2hPevtLVyViy0jw9P1CLvJYNnLXyA=\"},\"F-69733r1_fix\",\"V-63805\",\"medium\",\"WN10-SO-000215\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",164,\"SV-78295r1_rule\",\"medium\",null,null,\"The system must be configured to meet the minimum session security requirement for NTLM SSP based clients.\",\"WN10-SO-000215\",\"Microsoft has implemented a variety of security support providers for use with RPC sessions.  All of the options must be enabled to ensure the maximum security level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gvDKD+YMxXb3Dbh+NdpQ/LmlaxOytN56P+kbBAhz7EA=\"},\"C-64557r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cx68iW81VjvTZ8JCOTGJY+ZkDwZAyi58zqvh9W0D+oY=\"},\"F-69735r1_fix\",\"V-63807\",\"medium\",\"WN10-SO-000220\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",165,\"SV-78297r1_rule\",\"medium\",null,null,\"The system must be configured to meet the minimum session security requirement for NTLM SSP based servers.\",\"WN10-SO-000220\",\"Microsoft has implemented a variety of security support providers for use with RPC sessions.  All of the options must be enabled to ensure the maximum security level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QgLpxb9vltYJFW7KY8eBS23IB732VOg5sO/3heYiTSY=\"},\"C-64561r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:93DcQLMka1EstIPvjGFGOJ5foKzfD1YZE+HUfIx9paw=\"},\"F-69739r1_fix\",\"V-63811\",\"medium\",\"WN10-SO-000230\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",166,\"SV-78301r1_rule\",\"medium\",null,null,\"The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.\",\"WN10-SO-000230\",\"This setting ensures that the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing.  FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QiljZhB01LqOQfbiDH4gdszZSQwiokE7rvHMNETmntI=\"},\"C-64565r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dCyIjTSOsteLs196W+MDtMhL8jnRdoLpKwA+nvvWzmg=\"},\"F-69743r1_fix\",\"V-63815\",\"low\",\"WN10-SO-000240\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",167,\"SV-78305r1_rule\",\"low\",null,null,\"The default permissions of global system objects must be increased.\",\"WN10-SO-000240\",\"Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. If this policy is enabled, the default DACL is stronger, allowing non-admin users to read shared objects, but not modify shared objects that they did not create.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9xKCBYF3X03GOrS60NZkKP1tRU65uLNh/SvSEhv7qzY=\"},\"C-64567r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1f85JbcxwG6eJsI6OJtbVtsrFjIPElpHt9NkyJmdOBc=\"},\"F-69745r1_fix\",\"V-63817\",\"medium\",\"WN10-SO-000245\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",168,\"SV-78307r1_rule\",\"medium\",null,null,\"User Account Control approval mode for the built-in Administrator must be enabled.\",\"WN10-SO-000245\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures the built-in Administrator account so that it runs in Admin Approval Mode.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6anIfcvLd9P3Qqj21QYsvMEK1vkh6OjqA8kxfY/qKRI=\"},\"C-64569r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:m0c1pC4N9864TRC68Ar0oJjxRt++R+ocV6OA/6pOhUQ=\"},\"F-69747r1_fix\",\"V-63819\",\"medium\",\"WN10-SO-000250\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",169,\"SV-78309r1_rule\",\"medium\",null,null,\"User Account Control must, at minimum, prompt administrators for consent on the secure desktop.\",\"WN10-SO-000250\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures the elevation requirements for logged on administrators to complete a task that requires raised privileges.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2Mf6LpRtxqJ2Xi014C6XdUKrfkVm1If47khfoSg5IPk=\"},\"C-64571r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:N/o1L9Q+AUc8QsP9dAiLMwg8rm0IExtcCSPzA1bf5Po=\"},\"F-69749r1_fix\",\"V-63821\",\"medium\",\"WN10-SO-000255\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",170,\"SV-78311r1_rule\",\"medium\",null,null,\"User Account Control must automatically deny elevation requests for standard users.\",\"WN10-SO-000255\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  Denying elevation requests from standard user accounts requires tasks that need elevation to be initiated by accounts with administrative privileges.  This ensures correct accounts are used on the system for privileged tasks to help mitigate credential theft.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xIxQC3EFtKo4/I03k/uVVwqUkFC9effmNV1HiiiVNas=\"},\"C-64575r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:c3FJiPcRTQKsbimXW346V6o1aEmBxxUjtvc6xMkzBuk=\"},\"F-69753r1_fix\",\"V-63825\",\"medium\",\"WN10-SO-000260\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",171,\"SV-78315r1_rule\",\"medium\",null,null,\"User Account Control must be configured to detect application installations and prompt for elevation.\",\"WN10-SO-000260\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting requires Windows to respond to application installation requests by prompting for credentials.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8HK3jPasJRJpBZDqSPFQU1vxUyg5+aAI6SAka9PPlvc=\"},\"C-64577r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9i1/CQ1T55XT7+qRqaJr58Gz7WiZB48LYgpipcVwl8Y=\"},\"F-69755r1_fix\",\"V-63827\",\"medium\",\"WN10-SO-000265\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",172,\"SV-78317r1_rule\",\"medium\",null,null,\"User Account Control must only elevate UIAccess applications that are installed in secure locations.\",\"WN10-SO-000265\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\\\\System32 folders, to run with elevated privileges.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TXh7CT8eDFg9PQd3GuTWW0B0BM4p6bzG9FF1T+9Vv8s=\"},\"C-64579r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:A7Xg19vCL5Q1xW+Fj+Az/f5vpJcs5u/SrRq9BClkS1w=\"},\"F-69757r1_fix\",\"V-63829\",\"medium\",\"WN10-SO-000270\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",173,\"SV-78319r1_rule\",\"medium\",null,null,\"User Account Control must run all administrators in Admin Approval Mode, enabling UAC.\",\"WN10-SO-000270\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting enables UAC.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jTdDk2qrsY7wk2fxd9JsCbcokx4k7p+QSN/VYmbUB9k=\"},\"C-64581r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Xl6F0faD877NphGnac4TlBR9h7CQODCKRBJEbkazvZw=\"},\"F-69759r1_fix\",\"V-63831\",\"medium\",\"WN10-SO-000275\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",174,\"SV-78321r1_rule\",\"medium\",null,null,\"User Account Control must virtualize file and registry write failures to per-user locations.\",\"WN10-SO-000275\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures non-UAC compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ps+f+j5cOJetWmfgZFHPTjOUfHH002d19GW01SZ35RY=\"},\"C-64589r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kTK1HAiRWb7wh2x/972MVh76uwhKv3aK9KX756oAZUQ=\"},\"F-69767r1_fix\",\"V-63839\",\"low\",\"WN10-UC-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",175,\"SV-78329r1_rule\",\"low\",null,null,\"Toast notifications to the lock screen must be turned off.\",\"WN10-UC-000015\",\"Toast notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel.  Turning off this feature will limit access to the information to a logged on user.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:31JR/6WQp6TuKxIQqNorrp6RBoUM0yhGJ95MVdPpzUw=\"},\"C-72015r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5Ot0vgTp8BQIqeYRzGXU6jF6SmJwLU7WpTomfAop3sk=\"},\"F-78717r1_fix\",\"V-63841\",\"medium\",\"WN10-UC-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",176,\"SV-78331r2_rule\",\"medium\",null,null,\"Zone information must be preserved when saving attachments.\",\"WN10-UC-000020\",\"Preserving zone of origin (internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4Q6F4dio1jN4MtIZbfGfkZnYkN6zfJazb6nB793l6nQ=\"},\"C-64593r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0P5EtYikbUi9E8oJtKWDfYRy9/apYtbEE8kRho3lm2s=\"},\"F-69771r1_fix\",\"V-63843\",\"medium\",\"WN10-UR-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",177,\"SV-78333r1_rule\",\"medium\",null,null,\"The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.\",\"WN10-UR-000005\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Access Credential Manager as a trusted caller\\\" user right may be able to retrieve the credentials of other accounts from Credential Manager.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:at5fqeVaC1Sm9FnXQjZ7YLh8ehuVr9z5FoeJZMIMABA=\"},\"C-78091r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dkn7S+ZGNYR6EDPqRbNd2XSN1OwzgDnpb8htRCC7PzI=\"},\"F-81289r1_fix\",\"V-63845\",\"medium\",\"WN10-UR-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",178,\"SV-78335r3_rule\",\"medium\",null,null,\"The Access this computer from the network user right must only be assigned to the Administrators and Remote Desktop Users groups.\",\"WN10-UR-000010\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Access this computer from the network\\\" user right may access resources on the system, and must be limited to those that require it.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8xkuF4nDSjRiPP+9oGCPnfWYPGGSOi17d7FbL0XhlU0=\"},\"C-64597r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lH+1d+CUETOJmmgPi4Eh1CmVaFGByIFqLf5MAj1QNCg=\"},\"F-69775r1_fix\",\"V-63847\",\"high\",\"WN10-UR-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",179,\"SV-78337r1_rule\",\"high\",null,null,\"The Act as part of the operating system user right must not be assigned to any groups or accounts.\",\"WN10-UR-000015\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Act as part of the operating system\\\" user right can assume the identity of any user and gain access to resources that user is authorized to access.  Any accounts with this right can take complete control of a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dq7TXJZ0aBQkd+AjwMgoDVp+n4UvOG8n1gEF82FEBlE=\"},\"C-81367r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Xl4LzBTTkELkCIZqGakC2Cs0g1urWrbMdVhJLuVCRPs=\"},\"F-88439r1_fix\",\"V-63851\",\"medium\",\"WN10-UR-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",180,\"SV-78341r2_rule\",\"medium\",null,null,\"The Allow log on locally user right must only be assigned to the Administrators and Users groups.\",\"WN10-UR-000025\",\"Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\\n\\nAccounts with the \\\"Allow log on locally\\\" user right can log on interactively to a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KEKE0PGxslNV0A6vemAzaWjzbx9nYy/RbiPhNJ3aL20=\"},\"C-64603r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wjp/q1GocHJDSKu6HUfJsuOtQPP0kDgmTKsCC7cxZyQ=\"},\"F-69781r1_fix\",\"V-63853\",\"medium\",\"WN10-UR-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",181,\"SV-78343r1_rule\",\"medium\",null,null,\"The Back up files and directories user right must only be assigned to the Administrators group.\",\"WN10-UR-000030\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Back up files and directories\\\" user right can circumvent file and directory permissions and could allow access to sensitive data.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cDiaxsqIK6oeD+TiOA04U8bzW/Xipep+PGUIszW1Ddg=\"},\"C-64605r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:U/cFLnQ/p+ew1NO2jk7jx27uLjZ7K4bhawkMyDg8moo=\"},\"F-69783r2_fix\",\"V-63855\",\"medium\",\"WN10-UR-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",182,\"SV-78345r2_rule\",\"medium\",null,null,\"The Change the system time user right must only be assigned to Administrators and Local Service and NT SERVICE\\\\autotimesvc.\",\"WN10-UR-000035\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Change the system time\\\" user right can change the system time, which can impact authentication, as well as affect time stamps on event log entries.\\n\\nThe NT SERVICE\\\\autotimesvc is added in v1909 cumulative update. \",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Wzi+dcfocDaL/BL8ZywSuiDTEG4Zv3kI5qdXUcl3y8E=\"},\"C-64607r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8zMCD/IKqVJ/fXFhi/Wm5Gh/E5mOCHccloPzGxq/4iE=\"},\"F-69785r1_fix\",\"V-63857\",\"medium\",\"WN10-UR-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",183,\"SV-78347r1_rule\",\"medium\",null,null,\"The Create a pagefile user right must only be assigned to the Administrators group.\",\"WN10-UR-000040\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Create a pagefile\\\" user right can change the size of a pagefile, which could affect system performance.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m3olQQDR+ylJqlRWob7mYvRuzE60jAwPG6gvqc+QNq4=\"},\"C-64609r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bG2PZaJNs9ecO6qKJICBZlSrM78VxxabO9H3M3EUQqc=\"},\"F-69787r2_fix\",\"V-63859\",\"high\",\"WN10-UR-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",184,\"SV-78349r1_rule\",\"high\",null,null,\"The Create a token object user right must not be assigned to any groups or accounts.\",\"WN10-UR-000045\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Create a token object\\\" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:srfyN9VEgB5cnpXOBY292RFK5lJspJquvD0ZD4TIQLE=\"},\"C-64611r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:3GTvWhd/A8LO+nyZwqP9YKzU+SgKstcEDws2u6mZ+To=\"},\"F-69789r1_fix\",\"V-63861\",\"medium\",\"WN10-UR-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",185,\"SV-78351r1_rule\",\"medium\",null,null,\"The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.\",\"WN10-UR-000050\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Create global objects\\\" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KcAj9nx0K1Jq/IEktNS9qbRss/b4npcbS1XEQ+S/Xm0=\"},\"C-64613r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:X34pPeycBlL0GZKXjB7Mt7WYIKastRoN1JjKquwVZIU=\"},\"F-69791r1_fix\",\"V-63863\",\"medium\",\"WN10-UR-000055\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",186,\"SV-78353r1_rule\",\"medium\",null,null,\"The Create permanent shared objects user right must not be assigned to any groups or accounts.\",\"WN10-UR-000055\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Create permanent shared objects\\\" user right could expose sensitive data by creating shared objects.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3c6IOQPBsJcn8+IGDfwZ5oHJ/hbHObilnQESAeOLePs=\"},\"C-76167r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SRTeMQOurz8bQYLytMEFTmCJvFFV5XxEwmHuSvNvjgc=\"},\"F-69793r1_fix\",\"V-63865\",\"medium\",\"WN10-UR-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",187,\"SV-78355r2_rule\",\"medium\",null,null,\"The Create symbolic links user right must only be assigned to the Administrators group.\",\"WN10-UR-000060\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Create symbolic links\\\" user right can create pointers to other objects, which could potentially expose the system to attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PgmqvkJqmLhRaPCQpSZZxUPFDDIdB1muY7/23B1nyZM=\"},\"C-64619r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TWMfw7k3V5v/oNV0mZHixqfTQgolQ5/LURmoZBPNyl8=\"},\"F-69797r1_fix\",\"V-63869\",\"high\",\"WN10-UR-000065\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",188,\"SV-78359r1_rule\",\"high\",null,null,\"The Debug programs user right must only be assigned to the Administrators group.\",\"WN10-UR-000065\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Debug Programs\\\" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components.  This right is given to Administrators in the default configuration.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qj88J123Y6ALiPB3Uh+vm0KvR68nqjRVdYVnlzC1rII=\"},\"C-81369r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:koH0FsedyUbc3GTxXlLNXKaLwWT6ld4COb/PHndEwvA=\"},\"F-88441r1_fix\",\"V-63871\",\"medium\",\"WN10-UR-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",189,\"SV-78361r3_rule\",\"medium\",null,null,\"The Deny access to this computer from the network user right on workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.\",\"WN10-UR-000070\",\"Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\\n\\nThe \\\"Deny access to this computer from the network\\\" right defines the accounts that are prevented from logging on from the network.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.\\n\\nLocal accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks.\\n\\nThe Guests group must be assigned this right to prevent unauthenticated access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gRYqjlzcylziTXB0rod7QdHFL/L5BST/gimkIhHW/vk=\"},\"C-64623r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QR8rMbfP0bYem6CaUDF4p4InJIAIp/WARLl1wr24J+U=\"},\"F-69801r1_fix\",\"V-63873\",\"medium\",\"WN10-UR-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",190,\"SV-78363r1_rule\",\"medium\",null,null,\"The Deny log on as a batch job user right on domain-joined workstations must be configured to prevent access from highly privileged domain accounts.\",\"WN10-UR-000075\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Deny log on as a batch job\\\" right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Hn5uwnn6gC1VwYXthEGUgC6ziFRTZscKIoUS++3Rjto=\"},\"C-94081r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:A3nadAl1DlKeOYbXl4/6ZUtaau9FUhRhgRq2BSyoVmg=\"},\"F-100993r1_fix\",\"V-63875\",\"medium\",\"WN10-UR-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",191,\"SV-78365r2_rule\",\"medium\",null,null,\"The Deny log on as a service user right on Windows 10 domain-joined workstations must be configured to prevent access from highly privileged domain accounts.\",\"WN10-UR-000080\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Deny log on as a service\\\" right defines accounts that are denied log on as a service.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain.\\n\\nIncorrect configurations could prevent services from starting and result in a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XTQwo3vFeHtIVTshIduv4IWitfBFRakuEQXlLRuSS24=\"},\"C-81371r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9VeeDgwQVkT/exUSjv6Ovcl8SUv7kU7mYlxF4qZCtb4=\"},\"F-88443r1_fix\",\"V-63877\",\"medium\",\"WN10-UR-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",192,\"SV-78367r2_rule\",\"medium\",null,null,\"The Deny log on locally user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems.\",\"WN10-UR-000085\",\"Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\\n\\nThe \\\"Deny log on locally\\\" right defines accounts that are prevented from logging on interactively.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.\\n\\nThe Guests group must be assigned this right to prevent unauthenticated access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oDnTVUc7IVAYvvMQbb1Wz03I5+3OQ5gnInH/2FTM+UQ=\"},\"C-94083r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nywkeJfphs8p9QmHEW6QIIy0cJ5ghfBoRh69uQw90SQ=\"},\"F-88445r1_fix\",\"V-63879\",\"medium\",\"WN10-UR-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",193,\"SV-78369r4_rule\",\"medium\",null,null,\"The Deny log on through Remote Desktop Services user right on Windows 10 workstations must at a minimum be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.\",\"WN10-UR-000090\",\"Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\\n\\nThe \\\"Deny log on through Remote Desktop Services\\\" right defines the accounts that are prevented from logging on using Remote Desktop Services.\\n\\nIf Remote Desktop Services is not used by the organization, the Everyone group must be assigned this right to prevent all access.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.\\n\\nLocal accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks.\\n\\nThe Guests group must be assigned this right to prevent unauthenticated access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HCUwYAohklOWhKjdCkwUXELBicl1aKdYsLlX2ENO5ZQ=\"},\"C-64631r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8hf+ttnXrBz3tjm15xWFy1gfNWxyAsg6g235d3bMNCU=\"},\"F-69809r1_fix\",\"V-63881\",\"medium\",\"WN10-UR-000095\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",194,\"SV-78371r1_rule\",\"medium\",null,null,\"The Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts.\",\"WN10-UR-000095\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Enable computer and user accounts to be trusted for delegation\\\" user right allows the \\\"Trusted for Delegation\\\" setting to be changed. This could potentially allow unauthorized users to impersonate other users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h8rwAYISD/28YdzSDaeuG5FpPZBqNPB9wT86XIfoUdE=\"},\"C-64633r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:esgXWycKuQZruggJyh9Ol7GwmEzQJm9SGb0QT0yUtfk=\"},\"F-69811r1_fix\",\"V-63883\",\"medium\",\"WN10-UR-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",195,\"SV-78373r1_rule\",\"medium\",null,null,\"The Force shutdown from a remote system user right must only be assigned to the Administrators group.\",\"WN10-UR-000100\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Force shutdown from a remote system\\\" user right can remotely shut down a system which could result in a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8ZljbVob0XqSwiA5dOYkrIecCXdmnQCug5ybd0v/x1Q=\"},\"C-64639r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:doKzrhFXOcBUCa8mb8oq2DvsmDq5V1THjTE/n8l3Qpk=\"},\"F-69817r1_fix\",\"V-63889\",\"medium\",\"WN10-UR-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",196,\"SV-78379r1_rule\",\"medium\",null,null,\"The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.\",\"WN10-UR-000110\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Impersonate a client after authentication\\\" user right allows a program to impersonate another user or account to run on their behalf. An attacker could potentially use this to elevate privileges.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zxCJ1n+/xpv4SXNOQLm6wAQSmkH1udVPy4xRJNH22s0=\"},\"C-64667r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SUCrurhykryvVKTz9GWJ3w9cTzGoZuL4CwNKapjj4Nk=\"},\"F-69845r1_fix\",\"V-63917\",\"medium\",\"WN10-UR-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",197,\"SV-78407r1_rule\",\"medium\",null,null,\"The Load and unload device drivers user right must only be assigned to the Administrators group.\",\"WN10-UR-000120\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Load and unload device drivers\\\" user right allows device drivers to dynamically be loaded on a system by a user. This could potentially be used to install malicious code by an attacker.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pvOcEpA+TB34F4cWCOGMSfSEkxZAfBUxITpDJmb9+K4=\"},\"C-64675r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6e9tpU5sJRuxuqMaLyEeFRtnGNCyAkndOHctlQh/p+U=\"},\"F-69853r1_fix\",\"V-63925\",\"medium\",\"WN10-UR-000125\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",198,\"SV-78415r1_rule\",\"medium\",null,null,\"The Lock pages in memory user right must not be assigned to any groups or accounts.\",\"WN10-UR-000125\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Lock pages in memory\\\" user right allows physical memory to be assigned to processes, which could cause performance issues or a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ntgurAdRh2vPTZ6v6uIm1vEBH6EsSEipSMq20DsG+D8=\"},\"C-64677r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KwWbfMfFZql+AKxylOLvygdGadkfUHQIq36+h28fZbI=\"},\"F-69855r1_fix\",\"V-63927\",\"medium\",\"WN10-UR-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",199,\"SV-78417r1_rule\",\"medium\",null,null,\"The Manage auditing and security log user right must only be assigned to the Administrators group.\",\"WN10-UR-000130\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Manage auditing and security log\\\" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zpJA36QZjPMfklit+NRW9GEdI9+UG+zGf4DOGG8XG6Y=\"},\"C-64681r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:T4llh+VCxuV2Fyk12sbY99zVphPSqjyrvbbuIsk6Koo=\"},\"F-69859r1_fix\",\"V-63931\",\"medium\",\"WN10-UR-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",200,\"SV-78421r1_rule\",\"medium\",null,null,\"The Modify firmware environment values user right must only be assigned to the Administrators group.\",\"WN10-UR-000140\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Modify firmware environment values\\\" user right can change hardware configuration environment variables. This could result in hardware failures or a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6Vr6sSumF5z/+2j4Jut2d6KaK1Nl8c/eF71h3mZz84s=\"},\"C-64683r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:58eSIVL8m7QzY3SYimfFF/nDuwl11WTOchEf/D6tXr4=\"},\"F-69861r1_fix\",\"V-63933\",\"medium\",\"WN10-UR-000145\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",201,\"SV-78423r1_rule\",\"medium\",null,null,\"The Perform volume maintenance tasks user right must only be assigned to the Administrators group.\",\"WN10-UR-000145\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Perform volume maintenance tasks\\\" user right can manage volume and disk configurations. They could potentially delete volumes, resulting in, data loss or a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U1jQim/n6VHAUZXYJaQi/HWtt7Q3k/5g/dZtKPgRpRQ=\"},\"C-64685r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+3g+iyx8lV+Qihe18EjHZbZtYJZYLaQjpr7hF1kjYls=\"},\"F-69863r1_fix\",\"V-63935\",\"medium\",\"WN10-UR-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",202,\"SV-78425r1_rule\",\"medium\",null,null,\"The Profile single process user right must only be assigned to the Administrators group.\",\"WN10-UR-000150\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Profile single process\\\" user right can monitor non-system processes performance. An attacker could potentially use this to identify processes to attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F0RPJGfwD1qORt7UmHAIsqA20ktqswUXeKiEMO4DFEw=\"},\"C-64691r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vS+hQSlGNf4MpRQS97hEvCTsa8GXWltEE7+gZiRNfqM=\"},\"F-69867r1_fix\",\"V-63939\",\"medium\",\"WN10-UR-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",203,\"SV-78429r1_rule\",\"medium\",null,null,\"The Restore files and directories user right must only be assigned to the Administrators group.\",\"WN10-UR-000160\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Restore files and directories\\\" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to over-write more current data.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hO/PQW/5C6I5rdjEwZhLARaC8GglwdI3lTW+tbXMeS4=\"},\"C-64693r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jVS0vRb7tWvU1r/KiIBkXQ8TK4yQsSDiLOS1ExWWxSk=\"},\"F-69869r1_fix\",\"V-63941\",\"medium\",\"WN10-UR-000165\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",204,\"SV-78431r1_rule\",\"medium\",null,null,\"The Take ownership of files or other objects user right must only be assigned to the Administrators group.\",\"WN10-UR-000165\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Take ownership of files or other objects\\\" user right can take ownership of objects and make changes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJSxQGzb7YGcY1mgBjeFquoDAw5e1lp1zoNJaIM2u2U=\"},\"C-76221r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B+8s7YEQR2Jk3MpIl5LKgCGEyxi7T3p2M4KNz6wxSII=\"},\"F-83251r4_fix\",\"V-65681\",\"low\",\"WN10-CC-000206\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",205,\"SV-80171r3_rule\",\"low\",null,null,\"Windows Update must not obtain updates from other PCs on the Internet.\",\"WN10-CC-000206\",\"Windows 10 allows Windows Update to obtain updates from additional sources instead of Microsoft. In addition to Microsoft, updates can be obtained from and sent to PCs on the local network as well as on the Internet. This is part of the Windows Update trusted process, however to minimize outside exposure, obtaining updates from or sending to systems on the Internet must be prevented.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nB5yZlxqxo8iNwRqReGtHbsRcruqk84xPSKCKzfrudk=\"},\"C-69305r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qf04bkgmMh7/Xtq1/PBpX+EZO4hz59RpQOM81gGA5K4=\"},\"F-74987r1_fix\",\"V-68817\",\"medium\",\"WN10-CC-000066\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",206,\"SV-83409r1_rule\",\"medium\",null,null,\"Command line data must be included in process creation events.\",\"WN10-CC-000066\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nEnabling \\\"Include command line data for process creation events\\\" will record the command line information with the process creation events in the log.  This can provide additional detail when malware has run on a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tlcocN55ZYxvkWqCrlKzS308hz23N1rtV+8aFeDnhcQ=\"},\"C-94087r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QdYlaeg3zVAWdJ4P3hyvRlPDwr0KB2zjCtlJZ+liF6c=\"},\"F-74989r1_fix\",\"V-68819\",\"medium\",\"WN10-CC-000326\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",207,\"SV-83411r2_rule\",\"medium\",null,null,\"PowerShell script block logging must be enabled on Windows 10.\",\"WN10-CC-000326\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nEnabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts.  This can provide additional detail when malware has run on a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:95Wge0r7A1nMcqH3gMcG1tsaCxT6bDaub3VeK5nHEcY=\"},\"C-77535r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:W9OT6/yKCLuomlNSX3QJrCYyprmuohy6rVi6tbgiyb8=\"},\"F-75017r2_fix\",\"V-68845\",\"high\",\"WN10-00-000145\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",208,\"SV-83439r2_rule\",\"high\",null,null,\"Data Execution Prevention (DEP) must be configured to at least OptOut.\",\"WN10-00-000145\",\"Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windows and other programs.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7XgAgPXMwnWi7uSIC/fqd46LXQjEefiQggfQCfHL7K8=\"},\"C-80163r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:irQUQvrkSAAacEmAqilJbT3/LE5inxDiqZKlYKlWBrE=\"},\"F-87295r1_fix\",\"V-68849\",\"high\",\"WN10-00-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",209,\"SV-83445r4_rule\",\"high\",null,null,\"Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.\",\"WN10-00-000150\",\"Attackers are constantly looking for vulnerabilities in systems and applications. Structured Exception Handling Overwrite Protection (SEHOP) blocks exploits that use the Structured Exception Handling overwrite technique, a common buffer overflow attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8QaHQQT2a/xX1mHR9JZYds+zZe9VKc6wZnVv2nVWTwg=\"},\"C-91429r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zTiS3h97x2piMq/0m0GdZt8rbZHJxutHF7zDTCd4M4U=\"},\"F-76869r1_fix\",\"V-70637\",\"medium\",\"WN10-00-000155\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",210,\"SV-85259r2_rule\",\"medium\",null,null,\"The Windows PowerShell 2.0 feature must be disabled on the system.\",\"WN10-00-000155\",\"Windows PowerShell 5.0 added advanced logging features which can provide additional detail when malware has been run on a system.  Disabling the Windows PowerShell 2.0 mitigates against a downgrade attack that evades the Windows PowerShell 5.0 script block logging feature.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LoHFxrEqFXMSEB8aLzNbxWm1sZAEoJAELFfMvbeXJWA=\"},\"C-74581r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rOBoCm3gFi8A59Xsp7O0G7tiYN6JL2ya9ecafxQRRDo=\"},\"F-76871r2_fix\",\"V-70639\",\"medium\",\"WN10-00-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",211,\"SV-85261r2_rule\",\"medium\",null,null,\"The Server Message Block (SMB) v1 protocol must be disabled on the system.\",\"WN10-00-000160\",\"SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.\\n\\nDisabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older Network Attached Storage (NAS) devices may only support SMBv1.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VfJcv2oibH4fO+7O/16d0DnpaUWHMb9vOGAlg65RKTw=\"},\"C-72017r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tY7XMVbdAbMzjSFZqqVfir/m4Sw0RJr73TvI0ORMx0c=\"},\"F-78111r2_fix\",\"V-71759\",\"medium\",\"WN10-AU-000054\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",212,\"SV-86383r2_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Account Lockout failures.\",\"WN10-AU-000054\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAccount Lockout events can be used to identify potentially malicious logon attempts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:spd2YfnamQST1NlVqvAqNOfFgfZkdothjKXNWgXmfX8=\"},\"C-72019r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XAYh9ZCmsN2u9vza7wzaPkjBtlPqL/UbBVes+PcPB/8=\"},\"F-78113r1_fix\",\"V-71761\",\"medium\",\"WN10-AU-000107\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",213,\"SV-86385r1_rule\",\"medium\",null,null,\"The system must be configured to audit Policy Change - Authorization Policy Change successes.\",\"WN10-AU-000107\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuthorization Policy Change records events related to changes in user rights, such as Create a token object.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cLWTmB4pH7+xPBjUvZx8mpG3gs+QxeJQobWa4u/txeE=\"},\"C-72021r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dLnDVN8s/91ti09nXwJxNczSs5bPSptsa4aYD4hcjvc=\"},\"F-78115r4_fix\",\"V-71763\",\"medium\",\"WN10-CC-000038\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",214,\"SV-86387r1_rule\",\"medium\",null,null,\"WDigest Authentication must be disabled.\",\"WN10-CC-000038\",\"When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft.  WDigest is disabled by default in Windows 10.  This setting ensures this is enforced.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A69vy1PsYlLcAzLy5BVJjqB9jb4HUwisI/dMcPrDcBI=\"},\"C-72023r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:IgFL5XwyUdOYZfdnbKixtFP+EGlN8oDS3gbBsSbv5Yw=\"},\"F-78117r2_fix\",\"V-71765\",\"medium\",\"WN10-CC-000044\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",215,\"SV-86389r1_rule\",\"medium\",null,null,\"Internet connection sharing must be disabled.\",\"WN10-CC-000044\",\"Internet connection sharing makes it possible for an existing internet connection, such as through wireless, to be shared and used by other systems essentially creating a mobile hotspot.  This exposes the system sharing the connection to others with potentially malicious purpose.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bnGEzcuJUAwCNZ4Ws5wyS5j2lY5Jgzk6QrlcnBXgb8o=\"},\"C-76223r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eGXZ+DOsdSkcmF3ldc2wW5VrVYYyaaP4oY0KtvzQ/Mg=\"},\"F-78121r3_fix\",\"V-71769\",\"medium\",\"WN10-SO-000167\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",216,\"SV-86393r3_rule\",\"medium\",null,null,\"Remote calls to the Security Account Manager (SAM) must be restricted to Administrators.\",\"WN10-SO-000167\",\"The Windows Security Account Manager (SAM) stores users' passwords.  Restricting remote rpc connections to the SAM to Administrators helps protect those credentials.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uqablBEdj8fYHH8criFKQSHGko9Gb2nm3ANEizuP+08=\"},\"C-81363r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Be1MLyR/Z+nSYWeOYKQpPWP0Df/FA9g0clocFDsx5wE=\"},\"F-78123r1_fix\",\"V-71771\",\"low\",\"WN10-CC-000197\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",217,\"SV-86395r2_rule\",\"low\",null,null,\"Microsoft consumer experiences must be turned off.\",\"WN10-CC-000197\",\"Microsoft consumer experiences provides suggestions and notifications to users, which may include the installation of Windows Store apps.  Organizations may control the execution of applications through other means such as whitelisting.  Turning off Microsoft consumer experiences will help prevent the unwanted installation of suggested applications.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:azduH/rGDaA9J8WfIbKquOL5RoDMag7lQ/2PBt2QE8s=\"},\"C-72563r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:M5rwZagEaLNTaJKOXPYqxrB71orJ89nWwRBonZ+GsJs=\"},\"F-78683r2_fix\",\"V-72329\",\"medium\",\"WN10-CC-000039\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",218,\"SV-86953r1_rule\",\"medium\",null,null,\"Run as different user must be removed from context menus.\",\"WN10-CC-000039\",\"The \\\"Run as different user\\\" selection from context menus allows the use of credentials other than the currently logged on user.  Using privileged credentials in a standard user session can expose those credentials to theft.  Removing this option from context menus helps prevent this from occurring.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QUy5rMKrmSVFuZRi8lijI352v840T0gzGD5qak7wNbk=\"},\"C-72913r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:A2l+hvl/8exaBSN6YCIsffw0hfHkhBy+P3AKlVVpFAw=\"},\"F-79175r1_fix\",\"V-72765\",\"medium\",\"WN10-00-000210\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",219,\"SV-87403r1_rule\",\"medium\",null,null,\"Bluetooth must be turned off unless approved by the organization.\",\"WN10-00-000210\",\"If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OLU1Ki32nfmwHE1geqvJmNi7m2t/bTSrs5FI1qvvg5o=\"},\"C-72915r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2am2H7Doa4rGmj6G+kS9wKTwC5Nme9hPQFpYKniqeB4=\"},\"F-79177r1_fix\",\"V-72767\",\"medium\",\"WN10-00-000220\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",220,\"SV-87405r1_rule\",\"medium\",null,null,\"Bluetooth must be turned off when not in use.\",\"WN10-00-000220\",\"If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VC4MssCw0YPNf5Ku7vwfsCk462cMswOvsMCGoxhRGaU=\"},\"C-72917r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Pb5TafjPaP+LTOixhDns54D9iLk838ohVuYebZ2RvcY=\"},\"F-79179r1_fix\",\"V-72769\",\"medium\",\"WN10-00-000230\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",221,\"SV-87407r2_rule\",\"medium\",null,null,\"The system must notify the user when a Bluetooth device attempts to connect.\",\"WN10-00-000230\",\"If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hktzVHG38mzOhb1tNzgXaCky+9tk/sTzqf2ayzkUh0A=\"},\"C-74295r6_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9fnPpiozrI0OKjv+pcmSSl17/I8MN2dILhQcCidat/E=\"},\"F-80951r4_fix\",\"V-74409\",\"medium\",\"WN10-AU-000084\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",222,\"SV-89083r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Object Access - Other Object Access Events failures.\",\"WN10-AU-000084\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing for other object access records events related to the management of task scheduler jobs and COM+ objects.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+dPx0n8JfTUXKdPsMAw42NTXs2lAb7HwDFC8m/Frthk=\"},\"C-74297r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vd8EsTrkNYhogosEeLUKmcGtT/0kDmTjGQjR7pYHTFc=\"},\"F-80953r2_fix\",\"V-74411\",\"medium\",\"WN10-AU-000083\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",223,\"SV-89085r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Object Access - Other Object Access Events successes.\",\"WN10-AU-000083\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing for other object access records events related to the management of task scheduler jobs and COM+ objects.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HPKwv55aIzf3+HquubSdJocG/rCtCTbtxNECCDpyxPk=\"},\"C-94089r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BYVODkXyQ1zz05xobiYtyYf0nPtZ/GjmyoBPKUesI84=\"},\"F-80955r1_fix\",\"V-74413\",\"medium\",\"WN10-CC-000052\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",224,\"SV-89087r2_rule\",\"medium\",null,null,\"Windows 10 must be configured to prioritize ECC Curves with longer key lengths first.\",\"WN10-CC-000052\",\"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. By default Windows uses ECC curves with shorter key lengths first.  Requiring ECC curves with longer key lengths to be prioritized first helps ensure more secure algorithms are used.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gd3/nmYTFouE7yNfONwiOI09OM4xvvtC7p5aHSm3+rk=\"},\"C-91423r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rNae1lECfwUQzq7cVpoyPLhfSkChOADC8SJ+dmqF7bc=\"},\"F-80959r1_fix\",\"V-74417\",\"medium\",\"WN10-CC-000252\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",225,\"SV-89091r2_rule\",\"medium\",null,null,\"Windows 10 must be configured to disable Windows Game Recording and Broadcasting.\",\"WN10-CC-000252\",\"Windows Game Recording and Broadcasting is intended for use with games, however it could potentially record screen shots of other applications and expose sensitive data.  Disabling the feature will prevent this from occurring.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p3Km58ax+vwtXp6vt/jvLyGVTgesTT2NKlz+BVoeGAk=\"},\"C-91425r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vS35zhZGlAylBppLd2YkbVv5mYh6dEBH9Lg9/Qx2sCQ=\"},\"F-81317r1_fix\",\"V-74699\",\"medium\",\"WN10-CC-000068\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",226,\"SV-89373r2_rule\",\"medium\",null,null,\"Windows 10 must be configured to enable Remote host allows delegation of non-exportable credentials.\",\"WN10-CC-000068\",\"An exportable version of credentials is provided to remote hosts when using credential delegation which exposes them to theft on the remote host.  Restricted Admin mode or Remote Credential Guard allow delegation of non-exportable credentials providing additional protection of the credentials.  Enabling this configures the host to support Restricted Admin mode or Remote Credential Guard.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kmONnQi8hUqCu/WJgM8CHWQrxsQLtOxhWR7c6bEt12Y=\"},\"C-94093r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6LaK2VcIqK9oUGu0jqwrijFrhQ5H371NKRriYM6+TB4=\"},\"F-81333r1_fix\",\"V-74719\",\"medium\",\"WN10-00-000175\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",227,\"SV-89393r2_rule\",\"medium\",null,null,\"The Secondary Logon service must be disabled on Windows 10.\",\"WN10-00-000175\",\"The Secondary Logon service provides a means for entering alternate credentials, typically used to run commands with elevated privileges.  Using privileged credentials in a standard user session can expose those credentials to theft.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJq3SMQlkiH7VSnlxXWdCkxlPWIUUAHF7pAJRBLRDOU=\"},\"C-74575r5_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eZpj+IITXq5ums6eQxFjnoGoYPhzGIVD4fSfvb1yD0g=\"},\"F-81335r3_fix\",\"V-74721\",\"medium\",\"WN10-AU-000082\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",228,\"SV-89395r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Object Access - File Share successes.\",\"WN10-AU-000082\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing file shares records events related to connection to shares on a system including system shares such as C$.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AcIhp89UhB4v65rG4+1OlkrKzpAPGx+nVXwXtWlRxtw=\"},\"C-74577r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TSmMu0ZHsAd1fzROhv0xiffJsLGIkQoOrLRxkBCNjPU=\"},\"F-81337r2_fix\",\"V-74723\",\"medium\",\"WN10-00-000165\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",229,\"SV-89397r1_rule\",\"medium\",null,null,\"The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.\",\"WN10-00-000165\",\"SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.\\n\\nDisabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bH2zYG4O8rv2T9lCQ0x5K3UStABQyU0MGrR7XdmZxm4=\"},\"C-74579r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vrvlutyLqr3NGe5hhKWoLyJi7MftxvLvZBtgAHlh3sg=\"},\"F-81339r3_fix\",\"V-74725\",\"medium\",\"WN10-00-000170\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",230,\"SV-89399r1_rule\",\"medium\",null,null,\"The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.\",\"WN10-00-000170\",\"SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.\\n\\nDisabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pP6wExXu7hx0kSxYXKfJVrzTaRizYrfD1RMLqHWYrFY=\"},\"C-74879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JfK0hPvOcoRwMHqq7hLD/z12EWwkRlJQFjlqGg7QcEA=\"},\"F-81643r1_fix\",\"V-75027\",\"medium\",\"WN10-AU-000081\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",231,\"SV-89701r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Object Access - File Share failures.\",\"WN10-AU-000081\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing file shares records events related to connection to shares on a system including system shares such as C$.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2j27+jG0GZFs6PCwCbPpklgetUgKU7XZetxNDvK30ho=\"},\"C-76171r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:DrB1/dhFAcMIz4jr6xajtN8beSutIcDkV9SZc5jmaz4=\"},\"F-83185r1_fix\",\"V-76505\",\"medium\",\"WN10-00-000190\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",232,\"SV-91201r1_rule\",\"medium\",null,null,\"Orphaned security identifiers (SIDs) must be removed from user rights on Windows 10.\",\"WN10-00-000190\",\"Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups.  If the account or group objects are reanimated, there is a potential they may still have rights no longer intended.  Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:G++c76EF2dug3yxJ1mWjWuE/wznHG9SVXyS+eCsoMKE=\"},\"C-86429r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:AVzpNK+DyFAXlwjznEhrrAG4I22Sg+pYLab7wZSj95Y=\"},\"F-83781r1_fix\",\"V-77083\",\"medium\",\"WN10-00-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",233,\"SV-91779r3_rule\",\"medium\",null,null,\"Windows 10 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.\",\"WN10-00-000015\",\"UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in Legacy BIOS mode will not support these security features.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:UyAIBRFH+PIeD9UnW2uuScJwGHi1TzbEGDoaMPRL1nM=\"},\"C-86431r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TRTnlaC83paER7O+Xt96qk6Vk3HwozJXAzJuSrP/hKs=\"},\"F-83783r1_fix\",\"V-77085\",\"low\",\"WN10-00-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",234,\"SV-91781r2_rule\",\"low\",null,null,\"Secure Boot must be enabled on Windows 10 systems.\",\"WN10-00-000020\",\"Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wZQbFTwW94OSVmQOtJRreFTXD/cIx6cp6SMGeIT/5Q0=\"},\"C-79579r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:woCzI+ry5rY5WpxHM5I31gu2dqoVFaTbd4coSFbSgYo=\"},\"F-86717r3_fix\",\"V-77091\",\"medium\",\"WN10-EP-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",235,\"SV-91787r3_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Data Execution Prevention (DEP), must be on.\",\"WN10-EP-000020\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Data Execution Prevention (DEP)\\\", are enabled by default at the system level. DEP prevents code from being run from data-only memory pages. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:seoeJ0TVdyPF1IZOglTdU3YY9kcGzHzPhCDGtAE3tkM=\"},\"C-79581r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mWshO11tryJTCql4hk/spdqg+E1bzL8t2tI5Lm9xlwA=\"},\"F-86719r3_fix\",\"V-77095\",\"medium\",\"WN10-EP-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",236,\"SV-91791r4_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Randomize memory allocations (Bottom-Up ASLR), must be on.\",\"WN10-EP-000030\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Randomize memory allocations (Bottom-Up ASLR)\\\", are enabled by default at the system level. Bottom-Up ASLR (address space layout randomization) randomizes locations for virtual memory allocations, including those for system structures. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I4uQfS2NjZHDkDdoRvwEOJ9Cn5UEOwkvBoMVv0IlL4w=\"},\"C-79583r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lMnpP4ynhAZVatRsYBaTTKBOmTVGXa68O1WqgFozVek=\"},\"F-86721r2_fix\",\"V-77097\",\"medium\",\"WN10-EP-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",237,\"SV-91793r3_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Control flow guard (CFG), must be on.\",\"WN10-EP-000040\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Control flow guard (CFG)\\\", are enabled by default at the system level. CFG ensures flow integrity for indirect calls. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kFzIaNPWT2wqsaqKjSiKaNxW40sevexLR9vPMcm9edQ=\"},\"C-79585r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CagwaL6jYeJAB8F7kV6A1VgcgO0qo2LyozS2WSl9LV0=\"},\"F-86723r2_fix\",\"V-77101\",\"medium\",\"WN10-EP-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",238,\"SV-91797r3_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Validate exception chains (SEHOP), must be on.\",\"WN10-EP-000050\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Validate exception chains (SEHOP)\\\", are enabled by default at the system level. SEHOP (structured exception handling overwrite protection) ensures the integrity of an exception chain during exception dispatch. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:g7RfvBxx636aPhixMi/6iDCzMbVFIx9shebxkreQe48=\"},\"C-79587r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y+Jwz4SlaCP0uDfdPN7A2Kkk2w9cH6/sCOOpTuFkp5Y=\"},\"F-86725r2_fix\",\"V-77103\",\"medium\",\"WN10-EP-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",239,\"SV-91799r3_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Validate heap integrity, must be on.\",\"WN10-EP-000060\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Validate heap integrity\\\", are enabled by default at the system level. \\\"Validate heap integrity\\\" terminates a process when heap corruption is detected. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/kelpkvOVtEhlqeho3DqaACavzCa3fwBSBE55Uza0+E=\"},\"C-94095r9_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:akIn3OR8SKnyLhrjzkf6C+t63Ll3bFZcny/I2uJNO0w=\"},\"F-84325r8_fix\",\"V-77189\",\"medium\",\"WN10-EP-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",240,\"SV-91885r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for Acrobat.exe.\",\"WN10-EP-000070\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MubhtefZIzGkvhlY2PmYFuDlH+8Uqku0fltszVjOuxU=\"},\"C-94097r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:go1d0UhD/s44LKtOJi7giiQmLfHwsIDsomswW5bEhEw=\"},\"F-84329r7_fix\",\"V-77191\",\"medium\",\"WN10-EP-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",241,\"SV-91887r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for AcroRd32.exe.\",\"WN10-EP-000080\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fg2f0FG3EIVUBqMtVXqVYKHERgkwZW3I0YbnLTVAsX8=\"},\"C-94099r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:UtLy/lhF+3qJsptN1S7+/BnmRwSuoKQLUjCcTfPFVmQ=\"},\"F-84333r5_fix\",\"V-77195\",\"medium\",\"WN10-EP-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",242,\"SV-91891r4_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for chrome.exe.\",\"WN10-EP-000090\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pNmbpGc9jee+bzjZjzmnqgZeocNv6buCv3Ipvsb5pXo=\"},\"C-94101r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:G7GA5EjlQapB+o33giDLY13tf4ks4V+aVerdQAKmg3o=\"},\"F-84337r7_fix\",\"V-77201\",\"medium\",\"WN10-EP-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",243,\"SV-91897r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for EXCEL.EXE.\",\"WN10-EP-000100\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:spszjT7BTTddnp6oFJqi/T4F3rA0UBbm/6GzPBqBcWo=\"},\"C-79777r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lmq37rPV73c8QL9fNQTktgAYlAIm/VcmeVQUR5N+QPM=\"},\"F-86915r3_fix\",\"V-77205\",\"medium\",\"WN10-EP-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",244,\"SV-91901r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for firefox.exe.\",\"WN10-EP-000110\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mtl2VgiudtjEJVh9KeXvbi749Hr3urnyB+DwqMQJz2Y=\"},\"C-94103r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bwz+hhci2hrUCxhD+VWhV+aLmorsS7M6HVezP2NZtNw=\"},\"F-84341r6_fix\",\"V-77209\",\"medium\",\"WN10-EP-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",245,\"SV-91905r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for FLTLDR.EXE.\",\"WN10-EP-000120\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LsXrxcaxVB8zrRJjNYRpPBfOKTGaqj32TPrT80sjdFE=\"},\"C-94105r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:v3QdCidDWVcmfH52W7787MqM06FhUQwodFBWSACop7M=\"},\"F-84343r6_fix\",\"V-77213\",\"medium\",\"WN10-EP-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",246,\"SV-91909r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for GROOVE.EXE.\",\"WN10-EP-000130\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:amDpgsaRxthlet+rsvJeTvWJu1llLyepQcXyc5K4O7w=\"},\"C-94107r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Q7yxXUAX6curMWW1+63uLbDcl9ljTbRXUFw1GGJVd2c=\"},\"F-84347r6_fix\",\"V-77217\",\"medium\",\"WN10-EP-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",247,\"SV-91913r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for iexplore.exe.\",\"WN10-EP-000140\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lY+AXYfe/AluR4WGTqo0FEqJ5tSSl5HZ39f56ylKTs4=\"},\"C-94109r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:GulQPjdDC+qlUbS2TlpaM3J62Vs0lZh5wMmcUEsC1uA=\"},\"F-84349r6_fix\",\"V-77221\",\"medium\",\"WN10-EP-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",248,\"SV-91917r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for INFOPATH.EXE.\",\"WN10-EP-000150\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fe/FsLxtBWOXdM4WX+ESyWqxz8i/+CYiH84HrxQGTKM=\"},\"C-94111r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nB+4od41f5NQMsWDyaK8/k0TJse8+H0mHNA2tCIAMTA=\"},\"F-84353r5_fix\",\"V-77223\",\"medium\",\"WN10-EP-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",249,\"SV-91919r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for java.exe, javaw.exe, and javaws.exe.\",\"WN10-EP-000160\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mh9IH1clzy+A1OOIBzjvUuybaU9xSwmJekh7crMQoVI=\"},\"C-94113r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:63zaP2KKzTXpl+NIgXAfQSDlkk8SmqPAW2nW9p/6B/c=\"},\"F-84357r7_fix\",\"V-77227\",\"medium\",\"WN10-EP-000170\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",250,\"SV-91923r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for lync.exe.\",\"WN10-EP-000170\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dEwmjiXxS3GnMegQ2bUU71KYoXG5Dd/AZ7wdyDMWJGQ=\"},\"C-94115r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MDpvhRQniNCiKGQAJSKnHWQ00gPj8bYf9lxw0wxnoBU=\"},\"F-84359r6_fix\",\"V-77231\",\"medium\",\"WN10-EP-000180\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",251,\"SV-91927r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for MSACCESS.EXE.\",\"WN10-EP-000180\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xgIlihjGuLyZbqGDLM1SWEpzSqmldIb/KD1X6dqFPeQ=\"},\"C-94117r5_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OexQ8kEncBJsMQKalFDXdL/ElicZV/YRKjUyPX4zpLY=\"},\"F-84361r6_fix\",\"V-77233\",\"medium\",\"WN10-EP-000190\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",252,\"SV-91929r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for MSPUB.EXE.\",\"WN10-EP-000190\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5Ph3UBC9p+Akj+j+IR75pArMHpuq1OdgoJE3yVDf11E=\"},\"C-94119r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BCa1+WSHpwNFQlicOVJTT7MO9RB9aBAbcT3ARZQ/k2E=\"},\"F-84321r7_fix\",\"V-77235\",\"medium\",\"WN10-EP-000210\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",253,\"SV-91931r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for OneDrive.exe.\",\"WN10-EP-000210\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lILMjdtbWDfww7YCEZdpYCS81lAL+dJlad4M/TVlfcQ=\"},\"C-94121r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NwmgFiA9NckdN5TeGEUGMcRrS12KDExHspvp62uYU+Q=\"},\"F-84315r7_fix\",\"V-77239\",\"medium\",\"WN10-EP-000200\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",254,\"SV-91935r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for OIS.EXE.\",\"WN10-EP-000200\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GXA5f/UA68emJFB8jqN9ewGYIe84bEvyYg7xSGas3I4=\"},\"C-94123r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:GYLqyqrHfdyE4k3QM4zwGeUyRS9mmnEGZBpRqxsMKqI=\"},\"F-84363r6_fix\",\"V-77243\",\"medium\",\"WN10-EP-000220\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",255,\"SV-91939r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for OUTLOOK.EXE.\",\"WN10-EP-000220\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MUCQyakZZLfc2Ap5HiFf5ipmQj0p92vkKHKV9h/lKZA=\"},\"C-94125r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eD5WaRu5VcwvSfrT2UxDYynPsF16jaqIicn0D7W7yXU=\"},\"F-84365r8_fix\",\"V-77245\",\"medium\",\"WN10-EP-000230\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",256,\"SV-91941r4_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for plugin-container.exe.\",\"WN10-EP-000230\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Tc2J0p3mLuCyswLMHwCyLpY+3kVedt6NP6VLBTCWYjA=\"},\"C-94127r5_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pc/w19DZVMih+ciy86Y9JMYlyvH/jIeElYtpCZZoHyE=\"},\"F-84503r8_fix\",\"V-77247\",\"medium\",\"WN10-EP-000240\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",257,\"SV-91943r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for POWERPNT.EXE.\",\"WN10-EP-000240\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MQNLsBE4TEp2/6ROgBSTJO9fJkNfyMcnLhI9YtT5BXI=\"},\"C-94129r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:WsF1epd1aFpIa9jDy3bcmb6qVRoEa5866L5rVCMQAzU=\"},\"F-84505r7_fix\",\"V-77249\",\"medium\",\"WN10-EP-000250\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",258,\"SV-91945r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for PPTVIEW.EXE.\",\"WN10-EP-000250\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pHMGWcsdxpl8Z+8pYTfwp4+n7EAO3II6SBPoR0qmkV8=\"},\"C-94131r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:prizP85kj6huvXs/G4ghxyH4LZWTIOMFXs00Svnjh3A=\"},\"F-84507r8_fix\",\"V-77255\",\"medium\",\"WN10-EP-000260\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",259,\"SV-91951r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for VISIO.EXE.\",\"WN10-EP-000260\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8vOgdCfinZFo71HQ6cBJRAa/ITYhJrZWDk+MZttTzFg=\"},\"C-94133r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hPsWkcNQxMjXoLg+pAJQVJfUxZbyUac/dEBdQd8Deqk=\"},\"F-84509r7_fix\",\"V-77259\",\"medium\",\"WN10-EP-000270\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",260,\"SV-91955r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for VPREVIEW.EXE.\",\"WN10-EP-000270\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wzRqhQROBVJlE1q3nxtUM1GkAJigG01hupg8bXE1iSA=\"},\"C-94135r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NfdZ24hCWsRX4GyoitZP1gOvqm9KxehEDibz/R35NPU=\"},\"F-84511r7_fix\",\"V-77263\",\"medium\",\"WN10-EP-000280\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",261,\"SV-91959r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for WINWORD.EXE.\",\"WN10-EP-000280\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/mZrNq1dEWU1tMYc71JTRfkRtNHkdPGHX2E03f0Jppc=\"},\"C-94137r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tXGn2pX+eEr6Q8FblEWmysB+EYqlH0J64+XJJHHbztU=\"},\"F-84513r7_fix\",\"V-77267\",\"medium\",\"WN10-EP-000290\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",262,\"SV-91963r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for wmplayer.exe.\",\"WN10-EP-000290\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i7E2vv6pd35hawlK+qV+2UpXcaVnUkBR1V3CR/Rcg7M=\"},\"C-94139r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:V/BKBf3pVG0DtiNhcIN8772kUA7FsIV4gQZ5YiOqAjk=\"},\"F-84515r7_fix\",\"V-77269\",\"medium\",\"WN10-EP-000300\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",263,\"SV-91965r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for wordpad.exe.\",\"WN10-EP-000300\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:99vRhcTZ40z21olaz2KCAKJlYMIhAMYv5z3B0U4Tt7E=\"},\"C-77703r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4yYwGe5746/lZUu5mItEq1GkKqM7qXqbJZqcipCDsu8=\"},\"F-84851r1_fix\",\"V-78129\",\"high\",\"WN10-00-000240\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",264,\"SV-92835r1_rule\",\"high\",null,null,\"Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.\",\"WN10-00-000240\",\"Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account.\\n\\nSince administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy requires administrative accounts to not access the Internet or use applications, such as email.\\n\\nThe policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.\\n\\nTechnical means such as application whitelisting can be used to enforce the policy to ensure compliance.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ewDvbXkRfIkCeWiNsw3OWO1nlDe4SsgnCecA5Am1j5Q=\"},\"C-81935r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:W9CRIHTIvuwyTuYRNeqcLnBcDyK6y5LJmcZdO2HC4Kw=\"},\"F-88989r2_fix\",\"V-82137\",\"medium\",\"WN10-UC-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",265,\"SV-96851r1_rule\",\"medium\",null,null,\"The use of personal accounts for OneDrive synchronization must be disabled.\",\"WN10-UC-000005\",\"OneDrive provides access to external services for data storage, which must be restricted to authorized instances. Enabling this setting will prevent the use of personal OneDrive accounts for synchronization.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Yc8MBcfVv6vNjndIl1SGBkgIuoDRlU+d8I5bNlbhm5k=\"},\"C-81939r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NYJvEfLe6qqpfrqg9mcbQtXqcwpfjyCZ3kza554KJAA=\"},\"F-88993r1_fix\",\"V-82139\",\"medium\",\"WN10-CC-000238\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",266,\"SV-96853r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to prevent certificate error overrides in Microsoft Edge.\",\"WN10-CC-000238\",\"Web security certificates provide an indication whether a site is legitimate. This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rj3OnjRCg+zI0qrs9i/7QAUeW1hgVcDx11HNsPktgsU=\"},\"C-81943r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RHLyDoJJQoQLYBXIbpvnNPrKKHX099LvJyUf7L2XMmI=\"},\"F-88997r2_fix\",\"V-82145\",\"medium\",\"WN10-CC-000204\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",267,\"SV-96859r1_rule\",\"medium\",null,null,\"If Enhanced diagnostic data is enabled it must be limited to the minimum required to support Windows Analytics.\",\"WN10-CC-000204\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The \\\"Enhanced\\\" level for telemetry includes additional information beyond \\\"Security\\\" and \\\"Basic\\\" on how Windows and apps are used and advanced reliability data. Windows Analytics can use a \\\"limited enhanced\\\" level to provide information such as health data for devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2tk48SuLjCC1zEZDnJEJwFssANaf8w1hwLA0yFQDwt0=\"},\"C-87895r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VHeKoAaG7leI8VWo6O7ZVX0+8WiDV/Oct8xTAZwnQPY=\"},\"F-94945r4_fix\",\"V-88203\",\"medium\",\"WN10-CC-000340\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",268,\"SV-98853r3_rule\",\"medium\",null,null,\"OneDrive must only allow synchronizing of accounts for DoD organization instances.\",\"WN10-CC-000340\",\"OneDrive provides access to external services for data storage, which must be restricted to authorized instances if enabled. Configuring this setting will restrict synchronizing of OneDrive accounts to DoD organization instances.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xCK9AnopZ/PLEiEfFd+fF29a3GvfMV+H4kBtncaC+w4=\"},\"C-93909r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mPWqIsb0n06wTF7qh1aYHnPiwDdpF2h7PhHFwsmZUqY=\"},\"F-100837r3_fix\",\"V-94719\",\"medium\",\"WN10-CC-000365\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",269,\"SV-104549r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to prevent Windows apps from being activated by voice while the system is locked.\",\"WN10-CC-000365\",\"Allowing Windows apps to be activated by voice from the lock screen could allow for unauthorized use. Requiring logon will ensure the apps are only used by authorized personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hSVsi+qUuuUyVINtO7WeONuyh47CyGSc32+FLd4Ul1Q=\"},\"C-94055r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+pJv8+F1yFio0LjRDpj7dffhIDVp0nEY8jvnE+wrX4w=\"},\"F-100983r2_fix\",\"V-94859\",\"medium\",\"WN10-00-000031\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",270,\"SV-104689r1_rule\",\"medium\",null,null,\"Windows 10 systems must use a BitLocker PIN for pre-boot authentication.\",\"WN10-00-000031\",\"If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SIUT9VltMgIdU+iQ11p1JXZ1wRhtZVpC4mS/QVMSxf0=\"},\"C-94057r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bZOkFz4V8Ui/FunBETLbYY6kWJHTUI5wFoQlPtlZiqU=\"},\"F-100985r1_fix\",\"V-94861\",\"medium\",\"WN10-00-000032\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",271,\"SV-104691r2_rule\",\"medium\",null,null,\"Windows 10 systems must use a BitLocker PIN with a minimum length of 6 digits for pre-boot authentication.\",\"WN10-00-000032\",\"If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives. Increasing the pin length requires a greater number of guesses for an attacker.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ma4nqZH+wIDRjwzJLcPKvIvKb/+DvmWJQSbZYwt0kjY=\"},\"C-98389r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rcAafIXouE+3wT6heNODo54W6/EDFFC9IGCWJ8/HefA=\"},\"F-105225r1_fix\",\"V-99541\",\"medium\",\"WN10-AU-000565\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",272,\"SV-108645r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit other Logon/Logoff Events Failures.\",\"WN10-AU-000565\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aHDwysX9OO7lInhWR4rNHU0Ms5aHv+DvTtpIpt7OrPU=\"},\"C-98393r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BEdoMF9S2cOQGD2GXgg9s6wgMJrbDpokNMz6l9nTjv0=\"},\"F-105227r1_fix\",\"V-99543\",\"medium\",\"WN10-AU-000560\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",273,\"SV-108647r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit other Logon/Logoff Events Successes.\",\"WN10-AU-000560\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1xCrwLo/Iq6qUeIrA32JKdJWhv9UJ8i93khTh00F31M=\"},\"C-98395r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:K470rD17EN41ERiWYr5a6WRrSS6wvqHUSlWy+iX1BCY=\"},\"F-105229r1_fix\",\"V-99545\",\"medium\",\"WN10-AU-000570\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",274,\"SV-108649r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Detailed File Share Failures.\",\"WN10-AU-000570\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Detailed File Share allows you to audit attempts to access files and folders on a shared folder.\\nThe Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xN9N4TyNWncZnuydNiSn1AFbgDuZlrOZk/FpvfCXbCw=\"},\"C-98397r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Og8bqxxj38uPecH7EfrawZ+rB2jQ+W6bSi3cC899qhE=\"},\"F-105231r1_fix\",\"V-99547\",\"medium\",\"WN10-AU-000575\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",275,\"SV-108651r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Successes.\",\"WN10-AU-000575\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). \\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AwE4aTQA41II3JBpLcuFwxr2s+SdrBU5NkQnKMmh+34=\"},\"C-98399r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:3kKmtcMstjT4aZm8opTuiNQyeFx5VSsOlN0KLpSlQeU=\"},\"F-105233r1_fix\",\"V-99549\",\"medium\",\"WN10-AU-000580\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",276,\"SV-108653r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Failures.\",\"WN10-AU-000580\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). \\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JLf0igfVeeCGPtuP0G5jtsBt5SLWDy8/40lxLhTjp+A=\"},\"C-98401r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fnFr59iMjWuCLW0+oFtD3LoOgcVyLzjCmKhn0eBtvf4=\"},\"F-105235r1_fix\",\"V-99551\",\"medium\",\"WN10-AU-000550\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",277,\"SV-108655r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Other Policy Change Events Successes.\",\"WN10-AU-000550\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0JIEYxGjLJCW+XDuQSNKZLiOraun/N4xAz9pc3iPnC4=\"},\"C-98403r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:J94I4bXHjDSMsn8zktbNFAlWp+zRBwXxG+yxPDD9mvA=\"},\"F-105237r1_fix\",\"V-99553\",\"medium\",\"WN10-AU-000555\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",278,\"SV-108657r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Other Policy Change Events Failures.\",\"WN10-AU-000555\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WiWO+yrYgzS9BRfJ95tCnETPOIU/k/YYuPYQakQM+IM=\"},\"C-98405r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JXGq7aDhtWNDrivMOMTSMI94M0jJatF+Nj93C8VgSrs=\"},\"F-105239r2_fix\",\"V-99555\",\"medium\",\"WN10-SO-000280\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",279,\"SV-108659r2_rule\",\"medium\",null,null,\"Passwords for enabled local Administrator accounts must be changed at least every 60 days.\",\"WN10-SO-000280\",\"The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. A local Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for enabled Administrator accounts on a regular basis will limit its exposure.\\n\\nOrganizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every \\\"30\\\" days by default.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vk0EeybuvPD5mu6kz6fCWWqDopo0zsPMlVMjqvlYb5I=\"},\"C-98407r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bJdExunHBewJYBF6G0nwK51NbFw+0zp5HCOqjnETyCQ=\"},\"F-105241r4_fix\",\"V-99557\",\"medium\",\"WN10-EP-000310\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",280,\"SV-108661r1_rule\",\"medium\",null,null,\"Windows 10 Kernel (Direct Memory Access) DMA Protection must be enabled.\",\"WN10-EP-000310\",\"Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. Drive-by DMA attacks can lead to disclosure of sensitive information residing on a PC, or even injection of malware that allows attackers to bypass the lock screen or control PCs remotely.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QBQK/tnwXZkWJDaqU/JtL7zWbHA0F4hsxCD2qrMtB98=\"},\"C-98409r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gmXzLE+C5v8pYM8+S6Iego7iYhlC18ZgH4ozkLXCTvE=\"},\"F-105243r1_fix\",\"V-99559\",\"medium\",\"WN10-CC-000370\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",281,\"SV-108663r1_rule\",\"medium\",null,null,\"The convenience PIN for Windows 10 must be disabled.\",\"WN10-CC-000370\",\"This policy controls whether a domain user can sign in using a convenience PIN to prevent enabling (Password Stuffer).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:d1pbzJigO85rKAMstf6sSkdP/ACDK1pRyqaLfXxwivI=\"},\"C-98411r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:i0Z+IG92JiLzmzLx6tQ74snoRBL6KKFk5hh5XykDo7s=\"},\"F-105245r1_fix\",\"V-99561\",\"medium\",\"WN10-CC-000385\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",282,\"SV-108665r1_rule\",\"medium\",null,null,\"Windows Ink Workspace configured but disallow access above the lock.\",\"WN10-CC-000385\",\"Securing Windows Ink which contains application and features oriented towards pen computing. \",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rD1r31DjrTFhcjSKe05lznNWs43/fc9RD+ZPg5DX/ZA=\"},\"C-98413r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KfW44fGASN+DiEKxrOxRxC/y1q1o/IzZsuqfPyZVbE4=\"},\"F-105247r1_fix\",\"V-99563\",\"low\",\"WN10-CC-000390\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",283,\"SV-108667r1_rule\",\"low\",null,null,\"Windows 10 should be configured to prevent users from receiving suggestions for third-party or additional applications.\",\"WN10-CC-000390\",\"Windows spotlight features may suggest apps and content from third-party software publishers in addition to Microsoft apps and content. \",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FGmuM87xdJUUKhYyergOAvk1Q+FhFTf1uOoIl5+4vOQ=\"},\"C-98943r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:uDOK3Fjq2yLJbn3WYZKpUUc41LjFQmsFAugtp+V755g=\"},\"F-105777r3_fix\",\"V-100093\",\"medium\",\"SRG-OS-000095-GPOS-00049\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",284,\"SV-109197r1_rule\",\"medium\",null,null,\"Windows 10 must cover or disable the built-in or attached camera when not in use.\",\"WN10-CC-000007\",\"It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\\n\\nFailing to disconnect from collaborative computing devices (i.e. cameras) can result in subsequent compromises of organizational information. Providing easy methods to physically disconnect from such devices after a collaborative computing session helps to ensure that participants actually carry out the disconnect activity without having to go through complex and tedious procedures.\\n\\nSatisfies: SRG-OS-000095-GPOS-00049, SRG-OS-000370-GPOS-00155\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HTJfh6HdzWTnnVR96iuoJZ0PnIvio+5FoDwpQDtzoTk=\"},\"C-101347r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4wZyYpTBO45VsCc6wvm7l2eGkIhtOrcxbBb0SGvAieE=\"},\"F-108159r2_fix\",\"V-102611\",\"medium\",\"WN10-00-000250\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",285,\"SV-111557r1_rule\",\"medium\",null,null,\"Windows 10 non-persistent VM sessions should not exceed 24 hours.\",\"WN10-00-000250\",\"For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, the organization should enforce that sessions be terminated within 24 hours. This would ensure any data stored on the VM that is not encrypted or covered by Credential Guard is deleted.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dbiUpUgiJb2+wzenGvBgb7gCtpsKZcFOnZmCT6u1k3s=\"},\"C-101355r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Og0Ct9ilCO63e8VppKdOiDA8j8y3ZH3RTayXtTMnHqE=\"},\"F-108147r3_fix\",\"V-102617\",\"medium\",\"WN10-CC-000328\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",286,\"SV-111563r1_rule\",\"medium\",null,null,\"The Windows Explorer Preview pane must be disabled for Windows 10.\",\"WN10-CC-000328\",\"A known vulnerability in Windows 10 could allow the execution of malicious code by either opening a compromised document or viewing it in the Windows Preview pane.\\n\\nOrganizations must disable the Windows Preview pane and Windows Detail pane.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aGZaMr7JCYhdhYIbyDmHK2zx8fjqDpXXjEY01sUoNo4=\"},\"C-101365r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:h9sVNjmtZbTh4890fOEZpilU6aj+nDNbUGjH9jf1Tzs=\"},\"F-108157r1_fix\",\"V-102627\",\"medium\",\"WN10-SO-000251\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",287,\"SV-111577r1_rule\",\"medium\",null,null,\"Windows 10 must use multifactor authentication for local and network access to privileged and non-privileged accounts.\",\"WN10-SO-000251\",\"Without the use of multifactor authentication, the ease of access to privileged and non-privileged functions is greatly increased. \\n\\nAll domain accounts must be enabled for multifactor authentication with the exception of local emergency accounts. \\n\\nMultifactor authentication requires using two or more factors to achieve authentication.\\n\\nFactors include: \\n\\n1) Something a user knows (e.g., password/PIN);\\n\\n2) Something a user has (e.g., cryptographic identification device, token); and\\n\\n3) Something a user is (e.g., biometric).\\n\\nA privileged account is defined as an information system account with authorizations of a privileged user.\\n\\nNetwork access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the Internet).\\n\\nLocal access is defined as access to an organizational information system by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network.\\n\\nThe DoD CAC with DoD-approved PKI is an example of multifactor authentication.\\n\\nSatisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nkk6VkjluuUxkzsszOk8eTgHlUakS2R/bR95QTwbAM8=\"},\"C-4516r88368_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:171piPtMwULALIZ14So5l0MBIPd4Xcr2rWsmNy6Dx/g=\"},\"F-4516r88369_fix\",\"V-204392\",\"high\",\"SRG-OS-000257-GPOS-00098\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",288,\"SV-204392r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values.\",\"RHEL-07-010010\",\"Discretionary access control is weakened if a user or group has access permissions to system files and directories greater than the default.\\n\\nSatisfies: SRG-OS-000257-GPOS-00098, SRG-OS-000278-GPOS-00108\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:t3pLu4RByPjTmSyEGSrDsv2WpOjBnMxFcux4WTKpzsg=\"},\"C-4517r88371_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hYWkn5qu+JVb8C0/FpEXNp2r5VMsXVv/bIRrPHmoQNU=\"},\"F-4517r88372_fix\",\"V-204393\",\"medium\",\"SRG-OS-000023-GPOS-00006\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",289,\"SV-204393r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.\",\"RHEL-07-010030\",\"Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\n\\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b7cLLXAJwWiYlb+ZLVM/YmYEKrJOElbc2DI7KzdElaY=\"},\"C-4518r88374_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:w+OPWXVI1Kw0bo/mliM4bt1VuO10x/y6qOatUlCmTLA=\"},\"F-4518r88375_fix\",\"V-204394\",\"medium\",\"SRG-OS-000023-GPOS-00006\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",290,\"SV-204394r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the approved Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.\",\"RHEL-07-010040\",\"Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9ShQfZRP37ZylVTOj7a7tmzPRP/DZmVauIWv5cK5IgU=\"},\"C-4519r88377_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VxFoDAct2ic13XgKRn+E/ACi/TSpmK9WNulzRc3rOxY=\"},\"F-4519r88378_fix\",\"V-204395\",\"medium\",\"SRG-OS-000023-GPOS-00006\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",291,\"SV-204395r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.\",\"RHEL-07-010050\",\"Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Eg7oETP6JdEiW9fWb3CWsCNr1Ee+e9COo/1vPyjLJyA=\"},\"C-4520r88380_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MnA1wjFQqLCk55goNlJqa3e9IQiF1U+1NIeoMR43fSU=\"},\"F-4520r88381_fix\",\"V-204396\",\"medium\",\"SRG-OS-000028-GPOS-00009\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",292,\"SV-204396r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must enable a user session lock until that user re-establishes access using established identification and authentication procedures.\",\"RHEL-07-010060\",\"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.\\n\\nThe session lock is implemented at the point where session activity can be determined.\\n\\nRegardless of where the session lock is determined and implemented, once invoked, the session lock must remain in place until the user reauthenticates. No other activity aside from reauthentication must unlock the system.\\n\\nSatisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v8r3y4wndT3MrdoqZ+IXfrOkoGx9bEvFFDEL4eMv6bI=\"},\"C-4521r88383_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FJ09r9gGAOoBlB3ANwPG10/GW3aeCVvnhJwFpBEgyrg=\"},\"F-4521r88384_fix\",\"V-204397\",\"medium\",\"SRG-OS-000375-GPOS-00160\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",293,\"SV-204397r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate users using multifactor authentication via a graphical user logon.\",\"RHEL-07-010061\",\"To assure accountability and prevent unauthenticated access, users must be identified and authenticated to prevent potential misuse and compromise of the system.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\\n\\nSatisfies: SRG-OS-000375-GPOS-00161,SRG-OS-000375-GPOS-00162\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4Vhryn3qYojwlbzNOTBxhlYOCH+6lGP9nQktKh5cvso=\"},\"C-4522r88386_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:txbQErX0FRuka0ET9MkbOIEBnV+bAVMYgBP6oH/i79o=\"},\"F-4522r88387_fix\",\"V-204398\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",294,\"SV-204398r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces.\",\"RHEL-07-010070\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9A9hqWAZ5NS1n2W3Z6epeuVuWBbbbPCEc/zuKz7IiSM=\"},\"C-4523r88389_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vl4SP0SyLICEo1UBg5mI/85sJQuDzfImBjmKGkVysKs=\"},\"F-4523r88390_fix\",\"V-204399\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",295,\"SV-204399r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver lock-delay setting for the graphical user interface.\",\"RHEL-07-010081\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1r/d1v914jFv+PeIiRAnO8w+OdA0cucmU9N4uS9npIU=\"},\"C-4524r88392_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dnQ2OlAztdPf5rQ9gH8GFI1O36kYCEF3B2vcP6Jh8vI=\"},\"F-4524r88393_fix\",\"V-204400\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",296,\"SV-204400r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent a user from overriding the session idle-delay setting for the graphical user interface.\",\"RHEL-07-010082\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BdYvtV85bZiRNU3aVsf9P0v0mUKO7gFFdyTulpf63UA=\"},\"C-4525r88395_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Et1UGeqvKWmnbOPO51FwzssEelKOLZsQzNg/Wj9Vi0M=\"},\"F-4525r88396_fix\",\"V-204401\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",297,\"SV-204401r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must have the screen package installed.\",\"RHEL-07-010090\",\":  A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe screen and tmux packages allow for a session lock to be implemented and configured.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SJj4kDOYlogEinGYl4UBtzYvD0sUOtC0Zc+GkbM/nQg=\"},\"C-4526r88398_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RHDbTLpscT3JPNQs8VWSai2xSgAZqUcMgIRNSBG1V5o=\"},\"F-4526r88399_fix\",\"V-204402\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",298,\"SV-204402r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must initiate a session lock for the screensaver after a period of inactivity for graphical user interfaces.\",\"RHEL-07-010100\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wLqPaWBvxUmRKRMMSiJj2pj0F8NCk7mvWKECb9jxRgw=\"},\"C-4527r88401_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ktylcJOE83aWAU3yVOV6uQjr4EguM93Bhe66FymU9bE=\"},\"F-4527r88402_fix\",\"V-204403\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",299,\"SV-204403r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface.\",\"RHEL-07-010101\",\"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.\\n\\nThe session lock is implemented at the point where session activity can be determined.\\n\\nThe ability to enable/disable a session lock is given to the user by default. Disabling the user's ability to disengage the graphical user interface session lock provides the assurance that all sessions will lock after the specified period of time.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:orUMwfifYhVDl5eCyl7LEBXY8R0QtYf4FB3AikYOR0Q=\"},\"C-4528r88404_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:7pgCXmTq1+tSHD6gmAtfroDMvoebl9KLtd/SK4N3WTo=\"},\"F-4528r88405_fix\",\"V-204404\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",300,\"SV-204404r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must initiate a session lock for graphical user interfaces when the screensaver is activated.\",\"RHEL-07-010110\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:87KK1t2KJmsVqwDVxcvH3F6erHGSjt6gU3lODHDY4FI=\"},\"C-4529r88407_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wV2rv2IVWyQHIuIZzNN7jDzLimBra9QVKxEfwm4p0nc=\"},\"F-4529r88408_fix\",\"V-204405\",\"medium\",\"SRG-OS-000069-GPOS-00037\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",301,\"SV-204405r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that /etc/pam.d/passwd implements /etc/pam.d/system-auth when changing passwords.\",\"RHEL-07-010118\",\"Pluggable authentication modules (PAM) allow for a modular approach to integrating authentication methods. PAM operates in a top-down processing model and if the modules are not listed in the correct order, an important security function could be bypassed if stack entries are not centralized.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NVVlZz6DnbTO6YEa+HkLTRE6ApJBkX8N7oXza495krA=\"},\"C-4530r88410_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ty0BX1+S2CNa7NTV6x02Hdkv+nFbpdfLxv2kxmTzuoA=\"},\"F-4530r88411_fix\",\"V-204406\",\"medium\",\"SRG-OS-000069-GPOS-00037\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",302,\"SV-204406r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.\",\"RHEL-07-010119\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. \\\"pwquality\\\" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZZsZT55sjZiOw8YvdeG/PuTRrOJNXQ9fXpNFx1alZS0=\"},\"C-4531r88413_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:50c24SpAy6lZUa/raxhyzfeiBWAPtMEV8VJDkehahfI=\"},\"F-4531r88414_fix\",\"V-204407\",\"medium\",\"SRG-OS-000069-GPOS-00037\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",303,\"SV-204407r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one upper-case character.\",\"RHEL-07-010120\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5mP42vXD7dbHMk2adGpM5o78xd9tfHYGp4AY1olXPug=\"},\"C-4532r88416_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:K9vm1++ZIJVabRWXzHTee4LsRs4K42zsOdnMaBs894A=\"},\"F-4532r88417_fix\",\"V-204408\",\"medium\",\"SRG-OS-000070-GPOS-00038\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",304,\"SV-204408r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one lower-case character.\",\"RHEL-07-010130\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+ZxB96680QpTXOUhL+JNnhQFv/FKeRTfkrvRL3PV5S8=\"},\"C-4533r88419_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C2+B8kPWnlF62QWrO/V35CnYRxq/BrtDWAlCFrqLPPg=\"},\"F-4533r88420_fix\",\"V-204409\",\"medium\",\"SRG-OS-000071-GPOS-00039\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",305,\"SV-204409r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are assigned, the new password must contain at least one numeric character.\",\"RHEL-07-010140\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:abrw002NXrRQ66PzmbZYPT3hHRpQytzeYoaeJHhVEhU=\"},\"C-4534r88422_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RU7Q7o3Ev0u3LKqF5gyOeGtE+4224DgffB3yxG3HXzA=\"},\"F-4534r88423_fix\",\"V-204410\",\"medium\",\"SRG-OS-000266-GPOS-00101\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",306,\"SV-204410r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one special character.\",\"RHEL-07-010150\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CKBfpvZELPLxUExAGYDADab38Se08BtvG5UpBNIazBI=\"},\"C-4535r88425_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SV7aVMHMV2pg9CvBTy267KcjoYRu/NtX4vDqa6ogG+k=\"},\"F-4535r88426_fix\",\"V-204411\",\"medium\",\"SRG-OS-000072-GPOS-00040\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",307,\"SV-204411r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed a minimum of eight of the total number of characters must be changed.\",\"RHEL-07-010160\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wHEY2x4CvlXeh/wo8XesGOqxBrsYGWbUXOPbniv8Eec=\"},\"C-4536r88428_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ywBdYcG6riksarMvU8GLYRkgHnsMvClRGhpO80dIryk=\"},\"F-4536r88429_fix\",\"V-204412\",\"medium\",\"SRG-OS-000072-GPOS-00040\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",308,\"SV-204412r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed a minimum of four character classes must be changed.\",\"RHEL-07-010170\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:50yiX31ofIr+hd8aTkGds0o0cG1XWzi9CajHGO80y9s=\"},\"C-4537r88431_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sQgH4GxCCq+ysoBMnYh5H31rp93G+5yz2Gg2jTWAOMA=\"},\"F-4537r88432_fix\",\"V-204413\",\"medium\",\"SRG-OS-000072-GPOS-00040\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",309,\"SV-204413r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed the number of repeating consecutive characters must not be more than three characters.\",\"RHEL-07-010180\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:B5/JCBM3+y8mI0Wx//3vcvLxaBJUTuafPhnRMesP9F4=\"},\"C-4538r88434_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:E9p40X59ObEVCYByBc8xAxmZqPEKUNQhFuScvnelbvE=\"},\"F-4538r88435_fix\",\"V-204414\",\"medium\",\"SRG-OS-000072-GPOS-00040\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",310,\"SV-204414r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed the number of repeating characters of the same character class must not be more than four characters.\",\"RHEL-07-010190\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:EWkE5ArbnCtRXt1tYfKaQZxY82bf5+ySftE5x3A7rUw=\"},\"C-4539r88437_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4ddTsadW6QqrmIoLUDmcDiTBzxaIozFG0eOuiHCk7RE=\"},\"F-4539r88438_fix\",\"V-204415\",\"medium\",\"SRG-OS-000073-GPOS-00041\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",311,\"SV-204415r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the PAM system service is configured to store only encrypted representations of passwords.\",\"RHEL-07-010200\",\"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:szDJRfipxjLUpU4siSaUz52MOYPESOCSPqgSYGrG8h8=\"},\"C-4540r88440_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gOQ3eksWP5ENmWWzc/DMM0RZ2jLEEkon1gajsl35tsI=\"},\"F-4540r88441_fix\",\"V-204416\",\"medium\",\"SRG-OS-000073-GPOS-00041\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",312,\"SV-204416r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to use the shadow file to store only encrypted representations of passwords.\",\"RHEL-07-010210\",\"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:37jX9s+legYelkYfnf62nyYfMX4Svx6S53TO09s9e7U=\"},\"C-4541r88443_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hRyf1t19z5DMc75LIoHPuvVnrO2HP0zkmJIFEox5KzE=\"},\"F-4541r88444_fix\",\"V-204417\",\"medium\",\"SRG-OS-000073-GPOS-00041\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",313,\"SV-204417r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.\",\"RHEL-07-010220\",\"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+bzaAS/aDWQDJP8ZUOuMk/ISS9nWHhkC1peC0GEcbKo=\"},\"C-4542r88446_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1T7sJCq5OM2unDp6aEqf5HsDoTTlARZDq3qfpQyM8uU=\"},\"F-4542r88447_fix\",\"V-204418\",\"medium\",\"SRG-OS-000075-GPOS-00043\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",314,\"SV-204418r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords for new users are restricted to a 24 hours/1 day minimum lifetime.\",\"RHEL-07-010230\",\"Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MrAAW3p9KHUSNIIDH94flLWi6pGLzydp9PgU+RlvGC4=\"},\"C-4543r88449_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JrE+xgTMLgDmwuA8WAdXAxbHE2r7VM2qSE/TkRg8DMw=\"},\"F-4543r88450_fix\",\"V-204419\",\"medium\",\"SRG-OS-000075-GPOS-00043\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",315,\"SV-204419r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords are restricted to a 24 hours/1 day minimum lifetime.\",\"RHEL-07-010240\",\"Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aD2m4e2s0uh65x94BQAdZnXh7LZzUYWOg1jlF0xaYe4=\"},\"C-4544r88452_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OP0loBodphliC5wIAx2xt3COiJwLHbScpisnDs0leHU=\"},\"F-4544r88453_fix\",\"V-204420\",\"medium\",\"SRG-OS-000076-GPOS-00044\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",316,\"SV-204420r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords for new users are restricted to a 60-day maximum lifetime.\",\"RHEL-07-010250\",\"Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Xq5u0Pw/Zw4wuAxFngAnRjHsza6G0aVM5vVkmV9EUkw=\"},\"C-4545r88455_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OW+LFcNscBOuumegSBomC31jM5LYWiBJDmBDcCJqtOk=\"},\"F-4545r88456_fix\",\"V-204421\",\"medium\",\"SRG-OS-000076-GPOS-00044\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",317,\"SV-204421r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that existing passwords are restricted to a 60-day maximum lifetime.\",\"RHEL-07-010260\",\"Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N2xDTbhTE+RFh0/Sm++3xu/AV9xHzSY7hXbPJaaNeEk=\"},\"C-4546r88458_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jqBEArvHLQLeliRKzl6iU7Hesu2gNm2CHdGbqTUxHa4=\"},\"F-4546r88459_fix\",\"V-204422\",\"medium\",\"SRG-OS-000077-GPOS-00045\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",318,\"SV-204422r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords are prohibited from reuse for a minimum of five generations.\",\"RHEL-07-010270\",\"Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If the information system or application allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed per policy requirements.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wnEfB+iBnuzOMM868Vy5hLj72C0iU0CFAkGqCn3lcV8=\"},\"C-4547r88461_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Zxvk6/+F0erAfuKv1q4yUSpM0vr7+nIlyKzfzaKdc6s=\"},\"F-4547r88462_fix\",\"V-204423\",\"medium\",\"SRG-OS-000078-GPOS-00046\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",319,\"SV-204423r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords are a minimum of 15 characters in length.\",\"RHEL-07-010280\",\"The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.\\n\\nPassword complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dxEV5bGuHZP4iVsWXTtnKnb7HW9YuqytYqEfO4SaQlk=\"},\"C-4548r88464_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+qsYjWciZYQUB/V88VGdKnDuQXUV0QqGX56udWYJrmU=\"},\"F-4548r88465_fix\",\"V-204424\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",320,\"SV-204424r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have accounts configured with blank or null passwords.\",\"RHEL-07-010290\",\"If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fGovMAyL0HmlG0cv8i7GIrnPdYDI2Uu2j1CXqheXU6U=\"},\"C-4549r88467_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Q8iotl6ux8+dPdOwKWmbwKgIf/7rwz4a2+PNesYZhmo=\"},\"F-4549r88468_fix\",\"V-204425\",\"high\",\"SRG-OS-000106-GPOS-00053\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",321,\"SV-204425r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using an empty password.\",\"RHEL-07-010300\",\"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HWvW+5i4DGfbBRQ5ePFMe8hnoLMZwFwyu8jP8qD13B4=\"},\"C-4550r88470_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mx7sNoaABjDtoHiw3EcuJ31CMmR6HHu0qfKxJDkLskM=\"},\"F-4550r88471_fix\",\"V-204426\",\"medium\",\"SRG-OS-000118-GPOS-00060\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",322,\"SV-204426r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must disable account identifiers (individuals, groups, roles, and devices) if the password expires.\",\"RHEL-07-010310\",\"Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained.\\n\\nOperating systems need to track periods of inactivity and disable application identifiers after zero days of inactivity.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:H9mT1qdHOp9+ZyEy2fFxjTE/8tI1xhFtEvJORCJqd1k=\"},\"C-4551r88473_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:E9XDhr/n24vkAWIMtfMkvXTpFhXZwpvolrqLLmC13Kg=\"},\"F-4551r88474_fix\",\"V-204427\",\"medium\",\"SRG-OS-000329-GPOS-00128\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",323,\"SV-204427r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to lock accounts for a minimum of 15 minutes after three unsuccessful logon attempts within a 15-minute timeframe.\",\"RHEL-07-010320\",\"By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.\\n\\nSatisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oD6nmwpiJW9D5Cp/XXFX9UYRA755KWJpjrae9YSJLcA=\"},\"C-4552r88476_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+WHWx4dcfhcx4Ze8G9gIFM5wrU0gKeYCHmkrhqBKy/E=\"},\"F-4552r88477_fix\",\"V-204428\",\"medium\",\"SRG-OS-000329-GPOS-00128\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",324,\"SV-204428r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must lock the associated account after three unsuccessful root logon attempts are made within a 15-minute period.\",\"RHEL-07-010330\",\"By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.\\n\\nSatisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GEhzlPPnk+CAcWnOXaLRDP95b6T65/xq1qVqL/b84vw=\"},\"C-4553r88479_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hpjpsRKaPPJ3Ia1RY19t5pVGQb6/g/VXlMgaZLlmwcQ=\"},\"F-4553r88480_fix\",\"V-204429\",\"medium\",\"SRG-OS-000373-GPOS-00156\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",325,\"SV-204429r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that users must provide a password for privilege escalation.\",\"RHEL-07-010340\",\"Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \\n\\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate.\\n\\nSatisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SxSLBVVTtBtxKalJaRaw/6lgbVU0UOBOkgcTTRhHxD8=\"},\"C-4554r88482_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HYAeYfwCZZs8ctZhnvnSv2ucQ1JdxKYPJg0CTd18h14=\"},\"F-4554r88483_fix\",\"V-204430\",\"medium\",\"SRG-OS-000373-GPOS-00156\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",326,\"SV-204430r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that users must re-authenticate for privilege escalation.\",\"RHEL-07-010350\",\"Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \\n\\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate.\\n\\nSatisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+hZzZLys3BX7zWBUfBAVBQPgw6OXD+II7GH5BWOLMCI=\"},\"C-4555r88485_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JdoMO19GhKJDPOBHzoFLCHF7oQmEy7Lx/L1/9sWeXg0=\"},\"F-4555r88486_fix\",\"V-204431\",\"medium\",\"SRG-OS-000480-GPOS-00226\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",327,\"SV-204431r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the delay between logon prompts following a failed console logon attempt is at least four seconds.\",\"RHEL-07-010430\",\"Configuring the operating system to implement organization-wide security implementation guides and security checklists verifies compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\\n\\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example, registry settings; account, file, and directory permission settings; and settings for functions, ports, protocols, services, and remote connections.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wXo7iqYH5XGZTi7xVyPo9OMFKHuQ4XH2hIqOWqKo2ig=\"},\"C-4556r88488_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rtXajOQZci6vKdIVOpf9wOu2ZeYZ0LvKIOal4TwIexs=\"},\"F-4556r88489_fix\",\"V-204432\",\"high\",\"SRG-OS-000480-GPOS-00229\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",328,\"SV-204432r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not allow an unattended or automatic logon to the system via a graphical user interface.\",\"RHEL-07-010440\",\"Failure to restrict system access to authenticated users negatively impacts operating system security.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9DWDKCqiCDCdPaBAR1JnUJ2FgBKkNaNW7tQqAq+dw08=\"},\"C-4557r88491_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oWh+Qz6WRTlWrb5lARfKshYDIa+p6dDR188hrq5F5ds=\"},\"F-4557r88492_fix\",\"V-204433\",\"high\",\"SRG-OS-000480-GPOS-00229\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",329,\"SV-204433r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not allow an unrestricted logon to the system.\",\"RHEL-07-010450\",\"Failure to restrict system access to authenticated users negatively impacts operating system security.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rBMTU13BrvFeKQ+LVw9CSDaXjsTTmFaQjUCP5WUmK4E=\"},\"C-4558r88494_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gihecVT6zHmRSdYksj/6YGJOT2uA9gZTcH/QhkIQsq0=\"},\"F-4558r88495_fix\",\"V-204434\",\"medium\",\"SRG-OS-000480-GPOS-00229\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",330,\"SV-204434r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not allow users to override SSH environment variables.\",\"RHEL-07-010460\",\"Failure to restrict system access to authenticated users negatively impacts operating system security.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/uoCfeW8Df/g/XGQoBkg5WVbTAykMMBn4oMkJdNUEyA=\"},\"C-4559r88497_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:K+3n1t+ObwIUM11QMDTdGh98yONjdBtmdx5Ur9N3C0g=\"},\"F-4559r88498_fix\",\"V-204435\",\"medium\",\"SRG-OS-000480-GPOS-00229\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",331,\"SV-204435r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not allow a non-certificate trusted host SSH logon to the system.\",\"RHEL-07-010470\",\"Failure to restrict system access to authenticated users negatively impacts operating system security.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PVRLHuZ9kP5FJwKwYPDiChFJ5ZxZtcp0ro/wCh+st1A=\"},\"C-4560r88500_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:76sWDqXPiYk1zWHA8hQVZen2OkN3ppblRPJFE441EC4=\"},\"F-4560r88501_fix\",\"V-204436\",\"high\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",332,\"SV-204436r241939_rule\",\"high\",null,null,\"Red Hat Enterprise Linux operating systems prior to version 7.2 with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010480\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:y7xDq5NT2XNGrsamdbkoYKBvisZGFnS1fyg5AKvdfUQ=\"},\"C-4561r88503_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XBRfse8u4CBaisSjZn1V5+mBtSHoq8qleEOMU7NPS8Q=\"},\"F-4561r88504_fix\",\"V-204437\",\"medium\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",333,\"SV-204437r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010481\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tSZDrM1hWlCATKGgxqXsqEoIbIpJlq97X+0R6excyuQ=\"},\"C-4562r88506_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:geJjmG2xvtU8KsOo0NYpCklrqXG0GveHvbfaGe11AP4=\"},\"F-4562r88507_fix\",\"V-204438\",\"high\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",334,\"SV-204438r241939_rule\",\"high\",null,null,\"Red Hat Enterprise Linux operating systems version 7.2 or newer with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010482\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N8tSABUcJlBAkZ3vrmMcMUQscjNj485lQceECmBpBqY=\"},\"C-4563r88509_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9Hgkiy5EBfmBhvQw2thdKK4Mitvv2nkfcXFu2Yjvd8M=\"},\"F-4563r88510_fix\",\"V-204439\",\"high\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",335,\"SV-204439r241939_rule\",\"high\",null,null,\"Red Hat Enterprise Linux operating systems prior to version 7.2 using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010490\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3DS5zKmPA1/pZTvKSZLzlkwx6ZjRlk5GytGTDgvav+s=\"},\"C-4564r88512_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sLNLxYLCF4BkYkTMQlqtKlmz2CCiO2PBBy4/Xxulzds=\"},\"F-4564r88513_fix\",\"V-204440\",\"high\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",336,\"SV-204440r241939_rule\",\"high\",null,null,\"Red Hat Enterprise Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010491\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JTVgaY1LZdMLglvZK8C9tixEgj79wwesQdbeHi7a7Rk=\"},\"C-4565r88515_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XC9ckGWSpFsFRlPTdc3d5Ywv6RikA3tYpya5heE8HWw=\"},\"F-4565r88516_fix\",\"V-204441\",\"medium\",\"SRG-OS-000104-GPOS-00051\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",337,\"SV-204441r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users) using multifactor authentication.\",\"RHEL-07-010500\",\"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\\n\\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following:\\n\\n1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; \\n\\nand\\n\\n2) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\\n\\nSatisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000109-GPOS-00056, SRG-OS-000108-GPOS-00055, SRG-OS-000108-GPOS-00057, SRG-OS-000108-GPOS-00058\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mkc5HGb9gHNlg2WnY/djvfYdh8TcEe1wjVMoosFw32o=\"},\"C-4566r88518_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PkPXfMM5WKryVY7en8MTyQdFX7MPh1hx5HeAzwkHuGw=\"},\"F-4566r88519_fix\",\"V-204442\",\"high\",\"SRG-OS-000095-GPOS-00049\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",338,\"SV-204442r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have the rsh-server package installed.\",\"RHEL-07-020000\",\"It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\\n\\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).\\n\\nThe rsh-server service provides an unencrypted remote access service that does not provide for the confidentiality and integrity of user passwords or the remote session and has very weak authentication.\\n\\nIf a privileged user were to log on using this service, the privileged user password could be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:L6nJ9zxJTEu9H+NPMBNKXjZF11fxVnKsHJ0WDDygoYg=\"},\"C-4567r88521_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:i7hMFNAgwkh8GP0WW51DeT3l5PIPKAHm3h1ELi0DDSI=\"},\"F-4567r88522_fix\",\"V-204443\",\"high\",\"SRG-OS-000095-GPOS-00049\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",339,\"SV-204443r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have the ypserv package installed.\",\"RHEL-07-020010\",\"Removing the \\\"ypserv\\\" package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sfB3iHYcODrsGQIdQzi9S4OiWXlzCjwowCqvtusaGKY=\"},\"C-4568r88524_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pSF5drERdMpLPSu+WvmeYr2Pe+SlgFgTtHkBYI2QcAY=\"},\"F-4568r88525_fix\",\"V-204444\",\"medium\",\"SRG-OS-000324-GPOS-00125\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",340,\"SV-204444r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.\",\"RHEL-07-020020\",\"Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\\n\\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:toAqPFxuUxre2EEjoCzKlhcSnOb9RFpEln3MtuVIT9Q=\"},\"C-4569r88527_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XEeDzj3T3s/5C075RaI2/RVS5MmLUSOtmPLFh/sy/mk=\"},\"F-4569r88528_fix\",\"V-204445\",\"medium\",\"SRG-OS-000363-GPOS-00150\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",341,\"SV-204445r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that a file integrity tool verifies the baseline operating system configuration at least weekly.\",\"RHEL-07-020030\",\"Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\\n\\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NzJUcxxFJi8pit5evzZxnwQLQXWBf4/ftLMFNB6yiGw=\"},\"C-4570r88530_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RY/t3dX5Ty9FJRH+/noSp1Svd2G6xR3hYhL59PhK/G4=\"},\"F-4570r88531_fix\",\"V-204446\",\"medium\",\"SRG-OS-000363-GPOS-00150\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",342,\"SV-204446r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that designated personnel are notified if baseline configurations are changed in an unauthorized manner.\",\"RHEL-07-020040\",\"Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\\n\\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i6TlhYJkq+XnxoK0jdYhyvmrG0/kVGWgegQHFyIbH8Y=\"},\"C-4571r88533_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Eg5EIdHVVwh9ZqgphMoirHxJPHn0A2ZP4Q2vx9opqNY=\"},\"F-4571r88534_fix\",\"V-204447\",\"high\",\"SRG-OS-000366-GPOS-00153\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",343,\"SV-204447r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that\",\"RHEL-07-020050\",\"Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor.\\n\\nAccordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.\\n\\nVerifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SKIqa4iromN1/ld/zYxiQSOEbtGDJiFaQ30mjK6UgUY=\"},\"C-4572r88536_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BiV0UQMmksXuCOkEvhmjfxtdVdFaJetcBXhZERMG7fo=\"},\"F-4572r88537_fix\",\"V-204448\",\"high\",\"SRG-OS-000366-GPOS-00153\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",344,\"SV-204448r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that\",\"RHEL-07-020060\",\"Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor.\\n\\nAccordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.\\n\\nVerifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/bMIprnmuyHCZfwMhN53JacAU9Bw8vUNAz6FpcIsWeU=\"},\"C-4573r88539_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Z3a1S06/4F5C4Lp5cixp7Nu0E7my4W0IeMi33IalQW0=\"},\"F-4573r88540_fix\",\"V-204449\",\"medium\",\"SRG-OS-000114-GPOS-00059\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",345,\"SV-204449r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to disable USB mass storage.\",\"RHEL-07-020100\",\"USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity.\\n\\nSatisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7C8lXVeU00V8ySil2p6/I+nVauuGAbjK42d5ow1J2Y4=\"},\"C-4574r88542_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:uZz3nYMMEKXMiPBl6Xy/ScYOm9HzRk5qWZYzHGUx4bU=\"},\"F-4574r88543_fix\",\"V-204450\",\"medium\",\"SRG-OS-000378-GPOS-00163\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",346,\"SV-204450r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the Datagram Congestion Control Protocol (DCCP) kernel module is disabled unless required.\",\"RHEL-07-020101\",\"Disabling DCCP protects the system against exploitation of any flaws in the protocol implementation.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fvHgDUJGBMB+FLi/4z9egnoRgc5XNsyChWvVL+OV66I=\"},\"C-4575r88545_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Hq9mrYHDvGHmBtdMFIdfUqolkM1cMduz/gaG9QiC6yA=\"},\"F-4575r88546_fix\",\"V-204451\",\"medium\",\"SRG-OS-000114-GPOS-00059\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",347,\"SV-204451r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must disable the file system automounter unless required.\",\"RHEL-07-020110\",\"Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.\\n\\nSatisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ECU3PcokYJ0iTOaeFC4vceGeElsR/zrQCO1UeE3DreQ=\"},\"C-4576r88548_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oI+PCfg0U2LYXCzs78eVO/laVLbdDfv02bzMmbnUXsc=\"},\"F-4576r88549_fix\",\"V-204452\",\"low\",\"SRG-OS-000437-GPOS-00194\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",348,\"SV-204452r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must remove all software components after updated versions have been installed.\",\"RHEL-07-020200\",\"Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products may remove older versions of software automatically from the information system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mc80MJb4r7Qc8AmVFz9tOOJczWkzT3PVQISn5ZtRXSE=\"},\"C-4577r88551_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4FSreFL+qldPVF/mR4X7EaNlwgkKsQjPaFXx4S83Csk=\"},\"F-4577r88552_fix\",\"V-204453\",\"high\",\"SRG-OS-000445-GPOS-00199\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",349,\"SV-204453r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must enable SELinux.\",\"RHEL-07-020210\",\"Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\\n\\nThis requirement applies to operating systems performing security function verification/testing and/or systems and environments that require this functionality.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qFfBME/2o77yTMuxtpA4P0I8o2NQnfoVfThRiWzo6Lk=\"},\"C-4578r88554_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:3Ajev4/zwRAqY3q24YSLe6K9Ush9+wKs5BkHwER9b6M=\"},\"F-4578r88555_fix\",\"V-204454\",\"high\",\"SRG-OS-000445-GPOS-00199\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",350,\"SV-204454r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must enable the SELinux targeted policy.\",\"RHEL-07-020220\",\"Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\\n\\nThis requirement applies to operating systems performing security function verification/testing and/or systems and environments that require this functionality.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F70pc4lFutrB1aZSKBDOLu0diT12WqlYfaQrxFvOlBg=\"},\"C-4579r88557_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y6yG9b4+Sk91rD7DfkS/MXgAxBlsBoMeQBPFUWN95vw=\"},\"F-4579r88558_fix\",\"V-204455\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",351,\"SV-204455r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled on the command line.\",\"RHEL-07-020230\",\"A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:brL/cUNHx6LqwmVc7ML2OUn/P9TF3UTZ+dZ6dn6tjNY=\"},\"C-4580r88560_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JkiLXAedT0k6bEQvwqxohF7tHLjWbU2pGzkDN55NRYM=\"},\"F-4580r88561_fix\",\"V-204456\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",352,\"SV-204456r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled in the GUI.\",\"RHEL-07-020231\",\"A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:41T5JYxmVoKU+kVdsnjUa+6f5+dfkDIeSb6GFuUm5Dw=\"},\"C-4581r88563_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cpYv58/8Flvc4/bkLc1YNsLlr1YRlw72yf+/DFBGHGY=\"},\"F-4581r88564_fix\",\"V-204457\",\"medium\",\"SRG-OS-000480-GPOS-00228\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",353,\"SV-204457r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.\",\"RHEL-07-020240\",\"Setting the most restrictive default permissions ensures that when new accounts are created, they do not have unnecessary access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BKBVXasUfiVr7ygcFP+LUlFT+KaO5mryWRKA5v63Lzg=\"},\"C-4582r88566_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Cp4nKIw9SPZbUroGRU18fIv29Pew+EPDZcmgSeSx8EY=\"},\"F-4582r88567_fix\",\"V-204458\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",354,\"SV-204458r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be a vendor supported release.\",\"RHEL-07-020250\",\"An operating system release is considered \\\"supported\\\" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gzK9MUt7PjwGBJ/p/j6hcmkkkGmVE6qTD/BqPIvnN/E=\"},\"C-4583r88569_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:E9gT32RHBVbik+Je7pTMExJ4L7DJjyk7GysYa+7h2vQ=\"},\"F-4583r88570_fix\",\"V-204459\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",355,\"SV-204459r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system security patches and updates must be installed and up to date.\",\"RHEL-07-020260\",\"Timely patching is critical for maintaining the operational availability, confidentiality, and integrity of information technology (IT) systems. However, failure to keep operating system and application software patched is a common mistake made by IT professionals. New patches are released daily, and it is often difficult for even experienced System Administrators to keep abreast of all the new patches. When new weaknesses in an operating system exist, patches are usually made available by the vendor to resolve the problems. If the most recent security patches and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The lack of prompt attention to patching could result in a system compromise.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BIJOSScjxtLqA/SKv6NkIB3IGMa3Q+LPB+L/geOe7ok=\"},\"C-4584r88572_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:on/oOg7GrAbVYe62qKzCDcHBVJ+735gUHbX6wCQX7Tk=\"},\"F-4584r88573_fix\",\"V-204460\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",356,\"SV-204460r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not have unnecessary accounts.\",\"RHEL-07-020270\",\"Accounts providing no operational purpose provide additional opportunities for system compromise. Unnecessary accounts include user accounts for individuals not requiring access to the system and application accounts for applications not installed on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Xk8zYUvsnzovMiPLfQR6KgfXOkgeBn2KDtxaaMW0pGs=\"},\"C-4585r88575_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:x6Sb8AhbFuFgBMcB8fQ2DaX8SPkRfxrtvMQ5l7SngQQ=\"},\"F-4585r88576_fix\",\"V-204461\",\"low\",\"SRG-OS-000104-GPOS-00051\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",357,\"SV-204461r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all Group Identifiers (GIDs) referenced in the /etc/passwd file are defined in the /etc/group file.\",\"RHEL-07-020300\",\"If a user is assigned the GID of a group not existing on the system, and a group with the GID is subsequently created, the user may have unintended rights to any files associated with the group.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mmPdRsWMT1RXStEFvhbFi2NPQhPau7t1mLPRqSfrlso=\"},\"C-4586r88578_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:y96yxmL2BuOT8czP6029uRiO6H3TBaJbbwlQckB5Hzw=\"},\"F-4586r88579_fix\",\"V-204462\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",358,\"SV-204462r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the root account must be the only account having unrestricted access to the system.\",\"RHEL-07-020310\",\"If an account other than root also has a User Identifier (UID) of \\\"0\\\", it has root authority, giving that account unrestricted access to the entire operating system. Multiple accounts with a UID of \\\"0\\\" afford an opportunity for potential intruders to guess a password for a privileged account.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MCpiixKAw6iysD7QdBwvf/0nHCrKyrAMLWQ4JNX0Bl4=\"},\"C-4587r88581_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:GsC5G7HipGtW+62NgiZQXAkutlZWBE/GXEKtN8U0I/Q=\"},\"F-4587r88582_fix\",\"V-204463\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",359,\"SV-204463r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories have a valid owner.\",\"RHEL-07-020320\",\"Unowned files and directories may be unintentionally inherited if a user is assigned the same User Identifier \\\"UID\\\" as the UID of the un-owned files.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PkSBdKqiF+1CoNw6WAjSOHw0QMu48lpgS7hmAFLNKw8=\"},\"C-4588r88584_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vovSWqnTRcIm/6qmsLOTgH+/9w+W/vFltxdwhBfPZKA=\"},\"F-4588r88585_fix\",\"V-204464\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",360,\"SV-204464r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories have a valid group owner.\",\"RHEL-07-020330\",\"Files without a valid group owner may be unintentionally inherited if a group is assigned the same Group Identifier (GID) as the GID of the files without a valid group owner.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DgsJDDQVqbrezHTaPjQzaqTduH3lEoKAMNNMCRj803k=\"},\"C-4589r88587_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XGxN69S1ERxDxrpoViLVhQRmBwhqv05Lu3rnmLO0oJ4=\"},\"F-4589r88588_fix\",\"V-204465\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",361,\"SV-204465r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive users have a home directory assigned in the /etc/passwd file.\",\"RHEL-07-020600\",\"If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nJKpEfqumuAlnJnurMfT8V8fSO3ydCuFSVHs1UY9GPo=\"},\"C-4590r88590_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OeDu1aipDedHmc19/Hzvj5ebEOIbnKBqTl8bOptR+Go=\"},\"F-4590r88591_fix\",\"V-204466\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",362,\"SV-204466r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user accounts, upon creation, are assigned a home directory.\",\"RHEL-07-020610\",\"If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KjHexj1LNSBP7CHmbNY3vvDc8KQeFRj4apAjjK7uRz8=\"},\"C-4591r88593_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vwYoTQjccTE77nR+wCGdiEu6mm4DUZtTWHdqEzVbIDk=\"},\"F-4591r88594_fix\",\"V-204467\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",363,\"SV-204467r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are defined in the /etc/passwd file.\",\"RHEL-07-020620\",\"If a local interactive user has a home directory defined that does not exist, the user may be given access to the / directory as the current working directory upon logon. This could create a Denial of Service because the user would not be able to access their logon configuration files, and it may give them visibility to system files they normally would not be able to access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IUowyh9fpAWNacEDCWcoW0ywTTeAFy1QJWtS37N3CvU=\"},\"C-4592r88596_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:f13Hkn8e4tzMje7pXIcxv5nytn7jo//XK+PrDi1dyWs=\"},\"F-4592r88597_fix\",\"V-204468\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",364,\"SV-204468r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories have mode 0750 or less permissive.\",\"RHEL-07-020630\",\"Excessive permissions on local interactive user home directories may allow unauthorized access to user files by other users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RVZyk6n7GgpVN69UGZjh42yXz3qHC+E11xMgNQqKqeA=\"},\"C-4593r88599_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fkXJCERE3hQ+ziCN+fp8Iy0BGhZ2sENcZRYvDy9Zp4M=\"},\"F-4593r88600_fix\",\"V-204469\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",365,\"SV-204469r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are owned by their respective users.\",\"RHEL-07-020640\",\"If a local interactive user does not own their home directory, unauthorized users could access or modify the user's files, and the users may not be able to access their own files.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4jt4mkKBzSe4CWKOCChBtcLEVdWyrxsrtYUDQqOWPb4=\"},\"C-4594r88602_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:V6lI0oDUoQokm4czgGuQfbxZHuD5cf984TnzjPNE6AI=\"},\"F-4594r88603_fix\",\"V-204470\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",366,\"SV-204470r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are group-owned by the home directory owners primary group.\",\"RHEL-07-020650\",\"If the Group Identifier (GID) of a local interactive user's home directory is not the same as the primary GID of the user, this would allow unauthorized access to the user's files, and users that share the same group may not be able to access files that they legitimately should.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AK8GPupR9o9w4Bpqm2vkAfSZfDDOTxHxIQYgJ4RNCtU=\"},\"C-4595r88605_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PDyQBeVHE7VC7Z4oNAi4BsMfmcg/7HUqDYEmFDrrYhc=\"},\"F-4595r88606_fix\",\"V-204471\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",367,\"SV-204471r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories are owned by the owner of the home directory.\",\"RHEL-07-020660\",\"If local interactive users do not own the files in their directories, unauthorized users may be able to access them. Additionally, if files are not owned by the user, this could be an indication of system compromise.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CUecwNXz6GFSUPJZXW1ugeOxM+oEICWaiuiBIttVcmE=\"},\"C-4596r88608_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2ynIHTJxW/hjjVBnoE3aH3Dx64kMUvPw3sE8bQ/tZFg=\"},\"F-4596r88609_fix\",\"V-204472\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",368,\"SV-204472r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member.\",\"RHEL-07-020670\",\"If a local interactive user's files are group-owned by a group of which the user is not a member, unintended users may be able to access them.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v1B+Day0uLquC3G3rkAZLvKRlB/UsiRznWww8MhD2Ns=\"},\"C-4597r88611_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2KJKevWHOUHMQKjoQwxaE2WAGIXLMzDOWnovDK4DZns=\"},\"F-4597r88612_fix\",\"V-204473\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",369,\"SV-204473r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories have a mode of 0750 or less permissive.\",\"RHEL-07-020680\",\"If a local interactive user files have excessive permissions, unintended users may be able to access or modify them.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uxK1tQMsGtXuIVRNHQgns3AeLuOfO8jy94kjoPQ2L+g=\"},\"C-4598r88614_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XV3izjAIenixvx0nqsZoW+XWGaX6te1P3K0d1un2MOM=\"},\"F-4598r88615_fix\",\"V-204474\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",370,\"SV-204474r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local initialization files for interactive users are owned by the home directory user or root.\",\"RHEL-07-020690\",\"Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uxK1tQMsGtXuIVRNHQgns3AeLuOfO8jy94kjoPQ2L+g=\"},\"C-4599r88617_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zgcP3101YueZ5H1sOBSOtCI20rSAHZPmMQIWD74FgfY=\"},\"F-4599r88618_fix\",\"V-204475\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",371,\"SV-204475r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local initialization files for local interactive users are be group-owned by the users primary group or root.\",\"RHEL-07-020700\",\"Local initialization files for interactive users are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vX6dN7EfNthdimlLaFh0Q9z6OmJUHbzovDHwg8c8NHU=\"},\"C-4600r88620_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hED2+/cZGpIdVgJ0q4fRlhVaRWUvsLQbvwPtOtoQWxY=\"},\"F-4600r88621_fix\",\"V-204476\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",372,\"SV-204476r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local initialization files have mode 0740 or less permissive.\",\"RHEL-07-020710\",\"Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nMN0kK1ic7h1eLInaM6SrG+c+t8cGPkmMerp3/LQra8=\"},\"C-4601r88623_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lfpVJ/f47cYlqC2Iqf5QP2GfumZTqSvKzQqeqevyjkw=\"},\"F-4601r88624_fix\",\"V-204477\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",373,\"SV-204477r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user initialization files executable search paths contain only paths that resolve to the users home directory.\",\"RHEL-07-020720\",\"The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory (other than the user's home directory), executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two consecutive colons, this is interpreted as the current working directory. If deviations from the default system search path for the local interactive user are required, they must be documented with the Information System Security Officer (ISSO).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Jjjq7xVAWflOe4CoFgZpUiv9Y1NWKcp73tzANZZz+gw=\"},\"C-4602r88626_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:c71mt3rovTr0gD67mVjW85xuJx1Gn3YVBPAifDNyrVc=\"},\"F-4602r88627_fix\",\"V-204478\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",374,\"SV-204478r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that local initialization files do not execute world-writable programs.\",\"RHEL-07-020730\",\"If user start-up files execute world-writable programs, especially in unprotected directories, they could be maliciously modified to destroy user files or otherwise compromise the system at the user level. If the system is compromised at the user level, it is easier to elevate privileges to eventually compromise the system at the root and network level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:X06vDs2tR3QGoQ+xoPHCwRpZHEYU9e6HRZHfgAas1TE=\"},\"C-4603r88629_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bAJKBf4BozI/fviaN/J4hW6lYCK5730YjnmMZI8SZhY=\"},\"F-4603r88630_fix\",\"V-204479\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",375,\"SV-204479r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all system device files are correctly labeled to prevent unauthorized modification.\",\"RHEL-07-020900\",\"If an unauthorized or modified device is allowed to exist on the system, there is the possibility the system may perform unintended or unauthorized operations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rTAfVwmsa16lr6s7L1HVMt53f8c4APqViMHCPG3PQ0c=\"},\"C-4604r88632_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MCtlDRYVTGx0QAFvjnLcwUlRaRnKewVZwCEqHsR69vc=\"},\"F-4604r88633_fix\",\"V-204480\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",376,\"SV-204480r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that file systems containing user home directories are mounted to prevent files with the setuid and setgid bit set from being executed.\",\"RHEL-07-021000\",\"The \\\"nosuid\\\" mount option causes the system to not execute setuid and setgid files with owner privileges. This option must be used for mounting any file system not containing approved setuid and setguid files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oNIXrV8IrUz3LBKHcpc5OkB5AAV30a49EWBJw8tFGRI=\"},\"C-4605r88635_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:A9U1/Kh+oVjKN0jAypf2fLI0wUE+tPD5KlslHPZ6aQw=\"},\"F-4605r88636_fix\",\"V-204481\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",377,\"SV-204481r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.\",\"RHEL-07-021010\",\"The \\\"nosuid\\\" mount option causes the system to not execute \\\"setuid\\\" and \\\"setgid\\\" files with owner privileges. This option must be used for mounting any file system not containing approved \\\"setuid\\\" and \\\"setguid\\\" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:u7P2t9CBo4bVxiR7YZbGpIUx/LFmWm/tqN+oNRgHAME=\"},\"C-4606r88638_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B30lyHn2hJcrEol+Itn5ztKfCEjGM7iuUWexOnyqja0=\"},\"F-4606r88639_fix\",\"V-204482\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",378,\"SV-204482r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are being imported via Network File System (NFS).\",\"RHEL-07-021020\",\"The \\\"nosuid\\\" mount option causes the system to not execute \\\"setuid\\\" and \\\"setgid\\\" files with owner privileges. This option must be used for mounting any file system not containing approved \\\"setuid\\\" and \\\"setguid\\\" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bNGETuyi+t5ZcClrjc42GS9cWGj/6HLIX7UykCKyI9I=\"},\"C-4607r88641_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:izR6tZbtPgWAisBlIjGs3YMJNpiPvp0YrUH300TXERk=\"},\"F-4607r88642_fix\",\"V-204483\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",379,\"SV-204483r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent binary files from being executed on file systems that are being imported via Network File System (NFS).\",\"RHEL-07-021021\",\"The \\\"noexec\\\" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files as they may be incompatible. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+rITfa9uPWXKr2BTckVmwYe0uqE2Xqu4VJaGlyUb/tU=\"},\"C-4608r88644_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:LyHAJsCX564T9Ld2guDnewiwJ2c5r5nZSosa5H1Xdu8=\"},\"F-4608r88645_fix\",\"V-204484\",\"low\",\"SRG-OS-000368-GPOS-00154\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",380,\"SV-204484r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must mount /dev/shm with the nodev option.\",\"RHEL-07-021022\",\"The \\\"nodev\\\" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c76gZ1SY4u9l79FnrsQHACwNc4CL62N+zPqo7zmpzkA=\"},\"C-4609r88647_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:txPPE7KSlIBN9F/tup+d+px5xHuUHHHEq3zGVD74WZ8=\"},\"F-4609r88648_fix\",\"V-204485\",\"low\",\"SRG-OS-000368-GPOS-00154\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",381,\"SV-204485r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must mount /dev/shm with the nosuid option.\",\"RHEL-07-021023\",\"The \\\"nosuid\\\" mount option causes the system to not execute \\\"setuid\\\" and \\\"setgid\\\" files with owner privileges. This option must be used for mounting any file system not containing approved \\\"setuid\\\" and \\\"setguid\\\" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+Cd2E8o4ONaUdrAAVpMr0bFQJFkRt9EDcw+xhFpcySU=\"},\"C-4610r88650_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oHUhPRya0ZChLM+Nhu19UnAx5gOJ6gN6DT+c0ZfQLjo=\"},\"F-4610r88651_fix\",\"V-204486\",\"low\",\"SRG-OS-000368-GPOS-00154\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",382,\"SV-204486r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must mount /dev/shm with the noexec option.\",\"RHEL-07-021024\",\"The \\\"noexec\\\" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files as they may be incompatible. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:68kXW4hDQ+wT9SdXi8wMj/sov4EvnCOjABVhUZDBnBo=\"},\"C-4611r88653_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:83kRFa5no0nmunBS+gSPgjh4XcsNZklC+6sA2t8+kXo=\"},\"F-4611r88654_fix\",\"V-204487\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",383,\"SV-204487r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all world-writable directories are group-owned by root, sys, bin, or an application group.\",\"RHEL-07-021030\",\"If a world-writable directory has the sticky bit set and is not group-owned by a privileged Group Identifier (GID), unauthorized users may be able to modify files created by others.\\n\\nThe only authorized public directories are those temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage, (e.g., /tmp), and for directories requiring global read/write access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1XgmUIRB6alinIiV63h8l4a4c+FpBsGbCgpB3sm/gQ4=\"},\"C-4612r88656_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:u0/cFHEM/xlDUYJ90JmsaS3bdmwY8gRr+EjqVIoj7vM=\"},\"F-4612r88657_fix\",\"V-204488\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",384,\"SV-204488r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must set the umask value to 077 for all local interactive user accounts.\",\"RHEL-07-021040\",\"The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 700 or less permissive. Although umask can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be \\\"0\\\". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MnVJuhcg4+npgMSzOK+ZI3jYbv9R79L3Pw0sG4OGjuY=\"},\"C-4613r88659_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ml9/OTeVKu9RrgGyw3MUaFEGuvSL9eoIA/iBk14uSbQ=\"},\"F-4613r88660_fix\",\"V-204489\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",385,\"SV-204489r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must have cron logging implemented.\",\"RHEL-07-021100\",\"Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hAE8/s/q+2bPxB0JEqCor5YiRwtPpCKQTpKO19s+CsE=\"},\"C-4614r88662_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HoJ5w5/OwkGpsfXKH28H0ocQMj/3zOwF8e8Lr8glasY=\"},\"F-4614r88663_fix\",\"V-204490\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",386,\"SV-204490r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists, is owned by root.\",\"RHEL-07-021110\",\"If the owner of the \\\"cron.allow\\\" file is not set to root, the possibility exists for an unauthorized user to view or to edit sensitive information.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2dsipNSSkkuhCPSuvfUEnxPPKLhEefb0wQ5pWOxGi1s=\"},\"C-4615r88665_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:WJ6fBifQQVq1bOrhsHodd56xXHAwG48s2i17d+TgZP8=\"},\"F-4615r88666_fix\",\"V-204491\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",387,\"SV-204491r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists, is group-owned by root.\",\"RHEL-07-021120\",\"If the group owner of the \\\"cron.allow\\\" file is not set to root, sensitive information could be viewed or edited by unauthorized users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ouKxFOOPpBEfihfWTLMVhsHI14OUZyPa8UIIzq+9aDM=\"},\"C-4616r88668_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nr5wfFxT0WmrANwdPMiqK5tUbpZe7VTGB5cXzmlYXWE=\"},\"F-4616r88669_fix\",\"V-204492\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",388,\"SV-204492r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must disable Kernel core dumps unless needed.\",\"RHEL-07-021300\",\"Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps may consume a considerable amount of disk space and may result in denial of service by exhausting the available space on the target file system partition.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7PN7qrWKJmcvXiHYyWoVhaf0vMJwkBzlYvMLMqakubE=\"},\"C-4617r88671_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FESCG4d/9iAZyFfuPeXnTNkZi64m9INnnm4n9aC52FI=\"},\"F-4617r88672_fix\",\"V-204493\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",389,\"SV-204493r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that a separate file system is used for user home directories (such as /home or an equivalent).\",\"RHEL-07-021310\",\"The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1cCc49bcm+M75v2YFAybr7leYSlE+gJkFfU7F/sl09M=\"},\"C-4618r88674_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C2bv9rIevJ1z1iyzLf8xYIUwpYUQWtFzgJ0EtVzj1b0=\"},\"F-4618r88675_fix\",\"V-204494\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",390,\"SV-204494r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must use a separate file system for /var.\",\"RHEL-07-021320\",\"The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XJvN48pmi8HAcsDkJM/G14Kd6I6pzdqyNmh7aTUWPog=\"},\"C-4619r88677_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NPfLVxGk1uPQ98SX656t+VIJsK19BOAD7ay7Qu0w7ck=\"},\"F-4619r88678_fix\",\"V-204495\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",391,\"SV-204495r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must use a separate file system for the system audit data path.\",\"RHEL-07-021330\",\"The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:18y0TK+OVu1ckq6VVHACpujYOUOuHE9k0lnFU7vZePY=\"},\"C-4620r88680_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B9gPCX4PFcoRc5Vm3y0wzQEuWJY0O+DtUXFoEcYdlSY=\"},\"F-4620r88681_fix\",\"V-204496\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",392,\"SV-204496r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must use a separate file system for /tmp (or equivalent).\",\"RHEL-07-021340\",\"The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Eqvpa3O8L/43+F/dfd3RCBJOqej2+xWuUq9l9HGqyf8=\"},\"C-4621r88683_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jXW05QbpEzlIDpcMBVrdzEstoZVo3Ubv2bc8/2DTpac=\"},\"F-4621r88684_fix\",\"V-204497\",\"high\",\"SRG-OS-000033-GPOS-00014\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",393,\"SV-204497r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with a\",\"RHEL-07-021350\",\"Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\\n\\nSatisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000185-GPOS-00079, SRG-OS-000396-GPOS-00176, SRG-OS-000405-GPOS-00184, SRG-OS-000478-GPOS-00223\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gqquU+6877zdN2QBJVLYBJLAgY9YaeAMGXWhfOMdJDc=\"},\"C-4622r88686_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:340oKSUye0fhpJyu4pBuORuPrLVb6J7Ia64/DF2LHHM=\"},\"F-4622r88687_fix\",\"V-204498\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",394,\"SV-204498r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the file integrity tool is configured to verify Access Control Lists (ACLs).\",\"RHEL-07-021600\",\"ACLs can provide permissions beyond those permitted through the file mode and must be verified by file integrity tools.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BuBYuHuQAvXuOxcqP3DStX9B4QilMV8GArQJSwKL4qk=\"},\"C-4623r88689_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+f/QFLk9K+H3NQDA2eP/vOV+0hz8XlNBateHJaucadA=\"},\"F-4623r88690_fix\",\"V-204499\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",395,\"SV-204499r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the file integrity tool is configured to verify extended attributes.\",\"RHEL-07-021610\",\"Extended attributes in file systems are used to contain arbitrary data and file metadata with security implications.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nqqG2GW71CBVy4Zbpx5pP8sJyDtQRHFZG9xO9W+fhaY=\"},\"C-4624r88692_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QMPyNe4roXVyfO/NnAf18sgASR0e2B1wqdT6D4qATSY=\"},\"F-4624r88693_fix\",\"V-204500\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",396,\"SV-204500r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must use a file integrity tool that is configured to use FIPS 140-2 approved cryptographic hashes for validating file contents and directories.\",\"RHEL-07-021620\",\"File integrity tools use cryptographic hashes for verifying file contents and directories have not been altered. These hashes must be FIPS 140-2 approved cryptographic hashes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:APlAz7ZItAMZCPrk0PRupBAoTrM5Bx3+9xNBo4579+0=\"},\"C-4625r88695_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cMCdYD5AiShSbfVloMRt6g3gUP7LLewSgx2SyXMlHFk=\"},\"F-4625r88696_fix\",\"V-204501\",\"medium\",\"SRG-OS-000364-GPOS-00151\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",397,\"SV-204501r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not allow removable media to be used as the boot loader unless approved.\",\"RHEL-07-021700\",\"Malicious users with removable boot media can gain access to a system configured to use removable media as the boot loader. If removable media is designed to be used as the boot loader, the requirement must be documented with the Information System Security Officer (ISSO).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cp2RMg6QxCqTvmqP37SKwG1FqsgipFxqR3t5FU4PXLk=\"},\"C-4626r88698_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+JK6qsOZ0/f3jw+GVOKxXzJfdL75RKoM5+nkeNBSwDo=\"},\"F-4626r88699_fix\",\"V-204502\",\"high\",\"SRG-OS-000095-GPOS-00049\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",398,\"SV-204502r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have the telnet-server package installed.\",\"RHEL-07-021710\",\"It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\\n\\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).\\n\\nExamples of non-essential capabilities include, but are not limited to, games, software packages, tools, and demonstration software not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Z7b6Mm6lUqwXG2sdLSsdV3B3gZr1qR0O9kZkWEmbxrM=\"},\"C-4627r88701_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/4EWh8HGiUPHSSmWJEeEoA7QVt/i4fYiGMgMiSXKZPA=\"},\"F-4627r88702_fix\",\"V-204503\",\"high\",\"SRG-OS-000038-GPOS-00016\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",399,\"SV-204503r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of th\",\"RHEL-07-030000\",\"Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nAudit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.\\n\\nAssociating event types with detected events in the operating system audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured operating system.\\n\\nSatisfies: SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000042-GPOS-00021, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qglSyMZMvG/rrLNnILUfVZ3YuFZFi5T6+KZGiWAdQ/A=\"},\"C-4628r88704_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6xjMdWgrCBOAv09QpXdtDYvHZLQ+b9mnJgExj1C/Nrc=\"},\"F-4628r88705_fix\",\"V-204504\",\"medium\",\"SRG-OS-000046-GPOS-00022\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",400,\"SV-204504r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must shut down upon audit processing failure, unless availability is an overriding concern. If availability is a concern, the system must alert the designated staff (System Administrator [SA] and Information S\",\"RHEL-07-030010\",\"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.\\n\\nAudit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.\\n\\nThis requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.\\n\\nSatisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000047-GPOS-00023\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GlCYNKZ4IKbMHrBwdJyaGeNDUtXvok0O5JQhengD9bI=\"},\"C-4629r88707_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ytY6syQ7DRKurVfyuaATJjO7HK1ts6aQR0tZCIf8Ie4=\"},\"F-4629r88708_fix\",\"V-204505\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",401,\"SV-204505r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to use the au-remote plugin.\",\"RHEL-07-030200\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nWithout the configuration of the \\\"au-remote\\\" plugin, the audisp-remote daemon will not off-load the logs from the system being audited.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BqnXskmzv0Fml5dUryA9empCvoF4uJVgP7gSzNJBG5Q=\"},\"C-4630r88710_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OzaEK+xwE4QT0b0pQEOvNF6OWexP72bOIc5JEdcUGuk=\"},\"F-4630r88711_fix\",\"V-204506\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",402,\"SV-204506r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must configure the au-remote plugin to off-load audit logs using the audisp-remote daemon.\",\"RHEL-07-030201\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nWithout the configuration of the \\\"au-remote\\\" plugin, the audisp-remote daemon will not off load the logs from the system being audited.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:l+C+NK9AgsqOtIckjdTH4jH0PdnaS4ciKjpNRfQiUbQ=\"},\"C-4631r88713_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:p4NuyS6snIbSrRC2m6yASdhY1FUZkGFyIQRGi5/wXk4=\"},\"F-4631r88714_fix\",\"V-204507\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",403,\"SV-204507r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must take appropriate action when the audisp-remote buffer is full.\",\"RHEL-07-030210\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nWhen the remote buffer is full, audit logs will not be collected and sent to the central log server.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hcASCCaQ6DCZhsOVgtG2fCLYh13EpBUcl5ehg9PF3Js=\"},\"C-4632r88716_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:U6YLDhJ893R7sPbp7NC27z+9DeVXlqe980JXLuAfpPo=\"},\"F-4632r88717_fix\",\"V-204508\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",404,\"SV-204508r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must label all off-loaded audit logs before sending them to the central log server.\",\"RHEL-07-030211\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nWhen audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be analyzed and tied back to the correct system.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XkQ6DCdOAKS0GwAwhQplZEj8R1FV2bl5hQua4nPED4k=\"},\"C-4633r88719_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kSsD36pnjKCClXikSWuQ1pP1rZFh01i/y53w3iNUhVI=\"},\"F-4633r88720_fix\",\"V-204509\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",405,\"SV-204509r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must off-load audit records onto a different system or media from the system being audited.\",\"RHEL-07-030300\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Bf2fWApv0APcqeZ5XF4R3RXo/goqg4pCstdRuIGQtss=\"},\"C-4634r88722_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:giS9pFUiCrhO1TkbbeSyXejUIjjJKDujN4BntbuGaXU=\"},\"F-4634r88723_fix\",\"V-204510\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",406,\"SV-204510r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited.\",\"RHEL-07-030310\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:M4dQIiEBGtvfjwdGLgcnbZPAohqROn1I34DQD4YRp64=\"},\"C-4635r88725_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sXHGhtqxex7BLAMaVPnlDAgGWULXebvIAQ4yeHY17bw=\"},\"F-4635r88726_fix\",\"V-204511\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",407,\"SV-204511r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the audit system takes appropriate action when the audit storage volume is full.\",\"RHEL-07-030320\",\"Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3wu6Xlq+C0xzTcZhVKXS6/ol6uXxhMPvS8I8O+1XaqI=\"},\"C-4636r88728_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:le7qN6zmE7PQ4gZdn8UO/rZlhQCMUymKprBd07poQN4=\"},\"F-4636r88729_fix\",\"V-204512\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",408,\"SV-204512r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the audit system takes appropriate action when there is an error sending audit records to a remote system.\",\"RHEL-07-030321\",\"Taking appropriate action when there is an error sending audit records to a remote system will minimize the possibility of losing audit records.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aflWrGGmEaadkYGyiV9fTBb/AxbzyQb2JEc+iSI+NkM=\"},\"C-4637r88731_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qCZZZ4TWBFpqEjjkyQQ2aorhUNgEHavtO0hiaWBbmRQ=\"},\"F-4637r88732_fix\",\"V-204513\",\"medium\",\"SRG-OS-000343-GPOS-00134\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",409,\"SV-204513r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must initiate an action to notify the System Administrator (SA) and Information System Security Officer ISSO, at a minimum, when allocated audit record storage volume reaches 75% of the repository maximum audi\",\"RHEL-07-030330\",\"If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to plan for audit record storage capacity expansion.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ltVAshO8pttoqEyqG6qijiNJqOl2Qg26et8YkE7jF5s=\"},\"C-4638r88734_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KxzZV1AXjjqRD/m745HcjAVzzwYXjKxl5If3x0jrZMw=\"},\"F-4638r88735_fix\",\"V-204514\",\"medium\",\"SRG-OS-000343-GPOS-00134\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",410,\"SV-204514r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) via email when the threshold for the repository maximum audit record storage capacity is reac\",\"RHEL-07-030340\",\"If security personnel are not notified immediately when the threshold for the repository maximum audit record storage capacity is reached, they are unable to expand the audit record storage capacity before records are lost.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Uw4E5/qhIYn2a7XqoO/vCVOGSvxQjO5QMCJ7MHUh3po=\"},\"C-4639r88737_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:F3IcvKBWmicK+KdP03BYHkfQVcnycYYa3Ww3CsjMnjw=\"},\"F-4639r88738_fix\",\"V-204515\",\"medium\",\"SRG-OS-000343-GPOS-00134\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",411,\"SV-204515r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached.\",\"RHEL-07-030350\",\"If security personnel are not notified immediately when the threshold for the repository maximum audit record storage capacity is reached, they are unable to expand the audit record storage capacity before records are lost.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pb9zyKyDrGizMm2SQJsP9iE6S0NT/TD/ykIFMramKTU=\"},\"C-4640r88740_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Jk4zqxy0xY2nrp1dYXkiE3RgwNuE7VZK0/ZJdueJ1ZI=\"},\"F-4640r88741_fix\",\"V-204516\",\"medium\",\"SRG-OS-000327-GPOS-00127\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",412,\"SV-204516r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all executions of privileged functions.\",\"RHEL-07-030360\",\"Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tfgd6xmJ2tetubGheG+rBYQusickUOomvWf+fpjbT7Q=\"},\"C-4641r88743_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:N/N8R/5EbzaxWpnadedKVzeEjXbqgmOONNwPn+bHRRs=\"},\"F-4641r88744_fix\",\"V-204517\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",413,\"SV-204517r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chown syscall.\",\"RHEL-07-030370\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IRTfp4gJecK//m5Q762/0oGsBdPOyjw0rySHurIS8LE=\"},\"C-4642r88746_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Lzjw0z9I6F2iClv12SH/CGeb1U1kLA6Vs1zPNHLvVuQ=\"},\"F-4642r88747_fix\",\"V-204518\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",414,\"SV-204518r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fchown syscall.\",\"RHEL-07-030380\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c3BG+SR2o14aicE+yhq3PtQvfjs3cmTzFbE8tHrvpUA=\"},\"C-4643r88749_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VT1ZFsd5F6gX89ldnJ4WQwNzKVn+O05wg2pOqSoa4Bk=\"},\"F-4643r88750_fix\",\"V-204519\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",415,\"SV-204519r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the lchown syscall.\",\"RHEL-07-030390\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2XtliP/rksJDS7Xvfpls8GPXpBFZoWsdnTomfRmL9QU=\"},\"C-4644r88752_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:a9pQ+UYmeonAb+q0O5K0HvydTCOnpSRwNCVZ1qPIzxM=\"},\"F-4644r88753_fix\",\"V-204520\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",416,\"SV-204520r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fchownat syscall.\",\"RHEL-07-030400\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NQ4XbflQ44GaE3zsieP8DlRi/3mPxweIdroLWHOE4Pg=\"},\"C-4645r88755_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lrdjsFKfpaOe12ODjIvaz6pGUQDdDwa3dj2P2AvnQO8=\"},\"F-4645r88756_fix\",\"V-204521\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",417,\"SV-204521r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chmod syscall.\",\"RHEL-07-030410\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ct96QUF8s7jdqE0Ojh304JzeK8kmZYLbQaQReE84rXs=\"},\"C-4646r88758_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YaQBZRFREVaeABtSVI8wvC8DzIeJkWLuP9gdN4onkGc=\"},\"F-4646r88759_fix\",\"V-204522\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",418,\"SV-204522r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fchmod syscall.\",\"RHEL-07-030420\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rDncDz9FOlJO5zuVTZJbynkJ6dX2Vmq6oI6860tKW3g=\"},\"C-4647r88761_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cqwA8+hvx3TIV+pEBCaRFI8mXzSRXFlA/o8IN6XPhtg=\"},\"F-4647r88762_fix\",\"V-204523\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",419,\"SV-204523r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fchmodat syscall.\",\"RHEL-07-030430\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8tsf1iL2uCKUxO1hoNkCKyC3IFWiTzlQVJpKPEwK0QI=\"},\"C-4648r88764_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4/Y9rUqyPdcCD9Ee+D7kKjsQpUrVo3Y2fNse7I+PSs4=\"},\"F-4648r88765_fix\",\"V-204524\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",420,\"SV-204524r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the setxattr syscall.\",\"RHEL-07-030440\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SvFkHfPrdOQKr5ne1xqIFighaKbfQ/sihawpHb7p7rA=\"},\"C-4649r88767_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wLwqr7Awa4pIak8mi9ElXBAr4HnVTHOllj07wZTbP2M=\"},\"F-4649r88768_fix\",\"V-204525\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",421,\"SV-204525r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fsetxattr syscall.\",\"RHEL-07-030450\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xCC65vU4a0dx3uNjyFYVXGG1SRtdEiyjqGvJjghYeow=\"},\"C-4650r88770_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SIoz7aeiUTREx9WK/3oog5vv1qzPOYJ0E0oTAI8mJ8c=\"},\"F-4650r88771_fix\",\"V-204526\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",422,\"SV-204526r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the lsetxattr syscall.\",\"RHEL-07-030460\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kE1xvX7cLhAoPe9cvYdrUdLUAfjE7eLXYem3Gw8DNLs=\"},\"C-4651r88773_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:F6IhUU6xp6NUpuB/qpY3XXNN1ASs9zdvMmmF9/zPDwU=\"},\"F-4651r88774_fix\",\"V-204527\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",423,\"SV-204527r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the removexattr syscall.\",\"RHEL-07-030470\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vnSamAe2+/Hr+nfPkTqL9I0bWVmWTIFQpYfsqnVG9F8=\"},\"C-4652r88776_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Lg3LvhwYivRIIFbmUNu5aXJNKKGBMSEBPbjWRrOtSuM=\"},\"F-4652r88777_fix\",\"V-204528\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",424,\"SV-204528r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fremovexattr syscall.\",\"RHEL-07-030480\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qHpyKM8i0QhH/xmWGRB3HGZ+olnqtUnASbAZecaifiM=\"},\"C-4653r88779_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NgalkY0uC0B3Y5qlj+v1Efd1XY1ykcDyIwUBqXjsfLA=\"},\"F-4653r88780_fix\",\"V-204529\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",425,\"SV-204529r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the lremovexattr syscall.\",\"RHEL-07-030490\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9kmHZoiuoiL6AsWMWz23RZbKzak8ErxyC7YO6g8muqE=\"},\"C-4654r88782_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5sGvUlB7gnIf90PrEFOfkewhURxAI1SWz7kIMnanjXg=\"},\"F-4654r88783_fix\",\"V-204530\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",426,\"SV-204530r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the creat syscall.\",\"RHEL-07-030500\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QLmTItOwmEnfzdlxDbgeaEgT0GU0Nbb70w5rFh7+ClA=\"},\"C-4655r88785_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6zBN3awVnJJxpbFDd7rNtN56UvR4PeH9i+8VXL2iq1Y=\"},\"F-4655r88786_fix\",\"V-204531\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",427,\"SV-204531r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the open syscall.\",\"RHEL-07-030510\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/PZC/00fiKOLVTTaP7vTKSayzSFdhYJTeG7hNLk4+gE=\"},\"C-4656r88788_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bvOEkYRfhusdNwFelT4MbDopZr6A0Sge446avyeOeUw=\"},\"F-4656r88789_fix\",\"V-204532\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",428,\"SV-204532r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the openat syscall.\",\"RHEL-07-030520\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jhuvdlST3755aQuU9dw8itd/oBXZUB3VR1y2ygyl5FI=\"},\"C-4657r88791_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:r/0O2zTE5O+392jpkFNgse//67/OEAkktr2AzRD7wyU=\"},\"F-4657r88792_fix\",\"V-204533\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",429,\"SV-204533r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the open_by_handle_at syscall.\",\"RHEL-07-030530\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tA45OvJ+kaPqzTLBG3AsIdZ+y1Fsg6ea5iZ7tEfE1dQ=\"},\"C-4658r88794_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FiHAEf5+7+wojzlrnbsH3ebzF+bOSRMAJ7VNN4gVzlA=\"},\"F-4658r88795_fix\",\"V-204534\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",430,\"SV-204534r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the truncate syscall.\",\"RHEL-07-030540\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aAoxDRfMkHNrqAeotAp74gpKHv9wOXogrgjeQ7eJGQA=\"},\"C-4659r88797_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:iBhBh/4FwIsthObBlwNsPC4Max9BYz/32jCUuYl0CN0=\"},\"F-4659r88798_fix\",\"V-204535\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",431,\"SV-204535r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the ftruncate syscall.\",\"RHEL-07-030550\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yz9ySMXJdb86u8eDi3onAaj+kp672EFyUXztQ5ZavCQ=\"},\"C-4660r88800_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ymhy4VaIZ29+cduBZAwVKhyxZg169tdaJfCPbSkNg34=\"},\"F-4660r88801_fix\",\"V-204536\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",432,\"SV-204536r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the semanage command.\",\"RHEL-07-030560\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:H82QTLuiCWDcZMXUpQQdTEKNJvGkX6x49d2pDZHpYyU=\"},\"C-4661r88803_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CXZ3wbxKuyfW7Hc7A2xWF2jcCkvrJDk5n4MpKx7Jh9Y=\"},\"F-4661r88804_fix\",\"V-204537\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",433,\"SV-204537r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the setsebool command.\",\"RHEL-07-030570\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ERmkPloadjyA5EWZSqAGmmsmSh9yhFCpxtM/g7u2MVY=\"},\"C-4662r88806_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hsy8XmPVJmQFKltnYTmWxXXQKPpivHC8PhsbYMru5+A=\"},\"F-4662r88807_fix\",\"V-204538\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",434,\"SV-204538r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chcon command.\",\"RHEL-07-030580\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yWWSgcAdr7toWF3W2KVSsJEAivLZ/eCE17DkDnuxdnU=\"},\"C-4663r88809_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:H29Zf7IMzj0c2WDyCqJqraBoGasM7wdb72Tx2zKgjKg=\"},\"F-4663r88810_fix\",\"V-204539\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",435,\"SV-204539r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the setfiles command.\",\"RHEL-07-030590\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YXNsFsD1BNTH+UuPUScRJc2/DURz1Fj+3uIcvrRMNdg=\"},\"C-4664r88812_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wKbglrH2LXUYH8odc79kGiaqkdnpz/Ngn/mBGCvfPwM=\"},\"F-4664r88813_fix\",\"V-204540\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",436,\"SV-204540r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all unsuccessful account access events.\",\"RHEL-07-030610\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lJjp0a4I1yjr202W8rakaUjmlWknnhRtwWTbPOgaIB8=\"},\"C-4665r88815_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0mQC9d5eP+LU7s5b1OUMtNKAKQvhAb4VH4Nki+oZvQ4=\"},\"F-4665r88816_fix\",\"V-204541\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",437,\"SV-204541r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all successful account access events.\",\"RHEL-07-030620\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2qmfNcP9ypf8f5/1I1ZWKnvrnO4JwwU1bWjsI78D6KE=\"},\"C-4666r88818_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:j23KNnfT4y4Q+T3/PLJIu9AcgBC+3v1oNGcCzWq9JYc=\"},\"F-4666r88819_fix\",\"V-204542\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",438,\"SV-204542r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the passwd command.\",\"RHEL-07-030630\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gya/2JPlteqFjlFszdxnLFZfGW3EV7vQah2z8gDWTmo=\"},\"C-4667r88821_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KY2hZNWLmBuQzt6IyL5juMxrVmftwMn4HlQ1jU6oLQQ=\"},\"F-4667r88822_fix\",\"V-204543\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",439,\"SV-204543r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the unix_chkpwd command.\",\"RHEL-07-030640\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gi8ZMeceL+SSmRb14wgW06ZvRE7tuolGOXprwyUf+k0=\"},\"C-4668r88824_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:xrqKVwPbs5aekaA17oyUETQ7stRF/qHmet1N2+lY7jU=\"},\"F-4668r88825_fix\",\"V-204544\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",440,\"SV-204544r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the gpasswd command.\",\"RHEL-07-030650\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9sL5nx6+vlT67EKHKU4R5qqJ5n3moOZWw1AikH8pTXk=\"},\"C-4669r88827_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kcjN8hHDyHYyzY66Xm/orQ/6+t3DXU2t/6Mr4aeNajU=\"},\"F-4669r88828_fix\",\"V-204545\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",441,\"SV-204545r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chage command.\",\"RHEL-07-030660\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gqtgtLcu9IdW8tgI/Z/PEk9biRBlGBOHv5LMDpPdpL4=\"},\"C-4670r88830_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QLNijN+/ktoVMtSf8FWijh8WKQU1DpxKnvsPs9TYHoo=\"},\"F-4670r88831_fix\",\"V-204546\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",442,\"SV-204546r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the userhelper command.\",\"RHEL-07-030670\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Yez5vz3QxFhKWn3gCF8yxjW5wBeRRzXNuSoPn6GIO0s=\"},\"C-4671r88833_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:thytcFLh5cIHZuy2u4BfgOSALBemyZQ6F5s/ne6qOzo=\"},\"F-4671r88834_fix\",\"V-204547\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",443,\"SV-204547r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the su command.\",\"RHEL-07-030680\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hC1vcQxqT0u80KTFQPLu/SIk7krmukM+EtUTAUW4Q4A=\"},\"C-4672r88836_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:p4OzTKKgjGDSV/pUdpE/hubQn9MK/F9MZ2hD2sQz0WM=\"},\"F-4672r88837_fix\",\"V-204548\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",444,\"SV-204548r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the sudo command.\",\"RHEL-07-030690\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sTsM/uo7uY/03QywYVZf+XXWwPePPwd6hv1n+aUTiXo=\"},\"C-4673r88839_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qLVnnaX3JtzfwaSqYQolunAg9vfuILgBOx5TwS9/CBI=\"},\"F-4673r88840_fix\",\"V-204549\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",445,\"SV-204549r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.\",\"RHEL-07-030700\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tU3v9z4QSrPw6soKYZKEo2o/9C6DfQXE4mmzVlVGsw8=\"},\"C-4674r88842_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:taMxKHlvcSHa5MrWHLREp57+jZB7dbnWuVFkd/HqAtY=\"},\"F-4674r88843_fix\",\"V-204550\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",446,\"SV-204550r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the newgrp command.\",\"RHEL-07-030710\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:C0RoeHp6aYd9h/bi32FTCOUFtJwNd9lElDmsQIq+wF4=\"},\"C-4675r88845_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2jUfmU4AEu8hT4NZW9E/7rjdUjRflMUEFfPgxFUXZVU=\"},\"F-4675r88846_fix\",\"V-204551\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",447,\"SV-204551r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chsh command.\",\"RHEL-07-030720\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pafqBQ37fC9z4g2ywAqLpjl+XAFqcgxwjjyxs/Verx4=\"},\"C-4676r88848_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cLxeUP3mZ1M9jzX8TTPjs0vy6QD75+qQtPlaSAgSQiw=\"},\"F-4676r88849_fix\",\"V-204552\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",448,\"SV-204552r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the mount command and syscall.\",\"RHEL-07-030740\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged mount commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:caNUlUAL0QTWs82AAVnnqegh0qk/ScQg+zi9M6mXN3Q=\"},\"C-4677r88851_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Zy0AlQ/AK9jrYk7YF0IxUlXJhlHPbVzCfRh1hkQFab4=\"},\"F-4677r88852_fix\",\"V-204553\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",449,\"SV-204553r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the umount command.\",\"RHEL-07-030750\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged mount commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FS0w5y0Nv2J8GgXgjl0+kwNnGa1SOyKNV0kAzuc0Lhc=\"},\"C-4678r88854_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Yn3YWTHi6QKZmIAKqFQXHjUm9ZMaG4AYKwOihst12sU=\"},\"F-4678r88855_fix\",\"V-204554\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",450,\"SV-204554r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the postdrop command.\",\"RHEL-07-030760\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dqcxu/FPpiMQY4drQDT3SVl/Op48vP4lYINaQ/7qycE=\"},\"C-4679r88857_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:L5sMqlW6oTeIfAOPicSMgQJzP1frnBRoZo1ULE8ms5Q=\"},\"F-4679r88858_fix\",\"V-204555\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",451,\"SV-204555r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the postqueue command.\",\"RHEL-07-030770\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mDysNGysefS+eTvNiUFriD9n8ubTJ8X27LObMHof9qM=\"},\"C-4680r88860_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mnbgP41kF+eQDWC3XJbpprjbfNG3To5n7QMtd2b3zDU=\"},\"F-4680r88861_fix\",\"V-204556\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",452,\"SV-204556r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the ssh-keysign command.\",\"RHEL-07-030780\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged ssh commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rEz96y1do/MI6pN7zRcF7HR19einFw1A4ikBHs19nzQ=\"},\"C-4681r88863_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/BAQvnDiTkOcDy7+7rcXBio88IJFaCJV+rp937iHZCo=\"},\"F-4681r88864_fix\",\"V-204557\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",453,\"SV-204557r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the crontab command.\",\"RHEL-07-030800\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ady1u6dO6xtC3UnQhdVbuDv992JbS9UEl9bHXFlDfeU=\"},\"C-4682r88866_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tepGwcttTXBlSxRZeiYWKPNpqYhqMyY67Pq5SGyx9UY=\"},\"F-4682r88867_fix\",\"V-204558\",\"medium\",\"SRG-OS-000471-GPOS-00215\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",454,\"SV-204558r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the pam_timestamp_check command.\",\"RHEL-07-030810\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ktrDKQOFniBjtBla/5sCoFWD4QpBziBp6d3yNj4wSxc=\"},\"C-4683r88869_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NhupFdh9BrfCnk+UCoM9U5iNxBlErlgobWDBG3cY7+0=\"},\"F-4683r88870_fix\",\"V-204559\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",455,\"SV-204559r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the create_module syscall.\",\"RHEL-07-030819\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FKYTZs9Omb9gpZvDDN+VFtmbOEANwAA79jfnk0fdo+4=\"},\"C-4684r88872_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:iyYMEQ9NY1jsBg8aYvinfh87kCf0fxDIHYE5F5wvjD8=\"},\"F-4684r88873_fix\",\"V-204560\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",456,\"SV-204560r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the init_module syscall.\",\"RHEL-07-030820\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DJ473QpyrOIOL4YWEvv/UhC/pdcGoEXF+NICnIw8kXE=\"},\"C-4685r88875_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YO20sjKaSgwWzo5K5zpbLlsrBJRARNcRaQ/WCvAqqPw=\"},\"F-4685r88876_fix\",\"V-204561\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",457,\"SV-204561r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the finit_module syscall.\",\"RHEL-07-030821\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yaISAkFMNlE1gd40ss3E4raZaPutmNF5nUPZxy/dVxE=\"},\"C-4686r88878_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gukXW2K0LmzgeHJsVdPKWm0Dnc8XLdjMo47vFIReIm0=\"},\"F-4686r88879_fix\",\"V-204562\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",458,\"SV-204562r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the delete_module syscall.\",\"RHEL-07-030830\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oBDs5Z67EFgAVh+xQ4UWmvl8l68JaD3MlIWHxZV7Ivg=\"},\"C-4687r88881_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qYL963ACq1nVDqG81Nhwogvxn4pCVk5zYGa6U82IWPo=\"},\"F-4687r88882_fix\",\"V-204563\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",459,\"SV-204563r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the kmod command.\",\"RHEL-07-030840\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yo+7DvmHZV8hyRCSWad1ZfWbs115vSFezvQEM11an2w=\"},\"C-4688r88884_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:DrLGYbRrLcqkaFlvsUgsi805zP8GM1q0BhY+8TbEB80=\"},\"F-4688r88885_fix\",\"V-204564\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",460,\"SV-204564r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.\",\"RHEL-07-030870\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XCeo82R8xQFLoiWbWwslLhkjyDvBriCPlnTPaVCU0O0=\"},\"C-4689r88887_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:iTfdgBwwZUc5xUl78eUFlJ7r99OVpSSYuyt0c9t1ylw=\"},\"F-4689r88888_fix\",\"V-204565\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",461,\"SV-204565r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.\",\"RHEL-07-030871\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mregkcdfFGH6lVk6ARZub4pIX77ZBmx54DG508a9aww=\"},\"C-4690r88890_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SzNb0MZd7tDXe9zrz9tBQl9AKYU9vxCoW/YZ+j5Z2D8=\"},\"F-4690r88891_fix\",\"V-204566\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",462,\"SV-204566r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.\",\"RHEL-07-030872\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lXRvTRQWN34A1q+mXN0yVv2AZrR0vT3Ts/aM1h5LkOo=\"},\"C-4691r88893_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YuxlbzicCJTuUCw8UKAD2dfrvHtiLclVxDfcu6yBHkA=\"},\"F-4691r88894_fix\",\"V-204567\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",463,\"SV-204567r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.\",\"RHEL-07-030873\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:688w5yaOgi6yS2MMu0BXElzK0Nc1j4e7a91fW45De2A=\"},\"C-4692r88896_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9wbu2UEQZg5W0c5/58K+CG9s0WnYuEVRf2xHahsYjn4=\"},\"F-4692r88897_fix\",\"V-204568\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",464,\"SV-204568r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.\",\"RHEL-07-030874\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:umcgNuAsnB59XSjy1I6U++dXqM23CWYChhlv86x8Xuw=\"},\"C-4693r88899_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:w4c+iD078TSfI/nVvVGCuK9E5rXnbgH3VaanYWKniTg=\"},\"F-4693r88900_fix\",\"V-204569\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",465,\"SV-204569r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the rename syscall.\",\"RHEL-07-030880\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mE0MJl83yHmgx0kwKQuKZgNSsnJD2tRsSDRy+kJVHUo=\"},\"C-4694r88902_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MqMWdx8HoJFr5CPVtrttoFouIYkzuaAu0iZSsT0BuvE=\"},\"F-4694r88903_fix\",\"V-204570\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",466,\"SV-204570r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the renameat syscall.\",\"RHEL-07-030890\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SvB0fmN1dM3PsEjEvg5vyZ0zWzSJPOTnbJAICsSPMMU=\"},\"C-4695r88905_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JIX2VnlSvH0MpceK8GMELEnC5U1Vb81fXOVkFOJh0TE=\"},\"F-4695r88906_fix\",\"V-204571\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",467,\"SV-204571r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the rmdir syscall.\",\"RHEL-07-030900\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DS0Fydb5T+qrwtZc8yHRMbt0kZVQKXZvEJkk2pfaoa0=\"},\"C-4696r88908_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:k6ETZYpiAtsCcl8sbY0lyjEPIpX1437rhb9RcZo7Ii4=\"},\"F-4696r88909_fix\",\"V-204572\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",468,\"SV-204572r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the unlink syscall.\",\"RHEL-07-030910\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gQjaLKPqvRmJxPutSuCF2raYWv3G7pqqkl4RYi2CQjI=\"},\"C-4697r88911_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fvZmzi/j1WxOacjuN66vVRNeVl+kmTNB5n2eXA4RUmA=\"},\"F-4697r88912_fix\",\"V-204573\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",469,\"SV-204573r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the unlinkat syscall.\",\"RHEL-07-030920\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:189mZdbWFnTmb/pv12S5jXM09zjsiaBRlTlxaxSpVrA=\"},\"C-4698r88914_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KazPPixn9iBMTwVpaMRQK8IKHGzNe7t2JaJgXt03JSs=\"},\"F-4698r88915_fix\",\"V-204574\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",470,\"SV-204574r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must send rsyslog output to a log aggregation server.\",\"RHEL-07-031000\",\"Sending rsyslog output to another system ensures that the logs cannot be removed or modified in the event that the system is compromised or has a hardware failure.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MwPcFaS7XSTh86tBjhVDJe6I76OH8QTJFy8ThExOTCg=\"},\"C-4699r88917_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pVmbVwyfPytRATXlXvn+p76ybxM6O3oBPglyqw8yf4s=\"},\"F-4699r88918_fix\",\"V-204575\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",471,\"SV-204575r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.\",\"RHEL-07-031010\",\"Unintentionally running a rsyslog server accepting remote messages puts the system at increased risk. Malicious rsyslog messages sent to the server could exploit vulnerabilities in the server software itself, could introduce misleading information in to the system's logs, or could fill the system's storage leading to a Denial of Service.\\n\\nIf the system is intended to be a log aggregation server its use must be documented with the ISSO.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DhilIZI4XItLrdeaFbC8ICZgBN1OCgHuPfD1k8e78sc=\"},\"C-4700r88920_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tuh0npx6WnyQC2URDIxyB9urDMEvi0gcwpWFR4v0veU=\"},\"F-4700r88921_fix\",\"V-204576\",\"low\",\"SRG-OS-000027-GPOS-00008\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",472,\"SV-204576r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must limit the number of concurrent sessions to 10 for all accounts and/or account types.\",\"RHEL-07-040000\",\"Operating system management includes the ability to control the number of users and user sessions that utilize an operating system. Limiting the number of allowed users and sessions per user is helpful in reducing the risks related to DoS attacks.\\n\\nThis requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based on mission needs and the operational environment for each system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:O1hlu7Cy9bkTgUpdl/8swEZmVqrdSxecwRgqIv7TKeI=\"},\"C-4701r88923_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8Ow3JzDo50tPnuuLfgcdLIb5/F/dXCIIRBWsKvJeWWk=\"},\"F-4701r88924_fix\",\"V-204577\",\"medium\",\"SRG-OS-000096-GPOS-00050\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",473,\"SV-204577r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA) an\",\"RHEL-07-040100\",\"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\\n\\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component.\\n\\nTo support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.\\n\\nSatisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JDnnCT7i6KXIu1+6ypsCHBmdw6EQtsr4dSd3kFFR2B4=\"},\"C-4702r88926_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C9wtDic6D6IxHIwpBEoADN3UNF1n/zkJ4DO1Rmx3sR8=\"},\"F-4702r88927_fix\",\"V-204578\",\"medium\",\"SRG-OS-000033-GPOS-00014\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",474,\"SV-204578r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must use a FIPS 140-2 approved cryptographic algorithm for SSH communications.\",\"RHEL-07-040110\",\"Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised.\\n\\nOperating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules.\\n\\nFIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system.\\n\\nSatisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YGctoNEqGYp37D0V7f4JEnaQwZUWRJ16N85m3V1dTA4=\"},\"C-4703r88929_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:7V/YZskuZIFMWUmgA0F+WowCfC79F3qEk3hNicn9Juc=\"},\"F-4703r88930_fix\",\"V-204579\",\"medium\",\"SRG-OS-000163-GPOS-00072\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",475,\"SV-204579r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all network connections associated with a communication session are terminated at the end of the session or after 10 minutes of inactivity from the user at a command prompt, except t\",\"RHEL-07-040160\",\"Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element. \\n\\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kPgd3nZYx8oNc7jNrMPf7SaMkgI7Mpqc+C0Gesho7w0=\"},\"C-4704r88932_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CbJrOqZc9aUjytjiQipH2FQttO6A0xmJSPRZ2xNAGKQ=\"},\"F-4704r88933_fix\",\"V-204580\",\"medium\",\"SRG-OS-000023-GPOS-00006\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",476,\"SV-204580r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner immediately prior to, or as part of, remote access logon prompts.\",\"RHEL-07-040170\",\"Display of a standardized and approved use notification before granting access to the publicly accessible operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007 , SRG-OS-000228-GPOS-00088\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gICjVQBlC2CyjSEDRHoAr3hm79aABc0TAYCd4cyGREM=\"},\"C-4705r88935_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ze0CDAPHd/Z+DRoWsy7rlbe1B/FAjmxymeuyFUVxLGU=\"},\"F-4705r88936_fix\",\"V-204581\",\"medium\",\"SRG-OS-000250-GPOS-00093\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",477,\"SV-204581r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications.\",\"RHEL-07-040180\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IgR19ArnuG58zoGRs25ETsbszS2t2pU66+rmh1ALJZg=\"},\"C-4706r88938_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:67sjwMBDYQYyIYP5nO6e9SccjTN96sfDcHNkmpYO6W0=\"},\"F-4706r88939_fix\",\"V-204582\",\"medium\",\"SRG-OS-000250-GPOS-00093\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",478,\"SV-204582r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.\",\"RHEL-07-040190\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7XIsGNddY755GhU000GYrT04RXf5RlJxt9a8QpJOgWM=\"},\"C-4707r88941_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aDzdhKgdToIxgIHOdlmP6tQ+bOd58icfm4R3mYwxebk=\"},\"F-4707r88942_fix\",\"V-204583\",\"medium\",\"SRG-OS-000250-GPOS-00093\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",479,\"SV-204583r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.\",\"RHEL-07-040200\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zNpBjI7gKD5CGJeHa0TgLmFXquRzktJOpNM1MitUcYA=\"},\"C-4708r88944_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QzcqROrmTjc9BOoYr4nEK3uqGdgRV8SuOfDsOICf/ko=\"},\"F-4708r88945_fix\",\"V-204584\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",480,\"SV-204584r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement virtual address space randomization.\",\"RHEL-07-040201\",\"Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code he or she has introduced into a process's address space during an attempt at exploitation. Additionally, ASLR also makes it more difficult for an attacker to know the location of existing code in order to repurpose it using return-oriented programming (ROP) techniques.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tu8dUs1zi+TVniquX91HB2mrznXWiYevRt36mw4oUc0=\"},\"C-4709r88947_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OeCoQ29Jes44dR6OzCMZZ1F/PQNZix/au38A40JM/Lw=\"},\"F-4709r88948_fix\",\"V-204585\",\"medium\",\"SRG-OS-000423-GPOS-00187\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",481,\"SV-204585r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all networked systems have SSH installed.\",\"RHEL-07-040300\",\"Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. \\n\\nThis requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. \\n\\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, logical means (cryptography) do not have to be employed, and vice versa.\\n\\nSatisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U0+kiCOWAxM37Dm2rN333KIvx6YqKjJfXh9Z8SO0Hw0=\"},\"C-4710r88950_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rDZF521/oH8A2KYzjDsmXNuXcTWUxjr1+bnB8N78kog=\"},\"F-4710r88951_fix\",\"V-204586\",\"medium\",\"SRG-OS-000423-GPOS-00187\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",482,\"SV-204586r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all networked systems use SSH for confidentiality and integrity of transmitted and received information as well as information during preparation for transmission.\",\"RHEL-07-040310\",\"Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. \\n\\nThis requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. \\n\\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.\\n\\nSatisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000423-GPOS-00188, SRG-OS-000423-GPOS-00189, SRG-OS-000423-GPOS-00190\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dkh4lOXziNuIqVk4eaOVLxaMcoWI12sofxv7jKQaw+8=\"},\"C-4711r88953_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Q+ge+udsPuOSaneNaoRiP6qT0I7v5utOt7Yi+ZrWtSE=\"},\"F-4711r88954_fix\",\"V-204587\",\"medium\",\"SRG-OS-000163-GPOS-00072\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",483,\"SV-204587r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all network connections associated with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity, except to fulfill documented and validated mission req\",\"RHEL-07-040320\",\"Terminating an idle SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element.\\n\\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.\\n\\nSatisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KFrNyXlrwufl0fTSC2Xb2SJFGIHk5O3cfMQ8TP0OUcU=\"},\"C-4712r88956_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KCD2uLmWRsM8aj9IlQqXERBKxYqg3/WNWb6mZ9Dl1J4=\"},\"F-4712r88957_fix\",\"V-204588\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",484,\"SV-204588r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using RSA rhosts authentication.\",\"RHEL-07-040330\",\"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:s3HPGztH6jOvI74wiywU7WSmWcHTK8Aw+JzBeFJeV+o=\"},\"C-4713r88959_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aRr6Q+KVIsrwZ81agKF3kJQ+D4tBZOI9I1ZsEqiMojk=\"},\"F-4713r88960_fix\",\"V-204589\",\"medium\",\"SRG-OS-000163-GPOS-00072\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",485,\"SV-204589r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all network connections associated with SSH traffic terminate after a period of inactivity.\",\"RHEL-07-040340\",\"Terminating an idle SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element.\\n\\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.\\n\\nSatisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4oJTyVwrO2R6TmqIF+bsE92/Eo5rArioW/qSFId8tfc=\"},\"C-4714r88962_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Z66CFYVnPNn7K3huS7XeWE1O5Vz7Og//viy4jwSZVH8=\"},\"F-4714r88963_fix\",\"V-204590\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",486,\"SV-204590r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using rhosts authentication.\",\"RHEL-07-040350\",\"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2znyQY3TQ9xKT6QoY0lQ8dx0S8AN67MOq5v/U8DLEh4=\"},\"C-4715r88965_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ydTBWcCVdqH9GwZPSxCb1+Mha35cyxZQZ+PtJTBBj/E=\"},\"F-4715r88966_fix\",\"V-204591\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",487,\"SV-204591r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the date and time of the last successful account logon upon an SSH logon.\",\"RHEL-07-040360\",\"Providing users with feedback on when account accesses via SSH last occurred facilitates user recognition and reporting of unauthorized account use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yX1X8uJ+vqpiTI1YneKPRT+wM/BMopO1gSTrMWwXbLY=\"},\"C-4716r88968_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JJ5Ox1vSig/SsGTtHJKKVEa5/xuzhEH/+pAXuYqInTQ=\"},\"F-4716r88969_fix\",\"V-204592\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",488,\"SV-204592r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not permit direct logons to the root account using remote access via SSH.\",\"RHEL-07-040370\",\"Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging on directly as root. In addition, logging on with a user-specific account provides individual accountability of actions performed on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XefiLkI57brJK6zs5DReGOyqdxXR/FR0JRYBWt4XivE=\"},\"C-4717r88971_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jCt7XP2/joML7K4rmp5RRkBW4Ghsyim2Haa5MjMDry4=\"},\"F-4717r88972_fix\",\"V-204593\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",489,\"SV-204593r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using known hosts authentication.\",\"RHEL-07-040380\",\"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0dqZel9WfGVpxO6OVdTQca14awO4upKlmd0SHcwofA8=\"},\"C-4718r88974_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:e1QPacknVGwhQrTRKO9ch3+12rJP4nUsDzOeg2RKrEY=\"},\"F-4718r88975_fix\",\"V-204594\",\"high\",\"SRG-OS-000074-GPOS-00042\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",490,\"SV-204594r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use the SSHv2 protocol.\",\"RHEL-07-040390\",\"SSHv1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system.\\n\\nSatisfies: SRG-OS-000074-GPOS-00042, SRG-OS-000480-GPOS-00227\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xTLJjvdq15UZDw8G16bCt7+I8XiP/RxZCLmJQpOTmC0=\"},\"C-4719r88977_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:usvEwYL9OkEILqrk7anH3bP3g4cqO6Ot64CCfaWLB20=\"},\"F-4719r88978_fix\",\"V-204595\",\"medium\",\"SRG-OS-000250-GPOS-00093\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",491,\"SV-204595r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.\",\"RHEL-07-040400\",\"DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions. The only SSHv2 hash algorithm meeting this requirement is SHA.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZrwBro/CqOpHuLOT920+WMMOrhs4KR7xtuVSg83ADyY=\"},\"C-4720r88980_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dU8FWoZwp7g+jY/DWHe5T7TwjzaY/5wKrRaYlRza5Ig=\"},\"F-4720r88981_fix\",\"V-204596\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",492,\"SV-204596r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH public host key files have mode 0644 or less permissive.\",\"RHEL-07-040410\",\"If a public host key file is modified by an unauthorized user, the SSH service may be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h0blgpw29xSnpbeqXLAlK16DNURlD9WDnqL8KrTVoVg=\"},\"C-4721r88983_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ZD8sBCF6rqsIMhMVh7zuafBe82s55AJKOiZVo44+sNA=\"},\"F-4721r88984_fix\",\"V-204597\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",493,\"SV-204597r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH private host key files have mode 0640 or less permissive.\",\"RHEL-07-040420\",\"If an unauthorized user obtains the private SSH host key file, the host could be impersonated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LuF6kqpOF9eNjNyaM7lVHX3f2Ce7dRDM7eZK2TV8w6Q=\"},\"C-4722r88986_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eS00OlwHK5cCVIs4PslmH3lcsroembapbUdNCYZMVHs=\"},\"F-4722r88987_fix\",\"V-204598\",\"medium\",\"SRG-OS-000364-GPOS-00151\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",494,\"SV-204598r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.\",\"RHEL-07-040430\",\"GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:95XKdYxzx1qHEALj0vVcUgfFdzE+HDbKJn+kj2tRtCY=\"},\"C-4723r88989_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:q8f6Jmtw61OMK7wrwD6lUOd8HB4HcM3fOlMH3PkuZgg=\"},\"F-4723r88990_fix\",\"V-204599\",\"medium\",\"SRG-OS-000364-GPOS-00151\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",495,\"SV-204599r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed.\",\"RHEL-07-040440\",\"Kerberos authentication for SSH is often implemented using Generic Security Service Application Program Interface (GSSAPI). If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementation may then be subject to exploitation. To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be disabled for systems not using this capability.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XRT3D2vqhfiWwUMNKp1iT0NPdaECtsiOv+PkO9tvPIQ=\"},\"C-4724r88992_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jQUn3D+sFRAlgnGUSH9cqqjkv9PoNyIrXnrGPGcEv5k=\"},\"F-4724r88993_fix\",\"V-204600\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",496,\"SV-204600r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon performs strict mode checking of home directory configuration files.\",\"RHEL-07-040450\",\"If other users have access to modify user-specific SSH configuration files, they may be able to log on to the system as another user.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uaQWPHqYSfcx2Hsbsz6oSx3/NvJ2S9ZZWyR1AaamE3c=\"},\"C-4725r88995_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zZpuieBctwldmi6eIcERNzoXGyEr3faLqs3fQtGyyVw=\"},\"F-4725r88996_fix\",\"V-204601\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",497,\"SV-204601r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon uses privilege separation.\",\"RHEL-07-040460\",\"SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would decrease the impact of software vulnerabilities in the unprivileged section.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZEDgUUGRtYwtdg/7IGePmM+mO77jBmQ2y6qQSJnzh88=\"},\"C-4726r88998_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KYaVM1r633+W0Wve0UtUbhlZczsFNuL7IEagI+ikd2I=\"},\"F-4726r88999_fix\",\"V-204602\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",498,\"SV-204602r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow compression or only allows compression after successful authentication.\",\"RHEL-07-040470\",\"If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vFy+LSYNEqK8q0jlqPSRN9R2KTNP4oH9DkTCn3+F6lU=\"},\"C-4727r89001_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:M/hOba2r0QaIPkgCW9PuPUW++WJrYiNkoxWDWBk0TpA=\"},\"F-4727r89002_fix\",\"V-204603\",\"medium\",\"SRG-OS-000355-GPOS-00143\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",499,\"SV-204603r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must, for networked systems, synchronize clocks with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, a time server designated for the appropriate DoD\",\"RHEL-07-040500\",\"Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.\\n\\nSynchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network.\\n\\nOrganizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints).\\n\\nSatisfies: SRG-OS-000355-GPOS-00143, SRG-OS-000356-GPOS-00144\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cXVgQoJtqPP16H6INhLNMDk5sX6o5q6ee0+MombCLUE=\"},\"C-4728r89004_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ZtOVMm1z0V1iMbun6RkRK9SwQrwqJLpq5eClGiG/Nk4=\"},\"F-4728r89005_fix\",\"V-204604\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",500,\"SV-204604r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must enable an application firewall, if available.\",\"RHEL-07-040520\",\"Firewalls protect computers from network attacks by blocking or limiting access to open network ports. Application firewalls limit which applications are allowed to communicate over the network.\\n\\nSatisfies: SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5AeStZQDNTFP8dyAN+kdFOwEHd7ujN7N8QOsth1BYFI=\"},\"C-4729r89007_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HVYPccbIpDKZ3GH14dxeoC/9Y07YDJ2ua3K1XD8mRwM=\"},\"F-4729r89008_fix\",\"V-204605\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",501,\"SV-204605r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must display the date and time of the last successful account logon upon logon.\",\"RHEL-07-040530\",\"Providing users with feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2MW4CbQWQSdnWTn+vJjAqUXxy39KvlIkThmnSy/UnmI=\"},\"C-4730r89010_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zG2ejNhnMKFBTuhN2Dwb6ws3PtZqpdwum63IT4dN2Do=\"},\"F-4730r89011_fix\",\"V-204606\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",502,\"SV-204606r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not contain .shosts files.\",\"RHEL-07-040540\",\"The .shosts files are used to configure host-based authentication for individual users or the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v4IA4z20DXRjhaVy+lPUHGEq1PKWrz2BRO+w5yuY2A4=\"},\"C-4731r89013_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:iAG2eQUIiF6iF8xBCRDdrpYX7SYLm6n7X1rzAuRhTyA=\"},\"F-4731r89014_fix\",\"V-204607\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",503,\"SV-204607r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not contain shosts.equiv files.\",\"RHEL-07-040550\",\"The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rZwRT3O4olP1cUbfaVWLtsV55GMO6FG1urqqL7Z5if0=\"},\"C-4732r89016_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oTf9BJoMwzWXGsPa9JPAVvuMhtDZFy83jaBTDB/KFpo=\"},\"F-4732r89017_fix\",\"V-204608\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",504,\"SV-204608r241939_rule\",\"low\",null,null,\"For Red Hat Enterprise Linux operating systems using DNS resolution, at least two name servers must be configured.\",\"RHEL-07-040600\",\"To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eQBkLoCxbhLSL0FSX13w71XInyURAJYddveh0zcMYZs=\"},\"C-4733r89019_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:y+24JzwqotIYx7gqe5g6jITwUglOdhYm/qTYhNtdFZk=\"},\"F-4733r89020_fix\",\"V-204609\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",505,\"SV-204609r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets.\",\"RHEL-07-040610\",\"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FwLT66vNGmWrFses/sAjJSSaKxtlj7doQb3MZgBImX8=\"},\"C-4734r89022_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HO2PKACks+73FSunYYTdtPYisctn2lnasLL69QkZx4I=\"},\"F-4734r89023_fix\",\"V-204610\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",506,\"SV-204610r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces.\",\"RHEL-07-040611\",\"Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p1jUPBQZCsvZDLRRitg2VYMt2+J7ICQQdk58h8+Ceww=\"},\"C-4735r89025_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Gq/vTd0tjUvdnU5c0TxXUZhM6dJK0L6q1WsBW6Y6gPU=\"},\"F-4735r89026_fix\",\"V-204611\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",507,\"SV-204611r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when possible by default.\",\"RHEL-07-040612\",\"Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cG2bpeEieasuM4Qt7PgAX0WNy3Jg+IohvlZC3bDIxnk=\"},\"C-4736r89028_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NTL219/6bYDMTON9XSc9S9cWfktEkrQPTcTrRGmhtSc=\"},\"F-4736r89029_fix\",\"V-204612\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",508,\"SV-204612r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default.\",\"RHEL-07-040620\",\"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MRRtJ87d9codxHSiwiP6FQaDVF9nRZZKpZzZKdkt8tc=\"},\"C-4737r89031_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:85PUYBt8Wup7sfq95PhD6gnuL6/s7LBJQuexpMb9+KA=\"},\"F-4737r89032_fix\",\"V-204613\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",509,\"SV-204613r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not respond to Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.\",\"RHEL-07-040630\",\"Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8YTZ6fEoQgsCaCCADaJpdHZaoc+u9wlTzoxXW92DDXI=\"},\"C-4738r89034_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fjCX0oYjs4K4WUl6cdO3QKoRLCxTiAc8/80ZgMIjPqY=\"},\"F-4738r89035_fix\",\"V-204614\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",510,\"SV-204614r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted.\",\"RHEL-07-040640\",\"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/GqImo5AYk9oB6VesRt32EX9qhNxt0bsSwz/JfdpsTM=\"},\"C-4739r89037_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tWci+stkNSEw1rQydP4hqVP4Es8/V0uGvLQAjq4FXy0=\"},\"F-4739r89038_fix\",\"V-204615\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",511,\"SV-204615r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.\",\"RHEL-07-040641\",\"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rajjUFaPBiT4Sd2KHjdKE74EwKfpgWlkjrCk3HupPOg=\"},\"C-4740r89040_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tnpYW+PKr3HpfMAGcg1EJcUhn3xPz0d5BdCvz0h23oM=\"},\"F-4740r89041_fix\",\"V-204616\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",512,\"SV-204616r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not allow interfaces to perform Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects by default.\",\"RHEL-07-040650\",\"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly revealing portions of the network topology.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eI/kCnLWasuxYrqINFrqYvnYRusBETB3PyweSidvuS0=\"},\"C-4741r89043_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cBYZZiaWYKmFjEYKjwUnAbM7tZwSJVrfhYpOGfbhXdk=\"},\"F-4741r89044_fix\",\"V-204617\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",513,\"SV-204617r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects.\",\"RHEL-07-040660\",\"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly revealing portions of the network topology.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ehZyYb58GoVTgK7yVpGqpPJBA7NKrWkkjvGCe4/cHMw=\"},\"C-4742r89046_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:yhEK6NuW4WdRcxfcoTRtFQgiYsMbK57qrVfbNbfQZ9M=\"},\"F-4742r89047_fix\",\"V-204618\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",514,\"SV-204618r241939_rule\",\"medium\",null,null,\"Network interfaces configured on the Red Hat Enterprise Linux operating system must not be in promiscuous mode.\",\"RHEL-07-040670\",\"Network interfaces in promiscuous mode allow for the capture of all network traffic visible to the system. If unauthorized individuals can access these applications, it may allow then to collect information such as logon IDs, passwords, and key exchanges between systems.\\n\\nIf the system is being used to perform a network troubleshooting function, the use of these tools must be documented with the Information System Security Officer (ISSO) and restricted to only authorized personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6FOjMjnPE6o/2RQfLIQ7oCu1NiuJoXu8ZloEh6aQnOc=\"},\"C-4743r89049_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cyM0WmnGxvBXRRp0YFSiJZeW7vUye4blZdY444e0/no=\"},\"F-4743r89050_fix\",\"V-204619\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",515,\"SV-204619r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to prevent unrestricted mail relaying.\",\"RHEL-07-040680\",\"If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay for the purpose of sending spam or other unauthorized activity.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GYLgPoC9dWO6EQnX8n402yDsuMPAnK9fUZjDeNJuVlQ=\"},\"C-4744r89052_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RRWH8/X8wLuvfQSBfZasWwuL/5PBM9a/OsDIO6uaWzo=\"},\"F-4744r89053_fix\",\"V-204620\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",516,\"SV-204620r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have a File Transfer Protocol (FTP) server package installed unless needed.\",\"RHEL-07-040690\",\"The FTP service provides an unencrypted remote access that does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised. SSH or other encrypted file transfer methods must be used in place of this service.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bjTPHU4AZoK6BfgfQVubbfWkNDK50eujmcmoDTDukmw=\"},\"C-4745r89055_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gFY0nCBxuLCZzgbZxxi0+UGWs4WK6U6lg0G4nGms8+c=\"},\"F-4745r89056_fix\",\"V-204621\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",517,\"SV-204621r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have the Trivial File Transfer Protocol (TFTP) server package installed if not required for operational support.\",\"RHEL-07-040700\",\"If TFTP is required for operational support (such as the transmission of router configurations) its use must be documented with the Information System Security Officer (ISSO), restricted to only authorized personnel, and have access control rules established.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N0HT3nvX0nacPF0nic2Fvo+QoxFewqWUvw8Cb2dpdyE=\"},\"C-4746r89058_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/ZanvCC0BUgOEU2xiMkMW8jn2JFseHUzGwkoLvPO7Ww=\"},\"F-4746r89059_fix\",\"V-204622\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",518,\"SV-204622r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that remote X connections for interactive users are encrypted.\",\"RHEL-07-040710\",\"Open X displays allow an attacker to capture keystrokes and execute commands remotely.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BQENP4a828YEZSXVXQtFoPetmYEFb8+83NfUr43aZ74=\"},\"C-4747r89061_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oZYVTfOCZj0stqUz9kKUxX7h+6FupXnYdOdIzRnl0mU=\"},\"F-4747r89062_fix\",\"V-204623\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",519,\"SV-204623r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that if the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon is configured to operate in secure mode.\",\"RHEL-07-040720\",\"Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting system files.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nW951brbjAkAlDNfMZI++v9EZTA23qYKprHAkBSWFUY=\"},\"C-4748r89064_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:g8ZkdpWH96vEPFX5ESHd9ky+MZd0MVuZXesCggS6m34=\"},\"F-4748r89065_fix\",\"V-204624\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",520,\"SV-204624r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not have an X Windows display manager installed unless approved.\",\"RHEL-07-040730\",\"Internet services that are not required for system or application processes must not be active to decrease the attack surface of the system. X Windows has a long history of security vulnerabilities and will not be used unless approved and documented.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ng0nTd+F1YUu4CUZtk3DYlhWROBAoM4ie5InHAQthN4=\"},\"C-4749r89067_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QmMprBr2eZLDrQvdHB9GdZ86VNbOdUvsiMmqhIdbkqg=\"},\"F-4749r89068_fix\",\"V-204625\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",521,\"SV-204625r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not be performing packet forwarding unless the system is a router.\",\"RHEL-07-040740\",\"Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this software is used when not required, system network information may be unnecessarily transmitted across the network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MkXnVi+BfZNKD8HBi1BdRhBwQYqAqk37hdGW0wzHsBo=\"},\"C-4750r89070_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:j6VcelJRgVA4Y3z+Ne5pwBUGCh8q+WYi4U0tTn1l/pU=\"},\"F-4750r89071_fix\",\"V-204626\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",522,\"SV-204626r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.\",\"RHEL-07-040750\",\"When an NFS server is configured to use RPCSEC_SYS, a selected userid and groupid are used to handle requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The RPCSEC_GSS method of authentication uses certificates on the server and client systems to more securely authenticate the remote mount request.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LPkkcM3GKLloG2iIqGS//40g7fdb9hulnGjTO5OPl/c=\"},\"C-4751r89073_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:EaHp4BPOrxxdG+2wJpgynKF1UEZ8Z9HXXq1HwFQhoq4=\"},\"F-4751r89074_fix\",\"V-204627\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",523,\"SV-204627r241939_rule\",\"high\",null,null,\"SNMP community strings on the Red Hat Enterprise Linux operating system must be changed from the default.\",\"RHEL-07-040800\",\"Whether active or not, default Simple Network Management Protocol (SNMP) community strings must be changed to maintain security. If the service is running with the default authenticators, anyone can gather data about the system and the network and use the information to potentially compromise the integrity of the system or network(s). It is highly recommended that SNMP version 3 user authentication and message encryption be used in place of the version 2 community strings.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aj2+q1FDm7tuIsdCJ6yjAVx2dNimOetQj7BToo/VlEg=\"},\"C-4752r89076_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/D2dqEXX4V/I16RqUkyCnszvssRqNUU7YHRl6wMHa/Y=\"},\"F-4752r89077_fix\",\"V-204628\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",524,\"SV-204628r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system access control program must be configured to grant or deny system access to specific hosts and services.\",\"RHEL-07-040810\",\"If the systems access control program is not configured with appropriate rules for allowing and denying access to system network resources, services may be accessible to unauthorized hosts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kkwHgTSKsJctRdFnhk7oBugs+k0hSvrAHTNBODYlnRY=\"},\"C-4753r89079_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CJFIHGHu/Ahf1QpfA3b6XDDdhlwGDdNBStawu9T5tho=\"},\"F-4753r89080_fix\",\"V-204629\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",525,\"SV-204629r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not have unauthorized IP tunnels configured.\",\"RHEL-07-040820\",\"IP tunneling mechanisms can be used to bypass network filtering. If tunneling is required, it must be documented with the Information System Security Officer (ISSO).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A4M7YDCBxwn82FM8E2pYn9DdV8RWXiiwlGjESBKWFWc=\"},\"C-4754r89082_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tLQQARe7p90gWnNRXyllJC/m16NksdyCY9EyUOeRuHM=\"},\"F-4754r89083_fix\",\"V-204630\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",526,\"SV-204630r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not forward IPv6 source-routed packets.\",\"RHEL-07-040830\",\"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:duPPEkYg4Z6hIj9Yd6lOp0gvtSraIDw+nJz6zxmFvqE=\"},\"C-4755r89085_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YSqpQKIwhp2ZC1jrJSTdg7d4cJRA6Hbv++u8d3+ahfQ=\"},\"F-4755r89086_fix\",\"V-204631\",\"medium\",\"SRG-OS-000375-GPOS-00160\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",527,\"SV-204631r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must have the required packages for multifactor authentication installed.\",\"RHEL-07-041001\",\"Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\\n\\nA privileged account is defined as an information system account with authorizations of a privileged user.\\n\\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management).\\n\\nSatisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:C1LYFgaAqeuTh7Gtm38t3OcPVMq8CySBTILHzdSksbQ=\"},\"C-4756r89088_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XDloiqHMj2ldT1rBcJmIwqmYeKadE4QFbz+ypjK1Xd8=\"},\"F-4756r89089_fix\",\"V-204632\",\"medium\",\"SRG-OS-000375-GPOS-00160\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",528,\"SV-204632r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement multifactor authentication for access to privileged accounts via pluggable authentication modules (PAM).\",\"RHEL-07-041002\",\"Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\\n\\nA privileged account is defined as an information system account with authorizations of a privileged user.\\n\\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management).\\n\\nSatisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:o86wCHVnLXklbvao4gX06PkNKLM2n2dr61EHb3iOGuE=\"},\"C-4757r89091_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C+smaI80UgLR6sPJuLau7SkZhyN+Yirf5Yht9/ba90A=\"},\"F-4757r89092_fix\",\"V-204633\",\"medium\",\"SRG-OS-000375-GPOS-00160\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",529,\"SV-204633r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement certificate status checking for PKI authentication.\",\"RHEL-07-041003\",\"Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\\n\\nA privileged account is defined as an information system account with authorizations of a privileged user.\\n\\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management).\\n\\nSatisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2hPpDflNaMEbweY8kZ9GeMsYvJyW3OYECrRyUBb7WFU=\"},\"C-4758r89094_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TQIFjLZmV+wLHWdHvzMcJFt32vRR6Kijwnw5xWu5MqY=\"},\"F-4758r89095_fix\",\"V-204634\",\"medium\",\"SRG-OS-000424-GPOS-00188\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",530,\"SV-204634r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all wireless network adapters are disabled.\",\"RHEL-07-041010\",\"The use of wireless networking can introduce many different attack vectors into the organization's network. Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to create a denial of service to valid network resources.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:iSqVW4RiHyBVvrAYsGNx9SrOT+nAF6gnNHhGSMv/OPg=\"},\"C-15999r192362_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oOI5Mi24TV+g/qDOT1oyHshUdmQD3N1tU88YFY33XM8=\"},\"F-15997r192363_fix\",\"V-214799\",null,\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",531,\"SV-214799r241939_rule\",null,null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the cryptographic hash of system files and commands matches vendor values.\",\"RHEL-07-010020\",\"Without cryptographic integrity protections, system command and files can be altered by unauthorized users without detection.\\n\\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pp7LtbhvevdAe+ue4EVnM1uccxy7pW3XZ+xC9xFfmNk=\"},\"C-16000r192365_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:EcCFM8f6faJ+Y2AqXcOa7IfRS6V57umK55VW3UkAc1A=\"},\"F-15998r192366_fix\",\"V-214800\",null,\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",532,\"SV-214800r241939_rule\",null,null,null,\"The Red Hat Enterprise Linux operating system must have a host-based intrusion detection tool installed.\",\"RHEL-07-020019\",\"Adding host-based intrusion detection tools can provide the capability to automatically take actions in response to malicious behavior, which can provide additional agility in reacting to network threats. These tools also often include a reporting capability to provide network awareness of the system, which may not otherwise exist in an organization's systems management regime.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9LhzdHuv/khleaS+BQu9ZlUcdjdohBUoq5bjuJZdhK8=\"},\"C-16001r192368_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OcfCs3Q0wVovyUOOu9z0LWAjnT/FA3EL8ebXHSrlehs=\"},\"F-15999r192369_fix\",\"V-214801\",null,\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",533,\"SV-214801r241939_rule\",null,null,null,\"The Red Hat Enterprise Linux operating system must use a virus scan program.\",\"RHEL-07-032000\",\"Virus scanning software can be used to protect a system from penetration from computer viruses and to limit their spread through intermediate systems.  \\n\\nThe virus scanning software should be configured to perform scans dynamically on accessed files. If this capability is not available, the system must be configured to scan, at a minimum, all altered files on the system on a daily basis.\\n\\nIf the system processes inbound SMTP mail, the virus scanner must be configured to scan all received mail.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:M7pACkppJDi/CsMl2CmLoXQL4s2zAFRVxqwbrcNQ3+k=\"},\"C-16137r193200_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2Gkgp8uVI1bLYW6K55h7LR8klUBCa5UWZ6TUZAdA86Y=\"},\"F-16135r193201_fix\",\"V-214937\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",534,\"SV-214937r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.\",\"RHEL-07-010062\",\"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.\\n\\nThe session lock is implemented at the point where session activity can be determined.\\n\\nThe ability to enable/disable a session lock is given to the user by default. Disabling the user’s ability to disengage the graphical user interface session lock provides the assurance that all sessions will lock after the specified period of time.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",537,\"SV-106179r1_rule\",\"medium\",null,null,\"The VPN Gateway must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:slm2UFIqnUUPyOpfIcsxSew4LGvsTesU9C6Ju5XJ3mw=\"},\"C-95879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fgzhbaQbILFSeEwIwlOogRZtoeuNS7Kr0AHwx84IKLg=\"},\"F-102723r1_fix\",\"V-97043\",\"medium\",\"SRG-NET-000041-VPN-000110\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",538,\"SV-106181r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.\",\"SRG-NET-000041-VPN-000110\",\"Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n \\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jc6QW12gqdTKEPqvls4bilVyDJExcCoSskTVyO0VtC8=\"},\"C-95881r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QOTNmZJgq99GtXVEhYObEaDdxa5uT73FDkpBccGCe5Q=\"},\"F-102725r1_fix\",\"V-97045\",\"medium\",\"SRG-NET-000042-VPN-000120\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",539,\"SV-106183r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must enforce a policy to retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.\",\"SRG-NET-000042-VPN-000120\",\"The banner must be acknowledged by the user prior to allowing the user access to the network. This provides assurance that the user has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the user, DoD will not be in compliance with system use notifications required by law. \\n\\nThe banner is usually configured in NDM for client presentation as well as local logon.\\n\\nTo establish acceptance of the application usage policy, a click-through banner at application logon is required. The VPN gateway must prevent further activity until the user executes a positive action to manifest agreement by clicking on a box indicating \\\"OK\\\". \\n\\nThis applies to gateways that have the concept of a user account and have the login function residing on the gateway or the gateway acts as a user intermediary.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4cT/S3JRnRG1/bjkxCCl0FvJ2jFBPQxR6xd/ho3iPwU=\"},\"C-95883r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zvj+8RueEc8AGER4mc5vsA+JPLux2r9T3RERyvr6GqU=\"},\"F-102727r1_fix\",\"V-97047\",\"medium\",\"SRG-NET-000043-VPN-000130\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",540,\"SV-106185r1_rule\",\"medium\",null,null,\"The publicly accessible VPN Gateway must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\",\"SRG-NET-000043-VPN-000130\",\"Display of a standardized and approved use notification before granting access to the publicly accessible VPN gateway ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with DTM-08-060. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IdemsTDQGwPd7bokQxIIvpGCFpuH2a0LMkx43UGqWUA=\"},\"C-95885r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zwSBwQLPqjyi/Vwm1CxWQnlXRWyZZB59z9HGXUELgyQ=\"},\"F-102729r1_fix\",\"V-97049\",\"low\",\"SRG-NET-000049-VPN-000150\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",541,\"SV-106187r1_rule\",\"low\",null,null,\"The VPN Gateway must notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access).\",\"SRG-NET-000049-VPN-000150\",\"Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the number of unsuccessful attempts that were made to login to their account allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators.\\n\\nThis applies to gateways that have the concept of a user account and have the login function residing on the gateway or the gateway acts as a user intermediary.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aVWTWelue2vPX4PPQhsVdenoG0JoZrePs1txZu8Tn9w=\"},\"C-95887r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Bxnvb6aexynxn1Y2nmdyofyqfjFnX0xOt15KQeL53to=\"},\"F-102731r1_fix\",\"V-97051\",\"medium\",\"SRG-NET-000053-VPN-000170\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",542,\"SV-106189r1_rule\",\"medium\",null,null,\"The VPN Gateway must limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number.\",\"SRG-NET-000053-VPN-000170\",\"VPN gateway management includes the ability to control the number of users and user sessions that utilize a VPN gateway. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to DoS attacks.\\n\\nThis requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.\\n\\nThe intent of this policy is to ensure the number of concurrent sessions is deliberately set to a number based on the site's mission and not left unlimited.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CyTJHLIKQ2Ojkg9rwcZ3x7T66VHLzHB54n+nmQfac2E=\"},\"C-95889r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:H+ZsJRqo1BYEq9Wumb38YWMb+3wdolcYgDCbwGXeDJo=\"},\"F-102733r1_fix\",\"V-97053\",\"high\",\"SRG-NET-000062-VPN-000200\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",543,\"SV-106191r1_rule\",\"high\",null,null,\"The TLS VPN Gateway must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during transmission.\",\"SRG-NET-000062-VPN-000200\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nNIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b0U2i/2oFdeOwmGlTBap86LUQ1gHdfQ3eL4us+64fpw=\"},\"C-95891r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:J8KVE+KgBfuYvKemq7ovYBGF4IuGwoDzawSXyCaOyAQ=\"},\"F-102735r1_fix\",\"V-97055\",\"medium\",\"SRG-NET-000063-VPN-000210\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",544,\"SV-106193r1_rule\",\"medium\",null,null,\"The remote access VPN Gateway must use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.\",\"SRG-NET-000063-VPN-000210\",\"Without integrity protection, unauthorized changes may be made to the log files and reliable forensic analysis and discovery of the source of malicious system activity may be degraded.\\n\\nRemote access (e.g., RDP) is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless.\\n\\nIntegrity checks include cryptographic checksums, digital signatures, or hash functions. Federal Information Processing Standard (FIPS) 186-4, Digital Signature Standard (DSS), specifies three NIST-approved algorithms: DSA, RSA, and ECDSA. All three are used to generate and verify digital signatures in conjunction with an approved hash function.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v3WpQRoQigeTzLi65BYsrw9t+ZEEROlTq1kxXFTTLlc=\"},\"C-95893r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0D+opAzf5nzDclgwdIOkAD6j3JJiMTsVJtgVtp12Gss=\"},\"F-102737r1_fix\",\"V-97057\",\"medium\",\"SRG-NET-000063-VPN-000220\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",545,\"SV-106195r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.\",\"SRG-NET-000063-VPN-000220\",\"Without strong cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThe remote access VPN provides access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+B3+7JmTL1p1pvXgkAa8wGoCkVHYXHjICDWeklY1MTk=\"},\"C-95895r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:M9780XhNnUX+zVJLNXdHbTc95ro/kqEEj3UK2rL6hHI=\"},\"F-102739r1_fix\",\"V-97059\",\"high\",\"SRG-NET-000074-VPN-000250\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",546,\"SV-106197r1_rule\",\"high\",null,null,\"The IPsec VPN must implement a FIPS 140-2 validated Diffie-Hellman (DH) group.\",\"SRG-NET-000074-VPN-000250\",\"Use of an approved DH algorithm ensures the Internet Key Exchange (IKE) (phase 1) proposal uses FIPS-validated key management techniques and processes in the production, storage, and control of private/secret cryptographic keys. The security of the DH key exchange is based on the difficulty of solving the discrete logarithm in which the key was derived from. Hence, the larger the modulus, the more secure the generated key is considered to be.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YlctilOwQ2MBW7zoqYuhAoiJN5c5NYVKUMH7L8KW2VE=\"},\"C-95899r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:13l80RWe85t3TbQcxGDY1TeqhIv8oq9LWDSwKSmwv2c=\"},\"F-102743r1_fix\",\"V-97061\",\"low\",\"SRG-NET-000077-VPN-000280\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",547,\"SV-106199r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish what type of events occurred.\",\"SRG-NET-000077-VPN-000280\",\"Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nVPN gateways often have a separate audit log for capturing VPN status and other information about the traffic (as opposed to the log capturing administrative and configuration actions). Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.\\n\\nAssociating event types with detected events in the VPN gateway logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HGobFrLp43KBzaBeaBiQba6hjKEcpQn11VJTJJwwmMo=\"},\"C-95901r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1960KI2uASwT2grDyD1D8glCHawNm1LCT+mppgDNAG4=\"},\"F-102745r1_fix\",\"V-97063\",\"low\",\"SRG-NET-000078-VPN-000290\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",548,\"SV-106201r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish when (date and time) the events occurred.\",\"SRG-NET-000078-VPN-000290\",\"Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nVPN gateways often have a separate audit log for capturing VPN status and other information about the traffic (as opposed to the log capturing administrative and configuration actions).\\n\\nAssociating event types with detected events in the network audit logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:P/zyghBUSYmw8eYcF6kqAgE8TeMANzSroGoCNq9DxmU=\"},\"C-95903r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jl3z7pSS/5EUBqiypkdJCKqCZ9U+KdO46Z7KbtxpUpI=\"},\"F-102747r1_fix\",\"V-97065\",\"medium\",\"SRG-NET-000079-VPN-000300\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",549,\"SV-106203r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records containing information that establishes the identity of any individual or process associated with the event.\",\"SRG-NET-000079-VPN-000300\",\"Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/9F2orQ7S4UyHUeIF5MNwyf2YqTtEcZKOu6Lyy3dl0w=\"},\"C-95905r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8Jh0XPz5tsLOV5OOHxTog1U4Ld3GURTDC/neBufCCRc=\"},\"F-102749r1_fix\",\"V-97067\",\"medium\",\"SRG-NET-000088-VPN-000310\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",550,\"SV-106205r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records containing information to establish where the events occurred.\",\"SRG-NET-000088-VPN-000310\",\"Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nIn order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know where events occurred, such as VPN gateway components, modules, device identifiers, node names, and functionality.\\n\\nAssociating information about where the event occurred within the network provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TBiXTAY2X10uilSJ/Zo764Ce7gxa+BC604igCvR21Ys=\"},\"C-95907r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fdhbsyNKzbH4WTd1xvpZy3y/UYX8uj3SGwmY5U6RSTM=\"},\"F-102751r1_fix\",\"V-97069\",\"low\",\"SRG-NET-000089-VPN-000330\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",551,\"SV-106207r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish the source of the events.\",\"SRG-NET-000089-VPN-000330\",\"Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event.\\n\\nIn addition to logging where events occur within the network, the log records must also identify sources of events such as IP addresses, processes, and node or device names.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2+gLZEUpQFGiiXTLj5vTvPMeNuYVSesoUBq5osjiwyA=\"},\"C-95909r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+Hhc/f/5x1WDFzGN2o6Zu1Zd4z5P5GcPUtxEuGkAWCk=\"},\"F-102753r1_fix\",\"V-97071\",\"medium\",\"SRG-NET-000091-VPN-000350\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",552,\"SV-106209r1_rule\",\"medium\",null,null,\"The VPN Gateway must produce log records containing information to establish the outcome of the events.\",\"SRG-NET-000091-VPN-000350\",\"Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the network.\\n\\nEvent outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the network after the event occurred). As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mi17ibh62O4cda5bcRUSENaNZI+A+wHMQdsAhZaeELQ=\"},\"C-95911r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:uA4H2p1A7Ll9hacECizf787pb/UA7IqAnIHhct/QrEM=\"},\"F-102755r1_fix\",\"V-97073\",\"low\",\"SRG-NET-000098-VPN-000370\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",553,\"SV-106211r1_rule\",\"low\",null,null,\"The VPN Gateway must protect log information from unauthorized read access if all or some of this data is stored locally.\",\"SRG-NET-000098-VPN-000370\",\"Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured VPN gateway. Thus, it is imperative that the collected log data from the various VPN gateways, as well as the auditing tools, be secured and can only be accessed by authorized personnel.\\n\\nThis requirement pertains to securing the VPN log as it is stored locally, on the box temporarily, or while being encapsulated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xx7dyKjP3tr449DemD15SwuRdkEieFRE1AhuT429Hbk=\"},\"C-95913r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0Ev7nKBuQufWeKLn3k7Wr/z0hb8pni2MRJGUGCqohj8=\"},\"F-102757r1_fix\",\"V-97075\",\"medium\",\"SRG-NET-000099-VPN-000380\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",554,\"SV-106213r1_rule\",\"medium\",null,null,\"The VPN Gateway log must protect audit information from unauthorized modification when stored locally.\",\"SRG-NET-000099-VPN-000380\",\"If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\\n\\nThis requirement pertains to securing the VPN log as it is stored locally, on the box temporarily, or while being encapsulated.\\n\\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\\n\\nAudit information includes all information (e.g., log records, audit settings, and audit reports) needed to successfully audit information system activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LurVSxZqQlUG4THAxXLsYwtoOIQkH9C5vFm75lhPk+M=\"},\"C-95915r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PRb2voDcKub8xxvNSpdygBWfbLpwWfUE85OlSdeFxMU=\"},\"F-102759r1_fix\",\"V-97077\",\"medium\",\"SRG-NET-000100-VPN-000390\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",555,\"SV-106215r1_rule\",\"medium\",null,null,\"The VPN Gateway must protect audit information from unauthorized deletion when stored locally.\",\"SRG-NET-000100-VPN-000390\",\"If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\\n\\nTo ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification.\\n\\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\\n\\nAudit information includes all information (e.g., log records, audit settings, and audit reports) needed to successfully audit information system activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:R+x0KRiQIKJIbqWDk9OWXOHA/tx5c83O7HSpjbaqItQ=\"},\"C-95917r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4gmYRDVBlFkpvQ5jFnJALH34Q1qS7urLI7Yjatvv5Ks=\"},\"F-102761r1_fix\",\"V-97079\",\"medium\",\"SRG-NET-000132-VPN-000450\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",556,\"SV-106217r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.\",\"SRG-NET-000132-VPN-000450\",\"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\\n\\nDoD continually assesses the ports, protocols, and services that can be used for network communications. Some protocols or services have known exploits or security weaknesses. Network traffic using these ports, protocols, and services must be prohibited or restricted in accordance with DoD policy. The PPSM CAL and vulnerability assessments provide an authoritative source for ports, protocols, and services that are unauthorized or restricted across boundaries on DoD networks.\\n\\nThe VPN Gateway must be configured to prevent or restrict the use of prohibited ports, protocols, and services throughout the network by filtering the network traffic and disallowing or redirecting traffic as necessary. Default and updated policy filters from the vendors will disallow older version of protocols and applications and will address most known non-secure ports, protocols, and/or services.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6xznw8iyFeJRJwk1JYCPRsiNwv5VE1E6oPOibHnQepY=\"},\"C-95919r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BV4FIuZmpkNnwep3K+axA7S7eorRTT2tR14EUOT7U0Y=\"},\"F-102763r1_fix\",\"V-97081\",\"medium\",\"SRG-NET-000132-VPN-000460\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",557,\"SV-106219r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use IKEv2 for IPsec VPN security associations.\",\"SRG-NET-000132-VPN-000460\",\"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\\n\\nUse of IKEv2 leverages DoS protections because of improved bandwidth management and leverages more secure encryption algorithms.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U9u5kkzq19uYYwdfbvK93u00swz2+lLKN/KXYD1SLPM=\"},\"C-95921r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CZLDS9pX8n0hhkw38hCbPDJhpjz0SK1r40ll/eFYuDI=\"},\"F-102765r1_fix\",\"V-97083\",\"medium\",\"SRG-NET-000132-VPN-000470\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",558,\"SV-106221r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and L2F.\",\"SRG-NET-000132-VPN-000470\",\"The PPTP and L2F are obsolete method for implementing virtual private networks. Both protocols may be easy to use and readily available, but they have many well-known security issues and exploits. Encryption and authentication are both weak.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qL67vWiduAPXEoBZfFyKtQr8Xx5q0lifYoN8/VKeiXk=\"},\"C-95923r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fRSUaDiTIxiKHwtXC7xhS028BxmoqEKmcdKtfdEYU8A=\"},\"F-102767r1_fix\",\"V-97085\",\"medium\",\"SRG-NET-000132-VPN-000480\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",559,\"SV-106223r1_rule\",\"medium\",null,null,\"For site-to-site VPN implementations, the  L2TP protocol must be blocked or denied at the security boundary with the private network so unencrypted L2TP packets cannot traverse into the private network of the enclave.\",\"SRG-NET-000132-VPN-000480\",\"Unlike GRE (a simple encapsulating header) L2TP is a full-fledged communications protocol with control channel, data channels, and a robust command structure. In addition to PPP, other link layer types (called pseudowires) can be and are defined for delivery in L2TP by separate RFC documents. Further complexity is created by the capability to define vender-specific parameters beyond those defined in the L2TP specifications.\\n\\nThe endpoint devices of an L2TP connection can be an L2TP Access Concentrator (LAC) in which case it inputs/outputs the layer 2 protocol to/from the L2TP tunnel. Otherwise, it is an L2TP Network Server (LNS), in which case it inputs/outputs the layer 3 (IP) protocol to/from the L2TP tunnel. The specifications describe three reference models: LAC-LNS, LAC-LAC, and LNS-LNS, the first of which is the most common case. The LAC-LNS model allows a remote access user to reach his home network or ISP from a remote location. The remote access user connects to  a LAC device which tunnels his connection home to an awaiting LNS. The LAC could also be located on the remote user's laptop, which connects to an LNS at home using some generic internet connection. The other reference models may be used for more obscure scenarios.\\n\\nAlthough the L2TP protocol does not contain encryption capability, it can be operated over IPsec, which would provide authentication and confidentiality. A remote user in the LAC-LNS model would most likely obtain a dynamically assigned IP address from the home network to ultimately use through the tunnel back to the home network. Secondly, the outer IP source address used to send the L2TP tunnel packet to the home network is likely to be unknown or highly variable. Thirdly, since the LNS provides the remote user with a dynamic IP address to use, the firewall at the home network would have to be dynamically updated to accept this address in conjunction with the outer tunnel address. Finally, there is also the issue of authentication of the remote user prior to divulging an acceptable IP address. Because of all of these complications, the strict filtering rules applied to the IP-in-IP and GRE tunneling cases will likely not be possible in the L2TP scenario.\\n\\nIn addition to the difficulty of enforcing addresses and endpoints (as explained above), the L2TP protocol itself is a security concern if allowed through a security boundary. In particular:\\n\\n1) L2TP potentially allows link layer protocols to be delivered from afar. These protocols were intended for link-local scope only, are less defended, and not as well-known,\\n2) The L2TP tunnels can carry IP packets that are very difficult to see and filter because of the additional layer 2 overhead,\\n3) L2TP is highly complex and variable (vender-specific variability) and therefore would be a viable target that is difficult to defend. It is better left outside of the main firewall where less damage occurs if the L2TP-processing node is compromised,\\n4) Filtering cannot be used to detect and prevent other unintended layer 2 protocols from being tunneled. The strength of the application layer code would have to be relied on to achieve this task,\\n5) Regardless of whether the L2TP is handled inside or outside of the main network, a secondary layer of IP filtering is required; therefore bringing it inside does not save resources.\\n\\nTherefore, it is not recommended to allow unencrypted L2TP packets across the security boundary into the network's protected areas. Reference the Backbone Transport STIG for additional L2TP guidance and use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mmyK/9p+kkBzjw391gSBn/5JwQ6rUWRXc0i0deZcJlY=\"},\"C-95925r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PTCfoKcCD5hDW7K47sK1D7FeehVzMR67iHZOHpTiBJE=\"},\"F-102769r1_fix\",\"V-97087\",\"medium\",\"SRG-NET-000138-VPN-000490\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",560,\"SV-106225r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).\",\"SRG-NET-000138-VPN-000490\",\"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\\n\\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses except the following.\\n\\n(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\\n\\n(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals' in-group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN or proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D7dgt3RnYA25LvMASqDp9YTrG7KfSDck59y/cwVd1j4=\"},\"C-95927r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Rh+GrFD8y7n/BlVOr9JDOC5ROFB+DmI+8x461DH5A1Q=\"},\"F-102771r1_fix\",\"V-97089\",\"high\",\"SRG-NET-000140-VPN-000500\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",561,\"SV-106227r1_rule\",\"high\",null,null,\"The VPN Gateway must use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.\",\"SRG-NET-000140-VPN-000500\",\"To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.\\n\\nMultifactor authentication uses two or more factors to achieve authentication. Use of password for user remote access for non-privileged account is not authorized.\\n\\nFactors include:\\n(i) Something you know (e.g., password/PIN);\\n(ii) Something you have (e.g., cryptographic identification device, token); or\\n(iii) Something you are (e.g., biometric).\\n\\nA non-privileged account is any information system account with authorizations of a non-privileged user.\\n\\nNetwork access is any access to a network element by a user (or a process acting on behalf of a user) communicating through a network.\\n\\nThe DoD CAC with DoD-approved PKI is an example of multifactor authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KKZUM28vxti/o8G6lxUgCF8Wx8ura3+B1TExgJuWCGA=\"},\"C-95929r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:n8I5AADucbxW3nhWpeZCsAbA1ZwIJ9+ypR/dgDeDkbA=\"},\"F-102773r1_fix\",\"V-97091\",\"medium\",\"SRG-NET-000145-VPN-000510\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",562,\"SV-106229r1_rule\",\"medium\",null,null,\"The VPN Client must implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.\",\"SRG-NET-000145-VPN-000510\",\"Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD common access card.\\n\\nA non-privileged account is any information system account with authorizations of a non-privileged user.\\n\\nNetwork access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:koWH1S5xZuAZ4H9vnFXHr/qz4c6UDJH7P29FdfhEPZg=\"},\"C-95931r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/05962IPiIdyt4V5PSfPjQ8gsSvFmLoQb7Ih1O9CdmI=\"},\"F-102775r1_fix\",\"V-97093\",\"medium\",\"SRG-NET-000147-VPN-000520\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",563,\"SV-106231r1_rule\",\"medium\",null,null,\"The TLS VPN must be configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts.\",\"SRG-NET-000147-VPN-000520\",\"A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack.\\n\\nAn authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message.\\n\\nA non-privileged account is any operating system account with authorizations of a non-privileged user.\\n\\nTechniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:53vjl7nhxJZkAmPcXBfrWgxe2N8vSeOA4P5KeOUv1cA=\"},\"C-95933r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tvtLSoQBIUhFi1DUAx/IQFts2ZxCAJGEu1MMnqECcNE=\"},\"F-102777r1_fix\",\"V-97095\",\"medium\",\"SRG-NET-000147-VPN-000530\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",564,\"SV-106233r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use anti-replay mechanisms for security associations.\",\"SRG-NET-000147-VPN-000530\",\"Anti-replay is an IPsec security mechanism at a packet level, which helps to avoid unwanted users from intercepting and modifying an ESP packet.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PQvyQqpQfxH4QYcuFED9dQWGmLZ5NjYVdg+5ViJyzMc=\"},\"C-95935r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PKYcfwohvuVW06x1QmIrzJEC7yX68OlFaic/tTj3y3A=\"},\"F-102779r1_fix\",\"V-97097\",\"medium\",\"SRG-NET-000148-VPN-000540\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",565,\"SV-106235r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify all network-connected endpoint devices before establishing a connection.\",\"SRG-NET-000148-VPN-000540\",\"Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\\n\\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification decisions (as opposed to the actual identifiers) to the services that need to act on those decisions.\\n\\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers (outside a datacenter), VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v5/IfNoYuNBZdJW3TnihRjv14rrPD9SLxquxNn9HMf0=\"},\"C-95937r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4mEma8P0Dv4vj5cqKTp53/Xgkv8CV31yYo/9WqBJF7I=\"},\"F-102781r1_fix\",\"V-97099\",\"medium\",\"SRG-NET-000164-VPN-000560\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",566,\"SV-106237r1_rule\",\"medium\",null,null,\"The VPN Gateway, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.\",\"SRG-NET-000164-VPN-000560\",\"Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. To meet this requirement, the information system must create trusted channels between itself and remote trusted authorized IT product (e.g., syslog server) entities that protect the confidentiality and integrity of communications. The information system must create trusted paths between itself and remote administrators and users that protect the confidentiality and integrity of communications.\\n\\nA trust anchor is an authoritative entity represented via a public key and associated data. It is most often used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. However, applications that do not use a trusted path are not approved for non-local and remote management of DoD information systems.\\n\\nUse of SSHv2 to establish a trusted channel is approved. Use of FTP, TELNET, HTTP, and SNMPV1 is not approved since they violate the trusted channel rule set. Use of web management tools that are not validated by common criteria may also violate the trusted channel rule set.\\n\\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA.\\n\\nThis requirement verifies that a certification path to an accepted trust anchor is used for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Validation of the certificate status information is out of scope for this requirement.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4L7fYYyaq26bvadPv3JCcQ3yEjurb6JgRmYQ/U0UV1c=\"},\"C-95939r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kHIpuc9rQ7c3thtVDQNITMH7ftHuWzgXExpBIujEdHQ=\"},\"F-102783r1_fix\",\"V-97101\",\"medium\",\"SRG-NET-000165-VPN-000570\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",567,\"SV-106239r1_rule\",\"medium\",null,null,\"The site-to-site VPN, when using PKI-based authentication for devices, must enforce authorized access to the corresponding private key.\",\"SRG-NET-000165-VPN-000570\",\"If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure.\\n\\nThe cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to authenticate to network devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ar3GvJuXEKD4A/Af2IozOGlLJBjfNqRbiW1i8k/7Y9g=\"},\"C-95941r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5j0XBOP7B/DfiJ4RQcUK0zsSkNS1ZJgD+jERXi5h0IM=\"},\"F-102785r1_fix\",\"V-97103\",\"medium\",\"SRG-NET-000166-VPN-000580\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",568,\"SV-106241r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway must use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.\",\"SRG-NET-000166-VPN-000580\",\"The VPN interacts directly with public networks and devices and should not contain user authentication information for all users. AAA network security services provide the primary framework through which a network administrator can set up access control and authorization on network points of entry or network access servers. It is not advisable to configure access control on the VPN gateway or remote access server. Separation of services provides added assurance to the network if the access control server is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:f0b/RYI3SCPeEqjHsb3psBWUdGRTKfgqRrq51hB7yfE=\"},\"C-95953r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Oi4jUVTD6ycPdzvYBP8T+rY1x1IUvcpUVTHSlQ5ZZHM=\"},\"F-102797r1_fix\",\"V-97113\",\"medium\",\"SRG-NET-000166-VPN-000590\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",569,\"SV-106251r1_rule\",\"medium\",null,null,\"The VPN Gateway must map the authenticated identity to the user account for PKI-based authentication.\",\"SRG-NET-000166-VPN-000590\",\"Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of a user (e.g., VPN or ALG. This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MRKxPi/bbsDz8wNN9vXmb7hhgMU8M3+JU6oyqsrMnZk=\"},\"C-95955r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pSURQgwBF8TrM2BF5TWiE9Mm2xRU9ilNiN8qenfhfhs=\"},\"F-102799r1_fix\",\"V-97115\",\"medium\",\"SRG-NET-000168-VPN-000600\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",570,\"SV-106253r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).\",\"SRG-NET-000168-VPN-000600\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nNonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through either an external network (e.g., the Internet) or an internal network.\\n\\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\\n\\nApplications also include HMAC, KDFs, Random Bit Generation, and hash-only applications (e.g., hashing passwords and using SHA-1 or higher to compute a checksum). For digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use where needed.\\n\\nSeparate requirements for configuring applications and protocols used by each product (e.g., SNMPv3, SSH, NTP, and other protocols and applications that require server/client authentication) are required to implement this requirement.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:L26csqRjhPU0fgblV8qX1BlmvtAHZjw4Yyp+bb0mDKw=\"},\"C-95957r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:srWnJLZc/eBKJFIWlsEIupfvJph4j2NGvFXosOihlzk=\"},\"F-102801r1_fix\",\"V-97117\",\"medium\",\"SRG-NET-000169-VPN-000610\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",571,\"SV-106255r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).\",\"SRG-NET-000169-VPN-000610\",\"Lack of authentication and identification enables non-organizational users to gain access to the network or possibly a VPN gateway that provides opportunity for intruders to compromise resources within the network infrastructure.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of a non-organizational user.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OyTG982E0CMxr4y2rmBaYCCpTY7srBWAv/cZQUt/Y+w=\"},\"C-95959r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1p/ev5FaVReOsAiB4Yypz9PuTHTIq8DZEOVu8/pAPZo=\"},\"F-102803r1_fix\",\"V-97119\",\"medium\",\"SRG-NET-000205-VPN-000710\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",572,\"SV-106257r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to route sessions to an IDPS for inspection.\",\"SRG-NET-000205-VPN-000710\",\"Remote access devices, such as those providing remote access to network devices and information systems, which lack automated, capabilities increase risk and makes remote user access management difficult at best.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nAutomated monitoring of remote access sessions allows organizations to detect cyber attacks and ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, from a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lOVVOo0oYWR1BZZb2TwnHXMbM18YttAN6G4GrHPWbyw=\"},\"C-95961r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lQAodzF2vAPdkyT4THpjERChTagkjNx3KaYEZBi/5HM=\"},\"F-102805r1_fix\",\"V-97121\",\"low\",\"SRG-NET-000213-VPN-000720\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",573,\"SV-106259r1_rule\",\"low\",null,null,\"The VPN Gateway must terminate all network connections associated with a communications session at the end of the session.\",\"SRG-NET-000213-VPN-000720\",\"Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These “orphaned” sessions use up valuable router resources and can be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keep alive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the TCP keep alive message, the sending router will clear the connection and free resources allocated to the session.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZitF7N9m7tBrFLBSFvvFyer2Cj1EN7TGddhFoon9a2g=\"},\"C-95963r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:EuB8U2wr3QUgtcHmLsicOw6VzQ5t4flKS602zwr3K7I=\"},\"F-102807r1_fix\",\"V-97123\",\"medium\",\"SRG-NET-000230-VPN-000770\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",574,\"SV-106261r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.\",\"SRG-NET-000230-VPN-000770\",\"Unapproved mechanisms that are used for authentication to the cryptographic module are not verified, and therefore cannot be relied upon to provide confidentiality or integrity and DoD data may be compromised.\\n\\nVPN gateways utilizing encryption are required to use FIPS compliant mechanisms for authenticating to cryptographic modules.\\n\\nFIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uJQ31o/f/Vqkllw6K1glewYI9Xlo0bRZIER2AGlLICw=\"},\"C-95965r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5d33UFWeSYVRhZGzYH0+0+VJ6rVugjCYj6LlTRa+nqY=\"},\"F-102809r1_fix\",\"V-97125\",\"high\",\"SRG-NET-000230-VPN-000780\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",575,\"SV-106263r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use Internet Key Exchange (IKE) with SHA-1 or greater to protect the authenticity of communications sessions.\",\"SRG-NET-000230-VPN-000780\",\"Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/SOA will require the use of mutual authentication (two-way/bidirectional).\\n\\nAn IPsec Security Associations (SA) is established using either IKE or manual configuration.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KPLBOeYMBZIxBbaWyihbjnI+iXUnrab0mkIE2hzbTk8=\"},\"C-95967r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QTXhy5bkfpQRsWuE/X3R1behSbs9HPpQP63IlKE7Z9A=\"},\"F-102811r1_fix\",\"V-97127\",\"medium\",\"SRG-NET-000231-VPN-000790\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",576,\"SV-106265r1_rule\",\"medium\",null,null,\"The VPN Gateway must invalidate session identifiers upon user logoff or other session termination.\",\"SRG-NET-000231-VPN-000790\",\"Captured sessions can be reused in \\\"replay\\\" attacks. This requirement limits the ability of adversaries from capturing and continuing to employ previously valid session IDs.\\n\\nSession IDs are tokens generated by web applications to uniquely identify an application user's session. Unique session identifiers or IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. When a user logs out, or when any other session termination event occurs, the VPN gateway must terminate the user session to minimize the potential for an attacker to hijack that particular user session.\\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet.\\n\\nThis requirement applies only to any VPN gateway that is an intermediary of individual sessions (e.g., proxy, ALG, or SSL VPN). This requirement focuses on communications protection at the application session, versus network packet level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p+iB5XlL+If6inJuLfQ+r3VNT86JXC5NhnV2vOeozxg=\"},\"C-95969r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tbmOT/VG86p0EWsjZLm3s8Y4/9kcKFGaAevpuHrUlfg=\"},\"F-102813r1_fix\",\"V-97129\",\"medium\",\"SRG-NET-000233-VPN-000800\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",577,\"SV-106267r1_rule\",\"medium\",null,null,\"The VPN Gateway must recognize only system-generated session identifiers.\",\"SRG-NET-000233-VPN-000800\",\"VPN gateways (depending on function) utilize sessions and session identifiers to control application behavior and user access. If an attacker can guess the session identifier, or can inject or manually insert session information, the valid user's application session can be compromised.\\n\\nUnique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions.\\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet.\\n\\nThis requirement applies to any VPN gateway that is an intermediary of individual sessions (e.g., proxy, ALG, TLS VPN). VPN gateways that perform these functions must be able to identify which session identifiers were generated when the sessions were established.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ktJIe/Y+HEIOo7bAwQCz3X/2hQkiqoTyl8BVpkZpHYk=\"},\"C-95971r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TniVNe2bo64DYrBZv1sEf0zR9SKcbwn0jWfXR3l8iz0=\"},\"F-102815r1_fix\",\"V-97131\",\"medium\",\"SRG-NET-000234-VPN-000810\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",578,\"SV-106269r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.\",\"SRG-NET-000234-VPN-000810\",\"Both IPsec and TLS gateways use the RNG to strengthen the security of the protocols. Using a weak RNG will weaken the protocol and make it more vulnerable.\\n\\nUse of a FIPS validated RNG that is not DRGB mitigates to a CAT III.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D9gD2h3b8ZDEWmQokEZllnWlmTLY7M//Hjdn7DqBOf8=\"},\"C-95973r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KB4RBRRC9piCCQ/V/rwpAJ5Z4Df6Bh3k50+VVARART8=\"},\"F-102817r1_fix\",\"V-97133\",\"medium\",\"SRG-NET-000235-VPN-000820\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",579,\"SV-106271r1_rule\",\"medium\",null,null,\"The VPN Gateway must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.\",\"SRG-NET-000235-VPN-000820\",\"Failure to a known safe state helps prevent systems from failing to a state that may cause loss of data or unauthorized access to system resources. VPN gateways that fail suddenly and with no incorporated failure state planning may leave the hosting system available but with a reduced security protection capability. Preserving information system state information also facilitates system restart and return to the operational mode of the organization with less disruption to mission-essential processes.\\n\\nAbort refers to stopping a program or function before it has finished naturally. The term abort refers to both requested and unexpected terminations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:72eP2Vo/dCHVQ+6f/2RQyYnBi119Hq+RWYm1m2WqoLc=\"},\"C-95975r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KOCFObJ10AgHLn2PIX9FSde4QkGSCpnBOYQLWTFTSDo=\"},\"F-102819r1_fix\",\"V-97135\",\"medium\",\"SRG-NET-000313-VPN-001050\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",580,\"SV-106273r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to perform an organization-defined action if the audit reveals unauthorized activity.\",\"SRG-NET-000313-VPN-001050\",\"Remote access devices, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and makes remote user access management difficult at best.\\n\\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\\n\\nRemote access functionality, such as remote access servers, VPN concentrators, and IDS/IPS devices, must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:w9yL+z+t1qYSt9kk+sxVflN/xG/naaJ9QP4VRCcqw6Q=\"},\"C-95977r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:COjdhT7YeatypyTtARxEDYM/VBCnUmEevQq0bspvHSk=\"},\"F-102821r1_fix\",\"V-97137\",\"medium\",\"SRG-NET-000314-VPN-001060\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",581,\"SV-106275r1_rule\",\"medium\",null,null,\"The VPN Gateway administrator accounts or security policy must be configured to allow the system administrator to immediately disconnect or disable remote access to devices and/or users when needed.\",\"SRG-NET-000314-VPN-001060\",\"Without the ability to immediately disconnect or disable remote access, an attack or other compromise taking progress would not be immediately stopped.\\n\\nRemote access functionality must have the capability to immediately disconnect current users remotely accessing the information system and/or disable further remote access. The speed of disconnect or disablement varies based on the criticality of mission functions and the need to eliminate immediate or future remote access to organizational information systems.\\n\\nThe remote access functionality (e.g., VPN, ALG, and RAS) may implement features, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:afNm41YNd2Z2QwHOtNNm/ZsgKpPtQhY3FaPrGqRWnTw=\"},\"C-95979r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HIQBC9ZU7AuTIdllzK3oRjj9cc4DrzRsdkjLzrUOnSE=\"},\"F-102823r1_fix\",\"V-97139\",\"high\",\"SRG-NET-000317-VPN-001090\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",582,\"SV-106277r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use AES encryption for the Internet Key Exchange (IKE) proposal to protect confidentiality of remote access sessions.\",\"SRG-NET-000317-VPN-001090\",\"Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nAES is the FIPS-validated cipher block cryptographic algorithm approved for use in DoD. For an algorithm implementation to be listed on a FIPS 140-2 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. Currently, NIST has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:n4616xCQqSEJ5LDbI/BvogDwAhTFLCqs6qsCNm2y6qM=\"},\"C-95981r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:o94iAavW4v2w03yRo2xl3upVmak75NTVDj/Dy2pNCbA=\"},\"F-102825r1_fix\",\"V-97141\",\"medium\",\"SRG-NET-000320-VPN-001120\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",583,\"SV-106279r1_rule\",\"medium\",null,null,\"The VPN Gateway must transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.\",\"SRG-NET-000320-VPN-001120\",\"Protecting authentication communications between the client, the VPN Gateway, and the authentication server keeps this critical information from being exploited.\\n\\nIn distributed information systems, authorization processes and access control decisions may occur in separate parts of the systems. In such instances, authorization information is transmitted securely so timely access control decisions can be enforced at the appropriate locations. To support the access control decisions, it may be necessary to transmit as part of the access authorization information, supporting security attributes. This is due to the fact that in distributed information systems, there are various access control decisions that need to be made and different entities (e.g., services) make these decisions in a serial fashion, each requiring some security attributes to make the decisions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qrumTMQiLLqavZ4GBAcbIfp6Kibky5yDpODJYsUNU6k=\"},\"C-95983r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:liEE0SFmmeFRP77fVgYsXwcMaxPrYjZRWHQv5JaTXXg=\"},\"F-102827r1_fix\",\"V-97143\",\"low\",\"SRG-NET-000330-VPN-001220\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",584,\"SV-106281r1_rule\",\"low\",null,null,\"The VPN Gateway must notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).\",\"SRG-NET-000330-VPN-001220\",\"Users need to be aware of activity that occurs regarding their account. Providing users with information deemed important by the organization may aid in the discovery of unauthorized access or thwart a potential attacker.\\n\\nOrganizations should consider the risks to the specific information system being accessed and the threats presented by the device to the environment when configuring this option. An excessive or unnecessary amount of information presented to the user at logon is not recommended.\\n\\nThis requirement applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bzo/kYUviBi8fH0VVF4kMJsdAnZOcFeOl3REDgnED8o=\"},\"C-95985r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:P8pkANj/XLaqdv6hJakyvgLuueJH8cGpKoldzmEq82g=\"},\"F-102829r1_fix\",\"V-97145\",\"medium\",\"SRG-NET-000333-VPN-001250\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",585,\"SV-106283r1_rule\",\"medium\",null,null,\"The VPN Gateway must provide centralized management and configuration of the content to be captured in log records generated by all network components.\",\"SRG-NET-000333-VPN-001250\",\"Without the ability to centrally manage the content captured in the log records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack.\\n\\nThe content captured in log records must be managed from a central location (necessitating automation). Centralized management of log records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Network components requiring centralized audit log management must have the capability to support centralized management.\\n\\nThe DoD requires centralized management of all network component audit record content.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cvSX2fNtb/9d5KoCFv38r/vk1P66QvbknutRPO++RHQ=\"},\"C-95987r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4LMA3u9siEI56MkwasqV8o7t4fUD89q8QT8ld4InCNY=\"},\"F-102831r1_fix\",\"V-97147\",\"medium\",\"SRG-NET-000334-VPN-001260\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",586,\"SV-106285r1_rule\",\"medium\",null,null,\"The VPN Gateway must off-load audit records onto a different system or media than the system being audited.\",\"SRG-NET-000334-VPN-001260\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rpLsrhPbwk1f+JYoA5pOhGpi71+wEYHZA7WhvDHOZ+M=\"},\"C-95989r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ZbcudZvV1BQEgFZtq1Hz/2teLVGVbnWW0bcryt+9lXk=\"},\"F-102833r1_fix\",\"V-97149\",\"medium\",\"SRG-NET-000335-VPN-001270\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",587,\"SV-106287r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.\",\"SRG-NET-000335-VPN-001270\",\"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected.\\n\\nAlerts provide organizations with urgent messages. Automated alerts can be conveyed in a variety of ways, including, for example, telephonically, via electronic mail, via text message, or via websites. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded.\\n\\nWhile this requirement also applies to the event monitoring system (e.g., Syslog, Security Information and Event Management [SIEM], or SNMP servers), the VPN Gateway must also be configured to generate a message to the administrator console.\\n\\nThe VPN daemon facility and log facility are messages in the log, which capture actions performed or errors encountered by system processes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lKiTDkfAGyG9SqJoJw3IBMHEt9m1XfYEXjJcJ6N2O4I=\"},\"C-95991r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:98ovgM7bqc4Ya1AKRRjI0MOMt8I2xMdngADds6VQJgc=\"},\"F-102835r1_fix\",\"V-97151\",\"medium\",\"SRG-NET-000336-VPN-001280\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",588,\"SV-106289r1_rule\",\"medium\",null,null,\"When communications with the Central Log Server is lost, the VPN Gateway must continue to queue traffic log records locally.\",\"SRG-NET-000336-VPN-001280\",\"If the system were to continue processing after audit failure, actions can be taken on the system that cannot be tracked and recorded for later forensic analysis.\\n\\nBecause of the importance of ensuring mission/business continuity, organizations may determine that the nature of the audit failure is not so severe that it warrants a complete shutdown of the application supporting the core organizational missions/business operations. In those instances, partial application shutdowns or operating in a degraded mode with reduced capability may be viable alternatives.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fVzjNA9x7fe7XKuKOy79M7wLwKGgdGCnV3TChwORocM=\"},\"C-95993r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:7kFOvG6IkBGOVLyO9MRlIA10BFwkb7/m/gpclcr3GP8=\"},\"F-102837r1_fix\",\"V-97153\",\"medium\",\"SRG-NET-000337-VPN-001290\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",589,\"SV-106291r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must renegotiate the security association after 8 hours or less, or an organization-defined period.\",\"SRG-NET-000337-VPN-001290\",\"The IPsec SA and its corresponding key will expire either after the number of seconds or amount of traffic volume has exceeded the configured limit. A new SA is negotiated before the lifetime threshold of the existing SA is reached to ensure that a new SA is ready for use when the old one expires. The longer the lifetime of the IPsec SA, the longer the lifetime of the session key used to protect IP traffic. The SA is less secure with a longer lifetime because an attacker has a greater opportunity to collect traffic encrypted by the same key and subject it to cryptanalysis. However, a shorter lifetime causes IPsec peers to renegotiate Phase II more often resulting in the expenditure of additional resources.\\n\\nSpecify the lifetime (in seconds) of an Internet Key Exchange (IKE) security association (SA). When the SA expires, it is replaced by a new SA, the security parameter index (SPI), or terminated if the peer cannot be contacted for renegotiation.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yIMWyLqQ5KjJhVIE0sO7kOy3MFZ/mr8G1UsF2vpFezs=\"},\"C-95995r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HEQrvy4/s8jokXmlLC3sxlKZoNheJdGUClzKnI45P1o=\"},\"F-102839r1_fix\",\"V-97155\",\"medium\",\"SRG-NET-000337-VPN-001300\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",590,\"SV-106293r1_rule\",\"medium\",null,null,\"The VPN Gateway must renegotiate the security association after 24 hours or less or as defined by the organization.\",\"SRG-NET-000337-VPN-001300\",\"When a VPN gateway creates an IPsec Security Association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway’s inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3Vk1c0ULGwB+JNxtAcJe82imefTrQUiXMXW0gSoV5sI=\"},\"C-95997r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:xBCJWam1YJOEk/Y3uRcCt4tDlmUHwgij/XAGpODs0PQ=\"},\"F-102841r1_fix\",\"V-97157\",\"medium\",\"SRG-NET-000341-VPN-001350\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",591,\"SV-106295r1_rule\",\"medium\",null,null,\"The VPN Gateway must accept Personal Identity Verification (PIV) credentials.\",\"SRG-NET-000341-VPN-001350\",\"The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\\n\\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U2xkrpdDd5fbE89oPVhqhnurz+BzWOL7MBkXI3iyc44=\"},\"C-95999r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:DWEbV0DVPuJ7OTfvbUkhrgxsgpWLM8sKjC8MjkQOMA4=\"},\"F-102843r1_fix\",\"V-97159\",\"medium\",\"SRG-NET-000342-VPN-001360\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",592,\"SV-106297r1_rule\",\"medium\",null,null,\"The VPN Gateway must electronically verify Personal Identity Verification (PIV) credentials.\",\"SRG-NET-000342-VPN-001360\",\"The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\\n\\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tY5W3SOCbPKTMPPTVFP0FpXqFdrxc15JZY9C5N1Jp3E=\"},\"C-96015r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C2DPURp+P/TJg1Bmt9fhJFi9259gGRXNzSqAORnuD3g=\"},\"F-102859r1_fix\",\"V-97177\",\"medium\",\"SRG-NET-000343-VPN-001370\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",593,\"SV-106315r1_rule\",\"medium\",null,null,\"The VPN Gateway must authenticate all network-connected endpoint devices before establishing a connection.\",\"SRG-NET-000343-VPN-001370\",\"Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\\n\\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions.\\n\\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers (outside a datacenter), VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.\\n\\nDevice authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bVroOwdA0e1yfLelH5K0/LjEPzRuPTDt+xgTDMzMsWA=\"},\"C-96017r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y/+l8kwggjnCbQ11WRfSGhCjui6kGNchR0wer8LCVos=\"},\"F-102861r1_fix\",\"V-97179\",\"medium\",\"SRG-NET-000352-VPN-001460\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",594,\"SV-106317r1_rule\",\"medium\",null,null,\"The VPN Gateway must use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.\",\"SRG-NET-000352-VPN-001460\",\"Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.\\n\\nThe National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by NIST and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future required Suite B implementations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1maPMRSAJQc9CCcE9i3+e/pBNygIhmu9m1GajIh4WrA=\"},\"C-96019r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:c81cg0K0ERMsQOfw3hMhzc4N9PuesRPEfIK2UBPat/E=\"},\"F-102863r1_fix\",\"V-97181\",\"medium\",\"SRG-NET-000369-VPN-001620\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",595,\"SV-106319r1_rule\",\"medium\",null,null,\"The VPN Gateway must disable split-tunneling for remote clients VPNs.\",\"SRG-NET-000369-VPN-001620\",\"Split tunneling would in effect allow unauthorized external connections, making the system more vulnerable to attack and to exfiltration of organizational information.\\n\\nA VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the Internet. With split tunneling enabled, a remote client has access to the Internet while at the same time has established a secured path to the enclave via an IPsec tunnel. A remote client connected to the Internet that has been compromised by an attacker in the Internet, provides an attack base to the enclave’s private network via the IPsec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:W5E6fpSFPSjZsDhRm6JBdbhvWCdb4iIQ29kz4GWDM20=\"},\"C-96021r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PzvaYVGXC+ztLTE2ZozeA+R4K4I1v/fBf/opSADlvJ0=\"},\"F-102865r1_fix\",\"V-97183\",\"medium\",\"SRG-NET-000371-VPN-001640\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",596,\"SV-106321r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.\",\"SRG-NET-000371-VPN-001640\",\"PFS generates each new encryption key independently from the previous key. Without PFS, compromise of one key will compromise all communications.\\n\\nThe phase 2 (Quick Mode) Security Association (SA) is used to create an IPsec session key. Hence, its rekey or key regeneration procedure is very important. The phase 2 rekey can be performed with or without Perfect Forward Secrecy (PFS). With PFS, every time a new IPsec Security Association is negotiated during the Quick Mode, a new Diffie-Hellman (DH) exchange occurs. The new DH shared secret will be included with original keying material (SYKEID_d, initiator nonce, and responder nonce from phase 1 for generating a new IPsec session key. If PFS is not used, the IPsec session key will always be completely dependent on the original keying material from the Phase-1. Hence, if an older key is compromised at any time, it is possible that all new keys may be compromised.\\n\\nThe DH exchange is performed in the same manner as was done in phase 1 (Main or Aggressive Mode). However, the phase 2 exchange is protected by encrypting the phase 2 packets with the key derived from the phase 1 negotiation. Because DH negotiations during phase 2 are encrypted, the new IPsec session key has an added element of secrecy.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rqcFP9ktgfb343ahB5Mv16lTwTPf1/ELOUg9C3CgAj8=\"},\"C-96023r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:j/fsWDohMzN1oclh4BAauCakys23bebITKpZxWpK2Qk=\"},\"F-102867r1_fix\",\"V-97185\",\"high\",\"SRG-NET-000371-VPN-001650\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",597,\"SV-106323r1_rule\",\"high\",null,null,\"The VPN Gateway and Client must be configured to protect the confidentiality and integrity of transmitted information.\",\"SRG-NET-000371-VPN-001650\",\"Without protection of the transmitted information, confidentiality and integrity may be compromised as unprotected communications can be intercepted and either read or altered.\\n\\nThis requirement also applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification.\\n\\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.\\n\\nFor example, configure all ISAKMP policies to use AES for Internet Key Exchange (IKE) cryptographic encryption operations and SHA-1 to protect data integrity.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+vnSRs+ZokA+P5inP7i24jyzDoJ+8dRGwCZAF72bzfw=\"},\"C-96025r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:F3uzs5G3+v3iJx/kCrPtcrdW/gsCjZHZOAXufRJxNgY=\"},\"F-102869r1_fix\",\"V-97187\",\"medium\",\"SRG-NET-000375-VPN-001690\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",598,\"SV-106325r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.\",\"SRG-NET-000375-VPN-001690\",\"ESP provides confidentiality, data origin authentication, integrity, and anti-replay services within the IPsec suite of protocols. ESP in tunnel mode ensures a secure path for communications for site-to-site VPNs and gateway to endpoints, including header information.\\n\\nESP can be deployed in either transport or tunnel mode. Transport mode is used to create a secured session between two hosts. It can also be used when two hosts simply want to authenticate each IP packet with IPsec authentication header (AH). With ESP transport mode, only the payload (transport layer) is encrypted, whereas with tunnel mode, the entire IP packet is encrypted and encapsulated with a new IP header. Tunnel mode is used to encrypt traffic between secure IPsec gateways or between an IPsec gateway and an end-station running IPsec software. Hence, it is the only method to provide a secured path to transport traffic between remote sites or end-stations and the central site.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fU8zq6dLn1EHMKbL2KwqzdBun1CXedlYFT1NSzY5Zw0=\"},\"C-96027r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:AN4m35Ma+yxdnoD7gJy8bvR+ZHLR8Sqmd04QY4ipeyM=\"},\"F-102871r1_fix\",\"V-97189\",\"medium\",\"SRG-NET-000400-VPN-001940\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",599,\"SV-106327r1_rule\",\"medium\",null,null,\"For site-to-site VPN, for accounts using password authentication, the VPN Gateway must use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.\",\"SRG-NET-000400-VPN-001940\",\"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThe information system must specify the hash algorithm used for authenticating passwords. Implementation of this requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GOcfn7YCnFViHL4Sv9yLScid+jFSlnVek7L1omc1Mjw=\"},\"C-96029r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4MYR7ku3/EgXleyLtcxftc2BDi8OAuC5GMzuGE2BIhY=\"},\"F-102873r1_fix\",\"V-97191\",\"medium\",\"SRG-NET-000492-VPN-001980\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",600,\"SV-106329r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records when successful and/or unsuccessful VPN connection attempts occur.\",\"SRG-NET-000492-VPN-001980\",\"Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\\n\\nLog records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nThis requirement only applies to components where this is specific to the function of the device, such as application layer gateway (ALG), which provides these access control and auditing functions on behalf of an application. This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D0/SC7O2V3JZ4+Sewx7Qn6Z7ZSrkdje8orXuKxcEjpo=\"},\"C-96031r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NNq3b5rAHl25ZbWpIy/Y+Q7WJgEfjrSCsg45dAZ/hYA=\"},\"F-102875r1_fix\",\"V-97193\",\"medium\",\"SRG-NET-000510-VPN-002160\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",601,\"SV-106331r1_rule\",\"medium\",null,null,\"The VPN Gateway must use a FIPS-validated cryptographic module to generate cryptographic hashes.\",\"SRG-NET-000510-VPN-002160\",\"FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plain text. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.\\n\\nThe cryptographic module used must have at least one validated hash algorithm. This validated hash algorithm must be used to generate cryptographic hashes for all cryptographic security function within the product being evaluated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GNvczQqQ8RSDNiGZgHykTH9Fl/06XwpsXibtlkPH4AM=\"},\"C-96033r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wpU2wZ1uyf3RUQgJzjcuMubJFwKQTMsVYABGtyetAu0=\"},\"F-102877r1_fix\",\"V-97195\",\"medium\",\"SRG-NET-000510-VPN-002170\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",602,\"SV-106333r1_rule\",\"medium\",null,null,\"The VPN Gateway must use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.\",\"SRG-NET-000510-VPN-002170\",\"FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plain text. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.\\n\\nThe cryptographic module used must have one FIPS-validated encryption algorithm (i.e., validated Advanced Encryption Standard [AES]). This validated algorithm must be used for encryption for cryptographic security function within the product being evaluated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nrioFfQyWAyHyqPYTDE2+pXaDoeycQE/PjC2vrEL9Jo=\"},\"C-96035r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zi3v1EJgN7RWCshcZkpIFWwckY19Ow6NkWzZdajmLjM=\"},\"F-102879r1_fix\",\"V-97197\",\"medium\",\"SRG-NET-000510-VPN-002180\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",603,\"SV-106335r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway IKE must use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.\",\"SRG-NET-000510-VPN-002180\",\"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hDgoEHbOPyCRLlTAZ0Qqx1kkok77I93P01NwpDJNEE8=\"},\"C-96037r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qUzVSTw+n8v2UFfLxBraBDENI28bgIEBRVGPthivu9U=\"},\"F-102881r1_fix\",\"V-97199\",\"high\",\"SRG-NET-000512-VPN-002220\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",604,\"SV-106337r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use Internet Key Exchange (IKE) for IPsec VPN Security Associations (SAs).\",\"SRG-NET-000512-VPN-002220\",\"Without IKE, the SPI is manually specified for each security association. IKE peers will negotiate the encryption algorithm and authentication or hashing methods as well as generate the encryption keys.\\n\\nAn IPsec SA is established using either Internet Key Exchange (IKE) or manual configuration. When using IKE, the security associations are established when needed and expire after a period of time or volume of traffic threshold. If manually configured, they are established as soon as the configuration is complete at both end points and they do not expire. When using IKE, the Security Parameter Index (SPI) for each security association is a pseudo-randomly derived number.\\n\\nWith manual configuration of the IPsec security association, both the cipher key and authentication key are static. Hence, if the keys are compromised, the traffic being protected by the current IPsec tunnel can be decrypted as well as traffic in any future tunnels established by this SA. Furthermore, the peers are not authenticated prior to establishing the SA, which could result in a rogue device establishing an IPsec SA with either of the VPN end points.\\n\\nIKE provides primary authentication to verify the identity of the remote system before negotiation begins. This feature is lost when the IPsec security associations are manually configured, which results in a non-terminating session using static pre-shared keys.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IzzOyrG05CKpFAWFrkEoNJ5rxjb3elkLNtjevgCQdtw=\"},\"C-96039r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:xx84wPMsMSSAo4CeASGVN5MvUIu7DiKqar4aWbsOerA=\"},\"F-102883r1_fix\",\"V-97201\",\"high\",\"SRG-NET-000512-VPN-002230\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",605,\"SV-106339r1_rule\",\"high\",null,null,\"The VPN Gateway must not accept certificates that have been revoked when using PKI for authentication.\",\"SRG-NET-000512-VPN-002230\",\"Situations may arise in which the certificate issued by a Certificate Authority (CA) may need to be revoked before the lifetime of the certificate expires. For example, the certificate is known to have been compromised.\\n\\nWhen an incoming Internet Key Exchange (IKE) session is initiated for a remote client or peer whose certificate is revoked, the revocation list configured for use by the VPN server is checked to see if the certificate is valid; if the certificate is revoked, IKE will fail and an IPsec security association will not be established for the remote endpoint.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GrHgK/pBnHrsn1Seh0qJujIqrWqRLPE0eaA+ZAqQMjo=\"},\"C-96041r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:X8wHzcaz0980HXxuy93EVyk4VDWyVtsDF0WbqVlaX/w=\"},\"F-102885r1_fix\",\"V-97203\",\"medium\",\"SRG-NET-000518-VPN-002280\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",606,\"SV-106341r1_rule\",\"medium\",null,null,\"The VPN Client logout function must be configured to terminate the session on/with the VPN Gateway.\",\"SRG-NET-000518-VPN-002280\",\"If a user cannot explicitly end a session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session.\\n\\nHowever, for some types of interactive sessions including, for example, remote login, information systems typically send logout messages as final messages prior to terminating sessions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+WzKvuFJw2Hd2tINf3CAdDXjeroLc9pIuZQ8rxqAqW8=\"},\"C-96043r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+tCpOllw27HEiCrQcnfBz1Mp9uGAIFb0WolLkLykCm4=\"},\"F-102887r1_fix\",\"V-97205\",\"medium\",\"SRG-NET-000519-VPN-002290\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",607,\"SV-106343r1_rule\",\"medium\",null,null,\"The VPN Client must display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.\",\"SRG-NET-000519-VPN-002290\",\"If a user cannot explicitly end a session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. Users need to be aware of whether or not the session has been terminated.\\n\\nLogout messages for access, for example, can be displayed after authenticated sessions have been terminated. However, for some types of interactive sessions including, for example, remote login, information systems typically send logout messages as final messages prior to terminating sessions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WFTjVjonYKh95+ufS3SeRtMzKzxvcuYhkuGqLkDzAdQ=\"},\"C-96045r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fy0MhQs22gOsjCy8Ui4Xr8MpXyFw2N5p7qTSc67sOzM=\"},\"F-102889r1_fix\",\"V-97207\",\"medium\",\"SRG-NET-000522-VPN-002320\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",608,\"SV-106345r1_rule\",\"medium\",null,null,\"For site-to-site VPN Gateway must store only cryptographic representations of Pre-shared Keys (PSKs).\",\"SRG-NET-000522-VPN-002320\",\"Pre-shared keys need to be protected at all times, and encryption is the standard method for protecting passwords. If PSKs are not encrypted, they can be plainly read and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\\n\\nPSKs used for site-to-site VPNs are considered by the SRG as a type of password. If this shared secret is already encrypted and not in plaintext, this meets this requirement. This requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption. This method uses a one-way hashing encryption algorithm with a salt value to validate a user's password without having to store the actual password. Performance and time required to access are factors that must be considered, and the one-way hash is the most feasible means of securing the password and providing an acceptable measure of password security.\\n\\nUse a keyed hash message authentication code (HMAC). HMAC calculates a message authentication code via a cryptographic hash function used in conjunction with an encryption key. The key must be protected as with any private key.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WvHtCxF8aHRpizWQnHhcRWZ2GSo4LpYF4C+7vAKUMGY=\"},\"C-96047r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lOGJxdtWr9FVthiaj/+UbIRNwkTQqM0TzcIWviq/0Jk=\"},\"F-102891r1_fix\",\"V-97209\",\"high\",\"SRG-NET-000525-VPN-002330\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",609,\"SV-106347r1_rule\",\"high\",null,null,\"The IPsec VPN must use Advanced Encryption Standard (AES) encryption for the IPsec proposal to protect the confidentiality of remote access sessions.\",\"SRG-NET-000525-VPN-002330\",\"Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nA block cipher mode is an algorithm that features the use of a symmetric key block cipher algorithm to provide an information service, such as confidentiality or authentication.\\n\\nAES is the FIPS-validated cipher block cryptographic algorithm approved for use in DoD. For an algorithm implementation to be listed on a FIPS 140-2 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. Currently, NIST has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hK46dRZBIlXNdxH/0rgMhBXqrBF8nwMTFp1UUvsZ2/w=\"},\"C-96049r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:f3H1Fnk3Mq9sTlW4p0spIywjLsmMT5ZgZN+1SV7bU2U=\"},\"F-102893r1_fix\",\"V-97211\",\"medium\",\"SRG-NET-000530-VPN-002340\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",610,\"SV-106349r1_rule\",\"medium\",null,null,\"The TLS VPN Gateway that supports Government-only services must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.\",\"SRG-NET-000530-VPN-002340\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nThis requirement applies to TLS gateways (also known as SSL gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Oyy/mFzHcQy1sAgTQ9gS+b99/s9IcmH4xTl+n0Pf6Rw=\"},\"C-96051r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tG7QZxAuAcqmA4gmuAeWEA9ZEnLVfGT5NFaUDibQfFE=\"},\"F-102895r1_fix\",\"V-97213\",\"medium\",\"SRG-NET-000540-VPN-002350\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",611,\"SV-106351r1_rule\",\"medium\",null,null,\"The TLS VPN Gateway that supports citizen- or business-facing network devices must prohibit client negotiation to SSL 2.0 or SSL 3.0.\",\"SRG-NET-000540-VPN-002350\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nThis requirement applies to public-facing or external-facing devices such as TLS gateways (also known as SSL gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance.\\n\\nThe minimum TLS version required by DoD is 1.2. However, devices and applications may allow client negotiation for systems supporting citizen- and business-facing applications. These devices may be configured to support TLS version 1.1 and 1.0 to enable interaction with citizens and businesses. These devices must not support SSL version 3.0 or earlier.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0WoWCtzpWtYJ2vxCT7vXvLruiskYzBOwEVdaxJWlGbM=\"},\"C-96053r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nHHSH5iwaGyboJNtWTygHWn0yTU3Rug61FYQH6Ni/Ek=\"},\"F-102897r1_fix\",\"V-97215\",\"medium\",\"SRG-NET-000550-VPN-002360\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",612,\"SV-106353r1_rule\",\"medium\",null,null,\"The VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.\",\"SRG-NET-000550-VPN-002360\",\"Without device-to-device authentication, communications with malicious devices may be established. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk.\\n\\nSNMPv3 supports authentication, authorization, access control, and privacy while previous versions of the protocol contained well-known security weaknesses, which were easily exploited. SNMPv3 can be configured for identification and bidirectional, cryptographically based authentication.\\n\\nA typical SNMP implementation includes three components: Managed device, SNMP agent, and NMS. The SNMP agent is the SNMP process that resides on the managed device and communicates with the network management system. The NMS is a combination of hardware and software that is used to monitor and administer a network. The SNMP data is stored in a highly-structured, hierarchical format known as a management information base (MIB). The SNMP manager collects information about network connectivity, activity, and events by polling managed devices.\\n\\nSNMPv3 defines a user-based security model (USM), and a view-based access control model (VACM). SNMPv3 USM provides data integrity, data origin authentication, message replay protection, and protection against disclosure of the message payload. SNMPv3 VACM provides access control to determine whether a specific type of access (read or write) to the management information is allowed. Implement both VACM and USM for full protection.\\n\\nSNMPv3 server services must not be configured on products whose primary purpose is not to provide SNMP services. SNMP client services may be configured on the VPN gateway, application, or operating system to allow limited monitoring or querying of the device from by an SNMP server for management purposes. SNMP of any version will not be used to make configuration changes to the device. SNMPv3 must be disabled by default and enabled only if used. SNMP v3 provides security feature enhancements to SNMP, including encryption and message authentication.\\n\\nCurrently, the AES cipher block algorithm can be used for both applying cryptographic protection (e.g., encryption) and removing or verifying the protection that was previously applied (e.g., decryption) in DoD. The use of FIPS-approved algorithms for both cryptographic mechanisms is required. If any version of SNMP is used for remote administration, default SNMP community strings such as “public” and “private” should be removed before real community strings are put into place. If the defaults are not removed, an attacker could retrieve real community strings from the device using the default string.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RFq+xtylI0rdth+CO8xXpnUCA7eBYGNXjStRxU/Sh2g=\"},\"C-96055r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:snkiXNFPpO0+kw0zQco5SKVgkORHDhyOH3PpUq4/k30=\"},\"F-102899r1_fix\",\"V-97217\",\"high\",\"SRG-NET-000565-VPN-002390\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",613,\"SV-106355r1_rule\",\"high\",null,null,\"The VPN Gateway must use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.\",\"SRG-NET-000565-VPN-002390\",\"Use of improperly configured or lower assurance equipment and solutions could compromise high-value information.\\n\\nThe National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by the National Institute of Standards and Technology (NIST) and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future Suite B implementations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p7UCHJrDUnFC2jp6mXGtSAilZeT3BjF1NVmG5ykWcy4=\"},\"C-96057r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KIex1ZGWMlFIxubnYXqgVjEDQ6/8SNR9c5AVbsZNKEA=\"},\"F-102901r1_fix\",\"V-97219\",\"high\",\"SRG-NET-000565-VPN-002400\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",614,\"SV-106357r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway Internet Key Exchange (IKE) must use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.\",\"SRG-NET-000565-VPN-002400\",\"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\\n\\nRFC 6379 Suite B Cryptographic Suites for IPsec defines four cryptographic user interface suites for deploying IPsec. Each suite provides choices for Encapsulating Security Payload (ESP) and IKE. The four suites are differentiated by the choice of IKE authentication and key exchange, cryptographic algorithm strengths, and whether ESP is to provide both confidentiality and integrity or integrity only. The suite names are based on the Advanced Encryption Standard (AES) mode and AES key length specified for ESP. Two suites are defined for transporting classified information up to SECRET level—one for both confidentiality and integrity and one for integrity only. There are also two suites defined for transporting classified information up to TOP SECRET level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F8wZynyPCZXbSCQKsDAa3RDhSkunUmMAhgYUP9Yu014=\"},\"C-96059r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sJ4ufacKRyx88U9iliMjZLvETY3nQgVUnTBTVlqZ1YA=\"},\"F-102903r1_fix\",\"V-97221\",\"medium\",\"SRG-NET-000580-VPN-002410\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",615,\"SV-106359r1_rule\",\"medium\",null,null,\"The VPN Gateway must validate certificates used for Transport Layer Security (TLS) functions by performing RFC 5280-compliant certification path validation.\",\"SRG-NET-000580-VPN-002410\",\"A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate.\\n\\nCertification path validation includes checks such as certificate issuer trust, time validity, and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WOsWkwp7rHKriDcEPQi1g0VQp3X0XA14Kw+soZYNvnw=\"},\"C-96061r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jLNfObMjTtI/+Xyh7vDwZR17rLmudLzlz6NwxhVITKs=\"},\"F-102905r1_fix\",\"V-97223\",\"medium\",\"SRG-NET-000585-VPN-002420\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",616,\"SV-106361r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).\",\"SRG-NET-000585-VPN-002420\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Use only SHA-2 for Digital signature generation applications and functions. SHA-2 is strongly preferred for use by DoD for non-signature generation functions.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\\n\\nFor digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use only if needed for business critical applications.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5JYnVzed7VNQLssmYLnmi+secKLvHnAiNpVnw5LnOy0=\"},\"C-96063r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0MUtJg0aE03Glc9kBOBNI3y2a6+ptn7NTc3Xse+sN6w=\"},\"F-102907r1_fix\",\"V-97225\",\"medium\",\"SRG-NET-000075-VPN-000260\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",617,\"SV-106363r1_rule\",\"medium\",null,null,\"If the site-to-site VPN implementation uses L2TP, L2TPv3 sessions must be authenticated prior to transporting traffic.\",\"SRG-NET-000075-VPN-000260\",\"L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP tunnels can also carry IP packets that are very difficult to filter because of the additional encapsulation. Hence, it is imperative that L2TP sessions are authenticated prior to transporting traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_OTHER-2-2\",618,\"SV-106179r1_xxxx\",\"medium\",null,null,\"This rule title has been replaced.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"C-95879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fgzhbaQbILFSeEwIwlOogRZtoeuNS7Kr0AHwx84IKLg=\"},\"F-102723r1_fix\",\"V-97043\",\"medium\",\"SRG-NET-000041-VPN-000110\",null,null,null,null,null,\"VPN_SRG_OTHER-2-2\",619,\"SV-106181r1_xxxx\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.\",\"SRG-NET-000041-VPN-000110\",\"Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n \\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_Rule-fingerprint-match-test-2-2\",620,\"SV-106179r1_xxxx\",\"medium\",null,null,\"This rule title has been replaced.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_Rule-fingerprint-match-test-2-2\",621,\"SV-106179r1_zzzzzz\",\"medium\",null,null,\"This rule title has been replaced.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"C-95879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fgzhbaQbILFSeEwIwlOogRZtoeuNS7Kr0AHwx84IKLg=\"},\"F-102723r1_fix\",\"V-97043\",\"medium\",\"SRG-NET-000041-VPN-000110\",null,null,null,null,null,\"VPN_SRG_Rule-fingerprint-match-test-2-2\",622,\"SV-106181r1_xxxx\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.\",\"SRG-NET-000041-VPN-000110\",\"Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n \\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n{\"table\":\"review\",\"columns\":\"`assetId`,`autoResult`,`checkDigest`,`comment`,`detail`,`metadata`,`resultEngine`,`resultId`,`reviewId`,`ruleId`,`statusId`,`statusText`,`statusTs`,`statusUserId`,`ts`,`userId`,`version`\",\"rowCount\":20}\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"idk\",\"test\\nvisible to lvl1\",\"{\\\"testkey\\\": \\\"testvalue\\\"}\",null,3,1,\"SV-106179r1_rule\",1,null,\"2021-07-16 03:34:02\",1,\"2021-07-16 03:34:02\",1,\"SRG-NET-000019-VPN-000040\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:slm2UFIqnUUPyOpfIcsxSew4LGvsTesU9C6Ju5XJ3mw=\"},\"\",\"test\\nvisible to lvl1\\nhas history\",\"{}\",null,2,2,\"SV-106181r1_rule\",1,null,\"2022-02-03 00:07:07\",87,\"2022-02-03 00:07:05\",87,\"SRG-NET-000041-VPN-000110\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:jc6QW12gqdTKEPqvls4bilVyDJExcCoSskTVyO0VtC8=\"},\"test\\nvisible to lvl1\",\"test\\nvisible to lvl1\",\"{}\",null,4,3,\"SV-106183r1_rule\",1,null,\"2020-08-11 22:27:26\",1,\"2020-08-11 22:27:26\",1,\"SRG-NET-000042-VPN-000120\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:4cT/S3JRnRG1/bjkxCCl0FvJ2jFBPQxR6xd/ho3iPwU=\"},\"test\\nvisible to lvl1\",\"test\\nvisible to lvl1\",\"{}\",null,4,4,\"SV-106185r1_rule\",1,null,\"2020-08-11 22:28:27\",1,\"2020-08-11 22:28:27\",1,\"SRG-NET-000043-VPN-000130\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:IdemsTDQGwPd7bokQxIIvpGCFpuH2a0LMkx43UGqWUA=\"},\"test\\nvisible to lvl1\",\"test\\nvisible to lvl1\",\"{}\",null,4,5,\"SV-106187r1_rule\",1,null,\"2020-08-11 22:28:17\",1,\"2020-08-11 22:28:17\",1,\"SRG-NET-000049-VPN-000150\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:aVWTWelue2vPX4PPQhsVdenoG0JoZrePs1txZu8Tn9w=\"},null,\"test\\nvisible to lvl1\\nunbumitted\\n\",\"{}\",null,3,6,\"SV-106189r1_rule\",0,null,\"2020-08-11 22:28:42\",1,\"2020-08-11 22:28:42\",1,\"SRG-NET-000053-VPN-000170\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:vchgPhpapNXqH1070giShdvTrztio49eNJBWV74F3HU=\"},null,\"test\\nvisible to lvl2 and above\",\"{}\",null,3,7,\"SV-77809r3_rule\",0,null,\"2020-08-11 22:29:16\",1,\"2020-08-11 22:29:16\",1,\"WN10-00-000005\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:kaQFP+qv+/U0A5jz+BdWIpTTdtyktf1MP4WKqmlH3c4=\"},null,\"test\\nvisible to lvl2 and above\",\"{}\",null,3,8,\"SV-77811r1_rule\",1,null,\"2020-08-11 22:29:30\",1,\"2020-08-11 22:29:30\",1,\"WN10-CC-000310\"]\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:LSSb1gLDf7uiXzn44Bg4EplFPsBwaprDmRrselWEvyE=\"},\"test\\nlvl2\",\"test\\nlvl2\",\"{}\",null,4,9,\"SV-77813r6_rule\",1,null,\"2020-08-18 20:48:29\",1,\"2020-08-18 20:48:29\",1,\"WN10-00-000010\"]\n[62,false,{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"\",\"test\\nvisible to lvl1\",\"{}\",null,2,10,\"SV-106179r1_rule\",1,null,\"2022-01-26 01:23:06\",87,\"2022-01-26 01:23:06\",87,\"SRG-NET-000019-VPN-000040\"]\n[62,false,{\"type\":\"Buffer\",\"data\":\"base64:slm2UFIqnUUPyOpfIcsxSew4LGvsTesU9C6Ju5XJ3mw=\"},null,\"test\\nvisible to lvl1\",\"{}\",null,2,11,\"SV-106181r1_rule\",1,null,\"2020-08-11 23:37:48\",1,\"2020-08-11 23:37:48\",1,\"SRG-NET-000041-VPN-000110\"]\n[62,false,{\"type\":\"Buffer\",\"data\":\"base64:jc6QW12gqdTKEPqvls4bilVyDJExcCoSskTVyO0VtC8=\"},null,\"test\\nvisible to lvl1\",\"{}\",null,4,12,\"SV-106183r1_rule\",0,null,\"2020-08-11 23:37:53\",1,\"2020-08-11 23:37:53\",1,\"SRG-NET-000042-VPN-000120\"]\n[153,false,{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},null,\"test\\nvisible to lvl1\",\"{}\",null,3,13,\"SV-106179r1_rule\",1,null,\"2020-08-18 02:22:56\",1,\"2020-08-18 02:22:56\",1,\"SRG-NET-000019-VPN-000040\"]\n[154,false,{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"\",\"test\\nvisible to lvl1\\nhas history\",\"{}\",null,3,14,\"SV-106179r1_rule\",1,null,\"2022-02-02 20:20:18\",87,\"2022-02-02 20:20:18\",87,\"SRG-NET-000019-VPN-000040\"]\n[154,false,{\"type\":\"Buffer\",\"data\":\"base64:slm2UFIqnUUPyOpfIcsxSew4LGvsTesU9C6Ju5XJ3mw=\"},null,\"test\\nvisible to lvl1\",\"{}\",null,2,15,\"SV-106181r1_rule\",1,null,\"2020-08-11 22:30:42\",1,\"2020-08-11 22:30:42\",1,\"SRG-NET-000041-VPN-000110\"]\n[154,false,{\"type\":\"Buffer\",\"data\":\"base64:jc6QW12gqdTKEPqvls4bilVyDJExcCoSskTVyO0VtC8=\"},null,\"test\\nvisible to lvl1\",\"{}\",null,4,16,\"SV-106183r1_rule\",0,null,\"2020-08-11 22:30:51\",1,\"2020-08-11 22:30:51\",1,\"SRG-NET-000042-VPN-000120\"]\n[154,false,{\"type\":\"Buffer\",\"data\":\"base64:4cT/S3JRnRG1/bjkxCCl0FvJ2jFBPQxR6xd/ho3iPwU=\"},null,\"test\\nvisible to lvl1\",\"{}\",null,4,17,\"SV-106185r1_rule\",0,null,\"2020-08-11 22:30:55\",1,\"2020-08-11 22:30:55\",1,\"SRG-NET-000043-VPN-000130\"]\n[154,false,{\"type\":\"Buffer\",\"data\":\"base64:IdemsTDQGwPd7bokQxIIvpGCFpuH2a0LMkx43UGqWUA=\"},null,\"test\\nvisible to lvl1\",\"{}\",null,4,18,\"SV-106187r1_rule\",0,null,\"2020-08-11 22:31:11\",1,\"2020-08-11 22:31:11\",1,\"SRG-NET-000049-VPN-000150\"]\n[240,false,{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},null,\"test\\nno one but admin users should see this.\",\"{}\",null,3,19,\"SV-106179r1_rule\",0,null,\"2020-08-18 02:22:23\",1,\"2020-08-18 02:22:23\",1,\"SRG-NET-000019-VPN-000040\"]\n[248,false,{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"wdwd\",\"awdwd\",\"{}\",null,4,20,\"SV-106179r1_rule\",0,null,\"2025-05-30 21:07:44\",87,\"2025-05-30 21:07:44\",87,\"SRG-NET-000019-VPN-000040\"]\n{\"table\":\"review_history\",\"columns\":\"`autoResult`,`comment`,`detail`,`historyId`,`resultEngine`,`resultId`,`reviewId`,`ruleId`,`statusId`,`statusText`,`statusTs`,`statusUserId`,`touchTs`,`ts`,`userId`\",\"rowCount\":7}\n[false,null,\"test\\nvisible to lvl1\",1,null,3,1,\"SV-106179r1_rule\",1,null,\"2020-08-11 23:37:45\",1,\"2020-08-11 23:37:45\",\"2020-08-11 23:37:45\",1]\n[false,null,\"test\\nvisible to lvl1\",2,null,3,1,\"SV-106179r1_rule\",0,null,\"2020-08-11 23:37:45\",87,\"2020-08-11 23:37:45\",\"2020-08-11 23:37:45\",1]\n[false,null,\"test\\nvisible to lvl1\",3,null,2,2,\"SV-106181r1_rule\",1,null,\"2020-08-11 22:26:50\",1,\"2020-08-11 22:26:50\",\"2020-08-11 22:26:50\",1]\n[false,null,\"test\\nvisible to lvl1\",4,null,2,2,\"SV-106181r1_rule\",0,null,\"2020-08-11 22:26:50\",87,\"2020-08-11 22:26:50\",\"2020-08-11 22:26:50\",1]\n[false,\"\",\"test\\nvisible to lvl1\\nhas history\",5,null,2,2,\"SV-106181r1_rule\",0,null,\"2022-02-03 00:07:05\",87,\"2022-02-03 00:07:05\",\"2022-02-03 00:07:05\",87]\n[false,null,\"test\\nvisible to lvl1\",6,null,3,14,\"SV-106179r1_rule\",1,null,\"2020-08-11 22:30:38\",1,\"2020-08-11 22:30:38\",\"2020-08-11 22:30:38\",1]\n[false,null,\"test\\nvisible to lvl1\",7,null,3,14,\"SV-106179r1_rule\",0,null,\"2020-08-11 22:30:38\",87,\"2020-08-11 22:30:38\",\"2020-08-11 22:30:38\",1]\n{\"table\":\"revision\",\"columns\":\"`active`,`benchmarkDate`,`benchmarkDateSql`,`benchmarkId`,`checkCount`,`description`,`fixCount`,`groupCount`,`highCount`,`lowCount`,`marking`,`mediumCount`,`release`,`revId`,`status`,`statusDate`,`version`\",\"rowCount\":5}\n[1,\"31 Mar 2020\",\"2020-03-31\",\"RHEL_7_STIG_TEST\",247,\"This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.\",247,247,29,14,null,201,\"0.3\",\"RHEL_7_STIG_TEST-3-0.3\",\"draft\",\"2020-03-27\",3]\n[1,\"19 Jul 2001\",\"2001-07-19\",\"VPN_SRG_OTHER\",2,\"This description replaces the old description\",2,2,0,0,null,2,\"2\",\"VPN_SRG_OTHER-2-2\",\"accepted\",\"2001-07-26\",2]\n[1,\"19 Jul 2001\",\"2001-07-19\",\"VPN_SRG_Rule-fingerprint-match-test\",3,\"This description replaces the old description\",3,3,0,0,null,3,\"2\",\"VPN_SRG_Rule-fingerprint-match-test-2-2\",\"accepted\",\"2001-07-26\",2]\n[1,\"19 Jul 2019\",\"2019-07-19\",\"VPN_SRG_TEST\",81,\"This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",81,81,11,7,null,63,\"1\",\"VPN_SRG_TEST-1-1\",\"accepted\",\"2019-07-26\",1]\n[1,\"17 Jun 2020\",\"2020-06-17\",\"Windows_10_STIG_TEST\",287,\"The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",287,287,26,18,null,243,\"23\",\"Windows_10_STIG_TEST-1-23\",\"accepted\",\"2020-06-15\",1]\n{\"table\":\"rule_version_check_digest\",\"columns\":\"`checkDigest`,`ruleId`,`version`\",\"rowCount\":618}\n[{\"type\":\"Buffer\",\"data\":\"base64:nkk6VkjluuUxkzsszOk8eTgHlUakS2R/bR95QTwbAM8=\"},\"SV-204392r241939_rule\",\"RHEL-07-010010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:iSqVW4RiHyBVvrAYsGNx9SrOT+nAF6gnNHhGSMv/OPg=\"},\"SV-214799r241939_rule\",\"RHEL-07-010020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:t3pLu4RByPjTmSyEGSrDsv2WpOjBnMxFcux4WTKpzsg=\"},\"SV-204393r241939_rule\",\"RHEL-07-010030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b7cLLXAJwWiYlb+ZLVM/YmYEKrJOElbc2DI7KzdElaY=\"},\"SV-204394r241939_rule\",\"RHEL-07-010040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9ShQfZRP37ZylVTOj7a7tmzPRP/DZmVauIWv5cK5IgU=\"},\"SV-204395r241939_rule\",\"RHEL-07-010050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Eg7oETP6JdEiW9fWb3CWsCNr1Ee+e9COo/1vPyjLJyA=\"},\"SV-204396r241939_rule\",\"RHEL-07-010060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v8r3y4wndT3MrdoqZ+IXfrOkoGx9bEvFFDEL4eMv6bI=\"},\"SV-204397r241939_rule\",\"RHEL-07-010061\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:M7pACkppJDi/CsMl2CmLoXQL4s2zAFRVxqwbrcNQ3+k=\"},\"SV-214937r241939_rule\",\"RHEL-07-010062\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4Vhryn3qYojwlbzNOTBxhlYOCH+6lGP9nQktKh5cvso=\"},\"SV-204398r241939_rule\",\"RHEL-07-010070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9A9hqWAZ5NS1n2W3Z6epeuVuWBbbbPCEc/zuKz7IiSM=\"},\"SV-204399r241939_rule\",\"RHEL-07-010081\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1r/d1v914jFv+PeIiRAnO8w+OdA0cucmU9N4uS9npIU=\"},\"SV-204400r241939_rule\",\"RHEL-07-010082\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BdYvtV85bZiRNU3aVsf9P0v0mUKO7gFFdyTulpf63UA=\"},\"SV-204401r241939_rule\",\"RHEL-07-010090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SJj4kDOYlogEinGYl4UBtzYvD0sUOtC0Zc+GkbM/nQg=\"},\"SV-204402r241939_rule\",\"RHEL-07-010100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wLqPaWBvxUmRKRMMSiJj2pj0F8NCk7mvWKECb9jxRgw=\"},\"SV-204403r241939_rule\",\"RHEL-07-010101\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:orUMwfifYhVDl5eCyl7LEBXY8R0QtYf4FB3AikYOR0Q=\"},\"SV-204404r241939_rule\",\"RHEL-07-010110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:87KK1t2KJmsVqwDVxcvH3F6erHGSjt6gU3lODHDY4FI=\"},\"SV-204405r241939_rule\",\"RHEL-07-010118\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NVVlZz6DnbTO6YEa+HkLTRE6ApJBkX8N7oXza495krA=\"},\"SV-204406r241939_rule\",\"RHEL-07-010119\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZZsZT55sjZiOw8YvdeG/PuTRrOJNXQ9fXpNFx1alZS0=\"},\"SV-204407r241939_rule\",\"RHEL-07-010120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5mP42vXD7dbHMk2adGpM5o78xd9tfHYGp4AY1olXPug=\"},\"SV-204408r241939_rule\",\"RHEL-07-010130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+ZxB96680QpTXOUhL+JNnhQFv/FKeRTfkrvRL3PV5S8=\"},\"SV-204409r241939_rule\",\"RHEL-07-010140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:abrw002NXrRQ66PzmbZYPT3hHRpQytzeYoaeJHhVEhU=\"},\"SV-204410r241939_rule\",\"RHEL-07-010150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CKBfpvZELPLxUExAGYDADab38Se08BtvG5UpBNIazBI=\"},\"SV-204411r241939_rule\",\"RHEL-07-010160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wHEY2x4CvlXeh/wo8XesGOqxBrsYGWbUXOPbniv8Eec=\"},\"SV-204412r241939_rule\",\"RHEL-07-010170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:50yiX31ofIr+hd8aTkGds0o0cG1XWzi9CajHGO80y9s=\"},\"SV-204413r241939_rule\",\"RHEL-07-010180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:B5/JCBM3+y8mI0Wx//3vcvLxaBJUTuafPhnRMesP9F4=\"},\"SV-204414r241939_rule\",\"RHEL-07-010190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:EWkE5ArbnCtRXt1tYfKaQZxY82bf5+ySftE5x3A7rUw=\"},\"SV-204415r241939_rule\",\"RHEL-07-010200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:szDJRfipxjLUpU4siSaUz52MOYPESOCSPqgSYGrG8h8=\"},\"SV-204416r241939_rule\",\"RHEL-07-010210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:37jX9s+legYelkYfnf62nyYfMX4Svx6S53TO09s9e7U=\"},\"SV-204417r241939_rule\",\"RHEL-07-010220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+bzaAS/aDWQDJP8ZUOuMk/ISS9nWHhkC1peC0GEcbKo=\"},\"SV-204418r241939_rule\",\"RHEL-07-010230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MrAAW3p9KHUSNIIDH94flLWi6pGLzydp9PgU+RlvGC4=\"},\"SV-204419r241939_rule\",\"RHEL-07-010240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aD2m4e2s0uh65x94BQAdZnXh7LZzUYWOg1jlF0xaYe4=\"},\"SV-204420r241939_rule\",\"RHEL-07-010250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Xq5u0Pw/Zw4wuAxFngAnRjHsza6G0aVM5vVkmV9EUkw=\"},\"SV-204421r241939_rule\",\"RHEL-07-010260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N2xDTbhTE+RFh0/Sm++3xu/AV9xHzSY7hXbPJaaNeEk=\"},\"SV-204422r241939_rule\",\"RHEL-07-010270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wnEfB+iBnuzOMM868Vy5hLj72C0iU0CFAkGqCn3lcV8=\"},\"SV-204423r241939_rule\",\"RHEL-07-010280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dxEV5bGuHZP4iVsWXTtnKnb7HW9YuqytYqEfO4SaQlk=\"},\"SV-204424r241939_rule\",\"RHEL-07-010290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fGovMAyL0HmlG0cv8i7GIrnPdYDI2Uu2j1CXqheXU6U=\"},\"SV-204425r241939_rule\",\"RHEL-07-010300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HWvW+5i4DGfbBRQ5ePFMe8hnoLMZwFwyu8jP8qD13B4=\"},\"SV-204426r241939_rule\",\"RHEL-07-010310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:H9mT1qdHOp9+ZyEy2fFxjTE/8tI1xhFtEvJORCJqd1k=\"},\"SV-204427r241939_rule\",\"RHEL-07-010320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oD6nmwpiJW9D5Cp/XXFX9UYRA755KWJpjrae9YSJLcA=\"},\"SV-204428r241939_rule\",\"RHEL-07-010330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GEhzlPPnk+CAcWnOXaLRDP95b6T65/xq1qVqL/b84vw=\"},\"SV-204429r241939_rule\",\"RHEL-07-010340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SxSLBVVTtBtxKalJaRaw/6lgbVU0UOBOkgcTTRhHxD8=\"},\"SV-204430r241939_rule\",\"RHEL-07-010350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+hZzZLys3BX7zWBUfBAVBQPgw6OXD+II7GH5BWOLMCI=\"},\"SV-204431r241939_rule\",\"RHEL-07-010430\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wXo7iqYH5XGZTi7xVyPo9OMFKHuQ4XH2hIqOWqKo2ig=\"},\"SV-204432r241939_rule\",\"RHEL-07-010440\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9DWDKCqiCDCdPaBAR1JnUJ2FgBKkNaNW7tQqAq+dw08=\"},\"SV-204433r241939_rule\",\"RHEL-07-010450\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rBMTU13BrvFeKQ+LVw9CSDaXjsTTmFaQjUCP5WUmK4E=\"},\"SV-204434r241939_rule\",\"RHEL-07-010460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/uoCfeW8Df/g/XGQoBkg5WVbTAykMMBn4oMkJdNUEyA=\"},\"SV-204435r241939_rule\",\"RHEL-07-010470\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PVRLHuZ9kP5FJwKwYPDiChFJ5ZxZtcp0ro/wCh+st1A=\"},\"SV-204436r241939_rule\",\"RHEL-07-010480\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:y7xDq5NT2XNGrsamdbkoYKBvisZGFnS1fyg5AKvdfUQ=\"},\"SV-204437r241939_rule\",\"RHEL-07-010481\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tSZDrM1hWlCATKGgxqXsqEoIbIpJlq97X+0R6excyuQ=\"},\"SV-204438r241939_rule\",\"RHEL-07-010482\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N8tSABUcJlBAkZ3vrmMcMUQscjNj485lQceECmBpBqY=\"},\"SV-204439r241939_rule\",\"RHEL-07-010490\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3DS5zKmPA1/pZTvKSZLzlkwx6ZjRlk5GytGTDgvav+s=\"},\"SV-204440r241939_rule\",\"RHEL-07-010491\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JTVgaY1LZdMLglvZK8C9tixEgj79wwesQdbeHi7a7Rk=\"},\"SV-204441r241939_rule\",\"RHEL-07-010500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mkc5HGb9gHNlg2WnY/djvfYdh8TcEe1wjVMoosFw32o=\"},\"SV-204442r241939_rule\",\"RHEL-07-020000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:L6nJ9zxJTEu9H+NPMBNKXjZF11fxVnKsHJ0WDDygoYg=\"},\"SV-204443r241939_rule\",\"RHEL-07-020010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pp7LtbhvevdAe+ue4EVnM1uccxy7pW3XZ+xC9xFfmNk=\"},\"SV-214800r241939_rule\",\"RHEL-07-020019\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sfB3iHYcODrsGQIdQzi9S4OiWXlzCjwowCqvtusaGKY=\"},\"SV-204444r241939_rule\",\"RHEL-07-020020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:toAqPFxuUxre2EEjoCzKlhcSnOb9RFpEln3MtuVIT9Q=\"},\"SV-204445r241939_rule\",\"RHEL-07-020030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NzJUcxxFJi8pit5evzZxnwQLQXWBf4/ftLMFNB6yiGw=\"},\"SV-204446r241939_rule\",\"RHEL-07-020040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i6TlhYJkq+XnxoK0jdYhyvmrG0/kVGWgegQHFyIbH8Y=\"},\"SV-204447r241939_rule\",\"RHEL-07-020050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SKIqa4iromN1/ld/zYxiQSOEbtGDJiFaQ30mjK6UgUY=\"},\"SV-204448r241939_rule\",\"RHEL-07-020060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/bMIprnmuyHCZfwMhN53JacAU9Bw8vUNAz6FpcIsWeU=\"},\"SV-204449r241939_rule\",\"RHEL-07-020100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7C8lXVeU00V8ySil2p6/I+nVauuGAbjK42d5ow1J2Y4=\"},\"SV-204450r241939_rule\",\"RHEL-07-020101\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fvHgDUJGBMB+FLi/4z9egnoRgc5XNsyChWvVL+OV66I=\"},\"SV-204451r241939_rule\",\"RHEL-07-020110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ECU3PcokYJ0iTOaeFC4vceGeElsR/zrQCO1UeE3DreQ=\"},\"SV-204452r241939_rule\",\"RHEL-07-020200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mc80MJb4r7Qc8AmVFz9tOOJczWkzT3PVQISn5ZtRXSE=\"},\"SV-204453r241939_rule\",\"RHEL-07-020210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qFfBME/2o77yTMuxtpA4P0I8o2NQnfoVfThRiWzo6Lk=\"},\"SV-204454r241939_rule\",\"RHEL-07-020220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F70pc4lFutrB1aZSKBDOLu0diT12WqlYfaQrxFvOlBg=\"},\"SV-204455r241939_rule\",\"RHEL-07-020230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:brL/cUNHx6LqwmVc7ML2OUn/P9TF3UTZ+dZ6dn6tjNY=\"},\"SV-204456r241939_rule\",\"RHEL-07-020231\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:41T5JYxmVoKU+kVdsnjUa+6f5+dfkDIeSb6GFuUm5Dw=\"},\"SV-204457r241939_rule\",\"RHEL-07-020240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BKBVXasUfiVr7ygcFP+LUlFT+KaO5mryWRKA5v63Lzg=\"},\"SV-204458r241939_rule\",\"RHEL-07-020250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gzK9MUt7PjwGBJ/p/j6hcmkkkGmVE6qTD/BqPIvnN/E=\"},\"SV-204459r241939_rule\",\"RHEL-07-020260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BIJOSScjxtLqA/SKv6NkIB3IGMa3Q+LPB+L/geOe7ok=\"},\"SV-204460r241939_rule\",\"RHEL-07-020270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Xk8zYUvsnzovMiPLfQR6KgfXOkgeBn2KDtxaaMW0pGs=\"},\"SV-204461r241939_rule\",\"RHEL-07-020300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mmPdRsWMT1RXStEFvhbFi2NPQhPau7t1mLPRqSfrlso=\"},\"SV-204462r241939_rule\",\"RHEL-07-020310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MCpiixKAw6iysD7QdBwvf/0nHCrKyrAMLWQ4JNX0Bl4=\"},\"SV-204463r241939_rule\",\"RHEL-07-020320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PkSBdKqiF+1CoNw6WAjSOHw0QMu48lpgS7hmAFLNKw8=\"},\"SV-204464r241939_rule\",\"RHEL-07-020330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DgsJDDQVqbrezHTaPjQzaqTduH3lEoKAMNNMCRj803k=\"},\"SV-204465r241939_rule\",\"RHEL-07-020600\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nJKpEfqumuAlnJnurMfT8V8fSO3ydCuFSVHs1UY9GPo=\"},\"SV-204466r241939_rule\",\"RHEL-07-020610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KjHexj1LNSBP7CHmbNY3vvDc8KQeFRj4apAjjK7uRz8=\"},\"SV-204467r241939_rule\",\"RHEL-07-020620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IUowyh9fpAWNacEDCWcoW0ywTTeAFy1QJWtS37N3CvU=\"},\"SV-204468r241939_rule\",\"RHEL-07-020630\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RVZyk6n7GgpVN69UGZjh42yXz3qHC+E11xMgNQqKqeA=\"},\"SV-204469r241939_rule\",\"RHEL-07-020640\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4jt4mkKBzSe4CWKOCChBtcLEVdWyrxsrtYUDQqOWPb4=\"},\"SV-204470r241939_rule\",\"RHEL-07-020650\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AK8GPupR9o9w4Bpqm2vkAfSZfDDOTxHxIQYgJ4RNCtU=\"},\"SV-204471r241939_rule\",\"RHEL-07-020660\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CUecwNXz6GFSUPJZXW1ugeOxM+oEICWaiuiBIttVcmE=\"},\"SV-204472r241939_rule\",\"RHEL-07-020670\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v1B+Day0uLquC3G3rkAZLvKRlB/UsiRznWww8MhD2Ns=\"},\"SV-204473r241939_rule\",\"RHEL-07-020680\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uxK1tQMsGtXuIVRNHQgns3AeLuOfO8jy94kjoPQ2L+g=\"},\"SV-204474r241939_rule\",\"RHEL-07-020690\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uxK1tQMsGtXuIVRNHQgns3AeLuOfO8jy94kjoPQ2L+g=\"},\"SV-204475r241939_rule\",\"RHEL-07-020700\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vX6dN7EfNthdimlLaFh0Q9z6OmJUHbzovDHwg8c8NHU=\"},\"SV-204476r241939_rule\",\"RHEL-07-020710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nMN0kK1ic7h1eLInaM6SrG+c+t8cGPkmMerp3/LQra8=\"},\"SV-204477r241939_rule\",\"RHEL-07-020720\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Jjjq7xVAWflOe4CoFgZpUiv9Y1NWKcp73tzANZZz+gw=\"},\"SV-204478r241939_rule\",\"RHEL-07-020730\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:X06vDs2tR3QGoQ+xoPHCwRpZHEYU9e6HRZHfgAas1TE=\"},\"SV-204479r241939_rule\",\"RHEL-07-020900\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rTAfVwmsa16lr6s7L1HVMt53f8c4APqViMHCPG3PQ0c=\"},\"SV-204480r241939_rule\",\"RHEL-07-021000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oNIXrV8IrUz3LBKHcpc5OkB5AAV30a49EWBJw8tFGRI=\"},\"SV-204481r241939_rule\",\"RHEL-07-021010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:u7P2t9CBo4bVxiR7YZbGpIUx/LFmWm/tqN+oNRgHAME=\"},\"SV-204482r241939_rule\",\"RHEL-07-021020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bNGETuyi+t5ZcClrjc42GS9cWGj/6HLIX7UykCKyI9I=\"},\"SV-204483r241939_rule\",\"RHEL-07-021021\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+rITfa9uPWXKr2BTckVmwYe0uqE2Xqu4VJaGlyUb/tU=\"},\"SV-204484r241939_rule\",\"RHEL-07-021022\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c76gZ1SY4u9l79FnrsQHACwNc4CL62N+zPqo7zmpzkA=\"},\"SV-204485r241939_rule\",\"RHEL-07-021023\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+Cd2E8o4ONaUdrAAVpMr0bFQJFkRt9EDcw+xhFpcySU=\"},\"SV-204486r241939_rule\",\"RHEL-07-021024\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:68kXW4hDQ+wT9SdXi8wMj/sov4EvnCOjABVhUZDBnBo=\"},\"SV-204487r241939_rule\",\"RHEL-07-021030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1XgmUIRB6alinIiV63h8l4a4c+FpBsGbCgpB3sm/gQ4=\"},\"SV-204488r241939_rule\",\"RHEL-07-021040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MnVJuhcg4+npgMSzOK+ZI3jYbv9R79L3Pw0sG4OGjuY=\"},\"SV-204489r241939_rule\",\"RHEL-07-021100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hAE8/s/q+2bPxB0JEqCor5YiRwtPpCKQTpKO19s+CsE=\"},\"SV-204490r241939_rule\",\"RHEL-07-021110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2dsipNSSkkuhCPSuvfUEnxPPKLhEefb0wQ5pWOxGi1s=\"},\"SV-204491r241939_rule\",\"RHEL-07-021120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ouKxFOOPpBEfihfWTLMVhsHI14OUZyPa8UIIzq+9aDM=\"},\"SV-204492r241939_rule\",\"RHEL-07-021300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7PN7qrWKJmcvXiHYyWoVhaf0vMJwkBzlYvMLMqakubE=\"},\"SV-204493r241939_rule\",\"RHEL-07-021310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1cCc49bcm+M75v2YFAybr7leYSlE+gJkFfU7F/sl09M=\"},\"SV-204494r241939_rule\",\"RHEL-07-021320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XJvN48pmi8HAcsDkJM/G14Kd6I6pzdqyNmh7aTUWPog=\"},\"SV-204495r241939_rule\",\"RHEL-07-021330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:18y0TK+OVu1ckq6VVHACpujYOUOuHE9k0lnFU7vZePY=\"},\"SV-204496r241939_rule\",\"RHEL-07-021340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Eqvpa3O8L/43+F/dfd3RCBJOqej2+xWuUq9l9HGqyf8=\"},\"SV-204497r241939_rule\",\"RHEL-07-021350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gqquU+6877zdN2QBJVLYBJLAgY9YaeAMGXWhfOMdJDc=\"},\"SV-204498r241939_rule\",\"RHEL-07-021600\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BuBYuHuQAvXuOxcqP3DStX9B4QilMV8GArQJSwKL4qk=\"},\"SV-204499r241939_rule\",\"RHEL-07-021610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nqqG2GW71CBVy4Zbpx5pP8sJyDtQRHFZG9xO9W+fhaY=\"},\"SV-204500r241939_rule\",\"RHEL-07-021620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:APlAz7ZItAMZCPrk0PRupBAoTrM5Bx3+9xNBo4579+0=\"},\"SV-204501r241939_rule\",\"RHEL-07-021700\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cp2RMg6QxCqTvmqP37SKwG1FqsgipFxqR3t5FU4PXLk=\"},\"SV-204502r241939_rule\",\"RHEL-07-021710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Z7b6Mm6lUqwXG2sdLSsdV3B3gZr1qR0O9kZkWEmbxrM=\"},\"SV-204503r241939_rule\",\"RHEL-07-030000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qglSyMZMvG/rrLNnILUfVZ3YuFZFi5T6+KZGiWAdQ/A=\"},\"SV-204504r241939_rule\",\"RHEL-07-030010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GlCYNKZ4IKbMHrBwdJyaGeNDUtXvok0O5JQhengD9bI=\"},\"SV-204505r241939_rule\",\"RHEL-07-030200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BqnXskmzv0Fml5dUryA9empCvoF4uJVgP7gSzNJBG5Q=\"},\"SV-204506r241939_rule\",\"RHEL-07-030201\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:l+C+NK9AgsqOtIckjdTH4jH0PdnaS4ciKjpNRfQiUbQ=\"},\"SV-204507r241939_rule\",\"RHEL-07-030210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hcASCCaQ6DCZhsOVgtG2fCLYh13EpBUcl5ehg9PF3Js=\"},\"SV-204508r241939_rule\",\"RHEL-07-030211\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XkQ6DCdOAKS0GwAwhQplZEj8R1FV2bl5hQua4nPED4k=\"},\"SV-204509r241939_rule\",\"RHEL-07-030300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Bf2fWApv0APcqeZ5XF4R3RXo/goqg4pCstdRuIGQtss=\"},\"SV-204510r241939_rule\",\"RHEL-07-030310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:M4dQIiEBGtvfjwdGLgcnbZPAohqROn1I34DQD4YRp64=\"},\"SV-204511r241939_rule\",\"RHEL-07-030320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3wu6Xlq+C0xzTcZhVKXS6/ol6uXxhMPvS8I8O+1XaqI=\"},\"SV-204512r241939_rule\",\"RHEL-07-030321\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aflWrGGmEaadkYGyiV9fTBb/AxbzyQb2JEc+iSI+NkM=\"},\"SV-204513r241939_rule\",\"RHEL-07-030330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ltVAshO8pttoqEyqG6qijiNJqOl2Qg26et8YkE7jF5s=\"},\"SV-204514r241939_rule\",\"RHEL-07-030340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Uw4E5/qhIYn2a7XqoO/vCVOGSvxQjO5QMCJ7MHUh3po=\"},\"SV-204515r241939_rule\",\"RHEL-07-030350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pb9zyKyDrGizMm2SQJsP9iE6S0NT/TD/ykIFMramKTU=\"},\"SV-204516r241939_rule\",\"RHEL-07-030360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tfgd6xmJ2tetubGheG+rBYQusickUOomvWf+fpjbT7Q=\"},\"SV-204517r241939_rule\",\"RHEL-07-030370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IRTfp4gJecK//m5Q762/0oGsBdPOyjw0rySHurIS8LE=\"},\"SV-204518r241939_rule\",\"RHEL-07-030380\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c3BG+SR2o14aicE+yhq3PtQvfjs3cmTzFbE8tHrvpUA=\"},\"SV-204519r241939_rule\",\"RHEL-07-030390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2XtliP/rksJDS7Xvfpls8GPXpBFZoWsdnTomfRmL9QU=\"},\"SV-204520r241939_rule\",\"RHEL-07-030400\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NQ4XbflQ44GaE3zsieP8DlRi/3mPxweIdroLWHOE4Pg=\"},\"SV-204521r241939_rule\",\"RHEL-07-030410\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ct96QUF8s7jdqE0Ojh304JzeK8kmZYLbQaQReE84rXs=\"},\"SV-204522r241939_rule\",\"RHEL-07-030420\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rDncDz9FOlJO5zuVTZJbynkJ6dX2Vmq6oI6860tKW3g=\"},\"SV-204523r241939_rule\",\"RHEL-07-030430\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8tsf1iL2uCKUxO1hoNkCKyC3IFWiTzlQVJpKPEwK0QI=\"},\"SV-204524r241939_rule\",\"RHEL-07-030440\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SvFkHfPrdOQKr5ne1xqIFighaKbfQ/sihawpHb7p7rA=\"},\"SV-204525r241939_rule\",\"RHEL-07-030450\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xCC65vU4a0dx3uNjyFYVXGG1SRtdEiyjqGvJjghYeow=\"},\"SV-204526r241939_rule\",\"RHEL-07-030460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kE1xvX7cLhAoPe9cvYdrUdLUAfjE7eLXYem3Gw8DNLs=\"},\"SV-204527r241939_rule\",\"RHEL-07-030470\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vnSamAe2+/Hr+nfPkTqL9I0bWVmWTIFQpYfsqnVG9F8=\"},\"SV-204528r241939_rule\",\"RHEL-07-030480\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qHpyKM8i0QhH/xmWGRB3HGZ+olnqtUnASbAZecaifiM=\"},\"SV-204529r241939_rule\",\"RHEL-07-030490\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9kmHZoiuoiL6AsWMWz23RZbKzak8ErxyC7YO6g8muqE=\"},\"SV-204530r241939_rule\",\"RHEL-07-030500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QLmTItOwmEnfzdlxDbgeaEgT0GU0Nbb70w5rFh7+ClA=\"},\"SV-204531r241939_rule\",\"RHEL-07-030510\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/PZC/00fiKOLVTTaP7vTKSayzSFdhYJTeG7hNLk4+gE=\"},\"SV-204532r241939_rule\",\"RHEL-07-030520\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jhuvdlST3755aQuU9dw8itd/oBXZUB3VR1y2ygyl5FI=\"},\"SV-204533r241939_rule\",\"RHEL-07-030530\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tA45OvJ+kaPqzTLBG3AsIdZ+y1Fsg6ea5iZ7tEfE1dQ=\"},\"SV-204534r241939_rule\",\"RHEL-07-030540\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aAoxDRfMkHNrqAeotAp74gpKHv9wOXogrgjeQ7eJGQA=\"},\"SV-204535r241939_rule\",\"RHEL-07-030550\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yz9ySMXJdb86u8eDi3onAaj+kp672EFyUXztQ5ZavCQ=\"},\"SV-204536r241939_rule\",\"RHEL-07-030560\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:H82QTLuiCWDcZMXUpQQdTEKNJvGkX6x49d2pDZHpYyU=\"},\"SV-204537r241939_rule\",\"RHEL-07-030570\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ERmkPloadjyA5EWZSqAGmmsmSh9yhFCpxtM/g7u2MVY=\"},\"SV-204538r241939_rule\",\"RHEL-07-030580\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yWWSgcAdr7toWF3W2KVSsJEAivLZ/eCE17DkDnuxdnU=\"},\"SV-204539r241939_rule\",\"RHEL-07-030590\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YXNsFsD1BNTH+UuPUScRJc2/DURz1Fj+3uIcvrRMNdg=\"},\"SV-204540r241939_rule\",\"RHEL-07-030610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lJjp0a4I1yjr202W8rakaUjmlWknnhRtwWTbPOgaIB8=\"},\"SV-204541r241939_rule\",\"RHEL-07-030620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2qmfNcP9ypf8f5/1I1ZWKnvrnO4JwwU1bWjsI78D6KE=\"},\"SV-204542r241939_rule\",\"RHEL-07-030630\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gya/2JPlteqFjlFszdxnLFZfGW3EV7vQah2z8gDWTmo=\"},\"SV-204543r241939_rule\",\"RHEL-07-030640\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gi8ZMeceL+SSmRb14wgW06ZvRE7tuolGOXprwyUf+k0=\"},\"SV-204544r241939_rule\",\"RHEL-07-030650\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9sL5nx6+vlT67EKHKU4R5qqJ5n3moOZWw1AikH8pTXk=\"},\"SV-204545r241939_rule\",\"RHEL-07-030660\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gqtgtLcu9IdW8tgI/Z/PEk9biRBlGBOHv5LMDpPdpL4=\"},\"SV-204546r241939_rule\",\"RHEL-07-030670\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Yez5vz3QxFhKWn3gCF8yxjW5wBeRRzXNuSoPn6GIO0s=\"},\"SV-204547r241939_rule\",\"RHEL-07-030680\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hC1vcQxqT0u80KTFQPLu/SIk7krmukM+EtUTAUW4Q4A=\"},\"SV-204548r241939_rule\",\"RHEL-07-030690\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sTsM/uo7uY/03QywYVZf+XXWwPePPwd6hv1n+aUTiXo=\"},\"SV-204549r241939_rule\",\"RHEL-07-030700\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tU3v9z4QSrPw6soKYZKEo2o/9C6DfQXE4mmzVlVGsw8=\"},\"SV-204550r241939_rule\",\"RHEL-07-030710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:C0RoeHp6aYd9h/bi32FTCOUFtJwNd9lElDmsQIq+wF4=\"},\"SV-204551r241939_rule\",\"RHEL-07-030720\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pafqBQ37fC9z4g2ywAqLpjl+XAFqcgxwjjyxs/Verx4=\"},\"SV-204552r241939_rule\",\"RHEL-07-030740\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:caNUlUAL0QTWs82AAVnnqegh0qk/ScQg+zi9M6mXN3Q=\"},\"SV-204553r241939_rule\",\"RHEL-07-030750\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FS0w5y0Nv2J8GgXgjl0+kwNnGa1SOyKNV0kAzuc0Lhc=\"},\"SV-204554r241939_rule\",\"RHEL-07-030760\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dqcxu/FPpiMQY4drQDT3SVl/Op48vP4lYINaQ/7qycE=\"},\"SV-204555r241939_rule\",\"RHEL-07-030770\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mDysNGysefS+eTvNiUFriD9n8ubTJ8X27LObMHof9qM=\"},\"SV-204556r241939_rule\",\"RHEL-07-030780\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rEz96y1do/MI6pN7zRcF7HR19einFw1A4ikBHs19nzQ=\"},\"SV-204557r241939_rule\",\"RHEL-07-030800\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ady1u6dO6xtC3UnQhdVbuDv992JbS9UEl9bHXFlDfeU=\"},\"SV-204558r241939_rule\",\"RHEL-07-030810\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ktrDKQOFniBjtBla/5sCoFWD4QpBziBp6d3yNj4wSxc=\"},\"SV-204559r241939_rule\",\"RHEL-07-030819\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FKYTZs9Omb9gpZvDDN+VFtmbOEANwAA79jfnk0fdo+4=\"},\"SV-204560r241939_rule\",\"RHEL-07-030820\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DJ473QpyrOIOL4YWEvv/UhC/pdcGoEXF+NICnIw8kXE=\"},\"SV-204561r241939_rule\",\"RHEL-07-030821\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yaISAkFMNlE1gd40ss3E4raZaPutmNF5nUPZxy/dVxE=\"},\"SV-204562r241939_rule\",\"RHEL-07-030830\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oBDs5Z67EFgAVh+xQ4UWmvl8l68JaD3MlIWHxZV7Ivg=\"},\"SV-204563r241939_rule\",\"RHEL-07-030840\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yo+7DvmHZV8hyRCSWad1ZfWbs115vSFezvQEM11an2w=\"},\"SV-204564r241939_rule\",\"RHEL-07-030870\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XCeo82R8xQFLoiWbWwslLhkjyDvBriCPlnTPaVCU0O0=\"},\"SV-204565r241939_rule\",\"RHEL-07-030871\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mregkcdfFGH6lVk6ARZub4pIX77ZBmx54DG508a9aww=\"},\"SV-204566r241939_rule\",\"RHEL-07-030872\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lXRvTRQWN34A1q+mXN0yVv2AZrR0vT3Ts/aM1h5LkOo=\"},\"SV-204567r241939_rule\",\"RHEL-07-030873\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:688w5yaOgi6yS2MMu0BXElzK0Nc1j4e7a91fW45De2A=\"},\"SV-204568r241939_rule\",\"RHEL-07-030874\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:umcgNuAsnB59XSjy1I6U++dXqM23CWYChhlv86x8Xuw=\"},\"SV-204569r241939_rule\",\"RHEL-07-030880\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mE0MJl83yHmgx0kwKQuKZgNSsnJD2tRsSDRy+kJVHUo=\"},\"SV-204570r241939_rule\",\"RHEL-07-030890\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SvB0fmN1dM3PsEjEvg5vyZ0zWzSJPOTnbJAICsSPMMU=\"},\"SV-204571r241939_rule\",\"RHEL-07-030900\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DS0Fydb5T+qrwtZc8yHRMbt0kZVQKXZvEJkk2pfaoa0=\"},\"SV-204572r241939_rule\",\"RHEL-07-030910\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gQjaLKPqvRmJxPutSuCF2raYWv3G7pqqkl4RYi2CQjI=\"},\"SV-204573r241939_rule\",\"RHEL-07-030920\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:189mZdbWFnTmb/pv12S5jXM09zjsiaBRlTlxaxSpVrA=\"},\"SV-204574r241939_rule\",\"RHEL-07-031000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MwPcFaS7XSTh86tBjhVDJe6I76OH8QTJFy8ThExOTCg=\"},\"SV-204575r241939_rule\",\"RHEL-07-031010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9LhzdHuv/khleaS+BQu9ZlUcdjdohBUoq5bjuJZdhK8=\"},\"SV-214801r241939_rule\",\"RHEL-07-032000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DhilIZI4XItLrdeaFbC8ICZgBN1OCgHuPfD1k8e78sc=\"},\"SV-204576r241939_rule\",\"RHEL-07-040000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:O1hlu7Cy9bkTgUpdl/8swEZmVqrdSxecwRgqIv7TKeI=\"},\"SV-204577r241939_rule\",\"RHEL-07-040100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JDnnCT7i6KXIu1+6ypsCHBmdw6EQtsr4dSd3kFFR2B4=\"},\"SV-204578r241939_rule\",\"RHEL-07-040110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YGctoNEqGYp37D0V7f4JEnaQwZUWRJ16N85m3V1dTA4=\"},\"SV-204579r241939_rule\",\"RHEL-07-040160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kPgd3nZYx8oNc7jNrMPf7SaMkgI7Mpqc+C0Gesho7w0=\"},\"SV-204580r241939_rule\",\"RHEL-07-040170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gICjVQBlC2CyjSEDRHoAr3hm79aABc0TAYCd4cyGREM=\"},\"SV-204581r241939_rule\",\"RHEL-07-040180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IgR19ArnuG58zoGRs25ETsbszS2t2pU66+rmh1ALJZg=\"},\"SV-204582r241939_rule\",\"RHEL-07-040190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7XIsGNddY755GhU000GYrT04RXf5RlJxt9a8QpJOgWM=\"},\"SV-204583r241939_rule\",\"RHEL-07-040200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zNpBjI7gKD5CGJeHa0TgLmFXquRzktJOpNM1MitUcYA=\"},\"SV-204584r241939_rule\",\"RHEL-07-040201\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tu8dUs1zi+TVniquX91HB2mrznXWiYevRt36mw4oUc0=\"},\"SV-204585r241939_rule\",\"RHEL-07-040300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U0+kiCOWAxM37Dm2rN333KIvx6YqKjJfXh9Z8SO0Hw0=\"},\"SV-204586r241939_rule\",\"RHEL-07-040310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dkh4lOXziNuIqVk4eaOVLxaMcoWI12sofxv7jKQaw+8=\"},\"SV-204587r241939_rule\",\"RHEL-07-040320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KFrNyXlrwufl0fTSC2Xb2SJFGIHk5O3cfMQ8TP0OUcU=\"},\"SV-204588r241939_rule\",\"RHEL-07-040330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:s3HPGztH6jOvI74wiywU7WSmWcHTK8Aw+JzBeFJeV+o=\"},\"SV-204589r241939_rule\",\"RHEL-07-040340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4oJTyVwrO2R6TmqIF+bsE92/Eo5rArioW/qSFId8tfc=\"},\"SV-204590r241939_rule\",\"RHEL-07-040350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2znyQY3TQ9xKT6QoY0lQ8dx0S8AN67MOq5v/U8DLEh4=\"},\"SV-204591r241939_rule\",\"RHEL-07-040360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yX1X8uJ+vqpiTI1YneKPRT+wM/BMopO1gSTrMWwXbLY=\"},\"SV-204592r241939_rule\",\"RHEL-07-040370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XefiLkI57brJK6zs5DReGOyqdxXR/FR0JRYBWt4XivE=\"},\"SV-204593r241939_rule\",\"RHEL-07-040380\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0dqZel9WfGVpxO6OVdTQca14awO4upKlmd0SHcwofA8=\"},\"SV-204594r241939_rule\",\"RHEL-07-040390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xTLJjvdq15UZDw8G16bCt7+I8XiP/RxZCLmJQpOTmC0=\"},\"SV-204595r241939_rule\",\"RHEL-07-040400\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZrwBro/CqOpHuLOT920+WMMOrhs4KR7xtuVSg83ADyY=\"},\"SV-204596r241939_rule\",\"RHEL-07-040410\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h0blgpw29xSnpbeqXLAlK16DNURlD9WDnqL8KrTVoVg=\"},\"SV-204597r241939_rule\",\"RHEL-07-040420\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LuF6kqpOF9eNjNyaM7lVHX3f2Ce7dRDM7eZK2TV8w6Q=\"},\"SV-204598r241939_rule\",\"RHEL-07-040430\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:95XKdYxzx1qHEALj0vVcUgfFdzE+HDbKJn+kj2tRtCY=\"},\"SV-204599r241939_rule\",\"RHEL-07-040440\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XRT3D2vqhfiWwUMNKp1iT0NPdaECtsiOv+PkO9tvPIQ=\"},\"SV-204600r241939_rule\",\"RHEL-07-040450\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uaQWPHqYSfcx2Hsbsz6oSx3/NvJ2S9ZZWyR1AaamE3c=\"},\"SV-204601r241939_rule\",\"RHEL-07-040460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZEDgUUGRtYwtdg/7IGePmM+mO77jBmQ2y6qQSJnzh88=\"},\"SV-204602r241939_rule\",\"RHEL-07-040470\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vFy+LSYNEqK8q0jlqPSRN9R2KTNP4oH9DkTCn3+F6lU=\"},\"SV-204603r241939_rule\",\"RHEL-07-040500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cXVgQoJtqPP16H6INhLNMDk5sX6o5q6ee0+MombCLUE=\"},\"SV-204604r241939_rule\",\"RHEL-07-040520\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5AeStZQDNTFP8dyAN+kdFOwEHd7ujN7N8QOsth1BYFI=\"},\"SV-204605r241939_rule\",\"RHEL-07-040530\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2MW4CbQWQSdnWTn+vJjAqUXxy39KvlIkThmnSy/UnmI=\"},\"SV-204606r241939_rule\",\"RHEL-07-040540\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v4IA4z20DXRjhaVy+lPUHGEq1PKWrz2BRO+w5yuY2A4=\"},\"SV-204607r241939_rule\",\"RHEL-07-040550\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rZwRT3O4olP1cUbfaVWLtsV55GMO6FG1urqqL7Z5if0=\"},\"SV-204608r241939_rule\",\"RHEL-07-040600\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eQBkLoCxbhLSL0FSX13w71XInyURAJYddveh0zcMYZs=\"},\"SV-204609r241939_rule\",\"RHEL-07-040610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FwLT66vNGmWrFses/sAjJSSaKxtlj7doQb3MZgBImX8=\"},\"SV-204610r241939_rule\",\"RHEL-07-040611\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p1jUPBQZCsvZDLRRitg2VYMt2+J7ICQQdk58h8+Ceww=\"},\"SV-204611r241939_rule\",\"RHEL-07-040612\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cG2bpeEieasuM4Qt7PgAX0WNy3Jg+IohvlZC3bDIxnk=\"},\"SV-204612r241939_rule\",\"RHEL-07-040620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MRRtJ87d9codxHSiwiP6FQaDVF9nRZZKpZzZKdkt8tc=\"},\"SV-204613r241939_rule\",\"RHEL-07-040630\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8YTZ6fEoQgsCaCCADaJpdHZaoc+u9wlTzoxXW92DDXI=\"},\"SV-204614r241939_rule\",\"RHEL-07-040640\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/GqImo5AYk9oB6VesRt32EX9qhNxt0bsSwz/JfdpsTM=\"},\"SV-204615r241939_rule\",\"RHEL-07-040641\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rajjUFaPBiT4Sd2KHjdKE74EwKfpgWlkjrCk3HupPOg=\"},\"SV-204616r241939_rule\",\"RHEL-07-040650\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eI/kCnLWasuxYrqINFrqYvnYRusBETB3PyweSidvuS0=\"},\"SV-204617r241939_rule\",\"RHEL-07-040660\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ehZyYb58GoVTgK7yVpGqpPJBA7NKrWkkjvGCe4/cHMw=\"},\"SV-204618r241939_rule\",\"RHEL-07-040670\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6FOjMjnPE6o/2RQfLIQ7oCu1NiuJoXu8ZloEh6aQnOc=\"},\"SV-204619r241939_rule\",\"RHEL-07-040680\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GYLgPoC9dWO6EQnX8n402yDsuMPAnK9fUZjDeNJuVlQ=\"},\"SV-204620r241939_rule\",\"RHEL-07-040690\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bjTPHU4AZoK6BfgfQVubbfWkNDK50eujmcmoDTDukmw=\"},\"SV-204621r241939_rule\",\"RHEL-07-040700\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N0HT3nvX0nacPF0nic2Fvo+QoxFewqWUvw8Cb2dpdyE=\"},\"SV-204622r241939_rule\",\"RHEL-07-040710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BQENP4a828YEZSXVXQtFoPetmYEFb8+83NfUr43aZ74=\"},\"SV-204623r241939_rule\",\"RHEL-07-040720\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nW951brbjAkAlDNfMZI++v9EZTA23qYKprHAkBSWFUY=\"},\"SV-204624r241939_rule\",\"RHEL-07-040730\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ng0nTd+F1YUu4CUZtk3DYlhWROBAoM4ie5InHAQthN4=\"},\"SV-204625r241939_rule\",\"RHEL-07-040740\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MkXnVi+BfZNKD8HBi1BdRhBwQYqAqk37hdGW0wzHsBo=\"},\"SV-204626r241939_rule\",\"RHEL-07-040750\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LPkkcM3GKLloG2iIqGS//40g7fdb9hulnGjTO5OPl/c=\"},\"SV-204627r241939_rule\",\"RHEL-07-040800\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aj2+q1FDm7tuIsdCJ6yjAVx2dNimOetQj7BToo/VlEg=\"},\"SV-204628r241939_rule\",\"RHEL-07-040810\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kkwHgTSKsJctRdFnhk7oBugs+k0hSvrAHTNBODYlnRY=\"},\"SV-204629r241939_rule\",\"RHEL-07-040820\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A4M7YDCBxwn82FM8E2pYn9DdV8RWXiiwlGjESBKWFWc=\"},\"SV-204630r241939_rule\",\"RHEL-07-040830\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:duPPEkYg4Z6hIj9Yd6lOp0gvtSraIDw+nJz6zxmFvqE=\"},\"SV-204631r241939_rule\",\"RHEL-07-041001\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:C1LYFgaAqeuTh7Gtm38t3OcPVMq8CySBTILHzdSksbQ=\"},\"SV-204632r241939_rule\",\"RHEL-07-041002\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:o86wCHVnLXklbvao4gX06PkNKLM2n2dr61EHb3iOGuE=\"},\"SV-204633r241939_rule\",\"RHEL-07-041003\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2hPpDflNaMEbweY8kZ9GeMsYvJyW3OYECrRyUBb7WFU=\"},\"SV-204634r241939_rule\",\"RHEL-07-041010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"SV-106179r1_xxxx\",\"SRG-NET-000019-VPN-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"SV-106179r1_zzzzzz\",\"SRG-NET-000019-VPN-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"SV-106179r1_rule\",\"SRG-NET-000019-VPN-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"SV-106181r1_xxxx\",\"SRG-NET-000041-VPN-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:slm2UFIqnUUPyOpfIcsxSew4LGvsTesU9C6Ju5XJ3mw=\"},\"SV-106181r1_rule\",\"SRG-NET-000041-VPN-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jc6QW12gqdTKEPqvls4bilVyDJExcCoSskTVyO0VtC8=\"},\"SV-106183r1_rule\",\"SRG-NET-000042-VPN-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4cT/S3JRnRG1/bjkxCCl0FvJ2jFBPQxR6xd/ho3iPwU=\"},\"SV-106185r1_rule\",\"SRG-NET-000043-VPN-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IdemsTDQGwPd7bokQxIIvpGCFpuH2a0LMkx43UGqWUA=\"},\"SV-106187r1_rule\",\"SRG-NET-000049-VPN-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aVWTWelue2vPX4PPQhsVdenoG0JoZrePs1txZu8Tn9w=\"},\"SV-106189r1_rule\",\"SRG-NET-000053-VPN-000170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CyTJHLIKQ2Ojkg9rwcZ3x7T66VHLzHB54n+nmQfac2E=\"},\"SV-106191r1_rule\",\"SRG-NET-000062-VPN-000200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b0U2i/2oFdeOwmGlTBap86LUQ1gHdfQ3eL4us+64fpw=\"},\"SV-106193r1_rule\",\"SRG-NET-000063-VPN-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v3WpQRoQigeTzLi65BYsrw9t+ZEEROlTq1kxXFTTLlc=\"},\"SV-106195r1_rule\",\"SRG-NET-000063-VPN-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+B3+7JmTL1p1pvXgkAa8wGoCkVHYXHjICDWeklY1MTk=\"},\"SV-106197r1_rule\",\"SRG-NET-000074-VPN-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5JYnVzed7VNQLssmYLnmi+secKLvHnAiNpVnw5LnOy0=\"},\"SV-106363r1_rule\",\"SRG-NET-000075-VPN-000260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YlctilOwQ2MBW7zoqYuhAoiJN5c5NYVKUMH7L8KW2VE=\"},\"SV-106199r1_rule\",\"SRG-NET-000077-VPN-000280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HGobFrLp43KBzaBeaBiQba6hjKEcpQn11VJTJJwwmMo=\"},\"SV-106201r1_rule\",\"SRG-NET-000078-VPN-000290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:P/zyghBUSYmw8eYcF6kqAgE8TeMANzSroGoCNq9DxmU=\"},\"SV-106203r1_rule\",\"SRG-NET-000079-VPN-000300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/9F2orQ7S4UyHUeIF5MNwyf2YqTtEcZKOu6Lyy3dl0w=\"},\"SV-106205r1_rule\",\"SRG-NET-000088-VPN-000310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TBiXTAY2X10uilSJ/Zo764Ce7gxa+BC604igCvR21Ys=\"},\"SV-106207r1_rule\",\"SRG-NET-000089-VPN-000330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2+gLZEUpQFGiiXTLj5vTvPMeNuYVSesoUBq5osjiwyA=\"},\"SV-106209r1_rule\",\"SRG-NET-000091-VPN-000350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mi17ibh62O4cda5bcRUSENaNZI+A+wHMQdsAhZaeELQ=\"},\"SV-106211r1_rule\",\"SRG-NET-000098-VPN-000370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xx7dyKjP3tr449DemD15SwuRdkEieFRE1AhuT429Hbk=\"},\"SV-106213r1_rule\",\"SRG-NET-000099-VPN-000380\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LurVSxZqQlUG4THAxXLsYwtoOIQkH9C5vFm75lhPk+M=\"},\"SV-106215r1_rule\",\"SRG-NET-000100-VPN-000390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:R+x0KRiQIKJIbqWDk9OWXOHA/tx5c83O7HSpjbaqItQ=\"},\"SV-106217r1_rule\",\"SRG-NET-000132-VPN-000450\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6xznw8iyFeJRJwk1JYCPRsiNwv5VE1E6oPOibHnQepY=\"},\"SV-106219r1_rule\",\"SRG-NET-000132-VPN-000460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U9u5kkzq19uYYwdfbvK93u00swz2+lLKN/KXYD1SLPM=\"},\"SV-106221r1_rule\",\"SRG-NET-000132-VPN-000470\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qL67vWiduAPXEoBZfFyKtQr8Xx5q0lifYoN8/VKeiXk=\"},\"SV-106223r1_rule\",\"SRG-NET-000132-VPN-000480\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mmyK/9p+kkBzjw391gSBn/5JwQ6rUWRXc0i0deZcJlY=\"},\"SV-106225r1_rule\",\"SRG-NET-000138-VPN-000490\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D7dgt3RnYA25LvMASqDp9YTrG7KfSDck59y/cwVd1j4=\"},\"SV-106227r1_rule\",\"SRG-NET-000140-VPN-000500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KKZUM28vxti/o8G6lxUgCF8Wx8ura3+B1TExgJuWCGA=\"},\"SV-106229r1_rule\",\"SRG-NET-000145-VPN-000510\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:koWH1S5xZuAZ4H9vnFXHr/qz4c6UDJH7P29FdfhEPZg=\"},\"SV-106231r1_rule\",\"SRG-NET-000147-VPN-000520\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:53vjl7nhxJZkAmPcXBfrWgxe2N8vSeOA4P5KeOUv1cA=\"},\"SV-106233r1_rule\",\"SRG-NET-000147-VPN-000530\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PQvyQqpQfxH4QYcuFED9dQWGmLZ5NjYVdg+5ViJyzMc=\"},\"SV-106235r1_rule\",\"SRG-NET-000148-VPN-000540\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v5/IfNoYuNBZdJW3TnihRjv14rrPD9SLxquxNn9HMf0=\"},\"SV-106237r1_rule\",\"SRG-NET-000164-VPN-000560\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4L7fYYyaq26bvadPv3JCcQ3yEjurb6JgRmYQ/U0UV1c=\"},\"SV-106239r1_rule\",\"SRG-NET-000165-VPN-000570\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ar3GvJuXEKD4A/Af2IozOGlLJBjfNqRbiW1i8k/7Y9g=\"},\"SV-106241r1_rule\",\"SRG-NET-000166-VPN-000580\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:f0b/RYI3SCPeEqjHsb3psBWUdGRTKfgqRrq51hB7yfE=\"},\"SV-106251r1_rule\",\"SRG-NET-000166-VPN-000590\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MRKxPi/bbsDz8wNN9vXmb7hhgMU8M3+JU6oyqsrMnZk=\"},\"SV-106253r1_rule\",\"SRG-NET-000168-VPN-000600\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:L26csqRjhPU0fgblV8qX1BlmvtAHZjw4Yyp+bb0mDKw=\"},\"SV-106255r1_rule\",\"SRG-NET-000169-VPN-000610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OyTG982E0CMxr4y2rmBaYCCpTY7srBWAv/cZQUt/Y+w=\"},\"SV-106257r1_rule\",\"SRG-NET-000205-VPN-000710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lOVVOo0oYWR1BZZb2TwnHXMbM18YttAN6G4GrHPWbyw=\"},\"SV-106259r1_rule\",\"SRG-NET-000213-VPN-000720\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZitF7N9m7tBrFLBSFvvFyer2Cj1EN7TGddhFoon9a2g=\"},\"SV-106261r1_rule\",\"SRG-NET-000230-VPN-000770\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uJQ31o/f/Vqkllw6K1glewYI9Xlo0bRZIER2AGlLICw=\"},\"SV-106263r1_rule\",\"SRG-NET-000230-VPN-000780\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KPLBOeYMBZIxBbaWyihbjnI+iXUnrab0mkIE2hzbTk8=\"},\"SV-106265r1_rule\",\"SRG-NET-000231-VPN-000790\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p+iB5XlL+If6inJuLfQ+r3VNT86JXC5NhnV2vOeozxg=\"},\"SV-106267r1_rule\",\"SRG-NET-000233-VPN-000800\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ktJIe/Y+HEIOo7bAwQCz3X/2hQkiqoTyl8BVpkZpHYk=\"},\"SV-106269r1_rule\",\"SRG-NET-000234-VPN-000810\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D9gD2h3b8ZDEWmQokEZllnWlmTLY7M//Hjdn7DqBOf8=\"},\"SV-106271r1_rule\",\"SRG-NET-000235-VPN-000820\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:72eP2Vo/dCHVQ+6f/2RQyYnBi119Hq+RWYm1m2WqoLc=\"},\"SV-106273r1_rule\",\"SRG-NET-000313-VPN-001050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:w9yL+z+t1qYSt9kk+sxVflN/xG/naaJ9QP4VRCcqw6Q=\"},\"SV-106275r1_rule\",\"SRG-NET-000314-VPN-001060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:afNm41YNd2Z2QwHOtNNm/ZsgKpPtQhY3FaPrGqRWnTw=\"},\"SV-106277r1_rule\",\"SRG-NET-000317-VPN-001090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:n4616xCQqSEJ5LDbI/BvogDwAhTFLCqs6qsCNm2y6qM=\"},\"SV-106279r1_rule\",\"SRG-NET-000320-VPN-001120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qrumTMQiLLqavZ4GBAcbIfp6Kibky5yDpODJYsUNU6k=\"},\"SV-106281r1_rule\",\"SRG-NET-000330-VPN-001220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bzo/kYUviBi8fH0VVF4kMJsdAnZOcFeOl3REDgnED8o=\"},\"SV-106283r1_rule\",\"SRG-NET-000333-VPN-001250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cvSX2fNtb/9d5KoCFv38r/vk1P66QvbknutRPO++RHQ=\"},\"SV-106285r1_rule\",\"SRG-NET-000334-VPN-001260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rpLsrhPbwk1f+JYoA5pOhGpi71+wEYHZA7WhvDHOZ+M=\"},\"SV-106287r1_rule\",\"SRG-NET-000335-VPN-001270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lKiTDkfAGyG9SqJoJw3IBMHEt9m1XfYEXjJcJ6N2O4I=\"},\"SV-106289r1_rule\",\"SRG-NET-000336-VPN-001280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fVzjNA9x7fe7XKuKOy79M7wLwKGgdGCnV3TChwORocM=\"},\"SV-106291r1_rule\",\"SRG-NET-000337-VPN-001290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yIMWyLqQ5KjJhVIE0sO7kOy3MFZ/mr8G1UsF2vpFezs=\"},\"SV-106293r1_rule\",\"SRG-NET-000337-VPN-001300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3Vk1c0ULGwB+JNxtAcJe82imefTrQUiXMXW0gSoV5sI=\"},\"SV-106295r1_rule\",\"SRG-NET-000341-VPN-001350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U2xkrpdDd5fbE89oPVhqhnurz+BzWOL7MBkXI3iyc44=\"},\"SV-106297r1_rule\",\"SRG-NET-000342-VPN-001360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tY5W3SOCbPKTMPPTVFP0FpXqFdrxc15JZY9C5N1Jp3E=\"},\"SV-106315r1_rule\",\"SRG-NET-000343-VPN-001370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bVroOwdA0e1yfLelH5K0/LjEPzRuPTDt+xgTDMzMsWA=\"},\"SV-106317r1_rule\",\"SRG-NET-000352-VPN-001460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1maPMRSAJQc9CCcE9i3+e/pBNygIhmu9m1GajIh4WrA=\"},\"SV-106319r1_rule\",\"SRG-NET-000369-VPN-001620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:W5E6fpSFPSjZsDhRm6JBdbhvWCdb4iIQ29kz4GWDM20=\"},\"SV-106321r1_rule\",\"SRG-NET-000371-VPN-001640\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rqcFP9ktgfb343ahB5Mv16lTwTPf1/ELOUg9C3CgAj8=\"},\"SV-106323r1_rule\",\"SRG-NET-000371-VPN-001650\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+vnSRs+ZokA+P5inP7i24jyzDoJ+8dRGwCZAF72bzfw=\"},\"SV-106325r1_rule\",\"SRG-NET-000375-VPN-001690\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fU8zq6dLn1EHMKbL2KwqzdBun1CXedlYFT1NSzY5Zw0=\"},\"SV-106327r1_rule\",\"SRG-NET-000400-VPN-001940\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GOcfn7YCnFViHL4Sv9yLScid+jFSlnVek7L1omc1Mjw=\"},\"SV-106329r1_rule\",\"SRG-NET-000492-VPN-001980\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D0/SC7O2V3JZ4+Sewx7Qn6Z7ZSrkdje8orXuKxcEjpo=\"},\"SV-106331r1_rule\",\"SRG-NET-000510-VPN-002160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GNvczQqQ8RSDNiGZgHykTH9Fl/06XwpsXibtlkPH4AM=\"},\"SV-106333r1_rule\",\"SRG-NET-000510-VPN-002170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nrioFfQyWAyHyqPYTDE2+pXaDoeycQE/PjC2vrEL9Jo=\"},\"SV-106335r1_rule\",\"SRG-NET-000510-VPN-002180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hDgoEHbOPyCRLlTAZ0Qqx1kkok77I93P01NwpDJNEE8=\"},\"SV-106337r1_rule\",\"SRG-NET-000512-VPN-002220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IzzOyrG05CKpFAWFrkEoNJ5rxjb3elkLNtjevgCQdtw=\"},\"SV-106339r1_rule\",\"SRG-NET-000512-VPN-002230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GrHgK/pBnHrsn1Seh0qJujIqrWqRLPE0eaA+ZAqQMjo=\"},\"SV-106341r1_rule\",\"SRG-NET-000518-VPN-002280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+WzKvuFJw2Hd2tINf3CAdDXjeroLc9pIuZQ8rxqAqW8=\"},\"SV-106343r1_rule\",\"SRG-NET-000519-VPN-002290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WFTjVjonYKh95+ufS3SeRtMzKzxvcuYhkuGqLkDzAdQ=\"},\"SV-106345r1_rule\",\"SRG-NET-000522-VPN-002320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WvHtCxF8aHRpizWQnHhcRWZ2GSo4LpYF4C+7vAKUMGY=\"},\"SV-106347r1_rule\",\"SRG-NET-000525-VPN-002330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hK46dRZBIlXNdxH/0rgMhBXqrBF8nwMTFp1UUvsZ2/w=\"},\"SV-106349r1_rule\",\"SRG-NET-000530-VPN-002340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Oyy/mFzHcQy1sAgTQ9gS+b99/s9IcmH4xTl+n0Pf6Rw=\"},\"SV-106351r1_rule\",\"SRG-NET-000540-VPN-002350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0WoWCtzpWtYJ2vxCT7vXvLruiskYzBOwEVdaxJWlGbM=\"},\"SV-106353r1_rule\",\"SRG-NET-000550-VPN-002360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RFq+xtylI0rdth+CO8xXpnUCA7eBYGNXjStRxU/Sh2g=\"},\"SV-106355r1_rule\",\"SRG-NET-000565-VPN-002390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p7UCHJrDUnFC2jp6mXGtSAilZeT3BjF1NVmG5ykWcy4=\"},\"SV-106357r1_rule\",\"SRG-NET-000565-VPN-002400\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F8wZynyPCZXbSCQKsDAa3RDhSkunUmMAhgYUP9Yu014=\"},\"SV-106359r1_rule\",\"SRG-NET-000580-VPN-002410\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WOsWkwp7rHKriDcEPQi1g0VQp3X0XA14Kw+soZYNvnw=\"},\"SV-106361r1_rule\",\"SRG-NET-000585-VPN-002420\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vchgPhpapNXqH1070giShdvTrztio49eNJBWV74F3HU=\"},\"SV-77809r3_rule\",\"WN10-00-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LSSb1gLDf7uiXzn44Bg4EplFPsBwaprDmRrselWEvyE=\"},\"SV-77813r6_rule\",\"WN10-00-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:G++c76EF2dug3yxJ1mWjWuE/wznHG9SVXyS+eCsoMKE=\"},\"SV-91779r3_rule\",\"WN10-00-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:UyAIBRFH+PIeD9UnW2uuScJwGHi1TzbEGDoaMPRL1nM=\"},\"SV-91781r2_rule\",\"WN10-00-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HCOGZgkq+yjHfU54mGFmUULh8th2DmZrWdDxdOWGa1I=\"},\"SV-77833r2_rule\",\"WN10-00-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WJmapvaFU3fBFpTg+ufcMx2LC53rImDSpxqCEpTRTeE=\"},\"SV-77827r5_rule\",\"WN10-00-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hSVsi+qUuuUyVINtO7WeONuyh47CyGSc32+FLd4Ul1Q=\"},\"SV-104689r1_rule\",\"WN10-00-000031\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SIUT9VltMgIdU+iQ11p1JXZ1wRhtZVpC4mS/QVMSxf0=\"},\"SV-104691r2_rule\",\"WN10-00-000032\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qqusfdR/p7eKP2jELMMeLdSrRy4vsHPTO1wfCg44MTA=\"},\"SV-77835r3_rule\",\"WN10-00-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:or6yezNX5dbJzbcRUwG9A6vn2Nwe1/eA0vaJqpY6LqY=\"},\"SV-77839r11_rule\",\"WN10-00-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9LhzdHuv/khleaS+BQu9ZlUcdjdohBUoq5bjuJZdhK8=\"},\"SV-77841r4_rule\",\"WN10-00-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jyG27jY3W9Aj4bDrKfA/dk1GvzTU+D+IeEpDzIASblA=\"},\"SV-77843r2_rule\",\"WN10-00-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gGc0LjWq95X1V62ZlIHcMLmkQPw2oUyILFgDEIeCFgc=\"},\"SV-77845r1_rule\",\"WN10-00-000055\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dOGGLjicLHA/RGjJYYBp+48oN0T8aKpZdwp8uPV5/Ic=\"},\"SV-77847r1_rule\",\"WN10-00-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:O7e8OfTlyzjmCELOYfMlW3c1bFSd2cM7R7YSkTfN3OA=\"},\"SV-77849r1_rule\",\"WN10-00-000065\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8UtBp2DVYD1LJb6gnT+x7kAd1QHqhk+0hwQmESyWDy8=\"},\"SV-77851r2_rule\",\"WN10-00-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OHRlA26i4Hoz3B5fPGaNDpMcdjxDEW48a+7+FxI491c=\"},\"SV-77853r1_rule\",\"WN10-00-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KQ8lRy8FDBQ4580tUO1vy4jkMlou6sCG5kmgRB26zTA=\"},\"SV-77855r3_rule\",\"WN10-00-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bUQ3g8z8lvNafFtEoebv7L8OC/vCz5bDJEA+19YUMfY=\"},\"SV-77857r2_rule\",\"WN10-00-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MaaeK83VUHrwbWkTbzyV8UO0uqMO9TDhxJaX5AYk0dg=\"},\"SV-77861r1_rule\",\"WN10-00-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nU7vAsnPVGyMIHLfdjvPC2Bq5ULx/4Moe5DQgjWZP+E=\"},\"SV-77863r2_rule\",\"WN10-00-000095\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PQtPLZt9kjWgPV2hRYy2GI3OB/Iw5D032IDo7oY5zKw=\"},\"SV-77867r1_rule\",\"WN10-00-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TRPtutJnGn43Yj6o6o250dQEb4BOKYZixgC8OVRcNIo=\"},\"SV-77871r1_rule\",\"WN10-00-000105\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YwindgjytVWnrAw7yMnV/6hfzMIONOOroZJQi53YVkg=\"},\"SV-77873r1_rule\",\"WN10-00-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7Tr9YNXYybZpCvPg9E2lPUrKLG7+7N1se4RCmhXyPzE=\"},\"SV-77875r1_rule\",\"WN10-00-000115\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IYTubfVbsZBz/2eFUf+4u7kuvTO77HcoVONuJRZJyzw=\"},\"SV-77879r1_rule\",\"WN10-00-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:B/OnPBA2G41jIXn2STFlRDpkMuzALJv21OFtakZOH9Y=\"},\"SV-77883r2_rule\",\"WN10-00-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fz8dkAgamwTuH5yyEwnl11W4wiTXnoygvOnaEaNj80A=\"},\"SV-77889r1_rule\",\"WN10-00-000135\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wkHOfqgUvzr6nhiu0W8JznAIxTY88dEtZD1HETyM13Y=\"},\"SV-77893r2_rule\",\"WN10-00-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:95Wge0r7A1nMcqH3gMcG1tsaCxT6bDaub3VeK5nHEcY=\"},\"SV-83439r2_rule\",\"WN10-00-000145\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7XgAgPXMwnWi7uSIC/fqd46LXQjEefiQggfQCfHL7K8=\"},\"SV-83445r4_rule\",\"WN10-00-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8QaHQQT2a/xX1mHR9JZYds+zZe9VKc6wZnVv2nVWTwg=\"},\"SV-85259r2_rule\",\"WN10-00-000155\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LoHFxrEqFXMSEB8aLzNbxWm1sZAEoJAELFfMvbeXJWA=\"},\"SV-85261r2_rule\",\"WN10-00-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AcIhp89UhB4v65rG4+1OlkrKzpAPGx+nVXwXtWlRxtw=\"},\"SV-89397r1_rule\",\"WN10-00-000165\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bH2zYG4O8rv2T9lCQ0x5K3UStABQyU0MGrR7XdmZxm4=\"},\"SV-89399r1_rule\",\"WN10-00-000170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kmONnQi8hUqCu/WJgM8CHWQrxsQLtOxhWR7c6bEt12Y=\"},\"SV-89393r2_rule\",\"WN10-00-000175\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2j27+jG0GZFs6PCwCbPpklgetUgKU7XZetxNDvK30ho=\"},\"SV-91201r1_rule\",\"WN10-00-000190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QUy5rMKrmSVFuZRi8lijI352v840T0gzGD5qak7wNbk=\"},\"SV-87403r1_rule\",\"WN10-00-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OLU1Ki32nfmwHE1geqvJmNi7m2t/bTSrs5FI1qvvg5o=\"},\"SV-87405r1_rule\",\"WN10-00-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VC4MssCw0YPNf5Ku7vwfsCk462cMswOvsMCGoxhRGaU=\"},\"SV-87407r2_rule\",\"WN10-00-000230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:99vRhcTZ40z21olaz2KCAKJlYMIhAMYv5z3B0U4Tt7E=\"},\"SV-92835r1_rule\",\"WN10-00-000240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HTJfh6HdzWTnnVR96iuoJZ0PnIvio+5FoDwpQDtzoTk=\"},\"SV-111557r1_rule\",\"WN10-00-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:iZIWtAKLFv0mnxWoPykNAd+yxoNoNuOAn/rsuRkGkBw=\"},\"SV-77895r2_rule\",\"WN10-AC-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IeyN47N358ORV6Naa7eZ9JrcWdBvGlkKd07eHuOVVhQ=\"},\"SV-77899r1_rule\",\"WN10-AC-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:14aXfEafYKcgX8JWb5u3N/8DD5cx/FDR9uuxUhwPlSE=\"},\"SV-77903r1_rule\",\"WN10-AC-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:o8VKo4BFEQi8vohXvm9npwy451RfLEpCEbuLlXnX9P4=\"},\"SV-77905r2_rule\",\"WN10-AC-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OOSpmvJlTsCD444uc+1xJVXu6qS4JR7e8tmYahCVG9Q=\"},\"SV-77909r1_rule\",\"WN10-AC-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rtkmX+JYKFPLvLYlRGgdiaDWULPSxr3ntwT4Qq5G0gE=\"},\"SV-77911r1_rule\",\"WN10-AC-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gADtcufL0rvkhSygty7DNDG6rjm7eHO0Y8vlxc/cJOw=\"},\"SV-77913r1_rule\",\"WN10-AC-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9N++lDyFOQnR8saWfC585SvXvrRukpsO+VUybL0SJ3I=\"},\"SV-77917r1_rule\",\"WN10-AC-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YJ3a9bdA7M956htDthFs6pM+dAbD3AcqGyWDkl4iTa4=\"},\"SV-77919r1_rule\",\"WN10-AC-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sDp/d6cGeheQPSyDdqeABiqG2UKTGaaxfw8wIcMeQHs=\"},\"SV-77921r1_rule\",\"WN10-AU-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U2zZ7WbIs6xdLIKg5f+SK3W4lP14JKnsnLrhnXtzY8A=\"},\"SV-77925r1_rule\",\"WN10-AU-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Wm8Z9go4ijvi1hXPZNlNfvaEeTTCHlNCHL0r4Y+YBog=\"},\"SV-77935r1_rule\",\"WN10-AU-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3K8Cr0W8KyJySAjHnIKhBoSL7BMlQwmSIgNxt27SU90=\"},\"SV-77937r1_rule\",\"WN10-AU-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hFq/VN5iy8nq4TtmL91tbvNef3uqC1tTzH5qxWfTUFY=\"},\"SV-77939r1_rule\",\"WN10-AU-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6OLuCTq6MxuisuBFoZTFhVa37PfJJ79XxKFbZyUXh0w=\"},\"SV-77941r1_rule\",\"WN10-AU-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TRV0JYavJNEISA42NPNpnVnUp5myoEbm7eqpR1DJJFo=\"},\"SV-77943r1_rule\",\"WN10-AU-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VfJcv2oibH4fO+7O/16d0DnpaUWHMb9vOGAlg65RKTw=\"},\"SV-86383r2_rule\",\"WN10-AU-000054\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BvILRXAXQabjIlzA8GIEo277mORYvfi8NWsVMyjd+bs=\"},\"SV-77947r2_rule\",\"WN10-AU-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2DObiHB1tJi8nMxl9dgsi2/LMp3YdlL60aFyLwFw3R4=\"},\"SV-77951r1_rule\",\"WN10-AU-000065\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:V/vAvDNZ6xrqpdV/w1nyyY3RzAUSErMEtiv1Xc/qROg=\"},\"SV-77953r1_rule\",\"WN10-AU-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BE/T6AoSLhPnWZOeS6illZZoNnn6TQQMBBvTmt+LfNg=\"},\"SV-77957r1_rule\",\"WN10-AU-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HwmQqAec5Zb6el866c2comWk7ZfJ+ixTZEXIw7pzUOU=\"},\"SV-77959r1_rule\",\"WN10-AU-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pP6wExXu7hx0kSxYXKfJVrzTaRizYrfD1RMLqHWYrFY=\"},\"SV-89701r1_rule\",\"WN10-AU-000081\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJq3SMQlkiH7VSnlxXWdCkxlPWIUUAHF7pAJRBLRDOU=\"},\"SV-89395r1_rule\",\"WN10-AU-000082\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+dPx0n8JfTUXKdPsMAw42NTXs2lAb7HwDFC8m/Frthk=\"},\"SV-89085r1_rule\",\"WN10-AU-000083\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hktzVHG38mzOhb1tNzgXaCky+9tk/sTzqf2ayzkUh0A=\"},\"SV-89083r1_rule\",\"WN10-AU-000084\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1acXIWzqEYhMqmAFLJ2OFPWy5wyiClFRK0blgMdIxBY=\"},\"SV-77961r2_rule\",\"WN10-AU-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LGJqueVXVNwDFVXUpGxRZQ4Wny/BOBHeceC7sx3PXzs=\"},\"SV-77963r2_rule\",\"WN10-AU-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I1vZMy69tT8kq1UjsGKufBSv8WZnqduCw713X+syDqw=\"},\"SV-77969r2_rule\",\"WN10-AU-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:W/aNcLuy+E+akBMmzfflre1wQ9pk0xdJKZ8MsmhQgJg=\"},\"SV-77971r1_rule\",\"WN10-AU-000105\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:spd2YfnamQST1NlVqvAqNOfFgfZkdothjKXNWgXmfX8=\"},\"SV-86385r1_rule\",\"WN10-AU-000107\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uK/4Mc8psjVa5hc9xcQ/VvM1L3p/Z2PR5oXrXVdT3AA=\"},\"SV-77973r1_rule\",\"WN10-AU-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ub+bzRw9nK5FMqhg0cvtHTPXc0ZoY14WwJJpfePsTU0=\"},\"SV-77977r1_rule\",\"WN10-AU-000115\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pI4rSYXdO2I17sVUgVGEC9waoXmSE152j9vxVgdtn58=\"},\"SV-77981r1_rule\",\"WN10-AU-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XjzZBXSARGyTD/PfUuDeFm28fIvcIV4qygTV08sLVKo=\"},\"SV-77989r2_rule\",\"WN10-AU-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:t6WHp+ZUHBml263lvCguGrlkMzldPXsFEy5VNUVNBrI=\"},\"SV-77993r2_rule\",\"WN10-AU-000135\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Er5CsYJ2r9pG46ajyyQ8LR2k5mWoAMurGm8u9Uh/Iuw=\"},\"SV-77997r1_rule\",\"WN10-AU-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WuYFQVOva2y1AbhfejrStyjDyv4BFq3G2voT7JCBA8Y=\"},\"SV-78003r1_rule\",\"WN10-AU-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xgvxweAhj8P+1t428K3s8SDMbeLf2/MINiEDTjiVtRk=\"},\"SV-78005r1_rule\",\"WN10-AU-000155\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:liPGtSRilvM45JUUHGb3NoDoAKAmonqQZH/MaCqLC/s=\"},\"SV-78007r1_rule\",\"WN10-AU-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DyO6WQCEJJlinj5BDeq/RINvUFeMQ73GuBqzRcFDqQQ=\"},\"SV-78009r1_rule\",\"WN10-AU-000500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/3CmjRBIzvZC9yK/MCEjxBoeg+MF3xkIhnLP5Zgo/2M=\"},\"SV-78013r2_rule\",\"WN10-AU-000505\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rIpcAlB/RefJGwA84BZ7ULacK5uTqcC4TpZy9gfOwdk=\"},\"SV-78017r1_rule\",\"WN10-AU-000510\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Au90rsoIgKKpDJ+88Qps0bQDZf/CKYRvQpZFpv2MOUA=\"},\"SV-78023r2_rule\",\"WN10-AU-000515\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KvaUNjf9HpHOvMKNKYYGrc5t+RjNh70OiFd7YXyR7TI=\"},\"SV-78027r2_rule\",\"WN10-AU-000520\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kwjLPtx2Qf2ICgGtbJvcwowGSS5n1iOSY0sAbgRUseA=\"},\"SV-78031r2_rule\",\"WN10-AU-000525\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JLf0igfVeeCGPtuP0G5jtsBt5SLWDy8/40lxLhTjp+A=\"},\"SV-108655r1_rule\",\"WN10-AU-000550\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0JIEYxGjLJCW+XDuQSNKZLiOraun/N4xAz9pc3iPnC4=\"},\"SV-108657r1_rule\",\"WN10-AU-000555\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aHDwysX9OO7lInhWR4rNHU0Ms5aHv+DvTtpIpt7OrPU=\"},\"SV-108647r1_rule\",\"WN10-AU-000560\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ma4nqZH+wIDRjwzJLcPKvIvKb/+DvmWJQSbZYwt0kjY=\"},\"SV-108645r1_rule\",\"WN10-AU-000565\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1xCrwLo/Iq6qUeIrA32JKdJWhv9UJ8i93khTh00F31M=\"},\"SV-108649r1_rule\",\"WN10-AU-000570\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xN9N4TyNWncZnuydNiSn1AFbgDuZlrOZk/FpvfCXbCw=\"},\"SV-108651r1_rule\",\"WN10-AU-000575\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AwE4aTQA41II3JBpLcuFwxr2s+SdrBU5NkQnKMmh+34=\"},\"SV-108653r1_rule\",\"WN10-AU-000580\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:n/VYybwadURq9gktZ5pPv9NpPwlE/OX7X34avyRIxn0=\"},\"SV-78035r1_rule\",\"WN10-CC-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FGmuM87xdJUUKhYyergOAvk1Q+FhFTf1uOoIl5+4vOQ=\"},\"SV-109197r1_rule\",\"WN10-CC-000007\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wD5HvAQgiCsU2Pbe6EawPD0843pDzk9QjNocpT9i8RI=\"},\"SV-78039r1_rule\",\"WN10-CC-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A6fibgthh14b9Op4gFZQuUPcG2SB+c4/OCpJZl+JW/o=\"},\"SV-78045r1_rule\",\"WN10-CC-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QwUV9MHbwXjDlNhviMU3RJgonXD84IWB/u1SaVD04HU=\"},\"SV-78049r1_rule\",\"WN10-CC-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DJn8qS8Z+LUFfJVdHOYY3y3chtd5shcIjisdTgSjqYk=\"},\"SV-78053r1_rule\",\"WN10-CC-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OLmEHTREwzxLEYjHSP9Vs9v/hFwEi7JLaoSgaF8tAzI=\"},\"SV-78057r1_rule\",\"WN10-CC-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZB/zbtMEaShUymYYFvs3E2/5ygQ24pqyeGDPPNJ9udg=\"},\"SV-78087r2_rule\",\"WN10-CC-000037\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cLWTmB4pH7+xPBjUvZx8mpG3gs+QxeJQobWa4u/txeE=\"},\"SV-86387r1_rule\",\"WN10-CC-000038\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:azduH/rGDaA9J8WfIbKquOL5RoDMag7lQ/2PBt2QE8s=\"},\"SV-86953r1_rule\",\"WN10-CC-000039\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:R57XJmpmTusQFUQzPHbDgL50AUYv/vR8uoIKyz7Vpzs=\"},\"SV-78059r2_rule\",\"WN10-CC-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A69vy1PsYlLcAzLy5BVJjqB9jb4HUwisI/dMcPrDcBI=\"},\"SV-86389r1_rule\",\"WN10-CC-000044\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:61r9+JyE4FdTPKoO2j03RuHoicsSx+y5TDVRs+6Lxk8=\"},\"SV-78067r1_rule\",\"WN10-CC-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HPKwv55aIzf3+HquubSdJocG/rCtCTbtxNECCDpyxPk=\"},\"SV-89087r2_rule\",\"WN10-CC-000052\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c4QEIcRFMsJ0fLK2itIk4vhS7BejsCbOOCX+PUzaf1o=\"},\"SV-78071r2_rule\",\"WN10-CC-000055\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wmSMFUgwk1JCHLOyalyRfJCbYd8VKcplfwvV5bapJBY=\"},\"SV-78075r1_rule\",\"WN10-CC-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ev+o/KN0GgLzFlT2mWhE43+O9wbhzEnibMOjO1WuHo0=\"},\"SV-78081r2_rule\",\"WN10-CC-000065\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nB5yZlxqxo8iNwRqReGtHbsRcruqk84xPSKCKzfrudk=\"},\"SV-83409r1_rule\",\"WN10-CC-000066\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p3Km58ax+vwtXp6vt/jvLyGVTgesTT2NKlz+BVoeGAk=\"},\"SV-89373r2_rule\",\"WN10-CC-000068\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DgPD2H4FRf1aoEW+JdUiSywje5awdelYTOHDeJ/jku8=\"},\"SV-78085r6_rule\",\"WN10-CC-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PJ2hg0H5j3JxumOw1ESdMmYSago1hh7d1jPoC7NiknU=\"},\"SV-78089r9_rule\",\"WN10-CC-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MOtPlfIGo1RyaFuE2rfSMX3os4OtOKSymnMJWGrlUXI=\"},\"SV-78097r2_rule\",\"WN10-CC-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:x6lWvjXJOJaFvBJV1Zg8dV8fRzPlgg6/m3YcFFE/VLE=\"},\"SV-78099r1_rule\",\"WN10-CC-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:UFrGn+U27y3pnKkpO5lkjLvaccdBipAxfmB1NDMupKc=\"},\"SV-78105r1_rule\",\"WN10-CC-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PynI4MPELuswd9LSVn4o7lJ1Gj5XkceRgYo1jYFWcyE=\"},\"SV-78111r1_rule\",\"WN10-CC-000105\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eHWGorFu8rp07FggxF3KQzzzIDdCofw07d6YU7EPPQg=\"},\"SV-78113r1_rule\",\"WN10-CC-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1cHjpZpWasXrNs38blIHXTCAsBeBydKm/FoVbD6YN9E=\"},\"SV-78117r1_rule\",\"WN10-CC-000115\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJyg5YyGdmvNFobvn1b619ahBQSWRDA6UUW//FX4+mk=\"},\"SV-78119r1_rule\",\"WN10-CC-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uFh0+SOkPBhoY4cKXKJkJcnyQ6+Tp4ycDdOaJohcCxk=\"},\"SV-78123r1_rule\",\"WN10-CC-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i3fRKcUyn6PmTSkp0ufLDEGZMye3xAQxD4OpV2pM+0E=\"},\"SV-78135r1_rule\",\"WN10-CC-000145\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xC0vDkioBtR1JLW2HOIxcJl4n0eOz6yTkhlZetuLhI8=\"},\"SV-78139r1_rule\",\"WN10-CC-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NSgu6s8JKNnXMJ+7CGkFNsLqlJAeYQviKDinQTL+FHo=\"},\"SV-78141r1_rule\",\"WN10-CC-000155\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:14JhGWVp+3S3ydTw3+p8k3X7npjABreOsd4BluBaRyo=\"},\"SV-78147r1_rule\",\"WN10-CC-000165\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZJbz3VhLvqjcd2z7NP6j6DC8M0Ltzl3HDFROf1Cpu4o=\"},\"SV-78149r2_rule\",\"WN10-CC-000170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ye6LltMKmAmswLhHjkhNL7Oek9ZBv20d40WEFxLqoNg=\"},\"SV-78153r1_rule\",\"WN10-CC-000175\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BLkX1RSbTxRJ+95+jkVEEKAtY1YFGp7VUwcyz/Na6PU=\"},\"SV-78157r1_rule\",\"WN10-CC-000180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/dizhsZDVZiRpJUm04AvJkfxcjGg5bvtRPbE3Iajy3s=\"},\"SV-78161r1_rule\",\"WN10-CC-000185\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CffkXvxske/bT7jvs4za5BpRLmJrKhgTOflYgSJF+X8=\"},\"SV-78163r1_rule\",\"WN10-CC-000190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OHgYhVcmu/l9dVrJ0J5Uo4d4+lLD5rAkwUYwACRT+m0=\"},\"SV-78167r3_rule\",\"WN10-CC-000195\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uqablBEdj8fYHH8criFKQSHGko9Gb2nm3ANEizuP+08=\"},\"SV-86395r2_rule\",\"WN10-CC-000197\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ofnzmLY6Mws9d7/NtnKBQB4fhzW4stZa4Q8pqud3RuA=\"},\"SV-78169r1_rule\",\"WN10-CC-000200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rj3OnjRCg+zI0qrs9i/7QAUeW1hgVcDx11HNsPktgsU=\"},\"SV-96859r1_rule\",\"WN10-CC-000204\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:32jv43ZfzeffcLH0aNzUt/YSBnCyNLyRuby1CRN3yVw=\"},\"SV-78173r3_rule\",\"WN10-CC-000205\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJSxQGzb7YGcY1mgBjeFquoDAw5e1lp1zoNJaIM2u2U=\"},\"SV-80171r3_rule\",\"WN10-CC-000206\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SoCQzVKKVy7D5huRMI4Q7iyWO6PyUB9uG8vv4geQuQA=\"},\"SV-78175r6_rule\",\"WN10-CC-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pwvSQ+QN5KMngq6whT389oqgH7svUP44geVmJrGKA/Y=\"},\"SV-78179r1_rule\",\"WN10-CC-000215\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FNuzYuatOsVqoAEfYyh44rPDU4p+dXmH2F/22ijPNG8=\"},\"SV-78181r3_rule\",\"WN10-CC-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ka0gdKnu1i6pDqDBmfSv/etIgqsSnYvxwHo6vjDl/lA=\"},\"SV-78185r1_rule\",\"WN10-CC-000225\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nBBbWUKMYR0oBuDR1T1+MwPCSPwa/PvvTXckuCFHxcY=\"},\"SV-78189r6_rule\",\"WN10-CC-000230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nWoWY5Y4H2PjarlDCeZzumdmSKNqLLbQWB6PRDqTQik=\"},\"SV-78191r6_rule\",\"WN10-CC-000235\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Yc8MBcfVv6vNjndIl1SGBkgIuoDRlU+d8I5bNlbhm5k=\"},\"SV-96853r1_rule\",\"WN10-CC-000238\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Vnj02lH1OuXdBOVVSKAmO3ADzTn5+Ujz8I1pVPj59vU=\"},\"SV-78199r4_rule\",\"WN10-CC-000245\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2biNxxxfwe7Qz0rZRb+comoTPxV6tZ2FWyVQ8NR0XLI=\"},\"SV-78203r6_rule\",\"WN10-CC-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gd3/nmYTFouE7yNfONwiOI09OM4xvvtC7p5aHSm3+rk=\"},\"SV-89091r2_rule\",\"WN10-CC-000252\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:K8//OPyNM3tMbqVbeoAI5KxKu5UgN3dLo2qeJqTTARk=\"},\"SV-78207r5_rule\",\"WN10-CC-000255\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GJyj8KhT2aDTkrVyy9e0G2Fw3bcs2GwK50H4fhiljcA=\"},\"SV-78211r6_rule\",\"WN10-CC-000260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RzUSnNAkaFL0vjIzRXyocD/1metNOIhllvi1eHyUE/0=\"},\"SV-78219r1_rule\",\"WN10-CC-000270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9Pbb8VW3GGoFqiMEMNsF6+ETyP17aJ7LEE/EwiZmXLY=\"},\"SV-78221r1_rule\",\"WN10-CC-000275\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pOkacn9XsLUUPvPCp7BiIdMobs3MmyoiiFdmo2S1Jh4=\"},\"SV-78223r1_rule\",\"WN10-CC-000280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:db4NX5ePYijTdjIZhHi6AMQwXOH25jy1YMRAOPp6z8o=\"},\"SV-78227r1_rule\",\"WN10-CC-000285\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XK40On1j1swkBQC4KHrqqKtA3+PU7O8didBZ9X2v3mU=\"},\"SV-78231r1_rule\",\"WN10-CC-000290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D+Br9Bp34FIbXISTUzTyziluj9wIh2NeP3T7rqIlBeU=\"},\"SV-78233r1_rule\",\"WN10-CC-000295\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2hvdFSkHFd/jxnDg7QHAFnPQALuFWOVvLZGgRROj5l8=\"},\"SV-78237r1_rule\",\"WN10-CC-000300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MT/QRJ+7T5KdEYjB1CflYUeHypJvbgQA/NoSivDno44=\"},\"SV-78241r1_rule\",\"WN10-CC-000305\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kaQFP+qv+/U0A5jz+BdWIpTTdtyktf1MP4WKqmlH3c4=\"},\"SV-77811r1_rule\",\"WN10-CC-000310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zv0vssTime65YEhFGjHDqU96ACMkZRxJDowM/Qv+sCo=\"},\"SV-77815r1_rule\",\"WN10-CC-000315\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pBxUW2Mg4ubB2d75emmojt2R7TlPrd+/K+K4/cfdRCw=\"},\"SV-77819r1_rule\",\"WN10-CC-000320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zkVu4Ox1MUjKEwFzsfX/ILQ/ZYHNPsu/JvNQeqZ228Y=\"},\"SV-77823r1_rule\",\"WN10-CC-000325\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tlcocN55ZYxvkWqCrlKzS308hz23N1rtV+8aFeDnhcQ=\"},\"SV-83411r2_rule\",\"WN10-CC-000326\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dbiUpUgiJb2+wzenGvBgb7gCtpsKZcFOnZmCT6u1k3s=\"},\"SV-111563r1_rule\",\"WN10-CC-000328\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fdOFEUfWZvFxvtQyeYZ2AqTmF5GEfPF1uWfwWrblF5o=\"},\"SV-77825r1_rule\",\"WN10-CC-000330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b3jhzOOdG7cVXgpSQQKPwd6xwSdfSPk98Epls0Yl+iY=\"},\"SV-77829r1_rule\",\"WN10-CC-000335\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2tk48SuLjCC1zEZDnJEJwFssANaf8w1hwLA0yFQDwt0=\"},\"SV-98853r3_rule\",\"WN10-CC-000340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yd5HlJZjtzvpiWMc+q7EtjdFutkSfgvcIU2keNcxYzA=\"},\"SV-77837r1_rule\",\"WN10-CC-000345\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:EIBNySof2OFl+QthlhxU04xnAsa1Q0mr/BmTT/yWVGw=\"},\"SV-77859r1_rule\",\"WN10-CC-000350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rF9EqXhMnWgSBUWWkmTth67EEUxryI/ybsO2eNuHvzU=\"},\"SV-77865r1_rule\",\"WN10-CC-000355\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nkjCE6RM8DNItyD6rVqHkapLyfMeCxO61yv23MB6TIM=\"},\"SV-77831r2_rule\",\"WN10-CC-000360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xCK9AnopZ/PLEiEfFd+fF29a3GvfMV+H4kBtncaC+w4=\"},\"SV-104549r1_rule\",\"WN10-CC-000365\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QBQK/tnwXZkWJDaqU/JtL7zWbHA0F4hsxCD2qrMtB98=\"},\"SV-108663r1_rule\",\"WN10-CC-000370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:d1pbzJigO85rKAMstf6sSkdP/ACDK1pRyqaLfXxwivI=\"},\"SV-108665r1_rule\",\"WN10-CC-000385\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rD1r31DjrTFhcjSKe05lznNWs43/fc9RD+ZPg5DX/ZA=\"},\"SV-108667r1_rule\",\"WN10-CC-000390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wZQbFTwW94OSVmQOtJRreFTXD/cIx6cp6SMGeIT/5Q0=\"},\"SV-91787r3_rule\",\"WN10-EP-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:seoeJ0TVdyPF1IZOglTdU3YY9kcGzHzPhCDGtAE3tkM=\"},\"SV-91791r4_rule\",\"WN10-EP-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I4uQfS2NjZHDkDdoRvwEOJ9Cn5UEOwkvBoMVv0IlL4w=\"},\"SV-91793r3_rule\",\"WN10-EP-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kFzIaNPWT2wqsaqKjSiKaNxW40sevexLR9vPMcm9edQ=\"},\"SV-91797r3_rule\",\"WN10-EP-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:g7RfvBxx636aPhixMi/6iDCzMbVFIx9shebxkreQe48=\"},\"SV-91799r3_rule\",\"WN10-EP-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/kelpkvOVtEhlqeho3DqaACavzCa3fwBSBE55Uza0+E=\"},\"SV-91885r5_rule\",\"WN10-EP-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MubhtefZIzGkvhlY2PmYFuDlH+8Uqku0fltszVjOuxU=\"},\"SV-91887r5_rule\",\"WN10-EP-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fg2f0FG3EIVUBqMtVXqVYKHERgkwZW3I0YbnLTVAsX8=\"},\"SV-91891r4_rule\",\"WN10-EP-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pNmbpGc9jee+bzjZjzmnqgZeocNv6buCv3Ipvsb5pXo=\"},\"SV-91897r5_rule\",\"WN10-EP-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:spszjT7BTTddnp6oFJqi/T4F3rA0UBbm/6GzPBqBcWo=\"},\"SV-91901r5_rule\",\"WN10-EP-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mtl2VgiudtjEJVh9KeXvbi749Hr3urnyB+DwqMQJz2Y=\"},\"SV-91905r5_rule\",\"WN10-EP-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LsXrxcaxVB8zrRJjNYRpPBfOKTGaqj32TPrT80sjdFE=\"},\"SV-91909r5_rule\",\"WN10-EP-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:amDpgsaRxthlet+rsvJeTvWJu1llLyepQcXyc5K4O7w=\"},\"SV-91913r5_rule\",\"WN10-EP-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lY+AXYfe/AluR4WGTqo0FEqJ5tSSl5HZ39f56ylKTs4=\"},\"SV-91917r5_rule\",\"WN10-EP-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fe/FsLxtBWOXdM4WX+ESyWqxz8i/+CYiH84HrxQGTKM=\"},\"SV-91919r5_rule\",\"WN10-EP-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mh9IH1clzy+A1OOIBzjvUuybaU9xSwmJekh7crMQoVI=\"},\"SV-91923r5_rule\",\"WN10-EP-000170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dEwmjiXxS3GnMegQ2bUU71KYoXG5Dd/AZ7wdyDMWJGQ=\"},\"SV-91927r5_rule\",\"WN10-EP-000180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xgIlihjGuLyZbqGDLM1SWEpzSqmldIb/KD1X6dqFPeQ=\"},\"SV-91929r5_rule\",\"WN10-EP-000190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lILMjdtbWDfww7YCEZdpYCS81lAL+dJlad4M/TVlfcQ=\"},\"SV-91935r5_rule\",\"WN10-EP-000200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5Ph3UBC9p+Akj+j+IR75pArMHpuq1OdgoJE3yVDf11E=\"},\"SV-91931r5_rule\",\"WN10-EP-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GXA5f/UA68emJFB8jqN9ewGYIe84bEvyYg7xSGas3I4=\"},\"SV-91939r5_rule\",\"WN10-EP-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MUCQyakZZLfc2Ap5HiFf5ipmQj0p92vkKHKV9h/lKZA=\"},\"SV-91941r4_rule\",\"WN10-EP-000230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Tc2J0p3mLuCyswLMHwCyLpY+3kVedt6NP6VLBTCWYjA=\"},\"SV-91943r5_rule\",\"WN10-EP-000240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MQNLsBE4TEp2/6ROgBSTJO9fJkNfyMcnLhI9YtT5BXI=\"},\"SV-91945r5_rule\",\"WN10-EP-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pHMGWcsdxpl8Z+8pYTfwp4+n7EAO3II6SBPoR0qmkV8=\"},\"SV-91951r5_rule\",\"WN10-EP-000260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8vOgdCfinZFo71HQ6cBJRAa/ITYhJrZWDk+MZttTzFg=\"},\"SV-91955r5_rule\",\"WN10-EP-000270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wzRqhQROBVJlE1q3nxtUM1GkAJigG01hupg8bXE1iSA=\"},\"SV-91959r5_rule\",\"WN10-EP-000280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/mZrNq1dEWU1tMYc71JTRfkRtNHkdPGHX2E03f0Jppc=\"},\"SV-91963r5_rule\",\"WN10-EP-000290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i7E2vv6pd35hawlK+qV+2UpXcaVnUkBR1V3CR/Rcg7M=\"},\"SV-91965r5_rule\",\"WN10-EP-000300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vk0EeybuvPD5mu6kz6fCWWqDopo0zsPMlVMjqvlYb5I=\"},\"SV-108661r1_rule\",\"WN10-EP-000310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vBYNU1MOZTMT14yG0uwLTnJNZd27pnHRrsvC0HPMX0s=\"},\"SV-78069r4_rule\",\"WN10-PK-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4xWh6wamWmIOeIO59RNtRdwcCFtu7mD7qVIiEWhU49I=\"},\"SV-78073r3_rule\",\"WN10-PK-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FKy5u6ln+y0mzvOV4HzwGH2CwpZj3IQ2DhcZHGowfYk=\"},\"SV-78077r6_rule\",\"WN10-PK-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VNS7bkHAgOyfB6SjEoQf8o+x0lzbHQcxS5EZbR1kz64=\"},\"SV-78079r5_rule\",\"WN10-PK-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+gNTwi6NPYxK/l/EIlkhsqMLUMX3yk8p8qOXrOuTUD8=\"},\"SV-78083r2_rule\",\"WN10-RG-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gu4gtZX1rR01eoH7S8OImC8dbc8fZ9Js8wyj3Hq8AQA=\"},\"SV-78091r1_rule\",\"WN10-SO-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3H53KZC2kWuaeW6IYY71llirhuaVVZpEWoqEEkwfsC4=\"},\"SV-78101r1_rule\",\"WN10-SO-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:J5uvaJtjjYnwV4ewXXHS2Y/F1moPfjj95l8OgEmAcHg=\"},\"SV-78107r1_rule\",\"WN10-SO-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CgDvkF7Lpc1r6ZB1knUBa/Na6DAh5qTekx4xkJVDJKU=\"},\"SV-78109r1_rule\",\"WN10-SO-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Sp6+sZWFJ+5qIfMxuZM1X4FQ9Q3VaCCrivEnw2hO+VE=\"},\"SV-78115r1_rule\",\"WN10-SO-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h25vRZXLu1TOtMH5HMSKvo8N5a+Q/ueTRDZ1vspmoQE=\"},\"SV-78125r1_rule\",\"WN10-SO-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XPkkPkWSdvWEzxDy2sUWix6KC7aJBbG9RBZ/ZnYOGEs=\"},\"SV-78129r1_rule\",\"WN10-SO-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wy/VGGvzW3UlJ37hiY+I8pUms7MXbP2SNpPKfNy1KIA=\"},\"SV-78133r1_rule\",\"WN10-SO-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/cJizcUtpE2HLtuWkhVN3GiOSFjewXuYn9IJu3enAXg=\"},\"SV-78137r1_rule\",\"WN10-SO-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:z2vvY1cDmkJvQsHfPOfw8QGJtMOKrIQz9lM3Dc0ytLo=\"},\"SV-78143r1_rule\",\"WN10-SO-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LaaMQgJOQrkO4EB1mnVDnZdeYz6iDashNKpqfHpNCck=\"},\"SV-78151r1_rule\",\"WN10-SO-000055\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kcyr2a0EWEiUBvmVmyDq0M6j4K7/nBHuXmLhXDDtMf0=\"},\"SV-78155r1_rule\",\"WN10-SO-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mhjrBvHTfJT/OuyLZFDHWxfbvJ3FuijQKPyHh2cvxks=\"},\"SV-78159r2_rule\",\"WN10-SO-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XgzulLjMBxHaNi0V9FHGyZ4It0yWcGbG1JwlFE+T+gk=\"},\"SV-78165r2_rule\",\"WN10-SO-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PHPF3Sy5sq6u5phRafA9yRglmtGg7XcKsUmsucub7jI=\"},\"SV-78171r1_rule\",\"WN10-SO-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OtsqfrQg9GojUClvvmL4jzwvRg7kIHzjol+WcskfN8k=\"},\"SV-78177r1_rule\",\"WN10-SO-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v8lM7FP7aQdAEqhdWAElG8v5N9aKZNjsXI3sO16UBJ8=\"},\"SV-78187r1_rule\",\"WN10-SO-000095\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YHHxKYwoRYjDWym4IH18cuhmeP93GyehRyGY9+eWOlM=\"},\"SV-78193r1_rule\",\"WN10-SO-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I1hZ4Drt9YDDg3F9ZAzn33a90Yrg1/tAw/QcCCksE3A=\"},\"SV-78201r1_rule\",\"WN10-SO-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m4mVWgszCk8aLeRg9wcZWG+Rs/f7KjQGvMB6lRJ5A+M=\"},\"SV-78209r1_rule\",\"WN10-SO-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5oFtb8E3qwiXU282gaObtdqYpKDg1HKwTV1n0yGLwdM=\"},\"SV-78229r1_rule\",\"WN10-SO-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:q4amaRBeQBzWaWDuh+jg7+M6Q2vE1slnyWZ9vRYL1BU=\"},\"SV-78235r1_rule\",\"WN10-SO-000145\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PH+4N2yTf3KYeI3LzoMmv9I7NMVl4gENYVtdt5aHEQ4=\"},\"SV-78239r1_rule\",\"WN10-SO-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PPMakW1bUBUuTQXNZEWFXjV3n8bqxzcAep6WCv0LA6I=\"},\"SV-78245r1_rule\",\"WN10-SO-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+CqVPSzadLgqURUz9jpa2vfnE9s9rDLe5PbBuASRgh0=\"},\"SV-78249r1_rule\",\"WN10-SO-000165\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bnGEzcuJUAwCNZ4Ws5wyS5j2lY5Jgzk6QrlcnBXgb8o=\"},\"SV-86393r3_rule\",\"WN10-SO-000167\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m79WMkHt8ZOH03cNAv+YgwDxku23Nclna/dukfCHBwE=\"},\"SV-78255r1_rule\",\"WN10-SO-000180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bu7KdaDw/5/s3TIiuDAAhnNsO3EvwivuJyQ8TxBRC2k=\"},\"SV-78257r1_rule\",\"WN10-SO-000185\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WBduyUoS7ji0lJWOQsFV1TVIPhzv+GArzEJ9SaioyCg=\"},\"SV-78285r1_rule\",\"WN10-SO-000190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:esvIIQzIXuuV6UAZCui3VcV9VGJeNpc//UNi3KoTS1w=\"},\"SV-78287r1_rule\",\"WN10-SO-000195\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5qXivRds1q8g/9HnQ9nxJHz6twXtapACZhIt29psYMg=\"},\"SV-78291r1_rule\",\"WN10-SO-000205\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YGadfMPpS3VMGBFW+r3ZcBbI9dYCCdc/zyMG4vKxtCU=\"},\"SV-78293r1_rule\",\"WN10-SO-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wPbkf7isP1x09ZPgzKuJL8TtdkHaTA1/d8tDtGfpybs=\"},\"SV-78295r1_rule\",\"WN10-SO-000215\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gvDKD+YMxXb3Dbh+NdpQ/LmlaxOytN56P+kbBAhz7EA=\"},\"SV-78297r1_rule\",\"WN10-SO-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QgLpxb9vltYJFW7KY8eBS23IB732VOg5sO/3heYiTSY=\"},\"SV-78301r1_rule\",\"WN10-SO-000230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QiljZhB01LqOQfbiDH4gdszZSQwiokE7rvHMNETmntI=\"},\"SV-78305r1_rule\",\"WN10-SO-000240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9xKCBYF3X03GOrS60NZkKP1tRU65uLNh/SvSEhv7qzY=\"},\"SV-78307r1_rule\",\"WN10-SO-000245\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6anIfcvLd9P3Qqj21QYsvMEK1vkh6OjqA8kxfY/qKRI=\"},\"SV-78309r1_rule\",\"WN10-SO-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aGZaMr7JCYhdhYIbyDmHK2zx8fjqDpXXjEY01sUoNo4=\"},\"SV-111577r1_rule\",\"WN10-SO-000251\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2Mf6LpRtxqJ2Xi014C6XdUKrfkVm1If47khfoSg5IPk=\"},\"SV-78311r1_rule\",\"WN10-SO-000255\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xIxQC3EFtKo4/I03k/uVVwqUkFC9effmNV1HiiiVNas=\"},\"SV-78315r1_rule\",\"WN10-SO-000260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8HK3jPasJRJpBZDqSPFQU1vxUyg5+aAI6SAka9PPlvc=\"},\"SV-78317r1_rule\",\"WN10-SO-000265\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TXh7CT8eDFg9PQd3GuTWW0B0BM4p6bzG9FF1T+9Vv8s=\"},\"SV-78319r1_rule\",\"WN10-SO-000270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jTdDk2qrsY7wk2fxd9JsCbcokx4k7p+QSN/VYmbUB9k=\"},\"SV-78321r1_rule\",\"WN10-SO-000275\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WiWO+yrYgzS9BRfJ95tCnETPOIU/k/YYuPYQakQM+IM=\"},\"SV-108659r2_rule\",\"WN10-SO-000280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ewDvbXkRfIkCeWiNsw3OWO1nlDe4SsgnCecA5Am1j5Q=\"},\"SV-96851r1_rule\",\"WN10-UC-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ps+f+j5cOJetWmfgZFHPTjOUfHH002d19GW01SZ35RY=\"},\"SV-78329r1_rule\",\"WN10-UC-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:31JR/6WQp6TuKxIQqNorrp6RBoUM0yhGJ95MVdPpzUw=\"},\"SV-78331r2_rule\",\"WN10-UC-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4Q6F4dio1jN4MtIZbfGfkZnYkN6zfJazb6nB793l6nQ=\"},\"SV-78333r1_rule\",\"WN10-UR-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:at5fqeVaC1Sm9FnXQjZ7YLh8ehuVr9z5FoeJZMIMABA=\"},\"SV-78335r3_rule\",\"WN10-UR-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8xkuF4nDSjRiPP+9oGCPnfWYPGGSOi17d7FbL0XhlU0=\"},\"SV-78337r1_rule\",\"WN10-UR-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dq7TXJZ0aBQkd+AjwMgoDVp+n4UvOG8n1gEF82FEBlE=\"},\"SV-78341r2_rule\",\"WN10-UR-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KEKE0PGxslNV0A6vemAzaWjzbx9nYy/RbiPhNJ3aL20=\"},\"SV-78343r1_rule\",\"WN10-UR-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cDiaxsqIK6oeD+TiOA04U8bzW/Xipep+PGUIszW1Ddg=\"},\"SV-78345r2_rule\",\"WN10-UR-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Wzi+dcfocDaL/BL8ZywSuiDTEG4Zv3kI5qdXUcl3y8E=\"},\"SV-78347r1_rule\",\"WN10-UR-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m3olQQDR+ylJqlRWob7mYvRuzE60jAwPG6gvqc+QNq4=\"},\"SV-78349r1_rule\",\"WN10-UR-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:srfyN9VEgB5cnpXOBY292RFK5lJspJquvD0ZD4TIQLE=\"},\"SV-78351r1_rule\",\"WN10-UR-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KcAj9nx0K1Jq/IEktNS9qbRss/b4npcbS1XEQ+S/Xm0=\"},\"SV-78353r1_rule\",\"WN10-UR-000055\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3c6IOQPBsJcn8+IGDfwZ5oHJ/hbHObilnQESAeOLePs=\"},\"SV-78355r2_rule\",\"WN10-UR-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PgmqvkJqmLhRaPCQpSZZxUPFDDIdB1muY7/23B1nyZM=\"},\"SV-78359r1_rule\",\"WN10-UR-000065\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qj88J123Y6ALiPB3Uh+vm0KvR68nqjRVdYVnlzC1rII=\"},\"SV-78361r3_rule\",\"WN10-UR-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gRYqjlzcylziTXB0rod7QdHFL/L5BST/gimkIhHW/vk=\"},\"SV-78363r1_rule\",\"WN10-UR-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Hn5uwnn6gC1VwYXthEGUgC6ziFRTZscKIoUS++3Rjto=\"},\"SV-78365r2_rule\",\"WN10-UR-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XTQwo3vFeHtIVTshIduv4IWitfBFRakuEQXlLRuSS24=\"},\"SV-78367r2_rule\",\"WN10-UR-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oDnTVUc7IVAYvvMQbb1Wz03I5+3OQ5gnInH/2FTM+UQ=\"},\"SV-78369r4_rule\",\"WN10-UR-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HCUwYAohklOWhKjdCkwUXELBicl1aKdYsLlX2ENO5ZQ=\"},\"SV-78371r1_rule\",\"WN10-UR-000095\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h8rwAYISD/28YdzSDaeuG5FpPZBqNPB9wT86XIfoUdE=\"},\"SV-78373r1_rule\",\"WN10-UR-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8ZljbVob0XqSwiA5dOYkrIecCXdmnQCug5ybd0v/x1Q=\"},\"SV-78379r1_rule\",\"WN10-UR-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zxCJ1n+/xpv4SXNOQLm6wAQSmkH1udVPy4xRJNH22s0=\"},\"SV-78407r1_rule\",\"WN10-UR-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pvOcEpA+TB34F4cWCOGMSfSEkxZAfBUxITpDJmb9+K4=\"},\"SV-78415r1_rule\",\"WN10-UR-000125\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ntgurAdRh2vPTZ6v6uIm1vEBH6EsSEipSMq20DsG+D8=\"},\"SV-78417r1_rule\",\"WN10-UR-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zpJA36QZjPMfklit+NRW9GEdI9+UG+zGf4DOGG8XG6Y=\"},\"SV-78421r1_rule\",\"WN10-UR-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6Vr6sSumF5z/+2j4Jut2d6KaK1Nl8c/eF71h3mZz84s=\"},\"SV-78423r1_rule\",\"WN10-UR-000145\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U1jQim/n6VHAUZXYJaQi/HWtt7Q3k/5g/dZtKPgRpRQ=\"},\"SV-78425r1_rule\",\"WN10-UR-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F0RPJGfwD1qORt7UmHAIsqA20ktqswUXeKiEMO4DFEw=\"},\"SV-78429r1_rule\",\"WN10-UR-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hO/PQW/5C6I5rdjEwZhLARaC8GglwdI3lTW+tbXMeS4=\"},\"SV-78431r1_rule\",\"WN10-UR-000165\"]\n{\"table\":\"stig\",\"columns\":\"`benchmarkId`,`title`\",\"rowCount\":5}\n[\"RHEL_7_STIG_TEST\",\"Red Hat Enterprise Linux 7 Security Technical Implementation Guide\"]\n[\"VPN_SRG_TEST\",\"Virtual Private Network (VPN) Security Requirements Guide\"]\n[\"VPN_SRG_OTHER\",\"Virtual Private Network (VPN) Security Requirements Guide - replaced\"]\n[\"VPN_SRG_Rule-fingerprint-match-test\",\"Virtual Private Network (VPN) Security Requirements Guide - replaced\"]\n[\"Windows_10_STIG_TEST\",\"Windows 10 Security Technical Implementation Guide\"]\n{\"table\":\"stig_asset_map\",\"columns\":\"`accepted`,`acceptedResultEngine`,`assessedHighCount`,`assessedLowCount`,`assessedMediumCount`,`assetId`,`benchmarkId`,`error`,`errorResultEngine`,`fail`,`failResultEngine`,`fixed`,`fixedResultEngine`,`highCount`,`informational`,`informationalResultEngine`,`lowCount`,`maxTouchTs`,`maxTs`,`mediumCount`,`minTs`,`notapplicable`,`notapplicableResultEngine`,`notchecked`,`notcheckedResultEngine`,`notselected`,`notselectedResultEngine`,`pass`,`passResultEngine`,`rejected`,`rejectedResultEngine`,`saId`,`saved`,`savedResultEngine`,`submitted`,`submittedResultEngine`,`unknown`,`unknownResultEngine`,`userIds`\",\"rowCount\":17}\n[0,0,0,0,3,62,\"VPN_SRG_TEST\",0,0,1,0,0,0,0,0,0,0,\"2022-01-26 01:23:06\",\"2022-01-26 01:23:06\",1,\"2020-08-11 23:37:48\",2,0,0,0,0,0,0,0,0,0,1,1,0,2,0,0,0,\"[]\"]\n[0,0,0,0,0,62,\"Windows_10_STIG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,\"[]\"]\n[0,0,0,1,5,42,\"VPN_SRG_TEST\",0,0,3,0,0,0,0,0,0,1,\"2022-02-03 00:07:07\",\"2022-02-03 00:07:05\",2,\"2020-08-11 22:27:26\",1,0,0,0,0,0,2,0,0,0,3,1,0,5,0,0,0,\"[85]\"]\n[0,0,0,0,3,42,\"Windows_10_STIG_TEST\",0,0,1,0,0,0,0,0,0,0,\"2020-08-18 20:48:29\",\"2020-08-18 20:48:29\",1,\"2020-08-11 22:29:16\",0,0,0,0,0,0,2,0,0,0,4,1,0,2,0,0,0,\"[86]\"]\n[0,0,0,1,4,154,\"VPN_SRG_TEST\",0,0,3,0,0,0,0,0,0,1,\"2022-02-02 20:20:18\",\"2022-02-02 20:20:18\",2,\"2020-08-11 22:30:42\",1,0,0,0,0,0,1,0,0,0,5,3,0,2,0,0,0,\"[85]\"]\n[0,0,0,0,0,154,\"Windows_10_STIG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,\"[]\"]\n[0,0,0,0,1,240,\"VPN_SRG_TEST\",0,0,0,0,0,0,0,0,0,0,\"2020-08-18 02:22:23\",\"2020-08-18 02:22:23\",0,\"2020-08-18 02:22:23\",0,0,0,0,0,0,1,0,0,0,7,1,0,0,0,0,0,\"[]\"]\n[0,0,0,0,1,153,\"VPN_SRG_TEST\",0,0,0,0,0,0,0,0,0,0,\"2020-08-18 02:22:56\",\"2020-08-18 02:22:56\",0,\"2020-08-18 02:22:56\",0,0,0,0,0,0,1,0,0,0,8,0,0,1,0,0,0,\"[]\"]\n[0,0,0,0,0,38,\"VPN_SRG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,9,0,0,0,0,0,0,\"[85]\"]\n[0,0,0,0,0,241,\"VPN_SRG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,10,0,0,0,0,0,0,\"[]\"]\n[0,0,0,0,0,241,\"Windows_10_STIG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,11,0,0,0,0,0,0,\"[]\"]\n[0,0,0,0,0,34,\"RHEL_7_STIG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,12,0,0,0,0,0,0,\"[]\"]\n[0,0,0,0,0,34,\"VPN_SRG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,13,0,0,0,0,0,0,\"[]\"]\n[0,0,0,0,0,34,\"Windows_10_STIG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0,\"[]\"]\n[0,0,null,null,null,247,\"Windows_10_STIG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,15,0,0,0,0,0,0,null]\n[0,0,null,null,null,247,\"VPN_SRG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,null]\n[0,0,0,0,1,248,\"VPN_SRG_TEST\",0,0,1,0,0,0,0,0,0,0,\"2025-05-30 21:07:44\",\"2025-05-30 21:07:44\",1,\"2025-05-30 21:07:44\",0,0,0,0,0,0,0,0,0,0,17,1,0,0,0,0,0,null]\n{\"table\":\"user_data\",\"columns\":\"`created`,`lastAccess`,`lastClaims`,`status`,`statusDate`,`statusUser`,`userId`,`username`,`webPreferences`\",\"rowCount\":10}\n[\"2024-10-23 10:29:57\",1744054045,\"{\\\"acr\\\": \\\"0\\\", \\\"aud\\\": [\\\"realm-management\\\", \\\"account\\\"], \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1864681035, \\\"iat\\\": 1670540236, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman\\\", \\\"jti\\\": \\\"47f9aa7d-bac4-4098-9be8-ace75513aa7f\\\", \\\"sid\\\": \\\"87365b33-2c76-4b3c-8485-fba5dbff4b9f\\\", \\\"sub\\\": \\\"b7c78a62-b84f-4578-a983-2ebc66fd9efe\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"name\\\": \\\"STIGMAN Admin\\\", \\\"nonce\\\": \\\"3378daff-0404-43b3-b4ab-ee31ff7340ac\\\", \\\"scope\\\": \\\"openid stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:op stig-manager:collection:read stig-manager:op:read stig-manager:user stig-manager stig-manager:stig\\\", \\\"auth_time\\\": 1670540235, \\\"given_name\\\": \\\"STIGMAN\\\", \\\"family_name\\\": \\\"Admin\\\", \\\"realm_access\\\": {\\\"roles\\\": [\\\"create_collection\\\", \\\"default-roles-stigman\\\", \\\"admin\\\"]}, \\\"session_state\\\": \\\"87365b33-2c76-4b3c-8485-fba5dbff4b9f\\\", \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}, \\\"realm-management\\\": {\\\"roles\\\": [\\\"view-users\\\", \\\"query-groups\\\", \\\"query-users\\\"]}}, \\\"preferred_username\\\": \\\"stigmanadmin\\\"}\",\"available\",\"2024-10-23 10:29:57\",null,1,\"stigmanadmin\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:29:57\",1602652507,\"{\\\"acr\\\": \\\"1\\\", \\\"aud\\\": \\\"account\\\", \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1602652806, \\\"iat\\\": 1602652506, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman-test\\\", \\\"jti\\\": \\\"eb5cdbd4-c912-4fc5-a1b8-10cf737d374a\\\", \\\"sub\\\": \\\"51ea2e76-d3db-43ff-b551-68dfbdf01a38\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"nonce\\\": \\\"8fbd4814-621a-4b63-af57-9e62b665a529\\\", \\\"scope\\\": \\\"openid stig-manager:user:read stig-manager:collection stig-manager:user stig-manager:op stig-manager:stig stig-manager:stig:read email profile\\\", \\\"auth_time\\\": 1602652506, \\\"realm_access\\\": {\\\"roles\\\": [\\\"user\\\"]}, \\\"session_state\\\": \\\"d5a18452-599d-4a50-af6f-75fb3808f2e9\\\", \\\"email_verified\\\": false, \\\"allowed-origins\\\": [\\\"*\\\"], \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}}, \\\"preferred_username\\\": \\\"lvl2\\\"}\",\"available\",\"2024-10-23 10:29:57\",null,21,\"lvl2\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:29:57\",null,\"{}\",\"available\",\"2024-10-23 10:29:57\",null,22,\"wf-test\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:29:57\",null,\"{}\",\"available\",\"2024-10-23 10:29:57\",null,43,\"workforce-60\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:29:57\",1602652565,\"{\\\"acr\\\": \\\"1\\\", \\\"aud\\\": \\\"account\\\", \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1602652864, \\\"iat\\\": 1602652564, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman-test\\\", \\\"jti\\\": \\\"72163a5a-9599-4942-92c0-347d3c00d7fb\\\", \\\"sub\\\": \\\"dea1961a-b597-49d1-8b80-a443ec30c7c7\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"nonce\\\": \\\"709a0a0a-9d85-4e31-8266-99b7a306e17c\\\", \\\"scope\\\": \\\"openid stig-manager:user:read stig-manager:collection stig-manager:user stig-manager:op stig-manager:stig stig-manager:stig:read email profile\\\", \\\"auth_time\\\": 1602652564, \\\"realm_access\\\": {\\\"roles\\\": [\\\"user\\\"]}, \\\"session_state\\\": \\\"bcf64712-4b8d-4e42-86c9-d173a363e4d5\\\", \\\"email_verified\\\": false, \\\"allowed-origins\\\": [\\\"*\\\"], \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}}, \\\"preferred_username\\\": \\\"lvl3\\\"}\",\"available\",\"2024-10-23 10:29:57\",null,44,\"lvl3\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:29:57\",1602652573,\"{\\\"acr\\\": \\\"1\\\", \\\"aud\\\": \\\"account\\\", \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1602652872, \\\"iat\\\": 1602652572, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman-test\\\", \\\"jti\\\": \\\"b8cd924e-432b-4072-bf1c-425386981cd5\\\", \\\"sub\\\": \\\"1045da76-d100-4093-b4ac-d520e34e0bf9\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"nonce\\\": \\\"33f857b8-2d55-4ec9-8078-0aed9edda98e\\\", \\\"scope\\\": \\\"openid stig-manager:user:read stig-manager:collection stig-manager:user stig-manager:op stig-manager:stig stig-manager:stig:read email profile\\\", \\\"auth_time\\\": 1602652572, \\\"realm_access\\\": {\\\"roles\\\": [\\\"user\\\"]}, \\\"session_state\\\": \\\"6c15ffa5-ccf3-4cc7-b187-cf6117ada3d1\\\", \\\"email_verified\\\": false, \\\"allowed-origins\\\": [\\\"*\\\"], \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}}, \\\"preferred_username\\\": \\\"lvl4\\\"}\",\"available\",\"2024-10-23 10:29:57\",null,45,\"lvl4\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:29:57\",1602652554,\"{\\\"acr\\\": \\\"1\\\", \\\"aud\\\": \\\"account\\\", \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1602652854, \\\"iat\\\": 1602652554, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman-test\\\", \\\"jti\\\": \\\"dba7eae1-8a6b-4335-ae34-93097a78c948\\\", \\\"sub\\\": \\\"0afa914a-cdbb-4edb-baca-3a664dc20cd0\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"nonce\\\": \\\"5337bda6-559e-4823-8764-488337bd390f\\\", \\\"scope\\\": \\\"openid stig-manager:user:read stig-manager:collection stig-manager:user stig-manager:op stig-manager:stig stig-manager:stig:read email profile\\\", \\\"auth_time\\\": 1602652553, \\\"realm_access\\\": {\\\"roles\\\": [\\\"create_collection\\\", \\\"user\\\"]}, \\\"session_state\\\": \\\"69ed7f9b-1858-4af3-b909-7b9120c08878\\\", \\\"email_verified\\\": false, \\\"allowed-origins\\\": [\\\"*\\\"], \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}}, \\\"preferred_username\\\": \\\"collectioncreator\\\"}\",\"available\",\"2024-10-23 10:29:57\",null,82,\"collectioncreator\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:29:57\",1602652493,\"{\\\"acr\\\": \\\"1\\\", \\\"aud\\\": \\\"account\\\", \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1602652792, \\\"iat\\\": 1602652492, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman-test\\\", \\\"jti\\\": \\\"64ea09c4-e9fd-423c-b447-aff38d38f04e\\\", \\\"sub\\\": \\\"757dd598-d9d8-4c0b-8811-ec7f40925986\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"nonce\\\": \\\"48fe2aae-66f8-4188-8af3-419129aa02e6\\\", \\\"scope\\\": \\\"openid stig-manager:user:read stig-manager:collection stig-manager:user stig-manager:op stig-manager:stig stig-manager:stig:read email profile\\\", \\\"auth_time\\\": 1602652492, \\\"realm_access\\\": {\\\"roles\\\": [\\\"user\\\"]}, \\\"session_state\\\": \\\"cbf87935-3521-4c5d-a22e-d8dd9e60e5e3\\\", \\\"email_verified\\\": false, \\\"allowed-origins\\\": [\\\"*\\\"], \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}}, \\\"preferred_username\\\": \\\"lvl1\\\"}\",\"available\",\"2024-10-23 10:29:57\",null,85,\"lvl1\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:29:57\",null,\"{}\",\"available\",\"2024-10-23 10:29:57\",null,86,\"bizarroLvl1\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:29:57\",1759361850,\"{\\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 2057787828, \\\"iat\\\": 1742427828, \\\"iss\\\": \\\"http://localhost:8080/realms/stigman\\\", \\\"jti\\\": \\\"fb064b55-c896-4e57-a697-8ef4f153cb6d\\\", \\\"sid\\\": \\\"38a7409c-4a63-4311-ab62-5de78f573d5c\\\", \\\"sub\\\": \\\"bf87a16f-39e6-46d9-8971-f0ef51dd3f85\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"name\\\": \\\"Admin Burke\\\", \\\"scope\\\": \\\"stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:op stig-manager:user stig-manager:stig\\\", \\\"auth_time\\\": 1742427221, \\\"given_name\\\": \\\"Admin\\\", \\\"family_name\\\": \\\"Burke\\\", \\\"realm_access\\\": {\\\"roles\\\": [\\\"create_collection\\\", \\\"admin\\\"]}, \\\"preferred_username\\\": \\\"admin\\\"}\",\"available\",\"2024-10-23 10:29:57\",null,87,\"admin\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n{\"table\":\"user_group\",\"columns\":\"`createdDate`,`createdUserId`,`description`,`modifiedDate`,`modifiedUserId`,`name`,`userGroupId`\",\"rowCount\":1}\n[\"2024-10-30 19:39:58\",87,\"TestGroup\",\"2024-10-30 19:39:58\",87,\"TestGroup\",1]\n{\"table\":\"user_group_user_map\",\"columns\":\"`ugumId`,`userGroupId`,`userId`\",\"rowCount\":1}\n[1,1,85]\n"
  },
  {
    "path": "test/api/appdata/batch-test-data.jsonl",
    "content": "{\"version\":\"1.6.2\",\"commit\":{\"branch\":\"na\",\"sha\":\"na\",\"tag\":\"na\",\"describe\":\"na\"},\"date\":\"2026-03-09T22:46:21.940Z\",\"lastMigration\":46}\n{\"tables\":[{\"table\":\"asset\",\"rowCount\":14},{\"table\":\"check_content\",\"rowCount\":615},{\"table\":\"collection\",\"rowCount\":7},{\"table\":\"collection_grant\",\"rowCount\":22},{\"table\":\"collection_grant_acl\",\"rowCount\":1},{\"table\":\"collection_label\",\"rowCount\":3},{\"table\":\"collection_label_asset_map\",\"rowCount\":3},{\"table\":\"collection_rev_map\",\"rowCount\":1},{\"table\":\"current_rev\",\"rowCount\":6},{\"table\":\"default_rev\",\"rowCount\":5},{\"table\":\"fix_text\",\"rowCount\":615},{\"table\":\"rev_group_rule_cci_map\",\"rowCount\":929},{\"table\":\"rev_group_rule_map\",\"rowCount\":703},{\"table\":\"review\",\"rowCount\":2},{\"table\":\"review_history\",\"rowCount\":1},{\"table\":\"revision\",\"rowCount\":7},{\"table\":\"rule_version_check_digest\",\"rowCount\":619},{\"table\":\"stig\",\"rowCount\":6},{\"table\":\"stig_asset_map\",\"rowCount\":10},{\"table\":\"user_data\",\"rowCount\":10},{\"table\":\"user_group\",\"rowCount\":0},{\"table\":\"user_group_user_map\",\"rowCount\":0}],\"totalRows\":3579}\n{\"table\":\"asset\",\"columns\":\"`assetId`,`collectionId`,`description`,`fqdn`,`ip`,`mac`,`metadata`,`name`,`noncomputing`,`state`,`stateDate`,`stateUserId`\",\"rowCount\":14}\n[29,21,\"\",null,\"10.0.0.18\",null,\"{}\",\"ACHERNAR_Collection_X_asset\",false,\"enabled\",null,null]\n[34,1,\"test desc\",null,\"1.1.1.1\",null,\"{}\",\"test asset stigmanadmin\",true,\"enabled\",null,null]\n[38,1,\"\",null,\"10.0.0.27\",null,\"{}\",\"FOMALHAUT\",false,\"enabled\",null,null]\n[42,21,\"\",null,\"\",null,\"{}\",\"Collection_X_lvl1_asset-1\",true,\"disabled\",\"2024-12-04 19:43:06\",87]\n[62,21,\"\",null,\"10.1.1.1\",null,\"{}\",\"Collection_X_asset\",false,\"enabled\",null,null]\n[153,83,\"\",null,\"\",null,\"{}\",\"Collection_Y_lvl_1_asset-1\",false,\"enabled\",null,null]\n[154,21,\"\",null,\"\",null,\"{}\",\"Collection_X_lvl1_asset-2\",false,\"disabled\",\"2024-12-04 19:43:06\",87]\n[240,83,\"\",null,\"\",null,\"{}\",\"Collection_Y_asset-noGrants\",false,\"enabled\",null,null]\n[241,1,\"test desc\",null,\"1.1.1.1\",null,\"{}\",\"test asset POST stigmanadmin\",true,\"enabled\",null,null]\n[242,85,\"\",null,\"\",null,\"{}\",\"testasset\",false,\"enabled\",null,null]\n[243,85,\"\",null,\"\",null,\"{}\",\"testasset111\",false,\"enabled\",null,null]\n[244,85,\"\",null,\"\",null,\"{}\",\"wat\",false,\"enabled\",null,null]\n[245,92,\"test desc\",null,\"\",null,\"{}\",\"testasset\",false,\"enabled\",null,null]\n[246,92,\"\",null,\"\",null,\"{}\",\"tesetest\",false,\"enabled\",null,null]\n{\"table\":\"check_content\",\"columns\":\"`ccId`,`content`\",\"rowCount\":615}\n[537,\"Verify the VPN Gateway has an inbound and outbound traffic security policy which is in compliance with information flow control policies (e.g., IPsec policy configuration).\\n\\nReview network device configurations and topology diagrams. Verify encapsulated or encrypted traffic received from other enclaves with different security policies terminate at the perimeter for filtering and content inspection by a firewall and IDPS before gaining access to the private network.\\n\\nIf the VPN Gateway does not ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies, this is a finding.\"]\n[618,\"This check content has been replaced!\"]\n[11447,\"Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution.\\n\\nIf there is no anti-virus solution installed on the system, this is a finding.\"]\n[37906,\"If the user/remote client connection banner is the same as the banner configured as part of the NDM SRG, then this is not applicable.\\n\\nDetermine if the network device is configured to present a DoD-approved banner that is formatted in accordance with DoD policy. \\n\\nIf the Remote Access VPN Gateway or VPN client does not display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network, this is a finding.\"]\n[37907,\"If the user/remote client connection banner is the same as the banner configured as part of the NDM SRG, then this is not applicable.\\n\\nVerify the ALG retains the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and takes explicit actions to log on for further access.\\n\\nIf the Remote Access VPN Gateway and/or client does not retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access, this is a finding.\"]\n[37908,\"Verify the publicly accessible VPN Gateway displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.  The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for network elements that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\\n\\nIf the publicly accessible VPN Gateway does not display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system, this is a finding.\"]\n[37909,\"Determine if the VPN Gateway is either configured to notify the administrator of the number of unsuccessful login attempts since the last successful login or configured to use an authentication server which would perform this function. If the administrator is not notified of the number of unsuccessful login attempts since the last successful login, this is a finding.\\n\\nIf the VPN Gateway does not notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access), this is a finding.\"]\n[37910,\"Inspect the VPN Gateway configuration. Verify the number of concurrent sessions for user accounts to 1 or to an organization-defined number (defined in the SSP).\\n\\nIf the VPN Gateway does not limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number, this is a finding.\"]\n[37911,\"Verify the TLS VPN Gateway is configured to use  TLS 1.2 or higher to protect the confidentiality of sensitive data during transmission.\\n\\nIf the TLS VPN Gateway does not use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during transmission, this is a finding.\"]\n[37912,\"Verify the remote access VPN Gateway uses a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.\\n\\nIf the remote access VPN Gateway does not use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions, this is a finding.\"]\n[37913,\"Verify the VPN Gateway uses IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.\\n\\nIf the VPN Gateway does not use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions, this is a finding.\"]\n[37914,\"Verify all IKE proposals are set to use a FIPS-validated dh-group.\\n\\nView the IKE options dh-group option.\\n\\nIf the IKE option is not set to a FIPS 140-2 validated dh-group, this is a finding.\"]\n[37915,\"Verify the VPN Gateway generates log records containing information to establish what type of events occurred.\\n\\nIf the VPN Gateway does not generate log records containing information to establish what type of events occurred, this is a finding.\"]\n[37916,\"Configure the VPN Gateway generates log records containing information to establish when (date and time) the events occurred.\\n\\nIf the VPN Gateway does not generate log records containing information to establish when (date and time) the events occurred, this is a finding.\"]\n[37917,\"Verify the VPN Gateway generates log records containing information that establishes the identity of any individual or process associated with the event.\\n\\nIf the VPN Gateway does not generate log records containing information that establishes the identity of any individual or process associated with the event, this is a finding.\"]\n[37918,\"Verify the VPN Gateway generates  log records containing information to establish where the events occurred.\\n\\nIf the VPN Gateway does not generate log records containing information to establish where the events occurred, this is a finding.\"]\n[37919,\"Verify the VPN Gateway  generates log records containing information to establish the source of the events.\\n\\nIf the VPN Gateway does not generate log records containing information to establish the source of the events, this is a finding.\"]\n[37920,\"Examine the log configuration on the VPN Gateway or view several alert events on the organization's central audit server. Alternatively, examine the Central Log Server to see if it contains information about success or failure of client connection attempts or other events.\\n\\nIf the traffic log entries do not include the success or failure of connection attempts and other events, this is a finding.\"]\n[37921,\"Verify the VPN Gateway protects log information from unauthorized read access if all or some of this data is stored locally.\\n\\nIf the VPN Gateway does not protect log information from unauthorized read access if all or some of this data is stored locally, this is a finding.\"]\n[37922,\"Verify the VPN Gateway log is configured to protect audit information from unauthorized modification when stored locally.\\n\\nThe VPN Gateway log must protect audit information from unauthorized modification when stored locally, this is a finding.\"]\n[37923,\"Verify the VPN Gateway is configured to protect audit information from unauthorized deletion when stored locally.\\n\\nIf the VPN Gateway does not protect audit information from unauthorized deletion when stored locally, this is a finding.\"]\n[37924,\"View the configured security  services.\\n\\nCompare the services that are enabled, including the port, services, protocols, and functions.\\n\\nIf functions, ports, protocols, and services identified on the PPSM CAL are not disabled, this is a finding.\"]\n[37925,\"Verify the IPsec VPN Gateway uses IKEv2 for IPsec VPN security associations.\\n\\nIf the IPsec VPN Gateway must use IKEv2 for IPsec VPN security associations, this is a finding.\"]\n[37926,\"Verify the VPN Gateway is configured to prohibit PPTP and L2F.\\n\\nIf the VPN Gateway does not be configured to prohibit PPTP and L2F, this is a finding.\"]\n[37927,\"If L2TP communications protocol is not used, this is not applicable.\\n\\nVerify the VPN Gateway or another network element (e.g., firewall) is configure to block or deny L2TP packets with a destination address within the private network of the enclave.\\n\\nIf L2TP communications are  allowed to cross the security boundary into the private network of the enclave, this is a finding.\"]\n[37928,\"Verify the VPN Gateway is configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).\\n\\nIf the VPN Gateway does not uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users), this is a finding.\"]\n[37929,\"Verify the VPN Gateway uses multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.\\n\\nIf the VPN Gateway does not use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts, this is a finding.\"]\n[37930,\"Verify the VPN Client implements multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.\\n\\nIf the VPN Client does not implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access, this is a finding.\"]\n[37931,\"Verify the TLS VPN Gateway is configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts.\\n\\nIf the TLS VPN is not configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts, this is a finding.\"]\n[37932,\"Verify the IPsec VPN Gateway  uses anti-replay mechanisms for security associations.\\n\\nIf the IPsec VPN Gateway does not use anti-replay mechanisms for security associations, this is a finding.\"]\n[37933,\"Verify the VPN Gateway uniquely identifies all network-connected endpoint devices before establishing a connection.\\n\\nIf the VPN Gateway does not uniquely identify all network-connected endpoint devices before establishing a connection, this is a finding.\"]\n[37934,\"Verify the VPN Gateway to use PKI-based authentication that validates certificates by constructing a certification path (which includes status information) to an accepted trust anchor.\\n\\nIf PKI-based authentication does not validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor, this is a finding.\"]\n[37935,\"If PKI-based authentication is not being used for device authentication, this is not applicable.\\n\\nVerify the site-to-site VPN that uses certificate-based device authentication uses a FIPS-compliant key management process.\\n\\nIf the site-to-site VPN that uses certificate-based device authentication does not use a FIPS-compliant key management process, this is a finding.\"]\n[37936,\"Verify the Remote Access VPN Gateway is configured to use a physically separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.\\n\\nIf the Remote Access VPN Gateway does not use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication, this is a finding.\"]\n[37937,\"Verify the VPN Gateway maps the authenticated identity to the user account for PKI-based authentication.\\n\\nIf the VPN Gateway does not map the authenticated identity to the user account for PKI-based authentication, this is a finding.\"]\n[37938,\"Verify the VPN Gateway uses FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).\\n\\nIf the VPN Gateway does not use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only), this is a finding.\"]\n[37939,\"Configure the VPN Gateway to uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).\\n\\nIf the VPN Gateway does not uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users), this is a finding.\"]\n[37940,\"Verify the VPN Gateway routes sessions to an IDPS for inspection.\\n\\nIf the VPN Gateway is not  configured to route sessions to an IDPS for inspection, this is a finding.\"]\n[37941,\"Verify the VPN Gateway terminates all network connections associated with a communications session at the end of the session.\\n\\nIf the VPN Gateway does not terminate all network connections associated with a communications session at the end of the session, this is a finding.\"]\n[37942,\"Verify the VPN Gateway uses FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.\\n\\nIf the VPN Gateway does not use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module, this is a finding.\"]\n[37943,\"Verify the IPsec VPN Gateway uses IKE with SHA1 or greater to protect the authenticity of communications sessions.\\n\\nIf the IPsec VPN Gateway is not configured to use IKE with SHA1 or greater to protect the authenticity of communications sessions, this is a finding.\"]\n[37944,\"Verify the VPN Gateway invalidates session identifiers upon user logoff or other session termination.\\n\\nIf the VPN Gateway does not invalidate session identifiers upon user logoff or other session termination, this is a finding.\"]\n[37945,\"Verify the VPN Gateway recognizes only system-generated session identifiers.\\n\\nIf the VPN Gateway does not recognize only system-generated session identifiers, this is a finding.\"]\n[37946,\"Verify the VPN Gateway generates unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.\\n\\nIf the VPN Gateway does not generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm, this is a finding.\"]\n[37947,\"Verify the VPN Gateway is configured to fail to a secure state if system initialization fails, shutdown fails, or aborts fail.\\n\\nIf the VPN Gateway does not fail to a secure state if system initialization fails, shutdown fails, or aborts fail, this is a finding.\"]\n[37948,\"Verify the VPN Gateway is configured to perform an organization-defined action if the audit reveals unauthorized activity.\\n\\nIf the VPN Gateway does not be configured to perform an organization-defined action if the audit reveals unauthorized activity, this is a finding.\"]\n[37949,\"Configure the VPN Gateway for functionality, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack. \\n\\nConfigure authorized system administrator accounts to allow them to disconnect or disable remote access to remove user under circumstances defined in the VPN SSP.\\n\\nIf the VPN Gateway administrator accounts or security policy is not configured to allow the system administrator to immediately disconnect or disable remote access to devices and/or users when needed, this is a finding.\"]\n[37950,\"Verify all IKE proposals are set to use the AES encryption algorithm.\\n\\nView the value of the encryption algorithm for each defined proposal.\\n\\nIf the value of the encryption algorithm for any IKE proposal is not set to use an AES algorithm, this is a finding.\"]\n[37951,\"Verify the VPN Gateway transmits organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.\\n\\nIf the VPN Gateway does not transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions, this is a finding.\"]\n[37952,\"Verity the VPN Gateway notifies the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).\\n\\nIf the VPN Gateway does not notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access), this is a finding.\"]\n[37953,\"Verify the VPN Gateway provides centralized management and configuration of the content to be captured in log records generated by all network components.\\n\\nIf the VPN Gateway does not provide centralized management and configuration of the content to be captured in log records generated by all network components, this is a finding.\"]\n[37954,\"Verify the VPN Gateway off-loads log records onto a different system or media than the system being audited.\\n\\nIf the VPN Gateway does not off-load audit records onto a different system or media than the system being audited, this is a finding.\"]\n[37955,\"Verify the VPN Gateway generates a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.\\n\\nIf the VPN Gateway does not generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server, this is a finding.\"]\n[37956,\"Verify that in the event that communications with the Central Log Server is lost, the VPN Gateway is configured to continue to queue traffic log records locally.\\n\\nIf the VPN Gateway does not continue to queue traffic log records locally when communications with the Central Log Server is lost, this is a finding.\"]\n[37957,\"Verify the IPsec VPN Gateway renegotiates the security association after 8 hours or less, or an organization-defined period.\\n\\nIf the IPsec VPN Gateway does not renegotiate the security association after 8 hours or less, or an organization-defined period, this is a finding.\"]\n[37958,\"Verify the VPN Gateway renegotiates the security association after 24 hours or less or as defined by the organization.\\n\\nIf the VPN Gateway does not renegotiate the security association after 24 hours or less or as defined by the organization, this is a finding.\"]\n[37959,\"Verify the VPN Gateway accepts Personal Identity Verification (PIV) credentials.\\n\\nIf the VPN Gateway does not accept Personal Identity Verification (PIV) credentials, this is a finding.\"]\n[37960,\"Verify the VPN Gateway electronically verifies Personal Identity Verification (PIV) credentials.\\n\\nIf the VPN Gateway does not electronically verify Personal Identity Verification (PIV) credentials, this is a finding.\"]\n[37961,\"Verity the VPN Gateway  authenticates all network-connected endpoint devices before establishing a connection.\\n\\nIf the VPN Gateway does not authenticate all network-connected endpoint devices before establishing a connection, this is a finding.\"]\n[37962,\"Verify the VPN Gateway uses an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.\\n\\nIf the VPN Gateway does not use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network, this is a finding.\"]\n[37963,\"Verify the VPN Gateway disables split-tunneling for remote clients VPNs.\\n\\nIf the VPN Gateway does not disable split-tunneling for remote clients VPNs, this is a finding.\"]\n[37964,\"Verify the IPsec VPN Gateway specifies Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.\\n\\nIf the IPsec VPN Gateway does not specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation, this is a finding.\"]\n[37965,\"Verify the VPN Gateway and the remote access client are configured to protect the confidentiality and integrity of transmitted information.\\n\\nIf VPN Gateway and Client does not protect the confidentiality and integrity of transmitted information, this is a finding.\"]\n[37966,\"Verify the IPsec VPN Gateway uses Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.\\n\\nIf the IPsec VPN Gateway must use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations, this is a finding.\"]\n[37967,\"For accounts using password authentication, verify the VPN Gateway uses FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.\\n\\nFor accounts using password authentication, if the VPN Gateway does not use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process, this is a finding.\"]\n[37968,\"Verify the VPN Gateway generates log records when successful and/or unsuccessful VPN connection attempts occur.\\n\\nIf the VPN Gateway does not generate log records when successful and/or unsuccessful VPN connection attempts occur, this is a finding.\"]\n[37969,\"Verify the VPN Gateway uses a FIPS-validated cryptographic module to generate cryptographic hashes.\\n\\nIf the VPN Gateway does not use a FIPS-validated cryptographic module to generate cryptographic hashes, this is a finding.\"]\n[37970,\"Verify the VPN Gateway uses a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.\\n\\nIf the VPN Gateway does not use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality, this is a finding.\"]\n[37971,\"Verify the IPsec VPN Gateway IKE uses a NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.\\n\\nIf the IPsec VPN Gateway IKE does not use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic, this is a finding.\"]\n[37972,\"Verify the IKE protocol is specified for all IPsec VPNs.\\n\\nIf the IKE protocol is not specified as an option on all VPN gateways, this is a finding.\"]\n[37973,\"Verify the VPN Gateway does not accept certificates that have been revoked when using PKI for authentication.\\n\\nIf the VPN Gateway accepts certificates that have been revoked when using PKI for authentication, this is a finding.\"]\n[37974,\"Verify the VPN Client logout function is configured to terminate the session on/with the VPN Gateway.\\n\\nIf the VPN Client logout function does not terminate the session on/with the VPN Gateway, this is a finding.\"]\n[37975,\"Verify the VPN Client displays an explicit logout message to users indicating the reliable termination of authenticated communications sessions.\\n\\nIf the VPN Client does not display an explicit logout message to users indicating the reliable termination of authenticated communications sessions, this is a finding.\"]\n[37976,\"Verify the VPN Gateway stores only cryptographic representations of the PSK.\\n\\nIf the VPN Gateway does not store only cryptographic representations of the PSK, this is a finding.\"]\n[37977,\"Verify all Internet Key Exchange (IKE) proposals are set to use the AES encryption algorithm.\\n\\nView the value of the encryption algorithm for each defined proposal.\\n\\nIf the value of the encryption algorithm for any IPsec proposal is not set to use an AES algorithm, this is a finding.\"]\n[37978,\"Verify the TLS VPN Gateway that supports Government-only services prohibits client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.\\n\\nIf the TLS VPN Gateway that supports Government-only services does not prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0, this is a finding.\"]\n[37979,\"Verify the TLS VPN Gateway that supports citizen- or business-facing network devices prohibits client negotiation to SSL 2.0 or SSL 3.0.\\n\\nIf the TLS VPN Gateway that supports citizen- or business-facing network devices does not prohibit client negotiation to SSL 2.0 or SSL 3.0, this is a finding.\"]\n[37980,\"Verify the VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) is configured to use SNMPv3 to use FIPS-validated AES cipher block algorithm.\\n\\nIf the VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) does not configure SNMPv3 to use FIPS-validated AES cipher block algorithm, this is a finding.\"]\n[37981,\"Verify the VPN Gateway uses an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.\\n\\nIf the VPN Gateway does not use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network, this is a finding.\"]\n[37982,\"Verify the IPsec VPN Gateway Internet Key Exchange (IKE) uses cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.\\n\\nIf the IPsec VPN Gateway Internet Key Exchange (IKE) does not use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network, this is a finding.\"]\n[37983,\"Verify the VPN Gateway validates TLS certificates by performing RFC 5280-compliant certification path validation.\\n\\nIf the VPN Gateway does not validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation, this is a finding.\"]\n[37984,\"Verify the VPN Gateway uses FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).\\n\\nIf the VPN Gateway does not use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use), this is a finding.\"]\n[37985,\"If L2TP communications protocol is not used, this is not applicable.\\n\\nVerify L2TPv3 sessions are configured to authenticate the traffic before transit. L2TPv3 sessions must be authenticated prior to transporting traffic.\\n\\nIf L2TPv3 sessions do not require authentication, this is a finding.\"]\n[37992,\"Verify xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx the VPN Gateway has an inbound and outbound traffic security policy which is in compliance with information flow control policies (e.g., IPsec policy configuration).\\n\\nReview network device configurations and topology diagrams. Verify encapsulated or encrypted traffic received from other enclaves with different security policies terminate at the perimeter for filtering and content inspection by a firewall and IDPS before gaining access to the private network.\\n\\nIf the VPN Gateway does not ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies, this is a finding.\"]\n[41183,\"Verify domain-joined systems are using Windows 10 Enterprise Edition 64-bit version.\\n\\nFor standalone systems, this is NA.\\n\\nOpen \\\"Settings\\\".\\n\\nSelect \\\"System\\\", then \\\"About\\\".\\n\\nIf \\\"Edition\\\" is not \\\"Windows 10 Enterprise\\\", this is a finding.\\n\\nIf \\\"System type\\\" is not \\\"64-bit operating system…\\\", this is a finding.\"]\n[41184,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Installer\\\\\\n\\nValue Name: EnableUserControl\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41185,\"Verify domain-joined systems have a TPM enabled and ready for use.\\n\\nFor standalone systems, this is NA.\\n\\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nVerify the system has a TPM and is ready for use.\\nRun \\\"tpm.msc\\\".\\nReview the sections in the center pane.\\n\\\"Status\\\" must indicate it has been configured with a message such as \\\"The TPM is ready for use\\\" or \\\"The TPM is on and ownership has been taken\\\".\\nTPM Manufacturer Information - Specific Version = 2.0 or 1.2\\n\\nIf a TPM is not found or is not ready for use, this is a finding.\"]\n[41186,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Installer\\\\\\n\\nValue Name: AlwaysInstallElevated\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41187,\"The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system.\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Installer\\\\\\n\\nValue Name: SafeForScripting\\n\\nValue Type: REG_DWORD\\nValue: 0 (or if the Value Name does not exist)\"]\n[41188,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: DisableAutomaticRestartSignOn\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41189,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Client\\\\\\n\\nValue Name: AllowBasic\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41190,\"Verify all Windows 10 information systems (including SIPRNet) employ BitLocker for full disk encryption.\\n\\nFor virtual desktop implementations (VDIs) in which the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nIf full disk encryption using BitLocker is not implemented, this is a finding.\\n\\nVerify BitLocker is turned on for the operating system drive and any fixed data drives.\\n\\nOpen \\\"BitLocker Drive Encryption\\\" from the Control Panel.\\n\\nIf the operating system drive or any fixed data drives have \\\"Turn on BitLocker\\\", this is a finding.\\n\\nNOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).\"]\n[41191,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Client\\\\\\n\\nValue Name: AllowUnencryptedTraffic\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41192,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Client\\\\\\n\\nValue Name: AllowDigest\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41193,\"Verify DoD approved HBSS software is installed, configured, and properly operating. Ask the operator to document the HBSS software installation and configuration.\\n\\nIf the operator is not able to provide a documented configuration for an installed HBSS or if the HBSS software is not properly configured, maintained, or used, this is a finding.\"]\n[41194,\"This is applicable to unclassified systems; for other systems this is NA.\\n\\nVerify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. This must include packaged apps such as the universals apps installed by default on systems.\\n\\nIf an application whitelisting program is not in use on the system, this is a finding.\\n\\nConfiguration of whitelisting applications will vary by the program.\\n\\nAppLocker is a whitelisting application built into Windows 10 Enterprise.  A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules.\\n\\nIf AppLocker is used, perform the following to view the configuration of AppLocker:\\nRun \\\"PowerShell\\\".\\n\\nExecute the following command, substituting [c:\\\\temp\\\\file.xml] with a location and file name appropriate for the system:\\nGet-AppLockerPolicy -Effective -XML > c:\\\\temp\\\\file.xml\\n\\nThis will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review.\\n\\nImplementation guidance for AppLocker is available in the NSA paper \\\"Application Whitelisting using Microsoft AppLocker\\\" at the following link:\\n\\nhttps://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm\"]\n[41195,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Service\\\\\\n\\nValue Name: AllowBasic\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41196,\"Run \\\"winver.exe\\\".\\n\\nIf the \\\"About Windows\\\" dialog box does not display:\\n\\n\\\"Microsoft Windows Version 1803 (OS Build 17134.0)\\\"\\n\\nor greater, this is a finding.\\n\\nNote: Microsoft has extended support for previous versions providing critical and important updates for Windows 10 Enterprise.\\n\\nMicrosoft scheduled end of support dates for current Semi-Annual Channel versions:\\nv1709 - 13 October 2020\\nv1803 - 10 November 2020\\nv1809 - 13 April 2021\\nv1903 - 8 December 2020\\n\\nNo preview versions will be used in a production environment.\\n\\nSpecial purpose systems using the Long-Term Servicing Branch\\\\Channel (LTSC\\\\B) may be at following versions which are not a finding:\\n\\nv1507 (Build 10240)\\nv1607 (Build 14393)\\nv1809 (Build 17763)\"]\n[41197,\"Run \\\"Computer Management\\\".\\nNavigate to Storage >> Disk Management.\\n\\nIf the \\\"File System\\\" column does not indicate \\\"NTFS\\\" for each volume assigned a drive letter, this is a finding.\\n\\nThis does not apply to system partitions such the Recovery and EFI System Partition.\"]\n[41198,\"Verify the system does not include other operating system installations.\\n\\nRun \\\"Advanced System Settings\\\".\\nSelect the \\\"Advanced\\\" tab.\\nClick the \\\"Settings\\\" button in the \\\"Startup and Recovery\\\" section.\\n\\nIf the drop-down list box \\\"Default operating system:\\\" shows any operating system other than Windows 10, this is a finding.\"]\n[41199,\"Non system-created shares should not typically exist on workstations.\\n\\nIf only system-created shares exist on the system this is NA.\\n\\nRun \\\"Computer Management\\\".\\nNavigate to System Tools >> Shared Folders >> Shares.\\n\\nIf the only shares listed are \\\"ADMIN$\\\", \\\"C$\\\" and \\\"IPC$\\\", this is NA.\\n(Selecting Properties for system-created shares will display a message that it has been shared for administrative purposes.)\\n\\nRight click any non-system-created shares.\\nSelect \\\"Properties\\\".\\nSelect the \\\"Share Permissions\\\" tab.\\n\\nVerify the necessity of any shares found.\\nIf the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.\\n\\nSelect the \\\"Security\\\" tab.\\n\\nIf the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.\"]\n[41200,\"Run \\\"PowerShell\\\".\\nCopy the lines below to the PowerShell window and enter.\\n\\n\\\"([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach {\\n   $user = ([ADSI]$_.Path)\\n   $lastLogin = $user.Properties.LastLogin.Value\\n   $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2\\n   if ($lastLogin -eq $null) {\\n      $lastLogin = 'Never'\\n   }\\n   Write-Host $user.Name $lastLogin $enabled \\n}\\\"\\n\\nThis will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False).\\nFor example: User1  10/31/2015  5:49:56  AM  True\\n\\nReview the list to determine the finding validity for each account reported.\\n\\nExclude the following accounts:\\nBuilt-in administrator account (Disabled, SID ending in 500)\\nBuilt-in guest account (Disabled, SID ending in 501)\\nBuilt-in DefaultAccount (Disabled, SID ending in 503)\\nLocal administrator account\\n\\nIf any enabled accounts have not been logged on to within the past 35 days, this is a finding.\\n\\nInactive accounts that have been reviewed and deemed to be required must be documented with the ISSO.\"]\n[41201,\"Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Groups.\\nReview the members of the Administrators group.\\nOnly the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.\\n\\nFor domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.\\n\\nStandard user accounts must not be members of the local administrator group.\\n\\nIf prohibited accounts are members of the local administrators group, this is a finding.\\n\\nThe built-in Administrator account or other required administrative accounts would not be a finding.\"]\n[41202,\"Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Groups.\\nReview the members of the Backup Operators group.\\n\\nIf the group contains no accounts, this is not a finding.\\n\\nIf the group contains any accounts, the accounts must be specifically for backup functions.\\n\\nIf the group contains any standard user accounts used for performing normal user tasks, this is a finding.\"]\n[41203,\"If a hosted hypervisor (Hyper-V, VMware Workstation, etc.) is installed on the system, verify only authorized user accounts are allowed to run virtual machines.\\n\\nFor Hyper-V, Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Groups.\\nDouble click on \\\"Hyper-V Administrators\\\".\\n\\nIf any unauthorized groups or user accounts are listed in \\\"Members:\\\", this is a finding.\\n\\nFor hosted hypervisors other than Hyper-V, verify only authorized user accounts have access to run the virtual machines. Restrictions may be enforced by access to the physical system, software restriction policies, or access restrictions built in to the application.\\n\\nIf any unauthorized groups or user accounts have access to create or run virtual machines, this is a finding.\\n\\nAll users authorized to create or run virtual machines must be documented with the ISSM/ISSO. Accounts nested within group accounts must be documented as individual accounts and not the group accounts.\"]\n[41204,\"Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Users.\\n\\nIf local users other than the accounts listed below exist on a workstation in a domain, this is a finding.\\n\\nBuilt-in Administrator account (Disabled)\\nBuilt-in Guest account (Disabled)\\nBuilt-in DefaultAccount (Disabled)\\nBuilt-in defaultuser0 (Disabled)\\nBuilt-in WDAGUtilityAccount (Disabled)\\nLocal administrator account(s)\\n\\nAll of the built-in accounts may not exist on a system, depending on the Windows 10 version.\"]\n[41205,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Service\\\\\\n\\nValue Name: AllowUnencryptedTraffic\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41206,\"Run \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Users.\\nDouble click each active account.\\n\\nIf \\\"Password never expires\\\" is selected for any account, this is a finding.\"]\n[41207,\"The default file system permissions are adequate when the Security Option \\\"Network access: Let Everyone permissions apply to anonymous users\\\" is set to \\\"Disabled\\\" (WN10-SO-000160).\\n\\nIf the default file system permissions are maintained and the referenced option is set to \\\"Disabled\\\", this is not a finding.\\n\\nVerify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)\\n\\nViewing in File Explorer:\\nSelect the \\\"Security\\\" tab, and the \\\"Advanced\\\" button.\\n\\nC:\\\\\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nAdministrators - Full control - This folder, subfolders and files\\nSYSTEM - Full control - This folder, subfolders and files\\nUsers - Read & execute - This folder, subfolders and files\\nAuthenticated Users - Modify - Subfolders and files only\\nAuthenticated Users - Create folders / append data - This folder only\\n\\n\\\\Program Files\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nTrustedInstaller - Full control - This folder and subfolders\\nSYSTEM - Modify - This folder only\\nSYSTEM - Full control - Subfolders and files only\\nAdministrators - Modify - This folder only\\nAdministrators - Full control - Subfolders and files only\\nUsers - Read & execute - This folder, subfolders and files\\nCREATOR OWNER - Full control - Subfolders and files only\\nALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files\\nALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders and files\\n\\n\\\\Windows\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nTrustedInstaller - Full control - This folder and subfolders\\nSYSTEM - Modify - This folder only\\nSYSTEM - Full control - Subfolders and files only\\nAdministrators - Modify - This folder only\\nAdministrators - Full control - Subfolders and files only\\nUsers - Read & execute - This folder, subfolders and files\\nCREATOR OWNER - Full control - Subfolders and files only\\nALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files\\nALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders and files\\n\\nAlternately use icacls.\\n\\nRun \\\"CMD\\\" as administrator.\\nEnter \\\"icacls\\\" followed by the directory.\\n\\nicacls c:\\\\\\nicacls \\\"c:\\\\program files\\\"\\nicacls c:\\\\windows\\n\\nThe following results will be displayed as each is entered:\\n\\nc:\\\\\\nBUILTIN\\\\Administrators:(OI)(CI)(F)\\nNT AUTHORITY\\\\SYSTEM:(OI)(CI)(F)\\nBUILTIN\\\\Users:(OI)(CI)(RX)\\nNT AUTHORITY\\\\Authenticated Users:(OI)(CI)(IO)(M)\\nNT AUTHORITY\\\\Authenticated Users:(AD)\\nMandatory Label\\\\High Mandatory Level:(OI)(NP)(IO)(NW)\\nSuccessfully processed 1 files; Failed processing 0 files\\n\\nc:\\\\program files \\nNT SERVICE\\\\TrustedInstaller:(F)\\nNT SERVICE\\\\TrustedInstaller:(CI)(IO)(F)\\nNT AUTHORITY\\\\SYSTEM:(M)\\nNT AUTHORITY\\\\SYSTEM:(OI)(CI)(IO)(F)\\nBUILTIN\\\\Administrators:(M)\\nBUILTIN\\\\Administrators:(OI)(CI)(IO)(F)\\nBUILTIN\\\\Users:(RX)\\nBUILTIN\\\\Users:(OI)(CI)(IO)(GR,GE)\\nCREATOR OWNER:(OI)(CI)(IO)(F)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES:(RX)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL RESTRICTED APPLICATION PACKAGES:(RX)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\\nSuccessfully processed 1 files; Failed processing 0 files\\n\\nc:\\\\windows\\nNT SERVICE\\\\TrustedInstaller:(F)\\nNT SERVICE\\\\TrustedInstaller:(CI)(IO)(F)\\nNT AUTHORITY\\\\SYSTEM:(M)\\nNT AUTHORITY\\\\SYSTEM:(OI)(CI)(IO)(F)\\nBUILTIN\\\\Administrators:(M)\\nBUILTIN\\\\Administrators:(OI)(CI)(IO)(F)\\nBUILTIN\\\\Users:(RX)\\nBUILTIN\\\\Users:(OI)(CI)(IO)(GR,GE)\\nCREATOR OWNER:(OI)(CI)(IO)(F)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES:(RX)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL RESTRICTED APPLICATION PACKAGES:(RX)\\nAPPLICATION PACKAGE AUTHORITY\\\\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\\nSuccessfully processed 1 files; Failed processing 0 files\"]\n[41208,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Service\\\\\\n\\nValue Name: DisableRunAs\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41209,\"IIS is not installed by default.  Verify it has not been installed on the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows features on or off\\\".\\n\\nIf the entries for \\\"Internet Information Services\\\" or \\\"Internet Information Services Hostable Web Core\\\" are selected, this is a finding.\\n\\nIf an application requires IIS or a subset to be installed to function, this needs be documented with the ISSO.  In addition, any applicable requirements from the IIS STIG must be addressed.\"]\n[41210,\"\\\"SNMP\\\" is not installed by default.  Verify it has not been installed.\\n\\nNavigate to the Windows\\\\System32 directory.\\n\\nIf the \\\"SNMP\\\" application exists, this is a finding.\"]\n[41211,\"\\\"Simple TCP/IP Services\\\" is not installed by default.  Verify it has not been installed.\\n\\nRun \\\"Services.msc\\\".\\n\\nIf \\\"Simple TCP/IP Services\\\" is listed, this is a finding.\"]\n[41212,\"The \\\"Telnet Client\\\" is not installed by default.  Verify it has not been installed.\\n\\nNavigate to the Windows\\\\System32 directory.\\n\\nIf the \\\"telnet\\\" application exists, this is a finding.\"]\n[41213,\"The \\\"TFTP Client\\\" is not installed by default.  Verify it has not been installed.\\n\\nNavigate to the Windows\\\\System32 directory.\\n\\nIf the \\\"TFTP\\\" application exists, this is a finding.\"]\n[41214,\"Search all drives for *.p12 and *.pfx files.\\n\\nIf any files with these extensions exist, this is a finding.\\n\\nThis does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.\"]\n[41215,\"Determine if a host-based firewall is installed and enabled on the system.  If a host-based firewall is not installed and enabled on the system, this is a finding.\\n\\nThe configuration requirements will be determined by the applicable firewall STIG.\"]\n[41216,\"Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts.\\n\\nIf allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding.\\n\\nReview inbound firewall exceptions.\\nComputer Configuration >> Windows Settings >> Security Settings >> Windows Defender Firewall with Advanced Security >> Windows Defender Firewall with Advanced Security >> Inbound Rules (this link will be in the right pane)\\n\\nFor any inbound rules that allow connections view the Scope for Remote IP address. This may be defined as an IP address, subnet, or range. The rule must apply to all firewall profiles.\\n\\nIf a third-party firewall is used, ensure comparable settings are in place.\"]\n[41217,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy.\\n\\nIf the \\\"Account lockout duration\\\" is less than \\\"15\\\" minutes (excluding \\\"0\\\"), this is a finding.\\n\\nConfiguring this to \\\"0\\\", requiring an administrator to unlock the account, is more restrictive and is not a finding.\"]\n[41218,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy.\\n\\nIf the \\\"Account lockout threshold\\\" is \\\"0\\\" or more than \\\"3\\\" attempts, this is a finding.\"]\n[41219,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy.\\n\\nIf the \\\"Reset account lockout counter after\\\" value is less than \\\"15\\\" minutes, this is a finding.\"]\n[41220,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for \\\"Enforce password history\\\" is less than \\\"24\\\" passwords remembered, this is a finding.\"]\n[41221,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for the \\\"Maximum password age\\\" is greater than \\\"60\\\" days, this is a finding.  If the value is set to \\\"0\\\" (never expires), this is a finding.\"]\n[41222,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for the \\\"Minimum password age\\\" is less than \\\"1\\\" day, this is a finding.\"]\n[41223,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for the \\\"Minimum password length,\\\" is less than \\\"14\\\" characters, this is a finding.\"]\n[41224,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for \\\"Password must meet complexity requirements\\\" is not set to \\\"Enabled\\\", this is a finding.\\n\\nIf the site is using a password filter that requires this setting be set to \\\"Disabled\\\" for the filter to be used, this would not be considered a finding.\"]\n[41225,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\\n\\nIf the value for \\\"Store password using reversible encryption\\\" is not set to \\\"Disabled\\\", this is a finding.\"]\n[41226,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nAccount Logon >> Credential Validation - Failure\"]\n[41227,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nAccount Logon >> Credential Validation - Success\"]\n[41228,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nAccount Management >> Security Group Management - Success\"]\n[41229,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nAccount Management >> User Account Management - Failure\"]\n[41230,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nAccount Management >> User Account Management - Success\"]\n[41231,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nDetailed Tracking >> Plug and Play Events - Success\"]\n[41232,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nDetailed Tracking >> Process Creation - Success\"]\n[41233,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Group Membership - Success\"]\n[41234,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Logoff - Success\"]\n[41235,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Logon - Failure\"]\n[41236,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Logon - Success\"]\n[41237,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Special Logon - Success\"]\n[41238,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nObject Access >> Removable Storage - Failure\\n\\nSome virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.  This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.\"]\n[41239,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nObject Access >> Removable Storage - Success\\n\\nSome virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.  This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.\"]\n[41240,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nPolicy Change >> Audit Policy Change - Success\"]\n[41241,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nPolicy Change >> Authentication Policy Change - Success\"]\n[41242,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nPrivilege Use >> Sensitive Privilege Use - Failure\"]\n[41243,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nPrivilege Use >> Sensitive Privilege Use - Success\"]\n[41244,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> IPSec Driver - Failure\"]\n[41245,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> Other System Events - Success\"]\n[41246,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> Other System Events - Failure\"]\n[41247,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> Security State Change - Success\"]\n[41248,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> Security System Extension - Success\"]\n[41249,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> System Integrity - Failure\"]\n[41250,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\\n\\nSystem >> System Integrity - Success\"]\n[41251,\"If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\EventLog\\\\Application\\\\\\n\\nValue Name:  MaxSize\\n\\nValue Type:  REG_DWORD\\nValue:  0x00008000 (32768) (or greater)\"]\n[41252,\"If the system is configured to send audit records directly to an audit server, this is NA. This must be documented with the ISSO.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\EventLog\\\\Security\\\\\\n\\nValue Name: MaxSize\\n\\nValue Type: REG_DWORD\\nValue: 0x000fa000 (1024000) (or greater)\"]\n[41253,\"If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\EventLog\\\\System\\\\\\n\\nValue Name:  MaxSize\\n\\nValue Type:  REG_DWORD\\nValue:  0x00008000 (32768) (or greater)\"]\n[41254,\"Verify the permissions on the Application event log (Application.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory. They may have been moved to another folder.\\n\\nIf the permissions for these files are not as restrictive as the ACLs listed, this is a finding.\\n\\nNOTE: If \\\"APPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES\\\" has Special Permissions, this would not be a finding.\"]\n[41255,\"Verify the permissions on the Security event log (Security.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory. They may have been moved to another folder.\\n\\nIf the permissions for these files are not as restrictive as the ACLs listed, this is a finding.\\n\\nNOTE: If \\\"APPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES\\\" has Special Permissions, this would not be a finding.\"]\n[41256,\"Verify the permissions on the System event log (System.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory. They may have been moved to another folder.\\n\\nIf the permissions for these files are not as restrictive as the ACLs listed, this is a finding.\\n\\nNOTE: If \\\"APPLICATION PACKAGE AUTHORITY\\\\ALL APPLICATION PACKAGES\\\" has Special Permissions, this would not be a finding.\"]\n[41257,\"If the device does not have a camera, this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Personalization\\\\\\n\\nValue Name: NoLockScreenCamera\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41258,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Personalization\\\\\\n\\nValue Name: NoLockScreenSlideshow\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41259,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip6\\\\Parameters\\\\\\n\\nValue Name: DisableIpSourceRouting\\n\\nValue Type: REG_DWORD\\nValue: 2\"]\n[41260,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters\\\\\\n\\nValue Name: DisableIPSourceRouting\\n\\nValue Type: REG_DWORD\\nValue: 2\"]\n[41261,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters\\\\\\n\\nValue Name: EnableICMPRedirect\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41262,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netbt\\\\Parameters\\\\\\n\\nValue Name:  NoNameReleaseOnDemand\\n\\nValue Type:  REG_DWORD\\nValue:  1\"]\n[41263,\"Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\LanmanWorkstation\\\\\\n\\nValue Name: AllowInsecureGuestAuth\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[41264,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nIf the following registry values do not exist or are not configured as specified, this is a finding.\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\NetworkProvider\\\\HardenedPaths\\\\\\n\\nValue Name:  \\\\\\\\*\\\\NETLOGON\\nValue Type:  REG_SZ\\nValue:  RequireMutualAuthentication=1, RequireIntegrity=1\\n\\nValue Name:  \\\\\\\\*\\\\SYSVOL\\nValue Type:  REG_SZ\\nValue:  RequireMutualAuthentication=1, RequireIntegrity=1\\n\\nAdditional entries would not be a finding.\"]\n[41265,\"Verify the DoD Root CA certificates are installed as Trusted Root Certification Authorities.\\n\\nThe certificates and thumbprints referenced below apply to unclassified systems; see PKE documentation for other networks.\\n\\nRun \\\"PowerShell\\\" as an administrator.\\n\\nExecute the following command:\\n\\nGet-ChildItem -Path Cert:Localmachine\\\\root | Where Subject -Like \\\"*DoD*\\\" | FL Subject, Thumbprint, NotAfter\\n\\nIf the following certificate \\\"Subject\\\" and \\\"Thumbprint\\\" information is not displayed, this is finding. \\n\\nIf an expired certificate (\\\"NotAfter\\\" date) is not listed in the results, this is not a finding.\\n\\nSubject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561\\nNotAfter: 12/5/2029\\n\\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB\\nNotAfter: 12/30/2029\\n\\nSubject: CN=DoD Root CA 4, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026\\nNotAfter: 7/25/2032\\n\\nSubject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B\\nNotAfter: 6/14/2041\\n\\nAlternately use the Certificates MMC snap-in:\\n\\nRun \\\"MMC\\\".\\n\\nSelect \\\"File\\\", \\\"Add/Remove Snap-in\\\".\\n\\nSelect \\\"Certificates\\\", click \\\"Add\\\".\\n\\nSelect \\\"Computer account\\\", click \\\"Next\\\".\\n\\nSelect \\\"Local computer: (the computer this console is running on)\\\", click \\\"Finish\\\".\\n\\nClick \\\"OK\\\".\\n\\nExpand \\\"Certificates\\\" and navigate to \\\"Trusted Root Certification Authorities >> Certificates\\\".\\n\\nFor each of the DoD Root CA certificates noted below:\\n\\nRight-click on the certificate and select \\\"Open\\\".\\n\\nSelect the \\\"Details\\\" Tab.\\n\\nScroll to the bottom and select \\\"Thumbprint\\\".\\n\\nIf the DoD Root CA certificates below are not listed or the value for the \\\"Thumbprint\\\" field is not as noted, this is a finding.\\n\\nIf an expired certificate (\\\"Valid to\\\" date) is not listed in the results, this is not a finding.\\n\\nDoD Root CA 2\\nThumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561\\nValid to: Wednesday, December 5, 2029\\n\\nDoD Root CA 3\\nThumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB\\nValid to: Sunday, December 30, 2029\\n\\nDoD Root CA 4\\nThumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026\\nValid to: Sunday, July 25, 2032\\n\\nDoD Root CA 5\\nThumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B\\nValid to: Friday, June 14, 2041\"]\n[41266,\"The default behavior for \\\"Minimize the number of simultaneous connections to the Internet or a Windows Domain\\\" is \\\"Enabled\\\".\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WcmSvc\\\\GroupPolicy\\\\\\n\\nValue Name: fMinimizeConnections\\n\\nValue Type: REG_DWORD\\nValue: 1 (or if the Value Name does not exist)\"]\n[41267,\"Verify the ECA Root CA certificates are installed on unclassified systems as Trusted Root Certification Authorities.\\n\\nRun \\\"PowerShell\\\" as an administrator.\\n\\nExecute the following command:\\n\\nGet-ChildItem -Path Cert:Localmachine\\\\root | Where Subject -Like \\\"*ECA*\\\" | FL Subject, Thumbprint, NotAfter\\n\\nIf the following certificate \\\"Subject\\\" and \\\"Thumbprint\\\" information is not displayed, this is finding. \\n\\nIf an expired certificate (\\\"NotAfter\\\" date) is not listed in the results, this is not a finding.\\n\\nSubject: CN=ECA Root CA 2, OU=ECA, O=U.S. Government, C=US\\nThumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4\\nNotAfter: 3/30/2028\\n\\nSubject: CN=ECA Root CA 4, OU=ECA, O=U.S. Government, C=US\\nThumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582\\nNotAfter: 12/30/2029\\n\\nAlternately use the Certificates MMC snap-in:\\n\\nRun \\\"MMC\\\".\\n\\nSelect \\\"File\\\", \\\"Add/Remove Snap-in\\\".\\n\\nSelect \\\"Certificates\\\", click \\\"Add\\\".\\n\\nSelect \\\"Computer account\\\", click \\\"Next\\\".\\n\\nSelect \\\"Local computer: (the computer this console is running on)\\\", click \\\"Finish\\\".\\n\\nClick \\\"OK\\\".\\n\\nExpand \\\"Certificates\\\" and navigate to \\\"Trusted Root Certification Authorities >> Certificates\\\".\\n\\nFor each of the ECA Root CA certificates noted below:\\n\\nRight-click on the certificate and select \\\"Open\\\".\\n\\nSelect the \\\"Details\\\" Tab.\\n\\nScroll to the bottom and select \\\"Thumbprint\\\".\\n\\nIf the ECA Root CA certificates below are not listed or the value for the \\\"Thumbprint\\\" field is not as noted, this is a finding.\\n\\nIf an expired certificate (\\\"Valid to\\\" date) is not listed in the results, this is not a finding.\\n\\nECA Root CA 2\\nThumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4\\nValid to: Thursday, March 30, 2028\\n\\nECA Root CA 4\\nThumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582\\nValid to: Sunday, December 30, 2029\"]\n[41268,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WcmSvc\\\\GroupPolicy\\\\\\n\\nValue Name: fBlockNonDomain\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41269,\"Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates.\\n\\nRun \\\"PowerShell\\\" as an administrator.\\n\\nExecute the following command:\\n\\nGet-ChildItem -Path Cert:Localmachine\\\\disallowed | Where {$_.Issuer -Like \\\"*DoD Interoperability*\\\" -and $_.Subject -Like \\\"*DoD*\\\"} | FL Subject, Issuer, Thumbprint, NotAfter\\n\\nIf the following certificate \\\"Subject\\\", \\\"Issuer\\\", and \\\"Thumbprint\\\", information is not displayed, this is finding. \\n\\nIf an expired certificate (\\\"NotAfter\\\" date) is found, this is a finding.\\n\\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nIssuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341\\nNotAfter: 1/22/2022\\n \\nSubject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nIssuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nThumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02\\nNotAfter: 8/26/2022 \\n\\nAlternately use the Certificates MMC snap-in:\\n\\nRun \\\"MMC\\\".\\n\\nSelect \\\"File\\\", \\\"Add/Remove Snap-in\\\".\\n\\nSelect \\\"Certificates\\\", click \\\"Add\\\".\\n\\nSelect \\\"Computer account\\\", click \\\"Next\\\".\\n\\nSelect \\\"Local computer: (the computer this console is running on)\\\", click \\\"Finish\\\".\\n\\nClick \\\"OK\\\".\\n\\nExpand \\\"Certificates\\\" and navigate to \\\"Untrusted Certificates >> Certificates\\\".\\n\\nFor each certificate with \\\"DoD Root CA…\\\" under \\\"Issued To\\\" and \\\"DoD Interoperability Root CA…\\\" under \\\"Issued By\\\":\\n\\nRight-click on the certificate and select \\\"Open\\\".\\n\\nSelect the \\\"Details\\\" Tab.\\n\\nScroll to the bottom and select \\\"Thumbprint\\\".\\n\\nIf the certificates below are not listed or the value for the \\\"Thumbprint\\\" field is not as noted, this is a finding.\\n\\nIf an expired certificate (\\\"Valid to\\\" date) is not listed in the results, this is not a finding.\\n\\nIssued To: DoD Root CA 2\\nIssued By: DoD Interoperability Root CA 1\\nThumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02\\nValid to: Friday, August 26, 2022\\n\\nIssued To: DoD Root CA 3\\nIssued By: DoD Interoperability Root CA 2\\nThumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341\\nValid to: Saturday, January 22, 2022\"]\n[41270,\"Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate.\\n\\nRun \\\"PowerShell\\\" as an administrator.\\n\\nExecute the following command:\\n\\nGet-ChildItem -Path Cert:Localmachine\\\\disallowed | Where Issuer -Like \\\"*CCEB Interoperability*\\\" | FL Subject, Issuer, Thumbprint, NotAfter\\n\\nIf the following certificate \\\"Subject\\\", \\\"Issuer\\\", and \\\"Thumbprint\\\", information is not displayed, this is finding. \\n\\nIf an expired certificate (\\\"NotAfter\\\" date) is found, this is a finding.\\n\\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nIssuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S.Government, C=US\\nThumbprint: AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9\\nNotAfter: 8/26/2022 9:07:50 AM\\n\\nAlternately use the Certificates MMC snap-in:\\n\\nRun \\\"MMC\\\".\\n\\nSelect \\\"File\\\", \\\"Add/Remove Snap-in\\\".\\n\\nSelect \\\"Certificates\\\", click \\\"Add\\\".\\n\\nSelect \\\"Computer account\\\", click \\\"Next\\\".\\n\\nSelect \\\"Local computer: (the computer this console is running on)\\\", click \\\"Finish\\\".\\n\\nClick \\\"OK\\\".\\n\\nExpand \\\"Certificates\\\" and navigate to \\\"Untrusted Certificates >> Certificates\\\".\\n\\nFor each certificate with \\\"US DoD CCEB Interoperability Root CA …\\\" under \\\"Issued By\\\":\\n\\nRight-click on the certificate and select \\\"Open\\\".\\n\\nSelect the \\\"Details\\\" tab.\\n\\nScroll to the bottom and select \\\"Thumbprint\\\".\\n\\nIf the certificate below is not listed or the value for the \\\"Thumbprint\\\" field is not as noted, this is a finding.\\n\\nIf an expired certificate (\\\"Valid to\\\" date) is not listed in the results, this is not a finding.\\n\\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\\nIssuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S.Government, C=US\\nThumbprint: AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9\\nNotAfter: 8/26/2022 9:07:50 AM\"]\n[41271,\"This is NA as of v1803 of Windows 10; Wi-Fi sense is no longer available.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\WcmSvc\\\\wifinetworkmanager\\\\config\\\\\\n\\nValue Name: AutoConnectAllowedOEM\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[41272,\"Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.\\n\\nIf any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.\\n\\nRun \\\"Regedit\\\".\\nRight click on the registry areas noted below.\\nSelect \\\"Permissions...\\\" and the \\\"Advanced\\\" button.\\n\\nHKEY_LOCAL_MACHINE\\\\SECURITY\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nSYSTEM - Full Control - This key and subkeys\\nAdministrators - Special - This key and subkeys\\n\\nHKEY_LOCAL_MACHINE\\\\SOFTWARE\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nUsers - Read - This key and subkeys\\nAdministrators - Full Control - This key and subkeys\\nSYSTEM - Full Control - This key and subkeys\\nCREATOR OWNER - Full Control - This key and subkeys\\nALL APPLICATION PACKAGES - Read - This key and subkeys\\n\\nHKEY_LOCAL_MACHINE\\\\SYSTEM\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nUsers - Read - This key and subkeys\\nAdministrators - Full Control - This key and subkeys\\nSYSTEM - Full Control - This key and subkeys\\nCREATOR OWNER - Full Control - This key and subkeys\\nALL APPLICATION PACKAGES - Read - This key and subkeys\\n\\nOther subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.\\n\\nMicrosoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.\\n\\nS-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681\\n\\nIf the defaults have not been changed, these are not a finding.\"]\n[41273,\"Confirm Virtualization Based Security is enabled and running with Secure Boot or Secure Boot and DMA Protection.\\n\\nFor those devices that support virtualization based security (VBS) features, including Credential Guard or protection of code integrity, this must be enabled. If the system meets the hardware and firmware dependencies for enabling VBS but it is not enabled, this is a CAT III finding.\\n\\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nRun \\\"PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter the following:\\n\\n\\\"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\"\\n\\nIf \\\"RequiredSecurityProperties\\\" does not include a value of \\\"2\\\" indicating \\\"Secure Boot\\\" (e.g., \\\"{1, 2}\\\"), this is a finding.\\n\\nIf \\\"Secure Boot and DMA Protection\\\" is configured, \\\"3\\\" will also be displayed in the results (e.g., \\\"{1, 2, 3}\\\").\\n\\nIf \\\"VirtualizationBasedSecurityStatus\\\" is not a value of \\\"2\\\" indicating \\\"Running\\\", this is a finding.\\n\\nAlternately:\\n\\nRun \\\"System Information\\\".\\n\\nUnder \\\"System Summary\\\", verify the following:\\n\\nIf \\\"Device Guard Virtualization based security\\\" does not display \\\"Running\\\", this is finding.\\n\\nIf \\\"Device Guard Required Security Properties\\\" does not display \\\"Base Virtualization Support, Secure Boot\\\", this is finding.\\n\\nIf \\\"Secure Boot and DMA Protection\\\" is configured, \\\"DMA Protection\\\" will also be displayed (e.g., \\\"Base Virtualization Support, Secure Boot, DMA Protection\\\").\\n\\nThe policy settings referenced in the Fix section will configure the following registry values. However due to hardware requirements, the registry values alone do not ensure proper function.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\\\\n\\nValue Name: EnableVirtualizationBasedSecurity\\nValue Type: REG_DWORD\\nValue: 1\\n\\nValue Name: RequirePlatformSecurityFeatures\\nValue Type: REG_DWORD\\nValue: 1 (Secure Boot only) or 3 (Secure Boot and DMA Protection)\\n\\nA Microsoft article on Credential Guard system requirement can be found at the following link:\\n\\nhttps://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard-requirements\\n\\nNOTE:  The severity level for the requirement will be upgraded to CAT II starting January 2020.\"]\n[41274,\"If the system is not a member of a domain, this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: LocalAccountTokenFilterPolicy\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[41275,\"Confirm Credential Guard is running on domain-joined systems.\\n\\nFor those devices that support Credential Guard, this feature must be enabled. Organizations need to take the appropriate action to acquire and implement compatible hardware with Credential Guard enabled.\\n\\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nRun \\\"PowerShell\\\" with elevated privileges (run as administrator).\\nEnter the following:\\n\\\"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\"\\n\\nIf \\\"SecurityServicesRunning\\\" does not include a value of \\\"1\\\" (e.g., \\\"{1, 2}\\\"), this is a finding.\\n\\nAlternately:\\n\\nRun \\\"System Information\\\".\\nUnder \\\"System Summary\\\", verify the following:\\nIf \\\"Device Guard Security Services Running\\\" does not list \\\"Credential Guard\\\", this is finding.\\n\\nThe policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DeviceGuard\\\\\\n\\nValue Name: LsaCfgFlags\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1) (Enabled with UEFI lock)\"]\n[41276,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Accounts: Administrator account status\\\" is not set to \\\"Disabled\\\", this is a finding.\"]\n[41277,\"The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy is to enforce \\\"Good, unknown and bad but critical\\\" (preventing \\\"bad\\\").\\n\\nIf the registry value name below does not exist, this a finding.\\n\\nIf it exists and is configured with a value of \\\"7\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Policies\\\\EarlyLaunch\\\\\\n\\nValue Name: DriverLoadPolicy\\n\\nValue Type: REG_DWORD\\nValue: 1, 3, or 8 \\n\\nPossible values for this setting are:\\n8 - Good only\\n1 - Good and unknown\\n3 - Good, unknown and bad but critical\\n7 - All (which includes \\\"Bad\\\" and would be a finding)\"]\n[41278,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Group Policy\\\\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\\n\\nValue Name: NoGPOListChanges\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41279,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Accounts: Guest account status\\\" is not set to \\\"Disabled\\\", this is a finding.\"]\n[41280,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Printers\\\\\\n\\nValue Name: DisableWebPnPDownload\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41281,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: LimitBlankPasswordUse\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41282,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Accounts: Rename administrator account\\\" is set to \\\"Administrator\\\", this is a finding.\"]\n[41283,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\\\n\\nValue Name: NoWebServices\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41284,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Printers\\\\\\n\\nValue Name: DisableHTTPPrinting\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41285,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Accounts: Rename guest account\\\" is set to \\\"Guest\\\", this is a finding.\"]\n[41286,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nThe default behavior for \\\"Support device authentication using certificate\\\" is \\\"Automatic\\\".\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is a finding.\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Kerberos\\\\Parameters\\\\\\n\\nValue Name:  DevicePKInitEnabled\\nValue Type:  REG_DWORD\\nValue:  1 (or if the Value Name does not exist)\"]\n[41287,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: DontDisplayNetworkSelectionUI\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41288,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: EnumerateLocalUsers\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41289,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: SCENoApplyLegacyAuditPolicy\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41290,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: RequireSignOrSeal\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41291,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: SealSecureChannel\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41292,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Power\\\\PowerSettings\\\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\\\\\\n\\nValue Name: DCSettingIndex\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41293,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: SignSecureChannel\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41294,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Power\\\\PowerSettings\\\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\\\\\\n\\nValue Name: ACSettingIndex\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41295,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: fAllowToGetHelp\\n \\nValue Type: REG_DWORD\\nValue: 0\"]\n[41296,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: DisablePasswordChange\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41297,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Rpc\\\\\\n\\nValue Name: RestrictRemoteClients\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41298,\"Windows 10 LTSC\\\\B versions do not support the Microsoft Store and modern apps; this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: MSAOptional\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[41299,\"This is the default configuration for this setting (30 days).\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: MaximumPasswordAge\\n\\nValue Type: REG_DWORD\\nValue: 0x0000001e (30)  (or less, excluding 0)\"]\n[41300,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\AppCompat\\\\\\n\\nValue Name: DisableInventory\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41301,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\\n\\nValue Name: RequireStrongKey\\n\\nValue Type: REG_DWORD\\nValue: 1\\n \\nWarning: This setting may prevent a system from being joined to a domain if not configured consistently between systems.\"]\n[41302,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Explorer\\\\\\n\\nValue Name: NoAutoplayfornonVolume\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41303,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: InactivityTimeoutSecs\\n\\nValue Type: REG_DWORD\\nValue: 0x00000384 (900) (or less, excluding \\\"0\\\" which is effectively disabled)\"]\n[41304,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\\\n\\nValue Name: NoAutorun\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41305,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\policies\\\\Explorer\\\\\\n\\nValue Name: NoDriveTypeAutoRun\\n\\nValue Type: REG_DWORD\\nValue: 0x000000ff (255)\\n\\nNote: If the value for NoDriveTypeAutorun is entered manually, it must be entered as \\\"ff\\\" when Hexadecimal is selected, or \\\"255\\\" with Decimal selected.  Using the policy value specified in the Fix section will enter it correctly.\"]\n[41306,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: LegalNoticeText\\n\\nValue Type: REG_SZ\\nValue: \\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details.\"]\n[41307,\"Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Biometrics\\\\FacialFeatures\\\\\\n\\nValue Name: EnhancedAntiSpoofing\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[41308,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\CredUI\\\\\\n\\nValue Name: EnumerateAdministrators\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41309,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: LegalNoticeCaption\\n\\nValue Type: REG_SZ\\nValue: See message title above\\n\\n\\\"DoD Notice and Consent Banner\\\", \\\"US Department of Defense Warning Statement\\\" or a site-defined equivalent, this is a finding.\\n\\nIf a site-defined title is used, it can in no case contravene or modify the language of the banner text required in WN10-SO-000075.\"]\n[41310,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DataCollection\\\\\\n\\nValue Name: AllowTelemetry\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0) (Security)\\n0x00000001 (1) (Basic)\\n\\nIf an organization is using v1709 or later of Windows 10 this may be configured to \\\"Enhanced\\\" to support Windows Analytics. V-82145 must also be configured to limit the Enhanced diagnostic data to the minimum required by Windows Analytics. This registry value will then be 0x00000002 (2).\"]\n[41311,\"This is applicable to unclassified systems, for other systems this is NA.\\n\\nIf the following registry values do not exist or are not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: EnableSmartScreen\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\\n\\nAnd\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: ShellSmartScreenLevel\\n\\nValue Type: REG_SZ\\nValue: Block\\n\\nv1607 LTSB:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: EnableSmartScreen\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\\n\\nv1507 LTSB:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\\\n\\nValue Name: EnableSmartScreen\\n\\nValue Type: REG_DWORD\\nValue: 0x00000002 (2)\"]\n[41312,\"This is the default configuration for this setting (10 logons to cache).\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE \\nRegistry Path:  \\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\\\n\\nValue Name:  CachedLogonsCount\\n\\nValue Type:  REG_SZ\\nValue:  10 (or less)\\n\\nThis setting only applies to domain-joined systems, however, it is configured by default on all systems.\"]\n[41313,\"The default behavior is for data execution prevention to be turned on for file explorer.\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Explorer\\\\\\n\\nValue Name: NoDataExecutionPrevention\\n\\nValue Type: REG_DWORD\\nValue: 0 (or if the Value Name does not exist)\"]\n[41314,\"The default behavior is for File Explorer heap termination on corruption to be enabled.\\n\\nIf the registry Value Name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Explorer\\\\\\n\\nValue Name: NoHeapTerminationOnCorruption\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0) (or if the Value Name does not exist)\"]\n[41315,\"The default behavior is for shell protected mode to be turned on for file explorer.\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\\\n\\nValue Name: PreXPSP2ShellProtocolBehavior\\n\\nValue Type: REG_DWORD\\nValue: 0 (or if the Value Name does not exist)\"]\n[41316,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\\\n\\nValue Name:  SCRemoveOption\\n\\nValue Type:  REG_SZ\\nValue:  1 (Lock Workstation) or 2 (Force Logoff)\\n\\nThis can be left not configured or set to \\\"No action\\\" on workstations with the following conditions.  This must be documented with the ISSO.\\n-The setting cannot be configured due to mission needs, or because it interferes with applications.\\n-Policy must be in place that users manually lock workstations when leaving them unattended.\\n-The screen saver is properly configured to lock as required.\"]\n[41317,\"This is applicable to unclassified systems, for other systems this is NA.\\n\\nWindows 10 LTSC\\\\B versions do not include Microsoft Edge, this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\PhishingFilter\\\\\\n\\nValue Name: PreventOverride\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[41318,\"This is applicable to unclassified systems, for other systems this is NA.\\n\\nWindows 10 LTSC\\\\B versions do not include Microsoft Edge, this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\PhishingFilter\\\\\\n\\nValue Name: PreventOverrideAppRepUnknown\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[41319,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanmanWorkstation\\\\Parameters\\\\\\n\\nValue Name: RequireSecuritySignature\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41320,\"Windows 10 LTSC\\\\B versions do not include Microsoft Edge, this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\Main\\\\\\n\\nValue Name: FormSuggest Passwords\\n\\nType: REG_SZ\\nValue: no\"]\n[41321,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanmanWorkstation\\\\Parameters\\\\\\n\\nValue Name:  EnablePlainTextPassword\\n\\nValue Type:  REG_DWORD\\nValue:  0\"]\n[41322,\"This is applicable to unclassified systems, for other systems this is NA.\\n\\nWindows 10 LTSC\\\\B versions do not include Microsoft Edge, this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\PhishingFilter\\\\\\n\\nValue Name: EnabledV9\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[41323,\"Virtual desktop implementations currently may not support the use of TPMs. For virtual desktop implementations where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\PassportForWork\\\\\\n\\nValue Name: RequireSecurityDevice\\n\\nType: REG_DWORD\\nValue: 1\"]\n[41324,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanManServer\\\\Parameters\\\\\\n\\nValue Name: RequireSecuritySignature\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41325,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Path:  \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\PassportForWork\\\\PINComplexity\\\\\\n\\nValue Name:  MinimumPINLength\\n\\nType:  REG_DWORD\\nValue:  6 (or greater)\"]\n[41326,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: DisablePasswordSaving\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41327,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: fDisableCdm\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41328,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: fPromptForPassword\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41329,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: fEncryptRPCTraffic\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41330,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.\\n\\nIf the value for \\\"Network access: Allow anonymous SID/Name translation\\\" is not set to \\\"Disabled\\\", this is a finding.\"]\n[41331,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\\\n\\nValue Name: MinEncryptionLevel\\n\\nValue Type: REG_DWORD\\nValue: 3\"]\n[41332,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Internet Explorer\\\\Feeds\\\\\\n\\nValue Name: DisableEnclosureDownload\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41333,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: RestrictAnonymousSAM\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41334,\"The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections.\\n\\nIf the registry value name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"0\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Internet Explorer\\\\Feeds\\\\\\n\\nValue Name: AllowBasicAuthInClear\\n\\nValue Type: REG_DWORD\\nValue: 0 (or if the Value Name does not exist)\"]\n[41335,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: RestrictAnonymous\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41336,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Windows Search\\\\\\n\\nValue Name: AllowIndexingEncryptedStoresOrItems\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41337,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: EveryoneIncludesAnonymous\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41338,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanManServer\\\\Parameters\\\\\\n\\nValue Name: RestrictNullSessAccess\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41339,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\LSA\\\\MSV1_0\\\\\\n\\nValue Name: allownullsessionfallback\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41340,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\LSA\\\\pku2u\\\\\\n\\nValue Name: AllowOnlineID\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41341,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Kerberos\\\\Parameters\\\\\\n\\nValue Name: SupportedEncryptionTypes\\n\\nValue Type: REG_DWORD\\nValue: 0x7ffffff8 (2147483640)\"]\n[41342,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: NoLMHash\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41343,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: LmCompatibilityLevel\\n\\nValue Type: REG_DWORD\\nValue: 5\"]\n[41344,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LDAP\\\\\\n\\nValue Name: LDAPClientIntegrity\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41345,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\MSV1_0\\\\\\n\\nValue Name: NTLMMinClientSec\\n\\nValue Type: REG_DWORD\\nValue: 0x20080000 (537395200)\"]\n[41346,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\MSV1_0\\\\\\n\\nValue Name: NTLMMinServerSec\\n\\nValue Type: REG_DWORD\\nValue: 0x20080000 (537395200)\"]\n[41347,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\FIPSAlgorithmPolicy\\\\\\n\\nValue Name: Enabled\\n\\nValue Type: REG_DWORD\\nValue: 1\\n \\nWarning: Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms.  Both the browser and web server must be configured to use TLS otherwise the browser will not be able to connect to a secure site.\"]\n[41348,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\\\n\\nValue Name: ProtectionMode\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41349,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: FilterAdministratorToken\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41350,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: ConsentPromptBehaviorAdmin\\n\\nValue Type: REG_DWORD\\nValue: 2 (Prompt for consent on the secure desktop)\"]\n[41351,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: ConsentPromptBehaviorUser\\n\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41352,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: EnableInstallerDetection\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41353,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: EnableSecureUIAPaths\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41354,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: EnableLUA\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41355,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\\\n\\nValue Name: EnableVirtualization\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41356,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\PushNotifications\\\\\\n\\nValue Name: NoToastApplicationNotificationOnLockScreen\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41357,\"The default behavior is for Windows to mark file attachments with their zone information.\\n\\nIf the registry Value Name below does not exist, this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"2\\\", this is not a finding.\\n\\nIf it exists and is configured with a value of \\\"1\\\", this is a finding.\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Attachments\\\\\\n\\nValue Name: SaveZoneInformation\\n\\nValue Type: REG_DWORD\\nValue: 0x00000002 (2) (or if the Value Name does not exist)\"]\n[41358,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Access Credential Manager as a trusted caller\\\" user right, this is a finding.\"]\n[41359,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Access this computer from the network\\\" user right, this is a finding:\\n\\nAdministrators\\nRemote Desktop Users\\n\\nIf a domain application account such as for a management tool requires this user right, this would not be a finding.\\n\\nVendor documentation must support the requirement for having the user right.\\n\\nThe requirement must be documented with the ISSO.\\n\\nThe application account, managed at the domain level, must meet requirements for application account passwords, such as length and frequency of changes as defined in the Windows server STIGs.\"]\n[41360,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts (to include administrators), are granted the \\\"Act as part of the operating system\\\" user right, this is a finding.\"]\n[41361,\"Verify the effective setting in Local Group Policy Editor.\\n\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Allow log on locally\\\" user right, this is a finding:\\n\\nAdministrators\\nUsers\"]\n[41362,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Back up files and directories\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[41363,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Change the system time\\\" user right, this is a finding:\\n\\nAdministrators\\nLOCAL SERVICE\\nNT SERVICE\\\\autotimesvc is added in v1909 cumulative update.\"]\n[41364,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Create a pagefile\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[41365,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Create a token object\\\" user right, this is a finding.\"]\n[41366,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Create global objects\\\" user right, this is a finding:\\n\\nAdministrators\\nLOCAL SERVICE\\nNETWORK SERVICE\\nSERVICE\"]\n[41367,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Create permanent shared objects\\\" user right, this is a finding.\"]\n[41368,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Create symbolic links\\\" user right, this is a finding:\\n\\nAdministrators\\n\\nIf the workstation has an approved use of Hyper-V, such as being used as a dedicated admin workstation using Hyper-V to separate administration and standard user functions, \\\"NT VIRTUAL MACHINES\\\\VIRTUAL MACHINE\\\" may be assigned this user right and is not a finding.\"]\n[41369,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Debug Programs\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[41370,\"Verify the effective setting in Local Group Policy Editor.\\n\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny access to this computer from the network\\\" right, this is a finding:\\n\\nDomain Systems Only:\\nEnterprise Admins group\\nDomain Admins group\\nLocal account (see Note below)\\n\\nAll Systems:\\nGuests group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nNote: \\\"Local account\\\" is a built-in security group used to assign user rights and permissions to all local accounts.\"]\n[41371,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nVerify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny log on as a batch job\\\" right, this is a finding:\\n\\nDomain Systems Only:\\nEnterprise Admin Group\\nDomain Admin Group\"]\n[41372,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nVerify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny log on as a service\\\" right , this is a finding:\\n\\nDomain Systems Only:\\nEnterprise Admins Group\\nDomain Admins Group\"]\n[41373,\"Verify the effective setting in Local Group Policy Editor.\\n\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny log on locally\\\" right, this is a finding.\\n\\nDomain Systems Only:\\nEnterprise Admins Group\\nDomain Admins Group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nAll Systems:\\nGuests Group\"]\n[41374,\"Verify the effective setting in Local Group Policy Editor.\\n\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf the following groups or accounts are not defined for the \\\"Deny log on through Remote Desktop Services\\\" right, this is a finding:\\n\\nIf Remote Desktop Services is not used by the organization, the \\\"Everyone\\\" group can replace all of the groups listed below.\\n\\nDomain Systems Only:\\nEnterprise Admins group\\nDomain Admins group\\nLocal account (see Note below)\\n\\nAll Systems:\\nGuests group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nNote: \\\"Local account\\\" is a built-in security group used to assign user rights and permissions to all local accounts.\"]\n[41375,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Enable computer and user accounts to be trusted for delegation\\\" user right, this is a finding.\"]\n[41376,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Force shutdown from a remote system\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[41377,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Impersonate a client after authentication\\\" user right, this is a finding:\\n\\nAdministrators\\nLOCAL SERVICE\\nNETWORK SERVICE\\nSERVICE\"]\n[41378,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Load and unload device drivers\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[41379,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts are granted the \\\"Lock pages in memory\\\" user right, this is a finding.\"]\n[41380,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Manage auditing and security log\\\" user right, this is a finding:\\n\\nAdministrators\\n\\nIf the organization has an \\\"Auditors\\\" group the assignment of this group to the user right would not be a finding.\"]\n[41381,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Modify firmware environment values\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[41382,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Perform volume maintenance tasks\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[41383,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Profile single process\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[41384,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Restore files and directories\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[41385,\"Verify the effective setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nIf any groups or accounts other than the following are granted the \\\"Take ownership of files or other objects\\\" user right, this is a finding:\\n\\nAdministrators\"]\n[41386,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DeliveryOptimization\\\\\\n\\nValue Name: DODownloadMode\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0) - No peering (HTTP Only)\\n0x00000001 (1) - Peers on same NAT only (LAN)\\n0x00000002 (2) - Local Network / Private group peering (Group)\\n0x00000063 (99) - Simple download mode, no peering (Simple)\\n0x00000064 (100) - Bypass mode, Delivery Optimization not used (Bypass)\\n\\nA value of 0x00000003 (3), Internet, is a finding.\\n\\nv1507 LTSB:\\nDomain joined systems:\\nVerify the registry value above.\\nIf the value is not 0x00000000 (0) or 0x00000001 (1), this is a finding.\\n\\nStandalone systems (configured in Settings):\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\DeliveryOptimization\\\\Config\\\\\\n\\nValue Name: DODownloadMode\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0) - Off\\n0x00000001 (1) - LAN\"]\n[41387,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE \\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Audit\\\\\\n\\nValue Name: ProcessCreationIncludeCmdLine_Enabled\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41388,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE \\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\PowerShell\\\\ScriptBlockLogging\\\\\\n\\nValue Name: EnableScriptBlockLogging\\n\\nValue Type: REG_DWORD\\nValue: 1\"]\n[41389,\"Verify the DEP configuration.\\nOpen a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).\\nEnter \\\"BCDEdit /enum {current}\\\". (If using PowerShell \\\"{current}\\\" must be enclosed in quotes.)\\nIf the value for \\\"nx\\\" is not \\\"OptOut\\\", this is a finding.\\n(The more restrictive configuration of \\\"AlwaysOn\\\" would not be a finding.)\"]\n[41390,\"This is applicable to Windows 10 prior to v1709.\\n\\nVerify SEHOP is turned on.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\kernel\\\\\\n\\nValue Name: DisableExceptionChainValidation\\n\\nValue Type: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[41391,\"Run \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter the following:\\nGet-WindowsOptionalFeature -Online | Where FeatureName -like *PowerShellv2*\\n\\nIf either of the following have a \\\"State\\\" of \\\"Enabled\\\", this is a finding.\\n\\nFeatureName : MicrosoftWindowsPowerShellV2\\nState : Enabled\\nFeatureName : MicrosoftWindowsPowerShellV2Root\\nState : Enabled\\n\\nAlternately:\\nSearch for \\\"Features\\\".\\n\\nSelect \\\"Turn Windows features on or off\\\".\\n\\nIf \\\"Windows PowerShell 2.0\\\" (whether the subcategory of \\\"Windows PowerShell 2.0 Engine\\\" is selected or not) is selected, this is a finding.\"]\n[41392,\"Different methods are available to disable SMBv1 on Windows 10.  This is the preferred method, however if V-74723 and V-74725 are configured, this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter the following:\\nGet-WindowsOptionalFeature -Online | Where FeatureName -eq SMB1Protocol\\n\\nIf \\\"State : Enabled\\\" is returned, this is a finding.\\n\\nAlternately:\\nSearch for \\\"Features\\\".\\n\\nSelect \\\"Turn Windows features on or off\\\".\\n\\nIf \\\"SMB 1.0/CIFS File Sharing Support\\\" is selected, this is a finding.\"]\n[41393,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff >> Account Lockout - Failure\"]\n[41394,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n-Open a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n-Enter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding.\\n\\nPolicy Change >> Authorization Policy Change - Success\"]\n[41395,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\SecurityProviders\\\\Wdigest\\\\\\n\\nValue Name: UseLogonCredential\\n\\nType: REG_DWORD\\nValue:  0x00000000 (0)\"]\n[41396,\"If the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Network Connections\\\\\\n\\nValue Name: NC_ShowSharedAccessUI\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[41397,\"Windows 10 v1507 LTSB version does not include this setting, it is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\\n\\nValue Name: RestrictRemoteSAM\\n\\nValue Type: REG_SZ\\nValue: O:BAG:BAD:(A;;RC;;;BA)\"]\n[41398,\"Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\CloudContent\\\\\\n\\nValue Name: DisableWindowsConsumerFeatures\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[41399,\"If the following registry values do not exist or are not configured as specified, this is a finding.\\nThe policy configures the same Value Name, Type and Value under four different registry paths.\\n\\nRegistry Hive:  HKEY_LOCAL_MACHINE\\nRegistry Paths:  \\n\\\\SOFTWARE\\\\Classes\\\\batfile\\\\shell\\\\runasuser\\\\\\n\\\\SOFTWARE\\\\Classes\\\\cmdfile\\\\shell\\\\runasuser\\\\\\n\\\\SOFTWARE\\\\Classes\\\\exefile\\\\shell\\\\runasuser\\\\\\n\\\\SOFTWARE\\\\Classes\\\\mscfile\\\\shell\\\\runasuser\\\\\\n\\nValue Name:  SuppressionPolicy\\n\\nType:  REG_DWORD\\nValue:  0x00001000 (4096)\"]\n[41400,\"This is NA if the system does not have Bluetooth.\\n\\nVerify the Bluetooth radio is turned off unless approved by the organization. If it is not, this is a finding.\\n\\nApproval must be documented with the ISSO.\"]\n[41401,\"This is NA if the system does not have Bluetooth.\\n\\nVerify the organization has a policy to turn off Bluetooth when not in use and personnel are trained. If it does not, this is a finding.\"]\n[41402,\"This is NA if the system does not have Bluetooth, or if Bluetooth is turned off per the organizations policy.\\n\\nSearch for \\\"Bluetooth\\\".\\nView Bluetooth Settings.\\nSelect \\\"More Bluetooth Options\\\"\\nIf \\\"Alert me when a new Bluetooth device wants to connect\\\" is not checked, this is a finding.\"]\n[41403,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen PowerShell or a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following:\\n\\nObject Access >> Other Object Access Events - Failure\\n\\nIf the system does not audit the above, this is a finding.\"]\n[41404,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen PowerShell or a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following:\\n\\nObject Access >> Other Object Access Events - Success\\n\\nIf the system does not audit the above, this is a finding.\"]\n[41405,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Cryptography\\\\Configuration\\\\SSL\\\\00010002\\\\\\n\\nValue Name: EccCurves\\n\\nValue Type: REG_MULTI_SZ\\nValue: NistP384 NistP256\"]\n[41406,\"This is NA for Windows 10 LTSC\\\\B versions 1507 and 1607.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\GameDVR\\\\\\n\\nValue Name: AllowGameDVR\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[41407,\"This is NA for Windows 10 LTSC\\\\B versions 1507 and 1607.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\CredentialsDelegation\\\\\\n\\nValue Name: AllowProtectedCreds\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[41408,\"Run \\\"Services.msc\\\".\\n\\nLocate the \\\"Secondary Logon\\\" service.\\n\\nIf the \\\"Startup Type\\\" is not \\\"Disabled\\\" or the \\\"Status\\\" is \\\"Running\\\", this is a finding.\"]\n[41409,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen PowerShell or a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following:\\n\\nObject Access >> File Share - Success\\n\\nIf the system does not audit the above, this is a finding.\"]\n[41410,\"Different methods are available to disable SMBv1 on Windows 10, if V-70639 is configured, this is NA.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\LanmanServer\\\\Parameters\\\\\\n\\nValue Name: SMB1\\n\\nType: REG_DWORD\\nValue: 0x00000000 (0)\"]\n[41411,\"Different methods are available to disable SMBv1 on Windows 10, if V-70639 is configured, this is NA.\\n\\nIf the following registry value is not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\mrxsmb10\\\\\\n\\nValue Name: Start\\n\\nType: REG_DWORD\\nValue: 0x00000004 (4)\"]\n[41412,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\n\\nOpen PowerShell or a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\n\\nEnter \\\"AuditPol /get /category:*\\\"\\n\\nCompare the AuditPol settings with the following:\\n\\nObject Access >> File Share - Failure\\n\\nIf the system does not audit the above, this is a finding.\"]\n[41413,\"Review the effective User Rights setting in Local Group Policy Editor.\\nRun \\\"gpedit.msc\\\".\\n\\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\\n\\nReview each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of \\\"*S-1-…\\\".)\\n\\nIf any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.\"]\n[41414,\"For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nVerify the system firmware is configured to run in UEFI mode, not Legacy BIOS.\\n\\nRun \\\"System Information\\\".\\n\\nUnder \\\"System Summary\\\", if \\\"BIOS Mode\\\" does not display \\\"UEFI\\\", this is finding.\"]\n[41415,\"Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows 10 hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. \\n\\nFor virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nRun \\\"System Information\\\".\\n\\nUnder \\\"System Summary\\\", if \\\"Secure Boot State\\\" does not display \\\"On\\\", this is finding.\"]\n[41416,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"DEP: Enable\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[41417,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"ASLR: BottomUp\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[41418,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"CFG: Enable\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[41419,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"SEHOP: Enable\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[41420,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nThe default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.  The PowerShell query results for this show as \\\"NOTSET\\\".\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -System\\\".\\n\\nIf the status of \\\"Heap: TerminateOnError\\\" is \\\"OFF\\\", this is a finding.\\n\\nValues that would not be a finding include:\\nON\\nNOTSET (Default configuration)\"]\n[41421,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name Acrobat.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41422,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name AcroRd32.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot= False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41423,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name chrome.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverrideDEP: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41424,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name EXCEL.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41425,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name firefox.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: On\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41426,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name FLTLDR.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False \\nOverrideExportAddressFilterPlus: False \\nOverrideImportAddressFilter: False \\nOverrideEnableRopStackPivot: False \\nOverrideEnableRopCallerCheck: False \\nOverrideEnableRopSimExec: False\\n\\nChild Process:\\nOverrideChildProcess: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41427,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name GROOVE.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverrideDEP: False\\n\\nASLR:\\nForceRelocateImages: On\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nChild Process:\\nOverrideChildProcess: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here.  If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41428,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name iexplore.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41429,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name INFOPATH.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41430,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name [application name]\\\" with each of the following substituted for [application name]:\\njava.exe, javaw.exe, and javaws.exe\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41431,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name lync.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41432,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name MSACCESS.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41433,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name MSPUB.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41434,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name OneDrive.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nOverrideRelocateImages: NOTSET\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False \\nOverrideExportAddressFilterPlus: False \\nOverrideImportAddressFilter: False \\nOverrideEnableRopStackPivot: False \\nOverrideEnableRopCallerCheck: False \\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41435,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name OIS.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverrideDEP: False\\n\\nPayload:\\nOverrideEnableExportAddressFilter: False\\nOverrideEnableExportAddressFilterPlus: False\\nOverrideEnableImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41436,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name OUTLOOK.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41437,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name plugin-container.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status of \\\"ON\\\" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41438,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name POWERPNT.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41439,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name PPTVIEW.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41440,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name VISIO.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41441,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name VPREVIEW.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41442,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name WINWORD.EXE\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41443,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name wmplayer.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41444,\"This is NA prior to v1709 of Windows 10.\\n\\nThis is applicable to unclassified systems, for other systems this is NA.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter \\\"Get-ProcessMitigation -Name wordpad.exe\\\".\\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\\n\\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.\"]\n[41445,\"Determine whether administrative accounts are prevented from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration.\\n\\nThe organization must have a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.\\n\\nTechnical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet. \\n\\nIf accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding.\"]\n[41446,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\Software\\\\Policies\\\\Microsoft\\\\OneDrive\\\\\\n\\nValue Name: DisablePersonalSync\\n\\nValue Type: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[41447,\"This setting is applicable starting with v1809 of Windows 10; it is NA for prior versions.\\n\\nWindows 10 LTSC\\\\B versions do not include Microsoft Edge; this is NA for those systems.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\MicrosoftEdge\\\\Internet Settings\\\\\\n\\nValue Name: PreventCertErrorOverrides\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[41448,\"This setting requires v1709 or later of Windows 10; it is NA for prior versions.\\n\\nIf \\\"Enhanced\\\" level is enabled for telemetry, this must be configured. If \\\"Security\\\" or \\\"Basic\\\" are configured, this is NA. (See V-63683).\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\DataCollection\\\\\\n\\nValue Name: LimitEnhancedDiagnosticDataWindowsAnalytics\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[41449,\"If the organization is using a DoD instance of OneDrive, verify synchronizing is only allowed to the organization's DoD instance.\\n\\nIf the organization does not have an instance of OneDrive, verify this is configured with the noted dummy entry to prevent synchronizing with other instances.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\OneDrive\\\\AllowTenantList\\\\\\n\\nValue Name: Organization's Tenant GUID\\n\\nValue Type: REG_SZ\\nValue: Organization's Tenant GUID\\n\\nIf the organization does not have an instance of OneDrive the Value Name and Value must be 1111-2222-3333-4444, if not this is a finding.\"]\n[41450,\"This setting requires v1903 or later of Windows 10; it is NA for prior versions.  The setting is NA when the “Allow voice activation” policy is configured to disallow applications to be activated with voice for all users.\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\AppPrivacy\\\\\\n\\nValue Name: LetAppsActivateWithVoiceAboveLock\\n\\nType: REG_DWORD\\nValue: 0x00000002 (2)\\n\\nIf the following registry value exists and is configured as specified, requirement is NA. \\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\AppPrivacy\\\\\\n\\nValue Name: LetAppsActivateWithVoice\\n\\nType: REG_DWORD\\nValue: 0x00000002 (2)\"]\n[41451,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\FVE\\\\\\n\\nValue Name: UseAdvancedStartup\\nType: REG_DWORD\\nValue: 0x00000001 (1)\\n\\nIf one of the following registry values does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\FVE\\\\\\n\\nValue Name: UseTPMPIN\\nType: REG_DWORD\\nValue: 0x00000001 (1)\\n\\nValue Name: UseTPMKeyPIN\\nType: REG_DWORD\\nValue: 0x00000001 (1)\\n\\n\\nBitLocker network unlock may be used in conjunction with a BitLocker PIN. See the article below regarding information about network unlock.\\n\\nhttps://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock\"]\n[41452,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\FVE\\\\\\n\\nValue Name: MinimumPIN\\nType: REG_DWORD\\nValue: 0x00000006 (6) or greater\"]\n[41453,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff  >> Other Logon/Logoff Events - Failure\"]\n[41454,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nLogon/Logoff  >> Other Logon/Logoff Events - Success\"]\n[41455,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nObject Access  >> Detailed File Share - Failure\"]\n[41456,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nPolicy Change  >> MPSSVC Rule-Level Policy Change - Success\"]\n[41457,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nPolicy Change  >> MPSSVC Rule-Level Policy Change - Failure\"]\n[41458,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nPolicy Change  >> Other Policy Change Events - Success\"]\n[41459,\"Security Option \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" must be set to \\\"Enabled\\\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\\n\\nUse the AuditPol tool to review the current Audit Policy configuration:\\nOpen a Command Prompt with elevated privileges (\\\"Run as Administrator\\\").\\nEnter \\\"AuditPol /get /category:*\\\".\\n\\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\\n\\nPolicy Change  >> Other Policy Change Events - Failure\"]\n[41460,\"Review the password last set date for the enabled local Administrator account.\\n\\nOn the local domain joined workstation:\\n\\nOpen \\\"PowerShell\\\".\\n\\nEnter \\\"Get-LocalUser –Name * | Select-Object *”\\n\\nIf the \\\"PasswordLastSet\\\" date is greater than \\\"60\\\" days old for the local Administrator account for administering the computer/domain, this is a finding.\"]\n[41461,\"This is NA prior to v1803 of Windows 10.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\Kernel DMA Protection\\n\\nValue Name: DeviceEnumerationPolicy\\nValue Type: REG_DWORD\\nValue: 0\"]\n[41462,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\n\\nValue Name: AllowDomainPINLogon\\nValue Type: REG_DWORD\\nValue data: 0\"]\n[41463,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistry Path: \\\\Software\\\\Policies\\\\Microsoft\\\\WindowsInkWorkspace\\n\\nValue Name: AllowWindowsInkWorkspace\\nValue Type: REG_DWORD\\nValue data: 1\"]\n[41464,\"If the following registry value does not exist or is not configured as specified, this is a finding.\\n\\nIf the following registry value does not exist or is not configured as specified, this is a finding: \\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\CloudContent\\\\\\n\\nValue Name: DisableThirdPartySuggestions\\n\\nType: REG_DWORD\\nValue: 0x00000001 (1)\"]\n[41465,\"If the device or operating system does not have a camera installed, this requirement is not applicable.\\n\\nThis requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local AO decision.\\n\\nThis requirement is not applicable to dedicated VTC suites located in approved VTC locations that are centrally managed.\\n\\nFor an external camera, if there is not a method for the operator to manually disconnect camera at the end of collaborative computing sessions, this is a finding.\\n\\nFor a built-in camera, the camera must be protected by a camera cover (e.g. laptop camera cover slide) when not in use. If the built-in camera is not protected with a camera cover, or if the built-in\\ncamera is not disabled in the bios, this is a finding.\\n\\nIf the camera is not disconnected or covered, the following registry entry is required:\\n\\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistryPath\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\CapabilityAccessManager\\\\ConsentStore\\\\webcam\\n\\nValue Name: Deny\\n\\nIf \\\"Value Name\\\" is set to a value other than \\\"Deny\\\" and the collaborative computing device has not been authorized for use, this is a finding.\"]\n[41466,\"Ensure there is a documented policy or procedure in place that non-persistent VM sessions do not exceed 24 hours.\\n\\nIf there is no such documented policy or procedure in place, this is a finding.\"]\n[41467,\"If the following registry values do not exist or are not configured as specified, this is a finding:\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\n\\nValue Name: NoPreviewPane\\n\\nValue Type: REG_DWORD\\n\\nValue: 1\\n\\nRegistry Hive: HKEY_CURRENT_USER\\nRegistry Path: \\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\n\\nValue Name: NoReadingPane\\n\\nValue Type: REG_DWORD\\n\\nValue: 1\"]\n[41468,\"If the system is a member of a domain this is Not Applicable.\\n\\nIf one of the following settings does not exist and is not populated, this is a finding: \\n\\nComputer\\\\HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Cryptography\\\\Calais\\\\Readers\\nComputer\\\\HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Cryptography\\\\Calais\\\\SmartCards\"]\n[41470,\"Verify the file permissions, ownership, and group membership of system files and commands match the vendor values.\\n\\nCheck the default file permissions, ownership, and group membership of system files and commands with the following command:\\n\\n# for i in `rpm -Va | egrep -i '^\\\\.[M|U|G|.]{8}' | cut -d \\\" \\\" -f4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump | cut -d \\\" \\\" -f1,5,6,7 | grep $i;done;done\\n\\n/var/log/gdm 040755 root root\\n/etc/audisp/audisp-remote.conf 0100640 root root\\n/usr/bin/passwd 0104755 root root\\n\\nFor each file returned, verify the current permissions, ownership, and group membership:\\n# ls -la <filename>\\n\\n-rw-------. 1 root root 133 Jan 11 13:25 /etc/audisp/audisp-remote.conf\\n\\nIf the file is more permissive than the default permissions, this is a finding.\\n\\nIf the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding.\\n\\nIf the file is not a member of the default group and is not documented with the Information System Security Officer (ISSO), this is a finding.\"]\n[41471,\"Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a graphical user logon.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nCheck to see if the operating system displays a banner at the logon screen with the following command:\\n\\n# grep banner-message-enable /etc/dconf/db/local.d/*\\nbanner-message-enable=true\\n\\nIf \\\"banner-message-enable\\\" is set to \\\"false\\\" or is missing, this is a finding.\"]\n[41472,\"Verify the operating system displays the approved Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a graphical user logon.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nCheck that the operating system displays the exact approved Standard Mandatory DoD Notice and Consent Banner text with the command:\\n\\n# grep banner-message-text /etc/dconf/db/local.d/*\\nbanner-message-text=\\n'You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\\\n-At any time, the USG may inspect and seize data stored on this IS.\\\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. '\\n\\nNote: The \\\"\\\\n \\\" characters are for formatting only. They will not be displayed on the GUI.\\n\\nIf the banner does not match the approved Standard Mandatory DoD Notice and Consent Banner, this is a finding.\"]\n[41473,\"Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a command line user logon.\\n\\nCheck to see if the operating system displays a banner at the command line logon screen with the following command:\\n\\n# more /etc/issue\\n\\nThe command should return the following text:\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nIf the operating system does not display a graphical logon banner or the banner does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.\\n\\nIf the text in the \\\"/etc/issue\\\" file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.\"]\n[41474,\"Verify the operating system enables a user's session lock until that user re-establishes access using established identification and authentication procedures. The screen program must be installed to lock sessions on the console.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCheck to see if the screen lock is enabled with the following command:\\n\\n# grep -i lock-enabled /etc/dconf/db/local.d/*\\nlock-enabled=true\\n\\nIf the \\\"lock-enabled\\\" setting is missing or is not set to \\\"true\\\", this is a finding.\"]\n[41475,\"Verify the operating system uniquely identifies and authenticates users using multifactor authentication via a graphical user logon.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nDetermine which profile the system database is using with the following command:\\n\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nNote: The example is using the database local for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than local is being used.\\n\\n# grep enable-smartcard-authentication /etc/dconf/db/local.d/*\\n\\nenable-smartcard-authentication=true\\n\\nIf \\\"enable-smartcard-authentication\\\" is set to \\\"false\\\" or the keyword is missing, this is a finding.\"]\n[41476,\"Verify the operating system initiates a screensaver after a 15-minute period of inactivity for graphical user interfaces. The screen program must be installed to lock sessions on the console.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCheck to see if GNOME is configured to display a screensaver after a 15 minute delay with the following command:\\n\\n# grep -i idle-delay /etc/dconf/db/local.d/*\\nidle-delay=uint32 900\\n\\nIf the \\\"idle-delay\\\" setting is missing or is not set to \\\"900\\\" or less, this is a finding.\"]\n[41477,\"Verify the operating system prevents a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\\n\\nDetermine which profile the system database is using with the following command:\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nCheck for the lock delay setting with the following command:\\n\\nNote: The example below is using the database \\\"local\\\" for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than \\\"local\\\" is being used.\\n\\n# grep -i lock-delay /etc/dconf/db/local.d/locks/*\\n\\n/org/gnome/desktop/screensaver/lock-delay\\n\\nIf the command does not return a result, this is a finding.\"]\n[41478,\"Verify the operating system prevents a user from overriding session idle delay after a 15-minute period of inactivity for graphical user interfaces. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console. \\n\\nDetermine which profile the system database is using with the following command:\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nCheck for the session idle delay setting with the following command:\\n\\nNote: The example below is using the database \\\"local\\\" for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than \\\"local\\\" is being used.\\n\\n# grep -i idle-delay /etc/dconf/db/local.d/locks/*\\n\\n/org/gnome/desktop/session/idle-delay\\n\\nIf the command does not return a result, this is a finding.\"]\n[41479,\"Verify the operating system has the screen package installed.\\n\\nCheck to see if the screen package is installed with the following command:\\n\\n# yum list installed screen\\nscreen-4.3.1-3-x86_64.rpm\\n\\nIf the screen package is not installed, check to see if the tmux package is installed with the following command:\\n\\n#yum list installed tmux\\ntmux-1.8-4.el7.x86_64.rpm \\n\\nIf either the screen package or the tmux package is not installed, this is a finding.\"]\n[41480,\"Verify the operating system initiates a session lock after a 15-minute period of inactivity for graphical user interfaces. The screen program must be installed to lock sessions on the console.\\n\\nNote: If the system does not have a Graphical User Interface installed, this requirement is Not Applicable.\\n\\nCheck for the session lock settings with the following commands:\\n\\n# grep -i idle-activation-enabled /etc/dconf/db/local.d/*\\n\\nidle-activation-enabled=true\\n\\nIf \\\"idle-activation-enabled\\\" is not set to \\\"true\\\", this is a finding.\"]\n[41481,\"Verify the operating system prevents a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\\n\\nDetermine which profile the system database is using with the following command:\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nCheck for the idle-activation-enabled setting with the following command:\\n\\nNote: The example below is using the database \\\"local\\\" for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than \\\"local\\\" is being used.\\n\\n# grep -i idle-activation-enabled /etc/dconf/db/local.d/locks/*\\n\\n/org/gnome/desktop/screensaver/idle-activation-enabled\\n\\nIf the command does not return a result, this is a finding.\"]\n[41482,\"Verify the operating system initiates a session lock a for graphical user interfaces when the screensaver is activated. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\\n\\nIf GNOME is installed, check to see a session lock occurs when the screensaver is activated with the following command:\\n\\n# grep -i lock-delay /etc/dconf/db/local.d/*\\nlock-delay=uint32 5\\n\\nIf the \\\"lock-delay\\\" setting is missing, or is not set to \\\"5\\\" or less, this is a finding.\"]\n[41483,\"Verify that /etc/pam.d/passwd is configured to use /etc/pam.d/system-auth when changing passwords:\\n\\n# cat /etc/pam.d/passwd | grep -i substack | grep -i system-auth\\npassword     substack     system-auth\\n\\nIf no results are returned, the line is commented out, this is a finding.\"]\n[41484,\"Verify the operating system uses \\\"pwquality\\\" to enforce the password complexity rules. \\n\\nCheck for the use of \\\"pwquality\\\" with the following command:\\n\\n# cat /etc/pam.d/system-auth | grep pam_pwquality\\n\\npassword required pam_pwquality.so retry=3\\n\\nIf the command does not return an uncommented line containing the value \\\"pam_pwquality.so\\\", this is a finding.\\n\\nIf the value of \\\"retry\\\" is set to \\\"0\\\" or greater than \\\"3\\\", this is a finding.\"]\n[41485,\"Note: The value to require a number of upper-case characters to be set is expressed as a negative number in \\\"/etc/security/pwquality.conf\\\".\\n\\nCheck the value for \\\"ucredit\\\" in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep ucredit /etc/security/pwquality.conf \\nucredit = -1\\n\\nIf the value of \\\"ucredit\\\" is not set to a negative value, this is a finding.\"]\n[41486,\"Note: The value to require a number of lower-case characters to be set is expressed as a negative number in \\\"/etc/security/pwquality.conf\\\".\\n\\nCheck the value for \\\"lcredit\\\" in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep lcredit /etc/security/pwquality.conf \\nlcredit = -1 \\n\\nIf the value of \\\"lcredit\\\" is not set to a negative value, this is a finding.\"]\n[41487,\"Note: The value to require a number of numeric characters to be set is expressed as a negative number in \\\"/etc/security/pwquality.conf\\\".\\n\\nCheck the value for \\\"dcredit\\\" in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep dcredit /etc/security/pwquality.conf \\ndcredit = -1 \\n\\nIf the value of \\\"dcredit\\\" is not set to a negative value, this is a finding.\"]\n[41488,\"Verify the operating system enforces password complexity by requiring that at least one special character be used.\\n\\nNote: The value to require a number of special characters to be set is expressed as a negative number in \\\"/etc/security/pwquality.conf\\\".\\n\\nCheck the value for \\\"ocredit\\\" in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep ocredit /etc/security/pwquality.conf \\nocredit=-1\\n\\nIf the value of \\\"ocredit\\\" is not set to a negative value, this is a finding.\"]\n[41489,\"The \\\"difok\\\" option sets the number of characters in a password that must not be present in the old password.\\n\\nCheck for the value of the \\\"difok\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep difok /etc/security/pwquality.conf \\ndifok = 8\\n\\nIf the value of \\\"difok\\\" is set to less than \\\"8\\\", this is a finding.\"]\n[41490,\"The \\\"minclass\\\" option sets the minimum number of required classes of characters for the new password (digits, upper-case, lower-case, others).\\n\\nCheck for the value of the \\\"minclass\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep minclass /etc/security/pwquality.conf \\nminclass = 4\\n\\nIf the value of \\\"minclass\\\" is set to less than \\\"4\\\", this is a finding.\"]\n[41491,\"The \\\"maxrepeat\\\" option sets the maximum number of allowed same consecutive characters in a new password.\\n\\nCheck for the value of the \\\"maxrepeat\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep maxrepeat /etc/security/pwquality.conf \\nmaxrepeat = 3\\n\\nIf the value of \\\"maxrepeat\\\" is set to more than \\\"3\\\", this is a finding.\"]\n[41492,\"The \\\"maxclassrepeat\\\" option sets the maximum number of allowed same consecutive characters in the same class in the new password.\\n\\nCheck for the value of the \\\"maxclassrepeat\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep maxclassrepeat /etc/security/pwquality.conf \\nmaxclassrepeat = 4\\n\\nIf the value of \\\"maxclassrepeat\\\" is set to more than \\\"4\\\", this is a finding.\"]\n[41493,\"Verify the PAM system service is configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is SHA512.\\n\\nCheck that the system is configured to create SHA512 hashed passwords with the following command:\\n\\n# grep password /etc/pam.d/system-auth /etc/pam.d/password-auth\\n\\nOutcome should look like following:\\n/etc/pam.d/system-auth-ac:password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\\n/etc/pam.d/password-auth:password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\\n\\nIf the \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" configuration files allow for password hashes other than SHA512 to be used, this is a finding.\"]\n[41494,\"Verify the system's shadow file is configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is SHA512.\\n\\nCheck that the system is configured to create SHA512 hashed passwords with the following command:\\n\\n# grep -i encrypt /etc/login.defs\\nENCRYPT_METHOD SHA512\\n\\nIf the \\\"/etc/login.defs\\\" configuration file does not exist or allows for password hashes other than SHA512 to be used, this is a finding.\"]\n[41495,\"Verify the user and group account administration utilities are configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is \\\"SHA512\\\".\\n\\nCheck that the system is configured to create \\\"SHA512\\\" hashed passwords with the following command:\\n\\n# grep -i sha512 /etc/libuser.conf \\n\\ncrypt_style = sha512\\n\\nIf the \\\"crypt_style\\\" variable is not set to \\\"sha512\\\", is not in the defaults section, is commented out, or does not exist, this is a finding.\"]\n[41496,\"Verify the operating system enforces 24 hours/1 day as the minimum password lifetime for new user accounts.\\n\\nCheck for the value of \\\"PASS_MIN_DAYS\\\" in \\\"/etc/login.defs\\\" with the following command: \\n\\n# grep -i pass_min_days /etc/login.defs\\nPASS_MIN_DAYS     1\\n\\nIf the \\\"PASS_MIN_DAYS\\\" parameter value is not \\\"1\\\" or greater, or is commented out, this is a finding.\"]\n[41497,\"Check whether the minimum time period between password changes for each user account is one day or greater.\\n\\n# awk -F: '$4 < 1 {print $1 \\\" \\\" $4}' /etc/shadow\\n\\nIf any results are returned that are not associated with a system account, this is a finding.\"]\n[41498,\"If passwords are not being used for authentication, this is Not Applicable.\\n\\nVerify the operating system enforces a 60-day maximum password lifetime restriction for new user accounts.\\n\\nCheck for the value of \\\"PASS_MAX_DAYS\\\" in \\\"/etc/login.defs\\\" with the following command:\\n\\n# grep -i pass_max_days /etc/login.defs\\nPASS_MAX_DAYS 60\\n\\nIf the \\\"PASS_MAX_DAYS\\\" parameter value is not 60 or less, or is commented out, this is a finding.\"]\n[41499,\"Check whether the maximum time period for existing passwords is restricted to 60 days.\\n\\n# awk -F: '$5 > 60 {print $1 \\\" \\\" $5}' /etc/shadow\\n\\nIf any results are returned that are not associated with a system account, this is a finding.\"]\n[41500,\"Verify the operating system prohibits password reuse for a minimum of five generations.\\n\\nCheck for the value of the \\\"remember\\\" argument in \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" with the following command:\\n\\n# grep -i remember /etc/pam.d/system-auth /etc/pam.d/password-auth\\n\\npassword    requisite     pam_pwhistory.so use_authtok remember=5 retry=3\\n\\nIf the line containing the \\\"pam_pwhistory.so\\\" line does not have the \\\"remember\\\" module argument set, is commented out, or the value of the \\\"remember\\\" module argument is set to less than \\\"5\\\", this is a finding.\"]\n[41501,\"Verify the operating system enforces a minimum 15-character password length. The \\\"minlen\\\" option sets the minimum number of characters in a new password.\\n\\nCheck for the value of the \\\"minlen\\\" option in \\\"/etc/security/pwquality.conf\\\" with the following command:\\n\\n# grep minlen /etc/security/pwquality.conf\\nminlen = 15\\n\\nIf the command does not return a \\\"minlen\\\" value of 15 or greater, this is a finding.\"]\n[41502,\"To verify that null passwords cannot be used, run the following command: \\n\\n# grep nullok /etc/pam.d/system-auth /etc/pam.d/password-auth\\n\\nIf this produces any output, it may be possible to log on with accounts with empty passwords.\\n\\nIf null passwords can be used, this is a finding.\"]\n[41503,\"To determine how the SSH daemon's \\\"PermitEmptyPasswords\\\" option is set, run the following command:\\n\\n# grep -i PermitEmptyPasswords /etc/ssh/sshd_config\\nPermitEmptyPasswords no\\n\\nIf no line, a commented line, or a line indicating the value \\\"no\\\" is returned, the required value is set.\\n\\nIf the required value is not set, this is a finding.\"]\n[41504,\"If passwords are not being used for authentication, this is Not Applicable.\\n\\nVerify the operating system disables account identifiers (individuals, groups, roles, and devices) after the password expires with the following command:\\n\\n# grep -i inactive /etc/default/useradd\\nINACTIVE=0\\n\\nIf the value is not set to \\\"0\\\", is commented out, or is not defined, this is a finding.\"]\n[41505,\"Check that the system locks an account for a minimum of 15 minutes after three unsuccessful logon attempts within a period of 15 minutes with the following command:\\n\\n# grep pam_faillock.so /etc/pam.d/password-auth\\n\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so \\n\\nIf the \\\"deny\\\" parameter is set to \\\"0\\\" or a value less than \\\"3\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"even_deny_root\\\" parameter is not set on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"fail_interval\\\" parameter is set to \\\"0\\\" or is set to a value less than \\\"900\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"unlock_time\\\" parameter is not set to \\\"0\\\", \\\"never\\\", or is set to a value less than \\\"900\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nNote: The maximum configurable value for \\\"unlock_time\\\" is \\\"604800\\\". \\n\\nIf any line referencing the \\\"pam_faillock.so\\\" module is commented out, this is a finding.\\n\\n# grep pam_faillock.so /etc/pam.d/system-auth\\n\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so \\n\\nIf the \\\"deny\\\" parameter is set to \\\"0\\\" or a value less than \\\"3\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"even_deny_root\\\" parameter is not set on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"fail_interval\\\" parameter is set to \\\"0\\\" or is set to a value less than \\\"900\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module, or is missing from these lines, this is a finding.\\n\\nIf the \\\"unlock_time\\\" parameter is not set to \\\"0\\\", \\\"never\\\", or is set to a value less than \\\"900\\\" on both \\\"auth\\\" lines with the \\\"pam_faillock.so\\\" module or is missing from these lines, this is a finding.\\n\\nNote: The maximum configurable value for \\\"unlock_time\\\" is \\\"604800\\\". \\nIf any line referencing the \\\"pam_faillock.so\\\" module is commented out, this is a finding.\"]\n[41506,\"Verify the operating system automatically locks the root account until it is released by an administrator when three unsuccessful logon attempts in 15 minutes are made.\\n\\n# grep pam_faillock.so /etc/pam.d/password-auth\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900 \\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900 \\naccount required pam_faillock.so\\n\\nIf the \\\"even_deny_root\\\" setting is not defined on both lines with the \\\"pam_faillock.so\\\" module, is commented out, or is missing from a line, this is a finding.\\n\\n# grep pam_faillock.so /etc/pam.d/system-auth\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900 \\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so\\n\\nIf the \\\"even_deny_root\\\" setting is not defined on both lines with the \\\"pam_faillock.so\\\" module, is commented out, or is missing from a line, this is a finding.\"]\n[41507,\"If passwords are not being used for authentication, this is Not Applicable.\\n\\nVerify the operating system requires users to supply a password for privilege escalation.\\n\\nCheck the configuration of the \\\"/etc/sudoers\\\" and \\\"/etc/sudoers.d/*\\\" files with the following command:\\n\\n# grep -i nopasswd /etc/sudoers /etc/sudoers.d/*\\n\\nIf any uncommented line is found with a \\\"NOPASSWD\\\" tag, this is a finding.\"]\n[41508,\"Verify the operating system requires users to reauthenticate for privilege escalation.\\n\\nCheck the configuration of the \\\"/etc/sudoers\\\" and \\\"/etc/sudoers.d/*\\\" files with the following command:\\n\\n# grep -i authenticate /etc/sudoers /etc/sudoers.d/*\\n\\nIf any uncommented line is found with a \\\"!authenticate\\\" tag, this is a finding.\"]\n[41509,\"Verify the operating system enforces a delay of at least four seconds between console logon prompts following a failed logon attempt.\\n\\nCheck the value of the \\\"fail_delay\\\" parameter in the \\\"/etc/login.defs\\\" file with the following command:\\n\\n# grep -i fail_delay /etc/login.defs\\nFAIL_DELAY 4\\n\\nIf the value of \\\"FAIL_DELAY\\\" is not set to \\\"4\\\" or greater, or the line is commented out, this is a finding.\"]\n[41510,\"Verify the operating system does not allow an unattended or automatic logon to the system via a graphical user interface.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nCheck for the value of the \\\"AutomaticLoginEnable\\\" in the \\\"/etc/gdm/custom.conf\\\" file with the following command:\\n\\n# grep -i automaticloginenable /etc/gdm/custom.conf\\nAutomaticLoginEnable=false\\n\\nIf the value of \\\"AutomaticLoginEnable\\\" is not set to \\\"false\\\", this is a finding.\"]\n[41511,\"Verify the operating system does not allow an unrestricted logon to the system via a graphical user interface.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \\n\\nCheck for the value of the \\\"TimedLoginEnable\\\" parameter in \\\"/etc/gdm/custom.conf\\\" file with the following command:\\n\\n# grep -i timedloginenable /etc/gdm/custom.conf\\nTimedLoginEnable=false\\n\\nIf the value of \\\"TimedLoginEnable\\\" is not set to \\\"false\\\", this is a finding.\"]\n[41512,\"Verify the operating system does not allow users to override environment variables to the SSH daemon.\\n\\nCheck for the value of the \\\"PermitUserEnvironment\\\" keyword with the following command:\\n\\n# grep -i permituserenvironment /etc/ssh/sshd_config\\nPermitUserEnvironment no\\n\\nIf the \\\"PermitUserEnvironment\\\" keyword is not set to \\\"no\\\", is missing, or is commented out, this is a finding.\"]\n[41513,\"Verify the operating system does not allow a non-certificate trusted host SSH logon to the system.\\n\\nCheck for the value of the \\\"HostbasedAuthentication\\\" keyword with the following command:\\n\\n# grep -i hostbasedauthentication /etc/ssh/sshd_config\\nHostbasedAuthentication no\\n\\nIf the \\\"HostbasedAuthentication\\\" keyword is not set to \\\"no\\\", is missing, or is commented out, this is a finding.\"]\n[41514,\"For systems that use UEFI, this is Not Applicable.\\nFor systems that are running RHEL 7.2 or newer, this is Not Applicable.\\n\\nCheck to see if an encrypted root password is set. On systems that use a BIOS, use the following command:\\n\\n# grep -i password_pbkdf2 /boot/grub2/grub.cfg\\n\\npassword_pbkdf2 [superusers-account] [password-hash]\\n\\nIf the root password entry does not begin with \\\"password_pbkdf2\\\", this is a finding.\\n\\nIf the \\\"superusers-account\\\" is not set to \\\"root\\\", this is a finding.\"]\n[41515,\"Verify the operating system must require authentication upon booting into single-user and maintenance modes.\\n\\nCheck that the operating system requires authentication upon booting into single-user mode with the following command:\\n\\n# grep -i execstart /usr/lib/systemd/system/rescue.service | grep -i sulogin\\n\\nExecStart=-/bin/sh -c \\\"/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default\\\"\\n\\nIf \\\"ExecStart\\\" does not have \\\"/usr/sbin/sulogin\\\" as an option, this is a finding.\"]\n[41516,\"For systems that use UEFI, this is Not Applicable.\\n\\nFor systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\\n\\nCheck to see if an encrypted root password is set. On systems that use a BIOS, use the following command:\\n\\n# grep -iw grub2_password /boot/grub2/user.cfg\\nGRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]\\n\\nIf the root password does not begin with \\\"grub.pbkdf2.sha512\\\", this is a finding.\\n\\nVerify that the \\\"root\\\" account is set as the \\\"superusers\\\":\\n\\n# grep -iw \\\"superusers\\\" /boot/grub2/grub.cfg\\n    set superusers=\\\"root\\\"\\n    export superusers\\n\\nIf \\\"superusers\\\" is not set to \\\"root\\\", this is a finding.\"]\n[41517,\"For systems that use BIOS, this is Not Applicable.\\nFor systems that are running RHEL 7.2 or newer, this is Not Applicable.\\n\\nCheck to see if an encrypted root password is set. On systems that use UEFI, use the following command:\\n\\n# grep -i password /boot/efi/EFI/redhat/grub.cfg\\n\\npassword_pbkdf2 [superusers-account] [password-hash]\\n\\nIf the root password entry does not begin with \\\"password_pbkdf2\\\", this is a finding.\\n\\nIf the \\\"superusers-account\\\" is not set to \\\"root\\\", this is a finding.\"]\n[41518,\"For systems that use BIOS, this is Not Applicable.\\n\\nFor systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\\n\\nCheck to see if an encrypted root password is set. On systems that use UEFI, use the following command:\\n\\n# grep -iw grub2_password /boot/efi/EFI/redhat/user.cfg\\nGRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]\\n\\nIf the root password does not begin with \\\"grub.pbkdf2.sha512\\\", this is a finding.\\n\\nVerify that the \\\"root\\\" account is set as the \\\"superusers\\\":\\n\\n# grep -iw \\\"superusers\\\" /boot/efi/EFI/redhat/grub.cfg\\n    set superusers=\\\"root\\\"\\n    export superusers\\n\\nIf \\\"superusers\\\" is not set to \\\"root\\\", this is a finding.\"]\n[41519,\"Verify the operating system requires multifactor authentication to uniquely identify organizational users using multifactor authentication.\\n\\nCheck to see if smartcard authentication is enforced on the system:\\n\\n# authconfig --test | grep \\\"pam_pkcs11 is enabled\\\"\\n\\nIf no results are returned, this is a finding.\\n\\n# authconfig --test | grep \\\"smartcard removal action\\\"\\n\\nIf \\\"smartcard removal action\\\" is blank, this is a finding.\\n\\n# authconfig --test | grep \\\"smartcard module\\\"\\n\\nIf \\\"smartcard module\\\" is blank, this is a finding.\"]\n[41520,\"Check to see if the rsh-server package is installed with the following command:\\n\\n# yum list installed rsh-server\\n\\nIf the rsh-server package is installed, this is a finding.\"]\n[41521,\"The NIS service provides an unencrypted authentication service that does not provide for the confidentiality and integrity of user passwords or the remote session.\\n\\nCheck to see if the \\\"ypserve\\\" package is installed with the following command:\\n\\n# yum list installed ypserv\\n\\nIf the \\\"ypserv\\\" package is installed, this is a finding.\"]\n[41522,\"If an HBSS or HIPS is active on the system, this is Not Applicable.\\n\\nVerify the operating system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.\\n\\nGet a list of authorized users (other than System Administrator and guest accounts) for the system.\\n\\nCheck the list against the system by using the following command:\\n\\n# semanage login -l | more\\nLogin Name SELinux User MLS/MCS Range Service\\n__default__ user_u s0-s0:c0.c1023 *\\nroot unconfined_u s0-s0:c0.c1023 *\\nsystem_u system_u s0-s0:c0.c1023 *\\njoe staff_u s0-s0:c0.c1023 *\\n\\nAll administrators must be mapped to the \\\"sysadm_u\\\" or \\\"staff_u\\\" users role.\\n\\nAll authorized non-administrative users must be mapped to the \\\"user_u\\\" role.\\n\\nIf they are not mapped in this way, this is a finding.\"]\n[41523,\"Verify the operating system routinely checks the baseline configuration for unauthorized changes.\\n\\nNote: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed at least once per week.\\n\\nCheck to see if AIDE is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the SA how file integrity checks are performed on the system.\\n\\nCheck for the presence of a cron job running daily or weekly on the system that executes AIDE daily to scan for changes to the system baseline. The command used in the example will use a daily occurrence.\\n\\nCheck the cron directories for a script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:\\n\\n# ls -al /etc/cron.* | grep aide\\n-rwxr-xr-x 1 root root 29 Nov 22 2015 aide\\n\\n# grep aide /etc/crontab /var/spool/cron/root\\n/etc/crontab: 30 04 * * * /root/aide\\n/var/spool/cron/root: 30 04 * * * /root/aide\\n\\nIf the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, this is a finding.\"]\n[41524,\"Verify the operating system notifies designated personnel if baseline configurations are changed in an unauthorized manner.\\n\\nNote: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed and notify specified individuals via email or an alert.\\n\\nCheck to see if AIDE is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the SA how file integrity checks are performed on the system. \\n\\nCheck for the presence of a cron job running routinely on the system that executes AIDE to scan for changes to the system baseline. The commands used in the example will use a daily occurrence.\\n\\nCheck the cron directories for a \\\"crontab\\\" script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:\\n\\n# ls -al /etc/cron.* | grep aide\\n-rwxr-xr-x 1 root root 32 Jul 1 2011 aide\\n\\n# grep aide /etc/crontab /var/spool/cron/root\\n/etc/crontab: 30 04 * * * /root/aide\\n/var/spool/cron/root: 30 04 * * * /root/aide\\n\\nAIDE does not have a configuration that will send a notification, so the cron job uses the mail application on the system to email the results of the file integrity run as in the following example:\\n\\n# more /etc/cron.daily/aide\\n#!/bin/bash\\n\\n/usr/sbin/aide --check | /bin/mail -s \\\"$HOSTNAME - Daily aide integrity check run\\\" root@sysname.mil\\n\\nIf the file integrity application does not notify designated personnel of changes, this is a finding.\"]\n[41525,\"Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components from a repository without verification that they have been digitally signed using a certificate that is recognized and approved by the organization.\\n\\nCheck that yum verifies the signature of packages from a repository prior to install with the following command:\\n\\n# grep gpgcheck /etc/yum.conf\\ngpgcheck=1\\n\\nIf \\\"gpgcheck\\\" is not set to \\\"1\\\", or if options are missing or commented out, ask the System Administrator how the certificates for patches and other operating system components are verified. \\n\\nIf there is no process to validate certificates that is approved by the organization, this is a finding.\"]\n[41526,\"Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components of local packages without verification that they have been digitally signed using a certificate that is recognized and approved by the organization.\\n\\nCheck that yum verifies the signature of local packages prior to install with the following command:\\n\\n# grep localpkg_gpgcheck /etc/yum.conf\\nlocalpkg_gpgcheck=1\\n\\nIf \\\"localpkg_gpgcheck\\\" is not set to \\\"1\\\", or if options are missing or commented out, ask the System Administrator how the signatures of local packages and other operating system components are verified. \\n\\nIf there is no process to validate the signatures of local packages that is approved by the organization, this is a finding.\"]\n[41527,\"If there is an HBSS with a Device Control Module and a Data Loss Prevention mechanism, this requirement is not applicable.\\n\\nVerify the operating system disables the ability to load the USB Storage kernel module.\\n\\n# grep -r usb-storage /etc/modprobe.d/* | grep -i \\\"/bin/true\\\" | grep -v \\\"^#\\\"\\n\\ninstall usb-storage /bin/true\\n\\nIf the command does not return any output, or the line is commented out, and use of USB Storage is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\\n\\nVerify the operating system disables the ability to use USB mass storage devices.\\n\\nCheck to see if USB mass storage is disabled with the following command:\\n\\n# grep usb-storage /etc/modprobe.d/* | grep -i \\\"blacklist\\\" | grep -v \\\"^#\\\"\\nblacklist usb-storage\\n\\nIf the command does not return any output or the output is not \\\"blacklist usb-storage\\\", and use of USB storage devices is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[41528,\"Verify the operating system disables the ability to load the DCCP kernel module.\\n\\n# grep -r dccp /etc/modprobe.d/* | grep -i \\\"/bin/true\\\" | grep -v \\\"^#\\\"\\n\\ninstall dccp /bin/true\\n\\nIf the command does not return any output, or the line is commented out, and use of DCCP is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\\n\\nVerify the operating system disables the ability to use the DCCP kernel module.\\n\\nCheck to see if the DCCP kernel module is disabled with the following command:\\n\\n# grep -i dccp /etc/modprobe.d/* | grep -i \\\"blacklist\\\" | grep -v \\\"^#\\\"\\n\\nblacklist dccp\\n\\nIf the command does not return any output or the output is not \\\"blacklist dccp\\\", and use of the dccp kernel module is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[41529,\"Verify the operating system disables the ability to automount devices.\\n\\nCheck to see if automounter service is active with the following command:\\n\\n# systemctl status autofs\\nautofs.service - Automounts filesystems on demand\\n   Loaded: loaded (/usr/lib/systemd/system/autofs.service; disabled)\\n   Active: inactive (dead)\\n\\nIf the \\\"autofs\\\" status is set to \\\"active\\\" and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[41530,\"Verify the operating system removes all software components after updated versions have been installed.\\n\\nCheck if yum is configured to remove unneeded packages with the following command:\\n\\n# grep -i clean_requirements_on_remove /etc/yum.conf\\nclean_requirements_on_remove=1\\n\\nIf \\\"clean_requirements_on_remove\\\" is not set to \\\"1\\\", \\\"True\\\", or \\\"yes\\\", or is not set in \\\"/etc/yum.conf\\\", this is a finding.\"]\n[41531,\"If an HBSS or HIPS is active on the system, this is Not Applicable.\\n\\nVerify the operating system verifies correct operation of all security functions.\\n\\nCheck if \\\"SELinux\\\" is active and in \\\"Enforcing\\\" mode with the following command:\\n\\n# getenforce\\nEnforcing\\n\\nIf \\\"SELinux\\\" is not active and not in \\\"Enforcing\\\" mode, this is a finding.\"]\n[41532,\"If an HBSS or HIPS is active on the system, this is Not Applicable.\\n\\nVerify the operating system verifies correct operation of all security functions.\\n\\nCheck if \\\"SELinux\\\" is active and is enforcing the targeted policy with the following command:\\n\\n# sestatus\\n\\nSELinux status: enabled\\n\\nSELinuxfs mount: /selinux\\n\\nSELinux root directory: /etc/selinux\\n\\nLoaded policy name: targeted\\n\\nCurrent mode: enforcing\\n\\nMode from config file: enforcing\\n\\nPolicy MLS status: enabled\\n\\nPolicy deny_unknown status: allowed\\n\\nMax kernel policy version: 28\\n\\nIf the \\\"Loaded policy name\\\" is not set to \\\"targeted\\\", this is a finding.\\n\\nVerify that the /etc/selinux/config file is configured to the \\\"SELINUXTYPE\\\" to \\\"targeted\\\":\\n\\n# grep -i \\\"selinuxtype\\\" /etc/selinux/config | grep -v '^#'\\n\\nSELINUXTYPE = targeted\\n\\nIf no results are returned or \\\"SELINUXTYPE\\\" is not set to \\\"targeted\\\", this is a finding.\"]\n[41533,\"Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed.\\n\\nCheck that the ctrl-alt-del.target is masked and not active with the following command:\\n\\n# systemctl status ctrl-alt-del.target\\n\\nctrl-alt-del.target\\nLoaded: masked (/dev/null; bad)\\nActive: inactive (dead)\\n\\nIf the ctrl-alt-del.target is not masked, this is a finding.\\n\\nIf the ctrl-alt-del.target is active, this is a finding.\"]\n[41534,\"Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed.\\n\\nCheck that the ctrl-alt-del.target is masked and not active in the GUI with the following command:\\n\\n# grep logout /etc/dconf/local.d/*\\n\\nlogout=''\\n\\nIf \\\"logout\\\" is not set to use two single quotations, or is missing, this is a finding.\"]\n[41535,\"Verify the operating system defines default permissions for all authenticated users in such a way that the user can only read and modify their own files.\\n\\nCheck for the value of the \\\"UMASK\\\" parameter in \\\"/etc/login.defs\\\" file with the following command:\\n\\nNote: If the value of the \\\"UMASK\\\" parameter is set to \\\"000\\\" in \\\"/etc/login.defs\\\" file, the Severity is raised to a CAT I.\\n\\n# grep -i umask /etc/login.defs\\nUMASK  077\\n\\nIf the value for the \\\"UMASK\\\" parameter is not \\\"077\\\", or the \\\"UMASK\\\" parameter is missing or is commented out, this is a finding.\"]\n[41536,\"Verify the version of the operating system is vendor supported.\\n\\nCheck the version of the operating system with the following command:\\n\\n# cat /etc/redhat-release\\n\\nRed Hat Enterprise Linux Server release 7.4 (Maipo)\\n\\nCurrent End of Life for RHEL 7.1 is 31 March 2017.\\n\\nCurrent End of Life for RHEL 7.2 is 30 November 2017.\\n\\nCurrent End of Life for RHEL 7.3 is 30 November 2018.\\n\\nCurrent End of Life for RHEL 7.4 is 31 August 2019.\\n\\nCurrent End of Life for RHEL 7.5 is 30 April 2020.\\n\\nCurrent End of Life for RHEL 7.6 is 31 October 2020.\\n\\nCurrent End of Life for RHEL 7.7 is 30 August 2021.\\n\\nIf the release is not supported by the vendor, this is a finding.\"]\n[41537,\"Verify the operating system security patches and updates are installed and up to date. Updates are required to be applied with a frequency determined by the site or Program Management Office (PMO). \\n\\nObtain the list of available package security updates from Red Hat. The URL for updates is https://rhn.redhat.com/errata/. It is important to note that updates provided by Red Hat may not be present on the system if the underlying packages are not installed.\\n\\nCheck that the available package security updates have been installed on the system with the following command:\\n\\n# yum history list | more\\nLoaded plugins: langpacks, product-id, subscription-manager\\nID     | Command line             | Date and time    | Action(s)      | Altered\\n-------------------------------------------------------------------------------\\n    70 | install aide             | 2016-05-05 10:58 | Install       |     1   \\n    69 | update -y                | 2016-05-04 14:34 | Update     |   18 EE\\n    68 | install vlc                | 2016-04-21 17:12 | Install        |   21   \\n    67 | update -y                | 2016-04-21 17:04 | Update     |     7 EE\\n    66 | update -y                | 2016-04-15 16:47 | E, I, U         |   84 EE\\n\\nIf package updates have not been performed on the system within the timeframe that the site/program documentation requires, this is a finding. \\n\\nTypical update frequency may be overridden by Information Assurance Vulnerability Alert (IAVA) notifications from CYBERCOM.\\n\\nIf the operating system is in non-compliance with the Information Assurance Vulnerability Management (IAVM) process, this is a finding.\"]\n[41538,\"Verify all accounts on the system are assigned to an active system, application, or user account.\\n\\nObtain the list of authorized system accounts from the Information System Security Officer (ISSO).\\n\\nCheck the system accounts on the system with the following command:\\n\\n# more /etc/passwd\\nroot:x:0:0:root:/root:/bin/bash\\nbin:x:1:1:bin:/bin:/sbin/nologin\\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\\nsync:x:5:0:sync:/sbin:/bin/sync\\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown\\nhalt:x:7:0:halt:/sbin:/sbin/halt\\ngames:x:12:100:games:/usr/games:/sbin/nologin\\ngopher:x:13:30:gopher:/var/gopher:/sbin/nologin\\n\\nAccounts such as \\\"games\\\" and \\\"gopher\\\" are not authorized accounts as they do not support authorized system functions. \\n\\nIf the accounts on the system do not match the provided documentation, or accounts that do not support an authorized system function are present, this is a finding.\"]\n[41539,\"Verify all GIDs referenced in the \\\"/etc/passwd\\\" file are defined in the \\\"/etc/group\\\" file.\\n\\nCheck that all referenced GIDs exist with the following command:\\n\\n# pwck -r\\n\\nIf GIDs referenced in \\\"/etc/passwd\\\" file are returned as not defined in \\\"/etc/group\\\" file, this is a finding.\"]\n[41540,\"Check the system for duplicate UID \\\"0\\\" assignments with the following command:\\n\\n# awk -F: '$3 == 0 {print $1}' /etc/passwd\\n\\nIf any accounts other than root have a UID of \\\"0\\\", this is a finding.\"]\n[41541,\"Verify all files and directories on the system have a valid owner.\\n\\nCheck the owner of all files and directories with the following command:\\n\\nNote: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\\n\\n# find / -fstype xfs -nouser\\n\\nIf any files on the system do not have an assigned owner, this is a finding.\"]\n[41542,\"Verify all files and directories on the system have a valid group.\\n\\nCheck the owner of all files and directories with the following command:\\n\\nNote: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\\n\\n# find / -fstype xfs -nogroup\\n\\nIf any files on the system do not have an assigned group, this is a finding.\"]\n[41543,\"Verify local interactive users on the system have a home directory assigned.\\n\\nCheck for missing local interactive user home directories with the following command:\\n\\n# pwck -r\\nuser 'lp': directory '/var/spool/lpd' does not exist\\nuser 'news': directory '/var/spool/news' does not exist\\nuser 'uucp': directory '/var/spool/uucp' does not exist\\nuser 'smithj': directory '/home/smithj' does not exist\\n\\nAsk the System Administrator (SA) if any users found without home directories are local interactive users. If the SA is unable to provide a response, check for users with a User Identifier (UID) of 1000 or greater with the following command:\\n\\n# cut -d: -f 1,3 /etc/passwd | egrep \\\":[1-4][0-9]{2}$|:[0-9]{1,2}$\\\"\\n\\nIf any interactive users do not have a home directory assigned, this is a finding.\"]\n[41544,\"Verify all local interactive users on the system are assigned a home directory upon creation.\\n\\nCheck to see if the system is configured to create home directories for local interactive users with the following command:\\n\\n# grep -i create_home /etc/login.defs\\nCREATE_HOME yes\\n\\nIf the value for \\\"CREATE_HOME\\\" parameter is not set to \\\"yes\\\", the line is missing, or the line is commented out, this is a finding.\"]\n[41545,\"Verify the assigned home directory of all local interactive users on the system exists.\\n\\nCheck the home directory assignment for all local interactive non-privileged users on the system with the following command:\\n\\n# cut -d: -f 1,3,6 /etc/passwd | egrep \\\":[1-4][0-9]{3}\\\"\\n\\nsmithj:1001:/home/smithj\\n\\nNote: This may miss interactive users that have been assigned a privileged UID. Evidence of interactive use may be obtained from a number of log files containing system logon information.\\n\\nCheck that all referenced home directories exist with the following command:\\n\\n# pwck -r\\nuser 'smithj': directory '/home/smithj' does not exist\\n\\nIf any home directories referenced in \\\"/etc/passwd\\\" are returned as not defined, this is a finding.\"]\n[41546,\"Verify the assigned home directory of all local interactive users has a mode of \\\"0750\\\" or less permissive.\\n\\nCheck the home directory assignment for all non-privileged users on the system with the following command:\\n\\nNote: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information.\\n\\n# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6)\\n-rwxr-x--- 1 smithj users  18 Mar  5 17:06 /home/smithj\\n\\nIf home directories referenced in \\\"/etc/passwd\\\" do not have a mode of \\\"0750\\\" or less permissive, this is a finding.\"]\n[41547,\"Verify the assigned home directory of all local interactive users on the system exists.\\n\\nCheck the home directory assignment for all local interactive users on the system with the following command:\\n\\n# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6)\\n\\n-rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj\\n\\nIf any home directories referenced in \\\"/etc/passwd\\\" are not owned by the interactive user, this is a finding.\"]\n[41548,\"Verify the assigned home directory of all local interactive users is group-owned by that user's primary GID.\\n\\nCheck the home directory assignment for all local interactive users on the system with the following command:\\n\\n# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6)\\n\\n-rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj\\n\\nCheck the user's primary group with the following command:\\n\\n# grep users /etc/group\\n\\nusers:x:250:smithj,jonesj,jacksons\\n\\nIf the user home directory referenced in \\\"/etc/passwd\\\" is not group-owned by that user's primary GID, this is a finding.\"]\n[41549,\"Verify all files and directories in a local interactive user's home directory are owned by the user.\\n\\nCheck the owner of all files and directories in a local interactive user's home directory with the following command:\\n\\nNote: The example will be for the user \\\"smithj\\\", who has a home directory of \\\"/home/smithj\\\".\\n\\n# ls -lLR /home/smithj\\n-rw-r--r-- 1 smithj smithj  18 Mar  5 17:06 file1\\n-rw-r--r-- 1 smithj smithj 193 Mar  5 17:06 file2\\n-rw-r--r-- 1 smithj smithj 231 Mar  5 17:06 file3\\n\\nIf any files are found with an owner different than the home directory user, this is a finding.\"]\n[41550,\"Verify all files and directories in a local interactive user home directory are group-owned by a group the user is a member of.\\n\\nCheck the group owner of all files and directories in a local interactive user's home directory with the following command:\\n\\nNote: The example will be for the user \\\"smithj\\\", who has a home directory of \\\"/home/smithj\\\".\\n\\n# ls -lLR /<home directory>/<users home directory>/\\n-rw-r--r-- 1 smithj smithj  18 Mar  5 17:06 file1\\n-rw-r--r-- 1 smithj smithj 193 Mar  5 17:06 file2\\n-rw-r--r-- 1 smithj sa        231 Mar  5 17:06 file3\\n\\nIf any files are found with an owner different than the group home directory user, check to see if the user is a member of that group with the following command:\\n\\n# grep smithj /etc/group\\nsa:x:100:juan,shelley,bob,smithj \\nsmithj:x:521:smithj\\n\\nIf the user is not a member of a group that group owns file(s) in a local interactive user's home directory, this is a finding.\"]\n[41551,\"Verify all files and directories contained in a local interactive user home directory, excluding local initialization files, have a mode of \\\"0750\\\".\\n\\nCheck the mode of all non-initialization files in a local interactive user home directory with the following command:\\n\\nFiles that begin with a \\\".\\\" are excluded from this requirement.\\n\\nNote: The example will be for the user \\\"smithj\\\", who has a home directory of \\\"/home/smithj\\\".\\n\\n# ls -lLR /home/smithj\\n-rwxr-x--- 1 smithj smithj  18 Mar  5 17:06 file1\\n-rwxr----- 1 smithj smithj 193 Mar  5 17:06 file2\\n-rw-r-x--- 1 smithj smithj 231 Mar  5 17:06 file3\\n\\nIf any files are found with a mode more permissive than \\\"0750\\\", this is a finding.\"]\n[41552,\"Verify the local initialization files of all local interactive users are group-owned by that user's primary Group Identifier (GID).\\n\\nCheck the home directory assignment for all non-privileged users on the system with the following command:\\n\\nNote: The example will be for the smithj user, who has a home directory of \\\"/home/smithj\\\" and a primary group of \\\"users\\\".\\n\\n# cut -d: -f 1,4,6 /etc/passwd | egrep \\\":[1-4][0-9]{3}\\\"\\nsmithj:1000:/home/smithj\\n\\n# grep 1000 /etc/group\\nusers:x:1000:smithj,jonesj,jacksons \\n\\nNote: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information.\\n\\nCheck the group owner of all local interactive user's initialization files with the following command:\\n\\n# ls -al /home/smithj/.[^.]* | more\\n\\n-rwxr-xr-x 1 smithj users 896 Mar 10 2011 .profile\\n-rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login\\n-rwxr-xr-x 1 smithj users 886 Jan 6 2007 .something\\n\\nIf all local interactive user's initialization files are not group-owned by that user's primary GID, this is a finding.\"]\n[41553,\"Verify that all local initialization files have a mode of \\\"0740\\\" or less permissive.\\n\\nCheck the mode on all local initialization files with the following command:\\n\\nNote: The example will be for the \\\"smithj\\\" user, who has a home directory of \\\"/home/smithj\\\".\\n\\n# ls -al /home/smithj/.[^.]* | more\\n\\n-rwxr----- 1 smithj users 896 Mar 10 2011 .profile\\n-rwxr----- 1 smithj users 497 Jan 6 2007 .login\\n-rwxr----- 1 smithj users 886 Jan 6 2007 .something\\n\\nIf any local initialization files have a mode more permissive than \\\"0740\\\", this is a finding.\"]\n[41554,\"Verify that all local interactive user initialization files' executable search path statements do not contain statements that will reference a working directory other than the users' home directory.\\n\\nCheck the executable search path statement for all local interactive user initialization files in the users' home directory with the following commands:\\n\\nNote: The example will be for the smithj user, which has a home directory of \\\"/home/smithj\\\".\\n\\n# grep -i path /home/smithj/.*\\n/home/smithj/.bash_profile:PATH=$PATH:$HOME/.local/bin:$HOME/bin\\n/home/smithj/.bash_profile:export PATH\\n\\nIf any local interactive user initialization files have executable search path statements that include directories outside of their home directory, this is a finding.\"]\n[41555,\"Verify that local initialization files do not execute world-writable programs.\\n\\nCheck the system for world-writable files with the following command:\\n\\n# find / -xdev -perm -002 -type f -exec ls -ld {} \\\\; | more\\n\\nFor all files listed, check for their presence in the local initialization files with the following commands:\\n\\nNote: The example will be for a system that is configured to create users' home directories in the \\\"/home\\\" directory.\\n\\n# grep <file> /home/*/.*\\n\\nIf any local initialization files are found to reference world-writable files, this is a finding.\"]\n[41556,\"Verify that all system device files are correctly labeled to prevent unauthorized modification.\\n\\nList all device files on the system that are incorrectly labeled with the following commands:\\n\\nNote: Device files are normally found under \\\"/dev\\\", but applications may place device files in other directories and may necessitate a search of the entire system.\\n\\n#find /dev -context *:device_t:* \\\\( -type c -o -type b \\\\) -printf \\\"%p %Z\\\\n\\\"\\n\\n#find /dev -context *:unlabeled_t:* \\\\( -type c -o -type b \\\\) -printf \\\"%p %Z\\\\n\\\"\\n\\nNote: There are device files, such as \\\"/dev/vmci\\\", that are used when the operating system is a host virtual machine. They will not be owned by a user on the system and require the \\\"device_t\\\" label to operate. These device files are not a finding.\\n\\nIf there is output from either of these commands, other than already noted, this is a finding.\"]\n[41557,\"Verify file systems that contain user home directories are mounted with the \\\"nosuid\\\" option.\\n\\nFind the file system(s) that contain the user home directories with the following command:\\n\\nNote: If a separate file system has not been created for the user home directories (user home directories are mounted under \\\"/\\\"), this is not a finding as the \\\"nosuid\\\" option cannot be used on the \\\"/\\\" system.\\n\\n# cut -d: -f 1,3,6 /etc/passwd | egrep \\\":[1-4][0-9]{3}\\\"\\nsmithj:1001:/home/smithj\\nthomasr:1002:/home/thomasr\\n\\nCheck the file systems that are mounted at boot time with the following command:\\n\\n# more /etc/fstab\\n\\nUUID=a411dc99-f2a1-4c87-9e05-184977be8539 /home   ext4   rw,relatime,discard,data=ordered,nosuid 0 2\\n                                                            \\nIf a file system found in \\\"/etc/fstab\\\" refers to the user home directory file system and it does not have the \\\"nosuid\\\" option set, this is a finding.\"]\n[41558,\"Verify file systems that are used for removable media are mounted with the \\\"nosuid\\\" option.\\n\\nCheck the file systems that are mounted at boot time with the following command:\\n\\n# more /etc/fstab\\n\\nUUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat noauto,owner,ro,nosuid 0 0\\n\\nIf a file system found in \\\"/etc/fstab\\\" refers to removable media and it does not have the \\\"nosuid\\\" option set, this is a finding.\"]\n[41559,\"Verify file systems that are being NFS imported are configured with the \\\"nosuid\\\" option.\\n\\nFind the file system(s) that contain the directories being exported with the following command:\\n\\n# more /etc/fstab | grep nfs\\n\\nUUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d /store nfs rw,nosuid 0 0\\n\\nIf a file system found in \\\"/etc/fstab\\\" refers to NFS and it does not have the \\\"nosuid\\\" option set, this is a finding.\\n\\nVerify the NFS is mounted with the \\\"nosuid\\\" option:\\n\\n# mount | grep nfs | grep nosuid\\nIf no results are returned, this is a finding.\"]\n[41560,\"Verify file systems that are being NFS imported are configured with the \\\"noexec\\\" option.\\n\\nFind the file system(s) that contain the directories being imported with the following command:\\n\\n# more /etc/fstab | grep nfs\\n\\nUUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d /store nfs rw,noexec 0 0\\n\\nIf a file system found in \\\"/etc/fstab\\\" refers to NFS and it does not have the \\\"noexec\\\" option set, and use of NFS imported binaries is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\\n\\nVerify the NFS is mounted with the \\\"noexec\\\"option:\\n\\n# mount | grep nfs | grep noexec\\nIf no results are returned and use of NFS imported binaries is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[41561,\"Verify that the \\\"nodev\\\" option is configured for /dev/shm:\\n\\n\\n# cat /etc/fstab | grep /dev/shm\\ntmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0\\n\\nIf any results are returned and the \\\"nodev\\\" option is not listed, this is a finding.\\n\\nVerify \\\"/dev/shm\\\" is mounted with the \\\"nodev\\\" option:\\n\\n# mount | grep \\\"/dev/shm\\\" | grep nodev\\n\\nIf no results are returned, this is a finding.\"]\n[41562,\"Verify that the \\\"nosuid\\\" option is configured for /dev/shm:\\n\\n# cat /etc/fstab | grep /dev/shm\\n\\ntmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0\\n\\nIf any results are returned and the \\\"nosuid\\\" option is not listed, this is a finding.\\n\\nVerify \\\"/dev/shm\\\" is mounted with the \\\"nosuid\\\" option:\\n\\n# mount | grep \\\"/dev/shm\\\" | grep nosuid\\n\\nIf no results are returned, this is a finding.\"]\n[41563,\"Verify that the \\\"noexec\\\" option is configured for /dev/shm:\\n\\n# cat /etc/fstab | grep /dev/shm\\n\\ntmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0\\n\\nIf any results are returned and the \\\"noexec\\\" option is not listed, this is a finding.\\n\\nVerify \\\"/dev/shm\\\" is mounted with the \\\"noexec\\\" option:\\n\\n# mount | grep \\\"/dev/shm\\\" | grep noexec\\n\\nIf no results are returned, this is a finding.\"]\n[41564,\"Verify all world-writable directories are group-owned by root, sys, bin, or an application group.\\n\\nCheck the system for world-writable directories with the following command:\\n\\nNote: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\\n\\n# find / -xdev -perm -002 -type d -fstype xfs -exec ls -lLd {} \\\\;\\ndrwxrwxrwt 2 root root 40 Aug 26 13:07 /dev/mqueue\\ndrwxrwxrwt 2 root root 220 Aug 26 13:23 /dev/shm\\ndrwxrwxrwt 14 root root 4096 Aug 26 13:29 /tmp\\n\\nIf any world-writable directories are not owned by root, sys, bin, or an application group associated with the directory, this is a finding.\"]\n[41565,\"Verify that the default umask for all local interactive users is \\\"077\\\".\\n\\nIdentify the locations of all local interactive user home directories by looking at the \\\"/etc/passwd\\\" file.\\n\\nCheck all local interactive user initialization files for interactive users with the following command:\\n\\nNote: The example is for a system that is configured to create users home directories in the \\\"/home\\\" directory.\\n\\n# grep -i umask /home/*/.*\\n\\nIf any local interactive user initialization files are found to have a umask statement that has a value less restrictive than \\\"077\\\", this is a finding.\"]\n[41566,\"Verify that \\\"rsyslog\\\" is configured to log cron events.\\n\\nCheck the configuration of \\\"/etc/rsyslog.conf\\\" or \\\"/etc/rsyslog.d/*.conf\\\" files for the cron facility with the following command:\\n\\nNote: If another logging package is used, substitute the utility configuration file for \\\"/etc/rsyslog.conf\\\" or \\\"/etc/rsyslog.d/*.conf\\\" files.\\n\\n# grep cron /etc/rsyslog.conf  /etc/rsyslog.d/*.conf\\ncron.* /var/log/cron.log\\n\\nIf the command does not return a response, check for cron logging all facilities by inspecting the \\\"/etc/rsyslog.conf\\\" or \\\"/etc/rsyslog.d/*.conf\\\" files.\\n\\nLook for the following entry:\\n\\n*.* /var/log/messages\\n\\nIf \\\"rsyslog\\\" is not logging messages for the cron facility or all facilities, this is a finding.\"]\n[41567,\"Verify that the \\\"cron.allow\\\" file is owned by root.\\n\\nCheck the owner of the \\\"cron.allow\\\" file with the following command:\\n\\n# ls -al /etc/cron.allow\\n-rw------- 1 root root 6 Mar  5  2011 /etc/cron.allow\\n\\nIf the \\\"cron.allow\\\" file exists and has an owner other than root, this is a finding.\"]\n[41568,\"Verify that the \\\"cron.allow\\\" file is group-owned by root.\\n\\nCheck the group owner of the \\\"cron.allow\\\" file with the following command:\\n\\n# ls -al /etc/cron.allow\\n-rw------- 1 root root 6 Mar  5  2011 /etc/cron.allow\\n\\nIf the \\\"cron.allow\\\" file exists and has a group owner other than root, this is a finding.\"]\n[41569,\"Verify that kernel core dumps are disabled unless needed.\\n\\nCheck the status of the \\\"kdump\\\" service with the following command:\\n\\n# systemctl status kdump.service\\nkdump.service - Crash recovery kernel arming\\n   Loaded: loaded (/usr/lib/systemd/system/kdump.service; enabled)\\n   Active: active (exited) since Wed 2015-08-26 13:08:09 EDT; 43min ago\\n Main PID: 1130 (code=exited, status=0/SUCCESS)\\nkernel arming.\\n\\nIf the \\\"kdump\\\" service is active, ask the System Administrator if the use of the service is required and documented with the Information System Security Officer (ISSO).\\n\\nIf the service is active and is not documented, this is a finding.\"]\n[41570,\"Verify that a separate file system/partition has been created for non-privileged local interactive user home directories.\\n\\nCheck the home directory assignment for all non-privileged users (those with a UID greater than 1000) on the system with the following command:\\n\\n#cut -d: -f 1,3,6,7 /etc/passwd | egrep \\\":[1-4][0-9]{3}\\\" | tr \\\":\\\" \\\"\\\\t\\\"\\n\\nadamsj /home/adamsj /bin/bash\\njacksonm /home/jacksonm /bin/bash\\nsmithj /home/smithj /bin/bash\\n\\nThe output of the command will give the directory/partition that contains the home directories for the non-privileged users on the system (in this example, /home) and users' shell. All accounts with a valid shell (such as /bin/bash) are considered interactive users.\\n\\nCheck that a file system/partition has been created for the non-privileged interactive users with the following command:\\n\\nNote: The partition of /home is used in the example.\\n\\n# grep /home /etc/fstab\\nUUID=333ada18    /home                   ext4    noatime,nobarrier,nodev  1 2\\n\\nIf a separate entry for the file system/partition that contains the non-privileged interactive users' home directories does not exist, this is a finding.\"]\n[41571,\"Verify that a separate file system/partition has been created for \\\"/var\\\".\\n\\nCheck that a file system/partition has been created for \\\"/var\\\" with the following command:\\n\\n# grep /var /etc/fstab\\nUUID=c274f65f    /var                    ext4    noatime,nobarrier        1 2\\n\\nIf a separate entry for \\\"/var\\\" is not in use, this is a finding.\"]\n[41572,\"Determine if the operating system is configured to have the \\\"/var/log/audit\\\" path is on a separate file system.\\n\\n# grep /var/log/audit /etc/fstab\\n\\nIf no result is returned, or the operating system is not configured to have \\\"/var/log/audit\\\" on a separate file system, this is a finding.\\n\\nVerify that \\\"/var/log/audit\\\" is mounted on a separate file system:\\n\\n# mount | grep \\\"/var/log/audit\\\"\\n\\nIf no result is returned, or \\\"/var/log/audit\\\" is not on a separate file system, this is a finding.\"]\n[41573,\"Verify that a separate file system/partition has been created for \\\"/tmp\\\".\\n\\nCheck that a file system/partition has been created for \\\"/tmp\\\" with the following command:\\n\\n# systemctl is-enabled tmp.mount\\nenabled\\n\\nIf the \\\"tmp.mount\\\" service is not enabled, check to see if \\\"/tmp\\\" is defined in the fstab with a device and mount point:\\n\\n# grep -i /tmp /etc/fstab\\nUUID=a411dc99-f2a1-4c87-9e05-184977be8539 /tmp   ext4   rw,relatime,discard,data=ordered,nosuid,noexec, 0 0\\n\\nIf \\\"tmp.mount\\\" service is not enabled and the \\\"/tmp\\\" directory is not defined in the fstab with a device and mount point, this is a finding.\"]\n[41574,\"Verify the operating system implements DoD-approved encryption to protect the confidentiality of remote access sessions.\\n\\nCheck to see if the \\\"dracut-fips\\\" package is installed with the following command:\\n\\n# yum list installed dracut-fips\\n\\ndracut-fips-033-360.el7_2.x86_64.rpm\\n\\nIf a \\\"dracut-fips\\\" package is installed, check to see if the kernel command line is configured to use FIPS mode with the following command:\\n\\nNote: GRUB 2 reads its configuration from the \\\"/boot/grub2/grub.cfg\\\" file on traditional BIOS-based machines and from the \\\"/boot/efi/EFI/redhat/grub.cfg\\\" file on UEFI machines.\\n\\n# grep fips /boot/grub2/grub.cfg\\n/vmlinuz-3.8.0-0.40.el7.x86_64 root=/dev/mapper/rhel-root ro rd.md=0 rd.dm=0 rd.lvm.lv=rhel/swap crashkernel=auto rd.luks=0 vconsole.keymap=us rd.lvm.lv=rhel/root rhgb fips=1 quiet\\n\\nIf the kernel command line is configured to use FIPS mode, check to see if the system is in FIPS mode with the following command:\\n\\n# cat /proc/sys/crypto/fips_enabled \\n1\\n\\nIf a \\\"dracut-fips\\\" package is not installed, the kernel command line does not have a fips entry, or the system has a value of \\\"0\\\" for \\\"fips_enabled\\\" in \\\"/proc/sys/crypto\\\", this is a finding.\"]\n[41575,\"Verify the file integrity tool is configured to verify ACLs.\\n\\nCheck to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. \\n\\nIf there is no application installed to perform file integrity checks, this is a finding.\\n\\nNote: AIDE is highly configurable at install time. These commands assume the \\\"aide.conf\\\" file is under the \\\"/etc\\\" directory. \\n\\nUse the following command to determine if the file is in another location:\\n\\n# find / -name aide.conf\\n\\nCheck the \\\"aide.conf\\\" file to determine if the \\\"acl\\\" rule has been added to the rule list being applied to the files and directories selection lists.\\n\\nAn example rule that includes the \\\"acl\\\" rule is below:\\n\\nAll= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\\n/bin All # apply the custom rule to the files in bin \\n/sbin All # apply the same custom rule to the files in sbin \\n\\nIf the \\\"acl\\\" rule is not being used on all uncommented selection lines in the \\\"/etc/aide.conf\\\" file, or ACLs are not being checked by another file integrity tool, this is a finding.\"]\n[41576,\"Verify the file integrity tool is configured to verify extended attributes.\\n\\nCheck to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system.\\n\\nIf there is no application installed to perform file integrity checks, this is a finding.\\n\\nNote: AIDE is highly configurable at install time. These commands assume the \\\"aide.conf\\\" file is under the \\\"/etc\\\" directory.\\n\\nUse the following command to determine if the file is in another location:\\n\\n# find / -name aide.conf\\n\\nCheck the \\\"aide.conf\\\" file to determine if the \\\"xattrs\\\" rule has been added to the rule list being applied to the files and directories selection lists.\\n\\nAn example rule that includes the \\\"xattrs\\\" rule follows:\\n\\nAll= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\\n/bin All # apply the custom rule to the files in bin \\n/sbin All # apply the same custom rule to the files in sbin \\n\\nIf the \\\"xattrs\\\" rule is not being used on all uncommented selection lines in the \\\"/etc/aide.conf\\\" file, or extended attributes are not being checked by another file integrity tool, this is a finding.\"]\n[41577,\"Verify the file integrity tool is configured to use FIPS 140-2 approved cryptographic hashes for validating file contents and directories.\\n\\nNote: If RHEL-07-021350 is a finding, this is automatically a finding too as the system cannot implement FIPS 140-2 approved cryptographic algorithms and hashes.\\n\\nCheck to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command:\\n\\n# yum list installed aide\\n\\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. \\n\\nIf there is no application installed to perform file integrity checks, this is a finding.\\n\\nNote: AIDE is highly configurable at install time. These commands assume the \\\"aide.conf\\\" file is under the \\\"/etc\\\" directory. \\n\\nUse the following command to determine if the file is in another location:\\n\\n# find / -name aide.conf\\n\\nCheck the \\\"aide.conf\\\" file to determine if the \\\"sha512\\\" rule has been added to the rule list being applied to the files and directories selection lists.\\n\\nAn example rule that includes the \\\"sha512\\\" rule follows:\\n\\nAll=p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\\n/bin All # apply the custom rule to the files in bin \\n/sbin All # apply the same custom rule to the files in sbin \\n\\nIf the \\\"sha512\\\" rule is not being used on all uncommented selection lines in the \\\"/etc/aide.conf\\\" file, or another file integrity tool is not using FIPS 140-2 approved cryptographic hashes for validating file contents and directories, this is a finding.\"]\n[41578,\"Verify the system is not configured to use a boot loader on removable media.\\n\\nNote: GRUB 2 reads its configuration from the \\\"/boot/grub2/grub.cfg\\\" file on traditional BIOS-based machines and from the \\\"/boot/efi/EFI/redhat/grub.cfg\\\" file on UEFI machines.\\n\\nCheck for the existence of alternate boot loader configuration files with the following command:\\n\\n# find / -name grub.cfg\\n/boot/grub2/grub.cfg\\n\\nIf a \\\"grub.cfg\\\" is found in any subdirectories other than \\\"/boot/grub2\\\" and \\\"/boot/efi/EFI/redhat\\\", ask the System Administrator if there is documentation signed by the ISSO to approve the use of removable media as a boot loader. \\n\\nCheck that the grub configuration file has the set root command in each menu entry with the following commands:\\n\\n# grep -c menuentry /boot/grub2/grub.cfg\\n1\\n# grep 'set root' /boot/grub2/grub.cfg\\nset root=(hd0,1)\\n\\nIf the system is using an alternate boot loader on removable media, and documentation does not exist approving the alternate configuration, this is a finding.\"]\n[41579,\"Verify the operating system is configured to disable non-essential capabilities. The most secure way of ensuring a non-essential capability is disabled is to not have the capability installed.\\n\\nThe telnet service provides an unencrypted remote access service that does not provide for the confidentiality and integrity of user passwords or the remote session.\\n\\nIf a privileged user were to log on using this service, the privileged user password could be compromised. \\n\\nCheck to see if the telnet-server package is installed with the following command:\\n\\n# yum list installed telnet-server\\n\\nIf the telnet-server package is installed, this is a finding.\"]\n[41580,\"Verify the operating system produces audit records containing information to establish when (date and time) the events occurred.\\n\\nCheck to see if auditing is active by issuing the following command:\\n\\n# systemctl is-active auditd.service\\nactive\\n\\nIf the \\\"auditd\\\" status is not active, this is a finding.\"]\n[41581,\"Confirm the audit configuration regarding how auditing processing failures are handled.\\n\\nCheck to see what level \\\"auditctl\\\" is set to with following command: \\n\\n# auditctl -s | grep -i \\\"fail\\\"\\n\\nfailure 2\\n\\nIf the value of \\\"failure\\\" is set to \\\"2\\\", the system is configured to panic (shut down) in the event of an auditing failure.\\n\\nIf the value of \\\"failure\\\" is set to \\\"1\\\", the system is configured to only send information to the kernel log regarding the failure.\\n\\nIf the \\\"failure\\\" setting is not set, this is a CAT I finding.\\n\\nIf the \\\"failure\\\" setting is set to any value other than \\\"1\\\" or \\\"2\\\", this is a CAT II finding.\\n\\nIf the \\\"failure\\\" setting is set to \\\"1\\\" but the availability concern is not documented or there is no monitoring of the kernel log, this is a CAT III finding.\"]\n[41582,\"Verify the \\\"au-remote\\\" plugin is active on the system:\\n\\n# grep \\\"active\\\" /etc/audisp/plugins.d/au-remote.conf\\n\\nactive = yes\\n\\nIf the \\\"active\\\" setting is not set to \\\"yes\\\", or the line is commented out, this is a finding.\"]\n[41583,\"Verify the \\\"au-remote\\\" plugin is configured to always off-load audit logs using the audisp-remote daemon:\\n\\n# cat /etc/audisp/plugins.d/au-remote.conf | grep -v \\\"^#\\\"\\n\\nactive = yes\\ndirection = out\\npath = /sbin/audisp-remote\\ntype = always\\nformat = string\\n\\nIf the \\\"direction\\\" setting is not set to \\\"out\\\", or the line is commented out, this is a finding.\\n\\nIf the \\\"path\\\" setting is not set to \\\"/sbin/audisp-remote\\\", or the line is commented out, this is a finding.\\n\\nIf the \\\"type\\\" setting is not set to \\\"always\\\", or the line is commented out, this is a finding.\"]\n[41584,\"Verify the audisp daemon is configured to take an appropriate action when the internal queue is full:\\n\\n# grep \\\"overflow_action\\\" /etc/audisp/audispd.conf\\n\\noverflow_action = syslog\\n\\nIf the \\\"overflow_action\\\" option is not \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\", or the line is commented out, this is a finding.\"]\n[41585,\"Verify the audisp daemon is configured to label all off-loaded audit logs:\\n\\n# grep \\\"name_format\\\" /etc/audisp/audispd.conf\\n\\nname_format = hostname\\n\\nIf the \\\"name_format\\\" option is not \\\"hostname\\\", \\\"fqd\\\", or \\\"numeric\\\", or the line is commented out, this is a finding.\"]\n[41586,\"Verify the operating system off-loads audit records onto a different system or media from the system being audited.\\n\\nTo determine the remote server that the records are being sent to, use the following command:\\n\\n# grep -i remote_server /etc/audisp/audisp-remote.conf\\nremote_server = 10.0.21.1\\n\\nIf a remote server is not configured, or the line is commented out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. \\n\\nIf there is no evidence that the audit logs are being off-loaded to another system or media, this is a finding.\"]\n[41587,\"Verify the operating system encrypts audit records off-loaded onto a different system or media from the system being audited.\\n\\nTo determine if the transfer is encrypted, use the following command:\\n\\n# grep -i enable_krb5 /etc/audisp/audisp-remote.conf\\nenable_krb5 = yes\\n\\nIf the value of the \\\"enable_krb5\\\" option is not set to \\\"yes\\\" or the line is commented out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. \\n\\nIf there is no evidence that the transfer of the audit logs being off-loaded to another system or media is encrypted, this is a finding.\"]\n[41588,\"Verify the action the operating system takes if the disk the audit records are written to becomes full.\\n\\nTo determine the action that takes place if the disk is full on the remote server, use the following command:\\n\\n# grep -i disk_full_action /etc/audisp/audisp-remote.conf\\ndisk_full_action = single\\n\\nIf the value of the \\\"disk_full_action\\\" option is not \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\", or the line is commented out, this is a finding.\"]\n[41589,\"Verify the action the operating system takes if there is an error sending audit records to a remote system.\\n\\nCheck the action that takes place if there is an error sending audit records to a remote system with the following command:\\n\\n# grep -i network_failure_action /etc/audisp/audisp-remote.conf\\nnetwork_failure_action = syslog\\n\\nIf the value of the \\\"network_failure_action\\\" option is not \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\", or the line is commented out, this is a finding.\"]\n[41590,\"Verify the operating system initiates an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\\n\\nCheck the system configuration to determine the partition the audit records are being written to with the following command:\\n\\n# grep -iw log_file /etc/audit/auditd.conf\\nlog_file = /var/log/audit/audit.log\\n\\nCheck the size of the partition that audit records are written to (with the example being \\\"/var/log/audit/\\\"):\\n\\n# df -h /var/log/audit/\\n0.9G /var/log/audit\\n\\nIf the audit records are not being written to a partition specifically created for audit records (in this example \\\"/var/log/audit\\\" is a separate partition), determine the amount of space other files in the partition are currently occupying with the following command:\\n\\n# du -sh <partition>\\n1.8G /var\\n\\nDetermine what the threshold is for the system to take action when 75 percent of the repository maximum audit record storage capacity is reached:\\n\\n# grep -iw space_left /etc/audit/auditd.conf\\nspace_left = 225 \\n\\nIf the value of the \\\"space_left\\\" keyword is not set to 25 percent of the total partition size, this is a finding.\"]\n[41591,\"Verify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\\n\\nCheck what action the operating system takes when the threshold for the repository maximum audit record storage capacity is reached with the following command:\\n\\n# grep -i space_left_action  /etc/audit/auditd.conf\\nspace_left_action = email\\n\\nIf the value of the \\\"space_left_action\\\" keyword is not set to \\\"email\\\", this is a finding.\"]\n[41592,\"Verify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the threshold for the repository maximum audit record storage capacity is reached.\\n\\nCheck what account the operating system emails when the threshold for the repository maximum audit record storage capacity is reached with the following command:\\n\\n# grep -i action_mail_acct  /etc/audit/auditd.conf\\naction_mail_acct = root\\n\\nIf the value of the \\\"action_mail_acct\\\" keyword is not set to \\\"root\\\" and other accounts for security personnel, this is a finding.\"]\n[41593,\"Verify the operating system audits the execution of privileged functions using the following command:\\n\\n# grep -iw execve /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid\\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid\\n-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid\\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid\\n\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules for \\\"SUID\\\" files are not defined, this is a finding.\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules for \\\"SGID\\\" files are not defined, this is a finding.\"]\n[41594,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chown\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw chown /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"chown\\\" syscall, this is a finding.\"]\n[41595,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fchown\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw fchown /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fchown\\\" syscall, this is a finding.\"]\n[41596,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"lchown\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw lchown /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"lchown\\\" syscall, this is a finding.\"]\n[41597,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fchownat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw fchownat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fchownat\\\" syscall, this is a finding.\"]\n[41598,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chmod\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw chmod /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"chmod\\\" syscall, this is a finding.\"]\n[41599,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fchmod\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw fchmod /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fchmod\\\" syscall, this is a finding.\"]\n[41600,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fchmodat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw fchmodat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fchmodat\\\" syscall, this is a finding.\"]\n[41601,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"setxattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw setxattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"setxattr\\\" syscall, this is a finding.\"]\n[41602,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fsetxattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw fsetxattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fsetxattr\\\" syscall, this is a finding.\"]\n[41603,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"lsetxattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw lsetxattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"lsetxattr\\\" syscall, this is a finding.\"]\n[41604,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"removexattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw removexattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"removexattr\\\" syscall, this is a finding.\"]\n[41605,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"fremovexattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw fremovexattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"fremovexattr\\\" syscall, this is a finding.\"]\n[41606,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"lremovexattr\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw lremovexattr /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"lremovexattr\\\" syscall, this is a finding.\"]\n[41607,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"creat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw creat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S creat F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"creat\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[41608,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"open\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw open /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"open\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[41609,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"openat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw openat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"openat\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[41610,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"open_by_handle_at\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw open_by_handle_at /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"open_by_handle_at\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[41611,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"truncate\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw truncate /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"truncate\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[41612,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"ftruncate\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw ftruncate /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"ftruncate\\\" syscall, this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EPERM\\\", this is a finding.\\n\\nIf the output does not produce rules containing \\\"-F exit=-EACCES\\\", this is a finding.\"]\n[41613,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"semanage\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/sbin/semanage /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[41614,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"setsebool\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/sbin/setsebool /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[41615,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chcon\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/bin/chcon /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[41616,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"setfiles\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw /usr/sbin/setfiles /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[41617,\"Verify the operating system generates audit records when unsuccessful account access events occur. \\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following commands: \\n\\n# grep -i /var/run/faillock /etc/audit/audit.rules\\n\\n-w /var/run/faillock -p wa -k logins\\n\\nIf the command does not return any output, this is a finding.\"]\n[41618,\"Verify the operating system generates audit records when successful account access events occur. \\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands: \\n\\n# grep -i /var/log/lastlog /etc/audit/audit.rules\\n\\n-w /var/log/lastlog -p wa -k logins \\n\\nIf the command does not return any output, this is a finding.\"]\n[41619,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"passwd\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/bin/passwd /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[41620,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"unix_chkpwd\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw /usr/sbin/unix_chkpwd /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[41621,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"gpasswd\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/bin/gpasswd /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[41622,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chage\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/bin/chage /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[41623,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"userhelper\\\" command occur.\\n\\nCheck the file system rule in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -i /usr/sbin/userhelper /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nIf the command does not return any output, this is a finding.\"]\n[41624,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"su\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/bin/su /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[41625,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"sudo\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/bin/sudo /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[41626,\"Verify the operating system generates audit records when successful/unsuccessful attempts to access the \\\"/etc/sudoers\\\" file and files in the \\\"/etc/sudoers.d/\\\" directory. \\n\\nCheck for modification of the following files being audited by performing the following commands to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -i \\\"/etc/sudoers\\\" /etc/audit/audit.rules\\n\\n-w /etc/sudoers -p wa -k privileged-actions\\n\\n# grep -i \\\"/etc/sudoers.d/\\\" /etc/audit/audit.rules\\n\\n-w /etc/sudoers.d/ -p wa -k privileged-actions\\n\\nIf the commands do not return output that match the examples, this is a finding.\"]\n[41627,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"newgrp\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -i /usr/bin/newgrp /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[41628,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"chsh\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -i /usr/bin/chsh /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nIf the command does not return any output, this is a finding.\"]\n[41629,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"mount\\\" command and syscall occur.\\n\\nCheck that the following system call is being audited by performing the following series of commands to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw \\\"mount\\\" /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n-a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"mount\\\" syscall, this is a finding.\\n\\nIf all uses of the \\\"mount\\\" command are not being audited, this is a finding.\"]\n[41630,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"umount\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following series of commands to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw \\\"/usr/bin/umount\\\" /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=4294967295 -k privileged-mount \\n\\nIf the command does not return any output, this is a finding.\"]\n[41631,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"postdrop\\\" command occur.\\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/sbin/postdrop /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=4294967295 -k privileged-postfix\\n\\nIf the command does not return any output, this is a finding.\"]\n[41632,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"postqueue\\\" command occur. \\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/sbin/postqueue /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=4294967295 -k privileged-postfix\\n\\nIf the command does not return any output, this is a finding.\"]\n[41633,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"ssh-keysign\\\" command occur. \\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/libexec/openssh/ssh-keysign /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=4294967295 -k privileged-ssh\\n\\nIf the command does not return any output, this is a finding.\"]\n[41634,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"crontab\\\" command occur. \\n\\nCheck that the following system call is being audited by performing the following command to check the file system rules in \\\"/etc/audit/audit.rules\\\": \\n\\n# grep -iw /usr/bin/crontab /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=4294967295 -k privileged-cron\\n\\nIf the command does not return any output, this is a finding.\"]\n[41635,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"pam_timestamp_check\\\" command occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw \\\"/usr/sbin/pam_timestamp_check\\\" /etc/audit/audit.rules\\n\\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F auid>=1000 -F auid!=4294967295 -k privileged-pam \\n\\nIf the command does not return any output, this is a finding.\"]\n[41636,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"create_module\\\" syscall occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw create_module /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S create_module -k module-change\\n\\n-a always,exit -F arch=b64 -S create_module -k module-change\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"create_module\\\" syscall, this is a finding.\"]\n[41637,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"init_module\\\" syscall occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw init_module /etc/audit/audit.rules \\n\\n-a always,exit -F arch=b32 -S init_module -k module-change\\n\\n-a always,exit -F arch=b64 -S init_module -k module-change\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"init_module\\\" syscall, this is a finding.\"]\n[41638,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"finit_module\\\" syscall occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw finit_module /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S finit_module -k module-change\\n\\n-a always,exit -F arch=b64 -S finit_module -k module-change\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"finit_module\\\" syscall, this is a finding.\"]\n[41639,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"delete_module\\\" syscall occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw delete_module /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S delete_module -k module-change\\n\\n-a always,exit -F arch=b64 -S delete_module -k module-change\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"delete_module\\\" syscall, this is a finding.\"]\n[41640,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"kmod\\\" command occur. \\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep -iw kmod /etc/audit/audit.rules\\n\\n-w /usr/bin/kmod -p x -F auid!=4294967295 -k module-change\\n\\nIf the command does not return any output, this is a finding.\"]\n[41641,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/passwd\\\".\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/passwd /etc/audit/audit.rules\\n\\n-w /etc/passwd -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[41642,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/group\\\".\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/group /etc/audit/audit.rules\\n\\n-w /etc/group -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[41643,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/gshadow\\\".\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/gshadow /etc/audit/audit.rules\\n\\n-w /etc/gshadow -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[41644,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/shadow /etc/audit/audit.rules\\n\\n-w /etc/shadow -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[41645,\"Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.\\n\\nCheck the auditing rules in \\\"/etc/audit/audit.rules\\\" with the following command:\\n\\n# grep /etc/security/opasswd /etc/audit/audit.rules\\n\\n-w /etc/security/opasswd -p wa -k identity\\n\\nIf the command does not return a line, or the line is commented out, this is a finding.\"]\n[41646,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"rename\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw rename /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"rename\\\" syscall, this is a finding.\"]\n[41647,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"renameat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw renameat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"renameat\\\" syscall, this is a finding.\"]\n[41648,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"rmdir\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw rmdir /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"rmdir\\\" syscall, this is a finding.\"]\n[41649,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"unlink\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw unlink /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"unlink\\\" syscall, this is a finding.\"]\n[41650,\"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \\\"unlinkat\\\" syscall occur.\\n\\nCheck the file system rules in \\\"/etc/audit/audit.rules\\\" with the following commands:\\n\\n# grep -iw unlinkat /etc/audit/audit.rules\\n\\n-a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nIf both the \\\"b32\\\" and \\\"b64\\\" audit rules are not defined for the \\\"unlinkat\\\" syscall, this is a finding.\"]\n[41651,\"Verify \\\"rsyslog\\\" is configured to send all messages to a log aggregation server.\\n\\nCheck the configuration of \\\"rsyslog\\\" with the following command:\\n\\nNote: If another logging package is used, substitute the utility configuration file for \\\"/etc/rsyslog.conf\\\".\\n\\n# grep @ /etc/rsyslog.conf /etc/rsyslog.d/*.conf\\n*.* @@logagg.site.mil\\n\\nIf there are no lines in the \\\"/etc/rsyslog.conf\\\" or \\\"/etc/rsyslog.d/*.conf\\\" files that contain the \\\"@\\\" or \\\"@@\\\" symbol(s), and the lines with the correct symbol(s) to send output to another system do not cover all \\\"rsyslog\\\" output, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. \\n\\nIf the lines are commented out or there is no evidence that the audit logs are being sent to another system, this is a finding.\"]\n[41652,\"Verify that the system is not accepting \\\"rsyslog\\\" messages from other systems unless it is documented as a log aggregation server.\\n\\nCheck the configuration of \\\"rsyslog\\\" with the following command:\\n\\n# grep imtcp /etc/rsyslog.conf\\n$ModLoad imtcp\\n# grep imudp /etc/rsyslog.conf\\n$ModLoad imudp\\n# grep imrelp /etc/rsyslog.conf\\n$ModLoad imrelp\\n\\nIf any of the above modules are being loaded in the \\\"/etc/rsyslog.conf\\\" file, ask to see the documentation for the system being used for log aggregation.\\n\\nIf the documentation does not exist, or does not specify the server as a log aggregation system, this is a finding.\"]\n[41653,\"Verify the operating system limits the number of concurrent sessions to \\\"10\\\" for all accounts and/or account types by issuing the following command:\\n\\n# grep \\\"maxlogins\\\" /etc/security/limits.conf /etc/security/limits.d/*.conf\\n\\n* hard maxlogins 10\\n\\nThis can be set as a global domain (with the * wildcard) but may be set differently for multiple domains.\\n\\nIf the \\\"maxlogins\\\" item is missing, commented out, or the value is not set to \\\"10\\\" or less for all domains that have the \\\"maxlogins\\\" item assigned, this is a finding.\"]\n[41654,\"Inspect the firewall configuration and running services to verify that it is configured to prohibit or restrict the use of functions, ports, protocols, and/or services that are unnecessary or prohibited.\\n\\nCheck which services are currently active with the following command:\\n\\n# firewall-cmd --list-all\\npublic (default, active)\\n  interfaces: enp0s3\\n  sources: \\n  services: dhcpv6-client dns http https ldaps rpc-bind ssh\\n  ports: \\n  masquerade: no\\n  forward-ports: \\n  icmp-blocks: \\n  rich rules: \\n\\nAsk the System Administrator for the site or program PPSM CLSA. Verify the services allowed by the firewall match the PPSM CLSA. \\n\\nIf there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols, or services that are prohibited by the PPSM Category Assurance List (CAL), this is a finding.\"]\n[41655,\"Verify the operating system uses mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.\\n\\nNote: If RHEL-07-021350 is a finding, this is automatically a finding as the system cannot implement FIPS 140-2-approved cryptographic algorithms and hashes.\\n\\nThe location of the \\\"sshd_config\\\" file may vary if a different daemon is in use.\\n\\nInspect the \\\"Ciphers\\\" configuration with the following command:\\n\\n# grep -i ciphers /etc/ssh/sshd_config\\nCiphers aes128-ctr,aes192-ctr,aes256-ctr\\n\\nIf any ciphers other than \\\"aes128-ctr\\\", \\\"aes192-ctr\\\", or \\\"aes256-ctr\\\" are listed, the \\\"Ciphers\\\" keyword is missing, or the returned line is commented out, this is a finding.\"]\n[41656,\"Verify the operating system terminates all network connections associated with a communications session at the end of the session or based on inactivity.\\n\\nCheck the value of the system inactivity timeout with the following command:\\n\\n# grep -i tmout /etc/profile.d/*\\n\\netc/profile.d/tmout.sh:TMOUT=600\\n\\n/etc/profile.d/tmout.sh:readonly TMOUT\\n\\n/etc/profile.d/tmout.sh:export TMOUT\\n\\nIf \\\"TMOUT\\\" is not set to \\\"600\\\" or less in a script located in the /etc/profile.d/ directory to enforce session termination after inactivity, this is a finding.\"]\n[41657,\"Verify any publicly accessible connection to the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\\n\\nCheck for the location of the banner file being used with the following command:\\n\\n# grep -i banner /etc/ssh/sshd_config\\n\\nbanner /etc/issue\\n\\nThis command will return the banner keyword and the name of the file that contains the ssh banner (in this case \\\"/etc/issue\\\").\\n\\nIf the line is commented out, this is a finding.\\n\\nView the file specified by the banner keyword to check that it matches the text of the Standard Mandatory DoD Notice and Consent Banner:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nIf the system does not display a graphical logon banner or the banner does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.\\n\\nIf the text in the file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.\"]\n[41658,\"If LDAP is not being utilized, this requirement is Not Applicable.\\n\\nVerify the operating system implements cryptography to protect the integrity of remote LDAP authentication sessions.\\n\\nTo determine if LDAP is being used for authentication, use the following command:\\n\\n# systemctl status sssd.service\\nsssd.service - System Security Services Daemon\\nLoaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\\nActive: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\\n\\nIf the \\\"sssd.service\\\" is \\\"active\\\", then LDAP is being used. \\n\\nDetermine the \\\"id_provider\\\" the LDAP is currently using:\\n\\n# grep -i \\\"id_provider\\\" /etc/sssd/sssd.conf\\n\\nid_provider = ad\\n\\nIf \\\"id_provider\\\" is set to \\\"ad\\\", this is Not Applicable.\\n\\nEnsure that LDAP is configured to use TLS by using the following command:\\n\\n# grep -i \\\"start_tls\\\" /etc/sssd/sssd.conf\\nldap_id_use_start_tls = true\\n\\nIf the \\\"ldap_id_use_start_tls\\\" option is not \\\"true\\\", this is a finding.\"]\n[41659,\"If LDAP is not being utilized, this requirement is Not Applicable.\\n\\nVerify the operating system implements cryptography to protect the integrity of remote LDAP access sessions.\\n\\nTo determine if LDAP is being used for authentication, use the following command:\\n\\n# systemctl status sssd.service\\nsssd.service - System Security Services Daemon\\nLoaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\\nActive: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\\n\\nIf the \\\"sssd.service\\\" is \\\"active\\\", then LDAP is being used. \\n\\nDetermine the \\\"id_provider\\\" the LDAP is currently using:\\n\\n# grep -i \\\"id_provider\\\" /etc/sssd/sssd.conf\\n\\nid_provider = ad\\n\\nIf \\\"id_provider\\\" is set to \\\"ad\\\", this is Not Applicable.\\n\\nVerify the sssd service is configured to require the use of certificates:\\n\\n# grep -i tls_reqcert /etc/sssd/sssd.conf\\nldap_tls_reqcert = demand\\n\\nIf the \\\"ldap_tls_reqcert\\\" setting is missing, commented out, or does not exist, this is a finding.\\n\\nIf the \\\"ldap_tls_reqcert\\\" setting is not set to \\\"demand\\\" or \\\"hard\\\", this is a finding.\"]\n[41660,\"If LDAP is not being utilized, this requirement is Not Applicable.\\n\\nVerify the operating system implements cryptography to protect the integrity of remote LDAP access sessions.\\n\\nTo determine if LDAP is being used for authentication, use the following command:\\n\\n# systemctl status sssd.service\\nsssd.service - System Security Services Daemon\\nLoaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\\nActive: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\\n\\nIf the \\\"sssd.service\\\" is \\\"active\\\", then LDAP is being used.\\n\\nDetermine the \\\"id_provider\\\" that the LDAP is currently using:\\n\\n# grep -i \\\"id_provider\\\" /etc/sssd/sssd.conf\\n\\nid_provider = ad\\n\\nIf \\\"id_provider\\\" is set to \\\"ad\\\", this is Not Applicable.\\n\\nCheck the path to the X.509 certificate for peer authentication with the following command:\\n\\n# grep -i tls_cacert /etc/sssd/sssd.conf\\n\\nldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt\\n\\nVerify the \\\"ldap_tls_cacert\\\" option points to a file that contains the trusted CA certificate.\\n\\nIf this file does not exist, or the option is commented out or missing, this is a finding.\"]\n[41661,\"Verify the operating system implements virtual address space randomization.\\n\\n# grep kernel.randomize_va_space /etc/sysctl.conf /etc/sysctl.d/*\\n\\nkernel.randomize_va_space = 2\\n\\nIf \\\"kernel.randomize_va_space\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \\\"2\\\", this is a finding.\\n\\nCheck that the operating system implements virtual address space randomization with the following command:\\n\\n# /sbin/sysctl -a | grep kernel.randomize_va_space \\n\\nkernel.randomize_va_space = 2\\n\\nIf \\\"kernel.randomize_va_space\\\" does not have a value of \\\"2\\\", this is a finding.\"]\n[41662,\"Check to see if sshd is installed with the following command:\\n\\n# yum list installed \\\\*ssh\\\\*\\nlibssh2.x86_64 1.4.3-8.el7 @anaconda/7.1\\nopenssh.x86_64 6.6.1p1-11.el7 @anaconda/7.1\\nopenssh-server.x86_64 6.6.1p1-11.el7 @anaconda/7.1\\n\\nIf the \\\"SSH server\\\" package is not installed, this is a finding.\"]\n[41663,\"Verify SSH is loaded and active with the following command:\\n\\n# systemctl status sshd\\nsshd.service - OpenSSH server daemon\\nLoaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)\\nActive: active (running) since Tue 2015-11-17 15:17:22 EST; 4 weeks 0 days ago\\nMain PID: 1348 (sshd)\\nCGroup: /system.slice/sshd.service\\n1053 /usr/sbin/sshd -D\\n\\nIf \\\"sshd\\\" does not show a status of \\\"active\\\" and \\\"running\\\", this is a finding.\"]\n[41664,\"Verify the operating system automatically terminates a user session after inactivity time-outs have expired.\\n\\nCheck for the value of the \\\"ClientAliveInterval\\\" keyword with the following command:\\n\\n# grep -iw clientaliveinterval /etc/ssh/sshd_config\\n\\nClientAliveInterval 600\\n\\nIf \\\"ClientAliveInterval\\\" is not configured, commented out, or has a value of \\\"0\\\", this is a finding.\\n\\nIf \\\"ClientAliveInterval\\\" has a value that is greater than \\\"600\\\" and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[41665,\"Check the version of the operating system with the following command:\\n\\n# cat /etc/redhat-release\\n\\nIf the release is 7.4 or newer this requirement is Not Applicable.\\n\\nVerify the SSH daemon does not allow authentication using RSA rhosts authentication.\\n\\nTo determine how the SSH daemon's \\\"RhostsRSAAuthentication\\\" option is set, run the following command:\\n\\n# grep RhostsRSAAuthentication /etc/ssh/sshd_config\\nRhostsRSAAuthentication no\\n\\nIf the value is returned as \\\"yes\\\", the returned line is commented out, or no output is returned, this is a finding.\"]\n[41666,\"Verify the operating system automatically terminates a user session after inactivity time-outs have expired.\\n\\nCheck for the value of the \\\"ClientAliveCountMax\\\" keyword with the following command:\\n\\n# grep -i clientalivecount /etc/ssh/sshd_config\\nClientAliveCountMax 0\\n\\nIf \\\"ClientAliveCountMax\\\" is not set to \\\"0\\\", this is a finding.\"]\n[41667,\"Verify the SSH daemon does not allow authentication using known hosts authentication.\\n\\nTo determine how the SSH daemon's \\\"IgnoreRhosts\\\" option is set, run the following command:\\n\\n# grep -i IgnoreRhosts /etc/ssh/sshd_config\\n\\nIgnoreRhosts yes\\n\\nIf the value is returned as \\\"no\\\", the returned line is commented out, or no output is returned, this is a finding.\"]\n[41668,\"Verify SSH provides users with feedback on when account accesses last occurred.\\n\\nCheck that \\\"PrintLastLog\\\" keyword in the sshd daemon configuration file is used and set to \\\"yes\\\" with the following command:\\n\\n# grep -i printlastlog /etc/ssh/sshd_config\\nPrintLastLog yes\\n\\nIf the \\\"PrintLastLog\\\" keyword is set to \\\"no\\\", is missing, or is commented out, this is a finding.\"]\n[41669,\"Verify remote access using SSH prevents users from logging on directly as root.\\n\\nCheck that SSH prevents users from logging on directly as root with the following command:\\n\\n# grep -i permitrootlogin /etc/ssh/sshd_config\\nPermitRootLogin no\\n\\nIf the \\\"PermitRootLogin\\\" keyword is set to \\\"yes\\\", is missing, or is commented out, this is a finding.\"]\n[41670,\"Verify the SSH daemon does not allow authentication using known hosts authentication.\\n\\nTo determine how the SSH daemon's \\\"IgnoreUserKnownHosts\\\" option is set, run the following command:\\n\\n# grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config\\n\\nIgnoreUserKnownHosts yes\\n\\nIf the value is returned as \\\"no\\\", the returned line is commented out, or no output is returned, this is a finding.\"]\n[41671,\"Check the version of the operating system with the following command:\\n\\n# cat /etc/redhat-release\\n\\nIf the release is 7.4 or newer this requirement is Not Applicable.\\n\\nVerify the SSH daemon is configured to only use the SSHv2 protocol.\\n\\nCheck that the SSH daemon is configured to only use the SSHv2 protocol with the following command:\\n\\n# grep -i protocol /etc/ssh/sshd_config\\nProtocol 2\\n#Protocol 1,2\\n\\nIf any protocol line other than \\\"Protocol 2\\\" is uncommented, this is a finding.\"]\n[41672,\"Verify the SSH daemon is configured to only use MACs employing FIPS 140-2-approved ciphers.\\n\\nNote: If RHEL-07-021350 is a finding, this is automatically a finding as the system cannot implement FIPS 140-2-approved cryptographic algorithms and hashes.\\n\\nCheck that the SSH daemon is configured to only use MACs employing FIPS 140-2-approved ciphers with the following command:\\n\\n# grep -i macs /etc/ssh/sshd_config\\nMACs hmac-sha2-256,hmac-sha2-512\\n\\nIf any ciphers other than \\\"hmac-sha2-256\\\" or \\\"hmac-sha2-512\\\" are listed or the returned line is commented out, this is a finding.\"]\n[41673,\"Verify the SSH public host key files have mode \\\"0644\\\" or less permissive.\\n\\nNote: SSH public key files may be found in other directories on the system depending on the installation.\\n\\nThe following command will find all SSH public key files on the system:\\n\\n# find /etc/ssh -name '*.pub' -exec ls -lL {} \\\\;\\n\\n-rw-r--r-- 1 root root 618 Nov 28 06:43 ssh_host_dsa_key.pub\\n-rw-r--r-- 1 root root 347 Nov 28 06:43 ssh_host_key.pub\\n-rw-r--r-- 1 root root 238 Nov 28 06:43 ssh_host_rsa_key.pub\\n\\nIf any file has a mode more permissive than \\\"0644\\\", this is a finding.\"]\n[41674,\"Verify the SSH private host key files have mode \\\"0640\\\" or less permissive.\\n\\nThe following command will find all SSH private key files on the system and list their modes:\\n\\n# find / -name '*ssh_host*key' | xargs ls -lL\\n\\n-rw-r----- 1 root ssh_keys 668 Nov 28 06:43 ssh_host_dsa_key\\n-rw-r----- 1 root ssh_keys 582 Nov 28 06:43 ssh_host_key\\n-rw-r----- 1 root ssh_keys 887 Nov 28 06:43 ssh_host_rsa_key\\n\\nIf any file has a mode more permissive than \\\"0640\\\", this is a finding.\"]\n[41675,\"Verify the SSH daemon does not permit GSSAPI authentication unless approved.\\n\\nCheck that the SSH daemon does not permit GSSAPI authentication with the following command:\\n\\n# grep -i gssapiauth /etc/ssh/sshd_config\\nGSSAPIAuthentication no\\n\\nIf the \\\"GSSAPIAuthentication\\\" keyword is missing, is set to \\\"yes\\\" and is not documented with the Information System Security Officer (ISSO), or the returned line is commented out, this is a finding.\"]\n[41676,\"Verify the SSH daemon does not permit Kerberos to authenticate passwords unless approved.\\n\\nCheck that the SSH daemon does not permit Kerberos to authenticate passwords with the following command:\\n\\n# grep -i kerberosauth /etc/ssh/sshd_config\\nKerberosAuthentication no\\n\\nIf the \\\"KerberosAuthentication\\\" keyword is missing, or is set to \\\"yes\\\" and is not documented with the Information System Security Officer (ISSO), or the returned line is commented out, this is a finding.\"]\n[41677,\"Verify the SSH daemon performs strict mode checking of home directory configuration files.\\n\\nThe location of the \\\"sshd_config\\\" file may vary if a different daemon is in use.\\n\\nInspect the \\\"sshd_config\\\" file with the following command:\\n\\n# grep -i strictmodes /etc/ssh/sshd_config\\n\\nStrictModes yes\\n\\nIf \\\"StrictModes\\\" is set to \\\"no\\\", is missing, or the returned line is commented out, this is a finding.\"]\n[41678,\"Verify the SSH daemon performs privilege separation.\\n\\nCheck that the SSH daemon performs privilege separation with the following command:\\n\\n# grep -i usepriv /etc/ssh/sshd_config\\n\\nUsePrivilegeSeparation sandbox\\n\\nIf the \\\"UsePrivilegeSeparation\\\" keyword is set to \\\"no\\\", is missing, or the returned line is commented out, this is a finding.\"]\n[41679,\"Verify the SSH daemon performs compression after a user successfully authenticates.\\n\\nCheck that the SSH daemon performs compression after a user successfully authenticates with the following command:\\n\\n# grep -i compression /etc/ssh/sshd_config\\nCompression delayed\\n\\nIf the \\\"Compression\\\" keyword is set to \\\"yes\\\", is missing, or the returned line is commented out, this is a finding.\"]\n[41680,\"Check to see if NTP is running in continuous mode:\\n\\n# ps -ef | grep ntp\\n\\nIf NTP is not running, check to see if \\\"chronyd\\\" is running in continuous mode:\\n\\n# ps -ef | grep chronyd\\n\\nIf NTP or \\\"chronyd\\\" is not running, this is a finding.\\n\\nIf the NTP process is found, then check the \\\"ntp.conf\\\" file for the \\\"maxpoll\\\" option setting:\\n\\n# grep maxpoll /etc/ntp.conf\\n\\nserver 0.rhel.pool.ntp.org iburst maxpoll 10\\n\\nIf the option is set to \\\"17\\\" or is not set, this is a finding.\\n\\nIf the file does not exist, check the \\\"/etc/cron.daily\\\" subdirectory for a crontab file controlling the execution of the \\\"ntpd -q\\\" command.\\n\\n# grep -i \\\"ntpd -q\\\" /etc/cron.daily/*\\n# ls -al /etc/cron.* | grep ntp\\n\\nntp\\n\\nIf a crontab file does not exist in the \\\"/etc/cron.daily\\\" that executes the \\\"ntpd -q\\\" command, this is a finding.\\n\\nIf the \\\"chronyd\\\" process is found, then check the \\\"chrony.conf\\\" file for the \\\"maxpoll\\\" option setting:\\n\\n# grep maxpoll /etc/chrony.conf\\n\\nserver 0.rhel.pool.ntp.org iburst maxpoll 10\\n\\nIf the option is not set or the line is commented out, this is a finding.\"]\n[41681,\"Verify the operating system enabled an application firewall.\\n\\nCheck to see if \\\"firewalld\\\" is installed with the following command:\\n\\n# yum list installed firewalld\\nfirewalld-0.3.9-11.el7.noarch.rpm\\n\\nIf the \\\"firewalld\\\" package is not installed, ask the System Administrator if another firewall application (such as iptables) is installed. \\n\\nIf an application firewall is not installed, this is a finding. \\n\\nCheck to see if the firewall is loaded and active with the following command:\\n\\n# systemctl status firewalld\\nfirewalld.service - firewalld - dynamic firewall daemon\\n\\n   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)\\n   Active: active (running) since Tue 2014-06-17 11:14:49 CEST; 5 days ago\\n\\nIf \\\"firewalld\\\" does not show a status of \\\"loaded\\\" and \\\"active\\\", this is a finding. \\n\\nCheck the state of the firewall:\\n\\n# firewall-cmd --state \\nrunning\\n\\nIf \\\"firewalld\\\" does not show a state of \\\"running\\\", this is a finding.\"]\n[41682,\"Verify users are provided with feedback on when account accesses last occurred.\\n\\nCheck that \\\"pam_lastlog\\\" is used and not silent with the following command:\\n\\n# grep pam_lastlog /etc/pam.d/postlogin\\nsession required pam_lastlog.so showfailed\\n\\nIf \\\"pam_lastlog\\\" is missing from \\\"/etc/pam.d/postlogin\\\" file, or the silent option is present, this is a finding.\"]\n[41683,\"Verify there are no \\\".shosts\\\" files on the system.\\n\\nCheck the system for the existence of these files with the following command:\\n\\n# find / -name '*.shosts'\\n\\nIf any \\\".shosts\\\" files are found on the system, this is a finding.\"]\n[41684,\"Verify there are no \\\"shosts.equiv\\\" files on the system.\\n\\nCheck the system for the existence of these files with the following command:\\n\\n# find / -name shosts.equiv\\n\\nIf any \\\"shosts.equiv\\\" files are found on the system, this is a finding.\"]\n[41685,\"Determine whether the system is using local or DNS name resolution with the following command:\\n\\n# grep hosts /etc/nsswitch.conf\\nhosts:   files dns\\n\\nIf the DNS entry is missing from the host's line in the \\\"/etc/nsswitch.conf\\\" file, the \\\"/etc/resolv.conf\\\" file must be empty.\\n\\nVerify the \\\"/etc/resolv.conf\\\" file is empty with the following command:\\n\\n# ls -al /etc/resolv.conf\\n-rw-r--r--  1 root root        0 Aug 19 08:31 resolv.conf\\n\\nIf local host authentication is being used and the \\\"/etc/resolv.conf\\\" file is not empty, this is a finding.\\n\\nIf the DNS entry is found on the host's line of the \\\"/etc/nsswitch.conf\\\" file, verify the operating system is configured to use two or more name servers for DNS resolution.\\n\\nDetermine the name servers used by the system with the following command:\\n\\n# grep nameserver /etc/resolv.conf\\nnameserver 192.168.1.2\\nnameserver 192.168.1.3\\n\\nIf less than two lines are returned that are not commented out, this is a finding.\"]\n[41686,\"Verify the system does not accept IPv4 source-routed packets.\\n\\n# grep net.ipv4.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*\\n\\nnet.ipv4.conf.all.accept_source_route = 0\\n\\nIf \\\" net.ipv4.conf.all.accept_source_route \\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.conf.all.accept_source_route\\nnet.ipv4.conf.all.accept_source_route = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[41687,\"Verify the system uses a reverse-path filter for IPv4:\\n\\n# grep net.ipv4.conf.all.rp_filter /etc/sysctl.conf /etc/sysctl.d/*\\nnet.ipv4.conf.all.rp_filter = 1\\n\\nIf \\\"net.ipv4.conf.all.rp_filter\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"1\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.conf.all.rp_filter\\nnet.ipv4.conf.all.rp_filter = 1\\n\\nIf the returned line does not have a value of \\\"1\\\", this is a finding.\"]\n[41688,\"Verify the system uses a reverse-path filter for IPv4:\\n\\n# grep net.ipv4.conf.default.rp_filter /etc/sysctl.conf /etc/sysctl.d/*\\nnet.ipv4.conf.default.rp_filter = 1\\n\\nIf \\\"net.ipv4.conf.default.rp_filter\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"1\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.conf.default.rp_filter\\nnet.ipv4.conf.default.rp_filter = 1\\n\\nIf the returned line does not have a value of \\\"1\\\", this is a finding.\"]\n[41689,\"Verify the system does not accept IPv4 source-routed packets by default.\\n\\n# grep net.ipv4.conf.default.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*\\nnet.ipv4.conf.default.accept_source_route = 0\\n\\nIf \\\" net.ipv4.conf.default.accept_source_route \\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.conf.default.accept_source_route\\nnet.ipv4.conf.default.accept_source_route = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[41690,\"Verify the system does not respond to IPv4 ICMP echoes sent to a broadcast address.\\n\\n# grep net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\" net.ipv4.icmp_echo_ignore_broadcasts\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"1\\\", this is a finding.\\n\\nCheck that the operating system implements the \\\"icmp_echo_ignore_broadcasts\\\" variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.icmp_echo_ignore_broadcasts\\nnet.ipv4.icmp_echo_ignore_broadcasts = 1\\n\\nIf the returned line does not have a value of \\\"1\\\", this is a finding.\"]\n[41691,\"Verify the system will not accept IPv4 ICMP redirect messages.\\n\\n# grep 'net.ipv4.conf.default.accept_redirects' /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\" net.ipv4.conf.default.accept_redirects \\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the value of the \\\"accept_redirects\\\" variables with the following command:\\n\\n# /sbin/sysctl -a | grep 'net.ipv4.conf.default.accept_redirects'\\nnet.ipv4.conf.default.accept_redirects = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[41692,\"Verify the system ignores IPv4 ICMP redirect messages.\\n\\n# grep 'net.ipv4.conf.all.accept_redirects' /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\" net.ipv4.conf.all.accept_redirects \\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the \\\"accept_redirects\\\" variables with the following command:\\n\\n# /sbin/sysctl -a | grep 'net.ipv4.conf.all.accept_redirects'\\n\\nnet.ipv4.conf.all.accept_redirects = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[41693,\"Verify the system does not allow interfaces to perform IPv4 ICMP redirects by default.\\n\\n# grep 'net.ipv4.conf.default.send_redirects' /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\"net.ipv4.conf.default.send_redirects\\\" is not configured in the \\\"/etc/sysctl.conf\\\" file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the \\\"default send_redirects\\\" variables with the following command:\\n\\n# /sbin/sysctl -a | grep 'net.ipv4.conf.default.send_redirects'\\n\\nnet.ipv4.conf.default.send_redirects = 0 \\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[41694,\"Verify the system does not send IPv4 ICMP redirect messages.\\n\\n# grep 'net.ipv4.conf.all.send_redirects' /etc/sysctl.conf /etc/sysctl.d/*\\n\\nIf \\\"net.ipv4.conf.all.send_redirects\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the \\\"all send_redirects\\\" variables with the following command:\\n\\n# /sbin/sysctl -a | grep 'net.ipv4.conf.all.send_redirects'\\n\\nnet.ipv4.conf.all.send_redirects = 0\\n\\nIf the returned line does not have a value of \\\"0\\\", this is a finding.\"]\n[41695,\"Verify network interfaces are not in promiscuous mode unless approved by the ISSO and documented.\\n\\nCheck for the status with the following command:\\n\\n# ip link | grep -i promisc\\n\\nIf network interfaces are found on the system in promiscuous mode and their use has not been approved by the ISSO and documented, this is a finding.\"]\n[41696,\"Verify the system is configured to prevent unrestricted mail relaying.\\n\\nDetermine if \\\"postfix\\\" is installed with the following commands:\\n\\n# yum list installed postfix\\npostfix-2.6.6-6.el7.x86_64.rpm \\n\\nIf postfix is not installed, this is Not Applicable.\\n\\nIf postfix is installed, determine if it is configured to reject connections from unknown or untrusted networks with the following command:\\n\\n# postconf -n smtpd_client_restrictions\\nsmtpd_client_restrictions = permit_mynetworks, reject\\n\\nIf the \\\"smtpd_client_restrictions\\\" parameter contains any entries other than \\\"permit_mynetworks\\\" and \\\"reject\\\", this is a finding.\"]\n[41697,\"Verify an FTP server has not been installed on the system.\\n\\nCheck to see if an FTP server has been installed with the following commands:\\n\\n# yum list installed vsftpd\\n\\n vsftpd-3.0.2.el7.x86_64.rpm\\n\\nIf \\\"vsftpd\\\" is installed and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\"]\n[41698,\"Verify a TFTP server has not been installed on the system.\\n\\nCheck to see if a TFTP server has been installed with the following command:\\n\\n# yum list installed tftp-server\\ntftp-server-0.49-9.el7.x86_64.rpm\\n\\nIf TFTP is installed and the requirement for TFTP is not documented with the ISSO, this is a finding.\"]\n[41699,\"Verify remote X connections for interactive users are encrypted.\\n\\nCheck that remote X connections are encrypted with the following command:\\n\\n# grep -i x11forwarding /etc/ssh/sshd_config | grep -v \\\"^#\\\"\\n\\nX11Forwarding yes\\n\\nIf the \\\"X11Forwarding\\\" keyword is set to \\\"no\\\" or is missing, this is a finding.\"]\n[41700,\"Verify the TFTP daemon is configured to operate in secure mode.\\n\\nCheck to see if a TFTP server has been installed with the following commands:\\n\\n# yum list installed tftp-server\\ntftp-server.x86_64 x.x-x.el7 rhel-7-server-rpms\\n\\nIf a TFTP server is not installed, this is Not Applicable.\\n\\nIf a TFTP server is installed, check for the server arguments with the following command: \\n\\n# grep server_args /etc/xinetd.d/tftp\\nserver_args = -s /var/lib/tftpboot\\n\\nIf the \\\"server_args\\\" line does not have a \\\"-s\\\" option and a subdirectory is not assigned, this is a finding.\"]\n[41701,\"Verify that if the system has X Windows System installed, it is authorized.\\n\\nCheck for the X11 package with the following command:\\n\\n# rpm -qa | grep xorg | grep server\\n\\nAsk the System Administrator if use of the X Windows System is an operational requirement.\\n\\nIf the use of X Windows on the system is not documented with the Information System Security Officer (ISSO), this is a finding.\"]\n[41702,\"Verify the system is not performing packet forwarding, unless the system is a router.\\n\\n# grep net.ipv4.ip_forward /etc/sysctl.conf /etc/sysctl.d/*\\n\\nnet.ipv4.ip_forward = 0\\n\\nIf \\\"net.ipv4.ip_forward\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system does not implement IP forwarding using the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv4.ip_forward\\nnet.ipv4.ip_forward = 0\\n\\nIf IP forwarding value is \\\"1\\\" and the system is hosting any application, database, or web servers, this is a finding.\"]\n[41703,\"Verify \\\"AUTH_GSS\\\" is being used to authenticate NFS mounts.\\n\\nTo check if the system is importing an NFS file system, look for any entries in the \\\"/etc/fstab\\\" file that have a file system type of \\\"nfs\\\" with the following command:\\n\\n# cat /etc/fstab | grep nfs\\n192.168.21.5:/mnt/export /data1 nfs4 rw,sync ,soft,sec=krb5:krb5i:krb5p\\n\\nIf the system is mounting file systems via NFS and has the sec option without the \\\"krb5:krb5i:krb5p\\\" settings, the \\\"sec\\\" option has the \\\"sys\\\" setting, or the \\\"sec\\\" option is missing, this is a finding.\"]\n[41704,\"Verify that a system using SNMP is not using default community strings.\\n\\nCheck to see if the \\\"/etc/snmp/snmpd.conf\\\" file exists with the following command:\\n\\n# ls -al /etc/snmp/snmpd.conf\\n -rw-------   1 root root      52640 Mar 12 11:08 snmpd.conf\\n\\nIf the file does not exist, this is Not Applicable.\\n\\nIf the file does exist, check for the default community strings with the following commands:\\n\\n# grep public /etc/snmp/snmpd.conf\\n# grep private /etc/snmp/snmpd.conf\\n\\nIf either of these commands returns any output, this is a finding.\"]\n[41705,\"If the \\\"firewalld\\\" package is not installed, ask the System Administrator (SA) if another firewall application (such as iptables) is installed. If an application firewall is not installed, this is a finding. \\n\\nVerify the system's access control program is configured to grant or deny system access to specific hosts.\\n\\nCheck to see if \\\"firewalld\\\" is active with the following command:\\n\\n# systemctl status firewalld\\nfirewalld.service - firewalld - dynamic firewall daemon\\nLoaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)\\nActive: active (running) since Sun 2014-04-20 14:06:46 BST; 30s ago\\n\\nIf \\\"firewalld\\\" is active, check to see if it is configured to grant or deny access to specific hosts or services with the following commands:\\n\\n# firewall-cmd --get-default-zone\\npublic\\n\\n# firewall-cmd --list-all --zone=public\\npublic (active)\\ntarget: default\\nicmp-block-inversion: no\\ninterfaces: eth0\\nsources:\\nservices: mdns ssh\\nports:\\nprotocols:\\nmasquerade: no\\nforward-ports:\\nicmp-blocks:\\n\\nIf \\\"firewalld\\\" is not active, determine whether \\\"tcpwrappers\\\" is being used by checking whether the \\\"hosts.allow\\\" and \\\"hosts.deny\\\" files are empty with the following commands:\\n\\n# ls -al /etc/hosts.allow\\nrw-r----- 1 root root 9 Aug 2 23:13 /etc/hosts.allow\\n\\n# ls -al /etc/hosts.deny\\n-rw-r----- 1 root root 9 Apr 9 2007 /etc/hosts.deny\\n\\nIf \\\"firewalld\\\" and \\\"tcpwrappers\\\" are not installed, configured, and active, ask the SA if another access control program (such as iptables) is installed and active. Ask the SA to show that the running configuration grants or denies access to specific hosts or services.\\n\\nIf \\\"firewalld\\\" is active and is not configured to grant access to specific hosts or \\\"tcpwrappers\\\" is not configured to grant or deny access to specific hosts, this is a finding.\"]\n[41706,\"Verify the system does not have unauthorized IP tunnels configured.\\n\\nCheck to see if \\\"libreswan\\\" is installed with the following command:\\n\\n# yum list installed libreswan\\nlibreswan.x86-64 3.20-5.el7_4\\n\\nIf \\\"libreswan\\\" is installed, check to see if the \\\"IPsec\\\" service is active with the following command:\\n\\n# systemctl status ipsec\\nipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec\\nLoaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled)\\nActive: inactive (dead)\\n\\nIf the \\\"IPsec\\\" service is active, check to see if any tunnels are configured in \\\"/etc/ipsec.conf\\\" and \\\"/etc/ipsec.d/\\\" with the following commands:\\n\\n# grep -iw conn /etc/ipsec.conf /etc/ipsec.d/*.conf\\n\\nIf there are indications that a \\\"conn\\\" parameter is configured for a tunnel, ask the System Administrator if the tunnel is documented with the ISSO. \\n\\nIf \\\"libreswan\\\" is installed, \\\"IPsec\\\" is active, and an undocumented tunnel is active, this is a finding.\"]\n[41707,\"If IPv6 is not enabled, the key will not exist, and this is Not Applicable.\\n\\nVerify the system does not accept IPv6 source-routed packets.\\n\\n# grep net.ipv6.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*\\n\\nnet.ipv6.conf.all.accept_source_route = 0\\n\\nIf \\\"net.ipv6.conf.all.accept_source_route\\\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \\\"0\\\", this is a finding.\\n\\nCheck that the operating system implements the accept source route variable with the following command:\\n\\n# /sbin/sysctl -a | grep net.ipv6.conf.all.accept_source_route\\nnet.ipv6.conf.all.accept_source_route = 0\\n\\nIf the returned lines do not have a value of \\\"0\\\", this is a finding.\"]\n[41708,\"Verify the operating system has the packages required for multifactor authentication installed.\\n\\nCheck for the presence of the packages required to support multifactor authentication with the following commands:\\n\\n# yum list installed esc\\nesc-1.1.0-26.el7.noarch.rpm\\n\\n# yum list installed pam_pkcs11\\npam_pkcs11-0.6.2-14.el7.noarch.rpm\\n\\n\\nIf the \\\"esc\\\" and \\\"pam_pkcs11\\\" packages are not installed, this is a finding.\"]\n[41709,\"Verify the operating system implements multifactor authentication for remote access to privileged accounts via pluggable authentication modules (PAM).\\n\\nCheck the \\\"/etc/sssd/sssd.conf\\\" file for the authentication services that are being used with the following command:\\n\\n# grep services /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf\\n\\nservices = nss, pam\\n\\nIf the \\\"pam\\\" service is not present on all \\\"services\\\" lines, this is a finding.\"]\n[41710,\"Verify the operating system implements certificate status checking for PKI authentication.\\n\\nCheck to see if Online Certificate Status Protocol (OCSP) is enabled on the system with the following command:\\n\\n# grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep -v \\\"^#\\\"\\n\\ncert_policy = ca, ocsp_on, signature;\\ncert_policy = ca, ocsp_on, signature;\\ncert_policy = ca, ocsp_on, signature;\\n\\nThere should be at least three lines returned. \\n\\nIf \\\"ocsp_on\\\" is not present in all uncommented \\\"cert_policy\\\" lines in \\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\", this is a finding.\"]\n[41711,\"Verify that there are no wireless interfaces configured on the system.\\n\\nThis is N/A for systems that do not have wireless network adapters.\\n\\nCheck for the presence of active wireless interfaces with the following command:\\n\\n# nmcli device\\nDEVICE TYPE STATE\\neth0 ethernet connected\\nwlp3s0 wifi disconnected\\nlo loopback unmanaged\\n\\nIf a wireless interface is configured and its use on the system is not documented with the Information System Security Officer (ISSO), this is a finding.\"]\n[41712,\"Verify the cryptographic hash of system files and commands match the vendor values.\\n\\nCheck the cryptographic hash of system files and commands with the following command:\\n\\nNote: System configuration files (indicated by a \\\"c\\\" in the second column) are expected to change over time. Unusual modifications should be investigated through the system audit log.\\n\\n# rpm -Va --noconfig | grep '^..5'\\n\\nIf there is any output from the command for system files or binaries, this is a finding.\"]\n[41713,\"Ask the SA or ISSO if a host-based intrusion detection application is loaded on the system. Per OPORD 16-0080, the preferred intrusion detection system is McAfee HBSS available through the U.S. Cyber Command (USCYBERCOM).\\n\\nIf another host-based intrusion detection application is in use, such as SELinux, this must be documented and approved by the local Authorizing Official.\\n\\nProcedure:\\nExamine the system to determine if the Host Intrusion Prevention System (HIPS) is installed:\\n\\n# rpm -qa | grep MFEhiplsm\\n\\nVerify that the McAfee HIPS module is active on the system:\\n\\n# ps -ef | grep -i “hipclient”\\n\\nIf the MFEhiplsm package is not installed, check for another intrusion detection system:\\n\\n# find / -name <daemon name>\\n\\nWhere <daemon name> is the name of the primary application daemon to determine if the application is loaded on the system.\\n\\nDetermine if the application is active on the system:\\n\\n# ps -ef | grep -i <daemon name>\\n\\nIf the MFEhiplsm package is not installed and an alternate host-based intrusion detection application has not been documented for use, this is a finding.\\n\\nIf no host-based intrusion detection system is installed and running on the system, this is a finding.\"]\n[41714,\"Verify the operating system prevents a user from overriding the screensaver lock-enabled setting for the graphical user interface. \\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\\n\\nDetermine which profile the system database is using with the following command:\\n# grep system-db /etc/dconf/profile/user\\n\\nsystem-db:local\\n\\nCheck for the lock-enabled setting with the following command:\\n\\nNote: The example below is using the database \\\"local\\\" for the system, so the path is \\\"/etc/dconf/db/local.d\\\". This path must be modified if a database other than \\\"local\\\" is being used.\\n\\n# grep -i lock-enabled /etc/dconf/db/local.d/locks/*\\n\\n/org/gnome/desktop/screensaver/lock-enabled\\n\\nIf the command does not return a result, this is a finding.\"]\n{\"table\":\"collection\",\"columns\":\"`collectionId`,`created`,`createdUserId`,`description`,`metadata`,`name`,`settings`,`state`,`stateDate`,`stateUserId`\",\"rowCount\":7}\n[1,\"2024-10-23 10:59:15\",null,null,\"{\\\"reqRar\\\": \\\"true\\\", \\\"pocName\\\": \\\"poc2Put\\\", \\\"pocEmail\\\": \\\"pocEmailPut@email.com\\\", \\\"pocPhone\\\": \\\"12342\\\"}\",\"Collection Z put\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 15}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n[21,\"2024-10-23 10:59:15\",null,null,\"{\\\"reqRar\\\": \\\"true\\\", \\\"pocName\\\": \\\"poc2Patched\\\", \\\"pocEmail\\\": \\\"pocEmail@email.com\\\", \\\"pocPhone\\\": \\\"12342\\\"}\",\"Collection X\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 15}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n[83,\"2024-10-23 10:59:15\",null,null,\"{\\\"reqRar\\\": \\\"true\\\", \\\"pocName\\\": \\\"string\\\", \\\"pocEmail\\\": \\\"string\\\", \\\"pocPhone\\\": \\\"string\\\"}\",\"Collection Y\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 15}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n[84,\"2024-10-23 10:59:15\",null,null,\"{}\",\"delete Collection Admin\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 15}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n[85,\"2024-10-23 10:59:15\",null,null,\"{}\",\"delete Collection lvl4\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 15}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n[86,\"2024-10-23 10:59:15\",null,null,\"{}\",\"delete Collection NONE\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 15}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n[92,\"2024-10-23 10:59:15\",null,null,\"{}\",\"test Collection\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 15}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n{\"table\":\"collection_grant\",\"columns\":\"`collectionId`,`grantId`,`roleId`,`userGroupId`,`userId`\",\"rowCount\":22}\n[21,5895,1,null,86]\n[21,5896,1,null,85]\n[21,5897,2,null,21]\n[21,5898,3,null,44]\n[21,5899,4,null,87]\n[21,5900,4,null,1]\n[21,5901,4,null,45]\n[83,5902,4,null,87]\n[83,5903,4,null,1]\n[1,5904,1,null,86]\n[1,5905,2,null,21]\n[1,5906,3,null,44]\n[1,5907,4,null,87]\n[1,5908,4,null,45]\n[1,5909,4,null,1]\n[84,5910,4,null,87]\n[84,5911,4,null,1]\n[85,5912,4,null,87]\n[85,5913,4,null,1]\n[85,5914,4,null,45]\n[92,5915,4,null,87]\n[92,5916,4,null,1]\n{\"table\":\"collection_grant_acl\",\"columns\":\"`access`,`assetId`,`benchmarkId`,`cgAclId`,`clId`,`grantId`,`modifiedDate`,`modifiedUserId`\",\"rowCount\":1}\n[\"rw\",62,null,1,null,5896,\"2024-12-04 20:39:43\",87]\n{\"table\":\"collection_label\",\"columns\":\"`clId`,`collectionId`,`color`,`description`,`name`,`uuid`\",\"rowCount\":3}\n[969,21,\"FF99CC\",\"\",\"test-label-full\",{\"type\":\"Buffer\",\"data\":\"base64:EeyaaHVbiiixvAJCrBEAAg==\"}]\n[970,21,\"99CCFF\",\"\",\"test-label-lvl1\",{\"type\":\"Buffer\",\"data\":\"base64:EeyaaFEw3ISxvAJCrBEAAg==\"}]\n[971,1,\"99CCFF\",\"scrap label\",\"scrapLabel\",{\"type\":\"Buffer\",\"data\":\"base64:EeygA99OaDaxvAJCrBEAAg==\"}]\n{\"table\":\"collection_label_asset_map\",\"columns\":\"`assetId`,`claId`,`clId`\",\"rowCount\":3}\n[42,1220,969]\n[42,1221,970]\n[62,1219,969]\n{\"table\":\"collection_rev_map\",\"columns\":\"`benchmarkId`,`collectionId`,`crId`,`revId`\",\"rowCount\":1}\n[\"VPN_SRG_TEST_Batch\",21,1,\"VPN_SRG_TEST_Batch-1-1\"]\n{\"table\":\"current_rev\",\"columns\":\"`active`,`benchmarkDate`,`benchmarkDateSql`,`benchmarkId`,`checkCount`,`description`,`fixCount`,`groupCount`,`highCount`,`lowCount`,`marking`,`mediumCount`,`release`,`revId`,`status`,`statusDate`,`version`\",\"rowCount\":6}\n[1,\"31 Mar 2020\",\"2020-03-31\",\"RHEL_7_STIG_TEST\",247,\"This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.\",247,247,29,14,null,201,\"0.3\",\"RHEL_7_STIG_TEST-3-0.3\",\"draft\",\"2020-03-27\",3]\n[1,\"19 Jul 2001\",\"2001-07-19\",\"VPN_SRG_OTHER\",2,\"This description replaces the old description\",2,2,0,0,null,2,\"2\",\"VPN_SRG_OTHER-2-2\",\"accepted\",\"2001-07-26\",2]\n[1,\"19 Jul 2001\",\"2001-07-19\",\"VPN_SRG_Rule-fingerprint-match-test\",3,\"This description replaces the old description\",3,3,0,0,null,3,\"2\",\"VPN_SRG_Rule-fingerprint-match-test-2-2\",\"accepted\",\"2001-07-26\",2]\n[1,\"19 Jul 2019\",\"2019-07-19\",\"VPN_SRG_TEST_Batch\",2,\"This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",2,2,0,0,null,2,\"1\",\"VPN_SRG_TEST_Batch-1-1\",\"accepted\",\"2019-07-26\",1]\n[1,\"19 Jul 2019\",\"2019-07-19\",\"VPN_SRG_TEST\",81,\"This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",81,81,11,7,null,63,\"1\",\"VPN_SRG_TEST-1-1\",\"accepted\",\"2019-07-26\",1]\n[1,\"17 Jun 2020\",\"2020-06-17\",\"Windows_10_STIG_TEST\",287,\"The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",287,287,26,18,null,243,\"23\",\"Windows_10_STIG_TEST-1-23\",\"accepted\",\"2020-06-15\",1]\n{\"table\":\"default_rev\",\"columns\":\"`benchmarkId`,`collectionId`,`revId`,`revisionPinned`,`vdId`\",\"rowCount\":5}\n[\"RHEL_7_STIG_TEST\",1,\"RHEL_7_STIG_TEST-3-0.3\",0,5280]\n[\"VPN_SRG_TEST\",1,\"VPN_SRG_TEST-1-1\",0,5281]\n[\"VPN_SRG_TEST\",83,\"VPN_SRG_TEST-1-1\",0,5283]\n[\"Windows_10_STIG_TEST\",1,\"Windows_10_STIG_TEST-1-23\",0,5284]\n[\"VPN_SRG_TEST_Batch\",21,\"VPN_SRG_TEST_Batch-1-1\",1,5287]\n{\"table\":\"fix_text\",\"columns\":\"`ftId`,`text`\",\"rowCount\":615}\n[1,\"Use Windows 10 Enterprise 64-bit version for domain-joined systems.\"]\n[2,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> \\\"Allow user control over installs\\\" to \\\"Disabled\\\".\"]\n[3,\"For standalone systems, this is NA.\\n\\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nEnsure domain-joined systems must have a Trusted Platform Module (TPM) that is configured for use. (Versions 2.0 or 1.2 support Credential Guard.)\\n\\nThe TPM must be enabled in the firmware.\\nRun \\\"tpm.msc\\\" for configuration options in Windows.\"]\n[4,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> \\\"Always install with elevated privileges\\\" to \\\"Disabled\\\".\"]\n[5,\"The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> \\\"Prevent Internet Explorer security prompt for Windows Installer scripts\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[6,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Logon Options >> \\\"Sign-in last interactive user automatically after a system-initiated restart\\\" to \\\"Disabled\\\".\"]\n[7,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> \\\"Allow Basic authentication\\\" to \\\"Disabled\\\".\"]\n[8,\"Enable full disk encryption on all information systems (including SIPRNet) using BitLocker.\\n\\nBitLocker, included in Windows, can be enabled in the Control Panel under \\\"BitLocker Drive Encryption\\\" as well as other management tools.\\n\\nNOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).\"]\n[9,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> \\\"Allow unencrypted traffic\\\" to \\\"Disabled\\\".\"]\n[10,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> \\\"Disallow Digest authentication\\\" to \\\"Enabled\\\".\"]\n[11,\"Install DoD approved HBSS software and ensure it is operating continuously.\"]\n[12,\"Configure an application whitelisting program to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.\\n\\nConfiguration of whitelisting applications will vary by the program.  AppLocker is a whitelisting application built into Windows 10 Enterprise.\\n\\nIf AppLocker is used, it is configured through group policy in Computer Configuration >> Windows Settings >> Security Settings >> Application Control Policies >> AppLocker.\\n\\nImplementation guidance for AppLocker is available in the NSA paper \\\"Application Whitelisting using Microsoft AppLocker\\\" at the following link:\\n\\nhttps://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm\"]\n[13,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> \\\"Allow Basic authentication\\\" to \\\"Disabled\\\".\"]\n[14,\"Update systems on the Semi-Annual Channel to \\\"Microsoft Windows Version 1709 (OS Build 16299.0)\\\" or greater.\\n\\nIt is recommended systems be upgraded to the most recently released version.\\n\\nSpecial purpose systems using the Long-Term Servicing Branch\\\\Channel (LTSC\\\\B) may be at the following versions:\\n\\nv1507 (Build 10240)\\nv1607 (Build 14393)\\nv1809 (Build 17763)\"]\n[15,\"Install an anti-virus solution on the system.\"]\n[16,\"Format all local volumes to use NTFS.\"]\n[17,\"Ensure Windows 10 is the only operating system on a device.  Remove alternate operating systems.\"]\n[18,\"If a non system-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it.\\n\\nRemove any unnecessary non-system created shares.\"]\n[19,\"Regularly review local accounts and verify their necessity.  Disable or delete any active accounts that have not been used in the last 35 days.\"]\n[20,\"Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group.\\n\\nFor domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.\\n\\nRemove any standard user accounts.\"]\n[21,\"Create separate accounts for backup operations for users with this privilege.\"]\n[22,\"For Hyper-V, remove any unauthorized groups or user accounts from the \\\"Hyper-V Administrators\\\" group.\\n\\nFor hosted hypervisors other than Hyper-V, restrict access to create or run virtual machines to authorized user accounts only.\"]\n[23,\"Limit local user accounts on domain-joined systems.  Remove any unauthorized local accounts.\"]\n[24,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> \\\"Allow unencrypted traffic\\\" to \\\"Disabled\\\".\"]\n[25,\"Configure all passwords to expire.\\nRun \\\"Computer Management\\\".\\nNavigate to System Tools >> Local Users and Groups >> Users.\\nDouble click each active account.\\nEnsure \\\"Password never expires\\\" is not checked on all active accounts.\"]\n[26,\"Maintain the default file system permissions and configure the Security Option: \\\"Network access: Let everyone permissions apply to anonymous users\\\" to \\\"Disabled\\\" (WN10-SO-000160).\"]\n[27,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> \\\"Disallow WinRM from storing RunAs credentials\\\" to \\\"Enabled\\\".\"]\n[28,\"Uninstall \\\"Internet Information Services\\\" or \\\"Internet Information Services Hostable Web Core\\\" from the system.\"]\n[29,\"Uninstall \\\"Simple Network Management Protocol (SNMP)\\\" from the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows Features on or off\\\".\\nDe-select \\\"Simple Network Management Protocol (SNMP)\\\".\"]\n[30,\"Uninstall \\\"Simple TCPIP Services (i.e. echo, daytime etc)\\\" from the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows Features on or off\\\".\\nDe-select \\\"Simple TCPIP Services (i.e. echo, daytime etc)\\\".\"]\n[31,\"Uninstall \\\"Telnet Client\\\" from the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows Features on or off\\\".\\n\\nDe-select \\\"Telnet Client\\\".\"]\n[32,\"Uninstall \\\"TFTP Client\\\" from the system.\\n\\nRun \\\"Programs and Features\\\".\\nSelect \\\"Turn Windows Features on or off\\\".\\n\\nDe-select \\\"TFTP Client\\\".\"]\n[33,\"Remove any certificate installation files (*.p12 and *.pfx) found on a system.\\n\\nNote: This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or Adobe PreFlight certificate files.\"]\n[34,\"Install and enable a host-based firewall on the system.\"]\n[35,\"Configure firewall exceptions to inbound connections on domain workstations to include only authorized remote management hosts.\\n\\nConfigure only inbound connection exceptions for authorized remote management hosts.\\nComputer Configuration >> Windows Settings >> Security Settings >> Windows Defender Firewall with Advanced Security >> Windows Defender Firewall with Advanced Security >> Inbound Rules (this link will be in the right pane)\\n\\nFor any inbound rules that allow connections, configure the Scope for Remote IP address to those of authorized remote management hosts. This may be defined as an IP address, subnet or range. Apply the rule to all firewall profiles.\\n\\nIf a third-party firewall is used, configure inbound exceptions to only include authorized remote management hosts.\"]\n[36,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> \\\"Account lockout duration\\\" to \\\"15\\\" minutes or greater.\\n\\nA value of \\\"0\\\" is also acceptable, requiring an administrator to unlock the account.\"]\n[37,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> \\\"Account lockout threshold\\\" to \\\"3\\\" or less invalid logon attempts (excluding \\\"0\\\" which is unacceptable).\"]\n[38,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> \\\"Reset account lockout counter after\\\" to \\\"15\\\" minutes.\"]\n[39,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Enforce password history\\\" to \\\"24\\\" passwords remembered.\"]\n[40,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Maximum Password Age\\\" to \\\"60\\\" days or less (excluding \\\"0\\\" which is unacceptable).\"]\n[41,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Minimum Password Age\\\" to at least \\\"1\\\" day.\"]\n[42,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Minimum password length\\\" to \\\"14\\\" characters.\"]\n[43,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Password must meet complexity requirements\\\" to \\\"Enabled\\\".\"]\n[44,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> \\\"Store passwords using reversible encryption\\\" to \\\"Disabled\\\".\"]\n[45,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> \\\"Audit Credential Validation\\\" with \\\"Failure\\\" selected.\"]\n[46,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> \\\"Audit Credential Validation\\\" with \\\"Success\\\" selected.\"]\n[47,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> \\\"Audit Security Group Management\\\" with \\\"Success\\\" selected.\"]\n[48,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> \\\"Audit User Account Management\\\" with \\\"Failure\\\" selected.\"]\n[49,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> \\\"Audit User Account Management\\\" with \\\"Success\\\" selected.\"]\n[50,\"Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> \\\"Audit PNP Activity\\\" with \\\"Success\\\" selected.\"]\n[51,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> \\\"Audit Process Creation\\\" with \\\"Success\\\" selected.\"]\n[52,\"Configure the policy value for Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Group Membership\\\" with \\\"Success\\\" selected.\"]\n[53,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Logoff\\\" with \\\"Success\\\" selected.\"]\n[54,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Logon\\\" with \\\"Failure\\\" selected.\"]\n[55,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Logon\\\" with \\\"Success\\\" selected.\"]\n[56,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Special Logon\\\" with \\\"Success\\\" selected.\"]\n[57,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit Removable Storage\\\" with \\\"Failure\\\" selected.\"]\n[58,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit Removable Storage\\\" with \\\"Success\\\" selected.\"]\n[59,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> \\\"Audit Audit Policy Change\\\" with \\\"Success\\\" selected.\"]\n[60,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> \\\"Audit Authentication Policy Change\\\" with \\\"Success\\\" selected.\"]\n[61,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> \\\"Audit Sensitive Privilege Use\\\" with \\\"Failure\\\" selected.\"]\n[62,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> \\\"Audit Sensitive Privilege Use\\\" with \\\"Success\\\" selected.\"]\n[63,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit IPSec Driver\\\" with \\\"Failure\\\" selected.\"]\n[64,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit Other System Events\\\" with \\\"Success\\\" selected.\"]\n[65,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit Other System Events\\\" with \\\"Failure\\\" selected.\"]\n[66,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit Security State Change\\\" with \\\"Success\\\" selected.\"]\n[67,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit Security System Extension\\\" with \\\"Success\\\" selected.\"]\n[68,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit System Integrity\\\" with \\\"Failure\\\" selected.\"]\n[69,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> \\\"Audit System Integrity\\\" with \\\"Success\\\" selected.\"]\n[70,\"If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Application >> \\\"Specify the maximum log file size (KB)\\\" to \\\"Enabled\\\" with a \\\"Maximum Log Size (KB)\\\" of \\\"32768\\\" or greater.\"]\n[71,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Security >> \\\"Specify the maximum log file size (KB)\\\" to \\\"Enabled\\\" with a \\\"Maximum Log Size (KB)\\\" of \\\"1024000\\\" or greater.\\n\\nIf the system is configured to send audit records directly to an audit server, documented with the ISSO.\"]\n[72,\"If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> System >> \\\"Specify the maximum log file size (KB)\\\" to \\\"Enabled\\\" with a \\\"Maximum Log Size (KB)\\\" of \\\"32768\\\" or greater.\"]\n[73,\"Ensure the permissions on the Application event log (Application.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory.\\n\\nIf the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as \\\"NT Service\\\\Eventlog\\\".\"]\n[74,\"Ensure the permissions on the Security event log (Security.evtx) are configured to prevent standard user accounts or groups from having access.  The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory.\\n\\nIf the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as \\\"NT Service\\\\Eventlog\\\".\"]\n[75,\"Ensure the permissions on the System event log (System.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement.\\n\\nEventlog - Full Control\\nSYSTEM - Full Control\\nAdministrators - Full Control\\n\\nThe default location is the \\\"%SystemRoot%\\\\SYSTEM32\\\\WINEVT\\\\LOGS\\\" directory.\\n\\nIf the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as \\\"NT Service\\\\Eventlog\\\".\"]\n[76,\"If the device does not have a camera, this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Control Panel >> Personalization >> \\\"Prevent enabling lock screen camera\\\" to \\\"Enabled\\\".\"]\n[77,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Control Panel >> Personalization >> \\\"Prevent enabling lock screen slide show\\\" to \\\"Enabled\\\".\"]\n[78,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> \\\"MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)\\\" to \\\"Highest protection, source routing is completely disabled\\\".\\n\\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \\\"MSS-Legacy.admx\\\" and \\\" MSS-Legacy.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[79,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> \\\"MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)\\\" to \\\"Highest protection, source routing is completely disabled\\\".\\n\\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \\\"MSS-Legacy.admx\\\" and \\\" MSS-Legacy.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[80,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> \\\"MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes\\\" to \\\"Disabled\\\".\\n\\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \\\"MSS-Legacy.admx\\\" and \\\" MSS-Legacy.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[81,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> \\\"MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers\\\" to \\\"Enabled\\\".\\n\\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \\\"MSS-Legacy.admx\\\" and \\\" MSS-Legacy.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[82,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Lanman Workstation >> \\\"Enable insecure guest logons\\\" to \\\"Disabled\\\".\"]\n[83,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Network Provider >> \\\"Hardened UNC Paths\\\" to \\\"Enabled\\\" with at least the following configured in \\\"Hardened UNC Paths:\\\" (click the \\\"Show\\\" button to display).\\n\\nValue Name: \\\\\\\\*\\\\SYSVOL\\nValue: RequireMutualAuthentication=1, RequireIntegrity=1\\n\\nValue Name: \\\\\\\\*\\\\NETLOGON\\nValue: RequireMutualAuthentication=1, RequireIntegrity=1\"]\n[84,\"Install the DoD Root CA certificates.\\nDoD Root CA 2\\nDoD Root CA 3\\nDoD Root CA 4\\nDoD Root CA 5\\n\\nThe InstallRoot tool is available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.\"]\n[85,\"The default behavior for \\\"Minimize the number of simultaneous connections to the Internet or a Windows Domain\\\" is \\\"Enabled\\\".\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Windows Connection Manager >> \\\"Minimize the number of simultaneous connections to the Internet or a Windows Domain\\\" to \\\"Enabled\\\".\"]\n[86,\"Install the ECA Root CA certificates on unclassified systems.\\nECA Root CA 2\\nECA Root CA 4\\n\\nThe InstallRoot tool is available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.\"]\n[87,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Windows Connection Manager >> \\\"Prohibit connection to non-domain networks when connected to domain authenticated network\\\" to \\\"Enabled\\\".\"]\n[88,\"Install the DoD Interoperability Root CA cross-certificates on unclassified systems.\\n\\nIssued To - Issued By - Thumbprint\\nDoD Root CA 2 - DoD Interoperability Root CA 1 - A8C27332CCB4CA49554CE55D34062A7DD2850C02\\nDoD Root CA 3 - DoD Interoperability Root CA 2 - AC06108CA348CC03B53795C64BF84403C1DBD341\\n\\nThe certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.\"]\n[89,\"Install the US DoD CCEB Interoperability Root CA cross-certificate on unclassified systems.\\n\\nIssued To - Issued By - Thumbprint\\nDoD Root CA 3 - US DoD CCEB Interoperability Root CA 2 - AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9\\n\\nThe certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.\"]\n[90,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> WLAN Service >> WLAN Settings>> \\\"Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services\\\" to \\\"Disabled\\\".   \\n\\nv1507 LTSB does not include this group policy setting.  It may be configured through other means such as using group policy from a later version of Windows 10 or a registry update.\"]\n[91,\"Maintain the default permissions for the HKEY_LOCAL_MACHINE registry hive.\\n\\nThe default permissions of the higher level keys are noted below.\\n\\nHKEY_LOCAL_MACHINE\\\\SECURITY\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nSYSTEM - Full Control - This key and subkeys\\nAdministrators - Special - This key and subkeys\\n\\nHKEY_LOCAL_MACHINE\\\\SOFTWARE\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nUsers - Read - This key and subkeys\\nAdministrators - Full Control - This key and subkeys\\nSYSTEM - Full Control - This key and subkeys\\nCREATOR OWNER - Full Control - This key and subkeys\\nALL APPLICATION PACKAGES - Read - This key and subkeys\\n\\nHKEY_LOCAL_MACHINE\\\\SYSTEM\\nType - \\\"Allow\\\" for all\\nInherited from - \\\"None\\\" for all\\nPrincipal - Access - Applies to\\nUsers - Read - This key and subkeys\\nAdministrators - Full Control - This key and subkeys\\nSYSTEM - Full Control - This key and subkeys\\nCREATOR OWNER - Full Control - This key and subkeys\\nALL APPLICATION PACKAGES - Read - This key and subkeys\\n\\nMicrosoft has also given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID.\\n\\nS-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681\"]\n[92,\"Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> \\\"Turn On Virtualization Based Security\\\" to \\\"Enabled\\\" with \\\"Secure Boot\\\" or \\\"Secure Boot and DMA Protection\\\" selected for \\\"Select Platform Security Level:\\\".\\n\\nA Microsoft article on Credential Guard system requirement can be found at the following link.\\nhttps://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard-requirements\"]\n[93,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Apply UAC restrictions to local accounts on network logons\\\" to \\\"Enabled\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package.  \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[94,\"Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\\n\\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\\n\\nFor VDIs with persistent desktops, this may be downgraded to a CAT II only where administrators have specific tokens for the VDI. Administrator accounts on virtual desktops must only be used on systems in the VDI; they may not have administrative privileges on any other systems such as servers and physical workstations.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> \\\"Turn On Virtualization Based Security\\\" to \\\"Enabled\\\" with \\\"Enabled with UEFI lock\\\" selected for \\\"Credential Guard Configuration:\\\".\\n\\nv1507 LTSB does not include selection options; select \\\"Enable Credential Guard\\\".\\n\\nA Microsoft TechNet article on Credential Guard, including system requirement details, can be found at the following link:\\n\\nhttps://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard\"]\n[95,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Administrator account status\\\" to \\\"Disabled\\\".\"]\n[96,\"Ensure that Early Launch Antimalware - Boot-Start Driver Initialization policy is set to enforce \\\"Good, unknown and bad but critical\\\" (preventing \\\"bad\\\").\\n\\nIf this needs to be corrected configure the policy value for Computer Configuration >> Administrative Templates >> System >> Early Launch Antimalware >> \\\"Boot-Start Driver Initialization Policy\\\" to \\\"Enabled” with \\\"Good, unknown and bad but critical\\\" selected.\"]\n[97,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Group Policy >> \\\"Configure registry policy processing\\\" to \\\"Enabled\\\" and select the option \\\"Process even if the Group Policy objects have not changed\\\".\"]\n[98,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Guest account status\\\" to \\\"Disabled\\\".\"]\n[99,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> \\\"Turn off downloading of print drivers over HTTP\\\" to \\\"Enabled\\\".\"]\n[100,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Limit local account use of blank passwords to console logon only\\\" to \\\"Enabled\\\".\"]\n[101,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Rename administrator account\\\" to a name other than \\\"Administrator\\\".\"]\n[102,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> \\\"Turn off Internet download for Web publishing and online ordering wizards\\\" to \\\"Enabled\\\".\"]\n[103,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> \\\"Turn off printing over HTTP\\\" to \\\"Enabled\\\".\"]\n[104,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Accounts: Rename guest account\\\" to a name other than \\\"Guest\\\".\"]\n[105,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nThe default behavior for \\\"Support device authentication using certificate\\\" is \\\"Automatic\\\".\\n\\nIf this needs to be corrected, configured the policy value for Computer Configuration >> Administrative Templates >> System >> Kerberos >> \\\"Support device authentication using certificate\\\" to \\\"Not Configured or \\\"Enabled\\\" with either option selected in \\\"Device authentication behavior using certificate:\\\".\"]\n[106,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> \\\"Do not display network selection UI\\\" to \\\"Enabled\\\".\"]\n[107,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> \\\"Enumerate local users on domain-joined computers\\\" to \\\"Disabled\\\".\"]\n[108,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\\\" to \\\"Enabled\\\".\"]\n[109,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Digitally encrypt or sign secure channel data (always)\\\" to \\\"Enabled\\\".\"]\n[110,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Digitally encrypt secure channel data (when possible)\\\" to \\\"Enabled\\\".\"]\n[111,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> \\\"Require a password when a computer wakes (on battery)\\\" to \\\"Enabled\\\".\"]\n[112,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Digitally sign secure channel data (when possible)\\\" to \\\"Enabled\\\".\"]\n[113,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> \\\"Require a password when a computer wakes (plugged in)\\\" to \\\"Enabled\\\".\"]\n[114,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Remote Assistance >> \\\"Configure Solicited Remote Assistance\\\" to \\\"Disabled\\\".\"]\n[115,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Disable machine account password changes\\\" to \\\"Disabled\\\".\"]\n[116,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Remote Procedure Call >> \\\"Restrict Unauthenticated RPC clients\\\" to \\\"Enabled\\\" and \\\"Authenticated\\\".\"]\n[117,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Runtime >> \\\"Allow Microsoft accounts to be optional\\\" to \\\"Enabled\\\".\"]\n[118,\"This is the default configuration for this setting (30 days).\\n\\nConfigure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Maximum machine account password age\\\" to \\\"30\\\" or less (excluding 0 which is unacceptable).\"]\n[119,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Application Compatibility >> \\\"Turn off Inventory Collector\\\" to \\\"Enabled\\\".\"]\n[120,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Domain member: Require strong (Windows 2000 or Later) session key\\\" to \\\"Enabled\\\".\"]\n[121,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> \\\"Disallow Autoplay for non-volume devices\\\" to \\\"Enabled\\\".\"]\n[122,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Machine inactivity limit\\\" to \\\"900\\\" seconds\\\" or less, excluding \\\"0\\\" which is effectively disabled.\"]\n[123,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> \\\"Set the default behavior for AutoRun\\\" to \\\"Enabled:Do not execute any autorun commands\\\".\"]\n[124,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> \\\"Turn off AutoPlay\\\" to \\\"Enabled:All Drives\\\".\"]\n[125,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Message text for users attempting to log on\\\" to the following.\\n\\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details.\"]\n[126,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Biometrics >> Facial Features >> \\\"Configure enhanced anti-spoofing\\\" to \\\"Enabled\\\". \\n\\nv1607:\\nThe policy name is \\\"Use enhanced anti-spoofing when available\\\".\"]\n[127,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Credential User Interface >> \\\"Enumerate administrator accounts on elevation\\\" to \\\"Disabled\\\".\"]\n[128,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Message title for users attempting to log on\\\" to \\\"DoD Notice and Consent Banner\\\", \\\"US Department of Defense Warning Statement\\\", or a site-defined equivalent.\\n\\nIf a site-defined title is used, it can in no case contravene or modify the language of the banner text required in WN10-SO-000075.\"]\n[129,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Data Collection and Preview Builds >> \\\"Allow Telemetry\\\" to \\\"Enabled\\\" with \\\"0 - Security [Enterprise Only]\\\" or \\\"1 - Basic\\\" selected in \\\"Options:\\\".   \\n\\nIf an organization is using v1709 or later of Windows 10 this may be configured to \\\"2 - Enhanced\\\" to support Windows Analytics. V-82145 must also be configured to limit the Enhanced diagnostic data to the minimum required by Windows Analytics.\"]\n[130,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Configure Windows Defender SmartScreen\\\" to \\\"Enabled\\\" with \\\"Warn and prevent bypass\\\" selected. \\n\\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Explorer.\\n\\nv1607 LTSB:\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Configure Windows SmartScreen\\\" to \\\"Enabled\\\". (Selection options are not available.)\\n\\nv1507 LTSB:\\nConfigure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Configure Windows SmartScreen\\\" to \\\"Enabled\\\" with \\\"Require approval from an administrator before running downloaded unknown software\\\" selected.\"]\n[131,\"This is the default configuration for this setting (10 logons to cache).\\n\\nConfigure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Number of previous logons to cache (in case domain controller is not available)\\\" to \\\"10\\\" logons or less.\\n\\nThis setting only applies to domain-joined systems, however, it is configured by default on all systems.\"]\n[132,\"The default behavior is for data execution prevention to be turned on for file explorer.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Turn off Data Execution Prevention for Explorer\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[133,\"The default behavior is for File Explorer heap termination on corruption to be enabled.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Turn off heap termination on corruption\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[134,\"The default behavior is for shell protected mode to be turned on for file explorer.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> \\\"Turn off shell protocol protected mode\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[135,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Interactive logon: Smart card removal behavior\\\" to  \\\"Lock Workstation\\\" or \\\"Force Logoff\\\".\"]\n[136,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Prevent bypassing Windows Defender SmartScreen prompts for sites\\\" to \\\"Enabled\\\". \\n\\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.\"]\n[137,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Prevent bypassing Windows Defender SmartScreen prompts for files\\\" to \\\"Enabled\\\". \\n\\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.\"]\n[138,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Microsoft network client: Digitally sign communications (always)\\\" to \\\"Enabled\\\".\"]\n[139,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Configure Password Manager\\\" to \\\"Disabled\\\".\"]\n[140,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Microsoft network client: Send unencrypted password to third-party SMB servers\\\" to \\\"Disabled\\\".\"]\n[141,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Configure Windows Defender SmartScreen\\\" to \\\"Enabled\\\". \\n\\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Microsoft Edge.\"]\n[142,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Hello for Business >> \\\"Use a hardware security device\\\" to \\\"Enabled\\\". \\n\\nv1507 LTSB:\\nThe policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Passport for Work.\"]\n[143,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Microsoft network server: Digitally sign communications (always)\\\" to \\\"Enabled\\\".\"]\n[144,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> PIN Complexity >> \\\"Minimum PIN length\\\" to \\\"6\\\" or greater. \\n\\nv1607 LTSB:\\nThe policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Windows Hello for Business >> Pin Complexity.\\n\\nv1507 LTSB:\\nThe policy path is Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Passport for Work >> Pin Complexity.\"]\n[145,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Connection Client >> \\\"Do not allow passwords to be saved\\\" to \\\"Enabled\\\".\"]\n[146,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Device and Resource Redirection >> \\\"Do not allow drive redirection\\\" to \\\"Enabled\\\".\"]\n[147,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> \\\"Always prompt for password upon connection\\\" to \\\"Enabled\\\".\"]\n[148,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security \\\"Require secure RPC communication\\\" to \\\"Enabled\\\".\"]\n[149,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Allow anonymous SID/Name translation\\\" to \\\"Disabled\\\".\"]\n[150,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> \\\"Set client connection encryption level\\\" to \\\"Enabled\\\" and \\\"High Level\\\".\"]\n[151,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> \\\"Prevent downloading of enclosures\\\" to \\\"Enabled\\\".\"]\n[152,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Do not allow anonymous enumeration of SAM accounts\\\" to \\\"Enabled\\\".\"]\n[153,\"The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections.\\n\\nIf this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> \\\"Turn on Basic feed authentication over HTTP\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[154,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Do not allow anonymous enumeration of SAM accounts and shares\\\" to \\\"Enabled\\\".\"]\n[155,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Search >> \\\"Allow indexing of encrypted files\\\" to \\\"Disabled\\\".\"]\n[156,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Let Everyone permissions apply to anonymous users\\\" to \\\"Disabled\\\".\"]\n[157,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Restrict anonymous access to Named Pipes and Shares\\\" to \\\"Enabled\\\".\"]\n[158,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Allow LocalSystem NULL session fallback\\\" to \\\"Disabled\\\".\"]\n[159,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Allow PKU2U authentication requests to this computer to use online identities\\\" to \\\"Disabled\\\".\"]\n[160,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Configure encryption types allowed for Kerberos\\\" to \\\"Enabled\\\" with only the following selected:\\n\\nAES128_HMAC_SHA1\\nAES256_HMAC_SHA1\\nFuture encryption types\"]\n[161,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Do not store LAN Manager hash value on next password change\\\" to \\\"Enabled\\\".\"]\n[162,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: LAN Manager authentication level\\\" to \\\"Send NTLMv2 response only. Refuse LM & NTLM\\\".\"]\n[163,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: LDAP client signing requirements\\\" to \\\"Negotiate signing\\\" at a minimum.\"]\n[164,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Minimum session security for NTLM SSP based (including secure RPC) clients\\\" to \\\"Require NTLMv2 session security\\\" and \\\"Require 128-bit encryption\\\" (all options selected).\"]\n[165,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network security: Minimum session security for NTLM SSP based (including secure RPC) servers\\\" to \\\"Require NTLMv2 session security\\\" and \\\"Require 128-bit encryption\\\" (all options selected).\"]\n[166,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing\\\" to \\\"Enabled\\\".\"]\n[167,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"System objects: Strengthen default permissions of internal system objects (e.g. Symbolic links)\\\" to \\\"Enabled\\\".\"]\n[168,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Admin Approval Mode for the Built-in Administrator account\\\" to \\\"Enabled\\\".\"]\n[169,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode\\\" to \\\"Prompt for consent on the secure desktop\\\".\"]\n[170,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Behavior of the elevation prompt for standard users\\\" to \\\"Automatically deny elevation requests\\\".\"]\n[171,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Detect application installations and prompt for elevation\\\" to \\\"Enabled\\\".\"]\n[172,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Only elevate UIAccess applications that are installed in secure locations\\\" to \\\"Enabled\\\".\"]\n[173,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Run all administrators in Admin Approval Mode\\\" to \\\"Enabled\\\".\"]\n[174,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"User Account Control: Virtualize file and registry write failures to per-user locations\\\" to \\\"Enabled\\\".\"]\n[175,\"Configure the policy value for User Configuration >> Administrative Templates >> Start Menu and Taskbar >> Notifications >> \\\"Turn off toast notifications on the lock screen\\\" to \\\"Enabled\\\".\"]\n[176,\"The default behavior is for Windows to mark file attachments with their zone information.\\n\\nIf this needs to be corrected, configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Attachment Manager >> \\\"Do not preserve zone information in file attachments\\\" to \\\"Not Configured\\\" or \\\"Disabled\\\".\"]\n[177,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Access Credential Manager as a trusted caller\\\" to be defined but containing no entries (blank).\"]\n[178,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Access this computer from the network\\\" to only include the following groups or accounts:\\n\\nAdministrators   \\nRemote Desktop Users\"]\n[179,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Act as part of the operating system\\\" to be defined but containing no entries (blank).\"]\n[180,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Allow log on locally\\\" to only include the following groups or accounts:\\n\\nAdministrators\\nUsers\"]\n[181,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Back up files and directories\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[182,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Change the system time\\\" to only include the following groups or accounts:\\n\\nAdministrators\\nLOCAL SERVICE\\nNT SERVICE\\\\autotimesvc is added in v1909 cumulative update.\"]\n[183,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create a pagefile\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[184,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create a token object\\\" to be defined but containing no entries (blank).\"]\n[185,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create global objects\\\" to only include the following groups or accounts:\\n\\nAdministrators\\nLOCAL SERVICE\\nNETWORK SERVICE\\nSERVICE\"]\n[186,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create permanent shared objects\\\" to be defined but containing no entries (blank).\"]\n[187,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Create symbolic links\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[188,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Debug programs\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[189,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny access to this computer from the network\\\" to include the following.\\n\\nDomain Systems Only:\\nEnterprise Admins group\\nDomain Admins group\\nLocal account (see Note below)\\n\\nAll Systems:\\nGuests group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nNote: \\\"Local account\\\" is a built-in security group used to assign user rights and permissions to all local accounts.\"]\n[190,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny log on as a batch job\\\" to include the following.\\n\\nDomain Systems Only:\\nEnterprise Admin Group\\nDomain Admin Group\"]\n[191,\"This requirement is applicable to domain-joined systems, for standalone systems this is NA.\\n\\nConfigure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny log on as a service\\\" to include the following.\\n\\nDomain Systems Only:\\nEnterprise Admins Group\\nDomain Admins Group\"]\n[192,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny log on locally\\\" to include the following.\\n\\nDomain Systems Only:\\nEnterprise Admins Group\\nDomain Admins Group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nAll Systems:\\nGuests Group\"]\n[193,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Deny log on through Remote Desktop Services\\\" to include the following.\\n\\nIf Remote Desktop Services is not used by the organization, assign the Everyone group this right to prevent all access.\\n\\nDomain Systems Only:\\nEnterprise Admins group\\nDomain Admins group\\nLocal account (see Note below)\\n\\nAll Systems:\\nGuests group\\n\\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\\n\\nNote: \\\"Local account\\\" is a built-in security group used to assign user rights and permissions to all local accounts.\"]\n[194,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Enable computer and user accounts to be trusted for delegation\\\" to be defined but containing no entries (blank).\"]\n[195,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Force shutdown from a remote system\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[196,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Impersonate a client after authentication\\\" to only include the following groups or accounts:\\n\\nAdministrators\\nLOCAL SERVICE\\nNETWORK SERVICE\\nSERVICE\"]\n[197,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Load and unload device drivers\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[198,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Lock pages in memory\\\" to be defined but containing no entries (blank).\"]\n[199,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Manage auditing and security log\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[200,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Modify firmware environment values\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[201,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Perform volume maintenance tasks\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[202,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Profile single process\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[203,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Restore files and directories\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[204,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> \\\"Take ownership of files or other objects\\\" to only include the following groups or accounts:\\n\\nAdministrators\"]\n[205,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Delivery Optimization >> \\\"Download Mode\\\" to \\\"Enabled\\\" with any option except \\\"Internet\\\" selected.\\n\\nAcceptable selections include:\\nBypass (100)\\nGroup (2)\\nHTTP only (0)\\nLAN (1)\\nSimple (99)\\n\\nv1507 (LTSB) does not include this group policy setting locally. For domain joined systems, configure through domain group policy as \\\"HTTP only (0)\\\" or \\\"Lan (1)\\\". Standalone systems configure using Settings >> Update & Security >> Windows Update >> Advanced Options >> \\\"Choose how updates are delivered\\\" with either \\\"Off\\\" or \\\"PCs on my local network\\\" selected.\"]\n[206,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Audit Process Creation >> \\\"Include command line in process creation events\\\" to \\\"Enabled\\\".\"]\n[207,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> \\\"Turn on PowerShell Script Block Logging\\\" to \\\"Enabled\\\".\"]\n[208,\"Configure DEP to at least OptOut.\\n\\nNote: Suspend BitLocker before making changes to the DEP configuration.\\n\\nOpen a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).\\nEnter \\\"BCDEDIT /set {current} nx OptOut\\\".  (If using PowerShell \\\"{current}\\\" must be enclosed in quotes.)\\n\\\"AlwaysOn\\\", a more restrictive selection, is also valid but does not allow applications that do not function properly to be opted out of DEP.\\n\\nOpted out exceptions can be configured in the \\\"System Properties\\\".\\n\\nOpen \\\"System\\\" in Control Panel.\\nSelect \\\"Advanced system settings\\\".\\nClick \\\"Settings\\\" in the \\\"Performance\\\" section.\\nSelect the \\\"Data Execution Prevention\\\" tab.\\nApplications that are opted out are configured in the window below the selection \\\"Turn on DEP for all programs and services except those I select:\\\".\"]\n[209,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Enable Structured Exception Handling Overwrite Protection (SEHOP)\\\" to \\\"Enabled\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package. \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[210,\"Disable \\\"Windows PowerShell 2.0\\\" on the system.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\nEnter the following:\\nDisable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root\\n\\nThis command should disable both \\\"MicrosoftWindowsPowerShellV2Root\\\" and \\\"MicrosoftWindowsPowerShellV2\\\" which correspond to \\\"Windows PowerShell 2.0\\\" and \\\"Windows PowerShell 2.0 Engine\\\" respectively in \\\"Turn Windows features on or off\\\".\\n\\nAlternately:\\nSearch for \\\"Features\\\".\\nSelect \\\"Turn Windows features on or off\\\".\\nDe-select \\\"Windows PowerShell 2.0\\\".\"]\n[211,\"Disable the SMBv1 protocol.\\n\\nRun \\\"Windows PowerShell\\\" with elevated privileges (run as administrator).\\n\\nEnter the following:\\nDisable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol\\n\\nAlternately:\\nSearch for \\\"Features\\\".\\n\\nSelect \\\"Turn Windows features on or off\\\".\\n\\nDe-select \\\"SMB 1.0/CIFS File Sharing Support\\\".\"]\n[212,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Account Lockout\\\" with \\\"Failure\\\" selected.\"]\n[213,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> \\\"Audit Authorization Policy Change\\\" with \\\"Success\\\" selected.\"]\n[214,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"WDigest Authentication (disabling may require KB2871997)\\\" to \\\"Disabled\\\".\\n\\nThe patch referenced in the policy title is not required for Windows 10.\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package.  \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[215,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Network Connections >> \\\"Prohibit use of Internet Connection Sharing on your DNS domain network\\\" to \\\"Enabled\\\".\"]\n[216,\"Navigate to the policy Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> \\\"Network access: Restrict clients allowed to make remote calls to SAM\\\".\\n\\nSelect \\\"Edit Security\\\" to configure the \\\"Security descriptor:\\\".\\n\\nAdd \\\"Administrators\\\" in \\\"Group or user names:\\\" if it is not already listed (this is the default).\\n\\nSelect \\\"Administrators\\\" in \\\"Group or user names:\\\".\\n\\nSelect \\\"Allow\\\" for \\\"Remote Access\\\" in \\\"Permissions for \\\"Administrators\\\".\\n\\nClick \\\"OK\\\".\\n\\nThe \\\"Security descriptor:\\\" must be populated with \\\"O:BAG:BAD:(A;;RC;;;BA) for the policy to be enforced.\"]\n[217,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Cloud Content >> \\\"Turn off Microsoft consumer experiences\\\" to \\\"Enabled\\\".\"]\n[218,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Remove \\\"Run as Different User\\\" from context menus\\\" to \\\"Enabled\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package.  \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[219,\"Turn off Bluetooth radios not organizationally approved. Establish an organizational policy for the use of Bluetooth.\"]\n[220,\"Turn off Bluetooth radios when not in use. Establish an organizational policy for the use of Bluetooth to include training of personnel.\"]\n[221,\"Configure Bluetooth to notify users if devices attempt to connect.\\nView Bluetooth Settings.\\nEnsure \\\"Alert me when a new Bluetooth device wants to connect\\\" is checked.\"]\n[222,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit Other Object Access Events\\\" with \\\"Failure\\\" selected.\"]\n[223,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit Other Object Access Events\\\" with \\\"Success\\\" selected.\"]\n[224,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> SSL Configuration Settings >> \\\"ECC Curve Order\\\" to \\\"Enabled\\\" with \\\"ECC Curve Order:\\\" including the following in the order listed:\\n\\nNistP384\\nNistP256\"]\n[225,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Game Recording and Broadcasting >> \\\"Enables or disables Windows Game Recording and Broadcasting\\\" to \\\"Disabled\\\".\"]\n[226,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Credentials Delegation >> \\\"Remote host allows delegation of non-exportable credentials\\\" to \\\"Enabled\\\".\"]\n[227,\"Configure the \\\"Secondary Logon\\\" service \\\"Startup Type\\\" to \\\"Disabled\\\".\"]\n[228,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit File Share\\\" with \\\"Success\\\" selected.\"]\n[229,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Configure SMBv1 Server\\\" to \\\"Disabled\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package. \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.   \\n\\nThe system must be restarted for the change to take effect.\"]\n[230,\"Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> \\\"Configure SMBv1 client driver\\\" to \\\"Enabled\\\" with \\\"Disable driver (recommended)\\\" selected for \\\"Configure MrxSmb10 driver\\\".\\n\\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package. \\\"SecGuide.admx\\\" and \\\"SecGuide.adml\\\" must be copied to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.   \\n\\nThe system must be restarted for the changes to take effect.\"]\n[231,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> \\\"Audit File Share\\\" with \\\"Failure\\\" selected.\"]\n[232,\"Remove any unresolved SIDs found in User Rights assignments and determined to not be for currently valid accounts or groups by removing the accounts or groups from the appropriate group policy.\"]\n[233,\"Configure UEFI firmware to run in UEFI mode, not Legacy BIOS mode.\"]\n[234,\"Enable Secure Boot in the system firmware.\"]\n[235,\"Ensure Exploit Protection system-level mitigation, \\\"Data Execution Prevention (DEP)\\\", is turned on.  The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Data Execution Prevention (DEP)\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn DEP on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <DEP Enable=\\\"true\\\"></DEP>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[236,\"Ensure Exploit Protection system-level mitigation, \\\"Randomize memory allocations (Bottom-Up ASLR)\\\" is turned on. The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Randomize memory allocations (Bottom-Up ASLR)\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn Bottom-Up ASLR on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <ASLR BottomUp=\\\"true\\\"</ASLR>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[237,\"Ensure Exploit Protection system-level mitigation, \\\"Control flow guard (CFG)\\\", is turned on. The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Control flow guard (CFG)\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn CFG on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <ControlFlowGuard Enable=\\\"true\\\"></ControlFlowGuard>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[238,\"Ensure Exploit Protection system-level mitigation, \\\"Validate exception chains (SEHOP)\\\", is turned on. The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Validate exception chains (SEHOP)\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn SEHOP on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <SEHOP Enable=\\\"true\\\"></SEHOP>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[239,\"Ensure Exploit Protection system-level mitigation, \\\"Validate heap integrity\\\" is turned on. The default configuration in Exploit Protection is \\\"On by default\\\" which meets this requirement.\\n\\nOpen \\\"Windows Defender Security Center\\\".\\n\\nSelect \\\"App & browser control\\\".\\n\\nSelect \\\"Exploit protection settings\\\".\\n\\nUnder \\\"System settings\\\", configure \\\"Validate heap integrity\\\" to \\\"On by default\\\" or \\\"Use default (<On>)\\\".   \\n\\nThe STIG package includes a DoD EP XML file in the \\\"Supporting Files\\\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn Validate heap integrity on (other system level EP requirements can be combined under <SystemConfig>):\\n\\n<SystemConfig>\\n  <Heap TerminateOnError=\\\"true\\\"></Heap>\\n</SystemConfig>\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[240,\"Ensure the following mitigations are configured as shown for Acrobat.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[241,\"Ensure the following mitigations are configured as shown for AcroRd32.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot= False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[242,\"Ensure the following mitigations are configured as shown forchrome.exe:\\n\\nDEP:\\nOverrideDEP: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[243,\"Ensure the following mitigations are configured as shown for EXCEL.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[244,\"Ensure the following mitigations are configured as shown  firefox.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: On\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\". It is recommended the file be in a read-only network location.\"]\n[245,\"Ensure the following mitigations are configured as shown for FLTLDR.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False \\nOverrideExportAddressFilterPlus: False \\nOverrideImportAddressFilter: False \\nOverrideEnableRopStackPivot: False \\nOverrideEnableRopCallerCheck: False \\nOverrideEnableRopSimExec: False\\n\\nChild Process:\\nOverrideChildProcess: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[246,\"Ensure the following mitigations are configured as shown GROOVE.EXE:\\n\\nDEP:\\nOverrideDEP: False\\n\\nASLR:\\nOverrideBlockRemoteImages: False\\n\\nImageLoad:\\nForceRelocateImages: True\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nChild Process:\\nOverrideChildProcess: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[247,\"Ensure the following mitigations are configured as shown for iexplore.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[248,\"Ensure the following mitigations are configured as shown for INFOPATH.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[249,\"Ensure the following mitigations are configured for java.exe, javaw.exe, and javaws.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[250,\"Ensure the following mitigations are configured as shown for lync.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[251,\"Ensure the following mitigations are configured as shown for MSACCESS.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[252,\"Ensure the following mitigations are configured as shown for MSPUB.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[253,\"Ensure the following mitigations are configured for OneDrive.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nOverrideRelocateImages: NOTSET\\n\\nImageLoad:\\nOverrideBlockRemoteImages: False\\n\\nPayload:\\nOverrideExportAddressFilter: False \\nOverrideExportAddressFilterPlus: False \\nOverrideImportAddressFilter: False \\nOverrideEnableRopStackPivot: False \\nOverrideEnableRopCallerCheck: False \\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[254,\"Ensure the following mitigations are configured as shown for OIS.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[255,\"Ensure the following mitigations are configured as shown for OUTLOOK.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[256,\"Ensure the following mitigations are configured as shown forplugin-container.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[257,\"Ensure the following mitigations are configured as shown for POWERPNT.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[258,\"Ensure the following mitigations are configured as shown for PPTVIEW.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[259,\"Ensure the following mitigations are configured as shown for VISIO.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[260,\"Ensure the following mitigations are configured as shown for VPREVIEW.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[261,\"Ensure the following mitigations are configured as shown for WINWORD.EXE:\\n\\nDEP:\\nOverride DEP: False\\n\\nASLR:\\nForceRelocateImages: ON\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[262,\"Ensure the following mitigations are configured as shown for wmplayer.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[263,\"Ensure the following mitigations are configured as shown for wordpad.exe:\\n\\nDEP:\\nOverride DEP: False\\n\\nPayload:\\nOverrideExportAddressFilter: False\\nOverrideExportAddressFilterPlus: False\\nOverrideImportAddressFilter: False\\nOverrideEnableRopStackPivot: False\\nOverrideEnableRopCallerCheck: False\\nOverrideEnableRopSimExec: False\\n\\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \\\"Supporting Files\\\" folder.\\n\\nThe XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> \\\"Use a common set of exploit protection settings\\\" configured to \\\"Enabled\\\" with file name and location defined under \\\"Options:\\\".  It is recommended the file be in a read-only network location.\"]\n[264,\"Establish and enforce a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. Define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.\\n\\nImplement technical measures where feasible such as removal of applications or use of application whitelisting to restrict the use of applications that can access the Internet.\"]\n[265,\"Configure the policy value for User Configuration >> Administrative Templates >> OneDrive >> \\\"Prevent users from synchronizing personal OneDrive accounts\\\" to \\\"Enabled\\\".   \\n\\nGroup policy files for OneDrive are located on a system with OneDrive in \\\"%localappdata%\\\\Microsoft\\\\OneDrive\\\\BuildNumber\\\\adm\\\\\\\".\\n\\nCopy the OneDrive.admx and .adml files to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[266,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Edge >> \\\"Prevent certificate error overrides\\\" to \\\"Enabled\\\".\"]\n[267,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Data Collection and Preview Builds >> \\\"Limit Enhanced diagnostic data to the minimum required by Windows Analytics\\\" to \\\"Enabled\\\" with \\\"Enable Windows Analytics collection\\\" selected in \\\"Options:\\\".\"]\n[268,\"Configure the policy value for Computer Configuration >> Administrative Templates >> OneDrive >> \\\"Allow syncing OneDrive accounts for only specific organizations\\\", with the Tenant GUID of the organization's DoD instance in the format 1111-2222-3333-4444.\\n\\nIf the organization does not have an instance of OneDrive, configure the Tenant GUID with \\\"1111-2222-3333-4444\\\".\\n\\nGroup policy files for OneDrive are located on a system with OneDrive in \\\"%localappdata%\\\\Microsoft\\\\OneDrive\\\\BuildNumber\\\\adm\\\\\\\".\\n\\nCopy the OneDrive.admx and .adml files to the \\\\Windows\\\\PolicyDefinitions and \\\\Windows\\\\PolicyDefinitions\\\\en-US directories respectively.\"]\n[269,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> \\\"Let Windows apps activate with voice while the system is locked\\\" to \\\"Enabled\\\" with “Default for all Apps:” set to “Force Deny”. \\n\\nThe requirement is NA if the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> App Privacy >> \\\"Let Windows apps activate with voice\\\" is configured to \\\"Enabled\\\" with “Default for all Apps:” set to “Force Deny”.\"]\n[270,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> BitLocker Drive Encryption >> Operating System Drives \\\"Require additional authentication at startup\\\" to \\\"Enabled\\\" with \\\"Configure TPM Startup PIN:\\\" set to \\\"Require startup PIN with TPM\\\" or with \\\"Configure TPM startup key and PIN:\\\" set to \\\"Require startup key and PIN with TPM\\\".\"]\n[271,\"Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> BitLocker Drive Encryption >> Operating System Drives \\\"Configure minimum PIN length for startup\\\" to \\\"Enabled\\\" with \\\"Minimum characters:\\\" set to \\\"6\\\" or greater.\"]\n[272,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Other Logon/Logoff Events\\\" with \\\"Failure\\\" selected.\"]\n[273,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> \\\"Audit Other Logon/Logoff Events\\\" with \\\"Success\\\" selected.\"]\n[274,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> “Detailed File Share\\\" with \\\"Failure\\\" selected.\"]\n[275,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> “Audit MPSSVC Rule-Level Policy Change\\\" with \\\"Success\\\" selected.\"]\n[276,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> “Audit MPSSVC Rule-Level Policy Change\\\" with \\\"Failure\\\" selected.\"]\n[277,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change>> \\\"Audit Other Policy Change Events\\\" with \\\"Success\\\" selected.\"]\n[278,\"Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change>> \\\"Audit Other Policy Change Events\\\" with \\\"Failure\\\" selected.\"]\n[279,\"Change the enabled local Administrator account password at least every \\\"60\\\" days.\\n\\nAutomated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to meet this requirement.\"]\n[280,\"Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Kernel DMA Protection >> \\\"Enumeration policy for external devices incompatible with Kernel DMA Protection\\\" to \\\"Enabled\\\" with \\\"Enumeration Policy\\\" set to \\\"Block All\\\".\"]\n[281,\"Disable the convenience PIN sign-in. \\n\\nIf this needs to be corrected configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> Set \\\"Turn on convenience PIN sign-in\\\" to \\\"Disabled”.\"]\n[282,\"Disable the convenience PIN sign-in. \\n\\nIf this needs to be corrected configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Ink Workspace   >> Set \\\" Allow Windows Ink Workspace\\\" to \\\"Enabled” Set Options ‘On, but disallow access above lock”.\"]\n[283,\"Configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Cloud Content >> \\\"Do not suggest third-party content in Windows spotlight\\\" to \\\"Enabled\"]\n[284,\"If the camera is not disconnected or covered, the following registry entry is required.\\n \\nRegistry Hive: HKEY_LOCAL_MACHINE\\nRegistryPath\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\CapabilityAccessManager\\\\ConsentStore\\\\webcam\\n\\nValue Name: Deny\"]\n[285,\"Set non-persistent VM sessions to not exceed 24 hours.\"]\n[286,\"Ensure the following settings are configured for Windows 10 locally or applied through group policy. \\n\\nConfigure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane \\\"Turn off Preview Pane\\\" to \\\"Enabled\\\".\\n\\nConfigure the policy value for User Configuration >> Administrative Templates >> Windows Components >> File Explorer >> Explorer Frame Pane \\\"Turn on or off details pane\\\" to \\\"Enabled\\\" and \\\"Configure details pane\\\" to \\\"Always hide\\\".\"]\n[287,\"For non-domain joined systems, configuring Windows Hello for sign on options would be suggested based on the organizations needs and capabilities.\\n \\nNote: Before applying, the supplemental guidance provided with the STIG should be consulted to ensure continued access to the operating system.\"]\n[535,\"Configure the VPN Gateway to ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies (e.g., IPsec policy configuration). Also, configure the VPN gateway to forward encapsulated or encrypted traffic received from other enclaves with different security policies to the perimeter firewall and IDPS before traffic is passed to the private network.\"]\n[536,\"Configure the Remote Access VPN to display the Standard Mandatory DoD Notice and Consent Banner in accordance with DoD policy before granting access to the device. Use the following verbiage for applications that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n-At any time, the USG may inspect and seize data stored on this IS.\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\"]\n[11720,\"Run the following command to determine which package owns the file:\\n\\n# rpm -qf <filename>\\n\\nReset the user and group ownership of files within a package with the following command:\\n\\n#rpm --setugids <packagename>\\n\\n\\nReset the permissions of files within a package with the following command:\\n\\n#rpm --setperms <packagename>\"]\n[11721,\"Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCreate a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command:\\n\\n# touch /etc/dconf/db/local.d/01-banner-message\\n\\nAdd the following line to the [org/gnome/login-screen] section of the \\\"/etc/dconf/db/local.d/01-banner-message\\\":\\n\\n[org/gnome/login-screen]\\nbanner-message-enable=true\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[11722,\"Configure the operating system to display the approved Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCreate a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command:\\n\\n# touch /etc/dconf/db/local.d/01-banner-message\\n\\nAdd the following line to the [org/gnome/login-screen] section of the \\\"/etc/dconf/db/local.d/01-banner-message\\\":\\n\\n[org/gnome/login-screen]\\n\\nbanner-message-enable=true\\n\\nbanner-message-text='You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\\\n-At any time, the USG may inspect and seize data stored on this IS.\\\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. '\\n\\nNote: The \\\"\\\\n \\\" characters are for formatting only. They will not be displayed on the GUI.\\n\\nRun the following command to update the database:\\n# dconf update\"]\n[11723,\"Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via the command line by editing the \\\"/etc/issue\\\" file.\\n\\nReplace the default text with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is:\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details.\\\"\"]\n[11724,\"Configure the operating system to enable a user's session lock until that user re-establishes access using established identification and authentication procedures.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following example:\\n\\n# touch /etc/dconf/db/local.d/00-screensaver\\n\\nEdit the \\\"[org/gnome/desktop/screensaver]\\\" section of the database file and add or update the following lines:\\n\\n# Set this to true to lock the screen when the screensaver activates\\nlock-enabled=true\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[11725,\"Configure the operating system to uniquely identify and authenticate users using multifactor authentication via a graphical user logon.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example is using the database local for the system, so if the system is using another database in \\\"/etc/dconf/profile/user\\\", the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/00-defaults\\n\\nEdit \\\"[org/gnome/login-screen]\\\" and add or update the following line:\\nenable-smartcard-authentication=true   \\n\\nUpdate the system databases:\\n# dconf update\"]\n[11726,\"Configure the operating system to initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command:\\n\\n# touch /etc/dconf/db/local.d/00-screensaver\\n\\nEdit /etc/dconf/db/local.d/00-screensaver and add or update the following lines:\\n\\n[org/gnome/desktop/session]\\n# Set the lock time out to 900 seconds before the session is considered idle\\nidle-delay=uint32 900\\n\\nYou must include the \\\"uint32\\\" along with the integer key values as shown.\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[11727,\"Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example below is using the database \\\"local\\\" for the system, so if the system is using another database in \\\"/etc/dconf/profile/user\\\", the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/locks/session\\n\\nAdd the setting to lock the screensaver lock delay:\\n\\n/org/gnome/desktop/screensaver/lock-delay\"]\n[11728,\"Configure the operating system to prevent a user from overriding a session lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example below is using the database \\\"local\\\" for the system, so if the system is using another database in /etc/dconf/profile/user, the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/locks/session\\n\\nAdd the setting to lock the session idle delay:\\n\\n/org/gnome/desktop/session/idle-delay\"]\n[11729,\"Install the screen package to allow the initiation of a session lock after a 15-minute period of inactivity.\\n\\nInstall the screen program (if it is not on the system) with the following command:\\n\\n# yum install screen   \\n\\nOR\\n\\nInstall the tmux program (if it is not on the system) with the following command:\\n\\n#yum install tmux\"]\n[11730,\"Configure the operating system to initiate a session lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\n# touch /etc/dconf/db/local.d/00-screensaver\\n\\nAdd the setting to enable screensaver locking after 15 minutes of inactivity:\\n\\n[org/gnome/desktop/screensaver]\\n\\nidle-activation-enabled=true\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[11731,\"Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example below is using the database \\\"local\\\" for the system, so if the system is using another database in \\\"/etc/dconf/profile/user\\\", the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/locks/session\\n\\nAdd the setting to lock the screensaver idle-activation-enabled setting:\\n\\n/org/gnome/desktop/screensaver/idle-activation-enabled\"]\n[11732,\"Configure the operating system to initiate a session lock for graphical user interfaces when a screensaver is activated.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\n# touch /etc/dconf/db/local.d/00-screensaver\\n\\nAdd the setting to enable session locking when a screensaver is activated:\\n\\n[org/gnome/desktop/screensaver]\\nlock-delay=uint32 5\\n\\nThe \\\"uint32\\\" must be included along with the integer key values as shown.\\n\\nUpdate the system databases:\\n\\n# dconf update\\n\\nUsers must log out and back in again before the system-wide settings take effect.\"]\n[11733,\"Configure PAM to utilize /etc/pam.d/system-auth when changing passwords.\\n\\nAdd the following line to \\\"/etc/pam.d/passwd\\\" (or modify the line to have the required value):\\n\\npassword     substack    system-auth\"]\n[11734,\"Configure the operating system to use \\\"pwquality\\\" to enforce password complexity rules.\\n\\nAdd the following line to \\\"/etc/pam.d/system-auth\\\" (or modify the line to have the required value):\\n\\npassword required pam_pwquality.so retry=3\\n\\nNote: The value of \\\"retry\\\" should be between \\\"1\\\" and \\\"3\\\".\"]\n[11735,\"Configure the operating system to enforce password complexity by requiring that at least one upper-case character be used by setting the \\\"ucredit\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" (or modify the line to have the required value):\\n\\nucredit = -1\"]\n[11736,\"Configure the system to require at least one lower-case character when creating or changing a password.\\n\\nAdd or modify the following line \\nin \\\"/etc/security/pwquality.conf\\\":\\n\\nlcredit = -1\"]\n[11737,\"Configure the operating system to enforce password complexity by requiring that at least one numeric character be used by setting the \\\"dcredit\\\" option.\\n\\nAdd the following line to /etc/security/pwquality.conf (or modify the line to have the required value):\\n\\ndcredit = -1\"]\n[11738,\"Configure the operating system to enforce password complexity by requiring that at least one special character be used by setting the \\\"ocredit\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" (or modify the line to have the required value):\\n\\nocredit = -1\"]\n[11739,\"Configure the operating system to require the change of at least eight of the total number of characters when passwords are changed by setting the \\\"difok\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" (or modify the line to have the required value):\\n\\ndifok = 8\"]\n[11740,\"Configure the operating system to require the change of at least four character classes when passwords are changed by setting the \\\"minclass\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf conf\\\" (or modify the line to have the required value):\\n\\nminclass = 4\"]\n[11741,\"Configure the operating system to require the change of the number of repeating consecutive characters when passwords are changed by setting the \\\"maxrepeat\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf conf\\\" (or modify the line to have the required value):\\n\\nmaxrepeat = 3\"]\n[11742,\"Configure the operating system to require the change of the number of repeating characters of the same character class when passwords are changed by setting the \\\"maxclassrepeat\\\" option.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" conf (or modify the line to have the required value):\\n\\nmaxclassrepeat = 4\"]\n[11743,\"Configure the operating system to store only SHA512 encrypted representations of passwords.\\n\\nAdd the following line in \\\"/etc/pam.d/system-auth\\\":\\npam_unix.so sha512 shadow try_first_pass use_authtok\\n\\nAdd the following line in \\\"/etc/pam.d/password-auth\\\":\\npam_unix.so sha512 shadow try_first_pass use_authtok\\n\\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[11744,\"Configure the operating system to store only SHA512 encrypted representations of passwords.\\n\\nAdd or update the following line in \\\"/etc/login.defs\\\":\\n\\nENCRYPT_METHOD SHA512\"]\n[11745,\"Configure the operating system to store only SHA512 encrypted representations of passwords.\\n\\nAdd or update the following line in \\\"/etc/libuser.conf\\\" in the [defaults] section: \\n\\ncrypt_style = sha512\"]\n[11746,\"Configure the operating system to enforce 24 hours/1 day as the minimum password lifetime.\\n\\nAdd the following line in \\\"/etc/login.defs\\\" (or modify the line to have the required value):\\n\\nPASS_MIN_DAYS     1\"]\n[11747,\"Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime:\\n\\n# chage -m 1 [user]\"]\n[11748,\"Configure the operating system to enforce a 60-day maximum password lifetime restriction.\\n\\nAdd the following line in \\\"/etc/login.defs\\\" (or modify the line to have the required value):\\n\\nPASS_MAX_DAYS     60\"]\n[11749,\"Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction.\\n\\n# chage -M 60 [user]\"]\n[11750,\"Configure the operating system to prohibit password reuse for a minimum of five generations.\\n\\nAdd the following line in \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" (or modify the line to have the required value):\\n\\npassword    requisite     pam_pwhistory.so use_authtok remember=5 retry=3\\n   \\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[11751,\"Configure operating system to enforce a minimum 15-character password length.\\n\\nAdd the following line to \\\"/etc/security/pwquality.conf\\\" (or modify the line to have the required value):\\n\\nminlen = 15\"]\n[11752,\"If an account is configured for password authentication but does not have an assigned password, it may be possible to log on to the account without authenticating.\\n\\nRemove any instances of the \\\"nullok\\\" option in \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" to prevent logons with empty passwords.\\n\\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[11753,\"To explicitly disallow remote logon from accounts with empty passwords, add or correct the following line in \\\"/etc/ssh/sshd_config\\\":\\n\\nPermitEmptyPasswords no\\n\\nThe SSH service must be restarted for changes to take effect.  Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.\"]\n[11754,\"Configure the operating system to disable account identifiers (individuals, groups, roles, and devices) after the password expires.\\n\\nAdd the following line to \\\"/etc/default/useradd\\\" (or modify the line to have the required value):\\n\\nINACTIVE=0\"]\n[11755,\"Configure the operating system to lock an account for the maximum period when three unsuccessful logon attempts in 15 minutes are made.\\n\\nModify the first three lines of the auth section and the first line of the account section of the \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" files to match the following lines:\\n\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\nauth sufficient pam_unix.so try_first_pass\\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so   \\n\\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[11756,\"Configure the operating system to lock automatically the root account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are made.\\n\\nModify the first three lines of the auth section and the first line of the account section of the \\\"/etc/pam.d/system-auth\\\" and \\\"/etc/pam.d/password-auth\\\" files to match the following lines:\\n\\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\nauth sufficient pam_unix.so try_first_pass\\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\\naccount required pam_faillock.so\\n\\nNote: Manual changes to the listed files may be overwritten by the \\\"authconfig\\\" program. The \\\"authconfig\\\" program should not be used to update the configurations listed in this requirement.\"]\n[11757,\"Configure the operating system to require users to supply a password for privilege escalation.\\n\\nCheck the configuration of the \\\"/etc/sudoers\\\" file with the following command:\\n# visudo\\n\\nRemove any occurrences of \\\"NOPASSWD\\\" tags in the file.   \\n\\nCheck the configuration of the /etc/sudoers.d/* files with the following command:\\n# grep -i nopasswd /etc/sudoers.d/*\\n\\nRemove any occurrences of \\\"NOPASSWD\\\" tags in the file.\"]\n[11758,\"Configure the operating system to require users to reauthenticate for privilege escalation.\\n\\nCheck the configuration of the \\\"/etc/sudoers\\\" file with the following command:\\n\\n# visudo\\nRemove any occurrences of \\\"!authenticate\\\" tags in the file.\\n\\nCheck the configuration of the \\\"/etc/sudoers.d/*\\\" files with the following command:\\n\\n# grep -i authenticate /etc/sudoers /etc/sudoers.d/*\\nRemove any occurrences of \\\"!authenticate\\\" tags in the file(s).\"]\n[11759,\"Configure the operating system to enforce a delay of at least four seconds between logon prompts following a failed console logon attempt.\\n\\nModify the \\\"/etc/login.defs\\\" file to set the \\\"FAIL_DELAY\\\" parameter to \\\"4\\\" or greater:\\n\\nFAIL_DELAY 4\"]\n[11760,\"Configure the operating system to not allow an unattended or automatic logon to the system via a graphical user interface.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nAdd or edit the line for the \\\"AutomaticLoginEnable\\\" parameter in the [daemon] section of the \\\"/etc/gdm/custom.conf\\\" file to \\\"false\\\":\\n\\n[daemon]\\nAutomaticLoginEnable=false\"]\n[11761,\"Configure the operating system to not allow an unrestricted account to log on to the system via a graphical user interface.\\n\\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\\n\\nAdd or edit the line for the \\\"TimedLoginEnable\\\" parameter in the [daemon] section of the \\\"/etc/gdm/custom.conf\\\" file to \\\"false\\\":\\n\\n[daemon]\\nTimedLoginEnable=false\"]\n[11762,\"Configure the operating system to not allow users to override environment variables to the SSH daemon.\\n\\nEdit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for \\\"PermitUserEnvironment\\\" keyword and set the value to \\\"no\\\":\\n\\nPermitUserEnvironment no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[11763,\"Configure the operating system to not allow a non-certificate trusted host SSH logon to the system.\\n\\nEdit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for \\\"HostbasedAuthentication\\\" keyword and set the value to \\\"no\\\":\\n\\nHostbasedAuthentication no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[11764,\"Configure the system to encrypt the boot password for root.\\n\\nGenerate an encrypted grub2 password for root with the following command:\\n\\nNote: The hash generated is an example.\\n\\n# grub2-mkpasswd-pbkdf2\\n\\nEnter Password:\\nReenter Password:\\nPBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45\\n\\nEdit \\\"/etc/grub.d/40_custom\\\" and add the following lines below the comments:\\n\\n# vi /etc/grub.d/40_custom\\n\\nset superusers=\\\"root\\\"\\n\\npassword_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command}\\n\\nGenerate a new \\\"grub.conf\\\" file with the new password with the following commands:\\n\\n# grub2-mkconfig --output=/tmp/grub2.cfg\\n# mv /tmp/grub2.cfg /boot/grub2/grub.cfg\"]\n[11765,\"Configure the operating system to require authentication upon booting into single-user and maintenance modes.\\n\\nAdd or modify the \\\"ExecStart\\\" line in \\\"/usr/lib/systemd/system/rescue.service\\\" to include \\\"/usr/sbin/sulogin\\\":\\n\\nExecStart=-/bin/sh -c \\\"/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default\\\"\"]\n[11766,\"Configure the system to encrypt the boot password for root.\\n\\nGenerate an encrypted grub2 password for root with the following command:\\n\\nNote: The hash generated is an example.\\n  \\n# grub2-setpassword\\nEnter password:\\nConfirm password:\\n\\nEdit the /boot/grub2/grub.cfg file and add or modify the following lines in the \\\"### BEGIN /etc/grub.d/01_users ###\\\" section:\\n\\nset superusers=\\\"root\\\"\\nexport superusers\"]\n[11767,\"Configure the system to encrypt the boot password for root.\\n\\nGenerate an encrypted grub2 password for root with the following command:\\n\\nNote: The hash generated is an example.\\n\\n# grub2-mkpasswd-pbkdf2\\n\\nEnter Password:\\nReenter Password:\\nPBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45\\n\\nEdit \\\"/etc/grub.d/40_custom\\\" and add the following lines below the comments:\\n\\n# vi /etc/grub.d/40_custom\\n\\nset superusers=\\\"root\\\"\\n\\npassword_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command}\\n\\nGenerate a new \\\"grub.conf\\\" file with the new password with the following commands:\\n\\n# grub2-mkconfig --output=/tmp/grub2.cfg\\n# mv /tmp/grub2.cfg /boot/efi/EFI/redhat/grub.cfg\"]\n[11768,\"Configure the system to encrypt the boot password for root.\\n\\nGenerate an encrypted grub2 password for root with the following command:\\n\\nNote: The hash generated is an example.\\n  \\n# grub2-setpassword\\nEnter password:\\nConfirm password:\\n\\nEdit the /boot/efi/EFI/redhat/grub.cfg file and add or modify the following lines in the \\\"### BEGIN /etc/grub.d/01_users ###\\\" section:\\n\\nset superusers=\\\"root\\\"\\nexport superusers\"]\n[11769,\"Configure the operating system to require individuals to be authenticated with a multifactor authenticator.\\n\\nEnable smartcard logons with the following commands:\\n\\n# authconfig --enablesmartcard --smartcardaction=0 --update\\n# authconfig --enablerequiresmartcard -update\\n\\nModify the \\\"/etc/pam_pkcs11/pkcs11_eventmgr.conf\\\" file to uncomment the following line:\\n\\n#/usr/X11R6/bin/xscreensaver-command -lock\\n\\nModify the \\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" file to use the cackey module if required.\"]\n[11770,\"Configure the operating system to disable non-essential capabilities by removing the rsh-server package from the system with the following command:\\n\\n# yum remove rsh-server\"]\n[11771,\"Configure the operating system to disable non-essential capabilities by removing the \\\"ypserv\\\" package from the system with the following command:\\n\\n# yum remove ypserv\"]\n[11772,\"Configure the operating system to prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.\\n\\nUse the following command to map a new user to the \\\"sysdam_u\\\" role: \\n\\n#semanage login -a -s sysadm_u <username>\\n\\nUse the following command to map an existing user to the \\\"sysdam_u\\\" role:\\n\\n#semanage login -m -s sysadm_u <username>\\n\\nUse the following command to map a new user to the \\\"staff_u\\\" role:\\n\\n#semanage login -a -s staff_u <username>\\n\\nUse the following command to map an existing user to the \\\"staff_u\\\" role:\\n\\n#semanage login -m -s staff_u <username>\\n\\nUse the following command to map a new user to the \\\"user_u\\\" role:\\n\\n# semanage login -a -s user_u <username>\\n\\nUse the following command to map an existing user to the \\\"user_u\\\" role:\\n\\n# semanage login -m -s user_u <username>\"]\n[11773,\"Configure the file integrity tool to run automatically on the system at least weekly. The following example output is generic. It will set cron to run AIDE daily, but other file integrity tools may be used:  \\n\\n# more /etc/cron.daily/aide\\n#!/bin/bash\\n\\n/usr/sbin/aide --check | /bin/mail -s \\\"$HOSTNAME - Daily aide integrity check run\\\" root@sysname.mil\"]\n[11774,\"Configure the operating system to notify designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system. \\n\\nThe following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis. \\n\\n# more /etc/cron.daily/aide\\n\\n/usr/sbin/aide --check | /bin/mail -s \\\"$HOSTNAME - Daily aide integrity check run\\\" root@sysname.mil\"]\n[11775,\"Configure the operating system to verify the signature of packages from a repository prior to install by setting the following option in the \\\"/etc/yum.conf\\\" file:\\n\\ngpgcheck=1\"]\n[11776,\"Configure the operating system to verify the signature of local packages prior to install by setting the following option in the \\\"/etc/yum.conf\\\" file:\\n\\nlocalpkg_gpgcheck=1\"]\n[11777,\"Configure the operating system to disable the ability to use the USB Storage kernel module.\\n\\nCreate a file under \\\"/etc/modprobe.d\\\" with the following command:\\n\\n# touch /etc/modprobe.d/usb-storage.conf\\n\\nAdd the following line to the created file:\\n\\ninstall usb-storage /bin/true\\n\\nConfigure the operating system to disable the ability to use USB mass storage devices.\\n\\n# vi /etc/modprobe.d/blacklist.conf\\n\\nAdd or update the line:\\n\\nblacklist usb-storage\"]\n[11778,\"Configure the operating system to disable the ability to use the DCCP kernel module.\\n\\nCreate a file under \\\"/etc/modprobe.d\\\" with the following command:\\n\\n# touch /etc/modprobe.d/dccp.conf\\n\\nAdd the following line to the created file:\\n\\ninstall dccp /bin/true\\n\\nEnsure that the DCCP module is blacklisted: \\n\\n# vi /etc/modprobe.d/blacklist.conf\\n\\nAdd or update the line:\\n\\nblacklist dccp\"]\n[11779,\"Configure the operating system to disable the ability to automount devices.\\n\\nTurn off the automount service with the following commands:\\n\\n# systemctl stop autofs\\n# systemctl disable autofs\\n\\nIf \\\"autofs\\\" is required for Network File System (NFS), it must be documented with the ISSO.\"]\n[11780,\"Configure the operating system to remove all software components after updated versions have been installed.\\n\\nSet the \\\"clean_requirements_on_remove\\\" option to \\\"1\\\" in the \\\"/etc/yum.conf\\\" file:\\n\\nclean_requirements_on_remove=1\"]\n[11781,\"Configure the operating system to verify correct operation of all security functions.\\n\\nSet the \\\"SELinux\\\" status and the \\\"Enforcing\\\" mode by modifying the \\\"/etc/selinux/config\\\" file to have the following line:\\n\\nSELINUX=enforcing\\n\\nA reboot is required for the changes to take effect.\"]\n[11782,\"Configure the operating system to verify correct operation of all security functions.\\n\\nSet the \\\"SELinuxtype\\\" to the \\\"targeted\\\" policy by modifying the \\\"/etc/selinux/config\\\" file to have the following line:\\n\\nSELINUXTYPE=targeted\\n\\nA reboot is required for the changes to take effect.\"]\n[11783,\"Configure the system to disable the Ctrl-Alt-Delete sequence for the command line with the following command:\\n\\n# systemctl mask ctrl-alt-del.target\"]\n[11784,\"Configure the system to disable the Ctrl-Alt-Delete sequence for the GUI with the following command:\\n\\n# touch /etc/dconf/db/local.d/00-disable-CAD \\n\\nAdd the setting to disable the Ctrl-Alt-Delete sequence for GNOME:\\n\\n[org/gnome/settings-daemon/plugins/media-keys]\\nlogout=''\"]\n[11785,\"Configure the operating system to define default permissions for all authenticated users in such a way that the user can only read and modify their own files.\\n\\nAdd or edit the line for the \\\"UMASK\\\" parameter in \\\"/etc/login.defs\\\" file to \\\"077\\\":\\n\\nUMASK  077\"]\n[11786,\"Upgrade to a supported version of the operating system.\"]\n[11787,\"Install the operating system patches or updated packages available from Red Hat within 30 days or sooner as local policy dictates.\"]\n[11788,\"Configure the system so all accounts on the system are assigned to an active system, application, or user account. \\n\\nRemove accounts that do not support approved system activities or that allow for a normal user to perform administrative-level actions. \\n\\nDocument all authorized accounts on the system.\"]\n[11789,\"Configure the system to define all GIDs found in the \\\"/etc/passwd\\\" file by modifying the \\\"/etc/group\\\" file to add any non-existent group referenced in the \\\"/etc/passwd\\\" file, or change the GIDs referenced in the \\\"/etc/passwd\\\" file to a group that exists in \\\"/etc/group\\\".\"]\n[11790,\"Change the UID of any account on the system, other than root, that has a UID of \\\"0\\\". \\n\\nIf the account is associated with system commands or applications, the UID should be changed to one greater than \\\"0\\\" but less than \\\"1000\\\". Otherwise, assign a UID of greater than \\\"1000\\\" that has not already been assigned.\"]\n[11791,\"Either remove all files and directories from the system that do not have a valid user, or assign a valid user to all unowned files and directories on the system with the \\\"chown\\\" command:\\n\\n# chown <user> <file>\"]\n[11792,\"Either remove all files and directories from the system that do not have a valid group, or assign a valid group to all files and directories on the system with the \\\"chgrp\\\" command:\\n\\n# chgrp <group> <file>\"]\n[11793,\"Assign home directories to all local interactive users that currently do not have a home directory assigned.\"]\n[11794,\"Configure the operating system to assign home directories to all new local interactive users by setting the \\\"CREATE_HOME\\\" parameter in \\\"/etc/login.defs\\\" to \\\"yes\\\" as follows.\\n\\nCREATE_HOME yes\"]\n[11795,\"Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in \\\"/etc/ passwd\\\":\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\", a UID of \\\"smithj\\\", and a Group Identifier (GID) of \\\"users\\\" assigned in \\\"/etc/passwd\\\".\\n\\n# mkdir /home/smithj \\n# chown smithj /home/smithj\\n# chgrp users /home/smithj\\n# chmod 0750 /home/smithj\"]\n[11796,\"Change the mode of interactive user's home directories to \\\"0750\\\". To change the mode of a local interactive user's home directory, use the following command:\\n\\nNote: The example will be for the user \\\"smithj\\\".\\n\\n# chmod 0750 /home/smithj\"]\n[11797,\"Change the owner of a local interactive user's home directories to that owner. To change the owner of a local interactive user's home directory, use the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\".\\n\\n# chown smithj /home/smithj\"]\n[11798,\"Change the group owner of a local interactive user's home directory to the group found in \\\"/etc/passwd\\\". To change the group owner of a local interactive user's home directory, use the following command:\\n\\nNote: The example will be for the user \\\"smithj\\\", who has a home directory of \\\"/home/smithj\\\", and has a primary group of users.\\n\\n# chgrp users /home/smithj\"]\n[11799,\"Change the owner of a local interactive user's files and directories to that owner. To change the owner of a local interactive user's files and directories, use the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\".\\n\\n# chown smithj /home/smithj/<file or directory>\"]\n[11800,\"Change the group of a local interactive user's files and directories to a group that the interactive user is a member of. To change the group owner of a local interactive user's files and directories, use the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\" and is a member of the users group.\\n\\n# chgrp users /home/smithj/<file>\"]\n[11801,\"Set the mode on files and directories in the local interactive user home directory with the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\" and is a member of the users group.\\n\\n# chmod 0750 /home/smithj/<file>\"]\n[11802,\"Set the owner of the local initialization files for interactive users to either the directory owner or root with the following command:\\n\\nNote: The example will be for the smithj user, who has a home directory of \\\"/home/smithj\\\".\\n\\n# chown smithj /home/smithj/.[^.]*\"]\n[11803,\"Change the group owner of a local interactive user's files to the group found in \\\"/etc/passwd\\\" for the user. To change the group owner of a local interactive user's home directory, use the following command:\\n\\nNote: The example will be for the user smithj, who has a home directory of \\\"/home/smithj\\\", and has a primary group of users.\\n\\n# chgrp users /home/smithj/.[^.]*\"]\n[11804,\"Set the mode of the local initialization files to \\\"0740\\\" with the following command:\\n\\nNote: The example will be for the \\\"smithj\\\" user, who has a home directory of \\\"/home/smithj\\\".\\n\\n# chmod 0740 /home/smithj/.[^.]*\"]\n[11805,\"Edit the local interactive user initialization files to change any PATH variable statements that reference directories other than their home directory. \\n\\nIf a local interactive user requires path variables to reference a directory owned by the application, it must be documented with the ISSO.\"]\n[11806,\"Set the mode on files being executed by the local initialization files with the following command:\\n\\n# chmod 0755 <file>\"]\n[11807,\"Run the following command to determine which package owns the device file:\\n\\n# rpm -qf <filename>\\n\\nThe package can be reinstalled from a yum repository using the command:\\n\\n# sudo yum reinstall <packagename>\\n\\nAlternatively, the package can be reinstalled from trusted media using the command:\\n\\n# sudo rpm -Uvh <packagename>\"]\n[11808,\"Configure the \\\"/etc/fstab\\\" to use the \\\"nosuid\\\" option on file systems that contain user home directories.\"]\n[11809,\"Configure the \\\"/etc/fstab\\\" to use the \\\"nosuid\\\" option on file systems that are associated with removable media.\"]\n[11810,\"Configure the \\\"/etc/fstab\\\" to use the \\\"nosuid\\\" option on file systems that are being imported via NFS.\"]\n[11811,\"Configure the \\\"/etc/fstab\\\" to use the \\\"noexec\\\" option on file systems that are being imported via NFS.\"]\n[11812,\"Configure the system so that /dev/shm is mounted with the \\\"nodev\\\" option.\"]\n[11813,\"Configure the system so that /dev/shm is mounted with the \\\"nosuid\\\" option.\"]\n[11814,\"Configure the system so that /dev/shm is mounted with the \\\"noexec\\\" option.\"]\n[11815,\"Change the group of the world-writable directories to root with the following command:\\n\\n# chgrp root <directory>\"]\n[11816,\"Remove the umask statement from all local interactive user's initialization files. \\n\\nIf the account is for an application, the requirement for a umask less restrictive than \\\"077\\\" can be documented with the Information System Security Officer, but the user agreement for access to the account must specify that the local interactive user must log on to their account first and then switch the user to the application account with the correct option to gain the account's environment variables.\"]\n[11817,\"Configure \\\"rsyslog\\\" to log all cron messages by adding or updating the following line to \\\"/etc/rsyslog.conf\\\" or a configuration file in the /etc/rsyslog.d/ directory:\\n\\ncron.* /var/log/cron.log\"]\n[11818,\"Set the owner on the \\\"/etc/cron.allow\\\" file to root with the following command:\\n\\n# chown root /etc/cron.allow\"]\n[11819,\"Set the group owner on the \\\"/etc/cron.allow\\\" file to root with the following command:\\n\\n# chgrp root /etc/cron.allow\"]\n[11820,\"If kernel core dumps are not required, disable the \\\"kdump\\\" service with the following command:\\n\\n# systemctl disable kdump.service\\n\\nIf kernel core dumps are required, document the need with the ISSO.\"]\n[11821,\"Migrate the \\\"/home\\\" directory onto a separate file system/partition.\"]\n[11822,\"Migrate the \\\"/var\\\" path onto a separate file system.\"]\n[11823,\"Migrate the system audit data path onto a separate file system.\"]\n[11824,\"Start the \\\"tmp.mount\\\" service with the following command:\\n\\n# systemctl enable tmp.mount\\n   \\nOR\\n\\nEdit the \\\"/etc/fstab\\\" file and ensure the \\\"/tmp\\\" directory is defined in the fstab with a device and mount point.\"]\n[11825,\"Configure the operating system to implement DoD-approved encryption by installing the dracut-fips package.\\n\\nTo enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel command line during system installation so key generation is done with FIPS-approved algorithms and continuous monitoring tests in place.\\n\\nConfigure the operating system to implement DoD-approved encryption by following the steps below: \\n\\nThe fips=1 kernel option needs to be added to the kernel command line during system installation so that key generation is done with FIPS-approved algorithms and continuous monitoring tests in place. Users should also ensure that the system has plenty of entropy during the installation process by moving the mouse around, or if no mouse is available, ensuring that many keystrokes are typed. The recommended amount of keystrokes is 256 and more. Less than 256 keystrokes may generate a non-unique key.\\n\\nInstall the dracut-fips package with the following command:\\n\\n# yum install dracut-fips\\n\\nRecreate the \\\"initramfs\\\" file with the following command:\\n\\nNote: This command will overwrite the existing \\\"initramfs\\\" file.\\n\\n# dracut -f\\n\\nModify the kernel command line of the current kernel in the \\\"grub.cfg\\\" file by adding the following option to the GRUB_CMDLINE_LINUX key in the \\\"/etc/default/grub\\\" file and then rebuild the \\\"grub.cfg\\\" file:\\n\\nfips=1\\n\\nChanges to \\\"/etc/default/grub\\\" require rebuilding the \\\"grub.cfg\\\" file as follows:\\n\\nOn BIOS-based machines, use the following command:\\n\\n# grub2-mkconfig -o /boot/grub2/grub.cfg\\n\\nOn UEFI-based machines, use the following command:\\n\\n# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg\\n\\nIf /boot or /boot/efi reside on separate partitions, the kernel parameter boot=<partition of /boot or /boot/efi> must be added to the kernel command line. You can identify a partition by running the df /boot or df /boot/efi command:\\n\\n# df /boot\\nFilesystem 1K-blocks Used Available Use% Mounted on\\n/dev/sda1 495844 53780 416464 12% /boot\\n\\nTo ensure the \\\"boot=\\\" configuration option will work even if device naming changes occur between boots, identify the universally unique identifier (UUID) of the partition with the following command:\\n\\n# blkid /dev/sda1\\n/dev/sda1: UUID=\\\"05c000f1-a213-759e-c7a2-f11b7424c797\\\" TYPE=\\\"ext4\\\"\\n\\nFor the example above, append the following string to the kernel command line:\\n\\nboot=UUID=05c000f1-a213-759e-c7a2-f11b7424c797\\n\\nReboot the system for the changes to take effect.\"]\n[11826,\"Configure the file integrity tool to check file and directory ACLs. \\n\\nIf AIDE is installed, ensure the \\\"acl\\\" rule is present on all uncommented file and directory selection lists.\"]\n[11827,\"Configure the file integrity tool to check file and directory extended attributes. \\n\\nIf AIDE is installed, ensure the \\\"xattrs\\\" rule is present on all uncommented file and directory selection lists.\"]\n[11828,\"Configure the file integrity tool to use FIPS 140-2 cryptographic hashes for validating file and directory contents. \\n\\nIf AIDE is installed, ensure the \\\"sha512\\\" rule is present on all uncommented file and directory selection lists.\"]\n[11829,\"Remove alternate methods of booting the system from removable media or document the configuration to boot from removable media with the ISSO.\"]\n[11830,\"Configure the operating system to disable non-essential capabilities by removing the telnet-server package from the system with the following command:\\n\\n# yum remove telnet-server\"]\n[11831,\"Configure the operating system to produce audit records containing information to establish when (date and time) the events occurred.\\n\\nEnable the auditd service with the following command:\\n\\n# systemctl start auditd.service\"]\n[11832,\"Configure the operating system to shut down in the event of an audit processing failure.\\n\\nAdd or correct the option to shut down the operating system with the following command:\\n\\n# auditctl -f 2\\n\\nEdit the \\\"/etc/audit/rules.d/audit.rules\\\" file and add the following line:\\n\\n-f 2\\n\\nIf availability has been determined to be more important, and this decision is documented with the ISSO, configure the operating system to notify system administration staff and ISSO staff in the event of an audit processing failure with the following command:\\n\\n# auditctl -f 1\\n\\nEdit the \\\"/etc/audit/rules.d/audit.rules\\\" file and add the following line:\\n\\n-f 1\\n\\nKernel log monitoring must also be configured to properly alert designated staff.\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11833,\"Edit the /etc/audisp/plugins.d/au-remote.conf file and change the value of \\\"active\\\" to \\\"yes\\\".\\n\\nThe audit daemon must be restarted for changes to take effect:\\n\\n# service auditd restart\"]\n[11834,\"Edit the /etc/audisp/plugins.d/au-remote.conf file and add or update the following values:\\n\\ndirection = out\\npath = /sbin/audisp-remote\\ntype = always\\n\\nThe audit daemon must be restarted for changes to take effect:\\n\\n# service auditd restart\"]\n[11835,\"Edit the /etc/audisp/audispd.conf file and add or update the \\\"overflow_action\\\" option:\\n\\noverflow_action = syslog\\n\\nThe audit daemon must be restarted for changes to take effect:\\n\\n# service auditd restart\"]\n[11836,\"Edit the /etc/audisp/audispd.conf file and add or update the \\\"name_format\\\" option:\\n\\nname_format = hostname\\n\\nThe audit daemon must be restarted for changes to take effect:\\n\\n# service auditd restart\"]\n[11837,\"Configure the operating system to off-load audit records onto a different system or media from the system being audited.\\n\\nSet the remote server option in \\\"/etc/audisp/audisp-remote.conf\\\" with the IP address of the log aggregation server.\"]\n[11838,\"Configure the operating system to encrypt the transfer of off-loaded audit records onto a different system or media from the system being audited.\\n\\nUncomment the \\\"enable_krb5\\\" option in \\\"/etc/audisp/audisp-remote.conf\\\" and set it with the following line:\\n\\nenable_krb5 = yes\"]\n[11839,\"Configure the action the operating system takes if the disk the audit records are written to becomes full.\\n\\nUncomment or edit the \\\"disk_full_action\\\" option in \\\"/etc/audisp/audisp-remote.conf\\\" and set it to \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\", such as the following line:\\n\\ndisk_full_action = single\"]\n[11840,\"Configure the action the operating system takes if there is an error sending audit records to a remote system.\\n\\nUncomment the \\\"network_failure_action\\\" option in \\\"/etc/audisp/audisp-remote.conf\\\" and set it to \\\"syslog\\\", \\\"single\\\", or \\\"halt\\\".\\n\\nnetwork_failure_action = syslog\"]\n[11841,\"Configure the operating system to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\\n\\nCheck the system configuration to determine the partition the audit records are being written to: \\n\\n# grep -iw log_file /etc/audit/auditd.conf\\n\\nDetermine the size of the partition that audit records are written to (with the example being \\\"/var/log/audit/\\\"):\\n\\n# df -h /var/log/audit/\\n\\nSet the value of the \\\"space_left\\\" keyword in \\\"/etc/audit/auditd.conf\\\" to 25 percent of the partition size.\"]\n[11842,\"Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached.\\n\\nUncomment or edit the \\\"space_left_action\\\" keyword in \\\"/etc/audit/auditd.conf\\\" and set it to \\\"email\\\". \\n \\nspace_left_action = email\"]\n[11843,\"Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached.\\n\\nUncomment or edit the \\\"action_mail_acct\\\" keyword in \\\"/etc/audit/auditd.conf\\\" and set it to root and any other accounts associated with security personnel. \\n \\naction_mail_acct = root\"]\n[11844,\"Configure the operating system to audit the execution of privileged functions.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid\\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid\\n-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid\\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11845,\"Add or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11846,\"Add or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11847,\"Add or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11848,\"Add or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11849,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"chmod\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11850,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"fchmod\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11851,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"fchmodat\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11852,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"setxattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11853,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"fsetxattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11854,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"lsetxattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11855,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"removexattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11856,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"fremovexattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11857,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"lremovexattr\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\n-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11858,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"creat\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules:\\n\\n-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11859,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"open\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11860,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"openat\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11861,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"open_by_handle_at\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11862,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"truncate\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11863,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"ftruncate\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access\\n\\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11864,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"semanage\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11865,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"setsebool\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11866,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"chcon\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11867,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"setfiles\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11868,\"Configure the operating system to generate audit records when unsuccessful account access events occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-w /var/run/faillock -p wa -k logins\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11869,\"Configure the operating system to generate audit records when successful account access events occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-w /var/log/lastlog -p wa -k logins\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11870,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"passwd\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11871,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"unix_chkpwd\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11872,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"gpasswd\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11873,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"chage\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11874,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"userhelper\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=4294967295 -k privileged-passwd\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11875,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"su\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change \\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11876,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"sudo\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change \\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11877,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to access the \\\"/etc/sudoers\\\" file and files in the \\\"/etc/sudoers.d/\\\" directory.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/sudoers -p wa -k privileged-actions\\n\\n-w /etc/sudoers.d/ -p wa -k privileged-actions\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11878,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"newgrp\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11879,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"chsh\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11880,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"mount\\\" command and syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n-a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11881,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"umount\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=4294967295 -k privileged-mount\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11882,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"postdrop\\\" command occur.\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=4294967295 -k privileged-postfix\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11883,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"postqueue\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=4294967295 -k privileged-postfix\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11884,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"ssh-keysign\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=4294967295 -k privileged-ssh\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11885,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"crontab\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=4294967295 -k privileged-cron\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11886,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"pam_timestamp_check\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F auid>=1000 -F auid!=4294967295 -k privileged-pam\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11887,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"create_module\\\" syscall occur.\\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S create_module -k module-change\\n\\n-a always,exit -F arch=b64 -S create_module -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11888,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"init_module\\\" syscall occur. \\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S init_module -k module-change\\n\\n-a always,exit -F arch=b64 -S init_module -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11889,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"finit_module\\\" syscall occur. \\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F arch=b32 -S finit_module -k module-change\\n\\n-a always,exit -F arch=b64 -S finit_module -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11890,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"delete_module\\\" syscall occur. \\n\\nAdd or update the following rules in \\\"/etc/audit/rules.d/audit.rules\\\": \\n\\n-a always,exit -F arch=b32 -S delete_module -k module-change\\n\\n-a always,exit -F arch=b64 -S delete_module -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11891,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"kmod\\\" command occur. \\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /usr/bin/kmod -p x -F auid!=4294967295 -k module-change\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11892,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/passwd\\\".\\n\\nAdd or update the following rule \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/passwd -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11893,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/group\\\".\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/group -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11894,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect \\\"/etc/gshadow\\\".\\n\\nAdd or update the following rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/gshadow -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11895,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.\\n\\nAdd or update the following file system rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/shadow -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11896,\"Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.\\n\\nAdd or update the following file system rule in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-w /etc/security/opasswd -p wa -k identity\\n\\nThe audit daemon must be restarted for the changes to take effect:\\n# systemctl restart auditd\"]\n[11897,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"rename\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11898,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"renameat\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11899,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"rmdir\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11900,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"unlink\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11901,\"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \\\"unlinkat\\\" syscall occur.\\n\\nAdd the following rules in \\\"/etc/audit/rules.d/audit.rules\\\":\\n\\n-a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\n-a always,exit -F arch=b64 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete\\n\\nThe audit daemon must be restarted for the changes to take effect.\"]\n[11902,\"Modify the \\\"/etc/rsyslog.conf\\\" or an \\\"/etc/rsyslog.d/*.conf\\\" file to contain a configuration line to send all \\\"rsyslog\\\" output to a log aggregation system:\\n*.* @@<log aggregation system name>\"]\n[11903,\"Modify the \\\"/etc/rsyslog.conf\\\" file to remove the \\\"ModLoad imtcp\\\", \\\"ModLoad imudp\\\", and \\\"ModLoad imrelp\\\" configuration lines, or document the system as being used for log aggregation.\"]\n[11904,\"Configure the operating system to limit the number of concurrent sessions to \\\"10\\\" for all accounts and/or account types.\\n\\nAdd the following line to the top of the /etc/security/limits.conf or in a \\\".conf\\\" file defined in /etc/security/limits.d/ :\\n\\n* hard maxlogins 10\"]\n[11905,\"Update the host's firewall settings and/or running services to comply with the PPSM CLSA for the site or program and the PPSM CAL.\"]\n[11906,\"Configure SSH to use FIPS 140-2 approved cryptographic algorithms.\\n\\nAdd the following line (or modify the line to have the required value) to the \\\"/etc/ssh/sshd_config\\\" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor).\\n\\nCiphers aes128-ctr,aes192-ctr,aes256-ctr\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[11907,\"Configure the operating system to terminate all network connections associated with a communications session at the end of the session or after a period of inactivity.\\n\\nCreate a script to enforce the inactivity timeout (for example /etc/profile.d/tmout.sh) such as:\\n\\n#!/bin/bash\\n\\nTMOUT=600\\nreadonly TMOUT\\nexport TMOUT\"]\n[11908,\"Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via the ssh.\\n\\nEdit the \\\"/etc/ssh/sshd_config\\\" file to uncomment the banner keyword and configure it to point to a file that will contain the logon banner (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). An example configuration line is:\\n\\nbanner /etc/issue\\n\\nEither create the file containing the banner or replace the text in the file with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n \\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[11909,\"Configure the operating system to implement cryptography to protect the integrity of LDAP authentication sessions.\\n\\nAdd or modify the following line in \\\"/etc/sssd/sssd.conf\\\":\\n\\nldap_id_use_start_tls = true\"]\n[11910,\"Configure the operating system to implement cryptography to protect the integrity of LDAP remote access sessions.\\n\\nAdd or modify the following line in \\\"/etc/sssd/sssd.conf\\\":\\n\\nldap_tls_reqcert = demand\"]\n[11911,\"Configure the operating system to implement cryptography to protect the integrity of LDAP remote access sessions.\\n\\nAdd or modify the following line in \\\"/etc/sssd/sssd.conf\\\":\\n\\nldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt\"]\n[11912,\"Configure the operating system implement virtual address space randomization.\\n\\nSet the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a config file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nkernel.randomize_va_space = 2\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[11913,\"Install SSH packages onto the host with the following commands:\\n\\n# yum install openssh-server.x86_64\"]\n[11914,\"Configure the SSH service to automatically start after reboot with the following command:\\n\\n# systemctl enable sshd.service\"]\n[11915,\"Configure the operating system to automatically terminate a user session after inactivity time-outs have expired or at shutdown.\\n\\nAdd the following line (or modify the line to have the required value) to the \\\"/etc/ssh/sshd_config\\\" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nClientAliveInterval 600\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[11916,\"Configure the SSH daemon to not allow authentication using RSA rhosts authentication.\\n\\nAdd the following line in \\\"/etc/ssh/sshd_config\\\", or uncomment the line and set the value to \\\"no\\\":\\n\\nRhostsRSAAuthentication no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[11917,\"Configure the operating system to terminate automatically a user session after inactivity time-outs have expired or at shutdown.\\n\\nAdd the following line (or modify the line to have the required value) to the \\\"/etc/ssh/sshd_config\\\" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nClientAliveCountMax 0\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[11918,\"Configure the SSH daemon to not allow authentication using known hosts authentication.\\n\\nAdd the following line in \\\"/etc/ssh/sshd_config\\\", or uncomment the line and set the value to \\\"yes\\\":\\n\\nIgnoreRhosts yes\"]\n[11919,\"Configure SSH to provide users with feedback on when account accesses last occurred by setting the required configuration options in \\\"/etc/pam.d/sshd\\\" or in the \\\"sshd_config\\\" file used by the system (\\\"/etc/ssh/sshd_config\\\" will be used in the example) (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor).\\n\\nModify the \\\"PrintLastLog\\\" line in \\\"/etc/ssh/sshd_config\\\" to match the following:\\n\\nPrintLastLog yes\\n\\nThe SSH service must be restarted for changes to \\\"sshd_config\\\" to take effect.\"]\n[11920,\"Configure SSH to stop users from logging on remotely as the root user.\\n\\nEdit the appropriate  \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for the \\\"PermitRootLogin\\\" keyword and set its value to \\\"no\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nPermitRootLogin no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[11921,\"Configure the SSH daemon to not allow authentication using known hosts authentication.\\n\\nAdd the following line in \\\"/etc/ssh/sshd_config\\\", or uncomment the line and set the value to \\\"yes\\\":\\n\\nIgnoreUserKnownHosts yes\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[11922,\"Remove all Protocol lines that reference version \\\"1\\\" in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). The \\\"Protocol\\\" line must be as follows:\\n\\nProtocol 2\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[11923,\"Edit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for the \\\"MACs\\\" keyword and set its value to \\\"hmac-sha2-256\\\" and/or \\\"hmac-sha2-512\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nMACs hmac-sha2-256,hmac-sha2-512\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[11924,\"Note: SSH public key files may be found in other directories on the system depending on the installation. \\n\\nChange the mode of public host key files under \\\"/etc/ssh\\\" to \\\"0644\\\" with the following command:\\n\\n# chmod 0644 /etc/ssh/*.key.pub\"]\n[11925,\"Configure the mode of SSH private host key files under \\\"/etc/ssh\\\" to \\\"0640\\\" with the following command:\\n\\n# chmod 0640 /path/to/file/ssh_host*key\"]\n[11926,\"Uncomment the \\\"GSSAPIAuthentication\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \\\"no\\\": \\n\\nGSSAPIAuthentication no\\n\\nThe SSH service must be restarted for changes to take effect.\\n\\nIf GSSAPI authentication is required, it must be documented, to include the location of the configuration file, with the ISSO.\"]\n[11927,\"Uncomment the \\\"KerberosAuthentication\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \\\"no\\\":\\n\\nKerberosAuthentication no\\n\\nThe SSH service must be restarted for changes to take effect.\\n\\nIf Kerberos authentication is required, it must be documented, to include the location of the configuration file, with the ISSO.\"]\n[11928,\"Uncomment the \\\"StrictModes\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \\\"yes\\\":\\n\\nStrictModes yes\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[11929,\"Uncomment the \\\"UsePrivilegeSeparation\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \\\"sandbox\\\" or \\\"yes\\\":\\n\\nUsePrivilegeSeparation sandbox\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[11930,\"Uncomment the \\\"Compression\\\" keyword in \\\"/etc/ssh/sshd_config\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) on the system and set the value to \\\"delayed\\\" or \\\"no\\\":\\n\\nCompression no\\n\\nThe SSH service must be restarted for changes to take effect.\"]\n[11931,\"Edit the \\\"/etc/ntp.conf\\\" or \\\"/etc/chrony.conf\\\" file and add or update an entry to define \\\"maxpoll\\\" to \\\"10\\\" as follows:\\n\\nserver 0.rhel.pool.ntp.org iburst maxpoll 10\\n\\nIf NTP was running and \\\"maxpoll\\\" was updated, the NTP service must be restarted:\\n\\n# systemctl restart ntpd\\n\\nIf NTP was not running, it must be started:\\n\\n# systemctl start ntpd \\n\\nIf \\\"chronyd\\\" was running and \\\"maxpoll\\\" was updated, the service must be restarted:\\n\\n# systemctl restart chronyd.service\\n\\nIf \\\"chronyd\\\" was not running, it must be started:\\n\\n# systemctl start chronyd.service\"]\n[11932,\"Ensure the operating system's application firewall is enabled.\\n\\nInstall the \\\"firewalld\\\" package, if it is not on the system, with the following command:\\n\\n# yum install firewalld\\n\\nStart the firewall via \\\"systemctl\\\" with the following command:\\n\\n# systemctl start firewalld\"]\n[11933,\"Configure the operating system to provide users with feedback on when account accesses last occurred by setting the required configuration options in \\\"/etc/pam.d/postlogin\\\". \\n\\nAdd the following line to the top of \\\"/etc/pam.d/postlogin\\\":\\n\\nsession required pam_lastlog.so showfailed\"]\n[11934,\"Remove any found \\\".shosts\\\" files from the system.\\n\\n# rm /[path]/[to]/[file]/.shosts\"]\n[11935,\"Remove any found \\\"shosts.equiv\\\" files from the system.\\n\\n# rm /[path]/[to]/[file]/shosts.equiv\"]\n[11936,\"Configure the operating system to use two or more name servers for DNS resolution.\\n\\nEdit the \\\"/etc/resolv.conf\\\" file to uncomment or add the two or more \\\"nameserver\\\" option lines with the IP address of local authoritative name servers. If local host resolution is being performed, the \\\"/etc/resolv.conf\\\" file must be empty. An empty \\\"/etc/resolv.conf\\\" file can be created as follows:\\n\\n# echo -n > /etc/resolv.conf\\n\\nAnd then make the file immutable with the following command:\\n\\n# chattr +i /etc/resolv.conf\\n\\nIf the \\\"/etc/resolv.conf\\\" file must be mutable, the required configuration must be documented with the Information System Security Officer (ISSO) and the file must be verified by the system file integrity tool.\"]\n[11937,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.all.accept_source_route = 0   \\n\\nIssue the following command to make the changes take effect:\\n \\n# sysctl -system\"]\n[11938,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.all.rp_filter = 1 \\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[11939,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.default.rp_filter = 1 \\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[11940,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.default.accept_source_route = 0   \\n\\nIssue the following command to make the changes take effect:\\n \\n# sysctl --system\"]\n[11941,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.icmp_echo_ignore_broadcasts = 1\\n\\nIssue the following command to make the changes take effect: \\n\\n# sysctl --system\"]\n[11942,\"Set the system to not accept IPv4 ICMP redirect messages by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.default.accept_redirects = 0   \\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[11943,\"Set the system to ignore IPv4 ICMP redirect messages by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.all.accept_redirects = 0   \\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[11944,\"Configure the system to not allow interfaces to perform IPv4 ICMP redirects by default. \\n\\nSet the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.default.send_redirects = 0\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[11945,\"Configure the system to not allow interfaces to perform IPv4 ICMP redirects. \\n\\nSet the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.conf.all.send_redirects = 0\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[11946,\"Configure network interfaces to turn off promiscuous mode unless approved by the ISSO and documented.\\n\\nSet the promiscuous mode of an interface to off with the following command:\\n\\n#ip link set dev <devicename> multicast off promisc off\"]\n[11947,\"If \\\"postfix\\\" is installed, modify the \\\"/etc/postfix/main.cf\\\" file to restrict client connections to the local network with the following command:\\n\\n# postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'\"]\n[11948,\"Document the \\\"vsftpd\\\" package with the ISSO as an operational requirement or remove it from the system with the following command:\\n\\n# yum remove vsftpd\"]\n[11949,\"Remove the TFTP package from the system with the following command:\\n\\n# yum remove tftp-server\"]\n[11950,\"Configure SSH to encrypt connections for interactive users.\\n\\nEdit the \\\"/etc/ssh/sshd_config\\\" file to uncomment or add the line for the \\\"X11Forwarding\\\" keyword and set its value to \\\"yes\\\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\\n\\nX11Forwarding yes\\n\\nThe SSH service must be restarted for changes to take effect:\\n\\n# systemctl restart sshd\"]\n[11951,\"Configure the TFTP daemon to operate in secure mode by adding the following line to \\\"/etc/xinetd.d/tftp\\\" (or modify the line to have the required value):\\n\\nserver_args = -s /var/lib/tftpboot\"]\n[11952,\"Document the requirement for an X Windows server with the ISSO or remove the related packages with the following commands:\\n\\n# rpm -e xorg-x11-server-common\"]\n[11953,\"Set the system to the required kernel parameter by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv4.ip_forward = 0\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[11954,\"Update the \\\"/etc/fstab\\\" file so the option \\\"sec\\\" is defined for each NFS mounted file system and the \\\"sec\\\" option does not have the \\\"sys\\\" setting. \\n\\nEnsure the \\\"sec\\\" option is defined as \\\"krb5:krb5i:krb5p\\\".\"]\n[11955,\"If the \\\"/etc/snmp/snmpd.conf\\\" file exists, modify any lines that contain a community string value of \\\"public\\\" or \\\"private\\\" to another string value.\"]\n[11956,\"If \\\"firewalld\\\" is installed and active on the system, configure rules for allowing specific services and hosts. \\n\\nIf \\\"firewalld\\\" is not \\\"active\\\", enable \\\"tcpwrappers\\\" by configuring \\\"/etc/hosts.allow\\\" and \\\"/etc/hosts.deny\\\" to allow or deny access to specific hosts.\"]\n[11957,\"Remove all unapproved tunnels from the system, or document them with the ISSO.\"]\n[11958,\"Set the system to the required kernel parameter, if IPv6 is enabled, by adding the following line to \\\"/etc/sysctl.conf\\\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\\n\\nnet.ipv6.conf.all.accept_source_route = 0\\n\\nIssue the following command to make the changes take effect:\\n\\n# sysctl --system\"]\n[11959,\"Configure the operating system to implement multifactor authentication by installing the required packages.\\n\\nInstall the \\\"esc\\\" and \\\"pam_pkcs11\\\" packages on the system with the following command:\\n\\n# yum install esc pam_pkcs11\"]\n[11960,\"Configure the operating system to implement multifactor authentication for remote access to privileged accounts via pluggable authentication modules (PAM).\\n\\nModify all of the services lines in \\\"/etc/sssd/sssd.conf\\\" or in configuration files found under \\\"/etc/sssd/conf.d\\\" to include pam.\"]\n[11961,\"Configure the operating system to do certificate status checking for PKI authentication.\\n\\nModify all of the \\\"cert_policy\\\" lines in \\\"/etc/pam_pkcs11/pam_pkcs11.conf\\\" to include \\\"ocsp_on\\\".\"]\n[11962,\"Configure the system to disable all wireless network interfaces with the following command:\\n\\n#nmcli radio wifi off\"]\n[11963,\"Run the following command to determine which package owns the file:\\n\\n# rpm -qf <filename>\\n\\nThe package can be reinstalled from a yum repository using the command:\\n\\n# sudo yum reinstall <packagename>\\n\\nAlternatively, the package can be reinstalled from trusted media using the command:\\n\\n# sudo rpm -Uvh <packagename>\"]\n[11964,\"Install and enable the latest McAfee HIPS package, available from USCYBERCOM.\\n\\nNote: If the system does not support the McAfee HIPS package, install and enable a supported intrusion detection system application and document its use with the Authorizing Official.\"]\n[11965,\"Install an antivirus solution on the system.\"]\n[11966,\"Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces.\\n\\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \\n\\nNote: The example below is using the database \\\"local\\\" for the system, so if the system is using another database in \\\"/etc/dconf/profile/user\\\", the file should be created under the appropriate subdirectory.\\n\\n# touch /etc/dconf/db/local.d/locks/session\\n\\nAdd the setting to lock the screensaver lock-enabled setting:\\n\\n/org/gnome/desktop/screensaver/lock-enabled\"]\n[12048,\"Configure the Remote Access VPN Gateway and/or client to retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.\"]\n[12049,\"Configure the publicly accessible VPN Gateway to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\"]\n[12050,\"Configure the VPN Gateway to notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access).\"]\n[12051,\"Configure the VPN Gateway to limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number, as documented in the SSP.\"]\n[12052,\"Configure the TLS VPN Gateway to use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data for transmission.\"]\n[12053,\"Configure the remote access VPN Gateway to use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.\"]\n[12054,\"Configure the VPN Gateway to use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.\"]\n[12055,\"Configure the IPsec VPN to us the FIPS 140-2 DH group. The following command is an example of how to configure the IKE (phase 1) proposals. \\n\\nThe following groups are allowed for use in DoD: \\nDH Groups 14 (2048-bit MODP) \\n- 19 (256-bit Random ECP), 20 (384-bit Random ECP), 5 (1536-bit MODP), 24 (2048-bit MODP with 256-bit POS).\"]\n[12056,\"Configure the VPN Gateway to generate log records containing information to establish what type of events occurred.\"]\n[12057,\"Configure the VPN Gateway to generate log records containing information to establish when (date and time) the events occurred.\"]\n[12058,\"Configure the VPN Gateway to generate log records containing information that establishes the identity of any individual or process associated with the event.\"]\n[12059,\"Configure the VPN Gateway to generates log records containing information to establish where the events occurred.\"]\n[12060,\"Configure the VPN Gateway to generate log records containing information to establish the source of the events.\"]\n[12061,\"Configure the VPN Gateway to generate log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the client connection attempts.\"]\n[12062,\"Configure the VPN Gateway to protect log information from unauthorized read access if all or some of this data is stored locally.\"]\n[12063,\"Configure the VPN Gateway log to protect audit information from unauthorized modification when stored locally. The method used depends on system architecture and design. Examples: ensuring log files receive the proper file system permissions and limiting log data locations.\"]\n[12064,\"Configure the VPN Gateway to protect audit information from unauthorized deletion when stored locally. Ensure log files receive the proper file system permissions and limiting log data locations.\"]\n[12065,\"Ensure functions, ports, protocols, and services identified on the PPSM CAL are not used for system services configuration.\\n\\nView the configured security  services.\\n\\nCompare the services that are enabled, including the port, services, protocols, and functions.\\n\\nConsult the product knowledge base and configuration guides to determine the commands for disabling each port, protocols, services, or functions that is not in compliance with the PPSM CAL and vulnerability assessments.\"]\n[12066,\"Configure the IPsec VPN Gateway to use IKEv2 for IPsec VPN security associations.\"]\n[12067,\"Configure the VPN Gateway to prohibit PPTP and L2F.\"]\n[12068,\"If L2TP is used for encapsulation, configure the VPN Gateway or other network element to block or deny this communications protocol unencrypted L2TP packets across the security boundary and into the private network of the enclave.\"]\n[12069,\"Configure the VPN Gateway to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).\"]\n[12070,\"Configure the VPN Gateway to use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.\"]\n[12071,\"Configure the VPN Client to implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.\"]\n[12072,\"Configure the TLS VPN Gateway to use replay-resistant authentication mechanisms for network access to non-privileged accounts.\"]\n[12073,\"Configure the IPsec VPN Gateway to use anti-replay mechanisms for security associations.\"]\n[12074,\"Configure the VPN Gateway to uniquely identify all network-connected endpoint devices before establishing a connection.\"]\n[12075,\"Configure the  VPN Gateway to use PKI-based authentication that validates certificates by constructing a certification path (which includes status information) to an accepted trust anchor.\"]\n[12076,\"Configure the site-to-site VPN that uses certificate-based device authentication to use a FIPS-compliant key management process.\"]\n[12077,\"Configure the Remote Access VPN Gateway to use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.\"]\n[12078,\"Configure the VPN Gateway to map the authenticated identity to the user account for PKI-based authentication.\"]\n[12079,\"Configure the VPN Gateway to use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).\"]\n[12080,\"Configure the VPN Gateway to uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).\"]\n[12081,\"Configure the VPN Gateway to route sessions to an IDPS for inspection.\"]\n[12082,\"Configure the VPN Gateway to terminate all network connections associated with a communications session at the end of the session.\"]\n[12083,\"Configure the VPN Gateway to use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.\"]\n[12084,\"Configure the IPsec VPN Gateway to use IKE with SHA1 or greater to protect the authenticity of communications sessions.\"]\n[12085,\"Configure the VPN Gateway to invalidate session identifiers upon user logoff or other session termination.\"]\n[12086,\"Configure the VPN Gateway to recognize only system-generated session identifiers.\"]\n[12087,\"Configure the VPN Gateway to generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.\"]\n[12088,\"Configure the VPN Gateway to fail to a secure state if system initialization fails, shutdown fails, or aborts fail.\"]\n[12089,\"Configure the VPN Gateway to be configured to perform an organization-defined action if the audit reveals unauthorized activity.\"]\n[12090,\"Configure the VPN Gateway for functionality, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack. \\n\\nConfigure authorized system administrator accounts to allow them to disconnect or disable remote access to remove user under circumstances defined in the VPN SSP.\"]\n[12091,\"Configure the IPsec Gateway to use AES with IKE. The option on the IKE Phase 1 proposal may also be configured to use the  aes-128-cbc, aes-192-cbc, or aes-256-cbc algorithms.\"]\n[12092,\"Configure the VPN Gateway to transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.\"]\n[12093,\"Configure the VPN Gateway to notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).\"]\n[12094,\"Configure the VPN Gateway to provide centralized management and configuration of the content to be captured in log records generated by all network components.\"]\n[12095,\"Configure the VPN Gateway to off-load audit records onto a different system or media than the system being audited.\"]\n[12096,\"Configure the VPN Gateway to generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.\"]\n[12097,\"Configure the VPN Gateway to continue to queue traffic log records locally when communications with the Central Log Server is lost.\"]\n[12098,\"Configure the IPsec VPN Gateway to renegotiate the security association after 8 hours or less, or an organization-defined period.\"]\n[12099,\"Configure the VPN Gateway to renegotiate the security association after 24 hours or less or as defined by the organization.\"]\n[12100,\"Configure the VPN Gateway to accept Personal Identity Verification (PIV) credentials.\"]\n[12101,\"Configure the VPN Gateway to electronically verify Personal Identity Verification (PIV) credentials.\"]\n[12102,\"Configure the VPN Gateway to authenticate all network-connected endpoint devices before establishing a connection.\"]\n[12103,\"Configure the VPN Gateway to use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.\"]\n[12104,\"Configure the VPN Gateway to disable split-tunneling for remote clients VPNs.\"]\n[12105,\"Configure the IPsec VPN Gateway to specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.\"]\n[12106,\"Configure the VPN Gateway and the remote access client to protect the confidentiality and integrity of transmitted information.\"]\n[12107,\"Configure the IPsec VPN Gateway to use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.\"]\n[12108,\"For accounts using password authentication, configure the VPN Gateway to use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.\"]\n[12109,\"Configure the VPN Gateway to generate log records when successful and/or unsuccessful VPN connection attempts occur.\"]\n[12110,\"Configure the VPN Gateway to use a FIPS-validated cryptographic module to generate cryptographic hashes.\"]\n[12111,\"Configure the VPN Gateway to use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.\"]\n[12112,\"Configure the IPsec VPN Gateway IKE to use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.\"]\n[12113,\"Configure the IPsec VPN Gateway to use IKE and IPsec VPN SAs.\"]\n[12114,\"Configure the VPN Gateway to not accept certificates that have been revoked when using PKI for authentication.\"]\n[12115,\"Configure the VPN Client logout log out function must be configured to terminate the session on/with the VPN Gateway.\"]\n[12116,\"Configure the VPN Client to display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.\"]\n[12117,\"Configure the VPN Gateway to store only cryptographic representations of the PSK.\"]\n[12118,\"Configure the IPsec Gateway to use AES for the IPsec proposal. The following example commands configure the IPsec (phase 2) proposals. The option may also be configured to use the aes-128-cbc, aes-192-cbc, or aes-256-cbc algorithms.\"]\n[12119,\"Configure the TLS VPN Gateway that supports Government-only services to prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.\"]\n[12120,\"Configure the TLS VPN Gateway that supports citizen- or business-facing network devices to prohibit client negotiation to SSL 2.0 or SSL 3.0.\"]\n[12121,\"The VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.\"]\n[12122,\"Configure the VPN Gateway to use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.\"]\n[12123,\"Configure the IPsec VPN Gateway Internet Key Exchange (IKE) to use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.\"]\n[12124,\"Configure the VPN Gateway to validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.\"]\n[12125,\"Configure the VPN Gateway to use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).\"]\n[12126,\"If the site-to-site VPN implementation uses L2TPv3, configure L2TPv3 sessions to authenticate the traffic before transit.\"]\n{\"table\":\"rev_group_rule_cci_map\",\"columns\":\"`cci`,`rgrccId`,`rgrId`\",\"rowCount\":929}\n[\"001414\",70352,37992]\n[\"000048\",70353,37993]\n[\"000050\",70354,37994]\n[\"001384\",70355,37995]\n[\"001385\",70356,37995]\n[\"001386\",70357,37995]\n[\"001387\",70358,37995]\n[\"001388\",70359,37995]\n[\"000053\",70360,37996]\n[\"000054\",70361,37997]\n[\"000068\",70362,37998]\n[\"001453\",70363,37999]\n[\"001453\",70364,38000]\n[\"000068\",70365,38001]\n[\"000130\",70366,38002]\n[\"000131\",70367,38003]\n[\"001487\",70368,38004]\n[\"000132\",70369,38005]\n[\"000133\",70370,38006]\n[\"000134\",70371,38007]\n[\"000162\",70372,38008]\n[\"000163\",70373,38009]\n[\"000164\",70374,38010]\n[\"000382\",70375,38011]\n[\"000382\",70376,38012]\n[\"000382\",70377,38013]\n[\"000382\",70378,38014]\n[\"000764\",70379,38015]\n[\"000766\",70380,38016]\n[\"001939\",70381,38017]\n[\"001942\",70382,38018]\n[\"001942\",70383,38019]\n[\"000778\",70384,38020]\n[\"000185\",70385,38021]\n[\"000186\",70386,38022]\n[\"000187\",70387,38023]\n[\"000187\",70388,38024]\n[\"000803\",70389,38025]\n[\"000804\",70390,38026]\n[\"001097\",70391,38027]\n[\"001133\",70392,38028]\n[\"001184\",70393,38029]\n[\"001184\",70394,38030]\n[\"001185\",70395,38031]\n[\"001664\",70396,38032]\n[\"001188\",70397,38033]\n[\"001190\",70398,38034]\n[\"002314\",70399,38035]\n[\"002322\",70400,38036]\n[\"000068\",70401,38037]\n[\"002353\",70402,38038]\n[\"002250\",70403,38039]\n[\"001844\",70404,38040]\n[\"001851\",70405,38041]\n[\"001858\",70406,38042]\n[\"001861\",70407,38043]\n[\"002038\",70408,38044]\n[\"002038\",70409,38045]\n[\"001953\",70410,38046]\n[\"001954\",70411,38047]\n[\"001958\",70412,38048]\n[\"002450\",70413,38049]\n[\"002397\",70414,38050]\n[\"002418\",70415,38051]\n[\"002418\",70416,38052]\n[\"002423\",70417,38053]\n[\"000197\",70418,38054]\n[\"000172\",70419,38055]\n[\"002450\",70420,38056]\n[\"002450\",70421,38057]\n[\"002450\",70422,38058]\n[\"000366\",70423,38059]\n[\"000366\",70424,38060]\n[\"002363\",70425,38061]\n[\"002364\",70426,38062]\n[\"000196\",70427,38063]\n[\"000068\",70428,38064]\n[\"001453\",70429,38065]\n[\"001453\",70430,38066]\n[\"001967\",70431,38067]\n[\"002450\",70432,38068]\n[\"002450\",70433,38069]\n[\"000185\",70434,38070]\n[\"000803\",70435,38071]\n[\"000068\",70436,38072]\n[\"000366\",76269,41183]\n[\"001812\",76270,41184]\n[\"000366\",76271,41185]\n[\"001812\",76272,41186]\n[\"000366\",76273,41187]\n[\"000366\",76274,41188]\n[\"000877\",76275,41189]\n[\"001199\",76276,41190]\n[\"002475\",76277,41190]\n[\"002476\",76278,41190]\n[\"002890\",76279,41191]\n[\"003123\",76280,41191]\n[\"000877\",76281,41192]\n[\"001233\",76282,41193]\n[\"001774\",76283,41194]\n[\"000877\",76284,41195]\n[\"000366\",76285,41196]\n[\"000366\",76286,41197]\n[\"000213\",76287,41198]\n[\"000366\",76288,41199]\n[\"001090\",76289,41200]\n[\"000795\",76290,41201]\n[\"002235\",76291,41202]\n[\"000366\",76292,41203]\n[\"000381\",76293,41204]\n[\"000366\",76294,41205]\n[\"002890\",76295,41206]\n[\"003123\",76296,41206]\n[\"000199\",76297,41207]\n[\"002165\",76298,41208]\n[\"002038\",76299,41209]\n[\"000381\",76300,41210]\n[\"000382\",76301,41211]\n[\"000381\",76302,41212]\n[\"000382\",76303,41213]\n[\"000382\",76304,41214]\n[\"000366\",76305,41215]\n[\"000366\",76306,41216]\n[\"000366\",76307,41217]\n[\"002238\",76308,41218]\n[\"000044\",76309,41219]\n[\"000044\",76310,41220]\n[\"002238\",76311,41220]\n[\"000200\",76312,41221]\n[\"000199\",76313,41222]\n[\"000198\",76314,41223]\n[\"000205\",76315,41224]\n[\"000192\",76316,41225]\n[\"000193\",76317,41225]\n[\"000194\",76318,41225]\n[\"001619\",76319,41225]\n[\"000196\",76320,41226]\n[\"000172\",76321,41227]\n[\"000172\",76322,41228]\n[\"000018\",76323,41229]\n[\"000172\",76324,41229]\n[\"001403\",76325,41229]\n[\"001404\",76326,41229]\n[\"001405\",76327,41229]\n[\"002130\",76328,41229]\n[\"002234\",76329,41229]\n[\"000018\",76330,41230]\n[\"000172\",76331,41230]\n[\"001403\",76332,41230]\n[\"001404\",76333,41230]\n[\"001405\",76334,41230]\n[\"002130\",76335,41230]\n[\"002234\",76336,41230]\n[\"000018\",76337,41231]\n[\"000172\",76338,41231]\n[\"001403\",76339,41231]\n[\"001404\",76340,41231]\n[\"001405\",76341,41231]\n[\"002130\",76342,41231]\n[\"002234\",76343,41231]\n[\"000172\",76344,41232]\n[\"000172\",76345,41233]\n[\"000172\",76346,41234]\n[\"000067\",76347,41235]\n[\"000172\",76348,41235]\n[\"000067\",76349,41236]\n[\"000172\",76350,41236]\n[\"000067\",76351,41237]\n[\"000172\",76352,41237]\n[\"000172\",76353,41238]\n[\"000172\",76354,41239]\n[\"000172\",76355,41240]\n[\"000172\",76356,41241]\n[\"000172\",76357,41242]\n[\"002234\",76358,41242]\n[\"000172\",76359,41243]\n[\"002234\",76360,41243]\n[\"000172\",76361,41244]\n[\"002234\",76362,41244]\n[\"000172\",76363,41245]\n[\"000172\",76364,41246]\n[\"000172\",76365,41247]\n[\"000172\",76366,41248]\n[\"002234\",76367,41248]\n[\"000172\",76368,41249]\n[\"002234\",76369,41249]\n[\"000172\",76370,41250]\n[\"002234\",76371,41250]\n[\"000172\",76372,41251]\n[\"002234\",76373,41251]\n[\"001849\",76374,41252]\n[\"001849\",76375,41253]\n[\"001849\",76376,41254]\n[\"000162\",76377,41255]\n[\"000163\",76378,41255]\n[\"000164\",76379,41255]\n[\"000162\",76380,41256]\n[\"000163\",76381,41256]\n[\"000164\",76382,41256]\n[\"000162\",76383,41257]\n[\"000163\",76384,41257]\n[\"000164\",76385,41257]\n[\"000381\",76386,41258]\n[\"000381\",76387,41259]\n[\"000366\",76388,41260]\n[\"000366\",76389,41261]\n[\"000366\",76390,41262]\n[\"002385\",76391,41263]\n[\"000366\",76392,41264]\n[\"000366\",76393,41265]\n[\"000185\",76394,41266]\n[\"002470\",76395,41266]\n[\"000366\",76396,41267]\n[\"000185\",76397,41268]\n[\"000366\",76398,41269]\n[\"000185\",76399,41270]\n[\"002470\",76400,41270]\n[\"000185\",76401,41271]\n[\"002470\",76402,41271]\n[\"000366\",76403,41272]\n[\"002235\",76404,41273]\n[\"000366\",76405,41274]\n[\"001084\",76406,41275]\n[\"000366\",76407,41276]\n[\"000764\",76408,41277]\n[\"000366\",76409,41278]\n[\"000366\",76410,41279]\n[\"000804\",76411,41280]\n[\"000381\",76412,41281]\n[\"000366\",76413,41282]\n[\"000366\",76414,41283]\n[\"000381\",76415,41284]\n[\"000381\",76416,41285]\n[\"000366\",76417,41286]\n[\"000366\",76418,41287]\n[\"000381\",76419,41288]\n[\"000381\",76420,41289]\n[\"000169\",76421,41290]\n[\"002418\",76422,41291]\n[\"002421\",76423,41291]\n[\"002418\",76424,41292]\n[\"002421\",76425,41292]\n[\"002038\",76426,41293]\n[\"002418\",76427,41294]\n[\"002421\",76428,41294]\n[\"002038\",76429,41295]\n[\"001090\",76430,41296]\n[\"000366\",76431,41297]\n[\"001967\",76432,41298]\n[\"000366\",76433,41299]\n[\"000366\",76434,41300]\n[\"000381\",76435,41301]\n[\"002418\",76436,41302]\n[\"002421\",76437,41302]\n[\"001764\",76438,41303]\n[\"000057\",76439,41304]\n[\"001764\",76440,41305]\n[\"001764\",76441,41306]\n[\"000048\",76442,41307]\n[\"000050\",76443,41307]\n[\"001384\",76444,41307]\n[\"001385\",76445,41307]\n[\"001386\",76446,41307]\n[\"001387\",76447,41307]\n[\"001388\",76448,41307]\n[\"000366\",76449,41308]\n[\"001084\",76450,41309]\n[\"000048\",76451,41310]\n[\"001384\",76452,41310]\n[\"001385\",76453,41310]\n[\"001386\",76454,41310]\n[\"001387\",76455,41310]\n[\"001388\",76456,41310]\n[\"000366\",76457,41311]\n[\"000381\",76458,41312]\n[\"000366\",76459,41313]\n[\"002824\",76460,41314]\n[\"002385\",76461,41315]\n[\"000366\",76462,41316]\n[\"000366\",76463,41317]\n[\"000366\",76464,41318]\n[\"000366\",76465,41319]\n[\"002418\",76466,41320]\n[\"002421\",76467,41320]\n[\"000366\",76468,41321]\n[\"000197\",76469,41322]\n[\"000366\",76470,41323]\n[\"000366\",76471,41324]\n[\"002418\",76472,41325]\n[\"002421\",76473,41325]\n[\"000366\",76474,41326]\n[\"002038\",76475,41327]\n[\"001090\",76476,41328]\n[\"002038\",76477,41329]\n[\"001453\",76478,41330]\n[\"000366\",76479,41331]\n[\"000068\",76480,41332]\n[\"002890\",76481,41332]\n[\"000366\",76482,41333]\n[\"000366\",76483,41334]\n[\"000381\",76484,41335]\n[\"001090\",76485,41336]\n[\"000381\",76486,41337]\n[\"000366\",76487,41338]\n[\"001090\",76488,41339]\n[\"000366\",76489,41340]\n[\"000366\",76490,41341]\n[\"000803\",76491,41342]\n[\"000196\",76492,41343]\n[\"000366\",76493,41344]\n[\"000366\",76494,41345]\n[\"000366\",76495,41346]\n[\"000366\",76496,41347]\n[\"002450\",76497,41348]\n[\"000366\",76498,41349]\n[\"002038\",76499,41350]\n[\"001084\",76500,41351]\n[\"002038\",76501,41352]\n[\"001084\",76502,41353]\n[\"001084\",76503,41354]\n[\"002038\",76504,41355]\n[\"001084\",76505,41356]\n[\"000381\",76506,41357]\n[\"000366\",76507,41358]\n[\"002235\",76508,41359]\n[\"000213\",76509,41360]\n[\"002235\",76510,41361]\n[\"000213\",76511,41362]\n[\"002235\",76512,41363]\n[\"002235\",76513,41364]\n[\"002235\",76514,41365]\n[\"002235\",76515,41366]\n[\"002235\",76516,41367]\n[\"002235\",76517,41368]\n[\"002235\",76518,41369]\n[\"002235\",76519,41370]\n[\"000213\",76520,41371]\n[\"000213\",76521,41372]\n[\"000213\",76522,41373]\n[\"000213\",76523,41374]\n[\"000213\",76524,41375]\n[\"002314\",76525,41375]\n[\"002235\",76526,41376]\n[\"002235\",76527,41377]\n[\"002235\",76528,41378]\n[\"002235\",76529,41379]\n[\"002235\",76530,41380]\n[\"000162\",76531,41381]\n[\"000163\",76532,41381]\n[\"000164\",76533,41381]\n[\"000171\",76534,41381]\n[\"001914\",76535,41381]\n[\"002235\",76536,41382]\n[\"002235\",76537,41383]\n[\"002235\",76538,41384]\n[\"002235\",76539,41385]\n[\"002235\",76540,41386]\n[\"000366\",76541,41387]\n[\"000135\",76542,41388]\n[\"000135\",76543,41389]\n[\"002824\",76544,41390]\n[\"002824\",76545,41391]\n[\"000381\",76546,41392]\n[\"000381\",76547,41393]\n[\"000172\",76548,41394]\n[\"000172\",76549,41395]\n[\"000381\",76550,41396]\n[\"000381\",76551,41397]\n[\"002235\",76552,41398]\n[\"000381\",76553,41399]\n[\"000381\",76554,41400]\n[\"000381\",76555,41401]\n[\"000381\",76556,41402]\n[\"000366\",76557,41403]\n[\"000172\",76558,41404]\n[\"000172\",76559,41405]\n[\"000803\",76560,41406]\n[\"000381\",76561,41407]\n[\"000366\",76562,41408]\n[\"000381\",76563,41409]\n[\"000172\",76564,41410]\n[\"000381\",76565,41411]\n[\"000381\",76566,41412]\n[\"000172\",76567,41413]\n[\"000366\",76568,41414]\n[\"000366\",76569,41415]\n[\"000366\",76570,41416]\n[\"000366\",76571,41417]\n[\"002824\",76572,41418]\n[\"000366\",76573,41419]\n[\"000366\",76574,41420]\n[\"000366\",76575,41421]\n[\"000366\",76576,41422]\n[\"000366\",76577,41423]\n[\"000366\",76578,41424]\n[\"000366\",76579,41425]\n[\"000366\",76580,41426]\n[\"000366\",76581,41427]\n[\"000366\",76582,41428]\n[\"000366\",76583,41429]\n[\"000366\",76584,41430]\n[\"000366\",76585,41431]\n[\"000366\",76586,41432]\n[\"000366\",76587,41433]\n[\"000366\",76588,41434]\n[\"000366\",76589,41435]\n[\"000366\",76590,41436]\n[\"000366\",76591,41437]\n[\"000366\",76592,41438]\n[\"000366\",76593,41439]\n[\"000366\",76594,41440]\n[\"000366\",76595,41441]\n[\"000366\",76596,41442]\n[\"000366\",76597,41443]\n[\"000366\",76598,41444]\n[\"000366\",76599,41445]\n[\"000366\",76600,41446]\n[\"000381\",76601,41447]\n[\"000366\",76602,41448]\n[\"000366\",76603,41449]\n[\"000366\",76604,41450]\n[\"000056\",76605,41451]\n[\"001199\",76606,41452]\n[\"002475\",76607,41452]\n[\"002476\",76608,41452]\n[\"001199\",76609,41453]\n[\"002475\",76610,41453]\n[\"002476\",76611,41453]\n[\"000130\",76612,41454]\n[\"000130\",76613,41455]\n[\"000130\",76614,41456]\n[\"000130\",76615,41457]\n[\"000130\",76616,41458]\n[\"000130\",76617,41459]\n[\"000130\",76618,41460]\n[\"000199\",76619,41461]\n[\"001090\",76620,41462]\n[\"000381\",76621,41463]\n[\"000381\",76622,41464]\n[\"000381\",76623,41465]\n[\"000381\",76624,41466]\n[\"001199\",76625,41467]\n[\"000366\",76626,41468]\n[\"000765\",76627,41469]\n[\"000766\",76628,41469]\n[\"000767\",76629,41469]\n[\"000768\",76630,41469]\n[\"001494\",76780,41470]\n[\"001496\",76781,41470]\n[\"002165\",76782,41470]\n[\"002235\",76783,41470]\n[\"000048\",76784,41471]\n[\"000048\",76785,41472]\n[\"000048\",76786,41473]\n[\"000056\",76787,41474]\n[\"001948\",76788,41475]\n[\"001953\",76789,41475]\n[\"001954\",76790,41475]\n[\"000057\",76791,41476]\n[\"000057\",76792,41477]\n[\"000057\",76793,41478]\n[\"000057\",76794,41479]\n[\"000057\",76795,41480]\n[\"000057\",76796,41481]\n[\"000057\",76797,41482]\n[\"000192\",76798,41483]\n[\"000192\",76799,41484]\n[\"000192\",76800,41485]\n[\"000193\",76801,41486]\n[\"000194\",76802,41487]\n[\"001619\",76803,41488]\n[\"000195\",76804,41489]\n[\"000195\",76805,41490]\n[\"000195\",76806,41491]\n[\"000195\",76807,41492]\n[\"000196\",76808,41493]\n[\"000196\",76809,41494]\n[\"000196\",76810,41495]\n[\"000198\",76811,41496]\n[\"000198\",76812,41497]\n[\"000199\",76813,41498]\n[\"000199\",76814,41499]\n[\"000200\",76815,41500]\n[\"000205\",76816,41501]\n[\"000366\",76817,41502]\n[\"000766\",76818,41503]\n[\"000795\",76819,41504]\n[\"000044\",76820,41505]\n[\"002236\",76821,41505]\n[\"002237\",76822,41505]\n[\"002238\",76823,41505]\n[\"002238\",76824,41506]\n[\"002038\",76825,41507]\n[\"002038\",76826,41508]\n[\"000366\",76827,41509]\n[\"000366\",76828,41510]\n[\"000366\",76829,41511]\n[\"000366\",76830,41512]\n[\"000366\",76831,41513]\n[\"000213\",76832,41514]\n[\"000213\",76833,41515]\n[\"000213\",76834,41516]\n[\"000213\",76835,41517]\n[\"000213\",76836,41518]\n[\"000766\",76837,41519]\n[\"000381\",76838,41520]\n[\"000381\",76839,41521]\n[\"002165\",76840,41522]\n[\"002235\",76841,41522]\n[\"001744\",76842,41523]\n[\"001744\",76843,41524]\n[\"001749\",76844,41525]\n[\"001749\",76845,41526]\n[\"000366\",76847,41527]\n[\"000778\",76846,41527]\n[\"001958\",76848,41527]\n[\"001958\",76849,41528]\n[\"000366\",76850,41529]\n[\"000778\",76851,41529]\n[\"001958\",76852,41529]\n[\"002617\",76853,41530]\n[\"002165\",76855,41531]\n[\"002696\",76854,41531]\n[\"002165\",76857,41532]\n[\"002696\",76856,41532]\n[\"000366\",76858,41533]\n[\"000366\",76859,41534]\n[\"000366\",76860,41535]\n[\"000366\",76861,41536]\n[\"000366\",76862,41537]\n[\"000366\",76863,41538]\n[\"000764\",76864,41539]\n[\"000366\",76865,41540]\n[\"002165\",76866,41541]\n[\"002165\",76867,41542]\n[\"000366\",76868,41543]\n[\"000366\",76869,41544]\n[\"000366\",76870,41545]\n[\"000366\",76871,41546]\n[\"000366\",76872,41547]\n[\"000366\",76873,41548]\n[\"000366\",76874,41549]\n[\"000366\",76875,41550]\n[\"000366\",76876,41551]\n[\"000366\",76877,41552]\n[\"000366\",76878,41553]\n[\"000366\",76879,41554]\n[\"000366\",76880,41555]\n[\"000366\",76881,41556]\n[\"000318\",76883,41557]\n[\"000368\",76882,41557]\n[\"001812\",76884,41557]\n[\"001813\",76885,41557]\n[\"001814\",76886,41557]\n[\"000366\",76887,41558]\n[\"000366\",76888,41559]\n[\"000366\",76889,41560]\n[\"000366\",76890,41561]\n[\"001764\",76891,41562]\n[\"001764\",76892,41563]\n[\"001764\",76893,41564]\n[\"000366\",76894,41565]\n[\"000318\",76896,41566]\n[\"000368\",76895,41566]\n[\"001812\",76899,41566]\n[\"001813\",76898,41566]\n[\"001814\",76897,41566]\n[\"000366\",76900,41567]\n[\"000366\",76901,41568]\n[\"000366\",76902,41569]\n[\"000366\",76903,41570]\n[\"000366\",76904,41571]\n[\"000366\",76905,41572]\n[\"000366\",76906,41573]\n[\"000366\",76907,41574]\n[\"000068\",76909,41575]\n[\"001199\",76908,41575]\n[\"002450\",76910,41575]\n[\"002476\",76911,41575]\n[\"000366\",76912,41576]\n[\"000366\",76913,41577]\n[\"000366\",76914,41578]\n[\"000318\",76916,41579]\n[\"000368\",76915,41579]\n[\"001812\",76919,41579]\n[\"001813\",76917,41579]\n[\"001814\",76918,41579]\n[\"000381\",76920,41580]\n[\"000126\",76922,41581]\n[\"000131\",76921,41581]\n[\"000139\",76923,41582]\n[\"001851\",76924,41583]\n[\"001851\",76925,41584]\n[\"001851\",76926,41585]\n[\"001851\",76927,41586]\n[\"001851\",76928,41587]\n[\"001851\",76929,41588]\n[\"001851\",76930,41589]\n[\"001851\",76931,41590]\n[\"001855\",76932,41591]\n[\"001855\",76933,41592]\n[\"001855\",76934,41593]\n[\"002234\",76935,41594]\n[\"000126\",76937,41595]\n[\"000172\",76936,41595]\n[\"000126\",76938,41596]\n[\"000172\",76939,41596]\n[\"000126\",76941,41597]\n[\"000172\",76940,41597]\n[\"000126\",76942,41598]\n[\"000172\",76943,41598]\n[\"000172\",76944,41599]\n[\"000172\",76945,41600]\n[\"000172\",76946,41601]\n[\"000172\",76947,41602]\n[\"000172\",76948,41603]\n[\"000172\",76949,41604]\n[\"000172\",76950,41605]\n[\"000172\",76951,41606]\n[\"000172\",76952,41607]\n[\"000172\",76953,41608]\n[\"002884\",76954,41608]\n[\"000172\",76955,41609]\n[\"002884\",76956,41609]\n[\"000172\",76957,41610]\n[\"002884\",76958,41610]\n[\"000172\",76959,41611]\n[\"002884\",76960,41611]\n[\"000172\",76961,41612]\n[\"002884\",76962,41612]\n[\"000172\",76963,41613]\n[\"002884\",76964,41613]\n[\"000172\",76965,41614]\n[\"002884\",76966,41614]\n[\"000172\",76967,41615]\n[\"002884\",76968,41615]\n[\"000172\",76969,41616]\n[\"002884\",76970,41616]\n[\"000172\",76971,41617]\n[\"002884\",76972,41617]\n[\"000126\",76973,41618]\n[\"000172\",76974,41618]\n[\"002884\",76975,41618]\n[\"000126\",76976,41619]\n[\"000172\",76977,41619]\n[\"002884\",76978,41619]\n[\"000135\",76980,41620]\n[\"000172\",76979,41620]\n[\"002884\",76981,41620]\n[\"000135\",76982,41621]\n[\"000172\",76983,41621]\n[\"002884\",76984,41621]\n[\"000135\",76985,41622]\n[\"000172\",76986,41622]\n[\"002884\",76987,41622]\n[\"000135\",76989,41623]\n[\"000172\",76988,41623]\n[\"002884\",76990,41623]\n[\"000135\",76991,41624]\n[\"000172\",76992,41624]\n[\"002884\",76993,41624]\n[\"000130\",76996,41625]\n[\"000135\",76995,41625]\n[\"000172\",76994,41625]\n[\"002884\",76997,41625]\n[\"000130\",76998,41626]\n[\"000135\",76999,41626]\n[\"000172\",77000,41626]\n[\"002884\",77001,41626]\n[\"000130\",77004,41627]\n[\"000135\",77003,41627]\n[\"000172\",77002,41627]\n[\"002884\",77005,41627]\n[\"000130\",77006,41628]\n[\"000135\",77007,41628]\n[\"000172\",77008,41628]\n[\"002884\",77009,41628]\n[\"000130\",77011,41629]\n[\"000135\",77012,41629]\n[\"000172\",77010,41629]\n[\"002884\",77013,41629]\n[\"000135\",77014,41630]\n[\"002884\",77015,41630]\n[\"000135\",77016,41631]\n[\"002884\",77017,41631]\n[\"000135\",77018,41632]\n[\"002884\",77019,41632]\n[\"000135\",77020,41633]\n[\"002884\",77021,41633]\n[\"000135\",77022,41634]\n[\"000172\",77023,41634]\n[\"002884\",77024,41634]\n[\"000135\",77026,41635]\n[\"000172\",77025,41635]\n[\"002884\",77027,41635]\n[\"000172\",77028,41636]\n[\"000172\",77029,41637]\n[\"000172\",77030,41638]\n[\"000172\",77031,41639]\n[\"000172\",77032,41640]\n[\"000172\",77033,41641]\n[\"000018\",77035,41642]\n[\"000172\",77034,41642]\n[\"001403\",77037,41642]\n[\"002130\",77036,41642]\n[\"000018\",77038,41643]\n[\"000172\",77039,41643]\n[\"001403\",77040,41643]\n[\"002130\",77041,41643]\n[\"000018\",77043,41644]\n[\"000172\",77042,41644]\n[\"001403\",77045,41644]\n[\"002130\",77044,41644]\n[\"000018\",77046,41645]\n[\"000172\",77047,41645]\n[\"001403\",77048,41645]\n[\"002130\",77049,41645]\n[\"000018\",77050,41646]\n[\"000172\",77051,41646]\n[\"001403\",77053,41646]\n[\"002130\",77052,41646]\n[\"000172\",77054,41647]\n[\"002884\",77055,41647]\n[\"000172\",77056,41648]\n[\"002884\",77057,41648]\n[\"000172\",77058,41649]\n[\"002884\",77059,41649]\n[\"000172\",77060,41650]\n[\"002884\",77061,41650]\n[\"000172\",77062,41651]\n[\"002884\",77063,41651]\n[\"000366\",77064,41652]\n[\"000318\",77065,41653]\n[\"000368\",77066,41653]\n[\"001812\",77068,41653]\n[\"001813\",77069,41653]\n[\"001814\",77067,41653]\n[\"000054\",77070,41654]\n[\"000382\",77071,41655]\n[\"002314\",77072,41655]\n[\"000068\",77075,41656]\n[\"000366\",77073,41656]\n[\"000803\",77074,41656]\n[\"001133\",77076,41657]\n[\"002361\",77077,41657]\n[\"000048\",77083,41658]\n[\"000050\",77084,41658]\n[\"001384\",77078,41658]\n[\"001385\",77079,41658]\n[\"001386\",77080,41658]\n[\"001387\",77081,41658]\n[\"001388\",77082,41658]\n[\"001453\",77085,41659]\n[\"001453\",77086,41660]\n[\"001453\",77087,41661]\n[\"000366\",77088,41662]\n[\"002418\",77089,41663]\n[\"002420\",77090,41663]\n[\"002421\",77091,41663]\n[\"002422\",77092,41663]\n[\"002418\",77095,41664]\n[\"002420\",77096,41664]\n[\"002421\",77093,41664]\n[\"002422\",77094,41664]\n[\"001133\",77097,41665]\n[\"002361\",77098,41665]\n[\"000366\",77099,41666]\n[\"001133\",77100,41667]\n[\"002361\",77101,41667]\n[\"000366\",77102,41668]\n[\"000366\",77103,41669]\n[\"000366\",77104,41670]\n[\"000366\",77105,41671]\n[\"000197\",77106,41672]\n[\"000366\",77107,41672]\n[\"001453\",77108,41673]\n[\"000366\",77109,41674]\n[\"000366\",77110,41675]\n[\"000318\",77111,41676]\n[\"000368\",77112,41676]\n[\"001812\",77113,41676]\n[\"001813\",77115,41676]\n[\"001814\",77114,41676]\n[\"000318\",77117,41677]\n[\"000368\",77116,41677]\n[\"001812\",77120,41677]\n[\"001813\",77119,41677]\n[\"001814\",77118,41677]\n[\"000366\",77121,41678]\n[\"000366\",77122,41679]\n[\"000366\",77123,41680]\n[\"001891\",77125,41681]\n[\"002046\",77124,41681]\n[\"000366\",77126,41682]\n[\"000366\",77127,41683]\n[\"000366\",77128,41684]\n[\"000366\",77129,41685]\n[\"000366\",77130,41686]\n[\"000366\",77131,41687]\n[\"000366\",77132,41688]\n[\"000366\",77133,41689]\n[\"000366\",77134,41690]\n[\"000366\",77135,41691]\n[\"000366\",77136,41692]\n[\"000366\",77137,41693]\n[\"000366\",77138,41694]\n[\"000366\",77139,41695]\n[\"000366\",77140,41696]\n[\"000366\",77141,41697]\n[\"000366\",77142,41698]\n[\"000318\",77143,41699]\n[\"000368\",77144,41699]\n[\"001812\",77146,41699]\n[\"001813\",77145,41699]\n[\"001814\",77147,41699]\n[\"000366\",77148,41700]\n[\"000366\",77149,41701]\n[\"000366\",77150,41702]\n[\"000366\",77151,41703]\n[\"000366\",77152,41704]\n[\"000366\",77153,41705]\n[\"000366\",77154,41706]\n[\"000366\",77155,41707]\n[\"000366\",77156,41708]\n[\"001948\",77158,41709]\n[\"001953\",77159,41709]\n[\"001954\",77157,41709]\n[\"001948\",77161,41710]\n[\"001953\",77160,41710]\n[\"001954\",77162,41710]\n[\"001948\",77164,41711]\n[\"001953\",77165,41711]\n[\"001954\",77163,41711]\n[\"001443\",77166,41712]\n[\"001444\",77167,41712]\n[\"002418\",77168,41712]\n[\"000057\",77169,41716]\n[\"001414\",77294,41719]\n[\"000048\",77295,41720]\n[\"000050\",77296,41721]\n[\"001384\",77297,41722]\n[\"001385\",77298,41722]\n[\"001386\",77299,41722]\n[\"001387\",77300,41722]\n[\"001388\",77301,41722]\n[\"000053\",77302,41723]\n[\"000054\",77303,41724]\n[\"000068\",77304,41725]\n[\"001453\",77305,41726]\n[\"001453\",77306,41727]\n[\"000068\",77307,41728]\n[\"000130\",77308,41729]\n[\"000131\",77309,41730]\n[\"001487\",77310,41731]\n[\"000132\",77311,41732]\n[\"000133\",77312,41733]\n[\"000134\",77313,41734]\n[\"000162\",77314,41735]\n[\"000163\",77315,41736]\n[\"000164\",77316,41737]\n[\"000382\",77317,41738]\n[\"000382\",77318,41739]\n[\"000382\",77319,41740]\n[\"000382\",77320,41741]\n[\"000764\",77321,41742]\n[\"000766\",77322,41743]\n[\"001939\",77323,41744]\n[\"001942\",77324,41745]\n[\"001942\",77325,41746]\n[\"000778\",77326,41747]\n[\"000185\",77327,41748]\n[\"000186\",77328,41749]\n[\"000187\",77329,41750]\n[\"000187\",77330,41751]\n[\"000803\",77331,41752]\n[\"000804\",77332,41753]\n[\"001097\",77333,41754]\n[\"001133\",77334,41755]\n[\"001184\",77335,41756]\n[\"001184\",77336,41757]\n[\"001185\",77337,41758]\n[\"001664\",77338,41759]\n[\"001188\",77339,41760]\n[\"001190\",77340,41761]\n[\"002314\",77341,41762]\n[\"002322\",77342,41763]\n[\"000068\",77343,41764]\n[\"002353\",77344,41765]\n[\"002250\",77345,41766]\n[\"001844\",77346,41767]\n[\"001851\",77347,41768]\n[\"001858\",77348,41769]\n[\"001861\",77349,41770]\n[\"002038\",77350,41771]\n[\"002038\",77351,41772]\n[\"001953\",77352,41773]\n[\"001954\",77353,41774]\n[\"001958\",77354,41775]\n[\"002450\",77355,41776]\n[\"002397\",77356,41777]\n[\"002418\",77357,41778]\n[\"002418\",77358,41779]\n[\"002423\",77359,41780]\n[\"000197\",77360,41781]\n[\"000172\",77361,41782]\n[\"002450\",77362,41783]\n[\"002450\",77363,41784]\n[\"002450\",77364,41785]\n[\"000366\",77365,41786]\n[\"000366\",77366,41787]\n[\"002363\",77367,41788]\n[\"002364\",77368,41789]\n[\"000196\",77369,41790]\n[\"000068\",77370,41791]\n[\"001453\",77371,41792]\n[\"001453\",77372,41793]\n[\"001967\",77373,41794]\n[\"002450\",77374,41795]\n[\"002450\",77375,41796]\n[\"000185\",77376,41797]\n[\"000803\",77377,41798]\n[\"000068\",77378,41799]\n[\"001414\",77421,41800]\n[\"000048\",77422,41801]\n[\"001414\",77424,41802]\n[\"001414\",77425,41803]\n[\"000048\",77426,41804]\n[\"001414\",77427,41805]\n[\"000048\",77428,41806]\n{\"table\":\"rev_group_rule_map\",\"columns\":\"`checkDigest`,`checkSystem`,`documentable`,`falseNegatives`,`falsePositives`,`fixDigest`,`fixref`,`groupId`,`groupSeverity`,`groupTitle`,`iaControls`,`mitigationControl`,`mitigations`,`potentialImpacts`,`responsibility`,`revId`,`rgrId`,`ruleId`,`severity`,`severityOverrideGuidance`,`thirdPartyTools`,`title`,`version`,`vulnDiscussion`,`weight`\",\"rowCount\":703}\n[{\"type\":\"Buffer\",\"data\":\"base64:71oeJLYU9tjMIiRqSWuNoIKcrvLfKW7xfh7cI6OhvFc=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",37992,\"SV-106179r123456789_rule\",\"medium\",null,null,\"The VPN Gateway must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:slm2UFIqnUUPyOpfIcsxSew4LGvsTesU9C6Ju5XJ3mw=\"},\"C-95879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fgzhbaQbILFSeEwIwlOogRZtoeuNS7Kr0AHwx84IKLg=\"},\"F-102723r1_fix\",\"V-97043\",\"medium\",\"SRG-NET-000041-VPN-000110\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",37993,\"SV-106181r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.\",\"SRG-NET-000041-VPN-000110\",\"Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n \\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jc6QW12gqdTKEPqvls4bilVyDJExcCoSskTVyO0VtC8=\"},\"C-95881r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QOTNmZJgq99GtXVEhYObEaDdxa5uT73FDkpBccGCe5Q=\"},\"F-102725r1_fix\",\"V-97045\",\"medium\",\"SRG-NET-000042-VPN-000120\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",37994,\"SV-106183r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must enforce a policy to retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.\",\"SRG-NET-000042-VPN-000120\",\"The banner must be acknowledged by the user prior to allowing the user access to the network. This provides assurance that the user has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the user, DoD will not be in compliance with system use notifications required by law. \\n\\nThe banner is usually configured in NDM for client presentation as well as local logon.\\n\\nTo establish acceptance of the application usage policy, a click-through banner at application logon is required. The VPN gateway must prevent further activity until the user executes a positive action to manifest agreement by clicking on a box indicating \\\"OK\\\". \\n\\nThis applies to gateways that have the concept of a user account and have the login function residing on the gateway or the gateway acts as a user intermediary.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4cT/S3JRnRG1/bjkxCCl0FvJ2jFBPQxR6xd/ho3iPwU=\"},\"C-95883r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zvj+8RueEc8AGER4mc5vsA+JPLux2r9T3RERyvr6GqU=\"},\"F-102727r1_fix\",\"V-97047\",\"medium\",\"SRG-NET-000043-VPN-000130\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",37995,\"SV-106185r1_rule\",\"medium\",null,null,\"The publicly accessible VPN Gateway must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\",\"SRG-NET-000043-VPN-000130\",\"Display of a standardized and approved use notification before granting access to the publicly accessible VPN gateway ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with DTM-08-060. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IdemsTDQGwPd7bokQxIIvpGCFpuH2a0LMkx43UGqWUA=\"},\"C-95885r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zwSBwQLPqjyi/Vwm1CxWQnlXRWyZZB59z9HGXUELgyQ=\"},\"F-102729r1_fix\",\"V-97049\",\"low\",\"SRG-NET-000049-VPN-000150\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",37996,\"SV-106187r1_rule\",\"low\",null,null,\"The VPN Gateway must notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access).\",\"SRG-NET-000049-VPN-000150\",\"Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the number of unsuccessful attempts that were made to login to their account allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators.\\n\\nThis applies to gateways that have the concept of a user account and have the login function residing on the gateway or the gateway acts as a user intermediary.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aVWTWelue2vPX4PPQhsVdenoG0JoZrePs1txZu8Tn9w=\"},\"C-95887r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Bxnvb6aexynxn1Y2nmdyofyqfjFnX0xOt15KQeL53to=\"},\"F-102731r1_fix\",\"V-97051\",\"medium\",\"SRG-NET-000053-VPN-000170\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",37997,\"SV-106189r1_rule\",\"medium\",null,null,\"The VPN Gateway must limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number.\",\"SRG-NET-000053-VPN-000170\",\"VPN gateway management includes the ability to control the number of users and user sessions that utilize a VPN gateway. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to DoS attacks.\\n\\nThis requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.\\n\\nThe intent of this policy is to ensure the number of concurrent sessions is deliberately set to a number based on the site's mission and not left unlimited.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CyTJHLIKQ2Ojkg9rwcZ3x7T66VHLzHB54n+nmQfac2E=\"},\"C-95889r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:H+ZsJRqo1BYEq9Wumb38YWMb+3wdolcYgDCbwGXeDJo=\"},\"F-102733r1_fix\",\"V-97053\",\"high\",\"SRG-NET-000062-VPN-000200\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",37998,\"SV-106191r1_rule\",\"high\",null,null,\"The TLS VPN Gateway must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during transmission.\",\"SRG-NET-000062-VPN-000200\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nNIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b0U2i/2oFdeOwmGlTBap86LUQ1gHdfQ3eL4us+64fpw=\"},\"C-95891r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:J8KVE+KgBfuYvKemq7ovYBGF4IuGwoDzawSXyCaOyAQ=\"},\"F-102735r1_fix\",\"V-97055\",\"medium\",\"SRG-NET-000063-VPN-000210\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",37999,\"SV-106193r1_rule\",\"medium\",null,null,\"The remote access VPN Gateway must use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.\",\"SRG-NET-000063-VPN-000210\",\"Without integrity protection, unauthorized changes may be made to the log files and reliable forensic analysis and discovery of the source of malicious system activity may be degraded.\\n\\nRemote access (e.g., RDP) is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless.\\n\\nIntegrity checks include cryptographic checksums, digital signatures, or hash functions. Federal Information Processing Standard (FIPS) 186-4, Digital Signature Standard (DSS), specifies three NIST-approved algorithms: DSA, RSA, and ECDSA. All three are used to generate and verify digital signatures in conjunction with an approved hash function.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v3WpQRoQigeTzLi65BYsrw9t+ZEEROlTq1kxXFTTLlc=\"},\"C-95893r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0D+opAzf5nzDclgwdIOkAD6j3JJiMTsVJtgVtp12Gss=\"},\"F-102737r1_fix\",\"V-97057\",\"medium\",\"SRG-NET-000063-VPN-000220\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38000,\"SV-106195r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.\",\"SRG-NET-000063-VPN-000220\",\"Without strong cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThe remote access VPN provides access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+B3+7JmTL1p1pvXgkAa8wGoCkVHYXHjICDWeklY1MTk=\"},\"C-95895r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:M9780XhNnUX+zVJLNXdHbTc95ro/kqEEj3UK2rL6hHI=\"},\"F-102739r1_fix\",\"V-97059\",\"high\",\"SRG-NET-000074-VPN-000250\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38001,\"SV-106197r1_rule\",\"high\",null,null,\"The IPsec VPN must implement a FIPS 140-2 validated Diffie-Hellman (DH) group.\",\"SRG-NET-000074-VPN-000250\",\"Use of an approved DH algorithm ensures the Internet Key Exchange (IKE) (phase 1) proposal uses FIPS-validated key management techniques and processes in the production, storage, and control of private/secret cryptographic keys. The security of the DH key exchange is based on the difficulty of solving the discrete logarithm in which the key was derived from. Hence, the larger the modulus, the more secure the generated key is considered to be.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YlctilOwQ2MBW7zoqYuhAoiJN5c5NYVKUMH7L8KW2VE=\"},\"C-95899r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:13l80RWe85t3TbQcxGDY1TeqhIv8oq9LWDSwKSmwv2c=\"},\"F-102743r1_fix\",\"V-97061\",\"low\",\"SRG-NET-000077-VPN-000280\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38002,\"SV-106199r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish what type of events occurred.\",\"SRG-NET-000077-VPN-000280\",\"Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nVPN gateways often have a separate audit log for capturing VPN status and other information about the traffic (as opposed to the log capturing administrative and configuration actions). Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.\\n\\nAssociating event types with detected events in the VPN gateway logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HGobFrLp43KBzaBeaBiQba6hjKEcpQn11VJTJJwwmMo=\"},\"C-95901r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1960KI2uASwT2grDyD1D8glCHawNm1LCT+mppgDNAG4=\"},\"F-102745r1_fix\",\"V-97063\",\"low\",\"SRG-NET-000078-VPN-000290\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38003,\"SV-106201r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish when (date and time) the events occurred.\",\"SRG-NET-000078-VPN-000290\",\"Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nVPN gateways often have a separate audit log for capturing VPN status and other information about the traffic (as opposed to the log capturing administrative and configuration actions).\\n\\nAssociating event types with detected events in the network audit logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:P/zyghBUSYmw8eYcF6kqAgE8TeMANzSroGoCNq9DxmU=\"},\"C-95903r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jl3z7pSS/5EUBqiypkdJCKqCZ9U+KdO46Z7KbtxpUpI=\"},\"F-102747r1_fix\",\"V-97065\",\"medium\",\"SRG-NET-000079-VPN-000300\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38004,\"SV-106203r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records containing information that establishes the identity of any individual or process associated with the event.\",\"SRG-NET-000079-VPN-000300\",\"Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/9F2orQ7S4UyHUeIF5MNwyf2YqTtEcZKOu6Lyy3dl0w=\"},\"C-95905r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8Jh0XPz5tsLOV5OOHxTog1U4Ld3GURTDC/neBufCCRc=\"},\"F-102749r1_fix\",\"V-97067\",\"medium\",\"SRG-NET-000088-VPN-000310\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38005,\"SV-106205r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records containing information to establish where the events occurred.\",\"SRG-NET-000088-VPN-000310\",\"Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nIn order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know where events occurred, such as VPN gateway components, modules, device identifiers, node names, and functionality.\\n\\nAssociating information about where the event occurred within the network provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TBiXTAY2X10uilSJ/Zo764Ce7gxa+BC604igCvR21Ys=\"},\"C-95907r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fdhbsyNKzbH4WTd1xvpZy3y/UYX8uj3SGwmY5U6RSTM=\"},\"F-102751r1_fix\",\"V-97069\",\"low\",\"SRG-NET-000089-VPN-000330\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38006,\"SV-106207r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish the source of the events.\",\"SRG-NET-000089-VPN-000330\",\"Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event.\\n\\nIn addition to logging where events occur within the network, the log records must also identify sources of events such as IP addresses, processes, and node or device names.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2+gLZEUpQFGiiXTLj5vTvPMeNuYVSesoUBq5osjiwyA=\"},\"C-95909r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+Hhc/f/5x1WDFzGN2o6Zu1Zd4z5P5GcPUtxEuGkAWCk=\"},\"F-102753r1_fix\",\"V-97071\",\"medium\",\"SRG-NET-000091-VPN-000350\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38007,\"SV-106209r1_rule\",\"medium\",null,null,\"The VPN Gateway must produce log records containing information to establish the outcome of the events.\",\"SRG-NET-000091-VPN-000350\",\"Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the network.\\n\\nEvent outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the network after the event occurred). As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mi17ibh62O4cda5bcRUSENaNZI+A+wHMQdsAhZaeELQ=\"},\"C-95911r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:uA4H2p1A7Ll9hacECizf787pb/UA7IqAnIHhct/QrEM=\"},\"F-102755r1_fix\",\"V-97073\",\"low\",\"SRG-NET-000098-VPN-000370\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38008,\"SV-106211r1_rule\",\"low\",null,null,\"The VPN Gateway must protect log information from unauthorized read access if all or some of this data is stored locally.\",\"SRG-NET-000098-VPN-000370\",\"Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured VPN gateway. Thus, it is imperative that the collected log data from the various VPN gateways, as well as the auditing tools, be secured and can only be accessed by authorized personnel.\\n\\nThis requirement pertains to securing the VPN log as it is stored locally, on the box temporarily, or while being encapsulated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xx7dyKjP3tr449DemD15SwuRdkEieFRE1AhuT429Hbk=\"},\"C-95913r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0Ev7nKBuQufWeKLn3k7Wr/z0hb8pni2MRJGUGCqohj8=\"},\"F-102757r1_fix\",\"V-97075\",\"medium\",\"SRG-NET-000099-VPN-000380\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38009,\"SV-106213r1_rule\",\"medium\",null,null,\"The VPN Gateway log must protect audit information from unauthorized modification when stored locally.\",\"SRG-NET-000099-VPN-000380\",\"If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\\n\\nThis requirement pertains to securing the VPN log as it is stored locally, on the box temporarily, or while being encapsulated.\\n\\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\\n\\nAudit information includes all information (e.g., log records, audit settings, and audit reports) needed to successfully audit information system activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LurVSxZqQlUG4THAxXLsYwtoOIQkH9C5vFm75lhPk+M=\"},\"C-95915r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PRb2voDcKub8xxvNSpdygBWfbLpwWfUE85OlSdeFxMU=\"},\"F-102759r1_fix\",\"V-97077\",\"medium\",\"SRG-NET-000100-VPN-000390\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38010,\"SV-106215r1_rule\",\"medium\",null,null,\"The VPN Gateway must protect audit information from unauthorized deletion when stored locally.\",\"SRG-NET-000100-VPN-000390\",\"If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\\n\\nTo ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification.\\n\\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\\n\\nAudit information includes all information (e.g., log records, audit settings, and audit reports) needed to successfully audit information system activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:R+x0KRiQIKJIbqWDk9OWXOHA/tx5c83O7HSpjbaqItQ=\"},\"C-95917r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4gmYRDVBlFkpvQ5jFnJALH34Q1qS7urLI7Yjatvv5Ks=\"},\"F-102761r1_fix\",\"V-97079\",\"medium\",\"SRG-NET-000132-VPN-000450\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38011,\"SV-106217r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.\",\"SRG-NET-000132-VPN-000450\",\"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\\n\\nDoD continually assesses the ports, protocols, and services that can be used for network communications. Some protocols or services have known exploits or security weaknesses. Network traffic using these ports, protocols, and services must be prohibited or restricted in accordance with DoD policy. The PPSM CAL and vulnerability assessments provide an authoritative source for ports, protocols, and services that are unauthorized or restricted across boundaries on DoD networks.\\n\\nThe VPN Gateway must be configured to prevent or restrict the use of prohibited ports, protocols, and services throughout the network by filtering the network traffic and disallowing or redirecting traffic as necessary. Default and updated policy filters from the vendors will disallow older version of protocols and applications and will address most known non-secure ports, protocols, and/or services.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6xznw8iyFeJRJwk1JYCPRsiNwv5VE1E6oPOibHnQepY=\"},\"C-95919r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BV4FIuZmpkNnwep3K+axA7S7eorRTT2tR14EUOT7U0Y=\"},\"F-102763r1_fix\",\"V-97081\",\"medium\",\"SRG-NET-000132-VPN-000460\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38012,\"SV-106219r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use IKEv2 for IPsec VPN security associations.\",\"SRG-NET-000132-VPN-000460\",\"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\\n\\nUse of IKEv2 leverages DoS protections because of improved bandwidth management and leverages more secure encryption algorithms.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U9u5kkzq19uYYwdfbvK93u00swz2+lLKN/KXYD1SLPM=\"},\"C-95921r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CZLDS9pX8n0hhkw38hCbPDJhpjz0SK1r40ll/eFYuDI=\"},\"F-102765r1_fix\",\"V-97083\",\"medium\",\"SRG-NET-000132-VPN-000470\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38013,\"SV-106221r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and L2F.\",\"SRG-NET-000132-VPN-000470\",\"The PPTP and L2F are obsolete method for implementing virtual private networks. Both protocols may be easy to use and readily available, but they have many well-known security issues and exploits. Encryption and authentication are both weak.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qL67vWiduAPXEoBZfFyKtQr8Xx5q0lifYoN8/VKeiXk=\"},\"C-95923r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fRSUaDiTIxiKHwtXC7xhS028BxmoqEKmcdKtfdEYU8A=\"},\"F-102767r1_fix\",\"V-97085\",\"medium\",\"SRG-NET-000132-VPN-000480\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38014,\"SV-106223r1_rule\",\"medium\",null,null,\"For site-to-site VPN implementations, the  L2TP protocol must be blocked or denied at the security boundary with the private network so unencrypted L2TP packets cannot traverse into the private network of the enclave.\",\"SRG-NET-000132-VPN-000480\",\"Unlike GRE (a simple encapsulating header) L2TP is a full-fledged communications protocol with control channel, data channels, and a robust command structure. In addition to PPP, other link layer types (called pseudowires) can be and are defined for delivery in L2TP by separate RFC documents. Further complexity is created by the capability to define vender-specific parameters beyond those defined in the L2TP specifications.\\n\\nThe endpoint devices of an L2TP connection can be an L2TP Access Concentrator (LAC) in which case it inputs/outputs the layer 2 protocol to/from the L2TP tunnel. Otherwise, it is an L2TP Network Server (LNS), in which case it inputs/outputs the layer 3 (IP) protocol to/from the L2TP tunnel. The specifications describe three reference models: LAC-LNS, LAC-LAC, and LNS-LNS, the first of which is the most common case. The LAC-LNS model allows a remote access user to reach his home network or ISP from a remote location. The remote access user connects to  a LAC device which tunnels his connection home to an awaiting LNS. The LAC could also be located on the remote user's laptop, which connects to an LNS at home using some generic internet connection. The other reference models may be used for more obscure scenarios.\\n\\nAlthough the L2TP protocol does not contain encryption capability, it can be operated over IPsec, which would provide authentication and confidentiality. A remote user in the LAC-LNS model would most likely obtain a dynamically assigned IP address from the home network to ultimately use through the tunnel back to the home network. Secondly, the outer IP source address used to send the L2TP tunnel packet to the home network is likely to be unknown or highly variable. Thirdly, since the LNS provides the remote user with a dynamic IP address to use, the firewall at the home network would have to be dynamically updated to accept this address in conjunction with the outer tunnel address. Finally, there is also the issue of authentication of the remote user prior to divulging an acceptable IP address. Because of all of these complications, the strict filtering rules applied to the IP-in-IP and GRE tunneling cases will likely not be possible in the L2TP scenario.\\n\\nIn addition to the difficulty of enforcing addresses and endpoints (as explained above), the L2TP protocol itself is a security concern if allowed through a security boundary. In particular:\\n\\n1) L2TP potentially allows link layer protocols to be delivered from afar. These protocols were intended for link-local scope only, are less defended, and not as well-known,\\n2) The L2TP tunnels can carry IP packets that are very difficult to see and filter because of the additional layer 2 overhead,\\n3) L2TP is highly complex and variable (vender-specific variability) and therefore would be a viable target that is difficult to defend. It is better left outside of the main firewall where less damage occurs if the L2TP-processing node is compromised,\\n4) Filtering cannot be used to detect and prevent other unintended layer 2 protocols from being tunneled. The strength of the application layer code would have to be relied on to achieve this task,\\n5) Regardless of whether the L2TP is handled inside or outside of the main network, a secondary layer of IP filtering is required; therefore bringing it inside does not save resources.\\n\\nTherefore, it is not recommended to allow unencrypted L2TP packets across the security boundary into the network's protected areas. Reference the Backbone Transport STIG for additional L2TP guidance and use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mmyK/9p+kkBzjw391gSBn/5JwQ6rUWRXc0i0deZcJlY=\"},\"C-95925r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PTCfoKcCD5hDW7K47sK1D7FeehVzMR67iHZOHpTiBJE=\"},\"F-102769r1_fix\",\"V-97087\",\"medium\",\"SRG-NET-000138-VPN-000490\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38015,\"SV-106225r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).\",\"SRG-NET-000138-VPN-000490\",\"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\\n\\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses except the following.\\n\\n(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\\n\\n(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals' in-group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN or proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D7dgt3RnYA25LvMASqDp9YTrG7KfSDck59y/cwVd1j4=\"},\"C-95927r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Rh+GrFD8y7n/BlVOr9JDOC5ROFB+DmI+8x461DH5A1Q=\"},\"F-102771r1_fix\",\"V-97089\",\"high\",\"SRG-NET-000140-VPN-000500\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38016,\"SV-106227r1_rule\",\"high\",null,null,\"The VPN Gateway must use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.\",\"SRG-NET-000140-VPN-000500\",\"To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.\\n\\nMultifactor authentication uses two or more factors to achieve authentication. Use of password for user remote access for non-privileged account is not authorized.\\n\\nFactors include:\\n(i) Something you know (e.g., password/PIN);\\n(ii) Something you have (e.g., cryptographic identification device, token); or\\n(iii) Something you are (e.g., biometric).\\n\\nA non-privileged account is any information system account with authorizations of a non-privileged user.\\n\\nNetwork access is any access to a network element by a user (or a process acting on behalf of a user) communicating through a network.\\n\\nThe DoD CAC with DoD-approved PKI is an example of multifactor authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KKZUM28vxti/o8G6lxUgCF8Wx8ura3+B1TExgJuWCGA=\"},\"C-95929r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:n8I5AADucbxW3nhWpeZCsAbA1ZwIJ9+ypR/dgDeDkbA=\"},\"F-102773r1_fix\",\"V-97091\",\"medium\",\"SRG-NET-000145-VPN-000510\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38017,\"SV-106229r1_rule\",\"medium\",null,null,\"The VPN Client must implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.\",\"SRG-NET-000145-VPN-000510\",\"Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD common access card.\\n\\nA non-privileged account is any information system account with authorizations of a non-privileged user.\\n\\nNetwork access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:koWH1S5xZuAZ4H9vnFXHr/qz4c6UDJH7P29FdfhEPZg=\"},\"C-95931r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/05962IPiIdyt4V5PSfPjQ8gsSvFmLoQb7Ih1O9CdmI=\"},\"F-102775r1_fix\",\"V-97093\",\"medium\",\"SRG-NET-000147-VPN-000520\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38018,\"SV-106231r1_rule\",\"medium\",null,null,\"The TLS VPN must be configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts.\",\"SRG-NET-000147-VPN-000520\",\"A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack.\\n\\nAn authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message.\\n\\nA non-privileged account is any operating system account with authorizations of a non-privileged user.\\n\\nTechniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:53vjl7nhxJZkAmPcXBfrWgxe2N8vSeOA4P5KeOUv1cA=\"},\"C-95933r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tvtLSoQBIUhFi1DUAx/IQFts2ZxCAJGEu1MMnqECcNE=\"},\"F-102777r1_fix\",\"V-97095\",\"medium\",\"SRG-NET-000147-VPN-000530\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38019,\"SV-106233r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use anti-replay mechanisms for security associations.\",\"SRG-NET-000147-VPN-000530\",\"Anti-replay is an IPsec security mechanism at a packet level, which helps to avoid unwanted users from intercepting and modifying an ESP packet.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PQvyQqpQfxH4QYcuFED9dQWGmLZ5NjYVdg+5ViJyzMc=\"},\"C-95935r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PKYcfwohvuVW06x1QmIrzJEC7yX68OlFaic/tTj3y3A=\"},\"F-102779r1_fix\",\"V-97097\",\"medium\",\"SRG-NET-000148-VPN-000540\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38020,\"SV-106235r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify all network-connected endpoint devices before establishing a connection.\",\"SRG-NET-000148-VPN-000540\",\"Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\\n\\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification decisions (as opposed to the actual identifiers) to the services that need to act on those decisions.\\n\\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers (outside a datacenter), VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v5/IfNoYuNBZdJW3TnihRjv14rrPD9SLxquxNn9HMf0=\"},\"C-95937r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4mEma8P0Dv4vj5cqKTp53/Xgkv8CV31yYo/9WqBJF7I=\"},\"F-102781r1_fix\",\"V-97099\",\"medium\",\"SRG-NET-000164-VPN-000560\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38021,\"SV-106237r1_rule\",\"medium\",null,null,\"The VPN Gateway, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.\",\"SRG-NET-000164-VPN-000560\",\"Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. To meet this requirement, the information system must create trusted channels between itself and remote trusted authorized IT product (e.g., syslog server) entities that protect the confidentiality and integrity of communications. The information system must create trusted paths between itself and remote administrators and users that protect the confidentiality and integrity of communications.\\n\\nA trust anchor is an authoritative entity represented via a public key and associated data. It is most often used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. However, applications that do not use a trusted path are not approved for non-local and remote management of DoD information systems.\\n\\nUse of SSHv2 to establish a trusted channel is approved. Use of FTP, TELNET, HTTP, and SNMPV1 is not approved since they violate the trusted channel rule set. Use of web management tools that are not validated by common criteria may also violate the trusted channel rule set.\\n\\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA.\\n\\nThis requirement verifies that a certification path to an accepted trust anchor is used for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Validation of the certificate status information is out of scope for this requirement.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4L7fYYyaq26bvadPv3JCcQ3yEjurb6JgRmYQ/U0UV1c=\"},\"C-95939r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kHIpuc9rQ7c3thtVDQNITMH7ftHuWzgXExpBIujEdHQ=\"},\"F-102783r1_fix\",\"V-97101\",\"medium\",\"SRG-NET-000165-VPN-000570\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38022,\"SV-106239r1_rule\",\"medium\",null,null,\"The site-to-site VPN, when using PKI-based authentication for devices, must enforce authorized access to the corresponding private key.\",\"SRG-NET-000165-VPN-000570\",\"If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure.\\n\\nThe cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to authenticate to network devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ar3GvJuXEKD4A/Af2IozOGlLJBjfNqRbiW1i8k/7Y9g=\"},\"C-95941r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5j0XBOP7B/DfiJ4RQcUK0zsSkNS1ZJgD+jERXi5h0IM=\"},\"F-102785r1_fix\",\"V-97103\",\"medium\",\"SRG-NET-000166-VPN-000580\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38023,\"SV-106241r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway must use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.\",\"SRG-NET-000166-VPN-000580\",\"The VPN interacts directly with public networks and devices and should not contain user authentication information for all users. AAA network security services provide the primary framework through which a network administrator can set up access control and authorization on network points of entry or network access servers. It is not advisable to configure access control on the VPN gateway or remote access server. Separation of services provides added assurance to the network if the access control server is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:f0b/RYI3SCPeEqjHsb3psBWUdGRTKfgqRrq51hB7yfE=\"},\"C-95953r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Oi4jUVTD6ycPdzvYBP8T+rY1x1IUvcpUVTHSlQ5ZZHM=\"},\"F-102797r1_fix\",\"V-97113\",\"medium\",\"SRG-NET-000166-VPN-000590\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38024,\"SV-106251r1_rule\",\"medium\",null,null,\"The VPN Gateway must map the authenticated identity to the user account for PKI-based authentication.\",\"SRG-NET-000166-VPN-000590\",\"Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of a user (e.g., VPN or ALG. This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MRKxPi/bbsDz8wNN9vXmb7hhgMU8M3+JU6oyqsrMnZk=\"},\"C-95955r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pSURQgwBF8TrM2BF5TWiE9Mm2xRU9ilNiN8qenfhfhs=\"},\"F-102799r1_fix\",\"V-97115\",\"medium\",\"SRG-NET-000168-VPN-000600\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38025,\"SV-106253r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).\",\"SRG-NET-000168-VPN-000600\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nNonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through either an external network (e.g., the Internet) or an internal network.\\n\\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\\n\\nApplications also include HMAC, KDFs, Random Bit Generation, and hash-only applications (e.g., hashing passwords and using SHA-1 or higher to compute a checksum). For digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use where needed.\\n\\nSeparate requirements for configuring applications and protocols used by each product (e.g., SNMPv3, SSH, NTP, and other protocols and applications that require server/client authentication) are required to implement this requirement.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:L26csqRjhPU0fgblV8qX1BlmvtAHZjw4Yyp+bb0mDKw=\"},\"C-95957r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:srWnJLZc/eBKJFIWlsEIupfvJph4j2NGvFXosOihlzk=\"},\"F-102801r1_fix\",\"V-97117\",\"medium\",\"SRG-NET-000169-VPN-000610\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38026,\"SV-106255r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).\",\"SRG-NET-000169-VPN-000610\",\"Lack of authentication and identification enables non-organizational users to gain access to the network or possibly a VPN gateway that provides opportunity for intruders to compromise resources within the network infrastructure.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of a non-organizational user.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OyTG982E0CMxr4y2rmBaYCCpTY7srBWAv/cZQUt/Y+w=\"},\"C-95959r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1p/ev5FaVReOsAiB4Yypz9PuTHTIq8DZEOVu8/pAPZo=\"},\"F-102803r1_fix\",\"V-97119\",\"medium\",\"SRG-NET-000205-VPN-000710\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38027,\"SV-106257r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to route sessions to an IDPS for inspection.\",\"SRG-NET-000205-VPN-000710\",\"Remote access devices, such as those providing remote access to network devices and information systems, which lack automated, capabilities increase risk and makes remote user access management difficult at best.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nAutomated monitoring of remote access sessions allows organizations to detect cyber attacks and ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, from a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lOVVOo0oYWR1BZZb2TwnHXMbM18YttAN6G4GrHPWbyw=\"},\"C-95961r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lQAodzF2vAPdkyT4THpjERChTagkjNx3KaYEZBi/5HM=\"},\"F-102805r1_fix\",\"V-97121\",\"low\",\"SRG-NET-000213-VPN-000720\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38028,\"SV-106259r1_rule\",\"low\",null,null,\"The VPN Gateway must terminate all network connections associated with a communications session at the end of the session.\",\"SRG-NET-000213-VPN-000720\",\"Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These “orphaned” sessions use up valuable router resources and can be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keep alive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the TCP keep alive message, the sending router will clear the connection and free resources allocated to the session.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZitF7N9m7tBrFLBSFvvFyer2Cj1EN7TGddhFoon9a2g=\"},\"C-95963r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:EuB8U2wr3QUgtcHmLsicOw6VzQ5t4flKS602zwr3K7I=\"},\"F-102807r1_fix\",\"V-97123\",\"medium\",\"SRG-NET-000230-VPN-000770\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38029,\"SV-106261r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.\",\"SRG-NET-000230-VPN-000770\",\"Unapproved mechanisms that are used for authentication to the cryptographic module are not verified, and therefore cannot be relied upon to provide confidentiality or integrity and DoD data may be compromised.\\n\\nVPN gateways utilizing encryption are required to use FIPS compliant mechanisms for authenticating to cryptographic modules.\\n\\nFIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uJQ31o/f/Vqkllw6K1glewYI9Xlo0bRZIER2AGlLICw=\"},\"C-95965r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5d33UFWeSYVRhZGzYH0+0+VJ6rVugjCYj6LlTRa+nqY=\"},\"F-102809r1_fix\",\"V-97125\",\"high\",\"SRG-NET-000230-VPN-000780\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38030,\"SV-106263r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use Internet Key Exchange (IKE) with SHA-1 or greater to protect the authenticity of communications sessions.\",\"SRG-NET-000230-VPN-000780\",\"Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/SOA will require the use of mutual authentication (two-way/bidirectional).\\n\\nAn IPsec Security Associations (SA) is established using either IKE or manual configuration.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KPLBOeYMBZIxBbaWyihbjnI+iXUnrab0mkIE2hzbTk8=\"},\"C-95967r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QTXhy5bkfpQRsWuE/X3R1behSbs9HPpQP63IlKE7Z9A=\"},\"F-102811r1_fix\",\"V-97127\",\"medium\",\"SRG-NET-000231-VPN-000790\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38031,\"SV-106265r1_rule\",\"medium\",null,null,\"The VPN Gateway must invalidate session identifiers upon user logoff or other session termination.\",\"SRG-NET-000231-VPN-000790\",\"Captured sessions can be reused in \\\"replay\\\" attacks. This requirement limits the ability of adversaries from capturing and continuing to employ previously valid session IDs.\\n\\nSession IDs are tokens generated by web applications to uniquely identify an application user's session. Unique session identifiers or IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. When a user logs out, or when any other session termination event occurs, the VPN gateway must terminate the user session to minimize the potential for an attacker to hijack that particular user session.\\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet.\\n\\nThis requirement applies only to any VPN gateway that is an intermediary of individual sessions (e.g., proxy, ALG, or SSL VPN). This requirement focuses on communications protection at the application session, versus network packet level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p+iB5XlL+If6inJuLfQ+r3VNT86JXC5NhnV2vOeozxg=\"},\"C-95969r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tbmOT/VG86p0EWsjZLm3s8Y4/9kcKFGaAevpuHrUlfg=\"},\"F-102813r1_fix\",\"V-97129\",\"medium\",\"SRG-NET-000233-VPN-000800\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38032,\"SV-106267r1_rule\",\"medium\",null,null,\"The VPN Gateway must recognize only system-generated session identifiers.\",\"SRG-NET-000233-VPN-000800\",\"VPN gateways (depending on function) utilize sessions and session identifiers to control application behavior and user access. If an attacker can guess the session identifier, or can inject or manually insert session information, the valid user's application session can be compromised.\\n\\nUnique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions.\\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet.\\n\\nThis requirement applies to any VPN gateway that is an intermediary of individual sessions (e.g., proxy, ALG, TLS VPN). VPN gateways that perform these functions must be able to identify which session identifiers were generated when the sessions were established.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ktJIe/Y+HEIOo7bAwQCz3X/2hQkiqoTyl8BVpkZpHYk=\"},\"C-95971r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TniVNe2bo64DYrBZv1sEf0zR9SKcbwn0jWfXR3l8iz0=\"},\"F-102815r1_fix\",\"V-97131\",\"medium\",\"SRG-NET-000234-VPN-000810\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38033,\"SV-106269r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.\",\"SRG-NET-000234-VPN-000810\",\"Both IPsec and TLS gateways use the RNG to strengthen the security of the protocols. Using a weak RNG will weaken the protocol and make it more vulnerable.\\n\\nUse of a FIPS validated RNG that is not DRGB mitigates to a CAT III.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D9gD2h3b8ZDEWmQokEZllnWlmTLY7M//Hjdn7DqBOf8=\"},\"C-95973r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KB4RBRRC9piCCQ/V/rwpAJ5Z4Df6Bh3k50+VVARART8=\"},\"F-102817r1_fix\",\"V-97133\",\"medium\",\"SRG-NET-000235-VPN-000820\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38034,\"SV-106271r1_rule\",\"medium\",null,null,\"The VPN Gateway must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.\",\"SRG-NET-000235-VPN-000820\",\"Failure to a known safe state helps prevent systems from failing to a state that may cause loss of data or unauthorized access to system resources. VPN gateways that fail suddenly and with no incorporated failure state planning may leave the hosting system available but with a reduced security protection capability. Preserving information system state information also facilitates system restart and return to the operational mode of the organization with less disruption to mission-essential processes.\\n\\nAbort refers to stopping a program or function before it has finished naturally. The term abort refers to both requested and unexpected terminations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:72eP2Vo/dCHVQ+6f/2RQyYnBi119Hq+RWYm1m2WqoLc=\"},\"C-95975r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KOCFObJ10AgHLn2PIX9FSde4QkGSCpnBOYQLWTFTSDo=\"},\"F-102819r1_fix\",\"V-97135\",\"medium\",\"SRG-NET-000313-VPN-001050\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38035,\"SV-106273r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to perform an organization-defined action if the audit reveals unauthorized activity.\",\"SRG-NET-000313-VPN-001050\",\"Remote access devices, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and makes remote user access management difficult at best.\\n\\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\\n\\nRemote access functionality, such as remote access servers, VPN concentrators, and IDS/IPS devices, must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:w9yL+z+t1qYSt9kk+sxVflN/xG/naaJ9QP4VRCcqw6Q=\"},\"C-95977r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:COjdhT7YeatypyTtARxEDYM/VBCnUmEevQq0bspvHSk=\"},\"F-102821r1_fix\",\"V-97137\",\"medium\",\"SRG-NET-000314-VPN-001060\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38036,\"SV-106275r1_rule\",\"medium\",null,null,\"The VPN Gateway administrator accounts or security policy must be configured to allow the system administrator to immediately disconnect or disable remote access to devices and/or users when needed.\",\"SRG-NET-000314-VPN-001060\",\"Without the ability to immediately disconnect or disable remote access, an attack or other compromise taking progress would not be immediately stopped.\\n\\nRemote access functionality must have the capability to immediately disconnect current users remotely accessing the information system and/or disable further remote access. The speed of disconnect or disablement varies based on the criticality of mission functions and the need to eliminate immediate or future remote access to organizational information systems.\\n\\nThe remote access functionality (e.g., VPN, ALG, and RAS) may implement features, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:afNm41YNd2Z2QwHOtNNm/ZsgKpPtQhY3FaPrGqRWnTw=\"},\"C-95979r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HIQBC9ZU7AuTIdllzK3oRjj9cc4DrzRsdkjLzrUOnSE=\"},\"F-102823r1_fix\",\"V-97139\",\"high\",\"SRG-NET-000317-VPN-001090\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38037,\"SV-106277r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use AES encryption for the Internet Key Exchange (IKE) proposal to protect confidentiality of remote access sessions.\",\"SRG-NET-000317-VPN-001090\",\"Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nAES is the FIPS-validated cipher block cryptographic algorithm approved for use in DoD. For an algorithm implementation to be listed on a FIPS 140-2 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. Currently, NIST has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:n4616xCQqSEJ5LDbI/BvogDwAhTFLCqs6qsCNm2y6qM=\"},\"C-95981r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:o94iAavW4v2w03yRo2xl3upVmak75NTVDj/Dy2pNCbA=\"},\"F-102825r1_fix\",\"V-97141\",\"medium\",\"SRG-NET-000320-VPN-001120\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38038,\"SV-106279r1_rule\",\"medium\",null,null,\"The VPN Gateway must transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.\",\"SRG-NET-000320-VPN-001120\",\"Protecting authentication communications between the client, the VPN Gateway, and the authentication server keeps this critical information from being exploited.\\n\\nIn distributed information systems, authorization processes and access control decisions may occur in separate parts of the systems. In such instances, authorization information is transmitted securely so timely access control decisions can be enforced at the appropriate locations. To support the access control decisions, it may be necessary to transmit as part of the access authorization information, supporting security attributes. This is due to the fact that in distributed information systems, there are various access control decisions that need to be made and different entities (e.g., services) make these decisions in a serial fashion, each requiring some security attributes to make the decisions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qrumTMQiLLqavZ4GBAcbIfp6Kibky5yDpODJYsUNU6k=\"},\"C-95983r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:liEE0SFmmeFRP77fVgYsXwcMaxPrYjZRWHQv5JaTXXg=\"},\"F-102827r1_fix\",\"V-97143\",\"low\",\"SRG-NET-000330-VPN-001220\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38039,\"SV-106281r1_rule\",\"low\",null,null,\"The VPN Gateway must notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).\",\"SRG-NET-000330-VPN-001220\",\"Users need to be aware of activity that occurs regarding their account. Providing users with information deemed important by the organization may aid in the discovery of unauthorized access or thwart a potential attacker.\\n\\nOrganizations should consider the risks to the specific information system being accessed and the threats presented by the device to the environment when configuring this option. An excessive or unnecessary amount of information presented to the user at logon is not recommended.\\n\\nThis requirement applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bzo/kYUviBi8fH0VVF4kMJsdAnZOcFeOl3REDgnED8o=\"},\"C-95985r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:P8pkANj/XLaqdv6hJakyvgLuueJH8cGpKoldzmEq82g=\"},\"F-102829r1_fix\",\"V-97145\",\"medium\",\"SRG-NET-000333-VPN-001250\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38040,\"SV-106283r1_rule\",\"medium\",null,null,\"The VPN Gateway must provide centralized management and configuration of the content to be captured in log records generated by all network components.\",\"SRG-NET-000333-VPN-001250\",\"Without the ability to centrally manage the content captured in the log records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack.\\n\\nThe content captured in log records must be managed from a central location (necessitating automation). Centralized management of log records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Network components requiring centralized audit log management must have the capability to support centralized management.\\n\\nThe DoD requires centralized management of all network component audit record content.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cvSX2fNtb/9d5KoCFv38r/vk1P66QvbknutRPO++RHQ=\"},\"C-95987r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4LMA3u9siEI56MkwasqV8o7t4fUD89q8QT8ld4InCNY=\"},\"F-102831r1_fix\",\"V-97147\",\"medium\",\"SRG-NET-000334-VPN-001260\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38041,\"SV-106285r1_rule\",\"medium\",null,null,\"The VPN Gateway must off-load audit records onto a different system or media than the system being audited.\",\"SRG-NET-000334-VPN-001260\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rpLsrhPbwk1f+JYoA5pOhGpi71+wEYHZA7WhvDHOZ+M=\"},\"C-95989r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ZbcudZvV1BQEgFZtq1Hz/2teLVGVbnWW0bcryt+9lXk=\"},\"F-102833r1_fix\",\"V-97149\",\"medium\",\"SRG-NET-000335-VPN-001270\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38042,\"SV-106287r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.\",\"SRG-NET-000335-VPN-001270\",\"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected.\\n\\nAlerts provide organizations with urgent messages. Automated alerts can be conveyed in a variety of ways, including, for example, telephonically, via electronic mail, via text message, or via websites. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded.\\n\\nWhile this requirement also applies to the event monitoring system (e.g., Syslog, Security Information and Event Management [SIEM], or SNMP servers), the VPN Gateway must also be configured to generate a message to the administrator console.\\n\\nThe VPN daemon facility and log facility are messages in the log, which capture actions performed or errors encountered by system processes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lKiTDkfAGyG9SqJoJw3IBMHEt9m1XfYEXjJcJ6N2O4I=\"},\"C-95991r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:98ovgM7bqc4Ya1AKRRjI0MOMt8I2xMdngADds6VQJgc=\"},\"F-102835r1_fix\",\"V-97151\",\"medium\",\"SRG-NET-000336-VPN-001280\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38043,\"SV-106289r1_rule\",\"medium\",null,null,\"When communications with the Central Log Server is lost, the VPN Gateway must continue to queue traffic log records locally.\",\"SRG-NET-000336-VPN-001280\",\"If the system were to continue processing after audit failure, actions can be taken on the system that cannot be tracked and recorded for later forensic analysis.\\n\\nBecause of the importance of ensuring mission/business continuity, organizations may determine that the nature of the audit failure is not so severe that it warrants a complete shutdown of the application supporting the core organizational missions/business operations. In those instances, partial application shutdowns or operating in a degraded mode with reduced capability may be viable alternatives.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fVzjNA9x7fe7XKuKOy79M7wLwKGgdGCnV3TChwORocM=\"},\"C-95993r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:7kFOvG6IkBGOVLyO9MRlIA10BFwkb7/m/gpclcr3GP8=\"},\"F-102837r1_fix\",\"V-97153\",\"medium\",\"SRG-NET-000337-VPN-001290\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38044,\"SV-106291r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must renegotiate the security association after 8 hours or less, or an organization-defined period.\",\"SRG-NET-000337-VPN-001290\",\"The IPsec SA and its corresponding key will expire either after the number of seconds or amount of traffic volume has exceeded the configured limit. A new SA is negotiated before the lifetime threshold of the existing SA is reached to ensure that a new SA is ready for use when the old one expires. The longer the lifetime of the IPsec SA, the longer the lifetime of the session key used to protect IP traffic. The SA is less secure with a longer lifetime because an attacker has a greater opportunity to collect traffic encrypted by the same key and subject it to cryptanalysis. However, a shorter lifetime causes IPsec peers to renegotiate Phase II more often resulting in the expenditure of additional resources.\\n\\nSpecify the lifetime (in seconds) of an Internet Key Exchange (IKE) security association (SA). When the SA expires, it is replaced by a new SA, the security parameter index (SPI), or terminated if the peer cannot be contacted for renegotiation.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yIMWyLqQ5KjJhVIE0sO7kOy3MFZ/mr8G1UsF2vpFezs=\"},\"C-95995r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HEQrvy4/s8jokXmlLC3sxlKZoNheJdGUClzKnI45P1o=\"},\"F-102839r1_fix\",\"V-97155\",\"medium\",\"SRG-NET-000337-VPN-001300\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38045,\"SV-106293r1_rule\",\"medium\",null,null,\"The VPN Gateway must renegotiate the security association after 24 hours or less or as defined by the organization.\",\"SRG-NET-000337-VPN-001300\",\"When a VPN gateway creates an IPsec Security Association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway’s inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3Vk1c0ULGwB+JNxtAcJe82imefTrQUiXMXW0gSoV5sI=\"},\"C-95997r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:xBCJWam1YJOEk/Y3uRcCt4tDlmUHwgij/XAGpODs0PQ=\"},\"F-102841r1_fix\",\"V-97157\",\"medium\",\"SRG-NET-000341-VPN-001350\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38046,\"SV-106295r1_rule\",\"medium\",null,null,\"The VPN Gateway must accept Personal Identity Verification (PIV) credentials.\",\"SRG-NET-000341-VPN-001350\",\"The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\\n\\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U2xkrpdDd5fbE89oPVhqhnurz+BzWOL7MBkXI3iyc44=\"},\"C-95999r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:DWEbV0DVPuJ7OTfvbUkhrgxsgpWLM8sKjC8MjkQOMA4=\"},\"F-102843r1_fix\",\"V-97159\",\"medium\",\"SRG-NET-000342-VPN-001360\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38047,\"SV-106297r1_rule\",\"medium\",null,null,\"The VPN Gateway must electronically verify Personal Identity Verification (PIV) credentials.\",\"SRG-NET-000342-VPN-001360\",\"The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\\n\\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tY5W3SOCbPKTMPPTVFP0FpXqFdrxc15JZY9C5N1Jp3E=\"},\"C-96015r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C2DPURp+P/TJg1Bmt9fhJFi9259gGRXNzSqAORnuD3g=\"},\"F-102859r1_fix\",\"V-97177\",\"medium\",\"SRG-NET-000343-VPN-001370\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38048,\"SV-106315r1_rule\",\"medium\",null,null,\"The VPN Gateway must authenticate all network-connected endpoint devices before establishing a connection.\",\"SRG-NET-000343-VPN-001370\",\"Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\\n\\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions.\\n\\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers (outside a datacenter), VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.\\n\\nDevice authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bVroOwdA0e1yfLelH5K0/LjEPzRuPTDt+xgTDMzMsWA=\"},\"C-96017r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y/+l8kwggjnCbQ11WRfSGhCjui6kGNchR0wer8LCVos=\"},\"F-102861r1_fix\",\"V-97179\",\"medium\",\"SRG-NET-000352-VPN-001460\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38049,\"SV-106317r1_rule\",\"medium\",null,null,\"The VPN Gateway must use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.\",\"SRG-NET-000352-VPN-001460\",\"Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.\\n\\nThe National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by NIST and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future required Suite B implementations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1maPMRSAJQc9CCcE9i3+e/pBNygIhmu9m1GajIh4WrA=\"},\"C-96019r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:c81cg0K0ERMsQOfw3hMhzc4N9PuesRPEfIK2UBPat/E=\"},\"F-102863r1_fix\",\"V-97181\",\"medium\",\"SRG-NET-000369-VPN-001620\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38050,\"SV-106319r1_rule\",\"medium\",null,null,\"The VPN Gateway must disable split-tunneling for remote clients VPNs.\",\"SRG-NET-000369-VPN-001620\",\"Split tunneling would in effect allow unauthorized external connections, making the system more vulnerable to attack and to exfiltration of organizational information.\\n\\nA VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the Internet. With split tunneling enabled, a remote client has access to the Internet while at the same time has established a secured path to the enclave via an IPsec tunnel. A remote client connected to the Internet that has been compromised by an attacker in the Internet, provides an attack base to the enclave’s private network via the IPsec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:W5E6fpSFPSjZsDhRm6JBdbhvWCdb4iIQ29kz4GWDM20=\"},\"C-96021r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PzvaYVGXC+ztLTE2ZozeA+R4K4I1v/fBf/opSADlvJ0=\"},\"F-102865r1_fix\",\"V-97183\",\"medium\",\"SRG-NET-000371-VPN-001640\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38051,\"SV-106321r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.\",\"SRG-NET-000371-VPN-001640\",\"PFS generates each new encryption key independently from the previous key. Without PFS, compromise of one key will compromise all communications.\\n\\nThe phase 2 (Quick Mode) Security Association (SA) is used to create an IPsec session key. Hence, its rekey or key regeneration procedure is very important. The phase 2 rekey can be performed with or without Perfect Forward Secrecy (PFS). With PFS, every time a new IPsec Security Association is negotiated during the Quick Mode, a new Diffie-Hellman (DH) exchange occurs. The new DH shared secret will be included with original keying material (SYKEID_d, initiator nonce, and responder nonce from phase 1 for generating a new IPsec session key. If PFS is not used, the IPsec session key will always be completely dependent on the original keying material from the Phase-1. Hence, if an older key is compromised at any time, it is possible that all new keys may be compromised.\\n\\nThe DH exchange is performed in the same manner as was done in phase 1 (Main or Aggressive Mode). However, the phase 2 exchange is protected by encrypting the phase 2 packets with the key derived from the phase 1 negotiation. Because DH negotiations during phase 2 are encrypted, the new IPsec session key has an added element of secrecy.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rqcFP9ktgfb343ahB5Mv16lTwTPf1/ELOUg9C3CgAj8=\"},\"C-96023r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:j/fsWDohMzN1oclh4BAauCakys23bebITKpZxWpK2Qk=\"},\"F-102867r1_fix\",\"V-97185\",\"high\",\"SRG-NET-000371-VPN-001650\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38052,\"SV-106323r1_rule\",\"high\",null,null,\"The VPN Gateway and Client must be configured to protect the confidentiality and integrity of transmitted information.\",\"SRG-NET-000371-VPN-001650\",\"Without protection of the transmitted information, confidentiality and integrity may be compromised as unprotected communications can be intercepted and either read or altered.\\n\\nThis requirement also applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification.\\n\\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.\\n\\nFor example, configure all ISAKMP policies to use AES for Internet Key Exchange (IKE) cryptographic encryption operations and SHA-1 to protect data integrity.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+vnSRs+ZokA+P5inP7i24jyzDoJ+8dRGwCZAF72bzfw=\"},\"C-96025r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:F3uzs5G3+v3iJx/kCrPtcrdW/gsCjZHZOAXufRJxNgY=\"},\"F-102869r1_fix\",\"V-97187\",\"medium\",\"SRG-NET-000375-VPN-001690\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38053,\"SV-106325r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.\",\"SRG-NET-000375-VPN-001690\",\"ESP provides confidentiality, data origin authentication, integrity, and anti-replay services within the IPsec suite of protocols. ESP in tunnel mode ensures a secure path for communications for site-to-site VPNs and gateway to endpoints, including header information.\\n\\nESP can be deployed in either transport or tunnel mode. Transport mode is used to create a secured session between two hosts. It can also be used when two hosts simply want to authenticate each IP packet with IPsec authentication header (AH). With ESP transport mode, only the payload (transport layer) is encrypted, whereas with tunnel mode, the entire IP packet is encrypted and encapsulated with a new IP header. Tunnel mode is used to encrypt traffic between secure IPsec gateways or between an IPsec gateway and an end-station running IPsec software. Hence, it is the only method to provide a secured path to transport traffic between remote sites or end-stations and the central site.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fU8zq6dLn1EHMKbL2KwqzdBun1CXedlYFT1NSzY5Zw0=\"},\"C-96027r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:AN4m35Ma+yxdnoD7gJy8bvR+ZHLR8Sqmd04QY4ipeyM=\"},\"F-102871r1_fix\",\"V-97189\",\"medium\",\"SRG-NET-000400-VPN-001940\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38054,\"SV-106327r1_rule\",\"medium\",null,null,\"For site-to-site VPN, for accounts using password authentication, the VPN Gateway must use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.\",\"SRG-NET-000400-VPN-001940\",\"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThe information system must specify the hash algorithm used for authenticating passwords. Implementation of this requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GOcfn7YCnFViHL4Sv9yLScid+jFSlnVek7L1omc1Mjw=\"},\"C-96029r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4MYR7ku3/EgXleyLtcxftc2BDi8OAuC5GMzuGE2BIhY=\"},\"F-102873r1_fix\",\"V-97191\",\"medium\",\"SRG-NET-000492-VPN-001980\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38055,\"SV-106329r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records when successful and/or unsuccessful VPN connection attempts occur.\",\"SRG-NET-000492-VPN-001980\",\"Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\\n\\nLog records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nThis requirement only applies to components where this is specific to the function of the device, such as application layer gateway (ALG), which provides these access control and auditing functions on behalf of an application. This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D0/SC7O2V3JZ4+Sewx7Qn6Z7ZSrkdje8orXuKxcEjpo=\"},\"C-96031r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NNq3b5rAHl25ZbWpIy/Y+Q7WJgEfjrSCsg45dAZ/hYA=\"},\"F-102875r1_fix\",\"V-97193\",\"medium\",\"SRG-NET-000510-VPN-002160\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38056,\"SV-106331r1_rule\",\"medium\",null,null,\"The VPN Gateway must use a FIPS-validated cryptographic module to generate cryptographic hashes.\",\"SRG-NET-000510-VPN-002160\",\"FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plain text. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.\\n\\nThe cryptographic module used must have at least one validated hash algorithm. This validated hash algorithm must be used to generate cryptographic hashes for all cryptographic security function within the product being evaluated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GNvczQqQ8RSDNiGZgHykTH9Fl/06XwpsXibtlkPH4AM=\"},\"C-96033r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wpU2wZ1uyf3RUQgJzjcuMubJFwKQTMsVYABGtyetAu0=\"},\"F-102877r1_fix\",\"V-97195\",\"medium\",\"SRG-NET-000510-VPN-002170\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38057,\"SV-106333r1_rule\",\"medium\",null,null,\"The VPN Gateway must use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.\",\"SRG-NET-000510-VPN-002170\",\"FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plain text. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.\\n\\nThe cryptographic module used must have one FIPS-validated encryption algorithm (i.e., validated Advanced Encryption Standard [AES]). This validated algorithm must be used for encryption for cryptographic security function within the product being evaluated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nrioFfQyWAyHyqPYTDE2+pXaDoeycQE/PjC2vrEL9Jo=\"},\"C-96035r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zi3v1EJgN7RWCshcZkpIFWwckY19Ow6NkWzZdajmLjM=\"},\"F-102879r1_fix\",\"V-97197\",\"medium\",\"SRG-NET-000510-VPN-002180\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38058,\"SV-106335r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway IKE must use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.\",\"SRG-NET-000510-VPN-002180\",\"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hDgoEHbOPyCRLlTAZ0Qqx1kkok77I93P01NwpDJNEE8=\"},\"C-96037r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qUzVSTw+n8v2UFfLxBraBDENI28bgIEBRVGPthivu9U=\"},\"F-102881r1_fix\",\"V-97199\",\"high\",\"SRG-NET-000512-VPN-002220\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38059,\"SV-106337r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use Internet Key Exchange (IKE) for IPsec VPN Security Associations (SAs).\",\"SRG-NET-000512-VPN-002220\",\"Without IKE, the SPI is manually specified for each security association. IKE peers will negotiate the encryption algorithm and authentication or hashing methods as well as generate the encryption keys.\\n\\nAn IPsec SA is established using either Internet Key Exchange (IKE) or manual configuration. When using IKE, the security associations are established when needed and expire after a period of time or volume of traffic threshold. If manually configured, they are established as soon as the configuration is complete at both end points and they do not expire. When using IKE, the Security Parameter Index (SPI) for each security association is a pseudo-randomly derived number.\\n\\nWith manual configuration of the IPsec security association, both the cipher key and authentication key are static. Hence, if the keys are compromised, the traffic being protected by the current IPsec tunnel can be decrypted as well as traffic in any future tunnels established by this SA. Furthermore, the peers are not authenticated prior to establishing the SA, which could result in a rogue device establishing an IPsec SA with either of the VPN end points.\\n\\nIKE provides primary authentication to verify the identity of the remote system before negotiation begins. This feature is lost when the IPsec security associations are manually configured, which results in a non-terminating session using static pre-shared keys.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IzzOyrG05CKpFAWFrkEoNJ5rxjb3elkLNtjevgCQdtw=\"},\"C-96039r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:xx84wPMsMSSAo4CeASGVN5MvUIu7DiKqar4aWbsOerA=\"},\"F-102883r1_fix\",\"V-97201\",\"high\",\"SRG-NET-000512-VPN-002230\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38060,\"SV-106339r1_rule\",\"high\",null,null,\"The VPN Gateway must not accept certificates that have been revoked when using PKI for authentication.\",\"SRG-NET-000512-VPN-002230\",\"Situations may arise in which the certificate issued by a Certificate Authority (CA) may need to be revoked before the lifetime of the certificate expires. For example, the certificate is known to have been compromised.\\n\\nWhen an incoming Internet Key Exchange (IKE) session is initiated for a remote client or peer whose certificate is revoked, the revocation list configured for use by the VPN server is checked to see if the certificate is valid; if the certificate is revoked, IKE will fail and an IPsec security association will not be established for the remote endpoint.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GrHgK/pBnHrsn1Seh0qJujIqrWqRLPE0eaA+ZAqQMjo=\"},\"C-96041r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:X8wHzcaz0980HXxuy93EVyk4VDWyVtsDF0WbqVlaX/w=\"},\"F-102885r1_fix\",\"V-97203\",\"medium\",\"SRG-NET-000518-VPN-002280\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38061,\"SV-106341r1_rule\",\"medium\",null,null,\"The VPN Client logout function must be configured to terminate the session on/with the VPN Gateway.\",\"SRG-NET-000518-VPN-002280\",\"If a user cannot explicitly end a session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session.\\n\\nHowever, for some types of interactive sessions including, for example, remote login, information systems typically send logout messages as final messages prior to terminating sessions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+WzKvuFJw2Hd2tINf3CAdDXjeroLc9pIuZQ8rxqAqW8=\"},\"C-96043r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+tCpOllw27HEiCrQcnfBz1Mp9uGAIFb0WolLkLykCm4=\"},\"F-102887r1_fix\",\"V-97205\",\"medium\",\"SRG-NET-000519-VPN-002290\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38062,\"SV-106343r1_rule\",\"medium\",null,null,\"The VPN Client must display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.\",\"SRG-NET-000519-VPN-002290\",\"If a user cannot explicitly end a session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. Users need to be aware of whether or not the session has been terminated.\\n\\nLogout messages for access, for example, can be displayed after authenticated sessions have been terminated. However, for some types of interactive sessions including, for example, remote login, information systems typically send logout messages as final messages prior to terminating sessions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WFTjVjonYKh95+ufS3SeRtMzKzxvcuYhkuGqLkDzAdQ=\"},\"C-96045r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fy0MhQs22gOsjCy8Ui4Xr8MpXyFw2N5p7qTSc67sOzM=\"},\"F-102889r1_fix\",\"V-97207\",\"medium\",\"SRG-NET-000522-VPN-002320\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38063,\"SV-106345r1_rule\",\"medium\",null,null,\"For site-to-site VPN Gateway must store only cryptographic representations of Pre-shared Keys (PSKs).\",\"SRG-NET-000522-VPN-002320\",\"Pre-shared keys need to be protected at all times, and encryption is the standard method for protecting passwords. If PSKs are not encrypted, they can be plainly read and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\\n\\nPSKs used for site-to-site VPNs are considered by the SRG as a type of password. If this shared secret is already encrypted and not in plaintext, this meets this requirement. This requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption. This method uses a one-way hashing encryption algorithm with a salt value to validate a user's password without having to store the actual password. Performance and time required to access are factors that must be considered, and the one-way hash is the most feasible means of securing the password and providing an acceptable measure of password security.\\n\\nUse a keyed hash message authentication code (HMAC). HMAC calculates a message authentication code via a cryptographic hash function used in conjunction with an encryption key. The key must be protected as with any private key.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WvHtCxF8aHRpizWQnHhcRWZ2GSo4LpYF4C+7vAKUMGY=\"},\"C-96047r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lOGJxdtWr9FVthiaj/+UbIRNwkTQqM0TzcIWviq/0Jk=\"},\"F-102891r1_fix\",\"V-97209\",\"high\",\"SRG-NET-000525-VPN-002330\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38064,\"SV-106347r1_rule\",\"high\",null,null,\"The IPsec VPN must use Advanced Encryption Standard (AES) encryption for the IPsec proposal to protect the confidentiality of remote access sessions.\",\"SRG-NET-000525-VPN-002330\",\"Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nA block cipher mode is an algorithm that features the use of a symmetric key block cipher algorithm to provide an information service, such as confidentiality or authentication.\\n\\nAES is the FIPS-validated cipher block cryptographic algorithm approved for use in DoD. For an algorithm implementation to be listed on a FIPS 140-2 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. Currently, NIST has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hK46dRZBIlXNdxH/0rgMhBXqrBF8nwMTFp1UUvsZ2/w=\"},\"C-96049r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:f3H1Fnk3Mq9sTlW4p0spIywjLsmMT5ZgZN+1SV7bU2U=\"},\"F-102893r1_fix\",\"V-97211\",\"medium\",\"SRG-NET-000530-VPN-002340\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38065,\"SV-106349r1_rule\",\"medium\",null,null,\"The TLS VPN Gateway that supports Government-only services must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.\",\"SRG-NET-000530-VPN-002340\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nThis requirement applies to TLS gateways (also known as SSL gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Oyy/mFzHcQy1sAgTQ9gS+b99/s9IcmH4xTl+n0Pf6Rw=\"},\"C-96051r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tG7QZxAuAcqmA4gmuAeWEA9ZEnLVfGT5NFaUDibQfFE=\"},\"F-102895r1_fix\",\"V-97213\",\"medium\",\"SRG-NET-000540-VPN-002350\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38066,\"SV-106351r1_rule\",\"medium\",null,null,\"The TLS VPN Gateway that supports citizen- or business-facing network devices must prohibit client negotiation to SSL 2.0 or SSL 3.0.\",\"SRG-NET-000540-VPN-002350\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nThis requirement applies to public-facing or external-facing devices such as TLS gateways (also known as SSL gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance.\\n\\nThe minimum TLS version required by DoD is 1.2. However, devices and applications may allow client negotiation for systems supporting citizen- and business-facing applications. These devices may be configured to support TLS version 1.1 and 1.0 to enable interaction with citizens and businesses. These devices must not support SSL version 3.0 or earlier.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0WoWCtzpWtYJ2vxCT7vXvLruiskYzBOwEVdaxJWlGbM=\"},\"C-96053r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nHHSH5iwaGyboJNtWTygHWn0yTU3Rug61FYQH6Ni/Ek=\"},\"F-102897r1_fix\",\"V-97215\",\"medium\",\"SRG-NET-000550-VPN-002360\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38067,\"SV-106353r1_rule\",\"medium\",null,null,\"The VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.\",\"SRG-NET-000550-VPN-002360\",\"Without device-to-device authentication, communications with malicious devices may be established. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk.\\n\\nSNMPv3 supports authentication, authorization, access control, and privacy while previous versions of the protocol contained well-known security weaknesses, which were easily exploited. SNMPv3 can be configured for identification and bidirectional, cryptographically based authentication.\\n\\nA typical SNMP implementation includes three components: Managed device, SNMP agent, and NMS. The SNMP agent is the SNMP process that resides on the managed device and communicates with the network management system. The NMS is a combination of hardware and software that is used to monitor and administer a network. The SNMP data is stored in a highly-structured, hierarchical format known as a management information base (MIB). The SNMP manager collects information about network connectivity, activity, and events by polling managed devices.\\n\\nSNMPv3 defines a user-based security model (USM), and a view-based access control model (VACM). SNMPv3 USM provides data integrity, data origin authentication, message replay protection, and protection against disclosure of the message payload. SNMPv3 VACM provides access control to determine whether a specific type of access (read or write) to the management information is allowed. Implement both VACM and USM for full protection.\\n\\nSNMPv3 server services must not be configured on products whose primary purpose is not to provide SNMP services. SNMP client services may be configured on the VPN gateway, application, or operating system to allow limited monitoring or querying of the device from by an SNMP server for management purposes. SNMP of any version will not be used to make configuration changes to the device. SNMPv3 must be disabled by default and enabled only if used. SNMP v3 provides security feature enhancements to SNMP, including encryption and message authentication.\\n\\nCurrently, the AES cipher block algorithm can be used for both applying cryptographic protection (e.g., encryption) and removing or verifying the protection that was previously applied (e.g., decryption) in DoD. The use of FIPS-approved algorithms for both cryptographic mechanisms is required. If any version of SNMP is used for remote administration, default SNMP community strings such as “public” and “private” should be removed before real community strings are put into place. If the defaults are not removed, an attacker could retrieve real community strings from the device using the default string.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RFq+xtylI0rdth+CO8xXpnUCA7eBYGNXjStRxU/Sh2g=\"},\"C-96055r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:snkiXNFPpO0+kw0zQco5SKVgkORHDhyOH3PpUq4/k30=\"},\"F-102899r1_fix\",\"V-97217\",\"high\",\"SRG-NET-000565-VPN-002390\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38068,\"SV-106355r1_rule\",\"high\",null,null,\"The VPN Gateway must use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.\",\"SRG-NET-000565-VPN-002390\",\"Use of improperly configured or lower assurance equipment and solutions could compromise high-value information.\\n\\nThe National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by the National Institute of Standards and Technology (NIST) and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future Suite B implementations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p7UCHJrDUnFC2jp6mXGtSAilZeT3BjF1NVmG5ykWcy4=\"},\"C-96057r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KIex1ZGWMlFIxubnYXqgVjEDQ6/8SNR9c5AVbsZNKEA=\"},\"F-102901r1_fix\",\"V-97219\",\"high\",\"SRG-NET-000565-VPN-002400\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38069,\"SV-106357r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway Internet Key Exchange (IKE) must use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.\",\"SRG-NET-000565-VPN-002400\",\"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\\n\\nRFC 6379 Suite B Cryptographic Suites for IPsec defines four cryptographic user interface suites for deploying IPsec. Each suite provides choices for Encapsulating Security Payload (ESP) and IKE. The four suites are differentiated by the choice of IKE authentication and key exchange, cryptographic algorithm strengths, and whether ESP is to provide both confidentiality and integrity or integrity only. The suite names are based on the Advanced Encryption Standard (AES) mode and AES key length specified for ESP. Two suites are defined for transporting classified information up to SECRET level—one for both confidentiality and integrity and one for integrity only. There are also two suites defined for transporting classified information up to TOP SECRET level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F8wZynyPCZXbSCQKsDAa3RDhSkunUmMAhgYUP9Yu014=\"},\"C-96059r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sJ4ufacKRyx88U9iliMjZLvETY3nQgVUnTBTVlqZ1YA=\"},\"F-102903r1_fix\",\"V-97221\",\"medium\",\"SRG-NET-000580-VPN-002410\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38070,\"SV-106359r1_rule\",\"medium\",null,null,\"The VPN Gateway must validate certificates used for Transport Layer Security (TLS) functions by performing RFC 5280-compliant certification path validation.\",\"SRG-NET-000580-VPN-002410\",\"A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate.\\n\\nCertification path validation includes checks such as certificate issuer trust, time validity, and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WOsWkwp7rHKriDcEPQi1g0VQp3X0XA14Kw+soZYNvnw=\"},\"C-96061r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jLNfObMjTtI/+Xyh7vDwZR17rLmudLzlz6NwxhVITKs=\"},\"F-102905r1_fix\",\"V-97223\",\"medium\",\"SRG-NET-000585-VPN-002420\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38071,\"SV-106361r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).\",\"SRG-NET-000585-VPN-002420\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Use only SHA-2 for Digital signature generation applications and functions. SHA-2 is strongly preferred for use by DoD for non-signature generation functions.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\\n\\nFor digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use only if needed for business critical applications.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5JYnVzed7VNQLssmYLnmi+secKLvHnAiNpVnw5LnOy0=\"},\"C-96063r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0MUtJg0aE03Glc9kBOBNI3y2a6+ptn7NTc3Xse+sN6w=\"},\"F-102907r1_fix\",\"V-97225\",\"medium\",\"SRG-NET-000075-VPN-000260\",null,null,null,null,null,\"VPN_SRG_TEST-1-0\",38072,\"SV-106363r1_rule\",\"medium\",null,null,\"If the site-to-site VPN implementation uses L2TP, L2TPv3 sessions must be authenticated prior to transporting traffic.\",\"SRG-NET-000075-VPN-000260\",\"L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP tunnels can also carry IP packets that are very difficult to filter because of the additional encapsulation. Hence, it is imperative that L2TP sessions are authenticated prior to transporting traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vchgPhpapNXqH1070giShdvTrztio49eNJBWV74F3HU=\"},\"C-64053r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:w9I2ThmrWkLjEEgN5LZe5U8Sfp5fyYhIItBlZdSaJLE=\"},\"F-69237r2_fix\",\"V-63319\",\"medium\",\"WN10-00-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41183,\"SV-77809r3_rule\",\"medium\",null,null,\"Domain-joined systems must use Windows 10 Enterprise Edition 64-bit version.\",\"WN10-00-000005\",\"Features such as Credential Guard use virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Virtualization based security and Credential Guard are only available with Windows 10 Enterprise 64-bit version.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kaQFP+qv+/U0A5jz+BdWIpTTdtyktf1MP4WKqmlH3c4=\"},\"C-64055r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kepSgRivzMqHnK/2OMM0E1Wcu7H9wPx3R/EaQdHuCGA=\"},\"F-69239r1_fix\",\"V-63321\",\"medium\",\"WN10-CC-000310\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41184,\"SV-77811r1_rule\",\"medium\",null,null,\"Users must be prevented from changing installation options.\",\"WN10-CC-000310\",\"Installation options for applications are typically controlled by administrators.  This setting prevents users from changing installation options that may bypass security features.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LSSb1gLDf7uiXzn44Bg4EplFPsBwaprDmRrselWEvyE=\"},\"C-94059r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C69LdFRRLIKAEvN52sOWyR1XOoNaliZ20V7Ahi2TgE4=\"},\"F-71517r1_fix\",\"V-63323\",\"medium\",\"WN10-00-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41185,\"SV-77813r6_rule\",\"medium\",null,null,\"Windows 10 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.\",\"WN10-00-000010\",\"Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zv0vssTime65YEhFGjHDqU96ACMkZRxJDowM/Qv+sCo=\"},\"C-64059r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:WYWzs/LVbBJCV5p6sevrFQeIj+kgYqP53QgZoLCvajY=\"},\"F-69243r1_fix\",\"V-63325\",\"high\",\"WN10-CC-000315\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41186,\"SV-77815r1_rule\",\"high\",null,null,\"The Windows Installer Always install with elevated privileges must be disabled.\",\"WN10-CC-000315\",\"Standard user accounts must not be granted elevated privileges.  Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pBxUW2Mg4ubB2d75emmojt2R7TlPrd+/K+K4/cfdRCw=\"},\"C-64061r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sUyefRSp12AcSvLBKGiUxVCfWftGYjo3Xl9Pa+qQv5U=\"},\"F-69245r1_fix\",\"V-63329\",\"medium\",\"WN10-CC-000320\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41187,\"SV-77819r1_rule\",\"medium\",null,null,\"Users must be notified if a web-based program attempts to install software.\",\"WN10-CC-000320\",\"Web-based programs may attempt to install malicious software on a system.  Ensuring users are notified if a web-based program attempts to install software allows them to refuse the installation.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zkVu4Ox1MUjKEwFzsfX/ILQ/ZYHNPsu/JvNQeqZ228Y=\"},\"C-64067r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6kR9cAoufh12SxDcuUMPIlGdSV7Xnh2IK/uFUgsv5vk=\"},\"F-69251r1_fix\",\"V-63333\",\"medium\",\"WN10-CC-000325\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41188,\"SV-77823r1_rule\",\"medium\",null,null,\"Automatically signing in the last interactive user after a system-initiated restart must be disabled.\",\"WN10-CC-000325\",\"Windows can be configured to automatically sign the user back in after a Windows Update restart.  Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fdOFEUfWZvFxvtQyeYZ2AqTmF5GEfPF1uWfwWrblF5o=\"},\"C-64071r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FAsYZP3B2AC9MJAS9X+8yJy62Xj08bP/bThl9CR1e2E=\"},\"F-69255r1_fix\",\"V-63335\",\"high\",\"WN10-CC-000330\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41189,\"SV-77825r1_rule\",\"high\",null,null,\"The Windows Remote Management (WinRM) client must not use Basic authentication.\",\"WN10-CC-000330\",\"Basic authentication uses plain text passwords that could be used to compromise a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WJmapvaFU3fBFpTg+ufcMx2LC53rImDSpxqCEpTRTeE=\"},\"C-94061r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1qz4vDTsDlQKNl7HjZBswvv/xw5Z6+IAI5Vjmop+PuE=\"},\"F-100987r3_fix\",\"V-63337\",\"medium\",\"WN10-00-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41190,\"SV-77827r5_rule\",\"medium\",null,null,\"Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.\",\"WN10-00-000030\",\"If data at rest is unencrypted, it is vulnerable to disclosure.  Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls.   Encrypting the data ensures that confidentiality is protected even when the operating system is not running.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b3jhzOOdG7cVXgpSQQKPwd6xwSdfSPk98Epls0Yl+iY=\"},\"C-64075r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9wQwtSKZvc96iE+h8e50nFFTu3ZivGD9/+QhuwRZZOQ=\"},\"F-69259r1_fix\",\"V-63339\",\"medium\",\"WN10-CC-000335\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41191,\"SV-77829r1_rule\",\"medium\",null,null,\"The Windows Remote Management (WinRM) client must not allow unencrypted traffic.\",\"WN10-CC-000335\",\"Unencrypted remote access to a system can allow sensitive information to be compromised.  Windows remote management connections must be encrypted to prevent this.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nkjCE6RM8DNItyD6rVqHkapLyfMeCxO61yv23MB6TIM=\"},\"C-64079r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SSUaZxp2e3lrtlRvHn/MbHLzmo8TT8Gt7ESsNHEpoN4=\"},\"F-69263r1_fix\",\"V-63341\",\"medium\",\"WN10-CC-000360\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41192,\"SV-77831r2_rule\",\"medium\",null,null,\"The Windows Remote Management (WinRM) client must not use Digest authentication.\",\"WN10-CC-000360\",\"Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HCOGZgkq+yjHfU54mGFmUULh8th2DmZrWdDxdOWGa1I=\"},\"C-93975r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SCb7yomQ0gnALvtdYQ0Wfiqr79Wy9XDD7zCwrSrCFVo=\"},\"F-100903r1_fix\",\"V-63343\",\"medium\",\"WN10-00-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41193,\"SV-77833r2_rule\",\"medium\",null,null,\"Windows 10 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).\",\"WN10-00-000025\",\"An approved tool for continuous network scanning must be installed and configured to run.\\n\\nWithout the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws.\\n\\nTo support this requirement, the operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools, as specified in the requirement.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qqusfdR/p7eKP2jELMMeLdSrRy4vsHPTO1wfCg44MTA=\"},\"C-69225r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:GlCAt+DFqUcIiFpLGGP/s22dZRqXxVkiX9prKdNXawc=\"},\"F-69267r3_fix\",\"V-63345\",\"medium\",\"WN10-00-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41194,\"SV-77835r3_rule\",\"medium\",null,null,\"The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.\",\"WN10-00-000035\",\"Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities.\\n\\nThe organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yd5HlJZjtzvpiWMc+q7EtjdFutkSfgvcIU2keNcxYzA=\"},\"C-64081r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Q0+/kPQ+TMoFU6R/R3baauhZk8VsT5OP1El8uRmgkNI=\"},\"F-69265r1_fix\",\"V-63347\",\"high\",\"WN10-CC-000345\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41195,\"SV-77837r1_rule\",\"high\",null,null,\"The Windows Remote Management (WinRM) service must not use Basic authentication.\",\"WN10-CC-000345\",\"Basic authentication uses plain text passwords that could be used to compromise a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:or6yezNX5dbJzbcRUwG9A6vn2Nwe1/eA0vaJqpY6LqY=\"},\"C-94063r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ehIkgFNdMcE1az7ZnoCD3OKmAwmBi0GzVNa1FmkTgLA=\"},\"F-98031r3_fix\",\"V-63349\",\"high\",\"WN10-00-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41196,\"SV-77839r11_rule\",\"high\",null,null,\"Windows 10 systems must be maintained at a supported servicing level.\",\"WN10-00-000040\",\"Windows 10 is maintained by Microsoft at servicing levels for specific periods of time to support Windows as a Service. Systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities which leaves them subject to exploitation.\\n\\nNew versions with feature updates are planned to be released on a semi-annual basis with an estimated support timeframe of 18 to 30 months depending on the release. Support for previously released versions has been extended for Enterprise editions.\\n\\nA separate servicing branch intended for special purpose systems is the Long-Term Servicing Channel (LTSC, formerly Branch - LTSB) which will receive security updates for 10 years but excludes feature updates.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9LhzdHuv/khleaS+BQu9ZlUcdjdohBUoq5bjuJZdhK8=\"},\"C-76169r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gXX1vxZNLMEKJ906VeqO6VwfiDp3BnRhlIF8SZ5PQRA=\"},\"F-83183r1_fix\",\"V-63351\",\"high\",\"WN10-00-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41197,\"SV-77841r4_rule\",\"high\",null,null,\"The Windows 10 system must use an anti-virus program.\",\"WN10-00-000045\",\"Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jyG27jY3W9Aj4bDrKfA/dk1GvzTU+D+IeEpDzIASblA=\"},\"C-73999r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SyAsNp8smmdI+Hij4hPNLGBhi2NmilH/PyQdzV2pUIU=\"},\"F-69273r1_fix\",\"V-63353\",\"high\",\"WN10-00-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41198,\"SV-77843r2_rule\",\"high\",null,null,\"Local volumes must be formatted using NTFS.\",\"WN10-00-000050\",\"The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system.  To support this, volumes must be formatted using the NTFS file system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gGc0LjWq95X1V62ZlIHcMLmkQPw2oUyILFgDEIeCFgc=\"},\"C-64093r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Lt3NME40vnlwPhHHTosrR9dZcR8XhMnFcLHuB2Lq3Lc=\"},\"F-69275r1_fix\",\"V-63355\",\"medium\",\"WN10-00-000055\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41199,\"SV-77845r1_rule\",\"medium\",null,null,\"Alternate operating systems must not be permitted on the same system.\",\"WN10-00-000055\",\"Allowing other operating systems to run on a secure system may allow security to be circumvented.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dOGGLjicLHA/RGjJYYBp+48oN0T8aKpZdwp8uPV5/Ic=\"},\"C-64095r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:isAxddtT+0Fm0OAsblf9Ghf+iS4NGqA3jzgSbGNsF5U=\"},\"F-69277r1_fix\",\"V-63357\",\"medium\",\"WN10-00-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41200,\"SV-77847r1_rule\",\"medium\",null,null,\"Non system-created file shares on a system must limit access to groups that require it.\",\"WN10-00-000060\",\"Shares which provide network access, should not typically exist on a workstation except for system-created administrative shares, and could potentially expose sensitive information.  If a share is necessary, share permissions, as well as NTFS permissions, must be reconfigured to give the minimum access to those accounts that require it.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:O7e8OfTlyzjmCELOYfMlW3c1bFSd2cM7R7YSkTfN3OA=\"},\"C-64097r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:t5Ggv9sKI7GKzesnJIeO3bOI2A5P40Pr9pN0Hn1Dpa8=\"},\"F-69279r1_fix\",\"V-63359\",\"low\",\"WN10-00-000065\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41201,\"SV-77849r1_rule\",\"low\",null,null,\"Unused accounts must be disabled or removed from the system after 35 days of inactivity.\",\"WN10-00-000065\",\"Outdated or unused accounts provide penetration points that may go undetected.  Inactive accounts must be deleted if no longer necessary or, if still required, disable until needed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8UtBp2DVYD1LJb6gnT+x7kAd1QHqhk+0hwQmESyWDy8=\"},\"C-81365r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Rq0Drnciefrchb4v+sf+grCmTAk/HDHLAtw9M5xF5jY=\"},\"F-88437r1_fix\",\"V-63361\",\"high\",\"WN10-00-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41202,\"SV-77851r2_rule\",\"high\",null,null,\"Only accounts responsible for the administration of a system must have Administrator rights on the system.\",\"WN10-00-000070\",\"An account that does not have Administrator duties must not have Administrator rights.  Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack.\\n\\nSystem administrators must log on to systems only using accounts with the minimum level of authority necessary.\\n\\nFor domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group (see V-36434 in the Active Directory Domain STIG).  Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks.\\n\\nStandard user accounts must not be members of the local administrators group.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OHRlA26i4Hoz3B5fPGaNDpMcdjxDEW48a+7+FxI491c=\"},\"C-64101r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SBfE7TkDd2NcS786G5LlI557gc60VE7A4bfB4w2U9VU=\"},\"F-69283r1_fix\",\"V-63363\",\"medium\",\"WN10-00-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41203,\"SV-77853r1_rule\",\"medium\",null,null,\"Only accounts responsible for the backup operations must be members of the Backup Operators group.\",\"WN10-00-000075\",\"Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it.  Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes.  Members of the Backup Operators group must have separate logon accounts for performing backup duties.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KQ8lRy8FDBQ4580tUO1vy4jkMlou6sCG5kmgRB26zTA=\"},\"C-94005r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PkuQ7BkZk2mwCeDlNGawCqd9XTXG/RQJCtw9/XPYoIk=\"},\"F-100933r1_fix\",\"V-63365\",\"medium\",\"WN10-00-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41204,\"SV-77855r3_rule\",\"medium\",null,null,\"Only authorized user accounts must be allowed to create or run virtual machines on Windows 10 systems.\",\"WN10-00-000080\",\"Allowing other operating systems to run on a secure system may allow users to circumvent security. For Hyper-V, preventing unauthorized users from being assigned to the Hyper-V Administrators group will prevent them from accessing or creating virtual machines on the system. The Hyper-V Hypervisor is used by Virtualization Based Security features such as Credential Guard on Windows 10; however, it is not the full Hyper-V installation.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bUQ3g8z8lvNafFtEoebv7L8OC/vCz5bDJEA+19YUMfY=\"},\"C-80207r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oPJakZz+TKXqsUByLyv8N2iXv/UZvp2SaRktzs5napc=\"},\"F-69287r1_fix\",\"V-63367\",\"low\",\"WN10-00-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41205,\"SV-77857r2_rule\",\"low\",null,null,\"Standard local user accounts must not exist on a system in a domain.\",\"WN10-00-000085\",\"To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain.  Users must log onto workstations in a domain with their domain accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:EIBNySof2OFl+QthlhxU04xnAsa1Q0mr/BmTT/yWVGw=\"},\"C-64109r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HzewPVEXvJy/3vqK0uHB7ZYVifjTyHImWH6bHFnZXaY=\"},\"F-69289r1_fix\",\"V-63369\",\"medium\",\"WN10-CC-000350\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41206,\"SV-77859r1_rule\",\"medium\",null,null,\"The Windows Remote Management (WinRM) service must not allow unencrypted traffic.\",\"WN10-CC-000350\",\"Unencrypted remote access to a system can allow sensitive information to be compromised.  Windows remote management connections must be encrypted to prevent this.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MaaeK83VUHrwbWkTbzyV8UO0uqMO9TDhxJaX5AYk0dg=\"},\"C-64111r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:z4g9j8oDjZ68rUOX8fTSATLvKjQdLa09fHE0FoV8Z4c=\"},\"F-69291r1_fix\",\"V-63371\",\"medium\",\"WN10-00-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41207,\"SV-77861r1_rule\",\"medium\",null,null,\"Accounts must be configured to require password expiration.\",\"WN10-00-000090\",\"Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nU7vAsnPVGyMIHLfdjvPC2Bq5ULx/4Moe5DQgjWZP+E=\"},\"C-77003r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aBhkLk4yDDuxvJapoccThWMsCEzDpFPSHDP96o7GBfw=\"},\"F-69295r1_fix\",\"V-63373\",\"medium\",\"WN10-00-000095\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41208,\"SV-77863r2_rule\",\"medium\",null,null,\"Permissions for system files and directories must conform to minimum requirements.\",\"WN10-00-000095\",\"Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rF9EqXhMnWgSBUWWkmTth67EEUxryI/ybsO2eNuHvzU=\"},\"C-64113r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ne7bvvVkhxxwqQKzB0FZOhG5Dme7RArzYI/oxTFDmyU=\"},\"F-69293r1_fix\",\"V-63375\",\"medium\",\"WN10-CC-000355\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41209,\"SV-77865r1_rule\",\"medium\",null,null,\"The Windows Remote Management (WinRM) service must not store RunAs credentials.\",\"WN10-CC-000355\",\"Storage of administrative credentials could allow unauthorized access.  Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PQtPLZt9kjWgPV2hRYy2GI3OB/Iw5D032IDo7oY5zKw=\"},\"C-64117r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:7DClVm96u/PlUj0xa9B6Fpm/yZc6tH4hip//MHDgktY=\"},\"F-69297r1_fix\",\"V-63377\",\"high\",\"WN10-00-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41210,\"SV-77867r1_rule\",\"high\",null,null,\"Internet Information System (IIS) or its subcomponents must not be installed on a workstation.\",\"WN10-00-000100\",\"Installation of Internet Information System (IIS) may allow unauthorized internet services to be hosted.  Websites must only be hosted on servers that have been designed for that purpose and can be adequately secured.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TRPtutJnGn43Yj6o6o250dQEb4BOKYZixgC8OVRcNIo=\"},\"C-64121r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KcSVrisllTzlLbwwjD3aQjBbkfHtbxafvagxpaTuXSw=\"},\"F-69301r1_fix\",\"V-63381\",\"medium\",\"WN10-00-000105\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41211,\"SV-77871r1_rule\",\"medium\",null,null,\"Simple Network Management Protocol (SNMP) must not be installed on the system.\",\"WN10-00-000105\",\"Some protocols and services do not support required security features, such as encrypting passwords or traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YwindgjytVWnrAw7yMnV/6hfzMIONOOroZJQi53YVkg=\"},\"C-64125r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:UqUD9iUd/SyuIamYPkPhF5kf20WKpuY45B7aNfPWC2U=\"},\"F-69305r1_fix\",\"V-63383\",\"medium\",\"WN10-00-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41212,\"SV-77873r1_rule\",\"medium\",null,null,\"Simple TCP/IP Services must not be installed on the system.\",\"WN10-00-000110\",\"Some protocols and services do not support required security features, such as encrypting passwords or traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7Tr9YNXYybZpCvPg9E2lPUrKLG7+7N1se4RCmhXyPzE=\"},\"C-64127r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MBXoPmdfwx5WkAgXM2CWQZpFkT+DsNuewTcElUoIp7I=\"},\"F-69307r1_fix\",\"V-63385\",\"medium\",\"WN10-00-000115\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41213,\"SV-77875r1_rule\",\"medium\",null,null,\"The Telnet Client must not be installed on the system.\",\"WN10-00-000115\",\"Some protocols and services do not support required security features, such as encrypting passwords or traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IYTubfVbsZBz/2eFUf+4u7kuvTO77HcoVONuJRZJyzw=\"},\"C-64133r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:IEsbmFKizofkSQo4ofAFKrgclkCswtyCio8fk2M+Ja8=\"},\"F-69313r1_fix\",\"V-63389\",\"medium\",\"WN10-00-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41214,\"SV-77879r1_rule\",\"medium\",null,null,\"The TFTP Client must not be installed on the system.\",\"WN10-00-000120\",\"Some protocols and services do not support required security features, such as encrypting passwords or traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:B/OnPBA2G41jIXn2STFlRDpkMuzALJv21OFtakZOH9Y=\"},\"C-94065r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JKikEHNST7nGZraERoaKA0mibzuZzeNB/9NH3JyuuQ0=\"},\"F-100989r1_fix\",\"V-63393\",\"medium\",\"WN10-00-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41215,\"SV-77883r2_rule\",\"medium\",null,null,\"Software certificate installation files must be removed from Windows 10.\",\"WN10-00-000130\",\"Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fz8dkAgamwTuH5yyEwnl11W4wiTXnoygvOnaEaNj80A=\"},\"C-64147r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cA+3JZQpKpbDYPqpt+bArmFwhZxvmpRu2uDMTKnSaRI=\"},\"F-69327r1_fix\",\"V-63399\",\"medium\",\"WN10-00-000135\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41216,\"SV-77889r1_rule\",\"medium\",null,null,\"A host-based firewall must be installed and enabled on the system.\",\"WN10-00-000135\",\"A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wkHOfqgUvzr6nhiu0W8JznAIxTY88dEtZD1HETyM13Y=\"},\"C-94067r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:maSrCn/JTRi30EOHIhnTKUmRWD1TUrLuQWyxGw6bW34=\"},\"F-100991r1_fix\",\"V-63403\",\"medium\",\"WN10-00-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41217,\"SV-77893r2_rule\",\"medium\",null,null,\"Inbound exceptions to the firewall on Windows 10 domain workstations must only allow authorized remote management hosts.\",\"WN10-00-000140\",\"Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised.  Limiting inbound connections only from authorized remote management systems will help limit this exposure.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:iZIWtAKLFv0mnxWoPykNAd+yxoNoNuOAn/rsuRkGkBw=\"},\"C-74549r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jLRL3Ym/q1F3d0J4TpzAIREp+e+yRky+vjqjf9GGYaM=\"},\"F-81277r1_fix\",\"V-63405\",\"medium\",\"WN10-AC-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41218,\"SV-77895r2_rule\",\"medium\",null,null,\"Windows 10 account lockout duration must be configured to 15 minutes or greater.\",\"WN10-AC-000005\",\"The account lockout feature, when enabled, prevents brute-force password attacks on the system.   This parameter specifies the amount of time that an account will remain locked after the specified number of failed logon attempts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IeyN47N358ORV6Naa7eZ9JrcWdBvGlkKd07eHuOVVhQ=\"},\"C-64157r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5eZS64e/4nkwIBidUMYDnXVjcP3P+Q0Fa25x/nq2z1Y=\"},\"F-69337r1_fix\",\"V-63409\",\"medium\",\"WN10-AC-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41219,\"SV-77899r1_rule\",\"medium\",null,null,\"The number of allowed bad logon attempts must be configured to 3 or less.\",\"WN10-AC-000010\",\"The account lockout feature, when enabled, prevents brute-force password attacks on the system.  The higher this value is, the less effective the account lockout feature will be in protecting the local system.  The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:14aXfEafYKcgX8JWb5u3N/8DD5cx/FDR9uuxUhwPlSE=\"},\"C-64161r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MmMbe6A7LFKZ6HzPvNVdObtI5SQclsP1bclC8xe3ZvA=\"},\"F-69341r1_fix\",\"V-63413\",\"medium\",\"WN10-AC-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41220,\"SV-77903r1_rule\",\"medium\",null,null,\"The period of time before the bad logon counter is reset must be configured to 15 minutes.\",\"WN10-AC-000015\",\"The account lockout feature, when enabled, prevents brute-force password attacks on the system.  This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to 0.  The smaller this value is, the less effective the account lockout feature will be in protecting the local system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:o8VKo4BFEQi8vohXvm9npwy451RfLEpCEbuLlXnX9P4=\"},\"C-64163r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ySeUZF7neYw++ikB4UQxqpm8qej7Jy5BBVEeZPielDw=\"},\"F-69343r1_fix\",\"V-63415\",\"medium\",\"WN10-AC-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41221,\"SV-77905r2_rule\",\"medium\",null,null,\"The password history must be configured to 24 passwords remembered.\",\"WN10-AC-000020\",\"A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change a password to a unique password on a regularly scheduled basis.  This enables users to effectively negate the purpose of mandating periodic password changes.  The default value is 24 for Windows domain systems.  DoD has decided this is the appropriate value for all Windows systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OOSpmvJlTsCD444uc+1xJVXu6qS4JR7e8tmYahCVG9Q=\"},\"C-64167r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MPgQHZ8NOu+FYExJTAdPyuM60k7VNM2/HJvp0Z9aChc=\"},\"F-69347r1_fix\",\"V-63419\",\"medium\",\"WN10-AC-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41222,\"SV-77909r1_rule\",\"medium\",null,null,\"The maximum password age must be configured to 60 days or less.\",\"WN10-AC-000025\",\"The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords.   Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rtkmX+JYKFPLvLYlRGgdiaDWULPSxr3ntwT4Qq5G0gE=\"},\"C-64169r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4/1Ch5tWbxP+WIVYjouyk/HOJ0XDti4tjAN693o+91E=\"},\"F-69349r1_fix\",\"V-63421\",\"medium\",\"WN10-AC-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41223,\"SV-77911r1_rule\",\"medium\",null,null,\"The minimum password age must be configured to at least 1 day.\",\"WN10-AC-000030\",\"Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database.  This enables users to effectively negate the purpose of mandating periodic password changes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gADtcufL0rvkhSygty7DNDG6rjm7eHO0Y8vlxc/cJOw=\"},\"C-64171r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OGyxCX5DTHE1ARwtV3m5eLeOpqYLijS3M8zhjRnBkzM=\"},\"F-69351r1_fix\",\"V-63423\",\"medium\",\"WN10-AC-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41224,\"SV-77913r1_rule\",\"medium\",null,null,\"Passwords must, at a minimum, be 14 characters.\",\"WN10-AC-000035\",\"Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9N++lDyFOQnR8saWfC585SvXvrRukpsO+VUybL0SJ3I=\"},\"C-64175r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TtARJnIt4fAJ70CJNv7xxjsDm7PL3wI22DNMIUqNCXg=\"},\"F-69355r1_fix\",\"V-63427\",\"medium\",\"WN10-AC-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41225,\"SV-77917r1_rule\",\"medium\",null,null,\"The built-in Microsoft password complexity filter must be enabled.\",\"WN10-AC-000040\",\"The use of complex passwords increases their strength against guessing and brute-force attacks.  This setting configures the system to verify that newly created passwords conform to the Windows password complexity policy.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YJ3a9bdA7M956htDthFs6pM+dAbD3AcqGyWDkl4iTa4=\"},\"C-64177r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VGo1Nu2SJaq9I64JszyAAHcEh0AfgVawMKsOTAwL1dk=\"},\"F-69357r1_fix\",\"V-63429\",\"high\",\"WN10-AC-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41226,\"SV-77919r1_rule\",\"high\",null,null,\"Reversible password encryption must be disabled.\",\"WN10-AC-000045\",\"Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords. For this reason, this policy must never be enabled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sDp/d6cGeheQPSyDdqeABiqG2UKTGaaxfw8wIcMeQHs=\"},\"C-64181r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aA7TirNm7zPIdrLVzY9gUwi2WnKWGnEBB1HObtUaMdg=\"},\"F-69359r1_fix\",\"V-63431\",\"medium\",\"WN10-AU-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41227,\"SV-77921r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Logon - Credential Validation failures.\",\"WN10-AU-000005\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nCredential validation records events related to validation tests on credentials for a user account logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U2zZ7WbIs6xdLIKg5f+SK3W4lP14JKnsnLrhnXtzY8A=\"},\"C-64183r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YCkv04RndmdzyZCcB6O5+KYAOvsm7/89d5qqX0GhgSQ=\"},\"F-69363r1_fix\",\"V-63435\",\"medium\",\"WN10-AU-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41228,\"SV-77925r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Logon - Credential Validation successes.\",\"WN10-AU-000010\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nCredential validation records events related to validation tests on credentials for a user account logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Wm8Z9go4ijvi1hXPZNlNfvaEeTTCHlNCHL0r4Y+YBog=\"},\"C-64193r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gg/v2f3vUfMRkCkHvHXOt9BCfQqKfFN4a8DgK+qrvsQ=\"},\"F-69373r1_fix\",\"V-63445\",\"medium\",\"WN10-AU-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41229,\"SV-77935r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Management - Security Group Management successes.\",\"WN10-AU-000030\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSecurity Group Management records events such as creating, deleting or changing of security groups, including changes in group members.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3K8Cr0W8KyJySAjHnIKhBoSL7BMlQwmSIgNxt27SU90=\"},\"C-64195r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pVd0NovBldiHaHPFa0tAv011pF2RjRALQ7tnRADE91E=\"},\"F-69375r1_fix\",\"V-63447\",\"medium\",\"WN10-AU-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41230,\"SV-77937r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Management - User Account Management failures.\",\"WN10-AU-000035\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nUser Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hFq/VN5iy8nq4TtmL91tbvNef3uqC1tTzH5qxWfTUFY=\"},\"C-64197r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/xdrvVHV4IePqacc8MtQYqmIYGMhrwIztaVynBDnuLA=\"},\"F-69377r1_fix\",\"V-63449\",\"medium\",\"WN10-AU-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41231,\"SV-77939r1_rule\",\"medium\",null,null,\"The system must be configured to audit Account Management - User Account Management successes.\",\"WN10-AU-000040\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nUser Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6OLuCTq6MxuisuBFoZTFhVa37PfJJ79XxKFbZyUXh0w=\"},\"C-64199r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qOA4YL9f41Ns4hyJL9uPQqiGJGBe7icqz/ppQklVGv0=\"},\"F-69379r1_fix\",\"V-63451\",\"medium\",\"WN10-AU-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41232,\"SV-77941r1_rule\",\"medium\",null,null,\"The system must be configured to audit Detailed Tracking - PNP Activity successes.\",\"WN10-AU-000045\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nPlug and Play activity records events related to the successful connection of external devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TRV0JYavJNEISA42NPNpnVnUp5myoEbm7eqpR1DJJFo=\"},\"C-64201r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NBU2MzWYsGPC3gi/4RxDiS7NfuwoELGkXTJaeq9BrdU=\"},\"F-69381r1_fix\",\"V-63453\",\"medium\",\"WN10-AU-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41233,\"SV-77943r1_rule\",\"medium\",null,null,\"The system must be configured to audit Detailed Tracking - Process Creation successes.\",\"WN10-AU-000050\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nProcess creation records events related to the creation of a process and the source.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BvILRXAXQabjIlzA8GIEo277mORYvfi8NWsVMyjd+bs=\"},\"C-64205r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MkFjBW+wTXKM+bVOaMTYtYSOvoBL6TyGajba0WYKVoQ=\"},\"F-69385r2_fix\",\"V-63457\",\"medium\",\"WN10-AU-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41234,\"SV-77947r2_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Group Membership successes.\",\"WN10-AU-000060\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Group Membership records information related to the group membership of a user's logon token.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2DObiHB1tJi8nMxl9dgsi2/LMp3YdlL60aFyLwFw3R4=\"},\"C-64207r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:K5M4KmaUozWIzaU+v4pu+F3Oz6hud2YaO8zive2VMNQ=\"},\"F-69387r1_fix\",\"V-63459\",\"medium\",\"WN10-AU-000065\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41235,\"SV-77951r1_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Logoff successes.\",\"WN10-AU-000065\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nLogoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:V/vAvDNZ6xrqpdV/w1nyyY3RzAUSErMEtiv1Xc/qROg=\"},\"C-64211r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ja15obCbbcDYxnTR9GfasZC2z6rW5C077asl2QRc9ig=\"},\"F-69391r1_fix\",\"V-63463\",\"medium\",\"WN10-AU-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41236,\"SV-77953r1_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Logon failures.\",\"WN10-AU-000070\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nLogon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BE/T6AoSLhPnWZOeS6illZZoNnn6TQQMBBvTmt+LfNg=\"},\"C-64215r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2tufLSka7fFObhLBDXhZmY7CFoqtM5BQkY9Xx2urDHE=\"},\"F-69395r1_fix\",\"V-63467\",\"medium\",\"WN10-AU-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41237,\"SV-77957r1_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Logon successes.\",\"WN10-AU-000075\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nLogon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HwmQqAec5Zb6el866c2comWk7ZfJ+ixTZEXIw7pzUOU=\"},\"C-64219r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RJZC6BfSuklLHfD8/AdYU36eUuB5I07rIDS9TecjKqM=\"},\"F-69399r1_fix\",\"V-63469\",\"medium\",\"WN10-AU-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41238,\"SV-77959r1_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Special Logon successes.\",\"WN10-AU-000080\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSpecial Logon records special logons which have administrative privileges and can be used to elevate processes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1acXIWzqEYhMqmAFLJ2OFPWy5wyiClFRK0blgMdIxBY=\"},\"C-79559r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zSmfHuoXc0jrD2YrzBzIQ/XZ0Y954LULEdzdIVTClMw=\"},\"F-69401r1_fix\",\"V-63471\",\"medium\",\"WN10-AU-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41239,\"SV-77961r2_rule\",\"medium\",null,null,\"The system must be configured to audit Object Access - Removable Storage failures.\",\"WN10-AU-000085\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing object access for removable media records events related to access attempts on file system objects on removable storage devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LGJqueVXVNwDFVXUpGxRZQ4Wny/BOBHeceC7sx3PXzs=\"},\"C-79561r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zqpREYRg1Kxz138PJty6cYN9gO7tgJH8CBCn0kPzqyI=\"},\"F-69403r1_fix\",\"V-63473\",\"medium\",\"WN10-AU-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41240,\"SV-77963r2_rule\",\"medium\",null,null,\"The system must be configured to audit Object Access - Removable Storage successes.\",\"WN10-AU-000090\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing object access for removable media records events related to access attempts on file system objects on removable storage devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I1vZMy69tT8kq1UjsGKufBSv8WZnqduCw713X+syDqw=\"},\"C-64229r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wKnsWqty0H9nWg2aaRDOv7IxI9QTQpCDaGjIgbj0MBQ=\"},\"F-69409r2_fix\",\"V-63479\",\"medium\",\"WN10-AU-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41241,\"SV-77969r2_rule\",\"medium\",null,null,\"The system must be configured to audit Policy Change - Audit Policy Change successes.\",\"WN10-AU-000100\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Policy Change records events related to changes in audit policy.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:W/aNcLuy+E+akBMmzfflre1wQ9pk0xdJKZ8MsmhQgJg=\"},\"C-64231r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aKP1kHP2CONM78C0dxE8QkGqPoT1aq80NDZc6RL/OBI=\"},\"F-69411r1_fix\",\"V-63481\",\"medium\",\"WN10-AU-000105\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41242,\"SV-77971r1_rule\",\"medium\",null,null,\"The system must be configured to audit Policy Change - Authentication Policy Change successes.\",\"WN10-AU-000105\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuthentication Policy Change records events related to changes in authentication policy including Kerberos policy and Trust changes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uK/4Mc8psjVa5hc9xcQ/VvM1L3p/Z2PR5oXrXVdT3AA=\"},\"C-64235r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lP2Tm71qQIYsyXZjSgjcxXH47CRJMJhyJ8U+5zDT7N0=\"},\"F-69413r1_fix\",\"V-63483\",\"medium\",\"WN10-AU-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41243,\"SV-77973r1_rule\",\"medium\",null,null,\"The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.\",\"WN10-AU-000110\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSensitive Privilege Use records events related to use of sensitive privileges, such as \\\"Act as part of the operating system\\\" or \\\"Debug programs\\\".\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ub+bzRw9nK5FMqhg0cvtHTPXc0ZoY14WwJJpfePsTU0=\"},\"C-64237r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pNLEyv3K1YNdXEba5N6YcjSqJdolvf811azquiZVsIE=\"},\"F-69417r1_fix\",\"V-63487\",\"medium\",\"WN10-AU-000115\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41244,\"SV-77977r1_rule\",\"medium\",null,null,\"The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.\",\"WN10-AU-000115\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSensitive Privilege Use records events related to use of sensitive privileges, such as \\\"Act as part of the operating system\\\" or \\\"Debug programs\\\".\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pI4rSYXdO2I17sVUgVGEC9waoXmSE152j9vxVgdtn58=\"},\"C-64241r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FlfPwFuyGa353w6vq+ReJyYvcWU+jXAQhHZmDQsabcY=\"},\"F-69421r1_fix\",\"V-63491\",\"medium\",\"WN10-AU-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41245,\"SV-77981r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - IPSec Driver failures.\",\"WN10-AU-000120\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nIPSec Driver records events related to the IPSec Driver such as dropped packets.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XjzZBXSARGyTD/PfUuDeFm28fIvcIV4qygTV08sLVKo=\"},\"C-64249r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qbnkfxvcxqsHUumpyx/QPMSvTcHG0EHf5OmWf+44R34=\"},\"F-69429r2_fix\",\"V-63499\",\"medium\",\"WN10-AU-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41246,\"SV-77989r2_rule\",\"medium\",null,null,\"The system must be configured to audit System - Other System Events successes.\",\"WN10-AU-000130\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other System Events records information related to cryptographic key operations and the Windows Firewall service.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:t6WHp+ZUHBml263lvCguGrlkMzldPXsFEy5VNUVNBrI=\"},\"C-64253r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wKOwXbSL3PoqzLvUb4JGzDXw9Mj8ree+SlnSn2RvDi0=\"},\"F-69433r2_fix\",\"V-63503\",\"medium\",\"WN10-AU-000135\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41247,\"SV-77993r2_rule\",\"medium\",null,null,\"The system must be configured to audit System - Other System Events failures.\",\"WN10-AU-000135\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other System Events records information related to cryptographic key operations and the Windows Firewall service.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Er5CsYJ2r9pG46ajyyQ8LR2k5mWoAMurGm8u9Uh/Iuw=\"},\"C-64257r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:t48oe6m1PGxij2Hfz7wB0b6JoXbXl6dq0nX27AkSkw4=\"},\"F-69437r1_fix\",\"V-63507\",\"medium\",\"WN10-AU-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41248,\"SV-77997r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - Security State Change successes.\",\"WN10-AU-000140\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSecurity State Change records events related to changes in the security state, such as startup and shutdown of the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WuYFQVOva2y1AbhfejrStyjDyv4BFq3G2voT7JCBA8Y=\"},\"C-64263r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TncMv3Jzlg2v7g/aMq6s8u8VuBYs6+jp0w8uYjkuiBc=\"},\"F-69443r1_fix\",\"V-63513\",\"medium\",\"WN10-AU-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41249,\"SV-78003r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - Security System Extension successes.\",\"WN10-AU-000150\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSecurity System Extension records events related to extension code being loaded by the security subsystem.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xgvxweAhj8P+1t428K3s8SDMbeLf2/MINiEDTjiVtRk=\"},\"C-64265r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y1Aff8aSD5qwlONaGrPOmAJVqIiaG/LHZhiOPu2pfmc=\"},\"F-69445r1_fix\",\"V-63515\",\"medium\",\"WN10-AU-000155\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41250,\"SV-78005r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - System Integrity failures.\",\"WN10-AU-000155\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSystem Integrity records events related to violations of integrity to the security subsystem.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:liPGtSRilvM45JUUHGb3NoDoAKAmonqQZH/MaCqLC/s=\"},\"C-64267r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:x6KrpOs1hxxhfHX/dlnzpNji0JTFvBRWVnCw7WX2AOE=\"},\"F-69447r1_fix\",\"V-63517\",\"medium\",\"WN10-AU-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41251,\"SV-78007r1_rule\",\"medium\",null,null,\"The system must be configured to audit System - System Integrity successes.\",\"WN10-AU-000160\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nSystem Integrity records events related to violations of integrity to the security subsystem.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DyO6WQCEJJlinj5BDeq/RINvUFeMQ73GuBqzRcFDqQQ=\"},\"C-64269r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oqaP95MfT4NLwBuXhTFAOcC96NQT8kstSKpuuSkgPwY=\"},\"F-69449r1_fix\",\"V-63519\",\"medium\",\"WN10-AU-000500\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41252,\"SV-78009r1_rule\",\"medium\",null,null,\"The Application event log size must be configured to 32768 KB or greater.\",\"WN10-AU-000500\",\"Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/3CmjRBIzvZC9yK/MCEjxBoeg+MF3xkIhnLP5Zgo/2M=\"},\"C-79597r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hCKZP4gqx2/fQTmOmUUQ561GsS0cToKGHWLnjt1JE80=\"},\"F-86735r1_fix\",\"V-63523\",\"medium\",\"WN10-AU-000505\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41253,\"SV-78013r2_rule\",\"medium\",null,null,\"The Security event log size must be configured to 1024000 KB or greater.\",\"WN10-AU-000505\",\"Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rIpcAlB/RefJGwA84BZ7ULacK5uTqcC4TpZy9gfOwdk=\"},\"C-64277r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:V/1VRJCtUyree39Mg/Yp6XswbQtFsUiWSUtW3sC4gx0=\"},\"F-69457r1_fix\",\"V-63527\",\"medium\",\"WN10-AU-000510\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41254,\"SV-78017r1_rule\",\"medium\",null,null,\"The System event log size must be configured to 32768 KB or greater.\",\"WN10-AU-000510\",\"Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Au90rsoIgKKpDJ+88Qps0bQDZf/CKYRvQpZFpv2MOUA=\"},\"C-94069r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HvM9zFQwtSYA7tWqPQldVml2FC87Y1REgJ28eU0K7h0=\"},\"F-69463r1_fix\",\"V-63533\",\"medium\",\"WN10-AU-000515\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41255,\"SV-78023r2_rule\",\"medium\",null,null,\"Windows 10 permissions for the Application event log must prevent access by non-privileged accounts.\",\"WN10-AU-000515\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Application event log may be  susceptible to tampering if proper permissions are not applied.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KvaUNjf9HpHOvMKNKYYGrc5t+RjNh70OiFd7YXyR7TI=\"},\"C-94071r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NpbK/A9boxa1fvOWbf1Chof5scXWC2vQJMszQTt1u+Y=\"},\"F-69467r1_fix\",\"V-63537\",\"medium\",\"WN10-AU-000520\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41256,\"SV-78027r2_rule\",\"medium\",null,null,\"Windows 10 permissions for the Security event log must prevent access by non-privileged accounts.\",\"WN10-AU-000520\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Security event log may disclose sensitive information or be  susceptible to tampering if proper permissions are not applied.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kwjLPtx2Qf2ICgGtbJvcwowGSS5n1iOSY0sAbgRUseA=\"},\"C-94073r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/4pSofCd9Cq60jubDSnxx+57hw8xf9384evWVHaDk+w=\"},\"F-69471r1_fix\",\"V-63541\",\"medium\",\"WN10-AU-000525\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41257,\"SV-78031r2_rule\",\"medium\",null,null,\"Windows 10 permissions for the System event log must prevent access by non-privileged accounts.\",\"WN10-AU-000525\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The System event log may be  susceptible to tampering if proper permissions are not applied.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:n/VYybwadURq9gktZ5pPv9NpPwlE/OX7X34avyRIxn0=\"},\"C-64295r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rLQmxWfvja477xAg4uFTM+6sxpkTd5/YLxzvM0Fq2FQ=\"},\"F-69475r1_fix\",\"V-63545\",\"medium\",\"WN10-CC-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41258,\"SV-78035r1_rule\",\"medium\",null,null,\"Camera access from the lock screen must be disabled.\",\"WN10-CC-000005\",\"Enabling camera access from the lock screen could allow for unauthorized use.  Requiring logon will ensure the device is only used by authorized personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wD5HvAQgiCsU2Pbe6EawPD0843pDzk9QjNocpT9i8RI=\"},\"C-64299r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9w83wkd0gVC9qElvSUtSE641xHX0nJ5OKujjokrvMSo=\"},\"F-69479r1_fix\",\"V-63549\",\"medium\",\"WN10-CC-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41259,\"SV-78039r1_rule\",\"medium\",null,null,\"The display of slide shows on the lock screen must be disabled.\",\"WN10-CC-000010\",\"Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel.  Turning off this feature will limit access to the information to a logged on user.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A6fibgthh14b9Op4gFZQuUPcG2SB+c4/OCpJZl+JW/o=\"},\"C-64305r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pZWVc24salB5/U1HmWA4W6W1HuWSlK4IR5FLuphT3/I=\"},\"F-69485r1_fix\",\"V-63555\",\"medium\",\"WN10-CC-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41260,\"SV-78045r1_rule\",\"medium\",null,null,\"IPv6 source routing must be configured to highest protection.\",\"WN10-CC-000020\",\"Configuring the system to disable IPv6 source routing protects against spoofing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QwUV9MHbwXjDlNhviMU3RJgonXD84IWB/u1SaVD04HU=\"},\"C-64309r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/gYQBG7Wcx3jx0tMxsPSgc5qqAfkxIp4WUL6Tsp5d3E=\"},\"F-69489r1_fix\",\"V-63559\",\"medium\",\"WN10-CC-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41261,\"SV-78049r1_rule\",\"medium\",null,null,\"The system must be configured to prevent IP source routing.\",\"WN10-CC-000025\",\"Configuring the system to disable IP source routing protects against spoofing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DJn8qS8Z+LUFfJVdHOYY3y3chtd5shcIjisdTgSjqYk=\"},\"C-64313r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8Uv8OZEB4zBbtzRn6Z0BsKlAlG9jeileDqxL7Ggm4ks=\"},\"F-69493r1_fix\",\"V-63563\",\"low\",\"WN10-CC-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41262,\"SV-78053r1_rule\",\"low\",null,null,\"The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.\",\"WN10-CC-000030\",\"Allowing ICMP redirect of routes can lead to traffic not being routed properly.   When disabled, this forces ICMP to be routed via shortest path first.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OLmEHTREwzxLEYjHSP9Vs9v/hFwEi7JLaoSgaF8tAzI=\"},\"C-64317r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gJpOKNLcanyruAumtszxLLcnQ/GFp8dB80gTbU8dM4Y=\"},\"F-69497r1_fix\",\"V-63567\",\"low\",\"WN10-CC-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41263,\"SV-78057r1_rule\",\"low\",null,null,\"The system must be configured to ignore NetBIOS name release requests except from WINS servers.\",\"WN10-CC-000035\",\"Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:R57XJmpmTusQFUQzPHbDgL50AUYv/vR8uoIKyz7Vpzs=\"},\"C-81357r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Wd53AX2vIP+U41A35FoDx4GW6LTTJZ8oS3Mv3hOj/AI=\"},\"F-69499r2_fix\",\"V-63569\",\"medium\",\"WN10-CC-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41264,\"SV-78059r2_rule\",\"medium\",null,null,\"Insecure logons to an SMB server must be disabled.\",\"WN10-CC-000040\",\"Insecure guest logons allow unauthenticated access to shared folders.  Shared resources on a system must require authentication to establish proper access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:61r9+JyE4FdTPKoO2j03RuHoicsSx+y5TDVRs+6Lxk8=\"},\"C-64327r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6eFOhwebc7IktMzsdu/X6CFpnwwdXDnqdPZXnULUBPY=\"},\"F-69507r1_fix\",\"V-63577\",\"medium\",\"WN10-CC-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41265,\"SV-78067r1_rule\",\"medium\",null,null,\"Hardened UNC Paths must be defined to require mutual authentication and integrity for at least the \\\\\\\\*\\\\SYSVOL and \\\\\\\\*\\\\NETLOGON shares.\",\"WN10-CC-000050\",\"Additional security requirements are applied to Universal Naming Convention (UNC) paths specified in Hardened UNC paths before allowing access them.  This aids in preventing tampering with or spoofing of connections to these paths.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vBYNU1MOZTMT14yG0uwLTnJNZd27pnHRrsvC0HPMX0s=\"},\"C-80175r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qW/yvLi6pjd31ZPwUriE4/jZaYVO9VBepn68ejyghvY=\"},\"F-87307r1_fix\",\"V-63579\",\"medium\",\"WN10-PK-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41266,\"SV-78069r4_rule\",\"medium\",null,null,\"The DoD Root CA certificates must be installed in the Trusted Root Store.\",\"WN10-PK-000005\",\"To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root Certificate Authorities (CAs). The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c4QEIcRFMsJ0fLK2itIk4vhS7BejsCbOOCX+PUzaf1o=\"},\"C-64331r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nIaCTWblFcQ8963AsTavhUs6fngasKR5TbX3Oe3Jhr4=\"},\"F-69511r1_fix\",\"V-63581\",\"medium\",\"WN10-CC-000055\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41267,\"SV-78071r2_rule\",\"medium\",null,null,\"Simultaneous connections to the Internet or a Windows domain must be limited.\",\"WN10-CC-000055\",\"Multiple network connections can provide additional attack vectors to a system and must be limited. The \\\"Minimize the number of simultaneous connections to the Internet or a Windows Domain\\\" setting prevents systems from automatically establishing multiple connections.  When both wired and wireless connections are available, for example, the less preferred connection (typically wireless) will be disconnected.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4xWh6wamWmIOeIO59RNtRdwcCFtu7mD7qVIiEWhU49I=\"},\"C-80177r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6hfbBPdICANHXibauoRbwr56X1UfaZHIVdr6tdBHtRw=\"},\"F-76981r2_fix\",\"V-63583\",\"medium\",\"WN10-PK-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41268,\"SV-78073r3_rule\",\"medium\",null,null,\"The External Root CA certificates must be installed in the Trusted Root Store on unclassified systems.\",\"WN10-PK-000010\",\"To ensure secure websites protected with External Certificate Authority (ECA) server certificates are properly validated, the system must trust the ECA Root CAs. The ECA root certificates will ensure the trust chain is established for server certificates issued from the External CAs. This requirement only applies to unclassified systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wmSMFUgwk1JCHLOyalyRfJCbYd8VKcplfwvV5bapJBY=\"},\"C-64335r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2l+idlgBtTvnKFVa9VTf4zXsNEBWfO4m8plTIhF/DyE=\"},\"F-69515r1_fix\",\"V-63585\",\"medium\",\"WN10-CC-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41269,\"SV-78075r1_rule\",\"medium\",null,null,\"Connections to non-domain networks when connected to a domain authenticated network must be blocked.\",\"WN10-CC-000060\",\"Multiple network connections can provide additional attack vectors to a system and should be limited.  When connected to a domain, communication must go through the domain connection.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FKy5u6ln+y0mzvOV4HzwGH2CwpZj3IQ2DhcZHGowfYk=\"},\"C-91397r6_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vnsW+684faBn7v70CiiRfuLg3ZjpK4esKbO68gE27us=\"},\"F-98441r5_fix\",\"V-63587\",\"medium\",\"WN10-PK-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41270,\"SV-78077r6_rule\",\"medium\",null,null,\"The DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.\",\"WN10-PK-000015\",\"To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VNS7bkHAgOyfB6SjEoQf8o+x0lzbHQcxS5EZbR1kz64=\"},\"C-91399r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zKlpVqXd27JZ5EOCpoOs1uN43E0aHvghtWtFAEWFqE0=\"},\"F-98443r4_fix\",\"V-63589\",\"medium\",\"WN10-PK-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41271,\"SV-78079r5_rule\",\"medium\",null,null,\"The US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.\",\"WN10-PK-000020\",\"To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ev+o/KN0GgLzFlT2mWhE43+O9wbhzEnibMOjO1WuHo0=\"},\"C-81355r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qpCS/S/xqllHFnTYVWBNcXOwR4c/H0d+j+1IuGA91GM=\"},\"F-88431r2_fix\",\"V-63591\",\"medium\",\"WN10-CC-000065\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41272,\"SV-78081r2_rule\",\"medium\",null,null,\"Wi-Fi Sense must be disabled.\",\"WN10-CC-000065\",\"Wi-Fi Sense automatically connects the system to known hotspots and networks that contacts have shared.  It also allows the sharing of the system's known networks to contacts.  Automatically connecting to hotspots and shared networks can expose a system to unsecured or potentially malicious systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+gNTwi6NPYxK/l/EIlkhsqMLUMX3yk8p8qOXrOuTUD8=\"},\"C-91427r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ykTGg9spp0NKYR5+ZyC3oLERNxBbzK8ql0M2w5JsGF8=\"},\"F-98471r1_fix\",\"V-63593\",\"medium\",\"WN10-RG-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41273,\"SV-78083r2_rule\",\"medium\",null,null,\"Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.\",\"WN10-RG-000005\",\"The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DgPD2H4FRf1aoEW+JdUiSywje5awdelYTOHDeJ/jku8=\"},\"C-94075r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:G6lcect0y/g9UT0Y3z0L92t2RhMCjFw4ExV2g8zRFOo=\"},\"F-74851r3_fix\",\"V-63595\",\"low\",\"WN10-CC-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41274,\"SV-78085r6_rule\",\"low\",null,null,\"Virtualization Based Security must be enabled on Windows 10 with the platform security level configured to Secure Boot or Secure Boot with DMA Protection.\",\"WN10-CC-000070\",\"Virtualization Based Security (VBS) provides the platform for the additional security features, Credential Guard and Virtualization based protection of code integrity.  Secure Boot is the minimum security level with DMA protection providing additional memory protection.  DMA Protection requires a CPU that supports input/output memory management unit (IOMMU).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZB/zbtMEaShUymYYFvs3E2/5ygQ24pqyeGDPPNJ9udg=\"},\"C-72029r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SdkFWEyc7gjSU/lmjQKEMVDHJyCAq4AuDOkoUTPQUdU=\"},\"F-78099r3_fix\",\"V-63597\",\"medium\",\"WN10-CC-000037\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41275,\"SV-78087r2_rule\",\"medium\",null,null,\"Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.\",\"WN10-CC-000037\",\"A compromised local administrator account can provide means for an attacker to move laterally between domain systems.\\n\\nWith User Account Control enabled, filtering the privileged token for built-in administrator accounts will prevent the elevated privileges of these accounts from being used over the network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PJ2hg0H5j3JxumOw1ESdMmYSago1hh7d1jPoC7NiknU=\"},\"C-94077r6_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:j63Fbih99ATORGtI1MEEIxg37mR6MGAYmAiyypVcg1E=\"},\"F-88433r2_fix\",\"V-63599\",\"high\",\"WN10-CC-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41276,\"SV-78089r9_rule\",\"high\",null,null,\"Credential Guard must be running on Windows 10 domain-joined systems.\",\"WN10-CC-000075\",\"Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. This authentication information, which was stored in the Local Security Authority (LSA) in previous versions of Windows, is isolated from the rest of operating system and can only be accessed by privileged system software.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gu4gtZX1rR01eoH7S8OImC8dbc8fZ9Js8wyj3Hq8AQA=\"},\"C-64351r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HXfLFOqu+1s5ssE/guTf0G+p+E1y4Zp/jbZafzC2X8A=\"},\"F-69531r1_fix\",\"V-63601\",\"medium\",\"WN10-SO-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41277,\"SV-78091r1_rule\",\"medium\",null,null,\"The built-in administrator account must be disabled.\",\"WN10-SO-000005\",\"The built-in administrator account is a well-known account subject to attack.  It also provides no accountability to individual administrators on a system.  It must be disabled to prevent its use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MOtPlfIGo1RyaFuE2rfSMX3os4OtOKSymnMJWGrlUXI=\"},\"C-64357r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:i6Q2heKseDABr9dNSExMDPTbOHjPMPjTHR818GtjOVE=\"},\"F-69537r5_fix\",\"V-63607\",\"medium\",\"WN10-CC-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41278,\"SV-78097r2_rule\",\"medium\",null,null,\"Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers.\",\"WN10-CC-000085\",\"By being launched first by the kernel, ELAM ( Early Launch Antimalware) is ensured to be launched before any third-party software, and is therefore able to detect malware in the boot process and prevent it from initializing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:x6lWvjXJOJaFvBJV1Zg8dV8fRzPlgg6/m3YcFFE/VLE=\"},\"C-64359r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6VXJSqwF1zyWEd3Q5/6djx7mrB1JQSvdwnOXfetGibc=\"},\"F-69539r1_fix\",\"V-63609\",\"medium\",\"WN10-CC-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41279,\"SV-78099r1_rule\",\"medium\",null,null,\"Group Policy objects must be reprocessed even if they have not changed.\",\"WN10-CC-000090\",\"Enabling this setting and then selecting the \\\"Process even if the Group Policy objects have not changed\\\" option ensures that the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3H53KZC2kWuaeW6IYY71llirhuaVVZpEWoqEEkwfsC4=\"},\"C-64361r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cZIhh4M84G9S28SE0Eimt5O7VnLgH9tIurbqqRNRzv4=\"},\"F-69541r1_fix\",\"V-63611\",\"medium\",\"WN10-SO-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41280,\"SV-78101r1_rule\",\"medium\",null,null,\"The built-in guest account must be disabled.\",\"WN10-SO-000010\",\"A system faces an increased vulnerability threat if the built-in guest account is not disabled.  This account is a known account that exists on all Windows systems and cannot be deleted.  This account is initialized during the installation of the operating system with no password assigned.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:UFrGn+U27y3pnKkpO5lkjLvaccdBipAxfmB1NDMupKc=\"},\"C-64365r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/BowXRM3tJKXibXXxqKggyjs1ejtzmV1tj5Y6tuOML0=\"},\"F-69545r1_fix\",\"V-63615\",\"medium\",\"WN10-CC-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41281,\"SV-78105r1_rule\",\"medium\",null,null,\"Downloading print driver packages over HTTP must be prevented.\",\"WN10-CC-000100\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents the computer from downloading print driver packages over HTTP.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:J5uvaJtjjYnwV4ewXXHS2Y/F1moPfjj95l8OgEmAcHg=\"},\"C-64367r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MIISVbnumAOzsSQ0LnkOmibChxPx5xKPCAOIijlVP5Y=\"},\"F-69547r1_fix\",\"V-63617\",\"medium\",\"WN10-SO-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41282,\"SV-78107r1_rule\",\"medium\",null,null,\"Local accounts with blank passwords must be restricted to prevent access from the network.\",\"WN10-SO-000015\",\"An account without a password can allow unauthorized access to a system as only the username would be required.  Password policies should prevent accounts with blank passwords from existing on a system.  However, if a local account with a blank password did exist, enabling this setting will prevent network access, limiting the account to local console logon only.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CgDvkF7Lpc1r6ZB1knUBa/Na6DAh5qTekx4xkJVDJKU=\"},\"C-64371r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YeCBg180cLlpfYI2tR2YOQnoZKTsqgA2DUoYey1lDeI=\"},\"F-69551r1_fix\",\"V-63619\",\"medium\",\"WN10-SO-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41283,\"SV-78109r1_rule\",\"medium\",null,null,\"The built-in administrator account must be renamed.\",\"WN10-SO-000020\",\"The built-in administrator account is a well-known account subject to attack.  Renaming this account to an unidentified name improves the protection of this account and the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PynI4MPELuswd9LSVn4o7lJ1Gj5XkceRgYo1jYFWcyE=\"},\"C-64369r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oU5hOUYBLIYzJj1qziKaQNZ/YLYfQl5M/74gsNYEh0A=\"},\"F-69549r1_fix\",\"V-63621\",\"medium\",\"WN10-CC-000105\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41284,\"SV-78111r1_rule\",\"medium\",null,null,\"Web publishing and online ordering wizards must be prevented from downloading a list of providers.\",\"WN10-CC-000105\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents Windows from downloading a list of providers for the Web publishing and online ordering wizards.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eHWGorFu8rp07FggxF3KQzzzIDdCofw07d6YU7EPPQg=\"},\"C-64373r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VXzJXyUcgf8hv77wrcIGqLeZvieVy1yeE+Hw1MhHtY0=\"},\"F-69553r1_fix\",\"V-63623\",\"medium\",\"WN10-CC-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41285,\"SV-78113r1_rule\",\"medium\",null,null,\"Printing over HTTP must be prevented.\",\"WN10-CC-000110\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Sp6+sZWFJ+5qIfMxuZM1X4FQ9Q3VaCCrivEnw2hO+VE=\"},\"C-64375r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JQMn5/vnaierr1Bn8RdFDmS3S/rF6buFn2nIXZkcNV8=\"},\"F-69555r1_fix\",\"V-63625\",\"medium\",\"WN10-SO-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41286,\"SV-78115r1_rule\",\"medium\",null,null,\"The built-in guest account must be renamed.\",\"WN10-SO-000025\",\"The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password.  This can allow access to system resources by unauthorized users.  Renaming this account to an unidentified name improves the protection of this account and the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1cHjpZpWasXrNs38blIHXTCAsBeBydKm/FoVbD6YN9E=\"},\"C-64377r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:V7ZlwpHZNkAvZqc5or/lGETYCwAVfpt6oCJMf/fAvo8=\"},\"F-69557r1_fix\",\"V-63627\",\"medium\",\"WN10-CC-000115\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41287,\"SV-78117r1_rule\",\"medium\",null,null,\"Systems must at least attempt device authentication using certificates.\",\"WN10-CC-000115\",\"Using certificates to authenticate devices to the domain provides increased security over passwords.  By default systems will attempt to authenticate using certificates and fall back to passwords if the domain controller does not support certificates for devices.  This may also be configured to always use certificates for device authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJyg5YyGdmvNFobvn1b619ahBQSWRDA6UUW//FX4+mk=\"},\"C-64379r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lY/eHejF7uvV0G4iI3mWusJXcTrrzEH03ruzrhvLCmo=\"},\"F-69559r1_fix\",\"V-63629\",\"medium\",\"WN10-CC-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41288,\"SV-78119r1_rule\",\"medium\",null,null,\"The network selection user interface (UI) must not be displayed on the logon screen.\",\"WN10-CC-000120\",\"Enabling interaction with the network selection UI allows users to change connections to available networks without signing into Windows.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uFh0+SOkPBhoY4cKXKJkJcnyQ6+Tp4ycDdOaJohcCxk=\"},\"C-64385r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:S3TWBmC/Q5xYvT6ZGwAqTSxXSjKl6ycojEqE2r5j7fE=\"},\"F-69565r1_fix\",\"V-63633\",\"medium\",\"WN10-CC-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41289,\"SV-78123r1_rule\",\"medium\",null,null,\"Local users on domain-joined computers must not be enumerated.\",\"WN10-CC-000130\",\"The username is one part of logon credentials that could be used to gain access to a system.  Preventing the enumeration of users limits this information to authorized personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h25vRZXLu1TOtMH5HMSKvo8N5a+Q/ueTRDZ1vspmoQE=\"},\"C-64383r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MSIOrVvh0qZYj2W996i9HW1IJqNJZEwMkJGxNuP+Muw=\"},\"F-69563r1_fix\",\"V-63635\",\"medium\",\"WN10-SO-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41290,\"SV-78125r1_rule\",\"medium\",null,null,\"Audit policy using subcategories must be enabled.\",\"WN10-SO-000030\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.  This setting allows administrators to enable more precise auditing capabilities.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XPkkPkWSdvWEzxDy2sUWix6KC7aJBbG9RBZ/ZnYOGEs=\"},\"C-64389r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:LEy76jPorTWw92lJJwWwEpX5AWnnZBJsINVU5Ic6wqw=\"},\"F-69567r1_fix\",\"V-63639\",\"medium\",\"WN10-SO-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41291,\"SV-78129r1_rule\",\"medium\",null,null,\"Outgoing secure channel traffic must be encrypted or signed.\",\"WN10-SO-000035\",\"Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted.  If this policy is enabled, outgoing secure channel traffic will be encrypted and signed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wy/VGGvzW3UlJ37hiY+I8pUms7MXbP2SNpPKfNy1KIA=\"},\"C-64393r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B6kdQ18Xgf9RP4i2hQ6xycrV4CJUF/AJ5A51qWEH8H4=\"},\"F-69573r1_fix\",\"V-63643\",\"medium\",\"WN10-SO-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41292,\"SV-78133r1_rule\",\"medium\",null,null,\"Outgoing secure channel traffic must be encrypted when possible.\",\"WN10-SO-000040\",\"Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted.  If this policy is enabled, outgoing secure channel traffic will be encrypted.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i3fRKcUyn6PmTSkp0ufLDEGZMye3xAQxD4OpV2pM+0E=\"},\"C-64395r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y1MVZH5v2L2aqAimA3zA6ZxTn0xqMdKaQ22coYGtUro=\"},\"F-69575r1_fix\",\"V-63645\",\"medium\",\"WN10-CC-000145\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41293,\"SV-78135r1_rule\",\"medium\",null,null,\"Users must be prompted for a password on resume from sleep (on battery).\",\"WN10-CC-000145\",\"Authentication must always be required when accessing a system.  This setting ensures the user is prompted for a password on resume from sleep (on battery).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/cJizcUtpE2HLtuWkhVN3GiOSFjewXuYn9IJu3enAXg=\"},\"C-64397r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rRnpzXQnQ5Wg5SL2m++bXGkzUESeCy/W5r2TeBxdxbg=\"},\"F-69577r1_fix\",\"V-63647\",\"medium\",\"WN10-SO-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41294,\"SV-78137r1_rule\",\"medium\",null,null,\"Outgoing secure channel traffic must be signed when possible.\",\"WN10-SO-000045\",\"Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked.  If this policy is enabled, outgoing secure channel traffic will be signed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xC0vDkioBtR1JLW2HOIxcJl4n0eOz6yTkhlZetuLhI8=\"},\"C-64399r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KH892YjfVsGxJYUZGSE0lrd0LppIf/7wFaiIkL6y2mw=\"},\"F-69579r1_fix\",\"V-63649\",\"medium\",\"WN10-CC-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41295,\"SV-78139r1_rule\",\"medium\",null,null,\"The user must be prompted for a password on resume from sleep (plugged in).\",\"WN10-CC-000150\",\"Authentication must always be required when accessing a system.  This setting ensures the user is prompted for a password on resume from sleep (plugged in).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NSgu6s8JKNnXMJ+7CGkFNsLqlJAeYQviKDinQTL+FHo=\"},\"C-64401r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SCyv3bW6lq4Ib1jbv9NTvnfRDTnThjV154hBBpa9mpA=\"},\"F-69581r1_fix\",\"V-63651\",\"high\",\"WN10-CC-000155\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41296,\"SV-78141r1_rule\",\"high\",null,null,\"Solicited Remote Assistance must not be allowed.\",\"WN10-CC-000155\",\"Remote assistance allows another user to view or take control of the local session of a user.  Solicited assistance is help that is specifically requested by the local user.  This may allow unauthorized parties access to the resources on the computer.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:z2vvY1cDmkJvQsHfPOfw8QGJtMOKrIQz9lM3Dc0ytLo=\"},\"C-64707r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:r1bXexq2A1T9qVaB1K5kWuqDXKMQxIjhQ7WYiQDjmxA=\"},\"F-69885r1_fix\",\"V-63653\",\"low\",\"WN10-SO-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41297,\"SV-78143r1_rule\",\"low\",null,null,\"The computer account password must not be prevented from being reset.\",\"WN10-SO-000050\",\"Computer account passwords are changed automatically on a regular basis.  Disabling automatic password changes can make the system more vulnerable to malicious access.  Frequent password changes can be a significant safeguard for your system.  A new password for the computer account will be generated every 30 days.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:14JhGWVp+3S3ydTw3+p8k3X7npjABreOsd4BluBaRyo=\"},\"C-64405r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:AJ6JG4Bk6Dmp1BoAnVEPIilP5krfqcIj8GC43w2lHpQ=\"},\"F-69585r1_fix\",\"V-63657\",\"medium\",\"WN10-CC-000165\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41298,\"SV-78147r1_rule\",\"medium\",null,null,\"Unauthenticated RPC clients must be restricted from connecting to the RPC server.\",\"WN10-CC-000165\",\"Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZJbz3VhLvqjcd2z7NP6j6DC8M0Ltzl3HDFROf1Cpu4o=\"},\"C-81359r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:D1jcVX/W+b0YHzhQERbs67mDWibaHlED0dBMhDjh+wM=\"},\"F-69587r1_fix\",\"V-63659\",\"low\",\"WN10-CC-000170\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41299,\"SV-78149r2_rule\",\"low\",null,null,\"The setting to allow Microsoft accounts to be optional for modern style apps must be enabled.\",\"WN10-CC-000170\",\"Control of credentials and the system must be maintained within the enterprise.  Enabling this setting allows enterprise credentials to be used with modern style apps that support this, instead of Microsoft accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LaaMQgJOQrkO4EB1mnVDnZdeYz6iDashNKpqfHpNCck=\"},\"C-64409r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dL89jp1SO4omws1FGgPrtRlbGuoByCOZPICM5E1jDiY=\"},\"F-69589r1_fix\",\"V-63661\",\"low\",\"WN10-SO-000055\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41300,\"SV-78151r1_rule\",\"low\",null,null,\"The maximum age for machine account passwords must be configured to 30 days or less.\",\"WN10-SO-000055\",\"Computer account passwords are changed automatically on a regular basis.  This setting controls the maximum password age that a machine account may have.  This setting must be set to no more than 30 days, ensuring the machine changes its password monthly.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ye6LltMKmAmswLhHjkhNL7Oek9ZBv20d40WEFxLqoNg=\"},\"C-64411r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sCxZiiwjgSm8OBwRBkMz35gsmx1vpXnwyeoVinYH7r0=\"},\"F-69591r1_fix\",\"V-63663\",\"low\",\"WN10-CC-000175\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41301,\"SV-78153r1_rule\",\"low\",null,null,\"The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.\",\"WN10-CC-000175\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kcyr2a0EWEiUBvmVmyDq0M6j4K7/nBHuXmLhXDDtMf0=\"},\"C-64413r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:t+sRZ4X7MaovbPwgqWxtT6hCeHZM05XnF3CRYEMVCGI=\"},\"F-69593r1_fix\",\"V-63665\",\"medium\",\"WN10-SO-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41302,\"SV-78155r1_rule\",\"medium\",null,null,\"The system must be configured to require a strong session key.\",\"WN10-SO-000060\",\"A computer connecting to a domain controller will establish a secure channel.  Requiring strong session keys enforces 128-bit encryption between systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BLkX1RSbTxRJ+95+jkVEEKAtY1YFGp7VUwcyz/Na6PU=\"},\"C-64415r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ci3qw7pjUYic7vCIX1T40x6Xh/O32MzD07IpvzY758M=\"},\"F-69595r1_fix\",\"V-63667\",\"high\",\"WN10-CC-000180\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41303,\"SV-78157r1_rule\",\"high\",null,null,\"Autoplay must be turned off for non-volume devices.\",\"WN10-CC-000180\",\"Allowing autoplay to execute may introduce malicious code to a system.  Autoplay begins reading from a drive as soon as you insert media in the drive.  As a result, the setup file of programs or music on audio media may start.  This setting will disable autoplay for non-volume devices (such as Media Transfer Protocol (MTP) devices).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mhjrBvHTfJT/OuyLZFDHWxfbvJ3FuijQKPyHh2cvxks=\"},\"C-81353r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mfhw1BAvPFkq7MsuxZE2GyQ/AevVwWiMvufEzfNp6VE=\"},\"F-88429r1_fix\",\"V-63669\",\"medium\",\"WN10-SO-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41304,\"SV-78159r2_rule\",\"medium\",null,null,\"The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.\",\"WN10-SO-000070\",\"Unattended systems are susceptible to unauthorized use and should be locked when unattended.  The screen saver should be set at a maximum of 15 minutes and be password protected.  This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/dizhsZDVZiRpJUm04AvJkfxcjGg5bvtRPbE3Iajy3s=\"},\"C-64419r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Gr1LIZVQ5mNlMy66aYVrA/OKjqKZjPX33xTO3LoND90=\"},\"F-69599r1_fix\",\"V-63671\",\"high\",\"WN10-CC-000185\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41305,\"SV-78161r1_rule\",\"high\",null,null,\"The default autorun behavior must be configured to prevent autorun commands.\",\"WN10-CC-000185\",\"Allowing autorun commands to execute may introduce malicious code to a system.  Configuring this setting prevents autorun commands from executing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CffkXvxske/bT7jvs4za5BpRLmJrKhgTOflYgSJF+X8=\"},\"C-64423r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:IUYeFsIgc0Up3cMziGmWNHQALhhDmlYfxEV3mw5cFBY=\"},\"F-69603r1_fix\",\"V-63673\",\"high\",\"WN10-CC-000190\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41306,\"SV-78163r1_rule\",\"high\",null,null,\"Autoplay must be disabled for all drives.\",\"WN10-CC-000190\",\"Allowing autoplay to execute may introduce malicious code to a system.  Autoplay begins reading from a drive as soon as you insert media in the drive.  As a result, the setup file of programs or music on audio media may start.  By default, autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives.  If you enable this policy, you can also disable autoplay on all drives.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XgzulLjMBxHaNi0V9FHGyZ4It0yWcGbG1JwlFE+T+gk=\"},\"C-64421r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:98laJ6VbZ66jMMUQv5GDvBJWVZDOUd4XtWFuq8asTIo=\"},\"F-69601r2_fix\",\"V-63675\",\"medium\",\"WN10-SO-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41307,\"SV-78165r2_rule\",\"medium\",null,null,\"The required legal notice must be configured to display before console logon.\",\"WN10-SO-000075\",\"Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OHgYhVcmu/l9dVrJ0J5Uo4d4+lLD5rAkwUYwACRT+m0=\"},\"C-81361r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:inbVIW+zQG3/ufZ8fCHtpsqygHo1uhE9Z0Shi7JWHpw=\"},\"F-88435r1_fix\",\"V-63677\",\"medium\",\"WN10-CC-000195\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41308,\"SV-78167r3_rule\",\"medium\",null,null,\"Enhanced anti-spoofing for facial recognition must be enabled on Window 10.\",\"WN10-CC-000195\",\"Enhanced anti-spoofing provides additional protections when using facial recognition with devices that support it.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ofnzmLY6Mws9d7/NtnKBQB4fhzW4stZa4Q8pqud3RuA=\"},\"C-64429r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eLSnY8PHloz7mHtwdf09lPI2PMpuTsKmw/S+HhFSiGg=\"},\"F-69607r1_fix\",\"V-63679\",\"medium\",\"WN10-CC-000200\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41309,\"SV-78169r1_rule\",\"medium\",null,null,\"Administrator accounts must not be enumerated during elevation.\",\"WN10-CC-000200\",\"Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user.  This setting configures the system to always require users to type in a username and password to elevate a running application.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PHPF3Sy5sq6u5phRafA9yRglmtGg7XcKsUmsucub7jI=\"},\"C-64427r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gIHgnFLTdgMMsxBcIBxDElwInOkJE+8HJcwwDdRpq1w=\"},\"F-69609r1_fix\",\"V-63681\",\"low\",\"WN10-SO-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41310,\"SV-78171r1_rule\",\"low\",null,null,\"The Windows dialog box title for the legal banner must be configured.\",\"WN10-SO-000080\",\"Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:32jv43ZfzeffcLH0aNzUt/YSBnCyNLyRuby1CRN3yVw=\"},\"C-81949r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PzcejMlMlof9m/YZ/3j1NJUegoGppEgEiwd19VfFIm8=\"},\"F-89003r2_fix\",\"V-63683\",\"medium\",\"WN10-CC-000205\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41311,\"SV-78173r3_rule\",\"medium\",null,null,\"Windows Telemetry must not be configured to Full.\",\"WN10-CC-000205\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The \\\"Security\\\" option for Telemetry configures the lowest amount of data, effectively none outside of the Malicious Software Removal Tool (MSRT), Defender and telemetry client settings. \\\"Basic\\\" sends basic diagnostic and usage data and may be required to support some Microsoft services. \\\"Enhanced\\\" includes additional information on how Windows and apps are used and advanced reliability data. Windows Analytics can use a \\\"limited enhanced\\\" level to provide information such as health data for devices.  This requires the configuration of an additional setting available with v1709 and later of Windows 10. \",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SoCQzVKKVy7D5huRMI4Q7iyWO6PyUB9uG8vv4geQuQA=\"},\"C-91419r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jQ03pjP3CjGlYCQ/xCpujUMyYmW/fh9NqhCgqPd06zo=\"},\"F-98461r1_fix\",\"V-63685\",\"medium\",\"WN10-CC-000210\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41312,\"SV-78175r6_rule\",\"medium\",null,null,\"The Windows Defender SmartScreen for Explorer must be enabled.\",\"WN10-CC-000210\",\"Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling Windows Defender SmartScreen will warn or prevent users from running potentially malicious programs.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OtsqfrQg9GojUClvvmL4jzwvRg7kIHzjol+WcskfN8k=\"},\"C-64433r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+8vO2vy7uTxR2XHqPadadMrjS2Rni8BOSZVXO6X2Avk=\"},\"F-69615r1_fix\",\"V-63687\",\"low\",\"WN10-SO-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41313,\"SV-78177r1_rule\",\"low\",null,null,\"Caching of logon credentials must be limited.\",\"WN10-SO-000085\",\"The default Windows configuration caches the last logon credentials for users who log on interactively to a system.  This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable.  Even though the credential cache is well-protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pwvSQ+QN5KMngq6whT389oqgH7svUP44geVmJrGKA/Y=\"},\"C-64437r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:i2FiglDJfXybGpBxBjVYKAGi+YYUMg5nL518GU9EkhY=\"},\"F-69617r1_fix\",\"V-63689\",\"medium\",\"WN10-CC-000215\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41314,\"SV-78179r1_rule\",\"medium\",null,null,\"Explorer Data Execution Prevention must be enabled.\",\"WN10-CC-000215\",\"Data Execution Prevention (DEP) provides additional protection by performing  checks on memory to help prevent malicious code from running.  This setting will prevent Data Execution Prevention from being turned off for File Explorer.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FNuzYuatOsVqoAEfYyh44rPDU4p+dXmH2F/22ijPNG8=\"},\"C-72013r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dad3JOoYi4XhqeCDfFPaRfjDET/qOlbEcf8JrcuFYnU=\"},\"F-78109r3_fix\",\"V-63691\",\"low\",\"WN10-CC-000220\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41315,\"SV-78181r3_rule\",\"low\",null,null,\"Turning off File Explorer heap termination on corruption must be disabled.\",\"WN10-CC-000220\",\"Legacy plug-in applications may continue to function when a File Explorer session has become corrupt.  Disabling this feature will prevent this.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ka0gdKnu1i6pDqDBmfSv/etIgqsSnYvxwHo6vjDl/lA=\"},\"C-64443r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8iVJn6AEeEs7abM6FXII1UWcGL2f5acmsBIocVJzJ74=\"},\"F-69623r1_fix\",\"V-63695\",\"medium\",\"WN10-CC-000225\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41316,\"SV-78185r1_rule\",\"medium\",null,null,\"File Explorer shell protocol must run in protected mode.\",\"WN10-CC-000225\",\"The shell protocol will  limit the set of folders applications can open when run in protected mode.  Restricting files an application can open, to a limited set of folders, increases the security of Windows.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v8lM7FP7aQdAEqhdWAElG8v5N9aKZNjsXI3sO16UBJ8=\"},\"C-64445r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cjPwupCSR0TrHEYD/6TMlvONcdLHPWcCMHuTwwt9ubw=\"},\"F-69625r1_fix\",\"V-63697\",\"medium\",\"WN10-SO-000095\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41317,\"SV-78187r1_rule\",\"medium\",null,null,\"The Smart Card removal option must be configured to Force Logoff or Lock Workstation.\",\"WN10-SO-000095\",\"Unattended systems are susceptible to unauthorized use and must be locked.  Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nBBbWUKMYR0oBuDR1T1+MwPCSPwa/PvvTXckuCFHxcY=\"},\"C-79101r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B9S7hFWHqEWN+xF+QGr88dcbc2DFAnUZfPLb3qgLQUE=\"},\"F-98463r1_fix\",\"V-63699\",\"medium\",\"WN10-CC-000230\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41318,\"SV-78189r6_rule\",\"medium\",null,null,\"Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for malicious websites in Microsoft Edge.\",\"WN10-CC-000230\",\"The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites and file downloads.  If users are allowed to ignore warnings from the Windows Defender SmartScreen filter they could still access malicious websites.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nWoWY5Y4H2PjarlDCeZzumdmSKNqLLbQWB6PRDqTQik=\"},\"C-79105r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5BF6ShWtQQz6m2f5qGYgXrEcVyiHrphKl41vORKvwJo=\"},\"F-98465r1_fix\",\"V-63701\",\"medium\",\"WN10-CC-000235\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41319,\"SV-78191r6_rule\",\"medium\",null,null,\"Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for unverified files in Microsoft Edge.\",\"WN10-CC-000235\",\"The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites and file downloads.  If users are allowed to ignore warnings from the Windows Defender SmartScreen filter they could still download potentially malicious files.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YHHxKYwoRYjDWym4IH18cuhmeP93GyehRyGY9+eWOlM=\"},\"C-64451r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4OStpL8M7nd4yILh53YYVghkFMSc6KpjP7exx+P68bw=\"},\"F-69629r1_fix\",\"V-63703\",\"medium\",\"WN10-SO-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41320,\"SV-78193r1_rule\",\"medium\",null,null,\"The Windows SMB client must be configured to always perform SMB packet signing.\",\"WN10-SO-000100\",\"The server message block (SMB) protocol provides the basis for many network operations.  Digitally signed SMB packets aid in preventing man-in-the-middle attacks.  If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Vnj02lH1OuXdBOVVSKAmO3ADzTn5+Ujz8I1pVPj59vU=\"},\"C-79113r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:t8fAWmoC9793q7yjTkKodZAFyvN8+EQyAnQ3eKujeO8=\"},\"F-83245r1_fix\",\"V-63709\",\"medium\",\"WN10-CC-000245\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41321,\"SV-78199r4_rule\",\"medium\",null,null,\"The password manager function in the Edge browser must be disabled.\",\"WN10-CC-000245\",\"Passwords save locally for re-use when browsing may be subject to compromise.  Disabling the Edge password manager will prevent this for the browser.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I1hZ4Drt9YDDg3F9ZAzn33a90Yrg1/tAw/QcCCksE3A=\"},\"C-64459r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Tg8MEMQePeMwS+qS8PbB/4y6EDpxaFlUaj84ph6zmG4=\"},\"F-69639r1_fix\",\"V-63711\",\"medium\",\"WN10-SO-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41322,\"SV-78201r1_rule\",\"medium\",null,null,\"Unencrypted passwords must not be sent to third-party SMB Servers.\",\"WN10-SO-000110\",\"Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication.  Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment.  Check with the vendor of the SMB server to see if there is a way to support encrypted password authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2biNxxxfwe7Qz0rZRb+comoTPxV6tZ2FWyVQ8NR0XLI=\"},\"C-79115r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hTbZqwZ4fsK7/V09FctidZHUoPHmeOqxSidCPX6IxrM=\"},\"F-98467r1_fix\",\"V-63713\",\"medium\",\"WN10-CC-000250\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41323,\"SV-78203r6_rule\",\"medium\",null,null,\"The Windows Defender SmartScreen filter for Microsoft Edge must be enabled.\",\"WN10-CC-000250\",\"The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:K8//OPyNM3tMbqVbeoAI5KxKu5UgN3dLo2qeJqTTARk=\"},\"C-79119r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:p49q6xq7593kHJDfmQQpw38MtEgtBNAo+DiVb+PZ8PQ=\"},\"F-83247r2_fix\",\"V-63717\",\"medium\",\"WN10-CC-000255\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41324,\"SV-78207r5_rule\",\"medium\",null,null,\"The use of a hardware security device with Windows Hello for Business must be enabled.\",\"WN10-CC-000255\",\"The use of a Trusted Platform Module (TPM) to store keys for Windows Hello for Business provides additional security.  Keys stored in the TPM may only be used on that system while keys stored using software are more susceptible to compromise and could be used on other systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m4mVWgszCk8aLeRg9wcZWG+Rs/f7KjQGvMB6lRJ5A+M=\"},\"C-64467r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TlsXbmbT8RHk4qTd4l7iQC/kxVlACAHUoUo7IBK62Ag=\"},\"F-69647r1_fix\",\"V-63719\",\"medium\",\"WN10-SO-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41325,\"SV-78209r1_rule\",\"medium\",null,null,\"The Windows SMB server must be configured to always perform SMB packet signing.\",\"WN10-SO-000120\",\"The server message block (SMB) protocol provides the basis for many network operations.  Digitally signed SMB packets aid in preventing man-in-the-middle attacks.  If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GJyj8KhT2aDTkrVyy9e0G2Fw3bcs2GwK50H4fhiljcA=\"},\"C-64469r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2vvlS11rewnsG4aJFvEFbTIXj6FDxFe+II7GRviyH8Y=\"},\"F-98469r2_fix\",\"V-63721\",\"medium\",\"WN10-CC-000260\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41326,\"SV-78211r6_rule\",\"medium\",null,null,\"Windows 10 must be configured to require a minimum pin length of six characters or greater.\",\"WN10-CC-000260\",\"Windows allows the use of PINs as well as biometrics for authentication without sending a password to a network or website where it could be compromised.  Longer minimum PIN lengths increase the available combinations an attacker would have to attempt.  Shorter minimum length significantly reduces the strength.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RzUSnNAkaFL0vjIzRXyocD/1metNOIhllvi1eHyUE/0=\"},\"C-64479r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:seII/mAuw6P+r2G+ksL9Z1Aks3FE2FZ6U+SN6Gtn1r4=\"},\"F-69657r1_fix\",\"V-63729\",\"medium\",\"WN10-CC-000270\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41327,\"SV-78219r1_rule\",\"medium\",null,null,\"Passwords must not be saved in the Remote Desktop Client.\",\"WN10-CC-000270\",\"Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system.  The system must be configured to prevent users from saving passwords in the Remote Desktop Client.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9Pbb8VW3GGoFqiMEMNsF6+ETyP17aJ7LEE/EwiZmXLY=\"},\"C-64481r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FLcKXmX9gyKTpr/8udHNEwcKZ4rFm5s3IrSYYuIhZio=\"},\"F-69659r1_fix\",\"V-63731\",\"medium\",\"WN10-CC-000275\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41328,\"SV-78221r1_rule\",\"medium\",null,null,\"Local drives must be prevented from sharing with Remote Desktop Session Hosts.\",\"WN10-CC-000275\",\"Preventing users from sharing the local drives on their client computers to Remote Session Hosts that they access helps reduce possible exposure of sensitive data.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pOkacn9XsLUUPvPCp7BiIdMobs3MmyoiiFdmo2S1Jh4=\"},\"C-64483r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VvnnQJPqecT+hGCdyEjfV7HVGJGunhW9nSTQ3QH37Ig=\"},\"F-69661r1_fix\",\"V-63733\",\"medium\",\"WN10-CC-000280\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41329,\"SV-78223r1_rule\",\"medium\",null,null,\"Remote Desktop Services must always prompt a client for passwords upon connection.\",\"WN10-CC-000280\",\"This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection.  Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:db4NX5ePYijTdjIZhHi6AMQwXOH25jy1YMRAOPp6z8o=\"},\"C-64487r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RM0/gj1Qt707JlUYlmbLvA1fy/6G/giJ85DeOs8B6dc=\"},\"F-69665r1_fix\",\"V-63737\",\"medium\",\"WN10-CC-000285\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41330,\"SV-78227r1_rule\",\"medium\",null,null,\"The Remote Desktop Session Host must require secure RPC communications.\",\"WN10-CC-000285\",\"Allowing unsecure RPC communication exposes the system to man in the middle attacks and data disclosure attacks. A man in the middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5oFtb8E3qwiXU282gaObtdqYpKDg1HKwTV1n0yGLwdM=\"},\"C-64489r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9sj/XY7wTDukfNd098czduTVWQutMeqhJuSaISLQsag=\"},\"F-69667r1_fix\",\"V-63739\",\"high\",\"WN10-SO-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41331,\"SV-78229r1_rule\",\"high\",null,null,\"Anonymous SID/Name translation must not be allowed.\",\"WN10-SO-000140\",\"Allowing anonymous SID/Name translation can provide sensitive information for accessing a system.  Only authorized users must be able to perform such translations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XK40On1j1swkBQC4KHrqqKtA3+PU7O8didBZ9X2v3mU=\"},\"C-64491r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9UXyqEvrfJKY1Z3d2vJfrn9DoiXbrUvbEcBkOzErot8=\"},\"F-69669r1_fix\",\"V-63741\",\"medium\",\"WN10-CC-000290\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41332,\"SV-78231r1_rule\",\"medium\",null,null,\"Remote Desktop Services must be configured with the client connection encryption set to the required level.\",\"WN10-CC-000290\",\"Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting \\\"High Level\\\" will ensure encryption of Remote Desktop Services sessions in both directions.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D+Br9Bp34FIbXISTUzTyziluj9wIh2NeP3T7rqIlBeU=\"},\"C-64495r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:yKSPAaHSRXGDmYNqGS2PbbzeQyT5KHe1NkItcInDozg=\"},\"F-69671r1_fix\",\"V-63743\",\"medium\",\"WN10-CC-000295\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41333,\"SV-78233r1_rule\",\"medium\",null,null,\"Attachments must be prevented from being downloaded from RSS feeds.\",\"WN10-CC-000295\",\"Attachments from RSS feeds may not be secure.  This setting will prevent attachments from being downloaded from RSS feeds.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:q4amaRBeQBzWaWDuh+jg7+M6Q2vE1slnyWZ9vRYL1BU=\"},\"C-64493r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:80tL2NQiJzWA+nvWYN6N/dITCvP4z3gJpjfnPCQLSx0=\"},\"F-69673r1_fix\",\"V-63745\",\"high\",\"WN10-SO-000145\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41334,\"SV-78235r1_rule\",\"high\",null,null,\"Anonymous enumeration of SAM accounts must not be allowed.\",\"WN10-SO-000145\",\"Anonymous enumeration of SAM accounts allows anonymous log on users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2hvdFSkHFd/jxnDg7QHAFnPQALuFWOVvLZGgRROj5l8=\"},\"C-64497r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kHkfZTI+A4AbE13Gdmo2ILJcZzgniSLt8HUZ5HyExjw=\"},\"F-69675r1_fix\",\"V-63747\",\"medium\",\"WN10-CC-000300\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41335,\"SV-78237r1_rule\",\"medium\",null,null,\"Basic authentication for RSS feeds over HTTP must not be used.\",\"WN10-CC-000300\",\"Basic authentication uses plain text passwords that could be used to compromise a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PH+4N2yTf3KYeI3LzoMmv9I7NMVl4gENYVtdt5aHEQ4=\"},\"C-64499r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YJU6GsJ3MJkZ8CijAZUKemQUh76XEXi6kyN5hwgRL4k=\"},\"F-69677r1_fix\",\"V-63749\",\"high\",\"WN10-SO-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41336,\"SV-78239r1_rule\",\"high\",null,null,\"Anonymous enumeration of shares must be restricted.\",\"WN10-SO-000150\",\"Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MT/QRJ+7T5KdEYjB1CflYUeHypJvbgQA/NoSivDno44=\"},\"C-64501r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ouSnIupvvqC0crPccT7gBXrFmsWkb2i86WiVIUjCbqs=\"},\"F-69679r1_fix\",\"V-63751\",\"medium\",\"WN10-CC-000305\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41337,\"SV-78241r1_rule\",\"medium\",null,null,\"Indexing of encrypted files must be turned off.\",\"WN10-CC-000305\",\"Indexing of encrypted files may expose sensitive data.  This setting prevents encrypted files from being indexed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PPMakW1bUBUuTQXNZEWFXjV3n8bqxzcAep6WCv0LA6I=\"},\"C-64505r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CIxgreCun2hEbE39zaL6XRLXsvYRN0yNWQFu3yL064E=\"},\"F-69683r1_fix\",\"V-63755\",\"medium\",\"WN10-SO-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41338,\"SV-78245r1_rule\",\"medium\",null,null,\"The system must be configured to prevent anonymous users from having the same rights as the Everyone group.\",\"WN10-SO-000160\",\"Access by anonymous users must be restricted.  If this setting is enabled, then anonymous users have the same rights and permissions as the built-in Everyone group.  Anonymous users must not have these permissions or rights.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+CqVPSzadLgqURUz9jpa2vfnE9s9rDLe5PbBuASRgh0=\"},\"C-64509r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lmEqFepqElh4JHMGSs+lVIjqQ7WBg0SLMTdPF7FkJuo=\"},\"F-69687r1_fix\",\"V-63759\",\"high\",\"WN10-SO-000165\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41339,\"SV-78249r1_rule\",\"high\",null,null,\"Anonymous access to Named Pipes and Shares must be restricted.\",\"WN10-SO-000165\",\"Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access.  This setting restricts access to those defined in \\\"Network access: Named Pipes that can be accessed anonymously\\\" and \\\"Network access: Shares that can be accessed anonymously\\\",  both of which must be blank under other requirements.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m79WMkHt8ZOH03cNAv+YgwDxku23Nclna/dukfCHBwE=\"},\"C-64517r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/pAKglnnL1IEuLqBC+c6SyiwacUUiL1rDYa3onzxiNc=\"},\"F-69693r1_fix\",\"V-63765\",\"medium\",\"WN10-SO-000180\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41340,\"SV-78255r1_rule\",\"medium\",null,null,\"NTLM must be prevented from falling back to a Null session.\",\"WN10-SO-000180\",\"NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bu7KdaDw/5/s3TIiuDAAhnNsO3EvwivuJyQ8TxBRC2k=\"},\"C-64519r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:L0C4ySCZnL+TtFW8F+lv8g72upyUuF1Zn/Zw3K0bzl0=\"},\"F-69695r1_fix\",\"V-63767\",\"medium\",\"WN10-SO-000185\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41341,\"SV-78257r1_rule\",\"medium\",null,null,\"PKU2U authentication using online identities must be prevented.\",\"WN10-SO-000185\",\"PKU2U is a peer-to-peer authentication protocol.   This setting prevents online identities from authenticating to domain-joined systems.  Authentication will be centrally managed with Windows user accounts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WBduyUoS7ji0lJWOQsFV1TVIPhzv+GArzEJ9SaioyCg=\"},\"C-64545r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TGki+/+ykJXJ/k/DudIIisxNEy93XM3iv0yGY2fiKO8=\"},\"F-69723r2_fix\",\"V-63795\",\"medium\",\"WN10-SO-000190\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41342,\"SV-78285r1_rule\",\"medium\",null,null,\"Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.\",\"WN10-SO-000190\",\"Certain encryption types are no longer considered secure.  This setting configures a minimum encryption type for Kerberos, preventing the use of the DES and RC4 encryption suites.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:esvIIQzIXuuV6UAZCui3VcV9VGJeNpc//UNi3KoTS1w=\"},\"C-64547r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1Cv95OKFzyvZ4bRINC7Cv4fXGMtlaacMtNSowP9y7Ao=\"},\"F-69725r1_fix\",\"V-63797\",\"high\",\"WN10-SO-000195\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41343,\"SV-78287r1_rule\",\"high\",null,null,\"The system must be configured to prevent the storage of the LAN Manager hash of passwords.\",\"WN10-SO-000195\",\"The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords.  This setting controls whether or not a LAN Manager hash of the password is stored in the SAM the next time the password is changed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5qXivRds1q8g/9HnQ9nxJHz6twXtapACZhIt29psYMg=\"},\"C-64551r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0wdY1oOmLJZYVMb3ewPDolyocCYSxXOPJ+0XcVfOE5o=\"},\"F-69729r1_fix\",\"V-63801\",\"high\",\"WN10-SO-000205\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41344,\"SV-78291r1_rule\",\"high\",null,null,\"The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.\",\"WN10-SO-000205\",\"The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts.  NTLM, which is less secure, is retained in later Windows versions  for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it.  It is also used to authenticate logons to stand-alone computers that are running later versions.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YGadfMPpS3VMGBFW+r3ZcBbI9dYCCdc/zyMG4vKxtCU=\"},\"C-64553r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:UfsUJ6+QhNp9kcpFKuqZcTmy3ALjhtMSAGFmNACo9AY=\"},\"F-69731r1_fix\",\"V-63803\",\"medium\",\"WN10-SO-000210\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41345,\"SV-78293r1_rule\",\"medium\",null,null,\"The system must be configured to the required LDAP client signing level.\",\"WN10-SO-000210\",\"This setting controls the signing requirements for LDAP clients.  This setting must be set to Negotiate signing or Require signing, depending on the environment and type of LDAP server in use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wPbkf7isP1x09ZPgzKuJL8TtdkHaTA1/d8tDtGfpybs=\"},\"C-64555r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1+ExGyHoKNbg9f2hPevtLVyViy0jw9P1CLvJYNnLXyA=\"},\"F-69733r1_fix\",\"V-63805\",\"medium\",\"WN10-SO-000215\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41346,\"SV-78295r1_rule\",\"medium\",null,null,\"The system must be configured to meet the minimum session security requirement for NTLM SSP based clients.\",\"WN10-SO-000215\",\"Microsoft has implemented a variety of security support providers for use with RPC sessions.  All of the options must be enabled to ensure the maximum security level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gvDKD+YMxXb3Dbh+NdpQ/LmlaxOytN56P+kbBAhz7EA=\"},\"C-64557r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cx68iW81VjvTZ8JCOTGJY+ZkDwZAyi58zqvh9W0D+oY=\"},\"F-69735r1_fix\",\"V-63807\",\"medium\",\"WN10-SO-000220\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41347,\"SV-78297r1_rule\",\"medium\",null,null,\"The system must be configured to meet the minimum session security requirement for NTLM SSP based servers.\",\"WN10-SO-000220\",\"Microsoft has implemented a variety of security support providers for use with RPC sessions.  All of the options must be enabled to ensure the maximum security level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QgLpxb9vltYJFW7KY8eBS23IB732VOg5sO/3heYiTSY=\"},\"C-64561r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:93DcQLMka1EstIPvjGFGOJ5foKzfD1YZE+HUfIx9paw=\"},\"F-69739r1_fix\",\"V-63811\",\"medium\",\"WN10-SO-000230\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41348,\"SV-78301r1_rule\",\"medium\",null,null,\"The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.\",\"WN10-SO-000230\",\"This setting ensures that the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing.  FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QiljZhB01LqOQfbiDH4gdszZSQwiokE7rvHMNETmntI=\"},\"C-64565r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dCyIjTSOsteLs196W+MDtMhL8jnRdoLpKwA+nvvWzmg=\"},\"F-69743r1_fix\",\"V-63815\",\"low\",\"WN10-SO-000240\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41349,\"SV-78305r1_rule\",\"low\",null,null,\"The default permissions of global system objects must be increased.\",\"WN10-SO-000240\",\"Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. If this policy is enabled, the default DACL is stronger, allowing non-admin users to read shared objects, but not modify shared objects that they did not create.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9xKCBYF3X03GOrS60NZkKP1tRU65uLNh/SvSEhv7qzY=\"},\"C-64567r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1f85JbcxwG6eJsI6OJtbVtsrFjIPElpHt9NkyJmdOBc=\"},\"F-69745r1_fix\",\"V-63817\",\"medium\",\"WN10-SO-000245\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41350,\"SV-78307r1_rule\",\"medium\",null,null,\"User Account Control approval mode for the built-in Administrator must be enabled.\",\"WN10-SO-000245\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures the built-in Administrator account so that it runs in Admin Approval Mode.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6anIfcvLd9P3Qqj21QYsvMEK1vkh6OjqA8kxfY/qKRI=\"},\"C-64569r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:m0c1pC4N9864TRC68Ar0oJjxRt++R+ocV6OA/6pOhUQ=\"},\"F-69747r1_fix\",\"V-63819\",\"medium\",\"WN10-SO-000250\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41351,\"SV-78309r1_rule\",\"medium\",null,null,\"User Account Control must, at minimum, prompt administrators for consent on the secure desktop.\",\"WN10-SO-000250\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures the elevation requirements for logged on administrators to complete a task that requires raised privileges.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2Mf6LpRtxqJ2Xi014C6XdUKrfkVm1If47khfoSg5IPk=\"},\"C-64571r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:N/o1L9Q+AUc8QsP9dAiLMwg8rm0IExtcCSPzA1bf5Po=\"},\"F-69749r1_fix\",\"V-63821\",\"medium\",\"WN10-SO-000255\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41352,\"SV-78311r1_rule\",\"medium\",null,null,\"User Account Control must automatically deny elevation requests for standard users.\",\"WN10-SO-000255\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  Denying elevation requests from standard user accounts requires tasks that need elevation to be initiated by accounts with administrative privileges.  This ensures correct accounts are used on the system for privileged tasks to help mitigate credential theft.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xIxQC3EFtKo4/I03k/uVVwqUkFC9effmNV1HiiiVNas=\"},\"C-64575r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:c3FJiPcRTQKsbimXW346V6o1aEmBxxUjtvc6xMkzBuk=\"},\"F-69753r1_fix\",\"V-63825\",\"medium\",\"WN10-SO-000260\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41353,\"SV-78315r1_rule\",\"medium\",null,null,\"User Account Control must be configured to detect application installations and prompt for elevation.\",\"WN10-SO-000260\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting requires Windows to respond to application installation requests by prompting for credentials.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8HK3jPasJRJpBZDqSPFQU1vxUyg5+aAI6SAka9PPlvc=\"},\"C-64577r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9i1/CQ1T55XT7+qRqaJr58Gz7WiZB48LYgpipcVwl8Y=\"},\"F-69755r1_fix\",\"V-63827\",\"medium\",\"WN10-SO-000265\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41354,\"SV-78317r1_rule\",\"medium\",null,null,\"User Account Control must only elevate UIAccess applications that are installed in secure locations.\",\"WN10-SO-000265\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\\\\System32 folders, to run with elevated privileges.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TXh7CT8eDFg9PQd3GuTWW0B0BM4p6bzG9FF1T+9Vv8s=\"},\"C-64579r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:A7Xg19vCL5Q1xW+Fj+Az/f5vpJcs5u/SrRq9BClkS1w=\"},\"F-69757r1_fix\",\"V-63829\",\"medium\",\"WN10-SO-000270\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41355,\"SV-78319r1_rule\",\"medium\",null,null,\"User Account Control must run all administrators in Admin Approval Mode, enabling UAC.\",\"WN10-SO-000270\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting enables UAC.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jTdDk2qrsY7wk2fxd9JsCbcokx4k7p+QSN/VYmbUB9k=\"},\"C-64581r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Xl6F0faD877NphGnac4TlBR9h7CQODCKRBJEbkazvZw=\"},\"F-69759r1_fix\",\"V-63831\",\"medium\",\"WN10-SO-000275\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41356,\"SV-78321r1_rule\",\"medium\",null,null,\"User Account Control must virtualize file and registry write failures to per-user locations.\",\"WN10-SO-000275\",\"User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures non-UAC compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ps+f+j5cOJetWmfgZFHPTjOUfHH002d19GW01SZ35RY=\"},\"C-64589r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kTK1HAiRWb7wh2x/972MVh76uwhKv3aK9KX756oAZUQ=\"},\"F-69767r1_fix\",\"V-63839\",\"low\",\"WN10-UC-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41357,\"SV-78329r1_rule\",\"low\",null,null,\"Toast notifications to the lock screen must be turned off.\",\"WN10-UC-000015\",\"Toast notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel.  Turning off this feature will limit access to the information to a logged on user.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:31JR/6WQp6TuKxIQqNorrp6RBoUM0yhGJ95MVdPpzUw=\"},\"C-72015r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5Ot0vgTp8BQIqeYRzGXU6jF6SmJwLU7WpTomfAop3sk=\"},\"F-78717r1_fix\",\"V-63841\",\"medium\",\"WN10-UC-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41358,\"SV-78331r2_rule\",\"medium\",null,null,\"Zone information must be preserved when saving attachments.\",\"WN10-UC-000020\",\"Preserving zone of origin (internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4Q6F4dio1jN4MtIZbfGfkZnYkN6zfJazb6nB793l6nQ=\"},\"C-64593r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0P5EtYikbUi9E8oJtKWDfYRy9/apYtbEE8kRho3lm2s=\"},\"F-69771r1_fix\",\"V-63843\",\"medium\",\"WN10-UR-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41359,\"SV-78333r1_rule\",\"medium\",null,null,\"The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.\",\"WN10-UR-000005\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Access Credential Manager as a trusted caller\\\" user right may be able to retrieve the credentials of other accounts from Credential Manager.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:at5fqeVaC1Sm9FnXQjZ7YLh8ehuVr9z5FoeJZMIMABA=\"},\"C-78091r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dkn7S+ZGNYR6EDPqRbNd2XSN1OwzgDnpb8htRCC7PzI=\"},\"F-81289r1_fix\",\"V-63845\",\"medium\",\"WN10-UR-000010\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41360,\"SV-78335r3_rule\",\"medium\",null,null,\"The Access this computer from the network user right must only be assigned to the Administrators and Remote Desktop Users groups.\",\"WN10-UR-000010\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Access this computer from the network\\\" user right may access resources on the system, and must be limited to those that require it.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8xkuF4nDSjRiPP+9oGCPnfWYPGGSOi17d7FbL0XhlU0=\"},\"C-64597r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lH+1d+CUETOJmmgPi4Eh1CmVaFGByIFqLf5MAj1QNCg=\"},\"F-69775r1_fix\",\"V-63847\",\"high\",\"WN10-UR-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41361,\"SV-78337r1_rule\",\"high\",null,null,\"The Act as part of the operating system user right must not be assigned to any groups or accounts.\",\"WN10-UR-000015\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Act as part of the operating system\\\" user right can assume the identity of any user and gain access to resources that user is authorized to access.  Any accounts with this right can take complete control of a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dq7TXJZ0aBQkd+AjwMgoDVp+n4UvOG8n1gEF82FEBlE=\"},\"C-81367r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Xl4LzBTTkELkCIZqGakC2Cs0g1urWrbMdVhJLuVCRPs=\"},\"F-88439r1_fix\",\"V-63851\",\"medium\",\"WN10-UR-000025\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41362,\"SV-78341r2_rule\",\"medium\",null,null,\"The Allow log on locally user right must only be assigned to the Administrators and Users groups.\",\"WN10-UR-000025\",\"Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\\n\\nAccounts with the \\\"Allow log on locally\\\" user right can log on interactively to a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KEKE0PGxslNV0A6vemAzaWjzbx9nYy/RbiPhNJ3aL20=\"},\"C-64603r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wjp/q1GocHJDSKu6HUfJsuOtQPP0kDgmTKsCC7cxZyQ=\"},\"F-69781r1_fix\",\"V-63853\",\"medium\",\"WN10-UR-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41363,\"SV-78343r1_rule\",\"medium\",null,null,\"The Back up files and directories user right must only be assigned to the Administrators group.\",\"WN10-UR-000030\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Back up files and directories\\\" user right can circumvent file and directory permissions and could allow access to sensitive data.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cDiaxsqIK6oeD+TiOA04U8bzW/Xipep+PGUIszW1Ddg=\"},\"C-64605r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:U/cFLnQ/p+ew1NO2jk7jx27uLjZ7K4bhawkMyDg8moo=\"},\"F-69783r2_fix\",\"V-63855\",\"medium\",\"WN10-UR-000035\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41364,\"SV-78345r2_rule\",\"medium\",null,null,\"The Change the system time user right must only be assigned to Administrators and Local Service and NT SERVICE\\\\autotimesvc.\",\"WN10-UR-000035\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Change the system time\\\" user right can change the system time, which can impact authentication, as well as affect time stamps on event log entries.\\n\\nThe NT SERVICE\\\\autotimesvc is added in v1909 cumulative update. \",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Wzi+dcfocDaL/BL8ZywSuiDTEG4Zv3kI5qdXUcl3y8E=\"},\"C-64607r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8zMCD/IKqVJ/fXFhi/Wm5Gh/E5mOCHccloPzGxq/4iE=\"},\"F-69785r1_fix\",\"V-63857\",\"medium\",\"WN10-UR-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41365,\"SV-78347r1_rule\",\"medium\",null,null,\"The Create a pagefile user right must only be assigned to the Administrators group.\",\"WN10-UR-000040\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Create a pagefile\\\" user right can change the size of a pagefile, which could affect system performance.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m3olQQDR+ylJqlRWob7mYvRuzE60jAwPG6gvqc+QNq4=\"},\"C-64609r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bG2PZaJNs9ecO6qKJICBZlSrM78VxxabO9H3M3EUQqc=\"},\"F-69787r2_fix\",\"V-63859\",\"high\",\"WN10-UR-000045\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41366,\"SV-78349r1_rule\",\"high\",null,null,\"The Create a token object user right must not be assigned to any groups or accounts.\",\"WN10-UR-000045\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Create a token object\\\" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:srfyN9VEgB5cnpXOBY292RFK5lJspJquvD0ZD4TIQLE=\"},\"C-64611r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:3GTvWhd/A8LO+nyZwqP9YKzU+SgKstcEDws2u6mZ+To=\"},\"F-69789r1_fix\",\"V-63861\",\"medium\",\"WN10-UR-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41367,\"SV-78351r1_rule\",\"medium\",null,null,\"The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.\",\"WN10-UR-000050\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Create global objects\\\" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KcAj9nx0K1Jq/IEktNS9qbRss/b4npcbS1XEQ+S/Xm0=\"},\"C-64613r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:X34pPeycBlL0GZKXjB7Mt7WYIKastRoN1JjKquwVZIU=\"},\"F-69791r1_fix\",\"V-63863\",\"medium\",\"WN10-UR-000055\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41368,\"SV-78353r1_rule\",\"medium\",null,null,\"The Create permanent shared objects user right must not be assigned to any groups or accounts.\",\"WN10-UR-000055\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Create permanent shared objects\\\" user right could expose sensitive data by creating shared objects.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3c6IOQPBsJcn8+IGDfwZ5oHJ/hbHObilnQESAeOLePs=\"},\"C-76167r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SRTeMQOurz8bQYLytMEFTmCJvFFV5XxEwmHuSvNvjgc=\"},\"F-69793r1_fix\",\"V-63865\",\"medium\",\"WN10-UR-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41369,\"SV-78355r2_rule\",\"medium\",null,null,\"The Create symbolic links user right must only be assigned to the Administrators group.\",\"WN10-UR-000060\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Create symbolic links\\\" user right can create pointers to other objects, which could potentially expose the system to attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PgmqvkJqmLhRaPCQpSZZxUPFDDIdB1muY7/23B1nyZM=\"},\"C-64619r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TWMfw7k3V5v/oNV0mZHixqfTQgolQ5/LURmoZBPNyl8=\"},\"F-69797r1_fix\",\"V-63869\",\"high\",\"WN10-UR-000065\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41370,\"SV-78359r1_rule\",\"high\",null,null,\"The Debug programs user right must only be assigned to the Administrators group.\",\"WN10-UR-000065\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Debug Programs\\\" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components.  This right is given to Administrators in the default configuration.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qj88J123Y6ALiPB3Uh+vm0KvR68nqjRVdYVnlzC1rII=\"},\"C-81369r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:koH0FsedyUbc3GTxXlLNXKaLwWT6ld4COb/PHndEwvA=\"},\"F-88441r1_fix\",\"V-63871\",\"medium\",\"WN10-UR-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41371,\"SV-78361r3_rule\",\"medium\",null,null,\"The Deny access to this computer from the network user right on workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.\",\"WN10-UR-000070\",\"Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\\n\\nThe \\\"Deny access to this computer from the network\\\" right defines the accounts that are prevented from logging on from the network.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.\\n\\nLocal accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks.\\n\\nThe Guests group must be assigned this right to prevent unauthenticated access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gRYqjlzcylziTXB0rod7QdHFL/L5BST/gimkIhHW/vk=\"},\"C-64623r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QR8rMbfP0bYem6CaUDF4p4InJIAIp/WARLl1wr24J+U=\"},\"F-69801r1_fix\",\"V-63873\",\"medium\",\"WN10-UR-000075\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41372,\"SV-78363r1_rule\",\"medium\",null,null,\"The Deny log on as a batch job user right on domain-joined workstations must be configured to prevent access from highly privileged domain accounts.\",\"WN10-UR-000075\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Deny log on as a batch job\\\" right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Hn5uwnn6gC1VwYXthEGUgC6ziFRTZscKIoUS++3Rjto=\"},\"C-94081r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:A3nadAl1DlKeOYbXl4/6ZUtaau9FUhRhgRq2BSyoVmg=\"},\"F-100993r1_fix\",\"V-63875\",\"medium\",\"WN10-UR-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41373,\"SV-78365r2_rule\",\"medium\",null,null,\"The Deny log on as a service user right on Windows 10 domain-joined workstations must be configured to prevent access from highly privileged domain accounts.\",\"WN10-UR-000080\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Deny log on as a service\\\" right defines accounts that are denied log on as a service.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain.\\n\\nIncorrect configurations could prevent services from starting and result in a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XTQwo3vFeHtIVTshIduv4IWitfBFRakuEQXlLRuSS24=\"},\"C-81371r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9VeeDgwQVkT/exUSjv6Ovcl8SUv7kU7mYlxF4qZCtb4=\"},\"F-88443r1_fix\",\"V-63877\",\"medium\",\"WN10-UR-000085\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41374,\"SV-78367r2_rule\",\"medium\",null,null,\"The Deny log on locally user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems.\",\"WN10-UR-000085\",\"Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\\n\\nThe \\\"Deny log on locally\\\" right defines accounts that are prevented from logging on interactively.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.\\n\\nThe Guests group must be assigned this right to prevent unauthenticated access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oDnTVUc7IVAYvvMQbb1Wz03I5+3OQ5gnInH/2FTM+UQ=\"},\"C-94083r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nywkeJfphs8p9QmHEW6QIIy0cJ5ghfBoRh69uQw90SQ=\"},\"F-88445r1_fix\",\"V-63879\",\"medium\",\"WN10-UR-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41375,\"SV-78369r4_rule\",\"medium\",null,null,\"The Deny log on through Remote Desktop Services user right on Windows 10 workstations must at a minimum be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.\",\"WN10-UR-000090\",\"Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\\n\\nThe \\\"Deny log on through Remote Desktop Services\\\" right defines the accounts that are prevented from logging on using Remote Desktop Services.\\n\\nIf Remote Desktop Services is not used by the organization, the Everyone group must be assigned this right to prevent all access.\\n\\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.\\n\\nLocal accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks.\\n\\nThe Guests group must be assigned this right to prevent unauthenticated access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HCUwYAohklOWhKjdCkwUXELBicl1aKdYsLlX2ENO5ZQ=\"},\"C-64631r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8hf+ttnXrBz3tjm15xWFy1gfNWxyAsg6g235d3bMNCU=\"},\"F-69809r1_fix\",\"V-63881\",\"medium\",\"WN10-UR-000095\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41376,\"SV-78371r1_rule\",\"medium\",null,null,\"The Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts.\",\"WN10-UR-000095\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Enable computer and user accounts to be trusted for delegation\\\" user right allows the \\\"Trusted for Delegation\\\" setting to be changed. This could potentially allow unauthorized users to impersonate other users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h8rwAYISD/28YdzSDaeuG5FpPZBqNPB9wT86XIfoUdE=\"},\"C-64633r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:esgXWycKuQZruggJyh9Ol7GwmEzQJm9SGb0QT0yUtfk=\"},\"F-69811r1_fix\",\"V-63883\",\"medium\",\"WN10-UR-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41377,\"SV-78373r1_rule\",\"medium\",null,null,\"The Force shutdown from a remote system user right must only be assigned to the Administrators group.\",\"WN10-UR-000100\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Force shutdown from a remote system\\\" user right can remotely shut down a system which could result in a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8ZljbVob0XqSwiA5dOYkrIecCXdmnQCug5ybd0v/x1Q=\"},\"C-64639r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:doKzrhFXOcBUCa8mb8oq2DvsmDq5V1THjTE/n8l3Qpk=\"},\"F-69817r1_fix\",\"V-63889\",\"medium\",\"WN10-UR-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41378,\"SV-78379r1_rule\",\"medium\",null,null,\"The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.\",\"WN10-UR-000110\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Impersonate a client after authentication\\\" user right allows a program to impersonate another user or account to run on their behalf. An attacker could potentially use this to elevate privileges.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zxCJ1n+/xpv4SXNOQLm6wAQSmkH1udVPy4xRJNH22s0=\"},\"C-64667r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SUCrurhykryvVKTz9GWJ3w9cTzGoZuL4CwNKapjj4Nk=\"},\"F-69845r1_fix\",\"V-63917\",\"medium\",\"WN10-UR-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41379,\"SV-78407r1_rule\",\"medium\",null,null,\"The Load and unload device drivers user right must only be assigned to the Administrators group.\",\"WN10-UR-000120\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Load and unload device drivers\\\" user right allows device drivers to dynamically be loaded on a system by a user. This could potentially be used to install malicious code by an attacker.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pvOcEpA+TB34F4cWCOGMSfSEkxZAfBUxITpDJmb9+K4=\"},\"C-64675r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6e9tpU5sJRuxuqMaLyEeFRtnGNCyAkndOHctlQh/p+U=\"},\"F-69853r1_fix\",\"V-63925\",\"medium\",\"WN10-UR-000125\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41380,\"SV-78415r1_rule\",\"medium\",null,null,\"The Lock pages in memory user right must not be assigned to any groups or accounts.\",\"WN10-UR-000125\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nThe \\\"Lock pages in memory\\\" user right allows physical memory to be assigned to processes, which could cause performance issues or a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ntgurAdRh2vPTZ6v6uIm1vEBH6EsSEipSMq20DsG+D8=\"},\"C-64677r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KwWbfMfFZql+AKxylOLvygdGadkfUHQIq36+h28fZbI=\"},\"F-69855r1_fix\",\"V-63927\",\"medium\",\"WN10-UR-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41381,\"SV-78417r1_rule\",\"medium\",null,null,\"The Manage auditing and security log user right must only be assigned to the Administrators group.\",\"WN10-UR-000130\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Manage auditing and security log\\\" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zpJA36QZjPMfklit+NRW9GEdI9+UG+zGf4DOGG8XG6Y=\"},\"C-64681r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:T4llh+VCxuV2Fyk12sbY99zVphPSqjyrvbbuIsk6Koo=\"},\"F-69859r1_fix\",\"V-63931\",\"medium\",\"WN10-UR-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41382,\"SV-78421r1_rule\",\"medium\",null,null,\"The Modify firmware environment values user right must only be assigned to the Administrators group.\",\"WN10-UR-000140\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Modify firmware environment values\\\" user right can change hardware configuration environment variables. This could result in hardware failures or a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6Vr6sSumF5z/+2j4Jut2d6KaK1Nl8c/eF71h3mZz84s=\"},\"C-64683r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:58eSIVL8m7QzY3SYimfFF/nDuwl11WTOchEf/D6tXr4=\"},\"F-69861r1_fix\",\"V-63933\",\"medium\",\"WN10-UR-000145\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41383,\"SV-78423r1_rule\",\"medium\",null,null,\"The Perform volume maintenance tasks user right must only be assigned to the Administrators group.\",\"WN10-UR-000145\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Perform volume maintenance tasks\\\" user right can manage volume and disk configurations. They could potentially delete volumes, resulting in, data loss or a DoS.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U1jQim/n6VHAUZXYJaQi/HWtt7Q3k/5g/dZtKPgRpRQ=\"},\"C-64685r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+3g+iyx8lV+Qihe18EjHZbZtYJZYLaQjpr7hF1kjYls=\"},\"F-69863r1_fix\",\"V-63935\",\"medium\",\"WN10-UR-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41384,\"SV-78425r1_rule\",\"medium\",null,null,\"The Profile single process user right must only be assigned to the Administrators group.\",\"WN10-UR-000150\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Profile single process\\\" user right can monitor non-system processes performance. An attacker could potentially use this to identify processes to attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F0RPJGfwD1qORt7UmHAIsqA20ktqswUXeKiEMO4DFEw=\"},\"C-64691r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vS+hQSlGNf4MpRQS97hEvCTsa8GXWltEE7+gZiRNfqM=\"},\"F-69867r1_fix\",\"V-63939\",\"medium\",\"WN10-UR-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41385,\"SV-78429r1_rule\",\"medium\",null,null,\"The Restore files and directories user right must only be assigned to the Administrators group.\",\"WN10-UR-000160\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Restore files and directories\\\" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to over-write more current data.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hO/PQW/5C6I5rdjEwZhLARaC8GglwdI3lTW+tbXMeS4=\"},\"C-64693r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jVS0vRb7tWvU1r/KiIBkXQ8TK4yQsSDiLOS1ExWWxSk=\"},\"F-69869r1_fix\",\"V-63941\",\"medium\",\"WN10-UR-000165\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41386,\"SV-78431r1_rule\",\"medium\",null,null,\"The Take ownership of files or other objects user right must only be assigned to the Administrators group.\",\"WN10-UR-000165\",\"Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\\n\\nAccounts with the \\\"Take ownership of files or other objects\\\" user right can take ownership of objects and make changes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJSxQGzb7YGcY1mgBjeFquoDAw5e1lp1zoNJaIM2u2U=\"},\"C-76221r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B+8s7YEQR2Jk3MpIl5LKgCGEyxi7T3p2M4KNz6wxSII=\"},\"F-83251r4_fix\",\"V-65681\",\"low\",\"WN10-CC-000206\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41387,\"SV-80171r3_rule\",\"low\",null,null,\"Windows Update must not obtain updates from other PCs on the Internet.\",\"WN10-CC-000206\",\"Windows 10 allows Windows Update to obtain updates from additional sources instead of Microsoft. In addition to Microsoft, updates can be obtained from and sent to PCs on the local network as well as on the Internet. This is part of the Windows Update trusted process, however to minimize outside exposure, obtaining updates from or sending to systems on the Internet must be prevented.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nB5yZlxqxo8iNwRqReGtHbsRcruqk84xPSKCKzfrudk=\"},\"C-69305r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qf04bkgmMh7/Xtq1/PBpX+EZO4hz59RpQOM81gGA5K4=\"},\"F-74987r1_fix\",\"V-68817\",\"medium\",\"WN10-CC-000066\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41388,\"SV-83409r1_rule\",\"medium\",null,null,\"Command line data must be included in process creation events.\",\"WN10-CC-000066\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nEnabling \\\"Include command line data for process creation events\\\" will record the command line information with the process creation events in the log.  This can provide additional detail when malware has run on a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tlcocN55ZYxvkWqCrlKzS308hz23N1rtV+8aFeDnhcQ=\"},\"C-94087r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QdYlaeg3zVAWdJ4P3hyvRlPDwr0KB2zjCtlJZ+liF6c=\"},\"F-74989r1_fix\",\"V-68819\",\"medium\",\"WN10-CC-000326\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41389,\"SV-83411r2_rule\",\"medium\",null,null,\"PowerShell script block logging must be enabled on Windows 10.\",\"WN10-CC-000326\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nEnabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts.  This can provide additional detail when malware has run on a system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:95Wge0r7A1nMcqH3gMcG1tsaCxT6bDaub3VeK5nHEcY=\"},\"C-77535r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:W9OT6/yKCLuomlNSX3QJrCYyprmuohy6rVi6tbgiyb8=\"},\"F-75017r2_fix\",\"V-68845\",\"high\",\"WN10-00-000145\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41390,\"SV-83439r2_rule\",\"high\",null,null,\"Data Execution Prevention (DEP) must be configured to at least OptOut.\",\"WN10-00-000145\",\"Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windows and other programs.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7XgAgPXMwnWi7uSIC/fqd46LXQjEefiQggfQCfHL7K8=\"},\"C-80163r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:irQUQvrkSAAacEmAqilJbT3/LE5inxDiqZKlYKlWBrE=\"},\"F-87295r1_fix\",\"V-68849\",\"high\",\"WN10-00-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41391,\"SV-83445r4_rule\",\"high\",null,null,\"Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.\",\"WN10-00-000150\",\"Attackers are constantly looking for vulnerabilities in systems and applications. Structured Exception Handling Overwrite Protection (SEHOP) blocks exploits that use the Structured Exception Handling overwrite technique, a common buffer overflow attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8QaHQQT2a/xX1mHR9JZYds+zZe9VKc6wZnVv2nVWTwg=\"},\"C-91429r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zTiS3h97x2piMq/0m0GdZt8rbZHJxutHF7zDTCd4M4U=\"},\"F-76869r1_fix\",\"V-70637\",\"medium\",\"WN10-00-000155\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41392,\"SV-85259r2_rule\",\"medium\",null,null,\"The Windows PowerShell 2.0 feature must be disabled on the system.\",\"WN10-00-000155\",\"Windows PowerShell 5.0 added advanced logging features which can provide additional detail when malware has been run on a system.  Disabling the Windows PowerShell 2.0 mitigates against a downgrade attack that evades the Windows PowerShell 5.0 script block logging feature.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LoHFxrEqFXMSEB8aLzNbxWm1sZAEoJAELFfMvbeXJWA=\"},\"C-74581r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rOBoCm3gFi8A59Xsp7O0G7tiYN6JL2ya9ecafxQRRDo=\"},\"F-76871r2_fix\",\"V-70639\",\"medium\",\"WN10-00-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41393,\"SV-85261r2_rule\",\"medium\",null,null,\"The Server Message Block (SMB) v1 protocol must be disabled on the system.\",\"WN10-00-000160\",\"SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.\\n\\nDisabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older Network Attached Storage (NAS) devices may only support SMBv1.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VfJcv2oibH4fO+7O/16d0DnpaUWHMb9vOGAlg65RKTw=\"},\"C-72017r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tY7XMVbdAbMzjSFZqqVfir/m4Sw0RJr73TvI0ORMx0c=\"},\"F-78111r2_fix\",\"V-71759\",\"medium\",\"WN10-AU-000054\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41394,\"SV-86383r2_rule\",\"medium\",null,null,\"The system must be configured to audit Logon/Logoff - Account Lockout failures.\",\"WN10-AU-000054\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAccount Lockout events can be used to identify potentially malicious logon attempts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:spd2YfnamQST1NlVqvAqNOfFgfZkdothjKXNWgXmfX8=\"},\"C-72019r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XAYh9ZCmsN2u9vza7wzaPkjBtlPqL/UbBVes+PcPB/8=\"},\"F-78113r1_fix\",\"V-71761\",\"medium\",\"WN10-AU-000107\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41395,\"SV-86385r1_rule\",\"medium\",null,null,\"The system must be configured to audit Policy Change - Authorization Policy Change successes.\",\"WN10-AU-000107\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuthorization Policy Change records events related to changes in user rights, such as Create a token object.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cLWTmB4pH7+xPBjUvZx8mpG3gs+QxeJQobWa4u/txeE=\"},\"C-72021r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dLnDVN8s/91ti09nXwJxNczSs5bPSptsa4aYD4hcjvc=\"},\"F-78115r4_fix\",\"V-71763\",\"medium\",\"WN10-CC-000038\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41396,\"SV-86387r1_rule\",\"medium\",null,null,\"WDigest Authentication must be disabled.\",\"WN10-CC-000038\",\"When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft.  WDigest is disabled by default in Windows 10.  This setting ensures this is enforced.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A69vy1PsYlLcAzLy5BVJjqB9jb4HUwisI/dMcPrDcBI=\"},\"C-72023r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:IgFL5XwyUdOYZfdnbKixtFP+EGlN8oDS3gbBsSbv5Yw=\"},\"F-78117r2_fix\",\"V-71765\",\"medium\",\"WN10-CC-000044\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41397,\"SV-86389r1_rule\",\"medium\",null,null,\"Internet connection sharing must be disabled.\",\"WN10-CC-000044\",\"Internet connection sharing makes it possible for an existing internet connection, such as through wireless, to be shared and used by other systems essentially creating a mobile hotspot.  This exposes the system sharing the connection to others with potentially malicious purpose.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bnGEzcuJUAwCNZ4Ws5wyS5j2lY5Jgzk6QrlcnBXgb8o=\"},\"C-76223r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eGXZ+DOsdSkcmF3ldc2wW5VrVYYyaaP4oY0KtvzQ/Mg=\"},\"F-78121r3_fix\",\"V-71769\",\"medium\",\"WN10-SO-000167\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41398,\"SV-86393r3_rule\",\"medium\",null,null,\"Remote calls to the Security Account Manager (SAM) must be restricted to Administrators.\",\"WN10-SO-000167\",\"The Windows Security Account Manager (SAM) stores users' passwords.  Restricting remote rpc connections to the SAM to Administrators helps protect those credentials.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uqablBEdj8fYHH8criFKQSHGko9Gb2nm3ANEizuP+08=\"},\"C-81363r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Be1MLyR/Z+nSYWeOYKQpPWP0Df/FA9g0clocFDsx5wE=\"},\"F-78123r1_fix\",\"V-71771\",\"low\",\"WN10-CC-000197\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41399,\"SV-86395r2_rule\",\"low\",null,null,\"Microsoft consumer experiences must be turned off.\",\"WN10-CC-000197\",\"Microsoft consumer experiences provides suggestions and notifications to users, which may include the installation of Windows Store apps.  Organizations may control the execution of applications through other means such as whitelisting.  Turning off Microsoft consumer experiences will help prevent the unwanted installation of suggested applications.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:azduH/rGDaA9J8WfIbKquOL5RoDMag7lQ/2PBt2QE8s=\"},\"C-72563r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:M5rwZagEaLNTaJKOXPYqxrB71orJ89nWwRBonZ+GsJs=\"},\"F-78683r2_fix\",\"V-72329\",\"medium\",\"WN10-CC-000039\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41400,\"SV-86953r1_rule\",\"medium\",null,null,\"Run as different user must be removed from context menus.\",\"WN10-CC-000039\",\"The \\\"Run as different user\\\" selection from context menus allows the use of credentials other than the currently logged on user.  Using privileged credentials in a standard user session can expose those credentials to theft.  Removing this option from context menus helps prevent this from occurring.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QUy5rMKrmSVFuZRi8lijI352v840T0gzGD5qak7wNbk=\"},\"C-72913r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:A2l+hvl/8exaBSN6YCIsffw0hfHkhBy+P3AKlVVpFAw=\"},\"F-79175r1_fix\",\"V-72765\",\"medium\",\"WN10-00-000210\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41401,\"SV-87403r1_rule\",\"medium\",null,null,\"Bluetooth must be turned off unless approved by the organization.\",\"WN10-00-000210\",\"If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OLU1Ki32nfmwHE1geqvJmNi7m2t/bTSrs5FI1qvvg5o=\"},\"C-72915r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2am2H7Doa4rGmj6G+kS9wKTwC5Nme9hPQFpYKniqeB4=\"},\"F-79177r1_fix\",\"V-72767\",\"medium\",\"WN10-00-000220\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41402,\"SV-87405r1_rule\",\"medium\",null,null,\"Bluetooth must be turned off when not in use.\",\"WN10-00-000220\",\"If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VC4MssCw0YPNf5Ku7vwfsCk462cMswOvsMCGoxhRGaU=\"},\"C-72917r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Pb5TafjPaP+LTOixhDns54D9iLk838ohVuYebZ2RvcY=\"},\"F-79179r1_fix\",\"V-72769\",\"medium\",\"WN10-00-000230\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41403,\"SV-87407r2_rule\",\"medium\",null,null,\"The system must notify the user when a Bluetooth device attempts to connect.\",\"WN10-00-000230\",\"If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hktzVHG38mzOhb1tNzgXaCky+9tk/sTzqf2ayzkUh0A=\"},\"C-74295r6_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9fnPpiozrI0OKjv+pcmSSl17/I8MN2dILhQcCidat/E=\"},\"F-80951r4_fix\",\"V-74409\",\"medium\",\"WN10-AU-000084\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41404,\"SV-89083r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Object Access - Other Object Access Events failures.\",\"WN10-AU-000084\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing for other object access records events related to the management of task scheduler jobs and COM+ objects.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+dPx0n8JfTUXKdPsMAw42NTXs2lAb7HwDFC8m/Frthk=\"},\"C-74297r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vd8EsTrkNYhogosEeLUKmcGtT/0kDmTjGQjR7pYHTFc=\"},\"F-80953r2_fix\",\"V-74411\",\"medium\",\"WN10-AU-000083\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41405,\"SV-89085r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Object Access - Other Object Access Events successes.\",\"WN10-AU-000083\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing for other object access records events related to the management of task scheduler jobs and COM+ objects.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HPKwv55aIzf3+HquubSdJocG/rCtCTbtxNECCDpyxPk=\"},\"C-94089r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BYVODkXyQ1zz05xobiYtyYf0nPtZ/GjmyoBPKUesI84=\"},\"F-80955r1_fix\",\"V-74413\",\"medium\",\"WN10-CC-000052\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41406,\"SV-89087r2_rule\",\"medium\",null,null,\"Windows 10 must be configured to prioritize ECC Curves with longer key lengths first.\",\"WN10-CC-000052\",\"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. By default Windows uses ECC curves with shorter key lengths first.  Requiring ECC curves with longer key lengths to be prioritized first helps ensure more secure algorithms are used.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gd3/nmYTFouE7yNfONwiOI09OM4xvvtC7p5aHSm3+rk=\"},\"C-91423r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rNae1lECfwUQzq7cVpoyPLhfSkChOADC8SJ+dmqF7bc=\"},\"F-80959r1_fix\",\"V-74417\",\"medium\",\"WN10-CC-000252\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41407,\"SV-89091r2_rule\",\"medium\",null,null,\"Windows 10 must be configured to disable Windows Game Recording and Broadcasting.\",\"WN10-CC-000252\",\"Windows Game Recording and Broadcasting is intended for use with games, however it could potentially record screen shots of other applications and expose sensitive data.  Disabling the feature will prevent this from occurring.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p3Km58ax+vwtXp6vt/jvLyGVTgesTT2NKlz+BVoeGAk=\"},\"C-91425r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vS35zhZGlAylBppLd2YkbVv5mYh6dEBH9Lg9/Qx2sCQ=\"},\"F-81317r1_fix\",\"V-74699\",\"medium\",\"WN10-CC-000068\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41408,\"SV-89373r2_rule\",\"medium\",null,null,\"Windows 10 must be configured to enable Remote host allows delegation of non-exportable credentials.\",\"WN10-CC-000068\",\"An exportable version of credentials is provided to remote hosts when using credential delegation which exposes them to theft on the remote host.  Restricted Admin mode or Remote Credential Guard allow delegation of non-exportable credentials providing additional protection of the credentials.  Enabling this configures the host to support Restricted Admin mode or Remote Credential Guard.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kmONnQi8hUqCu/WJgM8CHWQrxsQLtOxhWR7c6bEt12Y=\"},\"C-94093r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6LaK2VcIqK9oUGu0jqwrijFrhQ5H371NKRriYM6+TB4=\"},\"F-81333r1_fix\",\"V-74719\",\"medium\",\"WN10-00-000175\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41409,\"SV-89393r2_rule\",\"medium\",null,null,\"The Secondary Logon service must be disabled on Windows 10.\",\"WN10-00-000175\",\"The Secondary Logon service provides a means for entering alternate credentials, typically used to run commands with elevated privileges.  Using privileged credentials in a standard user session can expose those credentials to theft.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJq3SMQlkiH7VSnlxXWdCkxlPWIUUAHF7pAJRBLRDOU=\"},\"C-74575r5_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eZpj+IITXq5ums6eQxFjnoGoYPhzGIVD4fSfvb1yD0g=\"},\"F-81335r3_fix\",\"V-74721\",\"medium\",\"WN10-AU-000082\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41410,\"SV-89395r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Object Access - File Share successes.\",\"WN10-AU-000082\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing file shares records events related to connection to shares on a system including system shares such as C$.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AcIhp89UhB4v65rG4+1OlkrKzpAPGx+nVXwXtWlRxtw=\"},\"C-74577r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TSmMu0ZHsAd1fzROhv0xiffJsLGIkQoOrLRxkBCNjPU=\"},\"F-81337r2_fix\",\"V-74723\",\"medium\",\"WN10-00-000165\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41411,\"SV-89397r1_rule\",\"medium\",null,null,\"The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.\",\"WN10-00-000165\",\"SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.\\n\\nDisabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bH2zYG4O8rv2T9lCQ0x5K3UStABQyU0MGrR7XdmZxm4=\"},\"C-74579r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vrvlutyLqr3NGe5hhKWoLyJi7MftxvLvZBtgAHlh3sg=\"},\"F-81339r3_fix\",\"V-74725\",\"medium\",\"WN10-00-000170\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41412,\"SV-89399r1_rule\",\"medium\",null,null,\"The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.\",\"WN10-00-000170\",\"SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.\\n\\nDisabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pP6wExXu7hx0kSxYXKfJVrzTaRizYrfD1RMLqHWYrFY=\"},\"C-74879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JfK0hPvOcoRwMHqq7hLD/z12EWwkRlJQFjlqGg7QcEA=\"},\"F-81643r1_fix\",\"V-75027\",\"medium\",\"WN10-AU-000081\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41413,\"SV-89701r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Object Access - File Share failures.\",\"WN10-AU-000081\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAuditing file shares records events related to connection to shares on a system including system shares such as C$.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2j27+jG0GZFs6PCwCbPpklgetUgKU7XZetxNDvK30ho=\"},\"C-76171r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:DrB1/dhFAcMIz4jr6xajtN8beSutIcDkV9SZc5jmaz4=\"},\"F-83185r1_fix\",\"V-76505\",\"medium\",\"WN10-00-000190\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41414,\"SV-91201r1_rule\",\"medium\",null,null,\"Orphaned security identifiers (SIDs) must be removed from user rights on Windows 10.\",\"WN10-00-000190\",\"Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups.  If the account or group objects are reanimated, there is a potential they may still have rights no longer intended.  Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:G++c76EF2dug3yxJ1mWjWuE/wznHG9SVXyS+eCsoMKE=\"},\"C-86429r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:AVzpNK+DyFAXlwjznEhrrAG4I22Sg+pYLab7wZSj95Y=\"},\"F-83781r1_fix\",\"V-77083\",\"medium\",\"WN10-00-000015\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41415,\"SV-91779r3_rule\",\"medium\",null,null,\"Windows 10 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.\",\"WN10-00-000015\",\"UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in Legacy BIOS mode will not support these security features.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:UyAIBRFH+PIeD9UnW2uuScJwGHi1TzbEGDoaMPRL1nM=\"},\"C-86431r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TRTnlaC83paER7O+Xt96qk6Vk3HwozJXAzJuSrP/hKs=\"},\"F-83783r1_fix\",\"V-77085\",\"low\",\"WN10-00-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41416,\"SV-91781r2_rule\",\"low\",null,null,\"Secure Boot must be enabled on Windows 10 systems.\",\"WN10-00-000020\",\"Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wZQbFTwW94OSVmQOtJRreFTXD/cIx6cp6SMGeIT/5Q0=\"},\"C-79579r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:woCzI+ry5rY5WpxHM5I31gu2dqoVFaTbd4coSFbSgYo=\"},\"F-86717r3_fix\",\"V-77091\",\"medium\",\"WN10-EP-000020\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41417,\"SV-91787r3_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Data Execution Prevention (DEP), must be on.\",\"WN10-EP-000020\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Data Execution Prevention (DEP)\\\", are enabled by default at the system level. DEP prevents code from being run from data-only memory pages. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:seoeJ0TVdyPF1IZOglTdU3YY9kcGzHzPhCDGtAE3tkM=\"},\"C-79581r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mWshO11tryJTCql4hk/spdqg+E1bzL8t2tI5Lm9xlwA=\"},\"F-86719r3_fix\",\"V-77095\",\"medium\",\"WN10-EP-000030\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41418,\"SV-91791r4_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Randomize memory allocations (Bottom-Up ASLR), must be on.\",\"WN10-EP-000030\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Randomize memory allocations (Bottom-Up ASLR)\\\", are enabled by default at the system level. Bottom-Up ASLR (address space layout randomization) randomizes locations for virtual memory allocations, including those for system structures. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I4uQfS2NjZHDkDdoRvwEOJ9Cn5UEOwkvBoMVv0IlL4w=\"},\"C-79583r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lMnpP4ynhAZVatRsYBaTTKBOmTVGXa68O1WqgFozVek=\"},\"F-86721r2_fix\",\"V-77097\",\"medium\",\"WN10-EP-000040\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41419,\"SV-91793r3_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Control flow guard (CFG), must be on.\",\"WN10-EP-000040\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Control flow guard (CFG)\\\", are enabled by default at the system level. CFG ensures flow integrity for indirect calls. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kFzIaNPWT2wqsaqKjSiKaNxW40sevexLR9vPMcm9edQ=\"},\"C-79585r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CagwaL6jYeJAB8F7kV6A1VgcgO0qo2LyozS2WSl9LV0=\"},\"F-86723r2_fix\",\"V-77101\",\"medium\",\"WN10-EP-000050\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41420,\"SV-91797r3_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Validate exception chains (SEHOP), must be on.\",\"WN10-EP-000050\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Validate exception chains (SEHOP)\\\", are enabled by default at the system level. SEHOP (structured exception handling overwrite protection) ensures the integrity of an exception chain during exception dispatch. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:g7RfvBxx636aPhixMi/6iDCzMbVFIx9shebxkreQe48=\"},\"C-79587r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y+Jwz4SlaCP0uDfdPN7A2Kkk2w9cH6/sCOOpTuFkp5Y=\"},\"F-86725r2_fix\",\"V-77103\",\"medium\",\"WN10-EP-000060\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41421,\"SV-91799r3_rule\",\"medium\",null,null,\"Windows 10 Exploit Protection system-level mitigation, Validate heap integrity, must be on.\",\"WN10-EP-000060\",\"Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \\\"Validate heap integrity\\\", are enabled by default at the system level. \\\"Validate heap integrity\\\" terminates a process when heap corruption is detected. If this is turned off, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/kelpkvOVtEhlqeho3DqaACavzCa3fwBSBE55Uza0+E=\"},\"C-94095r9_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:akIn3OR8SKnyLhrjzkf6C+t63Ll3bFZcny/I2uJNO0w=\"},\"F-84325r8_fix\",\"V-77189\",\"medium\",\"WN10-EP-000070\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41422,\"SV-91885r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for Acrobat.exe.\",\"WN10-EP-000070\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MubhtefZIzGkvhlY2PmYFuDlH+8Uqku0fltszVjOuxU=\"},\"C-94097r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:go1d0UhD/s44LKtOJi7giiQmLfHwsIDsomswW5bEhEw=\"},\"F-84329r7_fix\",\"V-77191\",\"medium\",\"WN10-EP-000080\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41423,\"SV-91887r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for AcroRd32.exe.\",\"WN10-EP-000080\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fg2f0FG3EIVUBqMtVXqVYKHERgkwZW3I0YbnLTVAsX8=\"},\"C-94099r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:UtLy/lhF+3qJsptN1S7+/BnmRwSuoKQLUjCcTfPFVmQ=\"},\"F-84333r5_fix\",\"V-77195\",\"medium\",\"WN10-EP-000090\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41424,\"SV-91891r4_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for chrome.exe.\",\"WN10-EP-000090\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pNmbpGc9jee+bzjZjzmnqgZeocNv6buCv3Ipvsb5pXo=\"},\"C-94101r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:G7GA5EjlQapB+o33giDLY13tf4ks4V+aVerdQAKmg3o=\"},\"F-84337r7_fix\",\"V-77201\",\"medium\",\"WN10-EP-000100\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41425,\"SV-91897r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for EXCEL.EXE.\",\"WN10-EP-000100\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:spszjT7BTTddnp6oFJqi/T4F3rA0UBbm/6GzPBqBcWo=\"},\"C-79777r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lmq37rPV73c8QL9fNQTktgAYlAIm/VcmeVQUR5N+QPM=\"},\"F-86915r3_fix\",\"V-77205\",\"medium\",\"WN10-EP-000110\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41426,\"SV-91901r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for firefox.exe.\",\"WN10-EP-000110\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mtl2VgiudtjEJVh9KeXvbi749Hr3urnyB+DwqMQJz2Y=\"},\"C-94103r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bwz+hhci2hrUCxhD+VWhV+aLmorsS7M6HVezP2NZtNw=\"},\"F-84341r6_fix\",\"V-77209\",\"medium\",\"WN10-EP-000120\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41427,\"SV-91905r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for FLTLDR.EXE.\",\"WN10-EP-000120\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LsXrxcaxVB8zrRJjNYRpPBfOKTGaqj32TPrT80sjdFE=\"},\"C-94105r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:v3QdCidDWVcmfH52W7787MqM06FhUQwodFBWSACop7M=\"},\"F-84343r6_fix\",\"V-77213\",\"medium\",\"WN10-EP-000130\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41428,\"SV-91909r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for GROOVE.EXE.\",\"WN10-EP-000130\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:amDpgsaRxthlet+rsvJeTvWJu1llLyepQcXyc5K4O7w=\"},\"C-94107r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Q7yxXUAX6curMWW1+63uLbDcl9ljTbRXUFw1GGJVd2c=\"},\"F-84347r6_fix\",\"V-77217\",\"medium\",\"WN10-EP-000140\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41429,\"SV-91913r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for iexplore.exe.\",\"WN10-EP-000140\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lY+AXYfe/AluR4WGTqo0FEqJ5tSSl5HZ39f56ylKTs4=\"},\"C-94109r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:GulQPjdDC+qlUbS2TlpaM3J62Vs0lZh5wMmcUEsC1uA=\"},\"F-84349r6_fix\",\"V-77221\",\"medium\",\"WN10-EP-000150\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41430,\"SV-91917r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for INFOPATH.EXE.\",\"WN10-EP-000150\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fe/FsLxtBWOXdM4WX+ESyWqxz8i/+CYiH84HrxQGTKM=\"},\"C-94111r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nB+4od41f5NQMsWDyaK8/k0TJse8+H0mHNA2tCIAMTA=\"},\"F-84353r5_fix\",\"V-77223\",\"medium\",\"WN10-EP-000160\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41431,\"SV-91919r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for java.exe, javaw.exe, and javaws.exe.\",\"WN10-EP-000160\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mh9IH1clzy+A1OOIBzjvUuybaU9xSwmJekh7crMQoVI=\"},\"C-94113r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:63zaP2KKzTXpl+NIgXAfQSDlkk8SmqPAW2nW9p/6B/c=\"},\"F-84357r7_fix\",\"V-77227\",\"medium\",\"WN10-EP-000170\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41432,\"SV-91923r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for lync.exe.\",\"WN10-EP-000170\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dEwmjiXxS3GnMegQ2bUU71KYoXG5Dd/AZ7wdyDMWJGQ=\"},\"C-94115r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MDpvhRQniNCiKGQAJSKnHWQ00gPj8bYf9lxw0wxnoBU=\"},\"F-84359r6_fix\",\"V-77231\",\"medium\",\"WN10-EP-000180\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41433,\"SV-91927r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for MSACCESS.EXE.\",\"WN10-EP-000180\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xgIlihjGuLyZbqGDLM1SWEpzSqmldIb/KD1X6dqFPeQ=\"},\"C-94117r5_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OexQ8kEncBJsMQKalFDXdL/ElicZV/YRKjUyPX4zpLY=\"},\"F-84361r6_fix\",\"V-77233\",\"medium\",\"WN10-EP-000190\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41434,\"SV-91929r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for MSPUB.EXE.\",\"WN10-EP-000190\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5Ph3UBC9p+Akj+j+IR75pArMHpuq1OdgoJE3yVDf11E=\"},\"C-94119r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BCa1+WSHpwNFQlicOVJTT7MO9RB9aBAbcT3ARZQ/k2E=\"},\"F-84321r7_fix\",\"V-77235\",\"medium\",\"WN10-EP-000210\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41435,\"SV-91931r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for OneDrive.exe.\",\"WN10-EP-000210\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lILMjdtbWDfww7YCEZdpYCS81lAL+dJlad4M/TVlfcQ=\"},\"C-94121r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NwmgFiA9NckdN5TeGEUGMcRrS12KDExHspvp62uYU+Q=\"},\"F-84315r7_fix\",\"V-77239\",\"medium\",\"WN10-EP-000200\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41436,\"SV-91935r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for OIS.EXE.\",\"WN10-EP-000200\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GXA5f/UA68emJFB8jqN9ewGYIe84bEvyYg7xSGas3I4=\"},\"C-94123r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:GYLqyqrHfdyE4k3QM4zwGeUyRS9mmnEGZBpRqxsMKqI=\"},\"F-84363r6_fix\",\"V-77243\",\"medium\",\"WN10-EP-000220\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41437,\"SV-91939r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for OUTLOOK.EXE.\",\"WN10-EP-000220\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MUCQyakZZLfc2Ap5HiFf5ipmQj0p92vkKHKV9h/lKZA=\"},\"C-94125r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eD5WaRu5VcwvSfrT2UxDYynPsF16jaqIicn0D7W7yXU=\"},\"F-84365r8_fix\",\"V-77245\",\"medium\",\"WN10-EP-000230\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41438,\"SV-91941r4_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for plugin-container.exe.\",\"WN10-EP-000230\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Tc2J0p3mLuCyswLMHwCyLpY+3kVedt6NP6VLBTCWYjA=\"},\"C-94127r5_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pc/w19DZVMih+ciy86Y9JMYlyvH/jIeElYtpCZZoHyE=\"},\"F-84503r8_fix\",\"V-77247\",\"medium\",\"WN10-EP-000240\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41439,\"SV-91943r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for POWERPNT.EXE.\",\"WN10-EP-000240\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MQNLsBE4TEp2/6ROgBSTJO9fJkNfyMcnLhI9YtT5BXI=\"},\"C-94129r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:WsF1epd1aFpIa9jDy3bcmb6qVRoEa5866L5rVCMQAzU=\"},\"F-84505r7_fix\",\"V-77249\",\"medium\",\"WN10-EP-000250\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41440,\"SV-91945r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for PPTVIEW.EXE.\",\"WN10-EP-000250\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pHMGWcsdxpl8Z+8pYTfwp4+n7EAO3II6SBPoR0qmkV8=\"},\"C-94131r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:prizP85kj6huvXs/G4ghxyH4LZWTIOMFXs00Svnjh3A=\"},\"F-84507r8_fix\",\"V-77255\",\"medium\",\"WN10-EP-000260\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41441,\"SV-91951r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for VISIO.EXE.\",\"WN10-EP-000260\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8vOgdCfinZFo71HQ6cBJRAa/ITYhJrZWDk+MZttTzFg=\"},\"C-94133r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hPsWkcNQxMjXoLg+pAJQVJfUxZbyUac/dEBdQd8Deqk=\"},\"F-84509r7_fix\",\"V-77259\",\"medium\",\"WN10-EP-000270\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41442,\"SV-91955r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for VPREVIEW.EXE.\",\"WN10-EP-000270\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wzRqhQROBVJlE1q3nxtUM1GkAJigG01hupg8bXE1iSA=\"},\"C-94135r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NfdZ24hCWsRX4GyoitZP1gOvqm9KxehEDibz/R35NPU=\"},\"F-84511r7_fix\",\"V-77263\",\"medium\",\"WN10-EP-000280\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41443,\"SV-91959r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for WINWORD.EXE.\",\"WN10-EP-000280\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/mZrNq1dEWU1tMYc71JTRfkRtNHkdPGHX2E03f0Jppc=\"},\"C-94137r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tXGn2pX+eEr6Q8FblEWmysB+EYqlH0J64+XJJHHbztU=\"},\"F-84513r7_fix\",\"V-77267\",\"medium\",\"WN10-EP-000290\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41444,\"SV-91963r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for wmplayer.exe.\",\"WN10-EP-000290\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i7E2vv6pd35hawlK+qV+2UpXcaVnUkBR1V3CR/Rcg7M=\"},\"C-94139r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:V/BKBf3pVG0DtiNhcIN8772kUA7FsIV4gQZ5YiOqAjk=\"},\"F-84515r7_fix\",\"V-77269\",\"medium\",\"WN10-EP-000300\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41445,\"SV-91965r5_rule\",\"medium\",null,null,\"Exploit Protection mitigations in Windows 10 must be configured for wordpad.exe.\",\"WN10-EP-000300\",\"Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:99vRhcTZ40z21olaz2KCAKJlYMIhAMYv5z3B0U4Tt7E=\"},\"C-77703r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4yYwGe5746/lZUu5mItEq1GkKqM7qXqbJZqcipCDsu8=\"},\"F-84851r1_fix\",\"V-78129\",\"high\",\"WN10-00-000240\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41446,\"SV-92835r1_rule\",\"high\",null,null,\"Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.\",\"WN10-00-000240\",\"Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account.\\n\\nSince administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy requires administrative accounts to not access the Internet or use applications, such as email.\\n\\nThe policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.\\n\\nTechnical means such as application whitelisting can be used to enforce the policy to ensure compliance.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ewDvbXkRfIkCeWiNsw3OWO1nlDe4SsgnCecA5Am1j5Q=\"},\"C-81935r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:W9CRIHTIvuwyTuYRNeqcLnBcDyK6y5LJmcZdO2HC4Kw=\"},\"F-88989r2_fix\",\"V-82137\",\"medium\",\"WN10-UC-000005\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41447,\"SV-96851r1_rule\",\"medium\",null,null,\"The use of personal accounts for OneDrive synchronization must be disabled.\",\"WN10-UC-000005\",\"OneDrive provides access to external services for data storage, which must be restricted to authorized instances. Enabling this setting will prevent the use of personal OneDrive accounts for synchronization.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Yc8MBcfVv6vNjndIl1SGBkgIuoDRlU+d8I5bNlbhm5k=\"},\"C-81939r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NYJvEfLe6qqpfrqg9mcbQtXqcwpfjyCZ3kza554KJAA=\"},\"F-88993r1_fix\",\"V-82139\",\"medium\",\"WN10-CC-000238\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41448,\"SV-96853r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to prevent certificate error overrides in Microsoft Edge.\",\"WN10-CC-000238\",\"Web security certificates provide an indication whether a site is legitimate. This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rj3OnjRCg+zI0qrs9i/7QAUeW1hgVcDx11HNsPktgsU=\"},\"C-81943r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RHLyDoJJQoQLYBXIbpvnNPrKKHX099LvJyUf7L2XMmI=\"},\"F-88997r2_fix\",\"V-82145\",\"medium\",\"WN10-CC-000204\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41449,\"SV-96859r1_rule\",\"medium\",null,null,\"If Enhanced diagnostic data is enabled it must be limited to the minimum required to support Windows Analytics.\",\"WN10-CC-000204\",\"Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The \\\"Enhanced\\\" level for telemetry includes additional information beyond \\\"Security\\\" and \\\"Basic\\\" on how Windows and apps are used and advanced reliability data. Windows Analytics can use a \\\"limited enhanced\\\" level to provide information such as health data for devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2tk48SuLjCC1zEZDnJEJwFssANaf8w1hwLA0yFQDwt0=\"},\"C-87895r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VHeKoAaG7leI8VWo6O7ZVX0+8WiDV/Oct8xTAZwnQPY=\"},\"F-94945r4_fix\",\"V-88203\",\"medium\",\"WN10-CC-000340\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41450,\"SV-98853r3_rule\",\"medium\",null,null,\"OneDrive must only allow synchronizing of accounts for DoD organization instances.\",\"WN10-CC-000340\",\"OneDrive provides access to external services for data storage, which must be restricted to authorized instances if enabled. Configuring this setting will restrict synchronizing of OneDrive accounts to DoD organization instances.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xCK9AnopZ/PLEiEfFd+fF29a3GvfMV+H4kBtncaC+w4=\"},\"C-93909r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mPWqIsb0n06wTF7qh1aYHnPiwDdpF2h7PhHFwsmZUqY=\"},\"F-100837r3_fix\",\"V-94719\",\"medium\",\"WN10-CC-000365\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41451,\"SV-104549r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to prevent Windows apps from being activated by voice while the system is locked.\",\"WN10-CC-000365\",\"Allowing Windows apps to be activated by voice from the lock screen could allow for unauthorized use. Requiring logon will ensure the apps are only used by authorized personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hSVsi+qUuuUyVINtO7WeONuyh47CyGSc32+FLd4Ul1Q=\"},\"C-94055r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+pJv8+F1yFio0LjRDpj7dffhIDVp0nEY8jvnE+wrX4w=\"},\"F-100983r2_fix\",\"V-94859\",\"medium\",\"WN10-00-000031\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41452,\"SV-104689r1_rule\",\"medium\",null,null,\"Windows 10 systems must use a BitLocker PIN for pre-boot authentication.\",\"WN10-00-000031\",\"If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SIUT9VltMgIdU+iQ11p1JXZ1wRhtZVpC4mS/QVMSxf0=\"},\"C-94057r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bZOkFz4V8Ui/FunBETLbYY6kWJHTUI5wFoQlPtlZiqU=\"},\"F-100985r1_fix\",\"V-94861\",\"medium\",\"WN10-00-000032\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41453,\"SV-104691r2_rule\",\"medium\",null,null,\"Windows 10 systems must use a BitLocker PIN with a minimum length of 6 digits for pre-boot authentication.\",\"WN10-00-000032\",\"If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives. Increasing the pin length requires a greater number of guesses for an attacker.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ma4nqZH+wIDRjwzJLcPKvIvKb/+DvmWJQSbZYwt0kjY=\"},\"C-98389r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rcAafIXouE+3wT6heNODo54W6/EDFFC9IGCWJ8/HefA=\"},\"F-105225r1_fix\",\"V-99541\",\"medium\",\"WN10-AU-000565\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41454,\"SV-108645r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit other Logon/Logoff Events Failures.\",\"WN10-AU-000565\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aHDwysX9OO7lInhWR4rNHU0Ms5aHv+DvTtpIpt7OrPU=\"},\"C-98393r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BEdoMF9S2cOQGD2GXgg9s6wgMJrbDpokNMz6l9nTjv0=\"},\"F-105227r1_fix\",\"V-99543\",\"medium\",\"WN10-AU-000560\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41455,\"SV-108647r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit other Logon/Logoff Events Successes.\",\"WN10-AU-000560\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1xCrwLo/Iq6qUeIrA32JKdJWhv9UJ8i93khTh00F31M=\"},\"C-98395r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:K470rD17EN41ERiWYr5a6WRrSS6wvqHUSlWy+iX1BCY=\"},\"F-105229r1_fix\",\"V-99545\",\"medium\",\"WN10-AU-000570\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41456,\"SV-108649r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Detailed File Share Failures.\",\"WN10-AU-000570\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Detailed File Share allows you to audit attempts to access files and folders on a shared folder.\\nThe Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xN9N4TyNWncZnuydNiSn1AFbgDuZlrOZk/FpvfCXbCw=\"},\"C-98397r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Og8bqxxj38uPecH7EfrawZ+rB2jQ+W6bSi3cC899qhE=\"},\"F-105231r1_fix\",\"V-99547\",\"medium\",\"WN10-AU-000575\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41457,\"SV-108651r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Successes.\",\"WN10-AU-000575\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). \\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AwE4aTQA41II3JBpLcuFwxr2s+SdrBU5NkQnKMmh+34=\"},\"C-98399r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:3kKmtcMstjT4aZm8opTuiNQyeFx5VSsOlN0KLpSlQeU=\"},\"F-105233r1_fix\",\"V-99549\",\"medium\",\"WN10-AU-000580\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41458,\"SV-108653r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Failures.\",\"WN10-AU-000580\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). \\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JLf0igfVeeCGPtuP0G5jtsBt5SLWDy8/40lxLhTjp+A=\"},\"C-98401r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fnFr59iMjWuCLW0+oFtD3LoOgcVyLzjCmKhn0eBtvf4=\"},\"F-105235r1_fix\",\"V-99551\",\"medium\",\"WN10-AU-000550\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41459,\"SV-108655r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Other Policy Change Events Successes.\",\"WN10-AU-000550\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0JIEYxGjLJCW+XDuQSNKZLiOraun/N4xAz9pc3iPnC4=\"},\"C-98403r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:J94I4bXHjDSMsn8zktbNFAlWp+zRBwXxG+yxPDD9mvA=\"},\"F-105237r1_fix\",\"V-99553\",\"medium\",\"WN10-AU-000555\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41460,\"SV-108657r1_rule\",\"medium\",null,null,\"Windows 10 must be configured to audit Other Policy Change Events Failures.\",\"WN10-AU-000555\",\"Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\\n\\nAudit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WiWO+yrYgzS9BRfJ95tCnETPOIU/k/YYuPYQakQM+IM=\"},\"C-98405r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JXGq7aDhtWNDrivMOMTSMI94M0jJatF+Nj93C8VgSrs=\"},\"F-105239r2_fix\",\"V-99555\",\"medium\",\"WN10-SO-000280\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41461,\"SV-108659r2_rule\",\"medium\",null,null,\"Passwords for enabled local Administrator accounts must be changed at least every 60 days.\",\"WN10-SO-000280\",\"The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. A local Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for enabled Administrator accounts on a regular basis will limit its exposure.\\n\\nOrganizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every \\\"30\\\" days by default.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vk0EeybuvPD5mu6kz6fCWWqDopo0zsPMlVMjqvlYb5I=\"},\"C-98407r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bJdExunHBewJYBF6G0nwK51NbFw+0zp5HCOqjnETyCQ=\"},\"F-105241r4_fix\",\"V-99557\",\"medium\",\"WN10-EP-000310\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41462,\"SV-108661r1_rule\",\"medium\",null,null,\"Windows 10 Kernel (Direct Memory Access) DMA Protection must be enabled.\",\"WN10-EP-000310\",\"Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. Drive-by DMA attacks can lead to disclosure of sensitive information residing on a PC, or even injection of malware that allows attackers to bypass the lock screen or control PCs remotely.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QBQK/tnwXZkWJDaqU/JtL7zWbHA0F4hsxCD2qrMtB98=\"},\"C-98409r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gmXzLE+C5v8pYM8+S6Iego7iYhlC18ZgH4ozkLXCTvE=\"},\"F-105243r1_fix\",\"V-99559\",\"medium\",\"WN10-CC-000370\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41463,\"SV-108663r1_rule\",\"medium\",null,null,\"The convenience PIN for Windows 10 must be disabled.\",\"WN10-CC-000370\",\"This policy controls whether a domain user can sign in using a convenience PIN to prevent enabling (Password Stuffer).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:d1pbzJigO85rKAMstf6sSkdP/ACDK1pRyqaLfXxwivI=\"},\"C-98411r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:i0Z+IG92JiLzmzLx6tQ74snoRBL6KKFk5hh5XykDo7s=\"},\"F-105245r1_fix\",\"V-99561\",\"medium\",\"WN10-CC-000385\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41464,\"SV-108665r1_rule\",\"medium\",null,null,\"Windows Ink Workspace configured but disallow access above the lock.\",\"WN10-CC-000385\",\"Securing Windows Ink which contains application and features oriented towards pen computing. \",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rD1r31DjrTFhcjSKe05lznNWs43/fc9RD+ZPg5DX/ZA=\"},\"C-98413r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KfW44fGASN+DiEKxrOxRxC/y1q1o/IzZsuqfPyZVbE4=\"},\"F-105247r1_fix\",\"V-99563\",\"low\",\"WN10-CC-000390\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41465,\"SV-108667r1_rule\",\"low\",null,null,\"Windows 10 should be configured to prevent users from receiving suggestions for third-party or additional applications.\",\"WN10-CC-000390\",\"Windows spotlight features may suggest apps and content from third-party software publishers in addition to Microsoft apps and content. \",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FGmuM87xdJUUKhYyergOAvk1Q+FhFTf1uOoIl5+4vOQ=\"},\"C-98943r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:uDOK3Fjq2yLJbn3WYZKpUUc41LjFQmsFAugtp+V755g=\"},\"F-105777r3_fix\",\"V-100093\",\"medium\",\"SRG-OS-000095-GPOS-00049\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41466,\"SV-109197r1_rule\",\"medium\",null,null,\"Windows 10 must cover or disable the built-in or attached camera when not in use.\",\"WN10-CC-000007\",\"It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\\n\\nFailing to disconnect from collaborative computing devices (i.e. cameras) can result in subsequent compromises of organizational information. Providing easy methods to physically disconnect from such devices after a collaborative computing session helps to ensure that participants actually carry out the disconnect activity without having to go through complex and tedious procedures.\\n\\nSatisfies: SRG-OS-000095-GPOS-00049, SRG-OS-000370-GPOS-00155\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HTJfh6HdzWTnnVR96iuoJZ0PnIvio+5FoDwpQDtzoTk=\"},\"C-101347r3_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4wZyYpTBO45VsCc6wvm7l2eGkIhtOrcxbBb0SGvAieE=\"},\"F-108159r2_fix\",\"V-102611\",\"medium\",\"WN10-00-000250\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41467,\"SV-111557r1_rule\",\"medium\",null,null,\"Windows 10 non-persistent VM sessions should not exceed 24 hours.\",\"WN10-00-000250\",\"For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, the organization should enforce that sessions be terminated within 24 hours. This would ensure any data stored on the VM that is not encrypted or covered by Credential Guard is deleted.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dbiUpUgiJb2+wzenGvBgb7gCtpsKZcFOnZmCT6u1k3s=\"},\"C-101355r4_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Og0Ct9ilCO63e8VppKdOiDA8j8y3ZH3RTayXtTMnHqE=\"},\"F-108147r3_fix\",\"V-102617\",\"medium\",\"WN10-CC-000328\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41468,\"SV-111563r1_rule\",\"medium\",null,null,\"The Windows Explorer Preview pane must be disabled for Windows 10.\",\"WN10-CC-000328\",\"A known vulnerability in Windows 10 could allow the execution of malicious code by either opening a compromised document or viewing it in the Windows Preview pane.\\n\\nOrganizations must disable the Windows Preview pane and Windows Detail pane.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aGZaMr7JCYhdhYIbyDmHK2zx8fjqDpXXjEY01sUoNo4=\"},\"C-101365r2_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:h9sVNjmtZbTh4890fOEZpilU6aj+nDNbUGjH9jf1Tzs=\"},\"F-108157r1_fix\",\"V-102627\",\"medium\",\"WN10-SO-000251\",null,null,null,null,null,\"Windows_10_STIG_TEST-1-23\",41469,\"SV-111577r1_rule\",\"medium\",null,null,\"Windows 10 must use multifactor authentication for local and network access to privileged and non-privileged accounts.\",\"WN10-SO-000251\",\"Without the use of multifactor authentication, the ease of access to privileged and non-privileged functions is greatly increased. \\n\\nAll domain accounts must be enabled for multifactor authentication with the exception of local emergency accounts. \\n\\nMultifactor authentication requires using two or more factors to achieve authentication.\\n\\nFactors include: \\n\\n1) Something a user knows (e.g., password/PIN);\\n\\n2) Something a user has (e.g., cryptographic identification device, token); and\\n\\n3) Something a user is (e.g., biometric).\\n\\nA privileged account is defined as an information system account with authorizations of a privileged user.\\n\\nNetwork access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the Internet).\\n\\nLocal access is defined as access to an organizational information system by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network.\\n\\nThe DoD CAC with DoD-approved PKI is an example of multifactor authentication.\\n\\nSatisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nkk6VkjluuUxkzsszOk8eTgHlUakS2R/bR95QTwbAM8=\"},\"C-4516r88368_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:171piPtMwULALIZ14So5l0MBIPd4Xcr2rWsmNy6Dx/g=\"},\"F-4516r88369_fix\",\"V-204392\",\"high\",\"SRG-OS-000257-GPOS-00098\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41470,\"SV-204392r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values.\",\"RHEL-07-010010\",\"Discretionary access control is weakened if a user or group has access permissions to system files and directories greater than the default.\\n\\nSatisfies: SRG-OS-000257-GPOS-00098, SRG-OS-000278-GPOS-00108\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:t3pLu4RByPjTmSyEGSrDsv2WpOjBnMxFcux4WTKpzsg=\"},\"C-4517r88371_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hYWkn5qu+JVb8C0/FpEXNp2r5VMsXVv/bIRrPHmoQNU=\"},\"F-4517r88372_fix\",\"V-204393\",\"medium\",\"SRG-OS-000023-GPOS-00006\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41471,\"SV-204393r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.\",\"RHEL-07-010030\",\"Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\n\\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b7cLLXAJwWiYlb+ZLVM/YmYEKrJOElbc2DI7KzdElaY=\"},\"C-4518r88374_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:w+OPWXVI1Kw0bo/mliM4bt1VuO10x/y6qOatUlCmTLA=\"},\"F-4518r88375_fix\",\"V-204394\",\"medium\",\"SRG-OS-000023-GPOS-00006\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41472,\"SV-204394r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the approved Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.\",\"RHEL-07-010040\",\"Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9ShQfZRP37ZylVTOj7a7tmzPRP/DZmVauIWv5cK5IgU=\"},\"C-4519r88377_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VxFoDAct2ic13XgKRn+E/ACi/TSpmK9WNulzRc3rOxY=\"},\"F-4519r88378_fix\",\"V-204395\",\"medium\",\"SRG-OS-000023-GPOS-00006\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41473,\"SV-204395r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.\",\"RHEL-07-010050\",\"Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Eg7oETP6JdEiW9fWb3CWsCNr1Ee+e9COo/1vPyjLJyA=\"},\"C-4520r88380_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MnA1wjFQqLCk55goNlJqa3e9IQiF1U+1NIeoMR43fSU=\"},\"F-4520r88381_fix\",\"V-204396\",\"medium\",\"SRG-OS-000028-GPOS-00009\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41474,\"SV-204396r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must enable a user session lock until that user re-establishes access using established identification and authentication procedures.\",\"RHEL-07-010060\",\"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.\\n\\nThe session lock is implemented at the point where session activity can be determined.\\n\\nRegardless of where the session lock is determined and implemented, once invoked, the session lock must remain in place until the user reauthenticates. No other activity aside from reauthentication must unlock the system.\\n\\nSatisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v8r3y4wndT3MrdoqZ+IXfrOkoGx9bEvFFDEL4eMv6bI=\"},\"C-4521r88383_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FJ09r9gGAOoBlB3ANwPG10/GW3aeCVvnhJwFpBEgyrg=\"},\"F-4521r88384_fix\",\"V-204397\",\"medium\",\"SRG-OS-000375-GPOS-00160\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41475,\"SV-204397r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate users using multifactor authentication via a graphical user logon.\",\"RHEL-07-010061\",\"To assure accountability and prevent unauthenticated access, users must be identified and authenticated to prevent potential misuse and compromise of the system.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\\n\\nSatisfies: SRG-OS-000375-GPOS-00161,SRG-OS-000375-GPOS-00162\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4Vhryn3qYojwlbzNOTBxhlYOCH+6lGP9nQktKh5cvso=\"},\"C-4522r88386_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:txbQErX0FRuka0ET9MkbOIEBnV+bAVMYgBP6oH/i79o=\"},\"F-4522r88387_fix\",\"V-204398\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41476,\"SV-204398r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces.\",\"RHEL-07-010070\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9A9hqWAZ5NS1n2W3Z6epeuVuWBbbbPCEc/zuKz7IiSM=\"},\"C-4523r88389_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vl4SP0SyLICEo1UBg5mI/85sJQuDzfImBjmKGkVysKs=\"},\"F-4523r88390_fix\",\"V-204399\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41477,\"SV-204399r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver lock-delay setting for the graphical user interface.\",\"RHEL-07-010081\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1r/d1v914jFv+PeIiRAnO8w+OdA0cucmU9N4uS9npIU=\"},\"C-4524r88392_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dnQ2OlAztdPf5rQ9gH8GFI1O36kYCEF3B2vcP6Jh8vI=\"},\"F-4524r88393_fix\",\"V-204400\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41478,\"SV-204400r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent a user from overriding the session idle-delay setting for the graphical user interface.\",\"RHEL-07-010082\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BdYvtV85bZiRNU3aVsf9P0v0mUKO7gFFdyTulpf63UA=\"},\"C-4525r88395_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Et1UGeqvKWmnbOPO51FwzssEelKOLZsQzNg/Wj9Vi0M=\"},\"F-4525r88396_fix\",\"V-204401\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41479,\"SV-204401r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must have the screen package installed.\",\"RHEL-07-010090\",\":  A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe screen and tmux packages allow for a session lock to be implemented and configured.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SJj4kDOYlogEinGYl4UBtzYvD0sUOtC0Zc+GkbM/nQg=\"},\"C-4526r88398_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RHDbTLpscT3JPNQs8VWSai2xSgAZqUcMgIRNSBG1V5o=\"},\"F-4526r88399_fix\",\"V-204402\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41480,\"SV-204402r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must initiate a session lock for the screensaver after a period of inactivity for graphical user interfaces.\",\"RHEL-07-010100\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wLqPaWBvxUmRKRMMSiJj2pj0F8NCk7mvWKECb9jxRgw=\"},\"C-4527r88401_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ktylcJOE83aWAU3yVOV6uQjr4EguM93Bhe66FymU9bE=\"},\"F-4527r88402_fix\",\"V-204403\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41481,\"SV-204403r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface.\",\"RHEL-07-010101\",\"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.\\n\\nThe session lock is implemented at the point where session activity can be determined.\\n\\nThe ability to enable/disable a session lock is given to the user by default. Disabling the user's ability to disengage the graphical user interface session lock provides the assurance that all sessions will lock after the specified period of time.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:orUMwfifYhVDl5eCyl7LEBXY8R0QtYf4FB3AikYOR0Q=\"},\"C-4528r88404_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:7pgCXmTq1+tSHD6gmAtfroDMvoebl9KLtd/SK4N3WTo=\"},\"F-4528r88405_fix\",\"V-204404\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41482,\"SV-204404r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must initiate a session lock for graphical user interfaces when the screensaver is activated.\",\"RHEL-07-010110\",\"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\\n\\nThe session lock is implemented at the point where session activity can be determined and/or controlled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:87KK1t2KJmsVqwDVxcvH3F6erHGSjt6gU3lODHDY4FI=\"},\"C-4529r88407_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wV2rv2IVWyQHIuIZzNN7jDzLimBra9QVKxEfwm4p0nc=\"},\"F-4529r88408_fix\",\"V-204405\",\"medium\",\"SRG-OS-000069-GPOS-00037\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41483,\"SV-204405r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that /etc/pam.d/passwd implements /etc/pam.d/system-auth when changing passwords.\",\"RHEL-07-010118\",\"Pluggable authentication modules (PAM) allow for a modular approach to integrating authentication methods. PAM operates in a top-down processing model and if the modules are not listed in the correct order, an important security function could be bypassed if stack entries are not centralized.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NVVlZz6DnbTO6YEa+HkLTRE6ApJBkX8N7oXza495krA=\"},\"C-4530r88410_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ty0BX1+S2CNa7NTV6x02Hdkv+nFbpdfLxv2kxmTzuoA=\"},\"F-4530r88411_fix\",\"V-204406\",\"medium\",\"SRG-OS-000069-GPOS-00037\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41484,\"SV-204406r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.\",\"RHEL-07-010119\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. \\\"pwquality\\\" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZZsZT55sjZiOw8YvdeG/PuTRrOJNXQ9fXpNFx1alZS0=\"},\"C-4531r88413_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:50c24SpAy6lZUa/raxhyzfeiBWAPtMEV8VJDkehahfI=\"},\"F-4531r88414_fix\",\"V-204407\",\"medium\",\"SRG-OS-000069-GPOS-00037\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41485,\"SV-204407r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one upper-case character.\",\"RHEL-07-010120\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5mP42vXD7dbHMk2adGpM5o78xd9tfHYGp4AY1olXPug=\"},\"C-4532r88416_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:K9vm1++ZIJVabRWXzHTee4LsRs4K42zsOdnMaBs894A=\"},\"F-4532r88417_fix\",\"V-204408\",\"medium\",\"SRG-OS-000070-GPOS-00038\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41486,\"SV-204408r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one lower-case character.\",\"RHEL-07-010130\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+ZxB96680QpTXOUhL+JNnhQFv/FKeRTfkrvRL3PV5S8=\"},\"C-4533r88419_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C2+B8kPWnlF62QWrO/V35CnYRxq/BrtDWAlCFrqLPPg=\"},\"F-4533r88420_fix\",\"V-204409\",\"medium\",\"SRG-OS-000071-GPOS-00039\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41487,\"SV-204409r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are assigned, the new password must contain at least one numeric character.\",\"RHEL-07-010140\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:abrw002NXrRQ66PzmbZYPT3hHRpQytzeYoaeJHhVEhU=\"},\"C-4534r88422_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RU7Q7o3Ev0u3LKqF5gyOeGtE+4224DgffB3yxG3HXzA=\"},\"F-4534r88423_fix\",\"V-204410\",\"medium\",\"SRG-OS-000266-GPOS-00101\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41488,\"SV-204410r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one special character.\",\"RHEL-07-010150\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CKBfpvZELPLxUExAGYDADab38Se08BtvG5UpBNIazBI=\"},\"C-4535r88425_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SV7aVMHMV2pg9CvBTy267KcjoYRu/NtX4vDqa6ogG+k=\"},\"F-4535r88426_fix\",\"V-204411\",\"medium\",\"SRG-OS-000072-GPOS-00040\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41489,\"SV-204411r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed a minimum of eight of the total number of characters must be changed.\",\"RHEL-07-010160\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wHEY2x4CvlXeh/wo8XesGOqxBrsYGWbUXOPbniv8Eec=\"},\"C-4536r88428_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ywBdYcG6riksarMvU8GLYRkgHnsMvClRGhpO80dIryk=\"},\"F-4536r88429_fix\",\"V-204412\",\"medium\",\"SRG-OS-000072-GPOS-00040\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41490,\"SV-204412r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed a minimum of four character classes must be changed.\",\"RHEL-07-010170\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:50yiX31ofIr+hd8aTkGds0o0cG1XWzi9CajHGO80y9s=\"},\"C-4537r88431_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sQgH4GxCCq+ysoBMnYh5H31rp93G+5yz2Gg2jTWAOMA=\"},\"F-4537r88432_fix\",\"V-204413\",\"medium\",\"SRG-OS-000072-GPOS-00040\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41491,\"SV-204413r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed the number of repeating consecutive characters must not be more than three characters.\",\"RHEL-07-010180\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:B5/JCBM3+y8mI0Wx//3vcvLxaBJUTuafPhnRMesP9F4=\"},\"C-4538r88434_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:E9p40X59ObEVCYByBc8xAxmZqPEKUNQhFuScvnelbvE=\"},\"F-4538r88435_fix\",\"V-204414\",\"medium\",\"SRG-OS-000072-GPOS-00040\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41492,\"SV-204414r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed the number of repeating characters of the same character class must not be more than four characters.\",\"RHEL-07-010190\",\"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\\n\\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:EWkE5ArbnCtRXt1tYfKaQZxY82bf5+ySftE5x3A7rUw=\"},\"C-4539r88437_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4ddTsadW6QqrmIoLUDmcDiTBzxaIozFG0eOuiHCk7RE=\"},\"F-4539r88438_fix\",\"V-204415\",\"medium\",\"SRG-OS-000073-GPOS-00041\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41493,\"SV-204415r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the PAM system service is configured to store only encrypted representations of passwords.\",\"RHEL-07-010200\",\"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:szDJRfipxjLUpU4siSaUz52MOYPESOCSPqgSYGrG8h8=\"},\"C-4540r88440_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gOQ3eksWP5ENmWWzc/DMM0RZ2jLEEkon1gajsl35tsI=\"},\"F-4540r88441_fix\",\"V-204416\",\"medium\",\"SRG-OS-000073-GPOS-00041\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41494,\"SV-204416r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to use the shadow file to store only encrypted representations of passwords.\",\"RHEL-07-010210\",\"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:37jX9s+legYelkYfnf62nyYfMX4Svx6S53TO09s9e7U=\"},\"C-4541r88443_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hRyf1t19z5DMc75LIoHPuvVnrO2HP0zkmJIFEox5KzE=\"},\"F-4541r88444_fix\",\"V-204417\",\"medium\",\"SRG-OS-000073-GPOS-00041\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41495,\"SV-204417r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.\",\"RHEL-07-010220\",\"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+bzaAS/aDWQDJP8ZUOuMk/ISS9nWHhkC1peC0GEcbKo=\"},\"C-4542r88446_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1T7sJCq5OM2unDp6aEqf5HsDoTTlARZDq3qfpQyM8uU=\"},\"F-4542r88447_fix\",\"V-204418\",\"medium\",\"SRG-OS-000075-GPOS-00043\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41496,\"SV-204418r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords for new users are restricted to a 24 hours/1 day minimum lifetime.\",\"RHEL-07-010230\",\"Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MrAAW3p9KHUSNIIDH94flLWi6pGLzydp9PgU+RlvGC4=\"},\"C-4543r88449_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JrE+xgTMLgDmwuA8WAdXAxbHE2r7VM2qSE/TkRg8DMw=\"},\"F-4543r88450_fix\",\"V-204419\",\"medium\",\"SRG-OS-000075-GPOS-00043\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41497,\"SV-204419r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords are restricted to a 24 hours/1 day minimum lifetime.\",\"RHEL-07-010240\",\"Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aD2m4e2s0uh65x94BQAdZnXh7LZzUYWOg1jlF0xaYe4=\"},\"C-4544r88452_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OP0loBodphliC5wIAx2xt3COiJwLHbScpisnDs0leHU=\"},\"F-4544r88453_fix\",\"V-204420\",\"medium\",\"SRG-OS-000076-GPOS-00044\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41498,\"SV-204420r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords for new users are restricted to a 60-day maximum lifetime.\",\"RHEL-07-010250\",\"Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Xq5u0Pw/Zw4wuAxFngAnRjHsza6G0aVM5vVkmV9EUkw=\"},\"C-4545r88455_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OW+LFcNscBOuumegSBomC31jM5LYWiBJDmBDcCJqtOk=\"},\"F-4545r88456_fix\",\"V-204421\",\"medium\",\"SRG-OS-000076-GPOS-00044\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41499,\"SV-204421r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that existing passwords are restricted to a 60-day maximum lifetime.\",\"RHEL-07-010260\",\"Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N2xDTbhTE+RFh0/Sm++3xu/AV9xHzSY7hXbPJaaNeEk=\"},\"C-4546r88458_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jqBEArvHLQLeliRKzl6iU7Hesu2gNm2CHdGbqTUxHa4=\"},\"F-4546r88459_fix\",\"V-204422\",\"medium\",\"SRG-OS-000077-GPOS-00045\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41500,\"SV-204422r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords are prohibited from reuse for a minimum of five generations.\",\"RHEL-07-010270\",\"Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If the information system or application allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed per policy requirements.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wnEfB+iBnuzOMM868Vy5hLj72C0iU0CFAkGqCn3lcV8=\"},\"C-4547r88461_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Zxvk6/+F0erAfuKv1q4yUSpM0vr7+nIlyKzfzaKdc6s=\"},\"F-4547r88462_fix\",\"V-204423\",\"medium\",\"SRG-OS-000078-GPOS-00046\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41501,\"SV-204423r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that passwords are a minimum of 15 characters in length.\",\"RHEL-07-010280\",\"The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.\\n\\nPassword complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dxEV5bGuHZP4iVsWXTtnKnb7HW9YuqytYqEfO4SaQlk=\"},\"C-4548r88464_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+qsYjWciZYQUB/V88VGdKnDuQXUV0QqGX56udWYJrmU=\"},\"F-4548r88465_fix\",\"V-204424\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41502,\"SV-204424r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have accounts configured with blank or null passwords.\",\"RHEL-07-010290\",\"If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fGovMAyL0HmlG0cv8i7GIrnPdYDI2Uu2j1CXqheXU6U=\"},\"C-4549r88467_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Q8iotl6ux8+dPdOwKWmbwKgIf/7rwz4a2+PNesYZhmo=\"},\"F-4549r88468_fix\",\"V-204425\",\"high\",\"SRG-OS-000106-GPOS-00053\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41503,\"SV-204425r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using an empty password.\",\"RHEL-07-010300\",\"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HWvW+5i4DGfbBRQ5ePFMe8hnoLMZwFwyu8jP8qD13B4=\"},\"C-4550r88470_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mx7sNoaABjDtoHiw3EcuJ31CMmR6HHu0qfKxJDkLskM=\"},\"F-4550r88471_fix\",\"V-204426\",\"medium\",\"SRG-OS-000118-GPOS-00060\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41504,\"SV-204426r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must disable account identifiers (individuals, groups, roles, and devices) if the password expires.\",\"RHEL-07-010310\",\"Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained.\\n\\nOperating systems need to track periods of inactivity and disable application identifiers after zero days of inactivity.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:H9mT1qdHOp9+ZyEy2fFxjTE/8tI1xhFtEvJORCJqd1k=\"},\"C-4551r88473_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:E9XDhr/n24vkAWIMtfMkvXTpFhXZwpvolrqLLmC13Kg=\"},\"F-4551r88474_fix\",\"V-204427\",\"medium\",\"SRG-OS-000329-GPOS-00128\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41505,\"SV-204427r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to lock accounts for a minimum of 15 minutes after three unsuccessful logon attempts within a 15-minute timeframe.\",\"RHEL-07-010320\",\"By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.\\n\\nSatisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oD6nmwpiJW9D5Cp/XXFX9UYRA755KWJpjrae9YSJLcA=\"},\"C-4552r88476_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+WHWx4dcfhcx4Ze8G9gIFM5wrU0gKeYCHmkrhqBKy/E=\"},\"F-4552r88477_fix\",\"V-204428\",\"medium\",\"SRG-OS-000329-GPOS-00128\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41506,\"SV-204428r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must lock the associated account after three unsuccessful root logon attempts are made within a 15-minute period.\",\"RHEL-07-010330\",\"By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.\\n\\nSatisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GEhzlPPnk+CAcWnOXaLRDP95b6T65/xq1qVqL/b84vw=\"},\"C-4553r88479_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hpjpsRKaPPJ3Ia1RY19t5pVGQb6/g/VXlMgaZLlmwcQ=\"},\"F-4553r88480_fix\",\"V-204429\",\"medium\",\"SRG-OS-000373-GPOS-00156\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41507,\"SV-204429r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that users must provide a password for privilege escalation.\",\"RHEL-07-010340\",\"Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \\n\\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate.\\n\\nSatisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SxSLBVVTtBtxKalJaRaw/6lgbVU0UOBOkgcTTRhHxD8=\"},\"C-4554r88482_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HYAeYfwCZZs8ctZhnvnSv2ucQ1JdxKYPJg0CTd18h14=\"},\"F-4554r88483_fix\",\"V-204430\",\"medium\",\"SRG-OS-000373-GPOS-00156\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41508,\"SV-204430r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that users must re-authenticate for privilege escalation.\",\"RHEL-07-010350\",\"Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \\n\\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate.\\n\\nSatisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+hZzZLys3BX7zWBUfBAVBQPgw6OXD+II7GH5BWOLMCI=\"},\"C-4555r88485_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JdoMO19GhKJDPOBHzoFLCHF7oQmEy7Lx/L1/9sWeXg0=\"},\"F-4555r88486_fix\",\"V-204431\",\"medium\",\"SRG-OS-000480-GPOS-00226\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41509,\"SV-204431r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the delay between logon prompts following a failed console logon attempt is at least four seconds.\",\"RHEL-07-010430\",\"Configuring the operating system to implement organization-wide security implementation guides and security checklists verifies compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\\n\\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example, registry settings; account, file, and directory permission settings; and settings for functions, ports, protocols, services, and remote connections.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wXo7iqYH5XGZTi7xVyPo9OMFKHuQ4XH2hIqOWqKo2ig=\"},\"C-4556r88488_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rtXajOQZci6vKdIVOpf9wOu2ZeYZ0LvKIOal4TwIexs=\"},\"F-4556r88489_fix\",\"V-204432\",\"high\",\"SRG-OS-000480-GPOS-00229\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41510,\"SV-204432r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not allow an unattended or automatic logon to the system via a graphical user interface.\",\"RHEL-07-010440\",\"Failure to restrict system access to authenticated users negatively impacts operating system security.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9DWDKCqiCDCdPaBAR1JnUJ2FgBKkNaNW7tQqAq+dw08=\"},\"C-4557r88491_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oWh+Qz6WRTlWrb5lARfKshYDIa+p6dDR188hrq5F5ds=\"},\"F-4557r88492_fix\",\"V-204433\",\"high\",\"SRG-OS-000480-GPOS-00229\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41511,\"SV-204433r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not allow an unrestricted logon to the system.\",\"RHEL-07-010450\",\"Failure to restrict system access to authenticated users negatively impacts operating system security.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rBMTU13BrvFeKQ+LVw9CSDaXjsTTmFaQjUCP5WUmK4E=\"},\"C-4558r88494_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gihecVT6zHmRSdYksj/6YGJOT2uA9gZTcH/QhkIQsq0=\"},\"F-4558r88495_fix\",\"V-204434\",\"medium\",\"SRG-OS-000480-GPOS-00229\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41512,\"SV-204434r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not allow users to override SSH environment variables.\",\"RHEL-07-010460\",\"Failure to restrict system access to authenticated users negatively impacts operating system security.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/uoCfeW8Df/g/XGQoBkg5WVbTAykMMBn4oMkJdNUEyA=\"},\"C-4559r88497_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:K+3n1t+ObwIUM11QMDTdGh98yONjdBtmdx5Ur9N3C0g=\"},\"F-4559r88498_fix\",\"V-204435\",\"medium\",\"SRG-OS-000480-GPOS-00229\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41513,\"SV-204435r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not allow a non-certificate trusted host SSH logon to the system.\",\"RHEL-07-010470\",\"Failure to restrict system access to authenticated users negatively impacts operating system security.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PVRLHuZ9kP5FJwKwYPDiChFJ5ZxZtcp0ro/wCh+st1A=\"},\"C-4560r88500_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:76sWDqXPiYk1zWHA8hQVZen2OkN3ppblRPJFE441EC4=\"},\"F-4560r88501_fix\",\"V-204436\",\"high\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41514,\"SV-204436r241939_rule\",\"high\",null,null,\"Red Hat Enterprise Linux operating systems prior to version 7.2 with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010480\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:y7xDq5NT2XNGrsamdbkoYKBvisZGFnS1fyg5AKvdfUQ=\"},\"C-4561r88503_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XBRfse8u4CBaisSjZn1V5+mBtSHoq8qleEOMU7NPS8Q=\"},\"F-4561r88504_fix\",\"V-204437\",\"medium\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41515,\"SV-204437r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010481\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tSZDrM1hWlCATKGgxqXsqEoIbIpJlq97X+0R6excyuQ=\"},\"C-4562r88506_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:geJjmG2xvtU8KsOo0NYpCklrqXG0GveHvbfaGe11AP4=\"},\"F-4562r88507_fix\",\"V-204438\",\"high\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41516,\"SV-204438r241939_rule\",\"high\",null,null,\"Red Hat Enterprise Linux operating systems version 7.2 or newer with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010482\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N8tSABUcJlBAkZ3vrmMcMUQscjNj485lQceECmBpBqY=\"},\"C-4563r88509_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9Hgkiy5EBfmBhvQw2thdKK4Mitvv2nkfcXFu2Yjvd8M=\"},\"F-4563r88510_fix\",\"V-204439\",\"high\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41517,\"SV-204439r241939_rule\",\"high\",null,null,\"Red Hat Enterprise Linux operating systems prior to version 7.2 using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010490\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3DS5zKmPA1/pZTvKSZLzlkwx6ZjRlk5GytGTDgvav+s=\"},\"C-4564r88512_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sLNLxYLCF4BkYkTMQlqtKlmz2CCiO2PBBy4/Xxulzds=\"},\"F-4564r88513_fix\",\"V-204440\",\"high\",\"SRG-OS-000080-GPOS-00048\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41518,\"SV-204440r241939_rule\",\"high\",null,null,\"Red Hat Enterprise Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes.\",\"RHEL-07-010491\",\"If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JTVgaY1LZdMLglvZK8C9tixEgj79wwesQdbeHi7a7Rk=\"},\"C-4565r88515_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XC9ckGWSpFsFRlPTdc3d5Ywv6RikA3tYpya5heE8HWw=\"},\"F-4565r88516_fix\",\"V-204441\",\"medium\",\"SRG-OS-000104-GPOS-00051\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41519,\"SV-204441r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users) using multifactor authentication.\",\"RHEL-07-010500\",\"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\\n\\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following:\\n\\n1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; \\n\\nand\\n\\n2) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\\n\\nSatisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000109-GPOS-00056, SRG-OS-000108-GPOS-00055, SRG-OS-000108-GPOS-00057, SRG-OS-000108-GPOS-00058\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mkc5HGb9gHNlg2WnY/djvfYdh8TcEe1wjVMoosFw32o=\"},\"C-4566r88518_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PkPXfMM5WKryVY7en8MTyQdFX7MPh1hx5HeAzwkHuGw=\"},\"F-4566r88519_fix\",\"V-204442\",\"high\",\"SRG-OS-000095-GPOS-00049\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41520,\"SV-204442r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have the rsh-server package installed.\",\"RHEL-07-020000\",\"It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\\n\\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).\\n\\nThe rsh-server service provides an unencrypted remote access service that does not provide for the confidentiality and integrity of user passwords or the remote session and has very weak authentication.\\n\\nIf a privileged user were to log on using this service, the privileged user password could be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:L6nJ9zxJTEu9H+NPMBNKXjZF11fxVnKsHJ0WDDygoYg=\"},\"C-4567r88521_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:i7hMFNAgwkh8GP0WW51DeT3l5PIPKAHm3h1ELi0DDSI=\"},\"F-4567r88522_fix\",\"V-204443\",\"high\",\"SRG-OS-000095-GPOS-00049\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41521,\"SV-204443r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have the ypserv package installed.\",\"RHEL-07-020010\",\"Removing the \\\"ypserv\\\" package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sfB3iHYcODrsGQIdQzi9S4OiWXlzCjwowCqvtusaGKY=\"},\"C-4568r88524_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pSF5drERdMpLPSu+WvmeYr2Pe+SlgFgTtHkBYI2QcAY=\"},\"F-4568r88525_fix\",\"V-204444\",\"medium\",\"SRG-OS-000324-GPOS-00125\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41522,\"SV-204444r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.\",\"RHEL-07-020020\",\"Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\\n\\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:toAqPFxuUxre2EEjoCzKlhcSnOb9RFpEln3MtuVIT9Q=\"},\"C-4569r88527_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XEeDzj3T3s/5C075RaI2/RVS5MmLUSOtmPLFh/sy/mk=\"},\"F-4569r88528_fix\",\"V-204445\",\"medium\",\"SRG-OS-000363-GPOS-00150\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41523,\"SV-204445r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that a file integrity tool verifies the baseline operating system configuration at least weekly.\",\"RHEL-07-020030\",\"Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\\n\\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NzJUcxxFJi8pit5evzZxnwQLQXWBf4/ftLMFNB6yiGw=\"},\"C-4570r88530_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RY/t3dX5Ty9FJRH+/noSp1Svd2G6xR3hYhL59PhK/G4=\"},\"F-4570r88531_fix\",\"V-204446\",\"medium\",\"SRG-OS-000363-GPOS-00150\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41524,\"SV-204446r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that designated personnel are notified if baseline configurations are changed in an unauthorized manner.\",\"RHEL-07-020040\",\"Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\\n\\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i6TlhYJkq+XnxoK0jdYhyvmrG0/kVGWgegQHFyIbH8Y=\"},\"C-4571r88533_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Eg5EIdHVVwh9ZqgphMoirHxJPHn0A2ZP4Q2vx9opqNY=\"},\"F-4571r88534_fix\",\"V-204447\",\"high\",\"SRG-OS-000366-GPOS-00153\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41525,\"SV-204447r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that\",\"RHEL-07-020050\",\"Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor.\\n\\nAccordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.\\n\\nVerifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SKIqa4iromN1/ld/zYxiQSOEbtGDJiFaQ30mjK6UgUY=\"},\"C-4572r88536_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BiV0UQMmksXuCOkEvhmjfxtdVdFaJetcBXhZERMG7fo=\"},\"F-4572r88537_fix\",\"V-204448\",\"high\",\"SRG-OS-000366-GPOS-00153\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41526,\"SV-204448r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that\",\"RHEL-07-020060\",\"Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor.\\n\\nAccordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.\\n\\nVerifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/bMIprnmuyHCZfwMhN53JacAU9Bw8vUNAz6FpcIsWeU=\"},\"C-4573r88539_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Z3a1S06/4F5C4Lp5cixp7Nu0E7my4W0IeMi33IalQW0=\"},\"F-4573r88540_fix\",\"V-204449\",\"medium\",\"SRG-OS-000114-GPOS-00059\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41527,\"SV-204449r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to disable USB mass storage.\",\"RHEL-07-020100\",\"USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity.\\n\\nSatisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7C8lXVeU00V8ySil2p6/I+nVauuGAbjK42d5ow1J2Y4=\"},\"C-4574r88542_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:uZz3nYMMEKXMiPBl6Xy/ScYOm9HzRk5qWZYzHGUx4bU=\"},\"F-4574r88543_fix\",\"V-204450\",\"medium\",\"SRG-OS-000378-GPOS-00163\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41528,\"SV-204450r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the Datagram Congestion Control Protocol (DCCP) kernel module is disabled unless required.\",\"RHEL-07-020101\",\"Disabling DCCP protects the system against exploitation of any flaws in the protocol implementation.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fvHgDUJGBMB+FLi/4z9egnoRgc5XNsyChWvVL+OV66I=\"},\"C-4575r88545_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Hq9mrYHDvGHmBtdMFIdfUqolkM1cMduz/gaG9QiC6yA=\"},\"F-4575r88546_fix\",\"V-204451\",\"medium\",\"SRG-OS-000114-GPOS-00059\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41529,\"SV-204451r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must disable the file system automounter unless required.\",\"RHEL-07-020110\",\"Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.\\n\\nSatisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ECU3PcokYJ0iTOaeFC4vceGeElsR/zrQCO1UeE3DreQ=\"},\"C-4576r88548_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oI+PCfg0U2LYXCzs78eVO/laVLbdDfv02bzMmbnUXsc=\"},\"F-4576r88549_fix\",\"V-204452\",\"low\",\"SRG-OS-000437-GPOS-00194\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41530,\"SV-204452r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must remove all software components after updated versions have been installed.\",\"RHEL-07-020200\",\"Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products may remove older versions of software automatically from the information system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mc80MJb4r7Qc8AmVFz9tOOJczWkzT3PVQISn5ZtRXSE=\"},\"C-4577r88551_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4FSreFL+qldPVF/mR4X7EaNlwgkKsQjPaFXx4S83Csk=\"},\"F-4577r88552_fix\",\"V-204453\",\"high\",\"SRG-OS-000445-GPOS-00199\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41531,\"SV-204453r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must enable SELinux.\",\"RHEL-07-020210\",\"Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\\n\\nThis requirement applies to operating systems performing security function verification/testing and/or systems and environments that require this functionality.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qFfBME/2o77yTMuxtpA4P0I8o2NQnfoVfThRiWzo6Lk=\"},\"C-4578r88554_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:3Ajev4/zwRAqY3q24YSLe6K9Ush9+wKs5BkHwER9b6M=\"},\"F-4578r88555_fix\",\"V-204454\",\"high\",\"SRG-OS-000445-GPOS-00199\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41532,\"SV-204454r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must enable the SELinux targeted policy.\",\"RHEL-07-020220\",\"Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\\n\\nThis requirement applies to operating systems performing security function verification/testing and/or systems and environments that require this functionality.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F70pc4lFutrB1aZSKBDOLu0diT12WqlYfaQrxFvOlBg=\"},\"C-4579r88557_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y6yG9b4+Sk91rD7DfkS/MXgAxBlsBoMeQBPFUWN95vw=\"},\"F-4579r88558_fix\",\"V-204455\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41533,\"SV-204455r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled on the command line.\",\"RHEL-07-020230\",\"A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:brL/cUNHx6LqwmVc7ML2OUn/P9TF3UTZ+dZ6dn6tjNY=\"},\"C-4580r88560_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JkiLXAedT0k6bEQvwqxohF7tHLjWbU2pGzkDN55NRYM=\"},\"F-4580r88561_fix\",\"V-204456\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41534,\"SV-204456r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled in the GUI.\",\"RHEL-07-020231\",\"A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:41T5JYxmVoKU+kVdsnjUa+6f5+dfkDIeSb6GFuUm5Dw=\"},\"C-4581r88563_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cpYv58/8Flvc4/bkLc1YNsLlr1YRlw72yf+/DFBGHGY=\"},\"F-4581r88564_fix\",\"V-204457\",\"medium\",\"SRG-OS-000480-GPOS-00228\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41535,\"SV-204457r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.\",\"RHEL-07-020240\",\"Setting the most restrictive default permissions ensures that when new accounts are created, they do not have unnecessary access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BKBVXasUfiVr7ygcFP+LUlFT+KaO5mryWRKA5v63Lzg=\"},\"C-4582r88566_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Cp4nKIw9SPZbUroGRU18fIv29Pew+EPDZcmgSeSx8EY=\"},\"F-4582r88567_fix\",\"V-204458\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41536,\"SV-204458r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be a vendor supported release.\",\"RHEL-07-020250\",\"An operating system release is considered \\\"supported\\\" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gzK9MUt7PjwGBJ/p/j6hcmkkkGmVE6qTD/BqPIvnN/E=\"},\"C-4583r88569_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:E9gT32RHBVbik+Je7pTMExJ4L7DJjyk7GysYa+7h2vQ=\"},\"F-4583r88570_fix\",\"V-204459\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41537,\"SV-204459r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system security patches and updates must be installed and up to date.\",\"RHEL-07-020260\",\"Timely patching is critical for maintaining the operational availability, confidentiality, and integrity of information technology (IT) systems. However, failure to keep operating system and application software patched is a common mistake made by IT professionals. New patches are released daily, and it is often difficult for even experienced System Administrators to keep abreast of all the new patches. When new weaknesses in an operating system exist, patches are usually made available by the vendor to resolve the problems. If the most recent security patches and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The lack of prompt attention to patching could result in a system compromise.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BIJOSScjxtLqA/SKv6NkIB3IGMa3Q+LPB+L/geOe7ok=\"},\"C-4584r88572_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:on/oOg7GrAbVYe62qKzCDcHBVJ+735gUHbX6wCQX7Tk=\"},\"F-4584r88573_fix\",\"V-204460\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41538,\"SV-204460r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not have unnecessary accounts.\",\"RHEL-07-020270\",\"Accounts providing no operational purpose provide additional opportunities for system compromise. Unnecessary accounts include user accounts for individuals not requiring access to the system and application accounts for applications not installed on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Xk8zYUvsnzovMiPLfQR6KgfXOkgeBn2KDtxaaMW0pGs=\"},\"C-4585r88575_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:x6Sb8AhbFuFgBMcB8fQ2DaX8SPkRfxrtvMQ5l7SngQQ=\"},\"F-4585r88576_fix\",\"V-204461\",\"low\",\"SRG-OS-000104-GPOS-00051\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41539,\"SV-204461r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all Group Identifiers (GIDs) referenced in the /etc/passwd file are defined in the /etc/group file.\",\"RHEL-07-020300\",\"If a user is assigned the GID of a group not existing on the system, and a group with the GID is subsequently created, the user may have unintended rights to any files associated with the group.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mmPdRsWMT1RXStEFvhbFi2NPQhPau7t1mLPRqSfrlso=\"},\"C-4586r88578_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:y96yxmL2BuOT8czP6029uRiO6H3TBaJbbwlQckB5Hzw=\"},\"F-4586r88579_fix\",\"V-204462\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41540,\"SV-204462r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the root account must be the only account having unrestricted access to the system.\",\"RHEL-07-020310\",\"If an account other than root also has a User Identifier (UID) of \\\"0\\\", it has root authority, giving that account unrestricted access to the entire operating system. Multiple accounts with a UID of \\\"0\\\" afford an opportunity for potential intruders to guess a password for a privileged account.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MCpiixKAw6iysD7QdBwvf/0nHCrKyrAMLWQ4JNX0Bl4=\"},\"C-4587r88581_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:GsC5G7HipGtW+62NgiZQXAkutlZWBE/GXEKtN8U0I/Q=\"},\"F-4587r88582_fix\",\"V-204463\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41541,\"SV-204463r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories have a valid owner.\",\"RHEL-07-020320\",\"Unowned files and directories may be unintentionally inherited if a user is assigned the same User Identifier \\\"UID\\\" as the UID of the un-owned files.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PkSBdKqiF+1CoNw6WAjSOHw0QMu48lpgS7hmAFLNKw8=\"},\"C-4588r88584_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vovSWqnTRcIm/6qmsLOTgH+/9w+W/vFltxdwhBfPZKA=\"},\"F-4588r88585_fix\",\"V-204464\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41542,\"SV-204464r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories have a valid group owner.\",\"RHEL-07-020330\",\"Files without a valid group owner may be unintentionally inherited if a group is assigned the same Group Identifier (GID) as the GID of the files without a valid group owner.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DgsJDDQVqbrezHTaPjQzaqTduH3lEoKAMNNMCRj803k=\"},\"C-4589r88587_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XGxN69S1ERxDxrpoViLVhQRmBwhqv05Lu3rnmLO0oJ4=\"},\"F-4589r88588_fix\",\"V-204465\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41543,\"SV-204465r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive users have a home directory assigned in the /etc/passwd file.\",\"RHEL-07-020600\",\"If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nJKpEfqumuAlnJnurMfT8V8fSO3ydCuFSVHs1UY9GPo=\"},\"C-4590r88590_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OeDu1aipDedHmc19/Hzvj5ebEOIbnKBqTl8bOptR+Go=\"},\"F-4590r88591_fix\",\"V-204466\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41544,\"SV-204466r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user accounts, upon creation, are assigned a home directory.\",\"RHEL-07-020610\",\"If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KjHexj1LNSBP7CHmbNY3vvDc8KQeFRj4apAjjK7uRz8=\"},\"C-4591r88593_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:vwYoTQjccTE77nR+wCGdiEu6mm4DUZtTWHdqEzVbIDk=\"},\"F-4591r88594_fix\",\"V-204467\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41545,\"SV-204467r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are defined in the /etc/passwd file.\",\"RHEL-07-020620\",\"If a local interactive user has a home directory defined that does not exist, the user may be given access to the / directory as the current working directory upon logon. This could create a Denial of Service because the user would not be able to access their logon configuration files, and it may give them visibility to system files they normally would not be able to access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IUowyh9fpAWNacEDCWcoW0ywTTeAFy1QJWtS37N3CvU=\"},\"C-4592r88596_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:f13Hkn8e4tzMje7pXIcxv5nytn7jo//XK+PrDi1dyWs=\"},\"F-4592r88597_fix\",\"V-204468\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41546,\"SV-204468r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories have mode 0750 or less permissive.\",\"RHEL-07-020630\",\"Excessive permissions on local interactive user home directories may allow unauthorized access to user files by other users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RVZyk6n7GgpVN69UGZjh42yXz3qHC+E11xMgNQqKqeA=\"},\"C-4593r88599_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fkXJCERE3hQ+ziCN+fp8Iy0BGhZ2sENcZRYvDy9Zp4M=\"},\"F-4593r88600_fix\",\"V-204469\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41547,\"SV-204469r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are owned by their respective users.\",\"RHEL-07-020640\",\"If a local interactive user does not own their home directory, unauthorized users could access or modify the user's files, and the users may not be able to access their own files.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4jt4mkKBzSe4CWKOCChBtcLEVdWyrxsrtYUDQqOWPb4=\"},\"C-4594r88602_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:V6lI0oDUoQokm4czgGuQfbxZHuD5cf984TnzjPNE6AI=\"},\"F-4594r88603_fix\",\"V-204470\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41548,\"SV-204470r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are group-owned by the home directory owners primary group.\",\"RHEL-07-020650\",\"If the Group Identifier (GID) of a local interactive user's home directory is not the same as the primary GID of the user, this would allow unauthorized access to the user's files, and users that share the same group may not be able to access files that they legitimately should.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AK8GPupR9o9w4Bpqm2vkAfSZfDDOTxHxIQYgJ4RNCtU=\"},\"C-4595r88605_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PDyQBeVHE7VC7Z4oNAi4BsMfmcg/7HUqDYEmFDrrYhc=\"},\"F-4595r88606_fix\",\"V-204471\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41549,\"SV-204471r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories are owned by the owner of the home directory.\",\"RHEL-07-020660\",\"If local interactive users do not own the files in their directories, unauthorized users may be able to access them. Additionally, if files are not owned by the user, this could be an indication of system compromise.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CUecwNXz6GFSUPJZXW1ugeOxM+oEICWaiuiBIttVcmE=\"},\"C-4596r88608_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2ynIHTJxW/hjjVBnoE3aH3Dx64kMUvPw3sE8bQ/tZFg=\"},\"F-4596r88609_fix\",\"V-204472\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41550,\"SV-204472r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member.\",\"RHEL-07-020670\",\"If a local interactive user's files are group-owned by a group of which the user is not a member, unintended users may be able to access them.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v1B+Day0uLquC3G3rkAZLvKRlB/UsiRznWww8MhD2Ns=\"},\"C-4597r88611_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2KJKevWHOUHMQKjoQwxaE2WAGIXLMzDOWnovDK4DZns=\"},\"F-4597r88612_fix\",\"V-204473\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41551,\"SV-204473r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories have a mode of 0750 or less permissive.\",\"RHEL-07-020680\",\"If a local interactive user files have excessive permissions, unintended users may be able to access or modify them.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uxK1tQMsGtXuIVRNHQgns3AeLuOfO8jy94kjoPQ2L+g=\"},\"C-4598r88614_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XV3izjAIenixvx0nqsZoW+XWGaX6te1P3K0d1un2MOM=\"},\"F-4598r88615_fix\",\"V-204474\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41552,\"SV-204474r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local initialization files for interactive users are owned by the home directory user or root.\",\"RHEL-07-020690\",\"Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uxK1tQMsGtXuIVRNHQgns3AeLuOfO8jy94kjoPQ2L+g=\"},\"C-4599r88617_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zgcP3101YueZ5H1sOBSOtCI20rSAHZPmMQIWD74FgfY=\"},\"F-4599r88618_fix\",\"V-204475\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41553,\"SV-204475r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local initialization files for local interactive users are be group-owned by the users primary group or root.\",\"RHEL-07-020700\",\"Local initialization files for interactive users are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vX6dN7EfNthdimlLaFh0Q9z6OmJUHbzovDHwg8c8NHU=\"},\"C-4600r88620_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hED2+/cZGpIdVgJ0q4fRlhVaRWUvsLQbvwPtOtoQWxY=\"},\"F-4600r88621_fix\",\"V-204476\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41554,\"SV-204476r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local initialization files have mode 0740 or less permissive.\",\"RHEL-07-020710\",\"Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nMN0kK1ic7h1eLInaM6SrG+c+t8cGPkmMerp3/LQra8=\"},\"C-4601r88623_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lfpVJ/f47cYlqC2Iqf5QP2GfumZTqSvKzQqeqevyjkw=\"},\"F-4601r88624_fix\",\"V-204477\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41555,\"SV-204477r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user initialization files executable search paths contain only paths that resolve to the users home directory.\",\"RHEL-07-020720\",\"The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory (other than the user's home directory), executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two consecutive colons, this is interpreted as the current working directory. If deviations from the default system search path for the local interactive user are required, they must be documented with the Information System Security Officer (ISSO).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Jjjq7xVAWflOe4CoFgZpUiv9Y1NWKcp73tzANZZz+gw=\"},\"C-4602r88626_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:c71mt3rovTr0gD67mVjW85xuJx1Gn3YVBPAifDNyrVc=\"},\"F-4602r88627_fix\",\"V-204478\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41556,\"SV-204478r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that local initialization files do not execute world-writable programs.\",\"RHEL-07-020730\",\"If user start-up files execute world-writable programs, especially in unprotected directories, they could be maliciously modified to destroy user files or otherwise compromise the system at the user level. If the system is compromised at the user level, it is easier to elevate privileges to eventually compromise the system at the root and network level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:X06vDs2tR3QGoQ+xoPHCwRpZHEYU9e6HRZHfgAas1TE=\"},\"C-4603r88629_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bAJKBf4BozI/fviaN/J4hW6lYCK5730YjnmMZI8SZhY=\"},\"F-4603r88630_fix\",\"V-204479\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41557,\"SV-204479r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all system device files are correctly labeled to prevent unauthorized modification.\",\"RHEL-07-020900\",\"If an unauthorized or modified device is allowed to exist on the system, there is the possibility the system may perform unintended or unauthorized operations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rTAfVwmsa16lr6s7L1HVMt53f8c4APqViMHCPG3PQ0c=\"},\"C-4604r88632_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MCtlDRYVTGx0QAFvjnLcwUlRaRnKewVZwCEqHsR69vc=\"},\"F-4604r88633_fix\",\"V-204480\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41558,\"SV-204480r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that file systems containing user home directories are mounted to prevent files with the setuid and setgid bit set from being executed.\",\"RHEL-07-021000\",\"The \\\"nosuid\\\" mount option causes the system to not execute setuid and setgid files with owner privileges. This option must be used for mounting any file system not containing approved setuid and setguid files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oNIXrV8IrUz3LBKHcpc5OkB5AAV30a49EWBJw8tFGRI=\"},\"C-4605r88635_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:A9U1/Kh+oVjKN0jAypf2fLI0wUE+tPD5KlslHPZ6aQw=\"},\"F-4605r88636_fix\",\"V-204481\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41559,\"SV-204481r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.\",\"RHEL-07-021010\",\"The \\\"nosuid\\\" mount option causes the system to not execute \\\"setuid\\\" and \\\"setgid\\\" files with owner privileges. This option must be used for mounting any file system not containing approved \\\"setuid\\\" and \\\"setguid\\\" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:u7P2t9CBo4bVxiR7YZbGpIUx/LFmWm/tqN+oNRgHAME=\"},\"C-4606r88638_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B30lyHn2hJcrEol+Itn5ztKfCEjGM7iuUWexOnyqja0=\"},\"F-4606r88639_fix\",\"V-204482\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41560,\"SV-204482r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are being imported via Network File System (NFS).\",\"RHEL-07-021020\",\"The \\\"nosuid\\\" mount option causes the system to not execute \\\"setuid\\\" and \\\"setgid\\\" files with owner privileges. This option must be used for mounting any file system not containing approved \\\"setuid\\\" and \\\"setguid\\\" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bNGETuyi+t5ZcClrjc42GS9cWGj/6HLIX7UykCKyI9I=\"},\"C-4607r88641_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:izR6tZbtPgWAisBlIjGs3YMJNpiPvp0YrUH300TXERk=\"},\"F-4607r88642_fix\",\"V-204483\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41561,\"SV-204483r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent binary files from being executed on file systems that are being imported via Network File System (NFS).\",\"RHEL-07-021021\",\"The \\\"noexec\\\" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files as they may be incompatible. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+rITfa9uPWXKr2BTckVmwYe0uqE2Xqu4VJaGlyUb/tU=\"},\"C-4608r88644_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:LyHAJsCX564T9Ld2guDnewiwJ2c5r5nZSosa5H1Xdu8=\"},\"F-4608r88645_fix\",\"V-204484\",\"low\",\"SRG-OS-000368-GPOS-00154\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41562,\"SV-204484r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must mount /dev/shm with the nodev option.\",\"RHEL-07-021022\",\"The \\\"nodev\\\" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c76gZ1SY4u9l79FnrsQHACwNc4CL62N+zPqo7zmpzkA=\"},\"C-4609r88647_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:txPPE7KSlIBN9F/tup+d+px5xHuUHHHEq3zGVD74WZ8=\"},\"F-4609r88648_fix\",\"V-204485\",\"low\",\"SRG-OS-000368-GPOS-00154\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41563,\"SV-204485r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must mount /dev/shm with the nosuid option.\",\"RHEL-07-021023\",\"The \\\"nosuid\\\" mount option causes the system to not execute \\\"setuid\\\" and \\\"setgid\\\" files with owner privileges. This option must be used for mounting any file system not containing approved \\\"setuid\\\" and \\\"setguid\\\" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+Cd2E8o4ONaUdrAAVpMr0bFQJFkRt9EDcw+xhFpcySU=\"},\"C-4610r88650_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oHUhPRya0ZChLM+Nhu19UnAx5gOJ6gN6DT+c0ZfQLjo=\"},\"F-4610r88651_fix\",\"V-204486\",\"low\",\"SRG-OS-000368-GPOS-00154\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41564,\"SV-204486r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must mount /dev/shm with the noexec option.\",\"RHEL-07-021024\",\"The \\\"noexec\\\" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files as they may be incompatible. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:68kXW4hDQ+wT9SdXi8wMj/sov4EvnCOjABVhUZDBnBo=\"},\"C-4611r88653_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:83kRFa5no0nmunBS+gSPgjh4XcsNZklC+6sA2t8+kXo=\"},\"F-4611r88654_fix\",\"V-204487\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41565,\"SV-204487r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all world-writable directories are group-owned by root, sys, bin, or an application group.\",\"RHEL-07-021030\",\"If a world-writable directory has the sticky bit set and is not group-owned by a privileged Group Identifier (GID), unauthorized users may be able to modify files created by others.\\n\\nThe only authorized public directories are those temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage, (e.g., /tmp), and for directories requiring global read/write access.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1XgmUIRB6alinIiV63h8l4a4c+FpBsGbCgpB3sm/gQ4=\"},\"C-4612r88656_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:u0/cFHEM/xlDUYJ90JmsaS3bdmwY8gRr+EjqVIoj7vM=\"},\"F-4612r88657_fix\",\"V-204488\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41566,\"SV-204488r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must set the umask value to 077 for all local interactive user accounts.\",\"RHEL-07-021040\",\"The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 700 or less permissive. Although umask can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be \\\"0\\\". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MnVJuhcg4+npgMSzOK+ZI3jYbv9R79L3Pw0sG4OGjuY=\"},\"C-4613r88659_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ml9/OTeVKu9RrgGyw3MUaFEGuvSL9eoIA/iBk14uSbQ=\"},\"F-4613r88660_fix\",\"V-204489\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41567,\"SV-204489r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must have cron logging implemented.\",\"RHEL-07-021100\",\"Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hAE8/s/q+2bPxB0JEqCor5YiRwtPpCKQTpKO19s+CsE=\"},\"C-4614r88662_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HoJ5w5/OwkGpsfXKH28H0ocQMj/3zOwF8e8Lr8glasY=\"},\"F-4614r88663_fix\",\"V-204490\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41568,\"SV-204490r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists, is owned by root.\",\"RHEL-07-021110\",\"If the owner of the \\\"cron.allow\\\" file is not set to root, the possibility exists for an unauthorized user to view or to edit sensitive information.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2dsipNSSkkuhCPSuvfUEnxPPKLhEefb0wQ5pWOxGi1s=\"},\"C-4615r88665_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:WJ6fBifQQVq1bOrhsHodd56xXHAwG48s2i17d+TgZP8=\"},\"F-4615r88666_fix\",\"V-204491\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41569,\"SV-204491r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists, is group-owned by root.\",\"RHEL-07-021120\",\"If the group owner of the \\\"cron.allow\\\" file is not set to root, sensitive information could be viewed or edited by unauthorized users.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ouKxFOOPpBEfihfWTLMVhsHI14OUZyPa8UIIzq+9aDM=\"},\"C-4616r88668_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nr5wfFxT0WmrANwdPMiqK5tUbpZe7VTGB5cXzmlYXWE=\"},\"F-4616r88669_fix\",\"V-204492\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41570,\"SV-204492r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must disable Kernel core dumps unless needed.\",\"RHEL-07-021300\",\"Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps may consume a considerable amount of disk space and may result in denial of service by exhausting the available space on the target file system partition.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7PN7qrWKJmcvXiHYyWoVhaf0vMJwkBzlYvMLMqakubE=\"},\"C-4617r88671_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FESCG4d/9iAZyFfuPeXnTNkZi64m9INnnm4n9aC52FI=\"},\"F-4617r88672_fix\",\"V-204493\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41571,\"SV-204493r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that a separate file system is used for user home directories (such as /home or an equivalent).\",\"RHEL-07-021310\",\"The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1cCc49bcm+M75v2YFAybr7leYSlE+gJkFfU7F/sl09M=\"},\"C-4618r88674_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C2bv9rIevJ1z1iyzLf8xYIUwpYUQWtFzgJ0EtVzj1b0=\"},\"F-4618r88675_fix\",\"V-204494\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41572,\"SV-204494r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must use a separate file system for /var.\",\"RHEL-07-021320\",\"The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XJvN48pmi8HAcsDkJM/G14Kd6I6pzdqyNmh7aTUWPog=\"},\"C-4619r88677_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NPfLVxGk1uPQ98SX656t+VIJsK19BOAD7ay7Qu0w7ck=\"},\"F-4619r88678_fix\",\"V-204495\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41573,\"SV-204495r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must use a separate file system for the system audit data path.\",\"RHEL-07-021330\",\"The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:18y0TK+OVu1ckq6VVHACpujYOUOuHE9k0lnFU7vZePY=\"},\"C-4620r88680_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:B9gPCX4PFcoRc5Vm3y0wzQEuWJY0O+DtUXFoEcYdlSY=\"},\"F-4620r88681_fix\",\"V-204496\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41574,\"SV-204496r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must use a separate file system for /tmp (or equivalent).\",\"RHEL-07-021340\",\"The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Eqvpa3O8L/43+F/dfd3RCBJOqej2+xWuUq9l9HGqyf8=\"},\"C-4621r88683_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jXW05QbpEzlIDpcMBVrdzEstoZVo3Ubv2bc8/2DTpac=\"},\"F-4621r88684_fix\",\"V-204497\",\"high\",\"SRG-OS-000033-GPOS-00014\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41575,\"SV-204497r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with a\",\"RHEL-07-021350\",\"Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\\n\\nSatisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000185-GPOS-00079, SRG-OS-000396-GPOS-00176, SRG-OS-000405-GPOS-00184, SRG-OS-000478-GPOS-00223\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gqquU+6877zdN2QBJVLYBJLAgY9YaeAMGXWhfOMdJDc=\"},\"C-4622r88686_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:340oKSUye0fhpJyu4pBuORuPrLVb6J7Ia64/DF2LHHM=\"},\"F-4622r88687_fix\",\"V-204498\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41576,\"SV-204498r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the file integrity tool is configured to verify Access Control Lists (ACLs).\",\"RHEL-07-021600\",\"ACLs can provide permissions beyond those permitted through the file mode and must be verified by file integrity tools.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BuBYuHuQAvXuOxcqP3DStX9B4QilMV8GArQJSwKL4qk=\"},\"C-4623r88689_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+f/QFLk9K+H3NQDA2eP/vOV+0hz8XlNBateHJaucadA=\"},\"F-4623r88690_fix\",\"V-204499\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41577,\"SV-204499r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the file integrity tool is configured to verify extended attributes.\",\"RHEL-07-021610\",\"Extended attributes in file systems are used to contain arbitrary data and file metadata with security implications.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nqqG2GW71CBVy4Zbpx5pP8sJyDtQRHFZG9xO9W+fhaY=\"},\"C-4624r88692_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QMPyNe4roXVyfO/NnAf18sgASR0e2B1wqdT6D4qATSY=\"},\"F-4624r88693_fix\",\"V-204500\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41578,\"SV-204500r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must use a file integrity tool that is configured to use FIPS 140-2 approved cryptographic hashes for validating file contents and directories.\",\"RHEL-07-021620\",\"File integrity tools use cryptographic hashes for verifying file contents and directories have not been altered. These hashes must be FIPS 140-2 approved cryptographic hashes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:APlAz7ZItAMZCPrk0PRupBAoTrM5Bx3+9xNBo4579+0=\"},\"C-4625r88695_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cMCdYD5AiShSbfVloMRt6g3gUP7LLewSgx2SyXMlHFk=\"},\"F-4625r88696_fix\",\"V-204501\",\"medium\",\"SRG-OS-000364-GPOS-00151\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41579,\"SV-204501r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not allow removable media to be used as the boot loader unless approved.\",\"RHEL-07-021700\",\"Malicious users with removable boot media can gain access to a system configured to use removable media as the boot loader. If removable media is designed to be used as the boot loader, the requirement must be documented with the Information System Security Officer (ISSO).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cp2RMg6QxCqTvmqP37SKwG1FqsgipFxqR3t5FU4PXLk=\"},\"C-4626r88698_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+JK6qsOZ0/f3jw+GVOKxXzJfdL75RKoM5+nkeNBSwDo=\"},\"F-4626r88699_fix\",\"V-204502\",\"high\",\"SRG-OS-000095-GPOS-00049\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41580,\"SV-204502r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have the telnet-server package installed.\",\"RHEL-07-021710\",\"It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\\n\\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).\\n\\nExamples of non-essential capabilities include, but are not limited to, games, software packages, tools, and demonstration software not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Z7b6Mm6lUqwXG2sdLSsdV3B3gZr1qR0O9kZkWEmbxrM=\"},\"C-4627r88701_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/4EWh8HGiUPHSSmWJEeEoA7QVt/i4fYiGMgMiSXKZPA=\"},\"F-4627r88702_fix\",\"V-204503\",\"high\",\"SRG-OS-000038-GPOS-00016\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41581,\"SV-204503r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of th\",\"RHEL-07-030000\",\"Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nAudit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.\\n\\nAssociating event types with detected events in the operating system audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured operating system.\\n\\nSatisfies: SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000042-GPOS-00021, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qglSyMZMvG/rrLNnILUfVZ3YuFZFi5T6+KZGiWAdQ/A=\"},\"C-4628r88704_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6xjMdWgrCBOAv09QpXdtDYvHZLQ+b9mnJgExj1C/Nrc=\"},\"F-4628r88705_fix\",\"V-204504\",\"medium\",\"SRG-OS-000046-GPOS-00022\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41582,\"SV-204504r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must shut down upon audit processing failure, unless availability is an overriding concern. If availability is a concern, the system must alert the designated staff (System Administrator [SA] and Information S\",\"RHEL-07-030010\",\"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.\\n\\nAudit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.\\n\\nThis requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.\\n\\nSatisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000047-GPOS-00023\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GlCYNKZ4IKbMHrBwdJyaGeNDUtXvok0O5JQhengD9bI=\"},\"C-4629r88707_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ytY6syQ7DRKurVfyuaATJjO7HK1ts6aQR0tZCIf8Ie4=\"},\"F-4629r88708_fix\",\"V-204505\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41583,\"SV-204505r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to use the au-remote plugin.\",\"RHEL-07-030200\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nWithout the configuration of the \\\"au-remote\\\" plugin, the audisp-remote daemon will not off-load the logs from the system being audited.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BqnXskmzv0Fml5dUryA9empCvoF4uJVgP7gSzNJBG5Q=\"},\"C-4630r88710_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OzaEK+xwE4QT0b0pQEOvNF6OWexP72bOIc5JEdcUGuk=\"},\"F-4630r88711_fix\",\"V-204506\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41584,\"SV-204506r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must configure the au-remote plugin to off-load audit logs using the audisp-remote daemon.\",\"RHEL-07-030201\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nWithout the configuration of the \\\"au-remote\\\" plugin, the audisp-remote daemon will not off load the logs from the system being audited.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:l+C+NK9AgsqOtIckjdTH4jH0PdnaS4ciKjpNRfQiUbQ=\"},\"C-4631r88713_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:p4NuyS6snIbSrRC2m6yASdhY1FUZkGFyIQRGi5/wXk4=\"},\"F-4631r88714_fix\",\"V-204507\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41585,\"SV-204507r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must take appropriate action when the audisp-remote buffer is full.\",\"RHEL-07-030210\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nWhen the remote buffer is full, audit logs will not be collected and sent to the central log server.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hcASCCaQ6DCZhsOVgtG2fCLYh13EpBUcl5ehg9PF3Js=\"},\"C-4632r88716_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:U6YLDhJ893R7sPbp7NC27z+9DeVXlqe980JXLuAfpPo=\"},\"F-4632r88717_fix\",\"V-204508\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41586,\"SV-204508r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must label all off-loaded audit logs before sending them to the central log server.\",\"RHEL-07-030211\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nWhen audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be analyzed and tied back to the correct system.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XkQ6DCdOAKS0GwAwhQplZEj8R1FV2bl5hQua4nPED4k=\"},\"C-4633r88719_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kSsD36pnjKCClXikSWuQ1pP1rZFh01i/y53w3iNUhVI=\"},\"F-4633r88720_fix\",\"V-204509\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41587,\"SV-204509r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must off-load audit records onto a different system or media from the system being audited.\",\"RHEL-07-030300\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Bf2fWApv0APcqeZ5XF4R3RXo/goqg4pCstdRuIGQtss=\"},\"C-4634r88722_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:giS9pFUiCrhO1TkbbeSyXejUIjjJKDujN4BntbuGaXU=\"},\"F-4634r88723_fix\",\"V-204510\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41588,\"SV-204510r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited.\",\"RHEL-07-030310\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:M4dQIiEBGtvfjwdGLgcnbZPAohqROn1I34DQD4YRp64=\"},\"C-4635r88725_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sXHGhtqxex7BLAMaVPnlDAgGWULXebvIAQ4yeHY17bw=\"},\"F-4635r88726_fix\",\"V-204511\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41589,\"SV-204511r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the audit system takes appropriate action when the audit storage volume is full.\",\"RHEL-07-030320\",\"Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3wu6Xlq+C0xzTcZhVKXS6/ol6uXxhMPvS8I8O+1XaqI=\"},\"C-4636r88728_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:le7qN6zmE7PQ4gZdn8UO/rZlhQCMUymKprBd07poQN4=\"},\"F-4636r88729_fix\",\"V-204512\",\"medium\",\"SRG-OS-000342-GPOS-00133\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41590,\"SV-204512r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the audit system takes appropriate action when there is an error sending audit records to a remote system.\",\"RHEL-07-030321\",\"Taking appropriate action when there is an error sending audit records to a remote system will minimize the possibility of losing audit records.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aflWrGGmEaadkYGyiV9fTBb/AxbzyQb2JEc+iSI+NkM=\"},\"C-4637r88731_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qCZZZ4TWBFpqEjjkyQQ2aorhUNgEHavtO0hiaWBbmRQ=\"},\"F-4637r88732_fix\",\"V-204513\",\"medium\",\"SRG-OS-000343-GPOS-00134\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41591,\"SV-204513r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must initiate an action to notify the System Administrator (SA) and Information System Security Officer ISSO, at a minimum, when allocated audit record storage volume reaches 75% of the repository maximum audi\",\"RHEL-07-030330\",\"If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to plan for audit record storage capacity expansion.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ltVAshO8pttoqEyqG6qijiNJqOl2Qg26et8YkE7jF5s=\"},\"C-4638r88734_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KxzZV1AXjjqRD/m745HcjAVzzwYXjKxl5If3x0jrZMw=\"},\"F-4638r88735_fix\",\"V-204514\",\"medium\",\"SRG-OS-000343-GPOS-00134\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41592,\"SV-204514r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) via email when the threshold for the repository maximum audit record storage capacity is reac\",\"RHEL-07-030340\",\"If security personnel are not notified immediately when the threshold for the repository maximum audit record storage capacity is reached, they are unable to expand the audit record storage capacity before records are lost.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Uw4E5/qhIYn2a7XqoO/vCVOGSvxQjO5QMCJ7MHUh3po=\"},\"C-4639r88737_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:F3IcvKBWmicK+KdP03BYHkfQVcnycYYa3Ww3CsjMnjw=\"},\"F-4639r88738_fix\",\"V-204515\",\"medium\",\"SRG-OS-000343-GPOS-00134\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41593,\"SV-204515r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached.\",\"RHEL-07-030350\",\"If security personnel are not notified immediately when the threshold for the repository maximum audit record storage capacity is reached, they are unable to expand the audit record storage capacity before records are lost.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pb9zyKyDrGizMm2SQJsP9iE6S0NT/TD/ykIFMramKTU=\"},\"C-4640r88740_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Jk4zqxy0xY2nrp1dYXkiE3RgwNuE7VZK0/ZJdueJ1ZI=\"},\"F-4640r88741_fix\",\"V-204516\",\"medium\",\"SRG-OS-000327-GPOS-00127\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41594,\"SV-204516r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all executions of privileged functions.\",\"RHEL-07-030360\",\"Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tfgd6xmJ2tetubGheG+rBYQusickUOomvWf+fpjbT7Q=\"},\"C-4641r88743_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:N/N8R/5EbzaxWpnadedKVzeEjXbqgmOONNwPn+bHRRs=\"},\"F-4641r88744_fix\",\"V-204517\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41595,\"SV-204517r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chown syscall.\",\"RHEL-07-030370\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IRTfp4gJecK//m5Q762/0oGsBdPOyjw0rySHurIS8LE=\"},\"C-4642r88746_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Lzjw0z9I6F2iClv12SH/CGeb1U1kLA6Vs1zPNHLvVuQ=\"},\"F-4642r88747_fix\",\"V-204518\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41596,\"SV-204518r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fchown syscall.\",\"RHEL-07-030380\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c3BG+SR2o14aicE+yhq3PtQvfjs3cmTzFbE8tHrvpUA=\"},\"C-4643r88749_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:VT1ZFsd5F6gX89ldnJ4WQwNzKVn+O05wg2pOqSoa4Bk=\"},\"F-4643r88750_fix\",\"V-204519\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41597,\"SV-204519r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the lchown syscall.\",\"RHEL-07-030390\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2XtliP/rksJDS7Xvfpls8GPXpBFZoWsdnTomfRmL9QU=\"},\"C-4644r88752_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:a9pQ+UYmeonAb+q0O5K0HvydTCOnpSRwNCVZ1qPIzxM=\"},\"F-4644r88753_fix\",\"V-204520\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41598,\"SV-204520r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fchownat syscall.\",\"RHEL-07-030400\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NQ4XbflQ44GaE3zsieP8DlRi/3mPxweIdroLWHOE4Pg=\"},\"C-4645r88755_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lrdjsFKfpaOe12ODjIvaz6pGUQDdDwa3dj2P2AvnQO8=\"},\"F-4645r88756_fix\",\"V-204521\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41599,\"SV-204521r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chmod syscall.\",\"RHEL-07-030410\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ct96QUF8s7jdqE0Ojh304JzeK8kmZYLbQaQReE84rXs=\"},\"C-4646r88758_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YaQBZRFREVaeABtSVI8wvC8DzIeJkWLuP9gdN4onkGc=\"},\"F-4646r88759_fix\",\"V-204522\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41600,\"SV-204522r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fchmod syscall.\",\"RHEL-07-030420\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rDncDz9FOlJO5zuVTZJbynkJ6dX2Vmq6oI6860tKW3g=\"},\"C-4647r88761_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cqwA8+hvx3TIV+pEBCaRFI8mXzSRXFlA/o8IN6XPhtg=\"},\"F-4647r88762_fix\",\"V-204523\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41601,\"SV-204523r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fchmodat syscall.\",\"RHEL-07-030430\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8tsf1iL2uCKUxO1hoNkCKyC3IFWiTzlQVJpKPEwK0QI=\"},\"C-4648r88764_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4/Y9rUqyPdcCD9Ee+D7kKjsQpUrVo3Y2fNse7I+PSs4=\"},\"F-4648r88765_fix\",\"V-204524\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41602,\"SV-204524r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the setxattr syscall.\",\"RHEL-07-030440\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SvFkHfPrdOQKr5ne1xqIFighaKbfQ/sihawpHb7p7rA=\"},\"C-4649r88767_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wLwqr7Awa4pIak8mi9ElXBAr4HnVTHOllj07wZTbP2M=\"},\"F-4649r88768_fix\",\"V-204525\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41603,\"SV-204525r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fsetxattr syscall.\",\"RHEL-07-030450\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xCC65vU4a0dx3uNjyFYVXGG1SRtdEiyjqGvJjghYeow=\"},\"C-4650r88770_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SIoz7aeiUTREx9WK/3oog5vv1qzPOYJ0E0oTAI8mJ8c=\"},\"F-4650r88771_fix\",\"V-204526\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41604,\"SV-204526r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the lsetxattr syscall.\",\"RHEL-07-030460\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kE1xvX7cLhAoPe9cvYdrUdLUAfjE7eLXYem3Gw8DNLs=\"},\"C-4651r88773_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:F6IhUU6xp6NUpuB/qpY3XXNN1ASs9zdvMmmF9/zPDwU=\"},\"F-4651r88774_fix\",\"V-204527\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41605,\"SV-204527r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the removexattr syscall.\",\"RHEL-07-030470\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vnSamAe2+/Hr+nfPkTqL9I0bWVmWTIFQpYfsqnVG9F8=\"},\"C-4652r88776_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Lg3LvhwYivRIIFbmUNu5aXJNKKGBMSEBPbjWRrOtSuM=\"},\"F-4652r88777_fix\",\"V-204528\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41606,\"SV-204528r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the fremovexattr syscall.\",\"RHEL-07-030480\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qHpyKM8i0QhH/xmWGRB3HGZ+olnqtUnASbAZecaifiM=\"},\"C-4653r88779_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NgalkY0uC0B3Y5qlj+v1Efd1XY1ykcDyIwUBqXjsfLA=\"},\"F-4653r88780_fix\",\"V-204529\",\"medium\",\"SRG-OS-000458-GPOS-00203\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41607,\"SV-204529r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the lremovexattr syscall.\",\"RHEL-07-030490\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9kmHZoiuoiL6AsWMWz23RZbKzak8ErxyC7YO6g8muqE=\"},\"C-4654r88782_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5sGvUlB7gnIf90PrEFOfkewhURxAI1SWz7kIMnanjXg=\"},\"F-4654r88783_fix\",\"V-204530\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41608,\"SV-204530r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the creat syscall.\",\"RHEL-07-030500\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QLmTItOwmEnfzdlxDbgeaEgT0GU0Nbb70w5rFh7+ClA=\"},\"C-4655r88785_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:6zBN3awVnJJxpbFDd7rNtN56UvR4PeH9i+8VXL2iq1Y=\"},\"F-4655r88786_fix\",\"V-204531\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41609,\"SV-204531r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the open syscall.\",\"RHEL-07-030510\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/PZC/00fiKOLVTTaP7vTKSayzSFdhYJTeG7hNLk4+gE=\"},\"C-4656r88788_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:bvOEkYRfhusdNwFelT4MbDopZr6A0Sge446avyeOeUw=\"},\"F-4656r88789_fix\",\"V-204532\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41610,\"SV-204532r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the openat syscall.\",\"RHEL-07-030520\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jhuvdlST3755aQuU9dw8itd/oBXZUB3VR1y2ygyl5FI=\"},\"C-4657r88791_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:r/0O2zTE5O+392jpkFNgse//67/OEAkktr2AzRD7wyU=\"},\"F-4657r88792_fix\",\"V-204533\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41611,\"SV-204533r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the open_by_handle_at syscall.\",\"RHEL-07-030530\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tA45OvJ+kaPqzTLBG3AsIdZ+y1Fsg6ea5iZ7tEfE1dQ=\"},\"C-4658r88794_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:FiHAEf5+7+wojzlrnbsH3ebzF+bOSRMAJ7VNN4gVzlA=\"},\"F-4658r88795_fix\",\"V-204534\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41612,\"SV-204534r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the truncate syscall.\",\"RHEL-07-030540\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aAoxDRfMkHNrqAeotAp74gpKHv9wOXogrgjeQ7eJGQA=\"},\"C-4659r88797_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:iBhBh/4FwIsthObBlwNsPC4Max9BYz/32jCUuYl0CN0=\"},\"F-4659r88798_fix\",\"V-204535\",\"medium\",\"SRG-OS-000064-GPOS-00033\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41613,\"SV-204535r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the ftruncate syscall.\",\"RHEL-07-030550\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yz9ySMXJdb86u8eDi3onAaj+kp672EFyUXztQ5ZavCQ=\"},\"C-4660r88800_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ymhy4VaIZ29+cduBZAwVKhyxZg169tdaJfCPbSkNg34=\"},\"F-4660r88801_fix\",\"V-204536\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41614,\"SV-204536r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the semanage command.\",\"RHEL-07-030560\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:H82QTLuiCWDcZMXUpQQdTEKNJvGkX6x49d2pDZHpYyU=\"},\"C-4661r88803_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CXZ3wbxKuyfW7Hc7A2xWF2jcCkvrJDk5n4MpKx7Jh9Y=\"},\"F-4661r88804_fix\",\"V-204537\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41615,\"SV-204537r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the setsebool command.\",\"RHEL-07-030570\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ERmkPloadjyA5EWZSqAGmmsmSh9yhFCpxtM/g7u2MVY=\"},\"C-4662r88806_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:hsy8XmPVJmQFKltnYTmWxXXQKPpivHC8PhsbYMru5+A=\"},\"F-4662r88807_fix\",\"V-204538\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41616,\"SV-204538r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chcon command.\",\"RHEL-07-030580\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yWWSgcAdr7toWF3W2KVSsJEAivLZ/eCE17DkDnuxdnU=\"},\"C-4663r88809_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:H29Zf7IMzj0c2WDyCqJqraBoGasM7wdb72Tx2zKgjKg=\"},\"F-4663r88810_fix\",\"V-204539\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41617,\"SV-204539r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the setfiles command.\",\"RHEL-07-030590\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YXNsFsD1BNTH+UuPUScRJc2/DURz1Fj+3uIcvrRMNdg=\"},\"C-4664r88812_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wKbglrH2LXUYH8odc79kGiaqkdnpz/Ngn/mBGCvfPwM=\"},\"F-4664r88813_fix\",\"V-204540\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41618,\"SV-204540r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all unsuccessful account access events.\",\"RHEL-07-030610\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lJjp0a4I1yjr202W8rakaUjmlWknnhRtwWTbPOgaIB8=\"},\"C-4665r88815_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0mQC9d5eP+LU7s5b1OUMtNKAKQvhAb4VH4Nki+oZvQ4=\"},\"F-4665r88816_fix\",\"V-204541\",\"medium\",\"SRG-OS-000392-GPOS-00172\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41619,\"SV-204541r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all successful account access events.\",\"RHEL-07-030620\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2qmfNcP9ypf8f5/1I1ZWKnvrnO4JwwU1bWjsI78D6KE=\"},\"C-4666r88818_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:j23KNnfT4y4Q+T3/PLJIu9AcgBC+3v1oNGcCzWq9JYc=\"},\"F-4666r88819_fix\",\"V-204542\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41620,\"SV-204542r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the passwd command.\",\"RHEL-07-030630\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gya/2JPlteqFjlFszdxnLFZfGW3EV7vQah2z8gDWTmo=\"},\"C-4667r88821_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KY2hZNWLmBuQzt6IyL5juMxrVmftwMn4HlQ1jU6oLQQ=\"},\"F-4667r88822_fix\",\"V-204543\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41621,\"SV-204543r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the unix_chkpwd command.\",\"RHEL-07-030640\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gi8ZMeceL+SSmRb14wgW06ZvRE7tuolGOXprwyUf+k0=\"},\"C-4668r88824_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:xrqKVwPbs5aekaA17oyUETQ7stRF/qHmet1N2+lY7jU=\"},\"F-4668r88825_fix\",\"V-204544\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41622,\"SV-204544r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the gpasswd command.\",\"RHEL-07-030650\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9sL5nx6+vlT67EKHKU4R5qqJ5n3moOZWw1AikH8pTXk=\"},\"C-4669r88827_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kcjN8hHDyHYyzY66Xm/orQ/6+t3DXU2t/6Mr4aeNajU=\"},\"F-4669r88828_fix\",\"V-204545\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41623,\"SV-204545r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chage command.\",\"RHEL-07-030660\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gqtgtLcu9IdW8tgI/Z/PEk9biRBlGBOHv5LMDpPdpL4=\"},\"C-4670r88830_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QLNijN+/ktoVMtSf8FWijh8WKQU1DpxKnvsPs9TYHoo=\"},\"F-4670r88831_fix\",\"V-204546\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41624,\"SV-204546r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the userhelper command.\",\"RHEL-07-030670\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Yez5vz3QxFhKWn3gCF8yxjW5wBeRRzXNuSoPn6GIO0s=\"},\"C-4671r88833_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:thytcFLh5cIHZuy2u4BfgOSALBemyZQ6F5s/ne6qOzo=\"},\"F-4671r88834_fix\",\"V-204547\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41625,\"SV-204547r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the su command.\",\"RHEL-07-030680\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hC1vcQxqT0u80KTFQPLu/SIk7krmukM+EtUTAUW4Q4A=\"},\"C-4672r88836_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:p4OzTKKgjGDSV/pUdpE/hubQn9MK/F9MZ2hD2sQz0WM=\"},\"F-4672r88837_fix\",\"V-204548\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41626,\"SV-204548r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the sudo command.\",\"RHEL-07-030690\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sTsM/uo7uY/03QywYVZf+XXWwPePPwd6hv1n+aUTiXo=\"},\"C-4673r88839_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qLVnnaX3JtzfwaSqYQolunAg9vfuILgBOx5TwS9/CBI=\"},\"F-4673r88840_fix\",\"V-204549\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41627,\"SV-204549r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.\",\"RHEL-07-030700\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tU3v9z4QSrPw6soKYZKEo2o/9C6DfQXE4mmzVlVGsw8=\"},\"C-4674r88842_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:taMxKHlvcSHa5MrWHLREp57+jZB7dbnWuVFkd/HqAtY=\"},\"F-4674r88843_fix\",\"V-204550\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41628,\"SV-204550r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the newgrp command.\",\"RHEL-07-030710\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:C0RoeHp6aYd9h/bi32FTCOUFtJwNd9lElDmsQIq+wF4=\"},\"C-4675r88845_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2jUfmU4AEu8hT4NZW9E/7rjdUjRflMUEFfPgxFUXZVU=\"},\"F-4675r88846_fix\",\"V-204551\",\"medium\",\"SRG-OS-000037-GPOS-00015\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41629,\"SV-204551r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the chsh command.\",\"RHEL-07-030720\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pafqBQ37fC9z4g2ywAqLpjl+XAFqcgxwjjyxs/Verx4=\"},\"C-4676r88848_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cLxeUP3mZ1M9jzX8TTPjs0vy6QD75+qQtPlaSAgSQiw=\"},\"F-4676r88849_fix\",\"V-204552\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41630,\"SV-204552r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the mount command and syscall.\",\"RHEL-07-030740\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged mount commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:caNUlUAL0QTWs82AAVnnqegh0qk/ScQg+zi9M6mXN3Q=\"},\"C-4677r88851_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Zy0AlQ/AK9jrYk7YF0IxUlXJhlHPbVzCfRh1hkQFab4=\"},\"F-4677r88852_fix\",\"V-204553\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41631,\"SV-204553r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the umount command.\",\"RHEL-07-030750\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged mount commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FS0w5y0Nv2J8GgXgjl0+kwNnGa1SOyKNV0kAzuc0Lhc=\"},\"C-4678r88854_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Yn3YWTHi6QKZmIAKqFQXHjUm9ZMaG4AYKwOihst12sU=\"},\"F-4678r88855_fix\",\"V-204554\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41632,\"SV-204554r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the postdrop command.\",\"RHEL-07-030760\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dqcxu/FPpiMQY4drQDT3SVl/Op48vP4lYINaQ/7qycE=\"},\"C-4679r88857_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:L5sMqlW6oTeIfAOPicSMgQJzP1frnBRoZo1ULE8ms5Q=\"},\"F-4679r88858_fix\",\"V-204555\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41633,\"SV-204555r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the postqueue command.\",\"RHEL-07-030770\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mDysNGysefS+eTvNiUFriD9n8ubTJ8X27LObMHof9qM=\"},\"C-4680r88860_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:mnbgP41kF+eQDWC3XJbpprjbfNG3To5n7QMtd2b3zDU=\"},\"F-4680r88861_fix\",\"V-204556\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41634,\"SV-204556r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the ssh-keysign command.\",\"RHEL-07-030780\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged ssh commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rEz96y1do/MI6pN7zRcF7HR19einFw1A4ikBHs19nzQ=\"},\"C-4681r88863_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/BAQvnDiTkOcDy7+7rcXBio88IJFaCJV+rp937iHZCo=\"},\"F-4681r88864_fix\",\"V-204557\",\"medium\",\"SRG-OS-000042-GPOS-00020\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41635,\"SV-204557r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the crontab command.\",\"RHEL-07-030800\",\"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\\n\\nAt a minimum, the organization must audit the full-text recording of privileged commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\\n\\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ady1u6dO6xtC3UnQhdVbuDv992JbS9UEl9bHXFlDfeU=\"},\"C-4682r88866_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tepGwcttTXBlSxRZeiYWKPNpqYhqMyY67Pq5SGyx9UY=\"},\"F-4682r88867_fix\",\"V-204558\",\"medium\",\"SRG-OS-000471-GPOS-00215\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41636,\"SV-204558r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the pam_timestamp_check command.\",\"RHEL-07-030810\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ktrDKQOFniBjtBla/5sCoFWD4QpBziBp6d3yNj4wSxc=\"},\"C-4683r88869_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NhupFdh9BrfCnk+UCoM9U5iNxBlErlgobWDBG3cY7+0=\"},\"F-4683r88870_fix\",\"V-204559\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41637,\"SV-204559r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the create_module syscall.\",\"RHEL-07-030819\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FKYTZs9Omb9gpZvDDN+VFtmbOEANwAA79jfnk0fdo+4=\"},\"C-4684r88872_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:iyYMEQ9NY1jsBg8aYvinfh87kCf0fxDIHYE5F5wvjD8=\"},\"F-4684r88873_fix\",\"V-204560\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41638,\"SV-204560r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the init_module syscall.\",\"RHEL-07-030820\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DJ473QpyrOIOL4YWEvv/UhC/pdcGoEXF+NICnIw8kXE=\"},\"C-4685r88875_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YO20sjKaSgwWzo5K5zpbLlsrBJRARNcRaQ/WCvAqqPw=\"},\"F-4685r88876_fix\",\"V-204561\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41639,\"SV-204561r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the finit_module syscall.\",\"RHEL-07-030821\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yaISAkFMNlE1gd40ss3E4raZaPutmNF5nUPZxy/dVxE=\"},\"C-4686r88878_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gukXW2K0LmzgeHJsVdPKWm0Dnc8XLdjMo47vFIReIm0=\"},\"F-4686r88879_fix\",\"V-204562\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41640,\"SV-204562r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the delete_module syscall.\",\"RHEL-07-030830\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oBDs5Z67EFgAVh+xQ4UWmvl8l68JaD3MlIWHxZV7Ivg=\"},\"C-4687r88881_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qYL963ACq1nVDqG81Nhwogvxn4pCVk5zYGa6U82IWPo=\"},\"F-4687r88882_fix\",\"V-204563\",\"medium\",\"SRG-OS-000471-GPOS-00216\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41641,\"SV-204563r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the kmod command.\",\"RHEL-07-030840\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yo+7DvmHZV8hyRCSWad1ZfWbs115vSFezvQEM11an2w=\"},\"C-4688r88884_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:DrLGYbRrLcqkaFlvsUgsi805zP8GM1q0BhY+8TbEB80=\"},\"F-4688r88885_fix\",\"V-204564\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41642,\"SV-204564r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.\",\"RHEL-07-030870\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nSatisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XCeo82R8xQFLoiWbWwslLhkjyDvBriCPlnTPaVCU0O0=\"},\"C-4689r88887_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:iTfdgBwwZUc5xUl78eUFlJ7r99OVpSSYuyt0c9t1ylw=\"},\"F-4689r88888_fix\",\"V-204565\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41643,\"SV-204565r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.\",\"RHEL-07-030871\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mregkcdfFGH6lVk6ARZub4pIX77ZBmx54DG508a9aww=\"},\"C-4690r88890_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:SzNb0MZd7tDXe9zrz9tBQl9AKYU9vxCoW/YZ+j5Z2D8=\"},\"F-4690r88891_fix\",\"V-204566\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41644,\"SV-204566r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.\",\"RHEL-07-030872\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lXRvTRQWN34A1q+mXN0yVv2AZrR0vT3Ts/aM1h5LkOo=\"},\"C-4691r88893_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YuxlbzicCJTuUCw8UKAD2dfrvHtiLclVxDfcu6yBHkA=\"},\"F-4691r88894_fix\",\"V-204567\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41645,\"SV-204567r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.\",\"RHEL-07-030873\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:688w5yaOgi6yS2MMu0BXElzK0Nc1j4e7a91fW45De2A=\"},\"C-4692r88896_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:9wbu2UEQZg5W0c5/58K+CG9s0WnYuEVRf2xHahsYjn4=\"},\"F-4692r88897_fix\",\"V-204568\",\"medium\",\"SRG-OS-000004-GPOS-00004\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41646,\"SV-204568r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.\",\"RHEL-07-030874\",\"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\\n\\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:umcgNuAsnB59XSjy1I6U++dXqM23CWYChhlv86x8Xuw=\"},\"C-4693r88899_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:w4c+iD078TSfI/nVvVGCuK9E5rXnbgH3VaanYWKniTg=\"},\"F-4693r88900_fix\",\"V-204569\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41647,\"SV-204569r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the rename syscall.\",\"RHEL-07-030880\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mE0MJl83yHmgx0kwKQuKZgNSsnJD2tRsSDRy+kJVHUo=\"},\"C-4694r88902_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:MqMWdx8HoJFr5CPVtrttoFouIYkzuaAu0iZSsT0BuvE=\"},\"F-4694r88903_fix\",\"V-204570\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41648,\"SV-204570r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the renameat syscall.\",\"RHEL-07-030890\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SvB0fmN1dM3PsEjEvg5vyZ0zWzSJPOTnbJAICsSPMMU=\"},\"C-4695r88905_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JIX2VnlSvH0MpceK8GMELEnC5U1Vb81fXOVkFOJh0TE=\"},\"F-4695r88906_fix\",\"V-204571\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41649,\"SV-204571r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the rmdir syscall.\",\"RHEL-07-030900\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DS0Fydb5T+qrwtZc8yHRMbt0kZVQKXZvEJkk2pfaoa0=\"},\"C-4696r88908_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:k6ETZYpiAtsCcl8sbY0lyjEPIpX1437rhb9RcZo7Ii4=\"},\"F-4696r88909_fix\",\"V-204572\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41650,\"SV-204572r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the unlink syscall.\",\"RHEL-07-030910\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gQjaLKPqvRmJxPutSuCF2raYWv3G7pqqkl4RYi2CQjI=\"},\"C-4697r88911_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fvZmzi/j1WxOacjuN66vVRNeVl+kmTNB5n2eXA4RUmA=\"},\"F-4697r88912_fix\",\"V-204573\",\"medium\",\"SRG-OS-000466-GPOS-00210\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41651,\"SV-204573r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must audit all uses of the unlinkat syscall.\",\"RHEL-07-030920\",\"If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\\n\\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:189mZdbWFnTmb/pv12S5jXM09zjsiaBRlTlxaxSpVrA=\"},\"C-4698r88914_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KazPPixn9iBMTwVpaMRQK8IKHGzNe7t2JaJgXt03JSs=\"},\"F-4698r88915_fix\",\"V-204574\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41652,\"SV-204574r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must send rsyslog output to a log aggregation server.\",\"RHEL-07-031000\",\"Sending rsyslog output to another system ensures that the logs cannot be removed or modified in the event that the system is compromised or has a hardware failure.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MwPcFaS7XSTh86tBjhVDJe6I76OH8QTJFy8ThExOTCg=\"},\"C-4699r88917_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pVmbVwyfPytRATXlXvn+p76ybxM6O3oBPglyqw8yf4s=\"},\"F-4699r88918_fix\",\"V-204575\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41653,\"SV-204575r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.\",\"RHEL-07-031010\",\"Unintentionally running a rsyslog server accepting remote messages puts the system at increased risk. Malicious rsyslog messages sent to the server could exploit vulnerabilities in the server software itself, could introduce misleading information in to the system's logs, or could fill the system's storage leading to a Denial of Service.\\n\\nIf the system is intended to be a log aggregation server its use must be documented with the ISSO.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DhilIZI4XItLrdeaFbC8ICZgBN1OCgHuPfD1k8e78sc=\"},\"C-4700r88920_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tuh0npx6WnyQC2URDIxyB9urDMEvi0gcwpWFR4v0veU=\"},\"F-4700r88921_fix\",\"V-204576\",\"low\",\"SRG-OS-000027-GPOS-00008\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41654,\"SV-204576r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must limit the number of concurrent sessions to 10 for all accounts and/or account types.\",\"RHEL-07-040000\",\"Operating system management includes the ability to control the number of users and user sessions that utilize an operating system. Limiting the number of allowed users and sessions per user is helpful in reducing the risks related to DoS attacks.\\n\\nThis requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based on mission needs and the operational environment for each system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:O1hlu7Cy9bkTgUpdl/8swEZmVqrdSxecwRgqIv7TKeI=\"},\"C-4701r88923_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8Ow3JzDo50tPnuuLfgcdLIb5/F/dXCIIRBWsKvJeWWk=\"},\"F-4701r88924_fix\",\"V-204577\",\"medium\",\"SRG-OS-000096-GPOS-00050\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41655,\"SV-204577r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA) an\",\"RHEL-07-040100\",\"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\\n\\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component.\\n\\nTo support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.\\n\\nSatisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JDnnCT7i6KXIu1+6ypsCHBmdw6EQtsr4dSd3kFFR2B4=\"},\"C-4702r88926_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C9wtDic6D6IxHIwpBEoADN3UNF1n/zkJ4DO1Rmx3sR8=\"},\"F-4702r88927_fix\",\"V-204578\",\"medium\",\"SRG-OS-000033-GPOS-00014\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41656,\"SV-204578r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must use a FIPS 140-2 approved cryptographic algorithm for SSH communications.\",\"RHEL-07-040110\",\"Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised.\\n\\nOperating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules.\\n\\nFIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system.\\n\\nSatisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YGctoNEqGYp37D0V7f4JEnaQwZUWRJ16N85m3V1dTA4=\"},\"C-4703r88929_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:7V/YZskuZIFMWUmgA0F+WowCfC79F3qEk3hNicn9Juc=\"},\"F-4703r88930_fix\",\"V-204579\",\"medium\",\"SRG-OS-000163-GPOS-00072\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41657,\"SV-204579r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all network connections associated with a communication session are terminated at the end of the session or after 10 minutes of inactivity from the user at a command prompt, except t\",\"RHEL-07-040160\",\"Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element. \\n\\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kPgd3nZYx8oNc7jNrMPf7SaMkgI7Mpqc+C0Gesho7w0=\"},\"C-4704r88932_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CbJrOqZc9aUjytjiQipH2FQttO6A0xmJSPRZ2xNAGKQ=\"},\"F-4704r88933_fix\",\"V-204580\",\"medium\",\"SRG-OS-000023-GPOS-00006\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41658,\"SV-204580r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner immediately prior to, or as part of, remote access logon prompts.\",\"RHEL-07-040170\",\"Display of a standardized and approved use notification before granting access to the publicly accessible operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007 , SRG-OS-000228-GPOS-00088\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gICjVQBlC2CyjSEDRHoAr3hm79aABc0TAYCd4cyGREM=\"},\"C-4705r88935_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Ze0CDAPHd/Z+DRoWsy7rlbe1B/FAjmxymeuyFUVxLGU=\"},\"F-4705r88936_fix\",\"V-204581\",\"medium\",\"SRG-OS-000250-GPOS-00093\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41659,\"SV-204581r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications.\",\"RHEL-07-040180\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IgR19ArnuG58zoGRs25ETsbszS2t2pU66+rmh1ALJZg=\"},\"C-4706r88938_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:67sjwMBDYQYyIYP5nO6e9SccjTN96sfDcHNkmpYO6W0=\"},\"F-4706r88939_fix\",\"V-204582\",\"medium\",\"SRG-OS-000250-GPOS-00093\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41660,\"SV-204582r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.\",\"RHEL-07-040190\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7XIsGNddY755GhU000GYrT04RXf5RlJxt9a8QpJOgWM=\"},\"C-4707r88941_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aDzdhKgdToIxgIHOdlmP6tQ+bOd58icfm4R3mYwxebk=\"},\"F-4707r88942_fix\",\"V-204583\",\"medium\",\"SRG-OS-000250-GPOS-00093\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41661,\"SV-204583r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.\",\"RHEL-07-040200\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zNpBjI7gKD5CGJeHa0TgLmFXquRzktJOpNM1MitUcYA=\"},\"C-4708r88944_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QzcqROrmTjc9BOoYr4nEK3uqGdgRV8SuOfDsOICf/ko=\"},\"F-4708r88945_fix\",\"V-204584\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41662,\"SV-204584r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement virtual address space randomization.\",\"RHEL-07-040201\",\"Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code he or she has introduced into a process's address space during an attempt at exploitation. Additionally, ASLR also makes it more difficult for an attacker to know the location of existing code in order to repurpose it using return-oriented programming (ROP) techniques.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tu8dUs1zi+TVniquX91HB2mrznXWiYevRt36mw4oUc0=\"},\"C-4709r88947_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OeCoQ29Jes44dR6OzCMZZ1F/PQNZix/au38A40JM/Lw=\"},\"F-4709r88948_fix\",\"V-204585\",\"medium\",\"SRG-OS-000423-GPOS-00187\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41663,\"SV-204585r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all networked systems have SSH installed.\",\"RHEL-07-040300\",\"Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. \\n\\nThis requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. \\n\\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, logical means (cryptography) do not have to be employed, and vice versa.\\n\\nSatisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U0+kiCOWAxM37Dm2rN333KIvx6YqKjJfXh9Z8SO0Hw0=\"},\"C-4710r88950_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:rDZF521/oH8A2KYzjDsmXNuXcTWUxjr1+bnB8N78kog=\"},\"F-4710r88951_fix\",\"V-204586\",\"medium\",\"SRG-OS-000423-GPOS-00187\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41664,\"SV-204586r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all networked systems use SSH for confidentiality and integrity of transmitted and received information as well as information during preparation for transmission.\",\"RHEL-07-040310\",\"Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. \\n\\nThis requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. \\n\\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.\\n\\nSatisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000423-GPOS-00188, SRG-OS-000423-GPOS-00189, SRG-OS-000423-GPOS-00190\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dkh4lOXziNuIqVk4eaOVLxaMcoWI12sofxv7jKQaw+8=\"},\"C-4711r88953_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Q+ge+udsPuOSaneNaoRiP6qT0I7v5utOt7Yi+ZrWtSE=\"},\"F-4711r88954_fix\",\"V-204587\",\"medium\",\"SRG-OS-000163-GPOS-00072\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41665,\"SV-204587r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all network connections associated with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity, except to fulfill documented and validated mission req\",\"RHEL-07-040320\",\"Terminating an idle SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element.\\n\\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.\\n\\nSatisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KFrNyXlrwufl0fTSC2Xb2SJFGIHk5O3cfMQ8TP0OUcU=\"},\"C-4712r88956_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KCD2uLmWRsM8aj9IlQqXERBKxYqg3/WNWb6mZ9Dl1J4=\"},\"F-4712r88957_fix\",\"V-204588\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41666,\"SV-204588r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using RSA rhosts authentication.\",\"RHEL-07-040330\",\"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:s3HPGztH6jOvI74wiywU7WSmWcHTK8Aw+JzBeFJeV+o=\"},\"C-4713r88959_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:aRr6Q+KVIsrwZ81agKF3kJQ+D4tBZOI9I1ZsEqiMojk=\"},\"F-4713r88960_fix\",\"V-204589\",\"medium\",\"SRG-OS-000163-GPOS-00072\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41667,\"SV-204589r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all network connections associated with SSH traffic terminate after a period of inactivity.\",\"RHEL-07-040340\",\"Terminating an idle SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element.\\n\\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.\\n\\nSatisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4oJTyVwrO2R6TmqIF+bsE92/Eo5rArioW/qSFId8tfc=\"},\"C-4714r88962_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Z66CFYVnPNn7K3huS7XeWE1O5Vz7Og//viy4jwSZVH8=\"},\"F-4714r88963_fix\",\"V-204590\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41668,\"SV-204590r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using rhosts authentication.\",\"RHEL-07-040350\",\"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2znyQY3TQ9xKT6QoY0lQ8dx0S8AN67MOq5v/U8DLEh4=\"},\"C-4715r88965_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ydTBWcCVdqH9GwZPSxCb1+Mha35cyxZQZ+PtJTBBj/E=\"},\"F-4715r88966_fix\",\"V-204591\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41669,\"SV-204591r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must display the date and time of the last successful account logon upon an SSH logon.\",\"RHEL-07-040360\",\"Providing users with feedback on when account accesses via SSH last occurred facilitates user recognition and reporting of unauthorized account use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yX1X8uJ+vqpiTI1YneKPRT+wM/BMopO1gSTrMWwXbLY=\"},\"C-4716r88968_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:JJ5Ox1vSig/SsGTtHJKKVEa5/xuzhEH/+pAXuYqInTQ=\"},\"F-4716r88969_fix\",\"V-204592\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41670,\"SV-204592r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not permit direct logons to the root account using remote access via SSH.\",\"RHEL-07-040370\",\"Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging on directly as root. In addition, logging on with a user-specific account provides individual accountability of actions performed on the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XefiLkI57brJK6zs5DReGOyqdxXR/FR0JRYBWt4XivE=\"},\"C-4717r88971_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jCt7XP2/joML7K4rmp5RRkBW4Ghsyim2Haa5MjMDry4=\"},\"F-4717r88972_fix\",\"V-204593\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41671,\"SV-204593r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using known hosts authentication.\",\"RHEL-07-040380\",\"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0dqZel9WfGVpxO6OVdTQca14awO4upKlmd0SHcwofA8=\"},\"C-4718r88974_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:e1QPacknVGwhQrTRKO9ch3+12rJP4nUsDzOeg2RKrEY=\"},\"F-4718r88975_fix\",\"V-204594\",\"high\",\"SRG-OS-000074-GPOS-00042\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41672,\"SV-204594r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use the SSHv2 protocol.\",\"RHEL-07-040390\",\"SSHv1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system.\\n\\nSatisfies: SRG-OS-000074-GPOS-00042, SRG-OS-000480-GPOS-00227\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xTLJjvdq15UZDw8G16bCt7+I8XiP/RxZCLmJQpOTmC0=\"},\"C-4719r88977_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:usvEwYL9OkEILqrk7anH3bP3g4cqO6Ot64CCfaWLB20=\"},\"F-4719r88978_fix\",\"V-204595\",\"medium\",\"SRG-OS-000250-GPOS-00093\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41673,\"SV-204595r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.\",\"RHEL-07-040400\",\"DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions. The only SSHv2 hash algorithm meeting this requirement is SHA.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZrwBro/CqOpHuLOT920+WMMOrhs4KR7xtuVSg83ADyY=\"},\"C-4720r88980_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:dU8FWoZwp7g+jY/DWHe5T7TwjzaY/5wKrRaYlRza5Ig=\"},\"F-4720r88981_fix\",\"V-204596\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41674,\"SV-204596r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH public host key files have mode 0644 or less permissive.\",\"RHEL-07-040410\",\"If a public host key file is modified by an unauthorized user, the SSH service may be compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h0blgpw29xSnpbeqXLAlK16DNURlD9WDnqL8KrTVoVg=\"},\"C-4721r88983_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ZD8sBCF6rqsIMhMVh7zuafBe82s55AJKOiZVo44+sNA=\"},\"F-4721r88984_fix\",\"V-204597\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41675,\"SV-204597r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH private host key files have mode 0640 or less permissive.\",\"RHEL-07-040420\",\"If an unauthorized user obtains the private SSH host key file, the host could be impersonated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LuF6kqpOF9eNjNyaM7lVHX3f2Ce7dRDM7eZK2TV8w6Q=\"},\"C-4722r88986_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:eS00OlwHK5cCVIs4PslmH3lcsroembapbUdNCYZMVHs=\"},\"F-4722r88987_fix\",\"V-204598\",\"medium\",\"SRG-OS-000364-GPOS-00151\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41676,\"SV-204598r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.\",\"RHEL-07-040430\",\"GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:95XKdYxzx1qHEALj0vVcUgfFdzE+HDbKJn+kj2tRtCY=\"},\"C-4723r88989_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:q8f6Jmtw61OMK7wrwD6lUOd8HB4HcM3fOlMH3PkuZgg=\"},\"F-4723r88990_fix\",\"V-204599\",\"medium\",\"SRG-OS-000364-GPOS-00151\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41677,\"SV-204599r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed.\",\"RHEL-07-040440\",\"Kerberos authentication for SSH is often implemented using Generic Security Service Application Program Interface (GSSAPI). If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementation may then be subject to exploitation. To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be disabled for systems not using this capability.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XRT3D2vqhfiWwUMNKp1iT0NPdaECtsiOv+PkO9tvPIQ=\"},\"C-4724r88992_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jQUn3D+sFRAlgnGUSH9cqqjkv9PoNyIrXnrGPGcEv5k=\"},\"F-4724r88993_fix\",\"V-204600\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41678,\"SV-204600r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon performs strict mode checking of home directory configuration files.\",\"RHEL-07-040450\",\"If other users have access to modify user-specific SSH configuration files, they may be able to log on to the system as another user.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uaQWPHqYSfcx2Hsbsz6oSx3/NvJ2S9ZZWyR1AaamE3c=\"},\"C-4725r88995_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zZpuieBctwldmi6eIcERNzoXGyEr3faLqs3fQtGyyVw=\"},\"F-4725r88996_fix\",\"V-204601\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41679,\"SV-204601r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon uses privilege separation.\",\"RHEL-07-040460\",\"SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would decrease the impact of software vulnerabilities in the unprivileged section.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZEDgUUGRtYwtdg/7IGePmM+mO77jBmQ2y6qQSJnzh88=\"},\"C-4726r88998_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KYaVM1r633+W0Wve0UtUbhlZczsFNuL7IEagI+ikd2I=\"},\"F-4726r88999_fix\",\"V-204602\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41680,\"SV-204602r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow compression or only allows compression after successful authentication.\",\"RHEL-07-040470\",\"If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vFy+LSYNEqK8q0jlqPSRN9R2KTNP4oH9DkTCn3+F6lU=\"},\"C-4727r89001_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:M/hOba2r0QaIPkgCW9PuPUW++WJrYiNkoxWDWBk0TpA=\"},\"F-4727r89002_fix\",\"V-204603\",\"medium\",\"SRG-OS-000355-GPOS-00143\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41681,\"SV-204603r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must, for networked systems, synchronize clocks with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, a time server designated for the appropriate DoD\",\"RHEL-07-040500\",\"Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.\\n\\nSynchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network.\\n\\nOrganizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints).\\n\\nSatisfies: SRG-OS-000355-GPOS-00143, SRG-OS-000356-GPOS-00144\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cXVgQoJtqPP16H6INhLNMDk5sX6o5q6ee0+MombCLUE=\"},\"C-4728r89004_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ZtOVMm1z0V1iMbun6RkRK9SwQrwqJLpq5eClGiG/Nk4=\"},\"F-4728r89005_fix\",\"V-204604\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41682,\"SV-204604r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must enable an application firewall, if available.\",\"RHEL-07-040520\",\"Firewalls protect computers from network attacks by blocking or limiting access to open network ports. Application firewalls limit which applications are allowed to communicate over the network.\\n\\nSatisfies: SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5AeStZQDNTFP8dyAN+kdFOwEHd7ujN7N8QOsth1BYFI=\"},\"C-4729r89007_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HVYPccbIpDKZ3GH14dxeoC/9Y07YDJ2ua3K1XD8mRwM=\"},\"F-4729r89008_fix\",\"V-204605\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41683,\"SV-204605r241939_rule\",\"low\",null,null,\"The Red Hat Enterprise Linux operating system must display the date and time of the last successful account logon upon logon.\",\"RHEL-07-040530\",\"Providing users with feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2MW4CbQWQSdnWTn+vJjAqUXxy39KvlIkThmnSy/UnmI=\"},\"C-4730r89010_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zG2ejNhnMKFBTuhN2Dwb6ws3PtZqpdwum63IT4dN2Do=\"},\"F-4730r89011_fix\",\"V-204606\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41684,\"SV-204606r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not contain .shosts files.\",\"RHEL-07-040540\",\"The .shosts files are used to configure host-based authentication for individual users or the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v4IA4z20DXRjhaVy+lPUHGEq1PKWrz2BRO+w5yuY2A4=\"},\"C-4731r89013_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:iAG2eQUIiF6iF8xBCRDdrpYX7SYLm6n7X1rzAuRhTyA=\"},\"F-4731r89014_fix\",\"V-204607\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41685,\"SV-204607r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not contain shosts.equiv files.\",\"RHEL-07-040550\",\"The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rZwRT3O4olP1cUbfaVWLtsV55GMO6FG1urqqL7Z5if0=\"},\"C-4732r89016_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oTf9BJoMwzWXGsPa9JPAVvuMhtDZFy83jaBTDB/KFpo=\"},\"F-4732r89017_fix\",\"V-204608\",\"low\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41686,\"SV-204608r241939_rule\",\"low\",null,null,\"For Red Hat Enterprise Linux operating systems using DNS resolution, at least two name servers must be configured.\",\"RHEL-07-040600\",\"To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eQBkLoCxbhLSL0FSX13w71XInyURAJYddveh0zcMYZs=\"},\"C-4733r89019_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:y+24JzwqotIYx7gqe5g6jITwUglOdhYm/qTYhNtdFZk=\"},\"F-4733r89020_fix\",\"V-204609\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41687,\"SV-204609r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets.\",\"RHEL-07-040610\",\"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FwLT66vNGmWrFses/sAjJSSaKxtlj7doQb3MZgBImX8=\"},\"C-4734r89022_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HO2PKACks+73FSunYYTdtPYisctn2lnasLL69QkZx4I=\"},\"F-4734r89023_fix\",\"V-204610\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41688,\"SV-204610r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces.\",\"RHEL-07-040611\",\"Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p1jUPBQZCsvZDLRRitg2VYMt2+J7ICQQdk58h8+Ceww=\"},\"C-4735r89025_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Gq/vTd0tjUvdnU5c0TxXUZhM6dJK0L6q1WsBW6Y6gPU=\"},\"F-4735r89026_fix\",\"V-204611\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41689,\"SV-204611r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when possible by default.\",\"RHEL-07-040612\",\"Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cG2bpeEieasuM4Qt7PgAX0WNy3Jg+IohvlZC3bDIxnk=\"},\"C-4736r89028_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NTL219/6bYDMTON9XSc9S9cWfktEkrQPTcTrRGmhtSc=\"},\"F-4736r89029_fix\",\"V-204612\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41690,\"SV-204612r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default.\",\"RHEL-07-040620\",\"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MRRtJ87d9codxHSiwiP6FQaDVF9nRZZKpZzZKdkt8tc=\"},\"C-4737r89031_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:85PUYBt8Wup7sfq95PhD6gnuL6/s7LBJQuexpMb9+KA=\"},\"F-4737r89032_fix\",\"V-204613\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41691,\"SV-204613r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not respond to Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.\",\"RHEL-07-040630\",\"Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8YTZ6fEoQgsCaCCADaJpdHZaoc+u9wlTzoxXW92DDXI=\"},\"C-4738r89034_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fjCX0oYjs4K4WUl6cdO3QKoRLCxTiAc8/80ZgMIjPqY=\"},\"F-4738r89035_fix\",\"V-204614\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41692,\"SV-204614r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted.\",\"RHEL-07-040640\",\"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/GqImo5AYk9oB6VesRt32EX9qhNxt0bsSwz/JfdpsTM=\"},\"C-4739r89037_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tWci+stkNSEw1rQydP4hqVP4Es8/V0uGvLQAjq4FXy0=\"},\"F-4739r89038_fix\",\"V-204615\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41693,\"SV-204615r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.\",\"RHEL-07-040641\",\"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rajjUFaPBiT4Sd2KHjdKE74EwKfpgWlkjrCk3HupPOg=\"},\"C-4740r89040_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tnpYW+PKr3HpfMAGcg1EJcUhn3xPz0d5BdCvz0h23oM=\"},\"F-4740r89041_fix\",\"V-204616\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41694,\"SV-204616r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not allow interfaces to perform Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects by default.\",\"RHEL-07-040650\",\"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly revealing portions of the network topology.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eI/kCnLWasuxYrqINFrqYvnYRusBETB3PyweSidvuS0=\"},\"C-4741r89043_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cBYZZiaWYKmFjEYKjwUnAbM7tZwSJVrfhYpOGfbhXdk=\"},\"F-4741r89044_fix\",\"V-204617\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41695,\"SV-204617r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects.\",\"RHEL-07-040660\",\"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly revealing portions of the network topology.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ehZyYb58GoVTgK7yVpGqpPJBA7NKrWkkjvGCe4/cHMw=\"},\"C-4742r89046_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:yhEK6NuW4WdRcxfcoTRtFQgiYsMbK57qrVfbNbfQZ9M=\"},\"F-4742r89047_fix\",\"V-204618\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41696,\"SV-204618r241939_rule\",\"medium\",null,null,\"Network interfaces configured on the Red Hat Enterprise Linux operating system must not be in promiscuous mode.\",\"RHEL-07-040670\",\"Network interfaces in promiscuous mode allow for the capture of all network traffic visible to the system. If unauthorized individuals can access these applications, it may allow then to collect information such as logon IDs, passwords, and key exchanges between systems.\\n\\nIf the system is being used to perform a network troubleshooting function, the use of these tools must be documented with the Information System Security Officer (ISSO) and restricted to only authorized personnel.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6FOjMjnPE6o/2RQfLIQ7oCu1NiuJoXu8ZloEh6aQnOc=\"},\"C-4743r89049_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:cyM0WmnGxvBXRRp0YFSiJZeW7vUye4blZdY444e0/no=\"},\"F-4743r89050_fix\",\"V-204619\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41697,\"SV-204619r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured to prevent unrestricted mail relaying.\",\"RHEL-07-040680\",\"If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay for the purpose of sending spam or other unauthorized activity.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GYLgPoC9dWO6EQnX8n402yDsuMPAnK9fUZjDeNJuVlQ=\"},\"C-4744r89052_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:RRWH8/X8wLuvfQSBfZasWwuL/5PBM9a/OsDIO6uaWzo=\"},\"F-4744r89053_fix\",\"V-204620\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41698,\"SV-204620r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have a File Transfer Protocol (FTP) server package installed unless needed.\",\"RHEL-07-040690\",\"The FTP service provides an unencrypted remote access that does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised. SSH or other encrypted file transfer methods must be used in place of this service.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bjTPHU4AZoK6BfgfQVubbfWkNDK50eujmcmoDTDukmw=\"},\"C-4745r89055_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:gFY0nCBxuLCZzgbZxxi0+UGWs4WK6U6lg0G4nGms8+c=\"},\"F-4745r89056_fix\",\"V-204621\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41699,\"SV-204621r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must not have the Trivial File Transfer Protocol (TFTP) server package installed if not required for operational support.\",\"RHEL-07-040700\",\"If TFTP is required for operational support (such as the transmission of router configurations) its use must be documented with the Information System Security Officer (ISSO), restricted to only authorized personnel, and have access control rules established.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N0HT3nvX0nacPF0nic2Fvo+QoxFewqWUvw8Cb2dpdyE=\"},\"C-4746r89058_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/ZanvCC0BUgOEU2xiMkMW8jn2JFseHUzGwkoLvPO7Ww=\"},\"F-4746r89059_fix\",\"V-204622\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41700,\"SV-204622r241939_rule\",\"high\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that remote X connections for interactive users are encrypted.\",\"RHEL-07-040710\",\"Open X displays allow an attacker to capture keystrokes and execute commands remotely.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BQENP4a828YEZSXVXQtFoPetmYEFb8+83NfUr43aZ74=\"},\"C-4747r89061_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oZYVTfOCZj0stqUz9kKUxX7h+6FupXnYdOdIzRnl0mU=\"},\"F-4747r89062_fix\",\"V-204623\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41701,\"SV-204623r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that if the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon is configured to operate in secure mode.\",\"RHEL-07-040720\",\"Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting system files.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nW951brbjAkAlDNfMZI++v9EZTA23qYKprHAkBSWFUY=\"},\"C-4748r89064_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:g8ZkdpWH96vEPFX5ESHd9ky+MZd0MVuZXesCggS6m34=\"},\"F-4748r89065_fix\",\"V-204624\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41702,\"SV-204624r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not have an X Windows display manager installed unless approved.\",\"RHEL-07-040730\",\"Internet services that are not required for system or application processes must not be active to decrease the attack surface of the system. X Windows has a long history of security vulnerabilities and will not be used unless approved and documented.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ng0nTd+F1YUu4CUZtk3DYlhWROBAoM4ie5InHAQthN4=\"},\"C-4749r89067_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QmMprBr2eZLDrQvdHB9GdZ86VNbOdUvsiMmqhIdbkqg=\"},\"F-4749r89068_fix\",\"V-204625\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41703,\"SV-204625r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not be performing packet forwarding unless the system is a router.\",\"RHEL-07-040740\",\"Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this software is used when not required, system network information may be unnecessarily transmitted across the network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MkXnVi+BfZNKD8HBi1BdRhBwQYqAqk37hdGW0wzHsBo=\"},\"C-4750r89070_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:j6VcelJRgVA4Y3z+Ne5pwBUGCh8q+WYi4U0tTn1l/pU=\"},\"F-4750r89071_fix\",\"V-204626\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41704,\"SV-204626r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.\",\"RHEL-07-040750\",\"When an NFS server is configured to use RPCSEC_SYS, a selected userid and groupid are used to handle requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The RPCSEC_GSS method of authentication uses certificates on the server and client systems to more securely authenticate the remote mount request.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LPkkcM3GKLloG2iIqGS//40g7fdb9hulnGjTO5OPl/c=\"},\"C-4751r89073_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:EaHp4BPOrxxdG+2wJpgynKF1UEZ8Z9HXXq1HwFQhoq4=\"},\"F-4751r89074_fix\",\"V-204627\",\"high\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41705,\"SV-204627r241939_rule\",\"high\",null,null,\"SNMP community strings on the Red Hat Enterprise Linux operating system must be changed from the default.\",\"RHEL-07-040800\",\"Whether active or not, default Simple Network Management Protocol (SNMP) community strings must be changed to maintain security. If the service is running with the default authenticators, anyone can gather data about the system and the network and use the information to potentially compromise the integrity of the system or network(s). It is highly recommended that SNMP version 3 user authentication and message encryption be used in place of the version 2 community strings.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aj2+q1FDm7tuIsdCJ6yjAVx2dNimOetQj7BToo/VlEg=\"},\"C-4752r89076_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/D2dqEXX4V/I16RqUkyCnszvssRqNUU7YHRl6wMHa/Y=\"},\"F-4752r89077_fix\",\"V-204628\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41706,\"SV-204628r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system access control program must be configured to grant or deny system access to specific hosts and services.\",\"RHEL-07-040810\",\"If the systems access control program is not configured with appropriate rules for allowing and denying access to system network resources, services may be accessible to unauthorized hosts.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kkwHgTSKsJctRdFnhk7oBugs+k0hSvrAHTNBODYlnRY=\"},\"C-4753r89079_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CJFIHGHu/Ahf1QpfA3b6XDDdhlwGDdNBStawu9T5tho=\"},\"F-4753r89080_fix\",\"V-204629\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41707,\"SV-204629r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not have unauthorized IP tunnels configured.\",\"RHEL-07-040820\",\"IP tunneling mechanisms can be used to bypass network filtering. If tunneling is required, it must be documented with the Information System Security Officer (ISSO).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A4M7YDCBxwn82FM8E2pYn9DdV8RWXiiwlGjESBKWFWc=\"},\"C-4754r89082_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tLQQARe7p90gWnNRXyllJC/m16NksdyCY9EyUOeRuHM=\"},\"F-4754r89083_fix\",\"V-204630\",\"medium\",\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41708,\"SV-204630r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must not forward IPv6 source-routed packets.\",\"RHEL-07-040830\",\"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:duPPEkYg4Z6hIj9Yd6lOp0gvtSraIDw+nJz6zxmFvqE=\"},\"C-4755r89085_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:YSqpQKIwhp2ZC1jrJSTdg7d4cJRA6Hbv++u8d3+ahfQ=\"},\"F-4755r89086_fix\",\"V-204631\",\"medium\",\"SRG-OS-000375-GPOS-00160\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41709,\"SV-204631r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must have the required packages for multifactor authentication installed.\",\"RHEL-07-041001\",\"Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\\n\\nA privileged account is defined as an information system account with authorizations of a privileged user.\\n\\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management).\\n\\nSatisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:C1LYFgaAqeuTh7Gtm38t3OcPVMq8CySBTILHzdSksbQ=\"},\"C-4756r89088_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:XDloiqHMj2ldT1rBcJmIwqmYeKadE4QFbz+ypjK1Xd8=\"},\"F-4756r89089_fix\",\"V-204632\",\"medium\",\"SRG-OS-000375-GPOS-00160\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41710,\"SV-204632r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement multifactor authentication for access to privileged accounts via pluggable authentication modules (PAM).\",\"RHEL-07-041002\",\"Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\\n\\nA privileged account is defined as an information system account with authorizations of a privileged user.\\n\\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management).\\n\\nSatisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:o86wCHVnLXklbvao4gX06PkNKLM2n2dr61EHb3iOGuE=\"},\"C-4757r89091_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C+smaI80UgLR6sPJuLau7SkZhyN+Yirf5Yht9/ba90A=\"},\"F-4757r89092_fix\",\"V-204633\",\"medium\",\"SRG-OS-000375-GPOS-00160\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41711,\"SV-204633r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must implement certificate status checking for PKI authentication.\",\"RHEL-07-041003\",\"Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\\n\\nA privileged account is defined as an information system account with authorizations of a privileged user.\\n\\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management).\\n\\nSatisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2hPpDflNaMEbweY8kZ9GeMsYvJyW3OYECrRyUBb7WFU=\"},\"C-4758r89094_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TQIFjLZmV+wLHWdHvzMcJFt32vRR6Kijwnw5xWu5MqY=\"},\"F-4758r89095_fix\",\"V-204634\",\"medium\",\"SRG-OS-000424-GPOS-00188\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41712,\"SV-204634r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must be configured so that all wireless network adapters are disabled.\",\"RHEL-07-041010\",\"The use of wireless networking can introduce many different attack vectors into the organization's network. Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to create a denial of service to valid network resources.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:iSqVW4RiHyBVvrAYsGNx9SrOT+nAF6gnNHhGSMv/OPg=\"},\"C-15999r192362_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:oOI5Mi24TV+g/qDOT1oyHshUdmQD3N1tU88YFY33XM8=\"},\"F-15997r192363_fix\",\"V-214799\",null,\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41713,\"SV-214799r241939_rule\",null,null,null,\"The Red Hat Enterprise Linux operating system must be configured so that the cryptographic hash of system files and commands matches vendor values.\",\"RHEL-07-010020\",\"Without cryptographic integrity protections, system command and files can be altered by unauthorized users without detection.\\n\\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pp7LtbhvevdAe+ue4EVnM1uccxy7pW3XZ+xC9xFfmNk=\"},\"C-16000r192365_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:EcCFM8f6faJ+Y2AqXcOa7IfRS6V57umK55VW3UkAc1A=\"},\"F-15998r192366_fix\",\"V-214800\",null,\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41714,\"SV-214800r241939_rule\",null,null,null,\"The Red Hat Enterprise Linux operating system must have a host-based intrusion detection tool installed.\",\"RHEL-07-020019\",\"Adding host-based intrusion detection tools can provide the capability to automatically take actions in response to malicious behavior, which can provide additional agility in reacting to network threats. These tools also often include a reporting capability to provide network awareness of the system, which may not otherwise exist in an organization's systems management regime.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9LhzdHuv/khleaS+BQu9ZlUcdjdohBUoq5bjuJZdhK8=\"},\"C-16001r192368_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:OcfCs3Q0wVovyUOOu9z0LWAjnT/FA3EL8ebXHSrlehs=\"},\"F-15999r192369_fix\",\"V-214801\",null,\"SRG-OS-000480-GPOS-00227\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41715,\"SV-214801r241939_rule\",null,null,null,\"The Red Hat Enterprise Linux operating system must use a virus scan program.\",\"RHEL-07-032000\",\"Virus scanning software can be used to protect a system from penetration from computer viruses and to limit their spread through intermediate systems.  \\n\\nThe virus scanning software should be configured to perform scans dynamically on accessed files. If this capability is not available, the system must be configured to scan, at a minimum, all altered files on the system on a daily basis.\\n\\nIf the system processes inbound SMTP mail, the virus scanner must be configured to scan all received mail.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:M7pACkppJDi/CsMl2CmLoXQL4s2zAFRVxqwbrcNQ3+k=\"},\"C-16137r193200_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:2Gkgp8uVI1bLYW6K55h7LR8klUBCa5UWZ6TUZAdA86Y=\"},\"F-16135r193201_fix\",\"V-214937\",\"medium\",\"SRG-OS-000029-GPOS-00010\",null,null,null,null,null,\"RHEL_7_STIG_TEST-3-0.3\",41716,\"SV-214937r241939_rule\",\"medium\",null,null,\"The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.\",\"RHEL-07-010062\",\"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.\\n\\nThe session lock is implemented at the point where session activity can be determined.\\n\\nThe ability to enable/disable a session lock is given to the user by default. Disabling the user’s ability to disengage the graphical user interface session lock provides the assurance that all sessions will lock after the specified period of time.\\n\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41719,\"SV-106179r1_rule\",\"medium\",null,null,\"The VPN Gateway must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:slm2UFIqnUUPyOpfIcsxSew4LGvsTesU9C6Ju5XJ3mw=\"},\"C-95879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fgzhbaQbILFSeEwIwlOogRZtoeuNS7Kr0AHwx84IKLg=\"},\"F-102723r1_fix\",\"V-97043\",\"medium\",\"SRG-NET-000041-VPN-000110\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41720,\"SV-106181r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.\",\"SRG-NET-000041-VPN-000110\",\"Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n \\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jc6QW12gqdTKEPqvls4bilVyDJExcCoSskTVyO0VtC8=\"},\"C-95881r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QOTNmZJgq99GtXVEhYObEaDdxa5uT73FDkpBccGCe5Q=\"},\"F-102725r1_fix\",\"V-97045\",\"medium\",\"SRG-NET-000042-VPN-000120\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41721,\"SV-106183r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must enforce a policy to retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.\",\"SRG-NET-000042-VPN-000120\",\"The banner must be acknowledged by the user prior to allowing the user access to the network. This provides assurance that the user has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the user, DoD will not be in compliance with system use notifications required by law. \\n\\nThe banner is usually configured in NDM for client presentation as well as local logon.\\n\\nTo establish acceptance of the application usage policy, a click-through banner at application logon is required. The VPN gateway must prevent further activity until the user executes a positive action to manifest agreement by clicking on a box indicating \\\"OK\\\". \\n\\nThis applies to gateways that have the concept of a user account and have the login function residing on the gateway or the gateway acts as a user intermediary.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4cT/S3JRnRG1/bjkxCCl0FvJ2jFBPQxR6xd/ho3iPwU=\"},\"C-95883r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zvj+8RueEc8AGER4mc5vsA+JPLux2r9T3RERyvr6GqU=\"},\"F-102727r1_fix\",\"V-97047\",\"medium\",\"SRG-NET-000043-VPN-000130\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41722,\"SV-106185r1_rule\",\"medium\",null,null,\"The publicly accessible VPN Gateway must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\",\"SRG-NET-000043-VPN-000130\",\"Display of a standardized and approved use notification before granting access to the publicly accessible VPN gateway ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with DTM-08-060. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n\\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IdemsTDQGwPd7bokQxIIvpGCFpuH2a0LMkx43UGqWUA=\"},\"C-95885r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zwSBwQLPqjyi/Vwm1CxWQnlXRWyZZB59z9HGXUELgyQ=\"},\"F-102729r1_fix\",\"V-97049\",\"low\",\"SRG-NET-000049-VPN-000150\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41723,\"SV-106187r1_rule\",\"low\",null,null,\"The VPN Gateway must notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access).\",\"SRG-NET-000049-VPN-000150\",\"Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the number of unsuccessful attempts that were made to login to their account allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators.\\n\\nThis applies to gateways that have the concept of a user account and have the login function residing on the gateway or the gateway acts as a user intermediary.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aVWTWelue2vPX4PPQhsVdenoG0JoZrePs1txZu8Tn9w=\"},\"C-95887r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Bxnvb6aexynxn1Y2nmdyofyqfjFnX0xOt15KQeL53to=\"},\"F-102731r1_fix\",\"V-97051\",\"medium\",\"SRG-NET-000053-VPN-000170\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41724,\"SV-106189r1_rule\",\"medium\",null,null,\"The VPN Gateway must limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number.\",\"SRG-NET-000053-VPN-000170\",\"VPN gateway management includes the ability to control the number of users and user sessions that utilize a VPN gateway. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to DoS attacks.\\n\\nThis requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.\\n\\nThe intent of this policy is to ensure the number of concurrent sessions is deliberately set to a number based on the site's mission and not left unlimited.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CyTJHLIKQ2Ojkg9rwcZ3x7T66VHLzHB54n+nmQfac2E=\"},\"C-95889r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:H+ZsJRqo1BYEq9Wumb38YWMb+3wdolcYgDCbwGXeDJo=\"},\"F-102733r1_fix\",\"V-97053\",\"high\",\"SRG-NET-000062-VPN-000200\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41725,\"SV-106191r1_rule\",\"high\",null,null,\"The TLS VPN Gateway must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during transmission.\",\"SRG-NET-000062-VPN-000200\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nNIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b0U2i/2oFdeOwmGlTBap86LUQ1gHdfQ3eL4us+64fpw=\"},\"C-95891r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:J8KVE+KgBfuYvKemq7ovYBGF4IuGwoDzawSXyCaOyAQ=\"},\"F-102735r1_fix\",\"V-97055\",\"medium\",\"SRG-NET-000063-VPN-000210\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41726,\"SV-106193r1_rule\",\"medium\",null,null,\"The remote access VPN Gateway must use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.\",\"SRG-NET-000063-VPN-000210\",\"Without integrity protection, unauthorized changes may be made to the log files and reliable forensic analysis and discovery of the source of malicious system activity may be degraded.\\n\\nRemote access (e.g., RDP) is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless.\\n\\nIntegrity checks include cryptographic checksums, digital signatures, or hash functions. Federal Information Processing Standard (FIPS) 186-4, Digital Signature Standard (DSS), specifies three NIST-approved algorithms: DSA, RSA, and ECDSA. All three are used to generate and verify digital signatures in conjunction with an approved hash function.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v3WpQRoQigeTzLi65BYsrw9t+ZEEROlTq1kxXFTTLlc=\"},\"C-95893r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0D+opAzf5nzDclgwdIOkAD6j3JJiMTsVJtgVtp12Gss=\"},\"F-102737r1_fix\",\"V-97057\",\"medium\",\"SRG-NET-000063-VPN-000220\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41727,\"SV-106195r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.\",\"SRG-NET-000063-VPN-000220\",\"Without strong cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThe remote access VPN provides access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+B3+7JmTL1p1pvXgkAa8wGoCkVHYXHjICDWeklY1MTk=\"},\"C-95895r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:M9780XhNnUX+zVJLNXdHbTc95ro/kqEEj3UK2rL6hHI=\"},\"F-102739r1_fix\",\"V-97059\",\"high\",\"SRG-NET-000074-VPN-000250\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41728,\"SV-106197r1_rule\",\"high\",null,null,\"The IPsec VPN must implement a FIPS 140-2 validated Diffie-Hellman (DH) group.\",\"SRG-NET-000074-VPN-000250\",\"Use of an approved DH algorithm ensures the Internet Key Exchange (IKE) (phase 1) proposal uses FIPS-validated key management techniques and processes in the production, storage, and control of private/secret cryptographic keys. The security of the DH key exchange is based on the difficulty of solving the discrete logarithm in which the key was derived from. Hence, the larger the modulus, the more secure the generated key is considered to be.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YlctilOwQ2MBW7zoqYuhAoiJN5c5NYVKUMH7L8KW2VE=\"},\"C-95899r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:13l80RWe85t3TbQcxGDY1TeqhIv8oq9LWDSwKSmwv2c=\"},\"F-102743r1_fix\",\"V-97061\",\"low\",\"SRG-NET-000077-VPN-000280\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41729,\"SV-106199r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish what type of events occurred.\",\"SRG-NET-000077-VPN-000280\",\"Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nVPN gateways often have a separate audit log for capturing VPN status and other information about the traffic (as opposed to the log capturing administrative and configuration actions). Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.\\n\\nAssociating event types with detected events in the VPN gateway logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HGobFrLp43KBzaBeaBiQba6hjKEcpQn11VJTJJwwmMo=\"},\"C-95901r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1960KI2uASwT2grDyD1D8glCHawNm1LCT+mppgDNAG4=\"},\"F-102745r1_fix\",\"V-97063\",\"low\",\"SRG-NET-000078-VPN-000290\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41730,\"SV-106201r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish when (date and time) the events occurred.\",\"SRG-NET-000078-VPN-000290\",\"Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nVPN gateways often have a separate audit log for capturing VPN status and other information about the traffic (as opposed to the log capturing administrative and configuration actions).\\n\\nAssociating event types with detected events in the network audit logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:P/zyghBUSYmw8eYcF6kqAgE8TeMANzSroGoCNq9DxmU=\"},\"C-95903r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jl3z7pSS/5EUBqiypkdJCKqCZ9U+KdO46Z7KbtxpUpI=\"},\"F-102747r1_fix\",\"V-97065\",\"medium\",\"SRG-NET-000079-VPN-000300\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41731,\"SV-106203r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records containing information that establishes the identity of any individual or process associated with the event.\",\"SRG-NET-000079-VPN-000300\",\"Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/9F2orQ7S4UyHUeIF5MNwyf2YqTtEcZKOu6Lyy3dl0w=\"},\"C-95905r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:8Jh0XPz5tsLOV5OOHxTog1U4Ld3GURTDC/neBufCCRc=\"},\"F-102749r1_fix\",\"V-97067\",\"medium\",\"SRG-NET-000088-VPN-000310\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41732,\"SV-106205r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records containing information to establish where the events occurred.\",\"SRG-NET-000088-VPN-000310\",\"Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\\n\\nIn order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know where events occurred, such as VPN gateway components, modules, device identifiers, node names, and functionality.\\n\\nAssociating information about where the event occurred within the network provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TBiXTAY2X10uilSJ/Zo764Ce7gxa+BC604igCvR21Ys=\"},\"C-95907r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fdhbsyNKzbH4WTd1xvpZy3y/UYX8uj3SGwmY5U6RSTM=\"},\"F-102751r1_fix\",\"V-97069\",\"low\",\"SRG-NET-000089-VPN-000330\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41733,\"SV-106207r1_rule\",\"low\",null,null,\"The VPN Gateway must generate log records containing information to establish the source of the events.\",\"SRG-NET-000089-VPN-000330\",\"Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event.\\n\\nIn addition to logging where events occur within the network, the log records must also identify sources of events such as IP addresses, processes, and node or device names.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2+gLZEUpQFGiiXTLj5vTvPMeNuYVSesoUBq5osjiwyA=\"},\"C-95909r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+Hhc/f/5x1WDFzGN2o6Zu1Zd4z5P5GcPUtxEuGkAWCk=\"},\"F-102753r1_fix\",\"V-97071\",\"medium\",\"SRG-NET-000091-VPN-000350\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41734,\"SV-106209r1_rule\",\"medium\",null,null,\"The VPN Gateway must produce log records containing information to establish the outcome of the events.\",\"SRG-NET-000091-VPN-000350\",\"Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the network.\\n\\nEvent outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the network after the event occurred). As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mi17ibh62O4cda5bcRUSENaNZI+A+wHMQdsAhZaeELQ=\"},\"C-95911r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:uA4H2p1A7Ll9hacECizf787pb/UA7IqAnIHhct/QrEM=\"},\"F-102755r1_fix\",\"V-97073\",\"low\",\"SRG-NET-000098-VPN-000370\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41735,\"SV-106211r1_rule\",\"low\",null,null,\"The VPN Gateway must protect log information from unauthorized read access if all or some of this data is stored locally.\",\"SRG-NET-000098-VPN-000370\",\"Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured VPN gateway. Thus, it is imperative that the collected log data from the various VPN gateways, as well as the auditing tools, be secured and can only be accessed by authorized personnel.\\n\\nThis requirement pertains to securing the VPN log as it is stored locally, on the box temporarily, or while being encapsulated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xx7dyKjP3tr449DemD15SwuRdkEieFRE1AhuT429Hbk=\"},\"C-95913r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0Ev7nKBuQufWeKLn3k7Wr/z0hb8pni2MRJGUGCqohj8=\"},\"F-102757r1_fix\",\"V-97075\",\"medium\",\"SRG-NET-000099-VPN-000380\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41736,\"SV-106213r1_rule\",\"medium\",null,null,\"The VPN Gateway log must protect audit information from unauthorized modification when stored locally.\",\"SRG-NET-000099-VPN-000380\",\"If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\\n\\nThis requirement pertains to securing the VPN log as it is stored locally, on the box temporarily, or while being encapsulated.\\n\\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\\n\\nAudit information includes all information (e.g., log records, audit settings, and audit reports) needed to successfully audit information system activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LurVSxZqQlUG4THAxXLsYwtoOIQkH9C5vFm75lhPk+M=\"},\"C-95915r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PRb2voDcKub8xxvNSpdygBWfbLpwWfUE85OlSdeFxMU=\"},\"F-102759r1_fix\",\"V-97077\",\"medium\",\"SRG-NET-000100-VPN-000390\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41737,\"SV-106215r1_rule\",\"medium\",null,null,\"The VPN Gateway must protect audit information from unauthorized deletion when stored locally.\",\"SRG-NET-000100-VPN-000390\",\"If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\\n\\nTo ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification.\\n\\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\\n\\nAudit information includes all information (e.g., log records, audit settings, and audit reports) needed to successfully audit information system activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:R+x0KRiQIKJIbqWDk9OWXOHA/tx5c83O7HSpjbaqItQ=\"},\"C-95917r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4gmYRDVBlFkpvQ5jFnJALH34Q1qS7urLI7Yjatvv5Ks=\"},\"F-102761r1_fix\",\"V-97079\",\"medium\",\"SRG-NET-000132-VPN-000450\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41738,\"SV-106217r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.\",\"SRG-NET-000132-VPN-000450\",\"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\\n\\nDoD continually assesses the ports, protocols, and services that can be used for network communications. Some protocols or services have known exploits or security weaknesses. Network traffic using these ports, protocols, and services must be prohibited or restricted in accordance with DoD policy. The PPSM CAL and vulnerability assessments provide an authoritative source for ports, protocols, and services that are unauthorized or restricted across boundaries on DoD networks.\\n\\nThe VPN Gateway must be configured to prevent or restrict the use of prohibited ports, protocols, and services throughout the network by filtering the network traffic and disallowing or redirecting traffic as necessary. Default and updated policy filters from the vendors will disallow older version of protocols and applications and will address most known non-secure ports, protocols, and/or services.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6xznw8iyFeJRJwk1JYCPRsiNwv5VE1E6oPOibHnQepY=\"},\"C-95919r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:BV4FIuZmpkNnwep3K+axA7S7eorRTT2tR14EUOT7U0Y=\"},\"F-102763r1_fix\",\"V-97081\",\"medium\",\"SRG-NET-000132-VPN-000460\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41739,\"SV-106219r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use IKEv2 for IPsec VPN security associations.\",\"SRG-NET-000132-VPN-000460\",\"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\\n\\nUse of IKEv2 leverages DoS protections because of improved bandwidth management and leverages more secure encryption algorithms.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U9u5kkzq19uYYwdfbvK93u00swz2+lLKN/KXYD1SLPM=\"},\"C-95921r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:CZLDS9pX8n0hhkw38hCbPDJhpjz0SK1r40ll/eFYuDI=\"},\"F-102765r1_fix\",\"V-97083\",\"medium\",\"SRG-NET-000132-VPN-000470\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41740,\"SV-106221r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and L2F.\",\"SRG-NET-000132-VPN-000470\",\"The PPTP and L2F are obsolete method for implementing virtual private networks. Both protocols may be easy to use and readily available, but they have many well-known security issues and exploits. Encryption and authentication are both weak.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qL67vWiduAPXEoBZfFyKtQr8Xx5q0lifYoN8/VKeiXk=\"},\"C-95923r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fRSUaDiTIxiKHwtXC7xhS028BxmoqEKmcdKtfdEYU8A=\"},\"F-102767r1_fix\",\"V-97085\",\"medium\",\"SRG-NET-000132-VPN-000480\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41741,\"SV-106223r1_rule\",\"medium\",null,null,\"For site-to-site VPN implementations, the  L2TP protocol must be blocked or denied at the security boundary with the private network so unencrypted L2TP packets cannot traverse into the private network of the enclave.\",\"SRG-NET-000132-VPN-000480\",\"Unlike GRE (a simple encapsulating header) L2TP is a full-fledged communications protocol with control channel, data channels, and a robust command structure. In addition to PPP, other link layer types (called pseudowires) can be and are defined for delivery in L2TP by separate RFC documents. Further complexity is created by the capability to define vender-specific parameters beyond those defined in the L2TP specifications.\\n\\nThe endpoint devices of an L2TP connection can be an L2TP Access Concentrator (LAC) in which case it inputs/outputs the layer 2 protocol to/from the L2TP tunnel. Otherwise, it is an L2TP Network Server (LNS), in which case it inputs/outputs the layer 3 (IP) protocol to/from the L2TP tunnel. The specifications describe three reference models: LAC-LNS, LAC-LAC, and LNS-LNS, the first of which is the most common case. The LAC-LNS model allows a remote access user to reach his home network or ISP from a remote location. The remote access user connects to  a LAC device which tunnels his connection home to an awaiting LNS. The LAC could also be located on the remote user's laptop, which connects to an LNS at home using some generic internet connection. The other reference models may be used for more obscure scenarios.\\n\\nAlthough the L2TP protocol does not contain encryption capability, it can be operated over IPsec, which would provide authentication and confidentiality. A remote user in the LAC-LNS model would most likely obtain a dynamically assigned IP address from the home network to ultimately use through the tunnel back to the home network. Secondly, the outer IP source address used to send the L2TP tunnel packet to the home network is likely to be unknown or highly variable. Thirdly, since the LNS provides the remote user with a dynamic IP address to use, the firewall at the home network would have to be dynamically updated to accept this address in conjunction with the outer tunnel address. Finally, there is also the issue of authentication of the remote user prior to divulging an acceptable IP address. Because of all of these complications, the strict filtering rules applied to the IP-in-IP and GRE tunneling cases will likely not be possible in the L2TP scenario.\\n\\nIn addition to the difficulty of enforcing addresses and endpoints (as explained above), the L2TP protocol itself is a security concern if allowed through a security boundary. In particular:\\n\\n1) L2TP potentially allows link layer protocols to be delivered from afar. These protocols were intended for link-local scope only, are less defended, and not as well-known,\\n2) The L2TP tunnels can carry IP packets that are very difficult to see and filter because of the additional layer 2 overhead,\\n3) L2TP is highly complex and variable (vender-specific variability) and therefore would be a viable target that is difficult to defend. It is better left outside of the main firewall where less damage occurs if the L2TP-processing node is compromised,\\n4) Filtering cannot be used to detect and prevent other unintended layer 2 protocols from being tunneled. The strength of the application layer code would have to be relied on to achieve this task,\\n5) Regardless of whether the L2TP is handled inside or outside of the main network, a secondary layer of IP filtering is required; therefore bringing it inside does not save resources.\\n\\nTherefore, it is not recommended to allow unencrypted L2TP packets across the security boundary into the network's protected areas. Reference the Backbone Transport STIG for additional L2TP guidance and use.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mmyK/9p+kkBzjw391gSBn/5JwQ6rUWRXc0i0deZcJlY=\"},\"C-95925r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PTCfoKcCD5hDW7K47sK1D7FeehVzMR67iHZOHpTiBJE=\"},\"F-102769r1_fix\",\"V-97087\",\"medium\",\"SRG-NET-000138-VPN-000490\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41742,\"SV-106225r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).\",\"SRG-NET-000138-VPN-000490\",\"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\\n\\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses except the following.\\n\\n(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\\n\\n(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals' in-group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN or proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D7dgt3RnYA25LvMASqDp9YTrG7KfSDck59y/cwVd1j4=\"},\"C-95927r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Rh+GrFD8y7n/BlVOr9JDOC5ROFB+DmI+8x461DH5A1Q=\"},\"F-102771r1_fix\",\"V-97089\",\"high\",\"SRG-NET-000140-VPN-000500\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41743,\"SV-106227r1_rule\",\"high\",null,null,\"The VPN Gateway must use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.\",\"SRG-NET-000140-VPN-000500\",\"To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.\\n\\nMultifactor authentication uses two or more factors to achieve authentication. Use of password for user remote access for non-privileged account is not authorized.\\n\\nFactors include:\\n(i) Something you know (e.g., password/PIN);\\n(ii) Something you have (e.g., cryptographic identification device, token); or\\n(iii) Something you are (e.g., biometric).\\n\\nA non-privileged account is any information system account with authorizations of a non-privileged user.\\n\\nNetwork access is any access to a network element by a user (or a process acting on behalf of a user) communicating through a network.\\n\\nThe DoD CAC with DoD-approved PKI is an example of multifactor authentication.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KKZUM28vxti/o8G6lxUgCF8Wx8ura3+B1TExgJuWCGA=\"},\"C-95929r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:n8I5AADucbxW3nhWpeZCsAbA1ZwIJ9+ypR/dgDeDkbA=\"},\"F-102773r1_fix\",\"V-97091\",\"medium\",\"SRG-NET-000145-VPN-000510\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41744,\"SV-106229r1_rule\",\"medium\",null,null,\"The VPN Client must implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.\",\"SRG-NET-000145-VPN-000510\",\"Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\\n\\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD common access card.\\n\\nA non-privileged account is any information system account with authorizations of a non-privileged user.\\n\\nNetwork access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:koWH1S5xZuAZ4H9vnFXHr/qz4c6UDJH7P29FdfhEPZg=\"},\"C-95931r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/05962IPiIdyt4V5PSfPjQ8gsSvFmLoQb7Ih1O9CdmI=\"},\"F-102775r1_fix\",\"V-97093\",\"medium\",\"SRG-NET-000147-VPN-000520\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41745,\"SV-106231r1_rule\",\"medium\",null,null,\"The TLS VPN must be configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts.\",\"SRG-NET-000147-VPN-000520\",\"A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack.\\n\\nAn authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message.\\n\\nA non-privileged account is any operating system account with authorizations of a non-privileged user.\\n\\nTechniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:53vjl7nhxJZkAmPcXBfrWgxe2N8vSeOA4P5KeOUv1cA=\"},\"C-95933r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tvtLSoQBIUhFi1DUAx/IQFts2ZxCAJGEu1MMnqECcNE=\"},\"F-102777r1_fix\",\"V-97095\",\"medium\",\"SRG-NET-000147-VPN-000530\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41746,\"SV-106233r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use anti-replay mechanisms for security associations.\",\"SRG-NET-000147-VPN-000530\",\"Anti-replay is an IPsec security mechanism at a packet level, which helps to avoid unwanted users from intercepting and modifying an ESP packet.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PQvyQqpQfxH4QYcuFED9dQWGmLZ5NjYVdg+5ViJyzMc=\"},\"C-95935r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PKYcfwohvuVW06x1QmIrzJEC7yX68OlFaic/tTj3y3A=\"},\"F-102779r1_fix\",\"V-97097\",\"medium\",\"SRG-NET-000148-VPN-000540\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41747,\"SV-106235r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify all network-connected endpoint devices before establishing a connection.\",\"SRG-NET-000148-VPN-000540\",\"Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\\n\\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification decisions (as opposed to the actual identifiers) to the services that need to act on those decisions.\\n\\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers (outside a datacenter), VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v5/IfNoYuNBZdJW3TnihRjv14rrPD9SLxquxNn9HMf0=\"},\"C-95937r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4mEma8P0Dv4vj5cqKTp53/Xgkv8CV31yYo/9WqBJF7I=\"},\"F-102781r1_fix\",\"V-97099\",\"medium\",\"SRG-NET-000164-VPN-000560\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41748,\"SV-106237r1_rule\",\"medium\",null,null,\"The VPN Gateway, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.\",\"SRG-NET-000164-VPN-000560\",\"Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. To meet this requirement, the information system must create trusted channels between itself and remote trusted authorized IT product (e.g., syslog server) entities that protect the confidentiality and integrity of communications. The information system must create trusted paths between itself and remote administrators and users that protect the confidentiality and integrity of communications.\\n\\nA trust anchor is an authoritative entity represented via a public key and associated data. It is most often used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. However, applications that do not use a trusted path are not approved for non-local and remote management of DoD information systems.\\n\\nUse of SSHv2 to establish a trusted channel is approved. Use of FTP, TELNET, HTTP, and SNMPV1 is not approved since they violate the trusted channel rule set. Use of web management tools that are not validated by common criteria may also violate the trusted channel rule set.\\n\\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA.\\n\\nThis requirement verifies that a certification path to an accepted trust anchor is used for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Validation of the certificate status information is out of scope for this requirement.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4L7fYYyaq26bvadPv3JCcQ3yEjurb6JgRmYQ/U0UV1c=\"},\"C-95939r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:kHIpuc9rQ7c3thtVDQNITMH7ftHuWzgXExpBIujEdHQ=\"},\"F-102783r1_fix\",\"V-97101\",\"medium\",\"SRG-NET-000165-VPN-000570\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41749,\"SV-106239r1_rule\",\"medium\",null,null,\"The site-to-site VPN, when using PKI-based authentication for devices, must enforce authorized access to the corresponding private key.\",\"SRG-NET-000165-VPN-000570\",\"If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure.\\n\\nThe cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to authenticate to network devices.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ar3GvJuXEKD4A/Af2IozOGlLJBjfNqRbiW1i8k/7Y9g=\"},\"C-95941r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5j0XBOP7B/DfiJ4RQcUK0zsSkNS1ZJgD+jERXi5h0IM=\"},\"F-102785r1_fix\",\"V-97103\",\"medium\",\"SRG-NET-000166-VPN-000580\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41750,\"SV-106241r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway must use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.\",\"SRG-NET-000166-VPN-000580\",\"The VPN interacts directly with public networks and devices and should not contain user authentication information for all users. AAA network security services provide the primary framework through which a network administrator can set up access control and authorization on network points of entry or network access servers. It is not advisable to configure access control on the VPN gateway or remote access server. Separation of services provides added assurance to the network if the access control server is compromised.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:f0b/RYI3SCPeEqjHsb3psBWUdGRTKfgqRrq51hB7yfE=\"},\"C-95953r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Oi4jUVTD6ycPdzvYBP8T+rY1x1IUvcpUVTHSlQ5ZZHM=\"},\"F-102797r1_fix\",\"V-97113\",\"medium\",\"SRG-NET-000166-VPN-000590\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41751,\"SV-106251r1_rule\",\"medium\",null,null,\"The VPN Gateway must map the authenticated identity to the user account for PKI-based authentication.\",\"SRG-NET-000166-VPN-000590\",\"Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of a user (e.g., VPN or ALG. This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MRKxPi/bbsDz8wNN9vXmb7hhgMU8M3+JU6oyqsrMnZk=\"},\"C-95955r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:pSURQgwBF8TrM2BF5TWiE9Mm2xRU9ilNiN8qenfhfhs=\"},\"F-102799r1_fix\",\"V-97115\",\"medium\",\"SRG-NET-000168-VPN-000600\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41752,\"SV-106253r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).\",\"SRG-NET-000168-VPN-000600\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nNonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through either an external network (e.g., the Internet) or an internal network.\\n\\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\\n\\nApplications also include HMAC, KDFs, Random Bit Generation, and hash-only applications (e.g., hashing passwords and using SHA-1 or higher to compute a checksum). For digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use where needed.\\n\\nSeparate requirements for configuring applications and protocols used by each product (e.g., SNMPv3, SSH, NTP, and other protocols and applications that require server/client authentication) are required to implement this requirement.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:L26csqRjhPU0fgblV8qX1BlmvtAHZjw4Yyp+bb0mDKw=\"},\"C-95957r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:srWnJLZc/eBKJFIWlsEIupfvJph4j2NGvFXosOihlzk=\"},\"F-102801r1_fix\",\"V-97117\",\"medium\",\"SRG-NET-000169-VPN-000610\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41753,\"SV-106255r1_rule\",\"medium\",null,null,\"The VPN Gateway must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).\",\"SRG-NET-000169-VPN-000610\",\"Lack of authentication and identification enables non-organizational users to gain access to the network or possibly a VPN gateway that provides opportunity for intruders to compromise resources within the network infrastructure.\\n\\nThis requirement only applies to components where this is specific to the function of the device or has the concept of a non-organizational user.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OyTG982E0CMxr4y2rmBaYCCpTY7srBWAv/cZQUt/Y+w=\"},\"C-95959r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:1p/ev5FaVReOsAiB4Yypz9PuTHTIq8DZEOVu8/pAPZo=\"},\"F-102803r1_fix\",\"V-97119\",\"medium\",\"SRG-NET-000205-VPN-000710\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41754,\"SV-106257r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to route sessions to an IDPS for inspection.\",\"SRG-NET-000205-VPN-000710\",\"Remote access devices, such as those providing remote access to network devices and information systems, which lack automated, capabilities increase risk and makes remote user access management difficult at best.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nAutomated monitoring of remote access sessions allows organizations to detect cyber attacks and ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, from a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lOVVOo0oYWR1BZZb2TwnHXMbM18YttAN6G4GrHPWbyw=\"},\"C-95961r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lQAodzF2vAPdkyT4THpjERChTagkjNx3KaYEZBi/5HM=\"},\"F-102805r1_fix\",\"V-97121\",\"low\",\"SRG-NET-000213-VPN-000720\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41755,\"SV-106259r1_rule\",\"low\",null,null,\"The VPN Gateway must terminate all network connections associated with a communications session at the end of the session.\",\"SRG-NET-000213-VPN-000720\",\"Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These “orphaned” sessions use up valuable router resources and can be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keep alive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the TCP keep alive message, the sending router will clear the connection and free resources allocated to the session.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZitF7N9m7tBrFLBSFvvFyer2Cj1EN7TGddhFoon9a2g=\"},\"C-95963r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:EuB8U2wr3QUgtcHmLsicOw6VzQ5t4flKS602zwr3K7I=\"},\"F-102807r1_fix\",\"V-97123\",\"medium\",\"SRG-NET-000230-VPN-000770\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41756,\"SV-106261r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.\",\"SRG-NET-000230-VPN-000770\",\"Unapproved mechanisms that are used for authentication to the cryptographic module are not verified, and therefore cannot be relied upon to provide confidentiality or integrity and DoD data may be compromised.\\n\\nVPN gateways utilizing encryption are required to use FIPS compliant mechanisms for authenticating to cryptographic modules.\\n\\nFIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uJQ31o/f/Vqkllw6K1glewYI9Xlo0bRZIER2AGlLICw=\"},\"C-95965r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:5d33UFWeSYVRhZGzYH0+0+VJ6rVugjCYj6LlTRa+nqY=\"},\"F-102809r1_fix\",\"V-97125\",\"high\",\"SRG-NET-000230-VPN-000780\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41757,\"SV-106263r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use Internet Key Exchange (IKE) with SHA-1 or greater to protect the authenticity of communications sessions.\",\"SRG-NET-000230-VPN-000780\",\"Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/SOA will require the use of mutual authentication (two-way/bidirectional).\\n\\nAn IPsec Security Associations (SA) is established using either IKE or manual configuration.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KPLBOeYMBZIxBbaWyihbjnI+iXUnrab0mkIE2hzbTk8=\"},\"C-95967r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:QTXhy5bkfpQRsWuE/X3R1behSbs9HPpQP63IlKE7Z9A=\"},\"F-102811r1_fix\",\"V-97127\",\"medium\",\"SRG-NET-000231-VPN-000790\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41758,\"SV-106265r1_rule\",\"medium\",null,null,\"The VPN Gateway must invalidate session identifiers upon user logoff or other session termination.\",\"SRG-NET-000231-VPN-000790\",\"Captured sessions can be reused in \\\"replay\\\" attacks. This requirement limits the ability of adversaries from capturing and continuing to employ previously valid session IDs.\\n\\nSession IDs are tokens generated by web applications to uniquely identify an application user's session. Unique session identifiers or IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. When a user logs out, or when any other session termination event occurs, the VPN gateway must terminate the user session to minimize the potential for an attacker to hijack that particular user session.\\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet.\\n\\nThis requirement applies only to any VPN gateway that is an intermediary of individual sessions (e.g., proxy, ALG, or SSL VPN). This requirement focuses on communications protection at the application session, versus network packet level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p+iB5XlL+If6inJuLfQ+r3VNT86JXC5NhnV2vOeozxg=\"},\"C-95969r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tbmOT/VG86p0EWsjZLm3s8Y4/9kcKFGaAevpuHrUlfg=\"},\"F-102813r1_fix\",\"V-97129\",\"medium\",\"SRG-NET-000233-VPN-000800\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41759,\"SV-106267r1_rule\",\"medium\",null,null,\"The VPN Gateway must recognize only system-generated session identifiers.\",\"SRG-NET-000233-VPN-000800\",\"VPN gateways (depending on function) utilize sessions and session identifiers to control application behavior and user access. If an attacker can guess the session identifier, or can inject or manually insert session information, the valid user's application session can be compromised.\\n\\nUnique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions.\\n\\nThis requirement focuses on communications protection for the application session rather than for the network packet.\\n\\nThis requirement applies to any VPN gateway that is an intermediary of individual sessions (e.g., proxy, ALG, TLS VPN). VPN gateways that perform these functions must be able to identify which session identifiers were generated when the sessions were established.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ktJIe/Y+HEIOo7bAwQCz3X/2hQkiqoTyl8BVpkZpHYk=\"},\"C-95971r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:TniVNe2bo64DYrBZv1sEf0zR9SKcbwn0jWfXR3l8iz0=\"},\"F-102815r1_fix\",\"V-97131\",\"medium\",\"SRG-NET-000234-VPN-000810\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41760,\"SV-106269r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.\",\"SRG-NET-000234-VPN-000810\",\"Both IPsec and TLS gateways use the RNG to strengthen the security of the protocols. Using a weak RNG will weaken the protocol and make it more vulnerable.\\n\\nUse of a FIPS validated RNG that is not DRGB mitigates to a CAT III.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D9gD2h3b8ZDEWmQokEZllnWlmTLY7M//Hjdn7DqBOf8=\"},\"C-95973r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KB4RBRRC9piCCQ/V/rwpAJ5Z4Df6Bh3k50+VVARART8=\"},\"F-102817r1_fix\",\"V-97133\",\"medium\",\"SRG-NET-000235-VPN-000820\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41761,\"SV-106271r1_rule\",\"medium\",null,null,\"The VPN Gateway must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.\",\"SRG-NET-000235-VPN-000820\",\"Failure to a known safe state helps prevent systems from failing to a state that may cause loss of data or unauthorized access to system resources. VPN gateways that fail suddenly and with no incorporated failure state planning may leave the hosting system available but with a reduced security protection capability. Preserving information system state information also facilitates system restart and return to the operational mode of the organization with less disruption to mission-essential processes.\\n\\nAbort refers to stopping a program or function before it has finished naturally. The term abort refers to both requested and unexpected terminations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:72eP2Vo/dCHVQ+6f/2RQyYnBi119Hq+RWYm1m2WqoLc=\"},\"C-95975r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KOCFObJ10AgHLn2PIX9FSde4QkGSCpnBOYQLWTFTSDo=\"},\"F-102819r1_fix\",\"V-97135\",\"medium\",\"SRG-NET-000313-VPN-001050\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41762,\"SV-106273r1_rule\",\"medium\",null,null,\"The VPN Gateway must be configured to perform an organization-defined action if the audit reveals unauthorized activity.\",\"SRG-NET-000313-VPN-001050\",\"Remote access devices, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and makes remote user access management difficult at best.\\n\\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\\n\\nRemote access functionality, such as remote access servers, VPN concentrators, and IDS/IPS devices, must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:w9yL+z+t1qYSt9kk+sxVflN/xG/naaJ9QP4VRCcqw6Q=\"},\"C-95977r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:COjdhT7YeatypyTtARxEDYM/VBCnUmEevQq0bspvHSk=\"},\"F-102821r1_fix\",\"V-97137\",\"medium\",\"SRG-NET-000314-VPN-001060\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41763,\"SV-106275r1_rule\",\"medium\",null,null,\"The VPN Gateway administrator accounts or security policy must be configured to allow the system administrator to immediately disconnect or disable remote access to devices and/or users when needed.\",\"SRG-NET-000314-VPN-001060\",\"Without the ability to immediately disconnect or disable remote access, an attack or other compromise taking progress would not be immediately stopped.\\n\\nRemote access functionality must have the capability to immediately disconnect current users remotely accessing the information system and/or disable further remote access. The speed of disconnect or disablement varies based on the criticality of mission functions and the need to eliminate immediate or future remote access to organizational information systems.\\n\\nThe remote access functionality (e.g., VPN, ALG, and RAS) may implement features, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:afNm41YNd2Z2QwHOtNNm/ZsgKpPtQhY3FaPrGqRWnTw=\"},\"C-95979r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HIQBC9ZU7AuTIdllzK3oRjj9cc4DrzRsdkjLzrUOnSE=\"},\"F-102823r1_fix\",\"V-97139\",\"high\",\"SRG-NET-000317-VPN-001090\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41764,\"SV-106277r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use AES encryption for the Internet Key Exchange (IKE) proposal to protect confidentiality of remote access sessions.\",\"SRG-NET-000317-VPN-001090\",\"Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nAES is the FIPS-validated cipher block cryptographic algorithm approved for use in DoD. For an algorithm implementation to be listed on a FIPS 140-2 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. Currently, NIST has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:n4616xCQqSEJ5LDbI/BvogDwAhTFLCqs6qsCNm2y6qM=\"},\"C-95981r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:o94iAavW4v2w03yRo2xl3upVmak75NTVDj/Dy2pNCbA=\"},\"F-102825r1_fix\",\"V-97141\",\"medium\",\"SRG-NET-000320-VPN-001120\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41765,\"SV-106279r1_rule\",\"medium\",null,null,\"The VPN Gateway must transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.\",\"SRG-NET-000320-VPN-001120\",\"Protecting authentication communications between the client, the VPN Gateway, and the authentication server keeps this critical information from being exploited.\\n\\nIn distributed information systems, authorization processes and access control decisions may occur in separate parts of the systems. In such instances, authorization information is transmitted securely so timely access control decisions can be enforced at the appropriate locations. To support the access control decisions, it may be necessary to transmit as part of the access authorization information, supporting security attributes. This is due to the fact that in distributed information systems, there are various access control decisions that need to be made and different entities (e.g., services) make these decisions in a serial fashion, each requiring some security attributes to make the decisions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qrumTMQiLLqavZ4GBAcbIfp6Kibky5yDpODJYsUNU6k=\"},\"C-95983r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:liEE0SFmmeFRP77fVgYsXwcMaxPrYjZRWHQv5JaTXXg=\"},\"F-102827r1_fix\",\"V-97143\",\"low\",\"SRG-NET-000330-VPN-001220\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41766,\"SV-106281r1_rule\",\"low\",null,null,\"The VPN Gateway must notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).\",\"SRG-NET-000330-VPN-001220\",\"Users need to be aware of activity that occurs regarding their account. Providing users with information deemed important by the organization may aid in the discovery of unauthorized access or thwart a potential attacker.\\n\\nOrganizations should consider the risks to the specific information system being accessed and the threats presented by the device to the environment when configuring this option. An excessive or unnecessary amount of information presented to the user at logon is not recommended.\\n\\nThis requirement applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bzo/kYUviBi8fH0VVF4kMJsdAnZOcFeOl3REDgnED8o=\"},\"C-95985r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:P8pkANj/XLaqdv6hJakyvgLuueJH8cGpKoldzmEq82g=\"},\"F-102829r1_fix\",\"V-97145\",\"medium\",\"SRG-NET-000333-VPN-001250\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41767,\"SV-106283r1_rule\",\"medium\",null,null,\"The VPN Gateway must provide centralized management and configuration of the content to be captured in log records generated by all network components.\",\"SRG-NET-000333-VPN-001250\",\"Without the ability to centrally manage the content captured in the log records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack.\\n\\nThe content captured in log records must be managed from a central location (necessitating automation). Centralized management of log records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Network components requiring centralized audit log management must have the capability to support centralized management.\\n\\nThe DoD requires centralized management of all network component audit record content.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cvSX2fNtb/9d5KoCFv38r/vk1P66QvbknutRPO++RHQ=\"},\"C-95987r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4LMA3u9siEI56MkwasqV8o7t4fUD89q8QT8ld4InCNY=\"},\"F-102831r1_fix\",\"V-97147\",\"medium\",\"SRG-NET-000334-VPN-001260\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41768,\"SV-106285r1_rule\",\"medium\",null,null,\"The VPN Gateway must off-load audit records onto a different system or media than the system being audited.\",\"SRG-NET-000334-VPN-001260\",\"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\\n\\nOff-loading is a common process in information systems with limited audit storage capacity.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rpLsrhPbwk1f+JYoA5pOhGpi71+wEYHZA7WhvDHOZ+M=\"},\"C-95989r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:ZbcudZvV1BQEgFZtq1Hz/2teLVGVbnWW0bcryt+9lXk=\"},\"F-102833r1_fix\",\"V-97149\",\"medium\",\"SRG-NET-000335-VPN-001270\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41769,\"SV-106287r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.\",\"SRG-NET-000335-VPN-001270\",\"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected.\\n\\nAlerts provide organizations with urgent messages. Automated alerts can be conveyed in a variety of ways, including, for example, telephonically, via electronic mail, via text message, or via websites. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded.\\n\\nWhile this requirement also applies to the event monitoring system (e.g., Syslog, Security Information and Event Management [SIEM], or SNMP servers), the VPN Gateway must also be configured to generate a message to the administrator console.\\n\\nThe VPN daemon facility and log facility are messages in the log, which capture actions performed or errors encountered by system processes.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lKiTDkfAGyG9SqJoJw3IBMHEt9m1XfYEXjJcJ6N2O4I=\"},\"C-95991r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:98ovgM7bqc4Ya1AKRRjI0MOMt8I2xMdngADds6VQJgc=\"},\"F-102835r1_fix\",\"V-97151\",\"medium\",\"SRG-NET-000336-VPN-001280\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41770,\"SV-106289r1_rule\",\"medium\",null,null,\"When communications with the Central Log Server is lost, the VPN Gateway must continue to queue traffic log records locally.\",\"SRG-NET-000336-VPN-001280\",\"If the system were to continue processing after audit failure, actions can be taken on the system that cannot be tracked and recorded for later forensic analysis.\\n\\nBecause of the importance of ensuring mission/business continuity, organizations may determine that the nature of the audit failure is not so severe that it warrants a complete shutdown of the application supporting the core organizational missions/business operations. In those instances, partial application shutdowns or operating in a degraded mode with reduced capability may be viable alternatives.\\n\\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fVzjNA9x7fe7XKuKOy79M7wLwKGgdGCnV3TChwORocM=\"},\"C-95993r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:7kFOvG6IkBGOVLyO9MRlIA10BFwkb7/m/gpclcr3GP8=\"},\"F-102837r1_fix\",\"V-97153\",\"medium\",\"SRG-NET-000337-VPN-001290\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41771,\"SV-106291r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must renegotiate the security association after 8 hours or less, or an organization-defined period.\",\"SRG-NET-000337-VPN-001290\",\"The IPsec SA and its corresponding key will expire either after the number of seconds or amount of traffic volume has exceeded the configured limit. A new SA is negotiated before the lifetime threshold of the existing SA is reached to ensure that a new SA is ready for use when the old one expires. The longer the lifetime of the IPsec SA, the longer the lifetime of the session key used to protect IP traffic. The SA is less secure with a longer lifetime because an attacker has a greater opportunity to collect traffic encrypted by the same key and subject it to cryptanalysis. However, a shorter lifetime causes IPsec peers to renegotiate Phase II more often resulting in the expenditure of additional resources.\\n\\nSpecify the lifetime (in seconds) of an Internet Key Exchange (IKE) security association (SA). When the SA expires, it is replaced by a new SA, the security parameter index (SPI), or terminated if the peer cannot be contacted for renegotiation.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yIMWyLqQ5KjJhVIE0sO7kOy3MFZ/mr8G1UsF2vpFezs=\"},\"C-95995r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:HEQrvy4/s8jokXmlLC3sxlKZoNheJdGUClzKnI45P1o=\"},\"F-102839r1_fix\",\"V-97155\",\"medium\",\"SRG-NET-000337-VPN-001300\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41772,\"SV-106293r1_rule\",\"medium\",null,null,\"The VPN Gateway must renegotiate the security association after 24 hours or less or as defined by the organization.\",\"SRG-NET-000337-VPN-001300\",\"When a VPN gateway creates an IPsec Security Association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway’s inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3Vk1c0ULGwB+JNxtAcJe82imefTrQUiXMXW0gSoV5sI=\"},\"C-95997r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:xBCJWam1YJOEk/Y3uRcCt4tDlmUHwgij/XAGpODs0PQ=\"},\"F-102841r1_fix\",\"V-97157\",\"medium\",\"SRG-NET-000341-VPN-001350\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41773,\"SV-106295r1_rule\",\"medium\",null,null,\"The VPN Gateway must accept Personal Identity Verification (PIV) credentials.\",\"SRG-NET-000341-VPN-001350\",\"The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\\n\\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U2xkrpdDd5fbE89oPVhqhnurz+BzWOL7MBkXI3iyc44=\"},\"C-95999r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:DWEbV0DVPuJ7OTfvbUkhrgxsgpWLM8sKjC8MjkQOMA4=\"},\"F-102843r1_fix\",\"V-97159\",\"medium\",\"SRG-NET-000342-VPN-001360\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41774,\"SV-106297r1_rule\",\"medium\",null,null,\"The VPN Gateway must electronically verify Personal Identity Verification (PIV) credentials.\",\"SRG-NET-000342-VPN-001360\",\"The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\\n\\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tY5W3SOCbPKTMPPTVFP0FpXqFdrxc15JZY9C5N1Jp3E=\"},\"C-96015r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:C2DPURp+P/TJg1Bmt9fhJFi9259gGRXNzSqAORnuD3g=\"},\"F-102859r1_fix\",\"V-97177\",\"medium\",\"SRG-NET-000343-VPN-001370\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41775,\"SV-106315r1_rule\",\"medium\",null,null,\"The VPN Gateway must authenticate all network-connected endpoint devices before establishing a connection.\",\"SRG-NET-000343-VPN-001370\",\"Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\\n\\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions.\\n\\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers (outside a datacenter), VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.\\n\\nDevice authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bVroOwdA0e1yfLelH5K0/LjEPzRuPTDt+xgTDMzMsWA=\"},\"C-96017r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:Y/+l8kwggjnCbQ11WRfSGhCjui6kGNchR0wer8LCVos=\"},\"F-102861r1_fix\",\"V-97179\",\"medium\",\"SRG-NET-000352-VPN-001460\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41776,\"SV-106317r1_rule\",\"medium\",null,null,\"The VPN Gateway must use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.\",\"SRG-NET-000352-VPN-001460\",\"Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.\\n\\nThe National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by NIST and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future required Suite B implementations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1maPMRSAJQc9CCcE9i3+e/pBNygIhmu9m1GajIh4WrA=\"},\"C-96019r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:c81cg0K0ERMsQOfw3hMhzc4N9PuesRPEfIK2UBPat/E=\"},\"F-102863r1_fix\",\"V-97181\",\"medium\",\"SRG-NET-000369-VPN-001620\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41777,\"SV-106319r1_rule\",\"medium\",null,null,\"The VPN Gateway must disable split-tunneling for remote clients VPNs.\",\"SRG-NET-000369-VPN-001620\",\"Split tunneling would in effect allow unauthorized external connections, making the system more vulnerable to attack and to exfiltration of organizational information.\\n\\nA VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the Internet. With split tunneling enabled, a remote client has access to the Internet while at the same time has established a secured path to the enclave via an IPsec tunnel. A remote client connected to the Internet that has been compromised by an attacker in the Internet, provides an attack base to the enclave’s private network via the IPsec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:W5E6fpSFPSjZsDhRm6JBdbhvWCdb4iIQ29kz4GWDM20=\"},\"C-96021r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:PzvaYVGXC+ztLTE2ZozeA+R4K4I1v/fBf/opSADlvJ0=\"},\"F-102865r1_fix\",\"V-97183\",\"medium\",\"SRG-NET-000371-VPN-001640\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41778,\"SV-106321r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.\",\"SRG-NET-000371-VPN-001640\",\"PFS generates each new encryption key independently from the previous key. Without PFS, compromise of one key will compromise all communications.\\n\\nThe phase 2 (Quick Mode) Security Association (SA) is used to create an IPsec session key. Hence, its rekey or key regeneration procedure is very important. The phase 2 rekey can be performed with or without Perfect Forward Secrecy (PFS). With PFS, every time a new IPsec Security Association is negotiated during the Quick Mode, a new Diffie-Hellman (DH) exchange occurs. The new DH shared secret will be included with original keying material (SYKEID_d, initiator nonce, and responder nonce from phase 1 for generating a new IPsec session key. If PFS is not used, the IPsec session key will always be completely dependent on the original keying material from the Phase-1. Hence, if an older key is compromised at any time, it is possible that all new keys may be compromised.\\n\\nThe DH exchange is performed in the same manner as was done in phase 1 (Main or Aggressive Mode). However, the phase 2 exchange is protected by encrypting the phase 2 packets with the key derived from the phase 1 negotiation. Because DH negotiations during phase 2 are encrypted, the new IPsec session key has an added element of secrecy.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rqcFP9ktgfb343ahB5Mv16lTwTPf1/ELOUg9C3CgAj8=\"},\"C-96023r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:j/fsWDohMzN1oclh4BAauCakys23bebITKpZxWpK2Qk=\"},\"F-102867r1_fix\",\"V-97185\",\"high\",\"SRG-NET-000371-VPN-001650\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41779,\"SV-106323r1_rule\",\"high\",null,null,\"The VPN Gateway and Client must be configured to protect the confidentiality and integrity of transmitted information.\",\"SRG-NET-000371-VPN-001650\",\"Without protection of the transmitted information, confidentiality and integrity may be compromised as unprotected communications can be intercepted and either read or altered.\\n\\nThis requirement also applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification.\\n\\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.\\n\\nFor example, configure all ISAKMP policies to use AES for Internet Key Exchange (IKE) cryptographic encryption operations and SHA-1 to protect data integrity.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+vnSRs+ZokA+P5inP7i24jyzDoJ+8dRGwCZAF72bzfw=\"},\"C-96025r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:F3uzs5G3+v3iJx/kCrPtcrdW/gsCjZHZOAXufRJxNgY=\"},\"F-102869r1_fix\",\"V-97187\",\"medium\",\"SRG-NET-000375-VPN-001690\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41780,\"SV-106325r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway must use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.\",\"SRG-NET-000375-VPN-001690\",\"ESP provides confidentiality, data origin authentication, integrity, and anti-replay services within the IPsec suite of protocols. ESP in tunnel mode ensures a secure path for communications for site-to-site VPNs and gateway to endpoints, including header information.\\n\\nESP can be deployed in either transport or tunnel mode. Transport mode is used to create a secured session between two hosts. It can also be used when two hosts simply want to authenticate each IP packet with IPsec authentication header (AH). With ESP transport mode, only the payload (transport layer) is encrypted, whereas with tunnel mode, the entire IP packet is encrypted and encapsulated with a new IP header. Tunnel mode is used to encrypt traffic between secure IPsec gateways or between an IPsec gateway and an end-station running IPsec software. Hence, it is the only method to provide a secured path to transport traffic between remote sites or end-stations and the central site.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fU8zq6dLn1EHMKbL2KwqzdBun1CXedlYFT1NSzY5Zw0=\"},\"C-96027r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:AN4m35Ma+yxdnoD7gJy8bvR+ZHLR8Sqmd04QY4ipeyM=\"},\"F-102871r1_fix\",\"V-97189\",\"medium\",\"SRG-NET-000400-VPN-001940\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41781,\"SV-106327r1_rule\",\"medium\",null,null,\"For site-to-site VPN, for accounts using password authentication, the VPN Gateway must use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.\",\"SRG-NET-000400-VPN-001940\",\"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nThe information system must specify the hash algorithm used for authenticating passwords. Implementation of this requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GOcfn7YCnFViHL4Sv9yLScid+jFSlnVek7L1omc1Mjw=\"},\"C-96029r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:4MYR7ku3/EgXleyLtcxftc2BDi8OAuC5GMzuGE2BIhY=\"},\"F-102873r1_fix\",\"V-97191\",\"medium\",\"SRG-NET-000492-VPN-001980\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41782,\"SV-106329r1_rule\",\"medium\",null,null,\"The VPN Gateway must generate log records when successful and/or unsuccessful VPN connection attempts occur.\",\"SRG-NET-000492-VPN-001980\",\"Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\\n\\nLog records can be generated from various components within the information system (e.g., module or policy filter).\\n\\nThis requirement only applies to components where this is specific to the function of the device, such as application layer gateway (ALG), which provides these access control and auditing functions on behalf of an application. This does not apply to audit logs generated on behalf of the device itself (management).\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D0/SC7O2V3JZ4+Sewx7Qn6Z7ZSrkdje8orXuKxcEjpo=\"},\"C-96031r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:NNq3b5rAHl25ZbWpIy/Y+Q7WJgEfjrSCsg45dAZ/hYA=\"},\"F-102875r1_fix\",\"V-97193\",\"medium\",\"SRG-NET-000510-VPN-002160\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41783,\"SV-106331r1_rule\",\"medium\",null,null,\"The VPN Gateway must use a FIPS-validated cryptographic module to generate cryptographic hashes.\",\"SRG-NET-000510-VPN-002160\",\"FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plain text. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.\\n\\nThe cryptographic module used must have at least one validated hash algorithm. This validated hash algorithm must be used to generate cryptographic hashes for all cryptographic security function within the product being evaluated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GNvczQqQ8RSDNiGZgHykTH9Fl/06XwpsXibtlkPH4AM=\"},\"C-96033r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:wpU2wZ1uyf3RUQgJzjcuMubJFwKQTMsVYABGtyetAu0=\"},\"F-102877r1_fix\",\"V-97195\",\"medium\",\"SRG-NET-000510-VPN-002170\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41784,\"SV-106333r1_rule\",\"medium\",null,null,\"The VPN Gateway must use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.\",\"SRG-NET-000510-VPN-002170\",\"FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plain text. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.\\n\\nThe cryptographic module used must have one FIPS-validated encryption algorithm (i.e., validated Advanced Encryption Standard [AES]). This validated algorithm must be used for encryption for cryptographic security function within the product being evaluated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nrioFfQyWAyHyqPYTDE2+pXaDoeycQE/PjC2vrEL9Jo=\"},\"C-96035r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:zi3v1EJgN7RWCshcZkpIFWwckY19Ow6NkWzZdajmLjM=\"},\"F-102879r1_fix\",\"V-97197\",\"medium\",\"SRG-NET-000510-VPN-002180\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41785,\"SV-106335r1_rule\",\"medium\",null,null,\"The IPsec VPN Gateway IKE must use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.\",\"SRG-NET-000510-VPN-002180\",\"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hDgoEHbOPyCRLlTAZ0Qqx1kkok77I93P01NwpDJNEE8=\"},\"C-96037r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:qUzVSTw+n8v2UFfLxBraBDENI28bgIEBRVGPthivu9U=\"},\"F-102881r1_fix\",\"V-97199\",\"high\",\"SRG-NET-000512-VPN-002220\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41786,\"SV-106337r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway must use Internet Key Exchange (IKE) for IPsec VPN Security Associations (SAs).\",\"SRG-NET-000512-VPN-002220\",\"Without IKE, the SPI is manually specified for each security association. IKE peers will negotiate the encryption algorithm and authentication or hashing methods as well as generate the encryption keys.\\n\\nAn IPsec SA is established using either Internet Key Exchange (IKE) or manual configuration. When using IKE, the security associations are established when needed and expire after a period of time or volume of traffic threshold. If manually configured, they are established as soon as the configuration is complete at both end points and they do not expire. When using IKE, the Security Parameter Index (SPI) for each security association is a pseudo-randomly derived number.\\n\\nWith manual configuration of the IPsec security association, both the cipher key and authentication key are static. Hence, if the keys are compromised, the traffic being protected by the current IPsec tunnel can be decrypted as well as traffic in any future tunnels established by this SA. Furthermore, the peers are not authenticated prior to establishing the SA, which could result in a rogue device establishing an IPsec SA with either of the VPN end points.\\n\\nIKE provides primary authentication to verify the identity of the remote system before negotiation begins. This feature is lost when the IPsec security associations are manually configured, which results in a non-terminating session using static pre-shared keys.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IzzOyrG05CKpFAWFrkEoNJ5rxjb3elkLNtjevgCQdtw=\"},\"C-96039r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:xx84wPMsMSSAo4CeASGVN5MvUIu7DiKqar4aWbsOerA=\"},\"F-102883r1_fix\",\"V-97201\",\"high\",\"SRG-NET-000512-VPN-002230\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41787,\"SV-106339r1_rule\",\"high\",null,null,\"The VPN Gateway must not accept certificates that have been revoked when using PKI for authentication.\",\"SRG-NET-000512-VPN-002230\",\"Situations may arise in which the certificate issued by a Certificate Authority (CA) may need to be revoked before the lifetime of the certificate expires. For example, the certificate is known to have been compromised.\\n\\nWhen an incoming Internet Key Exchange (IKE) session is initiated for a remote client or peer whose certificate is revoked, the revocation list configured for use by the VPN server is checked to see if the certificate is valid; if the certificate is revoked, IKE will fail and an IPsec security association will not be established for the remote endpoint.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GrHgK/pBnHrsn1Seh0qJujIqrWqRLPE0eaA+ZAqQMjo=\"},\"C-96041r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:X8wHzcaz0980HXxuy93EVyk4VDWyVtsDF0WbqVlaX/w=\"},\"F-102885r1_fix\",\"V-97203\",\"medium\",\"SRG-NET-000518-VPN-002280\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41788,\"SV-106341r1_rule\",\"medium\",null,null,\"The VPN Client logout function must be configured to terminate the session on/with the VPN Gateway.\",\"SRG-NET-000518-VPN-002280\",\"If a user cannot explicitly end a session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session.\\n\\nHowever, for some types of interactive sessions including, for example, remote login, information systems typically send logout messages as final messages prior to terminating sessions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+WzKvuFJw2Hd2tINf3CAdDXjeroLc9pIuZQ8rxqAqW8=\"},\"C-96043r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:+tCpOllw27HEiCrQcnfBz1Mp9uGAIFb0WolLkLykCm4=\"},\"F-102887r1_fix\",\"V-97205\",\"medium\",\"SRG-NET-000519-VPN-002290\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41789,\"SV-106343r1_rule\",\"medium\",null,null,\"The VPN Client must display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.\",\"SRG-NET-000519-VPN-002290\",\"If a user cannot explicitly end a session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. Users need to be aware of whether or not the session has been terminated.\\n\\nLogout messages for access, for example, can be displayed after authenticated sessions have been terminated. However, for some types of interactive sessions including, for example, remote login, information systems typically send logout messages as final messages prior to terminating sessions.\\n\\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WFTjVjonYKh95+ufS3SeRtMzKzxvcuYhkuGqLkDzAdQ=\"},\"C-96045r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fy0MhQs22gOsjCy8Ui4Xr8MpXyFw2N5p7qTSc67sOzM=\"},\"F-102889r1_fix\",\"V-97207\",\"medium\",\"SRG-NET-000522-VPN-002320\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41790,\"SV-106345r1_rule\",\"medium\",null,null,\"For site-to-site VPN Gateway must store only cryptographic representations of Pre-shared Keys (PSKs).\",\"SRG-NET-000522-VPN-002320\",\"Pre-shared keys need to be protected at all times, and encryption is the standard method for protecting passwords. If PSKs are not encrypted, they can be plainly read and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\\n\\nPSKs used for site-to-site VPNs are considered by the SRG as a type of password. If this shared secret is already encrypted and not in plaintext, this meets this requirement. This requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption. This method uses a one-way hashing encryption algorithm with a salt value to validate a user's password without having to store the actual password. Performance and time required to access are factors that must be considered, and the one-way hash is the most feasible means of securing the password and providing an acceptable measure of password security.\\n\\nUse a keyed hash message authentication code (HMAC). HMAC calculates a message authentication code via a cryptographic hash function used in conjunction with an encryption key. The key must be protected as with any private key.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WvHtCxF8aHRpizWQnHhcRWZ2GSo4LpYF4C+7vAKUMGY=\"},\"C-96047r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:lOGJxdtWr9FVthiaj/+UbIRNwkTQqM0TzcIWviq/0Jk=\"},\"F-102891r1_fix\",\"V-97209\",\"high\",\"SRG-NET-000525-VPN-002330\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41791,\"SV-106347r1_rule\",\"high\",null,null,\"The IPsec VPN must use Advanced Encryption Standard (AES) encryption for the IPsec proposal to protect the confidentiality of remote access sessions.\",\"SRG-NET-000525-VPN-002330\",\"Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\\n\\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\\n\\nA block cipher mode is an algorithm that features the use of a symmetric key block cipher algorithm to provide an information service, such as confidentiality or authentication.\\n\\nAES is the FIPS-validated cipher block cryptographic algorithm approved for use in DoD. For an algorithm implementation to be listed on a FIPS 140-2 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. Currently, NIST has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hK46dRZBIlXNdxH/0rgMhBXqrBF8nwMTFp1UUvsZ2/w=\"},\"C-96049r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:f3H1Fnk3Mq9sTlW4p0spIywjLsmMT5ZgZN+1SV7bU2U=\"},\"F-102893r1_fix\",\"V-97211\",\"medium\",\"SRG-NET-000530-VPN-002340\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41792,\"SV-106349r1_rule\",\"medium\",null,null,\"The TLS VPN Gateway that supports Government-only services must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.\",\"SRG-NET-000530-VPN-002340\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nThis requirement applies to TLS gateways (also known as SSL gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Oyy/mFzHcQy1sAgTQ9gS+b99/s9IcmH4xTl+n0Pf6Rw=\"},\"C-96051r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:tG7QZxAuAcqmA4gmuAeWEA9ZEnLVfGT5NFaUDibQfFE=\"},\"F-102895r1_fix\",\"V-97213\",\"medium\",\"SRG-NET-000540-VPN-002350\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41793,\"SV-106351r1_rule\",\"medium\",null,null,\"The TLS VPN Gateway that supports citizen- or business-facing network devices must prohibit client negotiation to SSL 2.0 or SSL 3.0.\",\"SRG-NET-000540-VPN-002350\",\"Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\\n\\nThis requirement applies to public-facing or external-facing devices such as TLS gateways (also known as SSL gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance.\\n\\nThe minimum TLS version required by DoD is 1.2. However, devices and applications may allow client negotiation for systems supporting citizen- and business-facing applications. These devices may be configured to support TLS version 1.1 and 1.0 to enable interaction with citizens and businesses. These devices must not support SSL version 3.0 or earlier.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0WoWCtzpWtYJ2vxCT7vXvLruiskYzBOwEVdaxJWlGbM=\"},\"C-96053r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:nHHSH5iwaGyboJNtWTygHWn0yTU3Rug61FYQH6Ni/Ek=\"},\"F-102897r1_fix\",\"V-97215\",\"medium\",\"SRG-NET-000550-VPN-002360\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41794,\"SV-106353r1_rule\",\"medium\",null,null,\"The VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.\",\"SRG-NET-000550-VPN-002360\",\"Without device-to-device authentication, communications with malicious devices may be established. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk.\\n\\nSNMPv3 supports authentication, authorization, access control, and privacy while previous versions of the protocol contained well-known security weaknesses, which were easily exploited. SNMPv3 can be configured for identification and bidirectional, cryptographically based authentication.\\n\\nA typical SNMP implementation includes three components: Managed device, SNMP agent, and NMS. The SNMP agent is the SNMP process that resides on the managed device and communicates with the network management system. The NMS is a combination of hardware and software that is used to monitor and administer a network. The SNMP data is stored in a highly-structured, hierarchical format known as a management information base (MIB). The SNMP manager collects information about network connectivity, activity, and events by polling managed devices.\\n\\nSNMPv3 defines a user-based security model (USM), and a view-based access control model (VACM). SNMPv3 USM provides data integrity, data origin authentication, message replay protection, and protection against disclosure of the message payload. SNMPv3 VACM provides access control to determine whether a specific type of access (read or write) to the management information is allowed. Implement both VACM and USM for full protection.\\n\\nSNMPv3 server services must not be configured on products whose primary purpose is not to provide SNMP services. SNMP client services may be configured on the VPN gateway, application, or operating system to allow limited monitoring or querying of the device from by an SNMP server for management purposes. SNMP of any version will not be used to make configuration changes to the device. SNMPv3 must be disabled by default and enabled only if used. SNMP v3 provides security feature enhancements to SNMP, including encryption and message authentication.\\n\\nCurrently, the AES cipher block algorithm can be used for both applying cryptographic protection (e.g., encryption) and removing or verifying the protection that was previously applied (e.g., decryption) in DoD. The use of FIPS-approved algorithms for both cryptographic mechanisms is required. If any version of SNMP is used for remote administration, default SNMP community strings such as “public” and “private” should be removed before real community strings are put into place. If the defaults are not removed, an attacker could retrieve real community strings from the device using the default string.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RFq+xtylI0rdth+CO8xXpnUCA7eBYGNXjStRxU/Sh2g=\"},\"C-96055r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:snkiXNFPpO0+kw0zQco5SKVgkORHDhyOH3PpUq4/k30=\"},\"F-102899r1_fix\",\"V-97217\",\"high\",\"SRG-NET-000565-VPN-002390\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41795,\"SV-106355r1_rule\",\"high\",null,null,\"The VPN Gateway must use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.\",\"SRG-NET-000565-VPN-002390\",\"Use of improperly configured or lower assurance equipment and solutions could compromise high-value information.\\n\\nThe National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by the National Institute of Standards and Technology (NIST) and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future Suite B implementations.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p7UCHJrDUnFC2jp6mXGtSAilZeT3BjF1NVmG5ykWcy4=\"},\"C-96057r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:KIex1ZGWMlFIxubnYXqgVjEDQ6/8SNR9c5AVbsZNKEA=\"},\"F-102901r1_fix\",\"V-97219\",\"high\",\"SRG-NET-000565-VPN-002400\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41796,\"SV-106357r1_rule\",\"high\",null,null,\"The IPsec VPN Gateway Internet Key Exchange (IKE) must use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.\",\"SRG-NET-000565-VPN-002400\",\"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\\n\\nRFC 6379 Suite B Cryptographic Suites for IPsec defines four cryptographic user interface suites for deploying IPsec. Each suite provides choices for Encapsulating Security Payload (ESP) and IKE. The four suites are differentiated by the choice of IKE authentication and key exchange, cryptographic algorithm strengths, and whether ESP is to provide both confidentiality and integrity or integrity only. The suite names are based on the Advanced Encryption Standard (AES) mode and AES key length specified for ESP. Two suites are defined for transporting classified information up to SECRET level—one for both confidentiality and integrity and one for integrity only. There are also two suites defined for transporting classified information up to TOP SECRET level.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F8wZynyPCZXbSCQKsDAa3RDhSkunUmMAhgYUP9Yu014=\"},\"C-96059r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:sJ4ufacKRyx88U9iliMjZLvETY3nQgVUnTBTVlqZ1YA=\"},\"F-102903r1_fix\",\"V-97221\",\"medium\",\"SRG-NET-000580-VPN-002410\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41797,\"SV-106359r1_rule\",\"medium\",null,null,\"The VPN Gateway must validate certificates used for Transport Layer Security (TLS) functions by performing RFC 5280-compliant certification path validation.\",\"SRG-NET-000580-VPN-002410\",\"A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate.\\n\\nCertification path validation includes checks such as certificate issuer trust, time validity, and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WOsWkwp7rHKriDcEPQi1g0VQp3X0XA14Kw+soZYNvnw=\"},\"C-96061r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:jLNfObMjTtI/+Xyh7vDwZR17rLmudLzlz6NwxhVITKs=\"},\"F-102905r1_fix\",\"V-97223\",\"medium\",\"SRG-NET-000585-VPN-002420\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41798,\"SV-106361r1_rule\",\"medium\",null,null,\"The VPN Gateway must use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).\",\"SRG-NET-000585-VPN-002420\",\"Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Use only SHA-2 for Digital signature generation applications and functions. SHA-2 is strongly preferred for use by DoD for non-signature generation functions.\\n\\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \\n\\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\\n\\nFor digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use only if needed for business critical applications.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5JYnVzed7VNQLssmYLnmi+secKLvHnAiNpVnw5LnOy0=\"},\"C-96063r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:0MUtJg0aE03Glc9kBOBNI3y2a6+ptn7NTc3Xse+sN6w=\"},\"F-102907r1_fix\",\"V-97225\",\"medium\",\"SRG-NET-000075-VPN-000260\",null,null,null,null,null,\"VPN_SRG_TEST-1-1\",41799,\"SV-106363r1_rule\",\"medium\",null,null,\"If the site-to-site VPN implementation uses L2TP, L2TPv3 sessions must be authenticated prior to transporting traffic.\",\"SRG-NET-000075-VPN-000260\",\"L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP tunnels can also carry IP packets that are very difficult to filter because of the additional encapsulation. Hence, it is imperative that L2TP sessions are authenticated prior to transporting traffic.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_OTHER-2-2\",41800,\"SV-106179r1_xxxx\",\"medium\",null,null,\"This rule title has been replaced.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"C-95879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fgzhbaQbILFSeEwIwlOogRZtoeuNS7Kr0AHwx84IKLg=\"},\"F-102723r1_fix\",\"V-97043\",\"medium\",\"SRG-NET-000041-VPN-000110\",null,null,null,null,null,\"VPN_SRG_OTHER-2-2\",41801,\"SV-106181r1_xxxx\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.\",\"SRG-NET-000041-VPN-000110\",\"Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n \\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_Rule-fingerprint-match-test-2-2\",41802,\"SV-106179r1_xxxx\",\"medium\",null,null,\"This rule title has been replaced.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_Rule-fingerprint-match-test-2-2\",41803,\"SV-106179r1_zzzzzz\",\"medium\",null,null,\"This rule title has been replaced.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"C-95879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fgzhbaQbILFSeEwIwlOogRZtoeuNS7Kr0AHwx84IKLg=\"},\"F-102723r1_fix\",\"V-97043\",\"medium\",\"SRG-NET-000041-VPN-000110\",null,null,null,null,null,\"VPN_SRG_Rule-fingerprint-match-test-2-2\",41804,\"SV-106181r1_xxxx\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.\",\"SRG-NET-000041-VPN-000110\",\"Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n \\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"C-95877r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:/GQ9JEWlFc49+/bLZh9fk+PqUIpoBKVqC04V+K5CMas=\"},\"F-102721r1_fix\",\"V-97041\",\"medium\",\"SRG-NET-000019-VPN-000040\",null,null,null,null,null,\"VPN_SRG_TEST_Batch-1-1\",41805,\"SV-106179r1_rule\",\"medium\",null,null,\"The VPN Gateway must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.\",\"SRG-NET-000019-VPN-000040\",\"Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\\n\\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.\",\"10.0\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:slm2UFIqnUUPyOpfIcsxSew4LGvsTesU9C6Ju5XJ3mw=\"},\"C-95879r1_chk\",\"false\",null,null,{\"type\":\"Buffer\",\"data\":\"base64:fgzhbaQbILFSeEwIwlOogRZtoeuNS7Kr0AHwx84IKLg=\"},\"F-102723r1_fix\",\"V-97043\",\"medium\",\"SRG-NET-000041-VPN-000110\",null,null,null,null,null,\"VPN_SRG_TEST_Batch-1-1\",41806,\"SV-106181r1_rule\",\"medium\",null,null,\"The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.\",\"SRG-NET-000041-VPN-000110\",\"Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\\n\\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\\n\\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\\n\\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\\n\\n\\\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\\\"\\n \\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\\n\\n\\\"I've read & consent to terms in IS user agreem't.\\\"\",\"10.0\"]\n{\"table\":\"review\",\"columns\":\"`assetId`,`autoResult`,`checkDigest`,`comment`,`detail`,`metadata`,`resultEngine`,`resultId`,`reviewId`,`ruleId`,`statusId`,`statusText`,`statusTs`,`statusUserId`,`ts`,`userId`,`version`\",\"rowCount\":2}\n[42,false,{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"\",\"test batch\",\"{}\",\"{\\\"type\\\": \\\"other\\\", \\\"product\\\": \\\"test\\\"}\",3,1,\"SV-106179r1_rule\",1,null,\"2022-10-30 20:36:40\",87,\"2022-10-25 22:37:46\",87,\"SRG-NET-000019-VPN-000040\"]\n[154,false,{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"test\",\"test\",\"{}\",null,4,2,\"SV-106179r1_rule\",1,null,\"2022-10-30 18:41:18\",87,\"2022-10-30 18:41:18\",87,\"SRG-NET-000019-VPN-000040\"]\n{\"table\":\"review_history\",\"columns\":\"`autoResult`,`comment`,`detail`,`historyId`,`resultEngine`,`resultId`,`reviewId`,`ruleId`,`statusId`,`statusText`,`statusTs`,`statusUserId`,`touchTs`,`ts`,`userId`\",\"rowCount\":1}\n[false,\"\",\"test batch\",1629,null,3,1,\"SV-106179r1_rule\",0,null,\"2022-10-25 22:37:46\",87,\"2022-10-25 22:37:46\",\"2022-10-25 22:37:46\",87]\n{\"table\":\"revision\",\"columns\":\"`active`,`benchmarkDate`,`benchmarkDateSql`,`benchmarkId`,`checkCount`,`description`,`fixCount`,`groupCount`,`highCount`,`lowCount`,`marking`,`mediumCount`,`release`,`revId`,`status`,`statusDate`,`version`\",\"rowCount\":7}\n[1,\"31 Mar 2020\",\"2020-03-31\",\"RHEL_7_STIG_TEST\",247,\"This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.\",247,247,29,14,null,201,\"0.3\",\"RHEL_7_STIG_TEST-3-0.3\",\"draft\",\"2020-03-27\",3]\n[1,\"19 Jul 2001\",\"2001-07-19\",\"VPN_SRG_OTHER\",2,\"This description replaces the old description\",2,2,0,0,null,2,\"2\",\"VPN_SRG_OTHER-2-2\",\"accepted\",\"2001-07-26\",2]\n[1,\"19 Jul 2001\",\"2001-07-19\",\"VPN_SRG_Rule-fingerprint-match-test\",3,\"This description replaces the old description\",3,3,0,0,null,3,\"2\",\"VPN_SRG_Rule-fingerprint-match-test-2-2\",\"accepted\",\"2001-07-26\",2]\n[1,\"19 Jul 2019\",\"2019-07-19\",\"VPN_SRG_TEST_Batch\",2,\"This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",2,2,0,0,null,2,\"1\",\"VPN_SRG_TEST_Batch-1-1\",\"accepted\",\"2019-07-26\",1]\n[1,\"19 Jul 2010\",\"2010-07-19\",\"VPN_SRG_TEST\",81,\"This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",81,81,11,7,null,63,\"0\",\"VPN_SRG_TEST-1-0\",\"accepted\",\"2010-07-26\",1]\n[1,\"19 Jul 2019\",\"2019-07-19\",\"VPN_SRG_TEST\",81,\"This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",81,81,11,7,null,63,\"1\",\"VPN_SRG_TEST-1-1\",\"accepted\",\"2019-07-26\",1]\n[1,\"17 Jun 2020\",\"2020-06-17\",\"Windows_10_STIG_TEST\",287,\"The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.\",287,287,26,18,null,243,\"23\",\"Windows_10_STIG_TEST-1-23\",\"accepted\",\"2020-06-15\",1]\n{\"table\":\"rule_version_check_digest\",\"columns\":\"`checkDigest`,`ruleId`,`version`\",\"rowCount\":619}\n[{\"type\":\"Buffer\",\"data\":\"base64:nkk6VkjluuUxkzsszOk8eTgHlUakS2R/bR95QTwbAM8=\"},\"SV-204392r241939_rule\",\"RHEL-07-010010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:iSqVW4RiHyBVvrAYsGNx9SrOT+nAF6gnNHhGSMv/OPg=\"},\"SV-214799r241939_rule\",\"RHEL-07-010020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:t3pLu4RByPjTmSyEGSrDsv2WpOjBnMxFcux4WTKpzsg=\"},\"SV-204393r241939_rule\",\"RHEL-07-010030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b7cLLXAJwWiYlb+ZLVM/YmYEKrJOElbc2DI7KzdElaY=\"},\"SV-204394r241939_rule\",\"RHEL-07-010040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9ShQfZRP37ZylVTOj7a7tmzPRP/DZmVauIWv5cK5IgU=\"},\"SV-204395r241939_rule\",\"RHEL-07-010050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Eg7oETP6JdEiW9fWb3CWsCNr1Ee+e9COo/1vPyjLJyA=\"},\"SV-204396r241939_rule\",\"RHEL-07-010060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v8r3y4wndT3MrdoqZ+IXfrOkoGx9bEvFFDEL4eMv6bI=\"},\"SV-204397r241939_rule\",\"RHEL-07-010061\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:M7pACkppJDi/CsMl2CmLoXQL4s2zAFRVxqwbrcNQ3+k=\"},\"SV-214937r241939_rule\",\"RHEL-07-010062\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4Vhryn3qYojwlbzNOTBxhlYOCH+6lGP9nQktKh5cvso=\"},\"SV-204398r241939_rule\",\"RHEL-07-010070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9A9hqWAZ5NS1n2W3Z6epeuVuWBbbbPCEc/zuKz7IiSM=\"},\"SV-204399r241939_rule\",\"RHEL-07-010081\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1r/d1v914jFv+PeIiRAnO8w+OdA0cucmU9N4uS9npIU=\"},\"SV-204400r241939_rule\",\"RHEL-07-010082\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BdYvtV85bZiRNU3aVsf9P0v0mUKO7gFFdyTulpf63UA=\"},\"SV-204401r241939_rule\",\"RHEL-07-010090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SJj4kDOYlogEinGYl4UBtzYvD0sUOtC0Zc+GkbM/nQg=\"},\"SV-204402r241939_rule\",\"RHEL-07-010100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wLqPaWBvxUmRKRMMSiJj2pj0F8NCk7mvWKECb9jxRgw=\"},\"SV-204403r241939_rule\",\"RHEL-07-010101\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:orUMwfifYhVDl5eCyl7LEBXY8R0QtYf4FB3AikYOR0Q=\"},\"SV-204404r241939_rule\",\"RHEL-07-010110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:87KK1t2KJmsVqwDVxcvH3F6erHGSjt6gU3lODHDY4FI=\"},\"SV-204405r241939_rule\",\"RHEL-07-010118\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NVVlZz6DnbTO6YEa+HkLTRE6ApJBkX8N7oXza495krA=\"},\"SV-204406r241939_rule\",\"RHEL-07-010119\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZZsZT55sjZiOw8YvdeG/PuTRrOJNXQ9fXpNFx1alZS0=\"},\"SV-204407r241939_rule\",\"RHEL-07-010120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5mP42vXD7dbHMk2adGpM5o78xd9tfHYGp4AY1olXPug=\"},\"SV-204408r241939_rule\",\"RHEL-07-010130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+ZxB96680QpTXOUhL+JNnhQFv/FKeRTfkrvRL3PV5S8=\"},\"SV-204409r241939_rule\",\"RHEL-07-010140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:abrw002NXrRQ66PzmbZYPT3hHRpQytzeYoaeJHhVEhU=\"},\"SV-204410r241939_rule\",\"RHEL-07-010150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CKBfpvZELPLxUExAGYDADab38Se08BtvG5UpBNIazBI=\"},\"SV-204411r241939_rule\",\"RHEL-07-010160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wHEY2x4CvlXeh/wo8XesGOqxBrsYGWbUXOPbniv8Eec=\"},\"SV-204412r241939_rule\",\"RHEL-07-010170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:50yiX31ofIr+hd8aTkGds0o0cG1XWzi9CajHGO80y9s=\"},\"SV-204413r241939_rule\",\"RHEL-07-010180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:B5/JCBM3+y8mI0Wx//3vcvLxaBJUTuafPhnRMesP9F4=\"},\"SV-204414r241939_rule\",\"RHEL-07-010190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:EWkE5ArbnCtRXt1tYfKaQZxY82bf5+ySftE5x3A7rUw=\"},\"SV-204415r241939_rule\",\"RHEL-07-010200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:szDJRfipxjLUpU4siSaUz52MOYPESOCSPqgSYGrG8h8=\"},\"SV-204416r241939_rule\",\"RHEL-07-010210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:37jX9s+legYelkYfnf62nyYfMX4Svx6S53TO09s9e7U=\"},\"SV-204417r241939_rule\",\"RHEL-07-010220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+bzaAS/aDWQDJP8ZUOuMk/ISS9nWHhkC1peC0GEcbKo=\"},\"SV-204418r241939_rule\",\"RHEL-07-010230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MrAAW3p9KHUSNIIDH94flLWi6pGLzydp9PgU+RlvGC4=\"},\"SV-204419r241939_rule\",\"RHEL-07-010240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aD2m4e2s0uh65x94BQAdZnXh7LZzUYWOg1jlF0xaYe4=\"},\"SV-204420r241939_rule\",\"RHEL-07-010250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Xq5u0Pw/Zw4wuAxFngAnRjHsza6G0aVM5vVkmV9EUkw=\"},\"SV-204421r241939_rule\",\"RHEL-07-010260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N2xDTbhTE+RFh0/Sm++3xu/AV9xHzSY7hXbPJaaNeEk=\"},\"SV-204422r241939_rule\",\"RHEL-07-010270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wnEfB+iBnuzOMM868Vy5hLj72C0iU0CFAkGqCn3lcV8=\"},\"SV-204423r241939_rule\",\"RHEL-07-010280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dxEV5bGuHZP4iVsWXTtnKnb7HW9YuqytYqEfO4SaQlk=\"},\"SV-204424r241939_rule\",\"RHEL-07-010290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fGovMAyL0HmlG0cv8i7GIrnPdYDI2Uu2j1CXqheXU6U=\"},\"SV-204425r241939_rule\",\"RHEL-07-010300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HWvW+5i4DGfbBRQ5ePFMe8hnoLMZwFwyu8jP8qD13B4=\"},\"SV-204426r241939_rule\",\"RHEL-07-010310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:H9mT1qdHOp9+ZyEy2fFxjTE/8tI1xhFtEvJORCJqd1k=\"},\"SV-204427r241939_rule\",\"RHEL-07-010320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oD6nmwpiJW9D5Cp/XXFX9UYRA755KWJpjrae9YSJLcA=\"},\"SV-204428r241939_rule\",\"RHEL-07-010330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GEhzlPPnk+CAcWnOXaLRDP95b6T65/xq1qVqL/b84vw=\"},\"SV-204429r241939_rule\",\"RHEL-07-010340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SxSLBVVTtBtxKalJaRaw/6lgbVU0UOBOkgcTTRhHxD8=\"},\"SV-204430r241939_rule\",\"RHEL-07-010350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+hZzZLys3BX7zWBUfBAVBQPgw6OXD+II7GH5BWOLMCI=\"},\"SV-204431r241939_rule\",\"RHEL-07-010430\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wXo7iqYH5XGZTi7xVyPo9OMFKHuQ4XH2hIqOWqKo2ig=\"},\"SV-204432r241939_rule\",\"RHEL-07-010440\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9DWDKCqiCDCdPaBAR1JnUJ2FgBKkNaNW7tQqAq+dw08=\"},\"SV-204433r241939_rule\",\"RHEL-07-010450\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rBMTU13BrvFeKQ+LVw9CSDaXjsTTmFaQjUCP5WUmK4E=\"},\"SV-204434r241939_rule\",\"RHEL-07-010460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/uoCfeW8Df/g/XGQoBkg5WVbTAykMMBn4oMkJdNUEyA=\"},\"SV-204435r241939_rule\",\"RHEL-07-010470\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PVRLHuZ9kP5FJwKwYPDiChFJ5ZxZtcp0ro/wCh+st1A=\"},\"SV-204436r241939_rule\",\"RHEL-07-010480\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:y7xDq5NT2XNGrsamdbkoYKBvisZGFnS1fyg5AKvdfUQ=\"},\"SV-204437r241939_rule\",\"RHEL-07-010481\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tSZDrM1hWlCATKGgxqXsqEoIbIpJlq97X+0R6excyuQ=\"},\"SV-204438r241939_rule\",\"RHEL-07-010482\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N8tSABUcJlBAkZ3vrmMcMUQscjNj485lQceECmBpBqY=\"},\"SV-204439r241939_rule\",\"RHEL-07-010490\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3DS5zKmPA1/pZTvKSZLzlkwx6ZjRlk5GytGTDgvav+s=\"},\"SV-204440r241939_rule\",\"RHEL-07-010491\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JTVgaY1LZdMLglvZK8C9tixEgj79wwesQdbeHi7a7Rk=\"},\"SV-204441r241939_rule\",\"RHEL-07-010500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mkc5HGb9gHNlg2WnY/djvfYdh8TcEe1wjVMoosFw32o=\"},\"SV-204442r241939_rule\",\"RHEL-07-020000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:L6nJ9zxJTEu9H+NPMBNKXjZF11fxVnKsHJ0WDDygoYg=\"},\"SV-204443r241939_rule\",\"RHEL-07-020010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pp7LtbhvevdAe+ue4EVnM1uccxy7pW3XZ+xC9xFfmNk=\"},\"SV-214800r241939_rule\",\"RHEL-07-020019\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sfB3iHYcODrsGQIdQzi9S4OiWXlzCjwowCqvtusaGKY=\"},\"SV-204444r241939_rule\",\"RHEL-07-020020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:toAqPFxuUxre2EEjoCzKlhcSnOb9RFpEln3MtuVIT9Q=\"},\"SV-204445r241939_rule\",\"RHEL-07-020030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NzJUcxxFJi8pit5evzZxnwQLQXWBf4/ftLMFNB6yiGw=\"},\"SV-204446r241939_rule\",\"RHEL-07-020040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i6TlhYJkq+XnxoK0jdYhyvmrG0/kVGWgegQHFyIbH8Y=\"},\"SV-204447r241939_rule\",\"RHEL-07-020050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SKIqa4iromN1/ld/zYxiQSOEbtGDJiFaQ30mjK6UgUY=\"},\"SV-204448r241939_rule\",\"RHEL-07-020060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/bMIprnmuyHCZfwMhN53JacAU9Bw8vUNAz6FpcIsWeU=\"},\"SV-204449r241939_rule\",\"RHEL-07-020100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7C8lXVeU00V8ySil2p6/I+nVauuGAbjK42d5ow1J2Y4=\"},\"SV-204450r241939_rule\",\"RHEL-07-020101\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fvHgDUJGBMB+FLi/4z9egnoRgc5XNsyChWvVL+OV66I=\"},\"SV-204451r241939_rule\",\"RHEL-07-020110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ECU3PcokYJ0iTOaeFC4vceGeElsR/zrQCO1UeE3DreQ=\"},\"SV-204452r241939_rule\",\"RHEL-07-020200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mc80MJb4r7Qc8AmVFz9tOOJczWkzT3PVQISn5ZtRXSE=\"},\"SV-204453r241939_rule\",\"RHEL-07-020210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qFfBME/2o77yTMuxtpA4P0I8o2NQnfoVfThRiWzo6Lk=\"},\"SV-204454r241939_rule\",\"RHEL-07-020220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F70pc4lFutrB1aZSKBDOLu0diT12WqlYfaQrxFvOlBg=\"},\"SV-204455r241939_rule\",\"RHEL-07-020230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:brL/cUNHx6LqwmVc7ML2OUn/P9TF3UTZ+dZ6dn6tjNY=\"},\"SV-204456r241939_rule\",\"RHEL-07-020231\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:41T5JYxmVoKU+kVdsnjUa+6f5+dfkDIeSb6GFuUm5Dw=\"},\"SV-204457r241939_rule\",\"RHEL-07-020240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BKBVXasUfiVr7ygcFP+LUlFT+KaO5mryWRKA5v63Lzg=\"},\"SV-204458r241939_rule\",\"RHEL-07-020250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gzK9MUt7PjwGBJ/p/j6hcmkkkGmVE6qTD/BqPIvnN/E=\"},\"SV-204459r241939_rule\",\"RHEL-07-020260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BIJOSScjxtLqA/SKv6NkIB3IGMa3Q+LPB+L/geOe7ok=\"},\"SV-204460r241939_rule\",\"RHEL-07-020270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Xk8zYUvsnzovMiPLfQR6KgfXOkgeBn2KDtxaaMW0pGs=\"},\"SV-204461r241939_rule\",\"RHEL-07-020300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mmPdRsWMT1RXStEFvhbFi2NPQhPau7t1mLPRqSfrlso=\"},\"SV-204462r241939_rule\",\"RHEL-07-020310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MCpiixKAw6iysD7QdBwvf/0nHCrKyrAMLWQ4JNX0Bl4=\"},\"SV-204463r241939_rule\",\"RHEL-07-020320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PkSBdKqiF+1CoNw6WAjSOHw0QMu48lpgS7hmAFLNKw8=\"},\"SV-204464r241939_rule\",\"RHEL-07-020330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DgsJDDQVqbrezHTaPjQzaqTduH3lEoKAMNNMCRj803k=\"},\"SV-204465r241939_rule\",\"RHEL-07-020600\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nJKpEfqumuAlnJnurMfT8V8fSO3ydCuFSVHs1UY9GPo=\"},\"SV-204466r241939_rule\",\"RHEL-07-020610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KjHexj1LNSBP7CHmbNY3vvDc8KQeFRj4apAjjK7uRz8=\"},\"SV-204467r241939_rule\",\"RHEL-07-020620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IUowyh9fpAWNacEDCWcoW0ywTTeAFy1QJWtS37N3CvU=\"},\"SV-204468r241939_rule\",\"RHEL-07-020630\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RVZyk6n7GgpVN69UGZjh42yXz3qHC+E11xMgNQqKqeA=\"},\"SV-204469r241939_rule\",\"RHEL-07-020640\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4jt4mkKBzSe4CWKOCChBtcLEVdWyrxsrtYUDQqOWPb4=\"},\"SV-204470r241939_rule\",\"RHEL-07-020650\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AK8GPupR9o9w4Bpqm2vkAfSZfDDOTxHxIQYgJ4RNCtU=\"},\"SV-204471r241939_rule\",\"RHEL-07-020660\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CUecwNXz6GFSUPJZXW1ugeOxM+oEICWaiuiBIttVcmE=\"},\"SV-204472r241939_rule\",\"RHEL-07-020670\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v1B+Day0uLquC3G3rkAZLvKRlB/UsiRznWww8MhD2Ns=\"},\"SV-204473r241939_rule\",\"RHEL-07-020680\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uxK1tQMsGtXuIVRNHQgns3AeLuOfO8jy94kjoPQ2L+g=\"},\"SV-204474r241939_rule\",\"RHEL-07-020690\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uxK1tQMsGtXuIVRNHQgns3AeLuOfO8jy94kjoPQ2L+g=\"},\"SV-204475r241939_rule\",\"RHEL-07-020700\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vX6dN7EfNthdimlLaFh0Q9z6OmJUHbzovDHwg8c8NHU=\"},\"SV-204476r241939_rule\",\"RHEL-07-020710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nMN0kK1ic7h1eLInaM6SrG+c+t8cGPkmMerp3/LQra8=\"},\"SV-204477r241939_rule\",\"RHEL-07-020720\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Jjjq7xVAWflOe4CoFgZpUiv9Y1NWKcp73tzANZZz+gw=\"},\"SV-204478r241939_rule\",\"RHEL-07-020730\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:X06vDs2tR3QGoQ+xoPHCwRpZHEYU9e6HRZHfgAas1TE=\"},\"SV-204479r241939_rule\",\"RHEL-07-020900\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rTAfVwmsa16lr6s7L1HVMt53f8c4APqViMHCPG3PQ0c=\"},\"SV-204480r241939_rule\",\"RHEL-07-021000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oNIXrV8IrUz3LBKHcpc5OkB5AAV30a49EWBJw8tFGRI=\"},\"SV-204481r241939_rule\",\"RHEL-07-021010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:u7P2t9CBo4bVxiR7YZbGpIUx/LFmWm/tqN+oNRgHAME=\"},\"SV-204482r241939_rule\",\"RHEL-07-021020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bNGETuyi+t5ZcClrjc42GS9cWGj/6HLIX7UykCKyI9I=\"},\"SV-204483r241939_rule\",\"RHEL-07-021021\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+rITfa9uPWXKr2BTckVmwYe0uqE2Xqu4VJaGlyUb/tU=\"},\"SV-204484r241939_rule\",\"RHEL-07-021022\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c76gZ1SY4u9l79FnrsQHACwNc4CL62N+zPqo7zmpzkA=\"},\"SV-204485r241939_rule\",\"RHEL-07-021023\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+Cd2E8o4ONaUdrAAVpMr0bFQJFkRt9EDcw+xhFpcySU=\"},\"SV-204486r241939_rule\",\"RHEL-07-021024\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:68kXW4hDQ+wT9SdXi8wMj/sov4EvnCOjABVhUZDBnBo=\"},\"SV-204487r241939_rule\",\"RHEL-07-021030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1XgmUIRB6alinIiV63h8l4a4c+FpBsGbCgpB3sm/gQ4=\"},\"SV-204488r241939_rule\",\"RHEL-07-021040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MnVJuhcg4+npgMSzOK+ZI3jYbv9R79L3Pw0sG4OGjuY=\"},\"SV-204489r241939_rule\",\"RHEL-07-021100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hAE8/s/q+2bPxB0JEqCor5YiRwtPpCKQTpKO19s+CsE=\"},\"SV-204490r241939_rule\",\"RHEL-07-021110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2dsipNSSkkuhCPSuvfUEnxPPKLhEefb0wQ5pWOxGi1s=\"},\"SV-204491r241939_rule\",\"RHEL-07-021120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ouKxFOOPpBEfihfWTLMVhsHI14OUZyPa8UIIzq+9aDM=\"},\"SV-204492r241939_rule\",\"RHEL-07-021300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7PN7qrWKJmcvXiHYyWoVhaf0vMJwkBzlYvMLMqakubE=\"},\"SV-204493r241939_rule\",\"RHEL-07-021310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1cCc49bcm+M75v2YFAybr7leYSlE+gJkFfU7F/sl09M=\"},\"SV-204494r241939_rule\",\"RHEL-07-021320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XJvN48pmi8HAcsDkJM/G14Kd6I6pzdqyNmh7aTUWPog=\"},\"SV-204495r241939_rule\",\"RHEL-07-021330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:18y0TK+OVu1ckq6VVHACpujYOUOuHE9k0lnFU7vZePY=\"},\"SV-204496r241939_rule\",\"RHEL-07-021340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Eqvpa3O8L/43+F/dfd3RCBJOqej2+xWuUq9l9HGqyf8=\"},\"SV-204497r241939_rule\",\"RHEL-07-021350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gqquU+6877zdN2QBJVLYBJLAgY9YaeAMGXWhfOMdJDc=\"},\"SV-204498r241939_rule\",\"RHEL-07-021600\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BuBYuHuQAvXuOxcqP3DStX9B4QilMV8GArQJSwKL4qk=\"},\"SV-204499r241939_rule\",\"RHEL-07-021610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nqqG2GW71CBVy4Zbpx5pP8sJyDtQRHFZG9xO9W+fhaY=\"},\"SV-204500r241939_rule\",\"RHEL-07-021620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:APlAz7ZItAMZCPrk0PRupBAoTrM5Bx3+9xNBo4579+0=\"},\"SV-204501r241939_rule\",\"RHEL-07-021700\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cp2RMg6QxCqTvmqP37SKwG1FqsgipFxqR3t5FU4PXLk=\"},\"SV-204502r241939_rule\",\"RHEL-07-021710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Z7b6Mm6lUqwXG2sdLSsdV3B3gZr1qR0O9kZkWEmbxrM=\"},\"SV-204503r241939_rule\",\"RHEL-07-030000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qglSyMZMvG/rrLNnILUfVZ3YuFZFi5T6+KZGiWAdQ/A=\"},\"SV-204504r241939_rule\",\"RHEL-07-030010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GlCYNKZ4IKbMHrBwdJyaGeNDUtXvok0O5JQhengD9bI=\"},\"SV-204505r241939_rule\",\"RHEL-07-030200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BqnXskmzv0Fml5dUryA9empCvoF4uJVgP7gSzNJBG5Q=\"},\"SV-204506r241939_rule\",\"RHEL-07-030201\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:l+C+NK9AgsqOtIckjdTH4jH0PdnaS4ciKjpNRfQiUbQ=\"},\"SV-204507r241939_rule\",\"RHEL-07-030210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hcASCCaQ6DCZhsOVgtG2fCLYh13EpBUcl5ehg9PF3Js=\"},\"SV-204508r241939_rule\",\"RHEL-07-030211\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XkQ6DCdOAKS0GwAwhQplZEj8R1FV2bl5hQua4nPED4k=\"},\"SV-204509r241939_rule\",\"RHEL-07-030300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Bf2fWApv0APcqeZ5XF4R3RXo/goqg4pCstdRuIGQtss=\"},\"SV-204510r241939_rule\",\"RHEL-07-030310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:M4dQIiEBGtvfjwdGLgcnbZPAohqROn1I34DQD4YRp64=\"},\"SV-204511r241939_rule\",\"RHEL-07-030320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3wu6Xlq+C0xzTcZhVKXS6/ol6uXxhMPvS8I8O+1XaqI=\"},\"SV-204512r241939_rule\",\"RHEL-07-030321\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aflWrGGmEaadkYGyiV9fTBb/AxbzyQb2JEc+iSI+NkM=\"},\"SV-204513r241939_rule\",\"RHEL-07-030330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ltVAshO8pttoqEyqG6qijiNJqOl2Qg26et8YkE7jF5s=\"},\"SV-204514r241939_rule\",\"RHEL-07-030340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Uw4E5/qhIYn2a7XqoO/vCVOGSvxQjO5QMCJ7MHUh3po=\"},\"SV-204515r241939_rule\",\"RHEL-07-030350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pb9zyKyDrGizMm2SQJsP9iE6S0NT/TD/ykIFMramKTU=\"},\"SV-204516r241939_rule\",\"RHEL-07-030360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tfgd6xmJ2tetubGheG+rBYQusickUOomvWf+fpjbT7Q=\"},\"SV-204517r241939_rule\",\"RHEL-07-030370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IRTfp4gJecK//m5Q762/0oGsBdPOyjw0rySHurIS8LE=\"},\"SV-204518r241939_rule\",\"RHEL-07-030380\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c3BG+SR2o14aicE+yhq3PtQvfjs3cmTzFbE8tHrvpUA=\"},\"SV-204519r241939_rule\",\"RHEL-07-030390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2XtliP/rksJDS7Xvfpls8GPXpBFZoWsdnTomfRmL9QU=\"},\"SV-204520r241939_rule\",\"RHEL-07-030400\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NQ4XbflQ44GaE3zsieP8DlRi/3mPxweIdroLWHOE4Pg=\"},\"SV-204521r241939_rule\",\"RHEL-07-030410\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ct96QUF8s7jdqE0Ojh304JzeK8kmZYLbQaQReE84rXs=\"},\"SV-204522r241939_rule\",\"RHEL-07-030420\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rDncDz9FOlJO5zuVTZJbynkJ6dX2Vmq6oI6860tKW3g=\"},\"SV-204523r241939_rule\",\"RHEL-07-030430\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8tsf1iL2uCKUxO1hoNkCKyC3IFWiTzlQVJpKPEwK0QI=\"},\"SV-204524r241939_rule\",\"RHEL-07-030440\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SvFkHfPrdOQKr5ne1xqIFighaKbfQ/sihawpHb7p7rA=\"},\"SV-204525r241939_rule\",\"RHEL-07-030450\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xCC65vU4a0dx3uNjyFYVXGG1SRtdEiyjqGvJjghYeow=\"},\"SV-204526r241939_rule\",\"RHEL-07-030460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kE1xvX7cLhAoPe9cvYdrUdLUAfjE7eLXYem3Gw8DNLs=\"},\"SV-204527r241939_rule\",\"RHEL-07-030470\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vnSamAe2+/Hr+nfPkTqL9I0bWVmWTIFQpYfsqnVG9F8=\"},\"SV-204528r241939_rule\",\"RHEL-07-030480\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qHpyKM8i0QhH/xmWGRB3HGZ+olnqtUnASbAZecaifiM=\"},\"SV-204529r241939_rule\",\"RHEL-07-030490\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9kmHZoiuoiL6AsWMWz23RZbKzak8ErxyC7YO6g8muqE=\"},\"SV-204530r241939_rule\",\"RHEL-07-030500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QLmTItOwmEnfzdlxDbgeaEgT0GU0Nbb70w5rFh7+ClA=\"},\"SV-204531r241939_rule\",\"RHEL-07-030510\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/PZC/00fiKOLVTTaP7vTKSayzSFdhYJTeG7hNLk4+gE=\"},\"SV-204532r241939_rule\",\"RHEL-07-030520\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jhuvdlST3755aQuU9dw8itd/oBXZUB3VR1y2ygyl5FI=\"},\"SV-204533r241939_rule\",\"RHEL-07-030530\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tA45OvJ+kaPqzTLBG3AsIdZ+y1Fsg6ea5iZ7tEfE1dQ=\"},\"SV-204534r241939_rule\",\"RHEL-07-030540\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aAoxDRfMkHNrqAeotAp74gpKHv9wOXogrgjeQ7eJGQA=\"},\"SV-204535r241939_rule\",\"RHEL-07-030550\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yz9ySMXJdb86u8eDi3onAaj+kp672EFyUXztQ5ZavCQ=\"},\"SV-204536r241939_rule\",\"RHEL-07-030560\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:H82QTLuiCWDcZMXUpQQdTEKNJvGkX6x49d2pDZHpYyU=\"},\"SV-204537r241939_rule\",\"RHEL-07-030570\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ERmkPloadjyA5EWZSqAGmmsmSh9yhFCpxtM/g7u2MVY=\"},\"SV-204538r241939_rule\",\"RHEL-07-030580\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yWWSgcAdr7toWF3W2KVSsJEAivLZ/eCE17DkDnuxdnU=\"},\"SV-204539r241939_rule\",\"RHEL-07-030590\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YXNsFsD1BNTH+UuPUScRJc2/DURz1Fj+3uIcvrRMNdg=\"},\"SV-204540r241939_rule\",\"RHEL-07-030610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lJjp0a4I1yjr202W8rakaUjmlWknnhRtwWTbPOgaIB8=\"},\"SV-204541r241939_rule\",\"RHEL-07-030620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2qmfNcP9ypf8f5/1I1ZWKnvrnO4JwwU1bWjsI78D6KE=\"},\"SV-204542r241939_rule\",\"RHEL-07-030630\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gya/2JPlteqFjlFszdxnLFZfGW3EV7vQah2z8gDWTmo=\"},\"SV-204543r241939_rule\",\"RHEL-07-030640\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gi8ZMeceL+SSmRb14wgW06ZvRE7tuolGOXprwyUf+k0=\"},\"SV-204544r241939_rule\",\"RHEL-07-030650\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9sL5nx6+vlT67EKHKU4R5qqJ5n3moOZWw1AikH8pTXk=\"},\"SV-204545r241939_rule\",\"RHEL-07-030660\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gqtgtLcu9IdW8tgI/Z/PEk9biRBlGBOHv5LMDpPdpL4=\"},\"SV-204546r241939_rule\",\"RHEL-07-030670\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Yez5vz3QxFhKWn3gCF8yxjW5wBeRRzXNuSoPn6GIO0s=\"},\"SV-204547r241939_rule\",\"RHEL-07-030680\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hC1vcQxqT0u80KTFQPLu/SIk7krmukM+EtUTAUW4Q4A=\"},\"SV-204548r241939_rule\",\"RHEL-07-030690\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sTsM/uo7uY/03QywYVZf+XXWwPePPwd6hv1n+aUTiXo=\"},\"SV-204549r241939_rule\",\"RHEL-07-030700\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tU3v9z4QSrPw6soKYZKEo2o/9C6DfQXE4mmzVlVGsw8=\"},\"SV-204550r241939_rule\",\"RHEL-07-030710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:C0RoeHp6aYd9h/bi32FTCOUFtJwNd9lElDmsQIq+wF4=\"},\"SV-204551r241939_rule\",\"RHEL-07-030720\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pafqBQ37fC9z4g2ywAqLpjl+XAFqcgxwjjyxs/Verx4=\"},\"SV-204552r241939_rule\",\"RHEL-07-030740\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:caNUlUAL0QTWs82AAVnnqegh0qk/ScQg+zi9M6mXN3Q=\"},\"SV-204553r241939_rule\",\"RHEL-07-030750\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FS0w5y0Nv2J8GgXgjl0+kwNnGa1SOyKNV0kAzuc0Lhc=\"},\"SV-204554r241939_rule\",\"RHEL-07-030760\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dqcxu/FPpiMQY4drQDT3SVl/Op48vP4lYINaQ/7qycE=\"},\"SV-204555r241939_rule\",\"RHEL-07-030770\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mDysNGysefS+eTvNiUFriD9n8ubTJ8X27LObMHof9qM=\"},\"SV-204556r241939_rule\",\"RHEL-07-030780\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rEz96y1do/MI6pN7zRcF7HR19einFw1A4ikBHs19nzQ=\"},\"SV-204557r241939_rule\",\"RHEL-07-030800\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ady1u6dO6xtC3UnQhdVbuDv992JbS9UEl9bHXFlDfeU=\"},\"SV-204558r241939_rule\",\"RHEL-07-030810\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ktrDKQOFniBjtBla/5sCoFWD4QpBziBp6d3yNj4wSxc=\"},\"SV-204559r241939_rule\",\"RHEL-07-030819\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FKYTZs9Omb9gpZvDDN+VFtmbOEANwAA79jfnk0fdo+4=\"},\"SV-204560r241939_rule\",\"RHEL-07-030820\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DJ473QpyrOIOL4YWEvv/UhC/pdcGoEXF+NICnIw8kXE=\"},\"SV-204561r241939_rule\",\"RHEL-07-030821\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yaISAkFMNlE1gd40ss3E4raZaPutmNF5nUPZxy/dVxE=\"},\"SV-204562r241939_rule\",\"RHEL-07-030830\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oBDs5Z67EFgAVh+xQ4UWmvl8l68JaD3MlIWHxZV7Ivg=\"},\"SV-204563r241939_rule\",\"RHEL-07-030840\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yo+7DvmHZV8hyRCSWad1ZfWbs115vSFezvQEM11an2w=\"},\"SV-204564r241939_rule\",\"RHEL-07-030870\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XCeo82R8xQFLoiWbWwslLhkjyDvBriCPlnTPaVCU0O0=\"},\"SV-204565r241939_rule\",\"RHEL-07-030871\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mregkcdfFGH6lVk6ARZub4pIX77ZBmx54DG508a9aww=\"},\"SV-204566r241939_rule\",\"RHEL-07-030872\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lXRvTRQWN34A1q+mXN0yVv2AZrR0vT3Ts/aM1h5LkOo=\"},\"SV-204567r241939_rule\",\"RHEL-07-030873\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:688w5yaOgi6yS2MMu0BXElzK0Nc1j4e7a91fW45De2A=\"},\"SV-204568r241939_rule\",\"RHEL-07-030874\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:umcgNuAsnB59XSjy1I6U++dXqM23CWYChhlv86x8Xuw=\"},\"SV-204569r241939_rule\",\"RHEL-07-030880\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mE0MJl83yHmgx0kwKQuKZgNSsnJD2tRsSDRy+kJVHUo=\"},\"SV-204570r241939_rule\",\"RHEL-07-030890\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SvB0fmN1dM3PsEjEvg5vyZ0zWzSJPOTnbJAICsSPMMU=\"},\"SV-204571r241939_rule\",\"RHEL-07-030900\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DS0Fydb5T+qrwtZc8yHRMbt0kZVQKXZvEJkk2pfaoa0=\"},\"SV-204572r241939_rule\",\"RHEL-07-030910\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gQjaLKPqvRmJxPutSuCF2raYWv3G7pqqkl4RYi2CQjI=\"},\"SV-204573r241939_rule\",\"RHEL-07-030920\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:189mZdbWFnTmb/pv12S5jXM09zjsiaBRlTlxaxSpVrA=\"},\"SV-204574r241939_rule\",\"RHEL-07-031000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MwPcFaS7XSTh86tBjhVDJe6I76OH8QTJFy8ThExOTCg=\"},\"SV-204575r241939_rule\",\"RHEL-07-031010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9LhzdHuv/khleaS+BQu9ZlUcdjdohBUoq5bjuJZdhK8=\"},\"SV-214801r241939_rule\",\"RHEL-07-032000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DhilIZI4XItLrdeaFbC8ICZgBN1OCgHuPfD1k8e78sc=\"},\"SV-204576r241939_rule\",\"RHEL-07-040000\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:O1hlu7Cy9bkTgUpdl/8swEZmVqrdSxecwRgqIv7TKeI=\"},\"SV-204577r241939_rule\",\"RHEL-07-040100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JDnnCT7i6KXIu1+6ypsCHBmdw6EQtsr4dSd3kFFR2B4=\"},\"SV-204578r241939_rule\",\"RHEL-07-040110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YGctoNEqGYp37D0V7f4JEnaQwZUWRJ16N85m3V1dTA4=\"},\"SV-204579r241939_rule\",\"RHEL-07-040160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kPgd3nZYx8oNc7jNrMPf7SaMkgI7Mpqc+C0Gesho7w0=\"},\"SV-204580r241939_rule\",\"RHEL-07-040170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gICjVQBlC2CyjSEDRHoAr3hm79aABc0TAYCd4cyGREM=\"},\"SV-204581r241939_rule\",\"RHEL-07-040180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IgR19ArnuG58zoGRs25ETsbszS2t2pU66+rmh1ALJZg=\"},\"SV-204582r241939_rule\",\"RHEL-07-040190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7XIsGNddY755GhU000GYrT04RXf5RlJxt9a8QpJOgWM=\"},\"SV-204583r241939_rule\",\"RHEL-07-040200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zNpBjI7gKD5CGJeHa0TgLmFXquRzktJOpNM1MitUcYA=\"},\"SV-204584r241939_rule\",\"RHEL-07-040201\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tu8dUs1zi+TVniquX91HB2mrznXWiYevRt36mw4oUc0=\"},\"SV-204585r241939_rule\",\"RHEL-07-040300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U0+kiCOWAxM37Dm2rN333KIvx6YqKjJfXh9Z8SO0Hw0=\"},\"SV-204586r241939_rule\",\"RHEL-07-040310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dkh4lOXziNuIqVk4eaOVLxaMcoWI12sofxv7jKQaw+8=\"},\"SV-204587r241939_rule\",\"RHEL-07-040320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KFrNyXlrwufl0fTSC2Xb2SJFGIHk5O3cfMQ8TP0OUcU=\"},\"SV-204588r241939_rule\",\"RHEL-07-040330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:s3HPGztH6jOvI74wiywU7WSmWcHTK8Aw+JzBeFJeV+o=\"},\"SV-204589r241939_rule\",\"RHEL-07-040340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4oJTyVwrO2R6TmqIF+bsE92/Eo5rArioW/qSFId8tfc=\"},\"SV-204590r241939_rule\",\"RHEL-07-040350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2znyQY3TQ9xKT6QoY0lQ8dx0S8AN67MOq5v/U8DLEh4=\"},\"SV-204591r241939_rule\",\"RHEL-07-040360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yX1X8uJ+vqpiTI1YneKPRT+wM/BMopO1gSTrMWwXbLY=\"},\"SV-204592r241939_rule\",\"RHEL-07-040370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XefiLkI57brJK6zs5DReGOyqdxXR/FR0JRYBWt4XivE=\"},\"SV-204593r241939_rule\",\"RHEL-07-040380\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0dqZel9WfGVpxO6OVdTQca14awO4upKlmd0SHcwofA8=\"},\"SV-204594r241939_rule\",\"RHEL-07-040390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xTLJjvdq15UZDw8G16bCt7+I8XiP/RxZCLmJQpOTmC0=\"},\"SV-204595r241939_rule\",\"RHEL-07-040400\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZrwBro/CqOpHuLOT920+WMMOrhs4KR7xtuVSg83ADyY=\"},\"SV-204596r241939_rule\",\"RHEL-07-040410\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h0blgpw29xSnpbeqXLAlK16DNURlD9WDnqL8KrTVoVg=\"},\"SV-204597r241939_rule\",\"RHEL-07-040420\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LuF6kqpOF9eNjNyaM7lVHX3f2Ce7dRDM7eZK2TV8w6Q=\"},\"SV-204598r241939_rule\",\"RHEL-07-040430\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:95XKdYxzx1qHEALj0vVcUgfFdzE+HDbKJn+kj2tRtCY=\"},\"SV-204599r241939_rule\",\"RHEL-07-040440\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XRT3D2vqhfiWwUMNKp1iT0NPdaECtsiOv+PkO9tvPIQ=\"},\"SV-204600r241939_rule\",\"RHEL-07-040450\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uaQWPHqYSfcx2Hsbsz6oSx3/NvJ2S9ZZWyR1AaamE3c=\"},\"SV-204601r241939_rule\",\"RHEL-07-040460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZEDgUUGRtYwtdg/7IGePmM+mO77jBmQ2y6qQSJnzh88=\"},\"SV-204602r241939_rule\",\"RHEL-07-040470\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vFy+LSYNEqK8q0jlqPSRN9R2KTNP4oH9DkTCn3+F6lU=\"},\"SV-204603r241939_rule\",\"RHEL-07-040500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cXVgQoJtqPP16H6INhLNMDk5sX6o5q6ee0+MombCLUE=\"},\"SV-204604r241939_rule\",\"RHEL-07-040520\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5AeStZQDNTFP8dyAN+kdFOwEHd7ujN7N8QOsth1BYFI=\"},\"SV-204605r241939_rule\",\"RHEL-07-040530\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2MW4CbQWQSdnWTn+vJjAqUXxy39KvlIkThmnSy/UnmI=\"},\"SV-204606r241939_rule\",\"RHEL-07-040540\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v4IA4z20DXRjhaVy+lPUHGEq1PKWrz2BRO+w5yuY2A4=\"},\"SV-204607r241939_rule\",\"RHEL-07-040550\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rZwRT3O4olP1cUbfaVWLtsV55GMO6FG1urqqL7Z5if0=\"},\"SV-204608r241939_rule\",\"RHEL-07-040600\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eQBkLoCxbhLSL0FSX13w71XInyURAJYddveh0zcMYZs=\"},\"SV-204609r241939_rule\",\"RHEL-07-040610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FwLT66vNGmWrFses/sAjJSSaKxtlj7doQb3MZgBImX8=\"},\"SV-204610r241939_rule\",\"RHEL-07-040611\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p1jUPBQZCsvZDLRRitg2VYMt2+J7ICQQdk58h8+Ceww=\"},\"SV-204611r241939_rule\",\"RHEL-07-040612\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cG2bpeEieasuM4Qt7PgAX0WNy3Jg+IohvlZC3bDIxnk=\"},\"SV-204612r241939_rule\",\"RHEL-07-040620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MRRtJ87d9codxHSiwiP6FQaDVF9nRZZKpZzZKdkt8tc=\"},\"SV-204613r241939_rule\",\"RHEL-07-040630\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8YTZ6fEoQgsCaCCADaJpdHZaoc+u9wlTzoxXW92DDXI=\"},\"SV-204614r241939_rule\",\"RHEL-07-040640\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/GqImo5AYk9oB6VesRt32EX9qhNxt0bsSwz/JfdpsTM=\"},\"SV-204615r241939_rule\",\"RHEL-07-040641\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rajjUFaPBiT4Sd2KHjdKE74EwKfpgWlkjrCk3HupPOg=\"},\"SV-204616r241939_rule\",\"RHEL-07-040650\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eI/kCnLWasuxYrqINFrqYvnYRusBETB3PyweSidvuS0=\"},\"SV-204617r241939_rule\",\"RHEL-07-040660\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ehZyYb58GoVTgK7yVpGqpPJBA7NKrWkkjvGCe4/cHMw=\"},\"SV-204618r241939_rule\",\"RHEL-07-040670\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6FOjMjnPE6o/2RQfLIQ7oCu1NiuJoXu8ZloEh6aQnOc=\"},\"SV-204619r241939_rule\",\"RHEL-07-040680\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GYLgPoC9dWO6EQnX8n402yDsuMPAnK9fUZjDeNJuVlQ=\"},\"SV-204620r241939_rule\",\"RHEL-07-040690\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bjTPHU4AZoK6BfgfQVubbfWkNDK50eujmcmoDTDukmw=\"},\"SV-204621r241939_rule\",\"RHEL-07-040700\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:N0HT3nvX0nacPF0nic2Fvo+QoxFewqWUvw8Cb2dpdyE=\"},\"SV-204622r241939_rule\",\"RHEL-07-040710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BQENP4a828YEZSXVXQtFoPetmYEFb8+83NfUr43aZ74=\"},\"SV-204623r241939_rule\",\"RHEL-07-040720\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nW951brbjAkAlDNfMZI++v9EZTA23qYKprHAkBSWFUY=\"},\"SV-204624r241939_rule\",\"RHEL-07-040730\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ng0nTd+F1YUu4CUZtk3DYlhWROBAoM4ie5InHAQthN4=\"},\"SV-204625r241939_rule\",\"RHEL-07-040740\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MkXnVi+BfZNKD8HBi1BdRhBwQYqAqk37hdGW0wzHsBo=\"},\"SV-204626r241939_rule\",\"RHEL-07-040750\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LPkkcM3GKLloG2iIqGS//40g7fdb9hulnGjTO5OPl/c=\"},\"SV-204627r241939_rule\",\"RHEL-07-040800\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aj2+q1FDm7tuIsdCJ6yjAVx2dNimOetQj7BToo/VlEg=\"},\"SV-204628r241939_rule\",\"RHEL-07-040810\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kkwHgTSKsJctRdFnhk7oBugs+k0hSvrAHTNBODYlnRY=\"},\"SV-204629r241939_rule\",\"RHEL-07-040820\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A4M7YDCBxwn82FM8E2pYn9DdV8RWXiiwlGjESBKWFWc=\"},\"SV-204630r241939_rule\",\"RHEL-07-040830\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:duPPEkYg4Z6hIj9Yd6lOp0gvtSraIDw+nJz6zxmFvqE=\"},\"SV-204631r241939_rule\",\"RHEL-07-041001\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:C1LYFgaAqeuTh7Gtm38t3OcPVMq8CySBTILHzdSksbQ=\"},\"SV-204632r241939_rule\",\"RHEL-07-041002\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:o86wCHVnLXklbvao4gX06PkNKLM2n2dr61EHb3iOGuE=\"},\"SV-204633r241939_rule\",\"RHEL-07-041003\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2hPpDflNaMEbweY8kZ9GeMsYvJyW3OYECrRyUBb7WFU=\"},\"SV-204634r241939_rule\",\"RHEL-07-041010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"SV-106179r1_xxxx\",\"SRG-NET-000019-VPN-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AxGKw3vIjV7cdBulbAW0/cJpPe+V9ntLUymDX+tMrXs=\"},\"SV-106179r1_zzzzzz\",\"SRG-NET-000019-VPN-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"SV-106179r1_rule\",\"SRG-NET-000019-VPN-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:71oeJLYU9tjMIiRqSWuNoIKcrvLfKW7xfh7cI6OhvFc=\"},\"SV-106179r123456789_rule\",\"SRG-NET-000019-VPN-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rCuitvLqBnVZ+8TF3loLSztzss5pqPttV4Q+TQkZtbM=\"},\"SV-106181r1_xxxx\",\"SRG-NET-000041-VPN-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:slm2UFIqnUUPyOpfIcsxSew4LGvsTesU9C6Ju5XJ3mw=\"},\"SV-106181r1_rule\",\"SRG-NET-000041-VPN-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jc6QW12gqdTKEPqvls4bilVyDJExcCoSskTVyO0VtC8=\"},\"SV-106183r1_rule\",\"SRG-NET-000042-VPN-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4cT/S3JRnRG1/bjkxCCl0FvJ2jFBPQxR6xd/ho3iPwU=\"},\"SV-106185r1_rule\",\"SRG-NET-000043-VPN-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IdemsTDQGwPd7bokQxIIvpGCFpuH2a0LMkx43UGqWUA=\"},\"SV-106187r1_rule\",\"SRG-NET-000049-VPN-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aVWTWelue2vPX4PPQhsVdenoG0JoZrePs1txZu8Tn9w=\"},\"SV-106189r1_rule\",\"SRG-NET-000053-VPN-000170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CyTJHLIKQ2Ojkg9rwcZ3x7T66VHLzHB54n+nmQfac2E=\"},\"SV-106191r1_rule\",\"SRG-NET-000062-VPN-000200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b0U2i/2oFdeOwmGlTBap86LUQ1gHdfQ3eL4us+64fpw=\"},\"SV-106193r1_rule\",\"SRG-NET-000063-VPN-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v3WpQRoQigeTzLi65BYsrw9t+ZEEROlTq1kxXFTTLlc=\"},\"SV-106195r1_rule\",\"SRG-NET-000063-VPN-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+B3+7JmTL1p1pvXgkAa8wGoCkVHYXHjICDWeklY1MTk=\"},\"SV-106197r1_rule\",\"SRG-NET-000074-VPN-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5JYnVzed7VNQLssmYLnmi+secKLvHnAiNpVnw5LnOy0=\"},\"SV-106363r1_rule\",\"SRG-NET-000075-VPN-000260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YlctilOwQ2MBW7zoqYuhAoiJN5c5NYVKUMH7L8KW2VE=\"},\"SV-106199r1_rule\",\"SRG-NET-000077-VPN-000280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HGobFrLp43KBzaBeaBiQba6hjKEcpQn11VJTJJwwmMo=\"},\"SV-106201r1_rule\",\"SRG-NET-000078-VPN-000290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:P/zyghBUSYmw8eYcF6kqAgE8TeMANzSroGoCNq9DxmU=\"},\"SV-106203r1_rule\",\"SRG-NET-000079-VPN-000300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/9F2orQ7S4UyHUeIF5MNwyf2YqTtEcZKOu6Lyy3dl0w=\"},\"SV-106205r1_rule\",\"SRG-NET-000088-VPN-000310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TBiXTAY2X10uilSJ/Zo764Ce7gxa+BC604igCvR21Ys=\"},\"SV-106207r1_rule\",\"SRG-NET-000089-VPN-000330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2+gLZEUpQFGiiXTLj5vTvPMeNuYVSesoUBq5osjiwyA=\"},\"SV-106209r1_rule\",\"SRG-NET-000091-VPN-000350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mi17ibh62O4cda5bcRUSENaNZI+A+wHMQdsAhZaeELQ=\"},\"SV-106211r1_rule\",\"SRG-NET-000098-VPN-000370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xx7dyKjP3tr449DemD15SwuRdkEieFRE1AhuT429Hbk=\"},\"SV-106213r1_rule\",\"SRG-NET-000099-VPN-000380\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LurVSxZqQlUG4THAxXLsYwtoOIQkH9C5vFm75lhPk+M=\"},\"SV-106215r1_rule\",\"SRG-NET-000100-VPN-000390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:R+x0KRiQIKJIbqWDk9OWXOHA/tx5c83O7HSpjbaqItQ=\"},\"SV-106217r1_rule\",\"SRG-NET-000132-VPN-000450\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6xznw8iyFeJRJwk1JYCPRsiNwv5VE1E6oPOibHnQepY=\"},\"SV-106219r1_rule\",\"SRG-NET-000132-VPN-000460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U9u5kkzq19uYYwdfbvK93u00swz2+lLKN/KXYD1SLPM=\"},\"SV-106221r1_rule\",\"SRG-NET-000132-VPN-000470\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qL67vWiduAPXEoBZfFyKtQr8Xx5q0lifYoN8/VKeiXk=\"},\"SV-106223r1_rule\",\"SRG-NET-000132-VPN-000480\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mmyK/9p+kkBzjw391gSBn/5JwQ6rUWRXc0i0deZcJlY=\"},\"SV-106225r1_rule\",\"SRG-NET-000138-VPN-000490\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D7dgt3RnYA25LvMASqDp9YTrG7KfSDck59y/cwVd1j4=\"},\"SV-106227r1_rule\",\"SRG-NET-000140-VPN-000500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KKZUM28vxti/o8G6lxUgCF8Wx8ura3+B1TExgJuWCGA=\"},\"SV-106229r1_rule\",\"SRG-NET-000145-VPN-000510\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:koWH1S5xZuAZ4H9vnFXHr/qz4c6UDJH7P29FdfhEPZg=\"},\"SV-106231r1_rule\",\"SRG-NET-000147-VPN-000520\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:53vjl7nhxJZkAmPcXBfrWgxe2N8vSeOA4P5KeOUv1cA=\"},\"SV-106233r1_rule\",\"SRG-NET-000147-VPN-000530\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PQvyQqpQfxH4QYcuFED9dQWGmLZ5NjYVdg+5ViJyzMc=\"},\"SV-106235r1_rule\",\"SRG-NET-000148-VPN-000540\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v5/IfNoYuNBZdJW3TnihRjv14rrPD9SLxquxNn9HMf0=\"},\"SV-106237r1_rule\",\"SRG-NET-000164-VPN-000560\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4L7fYYyaq26bvadPv3JCcQ3yEjurb6JgRmYQ/U0UV1c=\"},\"SV-106239r1_rule\",\"SRG-NET-000165-VPN-000570\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ar3GvJuXEKD4A/Af2IozOGlLJBjfNqRbiW1i8k/7Y9g=\"},\"SV-106241r1_rule\",\"SRG-NET-000166-VPN-000580\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:f0b/RYI3SCPeEqjHsb3psBWUdGRTKfgqRrq51hB7yfE=\"},\"SV-106251r1_rule\",\"SRG-NET-000166-VPN-000590\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MRKxPi/bbsDz8wNN9vXmb7hhgMU8M3+JU6oyqsrMnZk=\"},\"SV-106253r1_rule\",\"SRG-NET-000168-VPN-000600\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:L26csqRjhPU0fgblV8qX1BlmvtAHZjw4Yyp+bb0mDKw=\"},\"SV-106255r1_rule\",\"SRG-NET-000169-VPN-000610\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OyTG982E0CMxr4y2rmBaYCCpTY7srBWAv/cZQUt/Y+w=\"},\"SV-106257r1_rule\",\"SRG-NET-000205-VPN-000710\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lOVVOo0oYWR1BZZb2TwnHXMbM18YttAN6G4GrHPWbyw=\"},\"SV-106259r1_rule\",\"SRG-NET-000213-VPN-000720\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZitF7N9m7tBrFLBSFvvFyer2Cj1EN7TGddhFoon9a2g=\"},\"SV-106261r1_rule\",\"SRG-NET-000230-VPN-000770\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uJQ31o/f/Vqkllw6K1glewYI9Xlo0bRZIER2AGlLICw=\"},\"SV-106263r1_rule\",\"SRG-NET-000230-VPN-000780\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KPLBOeYMBZIxBbaWyihbjnI+iXUnrab0mkIE2hzbTk8=\"},\"SV-106265r1_rule\",\"SRG-NET-000231-VPN-000790\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p+iB5XlL+If6inJuLfQ+r3VNT86JXC5NhnV2vOeozxg=\"},\"SV-106267r1_rule\",\"SRG-NET-000233-VPN-000800\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ktJIe/Y+HEIOo7bAwQCz3X/2hQkiqoTyl8BVpkZpHYk=\"},\"SV-106269r1_rule\",\"SRG-NET-000234-VPN-000810\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D9gD2h3b8ZDEWmQokEZllnWlmTLY7M//Hjdn7DqBOf8=\"},\"SV-106271r1_rule\",\"SRG-NET-000235-VPN-000820\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:72eP2Vo/dCHVQ+6f/2RQyYnBi119Hq+RWYm1m2WqoLc=\"},\"SV-106273r1_rule\",\"SRG-NET-000313-VPN-001050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:w9yL+z+t1qYSt9kk+sxVflN/xG/naaJ9QP4VRCcqw6Q=\"},\"SV-106275r1_rule\",\"SRG-NET-000314-VPN-001060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:afNm41YNd2Z2QwHOtNNm/ZsgKpPtQhY3FaPrGqRWnTw=\"},\"SV-106277r1_rule\",\"SRG-NET-000317-VPN-001090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:n4616xCQqSEJ5LDbI/BvogDwAhTFLCqs6qsCNm2y6qM=\"},\"SV-106279r1_rule\",\"SRG-NET-000320-VPN-001120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qrumTMQiLLqavZ4GBAcbIfp6Kibky5yDpODJYsUNU6k=\"},\"SV-106281r1_rule\",\"SRG-NET-000330-VPN-001220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bzo/kYUviBi8fH0VVF4kMJsdAnZOcFeOl3REDgnED8o=\"},\"SV-106283r1_rule\",\"SRG-NET-000333-VPN-001250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cvSX2fNtb/9d5KoCFv38r/vk1P66QvbknutRPO++RHQ=\"},\"SV-106285r1_rule\",\"SRG-NET-000334-VPN-001260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rpLsrhPbwk1f+JYoA5pOhGpi71+wEYHZA7WhvDHOZ+M=\"},\"SV-106287r1_rule\",\"SRG-NET-000335-VPN-001270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lKiTDkfAGyG9SqJoJw3IBMHEt9m1XfYEXjJcJ6N2O4I=\"},\"SV-106289r1_rule\",\"SRG-NET-000336-VPN-001280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fVzjNA9x7fe7XKuKOy79M7wLwKGgdGCnV3TChwORocM=\"},\"SV-106291r1_rule\",\"SRG-NET-000337-VPN-001290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yIMWyLqQ5KjJhVIE0sO7kOy3MFZ/mr8G1UsF2vpFezs=\"},\"SV-106293r1_rule\",\"SRG-NET-000337-VPN-001300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3Vk1c0ULGwB+JNxtAcJe82imefTrQUiXMXW0gSoV5sI=\"},\"SV-106295r1_rule\",\"SRG-NET-000341-VPN-001350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U2xkrpdDd5fbE89oPVhqhnurz+BzWOL7MBkXI3iyc44=\"},\"SV-106297r1_rule\",\"SRG-NET-000342-VPN-001360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tY5W3SOCbPKTMPPTVFP0FpXqFdrxc15JZY9C5N1Jp3E=\"},\"SV-106315r1_rule\",\"SRG-NET-000343-VPN-001370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bVroOwdA0e1yfLelH5K0/LjEPzRuPTDt+xgTDMzMsWA=\"},\"SV-106317r1_rule\",\"SRG-NET-000352-VPN-001460\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1maPMRSAJQc9CCcE9i3+e/pBNygIhmu9m1GajIh4WrA=\"},\"SV-106319r1_rule\",\"SRG-NET-000369-VPN-001620\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:W5E6fpSFPSjZsDhRm6JBdbhvWCdb4iIQ29kz4GWDM20=\"},\"SV-106321r1_rule\",\"SRG-NET-000371-VPN-001640\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rqcFP9ktgfb343ahB5Mv16lTwTPf1/ELOUg9C3CgAj8=\"},\"SV-106323r1_rule\",\"SRG-NET-000371-VPN-001650\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+vnSRs+ZokA+P5inP7i24jyzDoJ+8dRGwCZAF72bzfw=\"},\"SV-106325r1_rule\",\"SRG-NET-000375-VPN-001690\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fU8zq6dLn1EHMKbL2KwqzdBun1CXedlYFT1NSzY5Zw0=\"},\"SV-106327r1_rule\",\"SRG-NET-000400-VPN-001940\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GOcfn7YCnFViHL4Sv9yLScid+jFSlnVek7L1omc1Mjw=\"},\"SV-106329r1_rule\",\"SRG-NET-000492-VPN-001980\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D0/SC7O2V3JZ4+Sewx7Qn6Z7ZSrkdje8orXuKxcEjpo=\"},\"SV-106331r1_rule\",\"SRG-NET-000510-VPN-002160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GNvczQqQ8RSDNiGZgHykTH9Fl/06XwpsXibtlkPH4AM=\"},\"SV-106333r1_rule\",\"SRG-NET-000510-VPN-002170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nrioFfQyWAyHyqPYTDE2+pXaDoeycQE/PjC2vrEL9Jo=\"},\"SV-106335r1_rule\",\"SRG-NET-000510-VPN-002180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hDgoEHbOPyCRLlTAZ0Qqx1kkok77I93P01NwpDJNEE8=\"},\"SV-106337r1_rule\",\"SRG-NET-000512-VPN-002220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IzzOyrG05CKpFAWFrkEoNJ5rxjb3elkLNtjevgCQdtw=\"},\"SV-106339r1_rule\",\"SRG-NET-000512-VPN-002230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GrHgK/pBnHrsn1Seh0qJujIqrWqRLPE0eaA+ZAqQMjo=\"},\"SV-106341r1_rule\",\"SRG-NET-000518-VPN-002280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+WzKvuFJw2Hd2tINf3CAdDXjeroLc9pIuZQ8rxqAqW8=\"},\"SV-106343r1_rule\",\"SRG-NET-000519-VPN-002290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WFTjVjonYKh95+ufS3SeRtMzKzxvcuYhkuGqLkDzAdQ=\"},\"SV-106345r1_rule\",\"SRG-NET-000522-VPN-002320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WvHtCxF8aHRpizWQnHhcRWZ2GSo4LpYF4C+7vAKUMGY=\"},\"SV-106347r1_rule\",\"SRG-NET-000525-VPN-002330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hK46dRZBIlXNdxH/0rgMhBXqrBF8nwMTFp1UUvsZ2/w=\"},\"SV-106349r1_rule\",\"SRG-NET-000530-VPN-002340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Oyy/mFzHcQy1sAgTQ9gS+b99/s9IcmH4xTl+n0Pf6Rw=\"},\"SV-106351r1_rule\",\"SRG-NET-000540-VPN-002350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0WoWCtzpWtYJ2vxCT7vXvLruiskYzBOwEVdaxJWlGbM=\"},\"SV-106353r1_rule\",\"SRG-NET-000550-VPN-002360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RFq+xtylI0rdth+CO8xXpnUCA7eBYGNXjStRxU/Sh2g=\"},\"SV-106355r1_rule\",\"SRG-NET-000565-VPN-002390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p7UCHJrDUnFC2jp6mXGtSAilZeT3BjF1NVmG5ykWcy4=\"},\"SV-106357r1_rule\",\"SRG-NET-000565-VPN-002400\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F8wZynyPCZXbSCQKsDAa3RDhSkunUmMAhgYUP9Yu014=\"},\"SV-106359r1_rule\",\"SRG-NET-000580-VPN-002410\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WOsWkwp7rHKriDcEPQi1g0VQp3X0XA14Kw+soZYNvnw=\"},\"SV-106361r1_rule\",\"SRG-NET-000585-VPN-002420\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vchgPhpapNXqH1070giShdvTrztio49eNJBWV74F3HU=\"},\"SV-77809r3_rule\",\"WN10-00-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LSSb1gLDf7uiXzn44Bg4EplFPsBwaprDmRrselWEvyE=\"},\"SV-77813r6_rule\",\"WN10-00-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:G++c76EF2dug3yxJ1mWjWuE/wznHG9SVXyS+eCsoMKE=\"},\"SV-91779r3_rule\",\"WN10-00-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:UyAIBRFH+PIeD9UnW2uuScJwGHi1TzbEGDoaMPRL1nM=\"},\"SV-91781r2_rule\",\"WN10-00-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HCOGZgkq+yjHfU54mGFmUULh8th2DmZrWdDxdOWGa1I=\"},\"SV-77833r2_rule\",\"WN10-00-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WJmapvaFU3fBFpTg+ufcMx2LC53rImDSpxqCEpTRTeE=\"},\"SV-77827r5_rule\",\"WN10-00-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hSVsi+qUuuUyVINtO7WeONuyh47CyGSc32+FLd4Ul1Q=\"},\"SV-104689r1_rule\",\"WN10-00-000031\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SIUT9VltMgIdU+iQ11p1JXZ1wRhtZVpC4mS/QVMSxf0=\"},\"SV-104691r2_rule\",\"WN10-00-000032\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qqusfdR/p7eKP2jELMMeLdSrRy4vsHPTO1wfCg44MTA=\"},\"SV-77835r3_rule\",\"WN10-00-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:or6yezNX5dbJzbcRUwG9A6vn2Nwe1/eA0vaJqpY6LqY=\"},\"SV-77839r11_rule\",\"WN10-00-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9LhzdHuv/khleaS+BQu9ZlUcdjdohBUoq5bjuJZdhK8=\"},\"SV-77841r4_rule\",\"WN10-00-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jyG27jY3W9Aj4bDrKfA/dk1GvzTU+D+IeEpDzIASblA=\"},\"SV-77843r2_rule\",\"WN10-00-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gGc0LjWq95X1V62ZlIHcMLmkQPw2oUyILFgDEIeCFgc=\"},\"SV-77845r1_rule\",\"WN10-00-000055\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dOGGLjicLHA/RGjJYYBp+48oN0T8aKpZdwp8uPV5/Ic=\"},\"SV-77847r1_rule\",\"WN10-00-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:O7e8OfTlyzjmCELOYfMlW3c1bFSd2cM7R7YSkTfN3OA=\"},\"SV-77849r1_rule\",\"WN10-00-000065\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8UtBp2DVYD1LJb6gnT+x7kAd1QHqhk+0hwQmESyWDy8=\"},\"SV-77851r2_rule\",\"WN10-00-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OHRlA26i4Hoz3B5fPGaNDpMcdjxDEW48a+7+FxI491c=\"},\"SV-77853r1_rule\",\"WN10-00-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KQ8lRy8FDBQ4580tUO1vy4jkMlou6sCG5kmgRB26zTA=\"},\"SV-77855r3_rule\",\"WN10-00-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bUQ3g8z8lvNafFtEoebv7L8OC/vCz5bDJEA+19YUMfY=\"},\"SV-77857r2_rule\",\"WN10-00-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MaaeK83VUHrwbWkTbzyV8UO0uqMO9TDhxJaX5AYk0dg=\"},\"SV-77861r1_rule\",\"WN10-00-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nU7vAsnPVGyMIHLfdjvPC2Bq5ULx/4Moe5DQgjWZP+E=\"},\"SV-77863r2_rule\",\"WN10-00-000095\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PQtPLZt9kjWgPV2hRYy2GI3OB/Iw5D032IDo7oY5zKw=\"},\"SV-77867r1_rule\",\"WN10-00-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TRPtutJnGn43Yj6o6o250dQEb4BOKYZixgC8OVRcNIo=\"},\"SV-77871r1_rule\",\"WN10-00-000105\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YwindgjytVWnrAw7yMnV/6hfzMIONOOroZJQi53YVkg=\"},\"SV-77873r1_rule\",\"WN10-00-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7Tr9YNXYybZpCvPg9E2lPUrKLG7+7N1se4RCmhXyPzE=\"},\"SV-77875r1_rule\",\"WN10-00-000115\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IYTubfVbsZBz/2eFUf+4u7kuvTO77HcoVONuJRZJyzw=\"},\"SV-77879r1_rule\",\"WN10-00-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:B/OnPBA2G41jIXn2STFlRDpkMuzALJv21OFtakZOH9Y=\"},\"SV-77883r2_rule\",\"WN10-00-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fz8dkAgamwTuH5yyEwnl11W4wiTXnoygvOnaEaNj80A=\"},\"SV-77889r1_rule\",\"WN10-00-000135\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wkHOfqgUvzr6nhiu0W8JznAIxTY88dEtZD1HETyM13Y=\"},\"SV-77893r2_rule\",\"WN10-00-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:95Wge0r7A1nMcqH3gMcG1tsaCxT6bDaub3VeK5nHEcY=\"},\"SV-83439r2_rule\",\"WN10-00-000145\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:7XgAgPXMwnWi7uSIC/fqd46LXQjEefiQggfQCfHL7K8=\"},\"SV-83445r4_rule\",\"WN10-00-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8QaHQQT2a/xX1mHR9JZYds+zZe9VKc6wZnVv2nVWTwg=\"},\"SV-85259r2_rule\",\"WN10-00-000155\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LoHFxrEqFXMSEB8aLzNbxWm1sZAEoJAELFfMvbeXJWA=\"},\"SV-85261r2_rule\",\"WN10-00-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AcIhp89UhB4v65rG4+1OlkrKzpAPGx+nVXwXtWlRxtw=\"},\"SV-89397r1_rule\",\"WN10-00-000165\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bH2zYG4O8rv2T9lCQ0x5K3UStABQyU0MGrR7XdmZxm4=\"},\"SV-89399r1_rule\",\"WN10-00-000170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kmONnQi8hUqCu/WJgM8CHWQrxsQLtOxhWR7c6bEt12Y=\"},\"SV-89393r2_rule\",\"WN10-00-000175\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2j27+jG0GZFs6PCwCbPpklgetUgKU7XZetxNDvK30ho=\"},\"SV-91201r1_rule\",\"WN10-00-000190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QUy5rMKrmSVFuZRi8lijI352v840T0gzGD5qak7wNbk=\"},\"SV-87403r1_rule\",\"WN10-00-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OLU1Ki32nfmwHE1geqvJmNi7m2t/bTSrs5FI1qvvg5o=\"},\"SV-87405r1_rule\",\"WN10-00-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VC4MssCw0YPNf5Ku7vwfsCk462cMswOvsMCGoxhRGaU=\"},\"SV-87407r2_rule\",\"WN10-00-000230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:99vRhcTZ40z21olaz2KCAKJlYMIhAMYv5z3B0U4Tt7E=\"},\"SV-92835r1_rule\",\"WN10-00-000240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HTJfh6HdzWTnnVR96iuoJZ0PnIvio+5FoDwpQDtzoTk=\"},\"SV-111557r1_rule\",\"WN10-00-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:iZIWtAKLFv0mnxWoPykNAd+yxoNoNuOAn/rsuRkGkBw=\"},\"SV-77895r2_rule\",\"WN10-AC-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:IeyN47N358ORV6Naa7eZ9JrcWdBvGlkKd07eHuOVVhQ=\"},\"SV-77899r1_rule\",\"WN10-AC-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:14aXfEafYKcgX8JWb5u3N/8DD5cx/FDR9uuxUhwPlSE=\"},\"SV-77903r1_rule\",\"WN10-AC-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:o8VKo4BFEQi8vohXvm9npwy451RfLEpCEbuLlXnX9P4=\"},\"SV-77905r2_rule\",\"WN10-AC-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OOSpmvJlTsCD444uc+1xJVXu6qS4JR7e8tmYahCVG9Q=\"},\"SV-77909r1_rule\",\"WN10-AC-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rtkmX+JYKFPLvLYlRGgdiaDWULPSxr3ntwT4Qq5G0gE=\"},\"SV-77911r1_rule\",\"WN10-AC-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gADtcufL0rvkhSygty7DNDG6rjm7eHO0Y8vlxc/cJOw=\"},\"SV-77913r1_rule\",\"WN10-AC-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9N++lDyFOQnR8saWfC585SvXvrRukpsO+VUybL0SJ3I=\"},\"SV-77917r1_rule\",\"WN10-AC-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YJ3a9bdA7M956htDthFs6pM+dAbD3AcqGyWDkl4iTa4=\"},\"SV-77919r1_rule\",\"WN10-AC-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:sDp/d6cGeheQPSyDdqeABiqG2UKTGaaxfw8wIcMeQHs=\"},\"SV-77921r1_rule\",\"WN10-AU-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U2zZ7WbIs6xdLIKg5f+SK3W4lP14JKnsnLrhnXtzY8A=\"},\"SV-77925r1_rule\",\"WN10-AU-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Wm8Z9go4ijvi1hXPZNlNfvaEeTTCHlNCHL0r4Y+YBog=\"},\"SV-77935r1_rule\",\"WN10-AU-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3K8Cr0W8KyJySAjHnIKhBoSL7BMlQwmSIgNxt27SU90=\"},\"SV-77937r1_rule\",\"WN10-AU-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hFq/VN5iy8nq4TtmL91tbvNef3uqC1tTzH5qxWfTUFY=\"},\"SV-77939r1_rule\",\"WN10-AU-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6OLuCTq6MxuisuBFoZTFhVa37PfJJ79XxKFbZyUXh0w=\"},\"SV-77941r1_rule\",\"WN10-AU-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TRV0JYavJNEISA42NPNpnVnUp5myoEbm7eqpR1DJJFo=\"},\"SV-77943r1_rule\",\"WN10-AU-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VfJcv2oibH4fO+7O/16d0DnpaUWHMb9vOGAlg65RKTw=\"},\"SV-86383r2_rule\",\"WN10-AU-000054\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BvILRXAXQabjIlzA8GIEo277mORYvfi8NWsVMyjd+bs=\"},\"SV-77947r2_rule\",\"WN10-AU-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2DObiHB1tJi8nMxl9dgsi2/LMp3YdlL60aFyLwFw3R4=\"},\"SV-77951r1_rule\",\"WN10-AU-000065\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:V/vAvDNZ6xrqpdV/w1nyyY3RzAUSErMEtiv1Xc/qROg=\"},\"SV-77953r1_rule\",\"WN10-AU-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BE/T6AoSLhPnWZOeS6illZZoNnn6TQQMBBvTmt+LfNg=\"},\"SV-77957r1_rule\",\"WN10-AU-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HwmQqAec5Zb6el866c2comWk7ZfJ+ixTZEXIw7pzUOU=\"},\"SV-77959r1_rule\",\"WN10-AU-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pP6wExXu7hx0kSxYXKfJVrzTaRizYrfD1RMLqHWYrFY=\"},\"SV-89701r1_rule\",\"WN10-AU-000081\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJq3SMQlkiH7VSnlxXWdCkxlPWIUUAHF7pAJRBLRDOU=\"},\"SV-89395r1_rule\",\"WN10-AU-000082\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+dPx0n8JfTUXKdPsMAw42NTXs2lAb7HwDFC8m/Frthk=\"},\"SV-89085r1_rule\",\"WN10-AU-000083\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hktzVHG38mzOhb1tNzgXaCky+9tk/sTzqf2ayzkUh0A=\"},\"SV-89083r1_rule\",\"WN10-AU-000084\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1acXIWzqEYhMqmAFLJ2OFPWy5wyiClFRK0blgMdIxBY=\"},\"SV-77961r2_rule\",\"WN10-AU-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LGJqueVXVNwDFVXUpGxRZQ4Wny/BOBHeceC7sx3PXzs=\"},\"SV-77963r2_rule\",\"WN10-AU-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I1vZMy69tT8kq1UjsGKufBSv8WZnqduCw713X+syDqw=\"},\"SV-77969r2_rule\",\"WN10-AU-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:W/aNcLuy+E+akBMmzfflre1wQ9pk0xdJKZ8MsmhQgJg=\"},\"SV-77971r1_rule\",\"WN10-AU-000105\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:spd2YfnamQST1NlVqvAqNOfFgfZkdothjKXNWgXmfX8=\"},\"SV-86385r1_rule\",\"WN10-AU-000107\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uK/4Mc8psjVa5hc9xcQ/VvM1L3p/Z2PR5oXrXVdT3AA=\"},\"SV-77973r1_rule\",\"WN10-AU-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ub+bzRw9nK5FMqhg0cvtHTPXc0ZoY14WwJJpfePsTU0=\"},\"SV-77977r1_rule\",\"WN10-AU-000115\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pI4rSYXdO2I17sVUgVGEC9waoXmSE152j9vxVgdtn58=\"},\"SV-77981r1_rule\",\"WN10-AU-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XjzZBXSARGyTD/PfUuDeFm28fIvcIV4qygTV08sLVKo=\"},\"SV-77989r2_rule\",\"WN10-AU-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:t6WHp+ZUHBml263lvCguGrlkMzldPXsFEy5VNUVNBrI=\"},\"SV-77993r2_rule\",\"WN10-AU-000135\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Er5CsYJ2r9pG46ajyyQ8LR2k5mWoAMurGm8u9Uh/Iuw=\"},\"SV-77997r1_rule\",\"WN10-AU-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WuYFQVOva2y1AbhfejrStyjDyv4BFq3G2voT7JCBA8Y=\"},\"SV-78003r1_rule\",\"WN10-AU-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xgvxweAhj8P+1t428K3s8SDMbeLf2/MINiEDTjiVtRk=\"},\"SV-78005r1_rule\",\"WN10-AU-000155\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:liPGtSRilvM45JUUHGb3NoDoAKAmonqQZH/MaCqLC/s=\"},\"SV-78007r1_rule\",\"WN10-AU-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DyO6WQCEJJlinj5BDeq/RINvUFeMQ73GuBqzRcFDqQQ=\"},\"SV-78009r1_rule\",\"WN10-AU-000500\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/3CmjRBIzvZC9yK/MCEjxBoeg+MF3xkIhnLP5Zgo/2M=\"},\"SV-78013r2_rule\",\"WN10-AU-000505\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rIpcAlB/RefJGwA84BZ7ULacK5uTqcC4TpZy9gfOwdk=\"},\"SV-78017r1_rule\",\"WN10-AU-000510\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Au90rsoIgKKpDJ+88Qps0bQDZf/CKYRvQpZFpv2MOUA=\"},\"SV-78023r2_rule\",\"WN10-AU-000515\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KvaUNjf9HpHOvMKNKYYGrc5t+RjNh70OiFd7YXyR7TI=\"},\"SV-78027r2_rule\",\"WN10-AU-000520\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kwjLPtx2Qf2ICgGtbJvcwowGSS5n1iOSY0sAbgRUseA=\"},\"SV-78031r2_rule\",\"WN10-AU-000525\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:JLf0igfVeeCGPtuP0G5jtsBt5SLWDy8/40lxLhTjp+A=\"},\"SV-108655r1_rule\",\"WN10-AU-000550\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:0JIEYxGjLJCW+XDuQSNKZLiOraun/N4xAz9pc3iPnC4=\"},\"SV-108657r1_rule\",\"WN10-AU-000555\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aHDwysX9OO7lInhWR4rNHU0Ms5aHv+DvTtpIpt7OrPU=\"},\"SV-108647r1_rule\",\"WN10-AU-000560\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ma4nqZH+wIDRjwzJLcPKvIvKb/+DvmWJQSbZYwt0kjY=\"},\"SV-108645r1_rule\",\"WN10-AU-000565\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1xCrwLo/Iq6qUeIrA32JKdJWhv9UJ8i93khTh00F31M=\"},\"SV-108649r1_rule\",\"WN10-AU-000570\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xN9N4TyNWncZnuydNiSn1AFbgDuZlrOZk/FpvfCXbCw=\"},\"SV-108651r1_rule\",\"WN10-AU-000575\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:AwE4aTQA41II3JBpLcuFwxr2s+SdrBU5NkQnKMmh+34=\"},\"SV-108653r1_rule\",\"WN10-AU-000580\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:n/VYybwadURq9gktZ5pPv9NpPwlE/OX7X34avyRIxn0=\"},\"SV-78035r1_rule\",\"WN10-CC-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FGmuM87xdJUUKhYyergOAvk1Q+FhFTf1uOoIl5+4vOQ=\"},\"SV-109197r1_rule\",\"WN10-CC-000007\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wD5HvAQgiCsU2Pbe6EawPD0843pDzk9QjNocpT9i8RI=\"},\"SV-78039r1_rule\",\"WN10-CC-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A6fibgthh14b9Op4gFZQuUPcG2SB+c4/OCpJZl+JW/o=\"},\"SV-78045r1_rule\",\"WN10-CC-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QwUV9MHbwXjDlNhviMU3RJgonXD84IWB/u1SaVD04HU=\"},\"SV-78049r1_rule\",\"WN10-CC-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DJn8qS8Z+LUFfJVdHOYY3y3chtd5shcIjisdTgSjqYk=\"},\"SV-78053r1_rule\",\"WN10-CC-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OLmEHTREwzxLEYjHSP9Vs9v/hFwEi7JLaoSgaF8tAzI=\"},\"SV-78057r1_rule\",\"WN10-CC-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZB/zbtMEaShUymYYFvs3E2/5ygQ24pqyeGDPPNJ9udg=\"},\"SV-78087r2_rule\",\"WN10-CC-000037\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cLWTmB4pH7+xPBjUvZx8mpG3gs+QxeJQobWa4u/txeE=\"},\"SV-86387r1_rule\",\"WN10-CC-000038\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:azduH/rGDaA9J8WfIbKquOL5RoDMag7lQ/2PBt2QE8s=\"},\"SV-86953r1_rule\",\"WN10-CC-000039\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:R57XJmpmTusQFUQzPHbDgL50AUYv/vR8uoIKyz7Vpzs=\"},\"SV-78059r2_rule\",\"WN10-CC-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:A69vy1PsYlLcAzLy5BVJjqB9jb4HUwisI/dMcPrDcBI=\"},\"SV-86389r1_rule\",\"WN10-CC-000044\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:61r9+JyE4FdTPKoO2j03RuHoicsSx+y5TDVRs+6Lxk8=\"},\"SV-78067r1_rule\",\"WN10-CC-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HPKwv55aIzf3+HquubSdJocG/rCtCTbtxNECCDpyxPk=\"},\"SV-89087r2_rule\",\"WN10-CC-000052\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:c4QEIcRFMsJ0fLK2itIk4vhS7BejsCbOOCX+PUzaf1o=\"},\"SV-78071r2_rule\",\"WN10-CC-000055\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wmSMFUgwk1JCHLOyalyRfJCbYd8VKcplfwvV5bapJBY=\"},\"SV-78075r1_rule\",\"WN10-CC-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ev+o/KN0GgLzFlT2mWhE43+O9wbhzEnibMOjO1WuHo0=\"},\"SV-78081r2_rule\",\"WN10-CC-000065\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nB5yZlxqxo8iNwRqReGtHbsRcruqk84xPSKCKzfrudk=\"},\"SV-83409r1_rule\",\"WN10-CC-000066\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:p3Km58ax+vwtXp6vt/jvLyGVTgesTT2NKlz+BVoeGAk=\"},\"SV-89373r2_rule\",\"WN10-CC-000068\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:DgPD2H4FRf1aoEW+JdUiSywje5awdelYTOHDeJ/jku8=\"},\"SV-78085r6_rule\",\"WN10-CC-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PJ2hg0H5j3JxumOw1ESdMmYSago1hh7d1jPoC7NiknU=\"},\"SV-78089r9_rule\",\"WN10-CC-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MOtPlfIGo1RyaFuE2rfSMX3os4OtOKSymnMJWGrlUXI=\"},\"SV-78097r2_rule\",\"WN10-CC-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:x6lWvjXJOJaFvBJV1Zg8dV8fRzPlgg6/m3YcFFE/VLE=\"},\"SV-78099r1_rule\",\"WN10-CC-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:UFrGn+U27y3pnKkpO5lkjLvaccdBipAxfmB1NDMupKc=\"},\"SV-78105r1_rule\",\"WN10-CC-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PynI4MPELuswd9LSVn4o7lJ1Gj5XkceRgYo1jYFWcyE=\"},\"SV-78111r1_rule\",\"WN10-CC-000105\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:eHWGorFu8rp07FggxF3KQzzzIDdCofw07d6YU7EPPQg=\"},\"SV-78113r1_rule\",\"WN10-CC-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:1cHjpZpWasXrNs38blIHXTCAsBeBydKm/FoVbD6YN9E=\"},\"SV-78117r1_rule\",\"WN10-CC-000115\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJyg5YyGdmvNFobvn1b619ahBQSWRDA6UUW//FX4+mk=\"},\"SV-78119r1_rule\",\"WN10-CC-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uFh0+SOkPBhoY4cKXKJkJcnyQ6+Tp4ycDdOaJohcCxk=\"},\"SV-78123r1_rule\",\"WN10-CC-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i3fRKcUyn6PmTSkp0ufLDEGZMye3xAQxD4OpV2pM+0E=\"},\"SV-78135r1_rule\",\"WN10-CC-000145\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xC0vDkioBtR1JLW2HOIxcJl4n0eOz6yTkhlZetuLhI8=\"},\"SV-78139r1_rule\",\"WN10-CC-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:NSgu6s8JKNnXMJ+7CGkFNsLqlJAeYQviKDinQTL+FHo=\"},\"SV-78141r1_rule\",\"WN10-CC-000155\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:14JhGWVp+3S3ydTw3+p8k3X7npjABreOsd4BluBaRyo=\"},\"SV-78147r1_rule\",\"WN10-CC-000165\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ZJbz3VhLvqjcd2z7NP6j6DC8M0Ltzl3HDFROf1Cpu4o=\"},\"SV-78149r2_rule\",\"WN10-CC-000170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ye6LltMKmAmswLhHjkhNL7Oek9ZBv20d40WEFxLqoNg=\"},\"SV-78153r1_rule\",\"WN10-CC-000175\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:BLkX1RSbTxRJ+95+jkVEEKAtY1YFGp7VUwcyz/Na6PU=\"},\"SV-78157r1_rule\",\"WN10-CC-000180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/dizhsZDVZiRpJUm04AvJkfxcjGg5bvtRPbE3Iajy3s=\"},\"SV-78161r1_rule\",\"WN10-CC-000185\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CffkXvxske/bT7jvs4za5BpRLmJrKhgTOflYgSJF+X8=\"},\"SV-78163r1_rule\",\"WN10-CC-000190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OHgYhVcmu/l9dVrJ0J5Uo4d4+lLD5rAkwUYwACRT+m0=\"},\"SV-78167r3_rule\",\"WN10-CC-000195\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:uqablBEdj8fYHH8criFKQSHGko9Gb2nm3ANEizuP+08=\"},\"SV-86395r2_rule\",\"WN10-CC-000197\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ofnzmLY6Mws9d7/NtnKBQB4fhzW4stZa4Q8pqud3RuA=\"},\"SV-78169r1_rule\",\"WN10-CC-000200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rj3OnjRCg+zI0qrs9i/7QAUeW1hgVcDx11HNsPktgsU=\"},\"SV-96859r1_rule\",\"WN10-CC-000204\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:32jv43ZfzeffcLH0aNzUt/YSBnCyNLyRuby1CRN3yVw=\"},\"SV-78173r3_rule\",\"WN10-CC-000205\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VJSxQGzb7YGcY1mgBjeFquoDAw5e1lp1zoNJaIM2u2U=\"},\"SV-80171r3_rule\",\"WN10-CC-000206\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:SoCQzVKKVy7D5huRMI4Q7iyWO6PyUB9uG8vv4geQuQA=\"},\"SV-78175r6_rule\",\"WN10-CC-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pwvSQ+QN5KMngq6whT389oqgH7svUP44geVmJrGKA/Y=\"},\"SV-78179r1_rule\",\"WN10-CC-000215\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FNuzYuatOsVqoAEfYyh44rPDU4p+dXmH2F/22ijPNG8=\"},\"SV-78181r3_rule\",\"WN10-CC-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ka0gdKnu1i6pDqDBmfSv/etIgqsSnYvxwHo6vjDl/lA=\"},\"SV-78185r1_rule\",\"WN10-CC-000225\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nBBbWUKMYR0oBuDR1T1+MwPCSPwa/PvvTXckuCFHxcY=\"},\"SV-78189r6_rule\",\"WN10-CC-000230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nWoWY5Y4H2PjarlDCeZzumdmSKNqLLbQWB6PRDqTQik=\"},\"SV-78191r6_rule\",\"WN10-CC-000235\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Yc8MBcfVv6vNjndIl1SGBkgIuoDRlU+d8I5bNlbhm5k=\"},\"SV-96853r1_rule\",\"WN10-CC-000238\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Vnj02lH1OuXdBOVVSKAmO3ADzTn5+Ujz8I1pVPj59vU=\"},\"SV-78199r4_rule\",\"WN10-CC-000245\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2biNxxxfwe7Qz0rZRb+comoTPxV6tZ2FWyVQ8NR0XLI=\"},\"SV-78203r6_rule\",\"WN10-CC-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gd3/nmYTFouE7yNfONwiOI09OM4xvvtC7p5aHSm3+rk=\"},\"SV-89091r2_rule\",\"WN10-CC-000252\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:K8//OPyNM3tMbqVbeoAI5KxKu5UgN3dLo2qeJqTTARk=\"},\"SV-78207r5_rule\",\"WN10-CC-000255\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GJyj8KhT2aDTkrVyy9e0G2Fw3bcs2GwK50H4fhiljcA=\"},\"SV-78211r6_rule\",\"WN10-CC-000260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:RzUSnNAkaFL0vjIzRXyocD/1metNOIhllvi1eHyUE/0=\"},\"SV-78219r1_rule\",\"WN10-CC-000270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9Pbb8VW3GGoFqiMEMNsF6+ETyP17aJ7LEE/EwiZmXLY=\"},\"SV-78221r1_rule\",\"WN10-CC-000275\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pOkacn9XsLUUPvPCp7BiIdMobs3MmyoiiFdmo2S1Jh4=\"},\"SV-78223r1_rule\",\"WN10-CC-000280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:db4NX5ePYijTdjIZhHi6AMQwXOH25jy1YMRAOPp6z8o=\"},\"SV-78227r1_rule\",\"WN10-CC-000285\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XK40On1j1swkBQC4KHrqqKtA3+PU7O8didBZ9X2v3mU=\"},\"SV-78231r1_rule\",\"WN10-CC-000290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:D+Br9Bp34FIbXISTUzTyziluj9wIh2NeP3T7rqIlBeU=\"},\"SV-78233r1_rule\",\"WN10-CC-000295\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2hvdFSkHFd/jxnDg7QHAFnPQALuFWOVvLZGgRROj5l8=\"},\"SV-78237r1_rule\",\"WN10-CC-000300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MT/QRJ+7T5KdEYjB1CflYUeHypJvbgQA/NoSivDno44=\"},\"SV-78241r1_rule\",\"WN10-CC-000305\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kaQFP+qv+/U0A5jz+BdWIpTTdtyktf1MP4WKqmlH3c4=\"},\"SV-77811r1_rule\",\"WN10-CC-000310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zv0vssTime65YEhFGjHDqU96ACMkZRxJDowM/Qv+sCo=\"},\"SV-77815r1_rule\",\"WN10-CC-000315\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pBxUW2Mg4ubB2d75emmojt2R7TlPrd+/K+K4/cfdRCw=\"},\"SV-77819r1_rule\",\"WN10-CC-000320\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zkVu4Ox1MUjKEwFzsfX/ILQ/ZYHNPsu/JvNQeqZ228Y=\"},\"SV-77823r1_rule\",\"WN10-CC-000325\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:tlcocN55ZYxvkWqCrlKzS308hz23N1rtV+8aFeDnhcQ=\"},\"SV-83411r2_rule\",\"WN10-CC-000326\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dbiUpUgiJb2+wzenGvBgb7gCtpsKZcFOnZmCT6u1k3s=\"},\"SV-111563r1_rule\",\"WN10-CC-000328\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fdOFEUfWZvFxvtQyeYZ2AqTmF5GEfPF1uWfwWrblF5o=\"},\"SV-77825r1_rule\",\"WN10-CC-000330\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:b3jhzOOdG7cVXgpSQQKPwd6xwSdfSPk98Epls0Yl+iY=\"},\"SV-77829r1_rule\",\"WN10-CC-000335\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2tk48SuLjCC1zEZDnJEJwFssANaf8w1hwLA0yFQDwt0=\"},\"SV-98853r3_rule\",\"WN10-CC-000340\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:yd5HlJZjtzvpiWMc+q7EtjdFutkSfgvcIU2keNcxYzA=\"},\"SV-77837r1_rule\",\"WN10-CC-000345\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:EIBNySof2OFl+QthlhxU04xnAsa1Q0mr/BmTT/yWVGw=\"},\"SV-77859r1_rule\",\"WN10-CC-000350\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rF9EqXhMnWgSBUWWkmTth67EEUxryI/ybsO2eNuHvzU=\"},\"SV-77865r1_rule\",\"WN10-CC-000355\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:nkjCE6RM8DNItyD6rVqHkapLyfMeCxO61yv23MB6TIM=\"},\"SV-77831r2_rule\",\"WN10-CC-000360\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xCK9AnopZ/PLEiEfFd+fF29a3GvfMV+H4kBtncaC+w4=\"},\"SV-104549r1_rule\",\"WN10-CC-000365\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QBQK/tnwXZkWJDaqU/JtL7zWbHA0F4hsxCD2qrMtB98=\"},\"SV-108663r1_rule\",\"WN10-CC-000370\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:d1pbzJigO85rKAMstf6sSkdP/ACDK1pRyqaLfXxwivI=\"},\"SV-108665r1_rule\",\"WN10-CC-000385\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:rD1r31DjrTFhcjSKe05lznNWs43/fc9RD+ZPg5DX/ZA=\"},\"SV-108667r1_rule\",\"WN10-CC-000390\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wZQbFTwW94OSVmQOtJRreFTXD/cIx6cp6SMGeIT/5Q0=\"},\"SV-91787r3_rule\",\"WN10-EP-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:seoeJ0TVdyPF1IZOglTdU3YY9kcGzHzPhCDGtAE3tkM=\"},\"SV-91791r4_rule\",\"WN10-EP-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I4uQfS2NjZHDkDdoRvwEOJ9Cn5UEOwkvBoMVv0IlL4w=\"},\"SV-91793r3_rule\",\"WN10-EP-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kFzIaNPWT2wqsaqKjSiKaNxW40sevexLR9vPMcm9edQ=\"},\"SV-91797r3_rule\",\"WN10-EP-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:g7RfvBxx636aPhixMi/6iDCzMbVFIx9shebxkreQe48=\"},\"SV-91799r3_rule\",\"WN10-EP-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/kelpkvOVtEhlqeho3DqaACavzCa3fwBSBE55Uza0+E=\"},\"SV-91885r5_rule\",\"WN10-EP-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MubhtefZIzGkvhlY2PmYFuDlH+8Uqku0fltszVjOuxU=\"},\"SV-91887r5_rule\",\"WN10-EP-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fg2f0FG3EIVUBqMtVXqVYKHERgkwZW3I0YbnLTVAsX8=\"},\"SV-91891r4_rule\",\"WN10-EP-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pNmbpGc9jee+bzjZjzmnqgZeocNv6buCv3Ipvsb5pXo=\"},\"SV-91897r5_rule\",\"WN10-EP-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:spszjT7BTTddnp6oFJqi/T4F3rA0UBbm/6GzPBqBcWo=\"},\"SV-91901r5_rule\",\"WN10-EP-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mtl2VgiudtjEJVh9KeXvbi749Hr3urnyB+DwqMQJz2Y=\"},\"SV-91905r5_rule\",\"WN10-EP-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LsXrxcaxVB8zrRJjNYRpPBfOKTGaqj32TPrT80sjdFE=\"},\"SV-91909r5_rule\",\"WN10-EP-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:amDpgsaRxthlet+rsvJeTvWJu1llLyepQcXyc5K4O7w=\"},\"SV-91913r5_rule\",\"WN10-EP-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lY+AXYfe/AluR4WGTqo0FEqJ5tSSl5HZ39f56ylKTs4=\"},\"SV-91917r5_rule\",\"WN10-EP-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:fe/FsLxtBWOXdM4WX+ESyWqxz8i/+CYiH84HrxQGTKM=\"},\"SV-91919r5_rule\",\"WN10-EP-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Mh9IH1clzy+A1OOIBzjvUuybaU9xSwmJekh7crMQoVI=\"},\"SV-91923r5_rule\",\"WN10-EP-000170\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dEwmjiXxS3GnMegQ2bUU71KYoXG5Dd/AZ7wdyDMWJGQ=\"},\"SV-91927r5_rule\",\"WN10-EP-000180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xgIlihjGuLyZbqGDLM1SWEpzSqmldIb/KD1X6dqFPeQ=\"},\"SV-91929r5_rule\",\"WN10-EP-000190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:lILMjdtbWDfww7YCEZdpYCS81lAL+dJlad4M/TVlfcQ=\"},\"SV-91935r5_rule\",\"WN10-EP-000200\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5Ph3UBC9p+Akj+j+IR75pArMHpuq1OdgoJE3yVDf11E=\"},\"SV-91931r5_rule\",\"WN10-EP-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:GXA5f/UA68emJFB8jqN9ewGYIe84bEvyYg7xSGas3I4=\"},\"SV-91939r5_rule\",\"WN10-EP-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MUCQyakZZLfc2Ap5HiFf5ipmQj0p92vkKHKV9h/lKZA=\"},\"SV-91941r4_rule\",\"WN10-EP-000230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Tc2J0p3mLuCyswLMHwCyLpY+3kVedt6NP6VLBTCWYjA=\"},\"SV-91943r5_rule\",\"WN10-EP-000240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:MQNLsBE4TEp2/6ROgBSTJO9fJkNfyMcnLhI9YtT5BXI=\"},\"SV-91945r5_rule\",\"WN10-EP-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pHMGWcsdxpl8Z+8pYTfwp4+n7EAO3II6SBPoR0qmkV8=\"},\"SV-91951r5_rule\",\"WN10-EP-000260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8vOgdCfinZFo71HQ6cBJRAa/ITYhJrZWDk+MZttTzFg=\"},\"SV-91955r5_rule\",\"WN10-EP-000270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wzRqhQROBVJlE1q3nxtUM1GkAJigG01hupg8bXE1iSA=\"},\"SV-91959r5_rule\",\"WN10-EP-000280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/mZrNq1dEWU1tMYc71JTRfkRtNHkdPGHX2E03f0Jppc=\"},\"SV-91963r5_rule\",\"WN10-EP-000290\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:i7E2vv6pd35hawlK+qV+2UpXcaVnUkBR1V3CR/Rcg7M=\"},\"SV-91965r5_rule\",\"WN10-EP-000300\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vk0EeybuvPD5mu6kz6fCWWqDopo0zsPMlVMjqvlYb5I=\"},\"SV-108661r1_rule\",\"WN10-EP-000310\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:vBYNU1MOZTMT14yG0uwLTnJNZd27pnHRrsvC0HPMX0s=\"},\"SV-78069r4_rule\",\"WN10-PK-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4xWh6wamWmIOeIO59RNtRdwcCFtu7mD7qVIiEWhU49I=\"},\"SV-78073r3_rule\",\"WN10-PK-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:FKy5u6ln+y0mzvOV4HzwGH2CwpZj3IQ2DhcZHGowfYk=\"},\"SV-78077r6_rule\",\"WN10-PK-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:VNS7bkHAgOyfB6SjEoQf8o+x0lzbHQcxS5EZbR1kz64=\"},\"SV-78079r5_rule\",\"WN10-PK-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+gNTwi6NPYxK/l/EIlkhsqMLUMX3yk8p8qOXrOuTUD8=\"},\"SV-78083r2_rule\",\"WN10-RG-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Gu4gtZX1rR01eoH7S8OImC8dbc8fZ9Js8wyj3Hq8AQA=\"},\"SV-78091r1_rule\",\"WN10-SO-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3H53KZC2kWuaeW6IYY71llirhuaVVZpEWoqEEkwfsC4=\"},\"SV-78101r1_rule\",\"WN10-SO-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:J5uvaJtjjYnwV4ewXXHS2Y/F1moPfjj95l8OgEmAcHg=\"},\"SV-78107r1_rule\",\"WN10-SO-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:CgDvkF7Lpc1r6ZB1knUBa/Na6DAh5qTekx4xkJVDJKU=\"},\"SV-78109r1_rule\",\"WN10-SO-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Sp6+sZWFJ+5qIfMxuZM1X4FQ9Q3VaCCrivEnw2hO+VE=\"},\"SV-78115r1_rule\",\"WN10-SO-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h25vRZXLu1TOtMH5HMSKvo8N5a+Q/ueTRDZ1vspmoQE=\"},\"SV-78125r1_rule\",\"WN10-SO-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XPkkPkWSdvWEzxDy2sUWix6KC7aJBbG9RBZ/ZnYOGEs=\"},\"SV-78129r1_rule\",\"WN10-SO-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wy/VGGvzW3UlJ37hiY+I8pUms7MXbP2SNpPKfNy1KIA=\"},\"SV-78133r1_rule\",\"WN10-SO-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:/cJizcUtpE2HLtuWkhVN3GiOSFjewXuYn9IJu3enAXg=\"},\"SV-78137r1_rule\",\"WN10-SO-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:z2vvY1cDmkJvQsHfPOfw8QGJtMOKrIQz9lM3Dc0ytLo=\"},\"SV-78143r1_rule\",\"WN10-SO-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:LaaMQgJOQrkO4EB1mnVDnZdeYz6iDashNKpqfHpNCck=\"},\"SV-78151r1_rule\",\"WN10-SO-000055\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:kcyr2a0EWEiUBvmVmyDq0M6j4K7/nBHuXmLhXDDtMf0=\"},\"SV-78155r1_rule\",\"WN10-SO-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:mhjrBvHTfJT/OuyLZFDHWxfbvJ3FuijQKPyHh2cvxks=\"},\"SV-78159r2_rule\",\"WN10-SO-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XgzulLjMBxHaNi0V9FHGyZ4It0yWcGbG1JwlFE+T+gk=\"},\"SV-78165r2_rule\",\"WN10-SO-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PHPF3Sy5sq6u5phRafA9yRglmtGg7XcKsUmsucub7jI=\"},\"SV-78171r1_rule\",\"WN10-SO-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:OtsqfrQg9GojUClvvmL4jzwvRg7kIHzjol+WcskfN8k=\"},\"SV-78177r1_rule\",\"WN10-SO-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:v8lM7FP7aQdAEqhdWAElG8v5N9aKZNjsXI3sO16UBJ8=\"},\"SV-78187r1_rule\",\"WN10-SO-000095\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YHHxKYwoRYjDWym4IH18cuhmeP93GyehRyGY9+eWOlM=\"},\"SV-78193r1_rule\",\"WN10-SO-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:I1hZ4Drt9YDDg3F9ZAzn33a90Yrg1/tAw/QcCCksE3A=\"},\"SV-78201r1_rule\",\"WN10-SO-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m4mVWgszCk8aLeRg9wcZWG+Rs/f7KjQGvMB6lRJ5A+M=\"},\"SV-78209r1_rule\",\"WN10-SO-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5oFtb8E3qwiXU282gaObtdqYpKDg1HKwTV1n0yGLwdM=\"},\"SV-78229r1_rule\",\"WN10-SO-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:q4amaRBeQBzWaWDuh+jg7+M6Q2vE1slnyWZ9vRYL1BU=\"},\"SV-78235r1_rule\",\"WN10-SO-000145\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PH+4N2yTf3KYeI3LzoMmv9I7NMVl4gENYVtdt5aHEQ4=\"},\"SV-78239r1_rule\",\"WN10-SO-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PPMakW1bUBUuTQXNZEWFXjV3n8bqxzcAep6WCv0LA6I=\"},\"SV-78245r1_rule\",\"WN10-SO-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:+CqVPSzadLgqURUz9jpa2vfnE9s9rDLe5PbBuASRgh0=\"},\"SV-78249r1_rule\",\"WN10-SO-000165\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bnGEzcuJUAwCNZ4Ws5wyS5j2lY5Jgzk6QrlcnBXgb8o=\"},\"SV-86393r3_rule\",\"WN10-SO-000167\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m79WMkHt8ZOH03cNAv+YgwDxku23Nclna/dukfCHBwE=\"},\"SV-78255r1_rule\",\"WN10-SO-000180\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:bu7KdaDw/5/s3TIiuDAAhnNsO3EvwivuJyQ8TxBRC2k=\"},\"SV-78257r1_rule\",\"WN10-SO-000185\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WBduyUoS7ji0lJWOQsFV1TVIPhzv+GArzEJ9SaioyCg=\"},\"SV-78285r1_rule\",\"WN10-SO-000190\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:esvIIQzIXuuV6UAZCui3VcV9VGJeNpc//UNi3KoTS1w=\"},\"SV-78287r1_rule\",\"WN10-SO-000195\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:5qXivRds1q8g/9HnQ9nxJHz6twXtapACZhIt29psYMg=\"},\"SV-78291r1_rule\",\"WN10-SO-000205\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:YGadfMPpS3VMGBFW+r3ZcBbI9dYCCdc/zyMG4vKxtCU=\"},\"SV-78293r1_rule\",\"WN10-SO-000210\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:wPbkf7isP1x09ZPgzKuJL8TtdkHaTA1/d8tDtGfpybs=\"},\"SV-78295r1_rule\",\"WN10-SO-000215\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gvDKD+YMxXb3Dbh+NdpQ/LmlaxOytN56P+kbBAhz7EA=\"},\"SV-78297r1_rule\",\"WN10-SO-000220\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QgLpxb9vltYJFW7KY8eBS23IB732VOg5sO/3heYiTSY=\"},\"SV-78301r1_rule\",\"WN10-SO-000230\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:QiljZhB01LqOQfbiDH4gdszZSQwiokE7rvHMNETmntI=\"},\"SV-78305r1_rule\",\"WN10-SO-000240\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:9xKCBYF3X03GOrS60NZkKP1tRU65uLNh/SvSEhv7qzY=\"},\"SV-78307r1_rule\",\"WN10-SO-000245\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6anIfcvLd9P3Qqj21QYsvMEK1vkh6OjqA8kxfY/qKRI=\"},\"SV-78309r1_rule\",\"WN10-SO-000250\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:aGZaMr7JCYhdhYIbyDmHK2zx8fjqDpXXjEY01sUoNo4=\"},\"SV-111577r1_rule\",\"WN10-SO-000251\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:2Mf6LpRtxqJ2Xi014C6XdUKrfkVm1If47khfoSg5IPk=\"},\"SV-78311r1_rule\",\"WN10-SO-000255\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:xIxQC3EFtKo4/I03k/uVVwqUkFC9effmNV1HiiiVNas=\"},\"SV-78315r1_rule\",\"WN10-SO-000260\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8HK3jPasJRJpBZDqSPFQU1vxUyg5+aAI6SAka9PPlvc=\"},\"SV-78317r1_rule\",\"WN10-SO-000265\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:TXh7CT8eDFg9PQd3GuTWW0B0BM4p6bzG9FF1T+9Vv8s=\"},\"SV-78319r1_rule\",\"WN10-SO-000270\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:jTdDk2qrsY7wk2fxd9JsCbcokx4k7p+QSN/VYmbUB9k=\"},\"SV-78321r1_rule\",\"WN10-SO-000275\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:WiWO+yrYgzS9BRfJ95tCnETPOIU/k/YYuPYQakQM+IM=\"},\"SV-108659r2_rule\",\"WN10-SO-000280\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ewDvbXkRfIkCeWiNsw3OWO1nlDe4SsgnCecA5Am1j5Q=\"},\"SV-96851r1_rule\",\"WN10-UC-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Ps+f+j5cOJetWmfgZFHPTjOUfHH002d19GW01SZ35RY=\"},\"SV-78329r1_rule\",\"WN10-UC-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:31JR/6WQp6TuKxIQqNorrp6RBoUM0yhGJ95MVdPpzUw=\"},\"SV-78331r2_rule\",\"WN10-UC-000020\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:4Q6F4dio1jN4MtIZbfGfkZnYkN6zfJazb6nB793l6nQ=\"},\"SV-78333r1_rule\",\"WN10-UR-000005\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:at5fqeVaC1Sm9FnXQjZ7YLh8ehuVr9z5FoeJZMIMABA=\"},\"SV-78335r3_rule\",\"WN10-UR-000010\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8xkuF4nDSjRiPP+9oGCPnfWYPGGSOi17d7FbL0XhlU0=\"},\"SV-78337r1_rule\",\"WN10-UR-000015\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:dq7TXJZ0aBQkd+AjwMgoDVp+n4UvOG8n1gEF82FEBlE=\"},\"SV-78341r2_rule\",\"WN10-UR-000025\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KEKE0PGxslNV0A6vemAzaWjzbx9nYy/RbiPhNJ3aL20=\"},\"SV-78343r1_rule\",\"WN10-UR-000030\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:cDiaxsqIK6oeD+TiOA04U8bzW/Xipep+PGUIszW1Ddg=\"},\"SV-78345r2_rule\",\"WN10-UR-000035\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Wzi+dcfocDaL/BL8ZywSuiDTEG4Zv3kI5qdXUcl3y8E=\"},\"SV-78347r1_rule\",\"WN10-UR-000040\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:m3olQQDR+ylJqlRWob7mYvRuzE60jAwPG6gvqc+QNq4=\"},\"SV-78349r1_rule\",\"WN10-UR-000045\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:srfyN9VEgB5cnpXOBY292RFK5lJspJquvD0ZD4TIQLE=\"},\"SV-78351r1_rule\",\"WN10-UR-000050\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:KcAj9nx0K1Jq/IEktNS9qbRss/b4npcbS1XEQ+S/Xm0=\"},\"SV-78353r1_rule\",\"WN10-UR-000055\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:3c6IOQPBsJcn8+IGDfwZ5oHJ/hbHObilnQESAeOLePs=\"},\"SV-78355r2_rule\",\"WN10-UR-000060\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:PgmqvkJqmLhRaPCQpSZZxUPFDDIdB1muY7/23B1nyZM=\"},\"SV-78359r1_rule\",\"WN10-UR-000065\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:qj88J123Y6ALiPB3Uh+vm0KvR68nqjRVdYVnlzC1rII=\"},\"SV-78361r3_rule\",\"WN10-UR-000070\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:gRYqjlzcylziTXB0rod7QdHFL/L5BST/gimkIhHW/vk=\"},\"SV-78363r1_rule\",\"WN10-UR-000075\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:Hn5uwnn6gC1VwYXthEGUgC6ziFRTZscKIoUS++3Rjto=\"},\"SV-78365r2_rule\",\"WN10-UR-000080\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:XTQwo3vFeHtIVTshIduv4IWitfBFRakuEQXlLRuSS24=\"},\"SV-78367r2_rule\",\"WN10-UR-000085\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:oDnTVUc7IVAYvvMQbb1Wz03I5+3OQ5gnInH/2FTM+UQ=\"},\"SV-78369r4_rule\",\"WN10-UR-000090\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:HCUwYAohklOWhKjdCkwUXELBicl1aKdYsLlX2ENO5ZQ=\"},\"SV-78371r1_rule\",\"WN10-UR-000095\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:h8rwAYISD/28YdzSDaeuG5FpPZBqNPB9wT86XIfoUdE=\"},\"SV-78373r1_rule\",\"WN10-UR-000100\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:8ZljbVob0XqSwiA5dOYkrIecCXdmnQCug5ybd0v/x1Q=\"},\"SV-78379r1_rule\",\"WN10-UR-000110\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zxCJ1n+/xpv4SXNOQLm6wAQSmkH1udVPy4xRJNH22s0=\"},\"SV-78407r1_rule\",\"WN10-UR-000120\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:pvOcEpA+TB34F4cWCOGMSfSEkxZAfBUxITpDJmb9+K4=\"},\"SV-78415r1_rule\",\"WN10-UR-000125\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:ntgurAdRh2vPTZ6v6uIm1vEBH6EsSEipSMq20DsG+D8=\"},\"SV-78417r1_rule\",\"WN10-UR-000130\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:zpJA36QZjPMfklit+NRW9GEdI9+UG+zGf4DOGG8XG6Y=\"},\"SV-78421r1_rule\",\"WN10-UR-000140\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:6Vr6sSumF5z/+2j4Jut2d6KaK1Nl8c/eF71h3mZz84s=\"},\"SV-78423r1_rule\",\"WN10-UR-000145\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:U1jQim/n6VHAUZXYJaQi/HWtt7Q3k/5g/dZtKPgRpRQ=\"},\"SV-78425r1_rule\",\"WN10-UR-000150\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:F0RPJGfwD1qORt7UmHAIsqA20ktqswUXeKiEMO4DFEw=\"},\"SV-78429r1_rule\",\"WN10-UR-000160\"]\n[{\"type\":\"Buffer\",\"data\":\"base64:hO/PQW/5C6I5rdjEwZhLARaC8GglwdI3lTW+tbXMeS4=\"},\"SV-78431r1_rule\",\"WN10-UR-000165\"]\n{\"table\":\"stig\",\"columns\":\"`benchmarkId`,`title`\",\"rowCount\":6}\n[\"RHEL_7_STIG_TEST\",\"Red Hat Enterprise Linux 7 Security Technical Implementation Guide\"]\n[\"VPN_SRG_TEST\",\"Virtual Private Network (VPN) Security Requirements Guide\"]\n[\"VPN_SRG_TEST_Batch\",\"Virtual Private Network (VPN) Security Requirements Guide\"]\n[\"VPN_SRG_OTHER\",\"Virtual Private Network (VPN) Security Requirements Guide - replaced\"]\n[\"VPN_SRG_Rule-fingerprint-match-test\",\"Virtual Private Network (VPN) Security Requirements Guide - replaced\"]\n[\"Windows_10_STIG_TEST\",\"Windows 10 Security Technical Implementation Guide\"]\n{\"table\":\"stig_asset_map\",\"columns\":\"`accepted`,`acceptedResultEngine`,`assessedHighCount`,`assessedLowCount`,`assessedMediumCount`,`assetId`,`benchmarkId`,`error`,`errorResultEngine`,`fail`,`failResultEngine`,`fixed`,`fixedResultEngine`,`highCount`,`informational`,`informationalResultEngine`,`lowCount`,`maxTouchTs`,`maxTs`,`mediumCount`,`minTs`,`notapplicable`,`notapplicableResultEngine`,`notchecked`,`notcheckedResultEngine`,`notselected`,`notselectedResultEngine`,`pass`,`passResultEngine`,`rejected`,`rejectedResultEngine`,`saId`,`saved`,`savedResultEngine`,`submitted`,`submittedResultEngine`,`unknown`,`unknownResultEngine`,`userIds`\",\"rowCount\":10}\n[0,0,0,0,0,240,\"VPN_SRG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,4219,0,0,0,0,0,0,\"[]\"]\n[0,0,0,0,0,153,\"VPN_SRG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,4220,0,0,0,0,0,0,\"[]\"]\n[0,0,0,0,0,38,\"VPN_SRG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,4221,0,0,0,0,0,0,\"[85]\"]\n[0,0,0,0,0,241,\"VPN_SRG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,4222,0,0,0,0,0,0,\"[]\"]\n[0,0,0,0,0,241,\"Windows_10_STIG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,4223,0,0,0,0,0,0,\"[]\"]\n[0,0,0,0,0,34,\"RHEL_7_STIG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,4224,0,0,0,0,0,0,\"[]\"]\n[0,0,0,0,0,34,\"VPN_SRG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,4225,0,0,0,0,0,0,\"[]\"]\n[0,0,0,0,0,34,\"Windows_10_STIG_TEST\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,4226,0,0,0,0,0,0,\"[]\"]\n[0,0,0,0,0,29,\"VPN_SRG_TEST_Batch\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,4227,0,0,0,0,0,0,null]\n[0,0,0,0,0,62,\"VPN_SRG_TEST_Batch\",0,0,0,0,0,0,0,0,0,0,null,null,0,null,0,0,0,0,0,0,0,0,0,0,4228,0,0,0,0,0,0,null]\n{\"table\":\"user_data\",\"columns\":\"`created`,`lastAccess`,`lastClaims`,`status`,`statusDate`,`statusUser`,`userId`,`username`,`webPreferences`\",\"rowCount\":10}\n[\"2024-10-23 10:59:15\",1744054050,\"{\\\"acr\\\": \\\"0\\\", \\\"aud\\\": [\\\"realm-management\\\", \\\"account\\\"], \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1864681035, \\\"iat\\\": 1670540236, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman\\\", \\\"jti\\\": \\\"47f9aa7d-bac4-4098-9be8-ace75513aa7f\\\", \\\"sid\\\": \\\"87365b33-2c76-4b3c-8485-fba5dbff4b9f\\\", \\\"sub\\\": \\\"b7c78a62-b84f-4578-a983-2ebc66fd9efe\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"name\\\": \\\"STIGMAN Admin\\\", \\\"nonce\\\": \\\"3378daff-0404-43b3-b4ab-ee31ff7340ac\\\", \\\"scope\\\": \\\"openid stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:op stig-manager:collection:read stig-manager:op:read stig-manager:user stig-manager stig-manager:stig\\\", \\\"auth_time\\\": 1670540235, \\\"given_name\\\": \\\"STIGMAN\\\", \\\"family_name\\\": \\\"Admin\\\", \\\"realm_access\\\": {\\\"roles\\\": [\\\"create_collection\\\", \\\"default-roles-stigman\\\", \\\"admin\\\"]}, \\\"session_state\\\": \\\"87365b33-2c76-4b3c-8485-fba5dbff4b9f\\\", \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}, \\\"realm-management\\\": {\\\"roles\\\": [\\\"view-users\\\", \\\"query-groups\\\", \\\"query-users\\\"]}}, \\\"preferred_username\\\": \\\"stigmanadmin\\\"}\",\"available\",\"2024-10-23 10:59:15\",null,1,\"stigmanadmin\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:59:15\",1602652507,\"{\\\"acr\\\": \\\"1\\\", \\\"aud\\\": \\\"account\\\", \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1602652806, \\\"iat\\\": 1602652506, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman-test\\\", \\\"jti\\\": \\\"eb5cdbd4-c912-4fc5-a1b8-10cf737d374a\\\", \\\"sub\\\": \\\"51ea2e76-d3db-43ff-b551-68dfbdf01a38\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"nonce\\\": \\\"8fbd4814-621a-4b63-af57-9e62b665a529\\\", \\\"scope\\\": \\\"openid stig-manager:user:read stig-manager:collection stig-manager:user stig-manager:op stig-manager:stig stig-manager:stig:read email profile\\\", \\\"auth_time\\\": 1602652506, \\\"realm_access\\\": {\\\"roles\\\": [\\\"user\\\"]}, \\\"session_state\\\": \\\"d5a18452-599d-4a50-af6f-75fb3808f2e9\\\", \\\"email_verified\\\": false, \\\"allowed-origins\\\": [\\\"*\\\"], \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}}, \\\"preferred_username\\\": \\\"lvl2\\\"}\",\"available\",\"2024-10-23 10:59:15\",null,21,\"lvl2\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:59:15\",null,\"{}\",\"available\",\"2024-10-23 10:59:15\",null,22,\"wf-test\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:59:15\",null,\"{}\",\"available\",\"2024-10-23 10:59:15\",null,43,\"workforce-60\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:59:15\",1602652565,\"{\\\"acr\\\": \\\"1\\\", \\\"aud\\\": \\\"account\\\", \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1602652864, \\\"iat\\\": 1602652564, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman-test\\\", \\\"jti\\\": \\\"72163a5a-9599-4942-92c0-347d3c00d7fb\\\", \\\"sub\\\": \\\"dea1961a-b597-49d1-8b80-a443ec30c7c7\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"nonce\\\": \\\"709a0a0a-9d85-4e31-8266-99b7a306e17c\\\", \\\"scope\\\": \\\"openid stig-manager:user:read stig-manager:collection stig-manager:user stig-manager:op stig-manager:stig stig-manager:stig:read email profile\\\", \\\"auth_time\\\": 1602652564, \\\"realm_access\\\": {\\\"roles\\\": [\\\"user\\\"]}, \\\"session_state\\\": \\\"bcf64712-4b8d-4e42-86c9-d173a363e4d5\\\", \\\"email_verified\\\": false, \\\"allowed-origins\\\": [\\\"*\\\"], \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}}, \\\"preferred_username\\\": \\\"lvl3\\\"}\",\"available\",\"2024-10-23 10:59:15\",null,44,\"lvl3\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:59:15\",1733344708,\"{\\\"acr\\\": \\\"0\\\", \\\"aud\\\": [\\\"realm-management\\\", \\\"account\\\"], \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1864709163, \\\"iat\\\": 1670568364, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman\\\", \\\"jti\\\": \\\"7180f59c-d4d3-442f-b5e5-76f120a947aa\\\", \\\"sid\\\": \\\"bf4ccf4c-7e40-47b6-b02b-cfd09d71989f\\\", \\\"sub\\\": \\\"902cfa46-61b3-49a7-8e8a-6f70a93c2a97\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"name\\\": \\\"lvl4\\\", \\\"nonce\\\": \\\"1eaa8441-dafb-4a93-87ff-1d73437e0eca\\\", \\\"scope\\\": \\\"openid stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:collection:read\\\", \\\"auth_time\\\": 1670568363, \\\"given_name\\\": \\\"lvl4\\\", \\\"realm_access\\\": {\\\"roles\\\": [\\\"default-roles-stigman\\\"]}, \\\"session_state\\\": \\\"bf4ccf4c-7e40-47b6-b02b-cfd09d71989f\\\", \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}, \\\"realm-management\\\": {\\\"roles\\\": [\\\"view-users\\\", \\\"query-groups\\\", \\\"query-users\\\"]}}, \\\"preferred_username\\\": \\\"lvl4\\\"}\",\"available\",\"2024-10-23 10:59:15\",null,45,\"lvl4\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:59:15\",1602652554,\"{\\\"acr\\\": \\\"1\\\", \\\"aud\\\": \\\"account\\\", \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1602652854, \\\"iat\\\": 1602652554, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman-test\\\", \\\"jti\\\": \\\"dba7eae1-8a6b-4335-ae34-93097a78c948\\\", \\\"sub\\\": \\\"0afa914a-cdbb-4edb-baca-3a664dc20cd0\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"nonce\\\": \\\"5337bda6-559e-4823-8764-488337bd390f\\\", \\\"scope\\\": \\\"openid stig-manager:user:read stig-manager:collection stig-manager:user stig-manager:op stig-manager:stig stig-manager:stig:read email profile\\\", \\\"auth_time\\\": 1602652553, \\\"realm_access\\\": {\\\"roles\\\": [\\\"create_collection\\\", \\\"user\\\"]}, \\\"session_state\\\": \\\"69ed7f9b-1858-4af3-b909-7b9120c08878\\\", \\\"email_verified\\\": false, \\\"allowed-origins\\\": [\\\"*\\\"], \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}}, \\\"preferred_username\\\": \\\"collectioncreator\\\"}\",\"available\",\"2024-10-23 10:59:15\",null,82,\"collectioncreator\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:59:15\",1602652493,\"{\\\"acr\\\": \\\"1\\\", \\\"aud\\\": \\\"account\\\", \\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 1602652792, \\\"iat\\\": 1602652492, \\\"iss\\\": \\\"http://localhost:8080/auth/realms/stigman-test\\\", \\\"jti\\\": \\\"64ea09c4-e9fd-423c-b447-aff38d38f04e\\\", \\\"sub\\\": \\\"757dd598-d9d8-4c0b-8811-ec7f40925986\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"nonce\\\": \\\"48fe2aae-66f8-4188-8af3-419129aa02e6\\\", \\\"scope\\\": \\\"openid stig-manager:user:read stig-manager:collection stig-manager:user stig-manager:op stig-manager:stig stig-manager:stig:read email profile\\\", \\\"auth_time\\\": 1602652492, \\\"realm_access\\\": {\\\"roles\\\": [\\\"user\\\"]}, \\\"session_state\\\": \\\"cbf87935-3521-4c5d-a22e-d8dd9e60e5e3\\\", \\\"email_verified\\\": false, \\\"allowed-origins\\\": [\\\"*\\\"], \\\"resource_access\\\": {\\\"account\\\": {\\\"roles\\\": [\\\"manage-account\\\", \\\"manage-account-links\\\", \\\"view-profile\\\"]}}, \\\"preferred_username\\\": \\\"lvl1\\\"}\",\"available\",\"2024-10-23 10:59:15\",null,85,\"lvl1\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:59:15\",null,\"{}\",\"available\",\"2024-10-23 10:59:15\",null,86,\"bizarroLvl1\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2024-10-23 10:59:15\",1759361890,\"{\\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 2057787828, \\\"iat\\\": 1742427828, \\\"iss\\\": \\\"http://localhost:8080/realms/stigman\\\", \\\"jti\\\": \\\"fb064b55-c896-4e57-a697-8ef4f153cb6d\\\", \\\"sid\\\": \\\"38a7409c-4a63-4311-ab62-5de78f573d5c\\\", \\\"sub\\\": \\\"bf87a16f-39e6-46d9-8971-f0ef51dd3f85\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"name\\\": \\\"Admin Burke\\\", \\\"scope\\\": \\\"stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:op stig-manager:user stig-manager:stig\\\", \\\"auth_time\\\": 1742427221, \\\"given_name\\\": \\\"Admin\\\", \\\"family_name\\\": \\\"Burke\\\", \\\"realm_access\\\": {\\\"roles\\\": [\\\"create_collection\\\", \\\"admin\\\"]}, \\\"preferred_username\\\": \\\"admin\\\"}\",\"available\",\"2024-10-23 10:59:15\",null,87,\"admin\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n{\"table\":\"user_group\",\"columns\":\"`createdDate`,`createdUserId`,`description`,`modifiedDate`,`modifiedUserId`,`name`,`userGroupId`\",\"rowCount\":0}\n{\"table\":\"user_group_user_map\",\"columns\":\"`ugumId`,`userGroupId`,`userId`\",\"rowCount\":0}\n"
  },
  {
    "path": "test/api/appdata/user-status-get-post.jsonl",
    "content": "{\"version\":\"1.6.2\",\"commit\":{\"branch\":\"na\",\"sha\":\"na\",\"tag\":\"na\",\"describe\":\"na\"},\"date\":\"2026-03-09T22:46:26.265Z\",\"lastMigration\":46}\n{\"tables\":[{\"table\":\"asset\",\"rowCount\":0},{\"table\":\"check_content\",\"rowCount\":0},{\"table\":\"collection\",\"rowCount\":1},{\"table\":\"collection_grant\",\"rowCount\":1},{\"table\":\"collection_grant_acl\",\"rowCount\":0},{\"table\":\"collection_label\",\"rowCount\":0},{\"table\":\"collection_label_asset_map\",\"rowCount\":0},{\"table\":\"collection_rev_map\",\"rowCount\":0},{\"table\":\"current_rev\",\"rowCount\":0},{\"table\":\"default_rev\",\"rowCount\":0},{\"table\":\"fix_text\",\"rowCount\":0},{\"table\":\"rev_group_rule_cci_map\",\"rowCount\":0},{\"table\":\"rev_group_rule_map\",\"rowCount\":0},{\"table\":\"review\",\"rowCount\":0},{\"table\":\"review_history\",\"rowCount\":0},{\"table\":\"revision\",\"rowCount\":0},{\"table\":\"rule_version_check_digest\",\"rowCount\":0},{\"table\":\"stig\",\"rowCount\":0},{\"table\":\"stig_asset_map\",\"rowCount\":0},{\"table\":\"user_data\",\"rowCount\":2},{\"table\":\"user_group\",\"rowCount\":0},{\"table\":\"user_group_user_map\",\"rowCount\":0}],\"totalRows\":4}\n{\"table\":\"asset\",\"columns\":\"`assetId`,`collectionId`,`description`,`fqdn`,`ip`,`mac`,`metadata`,`name`,`noncomputing`,`state`,`stateDate`,`stateUserId`\",\"rowCount\":0}\n{\"table\":\"check_content\",\"columns\":\"`ccId`,`content`\",\"rowCount\":0}\n{\"table\":\"collection\",\"columns\":\"`collectionId`,`created`,`createdUserId`,`description`,`metadata`,`name`,`settings`,`state`,`stateDate`,`stateUserId`\",\"rowCount\":1}\n[1,\"2025-03-22 18:23:18\",null,\"\",\"{}\",\"status-collection\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 5}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n{\"table\":\"collection_grant\",\"columns\":\"`collectionId`,`grantId`,`roleId`,`userGroupId`,`userId`\",\"rowCount\":1}\n[1,1,4,null,1]\n{\"table\":\"collection_grant_acl\",\"columns\":\"`access`,`assetId`,`benchmarkId`,`cgAclId`,`clId`,`grantId`,`modifiedDate`,`modifiedUserId`\",\"rowCount\":0}\n{\"table\":\"collection_label\",\"columns\":\"`clId`,`collectionId`,`color`,`description`,`name`,`uuid`\",\"rowCount\":0}\n{\"table\":\"collection_label_asset_map\",\"columns\":\"`assetId`,`claId`,`clId`\",\"rowCount\":0}\n{\"table\":\"collection_rev_map\",\"columns\":\"`benchmarkId`,`collectionId`,`crId`,`revId`\",\"rowCount\":0}\n{\"table\":\"current_rev\",\"columns\":\"`active`,`benchmarkDate`,`benchmarkDateSql`,`benchmarkId`,`checkCount`,`description`,`fixCount`,`groupCount`,`highCount`,`lowCount`,`marking`,`mediumCount`,`release`,`revId`,`status`,`statusDate`,`version`\",\"rowCount\":0}\n{\"table\":\"default_rev\",\"columns\":\"`benchmarkId`,`collectionId`,`revId`,`revisionPinned`,`vdId`\",\"rowCount\":0}\n{\"table\":\"fix_text\",\"columns\":\"`ftId`,`text`\",\"rowCount\":0}\n{\"table\":\"rev_group_rule_cci_map\",\"columns\":\"`cci`,`rgrccId`,`rgrId`\",\"rowCount\":0}\n{\"table\":\"rev_group_rule_map\",\"columns\":\"`checkDigest`,`checkSystem`,`documentable`,`falseNegatives`,`falsePositives`,`fixDigest`,`fixref`,`groupId`,`groupSeverity`,`groupTitle`,`iaControls`,`mitigationControl`,`mitigations`,`potentialImpacts`,`responsibility`,`revId`,`rgrId`,`ruleId`,`severity`,`severityOverrideGuidance`,`thirdPartyTools`,`title`,`version`,`vulnDiscussion`,`weight`\",\"rowCount\":0}\n{\"table\":\"review\",\"columns\":\"`assetId`,`autoResult`,`checkDigest`,`comment`,`detail`,`metadata`,`resultEngine`,`resultId`,`reviewId`,`ruleId`,`statusId`,`statusText`,`statusTs`,`statusUserId`,`ts`,`userId`,`version`\",\"rowCount\":0}\n{\"table\":\"review_history\",\"columns\":\"`autoResult`,`comment`,`detail`,`historyId`,`resultEngine`,`resultId`,`reviewId`,`ruleId`,`statusId`,`statusText`,`statusTs`,`statusUserId`,`touchTs`,`ts`,`userId`\",\"rowCount\":0}\n{\"table\":\"revision\",\"columns\":\"`active`,`benchmarkDate`,`benchmarkDateSql`,`benchmarkId`,`checkCount`,`description`,`fixCount`,`groupCount`,`highCount`,`lowCount`,`marking`,`mediumCount`,`release`,`revId`,`status`,`statusDate`,`version`\",\"rowCount\":0}\n{\"table\":\"rule_version_check_digest\",\"columns\":\"`checkDigest`,`ruleId`,`version`\",\"rowCount\":0}\n{\"table\":\"stig\",\"columns\":\"`benchmarkId`,`title`\",\"rowCount\":0}\n{\"table\":\"stig_asset_map\",\"columns\":\"`accepted`,`acceptedResultEngine`,`assessedHighCount`,`assessedLowCount`,`assessedMediumCount`,`assetId`,`benchmarkId`,`error`,`errorResultEngine`,`fail`,`failResultEngine`,`fixed`,`fixedResultEngine`,`highCount`,`informational`,`informationalResultEngine`,`lowCount`,`maxTouchTs`,`maxTs`,`mediumCount`,`minTs`,`notapplicable`,`notapplicableResultEngine`,`notchecked`,`notcheckedResultEngine`,`notselected`,`notselectedResultEngine`,`pass`,`passResultEngine`,`rejected`,`rejectedResultEngine`,`saId`,`saved`,`savedResultEngine`,`submitted`,`submittedResultEngine`,`unknown`,`unknownResultEngine`,`userIds`\",\"rowCount\":0}\n{\"table\":\"user_data\",\"columns\":\"`created`,`lastAccess`,`lastClaims`,`status`,`statusDate`,`statusUser`,`userId`,`username`,`webPreferences`\",\"rowCount\":2}\n[\"2025-03-19 23:09:52\",1759361894,\"{\\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 2057787828, \\\"iat\\\": 1742427828, \\\"iss\\\": \\\"http://localhost:8080/realms/stigman\\\", \\\"jti\\\": \\\"fb064b55-c896-4e57-a697-8ef4f153cb6d\\\", \\\"sid\\\": \\\"38a7409c-4a63-4311-ab62-5de78f573d5c\\\", \\\"sub\\\": \\\"bf87a16f-39e6-46d9-8971-f0ef51dd3f85\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"name\\\": \\\"Admin Burke\\\", \\\"scope\\\": \\\"stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:op stig-manager:user stig-manager:stig\\\", \\\"auth_time\\\": 1742427221, \\\"given_name\\\": \\\"Admin\\\", \\\"family_name\\\": \\\"Burke\\\", \\\"realm_access\\\": {\\\"roles\\\": [\\\"create_collection\\\", \\\"admin\\\"]}, \\\"preferred_username\\\": \\\"admin\\\"}\",\"available\",\"2025-01-01 00:00:00\",null,1,\"admin\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2025-03-19 23:48:44\",1735707600,\"{}\",\"unavailable\",\"2025-01-01 00:00:01\",1,2,\"user01\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n{\"table\":\"user_group\",\"columns\":\"`createdDate`,`createdUserId`,`description`,`modifiedDate`,`modifiedUserId`,`name`,`userGroupId`\",\"rowCount\":0}\n{\"table\":\"user_group_user_map\",\"columns\":\"`ugumId`,`userGroupId`,`userId`\",\"rowCount\":0}\n"
  },
  {
    "path": "test/api/appdata/user-status-patch-put.jsonl",
    "content": "{\"version\":\"1.6.2\",\"commit\":{\"branch\":\"na\",\"sha\":\"na\",\"tag\":\"na\",\"describe\":\"na\"},\"date\":\"2026-03-09T22:46:30.306Z\",\"lastMigration\":46}\n{\"tables\":[{\"table\":\"asset\",\"rowCount\":0},{\"table\":\"check_content\",\"rowCount\":0},{\"table\":\"collection\",\"rowCount\":1},{\"table\":\"collection_grant\",\"rowCount\":2},{\"table\":\"collection_grant_acl\",\"rowCount\":0},{\"table\":\"collection_label\",\"rowCount\":0},{\"table\":\"collection_label_asset_map\",\"rowCount\":0},{\"table\":\"collection_rev_map\",\"rowCount\":0},{\"table\":\"current_rev\",\"rowCount\":0},{\"table\":\"default_rev\",\"rowCount\":0},{\"table\":\"fix_text\",\"rowCount\":0},{\"table\":\"rev_group_rule_cci_map\",\"rowCount\":0},{\"table\":\"rev_group_rule_map\",\"rowCount\":0},{\"table\":\"review\",\"rowCount\":0},{\"table\":\"review_history\",\"rowCount\":0},{\"table\":\"revision\",\"rowCount\":0},{\"table\":\"rule_version_check_digest\",\"rowCount\":0},{\"table\":\"stig\",\"rowCount\":0},{\"table\":\"stig_asset_map\",\"rowCount\":0},{\"table\":\"user_data\",\"rowCount\":4},{\"table\":\"user_group\",\"rowCount\":1},{\"table\":\"user_group_user_map\",\"rowCount\":1}],\"totalRows\":9}\n{\"table\":\"asset\",\"columns\":\"`assetId`,`collectionId`,`description`,`fqdn`,`ip`,`mac`,`metadata`,`name`,`noncomputing`,`state`,`stateDate`,`stateUserId`\",\"rowCount\":0}\n{\"table\":\"check_content\",\"columns\":\"`ccId`,`content`\",\"rowCount\":0}\n{\"table\":\"collection\",\"columns\":\"`collectionId`,`created`,`createdUserId`,`description`,`metadata`,`name`,`settings`,`state`,`stateDate`,`stateUserId`\",\"rowCount\":1}\n[1,\"2025-03-22 18:23:18\",null,\"\",\"{}\",\"status-collection\",\"{\\\"fields\\\": {\\\"detail\\\": {\\\"enabled\\\": \\\"always\\\", \\\"required\\\": \\\"always\\\"}, \\\"comment\\\": {\\\"enabled\\\": \\\"findings\\\", \\\"required\\\": \\\"findings\\\"}}, \\\"status\\\": {\\\"canAccept\\\": true, \\\"resetCriteria\\\": \\\"result\\\", \\\"minAcceptGrant\\\": 3}, \\\"history\\\": {\\\"maxReviews\\\": 5}, \\\"importOptions\\\": {\\\"autoStatus\\\": {\\\"fail\\\": \\\"submitted\\\", \\\"pass\\\": \\\"submitted\\\", \\\"notapplicable\\\": \\\"submitted\\\"}, \\\"unreviewed\\\": \\\"commented\\\", \\\"allowCustom\\\": true, \\\"emptyDetail\\\": \\\"replace\\\", \\\"emptyComment\\\": \\\"ignore\\\", \\\"unreviewedCommented\\\": \\\"informational\\\"}}\",\"enabled\",null,null]\n{\"table\":\"collection_grant\",\"columns\":\"`collectionId`,`grantId`,`roleId`,`userGroupId`,`userId`\",\"rowCount\":2}\n[1,1,4,null,1]\n[1,2,2,null,3]\n{\"table\":\"collection_grant_acl\",\"columns\":\"`access`,`assetId`,`benchmarkId`,`cgAclId`,`clId`,`grantId`,`modifiedDate`,`modifiedUserId`\",\"rowCount\":0}\n{\"table\":\"collection_label\",\"columns\":\"`clId`,`collectionId`,`color`,`description`,`name`,`uuid`\",\"rowCount\":0}\n{\"table\":\"collection_label_asset_map\",\"columns\":\"`assetId`,`claId`,`clId`\",\"rowCount\":0}\n{\"table\":\"collection_rev_map\",\"columns\":\"`benchmarkId`,`collectionId`,`crId`,`revId`\",\"rowCount\":0}\n{\"table\":\"current_rev\",\"columns\":\"`active`,`benchmarkDate`,`benchmarkDateSql`,`benchmarkId`,`checkCount`,`description`,`fixCount`,`groupCount`,`highCount`,`lowCount`,`marking`,`mediumCount`,`release`,`revId`,`status`,`statusDate`,`version`\",\"rowCount\":0}\n{\"table\":\"default_rev\",\"columns\":\"`benchmarkId`,`collectionId`,`revId`,`revisionPinned`,`vdId`\",\"rowCount\":0}\n{\"table\":\"fix_text\",\"columns\":\"`ftId`,`text`\",\"rowCount\":0}\n{\"table\":\"rev_group_rule_cci_map\",\"columns\":\"`cci`,`rgrccId`,`rgrId`\",\"rowCount\":0}\n{\"table\":\"rev_group_rule_map\",\"columns\":\"`checkDigest`,`checkSystem`,`documentable`,`falseNegatives`,`falsePositives`,`fixDigest`,`fixref`,`groupId`,`groupSeverity`,`groupTitle`,`iaControls`,`mitigationControl`,`mitigations`,`potentialImpacts`,`responsibility`,`revId`,`rgrId`,`ruleId`,`severity`,`severityOverrideGuidance`,`thirdPartyTools`,`title`,`version`,`vulnDiscussion`,`weight`\",\"rowCount\":0}\n{\"table\":\"review\",\"columns\":\"`assetId`,`autoResult`,`checkDigest`,`comment`,`detail`,`metadata`,`resultEngine`,`resultId`,`reviewId`,`ruleId`,`statusId`,`statusText`,`statusTs`,`statusUserId`,`ts`,`userId`,`version`\",\"rowCount\":0}\n{\"table\":\"review_history\",\"columns\":\"`autoResult`,`comment`,`detail`,`historyId`,`resultEngine`,`resultId`,`reviewId`,`ruleId`,`statusId`,`statusText`,`statusTs`,`statusUserId`,`touchTs`,`ts`,`userId`\",\"rowCount\":0}\n{\"table\":\"revision\",\"columns\":\"`active`,`benchmarkDate`,`benchmarkDateSql`,`benchmarkId`,`checkCount`,`description`,`fixCount`,`groupCount`,`highCount`,`lowCount`,`marking`,`mediumCount`,`release`,`revId`,`status`,`statusDate`,`version`\",\"rowCount\":0}\n{\"table\":\"rule_version_check_digest\",\"columns\":\"`checkDigest`,`ruleId`,`version`\",\"rowCount\":0}\n{\"table\":\"stig\",\"columns\":\"`benchmarkId`,`title`\",\"rowCount\":0}\n{\"table\":\"stig_asset_map\",\"columns\":\"`accepted`,`acceptedResultEngine`,`assessedHighCount`,`assessedLowCount`,`assessedMediumCount`,`assetId`,`benchmarkId`,`error`,`errorResultEngine`,`fail`,`failResultEngine`,`fixed`,`fixedResultEngine`,`highCount`,`informational`,`informationalResultEngine`,`lowCount`,`maxTouchTs`,`maxTs`,`mediumCount`,`minTs`,`notapplicable`,`notapplicableResultEngine`,`notchecked`,`notcheckedResultEngine`,`notselected`,`notselectedResultEngine`,`pass`,`passResultEngine`,`rejected`,`rejectedResultEngine`,`saId`,`saved`,`savedResultEngine`,`submitted`,`submittedResultEngine`,`unknown`,`unknownResultEngine`,`userIds`\",\"rowCount\":0}\n{\"table\":\"user_data\",\"columns\":\"`created`,`lastAccess`,`lastClaims`,`status`,`statusDate`,`statusUser`,`userId`,`username`,`webPreferences`\",\"rowCount\":4}\n[\"2025-03-19 23:09:52\",1759361898,\"{\\\"azp\\\": \\\"stig-manager\\\", \\\"exp\\\": 2057787828, \\\"iat\\\": 1742427828, \\\"iss\\\": \\\"http://localhost:8080/realms/stigman\\\", \\\"jti\\\": \\\"fb064b55-c896-4e57-a697-8ef4f153cb6d\\\", \\\"sid\\\": \\\"38a7409c-4a63-4311-ab62-5de78f573d5c\\\", \\\"sub\\\": \\\"bf87a16f-39e6-46d9-8971-f0ef51dd3f85\\\", \\\"typ\\\": \\\"Bearer\\\", \\\"name\\\": \\\"Admin Burke\\\", \\\"scope\\\": \\\"stig-manager:collection stig-manager:stig:read stig-manager:user:read stig-manager:op stig-manager:user stig-manager:stig\\\", \\\"auth_time\\\": 1742427221, \\\"given_name\\\": \\\"Admin\\\", \\\"family_name\\\": \\\"Burke\\\", \\\"realm_access\\\": {\\\"roles\\\": [\\\"create_collection\\\", \\\"admin\\\"]}, \\\"preferred_username\\\": \\\"admin\\\"}\",\"available\",\"2025-01-01 00:00:00\",null,1,\"admin\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2025-03-19 23:48:44\",null,\"{}\",\"unavailable\",\"2025-01-01 00:00:01\",1,2,\"user01\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2025-03-22 18:21:24\",null,\"{}\",\"available\",\"2025-01-01 00:00:02\",null,3,\"user02\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n[\"2025-03-22 18:21:24\",null,\"{}\",\"available\",\"2025-01-01 00:00:03\",null,4,\"user03\",\"{\\\"darkMode\\\": true, \\\"lastWhatsNew\\\": \\\"2000-01-01\\\"}\"]\n{\"table\":\"user_group\",\"columns\":\"`createdDate`,`createdUserId`,`description`,`modifiedDate`,`modifiedUserId`,`name`,`userGroupId`\",\"rowCount\":1}\n[\"2025-03-22 18:23:09\",1,\"\",\"2025-03-22 18:23:09\",1,\"status-group\",1]\n{\"table\":\"user_group_user_map\",\"columns\":\"`ugumId`,`userGroupId`,`userId`\",\"rowCount\":1}\n[1,1,3]\n"
  },
  {
    "path": "test/api/dark.css",
    "content": "/*! mochawesome-report-generator 6.2.0 | https://github.com/adamgruber/mochawesome-report-generator */\n:root {\n    --screen-sm-min: 768px;\n    --screen-md-min: 992px;\n    --screen-lg-min: 1200px;\n    --grid-gutter-width: 30px;\n    --container-sm: calc(720px + var(--grid-gutter-width));\n    --container-md: calc(940px + var(--grid-gutter-width));\n    --container-lg: calc(1140px + var(--grid-gutter-width));\n    --navbar-height: 122px;\n    --navbar-height-short: 56px;\n    --summary-height-stacked: 82px;\n    --statusbar-height-stacked: 54px;\n    --footer-height: 60px;\n    --default-transition-duration: 0.2s;\n    --default-transition-easing: ease;\n    --gray-base: #000;\n    --gray-darker-faded: color(var(--gray-darker) alpha(95%));\n    --gray-darker: color(var(--gray-base) tint(13.5%));\n    --gray-dark: color(var(--gray-base) tint(20%));\n    --gray: color(var(--gray-base) tint(33.5%));\n    --gray-light: color(var(--gray-base) tint(46.7%));\n    --gray-medium: color(var(--gray-base) tint(73.5%));\n    --gray-lighter: color(var(--gray-base) tint(93.5%));\n    --gray-lighter-faded: color(var(--gray-lighter) alpha(95%));\n    --gray-border: color(var(--gray-base) tint(80%));\n    --grey50: #eceff1;\n    --grey100: #f5f5f5;\n    --grey300: #e0e0e0;\n    --grey500: #9e9e9e;\n    --grey700: #616161;\n    --green100: #c8e6c9;\n    --green200: #a5d6a7;\n    --green300: #81c784;\n    --green500: #4caf50;\n    --green700: #388e3c;\n    --red100: #ffcdd2;\n    --red300: #e57373;\n    --red500: #f44336;\n    --red700: #d32f2f;\n    --ltblue100: #b3e5fc;\n    --ltblue300: #4fc3f7;\n    --ltblue500: #03a9f4;\n    --ltblue700: #0288d1;\n    --black87: rgba(0,0,0,0.87);\n    --black54: rgba(0,0,0,0.54);\n    --black38: rgba(0,0,0,0.38);\n    --bluegrey500: #607d8b;\n    --bluegrey800: #37474f;\n    --bluegrey900: #263238;\n    --light-icon-active: #fff;\n    --light-icon-inactive: hsla(0,0%,100%,0.5);\n    --dark-icon-active: var(--black54);\n    --dark-icon-inactive: var(--black38);\n    --amber300: #ffd54f;\n    --amber400: #ffca28;\n    --amber500: #ffc107;\n    --yellow700: #fbc02d;\n    --yellow800: #f9a825;\n    --brand-primary: color(#428bca shade(6.5%));\n    --brand-success: #4caf50;\n    --brand-info: #5bc0de;\n    --brand-warning: #f0ad4e;\n    --brand-danger: #d9534f;\n    --text-color: var(--black87);\n    --body-bg: #f2f2f2;\n    --link-color: var(--brand-primary);\n    --link-hover-color: color(var(--link-color) shade(15%));\n    --list-group-border: #ddd;\n    --font-family-sans-serif: \"robotoregular\",\"Helvetica Neue\",Helvetica,Arial,sans-serif;\n    --font-family-base: var(--font-family-sans-serif);\n    --font-family-mono: \"Menlo\",\"Monaco\",\"Consolas\",\"Courier New\",monospace;\n    --font-size-base: 14px;\n    --line-height-base: 1.429;\n    --line-height-computed: 20px;\n    --headings-font-family: inherit;\n    --headings-font-weight: 400;\n    --headings-line-height: 1.1;\n    --headings-color: inherit;\n    --headings-small-color: var(--gray-light);\n    --font-size-h1: 36px;\n    --font-size-h2: 30px;\n    --font-size-h3: 24px;\n    --font-size-h4: 18px;\n    --font-size-h5: var(--font-size-base);\n    --font-size-h6: 12px;\n    --font-family-light: \"robotolight\";\n    --font-family-regular: \"robotoregular\";\n    --font-family-medium: \"robotomedium\";\n    --link-transition: color 0.2s ease-out\n}\n\n.dropdown--trans-color---3ixtY {\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\n.dropdown--component---21Q9c {\n    position: relative\n}\n\n.dropdown--toggle---3gdzr {\n    white-space: nowrap\n}\n\n.dropdown--toggle-icon---1j9Ga:not(.dropdown--icon-only---3vq2I) {\n    margin-left: .5rem\n}\n\n.dropdown--list---8GPrA {\n    padding: 0;\n    margin: 0;\n    list-style: none;\n    text-align: left\n}\n\n.dropdown--list-main---3QZnQ {\n    position: absolute;\n    top: 100%;\n    z-index: 1000;\n    visibility: hidden;\n    min-width: 160px;\n    overflow: auto\n}\n\n.dropdown--align-left---3-3Hu {\n    left: 0\n}\n\n.dropdown--align-right---2ZQx0 {\n    right: 0\n}\n\n.dropdown--list-item-link---JRrOY,.dropdown--list-item-text---2COKZ {\n    display: block;\n    position: relative;\n    white-space: nowrap;\n    text-decoration: none\n}\n\n.dropdown--list-item-text---2COKZ {\n    cursor: default\n}\n\n@-webkit-keyframes dropdown--in---FpwEb {\n    0% {\n        opacity: 0\n    }\n\n    to {\n        opacity: 1\n    }\n}\n\n@keyframes dropdown--in---FpwEb {\n    0% {\n        opacity: 0\n    }\n\n    to {\n        opacity: 1\n    }\n}\n\n@-webkit-keyframes dropdown--out---2HVe1 {\n    0% {\n        opacity: 1;\n        visibility: visible\n    }\n\n    to {\n        opacity: 0\n    }\n}\n\n@keyframes dropdown--out---2HVe1 {\n    0% {\n        opacity: 1;\n        visibility: visible\n    }\n\n    to {\n        opacity: 0\n    }\n}\n\n.dropdown--close---2LnDu {\n    -webkit-animation: dropdown--out---2HVe1 .2s ease;\n    animation: dropdown--out---2HVe1 .2s ease;\n    -webkit-animation: dropdown--out---2HVe1 var(--default-transition-duration) var(--default-transition-easing);\n    animation: dropdown--out---2HVe1 var(--default-transition-duration) var(--default-transition-easing);\n    visibility: hidden\n}\n\n.dropdown--open---3bwiy {\n    -webkit-animation: dropdown--in---FpwEb .2s ease;\n    animation: dropdown--in---FpwEb .2s ease;\n    -webkit-animation: dropdown--in---FpwEb var(--default-transition-duration) var(--default-transition-easing);\n    animation: dropdown--in---FpwEb var(--default-transition-duration) var(--default-transition-easing);\n    visibility: visible\n}\n\n:root {\n    --screen-sm-min: 768px;\n    --screen-md-min: 992px;\n    --screen-lg-min: 1200px;\n    --grid-gutter-width: 30px;\n    --container-sm: calc(720px + var(--grid-gutter-width));\n    --container-md: calc(940px + var(--grid-gutter-width));\n    --container-lg: calc(1140px + var(--grid-gutter-width));\n    --navbar-height: 122px;\n    --navbar-height-short: 56px;\n    --summary-height-stacked: 82px;\n    --statusbar-height-stacked: 54px;\n    --footer-height: 60px;\n    --default-transition-duration: 0.2s;\n    --default-transition-easing: ease;\n    --gray-base: #000;\n    --gray-darker-faded: color(var(--gray-darker) alpha(95%));\n    --gray-darker: color(var(--gray-base) tint(13.5%));\n    --gray-dark: color(var(--gray-base) tint(20%));\n    --gray: color(var(--gray-base) tint(33.5%));\n    --gray-light: color(var(--gray-base) tint(46.7%));\n    --gray-medium: color(var(--gray-base) tint(73.5%));\n    --gray-lighter: color(var(--gray-base) tint(93.5%));\n    --gray-lighter-faded: color(var(--gray-lighter) alpha(95%));\n    --gray-border: color(var(--gray-base) tint(80%));\n    --grey50: #eceff1;\n    --grey100: #f5f5f5;\n    --grey300: #e0e0e0;\n    --grey500: #9e9e9e;\n    --grey700: #616161;\n    --green100: #c8e6c9;\n    --green200: #a5d6a7;\n    --green300: #81c784;\n    --green500: #4caf50;\n    --green700: #388e3c;\n    --red100: #ffcdd2;\n    --red300: #e57373;\n    --red500: #f44336;\n    --red700: #d32f2f;\n    --ltblue100: #b3e5fc;\n    --ltblue300: #4fc3f7;\n    --ltblue500: #03a9f4;\n    --ltblue700: #0288d1;\n    --black87: rgba(0,0,0,0.87);\n    --black54: rgba(0,0,0,0.54);\n    --black38: rgba(0,0,0,0.38);\n    --bluegrey500: #607d8b;\n    --bluegrey800: #37474f;\n    --bluegrey900: #263238;\n    --light-icon-active: #fff;\n    --light-icon-inactive: hsla(0,0%,100%,0.5);\n    --dark-icon-active: var(--black54);\n    --dark-icon-inactive: var(--black38);\n    --amber300: #ffd54f;\n    --amber400: #ffca28;\n    --amber500: #ffc107;\n    --yellow700: #fbc02d;\n    --yellow800: #f9a825;\n    --brand-primary: color(#428bca shade(6.5%));\n    --brand-success: #4caf50;\n    --brand-info: #5bc0de;\n    --brand-warning: #f0ad4e;\n    --brand-danger: #d9534f;\n    --text-color: var(--black87);\n    --body-bg: #f2f2f2;\n    --link-color: var(--brand-primary);\n    --link-hover-color: color(var(--link-color) shade(15%));\n    --list-group-border: #ddd;\n    --font-family-sans-serif: \"robotoregular\",\"Helvetica Neue\",Helvetica,Arial,sans-serif;\n    --font-family-base: var(--font-family-sans-serif);\n    --font-family-mono: \"Menlo\",\"Monaco\",\"Consolas\",\"Courier New\",monospace;\n    --font-size-base: 14px;\n    --line-height-base: 1.429;\n    --line-height-computed: 20px;\n    --headings-font-family: inherit;\n    --headings-font-weight: 400;\n    --headings-line-height: 1.1;\n    --headings-color: inherit;\n    --headings-small-color: var(--gray-light);\n    --font-size-h1: 36px;\n    --font-size-h2: 30px;\n    --font-size-h3: 24px;\n    --font-size-h4: 18px;\n    --font-size-h5: var(--font-size-base);\n    --font-size-h6: 12px;\n    --font-family-light: \"robotolight\";\n    --font-family-regular: \"robotoregular\";\n    --font-family-medium: \"robotomedium\";\n    --link-transition: color 0.2s ease-out\n}\n\n.dropdown-selector--trans-color---3nePW {\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\n.dropdown-selector--dropdown---AT5ee {\n    right: -8px\n}\n\n.dropdown-selector--menu---nW4gv {\n    box-shadow: 0 2px 5px 0 rgba(0,0,0,.16),0 2px 10px 0 rgba(0,0,0,.12);\n    font-family: robotolight;\n    font-family: var(--font-family-light);\n    min-width: 70px;\n    width: 70px;\n    background: #fff;\n    top: 0\n}\n\n.dropdown-selector--toggle---WEnEe {\n    display: inline-block;\n    font-family: robotoregular;\n    font-family: var(--font-family-regular);\n    font-size: 14px;\n    color: rgba(0,0,0,.54);\n    color: var(--black54);\n    vertical-align: top;\n    line-height: 24px;\n    padding: 0 22px 0 0;\n    cursor: pointer;\n    border: none;\n    background: none;\n    outline: none;\n    width: 70px\n}\n\n.dropdown-selector--toggle---WEnEe:focus {\n    box-shadow: 0 0 2px 0 #03a9f4;\n    box-shadow: 0 0 2px 0 var(--ltblue500)\n}\n\n.dropdown-selector--toggle-icon---10VKo {\n    position: absolute;\n    top: 4px;\n    right: 4px\n}\n\n.dropdown-selector--item-link---2W1T7,.dropdown-selector--toggle-icon---10VKo {\n    color: rgba(0,0,0,.38);\n    color: var(--black38)\n}\n\n.dropdown-selector--item-link---2W1T7 {\n    border: none;\n    cursor: pointer;\n    padding: 4px 10px;\n    text-align: left;\n    width: 100%\n}\n\n.dropdown-selector--item-link---2W1T7:hover {\n    background-color: #f5f5f5;\n    background-color: var(--grey100)\n}\n\n.dropdown-selector--item-link---2W1T7:focus {\n    box-shadow: inset 0 0 2px 0 #03a9f4;\n    box-shadow: inset 0 0 2px 0 var(--ltblue500);\n    outline: none\n}\n\n.dropdown-selector--item-selected---1q-NK .dropdown-selector--item-link---2W1T7 {\n    color: #4caf50;\n    color: var(--green500)\n}\n\n:root {\n    --screen-sm-min: 768px;\n    --screen-md-min: 992px;\n    --screen-lg-min: 1200px;\n    --grid-gutter-width: 30px;\n    --container-sm: calc(720px + var(--grid-gutter-width));\n    --container-md: calc(940px + var(--grid-gutter-width));\n    --container-lg: calc(1140px + var(--grid-gutter-width));\n    --navbar-height: 122px;\n    --navbar-height-short: 56px;\n    --summary-height-stacked: 82px;\n    --statusbar-height-stacked: 54px;\n    --footer-height: 60px;\n    --default-transition-duration: 0.2s;\n    --default-transition-easing: ease;\n    --gray-base: #000;\n    --gray-darker-faded: color(var(--gray-darker) alpha(95%));\n    --gray-darker: color(var(--gray-base) tint(13.5%));\n    --gray-dark: color(var(--gray-base) tint(20%));\n    --gray: color(var(--gray-base) tint(33.5%));\n    --gray-light: color(var(--gray-base) tint(46.7%));\n    --gray-medium: color(var(--gray-base) tint(73.5%));\n    --gray-lighter: color(var(--gray-base) tint(93.5%));\n    --gray-lighter-faded: color(var(--gray-lighter) alpha(95%));\n    --gray-border: color(var(--gray-base) tint(80%));\n    --grey50: #eceff1;\n    --grey100: #f5f5f5;\n    --grey300: #e0e0e0;\n    --grey500: #9e9e9e;\n    --grey700: #616161;\n    --green100: #c8e6c9;\n    --green200: #a5d6a7;\n    --green300: #81c784;\n    --green500: #4caf50;\n    --green700: #388e3c;\n    --red100: #ffcdd2;\n    --red300: #e57373;\n    --red500: #f44336;\n    --red700: #d32f2f;\n    --ltblue100: #b3e5fc;\n    --ltblue300: #4fc3f7;\n    --ltblue500: #03a9f4;\n    --ltblue700: #0288d1;\n    --black87: rgba(0,0,0,0.87);\n    --black54: rgba(0,0,0,0.54);\n    --black38: rgba(0,0,0,0.38);\n    --bluegrey500: #607d8b;\n    --bluegrey800: #37474f;\n    --bluegrey900: #263238;\n    --light-icon-active: #fff;\n    --light-icon-inactive: hsla(0,0%,100%,0.5);\n    --dark-icon-active: var(--black54);\n    --dark-icon-inactive: var(--black38);\n    --amber300: #ffd54f;\n    --amber400: #ffca28;\n    --amber500: #ffc107;\n    --yellow700: #fbc02d;\n    --yellow800: #f9a825;\n    --brand-primary: color(#428bca shade(6.5%));\n    --brand-success: #4caf50;\n    --brand-info: #5bc0de;\n    --brand-warning: #f0ad4e;\n    --brand-danger: #d9534f;\n    --text-color: var(--black87);\n    --body-bg: #f2f2f2;\n    --link-color: var(--brand-primary);\n    --link-hover-color: color(var(--link-color) shade(15%));\n    --list-group-border: #ddd;\n    --font-family-sans-serif: \"robotoregular\",\"Helvetica Neue\",Helvetica,Arial,sans-serif;\n    --font-family-base: var(--font-family-sans-serif);\n    --font-family-mono: \"Menlo\",\"Monaco\",\"Consolas\",\"Courier New\",monospace;\n    --font-size-base: 14px;\n    --line-height-base: 1.429;\n    --line-height-computed: 20px;\n    --headings-font-family: inherit;\n    --headings-font-weight: 400;\n    --headings-line-height: 1.1;\n    --headings-color: inherit;\n    --headings-small-color: var(--gray-light);\n    --font-size-h1: 36px;\n    --font-size-h2: 30px;\n    --font-size-h3: 24px;\n    --font-size-h4: 18px;\n    --font-size-h5: var(--font-size-base);\n    --font-size-h6: 12px;\n    --font-family-light: \"robotolight\";\n    --font-family-regular: \"robotoregular\";\n    --font-family-medium: \"robotomedium\";\n    --link-transition: color 0.2s ease-out\n}\n\n.footer--trans-color---205XF {\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\n.footer--component---1WcTR {\n    position: absolute;\n    bottom: 0;\n    width: 100%;\n    height: 60px;\n    height: var(--footer-height);\n    color: rgba(0,0,0,.38);\n    color: var(--black38);\n    text-align: center\n}\n\n.footer--component---1WcTR p {\n    font-size: 12px;\n    margin: 10px 0\n}\n\n.footer--component---1WcTR a {\n    color: rgba(0,0,0,.54);\n    color: var(--black54);\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\n.footer--component---1WcTR a:hover {\n    color: rgba(0,0,0,.87);\n    color: var(--black87)\n}\n\n:root {\n    --screen-sm-min: 768px;\n    --screen-md-min: 992px;\n    --screen-lg-min: 1200px;\n    --grid-gutter-width: 30px;\n    --container-sm: calc(720px + var(--grid-gutter-width));\n    --container-md: calc(940px + var(--grid-gutter-width));\n    --container-lg: calc(1140px + var(--grid-gutter-width));\n    --navbar-height: 122px;\n    --navbar-height-short: 56px;\n    --summary-height-stacked: 82px;\n    --statusbar-height-stacked: 54px;\n    --footer-height: 60px;\n    --default-transition-duration: 0.2s;\n    --default-transition-easing: ease;\n    --gray-base: #000;\n    --gray-darker-faded: color(var(--gray-darker) alpha(95%));\n    --gray-darker: color(var(--gray-base) tint(13.5%));\n    --gray-dark: color(var(--gray-base) tint(20%));\n    --gray: color(var(--gray-base) tint(33.5%));\n    --gray-light: color(var(--gray-base) tint(46.7%));\n    --gray-medium: color(var(--gray-base) tint(73.5%));\n    --gray-lighter: color(var(--gray-base) tint(93.5%));\n    --gray-lighter-faded: color(var(--gray-lighter) alpha(95%));\n    --gray-border: color(var(--gray-base) tint(80%));\n    --grey50: #eceff1;\n    --grey100: #f5f5f5;\n    --grey300: #e0e0e0;\n    --grey500: #9e9e9e;\n    --grey700: #616161;\n    --green100: #c8e6c9;\n    --green200: #a5d6a7;\n    --green300: #81c784;\n    --green500: #4caf50;\n    --green700: #388e3c;\n    --red100: #ffcdd2;\n    --red300: #e57373;\n    --red500: #f44336;\n    --red700: #d32f2f;\n    --ltblue100: #b3e5fc;\n    --ltblue300: #4fc3f7;\n    --ltblue500: #03a9f4;\n    --ltblue700: #0288d1;\n    --black87: rgba(0,0,0,0.87);\n    --black54: rgba(0,0,0,0.54);\n    --black38: rgba(0,0,0,0.38);\n    --bluegrey500: #607d8b;\n    --bluegrey800: #37474f;\n    --bluegrey900: #263238;\n    --light-icon-active: #fff;\n    --light-icon-inactive: hsla(0,0%,100%,0.5);\n    --dark-icon-active: var(--black54);\n    --dark-icon-inactive: var(--black38);\n    --amber300: #ffd54f;\n    --amber400: #ffca28;\n    --amber500: #ffc107;\n    --yellow700: #fbc02d;\n    --yellow800: #f9a825;\n    --brand-primary: color(#428bca shade(6.5%));\n    --brand-success: #4caf50;\n    --brand-info: #5bc0de;\n    --brand-warning: #f0ad4e;\n    --brand-danger: #d9534f;\n    --text-color: var(--black87);\n    --body-bg: #f2f2f2;\n    --link-color: var(--brand-primary);\n    --link-hover-color: color(var(--link-color) shade(15%));\n    --list-group-border: #ddd;\n    --font-family-sans-serif: \"robotoregular\",\"Helvetica Neue\",Helvetica,Arial,sans-serif;\n    --font-family-base: var(--font-family-sans-serif);\n    --font-family-mono: \"Menlo\",\"Monaco\",\"Consolas\",\"Courier New\",monospace;\n    --font-size-base: 14px;\n    --line-height-base: 1.429;\n    --line-height-computed: 20px;\n    --headings-font-family: inherit;\n    --headings-font-weight: 400;\n    --headings-line-height: 1.1;\n    --headings-color: inherit;\n    --headings-small-color: var(--gray-light);\n    --font-size-h1: 36px;\n    --font-size-h2: 30px;\n    --font-size-h3: 24px;\n    --font-size-h4: 18px;\n    --font-size-h5: var(--font-size-base);\n    --font-size-h6: 12px;\n    --font-family-light: \"robotolight\";\n    --font-family-regular: \"robotoregular\";\n    --font-family-medium: \"robotomedium\";\n    --link-transition: color 0.2s ease-out\n}\n\n.loader--trans-color---97r08 {\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\n.loader--component---2grcA {\n    position: fixed;\n    top: 0;\n    height: 100%;\n    width: 100%;\n    background-color: color(#f2f2f2 alpha(60%));\n    background-color: color(var(--body-bg) alpha(60%));\n    padding-top: 122px;\n    padding-top: var(--navbar-height)\n}\n\n.loader--wrap---3Fhrc {\n    display: -webkit-flex;\n    display: flex;\n    -webkit-align-items: center;\n    align-items: center;\n    -webkit-justify-content: center;\n    justify-content: center;\n    -webkit-flex-direction: column;\n    flex-direction: column;\n    min-height: 200px\n}\n\n.loader--text---3Yu3g {\n    color: color(#000 tint(46.7%));\n    color: var(--gray-light);\n    text-align: center;\n    margin: 1rem 0 0\n}\n\n.loader--spinner---2q6MO {\n    border-radius: 50%;\n    width: 42px;\n    height: 42px;\n    border: .25rem solid color(#000 tint(73.5%));\n    border-top-color: color(#000 tint(33.5%));\n    border: .25rem solid var(--gray-medium);\n    border-top-color: var(--gray);\n    -webkit-animation: loader--spin---K6Loh 1s linear infinite;\n    animation: loader--spin---K6Loh 1s linear infinite\n}\n\n@-webkit-keyframes loader--spin---K6Loh {\n    0% {\n        -webkit-transform: rotate(0deg);\n        transform: rotate(0deg)\n    }\n\n    to {\n        -webkit-transform: rotate(1turn);\n        transform: rotate(1turn)\n    }\n}\n\n@keyframes loader--spin---K6Loh {\n    0% {\n        -webkit-transform: rotate(0deg);\n        transform: rotate(0deg)\n    }\n\n    to {\n        -webkit-transform: rotate(1turn);\n        transform: rotate(1turn)\n    }\n}\n\n@media (min-width: 768px) {\n    .loader--component---2grcA {\n        padding-top:56px;\n        padding-top: var(--navbar-height-short)\n    }\n}\n\n:root {\n    --screen-sm-min: 768px;\n    --screen-md-min: 992px;\n    --screen-lg-min: 1200px;\n    --grid-gutter-width: 30px;\n    --container-sm: calc(720px + var(--grid-gutter-width));\n    --container-md: calc(940px + var(--grid-gutter-width));\n    --container-lg: calc(1140px + var(--grid-gutter-width));\n    --navbar-height: 122px;\n    --navbar-height-short: 56px;\n    --summary-height-stacked: 82px;\n    --statusbar-height-stacked: 54px;\n    --footer-height: 60px;\n    --default-transition-duration: 0.2s;\n    --default-transition-easing: ease;\n    --gray-base: #000;\n    --gray-darker-faded: color(var(--gray-darker) alpha(95%));\n    --gray-darker: color(var(--gray-base) tint(13.5%));\n    --gray-dark: color(var(--gray-base) tint(20%));\n    --gray: color(var(--gray-base) tint(33.5%));\n    --gray-light: color(var(--gray-base) tint(46.7%));\n    --gray-medium: color(var(--gray-base) tint(73.5%));\n    --gray-lighter: color(var(--gray-base) tint(93.5%));\n    --gray-lighter-faded: color(var(--gray-lighter) alpha(95%));\n    --gray-border: color(var(--gray-base) tint(80%));\n    --grey50: #eceff1;\n    --grey100: #f5f5f5;\n    --grey300: #e0e0e0;\n    --grey500: #9e9e9e;\n    --grey700: #616161;\n    --green100: #c8e6c9;\n    --green200: #a5d6a7;\n    --green300: #81c784;\n    --green500: #4caf50;\n    --green700: #388e3c;\n    --red100: #ffcdd2;\n    --red300: #e57373;\n    --red500: #f44336;\n    --red700: #d32f2f;\n    --ltblue100: #b3e5fc;\n    --ltblue300: #4fc3f7;\n    --ltblue500: #03a9f4;\n    --ltblue700: #0288d1;\n    --black87: rgba(0,0,0,0.87);\n    --black54: rgba(0,0,0,0.54);\n    --black38: rgba(0,0,0,0.38);\n    --bluegrey500: #607d8b;\n    --bluegrey800: #37474f;\n    --bluegrey900: #263238;\n    --light-icon-active: #fff;\n    --light-icon-inactive: hsla(0,0%,100%,0.5);\n    --dark-icon-active: var(--black54);\n    --dark-icon-inactive: var(--black38);\n    --amber300: #ffd54f;\n    --amber400: #ffca28;\n    --amber500: #ffc107;\n    --yellow700: #fbc02d;\n    --yellow800: #f9a825;\n    --brand-primary: color(#428bca shade(6.5%));\n    --brand-success: #4caf50;\n    --brand-info: #5bc0de;\n    --brand-warning: #f0ad4e;\n    --brand-danger: #d9534f;\n    --text-color: var(--black87);\n    --body-bg: #f2f2f2;\n    --link-color: var(--brand-primary);\n    --link-hover-color: color(var(--link-color) shade(15%));\n    --list-group-border: #ddd;\n    --font-family-sans-serif: \"robotoregular\",\"Helvetica Neue\",Helvetica,Arial,sans-serif;\n    --font-family-base: var(--font-family-sans-serif);\n    --font-family-mono: \"Menlo\",\"Monaco\",\"Consolas\",\"Courier New\",monospace;\n    --font-size-base: 14px;\n    --line-height-base: 1.429;\n    --line-height-computed: 20px;\n    --headings-font-family: inherit;\n    --headings-font-weight: 400;\n    --headings-line-height: 1.1;\n    --headings-color: inherit;\n    --headings-small-color: var(--gray-light);\n    --font-size-h1: 36px;\n    --font-size-h2: 30px;\n    --font-size-h3: 24px;\n    --font-size-h4: 18px;\n    --font-size-h5: var(--font-size-base);\n    --font-size-h6: 12px;\n    --font-family-light: \"robotolight\";\n    --font-family-regular: \"robotoregular\";\n    --font-family-medium: \"robotomedium\";\n    --link-transition: color 0.2s ease-out\n}\n\n.nav-menu--trans-color---1l-R- {\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\n.nav-menu--wrap---39S_b {\n    position: fixed;\n    z-index: 2010;\n    top: 0;\n    right: 0;\n    bottom: 0;\n    left: 0;\n    overflow: hidden;\n    visibility: hidden\n}\n\n.nav-menu--overlay---k2Lwz {\n    display: none;\n    background: rgba(0,0,0,.5)\n}\n\n.nav-menu--close-btn---2m7W7 {\n    border: none;\n    background: transparent;\n    padding: 0\n}\n\n.nav-menu--close-btn---2m7W7:focus {\n    box-shadow: 0 0 2px 0 #03a9f4;\n    box-shadow: 0 0 2px 0 var(--ltblue500);\n    outline: none\n}\n\n.nav-menu--close-btn---2m7W7 {\n    cursor: pointer;\n    transition: color .2s ease-out;\n    transition: var(--link-transition);\n    position: absolute;\n    top: 16px;\n    right: 16px;\n    color: rgba(0,0,0,.54);\n    color: var(--black54)\n}\n\n.nav-menu--close-btn---2m7W7:active,.nav-menu--close-btn---2m7W7:hover {\n    color: rgba(0,0,0,.87);\n    color: var(--black87)\n}\n\n.nav-menu--menu---lFcsl {\n    position: absolute;\n    transition: all .15s cubic-bezier(.25,1,.8,1);\n    -webkit-transform: translate(-100%);\n    transform: translate(-100%);\n    width: 100%;\n    z-index: 1;\n    top: 0;\n    bottom: 0;\n    left: 0;\n    overflow: auto;\n    background: #202020;\n}\n\n.nav-menu--close-button---2_OHr {\n    border: none;\n    background: transparent;\n    padding: 0\n}\n\n.nav-menu--close-button---2_OHr:focus {\n    box-shadow: 0 0 2px 0 #03a9f4;\n    box-shadow: 0 0 2px 0 var(--ltblue500);\n    outline: none\n}\n\n.nav-menu--close-button---2_OHr {\n    cursor: pointer;\n    transition: color .2s ease-out;\n    transition: var(--link-transition);\n    position: absolute;\n    top: 14px;\n    right: 14px;\n    font-size: 21px;\n    width: 26px;\n    height: 26px;\n    color: color(#000 tint(33.5%));\n    color: var(--gray)\n}\n\n.nav-menu--close-button---2_OHr:hover {\n    color: color(#000 tint(20%));\n    color: var(--gray-dark)\n}\n\n.nav-menu--date---3SYOi,.nav-menu--section-head---3LXPD {\n    color: rgba(0,0,0,.54);\n    color: var(--black54)\n}\n\n.nav-menu--section-head---3LXPD {\n    text-transform: uppercase\n}\n\n.nav-menu--control---1JEYH {\n    display: -webkit-flex;\n    display: flex;\n    position: relative;\n    margin: 8px 0;\n    -webkit-align-items: center;\n    align-items: center\n}\n\n.nav-menu--control-label---3f2XU {\n    display: inline-block;\n    -webkit-flex-grow: 1;\n    flex-grow: 1;\n    font-family: var(--font-family--regular);\n    font-size: 13px;\n    vertical-align: top;\n    line-height: 24px\n}\n\n.nav-menu--control-label---3f2XU.nav-menu--with-icon---qF4hj {\n    margin-left: 12px\n}\n\n.nav-menu--control-group---32kKg {\n    margin-bottom: 10px\n}\n\n.nav-menu--toggle-icon-passed---132lH {\n    color: #4caf50;\n    color: var(--green500)\n}\n\n.nav-menu--toggle-icon-failed---x-XUB {\n    color: #f44336;\n    color: var(--red500)\n}\n\n.nav-menu--toggle-icon-pending---3ZJAs {\n    color: #03a9f4;\n    color: var(--ltblue500)\n}\n\n.nav-menu--toggle-icon-skipped---FyedH {\n    color: #9e9e9e;\n    color: var(--grey500)\n}\n\n.nav-menu--wrap---39S_b.nav-menu--open---3BW1O {\n    visibility: visible\n}\n\n.nav-menu--wrap---39S_b.nav-menu--open---3BW1O .nav-menu--overlay---k2Lwz {\n    opacity: 1\n}\n\n.nav-menu--wrap---39S_b.nav-menu--open---3BW1O .nav-menu--menu---lFcsl {\n    -webkit-transform: translate(0);\n    transform: translate(0)\n}\n\n.nav-menu--section---2z7Dj {\n    padding: 0 16px;\n    border-bottom: 1px solid #e0e0e0;\n    border-bottom: 1px solid var(--grey300)\n}\n\n.nav-menu--list---2QMG9 {\n    list-style: none;\n    padding-left: 0\n}\n\n.nav-menu--main---jkqJW {\n    margin: 8px 0\n}\n\n.nav-menu--no-tests---2sRAg>.nav-menu--item---gXWu6:not(.nav-menu--has-tests---1ND4g)>div>.nav-menu--sub---EnSIu {\n    padding-left: 0\n}\n\n.nav-menu--no-tests---2sRAg>.nav-menu--item---gXWu6:not(.nav-menu--has-tests---1ND4g):not(:only-child) {\n    padding-left: 22px\n}\n\n.nav-menu--sub---EnSIu {\n    padding-left: 24px;\n    margin: 0 0 2px\n}\n\n.nav-menu--link---tywPF {\n    display: -webkit-flex;\n    display: flex;\n    position: relative;\n    -webkit-align-items: center;\n    align-items: center;\n    padding: 3px 0;\n    color: color(#000 tint(33.5%));\n    color: var(--gray)\n}\n\n.nav-menu--link---tywPF:hover {\n    color: color(color(#428bca shade(6.5%)) shade(15%));\n    color: var(--link-hover-color);\n    text-decoration: none\n}\n\n.nav-menu--link---tywPF:active,.nav-menu--link---tywPF:focus {\n    box-shadow: 0 0 2px 0 #03a9f4;\n    box-shadow: 0 0 2px 0 var(--ltblue500);\n    outline: none;\n    text-decoration: none\n}\n\n.nav-menu--link---tywPF span {\n    transition: color .2s ease-out;\n    transition: var(--link-transition);\n    overflow: hidden;\n    text-overflow: ellipsis;\n    white-space: nowrap\n}\n\n.nav-menu--link-icon---1Q2NP {\n    margin-right: 2px\n}\n\n.nav-menu--link-icon---1Q2NP.nav-menu--pass---1PUeh {\n    color: #4caf50;\n    color: var(--green500)\n}\n\n.nav-menu--link-icon---1Q2NP.nav-menu--fail---3gQQa {\n    color: #f44336;\n    color: var(--red500)\n}\n\n.nav-menu--link-icon---1Q2NP.nav-menu--pending---9zAw0 {\n    color: #03a9f4;\n    color: var(--ltblue500)\n}\n\n.nav-menu--link-icon---1Q2NP.nav-menu--skipped---31GPM {\n    color: #9e9e9e;\n    color: var(--grey500)\n}\n\n.nav-menu--disabled---2MoA_ {\n    opacity: .3;\n    pointer-events: none\n}\n\n@media (min-width: 768px) {\n    .nav-menu--menu---lFcsl {\n        width:320px;\n        left: auto\n    }\n\n    .nav-menu--overlay---k2Lwz {\n        display: block;\n        position: fixed;\n        transition: all .2s ease-out;\n        top: 0;\n        right: 0;\n        bottom: 0;\n        left: 0;\n        cursor: pointer;\n        opacity: 0\n    }\n}\n\n/*! normalize.css v8.0.1 | MIT License | github.com/necolas/normalize.css */\nhtml {\n    line-height: 1.15;\n    -webkit-text-size-adjust: 100%\n}\n\nbody {\n    margin: 0\n}\n\nmain {\n    display: block\n}\n\nh1 {\n    font-size: 2em;\n    margin: .67em 0\n}\n\nhr {\n    box-sizing: content-box;\n    height: 0;\n    overflow: visible\n}\n\npre {\n    font-family: monospace,monospace;\n    font-size: 1em\n}\n\na {\n    background-color: transparent\n}\n\nabbr[title] {\n    border-bottom: none;\n    text-decoration: underline;\n    -webkit-text-decoration: underline dotted;\n    text-decoration: underline dotted\n}\n\nb,strong {\n    font-weight: bolder\n}\n\ncode,kbd,samp {\n    font-family: monospace,monospace;\n    font-size: 1em\n}\n\nsmall {\n    font-size: 80%\n}\n\nsub,sup {\n    font-size: 75%;\n    line-height: 0;\n    position: relative;\n    vertical-align: baseline\n}\n\nsub {\n    bottom: -.25em\n}\n\nsup {\n    top: -.5em\n}\n\nimg {\n    border-style: none\n}\n\nbutton,input,optgroup,select,textarea {\n    font-family: inherit;\n    font-size: 100%;\n    line-height: 1.15;\n    margin: 0\n}\n\nbutton,input {\n    overflow: visible\n}\n\nbutton,select {\n    text-transform: none\n}\n\n[type=button],[type=reset],[type=submit],button {\n    -webkit-appearance: button\n}\n\n[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button::-moz-focus-inner {\n    border-style: none;\n    padding: 0\n}\n\n[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring,button:-moz-focusring {\n    outline: 1px dotted ButtonText\n}\n\nfieldset {\n    padding: .35em .75em .625em\n}\n\nlegend {\n    box-sizing: border-box;\n    color: inherit;\n    display: table;\n    max-width: 100%;\n    padding: 0;\n    white-space: normal\n}\n\nprogress {\n    vertical-align: baseline\n}\n\ntextarea {\n    overflow: auto\n}\n\n[type=checkbox],[type=radio] {\n    box-sizing: border-box;\n    padding: 0\n}\n\n[type=number]::-webkit-inner-spin-button,[type=number]::-webkit-outer-spin-button {\n    height: auto\n}\n\n[type=search] {\n    -webkit-appearance: textfield;\n    outline-offset: -2px\n}\n\n[type=search]::-webkit-search-decoration {\n    -webkit-appearance: none\n}\n\n::-webkit-file-upload-button {\n    -webkit-appearance: button;\n    font: inherit\n}\n\ndetails {\n    display: block\n}\n\nsummary {\n    display: list-item\n}\n\n[hidden],template {\n    display: none\n}\n\n:root {\n    --screen-sm-min: 768px;\n    --screen-md-min: 992px;\n    --screen-lg-min: 1200px;\n    --grid-gutter-width: 30px;\n    --container-sm: calc(720px + var(--grid-gutter-width));\n    --container-md: calc(940px + var(--grid-gutter-width));\n    --container-lg: calc(1140px + var(--grid-gutter-width));\n    --navbar-height: 122px;\n    --navbar-height-short: 56px;\n    --summary-height-stacked: 82px;\n    --statusbar-height-stacked: 54px;\n    --footer-height: 60px;\n    --default-transition-duration: 0.2s;\n    --default-transition-easing: ease;\n    --gray-base: #000;\n    --gray-darker-faded: color(var(--gray-darker) alpha(95%));\n    --gray-darker: color(var(--gray-base) tint(13.5%));\n    --gray-dark: color(var(--gray-base) tint(20%));\n    --gray: color(var(--gray-base) tint(33.5%));\n    --gray-light: color(var(--gray-base) tint(46.7%));\n    --gray-medium: color(var(--gray-base) tint(73.5%));\n    --gray-lighter: color(var(--gray-base) tint(93.5%));\n    --gray-lighter-faded: color(var(--gray-lighter) alpha(95%));\n    --gray-border: color(var(--gray-base) tint(80%));\n    --grey50: #eceff1;\n    --grey100: #f5f5f5;\n    --grey300: #e0e0e0;\n    --grey500: #9e9e9e;\n    --grey700: #616161;\n    --green100: #c8e6c9;\n    --green200: #a5d6a7;\n    --green300: #81c784;\n    --green500: #4caf50;\n    --green700: #388e3c;\n    --red100: #ffcdd2;\n    --red300: #e57373;\n    --red500: #f44336;\n    --red700: #d32f2f;\n    --ltblue100: #b3e5fc;\n    --ltblue300: #4fc3f7;\n    --ltblue500: #03a9f4;\n    --ltblue700: #0288d1;\n    --black87: rgba(0,0,0,0.87);\n    --black54: rgba(0,0,0,0.54);\n    --black38: rgba(0,0,0,0.38);\n    --bluegrey500: #607d8b;\n    --bluegrey800: #37474f;\n    --bluegrey900: #263238;\n    --light-icon-active: #fff;\n    --light-icon-inactive: hsla(0,0%,100%,0.5);\n    --dark-icon-active: var(--black54);\n    --dark-icon-inactive: var(--black38);\n    --amber300: #ffd54f;\n    --amber400: #ffca28;\n    --amber500: #ffc107;\n    --yellow700: #fbc02d;\n    --yellow800: #f9a825;\n    --brand-primary: color(#428bca shade(6.5%));\n    --brand-success: #4caf50;\n    --brand-info: #5bc0de;\n    --brand-warning: #f0ad4e;\n    --brand-danger: #d9534f;\n    --text-color: var(--black87);\n    --body-bg: #f2f2f2;\n    --link-color: var(--brand-primary);\n    --link-hover-color: color(var(--link-color) shade(15%));\n    --list-group-border: #ddd;\n    --font-family-sans-serif: \"robotoregular\",\"Helvetica Neue\",Helvetica,Arial,sans-serif;\n    --font-family-base: var(--font-family-sans-serif);\n    --font-family-mono: \"Menlo\",\"Monaco\",\"Consolas\",\"Courier New\",monospace;\n    --font-size-base: 14px;\n    --line-height-base: 1.429;\n    --line-height-computed: 20px;\n    --headings-font-family: inherit;\n    --headings-font-weight: 400;\n    --headings-line-height: 1.1;\n    --headings-color: inherit;\n    --headings-small-color: var(--gray-light);\n    --font-size-h1: 36px;\n    --font-size-h2: 30px;\n    --font-size-h3: 24px;\n    --font-size-h4: 18px;\n    --font-size-h5: var(--font-size-base);\n    --font-size-h6: 12px;\n    --font-family-light: \"robotolight\";\n    --font-family-regular: \"robotoregular\";\n    --font-family-medium: \"robotomedium\";\n    --link-transition: color 0.2s ease-out\n}\n\n.trans-color {\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\n.h1,.h2,.h3,.h4,.h5,.h6,h1,h2,h3,h4,h5,h6 {\n    font-family: inherit;\n    font-family: var(--headings-font-family);\n    font-weight: 400;\n    font-weight: var(--headings-font-weight);\n    line-height: 1.1;\n    line-height: var(--headings-line-height);\n    color: inherit;\n    color: var(--headings-color)\n}\n\n.h1 .small,.h1 small,.h2 .small,.h2 small,.h3 .small,.h3 small,.h4 .small,.h4 small,.h5 .small,.h5 small,.h6 .small,.h6 small,h1 .small,h1 small,h2 .small,h2 small,h3 .small,h3 small,h4 .small,h4 small,h5 .small,h5 small,h6 .small,h6 small {\n    font-weight: 400;\n    line-height: 1;\n    color: color(#000 tint(46.7%));\n    color: var(--headings-small-color)\n}\n\n.h1,.h2,.h3,h1,h2,h3 {\n    margin-top: 20px;\n    margin-top: var(--line-height-computed);\n    margin-bottom: 10px;\n    margin-bottom: calc(var(--line-height-computed)/2)\n}\n\n.h1 .small,.h1 small,.h2 .small,.h2 small,.h3 .small,.h3 small,h1 .small,h1 small,h2 .small,h2 small,h3 .small,h3 small {\n    font-size: 65%\n}\n\n.h4,.h5,.h6,h4,h5,h6 {\n    margin-top: 10px;\n    margin-top: calc(var(--line-height-computed)/2);\n    margin-bottom: 10px;\n    margin-bottom: calc(var(--line-height-computed)/2)\n}\n\n.h4 .small,.h4 small,.h5 .small,.h5 small,.h6 .small,.h6 small,h4 .small,h4 small,h5 .small,h5 small,h6 .small,h6 small {\n    font-size: 75%\n}\n\n.h1,h1 {\n    font-size: 36px;\n    font-size: var(--font-size-h1)\n}\n\n.h2,h2 {\n    font-size: 30px;\n    font-size: var(--font-size-h2)\n}\n\n.h3,h3 {\n    font-size: 24px;\n    font-size: var(--font-size-h3)\n}\n\n.h4,h4 {\n    font-size: 18px;\n    font-size: var(--font-size-h4)\n}\n\n.h5,h5 {\n    font-size: 14px;\n    font-size: var(--font-size-h5)\n}\n\n.h6,h6 {\n    font-size: 12px;\n    font-size: var(--font-size-h6)\n}\n\np {\n    margin: 0 0 10px;\n    margin: 0 0 calc(var(--line-height-computed)/2)\n}\n\n.text-left {\n    text-align: left\n}\n\n.text-right {\n    text-align: right\n}\n\n.text-center {\n    text-align: center\n}\n\n.text-justify {\n    text-align: justify\n}\n\n.text-nowrap {\n    white-space: nowrap\n}\n\n.text-lowercase {\n    text-transform: lowercase\n}\n\n.text-uppercase {\n    text-transform: uppercase\n}\n\n.text-capitalize {\n    text-transform: capitalize\n}\n\nol,ul {\n    margin-top: 0;\n    margin-bottom: 10px;\n    margin-bottom: calc(var(--line-height-computed)/2);\n    ol,ul {\n        margin-bottom: 0\n    }\n}\n\n.list-inline,.list-unstyled {\n    padding-left: 0;\n    list-style: none\n}\n\n.list-inline {\n    margin-left: -5px\n}\n\n.list-inline>li {\n    display: inline-block;\n    padding-left: 5px;\n    padding-right: 5px\n}\n\ncode {\n    font-family: Menlo,Monaco,Consolas,Courier New,monospace;\n    font-family: var(--font-family-mono)\n}\n\n.hljs {\n    display: block;\n    overflow-x: auto;\n    padding: .5em;\n    color: #b8b8b8;\n    background: #fafafa\n}\n\n.hljs-comment,.hljs-quote {\n    color: #a0a1a7;\n    font-style: italic\n}\n\n.hljs-doctag,.hljs-formula,.hljs-keyword {\n    color: #a626a4\n}\n\n.hljs-deletion,.hljs-name,.hljs-section,.hljs-selector-tag,.hljs-subst {\n    color: #e45649\n}\n\n.hljs-literal {\n    color: #0184bb\n}\n\n.hljs-addition,.hljs-attribute,.hljs-meta-string,.hljs-regexp,.hljs-string {\n    color: #50a14f\n}\n\n.hljs-built_in,.hljs-class .hljs-title {\n    color: #c18401\n}\n\n.hljs-attr,.hljs-number,.hljs-selector-attr,.hljs-selector-class,.hljs-selector-pseudo,.hljs-template-variable,.hljs-type,.hljs-variable {\n    color: #986801\n}\n\n.hljs-bullet,.hljs-link,.hljs-meta,.hljs-selector-id,.hljs-symbol,.hljs-title {\n    color: #4078f2\n}\n\n.hljs-emphasis {\n    font-style: italic\n}\n\n.hljs-strong {\n    font-weight: 700\n}\n\n.hljs-link {\n    text-decoration: underline\n}\n\n.ct-label {\n    fill: rgba(0,0,0,.4);\n    color: rgba(0,0,0,.4);\n    font-size: .75rem;\n    line-height: 1\n}\n\n.ct-chart-bar .ct-label,.ct-chart-line .ct-label {\n    display: block;\n    display: -webkit-flex;\n    display: flex\n}\n\n.ct-chart-donut .ct-label,.ct-chart-pie .ct-label {\n    dominant-baseline: central\n}\n\n.ct-label.ct-horizontal.ct-start {\n    -webkit-align-items: flex-end;\n    align-items: flex-end\n}\n\n.ct-label.ct-horizontal.ct-end,.ct-label.ct-horizontal.ct-start {\n    -webkit-justify-content: flex-start;\n    justify-content: flex-start;\n    text-align: left;\n    text-anchor: start\n}\n\n.ct-label.ct-horizontal.ct-end {\n    -webkit-align-items: flex-start;\n    align-items: flex-start\n}\n\n.ct-label.ct-vertical.ct-start {\n    -webkit-align-items: flex-end;\n    align-items: flex-end;\n    -webkit-justify-content: flex-end;\n    justify-content: flex-end;\n    text-align: right;\n    text-anchor: end\n}\n\n.ct-label.ct-vertical.ct-end {\n    -webkit-align-items: flex-end;\n    align-items: flex-end;\n    -webkit-justify-content: flex-start;\n    justify-content: flex-start;\n    text-align: left;\n    text-anchor: start\n}\n\n.ct-chart-bar .ct-label.ct-horizontal.ct-start {\n    -webkit-align-items: flex-end;\n    align-items: flex-end;\n    -webkit-justify-content: center;\n    justify-content: center;\n    text-align: center;\n    text-anchor: start\n}\n\n.ct-chart-bar .ct-label.ct-horizontal.ct-end {\n    -webkit-align-items: flex-start;\n    align-items: flex-start;\n    -webkit-justify-content: center;\n    justify-content: center;\n    text-align: center;\n    text-anchor: start\n}\n\n.ct-chart-bar.ct-horizontal-bars .ct-label.ct-horizontal.ct-start {\n    -webkit-align-items: flex-end;\n    align-items: flex-end;\n    -webkit-justify-content: flex-start;\n    justify-content: flex-start;\n    text-align: left;\n    text-anchor: start\n}\n\n.ct-chart-bar.ct-horizontal-bars .ct-label.ct-horizontal.ct-end {\n    -webkit-align-items: flex-start;\n    align-items: flex-start;\n    -webkit-justify-content: flex-start;\n    justify-content: flex-start;\n    text-align: left;\n    text-anchor: start\n}\n\n.ct-chart-bar.ct-horizontal-bars .ct-label.ct-vertical.ct-start {\n    -webkit-align-items: center;\n    align-items: center;\n    -webkit-justify-content: flex-end;\n    justify-content: flex-end;\n    text-align: right;\n    text-anchor: end\n}\n\n.ct-chart-bar.ct-horizontal-bars .ct-label.ct-vertical.ct-end {\n    -webkit-align-items: center;\n    align-items: center;\n    -webkit-justify-content: flex-start;\n    justify-content: flex-start;\n    text-align: left;\n    text-anchor: end\n}\n\n.ct-grid {\n    stroke: rgba(0,0,0,.2);\n    stroke-width: 1px;\n    stroke-dasharray: 2px\n}\n\n.ct-grid-background {\n    fill: none\n}\n\n.ct-point {\n    stroke-width: 10px;\n    stroke-linecap: round\n}\n\n.ct-line {\n    fill: none;\n    stroke-width: 4px\n}\n\n.ct-area {\n    stroke: none;\n    fill-opacity: .1\n}\n\n.ct-bar {\n    fill: none;\n    stroke-width: 10px\n}\n\n.ct-slice-donut {\n    fill: none;\n    stroke-width: 60px\n}\n\n.ct-series-a .ct-bar,.ct-series-a .ct-line,.ct-series-a .ct-point,.ct-series-a .ct-slice-donut {\n    stroke: #d70206\n}\n\n.ct-series-a .ct-area,.ct-series-a .ct-slice-donut-solid,.ct-series-a .ct-slice-pie {\n    fill: #d70206\n}\n\n.ct-series-b .ct-bar,.ct-series-b .ct-line,.ct-series-b .ct-point,.ct-series-b .ct-slice-donut {\n    stroke: #f05b4f\n}\n\n.ct-series-b .ct-area,.ct-series-b .ct-slice-donut-solid,.ct-series-b .ct-slice-pie {\n    fill: #f05b4f\n}\n\n.ct-series-c .ct-bar,.ct-series-c .ct-line,.ct-series-c .ct-point,.ct-series-c .ct-slice-donut {\n    stroke: #f4c63d\n}\n\n.ct-series-c .ct-area,.ct-series-c .ct-slice-donut-solid,.ct-series-c .ct-slice-pie {\n    fill: #f4c63d\n}\n\n.ct-series-d .ct-bar,.ct-series-d .ct-line,.ct-series-d .ct-point,.ct-series-d .ct-slice-donut {\n    stroke: #d17905\n}\n\n.ct-series-d .ct-area,.ct-series-d .ct-slice-donut-solid,.ct-series-d .ct-slice-pie {\n    fill: #d17905\n}\n\n.ct-series-e .ct-bar,.ct-series-e .ct-line,.ct-series-e .ct-point,.ct-series-e .ct-slice-donut {\n    stroke: #453d3f\n}\n\n.ct-series-e .ct-area,.ct-series-e .ct-slice-donut-solid,.ct-series-e .ct-slice-pie {\n    fill: #453d3f\n}\n\n.ct-series-f .ct-bar,.ct-series-f .ct-line,.ct-series-f .ct-point,.ct-series-f .ct-slice-donut {\n    stroke: #59922b\n}\n\n.ct-series-f .ct-area,.ct-series-f .ct-slice-donut-solid,.ct-series-f .ct-slice-pie {\n    fill: #59922b\n}\n\n.ct-series-g .ct-bar,.ct-series-g .ct-line,.ct-series-g .ct-point,.ct-series-g .ct-slice-donut {\n    stroke: #0544d3\n}\n\n.ct-series-g .ct-area,.ct-series-g .ct-slice-donut-solid,.ct-series-g .ct-slice-pie {\n    fill: #0544d3\n}\n\n.ct-series-h .ct-bar,.ct-series-h .ct-line,.ct-series-h .ct-point,.ct-series-h .ct-slice-donut {\n    stroke: #6b0392\n}\n\n.ct-series-h .ct-area,.ct-series-h .ct-slice-donut-solid,.ct-series-h .ct-slice-pie {\n    fill: #6b0392\n}\n\n.ct-series-i .ct-bar,.ct-series-i .ct-line,.ct-series-i .ct-point,.ct-series-i .ct-slice-donut {\n    stroke: #f05b4f\n}\n\n.ct-series-i .ct-area,.ct-series-i .ct-slice-donut-solid,.ct-series-i .ct-slice-pie {\n    fill: #f05b4f\n}\n\n.ct-series-j .ct-bar,.ct-series-j .ct-line,.ct-series-j .ct-point,.ct-series-j .ct-slice-donut {\n    stroke: #dda458\n}\n\n.ct-series-j .ct-area,.ct-series-j .ct-slice-donut-solid,.ct-series-j .ct-slice-pie {\n    fill: #dda458\n}\n\n.ct-series-k .ct-bar,.ct-series-k .ct-line,.ct-series-k .ct-point,.ct-series-k .ct-slice-donut {\n    stroke: #eacf7d\n}\n\n.ct-series-k .ct-area,.ct-series-k .ct-slice-donut-solid,.ct-series-k .ct-slice-pie {\n    fill: #eacf7d\n}\n\n.ct-series-l .ct-bar,.ct-series-l .ct-line,.ct-series-l .ct-point,.ct-series-l .ct-slice-donut {\n    stroke: #86797d\n}\n\n.ct-series-l .ct-area,.ct-series-l .ct-slice-donut-solid,.ct-series-l .ct-slice-pie {\n    fill: #86797d\n}\n\n.ct-series-m .ct-bar,.ct-series-m .ct-line,.ct-series-m .ct-point,.ct-series-m .ct-slice-donut {\n    stroke: #b2c326\n}\n\n.ct-series-m .ct-area,.ct-series-m .ct-slice-donut-solid,.ct-series-m .ct-slice-pie {\n    fill: #b2c326\n}\n\n.ct-series-n .ct-bar,.ct-series-n .ct-line,.ct-series-n .ct-point,.ct-series-n .ct-slice-donut {\n    stroke: #6188e2\n}\n\n.ct-series-n .ct-area,.ct-series-n .ct-slice-donut-solid,.ct-series-n .ct-slice-pie {\n    fill: #6188e2\n}\n\n.ct-series-o .ct-bar,.ct-series-o .ct-line,.ct-series-o .ct-point,.ct-series-o .ct-slice-donut {\n    stroke: #a748ca\n}\n\n.ct-series-o .ct-area,.ct-series-o .ct-slice-donut-solid,.ct-series-o .ct-slice-pie {\n    fill: #a748ca\n}\n\n.ct-square {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-square:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 100%\n}\n\n.ct-square:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-square>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-minor-second {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-minor-second:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 93.75%\n}\n\n.ct-minor-second:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-minor-second>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-major-second {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-major-second:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 88.8888888889%\n}\n\n.ct-major-second:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-major-second>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-minor-third {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-minor-third:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 83.3333333333%\n}\n\n.ct-minor-third:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-minor-third>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-major-third {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-major-third:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 80%\n}\n\n.ct-major-third:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-major-third>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-perfect-fourth {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-perfect-fourth:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 75%\n}\n\n.ct-perfect-fourth:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-perfect-fourth>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-perfect-fifth {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-perfect-fifth:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 66.6666666667%\n}\n\n.ct-perfect-fifth:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-perfect-fifth>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-minor-sixth {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-minor-sixth:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 62.5%\n}\n\n.ct-minor-sixth:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-minor-sixth>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-golden-section {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-golden-section:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 61.804697157%\n}\n\n.ct-golden-section:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-golden-section>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-major-sixth {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-major-sixth:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 60%\n}\n\n.ct-major-sixth:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-major-sixth>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-minor-seventh {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-minor-seventh:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 56.25%\n}\n\n.ct-minor-seventh:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-minor-seventh>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-major-seventh {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-major-seventh:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 53.3333333333%\n}\n\n.ct-major-seventh:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-major-seventh>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-octave {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-octave:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 50%\n}\n\n.ct-octave:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-octave>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-major-tenth {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-major-tenth:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 40%\n}\n\n.ct-major-tenth:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-major-tenth>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-major-eleventh {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-major-eleventh:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 37.5%\n}\n\n.ct-major-eleventh:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-major-eleventh>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-major-twelfth {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-major-twelfth:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 33.3333333333%\n}\n\n.ct-major-twelfth:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-major-twelfth>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n.ct-double-octave {\n    display: block;\n    position: relative;\n    width: 100%\n}\n\n.ct-double-octave:before {\n    display: block;\n    float: left;\n    content: \"\";\n    width: 0;\n    height: 0;\n    padding-bottom: 25%\n}\n\n.ct-double-octave:after {\n    content: \"\";\n    display: table;\n    clear: both\n}\n\n.ct-double-octave>svg {\n    display: block;\n    position: absolute;\n    top: 0;\n    left: 0\n}\n\n@font-face {\n    font-family: robotolight;\n    src: url(roboto-light-webfont.woff2) format(\"woff2\"),url(roboto-light-webfont.woff) format(\"woff\");\n    font-weight: 400;\n    font-style: normal\n}\n\n@font-face {\n    font-family: robotomedium;\n    src: url(roboto-medium-webfont.woff2) format(\"woff2\"),url(roboto-medium-webfont.woff) format(\"woff\");\n    font-weight: 400;\n    font-style: normal\n}\n\n@font-face {\n    font-family: robotoregular;\n    src: url(roboto-regular-webfont.woff2) format(\"woff2\"),url(roboto-regular-webfont.woff) format(\"woff\");\n    font-weight: 400;\n    font-style: normal\n}\n\n@font-face {\n    font-family: Material Icons;\n    font-style: normal;\n    font-weight: 400;\n    src: url(MaterialIcons-Regular.woff2) format(\"woff2\"),url(MaterialIcons-Regular.woff) format(\"woff\")\n}\n\n.material-icons {\n    display: inline-block;\n    font-family: Material Icons;\n    font-weight: 400;\n    font-style: normal;\n    font-size: 24px;\n    line-height: 1;\n    text-transform: none;\n    letter-spacing: normal;\n    word-wrap: normal;\n    white-space: nowrap;\n    direction: ltr;\n    -webkit-font-smoothing: antialiased;\n    text-rendering: optimizeLegibility;\n    -moz-osx-font-smoothing: grayscale;\n    -webkit-font-feature-settings: \"liga\";\n    font-feature-settings: \"liga\"\n}\n\n.material-icons.md-18 {\n    font-size: 18px\n}\n\n.material-icons.md-24 {\n    font-size: 24px\n}\n\n.material-icons.md-36 {\n    font-size: 36px\n}\n\n.material-icons.md-48 {\n    font-size: 48px\n}\n\n.material-icons.md-dark {\n    color: rgba(0,0,0,.54)\n}\n\n.material-icons.md-dark.md-inactive {\n    color: rgba(0,0,0,.26)\n}\n\n.material-icons.md-light {\n    color: #fff\n}\n\n.material-icons.md-light.md-inactive {\n    color: hsla(0,0%,100%,.3)\n}\n\n*,:after,:before {\n    box-sizing: border-box\n}\n\nhtml {\n    position: relative;\n    min-height: 100%\n}\n\nbody {\n    font-family: robotoregular,Helvetica Neue,Helvetica,Arial,sans-serif;\n    font-family: var(--font-family-base);\n    font-size: 14px;\n    font-size: var(--font-size-base);\n    line-height: 1.429;\n    line-height: var(--line-height-base);\n    color: rgba(0,0,0,.87);\n    color: var(--text-color);\n    background-color: #f2f2f2;\n    background-color: var(--body-bg);\n    margin-bottom: 60px;\n    margin-bottom: var(--footer-height)\n}\n\na {\n    text-decoration: none;\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\na:hover {\n    text-decoration: underline\n}\n\npre {\n    word-break: break-all;\n    word-wrap: break-word;\n    border-radius: 4px\n}\n\n.cf:before,.clearfix:before {\n    content: \" \";\n    display: table\n}\n\n.cf:after,.clearfix:after {\n    content: \" \";\n    display: table;\n    clear: both\n}\n\n.container:after,.container:before {\n    content: \" \";\n    display: table\n}\n\n.container:after {\n    clear: both\n}\n\n.container {\n    margin-right: auto;\n    margin-left: auto;\n    padding-left: 15px;\n    padding-left: calc(var(--grid-gutter-width)/2);\n    padding-right: 15px;\n    padding-right: calc(var(--grid-gutter-width)/2)\n}\n\n.row:after,.row:before {\n    content: \" \";\n    display: table\n}\n\n.row:after {\n    clear: both\n}\n\n.row {\n    margin-left: -15px;\n    margin-left: calc(var(--grid-gutter-width)/-2);\n    margin-right: -15px;\n    margin-right: calc(var(--grid-gutter-width)/-2)\n}\n\n.details {\n    padding-top: 146px;\n    padding-top: calc(var(--navbar-height) + 24px)\n}\n\n.z-depth-0 {\n    box-shadow: none!important\n}\n\n.z-depth-1 {\n    box-shadow: 0 2px 5px 0 rgba(0,0,0,.16),0 2px 10px 0 rgba(0,0,0,.12)\n}\n\n.z-depth-1-half {\n    box-shadow: 0 5px 11px 0 rgba(0,0,0,.18),0 4px 15px 0 rgba(0,0,0,.15)\n}\n\n.z-depth-2 {\n    box-shadow: 0 8px 17px 0 rgba(0,0,0,.2),0 6px 20px 0 rgba(0,0,0,.19)\n}\n\n.z-depth-3 {\n    box-shadow: 0 12px 15px 0 rgba(0,0,0,.24),0 17px 50px 0 rgba(0,0,0,.19)\n}\n\n.z-depth-4 {\n    box-shadow: 0 16px 28px 0 rgba(0,0,0,.22),0 25px 55px 0 rgba(0,0,0,.21)\n}\n\n.z-depth-5 {\n    box-shadow: 0 27px 24px 0 rgba(0,0,0,.2),0 40px 77px 0 rgba(0,0,0,.22)\n}\n\n@media (min-width: 768px) {\n    .container {\n        width:750px;\n        width: var(--container-sm)\n    }\n\n    .details {\n        padding-top: 80px;\n        padding-top: calc(var(--navbar-height-short) + 24px)\n    }\n}\n\n@media (min-width: 992px) {\n    .container {\n        width:970px;\n        width: var(--container-md)\n    }\n}\n\n@media (min-width: 1200px) {\n    .container {\n        width:1170px;\n        width: var(--container-lg)\n    }\n}\n\n:root {\n    --screen-sm-min: 768px;\n    --screen-md-min: 992px;\n    --screen-lg-min: 1200px;\n    --grid-gutter-width: 30px;\n    --container-sm: calc(720px + var(--grid-gutter-width));\n    --container-md: calc(940px + var(--grid-gutter-width));\n    --container-lg: calc(1140px + var(--grid-gutter-width));\n    --navbar-height: 122px;\n    --navbar-height-short: 56px;\n    --summary-height-stacked: 82px;\n    --statusbar-height-stacked: 54px;\n    --footer-height: 60px;\n    --default-transition-duration: 0.2s;\n    --default-transition-easing: ease;\n    --gray-base: #000;\n    --gray-darker-faded: color(var(--gray-darker) alpha(95%));\n    --gray-darker: color(var(--gray-base) tint(13.5%));\n    --gray-dark: color(var(--gray-base) tint(20%));\n    --gray: color(var(--gray-base) tint(33.5%));\n    --gray-light: color(var(--gray-base) tint(46.7%));\n    --gray-medium: color(var(--gray-base) tint(73.5%));\n    --gray-lighter: color(var(--gray-base) tint(93.5%));\n    --gray-lighter-faded: color(var(--gray-lighter) alpha(95%));\n    --gray-border: color(var(--gray-base) tint(80%));\n    --grey50: #eceff1;\n    --grey100: #f5f5f5;\n    --grey300: #e0e0e0;\n    --grey500: #9e9e9e;\n    --grey700: #616161;\n    --green100: #c8e6c9;\n    --green200: #a5d6a7;\n    --green300: #81c784;\n    --green500: #4caf50;\n    --green700: #388e3c;\n    --red100: #ffcdd2;\n    --red300: #e57373;\n    --red500: #f44336;\n    --red700: #d32f2f;\n    --ltblue100: #b3e5fc;\n    --ltblue300: #4fc3f7;\n    --ltblue500: #03a9f4;\n    --ltblue700: #0288d1;\n    --black87: rgba(0,0,0,0.87);\n    --black54: rgba(0,0,0,0.54);\n    --black38: rgba(0,0,0,0.38);\n    --bluegrey500: #607d8b;\n    --bluegrey800: #37474f;\n    --bluegrey900: #263238;\n    --light-icon-active: #fff;\n    --light-icon-inactive: hsla(0,0%,100%,0.5);\n    --dark-icon-active: var(--black54);\n    --dark-icon-inactive: var(--black38);\n    --amber300: #ffd54f;\n    --amber400: #ffca28;\n    --amber500: #ffc107;\n    --yellow700: #fbc02d;\n    --yellow800: #f9a825;\n    --brand-primary: color(#428bca shade(6.5%));\n    --brand-success: #4caf50;\n    --brand-info: #5bc0de;\n    --brand-warning: #f0ad4e;\n    --brand-danger: #d9534f;\n    --text-color: var(--black87);\n    --body-bg: #f2f2f2;\n    --link-color: var(--brand-primary);\n    --link-hover-color: color(var(--link-color) shade(15%));\n    --list-group-border: #ddd;\n    --font-family-sans-serif: \"robotoregular\",\"Helvetica Neue\",Helvetica,Arial,sans-serif;\n    --font-family-base: var(--font-family-sans-serif);\n    --font-family-mono: \"Menlo\",\"Monaco\",\"Consolas\",\"Courier New\",monospace;\n    --font-size-base: 14px;\n    --line-height-base: 1.429;\n    --line-height-computed: 20px;\n    --headings-font-family: inherit;\n    --headings-font-weight: 400;\n    --headings-line-height: 1.1;\n    --headings-color: inherit;\n    --headings-small-color: var(--gray-light);\n    --font-size-h1: 36px;\n    --font-size-h2: 30px;\n    --font-size-h3: 24px;\n    --font-size-h4: 18px;\n    --font-size-h5: var(--font-size-base);\n    --font-size-h6: 12px;\n    --font-family-light: \"robotolight\";\n    --font-family-regular: \"robotoregular\";\n    --font-family-medium: \"robotomedium\";\n    --link-transition: color 0.2s ease-out\n}\n\n.navbar--trans-color---1tk7E {\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\n.navbar--component---2UCEi:after,.navbar--component---2UCEi:before {\n    content: \" \";\n    display: table\n}\n\n.navbar--component---2UCEi:after {\n    clear: both\n}\n\n.navbar--component---2UCEi {\n    position: fixed;\n    -webkit-flex-direction: column;\n    flex-direction: column;\n    top: 0;\n    right: 0;\n    left: 0;\n    z-index: 1030;\n    min-height: 122px;\n    min-height: var(--navbar-height);\n    height: 122px;\n    height: var(--navbar-height);\n    margin-bottom: 0;\n    border: none;\n    background: #37474f;\n    background: var(--bluegrey800)\n}\n\n.navbar--component---2UCEi,.navbar--report-info-cnt---8y9Bb {\n    display: -webkit-flex;\n    display: flex\n}\n\n.navbar--report-info-cnt---8y9Bb {\n    overflow: hidden;\n    padding-right: 12px\n}\n\n.navbar--menu-button---1ZRpz {\n    border: none;\n    background: transparent;\n    padding: 0\n}\n\n.navbar--menu-button---1ZRpz:focus {\n    box-shadow: 0 0 2px 0 #03a9f4;\n    box-shadow: 0 0 2px 0 var(--ltblue500);\n    outline: none\n}\n\n.navbar--menu-button---1ZRpz {\n    cursor: pointer;\n    transition: color .2s ease-out;\n    transition: var(--link-transition);\n    height: 40px;\n    margin: 8px 8px 0;\n    padding: 8px;\n    color: hsla(0,0%,100%,.5);\n    color: var(--light-icon-inactive)\n}\n\n.navbar--menu-button---1ZRpz:hover {\n    color: #fff;\n    color: var(--light-icon-active)\n}\n\n.navbar--report-title---3bXCv {\n    -webkit-flex-grow: 1;\n    flex-grow: 1;\n    font-family: var(--font-family--light);\n    color: #fff;\n    font-size: 18px;\n    line-height: 52px;\n    line-height: calc(var(--navbar-height-short) - 4px);\n    margin: 0;\n    overflow: hidden;\n    text-overflow: ellipsis;\n    white-space: nowrap\n}\n\n.navbar--pct-bar---3EwW-:after,.navbar--pct-bar---3EwW-:before {\n    content: \" \";\n    display: table\n}\n\n.navbar--pct-bar---3EwW-:after {\n    clear: both\n}\n\n.navbar--pct-bar---3EwW- {\n    display: -webkit-flex;\n    display: flex;\n    position: absolute;\n    left: 0;\n    right: 0;\n    bottom: 0;\n    height: 4px\n}\n\n.navbar--pct-bar---3EwW- .navbar--pass---2oR-w {\n    background-color: #4caf50;\n    background-color: var(--green500)\n}\n\n.navbar--pct-bar---3EwW- .navbar--fail---3mN80 {\n    background-color: #f44336;\n    background-color: #f4433669;\n}\n\n.navbar--pct-bar---3EwW- .navbar--pend---2iqjh {\n    background-color: #03a9f4;\n    background-color: var(--ltblue500)\n}\n\n.navbar--pct-bar-segment---3T0_o {\n    height: 4px\n}\n\n@media (min-width: 768px) {\n    .navbar--component---2UCEi {\n        min-height:56px;\n        min-height: var(--navbar-height-short);\n        height: 56px;\n        height: var(--navbar-height-short);\n        -webkit-flex-direction: initial;\n        flex-direction: row\n    }\n\n    .navbar--report-info-cnt---8y9Bb {\n        -webkit-flex-grow: 1;\n        flex-grow: 1\n    }\n}\n\n:root {\n    --screen-sm-min: 768px;\n    --screen-md-min: 992px;\n    --screen-lg-min: 1200px;\n    --grid-gutter-width: 30px;\n    --container-sm: calc(720px + var(--grid-gutter-width));\n    --container-md: calc(940px + var(--grid-gutter-width));\n    --container-lg: calc(1140px + var(--grid-gutter-width));\n    --navbar-height: 122px;\n    --navbar-height-short: 56px;\n    --summary-height-stacked: 82px;\n    --statusbar-height-stacked: 54px;\n    --footer-height: 60px;\n    --default-transition-duration: 0.2s;\n    --default-transition-easing: ease;\n    --gray-base: #000;\n    --gray-darker-faded: color(var(--gray-darker) alpha(95%));\n    --gray-darker: color(var(--gray-base) tint(13.5%));\n    --gray-dark: color(var(--gray-base) tint(20%));\n    --gray: color(var(--gray-base) tint(33.5%));\n    --gray-light: color(var(--gray-base) tint(46.7%));\n    --gray-medium: color(var(--gray-base) tint(73.5%));\n    --gray-lighter: color(var(--gray-base) tint(93.5%));\n    --gray-lighter-faded: color(var(--gray-lighter) alpha(95%));\n    --gray-border: color(var(--gray-base) tint(80%));\n    --grey50: #eceff1;\n    --grey100: #f5f5f5;\n    --grey300: #e0e0e0;\n    --grey500: #9e9e9e;\n    --grey700: #616161;\n    --green100: #c8e6c9;\n    --green200: #a5d6a7;\n    --green300: #81c784;\n    --green500: #4caf50;\n    --green700: #388e3c;\n    --red100: #ffcdd2;\n    --red300: #e57373;\n    --red500: #f44336;\n    --red700: #d32f2f;\n    --ltblue100: #b3e5fc;\n    --ltblue300: #4fc3f7;\n    --ltblue500: #03a9f4;\n    --ltblue700: #0288d1;\n    --black87: rgba(0,0,0,0.87);\n    --black54: rgba(0,0,0,0.54);\n    --black38: rgba(0,0,0,0.38);\n    --bluegrey500: #607d8b;\n    --bluegrey800: #37474f;\n    --bluegrey900: #263238;\n    --light-icon-active: #fff;\n    --light-icon-inactive: hsla(0,0%,100%,0.5);\n    --dark-icon-active: var(--black54);\n    --dark-icon-inactive: var(--black38);\n    --amber300: #ffd54f;\n    --amber400: #ffca28;\n    --amber500: #ffc107;\n    --yellow700: #fbc02d;\n    --yellow800: #f9a825;\n    --brand-primary: color(#428bca shade(6.5%));\n    --brand-success: #4caf50;\n    --brand-info: #5bc0de;\n    --brand-warning: #f0ad4e;\n    --brand-danger: #d9534f;\n    --text-color: var(--black87);\n    --body-bg: #f2f2f2;\n    --link-color: var(--brand-primary);\n    --link-hover-color: color(var(--link-color) shade(15%));\n    --list-group-border: #ddd;\n    --font-family-sans-serif: \"robotoregular\",\"Helvetica Neue\",Helvetica,Arial,sans-serif;\n    --font-family-base: var(--font-family-sans-serif);\n    --font-family-mono: \"Menlo\",\"Monaco\",\"Consolas\",\"Courier New\",monospace;\n    --font-size-base: 14px;\n    --line-height-base: 1.429;\n    --line-height-computed: 20px;\n    --headings-font-family: inherit;\n    --headings-font-weight: 400;\n    --headings-line-height: 1.1;\n    --headings-color: inherit;\n    --headings-small-color: var(--gray-light);\n    --font-size-h1: 36px;\n    --font-size-h2: 30px;\n    --font-size-h3: 24px;\n    --font-size-h4: 18px;\n    --font-size-h5: var(--font-size-base);\n    --font-size-h6: 12px;\n    --font-family-light: \"robotolight\";\n    --font-family-regular: \"robotoregular\";\n    --font-family-medium: \"robotomedium\";\n    --link-transition: color 0.2s ease-out\n}\n\n.quick-summary--trans-color---HUJqE {\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\n.quick-summary--cnt---3s38x {\n    display: -webkit-flex;\n    display: flex;\n    -webkit-flex-direction: column;\n    flex-direction: column;\n    padding: 0 12px\n}\n\n.quick-summary--list---2_80W:after,.quick-summary--list---2_80W:before {\n    content: \" \";\n    display: table\n}\n\n.quick-summary--list---2_80W:after {\n    clear: both\n}\n\n.quick-summary--list---2_80W {\n    list-style: none;\n    padding-left: 0;\n    transition: opacity .2s ease-out;\n    margin: 0 0 8px\n}\n\n.quick-summary--item---bfSQ0,.quick-summary--list---2_80W {\n    display: -webkit-flex;\n    display: flex\n}\n\n.quick-summary--item---bfSQ0 {\n    font-family: var(--font-family--light);\n    -webkit-align-items: flex-start;\n    align-items: flex-start;\n    color: #fff;\n    font-size: 16px;\n    -webkit-flex-basis: 25%;\n    flex-basis: 25%\n}\n\n.quick-summary--item---bfSQ0 button {\n    border: none;\n    background: transparent;\n    padding: 0\n}\n\n.quick-summary--item---bfSQ0 button:focus {\n    box-shadow: 0 0 2px 0 #03a9f4;\n    box-shadow: 0 0 2px 0 var(--ltblue500);\n    outline: none\n}\n\n.quick-summary--item---bfSQ0 button {\n    transition: color .2s ease-out;\n    transition: var(--link-transition);\n    display: -webkit-flex;\n    display: flex;\n    -webkit-align-items: center;\n    align-items: center;\n    color: #fff;\n    cursor: pointer\n}\n\n.quick-summary--item---bfSQ0 button:hover .quick-summary--icon---TW1oG {\n    border-color: #fff\n}\n\n.quick-summary--item---bfSQ0.quick-summary--tests---2nNut {\n    color: #fff\n}\n\n.quick-summary--item---bfSQ0.quick-summary--passes---3IjYH .quick-summary--icon---TW1oG {\n    color: #388e3c;\n    color: var(--green700);\n    background-color: #c8e6c9;\n    background-color: var(--green100)\n}\n\n.quick-summary--single-filter---31Thy .quick-summary--item---bfSQ0.quick-summary--passes---3IjYH .quick-summary--icon---TW1oG {\n    background-color: #e0e0e0;\n    background-color: var(--grey300);\n    color: #9e9e9e;\n    color: var(--grey500)\n}\n\n.quick-summary--single-filter--passed---3QnUL .quick-summary--item---bfSQ0.quick-summary--passes---3IjYH .quick-summary--icon---TW1oG {\n    color: #fff;\n    background-color: #388e3c;\n    background-color: var(--green700)\n}\n\n.quick-summary--item---bfSQ0.quick-summary--failures---14s29 .quick-summary--icon---TW1oG {\n    color: #d32f2f;\n    color: var(--red700);\n    background-color: #ffcdd2;\n    background-color: var(--red100)\n}\n\n.quick-summary--single-filter---31Thy .quick-summary--item---bfSQ0.quick-summary--failures---14s29 .quick-summary--icon---TW1oG {\n    background-color: #e0e0e0;\n    background-color: var(--grey300);\n    color: #9e9e9e;\n    color: var(--grey500)\n}\n\n.quick-summary--single-filter--failed---3_tAw .quick-summary--item---bfSQ0.quick-summary--failures---14s29 .quick-summary--icon---TW1oG {\n    color: #fff;\n    background-color: #d32f2f;\n    background-color: var(--red700)\n}\n\n.quick-summary--item---bfSQ0.quick-summary--pending---261aV .quick-summary--icon---TW1oG {\n    color: #0288d1;\n    color: var(--ltblue700);\n    background-color: #b3e5fc;\n    background-color: var(--ltblue100)\n}\n\n.quick-summary--single-filter---31Thy .quick-summary--item---bfSQ0.quick-summary--pending---261aV .quick-summary--icon---TW1oG {\n    background-color: #e0e0e0;\n    background-color: var(--grey300);\n    color: #9e9e9e;\n    color: var(--grey500)\n}\n\n.quick-summary--single-filter--pending---21lZM .quick-summary--item---bfSQ0.quick-summary--pending---261aV .quick-summary--icon---TW1oG {\n    color: #fff;\n    background-color: #0288d1;\n    background-color: var(--ltblue700)\n}\n\n.quick-summary--item---bfSQ0.quick-summary--skipped---tyOc4 .quick-summary--icon---TW1oG {\n    color: #616161;\n    color: var(--grey700);\n    background-color: #f5f5f5;\n    background-color: var(--grey100)\n}\n\n.quick-summary--single-filter---31Thy .quick-summary--item---bfSQ0.quick-summary--skipped---tyOc4 .quick-summary--icon---TW1oG {\n    background-color: #e0e0e0;\n    background-color: var(--grey300);\n    color: #9e9e9e;\n    color: var(--grey500)\n}\n\n.quick-summary--single-filter--skipped---1AdZA .quick-summary--item---bfSQ0.quick-summary--skipped---tyOc4 .quick-summary--icon---TW1oG {\n    color: #fff;\n    background-color: #616161;\n    background-color: var(--grey700)\n}\n\n.quick-summary--icon---TW1oG {\n    position: relative;\n    top: 2px;\n    font-size: 18px;\n    margin-right: 4px\n}\n\n.quick-summary--circle-icon---1HDS7 {\n    font-size: 12px;\n    border-radius: 50%;\n    padding: 2px;\n    border: 1px solid transparent;\n    transition: border-color .2s ease-out\n}\n\n@media (min-width: 768px) {\n    .quick-summary--cnt---3s38x {\n        -webkit-flex-direction:initial;\n        flex-direction: row;\n        padding: 14px 12px 0 0\n    }\n\n    .quick-summary--list---2_80W {\n        margin: 0\n    }\n\n    .quick-summary--item---bfSQ0 {\n        font-size: 18px;\n        -webkit-flex-basis: initial;\n        flex-basis: auto;\n        margin: 0 12px\n    }\n\n    .quick-summary--icon---TW1oG {\n        font-size: 24px;\n        width: 24px;\n        top: 0\n    }\n\n    .quick-summary--circle-icon---1HDS7 {\n        font-size: 18px\n    }\n}\n\n:root {\n    --screen-sm-min: 768px;\n    --screen-md-min: 992px;\n    --screen-lg-min: 1200px;\n    --grid-gutter-width: 30px;\n    --container-sm: calc(720px + var(--grid-gutter-width));\n    --container-md: calc(940px + var(--grid-gutter-width));\n    --container-lg: calc(1140px + var(--grid-gutter-width));\n    --navbar-height: 122px;\n    --navbar-height-short: 56px;\n    --summary-height-stacked: 82px;\n    --statusbar-height-stacked: 54px;\n    --footer-height: 60px;\n    --default-transition-duration: 0.2s;\n    --default-transition-easing: ease;\n    --gray-base: #000;\n    --gray-darker-faded: color(var(--gray-darker) alpha(95%));\n    --gray-darker: color(var(--gray-base) tint(13.5%));\n    --gray-dark: color(var(--gray-base) tint(20%));\n    --gray: color(var(--gray-base) tint(33.5%));\n    --gray-light: color(var(--gray-base) tint(46.7%));\n    --gray-medium: color(var(--gray-base) tint(73.5%));\n    --gray-lighter: color(var(--gray-base) tint(93.5%));\n    --gray-lighter-faded: color(var(--gray-lighter) alpha(95%));\n    --gray-border: color(var(--gray-base) tint(80%));\n    --grey50: #eceff1;\n    --grey100: #f5f5f5;\n    --grey300: #e0e0e0;\n    --grey500: #9e9e9e;\n    --grey700: #616161;\n    --green100: #c8e6c9;\n    --green200: #a5d6a7;\n    --green300: #81c784;\n    --green500: #4caf50;\n    --green700: #388e3c;\n    --red100: #ffcdd2;\n    --red300: #e57373;\n    --red500: #f44336;\n    --red700: #d32f2f;\n    --ltblue100: #b3e5fc;\n    --ltblue300: #4fc3f7;\n    --ltblue500: #03a9f4;\n    --ltblue700: #0288d1;\n    --black87: rgba(0,0,0,0.87);\n    --black54: rgba(0,0,0,0.54);\n    --black38: rgba(0,0,0,0.38);\n    --bluegrey500: #607d8b;\n    --bluegrey800: #37474f;\n    --bluegrey900: #263238;\n    --light-icon-active: #fff;\n    --light-icon-inactive: hsla(0,0%,100%,0.5);\n    --dark-icon-active: var(--black54);\n    --dark-icon-inactive: var(--black38);\n    --amber300: #ffd54f;\n    --amber400: #ffca28;\n    --amber500: #ffc107;\n    --yellow700: #fbc02d;\n    --yellow800: #f9a825;\n    --brand-primary: color(#428bca shade(6.5%));\n    --brand-success: #4caf50;\n    --brand-info: #5bc0de;\n    --brand-warning: #f0ad4e;\n    --brand-danger: #d9534f;\n    --text-color: var(--black87);\n    --body-bg: #f2f2f2;\n    --link-color: var(--brand-primary);\n    --link-hover-color: color(var(--link-color) shade(15%));\n    --list-group-border: #ddd;\n    --font-family-sans-serif: \"robotoregular\",\"Helvetica Neue\",Helvetica,Arial,sans-serif;\n    --font-family-base: var(--font-family-sans-serif);\n    --font-family-mono: \"Menlo\",\"Monaco\",\"Consolas\",\"Courier New\",monospace;\n    --font-size-base: 14px;\n    --line-height-base: 1.429;\n    --line-height-computed: 20px;\n    --headings-font-family: inherit;\n    --headings-font-weight: 400;\n    --headings-line-height: 1.1;\n    --headings-color: inherit;\n    --headings-small-color: var(--gray-light);\n    --font-size-h1: 36px;\n    --font-size-h2: 30px;\n    --font-size-h3: 24px;\n    --font-size-h4: 18px;\n    --font-size-h5: var(--font-size-base);\n    --font-size-h6: 12px;\n    --font-family-light: \"robotolight\";\n    --font-family-regular: \"robotoregular\";\n    --font-family-medium: \"robotomedium\";\n    --link-transition: color 0.2s ease-out\n}\n\n.radio-button--trans-color---egsik {\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\n.radio-button--component---1ix3c:after,.radio-button--component---1ix3c:before {\n    content: \" \";\n    display: table\n}\n\n.radio-button--component---1ix3c:after {\n    clear: both\n}\n\n.radio-button--component---1ix3c {\n    position: relative;\n    height: 24px\n}\n\n.radio-button--outer---a_NqL {\n    position: absolute;\n    top: 50%;\n    right: 0;\n    margin-top: -9px;\n    width: 18px;\n    height: 18px;\n    border: 2px solid #4caf50;\n    border: 2px solid var(--green500);\n    border-radius: 12px;\n    cursor: pointer;\n    transition: border-color .2s ease-out\n}\n\n.radio-button--off---dBAOK {\n    border-color: color(#000 tint(73.5%));\n    border-color: var(--gray-medium)\n}\n\n.radio-button--inner---3bo9Q {\n    display: block;\n    position: absolute;\n    top: 2px;\n    right: 2px;\n    width: 10px;\n    height: 10px;\n    border-radius: 100%;\n    background-color: #4caf50;\n    background-color: var(--green500)\n}\n\n.radio-button--off---dBAOK .radio-button--inner---3bo9Q {\n    background-color: #fff;\n    -webkit-transform: scale(0);\n    transform: scale(0)\n}\n\n.radio-button--inner---3bo9Q {\n    transition: all .15s cubic-bezier(.23,1,.32,1)\n}\n\n:root {\n    --screen-sm-min: 768px;\n    --screen-md-min: 992px;\n    --screen-lg-min: 1200px;\n    --grid-gutter-width: 30px;\n    --container-sm: calc(720px + var(--grid-gutter-width));\n    --container-md: calc(940px + var(--grid-gutter-width));\n    --container-lg: calc(1140px + var(--grid-gutter-width));\n    --navbar-height: 122px;\n    --navbar-height-short: 56px;\n    --summary-height-stacked: 82px;\n    --statusbar-height-stacked: 54px;\n    --footer-height: 60px;\n    --default-transition-duration: 0.2s;\n    --default-transition-easing: ease;\n    --gray-base: #000;\n    --gray-darker-faded: color(var(--gray-darker) alpha(95%));\n    --gray-darker: color(var(--gray-base) tint(13.5%));\n    --gray-dark: color(var(--gray-base) tint(20%));\n    --gray: color(var(--gray-base) tint(33.5%));\n    --gray-light: color(var(--gray-base) tint(46.7%));\n    --gray-medium: color(var(--gray-base) tint(73.5%));\n    --gray-lighter: color(var(--gray-base) tint(93.5%));\n    --gray-lighter-faded: color(var(--gray-lighter) alpha(95%));\n    --gray-border: color(var(--gray-base) tint(80%));\n    --grey50: #eceff1;\n    --grey100: #f5f5f5;\n    --grey300: #e0e0e0;\n    --grey500: #9e9e9e;\n    --grey700: #616161;\n    --green100: #c8e6c9;\n    --green200: #a5d6a7;\n    --green300: #81c784;\n    --green500: #4caf50;\n    --green700: #388e3c;\n    --red100: #ffcdd2;\n    --red300: #e57373;\n    --red500: #f44336;\n    --red700: #d32f2f;\n    --ltblue100: #b3e5fc;\n    --ltblue300: #4fc3f7;\n    --ltblue500: #03a9f4;\n    --ltblue700: #0288d1;\n    --black87: rgba(0,0,0,0.87);\n    --black54: rgba(0,0,0,0.54);\n    --black38: rgba(0,0,0,0.38);\n    --bluegrey500: #607d8b;\n    --bluegrey800: #37474f;\n    --bluegrey900: #263238;\n    --light-icon-active: #fff;\n    --light-icon-inactive: hsla(0,0%,100%,0.5);\n    --dark-icon-active: var(--black54);\n    --dark-icon-inactive: var(--black38);\n    --amber300: #ffd54f;\n    --amber400: #ffca28;\n    --amber500: #ffc107;\n    --yellow700: #fbc02d;\n    --yellow800: #f9a825;\n    --brand-primary: color(#428bca shade(6.5%));\n    --brand-success: #4caf50;\n    --brand-info: #5bc0de;\n    --brand-warning: #f0ad4e;\n    --brand-danger: #d9534f;\n    --text-color: var(--black87);\n    --body-bg: #f2f2f2;\n    --link-color: var(--brand-primary);\n    --link-hover-color: color(var(--link-color) shade(15%));\n    --list-group-border: #ddd;\n    --font-family-sans-serif: \"robotoregular\",\"Helvetica Neue\",Helvetica,Arial,sans-serif;\n    --font-family-base: var(--font-family-sans-serif);\n    --font-family-mono: \"Menlo\",\"Monaco\",\"Consolas\",\"Courier New\",monospace;\n    --font-size-base: 14px;\n    --line-height-base: 1.429;\n    --line-height-computed: 20px;\n    --headings-font-family: inherit;\n    --headings-font-weight: 400;\n    --headings-line-height: 1.1;\n    --headings-color: inherit;\n    --headings-small-color: var(--gray-light);\n    --font-size-h1: 36px;\n    --font-size-h2: 30px;\n    --font-size-h3: 24px;\n    --font-size-h4: 18px;\n    --font-size-h5: var(--font-size-base);\n    --font-size-h6: 12px;\n    --font-family-light: \"robotolight\";\n    --font-family-regular: \"robotoregular\";\n    --font-family-medium: \"robotomedium\";\n    --link-transition: color 0.2s ease-out\n}\n\n.test--trans-color---3sP2r {\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\n.test--component---1mwsi {\n    border-bottom: 1px solid #e0e0e0;\n    border-bottom: 1px solid var(--grey300)\n}\n\n.test--component---1mwsi.test--expanded---3hI0z.test--passed---38wAs .test--body-wrap---3EGPT,.test--component---1mwsi.test--expanded---3hI0z.test--passed---38wAs .test--header-btn---mI0Oy {\n    border-left-color: #4caf50;\n    border-left-color: var(--green500)\n}\n\n.test--component---1mwsi.test--expanded---3hI0z.test--failed---2PZhW .test--body-wrap---3EGPT,.test--component---1mwsi.test--expanded---3hI0z.test--failed---2PZhW .test--header-btn---mI0Oy {\n    border-left-color: #f44336;\n    border-left-color: var(--red500)\n}\n\n.test--list---24Hjy {\n    list-style-type: none;\n    margin: 0;\n    padding: 0\n}\n\n.test--header-btn---mI0Oy {\n    display: -webkit-flex;\n    display: flex;\n    position: relative;\n    background: #252525;\n    border: none;\n    border-left: 3px solid transparent;\n    cursor: pointer;\n    -webkit-flex-wrap: wrap;\n    flex-wrap: wrap;\n    padding: 10px 16px 10px 13px;\n    transition: border-color .2s ease-out;\n    width: 100%\n}\n\n.test--header-btn---mI0Oy[disabled] {\n    cursor: default\n}\n\n.test--header-btn---mI0Oy:focus {\n    box-shadow: 0 0 2px 0 #03a9f4;\n    box-shadow: 0 0 2px 0 var(--ltblue500);\n    outline: none\n}\n\n.test--header-btn---mI0Oy:focus:not([disabled]),.test--header-btn---mI0Oy:hover:not([disabled]) {\n    border-left-color: #9e9e9e;\n    border-left-color: var(--grey500)\n}\n\n.test--title---4c0rg {\n    overflow: hidden;\n    text-overflow: ellipsis;\n    white-space: nowrap;\n    -webkit-flex-grow: 1;\n    flex-grow: 1;\n    font-family: var(--font-family--regular);\n    font-size: 13px;\n    line-height: 24px;\n    margin: 0;\n    padding-right: 12px;\n    text-align: left\n}\n\n.test--hook---3T4lI .test--title---4c0rg {\n    color: rgba(0,0,0,.54);\n    color: var(--black54)\n}\n\n.test--expanded---3hI0z .test--title---4c0rg {\n    line-height: 1.5;\n    padding-top: 3px;\n    white-space: normal\n}\n\n.test--icon---2jgH_ {\n    -webkit-align-self: flex-start;\n    align-self: flex-start;\n    padding: 3px;\n    border-radius: 50%;\n    color: #fff;\n    margin-right: 16px\n}\n\n.test--icon---2jgH_.test--pass---C1Mk7 {\n    color: #c8e6c9;\n    color: var(--green100);\n    background-color: #4caf50;\n    background-color: var(--green500)\n}\n\n.test--icon---2jgH_.test--fail---3u2w0 {\n    color: #ffcdd2;\n    color: var(--red100);\n    background-color: #f44336;\n    background-color: var(--red500)\n}\n\n.test--icon---2jgH_.test--pending---3Ctfm {\n    color: #b3e5fc;\n    color: var(--ltblue100);\n    background-color: #03a9f4;\n    background-color: var(--ltblue500)\n}\n\n.test--icon---2jgH_.test--skipped---3aU0Y {\n    color: #f5f5f5;\n    color: var(--grey100);\n    background-color: #9e9e9e;\n    background-color: var(--grey500)\n}\n\n.test--icon---2jgH_.test--hook---3T4lI {\n    color: rgba(0,0,0,.38);\n    color: var(--black38);\n    padding: 0\n}\n\n.test--failed---2PZhW .test--icon---2jgH_.test--hook---3T4lI {\n    color: #f44336;\n    color: var(--red500)\n}\n\n.test--info---1UQNw {\n    display: -webkit-flex;\n    display: flex\n}\n\n.test--duration---2tVp5 {\n    font-family: var(--font-family--regular);\n    line-height: 24px;\n    color: rgba(0,0,0,.54);\n    color: var(--black54)\n}\n\n.test--component---1mwsi:hover:not(.test--pending---3Ctfm) .test--duration---2tVp5,.test--expanded---3hI0z .test--duration---2tVp5 {\n    color: rgba(0,0,0,.87);\n    color: var(--black87)\n}\n\n.test--duration---2tVp5 {\n    transition: color .2s ease-out\n}\n\n.test--duration-icon---2KnOU {\n    margin-left: 4px;\n    line-height: 24px!important;\n    color: rgba(0,0,0,.38);\n    color: var(--black38)\n}\n\n.test--duration-icon---2KnOU.test--slow---MQOnF {\n    color: #e57373;\n    color: var(--red300)\n}\n\n.test--duration-icon---2KnOU.test--medium---5j890 {\n    color: #fbc02d;\n    color: var(--yellow700)\n}\n\n.test--context-icon---2POzC {\n    position: relative;\n    line-height: 24px!important;\n    color: rgba(0,0,0,.38);\n    color: var(--black38);\n    margin-right: 8px;\n    top: 1px\n}\n\n.test--body-wrap---3EGPT {\n    border-left: 3px solid transparent;\n    transition: border-color .2s ease-out\n}\n\n.test--expanded---3hI0z .test--body-wrap---3EGPT {\n    display: block;\n    padding-bottom: 10px\n}\n\n.test--body---Ox0q_ {\n    display: none;\n    background-color: #181818;\n    border: 1px solid #eceff1;\n    border: 1px solid var(--grey50);\n    border-radius: 4px\n}\n\n.test--expanded---3hI0z .test--body---Ox0q_ {\n    display: block;\n    margin: 0 16px 0 13px\n}\n\n.test--error-message---3Grn0 {\n    color: #f44336;\n    color: var(--red500);\n    font-size: 12px;\n    margin: 10px 0 0;\n    text-align: left;\n    width: 100%;\n    word-break: break-word\n}\n\n.test--code-snippet---3H5Xj {\n    position: relative;\n    font-size: 11px;\n    margin: 0;\n    border-radius: 0\n}\n\n.test--code-snippet---3H5Xj+.test--code-snippet---3H5Xj {\n    border-top: 1px solid #fff\n}\n\n.test--code-snippet---3H5Xj.hljs {\n    padding: 1em;\n    background: none;\n}\n\n.test--code-diff---2XQsb code>span:first-child {\n    margin-right: 11px\n}\n\n.test--code-diff-expected---1QWLl span {\n    color: #859900\n}\n\n.test--inline-diff---3OmYO .test--code-diff-expected---1QWLl {\n    background-color: #859900;\n    color: #fff\n}\n\n.test--code-diff-actual---3MMxN span {\n    color: #dc322f\n}\n\n.test--inline-diff---3OmYO .test--code-diff-actual---3MMxN {\n    background-color: #dc322f;\n    color: #fff\n}\n\n.test--code-label---1QEUY {\n    position: absolute;\n    font-family: var(--font-family--regular);\n    top: 0;\n    right: 0;\n    padding: .2em .6em;\n    background-color: #9e9e9e;\n    background-color: var(--grey500);\n    color: #fff\n}\n\n.test--context---1YYgX {\n    background-color: #fff;\n    border-top: 1px solid #eceff1;\n    border-top: 1px solid var(--grey50);\n    border-bottom-left-radius: 4px;\n    border-bottom-right-radius: 4px\n}\n\n.test--context-title---HHH10 {\n    overflow: hidden;\n    text-overflow: ellipsis;\n    white-space: nowrap;\n    font-family: var(--font-family--regular);\n    font-size: 13px;\n    color: rgba(0,0,0,.54);\n    color: var(--black54);\n    margin: 0;\n    padding: 11px 11px 0\n}\n\n.test--context-item---R1NNU {\n    padding-top: 11px\n}\n\n.test--context-item---R1NNU .test--code-snippet---3H5Xj {\n    padding-top: 0\n}\n\n.test--context-item-title---1KxIO {\n    overflow: hidden;\n    text-overflow: ellipsis;\n    white-space: nowrap;\n    font-family: var(--font-family--medium);\n    font-size: 13px;\n    margin: 0;\n    padding: 0 11px 11px\n}\n\n.test--text-link---2_cSn {\n    display: inline-block;\n    padding: 0 1em 1em;\n    font-family: Menlo,Monaco,Consolas,Courier New,monospace;\n    font-family: var(--font-family-mono);\n    font-size: 11px;\n    color: #0288d1;\n    color: var(--ltblue700)\n}\n\n.test--text-link---2_cSn:hover {\n    color: #03a9f4;\n    color: var(--ltblue500)\n}\n\n.test--image-link---PUFPJ,.test--video-link---1L-2D {\n    display: inline-block;\n    font-size: 11px;\n    padding: 0 1em 1em\n}\n\n.test--image---2Z5X2,.test--video---2JK7O {\n    display: block;\n    max-width: 100%;\n    height: auto\n}\n\n:root {\n    --screen-sm-min: 768px;\n    --screen-md-min: 992px;\n    --screen-lg-min: 1200px;\n    --grid-gutter-width: 30px;\n    --container-sm: calc(720px + var(--grid-gutter-width));\n    --container-md: calc(940px + var(--grid-gutter-width));\n    --container-lg: calc(1140px + var(--grid-gutter-width));\n    --navbar-height: 122px;\n    --navbar-height-short: 56px;\n    --summary-height-stacked: 82px;\n    --statusbar-height-stacked: 54px;\n    --footer-height: 60px;\n    --default-transition-duration: 0.2s;\n    --default-transition-easing: ease;\n    --gray-base: #000;\n    --gray-darker-faded: color(var(--gray-darker) alpha(95%));\n    --gray-darker: color(var(--gray-base) tint(13.5%));\n    --gray-dark: color(var(--gray-base) tint(20%));\n    --gray: color(var(--gray-base) tint(33.5%));\n    --gray-light: color(var(--gray-base) tint(46.7%));\n    --gray-medium: color(var(--gray-base) tint(73.5%));\n    --gray-lighter: color(var(--gray-base) tint(93.5%));\n    --gray-lighter-faded: color(var(--gray-lighter) alpha(95%));\n    --gray-border: color(var(--gray-base) tint(80%));\n    --grey50: #eceff1;\n    --grey100: #f5f5f5;\n    --grey300: #e0e0e0;\n    --grey500: #9e9e9e;\n    --grey700: #616161;\n    --green100: #c8e6c9;\n    --green200: #a5d6a7;\n    --green300: #81c784;\n    --green500: #4caf50;\n    --green700: #388e3c;\n    --red100: #ffcdd2;\n    --red300: #e57373;\n    --red500: #f44336;\n    --red700: #d32f2f;\n    --ltblue100: #b3e5fc;\n    --ltblue300: #4fc3f7;\n    --ltblue500: #03a9f4;\n    --ltblue700: #0288d1;\n    --black87: rgba(0,0,0,0.87);\n    --black54: rgba(0,0,0,0.54);\n    --black38: rgba(0,0,0,0.38);\n    --bluegrey500: #607d8b;\n    --bluegrey800: #37474f;\n    --bluegrey900: #263238;\n    --light-icon-active: #fff;\n    --light-icon-inactive: hsla(0,0%,100%,0.5);\n    --dark-icon-active: var(--black54);\n    --dark-icon-inactive: var(--black38);\n    --amber300: #ffd54f;\n    --amber400: #ffca28;\n    --amber500: #ffc107;\n    --yellow700: #fbc02d;\n    --yellow800: #f9a825;\n    --brand-primary: color(#428bca shade(6.5%));\n    --brand-success: #4caf50;\n    --brand-info: #5bc0de;\n    --brand-warning: #f0ad4e;\n    --brand-danger: #d9534f;\n    --text-color: var(--black87);\n    --body-bg: #f2f2f2;\n    --link-color: var(--brand-primary);\n    --link-hover-color: color(var(--link-color) shade(15%));\n    --list-group-border: #ddd;\n    --font-family-sans-serif: \"robotoregular\",\"Helvetica Neue\",Helvetica,Arial,sans-serif;\n    --font-family-base: var(--font-family-sans-serif);\n    --font-family-mono: \"Menlo\",\"Monaco\",\"Consolas\",\"Courier New\",monospace;\n    --font-size-base: 14px;\n    --line-height-base: 1.429;\n    --line-height-computed: 20px;\n    --headings-font-family: inherit;\n    --headings-font-weight: 400;\n    --headings-line-height: 1.1;\n    --headings-color: inherit;\n    --headings-small-color: var(--gray-light);\n    --font-size-h1: 36px;\n    --font-size-h2: 30px;\n    --font-size-h3: 24px;\n    --font-size-h4: 18px;\n    --font-size-h5: var(--font-size-base);\n    --font-size-h6: 12px;\n    --font-family-light: \"robotolight\";\n    --font-family-regular: \"robotoregular\";\n    --font-family-medium: \"robotomedium\";\n    --link-transition: color 0.2s ease-out\n}\n\n.suite--trans-color---2pu6T {\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\n.suite--component---22Vxk:after,.suite--component---22Vxk:before {\n    content: \" \";\n    display: table\n}\n\n.suite--component---22Vxk:after {\n    clear: both\n}\n\n.suite--component---22Vxk {\n    position: relative;\n    background-color: #141414;\n    margin-bottom: 20px\n}\n\n.suite--component---22Vxk>.suite--body---1itCO>ul>li>.suite--component---22Vxk {\n    border: 1px solid #e0e0e0;\n    border: 1px solid var(--grey300);\n    border-right: none;\n    border-bottom: none;\n    margin: 16px 0 16px 16px\n}\n\n.suite--component---22Vxk>.suite--body---1itCO>ul>li>.suite--component---22Vxk.suite--no-tests---l47BS {\n    border-bottom: 1px solid #e0e0e0;\n    border-bottom: 1px solid var(--grey300)\n}\n\n.suite--list---3WtMK {\n    list-style-type: none;\n    margin: 0;\n    padding: 0\n}\n\n.suite--list-main---3KCXR>li>.suite--component---22Vxk,.suite--root-suite---ZDRuj {\n    box-shadow: 0 2px 5px 0 rgb(197 197 197 / 16%), 0 2px 10px 0 rgb(57 57 57 / 12%);\n    margin: 0 0 24px\n}\n\n.suite--list-main---3KCXR>.suite--no-tests---l47BS>.suite--body---1itCO>ul>li>.suite--component---22Vxk:not(.suite--no-suites---2PQFQ) {\n    border-bottom: 1px solid #e0e0e0;\n    border-bottom: 1px solid var(--grey300)\n}\n\n.suite--header---TddSn:after,.suite--header---TddSn:before {\n    content: \" \";\n    display: table\n}\n\n.suite--header---TddSn:after {\n    clear: both\n}\n\n.suite--header---TddSn {\n    border-bottom: 1px solid #e0e0e0;\n    border-bottom: 1px solid var(--grey300)\n}\n\n.suite--no-tests---l47BS>.suite--header---TddSn {\n    padding-bottom: 0;\n    border-bottom: none\n}\n\n.suite--header-btn---25qLz {\n    background: #1d1c1c;\n    border: none;\n    cursor: pointer;\n    padding: 12px 16px;\n    text-align: left;\n    width: 100%\n}\n\n.suite--header-btn---25qLz:focus {\n    box-shadow: 0 0 2px 0 #03a9f4;\n    box-shadow: 0 0 2px 0 var(--ltblue500);\n    outline: none\n}\n\n.suite--title---3T6OR {\n    display: -webkit-flex;\n    display: flex;\n    font-family: var(--font-family--light);\n    font-size: 21px;\n    margin: 0\n}\n\n.suite--title---3T6OR span {\n    margin-right: auto\n}\n\n.suite--title---3T6OR .suite--icon---2KPe5 {\n    margin-left: 58px\n}\n\n.suite--filename---1u8oo {\n    color: rgba(0,0,0,.54);\n    color: var(--black54);\n    font-family: var(--font-family--regular);\n    margin: 6px 0 0\n}\n\n.suite--body---1itCO:after,.suite--body---1itCO:before {\n    content: \" \";\n    display: table\n}\n\n.suite--body---1itCO:after {\n    clear: both\n}\n\n.suite--body---1itCO.suite--hide---2i8QF {\n    display: none\n}\n\n.suite--has-suites---3OYDf>.suite--body---1itCO {\n    border-bottom: 1px solid #e0e0e0;\n    border-bottom: 1px solid var(--grey300)\n}\n\n.suite--chart-wrap---7hvUh {\n    display: none;\n    position: absolute;\n    top: 12px;\n    right: 36px;\n    width: 50px;\n    height: 50px\n}\n\n.suite--chart-slice---1XN2j {\n    stroke: #fff;\n    stroke-width: 2px\n}\n\n.ct-series-a .suite--chart-slice---1XN2j {\n    fill: #4caf50;\n    fill: var(--green500)\n}\n\n.ct-series-b .suite--chart-slice---1XN2j {\n    fill: #f44336;\n    fill: var(--red500)\n}\n\n.ct-series-c .suite--chart-slice---1XN2j {\n    fill: #03a9f4;\n    fill: var(--ltblue500)\n}\n\n.ct-series-d .suite--chart-slice---1XN2j {\n    fill: rgba(0,0,0,.38);\n    fill: var(--black38)\n}\n\n@media (min-width: 768px) {\n    .suite--chart-wrap---7hvUh {\n        display:block\n    }\n\n    .suite--chart-enabled---1N-VF:not(.suite--no-tests---l47BS) .suite--header---TddSn {\n        min-height: 66px\n    }\n}\n\n:root {\n    --screen-sm-min: 768px;\n    --screen-md-min: 992px;\n    --screen-lg-min: 1200px;\n    --grid-gutter-width: 30px;\n    --container-sm: calc(720px + var(--grid-gutter-width));\n    --container-md: calc(940px + var(--grid-gutter-width));\n    --container-lg: calc(1140px + var(--grid-gutter-width));\n    --navbar-height: 122px;\n    --navbar-height-short: 56px;\n    --summary-height-stacked: 82px;\n    --statusbar-height-stacked: 54px;\n    --footer-height: 60px;\n    --default-transition-duration: 0.2s;\n    --default-transition-easing: ease;\n    --gray-base: #000;\n    --gray-darker-faded: color(var(--gray-darker) alpha(95%));\n    --gray-darker: color(var(--gray-base) tint(13.5%));\n    --gray-dark: color(var(--gray-base) tint(20%));\n    --gray: color(var(--gray-base) tint(33.5%));\n    --gray-light: color(var(--gray-base) tint(46.7%));\n    --gray-medium: color(var(--gray-base) tint(73.5%));\n    --gray-lighter: color(var(--gray-base) tint(93.5%));\n    --gray-lighter-faded: color(var(--gray-lighter) alpha(95%));\n    --gray-border: color(var(--gray-base) tint(80%));\n    --grey50: #eceff1;\n    --grey100: #f5f5f5;\n    --grey300: #e0e0e0;\n    --grey500: #9e9e9e;\n    --grey700: #616161;\n    --green100: #c8e6c9;\n    --green200: #a5d6a7;\n    --green300: #81c784;\n    --green500: #4caf50;\n    --green700: #388e3c;\n    --red100: #ffcdd2;\n    --red300: #e57373;\n    --red500: #f44336;\n    --red700: #d32f2f;\n    --ltblue100: #b3e5fc;\n    --ltblue300: #4fc3f7;\n    --ltblue500: #03a9f4;\n    --ltblue700: #0288d1;\n    --black87: rgba(0,0,0,0.87);\n    --black54: rgba(0,0,0,0.54);\n    --black38: rgba(0,0,0,0.38);\n    --bluegrey500: #607d8b;\n    --bluegrey800: #37474f;\n    --bluegrey900: #263238;\n    --light-icon-active: #fff;\n    --light-icon-inactive: hsla(0,0%,100%,0.5);\n    --dark-icon-active: var(--black54);\n    --dark-icon-inactive: var(--black38);\n    --amber300: #ffd54f;\n    --amber400: #ffca28;\n    --amber500: #ffc107;\n    --yellow700: #fbc02d;\n    --yellow800: #f9a825;\n    --brand-primary: color(#428bca shade(6.5%));\n    --brand-success: #4caf50;\n    --brand-info: #5bc0de;\n    --brand-warning: #f0ad4e;\n    --brand-danger: #d9534f;\n    --text-color: var(--black87);\n    --body-bg: #f2f2f2;\n    --link-color: var(--brand-primary);\n    --link-hover-color: color(var(--link-color) shade(15%));\n    --list-group-border: #ddd;\n    --font-family-sans-serif: \"robotoregular\",\"Helvetica Neue\",Helvetica,Arial,sans-serif;\n    --font-family-base: var(--font-family-sans-serif);\n    --font-family-mono: \"Menlo\",\"Monaco\",\"Consolas\",\"Courier New\",monospace;\n    --font-size-base: 14px;\n    --line-height-base: 1.429;\n    --line-height-computed: 20px;\n    --headings-font-family: inherit;\n    --headings-font-weight: 400;\n    --headings-line-height: 1.1;\n    --headings-color: inherit;\n    --headings-small-color: var(--gray-light);\n    --font-size-h1: 36px;\n    --font-size-h2: 30px;\n    --font-size-h3: 24px;\n    --font-size-h4: 18px;\n    --font-size-h5: var(--font-size-base);\n    --font-size-h6: 12px;\n    --font-family-light: \"robotolight\";\n    --font-family-regular: \"robotoregular\";\n    --font-family-medium: \"robotomedium\";\n    --link-transition: color 0.2s ease-out\n}\n\n.suite-summary--trans-color---14JXk {\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\n.suite-summary--component---cFAkx:after,.suite-summary--component---cFAkx:before {\n    content: \" \";\n    display: table\n}\n\n.suite-summary--component---cFAkx:after {\n    clear: both\n}\n\n.suite-summary--component---cFAkx {\n    list-style: none;\n    padding-left: 0;\n    display: -webkit-flex;\n    display: flex;\n    font-family: var(--font-family--regular);\n    font-size: 15px;\n    margin: 16px 0 0\n}\n\n.suite-summary--component---cFAkx.suite-summary--no-margin---3WX9n {\n    margin: 0\n}\n\n.suite-summary--summary-item---JHYFN {\n    display: -webkit-flex;\n    display: flex;\n    line-height: 18px;\n    margin: 0 8px;\n    color: rgba(0,0,0,.54);\n    color: var(--black54)\n}\n\n.suite-summary--summary-item---JHYFN:first-child {\n    margin-left: 0\n}\n\n.suite-summary--summary-item---JHYFN.suite-summary--duration---AzGUQ,.suite-summary--summary-item---JHYFN.suite-summary--tests---3Zhct {\n    color: rgba(0,0,0,.54);\n    color: var(--black54)\n}\n\n.suite-summary--summary-item---JHYFN.suite-summary--passed---24BnC {\n    color: #4caf50;\n    color: var(--green500)\n}\n\n.suite-summary--summary-item---JHYFN.suite-summary--failed---205C4 {\n    color: #f44336;\n    color: var(--red500)\n}\n\n.suite-summary--summary-item---JHYFN.suite-summary--pending---3_Nkj {\n    color: #03a9f4;\n    color: var(--ltblue500)\n}\n\n.suite-summary--summary-item---JHYFN.suite-summary--skipped---TovqF {\n    color: rgba(0,0,0,.38);\n    color: var(--black38)\n}\n\n.suite-summary--icon---3rZ6G {\n    margin-right: 2px\n}\n\n:root {\n      color-scheme: dark;\n      --screen-sm-min: 768px;\n      --screen-md-min: 992px;\n      --screen-lg-min: 1200px;\n      --grid-gutter-width: 30px;\n      --container-sm: calc(720px + var(--grid-gutter-width));\n      --container-md: calc(940px + var(--grid-gutter-width));\n      --container-lg: calc(1140px + var(--grid-gutter-width));\n      --navbar-height: 122px;\n      --navbar-height-short: 56px;\n      --summary-height-stacked: 82px;\n      --statusbar-height-stacked: 54px;\n      --footer-height: 60px;\n      --default-transition-duration: 0.2s;\n      --default-transition-easing: ease;\n      --gray-base: #000;\n      --gray-darker-faded: color(var(--gray-darker) alpha(95%));\n      --gray-darker: color(var(--gray-base) tint(13.5%));\n      --gray-dark: color(var(--gray-base) tint(20%));\n      --gray: color(var(--gray-base) tint(33.5%));\n      --gray-light: color(var(--gray-base) tint(46.7%));\n      --gray-medium: color(var(--gray-base) tint(73.5%));\n      --gray-lighter: color(var(--gray-base) tint(93.5%));\n      --gray-lighter-faded: color(var(--gray-lighter) alpha(95%));\n      --gray-border: color(var(--gray-base) tint(80%));\n      --grey50: #eceff1;\n      --grey100: #f5f5f5;\n      --grey300: #828282;\n      --grey500: #9e9e9e;\n      --grey700: #616161;\n      --green100: #c8e6c9;\n      --green200: #a5d6a7;\n      --green300: #81c784;\n      --green500: #4caf50;\n      --green700: #388e3c;\n      --red100: #ffcdd2;\n      --red300: #e57373;\n      --red500: #f44336;\n      --red700: #d32f2f;\n      --ltblue100: #b3e5fc;\n      --ltblue300: #4fc3f7;\n      --ltblue500: #03a9f4;\n      --ltblue700: #0288d1;\n      --black87: rgb(188 188 188);\n      --black54: rgb(255 255 255 / 54%);\n      --black38: rgba(0,0,0,0.38);\n      --bluegrey500: #607d8b;\n      --bluegrey800: #37474f;\n      --bluegrey900: #263238;\n      --light-icon-active: #fff;\n      --light-icon-inactive: hsla(0,0%,100%,0.5);\n      --dark-icon-active: var(--black54);\n      --dark-icon-inactive: var(--black38);\n      --amber300: #ffd54f;\n      --amber400: #ffca28;\n      --amber500: #ffc107;\n      --yellow700: #fbc02d;\n      --yellow800: #f9a825;\n      --brand-primary: color(#428bca shade(6.5%));\n      --brand-success: #4caf50;\n      --brand-info: #5bc0de;\n      --brand-warning: #f0ad4e;\n      --brand-danger: #d9534f;\n      --text-color: var(--black87);\n      --body-bg: #1b1a1a;\n      --link-color: var(--brand-primary);\n      --link-hover-color: color(var(--link-color) shade(15%));\n      --list-group-border: #ddd;\n      --font-family-sans-serif: \"robotoregular\",\"Helvetica Neue\",Helvetica,Arial,sans-serif;\n      --font-family-base: var(--font-family-sans-serif);\n      --font-family-mono: \"Menlo\",\"Monaco\",\"Consolas\",\"Courier New\",monospace;\n      --font-size-base: 14px;\n      --line-height-base: 1.429;\n      --line-height-computed: 20px;\n      --headings-font-family: inherit;\n      --headings-font-weight: 400;\n      --headings-line-height: 1.1;\n      --headings-color: #d1d1d1;\n      --headings-small-color: var(--gray-light);\n      --font-size-h1: 36px;\n      --font-size-h2: 30px;\n      --font-size-h3: 24px;\n      --font-size-h4: 18px;\n      --font-size-h5: var(--font-size-base);\n      --font-size-h6: 12px;\n      --font-family-light: \"robotolight\";\n      --font-family-regular: \"robotoregular\";\n      --font-family-medium: \"robotomedium\";\n      --link-transition: color 0.2s ease-out\n}\n\n.toggle-switch--trans-color---16in9 {\n    transition: color .2s ease-out;\n    transition: var(--link-transition)\n}\n\n.toggle-switch--component---3vjvh:after,.toggle-switch--component---3vjvh:before {\n    content: \" \";\n    display: table\n}\n\n.toggle-switch--component---3vjvh:after {\n    clear: both\n}\n\n.toggle-switch--component---3vjvh {\n    height: 24px\n}\n\n.toggle-switch--label---1Lu8U {\n    display: -webkit-flex;\n    display: flex;\n    -webkit-align-items: center;\n    align-items: center\n}\n\n.toggle-switch--toggle-input---3BB7e {\n    position: absolute;\n    opacity: 0\n}\n\n.toggle-switch--toggle-input---3BB7e:checked+.toggle-switch--toggle---2kPqc {\n    background-color: #a5d6a7;\n    background-color: var(--green200)\n}\n\n.toggle-switch--toggle-input---3BB7e:checked+.toggle-switch--toggle---2kPqc:before {\n    background-color: #4caf50;\n    background-color: var(--green500);\n    -webkit-transform: translateX(14px);\n    transform: translateX(14px)\n}\n\n.toggle-switch--toggle-input---3BB7e:focus+.toggle-switch--toggle---2kPqc:before {\n    box-shadow: 0 2px 5px 0 rgba(0,0,0,.16),0 2px 10px 0 rgba(0,0,0,.12),0 0 2px 0 #03a9f4;\n    box-shadow: 0 2px 5px 0 rgba(0,0,0,.16),0 2px 10px 0 rgba(0,0,0,.12),0 0 2px 0 var(--ltblue500)\n}\n\n.toggle-switch--toggle---2kPqc {\n    display: inline-block;\n    position: relative;\n    background-color: #e0e0e0;\n    background-color: var(--grey300);\n    border-radius: 7px;\n    cursor: pointer;\n    height: 14px;\n    margin-left: auto;\n    transition: background-color .15s cubic-bezier(.4,0,.2,1) 0s;\n    width: 34px\n}\n\n.toggle-switch--toggle---2kPqc:before {\n    box-shadow: 0 2px 5px 0 rgba(0,0,0,.16),0 2px 10px 0 rgba(0,0,0,.12);\n    content: \"\";\n    position: absolute;\n    background-color: #9e9e9e;\n    background-color: var(--grey500);\n    border-radius: 100%;\n    height: 20px;\n    left: 0;\n    top: -3px;\n    width: 20px;\n    transition: -webkit-transform .15s cubic-bezier(.4,0,.2,1) 0s;\n    transition: transform .15s cubic-bezier(.4,0,.2,1) 0s;\n    transition: transform .15s cubic-bezier(.4,0,.2,1) 0s,-webkit-transform .15s cubic-bezier(.4,0,.2,1) 0s\n}\n\n.toggle-switch--disabled---1qDLf {\n    opacity: .6\n}\n\n.toggle-switch--disabled---1qDLf .toggle-switch--icon---348nT {\n    color: rgba(0,0,0,.38);\n    color: var(--black38)\n}\n\n.toggle-switch--disabled---1qDLf .toggle-switch--toggle---2kPqc {\n    cursor: default\n}\n"
  },
  {
    "path": "test/api/form-data-files/U_MS_Windows_10_STIG_V1R23_Manual-xccdf.xml",
    "content": "<?xml version=\"1.0\" encoding=\"utf-8\"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:cpe=\"http://cpe.mitre.org/language/2.0\" xmlns:xhtml=\"http://www.w3.org/1999/xhtml\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\" id=\"Windows_10_STIG_TEST\" xml:lang=\"en\" xsi:schemaLocation=\"http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd\" xmlns=\"http://checklists.nist.gov/xccdf/1.1\"><status date=\"2020-06-15\">accepted</status><title>Windows 10 Security Technical Implementation Guide</title><description>The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id=\"terms-of-use\" xml:lang=\"en\">Developed_by_DISA_for_the_DoD</notice><reference href=\"https://cyber.mil/\"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id=\"release-info\">Release: 23 Benchmark Date: 17 Jun 2020</plain-text><version>1</version><Profile id=\"MAC-1_Classified\"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-63319\" selected=\"true\" /><select idref=\"V-63321\" selected=\"true\" /><select idref=\"V-63323\" selected=\"true\" /><select idref=\"V-63325\" selected=\"true\" /><select idref=\"V-63329\" selected=\"true\" /><select idref=\"V-63333\" selected=\"true\" /><select idref=\"V-63335\" selected=\"true\" /><select idref=\"V-63337\" selected=\"true\" /><select idref=\"V-63339\" selected=\"true\" /><select idref=\"V-63341\" selected=\"true\" /><select idref=\"V-63343\" selected=\"true\" /><select idref=\"V-63345\" selected=\"true\" /><select idref=\"V-63347\" selected=\"true\" /><select idref=\"V-63349\" selected=\"true\" /><select idref=\"V-63351\" selected=\"true\" /><select idref=\"V-63353\" selected=\"true\" /><select idref=\"V-63355\" selected=\"true\" /><select idref=\"V-63357\" selected=\"true\" /><select idref=\"V-63359\" selected=\"true\" /><select idref=\"V-63361\" selected=\"true\" /><select idref=\"V-63363\" selected=\"true\" /><select idref=\"V-63365\" selected=\"true\" /><select idref=\"V-63367\" selected=\"true\" /><select idref=\"V-63369\" selected=\"true\" /><select idref=\"V-63371\" selected=\"true\" /><select idref=\"V-63373\" selected=\"true\" /><select idref=\"V-63375\" selected=\"true\" /><select idref=\"V-63377\" selected=\"true\" /><select idref=\"V-63381\" selected=\"true\" /><select idref=\"V-63383\" selected=\"true\" /><select idref=\"V-63385\" selected=\"true\" /><select idref=\"V-63389\" selected=\"true\" /><select idref=\"V-63393\" selected=\"true\" /><select idref=\"V-63399\" selected=\"true\" /><select idref=\"V-63403\" selected=\"true\" /><select idref=\"V-63405\" selected=\"true\" /><select idref=\"V-63409\" selected=\"true\" /><select idref=\"V-63413\" selected=\"true\" /><select idref=\"V-63415\" selected=\"true\" /><select idref=\"V-63419\" selected=\"true\" /><select idref=\"V-63421\" selected=\"true\" /><select idref=\"V-63423\" selected=\"true\" /><select idref=\"V-63427\" selected=\"true\" /><select idref=\"V-63429\" selected=\"true\" /><select idref=\"V-63431\" selected=\"true\" /><select idref=\"V-63435\" selected=\"true\" /><select idref=\"V-63445\" selected=\"true\" /><select idref=\"V-63447\" selected=\"true\" /><select idref=\"V-63449\" selected=\"true\" /><select idref=\"V-63451\" selected=\"true\" /><select idref=\"V-63453\" selected=\"true\" /><select idref=\"V-63457\" selected=\"true\" /><select idref=\"V-63459\" selected=\"true\" /><select idref=\"V-63463\" selected=\"true\" /><select idref=\"V-63467\" selected=\"true\" /><select idref=\"V-63469\" selected=\"true\" /><select idref=\"V-63471\" selected=\"true\" /><select idref=\"V-63473\" selected=\"true\" /><select idref=\"V-63479\" selected=\"true\" /><select idref=\"V-63481\" selected=\"true\" /><select idref=\"V-63483\" selected=\"true\" /><select idref=\"V-63487\" selected=\"true\" /><select idref=\"V-63491\" selected=\"true\" /><select idref=\"V-63499\" selected=\"true\" /><select idref=\"V-63503\" selected=\"true\" /><select idref=\"V-63507\" selected=\"true\" /><select idref=\"V-63513\" selected=\"true\" /><select idref=\"V-63515\" selected=\"true\" /><select idref=\"V-63517\" selected=\"true\" /><select idref=\"V-63519\" selected=\"true\" /><select idref=\"V-63523\" selected=\"true\" /><select idref=\"V-63527\" selected=\"true\" /><select idref=\"V-63533\" selected=\"true\" /><select idref=\"V-63537\" selected=\"true\" /><select idref=\"V-63541\" selected=\"true\" /><select idref=\"V-63545\" selected=\"true\" /><select idref=\"V-63549\" selected=\"true\" /><select idref=\"V-63555\" selected=\"true\" /><select idref=\"V-63559\" selected=\"true\" /><select idref=\"V-63563\" selected=\"true\" /><select idref=\"V-63567\" selected=\"true\" /><select idref=\"V-63569\" selected=\"true\" /><select idref=\"V-63577\" selected=\"true\" /><select idref=\"V-63579\" selected=\"true\" /><select idref=\"V-63581\" selected=\"true\" /><select idref=\"V-63583\" selected=\"true\" /><select idref=\"V-63585\" selected=\"true\" /><select idref=\"V-63587\" selected=\"true\" /><select idref=\"V-63589\" selected=\"true\" /><select idref=\"V-63591\" selected=\"true\" /><select idref=\"V-63593\" selected=\"true\" /><select idref=\"V-63595\" selected=\"true\" /><select idref=\"V-63597\" selected=\"true\" /><select idref=\"V-63599\" selected=\"true\" /><select idref=\"V-63601\" selected=\"true\" /><select idref=\"V-63607\" selected=\"true\" /><select idref=\"V-63609\" selected=\"true\" /><select idref=\"V-63611\" selected=\"true\" /><select idref=\"V-63615\" selected=\"true\" /><select idref=\"V-63617\" selected=\"true\" /><select idref=\"V-63619\" selected=\"true\" /><select idref=\"V-63621\" selected=\"true\" /><select idref=\"V-63623\" selected=\"true\" /><select idref=\"V-63625\" selected=\"true\" /><select idref=\"V-63627\" selected=\"true\" /><select idref=\"V-63629\" selected=\"true\" /><select idref=\"V-63633\" selected=\"true\" /><select idref=\"V-63635\" selected=\"true\" /><select idref=\"V-63639\" selected=\"true\" /><select idref=\"V-63643\" selected=\"true\" /><select idref=\"V-63645\" selected=\"true\" /><select idref=\"V-63647\" selected=\"true\" /><select idref=\"V-63649\" selected=\"true\" /><select idref=\"V-63651\" selected=\"true\" /><select idref=\"V-63653\" selected=\"true\" /><select idref=\"V-63657\" selected=\"true\" /><select idref=\"V-63659\" selected=\"true\" /><select idref=\"V-63661\" selected=\"true\" /><select idref=\"V-63663\" selected=\"true\" /><select idref=\"V-63665\" selected=\"true\" /><select idref=\"V-63667\" selected=\"true\" /><select idref=\"V-63669\" selected=\"true\" /><select idref=\"V-63671\" selected=\"true\" /><select idref=\"V-63673\" selected=\"true\" /><select idref=\"V-63675\" selected=\"true\" /><select idref=\"V-63677\" selected=\"true\" /><select idref=\"V-63679\" selected=\"true\" /><select idref=\"V-63681\" selected=\"true\" /><select idref=\"V-63683\" selected=\"true\" /><select idref=\"V-63685\" selected=\"true\" /><select idref=\"V-63687\" selected=\"true\" /><select idref=\"V-63689\" selected=\"true\" /><select idref=\"V-63691\" selected=\"true\" /><select idref=\"V-63695\" selected=\"true\" /><select idref=\"V-63697\" selected=\"true\" /><select idref=\"V-63699\" selected=\"true\" /><select idref=\"V-63701\" selected=\"true\" /><select idref=\"V-63703\" selected=\"true\" /><select idref=\"V-63709\" selected=\"true\" /><select idref=\"V-63711\" selected=\"true\" /><select idref=\"V-63713\" selected=\"true\" /><select idref=\"V-63717\" selected=\"true\" /><select idref=\"V-63719\" selected=\"true\" /><select idref=\"V-63721\" selected=\"true\" /><select idref=\"V-63729\" selected=\"true\" /><select idref=\"V-63731\" selected=\"true\" /><select idref=\"V-63733\" selected=\"true\" /><select idref=\"V-63737\" selected=\"true\" /><select idref=\"V-63739\" selected=\"true\" /><select idref=\"V-63741\" selected=\"true\" /><select idref=\"V-63743\" selected=\"true\" /><select idref=\"V-63745\" selected=\"true\" /><select idref=\"V-63747\" selected=\"true\" /><select idref=\"V-63749\" selected=\"true\" /><select idref=\"V-63751\" selected=\"true\" /><select idref=\"V-63755\" selected=\"true\" /><select idref=\"V-63759\" selected=\"true\" /><select idref=\"V-63765\" selected=\"true\" /><select idref=\"V-63767\" selected=\"true\" /><select idref=\"V-63795\" selected=\"true\" /><select idref=\"V-63797\" selected=\"true\" /><select idref=\"V-63801\" selected=\"true\" /><select idref=\"V-63803\" selected=\"true\" /><select idref=\"V-63805\" selected=\"true\" /><select idref=\"V-63807\" selected=\"true\" /><select idref=\"V-63811\" selected=\"true\" /><select idref=\"V-63815\" selected=\"true\" /><select idref=\"V-63817\" selected=\"true\" /><select idref=\"V-63819\" selected=\"true\" /><select idref=\"V-63821\" selected=\"true\" /><select idref=\"V-63825\" selected=\"true\" /><select idref=\"V-63827\" selected=\"true\" /><select idref=\"V-63829\" selected=\"true\" /><select idref=\"V-63831\" selected=\"true\" /><select idref=\"V-63839\" selected=\"true\" /><select idref=\"V-63841\" selected=\"true\" /><select idref=\"V-63843\" selected=\"true\" /><select idref=\"V-63845\" selected=\"true\" /><select idref=\"V-63847\" selected=\"true\" /><select idref=\"V-63851\" selected=\"true\" /><select idref=\"V-63853\" selected=\"true\" /><select idref=\"V-63855\" selected=\"true\" /><select idref=\"V-63857\" selected=\"true\" /><select idref=\"V-63859\" selected=\"true\" /><select idref=\"V-63861\" selected=\"true\" /><select idref=\"V-63863\" selected=\"true\" /><select idref=\"V-63865\" selected=\"true\" /><select idref=\"V-63869\" selected=\"true\" /><select idref=\"V-63871\" selected=\"true\" /><select idref=\"V-63873\" selected=\"true\" /><select idref=\"V-63875\" selected=\"true\" /><select idref=\"V-63877\" selected=\"true\" /><select idref=\"V-63879\" selected=\"true\" /><select idref=\"V-63881\" selected=\"true\" /><select idref=\"V-63883\" selected=\"true\" /><select idref=\"V-63889\" selected=\"true\" /><select idref=\"V-63917\" selected=\"true\" /><select idref=\"V-63925\" selected=\"true\" /><select idref=\"V-63927\" selected=\"true\" /><select idref=\"V-63931\" selected=\"true\" /><select idref=\"V-63933\" selected=\"true\" /><select idref=\"V-63935\" selected=\"true\" /><select idref=\"V-63939\" selected=\"true\" /><select idref=\"V-63941\" selected=\"true\" /><select idref=\"V-65681\" selected=\"true\" /><select idref=\"V-68817\" selected=\"true\" /><select idref=\"V-68819\" selected=\"true\" /><select idref=\"V-68845\" selected=\"true\" /><select idref=\"V-68849\" selected=\"true\" /><select idref=\"V-70637\" selected=\"true\" /><select idref=\"V-70639\" selected=\"true\" /><select idref=\"V-71759\" selected=\"true\" /><select idref=\"V-71761\" selected=\"true\" /><select idref=\"V-71763\" selected=\"true\" /><select idref=\"V-71765\" selected=\"true\" /><select idref=\"V-71769\" selected=\"true\" /><select idref=\"V-71771\" selected=\"true\" /><select idref=\"V-72329\" selected=\"true\" /><select idref=\"V-72765\" selected=\"true\" /><select idref=\"V-72767\" selected=\"true\" /><select idref=\"V-72769\" selected=\"true\" /><select idref=\"V-74409\" selected=\"true\" /><select idref=\"V-74411\" selected=\"true\" /><select idref=\"V-74413\" selected=\"true\" /><select idref=\"V-74417\" selected=\"true\" /><select idref=\"V-74699\" selected=\"true\" /><select idref=\"V-74719\" selected=\"true\" /><select idref=\"V-74721\" selected=\"true\" /><select idref=\"V-74723\" selected=\"true\" /><select idref=\"V-74725\" selected=\"true\" /><select idref=\"V-75027\" selected=\"true\" /><select idref=\"V-76505\" selected=\"true\" /><select idref=\"V-77083\" selected=\"true\" /><select idref=\"V-77085\" selected=\"true\" /><select idref=\"V-77091\" selected=\"true\" /><select idref=\"V-77095\" selected=\"true\" /><select idref=\"V-77097\" selected=\"true\" /><select idref=\"V-77101\" selected=\"true\" /><select idref=\"V-77103\" selected=\"true\" /><select idref=\"V-77189\" selected=\"true\" /><select idref=\"V-77191\" selected=\"true\" /><select idref=\"V-77195\" selected=\"true\" /><select idref=\"V-77201\" selected=\"true\" /><select idref=\"V-77205\" selected=\"true\" /><select idref=\"V-77209\" selected=\"true\" /><select idref=\"V-77213\" selected=\"true\" /><select idref=\"V-77217\" selected=\"true\" /><select idref=\"V-77221\" selected=\"true\" /><select idref=\"V-77223\" selected=\"true\" /><select idref=\"V-77227\" selected=\"true\" /><select idref=\"V-77231\" selected=\"true\" /><select idref=\"V-77233\" selected=\"true\" /><select idref=\"V-77235\" selected=\"true\" /><select idref=\"V-77239\" selected=\"true\" /><select idref=\"V-77243\" selected=\"true\" /><select idref=\"V-77245\" selected=\"true\" /><select idref=\"V-77247\" selected=\"true\" /><select idref=\"V-77249\" selected=\"true\" /><select idref=\"V-77255\" selected=\"true\" /><select idref=\"V-77259\" selected=\"true\" /><select idref=\"V-77263\" selected=\"true\" /><select idref=\"V-77267\" selected=\"true\" /><select idref=\"V-77269\" selected=\"true\" /><select idref=\"V-78129\" selected=\"true\" /><select idref=\"V-82137\" selected=\"true\" /><select idref=\"V-82139\" selected=\"true\" /><select idref=\"V-82145\" selected=\"true\" /><select idref=\"V-88203\" selected=\"true\" /><select idref=\"V-94719\" selected=\"true\" /><select idref=\"V-94859\" selected=\"true\" /><select idref=\"V-94861\" selected=\"true\" /><select idref=\"V-99541\" selected=\"true\" /><select idref=\"V-99543\" selected=\"true\" /><select idref=\"V-99545\" selected=\"true\" /><select idref=\"V-99547\" selected=\"true\" /><select idref=\"V-99549\" selected=\"true\" /><select idref=\"V-99551\" selected=\"true\" /><select idref=\"V-99553\" selected=\"true\" /><select idref=\"V-99555\" selected=\"true\" /><select idref=\"V-99557\" selected=\"true\" /><select idref=\"V-99559\" selected=\"true\" /><select idref=\"V-99561\" selected=\"true\" /><select idref=\"V-99563\" selected=\"true\" /><select idref=\"V-100093\" selected=\"true\" /><select idref=\"V-102611\" selected=\"true\" /><select idref=\"V-102617\" selected=\"true\" /><select idref=\"V-102627\" selected=\"true\" /></Profile><Profile id=\"MAC-1_Public\"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-63319\" selected=\"true\" /><select idref=\"V-63321\" selected=\"true\" /><select idref=\"V-63323\" selected=\"true\" /><select idref=\"V-63325\" selected=\"true\" /><select idref=\"V-63329\" selected=\"true\" /><select idref=\"V-63333\" selected=\"true\" /><select idref=\"V-63335\" selected=\"true\" /><select idref=\"V-63337\" selected=\"true\" /><select idref=\"V-63339\" selected=\"true\" /><select idref=\"V-63341\" selected=\"true\" /><select idref=\"V-63343\" selected=\"true\" /><select idref=\"V-63345\" selected=\"true\" /><select idref=\"V-63347\" selected=\"true\" /><select idref=\"V-63349\" selected=\"true\" /><select idref=\"V-63351\" selected=\"true\" /><select idref=\"V-63353\" selected=\"true\" /><select idref=\"V-63355\" selected=\"true\" /><select idref=\"V-63357\" selected=\"true\" /><select idref=\"V-63359\" selected=\"true\" /><select idref=\"V-63361\" selected=\"true\" /><select idref=\"V-63363\" selected=\"true\" /><select idref=\"V-63365\" selected=\"true\" /><select idref=\"V-63367\" selected=\"true\" /><select idref=\"V-63369\" selected=\"true\" /><select idref=\"V-63371\" selected=\"true\" /><select idref=\"V-63373\" selected=\"true\" /><select idref=\"V-63375\" selected=\"true\" /><select idref=\"V-63377\" selected=\"true\" /><select idref=\"V-63381\" selected=\"true\" /><select idref=\"V-63383\" selected=\"true\" /><select idref=\"V-63385\" selected=\"true\" /><select idref=\"V-63389\" selected=\"true\" /><select idref=\"V-63393\" selected=\"true\" /><select idref=\"V-63399\" selected=\"true\" /><select idref=\"V-63403\" selected=\"true\" /><select idref=\"V-63405\" selected=\"true\" /><select idref=\"V-63409\" selected=\"true\" /><select idref=\"V-63413\" selected=\"true\" /><select idref=\"V-63415\" selected=\"true\" /><select idref=\"V-63419\" selected=\"true\" /><select idref=\"V-63421\" selected=\"true\" /><select idref=\"V-63423\" selected=\"true\" /><select idref=\"V-63427\" selected=\"true\" /><select idref=\"V-63429\" selected=\"true\" /><select idref=\"V-63431\" selected=\"true\" /><select idref=\"V-63435\" selected=\"true\" /><select idref=\"V-63445\" selected=\"true\" /><select idref=\"V-63447\" selected=\"true\" /><select idref=\"V-63449\" selected=\"true\" /><select idref=\"V-63451\" selected=\"true\" /><select idref=\"V-63453\" selected=\"true\" /><select idref=\"V-63457\" selected=\"true\" /><select idref=\"V-63459\" selected=\"true\" /><select idref=\"V-63463\" selected=\"true\" /><select idref=\"V-63467\" selected=\"true\" /><select idref=\"V-63469\" selected=\"true\" /><select idref=\"V-63471\" selected=\"true\" /><select idref=\"V-63473\" selected=\"true\" /><select idref=\"V-63479\" selected=\"true\" /><select idref=\"V-63481\" selected=\"true\" /><select idref=\"V-63483\" selected=\"true\" /><select idref=\"V-63487\" selected=\"true\" /><select idref=\"V-63491\" selected=\"true\" /><select idref=\"V-63499\" selected=\"true\" /><select idref=\"V-63503\" selected=\"true\" /><select idref=\"V-63507\" selected=\"true\" /><select idref=\"V-63513\" selected=\"true\" /><select idref=\"V-63515\" selected=\"true\" /><select idref=\"V-63517\" selected=\"true\" /><select idref=\"V-63519\" selected=\"true\" /><select idref=\"V-63523\" selected=\"true\" /><select idref=\"V-63527\" selected=\"true\" /><select idref=\"V-63533\" selected=\"true\" /><select idref=\"V-63537\" selected=\"true\" /><select idref=\"V-63541\" selected=\"true\" /><select idref=\"V-63545\" selected=\"true\" /><select idref=\"V-63549\" selected=\"true\" /><select idref=\"V-63555\" selected=\"true\" /><select idref=\"V-63559\" selected=\"true\" /><select idref=\"V-63563\" selected=\"true\" /><select idref=\"V-63567\" selected=\"true\" /><select idref=\"V-63569\" selected=\"true\" /><select idref=\"V-63577\" selected=\"true\" /><select idref=\"V-63579\" selected=\"true\" /><select idref=\"V-63581\" selected=\"true\" /><select idref=\"V-63583\" selected=\"true\" /><select idref=\"V-63585\" selected=\"true\" /><select idref=\"V-63587\" selected=\"true\" /><select idref=\"V-63589\" selected=\"true\" /><select idref=\"V-63591\" selected=\"true\" /><select idref=\"V-63593\" selected=\"true\" /><select idref=\"V-63595\" selected=\"true\" /><select idref=\"V-63597\" selected=\"true\" /><select idref=\"V-63599\" selected=\"true\" /><select idref=\"V-63601\" selected=\"true\" /><select idref=\"V-63607\" selected=\"true\" /><select idref=\"V-63609\" selected=\"true\" /><select idref=\"V-63611\" selected=\"true\" /><select idref=\"V-63615\" selected=\"true\" /><select idref=\"V-63617\" selected=\"true\" /><select idref=\"V-63619\" selected=\"true\" /><select idref=\"V-63621\" selected=\"true\" /><select idref=\"V-63623\" selected=\"true\" /><select idref=\"V-63625\" selected=\"true\" /><select idref=\"V-63627\" selected=\"true\" /><select idref=\"V-63629\" selected=\"true\" /><select idref=\"V-63633\" selected=\"true\" /><select idref=\"V-63635\" selected=\"true\" /><select idref=\"V-63639\" selected=\"true\" /><select idref=\"V-63643\" selected=\"true\" /><select idref=\"V-63645\" selected=\"true\" /><select idref=\"V-63647\" selected=\"true\" /><select idref=\"V-63649\" selected=\"true\" /><select idref=\"V-63651\" selected=\"true\" /><select idref=\"V-63653\" selected=\"true\" /><select idref=\"V-63657\" selected=\"true\" /><select idref=\"V-63659\" selected=\"true\" /><select idref=\"V-63661\" selected=\"true\" /><select idref=\"V-63663\" selected=\"true\" /><select idref=\"V-63665\" selected=\"true\" /><select idref=\"V-63667\" selected=\"true\" /><select idref=\"V-63669\" selected=\"true\" /><select idref=\"V-63671\" selected=\"true\" /><select idref=\"V-63673\" selected=\"true\" /><select idref=\"V-63675\" selected=\"true\" /><select idref=\"V-63677\" selected=\"true\" /><select idref=\"V-63679\" selected=\"true\" /><select idref=\"V-63681\" selected=\"true\" /><select idref=\"V-63683\" selected=\"true\" /><select idref=\"V-63685\" selected=\"true\" /><select idref=\"V-63687\" selected=\"true\" /><select idref=\"V-63689\" selected=\"true\" /><select idref=\"V-63691\" selected=\"true\" /><select idref=\"V-63695\" selected=\"true\" /><select idref=\"V-63697\" selected=\"true\" /><select idref=\"V-63699\" selected=\"true\" /><select idref=\"V-63701\" selected=\"true\" /><select idref=\"V-63703\" selected=\"true\" /><select idref=\"V-63709\" selected=\"true\" /><select idref=\"V-63711\" selected=\"true\" /><select idref=\"V-63713\" selected=\"true\" /><select idref=\"V-63717\" selected=\"true\" /><select idref=\"V-63719\" selected=\"true\" /><select idref=\"V-63721\" selected=\"true\" /><select idref=\"V-63729\" selected=\"true\" /><select idref=\"V-63731\" selected=\"true\" /><select idref=\"V-63733\" selected=\"true\" /><select idref=\"V-63737\" selected=\"true\" /><select idref=\"V-63739\" selected=\"true\" /><select idref=\"V-63741\" selected=\"true\" /><select idref=\"V-63743\" selected=\"true\" /><select idref=\"V-63745\" selected=\"true\" /><select idref=\"V-63747\" selected=\"true\" /><select idref=\"V-63749\" selected=\"true\" /><select idref=\"V-63751\" selected=\"true\" /><select idref=\"V-63755\" selected=\"true\" /><select idref=\"V-63759\" selected=\"true\" /><select idref=\"V-63765\" selected=\"true\" /><select idref=\"V-63767\" selected=\"true\" /><select idref=\"V-63795\" selected=\"true\" /><select idref=\"V-63797\" selected=\"true\" /><select idref=\"V-63801\" selected=\"true\" /><select idref=\"V-63803\" selected=\"true\" /><select idref=\"V-63805\" selected=\"true\" /><select idref=\"V-63807\" selected=\"true\" /><select idref=\"V-63811\" selected=\"true\" /><select idref=\"V-63815\" selected=\"true\" /><select idref=\"V-63817\" selected=\"true\" /><select idref=\"V-63819\" selected=\"true\" /><select idref=\"V-63821\" selected=\"true\" /><select idref=\"V-63825\" selected=\"true\" /><select idref=\"V-63827\" selected=\"true\" /><select idref=\"V-63829\" selected=\"true\" /><select idref=\"V-63831\" selected=\"true\" /><select idref=\"V-63839\" selected=\"true\" /><select idref=\"V-63841\" selected=\"true\" /><select idref=\"V-63843\" selected=\"true\" /><select idref=\"V-63845\" selected=\"true\" /><select idref=\"V-63847\" selected=\"true\" /><select idref=\"V-63851\" selected=\"true\" /><select idref=\"V-63853\" selected=\"true\" /><select idref=\"V-63855\" selected=\"true\" /><select idref=\"V-63857\" selected=\"true\" /><select idref=\"V-63859\" selected=\"true\" /><select idref=\"V-63861\" selected=\"true\" /><select idref=\"V-63863\" selected=\"true\" /><select idref=\"V-63865\" selected=\"true\" /><select idref=\"V-63869\" selected=\"true\" /><select idref=\"V-63871\" selected=\"true\" /><select idref=\"V-63873\" selected=\"true\" /><select idref=\"V-63875\" selected=\"true\" /><select idref=\"V-63877\" selected=\"true\" /><select idref=\"V-63879\" selected=\"true\" /><select idref=\"V-63881\" selected=\"true\" /><select idref=\"V-63883\" selected=\"true\" /><select idref=\"V-63889\" selected=\"true\" /><select idref=\"V-63917\" selected=\"true\" /><select idref=\"V-63925\" selected=\"true\" /><select idref=\"V-63927\" selected=\"true\" /><select idref=\"V-63931\" selected=\"true\" /><select idref=\"V-63933\" selected=\"true\" /><select idref=\"V-63935\" selected=\"true\" /><select idref=\"V-63939\" selected=\"true\" /><select idref=\"V-63941\" selected=\"true\" /><select idref=\"V-65681\" selected=\"true\" /><select idref=\"V-68817\" selected=\"true\" /><select idref=\"V-68819\" selected=\"true\" /><select idref=\"V-68845\" selected=\"true\" /><select idref=\"V-68849\" selected=\"true\" /><select idref=\"V-70637\" selected=\"true\" /><select idref=\"V-70639\" selected=\"true\" /><select idref=\"V-71759\" selected=\"true\" /><select idref=\"V-71761\" selected=\"true\" /><select idref=\"V-71763\" selected=\"true\" /><select idref=\"V-71765\" selected=\"true\" /><select idref=\"V-71769\" selected=\"true\" /><select idref=\"V-71771\" selected=\"true\" /><select idref=\"V-72329\" selected=\"true\" /><select idref=\"V-72765\" selected=\"true\" /><select idref=\"V-72767\" selected=\"true\" /><select idref=\"V-72769\" selected=\"true\" /><select idref=\"V-74409\" selected=\"true\" /><select idref=\"V-74411\" selected=\"true\" /><select idref=\"V-74413\" selected=\"true\" /><select idref=\"V-74417\" selected=\"true\" /><select idref=\"V-74699\" selected=\"true\" /><select idref=\"V-74719\" selected=\"true\" /><select idref=\"V-74721\" selected=\"true\" /><select idref=\"V-74723\" selected=\"true\" /><select idref=\"V-74725\" selected=\"true\" /><select idref=\"V-75027\" selected=\"true\" /><select idref=\"V-76505\" selected=\"true\" /><select idref=\"V-77083\" selected=\"true\" /><select idref=\"V-77085\" selected=\"true\" /><select idref=\"V-77091\" selected=\"true\" /><select idref=\"V-77095\" selected=\"true\" /><select idref=\"V-77097\" selected=\"true\" /><select idref=\"V-77101\" selected=\"true\" /><select idref=\"V-77103\" selected=\"true\" /><select idref=\"V-77189\" selected=\"true\" /><select idref=\"V-77191\" selected=\"true\" /><select idref=\"V-77195\" selected=\"true\" /><select idref=\"V-77201\" selected=\"true\" /><select idref=\"V-77205\" selected=\"true\" /><select idref=\"V-77209\" selected=\"true\" /><select idref=\"V-77213\" selected=\"true\" /><select idref=\"V-77217\" selected=\"true\" /><select idref=\"V-77221\" selected=\"true\" /><select idref=\"V-77223\" selected=\"true\" /><select idref=\"V-77227\" selected=\"true\" /><select idref=\"V-77231\" selected=\"true\" /><select idref=\"V-77233\" selected=\"true\" /><select idref=\"V-77235\" selected=\"true\" /><select idref=\"V-77239\" selected=\"true\" /><select idref=\"V-77243\" selected=\"true\" /><select idref=\"V-77245\" selected=\"true\" /><select idref=\"V-77247\" selected=\"true\" /><select idref=\"V-77249\" selected=\"true\" /><select idref=\"V-77255\" selected=\"true\" /><select idref=\"V-77259\" selected=\"true\" /><select idref=\"V-77263\" selected=\"true\" /><select idref=\"V-77267\" selected=\"true\" /><select idref=\"V-77269\" selected=\"true\" /><select idref=\"V-78129\" selected=\"true\" /><select idref=\"V-82137\" selected=\"true\" /><select idref=\"V-82139\" selected=\"true\" /><select idref=\"V-82145\" selected=\"true\" /><select idref=\"V-88203\" selected=\"true\" /><select idref=\"V-94719\" selected=\"true\" /><select idref=\"V-94859\" selected=\"true\" /><select idref=\"V-94861\" selected=\"true\" /><select idref=\"V-99541\" selected=\"true\" /><select idref=\"V-99543\" selected=\"true\" /><select idref=\"V-99545\" selected=\"true\" /><select idref=\"V-99547\" selected=\"true\" /><select idref=\"V-99549\" selected=\"true\" /><select idref=\"V-99551\" selected=\"true\" /><select idref=\"V-99553\" selected=\"true\" /><select idref=\"V-99555\" selected=\"true\" /><select idref=\"V-99557\" selected=\"true\" /><select idref=\"V-99559\" selected=\"true\" /><select idref=\"V-99561\" selected=\"true\" /><select idref=\"V-99563\" selected=\"true\" /><select idref=\"V-100093\" selected=\"true\" /><select idref=\"V-102611\" selected=\"true\" /><select idref=\"V-102617\" selected=\"true\" /><select idref=\"V-102627\" selected=\"true\" /></Profile><Profile id=\"MAC-1_Sensitive\"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-63319\" selected=\"true\" /><select idref=\"V-63321\" selected=\"true\" /><select idref=\"V-63323\" selected=\"true\" /><select idref=\"V-63325\" selected=\"true\" /><select idref=\"V-63329\" selected=\"true\" /><select idref=\"V-63333\" selected=\"true\" /><select idref=\"V-63335\" selected=\"true\" /><select idref=\"V-63337\" selected=\"true\" /><select idref=\"V-63339\" selected=\"true\" /><select idref=\"V-63341\" selected=\"true\" /><select idref=\"V-63343\" selected=\"true\" /><select idref=\"V-63345\" selected=\"true\" /><select idref=\"V-63347\" selected=\"true\" /><select idref=\"V-63349\" selected=\"true\" /><select idref=\"V-63351\" selected=\"true\" /><select idref=\"V-63353\" selected=\"true\" /><select idref=\"V-63355\" selected=\"true\" /><select idref=\"V-63357\" selected=\"true\" /><select idref=\"V-63359\" selected=\"true\" /><select idref=\"V-63361\" selected=\"true\" /><select idref=\"V-63363\" selected=\"true\" /><select idref=\"V-63365\" selected=\"true\" /><select idref=\"V-63367\" selected=\"true\" /><select idref=\"V-63369\" selected=\"true\" /><select idref=\"V-63371\" selected=\"true\" /><select idref=\"V-63373\" selected=\"true\" /><select idref=\"V-63375\" selected=\"true\" /><select idref=\"V-63377\" selected=\"true\" /><select idref=\"V-63381\" selected=\"true\" /><select idref=\"V-63383\" selected=\"true\" /><select idref=\"V-63385\" selected=\"true\" /><select idref=\"V-63389\" selected=\"true\" /><select idref=\"V-63393\" selected=\"true\" /><select idref=\"V-63399\" selected=\"true\" /><select idref=\"V-63403\" selected=\"true\" /><select idref=\"V-63405\" selected=\"true\" /><select idref=\"V-63409\" selected=\"true\" /><select idref=\"V-63413\" selected=\"true\" /><select idref=\"V-63415\" selected=\"true\" /><select idref=\"V-63419\" selected=\"true\" /><select idref=\"V-63421\" selected=\"true\" /><select idref=\"V-63423\" selected=\"true\" /><select idref=\"V-63427\" selected=\"true\" /><select idref=\"V-63429\" selected=\"true\" /><select idref=\"V-63431\" selected=\"true\" /><select idref=\"V-63435\" selected=\"true\" /><select idref=\"V-63445\" selected=\"true\" /><select idref=\"V-63447\" selected=\"true\" /><select idref=\"V-63449\" selected=\"true\" /><select idref=\"V-63451\" selected=\"true\" /><select idref=\"V-63453\" selected=\"true\" /><select idref=\"V-63457\" selected=\"true\" /><select idref=\"V-63459\" selected=\"true\" /><select idref=\"V-63463\" selected=\"true\" /><select idref=\"V-63467\" selected=\"true\" /><select idref=\"V-63469\" selected=\"true\" /><select idref=\"V-63471\" selected=\"true\" /><select idref=\"V-63473\" selected=\"true\" /><select idref=\"V-63479\" selected=\"true\" /><select idref=\"V-63481\" selected=\"true\" /><select idref=\"V-63483\" selected=\"true\" /><select idref=\"V-63487\" selected=\"true\" /><select idref=\"V-63491\" selected=\"true\" /><select idref=\"V-63499\" selected=\"true\" /><select idref=\"V-63503\" selected=\"true\" /><select idref=\"V-63507\" selected=\"true\" /><select idref=\"V-63513\" selected=\"true\" /><select idref=\"V-63515\" selected=\"true\" /><select idref=\"V-63517\" selected=\"true\" /><select idref=\"V-63519\" selected=\"true\" /><select idref=\"V-63523\" selected=\"true\" /><select idref=\"V-63527\" selected=\"true\" /><select idref=\"V-63533\" selected=\"true\" /><select idref=\"V-63537\" selected=\"true\" /><select idref=\"V-63541\" selected=\"true\" /><select idref=\"V-63545\" selected=\"true\" /><select idref=\"V-63549\" selected=\"true\" /><select idref=\"V-63555\" selected=\"true\" /><select idref=\"V-63559\" selected=\"true\" /><select idref=\"V-63563\" selected=\"true\" /><select idref=\"V-63567\" selected=\"true\" /><select idref=\"V-63569\" selected=\"true\" /><select idref=\"V-63577\" selected=\"true\" /><select idref=\"V-63579\" selected=\"true\" /><select idref=\"V-63581\" selected=\"true\" /><select idref=\"V-63583\" selected=\"true\" /><select idref=\"V-63585\" selected=\"true\" /><select idref=\"V-63587\" selected=\"true\" /><select idref=\"V-63589\" selected=\"true\" /><select idref=\"V-63591\" selected=\"true\" /><select idref=\"V-63593\" selected=\"true\" /><select idref=\"V-63595\" selected=\"true\" /><select idref=\"V-63597\" selected=\"true\" /><select idref=\"V-63599\" selected=\"true\" /><select idref=\"V-63601\" selected=\"true\" /><select idref=\"V-63607\" selected=\"true\" /><select idref=\"V-63609\" selected=\"true\" /><select idref=\"V-63611\" selected=\"true\" /><select idref=\"V-63615\" selected=\"true\" /><select idref=\"V-63617\" selected=\"true\" /><select idref=\"V-63619\" selected=\"true\" /><select idref=\"V-63621\" selected=\"true\" /><select idref=\"V-63623\" selected=\"true\" /><select idref=\"V-63625\" selected=\"true\" /><select idref=\"V-63627\" selected=\"true\" /><select idref=\"V-63629\" selected=\"true\" /><select idref=\"V-63633\" selected=\"true\" /><select idref=\"V-63635\" selected=\"true\" /><select idref=\"V-63639\" selected=\"true\" /><select idref=\"V-63643\" selected=\"true\" /><select idref=\"V-63645\" selected=\"true\" /><select idref=\"V-63647\" selected=\"true\" /><select idref=\"V-63649\" selected=\"true\" /><select idref=\"V-63651\" selected=\"true\" /><select idref=\"V-63653\" selected=\"true\" /><select idref=\"V-63657\" selected=\"true\" /><select idref=\"V-63659\" selected=\"true\" /><select idref=\"V-63661\" selected=\"true\" /><select idref=\"V-63663\" selected=\"true\" /><select idref=\"V-63665\" selected=\"true\" /><select idref=\"V-63667\" selected=\"true\" /><select idref=\"V-63669\" selected=\"true\" /><select idref=\"V-63671\" selected=\"true\" /><select idref=\"V-63673\" selected=\"true\" /><select idref=\"V-63675\" selected=\"true\" /><select idref=\"V-63677\" selected=\"true\" /><select idref=\"V-63679\" selected=\"true\" /><select idref=\"V-63681\" selected=\"true\" /><select idref=\"V-63683\" selected=\"true\" /><select idref=\"V-63685\" selected=\"true\" /><select idref=\"V-63687\" selected=\"true\" /><select idref=\"V-63689\" selected=\"true\" /><select idref=\"V-63691\" selected=\"true\" /><select idref=\"V-63695\" selected=\"true\" /><select idref=\"V-63697\" selected=\"true\" /><select idref=\"V-63699\" selected=\"true\" /><select idref=\"V-63701\" selected=\"true\" /><select idref=\"V-63703\" selected=\"true\" /><select idref=\"V-63709\" selected=\"true\" /><select idref=\"V-63711\" selected=\"true\" /><select idref=\"V-63713\" selected=\"true\" /><select idref=\"V-63717\" selected=\"true\" /><select idref=\"V-63719\" selected=\"true\" /><select idref=\"V-63721\" selected=\"true\" /><select idref=\"V-63729\" selected=\"true\" /><select idref=\"V-63731\" selected=\"true\" /><select idref=\"V-63733\" selected=\"true\" /><select idref=\"V-63737\" selected=\"true\" /><select idref=\"V-63739\" selected=\"true\" /><select idref=\"V-63741\" selected=\"true\" /><select idref=\"V-63743\" selected=\"true\" /><select idref=\"V-63745\" selected=\"true\" /><select idref=\"V-63747\" selected=\"true\" /><select idref=\"V-63749\" selected=\"true\" /><select idref=\"V-63751\" selected=\"true\" /><select idref=\"V-63755\" selected=\"true\" /><select idref=\"V-63759\" selected=\"true\" /><select idref=\"V-63765\" selected=\"true\" /><select idref=\"V-63767\" selected=\"true\" /><select idref=\"V-63795\" selected=\"true\" /><select idref=\"V-63797\" selected=\"true\" /><select idref=\"V-63801\" selected=\"true\" /><select idref=\"V-63803\" selected=\"true\" /><select idref=\"V-63805\" selected=\"true\" /><select idref=\"V-63807\" selected=\"true\" /><select idref=\"V-63811\" selected=\"true\" /><select idref=\"V-63815\" selected=\"true\" /><select idref=\"V-63817\" selected=\"true\" /><select idref=\"V-63819\" selected=\"true\" /><select idref=\"V-63821\" selected=\"true\" /><select idref=\"V-63825\" selected=\"true\" /><select idref=\"V-63827\" selected=\"true\" /><select idref=\"V-63829\" selected=\"true\" /><select idref=\"V-63831\" selected=\"true\" /><select idref=\"V-63839\" selected=\"true\" /><select idref=\"V-63841\" selected=\"true\" /><select idref=\"V-63843\" selected=\"true\" /><select idref=\"V-63845\" selected=\"true\" /><select idref=\"V-63847\" selected=\"true\" /><select idref=\"V-63851\" selected=\"true\" /><select idref=\"V-63853\" selected=\"true\" /><select idref=\"V-63855\" selected=\"true\" /><select idref=\"V-63857\" selected=\"true\" /><select idref=\"V-63859\" selected=\"true\" /><select idref=\"V-63861\" selected=\"true\" /><select idref=\"V-63863\" selected=\"true\" /><select idref=\"V-63865\" selected=\"true\" /><select idref=\"V-63869\" selected=\"true\" /><select idref=\"V-63871\" selected=\"true\" /><select idref=\"V-63873\" selected=\"true\" /><select idref=\"V-63875\" selected=\"true\" /><select idref=\"V-63877\" selected=\"true\" /><select idref=\"V-63879\" selected=\"true\" /><select idref=\"V-63881\" selected=\"true\" /><select idref=\"V-63883\" selected=\"true\" /><select idref=\"V-63889\" selected=\"true\" /><select idref=\"V-63917\" selected=\"true\" /><select idref=\"V-63925\" selected=\"true\" /><select idref=\"V-63927\" selected=\"true\" /><select idref=\"V-63931\" selected=\"true\" /><select idref=\"V-63933\" selected=\"true\" /><select idref=\"V-63935\" selected=\"true\" /><select idref=\"V-63939\" selected=\"true\" /><select idref=\"V-63941\" selected=\"true\" /><select idref=\"V-65681\" selected=\"true\" /><select idref=\"V-68817\" selected=\"true\" /><select idref=\"V-68819\" selected=\"true\" /><select idref=\"V-68845\" selected=\"true\" /><select idref=\"V-68849\" selected=\"true\" /><select idref=\"V-70637\" selected=\"true\" /><select idref=\"V-70639\" selected=\"true\" /><select idref=\"V-71759\" selected=\"true\" /><select idref=\"V-71761\" selected=\"true\" /><select idref=\"V-71763\" selected=\"true\" /><select idref=\"V-71765\" selected=\"true\" /><select idref=\"V-71769\" selected=\"true\" /><select idref=\"V-71771\" selected=\"true\" /><select idref=\"V-72329\" selected=\"true\" /><select idref=\"V-72765\" selected=\"true\" /><select idref=\"V-72767\" selected=\"true\" /><select idref=\"V-72769\" selected=\"true\" /><select idref=\"V-74409\" selected=\"true\" /><select idref=\"V-74411\" selected=\"true\" /><select idref=\"V-74413\" selected=\"true\" /><select idref=\"V-74417\" selected=\"true\" /><select idref=\"V-74699\" selected=\"true\" /><select idref=\"V-74719\" selected=\"true\" /><select idref=\"V-74721\" selected=\"true\" /><select idref=\"V-74723\" selected=\"true\" /><select idref=\"V-74725\" selected=\"true\" /><select idref=\"V-75027\" selected=\"true\" /><select idref=\"V-76505\" selected=\"true\" /><select idref=\"V-77083\" selected=\"true\" /><select idref=\"V-77085\" selected=\"true\" /><select idref=\"V-77091\" selected=\"true\" /><select idref=\"V-77095\" selected=\"true\" /><select idref=\"V-77097\" selected=\"true\" /><select idref=\"V-77101\" selected=\"true\" /><select idref=\"V-77103\" selected=\"true\" /><select idref=\"V-77189\" selected=\"true\" /><select idref=\"V-77191\" selected=\"true\" /><select idref=\"V-77195\" selected=\"true\" /><select idref=\"V-77201\" selected=\"true\" /><select idref=\"V-77205\" selected=\"true\" /><select idref=\"V-77209\" selected=\"true\" /><select idref=\"V-77213\" selected=\"true\" /><select idref=\"V-77217\" selected=\"true\" /><select idref=\"V-77221\" selected=\"true\" /><select idref=\"V-77223\" selected=\"true\" /><select idref=\"V-77227\" selected=\"true\" /><select idref=\"V-77231\" selected=\"true\" /><select idref=\"V-77233\" selected=\"true\" /><select idref=\"V-77235\" selected=\"true\" /><select idref=\"V-77239\" selected=\"true\" /><select idref=\"V-77243\" selected=\"true\" /><select idref=\"V-77245\" selected=\"true\" /><select idref=\"V-77247\" selected=\"true\" /><select idref=\"V-77249\" selected=\"true\" /><select idref=\"V-77255\" selected=\"true\" /><select idref=\"V-77259\" selected=\"true\" /><select idref=\"V-77263\" selected=\"true\" /><select idref=\"V-77267\" selected=\"true\" /><select idref=\"V-77269\" selected=\"true\" /><select idref=\"V-78129\" selected=\"true\" /><select idref=\"V-82137\" selected=\"true\" /><select idref=\"V-82139\" selected=\"true\" /><select idref=\"V-82145\" selected=\"true\" /><select idref=\"V-88203\" selected=\"true\" /><select idref=\"V-94719\" selected=\"true\" /><select idref=\"V-94859\" selected=\"true\" /><select idref=\"V-94861\" selected=\"true\" /><select idref=\"V-99541\" selected=\"true\" /><select idref=\"V-99543\" selected=\"true\" /><select idref=\"V-99545\" selected=\"true\" /><select idref=\"V-99547\" selected=\"true\" /><select idref=\"V-99549\" selected=\"true\" /><select idref=\"V-99551\" selected=\"true\" /><select idref=\"V-99553\" selected=\"true\" /><select idref=\"V-99555\" selected=\"true\" /><select idref=\"V-99557\" selected=\"true\" /><select idref=\"V-99559\" selected=\"true\" /><select idref=\"V-99561\" selected=\"true\" /><select idref=\"V-99563\" selected=\"true\" /><select idref=\"V-100093\" selected=\"true\" /><select idref=\"V-102611\" selected=\"true\" /><select idref=\"V-102617\" selected=\"true\" /><select idref=\"V-102627\" selected=\"true\" /></Profile><Profile id=\"MAC-2_Classified\"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-63319\" selected=\"true\" /><select idref=\"V-63321\" selected=\"true\" /><select idref=\"V-63323\" selected=\"true\" /><select idref=\"V-63325\" selected=\"true\" /><select idref=\"V-63329\" selected=\"true\" /><select idref=\"V-63333\" selected=\"true\" /><select idref=\"V-63335\" selected=\"true\" /><select idref=\"V-63337\" selected=\"true\" /><select idref=\"V-63339\" selected=\"true\" /><select idref=\"V-63341\" selected=\"true\" /><select idref=\"V-63343\" selected=\"true\" /><select idref=\"V-63345\" selected=\"true\" /><select idref=\"V-63347\" selected=\"true\" /><select idref=\"V-63349\" selected=\"true\" /><select idref=\"V-63351\" selected=\"true\" /><select idref=\"V-63353\" selected=\"true\" /><select idref=\"V-63355\" selected=\"true\" /><select idref=\"V-63357\" selected=\"true\" /><select idref=\"V-63359\" selected=\"true\" /><select idref=\"V-63361\" selected=\"true\" /><select idref=\"V-63363\" selected=\"true\" /><select idref=\"V-63365\" selected=\"true\" /><select idref=\"V-63367\" selected=\"true\" /><select idref=\"V-63369\" selected=\"true\" /><select idref=\"V-63371\" selected=\"true\" /><select idref=\"V-63373\" selected=\"true\" /><select idref=\"V-63375\" selected=\"true\" /><select idref=\"V-63377\" selected=\"true\" /><select idref=\"V-63381\" selected=\"true\" /><select idref=\"V-63383\" selected=\"true\" /><select idref=\"V-63385\" selected=\"true\" /><select idref=\"V-63389\" selected=\"true\" /><select idref=\"V-63393\" selected=\"true\" /><select idref=\"V-63399\" selected=\"true\" /><select idref=\"V-63403\" selected=\"true\" /><select idref=\"V-63405\" selected=\"true\" /><select idref=\"V-63409\" selected=\"true\" /><select idref=\"V-63413\" selected=\"true\" /><select idref=\"V-63415\" selected=\"true\" /><select idref=\"V-63419\" selected=\"true\" /><select idref=\"V-63421\" selected=\"true\" /><select idref=\"V-63423\" selected=\"true\" /><select idref=\"V-63427\" selected=\"true\" /><select idref=\"V-63429\" selected=\"true\" /><select idref=\"V-63431\" selected=\"true\" /><select idref=\"V-63435\" selected=\"true\" /><select idref=\"V-63445\" selected=\"true\" /><select idref=\"V-63447\" selected=\"true\" /><select idref=\"V-63449\" selected=\"true\" /><select idref=\"V-63451\" selected=\"true\" /><select idref=\"V-63453\" selected=\"true\" /><select idref=\"V-63457\" selected=\"true\" /><select idref=\"V-63459\" selected=\"true\" /><select idref=\"V-63463\" selected=\"true\" /><select idref=\"V-63467\" selected=\"true\" /><select idref=\"V-63469\" selected=\"true\" /><select idref=\"V-63471\" selected=\"true\" /><select idref=\"V-63473\" selected=\"true\" /><select idref=\"V-63479\" selected=\"true\" /><select idref=\"V-63481\" selected=\"true\" /><select idref=\"V-63483\" selected=\"true\" /><select idref=\"V-63487\" selected=\"true\" /><select idref=\"V-63491\" selected=\"true\" /><select idref=\"V-63499\" selected=\"true\" /><select idref=\"V-63503\" selected=\"true\" /><select idref=\"V-63507\" selected=\"true\" /><select idref=\"V-63513\" selected=\"true\" /><select idref=\"V-63515\" selected=\"true\" /><select idref=\"V-63517\" selected=\"true\" /><select idref=\"V-63519\" selected=\"true\" /><select idref=\"V-63523\" selected=\"true\" /><select idref=\"V-63527\" selected=\"true\" /><select idref=\"V-63533\" selected=\"true\" /><select idref=\"V-63537\" selected=\"true\" /><select idref=\"V-63541\" selected=\"true\" /><select idref=\"V-63545\" selected=\"true\" /><select idref=\"V-63549\" selected=\"true\" /><select idref=\"V-63555\" selected=\"true\" /><select idref=\"V-63559\" selected=\"true\" /><select idref=\"V-63563\" selected=\"true\" /><select idref=\"V-63567\" selected=\"true\" /><select idref=\"V-63569\" selected=\"true\" /><select idref=\"V-63577\" selected=\"true\" /><select idref=\"V-63579\" selected=\"true\" /><select idref=\"V-63581\" selected=\"true\" /><select idref=\"V-63583\" selected=\"true\" /><select idref=\"V-63585\" selected=\"true\" /><select idref=\"V-63587\" selected=\"true\" /><select idref=\"V-63589\" selected=\"true\" /><select idref=\"V-63591\" selected=\"true\" /><select idref=\"V-63593\" selected=\"true\" /><select idref=\"V-63595\" selected=\"true\" /><select idref=\"V-63597\" selected=\"true\" /><select idref=\"V-63599\" selected=\"true\" /><select idref=\"V-63601\" selected=\"true\" /><select idref=\"V-63607\" selected=\"true\" /><select idref=\"V-63609\" selected=\"true\" /><select idref=\"V-63611\" selected=\"true\" /><select idref=\"V-63615\" selected=\"true\" /><select idref=\"V-63617\" selected=\"true\" /><select idref=\"V-63619\" selected=\"true\" /><select idref=\"V-63621\" selected=\"true\" /><select idref=\"V-63623\" selected=\"true\" /><select idref=\"V-63625\" selected=\"true\" /><select idref=\"V-63627\" selected=\"true\" /><select idref=\"V-63629\" selected=\"true\" /><select idref=\"V-63633\" selected=\"true\" /><select idref=\"V-63635\" selected=\"true\" /><select idref=\"V-63639\" selected=\"true\" /><select idref=\"V-63643\" selected=\"true\" /><select idref=\"V-63645\" selected=\"true\" /><select idref=\"V-63647\" selected=\"true\" /><select idref=\"V-63649\" selected=\"true\" /><select idref=\"V-63651\" selected=\"true\" /><select idref=\"V-63653\" selected=\"true\" /><select idref=\"V-63657\" selected=\"true\" /><select idref=\"V-63659\" selected=\"true\" /><select idref=\"V-63661\" selected=\"true\" /><select idref=\"V-63663\" selected=\"true\" /><select idref=\"V-63665\" selected=\"true\" /><select idref=\"V-63667\" selected=\"true\" /><select idref=\"V-63669\" selected=\"true\" /><select idref=\"V-63671\" selected=\"true\" /><select idref=\"V-63673\" selected=\"true\" /><select idref=\"V-63675\" selected=\"true\" /><select idref=\"V-63677\" selected=\"true\" /><select idref=\"V-63679\" selected=\"true\" /><select idref=\"V-63681\" selected=\"true\" /><select idref=\"V-63683\" selected=\"true\" /><select idref=\"V-63685\" selected=\"true\" /><select idref=\"V-63687\" selected=\"true\" /><select idref=\"V-63689\" selected=\"true\" /><select idref=\"V-63691\" selected=\"true\" /><select idref=\"V-63695\" selected=\"true\" /><select idref=\"V-63697\" selected=\"true\" /><select idref=\"V-63699\" selected=\"true\" /><select idref=\"V-63701\" selected=\"true\" /><select idref=\"V-63703\" selected=\"true\" /><select idref=\"V-63709\" selected=\"true\" /><select idref=\"V-63711\" selected=\"true\" /><select idref=\"V-63713\" selected=\"true\" /><select idref=\"V-63717\" selected=\"true\" /><select idref=\"V-63719\" selected=\"true\" /><select idref=\"V-63721\" selected=\"true\" /><select idref=\"V-63729\" selected=\"true\" /><select idref=\"V-63731\" selected=\"true\" /><select idref=\"V-63733\" selected=\"true\" /><select idref=\"V-63737\" selected=\"true\" /><select idref=\"V-63739\" selected=\"true\" /><select idref=\"V-63741\" selected=\"true\" /><select idref=\"V-63743\" selected=\"true\" /><select idref=\"V-63745\" selected=\"true\" /><select idref=\"V-63747\" selected=\"true\" /><select idref=\"V-63749\" selected=\"true\" /><select idref=\"V-63751\" selected=\"true\" /><select idref=\"V-63755\" selected=\"true\" /><select idref=\"V-63759\" selected=\"true\" /><select idref=\"V-63765\" selected=\"true\" /><select idref=\"V-63767\" selected=\"true\" /><select idref=\"V-63795\" selected=\"true\" /><select idref=\"V-63797\" selected=\"true\" /><select idref=\"V-63801\" selected=\"true\" /><select idref=\"V-63803\" selected=\"true\" /><select idref=\"V-63805\" selected=\"true\" /><select idref=\"V-63807\" selected=\"true\" /><select idref=\"V-63811\" selected=\"true\" /><select idref=\"V-63815\" selected=\"true\" /><select idref=\"V-63817\" selected=\"true\" /><select idref=\"V-63819\" selected=\"true\" /><select idref=\"V-63821\" selected=\"true\" /><select idref=\"V-63825\" selected=\"true\" /><select idref=\"V-63827\" selected=\"true\" /><select idref=\"V-63829\" selected=\"true\" /><select idref=\"V-63831\" selected=\"true\" /><select idref=\"V-63839\" selected=\"true\" /><select idref=\"V-63841\" selected=\"true\" /><select idref=\"V-63843\" selected=\"true\" /><select idref=\"V-63845\" selected=\"true\" /><select idref=\"V-63847\" selected=\"true\" /><select idref=\"V-63851\" selected=\"true\" /><select idref=\"V-63853\" selected=\"true\" /><select idref=\"V-63855\" selected=\"true\" /><select idref=\"V-63857\" selected=\"true\" /><select idref=\"V-63859\" selected=\"true\" /><select idref=\"V-63861\" selected=\"true\" /><select idref=\"V-63863\" selected=\"true\" /><select idref=\"V-63865\" selected=\"true\" /><select idref=\"V-63869\" selected=\"true\" /><select idref=\"V-63871\" selected=\"true\" /><select idref=\"V-63873\" selected=\"true\" /><select idref=\"V-63875\" selected=\"true\" /><select idref=\"V-63877\" selected=\"true\" /><select idref=\"V-63879\" selected=\"true\" /><select idref=\"V-63881\" selected=\"true\" /><select idref=\"V-63883\" selected=\"true\" /><select idref=\"V-63889\" selected=\"true\" /><select idref=\"V-63917\" selected=\"true\" /><select idref=\"V-63925\" selected=\"true\" /><select idref=\"V-63927\" selected=\"true\" /><select idref=\"V-63931\" selected=\"true\" /><select idref=\"V-63933\" selected=\"true\" /><select idref=\"V-63935\" selected=\"true\" /><select idref=\"V-63939\" selected=\"true\" /><select idref=\"V-63941\" selected=\"true\" /><select idref=\"V-65681\" selected=\"true\" /><select idref=\"V-68817\" selected=\"true\" /><select idref=\"V-68819\" selected=\"true\" /><select idref=\"V-68845\" selected=\"true\" /><select idref=\"V-68849\" selected=\"true\" /><select idref=\"V-70637\" selected=\"true\" /><select idref=\"V-70639\" selected=\"true\" /><select idref=\"V-71759\" selected=\"true\" /><select idref=\"V-71761\" selected=\"true\" /><select idref=\"V-71763\" selected=\"true\" /><select idref=\"V-71765\" selected=\"true\" /><select idref=\"V-71769\" selected=\"true\" /><select idref=\"V-71771\" selected=\"true\" /><select idref=\"V-72329\" selected=\"true\" /><select idref=\"V-72765\" selected=\"true\" /><select idref=\"V-72767\" selected=\"true\" /><select idref=\"V-72769\" selected=\"true\" /><select idref=\"V-74409\" selected=\"true\" /><select idref=\"V-74411\" selected=\"true\" /><select idref=\"V-74413\" selected=\"true\" /><select idref=\"V-74417\" selected=\"true\" /><select idref=\"V-74699\" selected=\"true\" /><select idref=\"V-74719\" selected=\"true\" /><select idref=\"V-74721\" selected=\"true\" /><select idref=\"V-74723\" selected=\"true\" /><select idref=\"V-74725\" selected=\"true\" /><select idref=\"V-75027\" selected=\"true\" /><select idref=\"V-76505\" selected=\"true\" /><select idref=\"V-77083\" selected=\"true\" /><select idref=\"V-77085\" selected=\"true\" /><select idref=\"V-77091\" selected=\"true\" /><select idref=\"V-77095\" selected=\"true\" /><select idref=\"V-77097\" selected=\"true\" /><select idref=\"V-77101\" selected=\"true\" /><select idref=\"V-77103\" selected=\"true\" /><select idref=\"V-77189\" selected=\"true\" /><select idref=\"V-77191\" selected=\"true\" /><select idref=\"V-77195\" selected=\"true\" /><select idref=\"V-77201\" selected=\"true\" /><select idref=\"V-77205\" selected=\"true\" /><select idref=\"V-77209\" selected=\"true\" /><select idref=\"V-77213\" selected=\"true\" /><select idref=\"V-77217\" selected=\"true\" /><select idref=\"V-77221\" selected=\"true\" /><select idref=\"V-77223\" selected=\"true\" /><select idref=\"V-77227\" selected=\"true\" /><select idref=\"V-77231\" selected=\"true\" /><select idref=\"V-77233\" selected=\"true\" /><select idref=\"V-77235\" selected=\"true\" /><select idref=\"V-77239\" selected=\"true\" /><select idref=\"V-77243\" selected=\"true\" /><select idref=\"V-77245\" selected=\"true\" /><select idref=\"V-77247\" selected=\"true\" /><select idref=\"V-77249\" selected=\"true\" /><select idref=\"V-77255\" selected=\"true\" /><select idref=\"V-77259\" selected=\"true\" /><select idref=\"V-77263\" selected=\"true\" /><select idref=\"V-77267\" selected=\"true\" /><select idref=\"V-77269\" selected=\"true\" /><select idref=\"V-78129\" selected=\"true\" /><select idref=\"V-82137\" selected=\"true\" /><select idref=\"V-82139\" selected=\"true\" /><select idref=\"V-82145\" selected=\"true\" /><select idref=\"V-88203\" selected=\"true\" /><select idref=\"V-94719\" selected=\"true\" /><select idref=\"V-94859\" selected=\"true\" /><select idref=\"V-94861\" selected=\"true\" /><select idref=\"V-99541\" selected=\"true\" /><select idref=\"V-99543\" selected=\"true\" /><select idref=\"V-99545\" selected=\"true\" /><select idref=\"V-99547\" selected=\"true\" /><select idref=\"V-99549\" selected=\"true\" /><select idref=\"V-99551\" selected=\"true\" /><select idref=\"V-99553\" selected=\"true\" /><select idref=\"V-99555\" selected=\"true\" /><select idref=\"V-99557\" selected=\"true\" /><select idref=\"V-99559\" selected=\"true\" /><select idref=\"V-99561\" selected=\"true\" /><select idref=\"V-99563\" selected=\"true\" /><select idref=\"V-100093\" selected=\"true\" /><select idref=\"V-102611\" selected=\"true\" /><select idref=\"V-102617\" selected=\"true\" /><select idref=\"V-102627\" selected=\"true\" /></Profile><Profile id=\"MAC-2_Public\"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-63319\" selected=\"true\" /><select idref=\"V-63321\" selected=\"true\" /><select idref=\"V-63323\" selected=\"true\" /><select idref=\"V-63325\" selected=\"true\" /><select idref=\"V-63329\" selected=\"true\" /><select idref=\"V-63333\" selected=\"true\" /><select idref=\"V-63335\" selected=\"true\" /><select idref=\"V-63337\" selected=\"true\" /><select idref=\"V-63339\" selected=\"true\" /><select idref=\"V-63341\" selected=\"true\" /><select idref=\"V-63343\" selected=\"true\" /><select idref=\"V-63345\" selected=\"true\" /><select idref=\"V-63347\" selected=\"true\" /><select idref=\"V-63349\" selected=\"true\" /><select idref=\"V-63351\" selected=\"true\" /><select idref=\"V-63353\" selected=\"true\" /><select idref=\"V-63355\" selected=\"true\" /><select idref=\"V-63357\" selected=\"true\" /><select idref=\"V-63359\" selected=\"true\" /><select idref=\"V-63361\" selected=\"true\" /><select idref=\"V-63363\" selected=\"true\" /><select idref=\"V-63365\" selected=\"true\" /><select idref=\"V-63367\" selected=\"true\" /><select idref=\"V-63369\" selected=\"true\" /><select idref=\"V-63371\" selected=\"true\" /><select idref=\"V-63373\" selected=\"true\" /><select idref=\"V-63375\" selected=\"true\" /><select idref=\"V-63377\" selected=\"true\" /><select idref=\"V-63381\" selected=\"true\" /><select idref=\"V-63383\" selected=\"true\" /><select idref=\"V-63385\" selected=\"true\" /><select idref=\"V-63389\" selected=\"true\" /><select idref=\"V-63393\" selected=\"true\" /><select idref=\"V-63399\" selected=\"true\" /><select idref=\"V-63403\" selected=\"true\" /><select idref=\"V-63405\" selected=\"true\" /><select idref=\"V-63409\" selected=\"true\" /><select idref=\"V-63413\" selected=\"true\" /><select idref=\"V-63415\" selected=\"true\" /><select idref=\"V-63419\" selected=\"true\" /><select idref=\"V-63421\" selected=\"true\" /><select idref=\"V-63423\" selected=\"true\" /><select idref=\"V-63427\" selected=\"true\" /><select idref=\"V-63429\" selected=\"true\" /><select idref=\"V-63431\" selected=\"true\" /><select idref=\"V-63435\" selected=\"true\" /><select idref=\"V-63445\" selected=\"true\" /><select idref=\"V-63447\" selected=\"true\" /><select idref=\"V-63449\" selected=\"true\" /><select idref=\"V-63451\" selected=\"true\" /><select idref=\"V-63453\" selected=\"true\" /><select idref=\"V-63457\" selected=\"true\" /><select idref=\"V-63459\" selected=\"true\" /><select idref=\"V-63463\" selected=\"true\" /><select idref=\"V-63467\" selected=\"true\" /><select idref=\"V-63469\" selected=\"true\" /><select idref=\"V-63471\" selected=\"true\" /><select idref=\"V-63473\" selected=\"true\" /><select idref=\"V-63479\" selected=\"true\" /><select idref=\"V-63481\" selected=\"true\" /><select idref=\"V-63483\" selected=\"true\" /><select idref=\"V-63487\" selected=\"true\" /><select idref=\"V-63491\" selected=\"true\" /><select idref=\"V-63499\" selected=\"true\" /><select idref=\"V-63503\" selected=\"true\" /><select idref=\"V-63507\" selected=\"true\" /><select idref=\"V-63513\" selected=\"true\" /><select idref=\"V-63515\" selected=\"true\" /><select idref=\"V-63517\" selected=\"true\" /><select idref=\"V-63519\" selected=\"true\" /><select idref=\"V-63523\" selected=\"true\" /><select idref=\"V-63527\" selected=\"true\" /><select idref=\"V-63533\" selected=\"true\" /><select idref=\"V-63537\" selected=\"true\" /><select idref=\"V-63541\" selected=\"true\" /><select idref=\"V-63545\" selected=\"true\" /><select idref=\"V-63549\" selected=\"true\" /><select idref=\"V-63555\" selected=\"true\" /><select idref=\"V-63559\" selected=\"true\" /><select idref=\"V-63563\" selected=\"true\" /><select idref=\"V-63567\" selected=\"true\" /><select idref=\"V-63569\" selected=\"true\" /><select idref=\"V-63577\" selected=\"true\" /><select idref=\"V-63579\" selected=\"true\" /><select idref=\"V-63581\" selected=\"true\" /><select idref=\"V-63583\" selected=\"true\" /><select idref=\"V-63585\" selected=\"true\" /><select idref=\"V-63587\" selected=\"true\" /><select idref=\"V-63589\" selected=\"true\" /><select idref=\"V-63591\" selected=\"true\" /><select idref=\"V-63593\" selected=\"true\" /><select idref=\"V-63595\" selected=\"true\" /><select idref=\"V-63597\" selected=\"true\" /><select idref=\"V-63599\" selected=\"true\" /><select idref=\"V-63601\" selected=\"true\" /><select idref=\"V-63607\" selected=\"true\" /><select idref=\"V-63609\" selected=\"true\" /><select idref=\"V-63611\" selected=\"true\" /><select idref=\"V-63615\" selected=\"true\" /><select idref=\"V-63617\" selected=\"true\" /><select idref=\"V-63619\" selected=\"true\" /><select idref=\"V-63621\" selected=\"true\" /><select idref=\"V-63623\" selected=\"true\" /><select idref=\"V-63625\" selected=\"true\" /><select idref=\"V-63627\" selected=\"true\" /><select idref=\"V-63629\" selected=\"true\" /><select idref=\"V-63633\" selected=\"true\" /><select idref=\"V-63635\" selected=\"true\" /><select idref=\"V-63639\" selected=\"true\" /><select idref=\"V-63643\" selected=\"true\" /><select idref=\"V-63645\" selected=\"true\" /><select idref=\"V-63647\" selected=\"true\" /><select idref=\"V-63649\" selected=\"true\" /><select idref=\"V-63651\" selected=\"true\" /><select idref=\"V-63653\" selected=\"true\" /><select idref=\"V-63657\" selected=\"true\" /><select idref=\"V-63659\" selected=\"true\" /><select idref=\"V-63661\" selected=\"true\" /><select idref=\"V-63663\" selected=\"true\" /><select idref=\"V-63665\" selected=\"true\" /><select idref=\"V-63667\" selected=\"true\" /><select idref=\"V-63669\" selected=\"true\" /><select idref=\"V-63671\" selected=\"true\" /><select idref=\"V-63673\" selected=\"true\" /><select idref=\"V-63675\" selected=\"true\" /><select idref=\"V-63677\" selected=\"true\" /><select idref=\"V-63679\" selected=\"true\" /><select idref=\"V-63681\" selected=\"true\" /><select idref=\"V-63683\" selected=\"true\" /><select idref=\"V-63685\" selected=\"true\" /><select idref=\"V-63687\" selected=\"true\" /><select idref=\"V-63689\" selected=\"true\" /><select idref=\"V-63691\" selected=\"true\" /><select idref=\"V-63695\" selected=\"true\" /><select idref=\"V-63697\" selected=\"true\" /><select idref=\"V-63699\" selected=\"true\" /><select idref=\"V-63701\" selected=\"true\" /><select idref=\"V-63703\" selected=\"true\" /><select idref=\"V-63709\" selected=\"true\" /><select idref=\"V-63711\" selected=\"true\" /><select idref=\"V-63713\" selected=\"true\" /><select idref=\"V-63717\" selected=\"true\" /><select idref=\"V-63719\" selected=\"true\" /><select idref=\"V-63721\" selected=\"true\" /><select idref=\"V-63729\" selected=\"true\" /><select idref=\"V-63731\" selected=\"true\" /><select idref=\"V-63733\" selected=\"true\" /><select idref=\"V-63737\" selected=\"true\" /><select idref=\"V-63739\" selected=\"true\" /><select idref=\"V-63741\" selected=\"true\" /><select idref=\"V-63743\" selected=\"true\" /><select idref=\"V-63745\" selected=\"true\" /><select idref=\"V-63747\" selected=\"true\" /><select idref=\"V-63749\" selected=\"true\" /><select idref=\"V-63751\" selected=\"true\" /><select idref=\"V-63755\" selected=\"true\" /><select idref=\"V-63759\" selected=\"true\" /><select idref=\"V-63765\" selected=\"true\" /><select idref=\"V-63767\" selected=\"true\" /><select idref=\"V-63795\" selected=\"true\" /><select idref=\"V-63797\" selected=\"true\" /><select idref=\"V-63801\" selected=\"true\" /><select idref=\"V-63803\" selected=\"true\" /><select idref=\"V-63805\" selected=\"true\" /><select idref=\"V-63807\" selected=\"true\" /><select idref=\"V-63811\" selected=\"true\" /><select idref=\"V-63815\" selected=\"true\" /><select idref=\"V-63817\" selected=\"true\" /><select idref=\"V-63819\" selected=\"true\" /><select idref=\"V-63821\" selected=\"true\" /><select idref=\"V-63825\" selected=\"true\" /><select idref=\"V-63827\" selected=\"true\" /><select idref=\"V-63829\" selected=\"true\" /><select idref=\"V-63831\" selected=\"true\" /><select idref=\"V-63839\" selected=\"true\" /><select idref=\"V-63841\" selected=\"true\" /><select idref=\"V-63843\" selected=\"true\" /><select idref=\"V-63845\" selected=\"true\" /><select idref=\"V-63847\" selected=\"true\" /><select idref=\"V-63851\" selected=\"true\" /><select idref=\"V-63853\" selected=\"true\" /><select idref=\"V-63855\" selected=\"true\" /><select idref=\"V-63857\" selected=\"true\" /><select idref=\"V-63859\" selected=\"true\" /><select idref=\"V-63861\" selected=\"true\" /><select idref=\"V-63863\" selected=\"true\" /><select idref=\"V-63865\" selected=\"true\" /><select idref=\"V-63869\" selected=\"true\" /><select idref=\"V-63871\" selected=\"true\" /><select idref=\"V-63873\" selected=\"true\" /><select idref=\"V-63875\" selected=\"true\" /><select idref=\"V-63877\" selected=\"true\" /><select idref=\"V-63879\" selected=\"true\" /><select idref=\"V-63881\" selected=\"true\" /><select idref=\"V-63883\" selected=\"true\" /><select idref=\"V-63889\" selected=\"true\" /><select idref=\"V-63917\" selected=\"true\" /><select idref=\"V-63925\" selected=\"true\" /><select idref=\"V-63927\" selected=\"true\" /><select idref=\"V-63931\" selected=\"true\" /><select idref=\"V-63933\" selected=\"true\" /><select idref=\"V-63935\" selected=\"true\" /><select idref=\"V-63939\" selected=\"true\" /><select idref=\"V-63941\" selected=\"true\" /><select idref=\"V-65681\" selected=\"true\" /><select idref=\"V-68817\" selected=\"true\" /><select idref=\"V-68819\" selected=\"true\" /><select idref=\"V-68845\" selected=\"true\" /><select idref=\"V-68849\" selected=\"true\" /><select idref=\"V-70637\" selected=\"true\" /><select idref=\"V-70639\" selected=\"true\" /><select idref=\"V-71759\" selected=\"true\" /><select idref=\"V-71761\" selected=\"true\" /><select idref=\"V-71763\" selected=\"true\" /><select idref=\"V-71765\" selected=\"true\" /><select idref=\"V-71769\" selected=\"true\" /><select idref=\"V-71771\" selected=\"true\" /><select idref=\"V-72329\" selected=\"true\" /><select idref=\"V-72765\" selected=\"true\" /><select idref=\"V-72767\" selected=\"true\" /><select idref=\"V-72769\" selected=\"true\" /><select idref=\"V-74409\" selected=\"true\" /><select idref=\"V-74411\" selected=\"true\" /><select idref=\"V-74413\" selected=\"true\" /><select idref=\"V-74417\" selected=\"true\" /><select idref=\"V-74699\" selected=\"true\" /><select idref=\"V-74719\" selected=\"true\" /><select idref=\"V-74721\" selected=\"true\" /><select idref=\"V-74723\" selected=\"true\" /><select idref=\"V-74725\" selected=\"true\" /><select idref=\"V-75027\" selected=\"true\" /><select idref=\"V-76505\" selected=\"true\" /><select idref=\"V-77083\" selected=\"true\" /><select idref=\"V-77085\" selected=\"true\" /><select idref=\"V-77091\" selected=\"true\" /><select idref=\"V-77095\" selected=\"true\" /><select idref=\"V-77097\" selected=\"true\" /><select idref=\"V-77101\" selected=\"true\" /><select idref=\"V-77103\" selected=\"true\" /><select idref=\"V-77189\" selected=\"true\" /><select idref=\"V-77191\" selected=\"true\" /><select idref=\"V-77195\" selected=\"true\" /><select idref=\"V-77201\" selected=\"true\" /><select idref=\"V-77205\" selected=\"true\" /><select idref=\"V-77209\" selected=\"true\" /><select idref=\"V-77213\" selected=\"true\" /><select idref=\"V-77217\" selected=\"true\" /><select idref=\"V-77221\" selected=\"true\" /><select idref=\"V-77223\" selected=\"true\" /><select idref=\"V-77227\" selected=\"true\" /><select idref=\"V-77231\" selected=\"true\" /><select idref=\"V-77233\" selected=\"true\" /><select idref=\"V-77235\" selected=\"true\" /><select idref=\"V-77239\" selected=\"true\" /><select idref=\"V-77243\" selected=\"true\" /><select idref=\"V-77245\" selected=\"true\" /><select idref=\"V-77247\" selected=\"true\" /><select idref=\"V-77249\" selected=\"true\" /><select idref=\"V-77255\" selected=\"true\" /><select idref=\"V-77259\" selected=\"true\" /><select idref=\"V-77263\" selected=\"true\" /><select idref=\"V-77267\" selected=\"true\" /><select idref=\"V-77269\" selected=\"true\" /><select idref=\"V-78129\" selected=\"true\" /><select idref=\"V-82137\" selected=\"true\" /><select idref=\"V-82139\" selected=\"true\" /><select idref=\"V-82145\" selected=\"true\" /><select idref=\"V-88203\" selected=\"true\" /><select idref=\"V-94719\" selected=\"true\" /><select idref=\"V-94859\" selected=\"true\" /><select idref=\"V-94861\" selected=\"true\" /><select idref=\"V-99541\" selected=\"true\" /><select idref=\"V-99543\" selected=\"true\" /><select idref=\"V-99545\" selected=\"true\" /><select idref=\"V-99547\" selected=\"true\" /><select idref=\"V-99549\" selected=\"true\" /><select idref=\"V-99551\" selected=\"true\" /><select idref=\"V-99553\" selected=\"true\" /><select idref=\"V-99555\" selected=\"true\" /><select idref=\"V-99557\" selected=\"true\" /><select idref=\"V-99559\" selected=\"true\" /><select idref=\"V-99561\" selected=\"true\" /><select idref=\"V-99563\" selected=\"true\" /><select idref=\"V-100093\" selected=\"true\" /><select idref=\"V-102611\" selected=\"true\" /><select idref=\"V-102617\" selected=\"true\" /><select idref=\"V-102627\" selected=\"true\" /></Profile><Profile id=\"MAC-2_Sensitive\"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-63319\" selected=\"true\" /><select idref=\"V-63321\" selected=\"true\" /><select idref=\"V-63323\" selected=\"true\" /><select idref=\"V-63325\" selected=\"true\" /><select idref=\"V-63329\" selected=\"true\" /><select idref=\"V-63333\" selected=\"true\" /><select idref=\"V-63335\" selected=\"true\" /><select idref=\"V-63337\" selected=\"true\" /><select idref=\"V-63339\" selected=\"true\" /><select idref=\"V-63341\" selected=\"true\" /><select idref=\"V-63343\" selected=\"true\" /><select idref=\"V-63345\" selected=\"true\" /><select idref=\"V-63347\" selected=\"true\" /><select idref=\"V-63349\" selected=\"true\" /><select idref=\"V-63351\" selected=\"true\" /><select idref=\"V-63353\" selected=\"true\" /><select idref=\"V-63355\" selected=\"true\" /><select idref=\"V-63357\" selected=\"true\" /><select idref=\"V-63359\" selected=\"true\" /><select idref=\"V-63361\" selected=\"true\" /><select idref=\"V-63363\" selected=\"true\" /><select idref=\"V-63365\" selected=\"true\" /><select idref=\"V-63367\" selected=\"true\" /><select idref=\"V-63369\" selected=\"true\" /><select idref=\"V-63371\" selected=\"true\" /><select idref=\"V-63373\" selected=\"true\" /><select idref=\"V-63375\" selected=\"true\" /><select idref=\"V-63377\" selected=\"true\" /><select idref=\"V-63381\" selected=\"true\" /><select idref=\"V-63383\" selected=\"true\" /><select idref=\"V-63385\" selected=\"true\" /><select idref=\"V-63389\" selected=\"true\" /><select idref=\"V-63393\" selected=\"true\" /><select idref=\"V-63399\" selected=\"true\" /><select idref=\"V-63403\" selected=\"true\" /><select idref=\"V-63405\" selected=\"true\" /><select idref=\"V-63409\" selected=\"true\" /><select idref=\"V-63413\" selected=\"true\" /><select idref=\"V-63415\" selected=\"true\" /><select idref=\"V-63419\" selected=\"true\" /><select idref=\"V-63421\" selected=\"true\" /><select idref=\"V-63423\" selected=\"true\" /><select idref=\"V-63427\" selected=\"true\" /><select idref=\"V-63429\" selected=\"true\" /><select idref=\"V-63431\" selected=\"true\" /><select idref=\"V-63435\" selected=\"true\" /><select idref=\"V-63445\" selected=\"true\" /><select idref=\"V-63447\" selected=\"true\" /><select idref=\"V-63449\" selected=\"true\" /><select idref=\"V-63451\" selected=\"true\" /><select idref=\"V-63453\" selected=\"true\" /><select idref=\"V-63457\" selected=\"true\" /><select idref=\"V-63459\" selected=\"true\" /><select idref=\"V-63463\" selected=\"true\" /><select idref=\"V-63467\" selected=\"true\" /><select idref=\"V-63469\" selected=\"true\" /><select idref=\"V-63471\" selected=\"true\" /><select idref=\"V-63473\" selected=\"true\" /><select idref=\"V-63479\" selected=\"true\" /><select idref=\"V-63481\" selected=\"true\" /><select idref=\"V-63483\" selected=\"true\" /><select idref=\"V-63487\" selected=\"true\" /><select idref=\"V-63491\" selected=\"true\" /><select idref=\"V-63499\" selected=\"true\" /><select idref=\"V-63503\" selected=\"true\" /><select idref=\"V-63507\" selected=\"true\" /><select idref=\"V-63513\" selected=\"true\" /><select idref=\"V-63515\" selected=\"true\" /><select idref=\"V-63517\" selected=\"true\" /><select idref=\"V-63519\" selected=\"true\" /><select idref=\"V-63523\" selected=\"true\" /><select idref=\"V-63527\" selected=\"true\" /><select idref=\"V-63533\" selected=\"true\" /><select idref=\"V-63537\" selected=\"true\" /><select idref=\"V-63541\" selected=\"true\" /><select idref=\"V-63545\" selected=\"true\" /><select idref=\"V-63549\" selected=\"true\" /><select idref=\"V-63555\" selected=\"true\" /><select idref=\"V-63559\" selected=\"true\" /><select idref=\"V-63563\" selected=\"true\" /><select idref=\"V-63567\" selected=\"true\" /><select idref=\"V-63569\" selected=\"true\" /><select idref=\"V-63577\" selected=\"true\" /><select idref=\"V-63579\" selected=\"true\" /><select idref=\"V-63581\" selected=\"true\" /><select idref=\"V-63583\" selected=\"true\" /><select idref=\"V-63585\" selected=\"true\" /><select idref=\"V-63587\" selected=\"true\" /><select idref=\"V-63589\" selected=\"true\" /><select idref=\"V-63591\" selected=\"true\" /><select idref=\"V-63593\" selected=\"true\" /><select idref=\"V-63595\" selected=\"true\" /><select idref=\"V-63597\" selected=\"true\" /><select idref=\"V-63599\" selected=\"true\" /><select idref=\"V-63601\" selected=\"true\" /><select idref=\"V-63607\" selected=\"true\" /><select idref=\"V-63609\" selected=\"true\" /><select idref=\"V-63611\" selected=\"true\" /><select idref=\"V-63615\" selected=\"true\" /><select idref=\"V-63617\" selected=\"true\" /><select idref=\"V-63619\" selected=\"true\" /><select idref=\"V-63621\" selected=\"true\" /><select idref=\"V-63623\" selected=\"true\" /><select idref=\"V-63625\" selected=\"true\" /><select idref=\"V-63627\" selected=\"true\" /><select idref=\"V-63629\" selected=\"true\" /><select idref=\"V-63633\" selected=\"true\" /><select idref=\"V-63635\" selected=\"true\" /><select idref=\"V-63639\" selected=\"true\" /><select idref=\"V-63643\" selected=\"true\" /><select idref=\"V-63645\" selected=\"true\" /><select idref=\"V-63647\" selected=\"true\" /><select idref=\"V-63649\" selected=\"true\" /><select idref=\"V-63651\" selected=\"true\" /><select idref=\"V-63653\" selected=\"true\" /><select idref=\"V-63657\" selected=\"true\" /><select idref=\"V-63659\" selected=\"true\" /><select idref=\"V-63661\" selected=\"true\" /><select idref=\"V-63663\" selected=\"true\" /><select idref=\"V-63665\" selected=\"true\" /><select idref=\"V-63667\" selected=\"true\" /><select idref=\"V-63669\" selected=\"true\" /><select idref=\"V-63671\" selected=\"true\" /><select idref=\"V-63673\" selected=\"true\" /><select idref=\"V-63675\" selected=\"true\" /><select idref=\"V-63677\" selected=\"true\" /><select idref=\"V-63679\" selected=\"true\" /><select idref=\"V-63681\" selected=\"true\" /><select idref=\"V-63683\" selected=\"true\" /><select idref=\"V-63685\" selected=\"true\" /><select idref=\"V-63687\" selected=\"true\" /><select idref=\"V-63689\" selected=\"true\" /><select idref=\"V-63691\" selected=\"true\" /><select idref=\"V-63695\" selected=\"true\" /><select idref=\"V-63697\" selected=\"true\" /><select idref=\"V-63699\" selected=\"true\" /><select idref=\"V-63701\" selected=\"true\" /><select idref=\"V-63703\" selected=\"true\" /><select idref=\"V-63709\" selected=\"true\" /><select idref=\"V-63711\" selected=\"true\" /><select idref=\"V-63713\" selected=\"true\" /><select idref=\"V-63717\" selected=\"true\" /><select idref=\"V-63719\" selected=\"true\" /><select idref=\"V-63721\" selected=\"true\" /><select idref=\"V-63729\" selected=\"true\" /><select idref=\"V-63731\" selected=\"true\" /><select idref=\"V-63733\" selected=\"true\" /><select idref=\"V-63737\" selected=\"true\" /><select idref=\"V-63739\" selected=\"true\" /><select idref=\"V-63741\" selected=\"true\" /><select idref=\"V-63743\" selected=\"true\" /><select idref=\"V-63745\" selected=\"true\" /><select idref=\"V-63747\" selected=\"true\" /><select idref=\"V-63749\" selected=\"true\" /><select idref=\"V-63751\" selected=\"true\" /><select idref=\"V-63755\" selected=\"true\" /><select idref=\"V-63759\" selected=\"true\" /><select idref=\"V-63765\" selected=\"true\" /><select idref=\"V-63767\" selected=\"true\" /><select idref=\"V-63795\" selected=\"true\" /><select idref=\"V-63797\" selected=\"true\" /><select idref=\"V-63801\" selected=\"true\" /><select idref=\"V-63803\" selected=\"true\" /><select idref=\"V-63805\" selected=\"true\" /><select idref=\"V-63807\" selected=\"true\" /><select idref=\"V-63811\" selected=\"true\" /><select idref=\"V-63815\" selected=\"true\" /><select idref=\"V-63817\" selected=\"true\" /><select idref=\"V-63819\" selected=\"true\" /><select idref=\"V-63821\" selected=\"true\" /><select idref=\"V-63825\" selected=\"true\" /><select idref=\"V-63827\" selected=\"true\" /><select idref=\"V-63829\" selected=\"true\" /><select idref=\"V-63831\" selected=\"true\" /><select idref=\"V-63839\" selected=\"true\" /><select idref=\"V-63841\" selected=\"true\" /><select idref=\"V-63843\" selected=\"true\" /><select idref=\"V-63845\" selected=\"true\" /><select idref=\"V-63847\" selected=\"true\" /><select idref=\"V-63851\" selected=\"true\" /><select idref=\"V-63853\" selected=\"true\" /><select idref=\"V-63855\" selected=\"true\" /><select idref=\"V-63857\" selected=\"true\" /><select idref=\"V-63859\" selected=\"true\" /><select idref=\"V-63861\" selected=\"true\" /><select idref=\"V-63863\" selected=\"true\" /><select idref=\"V-63865\" selected=\"true\" /><select idref=\"V-63869\" selected=\"true\" /><select idref=\"V-63871\" selected=\"true\" /><select idref=\"V-63873\" selected=\"true\" /><select idref=\"V-63875\" selected=\"true\" /><select idref=\"V-63877\" selected=\"true\" /><select idref=\"V-63879\" selected=\"true\" /><select idref=\"V-63881\" selected=\"true\" /><select idref=\"V-63883\" selected=\"true\" /><select idref=\"V-63889\" selected=\"true\" /><select idref=\"V-63917\" selected=\"true\" /><select idref=\"V-63925\" selected=\"true\" /><select idref=\"V-63927\" selected=\"true\" /><select idref=\"V-63931\" selected=\"true\" /><select idref=\"V-63933\" selected=\"true\" /><select idref=\"V-63935\" selected=\"true\" /><select idref=\"V-63939\" selected=\"true\" /><select idref=\"V-63941\" selected=\"true\" /><select idref=\"V-65681\" selected=\"true\" /><select idref=\"V-68817\" selected=\"true\" /><select idref=\"V-68819\" selected=\"true\" /><select idref=\"V-68845\" selected=\"true\" /><select idref=\"V-68849\" selected=\"true\" /><select idref=\"V-70637\" selected=\"true\" /><select idref=\"V-70639\" selected=\"true\" /><select idref=\"V-71759\" selected=\"true\" /><select idref=\"V-71761\" selected=\"true\" /><select idref=\"V-71763\" selected=\"true\" /><select idref=\"V-71765\" selected=\"true\" /><select idref=\"V-71769\" selected=\"true\" /><select idref=\"V-71771\" selected=\"true\" /><select idref=\"V-72329\" selected=\"true\" /><select idref=\"V-72765\" selected=\"true\" /><select idref=\"V-72767\" selected=\"true\" /><select idref=\"V-72769\" selected=\"true\" /><select idref=\"V-74409\" selected=\"true\" /><select idref=\"V-74411\" selected=\"true\" /><select idref=\"V-74413\" selected=\"true\" /><select idref=\"V-74417\" selected=\"true\" /><select idref=\"V-74699\" selected=\"true\" /><select idref=\"V-74719\" selected=\"true\" /><select idref=\"V-74721\" selected=\"true\" /><select idref=\"V-74723\" selected=\"true\" /><select idref=\"V-74725\" selected=\"true\" /><select idref=\"V-75027\" selected=\"true\" /><select idref=\"V-76505\" selected=\"true\" /><select idref=\"V-77083\" selected=\"true\" /><select idref=\"V-77085\" selected=\"true\" /><select idref=\"V-77091\" selected=\"true\" /><select idref=\"V-77095\" selected=\"true\" /><select idref=\"V-77097\" selected=\"true\" /><select idref=\"V-77101\" selected=\"true\" /><select idref=\"V-77103\" selected=\"true\" /><select idref=\"V-77189\" selected=\"true\" /><select idref=\"V-77191\" selected=\"true\" /><select idref=\"V-77195\" selected=\"true\" /><select idref=\"V-77201\" selected=\"true\" /><select idref=\"V-77205\" selected=\"true\" /><select idref=\"V-77209\" selected=\"true\" /><select idref=\"V-77213\" selected=\"true\" /><select idref=\"V-77217\" selected=\"true\" /><select idref=\"V-77221\" selected=\"true\" /><select idref=\"V-77223\" selected=\"true\" /><select idref=\"V-77227\" selected=\"true\" /><select idref=\"V-77231\" selected=\"true\" /><select idref=\"V-77233\" selected=\"true\" /><select idref=\"V-77235\" selected=\"true\" /><select idref=\"V-77239\" selected=\"true\" /><select idref=\"V-77243\" selected=\"true\" /><select idref=\"V-77245\" selected=\"true\" /><select idref=\"V-77247\" selected=\"true\" /><select idref=\"V-77249\" selected=\"true\" /><select idref=\"V-77255\" selected=\"true\" /><select idref=\"V-77259\" selected=\"true\" /><select idref=\"V-77263\" selected=\"true\" /><select idref=\"V-77267\" selected=\"true\" /><select idref=\"V-77269\" selected=\"true\" /><select idref=\"V-78129\" selected=\"true\" /><select idref=\"V-82137\" selected=\"true\" /><select idref=\"V-82139\" selected=\"true\" /><select idref=\"V-82145\" selected=\"true\" /><select idref=\"V-88203\" selected=\"true\" /><select idref=\"V-94719\" selected=\"true\" /><select idref=\"V-94859\" selected=\"true\" /><select idref=\"V-94861\" selected=\"true\" /><select idref=\"V-99541\" selected=\"true\" /><select idref=\"V-99543\" selected=\"true\" /><select idref=\"V-99545\" selected=\"true\" /><select idref=\"V-99547\" selected=\"true\" /><select idref=\"V-99549\" selected=\"true\" /><select idref=\"V-99551\" selected=\"true\" /><select idref=\"V-99553\" selected=\"true\" /><select idref=\"V-99555\" selected=\"true\" /><select idref=\"V-99557\" selected=\"true\" /><select idref=\"V-99559\" selected=\"true\" /><select idref=\"V-99561\" selected=\"true\" /><select idref=\"V-99563\" selected=\"true\" /><select idref=\"V-100093\" selected=\"true\" /><select idref=\"V-102611\" selected=\"true\" /><select idref=\"V-102617\" selected=\"true\" /><select idref=\"V-102627\" selected=\"true\" /></Profile><Profile id=\"MAC-3_Classified\"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-63319\" selected=\"true\" /><select idref=\"V-63321\" selected=\"true\" /><select idref=\"V-63323\" selected=\"true\" /><select idref=\"V-63325\" selected=\"true\" /><select idref=\"V-63329\" selected=\"true\" /><select idref=\"V-63333\" selected=\"true\" /><select idref=\"V-63335\" selected=\"true\" /><select idref=\"V-63337\" selected=\"true\" /><select idref=\"V-63339\" selected=\"true\" /><select idref=\"V-63341\" selected=\"true\" /><select idref=\"V-63343\" selected=\"true\" /><select idref=\"V-63345\" selected=\"true\" /><select idref=\"V-63347\" selected=\"true\" /><select idref=\"V-63349\" selected=\"true\" /><select idref=\"V-63351\" selected=\"true\" /><select idref=\"V-63353\" selected=\"true\" /><select idref=\"V-63355\" selected=\"true\" /><select idref=\"V-63357\" selected=\"true\" /><select idref=\"V-63359\" selected=\"true\" /><select idref=\"V-63361\" selected=\"true\" /><select idref=\"V-63363\" selected=\"true\" /><select idref=\"V-63365\" selected=\"true\" /><select idref=\"V-63367\" selected=\"true\" /><select idref=\"V-63369\" selected=\"true\" /><select idref=\"V-63371\" selected=\"true\" /><select idref=\"V-63373\" selected=\"true\" /><select idref=\"V-63375\" selected=\"true\" /><select idref=\"V-63377\" selected=\"true\" /><select idref=\"V-63381\" selected=\"true\" /><select idref=\"V-63383\" selected=\"true\" /><select idref=\"V-63385\" selected=\"true\" /><select idref=\"V-63389\" selected=\"true\" /><select idref=\"V-63393\" selected=\"true\" /><select idref=\"V-63399\" selected=\"true\" /><select idref=\"V-63403\" selected=\"true\" /><select idref=\"V-63405\" selected=\"true\" /><select idref=\"V-63409\" selected=\"true\" /><select idref=\"V-63413\" selected=\"true\" /><select idref=\"V-63415\" selected=\"true\" /><select idref=\"V-63419\" selected=\"true\" /><select idref=\"V-63421\" selected=\"true\" /><select idref=\"V-63423\" selected=\"true\" /><select idref=\"V-63427\" selected=\"true\" /><select idref=\"V-63429\" selected=\"true\" /><select idref=\"V-63431\" selected=\"true\" /><select idref=\"V-63435\" selected=\"true\" /><select idref=\"V-63445\" selected=\"true\" /><select idref=\"V-63447\" selected=\"true\" /><select idref=\"V-63449\" selected=\"true\" /><select idref=\"V-63451\" selected=\"true\" /><select idref=\"V-63453\" selected=\"true\" /><select idref=\"V-63457\" selected=\"true\" /><select idref=\"V-63459\" selected=\"true\" /><select idref=\"V-63463\" selected=\"true\" /><select idref=\"V-63467\" selected=\"true\" /><select idref=\"V-63469\" selected=\"true\" /><select idref=\"V-63471\" selected=\"true\" /><select idref=\"V-63473\" selected=\"true\" /><select idref=\"V-63479\" selected=\"true\" /><select idref=\"V-63481\" selected=\"true\" /><select idref=\"V-63483\" selected=\"true\" /><select idref=\"V-63487\" selected=\"true\" /><select idref=\"V-63491\" selected=\"true\" /><select idref=\"V-63499\" selected=\"true\" /><select idref=\"V-63503\" selected=\"true\" /><select idref=\"V-63507\" selected=\"true\" /><select idref=\"V-63513\" selected=\"true\" /><select idref=\"V-63515\" selected=\"true\" /><select idref=\"V-63517\" selected=\"true\" /><select idref=\"V-63519\" selected=\"true\" /><select idref=\"V-63523\" selected=\"true\" /><select idref=\"V-63527\" selected=\"true\" /><select idref=\"V-63533\" selected=\"true\" /><select idref=\"V-63537\" selected=\"true\" /><select idref=\"V-63541\" selected=\"true\" /><select idref=\"V-63545\" selected=\"true\" /><select idref=\"V-63549\" selected=\"true\" /><select idref=\"V-63555\" selected=\"true\" /><select idref=\"V-63559\" selected=\"true\" /><select idref=\"V-63563\" selected=\"true\" /><select idref=\"V-63567\" selected=\"true\" /><select idref=\"V-63569\" selected=\"true\" /><select idref=\"V-63577\" selected=\"true\" /><select idref=\"V-63579\" selected=\"true\" /><select idref=\"V-63581\" selected=\"true\" /><select idref=\"V-63583\" selected=\"true\" /><select idref=\"V-63585\" selected=\"true\" /><select idref=\"V-63587\" selected=\"true\" /><select idref=\"V-63589\" selected=\"true\" /><select idref=\"V-63591\" selected=\"true\" /><select idref=\"V-63593\" selected=\"true\" /><select idref=\"V-63595\" selected=\"true\" /><select idref=\"V-63597\" selected=\"true\" /><select idref=\"V-63599\" selected=\"true\" /><select idref=\"V-63601\" selected=\"true\" /><select idref=\"V-63607\" selected=\"true\" /><select idref=\"V-63609\" selected=\"true\" /><select idref=\"V-63611\" selected=\"true\" /><select idref=\"V-63615\" selected=\"true\" /><select idref=\"V-63617\" selected=\"true\" /><select idref=\"V-63619\" selected=\"true\" /><select idref=\"V-63621\" selected=\"true\" /><select idref=\"V-63623\" selected=\"true\" /><select idref=\"V-63625\" selected=\"true\" /><select idref=\"V-63627\" selected=\"true\" /><select idref=\"V-63629\" selected=\"true\" /><select idref=\"V-63633\" selected=\"true\" /><select idref=\"V-63635\" selected=\"true\" /><select idref=\"V-63639\" selected=\"true\" /><select idref=\"V-63643\" selected=\"true\" /><select idref=\"V-63645\" selected=\"true\" /><select idref=\"V-63647\" selected=\"true\" /><select idref=\"V-63649\" selected=\"true\" /><select idref=\"V-63651\" selected=\"true\" /><select idref=\"V-63653\" selected=\"true\" /><select idref=\"V-63657\" selected=\"true\" /><select idref=\"V-63659\" selected=\"true\" /><select idref=\"V-63661\" selected=\"true\" /><select idref=\"V-63663\" selected=\"true\" /><select idref=\"V-63665\" selected=\"true\" /><select idref=\"V-63667\" selected=\"true\" /><select idref=\"V-63669\" selected=\"true\" /><select idref=\"V-63671\" selected=\"true\" /><select idref=\"V-63673\" selected=\"true\" /><select idref=\"V-63675\" selected=\"true\" /><select idref=\"V-63677\" selected=\"true\" /><select idref=\"V-63679\" selected=\"true\" /><select idref=\"V-63681\" selected=\"true\" /><select idref=\"V-63683\" selected=\"true\" /><select idref=\"V-63685\" selected=\"true\" /><select idref=\"V-63687\" selected=\"true\" /><select idref=\"V-63689\" selected=\"true\" /><select idref=\"V-63691\" selected=\"true\" /><select idref=\"V-63695\" selected=\"true\" /><select idref=\"V-63697\" selected=\"true\" /><select idref=\"V-63699\" selected=\"true\" /><select idref=\"V-63701\" selected=\"true\" /><select idref=\"V-63703\" selected=\"true\" /><select idref=\"V-63709\" selected=\"true\" /><select idref=\"V-63711\" selected=\"true\" /><select idref=\"V-63713\" selected=\"true\" /><select idref=\"V-63717\" selected=\"true\" /><select idref=\"V-63719\" selected=\"true\" /><select idref=\"V-63721\" selected=\"true\" /><select idref=\"V-63729\" selected=\"true\" /><select idref=\"V-63731\" selected=\"true\" /><select idref=\"V-63733\" selected=\"true\" /><select idref=\"V-63737\" selected=\"true\" /><select idref=\"V-63739\" selected=\"true\" /><select idref=\"V-63741\" selected=\"true\" /><select idref=\"V-63743\" selected=\"true\" /><select idref=\"V-63745\" selected=\"true\" /><select idref=\"V-63747\" selected=\"true\" /><select idref=\"V-63749\" selected=\"true\" /><select idref=\"V-63751\" selected=\"true\" /><select idref=\"V-63755\" selected=\"true\" /><select idref=\"V-63759\" selected=\"true\" /><select idref=\"V-63765\" selected=\"true\" /><select idref=\"V-63767\" selected=\"true\" /><select idref=\"V-63795\" selected=\"true\" /><select idref=\"V-63797\" selected=\"true\" /><select idref=\"V-63801\" selected=\"true\" /><select idref=\"V-63803\" selected=\"true\" /><select idref=\"V-63805\" selected=\"true\" /><select idref=\"V-63807\" selected=\"true\" /><select idref=\"V-63811\" selected=\"true\" /><select idref=\"V-63815\" selected=\"true\" /><select idref=\"V-63817\" selected=\"true\" /><select idref=\"V-63819\" selected=\"true\" /><select idref=\"V-63821\" selected=\"true\" /><select idref=\"V-63825\" selected=\"true\" /><select idref=\"V-63827\" selected=\"true\" /><select idref=\"V-63829\" selected=\"true\" /><select idref=\"V-63831\" selected=\"true\" /><select idref=\"V-63839\" selected=\"true\" /><select idref=\"V-63841\" selected=\"true\" /><select idref=\"V-63843\" selected=\"true\" /><select idref=\"V-63845\" selected=\"true\" /><select idref=\"V-63847\" selected=\"true\" /><select idref=\"V-63851\" selected=\"true\" /><select idref=\"V-63853\" selected=\"true\" /><select idref=\"V-63855\" selected=\"true\" /><select idref=\"V-63857\" selected=\"true\" /><select idref=\"V-63859\" selected=\"true\" /><select idref=\"V-63861\" selected=\"true\" /><select idref=\"V-63863\" selected=\"true\" /><select idref=\"V-63865\" selected=\"true\" /><select idref=\"V-63869\" selected=\"true\" /><select idref=\"V-63871\" selected=\"true\" /><select idref=\"V-63873\" selected=\"true\" /><select idref=\"V-63875\" selected=\"true\" /><select idref=\"V-63877\" selected=\"true\" /><select idref=\"V-63879\" selected=\"true\" /><select idref=\"V-63881\" selected=\"true\" /><select idref=\"V-63883\" selected=\"true\" /><select idref=\"V-63889\" selected=\"true\" /><select idref=\"V-63917\" selected=\"true\" /><select idref=\"V-63925\" selected=\"true\" /><select idref=\"V-63927\" selected=\"true\" /><select idref=\"V-63931\" selected=\"true\" /><select idref=\"V-63933\" selected=\"true\" /><select idref=\"V-63935\" selected=\"true\" /><select idref=\"V-63939\" selected=\"true\" /><select idref=\"V-63941\" selected=\"true\" /><select idref=\"V-65681\" selected=\"true\" /><select idref=\"V-68817\" selected=\"true\" /><select idref=\"V-68819\" selected=\"true\" /><select idref=\"V-68845\" selected=\"true\" /><select idref=\"V-68849\" selected=\"true\" /><select idref=\"V-70637\" selected=\"true\" /><select idref=\"V-70639\" selected=\"true\" /><select idref=\"V-71759\" selected=\"true\" /><select idref=\"V-71761\" selected=\"true\" /><select idref=\"V-71763\" selected=\"true\" /><select idref=\"V-71765\" selected=\"true\" /><select idref=\"V-71769\" selected=\"true\" /><select idref=\"V-71771\" selected=\"true\" /><select idref=\"V-72329\" selected=\"true\" /><select idref=\"V-72765\" selected=\"true\" /><select idref=\"V-72767\" selected=\"true\" /><select idref=\"V-72769\" selected=\"true\" /><select idref=\"V-74409\" selected=\"true\" /><select idref=\"V-74411\" selected=\"true\" /><select idref=\"V-74413\" selected=\"true\" /><select idref=\"V-74417\" selected=\"true\" /><select idref=\"V-74699\" selected=\"true\" /><select idref=\"V-74719\" selected=\"true\" /><select idref=\"V-74721\" selected=\"true\" /><select idref=\"V-74723\" selected=\"true\" /><select idref=\"V-74725\" selected=\"true\" /><select idref=\"V-75027\" selected=\"true\" /><select idref=\"V-76505\" selected=\"true\" /><select idref=\"V-77083\" selected=\"true\" /><select idref=\"V-77085\" selected=\"true\" /><select idref=\"V-77091\" selected=\"true\" /><select idref=\"V-77095\" selected=\"true\" /><select idref=\"V-77097\" selected=\"true\" /><select idref=\"V-77101\" selected=\"true\" /><select idref=\"V-77103\" selected=\"true\" /><select idref=\"V-77189\" selected=\"true\" /><select idref=\"V-77191\" selected=\"true\" /><select idref=\"V-77195\" selected=\"true\" /><select idref=\"V-77201\" selected=\"true\" /><select idref=\"V-77205\" selected=\"true\" /><select idref=\"V-77209\" selected=\"true\" /><select idref=\"V-77213\" selected=\"true\" /><select idref=\"V-77217\" selected=\"true\" /><select idref=\"V-77221\" selected=\"true\" /><select idref=\"V-77223\" selected=\"true\" /><select idref=\"V-77227\" selected=\"true\" /><select idref=\"V-77231\" selected=\"true\" /><select idref=\"V-77233\" selected=\"true\" /><select idref=\"V-77235\" selected=\"true\" /><select idref=\"V-77239\" selected=\"true\" /><select idref=\"V-77243\" selected=\"true\" /><select idref=\"V-77245\" selected=\"true\" /><select idref=\"V-77247\" selected=\"true\" /><select idref=\"V-77249\" selected=\"true\" /><select idref=\"V-77255\" selected=\"true\" /><select idref=\"V-77259\" selected=\"true\" /><select idref=\"V-77263\" selected=\"true\" /><select idref=\"V-77267\" selected=\"true\" /><select idref=\"V-77269\" selected=\"true\" /><select idref=\"V-78129\" selected=\"true\" /><select idref=\"V-82137\" selected=\"true\" /><select idref=\"V-82139\" selected=\"true\" /><select idref=\"V-82145\" selected=\"true\" /><select idref=\"V-88203\" selected=\"true\" /><select idref=\"V-94719\" selected=\"true\" /><select idref=\"V-94859\" selected=\"true\" /><select idref=\"V-94861\" selected=\"true\" /><select idref=\"V-99541\" selected=\"true\" /><select idref=\"V-99543\" selected=\"true\" /><select idref=\"V-99545\" selected=\"true\" /><select idref=\"V-99547\" selected=\"true\" /><select idref=\"V-99549\" selected=\"true\" /><select idref=\"V-99551\" selected=\"true\" /><select idref=\"V-99553\" selected=\"true\" /><select idref=\"V-99555\" selected=\"true\" /><select idref=\"V-99557\" selected=\"true\" /><select idref=\"V-99559\" selected=\"true\" /><select idref=\"V-99561\" selected=\"true\" /><select idref=\"V-99563\" selected=\"true\" /><select idref=\"V-100093\" selected=\"true\" /><select idref=\"V-102611\" selected=\"true\" /><select idref=\"V-102617\" selected=\"true\" /><select idref=\"V-102627\" selected=\"true\" /></Profile><Profile id=\"MAC-3_Public\"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-63319\" selected=\"true\" /><select idref=\"V-63321\" selected=\"true\" /><select idref=\"V-63323\" selected=\"true\" /><select idref=\"V-63325\" selected=\"true\" /><select idref=\"V-63329\" selected=\"true\" /><select idref=\"V-63333\" selected=\"true\" /><select idref=\"V-63335\" selected=\"true\" /><select idref=\"V-63337\" selected=\"true\" /><select idref=\"V-63339\" selected=\"true\" /><select idref=\"V-63341\" selected=\"true\" /><select idref=\"V-63343\" selected=\"true\" /><select idref=\"V-63345\" selected=\"true\" /><select idref=\"V-63347\" selected=\"true\" /><select idref=\"V-63349\" selected=\"true\" /><select idref=\"V-63351\" selected=\"true\" /><select idref=\"V-63353\" selected=\"true\" /><select idref=\"V-63355\" selected=\"true\" /><select idref=\"V-63357\" selected=\"true\" /><select idref=\"V-63359\" selected=\"true\" /><select idref=\"V-63361\" selected=\"true\" /><select idref=\"V-63363\" selected=\"true\" /><select idref=\"V-63365\" selected=\"true\" /><select idref=\"V-63367\" selected=\"true\" /><select idref=\"V-63369\" selected=\"true\" /><select idref=\"V-63371\" selected=\"true\" /><select idref=\"V-63373\" selected=\"true\" /><select idref=\"V-63375\" selected=\"true\" /><select idref=\"V-63377\" selected=\"true\" /><select idref=\"V-63381\" selected=\"true\" /><select idref=\"V-63383\" selected=\"true\" /><select idref=\"V-63385\" selected=\"true\" /><select idref=\"V-63389\" selected=\"true\" /><select idref=\"V-63393\" selected=\"true\" /><select idref=\"V-63399\" selected=\"true\" /><select idref=\"V-63403\" selected=\"true\" /><select idref=\"V-63405\" selected=\"true\" /><select idref=\"V-63409\" selected=\"true\" /><select idref=\"V-63413\" selected=\"true\" /><select idref=\"V-63415\" selected=\"true\" /><select idref=\"V-63419\" selected=\"true\" /><select idref=\"V-63421\" selected=\"true\" /><select idref=\"V-63423\" selected=\"true\" /><select idref=\"V-63427\" selected=\"true\" /><select idref=\"V-63429\" selected=\"true\" /><select idref=\"V-63431\" selected=\"true\" /><select idref=\"V-63435\" selected=\"true\" /><select idref=\"V-63445\" selected=\"true\" /><select idref=\"V-63447\" selected=\"true\" /><select idref=\"V-63449\" selected=\"true\" /><select idref=\"V-63451\" selected=\"true\" /><select idref=\"V-63453\" selected=\"true\" /><select idref=\"V-63457\" selected=\"true\" /><select idref=\"V-63459\" selected=\"true\" /><select idref=\"V-63463\" selected=\"true\" /><select idref=\"V-63467\" selected=\"true\" /><select idref=\"V-63469\" selected=\"true\" /><select idref=\"V-63471\" selected=\"true\" /><select idref=\"V-63473\" selected=\"true\" /><select idref=\"V-63479\" selected=\"true\" /><select idref=\"V-63481\" selected=\"true\" /><select idref=\"V-63483\" selected=\"true\" /><select idref=\"V-63487\" selected=\"true\" /><select idref=\"V-63491\" selected=\"true\" /><select idref=\"V-63499\" selected=\"true\" /><select idref=\"V-63503\" selected=\"true\" /><select idref=\"V-63507\" selected=\"true\" /><select idref=\"V-63513\" selected=\"true\" /><select idref=\"V-63515\" selected=\"true\" /><select idref=\"V-63517\" selected=\"true\" /><select idref=\"V-63519\" selected=\"true\" /><select idref=\"V-63523\" selected=\"true\" /><select idref=\"V-63527\" selected=\"true\" /><select idref=\"V-63533\" selected=\"true\" /><select idref=\"V-63537\" selected=\"true\" /><select idref=\"V-63541\" selected=\"true\" /><select idref=\"V-63545\" selected=\"true\" /><select idref=\"V-63549\" selected=\"true\" /><select idref=\"V-63555\" selected=\"true\" /><select idref=\"V-63559\" selected=\"true\" /><select idref=\"V-63563\" selected=\"true\" /><select idref=\"V-63567\" selected=\"true\" /><select idref=\"V-63569\" selected=\"true\" /><select idref=\"V-63577\" selected=\"true\" /><select idref=\"V-63579\" selected=\"true\" /><select idref=\"V-63581\" selected=\"true\" /><select idref=\"V-63583\" selected=\"true\" /><select idref=\"V-63585\" selected=\"true\" /><select idref=\"V-63587\" selected=\"true\" /><select idref=\"V-63589\" selected=\"true\" /><select idref=\"V-63591\" selected=\"true\" /><select idref=\"V-63593\" selected=\"true\" /><select idref=\"V-63595\" selected=\"true\" /><select idref=\"V-63597\" selected=\"true\" /><select idref=\"V-63599\" selected=\"true\" /><select idref=\"V-63601\" selected=\"true\" /><select idref=\"V-63607\" selected=\"true\" /><select idref=\"V-63609\" selected=\"true\" /><select idref=\"V-63611\" selected=\"true\" /><select idref=\"V-63615\" selected=\"true\" /><select idref=\"V-63617\" selected=\"true\" /><select idref=\"V-63619\" selected=\"true\" /><select idref=\"V-63621\" selected=\"true\" /><select idref=\"V-63623\" selected=\"true\" /><select idref=\"V-63625\" selected=\"true\" /><select idref=\"V-63627\" selected=\"true\" /><select idref=\"V-63629\" selected=\"true\" /><select idref=\"V-63633\" selected=\"true\" /><select idref=\"V-63635\" selected=\"true\" /><select idref=\"V-63639\" selected=\"true\" /><select idref=\"V-63643\" selected=\"true\" /><select idref=\"V-63645\" selected=\"true\" /><select idref=\"V-63647\" selected=\"true\" /><select idref=\"V-63649\" selected=\"true\" /><select idref=\"V-63651\" selected=\"true\" /><select idref=\"V-63653\" selected=\"true\" /><select idref=\"V-63657\" selected=\"true\" /><select idref=\"V-63659\" selected=\"true\" /><select idref=\"V-63661\" selected=\"true\" /><select idref=\"V-63663\" selected=\"true\" /><select idref=\"V-63665\" selected=\"true\" /><select idref=\"V-63667\" selected=\"true\" /><select idref=\"V-63669\" selected=\"true\" /><select idref=\"V-63671\" selected=\"true\" /><select idref=\"V-63673\" selected=\"true\" /><select idref=\"V-63675\" selected=\"true\" /><select idref=\"V-63677\" selected=\"true\" /><select idref=\"V-63679\" selected=\"true\" /><select idref=\"V-63681\" selected=\"true\" /><select idref=\"V-63683\" selected=\"true\" /><select idref=\"V-63685\" selected=\"true\" /><select idref=\"V-63687\" selected=\"true\" /><select idref=\"V-63689\" selected=\"true\" /><select idref=\"V-63691\" selected=\"true\" /><select idref=\"V-63695\" selected=\"true\" /><select idref=\"V-63697\" selected=\"true\" /><select idref=\"V-63699\" selected=\"true\" /><select idref=\"V-63701\" selected=\"true\" /><select idref=\"V-63703\" selected=\"true\" /><select idref=\"V-63709\" selected=\"true\" /><select idref=\"V-63711\" selected=\"true\" /><select idref=\"V-63713\" selected=\"true\" /><select idref=\"V-63717\" selected=\"true\" /><select idref=\"V-63719\" selected=\"true\" /><select idref=\"V-63721\" selected=\"true\" /><select idref=\"V-63729\" selected=\"true\" /><select idref=\"V-63731\" selected=\"true\" /><select idref=\"V-63733\" selected=\"true\" /><select idref=\"V-63737\" selected=\"true\" /><select idref=\"V-63739\" selected=\"true\" /><select idref=\"V-63741\" selected=\"true\" /><select idref=\"V-63743\" selected=\"true\" /><select idref=\"V-63745\" selected=\"true\" /><select idref=\"V-63747\" selected=\"true\" /><select idref=\"V-63749\" selected=\"true\" /><select idref=\"V-63751\" selected=\"true\" /><select idref=\"V-63755\" selected=\"true\" /><select idref=\"V-63759\" selected=\"true\" /><select idref=\"V-63765\" selected=\"true\" /><select idref=\"V-63767\" selected=\"true\" /><select idref=\"V-63795\" selected=\"true\" /><select idref=\"V-63797\" selected=\"true\" /><select idref=\"V-63801\" selected=\"true\" /><select idref=\"V-63803\" selected=\"true\" /><select idref=\"V-63805\" selected=\"true\" /><select idref=\"V-63807\" selected=\"true\" /><select idref=\"V-63811\" selected=\"true\" /><select idref=\"V-63815\" selected=\"true\" /><select idref=\"V-63817\" selected=\"true\" /><select idref=\"V-63819\" selected=\"true\" /><select idref=\"V-63821\" selected=\"true\" /><select idref=\"V-63825\" selected=\"true\" /><select idref=\"V-63827\" selected=\"true\" /><select idref=\"V-63829\" selected=\"true\" /><select idref=\"V-63831\" selected=\"true\" /><select idref=\"V-63839\" selected=\"true\" /><select idref=\"V-63841\" selected=\"true\" /><select idref=\"V-63843\" selected=\"true\" /><select idref=\"V-63845\" selected=\"true\" /><select idref=\"V-63847\" selected=\"true\" /><select idref=\"V-63851\" selected=\"true\" /><select idref=\"V-63853\" selected=\"true\" /><select idref=\"V-63855\" selected=\"true\" /><select idref=\"V-63857\" selected=\"true\" /><select idref=\"V-63859\" selected=\"true\" /><select idref=\"V-63861\" selected=\"true\" /><select idref=\"V-63863\" selected=\"true\" /><select idref=\"V-63865\" selected=\"true\" /><select idref=\"V-63869\" selected=\"true\" /><select idref=\"V-63871\" selected=\"true\" /><select idref=\"V-63873\" selected=\"true\" /><select idref=\"V-63875\" selected=\"true\" /><select idref=\"V-63877\" selected=\"true\" /><select idref=\"V-63879\" selected=\"true\" /><select idref=\"V-63881\" selected=\"true\" /><select idref=\"V-63883\" selected=\"true\" /><select idref=\"V-63889\" selected=\"true\" /><select idref=\"V-63917\" selected=\"true\" /><select idref=\"V-63925\" selected=\"true\" /><select idref=\"V-63927\" selected=\"true\" /><select idref=\"V-63931\" selected=\"true\" /><select idref=\"V-63933\" selected=\"true\" /><select idref=\"V-63935\" selected=\"true\" /><select idref=\"V-63939\" selected=\"true\" /><select idref=\"V-63941\" selected=\"true\" /><select idref=\"V-65681\" selected=\"true\" /><select idref=\"V-68817\" selected=\"true\" /><select idref=\"V-68819\" selected=\"true\" /><select idref=\"V-68845\" selected=\"true\" /><select idref=\"V-68849\" selected=\"true\" /><select idref=\"V-70637\" selected=\"true\" /><select idref=\"V-70639\" selected=\"true\" /><select idref=\"V-71759\" selected=\"true\" /><select idref=\"V-71761\" selected=\"true\" /><select idref=\"V-71763\" selected=\"true\" /><select idref=\"V-71765\" selected=\"true\" /><select idref=\"V-71769\" selected=\"true\" /><select idref=\"V-71771\" selected=\"true\" /><select idref=\"V-72329\" selected=\"true\" /><select idref=\"V-72765\" selected=\"true\" /><select idref=\"V-72767\" selected=\"true\" /><select idref=\"V-72769\" selected=\"true\" /><select idref=\"V-74409\" selected=\"true\" /><select idref=\"V-74411\" selected=\"true\" /><select idref=\"V-74413\" selected=\"true\" /><select idref=\"V-74417\" selected=\"true\" /><select idref=\"V-74699\" selected=\"true\" /><select idref=\"V-74719\" selected=\"true\" /><select idref=\"V-74721\" selected=\"true\" /><select idref=\"V-74723\" selected=\"true\" /><select idref=\"V-74725\" selected=\"true\" /><select idref=\"V-75027\" selected=\"true\" /><select idref=\"V-76505\" selected=\"true\" /><select idref=\"V-77083\" selected=\"true\" /><select idref=\"V-77085\" selected=\"true\" /><select idref=\"V-77091\" selected=\"true\" /><select idref=\"V-77095\" selected=\"true\" /><select idref=\"V-77097\" selected=\"true\" /><select idref=\"V-77101\" selected=\"true\" /><select idref=\"V-77103\" selected=\"true\" /><select idref=\"V-77189\" selected=\"true\" /><select idref=\"V-77191\" selected=\"true\" /><select idref=\"V-77195\" selected=\"true\" /><select idref=\"V-77201\" selected=\"true\" /><select idref=\"V-77205\" selected=\"true\" /><select idref=\"V-77209\" selected=\"true\" /><select idref=\"V-77213\" selected=\"true\" /><select idref=\"V-77217\" selected=\"true\" /><select idref=\"V-77221\" selected=\"true\" /><select idref=\"V-77223\" selected=\"true\" /><select idref=\"V-77227\" selected=\"true\" /><select idref=\"V-77231\" selected=\"true\" /><select idref=\"V-77233\" selected=\"true\" /><select idref=\"V-77235\" selected=\"true\" /><select idref=\"V-77239\" selected=\"true\" /><select idref=\"V-77243\" selected=\"true\" /><select idref=\"V-77245\" selected=\"true\" /><select idref=\"V-77247\" selected=\"true\" /><select idref=\"V-77249\" selected=\"true\" /><select idref=\"V-77255\" selected=\"true\" /><select idref=\"V-77259\" selected=\"true\" /><select idref=\"V-77263\" selected=\"true\" /><select idref=\"V-77267\" selected=\"true\" /><select idref=\"V-77269\" selected=\"true\" /><select idref=\"V-78129\" selected=\"true\" /><select idref=\"V-82137\" selected=\"true\" /><select idref=\"V-82139\" selected=\"true\" /><select idref=\"V-82145\" selected=\"true\" /><select idref=\"V-88203\" selected=\"true\" /><select idref=\"V-94719\" selected=\"true\" /><select idref=\"V-94859\" selected=\"true\" /><select idref=\"V-94861\" selected=\"true\" /><select idref=\"V-99541\" selected=\"true\" /><select idref=\"V-99543\" selected=\"true\" /><select idref=\"V-99545\" selected=\"true\" /><select idref=\"V-99547\" selected=\"true\" /><select idref=\"V-99549\" selected=\"true\" /><select idref=\"V-99551\" selected=\"true\" /><select idref=\"V-99553\" selected=\"true\" /><select idref=\"V-99555\" selected=\"true\" /><select idref=\"V-99557\" selected=\"true\" /><select idref=\"V-99559\" selected=\"true\" /><select idref=\"V-99561\" selected=\"true\" /><select idref=\"V-99563\" selected=\"true\" /><select idref=\"V-100093\" selected=\"true\" /><select idref=\"V-102611\" selected=\"true\" /><select idref=\"V-102617\" selected=\"true\" /><select idref=\"V-102627\" selected=\"true\" /></Profile><Profile id=\"MAC-3_Sensitive\"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-63319\" selected=\"true\" /><select idref=\"V-63321\" selected=\"true\" /><select idref=\"V-63323\" selected=\"true\" /><select idref=\"V-63325\" selected=\"true\" /><select idref=\"V-63329\" selected=\"true\" /><select idref=\"V-63333\" selected=\"true\" /><select idref=\"V-63335\" selected=\"true\" /><select idref=\"V-63337\" selected=\"true\" /><select idref=\"V-63339\" selected=\"true\" /><select idref=\"V-63341\" selected=\"true\" /><select idref=\"V-63343\" selected=\"true\" /><select idref=\"V-63345\" selected=\"true\" /><select idref=\"V-63347\" selected=\"true\" /><select idref=\"V-63349\" selected=\"true\" /><select idref=\"V-63351\" selected=\"true\" /><select idref=\"V-63353\" selected=\"true\" /><select idref=\"V-63355\" selected=\"true\" /><select idref=\"V-63357\" selected=\"true\" /><select idref=\"V-63359\" selected=\"true\" /><select idref=\"V-63361\" selected=\"true\" /><select idref=\"V-63363\" selected=\"true\" /><select idref=\"V-63365\" selected=\"true\" /><select idref=\"V-63367\" selected=\"true\" /><select idref=\"V-63369\" selected=\"true\" /><select idref=\"V-63371\" selected=\"true\" /><select idref=\"V-63373\" selected=\"true\" /><select idref=\"V-63375\" selected=\"true\" /><select idref=\"V-63377\" selected=\"true\" /><select idref=\"V-63381\" selected=\"true\" /><select idref=\"V-63383\" selected=\"true\" /><select idref=\"V-63385\" selected=\"true\" /><select idref=\"V-63389\" selected=\"true\" /><select idref=\"V-63393\" selected=\"true\" /><select idref=\"V-63399\" selected=\"true\" /><select idref=\"V-63403\" selected=\"true\" /><select idref=\"V-63405\" selected=\"true\" /><select idref=\"V-63409\" selected=\"true\" /><select idref=\"V-63413\" selected=\"true\" /><select idref=\"V-63415\" selected=\"true\" /><select idref=\"V-63419\" selected=\"true\" /><select idref=\"V-63421\" selected=\"true\" /><select idref=\"V-63423\" selected=\"true\" /><select idref=\"V-63427\" selected=\"true\" /><select idref=\"V-63429\" selected=\"true\" /><select idref=\"V-63431\" selected=\"true\" /><select idref=\"V-63435\" selected=\"true\" /><select idref=\"V-63445\" selected=\"true\" /><select idref=\"V-63447\" selected=\"true\" /><select idref=\"V-63449\" selected=\"true\" /><select idref=\"V-63451\" selected=\"true\" /><select idref=\"V-63453\" selected=\"true\" /><select idref=\"V-63457\" selected=\"true\" /><select idref=\"V-63459\" selected=\"true\" /><select idref=\"V-63463\" selected=\"true\" /><select idref=\"V-63467\" selected=\"true\" /><select idref=\"V-63469\" selected=\"true\" /><select idref=\"V-63471\" selected=\"true\" /><select idref=\"V-63473\" selected=\"true\" /><select idref=\"V-63479\" selected=\"true\" /><select idref=\"V-63481\" selected=\"true\" /><select idref=\"V-63483\" selected=\"true\" /><select idref=\"V-63487\" selected=\"true\" /><select idref=\"V-63491\" selected=\"true\" /><select idref=\"V-63499\" selected=\"true\" /><select idref=\"V-63503\" selected=\"true\" /><select idref=\"V-63507\" selected=\"true\" /><select idref=\"V-63513\" selected=\"true\" /><select idref=\"V-63515\" selected=\"true\" /><select idref=\"V-63517\" selected=\"true\" /><select idref=\"V-63519\" selected=\"true\" /><select idref=\"V-63523\" selected=\"true\" /><select idref=\"V-63527\" selected=\"true\" /><select idref=\"V-63533\" selected=\"true\" /><select idref=\"V-63537\" selected=\"true\" /><select idref=\"V-63541\" selected=\"true\" /><select idref=\"V-63545\" selected=\"true\" /><select idref=\"V-63549\" selected=\"true\" /><select idref=\"V-63555\" selected=\"true\" /><select idref=\"V-63559\" selected=\"true\" /><select idref=\"V-63563\" selected=\"true\" /><select idref=\"V-63567\" selected=\"true\" /><select idref=\"V-63569\" selected=\"true\" /><select idref=\"V-63577\" selected=\"true\" /><select idref=\"V-63579\" selected=\"true\" /><select idref=\"V-63581\" selected=\"true\" /><select idref=\"V-63583\" selected=\"true\" /><select idref=\"V-63585\" selected=\"true\" /><select idref=\"V-63587\" selected=\"true\" /><select idref=\"V-63589\" selected=\"true\" /><select idref=\"V-63591\" selected=\"true\" /><select idref=\"V-63593\" selected=\"true\" /><select idref=\"V-63595\" selected=\"true\" /><select idref=\"V-63597\" selected=\"true\" /><select idref=\"V-63599\" selected=\"true\" /><select idref=\"V-63601\" selected=\"true\" /><select idref=\"V-63607\" selected=\"true\" /><select idref=\"V-63609\" selected=\"true\" /><select idref=\"V-63611\" selected=\"true\" /><select idref=\"V-63615\" selected=\"true\" /><select idref=\"V-63617\" selected=\"true\" /><select idref=\"V-63619\" selected=\"true\" /><select idref=\"V-63621\" selected=\"true\" /><select idref=\"V-63623\" selected=\"true\" /><select idref=\"V-63625\" selected=\"true\" /><select idref=\"V-63627\" selected=\"true\" /><select idref=\"V-63629\" selected=\"true\" /><select idref=\"V-63633\" selected=\"true\" /><select idref=\"V-63635\" selected=\"true\" /><select idref=\"V-63639\" selected=\"true\" /><select idref=\"V-63643\" selected=\"true\" /><select idref=\"V-63645\" selected=\"true\" /><select idref=\"V-63647\" selected=\"true\" /><select idref=\"V-63649\" selected=\"true\" /><select idref=\"V-63651\" selected=\"true\" /><select idref=\"V-63653\" selected=\"true\" /><select idref=\"V-63657\" selected=\"true\" /><select idref=\"V-63659\" selected=\"true\" /><select idref=\"V-63661\" selected=\"true\" /><select idref=\"V-63663\" selected=\"true\" /><select idref=\"V-63665\" selected=\"true\" /><select idref=\"V-63667\" selected=\"true\" /><select idref=\"V-63669\" selected=\"true\" /><select idref=\"V-63671\" selected=\"true\" /><select idref=\"V-63673\" selected=\"true\" /><select idref=\"V-63675\" selected=\"true\" /><select idref=\"V-63677\" selected=\"true\" /><select idref=\"V-63679\" selected=\"true\" /><select idref=\"V-63681\" selected=\"true\" /><select idref=\"V-63683\" selected=\"true\" /><select idref=\"V-63685\" selected=\"true\" /><select idref=\"V-63687\" selected=\"true\" /><select idref=\"V-63689\" selected=\"true\" /><select idref=\"V-63691\" selected=\"true\" /><select idref=\"V-63695\" selected=\"true\" /><select idref=\"V-63697\" selected=\"true\" /><select idref=\"V-63699\" selected=\"true\" /><select idref=\"V-63701\" selected=\"true\" /><select idref=\"V-63703\" selected=\"true\" /><select idref=\"V-63709\" selected=\"true\" /><select idref=\"V-63711\" selected=\"true\" /><select idref=\"V-63713\" selected=\"true\" /><select idref=\"V-63717\" selected=\"true\" /><select idref=\"V-63719\" selected=\"true\" /><select idref=\"V-63721\" selected=\"true\" /><select idref=\"V-63729\" selected=\"true\" /><select idref=\"V-63731\" selected=\"true\" /><select idref=\"V-63733\" selected=\"true\" /><select idref=\"V-63737\" selected=\"true\" /><select idref=\"V-63739\" selected=\"true\" /><select idref=\"V-63741\" selected=\"true\" /><select idref=\"V-63743\" selected=\"true\" /><select idref=\"V-63745\" selected=\"true\" /><select idref=\"V-63747\" selected=\"true\" /><select idref=\"V-63749\" selected=\"true\" /><select idref=\"V-63751\" selected=\"true\" /><select idref=\"V-63755\" selected=\"true\" /><select idref=\"V-63759\" selected=\"true\" /><select idref=\"V-63765\" selected=\"true\" /><select idref=\"V-63767\" selected=\"true\" /><select idref=\"V-63795\" selected=\"true\" /><select idref=\"V-63797\" selected=\"true\" /><select idref=\"V-63801\" selected=\"true\" /><select idref=\"V-63803\" selected=\"true\" /><select idref=\"V-63805\" selected=\"true\" /><select idref=\"V-63807\" selected=\"true\" /><select idref=\"V-63811\" selected=\"true\" /><select idref=\"V-63815\" selected=\"true\" /><select idref=\"V-63817\" selected=\"true\" /><select idref=\"V-63819\" selected=\"true\" /><select idref=\"V-63821\" selected=\"true\" /><select idref=\"V-63825\" selected=\"true\" /><select idref=\"V-63827\" selected=\"true\" /><select idref=\"V-63829\" selected=\"true\" /><select idref=\"V-63831\" selected=\"true\" /><select idref=\"V-63839\" selected=\"true\" /><select idref=\"V-63841\" selected=\"true\" /><select idref=\"V-63843\" selected=\"true\" /><select idref=\"V-63845\" selected=\"true\" /><select idref=\"V-63847\" selected=\"true\" /><select idref=\"V-63851\" selected=\"true\" /><select idref=\"V-63853\" selected=\"true\" /><select idref=\"V-63855\" selected=\"true\" /><select idref=\"V-63857\" selected=\"true\" /><select idref=\"V-63859\" selected=\"true\" /><select idref=\"V-63861\" selected=\"true\" /><select idref=\"V-63863\" selected=\"true\" /><select idref=\"V-63865\" selected=\"true\" /><select idref=\"V-63869\" selected=\"true\" /><select idref=\"V-63871\" selected=\"true\" /><select idref=\"V-63873\" selected=\"true\" /><select idref=\"V-63875\" selected=\"true\" /><select idref=\"V-63877\" selected=\"true\" /><select idref=\"V-63879\" selected=\"true\" /><select idref=\"V-63881\" selected=\"true\" /><select idref=\"V-63883\" selected=\"true\" /><select idref=\"V-63889\" selected=\"true\" /><select idref=\"V-63917\" selected=\"true\" /><select idref=\"V-63925\" selected=\"true\" /><select idref=\"V-63927\" selected=\"true\" /><select idref=\"V-63931\" selected=\"true\" /><select idref=\"V-63933\" selected=\"true\" /><select idref=\"V-63935\" selected=\"true\" /><select idref=\"V-63939\" selected=\"true\" /><select idref=\"V-63941\" selected=\"true\" /><select idref=\"V-65681\" selected=\"true\" /><select idref=\"V-68817\" selected=\"true\" /><select idref=\"V-68819\" selected=\"true\" /><select idref=\"V-68845\" selected=\"true\" /><select idref=\"V-68849\" selected=\"true\" /><select idref=\"V-70637\" selected=\"true\" /><select idref=\"V-70639\" selected=\"true\" /><select idref=\"V-71759\" selected=\"true\" /><select idref=\"V-71761\" selected=\"true\" /><select idref=\"V-71763\" selected=\"true\" /><select idref=\"V-71765\" selected=\"true\" /><select idref=\"V-71769\" selected=\"true\" /><select idref=\"V-71771\" selected=\"true\" /><select idref=\"V-72329\" selected=\"true\" /><select idref=\"V-72765\" selected=\"true\" /><select idref=\"V-72767\" selected=\"true\" /><select idref=\"V-72769\" selected=\"true\" /><select idref=\"V-74409\" selected=\"true\" /><select idref=\"V-74411\" selected=\"true\" /><select idref=\"V-74413\" selected=\"true\" /><select idref=\"V-74417\" selected=\"true\" /><select idref=\"V-74699\" selected=\"true\" /><select idref=\"V-74719\" selected=\"true\" /><select idref=\"V-74721\" selected=\"true\" /><select idref=\"V-74723\" selected=\"true\" /><select idref=\"V-74725\" selected=\"true\" /><select idref=\"V-75027\" selected=\"true\" /><select idref=\"V-76505\" selected=\"true\" /><select idref=\"V-77083\" selected=\"true\" /><select idref=\"V-77085\" selected=\"true\" /><select idref=\"V-77091\" selected=\"true\" /><select idref=\"V-77095\" selected=\"true\" /><select idref=\"V-77097\" selected=\"true\" /><select idref=\"V-77101\" selected=\"true\" /><select idref=\"V-77103\" selected=\"true\" /><select idref=\"V-77189\" selected=\"true\" /><select idref=\"V-77191\" selected=\"true\" /><select idref=\"V-77195\" selected=\"true\" /><select idref=\"V-77201\" selected=\"true\" /><select idref=\"V-77205\" selected=\"true\" /><select idref=\"V-77209\" selected=\"true\" /><select idref=\"V-77213\" selected=\"true\" /><select idref=\"V-77217\" selected=\"true\" /><select idref=\"V-77221\" selected=\"true\" /><select idref=\"V-77223\" selected=\"true\" /><select idref=\"V-77227\" selected=\"true\" /><select idref=\"V-77231\" selected=\"true\" /><select idref=\"V-77233\" selected=\"true\" /><select idref=\"V-77235\" selected=\"true\" /><select idref=\"V-77239\" selected=\"true\" /><select idref=\"V-77243\" selected=\"true\" /><select idref=\"V-77245\" selected=\"true\" /><select idref=\"V-77247\" selected=\"true\" /><select idref=\"V-77249\" selected=\"true\" /><select idref=\"V-77255\" selected=\"true\" /><select idref=\"V-77259\" selected=\"true\" /><select idref=\"V-77263\" selected=\"true\" /><select idref=\"V-77267\" selected=\"true\" /><select idref=\"V-77269\" selected=\"true\" /><select idref=\"V-78129\" selected=\"true\" /><select idref=\"V-82137\" selected=\"true\" /><select idref=\"V-82139\" selected=\"true\" /><select idref=\"V-82145\" selected=\"true\" /><select idref=\"V-88203\" selected=\"true\" /><select idref=\"V-94719\" selected=\"true\" /><select idref=\"V-94859\" selected=\"true\" /><select idref=\"V-94861\" selected=\"true\" /><select idref=\"V-99541\" selected=\"true\" /><select idref=\"V-99543\" selected=\"true\" /><select idref=\"V-99545\" selected=\"true\" /><select idref=\"V-99547\" selected=\"true\" /><select idref=\"V-99549\" selected=\"true\" /><select idref=\"V-99551\" selected=\"true\" /><select idref=\"V-99553\" selected=\"true\" /><select idref=\"V-99555\" selected=\"true\" /><select idref=\"V-99557\" selected=\"true\" /><select idref=\"V-99559\" selected=\"true\" /><select idref=\"V-99561\" selected=\"true\" /><select idref=\"V-99563\" selected=\"true\" /><select idref=\"V-100093\" selected=\"true\" /><select idref=\"V-102611\" selected=\"true\" /><select idref=\"V-102617\" selected=\"true\" /><select idref=\"V-102627\" selected=\"true\" /></Profile><Group id=\"V-63319\"><title>WN10-00-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77809r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000005</version><title>Domain-joined systems must use Windows 10 Enterprise Edition 64-bit version.</title><description>&lt;VulnDiscussion&gt;Features such as Credential Guard use virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Virtualization based security and Credential Guard are only available with Windows 10 Enterprise 64-bit version.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69237r2_fix\">Use Windows 10 Enterprise 64-bit version for domain-joined systems.</fixtext><fix id=\"F-69237r2_fix\" /><check system=\"C-64053r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify domain-joined systems are using Windows 10 Enterprise Edition 64-bit version.\r\n\r\nFor standalone systems, this is NA.\r\n\r\nOpen \"Settings\".\r\n\r\nSelect \"System\", then \"About\".\r\n\r\nIf \"Edition\" is not \"Windows 10 Enterprise\", this is a finding.\r\n\r\nIf \"System type\" is not \"64-bit operating system…\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-63321\"><title>WN10-CC-000310</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77811r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000310</version><title>Users must be prevented from changing installation options.</title><description>&lt;VulnDiscussion&gt;Installation options for applications are typically controlled by administrators.  This setting prevents users from changing installation options that may bypass security features.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001812</ident><fixtext fixref=\"F-69239r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Installer &gt;&gt; \"Allow user control over installs\" to \"Disabled\".</fixtext><fix id=\"F-69239r1_fix\" /><check system=\"C-64055r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer\\\r\n\r\nValue Name: EnableUserControl\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63323\"><title>WN10-00-000010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77813r6_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000010</version><title>Windows 10 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.</title><description>&lt;VulnDiscussion&gt;Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-71517r1_fix\">For standalone systems, this is NA.\r\n\r\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\r\n\r\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\r\n\r\nEnsure domain-joined systems must have a Trusted Platform Module (TPM) that is configured for use. (Versions 2.0 or 1.2 support Credential Guard.)\r\n\r\nThe TPM must be enabled in the firmware.\r\nRun \"tpm.msc\" for configuration options in Windows.</fixtext><fix id=\"F-71517r1_fix\" /><check system=\"C-94059r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify domain-joined systems have a TPM enabled and ready for use.\r\n\r\nFor standalone systems, this is NA.\r\n\r\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\r\n\r\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\r\n\r\nVerify the system has a TPM and is ready for use.\r\nRun \"tpm.msc\".\r\nReview the sections in the center pane.\r\n\"Status\" must indicate it has been configured with a message such as \"The TPM is ready for use\" or \"The TPM is on and ownership has been taken\".\r\nTPM Manufacturer Information - Specific Version = 2.0 or 1.2\r\n\r\nIf a TPM is not found or is not ready for use, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63325\"><title>WN10-CC-000315</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77815r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-CC-000315</version><title>The Windows Installer Always install with elevated privileges must be disabled.</title><description>&lt;VulnDiscussion&gt;Standard user accounts must not be granted elevated privileges.  Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001812</ident><fixtext fixref=\"F-69243r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Installer &gt;&gt; \"Always install with elevated privileges\" to \"Disabled\".</fixtext><fix id=\"F-69243r1_fix\" /><check system=\"C-64059r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer\\\r\n\r\nValue Name: AlwaysInstallElevated\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63329\"><title>WN10-CC-000320</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77819r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000320</version><title>Users must be notified if a web-based program attempts to install software.</title><description>&lt;VulnDiscussion&gt;Web-based programs may attempt to install malicious software on a system.  Ensuring users are notified if a web-based program attempts to install software allows them to refuse the installation.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69245r1_fix\">The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system.\r\n\r\nIf this needs to be corrected, configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Installer &gt;&gt; \"Prevent Internet Explorer security prompt for Windows Installer scripts\" to \"Not Configured\" or \"Disabled\".</fixtext><fix id=\"F-69245r1_fix\" /><check system=\"C-64061r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system.\r\n\r\nIf the registry value name below does not exist, this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"0\", this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"1\", this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer\\\r\n\r\nValue Name: SafeForScripting\r\n\r\nValue Type: REG_DWORD\r\nValue: 0 (or if the Value Name does not exist)</check-content></check></Rule></Group><Group id=\"V-63333\"><title>WN10-CC-000325</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77823r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000325</version><title>Automatically signing in the last interactive user after a system-initiated restart must be disabled.</title><description>&lt;VulnDiscussion&gt;Windows can be configured to automatically sign the user back in after a Windows Update restart.  Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69251r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Logon Options &gt;&gt; \"Sign-in last interactive user automatically after a system-initiated restart\" to \"Disabled\".</fixtext><fix id=\"F-69251r1_fix\" /><check system=\"C-64067r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\\r\n\r\nValue Name: DisableAutomaticRestartSignOn\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63335\"><title>WN10-CC-000330</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77825r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-CC-000330</version><title>The Windows Remote Management (WinRM) client must not use Basic authentication.</title><description>&lt;VulnDiscussion&gt;Basic authentication uses plain text passwords that could be used to compromise a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000877</ident><fixtext fixref=\"F-69255r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Remote Management (WinRM) &gt;&gt; WinRM Client &gt;&gt; \"Allow Basic authentication\" to \"Disabled\".</fixtext><fix id=\"F-69255r1_fix\" /><check system=\"C-64071r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\WinRM\\Client\\\r\n\r\nValue Name: AllowBasic\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63337\"><title>WN10-00-000030</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77827r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000030</version><title>Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.</title><description>&lt;VulnDiscussion&gt;If data at rest is unencrypted, it is vulnerable to disclosure.  Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls.   Encrypting the data ensures that confidentiality is protected even when the operating system is not running.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001199</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002475</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002476</ident><fixtext fixref=\"F-100987r3_fix\">Enable full disk encryption on all information systems (including SIPRNet) using BitLocker.\r\n\r\nBitLocker, included in Windows, can be enabled in the Control Panel under \"BitLocker Drive Encryption\" as well as other management tools.\r\n\r\nNOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).</fixtext><fix id=\"F-100987r3_fix\" /><check system=\"C-94061r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify all Windows 10 information systems (including SIPRNet) employ BitLocker for full disk encryption.\r\n\r\nFor virtual desktop implementations (VDIs) in which the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\r\n\r\nIf full disk encryption using BitLocker is not implemented, this is a finding.\r\n\r\nVerify BitLocker is turned on for the operating system drive and any fixed data drives.\r\n\r\nOpen \"BitLocker Drive Encryption\" from the Control Panel.\r\n\r\nIf the operating system drive or any fixed data drives have \"Turn on BitLocker\", this is a finding.\r\n\r\nNOTE: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN10-00-000031 and WN10-00-000032).</check-content></check></Rule></Group><Group id=\"V-63339\"><title>WN10-CC-000335</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77829r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000335</version><title>The Windows Remote Management (WinRM) client must not allow unencrypted traffic.</title><description>&lt;VulnDiscussion&gt;Unencrypted remote access to a system can allow sensitive information to be compromised.  Windows remote management connections must be encrypted to prevent this.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002890</ident><ident system=\"http://iase.disa.mil/cci\">CCI-003123</ident><fixtext fixref=\"F-69259r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Remote Management (WinRM) &gt;&gt; WinRM Client &gt;&gt; \"Allow unencrypted traffic\" to \"Disabled\".</fixtext><fix id=\"F-69259r1_fix\" /><check system=\"C-64075r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\WinRM\\Client\\\r\n\r\nValue Name: AllowUnencryptedTraffic\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63341\"><title>WN10-CC-000360</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77831r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000360</version><title>The Windows Remote Management (WinRM) client must not use Digest authentication.</title><description>&lt;VulnDiscussion&gt;Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000877</ident><fixtext fixref=\"F-69263r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Remote Management (WinRM) &gt;&gt; WinRM Client &gt;&gt; \"Disallow Digest authentication\" to \"Enabled\".</fixtext><fix id=\"F-69263r1_fix\" /><check system=\"C-64079r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\WinRM\\Client\\\r\n\r\nValue Name: AllowDigest\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63343\"><title>WN10-00-000025</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77833r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000025</version><title>Windows 10 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).</title><description>&lt;VulnDiscussion&gt;An approved tool for continuous network scanning must be installed and configured to run.\r\n\r\nWithout the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws.\r\n\r\nTo support this requirement, the operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools, as specified in the requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001233</ident><fixtext fixref=\"F-100903r1_fix\">Install DoD approved HBSS software and ensure it is operating continuously.</fixtext><fix id=\"F-100903r1_fix\" /><check system=\"C-93975r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify DoD approved HBSS software is installed, configured, and properly operating. Ask the operator to document the HBSS software installation and configuration.\r\n\r\nIf the operator is not able to provide a documented configuration for an installed HBSS or if the HBSS software is not properly configured, maintained, or used, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63345\"><title>WN10-00-000035</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77835r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000035</version><title>The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.</title><description>&lt;VulnDiscussion&gt;Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities.\r\n\r\nThe organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001774</ident><fixtext fixref=\"F-69267r3_fix\">Configure an application whitelisting program to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.\r\n\r\nConfiguration of whitelisting applications will vary by the program.  AppLocker is a whitelisting application built into Windows 10 Enterprise.\r\n\r\nIf AppLocker is used, it is configured through group policy in Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Application Control Policies &gt;&gt; AppLocker.\r\n\r\nImplementation guidance for AppLocker is available in the NSA paper \"Application Whitelisting using Microsoft AppLocker\" at the following link:\r\n\r\nhttps://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm</fixtext><fix id=\"F-69267r3_fix\" /><check system=\"C-69225r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is applicable to unclassified systems; for other systems this is NA.\r\n\r\nVerify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. This must include packaged apps such as the universals apps installed by default on systems.\r\n\r\nIf an application whitelisting program is not in use on the system, this is a finding.\r\n\r\nConfiguration of whitelisting applications will vary by the program.\r\n\r\nAppLocker is a whitelisting application built into Windows 10 Enterprise.  A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules.\r\n\r\nIf AppLocker is used, perform the following to view the configuration of AppLocker:\r\nRun \"PowerShell\".\r\n\r\nExecute the following command, substituting [c:\\temp\\file.xml] with a location and file name appropriate for the system:\r\nGet-AppLockerPolicy -Effective -XML &gt; c:\\temp\\file.xml\r\n\r\nThis will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review.\r\n\r\nImplementation guidance for AppLocker is available in the NSA paper \"Application Whitelisting using Microsoft AppLocker\" at the following link:\r\n\r\nhttps://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm</check-content></check></Rule></Group><Group id=\"V-63347\"><title>WN10-CC-000345</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77837r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-CC-000345</version><title>The Windows Remote Management (WinRM) service must not use Basic authentication.</title><description>&lt;VulnDiscussion&gt;Basic authentication uses plain text passwords that could be used to compromise a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000877</ident><fixtext fixref=\"F-69265r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Remote Management (WinRM) &gt;&gt; WinRM Service &gt;&gt; \"Allow Basic authentication\" to \"Disabled\".</fixtext><fix id=\"F-69265r1_fix\" /><check system=\"C-64081r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\WinRM\\Service\\\r\n\r\nValue Name: AllowBasic\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63349\"><title>WN10-00-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77839r11_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-00-000040</version><title>Windows 10 systems must be maintained at a supported servicing level.</title><description>&lt;VulnDiscussion&gt;Windows 10 is maintained by Microsoft at servicing levels for specific periods of time to support Windows as a Service. Systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities which leaves them subject to exploitation.\r\n\r\nNew versions with feature updates are planned to be released on a semi-annual basis with an estimated support timeframe of 18 to 30 months depending on the release. Support for previously released versions has been extended for Enterprise editions.\r\n\r\nA separate servicing branch intended for special purpose systems is the Long-Term Servicing Channel (LTSC, formerly Branch - LTSB) which will receive security updates for 10 years but excludes feature updates.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-98031r3_fix\">Update systems on the Semi-Annual Channel to \"Microsoft Windows Version 1709 (OS Build 16299.0)\" or greater.\r\n\r\nIt is recommended systems be upgraded to the most recently released version.\r\n\r\nSpecial purpose systems using the Long-Term Servicing Branch\\Channel (LTSC\\B) may be at the following versions:\r\n\r\nv1507 (Build 10240)\r\nv1607 (Build 14393)\r\nv1809 (Build 17763)</fixtext><fix id=\"F-98031r3_fix\" /><check system=\"C-94063r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Run \"winver.exe\".\r\n\r\nIf the \"About Windows\" dialog box does not display:\r\n\r\n\"Microsoft Windows Version 1803 (OS Build 17134.0)\"\r\n\r\nor greater, this is a finding.\r\n\r\nNote: Microsoft has extended support for previous versions providing critical and important updates for Windows 10 Enterprise.\r\n\r\nMicrosoft scheduled end of support dates for current Semi-Annual Channel versions:\r\nv1709 - 13 October 2020\r\nv1803 - 10 November 2020\r\nv1809 - 13 April 2021\r\nv1903 - 8 December 2020\r\n\r\nNo preview versions will be used in a production environment.\r\n\r\nSpecial purpose systems using the Long-Term Servicing Branch\\Channel (LTSC\\B) may be at following versions which are not a finding:\r\n\r\nv1507 (Build 10240)\r\nv1607 (Build 14393)\r\nv1809 (Build 17763)</check-content></check></Rule></Group><Group id=\"V-63351\"><title>WN10-00-000045</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77841r4_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-00-000045</version><title>The Windows 10 system must use an anti-virus program.</title><description>&lt;VulnDiscussion&gt;Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-83183r1_fix\">Install an anti-virus solution on the system.</fixtext><fix id=\"F-83183r1_fix\" /><check system=\"C-76169r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution.\r\n\r\nIf there is no anti-virus solution installed on the system, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63353\"><title>WN10-00-000050</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77843r2_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-00-000050</version><title>Local volumes must be formatted using NTFS.</title><description>&lt;VulnDiscussion&gt;The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system.  To support this, volumes must be formatted using the NTFS file system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000213</ident><fixtext fixref=\"F-69273r1_fix\">Format all local volumes to use NTFS.</fixtext><fix id=\"F-69273r1_fix\" /><check system=\"C-73999r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Run \"Computer Management\".\r\nNavigate to Storage &gt;&gt; Disk Management.\r\n\r\nIf the \"File System\" column does not indicate \"NTFS\" for each volume assigned a drive letter, this is a finding.\r\n\r\nThis does not apply to system partitions such the Recovery and EFI System Partition.</check-content></check></Rule></Group><Group id=\"V-63355\"><title>WN10-00-000055</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77845r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000055</version><title>Alternate operating systems must not be permitted on the same system.</title><description>&lt;VulnDiscussion&gt;Allowing other operating systems to run on a secure system may allow security to be circumvented.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69275r1_fix\">Ensure Windows 10 is the only operating system on a device.  Remove alternate operating systems.</fixtext><fix id=\"F-69275r1_fix\" /><check system=\"C-64093r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the system does not include other operating system installations.\r\n\r\nRun \"Advanced System Settings\".\r\nSelect the \"Advanced\" tab.\r\nClick the \"Settings\" button in the \"Startup and Recovery\" section.\r\n\r\nIf the drop-down list box \"Default operating system:\" shows any operating system other than Windows 10, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63357\"><title>WN10-00-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77847r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000060</version><title>Non system-created file shares on a system must limit access to groups that require it.</title><description>&lt;VulnDiscussion&gt;Shares which provide network access, should not typically exist on a workstation except for system-created administrative shares, and could potentially expose sensitive information.  If a share is necessary, share permissions, as well as NTFS permissions, must be reconfigured to give the minimum access to those accounts that require it.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001090</ident><fixtext fixref=\"F-69277r1_fix\">If a non system-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it.\r\n\r\nRemove any unnecessary non-system created shares.</fixtext><fix id=\"F-69277r1_fix\" /><check system=\"C-64095r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Non system-created shares should not typically exist on workstations.\r\n\r\nIf only system-created shares exist on the system this is NA.\r\n\r\nRun \"Computer Management\".\r\nNavigate to System Tools &gt;&gt; Shared Folders &gt;&gt; Shares.\r\n\r\nIf the only shares listed are \"ADMIN$\", \"C$\" and \"IPC$\", this is NA.\r\n(Selecting Properties for system-created shares will display a message that it has been shared for administrative purposes.)\r\n\r\nRight click any non-system-created shares.\r\nSelect \"Properties\".\r\nSelect the \"Share Permissions\" tab.\r\n\r\nVerify the necessity of any shares found.\r\nIf the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.\r\n\r\nSelect the \"Security\" tab.\r\n\r\nIf the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63359\"><title>WN10-00-000065</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77849r1_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-00-000065</version><title>Unused accounts must be disabled or removed from the system after 35 days of inactivity.</title><description>&lt;VulnDiscussion&gt;Outdated or unused accounts provide penetration points that may go undetected.  Inactive accounts must be deleted if no longer necessary or, if still required, disable until needed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000795</ident><fixtext fixref=\"F-69279r1_fix\">Regularly review local accounts and verify their necessity.  Disable or delete any active accounts that have not been used in the last 35 days.</fixtext><fix id=\"F-69279r1_fix\" /><check system=\"C-64097r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Run \"PowerShell\".\r\nCopy the lines below to the PowerShell window and enter.\r\n\r\n\"([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach {\r\n   $user = ([ADSI]$_.Path)\r\n   $lastLogin = $user.Properties.LastLogin.Value\r\n   $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2\r\n   if ($lastLogin -eq $null) {\r\n      $lastLogin = 'Never'\r\n   }\r\n   Write-Host $user.Name $lastLogin $enabled \r\n}\"\r\n\r\nThis will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False).\r\nFor example: User1  10/31/2015  5:49:56  AM  True\r\n\r\nReview the list to determine the finding validity for each account reported.\r\n\r\nExclude the following accounts:\r\nBuilt-in administrator account (Disabled, SID ending in 500)\r\nBuilt-in guest account (Disabled, SID ending in 501)\r\nBuilt-in DefaultAccount (Disabled, SID ending in 503)\r\nLocal administrator account\r\n\r\nIf any enabled accounts have not been logged on to within the past 35 days, this is a finding.\r\n\r\nInactive accounts that have been reviewed and deemed to be required must be documented with the ISSO.</check-content></check></Rule></Group><Group id=\"V-63361\"><title>WN10-00-000070</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77851r2_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-00-000070</version><title>Only accounts responsible for the administration of a system must have Administrator rights on the system.</title><description>&lt;VulnDiscussion&gt;An account that does not have Administrator duties must not have Administrator rights.  Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack.\r\n\r\nSystem administrators must log on to systems only using accounts with the minimum level of authority necessary.\r\n\r\nFor domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group (see V-36434 in the Active Directory Domain STIG).  Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks.\r\n\r\nStandard user accounts must not be members of the local administrators group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-88437r1_fix\">Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group.\r\n\r\nFor domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.\r\n\r\nRemove any standard user accounts.</fixtext><fix id=\"F-88437r1_fix\" /><check system=\"C-81365r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Run \"Computer Management\".\r\nNavigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Groups.\r\nReview the members of the Administrators group.\r\nOnly the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.\r\n\r\nFor domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.\r\n\r\nStandard user accounts must not be members of the local administrator group.\r\n\r\nIf prohibited accounts are members of the local administrators group, this is a finding.\r\n\r\nThe built-in Administrator account or other required administrative accounts would not be a finding.</check-content></check></Rule></Group><Group id=\"V-63363\"><title>WN10-00-000075</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77853r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000075</version><title>Only accounts responsible for the backup operations must be members of the Backup Operators group.</title><description>&lt;VulnDiscussion&gt;Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it.  Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes.  Members of the Backup Operators group must have separate logon accounts for performing backup duties.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69283r1_fix\">Create separate accounts for backup operations for users with this privilege.</fixtext><fix id=\"F-69283r1_fix\" /><check system=\"C-64101r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Run \"Computer Management\".\r\nNavigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Groups.\r\nReview the members of the Backup Operators group.\r\n\r\nIf the group contains no accounts, this is not a finding.\r\n\r\nIf the group contains any accounts, the accounts must be specifically for backup functions.\r\n\r\nIf the group contains any standard user accounts used for performing normal user tasks, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63365\"><title>WN10-00-000080</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77855r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000080</version><title>Only authorized user accounts must be allowed to create or run virtual machines on Windows 10 systems.</title><description>&lt;VulnDiscussion&gt;Allowing other operating systems to run on a secure system may allow users to circumvent security. For Hyper-V, preventing unauthorized users from being assigned to the Hyper-V Administrators group will prevent them from accessing or creating virtual machines on the system. The Hyper-V Hypervisor is used by Virtualization Based Security features such as Credential Guard on Windows 10; however, it is not the full Hyper-V installation.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-100933r1_fix\">For Hyper-V, remove any unauthorized groups or user accounts from the \"Hyper-V Administrators\" group.\r\n\r\nFor hosted hypervisors other than Hyper-V, restrict access to create or run virtual machines to authorized user accounts only.</fixtext><fix id=\"F-100933r1_fix\" /><check system=\"C-94005r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If a hosted hypervisor (Hyper-V, VMware Workstation, etc.) is installed on the system, verify only authorized user accounts are allowed to run virtual machines.\r\n\r\nFor Hyper-V, Run \"Computer Management\".\r\nNavigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Groups.\r\nDouble click on \"Hyper-V Administrators\".\r\n\r\nIf any unauthorized groups or user accounts are listed in \"Members:\", this is a finding.\r\n\r\nFor hosted hypervisors other than Hyper-V, verify only authorized user accounts have access to run the virtual machines. Restrictions may be enforced by access to the physical system, software restriction policies, or access restrictions built in to the application.\r\n\r\nIf any unauthorized groups or user accounts have access to create or run virtual machines, this is a finding.\r\n\r\nAll users authorized to create or run virtual machines must be documented with the ISSM/ISSO. Accounts nested within group accounts must be documented as individual accounts and not the group accounts.</check-content></check></Rule></Group><Group id=\"V-63367\"><title>WN10-00-000085</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77857r2_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-00-000085</version><title>Standard local user accounts must not exist on a system in a domain.</title><description>&lt;VulnDiscussion&gt;To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain.  Users must log onto workstations in a domain with their domain accounts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69287r1_fix\">Limit local user accounts on domain-joined systems.  Remove any unauthorized local accounts.</fixtext><fix id=\"F-69287r1_fix\" /><check system=\"C-80207r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Run \"Computer Management\".\r\nNavigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Users.\r\n\r\nIf local users other than the accounts listed below exist on a workstation in a domain, this is a finding.\r\n\r\nBuilt-in Administrator account (Disabled)\r\nBuilt-in Guest account (Disabled)\r\nBuilt-in DefaultAccount (Disabled)\r\nBuilt-in defaultuser0 (Disabled)\r\nBuilt-in WDAGUtilityAccount (Disabled)\r\nLocal administrator account(s)\r\n\r\nAll of the built-in accounts may not exist on a system, depending on the Windows 10 version.</check-content></check></Rule></Group><Group id=\"V-63369\"><title>WN10-CC-000350</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77859r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000350</version><title>The Windows Remote Management (WinRM) service must not allow unencrypted traffic.</title><description>&lt;VulnDiscussion&gt;Unencrypted remote access to a system can allow sensitive information to be compromised.  Windows remote management connections must be encrypted to prevent this.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002890</ident><ident system=\"http://iase.disa.mil/cci\">CCI-003123</ident><fixtext fixref=\"F-69289r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Remote Management (WinRM) &gt;&gt; WinRM Service &gt;&gt; \"Allow unencrypted traffic\" to \"Disabled\".</fixtext><fix id=\"F-69289r1_fix\" /><check system=\"C-64109r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\WinRM\\Service\\\r\n\r\nValue Name: AllowUnencryptedTraffic\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63371\"><title>WN10-00-000090</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77861r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000090</version><title>Accounts must be configured to require password expiration.</title><description>&lt;VulnDiscussion&gt;Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000199</ident><fixtext fixref=\"F-69291r1_fix\">Configure all passwords to expire.\r\nRun \"Computer Management\".\r\nNavigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Users.\r\nDouble click each active account.\r\nEnsure \"Password never expires\" is not checked on all active accounts.</fixtext><fix id=\"F-69291r1_fix\" /><check system=\"C-64111r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Run \"Computer Management\".\r\nNavigate to System Tools &gt;&gt; Local Users and Groups &gt;&gt; Users.\r\nDouble click each active account.\r\n\r\nIf \"Password never expires\" is selected for any account, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63373\"><title>WN10-00-000095</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77863r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000095</version><title>Permissions for system files and directories must conform to minimum requirements.</title><description>&lt;VulnDiscussion&gt;Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002165</ident><fixtext fixref=\"F-69295r1_fix\">Maintain the default file system permissions and configure the Security Option: \"Network access: Let everyone permissions apply to anonymous users\" to \"Disabled\" (WN10-SO-000160).</fixtext><fix id=\"F-69295r1_fix\" /><check system=\"C-77003r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>The default file system permissions are adequate when the Security Option \"Network access: Let Everyone permissions apply to anonymous users\" is set to \"Disabled\" (WN10-SO-000160).\r\n\r\nIf the default file system permissions are maintained and the referenced option is set to \"Disabled\", this is not a finding.\r\n\r\nVerify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read &amp; execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)\r\n\r\nViewing in File Explorer:\r\nSelect the \"Security\" tab, and the \"Advanced\" button.\r\n\r\nC:\\\r\nType - \"Allow\" for all\r\nInherited from - \"None\" for all\r\nPrincipal - Access - Applies to\r\nAdministrators - Full control - This folder, subfolders and files\r\nSYSTEM - Full control - This folder, subfolders and files\r\nUsers - Read &amp; execute - This folder, subfolders and files\r\nAuthenticated Users - Modify - Subfolders and files only\r\nAuthenticated Users - Create folders / append data - This folder only\r\n\r\n\\Program Files\r\nType - \"Allow\" for all\r\nInherited from - \"None\" for all\r\nPrincipal - Access - Applies to\r\nTrustedInstaller - Full control - This folder and subfolders\r\nSYSTEM - Modify - This folder only\r\nSYSTEM - Full control - Subfolders and files only\r\nAdministrators - Modify - This folder only\r\nAdministrators - Full control - Subfolders and files only\r\nUsers - Read &amp; execute - This folder, subfolders and files\r\nCREATOR OWNER - Full control - Subfolders and files only\r\nALL APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files\r\nALL RESTRICTED APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files\r\n\r\n\\Windows\r\nType - \"Allow\" for all\r\nInherited from - \"None\" for all\r\nPrincipal - Access - Applies to\r\nTrustedInstaller - Full control - This folder and subfolders\r\nSYSTEM - Modify - This folder only\r\nSYSTEM - Full control - Subfolders and files only\r\nAdministrators - Modify - This folder only\r\nAdministrators - Full control - Subfolders and files only\r\nUsers - Read &amp; execute - This folder, subfolders and files\r\nCREATOR OWNER - Full control - Subfolders and files only\r\nALL APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files\r\nALL RESTRICTED APPLICATION PACKAGES - Read &amp; execute - This folder, subfolders and files\r\n\r\nAlternately use icacls.\r\n\r\nRun \"CMD\" as administrator.\r\nEnter \"icacls\" followed by the directory.\r\n\r\nicacls c:\\\r\nicacls \"c:\\program files\"\r\nicacls c:\\windows\r\n\r\nThe following results will be displayed as each is entered:\r\n\r\nc:\\\r\nBUILTIN\\Administrators:(OI)(CI)(F)\r\nNT AUTHORITY\\SYSTEM:(OI)(CI)(F)\r\nBUILTIN\\Users:(OI)(CI)(RX)\r\nNT AUTHORITY\\Authenticated Users:(OI)(CI)(IO)(M)\r\nNT AUTHORITY\\Authenticated Users:(AD)\r\nMandatory Label\\High Mandatory Level:(OI)(NP)(IO)(NW)\r\nSuccessfully processed 1 files; Failed processing 0 files\r\n\r\nc:\\program files \r\nNT SERVICE\\TrustedInstaller:(F)\r\nNT SERVICE\\TrustedInstaller:(CI)(IO)(F)\r\nNT AUTHORITY\\SYSTEM:(M)\r\nNT AUTHORITY\\SYSTEM:(OI)(CI)(IO)(F)\r\nBUILTIN\\Administrators:(M)\r\nBUILTIN\\Administrators:(OI)(CI)(IO)(F)\r\nBUILTIN\\Users:(RX)\r\nBUILTIN\\Users:(OI)(CI)(IO)(GR,GE)\r\nCREATOR OWNER:(OI)(CI)(IO)(F)\r\nAPPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES:(RX)\r\nAPPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\r\nAPPLICATION PACKAGE AUTHORITY\\ALL RESTRICTED APPLICATION PACKAGES:(RX)\r\nAPPLICATION PACKAGE AUTHORITY\\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\r\nSuccessfully processed 1 files; Failed processing 0 files\r\n\r\nc:\\windows\r\nNT SERVICE\\TrustedInstaller:(F)\r\nNT SERVICE\\TrustedInstaller:(CI)(IO)(F)\r\nNT AUTHORITY\\SYSTEM:(M)\r\nNT AUTHORITY\\SYSTEM:(OI)(CI)(IO)(F)\r\nBUILTIN\\Administrators:(M)\r\nBUILTIN\\Administrators:(OI)(CI)(IO)(F)\r\nBUILTIN\\Users:(RX)\r\nBUILTIN\\Users:(OI)(CI)(IO)(GR,GE)\r\nCREATOR OWNER:(OI)(CI)(IO)(F)\r\nAPPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES:(RX)\r\nAPPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\r\nAPPLICATION PACKAGE AUTHORITY\\ALL RESTRICTED APPLICATION PACKAGES:(RX)\r\nAPPLICATION PACKAGE AUTHORITY\\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)\r\nSuccessfully processed 1 files; Failed processing 0 files</check-content></check></Rule></Group><Group id=\"V-63375\"><title>WN10-CC-000355</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77865r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000355</version><title>The Windows Remote Management (WinRM) service must not store RunAs credentials.</title><description>&lt;VulnDiscussion&gt;Storage of administrative credentials could allow unauthorized access.  Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002038</ident><fixtext fixref=\"F-69293r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Remote Management (WinRM) &gt;&gt; WinRM Service &gt;&gt; \"Disallow WinRM from storing RunAs credentials\" to \"Enabled\".</fixtext><fix id=\"F-69293r1_fix\" /><check system=\"C-64113r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\WinRM\\Service\\\r\n\r\nValue Name: DisableRunAs\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63377\"><title>WN10-00-000100</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77867r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-00-000100</version><title>Internet Information System (IIS) or its subcomponents must not be installed on a workstation.</title><description>&lt;VulnDiscussion&gt;Installation of Internet Information System (IIS) may allow unauthorized internet services to be hosted.  Websites must only be hosted on servers that have been designed for that purpose and can be adequately secured.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-69297r1_fix\">Uninstall \"Internet Information Services\" or \"Internet Information Services Hostable Web Core\" from the system.</fixtext><fix id=\"F-69297r1_fix\" /><check system=\"C-64117r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>IIS is not installed by default.  Verify it has not been installed on the system.\r\n\r\nRun \"Programs and Features\".\r\nSelect \"Turn Windows features on or off\".\r\n\r\nIf the entries for \"Internet Information Services\" or \"Internet Information Services Hostable Web Core\" are selected, this is a finding.\r\n\r\nIf an application requires IIS or a subset to be installed to function, this needs be documented with the ISSO.  In addition, any applicable requirements from the IIS STIG must be addressed.</check-content></check></Rule></Group><Group id=\"V-63381\"><title>WN10-00-000105</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77871r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000105</version><title>Simple Network Management Protocol (SNMP) must not be installed on the system.</title><description>&lt;VulnDiscussion&gt;Some protocols and services do not support required security features, such as encrypting passwords or traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000382</ident><fixtext fixref=\"F-69301r1_fix\">Uninstall \"Simple Network Management Protocol (SNMP)\" from the system.\r\n\r\nRun \"Programs and Features\".\r\nSelect \"Turn Windows Features on or off\".\r\nDe-select \"Simple Network Management Protocol (SNMP)\".</fixtext><fix id=\"F-69301r1_fix\" /><check system=\"C-64121r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>\"SNMP\" is not installed by default.  Verify it has not been installed.\r\n\r\nNavigate to the Windows\\System32 directory.\r\n\r\nIf the \"SNMP\" application exists, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63383\"><title>WN10-00-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77873r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000110</version><title>Simple TCP/IP Services must not be installed on the system.</title><description>&lt;VulnDiscussion&gt;Some protocols and services do not support required security features, such as encrypting passwords or traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-69305r1_fix\">Uninstall \"Simple TCPIP Services (i.e. echo, daytime etc)\" from the system.\r\n\r\nRun \"Programs and Features\".\r\nSelect \"Turn Windows Features on or off\".\r\nDe-select \"Simple TCPIP Services (i.e. echo, daytime etc)\".</fixtext><fix id=\"F-69305r1_fix\" /><check system=\"C-64125r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>\"Simple TCP/IP Services\" is not installed by default.  Verify it has not been installed.\r\n\r\nRun \"Services.msc\".\r\n\r\nIf \"Simple TCP/IP Services\" is listed, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63385\"><title>WN10-00-000115</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77875r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000115</version><title>The Telnet Client must not be installed on the system.</title><description>&lt;VulnDiscussion&gt;Some protocols and services do not support required security features, such as encrypting passwords or traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000382</ident><fixtext fixref=\"F-69307r1_fix\">Uninstall \"Telnet Client\" from the system.\r\n\r\nRun \"Programs and Features\".\r\nSelect \"Turn Windows Features on or off\".\r\n\r\nDe-select \"Telnet Client\".</fixtext><fix id=\"F-69307r1_fix\" /><check system=\"C-64127r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>The \"Telnet Client\" is not installed by default.  Verify it has not been installed.\r\n\r\nNavigate to the Windows\\System32 directory.\r\n\r\nIf the \"telnet\" application exists, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63389\"><title>WN10-00-000120</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77879r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000120</version><title>The TFTP Client must not be installed on the system.</title><description>&lt;VulnDiscussion&gt;Some protocols and services do not support required security features, such as encrypting passwords or traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000382</ident><fixtext fixref=\"F-69313r1_fix\">Uninstall \"TFTP Client\" from the system.\r\n\r\nRun \"Programs and Features\".\r\nSelect \"Turn Windows Features on or off\".\r\n\r\nDe-select \"TFTP Client\".</fixtext><fix id=\"F-69313r1_fix\" /><check system=\"C-64133r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>The \"TFTP Client\" is not installed by default.  Verify it has not been installed.\r\n\r\nNavigate to the Windows\\System32 directory.\r\n\r\nIf the \"TFTP\" application exists, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63393\"><title>WN10-00-000130</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77883r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000130</version><title>Software certificate installation files must be removed from Windows 10.</title><description>&lt;VulnDiscussion&gt;Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-100989r1_fix\">Remove any certificate installation files (*.p12 and *.pfx) found on a system.\r\n\r\nNote: This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or Adobe PreFlight certificate files.</fixtext><fix id=\"F-100989r1_fix\" /><check system=\"C-94065r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Search all drives for *.p12 and *.pfx files.\r\n\r\nIf any files with these extensions exist, this is a finding.\r\n\r\nThis does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager) or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.</check-content></check></Rule></Group><Group id=\"V-63399\"><title>WN10-00-000135</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77889r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000135</version><title>A host-based firewall must be installed and enabled on the system.</title><description>&lt;VulnDiscussion&gt;A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69327r1_fix\">Install and enable a host-based firewall on the system.</fixtext><fix id=\"F-69327r1_fix\" /><check system=\"C-64147r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Determine if a host-based firewall is installed and enabled on the system.  If a host-based firewall is not installed and enabled on the system, this is a finding.\r\n\r\nThe configuration requirements will be determined by the applicable firewall STIG.</check-content></check></Rule></Group><Group id=\"V-63403\"><title>WN10-00-000140</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77893r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000140</version><title>Inbound exceptions to the firewall on Windows 10 domain workstations must only allow authorized remote management hosts.</title><description>&lt;VulnDiscussion&gt;Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised.  Limiting inbound connections only from authorized remote management systems will help limit this exposure.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-100991r1_fix\">Configure firewall exceptions to inbound connections on domain workstations to include only authorized remote management hosts.\r\n\r\nConfigure only inbound connection exceptions for authorized remote management hosts.\r\nComputer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Windows Defender Firewall with Advanced Security &gt;&gt; Windows Defender Firewall with Advanced Security &gt;&gt; Inbound Rules (this link will be in the right pane)\r\n\r\nFor any inbound rules that allow connections, configure the Scope for Remote IP address to those of authorized remote management hosts. This may be defined as an IP address, subnet or range. Apply the rule to all firewall profiles.\r\n\r\nIf a third-party firewall is used, configure inbound exceptions to only include authorized remote management hosts.</fixtext><fix id=\"F-100991r1_fix\" /><check system=\"C-94067r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts.\r\n\r\nIf allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding.\r\n\r\nReview inbound firewall exceptions.\r\nComputer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Windows Defender Firewall with Advanced Security &gt;&gt; Windows Defender Firewall with Advanced Security &gt;&gt; Inbound Rules (this link will be in the right pane)\r\n\r\nFor any inbound rules that allow connections view the Scope for Remote IP address. This may be defined as an IP address, subnet, or range. The rule must apply to all firewall profiles.\r\n\r\nIf a third-party firewall is used, ensure comparable settings are in place.</check-content></check></Rule></Group><Group id=\"V-63405\"><title>WN10-AC-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77895r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AC-000005</version><title>Windows 10 account lockout duration must be configured to 15 minutes or greater.</title><description>&lt;VulnDiscussion&gt;The account lockout feature, when enabled, prevents brute-force password attacks on the system.   This parameter specifies the amount of time that an account will remain locked after the specified number of failed logon attempts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002238</ident><fixtext fixref=\"F-81277r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Account Lockout Policy &gt;&gt; \"Account lockout duration\" to \"15\" minutes or greater.\r\n\r\nA value of \"0\" is also acceptable, requiring an administrator to unlock the account.</fixtext><fix id=\"F-81277r1_fix\" /><check system=\"C-74549r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Account Lockout Policy.\r\n\r\nIf the \"Account lockout duration\" is less than \"15\" minutes (excluding \"0\"), this is a finding.\r\n\r\nConfiguring this to \"0\", requiring an administrator to unlock the account, is more restrictive and is not a finding.</check-content></check></Rule></Group><Group id=\"V-63409\"><title>WN10-AC-000010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77899r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AC-000010</version><title>The number of allowed bad logon attempts must be configured to 3 or less.</title><description>&lt;VulnDiscussion&gt;The account lockout feature, when enabled, prevents brute-force password attacks on the system.  The higher this value is, the less effective the account lockout feature will be in protecting the local system.  The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000044</ident><fixtext fixref=\"F-69337r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Account Lockout Policy &gt;&gt; \"Account lockout threshold\" to \"3\" or less invalid logon attempts (excluding \"0\" which is unacceptable).</fixtext><fix id=\"F-69337r1_fix\" /><check system=\"C-64157r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Account Lockout Policy.\r\n\r\nIf the \"Account lockout threshold\" is \"0\" or more than \"3\" attempts, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63413\"><title>WN10-AC-000015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77903r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AC-000015</version><title>The period of time before the bad logon counter is reset must be configured to 15 minutes.</title><description>&lt;VulnDiscussion&gt;The account lockout feature, when enabled, prevents brute-force password attacks on the system.  This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to 0.  The smaller this value is, the less effective the account lockout feature will be in protecting the local system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000044</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002238</ident><fixtext fixref=\"F-69341r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Account Lockout Policy &gt;&gt; \"Reset account lockout counter after\" to \"15\" minutes.</fixtext><fix id=\"F-69341r1_fix\" /><check system=\"C-64161r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Account Lockout Policy.\r\n\r\nIf the \"Reset account lockout counter after\" value is less than \"15\" minutes, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63415\"><title>WN10-AC-000020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77905r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AC-000020</version><title>The password history must be configured to 24 passwords remembered.</title><description>&lt;VulnDiscussion&gt;A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change a password to a unique password on a regularly scheduled basis.  This enables users to effectively negate the purpose of mandating periodic password changes.  The default value is 24 for Windows domain systems.  DoD has decided this is the appropriate value for all Windows systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000200</ident><fixtext fixref=\"F-69343r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Password Policy &gt;&gt; \"Enforce password history\" to \"24\" passwords remembered.</fixtext><fix id=\"F-69343r1_fix\" /><check system=\"C-64163r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Password Policy.\r\n\r\nIf the value for \"Enforce password history\" is less than \"24\" passwords remembered, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63419\"><title>WN10-AC-000025</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77909r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AC-000025</version><title>The maximum password age must be configured to 60 days or less.</title><description>&lt;VulnDiscussion&gt;The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords.   Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000199</ident><fixtext fixref=\"F-69347r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Password Policy &gt;&gt; \"Maximum Password Age\" to \"60\" days or less (excluding \"0\" which is unacceptable).</fixtext><fix id=\"F-69347r1_fix\" /><check system=\"C-64167r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Password Policy.\r\n\r\nIf the value for the \"Maximum password age\" is greater than \"60\" days, this is a finding.  If the value is set to \"0\" (never expires), this is a finding.</check-content></check></Rule></Group><Group id=\"V-63421\"><title>WN10-AC-000030</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77911r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AC-000030</version><title>The minimum password age must be configured to at least 1 day.</title><description>&lt;VulnDiscussion&gt;Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database.  This enables users to effectively negate the purpose of mandating periodic password changes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000198</ident><fixtext fixref=\"F-69349r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Password Policy &gt;&gt; \"Minimum Password Age\" to at least \"1\" day.</fixtext><fix id=\"F-69349r1_fix\" /><check system=\"C-64169r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Password Policy.\r\n\r\nIf the value for the \"Minimum password age\" is less than \"1\" day, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63423\"><title>WN10-AC-000035</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77913r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AC-000035</version><title>Passwords must, at a minimum, be 14 characters.</title><description>&lt;VulnDiscussion&gt;Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000205</ident><fixtext fixref=\"F-69351r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Password Policy &gt;&gt; \"Minimum password length\" to \"14\" characters.</fixtext><fix id=\"F-69351r1_fix\" /><check system=\"C-64171r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Password Policy.\r\n\r\nIf the value for the \"Minimum password length,\" is less than \"14\" characters, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63427\"><title>WN10-AC-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77917r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AC-000040</version><title>The built-in Microsoft password complexity filter must be enabled.</title><description>&lt;VulnDiscussion&gt;The use of complex passwords increases their strength against guessing and brute-force attacks.  This setting configures the system to verify that newly created passwords conform to the Windows password complexity policy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000192</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000193</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000194</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001619</ident><fixtext fixref=\"F-69355r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Password Policy &gt;&gt; \"Password must meet complexity requirements\" to \"Enabled\".</fixtext><fix id=\"F-69355r1_fix\" /><check system=\"C-64175r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Password Policy.\r\n\r\nIf the value for \"Password must meet complexity requirements\" is not set to \"Enabled\", this is a finding.\r\n\r\nIf the site is using a password filter that requires this setting be set to \"Disabled\" for the filter to be used, this would not be considered a finding.</check-content></check></Rule></Group><Group id=\"V-63429\"><title>WN10-AC-000045</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77919r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-AC-000045</version><title>Reversible password encryption must be disabled.</title><description>&lt;VulnDiscussion&gt;Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords. For this reason, this policy must never be enabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000196</ident><fixtext fixref=\"F-69357r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Password Policy &gt;&gt; \"Store passwords using reversible encryption\" to \"Disabled\".</fixtext><fix id=\"F-69357r1_fix\" /><check system=\"C-64177r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Account Policies &gt;&gt; Password Policy.\r\n\r\nIf the value for \"Store password using reversible encryption\" is not set to \"Disabled\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-63431\"><title>WN10-AU-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77921r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000005</version><title>The system must be configured to audit Account Logon - Credential Validation failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nCredential validation records events related to validation tests on credentials for a user account logon.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69359r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Account Logon &gt;&gt; \"Audit Credential Validation\" with \"Failure\" selected.</fixtext><fix id=\"F-69359r1_fix\" /><check system=\"C-64181r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\r\n\r\nAccount Logon &gt;&gt; Credential Validation - Failure</check-content></check></Rule></Group><Group id=\"V-63435\"><title>WN10-AU-000010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77925r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000010</version><title>The system must be configured to audit Account Logon - Credential Validation successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nCredential validation records events related to validation tests on credentials for a user account logon.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69363r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Account Logon &gt;&gt; \"Audit Credential Validation\" with \"Success\" selected.</fixtext><fix id=\"F-69363r1_fix\" /><check system=\"C-64183r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nAccount Logon &gt;&gt; Credential Validation - Success</check-content></check></Rule></Group><Group id=\"V-63445\"><title>WN10-AU-000030</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77935r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000030</version><title>The system must be configured to audit Account Management - Security Group Management successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nSecurity Group Management records events such as creating, deleting or changing of security groups, including changes in group members.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000018</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001403</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001404</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001405</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002130</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002234</ident><fixtext fixref=\"F-69373r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Account Management &gt;&gt; \"Audit Security Group Management\" with \"Success\" selected.</fixtext><fix id=\"F-69373r1_fix\" /><check system=\"C-64193r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nAccount Management &gt;&gt; Security Group Management - Success</check-content></check></Rule></Group><Group id=\"V-63447\"><title>WN10-AU-000035</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77937r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000035</version><title>The system must be configured to audit Account Management - User Account Management failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nUser Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000018</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001403</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001404</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001405</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002130</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002234</ident><fixtext fixref=\"F-69375r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Account Management &gt;&gt; \"Audit User Account Management\" with \"Failure\" selected.</fixtext><fix id=\"F-69375r1_fix\" /><check system=\"C-64195r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nAccount Management &gt;&gt; User Account Management - Failure</check-content></check></Rule></Group><Group id=\"V-63449\"><title>WN10-AU-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77939r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000040</version><title>The system must be configured to audit Account Management - User Account Management successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nUser Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000018</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001403</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001404</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001405</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002130</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002234</ident><fixtext fixref=\"F-69377r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Account Management &gt;&gt; \"Audit User Account Management\" with \"Success\" selected.</fixtext><fix id=\"F-69377r1_fix\" /><check system=\"C-64197r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nAccount Management &gt;&gt; User Account Management - Success</check-content></check></Rule></Group><Group id=\"V-63451\"><title>WN10-AU-000045</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77941r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000045</version><title>The system must be configured to audit Detailed Tracking - PNP Activity successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nPlug and Play activity records events related to the successful connection of external devices.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69379r1_fix\">Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Detailed Tracking &gt;&gt; \"Audit PNP Activity\" with \"Success\" selected.</fixtext><fix id=\"F-69379r1_fix\" /><check system=\"C-64199r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\"\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nDetailed Tracking &gt;&gt; Plug and Play Events - Success</check-content></check></Rule></Group><Group id=\"V-63453\"><title>WN10-AU-000050</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77943r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000050</version><title>The system must be configured to audit Detailed Tracking - Process Creation successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nProcess creation records events related to the creation of a process and the source.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69381r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Detailed Tracking &gt;&gt; \"Audit Process Creation\" with \"Success\" selected.</fixtext><fix id=\"F-69381r1_fix\" /><check system=\"C-64201r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nDetailed Tracking &gt;&gt; Process Creation - Success</check-content></check></Rule></Group><Group id=\"V-63457\"><title>WN10-AU-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77947r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000060</version><title>The system must be configured to audit Logon/Logoff - Group Membership successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAudit Group Membership records information related to the group membership of a user's logon token.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69385r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Logon/Logoff &gt;&gt; \"Audit Group Membership\" with \"Success\" selected.</fixtext><fix id=\"F-69385r2_fix\" /><check system=\"C-64205r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\"\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nLogon/Logoff &gt;&gt; Group Membership - Success</check-content></check></Rule></Group><Group id=\"V-63459\"><title>WN10-AU-000065</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77951r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000065</version><title>The system must be configured to audit Logon/Logoff - Logoff successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nLogoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000067</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69387r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Logon/Logoff &gt;&gt; \"Audit Logoff\" with \"Success\" selected.</fixtext><fix id=\"F-69387r1_fix\" /><check system=\"C-64207r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nLogon/Logoff &gt;&gt; Logoff - Success</check-content></check></Rule></Group><Group id=\"V-63463\"><title>WN10-AU-000070</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77953r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000070</version><title>The system must be configured to audit Logon/Logoff - Logon failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nLogon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000067</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69391r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Logon/Logoff &gt;&gt; \"Audit Logon\" with \"Failure\" selected.</fixtext><fix id=\"F-69391r1_fix\" /><check system=\"C-64211r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nLogon/Logoff &gt;&gt; Logon - Failure</check-content></check></Rule></Group><Group id=\"V-63467\"><title>WN10-AU-000075</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77957r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000075</version><title>The system must be configured to audit Logon/Logoff - Logon successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nLogon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000067</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69395r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Logon/Logoff &gt;&gt; \"Audit Logon\" with \"Success\" selected.</fixtext><fix id=\"F-69395r1_fix\" /><check system=\"C-64215r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nLogon/Logoff &gt;&gt; Logon - Success</check-content></check></Rule></Group><Group id=\"V-63469\"><title>WN10-AU-000080</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77959r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000080</version><title>The system must be configured to audit Logon/Logoff - Special Logon successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nSpecial Logon records special logons which have administrative privileges and can be used to elevate processes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69399r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Logon/Logoff &gt;&gt; \"Audit Special Logon\" with \"Success\" selected.</fixtext><fix id=\"F-69399r1_fix\" /><check system=\"C-64219r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nLogon/Logoff &gt;&gt; Special Logon - Success</check-content></check></Rule></Group><Group id=\"V-63471\"><title>WN10-AU-000085</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77961r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000085</version><title>The system must be configured to audit Object Access - Removable Storage failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAuditing object access for removable media records events related to access attempts on file system objects on removable storage devices.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69401r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Object Access &gt;&gt; \"Audit Removable Storage\" with \"Failure\" selected.</fixtext><fix id=\"F-69401r1_fix\" /><check system=\"C-79559r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\"\r\n\r\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\r\n\r\nObject Access &gt;&gt; Removable Storage - Failure\r\n\r\nSome virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.  This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.</check-content></check></Rule></Group><Group id=\"V-63473\"><title>WN10-AU-000090</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77963r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000090</version><title>The system must be configured to audit Object Access - Removable Storage successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAuditing object access for removable media records events related to access attempts on file system objects on removable storage devices.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69403r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Object Access &gt;&gt; \"Audit Removable Storage\" with \"Success\" selected.</fixtext><fix id=\"F-69403r1_fix\" /><check system=\"C-79561r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\"\r\n\r\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\r\n\r\nObject Access &gt;&gt; Removable Storage - Success\r\n\r\nSome virtual machines may generate excessive audit events for access to the virtual hard disk itself when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.  This must be documented with the ISSO to include mitigations such as monitoring or restricting any actual removable storage connected to the VM.</check-content></check></Rule></Group><Group id=\"V-63479\"><title>WN10-AU-000100</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77969r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000100</version><title>The system must be configured to audit Policy Change - Audit Policy Change successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAudit Policy Change records events related to changes in audit policy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69409r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Policy Change &gt;&gt; \"Audit Audit Policy Change\" with \"Success\" selected.</fixtext><fix id=\"F-69409r2_fix\" /><check system=\"C-64229r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nPolicy Change &gt;&gt; Audit Policy Change - Success</check-content></check></Rule></Group><Group id=\"V-63481\"><title>WN10-AU-000105</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77971r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000105</version><title>The system must be configured to audit Policy Change - Authentication Policy Change successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAuthentication Policy Change records events related to changes in authentication policy including Kerberos policy and Trust changes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002234</ident><fixtext fixref=\"F-69411r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Policy Change &gt;&gt; \"Audit Authentication Policy Change\" with \"Success\" selected.</fixtext><fix id=\"F-69411r1_fix\" /><check system=\"C-64231r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nPolicy Change &gt;&gt; Authentication Policy Change - Success</check-content></check></Rule></Group><Group id=\"V-63483\"><title>WN10-AU-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77973r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000110</version><title>The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nSensitive Privilege Use records events related to use of sensitive privileges, such as \"Act as part of the operating system\" or \"Debug programs\".&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002234</ident><fixtext fixref=\"F-69413r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Privilege Use &gt;&gt; \"Audit Sensitive Privilege Use\" with \"Failure\" selected.</fixtext><fix id=\"F-69413r1_fix\" /><check system=\"C-64235r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nPrivilege Use &gt;&gt; Sensitive Privilege Use - Failure</check-content></check></Rule></Group><Group id=\"V-63487\"><title>WN10-AU-000115</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77977r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000115</version><title>The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nSensitive Privilege Use records events related to use of sensitive privileges, such as \"Act as part of the operating system\" or \"Debug programs\".&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002234</ident><fixtext fixref=\"F-69417r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Privilege Use &gt;&gt; \"Audit Sensitive Privilege Use\" with \"Success\" selected.</fixtext><fix id=\"F-69417r1_fix\" /><check system=\"C-64237r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nPrivilege Use &gt;&gt; Sensitive Privilege Use - Success</check-content></check></Rule></Group><Group id=\"V-63491\"><title>WN10-AU-000120</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77981r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000120</version><title>The system must be configured to audit System - IPSec Driver failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nIPSec Driver records events related to the IPSec Driver such as dropped packets.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69421r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; System &gt;&gt; \"Audit IPSec Driver\" with \"Failure\" selected.</fixtext><fix id=\"F-69421r1_fix\" /><check system=\"C-64241r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nSystem &gt;&gt; IPSec Driver - Failure</check-content></check></Rule></Group><Group id=\"V-63499\"><title>WN10-AU-000130</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77989r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000130</version><title>The system must be configured to audit System - Other System Events successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAudit Other System Events records information related to cryptographic key operations and the Windows Firewall service.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69429r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; System &gt;&gt; \"Audit Other System Events\" with \"Success\" selected.</fixtext><fix id=\"F-69429r2_fix\" /><check system=\"C-64249r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\"\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nSystem &gt;&gt; Other System Events - Success</check-content></check></Rule></Group><Group id=\"V-63503\"><title>WN10-AU-000135</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77993r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000135</version><title>The system must be configured to audit System - Other System Events failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAudit Other System Events records information related to cryptographic key operations and the Windows Firewall service.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-69433r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; System &gt;&gt; \"Audit Other System Events\" with \"Failure\" selected.</fixtext><fix id=\"F-69433r2_fix\" /><check system=\"C-64253r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\"\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nSystem &gt;&gt; Other System Events - Failure</check-content></check></Rule></Group><Group id=\"V-63507\"><title>WN10-AU-000140</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-77997r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000140</version><title>The system must be configured to audit System - Security State Change successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nSecurity State Change records events related to changes in the security state, such as startup and shutdown of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002234</ident><fixtext fixref=\"F-69437r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; System &gt;&gt; \"Audit Security State Change\" with \"Success\" selected.</fixtext><fix id=\"F-69437r1_fix\" /><check system=\"C-64257r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nSystem &gt;&gt; Security State Change - Success</check-content></check></Rule></Group><Group id=\"V-63513\"><title>WN10-AU-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78003r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000150</version><title>The system must be configured to audit System - Security System Extension successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nSecurity System Extension records events related to extension code being loaded by the security subsystem.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002234</ident><fixtext fixref=\"F-69443r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; System &gt;&gt; \"Audit Security System Extension\" with \"Success\" selected.</fixtext><fix id=\"F-69443r1_fix\" /><check system=\"C-64263r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nSystem &gt;&gt; Security System Extension - Success</check-content></check></Rule></Group><Group id=\"V-63515\"><title>WN10-AU-000155</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78005r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000155</version><title>The system must be configured to audit System - System Integrity failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nSystem Integrity records events related to violations of integrity to the security subsystem.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002234</ident><fixtext fixref=\"F-69445r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; System &gt;&gt; \"Audit System Integrity\" with \"Failure\" selected.</fixtext><fix id=\"F-69445r1_fix\" /><check system=\"C-64265r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nSystem &gt;&gt; System Integrity - Failure</check-content></check></Rule></Group><Group id=\"V-63517\"><title>WN10-AU-000160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78007r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000160</version><title>The system must be configured to audit System - System Integrity successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nSystem Integrity records events related to violations of integrity to the security subsystem.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002234</ident><fixtext fixref=\"F-69447r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; System &gt;&gt; \"Audit System Integrity\" with \"Success\" selected.</fixtext><fix id=\"F-69447r1_fix\" /><check system=\"C-64267r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following.  If the system does not audit the following, this is a finding:\r\n\r\nSystem &gt;&gt; System Integrity - Success</check-content></check></Rule></Group><Group id=\"V-63519\"><title>WN10-AU-000500</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78009r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000500</version><title>The Application event log size must be configured to 32768 KB or greater.</title><description>&lt;VulnDiscussion&gt;Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001849</ident><fixtext fixref=\"F-69449r1_fix\">If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\r\n\r\nConfigure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Event Log Service &gt;&gt; Application &gt;&gt; \"Specify the maximum log file size (KB)\" to \"Enabled\" with a \"Maximum Log Size (KB)\" of \"32768\" or greater.</fixtext><fix id=\"F-69449r1_fix\" /><check system=\"C-64269r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive:  HKEY_LOCAL_MACHINE\r\nRegistry Path:  \\SOFTWARE\\Policies\\Microsoft\\Windows\\EventLog\\Application\\\r\n\r\nValue Name:  MaxSize\r\n\r\nValue Type:  REG_DWORD\r\nValue:  0x00008000 (32768) (or greater)</check-content></check></Rule></Group><Group id=\"V-63523\"><title>WN10-AU-000505</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78013r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000505</version><title>The Security event log size must be configured to 1024000 KB or greater.</title><description>&lt;VulnDiscussion&gt;Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001849</ident><fixtext fixref=\"F-86735r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Event Log Service &gt;&gt; Security &gt;&gt; \"Specify the maximum log file size (KB)\" to \"Enabled\" with a \"Maximum Log Size (KB)\" of \"1024000\" or greater.\r\n\r\nIf the system is configured to send audit records directly to an audit server, documented with the ISSO.</fixtext><fix id=\"F-86735r1_fix\" /><check system=\"C-79597r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the system is configured to send audit records directly to an audit server, this is NA. This must be documented with the ISSO.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\EventLog\\Security\\\r\n\r\nValue Name: MaxSize\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x000fa000 (1024000) (or greater)</check-content></check></Rule></Group><Group id=\"V-63527\"><title>WN10-AU-000510</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78017r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000510</version><title>The System event log size must be configured to 32768 KB or greater.</title><description>&lt;VulnDiscussion&gt;Inadequate log size will cause the log to fill up quickly.  This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001849</ident><fixtext fixref=\"F-69457r1_fix\">If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\r\n\r\nConfigure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Event Log Service &gt;&gt; System &gt;&gt; \"Specify the maximum log file size (KB)\" to \"Enabled\" with a \"Maximum Log Size (KB)\" of \"32768\" or greater.</fixtext><fix id=\"F-69457r1_fix\" /><check system=\"C-64277r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the system is configured to send audit records directly to an audit server, this is NA.  This must be documented with the ISSO.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive:  HKEY_LOCAL_MACHINE\r\nRegistry Path:  \\SOFTWARE\\Policies\\Microsoft\\Windows\\EventLog\\System\\\r\n\r\nValue Name:  MaxSize\r\n\r\nValue Type:  REG_DWORD\r\nValue:  0x00008000 (32768) (or greater)</check-content></check></Rule></Group><Group id=\"V-63533\"><title>WN10-AU-000515</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78023r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000515</version><title>Windows 10 permissions for the Application event log must prevent access by non-privileged accounts.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Application event log may be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000162</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000163</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000164</ident><fixtext fixref=\"F-69463r1_fix\">Ensure the permissions on the Application event log (Application.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement.\r\n\r\nEventlog - Full Control\r\nSYSTEM - Full Control\r\nAdministrators - Full Control\r\n\r\nThe default location is the \"%SystemRoot%\\SYSTEM32\\WINEVT\\LOGS\" directory.\r\n\r\nIf the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as \"NT Service\\Eventlog\".</fixtext><fix id=\"F-69463r1_fix\" /><check system=\"C-94069r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the permissions on the Application event log (Application.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.\r\n\r\nEventlog - Full Control\r\nSYSTEM - Full Control\r\nAdministrators - Full Control\r\n\r\nThe default location is the \"%SystemRoot%\\SYSTEM32\\WINEVT\\LOGS\" directory. They may have been moved to another folder.\r\n\r\nIf the permissions for these files are not as restrictive as the ACLs listed, this is a finding.\r\n\r\nNOTE: If \"APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES\" has Special Permissions, this would not be a finding.</check-content></check></Rule></Group><Group id=\"V-63537\"><title>WN10-AU-000520</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78027r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000520</version><title>Windows 10 permissions for the Security event log must prevent access by non-privileged accounts.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The Security event log may disclose sensitive information or be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000162</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000163</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000164</ident><fixtext fixref=\"F-69467r1_fix\">Ensure the permissions on the Security event log (Security.evtx) are configured to prevent standard user accounts or groups from having access.  The default permissions listed below satisfy this requirement.\r\n\r\nEventlog - Full Control\r\nSYSTEM - Full Control\r\nAdministrators - Full Control\r\n\r\nThe default location is the \"%SystemRoot%\\SYSTEM32\\WINEVT\\LOGS\" directory.\r\n\r\nIf the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as \"NT Service\\Eventlog\".</fixtext><fix id=\"F-69467r1_fix\" /><check system=\"C-94071r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the permissions on the Security event log (Security.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.\r\n\r\nEventlog - Full Control\r\nSYSTEM - Full Control\r\nAdministrators - Full Control\r\n\r\nThe default location is the \"%SystemRoot%\\SYSTEM32\\WINEVT\\LOGS\" directory. They may have been moved to another folder.\r\n\r\nIf the permissions for these files are not as restrictive as the ACLs listed, this is a finding.\r\n\r\nNOTE: If \"APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES\" has Special Permissions, this would not be a finding.</check-content></check></Rule></Group><Group id=\"V-63541\"><title>WN10-AU-000525</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78031r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000525</version><title>Windows 10 permissions for the System event log must prevent access by non-privileged accounts.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  The System event log may be  susceptible to tampering if proper permissions are not applied.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000162</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000163</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000164</ident><fixtext fixref=\"F-69471r1_fix\">Ensure the permissions on the System event log (System.evtx) are configured to prevent standard user accounts or groups from having access. The default permissions listed below satisfy this requirement.\r\n\r\nEventlog - Full Control\r\nSYSTEM - Full Control\r\nAdministrators - Full Control\r\n\r\nThe default location is the \"%SystemRoot%\\SYSTEM32\\WINEVT\\LOGS\" directory.\r\n\r\nIf the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as \"NT Service\\Eventlog\".</fixtext><fix id=\"F-69471r1_fix\" /><check system=\"C-94073r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the permissions on the System event log (System.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement.\r\n\r\nEventlog - Full Control\r\nSYSTEM - Full Control\r\nAdministrators - Full Control\r\n\r\nThe default location is the \"%SystemRoot%\\SYSTEM32\\WINEVT\\LOGS\" directory. They may have been moved to another folder.\r\n\r\nIf the permissions for these files are not as restrictive as the ACLs listed, this is a finding.\r\n\r\nNOTE: If \"APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES\" has Special Permissions, this would not be a finding.</check-content></check></Rule></Group><Group id=\"V-63545\"><title>WN10-CC-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78035r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000005</version><title>Camera access from the lock screen must be disabled.</title><description>&lt;VulnDiscussion&gt;Enabling camera access from the lock screen could allow for unauthorized use.  Requiring logon will ensure the device is only used by authorized personnel.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-69475r1_fix\">If the device does not have a camera, this is NA.\r\n\r\nConfigure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Control Panel &gt;&gt; Personalization &gt;&gt; \"Prevent enabling lock screen camera\" to \"Enabled\".</fixtext><fix id=\"F-69475r1_fix\" /><check system=\"C-64295r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the device does not have a camera, this is NA.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization\\\r\n\r\nValue Name: NoLockScreenCamera\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63549\"><title>WN10-CC-000010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78039r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000010</version><title>The display of slide shows on the lock screen must be disabled.</title><description>&lt;VulnDiscussion&gt;Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel.  Turning off this feature will limit access to the information to a logged on user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-69479r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Control Panel &gt;&gt; Personalization &gt;&gt; \"Prevent enabling lock screen slide show\" to \"Enabled\".</fixtext><fix id=\"F-69479r1_fix\" /><check system=\"C-64299r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization\\\r\n\r\nValue Name: NoLockScreenSlideshow\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63555\"><title>WN10-CC-000020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78045r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000020</version><title>IPv6 source routing must be configured to highest protection.</title><description>&lt;VulnDiscussion&gt;Configuring the system to disable IPv6 source routing protects against spoofing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69485r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; MSS (Legacy) &gt;&gt; \"MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)\" to \"Highest protection, source routing is completely disabled\".\r\n\r\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \"MSS-Legacy.admx\" and \" MSS-Legacy.adml\" must be copied to the \\Windows\\PolicyDefinitions and \\Windows\\PolicyDefinitions\\en-US directories respectively.</fixtext><fix id=\"F-69485r1_fix\" /><check system=\"C-64305r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\\r\n\r\nValue Name: DisableIpSourceRouting\r\n\r\nValue Type: REG_DWORD\r\nValue: 2</check-content></check></Rule></Group><Group id=\"V-63559\"><title>WN10-CC-000025</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78049r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000025</version><title>The system must be configured to prevent IP source routing.</title><description>&lt;VulnDiscussion&gt;Configuring the system to disable IP source routing protects against spoofing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69489r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; MSS (Legacy) &gt;&gt; \"MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)\" to \"Highest protection, source routing is completely disabled\".\r\n\r\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \"MSS-Legacy.admx\" and \" MSS-Legacy.adml\" must be copied to the \\Windows\\PolicyDefinitions and \\Windows\\PolicyDefinitions\\en-US directories respectively.</fixtext><fix id=\"F-69489r1_fix\" /><check system=\"C-64309r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\\r\n\r\nValue Name: DisableIPSourceRouting\r\n\r\nValue Type: REG_DWORD\r\nValue: 2</check-content></check></Rule></Group><Group id=\"V-63563\"><title>WN10-CC-000030</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78053r1_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-CC-000030</version><title>The system must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF) generated routes.</title><description>&lt;VulnDiscussion&gt;Allowing ICMP redirect of routes can lead to traffic not being routed properly.   When disabled, this forces ICMP to be routed via shortest path first.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69493r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; MSS (Legacy) &gt;&gt; \"MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes\" to \"Disabled\".\r\n\r\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \"MSS-Legacy.admx\" and \" MSS-Legacy.adml\" must be copied to the \\Windows\\PolicyDefinitions and \\Windows\\PolicyDefinitions\\en-US directories respectively.</fixtext><fix id=\"F-69493r1_fix\" /><check system=\"C-64313r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\\r\n\r\nValue Name: EnableICMPRedirect\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63567\"><title>WN10-CC-000035</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78057r1_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-CC-000035</version><title>The system must be configured to ignore NetBIOS name release requests except from WINS servers.</title><description>&lt;VulnDiscussion&gt;Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002385</ident><fixtext fixref=\"F-69497r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; MSS (Legacy) &gt;&gt; \"MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers\" to \"Enabled\".\r\n\r\nThis policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package.  \"MSS-Legacy.admx\" and \" MSS-Legacy.adml\" must be copied to the \\Windows\\PolicyDefinitions and \\Windows\\PolicyDefinitions\\en-US directories respectively.</fixtext><fix id=\"F-69497r1_fix\" /><check system=\"C-64317r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive:  HKEY_LOCAL_MACHINE\r\nRegistry Path:  \\SYSTEM\\CurrentControlSet\\Services\\Netbt\\Parameters\\\r\n\r\nValue Name:  NoNameReleaseOnDemand\r\n\r\nValue Type:  REG_DWORD\r\nValue:  1</check-content></check></Rule></Group><Group id=\"V-63569\"><title>WN10-CC-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78059r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000040</version><title>Insecure logons to an SMB server must be disabled.</title><description>&lt;VulnDiscussion&gt;Insecure guest logons allow unauthenticated access to shared folders.  Shared resources on a system must require authentication to establish proper access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69499r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Network &gt;&gt; Lanman Workstation &gt;&gt; \"Enable insecure guest logons\" to \"Disabled\".</fixtext><fix id=\"F-69499r2_fix\" /><check system=\"C-81357r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\LanmanWorkstation\\\r\n\r\nValue Name: AllowInsecureGuestAuth\r\n\r\nType: REG_DWORD\r\nValue: 0x00000000 (0)</check-content></check></Rule></Group><Group id=\"V-63577\"><title>WN10-CC-000050</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78067r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000050</version><title>Hardened UNC Paths must be defined to require mutual authentication and integrity for at least the \\\\*\\SYSVOL and \\\\*\\NETLOGON shares.</title><description>&lt;VulnDiscussion&gt;Additional security requirements are applied to Universal Naming Convention (UNC) paths specified in Hardened UNC paths before allowing access them.  This aids in preventing tampering with or spoofing of connections to these paths.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69507r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Network &gt;&gt; Network Provider &gt;&gt; \"Hardened UNC Paths\" to \"Enabled\" with at least the following configured in \"Hardened UNC Paths:\" (click the \"Show\" button to display).\r\n\r\nValue Name: \\\\*\\SYSVOL\r\nValue: RequireMutualAuthentication=1, RequireIntegrity=1\r\n\r\nValue Name: \\\\*\\NETLOGON\r\nValue: RequireMutualAuthentication=1, RequireIntegrity=1</fixtext><fix id=\"F-69507r1_fix\" /><check system=\"C-64327r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This requirement is applicable to domain-joined systems, for standalone systems this is NA.\r\n\r\nIf the following registry values do not exist or are not configured as specified, this is a finding.\r\n\r\nRegistry Hive:  HKEY_LOCAL_MACHINE\r\nRegistry Path:  \\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkProvider\\HardenedPaths\\\r\n\r\nValue Name:  \\\\*\\NETLOGON\r\nValue Type:  REG_SZ\r\nValue:  RequireMutualAuthentication=1, RequireIntegrity=1\r\n\r\nValue Name:  \\\\*\\SYSVOL\r\nValue Type:  REG_SZ\r\nValue:  RequireMutualAuthentication=1, RequireIntegrity=1\r\n\r\nAdditional entries would not be a finding.</check-content></check></Rule></Group><Group id=\"V-63579\"><title>WN10-PK-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78069r4_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-PK-000005</version><title>The DoD Root CA certificates must be installed in the Trusted Root Store.</title><description>&lt;VulnDiscussion&gt;To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root Certificate Authorities (CAs). The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000185</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002470</ident><fixtext fixref=\"F-87307r1_fix\">Install the DoD Root CA certificates.\r\nDoD Root CA 2\r\nDoD Root CA 3\r\nDoD Root CA 4\r\nDoD Root CA 5\r\n\r\nThe InstallRoot tool is available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.</fixtext><fix id=\"F-87307r1_fix\" /><check system=\"C-80175r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the DoD Root CA certificates are installed as Trusted Root Certification Authorities.\r\n\r\nThe certificates and thumbprints referenced below apply to unclassified systems; see PKE documentation for other networks.\r\n\r\nRun \"PowerShell\" as an administrator.\r\n\r\nExecute the following command:\r\n\r\nGet-ChildItem -Path Cert:Localmachine\\root | Where Subject -Like \"*DoD*\" | FL Subject, Thumbprint, NotAfter\r\n\r\nIf the following certificate \"Subject\" and \"Thumbprint\" information is not displayed, this is finding. \r\n\r\nIf an expired certificate (\"NotAfter\" date) is not listed in the results, this is not a finding.\r\n\r\nSubject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US\r\nThumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561\r\nNotAfter: 12/5/2029\r\n\r\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\r\nThumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB\r\nNotAfter: 12/30/2029\r\n\r\nSubject: CN=DoD Root CA 4, OU=PKI, OU=DoD, O=U.S. Government, C=US\r\nThumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026\r\nNotAfter: 7/25/2032\r\n\r\nSubject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US\r\nThumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B\r\nNotAfter: 6/14/2041\r\n\r\nAlternately use the Certificates MMC snap-in:\r\n\r\nRun \"MMC\".\r\n\r\nSelect \"File\", \"Add/Remove Snap-in\".\r\n\r\nSelect \"Certificates\", click \"Add\".\r\n\r\nSelect \"Computer account\", click \"Next\".\r\n\r\nSelect \"Local computer: (the computer this console is running on)\", click \"Finish\".\r\n\r\nClick \"OK\".\r\n\r\nExpand \"Certificates\" and navigate to \"Trusted Root Certification Authorities &gt;&gt; Certificates\".\r\n\r\nFor each of the DoD Root CA certificates noted below:\r\n\r\nRight-click on the certificate and select \"Open\".\r\n\r\nSelect the \"Details\" Tab.\r\n\r\nScroll to the bottom and select \"Thumbprint\".\r\n\r\nIf the DoD Root CA certificates below are not listed or the value for the \"Thumbprint\" field is not as noted, this is a finding.\r\n\r\nIf an expired certificate (\"Valid to\" date) is not listed in the results, this is not a finding.\r\n\r\nDoD Root CA 2\r\nThumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561\r\nValid to: Wednesday, December 5, 2029\r\n\r\nDoD Root CA 3\r\nThumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB\r\nValid to: Sunday, December 30, 2029\r\n\r\nDoD Root CA 4\r\nThumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026\r\nValid to: Sunday, July 25, 2032\r\n\r\nDoD Root CA 5\r\nThumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B\r\nValid to: Friday, June 14, 2041</check-content></check></Rule></Group><Group id=\"V-63581\"><title>WN10-CC-000055</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78071r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000055</version><title>Simultaneous connections to the Internet or a Windows domain must be limited.</title><description>&lt;VulnDiscussion&gt;Multiple network connections can provide additional attack vectors to a system and must be limited. The \"Minimize the number of simultaneous connections to the Internet or a Windows Domain\" setting prevents systems from automatically establishing multiple connections.  When both wired and wireless connections are available, for example, the less preferred connection (typically wireless) will be disconnected.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69511r1_fix\">The default behavior for \"Minimize the number of simultaneous connections to the Internet or a Windows Domain\" is \"Enabled\".\r\n\r\nIf this needs to be corrected, configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Network &gt;&gt; Windows Connection Manager &gt;&gt; \"Minimize the number of simultaneous connections to the Internet or a Windows Domain\" to \"Enabled\".</fixtext><fix id=\"F-69511r1_fix\" /><check system=\"C-64331r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>The default behavior for \"Minimize the number of simultaneous connections to the Internet or a Windows Domain\" is \"Enabled\".\r\n\r\nIf the registry value name below does not exist, this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"1\", this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"0\", this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\WcmSvc\\GroupPolicy\\\r\n\r\nValue Name: fMinimizeConnections\r\n\r\nValue Type: REG_DWORD\r\nValue: 1 (or if the Value Name does not exist)</check-content></check></Rule></Group><Group id=\"V-63583\"><title>WN10-PK-000010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78073r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-PK-000010</version><title>The External Root CA certificates must be installed in the Trusted Root Store on unclassified systems.</title><description>&lt;VulnDiscussion&gt;To ensure secure websites protected with External Certificate Authority (ECA) server certificates are properly validated, the system must trust the ECA Root CAs. The ECA root certificates will ensure the trust chain is established for server certificates issued from the External CAs. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000185</ident><fixtext fixref=\"F-76981r2_fix\">Install the ECA Root CA certificates on unclassified systems.\r\nECA Root CA 2\r\nECA Root CA 4\r\n\r\nThe InstallRoot tool is available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.</fixtext><fix id=\"F-76981r2_fix\" /><check system=\"C-80177r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the ECA Root CA certificates are installed on unclassified systems as Trusted Root Certification Authorities.\r\n\r\nRun \"PowerShell\" as an administrator.\r\n\r\nExecute the following command:\r\n\r\nGet-ChildItem -Path Cert:Localmachine\\root | Where Subject -Like \"*ECA*\" | FL Subject, Thumbprint, NotAfter\r\n\r\nIf the following certificate \"Subject\" and \"Thumbprint\" information is not displayed, this is finding. \r\n\r\nIf an expired certificate (\"NotAfter\" date) is not listed in the results, this is not a finding.\r\n\r\nSubject: CN=ECA Root CA 2, OU=ECA, O=U.S. Government, C=US\r\nThumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4\r\nNotAfter: 3/30/2028\r\n\r\nSubject: CN=ECA Root CA 4, OU=ECA, O=U.S. Government, C=US\r\nThumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582\r\nNotAfter: 12/30/2029\r\n\r\nAlternately use the Certificates MMC snap-in:\r\n\r\nRun \"MMC\".\r\n\r\nSelect \"File\", \"Add/Remove Snap-in\".\r\n\r\nSelect \"Certificates\", click \"Add\".\r\n\r\nSelect \"Computer account\", click \"Next\".\r\n\r\nSelect \"Local computer: (the computer this console is running on)\", click \"Finish\".\r\n\r\nClick \"OK\".\r\n\r\nExpand \"Certificates\" and navigate to \"Trusted Root Certification Authorities &gt;&gt; Certificates\".\r\n\r\nFor each of the ECA Root CA certificates noted below:\r\n\r\nRight-click on the certificate and select \"Open\".\r\n\r\nSelect the \"Details\" Tab.\r\n\r\nScroll to the bottom and select \"Thumbprint\".\r\n\r\nIf the ECA Root CA certificates below are not listed or the value for the \"Thumbprint\" field is not as noted, this is a finding.\r\n\r\nIf an expired certificate (\"Valid to\" date) is not listed in the results, this is not a finding.\r\n\r\nECA Root CA 2\r\nThumbprint: C313F919A6ED4E0E8451AFA930FB419A20F181E4\r\nValid to: Thursday, March 30, 2028\r\n\r\nECA Root CA 4\r\nThumbprint: 73E8BB08E337D6A5A6AEF90CFFDD97D9176CB582\r\nValid to: Sunday, December 30, 2029</check-content></check></Rule></Group><Group id=\"V-63585\"><title>WN10-CC-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78075r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000060</version><title>Connections to non-domain networks when connected to a domain authenticated network must be blocked.</title><description>&lt;VulnDiscussion&gt;Multiple network connections can provide additional attack vectors to a system and should be limited.  When connected to a domain, communication must go through the domain connection.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69515r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Network &gt;&gt; Windows Connection Manager &gt;&gt; \"Prohibit connection to non-domain networks when connected to domain authenticated network\" to \"Enabled\".</fixtext><fix id=\"F-69515r1_fix\" /><check system=\"C-64335r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\WcmSvc\\GroupPolicy\\\r\n\r\nValue Name: fBlockNonDomain\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63587\"><title>WN10-PK-000015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78077r6_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-PK-000015</version><title>The DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.</title><description>&lt;VulnDiscussion&gt;To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000185</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002470</ident><fixtext fixref=\"F-98441r5_fix\">Install the DoD Interoperability Root CA cross-certificates on unclassified systems.\r\n\r\nIssued To - Issued By - Thumbprint\r\nDoD Root CA 2 - DoD Interoperability Root CA 1 - A8C27332CCB4CA49554CE55D34062A7DD2850C02\r\nDoD Root CA 3 - DoD Interoperability Root CA 2 - AC06108CA348CC03B53795C64BF84403C1DBD341\r\n\r\nThe certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.</fixtext><fix id=\"F-98441r5_fix\" /><check system=\"C-91397r6_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates.\r\n\r\nRun \"PowerShell\" as an administrator.\r\n\r\nExecute the following command:\r\n\r\nGet-ChildItem -Path Cert:Localmachine\\disallowed | Where {$_.Issuer -Like \"*DoD Interoperability*\" -and $_.Subject -Like \"*DoD*\"} | FL Subject, Issuer, Thumbprint, NotAfter\r\n\r\nIf the following certificate \"Subject\", \"Issuer\", and \"Thumbprint\", information is not displayed, this is finding. \r\n\r\nIf an expired certificate (\"NotAfter\" date) is found, this is a finding.\r\n\r\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\r\nIssuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US\r\nThumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341\r\nNotAfter: 1/22/2022\r\n \r\nSubject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US\r\nIssuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US\r\nThumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02\r\nNotAfter: 8/26/2022 \r\n\r\nAlternately use the Certificates MMC snap-in:\r\n\r\nRun \"MMC\".\r\n\r\nSelect \"File\", \"Add/Remove Snap-in\".\r\n\r\nSelect \"Certificates\", click \"Add\".\r\n\r\nSelect \"Computer account\", click \"Next\".\r\n\r\nSelect \"Local computer: (the computer this console is running on)\", click \"Finish\".\r\n\r\nClick \"OK\".\r\n\r\nExpand \"Certificates\" and navigate to \"Untrusted Certificates &gt;&gt; Certificates\".\r\n\r\nFor each certificate with \"DoD Root CA…\" under \"Issued To\" and \"DoD Interoperability Root CA…\" under \"Issued By\":\r\n\r\nRight-click on the certificate and select \"Open\".\r\n\r\nSelect the \"Details\" Tab.\r\n\r\nScroll to the bottom and select \"Thumbprint\".\r\n\r\nIf the certificates below are not listed or the value for the \"Thumbprint\" field is not as noted, this is a finding.\r\n\r\nIf an expired certificate (\"Valid to\" date) is not listed in the results, this is not a finding.\r\n\r\nIssued To: DoD Root CA 2\r\nIssued By: DoD Interoperability Root CA 1\r\nThumbprint: A8C27332CCB4CA49554CE55D34062A7DD2850C02\r\nValid to: Friday, August 26, 2022\r\n\r\nIssued To: DoD Root CA 3\r\nIssued By: DoD Interoperability Root CA 2\r\nThumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341\r\nValid to: Saturday, January 22, 2022</check-content></check></Rule></Group><Group id=\"V-63589\"><title>WN10-PK-000020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78079r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-PK-000020</version><title>The US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.</title><description>&lt;VulnDiscussion&gt;To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000185</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002470</ident><fixtext fixref=\"F-98443r4_fix\">Install the US DoD CCEB Interoperability Root CA cross-certificate on unclassified systems.\r\n\r\nIssued To - Issued By - Thumbprint\r\nDoD Root CA 3 - US DoD CCEB Interoperability Root CA 2 - AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9\r\n\r\nThe certificates can be installed using the InstallRoot tool. The tool and user guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.</fixtext><fix id=\"F-98443r4_fix\" /><check system=\"C-91399r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate.\r\n\r\nRun \"PowerShell\" as an administrator.\r\n\r\nExecute the following command:\r\n\r\nGet-ChildItem -Path Cert:Localmachine\\disallowed | Where Issuer -Like \"*CCEB Interoperability*\" | FL Subject, Issuer, Thumbprint, NotAfter\r\n\r\nIf the following certificate \"Subject\", \"Issuer\", and \"Thumbprint\", information is not displayed, this is finding. \r\n\r\nIf an expired certificate (\"NotAfter\" date) is found, this is a finding.\r\n\r\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\r\nIssuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S.Government, C=US\r\nThumbprint: AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9\r\nNotAfter: 8/26/2022 9:07:50 AM\r\n\r\nAlternately use the Certificates MMC snap-in:\r\n\r\nRun \"MMC\".\r\n\r\nSelect \"File\", \"Add/Remove Snap-in\".\r\n\r\nSelect \"Certificates\", click \"Add\".\r\n\r\nSelect \"Computer account\", click \"Next\".\r\n\r\nSelect \"Local computer: (the computer this console is running on)\", click \"Finish\".\r\n\r\nClick \"OK\".\r\n\r\nExpand \"Certificates\" and navigate to \"Untrusted Certificates &gt;&gt; Certificates\".\r\n\r\nFor each certificate with \"US DoD CCEB Interoperability Root CA …\" under \"Issued By\":\r\n\r\nRight-click on the certificate and select \"Open\".\r\n\r\nSelect the \"Details\" tab.\r\n\r\nScroll to the bottom and select \"Thumbprint\".\r\n\r\nIf the certificate below is not listed or the value for the \"Thumbprint\" field is not as noted, this is a finding.\r\n\r\nIf an expired certificate (\"Valid to\" date) is not listed in the results, this is not a finding.\r\n\r\nSubject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US\r\nIssuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S.Government, C=US\r\nThumbprint: AF132AC65DE86FC4FB3FE51FD637EBA0FF0B12A9\r\nNotAfter: 8/26/2022 9:07:50 AM</check-content></check></Rule></Group><Group id=\"V-63591\"><title>WN10-CC-000065</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78081r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000065</version><title>Wi-Fi Sense must be disabled.</title><description>&lt;VulnDiscussion&gt;Wi-Fi Sense automatically connects the system to known hotspots and networks that contacts have shared.  It also allows the sharing of the system's known networks to contacts.  Automatically connecting to hotspots and shared networks can expose a system to unsecured or potentially malicious systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-88431r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Network &gt;&gt; WLAN Service &gt;&gt; WLAN Settings&gt;&gt; \"Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services\" to \"Disabled\".   \r\n\r\nv1507 LTSB does not include this group policy setting.  It may be configured through other means such as using group policy from a later version of Windows 10 or a registry update.</fixtext><fix id=\"F-88431r2_fix\" /><check system=\"C-81355r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA as of v1803 of Windows 10; Wi-Fi sense is no longer available.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\WcmSvc\\wifinetworkmanager\\config\\\r\n\r\nValue Name: AutoConnectAllowedOEM\r\n\r\nType: REG_DWORD\r\nValue: 0x00000000 (0)</check-content></check></Rule></Group><Group id=\"V-63593\"><title>WN10-RG-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78083r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-RG-000005</version><title>Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.</title><description>&lt;VulnDiscussion&gt;The registry is integral to the function, security, and stability of the Windows system.  Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-98471r1_fix\">Maintain the default permissions for the HKEY_LOCAL_MACHINE registry hive.\r\n\r\nThe default permissions of the higher level keys are noted below.\r\n\r\nHKEY_LOCAL_MACHINE\\SECURITY\r\nType - \"Allow\" for all\r\nInherited from - \"None\" for all\r\nPrincipal - Access - Applies to\r\nSYSTEM - Full Control - This key and subkeys\r\nAdministrators - Special - This key and subkeys\r\n\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\r\nType - \"Allow\" for all\r\nInherited from - \"None\" for all\r\nPrincipal - Access - Applies to\r\nUsers - Read - This key and subkeys\r\nAdministrators - Full Control - This key and subkeys\r\nSYSTEM - Full Control - This key and subkeys\r\nCREATOR OWNER - Full Control - This key and subkeys\r\nALL APPLICATION PACKAGES - Read - This key and subkeys\r\n\r\nHKEY_LOCAL_MACHINE\\SYSTEM\r\nType - \"Allow\" for all\r\nInherited from - \"None\" for all\r\nPrincipal - Access - Applies to\r\nUsers - Read - This key and subkeys\r\nAdministrators - Full Control - This key and subkeys\r\nSYSTEM - Full Control - This key and subkeys\r\nCREATOR OWNER - Full Control - This key and subkeys\r\nALL APPLICATION PACKAGES - Read - This key and subkeys\r\n\r\nMicrosoft has also given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID.\r\n\r\nS-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681</fixtext><fix id=\"F-98471r1_fix\" /><check system=\"C-91427r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the default registry permissions for the keys note below of the HKEY_LOCAL_MACHINE hive.\r\n\r\nIf any non-privileged groups such as Everyone, Users or Authenticated Users have greater than Read permission, this is a finding.\r\n\r\nRun \"Regedit\".\r\nRight click on the registry areas noted below.\r\nSelect \"Permissions...\" and the \"Advanced\" button.\r\n\r\nHKEY_LOCAL_MACHINE\\SECURITY\r\nType - \"Allow\" for all\r\nInherited from - \"None\" for all\r\nPrincipal - Access - Applies to\r\nSYSTEM - Full Control - This key and subkeys\r\nAdministrators - Special - This key and subkeys\r\n\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\r\nType - \"Allow\" for all\r\nInherited from - \"None\" for all\r\nPrincipal - Access - Applies to\r\nUsers - Read - This key and subkeys\r\nAdministrators - Full Control - This key and subkeys\r\nSYSTEM - Full Control - This key and subkeys\r\nCREATOR OWNER - Full Control - This key and subkeys\r\nALL APPLICATION PACKAGES - Read - This key and subkeys\r\n\r\nHKEY_LOCAL_MACHINE\\SYSTEM\r\nType - \"Allow\" for all\r\nInherited from - \"None\" for all\r\nPrincipal - Access - Applies to\r\nUsers - Read - This key and subkeys\r\nAdministrators - Full Control - This key and subkeys\r\nSYSTEM - Full Control - This key and subkeys\r\nCREATOR OWNER - Full Control - This key and subkeys\r\nALL APPLICATION PACKAGES - Read - This key and subkeys\r\n\r\nOther subkeys under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.\r\n\r\nMicrosoft has given Read permission to the SOFTWARE and SYSTEM registry keys in later versions of Windows 10 to the following SID, this is currently not a finding.\r\n\r\nS-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681\r\n\r\nIf the defaults have not been changed, these are not a finding.</check-content></check></Rule></Group><Group id=\"V-63595\"><title>WN10-CC-000070</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78085r6_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-CC-000070</version><title>Virtualization Based Security must be enabled on Windows 10 with the platform security level configured to Secure Boot or Secure Boot with DMA Protection.</title><description>&lt;VulnDiscussion&gt;Virtualization Based Security (VBS) provides the platform for the additional security features, Credential Guard and Virtualization based protection of code integrity.  Secure Boot is the minimum security level with DMA protection providing additional memory protection.  DMA Protection requires a CPU that supports input/output memory management unit (IOMMU).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-74851r3_fix\">Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\r\n\r\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\r\n\r\nConfigure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Device Guard &gt;&gt; \"Turn On Virtualization Based Security\" to \"Enabled\" with \"Secure Boot\" or \"Secure Boot and DMA Protection\" selected for \"Select Platform Security Level:\".\r\n\r\nA Microsoft article on Credential Guard system requirement can be found at the following link.\r\nhttps://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard-requirements</fixtext><fix id=\"F-74851r3_fix\" /><check system=\"C-94075r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Confirm Virtualization Based Security is enabled and running with Secure Boot or Secure Boot and DMA Protection.\r\n\r\nFor those devices that support virtualization based security (VBS) features, including Credential Guard or protection of code integrity, this must be enabled. If the system meets the hardware and firmware dependencies for enabling VBS but it is not enabled, this is a CAT III finding.\r\n\r\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\r\n\r\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\r\n\r\nRun \"PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter the following:\r\n\r\n\"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\\Microsoft\\Windows\\DeviceGuard\"\r\n\r\nIf \"RequiredSecurityProperties\" does not include a value of \"2\" indicating \"Secure Boot\" (e.g., \"{1, 2}\"), this is a finding.\r\n\r\nIf \"Secure Boot and DMA Protection\" is configured, \"3\" will also be displayed in the results (e.g., \"{1, 2, 3}\").\r\n\r\nIf \"VirtualizationBasedSecurityStatus\" is not a value of \"2\" indicating \"Running\", this is a finding.\r\n\r\nAlternately:\r\n\r\nRun \"System Information\".\r\n\r\nUnder \"System Summary\", verify the following:\r\n\r\nIf \"Device Guard Virtualization based security\" does not display \"Running\", this is finding.\r\n\r\nIf \"Device Guard Required Security Properties\" does not display \"Base Virtualization Support, Secure Boot\", this is finding.\r\n\r\nIf \"Secure Boot and DMA Protection\" is configured, \"DMA Protection\" will also be displayed (e.g., \"Base Virtualization Support, Secure Boot, DMA Protection\").\r\n\r\nThe policy settings referenced in the Fix section will configure the following registry values. However due to hardware requirements, the registry values alone do not ensure proper function.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard\\\r\n\r\nValue Name: EnableVirtualizationBasedSecurity\r\nValue Type: REG_DWORD\r\nValue: 1\r\n\r\nValue Name: RequirePlatformSecurityFeatures\r\nValue Type: REG_DWORD\r\nValue: 1 (Secure Boot only) or 3 (Secure Boot and DMA Protection)\r\n\r\nA Microsoft article on Credential Guard system requirement can be found at the following link:\r\n\r\nhttps://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard-requirements\r\n\r\nNOTE:  The severity level for the requirement will be upgraded to CAT II starting January 2020.</check-content></check></Rule></Group><Group id=\"V-63597\"><title>WN10-CC-000037</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78087r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000037</version><title>Local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.</title><description>&lt;VulnDiscussion&gt;A compromised local administrator account can provide means for an attacker to move laterally between domain systems.\r\n\r\nWith User Account Control enabled, filtering the privileged token for built-in administrator accounts will prevent the elevated privileges of these accounts from being used over the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001084</ident><fixtext fixref=\"F-78099r3_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; MS Security Guide &gt;&gt; \"Apply UAC restrictions to local accounts on network logons\" to \"Enabled\".\r\n\r\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package.  \"SecGuide.admx\" and \"SecGuide.adml\" must be copied to the \\Windows\\PolicyDefinitions and \\Windows\\PolicyDefinitions\\en-US directories respectively.</fixtext><fix id=\"F-78099r3_fix\" /><check system=\"C-72029r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the system is not a member of a domain, this is NA.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\\r\n\r\nValue Name: LocalAccountTokenFilterPolicy\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x00000000 (0)</check-content></check></Rule></Group><Group id=\"V-63599\"><title>WN10-CC-000075</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78089r9_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-CC-000075</version><title>Credential Guard must be running on Windows 10 domain-joined systems.</title><description>&lt;VulnDiscussion&gt;Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. This authentication information, which was stored in the Local Security Authority (LSA) in previous versions of Windows, is isolated from the rest of operating system and can only be accessed by privileged system software.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-88433r2_fix\">Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\r\n\r\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\r\n\r\nFor VDIs with persistent desktops, this may be downgraded to a CAT II only where administrators have specific tokens for the VDI. Administrator accounts on virtual desktops must only be used on systems in the VDI; they may not have administrative privileges on any other systems such as servers and physical workstations.\r\n\r\nConfigure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Device Guard &gt;&gt; \"Turn On Virtualization Based Security\" to \"Enabled\" with \"Enabled with UEFI lock\" selected for \"Credential Guard Configuration:\".\r\n\r\nv1507 LTSB does not include selection options; select \"Enable Credential Guard\".\r\n\r\nA Microsoft TechNet article on Credential Guard, including system requirement details, can be found at the following link:\r\n\r\nhttps://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard</fixtext><fix id=\"F-88433r2_fix\" /><check system=\"C-94077r6_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Confirm Credential Guard is running on domain-joined systems.\r\n\r\nFor those devices that support Credential Guard, this feature must be enabled. Organizations need to take the appropriate action to acquire and implement compatible hardware with Credential Guard enabled.\r\n\r\nVirtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.\r\n\r\nFor VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\r\n\r\nRun \"PowerShell\" with elevated privileges (run as administrator).\r\nEnter the following:\r\n\"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\\Microsoft\\Windows\\DeviceGuard\"\r\n\r\nIf \"SecurityServicesRunning\" does not include a value of \"1\" (e.g., \"{1, 2}\"), this is a finding.\r\n\r\nAlternately:\r\n\r\nRun \"System Information\".\r\nUnder \"System Summary\", verify the following:\r\nIf \"Device Guard Security Services Running\" does not list \"Credential Guard\", this is finding.\r\n\r\nThe policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard\\\r\n\r\nValue Name: LsaCfgFlags\r\nValue Type: REG_DWORD\r\nValue: 0x00000001 (1) (Enabled with UEFI lock)\r\n\r\n</check-content></check></Rule></Group><Group id=\"V-63601\"><title>WN10-SO-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78091r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000005</version><title>The built-in administrator account must be disabled.</title><description>&lt;VulnDiscussion&gt;The built-in administrator account is a well-known account subject to attack.  It also provides no accountability to individual administrators on a system.  It must be disabled to prevent its use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000764</ident><fixtext fixref=\"F-69531r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Accounts: Administrator account status\" to \"Disabled\".</fixtext><fix id=\"F-69531r1_fix\" /><check system=\"C-64351r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options.\r\n\r\nIf the value for \"Accounts: Administrator account status\" is not set to \"Disabled\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-63607\"><title>WN10-CC-000085</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78097r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000085</version><title>Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers.</title><description>&lt;VulnDiscussion&gt;By being launched first by the kernel, ELAM ( Early Launch Antimalware) is ensured to be launched before any third-party software, and is therefore able to detect malware in the boot process and prevent it from initializing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69537r5_fix\">Ensure that Early Launch Antimalware - Boot-Start Driver Initialization policy is set to enforce \"Good, unknown and bad but critical\" (preventing \"bad\").\r\n\r\nIf this needs to be corrected configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Early Launch Antimalware &gt;&gt; \"Boot-Start Driver Initialization Policy\" to \"Enabled” with \"Good, unknown and bad but critical\" selected.</fixtext><fix id=\"F-69537r5_fix\" /><check system=\"C-64357r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy is to enforce \"Good, unknown and bad but critical\" (preventing \"bad\").\r\n\r\nIf the registry value name below does not exist, this a finding.\r\n\r\nIf it exists and is configured with a value of \"7\", this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Policies\\EarlyLaunch\\\r\n\r\nValue Name: DriverLoadPolicy\r\n\r\nValue Type: REG_DWORD\r\nValue: 1, 3, or 8 \r\n\r\nPossible values for this setting are:\r\n8 - Good only\r\n1 - Good and unknown\r\n3 - Good, unknown and bad but critical\r\n7 - All (which includes \"Bad\" and would be a finding)\r\n</check-content></check></Rule></Group><Group id=\"V-63609\"><title>WN10-CC-000090</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78099r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000090</version><title>Group Policy objects must be reprocessed even if they have not changed.</title><description>&lt;VulnDiscussion&gt;Enabling this setting and then selecting the \"Process even if the Group Policy objects have not changed\" option ensures that the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69539r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Group Policy &gt;&gt; \"Configure registry policy processing\" to \"Enabled\" and select the option \"Process even if the Group Policy objects have not changed\".</fixtext><fix id=\"F-69539r1_fix\" /><check system=\"C-64359r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\Group Policy\\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\r\n\r\nValue Name: NoGPOListChanges\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63611\"><title>WN10-SO-000010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78101r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000010</version><title>The built-in guest account must be disabled.</title><description>&lt;VulnDiscussion&gt;A system faces an increased vulnerability threat if the built-in guest account is not disabled.  This account is a known account that exists on all Windows systems and cannot be deleted.  This account is initialized during the installation of the operating system with no password assigned.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000804</ident><fixtext fixref=\"F-69541r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Accounts: Guest account status\" to \"Disabled\".</fixtext><fix id=\"F-69541r1_fix\" /><check system=\"C-64361r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options.\r\n\r\nIf the value for \"Accounts: Guest account status\" is not set to \"Disabled\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-63615\"><title>WN10-CC-000100</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78105r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000100</version><title>Downloading print driver packages over HTTP must be prevented.</title><description>&lt;VulnDiscussion&gt;Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents the computer from downloading print driver packages over HTTP.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-69545r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Internet Communication Management &gt;&gt; Internet Communication settings &gt;&gt; \"Turn off downloading of print drivers over HTTP\" to \"Enabled\".</fixtext><fix id=\"F-69545r1_fix\" /><check system=\"C-64365r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\\\r\n\r\nValue Name: DisableWebPnPDownload\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63617\"><title>WN10-SO-000015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78107r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000015</version><title>Local accounts with blank passwords must be restricted to prevent access from the network.</title><description>&lt;VulnDiscussion&gt;An account without a password can allow unauthorized access to a system as only the username would be required.  Password policies should prevent accounts with blank passwords from existing on a system.  However, if a local account with a blank password did exist, enabling this setting will prevent network access, limiting the account to local console logon only.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69547r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Accounts: Limit local account use of blank passwords to console logon only\" to \"Enabled\".</fixtext><fix id=\"F-69547r1_fix\" /><check system=\"C-64367r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\Lsa\\\r\n\r\nValue Name: LimitBlankPasswordUse\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63619\"><title>WN10-SO-000020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78109r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000020</version><title>The built-in administrator account must be renamed.</title><description>&lt;VulnDiscussion&gt;The built-in administrator account is a well-known account subject to attack.  Renaming this account to an unidentified name improves the protection of this account and the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69551r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Accounts: Rename administrator account\" to a name other than \"Administrator\".</fixtext><fix id=\"F-69551r1_fix\" /><check system=\"C-64371r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options.\r\n\r\nIf the value for \"Accounts: Rename administrator account\" is set to \"Administrator\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-63621\"><title>WN10-CC-000105</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78111r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000105</version><title>Web publishing and online ordering wizards must be prevented from downloading a list of providers.</title><description>&lt;VulnDiscussion&gt;Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents Windows from downloading a list of providers for the Web publishing and online ordering wizards.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-69549r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Internet Communication Management &gt;&gt; Internet Communication settings &gt;&gt; \"Turn off Internet download for Web publishing and online ordering wizards\" to \"Enabled\".</fixtext><fix id=\"F-69549r1_fix\" /><check system=\"C-64369r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\\r\n\r\nValue Name: NoWebServices\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63623\"><title>WN10-CC-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78113r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000110</version><title>Printing over HTTP must be prevented.</title><description>&lt;VulnDiscussion&gt;Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-69553r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Internet Communication Management &gt;&gt; Internet Communication settings &gt;&gt; \"Turn off printing over HTTP\" to \"Enabled\".</fixtext><fix id=\"F-69553r1_fix\" /><check system=\"C-64373r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\\\r\n\r\nValue Name: DisableHTTPPrinting\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63625\"><title>WN10-SO-000025</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78115r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000025</version><title>The built-in guest account must be renamed.</title><description>&lt;VulnDiscussion&gt;The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password.  This can allow access to system resources by unauthorized users.  Renaming this account to an unidentified name improves the protection of this account and the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69555r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Accounts: Rename guest account\" to a name other than \"Guest\".</fixtext><fix id=\"F-69555r1_fix\" /><check system=\"C-64375r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options.\r\n\r\nIf the value for \"Accounts: Rename guest account\" is set to \"Guest\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-63627\"><title>WN10-CC-000115</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78117r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000115</version><title>Systems must at least attempt device authentication using certificates.</title><description>&lt;VulnDiscussion&gt;Using certificates to authenticate devices to the domain provides increased security over passwords.  By default systems will attempt to authenticate using certificates and fall back to passwords if the domain controller does not support certificates for devices.  This may also be configured to always use certificates for device authentication.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69557r1_fix\">This requirement is applicable to domain-joined systems, for standalone systems this is NA.\r\n\r\nThe default behavior for \"Support device authentication using certificate\" is \"Automatic\".\r\n\r\nIf this needs to be corrected, configured the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Kerberos &gt;&gt; \"Support device authentication using certificate\" to \"Not Configured or \"Enabled\" with either option selected in \"Device authentication behavior using certificate:\".</fixtext><fix id=\"F-69557r1_fix\" /><check system=\"C-64377r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This requirement is applicable to domain-joined systems, for standalone systems this is NA.\r\n\r\nThe default behavior for \"Support device authentication using certificate\" is \"Automatic\".\r\n\r\nIf the registry value name below does not exist, this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"1\", this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"0\", this is a finding.\r\n\r\nRegistry Hive:  HKEY_LOCAL_MACHINE\r\nRegistry Path:  \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\Parameters\\\r\n\r\nValue Name:  DevicePKInitEnabled\r\nValue Type:  REG_DWORD\r\nValue:  1 (or if the Value Name does not exist)</check-content></check></Rule></Group><Group id=\"V-63629\"><title>WN10-CC-000120</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78119r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000120</version><title>The network selection user interface (UI) must not be displayed on the logon screen.</title><description>&lt;VulnDiscussion&gt;Enabling interaction with the network selection UI allows users to change connections to available networks without signing into Windows.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-69559r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Logon &gt;&gt; \"Do not display network selection UI\" to \"Enabled\".</fixtext><fix id=\"F-69559r1_fix\" /><check system=\"C-64379r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\\r\n\r\nValue Name: DontDisplayNetworkSelectionUI\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63633\"><title>WN10-CC-000130</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78123r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000130</version><title>Local users on domain-joined computers must not be enumerated.</title><description>&lt;VulnDiscussion&gt;The username is one part of logon credentials that could be used to gain access to a system.  Preventing the enumeration of users limits this information to authorized personnel.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-69565r1_fix\">This requirement is applicable to domain-joined systems, for standalone systems this is NA.\r\n\r\nConfigure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Logon &gt;&gt; \"Enumerate local users on domain-joined computers\" to \"Disabled\".</fixtext><fix id=\"F-69565r1_fix\" /><check system=\"C-64385r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This requirement is applicable to domain-joined systems, for standalone systems this is NA.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\\r\n\r\nValue Name: EnumerateLocalUsers\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63635\"><title>WN10-SO-000030</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78125r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000030</version><title>Audit policy using subcategories must be enabled.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks.  Audit logs are necessary to provide a trail of evidence in case the system or network is compromised.  Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.  This setting allows administrators to enable more precise auditing capabilities.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000169</ident><fixtext fixref=\"F-69563r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" to \"Enabled\".</fixtext><fix id=\"F-69563r1_fix\" /><check system=\"C-64383r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\Lsa\\\r\n\r\nValue Name: SCENoApplyLegacyAuditPolicy\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63639\"><title>WN10-SO-000035</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78129r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000035</version><title>Outgoing secure channel traffic must be encrypted or signed.</title><description>&lt;VulnDiscussion&gt;Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted.  If this policy is enabled, outgoing secure channel traffic will be encrypted and signed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002418</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002421</ident><fixtext fixref=\"F-69567r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Domain member: Digitally encrypt or sign secure channel data (always)\" to \"Enabled\".</fixtext><fix id=\"F-69567r1_fix\" /><check system=\"C-64389r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\\r\n\r\nValue Name: RequireSignOrSeal\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63643\"><title>WN10-SO-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78133r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000040</version><title>Outgoing secure channel traffic must be encrypted when possible.</title><description>&lt;VulnDiscussion&gt;Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted.  If this policy is enabled, outgoing secure channel traffic will be encrypted.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002418</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002421</ident><fixtext fixref=\"F-69573r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Domain member: Digitally encrypt secure channel data (when possible)\" to \"Enabled\".</fixtext><fix id=\"F-69573r1_fix\" /><check system=\"C-64393r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\\r\n\r\nValue Name: SealSecureChannel\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63645\"><title>WN10-CC-000145</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78135r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000145</version><title>Users must be prompted for a password on resume from sleep (on battery).</title><description>&lt;VulnDiscussion&gt;Authentication must always be required when accessing a system.  This setting ensures the user is prompted for a password on resume from sleep (on battery).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002038</ident><fixtext fixref=\"F-69575r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Power Management &gt;&gt; Sleep Settings &gt;&gt; \"Require a password when a computer wakes (on battery)\" to \"Enabled\".</fixtext><fix id=\"F-69575r1_fix\" /><check system=\"C-64395r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Power\\PowerSettings\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\\\r\n\r\nValue Name: DCSettingIndex\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63647\"><title>WN10-SO-000045</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78137r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000045</version><title>Outgoing secure channel traffic must be signed when possible.</title><description>&lt;VulnDiscussion&gt;Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked.  If this policy is enabled, outgoing secure channel traffic will be signed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002418</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002421</ident><fixtext fixref=\"F-69577r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Domain member: Digitally sign secure channel data (when possible)\" to \"Enabled\".</fixtext><fix id=\"F-69577r1_fix\" /><check system=\"C-64397r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\\r\n\r\nValue Name: SignSecureChannel\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63649\"><title>WN10-CC-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78139r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000150</version><title>The user must be prompted for a password on resume from sleep (plugged in).</title><description>&lt;VulnDiscussion&gt;Authentication must always be required when accessing a system.  This setting ensures the user is prompted for a password on resume from sleep (plugged in).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002038</ident><fixtext fixref=\"F-69579r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Power Management &gt;&gt; Sleep Settings &gt;&gt; \"Require a password when a computer wakes (plugged in)\" to \"Enabled\".</fixtext><fix id=\"F-69579r1_fix\" /><check system=\"C-64399r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Power\\PowerSettings\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\\\r\n\r\nValue Name: ACSettingIndex\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63651\"><title>WN10-CC-000155</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78141r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-CC-000155</version><title>Solicited Remote Assistance must not be allowed.</title><description>&lt;VulnDiscussion&gt;Remote assistance allows another user to view or take control of the local session of a user.  Solicited assistance is help that is specifically requested by the local user.  This may allow unauthorized parties access to the resources on the computer.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001090</ident><fixtext fixref=\"F-69581r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Remote Assistance &gt;&gt; \"Configure Solicited Remote Assistance\" to \"Disabled\".</fixtext><fix id=\"F-69581r1_fix\" /><check system=\"C-64401r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\\r\n\r\nValue Name: fAllowToGetHelp\r\n \r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63653\"><title>WN10-SO-000050</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78143r1_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-SO-000050</version><title>The computer account password must not be prevented from being reset.</title><description>&lt;VulnDiscussion&gt;Computer account passwords are changed automatically on a regular basis.  Disabling automatic password changes can make the system more vulnerable to malicious access.  Frequent password changes can be a significant safeguard for your system.  A new password for the computer account will be generated every 30 days.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69885r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Domain member: Disable machine account password changes\" to \"Disabled\".</fixtext><fix id=\"F-69885r1_fix\" /><check system=\"C-64707r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\\r\n\r\nValue Name: DisablePasswordChange\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63657\"><title>WN10-CC-000165</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78147r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000165</version><title>Unauthenticated RPC clients must be restricted from connecting to the RPC server.</title><description>&lt;VulnDiscussion&gt;Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001967</ident><fixtext fixref=\"F-69585r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Remote Procedure Call &gt;&gt; \"Restrict Unauthenticated RPC clients\" to \"Enabled\" and \"Authenticated\".</fixtext><fix id=\"F-69585r1_fix\" /><check system=\"C-64405r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Rpc\\\r\n\r\nValue Name: RestrictRemoteClients\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63659\"><title>WN10-CC-000170</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78149r2_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-CC-000170</version><title>The setting to allow Microsoft accounts to be optional for modern style apps must be enabled.</title><description>&lt;VulnDiscussion&gt;Control of credentials and the system must be maintained within the enterprise.  Enabling this setting allows enterprise credentials to be used with modern style apps that support this, instead of Microsoft accounts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69587r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; App Runtime &gt;&gt; \"Allow Microsoft accounts to be optional\" to \"Enabled\".</fixtext><fix id=\"F-69587r1_fix\" /><check system=\"C-81359r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Windows 10 LTSC\\B versions do not support the Microsoft Store and modern apps; this is NA for those systems.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\\r\n\r\nValue Name: MSAOptional\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x00000001 (1)</check-content></check></Rule></Group><Group id=\"V-63661\"><title>WN10-SO-000055</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78151r1_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-SO-000055</version><title>The maximum age for machine account passwords must be configured to 30 days or less.</title><description>&lt;VulnDiscussion&gt;Computer account passwords are changed automatically on a regular basis.  This setting controls the maximum password age that a machine account may have.  This setting must be set to no more than 30 days, ensuring the machine changes its password monthly.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69589r1_fix\">This is the default configuration for this setting (30 days).\r\n\r\nConfigure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Domain member: Maximum machine account password age\" to \"30\" or less (excluding 0 which is unacceptable).</fixtext><fix id=\"F-69589r1_fix\" /><check system=\"C-64409r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is the default configuration for this setting (30 days).\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\\r\n\r\nValue Name: MaximumPasswordAge\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x0000001e (30)  (or less, excluding 0)</check-content></check></Rule></Group><Group id=\"V-63663\"><title>WN10-CC-000175</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78153r1_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-CC-000175</version><title>The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.</title><description>&lt;VulnDiscussion&gt;Some features may communicate with the vendor, sending system information or downloading data or components for the feature.  Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.  This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-69591r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Application Compatibility &gt;&gt; \"Turn off Inventory Collector\" to \"Enabled\".</fixtext><fix id=\"F-69591r1_fix\" /><check system=\"C-64411r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\AppCompat\\\r\n\r\nValue Name: DisableInventory\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63665\"><title>WN10-SO-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78155r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000060</version><title>The system must be configured to require a strong session key.</title><description>&lt;VulnDiscussion&gt;A computer connecting to a domain controller will establish a secure channel.  Requiring strong session keys enforces 128-bit encryption between systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002418</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002421</ident><fixtext fixref=\"F-69593r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Domain member: Require strong (Windows 2000 or Later) session key\" to \"Enabled\".</fixtext><fix id=\"F-69593r1_fix\" /><check system=\"C-64413r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\\r\n\r\nValue Name: RequireStrongKey\r\n\r\nValue Type: REG_DWORD\r\nValue: 1\r\n \r\nWarning: This setting may prevent a system from being joined to a domain if not configured consistently between systems.</check-content></check></Rule></Group><Group id=\"V-63667\"><title>WN10-CC-000180</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78157r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-CC-000180</version><title>Autoplay must be turned off for non-volume devices.</title><description>&lt;VulnDiscussion&gt;Allowing autoplay to execute may introduce malicious code to a system.  Autoplay begins reading from a drive as soon as you insert media in the drive.  As a result, the setup file of programs or music on audio media may start.  This setting will disable autoplay for non-volume devices (such as Media Transfer Protocol (MTP) devices).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001764</ident><fixtext fixref=\"F-69595r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; AutoPlay Policies &gt;&gt; \"Disallow Autoplay for non-volume devices\" to \"Enabled\".</fixtext><fix id=\"F-69595r1_fix\" /><check system=\"C-64415r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\Explorer\\\r\n\r\nValue Name: NoAutoplayfornonVolume\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63669\"><title>WN10-SO-000070</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78159r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000070</version><title>The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.</title><description>&lt;VulnDiscussion&gt;Unattended systems are susceptible to unauthorized use and should be locked when unattended.  The screen saver should be set at a maximum of 15 minutes and be password protected.  This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000057</ident><fixtext fixref=\"F-88429r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Interactive logon: Machine inactivity limit\" to \"900\" seconds\" or less, excluding \"0\" which is effectively disabled.</fixtext><fix id=\"F-88429r1_fix\" /><check system=\"C-81353r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\\r\n\r\nValue Name: InactivityTimeoutSecs\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x00000384 (900) (or less, excluding \"0\" which is effectively disabled)</check-content></check></Rule></Group><Group id=\"V-63671\"><title>WN10-CC-000185</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78161r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-CC-000185</version><title>The default autorun behavior must be configured to prevent autorun commands.</title><description>&lt;VulnDiscussion&gt;Allowing autorun commands to execute may introduce malicious code to a system.  Configuring this setting prevents autorun commands from executing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001764</ident><fixtext fixref=\"F-69599r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; AutoPlay Policies &gt;&gt; \"Set the default behavior for AutoRun\" to \"Enabled:Do not execute any autorun commands\".</fixtext><fix id=\"F-69599r1_fix\" /><check system=\"C-64419r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\\r\n\r\nValue Name: NoAutorun\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63673\"><title>WN10-CC-000190</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78163r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-CC-000190</version><title>Autoplay must be disabled for all drives.</title><description>&lt;VulnDiscussion&gt;Allowing autoplay to execute may introduce malicious code to a system.  Autoplay begins reading from a drive as soon as you insert media in the drive.  As a result, the setup file of programs or music on audio media may start.  By default, autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives.  If you enable this policy, you can also disable autoplay on all drives.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001764</ident><fixtext fixref=\"F-69603r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; AutoPlay Policies &gt;&gt; \"Turn off AutoPlay\" to \"Enabled:All Drives\".</fixtext><fix id=\"F-69603r1_fix\" /><check system=\"C-64423r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path:  \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\Explorer\\\r\n\r\nValue Name: NoDriveTypeAutoRun\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x000000ff (255)\r\n\r\nNote: If the value for NoDriveTypeAutorun is entered manually, it must be entered as \"ff\" when Hexadecimal is selected, or \"255\" with Decimal selected.  Using the policy value specified in the Fix section will enter it correctly.</check-content></check></Rule></Group><Group id=\"V-63675\"><title>WN10-SO-000075</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78165r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000075</version><title>The required legal notice must be configured to display before console logon.</title><description>&lt;VulnDiscussion&gt;Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000048</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000050</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001384</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001385</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001386</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001387</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001388</ident><fixtext fixref=\"F-69601r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Interactive logon: Message text for users attempting to log on\" to the following.\r\n\r\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details.</fixtext><fix id=\"F-69601r2_fix\" /><check system=\"C-64421r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\\r\n\r\nValue Name: LegalNoticeText\r\n\r\nValue Type: REG_SZ\r\nValue: \r\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details.</check-content></check></Rule></Group><Group id=\"V-63677\"><title>WN10-CC-000195</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78167r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000195</version><title>Enhanced anti-spoofing for facial recognition must be enabled on Window 10.</title><description>&lt;VulnDiscussion&gt;Enhanced anti-spoofing provides additional protections when using facial recognition with devices that support it.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-88435r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Biometrics &gt;&gt; Facial Features &gt;&gt; \"Configure enhanced anti-spoofing\" to \"Enabled\". \r\n\r\nv1607:\r\nThe policy name is \"Use enhanced anti-spoofing when available\".</fixtext><fix id=\"F-88435r1_fix\" /><check system=\"C-81361r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Biometrics\\FacialFeatures\\\r\n\r\nValue Name: EnhancedAntiSpoofing\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x00000001 (1)</check-content></check></Rule></Group><Group id=\"V-63679\"><title>WN10-CC-000200</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78169r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000200</version><title>Administrator accounts must not be enumerated during elevation.</title><description>&lt;VulnDiscussion&gt;Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user.  This setting configures the system to always require users to type in a username and password to elevate a running application.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001084</ident><fixtext fixref=\"F-69607r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Credential User Interface &gt;&gt; \"Enumerate administrator accounts on elevation\" to \"Disabled\".</fixtext><fix id=\"F-69607r1_fix\" /><check system=\"C-64429r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\CredUI\\\r\n\r\nValue Name: EnumerateAdministrators\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63681\"><title>WN10-SO-000080</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78171r1_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-SO-000080</version><title>The Windows dialog box title for the legal banner must be configured.</title><description>&lt;VulnDiscussion&gt;Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000048</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001384</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001385</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001386</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001387</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001388</ident><fixtext fixref=\"F-69609r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Interactive logon: Message title for users attempting to log on\" to \"DoD Notice and Consent Banner\", \"US Department of Defense Warning Statement\", or a site-defined equivalent.\r\n\r\nIf a site-defined title is used, it can in no case contravene or modify the language of the banner text required in WN10-SO-000075.</fixtext><fix id=\"F-69609r1_fix\" /><check system=\"C-64427r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\\r\n\r\nValue Name: LegalNoticeCaption\r\n\r\nValue Type: REG_SZ\r\nValue: See message title above\r\n\r\n\"DoD Notice and Consent Banner\", \"US Department of Defense Warning Statement\" or a site-defined equivalent, this is a finding.\r\n\r\nIf a site-defined title is used, it can in no case contravene or modify the language of the banner text required in WN10-SO-000075.</check-content></check></Rule></Group><Group id=\"V-63683\"><title>WN10-CC-000205</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78173r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000205</version><title>Windows Telemetry must not be configured to Full.</title><description>&lt;VulnDiscussion&gt;Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The \"Security\" option for Telemetry configures the lowest amount of data, effectively none outside of the Malicious Software Removal Tool (MSRT), Defender and telemetry client settings. \"Basic\" sends basic diagnostic and usage data and may be required to support some Microsoft services. \"Enhanced\" includes additional information on how Windows and apps are used and advanced reliability data. Windows Analytics can use a \"limited enhanced\" level to provide information such as health data for devices.  This requires the configuration of an additional setting available with v1709 and later of Windows 10. &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-89003r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Data Collection and Preview Builds &gt;&gt; \"Allow Telemetry\" to \"Enabled\" with \"0 - Security [Enterprise Only]\" or \"1 - Basic\" selected in \"Options:\".   \r\n\r\nIf an organization is using v1709 or later of Windows 10 this may be configured to \"2 - Enhanced\" to support Windows Analytics. V-82145 must also be configured to limit the Enhanced diagnostic data to the minimum required by Windows Analytics.</fixtext><fix id=\"F-89003r2_fix\" /><check system=\"C-81949r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\\r\n\r\nValue Name: AllowTelemetry\r\n\r\nType: REG_DWORD\r\nValue: 0x00000000 (0) (Security)\r\n0x00000001 (1) (Basic)\r\n\r\nIf an organization is using v1709 or later of Windows 10 this may be configured to \"Enhanced\" to support Windows Analytics. V-82145 must also be configured to limit the Enhanced diagnostic data to the minimum required by Windows Analytics. This registry value will then be 0x00000002 (2).</check-content></check></Rule></Group><Group id=\"V-63685\"><title>WN10-CC-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78175r6_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000210</version><title>The Windows Defender SmartScreen for Explorer must be enabled.</title><description>&lt;VulnDiscussion&gt;Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling Windows Defender SmartScreen will warn or prevent users from running potentially malicious programs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-98461r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; File Explorer &gt;&gt; \"Configure Windows Defender SmartScreen\" to \"Enabled\" with \"Warn and prevent bypass\" selected. \r\n\r\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender SmartScreen &gt;&gt; Explorer.\r\n\r\nv1607 LTSB:\r\nConfigure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; File Explorer &gt;&gt; \"Configure Windows SmartScreen\" to \"Enabled\". (Selection options are not available.)\r\n\r\nv1507 LTSB:\r\nConfigure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; File Explorer &gt;&gt; \"Configure Windows SmartScreen\" to \"Enabled\" with \"Require approval from an administrator before running downloaded unknown software\" selected.</fixtext><fix id=\"F-98461r1_fix\" /><check system=\"C-91419r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is applicable to unclassified systems, for other systems this is NA.\r\n\r\nIf the following registry values do not exist or are not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\\r\n\r\nValue Name: EnableSmartScreen\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x00000001 (1)\r\n\r\nAnd\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\\r\n\r\nValue Name: ShellSmartScreenLevel\r\n\r\nValue Type: REG_SZ\r\nValue: Block\r\n\r\nv1607 LTSB:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\\r\n\r\nValue Name: EnableSmartScreen\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x00000001 (1)\r\n\r\nv1507 LTSB:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\\r\n\r\nValue Name: EnableSmartScreen\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x00000002 (2)</check-content></check></Rule></Group><Group id=\"V-63687\"><title>WN10-SO-000085</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78177r1_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-SO-000085</version><title>Caching of logon credentials must be limited.</title><description>&lt;VulnDiscussion&gt;The default Windows configuration caches the last logon credentials for users who log on interactively to a system.  This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable.  Even though the credential cache is well-protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69615r1_fix\">This is the default configuration for this setting (10 logons to cache).\r\n\r\nConfigure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Interactive logon: Number of previous logons to cache (in case domain controller is not available)\" to \"10\" logons or less.\r\n\r\nThis setting only applies to domain-joined systems, however, it is configured by default on all systems.</fixtext><fix id=\"F-69615r1_fix\" /><check system=\"C-64433r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is the default configuration for this setting (10 logons to cache).\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive:  HKEY_LOCAL_MACHINE \r\nRegistry Path:  \\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\\r\n\r\nValue Name:  CachedLogonsCount\r\n\r\nValue Type:  REG_SZ\r\nValue:  10 (or less)\r\n\r\nThis setting only applies to domain-joined systems, however, it is configured by default on all systems.</check-content></check></Rule></Group><Group id=\"V-63689\"><title>WN10-CC-000215</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78179r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000215</version><title>Explorer Data Execution Prevention must be enabled.</title><description>&lt;VulnDiscussion&gt;Data Execution Prevention (DEP) provides additional protection by performing  checks on memory to help prevent malicious code from running.  This setting will prevent Data Execution Prevention from being turned off for File Explorer.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002824</ident><fixtext fixref=\"F-69617r1_fix\">The default behavior is for data execution prevention to be turned on for file explorer.\r\n\r\nIf this needs to be corrected, configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; File Explorer &gt;&gt; \"Turn off Data Execution Prevention for Explorer\" to \"Not Configured\" or \"Disabled\".</fixtext><fix id=\"F-69617r1_fix\" /><check system=\"C-64437r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>The default behavior is for data execution prevention to be turned on for file explorer.\r\n\r\nIf the registry value name below does not exist, this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"0\", this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"1\", this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\Explorer\\\r\n\r\nValue Name: NoDataExecutionPrevention\r\n\r\nValue Type: REG_DWORD\r\nValue: 0 (or if the Value Name does not exist)</check-content></check></Rule></Group><Group id=\"V-63691\"><title>WN10-CC-000220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78181r3_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-CC-000220</version><title>Turning off File Explorer heap termination on corruption must be disabled.</title><description>&lt;VulnDiscussion&gt;Legacy plug-in applications may continue to function when a File Explorer session has become corrupt.  Disabling this feature will prevent this.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002385</ident><fixtext fixref=\"F-78109r3_fix\">The default behavior is for File Explorer heap termination on corruption to be enabled.\r\n\r\nIf this needs to be corrected, configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; File Explorer &gt;&gt; \"Turn off heap termination on corruption\" to \"Not Configured\" or \"Disabled\".</fixtext><fix id=\"F-78109r3_fix\" /><check system=\"C-72013r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>The default behavior is for File Explorer heap termination on corruption to be enabled.\r\n\r\nIf the registry Value Name below does not exist, this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"0\", this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"1\", this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\Explorer\\\r\n\r\nValue Name: NoHeapTerminationOnCorruption\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x00000000 (0) (or if the Value Name does not exist)</check-content></check></Rule></Group><Group id=\"V-63695\"><title>WN10-CC-000225</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78185r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000225</version><title>File Explorer shell protocol must run in protected mode.</title><description>&lt;VulnDiscussion&gt;The shell protocol will  limit the set of folders applications can open when run in protected mode.  Restricting files an application can open, to a limited set of folders, increases the security of Windows.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69623r1_fix\">The default behavior is for shell protected mode to be turned on for file explorer.\r\n\r\nIf this needs to be corrected, configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; File Explorer &gt;&gt; \"Turn off shell protocol protected mode\" to \"Not Configured\" or \"Disabled\".</fixtext><fix id=\"F-69623r1_fix\" /><check system=\"C-64443r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>The default behavior is for shell protected mode to be turned on for file explorer.\r\n\r\nIf the registry value name below does not exist, this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"0\", this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"1\", this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\\r\n\r\nValue Name: PreXPSP2ShellProtocolBehavior\r\n\r\nValue Type: REG_DWORD\r\nValue: 0 (or if the Value Name does not exist)</check-content></check></Rule></Group><Group id=\"V-63697\"><title>WN10-SO-000095</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78187r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000095</version><title>The Smart Card removal option must be configured to Force Logoff or Lock Workstation.</title><description>&lt;VulnDiscussion&gt;Unattended systems are susceptible to unauthorized use and must be locked.  Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69625r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Interactive logon: Smart card removal behavior\" to  \"Lock Workstation\" or \"Force Logoff\".</fixtext><fix id=\"F-69625r1_fix\" /><check system=\"C-64445r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive:  HKEY_LOCAL_MACHINE\r\nRegistry Path:  \\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\\r\n\r\nValue Name:  SCRemoveOption\r\n\r\nValue Type:  REG_SZ\r\nValue:  1 (Lock Workstation) or 2 (Force Logoff)\r\n\r\nThis can be left not configured or set to \"No action\" on workstations with the following conditions.  This must be documented with the ISSO.\r\n-The setting cannot be configured due to mission needs, or because it interferes with applications.\r\n-Policy must be in place that users manually lock workstations when leaving them unattended.\r\n-The screen saver is properly configured to lock as required.</check-content></check></Rule></Group><Group id=\"V-63699\"><title>WN10-CC-000230</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78189r6_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000230</version><title>Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for malicious websites in Microsoft Edge.</title><description>&lt;VulnDiscussion&gt;The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites and file downloads.  If users are allowed to ignore warnings from the Windows Defender SmartScreen filter they could still access malicious websites.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-98463r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Microsoft Edge &gt;&gt; \"Prevent bypassing Windows Defender SmartScreen prompts for sites\" to \"Enabled\". \r\n\r\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender SmartScreen &gt;&gt; Microsoft Edge.</fixtext><fix id=\"F-98463r1_fix\" /><check system=\"C-79101r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is applicable to unclassified systems, for other systems this is NA.\r\n\r\nWindows 10 LTSC\\B versions do not include Microsoft Edge, this is NA for those systems.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter\\\r\n\r\nValue Name: PreventOverride\r\n\r\nType: REG_DWORD\r\nValue: 0x00000001 (1)</check-content></check></Rule></Group><Group id=\"V-63701\"><title>WN10-CC-000235</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78191r6_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000235</version><title>Users must not be allowed to ignore Windows Defender SmartScreen filter warnings for unverified files in Microsoft Edge.</title><description>&lt;VulnDiscussion&gt;The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites and file downloads.  If users are allowed to ignore warnings from the Windows Defender SmartScreen filter they could still download potentially malicious files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-98465r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Microsoft Edge &gt;&gt; \"Prevent bypassing Windows Defender SmartScreen prompts for files\" to \"Enabled\". \r\n\r\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender SmartScreen &gt;&gt; Microsoft Edge.</fixtext><fix id=\"F-98465r1_fix\" /><check system=\"C-79105r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is applicable to unclassified systems, for other systems this is NA.\r\n\r\nWindows 10 LTSC\\B versions do not include Microsoft Edge, this is NA for those systems.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter\\\r\n\r\nValue Name: PreventOverrideAppRepUnknown\r\n\r\nType: REG_DWORD\r\nValue: 0x00000001 (1)</check-content></check></Rule></Group><Group id=\"V-63703\"><title>WN10-SO-000100</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78193r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000100</version><title>The Windows SMB client must be configured to always perform SMB packet signing.</title><description>&lt;VulnDiscussion&gt;The server message block (SMB) protocol provides the basis for many network operations.  Digitally signed SMB packets aid in preventing man-in-the-middle attacks.  If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002418</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002421</ident><fixtext fixref=\"F-69629r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Microsoft network client: Digitally sign communications (always)\" to \"Enabled\".</fixtext><fix id=\"F-69629r1_fix\" /><check system=\"C-64451r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters\\\r\n\r\nValue Name: RequireSecuritySignature\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63709\"><title>WN10-CC-000245</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78199r4_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000245</version><title>The password manager function in the Edge browser must be disabled.</title><description>&lt;VulnDiscussion&gt;Passwords save locally for re-use when browsing may be subject to compromise.  Disabling the Edge password manager will prevent this for the browser.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-83245r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Microsoft Edge &gt;&gt; \"Configure Password Manager\" to \"Disabled\".</fixtext><fix id=\"F-83245r1_fix\" /><check system=\"C-79113r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Windows 10 LTSC\\B versions do not include Microsoft Edge, this is NA for those systems.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main\\\r\n\r\nValue Name: FormSuggest Passwords\r\n\r\nType: REG_SZ\r\nValue: no</check-content></check></Rule></Group><Group id=\"V-63711\"><title>WN10-SO-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78201r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000110</version><title>Unencrypted passwords must not be sent to third-party SMB Servers.</title><description>&lt;VulnDiscussion&gt;Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication.  Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment.  Check with the vendor of the SMB server to see if there is a way to support encrypted password authentication.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000197</ident><fixtext fixref=\"F-69639r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Microsoft network client: Send unencrypted password to third-party SMB servers\" to \"Disabled\".</fixtext><fix id=\"F-69639r1_fix\" /><check system=\"C-64459r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive:  HKEY_LOCAL_MACHINE\r\nRegistry Path:  \\SYSTEM\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters\\\r\n\r\nValue Name:  EnablePlainTextPassword\r\n\r\nValue Type:  REG_DWORD\r\nValue:  0</check-content></check></Rule></Group><Group id=\"V-63713\"><title>WN10-CC-000250</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78203r6_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000250</version><title>The Windows Defender SmartScreen filter for Microsoft Edge must be enabled.</title><description>&lt;VulnDiscussion&gt;The Windows Defender SmartScreen filter in Microsoft Edge provides warning messages and blocks potentially malicious websites.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-98467r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Microsoft Edge &gt;&gt; \"Configure Windows Defender SmartScreen\" to \"Enabled\". \r\n\r\nWindows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Defender SmartScreen &gt;&gt; Microsoft Edge.</fixtext><fix id=\"F-98467r1_fix\" /><check system=\"C-79115r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is applicable to unclassified systems, for other systems this is NA.\r\n\r\nWindows 10 LTSC\\B versions do not include Microsoft Edge, this is NA for those systems.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter\\\r\n\r\nValue Name: EnabledV9\r\n\r\nType: REG_DWORD\r\nValue: 0x00000001 (1)</check-content></check></Rule></Group><Group id=\"V-63717\"><title>WN10-CC-000255</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78207r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000255</version><title>The use of a hardware security device with Windows Hello for Business must be enabled.</title><description>&lt;VulnDiscussion&gt;The use of a Trusted Platform Module (TPM) to store keys for Windows Hello for Business provides additional security.  Keys stored in the TPM may only be used on that system while keys stored using software are more susceptible to compromise and could be used on other systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-83247r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Hello for Business &gt;&gt; \"Use a hardware security device\" to \"Enabled\". \r\n\r\nv1507 LTSB:\r\nThe policy path is Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Microsoft Passport for Work.</fixtext><fix id=\"F-83247r2_fix\" /><check system=\"C-79119r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Virtual desktop implementations currently may not support the use of TPMs. For virtual desktop implementations where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\PassportForWork\\\r\n\r\nValue Name: RequireSecurityDevice\r\n\r\nType: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63719\"><title>WN10-SO-000120</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78209r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000120</version><title>The Windows SMB server must be configured to always perform SMB packet signing.</title><description>&lt;VulnDiscussion&gt;The server message block (SMB) protocol provides the basis for many network operations.  Digitally signed SMB packets aid in preventing man-in-the-middle attacks.  If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002418</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002421</ident><fixtext fixref=\"F-69647r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Microsoft network server: Digitally sign communications (always)\" to \"Enabled\".</fixtext><fix id=\"F-69647r1_fix\" /><check system=\"C-64467r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\LanManServer\\Parameters\\\r\n\r\nValue Name: RequireSecuritySignature\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63721\"><title>WN10-CC-000260</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78211r6_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000260</version><title>Windows 10 must be configured to require a minimum pin length of six characters or greater.</title><description>&lt;VulnDiscussion&gt;Windows allows the use of PINs as well as biometrics for authentication without sending a password to a network or website where it could be compromised.  Longer minimum PIN lengths increase the available combinations an attacker would have to attempt.  Shorter minimum length significantly reduces the strength.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-98469r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; PIN Complexity &gt;&gt; \"Minimum PIN length\" to \"6\" or greater. \r\n\r\nv1607 LTSB:\r\nThe policy path is Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Hello for Business &gt;&gt; Pin Complexity.\r\n\r\nv1507 LTSB:\r\nThe policy path is Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Microsoft Passport for Work &gt;&gt; Pin Complexity.</fixtext><fix id=\"F-98469r2_fix\" /><check system=\"C-64469r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive:  HKEY_LOCAL_MACHINE\r\nRegistry Path:  \\SOFTWARE\\Policies\\Microsoft\\PassportForWork\\PINComplexity\\\r\n\r\nValue Name:  MinimumPINLength\r\n\r\nType:  REG_DWORD\r\nValue:  6 (or greater)</check-content></check></Rule></Group><Group id=\"V-63729\"><title>WN10-CC-000270</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78219r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000270</version><title>Passwords must not be saved in the Remote Desktop Client.</title><description>&lt;VulnDiscussion&gt;Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system.  The system must be configured to prevent users from saving passwords in the Remote Desktop Client.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002038</ident><fixtext fixref=\"F-69657r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Remote Desktop Services &gt;&gt; Remote Desktop Connection Client &gt;&gt; \"Do not allow passwords to be saved\" to \"Enabled\".</fixtext><fix id=\"F-69657r1_fix\" /><check system=\"C-64479r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\\r\n\r\nValue Name: DisablePasswordSaving\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63731\"><title>WN10-CC-000275</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78221r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000275</version><title>Local drives must be prevented from sharing with Remote Desktop Session Hosts.</title><description>&lt;VulnDiscussion&gt;Preventing users from sharing the local drives on their client computers to Remote Session Hosts that they access helps reduce possible exposure of sensitive data.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001090</ident><fixtext fixref=\"F-69659r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Remote Desktop Services &gt;&gt; Remote Desktop Session Host &gt;&gt; Device and Resource Redirection &gt;&gt; \"Do not allow drive redirection\" to \"Enabled\".</fixtext><fix id=\"F-69659r1_fix\" /><check system=\"C-64481r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\\r\n\r\nValue Name: fDisableCdm\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63733\"><title>WN10-CC-000280</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78223r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000280</version><title>Remote Desktop Services must always prompt a client for passwords upon connection.</title><description>&lt;VulnDiscussion&gt;This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection.  Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002038</ident><fixtext fixref=\"F-69661r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Remote Desktop Services &gt;&gt; Remote Desktop Session Host &gt;&gt; Security &gt;&gt; \"Always prompt for password upon connection\" to \"Enabled\".</fixtext><fix id=\"F-69661r1_fix\" /><check system=\"C-64483r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\\r\n\r\nValue Name: fPromptForPassword\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63737\"><title>WN10-CC-000285</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78227r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000285</version><title>The Remote Desktop Session Host must require secure RPC communications.</title><description>&lt;VulnDiscussion&gt;Allowing unsecure RPC communication exposes the system to man in the middle attacks and data disclosure attacks. A man in the middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001453</ident><fixtext fixref=\"F-69665r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Remote Desktop Services &gt;&gt; Remote Desktop Session Host &gt;&gt; Security \"Require secure RPC communication\" to \"Enabled\".</fixtext><fix id=\"F-69665r1_fix\" /><check system=\"C-64487r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\\r\n\r\nValue Name: fEncryptRPCTraffic\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63739\"><title>WN10-SO-000140</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78229r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-SO-000140</version><title>Anonymous SID/Name translation must not be allowed.</title><description>&lt;VulnDiscussion&gt;Allowing anonymous SID/Name translation can provide sensitive information for accessing a system.  Only authorized users must be able to perform such translations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69667r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Network access: Allow anonymous SID/Name translation\" to \"Disabled\".</fixtext><fix id=\"F-69667r1_fix\" /><check system=\"C-64489r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options.\r\n\r\nIf the value for \"Network access: Allow anonymous SID/Name translation\" is not set to \"Disabled\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-63741\"><title>WN10-CC-000290</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78231r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000290</version><title>Remote Desktop Services must be configured with the client connection encryption set to the required level.</title><description>&lt;VulnDiscussion&gt;Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting \"High Level\" will ensure encryption of Remote Desktop Services sessions in both directions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000068</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002890</ident><fixtext fixref=\"F-69669r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Remote Desktop Services &gt;&gt; Remote Desktop Session Host &gt;&gt; Security &gt;&gt; \"Set client connection encryption level\" to \"Enabled\" and \"High Level\".</fixtext><fix id=\"F-69669r1_fix\" /><check system=\"C-64491r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\\r\n\r\nValue Name: MinEncryptionLevel\r\n\r\nValue Type: REG_DWORD\r\nValue: 3</check-content></check></Rule></Group><Group id=\"V-63743\"><title>WN10-CC-000295</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78233r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000295</version><title>Attachments must be prevented from being downloaded from RSS feeds.</title><description>&lt;VulnDiscussion&gt;Attachments from RSS feeds may not be secure.  This setting will prevent attachments from being downloaded from RSS feeds.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69671r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; RSS Feeds &gt;&gt; \"Prevent downloading of enclosures\" to \"Enabled\".</fixtext><fix id=\"F-69671r1_fix\" /><check system=\"C-64495r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Feeds\\\r\n\r\nValue Name: DisableEnclosureDownload\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63745\"><title>WN10-SO-000145</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78235r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-SO-000145</version><title>Anonymous enumeration of SAM accounts must not be allowed.</title><description>&lt;VulnDiscussion&gt;Anonymous enumeration of SAM accounts allows anonymous log on users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69673r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Network access: Do not allow anonymous enumeration of SAM accounts\" to \"Enabled\".</fixtext><fix id=\"F-69673r1_fix\" /><check system=\"C-64493r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\Lsa\\\r\n\r\nValue Name: RestrictAnonymousSAM\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63747\"><title>WN10-CC-000300</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78237r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000300</version><title>Basic authentication for RSS feeds over HTTP must not be used.</title><description>&lt;VulnDiscussion&gt;Basic authentication uses plain text passwords that could be used to compromise a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-69675r1_fix\">The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections.\r\n\r\nIf this needs to be corrected, configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; RSS Feeds &gt;&gt; \"Turn on Basic feed authentication over HTTP\" to \"Not Configured\" or \"Disabled\".</fixtext><fix id=\"F-69675r1_fix\" /><check system=\"C-64497r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections.\r\n\r\nIf the registry value name below does not exist, this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"0\", this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"1\", this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Feeds\\\r\n\r\nValue Name: AllowBasicAuthInClear\r\n\r\nValue Type: REG_DWORD\r\nValue: 0 (or if the Value Name does not exist)</check-content></check></Rule></Group><Group id=\"V-63749\"><title>WN10-SO-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78239r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-SO-000150</version><title>Anonymous enumeration of shares must be restricted.</title><description>&lt;VulnDiscussion&gt;Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001090</ident><fixtext fixref=\"F-69677r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Network access: Do not allow anonymous enumeration of SAM accounts and shares\" to \"Enabled\".</fixtext><fix id=\"F-69677r1_fix\" /><check system=\"C-64499r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\Lsa\\\r\n\r\nValue Name: RestrictAnonymous\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63751\"><title>WN10-CC-000305</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78241r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000305</version><title>Indexing of encrypted files must be turned off.</title><description>&lt;VulnDiscussion&gt;Indexing of encrypted files may expose sensitive data.  This setting prevents encrypted files from being indexed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-69679r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Search &gt;&gt; \"Allow indexing of encrypted files\" to \"Disabled\".</fixtext><fix id=\"F-69679r1_fix\" /><check system=\"C-64501r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search\\\r\n\r\nValue Name: AllowIndexingEncryptedStoresOrItems\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63755\"><title>WN10-SO-000160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78245r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000160</version><title>The system must be configured to prevent anonymous users from having the same rights as the Everyone group.</title><description>&lt;VulnDiscussion&gt;Access by anonymous users must be restricted.  If this setting is enabled, then anonymous users have the same rights and permissions as the built-in Everyone group.  Anonymous users must not have these permissions or rights.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69683r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Network access: Let Everyone permissions apply to anonymous users\" to \"Disabled\".</fixtext><fix id=\"F-69683r1_fix\" /><check system=\"C-64505r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\Lsa\\\r\n\r\nValue Name: EveryoneIncludesAnonymous\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63759\"><title>WN10-SO-000165</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78249r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-SO-000165</version><title>Anonymous access to Named Pipes and Shares must be restricted.</title><description>&lt;VulnDiscussion&gt;Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access.  This setting restricts access to those defined in \"Network access: Named Pipes that can be accessed anonymously\" and \"Network access: Shares that can be accessed anonymously\",  both of which must be blank under other requirements.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001090</ident><fixtext fixref=\"F-69687r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Network access: Restrict anonymous access to Named Pipes and Shares\" to \"Enabled\".</fixtext><fix id=\"F-69687r1_fix\" /><check system=\"C-64509r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\LanManServer\\Parameters\\\r\n\r\nValue Name: RestrictNullSessAccess\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63765\"><title>WN10-SO-000180</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78255r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000180</version><title>NTLM must be prevented from falling back to a Null session.</title><description>&lt;VulnDiscussion&gt;NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69693r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Network security: Allow LocalSystem NULL session fallback\" to \"Disabled\".</fixtext><fix id=\"F-69693r1_fix\" /><check system=\"C-64517r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\LSA\\MSV1_0\\\r\n\r\nValue Name: allownullsessionfallback\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63767\"><title>WN10-SO-000185</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78257r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000185</version><title>PKU2U authentication using online identities must be prevented.</title><description>&lt;VulnDiscussion&gt;PKU2U is a peer-to-peer authentication protocol.   This setting prevents online identities from authenticating to domain-joined systems.  Authentication will be centrally managed with Windows user accounts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69695r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Network security: Allow PKU2U authentication requests to this computer to use online identities\" to \"Disabled\".</fixtext><fix id=\"F-69695r1_fix\" /><check system=\"C-64519r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\LSA\\pku2u\\\r\n\r\nValue Name: AllowOnlineID\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63795\"><title>WN10-SO-000190</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78285r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000190</version><title>Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.</title><description>&lt;VulnDiscussion&gt;Certain encryption types are no longer considered secure.  This setting configures a minimum encryption type for Kerberos, preventing the use of the DES and RC4 encryption suites.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000803</ident><fixtext fixref=\"F-69723r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Network security: Configure encryption types allowed for Kerberos\" to \"Enabled\" with only the following selected:\r\n\r\nAES128_HMAC_SHA1\r\nAES256_HMAC_SHA1\r\nFuture encryption types</fixtext><fix id=\"F-69723r2_fix\" /><check system=\"C-64545r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\Parameters\\\r\n\r\nValue Name: SupportedEncryptionTypes\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x7ffffff8 (2147483640)</check-content></check></Rule></Group><Group id=\"V-63797\"><title>WN10-SO-000195</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78287r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-SO-000195</version><title>The system must be configured to prevent the storage of the LAN Manager hash of passwords.</title><description>&lt;VulnDiscussion&gt;The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords.  This setting controls whether or not a LAN Manager hash of the password is stored in the SAM the next time the password is changed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000196</ident><fixtext fixref=\"F-69725r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Network security: Do not store LAN Manager hash value on next password change\" to \"Enabled\".</fixtext><fix id=\"F-69725r1_fix\" /><check system=\"C-64547r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\Lsa\\\r\n\r\nValue Name: NoLMHash\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63801\"><title>WN10-SO-000205</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78291r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-SO-000205</version><title>The LanMan authentication level must be set to send NTLMv2 response only, and to refuse LM and NTLM.</title><description>&lt;VulnDiscussion&gt;The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts.  NTLM, which is less secure, is retained in later Windows versions  for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it.  It is also used to authenticate logons to stand-alone computers that are running later versions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69729r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Network security: LAN Manager authentication level\" to \"Send NTLMv2 response only. Refuse LM &amp; NTLM\".</fixtext><fix id=\"F-69729r1_fix\" /><check system=\"C-64551r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\Lsa\\\r\n\r\nValue Name: LmCompatibilityLevel\r\n\r\nValue Type: REG_DWORD\r\nValue: 5</check-content></check></Rule></Group><Group id=\"V-63803\"><title>WN10-SO-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78293r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000210</version><title>The system must be configured to the required LDAP client signing level.</title><description>&lt;VulnDiscussion&gt;This setting controls the signing requirements for LDAP clients.  This setting must be set to Negotiate signing or Require signing, depending on the environment and type of LDAP server in use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69731r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Network security: LDAP client signing requirements\" to \"Negotiate signing\" at a minimum.</fixtext><fix id=\"F-69731r1_fix\" /><check system=\"C-64553r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\LDAP\\\r\n\r\nValue Name: LDAPClientIntegrity\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63805\"><title>WN10-SO-000215</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78295r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000215</version><title>The system must be configured to meet the minimum session security requirement for NTLM SSP based clients.</title><description>&lt;VulnDiscussion&gt;Microsoft has implemented a variety of security support providers for use with RPC sessions.  All of the options must be enabled to ensure the maximum security level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69733r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Network security: Minimum session security for NTLM SSP based (including secure RPC) clients\" to \"Require NTLMv2 session security\" and \"Require 128-bit encryption\" (all options selected).</fixtext><fix id=\"F-69733r1_fix\" /><check system=\"C-64555r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\\r\n\r\nValue Name: NTLMMinClientSec\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x20080000 (537395200)</check-content></check></Rule></Group><Group id=\"V-63807\"><title>WN10-SO-000220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78297r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000220</version><title>The system must be configured to meet the minimum session security requirement for NTLM SSP based servers.</title><description>&lt;VulnDiscussion&gt;Microsoft has implemented a variety of security support providers for use with RPC sessions.  All of the options must be enabled to ensure the maximum security level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69735r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Network security: Minimum session security for NTLM SSP based (including secure RPC) servers\" to \"Require NTLMv2 session security\" and \"Require 128-bit encryption\" (all options selected).</fixtext><fix id=\"F-69735r1_fix\" /><check system=\"C-64557r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\\r\n\r\nValue Name: NTLMMinServerSec\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x20080000 (537395200)</check-content></check></Rule></Group><Group id=\"V-63811\"><title>WN10-SO-000230</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78301r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000230</version><title>The system must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.</title><description>&lt;VulnDiscussion&gt;This setting ensures that the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing.  FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002450</ident><fixtext fixref=\"F-69739r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing\" to \"Enabled\".</fixtext><fix id=\"F-69739r1_fix\" /><check system=\"C-64561r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\Lsa\\FIPSAlgorithmPolicy\\\r\n\r\nValue Name: Enabled\r\n\r\nValue Type: REG_DWORD\r\nValue: 1\r\n \r\nWarning: Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms.  Both the browser and web server must be configured to use TLS otherwise the browser will not be able to connect to a secure site.</check-content></check></Rule></Group><Group id=\"V-63815\"><title>WN10-SO-000240</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78305r1_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-SO-000240</version><title>The default permissions of global system objects must be increased.</title><description>&lt;VulnDiscussion&gt;Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. If this policy is enabled, the default DACL is stronger, allowing non-admin users to read shared objects, but not modify shared objects that they did not create.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-69743r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"System objects: Strengthen default permissions of internal system objects (e.g. Symbolic links)\" to \"Enabled\".</fixtext><fix id=\"F-69743r1_fix\" /><check system=\"C-64565r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\\r\n\r\nValue Name: ProtectionMode\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63817\"><title>WN10-SO-000245</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78307r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000245</version><title>User Account Control approval mode for the built-in Administrator must be enabled.</title><description>&lt;VulnDiscussion&gt;User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures the built-in Administrator account so that it runs in Admin Approval Mode.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002038</ident><fixtext fixref=\"F-69745r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"User Account Control: Admin Approval Mode for the Built-in Administrator account\" to \"Enabled\".</fixtext><fix id=\"F-69745r1_fix\" /><check system=\"C-64567r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\\r\n\r\nValue Name: FilterAdministratorToken\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63819\"><title>WN10-SO-000250</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78309r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000250</version><title>User Account Control must, at minimum, prompt administrators for consent on the secure desktop.</title><description>&lt;VulnDiscussion&gt;User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures the elevation requirements for logged on administrators to complete a task that requires raised privileges.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001084</ident><fixtext fixref=\"F-69747r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode\" to \"Prompt for consent on the secure desktop\".</fixtext><fix id=\"F-69747r1_fix\" /><check system=\"C-64569r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\\r\n\r\nValue Name: ConsentPromptBehaviorAdmin\r\n\r\nValue Type: REG_DWORD\r\nValue: 2 (Prompt for consent on the secure desktop)</check-content></check></Rule></Group><Group id=\"V-63821\"><title>WN10-SO-000255</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78311r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000255</version><title>User Account Control must automatically deny elevation requests for standard users.</title><description>&lt;VulnDiscussion&gt;User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  Denying elevation requests from standard user accounts requires tasks that need elevation to be initiated by accounts with administrative privileges.  This ensures correct accounts are used on the system for privileged tasks to help mitigate credential theft.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002038</ident><fixtext fixref=\"F-69749r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"User Account Control: Behavior of the elevation prompt for standard users\" to \"Automatically deny elevation requests\".</fixtext><fix id=\"F-69749r1_fix\" /><check system=\"C-64571r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\\r\n\r\nValue Name: ConsentPromptBehaviorUser\r\n\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-63825\"><title>WN10-SO-000260</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78315r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000260</version><title>User Account Control must be configured to detect application installations and prompt for elevation.</title><description>&lt;VulnDiscussion&gt;User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting requires Windows to respond to application installation requests by prompting for credentials.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001084</ident><fixtext fixref=\"F-69753r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"User Account Control: Detect application installations and prompt for elevation\" to \"Enabled\".</fixtext><fix id=\"F-69753r1_fix\" /><check system=\"C-64575r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\\r\n\r\nValue Name: EnableInstallerDetection\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63827\"><title>WN10-SO-000265</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78317r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000265</version><title>User Account Control must only elevate UIAccess applications that are installed in secure locations.</title><description>&lt;VulnDiscussion&gt;User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\\System32 folders, to run with elevated privileges.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001084</ident><fixtext fixref=\"F-69755r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"User Account Control: Only elevate UIAccess applications that are installed in secure locations\" to \"Enabled\".</fixtext><fix id=\"F-69755r1_fix\" /><check system=\"C-64577r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\\r\n\r\nValue Name: EnableSecureUIAPaths\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63829\"><title>WN10-SO-000270</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78319r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000270</version><title>User Account Control must run all administrators in Admin Approval Mode, enabling UAC.</title><description>&lt;VulnDiscussion&gt;User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting enables UAC.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002038</ident><fixtext fixref=\"F-69757r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"User Account Control: Run all administrators in Admin Approval Mode\" to \"Enabled\".</fixtext><fix id=\"F-69757r1_fix\" /><check system=\"C-64579r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\\r\n\r\nValue Name: EnableLUA\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63831\"><title>WN10-SO-000275</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78321r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000275</version><title>User Account Control must virtualize file and registry write failures to per-user locations.</title><description>&lt;VulnDiscussion&gt;User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized.  This setting configures non-UAC compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001084</ident><fixtext fixref=\"F-69759r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"User Account Control: Virtualize file and registry write failures to per-user locations\" to \"Enabled\".</fixtext><fix id=\"F-69759r1_fix\" /><check system=\"C-64581r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\\r\n\r\nValue Name: EnableVirtualization\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63839\"><title>WN10-UC-000015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78329r1_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-UC-000015</version><title>Toast notifications to the lock screen must be turned off.</title><description>&lt;VulnDiscussion&gt;Toast notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel.  Turning off this feature will limit access to the information to a logged on user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-69767r1_fix\">Configure the policy value for User Configuration &gt;&gt; Administrative Templates &gt;&gt; Start Menu and Taskbar &gt;&gt; Notifications &gt;&gt; \"Turn off toast notifications on the lock screen\" to \"Enabled\".</fixtext><fix id=\"F-69767r1_fix\" /><check system=\"C-64589r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_CURRENT_USER\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\\r\n\r\nValue Name: NoToastApplicationNotificationOnLockScreen\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-63841\"><title>WN10-UC-000020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78331r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UC-000020</version><title>Zone information must be preserved when saving attachments.</title><description>&lt;VulnDiscussion&gt;Preserving zone of origin (internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-78717r1_fix\">The default behavior is for Windows to mark file attachments with their zone information.\r\n\r\nIf this needs to be corrected, configure the policy value for User Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Attachment Manager &gt;&gt; \"Do not preserve zone information in file attachments\" to \"Not Configured\" or \"Disabled\".</fixtext><fix id=\"F-78717r1_fix\" /><check system=\"C-72015r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>The default behavior is for Windows to mark file attachments with their zone information.\r\n\r\nIf the registry Value Name below does not exist, this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"2\", this is not a finding.\r\n\r\nIf it exists and is configured with a value of \"1\", this is a finding.\r\n\r\nRegistry Hive: HKEY_CURRENT_USER\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Attachments\\\r\n\r\nValue Name: SaveZoneInformation\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x00000002 (2) (or if the Value Name does not exist)</check-content></check></Rule></Group><Group id=\"V-63843\"><title>WN10-UR-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78333r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000005</version><title>The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Access Credential Manager as a trusted caller\" user right may be able to retrieve the credentials of other accounts from Credential Manager.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69771r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Access Credential Manager as a trusted caller\" to be defined but containing no entries (blank).</fixtext><fix id=\"F-69771r1_fix\" /><check system=\"C-64593r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts are granted the \"Access Credential Manager as a trusted caller\" user right, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63845\"><title>WN10-UR-000010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78335r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000010</version><title>The Access this computer from the network user right must only be assigned to the Administrators and Remote Desktop Users groups.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Access this computer from the network\" user right may access resources on the system, and must be limited to those that require it.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000213</ident><fixtext fixref=\"F-81289r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Access this computer from the network\" to only include the following groups or accounts:\r\n\r\nAdministrators   \r\nRemote Desktop Users</fixtext><fix id=\"F-81289r1_fix\" /><check system=\"C-78091r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Access this computer from the network\" user right, this is a finding:\r\n\r\nAdministrators\r\nRemote Desktop Users\r\n\r\nIf a domain application account such as for a management tool requires this user right, this would not be a finding.\r\n\r\nVendor documentation must support the requirement for having the user right.\r\n\r\nThe requirement must be documented with the ISSO.\r\n\r\nThe application account, managed at the domain level, must meet requirements for application account passwords, such as length and frequency of changes as defined in the Windows server STIGs.</check-content></check></Rule></Group><Group id=\"V-63847\"><title>WN10-UR-000015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78337r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-UR-000015</version><title>The Act as part of the operating system user right must not be assigned to any groups or accounts.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Act as part of the operating system\" user right can assume the identity of any user and gain access to resources that user is authorized to access.  Any accounts with this right can take complete control of a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69775r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Act as part of the operating system\" to be defined but containing no entries (blank).</fixtext><fix id=\"F-69775r1_fix\" /><check system=\"C-64597r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts (to include administrators), are granted the \"Act as part of the operating system\" user right, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63851\"><title>WN10-UR-000025</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78341r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000025</version><title>The Allow log on locally user right must only be assigned to the Administrators and Users groups.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\r\n\r\nAccounts with the \"Allow log on locally\" user right can log on interactively to a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000213</ident><fixtext fixref=\"F-88439r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Allow log on locally\" to only include the following groups or accounts:\r\n\r\nAdministrators\r\nUsers</fixtext><fix id=\"F-88439r1_fix\" /><check system=\"C-81367r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\n\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Allow log on locally\" user right, this is a finding:\r\n\r\nAdministrators\r\nUsers</check-content></check></Rule></Group><Group id=\"V-63853\"><title>WN10-UR-000030</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78343r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000030</version><title>The Back up files and directories user right must only be assigned to the Administrators group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Back up files and directories\" user right can circumvent file and directory permissions and could allow access to sensitive data.\"&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69781r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Back up files and directories\" to only include the following groups or accounts:\r\n\r\nAdministrators</fixtext><fix id=\"F-69781r1_fix\" /><check system=\"C-64603r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Back up files and directories\" user right, this is a finding:\r\n\r\nAdministrators</check-content></check></Rule></Group><Group id=\"V-63855\"><title>WN10-UR-000035</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78345r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000035</version><title>The Change the system time user right must only be assigned to Administrators and Local Service and NT SERVICE\\autotimesvc.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Change the system time\" user right can change the system time, which can impact authentication, as well as affect time stamps on event log entries.\r\n\r\nThe NT SERVICE\\autotimesvc is added in v1909 cumulative update. &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69783r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Change the system time\" to only include the following groups or accounts:\r\n\r\nAdministrators\r\nLOCAL SERVICE\r\nNT SERVICE\\autotimesvc is added in v1909 cumulative update.</fixtext><fix id=\"F-69783r2_fix\" /><check system=\"C-64605r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Change the system time\" user right, this is a finding:\r\n\r\nAdministrators\r\nLOCAL SERVICE\r\nNT SERVICE\\autotimesvc is added in v1909 cumulative update.</check-content></check></Rule></Group><Group id=\"V-63857\"><title>WN10-UR-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78347r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000040</version><title>The Create a pagefile user right must only be assigned to the Administrators group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Create a pagefile\" user right can change the size of a pagefile, which could affect system performance.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69785r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Create a pagefile\" to only include the following groups or accounts:\r\n\r\nAdministrators</fixtext><fix id=\"F-69785r1_fix\" /><check system=\"C-64607r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Create a pagefile\" user right, this is a finding:\r\n\r\nAdministrators</check-content></check></Rule></Group><Group id=\"V-63859\"><title>WN10-UR-000045</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78349r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-UR-000045</version><title>The Create a token object user right must not be assigned to any groups or accounts.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nThe \"Create a token object\" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69787r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Create a token object\" to be defined but containing no entries (blank).</fixtext><fix id=\"F-69787r2_fix\" /><check system=\"C-64609r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts are granted the \"Create a token object\" user right, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63861\"><title>WN10-UR-000050</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78351r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000050</version><title>The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Create global objects\" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69789r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Create global objects\" to only include the following groups or accounts:\r\n\r\nAdministrators\r\nLOCAL SERVICE\r\nNETWORK SERVICE\r\nSERVICE</fixtext><fix id=\"F-69789r1_fix\" /><check system=\"C-64611r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Create global objects\" user right, this is a finding:\r\n\r\nAdministrators\r\nLOCAL SERVICE\r\nNETWORK SERVICE\r\nSERVICE</check-content></check></Rule></Group><Group id=\"V-63863\"><title>WN10-UR-000055</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78353r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000055</version><title>The Create permanent shared objects user right must not be assigned to any groups or accounts.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Create permanent shared objects\" user right could expose sensitive data by creating shared objects.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69791r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Create permanent shared objects\" to be defined but containing no entries (blank).</fixtext><fix id=\"F-69791r1_fix\" /><check system=\"C-64613r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts are granted the \"Create permanent shared objects\" user right, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63865\"><title>WN10-UR-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78355r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000060</version><title>The Create symbolic links user right must only be assigned to the Administrators group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Create symbolic links\" user right can create pointers to other objects, which could potentially expose the system to attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69793r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Create symbolic links\" to only include the following groups or accounts:\r\n\r\nAdministrators</fixtext><fix id=\"F-69793r1_fix\" /><check system=\"C-76167r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Create symbolic links\" user right, this is a finding:\r\n\r\nAdministrators\r\n\r\nIf the workstation has an approved use of Hyper-V, such as being used as a dedicated admin workstation using Hyper-V to separate administration and standard user functions, \"NT VIRTUAL MACHINES\\VIRTUAL MACHINE\" may be assigned this user right and is not a finding.</check-content></check></Rule></Group><Group id=\"V-63869\"><title>WN10-UR-000065</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78359r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-UR-000065</version><title>The Debug programs user right must only be assigned to the Administrators group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Debug Programs\" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components.  This right is given to Administrators in the default configuration.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69797r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Debug programs\" to only include the following groups or accounts:\r\n\r\nAdministrators</fixtext><fix id=\"F-69797r1_fix\" /><check system=\"C-64619r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Debug Programs\" user right, this is a finding:\r\n\r\nAdministrators</check-content></check></Rule></Group><Group id=\"V-63871\"><title>WN10-UR-000070</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78361r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000070</version><title>The Deny access to this computer from the network user right on workstations must be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\r\n\r\nThe \"Deny access to this computer from the network\" right defines the accounts that are prevented from logging on from the network.\r\n\r\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.\r\n\r\nLocal accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks.\r\n\r\nThe Guests group must be assigned this right to prevent unauthenticated access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000213</ident><fixtext fixref=\"F-88441r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Deny access to this computer from the network\" to include the following.\r\n\r\nDomain Systems Only:\r\nEnterprise Admins group\r\nDomain Admins group\r\nLocal account (see Note below)\r\n\r\nAll Systems:\r\nGuests group\r\n\r\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\r\n\r\nNote: \"Local account\" is a built-in security group used to assign user rights and permissions to all local accounts.</fixtext><fix id=\"F-88441r1_fix\" /><check system=\"C-81369r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\n\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf the following groups or accounts are not defined for the \"Deny access to this computer from the network\" right, this is a finding:\r\n\r\nDomain Systems Only:\r\nEnterprise Admins group\r\nDomain Admins group\r\nLocal account (see Note below)\r\n\r\nAll Systems:\r\nGuests group\r\n\r\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\r\n\r\nNote: \"Local account\" is a built-in security group used to assign user rights and permissions to all local accounts.</check-content></check></Rule></Group><Group id=\"V-63873\"><title>WN10-UR-000075</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78363r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000075</version><title>The Deny log on as a batch job user right on domain-joined workstations must be configured to prevent access from highly privileged domain accounts.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nThe \"Deny log on as a batch job\" right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler.\r\n\r\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000213</ident><fixtext fixref=\"F-69801r1_fix\">This requirement is applicable to domain-joined systems, for standalone systems this is NA.\r\n\r\nConfigure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Deny log on as a batch job\" to include the following.\r\n\r\nDomain Systems Only:\r\nEnterprise Admin Group\r\nDomain Admin Group</fixtext><fix id=\"F-69801r1_fix\" /><check system=\"C-64623r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This requirement is applicable to domain-joined systems, for standalone systems this is NA.\r\n\r\nVerify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf the following groups or accounts are not defined for the \"Deny log on as a batch job\" right, this is a finding:\r\n\r\nDomain Systems Only:\r\nEnterprise Admin Group\r\nDomain Admin Group</check-content></check></Rule></Group><Group id=\"V-63875\"><title>WN10-UR-000080</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78365r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000080</version><title>The Deny log on as a service user right on Windows 10 domain-joined workstations must be configured to prevent access from highly privileged domain accounts.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nThe \"Deny log on as a service\" right defines accounts that are denied log on as a service.\r\n\r\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain.\r\n\r\nIncorrect configurations could prevent services from starting and result in a DoS.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000213</ident><fixtext fixref=\"F-100993r1_fix\">This requirement is applicable to domain-joined systems, for standalone systems this is NA.\r\n\r\nConfigure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Deny log on as a service\" to include the following.\r\n\r\nDomain Systems Only:\r\nEnterprise Admins Group\r\nDomain Admins Group</fixtext><fix id=\"F-100993r1_fix\" /><check system=\"C-94081r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This requirement is applicable to domain-joined systems, for standalone systems this is NA.\r\n\r\nVerify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf the following groups or accounts are not defined for the \"Deny log on as a service\" right , this is a finding:\r\n\r\nDomain Systems Only:\r\nEnterprise Admins Group\r\nDomain Admins Group</check-content></check></Rule></Group><Group id=\"V-63877\"><title>WN10-UR-000085</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78367r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000085</version><title>The Deny log on locally user right on workstations must be configured to prevent access from highly privileged domain accounts on domain systems and unauthenticated access on all systems.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\r\n\r\nThe \"Deny log on locally\" right defines accounts that are prevented from logging on interactively.\r\n\r\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.\r\n\r\nThe Guests group must be assigned this right to prevent unauthenticated access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000213</ident><fixtext fixref=\"F-88443r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Deny log on locally\" to include the following.\r\n\r\nDomain Systems Only:\r\nEnterprise Admins Group\r\nDomain Admins Group\r\n\r\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\r\n\r\nAll Systems:\r\nGuests Group</fixtext><fix id=\"F-88443r1_fix\" /><check system=\"C-81371r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\n\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf the following groups or accounts are not defined for the \"Deny log on locally\" right, this is a finding.\r\n\r\nDomain Systems Only:\r\nEnterprise Admins Group\r\nDomain Admins Group\r\n\r\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\r\n\r\nAll Systems:\r\nGuests Group</check-content></check></Rule></Group><Group id=\"V-63879\"><title>WN10-UR-000090</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78369r4_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000090</version><title>The Deny log on through Remote Desktop Services user right on Windows 10 workstations must at a minimum be configured to prevent access from highly privileged domain accounts and local accounts on domain systems and unauthenticated access on all systems.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\r\n\r\nThe \"Deny log on through Remote Desktop Services\" right defines the accounts that are prevented from logging on using Remote Desktop Services.\r\n\r\nIf Remote Desktop Services is not used by the organization, the Everyone group must be assigned this right to prevent all access.\r\n\r\nIn an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.\r\n\r\nLocal accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks.\r\n\r\nThe Guests group must be assigned this right to prevent unauthenticated access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000213</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002314</ident><fixtext fixref=\"F-88445r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Deny log on through Remote Desktop Services\" to include the following.\r\n\r\nIf Remote Desktop Services is not used by the organization, assign the Everyone group this right to prevent all access.\r\n\r\nDomain Systems Only:\r\nEnterprise Admins group\r\nDomain Admins group\r\nLocal account (see Note below)\r\n\r\nAll Systems:\r\nGuests group\r\n\r\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\r\n\r\nNote: \"Local account\" is a built-in security group used to assign user rights and permissions to all local accounts.</fixtext><fix id=\"F-88445r1_fix\" /><check system=\"C-94083r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\n\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf the following groups or accounts are not defined for the \"Deny log on through Remote Desktop Services\" right, this is a finding:\r\n\r\nIf Remote Desktop Services is not used by the organization, the \"Everyone\" group can replace all of the groups listed below.\r\n\r\nDomain Systems Only:\r\nEnterprise Admins group\r\nDomain Admins group\r\nLocal account (see Note below)\r\n\r\nAll Systems:\r\nGuests group\r\n\r\nPrivileged Access Workstations (PAWs) dedicated to the management of Active Directory are exempt from denying the Enterprise Admins and Domain Admins groups. (See the Windows Privileged Access Workstation STIG for PAW requirements.)\r\n\r\nNote: \"Local account\" is a built-in security group used to assign user rights and permissions to all local accounts.</check-content></check></Rule></Group><Group id=\"V-63881\"><title>WN10-UR-000095</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78371r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000095</version><title>The Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nThe \"Enable computer and user accounts to be trusted for delegation\" user right allows the \"Trusted for Delegation\" setting to be changed. This could potentially allow unauthorized users to impersonate other users.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69809r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Enable computer and user accounts to be trusted for delegation\" to be defined but containing no entries (blank).</fixtext><fix id=\"F-69809r1_fix\" /><check system=\"C-64631r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts are granted the \"Enable computer and user accounts to be trusted for delegation\" user right, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63883\"><title>WN10-UR-000100</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78373r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000100</version><title>The Force shutdown from a remote system user right must only be assigned to the Administrators group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Force shutdown from a remote system\" user right can remotely shut down a system which could result in a DoS.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69811r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Force shutdown from a remote system\" to only include the following groups or accounts:\r\n\r\nAdministrators</fixtext><fix id=\"F-69811r1_fix\" /><check system=\"C-64633r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Force shutdown from a remote system\" user right, this is a finding:\r\n\r\nAdministrators</check-content></check></Rule></Group><Group id=\"V-63889\"><title>WN10-UR-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78379r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000110</version><title>The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nThe \"Impersonate a client after authentication\" user right allows a program to impersonate another user or account to run on their behalf. An attacker could potentially use this to elevate privileges.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69817r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Impersonate a client after authentication\" to only include the following groups or accounts:\r\n\r\nAdministrators\r\nLOCAL SERVICE\r\nNETWORK SERVICE\r\nSERVICE</fixtext><fix id=\"F-69817r1_fix\" /><check system=\"C-64639r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Impersonate a client after authentication\" user right, this is a finding:\r\n\r\nAdministrators\r\nLOCAL SERVICE\r\nNETWORK SERVICE\r\nSERVICE</check-content></check></Rule></Group><Group id=\"V-63917\"><title>WN10-UR-000120</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78407r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000120</version><title>The Load and unload device drivers user right must only be assigned to the Administrators group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nThe \"Load and unload device drivers\" user right allows device drivers to dynamically be loaded on a system by a user. This could potentially be used to install malicious code by an attacker.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69845r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Load and unload device drivers\" to only include the following groups or accounts:\r\n\r\nAdministrators</fixtext><fix id=\"F-69845r1_fix\" /><check system=\"C-64667r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Load and unload device drivers\" user right, this is a finding:\r\n\r\nAdministrators</check-content></check></Rule></Group><Group id=\"V-63925\"><title>WN10-UR-000125</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78415r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000125</version><title>The Lock pages in memory user right must not be assigned to any groups or accounts.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nThe \"Lock pages in memory\" user right allows physical memory to be assigned to processes, which could cause performance issues or a DoS.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69853r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Lock pages in memory\" to be defined but containing no entries (blank).</fixtext><fix id=\"F-69853r1_fix\" /><check system=\"C-64675r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts are granted the \"Lock pages in memory\" user right, this is a finding.</check-content></check></Rule></Group><Group id=\"V-63927\"><title>WN10-UR-000130</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78417r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000130</version><title>The Manage auditing and security log user right must only be assigned to the Administrators group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Manage auditing and security log\" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000162</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000163</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000164</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000171</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001914</ident><fixtext fixref=\"F-69855r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Manage auditing and security log\" to only include the following groups or accounts:\r\n\r\nAdministrators</fixtext><fix id=\"F-69855r1_fix\" /><check system=\"C-64677r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Manage auditing and security log\" user right, this is a finding:\r\n\r\nAdministrators\r\n\r\nIf the organization has an \"Auditors\" group the assignment of this group to the user right would not be a finding.</check-content></check></Rule></Group><Group id=\"V-63931\"><title>WN10-UR-000140</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78421r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000140</version><title>The Modify firmware environment values user right must only be assigned to the Administrators group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Modify firmware environment values\" user right can change hardware configuration environment variables. This could result in hardware failures or a DoS.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69859r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Modify firmware environment values\" to only include the following groups or accounts:\r\n\r\nAdministrators</fixtext><fix id=\"F-69859r1_fix\" /><check system=\"C-64681r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Modify firmware environment values\" user right, this is a finding:\r\n\r\nAdministrators</check-content></check></Rule></Group><Group id=\"V-63933\"><title>WN10-UR-000145</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78423r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000145</version><title>The Perform volume maintenance tasks user right must only be assigned to the Administrators group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Perform volume maintenance tasks\" user right can manage volume and disk configurations. They could potentially delete volumes, resulting in, data loss or a DoS.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69861r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Perform volume maintenance tasks\" to only include the following groups or accounts:\r\n\r\nAdministrators</fixtext><fix id=\"F-69861r1_fix\" /><check system=\"C-64683r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Perform volume maintenance tasks\" user right, this is a finding:\r\n\r\nAdministrators</check-content></check></Rule></Group><Group id=\"V-63935\"><title>WN10-UR-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78425r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000150</version><title>The Profile single process user right must only be assigned to the Administrators group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Profile single process\" user right can monitor non-system processes performance. An attacker could potentially use this to identify processes to attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69863r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Profile single process\" to only include the following groups or accounts:\r\n\r\nAdministrators</fixtext><fix id=\"F-69863r1_fix\" /><check system=\"C-64685r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Profile single process\" user right, this is a finding:\r\n\r\nAdministrators</check-content></check></Rule></Group><Group id=\"V-63939\"><title>WN10-UR-000160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78429r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000160</version><title>The Restore files and directories user right must only be assigned to the Administrators group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Restore files and directories\" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to over-write more current data.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69867r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Restore files and directories\" to only include the following groups or accounts:\r\n\r\nAdministrators</fixtext><fix id=\"F-69867r1_fix\" /><check system=\"C-64691r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Restore files and directories\" user right, this is a finding:\r\n\r\nAdministrators</check-content></check></Rule></Group><Group id=\"V-63941\"><title>WN10-UR-000165</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-78431r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UR-000165</version><title>The Take ownership of files or other objects user right must only be assigned to the Administrators group.</title><description>&lt;VulnDiscussion&gt;Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.\r\n\r\nAccounts with the \"Take ownership of files or other objects\" user right can take ownership of objects and make changes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-69869r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment &gt;&gt; \"Take ownership of files or other objects\" to only include the following groups or accounts:\r\n\r\nAdministrators</fixtext><fix id=\"F-69869r1_fix\" /><check system=\"C-64693r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the effective setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nIf any groups or accounts other than the following are granted the \"Take ownership of files or other objects\" user right, this is a finding:\r\n\r\nAdministrators</check-content></check></Rule></Group><Group id=\"V-65681\"><title>WN10-CC-000206</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-80171r3_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-CC-000206</version><title>Windows Update must not obtain updates from other PCs on the Internet.</title><description>&lt;VulnDiscussion&gt;Windows 10 allows Windows Update to obtain updates from additional sources instead of Microsoft. In addition to Microsoft, updates can be obtained from and sent to PCs on the local network as well as on the Internet. This is part of the Windows Update trusted process, however to minimize outside exposure, obtaining updates from or sending to systems on the Internet must be prevented.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-83251r4_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Delivery Optimization &gt;&gt; \"Download Mode\" to \"Enabled\" with any option except \"Internet\" selected.\r\n\r\nAcceptable selections include:\r\nBypass (100)\r\nGroup (2)\r\nHTTP only (0)\r\nLAN (1)\r\nSimple (99)\r\n\r\nv1507 (LTSB) does not include this group policy setting locally. For domain joined systems, configure through domain group policy as \"HTTP only (0)\" or \"Lan (1)\". Standalone systems configure using Settings &gt;&gt; Update &amp; Security &gt;&gt; Windows Update &gt;&gt; Advanced Options &gt;&gt; \"Choose how updates are delivered\" with either \"Off\" or \"PCs on my local network\" selected.</fixtext><fix id=\"F-83251r4_fix\" /><check system=\"C-76221r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization\\\r\n\r\nValue Name: DODownloadMode\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x00000000 (0) - No peering (HTTP Only)\r\n0x00000001 (1) - Peers on same NAT only (LAN)\r\n0x00000002 (2) - Local Network / Private group peering (Group)\r\n0x00000063 (99) - Simple download mode, no peering (Simple)\r\n0x00000064 (100) - Bypass mode, Delivery Optimization not used (Bypass)\r\n\r\nA value of 0x00000003 (3), Internet, is a finding.\r\n\r\nv1507 LTSB:\r\nDomain joined systems:\r\nVerify the registry value above.\r\nIf the value is not 0x00000000 (0) or 0x00000001 (1), this is a finding.\r\n\r\nStandalone systems (configured in Settings):\r\nIf the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeliveryOptimization\\Config\\\r\n\r\nValue Name: DODownloadMode\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x00000000 (0) - Off\r\n0x00000001 (1) - LAN</check-content></check></Rule></Group><Group id=\"V-68817\"><title>WN10-CC-000066</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-83409r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000066</version><title>Command line data must be included in process creation events.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nEnabling \"Include command line data for process creation events\" will record the command line information with the process creation events in the log.  This can provide additional detail when malware has run on a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000135</ident><fixtext fixref=\"F-74987r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Audit Process Creation &gt;&gt; \"Include command line in process creation events\" to \"Enabled\".</fixtext><fix id=\"F-74987r1_fix\" /><check system=\"C-69305r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE \r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Audit\\\r\n\r\nValue Name: ProcessCreationIncludeCmdLine_Enabled\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-68819\"><title>WN10-CC-000326</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-83411r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000326</version><title>PowerShell script block logging must be enabled on Windows 10.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nEnabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts.  This can provide additional detail when malware has run on a system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000135</ident><fixtext fixref=\"F-74989r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows PowerShell &gt;&gt; \"Turn on PowerShell Script Block Logging\" to \"Enabled\".</fixtext><fix id=\"F-74989r1_fix\" /><check system=\"C-94087r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE \r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\\\r\n\r\nValue Name: EnableScriptBlockLogging\r\n\r\nValue Type: REG_DWORD\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-68845\"><title>WN10-00-000145</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-83439r2_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-00-000145</version><title>Data Execution Prevention (DEP) must be configured to at least OptOut.</title><description>&lt;VulnDiscussion&gt;Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windows and other programs.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002824</ident><fixtext fixref=\"F-75017r2_fix\">Configure DEP to at least OptOut.\r\n\r\nNote: Suspend BitLocker before making changes to the DEP configuration.\r\n\r\nOpen a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).\r\nEnter \"BCDEDIT /set {current} nx OptOut\".  (If using PowerShell \"{current}\" must be enclosed in quotes.)\r\n\"AlwaysOn\", a more restrictive selection, is also valid but does not allow applications that do not function properly to be opted out of DEP.\r\n\r\nOpted out exceptions can be configured in the \"System Properties\".\r\n\r\nOpen \"System\" in Control Panel.\r\nSelect \"Advanced system settings\".\r\nClick \"Settings\" in the \"Performance\" section.\r\nSelect the \"Data Execution Prevention\" tab.\r\nApplications that are opted out are configured in the window below the selection \"Turn on DEP for all programs and services except those I select:\".</fixtext><fix id=\"F-75017r2_fix\" /><check system=\"C-77535r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Verify the DEP configuration.\r\nOpen a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).\r\nEnter \"BCDEdit /enum {current}\". (If using PowerShell \"{current}\" must be enclosed in quotes.)\r\nIf the value for \"nx\" is not \"OptOut\", this is a finding.\r\n(The more restrictive configuration of \"AlwaysOn\" would not be a finding.)</check-content></check></Rule></Group><Group id=\"V-68849\"><title>WN10-00-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-83445r4_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-00-000150</version><title>Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.</title><description>&lt;VulnDiscussion&gt;Attackers are constantly looking for vulnerabilities in systems and applications. Structured Exception Handling Overwrite Protection (SEHOP) blocks exploits that use the Structured Exception Handling overwrite technique, a common buffer overflow attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002824</ident><fixtext fixref=\"F-87295r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; MS Security Guide &gt;&gt; \"Enable Structured Exception Handling Overwrite Protection (SEHOP)\" to \"Enabled\".\r\n\r\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package. \"SecGuide.admx\" and \"SecGuide.adml\" must be copied to the \\Windows\\PolicyDefinitions and \\Windows\\PolicyDefinitions\\en-US directories respectively.</fixtext><fix id=\"F-87295r1_fix\" /><check system=\"C-80163r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is applicable to Windows 10 prior to v1709.\r\n\r\nVerify SEHOP is turned on.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\kernel\\\r\n\r\nValue Name: DisableExceptionChainValidation\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x00000000 (0)</check-content></check></Rule></Group><Group id=\"V-70637\"><title>WN10-00-000155</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-85259r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000155</version><title>The Windows PowerShell 2.0 feature must be disabled on the system.</title><description>&lt;VulnDiscussion&gt;Windows PowerShell 5.0 added advanced logging features which can provide additional detail when malware has been run on a system.  Disabling the Windows PowerShell 2.0 mitigates against a downgrade attack that evades the Windows PowerShell 5.0 script block logging feature.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-76869r1_fix\">Disable \"Windows PowerShell 2.0\" on the system.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\nEnter the following:\r\nDisable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root\r\n\r\nThis command should disable both \"MicrosoftWindowsPowerShellV2Root\" and \"MicrosoftWindowsPowerShellV2\" which correspond to \"Windows PowerShell 2.0\" and \"Windows PowerShell 2.0 Engine\" respectively in \"Turn Windows features on or off\".\r\n\r\nAlternately:\r\nSearch for \"Features\".\r\nSelect \"Turn Windows features on or off\".\r\nDe-select \"Windows PowerShell 2.0\".</fixtext><fix id=\"F-76869r1_fix\" /><check system=\"C-91429r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Run \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter the following:\r\nGet-WindowsOptionalFeature -Online | Where FeatureName -like *PowerShellv2*\r\n\r\nIf either of the following have a \"State\" of \"Enabled\", this is a finding.\r\n\r\nFeatureName : MicrosoftWindowsPowerShellV2\r\nState : Enabled\r\nFeatureName : MicrosoftWindowsPowerShellV2Root\r\nState : Enabled\r\n\r\nAlternately:\r\nSearch for \"Features\".\r\n\r\nSelect \"Turn Windows features on or off\".\r\n\r\nIf \"Windows PowerShell 2.0\" (whether the subcategory of \"Windows PowerShell 2.0 Engine\" is selected or not) is selected, this is a finding.</check-content></check></Rule></Group><Group id=\"V-70639\"><title>WN10-00-000160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-85261r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000160</version><title>The Server Message Block (SMB) v1 protocol must be disabled on the system.</title><description>&lt;VulnDiscussion&gt;SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.\r\n\r\nDisabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older Network Attached Storage (NAS) devices may only support SMBv1.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-76871r2_fix\">Disable the SMBv1 protocol.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter the following:\r\nDisable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol\r\n\r\nAlternately:\r\nSearch for \"Features\".\r\n\r\nSelect \"Turn Windows features on or off\".\r\n\r\nDe-select \"SMB 1.0/CIFS File Sharing Support\".</fixtext><fix id=\"F-76871r2_fix\" /><check system=\"C-74581r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Different methods are available to disable SMBv1 on Windows 10.  This is the preferred method, however if V-74723 and V-74725 are configured, this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter the following:\r\nGet-WindowsOptionalFeature -Online | Where FeatureName -eq SMB1Protocol\r\n\r\nIf \"State : Enabled\" is returned, this is a finding.\r\n\r\nAlternately:\r\nSearch for \"Features\".\r\n\r\nSelect \"Turn Windows features on or off\".\r\n\r\nIf \"SMB 1.0/CIFS File Sharing Support\" is selected, this is a finding.</check-content></check></Rule></Group><Group id=\"V-71759\"><title>WN10-AU-000054</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-86383r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000054</version><title>The system must be configured to audit Logon/Logoff - Account Lockout failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAccount Lockout events can be used to identify potentially malicious logon attempts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-78111r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Logon/Logoff &gt;&gt; \"Audit Account Lockout\" with \"Failure\" selected.</fixtext><fix id=\"F-78111r2_fix\" /><check system=\"C-72017r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\n\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\n\r\nEnter \"AuditPol /get /category:*\"\r\n\r\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\r\n\r\nLogon/Logoff &gt;&gt; Account Lockout - Failure</check-content></check></Rule></Group><Group id=\"V-71761\"><title>WN10-AU-000107</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-86385r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000107</version><title>The system must be configured to audit Policy Change - Authorization Policy Change successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAuthorization Policy Change records events related to changes in user rights, such as Create a token object.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-78113r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Policy Change &gt;&gt; \"Audit Authorization Policy Change\" with \"Success\" selected.</fixtext><fix id=\"F-78113r1_fix\" /><check system=\"C-72019r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective. \r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\n-Open a Command Prompt with elevated privileges (\"Run as Administrator\").\r\n-Enter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding.\r\n\r\nPolicy Change &gt;&gt; Authorization Policy Change - Success</check-content></check></Rule></Group><Group id=\"V-71763\"><title>WN10-CC-000038</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-86387r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000038</version><title>WDigest Authentication must be disabled.</title><description>&lt;VulnDiscussion&gt;When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft.  WDigest is disabled by default in Windows 10.  This setting ensures this is enforced.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-78115r4_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; MS Security Guide &gt;&gt; \"WDigest Authentication (disabling may require KB2871997)\" to \"Disabled\".\r\n\r\nThe patch referenced in the policy title is not required for Windows 10.\r\n\r\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package.  \"SecGuide.admx\" and \"SecGuide.adml\" must be copied to the \\Windows\\PolicyDefinitions and \\Windows\\PolicyDefinitions\\en-US directories respectively.</fixtext><fix id=\"F-78115r4_fix\" /><check system=\"C-72021r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\Wdigest\\\r\n\r\nValue Name: UseLogonCredential\r\n\r\nType: REG_DWORD\r\nValue:  0x00000000 (0)</check-content></check></Rule></Group><Group id=\"V-71765\"><title>WN10-CC-000044</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-86389r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000044</version><title>Internet connection sharing must be disabled.</title><description>&lt;VulnDiscussion&gt;Internet connection sharing makes it possible for an existing internet connection, such as through wireless, to be shared and used by other systems essentially creating a mobile hotspot.  This exposes the system sharing the connection to others with potentially malicious purpose.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-78117r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Network &gt;&gt; Network Connections &gt;&gt; \"Prohibit use of Internet Connection Sharing on your DNS domain network\" to \"Enabled\".</fixtext><fix id=\"F-78117r2_fix\" /><check system=\"C-72023r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\Network Connections\\\r\n\r\nValue Name: NC_ShowSharedAccessUI\r\n\r\nType: REG_DWORD\r\nValue: 0x00000000 (0)</check-content></check></Rule></Group><Group id=\"V-71769\"><title>WN10-SO-000167</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-86393r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000167</version><title>Remote calls to the Security Account Manager (SAM) must be restricted to Administrators.</title><description>&lt;VulnDiscussion&gt;The Windows Security Account Manager (SAM) stores users' passwords.  Restricting remote rpc connections to the SAM to Administrators helps protect those credentials.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-78121r3_fix\">Navigate to the policy Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; Security Options &gt;&gt; \"Network access: Restrict clients allowed to make remote calls to SAM\".\r\n\r\nSelect \"Edit Security\" to configure the \"Security descriptor:\".\r\n\r\nAdd \"Administrators\" in \"Group or user names:\" if it is not already listed (this is the default).\r\n\r\nSelect \"Administrators\" in \"Group or user names:\".\r\n\r\nSelect \"Allow\" for \"Remote Access\" in \"Permissions for \"Administrators\".\r\n\r\nClick \"OK\".\r\n\r\nThe \"Security descriptor:\" must be populated with \"O:BAG:BAD:(A;;RC;;;BA) for the policy to be enforced.</fixtext><fix id=\"F-78121r3_fix\" /><check system=\"C-76223r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Windows 10 v1507 LTSB version does not include this setting, it is NA for those systems.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Control\\Lsa\\\r\n\r\nValue Name: RestrictRemoteSAM\r\n\r\nValue Type: REG_SZ\r\nValue: O:BAG:BAD:(A;;RC;;;BA)</check-content></check></Rule></Group><Group id=\"V-71771\"><title>WN10-CC-000197</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-86395r2_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-CC-000197</version><title>Microsoft consumer experiences must be turned off.</title><description>&lt;VulnDiscussion&gt;Microsoft consumer experiences provides suggestions and notifications to users, which may include the installation of Windows Store apps.  Organizations may control the execution of applications through other means such as whitelisting.  Turning off Microsoft consumer experiences will help prevent the unwanted installation of suggested applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-78123r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Cloud Content &gt;&gt; \"Turn off Microsoft consumer experiences\" to \"Enabled\".</fixtext><fix id=\"F-78123r1_fix\" /><check system=\"C-81363r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Windows 10 v1507 LTSB version does not include this setting; it is NA for those systems.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent\\\r\n\r\nValue Name: DisableWindowsConsumerFeatures\r\n\r\nType: REG_DWORD\r\nValue: 0x00000001 (1)</check-content></check></Rule></Group><Group id=\"V-72329\"><title>WN10-CC-000039</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-86953r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000039</version><title>Run as different user must be removed from context menus.</title><description>&lt;VulnDiscussion&gt;The \"Run as different user\" selection from context menus allows the use of credentials other than the currently logged on user.  Using privileged credentials in a standard user session can expose those credentials to theft.  Removing this option from context menus helps prevent this from occurring.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-78683r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; MS Security Guide &gt;&gt; \"Remove \"Run as Different User\" from context menus\" to \"Enabled\".\r\n\r\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package.  \"SecGuide.admx\" and \"SecGuide.adml\" must be copied to the \\Windows\\PolicyDefinitions and \\Windows\\PolicyDefinitions\\en-US directories respectively.</fixtext><fix id=\"F-78683r2_fix\" /><check system=\"C-72563r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry values do not exist or are not configured as specified, this is a finding.\r\nThe policy configures the same Value Name, Type and Value under four different registry paths.\r\n\r\nRegistry Hive:  HKEY_LOCAL_MACHINE\r\nRegistry Paths:  \r\n\\SOFTWARE\\Classes\\batfile\\shell\\runasuser\\\r\n\\SOFTWARE\\Classes\\cmdfile\\shell\\runasuser\\\r\n\\SOFTWARE\\Classes\\exefile\\shell\\runasuser\\\r\n\\SOFTWARE\\Classes\\mscfile\\shell\\runasuser\\\r\n\r\nValue Name:  SuppressionPolicy\r\n\r\nType:  REG_DWORD\r\nValue:  0x00001000 (4096)</check-content></check></Rule></Group><Group id=\"V-72765\"><title>WN10-00-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-87403r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000210</version><title>Bluetooth must be turned off unless approved by the organization.</title><description>&lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-79175r1_fix\">Turn off Bluetooth radios not organizationally approved. Establish an organizational policy for the use of Bluetooth.</fixtext><fix id=\"F-79175r1_fix\" /><check system=\"C-72913r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA if the system does not have Bluetooth.\r\n\r\nVerify the Bluetooth radio is turned off unless approved by the organization. If it is not, this is a finding.\r\n\r\nApproval must be documented with the ISSO.</check-content></check></Rule></Group><Group id=\"V-72767\"><title>WN10-00-000220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-87405r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000220</version><title>Bluetooth must be turned off when not in use.</title><description>&lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-79177r1_fix\">Turn off Bluetooth radios when not in use. Establish an organizational policy for the use of Bluetooth to include training of personnel.</fixtext><fix id=\"F-79177r1_fix\" /><check system=\"C-72915r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA if the system does not have Bluetooth.\r\n\r\nVerify the organization has a policy to turn off Bluetooth when not in use and personnel are trained. If it does not, this is a finding.</check-content></check></Rule></Group><Group id=\"V-72769\"><title>WN10-00-000230</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-87407r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000230</version><title>The system must notify the user when a Bluetooth device attempts to connect.</title><description>&lt;VulnDiscussion&gt;If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-79179r1_fix\">Configure Bluetooth to notify users if devices attempt to connect.\r\nView Bluetooth Settings.\r\nEnsure \"Alert me when a new Bluetooth device wants to connect\" is checked.</fixtext><fix id=\"F-79179r1_fix\" /><check system=\"C-72917r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA if the system does not have Bluetooth, or if Bluetooth is turned off per the organizations policy.\r\n\r\nSearch for \"Bluetooth\".\r\nView Bluetooth Settings.\r\nSelect \"More Bluetooth Options\"\r\nIf \"Alert me when a new Bluetooth device wants to connect\" is not checked, this is a finding.</check-content></check></Rule></Group><Group id=\"V-74409\"><title>WN10-AU-000084</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-89083r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000084</version><title>Windows 10 must be configured to audit Object Access - Other Object Access Events failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAuditing for other object access records events related to the management of task scheduler jobs and COM+ objects.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-80951r4_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Object Access &gt;&gt; \"Audit Other Object Access Events\" with \"Failure\" selected.</fixtext><fix id=\"F-80951r4_fix\" /><check system=\"C-74295r6_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\n\r\nOpen PowerShell or a Command Prompt with elevated privileges (\"Run as Administrator\").\r\n\r\nEnter \"AuditPol /get /category:*\"\r\n\r\nCompare the AuditPol settings with the following:\r\n\r\nObject Access &gt;&gt; Other Object Access Events - Failure\r\n\r\nIf the system does not audit the above, this is a finding.</check-content></check></Rule></Group><Group id=\"V-74411\"><title>WN10-AU-000083</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-89085r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000083</version><title>Windows 10 must be configured to audit Object Access - Other Object Access Events successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAuditing for other object access records events related to the management of task scheduler jobs and COM+ objects.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-80953r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Object Access &gt;&gt; \"Audit Other Object Access Events\" with \"Success\" selected.</fixtext><fix id=\"F-80953r2_fix\" /><check system=\"C-74297r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\n\r\nOpen PowerShell or a Command Prompt with elevated privileges (\"Run as Administrator\").\r\n\r\nEnter \"AuditPol /get /category:*\"\r\n\r\nCompare the AuditPol settings with the following:\r\n\r\nObject Access &gt;&gt; Other Object Access Events - Success\r\n\r\nIf the system does not audit the above, this is a finding.</check-content></check></Rule></Group><Group id=\"V-74413\"><title>WN10-CC-000052</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-89087r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000052</version><title>Windows 10 must be configured to prioritize ECC Curves with longer key lengths first.</title><description>&lt;VulnDiscussion&gt;Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. By default Windows uses ECC curves with shorter key lengths first.  Requiring ECC curves with longer key lengths to be prioritized first helps ensure more secure algorithms are used.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000803</ident><fixtext fixref=\"F-80955r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Network &gt;&gt; SSL Configuration Settings &gt;&gt; \"ECC Curve Order\" to \"Enabled\" with \"ECC Curve Order:\" including the following in the order listed:\r\n\r\nNistP384\r\nNistP256</fixtext><fix id=\"F-80955r1_fix\" /><check system=\"C-94089r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Cryptography\\Configuration\\SSL\\00010002\\\r\n\r\nValue Name: EccCurves\r\n\r\nValue Type: REG_MULTI_SZ\r\nValue: NistP384 NistP256</check-content></check></Rule></Group><Group id=\"V-74417\"><title>WN10-CC-000252</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-89091r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000252</version><title>Windows 10 must be configured to disable Windows Game Recording and Broadcasting.</title><description>&lt;VulnDiscussion&gt;Windows Game Recording and Broadcasting is intended for use with games, however it could potentially record screen shots of other applications and expose sensitive data.  Disabling the feature will prevent this from occurring.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-80959r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Game Recording and Broadcasting &gt;&gt; \"Enables or disables Windows Game Recording and Broadcasting\" to \"Disabled\".</fixtext><fix id=\"F-80959r1_fix\" /><check system=\"C-91423r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA for Windows 10 LTSC\\B versions 1507 and 1607.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\GameDVR\\\r\n\r\nValue Name: AllowGameDVR\r\n\r\nType: REG_DWORD\r\nValue: 0x00000000 (0)</check-content></check></Rule></Group><Group id=\"V-74699\"><title>WN10-CC-000068</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-89373r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000068</version><title>Windows 10 must be configured to enable Remote host allows delegation of non-exportable credentials.</title><description>&lt;VulnDiscussion&gt;An exportable version of credentials is provided to remote hosts when using credential delegation which exposes them to theft on the remote host.  Restricted Admin mode or Remote Credential Guard allow delegation of non-exportable credentials providing additional protection of the credentials.  Enabling this configures the host to support Restricted Admin mode or Remote Credential Guard.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-81317r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Credentials Delegation &gt;&gt; \"Remote host allows delegation of non-exportable credentials\" to \"Enabled\".</fixtext><fix id=\"F-81317r1_fix\" /><check system=\"C-91425r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA for Windows 10 LTSC\\B versions 1507 and 1607.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\CredentialsDelegation\\\r\n\r\nValue Name: AllowProtectedCreds\r\n\r\nType: REG_DWORD\r\nValue: 0x00000001 (1)</check-content></check></Rule></Group><Group id=\"V-74719\"><title>WN10-00-000175</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-89393r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000175</version><title>The Secondary Logon service must be disabled on Windows 10.</title><description>&lt;VulnDiscussion&gt;The Secondary Logon service provides a means for entering alternate credentials, typically used to run commands with elevated privileges.  Using privileged credentials in a standard user session can expose those credentials to theft.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-81333r1_fix\">Configure the \"Secondary Logon\" service \"Startup Type\" to \"Disabled\".</fixtext><fix id=\"F-81333r1_fix\" /><check system=\"C-94093r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Run \"Services.msc\".\r\n\r\nLocate the \"Secondary Logon\" service.\r\n\r\nIf the \"Startup Type\" is not \"Disabled\" or the \"Status\" is \"Running\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-74721\"><title>WN10-AU-000082</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-89395r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000082</version><title>Windows 10 must be configured to audit Object Access - File Share successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAuditing file shares records events related to connection to shares on a system including system shares such as C$.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-81335r3_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Object Access &gt;&gt; \"Audit File Share\" with \"Success\" selected.</fixtext><fix id=\"F-81335r3_fix\" /><check system=\"C-74575r5_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\n\r\nOpen PowerShell or a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\"\r\n\r\nCompare the AuditPol settings with the following:\r\n\r\nObject Access &gt;&gt; File Share - Success\r\n\r\nIf the system does not audit the above, this is a finding.</check-content></check></Rule></Group><Group id=\"V-74723\"><title>WN10-00-000165</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-89397r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000165</version><title>The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.</title><description>&lt;VulnDiscussion&gt;SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.\r\n\r\nDisabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-81337r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; MS Security Guide &gt;&gt; \"Configure SMBv1 Server\" to \"Disabled\".\r\n\r\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package. \"SecGuide.admx\" and \"SecGuide.adml\" must be copied to the \\Windows\\PolicyDefinitions and \\Windows\\PolicyDefinitions\\en-US directories respectively.   \r\n\r\nThe system must be restarted for the change to take effect.</fixtext><fix id=\"F-81337r2_fix\" /><check system=\"C-74577r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Different methods are available to disable SMBv1 on Windows 10, if V-70639 is configured, this is NA.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters\\\r\n\r\nValue Name: SMB1\r\n\r\nType: REG_DWORD\r\nValue: 0x00000000 (0)</check-content></check></Rule></Group><Group id=\"V-74725\"><title>WN10-00-000170</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-89399r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000170</version><title>The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.</title><description>&lt;VulnDiscussion&gt;SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.\r\n\r\nDisabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-81339r3_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; MS Security Guide &gt;&gt; \"Configure SMBv1 client driver\" to \"Enabled\" with \"Disable driver (recommended)\" selected for \"Configure MrxSmb10 driver\".\r\n\r\nThis policy setting requires the installation of the SecGuide custom templates included with the STIG package. \"SecGuide.admx\" and \"SecGuide.adml\" must be copied to the \\Windows\\PolicyDefinitions and \\Windows\\PolicyDefinitions\\en-US directories respectively.   \r\n\r\nThe system must be restarted for the changes to take effect. </fixtext><fix id=\"F-81339r3_fix\" /><check system=\"C-74579r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Different methods are available to disable SMBv1 on Windows 10, if V-70639 is configured, this is NA.\r\n\r\nIf the following registry value is not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SYSTEM\\CurrentControlSet\\Services\\mrxsmb10\\\r\n\r\nValue Name: Start\r\n\r\nType: REG_DWORD\r\nValue: 0x00000004 (4)</check-content></check></Rule></Group><Group id=\"V-75027\"><title>WN10-AU-000081</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-89701r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000081</version><title>Windows 10 must be configured to audit Object Access - File Share failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAuditing file shares records events related to connection to shares on a system including system shares such as C$.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-81643r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Object Access &gt;&gt; \"Audit File Share\" with \"Failure\" selected.</fixtext><fix id=\"F-81643r1_fix\" /><check system=\"C-74879r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\n\r\nOpen PowerShell or a Command Prompt with elevated privileges (\"Run as Administrator\").\r\n\r\nEnter \"AuditPol /get /category:*\"\r\n\r\nCompare the AuditPol settings with the following:\r\n\r\nObject Access &gt;&gt; File Share - Failure\r\n\r\nIf the system does not audit the above, this is a finding.</check-content></check></Rule></Group><Group id=\"V-76505\"><title>WN10-00-000190</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91201r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000190</version><title>Orphaned security identifiers (SIDs) must be removed from user rights on Windows 10.</title><description>&lt;VulnDiscussion&gt;Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups.  If the account or group objects are reanimated, there is a potential they may still have rights no longer intended.  Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-83185r1_fix\">Remove any unresolved SIDs found in User Rights assignments and determined to not be for currently valid accounts or groups by removing the accounts or groups from the appropriate group policy.</fixtext><fix id=\"F-83185r1_fix\" /><check system=\"C-76171r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Review the effective User Rights setting in Local Group Policy Editor.\r\nRun \"gpedit.msc\".\r\n\r\nNavigate to Local Computer Policy &gt;&gt; Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies &gt;&gt; User Rights Assignment.\r\n\r\nReview each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of \"*S-1-…\".)\r\n\r\nIf any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.</check-content></check></Rule></Group><Group id=\"V-77083\"><title>WN10-00-000015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91779r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000015</version><title>Windows 10 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.</title><description>&lt;VulnDiscussion&gt;UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in Legacy BIOS mode will not support these security features.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-83781r1_fix\">Configure UEFI firmware to run in UEFI mode, not Legacy BIOS mode.</fixtext><fix id=\"F-83781r1_fix\" /><check system=\"C-86429r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\r\n\r\nVerify the system firmware is configured to run in UEFI mode, not Legacy BIOS.\r\n\r\nRun \"System Information\".\r\n\r\nUnder \"System Summary\", if \"BIOS Mode\" does not display \"UEFI\", this is finding.</check-content></check></Rule></Group><Group id=\"V-77085\"><title>WN10-00-000020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91781r2_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-00-000020</version><title>Secure Boot must be enabled on Windows 10 systems.</title><description>&lt;VulnDiscussion&gt;Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-83783r1_fix\">Enable Secure Boot in the system firmware.</fixtext><fix id=\"F-83783r1_fix\" /><check system=\"C-86431r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows 10 hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. \r\n\r\nFor virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.\r\n\r\nRun \"System Information\".\r\n\r\nUnder \"System Summary\", if \"Secure Boot State\" does not display \"On\", this is finding.</check-content></check></Rule></Group><Group id=\"V-77091\"><title>WN10-EP-000020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91787r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000020</version><title>Windows 10 Exploit Protection system-level mitigation, Data Execution Prevention (DEP), must be on.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \"Data Execution Prevention (DEP)\", are enabled by default at the system level. DEP prevents code from being run from data-only memory pages. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-86717r3_fix\">Ensure Exploit Protection system-level mitigation, \"Data Execution Prevention (DEP)\", is turned on.  The default configuration in Exploit Protection is \"On by default\" which meets this requirement.\r\n\r\nOpen \"Windows Defender Security Center\".\r\n\r\nSelect \"App &amp; browser control\".\r\n\r\nSelect \"Exploit protection settings\".\r\n\r\nUnder \"System settings\", configure \"Data Execution Prevention (DEP)\" to \"On by default\" or \"Use default (&lt;On&gt;)\".   \r\n\r\nThe STIG package includes a DoD EP XML file in the \"Supporting Files\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn DEP on (other system level EP requirements can be combined under &lt;SystemConfig&gt;):\r\n\r\n&lt;SystemConfig&gt;\r\n  &lt;DEP Enable=\"true\"&gt;&lt;/DEP&gt;\r\n&lt;/SystemConfig&gt;\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\". It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-86717r3_fix\" /><check system=\"C-79579r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nThe default configuration in Exploit Protection is \"On by default\" which meets this requirement.  The PowerShell query results for this show as \"NOTSET\".\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -System\".\r\n\r\nIf the status of \"DEP: Enable\" is \"OFF\", this is a finding.\r\n\r\nValues that would not be a finding include:\r\nON\r\nNOTSET (Default configuration)</check-content></check></Rule></Group><Group id=\"V-77095\"><title>WN10-EP-000030</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91791r4_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000030</version><title>Windows 10 Exploit Protection system-level mitigation, Randomize memory allocations (Bottom-Up ASLR), must be on.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \"Randomize memory allocations (Bottom-Up ASLR)\", are enabled by default at the system level. Bottom-Up ASLR (address space layout randomization) randomizes locations for virtual memory allocations, including those for system structures. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002824</ident><fixtext fixref=\"F-86719r3_fix\">Ensure Exploit Protection system-level mitigation, \"Randomize memory allocations (Bottom-Up ASLR)\" is turned on. The default configuration in Exploit Protection is \"On by default\" which meets this requirement.\r\n\r\nOpen \"Windows Defender Security Center\".\r\n\r\nSelect \"App &amp; browser control\".\r\n\r\nSelect \"Exploit protection settings\".\r\n\r\nUnder \"System settings\", configure \"Randomize memory allocations (Bottom-Up ASLR)\" to \"On by default\" or \"Use default (&lt;On&gt;)\".   \r\n\r\nThe STIG package includes a DoD EP XML file in the \"Supporting Files\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn Bottom-Up ASLR on (other system level EP requirements can be combined under &lt;SystemConfig&gt;):\r\n\r\n&lt;SystemConfig&gt;\r\n  &lt;ASLR BottomUp=\"true\"&lt;/ASLR&gt;\r\n&lt;/SystemConfig&gt;\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\". It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-86719r3_fix\" /><check system=\"C-79581r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nThe default configuration in Exploit Protection is \"On by default\" which meets this requirement.  The PowerShell query results for this show as \"NOTSET\".\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -System\".\r\n\r\nIf the status of \"ASLR: BottomUp\" is \"OFF\", this is a finding.\r\n\r\nValues that would not be a finding include:\r\nON\r\nNOTSET (Default configuration)</check-content></check></Rule></Group><Group id=\"V-77097\"><title>WN10-EP-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91793r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000040</version><title>Windows 10 Exploit Protection system-level mitigation, Control flow guard (CFG), must be on.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \"Control flow guard (CFG)\", are enabled by default at the system level. CFG ensures flow integrity for indirect calls. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-86721r2_fix\">Ensure Exploit Protection system-level mitigation, \"Control flow guard (CFG)\", is turned on. The default configuration in Exploit Protection is \"On by default\" which meets this requirement.\r\n\r\nOpen \"Windows Defender Security Center\".\r\n\r\nSelect \"App &amp; browser control\".\r\n\r\nSelect \"Exploit protection settings\".\r\n\r\nUnder \"System settings\", configure \"Control flow guard (CFG)\" to \"On by default\" or \"Use default (&lt;On&gt;)\".   \r\n\r\nThe STIG package includes a DoD EP XML file in the \"Supporting Files\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn CFG on (other system level EP requirements can be combined under &lt;SystemConfig&gt;):\r\n\r\n&lt;SystemConfig&gt;\r\n  &lt;ControlFlowGuard Enable=\"true\"&gt;&lt;/ControlFlowGuard&gt;\r\n&lt;/SystemConfig&gt;\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\". It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-86721r2_fix\" /><check system=\"C-79583r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nThe default configuration in Exploit Protection is \"On by default\" which meets this requirement.  The PowerShell query results for this show as \"NOTSET\".\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -System\".\r\n\r\nIf the status of \"CFG: Enable\" is \"OFF\", this is a finding.\r\n\r\nValues that would not be a finding include:\r\nON\r\nNOTSET (Default configuration)</check-content></check></Rule></Group><Group id=\"V-77101\"><title>WN10-EP-000050</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91797r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000050</version><title>Windows 10 Exploit Protection system-level mitigation, Validate exception chains (SEHOP), must be on.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \"Validate exception chains (SEHOP)\", are enabled by default at the system level. SEHOP (structured exception handling overwrite protection) ensures the integrity of an exception chain during exception dispatch. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-86723r2_fix\">Ensure Exploit Protection system-level mitigation, \"Validate exception chains (SEHOP)\", is turned on. The default configuration in Exploit Protection is \"On by default\" which meets this requirement.\r\n\r\nOpen \"Windows Defender Security Center\".\r\n\r\nSelect \"App &amp; browser control\".\r\n\r\nSelect \"Exploit protection settings\".\r\n\r\nUnder \"System settings\", configure \"Validate exception chains (SEHOP)\" to \"On by default\" or \"Use default (&lt;On&gt;)\".   \r\n\r\nThe STIG package includes a DoD EP XML file in the \"Supporting Files\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn SEHOP on (other system level EP requirements can be combined under &lt;SystemConfig&gt;):\r\n\r\n&lt;SystemConfig&gt;\r\n  &lt;SEHOP Enable=\"true\"&gt;&lt;/SEHOP&gt;\r\n&lt;/SystemConfig&gt;\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\". It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-86723r2_fix\" /><check system=\"C-79585r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nThe default configuration in Exploit Protection is \"On by default\" which meets this requirement.  The PowerShell query results for this show as \"NOTSET\".\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -System\".\r\n\r\nIf the status of \"SEHOP: Enable\" is \"OFF\", this is a finding.\r\n\r\nValues that would not be a finding include:\r\nON\r\nNOTSET (Default configuration)</check-content></check></Rule></Group><Group id=\"V-77103\"><title>WN10-EP-000060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91799r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000060</version><title>Windows 10 Exploit Protection system-level mitigation, Validate heap integrity, must be on.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 enables mitigations against potential threats at the system and application level.  Several mitigations, including \"Validate heap integrity\", are enabled by default at the system level. \"Validate heap integrity\" terminates a process when heap corruption is detected. If this is turned off, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-86725r2_fix\">Ensure Exploit Protection system-level mitigation, \"Validate heap integrity\" is turned on. The default configuration in Exploit Protection is \"On by default\" which meets this requirement.\r\n\r\nOpen \"Windows Defender Security Center\".\r\n\r\nSelect \"App &amp; browser control\".\r\n\r\nSelect \"Exploit protection settings\".\r\n\r\nUnder \"System settings\", configure \"Validate heap integrity\" to \"On by default\" or \"Use default (&lt;On&gt;)\".   \r\n\r\nThe STIG package includes a DoD EP XML file in the \"Supporting Files\" folder for configuring application mitigations defined in the STIG.  This can also be modified to explicitly enforce the system level requirements.  Adding the following to the XML file will explicitly turn Validate heap integrity on (other system level EP requirements can be combined under &lt;SystemConfig&gt;):\r\n\r\n&lt;SystemConfig&gt;\r\n  &lt;Heap TerminateOnError=\"true\"&gt;&lt;/Heap&gt;\r\n&lt;/SystemConfig&gt;\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\". It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-86725r2_fix\" /><check system=\"C-79587r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nThe default configuration in Exploit Protection is \"On by default\" which meets this requirement.  The PowerShell query results for this show as \"NOTSET\".\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -System\".\r\n\r\nIf the status of \"Heap: TerminateOnError\" is \"OFF\", this is a finding.\r\n\r\nValues that would not be a finding include:\r\nON\r\nNOTSET (Default configuration)</check-content></check></Rule></Group><Group id=\"V-77189\"><title>WN10-EP-000070  </title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91885r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000070</version><title>Exploit Protection mitigations in Windows 10 must be configured for Acrobat.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84325r8_fix\">Ensure the following mitigations are configured as shown for Acrobat.exe:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84325r8_fix\" /><check system=\"C-94095r9_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name Acrobat.exe\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77191\"><title>WN10-EP-000080</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91887r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000080</version><title>Exploit Protection mitigations in Windows 10 must be configured for AcroRd32.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84329r7_fix\">Ensure the following mitigations are configured as shown for AcroRd32.exe:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot= False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\". It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84329r7_fix\" /><check system=\"C-94097r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name AcroRd32.exe\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot= False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77195\"><title>WN10-EP-000090</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91891r4_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000090</version><title>Exploit Protection mitigations in Windows 10 must be configured for chrome.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84333r5_fix\">Ensure the following mitigations are configured as shown forchrome.exe:\r\n\r\nDEP:\r\nOverrideDEP: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84333r5_fix\" /><check system=\"C-94099r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name chrome.exe\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverrideDEP: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77201\"><title>WN10-EP-000100</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91897r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000100</version><title>Exploit Protection mitigations in Windows 10 must be configured for EXCEL.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84337r7_fix\">Ensure the following mitigations are configured as shown for EXCEL.EXE:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84337r7_fix\" /><check system=\"C-94101r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name EXCEL.EXE\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77205\"><title>WN10-EP-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91901r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000110</version><title>Exploit Protection mitigations in Windows 10 must be configured for firefox.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-86915r3_fix\">Ensure the following mitigations are configured as shown  firefox.exe:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: On\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\". It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-86915r3_fix\" /><check system=\"C-79777r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name firefox.exe\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: On\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77209\"><title>WN10-EP-000120</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91905r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000120</version><title>Exploit Protection mitigations in Windows 10 must be configured for FLTLDR.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84341r6_fix\">Ensure the following mitigations are configured as shown for FLTLDR.EXE:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nImageLoad:\r\nOverrideBlockRemoteImages: False\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False \r\nOverrideExportAddressFilterPlus: False \r\nOverrideImportAddressFilter: False \r\nOverrideEnableRopStackPivot: False \r\nOverrideEnableRopCallerCheck: False \r\nOverrideEnableRopSimExec: False\r\n\r\nChild Process:\r\nOverrideChildProcess: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84341r6_fix\" /><check system=\"C-94103r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name FLTLDR.EXE\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nImageLoad:\r\nOverrideBlockRemoteImages: False\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False \r\nOverrideExportAddressFilterPlus: False \r\nOverrideImportAddressFilter: False \r\nOverrideEnableRopStackPivot: False \r\nOverrideEnableRopCallerCheck: False \r\nOverrideEnableRopSimExec: False\r\n\r\nChild Process:\r\nOverrideChildProcess: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77213\"><title>WN10-EP-000130</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91909r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000130</version><title>Exploit Protection mitigations in Windows 10 must be configured for GROOVE.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84343r6_fix\">Ensure the following mitigations are configured as shown GROOVE.EXE:\r\n\r\nDEP:\r\nOverrideDEP: False\r\n\r\nASLR:\r\nOverrideBlockRemoteImages: False\r\n\r\nImageLoad:\r\nForceRelocateImages: True\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nChild Process:\r\nOverrideChildProcess: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84343r6_fix\" /><check system=\"C-94105r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name GROOVE.EXE\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverrideDEP: False\r\n\r\nASLR:\r\nForceRelocateImages: On\r\n\r\nImageLoad:\r\nOverrideBlockRemoteImages: False\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\n\r\nChild Process:\r\nOverrideChildProcess: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here.  If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77217\"><title>WN10-EP-000140</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91913r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000140</version><title>Exploit Protection mitigations in Windows 10 must be configured for iexplore.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84347r6_fix\">Ensure the following mitigations are configured as shown for iexplore.exe:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84347r6_fix\" /><check system=\"C-94107r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name iexplore.exe\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77221\"><title>WN10-EP-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91917r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000150</version><title>Exploit Protection mitigations in Windows 10 must be configured for INFOPATH.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84349r6_fix\">Ensure the following mitigations are configured as shown for INFOPATH.EXE:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84349r6_fix\" /><check system=\"C-94109r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name INFOPATH.EXE\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77223\"><title>WN10-EP-000160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91919r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000160</version><title>Exploit Protection mitigations in Windows 10 must be configured for java.exe, javaw.exe, and javaws.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84353r5_fix\">Ensure the following mitigations are configured for java.exe, javaw.exe, and javaws.exe:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84353r5_fix\" /><check system=\"C-94111r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name [application name]\" with each of the following substituted for [application name]:\r\njava.exe, javaw.exe, and javaws.exe\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77227\"><title>WN10-EP-000170</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91923r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000170</version><title>Exploit Protection mitigations in Windows 10 must be configured for lync.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84357r7_fix\">Ensure the following mitigations are configured as shown for lync.exe:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84357r7_fix\" /><check system=\"C-94113r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name lync.exe\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77231\"><title>WN10-EP-000180</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91927r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000180</version><title>Exploit Protection mitigations in Windows 10 must be configured for MSACCESS.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84359r6_fix\">Ensure the following mitigations are configured as shown for MSACCESS.EXE:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84359r6_fix\" /><check system=\"C-94115r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name MSACCESS.EXE\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77233\"><title>WN10-EP-000190</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91929r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000190</version><title>Exploit Protection mitigations in Windows 10 must be configured for MSPUB.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84361r6_fix\">Ensure the following mitigations are configured as shown for MSPUB.EXE:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84361r6_fix\" /><check system=\"C-94117r5_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name MSPUB.EXE\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77235\"><title>WN10-EP-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91931r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000210</version><title>Exploit Protection mitigations in Windows 10 must be configured for OneDrive.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84321r7_fix\">Ensure the following mitigations are configured for OneDrive.exe:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nOverrideRelocateImages: NOTSET\r\n\r\nImageLoad:\r\nOverrideBlockRemoteImages: False\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False \r\nOverrideExportAddressFilterPlus: False \r\nOverrideImportAddressFilter: False \r\nOverrideEnableRopStackPivot: False \r\nOverrideEnableRopCallerCheck: False \r\nOverrideEnableRopSimExec: False\r\n\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84321r7_fix\" /><check system=\"C-94119r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name OneDrive.exe\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nOverrideRelocateImages: NOTSET\r\n\r\nImageLoad:\r\nOverrideBlockRemoteImages: False\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False \r\nOverrideExportAddressFilterPlus: False \r\nOverrideImportAddressFilter: False \r\nOverrideEnableRopStackPivot: False \r\nOverrideEnableRopCallerCheck: False \r\nOverrideEnableRopSimExec: False\r\n\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77239\"><title>WN10-EP-000200</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91935r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000200</version><title>Exploit Protection mitigations in Windows 10 must be configured for OIS.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84315r7_fix\">Ensure the following mitigations are configured as shown for OIS.EXE:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84315r7_fix\" /><check system=\"C-94121r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name OIS.EXE\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverrideDEP: False\r\n\r\nPayload:\r\nOverrideEnableExportAddressFilter: False\r\nOverrideEnableExportAddressFilterPlus: False\r\nOverrideEnableImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77243\"><title>WN10-EP-000220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91939r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000220</version><title>Exploit Protection mitigations in Windows 10 must be configured for OUTLOOK.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84363r6_fix\">Ensure the following mitigations are configured as shown for OUTLOOK.EXE:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84363r6_fix\" /><check system=\"C-94123r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name OUTLOOK.EXE\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77245\"><title>WN10-EP-000230</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91941r4_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000230</version><title>Exploit Protection mitigations in Windows 10 must be configured for plugin-container.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84365r8_fix\">Ensure the following mitigations are configured as shown forplugin-container.exe:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84365r8_fix\" /><check system=\"C-94125r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name plugin-container.exe\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status of \"ON\" are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77247\"><title>WN10-EP-000240</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91943r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000240</version><title>Exploit Protection mitigations in Windows 10 must be configured for POWERPNT.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84503r8_fix\">Ensure the following mitigations are configured as shown for POWERPNT.EXE:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84503r8_fix\" /><check system=\"C-94127r5_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name POWERPNT.EXE\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77249\"><title>WN10-EP-000250</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91945r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000250</version><title>Exploit Protection mitigations in Windows 10 must be configured for PPTVIEW.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84505r7_fix\">Ensure the following mitigations are configured as shown for PPTVIEW.EXE:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84505r7_fix\" /><check system=\"C-94129r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name PPTVIEW.EXE\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77255\"><title>WN10-EP-000260</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91951r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000260</version><title>Exploit Protection mitigations in Windows 10 must be configured for VISIO.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84507r8_fix\">Ensure the following mitigations are configured as shown for VISIO.EXE:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84507r8_fix\" /><check system=\"C-94131r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name VISIO.EXE\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77259\"><title>WN10-EP-000270</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91955r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000270</version><title>Exploit Protection mitigations in Windows 10 must be configured for VPREVIEW.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84509r7_fix\">Ensure the following mitigations are configured as shown for VPREVIEW.EXE:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84509r7_fix\" /><check system=\"C-94133r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name VPREVIEW.EXE\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77263\"><title>WN10-EP-000280</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91959r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000280</version><title>Exploit Protection mitigations in Windows 10 must be configured for WINWORD.EXE.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84511r7_fix\">Ensure the following mitigations are configured as shown for WINWORD.EXE:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84511r7_fix\" /><check system=\"C-94135r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name WINWORD.EXE\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nASLR:\r\nForceRelocateImages: ON\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status of are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77267\"><title>WN10-EP-000290</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91963r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000290</version><title>Exploit Protection mitigations in Windows 10 must be configured for wmplayer.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84513r7_fix\">Ensure the following mitigations are configured as shown for wmplayer.exe:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84513r7_fix\" /><check system=\"C-94137r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name wmplayer.exe\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-77269\"><title>WN10-EP-000300</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-91965r5_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000300</version><title>Exploit Protection mitigations in Windows 10 must be configured for wordpad.exe.</title><description>&lt;VulnDiscussion&gt;Exploit protection in Windows 10 provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows 10 may be subject to various exploits.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84515r7_fix\">Ensure the following mitigations are configured as shown for wordpad.exe:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nApplication mitigations defined in the STIG are configured by a DoD EP XML file included with the Windows 10 STIG package in the \"Supporting Files\" folder.\r\n\r\nThe XML file is applied with the group policy setting Computer Configuration &gt;&gt; Administrative Settings &gt;&gt; Windows Components &gt;&gt; Windows Defender Exploit Guard &gt;&gt; Exploit Protection &gt;&gt; \"Use a common set of exploit protection settings\" configured to \"Enabled\" with file name and location defined under \"Options:\".  It is recommended the file be in a read-only network location.</fixtext><fix id=\"F-84515r7_fix\" /><check system=\"C-94139r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1709 of Windows 10.\r\n\r\nThis is applicable to unclassified systems, for other systems this is NA.\r\n\r\nRun \"Windows PowerShell\" with elevated privileges (run as administrator).\r\n\r\nEnter \"Get-ProcessMitigation -Name wordpad.exe\".\r\n(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.)\r\n\r\nIf the following mitigations do not have the listed status which is shown below, this is a finding:\r\n\r\nDEP:\r\nOverride DEP: False\r\n\r\nPayload:\r\nOverrideExportAddressFilter: False\r\nOverrideExportAddressFilterPlus: False\r\nOverrideImportAddressFilter: False\r\nOverrideEnableRopStackPivot: False\r\nOverrideEnableRopCallerCheck: False\r\nOverrideEnableRopSimExec: False\r\n\r\nThe PowerShell command produces a list of mitigations; only those with a required status are listed here. If the PowerShell command does not produce results, ensure the letter case of the filename within the command syntax matches the letter case of the actual filename on the system.</check-content></check></Rule></Group><Group id=\"V-78129\"><title>WN10-00-000240</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-92835r1_rule\" severity=\"high\" weight=\"10.0\"><version>WN10-00-000240</version><title>Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.</title><description>&lt;VulnDiscussion&gt;Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account.\r\n\r\nSince administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy requires administrative accounts to not access the Internet or use applications, such as email.\r\n\r\nThe policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.\r\n\r\nTechnical means such as application whitelisting can be used to enforce the policy to ensure compliance.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-84851r1_fix\">Establish and enforce a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. Define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.\r\n\r\nImplement technical measures where feasible such as removal of applications or use of application whitelisting to restrict the use of applications that can access the Internet.</fixtext><fix id=\"F-84851r1_fix\" /><check system=\"C-77703r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Determine whether administrative accounts are prevented from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration.\r\n\r\nThe organization must have a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.\r\n\r\nTechnical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet. \r\n\r\nIf accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding.</check-content></check></Rule></Group><Group id=\"V-82137\"><title>WN10-UC-000005</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-96851r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-UC-000005</version><title>The use of personal accounts for OneDrive synchronization must be disabled.</title><description>&lt;VulnDiscussion&gt;OneDrive provides access to external services for data storage, which must be restricted to authorized instances. Enabling this setting will prevent the use of personal OneDrive accounts for synchronization.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-88989r2_fix\">Configure the policy value for User Configuration &gt;&gt; Administrative Templates &gt;&gt; OneDrive &gt;&gt; \"Prevent users from synchronizing personal OneDrive accounts\" to \"Enabled\".   \r\n\r\nGroup policy files for OneDrive are located on a system with OneDrive in \"%localappdata%\\Microsoft\\OneDrive\\BuildNumber\\adm\\\".\r\n\r\nCopy the OneDrive.admx and .adml files to the \\Windows\\PolicyDefinitions and \\Windows\\PolicyDefinitions\\en-US directories respectively.</fixtext><fix id=\"F-88989r2_fix\" /><check system=\"C-81935r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_CURRENT_USER\r\nRegistry Path: \\Software\\Policies\\Microsoft\\OneDrive\\\r\n\r\nValue Name: DisablePersonalSync\r\n\r\nValue Type: REG_DWORD\r\nValue: 0x00000001 (1)</check-content></check></Rule></Group><Group id=\"V-82139\"><title>WN10-CC-000238</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-96853r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000238</version><title>Windows 10 must be configured to prevent certificate error overrides in Microsoft Edge.</title><description>&lt;VulnDiscussion&gt;Web security certificates provide an indication whether a site is legitimate. This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-88993r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Microsoft Edge &gt;&gt; \"Prevent certificate error overrides\" to \"Enabled\".</fixtext><fix id=\"F-88993r1_fix\" /><check system=\"C-81939r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This setting is applicable starting with v1809 of Windows 10; it is NA for prior versions.\r\n\r\nWindows 10 LTSC\\B versions do not include Microsoft Edge; this is NA for those systems.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Internet Settings\\\r\n\r\nValue Name: PreventCertErrorOverrides\r\n\r\nType: REG_DWORD\r\nValue: 0x00000001 (1)</check-content></check></Rule></Group><Group id=\"V-82145\"><title>WN10-CC-000204</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-96859r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000204</version><title>If Enhanced diagnostic data is enabled it must be limited to the minimum required to support Windows Analytics.</title><description>&lt;VulnDiscussion&gt;Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The \"Enhanced\" level for telemetry includes additional information beyond \"Security\" and \"Basic\" on how Windows and apps are used and advanced reliability data. Windows Analytics can use a \"limited enhanced\" level to provide information such as health data for devices.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-88997r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Data Collection and Preview Builds &gt;&gt; \"Limit Enhanced diagnostic data to the minimum required by Windows Analytics\" to \"Enabled\" with \"Enable Windows Analytics collection\" selected in \"Options:\".</fixtext><fix id=\"F-88997r2_fix\" /><check system=\"C-81943r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This setting requires v1709 or later of Windows 10; it is NA for prior versions.\r\n\r\nIf \"Enhanced\" level is enabled for telemetry, this must be configured. If \"Security\" or \"Basic\" are configured, this is NA. (See V-63683).\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\\r\n\r\nValue Name: LimitEnhancedDiagnosticDataWindowsAnalytics\r\n\r\nType: REG_DWORD\r\nValue: 0x00000001 (1)</check-content></check></Rule></Group><Group id=\"V-88203\"><title>WN10-CC-000340</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-98853r3_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000340</version><title>OneDrive must only allow synchronizing of accounts for DoD organization instances.</title><description>&lt;VulnDiscussion&gt;OneDrive provides access to external services for data storage, which must be restricted to authorized instances if enabled. Configuring this setting will restrict synchronizing of OneDrive accounts to DoD organization instances.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-94945r4_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; OneDrive &gt;&gt; \"Allow syncing OneDrive accounts for only specific organizations\", with the Tenant GUID of the organization's DoD instance in the format 1111-2222-3333-4444.\r\n\r\nIf the organization does not have an instance of OneDrive, configure the Tenant GUID with \"1111-2222-3333-4444\".\r\n\r\nGroup policy files for OneDrive are located on a system with OneDrive in \"%localappdata%\\Microsoft\\OneDrive\\BuildNumber\\adm\\\".\r\n\r\nCopy the OneDrive.admx and .adml files to the \\Windows\\PolicyDefinitions and \\Windows\\PolicyDefinitions\\en-US directories respectively.</fixtext><fix id=\"F-94945r4_fix\" /><check system=\"C-87895r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the organization is using a DoD instance of OneDrive, verify synchronizing is only allowed to the organization's DoD instance.\r\n\r\nIf the organization does not have an instance of OneDrive, verify this is configured with the noted dummy entry to prevent synchronizing with other instances.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\OneDrive\\AllowTenantList\\\r\n\r\nValue Name: Organization's Tenant GUID\r\n\r\nValue Type: REG_SZ\r\nValue: Organization's Tenant GUID\r\n\r\nIf the organization does not have an instance of OneDrive the Value Name and Value must be 1111-2222-3333-4444, if not this is a finding.</check-content></check></Rule></Group><Group id=\"V-94719\"><title>WN10-CC-000365</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-104549r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000365</version><title>Windows 10 must be configured to prevent Windows apps from being activated by voice while the system is locked.</title><description>&lt;VulnDiscussion&gt;Allowing Windows apps to be activated by voice from the lock screen could allow for unauthorized use. Requiring logon will ensure the apps are only used by authorized personnel.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000056</ident><fixtext fixref=\"F-100837r3_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; App Privacy &gt;&gt; \"Let Windows apps activate with voice while the system is locked\" to \"Enabled\" with “Default for all Apps:” set to “Force Deny”. \r\n\r\nThe requirement is NA if the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; App Privacy &gt;&gt; \"Let Windows apps activate with voice\" is configured to \"Enabled\" with “Default for all Apps:” set to “Force Deny”.</fixtext><fix id=\"F-100837r3_fix\" /><check system=\"C-93909r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This setting requires v1903 or later of Windows 10; it is NA for prior versions.  The setting is NA when the “Allow voice activation” policy is configured to disallow applications to be activated with voice for all users.\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy\\\r\n\r\nValue Name: LetAppsActivateWithVoiceAboveLock\r\n\r\nType: REG_DWORD\r\nValue: 0x00000002 (2)\r\n\r\nIf the following registry value exists and is configured as specified, requirement is NA. \r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy\\\r\n\r\nValue Name: LetAppsActivateWithVoice\r\n\r\nType: REG_DWORD\r\nValue: 0x00000002 (2)</check-content></check></Rule></Group><Group id=\"V-94859\"><title>WN10-00-000031</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-104689r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000031</version><title>Windows 10 systems must use a BitLocker PIN for pre-boot authentication.</title><description>&lt;VulnDiscussion&gt;If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001199</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002475</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002476</ident><fixtext fixref=\"F-100983r2_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; BitLocker Drive Encryption &gt;&gt; Operating System Drives \"Require additional authentication at startup\" to \"Enabled\" with \"Configure TPM Startup PIN:\" set to \"Require startup PIN with TPM\" or with \"Configure TPM startup key and PIN:\" set to \"Require startup key and PIN with TPM\".</fixtext><fix id=\"F-100983r2_fix\" /><check system=\"C-94055r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\FVE\\\r\n\r\nValue Name: UseAdvancedStartup\r\nType: REG_DWORD\r\nValue: 0x00000001 (1)\r\n\r\nIf one of the following registry values does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\FVE\\\r\n\r\nValue Name: UseTPMPIN\r\nType: REG_DWORD\r\nValue: 0x00000001 (1)\r\n\r\nValue Name: UseTPMKeyPIN\r\nType: REG_DWORD\r\nValue: 0x00000001 (1)\r\n\r\n\r\nBitLocker network unlock may be used in conjunction with a BitLocker PIN. See the article below regarding information about network unlock.\r\n\r\nhttps://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock</check-content></check></Rule></Group><Group id=\"V-94861\"><title>WN10-00-000032</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-104691r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000032</version><title>Windows 10 systems must use a BitLocker PIN with a minimum length of 6 digits for pre-boot authentication.</title><description>&lt;VulnDiscussion&gt;If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives. Increasing the pin length requires a greater number of guesses for an attacker.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001199</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002475</ident><ident system=\"http://iase.disa.mil/cci\">CCI-002476</ident><fixtext fixref=\"F-100985r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; BitLocker Drive Encryption &gt;&gt; Operating System Drives \"Configure minimum PIN length for startup\" to \"Enabled\" with \"Minimum characters:\" set to \"6\" or greater.</fixtext><fix id=\"F-100985r1_fix\" /><check system=\"C-94057r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\FVE\\\r\n\r\nValue Name: MinimumPIN\r\nType: REG_DWORD\r\nValue: 0x00000006 (6) or greater</check-content></check></Rule></Group><Group id=\"V-99541\"><title>WN10-AU-000565</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-108645r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000565</version><title>Windows 10 must be configured to audit other Logon/Logoff Events Failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAudit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks.\r\n&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000130</ident><fixtext fixref=\"F-105225r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Logon/Logoff &gt;&gt; \"Audit Other Logon/Logoff Events\" with \"Failure\" selected.</fixtext><fix id=\"F-105225r1_fix\" /><check system=\"C-98389r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\r\n\r\nLogon/Logoff  &gt;&gt; Other Logon/Logoff Events - Failure\r\n</check-content></check></Rule></Group><Group id=\"V-99543\"><title>WN10-AU-000560</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-108647r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000560</version><title>Windows 10 must be configured to audit other Logon/Logoff Events Successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAudit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. Logon events are essential to understanding user activity and detecting potential attacks.\r\n&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000130</ident><fixtext fixref=\"F-105227r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Logon/Logoff &gt;&gt; \"Audit Other Logon/Logoff Events\" with \"Success\" selected.</fixtext><fix id=\"F-105227r1_fix\" /><check system=\"C-98393r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\r\n\r\nLogon/Logoff  &gt;&gt; Other Logon/Logoff Events - Success\r\n</check-content></check></Rule></Group><Group id=\"V-99545\"><title>WN10-AU-000570</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-108649r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000570</version><title>Windows 10 must be configured to audit Detailed File Share Failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAudit Detailed File Share allows you to audit attempts to access files and folders on a shared folder.\r\nThe Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access.\r\n&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000130</ident><fixtext fixref=\"F-105229r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Object Access &gt;&gt; “Detailed File Share\" with \"Failure\" selected.</fixtext><fix id=\"F-105229r1_fix\" /><check system=\"C-98395r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\r\n\r\nObject Access  &gt;&gt; Detailed File Share - Failure\r\n</check-content></check></Rule></Group><Group id=\"V-99547\"><title>WN10-AU-000575</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-108651r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000575</version><title>Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAudit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). \r\n&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000130</ident><fixtext fixref=\"F-105231r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Policy Change &gt;&gt; “Audit MPSSVC Rule-Level Policy Change\" with \"Success\" selected.</fixtext><fix id=\"F-105231r1_fix\" /><check system=\"C-98397r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\r\n\r\nPolicy Change  &gt;&gt; MPSSVC Rule-Level Policy Change - Success\r\n</check-content></check></Rule></Group><Group id=\"V-99549\"><title>WN10-AU-000580</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-108653r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000580</version><title>Windows 10 must be configured to audit MPSSVC Rule-Level Policy Change Failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAudit MPSSVC Rule-Level Policy Change determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). \r\n&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000130</ident><fixtext fixref=\"F-105233r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Policy Change &gt;&gt; “Audit MPSSVC Rule-Level Policy Change\" with \"Failure\" selected.</fixtext><fix id=\"F-105233r1_fix\" /><check system=\"C-98399r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\r\n\r\nPolicy Change  &gt;&gt; MPSSVC Rule-Level Policy Change - Failure\r\n</check-content></check></Rule></Group><Group id=\"V-99551\"><title>WN10-AU-000550</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-108655r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000550</version><title>Windows 10 must be configured to audit Other Policy Change Events Successes.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAudit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.\r\n&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000130</ident><fixtext fixref=\"F-105235r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Policy Change&gt;&gt; \"Audit Other Policy Change Events\" with \"Success\" selected.</fixtext><fix id=\"F-105235r1_fix\" /><check system=\"C-98401r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\r\n\r\nPolicy Change  &gt;&gt; Other Policy Change Events - Success\r\n</check-content></check></Rule></Group><Group id=\"V-99553\"><title>WN10-AU-000555</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-108657r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-AU-000555</version><title>Windows 10 must be configured to audit Other Policy Change Events Failures.</title><description>&lt;VulnDiscussion&gt;Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\r\n\r\nAudit Other Policy Change Events contains events about EFS Data Recovery Agent policy changes, changes in Windows Filtering Platform filter, status on Security policy settings updates for local Group Policy settings, Central Access Policy changes, and detailed troubleshooting events for Cryptographic Next Generation (CNG) operations.\r\n&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000130</ident><fixtext fixref=\"F-105237r1_fix\">Configure the policy value for Computer Configuration &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Advanced Audit Policy Configuration &gt;&gt; System Audit Policies &gt;&gt; Policy Change&gt;&gt; \"Audit Other Policy Change Events\" with \"Failure\" selected.</fixtext><fix id=\"F-105237r1_fix\" /><check system=\"C-98403r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN10-SO-000030) for the detailed auditing subcategories to be effective.\r\n\r\nUse the AuditPol tool to review the current Audit Policy configuration:\r\nOpen a Command Prompt with elevated privileges (\"Run as Administrator\").\r\nEnter \"AuditPol /get /category:*\".\r\n\r\nCompare the AuditPol settings with the following. If the system does not audit the following, this is a finding:\r\n\r\nPolicy Change  &gt;&gt; Other Policy Change Events - Failure\r\n</check-content></check></Rule></Group><Group id=\"V-99555\"><title>WN10-SO-000280</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-108659r2_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000280</version><title>Passwords for enabled local Administrator accounts must be changed at least every 60 days.</title><description>&lt;VulnDiscussion&gt;The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. A local Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for enabled Administrator accounts on a regular basis will limit its exposure.\r\n\r\nOrganizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every \"30\" days by default.\r\n&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000199</ident><fixtext fixref=\"F-105239r2_fix\">Change the enabled local Administrator account password at least every \"60\" days.\r\n\r\nAutomated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to meet this requirement. \r\n</fixtext><fix id=\"F-105239r2_fix\" /><check system=\"C-98405r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Review the password last set date for the enabled local Administrator account.\r\n\r\nOn the local domain joined workstation:\r\n\r\nOpen \"PowerShell\".\r\n\r\nEnter \"Get-LocalUser –Name * | Select-Object *”\r\n\r\nIf the \"PasswordLastSet\" date is greater than \"60\" days old for the local Administrator account for administering the computer/domain, this is a finding.\r\n</check-content></check></Rule></Group><Group id=\"V-99557\"><title>WN10-EP-000310</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-108661r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-EP-000310</version><title>Windows 10 Kernel (Direct Memory Access) DMA Protection must be enabled.</title><description>&lt;VulnDiscussion&gt;Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. Drive-by DMA attacks can lead to disclosure of sensitive information residing on a PC, or even injection of malware that allows attackers to bypass the lock screen or control PCs remotely.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001090</ident><fixtext fixref=\"F-105241r4_fix\">Configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Kernel DMA Protection &gt;&gt; \"Enumeration policy for external devices incompatible with Kernel DMA Protection\" to \"Enabled\" with \"Enumeration Policy\" set to \"Block All\".</fixtext><fix id=\"F-105241r4_fix\" /><check system=\"C-98407r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>This is NA prior to v1803 of Windows 10.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\Software\\Policies\\Microsoft\\Windows\\Kernel DMA Protection\r\n\r\nValue Name: DeviceEnumerationPolicy\r\nValue Type: REG_DWORD\r\nValue: 0</check-content></check></Rule></Group><Group id=\"V-99559\"><title>WN10-CC-000370</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-108663r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000370</version><title>The convenience PIN for Windows 10 must be disabled.  </title><description>&lt;VulnDiscussion&gt;This policy controls whether a domain user can sign in using a convenience PIN to prevent enabling (Password Stuffer).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-105243r1_fix\">Disable the convenience PIN sign-in. \r\n\r\nIf this needs to be corrected configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; System &gt;&gt; Logon &gt;&gt; Set \"Turn on convenience PIN sign-in\" to \"Disabled”.\r\n</fixtext><fix id=\"F-105243r1_fix\" /><check system=\"C-98409r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\Software\\Policies\\Microsoft\\Windows\\System\r\n\r\nValue Name: AllowDomainPINLogon\r\nValue Type: REG_DWORD\r\nValue data: 0</check-content></check></Rule></Group><Group id=\"V-99561\"><title>WN10-CC-000385</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-108665r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000385</version><title>Windows Ink Workspace configured but disallow access above the lock.  </title><description>&lt;VulnDiscussion&gt;Securing Windows Ink which contains application and features oriented towards pen computing. &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-105245r1_fix\">Disable the convenience PIN sign-in. \r\n\r\nIf this needs to be corrected configure the policy value for Computer Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Windows Ink Workspace   &gt;&gt; Set \" Allow Windows Ink Workspace\" to \"Enabled” Set Options ‘On, but disallow access above lock”. \r\n</fixtext><fix id=\"F-105245r1_fix\" /><check system=\"C-98411r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistry Path: \\Software\\Policies\\Microsoft\\WindowsInkWorkspace\r\n\r\nValue Name: AllowWindowsInkWorkspace\r\nValue Type: REG_DWORD\r\nValue data: 1\r\n\r\n</check-content></check></Rule></Group><Group id=\"V-99563\"><title>WN10-CC-000390</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-108667r1_rule\" severity=\"low\" weight=\"10.0\"><version>WN10-CC-000390</version><title>Windows 10 should be configured to prevent users from receiving suggestions for third-party or additional applications. </title><description>&lt;VulnDiscussion&gt;Windows spotlight features may suggest apps and content from third-party software publishers in addition to Microsoft apps and content. &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-105247r1_fix\">Configure the policy value for User Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; Cloud Content &gt;&gt; \"Do not suggest third-party content in Windows spotlight\" to \"Enabled</fixtext><fix id=\"F-105247r1_fix\" /><check system=\"C-98413r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding.\r\n\r\nIf the following registry value does not exist or is not configured as specified, this is a finding: \r\n\r\nRegistry Hive: HKEY_CURRENT_USER\r\nRegistry Path: \\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent\\\r\n\r\nValue Name: DisableThirdPartySuggestions\r\n\r\nType: REG_DWORD\r\nValue: 0x00000001 (1)\r\n\r\n</check-content></check></Rule></Group><Group id=\"V-100093\"><title>SRG-OS-000095-GPOS-00049</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-109197r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000007</version><title>Windows 10 must cover or disable the built-in or attached camera when not in use.</title><description>&lt;VulnDiscussion&gt;It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\r\n\r\nFailing to disconnect from collaborative computing devices (i.e. cameras) can result in subsequent compromises of organizational information. Providing easy methods to physically disconnect from such devices after a collaborative computing session helps to ensure that participants actually carry out the disconnect activity without having to go through complex and tedious procedures.\r\n\r\nSatisfies: SRG-OS-000095-GPOS-00049, SRG-OS-000370-GPOS-00155\r\n&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-105777r3_fix\">If the camera is not disconnected or covered, the following registry entry is required.\r\n \r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistryPath\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\webcam\r\n\r\nValue Name: Deny\r\n</fixtext><fix id=\"F-105777r3_fix\" /><check system=\"C-98943r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the device or operating system does not have a camera installed, this requirement is not applicable.\r\n\r\nThis requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local AO decision.\r\n\r\nThis requirement is not applicable to dedicated VTC suites located in approved VTC locations that are centrally managed.\r\n\r\nFor an external camera, if there is not a method for the operator to manually disconnect camera at the end of collaborative computing sessions, this is a finding.\r\n\r\nFor a built-in camera, the camera must be protected by a camera cover (e.g. laptop camera cover slide) when not in use. If the built-in camera is not protected with a camera cover, or if the built-in\r\ncamera is not disabled in the bios, this is a finding.\r\n\r\nIf the camera is not disconnected or covered, the following registry entry is required:\r\n\r\nRegistry Hive: HKEY_LOCAL_MACHINE\r\nRegistryPath\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\webcam\r\n\r\nValue Name: Deny\r\n\r\nIf \"Value Name\" is set to a value other than \"Deny\" and the collaborative computing device has not been authorized for use, this is a finding.\r\n</check-content></check></Rule></Group><Group id=\"V-102611\"><title>WN10-00-000250</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-111557r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-00-000250</version><title>Windows 10 non-persistent VM sessions should not exceed 24 hours. </title><description>&lt;VulnDiscussion&gt;For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, the organization should enforce that sessions be terminated within 24 hours. This would ensure any data stored on the VM that is not encrypted or covered by Credential Guard is deleted.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001199</ident><fixtext fixref=\"F-108159r2_fix\">Set non-persistent VM sessions to not exceed 24 hours.  </fixtext><fix id=\"F-108159r2_fix\" /><check system=\"C-101347r3_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>Ensure there is a documented policy or procedure in place that non-persistent VM sessions do not exceed 24 hours.\r\n\r\nIf there is no such documented policy or procedure in place, this is a finding.</check-content></check></Rule></Group><Group id=\"V-102617\"><title>WN10-CC-000328 </title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-111563r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-CC-000328 </version><title>The Windows Explorer Preview pane must be disabled for Windows 10.</title><description>&lt;VulnDiscussion&gt;A known vulnerability in Windows 10 could allow the execution of malicious code by either opening a compromised document or viewing it in the Windows Preview pane.\r\n\r\nOrganizations must disable the Windows Preview pane and Windows Detail pane.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-108147r3_fix\">Ensure the following settings are configured for Windows 10 locally or applied through group policy. \r\n\r\nConfigure the policy value for User Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; File Explorer &gt;&gt; Explorer Frame Pane \"Turn off Preview Pane\" to \"Enabled\".\r\n\r\nConfigure the policy value for User Configuration &gt;&gt; Administrative Templates &gt;&gt; Windows Components &gt;&gt; File Explorer &gt;&gt; Explorer Frame Pane \"Turn on or off details pane\" to \"Enabled\" and \"Configure details pane\" to \"Always hide\".\r\n</fixtext><fix id=\"F-108147r3_fix\" /><check system=\"C-101355r4_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the following registry values do not exist or are not configured as specified, this is a finding:\r\n\r\nRegistry Hive: HKEY_CURRENT_USER\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\r\n\r\nValue Name: NoPreviewPane\r\n\r\nValue Type: REG_DWORD\r\n\r\nValue: 1\r\n\r\nRegistry Hive: HKEY_CURRENT_USER\r\nRegistry Path: \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\r\n\r\nValue Name: NoReadingPane\r\n\r\nValue Type: REG_DWORD\r\n\r\nValue: 1</check-content></check></Rule></Group><Group id=\"V-102627\"><title>WN10-SO-000251\t</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-111577r1_rule\" severity=\"medium\" weight=\"10.0\"><version>WN10-SO-000251\t</version><title>Windows 10 must use multifactor authentication for local and network access to privileged and non-privileged accounts.</title><description>&lt;VulnDiscussion&gt;Without the use of multifactor authentication, the ease of access to privileged and non-privileged functions is greatly increased. \r\n\r\nAll domain accounts must be enabled for multifactor authentication with the exception of local emergency accounts. \r\n\r\nMultifactor authentication requires using two or more factors to achieve authentication.\r\n\r\nFactors include: \r\n\r\n1) Something a user knows (e.g., password/PIN);\r\n\r\n2) Something a user has (e.g., cryptographic identification device, token); and\r\n\r\n3) Something a user is (e.g., biometric).\r\n\r\nA privileged account is defined as an information system account with authorizations of a privileged user.\r\n\r\nNetwork access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the Internet).\r\n\r\nLocal access is defined as access to an organizational information system by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network.\r\n\r\nThe DoD CAC with DoD-approved PKI is an example of multifactor authentication.\r\n\r\nSatisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Windows 10</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows 10</dc:subject><dc:identifier>2885</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000765</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000766</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000767</ident><ident system=\"http://iase.disa.mil/cci\">CCI-000768</ident><fixtext fixref=\"F-108157r1_fix\">For non-domain joined systems, configuring Windows Hello for sign on options would be suggested based on the organizations needs and capabilities.\r\n \r\nNote: Before applying, the supplemental guidance provided with the STIG should be consulted to ensure continued access to the operating system.\r\n</fixtext><fix id=\"F-108157r1_fix\" /><check system=\"C-101365r2_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_Windows_10_STIG.xml\" /><check-content>If the system is a member of a domain this is Not Applicable.\r\n\r\nIf one of the following settings does not exist and is not populated, this is a finding: \r\n\r\nComputer\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Calais\\Readers\r\nComputer\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Calais\\SmartCards</check-content></check></Rule></Group></Benchmark>"
  },
  {
    "path": "test/api/form-data-files/U_RHEL_7_STIG_V3R0-3_Manual-xccdf.xml",
    "content": "<?xml version=\"1.0\" encoding=\"utf-8\"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:xhtml=\"http://www.w3.org/1999/xhtml\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:cpe=\"http://cpe.mitre.org/language/2.0\" xmlns:dsig=\"http://www.w3.org/2000/09/xmldsig#\" xsi:schemaLocation=\"http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd\" id=\"RHEL_7_STIG_TEST\" xml:lang=\"en\" xmlns=\"http://checklists.nist.gov/xccdf/1.1\"><status date=\"2020-03-27\">draft</status><title>Red Hat Enterprise Linux 7 Security Technical Implementation Guide</title><description>This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.</description><notice id=\"terms-of-use\" xml:lang=\"en\"></notice><front-matter xml:lang=\"en\"></front-matter><rear-matter xml:lang=\"en\"></rear-matter><reference href=\"https://cyber.mil\"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id=\"release-info\">Release: 0.3 Benchmark Date: 31 Mar 2020</plain-text><plain-text id=\"generator\">3.1.1.36225</plain-text><plain-text id=\"conventionsVersion\">1.10.0</plain-text><version>3</version><Profile id=\"MAC-1_Classified\"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-204392\" selected=\"true\" /><select idref=\"V-204393\" selected=\"true\" /><select idref=\"V-204394\" selected=\"true\" /><select idref=\"V-204395\" selected=\"true\" /><select idref=\"V-204396\" selected=\"true\" /><select idref=\"V-204397\" selected=\"true\" /><select idref=\"V-204398\" selected=\"true\" /><select idref=\"V-204399\" selected=\"true\" /><select idref=\"V-204400\" selected=\"true\" /><select idref=\"V-204401\" selected=\"true\" /><select idref=\"V-204402\" selected=\"true\" /><select idref=\"V-204403\" selected=\"true\" /><select idref=\"V-204404\" selected=\"true\" /><select idref=\"V-204405\" selected=\"true\" /><select idref=\"V-204406\" selected=\"true\" /><select idref=\"V-204407\" selected=\"true\" /><select idref=\"V-204408\" selected=\"true\" /><select idref=\"V-204409\" selected=\"true\" /><select idref=\"V-204410\" selected=\"true\" /><select idref=\"V-204411\" selected=\"true\" /><select idref=\"V-204412\" selected=\"true\" /><select idref=\"V-204413\" selected=\"true\" /><select idref=\"V-204414\" selected=\"true\" /><select idref=\"V-204415\" selected=\"true\" /><select idref=\"V-204416\" selected=\"true\" /><select idref=\"V-204417\" selected=\"true\" /><select idref=\"V-204418\" selected=\"true\" /><select idref=\"V-204419\" selected=\"true\" /><select idref=\"V-204420\" selected=\"true\" /><select idref=\"V-204421\" selected=\"true\" /><select idref=\"V-204422\" selected=\"true\" /><select idref=\"V-204423\" selected=\"true\" /><select idref=\"V-204424\" selected=\"true\" /><select idref=\"V-204425\" selected=\"true\" /><select idref=\"V-204426\" selected=\"true\" /><select idref=\"V-204427\" selected=\"true\" /><select idref=\"V-204428\" selected=\"true\" /><select idref=\"V-204429\" selected=\"true\" /><select idref=\"V-204430\" selected=\"true\" /><select idref=\"V-204431\" selected=\"true\" /><select idref=\"V-204432\" selected=\"true\" /><select idref=\"V-204433\" selected=\"true\" /><select idref=\"V-204434\" selected=\"true\" /><select idref=\"V-204435\" selected=\"true\" /><select idref=\"V-204436\" selected=\"true\" /><select idref=\"V-204437\" selected=\"true\" /><select idref=\"V-204438\" selected=\"true\" /><select idref=\"V-204439\" selected=\"true\" /><select idref=\"V-204440\" selected=\"true\" /><select idref=\"V-204441\" selected=\"true\" /><select idref=\"V-204442\" selected=\"true\" /><select idref=\"V-204443\" selected=\"true\" /><select idref=\"V-204444\" selected=\"true\" /><select idref=\"V-204445\" selected=\"true\" /><select idref=\"V-204446\" selected=\"true\" /><select idref=\"V-204447\" selected=\"true\" /><select idref=\"V-204448\" selected=\"true\" /><select idref=\"V-204449\" selected=\"true\" /><select idref=\"V-204450\" selected=\"true\" /><select idref=\"V-204451\" selected=\"true\" /><select idref=\"V-204452\" selected=\"true\" /><select idref=\"V-204453\" selected=\"true\" /><select idref=\"V-204454\" selected=\"true\" /><select idref=\"V-204455\" selected=\"true\" /><select idref=\"V-204456\" selected=\"true\" /><select idref=\"V-204457\" selected=\"true\" /><select idref=\"V-204458\" selected=\"true\" /><select idref=\"V-204459\" selected=\"true\" /><select idref=\"V-204460\" selected=\"true\" /><select idref=\"V-204461\" selected=\"true\" /><select idref=\"V-204462\" selected=\"true\" /><select idref=\"V-204463\" selected=\"true\" /><select idref=\"V-204464\" selected=\"true\" /><select idref=\"V-204465\" selected=\"true\" /><select idref=\"V-204466\" selected=\"true\" /><select idref=\"V-204467\" selected=\"true\" /><select idref=\"V-204468\" selected=\"true\" /><select idref=\"V-204469\" selected=\"true\" /><select idref=\"V-204470\" selected=\"true\" /><select idref=\"V-204471\" selected=\"true\" /><select idref=\"V-204472\" selected=\"true\" /><select idref=\"V-204473\" selected=\"true\" /><select idref=\"V-204474\" selected=\"true\" /><select idref=\"V-204475\" selected=\"true\" /><select idref=\"V-204476\" selected=\"true\" /><select idref=\"V-204477\" selected=\"true\" /><select idref=\"V-204478\" selected=\"true\" /><select idref=\"V-204479\" selected=\"true\" /><select idref=\"V-204480\" selected=\"true\" /><select idref=\"V-204481\" selected=\"true\" /><select idref=\"V-204482\" selected=\"true\" /><select idref=\"V-204483\" selected=\"true\" /><select idref=\"V-204484\" selected=\"true\" /><select idref=\"V-204485\" selected=\"true\" /><select idref=\"V-204486\" selected=\"true\" /><select idref=\"V-204487\" selected=\"true\" /><select idref=\"V-204488\" selected=\"true\" /><select idref=\"V-204489\" selected=\"true\" /><select idref=\"V-204490\" selected=\"true\" /><select idref=\"V-204491\" selected=\"true\" /><select idref=\"V-204492\" selected=\"true\" /><select idref=\"V-204493\" selected=\"true\" /><select idref=\"V-204494\" selected=\"true\" /><select idref=\"V-204495\" selected=\"true\" /><select idref=\"V-204496\" selected=\"true\" /><select idref=\"V-204497\" selected=\"true\" /><select idref=\"V-204498\" selected=\"true\" /><select idref=\"V-204499\" selected=\"true\" /><select idref=\"V-204500\" selected=\"true\" /><select idref=\"V-204501\" selected=\"true\" /><select idref=\"V-204502\" selected=\"true\" /><select idref=\"V-204503\" selected=\"true\" /><select idref=\"V-204504\" selected=\"true\" /><select idref=\"V-204505\" selected=\"true\" /><select idref=\"V-204506\" selected=\"true\" /><select idref=\"V-204507\" selected=\"true\" /><select idref=\"V-204508\" selected=\"true\" /><select idref=\"V-204509\" selected=\"true\" /><select idref=\"V-204510\" selected=\"true\" /><select idref=\"V-204511\" selected=\"true\" /><select idref=\"V-204512\" selected=\"true\" /><select idref=\"V-204513\" selected=\"true\" /><select idref=\"V-204514\" selected=\"true\" /><select idref=\"V-204515\" selected=\"true\" /><select idref=\"V-204516\" selected=\"true\" /><select idref=\"V-204517\" selected=\"true\" /><select idref=\"V-204518\" selected=\"true\" /><select idref=\"V-204519\" selected=\"true\" /><select idref=\"V-204520\" selected=\"true\" /><select idref=\"V-204521\" selected=\"true\" /><select idref=\"V-204522\" selected=\"true\" /><select idref=\"V-204523\" selected=\"true\" /><select idref=\"V-204524\" selected=\"true\" /><select idref=\"V-204525\" selected=\"true\" /><select idref=\"V-204526\" selected=\"true\" /><select idref=\"V-204527\" selected=\"true\" /><select idref=\"V-204528\" selected=\"true\" /><select idref=\"V-204529\" selected=\"true\" /><select idref=\"V-204530\" selected=\"true\" /><select idref=\"V-204531\" selected=\"true\" /><select idref=\"V-204532\" selected=\"true\" /><select idref=\"V-204533\" selected=\"true\" /><select idref=\"V-204534\" selected=\"true\" /><select idref=\"V-204535\" selected=\"true\" /><select idref=\"V-204536\" selected=\"true\" /><select idref=\"V-204537\" selected=\"true\" /><select idref=\"V-204538\" selected=\"true\" /><select idref=\"V-204539\" selected=\"true\" /><select idref=\"V-204540\" selected=\"true\" /><select idref=\"V-204541\" selected=\"true\" /><select idref=\"V-204542\" selected=\"true\" /><select idref=\"V-204543\" selected=\"true\" /><select idref=\"V-204544\" selected=\"true\" /><select idref=\"V-204545\" selected=\"true\" /><select idref=\"V-204546\" selected=\"true\" /><select idref=\"V-204547\" selected=\"true\" /><select idref=\"V-204548\" selected=\"true\" /><select idref=\"V-204549\" selected=\"true\" /><select idref=\"V-204550\" selected=\"true\" /><select idref=\"V-204551\" selected=\"true\" /><select idref=\"V-204552\" selected=\"true\" /><select idref=\"V-204553\" selected=\"true\" /><select idref=\"V-204554\" selected=\"true\" /><select idref=\"V-204555\" selected=\"true\" /><select idref=\"V-204556\" selected=\"true\" /><select idref=\"V-204557\" selected=\"true\" /><select idref=\"V-204558\" selected=\"true\" /><select idref=\"V-204559\" selected=\"true\" /><select idref=\"V-204560\" selected=\"true\" /><select idref=\"V-204561\" selected=\"true\" /><select idref=\"V-204562\" selected=\"true\" /><select idref=\"V-204563\" selected=\"true\" /><select idref=\"V-204564\" selected=\"true\" /><select idref=\"V-204565\" selected=\"true\" /><select idref=\"V-204566\" selected=\"true\" /><select idref=\"V-204567\" selected=\"true\" /><select idref=\"V-204568\" selected=\"true\" /><select idref=\"V-204569\" selected=\"true\" /><select idref=\"V-204570\" selected=\"true\" /><select idref=\"V-204571\" selected=\"true\" /><select idref=\"V-204572\" selected=\"true\" /><select idref=\"V-204573\" selected=\"true\" /><select idref=\"V-204574\" selected=\"true\" /><select idref=\"V-204575\" selected=\"true\" /><select idref=\"V-204576\" selected=\"true\" /><select idref=\"V-204577\" selected=\"true\" /><select idref=\"V-204578\" selected=\"true\" /><select idref=\"V-204579\" selected=\"true\" /><select idref=\"V-204580\" selected=\"true\" /><select idref=\"V-204581\" selected=\"true\" /><select idref=\"V-204582\" selected=\"true\" /><select idref=\"V-204583\" selected=\"true\" /><select idref=\"V-204584\" selected=\"true\" /><select idref=\"V-204585\" selected=\"true\" /><select idref=\"V-204586\" selected=\"true\" /><select idref=\"V-204587\" selected=\"true\" /><select idref=\"V-204588\" selected=\"true\" /><select idref=\"V-204589\" selected=\"true\" /><select idref=\"V-204590\" selected=\"true\" /><select idref=\"V-204591\" selected=\"true\" /><select idref=\"V-204592\" selected=\"true\" /><select idref=\"V-204593\" selected=\"true\" /><select idref=\"V-204594\" selected=\"true\" /><select idref=\"V-204595\" selected=\"true\" /><select idref=\"V-204596\" selected=\"true\" /><select idref=\"V-204597\" selected=\"true\" /><select idref=\"V-204598\" selected=\"true\" /><select idref=\"V-204599\" selected=\"true\" /><select idref=\"V-204600\" selected=\"true\" /><select idref=\"V-204601\" selected=\"true\" /><select idref=\"V-204602\" selected=\"true\" /><select idref=\"V-204603\" selected=\"true\" /><select idref=\"V-204604\" selected=\"true\" /><select idref=\"V-204605\" selected=\"true\" /><select idref=\"V-204606\" selected=\"true\" /><select idref=\"V-204607\" selected=\"true\" /><select idref=\"V-204608\" selected=\"true\" /><select idref=\"V-204609\" selected=\"true\" /><select idref=\"V-204610\" selected=\"true\" /><select idref=\"V-204611\" selected=\"true\" /><select idref=\"V-204612\" selected=\"true\" /><select idref=\"V-204613\" selected=\"true\" /><select idref=\"V-204614\" selected=\"true\" /><select idref=\"V-204615\" selected=\"true\" /><select idref=\"V-204616\" selected=\"true\" /><select idref=\"V-204617\" selected=\"true\" /><select idref=\"V-204618\" selected=\"true\" /><select idref=\"V-204619\" selected=\"true\" /><select idref=\"V-204620\" selected=\"true\" /><select idref=\"V-204621\" selected=\"true\" /><select idref=\"V-204622\" selected=\"true\" /><select idref=\"V-204623\" selected=\"true\" /><select idref=\"V-204624\" selected=\"true\" /><select idref=\"V-204625\" selected=\"true\" /><select idref=\"V-204626\" selected=\"true\" /><select idref=\"V-204627\" selected=\"true\" /><select idref=\"V-204628\" selected=\"true\" /><select idref=\"V-204629\" selected=\"true\" /><select idref=\"V-204630\" selected=\"true\" /><select idref=\"V-204631\" selected=\"true\" /><select idref=\"V-204632\" selected=\"true\" /><select idref=\"V-204633\" selected=\"true\" /><select idref=\"V-204634\" selected=\"true\" /><select idref=\"V-214799\" selected=\"true\" /><select idref=\"V-214800\" selected=\"true\" /><select idref=\"V-214801\" selected=\"true\" /><select idref=\"V-214937\" selected=\"true\" /></Profile><Profile id=\"MAC-1_Public\"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-204392\" selected=\"true\" /><select idref=\"V-204393\" selected=\"true\" /><select idref=\"V-204394\" selected=\"true\" /><select idref=\"V-204395\" selected=\"true\" /><select idref=\"V-204396\" selected=\"true\" /><select idref=\"V-204397\" selected=\"true\" /><select idref=\"V-204398\" selected=\"true\" /><select idref=\"V-204399\" selected=\"true\" /><select idref=\"V-204400\" selected=\"true\" /><select idref=\"V-204401\" selected=\"true\" /><select idref=\"V-204402\" selected=\"true\" /><select idref=\"V-204403\" selected=\"true\" /><select idref=\"V-204404\" selected=\"true\" /><select idref=\"V-204405\" selected=\"true\" /><select idref=\"V-204406\" selected=\"true\" /><select idref=\"V-204407\" selected=\"true\" /><select idref=\"V-204408\" selected=\"true\" /><select idref=\"V-204409\" selected=\"true\" /><select idref=\"V-204410\" selected=\"true\" /><select idref=\"V-204411\" selected=\"true\" /><select idref=\"V-204412\" selected=\"true\" /><select idref=\"V-204413\" selected=\"true\" /><select idref=\"V-204414\" selected=\"true\" /><select idref=\"V-204415\" selected=\"true\" /><select idref=\"V-204416\" selected=\"true\" /><select idref=\"V-204417\" selected=\"true\" /><select idref=\"V-204418\" selected=\"true\" /><select idref=\"V-204419\" selected=\"true\" /><select idref=\"V-204420\" selected=\"true\" /><select idref=\"V-204421\" selected=\"true\" /><select idref=\"V-204422\" selected=\"true\" /><select idref=\"V-204423\" selected=\"true\" /><select idref=\"V-204424\" selected=\"true\" /><select idref=\"V-204425\" selected=\"true\" /><select idref=\"V-204426\" selected=\"true\" /><select idref=\"V-204427\" selected=\"true\" /><select idref=\"V-204428\" selected=\"true\" /><select idref=\"V-204429\" selected=\"true\" /><select idref=\"V-204430\" selected=\"true\" /><select idref=\"V-204431\" selected=\"true\" /><select idref=\"V-204432\" selected=\"true\" /><select idref=\"V-204433\" selected=\"true\" /><select idref=\"V-204434\" selected=\"true\" /><select idref=\"V-204435\" selected=\"true\" /><select idref=\"V-204436\" selected=\"true\" /><select idref=\"V-204437\" selected=\"true\" /><select idref=\"V-204438\" selected=\"true\" /><select idref=\"V-204439\" selected=\"true\" /><select idref=\"V-204440\" selected=\"true\" /><select idref=\"V-204441\" selected=\"true\" /><select idref=\"V-204442\" selected=\"true\" /><select idref=\"V-204443\" selected=\"true\" /><select idref=\"V-204444\" selected=\"true\" /><select idref=\"V-204445\" selected=\"true\" /><select idref=\"V-204446\" selected=\"true\" /><select idref=\"V-204447\" selected=\"true\" /><select idref=\"V-204448\" selected=\"true\" /><select idref=\"V-204449\" selected=\"true\" /><select idref=\"V-204450\" selected=\"true\" /><select idref=\"V-204451\" selected=\"true\" /><select idref=\"V-204452\" selected=\"true\" /><select idref=\"V-204453\" selected=\"true\" /><select idref=\"V-204454\" selected=\"true\" /><select idref=\"V-204455\" selected=\"true\" /><select idref=\"V-204456\" selected=\"true\" /><select idref=\"V-204457\" selected=\"true\" /><select idref=\"V-204458\" selected=\"true\" /><select idref=\"V-204459\" selected=\"true\" /><select idref=\"V-204460\" selected=\"true\" /><select idref=\"V-204461\" selected=\"true\" /><select idref=\"V-204462\" selected=\"true\" /><select idref=\"V-204463\" selected=\"true\" /><select idref=\"V-204464\" selected=\"true\" /><select idref=\"V-204465\" selected=\"true\" /><select idref=\"V-204466\" selected=\"true\" /><select idref=\"V-204467\" selected=\"true\" /><select idref=\"V-204468\" selected=\"true\" /><select idref=\"V-204469\" selected=\"true\" /><select idref=\"V-204470\" selected=\"true\" /><select idref=\"V-204471\" selected=\"true\" /><select idref=\"V-204472\" selected=\"true\" /><select idref=\"V-204473\" selected=\"true\" /><select idref=\"V-204474\" selected=\"true\" /><select idref=\"V-204475\" selected=\"true\" /><select idref=\"V-204476\" selected=\"true\" /><select idref=\"V-204477\" selected=\"true\" /><select idref=\"V-204478\" selected=\"true\" /><select idref=\"V-204479\" selected=\"true\" /><select idref=\"V-204480\" selected=\"true\" /><select idref=\"V-204481\" selected=\"true\" /><select idref=\"V-204482\" selected=\"true\" /><select idref=\"V-204483\" selected=\"true\" /><select idref=\"V-204484\" selected=\"true\" /><select idref=\"V-204485\" selected=\"true\" /><select idref=\"V-204486\" selected=\"true\" /><select idref=\"V-204487\" selected=\"true\" /><select idref=\"V-204488\" selected=\"true\" /><select idref=\"V-204489\" selected=\"true\" /><select idref=\"V-204490\" selected=\"true\" /><select idref=\"V-204491\" selected=\"true\" /><select idref=\"V-204492\" selected=\"true\" /><select idref=\"V-204493\" selected=\"true\" /><select idref=\"V-204494\" selected=\"true\" /><select idref=\"V-204495\" selected=\"true\" /><select idref=\"V-204496\" selected=\"true\" /><select idref=\"V-204497\" selected=\"true\" /><select idref=\"V-204498\" selected=\"true\" /><select idref=\"V-204499\" selected=\"true\" /><select idref=\"V-204500\" selected=\"true\" /><select idref=\"V-204501\" selected=\"true\" /><select idref=\"V-204502\" selected=\"true\" /><select idref=\"V-204503\" selected=\"true\" /><select idref=\"V-204504\" selected=\"true\" /><select idref=\"V-204505\" selected=\"true\" /><select idref=\"V-204506\" selected=\"true\" /><select idref=\"V-204507\" selected=\"true\" /><select idref=\"V-204508\" selected=\"true\" /><select idref=\"V-204509\" selected=\"true\" /><select idref=\"V-204510\" selected=\"true\" /><select idref=\"V-204511\" selected=\"true\" /><select idref=\"V-204512\" selected=\"true\" /><select idref=\"V-204513\" selected=\"true\" /><select idref=\"V-204514\" selected=\"true\" /><select idref=\"V-204515\" selected=\"true\" /><select idref=\"V-204516\" selected=\"true\" /><select idref=\"V-204517\" selected=\"true\" /><select idref=\"V-204518\" selected=\"true\" /><select idref=\"V-204519\" selected=\"true\" /><select idref=\"V-204520\" selected=\"true\" /><select idref=\"V-204521\" selected=\"true\" /><select idref=\"V-204522\" selected=\"true\" /><select idref=\"V-204523\" selected=\"true\" /><select idref=\"V-204524\" selected=\"true\" /><select idref=\"V-204525\" selected=\"true\" /><select idref=\"V-204526\" selected=\"true\" /><select idref=\"V-204527\" selected=\"true\" /><select idref=\"V-204528\" selected=\"true\" /><select idref=\"V-204529\" selected=\"true\" /><select idref=\"V-204530\" selected=\"true\" /><select idref=\"V-204531\" selected=\"true\" /><select idref=\"V-204532\" selected=\"true\" /><select idref=\"V-204533\" selected=\"true\" /><select idref=\"V-204534\" selected=\"true\" /><select idref=\"V-204535\" selected=\"true\" /><select idref=\"V-204536\" selected=\"true\" /><select idref=\"V-204537\" selected=\"true\" /><select idref=\"V-204538\" selected=\"true\" /><select idref=\"V-204539\" selected=\"true\" /><select idref=\"V-204540\" selected=\"true\" /><select idref=\"V-204541\" selected=\"true\" /><select idref=\"V-204542\" selected=\"true\" /><select idref=\"V-204543\" selected=\"true\" /><select idref=\"V-204544\" selected=\"true\" /><select idref=\"V-204545\" selected=\"true\" /><select idref=\"V-204546\" selected=\"true\" /><select idref=\"V-204547\" selected=\"true\" /><select idref=\"V-204548\" selected=\"true\" /><select idref=\"V-204549\" selected=\"true\" /><select idref=\"V-204550\" selected=\"true\" /><select idref=\"V-204551\" selected=\"true\" /><select idref=\"V-204552\" selected=\"true\" /><select idref=\"V-204553\" selected=\"true\" /><select idref=\"V-204554\" selected=\"true\" /><select idref=\"V-204555\" selected=\"true\" /><select idref=\"V-204556\" selected=\"true\" /><select idref=\"V-204557\" selected=\"true\" /><select idref=\"V-204558\" selected=\"true\" /><select idref=\"V-204559\" selected=\"true\" /><select idref=\"V-204560\" selected=\"true\" /><select idref=\"V-204561\" selected=\"true\" /><select idref=\"V-204562\" selected=\"true\" /><select idref=\"V-204563\" selected=\"true\" /><select idref=\"V-204564\" selected=\"true\" /><select idref=\"V-204565\" selected=\"true\" /><select idref=\"V-204566\" selected=\"true\" /><select idref=\"V-204567\" selected=\"true\" /><select idref=\"V-204568\" selected=\"true\" /><select idref=\"V-204569\" selected=\"true\" /><select idref=\"V-204570\" selected=\"true\" /><select idref=\"V-204571\" selected=\"true\" /><select idref=\"V-204572\" selected=\"true\" /><select idref=\"V-204573\" selected=\"true\" /><select idref=\"V-204574\" selected=\"true\" /><select idref=\"V-204575\" selected=\"true\" /><select idref=\"V-204576\" selected=\"true\" /><select idref=\"V-204577\" selected=\"true\" /><select idref=\"V-204578\" selected=\"true\" /><select idref=\"V-204579\" selected=\"true\" /><select idref=\"V-204580\" selected=\"true\" /><select idref=\"V-204581\" selected=\"true\" /><select idref=\"V-204582\" selected=\"true\" /><select idref=\"V-204583\" selected=\"true\" /><select idref=\"V-204584\" selected=\"true\" /><select idref=\"V-204585\" selected=\"true\" /><select idref=\"V-204586\" selected=\"true\" /><select idref=\"V-204587\" selected=\"true\" /><select idref=\"V-204588\" selected=\"true\" /><select idref=\"V-204589\" selected=\"true\" /><select idref=\"V-204590\" selected=\"true\" /><select idref=\"V-204591\" selected=\"true\" /><select idref=\"V-204592\" selected=\"true\" /><select idref=\"V-204593\" selected=\"true\" /><select idref=\"V-204594\" selected=\"true\" /><select idref=\"V-204595\" selected=\"true\" /><select idref=\"V-204596\" selected=\"true\" /><select idref=\"V-204597\" selected=\"true\" /><select idref=\"V-204598\" selected=\"true\" /><select idref=\"V-204599\" selected=\"true\" /><select idref=\"V-204600\" selected=\"true\" /><select idref=\"V-204601\" selected=\"true\" /><select idref=\"V-204602\" selected=\"true\" /><select idref=\"V-204603\" selected=\"true\" /><select idref=\"V-204604\" selected=\"true\" /><select idref=\"V-204605\" selected=\"true\" /><select idref=\"V-204606\" selected=\"true\" /><select idref=\"V-204607\" selected=\"true\" /><select idref=\"V-204608\" selected=\"true\" /><select idref=\"V-204609\" selected=\"true\" /><select idref=\"V-204610\" selected=\"true\" /><select idref=\"V-204611\" selected=\"true\" /><select idref=\"V-204612\" selected=\"true\" /><select idref=\"V-204613\" selected=\"true\" /><select idref=\"V-204614\" selected=\"true\" /><select idref=\"V-204615\" selected=\"true\" /><select idref=\"V-204616\" selected=\"true\" /><select idref=\"V-204617\" selected=\"true\" /><select idref=\"V-204618\" selected=\"true\" /><select idref=\"V-204619\" selected=\"true\" /><select idref=\"V-204620\" selected=\"true\" /><select idref=\"V-204621\" selected=\"true\" /><select idref=\"V-204622\" selected=\"true\" /><select idref=\"V-204623\" selected=\"true\" /><select idref=\"V-204624\" selected=\"true\" /><select idref=\"V-204625\" selected=\"true\" /><select idref=\"V-204626\" selected=\"true\" /><select idref=\"V-204627\" selected=\"true\" /><select idref=\"V-204628\" selected=\"true\" /><select idref=\"V-204629\" selected=\"true\" /><select idref=\"V-204630\" selected=\"true\" /><select idref=\"V-204631\" selected=\"true\" /><select idref=\"V-204632\" selected=\"true\" /><select idref=\"V-204633\" selected=\"true\" /><select idref=\"V-204634\" selected=\"true\" /><select idref=\"V-214799\" selected=\"true\" /><select idref=\"V-214800\" selected=\"true\" /><select idref=\"V-214801\" selected=\"true\" /><select idref=\"V-214937\" selected=\"true\" /></Profile><Profile id=\"MAC-1_Sensitive\"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-204392\" selected=\"true\" /><select idref=\"V-204393\" selected=\"true\" /><select idref=\"V-204394\" selected=\"true\" /><select idref=\"V-204395\" selected=\"true\" /><select idref=\"V-204396\" selected=\"true\" /><select idref=\"V-204397\" selected=\"true\" /><select idref=\"V-204398\" selected=\"true\" /><select idref=\"V-204399\" selected=\"true\" /><select idref=\"V-204400\" selected=\"true\" /><select idref=\"V-204401\" selected=\"true\" /><select idref=\"V-204402\" selected=\"true\" /><select idref=\"V-204403\" selected=\"true\" /><select idref=\"V-204404\" selected=\"true\" /><select idref=\"V-204405\" selected=\"true\" /><select idref=\"V-204406\" selected=\"true\" /><select idref=\"V-204407\" selected=\"true\" /><select idref=\"V-204408\" selected=\"true\" /><select idref=\"V-204409\" selected=\"true\" /><select idref=\"V-204410\" selected=\"true\" /><select idref=\"V-204411\" selected=\"true\" /><select idref=\"V-204412\" selected=\"true\" /><select idref=\"V-204413\" selected=\"true\" /><select idref=\"V-204414\" selected=\"true\" /><select idref=\"V-204415\" selected=\"true\" /><select idref=\"V-204416\" selected=\"true\" /><select idref=\"V-204417\" selected=\"true\" /><select idref=\"V-204418\" selected=\"true\" /><select idref=\"V-204419\" selected=\"true\" /><select idref=\"V-204420\" selected=\"true\" /><select idref=\"V-204421\" selected=\"true\" /><select idref=\"V-204422\" selected=\"true\" /><select idref=\"V-204423\" selected=\"true\" /><select idref=\"V-204424\" selected=\"true\" /><select idref=\"V-204425\" selected=\"true\" /><select idref=\"V-204426\" selected=\"true\" /><select idref=\"V-204427\" selected=\"true\" /><select idref=\"V-204428\" selected=\"true\" /><select idref=\"V-204429\" selected=\"true\" /><select idref=\"V-204430\" selected=\"true\" /><select idref=\"V-204431\" selected=\"true\" /><select idref=\"V-204432\" selected=\"true\" /><select idref=\"V-204433\" selected=\"true\" /><select idref=\"V-204434\" selected=\"true\" /><select idref=\"V-204435\" selected=\"true\" /><select idref=\"V-204436\" selected=\"true\" /><select idref=\"V-204437\" selected=\"true\" /><select idref=\"V-204438\" selected=\"true\" /><select idref=\"V-204439\" selected=\"true\" /><select idref=\"V-204440\" selected=\"true\" /><select idref=\"V-204441\" selected=\"true\" /><select idref=\"V-204442\" selected=\"true\" /><select idref=\"V-204443\" selected=\"true\" /><select idref=\"V-204444\" selected=\"true\" /><select idref=\"V-204445\" selected=\"true\" /><select idref=\"V-204446\" selected=\"true\" /><select idref=\"V-204447\" selected=\"true\" /><select idref=\"V-204448\" selected=\"true\" /><select idref=\"V-204449\" selected=\"true\" /><select idref=\"V-204450\" selected=\"true\" /><select idref=\"V-204451\" selected=\"true\" /><select idref=\"V-204452\" selected=\"true\" /><select idref=\"V-204453\" selected=\"true\" /><select idref=\"V-204454\" selected=\"true\" /><select idref=\"V-204455\" selected=\"true\" /><select idref=\"V-204456\" selected=\"true\" /><select idref=\"V-204457\" selected=\"true\" /><select idref=\"V-204458\" selected=\"true\" /><select idref=\"V-204459\" selected=\"true\" /><select idref=\"V-204460\" selected=\"true\" /><select idref=\"V-204461\" selected=\"true\" /><select idref=\"V-204462\" selected=\"true\" /><select idref=\"V-204463\" selected=\"true\" /><select idref=\"V-204464\" selected=\"true\" /><select idref=\"V-204465\" selected=\"true\" /><select idref=\"V-204466\" selected=\"true\" /><select idref=\"V-204467\" selected=\"true\" /><select idref=\"V-204468\" selected=\"true\" /><select idref=\"V-204469\" selected=\"true\" /><select idref=\"V-204470\" selected=\"true\" /><select idref=\"V-204471\" selected=\"true\" /><select idref=\"V-204472\" selected=\"true\" /><select idref=\"V-204473\" selected=\"true\" /><select idref=\"V-204474\" selected=\"true\" /><select idref=\"V-204475\" selected=\"true\" /><select idref=\"V-204476\" selected=\"true\" /><select idref=\"V-204477\" selected=\"true\" /><select idref=\"V-204478\" selected=\"true\" /><select idref=\"V-204479\" selected=\"true\" /><select idref=\"V-204480\" selected=\"true\" /><select idref=\"V-204481\" selected=\"true\" /><select idref=\"V-204482\" selected=\"true\" /><select idref=\"V-204483\" selected=\"true\" /><select idref=\"V-204484\" selected=\"true\" /><select idref=\"V-204485\" selected=\"true\" /><select idref=\"V-204486\" selected=\"true\" /><select idref=\"V-204487\" selected=\"true\" /><select idref=\"V-204488\" selected=\"true\" /><select idref=\"V-204489\" selected=\"true\" /><select idref=\"V-204490\" selected=\"true\" /><select idref=\"V-204491\" selected=\"true\" /><select idref=\"V-204492\" selected=\"true\" /><select idref=\"V-204493\" selected=\"true\" /><select idref=\"V-204494\" selected=\"true\" /><select idref=\"V-204495\" selected=\"true\" /><select idref=\"V-204496\" selected=\"true\" /><select idref=\"V-204497\" selected=\"true\" /><select idref=\"V-204498\" selected=\"true\" /><select idref=\"V-204499\" selected=\"true\" /><select idref=\"V-204500\" selected=\"true\" /><select idref=\"V-204501\" selected=\"true\" /><select idref=\"V-204502\" selected=\"true\" /><select idref=\"V-204503\" selected=\"true\" /><select idref=\"V-204504\" selected=\"true\" /><select idref=\"V-204505\" selected=\"true\" /><select idref=\"V-204506\" selected=\"true\" /><select idref=\"V-204507\" selected=\"true\" /><select idref=\"V-204508\" selected=\"true\" /><select idref=\"V-204509\" selected=\"true\" /><select idref=\"V-204510\" selected=\"true\" /><select idref=\"V-204511\" selected=\"true\" /><select idref=\"V-204512\" selected=\"true\" /><select idref=\"V-204513\" selected=\"true\" /><select idref=\"V-204514\" selected=\"true\" /><select idref=\"V-204515\" selected=\"true\" /><select idref=\"V-204516\" selected=\"true\" /><select idref=\"V-204517\" selected=\"true\" /><select idref=\"V-204518\" selected=\"true\" /><select idref=\"V-204519\" selected=\"true\" /><select idref=\"V-204520\" selected=\"true\" /><select idref=\"V-204521\" selected=\"true\" /><select idref=\"V-204522\" selected=\"true\" /><select idref=\"V-204523\" selected=\"true\" /><select idref=\"V-204524\" selected=\"true\" /><select idref=\"V-204525\" selected=\"true\" /><select idref=\"V-204526\" selected=\"true\" /><select idref=\"V-204527\" selected=\"true\" /><select idref=\"V-204528\" selected=\"true\" /><select idref=\"V-204529\" selected=\"true\" /><select idref=\"V-204530\" selected=\"true\" /><select idref=\"V-204531\" selected=\"true\" /><select idref=\"V-204532\" selected=\"true\" /><select idref=\"V-204533\" selected=\"true\" /><select idref=\"V-204534\" selected=\"true\" /><select idref=\"V-204535\" selected=\"true\" /><select idref=\"V-204536\" selected=\"true\" /><select idref=\"V-204537\" selected=\"true\" /><select idref=\"V-204538\" selected=\"true\" /><select idref=\"V-204539\" selected=\"true\" /><select idref=\"V-204540\" selected=\"true\" /><select idref=\"V-204541\" selected=\"true\" /><select idref=\"V-204542\" selected=\"true\" /><select idref=\"V-204543\" selected=\"true\" /><select idref=\"V-204544\" selected=\"true\" /><select idref=\"V-204545\" selected=\"true\" /><select idref=\"V-204546\" selected=\"true\" /><select idref=\"V-204547\" selected=\"true\" /><select idref=\"V-204548\" selected=\"true\" /><select idref=\"V-204549\" selected=\"true\" /><select idref=\"V-204550\" selected=\"true\" /><select idref=\"V-204551\" selected=\"true\" /><select idref=\"V-204552\" selected=\"true\" /><select idref=\"V-204553\" selected=\"true\" /><select idref=\"V-204554\" selected=\"true\" /><select idref=\"V-204555\" selected=\"true\" /><select idref=\"V-204556\" selected=\"true\" /><select idref=\"V-204557\" selected=\"true\" /><select idref=\"V-204558\" selected=\"true\" /><select idref=\"V-204559\" selected=\"true\" /><select idref=\"V-204560\" selected=\"true\" /><select idref=\"V-204561\" selected=\"true\" /><select idref=\"V-204562\" selected=\"true\" /><select idref=\"V-204563\" selected=\"true\" /><select idref=\"V-204564\" selected=\"true\" /><select idref=\"V-204565\" selected=\"true\" /><select idref=\"V-204566\" selected=\"true\" /><select idref=\"V-204567\" selected=\"true\" /><select idref=\"V-204568\" selected=\"true\" /><select idref=\"V-204569\" selected=\"true\" /><select idref=\"V-204570\" selected=\"true\" /><select idref=\"V-204571\" selected=\"true\" /><select idref=\"V-204572\" selected=\"true\" /><select idref=\"V-204573\" selected=\"true\" /><select idref=\"V-204574\" selected=\"true\" /><select idref=\"V-204575\" selected=\"true\" /><select idref=\"V-204576\" selected=\"true\" /><select idref=\"V-204577\" selected=\"true\" /><select idref=\"V-204578\" selected=\"true\" /><select idref=\"V-204579\" selected=\"true\" /><select idref=\"V-204580\" selected=\"true\" /><select idref=\"V-204581\" selected=\"true\" /><select idref=\"V-204582\" selected=\"true\" /><select idref=\"V-204583\" selected=\"true\" /><select idref=\"V-204584\" selected=\"true\" /><select idref=\"V-204585\" selected=\"true\" /><select idref=\"V-204586\" selected=\"true\" /><select idref=\"V-204587\" selected=\"true\" /><select idref=\"V-204588\" selected=\"true\" /><select idref=\"V-204589\" selected=\"true\" /><select idref=\"V-204590\" selected=\"true\" /><select idref=\"V-204591\" selected=\"true\" /><select idref=\"V-204592\" selected=\"true\" /><select idref=\"V-204593\" selected=\"true\" /><select idref=\"V-204594\" selected=\"true\" /><select idref=\"V-204595\" selected=\"true\" /><select idref=\"V-204596\" selected=\"true\" /><select idref=\"V-204597\" selected=\"true\" /><select idref=\"V-204598\" selected=\"true\" /><select idref=\"V-204599\" selected=\"true\" /><select idref=\"V-204600\" selected=\"true\" /><select idref=\"V-204601\" selected=\"true\" /><select idref=\"V-204602\" selected=\"true\" /><select idref=\"V-204603\" selected=\"true\" /><select idref=\"V-204604\" selected=\"true\" /><select idref=\"V-204605\" selected=\"true\" /><select idref=\"V-204606\" selected=\"true\" /><select idref=\"V-204607\" selected=\"true\" /><select idref=\"V-204608\" selected=\"true\" /><select idref=\"V-204609\" selected=\"true\" /><select idref=\"V-204610\" selected=\"true\" /><select idref=\"V-204611\" selected=\"true\" /><select idref=\"V-204612\" selected=\"true\" /><select idref=\"V-204613\" selected=\"true\" /><select idref=\"V-204614\" selected=\"true\" /><select idref=\"V-204615\" selected=\"true\" /><select idref=\"V-204616\" selected=\"true\" /><select idref=\"V-204617\" selected=\"true\" /><select idref=\"V-204618\" selected=\"true\" /><select idref=\"V-204619\" selected=\"true\" /><select idref=\"V-204620\" selected=\"true\" /><select idref=\"V-204621\" selected=\"true\" /><select idref=\"V-204622\" selected=\"true\" /><select idref=\"V-204623\" selected=\"true\" /><select idref=\"V-204624\" selected=\"true\" /><select idref=\"V-204625\" selected=\"true\" /><select idref=\"V-204626\" selected=\"true\" /><select idref=\"V-204627\" selected=\"true\" /><select idref=\"V-204628\" selected=\"true\" /><select idref=\"V-204629\" selected=\"true\" /><select idref=\"V-204630\" selected=\"true\" /><select idref=\"V-204631\" selected=\"true\" /><select idref=\"V-204632\" selected=\"true\" /><select idref=\"V-204633\" selected=\"true\" /><select idref=\"V-204634\" selected=\"true\" /><select idref=\"V-214799\" selected=\"true\" /><select idref=\"V-214800\" selected=\"true\" /><select idref=\"V-214801\" selected=\"true\" /><select idref=\"V-214937\" selected=\"true\" /></Profile><Profile id=\"MAC-2_Classified\"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-204392\" selected=\"true\" /><select idref=\"V-204393\" selected=\"true\" /><select idref=\"V-204394\" selected=\"true\" /><select idref=\"V-204395\" selected=\"true\" /><select idref=\"V-204396\" selected=\"true\" /><select idref=\"V-204397\" selected=\"true\" /><select idref=\"V-204398\" selected=\"true\" /><select idref=\"V-204399\" selected=\"true\" /><select idref=\"V-204400\" selected=\"true\" /><select idref=\"V-204401\" selected=\"true\" /><select idref=\"V-204402\" selected=\"true\" /><select idref=\"V-204403\" selected=\"true\" /><select idref=\"V-204404\" selected=\"true\" /><select idref=\"V-204405\" selected=\"true\" /><select idref=\"V-204406\" selected=\"true\" /><select idref=\"V-204407\" selected=\"true\" /><select idref=\"V-204408\" selected=\"true\" /><select idref=\"V-204409\" selected=\"true\" /><select idref=\"V-204410\" selected=\"true\" /><select idref=\"V-204411\" selected=\"true\" /><select idref=\"V-204412\" selected=\"true\" /><select idref=\"V-204413\" selected=\"true\" /><select idref=\"V-204414\" selected=\"true\" /><select idref=\"V-204415\" selected=\"true\" /><select idref=\"V-204416\" selected=\"true\" /><select idref=\"V-204417\" selected=\"true\" /><select idref=\"V-204418\" selected=\"true\" /><select idref=\"V-204419\" selected=\"true\" /><select idref=\"V-204420\" selected=\"true\" /><select idref=\"V-204421\" selected=\"true\" /><select idref=\"V-204422\" selected=\"true\" /><select idref=\"V-204423\" selected=\"true\" /><select idref=\"V-204424\" selected=\"true\" /><select idref=\"V-204425\" selected=\"true\" /><select idref=\"V-204426\" selected=\"true\" /><select idref=\"V-204427\" selected=\"true\" /><select idref=\"V-204428\" selected=\"true\" /><select idref=\"V-204429\" selected=\"true\" /><select idref=\"V-204430\" selected=\"true\" /><select idref=\"V-204431\" selected=\"true\" /><select idref=\"V-204432\" selected=\"true\" /><select idref=\"V-204433\" selected=\"true\" /><select idref=\"V-204434\" selected=\"true\" /><select idref=\"V-204435\" selected=\"true\" /><select idref=\"V-204436\" selected=\"true\" /><select idref=\"V-204437\" selected=\"true\" /><select idref=\"V-204438\" selected=\"true\" /><select idref=\"V-204439\" selected=\"true\" /><select idref=\"V-204440\" selected=\"true\" /><select idref=\"V-204441\" selected=\"true\" /><select idref=\"V-204442\" selected=\"true\" /><select idref=\"V-204443\" selected=\"true\" /><select idref=\"V-204444\" selected=\"true\" /><select idref=\"V-204445\" selected=\"true\" /><select idref=\"V-204446\" selected=\"true\" /><select idref=\"V-204447\" selected=\"true\" /><select idref=\"V-204448\" selected=\"true\" /><select idref=\"V-204449\" selected=\"true\" /><select idref=\"V-204450\" selected=\"true\" /><select idref=\"V-204451\" selected=\"true\" /><select idref=\"V-204452\" selected=\"true\" /><select idref=\"V-204453\" selected=\"true\" /><select idref=\"V-204454\" selected=\"true\" /><select idref=\"V-204455\" selected=\"true\" /><select idref=\"V-204456\" selected=\"true\" /><select idref=\"V-204457\" selected=\"true\" /><select idref=\"V-204458\" selected=\"true\" /><select idref=\"V-204459\" selected=\"true\" /><select idref=\"V-204460\" selected=\"true\" /><select idref=\"V-204461\" selected=\"true\" /><select idref=\"V-204462\" selected=\"true\" /><select idref=\"V-204463\" selected=\"true\" /><select idref=\"V-204464\" selected=\"true\" /><select idref=\"V-204465\" selected=\"true\" /><select idref=\"V-204466\" selected=\"true\" /><select idref=\"V-204467\" selected=\"true\" /><select idref=\"V-204468\" selected=\"true\" /><select idref=\"V-204469\" selected=\"true\" /><select idref=\"V-204470\" selected=\"true\" /><select idref=\"V-204471\" selected=\"true\" /><select idref=\"V-204472\" selected=\"true\" /><select idref=\"V-204473\" selected=\"true\" /><select idref=\"V-204474\" selected=\"true\" /><select idref=\"V-204475\" selected=\"true\" /><select idref=\"V-204476\" selected=\"true\" /><select idref=\"V-204477\" selected=\"true\" /><select idref=\"V-204478\" selected=\"true\" /><select idref=\"V-204479\" selected=\"true\" /><select idref=\"V-204480\" selected=\"true\" /><select idref=\"V-204481\" selected=\"true\" /><select idref=\"V-204482\" selected=\"true\" /><select idref=\"V-204483\" selected=\"true\" /><select idref=\"V-204484\" selected=\"true\" /><select idref=\"V-204485\" selected=\"true\" /><select idref=\"V-204486\" selected=\"true\" /><select idref=\"V-204487\" selected=\"true\" /><select idref=\"V-204488\" selected=\"true\" /><select idref=\"V-204489\" selected=\"true\" /><select idref=\"V-204490\" selected=\"true\" /><select idref=\"V-204491\" selected=\"true\" /><select idref=\"V-204492\" selected=\"true\" /><select idref=\"V-204493\" selected=\"true\" /><select idref=\"V-204494\" selected=\"true\" /><select idref=\"V-204495\" selected=\"true\" /><select idref=\"V-204496\" selected=\"true\" /><select idref=\"V-204497\" selected=\"true\" /><select idref=\"V-204498\" selected=\"true\" /><select idref=\"V-204499\" selected=\"true\" /><select idref=\"V-204500\" selected=\"true\" /><select idref=\"V-204501\" selected=\"true\" /><select idref=\"V-204502\" selected=\"true\" /><select idref=\"V-204503\" selected=\"true\" /><select idref=\"V-204504\" selected=\"true\" /><select idref=\"V-204505\" selected=\"true\" /><select idref=\"V-204506\" selected=\"true\" /><select idref=\"V-204507\" selected=\"true\" /><select idref=\"V-204508\" selected=\"true\" /><select idref=\"V-204509\" selected=\"true\" /><select idref=\"V-204510\" selected=\"true\" /><select idref=\"V-204511\" selected=\"true\" /><select idref=\"V-204512\" selected=\"true\" /><select idref=\"V-204513\" selected=\"true\" /><select idref=\"V-204514\" selected=\"true\" /><select idref=\"V-204515\" selected=\"true\" /><select idref=\"V-204516\" selected=\"true\" /><select idref=\"V-204517\" selected=\"true\" /><select idref=\"V-204518\" selected=\"true\" /><select idref=\"V-204519\" selected=\"true\" /><select idref=\"V-204520\" selected=\"true\" /><select idref=\"V-204521\" selected=\"true\" /><select idref=\"V-204522\" selected=\"true\" /><select idref=\"V-204523\" selected=\"true\" /><select idref=\"V-204524\" selected=\"true\" /><select idref=\"V-204525\" selected=\"true\" /><select idref=\"V-204526\" selected=\"true\" /><select idref=\"V-204527\" selected=\"true\" /><select idref=\"V-204528\" selected=\"true\" /><select idref=\"V-204529\" selected=\"true\" /><select idref=\"V-204530\" selected=\"true\" /><select idref=\"V-204531\" selected=\"true\" /><select idref=\"V-204532\" selected=\"true\" /><select idref=\"V-204533\" selected=\"true\" /><select idref=\"V-204534\" selected=\"true\" /><select idref=\"V-204535\" selected=\"true\" /><select idref=\"V-204536\" selected=\"true\" /><select idref=\"V-204537\" selected=\"true\" /><select idref=\"V-204538\" selected=\"true\" /><select idref=\"V-204539\" selected=\"true\" /><select idref=\"V-204540\" selected=\"true\" /><select idref=\"V-204541\" selected=\"true\" /><select idref=\"V-204542\" selected=\"true\" /><select idref=\"V-204543\" selected=\"true\" /><select idref=\"V-204544\" selected=\"true\" /><select idref=\"V-204545\" selected=\"true\" /><select idref=\"V-204546\" selected=\"true\" /><select idref=\"V-204547\" selected=\"true\" /><select idref=\"V-204548\" selected=\"true\" /><select idref=\"V-204549\" selected=\"true\" /><select idref=\"V-204550\" selected=\"true\" /><select idref=\"V-204551\" selected=\"true\" /><select idref=\"V-204552\" selected=\"true\" /><select idref=\"V-204553\" selected=\"true\" /><select idref=\"V-204554\" selected=\"true\" /><select idref=\"V-204555\" selected=\"true\" /><select idref=\"V-204556\" selected=\"true\" /><select idref=\"V-204557\" selected=\"true\" /><select idref=\"V-204558\" selected=\"true\" /><select idref=\"V-204559\" selected=\"true\" /><select idref=\"V-204560\" selected=\"true\" /><select idref=\"V-204561\" selected=\"true\" /><select idref=\"V-204562\" selected=\"true\" /><select idref=\"V-204563\" selected=\"true\" /><select idref=\"V-204564\" selected=\"true\" /><select idref=\"V-204565\" selected=\"true\" /><select idref=\"V-204566\" selected=\"true\" /><select idref=\"V-204567\" selected=\"true\" /><select idref=\"V-204568\" selected=\"true\" /><select idref=\"V-204569\" selected=\"true\" /><select idref=\"V-204570\" selected=\"true\" /><select idref=\"V-204571\" selected=\"true\" /><select idref=\"V-204572\" selected=\"true\" /><select idref=\"V-204573\" selected=\"true\" /><select idref=\"V-204574\" selected=\"true\" /><select idref=\"V-204575\" selected=\"true\" /><select idref=\"V-204576\" selected=\"true\" /><select idref=\"V-204577\" selected=\"true\" /><select idref=\"V-204578\" selected=\"true\" /><select idref=\"V-204579\" selected=\"true\" /><select idref=\"V-204580\" selected=\"true\" /><select idref=\"V-204581\" selected=\"true\" /><select idref=\"V-204582\" selected=\"true\" /><select idref=\"V-204583\" selected=\"true\" /><select idref=\"V-204584\" selected=\"true\" /><select idref=\"V-204585\" selected=\"true\" /><select idref=\"V-204586\" selected=\"true\" /><select idref=\"V-204587\" selected=\"true\" /><select idref=\"V-204588\" selected=\"true\" /><select idref=\"V-204589\" selected=\"true\" /><select idref=\"V-204590\" selected=\"true\" /><select idref=\"V-204591\" selected=\"true\" /><select idref=\"V-204592\" selected=\"true\" /><select idref=\"V-204593\" selected=\"true\" /><select idref=\"V-204594\" selected=\"true\" /><select idref=\"V-204595\" selected=\"true\" /><select idref=\"V-204596\" selected=\"true\" /><select idref=\"V-204597\" selected=\"true\" /><select idref=\"V-204598\" selected=\"true\" /><select idref=\"V-204599\" selected=\"true\" /><select idref=\"V-204600\" selected=\"true\" /><select idref=\"V-204601\" selected=\"true\" /><select idref=\"V-204602\" selected=\"true\" /><select idref=\"V-204603\" selected=\"true\" /><select idref=\"V-204604\" selected=\"true\" /><select idref=\"V-204605\" selected=\"true\" /><select idref=\"V-204606\" selected=\"true\" /><select idref=\"V-204607\" selected=\"true\" /><select idref=\"V-204608\" selected=\"true\" /><select idref=\"V-204609\" selected=\"true\" /><select idref=\"V-204610\" selected=\"true\" /><select idref=\"V-204611\" selected=\"true\" /><select idref=\"V-204612\" selected=\"true\" /><select idref=\"V-204613\" selected=\"true\" /><select idref=\"V-204614\" selected=\"true\" /><select idref=\"V-204615\" selected=\"true\" /><select idref=\"V-204616\" selected=\"true\" /><select idref=\"V-204617\" selected=\"true\" /><select idref=\"V-204618\" selected=\"true\" /><select idref=\"V-204619\" selected=\"true\" /><select idref=\"V-204620\" selected=\"true\" /><select idref=\"V-204621\" selected=\"true\" /><select idref=\"V-204622\" selected=\"true\" /><select idref=\"V-204623\" selected=\"true\" /><select idref=\"V-204624\" selected=\"true\" /><select idref=\"V-204625\" selected=\"true\" /><select idref=\"V-204626\" selected=\"true\" /><select idref=\"V-204627\" selected=\"true\" /><select idref=\"V-204628\" selected=\"true\" /><select idref=\"V-204629\" selected=\"true\" /><select idref=\"V-204630\" selected=\"true\" /><select idref=\"V-204631\" selected=\"true\" /><select idref=\"V-204632\" selected=\"true\" /><select idref=\"V-204633\" selected=\"true\" /><select idref=\"V-204634\" selected=\"true\" /><select idref=\"V-214799\" selected=\"true\" /><select idref=\"V-214800\" selected=\"true\" /><select idref=\"V-214801\" selected=\"true\" /><select idref=\"V-214937\" selected=\"true\" /></Profile><Profile id=\"MAC-2_Public\"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-204392\" selected=\"true\" /><select idref=\"V-204393\" selected=\"true\" /><select idref=\"V-204394\" selected=\"true\" /><select idref=\"V-204395\" selected=\"true\" /><select idref=\"V-204396\" selected=\"true\" /><select idref=\"V-204397\" selected=\"true\" /><select idref=\"V-204398\" selected=\"true\" /><select idref=\"V-204399\" selected=\"true\" /><select idref=\"V-204400\" selected=\"true\" /><select idref=\"V-204401\" selected=\"true\" /><select idref=\"V-204402\" selected=\"true\" /><select idref=\"V-204403\" selected=\"true\" /><select idref=\"V-204404\" selected=\"true\" /><select idref=\"V-204405\" selected=\"true\" /><select idref=\"V-204406\" selected=\"true\" /><select idref=\"V-204407\" selected=\"true\" /><select idref=\"V-204408\" selected=\"true\" /><select idref=\"V-204409\" selected=\"true\" /><select idref=\"V-204410\" selected=\"true\" /><select idref=\"V-204411\" selected=\"true\" /><select idref=\"V-204412\" selected=\"true\" /><select idref=\"V-204413\" selected=\"true\" /><select idref=\"V-204414\" selected=\"true\" /><select idref=\"V-204415\" selected=\"true\" /><select idref=\"V-204416\" selected=\"true\" /><select idref=\"V-204417\" selected=\"true\" /><select idref=\"V-204418\" selected=\"true\" /><select idref=\"V-204419\" selected=\"true\" /><select idref=\"V-204420\" selected=\"true\" /><select idref=\"V-204421\" selected=\"true\" /><select idref=\"V-204422\" selected=\"true\" /><select idref=\"V-204423\" selected=\"true\" /><select idref=\"V-204424\" selected=\"true\" /><select idref=\"V-204425\" selected=\"true\" /><select idref=\"V-204426\" selected=\"true\" /><select idref=\"V-204427\" selected=\"true\" /><select idref=\"V-204428\" selected=\"true\" /><select idref=\"V-204429\" selected=\"true\" /><select idref=\"V-204430\" selected=\"true\" /><select idref=\"V-204431\" selected=\"true\" /><select idref=\"V-204432\" selected=\"true\" /><select idref=\"V-204433\" selected=\"true\" /><select idref=\"V-204434\" selected=\"true\" /><select idref=\"V-204435\" selected=\"true\" /><select idref=\"V-204436\" selected=\"true\" /><select idref=\"V-204437\" selected=\"true\" /><select idref=\"V-204438\" selected=\"true\" /><select idref=\"V-204439\" selected=\"true\" /><select idref=\"V-204440\" selected=\"true\" /><select idref=\"V-204441\" selected=\"true\" /><select idref=\"V-204442\" selected=\"true\" /><select idref=\"V-204443\" selected=\"true\" /><select idref=\"V-204444\" selected=\"true\" /><select idref=\"V-204445\" selected=\"true\" /><select idref=\"V-204446\" selected=\"true\" /><select idref=\"V-204447\" selected=\"true\" /><select idref=\"V-204448\" selected=\"true\" /><select idref=\"V-204449\" selected=\"true\" /><select idref=\"V-204450\" selected=\"true\" /><select idref=\"V-204451\" selected=\"true\" /><select idref=\"V-204452\" selected=\"true\" /><select idref=\"V-204453\" selected=\"true\" /><select idref=\"V-204454\" selected=\"true\" /><select idref=\"V-204455\" selected=\"true\" /><select idref=\"V-204456\" selected=\"true\" /><select idref=\"V-204457\" selected=\"true\" /><select idref=\"V-204458\" selected=\"true\" /><select idref=\"V-204459\" selected=\"true\" /><select idref=\"V-204460\" selected=\"true\" /><select idref=\"V-204461\" selected=\"true\" /><select idref=\"V-204462\" selected=\"true\" /><select idref=\"V-204463\" selected=\"true\" /><select idref=\"V-204464\" selected=\"true\" /><select idref=\"V-204465\" selected=\"true\" /><select idref=\"V-204466\" selected=\"true\" /><select idref=\"V-204467\" selected=\"true\" /><select idref=\"V-204468\" selected=\"true\" /><select idref=\"V-204469\" selected=\"true\" /><select idref=\"V-204470\" selected=\"true\" /><select idref=\"V-204471\" selected=\"true\" /><select idref=\"V-204472\" selected=\"true\" /><select idref=\"V-204473\" selected=\"true\" /><select idref=\"V-204474\" selected=\"true\" /><select idref=\"V-204475\" selected=\"true\" /><select idref=\"V-204476\" selected=\"true\" /><select idref=\"V-204477\" selected=\"true\" /><select idref=\"V-204478\" selected=\"true\" /><select idref=\"V-204479\" selected=\"true\" /><select idref=\"V-204480\" selected=\"true\" /><select idref=\"V-204481\" selected=\"true\" /><select idref=\"V-204482\" selected=\"true\" /><select idref=\"V-204483\" selected=\"true\" /><select idref=\"V-204484\" selected=\"true\" /><select idref=\"V-204485\" selected=\"true\" /><select idref=\"V-204486\" selected=\"true\" /><select idref=\"V-204487\" selected=\"true\" /><select idref=\"V-204488\" selected=\"true\" /><select idref=\"V-204489\" selected=\"true\" /><select idref=\"V-204490\" selected=\"true\" /><select idref=\"V-204491\" selected=\"true\" /><select idref=\"V-204492\" selected=\"true\" /><select idref=\"V-204493\" selected=\"true\" /><select idref=\"V-204494\" selected=\"true\" /><select idref=\"V-204495\" selected=\"true\" /><select idref=\"V-204496\" selected=\"true\" /><select idref=\"V-204497\" selected=\"true\" /><select idref=\"V-204498\" selected=\"true\" /><select idref=\"V-204499\" selected=\"true\" /><select idref=\"V-204500\" selected=\"true\" /><select idref=\"V-204501\" selected=\"true\" /><select idref=\"V-204502\" selected=\"true\" /><select idref=\"V-204503\" selected=\"true\" /><select idref=\"V-204504\" selected=\"true\" /><select idref=\"V-204505\" selected=\"true\" /><select idref=\"V-204506\" selected=\"true\" /><select idref=\"V-204507\" selected=\"true\" /><select idref=\"V-204508\" selected=\"true\" /><select idref=\"V-204509\" selected=\"true\" /><select idref=\"V-204510\" selected=\"true\" /><select idref=\"V-204511\" selected=\"true\" /><select idref=\"V-204512\" selected=\"true\" /><select idref=\"V-204513\" selected=\"true\" /><select idref=\"V-204514\" selected=\"true\" /><select idref=\"V-204515\" selected=\"true\" /><select idref=\"V-204516\" selected=\"true\" /><select idref=\"V-204517\" selected=\"true\" /><select idref=\"V-204518\" selected=\"true\" /><select idref=\"V-204519\" selected=\"true\" /><select idref=\"V-204520\" selected=\"true\" /><select idref=\"V-204521\" selected=\"true\" /><select idref=\"V-204522\" selected=\"true\" /><select idref=\"V-204523\" selected=\"true\" /><select idref=\"V-204524\" selected=\"true\" /><select idref=\"V-204525\" selected=\"true\" /><select idref=\"V-204526\" selected=\"true\" /><select idref=\"V-204527\" selected=\"true\" /><select idref=\"V-204528\" selected=\"true\" /><select idref=\"V-204529\" selected=\"true\" /><select idref=\"V-204530\" selected=\"true\" /><select idref=\"V-204531\" selected=\"true\" /><select idref=\"V-204532\" selected=\"true\" /><select idref=\"V-204533\" selected=\"true\" /><select idref=\"V-204534\" selected=\"true\" /><select idref=\"V-204535\" selected=\"true\" /><select idref=\"V-204536\" selected=\"true\" /><select idref=\"V-204537\" selected=\"true\" /><select idref=\"V-204538\" selected=\"true\" /><select idref=\"V-204539\" selected=\"true\" /><select idref=\"V-204540\" selected=\"true\" /><select idref=\"V-204541\" selected=\"true\" /><select idref=\"V-204542\" selected=\"true\" /><select idref=\"V-204543\" selected=\"true\" /><select idref=\"V-204544\" selected=\"true\" /><select idref=\"V-204545\" selected=\"true\" /><select idref=\"V-204546\" selected=\"true\" /><select idref=\"V-204547\" selected=\"true\" /><select idref=\"V-204548\" selected=\"true\" /><select idref=\"V-204549\" selected=\"true\" /><select idref=\"V-204550\" selected=\"true\" /><select idref=\"V-204551\" selected=\"true\" /><select idref=\"V-204552\" selected=\"true\" /><select idref=\"V-204553\" selected=\"true\" /><select idref=\"V-204554\" selected=\"true\" /><select idref=\"V-204555\" selected=\"true\" /><select idref=\"V-204556\" selected=\"true\" /><select idref=\"V-204557\" selected=\"true\" /><select idref=\"V-204558\" selected=\"true\" /><select idref=\"V-204559\" selected=\"true\" /><select idref=\"V-204560\" selected=\"true\" /><select idref=\"V-204561\" selected=\"true\" /><select idref=\"V-204562\" selected=\"true\" /><select idref=\"V-204563\" selected=\"true\" /><select idref=\"V-204564\" selected=\"true\" /><select idref=\"V-204565\" selected=\"true\" /><select idref=\"V-204566\" selected=\"true\" /><select idref=\"V-204567\" selected=\"true\" /><select idref=\"V-204568\" selected=\"true\" /><select idref=\"V-204569\" selected=\"true\" /><select idref=\"V-204570\" selected=\"true\" /><select idref=\"V-204571\" selected=\"true\" /><select idref=\"V-204572\" selected=\"true\" /><select idref=\"V-204573\" selected=\"true\" /><select idref=\"V-204574\" selected=\"true\" /><select idref=\"V-204575\" selected=\"true\" /><select idref=\"V-204576\" selected=\"true\" /><select idref=\"V-204577\" selected=\"true\" /><select idref=\"V-204578\" selected=\"true\" /><select idref=\"V-204579\" selected=\"true\" /><select idref=\"V-204580\" selected=\"true\" /><select idref=\"V-204581\" selected=\"true\" /><select idref=\"V-204582\" selected=\"true\" /><select idref=\"V-204583\" selected=\"true\" /><select idref=\"V-204584\" selected=\"true\" /><select idref=\"V-204585\" selected=\"true\" /><select idref=\"V-204586\" selected=\"true\" /><select idref=\"V-204587\" selected=\"true\" /><select idref=\"V-204588\" selected=\"true\" /><select idref=\"V-204589\" selected=\"true\" /><select idref=\"V-204590\" selected=\"true\" /><select idref=\"V-204591\" selected=\"true\" /><select idref=\"V-204592\" selected=\"true\" /><select idref=\"V-204593\" selected=\"true\" /><select idref=\"V-204594\" selected=\"true\" /><select idref=\"V-204595\" selected=\"true\" /><select idref=\"V-204596\" selected=\"true\" /><select idref=\"V-204597\" selected=\"true\" /><select idref=\"V-204598\" selected=\"true\" /><select idref=\"V-204599\" selected=\"true\" /><select idref=\"V-204600\" selected=\"true\" /><select idref=\"V-204601\" selected=\"true\" /><select idref=\"V-204602\" selected=\"true\" /><select idref=\"V-204603\" selected=\"true\" /><select idref=\"V-204604\" selected=\"true\" /><select idref=\"V-204605\" selected=\"true\" /><select idref=\"V-204606\" selected=\"true\" /><select idref=\"V-204607\" selected=\"true\" /><select idref=\"V-204608\" selected=\"true\" /><select idref=\"V-204609\" selected=\"true\" /><select idref=\"V-204610\" selected=\"true\" /><select idref=\"V-204611\" selected=\"true\" /><select idref=\"V-204612\" selected=\"true\" /><select idref=\"V-204613\" selected=\"true\" /><select idref=\"V-204614\" selected=\"true\" /><select idref=\"V-204615\" selected=\"true\" /><select idref=\"V-204616\" selected=\"true\" /><select idref=\"V-204617\" selected=\"true\" /><select idref=\"V-204618\" selected=\"true\" /><select idref=\"V-204619\" selected=\"true\" /><select idref=\"V-204620\" selected=\"true\" /><select idref=\"V-204621\" selected=\"true\" /><select idref=\"V-204622\" selected=\"true\" /><select idref=\"V-204623\" selected=\"true\" /><select idref=\"V-204624\" selected=\"true\" /><select idref=\"V-204625\" selected=\"true\" /><select idref=\"V-204626\" selected=\"true\" /><select idref=\"V-204627\" selected=\"true\" /><select idref=\"V-204628\" selected=\"true\" /><select idref=\"V-204629\" selected=\"true\" /><select idref=\"V-204630\" selected=\"true\" /><select idref=\"V-204631\" selected=\"true\" /><select idref=\"V-204632\" selected=\"true\" /><select idref=\"V-204633\" selected=\"true\" /><select idref=\"V-204634\" selected=\"true\" /><select idref=\"V-214799\" selected=\"true\" /><select idref=\"V-214800\" selected=\"true\" /><select idref=\"V-214801\" selected=\"true\" /><select idref=\"V-214937\" selected=\"true\" /></Profile><Profile id=\"MAC-2_Sensitive\"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-204392\" selected=\"true\" /><select idref=\"V-204393\" selected=\"true\" /><select idref=\"V-204394\" selected=\"true\" /><select idref=\"V-204395\" selected=\"true\" /><select idref=\"V-204396\" selected=\"true\" /><select idref=\"V-204397\" selected=\"true\" /><select idref=\"V-204398\" selected=\"true\" /><select idref=\"V-204399\" selected=\"true\" /><select idref=\"V-204400\" selected=\"true\" /><select idref=\"V-204401\" selected=\"true\" /><select idref=\"V-204402\" selected=\"true\" /><select idref=\"V-204403\" selected=\"true\" /><select idref=\"V-204404\" selected=\"true\" /><select idref=\"V-204405\" selected=\"true\" /><select idref=\"V-204406\" selected=\"true\" /><select idref=\"V-204407\" selected=\"true\" /><select idref=\"V-204408\" selected=\"true\" /><select idref=\"V-204409\" selected=\"true\" /><select idref=\"V-204410\" selected=\"true\" /><select idref=\"V-204411\" selected=\"true\" /><select idref=\"V-204412\" selected=\"true\" /><select idref=\"V-204413\" selected=\"true\" /><select idref=\"V-204414\" selected=\"true\" /><select idref=\"V-204415\" selected=\"true\" /><select idref=\"V-204416\" selected=\"true\" /><select idref=\"V-204417\" selected=\"true\" /><select idref=\"V-204418\" selected=\"true\" /><select idref=\"V-204419\" selected=\"true\" /><select idref=\"V-204420\" selected=\"true\" /><select idref=\"V-204421\" selected=\"true\" /><select idref=\"V-204422\" selected=\"true\" /><select idref=\"V-204423\" selected=\"true\" /><select idref=\"V-204424\" selected=\"true\" /><select idref=\"V-204425\" selected=\"true\" /><select idref=\"V-204426\" selected=\"true\" /><select idref=\"V-204427\" selected=\"true\" /><select idref=\"V-204428\" selected=\"true\" /><select idref=\"V-204429\" selected=\"true\" /><select idref=\"V-204430\" selected=\"true\" /><select idref=\"V-204431\" selected=\"true\" /><select idref=\"V-204432\" selected=\"true\" /><select idref=\"V-204433\" selected=\"true\" /><select idref=\"V-204434\" selected=\"true\" /><select idref=\"V-204435\" selected=\"true\" /><select idref=\"V-204436\" selected=\"true\" /><select idref=\"V-204437\" selected=\"true\" /><select idref=\"V-204438\" selected=\"true\" /><select idref=\"V-204439\" selected=\"true\" /><select idref=\"V-204440\" selected=\"true\" /><select idref=\"V-204441\" selected=\"true\" /><select idref=\"V-204442\" selected=\"true\" /><select idref=\"V-204443\" selected=\"true\" /><select idref=\"V-204444\" selected=\"true\" /><select idref=\"V-204445\" selected=\"true\" /><select idref=\"V-204446\" selected=\"true\" /><select idref=\"V-204447\" selected=\"true\" /><select idref=\"V-204448\" selected=\"true\" /><select idref=\"V-204449\" selected=\"true\" /><select idref=\"V-204450\" selected=\"true\" /><select idref=\"V-204451\" selected=\"true\" /><select idref=\"V-204452\" selected=\"true\" /><select idref=\"V-204453\" selected=\"true\" /><select idref=\"V-204454\" selected=\"true\" /><select idref=\"V-204455\" selected=\"true\" /><select idref=\"V-204456\" selected=\"true\" /><select idref=\"V-204457\" selected=\"true\" /><select idref=\"V-204458\" selected=\"true\" /><select idref=\"V-204459\" selected=\"true\" /><select idref=\"V-204460\" selected=\"true\" /><select idref=\"V-204461\" selected=\"true\" /><select idref=\"V-204462\" selected=\"true\" /><select idref=\"V-204463\" selected=\"true\" /><select idref=\"V-204464\" selected=\"true\" /><select idref=\"V-204465\" selected=\"true\" /><select idref=\"V-204466\" selected=\"true\" /><select idref=\"V-204467\" selected=\"true\" /><select idref=\"V-204468\" selected=\"true\" /><select idref=\"V-204469\" selected=\"true\" /><select idref=\"V-204470\" selected=\"true\" /><select idref=\"V-204471\" selected=\"true\" /><select idref=\"V-204472\" selected=\"true\" /><select idref=\"V-204473\" selected=\"true\" /><select idref=\"V-204474\" selected=\"true\" /><select idref=\"V-204475\" selected=\"true\" /><select idref=\"V-204476\" selected=\"true\" /><select idref=\"V-204477\" selected=\"true\" /><select idref=\"V-204478\" selected=\"true\" /><select idref=\"V-204479\" selected=\"true\" /><select idref=\"V-204480\" selected=\"true\" /><select idref=\"V-204481\" selected=\"true\" /><select idref=\"V-204482\" selected=\"true\" /><select idref=\"V-204483\" selected=\"true\" /><select idref=\"V-204484\" selected=\"true\" /><select idref=\"V-204485\" selected=\"true\" /><select idref=\"V-204486\" selected=\"true\" /><select idref=\"V-204487\" selected=\"true\" /><select idref=\"V-204488\" selected=\"true\" /><select idref=\"V-204489\" selected=\"true\" /><select idref=\"V-204490\" selected=\"true\" /><select idref=\"V-204491\" selected=\"true\" /><select idref=\"V-204492\" selected=\"true\" /><select idref=\"V-204493\" selected=\"true\" /><select idref=\"V-204494\" selected=\"true\" /><select idref=\"V-204495\" selected=\"true\" /><select idref=\"V-204496\" selected=\"true\" /><select idref=\"V-204497\" selected=\"true\" /><select idref=\"V-204498\" selected=\"true\" /><select idref=\"V-204499\" selected=\"true\" /><select idref=\"V-204500\" selected=\"true\" /><select idref=\"V-204501\" selected=\"true\" /><select idref=\"V-204502\" selected=\"true\" /><select idref=\"V-204503\" selected=\"true\" /><select idref=\"V-204504\" selected=\"true\" /><select idref=\"V-204505\" selected=\"true\" /><select idref=\"V-204506\" selected=\"true\" /><select idref=\"V-204507\" selected=\"true\" /><select idref=\"V-204508\" selected=\"true\" /><select idref=\"V-204509\" selected=\"true\" /><select idref=\"V-204510\" selected=\"true\" /><select idref=\"V-204511\" selected=\"true\" /><select idref=\"V-204512\" selected=\"true\" /><select idref=\"V-204513\" selected=\"true\" /><select idref=\"V-204514\" selected=\"true\" /><select idref=\"V-204515\" selected=\"true\" /><select idref=\"V-204516\" selected=\"true\" /><select idref=\"V-204517\" selected=\"true\" /><select idref=\"V-204518\" selected=\"true\" /><select idref=\"V-204519\" selected=\"true\" /><select idref=\"V-204520\" selected=\"true\" /><select idref=\"V-204521\" selected=\"true\" /><select idref=\"V-204522\" selected=\"true\" /><select idref=\"V-204523\" selected=\"true\" /><select idref=\"V-204524\" selected=\"true\" /><select idref=\"V-204525\" selected=\"true\" /><select idref=\"V-204526\" selected=\"true\" /><select idref=\"V-204527\" selected=\"true\" /><select idref=\"V-204528\" selected=\"true\" /><select idref=\"V-204529\" selected=\"true\" /><select idref=\"V-204530\" selected=\"true\" /><select idref=\"V-204531\" selected=\"true\" /><select idref=\"V-204532\" selected=\"true\" /><select idref=\"V-204533\" selected=\"true\" /><select idref=\"V-204534\" selected=\"true\" /><select idref=\"V-204535\" selected=\"true\" /><select idref=\"V-204536\" selected=\"true\" /><select idref=\"V-204537\" selected=\"true\" /><select idref=\"V-204538\" selected=\"true\" /><select idref=\"V-204539\" selected=\"true\" /><select idref=\"V-204540\" selected=\"true\" /><select idref=\"V-204541\" selected=\"true\" /><select idref=\"V-204542\" selected=\"true\" /><select idref=\"V-204543\" selected=\"true\" /><select idref=\"V-204544\" selected=\"true\" /><select idref=\"V-204545\" selected=\"true\" /><select idref=\"V-204546\" selected=\"true\" /><select idref=\"V-204547\" selected=\"true\" /><select idref=\"V-204548\" selected=\"true\" /><select idref=\"V-204549\" selected=\"true\" /><select idref=\"V-204550\" selected=\"true\" /><select idref=\"V-204551\" selected=\"true\" /><select idref=\"V-204552\" selected=\"true\" /><select idref=\"V-204553\" selected=\"true\" /><select idref=\"V-204554\" selected=\"true\" /><select idref=\"V-204555\" selected=\"true\" /><select idref=\"V-204556\" selected=\"true\" /><select idref=\"V-204557\" selected=\"true\" /><select idref=\"V-204558\" selected=\"true\" /><select idref=\"V-204559\" selected=\"true\" /><select idref=\"V-204560\" selected=\"true\" /><select idref=\"V-204561\" selected=\"true\" /><select idref=\"V-204562\" selected=\"true\" /><select idref=\"V-204563\" selected=\"true\" /><select idref=\"V-204564\" selected=\"true\" /><select idref=\"V-204565\" selected=\"true\" /><select idref=\"V-204566\" selected=\"true\" /><select idref=\"V-204567\" selected=\"true\" /><select idref=\"V-204568\" selected=\"true\" /><select idref=\"V-204569\" selected=\"true\" /><select idref=\"V-204570\" selected=\"true\" /><select idref=\"V-204571\" selected=\"true\" /><select idref=\"V-204572\" selected=\"true\" /><select idref=\"V-204573\" selected=\"true\" /><select idref=\"V-204574\" selected=\"true\" /><select idref=\"V-204575\" selected=\"true\" /><select idref=\"V-204576\" selected=\"true\" /><select idref=\"V-204577\" selected=\"true\" /><select idref=\"V-204578\" selected=\"true\" /><select idref=\"V-204579\" selected=\"true\" /><select idref=\"V-204580\" selected=\"true\" /><select idref=\"V-204581\" selected=\"true\" /><select idref=\"V-204582\" selected=\"true\" /><select idref=\"V-204583\" selected=\"true\" /><select idref=\"V-204584\" selected=\"true\" /><select idref=\"V-204585\" selected=\"true\" /><select idref=\"V-204586\" selected=\"true\" /><select idref=\"V-204587\" selected=\"true\" /><select idref=\"V-204588\" selected=\"true\" /><select idref=\"V-204589\" selected=\"true\" /><select idref=\"V-204590\" selected=\"true\" /><select idref=\"V-204591\" selected=\"true\" /><select idref=\"V-204592\" selected=\"true\" /><select idref=\"V-204593\" selected=\"true\" /><select idref=\"V-204594\" selected=\"true\" /><select idref=\"V-204595\" selected=\"true\" /><select idref=\"V-204596\" selected=\"true\" /><select idref=\"V-204597\" selected=\"true\" /><select idref=\"V-204598\" selected=\"true\" /><select idref=\"V-204599\" selected=\"true\" /><select idref=\"V-204600\" selected=\"true\" /><select idref=\"V-204601\" selected=\"true\" /><select idref=\"V-204602\" selected=\"true\" /><select idref=\"V-204603\" selected=\"true\" /><select idref=\"V-204604\" selected=\"true\" /><select idref=\"V-204605\" selected=\"true\" /><select idref=\"V-204606\" selected=\"true\" /><select idref=\"V-204607\" selected=\"true\" /><select idref=\"V-204608\" selected=\"true\" /><select idref=\"V-204609\" selected=\"true\" /><select idref=\"V-204610\" selected=\"true\" /><select idref=\"V-204611\" selected=\"true\" /><select idref=\"V-204612\" selected=\"true\" /><select idref=\"V-204613\" selected=\"true\" /><select idref=\"V-204614\" selected=\"true\" /><select idref=\"V-204615\" selected=\"true\" /><select idref=\"V-204616\" selected=\"true\" /><select idref=\"V-204617\" selected=\"true\" /><select idref=\"V-204618\" selected=\"true\" /><select idref=\"V-204619\" selected=\"true\" /><select idref=\"V-204620\" selected=\"true\" /><select idref=\"V-204621\" selected=\"true\" /><select idref=\"V-204622\" selected=\"true\" /><select idref=\"V-204623\" selected=\"true\" /><select idref=\"V-204624\" selected=\"true\" /><select idref=\"V-204625\" selected=\"true\" /><select idref=\"V-204626\" selected=\"true\" /><select idref=\"V-204627\" selected=\"true\" /><select idref=\"V-204628\" selected=\"true\" /><select idref=\"V-204629\" selected=\"true\" /><select idref=\"V-204630\" selected=\"true\" /><select idref=\"V-204631\" selected=\"true\" /><select idref=\"V-204632\" selected=\"true\" /><select idref=\"V-204633\" selected=\"true\" /><select idref=\"V-204634\" selected=\"true\" /><select idref=\"V-214799\" selected=\"true\" /><select idref=\"V-214800\" selected=\"true\" /><select idref=\"V-214801\" selected=\"true\" /><select idref=\"V-214937\" selected=\"true\" /></Profile><Profile id=\"MAC-3_Classified\"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-204392\" selected=\"true\" /><select idref=\"V-204393\" selected=\"true\" /><select idref=\"V-204394\" selected=\"true\" /><select idref=\"V-204395\" selected=\"true\" /><select idref=\"V-204396\" selected=\"true\" /><select idref=\"V-204397\" selected=\"true\" /><select idref=\"V-204398\" selected=\"true\" /><select idref=\"V-204399\" selected=\"true\" /><select idref=\"V-204400\" selected=\"true\" /><select idref=\"V-204401\" selected=\"true\" /><select idref=\"V-204402\" selected=\"true\" /><select idref=\"V-204403\" selected=\"true\" /><select idref=\"V-204404\" selected=\"true\" /><select idref=\"V-204405\" selected=\"true\" /><select idref=\"V-204406\" selected=\"true\" /><select idref=\"V-204407\" selected=\"true\" /><select idref=\"V-204408\" selected=\"true\" /><select idref=\"V-204409\" selected=\"true\" /><select idref=\"V-204410\" selected=\"true\" /><select idref=\"V-204411\" selected=\"true\" /><select idref=\"V-204412\" selected=\"true\" /><select idref=\"V-204413\" selected=\"true\" /><select idref=\"V-204414\" selected=\"true\" /><select idref=\"V-204415\" selected=\"true\" /><select idref=\"V-204416\" selected=\"true\" /><select idref=\"V-204417\" selected=\"true\" /><select idref=\"V-204418\" selected=\"true\" /><select idref=\"V-204419\" selected=\"true\" /><select idref=\"V-204420\" selected=\"true\" /><select idref=\"V-204421\" selected=\"true\" /><select idref=\"V-204422\" selected=\"true\" /><select idref=\"V-204423\" selected=\"true\" /><select idref=\"V-204424\" selected=\"true\" /><select idref=\"V-204425\" selected=\"true\" /><select idref=\"V-204426\" selected=\"true\" /><select idref=\"V-204427\" selected=\"true\" /><select idref=\"V-204428\" selected=\"true\" /><select idref=\"V-204429\" selected=\"true\" /><select idref=\"V-204430\" selected=\"true\" /><select idref=\"V-204431\" selected=\"true\" /><select idref=\"V-204432\" selected=\"true\" /><select idref=\"V-204433\" selected=\"true\" /><select idref=\"V-204434\" selected=\"true\" /><select idref=\"V-204435\" selected=\"true\" /><select idref=\"V-204436\" selected=\"true\" /><select idref=\"V-204437\" selected=\"true\" /><select idref=\"V-204438\" selected=\"true\" /><select idref=\"V-204439\" selected=\"true\" /><select idref=\"V-204440\" selected=\"true\" /><select idref=\"V-204441\" selected=\"true\" /><select idref=\"V-204442\" selected=\"true\" /><select idref=\"V-204443\" selected=\"true\" /><select idref=\"V-204444\" selected=\"true\" /><select idref=\"V-204445\" selected=\"true\" /><select idref=\"V-204446\" selected=\"true\" /><select idref=\"V-204447\" selected=\"true\" /><select idref=\"V-204448\" selected=\"true\" /><select idref=\"V-204449\" selected=\"true\" /><select idref=\"V-204450\" selected=\"true\" /><select idref=\"V-204451\" selected=\"true\" /><select idref=\"V-204452\" selected=\"true\" /><select idref=\"V-204453\" selected=\"true\" /><select idref=\"V-204454\" selected=\"true\" /><select idref=\"V-204455\" selected=\"true\" /><select idref=\"V-204456\" selected=\"true\" /><select idref=\"V-204457\" selected=\"true\" /><select idref=\"V-204458\" selected=\"true\" /><select idref=\"V-204459\" selected=\"true\" /><select idref=\"V-204460\" selected=\"true\" /><select idref=\"V-204461\" selected=\"true\" /><select idref=\"V-204462\" selected=\"true\" /><select idref=\"V-204463\" selected=\"true\" /><select idref=\"V-204464\" selected=\"true\" /><select idref=\"V-204465\" selected=\"true\" /><select idref=\"V-204466\" selected=\"true\" /><select idref=\"V-204467\" selected=\"true\" /><select idref=\"V-204468\" selected=\"true\" /><select idref=\"V-204469\" selected=\"true\" /><select idref=\"V-204470\" selected=\"true\" /><select idref=\"V-204471\" selected=\"true\" /><select idref=\"V-204472\" selected=\"true\" /><select idref=\"V-204473\" selected=\"true\" /><select idref=\"V-204474\" selected=\"true\" /><select idref=\"V-204475\" selected=\"true\" /><select idref=\"V-204476\" selected=\"true\" /><select idref=\"V-204477\" selected=\"true\" /><select idref=\"V-204478\" selected=\"true\" /><select idref=\"V-204479\" selected=\"true\" /><select idref=\"V-204480\" selected=\"true\" /><select idref=\"V-204481\" selected=\"true\" /><select idref=\"V-204482\" selected=\"true\" /><select idref=\"V-204483\" selected=\"true\" /><select idref=\"V-204484\" selected=\"true\" /><select idref=\"V-204485\" selected=\"true\" /><select idref=\"V-204486\" selected=\"true\" /><select idref=\"V-204487\" selected=\"true\" /><select idref=\"V-204488\" selected=\"true\" /><select idref=\"V-204489\" selected=\"true\" /><select idref=\"V-204490\" selected=\"true\" /><select idref=\"V-204491\" selected=\"true\" /><select idref=\"V-204492\" selected=\"true\" /><select idref=\"V-204493\" selected=\"true\" /><select idref=\"V-204494\" selected=\"true\" /><select idref=\"V-204495\" selected=\"true\" /><select idref=\"V-204496\" selected=\"true\" /><select idref=\"V-204497\" selected=\"true\" /><select idref=\"V-204498\" selected=\"true\" /><select idref=\"V-204499\" selected=\"true\" /><select idref=\"V-204500\" selected=\"true\" /><select idref=\"V-204501\" selected=\"true\" /><select idref=\"V-204502\" selected=\"true\" /><select idref=\"V-204503\" selected=\"true\" /><select idref=\"V-204504\" selected=\"true\" /><select idref=\"V-204505\" selected=\"true\" /><select idref=\"V-204506\" selected=\"true\" /><select idref=\"V-204507\" selected=\"true\" /><select idref=\"V-204508\" selected=\"true\" /><select idref=\"V-204509\" selected=\"true\" /><select idref=\"V-204510\" selected=\"true\" /><select idref=\"V-204511\" selected=\"true\" /><select idref=\"V-204512\" selected=\"true\" /><select idref=\"V-204513\" selected=\"true\" /><select idref=\"V-204514\" selected=\"true\" /><select idref=\"V-204515\" selected=\"true\" /><select idref=\"V-204516\" selected=\"true\" /><select idref=\"V-204517\" selected=\"true\" /><select idref=\"V-204518\" selected=\"true\" /><select idref=\"V-204519\" selected=\"true\" /><select idref=\"V-204520\" selected=\"true\" /><select idref=\"V-204521\" selected=\"true\" /><select idref=\"V-204522\" selected=\"true\" /><select idref=\"V-204523\" selected=\"true\" /><select idref=\"V-204524\" selected=\"true\" /><select idref=\"V-204525\" selected=\"true\" /><select idref=\"V-204526\" selected=\"true\" /><select idref=\"V-204527\" selected=\"true\" /><select idref=\"V-204528\" selected=\"true\" /><select idref=\"V-204529\" selected=\"true\" /><select idref=\"V-204530\" selected=\"true\" /><select idref=\"V-204531\" selected=\"true\" /><select idref=\"V-204532\" selected=\"true\" /><select idref=\"V-204533\" selected=\"true\" /><select idref=\"V-204534\" selected=\"true\" /><select idref=\"V-204535\" selected=\"true\" /><select idref=\"V-204536\" selected=\"true\" /><select idref=\"V-204537\" selected=\"true\" /><select idref=\"V-204538\" selected=\"true\" /><select idref=\"V-204539\" selected=\"true\" /><select idref=\"V-204540\" selected=\"true\" /><select idref=\"V-204541\" selected=\"true\" /><select idref=\"V-204542\" selected=\"true\" /><select idref=\"V-204543\" selected=\"true\" /><select idref=\"V-204544\" selected=\"true\" /><select idref=\"V-204545\" selected=\"true\" /><select idref=\"V-204546\" selected=\"true\" /><select idref=\"V-204547\" selected=\"true\" /><select idref=\"V-204548\" selected=\"true\" /><select idref=\"V-204549\" selected=\"true\" /><select idref=\"V-204550\" selected=\"true\" /><select idref=\"V-204551\" selected=\"true\" /><select idref=\"V-204552\" selected=\"true\" /><select idref=\"V-204553\" selected=\"true\" /><select idref=\"V-204554\" selected=\"true\" /><select idref=\"V-204555\" selected=\"true\" /><select idref=\"V-204556\" selected=\"true\" /><select idref=\"V-204557\" selected=\"true\" /><select idref=\"V-204558\" selected=\"true\" /><select idref=\"V-204559\" selected=\"true\" /><select idref=\"V-204560\" selected=\"true\" /><select idref=\"V-204561\" selected=\"true\" /><select idref=\"V-204562\" selected=\"true\" /><select idref=\"V-204563\" selected=\"true\" /><select idref=\"V-204564\" selected=\"true\" /><select idref=\"V-204565\" selected=\"true\" /><select idref=\"V-204566\" selected=\"true\" /><select idref=\"V-204567\" selected=\"true\" /><select idref=\"V-204568\" selected=\"true\" /><select idref=\"V-204569\" selected=\"true\" /><select idref=\"V-204570\" selected=\"true\" /><select idref=\"V-204571\" selected=\"true\" /><select idref=\"V-204572\" selected=\"true\" /><select idref=\"V-204573\" selected=\"true\" /><select idref=\"V-204574\" selected=\"true\" /><select idref=\"V-204575\" selected=\"true\" /><select idref=\"V-204576\" selected=\"true\" /><select idref=\"V-204577\" selected=\"true\" /><select idref=\"V-204578\" selected=\"true\" /><select idref=\"V-204579\" selected=\"true\" /><select idref=\"V-204580\" selected=\"true\" /><select idref=\"V-204581\" selected=\"true\" /><select idref=\"V-204582\" selected=\"true\" /><select idref=\"V-204583\" selected=\"true\" /><select idref=\"V-204584\" selected=\"true\" /><select idref=\"V-204585\" selected=\"true\" /><select idref=\"V-204586\" selected=\"true\" /><select idref=\"V-204587\" selected=\"true\" /><select idref=\"V-204588\" selected=\"true\" /><select idref=\"V-204589\" selected=\"true\" /><select idref=\"V-204590\" selected=\"true\" /><select idref=\"V-204591\" selected=\"true\" /><select idref=\"V-204592\" selected=\"true\" /><select idref=\"V-204593\" selected=\"true\" /><select idref=\"V-204594\" selected=\"true\" /><select idref=\"V-204595\" selected=\"true\" /><select idref=\"V-204596\" selected=\"true\" /><select idref=\"V-204597\" selected=\"true\" /><select idref=\"V-204598\" selected=\"true\" /><select idref=\"V-204599\" selected=\"true\" /><select idref=\"V-204600\" selected=\"true\" /><select idref=\"V-204601\" selected=\"true\" /><select idref=\"V-204602\" selected=\"true\" /><select idref=\"V-204603\" selected=\"true\" /><select idref=\"V-204604\" selected=\"true\" /><select idref=\"V-204605\" selected=\"true\" /><select idref=\"V-204606\" selected=\"true\" /><select idref=\"V-204607\" selected=\"true\" /><select idref=\"V-204608\" selected=\"true\" /><select idref=\"V-204609\" selected=\"true\" /><select idref=\"V-204610\" selected=\"true\" /><select idref=\"V-204611\" selected=\"true\" /><select idref=\"V-204612\" selected=\"true\" /><select idref=\"V-204613\" selected=\"true\" /><select idref=\"V-204614\" selected=\"true\" /><select idref=\"V-204615\" selected=\"true\" /><select idref=\"V-204616\" selected=\"true\" /><select idref=\"V-204617\" selected=\"true\" /><select idref=\"V-204618\" selected=\"true\" /><select idref=\"V-204619\" selected=\"true\" /><select idref=\"V-204620\" selected=\"true\" /><select idref=\"V-204621\" selected=\"true\" /><select idref=\"V-204622\" selected=\"true\" /><select idref=\"V-204623\" selected=\"true\" /><select idref=\"V-204624\" selected=\"true\" /><select idref=\"V-204625\" selected=\"true\" /><select idref=\"V-204626\" selected=\"true\" /><select idref=\"V-204627\" selected=\"true\" /><select idref=\"V-204628\" selected=\"true\" /><select idref=\"V-204629\" selected=\"true\" /><select idref=\"V-204630\" selected=\"true\" /><select idref=\"V-204631\" selected=\"true\" /><select idref=\"V-204632\" selected=\"true\" /><select idref=\"V-204633\" selected=\"true\" /><select idref=\"V-204634\" selected=\"true\" /><select idref=\"V-214799\" selected=\"true\" /><select idref=\"V-214800\" selected=\"true\" /><select idref=\"V-214801\" selected=\"true\" /><select idref=\"V-214937\" selected=\"true\" /></Profile><Profile id=\"MAC-3_Public\"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-204392\" selected=\"true\" /><select idref=\"V-204393\" selected=\"true\" /><select idref=\"V-204394\" selected=\"true\" /><select idref=\"V-204395\" selected=\"true\" /><select idref=\"V-204396\" selected=\"true\" /><select idref=\"V-204397\" selected=\"true\" /><select idref=\"V-204398\" selected=\"true\" /><select idref=\"V-204399\" selected=\"true\" /><select idref=\"V-204400\" selected=\"true\" /><select idref=\"V-204401\" selected=\"true\" /><select idref=\"V-204402\" selected=\"true\" /><select idref=\"V-204403\" selected=\"true\" /><select idref=\"V-204404\" selected=\"true\" /><select idref=\"V-204405\" selected=\"true\" /><select idref=\"V-204406\" selected=\"true\" /><select idref=\"V-204407\" selected=\"true\" /><select idref=\"V-204408\" selected=\"true\" /><select idref=\"V-204409\" selected=\"true\" /><select idref=\"V-204410\" selected=\"true\" /><select idref=\"V-204411\" selected=\"true\" /><select idref=\"V-204412\" selected=\"true\" /><select idref=\"V-204413\" selected=\"true\" /><select idref=\"V-204414\" selected=\"true\" /><select idref=\"V-204415\" selected=\"true\" /><select idref=\"V-204416\" selected=\"true\" /><select idref=\"V-204417\" selected=\"true\" /><select idref=\"V-204418\" selected=\"true\" /><select idref=\"V-204419\" selected=\"true\" /><select idref=\"V-204420\" selected=\"true\" /><select idref=\"V-204421\" selected=\"true\" /><select idref=\"V-204422\" selected=\"true\" /><select idref=\"V-204423\" selected=\"true\" /><select idref=\"V-204424\" selected=\"true\" /><select idref=\"V-204425\" selected=\"true\" /><select idref=\"V-204426\" selected=\"true\" /><select idref=\"V-204427\" selected=\"true\" /><select idref=\"V-204428\" selected=\"true\" /><select idref=\"V-204429\" selected=\"true\" /><select idref=\"V-204430\" selected=\"true\" /><select idref=\"V-204431\" selected=\"true\" /><select idref=\"V-204432\" selected=\"true\" /><select idref=\"V-204433\" selected=\"true\" /><select idref=\"V-204434\" selected=\"true\" /><select idref=\"V-204435\" selected=\"true\" /><select idref=\"V-204436\" selected=\"true\" /><select idref=\"V-204437\" selected=\"true\" /><select idref=\"V-204438\" selected=\"true\" /><select idref=\"V-204439\" selected=\"true\" /><select idref=\"V-204440\" selected=\"true\" /><select idref=\"V-204441\" selected=\"true\" /><select idref=\"V-204442\" selected=\"true\" /><select idref=\"V-204443\" selected=\"true\" /><select idref=\"V-204444\" selected=\"true\" /><select idref=\"V-204445\" selected=\"true\" /><select idref=\"V-204446\" selected=\"true\" /><select idref=\"V-204447\" selected=\"true\" /><select idref=\"V-204448\" selected=\"true\" /><select idref=\"V-204449\" selected=\"true\" /><select idref=\"V-204450\" selected=\"true\" /><select idref=\"V-204451\" selected=\"true\" /><select idref=\"V-204452\" selected=\"true\" /><select idref=\"V-204453\" selected=\"true\" /><select idref=\"V-204454\" selected=\"true\" /><select idref=\"V-204455\" selected=\"true\" /><select idref=\"V-204456\" selected=\"true\" /><select idref=\"V-204457\" selected=\"true\" /><select idref=\"V-204458\" selected=\"true\" /><select idref=\"V-204459\" selected=\"true\" /><select idref=\"V-204460\" selected=\"true\" /><select idref=\"V-204461\" selected=\"true\" /><select idref=\"V-204462\" selected=\"true\" /><select idref=\"V-204463\" selected=\"true\" /><select idref=\"V-204464\" selected=\"true\" /><select idref=\"V-204465\" selected=\"true\" /><select idref=\"V-204466\" selected=\"true\" /><select idref=\"V-204467\" selected=\"true\" /><select idref=\"V-204468\" selected=\"true\" /><select idref=\"V-204469\" selected=\"true\" /><select idref=\"V-204470\" selected=\"true\" /><select idref=\"V-204471\" selected=\"true\" /><select idref=\"V-204472\" selected=\"true\" /><select idref=\"V-204473\" selected=\"true\" /><select idref=\"V-204474\" selected=\"true\" /><select idref=\"V-204475\" selected=\"true\" /><select idref=\"V-204476\" selected=\"true\" /><select idref=\"V-204477\" selected=\"true\" /><select idref=\"V-204478\" selected=\"true\" /><select idref=\"V-204479\" selected=\"true\" /><select idref=\"V-204480\" selected=\"true\" /><select idref=\"V-204481\" selected=\"true\" /><select idref=\"V-204482\" selected=\"true\" /><select idref=\"V-204483\" selected=\"true\" /><select idref=\"V-204484\" selected=\"true\" /><select idref=\"V-204485\" selected=\"true\" /><select idref=\"V-204486\" selected=\"true\" /><select idref=\"V-204487\" selected=\"true\" /><select idref=\"V-204488\" selected=\"true\" /><select idref=\"V-204489\" selected=\"true\" /><select idref=\"V-204490\" selected=\"true\" /><select idref=\"V-204491\" selected=\"true\" /><select idref=\"V-204492\" selected=\"true\" /><select idref=\"V-204493\" selected=\"true\" /><select idref=\"V-204494\" selected=\"true\" /><select idref=\"V-204495\" selected=\"true\" /><select idref=\"V-204496\" selected=\"true\" /><select idref=\"V-204497\" selected=\"true\" /><select idref=\"V-204498\" selected=\"true\" /><select idref=\"V-204499\" selected=\"true\" /><select idref=\"V-204500\" selected=\"true\" /><select idref=\"V-204501\" selected=\"true\" /><select idref=\"V-204502\" selected=\"true\" /><select idref=\"V-204503\" selected=\"true\" /><select idref=\"V-204504\" selected=\"true\" /><select idref=\"V-204505\" selected=\"true\" /><select idref=\"V-204506\" selected=\"true\" /><select idref=\"V-204507\" selected=\"true\" /><select idref=\"V-204508\" selected=\"true\" /><select idref=\"V-204509\" selected=\"true\" /><select idref=\"V-204510\" selected=\"true\" /><select idref=\"V-204511\" selected=\"true\" /><select idref=\"V-204512\" selected=\"true\" /><select idref=\"V-204513\" selected=\"true\" /><select idref=\"V-204514\" selected=\"true\" /><select idref=\"V-204515\" selected=\"true\" /><select idref=\"V-204516\" selected=\"true\" /><select idref=\"V-204517\" selected=\"true\" /><select idref=\"V-204518\" selected=\"true\" /><select idref=\"V-204519\" selected=\"true\" /><select idref=\"V-204520\" selected=\"true\" /><select idref=\"V-204521\" selected=\"true\" /><select idref=\"V-204522\" selected=\"true\" /><select idref=\"V-204523\" selected=\"true\" /><select idref=\"V-204524\" selected=\"true\" /><select idref=\"V-204525\" selected=\"true\" /><select idref=\"V-204526\" selected=\"true\" /><select idref=\"V-204527\" selected=\"true\" /><select idref=\"V-204528\" selected=\"true\" /><select idref=\"V-204529\" selected=\"true\" /><select idref=\"V-204530\" selected=\"true\" /><select idref=\"V-204531\" selected=\"true\" /><select idref=\"V-204532\" selected=\"true\" /><select idref=\"V-204533\" selected=\"true\" /><select idref=\"V-204534\" selected=\"true\" /><select idref=\"V-204535\" selected=\"true\" /><select idref=\"V-204536\" selected=\"true\" /><select idref=\"V-204537\" selected=\"true\" /><select idref=\"V-204538\" selected=\"true\" /><select idref=\"V-204539\" selected=\"true\" /><select idref=\"V-204540\" selected=\"true\" /><select idref=\"V-204541\" selected=\"true\" /><select idref=\"V-204542\" selected=\"true\" /><select idref=\"V-204543\" selected=\"true\" /><select idref=\"V-204544\" selected=\"true\" /><select idref=\"V-204545\" selected=\"true\" /><select idref=\"V-204546\" selected=\"true\" /><select idref=\"V-204547\" selected=\"true\" /><select idref=\"V-204548\" selected=\"true\" /><select idref=\"V-204549\" selected=\"true\" /><select idref=\"V-204550\" selected=\"true\" /><select idref=\"V-204551\" selected=\"true\" /><select idref=\"V-204552\" selected=\"true\" /><select idref=\"V-204553\" selected=\"true\" /><select idref=\"V-204554\" selected=\"true\" /><select idref=\"V-204555\" selected=\"true\" /><select idref=\"V-204556\" selected=\"true\" /><select idref=\"V-204557\" selected=\"true\" /><select idref=\"V-204558\" selected=\"true\" /><select idref=\"V-204559\" selected=\"true\" /><select idref=\"V-204560\" selected=\"true\" /><select idref=\"V-204561\" selected=\"true\" /><select idref=\"V-204562\" selected=\"true\" /><select idref=\"V-204563\" selected=\"true\" /><select idref=\"V-204564\" selected=\"true\" /><select idref=\"V-204565\" selected=\"true\" /><select idref=\"V-204566\" selected=\"true\" /><select idref=\"V-204567\" selected=\"true\" /><select idref=\"V-204568\" selected=\"true\" /><select idref=\"V-204569\" selected=\"true\" /><select idref=\"V-204570\" selected=\"true\" /><select idref=\"V-204571\" selected=\"true\" /><select idref=\"V-204572\" selected=\"true\" /><select idref=\"V-204573\" selected=\"true\" /><select idref=\"V-204574\" selected=\"true\" /><select idref=\"V-204575\" selected=\"true\" /><select idref=\"V-204576\" selected=\"true\" /><select idref=\"V-204577\" selected=\"true\" /><select idref=\"V-204578\" selected=\"true\" /><select idref=\"V-204579\" selected=\"true\" /><select idref=\"V-204580\" selected=\"true\" /><select idref=\"V-204581\" selected=\"true\" /><select idref=\"V-204582\" selected=\"true\" /><select idref=\"V-204583\" selected=\"true\" /><select idref=\"V-204584\" selected=\"true\" /><select idref=\"V-204585\" selected=\"true\" /><select idref=\"V-204586\" selected=\"true\" /><select idref=\"V-204587\" selected=\"true\" /><select idref=\"V-204588\" selected=\"true\" /><select idref=\"V-204589\" selected=\"true\" /><select idref=\"V-204590\" selected=\"true\" /><select idref=\"V-204591\" selected=\"true\" /><select idref=\"V-204592\" selected=\"true\" /><select idref=\"V-204593\" selected=\"true\" /><select idref=\"V-204594\" selected=\"true\" /><select idref=\"V-204595\" selected=\"true\" /><select idref=\"V-204596\" selected=\"true\" /><select idref=\"V-204597\" selected=\"true\" /><select idref=\"V-204598\" selected=\"true\" /><select idref=\"V-204599\" selected=\"true\" /><select idref=\"V-204600\" selected=\"true\" /><select idref=\"V-204601\" selected=\"true\" /><select idref=\"V-204602\" selected=\"true\" /><select idref=\"V-204603\" selected=\"true\" /><select idref=\"V-204604\" selected=\"true\" /><select idref=\"V-204605\" selected=\"true\" /><select idref=\"V-204606\" selected=\"true\" /><select idref=\"V-204607\" selected=\"true\" /><select idref=\"V-204608\" selected=\"true\" /><select idref=\"V-204609\" selected=\"true\" /><select idref=\"V-204610\" selected=\"true\" /><select idref=\"V-204611\" selected=\"true\" /><select idref=\"V-204612\" selected=\"true\" /><select idref=\"V-204613\" selected=\"true\" /><select idref=\"V-204614\" selected=\"true\" /><select idref=\"V-204615\" selected=\"true\" /><select idref=\"V-204616\" selected=\"true\" /><select idref=\"V-204617\" selected=\"true\" /><select idref=\"V-204618\" selected=\"true\" /><select idref=\"V-204619\" selected=\"true\" /><select idref=\"V-204620\" selected=\"true\" /><select idref=\"V-204621\" selected=\"true\" /><select idref=\"V-204622\" selected=\"true\" /><select idref=\"V-204623\" selected=\"true\" /><select idref=\"V-204624\" selected=\"true\" /><select idref=\"V-204625\" selected=\"true\" /><select idref=\"V-204626\" selected=\"true\" /><select idref=\"V-204627\" selected=\"true\" /><select idref=\"V-204628\" selected=\"true\" /><select idref=\"V-204629\" selected=\"true\" /><select idref=\"V-204630\" selected=\"true\" /><select idref=\"V-204631\" selected=\"true\" /><select idref=\"V-204632\" selected=\"true\" /><select idref=\"V-204633\" selected=\"true\" /><select idref=\"V-204634\" selected=\"true\" /><select idref=\"V-214799\" selected=\"true\" /><select idref=\"V-214800\" selected=\"true\" /><select idref=\"V-214801\" selected=\"true\" /><select idref=\"V-214937\" selected=\"true\" /></Profile><Profile id=\"MAC-3_Sensitive\"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-204392\" selected=\"true\" /><select idref=\"V-204393\" selected=\"true\" /><select idref=\"V-204394\" selected=\"true\" /><select idref=\"V-204395\" selected=\"true\" /><select idref=\"V-204396\" selected=\"true\" /><select idref=\"V-204397\" selected=\"true\" /><select idref=\"V-204398\" selected=\"true\" /><select idref=\"V-204399\" selected=\"true\" /><select idref=\"V-204400\" selected=\"true\" /><select idref=\"V-204401\" selected=\"true\" /><select idref=\"V-204402\" selected=\"true\" /><select idref=\"V-204403\" selected=\"true\" /><select idref=\"V-204404\" selected=\"true\" /><select idref=\"V-204405\" selected=\"true\" /><select idref=\"V-204406\" selected=\"true\" /><select idref=\"V-204407\" selected=\"true\" /><select idref=\"V-204408\" selected=\"true\" /><select idref=\"V-204409\" selected=\"true\" /><select idref=\"V-204410\" selected=\"true\" /><select idref=\"V-204411\" selected=\"true\" /><select idref=\"V-204412\" selected=\"true\" /><select idref=\"V-204413\" selected=\"true\" /><select idref=\"V-204414\" selected=\"true\" /><select idref=\"V-204415\" selected=\"true\" /><select idref=\"V-204416\" selected=\"true\" /><select idref=\"V-204417\" selected=\"true\" /><select idref=\"V-204418\" selected=\"true\" /><select idref=\"V-204419\" selected=\"true\" /><select idref=\"V-204420\" selected=\"true\" /><select idref=\"V-204421\" selected=\"true\" /><select idref=\"V-204422\" selected=\"true\" /><select idref=\"V-204423\" selected=\"true\" /><select idref=\"V-204424\" selected=\"true\" /><select idref=\"V-204425\" selected=\"true\" /><select idref=\"V-204426\" selected=\"true\" /><select idref=\"V-204427\" selected=\"true\" /><select idref=\"V-204428\" selected=\"true\" /><select idref=\"V-204429\" selected=\"true\" /><select idref=\"V-204430\" selected=\"true\" /><select idref=\"V-204431\" selected=\"true\" /><select idref=\"V-204432\" selected=\"true\" /><select idref=\"V-204433\" selected=\"true\" /><select idref=\"V-204434\" selected=\"true\" /><select idref=\"V-204435\" selected=\"true\" /><select idref=\"V-204436\" selected=\"true\" /><select idref=\"V-204437\" selected=\"true\" /><select idref=\"V-204438\" selected=\"true\" /><select idref=\"V-204439\" selected=\"true\" /><select idref=\"V-204440\" selected=\"true\" /><select idref=\"V-204441\" selected=\"true\" /><select idref=\"V-204442\" selected=\"true\" /><select idref=\"V-204443\" selected=\"true\" /><select idref=\"V-204444\" selected=\"true\" /><select idref=\"V-204445\" selected=\"true\" /><select idref=\"V-204446\" selected=\"true\" /><select idref=\"V-204447\" selected=\"true\" /><select idref=\"V-204448\" selected=\"true\" /><select idref=\"V-204449\" selected=\"true\" /><select idref=\"V-204450\" selected=\"true\" /><select idref=\"V-204451\" selected=\"true\" /><select idref=\"V-204452\" selected=\"true\" /><select idref=\"V-204453\" selected=\"true\" /><select idref=\"V-204454\" selected=\"true\" /><select idref=\"V-204455\" selected=\"true\" /><select idref=\"V-204456\" selected=\"true\" /><select idref=\"V-204457\" selected=\"true\" /><select idref=\"V-204458\" selected=\"true\" /><select idref=\"V-204459\" selected=\"true\" /><select idref=\"V-204460\" selected=\"true\" /><select idref=\"V-204461\" selected=\"true\" /><select idref=\"V-204462\" selected=\"true\" /><select idref=\"V-204463\" selected=\"true\" /><select idref=\"V-204464\" selected=\"true\" /><select idref=\"V-204465\" selected=\"true\" /><select idref=\"V-204466\" selected=\"true\" /><select idref=\"V-204467\" selected=\"true\" /><select idref=\"V-204468\" selected=\"true\" /><select idref=\"V-204469\" selected=\"true\" /><select idref=\"V-204470\" selected=\"true\" /><select idref=\"V-204471\" selected=\"true\" /><select idref=\"V-204472\" selected=\"true\" /><select idref=\"V-204473\" selected=\"true\" /><select idref=\"V-204474\" selected=\"true\" /><select idref=\"V-204475\" selected=\"true\" /><select idref=\"V-204476\" selected=\"true\" /><select idref=\"V-204477\" selected=\"true\" /><select idref=\"V-204478\" selected=\"true\" /><select idref=\"V-204479\" selected=\"true\" /><select idref=\"V-204480\" selected=\"true\" /><select idref=\"V-204481\" selected=\"true\" /><select idref=\"V-204482\" selected=\"true\" /><select idref=\"V-204483\" selected=\"true\" /><select idref=\"V-204484\" selected=\"true\" /><select idref=\"V-204485\" selected=\"true\" /><select idref=\"V-204486\" selected=\"true\" /><select idref=\"V-204487\" selected=\"true\" /><select idref=\"V-204488\" selected=\"true\" /><select idref=\"V-204489\" selected=\"true\" /><select idref=\"V-204490\" selected=\"true\" /><select idref=\"V-204491\" selected=\"true\" /><select idref=\"V-204492\" selected=\"true\" /><select idref=\"V-204493\" selected=\"true\" /><select idref=\"V-204494\" selected=\"true\" /><select idref=\"V-204495\" selected=\"true\" /><select idref=\"V-204496\" selected=\"true\" /><select idref=\"V-204497\" selected=\"true\" /><select idref=\"V-204498\" selected=\"true\" /><select idref=\"V-204499\" selected=\"true\" /><select idref=\"V-204500\" selected=\"true\" /><select idref=\"V-204501\" selected=\"true\" /><select idref=\"V-204502\" selected=\"true\" /><select idref=\"V-204503\" selected=\"true\" /><select idref=\"V-204504\" selected=\"true\" /><select idref=\"V-204505\" selected=\"true\" /><select idref=\"V-204506\" selected=\"true\" /><select idref=\"V-204507\" selected=\"true\" /><select idref=\"V-204508\" selected=\"true\" /><select idref=\"V-204509\" selected=\"true\" /><select idref=\"V-204510\" selected=\"true\" /><select idref=\"V-204511\" selected=\"true\" /><select idref=\"V-204512\" selected=\"true\" /><select idref=\"V-204513\" selected=\"true\" /><select idref=\"V-204514\" selected=\"true\" /><select idref=\"V-204515\" selected=\"true\" /><select idref=\"V-204516\" selected=\"true\" /><select idref=\"V-204517\" selected=\"true\" /><select idref=\"V-204518\" selected=\"true\" /><select idref=\"V-204519\" selected=\"true\" /><select idref=\"V-204520\" selected=\"true\" /><select idref=\"V-204521\" selected=\"true\" /><select idref=\"V-204522\" selected=\"true\" /><select idref=\"V-204523\" selected=\"true\" /><select idref=\"V-204524\" selected=\"true\" /><select idref=\"V-204525\" selected=\"true\" /><select idref=\"V-204526\" selected=\"true\" /><select idref=\"V-204527\" selected=\"true\" /><select idref=\"V-204528\" selected=\"true\" /><select idref=\"V-204529\" selected=\"true\" /><select idref=\"V-204530\" selected=\"true\" /><select idref=\"V-204531\" selected=\"true\" /><select idref=\"V-204532\" selected=\"true\" /><select idref=\"V-204533\" selected=\"true\" /><select idref=\"V-204534\" selected=\"true\" /><select idref=\"V-204535\" selected=\"true\" /><select idref=\"V-204536\" selected=\"true\" /><select idref=\"V-204537\" selected=\"true\" /><select idref=\"V-204538\" selected=\"true\" /><select idref=\"V-204539\" selected=\"true\" /><select idref=\"V-204540\" selected=\"true\" /><select idref=\"V-204541\" selected=\"true\" /><select idref=\"V-204542\" selected=\"true\" /><select idref=\"V-204543\" selected=\"true\" /><select idref=\"V-204544\" selected=\"true\" /><select idref=\"V-204545\" selected=\"true\" /><select idref=\"V-204546\" selected=\"true\" /><select idref=\"V-204547\" selected=\"true\" /><select idref=\"V-204548\" selected=\"true\" /><select idref=\"V-204549\" selected=\"true\" /><select idref=\"V-204550\" selected=\"true\" /><select idref=\"V-204551\" selected=\"true\" /><select idref=\"V-204552\" selected=\"true\" /><select idref=\"V-204553\" selected=\"true\" /><select idref=\"V-204554\" selected=\"true\" /><select idref=\"V-204555\" selected=\"true\" /><select idref=\"V-204556\" selected=\"true\" /><select idref=\"V-204557\" selected=\"true\" /><select idref=\"V-204558\" selected=\"true\" /><select idref=\"V-204559\" selected=\"true\" /><select idref=\"V-204560\" selected=\"true\" /><select idref=\"V-204561\" selected=\"true\" /><select idref=\"V-204562\" selected=\"true\" /><select idref=\"V-204563\" selected=\"true\" /><select idref=\"V-204564\" selected=\"true\" /><select idref=\"V-204565\" selected=\"true\" /><select idref=\"V-204566\" selected=\"true\" /><select idref=\"V-204567\" selected=\"true\" /><select idref=\"V-204568\" selected=\"true\" /><select idref=\"V-204569\" selected=\"true\" /><select idref=\"V-204570\" selected=\"true\" /><select idref=\"V-204571\" selected=\"true\" /><select idref=\"V-204572\" selected=\"true\" /><select idref=\"V-204573\" selected=\"true\" /><select idref=\"V-204574\" selected=\"true\" /><select idref=\"V-204575\" selected=\"true\" /><select idref=\"V-204576\" selected=\"true\" /><select idref=\"V-204577\" selected=\"true\" /><select idref=\"V-204578\" selected=\"true\" /><select idref=\"V-204579\" selected=\"true\" /><select idref=\"V-204580\" selected=\"true\" /><select idref=\"V-204581\" selected=\"true\" /><select idref=\"V-204582\" selected=\"true\" /><select idref=\"V-204583\" selected=\"true\" /><select idref=\"V-204584\" selected=\"true\" /><select idref=\"V-204585\" selected=\"true\" /><select idref=\"V-204586\" selected=\"true\" /><select idref=\"V-204587\" selected=\"true\" /><select idref=\"V-204588\" selected=\"true\" /><select idref=\"V-204589\" selected=\"true\" /><select idref=\"V-204590\" selected=\"true\" /><select idref=\"V-204591\" selected=\"true\" /><select idref=\"V-204592\" selected=\"true\" /><select idref=\"V-204593\" selected=\"true\" /><select idref=\"V-204594\" selected=\"true\" /><select idref=\"V-204595\" selected=\"true\" /><select idref=\"V-204596\" selected=\"true\" /><select idref=\"V-204597\" selected=\"true\" /><select idref=\"V-204598\" selected=\"true\" /><select idref=\"V-204599\" selected=\"true\" /><select idref=\"V-204600\" selected=\"true\" /><select idref=\"V-204601\" selected=\"true\" /><select idref=\"V-204602\" selected=\"true\" /><select idref=\"V-204603\" selected=\"true\" /><select idref=\"V-204604\" selected=\"true\" /><select idref=\"V-204605\" selected=\"true\" /><select idref=\"V-204606\" selected=\"true\" /><select idref=\"V-204607\" selected=\"true\" /><select idref=\"V-204608\" selected=\"true\" /><select idref=\"V-204609\" selected=\"true\" /><select idref=\"V-204610\" selected=\"true\" /><select idref=\"V-204611\" selected=\"true\" /><select idref=\"V-204612\" selected=\"true\" /><select idref=\"V-204613\" selected=\"true\" /><select idref=\"V-204614\" selected=\"true\" /><select idref=\"V-204615\" selected=\"true\" /><select idref=\"V-204616\" selected=\"true\" /><select idref=\"V-204617\" selected=\"true\" /><select idref=\"V-204618\" selected=\"true\" /><select idref=\"V-204619\" selected=\"true\" /><select idref=\"V-204620\" selected=\"true\" /><select idref=\"V-204621\" selected=\"true\" /><select idref=\"V-204622\" selected=\"true\" /><select idref=\"V-204623\" selected=\"true\" /><select idref=\"V-204624\" selected=\"true\" /><select idref=\"V-204625\" selected=\"true\" /><select idref=\"V-204626\" selected=\"true\" /><select idref=\"V-204627\" selected=\"true\" /><select idref=\"V-204628\" selected=\"true\" /><select idref=\"V-204629\" selected=\"true\" /><select idref=\"V-204630\" selected=\"true\" /><select idref=\"V-204631\" selected=\"true\" /><select idref=\"V-204632\" selected=\"true\" /><select idref=\"V-204633\" selected=\"true\" /><select idref=\"V-204634\" selected=\"true\" /><select idref=\"V-214799\" selected=\"true\" /><select idref=\"V-214800\" selected=\"true\" /><select idref=\"V-214801\" selected=\"true\" /><select idref=\"V-214937\" selected=\"true\" /></Profile><Group id=\"V-204392\"><title>SRG-OS-000257-GPOS-00098</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204392r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-010010</version><title>The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values.</title><description>&lt;VulnDiscussion&gt;Discretionary access control is weakened if a user or group has access permissions to system files and directories greater than the default.\n\nSatisfies: SRG-OS-000257-GPOS-00098, SRG-OS-000278-GPOS-00108&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71849</ident><ident system=\"http://cyber.mil/legacy\">SV-86473</ident><ident system=\"http://cyber.mil/cci\">CCI-001494</ident><ident system=\"http://cyber.mil/cci\">CCI-001496</ident><ident system=\"http://cyber.mil/cci\">CCI-002165</ident><ident system=\"http://cyber.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-4516r88369_fix\">Run the following command to determine which package owns the file:\n\n# rpm -qf &lt;filename&gt;\n\nReset the user and group ownership of files within a package with the following command:\n\n#rpm --setugids &lt;packagename&gt;\n\n\nReset the permissions of files within a package with the following command:\n\n#rpm --setperms &lt;packagename&gt;</fixtext><fix id=\"F-4516r88369_fix\" /><check system=\"C-4516r88368_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the file permissions, ownership, and group membership of system files and commands match the vendor values.\n\nCheck the default file permissions, ownership, and group membership of system files and commands with the following command:\n\n# for i in `rpm -Va | egrep -i '^\\.[M|U|G|.]{8}' | cut -d \" \" -f4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump | cut -d \" \" -f1,5,6,7 | grep $i;done;done\n\n/var/log/gdm 040755 root root\n/etc/audisp/audisp-remote.conf 0100640 root root\n/usr/bin/passwd 0104755 root root\n\nFor each file returned, verify the current permissions, ownership, and group membership:\n# ls -la &lt;filename&gt;\n\n-rw-------. 1 root root 133 Jan 11 13:25 /etc/audisp/audisp-remote.conf\n\nIf the file is more permissive than the default permissions, this is a finding.\n\nIf the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding.\n\nIf the file is not a member of the default group and is not documented with the Information System Security Officer (ISSO), this is a finding.</check-content></check></Rule></Group><Group id=\"V-204393\"><title>SRG-OS-000023-GPOS-00006</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204393r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010030</version><title>The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.</title><description>&lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\n\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\n\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\n\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71859</ident><ident system=\"http://cyber.mil/legacy\">SV-86483</ident><ident system=\"http://cyber.mil/cci\">CCI-000048</ident><fixtext fixref=\"F-4517r88372_fix\">Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nCreate a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command:\n\n# touch /etc/dconf/db/local.d/01-banner-message\n\nAdd the following line to the [org/gnome/login-screen] section of the \"/etc/dconf/db/local.d/01-banner-message\":\n\n[org/gnome/login-screen]\nbanner-message-enable=true\n\nUpdate the system databases:\n\n# dconf update\n\nUsers must log out and back in again before the system-wide settings take effect.</fixtext><fix id=\"F-4517r88372_fix\" /><check system=\"C-4517r88371_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a graphical user logon.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \n\nCheck to see if the operating system displays a banner at the logon screen with the following command:\n\n# grep banner-message-enable /etc/dconf/db/local.d/*\nbanner-message-enable=true\n\nIf \"banner-message-enable\" is set to \"false\" or is missing, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204394\"><title>SRG-OS-000023-GPOS-00006</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204394r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010040</version><title>The Red Hat Enterprise Linux operating system must display the approved Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.</title><description>&lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\n\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\n\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71861</ident><ident system=\"http://cyber.mil/legacy\">SV-86485</ident><ident system=\"http://cyber.mil/cci\">CCI-000048</ident><fixtext fixref=\"F-4518r88375_fix\">Configure the operating system to display the approved Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nCreate a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command:\n\n# touch /etc/dconf/db/local.d/01-banner-message\n\nAdd the following line to the [org/gnome/login-screen] section of the \"/etc/dconf/db/local.d/01-banner-message\":\n\n[org/gnome/login-screen]\n\nbanner-message-enable=true\n\nbanner-message-text='You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n-At any time, the USG may inspect and seize data stored on this IS.\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. '\n\nNote: The \"\\n \" characters are for formatting only. They will not be displayed on the GUI.\n\nRun the following command to update the database:\n# dconf update</fixtext><fix id=\"F-4518r88375_fix\" /><check system=\"C-4518r88374_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system displays the approved Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a graphical user logon.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \n\nCheck that the operating system displays the exact approved Standard Mandatory DoD Notice and Consent Banner text with the command:\n\n# grep banner-message-text /etc/dconf/db/local.d/*\nbanner-message-text=\n'You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n-At any time, the USG may inspect and seize data stored on this IS.\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. '\n\nNote: The \"\\n \" characters are for formatting only. They will not be displayed on the GUI.\n\nIf the banner does not match the approved Standard Mandatory DoD Notice and Consent Banner, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204395\"><title>SRG-OS-000023-GPOS-00006</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204395r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010050</version><title>The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.</title><description>&lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\n\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\n\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71863</ident><ident system=\"http://cyber.mil/legacy\">SV-86487</ident><ident system=\"http://cyber.mil/cci\">CCI-000048</ident><fixtext fixref=\"F-4519r88378_fix\">Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via the command line by editing the \"/etc/issue\" file.\n\nReplace the default text with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is:\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are private and confidential.  See User Agreement for details.\"</fixtext><fix id=\"F-4519r88378_fix\" /><check system=\"C-4519r88377_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a command line user logon.\n\nCheck to see if the operating system displays a banner at the command line logon screen with the following command:\n\n# more /etc/issue\n\nThe command should return the following text:\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\nIf the operating system does not display a graphical logon banner or the banner does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.\n\nIf the text in the \"/etc/issue\" file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204396\"><title>SRG-OS-000028-GPOS-00009</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204396r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010060</version><title>The Red Hat Enterprise Linux operating system must enable a user session lock until that user re-establishes access using established identification and authentication procedures.</title><description>&lt;VulnDiscussion&gt;A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.\n\nThe session lock is implemented at the point where session activity can be determined.\n\nRegardless of where the session lock is determined and implemented, once invoked, the session lock must remain in place until the user reauthenticates. No other activity aside from reauthentication must unlock the system.\n\nSatisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71891</ident><ident system=\"http://cyber.mil/legacy\">SV-86515</ident><ident system=\"http://cyber.mil/cci\">CCI-000056</ident><fixtext fixref=\"F-4520r88381_fix\">Configure the operating system to enable a user's session lock until that user re-establishes access using established identification and authentication procedures.\n\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following example:\n\n# touch /etc/dconf/db/local.d/00-screensaver\n\nEdit the \"[org/gnome/desktop/screensaver]\" section of the database file and add or update the following lines:\n\n# Set this to true to lock the screen when the screensaver activates\nlock-enabled=true\n\nUpdate the system databases:\n\n# dconf update\n\nUsers must log out and back in again before the system-wide settings take effect. </fixtext><fix id=\"F-4520r88381_fix\" /><check system=\"C-4520r88380_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system enables a user's session lock until that user re-establishes access using established identification and authentication procedures. The screen program must be installed to lock sessions on the console.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nCheck to see if the screen lock is enabled with the following command:\n\n# grep -i lock-enabled /etc/dconf/db/local.d/*\nlock-enabled=true\n\nIf the \"lock-enabled\" setting is missing or is not set to \"true\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204397\"><title>SRG-OS-000375-GPOS-00160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204397r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010061</version><title>The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate users using multifactor authentication via a graphical user logon.</title><description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\n\nSatisfies: SRG-OS-000375-GPOS-00161,SRG-OS-000375-GPOS-00162&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-77819</ident><ident system=\"http://cyber.mil/legacy\">SV-92515</ident><ident system=\"http://cyber.mil/cci\">CCI-001948</ident><ident system=\"http://cyber.mil/cci\">CCI-001953</ident><ident system=\"http://cyber.mil/cci\">CCI-001954</ident><fixtext fixref=\"F-4521r88384_fix\">Configure the operating system to uniquely identify and authenticate users using multifactor authentication via a graphical user logon.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \n\nNote: The example is using the database local for the system, so if the system is using another database in \"/etc/dconf/profile/user\", the file should be created under the appropriate subdirectory.\n\n# touch /etc/dconf/db/local.d/00-defaults\n\nEdit \"[org/gnome/login-screen]\" and add or update the following line:\nenable-smartcard-authentication=true   \n\nUpdate the system databases:\n# dconf update</fixtext><fix id=\"F-4521r88384_fix\" /><check system=\"C-4521r88383_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system uniquely identifies and authenticates users using multifactor authentication via a graphical user logon.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \n\nDetermine which profile the system database is using with the following command:\n\n# grep system-db /etc/dconf/profile/user\n\nsystem-db:local\n\nNote: The example is using the database local for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than local is being used.\n\n# grep enable-smartcard-authentication /etc/dconf/db/local.d/*\n\nenable-smartcard-authentication=true\n\nIf \"enable-smartcard-authentication\" is set to \"false\" or the keyword is missing, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204398\"><title>SRG-OS-000029-GPOS-00010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204398r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010070</version><title>The Red Hat Enterprise Linux operating system must initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces.</title><description>&lt;VulnDiscussion&gt;A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\n\nThe session lock is implemented at the point where session activity can be determined and/or controlled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86517</ident><ident system=\"http://cyber.mil/legacy\">V-71893</ident><ident system=\"http://cyber.mil/cci\">CCI-000057</ident><fixtext fixref=\"F-4522r88387_fix\">Configure the operating system to initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces.\n\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command:\n\n# touch /etc/dconf/db/local.d/00-screensaver\n\nEdit /etc/dconf/db/local.d/00-screensaver and add or update the following lines:\n\n[org/gnome/desktop/session]\n# Set the lock time out to 900 seconds before the session is considered idle\nidle-delay=uint32 900\n\nYou must include the \"uint32\" along with the integer key values as shown.\n\nUpdate the system databases:\n\n# dconf update\n\nUsers must log out and back in again before the system-wide settings take effect.</fixtext><fix id=\"F-4522r88387_fix\" /><check system=\"C-4522r88386_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system initiates a screensaver after a 15-minute period of inactivity for graphical user interfaces. The screen program must be installed to lock sessions on the console.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nCheck to see if GNOME is configured to display a screensaver after a 15 minute delay with the following command:\n\n# grep -i idle-delay /etc/dconf/db/local.d/*\nidle-delay=uint32 900\n\nIf the \"idle-delay\" setting is missing or is not set to \"900\" or less, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204399\"><title>SRG-OS-000029-GPOS-00010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204399r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010081</version><title>The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver lock-delay setting for the graphical user interface.</title><description>&lt;VulnDiscussion&gt;A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\n\nThe session lock is implemented at the point where session activity can be determined and/or controlled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-87807</ident><ident system=\"http://cyber.mil/legacy\">V-73155</ident><ident system=\"http://cyber.mil/cci\">CCI-000057</ident><fixtext fixref=\"F-4523r88390_fix\">Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces.\n\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \n\nNote: The example below is using the database \"local\" for the system, so if the system is using another database in \"/etc/dconf/profile/user\", the file should be created under the appropriate subdirectory.\n\n# touch /etc/dconf/db/local.d/locks/session\n\nAdd the setting to lock the screensaver lock delay:\n\n/org/gnome/desktop/screensaver/lock-delay</fixtext><fix id=\"F-4523r88390_fix\" /><check system=\"C-4523r88389_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system prevents a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\n\nDetermine which profile the system database is using with the following command:\n# grep system-db /etc/dconf/profile/user\n\nsystem-db:local\n\nCheck for the lock delay setting with the following command:\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\n# grep -i lock-delay /etc/dconf/db/local.d/locks/*\n\n/org/gnome/desktop/screensaver/lock-delay\n\nIf the command does not return a result, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204400\"><title>SRG-OS-000029-GPOS-00010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204400r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010082</version><title>The Red Hat Enterprise Linux operating system must prevent a user from overriding the session idle-delay setting for the graphical user interface.</title><description>&lt;VulnDiscussion&gt;A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\n\nThe session lock is implemented at the point where session activity can be determined and/or controlled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-87809</ident><ident system=\"http://cyber.mil/legacy\">V-73157</ident><ident system=\"http://cyber.mil/cci\">CCI-000057</ident><fixtext fixref=\"F-4524r88393_fix\">Configure the operating system to prevent a user from overriding a session lock after a 15-minute period of inactivity for graphical user interfaces.\n\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \n\nNote: The example below is using the database \"local\" for the system, so if the system is using another database in /etc/dconf/profile/user, the file should be created under the appropriate subdirectory.\n\n# touch /etc/dconf/db/local.d/locks/session\n\nAdd the setting to lock the session idle delay:\n\n/org/gnome/desktop/session/idle-delay</fixtext><fix id=\"F-4524r88393_fix\" /><check system=\"C-4524r88392_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system prevents a user from overriding session idle delay after a 15-minute period of inactivity for graphical user interfaces. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console. \n\nDetermine which profile the system database is using with the following command:\n# grep system-db /etc/dconf/profile/user\n\nsystem-db:local\n\nCheck for the session idle delay setting with the following command:\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\n# grep -i idle-delay /etc/dconf/db/local.d/locks/*\n\n/org/gnome/desktop/session/idle-delay\n\nIf the command does not return a result, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204401\"><title>SRG-OS-000029-GPOS-00010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204401r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010090</version><title>The Red Hat Enterprise Linux operating system must have the screen package installed.</title><description>&lt;VulnDiscussion&gt;:  A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\n\nThe screen and tmux packages allow for a session lock to be implemented and configured.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86521</ident><ident system=\"http://cyber.mil/legacy\">V-71897</ident><ident system=\"http://cyber.mil/cci\">CCI-000057</ident><fixtext fixref=\"F-4525r88396_fix\">Install the screen package to allow the initiation of a session lock after a 15-minute period of inactivity.\n\nInstall the screen program (if it is not on the system) with the following command:\n\n# yum install screen   \n\nOR\n\nInstall the tmux program (if it is not on the system) with the following command:\n\n#yum install tmux</fixtext><fix id=\"F-4525r88396_fix\" /><check system=\"C-4525r88395_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system has the screen package installed.\n\nCheck to see if the screen package is installed with the following command:\n\n# yum list installed screen\nscreen-4.3.1-3-x86_64.rpm\n\nIf the screen package is not installed, check to see if the tmux package is installed with the following command:\n\n#yum list installed tmux\ntmux-1.8-4.el7.x86_64.rpm \n\nIf either the screen package or the tmux package is not installed, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204402\"><title>SRG-OS-000029-GPOS-00010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204402r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010100</version><title>The Red Hat Enterprise Linux operating system must initiate a session lock for the screensaver after a period of inactivity for graphical user interfaces.</title><description>&lt;VulnDiscussion&gt;A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\n\nThe session lock is implemented at the point where session activity can be determined and/or controlled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86523</ident><ident system=\"http://cyber.mil/legacy\">V-71899</ident><ident system=\"http://cyber.mil/cci\">CCI-000057</ident><fixtext fixref=\"F-4526r88399_fix\">Configure the operating system to initiate a session lock after a 15-minute period of inactivity for graphical user interfaces.\n\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \n\n# touch /etc/dconf/db/local.d/00-screensaver\n\nAdd the setting to enable screensaver locking after 15 minutes of inactivity:\n\n[org/gnome/desktop/screensaver]\n\nidle-activation-enabled=true\n\nUpdate the system databases:\n\n# dconf update\n\nUsers must log out and back in again before the system-wide settings take effect.</fixtext><fix id=\"F-4526r88399_fix\" /><check system=\"C-4526r88398_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system initiates a session lock after a 15-minute period of inactivity for graphical user interfaces. The screen program must be installed to lock sessions on the console.\n\nNote: If the system does not have a Graphical User Interface installed, this requirement is Not Applicable.\n\nCheck for the session lock settings with the following commands:\n\n# grep -i idle-activation-enabled /etc/dconf/db/local.d/*\n\nidle-activation-enabled=true\n\nIf \"idle-activation-enabled\" is not set to \"true\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204403\"><title>SRG-OS-000029-GPOS-00010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204403r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010101</version><title>The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface.</title><description>&lt;VulnDiscussion&gt;A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.\n\nThe session lock is implemented at the point where session activity can be determined.\n\nThe ability to enable/disable a session lock is given to the user by default. Disabling the user's ability to disengage the graphical user interface session lock provides the assurance that all sessions will lock after the specified period of time.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-93703</ident><ident system=\"http://cyber.mil/legacy\">V-78997</ident><ident system=\"http://cyber.mil/cci\">CCI-000057</ident><fixtext fixref=\"F-4527r88402_fix\">Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces.\n\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \n\nNote: The example below is using the database \"local\" for the system, so if the system is using another database in \"/etc/dconf/profile/user\", the file should be created under the appropriate subdirectory.\n\n# touch /etc/dconf/db/local.d/locks/session\n\nAdd the setting to lock the screensaver idle-activation-enabled setting:\n\n/org/gnome/desktop/screensaver/idle-activation-enabled</fixtext><fix id=\"F-4527r88402_fix\" /><check system=\"C-4527r88401_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system prevents a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\n\nDetermine which profile the system database is using with the following command:\n# grep system-db /etc/dconf/profile/user\n\nsystem-db:local\n\nCheck for the idle-activation-enabled setting with the following command:\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\n# grep -i idle-activation-enabled /etc/dconf/db/local.d/locks/*\n\n/org/gnome/desktop/screensaver/idle-activation-enabled\n\nIf the command does not return a result, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204404\"><title>SRG-OS-000029-GPOS-00010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204404r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010110</version><title>The Red Hat Enterprise Linux operating system must initiate a session lock for graphical user interfaces when the screensaver is activated.</title><description>&lt;VulnDiscussion&gt;A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\n\nThe session lock is implemented at the point where session activity can be determined and/or controlled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86525</ident><ident system=\"http://cyber.mil/legacy\">V-71901</ident><ident system=\"http://cyber.mil/cci\">CCI-000057</ident><fixtext fixref=\"F-4528r88405_fix\">Configure the operating system to initiate a session lock for graphical user interfaces when a screensaver is activated.\n\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \n\n# touch /etc/dconf/db/local.d/00-screensaver\n\nAdd the setting to enable session locking when a screensaver is activated:\n\n[org/gnome/desktop/screensaver]\nlock-delay=uint32 5\n\nThe \"uint32\" must be included along with the integer key values as shown.\n\nUpdate the system databases:\n\n# dconf update\n\nUsers must log out and back in again before the system-wide settings take effect.</fixtext><fix id=\"F-4528r88405_fix\" /><check system=\"C-4528r88404_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system initiates a session lock a for graphical user interfaces when the screensaver is activated. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\n\nIf GNOME is installed, check to see a session lock occurs when the screensaver is activated with the following command:\n\n# grep -i lock-delay /etc/dconf/db/local.d/*\nlock-delay=uint32 5\n\nIf the \"lock-delay\" setting is missing, or is not set to \"5\" or less, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204405\"><title>SRG-OS-000069-GPOS-00037</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204405r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010118</version><title>The Red Hat Enterprise Linux operating system must be configured so that /etc/pam.d/passwd implements /etc/pam.d/system-auth when changing passwords.</title><description>&lt;VulnDiscussion&gt;Pluggable authentication modules (PAM) allow for a modular approach to integrating authentication methods. PAM operates in a top-down processing model and if the modules are not listed in the correct order, an important security function could be bypassed if stack entries are not centralized.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-95715</ident><ident system=\"http://cyber.mil/legacy\">V-81003</ident><ident system=\"http://cyber.mil/cci\">CCI-000192</ident><fixtext fixref=\"F-4529r88408_fix\">Configure PAM to utilize /etc/pam.d/system-auth when changing passwords.\n\nAdd the following line to \"/etc/pam.d/passwd\" (or modify the line to have the required value):\n\npassword     substack    system-auth</fixtext><fix id=\"F-4529r88408_fix\" /><check system=\"C-4529r88407_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that /etc/pam.d/passwd is configured to use /etc/pam.d/system-auth when changing passwords:\n\n# cat /etc/pam.d/passwd | grep -i substack | grep -i system-auth\npassword     substack     system-auth\n\nIf no results are returned, the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204406\"><title>SRG-OS-000069-GPOS-00037</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204406r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010119</version><title>The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.</title><description>&lt;VulnDiscussion&gt;Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. \"pwquality\" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-87811</ident><ident system=\"http://cyber.mil/legacy\">V-73159</ident><ident system=\"http://cyber.mil/cci\">CCI-000192</ident><fixtext fixref=\"F-4530r88411_fix\">Configure the operating system to use \"pwquality\" to enforce password complexity rules.\n\nAdd the following line to \"/etc/pam.d/system-auth\" (or modify the line to have the required value):\n\npassword required pam_pwquality.so retry=3\n\nNote: The value of \"retry\" should be between \"1\" and \"3\".</fixtext><fix id=\"F-4530r88411_fix\" /><check system=\"C-4530r88410_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system uses \"pwquality\" to enforce the password complexity rules. \n\nCheck for the use of \"pwquality\" with the following command:\n\n# cat /etc/pam.d/system-auth | grep pam_pwquality\n\npassword required pam_pwquality.so retry=3\n\nIf the command does not return an uncommented line containing the value \"pam_pwquality.so\", this is a finding.\n\nIf the value of \"retry\" is set to \"0\" or greater than \"3\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204407\"><title>SRG-OS-000069-GPOS-00037</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204407r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010120</version><title>The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one upper-case character.</title><description>&lt;VulnDiscussion&gt;Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86527</ident><ident system=\"http://cyber.mil/legacy\">V-71903</ident><ident system=\"http://cyber.mil/cci\">CCI-000192</ident><fixtext fixref=\"F-4531r88414_fix\">Configure the operating system to enforce password complexity by requiring that at least one upper-case character be used by setting the \"ucredit\" option.\n\nAdd the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\n\nucredit = -1</fixtext><fix id=\"F-4531r88414_fix\" /><check system=\"C-4531r88413_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Note: The value to require a number of upper-case characters to be set is expressed as a negative number in \"/etc/security/pwquality.conf\".\n\nCheck the value for \"ucredit\" in \"/etc/security/pwquality.conf\" with the following command:\n\n# grep ucredit /etc/security/pwquality.conf \nucredit = -1\n\nIf the value of \"ucredit\" is not set to a negative value, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204408\"><title>SRG-OS-000070-GPOS-00038</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204408r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010130</version><title>The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one lower-case character.</title><description>&lt;VulnDiscussion&gt;Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71905</ident><ident system=\"http://cyber.mil/legacy\">SV-86529</ident><ident system=\"http://cyber.mil/cci\">CCI-000193</ident><fixtext fixref=\"F-4532r88417_fix\">Configure the system to require at least one lower-case character when creating or changing a password.\n\nAdd or modify the following line \nin \"/etc/security/pwquality.conf\":\n\nlcredit = -1</fixtext><fix id=\"F-4532r88417_fix\" /><check system=\"C-4532r88416_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Note: The value to require a number of lower-case characters to be set is expressed as a negative number in \"/etc/security/pwquality.conf\".\n\nCheck the value for \"lcredit\" in \"/etc/security/pwquality.conf\" with the following command:\n\n# grep lcredit /etc/security/pwquality.conf \nlcredit = -1 \n\nIf the value of \"lcredit\" is not set to a negative value, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204409\"><title>SRG-OS-000071-GPOS-00039</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204409r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010140</version><title>The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are assigned, the new password must contain at least one numeric character.</title><description>&lt;VulnDiscussion&gt;Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71907</ident><ident system=\"http://cyber.mil/legacy\">SV-86531</ident><ident system=\"http://cyber.mil/cci\">CCI-000194</ident><fixtext fixref=\"F-4533r88420_fix\">Configure the operating system to enforce password complexity by requiring that at least one numeric character be used by setting the \"dcredit\" option.\n\nAdd the following line to /etc/security/pwquality.conf (or modify the line to have the required value):\n\ndcredit = -1</fixtext><fix id=\"F-4533r88420_fix\" /><check system=\"C-4533r88419_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Note: The value to require a number of numeric characters to be set is expressed as a negative number in \"/etc/security/pwquality.conf\".\n\nCheck the value for \"dcredit\" in \"/etc/security/pwquality.conf\" with the following command:\n\n# grep dcredit /etc/security/pwquality.conf \ndcredit = -1 \n\nIf the value of \"dcredit\" is not set to a negative value, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204410\"><title>SRG-OS-000266-GPOS-00101</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204410r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010150</version><title>The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one special character.</title><description>&lt;VulnDiscussion&gt;Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71909</ident><ident system=\"http://cyber.mil/legacy\">SV-86533</ident><ident system=\"http://cyber.mil/cci\">CCI-001619</ident><fixtext fixref=\"F-4534r88423_fix\">Configure the operating system to enforce password complexity by requiring that at least one special character be used by setting the \"ocredit\" option.\n\nAdd the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\n\nocredit = -1</fixtext><fix id=\"F-4534r88423_fix\" /><check system=\"C-4534r88422_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system enforces password complexity by requiring that at least one special character be used.\n\nNote: The value to require a number of special characters to be set is expressed as a negative number in \"/etc/security/pwquality.conf\".\n\nCheck the value for \"ocredit\" in \"/etc/security/pwquality.conf\" with the following command:\n\n# grep ocredit /etc/security/pwquality.conf \nocredit=-1\n\nIf the value of \"ocredit\" is not set to a negative value, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204411\"><title>SRG-OS-000072-GPOS-00040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204411r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010160</version><title>The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed a minimum of eight of the total number of characters must be changed.</title><description>&lt;VulnDiscussion&gt;Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71911</ident><ident system=\"http://cyber.mil/legacy\">SV-86535</ident><ident system=\"http://cyber.mil/cci\">CCI-000195</ident><fixtext fixref=\"F-4535r88426_fix\">Configure the operating system to require the change of at least eight of the total number of characters when passwords are changed by setting the \"difok\" option.\n\nAdd the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\n\ndifok = 8</fixtext><fix id=\"F-4535r88426_fix\" /><check system=\"C-4535r88425_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>The \"difok\" option sets the number of characters in a password that must not be present in the old password.\n\nCheck for the value of the \"difok\" option in \"/etc/security/pwquality.conf\" with the following command:\n\n# grep difok /etc/security/pwquality.conf \ndifok = 8\n\nIf the value of \"difok\" is set to less than \"8\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204412\"><title>SRG-OS-000072-GPOS-00040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204412r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010170</version><title>The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed a minimum of four character classes must be changed.</title><description>&lt;VulnDiscussion&gt;Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71913</ident><ident system=\"http://cyber.mil/legacy\">SV-86537</ident><ident system=\"http://cyber.mil/cci\">CCI-000195</ident><fixtext fixref=\"F-4536r88429_fix\">Configure the operating system to require the change of at least four character classes when passwords are changed by setting the \"minclass\" option.\n\nAdd the following line to \"/etc/security/pwquality.conf conf\" (or modify the line to have the required value):\n\nminclass = 4</fixtext><fix id=\"F-4536r88429_fix\" /><check system=\"C-4536r88428_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>The \"minclass\" option sets the minimum number of required classes of characters for the new password (digits, upper-case, lower-case, others).\n\nCheck for the value of the \"minclass\" option in \"/etc/security/pwquality.conf\" with the following command:\n\n# grep minclass /etc/security/pwquality.conf \nminclass = 4\n\nIf the value of \"minclass\" is set to less than \"4\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204413\"><title>SRG-OS-000072-GPOS-00040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204413r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010180</version><title>The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed the number of repeating consecutive characters must not be more than three characters.</title><description>&lt;VulnDiscussion&gt;Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71915</ident><ident system=\"http://cyber.mil/legacy\">SV-86539</ident><ident system=\"http://cyber.mil/cci\">CCI-000195</ident><fixtext fixref=\"F-4537r88432_fix\">Configure the operating system to require the change of the number of repeating consecutive characters when passwords are changed by setting the \"maxrepeat\" option.\n\nAdd the following line to \"/etc/security/pwquality.conf conf\" (or modify the line to have the required value):\n\nmaxrepeat = 3</fixtext><fix id=\"F-4537r88432_fix\" /><check system=\"C-4537r88431_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>The \"maxrepeat\" option sets the maximum number of allowed same consecutive characters in a new password.\n\nCheck for the value of the \"maxrepeat\" option in \"/etc/security/pwquality.conf\" with the following command:\n\n# grep maxrepeat /etc/security/pwquality.conf \nmaxrepeat = 3\n\nIf the value of \"maxrepeat\" is set to more than \"3\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204414\"><title>SRG-OS-000072-GPOS-00040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204414r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010190</version><title>The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed the number of repeating characters of the same character class must not be more than four characters.</title><description>&lt;VulnDiscussion&gt;Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71917</ident><ident system=\"http://cyber.mil/legacy\">SV-86541</ident><ident system=\"http://cyber.mil/cci\">CCI-000195</ident><fixtext fixref=\"F-4538r88435_fix\">Configure the operating system to require the change of the number of repeating characters of the same character class when passwords are changed by setting the \"maxclassrepeat\" option.\n\nAdd the following line to \"/etc/security/pwquality.conf\" conf (or modify the line to have the required value):\n\nmaxclassrepeat = 4</fixtext><fix id=\"F-4538r88435_fix\" /><check system=\"C-4538r88434_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>The \"maxclassrepeat\" option sets the maximum number of allowed same consecutive characters in the same class in the new password.\n\nCheck for the value of the \"maxclassrepeat\" option in \"/etc/security/pwquality.conf\" with the following command:\n\n# grep maxclassrepeat /etc/security/pwquality.conf \nmaxclassrepeat = 4\n\nIf the value of \"maxclassrepeat\" is set to more than \"4\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204415\"><title>SRG-OS-000073-GPOS-00041</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204415r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010200</version><title>The Red Hat Enterprise Linux operating system must be configured so that the PAM system service is configured to store only encrypted representations of passwords.</title><description>&lt;VulnDiscussion&gt;Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71919</ident><ident system=\"http://cyber.mil/legacy\">SV-86543</ident><ident system=\"http://cyber.mil/cci\">CCI-000196</ident><fixtext fixref=\"F-4539r88438_fix\">Configure the operating system to store only SHA512 encrypted representations of passwords.\n\nAdd the following line in \"/etc/pam.d/system-auth\":\npam_unix.so sha512 shadow try_first_pass use_authtok\n\nAdd the following line in \"/etc/pam.d/password-auth\":\npam_unix.so sha512 shadow try_first_pass use_authtok\n\nNote: Manual changes to the listed files may be overwritten by the \"authconfig\" program. The \"authconfig\" program should not be used to update the configurations listed in this requirement.</fixtext><fix id=\"F-4539r88438_fix\" /><check system=\"C-4539r88437_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the PAM system service is configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is SHA512.\n\nCheck that the system is configured to create SHA512 hashed passwords with the following command:\n\n# grep password /etc/pam.d/system-auth /etc/pam.d/password-auth\n\nOutcome should look like following:\n/etc/pam.d/system-auth-ac:password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\n/etc/pam.d/password-auth:password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\n\nIf the \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" configuration files allow for password hashes other than SHA512 to be used, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204416\"><title>SRG-OS-000073-GPOS-00041</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204416r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010210</version><title>The Red Hat Enterprise Linux operating system must be configured to use the shadow file to store only encrypted representations of passwords.</title><description>&lt;VulnDiscussion&gt;Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71921</ident><ident system=\"http://cyber.mil/legacy\">SV-86545</ident><ident system=\"http://cyber.mil/cci\">CCI-000196</ident><fixtext fixref=\"F-4540r88441_fix\">Configure the operating system to store only SHA512 encrypted representations of passwords.\n\nAdd or update the following line in \"/etc/login.defs\":\n\nENCRYPT_METHOD SHA512</fixtext><fix id=\"F-4540r88441_fix\" /><check system=\"C-4540r88440_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the system's shadow file is configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is SHA512.\n\nCheck that the system is configured to create SHA512 hashed passwords with the following command:\n\n# grep -i encrypt /etc/login.defs\nENCRYPT_METHOD SHA512\n\nIf the \"/etc/login.defs\" configuration file does not exist or allows for password hashes other than SHA512 to be used, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204417\"><title>SRG-OS-000073-GPOS-00041</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204417r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010220</version><title>The Red Hat Enterprise Linux operating system must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.</title><description>&lt;VulnDiscussion&gt;Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71923</ident><ident system=\"http://cyber.mil/legacy\">SV-86547</ident><ident system=\"http://cyber.mil/cci\">CCI-000196</ident><fixtext fixref=\"F-4541r88444_fix\">Configure the operating system to store only SHA512 encrypted representations of passwords.\n\nAdd or update the following line in \"/etc/libuser.conf\" in the [defaults] section: \n\ncrypt_style = sha512</fixtext><fix id=\"F-4541r88444_fix\" /><check system=\"C-4541r88443_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the user and group account administration utilities are configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is \"SHA512\".\n\nCheck that the system is configured to create \"SHA512\" hashed passwords with the following command:\n\n# grep -i sha512 /etc/libuser.conf \n\ncrypt_style = sha512\n\nIf the \"crypt_style\" variable is not set to \"sha512\", is not in the defaults section, is commented out, or does not exist, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204418\"><title>SRG-OS-000075-GPOS-00043</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204418r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010230</version><title>The Red Hat Enterprise Linux operating system must be configured so that passwords for new users are restricted to a 24 hours/1 day minimum lifetime.</title><description>&lt;VulnDiscussion&gt;Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71925</ident><ident system=\"http://cyber.mil/legacy\">SV-86549</ident><ident system=\"http://cyber.mil/cci\">CCI-000198</ident><fixtext fixref=\"F-4542r88447_fix\">Configure the operating system to enforce 24 hours/1 day as the minimum password lifetime.\n\nAdd the following line in \"/etc/login.defs\" (or modify the line to have the required value):\n\nPASS_MIN_DAYS     1</fixtext><fix id=\"F-4542r88447_fix\" /><check system=\"C-4542r88446_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system enforces 24 hours/1 day as the minimum password lifetime for new user accounts.\n\nCheck for the value of \"PASS_MIN_DAYS\" in \"/etc/login.defs\" with the following command: \n\n# grep -i pass_min_days /etc/login.defs\nPASS_MIN_DAYS     1\n\nIf the \"PASS_MIN_DAYS\" parameter value is not \"1\" or greater, or is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204419\"><title>SRG-OS-000075-GPOS-00043</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204419r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010240</version><title>The Red Hat Enterprise Linux operating system must be configured so that passwords are restricted to a 24 hours/1 day minimum lifetime.</title><description>&lt;VulnDiscussion&gt;Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86551</ident><ident system=\"http://cyber.mil/legacy\">V-71927</ident><ident system=\"http://cyber.mil/cci\">CCI-000198</ident><fixtext fixref=\"F-4543r88450_fix\">Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime:\n\n# chage -m 1 [user]</fixtext><fix id=\"F-4543r88450_fix\" /><check system=\"C-4543r88449_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Check whether the minimum time period between password changes for each user account is one day or greater.\n\n# awk -F: '$4 &lt; 1 {print $1 \" \" $4}' /etc/shadow\n\nIf any results are returned that are not associated with a system account, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204420\"><title>SRG-OS-000076-GPOS-00044</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204420r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010250</version><title>The Red Hat Enterprise Linux operating system must be configured so that passwords for new users are restricted to a 60-day maximum lifetime.</title><description>&lt;VulnDiscussion&gt;Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86553</ident><ident system=\"http://cyber.mil/legacy\">V-71929</ident><ident system=\"http://cyber.mil/cci\">CCI-000199</ident><fixtext fixref=\"F-4544r88453_fix\">Configure the operating system to enforce a 60-day maximum password lifetime restriction.\n\nAdd the following line in \"/etc/login.defs\" (or modify the line to have the required value):\n\nPASS_MAX_DAYS     60</fixtext><fix id=\"F-4544r88453_fix\" /><check system=\"C-4544r88452_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>If passwords are not being used for authentication, this is Not Applicable.\n\nVerify the operating system enforces a 60-day maximum password lifetime restriction for new user accounts.\n\nCheck for the value of \"PASS_MAX_DAYS\" in \"/etc/login.defs\" with the following command:\n\n# grep -i pass_max_days /etc/login.defs\nPASS_MAX_DAYS 60\n\nIf the \"PASS_MAX_DAYS\" parameter value is not 60 or less, or is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204421\"><title>SRG-OS-000076-GPOS-00044</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204421r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010260</version><title>The Red Hat Enterprise Linux operating system must be configured so that existing passwords are restricted to a 60-day maximum lifetime.</title><description>&lt;VulnDiscussion&gt;Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86555</ident><ident system=\"http://cyber.mil/legacy\">V-71931</ident><ident system=\"http://cyber.mil/cci\">CCI-000199</ident><fixtext fixref=\"F-4545r88456_fix\">Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction.\n\n# chage -M 60 [user]</fixtext><fix id=\"F-4545r88456_fix\" /><check system=\"C-4545r88455_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Check whether the maximum time period for existing passwords is restricted to 60 days.\n\n# awk -F: '$5 &gt; 60 {print $1 \" \" $5}' /etc/shadow\n\nIf any results are returned that are not associated with a system account, this is a finding.\n</check-content></check></Rule></Group><Group id=\"V-204422\"><title>SRG-OS-000077-GPOS-00045</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204422r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010270</version><title>The Red Hat Enterprise Linux operating system must be configured so that passwords are prohibited from reuse for a minimum of five generations.</title><description>&lt;VulnDiscussion&gt;Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If the information system or application allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed per policy requirements.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86557</ident><ident system=\"http://cyber.mil/legacy\">V-71933</ident><ident system=\"http://cyber.mil/cci\">CCI-000200</ident><fixtext fixref=\"F-4546r88459_fix\">Configure the operating system to prohibit password reuse for a minimum of five generations.\n\nAdd the following line in \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" (or modify the line to have the required value):\n\npassword    requisite     pam_pwhistory.so use_authtok remember=5 retry=3\n   \nNote: Manual changes to the listed files may be overwritten by the \"authconfig\" program. The \"authconfig\" program should not be used to update the configurations listed in this requirement.</fixtext><fix id=\"F-4546r88459_fix\" /><check system=\"C-4546r88458_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system prohibits password reuse for a minimum of five generations.\n\nCheck for the value of the \"remember\" argument in \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" with the following command:\n\n# grep -i remember /etc/pam.d/system-auth /etc/pam.d/password-auth\n\npassword    requisite     pam_pwhistory.so use_authtok remember=5 retry=3\n\nIf the line containing the \"pam_pwhistory.so\" line does not have the \"remember\" module argument set, is commented out, or the value of the \"remember\" module argument is set to less than \"5\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204423\"><title>SRG-OS-000078-GPOS-00046</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204423r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010280</version><title>The Red Hat Enterprise Linux operating system must be configured so that passwords are a minimum of 15 characters in length.</title><description>&lt;VulnDiscussion&gt;The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.\n\nPassword complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86559</ident><ident system=\"http://cyber.mil/legacy\">V-71935</ident><ident system=\"http://cyber.mil/cci\">CCI-000205</ident><fixtext fixref=\"F-4547r88462_fix\">Configure operating system to enforce a minimum 15-character password length.\n\nAdd the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\n\nminlen = 15</fixtext><fix id=\"F-4547r88462_fix\" /><check system=\"C-4547r88461_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system enforces a minimum 15-character password length. The \"minlen\" option sets the minimum number of characters in a new password.\n\nCheck for the value of the \"minlen\" option in \"/etc/security/pwquality.conf\" with the following command:\n\n# grep minlen /etc/security/pwquality.conf\nminlen = 15\n\nIf the command does not return a \"minlen\" value of 15 or greater, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204424\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204424r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-010290</version><title>The Red Hat Enterprise Linux operating system must not have accounts configured with blank or null passwords.</title><description>&lt;VulnDiscussion&gt;If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86561</ident><ident system=\"http://cyber.mil/legacy\">V-71937</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4548r88465_fix\">If an account is configured for password authentication but does not have an assigned password, it may be possible to log on to the account without authenticating.\n\nRemove any instances of the \"nullok\" option in \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" to prevent logons with empty passwords.\n\nNote: Manual changes to the listed files may be overwritten by the \"authconfig\" program. The \"authconfig\" program should not be used to update the configurations listed in this requirement.</fixtext><fix id=\"F-4548r88465_fix\" /><check system=\"C-4548r88464_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>To verify that null passwords cannot be used, run the following command: \n\n# grep nullok /etc/pam.d/system-auth /etc/pam.d/password-auth\n\nIf this produces any output, it may be possible to log on with accounts with empty passwords.\n\nIf null passwords can be used, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204425\"><title>SRG-OS-000106-GPOS-00053</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204425r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-010300</version><title>The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using an empty password.</title><description>&lt;VulnDiscussion&gt;Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86563</ident><ident system=\"http://cyber.mil/legacy\">V-71939</ident><ident system=\"http://cyber.mil/cci\">CCI-000766</ident><fixtext fixref=\"F-4549r88468_fix\">To explicitly disallow remote logon from accounts with empty passwords, add or correct the following line in \"/etc/ssh/sshd_config\":\n\nPermitEmptyPasswords no\n\nThe SSH service must be restarted for changes to take effect.  Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.</fixtext><fix id=\"F-4549r88468_fix\" /><check system=\"C-4549r88467_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>To determine how the SSH daemon's \"PermitEmptyPasswords\" option is set, run the following command:\n\n# grep -i PermitEmptyPasswords /etc/ssh/sshd_config\nPermitEmptyPasswords no\n\nIf no line, a commented line, or a line indicating the value \"no\" is returned, the required value is set.\n\nIf the required value is not set, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204426\"><title>SRG-OS-000118-GPOS-00060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204426r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010310</version><title>The Red Hat Enterprise Linux operating system must disable account identifiers (individuals, groups, roles, and devices) if the password expires.</title><description>&lt;VulnDiscussion&gt;Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained.\n\nOperating systems need to track periods of inactivity and disable application identifiers after zero days of inactivity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86565</ident><ident system=\"http://cyber.mil/legacy\">V-71941</ident><ident system=\"http://cyber.mil/cci\">CCI-000795</ident><fixtext fixref=\"F-4550r88471_fix\">Configure the operating system to disable account identifiers (individuals, groups, roles, and devices) after the password expires.\n\nAdd the following line to \"/etc/default/useradd\" (or modify the line to have the required value):\n\nINACTIVE=0</fixtext><fix id=\"F-4550r88471_fix\" /><check system=\"C-4550r88470_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>If passwords are not being used for authentication, this is Not Applicable.\n\nVerify the operating system disables account identifiers (individuals, groups, roles, and devices) after the password expires with the following command:\n\n# grep -i inactive /etc/default/useradd\nINACTIVE=0\n\nIf the value is not set to \"0\", is commented out, or is not defined, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204427\"><title>SRG-OS-000329-GPOS-00128</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204427r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010320</version><title>The Red Hat Enterprise Linux operating system must be configured to lock accounts for a minimum of 15 minutes after three unsuccessful logon attempts within a 15-minute timeframe.</title><description>&lt;VulnDiscussion&gt;By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.\n\nSatisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86567</ident><ident system=\"http://cyber.mil/legacy\">V-71943</ident><ident system=\"http://cyber.mil/cci\">CCI-000044</ident><ident system=\"http://cyber.mil/cci\">CCI-002236</ident><ident system=\"http://cyber.mil/cci\">CCI-002237</ident><ident system=\"http://cyber.mil/cci\">CCI-002238</ident><fixtext fixref=\"F-4551r88474_fix\">Configure the operating system to lock an account for the maximum period when three unsuccessful logon attempts in 15 minutes are made.\n\nModify the first three lines of the auth section and the first line of the account section of the \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" files to match the following lines:\n\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\nauth sufficient pam_unix.so try_first_pass\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\naccount required pam_faillock.so   \n\nNote: Manual changes to the listed files may be overwritten by the \"authconfig\" program. The \"authconfig\" program should not be used to update the configurations listed in this requirement.</fixtext><fix id=\"F-4551r88474_fix\" /><check system=\"C-4551r88473_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Check that the system locks an account for a minimum of 15 minutes after three unsuccessful logon attempts within a period of 15 minutes with the following command:\n\n# grep pam_faillock.so /etc/pam.d/password-auth\n\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\naccount required pam_faillock.so \n\nIf the \"deny\" parameter is set to \"0\" or a value less than \"3\" on both \"auth\" lines with the \"pam_faillock.so\" module, or is missing from these lines, this is a finding.\n\nIf the \"even_deny_root\" parameter is not set on both \"auth\" lines with the \"pam_faillock.so\" module, or is missing from these lines, this is a finding.\n\nIf the \"fail_interval\" parameter is set to \"0\" or is set to a value less than \"900\" on both \"auth\" lines with the \"pam_faillock.so\" module, or is missing from these lines, this is a finding.\n\nIf the \"unlock_time\" parameter is not set to \"0\", \"never\", or is set to a value less than \"900\" on both \"auth\" lines with the \"pam_faillock.so\" module, or is missing from these lines, this is a finding.\n\nNote: The maximum configurable value for \"unlock_time\" is \"604800\". \n\nIf any line referencing the \"pam_faillock.so\" module is commented out, this is a finding.\n\n# grep pam_faillock.so /etc/pam.d/system-auth\n\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\naccount required pam_faillock.so \n\nIf the \"deny\" parameter is set to \"0\" or a value less than \"3\" on both \"auth\" lines with the \"pam_faillock.so\" module, or is missing from these lines, this is a finding.\n\nIf the \"even_deny_root\" parameter is not set on both \"auth\" lines with the \"pam_faillock.so\" module, or is missing from these lines, this is a finding.\n\nIf the \"fail_interval\" parameter is set to \"0\" or is set to a value less than \"900\" on both \"auth\" lines with the \"pam_faillock.so\" module, or is missing from these lines, this is a finding.\n\nIf the \"unlock_time\" parameter is not set to \"0\", \"never\", or is set to a value less than \"900\" on both \"auth\" lines with the \"pam_faillock.so\" module or is missing from these lines, this is a finding.\n\nNote: The maximum configurable value for \"unlock_time\" is \"604800\". \nIf any line referencing the \"pam_faillock.so\" module is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204428\"><title>SRG-OS-000329-GPOS-00128</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204428r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010330</version><title>The Red Hat Enterprise Linux operating system must lock the associated account after three unsuccessful root logon attempts are made within a 15-minute period.</title><description>&lt;VulnDiscussion&gt;By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.\n\nSatisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86569</ident><ident system=\"http://cyber.mil/legacy\">V-71945</ident><ident system=\"http://cyber.mil/cci\">CCI-002238</ident><fixtext fixref=\"F-4552r88477_fix\">Configure the operating system to lock automatically the root account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are made.\n\nModify the first three lines of the auth section and the first line of the account section of the \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" files to match the following lines:\n\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\nauth sufficient pam_unix.so try_first_pass\nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\naccount required pam_faillock.so\n\nNote: Manual changes to the listed files may be overwritten by the \"authconfig\" program. The \"authconfig\" program should not be used to update the configurations listed in this requirement.</fixtext><fix id=\"F-4552r88477_fix\" /><check system=\"C-4552r88476_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system automatically locks the root account until it is released by an administrator when three unsuccessful logon attempts in 15 minutes are made.\n\n# grep pam_faillock.so /etc/pam.d/password-auth\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900 \nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900 \naccount required pam_faillock.so\n\nIf the \"even_deny_root\" setting is not defined on both lines with the \"pam_faillock.so\" module, is commented out, or is missing from a line, this is a finding.\n\n# grep pam_faillock.so /etc/pam.d/system-auth\nauth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900 \nauth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\naccount required pam_faillock.so\n\nIf the \"even_deny_root\" setting is not defined on both lines with the \"pam_faillock.so\" module, is commented out, or is missing from a line, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204429\"><title>SRG-OS-000373-GPOS-00156</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204429r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010340</version><title>The Red Hat Enterprise Linux operating system must be configured so that users must provide a password for privilege escalation.</title><description>&lt;VulnDiscussion&gt;Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \n\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate.\n\nSatisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71947</ident><ident system=\"http://cyber.mil/legacy\">SV-86571</ident><ident system=\"http://cyber.mil/cci\">CCI-002038</ident><fixtext fixref=\"F-4553r88480_fix\">Configure the operating system to require users to supply a password for privilege escalation.\n\nCheck the configuration of the \"/etc/sudoers\" file with the following command:\n# visudo\n\nRemove any occurrences of \"NOPASSWD\" tags in the file.   \n\nCheck the configuration of the /etc/sudoers.d/* files with the following command:\n# grep -i nopasswd /etc/sudoers.d/*\n\nRemove any occurrences of \"NOPASSWD\" tags in the file.</fixtext><fix id=\"F-4553r88480_fix\" /><check system=\"C-4553r88479_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>If passwords are not being used for authentication, this is Not Applicable.\n\nVerify the operating system requires users to supply a password for privilege escalation.\n\nCheck the configuration of the \"/etc/sudoers\" and \"/etc/sudoers.d/*\" files with the following command:\n\n# grep -i nopasswd /etc/sudoers /etc/sudoers.d/*\n\nIf any uncommented line is found with a \"NOPASSWD\" tag, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204430\"><title>SRG-OS-000373-GPOS-00156</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204430r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010350</version><title>The Red Hat Enterprise Linux operating system must be configured so that users must re-authenticate for privilege escalation.</title><description>&lt;VulnDiscussion&gt;Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \n\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate.\n\nSatisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71949</ident><ident system=\"http://cyber.mil/legacy\">SV-86573</ident><ident system=\"http://cyber.mil/cci\">CCI-002038</ident><fixtext fixref=\"F-4554r88483_fix\">Configure the operating system to require users to reauthenticate for privilege escalation.\n\nCheck the configuration of the \"/etc/sudoers\" file with the following command:\n\n# visudo\nRemove any occurrences of \"!authenticate\" tags in the file.\n\nCheck the configuration of the \"/etc/sudoers.d/*\" files with the following command:\n\n# grep -i authenticate /etc/sudoers /etc/sudoers.d/*\nRemove any occurrences of \"!authenticate\" tags in the file(s).</fixtext><fix id=\"F-4554r88483_fix\" /><check system=\"C-4554r88482_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system requires users to reauthenticate for privilege escalation.\n\nCheck the configuration of the \"/etc/sudoers\" and \"/etc/sudoers.d/*\" files with the following command:\n\n# grep -i authenticate /etc/sudoers /etc/sudoers.d/*\n\nIf any uncommented line is found with a \"!authenticate\" tag, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204431\"><title>SRG-OS-000480-GPOS-00226</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204431r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010430</version><title>The Red Hat Enterprise Linux operating system must be configured so that the delay between logon prompts following a failed console logon attempt is at least four seconds.</title><description>&lt;VulnDiscussion&gt;Configuring the operating system to implement organization-wide security implementation guides and security checklists verifies compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example, registry settings; account, file, and directory permission settings; and settings for functions, ports, protocols, services, and remote connections.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71951</ident><ident system=\"http://cyber.mil/legacy\">SV-86575</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4555r88486_fix\">Configure the operating system to enforce a delay of at least four seconds between logon prompts following a failed console logon attempt.\n\nModify the \"/etc/login.defs\" file to set the \"FAIL_DELAY\" parameter to \"4\" or greater:\n\nFAIL_DELAY 4</fixtext><fix id=\"F-4555r88486_fix\" /><check system=\"C-4555r88485_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system enforces a delay of at least four seconds between console logon prompts following a failed logon attempt.\n\nCheck the value of the \"fail_delay\" parameter in the \"/etc/login.defs\" file with the following command:\n\n# grep -i fail_delay /etc/login.defs\nFAIL_DELAY 4\n\nIf the value of \"FAIL_DELAY\" is not set to \"4\" or greater, or the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204432\"><title>SRG-OS-000480-GPOS-00229</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204432r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-010440</version><title>The Red Hat Enterprise Linux operating system must not allow an unattended or automatic logon to the system via a graphical user interface.</title><description>&lt;VulnDiscussion&gt;Failure to restrict system access to authenticated users negatively impacts operating system security.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71953</ident><ident system=\"http://cyber.mil/legacy\">SV-86577</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4556r88489_fix\">Configure the operating system to not allow an unattended or automatic logon to the system via a graphical user interface.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nAdd or edit the line for the \"AutomaticLoginEnable\" parameter in the [daemon] section of the \"/etc/gdm/custom.conf\" file to \"false\":\n\n[daemon]\nAutomaticLoginEnable=false</fixtext><fix id=\"F-4556r88489_fix\" /><check system=\"C-4556r88488_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system does not allow an unattended or automatic logon to the system via a graphical user interface.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \n\nCheck for the value of the \"AutomaticLoginEnable\" in the \"/etc/gdm/custom.conf\" file with the following command:\n\n# grep -i automaticloginenable /etc/gdm/custom.conf\nAutomaticLoginEnable=false\n\nIf the value of \"AutomaticLoginEnable\" is not set to \"false\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204433\"><title>SRG-OS-000480-GPOS-00229</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204433r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-010450</version><title>The Red Hat Enterprise Linux operating system must not allow an unrestricted logon to the system.</title><description>&lt;VulnDiscussion&gt;Failure to restrict system access to authenticated users negatively impacts operating system security.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71955</ident><ident system=\"http://cyber.mil/legacy\">SV-86579</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4557r88492_fix\">Configure the operating system to not allow an unrestricted account to log on to the system via a graphical user interface.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nAdd or edit the line for the \"TimedLoginEnable\" parameter in the [daemon] section of the \"/etc/gdm/custom.conf\" file to \"false\":\n\n[daemon]\nTimedLoginEnable=false</fixtext><fix id=\"F-4557r88492_fix\" /><check system=\"C-4557r88491_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system does not allow an unrestricted logon to the system via a graphical user interface.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. \n\nCheck for the value of the \"TimedLoginEnable\" parameter in \"/etc/gdm/custom.conf\" file with the following command:\n\n# grep -i timedloginenable /etc/gdm/custom.conf\nTimedLoginEnable=false\n\nIf the value of \"TimedLoginEnable\" is not set to \"false\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204434\"><title>SRG-OS-000480-GPOS-00229</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204434r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010460</version><title>The Red Hat Enterprise Linux operating system must not allow users to override SSH environment variables.</title><description>&lt;VulnDiscussion&gt;Failure to restrict system access to authenticated users negatively impacts operating system security.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71957</ident><ident system=\"http://cyber.mil/legacy\">SV-86581</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4558r88495_fix\">Configure the operating system to not allow users to override environment variables to the SSH daemon.\n\nEdit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for \"PermitUserEnvironment\" keyword and set the value to \"no\":\n\nPermitUserEnvironment no\n\nThe SSH service must be restarted for changes to take effect.</fixtext><fix id=\"F-4558r88495_fix\" /><check system=\"C-4558r88494_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system does not allow users to override environment variables to the SSH daemon.\n\nCheck for the value of the \"PermitUserEnvironment\" keyword with the following command:\n\n# grep -i permituserenvironment /etc/ssh/sshd_config\nPermitUserEnvironment no\n\nIf the \"PermitUserEnvironment\" keyword is not set to \"no\", is missing, or is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204435\"><title>SRG-OS-000480-GPOS-00229</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204435r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010470</version><title>The Red Hat Enterprise Linux operating system must not allow a non-certificate trusted host SSH logon to the system.</title><description>&lt;VulnDiscussion&gt;Failure to restrict system access to authenticated users negatively impacts operating system security.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71959</ident><ident system=\"http://cyber.mil/legacy\">SV-86583</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4559r88498_fix\">Configure the operating system to not allow a non-certificate trusted host SSH logon to the system.\n\nEdit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for \"HostbasedAuthentication\" keyword and set the value to \"no\":\n\nHostbasedAuthentication no\n\nThe SSH service must be restarted for changes to take effect.</fixtext><fix id=\"F-4559r88498_fix\" /><check system=\"C-4559r88497_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system does not allow a non-certificate trusted host SSH logon to the system.\n\nCheck for the value of the \"HostbasedAuthentication\" keyword with the following command:\n\n# grep -i hostbasedauthentication /etc/ssh/sshd_config\nHostbasedAuthentication no\n\nIf the \"HostbasedAuthentication\" keyword is not set to \"no\", is missing, or is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204436\"><title>SRG-OS-000080-GPOS-00048</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204436r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-010480</version><title>Red Hat Enterprise Linux operating systems prior to version 7.2 with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes.</title><description>&lt;VulnDiscussion&gt;If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71961</ident><ident system=\"http://cyber.mil/legacy\">SV-86585</ident><ident system=\"http://cyber.mil/cci\">CCI-000213</ident><fixtext fixref=\"F-4560r88501_fix\">Configure the system to encrypt the boot password for root.\n\nGenerate an encrypted grub2 password for root with the following command:\n\nNote: The hash generated is an example.\n\n# grub2-mkpasswd-pbkdf2\n\nEnter Password:\nReenter Password:\nPBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45\n\nEdit \"/etc/grub.d/40_custom\" and add the following lines below the comments:\n\n# vi /etc/grub.d/40_custom\n\nset superusers=\"root\"\n\npassword_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command}\n\nGenerate a new \"grub.conf\" file with the new password with the following commands:\n\n# grub2-mkconfig --output=/tmp/grub2.cfg\n# mv /tmp/grub2.cfg /boot/grub2/grub.cfg</fixtext><fix id=\"F-4560r88501_fix\" /><check system=\"C-4560r88500_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>For systems that use UEFI, this is Not Applicable.\nFor systems that are running RHEL 7.2 or newer, this is Not Applicable.\n\nCheck to see if an encrypted root password is set. On systems that use a BIOS, use the following command:\n\n# grep -i password_pbkdf2 /boot/grub2/grub.cfg\n\npassword_pbkdf2 [superusers-account] [password-hash]\n\nIf the root password entry does not begin with \"password_pbkdf2\", this is a finding.\n\nIf the \"superusers-account\" is not set to \"root\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204437\"><title>SRG-OS-000080-GPOS-00048</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204437r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010481</version><title>The Red Hat Enterprise Linux operating system must require authentication upon booting into single-user and maintenance modes.</title><description>&lt;VulnDiscussion&gt;If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-77823</ident><ident system=\"http://cyber.mil/legacy\">SV-92519</ident><ident system=\"http://cyber.mil/cci\">CCI-000213</ident><fixtext fixref=\"F-4561r88504_fix\">Configure the operating system to require authentication upon booting into single-user and maintenance modes.\n\nAdd or modify the \"ExecStart\" line in \"/usr/lib/systemd/system/rescue.service\" to include \"/usr/sbin/sulogin\":\n\nExecStart=-/bin/sh -c \"/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default\"</fixtext><fix id=\"F-4561r88504_fix\" /><check system=\"C-4561r88503_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system must require authentication upon booting into single-user and maintenance modes.\n\nCheck that the operating system requires authentication upon booting into single-user mode with the following command:\n\n# grep -i execstart /usr/lib/systemd/system/rescue.service | grep -i sulogin\n\nExecStart=-/bin/sh -c \"/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default\"\n\nIf \"ExecStart\" does not have \"/usr/sbin/sulogin\" as an option, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204438\"><title>SRG-OS-000080-GPOS-00048</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204438r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-010482</version><title>Red Hat Enterprise Linux operating systems version 7.2 or newer with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes.</title><description>&lt;VulnDiscussion&gt;If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-81005</ident><ident system=\"http://cyber.mil/legacy\">SV-95717</ident><ident system=\"http://cyber.mil/cci\">CCI-000213</ident><fixtext fixref=\"F-4562r88507_fix\">Configure the system to encrypt the boot password for root.\n\nGenerate an encrypted grub2 password for root with the following command:\n\nNote: The hash generated is an example.\n  \n# grub2-setpassword\nEnter password:\nConfirm password:\n\nEdit the /boot/grub2/grub.cfg file and add or modify the following lines in the \"### BEGIN /etc/grub.d/01_users ###\" section:\n\nset superusers=\"root\"\nexport superusers</fixtext><fix id=\"F-4562r88507_fix\" /><check system=\"C-4562r88506_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>For systems that use UEFI, this is Not Applicable.\n\nFor systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\n\nCheck to see if an encrypted root password is set. On systems that use a BIOS, use the following command:\n\n# grep -iw grub2_password /boot/grub2/user.cfg\nGRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]\n\nIf the root password does not begin with \"grub.pbkdf2.sha512\", this is a finding.\n\nVerify that the \"root\" account is set as the \"superusers\":\n\n# grep -iw \"superusers\" /boot/grub2/grub.cfg\n    set superusers=\"root\"\n    export superusers\n\nIf \"superusers\" is not set to \"root\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204439\"><title>SRG-OS-000080-GPOS-00048</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204439r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-010490</version><title>Red Hat Enterprise Linux operating systems prior to version 7.2 using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes.</title><description>&lt;VulnDiscussion&gt;If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71963</ident><ident system=\"http://cyber.mil/legacy\">SV-86587</ident><ident system=\"http://cyber.mil/cci\">CCI-000213</ident><fixtext fixref=\"F-4563r88510_fix\">Configure the system to encrypt the boot password for root.\n\nGenerate an encrypted grub2 password for root with the following command:\n\nNote: The hash generated is an example.\n\n# grub2-mkpasswd-pbkdf2\n\nEnter Password:\nReenter Password:\nPBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45\n\nEdit \"/etc/grub.d/40_custom\" and add the following lines below the comments:\n\n# vi /etc/grub.d/40_custom\n\nset superusers=\"root\"\n\npassword_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command}\n\nGenerate a new \"grub.conf\" file with the new password with the following commands:\n\n# grub2-mkconfig --output=/tmp/grub2.cfg\n# mv /tmp/grub2.cfg /boot/efi/EFI/redhat/grub.cfg</fixtext><fix id=\"F-4563r88510_fix\" /><check system=\"C-4563r88509_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>For systems that use BIOS, this is Not Applicable.\nFor systems that are running RHEL 7.2 or newer, this is Not Applicable.\n\nCheck to see if an encrypted root password is set. On systems that use UEFI, use the following command:\n\n# grep -i password /boot/efi/EFI/redhat/grub.cfg\n\npassword_pbkdf2 [superusers-account] [password-hash]\n\nIf the root password entry does not begin with \"password_pbkdf2\", this is a finding.\n\nIf the \"superusers-account\" is not set to \"root\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204440\"><title>SRG-OS-000080-GPOS-00048</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204440r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-010491</version><title>Red Hat Enterprise Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes.</title><description>&lt;VulnDiscussion&gt;If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-95719</ident><ident system=\"http://cyber.mil/legacy\">V-81007</ident><ident system=\"http://cyber.mil/cci\">CCI-000213</ident><fixtext fixref=\"F-4564r88513_fix\">Configure the system to encrypt the boot password for root.\n\nGenerate an encrypted grub2 password for root with the following command:\n\nNote: The hash generated is an example.\n  \n# grub2-setpassword\nEnter password:\nConfirm password:\n\nEdit the /boot/efi/EFI/redhat/grub.cfg file and add or modify the following lines in the \"### BEGIN /etc/grub.d/01_users ###\" section:\n\nset superusers=\"root\"\nexport superusers</fixtext><fix id=\"F-4564r88513_fix\" /><check system=\"C-4564r88512_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>For systems that use BIOS, this is Not Applicable.\n\nFor systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\n\nCheck to see if an encrypted root password is set. On systems that use UEFI, use the following command:\n\n# grep -iw grub2_password /boot/efi/EFI/redhat/user.cfg\nGRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]\n\nIf the root password does not begin with \"grub.pbkdf2.sha512\", this is a finding.\n\nVerify that the \"root\" account is set as the \"superusers\":\n\n# grep -iw \"superusers\" /boot/efi/EFI/redhat/grub.cfg\n    set superusers=\"root\"\n    export superusers\n\nIf \"superusers\" is not set to \"root\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204441\"><title>SRG-OS-000104-GPOS-00051</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204441r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010500</version><title>The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users) using multifactor authentication.</title><description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following:\n\n1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; \n\nand\n\n2) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\n\nSatisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000109-GPOS-00056, SRG-OS-000108-GPOS-00055, SRG-OS-000108-GPOS-00057, SRG-OS-000108-GPOS-00058&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86589</ident><ident system=\"http://cyber.mil/legacy\">V-71965</ident><ident system=\"http://cyber.mil/cci\">CCI-000766</ident><fixtext fixref=\"F-4565r88516_fix\">Configure the operating system to require individuals to be authenticated with a multifactor authenticator.\n\nEnable smartcard logons with the following commands:\n\n# authconfig --enablesmartcard --smartcardaction=0 --update\n# authconfig --enablerequiresmartcard -update\n\nModify the \"/etc/pam_pkcs11/pkcs11_eventmgr.conf\" file to uncomment the following line:\n\n#/usr/X11R6/bin/xscreensaver-command -lock\n\nModify the \"/etc/pam_pkcs11/pam_pkcs11.conf\" file to use the cackey module if required.</fixtext><fix id=\"F-4565r88516_fix\" /><check system=\"C-4565r88515_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system requires multifactor authentication to uniquely identify organizational users using multifactor authentication.\n\nCheck to see if smartcard authentication is enforced on the system:\n\n# authconfig --test | grep \"pam_pkcs11 is enabled\"\n\nIf no results are returned, this is a finding.\n\n# authconfig --test | grep \"smartcard removal action\"\n\nIf \"smartcard removal action\" is blank, this is a finding.\n\n# authconfig --test | grep \"smartcard module\"\n\nIf \"smartcard module\" is blank, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204442\"><title>SRG-OS-000095-GPOS-00049</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204442r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-020000</version><title>The Red Hat Enterprise Linux operating system must not have the rsh-server package installed.</title><description>&lt;VulnDiscussion&gt;It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\n\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).\n\nThe rsh-server service provides an unencrypted remote access service that does not provide for the confidentiality and integrity of user passwords or the remote session and has very weak authentication.\n\nIf a privileged user were to log on using this service, the privileged user password could be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86591</ident><ident system=\"http://cyber.mil/legacy\">V-71967</ident><ident system=\"http://cyber.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-4566r88519_fix\">Configure the operating system to disable non-essential capabilities by removing the rsh-server package from the system with the following command:\n\n# yum remove rsh-server</fixtext><fix id=\"F-4566r88519_fix\" /><check system=\"C-4566r88518_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Check to see if the rsh-server package is installed with the following command:\n\n# yum list installed rsh-server\n\nIf the rsh-server package is installed, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204443\"><title>SRG-OS-000095-GPOS-00049</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204443r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-020010</version><title>The Red Hat Enterprise Linux operating system must not have the ypserv package installed.</title><description>&lt;VulnDiscussion&gt;Removing the \"ypserv\" package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86593</ident><ident system=\"http://cyber.mil/legacy\">V-71969</ident><ident system=\"http://cyber.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-4567r88522_fix\">Configure the operating system to disable non-essential capabilities by removing the \"ypserv\" package from the system with the following command:\n\n# yum remove ypserv</fixtext><fix id=\"F-4567r88522_fix\" /><check system=\"C-4567r88521_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>The NIS service provides an unencrypted authentication service that does not provide for the confidentiality and integrity of user passwords or the remote session.\n\nCheck to see if the \"ypserve\" package is installed with the following command:\n\n# yum list installed ypserv\n\nIf the \"ypserv\" package is installed, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204444\"><title>SRG-OS-000324-GPOS-00125</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204444r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020020</version><title>The Red Hat Enterprise Linux operating system must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.</title><description>&lt;VulnDiscussion&gt;Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86595</ident><ident system=\"http://cyber.mil/legacy\">V-71971</ident><ident system=\"http://cyber.mil/cci\">CCI-002165</ident><ident system=\"http://cyber.mil/cci\">CCI-002235</ident><fixtext fixref=\"F-4568r88525_fix\">Configure the operating system to prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.\n\nUse the following command to map a new user to the \"sysdam_u\" role: \n\n#semanage login -a -s sysadm_u &lt;username&gt;\n\nUse the following command to map an existing user to the \"sysdam_u\" role:\n\n#semanage login -m -s sysadm_u &lt;username&gt;\n\nUse the following command to map a new user to the \"staff_u\" role:\n\n#semanage login -a -s staff_u &lt;username&gt;\n\nUse the following command to map an existing user to the \"staff_u\" role:\n\n#semanage login -m -s staff_u &lt;username&gt;\n\nUse the following command to map a new user to the \"user_u\" role:\n\n# semanage login -a -s user_u &lt;username&gt;\n\nUse the following command to map an existing user to the \"user_u\" role:\n\n# semanage login -m -s user_u &lt;username&gt;</fixtext><fix id=\"F-4568r88525_fix\" /><check system=\"C-4568r88524_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>If an HBSS or HIPS is active on the system, this is Not Applicable.\n\nVerify the operating system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.\n\nGet a list of authorized users (other than System Administrator and guest accounts) for the system.\n\nCheck the list against the system by using the following command:\n\n# semanage login -l | more\nLogin Name SELinux User MLS/MCS Range Service\n__default__ user_u s0-s0:c0.c1023 *\nroot unconfined_u s0-s0:c0.c1023 *\nsystem_u system_u s0-s0:c0.c1023 *\njoe staff_u s0-s0:c0.c1023 *\n\nAll administrators must be mapped to the \"sysadm_u\" or \"staff_u\" users role.\n\nAll authorized non-administrative users must be mapped to the \"user_u\" role.\n\nIf they are not mapped in this way, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204445\"><title>SRG-OS-000363-GPOS-00150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204445r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020030</version><title>The Red Hat Enterprise Linux operating system must be configured so that a file integrity tool verifies the baseline operating system configuration at least weekly.</title><description>&lt;VulnDiscussion&gt;Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\n\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86597</ident><ident system=\"http://cyber.mil/legacy\">V-71973</ident><ident system=\"http://cyber.mil/cci\">CCI-001744</ident><fixtext fixref=\"F-4569r88528_fix\">Configure the file integrity tool to run automatically on the system at least weekly. The following example output is generic. It will set cron to run AIDE daily, but other file integrity tools may be used:  \n\n# more /etc/cron.daily/aide\n#!/bin/bash\n\n/usr/sbin/aide --check | /bin/mail -s \"$HOSTNAME - Daily aide integrity check run\" root@sysname.mil</fixtext><fix id=\"F-4569r88528_fix\" /><check system=\"C-4569r88527_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system routinely checks the baseline configuration for unauthorized changes.\n\nNote: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed at least once per week.\n\nCheck to see if AIDE is installed on the system with the following command:\n\n# yum list installed aide\n\nIf AIDE is not installed, ask the SA how file integrity checks are performed on the system.\n\nCheck for the presence of a cron job running daily or weekly on the system that executes AIDE daily to scan for changes to the system baseline. The command used in the example will use a daily occurrence.\n\nCheck the cron directories for a script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:\n\n# ls -al /etc/cron.* | grep aide\n-rwxr-xr-x 1 root root 29 Nov 22 2015 aide\n\n# grep aide /etc/crontab /var/spool/cron/root\n/etc/crontab: 30 04 * * * /root/aide\n/var/spool/cron/root: 30 04 * * * /root/aide\n\nIf the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204446\"><title>SRG-OS-000363-GPOS-00150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204446r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020040</version><title>The Red Hat Enterprise Linux operating system must be configured so that designated personnel are notified if baseline configurations are changed in an unauthorized manner.</title><description>&lt;VulnDiscussion&gt;Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\n\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86599</ident><ident system=\"http://cyber.mil/legacy\">V-71975</ident><ident system=\"http://cyber.mil/cci\">CCI-001744</ident><fixtext fixref=\"F-4570r88531_fix\">Configure the operating system to notify designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system. \n\nThe following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis. \n\n# more /etc/cron.daily/aide\n\n/usr/sbin/aide --check | /bin/mail -s \"$HOSTNAME - Daily aide integrity check run\" root@sysname.mil</fixtext><fix id=\"F-4570r88531_fix\" /><check system=\"C-4570r88530_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system notifies designated personnel if baseline configurations are changed in an unauthorized manner.\n\nNote: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed and notify specified individuals via email or an alert.\n\nCheck to see if AIDE is installed on the system with the following command:\n\n# yum list installed aide\n\nIf AIDE is not installed, ask the SA how file integrity checks are performed on the system. \n\nCheck for the presence of a cron job running routinely on the system that executes AIDE to scan for changes to the system baseline. The commands used in the example will use a daily occurrence.\n\nCheck the cron directories for a \"crontab\" script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:\n\n# ls -al /etc/cron.* | grep aide\n-rwxr-xr-x 1 root root 32 Jul 1 2011 aide\n\n# grep aide /etc/crontab /var/spool/cron/root\n/etc/crontab: 30 04 * * * /root/aide\n/var/spool/cron/root: 30 04 * * * /root/aide\n\nAIDE does not have a configuration that will send a notification, so the cron job uses the mail application on the system to email the results of the file integrity run as in the following example:\n\n# more /etc/cron.daily/aide\n#!/bin/bash\n\n/usr/sbin/aide --check | /bin/mail -s \"$HOSTNAME - Daily aide integrity check run\" root@sysname.mil\n\nIf the file integrity application does not notify designated personnel of changes, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204447\"><title>SRG-OS-000366-GPOS-00153</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204447r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-020050</version><title>The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that</title><description>&lt;VulnDiscussion&gt;Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor.\n\nAccordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.\n\nVerifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86601</ident><ident system=\"http://cyber.mil/legacy\">V-71977</ident><ident system=\"http://cyber.mil/cci\">CCI-001749</ident><fixtext fixref=\"F-4571r88534_fix\">Configure the operating system to verify the signature of packages from a repository prior to install by setting the following option in the \"/etc/yum.conf\" file:\n\ngpgcheck=1</fixtext><fix id=\"F-4571r88534_fix\" /><check system=\"C-4571r88533_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components from a repository without verification that they have been digitally signed using a certificate that is recognized and approved by the organization.\n\nCheck that yum verifies the signature of packages from a repository prior to install with the following command:\n\n# grep gpgcheck /etc/yum.conf\ngpgcheck=1\n\nIf \"gpgcheck\" is not set to \"1\", or if options are missing or commented out, ask the System Administrator how the certificates for patches and other operating system components are verified. \n\nIf there is no process to validate certificates that is approved by the organization, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204448\"><title>SRG-OS-000366-GPOS-00153</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204448r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-020060</version><title>The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that</title><description>&lt;VulnDiscussion&gt;Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor.\n\nAccordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.\n\nVerifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86603</ident><ident system=\"http://cyber.mil/legacy\">V-71979</ident><ident system=\"http://cyber.mil/cci\">CCI-001749</ident><fixtext fixref=\"F-4572r88537_fix\">Configure the operating system to verify the signature of local packages prior to install by setting the following option in the \"/etc/yum.conf\" file:\n\nlocalpkg_gpgcheck=1</fixtext><fix id=\"F-4572r88537_fix\" /><check system=\"C-4572r88536_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components of local packages without verification that they have been digitally signed using a certificate that is recognized and approved by the organization.\n\nCheck that yum verifies the signature of local packages prior to install with the following command:\n\n# grep localpkg_gpgcheck /etc/yum.conf\nlocalpkg_gpgcheck=1\n\nIf \"localpkg_gpgcheck\" is not set to \"1\", or if options are missing or commented out, ask the System Administrator how the signatures of local packages and other operating system components are verified. \n\nIf there is no process to validate the signatures of local packages that is approved by the organization, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204449\"><title>SRG-OS-000114-GPOS-00059</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204449r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020100</version><title>The Red Hat Enterprise Linux operating system must be configured to disable USB mass storage.</title><description>&lt;VulnDiscussion&gt;USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity.\n\nSatisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71983</ident><ident system=\"http://cyber.mil/legacy\">SV-86607</ident><ident system=\"http://cyber.mil/cci\">CCI-000778</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><ident system=\"http://cyber.mil/cci\">CCI-001958</ident><fixtext fixref=\"F-4573r88540_fix\">Configure the operating system to disable the ability to use the USB Storage kernel module.\n\nCreate a file under \"/etc/modprobe.d\" with the following command:\n\n# touch /etc/modprobe.d/usb-storage.conf\n\nAdd the following line to the created file:\n\ninstall usb-storage /bin/true\n\nConfigure the operating system to disable the ability to use USB mass storage devices.\n\n# vi /etc/modprobe.d/blacklist.conf\n\nAdd or update the line:\n\nblacklist usb-storage</fixtext><fix id=\"F-4573r88540_fix\" /><check system=\"C-4573r88539_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>If there is an HBSS with a Device Control Module and a Data Loss Prevention mechanism, this requirement is not applicable.\n\nVerify the operating system disables the ability to load the USB Storage kernel module.\n\n# grep -r usb-storage /etc/modprobe.d/* | grep -i \"/bin/true\" | grep -v \"^#\"\n\ninstall usb-storage /bin/true\n\nIf the command does not return any output, or the line is commented out, and use of USB Storage is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\n\nVerify the operating system disables the ability to use USB mass storage devices.\n\nCheck to see if USB mass storage is disabled with the following command:\n\n# grep usb-storage /etc/modprobe.d/* | grep -i \"blacklist\" | grep -v \"^#\"\nblacklist usb-storage\n\nIf the command does not return any output or the output is not \"blacklist usb-storage\", and use of USB storage devices is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204450\"><title>SRG-OS-000378-GPOS-00163</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204450r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020101</version><title>The Red Hat Enterprise Linux operating system must be configured so that the Datagram Congestion Control Protocol (DCCP) kernel module is disabled unless required.</title><description>&lt;VulnDiscussion&gt;Disabling DCCP protects the system against exploitation of any flaws in the protocol implementation.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-77821</ident><ident system=\"http://cyber.mil/legacy\">SV-92517</ident><ident system=\"http://cyber.mil/cci\">CCI-001958</ident><fixtext fixref=\"F-4574r88543_fix\">Configure the operating system to disable the ability to use the DCCP kernel module.\n\nCreate a file under \"/etc/modprobe.d\" with the following command:\n\n# touch /etc/modprobe.d/dccp.conf\n\nAdd the following line to the created file:\n\ninstall dccp /bin/true\n\nEnsure that the DCCP module is blacklisted: \n\n# vi /etc/modprobe.d/blacklist.conf\n\nAdd or update the line:\n\nblacklist dccp</fixtext><fix id=\"F-4574r88543_fix\" /><check system=\"C-4574r88542_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system disables the ability to load the DCCP kernel module.\n\n# grep -r dccp /etc/modprobe.d/* | grep -i \"/bin/true\" | grep -v \"^#\"\n\ninstall dccp /bin/true\n\nIf the command does not return any output, or the line is commented out, and use of DCCP is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\n\nVerify the operating system disables the ability to use the DCCP kernel module.\n\nCheck to see if the DCCP kernel module is disabled with the following command:\n\n# grep -i dccp /etc/modprobe.d/* | grep -i \"blacklist\" | grep -v \"^#\"\n\nblacklist dccp\n\nIf the command does not return any output or the output is not \"blacklist dccp\", and use of the dccp kernel module is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204451\"><title>SRG-OS-000114-GPOS-00059</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204451r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020110</version><title>The Red Hat Enterprise Linux operating system must disable the file system automounter unless required.</title><description>&lt;VulnDiscussion&gt;Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.\n\nSatisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71985</ident><ident system=\"http://cyber.mil/legacy\">SV-86609</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><ident system=\"http://cyber.mil/cci\">CCI-000778</ident><ident system=\"http://cyber.mil/cci\">CCI-001958</ident><fixtext fixref=\"F-4575r88546_fix\">Configure the operating system to disable the ability to automount devices.\n\nTurn off the automount service with the following commands:\n\n# systemctl stop autofs\n# systemctl disable autofs\n\nIf \"autofs\" is required for Network File System (NFS), it must be documented with the ISSO.</fixtext><fix id=\"F-4575r88546_fix\" /><check system=\"C-4575r88545_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system disables the ability to automount devices.\n\nCheck to see if automounter service is active with the following command:\n\n# systemctl status autofs\nautofs.service - Automounts filesystems on demand\n   Loaded: loaded (/usr/lib/systemd/system/autofs.service; disabled)\n   Active: inactive (dead)\n\nIf the \"autofs\" status is set to \"active\" and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204452\"><title>SRG-OS-000437-GPOS-00194</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204452r241939_rule\" weight=\"10.0\" severity=\"low\"><version>RHEL-07-020200</version><title>The Red Hat Enterprise Linux operating system must remove all software components after updated versions have been installed.</title><description>&lt;VulnDiscussion&gt;Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products may remove older versions of software automatically from the information system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71987</ident><ident system=\"http://cyber.mil/legacy\">SV-86611</ident><ident system=\"http://cyber.mil/cci\">CCI-002617</ident><fixtext fixref=\"F-4576r88549_fix\">Configure the operating system to remove all software components after updated versions have been installed.\n\nSet the \"clean_requirements_on_remove\" option to \"1\" in the \"/etc/yum.conf\" file:\n\nclean_requirements_on_remove=1</fixtext><fix id=\"F-4576r88549_fix\" /><check system=\"C-4576r88548_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system removes all software components after updated versions have been installed.\n\nCheck if yum is configured to remove unneeded packages with the following command:\n\n# grep -i clean_requirements_on_remove /etc/yum.conf\nclean_requirements_on_remove=1\n\nIf \"clean_requirements_on_remove\" is not set to \"1\", \"True\", or \"yes\", or is not set in \"/etc/yum.conf\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204453\"><title>SRG-OS-000445-GPOS-00199</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204453r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-020210</version><title>The Red Hat Enterprise Linux operating system must enable SELinux.</title><description>&lt;VulnDiscussion&gt;Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\n\nThis requirement applies to operating systems performing security function verification/testing and/or systems and environments that require this functionality.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71989</ident><ident system=\"http://cyber.mil/legacy\">SV-86613</ident><ident system=\"http://cyber.mil/cci\">CCI-002696</ident><ident system=\"http://cyber.mil/cci\">CCI-002165</ident><fixtext fixref=\"F-4577r88552_fix\">Configure the operating system to verify correct operation of all security functions.\n\nSet the \"SELinux\" status and the \"Enforcing\" mode by modifying the \"/etc/selinux/config\" file to have the following line:\n\nSELINUX=enforcing\n\nA reboot is required for the changes to take effect.</fixtext><fix id=\"F-4577r88552_fix\" /><check system=\"C-4577r88551_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>If an HBSS or HIPS is active on the system, this is Not Applicable.\n\nVerify the operating system verifies correct operation of all security functions.\n\nCheck if \"SELinux\" is active and in \"Enforcing\" mode with the following command:\n\n# getenforce\nEnforcing\n\nIf \"SELinux\" is not active and not in \"Enforcing\" mode, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204454\"><title>SRG-OS-000445-GPOS-00199</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204454r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-020220</version><title>The Red Hat Enterprise Linux operating system must enable the SELinux targeted policy.</title><description>&lt;VulnDiscussion&gt;Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\n\nThis requirement applies to operating systems performing security function verification/testing and/or systems and environments that require this functionality.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71991</ident><ident system=\"http://cyber.mil/legacy\">SV-86615</ident><ident system=\"http://cyber.mil/cci\">CCI-002696</ident><ident system=\"http://cyber.mil/cci\">CCI-002165</ident><fixtext fixref=\"F-4578r88555_fix\">Configure the operating system to verify correct operation of all security functions.\n\nSet the \"SELinuxtype\" to the \"targeted\" policy by modifying the \"/etc/selinux/config\" file to have the following line:\n\nSELINUXTYPE=targeted\n\nA reboot is required for the changes to take effect.</fixtext><fix id=\"F-4578r88555_fix\" /><check system=\"C-4578r88554_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>If an HBSS or HIPS is active on the system, this is Not Applicable.\n\nVerify the operating system verifies correct operation of all security functions.\n\nCheck if \"SELinux\" is active and is enforcing the targeted policy with the following command:\n\n# sestatus\n\nSELinux status: enabled\n\nSELinuxfs mount: /selinux\n\nSELinux root directory: /etc/selinux\n\nLoaded policy name: targeted\n\nCurrent mode: enforcing\n\nMode from config file: enforcing\n\nPolicy MLS status: enabled\n\nPolicy deny_unknown status: allowed\n\nMax kernel policy version: 28\n\nIf the \"Loaded policy name\" is not set to \"targeted\", this is a finding.\n\nVerify that the /etc/selinux/config file is configured to the \"SELINUXTYPE\" to \"targeted\":\n\n# grep -i \"selinuxtype\" /etc/selinux/config | grep -v '^#'\n\nSELINUXTYPE = targeted\n\nIf no results are returned or \"SELINUXTYPE\" is not set to \"targeted\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204455\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204455r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-020230</version><title>The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled on the command line.</title><description>&lt;VulnDiscussion&gt;A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71993</ident><ident system=\"http://cyber.mil/legacy\">SV-86617</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4579r88558_fix\">Configure the system to disable the Ctrl-Alt-Delete sequence for the command line with the following command:\n\n# systemctl mask ctrl-alt-del.target</fixtext><fix id=\"F-4579r88558_fix\" /><check system=\"C-4579r88557_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed.\n\nCheck that the ctrl-alt-del.target is masked and not active with the following command:\n\n# systemctl status ctrl-alt-del.target\n\nctrl-alt-del.target\nLoaded: masked (/dev/null; bad)\nActive: inactive (dead)\n\nIf the ctrl-alt-del.target is not masked, this is a finding.\n\nIf the ctrl-alt-del.target is active, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204456\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204456r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-020231</version><title>The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled in the GUI.</title><description>&lt;VulnDiscussion&gt;A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-94843</ident><ident system=\"http://cyber.mil/legacy\">SV-104673</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4580r88561_fix\">Configure the system to disable the Ctrl-Alt-Delete sequence for the GUI with the following command:\n\n# touch /etc/dconf/db/local.d/00-disable-CAD \n\nAdd the setting to disable the Ctrl-Alt-Delete sequence for GNOME:\n\n[org/gnome/settings-daemon/plugins/media-keys]\nlogout=''</fixtext><fix id=\"F-4580r88561_fix\" /><check system=\"C-4580r88560_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed.\n\nCheck that the ctrl-alt-del.target is masked and not active in the GUI with the following command:\n\n# grep logout /etc/dconf/local.d/*\n\nlogout=''\n\nIf \"logout\" is not set to use two single quotations, or is missing, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204457\"><title>SRG-OS-000480-GPOS-00228</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204457r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020240</version><title>The Red Hat Enterprise Linux operating system must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.</title><description>&lt;VulnDiscussion&gt;Setting the most restrictive default permissions ensures that when new accounts are created, they do not have unnecessary access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71995</ident><ident system=\"http://cyber.mil/legacy\">SV-86619</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4581r88564_fix\">Configure the operating system to define default permissions for all authenticated users in such a way that the user can only read and modify their own files.\n\nAdd or edit the line for the \"UMASK\" parameter in \"/etc/login.defs\" file to \"077\":\n\nUMASK  077</fixtext><fix id=\"F-4581r88564_fix\" /><check system=\"C-4581r88563_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system defines default permissions for all authenticated users in such a way that the user can only read and modify their own files.\n\nCheck for the value of the \"UMASK\" parameter in \"/etc/login.defs\" file with the following command:\n\nNote: If the value of the \"UMASK\" parameter is set to \"000\" in \"/etc/login.defs\" file, the Severity is raised to a CAT I.\n\n# grep -i umask /etc/login.defs\nUMASK  077\n\nIf the value for the \"UMASK\" parameter is not \"077\", or the \"UMASK\" parameter is missing or is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204458\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204458r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-020250</version><title>The Red Hat Enterprise Linux operating system must be a vendor supported release.</title><description>&lt;VulnDiscussion&gt;An operating system release is considered \"supported\" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71997</ident><ident system=\"http://cyber.mil/legacy\">SV-86621</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4582r88567_fix\">Upgrade to a supported version of the operating system.</fixtext><fix id=\"F-4582r88567_fix\" /><check system=\"C-4582r88566_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the version of the operating system is vendor supported.\n\nCheck the version of the operating system with the following command:\n\n# cat /etc/redhat-release\n\nRed Hat Enterprise Linux Server release 7.4 (Maipo)\n\nCurrent End of Life for RHEL 7.1 is 31 March 2017.\n\nCurrent End of Life for RHEL 7.2 is 30 November 2017.\n\nCurrent End of Life for RHEL 7.3 is 30 November 2018.\n\nCurrent End of Life for RHEL 7.4 is 31 August 2019.\n\nCurrent End of Life for RHEL 7.5 is 30 April 2020.\n\nCurrent End of Life for RHEL 7.6 is 31 October 2020.\n\nCurrent End of Life for RHEL 7.7 is 30 August 2021.\n\nIf the release is not supported by the vendor, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204459\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204459r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020260</version><title>The Red Hat Enterprise Linux operating system security patches and updates must be installed and up to date.</title><description>&lt;VulnDiscussion&gt;Timely patching is critical for maintaining the operational availability, confidentiality, and integrity of information technology (IT) systems. However, failure to keep operating system and application software patched is a common mistake made by IT professionals. New patches are released daily, and it is often difficult for even experienced System Administrators to keep abreast of all the new patches. When new weaknesses in an operating system exist, patches are usually made available by the vendor to resolve the problems. If the most recent security patches and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The lack of prompt attention to patching could result in a system compromise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86623</ident><ident system=\"http://cyber.mil/legacy\">V-71999</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4583r88570_fix\">Install the operating system patches or updated packages available from Red Hat within 30 days or sooner as local policy dictates.</fixtext><fix id=\"F-4583r88570_fix\" /><check system=\"C-4583r88569_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system security patches and updates are installed and up to date. Updates are required to be applied with a frequency determined by the site or Program Management Office (PMO). \n\nObtain the list of available package security updates from Red Hat. The URL for updates is https://rhn.redhat.com/errata/. It is important to note that updates provided by Red Hat may not be present on the system if the underlying packages are not installed.\n\nCheck that the available package security updates have been installed on the system with the following command:\n\n# yum history list | more\nLoaded plugins: langpacks, product-id, subscription-manager\nID     | Command line             | Date and time    | Action(s)      | Altered\n-------------------------------------------------------------------------------\n    70 | install aide             | 2016-05-05 10:58 | Install       |     1   \n    69 | update -y                | 2016-05-04 14:34 | Update     |   18 EE\n    68 | install vlc                | 2016-04-21 17:12 | Install        |   21   \n    67 | update -y                | 2016-04-21 17:04 | Update     |     7 EE\n    66 | update -y                | 2016-04-15 16:47 | E, I, U         |   84 EE\n\nIf package updates have not been performed on the system within the timeframe that the site/program documentation requires, this is a finding. \n\nTypical update frequency may be overridden by Information Assurance Vulnerability Alert (IAVA) notifications from CYBERCOM.\n\nIf the operating system is in non-compliance with the Information Assurance Vulnerability Management (IAVM) process, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204460\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204460r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020270</version><title>The Red Hat Enterprise Linux operating system must not have unnecessary accounts.</title><description>&lt;VulnDiscussion&gt;Accounts providing no operational purpose provide additional opportunities for system compromise. Unnecessary accounts include user accounts for individuals not requiring access to the system and application accounts for applications not installed on the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86625</ident><ident system=\"http://cyber.mil/legacy\">V-72001</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4584r88573_fix\">Configure the system so all accounts on the system are assigned to an active system, application, or user account. \n\nRemove accounts that do not support approved system activities or that allow for a normal user to perform administrative-level actions. \n\nDocument all authorized accounts on the system.</fixtext><fix id=\"F-4584r88573_fix\" /><check system=\"C-4584r88572_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify all accounts on the system are assigned to an active system, application, or user account.\n\nObtain the list of authorized system accounts from the Information System Security Officer (ISSO).\n\nCheck the system accounts on the system with the following command:\n\n# more /etc/passwd\nroot:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown\nhalt:x:7:0:halt:/sbin:/sbin/halt\ngames:x:12:100:games:/usr/games:/sbin/nologin\ngopher:x:13:30:gopher:/var/gopher:/sbin/nologin\n\nAccounts such as \"games\" and \"gopher\" are not authorized accounts as they do not support authorized system functions. \n\nIf the accounts on the system do not match the provided documentation, or accounts that do not support an authorized system function are present, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204461\"><title>SRG-OS-000104-GPOS-00051</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204461r241939_rule\" weight=\"10.0\" severity=\"low\"><version>RHEL-07-020300</version><title>The Red Hat Enterprise Linux operating system must be configured so that all Group Identifiers (GIDs) referenced in the /etc/passwd file are defined in the /etc/group file.</title><description>&lt;VulnDiscussion&gt;If a user is assigned the GID of a group not existing on the system, and a group with the GID is subsequently created, the user may have unintended rights to any files associated with the group.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86627</ident><ident system=\"http://cyber.mil/legacy\">V-72003</ident><ident system=\"http://cyber.mil/cci\">CCI-000764</ident><fixtext fixref=\"F-4585r88576_fix\">Configure the system to define all GIDs found in the \"/etc/passwd\" file by modifying the \"/etc/group\" file to add any non-existent group referenced in the \"/etc/passwd\" file, or change the GIDs referenced in the \"/etc/passwd\" file to a group that exists in \"/etc/group\".</fixtext><fix id=\"F-4585r88576_fix\" /><check system=\"C-4585r88575_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify all GIDs referenced in the \"/etc/passwd\" file are defined in the \"/etc/group\" file.\n\nCheck that all referenced GIDs exist with the following command:\n\n# pwck -r\n\nIf GIDs referenced in \"/etc/passwd\" file are returned as not defined in \"/etc/group\" file, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204462\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204462r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-020310</version><title>The Red Hat Enterprise Linux operating system must be configured so that the root account must be the only account having unrestricted access to the system.</title><description>&lt;VulnDiscussion&gt;If an account other than root also has a User Identifier (UID) of \"0\", it has root authority, giving that account unrestricted access to the entire operating system. Multiple accounts with a UID of \"0\" afford an opportunity for potential intruders to guess a password for a privileged account.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86629</ident><ident system=\"http://cyber.mil/legacy\">V-72005</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4586r88579_fix\">Change the UID of any account on the system, other than root, that has a UID of \"0\". \n\nIf the account is associated with system commands or applications, the UID should be changed to one greater than \"0\" but less than \"1000\". Otherwise, assign a UID of greater than \"1000\" that has not already been assigned.</fixtext><fix id=\"F-4586r88579_fix\" /><check system=\"C-4586r88578_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Check the system for duplicate UID \"0\" assignments with the following command:\n\n# awk -F: '$3 == 0 {print $1}' /etc/passwd\n\nIf any accounts other than root have a UID of \"0\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204463\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204463r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020320</version><title>The Red Hat Enterprise Linux operating system must be configured so that all files and directories have a valid owner.</title><description>&lt;VulnDiscussion&gt;Unowned files and directories may be unintentionally inherited if a user is assigned the same User Identifier \"UID\" as the UID of the un-owned files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86631</ident><ident system=\"http://cyber.mil/legacy\">V-72007</ident><ident system=\"http://cyber.mil/cci\">CCI-002165</ident><fixtext fixref=\"F-4587r88582_fix\">Either remove all files and directories from the system that do not have a valid user, or assign a valid user to all unowned files and directories on the system with the \"chown\" command:\n\n# chown &lt;user&gt; &lt;file&gt;</fixtext><fix id=\"F-4587r88582_fix\" /><check system=\"C-4587r88581_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify all files and directories on the system have a valid owner.\n\nCheck the owner of all files and directories with the following command:\n\nNote: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\n\n# find / -fstype xfs -nouser\n\nIf any files on the system do not have an assigned owner, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204464\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204464r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020330</version><title>The Red Hat Enterprise Linux operating system must be configured so that all files and directories have a valid group owner.</title><description>&lt;VulnDiscussion&gt;Files without a valid group owner may be unintentionally inherited if a group is assigned the same Group Identifier (GID) as the GID of the files without a valid group owner.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86633</ident><ident system=\"http://cyber.mil/legacy\">V-72009</ident><ident system=\"http://cyber.mil/cci\">CCI-002165</ident><fixtext fixref=\"F-4588r88585_fix\">Either remove all files and directories from the system that do not have a valid group, or assign a valid group to all files and directories on the system with the \"chgrp\" command:\n\n# chgrp &lt;group&gt; &lt;file&gt;</fixtext><fix id=\"F-4588r88585_fix\" /><check system=\"C-4588r88584_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify all files and directories on the system have a valid group.\n\nCheck the owner of all files and directories with the following command:\n\nNote: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\n\n# find / -fstype xfs -nogroup\n\nIf any files on the system do not have an assigned group, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204465\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204465r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020600</version><title>The Red Hat Enterprise Linux operating system must be configured so that all local interactive users have a home directory assigned in the /etc/passwd file.</title><description>&lt;VulnDiscussion&gt;If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86635</ident><ident system=\"http://cyber.mil/legacy\">V-72011</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4589r88588_fix\">Assign home directories to all local interactive users that currently do not have a home directory assigned.</fixtext><fix id=\"F-4589r88588_fix\" /><check system=\"C-4589r88587_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify local interactive users on the system have a home directory assigned.\n\nCheck for missing local interactive user home directories with the following command:\n\n# pwck -r\nuser 'lp': directory '/var/spool/lpd' does not exist\nuser 'news': directory '/var/spool/news' does not exist\nuser 'uucp': directory '/var/spool/uucp' does not exist\nuser 'smithj': directory '/home/smithj' does not exist\n\nAsk the System Administrator (SA) if any users found without home directories are local interactive users. If the SA is unable to provide a response, check for users with a User Identifier (UID) of 1000 or greater with the following command:\n\n# cut -d: -f 1,3 /etc/passwd | egrep \":[1-4][0-9]{2}$|:[0-9]{1,2}$\"\n\nIf any interactive users do not have a home directory assigned, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204466\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204466r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020610</version><title>The Red Hat Enterprise Linux operating system must be configured so that all local interactive user accounts, upon creation, are assigned a home directory.</title><description>&lt;VulnDiscussion&gt;If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86637</ident><ident system=\"http://cyber.mil/legacy\">V-72013</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4590r88591_fix\">Configure the operating system to assign home directories to all new local interactive users by setting the \"CREATE_HOME\" parameter in \"/etc/login.defs\" to \"yes\" as follows.\n\nCREATE_HOME yes</fixtext><fix id=\"F-4590r88591_fix\" /><check system=\"C-4590r88590_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify all local interactive users on the system are assigned a home directory upon creation.\n\nCheck to see if the system is configured to create home directories for local interactive users with the following command:\n\n# grep -i create_home /etc/login.defs\nCREATE_HOME yes\n\nIf the value for \"CREATE_HOME\" parameter is not set to \"yes\", the line is missing, or the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204467\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204467r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020620</version><title>The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are defined in the /etc/passwd file.</title><description>&lt;VulnDiscussion&gt;If a local interactive user has a home directory defined that does not exist, the user may be given access to the / directory as the current working directory upon logon. This could create a Denial of Service because the user would not be able to access their logon configuration files, and it may give them visibility to system files they normally would not be able to access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86639</ident><ident system=\"http://cyber.mil/legacy\">V-72015</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4591r88594_fix\">Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in \"/etc/ passwd\":\n\nNote: The example will be for the user smithj, who has a home directory of \"/home/smithj\", a UID of \"smithj\", and a Group Identifier (GID) of \"users\" assigned in \"/etc/passwd\".\n\n# mkdir /home/smithj \n# chown smithj /home/smithj\n# chgrp users /home/smithj\n# chmod 0750 /home/smithj</fixtext><fix id=\"F-4591r88594_fix\" /><check system=\"C-4591r88593_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the assigned home directory of all local interactive users on the system exists.\n\nCheck the home directory assignment for all local interactive non-privileged users on the system with the following command:\n\n# cut -d: -f 1,3,6 /etc/passwd | egrep \":[1-4][0-9]{3}\"\n\nsmithj:1001:/home/smithj\n\nNote: This may miss interactive users that have been assigned a privileged UID. Evidence of interactive use may be obtained from a number of log files containing system logon information.\n\nCheck that all referenced home directories exist with the following command:\n\n# pwck -r\nuser 'smithj': directory '/home/smithj' does not exist\n\nIf any home directories referenced in \"/etc/passwd\" are returned as not defined, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204468\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204468r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020630</version><title>The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories have mode 0750 or less permissive.</title><description>&lt;VulnDiscussion&gt;Excessive permissions on local interactive user home directories may allow unauthorized access to user files by other users.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86641</ident><ident system=\"http://cyber.mil/legacy\">V-72017</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4592r88597_fix\">Change the mode of interactive user's home directories to \"0750\". To change the mode of a local interactive user's home directory, use the following command:\n\nNote: The example will be for the user \"smithj\".\n\n# chmod 0750 /home/smithj</fixtext><fix id=\"F-4592r88597_fix\" /><check system=\"C-4592r88596_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the assigned home directory of all local interactive users has a mode of \"0750\" or less permissive.\n\nCheck the home directory assignment for all non-privileged users on the system with the following command:\n\nNote: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information.\n\n# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6)\n-rwxr-x--- 1 smithj users  18 Mar  5 17:06 /home/smithj\n\nIf home directories referenced in \"/etc/passwd\" do not have a mode of \"0750\" or less permissive, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204469\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204469r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020640</version><title>The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are owned by their respective users.</title><description>&lt;VulnDiscussion&gt;If a local interactive user does not own their home directory, unauthorized users could access or modify the user's files, and the users may not be able to access their own files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86643</ident><ident system=\"http://cyber.mil/legacy\">V-72019</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4593r88600_fix\">Change the owner of a local interactive user's home directories to that owner. To change the owner of a local interactive user's home directory, use the following command:\n\nNote: The example will be for the user smithj, who has a home directory of \"/home/smithj\".\n\n# chown smithj /home/smithj</fixtext><fix id=\"F-4593r88600_fix\" /><check system=\"C-4593r88599_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the assigned home directory of all local interactive users on the system exists.\n\nCheck the home directory assignment for all local interactive users on the system with the following command:\n\n# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6)\n\n-rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj\n\nIf any home directories referenced in \"/etc/passwd\" are not owned by the interactive user, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204470\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204470r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020650</version><title>The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home directories are group-owned by the home directory owners primary group.</title><description>&lt;VulnDiscussion&gt;If the Group Identifier (GID) of a local interactive user's home directory is not the same as the primary GID of the user, this would allow unauthorized access to the user's files, and users that share the same group may not be able to access files that they legitimately should.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72021</ident><ident system=\"http://cyber.mil/legacy\">SV-86645</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4594r88603_fix\">Change the group owner of a local interactive user's home directory to the group found in \"/etc/passwd\". To change the group owner of a local interactive user's home directory, use the following command:\n\nNote: The example will be for the user \"smithj\", who has a home directory of \"/home/smithj\", and has a primary group of users.\n\n# chgrp users /home/smithj</fixtext><fix id=\"F-4594r88603_fix\" /><check system=\"C-4594r88602_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the assigned home directory of all local interactive users is group-owned by that user's primary GID.\n\nCheck the home directory assignment for all local interactive users on the system with the following command:\n\n# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6)\n\n-rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj\n\nCheck the user's primary group with the following command:\n\n# grep users /etc/group\n\nusers:x:250:smithj,jonesj,jacksons\n\nIf the user home directory referenced in \"/etc/passwd\" is not group-owned by that user's primary GID, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204471\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204471r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020660</version><title>The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories are owned by the owner of the home directory.</title><description>&lt;VulnDiscussion&gt;If local interactive users do not own the files in their directories, unauthorized users may be able to access them. Additionally, if files are not owned by the user, this could be an indication of system compromise.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72023</ident><ident system=\"http://cyber.mil/legacy\">SV-86647</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4595r88606_fix\">Change the owner of a local interactive user's files and directories to that owner. To change the owner of a local interactive user's files and directories, use the following command:\n\nNote: The example will be for the user smithj, who has a home directory of \"/home/smithj\".\n\n# chown smithj /home/smithj/&lt;file or directory&gt;</fixtext><fix id=\"F-4595r88606_fix\" /><check system=\"C-4595r88605_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify all files and directories in a local interactive user's home directory are owned by the user.\n\nCheck the owner of all files and directories in a local interactive user's home directory with the following command:\n\nNote: The example will be for the user \"smithj\", who has a home directory of \"/home/smithj\".\n\n# ls -lLR /home/smithj\n-rw-r--r-- 1 smithj smithj  18 Mar  5 17:06 file1\n-rw-r--r-- 1 smithj smithj 193 Mar  5 17:06 file2\n-rw-r--r-- 1 smithj smithj 231 Mar  5 17:06 file3\n\nIf any files are found with an owner different than the home directory user, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204472\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204472r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020670</version><title>The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member.</title><description>&lt;VulnDiscussion&gt;If a local interactive user's files are group-owned by a group of which the user is not a member, unintended users may be able to access them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72025</ident><ident system=\"http://cyber.mil/legacy\">SV-86649</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4596r88609_fix\">Change the group of a local interactive user's files and directories to a group that the interactive user is a member of. To change the group owner of a local interactive user's files and directories, use the following command:\n\nNote: The example will be for the user smithj, who has a home directory of \"/home/smithj\" and is a member of the users group.\n\n# chgrp users /home/smithj/&lt;file&gt;</fixtext><fix id=\"F-4596r88609_fix\" /><check system=\"C-4596r88608_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify all files and directories in a local interactive user home directory are group-owned by a group the user is a member of.\n\nCheck the group owner of all files and directories in a local interactive user's home directory with the following command:\n\nNote: The example will be for the user \"smithj\", who has a home directory of \"/home/smithj\".\n\n# ls -lLR /&lt;home directory&gt;/&lt;users home directory&gt;/\n-rw-r--r-- 1 smithj smithj  18 Mar  5 17:06 file1\n-rw-r--r-- 1 smithj smithj 193 Mar  5 17:06 file2\n-rw-r--r-- 1 smithj sa        231 Mar  5 17:06 file3\n\nIf any files are found with an owner different than the group home directory user, check to see if the user is a member of that group with the following command:\n\n# grep smithj /etc/group\nsa:x:100:juan,shelley,bob,smithj \nsmithj:x:521:smithj\n\nIf the user is not a member of a group that group owns file(s) in a local interactive user's home directory, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204473\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204473r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020680</version><title>The Red Hat Enterprise Linux operating system must be configured so that all files and directories contained in local interactive user home directories have a mode of 0750 or less permissive.</title><description>&lt;VulnDiscussion&gt;If a local interactive user files have excessive permissions, unintended users may be able to access or modify them.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72027</ident><ident system=\"http://cyber.mil/legacy\">SV-86651</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4597r88612_fix\">Set the mode on files and directories in the local interactive user home directory with the following command:\n\nNote: The example will be for the user smithj, who has a home directory of \"/home/smithj\" and is a member of the users group.\n\n# chmod 0750 /home/smithj/&lt;file&gt;</fixtext><fix id=\"F-4597r88612_fix\" /><check system=\"C-4597r88611_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify all files and directories contained in a local interactive user home directory, excluding local initialization files, have a mode of \"0750\".\n\nCheck the mode of all non-initialization files in a local interactive user home directory with the following command:\n\nFiles that begin with a \".\" are excluded from this requirement.\n\nNote: The example will be for the user \"smithj\", who has a home directory of \"/home/smithj\".\n\n# ls -lLR /home/smithj\n-rwxr-x--- 1 smithj smithj  18 Mar  5 17:06 file1\n-rwxr----- 1 smithj smithj 193 Mar  5 17:06 file2\n-rw-r-x--- 1 smithj smithj 231 Mar  5 17:06 file3\n\nIf any files are found with a mode more permissive than \"0750\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204474\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204474r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020690</version><title>The Red Hat Enterprise Linux operating system must be configured so that all local initialization files for interactive users are owned by the home directory user or root.</title><description>&lt;VulnDiscussion&gt;Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72029</ident><ident system=\"http://cyber.mil/legacy\">SV-86653</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4598r88615_fix\">Set the owner of the local initialization files for interactive users to either the directory owner or root with the following command:\n\nNote: The example will be for the smithj user, who has a home directory of \"/home/smithj\".\n\n# chown smithj /home/smithj/.[^.]*</fixtext><fix id=\"F-4598r88615_fix\" /><check system=\"C-4598r88614_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the local initialization files of all local interactive users are group-owned by that user's primary Group Identifier (GID).\n\nCheck the home directory assignment for all non-privileged users on the system with the following command:\n\nNote: The example will be for the smithj user, who has a home directory of \"/home/smithj\" and a primary group of \"users\".\n\n# cut -d: -f 1,4,6 /etc/passwd | egrep \":[1-4][0-9]{3}\"\nsmithj:1000:/home/smithj\n\n# grep 1000 /etc/group\nusers:x:1000:smithj,jonesj,jacksons \n\nNote: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information.\n\nCheck the group owner of all local interactive user's initialization files with the following command:\n\n# ls -al /home/smithj/.[^.]* | more\n\n-rwxr-xr-x 1 smithj users 896 Mar 10 2011 .profile\n-rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login\n-rwxr-xr-x 1 smithj users 886 Jan 6 2007 .something\n\nIf all local interactive user's initialization files are not group-owned by that user's primary GID, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204475\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204475r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020700</version><title>The Red Hat Enterprise Linux operating system must be configured so that all local initialization files for local interactive users are be group-owned by the users primary group or root.</title><description>&lt;VulnDiscussion&gt;Local initialization files for interactive users are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72031</ident><ident system=\"http://cyber.mil/legacy\">SV-86655</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4599r88618_fix\">Change the group owner of a local interactive user's files to the group found in \"/etc/passwd\" for the user. To change the group owner of a local interactive user's home directory, use the following command:\n\nNote: The example will be for the user smithj, who has a home directory of \"/home/smithj\", and has a primary group of users.\n\n# chgrp users /home/smithj/.[^.]*</fixtext><fix id=\"F-4599r88618_fix\" /><check system=\"C-4599r88617_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the local initialization files of all local interactive users are group-owned by that user's primary Group Identifier (GID).\n\nCheck the home directory assignment for all non-privileged users on the system with the following command:\n\nNote: The example will be for the smithj user, who has a home directory of \"/home/smithj\" and a primary group of \"users\".\n\n# cut -d: -f 1,4,6 /etc/passwd | egrep \":[1-4][0-9]{3}\"\nsmithj:1000:/home/smithj\n\n# grep 1000 /etc/group\nusers:x:1000:smithj,jonesj,jacksons \n\nNote: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information.\n\nCheck the group owner of all local interactive user's initialization files with the following command:\n\n# ls -al /home/smithj/.[^.]* | more\n\n-rwxr-xr-x 1 smithj users 896 Mar 10 2011 .profile\n-rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login\n-rwxr-xr-x 1 smithj users 886 Jan 6 2007 .something\n\nIf all local interactive user's initialization files are not group-owned by that user's primary GID, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204476\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204476r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020710</version><title>The Red Hat Enterprise Linux operating system must be configured so that all local initialization files have mode 0740 or less permissive.</title><description>&lt;VulnDiscussion&gt;Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72033</ident><ident system=\"http://cyber.mil/legacy\">SV-86657</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4600r88621_fix\">Set the mode of the local initialization files to \"0740\" with the following command:\n\nNote: The example will be for the \"smithj\" user, who has a home directory of \"/home/smithj\".\n\n# chmod 0740 /home/smithj/.[^.]*</fixtext><fix id=\"F-4600r88621_fix\" /><check system=\"C-4600r88620_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that all local initialization files have a mode of \"0740\" or less permissive.\n\nCheck the mode on all local initialization files with the following command:\n\nNote: The example will be for the \"smithj\" user, who has a home directory of \"/home/smithj\".\n\n# ls -al /home/smithj/.[^.]* | more\n\n-rwxr----- 1 smithj users 896 Mar 10 2011 .profile\n-rwxr----- 1 smithj users 497 Jan 6 2007 .login\n-rwxr----- 1 smithj users 886 Jan 6 2007 .something\n\nIf any local initialization files have a mode more permissive than \"0740\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204477\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204477r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020720</version><title>The Red Hat Enterprise Linux operating system must be configured so that all local interactive user initialization files executable search paths contain only paths that resolve to the users home directory.</title><description>&lt;VulnDiscussion&gt;The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory (other than the user's home directory), executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two consecutive colons, this is interpreted as the current working directory. If deviations from the default system search path for the local interactive user are required, they must be documented with the Information System Security Officer (ISSO).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72035</ident><ident system=\"http://cyber.mil/legacy\">SV-86659</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4601r88624_fix\">Edit the local interactive user initialization files to change any PATH variable statements that reference directories other than their home directory. \n\nIf a local interactive user requires path variables to reference a directory owned by the application, it must be documented with the ISSO.</fixtext><fix id=\"F-4601r88624_fix\" /><check system=\"C-4601r88623_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that all local interactive user initialization files' executable search path statements do not contain statements that will reference a working directory other than the users' home directory.\n\nCheck the executable search path statement for all local interactive user initialization files in the users' home directory with the following commands:\n\nNote: The example will be for the smithj user, which has a home directory of \"/home/smithj\".\n\n# grep -i path /home/smithj/.*\n/home/smithj/.bash_profile:PATH=$PATH:$HOME/.local/bin:$HOME/bin\n/home/smithj/.bash_profile:export PATH\n\nIf any local interactive user initialization files have executable search path statements that include directories outside of their home directory, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204478\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204478r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020730</version><title>The Red Hat Enterprise Linux operating system must be configured so that local initialization files do not execute world-writable programs.</title><description>&lt;VulnDiscussion&gt;If user start-up files execute world-writable programs, especially in unprotected directories, they could be maliciously modified to destroy user files or otherwise compromise the system at the user level. If the system is compromised at the user level, it is easier to elevate privileges to eventually compromise the system at the root and network level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72037</ident><ident system=\"http://cyber.mil/legacy\">SV-86661</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4602r88627_fix\">Set the mode on files being executed by the local initialization files with the following command:\n\n# chmod 0755 &lt;file&gt;</fixtext><fix id=\"F-4602r88627_fix\" /><check system=\"C-4602r88626_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that local initialization files do not execute world-writable programs.\n\nCheck the system for world-writable files with the following command:\n\n# find / -xdev -perm -002 -type f -exec ls -ld {} \\; | more\n\nFor all files listed, check for their presence in the local initialization files with the following commands:\n\nNote: The example will be for a system that is configured to create users' home directories in the \"/home\" directory.\n\n# grep &lt;file&gt; /home/*/.*\n\nIf any local initialization files are found to reference world-writable files, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204479\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204479r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-020900</version><title>The Red Hat Enterprise Linux operating system must be configured so that all system device files are correctly labeled to prevent unauthorized modification.</title><description>&lt;VulnDiscussion&gt;If an unauthorized or modified device is allowed to exist on the system, there is the possibility the system may perform unintended or unauthorized operations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72039</ident><ident system=\"http://cyber.mil/legacy\">SV-86663</ident><ident system=\"http://cyber.mil/cci\">CCI-000368</ident><ident system=\"http://cyber.mil/cci\">CCI-000318</ident><ident system=\"http://cyber.mil/cci\">CCI-001812</ident><ident system=\"http://cyber.mil/cci\">CCI-001813</ident><ident system=\"http://cyber.mil/cci\">CCI-001814</ident><fixtext fixref=\"F-4603r88630_fix\">Run the following command to determine which package owns the device file:\n\n# rpm -qf &lt;filename&gt;\n\nThe package can be reinstalled from a yum repository using the command:\n\n# sudo yum reinstall &lt;packagename&gt;\n\nAlternatively, the package can be reinstalled from trusted media using the command:\n\n# sudo rpm -Uvh &lt;packagename&gt;</fixtext><fix id=\"F-4603r88630_fix\" /><check system=\"C-4603r88629_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that all system device files are correctly labeled to prevent unauthorized modification.\n\nList all device files on the system that are incorrectly labeled with the following commands:\n\nNote: Device files are normally found under \"/dev\", but applications may place device files in other directories and may necessitate a search of the entire system.\n\n#find /dev -context *:device_t:* \\( -type c -o -type b \\) -printf \"%p %Z\\n\"\n\n#find /dev -context *:unlabeled_t:* \\( -type c -o -type b \\) -printf \"%p %Z\\n\"\n\nNote: There are device files, such as \"/dev/vmci\", that are used when the operating system is a host virtual machine. They will not be owned by a user on the system and require the \"device_t\" label to operate. These device files are not a finding.\n\nIf there is output from either of these commands, other than already noted, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204480\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204480r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-021000</version><title>The Red Hat Enterprise Linux operating system must be configured so that file systems containing user home directories are mounted to prevent files with the setuid and setgid bit set from being executed.</title><description>&lt;VulnDiscussion&gt;The \"nosuid\" mount option causes the system to not execute setuid and setgid files with owner privileges. This option must be used for mounting any file system not containing approved setuid and setguid files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86665</ident><ident system=\"http://cyber.mil/legacy\">V-72041</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4604r88633_fix\">Configure the \"/etc/fstab\" to use the \"nosuid\" option on file systems that contain user home directories.</fixtext><fix id=\"F-4604r88633_fix\" /><check system=\"C-4604r88632_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify file systems that contain user home directories are mounted with the \"nosuid\" option.\n\nFind the file system(s) that contain the user home directories with the following command:\n\nNote: If a separate file system has not been created for the user home directories (user home directories are mounted under \"/\"), this is not a finding as the \"nosuid\" option cannot be used on the \"/\" system.\n\n# cut -d: -f 1,3,6 /etc/passwd | egrep \":[1-4][0-9]{3}\"\nsmithj:1001:/home/smithj\nthomasr:1002:/home/thomasr\n\nCheck the file systems that are mounted at boot time with the following command:\n\n# more /etc/fstab\n\nUUID=a411dc99-f2a1-4c87-9e05-184977be8539 /home   ext4   rw,relatime,discard,data=ordered,nosuid 0 2\n                                                            \nIf a file system found in \"/etc/fstab\" refers to the user home directory file system and it does not have the \"nosuid\" option set, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204481\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204481r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-021010</version><title>The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.</title><description>&lt;VulnDiscussion&gt;The \"nosuid\" mount option causes the system to not execute \"setuid\" and \"setgid\" files with owner privileges. This option must be used for mounting any file system not containing approved \"setuid\" and \"setguid\" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86667</ident><ident system=\"http://cyber.mil/legacy\">V-72043</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4605r88636_fix\">Configure the \"/etc/fstab\" to use the \"nosuid\" option on file systems that are associated with removable media.</fixtext><fix id=\"F-4605r88636_fix\" /><check system=\"C-4605r88635_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify file systems that are used for removable media are mounted with the \"nosuid\" option.\n\nCheck the file systems that are mounted at boot time with the following command:\n\n# more /etc/fstab\n\nUUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat noauto,owner,ro,nosuid 0 0\n\nIf a file system found in \"/etc/fstab\" refers to removable media and it does not have the \"nosuid\" option set, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204482\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204482r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-021020</version><title>The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are being imported via Network File System (NFS).</title><description>&lt;VulnDiscussion&gt;The \"nosuid\" mount option causes the system to not execute \"setuid\" and \"setgid\" files with owner privileges. This option must be used for mounting any file system not containing approved \"setuid\" and \"setguid\" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86669</ident><ident system=\"http://cyber.mil/legacy\">V-72045</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4606r88639_fix\">Configure the \"/etc/fstab\" to use the \"nosuid\" option on file systems that are being imported via NFS.</fixtext><fix id=\"F-4606r88639_fix\" /><check system=\"C-4606r88638_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify file systems that are being NFS imported are configured with the \"nosuid\" option.\n\nFind the file system(s) that contain the directories being exported with the following command:\n\n# more /etc/fstab | grep nfs\n\nUUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d /store nfs rw,nosuid 0 0\n\nIf a file system found in \"/etc/fstab\" refers to NFS and it does not have the \"nosuid\" option set, this is a finding.\n\nVerify the NFS is mounted with the \"nosuid\" option:\n\n# mount | grep nfs | grep nosuid\nIf no results are returned, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204483\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204483r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-021021</version><title>The Red Hat Enterprise Linux operating system must prevent binary files from being executed on file systems that are being imported via Network File System (NFS).</title><description>&lt;VulnDiscussion&gt;The \"noexec\" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files as they may be incompatible. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-87813</ident><ident system=\"http://cyber.mil/legacy\">V-73161</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4607r88642_fix\">Configure the \"/etc/fstab\" to use the \"noexec\" option on file systems that are being imported via NFS.</fixtext><fix id=\"F-4607r88642_fix\" /><check system=\"C-4607r88641_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify file systems that are being NFS imported are configured with the \"noexec\" option.\n\nFind the file system(s) that contain the directories being imported with the following command:\n\n# more /etc/fstab | grep nfs\n\nUUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d /store nfs rw,noexec 0 0\n\nIf a file system found in \"/etc/fstab\" refers to NFS and it does not have the \"noexec\" option set, and use of NFS imported binaries is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\n\nVerify the NFS is mounted with the \"noexec\"option:\n\n# mount | grep nfs | grep noexec\nIf no results are returned and use of NFS imported binaries is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204484\"><title>SRG-OS-000368-GPOS-00154</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204484r241939_rule\" weight=\"10.0\" severity=\"low\"><version>RHEL-07-021022</version><title>The Red Hat Enterprise Linux operating system must mount /dev/shm with the nodev option.</title><description>&lt;VulnDiscussion&gt;The \"nodev\" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-95721</ident><ident system=\"http://cyber.mil/legacy\">V-81009</ident><ident system=\"http://cyber.mil/cci\">CCI-001764</ident><fixtext fixref=\"F-4608r88645_fix\">Configure the system so that /dev/shm is mounted with the \"nodev\" option.</fixtext><fix id=\"F-4608r88645_fix\" /><check system=\"C-4608r88644_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that the \"nodev\" option is configured for /dev/shm:\n\n\n# cat /etc/fstab | grep /dev/shm\ntmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0\n\nIf any results are returned and the \"nodev\" option is not listed, this is a finding.\n\nVerify \"/dev/shm\" is mounted with the \"nodev\" option:\n\n# mount | grep \"/dev/shm\" | grep nodev\n\nIf no results are returned, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204485\"><title>SRG-OS-000368-GPOS-00154</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204485r241939_rule\" weight=\"10.0\" severity=\"low\"><version>RHEL-07-021023</version><title>The Red Hat Enterprise Linux operating system must mount /dev/shm with the nosuid option.</title><description>&lt;VulnDiscussion&gt;The \"nosuid\" mount option causes the system to not execute \"setuid\" and \"setgid\" files with owner privileges. This option must be used for mounting any file system not containing approved \"setuid\" and \"setguid\" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-95723</ident><ident system=\"http://cyber.mil/legacy\">V-81011</ident><ident system=\"http://cyber.mil/cci\">CCI-001764</ident><fixtext fixref=\"F-4609r88648_fix\">Configure the system so that /dev/shm is mounted with the \"nosuid\" option.</fixtext><fix id=\"F-4609r88648_fix\" /><check system=\"C-4609r88647_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that the \"nosuid\" option is configured for /dev/shm:\n\n# cat /etc/fstab | grep /dev/shm\n\ntmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0\n\nIf any results are returned and the \"nosuid\" option is not listed, this is a finding.\n\nVerify \"/dev/shm\" is mounted with the \"nosuid\" option:\n\n# mount | grep \"/dev/shm\" | grep nosuid\n\nIf no results are returned, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204486\"><title>SRG-OS-000368-GPOS-00154</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204486r241939_rule\" weight=\"10.0\" severity=\"low\"><version>RHEL-07-021024</version><title>The Red Hat Enterprise Linux operating system must mount /dev/shm with the noexec option.</title><description>&lt;VulnDiscussion&gt;The \"noexec\" mount option causes the system to not execute binary files. This option must be used for mounting any file system not containing approved binary files as they may be incompatible. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-95725</ident><ident system=\"http://cyber.mil/legacy\">V-81013</ident><ident system=\"http://cyber.mil/cci\">CCI-001764</ident><fixtext fixref=\"F-4610r88651_fix\">Configure the system so that /dev/shm is mounted with the \"noexec\" option.</fixtext><fix id=\"F-4610r88651_fix\" /><check system=\"C-4610r88650_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that the \"noexec\" option is configured for /dev/shm:\n\n# cat /etc/fstab | grep /dev/shm\n\ntmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0\n\nIf any results are returned and the \"noexec\" option is not listed, this is a finding.\n\nVerify \"/dev/shm\" is mounted with the \"noexec\" option:\n\n# mount | grep \"/dev/shm\" | grep noexec\n\nIf no results are returned, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204487\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204487r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-021030</version><title>The Red Hat Enterprise Linux operating system must be configured so that all world-writable directories are group-owned by root, sys, bin, or an application group.</title><description>&lt;VulnDiscussion&gt;If a world-writable directory has the sticky bit set and is not group-owned by a privileged Group Identifier (GID), unauthorized users may be able to modify files created by others.\n\nThe only authorized public directories are those temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage, (e.g., /tmp), and for directories requiring global read/write access.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86671</ident><ident system=\"http://cyber.mil/legacy\">V-72047</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4611r88654_fix\">Change the group of the world-writable directories to root with the following command:\n\n# chgrp root &lt;directory&gt;</fixtext><fix id=\"F-4611r88654_fix\" /><check system=\"C-4611r88653_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify all world-writable directories are group-owned by root, sys, bin, or an application group.\n\nCheck the system for world-writable directories with the following command:\n\nNote: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\n\n# find / -xdev -perm -002 -type d -fstype xfs -exec ls -lLd {} \\;\ndrwxrwxrwt 2 root root 40 Aug 26 13:07 /dev/mqueue\ndrwxrwxrwt 2 root root 220 Aug 26 13:23 /dev/shm\ndrwxrwxrwt 14 root root 4096 Aug 26 13:29 /tmp\n\nIf any world-writable directories are not owned by root, sys, bin, or an application group associated with the directory, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204488\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204488r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-021040</version><title>The Red Hat Enterprise Linux operating system must set the umask value to 077 for all local interactive user accounts.</title><description>&lt;VulnDiscussion&gt;The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 700 or less permissive. Although umask can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be \"0\". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86673</ident><ident system=\"http://cyber.mil/legacy\">V-72049</ident><ident system=\"http://cyber.mil/cci\">CCI-000368</ident><ident system=\"http://cyber.mil/cci\">CCI-000318</ident><ident system=\"http://cyber.mil/cci\">CCI-001814</ident><ident system=\"http://cyber.mil/cci\">CCI-001813</ident><ident system=\"http://cyber.mil/cci\">CCI-001812</ident><fixtext fixref=\"F-4612r88657_fix\">Remove the umask statement from all local interactive user's initialization files. \n\nIf the account is for an application, the requirement for a umask less restrictive than \"077\" can be documented with the Information System Security Officer, but the user agreement for access to the account must specify that the local interactive user must log on to their account first and then switch the user to the application account with the correct option to gain the account's environment variables.</fixtext><fix id=\"F-4612r88657_fix\" /><check system=\"C-4612r88656_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that the default umask for all local interactive users is \"077\".\n\nIdentify the locations of all local interactive user home directories by looking at the \"/etc/passwd\" file.\n\nCheck all local interactive user initialization files for interactive users with the following command:\n\nNote: The example is for a system that is configured to create users home directories in the \"/home\" directory.\n\n# grep -i umask /home/*/.*\n\nIf any local interactive user initialization files are found to have a umask statement that has a value less restrictive than \"077\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204489\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204489r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-021100</version><title>The Red Hat Enterprise Linux operating system must have cron logging implemented.</title><description>&lt;VulnDiscussion&gt;Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86675</ident><ident system=\"http://cyber.mil/legacy\">V-72051</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4613r88660_fix\">Configure \"rsyslog\" to log all cron messages by adding or updating the following line to \"/etc/rsyslog.conf\" or a configuration file in the /etc/rsyslog.d/ directory:\n\ncron.* /var/log/cron.log</fixtext><fix id=\"F-4613r88660_fix\" /><check system=\"C-4613r88659_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that \"rsyslog\" is configured to log cron events.\n\nCheck the configuration of \"/etc/rsyslog.conf\" or \"/etc/rsyslog.d/*.conf\" files for the cron facility with the following command:\n\nNote: If another logging package is used, substitute the utility configuration file for \"/etc/rsyslog.conf\" or \"/etc/rsyslog.d/*.conf\" files.\n\n# grep cron /etc/rsyslog.conf  /etc/rsyslog.d/*.conf\ncron.* /var/log/cron.log\n\nIf the command does not return a response, check for cron logging all facilities by inspecting the \"/etc/rsyslog.conf\" or \"/etc/rsyslog.d/*.conf\" files.\n\nLook for the following entry:\n\n*.* /var/log/messages\n\nIf \"rsyslog\" is not logging messages for the cron facility or all facilities, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204490\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204490r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-021110</version><title>The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists, is owned by root.</title><description>&lt;VulnDiscussion&gt;If the owner of the \"cron.allow\" file is not set to root, the possibility exists for an unauthorized user to view or to edit sensitive information.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86677</ident><ident system=\"http://cyber.mil/legacy\">V-72053</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4614r88663_fix\">Set the owner on the \"/etc/cron.allow\" file to root with the following command:\n\n# chown root /etc/cron.allow</fixtext><fix id=\"F-4614r88663_fix\" /><check system=\"C-4614r88662_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that the \"cron.allow\" file is owned by root.\n\nCheck the owner of the \"cron.allow\" file with the following command:\n\n# ls -al /etc/cron.allow\n-rw------- 1 root root 6 Mar  5  2011 /etc/cron.allow\n\nIf the \"cron.allow\" file exists and has an owner other than root, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204491\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204491r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-021120</version><title>The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists, is group-owned by root.</title><description>&lt;VulnDiscussion&gt;If the group owner of the \"cron.allow\" file is not set to root, sensitive information could be viewed or edited by unauthorized users.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72055</ident><ident system=\"http://cyber.mil/legacy\">SV-86679</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4615r88666_fix\">Set the group owner on the \"/etc/cron.allow\" file to root with the following command:\n\n# chgrp root /etc/cron.allow</fixtext><fix id=\"F-4615r88666_fix\" /><check system=\"C-4615r88665_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that the \"cron.allow\" file is group-owned by root.\n\nCheck the group owner of the \"cron.allow\" file with the following command:\n\n# ls -al /etc/cron.allow\n-rw------- 1 root root 6 Mar  5  2011 /etc/cron.allow\n\nIf the \"cron.allow\" file exists and has a group owner other than root, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204492\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204492r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-021300</version><title>The Red Hat Enterprise Linux operating system must disable Kernel core dumps unless needed.</title><description>&lt;VulnDiscussion&gt;Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps may consume a considerable amount of disk space and may result in denial of service by exhausting the available space on the target file system partition.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72057</ident><ident system=\"http://cyber.mil/legacy\">SV-86681</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4616r88669_fix\">If kernel core dumps are not required, disable the \"kdump\" service with the following command:\n\n# systemctl disable kdump.service\n\nIf kernel core dumps are required, document the need with the ISSO.</fixtext><fix id=\"F-4616r88669_fix\" /><check system=\"C-4616r88668_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that kernel core dumps are disabled unless needed.\n\nCheck the status of the \"kdump\" service with the following command:\n\n# systemctl status kdump.service\nkdump.service - Crash recovery kernel arming\n   Loaded: loaded (/usr/lib/systemd/system/kdump.service; enabled)\n   Active: active (exited) since Wed 2015-08-26 13:08:09 EDT; 43min ago\n Main PID: 1130 (code=exited, status=0/SUCCESS)\nkernel arming.\n\nIf the \"kdump\" service is active, ask the System Administrator if the use of the service is required and documented with the Information System Security Officer (ISSO).\n\nIf the service is active and is not documented, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204493\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204493r241939_rule\" weight=\"10.0\" severity=\"low\"><version>RHEL-07-021310</version><title>The Red Hat Enterprise Linux operating system must be configured so that a separate file system is used for user home directories (such as /home or an equivalent).</title><description>&lt;VulnDiscussion&gt;The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72059</ident><ident system=\"http://cyber.mil/legacy\">SV-86683</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4617r88672_fix\">Migrate the \"/home\" directory onto a separate file system/partition.</fixtext><fix id=\"F-4617r88672_fix\" /><check system=\"C-4617r88671_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that a separate file system/partition has been created for non-privileged local interactive user home directories.\n\nCheck the home directory assignment for all non-privileged users (those with a UID greater than 1000) on the system with the following command:\n\n#cut -d: -f 1,3,6,7 /etc/passwd | egrep \":[1-4][0-9]{3}\" | tr \":\" \"\\t\"\n\nadamsj /home/adamsj /bin/bash\njacksonm /home/jacksonm /bin/bash\nsmithj /home/smithj /bin/bash\n\nThe output of the command will give the directory/partition that contains the home directories for the non-privileged users on the system (in this example, /home) and users' shell. All accounts with a valid shell (such as /bin/bash) are considered interactive users.\n\nCheck that a file system/partition has been created for the non-privileged interactive users with the following command:\n\nNote: The partition of /home is used in the example.\n\n# grep /home /etc/fstab\nUUID=333ada18    /home                   ext4    noatime,nobarrier,nodev  1 2\n\nIf a separate entry for the file system/partition that contains the non-privileged interactive users' home directories does not exist, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204494\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204494r241939_rule\" weight=\"10.0\" severity=\"low\"><version>RHEL-07-021320</version><title>The Red Hat Enterprise Linux operating system must use a separate file system for /var.</title><description>&lt;VulnDiscussion&gt;The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72061</ident><ident system=\"http://cyber.mil/legacy\">SV-86685</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4618r88675_fix\">Migrate the \"/var\" path onto a separate file system.</fixtext><fix id=\"F-4618r88675_fix\" /><check system=\"C-4618r88674_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that a separate file system/partition has been created for \"/var\".\n\nCheck that a file system/partition has been created for \"/var\" with the following command:\n\n# grep /var /etc/fstab\nUUID=c274f65f    /var                    ext4    noatime,nobarrier        1 2\n\nIf a separate entry for \"/var\" is not in use, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204495\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204495r241939_rule\" weight=\"10.0\" severity=\"low\"><version>RHEL-07-021330</version><title>The Red Hat Enterprise Linux operating system must use a separate file system for the system audit data path.</title><description>&lt;VulnDiscussion&gt;The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72063</ident><ident system=\"http://cyber.mil/legacy\">SV-86687</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4619r88678_fix\">Migrate the system audit data path onto a separate file system.</fixtext><fix id=\"F-4619r88678_fix\" /><check system=\"C-4619r88677_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Determine if the operating system is configured to have the \"/var/log/audit\" path is on a separate file system.\n\n# grep /var/log/audit /etc/fstab\n\nIf no result is returned, or the operating system is not configured to have \"/var/log/audit\" on a separate file system, this is a finding.\n\nVerify that \"/var/log/audit\" is mounted on a separate file system:\n\n# mount | grep \"/var/log/audit\"\n\nIf no result is returned, or \"/var/log/audit\" is not on a separate file system, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204496\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204496r241939_rule\" weight=\"10.0\" severity=\"low\"><version>RHEL-07-021340</version><title>The Red Hat Enterprise Linux operating system must use a separate file system for /tmp (or equivalent).</title><description>&lt;VulnDiscussion&gt;The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72065</ident><ident system=\"http://cyber.mil/legacy\">SV-86689</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4620r88681_fix\">Start the \"tmp.mount\" service with the following command:\n\n# systemctl enable tmp.mount\n   \nOR\n\nEdit the \"/etc/fstab\" file and ensure the \"/tmp\" directory is defined in the fstab with a device and mount point.</fixtext><fix id=\"F-4620r88681_fix\" /><check system=\"C-4620r88680_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that a separate file system/partition has been created for \"/tmp\".\n\nCheck that a file system/partition has been created for \"/tmp\" with the following command:\n\n# systemctl is-enabled tmp.mount\nenabled\n\nIf the \"tmp.mount\" service is not enabled, check to see if \"/tmp\" is defined in the fstab with a device and mount point:\n\n# grep -i /tmp /etc/fstab\nUUID=a411dc99-f2a1-4c87-9e05-184977be8539 /tmp   ext4   rw,relatime,discard,data=ordered,nosuid,noexec, 0 0\n\nIf \"tmp.mount\" service is not enabled and the \"/tmp\" directory is not defined in the fstab with a device and mount point, this is a finding. </check-content></check></Rule></Group><Group id=\"V-204497\"><title>SRG-OS-000033-GPOS-00014</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204497r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-021350</version><title>The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with a</title><description>&lt;VulnDiscussion&gt;Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\n\nSatisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000185-GPOS-00079, SRG-OS-000396-GPOS-00176, SRG-OS-000405-GPOS-00184, SRG-OS-000478-GPOS-00223&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72067</ident><ident system=\"http://cyber.mil/legacy\">SV-86691</ident><ident system=\"http://cyber.mil/cci\">CCI-001199</ident><ident system=\"http://cyber.mil/cci\">CCI-000068</ident><ident system=\"http://cyber.mil/cci\">CCI-002450</ident><ident system=\"http://cyber.mil/cci\">CCI-002476</ident><fixtext fixref=\"F-4621r88684_fix\">Configure the operating system to implement DoD-approved encryption by installing the dracut-fips package.\n\nTo enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel command line during system installation so key generation is done with FIPS-approved algorithms and continuous monitoring tests in place.\n\nConfigure the operating system to implement DoD-approved encryption by following the steps below: \n\nThe fips=1 kernel option needs to be added to the kernel command line during system installation so that key generation is done with FIPS-approved algorithms and continuous monitoring tests in place. Users should also ensure that the system has plenty of entropy during the installation process by moving the mouse around, or if no mouse is available, ensuring that many keystrokes are typed. The recommended amount of keystrokes is 256 and more. Less than 256 keystrokes may generate a non-unique key.\n\nInstall the dracut-fips package with the following command:\n\n# yum install dracut-fips\n\nRecreate the \"initramfs\" file with the following command:\n\nNote: This command will overwrite the existing \"initramfs\" file.\n\n# dracut -f\n\nModify the kernel command line of the current kernel in the \"grub.cfg\" file by adding the following option to the GRUB_CMDLINE_LINUX key in the \"/etc/default/grub\" file and then rebuild the \"grub.cfg\" file:\n\nfips=1\n\nChanges to \"/etc/default/grub\" require rebuilding the \"grub.cfg\" file as follows:\n\nOn BIOS-based machines, use the following command:\n\n# grub2-mkconfig -o /boot/grub2/grub.cfg\n\nOn UEFI-based machines, use the following command:\n\n# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg\n\nIf /boot or /boot/efi reside on separate partitions, the kernel parameter boot=&lt;partition of /boot or /boot/efi&gt; must be added to the kernel command line. You can identify a partition by running the df /boot or df /boot/efi command:\n\n# df /boot\nFilesystem 1K-blocks Used Available Use% Mounted on\n/dev/sda1 495844 53780 416464 12% /boot\n\nTo ensure the \"boot=\" configuration option will work even if device naming changes occur between boots, identify the universally unique identifier (UUID) of the partition with the following command:\n\n# blkid /dev/sda1\n/dev/sda1: UUID=\"05c000f1-a213-759e-c7a2-f11b7424c797\" TYPE=\"ext4\"\n\nFor the example above, append the following string to the kernel command line:\n\nboot=UUID=05c000f1-a213-759e-c7a2-f11b7424c797\n\nReboot the system for the changes to take effect.</fixtext><fix id=\"F-4621r88684_fix\" /><check system=\"C-4621r88683_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system implements DoD-approved encryption to protect the confidentiality of remote access sessions.\n\nCheck to see if the \"dracut-fips\" package is installed with the following command:\n\n# yum list installed dracut-fips\n\ndracut-fips-033-360.el7_2.x86_64.rpm\n\nIf a \"dracut-fips\" package is installed, check to see if the kernel command line is configured to use FIPS mode with the following command:\n\nNote: GRUB 2 reads its configuration from the \"/boot/grub2/grub.cfg\" file on traditional BIOS-based machines and from the \"/boot/efi/EFI/redhat/grub.cfg\" file on UEFI machines.\n\n# grep fips /boot/grub2/grub.cfg\n/vmlinuz-3.8.0-0.40.el7.x86_64 root=/dev/mapper/rhel-root ro rd.md=0 rd.dm=0 rd.lvm.lv=rhel/swap crashkernel=auto rd.luks=0 vconsole.keymap=us rd.lvm.lv=rhel/root rhgb fips=1 quiet\n\nIf the kernel command line is configured to use FIPS mode, check to see if the system is in FIPS mode with the following command:\n\n# cat /proc/sys/crypto/fips_enabled \n1\n\nIf a \"dracut-fips\" package is not installed, the kernel command line does not have a fips entry, or the system has a value of \"0\" for \"fips_enabled\" in \"/proc/sys/crypto\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204498\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204498r241939_rule\" weight=\"10.0\" severity=\"low\"><version>RHEL-07-021600</version><title>The Red Hat Enterprise Linux operating system must be configured so that the file integrity tool is configured to verify Access Control Lists (ACLs).</title><description>&lt;VulnDiscussion&gt;ACLs can provide permissions beyond those permitted through the file mode and must be verified by file integrity tools.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72069</ident><ident system=\"http://cyber.mil/legacy\">SV-86693</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4622r88687_fix\">Configure the file integrity tool to check file and directory ACLs. \n\nIf AIDE is installed, ensure the \"acl\" rule is present on all uncommented file and directory selection lists.</fixtext><fix id=\"F-4622r88687_fix\" /><check system=\"C-4622r88686_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the file integrity tool is configured to verify ACLs.\n\nCheck to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command:\n\n# yum list installed aide\n\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. \n\nIf there is no application installed to perform file integrity checks, this is a finding.\n\nNote: AIDE is highly configurable at install time. These commands assume the \"aide.conf\" file is under the \"/etc\" directory. \n\nUse the following command to determine if the file is in another location:\n\n# find / -name aide.conf\n\nCheck the \"aide.conf\" file to determine if the \"acl\" rule has been added to the rule list being applied to the files and directories selection lists.\n\nAn example rule that includes the \"acl\" rule is below:\n\nAll= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\n/bin All # apply the custom rule to the files in bin \n/sbin All # apply the same custom rule to the files in sbin \n\nIf the \"acl\" rule is not being used on all uncommented selection lines in the \"/etc/aide.conf\" file, or ACLs are not being checked by another file integrity tool, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204499\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204499r241939_rule\" weight=\"10.0\" severity=\"low\"><version>RHEL-07-021610</version><title>The Red Hat Enterprise Linux operating system must be configured so that the file integrity tool is configured to verify extended attributes.</title><description>&lt;VulnDiscussion&gt;Extended attributes in file systems are used to contain arbitrary data and file metadata with security implications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72071</ident><ident system=\"http://cyber.mil/legacy\">SV-86695</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4623r88690_fix\">Configure the file integrity tool to check file and directory extended attributes. \n\nIf AIDE is installed, ensure the \"xattrs\" rule is present on all uncommented file and directory selection lists.</fixtext><fix id=\"F-4623r88690_fix\" /><check system=\"C-4623r88689_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the file integrity tool is configured to verify extended attributes.\n\nCheck to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command:\n\n# yum list installed aide\n\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system.\n\nIf there is no application installed to perform file integrity checks, this is a finding.\n\nNote: AIDE is highly configurable at install time. These commands assume the \"aide.conf\" file is under the \"/etc\" directory.\n\nUse the following command to determine if the file is in another location:\n\n# find / -name aide.conf\n\nCheck the \"aide.conf\" file to determine if the \"xattrs\" rule has been added to the rule list being applied to the files and directories selection lists.\n\nAn example rule that includes the \"xattrs\" rule follows:\n\nAll= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\n/bin All # apply the custom rule to the files in bin \n/sbin All # apply the same custom rule to the files in sbin \n\nIf the \"xattrs\" rule is not being used on all uncommented selection lines in the \"/etc/aide.conf\" file, or extended attributes are not being checked by another file integrity tool, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204500\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204500r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-021620</version><title>The Red Hat Enterprise Linux operating system must use a file integrity tool that is configured to use FIPS 140-2 approved cryptographic hashes for validating file contents and directories.</title><description>&lt;VulnDiscussion&gt;File integrity tools use cryptographic hashes for verifying file contents and directories have not been altered. These hashes must be FIPS 140-2 approved cryptographic hashes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72073</ident><ident system=\"http://cyber.mil/legacy\">SV-86697</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4624r88693_fix\">Configure the file integrity tool to use FIPS 140-2 cryptographic hashes for validating file and directory contents. \n\nIf AIDE is installed, ensure the \"sha512\" rule is present on all uncommented file and directory selection lists.</fixtext><fix id=\"F-4624r88693_fix\" /><check system=\"C-4624r88692_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the file integrity tool is configured to use FIPS 140-2 approved cryptographic hashes for validating file contents and directories.\n\nNote: If RHEL-07-021350 is a finding, this is automatically a finding too as the system cannot implement FIPS 140-2 approved cryptographic algorithms and hashes.\n\nCheck to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command:\n\n# yum list installed aide\n\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. \n\nIf there is no application installed to perform file integrity checks, this is a finding.\n\nNote: AIDE is highly configurable at install time. These commands assume the \"aide.conf\" file is under the \"/etc\" directory. \n\nUse the following command to determine if the file is in another location:\n\n# find / -name aide.conf\n\nCheck the \"aide.conf\" file to determine if the \"sha512\" rule has been added to the rule list being applied to the files and directories selection lists.\n\nAn example rule that includes the \"sha512\" rule follows:\n\nAll=p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\n/bin All # apply the custom rule to the files in bin \n/sbin All # apply the same custom rule to the files in sbin \n\nIf the \"sha512\" rule is not being used on all uncommented selection lines in the \"/etc/aide.conf\" file, or another file integrity tool is not using FIPS 140-2 approved cryptographic hashes for validating file contents and directories, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204501\"><title>SRG-OS-000364-GPOS-00151</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204501r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-021700</version><title>The Red Hat Enterprise Linux operating system must not allow removable media to be used as the boot loader unless approved.</title><description>&lt;VulnDiscussion&gt;Malicious users with removable boot media can gain access to a system configured to use removable media as the boot loader. If removable media is designed to be used as the boot loader, the requirement must be documented with the Information System Security Officer (ISSO).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72075</ident><ident system=\"http://cyber.mil/legacy\">SV-86699</ident><ident system=\"http://cyber.mil/cci\">CCI-000368</ident><ident system=\"http://cyber.mil/cci\">CCI-000318</ident><ident system=\"http://cyber.mil/cci\">CCI-001813</ident><ident system=\"http://cyber.mil/cci\">CCI-001814</ident><ident system=\"http://cyber.mil/cci\">CCI-001812</ident><fixtext fixref=\"F-4625r88696_fix\">Remove alternate methods of booting the system from removable media or document the configuration to boot from removable media with the ISSO.</fixtext><fix id=\"F-4625r88696_fix\" /><check system=\"C-4625r88695_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the system is not configured to use a boot loader on removable media.\n\nNote: GRUB 2 reads its configuration from the \"/boot/grub2/grub.cfg\" file on traditional BIOS-based machines and from the \"/boot/efi/EFI/redhat/grub.cfg\" file on UEFI machines.\n\nCheck for the existence of alternate boot loader configuration files with the following command:\n\n# find / -name grub.cfg\n/boot/grub2/grub.cfg\n\nIf a \"grub.cfg\" is found in any subdirectories other than \"/boot/grub2\" and \"/boot/efi/EFI/redhat\", ask the System Administrator if there is documentation signed by the ISSO to approve the use of removable media as a boot loader. \n\nCheck that the grub configuration file has the set root command in each menu entry with the following commands:\n\n# grep -c menuentry /boot/grub2/grub.cfg\n1\n# grep 'set root' /boot/grub2/grub.cfg\nset root=(hd0,1)\n\nIf the system is using an alternate boot loader on removable media, and documentation does not exist approving the alternate configuration, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204502\"><title>SRG-OS-000095-GPOS-00049</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204502r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-021710</version><title>The Red Hat Enterprise Linux operating system must not have the telnet-server package installed.</title><description>&lt;VulnDiscussion&gt;It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\n\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).\n\nExamples of non-essential capabilities include, but are not limited to, games, software packages, tools, and demonstration software not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72077</ident><ident system=\"http://cyber.mil/legacy\">SV-86701</ident><ident system=\"http://cyber.mil/cci\">CCI-000381</ident><fixtext fixref=\"F-4626r88699_fix\">Configure the operating system to disable non-essential capabilities by removing the telnet-server package from the system with the following command:\n\n# yum remove telnet-server</fixtext><fix id=\"F-4626r88699_fix\" /><check system=\"C-4626r88698_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system is configured to disable non-essential capabilities. The most secure way of ensuring a non-essential capability is disabled is to not have the capability installed.\n\nThe telnet service provides an unencrypted remote access service that does not provide for the confidentiality and integrity of user passwords or the remote session.\n\nIf a privileged user were to log on using this service, the privileged user password could be compromised. \n\nCheck to see if the telnet-server package is installed with the following command:\n\n# yum list installed telnet-server\n\nIf the telnet-server package is installed, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204503\"><title>SRG-OS-000038-GPOS-00016</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204503r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-030000</version><title>The Red Hat Enterprise Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of th</title><description>&lt;VulnDiscussion&gt;Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.\n\nAudit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.\n\nAssociating event types with detected events in the operating system audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured operating system.\n\nSatisfies: SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000042-GPOS-00021, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86703</ident><ident system=\"http://cyber.mil/legacy\">V-72079</ident><ident system=\"http://cyber.mil/cci\">CCI-000131</ident><ident system=\"http://cyber.mil/cci\">CCI-000126</ident><fixtext fixref=\"F-4627r88702_fix\">Configure the operating system to produce audit records containing information to establish when (date and time) the events occurred.\n\nEnable the auditd service with the following command:\n\n# systemctl start auditd.service</fixtext><fix id=\"F-4627r88702_fix\" /><check system=\"C-4627r88701_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system produces audit records containing information to establish when (date and time) the events occurred.\n\nCheck to see if auditing is active by issuing the following command:\n\n# systemctl is-active auditd.service\nactive\n\nIf the \"auditd\" status is not active, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204504\"><title>SRG-OS-000046-GPOS-00022</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204504r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030010</version><title>The Red Hat Enterprise Linux operating system must shut down upon audit processing failure, unless availability is an overriding concern. If availability is a concern, the system must alert the designated staff (System Administrator [SA] and Information S</title><description>&lt;VulnDiscussion&gt;It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.\n\nAudit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.\n\nThis requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.\n\nSatisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000047-GPOS-00023&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86705</ident><ident system=\"http://cyber.mil/legacy\">V-72081</ident><ident system=\"http://cyber.mil/cci\">CCI-000139</ident><fixtext fixref=\"F-4628r88705_fix\">Configure the operating system to shut down in the event of an audit processing failure.\n\nAdd or correct the option to shut down the operating system with the following command:\n\n# auditctl -f 2\n\nEdit the \"/etc/audit/rules.d/audit.rules\" file and add the following line:\n\n-f 2\n\nIf availability has been determined to be more important, and this decision is documented with the ISSO, configure the operating system to notify system administration staff and ISSO staff in the event of an audit processing failure with the following command:\n\n# auditctl -f 1\n\nEdit the \"/etc/audit/rules.d/audit.rules\" file and add the following line:\n\n-f 1\n\nKernel log monitoring must also be configured to properly alert designated staff.\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4628r88705_fix\" /><check system=\"C-4628r88704_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Confirm the audit configuration regarding how auditing processing failures are handled.\n\nCheck to see what level \"auditctl\" is set to with following command: \n\n# auditctl -s | grep -i \"fail\"\n\nfailure 2\n\nIf the value of \"failure\" is set to \"2\", the system is configured to panic (shut down) in the event of an auditing failure.\n\nIf the value of \"failure\" is set to \"1\", the system is configured to only send information to the kernel log regarding the failure.\n\nIf the \"failure\" setting is not set, this is a CAT I finding.\n\nIf the \"failure\" setting is set to any value other than \"1\" or \"2\", this is a CAT II finding.\n\nIf the \"failure\" setting is set to \"1\" but the availability concern is not documented or there is no monitoring of the kernel log, this is a CAT III finding.</check-content></check></Rule></Group><Group id=\"V-204505\"><title>SRG-OS-000342-GPOS-00133</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204505r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030200</version><title>The Red Hat Enterprise Linux operating system must be configured to use the au-remote plugin.</title><description>&lt;VulnDiscussion&gt;Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n\nOff-loading is a common process in information systems with limited audit storage capacity.\n\nWithout the configuration of the \"au-remote\" plugin, the audisp-remote daemon will not off-load the logs from the system being audited.\n\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-95727</ident><ident system=\"http://cyber.mil/legacy\">V-81015</ident><ident system=\"http://cyber.mil/cci\">CCI-001851</ident><fixtext fixref=\"F-4629r88708_fix\">Edit the /etc/audisp/plugins.d/au-remote.conf file and change the value of \"active\" to \"yes\".\n\nThe audit daemon must be restarted for changes to take effect:\n\n# service auditd restart</fixtext><fix id=\"F-4629r88708_fix\" /><check system=\"C-4629r88707_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the \"au-remote\" plugin is active on the system:\n\n# grep \"active\" /etc/audisp/plugins.d/au-remote.conf\n\nactive = yes\n\nIf the \"active\" setting is not set to \"yes\", or the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204506\"><title>SRG-OS-000342-GPOS-00133</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204506r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030201</version><title>The Red Hat Enterprise Linux operating system must configure the au-remote plugin to off-load audit logs using the audisp-remote daemon.</title><description>&lt;VulnDiscussion&gt;Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n\nOff-loading is a common process in information systems with limited audit storage capacity.\n\nWithout the configuration of the \"au-remote\" plugin, the audisp-remote daemon will not off load the logs from the system being audited.\n\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-95729</ident><ident system=\"http://cyber.mil/legacy\">V-81017</ident><ident system=\"http://cyber.mil/cci\">CCI-001851</ident><fixtext fixref=\"F-4630r88711_fix\">Edit the /etc/audisp/plugins.d/au-remote.conf file and add or update the following values:\n\ndirection = out\npath = /sbin/audisp-remote\ntype = always\n\nThe audit daemon must be restarted for changes to take effect:\n\n# service auditd restart</fixtext><fix id=\"F-4630r88711_fix\" /><check system=\"C-4630r88710_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the \"au-remote\" plugin is configured to always off-load audit logs using the audisp-remote daemon:\n\n# cat /etc/audisp/plugins.d/au-remote.conf | grep -v \"^#\"\n\nactive = yes\ndirection = out\npath = /sbin/audisp-remote\ntype = always\nformat = string\n\nIf the \"direction\" setting is not set to \"out\", or the line is commented out, this is a finding.\n\nIf the \"path\" setting is not set to \"/sbin/audisp-remote\", or the line is commented out, this is a finding.\n\nIf the \"type\" setting is not set to \"always\", or the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204507\"><title>SRG-OS-000342-GPOS-00133</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204507r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030210</version><title>The Red Hat Enterprise Linux operating system must take appropriate action when the audisp-remote buffer is full.</title><description>&lt;VulnDiscussion&gt;Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n\nOff-loading is a common process in information systems with limited audit storage capacity.\n\nWhen the remote buffer is full, audit logs will not be collected and sent to the central log server.\n\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-95731</ident><ident system=\"http://cyber.mil/legacy\">V-81019</ident><ident system=\"http://cyber.mil/cci\">CCI-001851</ident><fixtext fixref=\"F-4631r88714_fix\">Edit the /etc/audisp/audispd.conf file and add or update the \"overflow_action\" option:\n\noverflow_action = syslog\n\nThe audit daemon must be restarted for changes to take effect:\n\n# service auditd restart</fixtext><fix id=\"F-4631r88714_fix\" /><check system=\"C-4631r88713_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the audisp daemon is configured to take an appropriate action when the internal queue is full:\n\n# grep \"overflow_action\" /etc/audisp/audispd.conf\n\noverflow_action = syslog\n\nIf the \"overflow_action\" option is not \"syslog\", \"single\", or \"halt\", or the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204508\"><title>SRG-OS-000342-GPOS-00133</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204508r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030211</version><title>The Red Hat Enterprise Linux operating system must label all off-loaded audit logs before sending them to the central log server.</title><description>&lt;VulnDiscussion&gt;Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n\nOff-loading is a common process in information systems with limited audit storage capacity.\n\nWhen audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be analyzed and tied back to the correct system.\n\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-95733</ident><ident system=\"http://cyber.mil/legacy\">V-81021</ident><ident system=\"http://cyber.mil/cci\">CCI-001851</ident><fixtext fixref=\"F-4632r88717_fix\">Edit the /etc/audisp/audispd.conf file and add or update the \"name_format\" option:\n\nname_format = hostname\n\nThe audit daemon must be restarted for changes to take effect:\n\n# service auditd restart</fixtext><fix id=\"F-4632r88717_fix\" /><check system=\"C-4632r88716_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the audisp daemon is configured to label all off-loaded audit logs:\n\n# grep \"name_format\" /etc/audisp/audispd.conf\n\nname_format = hostname\n\nIf the \"name_format\" option is not \"hostname\", \"fqd\", or \"numeric\", or the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204509\"><title>SRG-OS-000342-GPOS-00133</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204509r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030300</version><title>The Red Hat Enterprise Linux operating system must off-load audit records onto a different system or media from the system being audited.</title><description>&lt;VulnDiscussion&gt;Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n\nOff-loading is a common process in information systems with limited audit storage capacity.\n\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86707</ident><ident system=\"http://cyber.mil/legacy\">V-72083</ident><ident system=\"http://cyber.mil/cci\">CCI-001851</ident><fixtext fixref=\"F-4633r88720_fix\">Configure the operating system to off-load audit records onto a different system or media from the system being audited.\n\nSet the remote server option in \"/etc/audisp/audisp-remote.conf\" with the IP address of the log aggregation server.</fixtext><fix id=\"F-4633r88720_fix\" /><check system=\"C-4633r88719_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system off-loads audit records onto a different system or media from the system being audited.\n\nTo determine the remote server that the records are being sent to, use the following command:\n\n# grep -i remote_server /etc/audisp/audisp-remote.conf\nremote_server = 10.0.21.1\n\nIf a remote server is not configured, or the line is commented out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. \n\nIf there is no evidence that the audit logs are being off-loaded to another system or media, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204510\"><title>SRG-OS-000342-GPOS-00133</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204510r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030310</version><title>The Red Hat Enterprise Linux operating system must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited.</title><description>&lt;VulnDiscussion&gt;Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n\nOff-loading is a common process in information systems with limited audit storage capacity.\n\nSatisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86709</ident><ident system=\"http://cyber.mil/legacy\">V-72085</ident><ident system=\"http://cyber.mil/cci\">CCI-001851</ident><fixtext fixref=\"F-4634r88723_fix\">Configure the operating system to encrypt the transfer of off-loaded audit records onto a different system or media from the system being audited.\n\nUncomment the \"enable_krb5\" option in \"/etc/audisp/audisp-remote.conf\" and set it with the following line:\n\nenable_krb5 = yes</fixtext><fix id=\"F-4634r88723_fix\" /><check system=\"C-4634r88722_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system encrypts audit records off-loaded onto a different system or media from the system being audited.\n\nTo determine if the transfer is encrypted, use the following command:\n\n# grep -i enable_krb5 /etc/audisp/audisp-remote.conf\nenable_krb5 = yes\n\nIf the value of the \"enable_krb5\" option is not set to \"yes\" or the line is commented out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. \n\nIf there is no evidence that the transfer of the audit logs being off-loaded to another system or media is encrypted, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204511\"><title>SRG-OS-000342-GPOS-00133</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204511r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030320</version><title>The Red Hat Enterprise Linux operating system must be configured so that the audit system takes appropriate action when the audit storage volume is full.</title><description>&lt;VulnDiscussion&gt;Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72087</ident><ident system=\"http://cyber.mil/legacy\">SV-86711</ident><ident system=\"http://cyber.mil/cci\">CCI-001851</ident><fixtext fixref=\"F-4635r88726_fix\">Configure the action the operating system takes if the disk the audit records are written to becomes full.\n\nUncomment or edit the \"disk_full_action\" option in \"/etc/audisp/audisp-remote.conf\" and set it to \"syslog\", \"single\", or \"halt\", such as the following line:\n\ndisk_full_action = single</fixtext><fix id=\"F-4635r88726_fix\" /><check system=\"C-4635r88725_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the action the operating system takes if the disk the audit records are written to becomes full.\n\nTo determine the action that takes place if the disk is full on the remote server, use the following command:\n\n# grep -i disk_full_action /etc/audisp/audisp-remote.conf\ndisk_full_action = single\n\nIf the value of the \"disk_full_action\" option is not \"syslog\", \"single\", or \"halt\", or the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204512\"><title>SRG-OS-000342-GPOS-00133</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204512r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030321</version><title>The Red Hat Enterprise Linux operating system must be configured so that the audit system takes appropriate action when there is an error sending audit records to a remote system.</title><description>&lt;VulnDiscussion&gt;Taking appropriate action when there is an error sending audit records to a remote system will minimize the possibility of losing audit records.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-73163</ident><ident system=\"http://cyber.mil/legacy\">SV-87815</ident><ident system=\"http://cyber.mil/cci\">CCI-001851</ident><fixtext fixref=\"F-4636r88729_fix\">Configure the action the operating system takes if there is an error sending audit records to a remote system.\n\nUncomment the \"network_failure_action\" option in \"/etc/audisp/audisp-remote.conf\" and set it to \"syslog\", \"single\", or \"halt\".\n\nnetwork_failure_action = syslog</fixtext><fix id=\"F-4636r88729_fix\" /><check system=\"C-4636r88728_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the action the operating system takes if there is an error sending audit records to a remote system.\n\nCheck the action that takes place if there is an error sending audit records to a remote system with the following command:\n\n# grep -i network_failure_action /etc/audisp/audisp-remote.conf\nnetwork_failure_action = syslog\n\nIf the value of the \"network_failure_action\" option is not \"syslog\", \"single\", or \"halt\", or the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204513\"><title>SRG-OS-000343-GPOS-00134</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204513r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030330</version><title>The Red Hat Enterprise Linux operating system must initiate an action to notify the System Administrator (SA) and Information System Security Officer ISSO, at a minimum, when allocated audit record storage volume reaches 75% of the repository maximum audi</title><description>&lt;VulnDiscussion&gt;If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to plan for audit record storage capacity expansion.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72089</ident><ident system=\"http://cyber.mil/legacy\">SV-86713</ident><ident system=\"http://cyber.mil/cci\">CCI-001855</ident><fixtext fixref=\"F-4637r88732_fix\">Configure the operating system to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\n\nCheck the system configuration to determine the partition the audit records are being written to: \n\n# grep -iw log_file /etc/audit/auditd.conf\n\nDetermine the size of the partition that audit records are written to (with the example being \"/var/log/audit/\"):\n\n# df -h /var/log/audit/\n\nSet the value of the \"space_left\" keyword in \"/etc/audit/auditd.conf\" to 25 percent of the partition size.</fixtext><fix id=\"F-4637r88732_fix\" /><check system=\"C-4637r88731_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system initiates an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\n\nCheck the system configuration to determine the partition the audit records are being written to with the following command:\n\n# grep -iw log_file /etc/audit/auditd.conf\nlog_file = /var/log/audit/audit.log\n\nCheck the size of the partition that audit records are written to (with the example being \"/var/log/audit/\"):\n\n# df -h /var/log/audit/\n0.9G /var/log/audit\n\nIf the audit records are not being written to a partition specifically created for audit records (in this example \"/var/log/audit\" is a separate partition), determine the amount of space other files in the partition are currently occupying with the following command:\n\n# du -sh &lt;partition&gt;\n1.8G /var\n\nDetermine what the threshold is for the system to take action when 75 percent of the repository maximum audit record storage capacity is reached:\n\n# grep -iw space_left /etc/audit/auditd.conf\nspace_left = 225 \n\nIf the value of the \"space_left\" keyword is not set to 25 percent of the total partition size, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204514\"><title>SRG-OS-000343-GPOS-00134</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204514r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030340</version><title>The Red Hat Enterprise Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) via email when the threshold for the repository maximum audit record storage capacity is reac</title><description>&lt;VulnDiscussion&gt;If security personnel are not notified immediately when the threshold for the repository maximum audit record storage capacity is reached, they are unable to expand the audit record storage capacity before records are lost.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72091</ident><ident system=\"http://cyber.mil/legacy\">SV-86715</ident><ident system=\"http://cyber.mil/cci\">CCI-001855</ident><fixtext fixref=\"F-4638r88735_fix\">Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached.\n\nUncomment or edit the \"space_left_action\" keyword in \"/etc/audit/auditd.conf\" and set it to \"email\". \n \nspace_left_action = email</fixtext><fix id=\"F-4638r88735_fix\" /><check system=\"C-4638r88734_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\n\nCheck what action the operating system takes when the threshold for the repository maximum audit record storage capacity is reached with the following command:\n\n# grep -i space_left_action  /etc/audit/auditd.conf\nspace_left_action = email\n\nIf the value of the \"space_left_action\" keyword is not set to \"email\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204515\"><title>SRG-OS-000343-GPOS-00134</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204515r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030350</version><title>The Red Hat Enterprise Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached.</title><description>&lt;VulnDiscussion&gt;If security personnel are not notified immediately when the threshold for the repository maximum audit record storage capacity is reached, they are unable to expand the audit record storage capacity before records are lost.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72093</ident><ident system=\"http://cyber.mil/legacy\">SV-86717</ident><ident system=\"http://cyber.mil/cci\">CCI-001855</ident><fixtext fixref=\"F-4639r88738_fix\">Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached.\n\nUncomment or edit the \"action_mail_acct\" keyword in \"/etc/audit/auditd.conf\" and set it to root and any other accounts associated with security personnel. \n \naction_mail_acct = root</fixtext><fix id=\"F-4639r88738_fix\" /><check system=\"C-4639r88737_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the threshold for the repository maximum audit record storage capacity is reached.\n\nCheck what account the operating system emails when the threshold for the repository maximum audit record storage capacity is reached with the following command:\n\n# grep -i action_mail_acct  /etc/audit/auditd.conf\naction_mail_acct = root\n\nIf the value of the \"action_mail_acct\" keyword is not set to \"root\" and other accounts for security personnel, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204516\"><title>SRG-OS-000327-GPOS-00127</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204516r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030360</version><title>The Red Hat Enterprise Linux operating system must audit all executions of privileged functions.</title><description>&lt;VulnDiscussion&gt;Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72095</ident><ident system=\"http://cyber.mil/legacy\">SV-86719</ident><ident system=\"http://cyber.mil/cci\">CCI-002234</ident><fixtext fixref=\"F-4640r88741_fix\">Configure the operating system to audit the execution of privileged functions.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid\n-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4640r88741_fix\" /><check system=\"C-4640r88740_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system audits the execution of privileged functions using the following command:\n\n# grep -iw execve /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid\n-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid\n\n\nIf both the \"b32\" and \"b64\" audit rules for \"SUID\" files are not defined, this is a finding.\n\nIf both the \"b32\" and \"b64\" audit rules for \"SGID\" files are not defined, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204517\"><title>SRG-OS-000064-GPOS-00033</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204517r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030370</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the chown syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72097</ident><ident system=\"http://cyber.mil/legacy\">SV-86721</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-000126</ident><fixtext fixref=\"F-4641r88744_fix\">Add or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4641r88744_fix\" /><check system=\"C-4641r88743_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"chown\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw chown /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"chown\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204518\"><title>SRG-OS-000064-GPOS-00033</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204518r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030380</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the fchown syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72099</ident><ident system=\"http://cyber.mil/legacy\">SV-86723</ident><ident system=\"http://cyber.mil/cci\">CCI-000126</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4642r88747_fix\">Add or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4642r88747_fix\" /><check system=\"C-4642r88746_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"fchown\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw fchown /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"fchown\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204519\"><title>SRG-OS-000064-GPOS-00033</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204519r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030390</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the lchown syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72101</ident><ident system=\"http://cyber.mil/legacy\">SV-86725</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-000126</ident><fixtext fixref=\"F-4643r88750_fix\">Add or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4643r88750_fix\" /><check system=\"C-4643r88749_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"lchown\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw lchown /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"lchown\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204520\"><title>SRG-OS-000064-GPOS-00033</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204520r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030400</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the fchownat syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72103</ident><ident system=\"http://cyber.mil/legacy\">SV-86727</ident><ident system=\"http://cyber.mil/cci\">CCI-000126</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4644r88753_fix\">Add or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4644r88753_fix\" /><check system=\"C-4644r88752_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"fchownat\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw fchownat /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"fchownat\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204521\"><title>SRG-OS-000458-GPOS-00203</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204521r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030410</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the chmod syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72105</ident><ident system=\"http://cyber.mil/legacy\">SV-86729</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4645r88756_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"chmod\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S chmod -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4645r88756_fix\" /><check system=\"C-4645r88755_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"chmod\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -iw chmod /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S chmod -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"chmod\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204522\"><title>SRG-OS-000458-GPOS-00203</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204522r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030420</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the fchmod syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72107</ident><ident system=\"http://cyber.mil/legacy\">SV-86731</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4646r88759_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"fchmod\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect.\n</fixtext><fix id=\"F-4646r88759_fix\" /><check system=\"C-4646r88758_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"fchmod\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -iw fchmod /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"fchmod\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204523\"><title>SRG-OS-000458-GPOS-00203</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204523r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030430</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the fchmodat syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72109</ident><ident system=\"http://cyber.mil/legacy\">SV-86733</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4647r88762_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"fchmodat\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4647r88762_fix\" /><check system=\"C-4647r88761_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"fchmodat\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -iw fchmodat /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"fchmodat\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204524\"><title>SRG-OS-000458-GPOS-00203</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204524r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030440</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the setxattr syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86735</ident><ident system=\"http://cyber.mil/legacy\">V-72111</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4648r88765_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"setxattr\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4648r88765_fix\" /><check system=\"C-4648r88764_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"setxattr\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw setxattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"setxattr\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204525\"><title>SRG-OS-000458-GPOS-00203</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204525r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030450</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the fsetxattr syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86737</ident><ident system=\"http://cyber.mil/legacy\">V-72113</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4649r88768_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"fsetxattr\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4649r88768_fix\" /><check system=\"C-4649r88767_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"fsetxattr\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw fsetxattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"fsetxattr\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204526\"><title>SRG-OS-000458-GPOS-00203</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204526r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030460</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the lsetxattr syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86739</ident><ident system=\"http://cyber.mil/legacy\">V-72115</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4650r88771_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"lsetxattr\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4650r88771_fix\" /><check system=\"C-4650r88770_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"lsetxattr\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw lsetxattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"lsetxattr\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204527\"><title>SRG-OS-000458-GPOS-00203</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204527r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030470</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the removexattr syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86741</ident><ident system=\"http://cyber.mil/legacy\">V-72117</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4651r88774_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"removexattr\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4651r88774_fix\" /><check system=\"C-4651r88773_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"removexattr\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw removexattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"removexattr\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204528\"><title>SRG-OS-000458-GPOS-00203</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204528r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030480</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the fremovexattr syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86743</ident><ident system=\"http://cyber.mil/legacy\">V-72119</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4652r88777_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"fremovexattr\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4652r88777_fix\" /><check system=\"C-4652r88776_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"fremovexattr\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw fremovexattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"fremovexattr\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204529\"><title>SRG-OS-000458-GPOS-00203</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204529r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030490</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the lremovexattr syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86745</ident><ident system=\"http://cyber.mil/legacy\">V-72121</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4653r88780_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"lremovexattr\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4653r88780_fix\" /><check system=\"C-4653r88779_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"lremovexattr\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw lremovexattr /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\n-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=4294967295 -k perm_mod\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"lremovexattr\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204530\"><title>SRG-OS-000064-GPOS-00033</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204530r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030500</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the creat syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86747</ident><ident system=\"http://cyber.mil/legacy\">V-72123</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4654r88783_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"creat\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules:\n\n-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4654r88783_fix\" /><check system=\"C-4654r88782_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"creat\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw creat /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S creat F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"creat\" syscall, this is a finding.\n\nIf the output does not produce rules containing \"-F exit=-EPERM\", this is a finding.\n\nIf the output does not produce rules containing \"-F exit=-EACCES\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204531\"><title>SRG-OS-000064-GPOS-00033</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204531r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030510</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the open syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86749</ident><ident system=\"http://cyber.mil/legacy\">V-72125</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4655r88786_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"open\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4655r88786_fix\" /><check system=\"C-4655r88785_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"open\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw open /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"open\" syscall, this is a finding.\n\nIf the output does not produce rules containing \"-F exit=-EPERM\", this is a finding.\n\nIf the output does not produce rules containing \"-F exit=-EACCES\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204532\"><title>SRG-OS-000064-GPOS-00033</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204532r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030520</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the openat syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72127</ident><ident system=\"http://cyber.mil/legacy\">SV-86751</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4656r88789_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"openat\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4656r88789_fix\" /><check system=\"C-4656r88788_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"openat\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw openat /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"openat\" syscall, this is a finding.\n\nIf the output does not produce rules containing \"-F exit=-EPERM\", this is a finding.\n\nIf the output does not produce rules containing \"-F exit=-EACCES\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204533\"><title>SRG-OS-000064-GPOS-00033</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204533r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030530</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the open_by_handle_at syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72129</ident><ident system=\"http://cyber.mil/legacy\">SV-86753</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4657r88792_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"open_by_handle_at\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4657r88792_fix\" /><check system=\"C-4657r88791_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"open_by_handle_at\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw open_by_handle_at /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"open_by_handle_at\" syscall, this is a finding.\n\nIf the output does not produce rules containing \"-F exit=-EPERM\", this is a finding.\n\nIf the output does not produce rules containing \"-F exit=-EACCES\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204534\"><title>SRG-OS-000064-GPOS-00033</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204534r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030540</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the truncate syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72131</ident><ident system=\"http://cyber.mil/legacy\">SV-86755</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4658r88795_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"truncate\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4658r88795_fix\" /><check system=\"C-4658r88794_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"truncate\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw truncate /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"truncate\" syscall, this is a finding.\n\nIf the output does not produce rules containing \"-F exit=-EPERM\", this is a finding.\n\nIf the output does not produce rules containing \"-F exit=-EACCES\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204535\"><title>SRG-OS-000064-GPOS-00033</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204535r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030550</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the ftruncate syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72133</ident><ident system=\"http://cyber.mil/legacy\">SV-86757</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4659r88798_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"ftruncate\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4659r88798_fix\" /><check system=\"C-4659r88797_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"ftruncate\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw ftruncate /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=4294967295 -k access\n\n-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=4294967295 -k access\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"ftruncate\" syscall, this is a finding.\n\nIf the output does not produce rules containing \"-F exit=-EPERM\", this is a finding.\n\nIf the output does not produce rules containing \"-F exit=-EACCES\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204536\"><title>SRG-OS-000392-GPOS-00172</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204536r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030560</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the semanage command.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72135</ident><ident system=\"http://cyber.mil/legacy\">SV-86759</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4660r88801_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"semanage\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/semanage -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4660r88801_fix\" /><check system=\"C-4660r88800_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"semanage\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -i /usr/sbin/semanage /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/semanage -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204537\"><title>SRG-OS-000392-GPOS-00172</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204537r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030570</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the setsebool command.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72137</ident><ident system=\"http://cyber.mil/legacy\">SV-86761</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4661r88804_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"setsebool\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/setsebool -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4661r88804_fix\" /><check system=\"C-4661r88803_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"setsebool\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -i /usr/sbin/setsebool /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/setsebool -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204538\"><title>SRG-OS-000392-GPOS-00172</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204538r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030580</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the chcon command.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72139</ident><ident system=\"http://cyber.mil/legacy\">SV-86763</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4662r88807_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"chcon\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4662r88807_fix\" /><check system=\"C-4662r88806_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"chcon\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -i /usr/bin/chcon /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204539\"><title>SRG-OS-000392-GPOS-00172</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204539r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030590</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the setfiles command.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72141</ident><ident system=\"http://cyber.mil/legacy\">SV-86765</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4663r88810_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"setfiles\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/setfiles -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4663r88810_fix\" /><check system=\"C-4663r88809_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"setfiles\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -iw /usr/sbin/setfiles /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/setfiles -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204540\"><title>SRG-OS-000392-GPOS-00172</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204540r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030610</version><title>The Red Hat Enterprise Linux operating system must generate audit records for all unsuccessful account access events.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72145</ident><ident system=\"http://cyber.mil/legacy\">SV-86769</ident><ident system=\"http://cyber.mil/cci\">CCI-000126</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4664r88813_fix\">Configure the operating system to generate audit records when unsuccessful account access events occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-w /var/run/faillock -p wa -k logins\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4664r88813_fix\" /><check system=\"C-4664r88812_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when unsuccessful account access events occur. \n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following commands: \n\n# grep -i /var/run/faillock /etc/audit/audit.rules\n\n-w /var/run/faillock -p wa -k logins\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204541\"><title>SRG-OS-000392-GPOS-00172</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204541r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030620</version><title>The Red Hat Enterprise Linux operating system must generate audit records for all successful account access events.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72147</ident><ident system=\"http://cyber.mil/legacy\">SV-86771</ident><ident system=\"http://cyber.mil/cci\">CCI-000126</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4665r88816_fix\">Configure the operating system to generate audit records when successful account access events occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-w /var/log/lastlog -p wa -k logins\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4665r88816_fix\" /><check system=\"C-4665r88815_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful account access events occur. \n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands: \n\n# grep -i /var/log/lastlog /etc/audit/audit.rules\n\n-w /var/log/lastlog -p wa -k logins \n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204542\"><title>SRG-OS-000042-GPOS-00020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204542r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030630</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the passwd command.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72149</ident><ident system=\"http://cyber.mil/legacy\">SV-86773</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4666r88819_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"passwd\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/bin/passwd -F auid&gt;=1000 -F auid!=4294967295 -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4666r88819_fix\" /><check system=\"C-4666r88818_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"passwd\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -i /usr/bin/passwd /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/passwd -F auid&gt;=1000 -F auid!=4294967295 -k privileged-passwd\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204543\"><title>SRG-OS-000042-GPOS-00020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204543r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030640</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the unix_chkpwd command.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72151</ident><ident system=\"http://cyber.mil/legacy\">SV-86775</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4667r88822_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"unix_chkpwd\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/unix_chkpwd -F auid&gt;=1000 -F auid!=4294967295 -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4667r88822_fix\" /><check system=\"C-4667r88821_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"unix_chkpwd\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -iw /usr/sbin/unix_chkpwd /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/unix_chkpwd -F auid&gt;=1000 -F auid!=4294967295 -k privileged-passwd\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204544\"><title>SRG-OS-000042-GPOS-00020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204544r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030650</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the gpasswd command.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72153</ident><ident system=\"http://cyber.mil/legacy\">SV-86777</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4668r88825_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"gpasswd\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/bin/gpasswd -F auid&gt;=1000 -F auid!=4294967295 -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect. </fixtext><fix id=\"F-4668r88825_fix\" /><check system=\"C-4668r88824_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"gpasswd\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -i /usr/bin/gpasswd /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/gpasswd -F auid&gt;=1000 -F auid!=4294967295 -k privileged-passwd\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204545\"><title>SRG-OS-000042-GPOS-00020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204545r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030660</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the chage command.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86779</ident><ident system=\"http://cyber.mil/legacy\">V-72155</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4669r88828_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"chage\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/bin/chage -F auid&gt;=1000 -F auid!=4294967295 -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4669r88828_fix\" /><check system=\"C-4669r88827_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"chage\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -i /usr/bin/chage /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chage -F auid&gt;=1000 -F auid!=4294967295 -k privileged-passwd\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204546\"><title>SRG-OS-000042-GPOS-00020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204546r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030670</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the userhelper command.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86781</ident><ident system=\"http://cyber.mil/legacy\">V-72157</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4670r88831_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"userhelper\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/userhelper -F auid&gt;=1000 -F auid!=4294967295 -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4670r88831_fix\" /><check system=\"C-4670r88830_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"userhelper\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -i /usr/sbin/userhelper /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/userhelper -F auid&gt;=1000 -F auid!=4294967295 -k privileged-passwd\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204547\"><title>SRG-OS-000037-GPOS-00015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204547r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030680</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the su command.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86783</ident><ident system=\"http://cyber.mil/legacy\">V-72159</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-000130</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4671r88834_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"su\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/su -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change \n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4671r88834_fix\" /><check system=\"C-4671r88833_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"su\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n# grep -iw /usr/bin/su /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/su -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204548\"><title>SRG-OS-000037-GPOS-00015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204548r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030690</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the sudo command.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86785</ident><ident system=\"http://cyber.mil/legacy\">V-72161</ident><ident system=\"http://cyber.mil/cci\">CCI-000130</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4672r88837_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"sudo\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/sudo -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change \n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4672r88837_fix\" /><check system=\"C-4672r88836_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"sudo\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n# grep -iw /usr/bin/sudo /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/sudo -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204549\"><title>SRG-OS-000037-GPOS-00015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204549r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030700</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86787</ident><ident system=\"http://cyber.mil/legacy\">V-72163</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-000130</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4673r88840_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to access the \"/etc/sudoers\" file and files in the \"/etc/sudoers.d/\" directory.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-w /etc/sudoers -p wa -k privileged-actions\n\n-w /etc/sudoers.d/ -p wa -k privileged-actions\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4673r88840_fix\" /><check system=\"C-4673r88839_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to access the \"/etc/sudoers\" file and files in the \"/etc/sudoers.d/\" directory. \n\nCheck for modification of the following files being audited by performing the following commands to check the file system rules in \"/etc/audit/audit.rules\": \n\n# grep -i \"/etc/sudoers\" /etc/audit/audit.rules\n\n-w /etc/sudoers -p wa -k privileged-actions\n\n# grep -i \"/etc/sudoers.d/\" /etc/audit/audit.rules\n\n-w /etc/sudoers.d/ -p wa -k privileged-actions\n\nIf the commands do not return output that match the examples, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204550\"><title>SRG-OS-000037-GPOS-00015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204550r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030710</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the newgrp command.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86789</ident><ident system=\"http://cyber.mil/legacy\">V-72165</ident><ident system=\"http://cyber.mil/cci\">CCI-000130</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4674r88843_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"newgrp\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/newgrp -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4674r88843_fix\" /><check system=\"C-4674r88842_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"newgrp\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n# grep -i /usr/bin/newgrp /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/newgrp -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204551\"><title>SRG-OS-000037-GPOS-00015</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204551r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030720</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the chsh command.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86791</ident><ident system=\"http://cyber.mil/legacy\">V-72167</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-000130</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4675r88846_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"chsh\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/chsh -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4675r88846_fix\" /><check system=\"C-4675r88845_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"chsh\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n# grep -i /usr/bin/chsh /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chsh -F auid&gt;=1000 -F auid!=4294967295 -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204552\"><title>SRG-OS-000042-GPOS-00020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204552r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030740</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the mount command and syscall.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged mount commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86795</ident><ident system=\"http://cyber.mil/legacy\">V-72171</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4676r88849_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"mount\" command and syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S mount -F auid&gt;=1000 -F auid!=4294967295 -k privileged-mount\n-a always,exit -F arch=b64 -S mount -F auid&gt;=1000 -F auid!=4294967295 -k privileged-mount\n-a always,exit -F path=/usr/bin/mount -F auid&gt;=1000 -F auid!=4294967295 -k privileged-mount\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4676r88849_fix\" /><check system=\"C-4676r88848_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"mount\" command and syscall occur.\n\nCheck that the following system call is being audited by performing the following series of commands to check the file system rules in \"/etc/audit/audit.rules\": \n\n# grep -iw \"mount\" /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S mount -F auid&gt;=1000 -F auid!=4294967295 -k privileged-mount\n-a always,exit -F arch=b64 -S mount -F auid&gt;=1000 -F auid!=4294967295 -k privileged-mount\n-a always,exit -F path=/usr/bin/mount -F auid&gt;=1000 -F auid!=4294967295 -k privileged-mount\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"mount\" syscall, this is a finding.\n\nIf all uses of the \"mount\" command are not being audited, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204553\"><title>SRG-OS-000042-GPOS-00020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204553r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030750</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the umount command.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged mount commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72173</ident><ident system=\"http://cyber.mil/legacy\">SV-86797</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4677r88852_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"umount\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/umount -F auid&gt;=1000 -F auid!=4294967295 -k privileged-mount\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4677r88852_fix\" /><check system=\"C-4677r88851_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"umount\" command occur.\n\nCheck that the following system call is being audited by performing the following series of commands to check the file system rules in \"/etc/audit/audit.rules\": \n\n# grep -iw \"/usr/bin/umount\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/umount -F auid&gt;=1000 -F auid!=4294967295 -k privileged-mount \n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204554\"><title>SRG-OS-000042-GPOS-00020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204554r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030760</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the postdrop command.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72175</ident><ident system=\"http://cyber.mil/legacy\">SV-86799</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4678r88855_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"postdrop\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/sbin/postdrop -F auid&gt;=1000 -F auid!=4294967295 -k privileged-postfix\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4678r88855_fix\" /><check system=\"C-4678r88854_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"postdrop\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n# grep -iw /usr/sbin/postdrop /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/postdrop -F auid&gt;=1000 -F auid!=4294967295 -k privileged-postfix\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204555\"><title>SRG-OS-000042-GPOS-00020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204555r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030770</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the postqueue command.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72177</ident><ident system=\"http://cyber.mil/legacy\">SV-86801</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4679r88858_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"postqueue\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/sbin/postqueue -F auid&gt;=1000 -F auid!=4294967295 -k privileged-postfix\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4679r88858_fix\" /><check system=\"C-4679r88857_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"postqueue\" command occur. \n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n# grep -iw /usr/sbin/postqueue /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/postqueue -F auid&gt;=1000 -F auid!=4294967295 -k privileged-postfix\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204556\"><title>SRG-OS-000042-GPOS-00020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204556r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030780</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the ssh-keysign command.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged ssh commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72179</ident><ident system=\"http://cyber.mil/legacy\">SV-86803</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4680r88861_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"ssh-keysign\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid&gt;=1000 -F auid!=4294967295 -k privileged-ssh\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4680r88861_fix\" /><check system=\"C-4680r88860_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"ssh-keysign\" command occur. \n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n# grep -iw /usr/libexec/openssh/ssh-keysign /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid&gt;=1000 -F auid!=4294967295 -k privileged-ssh\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204557\"><title>SRG-OS-000042-GPOS-00020</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204557r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030800</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the crontab command.</title><description>&lt;VulnDiscussion&gt;Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information.\n\nAt a minimum, the organization must audit the full-text recording of privileged commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n\nSatisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72183</ident><ident system=\"http://cyber.mil/legacy\">SV-86807</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-000135</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4681r88864_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"crontab\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/crontab -F auid&gt;=1000 -F auid!=4294967295 -k privileged-cron\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4681r88864_fix\" /><check system=\"C-4681r88863_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"crontab\" command occur. \n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n# grep -iw /usr/bin/crontab /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/crontab -F auid&gt;=1000 -F auid!=4294967295 -k privileged-cron\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204558\"><title>SRG-OS-000471-GPOS-00215</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204558r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030810</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the pam_timestamp_check command.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72185</ident><ident system=\"http://cyber.mil/legacy\">SV-86809</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4682r88867_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"pam_timestamp_check\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F auid&gt;=1000 -F auid!=4294967295 -k privileged-pam\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4682r88867_fix\" /><check system=\"C-4682r88866_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"pam_timestamp_check\" command occur. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -iw \"/usr/sbin/pam_timestamp_check\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F auid&gt;=1000 -F auid!=4294967295 -k privileged-pam \n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204559\"><title>SRG-OS-000471-GPOS-00216</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204559r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030819</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the create_module syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-78999</ident><ident system=\"http://cyber.mil/legacy\">SV-93705</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4683r88870_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"create_module\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S create_module -k module-change\n\n-a always,exit -F arch=b64 -S create_module -k module-change\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4683r88870_fix\" /><check system=\"C-4683r88869_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"create_module\" syscall occur. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -iw create_module /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S create_module -k module-change\n\n-a always,exit -F arch=b64 -S create_module -k module-change\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"create_module\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204560\"><title>SRG-OS-000471-GPOS-00216</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204560r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030820</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the init_module syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72187</ident><ident system=\"http://cyber.mil/legacy\">SV-86811</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4684r88873_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"init_module\" syscall occur. \n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S init_module -k module-change\n\n-a always,exit -F arch=b64 -S init_module -k module-change\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4684r88873_fix\" /><check system=\"C-4684r88872_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"init_module\" syscall occur. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -iw init_module /etc/audit/audit.rules \n\n-a always,exit -F arch=b32 -S init_module -k module-change\n\n-a always,exit -F arch=b64 -S init_module -k module-change\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"init_module\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204561\"><title>SRG-OS-000471-GPOS-00216</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204561r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030821</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the finit_module syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-79001</ident><ident system=\"http://cyber.mil/legacy\">SV-93707</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4685r88876_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"finit_module\" syscall occur. \n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F arch=b32 -S finit_module -k module-change\n\n-a always,exit -F arch=b64 -S finit_module -k module-change\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4685r88876_fix\" /><check system=\"C-4685r88875_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"finit_module\" syscall occur. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -iw finit_module /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S finit_module -k module-change\n\n-a always,exit -F arch=b64 -S finit_module -k module-change\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"finit_module\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204562\"><title>SRG-OS-000471-GPOS-00216</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204562r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030830</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the delete_module syscall.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72189</ident><ident system=\"http://cyber.mil/legacy\">SV-86813</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4686r88879_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"delete_module\" syscall occur. \n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F arch=b32 -S delete_module -k module-change\n\n-a always,exit -F arch=b64 -S delete_module -k module-change\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4686r88879_fix\" /><check system=\"C-4686r88878_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"delete_module\" syscall occur. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -iw delete_module /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S delete_module -k module-change\n\n-a always,exit -F arch=b64 -S delete_module -k module-change\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"delete_module\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204563\"><title>SRG-OS-000471-GPOS-00216</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204563r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030840</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the kmod command.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. \n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72191</ident><ident system=\"http://cyber.mil/legacy\">SV-86815</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-4687r88882_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"kmod\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-w /usr/bin/kmod -p x -F auid!=4294967295 -k module-change\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4687r88882_fix\" /><check system=\"C-4687r88881_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"kmod\" command occur. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n# grep -iw kmod /etc/audit/audit.rules\n\n-w /usr/bin/kmod -p x -F auid!=4294967295 -k module-change\n\nIf the command does not return any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204564\"><title>SRG-OS-000004-GPOS-00004</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204564r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030870</version><title>The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).\n\nSatisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72197</ident><ident system=\"http://cyber.mil/legacy\">SV-86821</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-000018</ident><ident system=\"http://cyber.mil/cci\">CCI-002130</ident><ident system=\"http://cyber.mil/cci\">CCI-001403</ident><fixtext fixref=\"F-4688r88885_fix\">Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect \"/etc/passwd\".\n\nAdd or update the following rule \"/etc/audit/rules.d/audit.rules\":\n\n-w /etc/passwd -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4688r88885_fix\" /><check system=\"C-4688r88884_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect \"/etc/passwd\".\n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n# grep /etc/passwd /etc/audit/audit.rules\n\n-w /etc/passwd -p wa -k identity\n\nIf the command does not return a line, or the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204565\"><title>SRG-OS-000004-GPOS-00004</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204565r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030871</version><title>The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-87817</ident><ident system=\"http://cyber.mil/legacy\">V-73165</ident><ident system=\"http://cyber.mil/cci\">CCI-000018</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-001403</ident><ident system=\"http://cyber.mil/cci\">CCI-002130</ident><fixtext fixref=\"F-4689r88888_fix\">Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect \"/etc/group\".\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-w /etc/group -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4689r88888_fix\" /><check system=\"C-4689r88887_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect \"/etc/group\".\n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n# grep /etc/group /etc/audit/audit.rules\n\n-w /etc/group -p wa -k identity\n\nIf the command does not return a line, or the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204566\"><title>SRG-OS-000004-GPOS-00004</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204566r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030872</version><title>The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-87819</ident><ident system=\"http://cyber.mil/legacy\">V-73167</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-000018</ident><ident system=\"http://cyber.mil/cci\">CCI-002130</ident><ident system=\"http://cyber.mil/cci\">CCI-001403</ident><fixtext fixref=\"F-4690r88891_fix\">Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect \"/etc/gshadow\".\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-w /etc/gshadow -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4690r88891_fix\" /><check system=\"C-4690r88890_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect \"/etc/gshadow\".\n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n# grep /etc/gshadow /etc/audit/audit.rules\n\n-w /etc/gshadow -p wa -k identity\n\nIf the command does not return a line, or the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204567\"><title>SRG-OS-000004-GPOS-00004</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204567r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030873</version><title>The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-87823</ident><ident system=\"http://cyber.mil/legacy\">V-73171</ident><ident system=\"http://cyber.mil/cci\">CCI-000018</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-001403</ident><ident system=\"http://cyber.mil/cci\">CCI-002130</ident><fixtext fixref=\"F-4691r88894_fix\">Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.\n\nAdd or update the following file system rule in \"/etc/audit/rules.d/audit.rules\":\n\n-w /etc/shadow -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4691r88894_fix\" /><check system=\"C-4691r88893_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.\n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n# grep /etc/shadow /etc/audit/audit.rules\n\n-w /etc/shadow -p wa -k identity\n\nIf the command does not return a line, or the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204568\"><title>SRG-OS-000004-GPOS-00004</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204568r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030874</version><title>The Red Hat Enterprise Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.</title><description>&lt;VulnDiscussion&gt;Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-87825</ident><ident system=\"http://cyber.mil/legacy\">V-73173</ident><ident system=\"http://cyber.mil/cci\">CCI-000018</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002130</ident><ident system=\"http://cyber.mil/cci\">CCI-001403</ident><fixtext fixref=\"F-4692r88897_fix\">Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.\n\nAdd or update the following file system rule in \"/etc/audit/rules.d/audit.rules\":\n\n-w /etc/security/opasswd -p wa -k identity\n\nThe audit daemon must be restarted for the changes to take effect:\n# systemctl restart auditd</fixtext><fix id=\"F-4692r88897_fix\" /><check system=\"C-4692r88896_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.\n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n# grep /etc/security/opasswd /etc/audit/audit.rules\n\n-w /etc/security/opasswd -p wa -k identity\n\nIf the command does not return a line, or the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204569\"><title>SRG-OS-000466-GPOS-00210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204569r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030880</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the rename syscall.</title><description>&lt;VulnDiscussion&gt;If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\n\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86823</ident><ident system=\"http://cyber.mil/legacy\">V-72199</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4693r88900_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"rename\" syscall occur.\n\nAdd the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S rename -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\n-a always,exit -F arch=b64 -S rename -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4693r88900_fix\" /><check system=\"C-4693r88899_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"rename\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw rename /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S rename -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\n-a always,exit -F arch=b64 -S rename -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"rename\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204570\"><title>SRG-OS-000466-GPOS-00210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204570r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030890</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the renameat syscall.</title><description>&lt;VulnDiscussion&gt;If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\n\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86825</ident><ident system=\"http://cyber.mil/legacy\">V-72201</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4694r88903_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"renameat\" syscall occur.\n\nAdd the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S renameat -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\n-a always,exit -F arch=b64 -S renameat -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4694r88903_fix\" /><check system=\"C-4694r88902_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"renameat\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw renameat /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S renameat -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\n-a always,exit -F arch=b64 -S renameat -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"renameat\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204571\"><title>SRG-OS-000466-GPOS-00210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204571r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030900</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the rmdir syscall.</title><description>&lt;VulnDiscussion&gt;If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\n\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86827</ident><ident system=\"http://cyber.mil/legacy\">V-72203</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4695r88906_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"rmdir\" syscall occur.\n\nAdd the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S rmdir -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\n-a always,exit -F arch=b64 -S rmdir -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4695r88906_fix\" /><check system=\"C-4695r88905_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"rmdir\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw rmdir /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S rmdir -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\n-a always,exit -F arch=b64 -S rmdir -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"rmdir\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204572\"><title>SRG-OS-000466-GPOS-00210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204572r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030910</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the unlink syscall.</title><description>&lt;VulnDiscussion&gt;If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\n\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86829</ident><ident system=\"http://cyber.mil/legacy\">V-72205</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4696r88909_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"unlink\" syscall occur.\n\nAdd the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S unlink -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\n-a always,exit -F arch=b64 -S unlink -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4696r88909_fix\" /><check system=\"C-4696r88908_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"unlink\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw unlink /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S unlink -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\n-a always,exit -F arch=b64 -S unlink -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"unlink\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204573\"><title>SRG-OS-000466-GPOS-00210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204573r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-030920</version><title>The Red Hat Enterprise Linux operating system must audit all uses of the unlinkat syscall.</title><description>&lt;VulnDiscussion&gt;If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise.\n\nSatisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86831</ident><ident system=\"http://cyber.mil/legacy\">V-72207</ident><ident system=\"http://cyber.mil/cci\">CCI-000172</ident><ident system=\"http://cyber.mil/cci\">CCI-002884</ident><fixtext fixref=\"F-4697r88912_fix\">Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"unlinkat\" syscall occur.\n\nAdd the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S unlinkat -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\n-a always,exit -F arch=b64 -S unlinkat -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\nThe audit daemon must be restarted for the changes to take effect.</fixtext><fix id=\"F-4697r88912_fix\" /><check system=\"C-4697r88911_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"unlinkat\" syscall occur.\n\nCheck the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n\n# grep -iw unlinkat /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S unlinkat -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\n-a always,exit -F arch=b64 -S unlinkat -F auid&gt;=1000 -F auid!=4294967295 -k delete\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"unlinkat\" syscall, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204574\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204574r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-031000</version><title>The Red Hat Enterprise Linux operating system must send rsyslog output to a log aggregation server.</title><description>&lt;VulnDiscussion&gt;Sending rsyslog output to another system ensures that the logs cannot be removed or modified in the event that the system is compromised or has a hardware failure.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72209</ident><ident system=\"http://cyber.mil/legacy\">SV-86833</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4698r88915_fix\">Modify the \"/etc/rsyslog.conf\" or an \"/etc/rsyslog.d/*.conf\" file to contain a configuration line to send all \"rsyslog\" output to a log aggregation system:\n*.* @@&lt;log aggregation system name&gt;</fixtext><fix id=\"F-4698r88915_fix\" /><check system=\"C-4698r88914_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify \"rsyslog\" is configured to send all messages to a log aggregation server.\n\nCheck the configuration of \"rsyslog\" with the following command:\n\nNote: If another logging package is used, substitute the utility configuration file for \"/etc/rsyslog.conf\".\n\n# grep @ /etc/rsyslog.conf /etc/rsyslog.d/*.conf\n*.* @@logagg.site.mil\n\nIf there are no lines in the \"/etc/rsyslog.conf\" or \"/etc/rsyslog.d/*.conf\" files that contain the \"@\" or \"@@\" symbol(s), and the lines with the correct symbol(s) to send output to another system do not cover all \"rsyslog\" output, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. \n\nIf the lines are commented out or there is no evidence that the audit logs are being sent to another system, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204575\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204575r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-031010</version><title>The Red Hat Enterprise Linux operating system must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.</title><description>&lt;VulnDiscussion&gt;Unintentionally running a rsyslog server accepting remote messages puts the system at increased risk. Malicious rsyslog messages sent to the server could exploit vulnerabilities in the server software itself, could introduce misleading information in to the system's logs, or could fill the system's storage leading to a Denial of Service.\n\nIf the system is intended to be a log aggregation server its use must be documented with the ISSO.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72211</ident><ident system=\"http://cyber.mil/legacy\">SV-86835</ident><ident system=\"http://cyber.mil/cci\">CCI-000318</ident><ident system=\"http://cyber.mil/cci\">CCI-000368</ident><ident system=\"http://cyber.mil/cci\">CCI-001814</ident><ident system=\"http://cyber.mil/cci\">CCI-001812</ident><ident system=\"http://cyber.mil/cci\">CCI-001813</ident><fixtext fixref=\"F-4699r88918_fix\">Modify the \"/etc/rsyslog.conf\" file to remove the \"ModLoad imtcp\", \"ModLoad imudp\", and \"ModLoad imrelp\" configuration lines, or document the system as being used for log aggregation.</fixtext><fix id=\"F-4699r88918_fix\" /><check system=\"C-4699r88917_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that the system is not accepting \"rsyslog\" messages from other systems unless it is documented as a log aggregation server.\n\nCheck the configuration of \"rsyslog\" with the following command:\n\n# grep imtcp /etc/rsyslog.conf\n$ModLoad imtcp\n# grep imudp /etc/rsyslog.conf\n$ModLoad imudp\n# grep imrelp /etc/rsyslog.conf\n$ModLoad imrelp\n\nIf any of the above modules are being loaded in the \"/etc/rsyslog.conf\" file, ask to see the documentation for the system being used for log aggregation.\n\nIf the documentation does not exist, or does not specify the server as a log aggregation system, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204576\"><title>SRG-OS-000027-GPOS-00008</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204576r241939_rule\" weight=\"10.0\" severity=\"low\"><version>RHEL-07-040000</version><title>The Red Hat Enterprise Linux operating system must limit the number of concurrent sessions to 10 for all accounts and/or account types.</title><description>&lt;VulnDiscussion&gt;Operating system management includes the ability to control the number of users and user sessions that utilize an operating system. Limiting the number of allowed users and sessions per user is helpful in reducing the risks related to DoS attacks.\n\nThis requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based on mission needs and the operational environment for each system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72217</ident><ident system=\"http://cyber.mil/legacy\">SV-86841</ident><ident system=\"http://cyber.mil/cci\">CCI-000054</ident><fixtext fixref=\"F-4700r88921_fix\">Configure the operating system to limit the number of concurrent sessions to \"10\" for all accounts and/or account types.\n\nAdd the following line to the top of the /etc/security/limits.conf or in a \".conf\" file defined in /etc/security/limits.d/ :\n\n* hard maxlogins 10</fixtext><fix id=\"F-4700r88921_fix\" /><check system=\"C-4700r88920_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system limits the number of concurrent sessions to \"10\" for all accounts and/or account types by issuing the following command:\n\n# grep \"maxlogins\" /etc/security/limits.conf /etc/security/limits.d/*.conf\n\n* hard maxlogins 10\n\nThis can be set as a global domain (with the * wildcard) but may be set differently for multiple domains.\n\nIf the \"maxlogins\" item is missing, commented out, or the value is not set to \"10\" or less for all domains that have the \"maxlogins\" item assigned, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204577\"><title>SRG-OS-000096-GPOS-00050</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204577r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040100</version><title>The Red Hat Enterprise Linux operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA) an</title><description>&lt;VulnDiscussion&gt;In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\n\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component.\n\nTo support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.\n\nSatisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72219</ident><ident system=\"http://cyber.mil/legacy\">SV-86843</ident><ident system=\"http://cyber.mil/cci\">CCI-000382</ident><ident system=\"http://cyber.mil/cci\">CCI-002314</ident><fixtext fixref=\"F-4701r88924_fix\">Update the host's firewall settings and/or running services to comply with the PPSM CLSA for the site or program and the PPSM CAL.</fixtext><fix id=\"F-4701r88924_fix\" /><check system=\"C-4701r88923_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Inspect the firewall configuration and running services to verify that it is configured to prohibit or restrict the use of functions, ports, protocols, and/or services that are unnecessary or prohibited.\n\nCheck which services are currently active with the following command:\n\n# firewall-cmd --list-all\npublic (default, active)\n  interfaces: enp0s3\n  sources: \n  services: dhcpv6-client dns http https ldaps rpc-bind ssh\n  ports: \n  masquerade: no\n  forward-ports: \n  icmp-blocks: \n  rich rules: \n\nAsk the System Administrator for the site or program PPSM CLSA. Verify the services allowed by the firewall match the PPSM CLSA. \n\nIf there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols, or services that are prohibited by the PPSM Category Assurance List (CAL), this is a finding.</check-content></check></Rule></Group><Group id=\"V-204578\"><title>SRG-OS-000033-GPOS-00014</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204578r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040110</version><title>The Red Hat Enterprise Linux operating system must use a FIPS 140-2 approved cryptographic algorithm for SSH communications.</title><description>&lt;VulnDiscussion&gt;Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised.\n\nOperating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules.\n\nFIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system.\n\nSatisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72221</ident><ident system=\"http://cyber.mil/legacy\">SV-86845</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><ident system=\"http://cyber.mil/cci\">CCI-000803</ident><ident system=\"http://cyber.mil/cci\">CCI-000068</ident><fixtext fixref=\"F-4702r88927_fix\">Configure SSH to use FIPS 140-2 approved cryptographic algorithms.\n\nAdd the following line (or modify the line to have the required value) to the \"/etc/ssh/sshd_config\" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor).\n\nCiphers aes128-ctr,aes192-ctr,aes256-ctr\n\nThe SSH service must be restarted for changes to take effect.</fixtext><fix id=\"F-4702r88927_fix\" /><check system=\"C-4702r88926_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system uses mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.\n\nNote: If RHEL-07-021350 is a finding, this is automatically a finding as the system cannot implement FIPS 140-2-approved cryptographic algorithms and hashes.\n\nThe location of the \"sshd_config\" file may vary if a different daemon is in use.\n\nInspect the \"Ciphers\" configuration with the following command:\n\n# grep -i ciphers /etc/ssh/sshd_config\nCiphers aes128-ctr,aes192-ctr,aes256-ctr\n\nIf any ciphers other than \"aes128-ctr\", \"aes192-ctr\", or \"aes256-ctr\" are listed, the \"Ciphers\" keyword is missing, or the returned line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204579\"><title>SRG-OS-000163-GPOS-00072</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204579r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040160</version><title>The Red Hat Enterprise Linux operating system must be configured so that all network connections associated with a communication session are terminated at the end of the session or after 10 minutes of inactivity from the user at a command prompt, except t</title><description>&lt;VulnDiscussion&gt;Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element. \n\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72223</ident><ident system=\"http://cyber.mil/legacy\">SV-86847</ident><ident system=\"http://cyber.mil/cci\">CCI-001133</ident><ident system=\"http://cyber.mil/cci\">CCI-002361</ident><fixtext fixref=\"F-4703r88930_fix\">Configure the operating system to terminate all network connections associated with a communications session at the end of the session or after a period of inactivity.\n\nCreate a script to enforce the inactivity timeout (for example /etc/profile.d/tmout.sh) such as:\n\n#!/bin/bash\n\nTMOUT=600\nreadonly TMOUT\nexport TMOUT</fixtext><fix id=\"F-4703r88930_fix\" /><check system=\"C-4703r88929_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system terminates all network connections associated with a communications session at the end of the session or based on inactivity.\n\nCheck the value of the system inactivity timeout with the following command:\n\n# grep -i tmout /etc/profile.d/*\n\netc/profile.d/tmout.sh:TMOUT=600\n\n/etc/profile.d/tmout.sh:readonly TMOUT\n\n/etc/profile.d/tmout.sh:export TMOUT\n\nIf \"TMOUT\" is not set to \"600\" or less in a script located in the /etc/profile.d/ directory to enforce session termination after inactivity, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204580\"><title>SRG-OS-000023-GPOS-00006</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204580r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040170</version><title>The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner immediately prior to, or as part of, remote access logon prompts.</title><description>&lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the publicly accessible operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\n\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\n\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007 , SRG-OS-000228-GPOS-00088&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72225</ident><ident system=\"http://cyber.mil/legacy\">SV-86849</ident><ident system=\"http://cyber.mil/cci\">CCI-001384</ident><ident system=\"http://cyber.mil/cci\">CCI-001385</ident><ident system=\"http://cyber.mil/cci\">CCI-001386</ident><ident system=\"http://cyber.mil/cci\">CCI-001387</ident><ident system=\"http://cyber.mil/cci\">CCI-001388</ident><ident system=\"http://cyber.mil/cci\">CCI-000048</ident><ident system=\"http://cyber.mil/cci\">CCI-000050</ident><fixtext fixref=\"F-4704r88933_fix\">Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via the ssh.\n\nEdit the \"/etc/ssh/sshd_config\" file to uncomment the banner keyword and configure it to point to a file that will contain the logon banner (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). An example configuration line is:\n\nbanner /etc/issue\n\nEither create the file containing the banner or replace the text in the file with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n \n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\nThe SSH service must be restarted for changes to take effect.</fixtext><fix id=\"F-4704r88933_fix\" /><check system=\"C-4704r88932_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify any publicly accessible connection to the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\n\nCheck for the location of the banner file being used with the following command:\n\n# grep -i banner /etc/ssh/sshd_config\n\nbanner /etc/issue\n\nThis command will return the banner keyword and the name of the file that contains the ssh banner (in this case \"/etc/issue\").\n\nIf the line is commented out, this is a finding.\n\nView the file specified by the banner keyword to check that it matches the text of the Standard Mandatory DoD Notice and Consent Banner:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\nIf the system does not display a graphical logon banner or the banner does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.\n\nIf the text in the file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204581\"><title>SRG-OS-000250-GPOS-00093</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204581r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040180</version><title>The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications.</title><description>&lt;VulnDiscussion&gt;Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\n\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72227</ident><ident system=\"http://cyber.mil/legacy\">SV-86851</ident><ident system=\"http://cyber.mil/cci\">CCI-001453</ident><fixtext fixref=\"F-4705r88936_fix\">Configure the operating system to implement cryptography to protect the integrity of LDAP authentication sessions.\n\nAdd or modify the following line in \"/etc/sssd/sssd.conf\":\n\nldap_id_use_start_tls = true</fixtext><fix id=\"F-4705r88936_fix\" /><check system=\"C-4705r88935_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>If LDAP is not being utilized, this requirement is Not Applicable.\n\nVerify the operating system implements cryptography to protect the integrity of remote LDAP authentication sessions.\n\nTo determine if LDAP is being used for authentication, use the following command:\n\n# systemctl status sssd.service\nsssd.service - System Security Services Daemon\nLoaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\nActive: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\n\nIf the \"sssd.service\" is \"active\", then LDAP is being used. \n\nDetermine the \"id_provider\" the LDAP is currently using:\n\n# grep -i \"id_provider\" /etc/sssd/sssd.conf\n\nid_provider = ad\n\nIf \"id_provider\" is set to \"ad\", this is Not Applicable.\n\nEnsure that LDAP is configured to use TLS by using the following command:\n\n# grep -i \"start_tls\" /etc/sssd/sssd.conf\nldap_id_use_start_tls = true\n\nIf the \"ldap_id_use_start_tls\" option is not \"true\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204582\"><title>SRG-OS-000250-GPOS-00093</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204582r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040190</version><title>The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.</title><description>&lt;VulnDiscussion&gt;Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\n\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72229</ident><ident system=\"http://cyber.mil/legacy\">SV-86853</ident><ident system=\"http://cyber.mil/cci\">CCI-001453</ident><fixtext fixref=\"F-4706r88939_fix\">Configure the operating system to implement cryptography to protect the integrity of LDAP remote access sessions.\n\nAdd or modify the following line in \"/etc/sssd/sssd.conf\":\n\nldap_tls_reqcert = demand</fixtext><fix id=\"F-4706r88939_fix\" /><check system=\"C-4706r88938_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>If LDAP is not being utilized, this requirement is Not Applicable.\n\nVerify the operating system implements cryptography to protect the integrity of remote LDAP access sessions.\n\nTo determine if LDAP is being used for authentication, use the following command:\n\n# systemctl status sssd.service\nsssd.service - System Security Services Daemon\nLoaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\nActive: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\n\nIf the \"sssd.service\" is \"active\", then LDAP is being used. \n\nDetermine the \"id_provider\" the LDAP is currently using:\n\n# grep -i \"id_provider\" /etc/sssd/sssd.conf\n\nid_provider = ad\n\nIf \"id_provider\" is set to \"ad\", this is Not Applicable.\n\nVerify the sssd service is configured to require the use of certificates:\n\n# grep -i tls_reqcert /etc/sssd/sssd.conf\nldap_tls_reqcert = demand\n\nIf the \"ldap_tls_reqcert\" setting is missing, commented out, or does not exist, this is a finding.\n\nIf the \"ldap_tls_reqcert\" setting is not set to \"demand\" or \"hard\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204583\"><title>SRG-OS-000250-GPOS-00093</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204583r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040200</version><title>The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.</title><description>&lt;VulnDiscussion&gt;Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\n\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72231</ident><ident system=\"http://cyber.mil/legacy\">SV-86855</ident><ident system=\"http://cyber.mil/cci\">CCI-001453</ident><fixtext fixref=\"F-4707r88942_fix\">Configure the operating system to implement cryptography to protect the integrity of LDAP remote access sessions.\n\nAdd or modify the following line in \"/etc/sssd/sssd.conf\":\n\nldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt</fixtext><fix id=\"F-4707r88942_fix\" /><check system=\"C-4707r88941_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>If LDAP is not being utilized, this requirement is Not Applicable.\n\nVerify the operating system implements cryptography to protect the integrity of remote LDAP access sessions.\n\nTo determine if LDAP is being used for authentication, use the following command:\n\n# systemctl status sssd.service\nsssd.service - System Security Services Daemon\nLoaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\nActive: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\n\nIf the \"sssd.service\" is \"active\", then LDAP is being used.\n\nDetermine the \"id_provider\" that the LDAP is currently using:\n\n# grep -i \"id_provider\" /etc/sssd/sssd.conf\n\nid_provider = ad\n\nIf \"id_provider\" is set to \"ad\", this is Not Applicable.\n\nCheck the path to the X.509 certificate for peer authentication with the following command:\n\n# grep -i tls_cacert /etc/sssd/sssd.conf\n\nldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt\n\nVerify the \"ldap_tls_cacert\" option points to a file that contains the trusted CA certificate.\n\nIf this file does not exist, or the option is commented out or missing, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204584\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204584r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040201</version><title>The Red Hat Enterprise Linux operating system must implement virtual address space randomization.</title><description>&lt;VulnDiscussion&gt;Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code he or she has introduced into a process's address space during an attempt at exploitation. Additionally, ASLR also makes it more difficult for an attacker to know the location of existing code in order to repurpose it using return-oriented programming (ROP) techniques.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-77825</ident><ident system=\"http://cyber.mil/legacy\">SV-92521</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4708r88945_fix\">Configure the operating system implement virtual address space randomization.\n\nSet the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a config file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n\nkernel.randomize_va_space = 2\n\nIssue the following command to make the changes take effect:\n\n# sysctl --system</fixtext><fix id=\"F-4708r88945_fix\" /><check system=\"C-4708r88944_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system implements virtual address space randomization.\n\n# grep kernel.randomize_va_space /etc/sysctl.conf /etc/sysctl.d/*\n\nkernel.randomize_va_space = 2\n\nIf \"kernel.randomize_va_space\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \"2\", this is a finding.\n\nCheck that the operating system implements virtual address space randomization with the following command:\n\n# /sbin/sysctl -a | grep kernel.randomize_va_space \n\nkernel.randomize_va_space = 2\n\nIf \"kernel.randomize_va_space\" does not have a value of \"2\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204585\"><title>SRG-OS-000423-GPOS-00187</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204585r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040300</version><title>The Red Hat Enterprise Linux operating system must be configured so that all networked systems have SSH installed.</title><description>&lt;VulnDiscussion&gt;Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. \n\nThis requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. \n\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, logical means (cryptography) do not have to be employed, and vice versa.\n\nSatisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86857</ident><ident system=\"http://cyber.mil/legacy\">V-72233</ident><ident system=\"http://cyber.mil/cci\">CCI-002418</ident><ident system=\"http://cyber.mil/cci\">CCI-002420</ident><ident system=\"http://cyber.mil/cci\">CCI-002421</ident><ident system=\"http://cyber.mil/cci\">CCI-002422</ident><fixtext fixref=\"F-4709r88948_fix\">Install SSH packages onto the host with the following commands:\n\n# yum install openssh-server.x86_64</fixtext><fix id=\"F-4709r88948_fix\" /><check system=\"C-4709r88947_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Check to see if sshd is installed with the following command:\n\n# yum list installed \\*ssh\\*\nlibssh2.x86_64 1.4.3-8.el7 @anaconda/7.1\nopenssh.x86_64 6.6.1p1-11.el7 @anaconda/7.1\nopenssh-server.x86_64 6.6.1p1-11.el7 @anaconda/7.1\n\nIf the \"SSH server\" package is not installed, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204586\"><title>SRG-OS-000423-GPOS-00187</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204586r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040310</version><title>The Red Hat Enterprise Linux operating system must be configured so that all networked systems use SSH for confidentiality and integrity of transmitted and received information as well as information during preparation for transmission.</title><description>&lt;VulnDiscussion&gt;Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. \n\nThis requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. \n\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.\n\nSatisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000423-GPOS-00188, SRG-OS-000423-GPOS-00189, SRG-OS-000423-GPOS-00190&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86859</ident><ident system=\"http://cyber.mil/legacy\">V-72235</ident><ident system=\"http://cyber.mil/cci\">CCI-002421</ident><ident system=\"http://cyber.mil/cci\">CCI-002422</ident><ident system=\"http://cyber.mil/cci\">CCI-002418</ident><ident system=\"http://cyber.mil/cci\">CCI-002420</ident><fixtext fixref=\"F-4710r88951_fix\">Configure the SSH service to automatically start after reboot with the following command:\n\n# systemctl enable sshd.service</fixtext><fix id=\"F-4710r88951_fix\" /><check system=\"C-4710r88950_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify SSH is loaded and active with the following command:\n\n# systemctl status sshd\nsshd.service - OpenSSH server daemon\nLoaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)\nActive: active (running) since Tue 2015-11-17 15:17:22 EST; 4 weeks 0 days ago\nMain PID: 1348 (sshd)\nCGroup: /system.slice/sshd.service\n1053 /usr/sbin/sshd -D\n\nIf \"sshd\" does not show a status of \"active\" and \"running\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204587\"><title>SRG-OS-000163-GPOS-00072</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204587r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040320</version><title>The Red Hat Enterprise Linux operating system must be configured so that all network connections associated with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity, except to fulfill documented and validated mission req</title><description>&lt;VulnDiscussion&gt;Terminating an idle SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element.\n\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.\n\nSatisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86861</ident><ident system=\"http://cyber.mil/legacy\">V-72237</ident><ident system=\"http://cyber.mil/cci\">CCI-001133</ident><ident system=\"http://cyber.mil/cci\">CCI-002361</ident><fixtext fixref=\"F-4711r88954_fix\">Configure the operating system to automatically terminate a user session after inactivity time-outs have expired or at shutdown.\n\nAdd the following line (or modify the line to have the required value) to the \"/etc/ssh/sshd_config\" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\n\nClientAliveInterval 600\n\nThe SSH service must be restarted for changes to take effect.</fixtext><fix id=\"F-4711r88954_fix\" /><check system=\"C-4711r88953_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system automatically terminates a user session after inactivity time-outs have expired.\n\nCheck for the value of the \"ClientAliveInterval\" keyword with the following command:\n\n# grep -iw clientaliveinterval /etc/ssh/sshd_config\n\nClientAliveInterval 600\n\nIf \"ClientAliveInterval\" is not configured, commented out, or has a value of \"0\", this is a finding.\n\nIf \"ClientAliveInterval\" has a value that is greater than \"600\" and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204588\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204588r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040330</version><title>The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using RSA rhosts authentication.</title><description>&lt;VulnDiscussion&gt;Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86863</ident><ident system=\"http://cyber.mil/legacy\">V-72239</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4712r88957_fix\">Configure the SSH daemon to not allow authentication using RSA rhosts authentication.\n\nAdd the following line in \"/etc/ssh/sshd_config\", or uncomment the line and set the value to \"no\":\n\nRhostsRSAAuthentication no\n\nThe SSH service must be restarted for changes to take effect.</fixtext><fix id=\"F-4712r88957_fix\" /><check system=\"C-4712r88956_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Check the version of the operating system with the following command:\n\n# cat /etc/redhat-release\n\nIf the release is 7.4 or newer this requirement is Not Applicable.\n\nVerify the SSH daemon does not allow authentication using RSA rhosts authentication.\n\nTo determine how the SSH daemon's \"RhostsRSAAuthentication\" option is set, run the following command:\n\n# grep RhostsRSAAuthentication /etc/ssh/sshd_config\nRhostsRSAAuthentication no\n\nIf the value is returned as \"yes\", the returned line is commented out, or no output is returned, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204589\"><title>SRG-OS-000163-GPOS-00072</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204589r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040340</version><title>The Red Hat Enterprise Linux operating system must be configured so that all network connections associated with SSH traffic terminate after a period of inactivity.</title><description>&lt;VulnDiscussion&gt;Terminating an idle SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element.\n\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.\n\nSatisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86865</ident><ident system=\"http://cyber.mil/legacy\">V-72241</ident><ident system=\"http://cyber.mil/cci\">CCI-001133</ident><ident system=\"http://cyber.mil/cci\">CCI-002361</ident><fixtext fixref=\"F-4713r88960_fix\">Configure the operating system to terminate automatically a user session after inactivity time-outs have expired or at shutdown.\n\nAdd the following line (or modify the line to have the required value) to the \"/etc/ssh/sshd_config\" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\n\nClientAliveCountMax 0\n\nThe SSH service must be restarted for changes to take effect.</fixtext><fix id=\"F-4713r88960_fix\" /><check system=\"C-4713r88959_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system automatically terminates a user session after inactivity time-outs have expired.\n\nCheck for the value of the \"ClientAliveCountMax\" keyword with the following command:\n\n# grep -i clientalivecount /etc/ssh/sshd_config\nClientAliveCountMax 0\n\nIf \"ClientAliveCountMax\" is not set to \"0\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204590\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204590r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040350</version><title>The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using rhosts authentication.</title><description>&lt;VulnDiscussion&gt;Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86867</ident><ident system=\"http://cyber.mil/legacy\">V-72243</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4714r88963_fix\">Configure the SSH daemon to not allow authentication using known hosts authentication.\n\nAdd the following line in \"/etc/ssh/sshd_config\", or uncomment the line and set the value to \"yes\":\n\nIgnoreRhosts yes</fixtext><fix id=\"F-4714r88963_fix\" /><check system=\"C-4714r88962_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the SSH daemon does not allow authentication using known hosts authentication.\n\nTo determine how the SSH daemon's \"IgnoreRhosts\" option is set, run the following command:\n\n# grep -i IgnoreRhosts /etc/ssh/sshd_config\n\nIgnoreRhosts yes\n\nIf the value is returned as \"no\", the returned line is commented out, or no output is returned, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204591\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204591r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040360</version><title>The Red Hat Enterprise Linux operating system must display the date and time of the last successful account logon upon an SSH logon.</title><description>&lt;VulnDiscussion&gt;Providing users with feedback on when account accesses via SSH last occurred facilitates user recognition and reporting of unauthorized account use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86869</ident><ident system=\"http://cyber.mil/legacy\">V-72245</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4715r88966_fix\">Configure SSH to provide users with feedback on when account accesses last occurred by setting the required configuration options in \"/etc/pam.d/sshd\" or in the \"sshd_config\" file used by the system (\"/etc/ssh/sshd_config\" will be used in the example) (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor).\n\nModify the \"PrintLastLog\" line in \"/etc/ssh/sshd_config\" to match the following:\n\nPrintLastLog yes\n\nThe SSH service must be restarted for changes to \"sshd_config\" to take effect.</fixtext><fix id=\"F-4715r88966_fix\" /><check system=\"C-4715r88965_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify SSH provides users with feedback on when account accesses last occurred.\n\nCheck that \"PrintLastLog\" keyword in the sshd daemon configuration file is used and set to \"yes\" with the following command:\n\n# grep -i printlastlog /etc/ssh/sshd_config\nPrintLastLog yes\n\nIf the \"PrintLastLog\" keyword is set to \"no\", is missing, or is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204592\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204592r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040370</version><title>The Red Hat Enterprise Linux operating system must not permit direct logons to the root account using remote access via SSH.</title><description>&lt;VulnDiscussion&gt;Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging on directly as root. In addition, logging on with a user-specific account provides individual accountability of actions performed on the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86871</ident><ident system=\"http://cyber.mil/legacy\">V-72247</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4716r88969_fix\">Configure SSH to stop users from logging on remotely as the root user.\n\nEdit the appropriate  \"/etc/ssh/sshd_config\" file to uncomment or add the line for the \"PermitRootLogin\" keyword and set its value to \"no\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\n\nPermitRootLogin no\n\nThe SSH service must be restarted for changes to take effect.</fixtext><fix id=\"F-4716r88969_fix\" /><check system=\"C-4716r88968_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify remote access using SSH prevents users from logging on directly as root.\n\nCheck that SSH prevents users from logging on directly as root with the following command:\n\n# grep -i permitrootlogin /etc/ssh/sshd_config\nPermitRootLogin no\n\nIf the \"PermitRootLogin\" keyword is set to \"yes\", is missing, or is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204593\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204593r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040380</version><title>The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using known hosts authentication.</title><description>&lt;VulnDiscussion&gt;Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86873</ident><ident system=\"http://cyber.mil/legacy\">V-72249</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4717r88972_fix\">Configure the SSH daemon to not allow authentication using known hosts authentication.\n\nAdd the following line in \"/etc/ssh/sshd_config\", or uncomment the line and set the value to \"yes\":\n\nIgnoreUserKnownHosts yes\n\nThe SSH service must be restarted for changes to take effect.</fixtext><fix id=\"F-4717r88972_fix\" /><check system=\"C-4717r88971_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the SSH daemon does not allow authentication using known hosts authentication.\n\nTo determine how the SSH daemon's \"IgnoreUserKnownHosts\" option is set, run the following command:\n\n# grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config\n\nIgnoreUserKnownHosts yes\n\nIf the value is returned as \"no\", the returned line is commented out, or no output is returned, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204594\"><title>SRG-OS-000074-GPOS-00042</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204594r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-040390</version><title>The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use the SSHv2 protocol.</title><description>&lt;VulnDiscussion&gt;SSHv1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system.\n\nSatisfies: SRG-OS-000074-GPOS-00042, SRG-OS-000480-GPOS-00227&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72251</ident><ident system=\"http://cyber.mil/legacy\">SV-86875</ident><ident system=\"http://cyber.mil/cci\">CCI-000197</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4718r88975_fix\">Remove all Protocol lines that reference version \"1\" in \"/etc/ssh/sshd_config\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). The \"Protocol\" line must be as follows:\n\nProtocol 2\n\nThe SSH service must be restarted for changes to take effect.</fixtext><fix id=\"F-4718r88975_fix\" /><check system=\"C-4718r88974_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Check the version of the operating system with the following command:\n\n# cat /etc/redhat-release\n\nIf the release is 7.4 or newer this requirement is Not Applicable.\n\nVerify the SSH daemon is configured to only use the SSHv2 protocol.\n\nCheck that the SSH daemon is configured to only use the SSHv2 protocol with the following command:\n\n# grep -i protocol /etc/ssh/sshd_config\nProtocol 2\n#Protocol 1,2\n\nIf any protocol line other than \"Protocol 2\" is uncommented, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204595\"><title>SRG-OS-000250-GPOS-00093</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204595r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040400</version><title>The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.</title><description>&lt;VulnDiscussion&gt;DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions. The only SSHv2 hash algorithm meeting this requirement is SHA.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72253</ident><ident system=\"http://cyber.mil/legacy\">SV-86877</ident><ident system=\"http://cyber.mil/cci\">CCI-001453</ident><fixtext fixref=\"F-4719r88978_fix\">Edit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for the \"MACs\" keyword and set its value to \"hmac-sha2-256\" and/or \"hmac-sha2-512\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\n\nMACs hmac-sha2-256,hmac-sha2-512\n\nThe SSH service must be restarted for changes to take effect.</fixtext><fix id=\"F-4719r88978_fix\" /><check system=\"C-4719r88977_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the SSH daemon is configured to only use MACs employing FIPS 140-2-approved ciphers.\n\nNote: If RHEL-07-021350 is a finding, this is automatically a finding as the system cannot implement FIPS 140-2-approved cryptographic algorithms and hashes.\n\nCheck that the SSH daemon is configured to only use MACs employing FIPS 140-2-approved ciphers with the following command:\n\n# grep -i macs /etc/ssh/sshd_config\nMACs hmac-sha2-256,hmac-sha2-512\n\nIf any ciphers other than \"hmac-sha2-256\" or \"hmac-sha2-512\" are listed or the returned line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204596\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204596r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040410</version><title>The Red Hat Enterprise Linux operating system must be configured so that the SSH public host key files have mode 0644 or less permissive.</title><description>&lt;VulnDiscussion&gt;If a public host key file is modified by an unauthorized user, the SSH service may be compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72255</ident><ident system=\"http://cyber.mil/legacy\">SV-86879</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4720r88981_fix\">Note: SSH public key files may be found in other directories on the system depending on the installation. \n\nChange the mode of public host key files under \"/etc/ssh\" to \"0644\" with the following command:\n\n# chmod 0644 /etc/ssh/*.key.pub</fixtext><fix id=\"F-4720r88981_fix\" /><check system=\"C-4720r88980_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the SSH public host key files have mode \"0644\" or less permissive.\n\nNote: SSH public key files may be found in other directories on the system depending on the installation.\n\nThe following command will find all SSH public key files on the system:\n\n# find /etc/ssh -name '*.pub' -exec ls -lL {} \\;\n\n-rw-r--r-- 1 root root 618 Nov 28 06:43 ssh_host_dsa_key.pub\n-rw-r--r-- 1 root root 347 Nov 28 06:43 ssh_host_key.pub\n-rw-r--r-- 1 root root 238 Nov 28 06:43 ssh_host_rsa_key.pub\n\nIf any file has a mode more permissive than \"0644\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204597\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204597r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040420</version><title>The Red Hat Enterprise Linux operating system must be configured so that the SSH private host key files have mode 0640 or less permissive.</title><description>&lt;VulnDiscussion&gt;If an unauthorized user obtains the private SSH host key file, the host could be impersonated.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72257</ident><ident system=\"http://cyber.mil/legacy\">SV-86881</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4721r88984_fix\">Configure the mode of SSH private host key files under \"/etc/ssh\" to \"0640\" with the following command:\n\n# chmod 0640 /path/to/file/ssh_host*key\n</fixtext><fix id=\"F-4721r88984_fix\" /><check system=\"C-4721r88983_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the SSH private host key files have mode \"0640\" or less permissive.\n\nThe following command will find all SSH private key files on the system and list their modes:\n\n# find / -name '*ssh_host*key' | xargs ls -lL\n\n-rw-r----- 1 root ssh_keys 668 Nov 28 06:43 ssh_host_dsa_key\n-rw-r----- 1 root ssh_keys 582 Nov 28 06:43 ssh_host_key\n-rw-r----- 1 root ssh_keys 887 Nov 28 06:43 ssh_host_rsa_key\n\nIf any file has a mode more permissive than \"0640\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204598\"><title>SRG-OS-000364-GPOS-00151</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204598r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040430</version><title>The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.</title><description>&lt;VulnDiscussion&gt;GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72259</ident><ident system=\"http://cyber.mil/legacy\">SV-86883</ident><ident system=\"http://cyber.mil/cci\">CCI-000318</ident><ident system=\"http://cyber.mil/cci\">CCI-000368</ident><ident system=\"http://cyber.mil/cci\">CCI-001812</ident><ident system=\"http://cyber.mil/cci\">CCI-001814</ident><ident system=\"http://cyber.mil/cci\">CCI-001813</ident><fixtext fixref=\"F-4722r88987_fix\">Uncomment the \"GSSAPIAuthentication\" keyword in \"/etc/ssh/sshd_config\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \"no\": \n\nGSSAPIAuthentication no\n\nThe SSH service must be restarted for changes to take effect.\n\nIf GSSAPI authentication is required, it must be documented, to include the location of the configuration file, with the ISSO.</fixtext><fix id=\"F-4722r88987_fix\" /><check system=\"C-4722r88986_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the SSH daemon does not permit GSSAPI authentication unless approved.\n\nCheck that the SSH daemon does not permit GSSAPI authentication with the following command:\n\n# grep -i gssapiauth /etc/ssh/sshd_config\nGSSAPIAuthentication no\n\nIf the \"GSSAPIAuthentication\" keyword is missing, is set to \"yes\" and is not documented with the Information System Security Officer (ISSO), or the returned line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204599\"><title>SRG-OS-000364-GPOS-00151</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204599r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040440</version><title>The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed.</title><description>&lt;VulnDiscussion&gt;Kerberos authentication for SSH is often implemented using Generic Security Service Application Program Interface (GSSAPI). If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementation may then be subject to exploitation. To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be disabled for systems not using this capability.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72261</ident><ident system=\"http://cyber.mil/legacy\">SV-86885</ident><ident system=\"http://cyber.mil/cci\">CCI-000368</ident><ident system=\"http://cyber.mil/cci\">CCI-000318</ident><ident system=\"http://cyber.mil/cci\">CCI-001814</ident><ident system=\"http://cyber.mil/cci\">CCI-001813</ident><ident system=\"http://cyber.mil/cci\">CCI-001812</ident><fixtext fixref=\"F-4723r88990_fix\">Uncomment the \"KerberosAuthentication\" keyword in \"/etc/ssh/sshd_config\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \"no\":\n\nKerberosAuthentication no\n\nThe SSH service must be restarted for changes to take effect.\n\nIf Kerberos authentication is required, it must be documented, to include the location of the configuration file, with the ISSO.</fixtext><fix id=\"F-4723r88990_fix\" /><check system=\"C-4723r88989_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the SSH daemon does not permit Kerberos to authenticate passwords unless approved.\n\nCheck that the SSH daemon does not permit Kerberos to authenticate passwords with the following command:\n\n# grep -i kerberosauth /etc/ssh/sshd_config\nKerberosAuthentication no\n\nIf the \"KerberosAuthentication\" keyword is missing, or is set to \"yes\" and is not documented with the Information System Security Officer (ISSO), or the returned line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204600\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204600r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040450</version><title>The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon performs strict mode checking of home directory configuration files.</title><description>&lt;VulnDiscussion&gt;If other users have access to modify user-specific SSH configuration files, they may be able to log on to the system as another user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72263</ident><ident system=\"http://cyber.mil/legacy\">SV-86887</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4724r88993_fix\">Uncomment the \"StrictModes\" keyword in \"/etc/ssh/sshd_config\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \"yes\":\n\nStrictModes yes\n\nThe SSH service must be restarted for changes to take effect.</fixtext><fix id=\"F-4724r88993_fix\" /><check system=\"C-4724r88992_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the SSH daemon performs strict mode checking of home directory configuration files.\n\nThe location of the \"sshd_config\" file may vary if a different daemon is in use.\n\nInspect the \"sshd_config\" file with the following command:\n\n# grep -i strictmodes /etc/ssh/sshd_config\n\nStrictModes yes\n\nIf \"StrictModes\" is set to \"no\", is missing, or the returned line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204601\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204601r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040460</version><title>The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon uses privilege separation.</title><description>&lt;VulnDiscussion&gt;SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would decrease the impact of software vulnerabilities in the unprivileged section.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72265</ident><ident system=\"http://cyber.mil/legacy\">SV-86889</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4725r88996_fix\">Uncomment the \"UsePrivilegeSeparation\" keyword in \"/etc/ssh/sshd_config\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to \"sandbox\" or \"yes\":\n\nUsePrivilegeSeparation sandbox\n\nThe SSH service must be restarted for changes to take effect.</fixtext><fix id=\"F-4725r88996_fix\" /><check system=\"C-4725r88995_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the SSH daemon performs privilege separation.\n\nCheck that the SSH daemon performs privilege separation with the following command:\n\n# grep -i usepriv /etc/ssh/sshd_config\n\nUsePrivilegeSeparation sandbox\n\nIf the \"UsePrivilegeSeparation\" keyword is set to \"no\", is missing, or the returned line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204602\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204602r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040470</version><title>The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow compression or only allows compression after successful authentication.</title><description>&lt;VulnDiscussion&gt;If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72267</ident><ident system=\"http://cyber.mil/legacy\">SV-86891</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4726r88999_fix\">Uncomment the \"Compression\" keyword in \"/etc/ssh/sshd_config\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) on the system and set the value to \"delayed\" or \"no\":\n\nCompression no\n\nThe SSH service must be restarted for changes to take effect.</fixtext><fix id=\"F-4726r88999_fix\" /><check system=\"C-4726r88998_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the SSH daemon performs compression after a user successfully authenticates.\n\nCheck that the SSH daemon performs compression after a user successfully authenticates with the following command:\n\n# grep -i compression /etc/ssh/sshd_config\nCompression delayed\n\nIf the \"Compression\" keyword is set to \"yes\", is missing, or the returned line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204603\"><title>SRG-OS-000355-GPOS-00143</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204603r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040500</version><title>The Red Hat Enterprise Linux operating system must, for networked systems, synchronize clocks with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, a time server designated for the appropriate DoD </title><description>&lt;VulnDiscussion&gt;Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.\n\nSynchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network.\n\nOrganizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints).\n\nSatisfies: SRG-OS-000355-GPOS-00143, SRG-OS-000356-GPOS-00144&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72269</ident><ident system=\"http://cyber.mil/legacy\">SV-86893</ident><ident system=\"http://cyber.mil/cci\">CCI-002046</ident><ident system=\"http://cyber.mil/cci\">CCI-001891</ident><fixtext fixref=\"F-4727r89002_fix\">Edit the \"/etc/ntp.conf\" or \"/etc/chrony.conf\" file and add or update an entry to define \"maxpoll\" to \"10\" as follows:\n\nserver 0.rhel.pool.ntp.org iburst maxpoll 10\n\nIf NTP was running and \"maxpoll\" was updated, the NTP service must be restarted:\n\n# systemctl restart ntpd\n\nIf NTP was not running, it must be started:\n\n# systemctl start ntpd \n\nIf \"chronyd\" was running and \"maxpoll\" was updated, the service must be restarted:\n\n# systemctl restart chronyd.service\n\nIf \"chronyd\" was not running, it must be started:\n\n# systemctl start chronyd.service</fixtext><fix id=\"F-4727r89002_fix\" /><check system=\"C-4727r89001_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Check to see if NTP is running in continuous mode:\n\n# ps -ef | grep ntp\n\nIf NTP is not running, check to see if \"chronyd\" is running in continuous mode:\n\n# ps -ef | grep chronyd\n\nIf NTP or \"chronyd\" is not running, this is a finding.\n\nIf the NTP process is found, then check the \"ntp.conf\" file for the \"maxpoll\" option setting:\n\n# grep maxpoll /etc/ntp.conf\n\nserver 0.rhel.pool.ntp.org iburst maxpoll 10\n\nIf the option is set to \"17\" or is not set, this is a finding.\n\nIf the file does not exist, check the \"/etc/cron.daily\" subdirectory for a crontab file controlling the execution of the \"ntpd -q\" command.\n\n# grep -i \"ntpd -q\" /etc/cron.daily/*\n# ls -al /etc/cron.* | grep ntp\n\nntp\n\nIf a crontab file does not exist in the \"/etc/cron.daily\" that executes the \"ntpd -q\" command, this is a finding.\n\nIf the \"chronyd\" process is found, then check the \"chrony.conf\" file for the \"maxpoll\" option setting:\n\n# grep maxpoll /etc/chrony.conf\n\nserver 0.rhel.pool.ntp.org iburst maxpoll 10\n\nIf the option is not set or the line is commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204604\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204604r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040520</version><title>The Red Hat Enterprise Linux operating system must enable an application firewall, if available.</title><description>&lt;VulnDiscussion&gt;Firewalls protect computers from network attacks by blocking or limiting access to open network ports. Application firewalls limit which applications are allowed to communicate over the network.\n\nSatisfies: SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72273</ident><ident system=\"http://cyber.mil/legacy\">SV-86897</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4728r89005_fix\">Ensure the operating system's application firewall is enabled.\n\nInstall the \"firewalld\" package, if it is not on the system, with the following command:\n\n# yum install firewalld\n\nStart the firewall via \"systemctl\" with the following command:\n\n# systemctl start firewalld</fixtext><fix id=\"F-4728r89005_fix\" /><check system=\"C-4728r89004_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system enabled an application firewall.\n\nCheck to see if \"firewalld\" is installed with the following command:\n\n# yum list installed firewalld\nfirewalld-0.3.9-11.el7.noarch.rpm\n\nIf the \"firewalld\" package is not installed, ask the System Administrator if another firewall application (such as iptables) is installed. \n\nIf an application firewall is not installed, this is a finding. \n\nCheck to see if the firewall is loaded and active with the following command:\n\n# systemctl status firewalld\nfirewalld.service - firewalld - dynamic firewall daemon\n\n   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)\n   Active: active (running) since Tue 2014-06-17 11:14:49 CEST; 5 days ago\n\nIf \"firewalld\" does not show a status of \"loaded\" and \"active\", this is a finding. \n\nCheck the state of the firewall:\n\n# firewall-cmd --state \nrunning\n\nIf \"firewalld\" does not show a state of \"running\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204605\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204605r241939_rule\" weight=\"10.0\" severity=\"low\"><version>RHEL-07-040530</version><title>The Red Hat Enterprise Linux operating system must display the date and time of the last successful account logon upon logon.</title><description>&lt;VulnDiscussion&gt;Providing users with feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72275</ident><ident system=\"http://cyber.mil/legacy\">SV-86899</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4729r89008_fix\">Configure the operating system to provide users with feedback on when account accesses last occurred by setting the required configuration options in \"/etc/pam.d/postlogin\". \n\nAdd the following line to the top of \"/etc/pam.d/postlogin\":\n\nsession required pam_lastlog.so showfailed</fixtext><fix id=\"F-4729r89008_fix\" /><check system=\"C-4729r89007_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify users are provided with feedback on when account accesses last occurred.\n\nCheck that \"pam_lastlog\" is used and not silent with the following command:\n\n# grep pam_lastlog /etc/pam.d/postlogin\nsession required pam_lastlog.so showfailed\n\nIf \"pam_lastlog\" is missing from \"/etc/pam.d/postlogin\" file, or the silent option is present, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204606\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204606r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-040540</version><title>The Red Hat Enterprise Linux operating system must not contain .shosts files.</title><description>&lt;VulnDiscussion&gt;The .shosts files are used to configure host-based authentication for individual users or the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86901</ident><ident system=\"http://cyber.mil/legacy\">V-72277</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4730r89011_fix\">Remove any found \".shosts\" files from the system.\n\n# rm /[path]/[to]/[file]/.shosts</fixtext><fix id=\"F-4730r89011_fix\" /><check system=\"C-4730r89010_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify there are no \".shosts\" files on the system.\n\nCheck the system for the existence of these files with the following command:\n\n# find / -name '*.shosts'\n\nIf any \".shosts\" files are found on the system, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204607\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204607r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-040550</version><title>The Red Hat Enterprise Linux operating system must not contain shosts.equiv files.</title><description>&lt;VulnDiscussion&gt;The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86903</ident><ident system=\"http://cyber.mil/legacy\">V-72279</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4731r89014_fix\">Remove any found \"shosts.equiv\" files from the system.\n\n# rm /[path]/[to]/[file]/shosts.equiv</fixtext><fix id=\"F-4731r89014_fix\" /><check system=\"C-4731r89013_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify there are no \"shosts.equiv\" files on the system.\n\nCheck the system for the existence of these files with the following command:\n\n# find / -name shosts.equiv\n\nIf any \"shosts.equiv\" files are found on the system, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204608\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204608r241939_rule\" weight=\"10.0\" severity=\"low\"><version>RHEL-07-040600</version><title>For Red Hat Enterprise Linux operating systems using DNS resolution, at least two name servers must be configured.</title><description>&lt;VulnDiscussion&gt;To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86905</ident><ident system=\"http://cyber.mil/legacy\">V-72281</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4732r89017_fix\">Configure the operating system to use two or more name servers for DNS resolution.\n\nEdit the \"/etc/resolv.conf\" file to uncomment or add the two or more \"nameserver\" option lines with the IP address of local authoritative name servers. If local host resolution is being performed, the \"/etc/resolv.conf\" file must be empty. An empty \"/etc/resolv.conf\" file can be created as follows:\n\n# echo -n &gt; /etc/resolv.conf\n\nAnd then make the file immutable with the following command:\n\n# chattr +i /etc/resolv.conf\n\nIf the \"/etc/resolv.conf\" file must be mutable, the required configuration must be documented with the Information System Security Officer (ISSO) and the file must be verified by the system file integrity tool.</fixtext><fix id=\"F-4732r89017_fix\" /><check system=\"C-4732r89016_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Determine whether the system is using local or DNS name resolution with the following command:\n\n# grep hosts /etc/nsswitch.conf\nhosts:   files dns\n\nIf the DNS entry is missing from the host's line in the \"/etc/nsswitch.conf\" file, the \"/etc/resolv.conf\" file must be empty.\n\nVerify the \"/etc/resolv.conf\" file is empty with the following command:\n\n# ls -al /etc/resolv.conf\n-rw-r--r--  1 root root        0 Aug 19 08:31 resolv.conf\n\nIf local host authentication is being used and the \"/etc/resolv.conf\" file is not empty, this is a finding.\n\nIf the DNS entry is found on the host's line of the \"/etc/nsswitch.conf\" file, verify the operating system is configured to use two or more name servers for DNS resolution.\n\nDetermine the name servers used by the system with the following command:\n\n# grep nameserver /etc/resolv.conf\nnameserver 192.168.1.2\nnameserver 192.168.1.3\n\nIf less than two lines are returned that are not commented out, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204609\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204609r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040610</version><title>The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets.</title><description>&lt;VulnDiscussion&gt;Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86907</ident><ident system=\"http://cyber.mil/legacy\">V-72283</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4733r89020_fix\">Set the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n\nnet.ipv4.conf.all.accept_source_route = 0   \n\nIssue the following command to make the changes take effect:\n \n# sysctl -system</fixtext><fix id=\"F-4733r89020_fix\" /><check system=\"C-4733r89019_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the system does not accept IPv4 source-routed packets.\n\n# grep net.ipv4.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*\n\nnet.ipv4.conf.all.accept_source_route = 0\n\nIf \" net.ipv4.conf.all.accept_source_route \" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n# /sbin/sysctl -a | grep net.ipv4.conf.all.accept_source_route\nnet.ipv4.conf.all.accept_source_route = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204610\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204610r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040611</version><title>The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces.</title><description>&lt;VulnDiscussion&gt;Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-102353</ident><ident system=\"http://cyber.mil/legacy\">V-92251</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4734r89023_fix\">Set the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n\nnet.ipv4.conf.all.rp_filter = 1 \n\nIssue the following command to make the changes take effect:\n\n# sysctl --system</fixtext><fix id=\"F-4734r89023_fix\" /><check system=\"C-4734r89022_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the system uses a reverse-path filter for IPv4:\n\n# grep net.ipv4.conf.all.rp_filter /etc/sysctl.conf /etc/sysctl.d/*\nnet.ipv4.conf.all.rp_filter = 1\n\nIf \"net.ipv4.conf.all.rp_filter\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \"1\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n# /sbin/sysctl -a | grep net.ipv4.conf.all.rp_filter\nnet.ipv4.conf.all.rp_filter = 1\n\nIf the returned line does not have a value of \"1\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204611\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204611r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040612</version><title>The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when possible by default.</title><description>&lt;VulnDiscussion&gt;Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-102355</ident><ident system=\"http://cyber.mil/legacy\">V-92253</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4735r89026_fix\">Set the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n\nnet.ipv4.conf.default.rp_filter = 1 \n\nIssue the following command to make the changes take effect:\n\n# sysctl --system</fixtext><fix id=\"F-4735r89026_fix\" /><check system=\"C-4735r89025_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the system uses a reverse-path filter for IPv4:\n\n# grep net.ipv4.conf.default.rp_filter /etc/sysctl.conf /etc/sysctl.d/*\nnet.ipv4.conf.default.rp_filter = 1\n\nIf \"net.ipv4.conf.default.rp_filter\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \"1\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n# /sbin/sysctl -a | grep net.ipv4.conf.default.rp_filter\nnet.ipv4.conf.default.rp_filter = 1\n\nIf the returned line does not have a value of \"1\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204612\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204612r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040620</version><title>The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default.</title><description>&lt;VulnDiscussion&gt;Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86909</ident><ident system=\"http://cyber.mil/legacy\">V-72285</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4736r89029_fix\">Set the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n\nnet.ipv4.conf.default.accept_source_route = 0   \n\nIssue the following command to make the changes take effect:\n \n# sysctl --system</fixtext><fix id=\"F-4736r89029_fix\" /><check system=\"C-4736r89028_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the system does not accept IPv4 source-routed packets by default.\n\n# grep net.ipv4.conf.default.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*\nnet.ipv4.conf.default.accept_source_route = 0\n\nIf \" net.ipv4.conf.default.accept_source_route \" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n# /sbin/sysctl -a | grep net.ipv4.conf.default.accept_source_route\nnet.ipv4.conf.default.accept_source_route = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204613\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204613r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040630</version><title>The Red Hat Enterprise Linux operating system must not respond to Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.</title><description>&lt;VulnDiscussion&gt;Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86911</ident><ident system=\"http://cyber.mil/legacy\">V-72287</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4737r89032_fix\">Set the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n\nnet.ipv4.icmp_echo_ignore_broadcasts = 1\n\nIssue the following command to make the changes take effect: \n\n# sysctl --system</fixtext><fix id=\"F-4737r89032_fix\" /><check system=\"C-4737r89031_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the system does not respond to IPv4 ICMP echoes sent to a broadcast address.\n\n# grep net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf /etc/sysctl.d/*\n\nIf \" net.ipv4.icmp_echo_ignore_broadcasts\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \"1\", this is a finding.\n\nCheck that the operating system implements the \"icmp_echo_ignore_broadcasts\" variable with the following command:\n\n# /sbin/sysctl -a | grep net.ipv4.icmp_echo_ignore_broadcasts\nnet.ipv4.icmp_echo_ignore_broadcasts = 1\n\nIf the returned line does not have a value of \"1\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204614\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204614r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040640</version><title>The Red Hat Enterprise Linux operating system must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted.</title><description>&lt;VulnDiscussion&gt;ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72289</ident><ident system=\"http://cyber.mil/legacy\">SV-86913</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4738r89035_fix\">Set the system to not accept IPv4 ICMP redirect messages by adding the following line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n\nnet.ipv4.conf.default.accept_redirects = 0   \n\nIssue the following command to make the changes take effect:\n\n# sysctl --system</fixtext><fix id=\"F-4738r89035_fix\" /><check system=\"C-4738r89034_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the system will not accept IPv4 ICMP redirect messages.\n\n# grep 'net.ipv4.conf.default.accept_redirects' /etc/sysctl.conf /etc/sysctl.d/*\n\nIf \" net.ipv4.conf.default.accept_redirects \" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the value of the \"accept_redirects\" variables with the following command:\n\n# /sbin/sysctl -a | grep 'net.ipv4.conf.default.accept_redirects'\nnet.ipv4.conf.default.accept_redirects = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204615\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204615r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040641</version><title>The Red Hat Enterprise Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.</title><description>&lt;VulnDiscussion&gt;ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-73175</ident><ident system=\"http://cyber.mil/legacy\">SV-87827</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4739r89038_fix\">Set the system to ignore IPv4 ICMP redirect messages by adding the following line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n\nnet.ipv4.conf.all.accept_redirects = 0   \n\nIssue the following command to make the changes take effect:\n\n# sysctl --system</fixtext><fix id=\"F-4739r89038_fix\" /><check system=\"C-4739r89037_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the system ignores IPv4 ICMP redirect messages.\n\n# grep 'net.ipv4.conf.all.accept_redirects' /etc/sysctl.conf /etc/sysctl.d/*\n\nIf \" net.ipv4.conf.all.accept_redirects \" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the \"accept_redirects\" variables with the following command:\n\n# /sbin/sysctl -a | grep 'net.ipv4.conf.all.accept_redirects'\n\nnet.ipv4.conf.all.accept_redirects = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204616\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204616r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040650</version><title>The Red Hat Enterprise Linux operating system must not allow interfaces to perform Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects by default.</title><description>&lt;VulnDiscussion&gt;ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly revealing portions of the network topology.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72291</ident><ident system=\"http://cyber.mil/legacy\">SV-86915</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4740r89041_fix\">Configure the system to not allow interfaces to perform IPv4 ICMP redirects by default. \n\nSet the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n\nnet.ipv4.conf.default.send_redirects = 0\n\nIssue the following command to make the changes take effect:\n\n# sysctl --system</fixtext><fix id=\"F-4740r89041_fix\" /><check system=\"C-4740r89040_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the system does not allow interfaces to perform IPv4 ICMP redirects by default.\n\n# grep 'net.ipv4.conf.default.send_redirects' /etc/sysctl.conf /etc/sysctl.d/*\n\nIf \"net.ipv4.conf.default.send_redirects\" is not configured in the \"/etc/sysctl.conf\" file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the \"default send_redirects\" variables with the following command:\n\n# /sbin/sysctl -a | grep 'net.ipv4.conf.default.send_redirects'\n\nnet.ipv4.conf.default.send_redirects = 0 \n\nIf the returned line does not have a value of \"0\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204617\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204617r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040660</version><title>The Red Hat Enterprise Linux operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects.</title><description>&lt;VulnDiscussion&gt;ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly revealing portions of the network topology.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72293</ident><ident system=\"http://cyber.mil/legacy\">SV-86917</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4741r89044_fix\">Configure the system to not allow interfaces to perform IPv4 ICMP redirects. \n\nSet the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n\nnet.ipv4.conf.all.send_redirects = 0\n\nIssue the following command to make the changes take effect:\n\n# sysctl --system</fixtext><fix id=\"F-4741r89044_fix\" /><check system=\"C-4741r89043_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the system does not send IPv4 ICMP redirect messages.\n\n# grep 'net.ipv4.conf.all.send_redirects' /etc/sysctl.conf /etc/sysctl.d/*\n\nIf \"net.ipv4.conf.all.send_redirects\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the \"all send_redirects\" variables with the following command:\n\n# /sbin/sysctl -a | grep 'net.ipv4.conf.all.send_redirects'\n\nnet.ipv4.conf.all.send_redirects = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204618\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204618r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040670</version><title>Network interfaces configured on the Red Hat Enterprise Linux operating system must not be in promiscuous mode.</title><description>&lt;VulnDiscussion&gt;Network interfaces in promiscuous mode allow for the capture of all network traffic visible to the system. If unauthorized individuals can access these applications, it may allow then to collect information such as logon IDs, passwords, and key exchanges between systems.\n\nIf the system is being used to perform a network troubleshooting function, the use of these tools must be documented with the Information System Security Officer (ISSO) and restricted to only authorized personnel.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72295</ident><ident system=\"http://cyber.mil/legacy\">SV-86919</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4742r89047_fix\">Configure network interfaces to turn off promiscuous mode unless approved by the ISSO and documented.\n\nSet the promiscuous mode of an interface to off with the following command:\n\n#ip link set dev &lt;devicename&gt; multicast off promisc off</fixtext><fix id=\"F-4742r89047_fix\" /><check system=\"C-4742r89046_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify network interfaces are not in promiscuous mode unless approved by the ISSO and documented.\n\nCheck for the status with the following command:\n\n# ip link | grep -i promisc\n\nIf network interfaces are found on the system in promiscuous mode and their use has not been approved by the ISSO and documented, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204619\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204619r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040680</version><title>The Red Hat Enterprise Linux operating system must be configured to prevent unrestricted mail relaying.</title><description>&lt;VulnDiscussion&gt;If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay for the purpose of sending spam or other unauthorized activity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72297</ident><ident system=\"http://cyber.mil/legacy\">SV-86921</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4743r89050_fix\">If \"postfix\" is installed, modify the \"/etc/postfix/main.cf\" file to restrict client connections to the local network with the following command:\n\n# postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'</fixtext><fix id=\"F-4743r89050_fix\" /><check system=\"C-4743r89049_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the system is configured to prevent unrestricted mail relaying.\n\nDetermine if \"postfix\" is installed with the following commands:\n\n# yum list installed postfix\npostfix-2.6.6-6.el7.x86_64.rpm \n\nIf postfix is not installed, this is Not Applicable.\n\nIf postfix is installed, determine if it is configured to reject connections from unknown or untrusted networks with the following command:\n\n# postconf -n smtpd_client_restrictions\nsmtpd_client_restrictions = permit_mynetworks, reject\n\nIf the \"smtpd_client_restrictions\" parameter contains any entries other than \"permit_mynetworks\" and \"reject\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204620\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204620r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-040690</version><title>The Red Hat Enterprise Linux operating system must not have a File Transfer Protocol (FTP) server package installed unless needed.</title><description>&lt;VulnDiscussion&gt;The FTP service provides an unencrypted remote access that does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised. SSH or other encrypted file transfer methods must be used in place of this service.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72299</ident><ident system=\"http://cyber.mil/legacy\">SV-86923</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4744r89053_fix\">Document the \"vsftpd\" package with the ISSO as an operational requirement or remove it from the system with the following command:\n\n# yum remove vsftpd</fixtext><fix id=\"F-4744r89053_fix\" /><check system=\"C-4744r89052_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify an FTP server has not been installed on the system.\n\nCheck to see if an FTP server has been installed with the following commands:\n\n# yum list installed vsftpd\n\n vsftpd-3.0.2.el7.x86_64.rpm\n\nIf \"vsftpd\" is installed and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204621\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204621r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-040700</version><title>The Red Hat Enterprise Linux operating system must not have the Trivial File Transfer Protocol (TFTP) server package installed if not required for operational support.</title><description>&lt;VulnDiscussion&gt;If TFTP is required for operational support (such as the transmission of router configurations) its use must be documented with the Information System Security Officer (ISSO), restricted to only authorized personnel, and have access control rules established.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72301</ident><ident system=\"http://cyber.mil/legacy\">SV-86925</ident><ident system=\"http://cyber.mil/cci\">CCI-000318</ident><ident system=\"http://cyber.mil/cci\">CCI-000368</ident><ident system=\"http://cyber.mil/cci\">CCI-001813</ident><ident system=\"http://cyber.mil/cci\">CCI-001812</ident><ident system=\"http://cyber.mil/cci\">CCI-001814</ident><fixtext fixref=\"F-4745r89056_fix\">Remove the TFTP package from the system with the following command:\n\n# yum remove tftp-server</fixtext><fix id=\"F-4745r89056_fix\" /><check system=\"C-4745r89055_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify a TFTP server has not been installed on the system.\n\nCheck to see if a TFTP server has been installed with the following command:\n\n# yum list installed tftp-server\ntftp-server-0.49-9.el7.x86_64.rpm\n\nIf TFTP is installed and the requirement for TFTP is not documented with the ISSO, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204622\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204622r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-040710</version><title>The Red Hat Enterprise Linux operating system must be configured so that remote X connections for interactive users are encrypted.</title><description>&lt;VulnDiscussion&gt;Open X displays allow an attacker to capture keystrokes and execute commands remotely.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72303</ident><ident system=\"http://cyber.mil/legacy\">SV-86927</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4746r89059_fix\">Configure SSH to encrypt connections for interactive users.\n\nEdit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for the \"X11Forwarding\" keyword and set its value to \"yes\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\n\nX11Forwarding yes\n\nThe SSH service must be restarted for changes to take effect:\n\n# systemctl restart sshd</fixtext><fix id=\"F-4746r89059_fix\" /><check system=\"C-4746r89058_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify remote X connections for interactive users are encrypted.\n\nCheck that remote X connections are encrypted with the following command:\n\n# grep -i x11forwarding /etc/ssh/sshd_config | grep -v \"^#\"\n\nX11Forwarding yes\n\nIf the \"X11Forwarding\" keyword is set to \"no\" or is missing, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204623\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204623r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040720</version><title>The Red Hat Enterprise Linux operating system must be configured so that if the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon is configured to operate in secure mode.</title><description>&lt;VulnDiscussion&gt;Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting system files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72305</ident><ident system=\"http://cyber.mil/legacy\">SV-86929</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4747r89062_fix\">Configure the TFTP daemon to operate in secure mode by adding the following line to \"/etc/xinetd.d/tftp\" (or modify the line to have the required value):\n\nserver_args = -s /var/lib/tftpboot</fixtext><fix id=\"F-4747r89062_fix\" /><check system=\"C-4747r89061_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the TFTP daemon is configured to operate in secure mode.\n\nCheck to see if a TFTP server has been installed with the following commands:\n\n# yum list installed tftp-server\ntftp-server.x86_64 x.x-x.el7 rhel-7-server-rpms\n\nIf a TFTP server is not installed, this is Not Applicable.\n\nIf a TFTP server is installed, check for the server arguments with the following command: \n\n# grep server_args /etc/xinetd.d/tftp\nserver_args = -s /var/lib/tftpboot\n\nIf the \"server_args\" line does not have a \"-s\" option and a subdirectory is not assigned, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204624\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204624r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040730</version><title>The Red Hat Enterprise Linux operating system must not have an X Windows display manager installed unless approved.</title><description>&lt;VulnDiscussion&gt;Internet services that are not required for system or application processes must not be active to decrease the attack surface of the system. X Windows has a long history of security vulnerabilities and will not be used unless approved and documented.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72307</ident><ident system=\"http://cyber.mil/legacy\">SV-86931</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4748r89065_fix\">Document the requirement for an X Windows server with the ISSO or remove the related packages with the following commands:\n\n# rpm -e xorg-x11-server-common</fixtext><fix id=\"F-4748r89065_fix\" /><check system=\"C-4748r89064_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that if the system has X Windows System installed, it is authorized.\n\nCheck for the X11 package with the following command:\n\n# rpm -qa | grep xorg | grep server\n\nAsk the System Administrator if use of the X Windows System is an operational requirement.\n\nIf the use of X Windows on the system is not documented with the Information System Security Officer (ISSO), this is a finding.</check-content></check></Rule></Group><Group id=\"V-204625\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204625r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040740</version><title>The Red Hat Enterprise Linux operating system must not be performing packet forwarding unless the system is a router.</title><description>&lt;VulnDiscussion&gt;Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this software is used when not required, system network information may be unnecessarily transmitted across the network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72309</ident><ident system=\"http://cyber.mil/legacy\">SV-86933</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4749r89068_fix\">Set the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n\nnet.ipv4.ip_forward = 0\n\nIssue the following command to make the changes take effect:\n\n# sysctl --system</fixtext><fix id=\"F-4749r89068_fix\" /><check system=\"C-4749r89067_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the system is not performing packet forwarding, unless the system is a router.\n\n# grep net.ipv4.ip_forward /etc/sysctl.conf /etc/sysctl.d/*\n\nnet.ipv4.ip_forward = 0\n\nIf \"net.ipv4.ip_forward\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system does not implement IP forwarding using the following command:\n\n# /sbin/sysctl -a | grep net.ipv4.ip_forward\nnet.ipv4.ip_forward = 0\n\nIf IP forwarding value is \"1\" and the system is hosting any application, database, or web servers, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204626\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204626r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040750</version><title>The Red Hat Enterprise Linux operating system must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.</title><description>&lt;VulnDiscussion&gt;When an NFS server is configured to use RPCSEC_SYS, a selected userid and groupid are used to handle requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The RPCSEC_GSS method of authentication uses certificates on the server and client systems to more securely authenticate the remote mount request.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72311</ident><ident system=\"http://cyber.mil/legacy\">SV-86935</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4750r89071_fix\">Update the \"/etc/fstab\" file so the option \"sec\" is defined for each NFS mounted file system and the \"sec\" option does not have the \"sys\" setting. \n\nEnsure the \"sec\" option is defined as \"krb5:krb5i:krb5p\".</fixtext><fix id=\"F-4750r89071_fix\" /><check system=\"C-4750r89070_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify \"AUTH_GSS\" is being used to authenticate NFS mounts.\n\nTo check if the system is importing an NFS file system, look for any entries in the \"/etc/fstab\" file that have a file system type of \"nfs\" with the following command:\n\n# cat /etc/fstab | grep nfs\n192.168.21.5:/mnt/export /data1 nfs4 rw,sync ,soft,sec=krb5:krb5i:krb5p\n\nIf the system is mounting file systems via NFS and has the sec option without the \"krb5:krb5i:krb5p\" settings, the \"sec\" option has the \"sys\" setting, or the \"sec\" option is missing, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204627\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204627r241939_rule\" weight=\"10.0\" severity=\"high\"><version>RHEL-07-040800</version><title>SNMP community strings on the Red Hat Enterprise Linux operating system must be changed from the default.</title><description>&lt;VulnDiscussion&gt;Whether active or not, default Simple Network Management Protocol (SNMP) community strings must be changed to maintain security. If the service is running with the default authenticators, anyone can gather data about the system and the network and use the information to potentially compromise the integrity of the system or network(s). It is highly recommended that SNMP version 3 user authentication and message encryption be used in place of the version 2 community strings.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86937</ident><ident system=\"http://cyber.mil/legacy\">V-72313</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4751r89074_fix\">If the \"/etc/snmp/snmpd.conf\" file exists, modify any lines that contain a community string value of \"public\" or \"private\" to another string value.</fixtext><fix id=\"F-4751r89074_fix\" /><check system=\"C-4751r89073_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that a system using SNMP is not using default community strings.\n\nCheck to see if the \"/etc/snmp/snmpd.conf\" file exists with the following command:\n\n# ls -al /etc/snmp/snmpd.conf\n -rw-------   1 root root      52640 Mar 12 11:08 snmpd.conf\n\nIf the file does not exist, this is Not Applicable.\n\nIf the file does exist, check for the default community strings with the following commands:\n\n# grep public /etc/snmp/snmpd.conf\n# grep private /etc/snmp/snmpd.conf\n\nIf either of these commands returns any output, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204628\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204628r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040810</version><title>The Red Hat Enterprise Linux operating system access control program must be configured to grant or deny system access to specific hosts and services.</title><description>&lt;VulnDiscussion&gt;If the systems access control program is not configured with appropriate rules for allowing and denying access to system network resources, services may be accessible to unauthorized hosts.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86939</ident><ident system=\"http://cyber.mil/legacy\">V-72315</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4752r89077_fix\">If \"firewalld\" is installed and active on the system, configure rules for allowing specific services and hosts. \n\nIf \"firewalld\" is not \"active\", enable \"tcpwrappers\" by configuring \"/etc/hosts.allow\" and \"/etc/hosts.deny\" to allow or deny access to specific hosts.</fixtext><fix id=\"F-4752r89077_fix\" /><check system=\"C-4752r89076_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>If the \"firewalld\" package is not installed, ask the System Administrator (SA) if another firewall application (such as iptables) is installed. If an application firewall is not installed, this is a finding. \n\nVerify the system's access control program is configured to grant or deny system access to specific hosts.\n\nCheck to see if \"firewalld\" is active with the following command:\n\n# systemctl status firewalld\nfirewalld.service - firewalld - dynamic firewall daemon\nLoaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)\nActive: active (running) since Sun 2014-04-20 14:06:46 BST; 30s ago\n\nIf \"firewalld\" is active, check to see if it is configured to grant or deny access to specific hosts or services with the following commands:\n\n# firewall-cmd --get-default-zone\npublic\n\n# firewall-cmd --list-all --zone=public\npublic (active)\ntarget: default\nicmp-block-inversion: no\ninterfaces: eth0\nsources:\nservices: mdns ssh\nports:\nprotocols:\nmasquerade: no\nforward-ports:\nicmp-blocks:\n\nIf \"firewalld\" is not active, determine whether \"tcpwrappers\" is being used by checking whether the \"hosts.allow\" and \"hosts.deny\" files are empty with the following commands:\n\n# ls -al /etc/hosts.allow\nrw-r----- 1 root root 9 Aug 2 23:13 /etc/hosts.allow\n\n# ls -al /etc/hosts.deny\n-rw-r----- 1 root root 9 Apr 9 2007 /etc/hosts.deny\n\nIf \"firewalld\" and \"tcpwrappers\" are not installed, configured, and active, ask the SA if another access control program (such as iptables) is installed and active. Ask the SA to show that the running configuration grants or denies access to specific hosts or services.\n\nIf \"firewalld\" is active and is not configured to grant access to specific hosts or \"tcpwrappers\" is not configured to grant or deny access to specific hosts, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204629\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204629r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040820</version><title>The Red Hat Enterprise Linux operating system must not have unauthorized IP tunnels configured.</title><description>&lt;VulnDiscussion&gt;IP tunneling mechanisms can be used to bypass network filtering. If tunneling is required, it must be documented with the Information System Security Officer (ISSO).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86941</ident><ident system=\"http://cyber.mil/legacy\">V-72317</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4753r89080_fix\">Remove all unapproved tunnels from the system, or document them with the ISSO.</fixtext><fix id=\"F-4753r89080_fix\" /><check system=\"C-4753r89079_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the system does not have unauthorized IP tunnels configured.\n\nCheck to see if \"libreswan\" is installed with the following command:\n\n# yum list installed libreswan\nlibreswan.x86-64 3.20-5.el7_4\n\nIf \"libreswan\" is installed, check to see if the \"IPsec\" service is active with the following command:\n\n# systemctl status ipsec\nipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec\nLoaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled)\nActive: inactive (dead)\n\nIf the \"IPsec\" service is active, check to see if any tunnels are configured in \"/etc/ipsec.conf\" and \"/etc/ipsec.d/\" with the following commands:\n\n# grep -iw conn /etc/ipsec.conf /etc/ipsec.d/*.conf\n\nIf there are indications that a \"conn\" parameter is configured for a tunnel, ask the System Administrator if the tunnel is documented with the ISSO. \n\nIf \"libreswan\" is installed, \"IPsec\" is active, and an undocumented tunnel is active, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204630\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204630r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-040830</version><title>The Red Hat Enterprise Linux operating system must not forward IPv6 source-routed packets.</title><description>&lt;VulnDiscussion&gt;Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-86943</ident><ident system=\"http://cyber.mil/legacy\">V-72319</ident><ident system=\"http://cyber.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-4754r89083_fix\">Set the system to the required kernel parameter, if IPv6 is enabled, by adding the following line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n\nnet.ipv6.conf.all.accept_source_route = 0\n\nIssue the following command to make the changes take effect:\n\n# sysctl --system</fixtext><fix id=\"F-4754r89083_fix\" /><check system=\"C-4754r89082_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>If IPv6 is not enabled, the key will not exist, and this is Not Applicable.\n\nVerify the system does not accept IPv6 source-routed packets.\n\n# grep net.ipv6.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*\n\nnet.ipv6.conf.all.accept_source_route = 0\n\nIf \"net.ipv6.conf.all.accept_source_route\" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n# /sbin/sysctl -a | grep net.ipv6.conf.all.accept_source_route\nnet.ipv6.conf.all.accept_source_route = 0\n\nIf the returned lines do not have a value of \"0\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204631\"><title>SRG-OS-000375-GPOS-00160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204631r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-041001</version><title>The Red Hat Enterprise Linux operating system must have the required packages for multifactor authentication installed.</title><description>&lt;VulnDiscussion&gt;Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\n\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\n\nA privileged account is defined as an information system account with authorizations of a privileged user.\n\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\n\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management).\n\nSatisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-87041</ident><ident system=\"http://cyber.mil/legacy\">V-72417</ident><ident system=\"http://cyber.mil/cci\">CCI-001954</ident><ident system=\"http://cyber.mil/cci\">CCI-001948</ident><ident system=\"http://cyber.mil/cci\">CCI-001953</ident><fixtext fixref=\"F-4755r89086_fix\">Configure the operating system to implement multifactor authentication by installing the required packages.\n\nInstall the \"esc\" and \"pam_pkcs11\" packages on the system with the following command:\n\n# yum install esc pam_pkcs11</fixtext><fix id=\"F-4755r89086_fix\" /><check system=\"C-4755r89085_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system has the packages required for multifactor authentication installed.\n\nCheck for the presence of the packages required to support multifactor authentication with the following commands:\n\n# yum list installed esc\nesc-1.1.0-26.el7.noarch.rpm\n\n# yum list installed pam_pkcs11\npam_pkcs11-0.6.2-14.el7.noarch.rpm\n\n\nIf the \"esc\" and \"pam_pkcs11\" packages are not installed, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204632\"><title>SRG-OS-000375-GPOS-00160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204632r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-041002</version><title>The Red Hat Enterprise Linux operating system must implement multifactor authentication for access to privileged accounts via pluggable authentication modules (PAM).</title><description>&lt;VulnDiscussion&gt;Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\n\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\n\nA privileged account is defined as an information system account with authorizations of a privileged user.\n\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\n\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management).\n\nSatisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-87051</ident><ident system=\"http://cyber.mil/legacy\">V-72427</ident><ident system=\"http://cyber.mil/cci\">CCI-001953</ident><ident system=\"http://cyber.mil/cci\">CCI-001948</ident><ident system=\"http://cyber.mil/cci\">CCI-001954</ident><fixtext fixref=\"F-4756r89089_fix\">Configure the operating system to implement multifactor authentication for remote access to privileged accounts via pluggable authentication modules (PAM).\n\nModify all of the services lines in \"/etc/sssd/sssd.conf\" or in configuration files found under \"/etc/sssd/conf.d\" to include pam.</fixtext><fix id=\"F-4756r89089_fix\" /><check system=\"C-4756r89088_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system implements multifactor authentication for remote access to privileged accounts via pluggable authentication modules (PAM).\n\nCheck the \"/etc/sssd/sssd.conf\" file for the authentication services that are being used with the following command:\n\n# grep services /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf\n\nservices = nss, pam\n\nIf the \"pam\" service is not present on all \"services\" lines, this is a finding.</check-content></check></Rule></Group><Group id=\"V-204633\"><title>SRG-OS-000375-GPOS-00160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204633r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-041003</version><title>The Red Hat Enterprise Linux operating system must implement certificate status checking for PKI authentication.</title><description>&lt;VulnDiscussion&gt;Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\n\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.\n\nA privileged account is defined as an information system account with authorizations of a privileged user.\n\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\n\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management).\n\nSatisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000375-GPOS-00162&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-87057</ident><ident system=\"http://cyber.mil/legacy\">V-72433</ident><ident system=\"http://cyber.mil/cci\">CCI-001954</ident><ident system=\"http://cyber.mil/cci\">CCI-001948</ident><ident system=\"http://cyber.mil/cci\">CCI-001953</ident><fixtext fixref=\"F-4757r89092_fix\">Configure the operating system to do certificate status checking for PKI authentication.\n\nModify all of the \"cert_policy\" lines in \"/etc/pam_pkcs11/pam_pkcs11.conf\" to include \"ocsp_on\".</fixtext><fix id=\"F-4757r89092_fix\" /><check system=\"C-4757r89091_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system implements certificate status checking for PKI authentication.\n\nCheck to see if Online Certificate Status Protocol (OCSP) is enabled on the system with the following command:\n\n# grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep -v \"^#\"\n\ncert_policy = ca, ocsp_on, signature;\ncert_policy = ca, ocsp_on, signature;\ncert_policy = ca, ocsp_on, signature;\n\nThere should be at least three lines returned. \n\nIf \"ocsp_on\" is not present in all uncommented \"cert_policy\" lines in \"/etc/pam_pkcs11/pam_pkcs11.conf\", this is a finding.</check-content></check></Rule></Group><Group id=\"V-204634\"><title>SRG-OS-000424-GPOS-00188</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-204634r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-041010</version><title>The Red Hat Enterprise Linux operating system must be configured so that all wireless network adapters are disabled.</title><description>&lt;VulnDiscussion&gt;The use of wireless networking can introduce many different attack vectors into the organization's network. Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to create a denial of service to valid network resources.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-87829</ident><ident system=\"http://cyber.mil/legacy\">V-73177</ident><ident system=\"http://cyber.mil/cci\">CCI-001443</ident><ident system=\"http://cyber.mil/cci\">CCI-001444</ident><ident system=\"http://cyber.mil/cci\">CCI-002418</ident><fixtext fixref=\"F-4758r89095_fix\">Configure the system to disable all wireless network interfaces with the following command:\n\n#nmcli radio wifi off</fixtext><fix id=\"F-4758r89095_fix\" /><check system=\"C-4758r89094_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify that there are no wireless interfaces configured on the system.\n\nThis is N/A for systems that do not have wireless network adapters.\n\nCheck for the presence of active wireless interfaces with the following command:\n\n# nmcli device\nDEVICE TYPE STATE\neth0 ethernet connected\nwlp3s0 wifi disconnected\nlo loopback unmanaged\n\nIf a wireless interface is configured and its use on the system is not documented with the Information System Security Officer (ISSO), this is a finding.</check-content></check></Rule></Group><Group id=\"V-214799\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-214799r241939_rule\" weight=\"10.0\"><version>RHEL-07-010020</version><title>The Red Hat Enterprise Linux operating system must be configured so that the cryptographic hash of system files and commands matches vendor values.</title><description>&lt;VulnDiscussion&gt;Without cryptographic integrity protections, system command and files can be altered by unauthorized users without detection.\n\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-71855</ident><ident system=\"http://cyber.mil/legacy\">SV-86479</ident><fixtext fixref=\"F-15997r192363_fix\">Run the following command to determine which package owns the file:\n\n# rpm -qf &lt;filename&gt;\n\nThe package can be reinstalled from a yum repository using the command:\n\n# sudo yum reinstall &lt;packagename&gt;\n\nAlternatively, the package can be reinstalled from trusted media using the command:\n\n# sudo rpm -Uvh &lt;packagename&gt;</fixtext><fix id=\"F-15997r192363_fix\" /><check system=\"C-15999r192362_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the cryptographic hash of system files and commands match the vendor values.\n\nCheck the cryptographic hash of system files and commands with the following command:\n\nNote: System configuration files (indicated by a \"c\" in the second column) are expected to change over time. Unusual modifications should be investigated through the system audit log.\n\n# rpm -Va --noconfig | grep '^..5'\n\nIf there is any output from the command for system files or binaries, this is a finding.</check-content></check></Rule></Group><Group id=\"V-214800\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-214800r241939_rule\" weight=\"10.0\"><version>RHEL-07-020019</version><title>The Red Hat Enterprise Linux operating system must have a host-based intrusion detection tool installed.</title><description>&lt;VulnDiscussion&gt;Adding host-based intrusion detection tools can provide the capability to automatically take actions in response to malicious behavior, which can provide additional agility in reacting to network threats. These tools also often include a reporting capability to provide network awareness of the system, which may not otherwise exist in an organization's systems management regime.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">SV-102357</ident><ident system=\"http://cyber.mil/legacy\">V-92255</ident><fixtext fixref=\"F-15998r192366_fix\">Install and enable the latest McAfee HIPS package, available from USCYBERCOM.\n\nNote: If the system does not support the McAfee HIPS package, install and enable a supported intrusion detection system application and document its use with the Authorizing Official.</fixtext><fix id=\"F-15998r192366_fix\" /><check system=\"C-16000r192365_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Ask the SA or ISSO if a host-based intrusion detection application is loaded on the system. Per OPORD 16-0080, the preferred intrusion detection system is McAfee HBSS available through the U.S. Cyber Command (USCYBERCOM).\n\nIf another host-based intrusion detection application is in use, such as SELinux, this must be documented and approved by the local Authorizing Official.\n\nProcedure:\nExamine the system to determine if the Host Intrusion Prevention System (HIPS) is installed:\n\n# rpm -qa | grep MFEhiplsm\n\nVerify that the McAfee HIPS module is active on the system:\n\n# ps -ef | grep -i “hipclient”\n\nIf the MFEhiplsm package is not installed, check for another intrusion detection system:\n\n# find / -name &lt;daemon name&gt;\n\nWhere &lt;daemon name&gt; is the name of the primary application daemon to determine if the application is loaded on the system.\n\nDetermine if the application is active on the system:\n\n# ps -ef | grep -i &lt;daemon name&gt;\n\nIf the MFEhiplsm package is not installed and an alternate host-based intrusion detection application has not been documented for use, this is a finding.\n\nIf no host-based intrusion detection system is installed and running on the system, this is a finding.</check-content></check></Rule></Group><Group id=\"V-214801\"><title>SRG-OS-000480-GPOS-00227</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-214801r241939_rule\" weight=\"10.0\"><version>RHEL-07-032000</version><title>The Red Hat Enterprise Linux operating system must use a virus scan program.</title><description>&lt;VulnDiscussion&gt;Virus scanning software can be used to protect a system from penetration from computer viruses and to limit their spread through intermediate systems.  \n\nThe virus scanning software should be configured to perform scans dynamically on accessed files. If this capability is not available, the system must be configured to scan, at a minimum, all altered files on the system on a daily basis.\n\nIf the system processes inbound SMTP mail, the virus scanner must be configured to scan all received mail.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-72213</ident><ident system=\"http://cyber.mil/legacy\">SV-86837</ident><fixtext fixref=\"F-15999r192369_fix\">Install an antivirus solution on the system.</fixtext><fix id=\"F-15999r192369_fix\" /><check system=\"C-16001r192368_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution.\n\nIf there is no anti-virus solution installed on the system, this is a finding.</check-content></check></Rule></Group><Group id=\"V-214937\"><title>SRG-OS-000029-GPOS-00010</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-214937r241939_rule\" weight=\"10.0\" severity=\"medium\"><version>RHEL-07-010062</version><title>The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.</title><description>&lt;VulnDiscussion&gt;A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.\n\nThe session lock is implemented at the point where session activity can be determined.\n\nThe ability to enable/disable a session lock is given to the user by default. Disabling the user’s ability to disengage the graphical user interface session lock provides the assurance that all sessions will lock after the specified period of time.\n&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Red Hat Enterprise Linux 7</dc:subject><dc:identifier>2899</dc:identifier></reference><ident system=\"http://cyber.mil/legacy\">V-78995</ident><ident system=\"http://cyber.mil/legacy\">SV-93701</ident><ident system=\"http://cyber.mil/cci\">CCI-000057</ident><fixtext fixref=\"F-16135r193201_fix\">Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces.\n\nCreate a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: \n\nNote: The example below is using the database \"local\" for the system, so if the system is using another database in \"/etc/dconf/profile/user\", the file should be created under the appropriate subdirectory.\n\n# touch /etc/dconf/db/local.d/locks/session\n\nAdd the setting to lock the screensaver lock-enabled setting:\n\n/org/gnome/desktop/screensaver/lock-enabled\n</fixtext><fix id=\"F-16135r193201_fix\" /><check system=\"C-16137r193200_chk\"><check-content-ref href=\"Red_Hat_Enterprise_Linux_7_STIG.xml\" name=\"M\" /><check-content>Verify the operating system prevents a user from overriding the screensaver lock-enabled setting for the graphical user interface. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console.\n\nDetermine which profile the system database is using with the following command:\n# grep system-db /etc/dconf/profile/user\n\nsystem-db:local\n\nCheck for the lock-enabled setting with the following command:\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\n# grep -i lock-enabled /etc/dconf/db/local.d/locks/*\n\n/org/gnome/desktop/screensaver/lock-enabled\n\nIf the command does not return a result, this is a finding.\n</check-content></check></Rule></Group></Benchmark>\n"
  },
  {
    "path": "test/api/form-data-files/U_VPN_SRG-OTHER_V1R1_Manual-xccdf.xml",
    "content": "<?xml version=\"1.0\" encoding=\"utf-8\"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:cpe=\"http://cpe.mitre.org/language/2.0\" xmlns:xhtml=\"http://www.w3.org/1999/xhtml\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\" id=\"VPN_SRG_OTHER\" xml:lang=\"en\" xsi:schemaLocation=\"http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd\" xmlns=\"http://checklists.nist.gov/xccdf/1.1\"><status date=\"2001-07-26\">accepted</status><title>Virtual Private Network (VPN) Security Requirements Guide - replaced</title><description>This description replaces the old description</description><notice id=\"terms-of-use\" xml:lang=\"en\"></notice><reference href=\"http://public.cyber.mil\"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id=\"release-info\">Release: 2 Benchmark Date: 19 Jul 2001</plain-text><version>2</version><Group id=\"V-97041\"><title>SRG-NET-000019-VPN-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106179r1_xxxx\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000019-VPN-000040</version><title>This rule title has been replaced.</title><description>&lt;VulnDiscussion&gt;Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\r\n\r\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001414</ident><fixtext fixref=\"F-102721r1_fix\">Configure the VPN Gateway to ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies (e.g., IPsec policy configuration). Also, configure the VPN gateway to forward encapsulated or encrypted traffic received from other enclaves with different security policies to the perimeter firewall and IDPS before traffic is passed to the private network.</fixtext><fix id=\"F-102721r1_fix\" /><check system=\"C-95877r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>This check content has been replaced!</check-content></check></Rule></Group><Group id=\"V-97043\"><title>SRG-NET-000041-VPN-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106181r1_xxxx\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000041-VPN-000110</version><title>The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.</title><description>&lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\r\n\r\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\r\n\r\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\r\n\r\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n \r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\r\n\"I've read &amp; consent to terms in IS user agreem't.\"&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000048</ident><fixtext fixref=\"F-102723r1_fix\">Configure the Remote Access VPN to display the Standard Mandatory DoD Notice and Consent Banner in accordance with DoD policy before granting access to the device. Use the following verbiage for applications that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n\r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\"I've read &amp; consent to terms in IS user agreem't.\"</fixtext><fix id=\"F-102723r1_fix\" /><check system=\"C-95879r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway has an inbound and outbound traffic security policy which is in compliance with information flow control policies (e.g., IPsec policy configuration).\r\n\r\nReview network device configurations and topology diagrams. Verify encapsulated or encrypted traffic received from other enclaves with different security policies terminate at the perimeter for filtering and content inspection by a firewall and IDPS before gaining access to the private network.\r\n\r\nIf the VPN Gateway does not ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies, this is a finding.</check-content></check></Rule></Group></Benchmark>"
  },
  {
    "path": "test/api/form-data-files/U_VPN_SRG-OTHER_V1R1_twoRules-matchingFingerprints.xml",
    "content": "<?xml version=\"1.0\" encoding=\"utf-8\"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:cpe=\"http://cpe.mitre.org/language/2.0\" xmlns:xhtml=\"http://www.w3.org/1999/xhtml\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\" id=\"VPN_SRG_Rule-fingerprint-match-test\" xml:lang=\"en\" xsi:schemaLocation=\"http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd\" xmlns=\"http://checklists.nist.gov/xccdf/1.1\"><status date=\"2001-07-26\">accepted</status><title>Virtual Private Network (VPN) Security Requirements Guide - replaced</title><description>This description replaces the old description</description><notice id=\"terms-of-use\" xml:lang=\"en\"></notice><reference href=\"http://public.cyber.mil\"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id=\"release-info\">Release: 2 Benchmark Date: 19 Jul 2001</plain-text><version>2</version>\r\n\r\n<Group id=\"V-97041\"><title>SRG-NET-000019-VPN-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106179r1_xxxx\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000019-VPN-000040</version><title>This rule title has been replaced.</title><description>&lt;VulnDiscussion&gt;Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\r\n\r\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001414</ident><fixtext fixref=\"F-102721r1_fix\">Configure the VPN Gateway to ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies (e.g., IPsec policy configuration). Also, configure the VPN gateway to forward encapsulated or encrypted traffic received from other enclaves with different security policies to the perimeter firewall and IDPS before traffic is passed to the private network.</fixtext><fix id=\"F-102721r1_fix\" /><check system=\"C-95877r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>This check content has been replaced!</check-content></check></Rule></Group>\r\n\r\n<Group id=\"V-97041\"><title>SRG-NET-000019-VPN-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106179r1_zzzzzz\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000019-VPN-000040</version><title>This rule title has been replaced.</title><description>&lt;VulnDiscussion&gt;Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\r\n\r\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001414</ident><fixtext fixref=\"F-102721r1_fix\">Configure the VPN Gateway to ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies (e.g., IPsec policy configuration). Also, configure the VPN gateway to forward encapsulated or encrypted traffic received from other enclaves with different security policies to the perimeter firewall and IDPS before traffic is passed to the private network.</fixtext><fix id=\"F-102721r1_fix\" /><check system=\"C-95877r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>This check content has been replaced!</check-content></check></Rule></Group>\r\n\r\n<Group id=\"V-97043\"><title>SRG-NET-000041-VPN-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106181r1_xxxx\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000041-VPN-000110</version><title>The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.</title><description>&lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\r\n\r\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\r\n\r\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\r\n\r\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n \r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\r\n\"I've read &amp; consent to terms in IS user agreem't.\"&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000048</ident><fixtext fixref=\"F-102723r1_fix\">Configure the Remote Access VPN to display the Standard Mandatory DoD Notice and Consent Banner in accordance with DoD policy before granting access to the device. Use the following verbiage for applications that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n\r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\"I've read &amp; consent to terms in IS user agreem't.\"</fixtext><fix id=\"F-102723r1_fix\" /><check system=\"C-95879r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway has an inbound and outbound traffic security policy which is in compliance with information flow control policies (e.g., IPsec policy configuration).\r\n\r\nReview network device configurations and topology diagrams. Verify encapsulated or encrypted traffic received from other enclaves with different security policies terminate at the perimeter for filtering and content inspection by a firewall and IDPS before gaining access to the private network.\r\n\r\nIf the VPN Gateway does not ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies, this is a finding.</check-content></check></Rule></Group></Benchmark>"
  },
  {
    "path": "test/api/form-data-files/U_VPN_SRG_V1R0_Manual-xccdf.xml",
    "content": "<?xml version=\"1.0\" encoding=\"utf-8\"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:cpe=\"http://cpe.mitre.org/language/2.0\" xmlns:xhtml=\"http://www.w3.org/1999/xhtml\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\" id=\"VPN_SRG_TEST\" xml:lang=\"en\" xsi:schemaLocation=\"http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd\" xmlns=\"http://checklists.nist.gov/xccdf/1.1\"><status date=\"2010-07-26\">accepted</status><title>Virtual Private Network (VPN) Security Requirements Guide</title><description>This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id=\"terms-of-use\" xml:lang=\"en\"></notice><reference href=\"http://public.cyber.mil\"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id=\"release-info\">Release: 0 Benchmark Date: 19 Jul 2010</plain-text><version>1</version><Group id=\"V-97041\"><title>SRG-NET-000019-VPN-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106179r123456789_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000019-VPN-000040</version><title>The VPN Gateway must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.</title><description>&lt;VulnDiscussion&gt;Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\r\n\r\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001414</ident><fixtext fixref=\"F-102721r1_fix\">Configure the VPN Gateway to ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies (e.g., IPsec policy configuration). Also, configure the VPN gateway to forward encapsulated or encrypted traffic received from other enclaves with different security policies to the perimeter firewall and IDPS before traffic is passed to the private network.</fixtext><fix id=\"F-102721r1_fix\" /><check system=\"C-95877r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx the VPN Gateway has an inbound and outbound traffic security policy which is in compliance with information flow control policies (e.g., IPsec policy configuration).\r\n\r\nReview network device configurations and topology diagrams. Verify encapsulated or encrypted traffic received from other enclaves with different security policies terminate at the perimeter for filtering and content inspection by a firewall and IDPS before gaining access to the private network.\r\n\r\nIf the VPN Gateway does not ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97043\"><title>SRG-NET-000041-VPN-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106181r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000041-VPN-000110</version><title>The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.</title><description>&lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\r\n\r\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\r\n\r\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\r\n\r\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n \r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\r\n\"I've read &amp; consent to terms in IS user agreem't.\"&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000048</ident><fixtext fixref=\"F-102723r1_fix\">Configure the Remote Access VPN to display the Standard Mandatory DoD Notice and Consent Banner in accordance with DoD policy before granting access to the device. Use the following verbiage for applications that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n\r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\"I've read &amp; consent to terms in IS user agreem't.\"</fixtext><fix id=\"F-102723r1_fix\" /><check system=\"C-95879r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>If the user/remote client connection banner is the same as the banner configured as part of the NDM SRG, then this is not applicable.\r\n\r\nDetermine if the network device is configured to present a DoD-approved banner that is formatted in accordance with DoD policy. \r\n\r\nIf the Remote Access VPN Gateway or VPN client does not display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97045\"><title>SRG-NET-000042-VPN-000120</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106183r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000042-VPN-000120</version><title>The Remote Access VPN Gateway and/or client must enforce a policy to retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.</title><description>&lt;VulnDiscussion&gt;The banner must be acknowledged by the user prior to allowing the user access to the network. This provides assurance that the user has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the user, DoD will not be in compliance with system use notifications required by law. \r\n\r\nThe banner is usually configured in NDM for client presentation as well as local logon.\r\n\r\nTo establish acceptance of the application usage policy, a click-through banner at application logon is required. The VPN gateway must prevent further activity until the user executes a positive action to manifest agreement by clicking on a box indicating \"OK\". \r\n\r\nThis applies to gateways that have the concept of a user account and have the login function residing on the gateway or the gateway acts as a user intermediary.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000050</ident><fixtext fixref=\"F-102725r1_fix\">Configure the Remote Access VPN Gateway and/or client to retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.</fixtext><fix id=\"F-102725r1_fix\" /><check system=\"C-95881r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>If the user/remote client connection banner is the same as the banner configured as part of the NDM SRG, then this is not applicable.\r\n\r\nVerify the ALG retains the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and takes explicit actions to log on for further access.\r\n\r\nIf the Remote Access VPN Gateway and/or client does not retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97047\"><title>SRG-NET-000043-VPN-000130</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106185r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000043-VPN-000130</version><title>The publicly accessible VPN Gateway must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.</title><description>&lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the publicly accessible VPN gateway ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\r\n\r\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\r\n\r\nThe banner must be formatted in accordance with DTM-08-060. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n\r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\r\n\"I've read &amp; consent to terms in IS user agreem't.\"&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001384</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001385</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001386</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001387</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001388</ident><fixtext fixref=\"F-102727r1_fix\">Configure the publicly accessible VPN Gateway to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.</fixtext><fix id=\"F-102727r1_fix\" /><check system=\"C-95883r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the publicly accessible VPN Gateway displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.  The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for network elements that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n\r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\r\n\"I've read &amp; consent to terms in IS user agreem't.\"\r\n\r\nIf the publicly accessible VPN Gateway does not display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97049\"><title>SRG-NET-000049-VPN-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106187r1_rule\" severity=\"low\" weight=\"10.0\"><version>SRG-NET-000049-VPN-000150</version><title>The VPN Gateway must notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access).</title><description>&lt;VulnDiscussion&gt;Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the number of unsuccessful attempts that were made to login to their account allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators.\r\n\r\nThis applies to gateways that have the concept of a user account and have the login function residing on the gateway or the gateway acts as a user intermediary.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000053</ident><fixtext fixref=\"F-102729r1_fix\">Configure the VPN Gateway to notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access).</fixtext><fix id=\"F-102729r1_fix\" /><check system=\"C-95885r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Determine if the VPN Gateway is either configured to notify the administrator of the number of unsuccessful login attempts since the last successful login or configured to use an authentication server which would perform this function. If the administrator is not notified of the number of unsuccessful login attempts since the last successful login, this is a finding.\r\n\r\nIf the VPN Gateway does not notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access), this is a finding.</check-content></check></Rule></Group><Group id=\"V-97051\"><title>SRG-NET-000053-VPN-000170</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106189r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000053-VPN-000170</version><title>The VPN Gateway must limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number.</title><description>&lt;VulnDiscussion&gt;VPN gateway management includes the ability to control the number of users and user sessions that utilize a VPN gateway. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to DoS attacks.\r\n\r\nThis requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.\r\n\r\nThe intent of this policy is to ensure the number of concurrent sessions is deliberately set to a number based on the site's mission and not left unlimited.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000054</ident><fixtext fixref=\"F-102731r1_fix\">Configure the VPN Gateway to limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number, as documented in the SSP.</fixtext><fix id=\"F-102731r1_fix\" /><check system=\"C-95887r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Inspect the VPN Gateway configuration. Verify the number of concurrent sessions for user accounts to 1 or to an organization-defined number (defined in the SSP).\r\n\r\nIf the VPN Gateway does not limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97053\"><title>SRG-NET-000062-VPN-000200</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106191r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000062-VPN-000200</version><title>The TLS VPN Gateway must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during transmission.</title><description>&lt;VulnDiscussion&gt;Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\r\n\r\nNIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000068</ident><fixtext fixref=\"F-102733r1_fix\">Configure the TLS VPN Gateway to use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data for transmission.</fixtext><fix id=\"F-102733r1_fix\" /><check system=\"C-95889r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the TLS VPN Gateway is configured to use  TLS 1.2 or higher to protect the confidentiality of sensitive data during transmission.\r\n\r\nIf the TLS VPN Gateway does not use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during transmission, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97055\"><title>SRG-NET-000063-VPN-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106193r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000063-VPN-000210</version><title>The remote access VPN Gateway must use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.</title><description>&lt;VulnDiscussion&gt;Without integrity protection, unauthorized changes may be made to the log files and reliable forensic analysis and discovery of the source of malicious system activity may be degraded.\r\n\r\nRemote access (e.g., RDP) is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless.\r\n\r\nIntegrity checks include cryptographic checksums, digital signatures, or hash functions. Federal Information Processing Standard (FIPS) 186-4, Digital Signature Standard (DSS), specifies three NIST-approved algorithms: DSA, RSA, and ECDSA. All three are used to generate and verify digital signatures in conjunction with an approved hash function.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001453</ident><fixtext fixref=\"F-102735r1_fix\">Configure the remote access VPN Gateway to use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.</fixtext><fix id=\"F-102735r1_fix\" /><check system=\"C-95891r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the remote access VPN Gateway uses a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.\r\n\r\nIf the remote access VPN Gateway does not use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97057\"><title>SRG-NET-000063-VPN-000220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106195r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000063-VPN-000220</version><title>The VPN Gateway must be configured to use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.</title><description>&lt;VulnDiscussion&gt;Without strong cryptographic integrity protections, information can be altered by unauthorized users without detection.\r\n\r\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \r\n\r\nThe remote access VPN provides access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001453</ident><fixtext fixref=\"F-102737r1_fix\">Configure the VPN Gateway to use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.</fixtext><fix id=\"F-102737r1_fix\" /><check system=\"C-95893r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.\r\n\r\nIf the VPN Gateway does not use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97059\"><title>SRG-NET-000074-VPN-000250</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106197r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000074-VPN-000250</version><title>The IPsec VPN must implement a FIPS 140-2 validated Diffie-Hellman (DH) group.</title><description>&lt;VulnDiscussion&gt;Use of an approved DH algorithm ensures the Internet Key Exchange (IKE) (phase 1) proposal uses FIPS-validated key management techniques and processes in the production, storage, and control of private/secret cryptographic keys. The security of the DH key exchange is based on the difficulty of solving the discrete logarithm in which the key was derived from. Hence, the larger the modulus, the more secure the generated key is considered to be.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000068</ident><fixtext fixref=\"F-102739r1_fix\">Configure the IPsec VPN to us the FIPS 140-2 DH group. The following command is an example of how to configure the IKE (phase 1) proposals. \r\n\r\nThe following groups are allowed for use in DoD: \r\nDH Groups 14 (2048-bit MODP) \r\n- 19 (256-bit Random ECP), 20 (384-bit Random ECP), 5 (1536-bit MODP), 24 (2048-bit MODP with 256-bit POS).</fixtext><fix id=\"F-102739r1_fix\" /><check system=\"C-95895r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify all IKE proposals are set to use a FIPS-validated dh-group.\r\n\r\nView the IKE options dh-group option.\r\n\r\nIf the IKE option is not set to a FIPS 140-2 validated dh-group, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97061\"><title>SRG-NET-000077-VPN-000280</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106199r1_rule\" severity=\"low\" weight=\"10.0\"><version>SRG-NET-000077-VPN-000280</version><title>The VPN Gateway must generate log records containing information to establish what type of events occurred.</title><description>&lt;VulnDiscussion&gt;Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.\r\n\r\nVPN gateways often have a separate audit log for capturing VPN status and other information about the traffic (as opposed to the log capturing administrative and configuration actions). Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.\r\n\r\nAssociating event types with detected events in the VPN gateway logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000130</ident><fixtext fixref=\"F-102743r1_fix\">Configure the VPN Gateway to generate log records containing information to establish what type of events occurred.</fixtext><fix id=\"F-102743r1_fix\" /><check system=\"C-95899r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway generates log records containing information to establish what type of events occurred.\r\n\r\nIf the VPN Gateway does not generate log records containing information to establish what type of events occurred, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97063\"><title>SRG-NET-000078-VPN-000290</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106201r1_rule\" severity=\"low\" weight=\"10.0\"><version>SRG-NET-000078-VPN-000290</version><title>The VPN Gateway must generate log records containing information to establish when (date and time) the events occurred.</title><description>&lt;VulnDiscussion&gt;Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\r\n\r\nVPN gateways often have a separate audit log for capturing VPN status and other information about the traffic (as opposed to the log capturing administrative and configuration actions).\r\n\r\nAssociating event types with detected events in the network audit logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000131</ident><fixtext fixref=\"F-102745r1_fix\">Configure the VPN Gateway to generate log records containing information to establish when (date and time) the events occurred.</fixtext><fix id=\"F-102745r1_fix\" /><check system=\"C-95901r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Configure the VPN Gateway generates log records containing information to establish when (date and time) the events occurred.\r\n\r\nIf the VPN Gateway does not generate log records containing information to establish when (date and time) the events occurred, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97065\"><title>SRG-NET-000079-VPN-000300</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106203r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000079-VPN-000300</version><title>The VPN Gateway must generate log records containing information that establishes the identity of any individual or process associated with the event.</title><description>&lt;VulnDiscussion&gt;Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001487</ident><fixtext fixref=\"F-102747r1_fix\">Configure the VPN Gateway to generate log records containing information that establishes the identity of any individual or process associated with the event.</fixtext><fix id=\"F-102747r1_fix\" /><check system=\"C-95903r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway generates log records containing information that establishes the identity of any individual or process associated with the event.\r\n\r\nIf the VPN Gateway does not generate log records containing information that establishes the identity of any individual or process associated with the event, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97067\"><title>SRG-NET-000088-VPN-000310</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106205r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000088-VPN-000310</version><title>The VPN Gateway must generate log records containing information to establish where the events occurred.</title><description>&lt;VulnDiscussion&gt;Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\r\n\r\nIn order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know where events occurred, such as VPN gateway components, modules, device identifiers, node names, and functionality.\r\n\r\nAssociating information about where the event occurred within the network provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000132</ident><fixtext fixref=\"F-102749r1_fix\">Configure the VPN Gateway to generates log records containing information to establish where the events occurred.</fixtext><fix id=\"F-102749r1_fix\" /><check system=\"C-95905r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway generates  log records containing information to establish where the events occurred.\r\n\r\nIf the VPN Gateway does not generate log records containing information to establish where the events occurred, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97069\"><title>SRG-NET-000089-VPN-000330</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106207r1_rule\" severity=\"low\" weight=\"10.0\"><version>SRG-NET-000089-VPN-000330</version><title>The VPN Gateway must generate log records containing information to establish the source of the events.</title><description>&lt;VulnDiscussion&gt;Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event.\r\n\r\nIn addition to logging where events occur within the network, the log records must also identify sources of events such as IP addresses, processes, and node or device names.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000133</ident><fixtext fixref=\"F-102751r1_fix\">Configure the VPN Gateway to generate log records containing information to establish the source of the events.</fixtext><fix id=\"F-102751r1_fix\" /><check system=\"C-95907r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway  generates log records containing information to establish the source of the events.\r\n\r\nIf the VPN Gateway does not generate log records containing information to establish the source of the events, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97071\"><title>SRG-NET-000091-VPN-000350</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106209r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000091-VPN-000350</version><title>The VPN Gateway must produce log records containing information to establish the outcome of the events.</title><description>&lt;VulnDiscussion&gt;Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the network.\r\n\r\nEvent outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the network after the event occurred). As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000134</ident><fixtext fixref=\"F-102753r1_fix\">Configure the VPN Gateway to generate log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the client connection attempts.</fixtext><fix id=\"F-102753r1_fix\" /><check system=\"C-95909r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Examine the log configuration on the VPN Gateway or view several alert events on the organization's central audit server. Alternatively, examine the Central Log Server to see if it contains information about success or failure of client connection attempts or other events.\r\n\r\nIf the traffic log entries do not include the success or failure of connection attempts and other events, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97073\"><title>SRG-NET-000098-VPN-000370</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106211r1_rule\" severity=\"low\" weight=\"10.0\"><version>SRG-NET-000098-VPN-000370</version><title>The VPN Gateway must protect log information from unauthorized read access if all or some of this data is stored locally.</title><description>&lt;VulnDiscussion&gt;Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured VPN gateway. Thus, it is imperative that the collected log data from the various VPN gateways, as well as the auditing tools, be secured and can only be accessed by authorized personnel.\r\n\r\nThis requirement pertains to securing the VPN log as it is stored locally, on the box temporarily, or while being encapsulated.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000162</ident><fixtext fixref=\"F-102755r1_fix\">Configure the VPN Gateway to protect log information from unauthorized read access if all or some of this data is stored locally.</fixtext><fix id=\"F-102755r1_fix\" /><check system=\"C-95911r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway protects log information from unauthorized read access if all or some of this data is stored locally.\r\n\r\nIf the VPN Gateway does not protect log information from unauthorized read access if all or some of this data is stored locally, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97075\"><title>SRG-NET-000099-VPN-000380</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106213r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000099-VPN-000380</version><title>The VPN Gateway log must protect audit information from unauthorized modification when stored locally.</title><description>&lt;VulnDiscussion&gt;If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\r\n\r\nThis requirement pertains to securing the VPN log as it is stored locally, on the box temporarily, or while being encapsulated.\r\n\r\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\r\n\r\nAudit information includes all information (e.g., log records, audit settings, and audit reports) needed to successfully audit information system activity.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000163</ident><fixtext fixref=\"F-102757r1_fix\">Configure the VPN Gateway log to protect audit information from unauthorized modification when stored locally. The method used depends on system architecture and design. Examples: ensuring log files receive the proper file system permissions and limiting log data locations.</fixtext><fix id=\"F-102757r1_fix\" /><check system=\"C-95913r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway log is configured to protect audit information from unauthorized modification when stored locally.\r\n\r\nThe VPN Gateway log must protect audit information from unauthorized modification when stored locally, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97077\"><title>SRG-NET-000100-VPN-000390</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106215r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000100-VPN-000390</version><title>The VPN Gateway must protect audit information from unauthorized deletion when stored locally.</title><description>&lt;VulnDiscussion&gt;If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\r\n\r\nTo ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification.\r\n\r\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\r\n\r\nAudit information includes all information (e.g., log records, audit settings, and audit reports) needed to successfully audit information system activity.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000164</ident><fixtext fixref=\"F-102759r1_fix\">Configure the VPN Gateway to protect audit information from unauthorized deletion when stored locally. Ensure log files receive the proper file system permissions and limiting log data locations.</fixtext><fix id=\"F-102759r1_fix\" /><check system=\"C-95915r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway is configured to protect audit information from unauthorized deletion when stored locally.\r\n\r\nIf the VPN Gateway does not protect audit information from unauthorized deletion when stored locally, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97079\"><title>SRG-NET-000132-VPN-000450</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106217r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000132-VPN-000450</version><title>The VPN Gateway must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.</title><description>&lt;VulnDiscussion&gt;In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\r\n\r\nDoD continually assesses the ports, protocols, and services that can be used for network communications. Some protocols or services have known exploits or security weaknesses. Network traffic using these ports, protocols, and services must be prohibited or restricted in accordance with DoD policy. The PPSM CAL and vulnerability assessments provide an authoritative source for ports, protocols, and services that are unauthorized or restricted across boundaries on DoD networks.\r\n\r\nThe VPN Gateway must be configured to prevent or restrict the use of prohibited ports, protocols, and services throughout the network by filtering the network traffic and disallowing or redirecting traffic as necessary. Default and updated policy filters from the vendors will disallow older version of protocols and applications and will address most known non-secure ports, protocols, and/or services.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000382</ident><fixtext fixref=\"F-102761r1_fix\">Ensure functions, ports, protocols, and services identified on the PPSM CAL are not used for system services configuration.\r\n\r\nView the configured security  services.\r\n\r\nCompare the services that are enabled, including the port, services, protocols, and functions.\r\n\r\nConsult the product knowledge base and configuration guides to determine the commands for disabling each port, protocols, services, or functions that is not in compliance with the PPSM CAL and vulnerability assessments.</fixtext><fix id=\"F-102761r1_fix\" /><check system=\"C-95917r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>View the configured security  services.\r\n\r\nCompare the services that are enabled, including the port, services, protocols, and functions.\r\n\r\nIf functions, ports, protocols, and services identified on the PPSM CAL are not disabled, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97081\"><title>SRG-NET-000132-VPN-000460</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106219r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000132-VPN-000460</version><title>The IPsec VPN Gateway must use IKEv2 for IPsec VPN security associations.</title><description>&lt;VulnDiscussion&gt;In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\r\n\r\nUse of IKEv2 leverages DoS protections because of improved bandwidth management and leverages more secure encryption algorithms.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000382</ident><fixtext fixref=\"F-102763r1_fix\">Configure the IPsec VPN Gateway to use IKEv2 for IPsec VPN security associations.</fixtext><fix id=\"F-102763r1_fix\" /><check system=\"C-95919r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway uses IKEv2 for IPsec VPN security associations.\r\n\r\nIf the IPsec VPN Gateway must use IKEv2 for IPsec VPN security associations, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97083\"><title>SRG-NET-000132-VPN-000470</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106221r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000132-VPN-000470</version><title>The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and L2F.</title><description>&lt;VulnDiscussion&gt;The PPTP and L2F are obsolete method for implementing virtual private networks. Both protocols may be easy to use and readily available, but they have many well-known security issues and exploits. Encryption and authentication are both weak.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000382</ident><fixtext fixref=\"F-102765r1_fix\">Configure the VPN Gateway to prohibit PPTP and L2F.</fixtext><fix id=\"F-102765r1_fix\" /><check system=\"C-95921r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway is configured to prohibit PPTP and L2F.\r\n\r\nIf the VPN Gateway does not be configured to prohibit PPTP and L2F, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97085\"><title>SRG-NET-000132-VPN-000480</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106223r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000132-VPN-000480</version><title>For site-to-site VPN implementations, the  L2TP protocol must be blocked or denied at the security boundary with the private network so unencrypted L2TP packets cannot traverse into the private network of the enclave.</title><description>&lt;VulnDiscussion&gt;Unlike GRE (a simple encapsulating header) L2TP is a full-fledged communications protocol with control channel, data channels, and a robust command structure. In addition to PPP, other link layer types (called pseudowires) can be and are defined for delivery in L2TP by separate RFC documents. Further complexity is created by the capability to define vender-specific parameters beyond those defined in the L2TP specifications.\r\n\r\nThe endpoint devices of an L2TP connection can be an L2TP Access Concentrator (LAC) in which case it inputs/outputs the layer 2 protocol to/from the L2TP tunnel. Otherwise, it is an L2TP Network Server (LNS), in which case it inputs/outputs the layer 3 (IP) protocol to/from the L2TP tunnel. The specifications describe three reference models: LAC-LNS, LAC-LAC, and LNS-LNS, the first of which is the most common case. The LAC-LNS model allows a remote access user to reach his home network or ISP from a remote location. The remote access user connects to  a LAC device which tunnels his connection home to an awaiting LNS. The LAC could also be located on the remote user's laptop, which connects to an LNS at home using some generic internet connection. The other reference models may be used for more obscure scenarios.\r\n\r\nAlthough the L2TP protocol does not contain encryption capability, it can be operated over IPsec, which would provide authentication and confidentiality. A remote user in the LAC-LNS model would most likely obtain a dynamically assigned IP address from the home network to ultimately use through the tunnel back to the home network. Secondly, the outer IP source address used to send the L2TP tunnel packet to the home network is likely to be unknown or highly variable. Thirdly, since the LNS provides the remote user with a dynamic IP address to use, the firewall at the home network would have to be dynamically updated to accept this address in conjunction with the outer tunnel address. Finally, there is also the issue of authentication of the remote user prior to divulging an acceptable IP address. Because of all of these complications, the strict filtering rules applied to the IP-in-IP and GRE tunneling cases will likely not be possible in the L2TP scenario.\r\n\r\nIn addition to the difficulty of enforcing addresses and endpoints (as explained above), the L2TP protocol itself is a security concern if allowed through a security boundary. In particular:\r\n\r\n1) L2TP potentially allows link layer protocols to be delivered from afar. These protocols were intended for link-local scope only, are less defended, and not as well-known,\r\n2) The L2TP tunnels can carry IP packets that are very difficult to see and filter because of the additional layer 2 overhead,\r\n3) L2TP is highly complex and variable (vender-specific variability) and therefore would be a viable target that is difficult to defend. It is better left outside of the main firewall where less damage occurs if the L2TP-processing node is compromised,\r\n4) Filtering cannot be used to detect and prevent other unintended layer 2 protocols from being tunneled. The strength of the application layer code would have to be relied on to achieve this task,\r\n5) Regardless of whether the L2TP is handled inside or outside of the main network, a secondary layer of IP filtering is required; therefore bringing it inside does not save resources.\r\n\r\nTherefore, it is not recommended to allow unencrypted L2TP packets across the security boundary into the network's protected areas. Reference the Backbone Transport STIG for additional L2TP guidance and use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000382</ident><fixtext fixref=\"F-102767r1_fix\">If L2TP is used for encapsulation, configure the VPN Gateway or other network element to block or deny this communications protocol unencrypted L2TP packets across the security boundary and into the private network of the enclave.</fixtext><fix id=\"F-102767r1_fix\" /><check system=\"C-95923r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>If L2TP communications protocol is not used, this is not applicable.\r\n\r\nVerify the VPN Gateway or another network element (e.g., firewall) is configure to block or deny L2TP packets with a destination address within the private network of the enclave.\r\n\r\nIf L2TP communications are  allowed to cross the security boundary into the private network of the enclave, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97087\"><title>SRG-NET-000138-VPN-000490</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106225r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000138-VPN-000490</version><title>The VPN Gateway must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).</title><description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\r\n\r\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses except the following.\r\n\r\n(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\r\n\r\n(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals' in-group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN or proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000764</ident><fixtext fixref=\"F-102769r1_fix\">Configure the VPN Gateway to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).</fixtext><fix id=\"F-102769r1_fix\" /><check system=\"C-95925r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway is configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).\r\n\r\nIf the VPN Gateway does not uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users), this is a finding.</check-content></check></Rule></Group><Group id=\"V-97089\"><title>SRG-NET-000140-VPN-000500</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106227r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000140-VPN-000500</version><title>The VPN Gateway must use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.</title><description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.\r\n\r\nMultifactor authentication uses two or more factors to achieve authentication. Use of password for user remote access for non-privileged account is not authorized.\r\n\r\nFactors include:\r\n(i) Something you know (e.g., password/PIN);\r\n(ii) Something you have (e.g., cryptographic identification device, token); or\r\n(iii) Something you are (e.g., biometric).\r\n\r\nA non-privileged account is any information system account with authorizations of a non-privileged user.\r\n\r\nNetwork access is any access to a network element by a user (or a process acting on behalf of a user) communicating through a network.\r\n\r\nThe DoD CAC with DoD-approved PKI is an example of multifactor authentication.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000766</ident><fixtext fixref=\"F-102771r1_fix\">Configure the VPN Gateway to use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.</fixtext><fix id=\"F-102771r1_fix\" /><check system=\"C-95927r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.\r\n\r\nIf the VPN Gateway does not use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97091\"><title>SRG-NET-000145-VPN-000510</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106229r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000145-VPN-000510</version><title>The VPN Client must implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.</title><description>&lt;VulnDiscussion&gt;Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\r\n\r\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD common access card.\r\n\r\nA non-privileged account is any information system account with authorizations of a non-privileged user.\r\n\r\nNetwork access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001939</ident><fixtext fixref=\"F-102773r1_fix\">Configure the VPN Client to implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.</fixtext><fix id=\"F-102773r1_fix\" /><check system=\"C-95929r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Client implements multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.\r\n\r\nIf the VPN Client does not implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97093\"><title>SRG-NET-000147-VPN-000520</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106231r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000147-VPN-000520</version><title>The TLS VPN must be configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts.</title><description>&lt;VulnDiscussion&gt;A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack.\r\n\r\nAn authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message.\r\n\r\nA non-privileged account is any operating system account with authorizations of a non-privileged user.\r\n\r\nTechniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001942</ident><fixtext fixref=\"F-102775r1_fix\">Configure the TLS VPN Gateway to use replay-resistant authentication mechanisms for network access to non-privileged accounts.</fixtext><fix id=\"F-102775r1_fix\" /><check system=\"C-95931r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the TLS VPN Gateway is configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts.\r\n\r\nIf the TLS VPN is not configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97095\"><title>SRG-NET-000147-VPN-000530</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106233r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000147-VPN-000530</version><title>The IPsec VPN Gateway must use anti-replay mechanisms for security associations.</title><description>&lt;VulnDiscussion&gt;Anti-replay is an IPsec security mechanism at a packet level, which helps to avoid unwanted users from intercepting and modifying an ESP packet.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001942</ident><fixtext fixref=\"F-102777r1_fix\">Configure the IPsec VPN Gateway to use anti-replay mechanisms for security associations.</fixtext><fix id=\"F-102777r1_fix\" /><check system=\"C-95933r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway  uses anti-replay mechanisms for security associations.\r\n\r\nIf the IPsec VPN Gateway does not use anti-replay mechanisms for security associations, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97097\"><title>SRG-NET-000148-VPN-000540</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106235r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000148-VPN-000540</version><title>The VPN Gateway must uniquely identify all network-connected endpoint devices before establishing a connection.</title><description>&lt;VulnDiscussion&gt;Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\r\n\r\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification decisions (as opposed to the actual identifiers) to the services that need to act on those decisions.\r\n\r\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers (outside a datacenter), VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000778</ident><fixtext fixref=\"F-102779r1_fix\">Configure the VPN Gateway to uniquely identify all network-connected endpoint devices before establishing a connection.</fixtext><fix id=\"F-102779r1_fix\" /><check system=\"C-95935r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uniquely identifies all network-connected endpoint devices before establishing a connection.\r\n\r\nIf the VPN Gateway does not uniquely identify all network-connected endpoint devices before establishing a connection, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97099\"><title>SRG-NET-000164-VPN-000560</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106237r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000164-VPN-000560</version><title>The VPN Gateway, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.</title><description>&lt;VulnDiscussion&gt;Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. To meet this requirement, the information system must create trusted channels between itself and remote trusted authorized IT product (e.g., syslog server) entities that protect the confidentiality and integrity of communications. The information system must create trusted paths between itself and remote administrators and users that protect the confidentiality and integrity of communications.\r\n\r\nA trust anchor is an authoritative entity represented via a public key and associated data. It is most often used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. However, applications that do not use a trusted path are not approved for non-local and remote management of DoD information systems.\r\n\r\nUse of SSHv2 to establish a trusted channel is approved. Use of FTP, TELNET, HTTP, and SNMPV1 is not approved since they violate the trusted channel rule set. Use of web management tools that are not validated by common criteria may also violate the trusted channel rule set.\r\n\r\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA.\r\n\r\nThis requirement verifies that a certification path to an accepted trust anchor is used for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Validation of the certificate status information is out of scope for this requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000185</ident><fixtext fixref=\"F-102781r1_fix\">Configure the  VPN Gateway to use PKI-based authentication that validates certificates by constructing a certification path (which includes status information) to an accepted trust anchor.</fixtext><fix id=\"F-102781r1_fix\" /><check system=\"C-95937r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway to use PKI-based authentication that validates certificates by constructing a certification path (which includes status information) to an accepted trust anchor.\r\n\r\nIf PKI-based authentication does not validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97101\"><title>SRG-NET-000165-VPN-000570</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106239r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000165-VPN-000570</version><title>The site-to-site VPN, when using PKI-based authentication for devices, must enforce authorized access to the corresponding private key.</title><description>&lt;VulnDiscussion&gt;If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure.\r\n\r\nThe cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to authenticate to network devices.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000186</ident><fixtext fixref=\"F-102783r1_fix\">Configure the site-to-site VPN that uses certificate-based device authentication to use a FIPS-compliant key management process.</fixtext><fix id=\"F-102783r1_fix\" /><check system=\"C-95939r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>If PKI-based authentication is not being used for device authentication, this is not applicable.\r\n\r\nVerify the site-to-site VPN that uses certificate-based device authentication uses a FIPS-compliant key management process.\r\n\r\nIf the site-to-site VPN that uses certificate-based device authentication does not use a FIPS-compliant key management process, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97103\"><title>SRG-NET-000166-VPN-000580</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106241r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000166-VPN-000580</version><title>The Remote Access VPN Gateway must use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.</title><description>&lt;VulnDiscussion&gt;The VPN interacts directly with public networks and devices and should not contain user authentication information for all users. AAA network security services provide the primary framework through which a network administrator can set up access control and authorization on network points of entry or network access servers. It is not advisable to configure access control on the VPN gateway or remote access server. Separation of services provides added assurance to the network if the access control server is compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000187</ident><fixtext fixref=\"F-102785r1_fix\">Configure the Remote Access VPN Gateway to use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.</fixtext><fix id=\"F-102785r1_fix\" /><check system=\"C-95941r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the Remote Access VPN Gateway is configured to use a physically separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.\r\n\r\nIf the Remote Access VPN Gateway does not use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97113\"><title>SRG-NET-000166-VPN-000590</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106251r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000166-VPN-000590</version><title>The VPN Gateway must map the authenticated identity to the user account for PKI-based authentication.</title><description>&lt;VulnDiscussion&gt;Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device or has the concept of a user (e.g., VPN or ALG. This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000187</ident><fixtext fixref=\"F-102797r1_fix\">Configure the VPN Gateway to map the authenticated identity to the user account for PKI-based authentication.</fixtext><fix id=\"F-102797r1_fix\" /><check system=\"C-95953r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway maps the authenticated identity to the user account for PKI-based authentication.\r\n\r\nIf the VPN Gateway does not map the authenticated identity to the user account for PKI-based authentication, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97115\"><title>SRG-NET-000168-VPN-000600</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106253r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000168-VPN-000600</version><title>The VPN Gateway must use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).</title><description>&lt;VulnDiscussion&gt;Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\r\n\r\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \r\n\r\nNonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through either an external network (e.g., the Internet) or an internal network.\r\n\r\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\r\n\r\nApplications also include HMAC, KDFs, Random Bit Generation, and hash-only applications (e.g., hashing passwords and using SHA-1 or higher to compute a checksum). For digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use where needed.\r\n\r\nSeparate requirements for configuring applications and protocols used by each product (e.g., SNMPv3, SSH, NTP, and other protocols and applications that require server/client authentication) are required to implement this requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000803</ident><fixtext fixref=\"F-102799r1_fix\">Configure the VPN Gateway to use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).</fixtext><fix id=\"F-102799r1_fix\" /><check system=\"C-95955r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).\r\n\r\nIf the VPN Gateway does not use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only), this is a finding.</check-content></check></Rule></Group><Group id=\"V-97117\"><title>SRG-NET-000169-VPN-000610</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106255r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000169-VPN-000610</version><title>The VPN Gateway must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).</title><description>&lt;VulnDiscussion&gt;Lack of authentication and identification enables non-organizational users to gain access to the network or possibly a VPN gateway that provides opportunity for intruders to compromise resources within the network infrastructure.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device or has the concept of a non-organizational user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000804</ident><fixtext fixref=\"F-102801r1_fix\">Configure the VPN Gateway to uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).</fixtext><fix id=\"F-102801r1_fix\" /><check system=\"C-95957r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Configure the VPN Gateway to uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).\r\n\r\nIf the VPN Gateway does not uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users), this is a finding.</check-content></check></Rule></Group><Group id=\"V-97119\"><title>SRG-NET-000205-VPN-000710</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106257r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000205-VPN-000710</version><title>The VPN Gateway must be configured to route sessions to an IDPS for inspection.</title><description>&lt;VulnDiscussion&gt;Remote access devices, such as those providing remote access to network devices and information systems, which lack automated, capabilities increase risk and makes remote user access management difficult at best.\r\n\r\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\r\n\r\nAutomated monitoring of remote access sessions allows organizations to detect cyber attacks and ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, from a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001097</ident><fixtext fixref=\"F-102803r1_fix\">Configure the VPN Gateway to route sessions to an IDPS for inspection.</fixtext><fix id=\"F-102803r1_fix\" /><check system=\"C-95959r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway routes sessions to an IDPS for inspection.\r\n\r\nIf the VPN Gateway is not  configured to route sessions to an IDPS for inspection, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97121\"><title>SRG-NET-000213-VPN-000720</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106259r1_rule\" severity=\"low\" weight=\"10.0\"><version>SRG-NET-000213-VPN-000720</version><title>The VPN Gateway must terminate all network connections associated with a communications session at the end of the session.</title><description>&lt;VulnDiscussion&gt;Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These “orphaned” sessions use up valuable router resources and can be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keep alive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the TCP keep alive message, the sending router will clear the connection and free resources allocated to the session.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001133</ident><fixtext fixref=\"F-102805r1_fix\">Configure the VPN Gateway to terminate all network connections associated with a communications session at the end of the session.</fixtext><fix id=\"F-102805r1_fix\" /><check system=\"C-95961r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway terminates all network connections associated with a communications session at the end of the session.\r\n\r\nIf the VPN Gateway does not terminate all network connections associated with a communications session at the end of the session, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97123\"><title>SRG-NET-000230-VPN-000770</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106261r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000230-VPN-000770</version><title>The VPN Gateway must use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.</title><description>&lt;VulnDiscussion&gt;Unapproved mechanisms that are used for authentication to the cryptographic module are not verified, and therefore cannot be relied upon to provide confidentiality or integrity and DoD data may be compromised.\r\n\r\nVPN gateways utilizing encryption are required to use FIPS compliant mechanisms for authenticating to cryptographic modules.\r\n\r\nFIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001184</ident><fixtext fixref=\"F-102807r1_fix\">Configure the VPN Gateway to use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.</fixtext><fix id=\"F-102807r1_fix\" /><check system=\"C-95963r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.\r\n\r\nIf the VPN Gateway does not use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97125\"><title>SRG-NET-000230-VPN-000780</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106263r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000230-VPN-000780</version><title>The IPsec VPN Gateway must use Internet Key Exchange (IKE) with SHA-1 or greater to protect the authenticity of communications sessions.</title><description>&lt;VulnDiscussion&gt;Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.\r\n\r\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \r\n\r\nThis requirement focuses on communications protection for the application session rather than for the network packet and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/SOA will require the use of mutual authentication (two-way/bidirectional).\r\n\r\nAn IPsec Security Associations (SA) is established using either IKE or manual configuration.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001184</ident><fixtext fixref=\"F-102809r1_fix\">Configure the IPsec VPN Gateway to use IKE with SHA1 or greater to protect the authenticity of communications sessions.</fixtext><fix id=\"F-102809r1_fix\" /><check system=\"C-95965r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway uses IKE with SHA1 or greater to protect the authenticity of communications sessions.\r\n\r\nIf the IPsec VPN Gateway is not configured to use IKE with SHA1 or greater to protect the authenticity of communications sessions, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97127\"><title>SRG-NET-000231-VPN-000790</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106265r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000231-VPN-000790</version><title>The VPN Gateway must invalidate session identifiers upon user logoff or other session termination.</title><description>&lt;VulnDiscussion&gt;Captured sessions can be reused in \"replay\" attacks. This requirement limits the ability of adversaries from capturing and continuing to employ previously valid session IDs.\r\n\r\nSession IDs are tokens generated by web applications to uniquely identify an application user's session. Unique session identifiers or IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. When a user logs out, or when any other session termination event occurs, the VPN gateway must terminate the user session to minimize the potential for an attacker to hijack that particular user session.\r\n\r\nThis requirement focuses on communications protection for the application session rather than for the network packet.\r\n\r\nThis requirement applies only to any VPN gateway that is an intermediary of individual sessions (e.g., proxy, ALG, or SSL VPN). This requirement focuses on communications protection at the application session, versus network packet level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001185</ident><fixtext fixref=\"F-102811r1_fix\">Configure the VPN Gateway to invalidate session identifiers upon user logoff or other session termination.</fixtext><fix id=\"F-102811r1_fix\" /><check system=\"C-95967r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway invalidates session identifiers upon user logoff or other session termination.\r\n\r\nIf the VPN Gateway does not invalidate session identifiers upon user logoff or other session termination, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97129\"><title>SRG-NET-000233-VPN-000800</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106267r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000233-VPN-000800</version><title>The VPN Gateway must recognize only system-generated session identifiers.</title><description>&lt;VulnDiscussion&gt;VPN gateways (depending on function) utilize sessions and session identifiers to control application behavior and user access. If an attacker can guess the session identifier, or can inject or manually insert session information, the valid user's application session can be compromised.\r\n\r\nUnique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions.\r\n\r\nThis requirement focuses on communications protection for the application session rather than for the network packet.\r\n\r\nThis requirement applies to any VPN gateway that is an intermediary of individual sessions (e.g., proxy, ALG, TLS VPN). VPN gateways that perform these functions must be able to identify which session identifiers were generated when the sessions were established.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001664</ident><fixtext fixref=\"F-102813r1_fix\">Configure the VPN Gateway to recognize only system-generated session identifiers.</fixtext><fix id=\"F-102813r1_fix\" /><check system=\"C-95969r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway recognizes only system-generated session identifiers.\r\n\r\nIf the VPN Gateway does not recognize only system-generated session identifiers, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97131\"><title>SRG-NET-000234-VPN-000810</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106269r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000234-VPN-000810</version><title>The VPN Gateway must generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.</title><description>&lt;VulnDiscussion&gt;Both IPsec and TLS gateways use the RNG to strengthen the security of the protocols. Using a weak RNG will weaken the protocol and make it more vulnerable.\r\n\r\nUse of a FIPS validated RNG that is not DRGB mitigates to a CAT III.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001188</ident><fixtext fixref=\"F-102815r1_fix\">Configure the VPN Gateway to generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.</fixtext><fix id=\"F-102815r1_fix\" /><check system=\"C-95971r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway generates unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.\r\n\r\nIf the VPN Gateway does not generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97133\"><title>SRG-NET-000235-VPN-000820</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106271r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000235-VPN-000820</version><title>The VPN Gateway must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.</title><description>&lt;VulnDiscussion&gt;Failure to a known safe state helps prevent systems from failing to a state that may cause loss of data or unauthorized access to system resources. VPN gateways that fail suddenly and with no incorporated failure state planning may leave the hosting system available but with a reduced security protection capability. Preserving information system state information also facilitates system restart and return to the operational mode of the organization with less disruption to mission-essential processes.\r\n\r\nAbort refers to stopping a program or function before it has finished naturally. The term abort refers to both requested and unexpected terminations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001190</ident><fixtext fixref=\"F-102817r1_fix\">Configure the VPN Gateway to fail to a secure state if system initialization fails, shutdown fails, or aborts fail.</fixtext><fix id=\"F-102817r1_fix\" /><check system=\"C-95973r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway is configured to fail to a secure state if system initialization fails, shutdown fails, or aborts fail.\r\n\r\nIf the VPN Gateway does not fail to a secure state if system initialization fails, shutdown fails, or aborts fail, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97135\"><title>SRG-NET-000313-VPN-001050</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106273r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000313-VPN-001050</version><title>The VPN Gateway must be configured to perform an organization-defined action if the audit reveals unauthorized activity.</title><description>&lt;VulnDiscussion&gt;Remote access devices, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and makes remote user access management difficult at best.\r\n\r\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\r\n\r\nRemote access functionality, such as remote access servers, VPN concentrators, and IDS/IPS devices, must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002314</ident><fixtext fixref=\"F-102819r1_fix\">Configure the VPN Gateway to be configured to perform an organization-defined action if the audit reveals unauthorized activity.</fixtext><fix id=\"F-102819r1_fix\" /><check system=\"C-95975r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway is configured to perform an organization-defined action if the audit reveals unauthorized activity.\r\n\r\nIf the VPN Gateway does not be configured to perform an organization-defined action if the audit reveals unauthorized activity, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97137\"><title>SRG-NET-000314-VPN-001060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106275r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000314-VPN-001060</version><title>The VPN Gateway administrator accounts or security policy must be configured to allow the system administrator to immediately disconnect or disable remote access to devices and/or users when needed.</title><description>&lt;VulnDiscussion&gt;Without the ability to immediately disconnect or disable remote access, an attack or other compromise taking progress would not be immediately stopped.\r\n\r\nRemote access functionality must have the capability to immediately disconnect current users remotely accessing the information system and/or disable further remote access. The speed of disconnect or disablement varies based on the criticality of mission functions and the need to eliminate immediate or future remote access to organizational information systems.\r\n\r\nThe remote access functionality (e.g., VPN, ALG, and RAS) may implement features, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002322</ident><fixtext fixref=\"F-102821r1_fix\">Configure the VPN Gateway for functionality, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack. \r\n\r\nConfigure authorized system administrator accounts to allow them to disconnect or disable remote access to remove user under circumstances defined in the VPN SSP.</fixtext><fix id=\"F-102821r1_fix\" /><check system=\"C-95977r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Configure the VPN Gateway for functionality, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack. \r\n\r\nConfigure authorized system administrator accounts to allow them to disconnect or disable remote access to remove user under circumstances defined in the VPN SSP.\r\n\r\nIf the VPN Gateway administrator accounts or security policy is not configured to allow the system administrator to immediately disconnect or disable remote access to devices and/or users when needed, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97139\"><title>SRG-NET-000317-VPN-001090</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106277r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000317-VPN-001090</version><title>The IPsec VPN Gateway must use AES encryption for the Internet Key Exchange (IKE) proposal to protect confidentiality of remote access sessions.</title><description>&lt;VulnDiscussion&gt;Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\r\n\r\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\r\n\r\nAES is the FIPS-validated cipher block cryptographic algorithm approved for use in DoD. For an algorithm implementation to be listed on a FIPS 140-2 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. Currently, NIST has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000068</ident><fixtext fixref=\"F-102823r1_fix\">Configure the IPsec Gateway to use AES with IKE. The option on the IKE Phase 1 proposal may also be configured to use the  aes-128-cbc, aes-192-cbc, or aes-256-cbc algorithms.</fixtext><fix id=\"F-102823r1_fix\" /><check system=\"C-95979r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify all IKE proposals are set to use the AES encryption algorithm.\r\n\r\nView the value of the encryption algorithm for each defined proposal.\r\n\r\nIf the value of the encryption algorithm for any IKE proposal is not set to use an AES algorithm, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97141\"><title>SRG-NET-000320-VPN-001120</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106279r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000320-VPN-001120</version><title>The VPN Gateway must transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.</title><description>&lt;VulnDiscussion&gt;Protecting authentication communications between the client, the VPN Gateway, and the authentication server keeps this critical information from being exploited.\r\n\r\nIn distributed information systems, authorization processes and access control decisions may occur in separate parts of the systems. In such instances, authorization information is transmitted securely so timely access control decisions can be enforced at the appropriate locations. To support the access control decisions, it may be necessary to transmit as part of the access authorization information, supporting security attributes. This is due to the fact that in distributed information systems, there are various access control decisions that need to be made and different entities (e.g., services) make these decisions in a serial fashion, each requiring some security attributes to make the decisions.\r\n\r\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002353</ident><fixtext fixref=\"F-102825r1_fix\">Configure the VPN Gateway to transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.</fixtext><fix id=\"F-102825r1_fix\" /><check system=\"C-95981r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway transmits organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.\r\n\r\nIf the VPN Gateway does not transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97143\"><title>SRG-NET-000330-VPN-001220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106281r1_rule\" severity=\"low\" weight=\"10.0\"><version>SRG-NET-000330-VPN-001220</version><title>The VPN Gateway must notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).</title><description>&lt;VulnDiscussion&gt;Users need to be aware of activity that occurs regarding their account. Providing users with information deemed important by the organization may aid in the discovery of unauthorized access or thwart a potential attacker.\r\n\r\nOrganizations should consider the risks to the specific information system being accessed and the threats presented by the device to the environment when configuring this option. An excessive or unnecessary amount of information presented to the user at logon is not recommended.\r\n\r\nThis requirement applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002250</ident><fixtext fixref=\"F-102827r1_fix\">Configure the VPN Gateway to notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).</fixtext><fix id=\"F-102827r1_fix\" /><check system=\"C-95983r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verity the VPN Gateway notifies the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).\r\n\r\nIf the VPN Gateway does not notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access), this is a finding.</check-content></check></Rule></Group><Group id=\"V-97145\"><title>SRG-NET-000333-VPN-001250</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106283r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000333-VPN-001250</version><title>The VPN Gateway must provide centralized management and configuration of the content to be captured in log records generated by all network components.</title><description>&lt;VulnDiscussion&gt;Without the ability to centrally manage the content captured in the log records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack.\r\n\r\nThe content captured in log records must be managed from a central location (necessitating automation). Centralized management of log records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Network components requiring centralized audit log management must have the capability to support centralized management.\r\n\r\nThe DoD requires centralized management of all network component audit record content.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001844</ident><fixtext fixref=\"F-102829r1_fix\">Configure the VPN Gateway to provide centralized management and configuration of the content to be captured in log records generated by all network components.</fixtext><fix id=\"F-102829r1_fix\" /><check system=\"C-95985r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway provides centralized management and configuration of the content to be captured in log records generated by all network components.\r\n\r\nIf the VPN Gateway does not provide centralized management and configuration of the content to be captured in log records generated by all network components, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97147\"><title>SRG-NET-000334-VPN-001260</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106285r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000334-VPN-001260</version><title>The VPN Gateway must off-load audit records onto a different system or media than the system being audited.</title><description>&lt;VulnDiscussion&gt;Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\r\n\r\nOff-loading is a common process in information systems with limited audit storage capacity.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001851</ident><fixtext fixref=\"F-102831r1_fix\">Configure the VPN Gateway to off-load audit records onto a different system or media than the system being audited.</fixtext><fix id=\"F-102831r1_fix\" /><check system=\"C-95987r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway off-loads log records onto a different system or media than the system being audited.\r\n\r\nIf the VPN Gateway does not off-load audit records onto a different system or media than the system being audited, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97149\"><title>SRG-NET-000335-VPN-001270</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106287r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000335-VPN-001270</version><title>The VPN Gateway must generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.</title><description>&lt;VulnDiscussion&gt;It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected.\r\n\r\nAlerts provide organizations with urgent messages. Automated alerts can be conveyed in a variety of ways, including, for example, telephonically, via electronic mail, via text message, or via websites. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded.\r\n\r\nWhile this requirement also applies to the event monitoring system (e.g., Syslog, Security Information and Event Management [SIEM], or SNMP servers), the VPN Gateway must also be configured to generate a message to the administrator console.\r\n\r\nThe VPN daemon facility and log facility are messages in the log, which capture actions performed or errors encountered by system processes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001858</ident><fixtext fixref=\"F-102833r1_fix\">Configure the VPN Gateway to generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.</fixtext><fix id=\"F-102833r1_fix\" /><check system=\"C-95989r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway generates a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.\r\n\r\nIf the VPN Gateway does not generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97151\"><title>SRG-NET-000336-VPN-001280</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106289r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000336-VPN-001280</version><title>When communications with the Central Log Server is lost, the VPN Gateway must continue to queue traffic log records locally.</title><description>&lt;VulnDiscussion&gt;If the system were to continue processing after audit failure, actions can be taken on the system that cannot be tracked and recorded for later forensic analysis.\r\n\r\nBecause of the importance of ensuring mission/business continuity, organizations may determine that the nature of the audit failure is not so severe that it warrants a complete shutdown of the application supporting the core organizational missions/business operations. In those instances, partial application shutdowns or operating in a degraded mode with reduced capability may be viable alternatives.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001861</ident><fixtext fixref=\"F-102835r1_fix\">Configure the VPN Gateway to continue to queue traffic log records locally when communications with the Central Log Server is lost.</fixtext><fix id=\"F-102835r1_fix\" /><check system=\"C-95991r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify that in the event that communications with the Central Log Server is lost, the VPN Gateway is configured to continue to queue traffic log records locally.\r\n\r\nIf the VPN Gateway does not continue to queue traffic log records locally when communications with the Central Log Server is lost, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97153\"><title>SRG-NET-000337-VPN-001290</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106291r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000337-VPN-001290</version><title>The IPsec VPN Gateway must renegotiate the security association after 8 hours or less, or an organization-defined period.</title><description>&lt;VulnDiscussion&gt;The IPsec SA and its corresponding key will expire either after the number of seconds or amount of traffic volume has exceeded the configured limit. A new SA is negotiated before the lifetime threshold of the existing SA is reached to ensure that a new SA is ready for use when the old one expires. The longer the lifetime of the IPsec SA, the longer the lifetime of the session key used to protect IP traffic. The SA is less secure with a longer lifetime because an attacker has a greater opportunity to collect traffic encrypted by the same key and subject it to cryptanalysis. However, a shorter lifetime causes IPsec peers to renegotiate Phase II more often resulting in the expenditure of additional resources.\r\n\r\nSpecify the lifetime (in seconds) of an Internet Key Exchange (IKE) security association (SA). When the SA expires, it is replaced by a new SA, the security parameter index (SPI), or terminated if the peer cannot be contacted for renegotiation.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002038</ident><fixtext fixref=\"F-102837r1_fix\">Configure the IPsec VPN Gateway to renegotiate the security association after 8 hours or less, or an organization-defined period.</fixtext><fix id=\"F-102837r1_fix\" /><check system=\"C-95993r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway renegotiates the security association after 8 hours or less, or an organization-defined period.\r\n\r\nIf the IPsec VPN Gateway does not renegotiate the security association after 8 hours or less, or an organization-defined period, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97155\"><title>SRG-NET-000337-VPN-001300</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106293r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000337-VPN-001300</version><title>The VPN Gateway must renegotiate the security association after 24 hours or less or as defined by the organization.</title><description>&lt;VulnDiscussion&gt;When a VPN gateway creates an IPsec Security Association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway’s inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002038</ident><fixtext fixref=\"F-102839r1_fix\">Configure the VPN Gateway to renegotiate the security association after 24 hours or less or as defined by the organization.</fixtext><fix id=\"F-102839r1_fix\" /><check system=\"C-95995r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway renegotiates the security association after 24 hours or less or as defined by the organization.\r\n\r\nIf the VPN Gateway does not renegotiate the security association after 24 hours or less or as defined by the organization, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97157\"><title>SRG-NET-000341-VPN-001350</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106295r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000341-VPN-001350</version><title>The VPN Gateway must accept Personal Identity Verification (PIV) credentials.</title><description>&lt;VulnDiscussion&gt;The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\r\n\r\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001953</ident><fixtext fixref=\"F-102841r1_fix\">Configure the VPN Gateway to accept Personal Identity Verification (PIV) credentials.</fixtext><fix id=\"F-102841r1_fix\" /><check system=\"C-95997r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway accepts Personal Identity Verification (PIV) credentials.\r\n\r\nIf the VPN Gateway does not accept Personal Identity Verification (PIV) credentials, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97159\"><title>SRG-NET-000342-VPN-001360</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106297r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000342-VPN-001360</version><title>The VPN Gateway must electronically verify Personal Identity Verification (PIV) credentials.</title><description>&lt;VulnDiscussion&gt;The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\r\n\r\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001954</ident><fixtext fixref=\"F-102843r1_fix\">Configure the VPN Gateway to electronically verify Personal Identity Verification (PIV) credentials.</fixtext><fix id=\"F-102843r1_fix\" /><check system=\"C-95999r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway electronically verifies Personal Identity Verification (PIV) credentials.\r\n\r\nIf the VPN Gateway does not electronically verify Personal Identity Verification (PIV) credentials, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97177\"><title>SRG-NET-000343-VPN-001370</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106315r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000343-VPN-001370</version><title>The VPN Gateway must authenticate all network-connected endpoint devices before establishing a connection.</title><description>&lt;VulnDiscussion&gt;Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\r\n\r\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions.\r\n\r\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers (outside a datacenter), VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.\r\n\r\nDevice authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001958</ident><fixtext fixref=\"F-102859r1_fix\">Configure the VPN Gateway to authenticate all network-connected endpoint devices before establishing a connection.</fixtext><fix id=\"F-102859r1_fix\" /><check system=\"C-96015r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verity the VPN Gateway  authenticates all network-connected endpoint devices before establishing a connection.\r\n\r\nIf the VPN Gateway does not authenticate all network-connected endpoint devices before establishing a connection, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97179\"><title>SRG-NET-000352-VPN-001460</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106317r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000352-VPN-001460</version><title>The VPN Gateway must use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.</title><description>&lt;VulnDiscussion&gt;Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.\r\n\r\nThe National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by NIST and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future required Suite B implementations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002450</ident><fixtext fixref=\"F-102861r1_fix\">Configure the VPN Gateway to use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.</fixtext><fix id=\"F-102861r1_fix\" /><check system=\"C-96017r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.\r\n\r\nIf the VPN Gateway does not use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97181\"><title>SRG-NET-000369-VPN-001620</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106319r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000369-VPN-001620</version><title>The VPN Gateway must disable split-tunneling for remote clients VPNs.</title><description>&lt;VulnDiscussion&gt;Split tunneling would in effect allow unauthorized external connections, making the system more vulnerable to attack and to exfiltration of organizational information.\r\n\r\nA VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the Internet. With split tunneling enabled, a remote client has access to the Internet while at the same time has established a secured path to the enclave via an IPsec tunnel. A remote client connected to the Internet that has been compromised by an attacker in the Internet, provides an attack base to the enclave’s private network via the IPsec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002397</ident><fixtext fixref=\"F-102863r1_fix\">Configure the VPN Gateway to disable split-tunneling for remote clients VPNs.</fixtext><fix id=\"F-102863r1_fix\" /><check system=\"C-96019r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway disables split-tunneling for remote clients VPNs.\r\n\r\nIf the VPN Gateway does not disable split-tunneling for remote clients VPNs, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97183\"><title>SRG-NET-000371-VPN-001640</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106321r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000371-VPN-001640</version><title>The IPsec VPN Gateway must specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.</title><description>&lt;VulnDiscussion&gt;PFS generates each new encryption key independently from the previous key. Without PFS, compromise of one key will compromise all communications.\r\n\r\nThe phase 2 (Quick Mode) Security Association (SA) is used to create an IPsec session key. Hence, its rekey or key regeneration procedure is very important. The phase 2 rekey can be performed with or without Perfect Forward Secrecy (PFS). With PFS, every time a new IPsec Security Association is negotiated during the Quick Mode, a new Diffie-Hellman (DH) exchange occurs. The new DH shared secret will be included with original keying material (SYKEID_d, initiator nonce, and responder nonce from phase 1 for generating a new IPsec session key. If PFS is not used, the IPsec session key will always be completely dependent on the original keying material from the Phase-1. Hence, if an older key is compromised at any time, it is possible that all new keys may be compromised.\r\n\r\nThe DH exchange is performed in the same manner as was done in phase 1 (Main or Aggressive Mode). However, the phase 2 exchange is protected by encrypting the phase 2 packets with the key derived from the phase 1 negotiation. Because DH negotiations during phase 2 are encrypted, the new IPsec session key has an added element of secrecy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002418</ident><fixtext fixref=\"F-102865r1_fix\">Configure the IPsec VPN Gateway to specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.</fixtext><fix id=\"F-102865r1_fix\" /><check system=\"C-96021r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway specifies Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.\r\n\r\nIf the IPsec VPN Gateway does not specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97185\"><title>SRG-NET-000371-VPN-001650</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106323r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000371-VPN-001650</version><title>The VPN Gateway and Client must be configured to protect the confidentiality and integrity of transmitted information.</title><description>&lt;VulnDiscussion&gt;Without protection of the transmitted information, confidentiality and integrity may be compromised as unprotected communications can be intercepted and either read or altered.\r\n\r\nThis requirement also applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification.\r\n\r\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.\r\n\r\nFor example, configure all ISAKMP policies to use AES for Internet Key Exchange (IKE) cryptographic encryption operations and SHA-1 to protect data integrity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002418</ident><fixtext fixref=\"F-102867r1_fix\">Configure the VPN Gateway and the remote access client to protect the confidentiality and integrity of transmitted information.</fixtext><fix id=\"F-102867r1_fix\" /><check system=\"C-96023r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway and the remote access client are configured to protect the confidentiality and integrity of transmitted information.\r\n\r\nIf VPN Gateway and Client does not protect the confidentiality and integrity of transmitted information, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97187\"><title>SRG-NET-000375-VPN-001690</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106325r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000375-VPN-001690</version><title>The IPsec VPN Gateway must use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.</title><description>&lt;VulnDiscussion&gt;ESP provides confidentiality, data origin authentication, integrity, and anti-replay services within the IPsec suite of protocols. ESP in tunnel mode ensures a secure path for communications for site-to-site VPNs and gateway to endpoints, including header information.\r\n\r\nESP can be deployed in either transport or tunnel mode. Transport mode is used to create a secured session between two hosts. It can also be used when two hosts simply want to authenticate each IP packet with IPsec authentication header (AH). With ESP transport mode, only the payload (transport layer) is encrypted, whereas with tunnel mode, the entire IP packet is encrypted and encapsulated with a new IP header. Tunnel mode is used to encrypt traffic between secure IPsec gateways or between an IPsec gateway and an end-station running IPsec software. Hence, it is the only method to provide a secured path to transport traffic between remote sites or end-stations and the central site.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002423</ident><fixtext fixref=\"F-102869r1_fix\">Configure the IPsec VPN Gateway to use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.</fixtext><fix id=\"F-102869r1_fix\" /><check system=\"C-96025r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway uses Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.\r\n\r\nIf the IPsec VPN Gateway must use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97189\"><title>SRG-NET-000400-VPN-001940</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106327r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000400-VPN-001940</version><title>For site-to-site VPN, for accounts using password authentication, the VPN Gateway must use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.</title><description>&lt;VulnDiscussion&gt;Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\r\n\r\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \r\n\r\nThe information system must specify the hash algorithm used for authenticating passwords. Implementation of this requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000197</ident><fixtext fixref=\"F-102871r1_fix\">For accounts using password authentication, configure the VPN Gateway to use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.</fixtext><fix id=\"F-102871r1_fix\" /><check system=\"C-96027r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>For accounts using password authentication, verify the VPN Gateway uses FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.\r\n\r\nFor accounts using password authentication, if the VPN Gateway does not use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97191\"><title>SRG-NET-000492-VPN-001980</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106329r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000492-VPN-001980</version><title>The VPN Gateway must generate log records when successful and/or unsuccessful VPN connection attempts occur.</title><description>&lt;VulnDiscussion&gt;Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\r\n\r\nLog records can be generated from various components within the information system (e.g., module or policy filter).\r\n\r\nThis requirement only applies to components where this is specific to the function of the device, such as application layer gateway (ALG), which provides these access control and auditing functions on behalf of an application. This does not apply to audit logs generated on behalf of the device itself (management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-102873r1_fix\">Configure the VPN Gateway to generate log records when successful and/or unsuccessful VPN connection attempts occur.</fixtext><fix id=\"F-102873r1_fix\" /><check system=\"C-96029r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway generates log records when successful and/or unsuccessful VPN connection attempts occur.\r\n\r\nIf the VPN Gateway does not generate log records when successful and/or unsuccessful VPN connection attempts occur, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97193\"><title>SRG-NET-000510-VPN-002160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106331r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000510-VPN-002160</version><title>The VPN Gateway must use a FIPS-validated cryptographic module to generate cryptographic hashes.</title><description>&lt;VulnDiscussion&gt;FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plain text. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.\r\n\r\nThe cryptographic module used must have at least one validated hash algorithm. This validated hash algorithm must be used to generate cryptographic hashes for all cryptographic security function within the product being evaluated.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002450</ident><fixtext fixref=\"F-102875r1_fix\">Configure the VPN Gateway to use a FIPS-validated cryptographic module to generate cryptographic hashes.</fixtext><fix id=\"F-102875r1_fix\" /><check system=\"C-96031r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses a FIPS-validated cryptographic module to generate cryptographic hashes.\r\n\r\nIf the VPN Gateway does not use a FIPS-validated cryptographic module to generate cryptographic hashes, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97195\"><title>SRG-NET-000510-VPN-002170</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106333r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000510-VPN-002170</version><title>The VPN Gateway must use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.</title><description>&lt;VulnDiscussion&gt;FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plain text. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.\r\n\r\nThe cryptographic module used must have one FIPS-validated encryption algorithm (i.e., validated Advanced Encryption Standard [AES]). This validated algorithm must be used for encryption for cryptographic security function within the product being evaluated.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002450</ident><fixtext fixref=\"F-102877r1_fix\">Configure the VPN Gateway to use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.</fixtext><fix id=\"F-102877r1_fix\" /><check system=\"C-96033r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.\r\n\r\nIf the VPN Gateway does not use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97197\"><title>SRG-NET-000510-VPN-002180</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106335r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000510-VPN-002180</version><title>The IPsec VPN Gateway IKE must use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.</title><description>&lt;VulnDiscussion&gt;Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002450</ident><fixtext fixref=\"F-102879r1_fix\">Configure the IPsec VPN Gateway IKE to use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.</fixtext><fix id=\"F-102879r1_fix\" /><check system=\"C-96035r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway IKE uses a NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.\r\n\r\nIf the IPsec VPN Gateway IKE does not use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97199\"><title>SRG-NET-000512-VPN-002220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106337r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000512-VPN-002220</version><title>The IPsec VPN Gateway must use Internet Key Exchange (IKE) for IPsec VPN Security Associations (SAs).</title><description>&lt;VulnDiscussion&gt;Without IKE, the SPI is manually specified for each security association. IKE peers will negotiate the encryption algorithm and authentication or hashing methods as well as generate the encryption keys.\r\n\r\nAn IPsec SA is established using either Internet Key Exchange (IKE) or manual configuration. When using IKE, the security associations are established when needed and expire after a period of time or volume of traffic threshold. If manually configured, they are established as soon as the configuration is complete at both end points and they do not expire. When using IKE, the Security Parameter Index (SPI) for each security association is a pseudo-randomly derived number.\r\n\r\nWith manual configuration of the IPsec security association, both the cipher key and authentication key are static. Hence, if the keys are compromised, the traffic being protected by the current IPsec tunnel can be decrypted as well as traffic in any future tunnels established by this SA. Furthermore, the peers are not authenticated prior to establishing the SA, which could result in a rogue device establishing an IPsec SA with either of the VPN end points.\r\n\r\nIKE provides primary authentication to verify the identity of the remote system before negotiation begins. This feature is lost when the IPsec security associations are manually configured, which results in a non-terminating session using static pre-shared keys.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-102881r1_fix\">Configure the IPsec VPN Gateway to use IKE and IPsec VPN SAs.</fixtext><fix id=\"F-102881r1_fix\" /><check system=\"C-96037r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IKE protocol is specified for all IPsec VPNs.\r\n\r\nIf the IKE protocol is not specified as an option on all VPN gateways, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97201\"><title>SRG-NET-000512-VPN-002230</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106339r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000512-VPN-002230</version><title>The VPN Gateway must not accept certificates that have been revoked when using PKI for authentication.</title><description>&lt;VulnDiscussion&gt;Situations may arise in which the certificate issued by a Certificate Authority (CA) may need to be revoked before the lifetime of the certificate expires. For example, the certificate is known to have been compromised.\r\n\r\nWhen an incoming Internet Key Exchange (IKE) session is initiated for a remote client or peer whose certificate is revoked, the revocation list configured for use by the VPN server is checked to see if the certificate is valid; if the certificate is revoked, IKE will fail and an IPsec security association will not be established for the remote endpoint.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-102883r1_fix\">Configure the VPN Gateway to not accept certificates that have been revoked when using PKI for authentication.</fixtext><fix id=\"F-102883r1_fix\" /><check system=\"C-96039r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway does not accept certificates that have been revoked when using PKI for authentication.\r\n\r\nIf the VPN Gateway accepts certificates that have been revoked when using PKI for authentication, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97203\"><title>SRG-NET-000518-VPN-002280</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106341r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000518-VPN-002280</version><title>The VPN Client logout function must be configured to terminate the session on/with the VPN Gateway.</title><description>&lt;VulnDiscussion&gt;If a user cannot explicitly end a session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session.\r\n\r\nHowever, for some types of interactive sessions including, for example, remote login, information systems typically send logout messages as final messages prior to terminating sessions.\r\n\r\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002363</ident><fixtext fixref=\"F-102885r1_fix\">Configure the VPN Client logout log out function must be configured to terminate the session on/with the VPN Gateway.</fixtext><fix id=\"F-102885r1_fix\" /><check system=\"C-96041r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Client logout function is configured to terminate the session on/with the VPN Gateway.\r\n\r\nIf the VPN Client logout function does not terminate the session on/with the VPN Gateway, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97205\"><title>SRG-NET-000519-VPN-002290</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106343r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000519-VPN-002290</version><title>The VPN Client must display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.</title><description>&lt;VulnDiscussion&gt;If a user cannot explicitly end a session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. Users need to be aware of whether or not the session has been terminated.\r\n\r\nLogout messages for access, for example, can be displayed after authenticated sessions have been terminated. However, for some types of interactive sessions including, for example, remote login, information systems typically send logout messages as final messages prior to terminating sessions.\r\n\r\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002364</ident><fixtext fixref=\"F-102887r1_fix\">Configure the VPN Client to display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.</fixtext><fix id=\"F-102887r1_fix\" /><check system=\"C-96043r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Client displays an explicit logout message to users indicating the reliable termination of authenticated communications sessions.\r\n\r\nIf the VPN Client does not display an explicit logout message to users indicating the reliable termination of authenticated communications sessions, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97207\"><title>SRG-NET-000522-VPN-002320</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106345r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000522-VPN-002320</version><title>For site-to-site VPN Gateway must store only cryptographic representations of Pre-shared Keys (PSKs).</title><description>&lt;VulnDiscussion&gt;Pre-shared keys need to be protected at all times, and encryption is the standard method for protecting passwords. If PSKs are not encrypted, they can be plainly read and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\r\n\r\nPSKs used for site-to-site VPNs are considered by the SRG as a type of password. If this shared secret is already encrypted and not in plaintext, this meets this requirement. This requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption. This method uses a one-way hashing encryption algorithm with a salt value to validate a user's password without having to store the actual password. Performance and time required to access are factors that must be considered, and the one-way hash is the most feasible means of securing the password and providing an acceptable measure of password security.\r\n\r\nUse a keyed hash message authentication code (HMAC). HMAC calculates a message authentication code via a cryptographic hash function used in conjunction with an encryption key. The key must be protected as with any private key.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000196</ident><fixtext fixref=\"F-102889r1_fix\">Configure the VPN Gateway to store only cryptographic representations of the PSK.</fixtext><fix id=\"F-102889r1_fix\" /><check system=\"C-96045r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway stores only cryptographic representations of the PSK.\r\n\r\nIf the VPN Gateway does not store only cryptographic representations of the PSK, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97209\"><title>SRG-NET-000525-VPN-002330</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106347r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000525-VPN-002330</version><title>The IPsec VPN must use Advanced Encryption Standard (AES) encryption for the IPsec proposal to protect the confidentiality of remote access sessions.</title><description>&lt;VulnDiscussion&gt;Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\r\n\r\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\r\n\r\nA block cipher mode is an algorithm that features the use of a symmetric key block cipher algorithm to provide an information service, such as confidentiality or authentication.\r\n\r\nAES is the FIPS-validated cipher block cryptographic algorithm approved for use in DoD. For an algorithm implementation to be listed on a FIPS 140-2 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. Currently, NIST has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000068</ident><fixtext fixref=\"F-102891r1_fix\">Configure the IPsec Gateway to use AES for the IPsec proposal. The following example commands configure the IPsec (phase 2) proposals. The option may also be configured to use the aes-128-cbc, aes-192-cbc, or aes-256-cbc algorithms.</fixtext><fix id=\"F-102891r1_fix\" /><check system=\"C-96047r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify all Internet Key Exchange (IKE) proposals are set to use the AES encryption algorithm.\r\n\r\nView the value of the encryption algorithm for each defined proposal.\r\n\r\nIf the value of the encryption algorithm for any IPsec proposal is not set to use an AES algorithm, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97211\"><title>SRG-NET-000530-VPN-002340</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106349r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000530-VPN-002340</version><title>The TLS VPN Gateway that supports Government-only services must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.</title><description>&lt;VulnDiscussion&gt;Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\r\n\r\nThis requirement applies to TLS gateways (also known as SSL gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001453</ident><fixtext fixref=\"F-102893r1_fix\">Configure the TLS VPN Gateway that supports Government-only services to prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.</fixtext><fix id=\"F-102893r1_fix\" /><check system=\"C-96049r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the TLS VPN Gateway that supports Government-only services prohibits client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.\r\n\r\nIf the TLS VPN Gateway that supports Government-only services does not prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97213\"><title>SRG-NET-000540-VPN-002350</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106351r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000540-VPN-002350</version><title>The TLS VPN Gateway that supports citizen- or business-facing network devices must prohibit client negotiation to SSL 2.0 or SSL 3.0.</title><description>&lt;VulnDiscussion&gt;Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\r\n\r\nThis requirement applies to public-facing or external-facing devices such as TLS gateways (also known as SSL gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance.\r\n\r\nThe minimum TLS version required by DoD is 1.2. However, devices and applications may allow client negotiation for systems supporting citizen- and business-facing applications. These devices may be configured to support TLS version 1.1 and 1.0 to enable interaction with citizens and businesses. These devices must not support SSL version 3.0 or earlier.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001453</ident><fixtext fixref=\"F-102895r1_fix\">Configure the TLS VPN Gateway that supports citizen- or business-facing network devices to prohibit client negotiation to SSL 2.0 or SSL 3.0.</fixtext><fix id=\"F-102895r1_fix\" /><check system=\"C-96051r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the TLS VPN Gateway that supports citizen- or business-facing network devices prohibits client negotiation to SSL 2.0 or SSL 3.0.\r\n\r\nIf the TLS VPN Gateway that supports citizen- or business-facing network devices does not prohibit client negotiation to SSL 2.0 or SSL 3.0, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97215\"><title>SRG-NET-000550-VPN-002360</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106353r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000550-VPN-002360</version><title>The VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.</title><description>&lt;VulnDiscussion&gt;Without device-to-device authentication, communications with malicious devices may be established. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk.\r\n\r\nSNMPv3 supports authentication, authorization, access control, and privacy while previous versions of the protocol contained well-known security weaknesses, which were easily exploited. SNMPv3 can be configured for identification and bidirectional, cryptographically based authentication.\r\n\r\nA typical SNMP implementation includes three components: Managed device, SNMP agent, and NMS. The SNMP agent is the SNMP process that resides on the managed device and communicates with the network management system. The NMS is a combination of hardware and software that is used to monitor and administer a network. The SNMP data is stored in a highly-structured, hierarchical format known as a management information base (MIB). The SNMP manager collects information about network connectivity, activity, and events by polling managed devices.\r\n\r\nSNMPv3 defines a user-based security model (USM), and a view-based access control model (VACM). SNMPv3 USM provides data integrity, data origin authentication, message replay protection, and protection against disclosure of the message payload. SNMPv3 VACM provides access control to determine whether a specific type of access (read or write) to the management information is allowed. Implement both VACM and USM for full protection.\r\n\r\nSNMPv3 server services must not be configured on products whose primary purpose is not to provide SNMP services. SNMP client services may be configured on the VPN gateway, application, or operating system to allow limited monitoring or querying of the device from by an SNMP server for management purposes. SNMP of any version will not be used to make configuration changes to the device. SNMPv3 must be disabled by default and enabled only if used. SNMP v3 provides security feature enhancements to SNMP, including encryption and message authentication.\r\n\r\nCurrently, the AES cipher block algorithm can be used for both applying cryptographic protection (e.g., encryption) and removing or verifying the protection that was previously applied (e.g., decryption) in DoD. The use of FIPS-approved algorithms for both cryptographic mechanisms is required. If any version of SNMP is used for remote administration, default SNMP community strings such as “public” and “private” should be removed before real community strings are put into place. If the defaults are not removed, an attacker could retrieve real community strings from the device using the default string.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001967</ident><fixtext fixref=\"F-102897r1_fix\">The VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.</fixtext><fix id=\"F-102897r1_fix\" /><check system=\"C-96053r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) is configured to use SNMPv3 to use FIPS-validated AES cipher block algorithm.\r\n\r\nIf the VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) does not configure SNMPv3 to use FIPS-validated AES cipher block algorithm, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97217\"><title>SRG-NET-000565-VPN-002390</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106355r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000565-VPN-002390</version><title>The VPN Gateway must use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.</title><description>&lt;VulnDiscussion&gt;Use of improperly configured or lower assurance equipment and solutions could compromise high-value information.\r\n\r\nThe National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by the National Institute of Standards and Technology (NIST) and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future Suite B implementations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002450</ident><fixtext fixref=\"F-102899r1_fix\">Configure the VPN Gateway to use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.</fixtext><fix id=\"F-102899r1_fix\" /><check system=\"C-96055r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.\r\n\r\nIf the VPN Gateway does not use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97219\"><title>SRG-NET-000565-VPN-002400</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106357r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000565-VPN-002400</version><title>The IPsec VPN Gateway Internet Key Exchange (IKE) must use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.</title><description>&lt;VulnDiscussion&gt;Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\r\n\r\nRFC 6379 Suite B Cryptographic Suites for IPsec defines four cryptographic user interface suites for deploying IPsec. Each suite provides choices for Encapsulating Security Payload (ESP) and IKE. The four suites are differentiated by the choice of IKE authentication and key exchange, cryptographic algorithm strengths, and whether ESP is to provide both confidentiality and integrity or integrity only. The suite names are based on the Advanced Encryption Standard (AES) mode and AES key length specified for ESP. Two suites are defined for transporting classified information up to SECRET level—one for both confidentiality and integrity and one for integrity only. There are also two suites defined for transporting classified information up to TOP SECRET level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002450</ident><fixtext fixref=\"F-102901r1_fix\">Configure the IPsec VPN Gateway Internet Key Exchange (IKE) to use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.</fixtext><fix id=\"F-102901r1_fix\" /><check system=\"C-96057r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway Internet Key Exchange (IKE) uses cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.\r\n\r\nIf the IPsec VPN Gateway Internet Key Exchange (IKE) does not use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97221\"><title>SRG-NET-000580-VPN-002410</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106359r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000580-VPN-002410</version><title>The VPN Gateway must validate certificates used for Transport Layer Security (TLS) functions by performing RFC 5280-compliant certification path validation.</title><description>&lt;VulnDiscussion&gt;A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate.\r\n\r\nCertification path validation includes checks such as certificate issuer trust, time validity, and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000185</ident><fixtext fixref=\"F-102903r1_fix\">Configure the VPN Gateway to validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.</fixtext><fix id=\"F-102903r1_fix\" /><check system=\"C-96059r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway validates TLS certificates by performing RFC 5280-compliant certification path validation.\r\n\r\nIf the VPN Gateway does not validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97223\"><title>SRG-NET-000585-VPN-002420</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106361r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000585-VPN-002420</version><title>The VPN Gateway must use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).</title><description>&lt;VulnDiscussion&gt;Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Use only SHA-2 for Digital signature generation applications and functions. SHA-2 is strongly preferred for use by DoD for non-signature generation functions.\r\n\r\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \r\n\r\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\r\n\r\nFor digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use only if needed for business critical applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000803</ident><fixtext fixref=\"F-102905r1_fix\">Configure the VPN Gateway to use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).</fixtext><fix id=\"F-102905r1_fix\" /><check system=\"C-96061r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).\r\n\r\nIf the VPN Gateway does not use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use), this is a finding.</check-content></check></Rule></Group><Group id=\"V-97225\"><title>SRG-NET-000075-VPN-000260</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106363r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000075-VPN-000260</version><title>If the site-to-site VPN implementation uses L2TP, L2TPv3 sessions must be authenticated prior to transporting traffic.</title><description>&lt;VulnDiscussion&gt;L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP tunnels can also carry IP packets that are very difficult to filter because of the additional encapsulation. Hence, it is imperative that L2TP sessions are authenticated prior to transporting traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000068</ident><fixtext fixref=\"F-102907r1_fix\">If the site-to-site VPN implementation uses L2TPv3, configure L2TPv3 sessions to authenticate the traffic before transit.</fixtext><fix id=\"F-102907r1_fix\" /><check system=\"C-96063r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>If L2TP communications protocol is not used, this is not applicable.\r\n\r\nVerify L2TPv3 sessions are configured to authenticate the traffic before transit. L2TPv3 sessions must be authenticated prior to transporting traffic.\r\n\r\nIf L2TPv3 sessions do not require authentication, this is a finding.</check-content></check></Rule></Group></Benchmark>"
  },
  {
    "path": "test/api/form-data-files/U_VPN_SRG_V1R1_Manual-xccdf-replace.xml",
    "content": "<?xml version=\"1.0\" encoding=\"utf-8\"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:cpe=\"http://cpe.mitre.org/language/2.0\" xmlns:xhtml=\"http://www.w3.org/1999/xhtml\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\" id=\"VPN_SRG_TEST\" xml:lang=\"en\" xsi:schemaLocation=\"http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd\" xmlns=\"http://checklists.nist.gov/xccdf/1.1\"><status date=\"2001-07-26\">accepted</status><title>Virtual Private Network (VPN) Security Requirements Guide - replaced</title><description>This description replaces the old description</description><notice id=\"terms-of-use\" xml:lang=\"en\"></notice><reference href=\"http://public.cyber.mil\"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id=\"release-info\">Release: 1 Benchmark Date: 19 Jul 2001</plain-text><version>1</version><Group id=\"V-97041\"><title>SRG-NET-000019-VPN-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106179r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000019-VPN-000040</version><title>This rule title has been replaced.</title><description>&lt;VulnDiscussion&gt;Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\r\n\r\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001414</ident><fixtext fixref=\"F-102721r1_fix\">Configure the VPN Gateway to ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies (e.g., IPsec policy configuration). Also, configure the VPN gateway to forward encapsulated or encrypted traffic received from other enclaves with different security policies to the perimeter firewall and IDPS before traffic is passed to the private network.</fixtext><fix id=\"F-102721r1_fix\" /><check system=\"C-95877r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway has an inbound and outbound traffic security policy which is in compliance with information flow control policies (e.g., IPsec policy configuration).\r\n\r\nReview network device configurations and topology diagrams. Verify encapsulated or encrypted traffic received from other enclaves with different security policies terminate at the perimeter for filtering and content inspection by a firewall and IDPS before gaining access to the private network.\r\n\r\nIf the VPN Gateway does not ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97043\"><title>SRG-NET-000041-VPN-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106181r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000041-VPN-000110</version><title>The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.</title><description>&lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\r\n\r\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\r\n\r\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\r\n\r\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n \r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\r\n\"I've read &amp; consent to terms in IS user agreem't.\"&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000048</ident><fixtext fixref=\"F-102723r1_fix\">Configure the Remote Access VPN to display the Standard Mandatory DoD Notice and Consent Banner in accordance with DoD policy before granting access to the device. Use the following verbiage for applications that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n\r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\"I've read &amp; consent to terms in IS user agreem't.\"</fixtext><fix id=\"F-102723r1_fix\" /><check system=\"C-95879r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>If the user/remote client connection banner is the same as the banner configured as part of the NDM SRG, then this is not applicable.\r\n\r\nDetermine if the network device is configured to present a DoD-approved banner that is formatted in accordance with DoD policy. \r\n\r\nIf the Remote Access VPN Gateway or VPN client does not display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network, this is a finding.</check-content></check></Rule></Group></Benchmark>"
  },
  {
    "path": "test/api/form-data-files/U_VPN_SRG_V1R1_Manual-xccdf.xml",
    "content": "<?xml version=\"1.0\" encoding=\"utf-8\"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:cpe=\"http://cpe.mitre.org/language/2.0\" xmlns:xhtml=\"http://www.w3.org/1999/xhtml\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\" id=\"VPN_SRG_TEST\" xml:lang=\"en\" xsi:schemaLocation=\"http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd\" xmlns=\"http://checklists.nist.gov/xccdf/1.1\"><status date=\"2019-07-26\">accepted</status><title>Virtual Private Network (VPN) Security Requirements Guide</title><description>This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id=\"terms-of-use\" xml:lang=\"en\"></notice><reference href=\"http://public.cyber.mil\"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id=\"release-info\">Release: 1 Benchmark Date: 19 Jul 2019</plain-text><version>1</version><Profile id=\"MAC-1_Classified\"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-97041\" selected=\"true\" /><select idref=\"V-97043\" selected=\"true\" /><select idref=\"V-97045\" selected=\"true\" /><select idref=\"V-97047\" selected=\"true\" /><select idref=\"V-97049\" selected=\"true\" /><select idref=\"V-97051\" selected=\"true\" /><select idref=\"V-97053\" selected=\"true\" /><select idref=\"V-97055\" selected=\"true\" /><select idref=\"V-97057\" selected=\"true\" /><select idref=\"V-97059\" selected=\"true\" /><select idref=\"V-97061\" selected=\"true\" /><select idref=\"V-97063\" selected=\"true\" /><select idref=\"V-97065\" selected=\"true\" /><select idref=\"V-97067\" selected=\"true\" /><select idref=\"V-97069\" selected=\"true\" /><select idref=\"V-97071\" selected=\"true\" /><select idref=\"V-97073\" selected=\"true\" /><select idref=\"V-97075\" selected=\"true\" /><select idref=\"V-97077\" selected=\"true\" /><select idref=\"V-97079\" selected=\"true\" /><select idref=\"V-97081\" selected=\"true\" /><select idref=\"V-97083\" selected=\"true\" /><select idref=\"V-97085\" selected=\"true\" /><select idref=\"V-97087\" selected=\"true\" /><select idref=\"V-97089\" selected=\"true\" /><select idref=\"V-97091\" selected=\"true\" /><select idref=\"V-97093\" selected=\"true\" /><select idref=\"V-97095\" selected=\"true\" /><select idref=\"V-97097\" selected=\"true\" /><select idref=\"V-97099\" selected=\"true\" /><select idref=\"V-97101\" selected=\"true\" /><select idref=\"V-97103\" selected=\"true\" /><select idref=\"V-97113\" selected=\"true\" /><select idref=\"V-97115\" selected=\"true\" /><select idref=\"V-97117\" selected=\"true\" /><select idref=\"V-97119\" selected=\"true\" /><select idref=\"V-97121\" selected=\"true\" /><select idref=\"V-97123\" selected=\"true\" /><select idref=\"V-97125\" selected=\"true\" /><select idref=\"V-97127\" selected=\"true\" /><select idref=\"V-97129\" selected=\"true\" /><select idref=\"V-97131\" selected=\"true\" /><select idref=\"V-97133\" selected=\"true\" /><select idref=\"V-97135\" selected=\"true\" /><select idref=\"V-97137\" selected=\"true\" /><select idref=\"V-97139\" selected=\"true\" /><select idref=\"V-97141\" selected=\"true\" /><select idref=\"V-97143\" selected=\"true\" /><select idref=\"V-97145\" selected=\"true\" /><select idref=\"V-97147\" selected=\"true\" /><select idref=\"V-97149\" selected=\"true\" /><select idref=\"V-97151\" selected=\"true\" /><select idref=\"V-97153\" selected=\"true\" /><select idref=\"V-97155\" selected=\"true\" /><select idref=\"V-97157\" selected=\"true\" /><select idref=\"V-97159\" selected=\"true\" /><select idref=\"V-97177\" selected=\"true\" /><select idref=\"V-97179\" selected=\"true\" /><select idref=\"V-97181\" selected=\"true\" /><select idref=\"V-97183\" selected=\"true\" /><select idref=\"V-97185\" selected=\"true\" /><select idref=\"V-97187\" selected=\"true\" /><select idref=\"V-97189\" selected=\"true\" /><select idref=\"V-97191\" selected=\"true\" /><select idref=\"V-97193\" selected=\"true\" /><select idref=\"V-97195\" selected=\"true\" /><select idref=\"V-97197\" selected=\"true\" /><select idref=\"V-97199\" selected=\"true\" /><select idref=\"V-97201\" selected=\"true\" /><select idref=\"V-97203\" selected=\"true\" /><select idref=\"V-97205\" selected=\"true\" /><select idref=\"V-97207\" selected=\"true\" /><select idref=\"V-97209\" selected=\"true\" /><select idref=\"V-97211\" selected=\"true\" /><select idref=\"V-97213\" selected=\"true\" /><select idref=\"V-97215\" selected=\"true\" /><select idref=\"V-97217\" selected=\"true\" /><select idref=\"V-97219\" selected=\"true\" /><select idref=\"V-97221\" selected=\"true\" /><select idref=\"V-97223\" selected=\"true\" /><select idref=\"V-97225\" selected=\"true\" /></Profile><Profile id=\"MAC-1_Public\"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-97041\" selected=\"true\" /><select idref=\"V-97043\" selected=\"true\" /><select idref=\"V-97045\" selected=\"true\" /><select idref=\"V-97047\" selected=\"true\" /><select idref=\"V-97049\" selected=\"true\" /><select idref=\"V-97051\" selected=\"true\" /><select idref=\"V-97053\" selected=\"true\" /><select idref=\"V-97055\" selected=\"true\" /><select idref=\"V-97057\" selected=\"true\" /><select idref=\"V-97059\" selected=\"true\" /><select idref=\"V-97061\" selected=\"true\" /><select idref=\"V-97063\" selected=\"true\" /><select idref=\"V-97065\" selected=\"true\" /><select idref=\"V-97067\" selected=\"true\" /><select idref=\"V-97069\" selected=\"true\" /><select idref=\"V-97071\" selected=\"true\" /><select idref=\"V-97073\" selected=\"true\" /><select idref=\"V-97075\" selected=\"true\" /><select idref=\"V-97077\" selected=\"true\" /><select idref=\"V-97079\" selected=\"true\" /><select idref=\"V-97081\" selected=\"true\" /><select idref=\"V-97083\" selected=\"true\" /><select idref=\"V-97085\" selected=\"true\" /><select idref=\"V-97087\" selected=\"true\" /><select idref=\"V-97089\" selected=\"true\" /><select idref=\"V-97091\" selected=\"true\" /><select idref=\"V-97093\" selected=\"true\" /><select idref=\"V-97095\" selected=\"true\" /><select idref=\"V-97097\" selected=\"true\" /><select idref=\"V-97099\" selected=\"true\" /><select idref=\"V-97101\" selected=\"true\" /><select idref=\"V-97103\" selected=\"true\" /><select idref=\"V-97113\" selected=\"true\" /><select idref=\"V-97115\" selected=\"true\" /><select idref=\"V-97117\" selected=\"true\" /><select idref=\"V-97119\" selected=\"true\" /><select idref=\"V-97121\" selected=\"true\" /><select idref=\"V-97123\" selected=\"true\" /><select idref=\"V-97125\" selected=\"true\" /><select idref=\"V-97127\" selected=\"true\" /><select idref=\"V-97129\" selected=\"true\" /><select idref=\"V-97131\" selected=\"true\" /><select idref=\"V-97133\" selected=\"true\" /><select idref=\"V-97135\" selected=\"true\" /><select idref=\"V-97137\" selected=\"true\" /><select idref=\"V-97139\" selected=\"true\" /><select idref=\"V-97141\" selected=\"true\" /><select idref=\"V-97143\" selected=\"true\" /><select idref=\"V-97145\" selected=\"true\" /><select idref=\"V-97147\" selected=\"true\" /><select idref=\"V-97149\" selected=\"true\" /><select idref=\"V-97151\" selected=\"true\" /><select idref=\"V-97153\" selected=\"true\" /><select idref=\"V-97155\" selected=\"true\" /><select idref=\"V-97157\" selected=\"true\" /><select idref=\"V-97159\" selected=\"true\" /><select idref=\"V-97177\" selected=\"true\" /><select idref=\"V-97179\" selected=\"true\" /><select idref=\"V-97181\" selected=\"true\" /><select idref=\"V-97183\" selected=\"true\" /><select idref=\"V-97185\" selected=\"true\" /><select idref=\"V-97187\" selected=\"true\" /><select idref=\"V-97189\" selected=\"true\" /><select idref=\"V-97191\" selected=\"true\" /><select idref=\"V-97193\" selected=\"true\" /><select idref=\"V-97195\" selected=\"true\" /><select idref=\"V-97197\" selected=\"true\" /><select idref=\"V-97199\" selected=\"true\" /><select idref=\"V-97201\" selected=\"true\" /><select idref=\"V-97203\" selected=\"true\" /><select idref=\"V-97205\" selected=\"true\" /><select idref=\"V-97207\" selected=\"true\" /><select idref=\"V-97209\" selected=\"true\" /><select idref=\"V-97211\" selected=\"true\" /><select idref=\"V-97213\" selected=\"true\" /><select idref=\"V-97215\" selected=\"true\" /><select idref=\"V-97217\" selected=\"true\" /><select idref=\"V-97219\" selected=\"true\" /><select idref=\"V-97221\" selected=\"true\" /><select idref=\"V-97223\" selected=\"true\" /><select idref=\"V-97225\" selected=\"true\" /></Profile><Profile id=\"MAC-1_Sensitive\"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-97041\" selected=\"true\" /><select idref=\"V-97043\" selected=\"true\" /><select idref=\"V-97045\" selected=\"true\" /><select idref=\"V-97047\" selected=\"true\" /><select idref=\"V-97049\" selected=\"true\" /><select idref=\"V-97051\" selected=\"true\" /><select idref=\"V-97053\" selected=\"true\" /><select idref=\"V-97055\" selected=\"true\" /><select idref=\"V-97057\" selected=\"true\" /><select idref=\"V-97059\" selected=\"true\" /><select idref=\"V-97061\" selected=\"true\" /><select idref=\"V-97063\" selected=\"true\" /><select idref=\"V-97065\" selected=\"true\" /><select idref=\"V-97067\" selected=\"true\" /><select idref=\"V-97069\" selected=\"true\" /><select idref=\"V-97071\" selected=\"true\" /><select idref=\"V-97073\" selected=\"true\" /><select idref=\"V-97075\" selected=\"true\" /><select idref=\"V-97077\" selected=\"true\" /><select idref=\"V-97079\" selected=\"true\" /><select idref=\"V-97081\" selected=\"true\" /><select idref=\"V-97083\" selected=\"true\" /><select idref=\"V-97085\" selected=\"true\" /><select idref=\"V-97087\" selected=\"true\" /><select idref=\"V-97089\" selected=\"true\" /><select idref=\"V-97091\" selected=\"true\" /><select idref=\"V-97093\" selected=\"true\" /><select idref=\"V-97095\" selected=\"true\" /><select idref=\"V-97097\" selected=\"true\" /><select idref=\"V-97099\" selected=\"true\" /><select idref=\"V-97101\" selected=\"true\" /><select idref=\"V-97103\" selected=\"true\" /><select idref=\"V-97113\" selected=\"true\" /><select idref=\"V-97115\" selected=\"true\" /><select idref=\"V-97117\" selected=\"true\" /><select idref=\"V-97119\" selected=\"true\" /><select idref=\"V-97121\" selected=\"true\" /><select idref=\"V-97123\" selected=\"true\" /><select idref=\"V-97125\" selected=\"true\" /><select idref=\"V-97127\" selected=\"true\" /><select idref=\"V-97129\" selected=\"true\" /><select idref=\"V-97131\" selected=\"true\" /><select idref=\"V-97133\" selected=\"true\" /><select idref=\"V-97135\" selected=\"true\" /><select idref=\"V-97137\" selected=\"true\" /><select idref=\"V-97139\" selected=\"true\" /><select idref=\"V-97141\" selected=\"true\" /><select idref=\"V-97143\" selected=\"true\" /><select idref=\"V-97145\" selected=\"true\" /><select idref=\"V-97147\" selected=\"true\" /><select idref=\"V-97149\" selected=\"true\" /><select idref=\"V-97151\" selected=\"true\" /><select idref=\"V-97153\" selected=\"true\" /><select idref=\"V-97155\" selected=\"true\" /><select idref=\"V-97157\" selected=\"true\" /><select idref=\"V-97159\" selected=\"true\" /><select idref=\"V-97177\" selected=\"true\" /><select idref=\"V-97179\" selected=\"true\" /><select idref=\"V-97181\" selected=\"true\" /><select idref=\"V-97183\" selected=\"true\" /><select idref=\"V-97185\" selected=\"true\" /><select idref=\"V-97187\" selected=\"true\" /><select idref=\"V-97189\" selected=\"true\" /><select idref=\"V-97191\" selected=\"true\" /><select idref=\"V-97193\" selected=\"true\" /><select idref=\"V-97195\" selected=\"true\" /><select idref=\"V-97197\" selected=\"true\" /><select idref=\"V-97199\" selected=\"true\" /><select idref=\"V-97201\" selected=\"true\" /><select idref=\"V-97203\" selected=\"true\" /><select idref=\"V-97205\" selected=\"true\" /><select idref=\"V-97207\" selected=\"true\" /><select idref=\"V-97209\" selected=\"true\" /><select idref=\"V-97211\" selected=\"true\" /><select idref=\"V-97213\" selected=\"true\" /><select idref=\"V-97215\" selected=\"true\" /><select idref=\"V-97217\" selected=\"true\" /><select idref=\"V-97219\" selected=\"true\" /><select idref=\"V-97221\" selected=\"true\" /><select idref=\"V-97223\" selected=\"true\" /><select idref=\"V-97225\" selected=\"true\" /></Profile><Profile id=\"MAC-2_Classified\"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-97041\" selected=\"true\" /><select idref=\"V-97043\" selected=\"true\" /><select idref=\"V-97045\" selected=\"true\" /><select idref=\"V-97047\" selected=\"true\" /><select idref=\"V-97049\" selected=\"true\" /><select idref=\"V-97051\" selected=\"true\" /><select idref=\"V-97053\" selected=\"true\" /><select idref=\"V-97055\" selected=\"true\" /><select idref=\"V-97057\" selected=\"true\" /><select idref=\"V-97059\" selected=\"true\" /><select idref=\"V-97061\" selected=\"true\" /><select idref=\"V-97063\" selected=\"true\" /><select idref=\"V-97065\" selected=\"true\" /><select idref=\"V-97067\" selected=\"true\" /><select idref=\"V-97069\" selected=\"true\" /><select idref=\"V-97071\" selected=\"true\" /><select idref=\"V-97073\" selected=\"true\" /><select idref=\"V-97075\" selected=\"true\" /><select idref=\"V-97077\" selected=\"true\" /><select idref=\"V-97079\" selected=\"true\" /><select idref=\"V-97081\" selected=\"true\" /><select idref=\"V-97083\" selected=\"true\" /><select idref=\"V-97085\" selected=\"true\" /><select idref=\"V-97087\" selected=\"true\" /><select idref=\"V-97089\" selected=\"true\" /><select idref=\"V-97091\" selected=\"true\" /><select idref=\"V-97093\" selected=\"true\" /><select idref=\"V-97095\" selected=\"true\" /><select idref=\"V-97097\" selected=\"true\" /><select idref=\"V-97099\" selected=\"true\" /><select idref=\"V-97101\" selected=\"true\" /><select idref=\"V-97103\" selected=\"true\" /><select idref=\"V-97113\" selected=\"true\" /><select idref=\"V-97115\" selected=\"true\" /><select idref=\"V-97117\" selected=\"true\" /><select idref=\"V-97119\" selected=\"true\" /><select idref=\"V-97121\" selected=\"true\" /><select idref=\"V-97123\" selected=\"true\" /><select idref=\"V-97125\" selected=\"true\" /><select idref=\"V-97127\" selected=\"true\" /><select idref=\"V-97129\" selected=\"true\" /><select idref=\"V-97131\" selected=\"true\" /><select idref=\"V-97133\" selected=\"true\" /><select idref=\"V-97135\" selected=\"true\" /><select idref=\"V-97137\" selected=\"true\" /><select idref=\"V-97139\" selected=\"true\" /><select idref=\"V-97141\" selected=\"true\" /><select idref=\"V-97143\" selected=\"true\" /><select idref=\"V-97145\" selected=\"true\" /><select idref=\"V-97147\" selected=\"true\" /><select idref=\"V-97149\" selected=\"true\" /><select idref=\"V-97151\" selected=\"true\" /><select idref=\"V-97153\" selected=\"true\" /><select idref=\"V-97155\" selected=\"true\" /><select idref=\"V-97157\" selected=\"true\" /><select idref=\"V-97159\" selected=\"true\" /><select idref=\"V-97177\" selected=\"true\" /><select idref=\"V-97179\" selected=\"true\" /><select idref=\"V-97181\" selected=\"true\" /><select idref=\"V-97183\" selected=\"true\" /><select idref=\"V-97185\" selected=\"true\" /><select idref=\"V-97187\" selected=\"true\" /><select idref=\"V-97189\" selected=\"true\" /><select idref=\"V-97191\" selected=\"true\" /><select idref=\"V-97193\" selected=\"true\" /><select idref=\"V-97195\" selected=\"true\" /><select idref=\"V-97197\" selected=\"true\" /><select idref=\"V-97199\" selected=\"true\" /><select idref=\"V-97201\" selected=\"true\" /><select idref=\"V-97203\" selected=\"true\" /><select idref=\"V-97205\" selected=\"true\" /><select idref=\"V-97207\" selected=\"true\" /><select idref=\"V-97209\" selected=\"true\" /><select idref=\"V-97211\" selected=\"true\" /><select idref=\"V-97213\" selected=\"true\" /><select idref=\"V-97215\" selected=\"true\" /><select idref=\"V-97217\" selected=\"true\" /><select idref=\"V-97219\" selected=\"true\" /><select idref=\"V-97221\" selected=\"true\" /><select idref=\"V-97223\" selected=\"true\" /><select idref=\"V-97225\" selected=\"true\" /></Profile><Profile id=\"MAC-2_Public\"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-97041\" selected=\"true\" /><select idref=\"V-97043\" selected=\"true\" /><select idref=\"V-97045\" selected=\"true\" /><select idref=\"V-97047\" selected=\"true\" /><select idref=\"V-97049\" selected=\"true\" /><select idref=\"V-97051\" selected=\"true\" /><select idref=\"V-97053\" selected=\"true\" /><select idref=\"V-97055\" selected=\"true\" /><select idref=\"V-97057\" selected=\"true\" /><select idref=\"V-97059\" selected=\"true\" /><select idref=\"V-97061\" selected=\"true\" /><select idref=\"V-97063\" selected=\"true\" /><select idref=\"V-97065\" selected=\"true\" /><select idref=\"V-97067\" selected=\"true\" /><select idref=\"V-97069\" selected=\"true\" /><select idref=\"V-97071\" selected=\"true\" /><select idref=\"V-97073\" selected=\"true\" /><select idref=\"V-97075\" selected=\"true\" /><select idref=\"V-97077\" selected=\"true\" /><select idref=\"V-97079\" selected=\"true\" /><select idref=\"V-97081\" selected=\"true\" /><select idref=\"V-97083\" selected=\"true\" /><select idref=\"V-97085\" selected=\"true\" /><select idref=\"V-97087\" selected=\"true\" /><select idref=\"V-97089\" selected=\"true\" /><select idref=\"V-97091\" selected=\"true\" /><select idref=\"V-97093\" selected=\"true\" /><select idref=\"V-97095\" selected=\"true\" /><select idref=\"V-97097\" selected=\"true\" /><select idref=\"V-97099\" selected=\"true\" /><select idref=\"V-97101\" selected=\"true\" /><select idref=\"V-97103\" selected=\"true\" /><select idref=\"V-97113\" selected=\"true\" /><select idref=\"V-97115\" selected=\"true\" /><select idref=\"V-97117\" selected=\"true\" /><select idref=\"V-97119\" selected=\"true\" /><select idref=\"V-97121\" selected=\"true\" /><select idref=\"V-97123\" selected=\"true\" /><select idref=\"V-97125\" selected=\"true\" /><select idref=\"V-97127\" selected=\"true\" /><select idref=\"V-97129\" selected=\"true\" /><select idref=\"V-97131\" selected=\"true\" /><select idref=\"V-97133\" selected=\"true\" /><select idref=\"V-97135\" selected=\"true\" /><select idref=\"V-97137\" selected=\"true\" /><select idref=\"V-97139\" selected=\"true\" /><select idref=\"V-97141\" selected=\"true\" /><select idref=\"V-97143\" selected=\"true\" /><select idref=\"V-97145\" selected=\"true\" /><select idref=\"V-97147\" selected=\"true\" /><select idref=\"V-97149\" selected=\"true\" /><select idref=\"V-97151\" selected=\"true\" /><select idref=\"V-97153\" selected=\"true\" /><select idref=\"V-97155\" selected=\"true\" /><select idref=\"V-97157\" selected=\"true\" /><select idref=\"V-97159\" selected=\"true\" /><select idref=\"V-97177\" selected=\"true\" /><select idref=\"V-97179\" selected=\"true\" /><select idref=\"V-97181\" selected=\"true\" /><select idref=\"V-97183\" selected=\"true\" /><select idref=\"V-97185\" selected=\"true\" /><select idref=\"V-97187\" selected=\"true\" /><select idref=\"V-97189\" selected=\"true\" /><select idref=\"V-97191\" selected=\"true\" /><select idref=\"V-97193\" selected=\"true\" /><select idref=\"V-97195\" selected=\"true\" /><select idref=\"V-97197\" selected=\"true\" /><select idref=\"V-97199\" selected=\"true\" /><select idref=\"V-97201\" selected=\"true\" /><select idref=\"V-97203\" selected=\"true\" /><select idref=\"V-97205\" selected=\"true\" /><select idref=\"V-97207\" selected=\"true\" /><select idref=\"V-97209\" selected=\"true\" /><select idref=\"V-97211\" selected=\"true\" /><select idref=\"V-97213\" selected=\"true\" /><select idref=\"V-97215\" selected=\"true\" /><select idref=\"V-97217\" selected=\"true\" /><select idref=\"V-97219\" selected=\"true\" /><select idref=\"V-97221\" selected=\"true\" /><select idref=\"V-97223\" selected=\"true\" /><select idref=\"V-97225\" selected=\"true\" /></Profile><Profile id=\"MAC-2_Sensitive\"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-97041\" selected=\"true\" /><select idref=\"V-97043\" selected=\"true\" /><select idref=\"V-97045\" selected=\"true\" /><select idref=\"V-97047\" selected=\"true\" /><select idref=\"V-97049\" selected=\"true\" /><select idref=\"V-97051\" selected=\"true\" /><select idref=\"V-97053\" selected=\"true\" /><select idref=\"V-97055\" selected=\"true\" /><select idref=\"V-97057\" selected=\"true\" /><select idref=\"V-97059\" selected=\"true\" /><select idref=\"V-97061\" selected=\"true\" /><select idref=\"V-97063\" selected=\"true\" /><select idref=\"V-97065\" selected=\"true\" /><select idref=\"V-97067\" selected=\"true\" /><select idref=\"V-97069\" selected=\"true\" /><select idref=\"V-97071\" selected=\"true\" /><select idref=\"V-97073\" selected=\"true\" /><select idref=\"V-97075\" selected=\"true\" /><select idref=\"V-97077\" selected=\"true\" /><select idref=\"V-97079\" selected=\"true\" /><select idref=\"V-97081\" selected=\"true\" /><select idref=\"V-97083\" selected=\"true\" /><select idref=\"V-97085\" selected=\"true\" /><select idref=\"V-97087\" selected=\"true\" /><select idref=\"V-97089\" selected=\"true\" /><select idref=\"V-97091\" selected=\"true\" /><select idref=\"V-97093\" selected=\"true\" /><select idref=\"V-97095\" selected=\"true\" /><select idref=\"V-97097\" selected=\"true\" /><select idref=\"V-97099\" selected=\"true\" /><select idref=\"V-97101\" selected=\"true\" /><select idref=\"V-97103\" selected=\"true\" /><select idref=\"V-97113\" selected=\"true\" /><select idref=\"V-97115\" selected=\"true\" /><select idref=\"V-97117\" selected=\"true\" /><select idref=\"V-97119\" selected=\"true\" /><select idref=\"V-97121\" selected=\"true\" /><select idref=\"V-97123\" selected=\"true\" /><select idref=\"V-97125\" selected=\"true\" /><select idref=\"V-97127\" selected=\"true\" /><select idref=\"V-97129\" selected=\"true\" /><select idref=\"V-97131\" selected=\"true\" /><select idref=\"V-97133\" selected=\"true\" /><select idref=\"V-97135\" selected=\"true\" /><select idref=\"V-97137\" selected=\"true\" /><select idref=\"V-97139\" selected=\"true\" /><select idref=\"V-97141\" selected=\"true\" /><select idref=\"V-97143\" selected=\"true\" /><select idref=\"V-97145\" selected=\"true\" /><select idref=\"V-97147\" selected=\"true\" /><select idref=\"V-97149\" selected=\"true\" /><select idref=\"V-97151\" selected=\"true\" /><select idref=\"V-97153\" selected=\"true\" /><select idref=\"V-97155\" selected=\"true\" /><select idref=\"V-97157\" selected=\"true\" /><select idref=\"V-97159\" selected=\"true\" /><select idref=\"V-97177\" selected=\"true\" /><select idref=\"V-97179\" selected=\"true\" /><select idref=\"V-97181\" selected=\"true\" /><select idref=\"V-97183\" selected=\"true\" /><select idref=\"V-97185\" selected=\"true\" /><select idref=\"V-97187\" selected=\"true\" /><select idref=\"V-97189\" selected=\"true\" /><select idref=\"V-97191\" selected=\"true\" /><select idref=\"V-97193\" selected=\"true\" /><select idref=\"V-97195\" selected=\"true\" /><select idref=\"V-97197\" selected=\"true\" /><select idref=\"V-97199\" selected=\"true\" /><select idref=\"V-97201\" selected=\"true\" /><select idref=\"V-97203\" selected=\"true\" /><select idref=\"V-97205\" selected=\"true\" /><select idref=\"V-97207\" selected=\"true\" /><select idref=\"V-97209\" selected=\"true\" /><select idref=\"V-97211\" selected=\"true\" /><select idref=\"V-97213\" selected=\"true\" /><select idref=\"V-97215\" selected=\"true\" /><select idref=\"V-97217\" selected=\"true\" /><select idref=\"V-97219\" selected=\"true\" /><select idref=\"V-97221\" selected=\"true\" /><select idref=\"V-97223\" selected=\"true\" /><select idref=\"V-97225\" selected=\"true\" /></Profile><Profile id=\"MAC-3_Classified\"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-97041\" selected=\"true\" /><select idref=\"V-97043\" selected=\"true\" /><select idref=\"V-97045\" selected=\"true\" /><select idref=\"V-97047\" selected=\"true\" /><select idref=\"V-97049\" selected=\"true\" /><select idref=\"V-97051\" selected=\"true\" /><select idref=\"V-97053\" selected=\"true\" /><select idref=\"V-97055\" selected=\"true\" /><select idref=\"V-97057\" selected=\"true\" /><select idref=\"V-97059\" selected=\"true\" /><select idref=\"V-97061\" selected=\"true\" /><select idref=\"V-97063\" selected=\"true\" /><select idref=\"V-97065\" selected=\"true\" /><select idref=\"V-97067\" selected=\"true\" /><select idref=\"V-97069\" selected=\"true\" /><select idref=\"V-97071\" selected=\"true\" /><select idref=\"V-97073\" selected=\"true\" /><select idref=\"V-97075\" selected=\"true\" /><select idref=\"V-97077\" selected=\"true\" /><select idref=\"V-97079\" selected=\"true\" /><select idref=\"V-97081\" selected=\"true\" /><select idref=\"V-97083\" selected=\"true\" /><select idref=\"V-97085\" selected=\"true\" /><select idref=\"V-97087\" selected=\"true\" /><select idref=\"V-97089\" selected=\"true\" /><select idref=\"V-97091\" selected=\"true\" /><select idref=\"V-97093\" selected=\"true\" /><select idref=\"V-97095\" selected=\"true\" /><select idref=\"V-97097\" selected=\"true\" /><select idref=\"V-97099\" selected=\"true\" /><select idref=\"V-97101\" selected=\"true\" /><select idref=\"V-97103\" selected=\"true\" /><select idref=\"V-97113\" selected=\"true\" /><select idref=\"V-97115\" selected=\"true\" /><select idref=\"V-97117\" selected=\"true\" /><select idref=\"V-97119\" selected=\"true\" /><select idref=\"V-97121\" selected=\"true\" /><select idref=\"V-97123\" selected=\"true\" /><select idref=\"V-97125\" selected=\"true\" /><select idref=\"V-97127\" selected=\"true\" /><select idref=\"V-97129\" selected=\"true\" /><select idref=\"V-97131\" selected=\"true\" /><select idref=\"V-97133\" selected=\"true\" /><select idref=\"V-97135\" selected=\"true\" /><select idref=\"V-97137\" selected=\"true\" /><select idref=\"V-97139\" selected=\"true\" /><select idref=\"V-97141\" selected=\"true\" /><select idref=\"V-97143\" selected=\"true\" /><select idref=\"V-97145\" selected=\"true\" /><select idref=\"V-97147\" selected=\"true\" /><select idref=\"V-97149\" selected=\"true\" /><select idref=\"V-97151\" selected=\"true\" /><select idref=\"V-97153\" selected=\"true\" /><select idref=\"V-97155\" selected=\"true\" /><select idref=\"V-97157\" selected=\"true\" /><select idref=\"V-97159\" selected=\"true\" /><select idref=\"V-97177\" selected=\"true\" /><select idref=\"V-97179\" selected=\"true\" /><select idref=\"V-97181\" selected=\"true\" /><select idref=\"V-97183\" selected=\"true\" /><select idref=\"V-97185\" selected=\"true\" /><select idref=\"V-97187\" selected=\"true\" /><select idref=\"V-97189\" selected=\"true\" /><select idref=\"V-97191\" selected=\"true\" /><select idref=\"V-97193\" selected=\"true\" /><select idref=\"V-97195\" selected=\"true\" /><select idref=\"V-97197\" selected=\"true\" /><select idref=\"V-97199\" selected=\"true\" /><select idref=\"V-97201\" selected=\"true\" /><select idref=\"V-97203\" selected=\"true\" /><select idref=\"V-97205\" selected=\"true\" /><select idref=\"V-97207\" selected=\"true\" /><select idref=\"V-97209\" selected=\"true\" /><select idref=\"V-97211\" selected=\"true\" /><select idref=\"V-97213\" selected=\"true\" /><select idref=\"V-97215\" selected=\"true\" /><select idref=\"V-97217\" selected=\"true\" /><select idref=\"V-97219\" selected=\"true\" /><select idref=\"V-97221\" selected=\"true\" /><select idref=\"V-97223\" selected=\"true\" /><select idref=\"V-97225\" selected=\"true\" /></Profile><Profile id=\"MAC-3_Public\"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-97041\" selected=\"true\" /><select idref=\"V-97043\" selected=\"true\" /><select idref=\"V-97045\" selected=\"true\" /><select idref=\"V-97047\" selected=\"true\" /><select idref=\"V-97049\" selected=\"true\" /><select idref=\"V-97051\" selected=\"true\" /><select idref=\"V-97053\" selected=\"true\" /><select idref=\"V-97055\" selected=\"true\" /><select idref=\"V-97057\" selected=\"true\" /><select idref=\"V-97059\" selected=\"true\" /><select idref=\"V-97061\" selected=\"true\" /><select idref=\"V-97063\" selected=\"true\" /><select idref=\"V-97065\" selected=\"true\" /><select idref=\"V-97067\" selected=\"true\" /><select idref=\"V-97069\" selected=\"true\" /><select idref=\"V-97071\" selected=\"true\" /><select idref=\"V-97073\" selected=\"true\" /><select idref=\"V-97075\" selected=\"true\" /><select idref=\"V-97077\" selected=\"true\" /><select idref=\"V-97079\" selected=\"true\" /><select idref=\"V-97081\" selected=\"true\" /><select idref=\"V-97083\" selected=\"true\" /><select idref=\"V-97085\" selected=\"true\" /><select idref=\"V-97087\" selected=\"true\" /><select idref=\"V-97089\" selected=\"true\" /><select idref=\"V-97091\" selected=\"true\" /><select idref=\"V-97093\" selected=\"true\" /><select idref=\"V-97095\" selected=\"true\" /><select idref=\"V-97097\" selected=\"true\" /><select idref=\"V-97099\" selected=\"true\" /><select idref=\"V-97101\" selected=\"true\" /><select idref=\"V-97103\" selected=\"true\" /><select idref=\"V-97113\" selected=\"true\" /><select idref=\"V-97115\" selected=\"true\" /><select idref=\"V-97117\" selected=\"true\" /><select idref=\"V-97119\" selected=\"true\" /><select idref=\"V-97121\" selected=\"true\" /><select idref=\"V-97123\" selected=\"true\" /><select idref=\"V-97125\" selected=\"true\" /><select idref=\"V-97127\" selected=\"true\" /><select idref=\"V-97129\" selected=\"true\" /><select idref=\"V-97131\" selected=\"true\" /><select idref=\"V-97133\" selected=\"true\" /><select idref=\"V-97135\" selected=\"true\" /><select idref=\"V-97137\" selected=\"true\" /><select idref=\"V-97139\" selected=\"true\" /><select idref=\"V-97141\" selected=\"true\" /><select idref=\"V-97143\" selected=\"true\" /><select idref=\"V-97145\" selected=\"true\" /><select idref=\"V-97147\" selected=\"true\" /><select idref=\"V-97149\" selected=\"true\" /><select idref=\"V-97151\" selected=\"true\" /><select idref=\"V-97153\" selected=\"true\" /><select idref=\"V-97155\" selected=\"true\" /><select idref=\"V-97157\" selected=\"true\" /><select idref=\"V-97159\" selected=\"true\" /><select idref=\"V-97177\" selected=\"true\" /><select idref=\"V-97179\" selected=\"true\" /><select idref=\"V-97181\" selected=\"true\" /><select idref=\"V-97183\" selected=\"true\" /><select idref=\"V-97185\" selected=\"true\" /><select idref=\"V-97187\" selected=\"true\" /><select idref=\"V-97189\" selected=\"true\" /><select idref=\"V-97191\" selected=\"true\" /><select idref=\"V-97193\" selected=\"true\" /><select idref=\"V-97195\" selected=\"true\" /><select idref=\"V-97197\" selected=\"true\" /><select idref=\"V-97199\" selected=\"true\" /><select idref=\"V-97201\" selected=\"true\" /><select idref=\"V-97203\" selected=\"true\" /><select idref=\"V-97205\" selected=\"true\" /><select idref=\"V-97207\" selected=\"true\" /><select idref=\"V-97209\" selected=\"true\" /><select idref=\"V-97211\" selected=\"true\" /><select idref=\"V-97213\" selected=\"true\" /><select idref=\"V-97215\" selected=\"true\" /><select idref=\"V-97217\" selected=\"true\" /><select idref=\"V-97219\" selected=\"true\" /><select idref=\"V-97221\" selected=\"true\" /><select idref=\"V-97223\" selected=\"true\" /><select idref=\"V-97225\" selected=\"true\" /></Profile><Profile id=\"MAC-3_Sensitive\"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref=\"V-97041\" selected=\"true\" /><select idref=\"V-97043\" selected=\"true\" /><select idref=\"V-97045\" selected=\"true\" /><select idref=\"V-97047\" selected=\"true\" /><select idref=\"V-97049\" selected=\"true\" /><select idref=\"V-97051\" selected=\"true\" /><select idref=\"V-97053\" selected=\"true\" /><select idref=\"V-97055\" selected=\"true\" /><select idref=\"V-97057\" selected=\"true\" /><select idref=\"V-97059\" selected=\"true\" /><select idref=\"V-97061\" selected=\"true\" /><select idref=\"V-97063\" selected=\"true\" /><select idref=\"V-97065\" selected=\"true\" /><select idref=\"V-97067\" selected=\"true\" /><select idref=\"V-97069\" selected=\"true\" /><select idref=\"V-97071\" selected=\"true\" /><select idref=\"V-97073\" selected=\"true\" /><select idref=\"V-97075\" selected=\"true\" /><select idref=\"V-97077\" selected=\"true\" /><select idref=\"V-97079\" selected=\"true\" /><select idref=\"V-97081\" selected=\"true\" /><select idref=\"V-97083\" selected=\"true\" /><select idref=\"V-97085\" selected=\"true\" /><select idref=\"V-97087\" selected=\"true\" /><select idref=\"V-97089\" selected=\"true\" /><select idref=\"V-97091\" selected=\"true\" /><select idref=\"V-97093\" selected=\"true\" /><select idref=\"V-97095\" selected=\"true\" /><select idref=\"V-97097\" selected=\"true\" /><select idref=\"V-97099\" selected=\"true\" /><select idref=\"V-97101\" selected=\"true\" /><select idref=\"V-97103\" selected=\"true\" /><select idref=\"V-97113\" selected=\"true\" /><select idref=\"V-97115\" selected=\"true\" /><select idref=\"V-97117\" selected=\"true\" /><select idref=\"V-97119\" selected=\"true\" /><select idref=\"V-97121\" selected=\"true\" /><select idref=\"V-97123\" selected=\"true\" /><select idref=\"V-97125\" selected=\"true\" /><select idref=\"V-97127\" selected=\"true\" /><select idref=\"V-97129\" selected=\"true\" /><select idref=\"V-97131\" selected=\"true\" /><select idref=\"V-97133\" selected=\"true\" /><select idref=\"V-97135\" selected=\"true\" /><select idref=\"V-97137\" selected=\"true\" /><select idref=\"V-97139\" selected=\"true\" /><select idref=\"V-97141\" selected=\"true\" /><select idref=\"V-97143\" selected=\"true\" /><select idref=\"V-97145\" selected=\"true\" /><select idref=\"V-97147\" selected=\"true\" /><select idref=\"V-97149\" selected=\"true\" /><select idref=\"V-97151\" selected=\"true\" /><select idref=\"V-97153\" selected=\"true\" /><select idref=\"V-97155\" selected=\"true\" /><select idref=\"V-97157\" selected=\"true\" /><select idref=\"V-97159\" selected=\"true\" /><select idref=\"V-97177\" selected=\"true\" /><select idref=\"V-97179\" selected=\"true\" /><select idref=\"V-97181\" selected=\"true\" /><select idref=\"V-97183\" selected=\"true\" /><select idref=\"V-97185\" selected=\"true\" /><select idref=\"V-97187\" selected=\"true\" /><select idref=\"V-97189\" selected=\"true\" /><select idref=\"V-97191\" selected=\"true\" /><select idref=\"V-97193\" selected=\"true\" /><select idref=\"V-97195\" selected=\"true\" /><select idref=\"V-97197\" selected=\"true\" /><select idref=\"V-97199\" selected=\"true\" /><select idref=\"V-97201\" selected=\"true\" /><select idref=\"V-97203\" selected=\"true\" /><select idref=\"V-97205\" selected=\"true\" /><select idref=\"V-97207\" selected=\"true\" /><select idref=\"V-97209\" selected=\"true\" /><select idref=\"V-97211\" selected=\"true\" /><select idref=\"V-97213\" selected=\"true\" /><select idref=\"V-97215\" selected=\"true\" /><select idref=\"V-97217\" selected=\"true\" /><select idref=\"V-97219\" selected=\"true\" /><select idref=\"V-97221\" selected=\"true\" /><select idref=\"V-97223\" selected=\"true\" /><select idref=\"V-97225\" selected=\"true\" /></Profile><Group id=\"V-97041\"><title>SRG-NET-000019-VPN-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106179r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000019-VPN-000040</version><title>The VPN Gateway must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.</title><description>&lt;VulnDiscussion&gt;Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\r\n\r\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001414</ident><fixtext fixref=\"F-102721r1_fix\">Configure the VPN Gateway to ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies (e.g., IPsec policy configuration). Also, configure the VPN gateway to forward encapsulated or encrypted traffic received from other enclaves with different security policies to the perimeter firewall and IDPS before traffic is passed to the private network.</fixtext><fix id=\"F-102721r1_fix\" /><check system=\"C-95877r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway has an inbound and outbound traffic security policy which is in compliance with information flow control policies (e.g., IPsec policy configuration).\r\n\r\nReview network device configurations and topology diagrams. Verify encapsulated or encrypted traffic received from other enclaves with different security policies terminate at the perimeter for filtering and content inspection by a firewall and IDPS before gaining access to the private network.\r\n\r\nIf the VPN Gateway does not ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97043\"><title>SRG-NET-000041-VPN-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106181r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000041-VPN-000110</version><title>The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.</title><description>&lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\r\n\r\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\r\n\r\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\r\n\r\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n \r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\r\n\"I've read &amp; consent to terms in IS user agreem't.\"&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000048</ident><fixtext fixref=\"F-102723r1_fix\">Configure the Remote Access VPN to display the Standard Mandatory DoD Notice and Consent Banner in accordance with DoD policy before granting access to the device. Use the following verbiage for applications that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n\r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\"I've read &amp; consent to terms in IS user agreem't.\"</fixtext><fix id=\"F-102723r1_fix\" /><check system=\"C-95879r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>If the user/remote client connection banner is the same as the banner configured as part of the NDM SRG, then this is not applicable.\r\n\r\nDetermine if the network device is configured to present a DoD-approved banner that is formatted in accordance with DoD policy. \r\n\r\nIf the Remote Access VPN Gateway or VPN client does not display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97045\"><title>SRG-NET-000042-VPN-000120</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106183r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000042-VPN-000120</version><title>The Remote Access VPN Gateway and/or client must enforce a policy to retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.</title><description>&lt;VulnDiscussion&gt;The banner must be acknowledged by the user prior to allowing the user access to the network. This provides assurance that the user has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the user, DoD will not be in compliance with system use notifications required by law. \r\n\r\nThe banner is usually configured in NDM for client presentation as well as local logon.\r\n\r\nTo establish acceptance of the application usage policy, a click-through banner at application logon is required. The VPN gateway must prevent further activity until the user executes a positive action to manifest agreement by clicking on a box indicating \"OK\". \r\n\r\nThis applies to gateways that have the concept of a user account and have the login function residing on the gateway or the gateway acts as a user intermediary.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000050</ident><fixtext fixref=\"F-102725r1_fix\">Configure the Remote Access VPN Gateway and/or client to retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.</fixtext><fix id=\"F-102725r1_fix\" /><check system=\"C-95881r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>If the user/remote client connection banner is the same as the banner configured as part of the NDM SRG, then this is not applicable.\r\n\r\nVerify the ALG retains the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and takes explicit actions to log on for further access.\r\n\r\nIf the Remote Access VPN Gateway and/or client does not retain the Standard Mandatory DoD-approved Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97047\"><title>SRG-NET-000043-VPN-000130</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106185r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000043-VPN-000130</version><title>The publicly accessible VPN Gateway must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.</title><description>&lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the publicly accessible VPN gateway ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\r\n\r\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\r\n\r\nThe banner must be formatted in accordance with DTM-08-060. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n\r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\r\n\"I've read &amp; consent to terms in IS user agreem't.\"&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001384</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001385</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001386</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001387</ident><ident system=\"http://iase.disa.mil/cci\">CCI-001388</ident><fixtext fixref=\"F-102727r1_fix\">Configure the publicly accessible VPN Gateway to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.</fixtext><fix id=\"F-102727r1_fix\" /><check system=\"C-95883r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the publicly accessible VPN Gateway displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.  The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for network elements that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n\r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\r\n\"I've read &amp; consent to terms in IS user agreem't.\"\r\n\r\nIf the publicly accessible VPN Gateway does not display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97049\"><title>SRG-NET-000049-VPN-000150</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106187r1_rule\" severity=\"low\" weight=\"10.0\"><version>SRG-NET-000049-VPN-000150</version><title>The VPN Gateway must notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access).</title><description>&lt;VulnDiscussion&gt;Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the number of unsuccessful attempts that were made to login to their account allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators.\r\n\r\nThis applies to gateways that have the concept of a user account and have the login function residing on the gateway or the gateway acts as a user intermediary.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000053</ident><fixtext fixref=\"F-102729r1_fix\">Configure the VPN Gateway to notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access).</fixtext><fix id=\"F-102729r1_fix\" /><check system=\"C-95885r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Determine if the VPN Gateway is either configured to notify the administrator of the number of unsuccessful login attempts since the last successful login or configured to use an authentication server which would perform this function. If the administrator is not notified of the number of unsuccessful login attempts since the last successful login, this is a finding.\r\n\r\nIf the VPN Gateway does not notify the user, upon successful logon (access), of the number of unsuccessful logon (access) attempts since the last successful logon (access), this is a finding.</check-content></check></Rule></Group><Group id=\"V-97051\"><title>SRG-NET-000053-VPN-000170</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106189r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000053-VPN-000170</version><title>The VPN Gateway must limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number.</title><description>&lt;VulnDiscussion&gt;VPN gateway management includes the ability to control the number of users and user sessions that utilize a VPN gateway. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to DoS attacks.\r\n\r\nThis requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.\r\n\r\nThe intent of this policy is to ensure the number of concurrent sessions is deliberately set to a number based on the site's mission and not left unlimited.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000054</ident><fixtext fixref=\"F-102731r1_fix\">Configure the VPN Gateway to limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number, as documented in the SSP.</fixtext><fix id=\"F-102731r1_fix\" /><check system=\"C-95887r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Inspect the VPN Gateway configuration. Verify the number of concurrent sessions for user accounts to 1 or to an organization-defined number (defined in the SSP).\r\n\r\nIf the VPN Gateway does not limit the number of concurrent sessions for user accounts to 1 or to an organization-defined number, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97053\"><title>SRG-NET-000062-VPN-000200</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106191r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000062-VPN-000200</version><title>The TLS VPN Gateway must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during transmission.</title><description>&lt;VulnDiscussion&gt;Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\r\n\r\nNIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000068</ident><fixtext fixref=\"F-102733r1_fix\">Configure the TLS VPN Gateway to use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data for transmission.</fixtext><fix id=\"F-102733r1_fix\" /><check system=\"C-95889r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the TLS VPN Gateway is configured to use  TLS 1.2 or higher to protect the confidentiality of sensitive data during transmission.\r\n\r\nIf the TLS VPN Gateway does not use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during transmission, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97055\"><title>SRG-NET-000063-VPN-000210</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106193r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000063-VPN-000210</version><title>The remote access VPN Gateway must use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.</title><description>&lt;VulnDiscussion&gt;Without integrity protection, unauthorized changes may be made to the log files and reliable forensic analysis and discovery of the source of malicious system activity may be degraded.\r\n\r\nRemote access (e.g., RDP) is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless.\r\n\r\nIntegrity checks include cryptographic checksums, digital signatures, or hash functions. Federal Information Processing Standard (FIPS) 186-4, Digital Signature Standard (DSS), specifies three NIST-approved algorithms: DSA, RSA, and ECDSA. All three are used to generate and verify digital signatures in conjunction with an approved hash function.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001453</ident><fixtext fixref=\"F-102735r1_fix\">Configure the remote access VPN Gateway to use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.</fixtext><fix id=\"F-102735r1_fix\" /><check system=\"C-95891r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the remote access VPN Gateway uses a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions.\r\n\r\nIf the remote access VPN Gateway does not use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of remote access sessions, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97057\"><title>SRG-NET-000063-VPN-000220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106195r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000063-VPN-000220</version><title>The VPN Gateway must be configured to use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.</title><description>&lt;VulnDiscussion&gt;Without strong cryptographic integrity protections, information can be altered by unauthorized users without detection.\r\n\r\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \r\n\r\nThe remote access VPN provides access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001453</ident><fixtext fixref=\"F-102737r1_fix\">Configure the VPN Gateway to use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.</fixtext><fix id=\"F-102737r1_fix\" /><check system=\"C-95893r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions.\r\n\r\nIf the VPN Gateway does not use IPsec with SHA-1 or greater for hashing to protect the integrity of remote access sessions, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97059\"><title>SRG-NET-000074-VPN-000250</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106197r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000074-VPN-000250</version><title>The IPsec VPN must implement a FIPS 140-2 validated Diffie-Hellman (DH) group.</title><description>&lt;VulnDiscussion&gt;Use of an approved DH algorithm ensures the Internet Key Exchange (IKE) (phase 1) proposal uses FIPS-validated key management techniques and processes in the production, storage, and control of private/secret cryptographic keys. The security of the DH key exchange is based on the difficulty of solving the discrete logarithm in which the key was derived from. Hence, the larger the modulus, the more secure the generated key is considered to be.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000068</ident><fixtext fixref=\"F-102739r1_fix\">Configure the IPsec VPN to us the FIPS 140-2 DH group. The following command is an example of how to configure the IKE (phase 1) proposals. \r\n\r\nThe following groups are allowed for use in DoD: \r\nDH Groups 14 (2048-bit MODP) \r\n- 19 (256-bit Random ECP), 20 (384-bit Random ECP), 5 (1536-bit MODP), 24 (2048-bit MODP with 256-bit POS).</fixtext><fix id=\"F-102739r1_fix\" /><check system=\"C-95895r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify all IKE proposals are set to use a FIPS-validated dh-group.\r\n\r\nView the IKE options dh-group option.\r\n\r\nIf the IKE option is not set to a FIPS 140-2 validated dh-group, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97061\"><title>SRG-NET-000077-VPN-000280</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106199r1_rule\" severity=\"low\" weight=\"10.0\"><version>SRG-NET-000077-VPN-000280</version><title>The VPN Gateway must generate log records containing information to establish what type of events occurred.</title><description>&lt;VulnDiscussion&gt;Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.\r\n\r\nVPN gateways often have a separate audit log for capturing VPN status and other information about the traffic (as opposed to the log capturing administrative and configuration actions). Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.\r\n\r\nAssociating event types with detected events in the VPN gateway logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000130</ident><fixtext fixref=\"F-102743r1_fix\">Configure the VPN Gateway to generate log records containing information to establish what type of events occurred.</fixtext><fix id=\"F-102743r1_fix\" /><check system=\"C-95899r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway generates log records containing information to establish what type of events occurred.\r\n\r\nIf the VPN Gateway does not generate log records containing information to establish what type of events occurred, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97063\"><title>SRG-NET-000078-VPN-000290</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106201r1_rule\" severity=\"low\" weight=\"10.0\"><version>SRG-NET-000078-VPN-000290</version><title>The VPN Gateway must generate log records containing information to establish when (date and time) the events occurred.</title><description>&lt;VulnDiscussion&gt;Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\r\n\r\nVPN gateways often have a separate audit log for capturing VPN status and other information about the traffic (as opposed to the log capturing administrative and configuration actions).\r\n\r\nAssociating event types with detected events in the network audit logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000131</ident><fixtext fixref=\"F-102745r1_fix\">Configure the VPN Gateway to generate log records containing information to establish when (date and time) the events occurred.</fixtext><fix id=\"F-102745r1_fix\" /><check system=\"C-95901r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Configure the VPN Gateway generates log records containing information to establish when (date and time) the events occurred.\r\n\r\nIf the VPN Gateway does not generate log records containing information to establish when (date and time) the events occurred, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97065\"><title>SRG-NET-000079-VPN-000300</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106203r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000079-VPN-000300</version><title>The VPN Gateway must generate log records containing information that establishes the identity of any individual or process associated with the event.</title><description>&lt;VulnDiscussion&gt;Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001487</ident><fixtext fixref=\"F-102747r1_fix\">Configure the VPN Gateway to generate log records containing information that establishes the identity of any individual or process associated with the event.</fixtext><fix id=\"F-102747r1_fix\" /><check system=\"C-95903r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway generates log records containing information that establishes the identity of any individual or process associated with the event.\r\n\r\nIf the VPN Gateway does not generate log records containing information that establishes the identity of any individual or process associated with the event, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97067\"><title>SRG-NET-000088-VPN-000310</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106205r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000088-VPN-000310</version><title>The VPN Gateway must generate log records containing information to establish where the events occurred.</title><description>&lt;VulnDiscussion&gt;Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack.\r\n\r\nIn order to compile an accurate risk assessment, and provide forensic analysis, it is essential for security personnel to know where events occurred, such as VPN gateway components, modules, device identifiers, node names, and functionality.\r\n\r\nAssociating information about where the event occurred within the network provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured VPN gateway.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000132</ident><fixtext fixref=\"F-102749r1_fix\">Configure the VPN Gateway to generates log records containing information to establish where the events occurred.</fixtext><fix id=\"F-102749r1_fix\" /><check system=\"C-95905r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway generates  log records containing information to establish where the events occurred.\r\n\r\nIf the VPN Gateway does not generate log records containing information to establish where the events occurred, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97069\"><title>SRG-NET-000089-VPN-000330</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106207r1_rule\" severity=\"low\" weight=\"10.0\"><version>SRG-NET-000089-VPN-000330</version><title>The VPN Gateway must generate log records containing information to establish the source of the events.</title><description>&lt;VulnDiscussion&gt;Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event.\r\n\r\nIn addition to logging where events occur within the network, the log records must also identify sources of events such as IP addresses, processes, and node or device names.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000133</ident><fixtext fixref=\"F-102751r1_fix\">Configure the VPN Gateway to generate log records containing information to establish the source of the events.</fixtext><fix id=\"F-102751r1_fix\" /><check system=\"C-95907r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway  generates log records containing information to establish the source of the events.\r\n\r\nIf the VPN Gateway does not generate log records containing information to establish the source of the events, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97071\"><title>SRG-NET-000091-VPN-000350</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106209r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000091-VPN-000350</version><title>The VPN Gateway must produce log records containing information to establish the outcome of the events.</title><description>&lt;VulnDiscussion&gt;Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the network.\r\n\r\nEvent outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the network after the event occurred). As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000134</ident><fixtext fixref=\"F-102753r1_fix\">Configure the VPN Gateway to generate log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the client connection attempts.</fixtext><fix id=\"F-102753r1_fix\" /><check system=\"C-95909r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Examine the log configuration on the VPN Gateway or view several alert events on the organization's central audit server. Alternatively, examine the Central Log Server to see if it contains information about success or failure of client connection attempts or other events.\r\n\r\nIf the traffic log entries do not include the success or failure of connection attempts and other events, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97073\"><title>SRG-NET-000098-VPN-000370</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106211r1_rule\" severity=\"low\" weight=\"10.0\"><version>SRG-NET-000098-VPN-000370</version><title>The VPN Gateway must protect log information from unauthorized read access if all or some of this data is stored locally.</title><description>&lt;VulnDiscussion&gt;Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured VPN gateway. Thus, it is imperative that the collected log data from the various VPN gateways, as well as the auditing tools, be secured and can only be accessed by authorized personnel.\r\n\r\nThis requirement pertains to securing the VPN log as it is stored locally, on the box temporarily, or while being encapsulated.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000162</ident><fixtext fixref=\"F-102755r1_fix\">Configure the VPN Gateway to protect log information from unauthorized read access if all or some of this data is stored locally.</fixtext><fix id=\"F-102755r1_fix\" /><check system=\"C-95911r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway protects log information from unauthorized read access if all or some of this data is stored locally.\r\n\r\nIf the VPN Gateway does not protect log information from unauthorized read access if all or some of this data is stored locally, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97075\"><title>SRG-NET-000099-VPN-000380</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106213r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000099-VPN-000380</version><title>The VPN Gateway log must protect audit information from unauthorized modification when stored locally.</title><description>&lt;VulnDiscussion&gt;If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\r\n\r\nThis requirement pertains to securing the VPN log as it is stored locally, on the box temporarily, or while being encapsulated.\r\n\r\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\r\n\r\nAudit information includes all information (e.g., log records, audit settings, and audit reports) needed to successfully audit information system activity.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000163</ident><fixtext fixref=\"F-102757r1_fix\">Configure the VPN Gateway log to protect audit information from unauthorized modification when stored locally. The method used depends on system architecture and design. Examples: ensuring log files receive the proper file system permissions and limiting log data locations.</fixtext><fix id=\"F-102757r1_fix\" /><check system=\"C-95913r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway log is configured to protect audit information from unauthorized modification when stored locally.\r\n\r\nThe VPN Gateway log must protect audit information from unauthorized modification when stored locally, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97077\"><title>SRG-NET-000100-VPN-000390</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106215r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000100-VPN-000390</version><title>The VPN Gateway must protect audit information from unauthorized deletion when stored locally.</title><description>&lt;VulnDiscussion&gt;If audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\r\n\r\nTo ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification.\r\n\r\nThis requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions, and limiting log data locations.\r\n\r\nAudit information includes all information (e.g., log records, audit settings, and audit reports) needed to successfully audit information system activity.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000164</ident><fixtext fixref=\"F-102759r1_fix\">Configure the VPN Gateway to protect audit information from unauthorized deletion when stored locally. Ensure log files receive the proper file system permissions and limiting log data locations.</fixtext><fix id=\"F-102759r1_fix\" /><check system=\"C-95915r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway is configured to protect audit information from unauthorized deletion when stored locally.\r\n\r\nIf the VPN Gateway does not protect audit information from unauthorized deletion when stored locally, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97079\"><title>SRG-NET-000132-VPN-000450</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106217r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000132-VPN-000450</version><title>The VPN Gateway must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.</title><description>&lt;VulnDiscussion&gt;In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\r\n\r\nDoD continually assesses the ports, protocols, and services that can be used for network communications. Some protocols or services have known exploits or security weaknesses. Network traffic using these ports, protocols, and services must be prohibited or restricted in accordance with DoD policy. The PPSM CAL and vulnerability assessments provide an authoritative source for ports, protocols, and services that are unauthorized or restricted across boundaries on DoD networks.\r\n\r\nThe VPN Gateway must be configured to prevent or restrict the use of prohibited ports, protocols, and services throughout the network by filtering the network traffic and disallowing or redirecting traffic as necessary. Default and updated policy filters from the vendors will disallow older version of protocols and applications and will address most known non-secure ports, protocols, and/or services.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000382</ident><fixtext fixref=\"F-102761r1_fix\">Ensure functions, ports, protocols, and services identified on the PPSM CAL are not used for system services configuration.\r\n\r\nView the configured security  services.\r\n\r\nCompare the services that are enabled, including the port, services, protocols, and functions.\r\n\r\nConsult the product knowledge base and configuration guides to determine the commands for disabling each port, protocols, services, or functions that is not in compliance with the PPSM CAL and vulnerability assessments.</fixtext><fix id=\"F-102761r1_fix\" /><check system=\"C-95917r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>View the configured security  services.\r\n\r\nCompare the services that are enabled, including the port, services, protocols, and functions.\r\n\r\nIf functions, ports, protocols, and services identified on the PPSM CAL are not disabled, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97081\"><title>SRG-NET-000132-VPN-000460</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106219r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000132-VPN-000460</version><title>The IPsec VPN Gateway must use IKEv2 for IPsec VPN security associations.</title><description>&lt;VulnDiscussion&gt;In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\r\n\r\nUse of IKEv2 leverages DoS protections because of improved bandwidth management and leverages more secure encryption algorithms.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000382</ident><fixtext fixref=\"F-102763r1_fix\">Configure the IPsec VPN Gateway to use IKEv2 for IPsec VPN security associations.</fixtext><fix id=\"F-102763r1_fix\" /><check system=\"C-95919r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway uses IKEv2 for IPsec VPN security associations.\r\n\r\nIf the IPsec VPN Gateway must use IKEv2 for IPsec VPN security associations, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97083\"><title>SRG-NET-000132-VPN-000470</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106221r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000132-VPN-000470</version><title>The Remote Access VPN Gateway must be configured to prohibit Point-to-Point Tunneling Protocol (PPTP) and L2F.</title><description>&lt;VulnDiscussion&gt;The PPTP and L2F are obsolete method for implementing virtual private networks. Both protocols may be easy to use and readily available, but they have many well-known security issues and exploits. Encryption and authentication are both weak.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000382</ident><fixtext fixref=\"F-102765r1_fix\">Configure the VPN Gateway to prohibit PPTP and L2F.</fixtext><fix id=\"F-102765r1_fix\" /><check system=\"C-95921r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway is configured to prohibit PPTP and L2F.\r\n\r\nIf the VPN Gateway does not be configured to prohibit PPTP and L2F, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97085\"><title>SRG-NET-000132-VPN-000480</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106223r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000132-VPN-000480</version><title>For site-to-site VPN implementations, the  L2TP protocol must be blocked or denied at the security boundary with the private network so unencrypted L2TP packets cannot traverse into the private network of the enclave.</title><description>&lt;VulnDiscussion&gt;Unlike GRE (a simple encapsulating header) L2TP is a full-fledged communications protocol with control channel, data channels, and a robust command structure. In addition to PPP, other link layer types (called pseudowires) can be and are defined for delivery in L2TP by separate RFC documents. Further complexity is created by the capability to define vender-specific parameters beyond those defined in the L2TP specifications.\r\n\r\nThe endpoint devices of an L2TP connection can be an L2TP Access Concentrator (LAC) in which case it inputs/outputs the layer 2 protocol to/from the L2TP tunnel. Otherwise, it is an L2TP Network Server (LNS), in which case it inputs/outputs the layer 3 (IP) protocol to/from the L2TP tunnel. The specifications describe three reference models: LAC-LNS, LAC-LAC, and LNS-LNS, the first of which is the most common case. The LAC-LNS model allows a remote access user to reach his home network or ISP from a remote location. The remote access user connects to  a LAC device which tunnels his connection home to an awaiting LNS. The LAC could also be located on the remote user's laptop, which connects to an LNS at home using some generic internet connection. The other reference models may be used for more obscure scenarios.\r\n\r\nAlthough the L2TP protocol does not contain encryption capability, it can be operated over IPsec, which would provide authentication and confidentiality. A remote user in the LAC-LNS model would most likely obtain a dynamically assigned IP address from the home network to ultimately use through the tunnel back to the home network. Secondly, the outer IP source address used to send the L2TP tunnel packet to the home network is likely to be unknown or highly variable. Thirdly, since the LNS provides the remote user with a dynamic IP address to use, the firewall at the home network would have to be dynamically updated to accept this address in conjunction with the outer tunnel address. Finally, there is also the issue of authentication of the remote user prior to divulging an acceptable IP address. Because of all of these complications, the strict filtering rules applied to the IP-in-IP and GRE tunneling cases will likely not be possible in the L2TP scenario.\r\n\r\nIn addition to the difficulty of enforcing addresses and endpoints (as explained above), the L2TP protocol itself is a security concern if allowed through a security boundary. In particular:\r\n\r\n1) L2TP potentially allows link layer protocols to be delivered from afar. These protocols were intended for link-local scope only, are less defended, and not as well-known,\r\n2) The L2TP tunnels can carry IP packets that are very difficult to see and filter because of the additional layer 2 overhead,\r\n3) L2TP is highly complex and variable (vender-specific variability) and therefore would be a viable target that is difficult to defend. It is better left outside of the main firewall where less damage occurs if the L2TP-processing node is compromised,\r\n4) Filtering cannot be used to detect and prevent other unintended layer 2 protocols from being tunneled. The strength of the application layer code would have to be relied on to achieve this task,\r\n5) Regardless of whether the L2TP is handled inside or outside of the main network, a secondary layer of IP filtering is required; therefore bringing it inside does not save resources.\r\n\r\nTherefore, it is not recommended to allow unencrypted L2TP packets across the security boundary into the network's protected areas. Reference the Backbone Transport STIG for additional L2TP guidance and use.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000382</ident><fixtext fixref=\"F-102767r1_fix\">If L2TP is used for encapsulation, configure the VPN Gateway or other network element to block or deny this communications protocol unencrypted L2TP packets across the security boundary and into the private network of the enclave.</fixtext><fix id=\"F-102767r1_fix\" /><check system=\"C-95923r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>If L2TP communications protocol is not used, this is not applicable.\r\n\r\nVerify the VPN Gateway or another network element (e.g., firewall) is configure to block or deny L2TP packets with a destination address within the private network of the enclave.\r\n\r\nIf L2TP communications are  allowed to cross the security boundary into the private network of the enclave, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97087\"><title>SRG-NET-000138-VPN-000490</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106225r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000138-VPN-000490</version><title>The VPN Gateway must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).</title><description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\r\n\r\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses except the following.\r\n\r\n(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\r\n\r\n(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals' in-group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN or proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000764</ident><fixtext fixref=\"F-102769r1_fix\">Configure the VPN Gateway to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).</fixtext><fix id=\"F-102769r1_fix\" /><check system=\"C-95925r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway is configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).\r\n\r\nIf the VPN Gateway does not uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users), this is a finding.</check-content></check></Rule></Group><Group id=\"V-97089\"><title>SRG-NET-000140-VPN-000500</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106227r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000140-VPN-000500</version><title>The VPN Gateway must use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.</title><description>&lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.\r\n\r\nMultifactor authentication uses two or more factors to achieve authentication. Use of password for user remote access for non-privileged account is not authorized.\r\n\r\nFactors include:\r\n(i) Something you know (e.g., password/PIN);\r\n(ii) Something you have (e.g., cryptographic identification device, token); or\r\n(iii) Something you are (e.g., biometric).\r\n\r\nA non-privileged account is any information system account with authorizations of a non-privileged user.\r\n\r\nNetwork access is any access to a network element by a user (or a process acting on behalf of a user) communicating through a network.\r\n\r\nThe DoD CAC with DoD-approved PKI is an example of multifactor authentication.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000766</ident><fixtext fixref=\"F-102771r1_fix\">Configure the VPN Gateway to use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.</fixtext><fix id=\"F-102771r1_fix\" /><check system=\"C-95927r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts.\r\n\r\nIf the VPN Gateway does not use multifactor authentication (e.g., DoD PKI) for network access to non-privileged accounts, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97091\"><title>SRG-NET-000145-VPN-000510</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106229r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000145-VPN-000510</version><title>The VPN Client must implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.</title><description>&lt;VulnDiscussion&gt;Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.\r\n\r\nMultifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD common access card.\r\n\r\nA non-privileged account is any information system account with authorizations of a non-privileged user.\r\n\r\nNetwork access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001939</ident><fixtext fixref=\"F-102773r1_fix\">Configure the VPN Client to implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.</fixtext><fix id=\"F-102773r1_fix\" /><check system=\"C-95929r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Client implements multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.\r\n\r\nIf the VPN Client does not implement multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97093\"><title>SRG-NET-000147-VPN-000520</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106231r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000147-VPN-000520</version><title>The TLS VPN must be configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts.</title><description>&lt;VulnDiscussion&gt;A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack.\r\n\r\nAn authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message.\r\n\r\nA non-privileged account is any operating system account with authorizations of a non-privileged user.\r\n\r\nTechniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001942</ident><fixtext fixref=\"F-102775r1_fix\">Configure the TLS VPN Gateway to use replay-resistant authentication mechanisms for network access to non-privileged accounts.</fixtext><fix id=\"F-102775r1_fix\" /><check system=\"C-95931r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the TLS VPN Gateway is configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts.\r\n\r\nIf the TLS VPN is not configured to use replay-resistant authentication mechanisms for network access to non-privileged accounts, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97095\"><title>SRG-NET-000147-VPN-000530</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106233r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000147-VPN-000530</version><title>The IPsec VPN Gateway must use anti-replay mechanisms for security associations.</title><description>&lt;VulnDiscussion&gt;Anti-replay is an IPsec security mechanism at a packet level, which helps to avoid unwanted users from intercepting and modifying an ESP packet.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001942</ident><fixtext fixref=\"F-102777r1_fix\">Configure the IPsec VPN Gateway to use anti-replay mechanisms for security associations.</fixtext><fix id=\"F-102777r1_fix\" /><check system=\"C-95933r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway  uses anti-replay mechanisms for security associations.\r\n\r\nIf the IPsec VPN Gateway does not use anti-replay mechanisms for security associations, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97097\"><title>SRG-NET-000148-VPN-000540</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106235r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000148-VPN-000540</version><title>The VPN Gateway must uniquely identify all network-connected endpoint devices before establishing a connection.</title><description>&lt;VulnDiscussion&gt;Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\r\n\r\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of identification claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide the identification decisions (as opposed to the actual identifiers) to the services that need to act on those decisions.\r\n\r\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers (outside a datacenter), VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000778</ident><fixtext fixref=\"F-102779r1_fix\">Configure the VPN Gateway to uniquely identify all network-connected endpoint devices before establishing a connection.</fixtext><fix id=\"F-102779r1_fix\" /><check system=\"C-95935r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uniquely identifies all network-connected endpoint devices before establishing a connection.\r\n\r\nIf the VPN Gateway does not uniquely identify all network-connected endpoint devices before establishing a connection, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97099\"><title>SRG-NET-000164-VPN-000560</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106237r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000164-VPN-000560</version><title>The VPN Gateway, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.</title><description>&lt;VulnDiscussion&gt;Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. To meet this requirement, the information system must create trusted channels between itself and remote trusted authorized IT product (e.g., syslog server) entities that protect the confidentiality and integrity of communications. The information system must create trusted paths between itself and remote administrators and users that protect the confidentiality and integrity of communications.\r\n\r\nA trust anchor is an authoritative entity represented via a public key and associated data. It is most often used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. However, applications that do not use a trusted path are not approved for non-local and remote management of DoD information systems.\r\n\r\nUse of SSHv2 to establish a trusted channel is approved. Use of FTP, TELNET, HTTP, and SNMPV1 is not approved since they violate the trusted channel rule set. Use of web management tools that are not validated by common criteria may also violate the trusted channel rule set.\r\n\r\nWhen there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA.\r\n\r\nThis requirement verifies that a certification path to an accepted trust anchor is used for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Validation of the certificate status information is out of scope for this requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000185</ident><fixtext fixref=\"F-102781r1_fix\">Configure the  VPN Gateway to use PKI-based authentication that validates certificates by constructing a certification path (which includes status information) to an accepted trust anchor.</fixtext><fix id=\"F-102781r1_fix\" /><check system=\"C-95937r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway to use PKI-based authentication that validates certificates by constructing a certification path (which includes status information) to an accepted trust anchor.\r\n\r\nIf PKI-based authentication does not validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97101\"><title>SRG-NET-000165-VPN-000570</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106239r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000165-VPN-000570</version><title>The site-to-site VPN, when using PKI-based authentication for devices, must enforce authorized access to the corresponding private key.</title><description>&lt;VulnDiscussion&gt;If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure.\r\n\r\nThe cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to authenticate to network devices.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000186</ident><fixtext fixref=\"F-102783r1_fix\">Configure the site-to-site VPN that uses certificate-based device authentication to use a FIPS-compliant key management process.</fixtext><fix id=\"F-102783r1_fix\" /><check system=\"C-95939r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>If PKI-based authentication is not being used for device authentication, this is not applicable.\r\n\r\nVerify the site-to-site VPN that uses certificate-based device authentication uses a FIPS-compliant key management process.\r\n\r\nIf the site-to-site VPN that uses certificate-based device authentication does not use a FIPS-compliant key management process, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97103\"><title>SRG-NET-000166-VPN-000580</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106241r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000166-VPN-000580</version><title>The Remote Access VPN Gateway must use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.</title><description>&lt;VulnDiscussion&gt;The VPN interacts directly with public networks and devices and should not contain user authentication information for all users. AAA network security services provide the primary framework through which a network administrator can set up access control and authorization on network points of entry or network access servers. It is not advisable to configure access control on the VPN gateway or remote access server. Separation of services provides added assurance to the network if the access control server is compromised.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000187</ident><fixtext fixref=\"F-102785r1_fix\">Configure the Remote Access VPN Gateway to use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.</fixtext><fix id=\"F-102785r1_fix\" /><check system=\"C-95941r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the Remote Access VPN Gateway is configured to use a physically separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication.\r\n\r\nIf the Remote Access VPN Gateway does not use a separate authentication server (e.g., LDAP, RADIUS, TACACS+) to perform user authentication, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97113\"><title>SRG-NET-000166-VPN-000590</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106251r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000166-VPN-000590</version><title>The VPN Gateway must map the authenticated identity to the user account for PKI-based authentication.</title><description>&lt;VulnDiscussion&gt;Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device or has the concept of a user (e.g., VPN or ALG. This does not apply to authentication for the purpose of configuring the device itself (i.e., device management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000187</ident><fixtext fixref=\"F-102797r1_fix\">Configure the VPN Gateway to map the authenticated identity to the user account for PKI-based authentication.</fixtext><fix id=\"F-102797r1_fix\" /><check system=\"C-95953r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway maps the authenticated identity to the user account for PKI-based authentication.\r\n\r\nIf the VPN Gateway does not map the authenticated identity to the user account for PKI-based authentication, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97115\"><title>SRG-NET-000168-VPN-000600</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106253r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000168-VPN-000600</version><title>The VPN Gateway must use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).</title><description>&lt;VulnDiscussion&gt;Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\r\n\r\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \r\n\r\nNonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through either an external network (e.g., the Internet) or an internal network.\r\n\r\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\r\n\r\nApplications also include HMAC, KDFs, Random Bit Generation, and hash-only applications (e.g., hashing passwords and using SHA-1 or higher to compute a checksum). For digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use where needed.\r\n\r\nSeparate requirements for configuring applications and protocols used by each product (e.g., SNMPv3, SSH, NTP, and other protocols and applications that require server/client authentication) are required to implement this requirement.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000803</ident><fixtext fixref=\"F-102799r1_fix\">Configure the VPN Gateway to use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).</fixtext><fix id=\"F-102799r1_fix\" /><check system=\"C-95955r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only).\r\n\r\nIf the VPN Gateway does not use FIPS-validated SHA-1 or higher hash function to protect the integrity of hash message authentication code (HMAC), Key Derivation Functions (KDFs), Random Bit Generation, hash-only applications, and digital signature verification (legacy use only), this is a finding.</check-content></check></Rule></Group><Group id=\"V-97117\"><title>SRG-NET-000169-VPN-000610</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106255r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000169-VPN-000610</version><title>The VPN Gateway must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).</title><description>&lt;VulnDiscussion&gt;Lack of authentication and identification enables non-organizational users to gain access to the network or possibly a VPN gateway that provides opportunity for intruders to compromise resources within the network infrastructure.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device or has the concept of a non-organizational user.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000804</ident><fixtext fixref=\"F-102801r1_fix\">Configure the VPN Gateway to uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).</fixtext><fix id=\"F-102801r1_fix\" /><check system=\"C-95957r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Configure the VPN Gateway to uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).\r\n\r\nIf the VPN Gateway does not uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users), this is a finding.</check-content></check></Rule></Group><Group id=\"V-97119\"><title>SRG-NET-000205-VPN-000710</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106257r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000205-VPN-000710</version><title>The VPN Gateway must be configured to route sessions to an IDPS for inspection.</title><description>&lt;VulnDiscussion&gt;Remote access devices, such as those providing remote access to network devices and information systems, which lack automated, capabilities increase risk and makes remote user access management difficult at best.\r\n\r\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\r\n\r\nAutomated monitoring of remote access sessions allows organizations to detect cyber attacks and ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, from a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001097</ident><fixtext fixref=\"F-102803r1_fix\">Configure the VPN Gateway to route sessions to an IDPS for inspection.</fixtext><fix id=\"F-102803r1_fix\" /><check system=\"C-95959r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway routes sessions to an IDPS for inspection.\r\n\r\nIf the VPN Gateway is not  configured to route sessions to an IDPS for inspection, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97121\"><title>SRG-NET-000213-VPN-000720</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106259r1_rule\" severity=\"low\" weight=\"10.0\"><version>SRG-NET-000213-VPN-000720</version><title>The VPN Gateway must terminate all network connections associated with a communications session at the end of the session.</title><description>&lt;VulnDiscussion&gt;Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If one end of a TCP connection idles out or terminates abnormally, the opposite end of the connection may still believe the session is available. These “orphaned” sessions use up valuable router resources and can be hijacked by an attacker. To mitigate this risk, routers must be configured to send periodic keep alive messages to check that the remote end of a session is still connected. If the remote device fails to respond to the TCP keep alive message, the sending router will clear the connection and free resources allocated to the session.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001133</ident><fixtext fixref=\"F-102805r1_fix\">Configure the VPN Gateway to terminate all network connections associated with a communications session at the end of the session.</fixtext><fix id=\"F-102805r1_fix\" /><check system=\"C-95961r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway terminates all network connections associated with a communications session at the end of the session.\r\n\r\nIf the VPN Gateway does not terminate all network connections associated with a communications session at the end of the session, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97123\"><title>SRG-NET-000230-VPN-000770</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106261r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000230-VPN-000770</version><title>The VPN Gateway must use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.</title><description>&lt;VulnDiscussion&gt;Unapproved mechanisms that are used for authentication to the cryptographic module are not verified, and therefore cannot be relied upon to provide confidentiality or integrity and DoD data may be compromised.\r\n\r\nVPN gateways utilizing encryption are required to use FIPS compliant mechanisms for authenticating to cryptographic modules.\r\n\r\nFIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001184</ident><fixtext fixref=\"F-102807r1_fix\">Configure the VPN Gateway to use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.</fixtext><fix id=\"F-102807r1_fix\" /><check system=\"C-95963r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.\r\n\r\nIf the VPN Gateway does not use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97125\"><title>SRG-NET-000230-VPN-000780</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106263r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000230-VPN-000780</version><title>The IPsec VPN Gateway must use Internet Key Exchange (IKE) with SHA-1 or greater to protect the authenticity of communications sessions.</title><description>&lt;VulnDiscussion&gt;Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.\r\n\r\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \r\n\r\nThis requirement focuses on communications protection for the application session rather than for the network packet and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/SOA will require the use of mutual authentication (two-way/bidirectional).\r\n\r\nAn IPsec Security Associations (SA) is established using either IKE or manual configuration.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001184</ident><fixtext fixref=\"F-102809r1_fix\">Configure the IPsec VPN Gateway to use IKE with SHA1 or greater to protect the authenticity of communications sessions.</fixtext><fix id=\"F-102809r1_fix\" /><check system=\"C-95965r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway uses IKE with SHA1 or greater to protect the authenticity of communications sessions.\r\n\r\nIf the IPsec VPN Gateway is not configured to use IKE with SHA1 or greater to protect the authenticity of communications sessions, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97127\"><title>SRG-NET-000231-VPN-000790</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106265r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000231-VPN-000790</version><title>The VPN Gateway must invalidate session identifiers upon user logoff or other session termination.</title><description>&lt;VulnDiscussion&gt;Captured sessions can be reused in \"replay\" attacks. This requirement limits the ability of adversaries from capturing and continuing to employ previously valid session IDs.\r\n\r\nSession IDs are tokens generated by web applications to uniquely identify an application user's session. Unique session identifiers or IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. When a user logs out, or when any other session termination event occurs, the VPN gateway must terminate the user session to minimize the potential for an attacker to hijack that particular user session.\r\n\r\nThis requirement focuses on communications protection for the application session rather than for the network packet.\r\n\r\nThis requirement applies only to any VPN gateway that is an intermediary of individual sessions (e.g., proxy, ALG, or SSL VPN). This requirement focuses on communications protection at the application session, versus network packet level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001185</ident><fixtext fixref=\"F-102811r1_fix\">Configure the VPN Gateway to invalidate session identifiers upon user logoff or other session termination.</fixtext><fix id=\"F-102811r1_fix\" /><check system=\"C-95967r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway invalidates session identifiers upon user logoff or other session termination.\r\n\r\nIf the VPN Gateway does not invalidate session identifiers upon user logoff or other session termination, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97129\"><title>SRG-NET-000233-VPN-000800</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106267r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000233-VPN-000800</version><title>The VPN Gateway must recognize only system-generated session identifiers.</title><description>&lt;VulnDiscussion&gt;VPN gateways (depending on function) utilize sessions and session identifiers to control application behavior and user access. If an attacker can guess the session identifier, or can inject or manually insert session information, the valid user's application session can be compromised.\r\n\r\nUnique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions.\r\n\r\nThis requirement focuses on communications protection for the application session rather than for the network packet.\r\n\r\nThis requirement applies to any VPN gateway that is an intermediary of individual sessions (e.g., proxy, ALG, TLS VPN). VPN gateways that perform these functions must be able to identify which session identifiers were generated when the sessions were established.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001664</ident><fixtext fixref=\"F-102813r1_fix\">Configure the VPN Gateway to recognize only system-generated session identifiers.</fixtext><fix id=\"F-102813r1_fix\" /><check system=\"C-95969r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway recognizes only system-generated session identifiers.\r\n\r\nIf the VPN Gateway does not recognize only system-generated session identifiers, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97131\"><title>SRG-NET-000234-VPN-000810</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106269r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000234-VPN-000810</version><title>The VPN Gateway must generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.</title><description>&lt;VulnDiscussion&gt;Both IPsec and TLS gateways use the RNG to strengthen the security of the protocols. Using a weak RNG will weaken the protocol and make it more vulnerable.\r\n\r\nUse of a FIPS validated RNG that is not DRGB mitigates to a CAT III.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001188</ident><fixtext fixref=\"F-102815r1_fix\">Configure the VPN Gateway to generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.</fixtext><fix id=\"F-102815r1_fix\" /><check system=\"C-95971r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway generates unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.\r\n\r\nIf the VPN Gateway does not generate unique session identifiers using FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97133\"><title>SRG-NET-000235-VPN-000820</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106271r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000235-VPN-000820</version><title>The VPN Gateway must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.</title><description>&lt;VulnDiscussion&gt;Failure to a known safe state helps prevent systems from failing to a state that may cause loss of data or unauthorized access to system resources. VPN gateways that fail suddenly and with no incorporated failure state planning may leave the hosting system available but with a reduced security protection capability. Preserving information system state information also facilitates system restart and return to the operational mode of the organization with less disruption to mission-essential processes.\r\n\r\nAbort refers to stopping a program or function before it has finished naturally. The term abort refers to both requested and unexpected terminations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001190</ident><fixtext fixref=\"F-102817r1_fix\">Configure the VPN Gateway to fail to a secure state if system initialization fails, shutdown fails, or aborts fail.</fixtext><fix id=\"F-102817r1_fix\" /><check system=\"C-95973r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway is configured to fail to a secure state if system initialization fails, shutdown fails, or aborts fail.\r\n\r\nIf the VPN Gateway does not fail to a secure state if system initialization fails, shutdown fails, or aborts fail, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97135\"><title>SRG-NET-000313-VPN-001050</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106273r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000313-VPN-001050</version><title>The VPN Gateway must be configured to perform an organization-defined action if the audit reveals unauthorized activity.</title><description>&lt;VulnDiscussion&gt;Remote access devices, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and makes remote user access management difficult at best.\r\n\r\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\r\n\r\nRemote access functionality, such as remote access servers, VPN concentrators, and IDS/IPS devices, must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002314</ident><fixtext fixref=\"F-102819r1_fix\">Configure the VPN Gateway to be configured to perform an organization-defined action if the audit reveals unauthorized activity.</fixtext><fix id=\"F-102819r1_fix\" /><check system=\"C-95975r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway is configured to perform an organization-defined action if the audit reveals unauthorized activity.\r\n\r\nIf the VPN Gateway does not be configured to perform an organization-defined action if the audit reveals unauthorized activity, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97137\"><title>SRG-NET-000314-VPN-001060</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106275r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000314-VPN-001060</version><title>The VPN Gateway administrator accounts or security policy must be configured to allow the system administrator to immediately disconnect or disable remote access to devices and/or users when needed.</title><description>&lt;VulnDiscussion&gt;Without the ability to immediately disconnect or disable remote access, an attack or other compromise taking progress would not be immediately stopped.\r\n\r\nRemote access functionality must have the capability to immediately disconnect current users remotely accessing the information system and/or disable further remote access. The speed of disconnect or disablement varies based on the criticality of mission functions and the need to eliminate immediate or future remote access to organizational information systems.\r\n\r\nThe remote access functionality (e.g., VPN, ALG, and RAS) may implement features, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002322</ident><fixtext fixref=\"F-102821r1_fix\">Configure the VPN Gateway for functionality, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack. \r\n\r\nConfigure authorized system administrator accounts to allow them to disconnect or disable remote access to remove user under circumstances defined in the VPN SSP.</fixtext><fix id=\"F-102821r1_fix\" /><check system=\"C-95977r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Configure the VPN Gateway for functionality, such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack. \r\n\r\nConfigure authorized system administrator accounts to allow them to disconnect or disable remote access to remove user under circumstances defined in the VPN SSP.\r\n\r\nIf the VPN Gateway administrator accounts or security policy is not configured to allow the system administrator to immediately disconnect or disable remote access to devices and/or users when needed, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97139\"><title>SRG-NET-000317-VPN-001090</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106277r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000317-VPN-001090</version><title>The IPsec VPN Gateway must use AES encryption for the Internet Key Exchange (IKE) proposal to protect confidentiality of remote access sessions.</title><description>&lt;VulnDiscussion&gt;Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\r\n\r\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\r\n\r\nAES is the FIPS-validated cipher block cryptographic algorithm approved for use in DoD. For an algorithm implementation to be listed on a FIPS 140-2 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. Currently, NIST has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000068</ident><fixtext fixref=\"F-102823r1_fix\">Configure the IPsec Gateway to use AES with IKE. The option on the IKE Phase 1 proposal may also be configured to use the  aes-128-cbc, aes-192-cbc, or aes-256-cbc algorithms.</fixtext><fix id=\"F-102823r1_fix\" /><check system=\"C-95979r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify all IKE proposals are set to use the AES encryption algorithm.\r\n\r\nView the value of the encryption algorithm for each defined proposal.\r\n\r\nIf the value of the encryption algorithm for any IKE proposal is not set to use an AES algorithm, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97141\"><title>SRG-NET-000320-VPN-001120</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106279r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000320-VPN-001120</version><title>The VPN Gateway must transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.</title><description>&lt;VulnDiscussion&gt;Protecting authentication communications between the client, the VPN Gateway, and the authentication server keeps this critical information from being exploited.\r\n\r\nIn distributed information systems, authorization processes and access control decisions may occur in separate parts of the systems. In such instances, authorization information is transmitted securely so timely access control decisions can be enforced at the appropriate locations. To support the access control decisions, it may be necessary to transmit as part of the access authorization information, supporting security attributes. This is due to the fact that in distributed information systems, there are various access control decisions that need to be made and different entities (e.g., services) make these decisions in a serial fashion, each requiring some security attributes to make the decisions.\r\n\r\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002353</ident><fixtext fixref=\"F-102825r1_fix\">Configure the VPN Gateway to transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.</fixtext><fix id=\"F-102825r1_fix\" /><check system=\"C-95981r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway transmits organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions.\r\n\r\nIf the VPN Gateway does not transmit organization-defined access authorization information using FIPS 140-2-validated cryptography to a compliant authentication server, which enforces access control decisions, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97143\"><title>SRG-NET-000330-VPN-001220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106281r1_rule\" severity=\"low\" weight=\"10.0\"><version>SRG-NET-000330-VPN-001220</version><title>The VPN Gateway must notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).</title><description>&lt;VulnDiscussion&gt;Users need to be aware of activity that occurs regarding their account. Providing users with information deemed important by the organization may aid in the discovery of unauthorized access or thwart a potential attacker.\r\n\r\nOrganizations should consider the risks to the specific information system being accessed and the threats presented by the device to the environment when configuring this option. An excessive or unnecessary amount of information presented to the user at logon is not recommended.\r\n\r\nThis requirement applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002250</ident><fixtext fixref=\"F-102827r1_fix\">Configure the VPN Gateway to notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).</fixtext><fix id=\"F-102827r1_fix\" /><check system=\"C-95983r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verity the VPN Gateway notifies the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access).\r\n\r\nIf the VPN Gateway does not notify the user, upon successful logon (access), of the organization-defined information to be included in addition to the date and time of the last logon (access), this is a finding.</check-content></check></Rule></Group><Group id=\"V-97145\"><title>SRG-NET-000333-VPN-001250</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106283r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000333-VPN-001250</version><title>The VPN Gateway must provide centralized management and configuration of the content to be captured in log records generated by all network components.</title><description>&lt;VulnDiscussion&gt;Without the ability to centrally manage the content captured in the log records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack.\r\n\r\nThe content captured in log records must be managed from a central location (necessitating automation). Centralized management of log records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Network components requiring centralized audit log management must have the capability to support centralized management.\r\n\r\nThe DoD requires centralized management of all network component audit record content.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001844</ident><fixtext fixref=\"F-102829r1_fix\">Configure the VPN Gateway to provide centralized management and configuration of the content to be captured in log records generated by all network components.</fixtext><fix id=\"F-102829r1_fix\" /><check system=\"C-95985r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway provides centralized management and configuration of the content to be captured in log records generated by all network components.\r\n\r\nIf the VPN Gateway does not provide centralized management and configuration of the content to be captured in log records generated by all network components, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97147\"><title>SRG-NET-000334-VPN-001260</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106285r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000334-VPN-001260</version><title>The VPN Gateway must off-load audit records onto a different system or media than the system being audited.</title><description>&lt;VulnDiscussion&gt;Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\r\n\r\nOff-loading is a common process in information systems with limited audit storage capacity.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001851</ident><fixtext fixref=\"F-102831r1_fix\">Configure the VPN Gateway to off-load audit records onto a different system or media than the system being audited.</fixtext><fix id=\"F-102831r1_fix\" /><check system=\"C-95987r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway off-loads log records onto a different system or media than the system being audited.\r\n\r\nIf the VPN Gateway does not off-load audit records onto a different system or media than the system being audited, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97149\"><title>SRG-NET-000335-VPN-001270</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106287r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000335-VPN-001270</version><title>The VPN Gateway must generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.</title><description>&lt;VulnDiscussion&gt;It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected.\r\n\r\nAlerts provide organizations with urgent messages. Automated alerts can be conveyed in a variety of ways, including, for example, telephonically, via electronic mail, via text message, or via websites. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded.\r\n\r\nWhile this requirement also applies to the event monitoring system (e.g., Syslog, Security Information and Event Management [SIEM], or SNMP servers), the VPN Gateway must also be configured to generate a message to the administrator console.\r\n\r\nThe VPN daemon facility and log facility are messages in the log, which capture actions performed or errors encountered by system processes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001858</ident><fixtext fixref=\"F-102833r1_fix\">Configure the VPN Gateway to generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.</fixtext><fix id=\"F-102833r1_fix\" /><check system=\"C-95989r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway generates a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server.\r\n\r\nIf the VPN Gateway does not generate a log record or an SNMP trap that can be forwarded as an alert to, at a minimum, the SCA and ISSO, of all log failure events where the detection and/or prevention function is unable to write events to either local storage or the centralized server, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97151\"><title>SRG-NET-000336-VPN-001280</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106289r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000336-VPN-001280</version><title>When communications with the Central Log Server is lost, the VPN Gateway must continue to queue traffic log records locally.</title><description>&lt;VulnDiscussion&gt;If the system were to continue processing after audit failure, actions can be taken on the system that cannot be tracked and recorded for later forensic analysis.\r\n\r\nBecause of the importance of ensuring mission/business continuity, organizations may determine that the nature of the audit failure is not so severe that it warrants a complete shutdown of the application supporting the core organizational missions/business operations. In those instances, partial application shutdowns or operating in a degraded mode with reduced capability may be viable alternatives.\r\n\r\nThis requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001861</ident><fixtext fixref=\"F-102835r1_fix\">Configure the VPN Gateway to continue to queue traffic log records locally when communications with the Central Log Server is lost.</fixtext><fix id=\"F-102835r1_fix\" /><check system=\"C-95991r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify that in the event that communications with the Central Log Server is lost, the VPN Gateway is configured to continue to queue traffic log records locally.\r\n\r\nIf the VPN Gateway does not continue to queue traffic log records locally when communications with the Central Log Server is lost, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97153\"><title>SRG-NET-000337-VPN-001290</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106291r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000337-VPN-001290</version><title>The IPsec VPN Gateway must renegotiate the security association after 8 hours or less, or an organization-defined period.</title><description>&lt;VulnDiscussion&gt;The IPsec SA and its corresponding key will expire either after the number of seconds or amount of traffic volume has exceeded the configured limit. A new SA is negotiated before the lifetime threshold of the existing SA is reached to ensure that a new SA is ready for use when the old one expires. The longer the lifetime of the IPsec SA, the longer the lifetime of the session key used to protect IP traffic. The SA is less secure with a longer lifetime because an attacker has a greater opportunity to collect traffic encrypted by the same key and subject it to cryptanalysis. However, a shorter lifetime causes IPsec peers to renegotiate Phase II more often resulting in the expenditure of additional resources.\r\n\r\nSpecify the lifetime (in seconds) of an Internet Key Exchange (IKE) security association (SA). When the SA expires, it is replaced by a new SA, the security parameter index (SPI), or terminated if the peer cannot be contacted for renegotiation.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002038</ident><fixtext fixref=\"F-102837r1_fix\">Configure the IPsec VPN Gateway to renegotiate the security association after 8 hours or less, or an organization-defined period.</fixtext><fix id=\"F-102837r1_fix\" /><check system=\"C-95993r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway renegotiates the security association after 8 hours or less, or an organization-defined period.\r\n\r\nIf the IPsec VPN Gateway does not renegotiate the security association after 8 hours or less, or an organization-defined period, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97155\"><title>SRG-NET-000337-VPN-001300</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106293r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000337-VPN-001300</version><title>The VPN Gateway must renegotiate the security association after 24 hours or less or as defined by the organization.</title><description>&lt;VulnDiscussion&gt;When a VPN gateway creates an IPsec Security Association (SA), resources must be allocated to maintain the SA. These resources are wasted during periods of IPsec endpoint inactivity, which could result in the gateway’s inability to create new SAs for other endpoints, thereby preventing new sessions from connecting. The Internet Key Exchange (IKE) idle timeout may also be set to allow SAs associated with inactive endpoints to be deleted before the SA lifetime has expired, although this setting is not recommended at this time. The value of one hour or less is a common best practice.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002038</ident><fixtext fixref=\"F-102839r1_fix\">Configure the VPN Gateway to renegotiate the security association after 24 hours or less or as defined by the organization.</fixtext><fix id=\"F-102839r1_fix\" /><check system=\"C-95995r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway renegotiates the security association after 24 hours or less or as defined by the organization.\r\n\r\nIf the VPN Gateway does not renegotiate the security association after 24 hours or less or as defined by the organization, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97157\"><title>SRG-NET-000341-VPN-001350</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106295r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000341-VPN-001350</version><title>The VPN Gateway must accept Personal Identity Verification (PIV) credentials.</title><description>&lt;VulnDiscussion&gt;The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\r\n\r\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001953</ident><fixtext fixref=\"F-102841r1_fix\">Configure the VPN Gateway to accept Personal Identity Verification (PIV) credentials.</fixtext><fix id=\"F-102841r1_fix\" /><check system=\"C-95997r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway accepts Personal Identity Verification (PIV) credentials.\r\n\r\nIf the VPN Gateway does not accept Personal Identity Verification (PIV) credentials, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97159\"><title>SRG-NET-000342-VPN-001360</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106297r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000342-VPN-001360</version><title>The VPN Gateway must electronically verify Personal Identity Verification (PIV) credentials.</title><description>&lt;VulnDiscussion&gt;The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\r\n\r\nDoD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001954</ident><fixtext fixref=\"F-102843r1_fix\">Configure the VPN Gateway to electronically verify Personal Identity Verification (PIV) credentials.</fixtext><fix id=\"F-102843r1_fix\" /><check system=\"C-95999r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway electronically verifies Personal Identity Verification (PIV) credentials.\r\n\r\nIf the VPN Gateway does not electronically verify Personal Identity Verification (PIV) credentials, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97177\"><title>SRG-NET-000343-VPN-001370</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106315r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000343-VPN-001370</version><title>The VPN Gateway must authenticate all network-connected endpoint devices before establishing a connection.</title><description>&lt;VulnDiscussion&gt;Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.\r\n\r\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions.\r\n\r\nThis requirement applies to applications that connect either locally, remotely, or through a network to an endpoint device (including, but not limited to, workstations, printers, servers (outside a datacenter), VoIP Phones, and VTC CODECs). Gateways and SOA applications are examples of where this requirement would apply.\r\n\r\nDevice authentication is a solution enabling an organization to manage devices. It is an additional layer of authentication ensuring only specific pre-authorized devices can access the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001958</ident><fixtext fixref=\"F-102859r1_fix\">Configure the VPN Gateway to authenticate all network-connected endpoint devices before establishing a connection.</fixtext><fix id=\"F-102859r1_fix\" /><check system=\"C-96015r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verity the VPN Gateway  authenticates all network-connected endpoint devices before establishing a connection.\r\n\r\nIf the VPN Gateway does not authenticate all network-connected endpoint devices before establishing a connection, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97179\"><title>SRG-NET-000352-VPN-001460</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106317r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000352-VPN-001460</version><title>The VPN Gateway must use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.</title><description>&lt;VulnDiscussion&gt;Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.\r\n\r\nThe National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by NIST and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future required Suite B implementations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002450</ident><fixtext fixref=\"F-102861r1_fix\">Configure the VPN Gateway to use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.</fixtext><fix id=\"F-102861r1_fix\" /><check system=\"C-96017r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.\r\n\r\nIf the VPN Gateway does not use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97181\"><title>SRG-NET-000369-VPN-001620</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106319r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000369-VPN-001620</version><title>The VPN Gateway must disable split-tunneling for remote clients VPNs.</title><description>&lt;VulnDiscussion&gt;Split tunneling would in effect allow unauthorized external connections, making the system more vulnerable to attack and to exfiltration of organizational information.\r\n\r\nA VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the Internet. With split tunneling enabled, a remote client has access to the Internet while at the same time has established a secured path to the enclave via an IPsec tunnel. A remote client connected to the Internet that has been compromised by an attacker in the Internet, provides an attack base to the enclave’s private network via the IPsec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002397</ident><fixtext fixref=\"F-102863r1_fix\">Configure the VPN Gateway to disable split-tunneling for remote clients VPNs.</fixtext><fix id=\"F-102863r1_fix\" /><check system=\"C-96019r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway disables split-tunneling for remote clients VPNs.\r\n\r\nIf the VPN Gateway does not disable split-tunneling for remote clients VPNs, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97183\"><title>SRG-NET-000371-VPN-001640</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106321r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000371-VPN-001640</version><title>The IPsec VPN Gateway must specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.</title><description>&lt;VulnDiscussion&gt;PFS generates each new encryption key independently from the previous key. Without PFS, compromise of one key will compromise all communications.\r\n\r\nThe phase 2 (Quick Mode) Security Association (SA) is used to create an IPsec session key. Hence, its rekey or key regeneration procedure is very important. The phase 2 rekey can be performed with or without Perfect Forward Secrecy (PFS). With PFS, every time a new IPsec Security Association is negotiated during the Quick Mode, a new Diffie-Hellman (DH) exchange occurs. The new DH shared secret will be included with original keying material (SYKEID_d, initiator nonce, and responder nonce from phase 1 for generating a new IPsec session key. If PFS is not used, the IPsec session key will always be completely dependent on the original keying material from the Phase-1. Hence, if an older key is compromised at any time, it is possible that all new keys may be compromised.\r\n\r\nThe DH exchange is performed in the same manner as was done in phase 1 (Main or Aggressive Mode). However, the phase 2 exchange is protected by encrypting the phase 2 packets with the key derived from the phase 1 negotiation. Because DH negotiations during phase 2 are encrypted, the new IPsec session key has an added element of secrecy.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002418</ident><fixtext fixref=\"F-102865r1_fix\">Configure the IPsec VPN Gateway to specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.</fixtext><fix id=\"F-102865r1_fix\" /><check system=\"C-96021r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway specifies Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation.\r\n\r\nIf the IPsec VPN Gateway does not specify Perfect Forward Secrecy (PFS) during Internet Key Exchange (IKE) negotiation, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97185\"><title>SRG-NET-000371-VPN-001650</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106323r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000371-VPN-001650</version><title>The VPN Gateway and Client must be configured to protect the confidentiality and integrity of transmitted information.</title><description>&lt;VulnDiscussion&gt;Without protection of the transmitted information, confidentiality and integrity may be compromised as unprotected communications can be intercepted and either read or altered.\r\n\r\nThis requirement also applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification.\r\n\r\nProtecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.\r\n\r\nFor example, configure all ISAKMP policies to use AES for Internet Key Exchange (IKE) cryptographic encryption operations and SHA-1 to protect data integrity.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002418</ident><fixtext fixref=\"F-102867r1_fix\">Configure the VPN Gateway and the remote access client to protect the confidentiality and integrity of transmitted information.</fixtext><fix id=\"F-102867r1_fix\" /><check system=\"C-96023r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway and the remote access client are configured to protect the confidentiality and integrity of transmitted information.\r\n\r\nIf VPN Gateway and Client does not protect the confidentiality and integrity of transmitted information, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97187\"><title>SRG-NET-000375-VPN-001690</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106325r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000375-VPN-001690</version><title>The IPsec VPN Gateway must use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.</title><description>&lt;VulnDiscussion&gt;ESP provides confidentiality, data origin authentication, integrity, and anti-replay services within the IPsec suite of protocols. ESP in tunnel mode ensures a secure path for communications for site-to-site VPNs and gateway to endpoints, including header information.\r\n\r\nESP can be deployed in either transport or tunnel mode. Transport mode is used to create a secured session between two hosts. It can also be used when two hosts simply want to authenticate each IP packet with IPsec authentication header (AH). With ESP transport mode, only the payload (transport layer) is encrypted, whereas with tunnel mode, the entire IP packet is encrypted and encapsulated with a new IP header. Tunnel mode is used to encrypt traffic between secure IPsec gateways or between an IPsec gateway and an end-station running IPsec software. Hence, it is the only method to provide a secured path to transport traffic between remote sites or end-stations and the central site.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002423</ident><fixtext fixref=\"F-102869r1_fix\">Configure the IPsec VPN Gateway to use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.</fixtext><fix id=\"F-102869r1_fix\" /><check system=\"C-96025r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway uses Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations.\r\n\r\nIf the IPsec VPN Gateway must use Encapsulating Security Payload (ESP) in tunnel mode for establishing secured paths to transport traffic between the organizations sites or between a gateway and remote end-stations, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97189\"><title>SRG-NET-000400-VPN-001940</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106327r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000400-VPN-001940</version><title>For site-to-site VPN, for accounts using password authentication, the VPN Gateway must use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.</title><description>&lt;VulnDiscussion&gt;Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\r\n\r\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \r\n\r\nThe information system must specify the hash algorithm used for authenticating passwords. Implementation of this requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000197</ident><fixtext fixref=\"F-102871r1_fix\">For accounts using password authentication, configure the VPN Gateway to use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.</fixtext><fix id=\"F-102871r1_fix\" /><check system=\"C-96027r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>For accounts using password authentication, verify the VPN Gateway uses FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.\r\n\r\nFor accounts using password authentication, if the VPN Gateway does not use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97191\"><title>SRG-NET-000492-VPN-001980</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106329r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000492-VPN-001980</version><title>The VPN Gateway must generate log records when successful and/or unsuccessful VPN connection attempts occur.</title><description>&lt;VulnDiscussion&gt;Without generating log records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.\r\n\r\nLog records can be generated from various components within the information system (e.g., module or policy filter).\r\n\r\nThis requirement only applies to components where this is specific to the function of the device, such as application layer gateway (ALG), which provides these access control and auditing functions on behalf of an application. This does not apply to audit logs generated on behalf of the device itself (management).&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000172</ident><fixtext fixref=\"F-102873r1_fix\">Configure the VPN Gateway to generate log records when successful and/or unsuccessful VPN connection attempts occur.</fixtext><fix id=\"F-102873r1_fix\" /><check system=\"C-96029r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway generates log records when successful and/or unsuccessful VPN connection attempts occur.\r\n\r\nIf the VPN Gateway does not generate log records when successful and/or unsuccessful VPN connection attempts occur, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97193\"><title>SRG-NET-000510-VPN-002160</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106331r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000510-VPN-002160</version><title>The VPN Gateway must use a FIPS-validated cryptographic module to generate cryptographic hashes.</title><description>&lt;VulnDiscussion&gt;FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plain text. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.\r\n\r\nThe cryptographic module used must have at least one validated hash algorithm. This validated hash algorithm must be used to generate cryptographic hashes for all cryptographic security function within the product being evaluated.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002450</ident><fixtext fixref=\"F-102875r1_fix\">Configure the VPN Gateway to use a FIPS-validated cryptographic module to generate cryptographic hashes.</fixtext><fix id=\"F-102875r1_fix\" /><check system=\"C-96031r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses a FIPS-validated cryptographic module to generate cryptographic hashes.\r\n\r\nIf the VPN Gateway does not use a FIPS-validated cryptographic module to generate cryptographic hashes, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97195\"><title>SRG-NET-000510-VPN-002170</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106333r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000510-VPN-002170</version><title>The VPN Gateway must use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.</title><description>&lt;VulnDiscussion&gt;FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plain text. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.\r\n\r\nThe cryptographic module used must have one FIPS-validated encryption algorithm (i.e., validated Advanced Encryption Standard [AES]). This validated algorithm must be used for encryption for cryptographic security function within the product being evaluated.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002450</ident><fixtext fixref=\"F-102877r1_fix\">Configure the VPN Gateway to use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.</fixtext><fix id=\"F-102877r1_fix\" /><check system=\"C-96033r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.\r\n\r\nIf the VPN Gateway does not use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97197\"><title>SRG-NET-000510-VPN-002180</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106335r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000510-VPN-002180</version><title>The IPsec VPN Gateway IKE must use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.</title><description>&lt;VulnDiscussion&gt;Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002450</ident><fixtext fixref=\"F-102879r1_fix\">Configure the IPsec VPN Gateway IKE to use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.</fixtext><fix id=\"F-102879r1_fix\" /><check system=\"C-96035r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway IKE uses a NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic.\r\n\r\nIf the IPsec VPN Gateway IKE does not use NIST FIPS-validated cryptography to implement encryption services for unclassified VPN traffic, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97199\"><title>SRG-NET-000512-VPN-002220</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106337r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000512-VPN-002220</version><title>The IPsec VPN Gateway must use Internet Key Exchange (IKE) for IPsec VPN Security Associations (SAs).</title><description>&lt;VulnDiscussion&gt;Without IKE, the SPI is manually specified for each security association. IKE peers will negotiate the encryption algorithm and authentication or hashing methods as well as generate the encryption keys.\r\n\r\nAn IPsec SA is established using either Internet Key Exchange (IKE) or manual configuration. When using IKE, the security associations are established when needed and expire after a period of time or volume of traffic threshold. If manually configured, they are established as soon as the configuration is complete at both end points and they do not expire. When using IKE, the Security Parameter Index (SPI) for each security association is a pseudo-randomly derived number.\r\n\r\nWith manual configuration of the IPsec security association, both the cipher key and authentication key are static. Hence, if the keys are compromised, the traffic being protected by the current IPsec tunnel can be decrypted as well as traffic in any future tunnels established by this SA. Furthermore, the peers are not authenticated prior to establishing the SA, which could result in a rogue device establishing an IPsec SA with either of the VPN end points.\r\n\r\nIKE provides primary authentication to verify the identity of the remote system before negotiation begins. This feature is lost when the IPsec security associations are manually configured, which results in a non-terminating session using static pre-shared keys.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-102881r1_fix\">Configure the IPsec VPN Gateway to use IKE and IPsec VPN SAs.</fixtext><fix id=\"F-102881r1_fix\" /><check system=\"C-96037r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IKE protocol is specified for all IPsec VPNs.\r\n\r\nIf the IKE protocol is not specified as an option on all VPN gateways, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97201\"><title>SRG-NET-000512-VPN-002230</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106339r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000512-VPN-002230</version><title>The VPN Gateway must not accept certificates that have been revoked when using PKI for authentication.</title><description>&lt;VulnDiscussion&gt;Situations may arise in which the certificate issued by a Certificate Authority (CA) may need to be revoked before the lifetime of the certificate expires. For example, the certificate is known to have been compromised.\r\n\r\nWhen an incoming Internet Key Exchange (IKE) session is initiated for a remote client or peer whose certificate is revoked, the revocation list configured for use by the VPN server is checked to see if the certificate is valid; if the certificate is revoked, IKE will fail and an IPsec security association will not be established for the remote endpoint.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000366</ident><fixtext fixref=\"F-102883r1_fix\">Configure the VPN Gateway to not accept certificates that have been revoked when using PKI for authentication.</fixtext><fix id=\"F-102883r1_fix\" /><check system=\"C-96039r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway does not accept certificates that have been revoked when using PKI for authentication.\r\n\r\nIf the VPN Gateway accepts certificates that have been revoked when using PKI for authentication, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97203\"><title>SRG-NET-000518-VPN-002280</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106341r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000518-VPN-002280</version><title>The VPN Client logout function must be configured to terminate the session on/with the VPN Gateway.</title><description>&lt;VulnDiscussion&gt;If a user cannot explicitly end a session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session.\r\n\r\nHowever, for some types of interactive sessions including, for example, remote login, information systems typically send logout messages as final messages prior to terminating sessions.\r\n\r\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002363</ident><fixtext fixref=\"F-102885r1_fix\">Configure the VPN Client logout log out function must be configured to terminate the session on/with the VPN Gateway.</fixtext><fix id=\"F-102885r1_fix\" /><check system=\"C-96041r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Client logout function is configured to terminate the session on/with the VPN Gateway.\r\n\r\nIf the VPN Client logout function does not terminate the session on/with the VPN Gateway, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97205\"><title>SRG-NET-000519-VPN-002290</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106343r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000519-VPN-002290</version><title>The VPN Client must display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.</title><description>&lt;VulnDiscussion&gt;If a user cannot explicitly end a session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. Users need to be aware of whether or not the session has been terminated.\r\n\r\nLogout messages for access, for example, can be displayed after authenticated sessions have been terminated. However, for some types of interactive sessions including, for example, remote login, information systems typically send logout messages as final messages prior to terminating sessions.\r\n\r\nThis applies to VPN gateways that have the concept of a user account and have the login function residing on the VPN gateway.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002364</ident><fixtext fixref=\"F-102887r1_fix\">Configure the VPN Client to display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.</fixtext><fix id=\"F-102887r1_fix\" /><check system=\"C-96043r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Client displays an explicit logout message to users indicating the reliable termination of authenticated communications sessions.\r\n\r\nIf the VPN Client does not display an explicit logout message to users indicating the reliable termination of authenticated communications sessions, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97207\"><title>SRG-NET-000522-VPN-002320</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106345r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000522-VPN-002320</version><title>For site-to-site VPN Gateway must store only cryptographic representations of Pre-shared Keys (PSKs).</title><description>&lt;VulnDiscussion&gt;Pre-shared keys need to be protected at all times, and encryption is the standard method for protecting passwords. If PSKs are not encrypted, they can be plainly read and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.\r\n\r\nPSKs used for site-to-site VPNs are considered by the SRG as a type of password. If this shared secret is already encrypted and not in plaintext, this meets this requirement. This requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption. This method uses a one-way hashing encryption algorithm with a salt value to validate a user's password without having to store the actual password. Performance and time required to access are factors that must be considered, and the one-way hash is the most feasible means of securing the password and providing an acceptable measure of password security.\r\n\r\nUse a keyed hash message authentication code (HMAC). HMAC calculates a message authentication code via a cryptographic hash function used in conjunction with an encryption key. The key must be protected as with any private key.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000196</ident><fixtext fixref=\"F-102889r1_fix\">Configure the VPN Gateway to store only cryptographic representations of the PSK.</fixtext><fix id=\"F-102889r1_fix\" /><check system=\"C-96045r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway stores only cryptographic representations of the PSK.\r\n\r\nIf the VPN Gateway does not store only cryptographic representations of the PSK, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97209\"><title>SRG-NET-000525-VPN-002330</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106347r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000525-VPN-002330</version><title>The IPsec VPN must use Advanced Encryption Standard (AES) encryption for the IPsec proposal to protect the confidentiality of remote access sessions.</title><description>&lt;VulnDiscussion&gt;Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\r\n\r\nRemote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network.\r\n\r\nA block cipher mode is an algorithm that features the use of a symmetric key block cipher algorithm to provide an information service, such as confidentiality or authentication.\r\n\r\nAES is the FIPS-validated cipher block cryptographic algorithm approved for use in DoD. For an algorithm implementation to be listed on a FIPS 140-2 cryptographic module validation certificate as an approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. Currently, NIST has approved the following confidentiality modes to be used with approved block ciphers in a series of special publications: ECB, CBC, OFB, CFB, CTR, XTS-AES, FF1, FF3, CCM, GCM, KW, KWP, and TKW.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000068</ident><fixtext fixref=\"F-102891r1_fix\">Configure the IPsec Gateway to use AES for the IPsec proposal. The following example commands configure the IPsec (phase 2) proposals. The option may also be configured to use the aes-128-cbc, aes-192-cbc, or aes-256-cbc algorithms.</fixtext><fix id=\"F-102891r1_fix\" /><check system=\"C-96047r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify all Internet Key Exchange (IKE) proposals are set to use the AES encryption algorithm.\r\n\r\nView the value of the encryption algorithm for each defined proposal.\r\n\r\nIf the value of the encryption algorithm for any IPsec proposal is not set to use an AES algorithm, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97211\"><title>SRG-NET-000530-VPN-002340</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106349r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000530-VPN-002340</version><title>The TLS VPN Gateway that supports Government-only services must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.</title><description>&lt;VulnDiscussion&gt;Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\r\n\r\nThis requirement applies to TLS gateways (also known as SSL gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance for client negotiation on either DoD-only or public-facing servers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001453</ident><fixtext fixref=\"F-102893r1_fix\">Configure the TLS VPN Gateway that supports Government-only services to prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.</fixtext><fix id=\"F-102893r1_fix\" /><check system=\"C-96049r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the TLS VPN Gateway that supports Government-only services prohibits client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.\r\n\r\nIf the TLS VPN Gateway that supports Government-only services does not prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97213\"><title>SRG-NET-000540-VPN-002350</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106351r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000540-VPN-002350</version><title>The TLS VPN Gateway that supports citizen- or business-facing network devices must prohibit client negotiation to SSL 2.0 or SSL 3.0.</title><description>&lt;VulnDiscussion&gt;Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.\r\n\r\nThis requirement applies to public-facing or external-facing devices such as TLS gateways (also known as SSL gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance.\r\n\r\nThe minimum TLS version required by DoD is 1.2. However, devices and applications may allow client negotiation for systems supporting citizen- and business-facing applications. These devices may be configured to support TLS version 1.1 and 1.0 to enable interaction with citizens and businesses. These devices must not support SSL version 3.0 or earlier.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001453</ident><fixtext fixref=\"F-102895r1_fix\">Configure the TLS VPN Gateway that supports citizen- or business-facing network devices to prohibit client negotiation to SSL 2.0 or SSL 3.0.</fixtext><fix id=\"F-102895r1_fix\" /><check system=\"C-96051r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the TLS VPN Gateway that supports citizen- or business-facing network devices prohibits client negotiation to SSL 2.0 or SSL 3.0.\r\n\r\nIf the TLS VPN Gateway that supports citizen- or business-facing network devices does not prohibit client negotiation to SSL 2.0 or SSL 3.0, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97215\"><title>SRG-NET-000550-VPN-002360</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106353r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000550-VPN-002360</version><title>The VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.</title><description>&lt;VulnDiscussion&gt;Without device-to-device authentication, communications with malicious devices may be established. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk.\r\n\r\nSNMPv3 supports authentication, authorization, access control, and privacy while previous versions of the protocol contained well-known security weaknesses, which were easily exploited. SNMPv3 can be configured for identification and bidirectional, cryptographically based authentication.\r\n\r\nA typical SNMP implementation includes three components: Managed device, SNMP agent, and NMS. The SNMP agent is the SNMP process that resides on the managed device and communicates with the network management system. The NMS is a combination of hardware and software that is used to monitor and administer a network. The SNMP data is stored in a highly-structured, hierarchical format known as a management information base (MIB). The SNMP manager collects information about network connectivity, activity, and events by polling managed devices.\r\n\r\nSNMPv3 defines a user-based security model (USM), and a view-based access control model (VACM). SNMPv3 USM provides data integrity, data origin authentication, message replay protection, and protection against disclosure of the message payload. SNMPv3 VACM provides access control to determine whether a specific type of access (read or write) to the management information is allowed. Implement both VACM and USM for full protection.\r\n\r\nSNMPv3 server services must not be configured on products whose primary purpose is not to provide SNMP services. SNMP client services may be configured on the VPN gateway, application, or operating system to allow limited monitoring or querying of the device from by an SNMP server for management purposes. SNMP of any version will not be used to make configuration changes to the device. SNMPv3 must be disabled by default and enabled only if used. SNMP v3 provides security feature enhancements to SNMP, including encryption and message authentication.\r\n\r\nCurrently, the AES cipher block algorithm can be used for both applying cryptographic protection (e.g., encryption) and removing or verifying the protection that was previously applied (e.g., decryption) in DoD. The use of FIPS-approved algorithms for both cryptographic mechanisms is required. If any version of SNMP is used for remote administration, default SNMP community strings such as “public” and “private” should be removed before real community strings are put into place. If the defaults are not removed, an attacker could retrieve real community strings from the device using the default string.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001967</ident><fixtext fixref=\"F-102897r1_fix\">The VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.</fixtext><fix id=\"F-102897r1_fix\" /><check system=\"C-96053r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) is configured to use SNMPv3 to use FIPS-validated AES cipher block algorithm.\r\n\r\nIf the VPN Gateway that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) does not configure SNMPv3 to use FIPS-validated AES cipher block algorithm, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97217\"><title>SRG-NET-000565-VPN-002390</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106355r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000565-VPN-002390</version><title>The VPN Gateway must use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.</title><description>&lt;VulnDiscussion&gt;Use of improperly configured or lower assurance equipment and solutions could compromise high-value information.\r\n\r\nThe National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by the National Institute of Standards and Technology (NIST) and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future Suite B implementations.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002450</ident><fixtext fixref=\"F-102899r1_fix\">Configure the VPN Gateway to use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.</fixtext><fix id=\"F-102899r1_fix\" /><check system=\"C-96055r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network.\r\n\r\nIf the VPN Gateway does not use an approved High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97219\"><title>SRG-NET-000565-VPN-002400</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106357r1_rule\" severity=\"high\" weight=\"10.0\"><version>SRG-NET-000565-VPN-002400</version><title>The IPsec VPN Gateway Internet Key Exchange (IKE) must use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.</title><description>&lt;VulnDiscussion&gt;Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The VPN gateway must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\r\n\r\nRFC 6379 Suite B Cryptographic Suites for IPsec defines four cryptographic user interface suites for deploying IPsec. Each suite provides choices for Encapsulating Security Payload (ESP) and IKE. The four suites are differentiated by the choice of IKE authentication and key exchange, cryptographic algorithm strengths, and whether ESP is to provide both confidentiality and integrity or integrity only. The suite names are based on the Advanced Encryption Standard (AES) mode and AES key length specified for ESP. Two suites are defined for transporting classified information up to SECRET level—one for both confidentiality and integrity and one for integrity only. There are also two suites defined for transporting classified information up to TOP SECRET level.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-002450</ident><fixtext fixref=\"F-102901r1_fix\">Configure the IPsec VPN Gateway Internet Key Exchange (IKE) to use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.</fixtext><fix id=\"F-102901r1_fix\" /><check system=\"C-96057r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the IPsec VPN Gateway Internet Key Exchange (IKE) uses cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network.\r\n\r\nIf the IPsec VPN Gateway Internet Key Exchange (IKE) does not use cryptography that is compliant with Suite B parameters when transporting classified traffic across an unclassified network, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97221\"><title>SRG-NET-000580-VPN-002410</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106359r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000580-VPN-002410</version><title>The VPN Gateway must validate certificates used for Transport Layer Security (TLS) functions by performing RFC 5280-compliant certification path validation.</title><description>&lt;VulnDiscussion&gt;A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate.\r\n\r\nCertification path validation includes checks such as certificate issuer trust, time validity, and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000185</ident><fixtext fixref=\"F-102903r1_fix\">Configure the VPN Gateway to validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.</fixtext><fix id=\"F-102903r1_fix\" /><check system=\"C-96059r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway validates TLS certificates by performing RFC 5280-compliant certification path validation.\r\n\r\nIf the VPN Gateway does not validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97223\"><title>SRG-NET-000585-VPN-002420</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106361r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000585-VPN-002420</version><title>The VPN Gateway must use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).</title><description>&lt;VulnDiscussion&gt;Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Use only SHA-2 for Digital signature generation applications and functions. SHA-2 is strongly preferred for use by DoD for non-signature generation functions.\r\n\r\nAlthough allowed by SP800-131Ar1 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and government standards. Unless required for legacy use, DoD systems should not be configured to use SHA-1 for integrity of remote access sessions. For digital signature verification, SHA-1 is allowed for legacy-use. For all other hash function applications (e.g., HMAC, KDFs, RBG, password hashing, checksum integrity checks), the use of SHA-1 is acceptable, but discouraged in DoD. \r\n\r\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\r\n\r\nFor digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use only if needed for business critical applications.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000803</ident><fixtext fixref=\"F-102905r1_fix\">Configure the VPN Gateway to use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).</fixtext><fix id=\"F-102905r1_fix\" /><check system=\"C-96061r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway uses FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).\r\n\r\nIf the VPN Gateway does not use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use), this is a finding.</check-content></check></Rule></Group><Group id=\"V-97225\"><title>SRG-NET-000075-VPN-000260</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106363r1_rule\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000075-VPN-000260</version><title>If the site-to-site VPN implementation uses L2TP, L2TPv3 sessions must be authenticated prior to transporting traffic.</title><description>&lt;VulnDiscussion&gt;L2TPv3 sessions can be used to transport layer-2 protocols across an IP backbone. These protocols were intended for link-local scope only and are therefore less defended and not as well-known. As stated in DoD IPv6 IA Guidance for MO3 (S4-C7-1), the L2TP tunnels can also carry IP packets that are very difficult to filter because of the additional encapsulation. Hence, it is imperative that L2TP sessions are authenticated prior to transporting traffic.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000068</ident><fixtext fixref=\"F-102907r1_fix\">If the site-to-site VPN implementation uses L2TPv3, configure L2TPv3 sessions to authenticate the traffic before transit.</fixtext><fix id=\"F-102907r1_fix\" /><check system=\"C-96063r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>If L2TP communications protocol is not used, this is not applicable.\r\n\r\nVerify L2TPv3 sessions are configured to authenticate the traffic before transit. L2TPv3 sessions must be authenticated prior to transporting traffic.\r\n\r\nIf L2TPv3 sessions do not require authentication, this is a finding.</check-content></check></Rule></Group></Benchmark>"
  },
  {
    "path": "test/api/form-data-files/U_VPN_SRG_V2R3_Manual-xccdf-reviewKeyChange.xml",
    "content": "<?xml version=\"1.0\" encoding=\"utf-8\"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:cpe=\"http://cpe.mitre.org/language/2.0\" xmlns:xhtml=\"http://www.w3.org/1999/xhtml\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\" id=\"VPN_SRG_OTHER\" xml:lang=\"en\" xsi:schemaLocation=\"http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd\" xmlns=\"http://checklists.nist.gov/xccdf/1.1\"><status date=\"2001-07-26\">accepted</status><title>Virtual Private Network (VPN) Security Requirements Guide - replaced</title><description>This description replaces the old description</description><notice id=\"terms-of-use\" xml:lang=\"en\"></notice><reference href=\"http://public.cyber.mil\"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id=\"release-info\">Release: 3 Benchmark Date: 19 Jul 2021</plain-text><version>2</version><Group id=\"V-97041\"><title>SRG-NET-000019-VPN-000040</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106179r1_yyyy\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000019-VPN-000040</version><title>This rule title has been replaced.</title><description>&lt;VulnDiscussion&gt;Unrestricted traffic may contain malicious traffic which poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\r\n\r\nVPN traffic received from another enclave with different security policy or level of trust must not bypass be inspected by the firewall before being forwarded to the private network.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-001414</ident><fixtext fixref=\"F-102721r1_fix\">Configure the VPN Gateway to ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies (e.g., IPsec policy configuration). Also, configure the VPN gateway to forward encapsulated or encrypted traffic received from other enclaves with different security policies to the perimeter firewall and IDPS before traffic is passed to the private network.</fixtext><fix id=\"F-102721r1_fix\" /><check system=\"C-95877r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway has an inbound and outbound traffic security policy which is in compliance with information flow control policies (e.g., IPsec policy configuration).\r\n\r\nReview network device configurations and topology diagrams. Verify encapsulated or encrypted traffic received from other enclaves with different security policies terminate at the perimeter for filtering and content inspection by a firewall and IDPS before gaining access to the private network.\r\n\r\nIf the VPN Gateway does not ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies, this is a finding.</check-content></check></Rule></Group><Group id=\"V-97043\"><title>SRG-NET-000041-VPN-000110</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id=\"SV-106181r1_yyyyy\" severity=\"medium\" weight=\"10.0\"><version>SRG-NET-000041-VPN-000110</version><title>The Remote Access VPN Gateway and/or client must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the network.</title><description>&lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the network ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\r\n\r\nIn most VPN implementations, the banner is configured in the management backplane (NDM SRG) and serves as the presentation for the VPN client connection as well as for administrator logon to the device management tool/backplane.\r\n\r\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. This requirement applies to VPN gateways that have the concept of a user account and have the logon function residing on the VPN gateway.\r\n\r\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for VPN gateways that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n \r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\r\n\"I've read &amp; consent to terms in IS user agreem't.\"&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description><reference><dc:title>DPMS Target SRG-NET-VPN</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>SRG-NET-VPN</dc:subject><dc:identifier>3463</dc:identifier></reference><ident system=\"http://iase.disa.mil/cci\">CCI-000048</ident><fixtext fixref=\"F-102723r1_fix\">Configure the Remote Access VPN to display the Standard Mandatory DoD Notice and Consent Banner in accordance with DoD policy before granting access to the device. Use the following verbiage for applications that can accommodate banners of 1300 characters:\r\n\r\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\r\n\r\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\r\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\r\n-At any time, the USG may inspect and seize data stored on this IS.\r\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\r\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\r\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\r\n\r\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\r\n\"I've read &amp; consent to terms in IS user agreem't.\"</fixtext><fix id=\"F-102723r1_fix\" /><check system=\"C-95877r1_chk\"><check-content-ref name=\"M\" href=\"DPMS_XCCDF_Benchmark_VPN SRG.xml\" /><check-content>Verify the VPN Gateway has an inbound and outbound traffic security policy which is in compliance with information flow control policies (e.g., IPsec policy configuration).\r\n\r\nReview network device configurations and topology diagrams. Verify encapsulated or encrypted traffic received from other enclaves with different security policies terminate at the perimeter for filtering and content inspection by a firewall and IDPS before gaining access to the private network.\r\n\r\nIf the VPN Gateway does not ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies, this is a finding.</check-content></check></Rule></Group></Benchmark>"
  },
  {
    "path": "test/api/mocha/cross-boundary/lvl1.test.js",
    "content": "import deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\nimport { config } from '../testConfig.js'\nimport * as utils from '../utils/testUtils.js'\nimport reference from '../referenceData.js'\n\nconst user =\n{\n    name: \"lvl1\",\n    grant: \"Restricted\",\n    userId: \"85\",\n    token:\n      \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDg5ODQsImlhdCI6MTY3MDU2ODE4NCwiYXV0aF90aW1lIjoxNjcwNTY4MTg0LCJqdGkiOiIxMDhmMDc2MC0wYmY5LTRkZjEtYjE0My05NjgzNmJmYmMzNjMiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJlM2FlMjdiOC1kYTIwLTRjNDItOWRmOC02MDg5ZjcwZjc2M2IiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjE0ZmE5ZDdkLTBmZTAtNDQyNi04ZmQ5LTY5ZDc0YTZmMzQ2NCIsInNlc3Npb25fc3RhdGUiOiJiNGEzYWNmMS05ZGM3LTQ1ZTEtOThmOC1kMzUzNjJhZWM0YzciLCJhY3IiOiIxIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtc3RpZ21hbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb246cmVhZCIsInNpZCI6ImI0YTNhY2YxLTlkYzctNDVlMS05OGY4LWQzNTM2MmFlYzRjNyIsIm5hbWUiOiJyZXN0cmljdGVkIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibHZsMSIsImdpdmVuX25hbWUiOiJyZXN0cmljdGVkIn0.OqLARi5ILt3j2rMikXy0ECTTqjWco0-CrMwzE88gUv2i8rVO9kMgVsXbtPk2L2c9NNNujnxqg7QIr2_sqA51saTrZHvzXcsT8lBruf74OubRMwcTQqJap-COmrzb60S7512k0WfKTYlHsoCn_uAzOb9sp8Trjr0NksU8OXCElDU\"\n}\nconst admin = {\n    // Has admin and createCollection privileges, standard appdata: Owner roleId in all collections\n    name: \"stigmanadmin\",\n    grant: \"Owner\",\n    userId: \"1\",\n    token:\n      \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ2ODEwMzUsImlhdCI6MTY3MDU0MDIzNiwiYXV0aF90aW1lIjoxNjcwNTQwMjM1LCJqdGkiOiI0N2Y5YWE3ZC1iYWM0LTQwOTgtOWJlOC1hY2U3NTUxM2FhN2YiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJiN2M3OGE2Mi1iODRmLTQ1NzgtYTk4My0yZWJjNjZmZDllZmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjMzNzhkYWZmLTA0MDQtNDNiMy1iNGFiLWVlMzFmZjczNDBhYyIsInNlc3Npb25fc3RhdGUiOiI4NzM2NWIzMy0yYzc2LTRiM2MtODQ4NS1mYmE1ZGJmZjRiOWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIiwiYWRtaW4iXX0sInJlc291cmNlX2FjY2VzcyI6eyJyZWFsbS1tYW5hZ2VtZW50Ijp7InJvbGVzIjpbInZpZXctdXNlcnMiLCJxdWVyeS1ncm91cHMiLCJxdWVyeS11c2VycyJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIHN0aWctbWFuYWdlcjpvcCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIHN0aWctbWFuYWdlcjpvcDpyZWFkIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlciBzdGlnLW1hbmFnZXI6c3RpZyIsInNpZCI6Ijg3MzY1YjMzLTJjNzYtNGIzYy04NDg1LWZiYTVkYmZmNGI5ZiIsIm5hbWUiOiJTVElHTUFOIEFkbWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RpZ21hbmFkbWluIiwiZ2l2ZW5fbmFtZSI6IlNUSUdNQU4iLCJmYW1pbHlfbmFtZSI6IkFkbWluIn0.a1XwJZw_FIzwMXKo-Dr-n11me5ut-SF9ni7ylX-7t7AVrH1eAqyBxX9DXaxFK0xs6YOhoPsh9NyW8UFVaYgtF68Ps6yzoiqFEeiRXkpN5ygICN3H3z6r-YwanLlEeaYR3P2EtHRcrBtCnt0VEKKbGPWOfeiNCVe3etlp9-NQo44\"\n}\n\ndescribe(\"lvl1 cross-boundary tests\", () => {\n    before(async () => {\n        await utils.loadAppData()\n    })\n    describe('GET - getUserObject - /user', () => {\n        it('Return the requesters user information - check user', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/user`, 'GET', user.token)\n\n            //expect(res.status).to.eql(200)\n            expect(res.status).to.eql(200)\n            expect(res.body.username).to.equal(user.name)\n            for(const grant of res.body.collectionGrants) {\n              expect(grant).to.exist\n              expect(grant).to.have.property('collection')\n              expect(grant).to.have.property('roleId')\n              expect(grant.collection).to.have.property('collectionId')\n              expect(grant.collection.collectionId).to.eql(reference.testCollection.collectionId)\n            }\n        })\n    })\n    describe('GET - getReviewByAssetRule - /collections/{collectionId}/reviews/{assetId}/{ruleId}', () => {\n\n        it('Return the Review for an Asset and Rule - expect fail for lvl1', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.ruleIdLvl1NoAccess}?projection=rule&projection=stigs&projection=metadata&projection=history`, 'GET', user.token)\n          expect(res.status).to.eql(204)\n        })\n    })\n    describe('GET - getStigsByCollection - /collections/{collectionId}/stigs', function () {\n\n        it('Return the STIGs mapped in the specified Collection - lvl1 - stigStats check',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs`, 'GET', user.token)\n           \n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(reference.lvl1ValidStigs.length)\n            for(const stig of res.body){\n              expect(reference.lvl1ValidStigs).to.include(stig.benchmarkId)\n              if(stig.benchmarkId === 'Windows_10_STIG_TEST'){\n                expect(stig.ruleCount).to.equal(287)\n                expect(stig.assetCount).to.equal(1)\n              }\n              else {\n                expect(stig.ruleCount).to.equal(81)\n                expect(stig.assetCount).to.equal(3)\n                expect(stig.revisionStr).to.equal(\"V1R1\")\n              }\n             \n            }\n        })\n    })\n    describe('GET - getAsset - /assets/{assetId}', () => {\n        it('Return an Asset (lvl1 user requests w/ 1 of 2 stig grants, check proper AdminStats)', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}?projection=statusStats&projection=stigs`, 'GET', user.token)\n            expect(res.status).to.eql(200)\n            expect(res.body.statusStats.ruleCount).to.equal(81);\n            expect(res.body.statusStats.submittedCount).to.equal(5);\n        })\n        it('Return an Asset (lvl1 user requests w/ ZERO of 2 stig grants, expect fail)', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAssetLvl1NoAccess}?projection=statusStats&projection=stigs`, 'GET', user.token)\n            expect(res.status).to.eql(403)\n           \n        })\n    })\n    describe('GET - getChecklistByCollectionStig - /collections/{collectionId}/checklists/{benchmarkId}/{revisionStr}', function () {\n       \n        it('Return the Checklist for the supplied Collection and STIG-revStr - lvl1 no access, empty array',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/checklists/${'Windows_10_STIG_TEST'}/${'V2R1'}`, 'GET', user.token)\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(0)\n        })\n    })\n    describe('POST - postReviewsByAsset - /collections/{collectionId}/reviews/{assetId}', () => {\n\n        it('Import one or more Reviews from a JSON body - ADMIN - lvl1 asset access', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}`, 'POST', admin.token, [\n                {\n                  ruleId: reference.testRule.ruleId,\n                  result: \"pass\",\n                  detail: \"ADMIN POSTED THIS\",\n                  comment: \"sure\",\n                  autoResult: false,\n                  status: \"submitted\",\n                },\n                {\n                  ruleId: reference.ruleIdLvl1NoAccess,\n                  result: \"pass\",\n                  detail: \"ADMIN POSTED THIS\",\n                  comment: \"sure\",\n                  autoResult: false,\n                  status: \"submitted\",\n                },\n              ])\n            expect(res.status).to.eql(200)\n        })\n        it('Import one or more Reviews from a JSON body - ADMIN - lvl1 no asset access', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAssetLvl1NoAccess}`, 'POST', admin.token, [\n            {\n                ruleId: reference.testRule.ruleId,\n                result: \"pass\",\n                detail: \"ADMIN POSTED THIS\",\n                comment: \"sure\",\n                autoResult: false,\n                status: \"submitted\",\n            },\n            {\n                ruleId: reference.ruleIdLvl1NoAccess,\n                result: \"pass\",\n                detail: \"ADMIN POSTED THIS\",\n                comment: \"sure\",\n                autoResult: false,\n                status: \"submitted\",\n            },\n            ])\n        expect(res.status).to.eql(200)\n        })\n        it('Import one or more Reviews from a JSON body - no Asset Access', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAssetLvl1NoAccess}`, 'POST', user.token, [\n                {\n                \"ruleId\": \"{{testRuleId}}\",\n                \"result\": \"pass\",\n                \"detail\": \"LVL1 POSTED THIS\",\n                \"comment\": \"sure\",\n                \"autoResult\": false,\n                \"status\": \"submitted\"\n                }\n            ])\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body.affected.updated).to.eql(0)\n            expect(res.body.affected.inserted).to.eql(0)\n            expect(res.body.rejected).to.have.lengthOf(1)\n        })\n        it('Import one or more Reviews from a JSON body - no Asset Access - multiple posts', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAssetLvl1NoAccess}`, 'POST', user.token, [\n                {\n                \"ruleId\": \"{{testRuleId}}\",\n                \"result\": \"pass\",\n                \"detail\": \"LVL1 POSTED THIS\",\n                \"comment\": \"sure\",\n                \"autoResult\": false,\n                \"status\": \"submitted\"\n                },\n                {\n                \"ruleId\": \"{{testRuleId-lvl1NoAccess}}\",\n                \"result\": \"pass\",\n                \"detail\": \"LVL1 POSTED THIS\",\n                \"comment\": \"sure\",\n                \"autoResult\": false,\n                \"status\": \"submitted\"\n                }\n            ])\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body.affected.updated).to.eql(0)\n            expect(res.body.affected.inserted).to.eql(0)\n            expect(res.body.rejected).to.have.lengthOf(2)\n        })\n        it('Import one or more Reviews from a JSON body - no STIG-Asset Access', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}`, 'POST', user.token, [\n                {\n                  ruleId: reference.ruleIdLvl1NoAccess,\n                  result: \"pass\",\n                  detail: \"LVL1 POSTED THIS\",\n                  comment: \"sure\",\n                  autoResult: false,\n                  status: \"submitted\",\n                },\n              ])\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body.affected.updated).to.eql(0)\n            expect(res.body.affected.inserted).to.eql(0)\n            expect(res.body.rejected).to.have.lengthOf(1)\n        })\n        it('Import one or more Reviews from a JSON body - no STIG-Asset Access - multiple reviews', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}`, 'POST', user.token, [\n                {\n                \"ruleId\": reference.testRule.ruleId,\n                \"result\": \"pass\",\n                \"detail\": \"LVL1 POSTED THIS\",\n                \"comment\": \"sure\",\n                \"autoResult\": false,\n                \"status\": \"submitted\"\n                },\n                {\n                \"ruleId\": reference.ruleIdLvl1NoAccess,\n                \"result\": \"pass\",\n                \"detail\": \"LVL1 POSTED THIS\",\n                \"comment\": \"sure\",\n                \"autoResult\": false,\n                \"status\": \"submitted\"\n                }\n            ])\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body.affected.updated).to.eql(1)\n            expect(res.body.affected.inserted).to.eql(0)\n            expect(res.body.rejected).to.have.lengthOf(1)\n        })\n    })\n    describe('PATCH - updateCollection - /collections/{collectionId}', function () {\n\n        it('Merge provided properties with a Collection',async function () {\n\n          const patchRequest = {\n            \"metadata\": {\n              \"pocName\": \"poc2Patched\",\n              \"pocEmail\": \"pocEmail@email.com\",\n              \"pocPhone\": \"12342\",\n              \"reqRar\": \"true\"\n            },\n              \"grants\": [\n                  {\n                    \"userId\": \"1\",\n                    \"roleId\": 1\n                  },\n                  {\n                          \"userId\": \"21\",\n                      \"roleId\": 2\n                  },\n                  {\n                          \"userId\": \"44\",\n                      \"roleId\": 3\n                  },\n                  {\n                          \"userId\": \"45\",\n                      \"roleId\": 4\n                  }\n              ]\n          }           \n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}?projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs`, 'PATCH', user.token, patchRequest)\n            expect(res.status).to.eql(403)\n        })\n    })\n    describe('PUT - replaceCollection - /collections/{collectionId}', function () {\n\n        it('Set all properties of a Collection - expect fail for lvl1',async function () {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}?projection=grants&projection=owners&projection=statistics&projection=stigs&projection=assets`, 'PUT', user.token, {\n                    \"name\": \"TEST_{{$randomNoun}}-{{$randomJobType}}\",\n                    \"description\": null,\n                    \"settings\": {\n                      \"fields\": {\n                          \"detail\": {\n                              \"enabled\": \"always\",\n                              \"required\": \"findings\"\n                          },\n                          \"comment\": {\n                              \"enabled\": \"always\",\n                              \"required\": \"findings\"\n                          }\n                      },\n                      \"status\": {\n                          \"canAccept\": true,\n                          \"minAcceptGrant\": 2,\n                          \"resetCriteria\": \"result\"\n                      },\n                      \"history\": {\n                        \"maxReviews\": 11\n                      },\n                      \"importOptions\": {\n                        \"autoStatus\": {\n                            \"fail\": \"submitted\",\n                            \"notapplicable\": \"submitted\",\n                            \"pass\": \"submitted\",\n                        },\n                        \"unreviewed\": \"commented\",\n                        \"unreviewedCommented\": \"informational\",\n                        \"emptyDetail\": \"replace\",\n                        \"emptyComment\": \"ignore\",\n                        \"allowCustom\": true\n                      }\n                    },\n                    \"metadata\": {\n                      \"pocName\": \"poc2Patched\",\n                      \"pocEmail\": \"pocEmail@email.com\",\n                      \"pocPhone\": \"12342\",\n                      \"reqRar\": \"true\"\n                    },\n                      \"grants\": [\n                          {\n                            \"userId\": \"1\",\n                            \"roleId\": 4\n                          },\n                          {\n                                  \"userId\": \"21\",\n                              \"roleId\": 2\n                          },\n                          {\n                                  \"userId\": \"44\",\n                              \"roleId\": 3\n                          },\n                          {\n                                  \"userId\": \"45\",\n                              \"roleId\": 4\n                          }\n                      ]\n                  })\n              expect(res.status).to.eql(403)\n        })\n    })\n    describe('PUT - putReviewByAssetRule - /collections/{collectionId}/reviews/{assetId}/{ruleId}', () => {\n        it('Set all properties of a Review - lvl1 should work', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testRule.ruleId}?projection=rule&projection=history&projection=stigs&projection=metadata`, 'PUT', user.token, {\n                    \"result\": \"pass\",\n                    \"detail\": \"test\\nvisible to lvl1\",\n                    \"comment\": \"sure\",\n                    \"autoResult\": false,\n                    \"status\": \"submitted\"\n                })\n            expect(res.status).to.eql(200)\n        })\n        it('Set all properties of a Review - lvl1 test - no Asset Access', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAssetLvl1NoAccess}/${reference.testCollection.ruleId}?projection=rule&projection=history&projection=stigs&projection=metadata`, 'PUT', user.token, {\n                    \"result\": \"pass\",\n                    \"detail\": \"test\\nvisible to lvl1\",\n                    \"comment\": \"sure\",\n                    \"autoResult\": false,\n                    \"status\": \"submitted\"\n                })\n            expect(res.status).to.eql(403)\n        })\n        it('Set all properties of a Review - lvl1 test - no STIG-Asset Access', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.ruleIdLvl1NoAccess}?projection=rule&projection=history&projection=stigs&projection=metadata`, 'PUT', user.token, {\n                    \"result\": \"pass\",\n                    \"detail\": \"test\\nvisible to lvl1\",\n                    \"comment\": \"sure\",\n                    \"autoResult\": false,\n                    \"status\": \"submitted\"\n                })\n            expect(res.status).to.eql(403)\n        })\n    })\n    describe('PATCH - patchReviewByAssetRule - /collections/{collectionId}/reviews/{assetId}/{ruleId}', () => {\n        it('Merge provided properties with a Review - lvl1 test - noAssetAccess - w admin request check Copy 2', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAssetLvl1NoAccess}/${reference.testCollection.ruleId}`, 'PATCH', user.token, {\n                \"result\": \"pass\",\n                \"detail\": \"LVL1 PATCHED THIS\",\n                \"comment\": \"sure\",\n                \"status\": \"submitted\"\n            })\n            expect(res.status).to.eql(404)\n        })\n        it('Merge provided properties with a Review - lvl1 test - noAssetAccess - w admin request check Copy 2', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.ruleIdLvl1NoAccess}`, 'PATCH', user.token, {\n                \"result\": \"pass\",\n                \"detail\": \"LVL1 PATCHED THIS\",\n                \"comment\": \"sure\",\n                \"status\": \"submitted\"\n            })\n            expect(res.status).to.eql(404)\n        })\n    })\n    describe('DELETE - deleteReviewByAssetRule - /collections/{collectionId}/reviews/{assetId}/{ruleId}', () => {\n        it('Delete a Review - lvl1 test - noAssetAccess', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAssetLvl1NoAccess}/${reference.testAsset.testRuleId}?projection=rule&projection=history&projection=stigs`, 'DELETE', user.token)\n            expect(res.status).to.eql(403)\n        })\n        it('Delete a Review - lvl1 test - no STIG-Asset Access', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.ruleIdLvl1NoAccess}?projection=rule&projection=history&projection=stigs`, 'DELETE', user.token)\n            expect(res.status).to.eql(403)\n        })\n    })\n    describe('GET - getReviewMetadataValue - /collections/{collectionId}/reviews/{assetId}/{ruleId}/metadata/keys/{key}', () => {\n   \n      it('Should throw SmError.PrivilegeError no access to review rule', async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.scrapRuleIdWindows10}/metadata/keys/notakey`, 'GET', user.token)\n        expect(res.status).to.eql(403)\n        expect(res.body.error).to.be.equal(\"User has insufficient privilege to complete this request.\")\n      })\n    })\n    describe('PUT - putReviewMetadataValue - /collections/{collectionId}/reviews/{assetId}/{ruleId}/metadata/keys/{key}', () => {\n\n      it('should throw SmError.PrivilegeError User has insufficient privilege to put the review of this rule. no acess to review rule', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.scrapRuleIdWindows10}/metadata/keys/${reference.reviewMetadataKey}`, 'PUT', user.token, `${JSON.stringify(reference.reviewMetadataValue)}`)\n          expect(res.status).to.eql(403)\n          expect(res.body.error).to.be.equal(\"User has insufficient privilege to complete this request.\")\n      })\n    })\n    describe('DELETE - deleteReviewMetadataKey - /collections/{collectionId}/reviews/{assetId}/{ruleId}/metadata/keys/{key}', () => {\n\n      it('should throw SmError.PrivilegeError User has insufficient privilege to delete the review of this rule. no acess to review rule', async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.scrapRuleIdWindows10}/metadata/keys/${reference.reviewMetadataKey}`, 'DELETE', user.token, `${JSON.stringify(reference.reviewMetadataValue)}`)\n        expect(res.status).to.eql(403)\n        expect(res.body.error).to.be.equal(\"User has insufficient privilege to complete this request.\")\n      })\n    })\n\n})\n\n\n"
  },
  {
    "path": "test/api/mocha/data/acl/directAcl.test.js",
    "content": "\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\nimport { config } from '../../testConfig.js'\nconst baseUrl = config.baseUrl\nconst adminToken = config.adminToken\nimport * as utils from '../../utils/testUtils.js'\nimport reference from './referenceData.js'\nimport {iterations} from './directIterations.js'\n\nconst user = {\n  name: 'lvl1',\n  userId: '85',\n  token:\n    'eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDg5ODQsImlhdCI6MTY3MDU2ODE4NCwiYXV0aF90aW1lIjoxNjcwNTY4MTg0LCJqdGkiOiIxMDhmMDc2MC0wYmY5LTRkZjEtYjE0My05NjgzNmJmYmMzNjMiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJlM2FlMjdiOC1kYTIwLTRjNDItOWRmOC02MDg5ZjcwZjc2M2IiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjE0ZmE5ZDdkLTBmZTAtNDQyNi04ZmQ5LTY5ZDc0YTZmMzQ2NCIsInNlc3Npb25fc3RhdGUiOiJiNGEzYWNmMS05ZGM3LTQ1ZTEtOThmOC1kMzUzNjJhZWM0YzciLCJhY3IiOiIxIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtc3RpZ21hbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb246cmVhZCIsInNpZCI6ImI0YTNhY2YxLTlkYzctNDVlMS05OGY4LWQzNTM2MmFlYzRjNyIsIm5hbWUiOiJyZXN0cmljdGVkIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibHZsMSIsImdpdmVuX25hbWUiOiJyZXN0cmljdGVkIn0.OqLARi5ILt3j2rMikXy0ECTTqjWco0-CrMwzE88gUv2i8rVO9kMgVsXbtPk2L2c9NNNujnxqg7QIr2_sqA51saTrZHvzXcsT8lBruf74OubRMwcTQqJap-COmrzb60S7512k0WfKTYlHsoCn_uAzOb9sp8Trjr0NksU8OXCElDU'\n}\n\nlet grantId\n\ndescribe('GET - Test Effective ACL', () => {\n  before(async () => {\n    await utils.loadAppData()\n  })\n  describe(`getEffectiveAclByCollectionUser - /collections/{collectionId}/users/{userId}/effective-acl`, () => {\n\n\n    it(\"should give lvl1 user restricted access to test collection\", async () => {\n      const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', config.adminToken, [{\n            userId: user.userId,\n            roleId: 1\n          }])\n      grantId = res.body[0].grantId\n      expect(res.status).to.eql(201)\n    })\n\n    for(const iteration of iterations){\n      \n      describe(`iteration:${iteration.name}`, () => {\n        it(`should set lvl1 users ACL: ${iteration.name}`, async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${grantId}/acl`, 'PUT', config.adminToken, iteration.put)\n\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal('none')\n        })\n\n        it(\"should confirm users acl was set\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${grantId}/acl`, 'GET', config.adminToken)\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal('none')\n          expect(res.body.acl.length).to.equal(iteration.put.length)\n\n          for (const acl of iteration.put) {\n            // Look for an exact match in res.body.acl that satisfies all specified conditions\n            const exactMatch = res.body.acl.find(\n              a =>\n                (acl.assetId ? a.asset?.assetId === acl.assetId : true) &&\n                (acl.labelId ? a.label?.labelId === acl.labelId : true) &&\n                (acl.benchmarkId ? a.benchmarkId === acl.benchmarkId : true) &&\n                (acl.access ? a.access === acl.access : true)\n            )\n            // Check if an exact match was found\n            expect(exactMatch).to.not.be.undefined\n\n            // Verify each specified field to ensure full match\n            if (acl.assetId) {\n              expect(exactMatch.asset.assetId).to.equal(acl.assetId)\n            }\n            if (acl.labelId) {\n              expect(exactMatch.label.labelId).to.equal(acl.labelId)\n            }\n            if (acl.benchmarkId) {\n              expect(exactMatch.benchmarkId).to.equal(acl.benchmarkId)\n            }\n            if (acl.access) {\n              expect(exactMatch.access).to.equal(acl.access)\n            }\n          }\n        })\n\n        it('should return 200 and the effective acl for the iteration', async () => {\n          const res = await utils.executeRequest(`${baseUrl}/collections/${reference.testCollection.collectionId}/users/${user.userId}/effective-acl`, 'GET', adminToken)\n          expect(res.status).to.eql(200)\n\n          const putAcl = iteration.put\n          expect(res.body).to.deep.equalInAnyOrder(iteration.response)\n        })\n      })\n    }\n  })\n})\n"
  },
  {
    "path": "test/api/mocha/data/acl/directIterations.js",
    "content": "import reference from '../../referenceData.js'\nexport const iterations = [\n  {\n    \n    name: 'label_rw',\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}],\n    response: [\n     {\n       access: \"rw\",\n       asset: {\n         name: reference.testAsset.name,\n         assetId: reference.testAsset.assetId,\n       },\n       benchmarkId: reference.benchmark,\n       aclSources: [\n         {\n           aclRule: {\n             label: {\n               name: reference.testCollection.fullLabelName,\n               labelId: reference.testCollection.fullLabel,\n             },\n             access: \"rw\",\n           },\n           grantee: {\n             userId: \"85\",\n             username: \"lvl1\",\n             roleId: 1,\n           },\n         },\n       ],\n     },\n     {\n       access: \"rw\",\n       asset: {\n         name: reference.testAsset.name,\n         assetId: reference.testAsset.assetId,\n       },\n       benchmarkId: reference.windowsBenchmark,\n       aclSources: [\n         {\n           aclRule: {\n             label: {\n               name: reference.testCollection.fullLabelName,\n               labelId: reference.testCollection.fullLabel,\n             },\n             access: \"rw\",\n           },\n           grantee: {\n             userId: \"85\",\n             username: \"lvl1\",\n             roleId: 1,\n           },\n         },\n       ],\n     },\n     {\n       access: \"rw\",\n       asset: {\n         name: \"Collection_X_asset\",\n         assetId: \"62\",\n       },\n       benchmarkId: reference.testCollection.benchmark,\n       aclSources: [\n         {\n           aclRule: {\n             label: {\n               name: reference.testCollection.fullLabelName,\n               labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n             },\n             access: \"rw\",\n           },\n           grantee: {\n             userId: \"85\",\n             username: \"lvl1\",\n             roleId: 1,\n           },\n         },\n       ],\n     },\n     {\n       access: \"rw\",\n       asset: {\n         name: \"Collection_X_asset\",\n         assetId: \"62\",\n       },\n       benchmarkId: reference.windowsBenchmark,\n       aclSources: [\n         {\n           aclRule: {\n             label: {\n               name: reference.testCollection.fullLabelName,\n               labelId: reference.testCollection.fullLabel,\n             },\n             access: \"rw\",\n           },\n           grantee: {\n             userId: \"85\",\n             username: \"lvl1\",\n             roleId: 1,\n           },\n         },\n       ],\n     },\n    ]\n  },\n  {\n    name: 'label_r',\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}],\n        response: [\n          {\n            access: \"r\",\n            asset: {\n              name: reference.testAsset.name,\n              assetId: reference.testAsset.assetId,\n            },\n            benchmarkId: reference.benchmark,\n            aclSources: [\n              {\n                aclRule: {\n                  label: {\n                    name: reference.testCollection.fullLabelName,\n                    labelId: reference.testCollection.fullLabel,\n                  },\n                  access: \"r\",\n                },\n                grantee: {\n                  userId: \"85\",\n                  username: \"lvl1\",\n                  roleId: 1,\n                },\n              },\n            ],\n          },\n          {\n            access: \"r\",\n            asset: {\n              name: reference.testAsset.name,\n              assetId: reference.testAsset.assetId,\n            },\n            benchmarkId: reference.windowsBenchmark,\n            aclSources: [\n              {\n                aclRule: {\n                  label: {\n                    name: reference.testCollection.fullLabelName,\n                    labelId: reference.testCollection.fullLabel,\n                  },\n                  access: \"r\",\n                },\n                grantee: {\n                  userId: \"85\",\n                  username: \"lvl1\",\n                  roleId: 1,\n                },\n              },\n            ],\n          },\n          {\n            access: \"r\",\n            asset: {\n              name: \"Collection_X_asset\",\n              assetId: \"62\",\n            },\n            benchmarkId: reference.testCollection.benchmark,\n            aclSources: [\n              {\n                aclRule: {\n                  label: {\n                    name: reference.testCollection.fullLabelName,\n                    labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n                  },\n                  access: \"r\",\n                },\n                grantee: {\n                  userId: \"85\",\n                  username: \"lvl1\",\n                  roleId: 1,\n                },\n              },\n            ],\n          },\n          {\n            access: \"r\",\n            asset: {\n              name: \"Collection_X_asset\",\n              assetId: \"62\",\n            },\n            benchmarkId: reference.windowsBenchmark,\n            aclSources: [\n              {\n                aclRule: {\n                  label: {\n                    name: reference.testCollection.fullLabelName,\n                    labelId: reference.testCollection.fullLabel,\n                  },\n                  access: \"r\",\n                },\n                grantee: {\n                  userId: \"85\",\n                  username: \"lvl1\",\n                  roleId: 1,\n                },\n              },\n            ],\n          },\n        ]\n  },\n  {\n    name: 'label_none',\n    put:[{\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"}],\n    response: []\n  },\n  {\n    name: 'benchmark_rw',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: 'benchmark_r',\n    put:[{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n   \n  },\n  {\n    name: 'benchmark_none',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"none\"}],\n    response: []\n  \n   \n  },\n  {\n    name: 'asset_rw',\n   \n    put: [{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: 'asset_r',\n    put: [{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: 'asset_none',\n    put: [{\"assetId\":reference.testAsset.assetId,\"access\":\"none\"}],\n    response: []\n  },\n  {\n    name: 'assetBenchmark_rw',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n   \n  },\n  {\n    name: 'assetBenchmark_r',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n        response: [\n          {\n            access: \"r\",\n            asset: {\n              name: reference.testAsset.name,\n              assetId: reference.testAsset.assetId,\n            },\n            benchmarkId: reference.testCollection.benchmark,\n            aclSources: [\n              {\n                aclRule: {\n                  asset: {\n                    name: reference.testAsset.name,\n                    assetId: reference.testAsset.assetId,\n                  },\n                  access: \"r\",\n                  benchmarkId: reference.testCollection.benchmark,\n                },\n                grantee: {\n                  userId: \"85\",\n                  username: \"lvl1\",\n                  roleId: 1,\n                },\n              },\n            ],\n          }\n        ]\n   \n  },\n  {\n    name: 'assetBenchmark_none',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"none\"}],\n    response: []\n  },\n  {\n    name: 'labelBenchmark_rw',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}],\n        response: [\n          {\n            access: \"rw\",\n            asset: {\n              name: reference.testAsset.name,\n              assetId: reference.testAsset.assetId,\n            },\n            benchmarkId: reference.testCollection.benchmark,\n            aclSources: [\n              {\n                aclRule: {\n                  label: {\n                    name: reference.testCollection.fullLabelName,\n                    labelId: reference.testCollection.fullLabel,\n                  },\n                  access: \"rw\",\n                  benchmarkId: reference.testCollection.benchmark,\n                },\n                grantee: {\n                  userId: \"85\",\n                  username: \"lvl1\",\n                  roleId: 1,\n                },\n              },\n            ],\n          },\n          {\n            access: \"rw\",\n            asset: {\n              name: \"Collection_X_asset\",\n              assetId: \"62\",\n            },\n            benchmarkId: reference.testCollection.benchmark,\n            aclSources: [\n              {\n                aclRule: {\n                  label: {\n                    name: reference.testCollection.fullLabelName,\n                    labelId: reference.testCollection.fullLabel,\n                  },\n                  access: \"rw\",\n                  benchmarkId: reference.testCollection.benchmark,\n                },\n                grantee: {\n                  userId: \"85\",\n                  username: \"lvl1\",\n                  roleId: 1,\n                },\n              },\n            ],\n          }\n        ]\n  },\n  {\n    name: 'labelBenchmark_r',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\", \n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: 'labelBenchmark_none',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"}],\n    response: []\n  },\n  {\n    name: 'asset_rw_asset_rw',\n    put:[{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"},{\"assetId\":\"154\",\"access\":\"rw\"}],\n    response: [\n    {\n      access: \"rw\",\n      asset: {\n        name: reference.testAsset.name,\n        assetId: reference.testAsset.assetId,\n      },\n      benchmarkId: reference.testCollection.benchmark,\n      aclSources: [\n        {\n          aclRule: {\n            asset: {\n              name: reference.testAsset.name,\n              assetId: reference.testAsset.assetId,\n            },\n            access: \"rw\",\n          },\n          grantee: {\n            userId: \"85\",\n            username: \"lvl1\",\n            roleId: 1,\n          },\n        },\n      ],\n    },\n    {\n      access: \"rw\",\n      asset: {\n        name: reference.testAsset.name,\n        assetId: reference.testAsset.assetId,\n      },\n      benchmarkId: reference.windowsBenchmark,\n      aclSources: [\n        {\n          aclRule: {\n            asset: {\n              name: reference.testAsset.name,\n              assetId: reference.testAsset.assetId,\n            },\n            access: \"rw\",\n          },\n          grantee: {\n            userId: \"85\",\n            username: \"lvl1\",\n            roleId: 1,\n          },\n        },\n      ],\n    },\n    {\n      access: \"rw\",\n      asset: {\n        name: \"Collection_X_lvl1_asset-2\",\n        assetId: \"154\",\n      },\n      benchmarkId: reference.windowsBenchmark,\n      aclSources: [\n        {\n          aclRule: {\n            asset: {\n              name: \"Collection_X_lvl1_asset-2\",\n              assetId: \"154\",\n            },\n            access: \"rw\",\n          },\n          grantee: {\n            userId: \"85\",\n            username: \"lvl1\",\n            roleId: 1,\n          },\n        },\n      ],\n    },\n    {\n      access: \"rw\",\n      asset: {\n        name: \"Collection_X_lvl1_asset-2\",\n        assetId: \"154\",\n      },\n      benchmarkId: reference.testCollection.benchmark,\n      aclSources: [\n        {\n          aclRule: {\n            asset: {\n              name: \"Collection_X_lvl1_asset-2\",\n              assetId: \"154\",\n            },\n            access: \"rw\",\n          },\n          grantee: {\n            userId: \"85\",\n            username: \"lvl1\",\n            roleId: 1,\n          },\n        },\n      ],\n    }\n    ]\n  },\n  {\n    name: 'asset_rw_asset_r',\n    put: [{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"},{\"assetId\":\"154\",\"access\":\"r\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: 'asset_rw_asset_none',\n    put: [{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"},{\"assetId\":\"154\",\"access\":\"none\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: 'asset_r_asset_r',\n    put: [{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"},{\"assetId\":\"154\",\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: 'assetBenchmark_rw_label_rw',\n    put:[{\"benchmarkId\":reference.windowsBenchmark,\"assetId\":\"62\",\"access\":\"rw\"},{\"labelId\":reference.testCollection.lvl1Label,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.lvl1LabelName,\n                labelId: reference.testCollection.lvl1Label,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.lvl1LabelName,\n                labelId: reference.testCollection.lvl1Label,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\"\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_asset\",\n                assetId: \"62\"\n              },\n              access: \"rw\",\n              benchmarkId: reference.windowsBenchmark\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: 'assetBenchmark_rw_label_r',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"154\",\"access\":\"rw\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"rw\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ]\n      }\n    ]\n  },\n  {\n    name: \"assetBenchark_r_label_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"154\",\"access\":\"r\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"r\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ]\n      }\n    ]\n  },\n  {\n    name: \"assetBenchmark_none_label_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"62\",\"access\":\"none\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        \"access\": \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"assetBenchmark_none_label_r\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"62\",\"access\":\"none\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        \"access\": \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"assetBenchmark_rw_benchmark_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"42\",\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n     \n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  { \n    name: \"assetBenchmark_rw_benchmark_r\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"42\",\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n     \n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  { \n    name: \"assetBenchmark_r_benchmark_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"42\",\"access\":\"r\"},{\"benchmarkId\":reference.benchmark,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"r\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n   \n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  { \n    name: \"assetBenchmark_r_benchmark_r\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"42\",\"access\":\"r\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"r\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n     \n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  { \n    name: \"assetBenchmark_none_benchmark_r\",\n    put: [{\"benchmarkId\":reference.windowsBenchmark, \"assetId\":\"42\",\"access\":\"none\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"assetBenchmark_rw_assetBenchmark_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              benchmarkId: reference.windowsBenchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"assetBenchmark_rw_assetBenchmark_r\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              benchmarkId: reference.windowsBenchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"assetBenchmark_r_assetBenchmark_r\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"r\"},{\"benchmarkId\":reference.windowsBenchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              benchmarkId: reference.testCollection.benchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              benchmarkId: reference.windowsBenchmark,\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"label_rw_benchmark_rw\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_rw_benchmark_r\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_rw_benchmark_none\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"none\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_none_benchmark_r\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_r_benchmark_r\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_rw_asset_rw\",\n    // 154 is not in the label we are adding it on\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"assetId\":\"154\",\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n        \n      },\n    ]\n  },\n  {\n    name: \"label_rw_asset_r\",\n    // 62 is in label should be made to r\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"assetId\":\"62\",\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              asset: {\n                name: \"Collection_X_asset\",\n                assetId: \"62\",\n              },\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              asset: {\n                name: \"Collection_X_asset\",\n                assetId: \"62\",\n              },\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_rw_asset_none\",\n    // 62 is in label should gone now\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"assetId\":\"62\",\"access\":\"none\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_r_asset_rw\",\n    // 62 is in label should be made to rw all else is r\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"assetId\":\"62\",\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_r_asset_none\",\n    // removes 62\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"assetId\":\"62\",\"access\":\"none\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_r_asset_r\",\n    // all read\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"assetId\":\"154\",\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_rw_label_rw\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.lvl1LabelName,\n                labelId: reference.testCollection.lvl1Label,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          }\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources:  [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.lvl1LabelName,\n                labelId: reference.testCollection.lvl1Label,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          }\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n     ]\n  },\n  {\n    name: \"label_rw_label_r\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.lvl1LabelName,\n                labelId: reference.testCollection.lvl1Label,\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          }\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources:  [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.lvl1LabelName,\n                labelId: reference.testCollection.lvl1Label,\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          }\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n     ]\n  },\n  {\n    name: \"label_rw_label_none\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"none\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n     ]\n  },\n  {\n    name: \"label_none_label_r\",\n    // no asssets cuz all in label full\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"},{\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"r\"}],\n    response: [\n    ]\n  },\n  {\n    name: \"benchmark_rw_asset_r\",\n    // test asset is r\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n      response: [\n        {\n          access: \"r\",\n          asset: {\n            name: reference.testAsset.name,\n            assetId: reference.testAsset.assetId,\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                asset: {\n                  name: reference.testAsset.name,\n                  assetId: reference.testAsset.assetId,\n                },\n                access: \"r\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        },\n        {\n          access: \"r\",\n          asset: {\n            name: reference.testAsset.name,\n            assetId: reference.testAsset.assetId,\n          },\n          benchmarkId: reference.windowsBenchmark,\n          aclSources: [\n            {\n              aclRule: {\n                asset: {\n                  name: reference.testAsset.name,\n                  assetId: reference.testAsset.assetId,\n                },\n                access: \"r\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        },\n        {\n          access: \"rw\",\n          asset: {\n            name: \"Collection_X_asset\",\n            assetId: \"62\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"rw\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        },\n        {\n          access: \"rw\",\n          asset: {\n            name: \"Collection_X_lvl1_asset-2\",\n            assetId: \"154\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"rw\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        }\n    ]\n  },\n  {\n    name: \"benchmark_rw_asset_none\",\n    // test asset is removes\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"none\"}],\n      response: [\n        {\n          access: \"rw\",\n          asset: {\n            name: \"Collection_X_asset\",\n            assetId: \"62\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"rw\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        },\n        {\n          access: \"rw\",\n          asset: {\n            name: \"Collection_X_lvl1_asset-2\",\n            assetId: \"154\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"rw\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        }\n    ]\n  },\n  {\n    name: \"benchmark_r_asset_rw\",\n    // test asset is r\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"}],\n      response: [\n        {\n          access: \"r\",\n          asset: {\n            name: reference.testAsset.name,\n            assetId: reference.testAsset.assetId,\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"r\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        },\n        {\n          access: \"rw\",\n          asset: {\n            name: reference.testAsset.name,\n            assetId: reference.testAsset.assetId,\n          },\n          benchmarkId: reference.windowsBenchmark,\n          aclSources: [\n            {\n              aclRule: {\n                asset: {\n                  name: reference.testAsset.name,\n                  assetId: reference.testAsset.assetId,\n                },\n                access: \"rw\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        },\n        {\n          access: \"r\",\n          asset: {\n            name: \"Collection_X_asset\",\n            assetId: \"62\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"r\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        },\n        {\n          access: \"r\",\n          asset: {\n            name: \"Collection_X_lvl1_asset-2\",\n            assetId: \"154\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"r\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        }\n    ]\n  },\n  {\n    name: \"benchmark_r_asset_r\",\n    // test asset is r\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n      response: [\n        {\n          access: \"r\",\n          asset: {\n            name: reference.testAsset.name,\n            assetId: reference.testAsset.assetId,\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"r\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n            {\n              aclRule: {\n                asset: {\n                  name: reference.testAsset.name,\n                  assetId: reference.testAsset.assetId,\n                },\n                access: \"r\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            }\n          ],\n        },\n        {\n          access: \"r\",\n          asset: {\n            name: reference.testAsset.name,\n            assetId: reference.testAsset.assetId,\n          },\n          benchmarkId: reference.windowsBenchmark,\n          aclSources: [\n            {\n              aclRule: {\n                asset: {\n                  name: \"Collection_X_lvl1_asset-1\",\n                  assetId: \"42\",\n                },\n                access: \"r\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        },\n        {\n          access: \"r\",\n          asset: {\n            name: \"Collection_X_asset\",\n            assetId: \"62\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"r\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        },\n        {\n          access: \"r\",\n          asset: {\n            name: \"Collection_X_lvl1_asset-2\",\n            assetId: \"154\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"r\",\n              },\n              grantee: {\n                userId: \"85\",\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        }\n    ]\n  },\n  {\n    name: \"benchmark_none_asset_r\",\n    // test asset is r\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"none\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n      response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"benchmark_rw_benchmark_rw\",\n     // asset stig for both \n    put:  [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.windowsBenchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.windowsBenchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.windowsBenchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"benchmark_rw_benchmark_r\",\n     // asset stig for both \n    put:  [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.windowsBenchmark,\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.windowsBenchmark,\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.windowsBenchmark,\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"benchmark_rw_benchmark_none\",\n     // asset stig for both \n    put:  [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"none\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_label_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"rw\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}], // doesnt do anything, tie at asset 42 but same access\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_label_r\",\n  // collsion at asset 42 rw wins becauselabel+ bnechmark is more accurate\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"rw\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}], \n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_r_label_rw\",\n    //label bechmark wins at asset 42 VPN for rw \n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"rw\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}], \n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_r_label_r\",\n   // does nothing all r\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"r\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}], \n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_r_label_none\",\n   // tie at asset 42 and labelBNenchmark wins so we wiill only return that \n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"r\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"}], \n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"labelBenchmark_none_label_rw\",\n   // labelBencahark none wins so we will remove intersection of assets which is asset 42 with VPN\n    put:[{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"none\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_benchmark_rw\",\n    // adds benchmark + labelBenchmark the bnechmarks added will be asset 62 and 42 cuz they have VPN test stig \n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_benchmark_r\",\n    // collsion on the asset not in the label, resolve to read \n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response:\n    [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_benchmark_none\",\n    // gives just the two assets in the labels as rw like the bnechmark doenst apply\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"none\"}],\n    response:\n    [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"labelBenchmark_r_benchmark_r\",\n    // gives just the two assets in the labels as rw like the bnechmark doenst apply\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response:\n    [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_none_benchmark_r\",\n    // gives just the two assets in the labels as rw like the bnechmark doenst apply\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response:\n    [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_none_asset_none\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"none\"}],\n    response: []\n  },\n  {\n    name: \"labelBenchmark_rw_asset_rw\",\n    // adds asset to labelBenchamark 154 is not in label \n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"assetId\":\"154\",\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_asset_r\",\n    // changes just the asset windows to r test asset vpn stgarts rw cuz labelBenchmark beats just asset\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_asset_none\",\n    // all rw for Vpn because the label benchmark wins!\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_r_asset_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_none_asset_rw\",\n    // none wins besides windows stig\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_assetBenchmark_rw\",\n    // adds asset benchmark its not in the label\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"assetId\":\"154\",\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"rw\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_assetBenchmark_r\",\n    // adds asset benchmark its not in the label\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}], // changes asset to r,\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_assetBenchmark_none\",\n    // adds asset benchmark its not in the label\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"none\"}], // remvoe asset\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_r_assetBenchmark_rw\",\n    // asset 62 is r\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}], // changes asset to r,\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_none_assetBenchmark_r\",\n    // asset 62 is r\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"},{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}], // changes asset to r,\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_labelBenchmark_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_labelBenchmark_r\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    \n      name: \"labelBenchmark_r_labelBenchmark_r\",\n      put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"r\"},{\"benchmarkId\":reference.windowsBenchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}],\n      response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n    \n  },\n  {\n    \n    name: \"labelBenchmark_r_labelBenchmark_none\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"r\"},{\"benchmarkId\":reference.windowsBenchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"}],\n    response: [\n    {\n      access: \"r\",\n      asset: {\n        name: \"Collection_X_lvl1_asset-1\",\n        assetId: \"42\",\n      },\n      benchmarkId: \"VPN_SRG_TEST\",\n      aclSources: [\n        {\n          aclRule: {\n            label: {\n              name: \"test-label-lvl1\",\n              labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n            },\n            access: \"r\",\n            benchmarkId: \"VPN_SRG_TEST\",\n          },\n          grantee: {\n            userId: \"85\",\n            username: \"lvl1\",\n            roleId: 1,\n          },\n        },\n      ],\n    },\n  ]\n  \n  },\n  {\n    name: \"label_rw_benchmark_r_asset_none\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"none\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"assetBenchmark_none_label_rw_benchmark_r\",\n    put: [{\"assetId\":reference.testAsset.assetId, benchmarkId: reference.testCollection.benchmark,\"access\":\"none\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response:[\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"assetBenchmark_r_benchmark_none_asset_rw\",\n    put: [{\"assetId\":reference.testAsset.assetId, benchmarkId: reference.testCollection.benchmark,\"access\":\"r\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"none\"},{\"assetId\":\"154\",\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_rw_asset_r_asset_r\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"},{\"assetId\":\"62\",\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_asset\",\n                assetId: \"62\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_asset\",\n                assetId: \"62\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_r_benchmark_rw_benchmark_none\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"none\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"assetBenchmark_rw_asset_rw_asset_rw\",\n    put: [{\"assetId\":reference.testAsset.assetId, benchmarkId: reference.testCollection.benchmark,\"access\":\"rw\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"},{\"assetId\":\"154\",\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userId: \"85\",\n              username: \"lvl1\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n    ]\n  },\n  \n]\n"
  },
  {
    "path": "test/api/mocha/data/acl/groupAcl.test.js",
    "content": "\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from './referenceData.js'\nimport {iterations} from './groupIterations.js'\n\nconst user = {\n    name: 'lvl1',\n    userId: '85', \n    token:\n    'eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDg5ODQsImlhdCI6MTY3MDU2ODE4NCwiYXV0aF90aW1lIjoxNjcwNTY4MTg0LCJqdGkiOiIxMDhmMDc2MC0wYmY5LTRkZjEtYjE0My05NjgzNmJmYmMzNjMiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJlM2FlMjdiOC1kYTIwLTRjNDItOWRmOC02MDg5ZjcwZjc2M2IiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjE0ZmE5ZDdkLTBmZTAtNDQyNi04ZmQ5LTY5ZDc0YTZmMzQ2NCIsInNlc3Npb25fc3RhdGUiOiJiNGEzYWNmMS05ZGM3LTQ1ZTEtOThmOC1kMzUzNjJhZWM0YzciLCJhY3IiOiIxIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtc3RpZ21hbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb246cmVhZCIsInNpZCI6ImI0YTNhY2YxLTlkYzctNDVlMS05OGY4LWQzNTM2MmFlYzRjNyIsIm5hbWUiOiJyZXN0cmljdGVkIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibHZsMSIsImdpdmVuX25hbWUiOiJyZXN0cmljdGVkIn0.OqLARi5ILt3j2rMikXy0ECTTqjWco0-CrMwzE88gUv2i8rVO9kMgVsXbtPk2L2c9NNNujnxqg7QIr2_sqA51saTrZHvzXcsT8lBruf74OubRMwcTQqJap-COmrzb60S7512k0WfKTYlHsoCn_uAzOb9sp8Trjr0NksU8OXCElDU'\n}\n\ndescribe('GET- getEffectiveAclByCollectionUser - /collections/{collectionId}/users/{userId}/effective-acl - Test Effective ACL from Group Grant', () => {\n\n  before(async () => {\n    await utils.loadAppData()\n  })\n\n  for(const iteration of iterations){\n \n    describe(`iteration:${iteration.name}`, () => {\n      \n      it(`should set test groups ACL: ${iteration.name}`, async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.grantId}/acl`, 'PUT', config.adminToken, iteration.put)\n\n        expect(res.status).to.eql(200)\n        expect(res.body.defaultAccess).to.equal(\"none\")\n      })\n\n      it(\"should confirm group acl was set\", async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.grantId}/acl`, 'GET', config.adminToken)\n        expect(res.status).to.eql(200)\n        expect(res.body.defaultAccess).to.equal(\"none\")\n        expect(res.body.acl.length).to.equal(iteration.put.length)\n        \n        for (const acl of iteration.put) {\n          // Look for an exact match in res.body.acl that satisfies all specified conditions\n          const exactMatch = res.body.acl.find(a => \n            (acl.assetId ? a.asset?.assetId === acl.assetId : true) &&\n            (acl.labelId ? a.label?.labelId === acl.labelId : true) &&\n            (acl.benchmarkId ? a.benchmarkId === acl.benchmarkId : true) &&\n            (acl.access ? a.access === acl.access : true)\n          )\n          // Check if an exact match was found\n          expect(exactMatch).to.not.be.undefined\n        \n          // Verify each specified field to ensure full match\n          if (acl.assetId) {\n            expect(exactMatch.asset.assetId).to.equal(acl.assetId)\n          }\n          if (acl.labelId) {\n            expect(exactMatch.label.labelId).to.equal(acl.labelId)\n          }\n          if (acl.benchmarkId) {\n            expect(exactMatch.benchmarkId).to.equal(acl.benchmarkId)\n          }\n          if (acl.access) {\n            expect(exactMatch.access).to.equal(acl.access)\n          }\n        }\n      })\n\n      it('should return 200 and the effective acl for the iteration', async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${user.userId}/effective-acl`, 'GET', config.adminToken)\n        expect(res.status).to.eql(200)\n\n        const putAcl = iteration.put\n        expect(res.body).to.deep.equalInAnyOrder(iteration.response)\n      })\n    })\n  }\n})\n"
  },
  {
    "path": "test/api/mocha/data/acl/groupIterations.js",
    "content": "import reference from '../../referenceData.js'\nexport const iterations = [\n  {\n    name: 'label_rw',\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}],\n    response: [\n     {\n       access: \"rw\",\n       asset: {\n         name: reference.testAsset.name,\n         assetId: reference.testAsset.assetId,\n       },\n       benchmarkId: reference.benchmark,\n       aclSources: [\n         {\n           aclRule: {\n             label: {\n               name: reference.testCollection.fullLabelName,\n               labelId: reference.testCollection.fullLabel,\n             },\n             access: \"rw\",\n           },\n            grantee: {\n            userGroupId: \"1\",\n            name: \"TestGroup\",\n            roleId: 1,\n          },\n         },\n       ],\n     },\n     {\n       access: \"rw\",\n       asset: {\n         name: reference.testAsset.name,\n         assetId: reference.testAsset.assetId,\n       },\n       benchmarkId: reference.windowsBenchmark,\n       aclSources: [\n         {\n           aclRule: {\n             label: {\n               name: reference.testCollection.fullLabelName,\n               labelId: reference.testCollection.fullLabel,\n             },\n             access: \"rw\",\n           },\n            grantee: {\n            userGroupId: \"1\",\n            name: \"TestGroup\",\n            roleId: 1,\n          },\n         },\n       ],\n     },\n     {\n       access: \"rw\",\n       asset: {\n         name: \"Collection_X_asset\",\n         assetId: \"62\",\n       },\n       benchmarkId: reference.testCollection.benchmark,\n       aclSources: [\n         {\n           aclRule: {\n             label: {\n               name: reference.testCollection.fullLabelName,\n               labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n             },\n             access: \"rw\",\n           },\n            grantee: {\n            userGroupId: \"1\",\n            name: \"TestGroup\",\n            roleId: 1,\n          },\n         },\n       ],\n     },\n     {\n       access: \"rw\",\n       asset: {\n         name: \"Collection_X_asset\",\n         assetId: \"62\",\n       },\n       benchmarkId: reference.windowsBenchmark,\n       aclSources: [\n         {\n           aclRule: {\n             label: {\n               name: reference.testCollection.fullLabelName,\n               labelId: reference.testCollection.fullLabel,\n             },\n             access: \"rw\",\n           },\n            grantee: {\n            userGroupId: \"1\",\n            name: \"TestGroup\",\n            roleId: 1,\n          },\n         },\n       ],\n     },\n    ]\n  },\n  {\n    name: 'label_r',\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}],\n        response: [\n          {\n            access: \"r\",\n            asset: {\n              name: reference.testAsset.name,\n              assetId: reference.testAsset.assetId,\n            },\n            benchmarkId: reference.benchmark,\n            aclSources: [\n              {\n                aclRule: {\n                  label: {\n                    name: reference.testCollection.fullLabelName,\n                    labelId: reference.testCollection.fullLabel,\n                  },\n                  access: \"r\",\n                },\n                grantee: {\n                  name: \"TestGroup\",\n                  userGroupId: \"1\",\n                  roleId: 1,\n                },\n              },\n            ],\n          },\n          {\n            access: \"r\",\n            asset: {\n              name: reference.testAsset.name,\n              assetId: reference.testAsset.assetId,\n            },\n            benchmarkId: reference.windowsBenchmark,\n            aclSources: [\n              {\n                aclRule: {\n                  label: {\n                    name: reference.testCollection.fullLabelName,\n                    labelId: reference.testCollection.fullLabel,\n                  },\n                  access: \"r\",\n                },\n                grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n              },\n            ],\n          },\n          {\n            access: \"r\",\n            asset: {\n              name: \"Collection_X_asset\",\n              assetId: \"62\",\n            },\n            benchmarkId: reference.testCollection.benchmark,\n            aclSources: [\n              {\n                aclRule: {\n                  label: {\n                    name: reference.testCollection.fullLabelName,\n                    labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n                  },\n                  access: \"r\",\n                },\n                grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n              },\n            ],\n          },\n          {\n            access: \"r\",\n            asset: {\n              name: \"Collection_X_asset\",\n              assetId: \"62\",\n            },\n            benchmarkId: reference.windowsBenchmark,\n            aclSources: [\n              {\n                aclRule: {\n                  label: {\n                    name: reference.testCollection.fullLabelName,\n                    labelId: reference.testCollection.fullLabel,\n                  },\n                  access: \"r\",\n                },\n                grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n              },\n            ],\n          },\n        ]\n  },\n  {\n    name: 'label_none',\n    put:[{\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"}],\n    response: []\n  },\n  {\n    name: 'benchmark_rw',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: 'benchmark_r',\n    put:[{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n\n  },\n  {\n    name: 'benchmark_none',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"none\"}],\n    response: []\n\n\n  },\n  {\n    name: 'asset_rw',\n\n    put: [{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: 'asset_r',\n    put: [{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: 'asset_none',\n    put: [{\"assetId\":reference.testAsset.assetId,\"access\":\"none\"}],\n    response: []\n  },\n  {\n    name: 'assetBenchmark_rw',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n            },\n          },\n        ],\n      }\n    ]\n\n  },\n  {\n    name: 'assetBenchmark_r',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n        response: [\n          {\n            access: \"r\",\n            asset: {\n              name: reference.testAsset.name,\n              assetId: reference.testAsset.assetId,\n            },\n            benchmarkId: reference.testCollection.benchmark,\n            aclSources: [\n              {\n                aclRule: {\n                  asset: {\n                    name: reference.testAsset.name,\n                    assetId: reference.testAsset.assetId,\n                  },\n                  access: \"r\",\n                  benchmarkId: reference.testCollection.benchmark,\n                },\n                grantee: {\n                  name: \"TestGroup\",\n                  userGroupId: \"1\",\n                  roleId: 1,\n                },\n              },\n            ],\n          }\n        ]\n\n  },\n  {\n    name: 'assetBenchmark_none',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"none\"}],\n    response: []\n  },\n  {\n    name: 'labelBenchmark_rw',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}],\n        response: [\n          {\n            access: \"rw\",\n            asset: {\n              name: reference.testAsset.name,\n              assetId: reference.testAsset.assetId,\n            },\n            benchmarkId: reference.testCollection.benchmark,\n            aclSources: [\n              {\n                aclRule: {\n                  label: {\n                    name: reference.testCollection.fullLabelName,\n                    labelId: reference.testCollection.fullLabel,\n                  },\n                  access: \"rw\",\n                  benchmarkId: reference.testCollection.benchmark,\n                },\n                grantee: {\n                  name: \"TestGroup\",\n                  userGroupId: \"1\",\n                  roleId: 1,\n                },\n              },\n            ],\n          },\n          {\n            access: \"rw\",\n            asset: {\n              name: \"Collection_X_asset\",\n              assetId: \"62\",\n            },\n            benchmarkId: reference.testCollection.benchmark,\n            aclSources: [\n              {\n                aclRule: {\n                  label: {\n                    name: reference.testCollection.fullLabelName,\n                    labelId: reference.testCollection.fullLabel,\n                  },\n                  access: \"rw\",\n                  benchmarkId: reference.testCollection.benchmark,\n                },\n                grantee: {\n                  name: \"TestGroup\",\n                  userGroupId: \"1\",\n                  roleId: 1,\n                },\n              },\n            ],\n          }\n        ]\n  },\n  {\n    name: 'labelBenchmark_r',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\", \n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: 'labelBenchmark_none',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"}],\n    response: []\n  },\n  {\n    name: 'asset_rw_asset_rw',\n    put:[{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"},{\"assetId\":\"154\",\"access\":\"rw\"}],\n    response: [\n    {\n      access: \"rw\",\n      asset: {\n        name: reference.testAsset.name,\n        assetId: reference.testAsset.assetId,\n      },\n      benchmarkId: reference.testCollection.benchmark,\n      aclSources: [\n        {\n          aclRule: {\n            asset: {\n              name: reference.testAsset.name,\n              assetId: reference.testAsset.assetId,\n            },\n            access: \"rw\",\n          },\n          grantee: {\n            name: \"TestGroup\",\n            userGroupId: \"1\",\n            roleId: 1,\n          },\n        },\n      ],\n    },\n    {\n      access: \"rw\",\n      asset: {\n        name: reference.testAsset.name,\n        assetId: reference.testAsset.assetId,\n      },\n      benchmarkId: reference.windowsBenchmark,\n      aclSources: [\n        {\n          aclRule: {\n            asset: {\n              name: reference.testAsset.name,\n              assetId: reference.testAsset.assetId,\n            },\n            access: \"rw\",\n          },\n          grantee: {\n            name: \"TestGroup\",\n            userGroupId: \"1\",\n            roleId: 1,\n          },\n        },\n      ],\n    },\n    {\n      access: \"rw\",\n      asset: {\n        name: \"Collection_X_lvl1_asset-2\",\n        assetId: \"154\",\n      },\n      benchmarkId: reference.windowsBenchmark,\n      aclSources: [\n        {\n          aclRule: {\n            asset: {\n              name: \"Collection_X_lvl1_asset-2\",\n              assetId: \"154\",\n            },\n            access: \"rw\",\n          },\n          grantee: {\n            name: \"TestGroup\",\n            userGroupId: \"1\",\n            roleId: 1,\n          },\n        },\n      ],\n    },\n    {\n      access: \"rw\",\n      asset: {\n        name: \"Collection_X_lvl1_asset-2\",\n        assetId: \"154\",\n      },\n      benchmarkId: reference.testCollection.benchmark,\n      aclSources: [\n        {\n          aclRule: {\n            asset: {\n              name: \"Collection_X_lvl1_asset-2\",\n              assetId: \"154\",\n            },\n            access: \"rw\",\n          },\n          grantee: {\n            name: \"TestGroup\",\n            userGroupId: \"1\",\n            roleId: 1,\n          },\n        },\n      ],\n    }\n    ]\n  },\n  {\n    name: 'asset_rw_asset_r',\n    put: [{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"},{\"assetId\":\"154\",\"access\":\"r\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: 'asset_rw_asset_none',\n    put: [{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"},{\"assetId\":\"154\",\"access\":\"none\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: 'asset_r_asset_r',\n    put: [{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"},{\"assetId\":\"154\",\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: 'assetBenchmark_rw_label_rw',\n    put:[{\"benchmarkId\":reference.windowsBenchmark,\"assetId\":\"62\",\"access\":\"rw\"},{\"labelId\":reference.testCollection.lvl1Label,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.lvl1LabelName,\n                labelId: reference.testCollection.lvl1Label,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.lvl1LabelName,\n                labelId: reference.testCollection.lvl1Label,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\"\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_asset\",\n                assetId: \"62\"\n              },\n              access: \"rw\",\n              benchmarkId: reference.windowsBenchmark\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: 'assetBenchmark_rw_label_r',\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"154\",\"access\":\"rw\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"rw\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ]\n      }\n    ]\n  },\n  {\n    name: \"assetBenchark_r_label_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"154\",\"access\":\"r\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"r\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ]\n      }\n    ]\n  },\n  {\n    name: \"assetBenchmark_none_label_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"62\",\"access\":\"none\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        \"access\": \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"assetBenchmark_none_label_r\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"62\",\"access\":\"none\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        \"access\": \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"assetBenchmark_rw_benchmark_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"42\",\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    \n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  { \n    name: \"assetBenchmark_rw_benchmark_r\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"42\",\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"rw\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    \n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  { \n    name: \"assetBenchmark_r_benchmark_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"42\",\"access\":\"r\"},{\"benchmarkId\":reference.benchmark,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"r\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  { \n    name: \"assetBenchmark_r_benchmark_r\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":\"42\",\"access\":\"r\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              access: \"r\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    \n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  { \n    name: \"assetBenchmark_none_benchmark_r\",\n    put: [{\"benchmarkId\":reference.windowsBenchmark, \"assetId\":\"42\",\"access\":\"none\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: reference.windowsBenchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"assetBenchmark_rw_assetBenchmark_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              benchmarkId: reference.windowsBenchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"assetBenchmark_rw_assetBenchmark_r\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              benchmarkId: reference.windowsBenchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"assetBenchmark_r_assetBenchmark_r\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"r\"},{\"benchmarkId\":reference.windowsBenchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              benchmarkId: reference.testCollection.benchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              asset: {\n                name: reference.testAsset.name,\n                assetId: reference.testAsset.assetId,\n              },\n              benchmarkId: reference.windowsBenchmark,\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"label_rw_benchmark_rw\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_rw_benchmark_r\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_rw_benchmark_none\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"none\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_none_benchmark_r\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_r_benchmark_r\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_rw_asset_rw\",\n    // 154 is not in the label we are adding it on\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"assetId\":\"154\",\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n    \n      },\n    ]\n  },\n  {\n    name: \"label_rw_asset_r\",\n    // 62 is in label should be made to r\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"assetId\":\"62\",\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              asset: {\n                name: \"Collection_X_asset\",\n                assetId: \"62\",\n              },\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              asset: {\n                name: \"Collection_X_asset\",\n                assetId: \"62\",\n              },\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_rw_asset_none\",\n    // 62 is in label should gone now\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"assetId\":\"62\",\"access\":\"none\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_r_asset_rw\",\n    // 62 is in label should be made to rw all else is r\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"assetId\":\"62\",\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_r_asset_none\",\n    // removes 62\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"assetId\":\"62\",\"access\":\"none\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_r_asset_r\",\n    // all read\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"assetId\":\"154\",\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_rw_label_rw\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.lvl1LabelName,\n                labelId: reference.testCollection.lvl1Label,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          }\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources:  [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.lvl1LabelName,\n                labelId: reference.testCollection.lvl1Label,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          }\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n     ]\n  },\n  {\n    name: \"label_rw_label_r\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.lvl1LabelName,\n                labelId: reference.testCollection.lvl1Label,\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          }\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources:  [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.lvl1LabelName,\n                labelId: reference.testCollection.lvl1Label,\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          }\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n     ]\n  },\n  {\n    name: \"label_rw_label_none\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"none\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: reference.testCollection.fullLabelName,\n                labelId: reference.testCollection.fullLabel,\n              },\n              access: \"rw\",\n            },\n            grantee: {\n              userGroupId: \"1\",\n              name: \"TestGroup\",\n              roleId: 1,\n            },\n          },\n        ],\n      },\n     ]\n  },\n  {\n    name: \"label_none_label_r\",\n    // no asssets cuz all in label full\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"},{\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"r\"}],\n    response: [\n    ]\n  },\n  {\n    name: \"benchmark_rw_asset_r\",\n    // test asset is r\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n      response: [\n        {\n          access: \"r\",\n          asset: {\n            name: reference.testAsset.name,\n            assetId: reference.testAsset.assetId,\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                asset: {\n                  name: reference.testAsset.name,\n                  assetId: reference.testAsset.assetId,\n                },\n                access: \"r\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            },\n          ],\n        },\n        {\n          access: \"r\",\n          asset: {\n            name: reference.testAsset.name,\n            assetId: reference.testAsset.assetId,\n          },\n          benchmarkId: reference.windowsBenchmark,\n          aclSources: [\n            {\n              aclRule: {\n                asset: {\n                  name: reference.testAsset.name,\n                  assetId: reference.testAsset.assetId,\n                },\n                access: \"r\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            },\n          ],\n        },\n        {\n          access: \"rw\",\n          asset: {\n            name: \"Collection_X_asset\",\n            assetId: \"62\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"rw\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            },\n          ],\n        },\n        {\n          access: \"rw\",\n          asset: {\n            name: \"Collection_X_lvl1_asset-2\",\n            assetId: \"154\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"rw\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            },\n          ],\n        }\n    ]\n  },\n  {\n    name: \"benchmark_rw_asset_none\",\n    // test asset is removes\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"none\"}],\n      response: [\n        {\n          access: \"rw\",\n          asset: {\n            name: \"Collection_X_asset\",\n            assetId: \"62\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"rw\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            },\n          ],\n        },\n        {\n          access: \"rw\",\n          asset: {\n            name: \"Collection_X_lvl1_asset-2\",\n            assetId: \"154\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"rw\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            },\n          ],\n        }\n    ]\n  },\n  {\n    name: \"benchmark_r_asset_rw\",\n    // test asset is r\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"}],\n      response: [\n        {\n          access: \"r\",\n          asset: {\n            name: reference.testAsset.name,\n            assetId: reference.testAsset.assetId,\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"r\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            },\n          ],\n        },\n        {\n          access: \"rw\",\n          asset: {\n            name: reference.testAsset.name,\n            assetId: reference.testAsset.assetId,\n          },\n          benchmarkId: reference.windowsBenchmark,\n          aclSources: [\n            {\n              aclRule: {\n                asset: {\n                  name: reference.testAsset.name,\n                  assetId: reference.testAsset.assetId,\n                },\n                access: \"rw\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            },\n          ],\n        },\n        {\n          access: \"r\",\n          asset: {\n            name: \"Collection_X_asset\",\n            assetId: \"62\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"r\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            },\n          ],\n        },\n        {\n          access: \"r\",\n          asset: {\n            name: \"Collection_X_lvl1_asset-2\",\n            assetId: \"154\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"r\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            },\n          ],\n        }\n    ]\n  },\n  {\n    name: \"benchmark_r_asset_r\",\n    // test asset is r\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n      response: [\n        {\n          access: \"r\",\n          asset: {\n            name: reference.testAsset.name,\n            assetId: reference.testAsset.assetId,\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"r\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            },\n            {\n              aclRule: {\n                asset: {\n                  name: reference.testAsset.name,\n                  assetId: reference.testAsset.assetId,\n                },\n                access: \"r\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            }\n          ],\n        },\n        {\n          access: \"r\",\n          asset: {\n            name: reference.testAsset.name,\n            assetId: reference.testAsset.assetId,\n          },\n          benchmarkId: reference.windowsBenchmark,\n          aclSources: [\n            {\n              aclRule: {\n                asset: {\n                  name: \"Collection_X_lvl1_asset-1\",\n                  assetId: \"42\",\n                },\n                access: \"r\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            },\n          ],\n        },\n        {\n          access: \"r\",\n          asset: {\n            name: \"Collection_X_asset\",\n            assetId: \"62\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"r\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            },\n          ],\n        },\n        {\n          access: \"r\",\n          asset: {\n            name: \"Collection_X_lvl1_asset-2\",\n            assetId: \"154\",\n          },\n          benchmarkId: reference.testCollection.benchmark,\n          aclSources: [\n            {\n              aclRule: {\n                benchmarkId: reference.testCollection.benchmark,\n                access: \"r\",\n              },\n               grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n            },\n          ],\n        }\n    ]\n  },\n  {\n    name: \"benchmark_none_asset_r\",\n    // test asset is r\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"none\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n      response: [\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"benchmark_rw_benchmark_rw\",\n     // asset stig for both \n    put:  [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.windowsBenchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.windowsBenchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.windowsBenchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"benchmark_rw_benchmark_r\",\n     // asset stig for both \n    put:  [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.windowsBenchmark,\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.windowsBenchmark,\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.windowsBenchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.windowsBenchmark,\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"benchmark_rw_benchmark_none\",\n     // asset stig for both \n    put:  [{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"none\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: reference.testAsset.name,\n          assetId: reference.testAsset.assetId,\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: reference.testCollection.benchmark,\n        aclSources: [\n          {\n            aclRule: {\n              benchmarkId: reference.testCollection.benchmark,\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_label_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"rw\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}], // doesnt do anything, tie at asset 42 but same access\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_label_r\",\n  // collsion at asset 42 rw wins becauselabel+ bnechmark is more accurate\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"rw\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}], \n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_r_label_rw\",\n    //label bechmark wins at asset 42 VPN for rw \n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"rw\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}], \n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_r_label_r\",\n   // does nothing all r\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"r\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}], \n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_r_label_none\",\n   // tie at asset 42 and labelBNenchmark wins so we wiill only return that \n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"r\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"}], \n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"labelBenchmark_none_label_rw\",\n   // labelBencahark none wins so we will remove intersection of assets which is asset 42 with VPN\n    put:[{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"none\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_benchmark_rw\",\n    // adds benchmark + labelBenchmark the bnechmarks added will be asset 62 and 42 cuz they have VPN test stig \n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_benchmark_r\",\n    // collsion on the asset not in the label, resolve to read \n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response:\n    [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_benchmark_none\",\n    // gives just the two assets in the labels as rw like the bnechmark doenst apply\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"none\"}],\n    response:\n    [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"labelBenchmark_r_benchmark_r\",\n    // gives just the two assets in the labels as rw like the bnechmark doenst apply\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response:\n    [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_none_benchmark_r\",\n    // gives just the two assets in the labels as rw like the bnechmark doenst apply\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response:\n    [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_none_asset_none\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"none\"}],\n    response: []\n  },\n  {\n    name: \"labelBenchmark_rw_asset_rw\",\n    // adds asset to labelBenchamark 154 is not in label \n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"assetId\":\"154\",\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_asset_r\",\n    // changes just the asset windows to r test asset vpn stgarts rw cuz labelBenchmark beats just asset\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_asset_none\",\n    // all rw for Vpn because the label benchmark wins!\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_r_asset_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_none_asset_rw\",\n    // none wins besides windows stig\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      }\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_assetBenchmark_rw\",\n    // adds asset benchmark its not in the label\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"assetId\":\"154\",\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"rw\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_assetBenchmark_r\",\n    // adds asset benchmark its not in the label\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}], // changes asset to r,\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_assetBenchmark_none\",\n    // adds asset benchmark its not in the label\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"none\"}], // remvoe asset\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_r_assetBenchmark_rw\",\n    // asset 62 is r\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}], // changes asset to r,\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_none_assetBenchmark_r\",\n    // asset 62 is r\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"},{\"benchmarkId\":reference.testCollection.benchmark,\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}], // changes asset to r,\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_labelBenchmark_rw\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"labelBenchmark_rw_labelBenchmark_r\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n\n      name: \"labelBenchmark_r_labelBenchmark_r\",\n      put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"r\"},{\"benchmarkId\":reference.windowsBenchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}],\n      response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n              benchmarkId: \"Windows_10_STIG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n\n  },\n  {\n\n    name: \"labelBenchmark_r_labelBenchmark_none\",\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":\"5130dc84-9a68-11ec-b1bc-0242ac110002\",\"access\":\"r\"},{\"benchmarkId\":reference.windowsBenchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"none\"}],\n    response: [\n    {\n      access: \"r\",\n      asset: {\n        name: \"Collection_X_lvl1_asset-1\",\n        assetId: \"42\",\n      },\n      benchmarkId: \"VPN_SRG_TEST\",\n      aclSources: [\n        {\n          aclRule: {\n            label: {\n              name: \"test-label-lvl1\",\n              labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n            },\n            access: \"r\",\n            benchmarkId: \"VPN_SRG_TEST\",\n          },\n          grantee: {\n            name: \"TestGroup\",\n            userGroupId: \"1\",\n            roleId: 1,\n          },\n        },\n      ],\n    },\n  ]\n\n  },\n  {\n    name: \"label_rw_benchmark_r_asset_none\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"none\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"assetBenchmark_none_label_rw_benchmark_r\",\n    put: [{\"assetId\":reference.testAsset.assetId, benchmarkId: reference.testCollection.benchmark,\"access\":\"none\"},{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"r\"}],\n    response:[\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"assetBenchmark_r_benchmark_none_asset_rw\",\n    put: [{\"assetId\":reference.testAsset.assetId, benchmarkId: reference.testCollection.benchmark,\"access\":\"r\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"none\"},{\"assetId\":\"154\",\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_rw_asset_r_asset_r\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"},{\"assetId\":\"62\",\"access\":\"r\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_asset\",\n                assetId: \"62\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_asset\",\n                assetId: \"62\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"label_r_benchmark_rw_benchmark_none\",\n    put: [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"benchmarkId\":reference.testCollection.benchmark,\"access\":\"rw\"},{\"benchmarkId\":reference.windowsBenchmark,\"access\":\"none\"}],\n    response: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-full\",\n                labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"r\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n  {\n    name: \"assetBenchmark_rw_asset_rw_asset_rw\",\n    put: [{\"assetId\":reference.testAsset.assetId, benchmarkId: reference.testCollection.benchmark,\"access\":\"rw\"},{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"},{\"assetId\":\"154\",\"access\":\"rw\"}],\n    response: [\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-1\",\n                assetId: \"42\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"rw\",\n            },\n             grantee: {\n                  userGroupId: \"1\",\n                  name: \"TestGroup\",\n                  roleId: 1,\n                },\n          },\n        ],\n      },\n    ]\n  },\n]\n"
  },
  {
    "path": "test/api/mocha/data/acl/referenceData.js",
    "content": "// This data represents components of the primary test Collections, Assets, etc. contained in the standard appData.json file without regard to access controls being exercised by the tests.  These Ids, etc. should be used to construct test case API requests. This data should only be used as expectations in cases where all test scenarios exercised are expected to return the same data. \n\n// The standard \"testCollection\" includes users named after the roles they have for that specific Collection, is used in most \"GET\" tests or tests not expected to change data that could alter expectations for subsequent tests. \"scrapCollection\" is used for tests that alter Collection data in some way.\n\nconst reference = {\n  collectionId: \"21\",\n  collectionName: \"Test Collection\",\n  collectionDescription: \"This is a test collection\",\n  collectionOwner: \"admin\",\n  collectionOwnerID: \"87\",\n  benchmark: \"VPN_SRG_TEST\",\n  pinRevision: \"V1R0\",\n  checklistLength: 81,\n  revisionStr: \"V1R1\",\n  grantCheckUserId: \"85\",\n  testCollection: {\n    name: \"Collection X\",\n    collectionId: \"21\",\n    benchmark: \"VPN_SRG_TEST\",\n    defaultRevision: \"V1R1\",    \n    pinRevision: \"V1R0\",    \n    collectionMetadataKey: \"pocName\",\n    collectionMetadataValue: \"poc2Patched\",\n    owners: [\"87\", \"1\", \"45\"],\n    assetIds: [\"29\", \"62\", \"42\", \"154\"],\n    assetsWithHistory: [\"42\", \"154\"],\n    testAssetId: \"42\",\n    validStigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\"],\n    labelCount: 2,\n    lvl1LabelName: \"test-label-lvl1\",\n    lvl1Label: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n    fullLabel: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n    fullLabelName: \"test-label-full\",\n    testGroup: {\n      userGroupId: 1,\n      grantId: 32,\n      users: [\"lvl1\"]\n    },\n    labels: [\n      \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n      \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n    ],\n    labelsMap: {\n      \"test-label-full\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n      \"test-label-lvl1\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n    },\n    allMetadata: [\n      {\n        key: \"pocEmail\",\n        value: \"pocEmail@email.com\"\n      },\n      {\n        key: \"pocName\",\n        value: \"poc2Patched\"\n      },\n      {\n        key: \"pocPhone\",\n        value: \"12342\"\n      },\n      {\n        key: \"reqRar\",\n        value: \"true\"\n      }\n    ],\n    reviewHistory: {\n      assetId: \"42\",\n      startDate: \"1900-10-01\",\n      endDate: \"2020-10-01\",\n      deletedEntriesByDate: 6,\n      deletedEntriesByDateAsset: 4,\n      ruleId: \"SV-106179r1_rule\",\n      status: \"submitted\"\n    },\n    rulesWithHistoryCnt: 2,\n    reviewHistoryRuleCnt: 2,\n    reviewHistoryTotalCnt: 7,\n    reviewHistory_endDateCnt: 6,\n    reviewHistory_startAndEndDateCnt: 2,\n    reviewHistory_startDateCnt: 2,\n    reviewHistory_byStatusCnt: 3,\n    reviewHistory_testAssetCnt: 5,\n    reviewHistory_ruleIdCnt: 4,\n    assetsProjected: [\n      {\n        name: \"ACHERNAR_Collection_X_asset\",\n        assetId: \"403\",\n      },\n      {\n        name: \"Collection_X_asset\",\n        assetId: \"405\",\n      },\n      {\n        name: \"Collection_X_lvl1_asset-1\",\n        assetId: \"404\",\n      },\n      {\n        name: \"Collection_X_lvl1_asset-2\",\n        assetId: \"406\",\n      },\n    ],\n    grantsProjected: [\n      {\n        user: {\n          userId: \"86\",\n          username: \"bizarroLvl1\",\n          displayName: \"bizarroLvl1\"\n          },\n        roleId: 1\n      },\n      {\n        user: {\n          userId: \"85\",\n          username: \"lvl1\",\n          displayName: \"lvl1\"\n        },\n        roleId: 1\n      },\n      {\n        user: {\n          userId: \"21\",\n          username: \"lvl2\",\n          displayName: \"lvl2\"\n        },\n        roleId: 2\n      },\n      {\n        user: {\n          userId: \"44\",\n          username: \"lvl3\",\n          displayName: \"lvl3\"\n        },\n        roleId: 3\n      },\n      {\n        user: {\n          userId: \"87\",\n          username: \"admin\",\n          displayName: \"Admin Burke\"\n        },\n        roleId: 4\n      },\n      {\n        user: {\n          userId: \"1\",\n          username: \"stigmanadmin\",\n          displayName: \"STIGMAN Admin\"\n        },\n        roleId: 4\n      },\n      {\n        user: {\n          userId: \"45\",\n          username: \"lvl4\",\n          displayName: \"lvl4\"\n        },\n        roleId: 4\n      }\n    ],\n    ownersProjected: [\n      {\n        email: \"admin@admin.com\",\n        userId: \"87\",\n        username: \"admin\",\n        displayName: \"Admin Burke\"\n      },\n      {\n        email: null,\n        userId: \"1\",\n        username: \"stigmanadmin\",\n        displayName: \"STIGMAN Admin\"\n      },\n      {\n        email: null,\n        userId: \"45\",\n        username: \"lvl4\",\n        displayName: null\n      }\n    ],\n    stigsProjected: [\n      {\n        ruleCount: 81,\n        benchmarkId: \"VPN_SRG_TEST\",\n        revisionStr: \"V1R0\",\n        benchmarkDate: \"2010-07-19\",\n        revisionPinned: true\n      },\n      {\n        ruleCount: 287,\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        revisionStr: \"V1R23\",\n        benchmarkDate: \"2020-06-17\",\n        revisionPinned: false\n      }\n    ],\n    statisticsProjected: {\n      assetCount: 4,\n      grantCount: 7,\n      checklistCount: 6\n    },\n    labelsProjected: [\n      {\n        name: \"test-label-full\",\n        description: \"\",\n        color: \"FF99CC\",\n        uses: 2\n      },\n      {\n        name: \"test-label-lvl1\",\n        description: \"\",\n        color: \"99CCFF\",\n        uses: 1\n      }\n    ]\n  },\n  deleteCollection: {\n    collectionId_adminOnly: \"84\",\n    collectionId: \"85\"\n  },\n  scrapCollection: {\n    collectionId: \"1\",\n    validStigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\", \"RHEL_7_STIG_TEST\"],\n    scrapLabel: \"df4e6836-a003-11ec-b1bc-0242ac110002\",\n    collectionMetadataKey: \"pocName\",\n    collectionMetadataValue: \"poc2Patched\"\n  },\n  scrapLvl1User: {\n    userId: \"86\",\n    username: \"bizarroLvl1\"\n  },\n  scrapAsset: {\n    assetId: \"34\",\n    scrapBenchmark: \"RHEL_7_STIG_TEST\",\n    metadataKey: \"testkey\",\n    metadataValue: \"testvalue\"\n  },\n  testAsset: {\n    name: \"Collection_X_lvl1_asset-1\",\n    assetId: \"42\",\n    collectionId: \"21\",\n    usersWithGrant: [\"86,85\"],\n    benchmark: \"VPN_SRG_TEST\",\n    validStigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\"],\n    metadataKey: \"testkey\",\n    metadataValue: \"testvalue\",\n    labels: [\n      \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n      \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n    ]\n  },\n  testRuleIdVPN: \"SV-106179r1_rule\",\n  testRuleIdWin: \"SV-77809r3_rule\",\n};\n\nexport default reference"
  },
  {
    "path": "test/api/mocha/data/asset/assetDelete.test.js",
    "content": "\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {requestBodies} from \"./requestBodies.js\"\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport {expect} from 'chai'\n\nconst createTempAsset = async () => {\n  const res = await utils.createTempAsset(requestBodies.tempAssetPost)\n  return res.data\n}\n\ndescribe('DELETE - Asset', function () {\n\n  before(async function () {\n    await utils.loadAppData()\n  })\n\n  beforeEach(async function () {\n    await utils.resetTestAsset()\n  })\n  \n  for(const iteration of iterations){\n    if (expectations[iteration.name] === undefined){\n      it(`No expectations for this iteration scenario: ${iteration.name}`, async function () {})\n      continue\n    }\n\n    describe(`iteration:${iteration.name}`, function () {\n      const distinct = expectations[iteration.name]\n      describe(`deleteAssetMetadataKey - /assets/{assetId}/metadata/keys/{key}`, function () {\n        it('Delete one metadata key/value of an Asset', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/metadata/keys/${reference.testAsset.metadataKey}`, 'DELETE', iteration.token)\n\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(204)\n          \n          const asset = await utils.getAsset(reference.testAsset.assetId)\n          expect(asset.metadata).to.not.have.property(reference.testAsset.metadataKey)\n        })\n        it(\"attempt to delete metadata key on deleted asset, should fail. \", async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.deletedAsset.assetId}/metadata/keys/${reference.testAsset.metadataKey}`, 'DELETE', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n      describe(`removeStigFromAsset - /assets/{assetId}/stigs/{benchmarkId}`, function () {\n        it('Delete a STIG assignment to an Asset', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/stigs/${reference.benchmark}`, 'DELETE', iteration.token)\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n\n          const asset = await utils.getAsset(reference.testAsset.assetId)\n          expect(asset.stigs).to.not.include(reference.benchmark)\n        })\n        it(\"attempt to delete stig on deleted asset, should fail. \", async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.deletedAsset.assetId}/stigs/${reference.benchmark}`, 'DELETE', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n      describe(`removeStigsFromAsset -/assets/{assetId}/stigs`, function () {\n        it('Delete all STIG assignments to an Asset', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/stigs`, 'DELETE', iteration.token)\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n          const asset = await utils.getAsset(reference.testAsset.assetId)\n          expect(asset.stigs).to.be.an('array').that.is.empty\n        })\n      })\n      describe(`deleteAsset - /assets/{assetId}`, function () {\n\n        let localTestAsset = null\n        \n        it('Create an Asset', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets`, 'POST', iteration.token, {\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            collectionId: reference.testCollection.collectionId,\n            description: 'test',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [reference.testCollection.fullLabelName],\n            metadata: {\n              pocName: 'pocName',\n              pocEmail: 'pocEmail@example.com',\n              pocPhone: '12345',\n              reqRar: 'true'\n            },\n            stigs: reference.testCollection.validStigs\n          })\n          \n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(201)     \n          localTestAsset = res.body    \n        })\n       \n        it('Delete scrap Asset', async function () {\n          if(!distinct.canModifyCollection){\n            return\n          }\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${localTestAsset.assetId}?projection=statusStats&projection=stigs`, 'DELETE', iteration.token)\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.assetId).to.equal(localTestAsset.assetId)\n          expect(res.body.statusStats.ruleCount).to.equal(reference.testAsset.stats.ruleCount)\n\n          expect(res.body.stigs).to.be.an('array').of.length(reference.testAsset.validStigs.length)\n          for(const stig of res.body.stigs){\n            expect(stig.benchmarkId).to.be.oneOf(reference.testAsset.validStigs)\n          }\n\n        })\n\n        it(\"attempt to delete an already deleted Asset\", async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.deletedAsset.assetId}`, 'DELETE', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n    })\n  }\n})\n\n\n"
  },
  {
    "path": "test/api/mocha/data/asset/assetGet.test.js",
    "content": "\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport { XMLParser } from 'fast-xml-parser'\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\n\ndescribe(`GET - Asset`, function () {\n\n  before(async function () {\n    await utils.loadAppData()\n  })\n\n  for(const iteration of iterations){\n    if (expectations[iteration.name] === undefined){\n      it(`No expectations for this iteration scenario: ${iteration.name}`, async function () {})\n      continue\n    }\n\n    describe(`iteration:${iteration.name}`, function () {\n      const distinct = expectations[iteration.name]\n\n      describe(`getAsset - /assets/{assetId}`, function () {\n      \n        it(`Return test asset`, async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}?projection=statusStats&projection=stigs`, 'GET', iteration.token)\n\n          if(distinct.hasAccessToTestAsset === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.name, `expect asset name to equal test asset ${reference.testAsset.name}`).to.eql(reference.testAsset.name)\n          expect(res.body.collection.collectionId, `expect asset to be a part of test collection ${reference.testAsset.collectionId}`).to.eql(reference.testAsset.collectionId)\n          expect(res.body.collection.name, `expect collection name to equal test collection ${reference.testCollection.name}`).to.eql(reference.testCollection.name)\n          expect(res.body.labelIds, `expect asset to have a label length ${reference.testAsset.labels.length}`).to.be.an(`array`).of.length(reference.testAsset.labels.length)\n          for(const label of res.body.labelIds){\n            expect(label, \"expect label to be one of the test labels\").to.be.oneOf(reference.testAsset.labels)\n          }\n          expect(res.body.labels, \"expect labels to be an array\").to.be.an(\"array\")\n          expect(res.body.labels).to.deep.equalInAnyOrder(reference.testAsset.fullLabels)\n          expect(res.body.metadata, \"expect metadata to equal test metadata\").to.deep.equal({\n            [reference.testAsset.metadataKey]: reference.testAsset.metadataValue\n          })\n          // stigs projection\n          expect(res.body.stigs).to.be.an(\"array\").of.length(distinct.testAssetStigs.length)\n          for (let stig of res.body.stigs){\n              expect(stig.benchmarkId).to.be.oneOf(distinct.testAssetStigs);\n          }\n          // statusStats projection\n          expect(res.body.statusStats.ruleCount, `rule count ${distinct.testAssetStats.ruleCount}`).to.eql(distinct.testAssetStats.ruleCount)\n          expect(res.body.statusStats.stigCount, `stig count ${distinct.testAssetStats.stigCount}`).to.eql(distinct.testAssetStats.stigCount)\n          expect(res.body.statusStats.savedCount, \"saved count: \" + distinct.testAssetStats.savedCount ).to.eql(distinct.testAssetStats.savedCount)\n          expect(res.body.statusStats.acceptedCount, \"accepted count\").to.eql(distinct.testAssetStats.acceptedCount)\n          expect(res.body.statusStats.rejectedCount, \"rejected count\").to.eql(distinct.testAssetStats.rejectedCount)\n          expect(res.body.statusStats.submittedCount, \"submitted count\").to.eql(distinct.testAssetStats.submittedCount)\n\n        })\n        // it(`Return an Asset with no assigned stigs`, async function () {\n        //   const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAssetNoStigs.assetId}?projection=statusStats&projection=stigs`, 'GET', iteration.token)\n\n        //   if(distinct.hasAccessToTestAssetNoStigs === false){\n        //     expect(res.status).to.eql(403)\n        //     return\n        //   }\n        //   else{\n        //     expect(res.status).to.eql(200)\n        //   }\n        //   expect(res.body.name).to.eql(reference.testAssetNoStigs.name)\n        //   expect(res.body.collection.collectionId).to.eql(reference.testAssetNoStigs.collectionId)\n        //   expect(res.body.labelIds).to.be.an(`array`).of.length(reference.testAssetNoStigs.labels.length)\n\n        //   // stigs\n        //   expect(res.body.stigs).to.be.an(\"array\").of.length(reference.testAssetNoStigs.stigs.length)\n\n        //   // statusStats\n        //   expect(res.body.statusStats.ruleCount, \"rule count\").to.eql(reference.testAssetNoStigs.stats.ruleCount)\n        //   expect(res.body.statusStats.stigCount, \"stig Count\").to.eql(reference.testAssetNoStigs.stats.stigCount)\n        //   expect(res.body.statusStats.savedCount, \"saved Count\").to.eql(reference.testAssetNoStigs.stats.savedCount)\n        //   expect(res.body.statusStats.acceptedCount, \"accepted Count\").to.eql(reference.testAssetNoStigs.stats.acceptedCount)\n        //   expect(res.body.statusStats.rejectedCount, \"rejected count\").to.eql(reference.testAssetNoStigs.stats.rejectedCount)\n        //   expect(res.body.statusStats.submittedCount, \"submitted count\").to.eql(reference.testAssetNoStigs.stats.submittedCount)\n        //   expect(res.body.statusStats.acceptedCount, \"accepted count\").to.eql(reference.testAssetNoStigs.stats.acceptedCount)\n\n        // })\n        // it(`Return test asset`, async function () {\n        //   const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}?projection=statusStats&projection=stigs`, 'GET', iteration.token)\n\n        //   if(!distinct.hasAccessToTestAsset){\n        //     expect(res.status).to.eql(403)\n        //     return\n        //   }\n\n        //   expect(res.status).to.eql(200)\n        //   expect(res.body).to.be.an(`object`)        \n        //   expect(res.body.name).to.eql(reference.testAsset.name)\n        //   expect(res.body.collection.collectionId).to.eql(reference.testAsset.collectionId)\n        //   expect(res.body.collection.name, \"expect collection name to equal test collection\").to.eql(reference.testCollection.name)\n        //   expect(res.body.labelIds).to.be.an(`array`).of.length(reference.testAsset.labels.length)\n        //   for(const label of res.body.labelIds){\n        //     expect(label).to.be.oneOf(reference.testAsset.labels)\n        //   }\n        //   expect(res.body.metadata).to.deep.equal({\n        //     [reference.testAsset.metadataKey]: reference.testAsset.metadataValue\n        //   })\n        //   //stigs\n        //   expect(res.body.stigs).to.exist;\n        //   expect(res.body.stigs).to.be.an(\"array\").of.length(distinct.testAssetStigs.length)\n        //   for (let stig of res.body.stigs){\n        //       expect(stig.benchmarkId).to.be.oneOf(reference.testAsset.validStigs);\n        //   }\n\n        //   // statusStats\n        //   expect(res.body.statusStats.ruleCount, \"rule count\").to.eql(distinct.testAssetStats.ruleCount)\n        //   expect(res.body.statusStats.stigCount, \"stig count\").to.eql(distinct.testAssetStats.stigCount)\n        //   expect(res.body.statusStats.savedCount, \"saved count\").to.eql(distinct.testAssetStats.savedCount)\n        //   expect(res.body.statusStats.acceptedCount, \"accepted count\").to.eql(distinct.testAssetStats.acceptedCount)\n        //   expect(res.body.statusStats.rejectedCount, \"rejected count\").to.eql(distinct.testAssetStats.rejectedCount)\n        //   expect(res.body.statusStats.submittedCount, \"submitted count\").to.eql(distinct.testAssetStats.submittedCount)\n\n        // })\n        // it(`Return an Asset  with no assigned stigs`, async function () {\n        //   const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAssetNoStigs.assetId}?projection=statusStats&projection=stigs`, 'GET', iteration.token)\n\n        //     if(!distinct.hasAccessToTestAssetNoStigs){\n        //       expect(res.status).to.eql(403)\n        //       return\n        //     }\n        //     else{\n        //       expect(res.status).to.eql(200)\n        //     }\n        //     expect(res.body.name).to.eql(reference.testAssetNoStigs.name)\n        //     expect(res.body.collection.collectionId).to.eql(reference.testAssetNoStigs.collectionId)\n        //     expect(res.body.labelIds).to.be.an(`array`).of.length(reference.testAssetNoStigs.labels.length)\n        //     expect(res.body.collection.name, \"expect collection name to equal test collection\").to.eql(reference.testCollection.name)\n        //     expect(res.body.labelIds).to.be.an(`array`).of.length(reference.testAssetNoStigs.labels.length)\n        //     for(const label of res.body.labelIds){\n        //       expect(label).to.be.oneOf(reference.testAssetNoStigs.labels)\n        //     }\n\n        //     // stigs\n        //     expect(res.body.stigs).to.be.an(\"array\").of.length(reference.testAssetNoStigs.stigs.length)\n  \n        //     // statusStats\n        //     expect(res.body.statusStats.ruleCount, \"rule count\").to.eql(reference.testAssetNoStigs.stats.ruleCount)\n        //     expect(res.body.statusStats.stigCount, \"stig Count\").to.eql(reference.testAssetNoStigs.stats.stigCount)\n        //     expect(res.body.statusStats.savedCount, \"saved Count\").to.eql(reference.testAssetNoStigs.stats.savedCount)\n        //     expect(res.body.statusStats.acceptedCount, \"accepted Count\").to.eql(reference.testAssetNoStigs.stats.acceptedCount)\n        //     expect(res.body.statusStats.rejectedCount, \"rejected count\").to.eql(reference.testAssetNoStigs.stats.rejectedCount)\n        //     expect(res.body.statusStats.submittedCount, \"submitted count\").to.eql(reference.testAssetNoStigs.stats.submittedCount)\n        //     expect(res.body.statusStats.acceptedCount, \"accepted count\").to.eql(reference.testAssetNoStigs.stats.acceptedCount)\n        // })\n        it(\"attempt to fetch a deleted Asset should 403 fail\", async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.deletedAsset.assetId}`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n      describe(`getAssetMetadata - /assets/{assetId}/metadata,`, function () {\n        it(`Return the Metadata for test asset`, async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/metadata`, 'GET', iteration.token)\n\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`object`)      \n          expect(res.body.testkey).to.exist\n          expect(res.body.testkey).to.eql(reference.testAsset.metadataValue)\n        })\n        it(\"should attempt to return metadata from a deleted asset, should throw 403\", async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.deletedAsset.assetId}/metadata`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n      describe(`getAssetMetadataKeys - /assets/{assetId}/metadata/keys`, function () {\n        it(`Return the Metadata KEYS for test asset`, async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/metadata/keys`, 'GET', iteration.token)\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`)\n          expect(res.body).to.include(reference.testAsset.metadataKey)\n        })\n        it(`should return emoty 200 response no metadata for asset`, async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAssetNoMetadata.assetId}/metadata/keys`, 'GET', iteration.token)\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n        })\n      })\n      describe(`getAssetMetadataValue - /assets/{assetId}/metadata/keys/{key}`, function () {\n        it(`Return the Metadata VALUE for test asset metadata key: testkey`, async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/metadata/keys/${reference.testAsset.metadataKey}`, 'GET', iteration.token)\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.include(reference.testAsset.metadataValue)\n        })\n        it(`should throw not found error, metadata keys not found`, async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAssetNoMetadata.assetId}/metadata/keys/test`, 'GET', iteration.token)\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(404)\n        })\n      })\n      describe(`getAssets - /assets`, function () {\n\n        it(`Assets accessible to the requester benchmark projection with test benchmark`, async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.testCollection.collectionId}&benchmarkId=${reference.benchmark}&projection=stigs`, 'GET', iteration.token)\n          if(distinct.hasAccessToTestAsset === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`).of.length(distinct.assetsAvailableBenchmark.length)\n          for(const asset of res.body){\n            expect(asset.assetId).to.be.oneOf(distinct.assetsAvailableBenchmark)\n            expect(reference.benchmark).to.be.oneOf(asset.stigs.map(stig => stig.benchmarkId))\n            if(asset.assetId === reference.testAsset.assetId){\n              expect(asset.name, \"expect asset name to equal test asset\").to.eql(reference.testAsset.name)\n              expect(asset.collection.collectionId, \"expect asset to be a part of test collection\").to.eql(reference.testAsset.collectionId)\n              expect(asset.collection.name, \"expect collection name to equal test collection\").to.eql(reference.testCollection.name)\n              expect(asset.labelIds).to.be.an(`array`).of.length(reference.testAsset.labels.length)\n              for(const label of asset.labelIds){\n                expect(label).to.be.oneOf(reference.testAsset.labels)\n              }\n              expect(asset.labels, \"expect labels to be an array\").to.be.an(\"array\")\n              expect(asset.labels).to.deep.equalInAnyOrder(reference.testAsset.fullLabels)\n              expect(asset.metadata).to.deep.equal({\n                [reference.testAsset.metadataKey]: reference.testAsset.metadataValue\n              })\n            }            \n          }\n        })\n\n        it(`Assets accessible to the requester`, async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.testCollection.collectionId}&projection=statusStats&projection=stigs`, 'GET', iteration.token)\n\n          if(distinct.hasAccessToTestAsset === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`).of.length(distinct.assetIds.length)\n        \n          const jsonData = res.body;\n          for (let asset of jsonData){\n            expect(asset.assetId).to.be.oneOf(distinct.assetIds)\n\n            for(let stig of asset.stigs){\n              expect(stig.benchmarkId).to.be.oneOf(reference.testCollection.validStigs);\n            }\n            if(asset.assetId === reference.testAsset.assetId){\n              expect(asset.name, \"expect asset name to equal test asset\").to.eql(reference.testAsset.name)\n              expect(asset.collection.collectionId, \"expect asset to be a part of test collection\").to.eql(reference.testAsset.collectionId)\n              expect(asset.collection.name, \"expect collection name to equal test collection\").to.eql(reference.testCollection.name)\n              expect(asset.labelIds).to.be.an(`array`).of.length(reference.testAsset.labels.length)\n              for(const label of asset.labelIds){\n                expect(label).to.be.oneOf(reference.testAsset.labels)\n              }\n              expect(asset.labels, \"expect labels to be an array\").to.be.an(\"array\")\n              expect(asset.labels).to.deep.equalInAnyOrder(reference.testAsset.fullLabels)\n              expect(asset.metadata).to.deep.equal({\n                [reference.testAsset.metadataKey]: reference.testAsset.metadataValue\n              })\n              expect(asset.statusStats.ruleCount).to.eql(distinct.testAssetStats.ruleCount);\n            }            \n          }\n        })\n\n        it(`Assets accessible to the requester - labels projection on full label`, async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.testCollection.collectionId}&labelId=${reference.testCollection.fullLabel}`, 'GET', iteration.token)\n\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`).of.length(distinct.assetsAvailableFullLabel.length)\n          for(let asset of res.body){\n            expect(asset.labelIds).to.include(reference.testCollection.fullLabel)\n          }\n        })\n\n        it(`should return assets accessible to the requester, testing metadata query. (issue 1357)`, async function () {\n          const assetWithMetadata = await utils.createTempAsset({\n            name: 'tempAsset' + utils.getUUIDSubString(),\n            collectionId: reference.scrapCollection.collectionId,\n            description: 'temp',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [],\n            metadata: {\n              testKey: 'test:value',\n            },\n            stigs: []\n          })\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.scrapCollection.collectionId}&metadata=testKey%3Atest%3Avalue`, 'GET', iteration.token)\n          \n          if(iteration.name === 'lvl1' || iteration.name === 'collectioncreator'){\n            expect(res.status).to.eql(403)\n            await utils.deleteAsset(assetWithMetadata.assetId)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`).of.length(1)\n          expect(res.body[0].assetId).to.eql(assetWithMetadata.assetId)\n          await utils.deleteAsset(assetWithMetadata.assetId)\n        })\n\n        it(`Assets accessible to the requester`, async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.testCollection.collectionId}&benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`).of.length(distinct.assetsAvailableBenchmark.length)\n          \n          const jsonData = res.body;\n          \n          for (const asset of jsonData){\n            expect(asset.assetId, \"expect assetId to be within the parameters of test collection and have test benchmark\").to.be.oneOf(distinct.assetsAvailableBenchmark)\n            if(asset.assetId === reference.testAsset.assetId){\n              expect(asset.name, \"expect asset name to equal test asset\").to.eql(reference.testAsset.name)\n              expect(asset.collection.collectionId, \"expect asset to be a part of test collection\").to.eql(reference.testAsset.collectionId)\n              expect(asset.collection.name, \"expect collection name to equal test collection\").to.eql(reference.testCollection.name)\n              expect(asset.labelIds).to.be.an(`array`).of.length(reference.testAsset.labels.length)\n              for(const label of asset.labelIds){\n                expect(label, \"expect label to be a valid label\").to.be.oneOf(reference.testAsset.labels)\n              }\n              expect(asset.labels, \"expect labels to be an array\").to.be.an(\"array\")\n              expect(asset.labels).to.deep.equalInAnyOrder(reference.testAsset.fullLabels)\n              expect(asset.metadata, \"expect metadata to match test asset\").to.deep.equal({\n                [reference.testAsset.metadataKey]: reference.testAsset.metadataValue\n              })\n            }\n          }\n        })\n\n        it(\"assets accessible to the requester labels predicate for label name, full label.\", async function () {\n\n          const res  =  await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.testCollection.collectionId}&labelName=${reference.testCollection.fullLabelName}`, 'GET', iteration.token)\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200) \n\n          expect(res.body).to.be.an(`array`).of.length(distinct.assetsAvailableFullLabel.length)\n          for(let asset of res.body){\n            expect(asset.labelIds).to.include(reference.testCollection.fullLabel)\n            expect(asset.labels, \"expect labels to be an array\").to.be.an(\"array\")\n            expect(asset.assetId).to.be.oneOf(distinct.assetsAvailableFullLabel)\n            expect(asset.collection.collectionId).to.eql(reference.testCollection.collectionId)\n          }\n        })\n\n        it(\"assets accessible to the requester label match predicate is null, should return assets without metadata\", async function () {\n\n          const res  =  await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.testCollection.collectionId}&labelMatch=null`, 'GET', iteration.token)\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200) \n\n          expect(res.body).to.be.an(`array`).of.length(distinct.assetsAvailableNoMetadata.length)\n          for(let asset of res.body){\n            expect(asset.labelIds).to.be.empty\n            expect(asset.labels).to.be.empty\n            expect(asset.assetId).to.be.oneOf(distinct.assetsAvailableNoMetadata)\n            expect(asset.collection.collectionId).to.eql(reference.testCollection.collectionId)\n          }\n        })\n\n        it(\"assets accessible to the requester name match predicate where asset name is exact should return test asset\", async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.testCollection.collectionId}&name=${reference.testAsset.name}&name-match=exact`, 'GET', iteration.token)\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`).of.length(1)\n          expect(res.body[0].assetId).to.eql(reference.testAsset.assetId)\n        })\n        it(\"assets accessible to the requester name match predicate where asset name starts with should return assets start with Co\", async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.testCollection.collectionId}&name=${\"Co\"}&name-match=startsWith`, 'GET', iteration.token)\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          const assetNamesStartWithCo = distinct.AssetNamesAvailable.filter(asset => asset.name.startsWith(\"Co\"))\n          expect(res.body).to.be.an(`array`).of.length(3)\n          for(const asset of res.body){\n            expect(asset.name).to.match(/^Co/)\n            expect(asset.assetId).to.be.oneOf(reference.testCollection.assetIds)\n          }\n        })\n        it(\"assets accessible to the requester name match predicate where asset name ends with should return assets with `asset`\", async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.testCollection.collectionId}&name=${\"asset\"}&name-match=endsWith`, 'GET', iteration.token)\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          const names = distinct.AssetNamesAvailable.filter(asset => asset.name.endsWith(\"asset\"))\n          if(iteration.name === 'lvl1'){\n            expect(res.body).to.be.an(`array`).of.length(1)\n          }\n          else {\n            expect(res.body).to.be.an(`array`).of.length(2)\n          }\n          for(const asset of res.body){\n            expect(asset.assetId).to.be.oneOf(reference.testCollection.assetIds)\n          }\n        })\n        it(\"assets accessible to the requester name match predicate where asset name contains should return assets containg `lvl`\", async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.testCollection.collectionId}&name=${\"lvl\"}&name-match=contains`, 'GET', iteration.token)\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          const names = distinct.AssetNamesAvailable.filter(asset => asset.name.includes(\"lvl\"))\n          expect(res.body).to.be.an(`array`).of.length(names.length)\n          for(const asset of res.body){\n            expect(asset.assetId).to.be.oneOf(names.map(asset => asset.assetId))\n          }\n        })\n        it(\"should not filter on name even with name-match=exact because no name predicate was passed.\", async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.testCollection.collectionId}&name-match=exact`, 'GET', iteration.token)\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`).of.length(distinct.assetIds.length)\n        })\n      })\n      describe(`getChecklistByAsset - /assets/{assetId}/checklists`, function () {\n\n        it(`Return the Checklist for the test Asset with benchmark query param of test benchmark (VPN_SRG_TEST)`, async function () {\n\n          const url = `${config.baseUrl}/assets/${reference.testAsset.assetId}/checklists?benchmarkId=${reference.benchmark}`\n          const options = {\n            method: 'GET',\n            headers: {\n              Authorization: `Bearer ${iteration.token}`,\n            },\n          }\n    \n          const res = await fetch(url, options)\n    \n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          const bodyText = await res.text()\n          expect(res.status).to.eql(200)\n\n          let cklData\n\n          const parser = new XMLParser({ processEntities: { enabled: true, maxTotalExpansions: 200000 } })\n          cklData = parser.parse(bodyText)\n\n          let cklHostName = cklData.CHECKLIST.ASSET.HOST_NAME\n          let cklIStigs = cklData.CHECKLIST.STIGS.iSTIG\n      \n          const regex = new RegExp(distinct.assetMatchString)\n          expect(cklHostName).to.match(regex)\n          let currentStigId \n          for(const stigData of cklIStigs.STIG_INFO.SI_DATA){\n            if (stigData.SID_NAME == `stigid`){\n              currentStigId = stigData.SID_DATA\n              expect(currentStigId).to.be.eql(reference.benchmark)\n          }\n          }\n          let cklVulns = cklIStigs.VULN;\n          expect(cklVulns).to.be.an(`array`);\n          if (currentStigId == reference.benchmark) {\n              expect(cklVulns).to.be.an(`array`).of.length(reference.checklistLength);\n          }\n        })\n\n        it(`Return the Checklist for the test Asset and MULTI-STIG JSON (.cklB)`, async function () {\n            \n            const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/checklists?format=cklb`, 'GET', iteration.token)\n\n            if(!distinct.hasAccessToTestAsset){\n              expect(res.status).to.eql(403)\n              return\n            }\n      \n            expect(res.status).to.eql(200)\n            let cklbData = res.body\n            let cklbHostName = cklbData.target_data.host_name\n            let cklbIStigs = cklbData.stigs\n\n            const regex = new RegExp(distinct.assetMatchString)\n            expect(cklbHostName).to.match(regex)\n\n            for (let stig of cklbIStigs){\n              let stigId = stig.stig_id\n              expect(stigId).to.be.oneOf(reference.testCollection.validStigs)\n              let cklbVulns = stig.rules;\n              expect(cklbVulns).to.be.an(`array`);\n              if (stigId == reference.benchmark) {\n                  expect(cklbVulns).to.be.an(`array`).of.length(reference.checklistLength);\n              }\n            }\n        })\n\n        it(`Return the Checklist for the test Asset and MULTI-STIG JSON (.cklB) - specific STIGs specified`, async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/checklists?format=cklb&benchmarkId=${reference.benchmark}&benchmarkId=Windows_10_STIG_TEST`, 'GET', iteration.token)\n\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          if(distinct.grant === `restricted`){\n            expect(res.status).to.eql(400)\n            return\n          }\n          expect(res.status).to.eql(200)\n          let cklbData = res.body\n          let cklbHostName = cklbData.target_data.host_name\n          let cklbIStigs = cklbData.stigs\n\n          const regex = new RegExp(distinct.assetMatchString)\n          expect(cklbHostName).to.match(regex)\n\n          for (let stig of cklbIStigs){\n            let stigId = stig.stig_id\n            expect(stigId).to.be.oneOf(reference.testCollection.validStigs)\n            let cklbVulns = stig.rules;\n            expect(cklbVulns).to.be.an(`array`);\n            if (stigId == reference.benchmark) {\n                expect(cklbVulns).to.be.an(`array`).of.length(reference.checklistLength);\n            }\n          }\n\n        })\n\n        it(`Return the Checklist for the test Asset and MULTI-STIG XML (.CKL) - no specified stigs`, async function () {\n\n          const url = `${config.baseUrl}/assets/${reference.testAsset.assetId}/checklists/`\n          const options = {\n            method: 'GET',\n            headers: {\n              Authorization: `Bearer ${iteration.token}`,\n            },\n          }\n    \n          const res = await fetch(url, options)\n    \n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          const bodyText = await res.text()\n          expect(res.status).to.eql(200)\n\n          let cklData\n\n          const parser = new XMLParser({ processEntities: { enabled: true, maxTotalExpansions: 200000 } })\n          cklData = parser.parse(bodyText)\n\n          let cklHostName = cklData.CHECKLIST.ASSET.HOST_NAME\n          let cklIStigs = [cklData.CHECKLIST.STIGS.iSTIG]\n\n          const regex = new RegExp(distinct.assetMatchString)\n          expect(cklHostName).to.match(regex)\n\n          if(iteration.name === 'lvl1'){\n            cklIStigs = [cklIStigs]\n          }\n\n          for (let stig of cklIStigs[0]){\n            let currentStigId\n            let referenceStig\n            for(let stigData of stig.STIG_INFO.SI_DATA){\n              if (stigData.SID_NAME == `stigid`){\n                currentStigId = stigData.SID_DATA\n                expect(currentStigId).to.be.oneOf(reference.testCollection.validStigs)\n                if(stigData.SID_DATA == reference.benchmark){\n                  referenceStig = stig\n                }\n              }\n            }\n            if (referenceStig) {\n              let referenceStigVulns = referenceStig.VULN\n                expect(referenceStigVulns).to.be.an(`array`).of.length(reference.checklistLength)\n            }\n          }\n        })\n\n        it(`Return the Checklist for the supplied Asset and MULTI-STIG XML (.CKL) - specified stigs`, async function () {\n          \n          const url = `${config.baseUrl}/assets/${reference.testAsset.assetId}/checklists?benchmarkId=${reference.benchmark}&benchmarkId=Windows_10_STIG_TEST`;\n          const options = {\n            method: 'GET',\n            headers: {\n              Authorization: `Bearer ${iteration.token}`,\n            },\n          }\n    \n          // Fetch request\n          const res = await fetch(url, options)\n    \n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          if(distinct.grant === `restricted`){\n            expect(res.status).to.eql(400)\n            return\n          }\n          \n          expect(res.status).to.eql(200)\n    \n          let cklData\n\n          const bodyText = await res.text()\n    \n          const parser = new XMLParser({ processEntities: { enabled: true, maxTotalExpansions: 200000 } })\n          cklData = parser.parse(bodyText)\n    \n          let cklHostName = cklData.CHECKLIST.ASSET.HOST_NAME\n          let cklIStigs = cklData.CHECKLIST.STIGS.iSTIG\n    \n          const regex = new RegExp(distinct.assetMatchString)\n          expect(cklHostName).to.match(regex)\n          let currentStigId\n          for (let stig of cklIStigs){\n            for(let stigData of stig.STIG_INFO.SI_DATA){\n              if (stigData.SID_NAME == `stigid`){\n                currentStigId = stigData.SID_DATA\n                expect(currentStigId).to.be.oneOf(reference.testCollection.validStigs)\n            }\n            }\n            let cklVulns = stig.VULN;\n            expect(cklVulns).to.be.an(`array`);\n            if (currentStigId == reference.benchmark) {\n                expect(cklVulns).to.be.an(`array`).of.length(reference.checklistLength);\n            }\n          }\n        })\n\n        it('should return 204, asset does not have checklists', async function () {\n\n          //create asset with no checklists \n          const res = await utils.executeRequest(`${config.baseUrl}/assets`, 'POST', iteration.token, {\n            name: `assetNoChecklists` + utils.getUUIDSubString(),\n            collectionId: reference.testCollection.collectionId,\n            description: `test`,\n            ip: `1.1.1.1`,\n            noncomputing: true,\n            labelNames: [],\n            metadata: {\n              pocName: `pocName`,\n            },\n            stigs: []\n          })\n            if(!distinct.canModifyCollection){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(201)\n\n            const assetId = res.body.assetId\n\n            const res2 = await utils.executeRequest(`${config.baseUrl}/assets/${assetId}/checklists`, 'GET', iteration.token)\n            expect(res2.status).to.eql(204)\n            \n            await utils.deleteAsset(assetId)\n        })\n\n        it(\"should return 403, asset is deleted\", async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.deletedAsset.assetId}/checklists`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n      describe(`getChecklistByAssetStig - /assets/{assetId}/checklists/{benchmarkId}/{revisionStr}`, function () {\n\n        it(`Return the Checklist for the supplied Asset and benchmarkId and revisionStr`, async function () {\n\n          const url = `${config.baseUrl}/assets/${reference.testAsset.assetId}/checklists/${reference.benchmark}/${reference.revisionStr}?format=ckl`\n          const options = {\n            method: 'GET',\n            headers: {\n              Authorization: `Bearer ${iteration.token}`,\n            },\n          }\n    \n          // Fetch request\n          const res = await fetch(url, options)\n    \n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          \n          expect(res.status).to.eql(200)\n    \n          let cklData\n\n          const bodyText = await res.text()\n    \n          const parser = new XMLParser({ processEntities: { enabled: true, maxTotalExpansions: 200000 } })\n          cklData = parser.parse(bodyText)\n    \n\n          let cklHostName = cklData.CHECKLIST.ASSET.HOST_NAME\n          let cklIStigs = cklData.CHECKLIST.STIGS.iSTIG\n\n          const regex = new RegExp(distinct.assetMatchString)\n          expect(cklHostName).to.match(regex)\n\n          cklIStigs = [cklIStigs]\n          let currentStigId\n          for (let stig of cklIStigs){\n            for(let stigData of stig.STIG_INFO.SI_DATA){\n              if (stigData.SID_NAME == `stigid`){\n                currentStigId = stigData.SID_DATA\n                expect(currentStigId).to.be.eql(reference.benchmark)\n            }\n            }\n            let cklVulns = stig.VULN\n            expect(cklVulns).to.be.an(`array`)\n            if (currentStigId == reference.benchmark) {\n                expect(cklVulns).to.be.an(`array`).of.length(reference.checklistLength)\n            }\n          }\n        })\n\n        it(`Return the Checklist for the supplied Asset and benchmarkId and revisionStr json-access`, async function () {\n\n          const url = `${config.baseUrl}/assets/${reference.testAsset.assetId}/checklists/${reference.benchmark}/${reference.revisionStr}?format=json-access`\n          const options = {\n            method: 'GET',\n            headers: {\n              Authorization: `Bearer ${iteration.token}`,\n            },\n          }\n    \n          const res = await fetch(url, options)\n    \n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          \n          expect(res.status).to.eql(200)\n    \n          let cklData\n\n          const bodyText = await res.json()\n\n          for(const checklist of bodyText.checklist){\n            expect(checklist.assetId).to.be.oneOf(reference.testCollection.assetIds)\n            if(checklist.ruleId === reference.testCollection.ruleId){\n              expect(checklist.ruleId).to.eql(reference.testCollection.ruleId)\n              expect(checklist.assetId).to.eql(reference.testAsset.assetId)\n              expect(checklist.result).to.eql(\"pass\")\n              expect(checklist.status).to.eql(\"submitted\")\n              expect(checklist.autoResult).to.eql(false)\n\n            }\n          }\n\n        })\n\n        it(`Return the Checklist for the supplied Asset and benchmarkId and revisionStr json with projections`, async function () {\n\n          const res = await utils.executeRequest(\n            `${config.baseUrl}/assets/${reference.testAsset.assetId}/checklists/${reference.benchmark}/${reference.revisionStr}?format=json&projection=detail&projection=comment&projection=rule`,\n            'GET',\n            iteration.token\n          )\n\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`).of.length(reference.checklistLength)\n\n          for (const checklist of res.body) {\n            expect(checklist.assetId).to.be.oneOf(reference.testCollection.assetIds)\n            if (checklist.ruleId === reference.testCollection.ruleId) {\n              expect(checklist.ruleId).to.eql(reference.testCollection.ruleId)\n              expect(checklist.assetId).to.eql(reference.testAsset.assetId)\n              expect(checklist.result).to.eql(\"pass\")\n              expect(checklist.status).to.eql(\"submitted\")\n              expect(checklist.autoResult).to.eql(false)\n              expect(checklist.detail).to.eql(\"test\\nvisible to lvl1\")\n              expect(checklist.comment).to.eql(\"idk\")\n              expect(checklist.rule).to.be.an('object')\n              expect(checklist.rule.ruleId).to.eql(reference.testRule.ruleId)\n              expect(checklist.rule.groupId).to.eql(reference.testRule.groupId)\n              expect(checklist.rule.version).to.eql(reference.testRule.version)\n              expect(checklist.rule.detail).to.be.an('object')\n              expect(checklist.rule.detail.vulnDiscussion).to.include(\"Unrestricted traffic may contain malicious traffic\")\n              expect(checklist.rule.ccis).to.be.an('array')\n              expect(checklist.rule.check).to.be.an('object')\n              expect(checklist.rule.fix).to.be.an('object')\n            }\n          }\n        })\n\n        it(`Return the Checklist for the supplied Asset and STIG XML (.cklB) - specific STIG`, async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/checklists/${reference.benchmark}/${reference.revisionStr}?format=cklb`, 'GET', iteration.token)\n\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          expect(res.status).to.eql(200)\n        \n          let cklbData = res.body\n          let cklbHostName = cklbData.target_data.host_name\n          let cklbIStigs = cklbData.stigs\n\n          const regex = new RegExp(distinct.assetMatchString)\n          expect(cklbHostName).to.match(regex)\n\n          for (let stig of cklbIStigs){\n            let stigId = stig.stig_id\n            expect(stigId).to.be.oneOf(reference.testCollection.validStigs)\n            let cklbVulns = stig.rules;\n            expect(cklbVulns).to.be.an(`array`);\n            if (stigId == reference.benchmark) {\n                expect(cklbVulns).to.be.an(`array`).of.length(reference.checklistLength);\n            }\n          }\n        })\n\n        it(`Return the Checklist for the supplied Asset and STIG JSON`, async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/checklists/${reference.benchmark}/${reference.revisionStr}?format=json`, 'GET', iteration.token)\n\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`).of.length(reference.checklistLength)\n        })\n\n        it(\"Return checklist for a disabled asset in an enabled collection. expect 404. \", async function () {\n\n          const deletedAsset  = reference.deletedAsset.assetId\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${deletedAsset}/checklists/${reference.benchmark}/${reference.revisionStr}`, 'GET', iteration.token)\n\n          expect(res.status).to.eql(403)\n\n        })\n      })\n      describe(`getStigsByAsset - /assets/{assetId}/stigs`, function () {\n\n        it(`Return the Checklist for the supplied Asset and benchmarkId and revisionStr - rules`, async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/stigs`, 'GET', iteration.token)\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`).of.length(distinct.validStigs.length)\n          for(let stig of res.body){\n            expect(stig.benchmarkId).to.be.oneOf(reference.testCollection.validStigs)\n          }\n        })\n\n        it(\"should return 403, asset is deleted\", async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.deletedAsset.assetId}/stigs`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n      describe(`getAssetsByCollectionLabelId - /collections/{collectionId}/labels/{labelId}/assets`, function () {\n\n        it(`Return the Checklist for the supplied Asset and benchmarkId - rules`, async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/labels/${reference.testCollection.fullLabel}/assets`, 'GET', iteration.token)\n\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`).of.length(distinct.assetsAvailableFullLabel.length)\n          \n          for(let asset of res.body){\n            expect(asset.assetId).to.be.oneOf(distinct.assetsAvailableFullLabel)\n          }   \n        })\n      })\n      describe(`getAssetsByStig - /collections/{collectionId}/stigs/{benchmarkId}/assets`, function () {\n\n        it(`Assets in a Collection attached to a STIG`, async function () {\n          \n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.benchmark}/assets`, 'GET', iteration.token)\n            \n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`).of.length(distinct.assetsAvailableBenchmark.length)\n          for(let asset of res.body){\n            expect(asset.assetId, \"expect assetId to be an asset attached to this bnenchmark\").to.be.oneOf(distinct.assetsAvailableBenchmark)\n            expect(asset.collectionId, \"expect collectionId to be equal to reference.testCollection.collectionId\").to.be.eql(reference.testCollection.collectionId)\n            for(const label of asset.assetLabelIds){\n              expect(label).to.be.oneOf(reference.testCollection.labels, `Label should be one of the valid labels`)\n            }\n            if(asset.assetId === reference.testAsset.assetId){\n              expect(asset.assetLabels).to.deep.equalInAnyOrder(reference.testAsset.fullLabels)\n            }\n            if(asset.access === \"r\"){\n              expect(iteration.name).to.be.oneOf(['lvl1'])\n            }\n            else {\n              expect(asset.access).to.be.oneOf(['rw'])\n            }\n          }   \n        })\n        it(`Assets in a Collection attached to a STIG - label-lvl1`, async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.benchmark}/assets?labelId=${reference.testCollection.lvl1Label}`, 'GET', iteration.token)\n\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`).of.length(reference.testCollection.lvl1LabelAssetIds.length)\n          for(const asset of res.body){\n            expect(asset.assetId).to.be.oneOf(reference.testCollection.lvl1LabelAssetIds)\n            expect(asset.collectionId, \"expect collectionId to be equal to reference.testCollection.collectionId\").to.be.eql(reference.testCollection.collectionId)\n            for(const label of asset.assetLabelIds){\n              expect(label).to.be.oneOf(reference.testCollection.labels, `Label should be one of the valid labels`)\n            }\n            if(asset.assetId === reference.testAsset.assetId){\n              expect(asset.assetLabels).to.deep.equalInAnyOrder(reference.testAsset.fullLabels)\n            }\n            if(asset.access === \"r\"){\n              expect(iteration.name).to.be.oneOf(['lvl1'])\n            }\n            else {\n              expect(asset.access).to.be.oneOf(['rw'])\n            }      \n          }\n       \n        })\n        it(`Assets in a Collection attached to a STIG - labelId`, async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.benchmark}/assets?labelId=${reference.testCollection.fullLabel}`, 'GET', iteration.token)\n\n          if(!distinct.hasAccessToTestAsset){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an(`array`).of.length(distinct.assetsAvailableFullLabel.length)\n\n          for(let asset of res.body){\n            expect(asset.assetId, \"expect assetId to be an asset attached to this bnenchmark\").to.be.oneOf(distinct.assetsAvailableBenchmark)\n            expect(asset.collectionId, \"expect collectionId to be equal to reference.testCollection.collectionId\").to.be.eql(reference.testCollection.collectionId)\n            for(const label of asset.assetLabelIds){\n              expect(label).to.be.oneOf(reference.testCollection.labels, `Label should be one of the valid labels`)\n            }\n            if(asset.assetId === reference.testAsset.assetId){\n              expect(asset.assetLabels).to.deep.equalInAnyOrder(reference.testAsset.fullLabels)\n            }\n            if(asset.access === \"r\"){\n              expect(iteration.name).to.be.oneOf(['lvl1'])\n            }\n            else {\n              expect(asset.access).to.be.oneOf(['rw'])\n            }       \n          }   \n        })\n        it(`Assets in a Collection attached to a STIG - labelName`, async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.benchmark}/assets?labelName=${reference.testCollection.fullLabelName}`, 'GET', iteration.token)\n            if(!distinct.hasAccessToTestAsset){\n              expect(res.status).to.eql(403)\n              return\n            }\n  \n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an(`array`).of.length(distinct.assetsAvailableFullLabel.length)\n  \n            for(let asset of res.body){\n              expect(asset.assetId, \"expect assetId to be an asset attached to this bnenchmark\").to.be.oneOf(distinct.assetsAvailableBenchmark)\n              expect(asset.collectionId, \"expect collectionId to be equal to reference.testCollection.collectionId\").to.be.eql(reference.testCollection.collectionId)\n              for(const label of asset.assetLabelIds){\n                expect(label).to.be.oneOf(reference.testCollection.labels, `Label should be one of the valid labels`)\n              }\n              if(asset.assetId === reference.testAsset.assetId){\n                expect(asset.assetLabels).to.deep.equalInAnyOrder(reference.testAsset.fullLabels)\n              }\n              if(asset.access === \"r\"){\n                expect(iteration.name).to.be.oneOf(['lvl1'])\n              }\n              else {\n                expect(asset.access).to.be.oneOf(['rw'])\n              }         \n            }   \n        })\n        it(`Assets in a Collection attached to a STIG - label match = null`, async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.benchmark}/assets?labelMatch=null`, 'GET', iteration.token)\n            if(!distinct.hasAccessToTestAsset){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200) \n            expect(res.body).to.be.an(`array`).of.length(1)\n            for(let asset of res.body){\n              expect(asset.assetLabelIds).to.be.empty\n              expect(asset.collectionId).to.eql(reference.testCollection.collectionId)\n              if(asset.access === \"r\"){\n                expect(iteration.name).to.be.oneOf(['lvl1'])\n              }\n              else {\n                expect(asset.access).to.be.oneOf(['rw'])\n              }\n            }\n           \n        })\n      })\n    })\n  }\n})\n"
  },
  {
    "path": "test/api/mocha/data/asset/assetPatch.test.js",
    "content": "\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\n\ndescribe('PATCH - Asset', function () {\n\n  before(async () => {\n    await utils.loadAppData()\n  })\n  \n  after(async () => {\n    await utils.resetTestAsset()\n    await utils.resetScrapAsset()\n  })\n\n  for(const iteration of iterations){\n    if (expectations[iteration.name] === undefined){\n      it(`No expectations for this iteration scenario: ${iteration.name}`, async function () {})\n      continue\n    }\n\n    describe(`iteration:${iteration.name}`, function () {\n      const distinct = expectations[iteration.name]\n      let testAsset = null\n      let scrapAsset = null\n      beforeEach(async function () {\n\n        testAsset = await utils.resetTestAsset()\n        scrapAsset = await utils.resetScrapAsset()\n      })\n\n      describe(`updateAsset - /assets/{assetId}`, function () {\n\n        it('Merge provided properties with an Asset - Change Collection - Fail for all iterations', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}?projection=statusStats&projection=stigs`, 'PATCH', iteration.token, { \n              \"collectionId\": reference.scrapLvl1User.userId,\n              \"description\": \"test desc\",\n              \"ip\": \"1.1.1.1\",\n              \"noncomputing\": true,\n              \"metadata\": {},\n              \"stigs\": [\n                  \"VPN_SRG_TEST\",\n                  \"Windows_10_STIG_TEST\",\n                  \"RHEL_7_STIG_TEST\"\n              ]\n          })\n\n          expect(res.status).to.eql(403)\n        })\n\n        it('Merge provided properties with an Asset - Change Collection - valid for lvl3 and lvl4 only (IE works for admin for me)', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}?projection=statusStats&projection=stigs`, 'PATCH', iteration.token, {\n              \"collectionId\": reference.scrapCollection.collectionId,\n              \"description\": \"test desc\",\n              \"ip\": \"1.1.1.1\",\n              \"noncomputing\": true,\n              \"metadata\": {},\n              \"stigs\": [\n                  \"VPN_SRG_TEST\",\n                  \"Windows_10_STIG_TEST\",\n                  \"RHEL_7_STIG_TEST\"\n              ]\n            })\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.collection.collectionId).to.equal(reference.scrapCollection.collectionId)\n          expect(res.body.labelIds).to.have.lengthOf(reference.testAsset.labels.length)\n          expect(res.body.labels).to.have.lengthOf(reference.testAsset.labels.length)\n          expect(res.body.ip).to.equal(reference.testAsset.ipaddress)\n          expect(res.body.noncomputing).to.equal(true)\n          expect(res.body.metadata).to.deep.equal({})\n          expect(res.body.description).to.equal('test desc')\n          for(const stig of res.body.stigs){\n            expect(stig.benchmarkId).to.be.oneOf([\n              'VPN_SRG_TEST',\n              'Windows_10_STIG_TEST',\n              'RHEL_7_STIG_TEST'\n            ])\n          }\n          const effectedAsset = await utils.getAsset(res.body.assetId)\n          expect(effectedAsset.collection.collectionId).to.equal(reference.scrapCollection.collectionId)\n          expect(effectedAsset.description).to.equal('test desc')\n          expect(effectedAsset.labelIds).to.have.lengthOf(2)\n          expect(effectedAsset.labels).to.have.lengthOf(2)\n          for (const stig of effectedAsset.stigs) {\n            expect(stig.benchmarkId).to.be.oneOf([\n              'VPN_SRG_TEST',\n              'Windows_10_STIG_TEST',\n              'RHEL_7_STIG_TEST'\n            ])\n          }\n          \n        }) \n    \n        it('Merge provided properties with an Asset', async function () {\n        \n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.scrapAsset.assetId}?projection=statusStats&projection=stigs`, 'PATCH', iteration.token, {\n              \"collectionId\": reference.scrapCollection.collectionId,\n              \"description\": \"scrap\",\n              \"ip\": \"1.1.1.1\",\n              \"noncomputing\": true,\n              \"metadata\": {\n                \"pocName\": \"poc2Put\",\n                \"pocEmail\": \"pocEmailPut@email.com\",\n                \"pocPhone\": \"12342\",\n                \"reqRar\": \"true\"\n              },\n              \"stigs\": [\n                  \"VPN_SRG_TEST\",\n                  \"Windows_10_STIG_TEST\",\n                  \"RHEL_7_STIG_TEST\"\n              ]\n          })\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('object')\n          expect(res.body.collection.collectionId).to.equal(reference.scrapCollection.collectionId)\n          expect(res.body.ip).to.equal(\"1.1.1.1\")\n          expect(res.body.noncomputing).to.equal(true)\n          expect(res.body.metadata).to.deep.equal({\n            \"pocName\": \"poc2Put\",\n            \"pocEmail\": \"pocEmailPut@email.com\",\n            \"pocPhone\": \"12342\",\n            \"reqRar\": \"true\"\n          })\n          for(const stig of res.body.stigs){\n            expect(stig.benchmarkId).to.be.oneOf([\n              'VPN_SRG_TEST',\n              'Windows_10_STIG_TEST',\n              'RHEL_7_STIG_TEST'\n            ])\n          }\n          const effectedAsset = await utils.getAsset(res.body.assetId)\n          expect(effectedAsset.collection.collectionId).to.equal(reference.scrapCollection.collectionId)\n          expect(effectedAsset.description).to.equal('scrap')\n          expect(effectedAsset.metadata).to.deep.equal({\n            \"pocName\": \"poc2Put\",\n            \"pocEmail\": \"pocEmailPut@email.com\",\n            \"pocPhone\": \"12342\",\n            \"reqRar\": \"true\"\n          })\n          for(const stig of effectedAsset.stigs){\n            expect(stig.benchmarkId).to.be.oneOf([\n              'VPN_SRG_TEST',\n              'Windows_10_STIG_TEST',\n              'RHEL_7_STIG_TEST'\n            ])\n          }\n        })\n\n        it(\"asset id does not exist\", async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/999999`, 'PATCH', iteration.token, {\n              \"description\": \"scrap\",\n          })\n          expect(res.status).to.eql(403)\n        })\n\n        it(\"should 403, asset is deleted\", async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.deletedAsset.assetId}`, 'PATCH', iteration.token, {\n              \"description\": \"scrap\",\n          })\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe(`patchAssetMetadata - /assets/{assetId}/metadata`, function () {\n        \n        it('Merge provided properties with an Asset - Change metadata', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/metadata`, 'PATCH', iteration.token, {\n              \"testkey\":\"poc2Patched\"\n            })\n\n            if(!distinct.canModifyCollection){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.body, \"expect new metadata to take effect\").to.deep.equal({\n              \"testkey\": \"poc2Patched\",\n            })\n            const effectedAsset = await utils.getAsset(reference.testAsset.assetId)\n            expect(effectedAsset.metadata, \"getting asset for double checking\").to.deep.equal({\n              \"testkey\": \"poc2Patched\"\n            })\n        })\n        it('Merge metadata property/value into an Asset', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.scrapAsset.assetId}/metadata`, 'PATCH', iteration.token, {\n              \"testkey\":\"poc2Patched\"\n            })\n\n            if(!distinct.canModifyCollection){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.body).to.deep.equal({\n              \"testkey\": \"poc2Patched\",\n            })\n            const effectedAsset = await utils.getAsset(reference.scrapAsset.assetId)\n            expect(effectedAsset.metadata, \"getting asset for double check metadata has changed\").to.deep.equal({\n              \"testkey\": \"poc2Patched\"\n            })\n        })\n\n        it(\"should 403, asset is deleted\", async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.deletedAsset.assetId}`, 'PATCH', iteration.token, {\n              \"description\": \"scrap\",\n          })\n          expect(res.status).to.eql(403)\n        })\n\n      })\n\n      describe(`patchAssets - /assets`, function () {\n\n        let asset1 = null\n        let asset2 = null\n\n        before(async function () {\n          asset1 = await utils.createTempAsset()\n          asset2 = await utils.createTempAsset()\n        \n        })\n    \n        it('Delete Assets - expect success for valid iterations', async function () {\n\n            const assetIds = [asset1.assetId, asset2.assetId]\n\n            const res = await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.testCollection.collectionId}`, 'PATCH', iteration.token, {\n                \"operation\": \"delete\",\n                \"assetIds\": assetIds\n            })\n        \n            if(!distinct.canModifyCollection){\n                expect(res.status).to.eql(403)\n                return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body, \"expect assets 29 and 42 to be delted\").to.eql({\n            \"operation\": \"deleted\",\n            \"assetIds\": assetIds})\n            \n            for(const assetID of res.body.assetIds){\n                const effectedAsset = await utils.getAsset(assetID)\n                expect(effectedAsset.status, \"response should be 403 due to asset being deleted\").to.equal(403)\n            }\n            \n        })\n        it('Delete Assets - assets not in collection', async function () {\n            const res = await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.testCollection.collectionId}`, 'PATCH', iteration.token, {\n                \"operation\": \"delete\",\n                \"assetIds\": [\"258\",\"260\"]\n              })\n              expect(res.status).to.eql(403)\n        })\n        it('Delete Assets - collection does not exist', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${99999}`, 'PATCH', iteration.token, {\n              \"operation\": \"delete\",\n              \"assetIds\": [\"29\",\"42\"]\n            })\n            expect(res.status).to.eql(403)\n        })\n      })  \n    })\n  }\n})\n\n"
  },
  {
    "path": "test/api/mocha/data/asset/assetPost.test.js",
    "content": "\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {requestBodies} from \"./requestBodies.js\"\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport { expect } from 'chai'\n\ndescribe('POST - Asset', function () {\n  for (const iteration of iterations) {\n    if (expectations[iteration.name] === undefined){\n      it(`No expectations for this iteration scenario: ${iteration.name}`, async function () {})\n      continue\n    }\n    describe(`iteration:${iteration.name}`, function () {\n      const distinct = expectations[iteration.name]\n      describe(`createAsset - /assets`, function () {\n\n        before(async function () {  \n          await utils.loadAppData()\n        })\n\n        it('Create an Asset (with statusStats and stigs projection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets?projection=statusStats&projection=stigs`, 'POST', iteration.token, {\n              name: 'TestAsset' + utils.getUUIDSubString(10),\n              collectionId: reference.testCollection.collectionId,\n              description: 'test',\n              ip: '1.1.1.1',\n              noncomputing: true,\n              labelNames: [reference.testCollection.fullLabelName],\n              metadata: {\n                pocName: 'pocName',\n                pocEmail: 'pocEmail@example.com',\n                pocPhone: '12345',\n                reqRar: 'true'\n              },\n              stigs: reference.testCollection.validStigs\n            })\n          \n            if(!distinct.canModifyCollection){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(201)\n            \n            expect(res.body.collection.collectionId).to.equal(reference.testCollection.collectionId)\n            expect(res.body.name).to.be.a('string')\n            expect(res.body.ip).to.equal('1.1.1.1')\n            expect(res.body.noncomputing).to.equal(true)\n            expect(res.body.labelIds).to.eql([reference.testCollection.fullLabel])\n            expect(res.body.labels).to.be.an('array').of.length(1)\n            expect(res.body.labels[0].labelId).to.equal(reference.testCollection.fullLabel)\n            expect(res.body.metadata.pocName).to.equal('pocName')\n            expect(res.body.metadata.pocEmail).to.equal('pocEmail@example.com')\n            expect(res.body.stigs).to.be.an('array').of.length(reference.testCollection.validStigs.length)\n            expect(res.body).to.have.property('statusStats')\n            expect(res.body.statusStats.maxTs).to.be.null\n            expect(res.body.statusStats.minTs).to.be.null\n            expect(res.body.statusStats.ruleCount).to.equal(reference.testAsset.stats.ruleCount)\n            expect(res.body.statusStats.stigCount).to.equal(reference.testAsset.stats.stigCount)\n            expect(res.body.statusStats.savedCount).to.equal(null)\n            expect(res.body.statusStats.acceptedCount).to.equal(null)\n            expect(res.body.statusStats.rejectedCount).to.equal(null)\n\n            for(const stig of res.body.stigs) {\n              expect(stig.benchmarkId).to.be.oneOf(reference.testCollection.validStigs)\n            }\n\n            const effectedAsset = await utils.getAsset(res.body.assetId)\n\n            expect(effectedAsset.statusStats.ruleCount).to.equal(reference.testAsset.stats.ruleCount)\n\n        })\n        it('should fail, duplicate asset name', async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets`, 'POST', iteration.token, {\n              name: reference.testAsset.name,\n              collectionId: reference.testCollection.collectionId,\n              description: 'test',\n              ip: '1.1.1.1',\n              noncomputing: true,\n              labelNames: [reference.testCollection.fullLabelName],\n              metadata: {\n                pocName: 'pocName',\n              },\n              stigs: reference.testCollection.validStigs\n          })\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(422)\n        })\n        it(\"create asset with name of a currently disabled asset\", async function () {\n\n          const name = \"deletedAsset\"\n          const disabledAssetId = 247\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets`, 'POST', iteration.token, {\n              name,\n              collectionId: reference.testCollection.collectionId,\n              description: 'test',\n              ip: '1.1.1.1',\n              noncomputing: true,\n              labelNames: [],\n              metadata: {\n                pocName: 'pocName',\n              },\n              stigs: []\n            })\n\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(201)\n          expect(res.body.name).to.equal(name)\n          expect(res.body.assetId).to.not.equal(disabledAssetId)\n\n        })\n        it('Create an Asset', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets`, 'POST', iteration.token, {\n              name: 'TestAsset' + utils.getUUIDSubString(10),\n              collectionId: reference.testCollection.collectionId,\n              description: 'test',\n              ip: '1.1.1.1',\n              noncomputing: true,\n              labelNames: [reference.testCollection.fullLabelName],\n              metadata: {\n                pocName: 'pocName',\n                pocEmail: 'pocEmail@example.com',\n                pocPhone: '12345',\n                reqRar: 'true'\n              },\n              stigs: reference.testCollection.validStigs\n            })\n          \n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(201)         \n        })\n        it(\"create asset with same name as test asset in test collection (expect 422)\", async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets`, 'POST', iteration.token, {\n              name: reference.testAsset.name,\n              collectionId: reference.testCollection.collectionId,\n              description: 'test',\n              ip: '1.1.1.1',\n              noncomputing: true,\n              labelNames: [reference.testCollection.fullLabelName],\n              metadata: {\n                pocName: 'pocName',\n                pocEmail: 'pocEmail@example.com',\n                pocPhone: '12345',\n                reqRar: 'true'\n              },\n              stigs: reference.testCollection.validStigs\n            })\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(422)\n        })\n        it(\"Create asset that already exist, expect correct 422 response \", async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets`, 'POST', iteration.token, {\n              name: reference.testAsset.name,\n              collectionId: reference.testCollection.collectionId,\n              description: 'test',\n              ip: '1.1.1.1',\n              noncomputing: true,\n              labelNames: [reference.testCollection.fullLabelName],\n              metadata: {\n                pocName: 'pocName',\n              },\n              stigs: reference.testCollection.validStigs\n            })\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(422)\n\n          expect(res.body.detail).to.be.an('array').of.length(1)\n          expect(res.body.detail[0].failure).to.equal('name exists')\n          expect(res.body.detail[0].detail).to.eql({\n            name: \"Collection_X_lvl1_asset-1\",\n            assetIndex: 1,\n          })\n\n        })\n\n        it(\"Create Asset with non-existing labelName, expect correct 422 response\", async function () {\n\n\n          const name = 'TestAsset' + utils.getUUIDSubString(10)\n\n          const res = await utils.executeRequest(`${config.baseUrl}/assets`, 'POST', iteration.token, {\n              name,\n              collectionId: reference.testCollection.collectionId,\n              description: 'test',\n              ip: '1.1.1.1',\n              noncomputing: true,\n              labelNames: [\"07285e36\"],\n              metadata: {\n                pocName: 'pocName',\n              },\n              stigs: []\n\n            })\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(422)\n          expect(res.body.detail).to.be.an('array').of.length(1)\n          expect(res.body.detail[0].failure).to.equal(\"unknown labelName\")\n          expect(res.body.detail[0].detail).to.eql({\n            name,\n            labelName: \"07285e36\",\n            assetIndex: 1,\n            labelIndex: 1,\n          })\n\n        })\n\n        it(\"Create Asset with non-existing benchmarkId, expect correct 422 response\", async function () {\n\n          const name = 'TestAsset' + utils.getUUIDSubString(10)\n          const res = await utils.executeRequest(`${config.baseUrl}/assets`, 'POST', iteration.token, {\n              name,\n              collectionId: reference.testCollection.collectionId,\n              description: 'test',\n              ip: '1.1.1.1',\n              noncomputing: true,\n              labelNames: [reference.testCollection.fullLabelName],\n              metadata: {\n                pocName: 'pocName',\n              },\n              stigs: [\"NotAStig\"]\n            })\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(422)\n          expect(res.body.detail).to.be.an('array').of.length(1)\n          expect(res.body.detail[0].failure).to.equal(\"unknown benchmarkId\")\n          expect(res.body.detail[0].detail).to.eql({\n            name,\n            benchmarkId: \"NotAStig\",\n            assetIndex: 1,\n            benchmarkIdIndex: 1,\n          })\n        })\n       \n      })\n      describe(`createAssets - /collections/{collectionId}/assets`, function () {\n\n        before(async function () {  \n          await utils.loadAppData()\n        })\n\n        it(\"Create Assets in batch all projections dry run false should create assets\", async function () {\n\n          const assets = [{\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [reference.testCollection.fullLabelName, reference.testCollection.lvl1LabelName],\n            metadata: {\n              batch: 'batch',\n              batch2: 'batch2'\n            },\n            stigs: reference.testCollection.validStigs\n          },\n          {\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: []\n          }]\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/21/assets?projection=stigs&projection=statusStats&dryRun=false`, 'POST', iteration.token,\n            assets\n          )\n            \n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(201)\n          expect(res.body).to.be.an('array').of.length(2)\n          expect(res.body[0].name).to.equal(assets[0].name)\n          expect(res.body[1].name).to.equal(assets[1].name)\n          for(const asset of res.body) {\n            expect(asset.ip).to.equal('1.1.1.1')\n            expect(asset.noncomputing).to.equal(true)\n            expect(asset.mac).to.be.null\n            expect(asset.collection.collectionId).to.equal(reference.testCollection.collectionId)\n           \n            expect(asset.statusStats.maxTs).to.be.null\n            expect(asset.statusStats.minTs).to.be.null\n            \n            expect(asset.metadata.batch).to.equal('batch')\n            if(asset.name === assets[0].name){\n              expect(asset.labelIds).to.eql([reference.testCollection.fullLabel, reference.testCollection.lvl1Label])\n              expect(asset.labels).to.deep.equalInAnyOrder(reference.testAsset.fullLabels)\n              expect(asset.statusStats.stigCount).to.be.eql(2)\n              expect(asset.statusStats.ruleCount).to.be.eql(368)\n              for(const stig of asset.stigs) {\n                expect(stig.benchmarkId).to.be.oneOf(reference.testCollection.validStigs)\n              }\n            }\n            else {\n              expect(asset.labelIds).to.eql([])\n              expect(asset.labels).to.be.empty\n              expect(asset.statusStats.stigCount).to.be.eql(0)\n              expect(asset.statusStats.ruleCount).to.be.eql(null)\n              expect(asset.stigs).to.be.an('array').of.length(0)\n            }\n          }\n        })\n        it(\"Create Assets in batch, one asset\", async function () {\n\n          const assets = [\n          {\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [reference.testCollection.fullLabelName, reference.testCollection.lvl1LabelName],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: reference.testCollection.validStigs\n          }]\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/21/assets?projection=stigs&projection=statusStats`, 'POST', iteration.token,\n            assets\n            )\n            \n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(201)\n          expect(res.body).to.be.an('array').of.length(1)\n          expect(res.body[0].name).to.equal(assets[0].name)\n          for(const asset of res.body) {\n            expect(asset.ip).to.equal('1.1.1.1')\n            expect(asset.noncomputing).to.equal(true)\n            expect(asset.mac).to.be.null\n            expect(asset.collection.collectionId).to.equal(reference.testCollection.collectionId)\n            expect(asset.labelIds).to.eql([reference.testCollection.fullLabel, reference.testCollection.lvl1Label])\n            expect(asset.labels).to.deep.equalInAnyOrder(reference.testAsset.fullLabels)\n            expect(asset.statusStats.maxTs).to.be.null\n            expect(asset.statusStats.minTs).to.be.null\n            expect(asset.statusStats.stigCount).to.be.eql(2)\n            expect(asset.statusStats.ruleCount).to.be.eql(368)\n            expect(asset.metadata.batch).to.equal('batch')\n            for(const stig of asset.stigs) {\n              expect(stig.benchmarkId).to.be.oneOf(reference.testCollection.validStigs)\n            }\n          }\n        })\n\n        it(\"create two incorrect asssets both have stig that doesnt exist should return 200 for unsucessful dry run \", async function () {\n\n          const assets = [{\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [reference.testCollection.fullLabelName, reference.testCollection.lvl1LabelName],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: [\"NotAStig\"]\n          },\n          {\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [reference.testCollection.fullLabelName, reference.testCollection.lvl1LabelName],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: [\"NotAStig\"]\n          }]\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/21/assets?projection=stigs&projection=statusStats`, 'POST', iteration.token,\n            assets\n            )\n\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.detail).to.be.an('array').of.length(2)\n          for(const error of res.body.detail) {\n            expect(error.failure).to.equal(\"unknown benchmarkId\")\n            if(error.detail.name === assets[0].name){\n              expect(error.detail).to.eql({\n                name: assets[0].name,\n                benchmarkId: \"NotAStig\",\n                assetIndex: 1,\n                benchmarkIdIndex: 1,\n              })\n            }\n            else {\n              expect(error.detail).to.eql({\n                name: assets[1].name,\n                benchmarkId: \"NotAStig\",\n                assetIndex: 2,\n                benchmarkIdIndex: 1,\n              })\n            }\n          }\n\n        })\n\n        it(\"Pass non existing collectionId should return 403\", async function () {\n\n          const assets = [{\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [reference.testCollection.fullLabelName, reference.testCollection.lvl1LabelName],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: reference.testCollection.validStigs\n          }]\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/999/assets`, 'POST', iteration.token,\n            assets\n            )\n          \n          expect(res.status).to.eql(403)\n        })\n\n        it(\"Pass disabled collectionId should return 403 \", async function () {\n\n          const assets = [{\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [reference.testCollection.fullLabelName, reference.testCollection.lvl1LabelName],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: reference.testCollection.validStigs\n          }]\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/93/assets`, 'POST', iteration.token,\n            assets\n            )\n          expect(res.status).to.eql(403)\n\n        })\n\n        it(\"Pass empty assets array should violate OAS for min items of 1\", async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/21/assets`, 'POST', iteration.token,\n           []\n            )\n          expect(res.status).to.eql(400)\n\n        })\n\n        it(\"Create assets with one that already exists, expect correct 200 response for dry run failure\", async function () {\n\n          const assets = [\n            {\n              name: 'TestAsset' + utils.getUUIDSubString(10),\n              description: 'batch',\n              ip: '1.1.1.1',\n              noncomputing: true,\n              labelNames: [],\n              metadata: {\n                batch: 'batch',\n              },\n              stigs: []\n            },{\n            name: reference.testAsset.name,\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [reference.testCollection.fullLabelName, reference.testCollection.lvl1LabelName],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: reference.testCollection.validStigs\n          }\n        ]\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/21/assets?projection=stigs&projection=statusStats`, 'POST', iteration.token,\n            \n            assets\n            )\n\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.detail).to.be.an('array').of.length(1)\n          expect(res.body.detail[0].failure).to.equal('name exists')\n          expect(res.body.detail[0].detail).to.eql({\n            name: reference.testAsset.name,\n            assetIndex: 2,\n          })\n\n        })\n\n        it(\"Create Assets where one has non-existing labelName, expect correct 200 response for dry run failure\", async function () {\n          \n          const assets = [{\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [\"unknownLabel\"],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: []\n          },\n          {\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [reference.testCollection.fullLabelName, reference.testCollection.lvl1LabelName],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: reference.testCollection.validStigs\n          }]\n          \n          const res = await utils.executeRequest(`${config.baseUrl}/collections/21/assets?projection=stigs&projection=statusStats`, 'POST', iteration.token,\n            assets )\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.detail).to.be.an('array').of.length(1)\n          expect(res.body.detail[0].failure).to.equal(\"unknown labelName\")\n          expect(res.body.detail[0].detail).to.eql({\n            name: assets[0].name,\n            labelName: \"unknownLabel\",\n            assetIndex: 1,\n            labelIndex: 1,\n          })\n        })\n\n        it(\"Create Assets where one has a non-existing benchmarkId, expect correct 200 response for dry run failure\", async function () {\n\n          const assets = [{\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [reference.testCollection.fullLabelName, reference.testCollection.lvl1LabelName],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: [\"NotAStig\"]\n          },\n          {\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [reference.testCollection.fullLabelName, reference.testCollection.lvl1LabelName],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: reference.testCollection.validStigs\n          }]\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/21/assets?projection=stigs&projection=statusStats`, 'POST', iteration.token,\n            assets )\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.detail).to.be.an('array').of.length(1)\n          expect(res.body.detail[0].failure).to.equal(\"unknown benchmarkId\")\n          expect(res.body.detail[0].detail).to.eql({\n            name: assets[0].name,\n            benchmarkId: \"NotAStig\",\n            assetIndex: 1,\n            benchmarkIdIndex: 1,\n          })\n          \n\n        })\n\n        it(\"Create Assets where one has one correct label/benchmark and one non-existing label/benchmark, expect correct 200 response for dry run failure\", async function () {\n          \n          const assets = [{\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [reference.testCollection.fullLabelName, reference.testCollection.lvl1LabelName],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: []\n          },\n          {\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [\"unknownLabel\"],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: [\"NotAStig\"]\n          }]\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/21/assets?projection=stigs&projection=statusStats`, 'POST', iteration.token,\n            assets )\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.detail).to.be.an('array').of.length(2)\n          for(const error of res.body.detail) {\n            expect(error.failure).to.be.oneOf([\"unknown labelName\", \"unknown benchmarkId\"])\n            if(error.failure === \"unknown labelName\"){\n              expect(error.detail).to.eql({\n                name: assets[1].name,\n                labelName: \"unknownLabel\",\n                assetIndex: 2,\n                labelIndex: 1,\n              })\n            }\n            else {\n              expect(error.detail).to.eql({\n                name: assets[1].name,\n                benchmarkId: \"NotAStig\",\n                assetIndex: 2,\n                benchmarkIdIndex: 1,\n              })\n            }\n          }\n        })\n\n        it(\"Create Duplicate Asset with not-existing benchmark/labelName expect correct 200 for dry run failure\", async function () {\n\n          const assets = [{\n            name: reference.testAsset.name,\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [\"unknownLabel\"],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: [\"NotAStig\"]\n          }]\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/21/assets?projection=stigs&projection=statusStats`, 'POST', iteration.token,\n            assets )\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.detail).to.be.an('array').of.length(1)\n          expect(res.body.detail[0].failure).to.equal(\"name exists\")\n          expect(res.body.detail[0].detail).to.eql({\n            name: reference.testAsset.name,\n            assetIndex: 1,\n          })\n        })\n\n        it(\"Create Duplicate Asset with not-existing benchmark/labelName expect correct 200 for dry run failure\", async function () {\n\n          const assets = [{\n            name: reference.testAsset.name,\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [\"unknownLabel\"],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: [\"NotAStig\"]\n          }]\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/21/assets?projection=stigs&projection=statusStats`, 'POST', iteration.token,\n            assets )\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.detail).to.be.an('array').of.length(1)\n          expect(res.body.detail[0].failure).to.equal(\"name exists\")\n          expect(res.body.detail[0].detail).to.eql({\n            name: reference.testAsset.name,\n            assetIndex: 1,\n          })\n        })\n\n        it(\"Create Valid asset with dry run option expect 204 no content sucessful dry run\", async function () {\n\n          const assets = [{\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [reference.testCollection.fullLabelName, reference.testCollection.lvl1LabelName],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: reference.testCollection.validStigs\n          }]\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/21/assets?dryRun=true&projection=stigs&projection=statusStats`, 'POST', iteration.token,\n            assets )\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(204)\n        })\n\n        it(\"Create Valid asset with dry run option and non-existing labelname expect 200 and correct response for dry run failure\", async function () {\n\n          const assets = [{\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: reference.testCollection.validStigs\n          },\n          {\n            name: 'TestAsset' + utils.getUUIDSubString(10),\n            description: 'batch',\n            ip: '1.1.1.1',\n            noncomputing: true,\n            labelNames: [\"unknownLabel\"],\n            metadata: {\n              batch: 'batch',\n            },\n            stigs: reference.testCollection.validStigs\n          },\n        ]\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/21/assets?dryRun=true&projection=stigs&projection=statusStats`, 'POST', iteration.token,\n            assets )\n\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.detail).to.be.an('array').of.length(1)\n          expect(res.body.detail[0].failure).to.equal(\"unknown labelName\")\n          expect(res.body.detail[0].detail).to.eql({\n            name: assets[1].name,\n            labelName: \"unknownLabel\",\n            assetIndex: 2,\n            labelIndex: 1,\n          })\n        })\n      })\n    })\n  }\n})\n\nfunction assetGetToPost (assetGet) {\n  // extract the transformed and unposted properties\n  const { assetId, collection, stigs, mac, fqdn, ...assetPost } = assetGet\n\n  // add transformed properties to the derived post\n  assetPost.collectionId = collection.collectionId\n  assetPost.stigs = stigsGetToPost(stigs)\n\n  // the derived post object\n  return assetPost\n}\n\nfunction stigsGetToPost (stigsGetArray) {\n  const stigsPostArray = []\n  for (const stig of stigsGetArray) {\n    stigsPostArray.push(stig.benchmarkId)\n  }\n  return stigsPostArray\n}\n"
  },
  {
    "path": "test/api/mocha/data/asset/assetPut.test.js",
    "content": "\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport { v4 as uuidv4 } from 'uuid'\nimport { expect } from 'chai'\n\ndescribe('PUT - Asset', function () {\n\n  before(async function () {\n     await utils.resetTestAsset()\n     await utils.resetScrapAsset()\n  })\n\n  for (const iteration of iterations) {\n    if (expectations[iteration.name] === undefined){\n      it(`No expectations for this iteration scenario: ${iteration.name}`, async function () {})\n      continue\n    }\n    describe(`iteration:${iteration.name}`, function () {\n      const distinct = expectations[iteration.name]\n\n      describe(`replaceAsset -/assets/{assetId}`, function () {\n        \n        it('Set all properties of an Asset', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.scrapAsset.assetId}?projection=statusStats&projection=stigs`, 'PUT', iteration.token, {\n              \"name\": 'TestAsset' + utils.getUUIDSubString(),\n              \"collectionId\": reference.scrapCollection.collectionId,\n              \"description\": \"test desc\",\n              \"ip\": \"1.1.1.1\",\n              \"noncomputing\": true,\n              \"labelNames\": [\n                  \"scrapLabel\"\n              ],\n              \"metadata\": {\n                  \"pocName\": \"poc2Put\",\n                  \"pocEmail\": \"pocEmailPut@email.com\",\n                  \"pocPhone\": \"12342\",\n                  \"reqRar\": \"true\"\n              },\n              \"stigs\": [\n                  \"VPN_SRG_TEST\",\n                  \"Windows_10_STIG_TEST\",\n                  \"RHEL_7_STIG_TEST\"\n              ]\n          })\n\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n\n          expect(res.body.collection.collectionId, \"expect asset to be in scrap colleciton\").to.equal(reference.scrapCollection.collectionId)\n          expect(res.body.name).to.be.a('string')\n          expect(res.body.ip).to.equal('1.1.1.1')\n          expect(res.body.noncomputing).to.equal(true)\n          expect(res.body.labelIds, \"Expect asset to have scrap label\").to.eql([reference.scrapCollection.scrapLabel])\n          expect(res.body.labels).to.be.an('array').of.length(1)\n          expect(res.body.labels[0].labelId).to.equal(reference.scrapCollection.scrapLabel)\n          expect(res.body.metadata.pocName).to.equal('poc2Put')\n          expect(res.body.metadata.pocEmail).to.equal('pocEmailPut@email.com')\n          expect(res.body.stigs, \"Expect asset to have 3 stigs\").to.be.an('array').of.length(3)\n          expect(res.body).to.have.property('statusStats')\n          expect(res.body.statusStats.stigCount, \"Expect asset to have 3 stigs\").to.equal(3)\n          expect(res.body.statusStats.savedCount).to.equal(0)\n          expect(res.body.statusStats.acceptedCount).to.equal(0)\n          expect(res.body.statusStats.rejectedCount).to.equal(0)\n          \n          \n          for (let stig of res.body.stigs) {\n            expect(stig.benchmarkId).to.be.oneOf([\n              \"VPN_SRG_TEST\",\n              \"Windows_10_STIG_TEST\",\n              \"RHEL_7_STIG_TEST\"\n          ])\n          }\n          const effectedAsset = await utils.getAsset(res.body.assetId)\n          expect(effectedAsset.collection.collectionId).to.equal(reference.scrapCollection.collectionId)\n          expect(effectedAsset.description).to.equal('test desc')\n          expect(effectedAsset.labelIds).to.have.lengthOf(1)\n          expect(effectedAsset.labels).to.be.an('array').of.length(1)\n          expect(effectedAsset.stigs).to.be.an('array').of.length(3)\n          for (const stig of effectedAsset.stigs) {\n            expect(stig.benchmarkId).to.be.oneOf([\n              'VPN_SRG_TEST',\n              'Windows_10_STIG_TEST',\n              'RHEL_7_STIG_TEST'\n            ])\n          }\n\n        })\n\n        it('Set all properties of an Asset - assign new STIG', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}?projection=statusStats&projection=stigs`, 'PUT', iteration.token, {\n              \"name\": 'TestAsset' + utils.getUUIDSubString(),\n              \"collectionId\": reference.testCollection.collectionId,\n              \"description\": \"test desc\",\n              \"ip\": \"1.1.1.1\",\n              \"noncomputing\": true,\n              \"metadata\": {\n                  \"pocName\": \"poc2Put\",\n                  \"pocEmail\": \"pocEmailPut@email.com\",\n                  \"pocPhone\": \"12342\",\n                  \"reqRar\": \"true\"\n              },\n              \"stigs\": [\n                  \"VPN_SRG_TEST\",\n                  \"VPN_SRG_OTHER\",\n                  \"Windows_10_STIG_TEST\",\n                  \"RHEL_7_STIG_TEST\"\n              ]\n            })\n            if(!distinct.canModifyCollection){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n\n            expect(res.body.statusStats.stigCount).to.equal(4)\n            expect(res.body.stigs).to.be.an('array').of.length(4)\n            for (const stig of res.body.stigs) {\n              expect(stig.benchmarkId).to.be.oneOf([ \"VPN_SRG_TEST\",\n                \"VPN_SRG_OTHER\",\n                \"Windows_10_STIG_TEST\",\n                \"RHEL_7_STIG_TEST\"\n            ])\n          }\n          \n          const effectedAsset = await utils.getAsset(res.body.assetId)\n          expect(effectedAsset.collection.collectionId).to.equal(reference.testCollection.collectionId)\n          expect(effectedAsset.stigs).to.be.an('array').of.length(4)\n          for (const stig of effectedAsset.stigs) {\n            expect(stig.benchmarkId).to.be.oneOf([ \"VPN_SRG_TEST\",\n              \"VPN_SRG_OTHER\",\n              \"Windows_10_STIG_TEST\",\n              \"RHEL_7_STIG_TEST\"\n            ])\n          }\n        })\n\n        it('Set all properties of an Asset- with metadata', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.scrapAsset.assetId}`, 'PUT', iteration.token, {\n              \"name\":'TestAsset' + utils.getUUIDSubString(),\n              \"collectionId\": reference.scrapCollection.collectionId,\n              \"description\": \"test desc\",\n              \"ip\": \"1.1.1.1\",\n              \"noncomputing\": true,\n              \"metadata\" : {\n                [reference.scrapAsset.metadataKey]: reference.scrapAsset.metadataValue\n              },\n              \"stigs\": [\n                  \"VPN_SRG_TEST\",\n                  \"Windows_10_STIG_TEST\",\n                  \"RHEL_7_STIG_TEST\"\n              ]\n          })\n\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          \n          expect(res.body.metadata).to.exist\n          expect(res.body.metadata).to.have.property(reference.scrapAsset.metadataKey)\n          expect(res.body.metadata[reference.scrapAsset.metadataKey]).to.equal(reference.scrapAsset.metadataValue)\n\n          const effectedAsset = await utils.getAsset(res.body.assetId)\n          expect(effectedAsset.metadata).to.exist\n          expect(effectedAsset.metadata).to.have.property(reference.scrapAsset.metadataKey)\n          expect(effectedAsset.metadata[reference.scrapAsset.metadataKey]).to.equal(reference.scrapAsset.metadataValue)\n\n        })\n\n        it('Set all properties of an Asset - Change Collection - invalid for all iteration', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.scrapAsset.assetId}`, 'PUT', iteration.token, {\n              \"name\": 'TestAsset' + utils.getUUIDSubString(),\n              \"collectionId\": reference.scrapLvl1User.userId,\n              \"description\": \"test desc\",\n              \"ip\": \"1.1.1.1\",\n              \"noncomputing\": true,\n              \"metadata\": {},\n              \"stigs\": [\n                  \"VPN_SRG_TEST\",\n                  \"Windows_10_STIG_TEST\",\n                  \"RHEL_7_STIG_TEST\"\n              ]\n            })\n          expect(res.status).to.eql(403)\n        })\n\n        it(\"should throw 403, asset is deleted.\", async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.deletedAsset.assetId}`, 'PUT', iteration.token, {\n              \"name\": 'TestAsset' + utils.getUUIDSubString(),\n              \"collectionId\": reference.scrapCollection.collectionId,\n              \"description\": \"test desc\",\n              \"ip\": \"1.1.1.1\",\n              \"noncomputing\": true,\n              \"metadata\": {},\n              \"stigs\": [\n                  \"VPN_SRG_TEST\",\n                  \"Windows_10_STIG_TEST\",\n                  \"RHEL_7_STIG_TEST\"\n              ]\n            })\n          expect(res.status).to.eql(403)\n        })\n      })\n      describe(`putAssetMetadata - /assets/{assetId}/metadata`, function () {\n\n        it('Set metadata of an Asset', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.scrapAsset.assetId}/metadata`, 'PUT', iteration.token, {\n              [reference.scrapAsset.metadataKey]: reference.scrapAsset.metadataValue\n            })\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          \n          expect(res.body).to.have.property(reference.scrapAsset.metadataKey)\n          expect(res.body[reference.scrapAsset.metadataKey]).to.equal(reference.scrapAsset.metadataValue)\n\n          const effectedAsset = await utils.getAsset(reference.scrapAsset.assetId)\n          expect(effectedAsset.metadata).to.have.property(reference.scrapAsset.metadataKey)\n        })\n        it(\"should throw 403, asset is deleted.\", async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.deletedAsset.assetId}/metadata`, 'PUT', iteration.token, {\n              [reference.scrapAsset.metadataKey]: reference.scrapAsset.metadataValue\n            })\n          expect(res.status).to.eql(403)\n        })\n      })\n      describe(`putAssetMetadataValue - /assets/{assetId}/metadata/keys/{key}`, function () {\n      \n        it('Set one metadata key/value of an Asset', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.scrapAsset.assetId}/metadata/keys/${reference.scrapAsset.metadataKey}`, 'PUT', iteration.token, `${JSON.stringify(reference.scrapAsset.metadataValue)}`)\n\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          \n          expect(res.status).to.eql(204)\n          const effectedAsset = await utils.getAsset(reference.scrapAsset.assetId)\n          expect(effectedAsset.metadata).to.have.property(reference.scrapAsset.metadataKey)\n        })\n        it(\"should throw 403, asset is deleted.\", async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.deletedAsset.assetId}/metadata/keys/${reference.scrapAsset.metadataKey}`, 'PUT', iteration.token, `${JSON.stringify(reference.scrapAsset.metadataValue)}`)\n          expect(res.status).to.eql(403)\n        })\n      })\n      describe(`attachStigToAsset - /assets/{assetId}/stigs/{benchmarkId}`, function () {\n      \n        it('PUT a STIG assignment to an Asset', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.scrapAsset.assetId}/stigs/${reference.scrapAsset.scrapBenchmark}`, 'PUT', iteration.token)\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array').of.length(3)\n          for (let stig of res.body) {\n            expect(stig.benchmarkId, \"expect stig to be one of the valid stigs\").to.be.oneOf(reference.scrapCollection.validStigs)\n            if (stig.benchmarkId === reference.scrapAsset.scrapBenchmark) {\n              expect(stig.benchmarkId).to.equal(reference.scrapAsset.scrapBenchmark)\n            }\n          }\n          const effectedAsset = await utils.getAsset(reference.scrapAsset.assetId)\n          expect(effectedAsset.stigs).to.be.an('array').of.length(3)\n          for (let stig of effectedAsset.stigs) {\n            if (stig.benchmarkId === reference.scrapAsset.scrapBenchmark) {\n              expect(stig.benchmarkId).to.equal(reference.scrapAsset.scrapBenchmark)\n            }\n          }\n        })\n        it(\"should throw 403, asset is deleted.\", async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.deletedAsset.assetId}/stigs/${reference.scrapAsset.scrapBenchmark}`, 'PUT', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n      describe(`putAssetsByCollectionLabelId - /collections/{collectionId}/labels/{labelId}/assets`, function () {\n      \n        it('Replace a Labels Asset Mappings in a Collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/labels/${reference.testCollection.fullLabel}/assets`, 'PUT', iteration.token, [reference.testAsset.assetId])\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n         \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array').of.length(1)\n          expect(res.body[0].assetId).to.equal(reference.testAsset.assetId)\n\n          const effectedAsset = await utils.getAssetsByLabel(reference.testCollection.collectionId, reference.testCollection.fullLabel)\n          expect(effectedAsset).to.have.lengthOf(1)\n          expect(effectedAsset[0].assetId).to.equal(reference.testAsset.assetId)\n        })\n        it('Replace a Labels Asset Mappings in a Collection assign to an asset that does not exist', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/labels/${reference.testCollection.fullLabel}/assets`, 'PUT', iteration.token, [\"9999\"])\n          expect(res.status).to.eql(403)\n        })\n        it(\"should throw SmError.NotFoundError when updating a label that doesn't exist.\",async function () {\n          const labelId = uuidv4()\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/labels/${labelId}/assets`, 'PUT', iteration.token, [reference.testAsset.assetId])\n            if(distinct.canModifyCollection === false){\n                expect(res.status).to.eql(403)\n                return\n            }\n            expect(res.status).to.eql(403)\n            expect(res.body.error).to.equal(\"User has insufficient privilege to complete this request.\")\n            expect(res.body.detail).to.equal(\"The labelId is not associated with this Collection.\")\n        })\n      })\n      describe(`attachAssetsToStig - /collections/{collectionId}/stigs/{benchmarkId}/assets`, function () {\n        it('Set the Assets mapped to a STIG', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/stigs/${reference.scrapAsset.scrapBenchmark}/assets`, 'PUT', iteration.token, [reference.scrapAsset.assetId])\n\n          if(!distinct.canModifyCollection){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n          expect(res.body).to.be.an('array').of.length(1)\n          expect(res.body[0].assetId).to.equal(reference.scrapAsset.assetId)\n          expect(res.body[0].collectionId).to.equal(reference.scrapCollection.collectionId)\n          if(iteration.name === 'lvl1'){\n            expect(res.body[0].access).to.equal('r')\n          }\n          else\n          {\n            expect(res.body[0].access).to.equal('rw')\n          }\n        })\n        it('should throw SM privilege error due to assetId not being apart of collection.', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/stigs/${reference.scrapAsset.scrapBenchmark}/assets`, 'PUT', iteration.token, [`1234321`])\n          expect(res.status).to.eql(403)\n        })\n      })\n    })\n  }\n})\n\n"
  },
  {
    "path": "test/api/mocha/data/asset/expectations.js",
    "content": "//This data contains expected response data that varies by iteration \"scenario\" or \"user\" for each test case. These expectations are relative to the \"referenceData.js\" data used to construct the API requests.\n\nexport const expectations = {\n  stigmanadmin: {\n    user: 'admin',\n    testAssetStigs: ['VPN_SRG_TEST', 'Windows_10_STIG_TEST'],\n    userId: '87',\n    testAssetStats: {\n      ruleCount: 368,\n      stigCount: 2,\n      savedCount: 2,\n      acceptedCount: 0,\n      rejectedCount: 0,\n      submittedCount: 7\n    },\n    grant: 'admin',\n    assignedStigs: ['VPN_SRG_TEST'],\n    assetIds: ['29', '62', '42', '154'],\n    assetMatchString: \"asset\",\n    validStigs: ['VPN_SRG_TEST', 'Windows_10_STIG_TEST'],\n    collectionIds: ['21'],\n    canModifyCollection: true,\n    assetsAvailableFullLabel: [\"62\",\"42\"],\n    assetsAvailableNoMetadata: [\"29\",\"154\"],\n    assetsAvailableBenchmark: [\"42\",\"62\", \"154\"],\n    assetsAvailableStigGrants:[\"42\",\"62\", \"154\"],\n    hasAccessToTestAsset: true,\n    hasAccessToTestAssetNoStigs: true,\n    AssetNamesAvailable:[\n      {\n        name: \"ACHERNAR_Collection_X_asset\",\n        assetId: \"29\",\n      },\n      {\n        name: \"Collection_X_asset\",\n        assetId: \"62\",\n      },\n      {\n        name: \"Collection_X_lvl1_asset-1\",\n        assetId: \"42\",\n      },\n      {\n        name: \"Collection_X_lvl1_asset-2\",\n        assetId: \"154\",\n      },\n    ]\n    \n  },\n  lvl1: {\n    testAssetStigs: ['VPN_SRG_TEST'],\n    testAssetStats: {\n      ruleCount: 81,\n      stigCount: 1,\n      savedCount: 1,\n      acceptedCount: 0,\n      rejectedCount: 0,\n      submittedCount: 5\n    },\n    user: 'lvl1',\n    userId: '85',\n    grant: 'restricted',\n    canModifyCollection: false,\n    assignedStigs: ['VPN_SRG_TEST'],\n    assetIds: ['42', '154', \"62\"],\n    assetMatchString: \"lvl1\",\n    assetsAvailableFullLabel: [\"42\", \"62\"],\n    assetsAvailableNoMetadata: [\"154\"],\n    assetsAvailableBenchmark: [\"42\", \"154\", \"62\"],\n    validStigs: ['VPN_SRG_TEST'],\n    collectionIds: ['21'],\n    hasAccessToTestAsset: true,\n    hasAccessToTestAssetNoStigs: false,\n    AssetNamesAvailable:[\n      {\n        name: \"Collection_X_lvl1_asset-1\",\n        assetId: \"42\",\n      },\n      {\n        name: \"Collection_X_lvl1_asset-2\",\n        assetId: \"154\",\n      },\n    ]\n\n  },\n  lvl2: {\n    testAssetStigs: ['VPN_SRG_TEST', 'Windows_10_STIG_TEST'],\n    testAssetStats: {\n      ruleCount: 368,\n      stigCount: 2,\n      savedCount: 2,\n      acceptedCount: 0,\n      rejectedCount: 0,\n      submittedCount: 7\n    },\n    user: 'lvl2',\n    userId: '87',\n    canModifyCollection: false,\n    grant: 'full',\n    assignedStigs: ['VPN_SRG_TEST'],\n    assetIds: ['29', '62', '42', '154'],\n    assetMatchString: \"asset\",\n    assetsAvailableFullLabel: [\"62\",\"42\"],\n    assetsAvailableNoMetadata: [\"29\",\"154\"],\n    assetsAvailableBenchmark: [\"42\",\"62\", \"154\"],\n    validStigs: ['VPN_SRG_TEST', 'Windows_10_STIG_TEST'],\n    collectionIds: ['21'],\n    hasAccessToTestAsset: true,\n    hasAccessToTestAssetNoStigs: true,\n    AssetNamesAvailable:[\n      {\n        name: \"ACHERNAR_Collection_X_asset\",\n        assetId: \"29\",\n      },\n      {\n        name: \"Collection_X_asset\",\n        assetId: \"62\",\n      },\n      {\n        name: \"Collection_X_lvl1_asset-1\",\n        assetId: \"42\",\n      },\n      {\n        name: \"Collection_X_lvl1_asset-2\",\n        assetId: \"154\",\n      },\n    ]\n\n  },\n  lvl3: {\n    testAssetStigs: ['VPN_SRG_TEST', 'Windows_10_STIG_TEST'],\n    testAssetStats: {\n      ruleCount: 368,\n      stigCount: 2,\n      savedCount: 2,\n      acceptedCount: 0,\n      rejectedCount: 0,\n      submittedCount: 7\n    },\n    user: 'lvl3',\n    userId: '87',\n    grant: 'manage',\n    canModifyCollection: true,\n    assignedStigs: ['VPN_SRG_TEST'],\n    assetIds: ['29', '62', '42', '154'],\n    assetMatchString: \"asset\",\n    validStigs: ['VPN_SRG_TEST', 'Windows_10_STIG_TEST'],\n    collectionIds: ['21'],\n    assetsAvailableFullLabel: [\"62\",\"42\"],\n    assetsAvailableNoMetadata: [\"29\",\"154\"],\n    assetsAvailableBenchmark: [\"42\",\"62\", \"154\"],\n    assetsAvailableStigGrants:[\"42\",\"62\", \"154\"],\n    hasAccessToTestAsset: true,\n    hasAccessToTestAssetNoStigs: true,\n    AssetNamesAvailable:[\n      {\n        name: \"ACHERNAR_Collection_X_asset\",\n        assetId: \"29\",\n      },\n      {\n        name: \"Collection_X_asset\",\n        assetId: \"62\",\n      },\n      {\n        name: \"Collection_X_lvl1_asset-1\",\n        assetId: \"42\",\n      },\n      {\n        name: \"Collection_X_lvl1_asset-2\",\n        assetId: \"154\",\n      },\n    ]\n\n  },\n  lvl4: {\n    testAssetStigs: ['VPN_SRG_TEST', 'Windows_10_STIG_TEST'],\n    testAssetStats: {\n      ruleCount: 368,\n      stigCount: 2,\n      savedCount: 2,\n      acceptedCount: 0,\n      rejectedCount: 0,\n      submittedCount: 7\n    },\n    user: 'lvl4',\n    userId: '87',\n    grant: 'owner',\n    canModifyCollection: true,\n    assetsAvailableFullLabel: [\"62\",\"42\"],\n    assignedStigs: ['VPN_SRG_TEST'],\n    assetIds: ['29', '62', '42', '154'],\n    assetMatchString: \"asset\",\n    assetsAvailableBenchmark: [\"42\",\"62\", \"154\"],\n    assetsAvailableNoMetadata: [\"29\",\"154\"],\n    validStigs: ['VPN_SRG_TEST', 'Windows_10_STIG_TEST'],\n    collectionIds: ['21'],\n    assetsAvailableStigGrants:[\"42\",\"62\", \"154\"],\n    hasAccessToTestAsset: true,\n    hasAccessToTestAssetNoStigs: true,\n    AssetNamesAvailable:[\n      {\n        name: \"ACHERNAR_Collection_X_asset\",\n        assetId: \"29\",\n      },\n      {\n        name: \"Collection_X_asset\",\n        assetId: \"62\",\n      },\n      {\n        name: \"Collection_X_lvl1_asset-1\",\n        assetId: \"42\",\n      },\n      {\n        name: \"Collection_X_lvl1_asset-2\",\n        assetId: \"154\",\n      },\n    ]\n  },\n  collectioncreator: {\n    canModifyCollection: false,\n    hasAccessToTestAsset: false,\n    hasAccessToTestAssetNoStigs: false,\n\n  }\n}\n"
  },
  {
    "path": "test/api/mocha/data/asset/requestBodies.js",
    "content": "//This data contains expected response data that varies by iteration \"scenario\" or \"iteration\" for each test case. These expectations are relative to the \"referenceData.js\" data used to construct the API requests.\n\nimport reference from \"../../referenceData.js\";\n\nexport const requestBodies = {\n    tempAssetPost: {\n        name: \"TempAsset\",\n        collectionId: \"21\",\n        description: \"\",\n        ip: \"\",\n        noncomputing: true,\n        mac: null,\n        labelIds: [\n            reference.testCollection.fullLabelName,\n            reference.testCollection.lvl1LabelName,\n        ],\n        metadata: {\n         testkey: \"testvalue\"\n        },\n        stigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\"],\n    },\n}\n  \n\n"
  },
  {
    "path": "test/api/mocha/data/collection/collectionDelete.test.js",
    "content": "\nimport { v4 as uuidv4 } from 'uuid'\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {requestBodies} from \"./requestBodies.js\"\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport { expect } from 'chai'\n\ndescribe('DELETE - Collection ', function () {\n\n  let tempCollection = null\n\n  for(const iteration of iterations){\n    \n    if (expectations[iteration.name] === undefined){\n      it(`No expectations for this iteration scenario: ${iteration.name}`,async function () {})\n      continue\n    }\n\n    describe(`iteration:${iteration.name}`, function () {\n      const distinct = expectations[iteration.name]\n\n      describe('deleteCollection - /collections/{collectionId}', function () {\n\n        before(async function () {\n          const testCollectionClone  = JSON.parse(JSON.stringify(requestBodies.resetTestCollection))\n          testCollectionClone.name = `Collection ` + utils.getUUIDSubString()\n          tempCollection = await utils.createTempCollection(testCollectionClone)\n        })\n\n        it('Delete tempCollection collection (stigmanadmin only)',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${tempCollection.collectionId}`, 'DELETE', iteration.token)\n\n          if(distinct.canDeleteCollection === false){ \n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n\n          expect(res.body.collectionId).to.equal(tempCollection.collectionId)\n\n          //confirm that it is deleted\n          const deletedCollection = await utils.getCollection(tempCollection.collectionId)\n          expect(deletedCollection.status, \"expect 403 response (delete worked)\").to.equal(403)\n        })\n\n        it(\"should throw 403, attempting to delete disabled collection\",async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}`, 'DELETE', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('deleteCollectionLabelById - /collections/{collectionId}/labels/{labelId}', function () {\n\n        let tempLabel = null\n        beforeEach(async function () {\n          const labelPost = JSON.parse(JSON.stringify(requestBodies.recreateCollectionLabel))\n          labelPost.name = `Label ` + utils.getUUIDSubString(5)\n          tempLabel = await utils.createCollectionLabel(reference.testCollection.collectionId, labelPost)\n        })\n        it('Delete a scrap collection scrap Label',async function () {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/labels/${tempLabel.labelId}`, 'DELETE', iteration.token)\n            if(distinct.canModifyCollection === false){\n                expect(res.status).to.eql(403)\n                return\n            }\n            expect(res.status).to.eql(204)\n            const collection = await utils.getCollection(reference.testCollection.collectionId)\n            expect(collection.labels).to.not.include(tempLabel.labelId)\n        })\n        it(\"should throw SmError.NotFoundError when deleting a non-existent label.\",async function () {\n          const labelId = uuidv4()\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/labels/${labelId}`, 'DELETE', iteration.token)\n          if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n          }\n          expect(res.status).to.eql(404)\n          expect(res.body.error).to.equal(\"Resource not found.\")\n        })\n        it(\"should throw 403, attempting to delete a label from a disabled collection\",async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/labels/${tempLabel.labelId}`, 'DELETE', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('deleteCollectionMetadataKey - /collections/{collectionId}/metadata/keys/{key}', function () {\n\n        beforeEach(async function () {\n          const res = await utils.putCollection(reference.testCollection.collectionId, requestBodies.resetTestCollection)\n        })\n        it('Delete a scrap collection Metadata Key',async function () {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metadata/keys/${reference.testCollection.collectionMetadataKey}`, 'DELETE', iteration.token)\n\n              if(distinct.canModifyCollection === false){\n                expect(res.status).to.eql(403)\n                return\n              }\n              expect(res.status).to.eql(204)\n              const collection = await utils.getCollection(reference.testCollection.collectionId)\n              expect(collection.metadata).to.not.have.property(reference.testCollection.collectionMetadataKey)\n        })\n        it(\"should throw a 403, attempting to delete a metadata key from a disabled collection\",async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metadata/keys/${reference.testCollection.collectionMetadataKey}`, 'DELETE', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('deleteReviewHistoryByCollection - /collections/{collectionId}/review-history', function () {\n\n        beforeEach(async function () {\n          await utils.loadAppData()\n        })\n\n        it('Delete review History records - retentionDate',async function () {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history?retentionDate=${reference.testCollection.reviewHistory.endDate}`, 'DELETE', iteration.token)\n                \n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n  \n            expect(res.status).to.eql(200)\n            expect(res.body.HistoryEntriesDeleted).to.be.equal(reference.testCollection.reviewHistory.deletedEntriesByDate)\n        })\n        it('Delete review History records - date and assetId',async function () {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history?retentionDate=${reference.testCollection.reviewHistory.endDate}&assetId=${reference.testCollection.testAssetId}`, 'DELETE', iteration.token)\n\n              if(distinct.canModifyCollection === false){\n                expect(res.status).to.eql(403)\n                return\n              }\n  \n            expect(res.status).to.eql(200)\n            expect(res.body.HistoryEntriesDeleted).to.be.equal(reference.testCollection.reviewHistory.deletedEntriesByDateAsset)\n        })\n        it(\"should throw 403, attempting to delete review history from a disabled collection\",async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/review-history?retentionDate=${reference.testCollection.reviewHistory.endDate}`, 'DELETE', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('deleteGrantByCollectionGrant - /collections/{collectionId}/grants/{grantId}', function () {\n\n        before(async function () {\n          await utils.loadAppData()\n        })  \n        it('Delete scrap lvl1 bizzaro users grant.  ',async function () {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.scrapLvl1User.testCollectionGrantId}`, 'DELETE', iteration.token)\n                \n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body.roleId).to.eql(1)\n            expect(res.body.grantId).to.eql(reference.scrapLvl1User.testCollectionGrantId)\n            expect(res.body.user.userId).to.eql(reference.scrapLvl1User.userId)\n\n        })\n        it(\"Delete an owner grant, is succeeding for all users with roleId owner without elevate.\",async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.adminBurke.testCollectionGrantId}`, 'DELETE', iteration.token)\n\n          if (distinct.roleId < 4){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n        })\n        it(\"Delete an owner grant, using elevate should only succeed with stigmanadmin\",async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${\"7\"}?elevate=true`, 'DELETE', iteration.token)\n\n          if(iteration.name !== \"stigmanadmin\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n        })\n        it(\"attempt to delete grant that does not exist expect error\",async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${\"54321\"}`, 'DELETE', iteration.token)\n          if(distinct.canModifyCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(404)\n        })\n        it(\"should throw 403, attempting to delete a grant from a disabled collection\",async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/grants/${reference.scrapLvl1User.testCollectionGrantId}`, 'DELETE', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n    })\n  }\n})\n\n"
  },
  {
    "path": "test/api/mocha/data/collection/collectionGet.test.js",
    "content": "import { v4 as uuidv4 } from 'uuid'\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\n\ndescribe('GET - Collection', function () {\n\n  before(async function () {\n    await utils.loadAppData()\n  })\n\n  for(const iteration of iterations){\n    if (expectations[iteration.name] === undefined){\n      it(`No expectations for this iteration scenario: ${iteration.name}`, async function () {})\n      continue\n    }\n\n    describe(`iteration:${iteration.name}`, function () {\n      const distinct = expectations[iteration.name]\n    \n      describe('getCollections - /collections', function () {\n        if (iteration.name === 'stigmanadmin' ){\n\n          it('Return Collections accessible to the requester No Filters - elevated stigmanadmin only', async function () {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections?projection=owners&projection=statistics&elevate=true`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(200)\n            // expect(res.body).to.be.an('array')\n            expect(res.body).to.have.lengthOf(distinct.collectionCountElevated)\n            //check statistics projection\n            const testCollection = res.body.find(collection => collection.collectionId === reference.testCollection.collectionId)\n            const testCollectionOwnerArray = testCollection.owners.map(owner => owner.userId)\n\n            expect(testCollectionOwnerArray, \"proper owners\").to.have.members(reference.testCollection.owners)\n            expect(testCollection.statistics.assetCount, \"asset count\").to.equal(distinct.assetIds.length)\n            expect(testCollection.statistics.checklistCount, \"checklist count\").to.equal(distinct.checklistCnt)\n          })\n        }\n\n        it('Return a list of Collections accessible to the requester No Filters no elevate!',async function () {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections?projection=owners&projection=statistics`, 'GET', iteration.token)\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array')\n            expect(res.body).to.have.lengthOf(distinct.collectionCount)\n            for(const collection of res.body){\n              expect(collection.collectionId).to.be.oneOf(distinct.collectionIdsAccess)\n            }\n        })\n        it('Return a list of Collections accessible to the requester METADATA',async function () {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections?metadata=${reference.testCollection.collectionMetadataKey}%3A${reference.testCollection.collectionMetadataValue}`, 'GET', iteration.token)\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array')\n            expect(res.body).to.have.lengthOf(distinct.collectionMatch.collectionMetadataMatchCnt)\n            if (distinct.collectionMatch.collectionContainsMatchCnt == 0) {\n              return\n            }\n            const regex  = new RegExp(reference.testCollection.name)\n            expect(res.body[0].name).to.match(regex)\n            expect(res.body[0].collectionId).to.equal(reference.testCollection.collectionId)\n            expect(res.body[0].metadata[reference.testCollection.collectionMetadataKey]).to.equal(reference.testCollection.collectionMetadataValue)\n\n        })\n        it('Return a list of Collections accessible to the requester METADATA param but with a colon character (see issue 1357)',async function () {\n          const tempCollectionWithMetadata = await utils.createTempCollection(\n            {\n              name: 'tempCollection' +  utils.getUUIDSubString(),\n              description: 'Collection TEST description',\n              settings: {\n                fields: {\n                  detail: {\n                    enabled: 'always',\n                    required: 'findings'\n                  },\n                  comment: {\n                    enabled: 'always',\n                    required: 'findings'\n                  }\n                },\n                status: {\n                  canAccept: true,\n                  minAcceptGrant: 2,\n                  resetCriteria: 'result'\n                },\n                history: {\n                  maxReviews: 11\n                },\n                importOptions: {\n                  autoStatus: {\n                    fail: \"submitted\",\n                    notapplicable: \"submitted\",\n                    pass: \"submitted\",\n                  },\n                  unreviewed: \"commented\",\n                  unreviewedCommented: \"informational\",\n                  emptyDetail: \"replace\",\n                  emptyComment: \"ignore\",\n                  allowCustom: true\n                }\n              },\n              metadata: {\n                testKey: 'test:value',\n              },\n              grants: [\n                {\n                  userId: '1',\n                  roleId: 4\n                }\n              ],\n              labels: [\n              ]\n            })\n          \n          const res = await utils.executeRequest(`${config.baseUrl}/collections?metadata=testKey%3Atest%3Avalue`, 'GET', iteration.token)\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n          if(iteration.name !== 'stigmanadmin'){\n            expect(res.body).to.have.lengthOf(0)\n            return\n          }\n          expect(res.body).to.have.lengthOf(1)\n          expect(res.body[0].collectionId).to.equal(tempCollectionWithMetadata.collectionId)\n        })\n        it('Return a list of Collections accessible to the requester NAME exact',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections?name=${reference.testCollection.name}&name-match=exact`, 'GET', iteration.token)\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n          expect(res.body).to.have.lengthOf(distinct.collectionMatch.collectionExactMatchCnt)\n          if (distinct.collectionMatch.collectionExactMatchCnt == 0) {\n            return\n          }\n          const regex  = new RegExp(reference.testCollection.name)\n          expect(res.body[0].name).to.match(regex)\n          expect(res.body[0].collectionId).to.equal(reference.testCollection.collectionId)\n          expect(res.body[0].settings.importOptions).to.deep.equalInAnyOrder(reference.testCollection.importOptions)\n        })\n        it('Return a list of Collections accessible to the requester NAME starts With',async function () {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections?name=${'Collection'}&name-match=startsWith`, 'GET', iteration.token)\n        expect(res.status).to.eql(200)\n        \n        expect(res.body).to.have.lengthOf(distinct.collectionMatch.collectionStartMatchCnt)\n        if (distinct.collectionMatch.collectionContainsMatchCnt == 0) {\n          return\n        }\n\n        for(const collection of res.body){\n            expect(collection.name).to.have.string('Collection')\n        }\n        })\n        it('Return a list of Collections accessible to the requester NAME ends With',async function () {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections?name=${'X'}&name-match=endsWith`, 'GET', iteration.token)\n        expect(res.status).to.eql(200)\n        expect(res.body).to.be.an('array')\n        expect(res.body).to.have.lengthOf(distinct.collectionMatch.collectionEndMatchCnt)\n        if (distinct.collectionMatch.collectionContainsMatchCnt == 0) {\n          return\n        }\n        expect(res.body[0].name).to.have.string('X')\n        })\n        it('Return a list of Collections accessible to the requester NAME contains elevated',async function () {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections?name=${'delete'}&name-match=contains&elevate=true`, 'GET', iteration.token)\n        if(iteration.name !== 'stigmanadmin'){\n          expect(res.status).to.eql(403)\n          return\n        } \n        expect(res.status).to.eql(200)\n        expect(res.body).to.be.an('array')\n        expect(res.body).to.have.lengthOf(distinct.collectionMatch.collectionDeleteMatchCntElevated)\n        expect(res.body[0].name).to.have.string('delete')\n        })\n        it('Return a list of Collections accessible to the requester NAME contains no elevate',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections?name=${'delete'}&name-match=contains`, 'GET', iteration.token)\n          expect(res.status).to.eql(200)\n          expect(res.body).to.have.lengthOf(distinct.collectionMatch.collectionDeleteMatchCnt)\n          if (distinct.collectionMatch.collectionDeleteMatchCnt > 0){\n            expect(res.body[0].name).to.have.string('delete')\n          }\n        })\n        it(\"return collections with stats projection, no elevate\",async function () {\n          const res =  await utils.executeRequest(`${config.baseUrl}/collections?projection=statistics`, 'GET', iteration.token)\n          expect(res.status).to.eql(200)\n          for(const collection of res.body){\n            if(collection.collectionId === reference.testCollection.collectionId){\n              expect(collection.statistics.assetCount).to.equal(distinct.assetIds.length)\n            }\n          }\n        })\n      })\n\n      describe('getCollection - /collections/{collectionId}', function () {\n        it('Return a Collection',async function () { \n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}?projection=assets&projection=grants&projection=owners&projection=users&projection=statistics&projection=stigs&projection=labels`, 'GET', iteration.token)\n          if (distinct.grant === \"none\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.collectionId).to.equal(reference.testCollection.collectionId)\n          const regex  = new RegExp(reference.testCollection.name)\n          expect(res.body.name).to.match(regex)\n          \n          expect(res.body.grants).to.have.lengthOf(reference.testCollection.grantsProjected.length)\n          for(const grant of res.body.grants){\n            const userIds = reference.testCollection.grantsProjected\n            .filter(grant => grant.user)\n            .map(grant => grant.user.userId);\n          \n            if (grant.user) {\n              expect(userIds).to.include(grant.user.userId);\n            }\n            else if (grant.userGroup) {\n              const groupIds = reference.testCollection.grantsProjected\n                .filter(grant => grant.userGroup)\n                .map(grant => grant.userGroup.userGroupId);\n          \n              expect(groupIds).to.include(grant.userGroup.userGroupId);\n            }\n          }\n\n          expect(res.body.settings.history.maxReviews).to.eql(5)\n          expect(res.body.settings.fields.detail.enabled).to.eql('always')\n          expect(res.body.settings.fields.detail.required).to.eql('always')\n          expect(res.body.settings.fields.comment.enabled).to.eql('findings')\n          expect(res.body.settings.fields.comment.required).to.eql('findings')\n\n          expect(res.body.settings.status.canAccept).to.eql(true)\n          expect(res.body.settings.status.minAcceptGrant).to.eql(3)\n          expect(res.body.settings.status.resetCriteria).to.eql('result')\n\n          expect(res.body.settings.importOptions).to.deep.equalInAnyOrder(reference.testCollection.importOptions)  \n\n\n          // assets projection\n          expect(res.body.assets).to.have.lengthOf(distinct.assetIds.length)\n          for(const asset of res.body.assets){\n            expect(reference.testCollection.assetIds).to.include(asset.assetId)\n            expect(reference.testCollection.assetsProjected).to.deep.include(asset)\n          }       \n          //stats\n          expect(res.body.statistics.assetCount).to.eql(distinct.assetIds.length)\n\n          //owner\n          expect(res.body.owners).to.have.lengthOf(reference.testCollection.owners.length)\n          for(const owner of res.body.owners){\n            expect(reference.testCollection.owners).to.include(owner.userId)\n          }\n\n          //stigs\n          expect(res.body.stigs).to.have.lengthOf(distinct.validStigs.length)\n          for(const stig of res.body.stigs){\n            expect(distinct.validStigs).to.include(stig.benchmarkId)\n          }          \n        })\n        it('pass non-existent collection Id with elevate, expect 404 (mostly just testing getCollectionInfoAndCheckPermission here) ',async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${'123456'}?elevate=true`, 'GET', iteration.token)\n\n          if(iteration.name === 'stigmanadmin'){\n            expect(res.status).to.eql(404)\n            expect(res.body.error).to.equal(\"Resource not found.\")\n            expect(res.body.detail).to.equal(\"Collection not found\")\n          }\n          else{\n            expect(res.status).to.eql(403)\n          }\n        })\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}?projection=assets&projection=grants&projection=owners&projection=users&projection=statistics&projection=stigs&projection=labels`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('getChecklistByCollectionStig - /collections/{collectionId}/checklists/{benchmarkId}/{revisionStr}', function () {\n        it('Return the Checklist for the supplied Collection and STIG-latest',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/checklists/${reference.benchmark}/latest`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(reference.checklistLength)\n        })\n        it('Return the Checklist for the supplied Collection and STIG-revStr',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/checklists/${reference.benchmark}/${reference.revisionStr}`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(reference.checklistLength)\n        })\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/checklists/${reference.benchmark}/latest`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      // needs some projection work\n      describe('getFindingsByCollection - /collections/{collectionId}/findings', function () {\n        \n        it('Return the Findings for the specified Collection by ruleId',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/findings?aggregator=cci&acceptedOnly=false&projection=assets&projection=groups&projection=rules&projection=stigs&projection=ccis`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n\n            expect(res.body).to.have.lengthOf(distinct.findings.findingsCnt)\n\n            // assets projection\n            for(const finding of res.body){\n                expect(finding.assetCount).to.equal(finding.assets.length)\n                for(const asset of finding.assets){\n                    expect(distinct.assetIds).to.include(asset.assetId)\n                }\n            }\n            // groups projection\n            expect(res.body[0].groups).to.be.an('array').of.length(1)\n\n            // rules projection\n            expect(res.body[0].rules).to.be.an('array').of.length(1)\n            \n            // stigs projection\n            expect(res.body[0].stigs).to.be.an('array').of.length(1)\n            expect(res.body[0].stigs[0].ruleCount).to.equal(81)\n            expect(res.body[0].stigs[0].benchmarkId).to.equal(reference.benchmark)\n            expect(res.body[0].stigs[0].revisionStr).to.equal(reference.revisionStr)\n\n            // ccis projection\n            expect(res.body[0].ccis).to.be.an('array').of.length(1)\n            expect(res.body[0].ccis[0]).to.have.property('cci')\n            expect(res.body[0].ccis[0]).to.have.property('definition')\n            expect(res.body[0].ccis[0]).to.have.property('apAcronym')\n            expect(res.body[0].ccis[0]).to.have.property('control')\n        })\n\n        it('Return the Findings for the specified Collection by groupId',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/findings?aggregator=groupId&acceptedOnly=false&projection=assets`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n\n            expect(res.body).to.have.lengthOf(distinct.findings.findingsByGroupCnt)\n\n            for(const finding of res.body){\n              expect(finding.assetCount).to.equal(finding.assets.length)\n              for(const asset of finding.assets){\n                  expect(distinct.assetIds).to.include(asset.assetId)\n              }\n            }\n        })\n\n        it('Return the Findings for the specified Collection by cci',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/findings?aggregator=cci&acceptedOnly=false&projection=assets`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n\n            expect(res.body).to.have.lengthOf(distinct.findings.findingsByCciCnt)\n\n            for(const finding of res.body){\n              expect(finding.assetCount).to.equal(finding.assets.length)\n              for(const asset of finding.assets){\n                  expect(distinct.assetIds).to.include(asset.assetId)\n              }\n            }\n        })\n\n        it('Return the Findings for the specified Collection by cci, no projections', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/findings?aggregator=cci&acceptedOnly=false`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.have.lengthOf(distinct.findings.findingsByCciCnt)\n        })\n\n        it('Return the Findings for the specified Collection for benchmarkId x ruleId',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/findings?aggregator=ruleId&acceptedOnly=false&benchmarkId=${reference.benchmark}&projection=assets`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n\n            expect(res.body).to.be.an('array').of.length(distinct.findings.findingsByRuleForBenchmarkCnt)\n\n            for(const finding of res.body){\n              expect(finding.assetCount).to.equal(finding.assets.length)\n              for(const asset of finding.assets){\n                  expect(distinct.assetIds).to.include(asset.assetId)\n              }\n            }\n        })\n\n        it('Return the Findings for the specified Collection for asset x ruleId Copy',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/findings?aggregator=ruleId&acceptedOnly=false&assetId=${reference.testAsset.assetId}&projection=assets`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n\n            expect(res.body).to.have.lengthOf(distinct.findings.findingsByRuleForAssetCnt)\n\n            for(const finding of res.body){\n              expect(finding.assetCount).to.equal(1)\n              expect(finding.assets[0].assetId).to.equal(reference.testAsset.assetId)\n            }\n        })\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/findings?aggregator=cci&acceptedOnly=false&projection=assets&projection=groups&projection=rules&projection=stigs&projection=ccis`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('getEffectiveAclByCollectionUser - /collections/{collectionId}/users/{userId}/effective-acl', function () {\n\n        it(\"should return the effective ACL for the user in the collection users < manage will get rejected\",async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${iteration.userId}/effective-acl`, 'GET', iteration.token)\n            if (distinct.grant === \"none\" || distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.deep.equalInAnyOrder(distinct.acl)\n        })\n\n        it(\"should return the effective ACL for the user in the collection users uses only admin token\",async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${iteration.userId}/effective-acl`, 'GET', iterations[0].token)\n            \n            if(iteration.name === 'collectioncreator'){\n              expect(res.status).to.eql(422)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.deep.equalInAnyOrder(distinct.acl)\n        })\n        it(\"should return SmError.UnprocessableError because the user has no direct grant in the collection\",async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${\"1234321\"}/effective-acl`, 'GET', iteration.token)\n            if (distinct.grant === \"none\" || distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(422)\n            expect(res.body.error).to.equal(\"Unprocessable Entity.\")\n        })\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/users/${iteration.userId}/effective-acl`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n  \n      describe('getCollectionLabels - /collections/{collectionId}/labels', function () {\n\n        it('Labels for the specified Collection',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/labels`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(reference.testCollection.labels.length)\n            for(const label of res.body){\n              expect(reference.testCollection.labels).to.include(label.labelId)\n              if (label.name == reference.testCollection.fullLabelName){\n                  expect(label.uses).to.equal(distinct.fullLabelUses)\n              }\n              if (label.name == reference.testCollection.lvl1LabelName){\n                  expect(label.uses).to.equal(distinct.lvl1LabelUses)\n              }\n              \n            }\n\n        })\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/labels`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('getCollectionLabelById - /collections/{collectionId}/labels/{labelId}', function () {\n        it('Collection label',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/labels/${reference.testCollection.fullLabel}`, 'GET', iteration.token)\n         /* The above JavaScript code snippet is performing the following actions: */\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body.labelId).to.equal(reference.testCollection.fullLabel)\n            expect(res.body.uses).to.equal(distinct.fullLabelUses)\n\n            expect(res.body.name).to.equal(reference.testCollection.fullLabelName)\n        })\n        it(\"should return SmError.NotFoundError because the label does not exist\",async function () {\n\n          const randomUUID = uuidv4()\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/labels/${randomUUID}`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(404)\n            expect(res.body.error).to.equal(\"Resource not found.\")\n        })\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/labels/${reference.testCollection.fullLabel}`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('getCollectionMetadata - /collections/{collectionId}/metadata', function () {\n        it('Metadata for the specified Collection',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metadata`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }                \n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n          }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body[reference.testCollection.collectionMetadataKey]).to.equal(reference.testCollection.collectionMetadataValue)\n        })\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metadata`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('getCollectionMetadataKeys - /collections/{collectionId}/metadata/keys', function () {\n\n        it('Return the Metadata KEYS for a Collection',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metadata/keys?`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(reference.testCollection.allMetadata.length)\n            const keys = reference.testCollection.allMetadata.map(meta => meta.key)\n            for(const key of res.body){\n              expect(keys).to.include(key)\n            }\n        })\n        it('should return empty 200 reponse, collection does not have metadata',async function () {\n          \n          const collectionNoMetadata = await utils.createTempCollection( {\n            name: 'temoCollection' + utils.getUUIDSubString(),\n            description: 'Collection TEST description',\n            settings: {\n              fields: {\n                detail: {\n                  enabled: 'always',\n                  required: 'findings'\n                },\n                comment: {\n                  enabled: 'always',\n                  required: 'findings'\n                }\n              },\n              status: {\n                canAccept: true,\n                minAcceptGrant: 2,\n                resetCriteria: 'result'\n              },\n              history: {\n                maxReviews: 11\n              },\n              importOptions: {\n                autoStatus: {\n                  fail: \"submitted\",\n                  notapplicable: \"submitted\",\n                  pass: \"submitted\",\n                },\n                unreviewed: \"commented\",\n                unreviewedCommented: \"informational\",\n                emptyDetail: \"replace\",\n                emptyComment: \"ignore\",\n                allowCustom: true\n              }\n            },\n            metadata: {},\n            grants: [\n              {\n                userId: '1',\n                roleId: 4\n              },\n              {\n                userId: '21',\n                roleId: 2\n              },\n              {\n                userId: '44',\n                roleId: 3\n              },\n              {\n                userId: '45',\n                roleId: 4\n              }\n            ],\n            labels: [\n              {\n                name: 'TEST',\n                description: 'Collection label description',\n                color: 'ffffff'\n              }\n            ]\n          })\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${collectionNoMetadata.collectionId}/metadata/keys`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              utils.deleteCollection(collectionNoMetadata.collectionId)\n              return\n            }\n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              utils.deleteCollection(collectionNoMetadata.collectionId)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(0)\n            utils.deleteCollection(collectionNoMetadata.collectionId)\n         })\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metadata/keys`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('getCollectionMetadataValue - /collections/{collectionId}/metadata/keys/{key}', function () {\n\n        it('Return the Metadata VALUE for a Collection metadata KEY',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metadata/keys/${reference.testCollection.collectionMetadataKey}`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.equal(reference.testCollection.collectionMetadataValue)\n        })\n        it('should throw SmError.NotFoundError because the collection does not contain the key',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metadata/keys/trashkey`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(404)\n            expect(res.body.error).to.equal(\"Resource not found.\")\n            expect(res.body.detail).to.equal(\"metadata key not found\")\n        })\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metadata/keys/${reference.testCollection.collectionMetadataKey}`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('getPoamByCollection - /collections/{collectionId}/poam', function () {\n        it('Return a POAM-like spreadsheet aggregated by groupId',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/poam?aggregator=groupId&date=01%2F01%2F1970&office=MyOffice&status=Ongoing&acceptedOnly=true`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n        })\n\n        it('Return a POAM-like spreadsheet aggregated by ruleId',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/poam?aggregator=ruleId&date=01%2F01%2F1970&office=MyOffice&status=Ongoing&acceptedOnly=true`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n        })\n\n        it('Return an EMASS formatted POAM-like spreadsheet aggregated by groupId',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/poam?format=EMASS&aggregator=groupId&date=01%2F01%2F1970&office=MyOffice&status=Ongoing&acceptedOnly=true&mccastPackageId=PackageID&mccastAuthName=AuthPackageName`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n        })\n\n        it('Return an EMASS formatted POAM-like spreadsheet aggregated by ruleId',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/poam?format=EMASS&aggregator=ruleId&date=01%2F01%2F1970&office=MyOffice&status=Ongoing&mccastPackageId=PackageID&mccastAuthName=AuthPackageName`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n        })\n\n        it('Return an MCCAST formatted POAM-like spreadsheet aggregated by groupId',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/poam?format=MCCAST&aggregator=groupId&date=01%2F01%2F1970&office=MyOffice&status=Started&acceptedOnly=true&mccastPackageId=PackageID&mccastAuthName=AuthPackageName`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n        })\n  \n        it('Return an MCCAST formatted POAM-like spreadsheet aggregated by ruleId',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/poam?format=MCCAST&aggregator=ruleId&date=01%2F01%2F1970&office=MyOffice&status=Started&mccastPackageId=PackageID&mccastAuthName=AuthPackageName`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n        })\n\n        it(\"should return 403 for deleted collection\", async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/poam?aggregator=groupId&date=01%2F01%2F1970&office=MyOffice&status=Ongoing&acceptedOnly=true`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('getReviewHistoryByCollection - /collections/{collectionId}/review-history', function () {\n\n        it('History records - no query params',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            expect(res.body).to.be.an('array').of.length(reference.testCollection.assetsWithHistory.length)\n\n            for(const asset of res.body){\n              if(asset.assetId === reference.testCollection.reviewHistory.assetId){\n                expect(asset.reviewHistories).to.be.an('array').of.length(reference.testCollection.reviewHistory.reviewHistoryRuleCnt)\n                for(const history of asset.reviewHistories){\n                  if(history.ruleId === reference.testCollection.reviewHistory.ruleId){\n                    expect(history.history).to.be.an('array').of.length(reference.testCollection.reviewHistory.reviewHistoryRuleCnt)\n                    for(const record of history.history){\n                      expect(record.result).to.be.equal('pass')\n                    }\n                  }\n                }\n              }\n            }\n        })\n\n        it('History records - asset only',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history?assetId=${reference.testCollection.reviewHistory.assetId}`, 'GET', iteration.token)\n\n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            //requesting one assets history\n            expect(res.body).to.be.an('array').of.length(1)\n            for(const asset of res.body){\n              expect(asset.assetId).to.equal(reference.testCollection.reviewHistory.assetId)\n              expect(asset.reviewHistories).to.be.an('array').of.length(reference.testCollection.reviewHistory.rulesWithHistoryCnt)\n              for(const history of asset.reviewHistories){\n                if(history.ruleId === reference.testCollection.reviewHistory.ruleId){\n                  expect(history.history).to.be.an('array').of.length(reference.testCollection.reviewHistory.reviewHistoryRuleCnt)\n                  for(const record of history.history){\n                    expect(record.result).to.be.equal('pass')\n                  }\n                }\n              }\n          }\n        })\n\n        it('History records - endDate only',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history?endDate=${reference.testCollection.reviewHistory.endDate}`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            expect(res.body).to.be.an('array').of.length(reference.testCollection.assetsWithHistory.length)\n            for(const asset of res.body){\n              for(const history of asset.reviewHistories){\n                expect(history.history).to.be.an('array').of.length(2)\n                for(const record of history.history){\n                  expect(Date.parse(record.ts)).to.be.below(Date.parse(reference.testCollection.reviewHistory.endDate))\n                }\n              }\n            }\n        })\n\n        it('History records - startDate only',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history?startDate=${reference.testCollection.reviewHistory.startDate}`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            expect(res.body).to.be.an('array').of.length(reference.testCollection.assetsWithHistory.length)\n            for(const asset of res.body){\n              for(const history of asset.reviewHistories){\n                for(const record of history.history){\n                  expect(Date.parse(record.ts)).to.be.above(Date.parse(reference.testCollection.reviewHistory.startDate))\n                }\n              }\n            }\n        })\n\n        it('History records - rule only',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history?ruleId=${reference.testCollection.reviewHistory.ruleId}`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            expect(res.body).to.be.an('array').of.length(reference.testCollection.assetsWithHistory.length)\n            for(const asset of res.body){\n              for(const history of asset.reviewHistories){\n                expect(history.ruleId).to.equal(reference.testCollection.reviewHistory.ruleId)\n              }\n            }\n        })\n\n        it('History records - start and end dates',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history?startDate=${reference.testCollection.reviewHistory.startDate}&endDate=${reference.testCollection.reviewHistory.endDate}`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            expect(res.body).to.be.an('array').of.length(reference.testCollection.assetsWithHistory.length)\n            for(const asset of res.body){\n              for(const history of asset.reviewHistories){\n                for(const record of history.history){\n                  expect(Date.parse(record.ts)).to.be.above(Date.parse(reference.testCollection.reviewHistory.startDate))\n                  expect(Date.parse(record.ts)).to.be.below(Date.parse(reference.testCollection.reviewHistory.endDate))\n                }\n              }\n            }\n        })\n\n        it('History records - status only',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history?status=${reference.testCollection.reviewHistory.status}`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            expect(res.body).to.be.an('array').of.length(reference.testCollection.assetsWithHistory.length)\n            for(const asset of res.body){\n              for(const history of asset.reviewHistories){\n                for(const record of history.history){\n                  expect(record.status.label).to.equal(reference.testCollection.reviewHistory.status)\n                }\n              }\n            }\n        })\n\n        it('History records - all params',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history?status=${reference.testCollection.reviewHistory.status}&assetId=${reference.testCollection.reviewHistory.assetId}&ruleId=${reference.testCollection.reviewHistory.ruleId}&startDate=${reference.testCollection.reviewHistory.startDate}&endDate=${reference.testCollection.reviewHistory.endDate}`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            expect(res.body).to.be.an('array').of.length(1)\n            //asset\n            //expect just one item in response array\n            expect(res.body[0].assetId).to.equal(reference.testCollection.reviewHistory.assetId)\n            for(const history of res.body[0].reviewHistories){\n              //rule \n              expect(history.ruleId).to.equal(reference.testCollection.reviewHistory.ruleId)\n              for(const record of history.history){\n                // start/end date\n                expect(Date.parse(record.ts)).to.be.above(Date.parse(reference.testCollection.reviewHistory.startDate))\n                expect(Date.parse(record.ts)).to.be.below(Date.parse(reference.testCollection.reviewHistory.endDate))\n                // status\n                expect(record.status.label).to.equal(reference.testCollection.reviewHistory.status)\n              }\n            }\n        })\n\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/review-history`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n      \n      describe('getReviewHistoryStatsByCollection - /collections/{collectionId}/review-history/stats', function () {\n\n        it('History stats - no query params',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history/stats`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            expect(res.body.collectionHistoryEntryCount).to.equal(reference.testCollection.reviewHistory.reviewHistoryTotalEntryCnt)\n            expect(Date.parse(res.body.oldestHistoryEntryDate)).to.equal(Date.parse(\"2020-08-11T22:26:50.000Z\"))\n        })\n\n        it('History stats - startDate only',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history/stats?startDate=${reference.testCollection.reviewHistory.startDate}`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            expect(res.body.collectionHistoryEntryCount).to.equal(reference.testCollection.reviewHistory.reviewHistoryTotalEntryCnt)\n            expect(Date.parse(res.body.oldestHistoryEntryDate)).to.equal(Date.parse(\"2020-08-11T22:26:50.000Z\"))\n        })\n\n        it('History stats - startDate - Asset Projection',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history/stats?startDate=${reference.testCollection.reviewHistory.startDate}&projection=asset`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n\n            expect(res.body.collectionHistoryEntryCount).to.equal(reference.testCollection.reviewHistory.reviewHistoryTotalEntryCnt)\n            expect(Date.parse(res.body.oldestHistoryEntryDate)).to.equal(Date.parse(\"2020-08-11T22:26:50.000Z\"))\n            expect(res.body.assetHistoryEntryCounts.length).to.eql(reference.testCollection.reviewHistory.reviewHistory_startDateCnt)\n            let totalHistoryEntries = 0\n            for(const asset of res.body.assetHistoryEntryCounts){\n              expect(distinct.assetIds).to.include(asset.assetId)\n              totalHistoryEntries += asset.historyEntryCount\n            }\n            expect(reference.testCollection.reviewHistory.reviewHistoryTotalEntryCnt).to.equal(res.body.collectionHistoryEntryCount)\n        })\n\n        it('History stats - endDate only',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history/stats?endDate=${reference.testCollection.reviewHistory.endDate}`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            expect(res.body.collectionHistoryEntryCount).to.equal(reference.testCollection.reviewHistory.reviewHistory_endDateCnt)\n            expect(Date.parse(res.body.oldestHistoryEntryDate)).to.equal(Date.parse(\"2020-08-11T22:26:50.000Z\"))\n        })\n\n        it('History stats - start and end dates',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history/stats?endDate=${reference.testCollection.reviewHistory.endDate}&startDate=${reference.testCollection.reviewHistory.startDate}`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            expect(res.body.collectionHistoryEntryCount).to.equal(reference.testCollection.reviewHistory.reviewHistory_startAndEndDateCnt)\n            expect(Date.parse(res.body.oldestHistoryEntryDate)).to.equal(Date.parse(\"2020-08-11T22:26:50.000Z\"))\n        })\n\n        it('History stats - asset only',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history/stats?assetId=${reference.testCollection.reviewHistory.assetId}`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            expect(res.body.collectionHistoryEntryCount).to.equal(reference.testCollection.reviewHistory.reviewHistory_testAssetCnt)\n        })\n        it('History stats - rule only',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history/stats?ruleId=${reference.testCollection.reviewHistory.ruleId}`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            expect(res.body.collectionHistoryEntryCount).to.equal(reference.testCollection.reviewHistory.reviewHistory_entriesByRuleIdCnt)\n            expect(Date.parse(res.body.oldestHistoryEntryDate)).to.equal(Date.parse(\"2020-08-11T22:30:38.000Z\"))\n        })\n\n        it('History stats - status only',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history/stats?status=${reference.testCollection.reviewHistory.status}`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n\n            expect(res.body.collectionHistoryEntryCount).to.equal(reference.testCollection.reviewHistory.reviewHistory_byStatusCnt)\n            expect(Date.parse(res.body.oldestHistoryEntryDate)).to.equal(Date.parse(\"2020-08-11T22:26:50.000Z\"))\n        })\n\n        it('History stats - all params',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history/stats?endDate=${reference.testCollection.reviewHistory.endDate}&startDate=${reference.testCollection.reviewHistory.startDate}&assetId=${reference.testCollection.reviewHistory.assetId}&status=${reference.testCollection.reviewHistory.status}&ruleId=${reference.testCollection.reviewHistory.ruleId}&projection=asset`, 'GET', iteration.token)\n            \n            expect(res.status).to.eql(distinct.historyResponseStatus)\n            if (res.status !== 200){\n              return\n            }\n            //expect just one item in response array\n            expect(res.body.collectionHistoryEntryCount).to.equal(1)\n            expect(Date.parse(res.body.oldestHistoryEntryDate)).to.equal(Date.parse(\"2020-08-11T23:37:45.000Z\"))\n            expect(res.body.assetHistoryEntryCounts.length).to.eql(1)\n        })\n\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/review-history/stats`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('getStigsByCollection - /collections/{collectionId}/stigs', function () {\n\n        it('Return the STIGs mapped in the specified Collection',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(distinct.validStigs.length)\n            for(const stig of res.body){\n              expect(distinct.validStigs).to.include(stig.benchmarkId)\n              expect(stig.revisionPinned).to.equal(false)\n              if(stig.benchmarkId === reference.benchmark){\n                expect(stig.revisionStr).to.equal(reference.revisionStr)\n                expect(stig.ruleCount).to.equal(reference.checklistLength)\n              }\n            }\n        })\n\n        it('Return the STIGs mapped in the specified Collection - label',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs?labelId=${reference.testCollection.fullLabel}`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n\n            expect(res.body).to.be.an('array').of.length(distinct.fullLabelUses)\n\n            for(const stig of res.body){\n              expect(distinct.validStigs).to.include(stig.benchmarkId)\n              if(stig.benchmarkId === reference.benchmark){\n                expect(stig.assetCount).to.equal(distinct.vpnStigAssetCount)\n                expect(stig.revisionStr).to.equal(reference.revisionStr)\n                expect(stig.ruleCount).to.equal(reference.checklistLength)\n              }\n              else{\n                expect(stig.assetCount).to.equal(distinct.windowsStigAssetCount)\n                expect(stig.ruleCount).to.equal(287)\n              }\n            }\n        })\n\n        it('Return the STIGs mapped in the specified Collection - asset projection',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs?projection=assets`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(distinct.validStigs.length)\n            for(const stig of res.body){\n              expect(distinct.validStigs).to.include(stig.benchmarkId)\n              const regex = new RegExp(\"asset\")\n              if(stig.benchmarkId === reference.benchmark){\n                expect(stig.revisionStr).to.equal(reference.revisionStr)\n                expect(stig.ruleCount).to.equal(reference.checklistLength)\n              }\n              for(const asset of stig.assets){\n                expect(distinct.assetIds).to.include(asset.assetId)\n                expect(asset.name).to.match(regex)\n              }\n            }\n        })\n        it(\"return the stigs mapped to test collection label names predicate\",async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs?labelName=${reference.testCollection.fullLabelName}`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(distinct.fullLabelUses)\n\n            for(const stig of res.body){\n              expect(distinct.validStigs).to.include(stig.benchmarkId)\n              //expect just 1 asset with this label\n              if(stig.benchmarkId === reference.benchmark){\n                expect(stig.assetCount).to.equal(distinct.vpnStigAssetCount)\n                expect(stig.revisionStr).to.equal(reference.revisionStr)\n                expect(stig.ruleCount).to.equal(reference.checklistLength)\n              }\n              else{\n                expect(stig.assetCount).to.equal(distinct.windowsStigAssetCount)\n                expect(stig.ruleCount).to.equal(287)\n              }\n            }\n        })\n        it(\"return the stigs mapped to test colleciton label match = null\",async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs?labelName=null`, 'GET', iteration.token)\n            if (distinct.grant === \"none\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(0)\n        })\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/stigs`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('getStigByCollection - /collections/{collectionId}/stigs/{benchmarkId}', function () {\n\n            it('Return Pinned Revision for this STIG',async function () {\n              const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.benchmark}`, 'GET', iteration.token)\n                if (distinct.grant === \"none\"){\n                  expect(res.status).to.eql(403)\n                  return\n                }\n                expect(res.status).to.eql(200)\n                expect(res.body.benchmarkId).to.equal(reference.benchmark)\n                expect(res.body.revisionStr).to.equal(reference.revisionStr)\n                expect(res.body.revisionPinned).to.equal(false)\n                expect(res.body.assetCount).to.eql(distinct.testBenchmarkAssignedCount)\n            })\n\n            it('Should return 204, no stig available (this probably needs to be 404? idk',async function () {\n              const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/notastig`, 'GET', iteration.token)\n                if (distinct.grant === \"none\"){\n                  expect(res.status).to.eql(403)\n                  return\n                }\n                expect(res.status).to.eql(204)\n            })\n\n            it('Return the info about the specified STIG from the specified Collection - asset projection',async function () {\n              const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.benchmark}?projection=assets`, 'GET', iteration.token)\n                if (distinct.grant === \"none\"){\n                  expect(res.status).to.eql(403)\n                  return\n                }\n                expect(res.status).to.eql(200)\n                expect(res.body.benchmarkId).to.equal(reference.benchmark)\n                expect(res.body.revisionStr).to.equal(reference.revisionStr)\n                expect(res.body.revisionPinned).to.equal(false)\n                const regex = new RegExp(\"asset\")\n                for(const asset of res.body.assets){\n                  expect(distinct.assetIds).to.include(asset.assetId)\n                  expect(asset.name).to.match(regex)\n                }\n            })\n            it('should return 403 for deleted collection', async function () {\n              const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/stigs/${reference.benchmark}`, 'GET', iteration.token)\n              expect(res.status).to.eql(403)\n            })\n      })\n\n      // experimental \n      describe('getUnreviewedAssetsByCollection - /collections/{collectionId}/unreviewed/assets', function () {\n\n        it(\"should return 200 \",async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/unreviewed/assets`, 'GET', iteration.token)\n          if (distinct.grant === \"none\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n        })\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/unreviewed/assets`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('getUnreviewedRulesByCollection - /collections/{collectionId}/unreviewed/rules', function () {\n\n        it(\"should return200\",async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/unreviewed/rules`, 'GET', iteration.token)\n          if (distinct.grant === \"none\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n        })\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/unreviewed/rules`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('getGrantsByCollection - /collections/{collectionId}/grants', function () {\n\n        it(\"should return all grants for the collection\",async function () {  \n          \n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'GET', iteration.token)\n            if (distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(reference.testCollection.grantsProjected.length)\n            expect(res.body).to.deep.equalInAnyOrder(reference.testCollection.grantsProjected)\n        })\n        it(\"should return all grants for the collection elevated, stigman admin should only pass. \",async function () {  \n          \n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants?elevate=true`, 'GET', iteration.token)\n            if (iteration.name !== \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(reference.testCollection.grantsProjected.length)\n            expect(res.body).to.deep.equalInAnyOrder(reference.testCollection.grantsProjected)\n        })\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/grants`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('getGrantByCollectionGrant - /collections/{collectionId}/grants/{grantId}', function () {\n\n        it(\"should return grant info for the test group\",async function () {\n          const res =  await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}`, 'GET', iteration.token)\n          if (distinct.canModifyCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.roleId).to.equal(reference.testCollection.testGroup.roleId)\n          expect(res.body.grantId).to.equal(reference.testCollection.testGroup.testCollectionGrantId)\n          expect(res.body.userGroup.userGroupId).to.equal(reference.testCollection.testGroup.userGroupId)\n          expect(res.body.userGroup.name).to.equal(reference.testCollection.testGroup.name)\n        })\n        it(\"should return grant for the test collection admin user (admin burke userId 87)\",async function () {\n          const res =  await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.adminBurke.testCollectionGrantId}`, 'GET', iteration.token)\n          if (distinct.canModifyCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.roleId).to.equal(reference.adminBurke.testCollectionrole)\n          expect(res.body.grantId).to.equal(reference.adminBurke.testCollectionGrantId)\n          expect(res.body.user.userId).to.equal(reference.adminBurke.userId)\n          expect(res.body.user.username).to.equal(reference.adminBurke.username)\n        })\n\n        it(\"should return grant for the test collection admin user (admin burke userId 87) elevated only stigmanadmin success\",async function () {\n          const res =  await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.adminBurke.testCollectionGrantId}?elevate=true`, 'GET', iteration.token)\n          if (iteration.name !== \"stigmanadmin\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.roleId).to.equal(reference.adminBurke.testCollectionrole)\n          expect(res.body.grantId).to.equal(reference.adminBurke.testCollectionGrantId)\n          expect(res.body.user.userId).to.equal(reference.adminBurke.userId)\n          expect(res.body.user.username).to.equal(reference.adminBurke.username)\n        })\n\n\n        \n        it(\"should return an error, there is no such grantId\",async function () {\n          \n          const res =  await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${\"12345678\"}`, 'GET', iteration.token)\n          if (distinct.canModifyCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(404)\n        })\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('getAclRulesByCollectionGrant - /collections/{collectionId}/grants/{grantId}/acl', function () {\n\n        it(\"should return acl for the testGroup\",async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}/acl`, 'GET', iteration.token)\n          if (distinct.canModifyCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(reference.testCollection.testGroup.defaultAccess)\n          expect(res.body.acl).to.deep.equalInAnyOrder(reference.testCollection.testGroup.acl) \n        })\n\n        it(\"should return the ACL for the direct users in the iteration (all using admin token for lvl1 and 2 success\",async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${iteration.grantId}/acl`, 'GET', iterations[0].token)\n          if(iteration.name === \"collectioncreator\"){\n            expect(res.status).to.eql(400)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(distinct.defaultAccess)\n          expect(res.body.acl).to.deep.equalInAnyOrder(distinct.aclByGrantId) \n\n        })\n\n        it(\"Should throw error collection id is bad\",async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${\"12345678\"}/grants/${reference.testCollection.testGroup.testCollectionGrantId}/acl`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n\n        it(\"should throw error grantId is bad\",async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${\"12345678\"}/acl`, 'GET', iteration.token)\n          if(distinct.canModifyCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(404)\n        })\n\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}/acl`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n    })\n  }\n})\n\n"
  },
  {
    "path": "test/api/mocha/data/collection/collectionPatch.test.js",
    "content": "import { v4 as uuidv4 } from 'uuid'\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {requestBodies} from \"./requestBodies.js\"\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\n\n\ndescribe('PATCH - Collection', function () {\n\n    before(async function () {\n        await utils.loadAppData()\n    })\n\n    for(const iteration of iterations) {\n      const distinct = expectations[iteration.name]\n      if (expectations[iteration.name] === undefined){\n        it(`No expectations for this iteration scenario: ${iteration.name}`,async function () {})\n        return\n      }\n\n      describe(`iteration:${iteration.name}`, function () {\n\n        beforeEach(async function () {\n          await utils.putCollection(reference.testCollection.collectionId, requestBodies.resetTestCollection)\n        })\n        describe('updateCollection - /collections/{collectionId}', function () {\n\n          it('Patch test collection, send 5 new grants and metadata.',async function () {\n\n            const patchRequest = requestBodies.updateCollection            \n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}?&projection=grants&projection=stigs`, 'PATCH', iteration.token, patchRequest)\n            \n            if(distinct.canModifyCollection === false){\n                expect(res.status).to.eql(403)\n                return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body.metadata.pocName).to.equal(patchRequest.metadata.pocName)\n            expect(res.body.metadata.pocEmail).to.equal(patchRequest.metadata.pocEmail)\n            expect(res.body.metadata.pocPhone).to.equal(patchRequest.metadata.pocPhone)\n            expect(res.body.metadata.reqRar).to.equal(patchRequest.metadata.reqRar)\n\n            expect(res.body.grants).to.have.lengthOf(patchRequest.grants.length)\n            for(let grant of res.body.grants) {\n                if(grant.userId){\n                    expect(grant.userId).to.be.oneOf(patchRequest.grants.map(grant => grant.userId))\n                }\n                if(grant.userGroupId){\n                    expect(grant.userGroupId).to.be.oneOf(patchRequest.grants.map(grant => grant.userGroupId))\n                }\n            }\n            for(let stig of res.body.stigs) {\n                expect(stig.benchmarkId).to.be.oneOf(reference.testCollection.validStigs)\n                if(stig.benchmarkId === reference.benchmark){\n                    expect(stig.ruleCount).to.equal(reference.checklistLength)\n                }\n            }\n          })\n\n          it(\"should change the collection settings import options\",async function () {\n\n            const patchRequest = {\n              settings: {\n                fields: {\n                  comment: {\n                    enabled: \"always\",\n                    required: \"findings\",\n                  },\n                  detail: {\n                    enabled: \"always\",\n                    required: \"findings\",\n                  },\n                },\n                history: {\n                  maxReviews: 5,\n                },\n                status: {\n                  canAccept: true,\n                  minAcceptGrant: 2,\n                  resetCriteria: \"result\",\n                },\n                importOptions: {\n                  autoStatus: {\n                    fail: \"saved\",\n                    notapplicable: \"saved\",\n                    pass: \"saved\",\n                  },\n                  unreviewed: \"never\",\n                  unreviewedCommented: \"notchecked\",\n                  emptyDetail: \"ignore\",\n                  emptyComment: \"ignore\",\n                  allowCustom: true,\n                },\n              },\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}`, 'PATCH', iteration.token, patchRequest)\n            if(distinct.canModifyCollection === false){\n                expect(res.status).to.eql(403)\n                return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body.settings).to.deep.equalInAnyOrder(patchRequest.settings)\n          \n          })\n\n          it(\"should throw SmError.UnprocessableError when updating due to duplicate user in grant array.\",async function () {\n\n            const patchRequest = JSON.parse(JSON.stringify(requestBodies.updateCollection))\n            patchRequest.grants.push(patchRequest.grants[0])\n            patchRequest.name = \"TEST\" + utils.getUUIDSubString()\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}`, 'PATCH', iteration.token, patchRequest)\n              if(distinct.canModifyCollection === false){\n                  expect(res.status).to.eql(403)\n                  return\n              }\n              expect(res.status).to.eql(422)\n              expect(res.body.error).to.equal(\"Unprocessable Entity.\")\n              expect(res.body.detail).to.equal(\"Duplicate user in grant array\")\n          })\n\n          it(\"should throw error because grants array has a repeated userGroupId\",async function () {\n\n            const patchRequest = JSON.parse(JSON.stringify(requestBodies.updateCollection))\n           // patchRequest.grants.push(patchRequest.grants[0])\n            patchRequest.grants.push({userGroupId: reference.testCollection.testGroup.userGroupId, roleId: 1})\n            patchRequest.name = \"TEST\" + utils.getUUIDSubString()\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}`, 'PATCH', iteration.token, patchRequest)\n              if(distinct.canModifyCollection === false){\n                  expect(res.status).to.eql(403)\n                  return\n              }\n              expect(res.status).to.eql(422)\n              expect(res.body.error).to.equal(\"Unprocessable Entity.\")\n              expect(res.body.detail).to.equal(\"Duplicate user in grant array\")\n\n          })\n\n          it('should return 403 for deleted collection', async function () {\n            const patchRequest = requestBodies.updateCollection\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}?&projection=grants&projection=stigs`, 'PATCH', iteration.token, patchRequest)\n            expect(res.status).to.eql(403)\n          })\n        })\n        describe('patchCollectionLabelById - /collections/{collectionId}/labels/{labelId}', function () {\n\n          it('Patch test collection label, change color, description and name ',async function () {\n            // this needed to be done because we are putting the collection in beforeeach which alters the labelId\n            const labelGet = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/labels`, 'GET', iteration.token)\n            if(distinct.canModifyCollection === false){\n              return\n            }\n            const fullLabel = labelGet.body.find(label => label.name === \"test-label-full\")\n            \n            const body = requestBodies.patchCollectionLabelById\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/labels/${fullLabel.labelId}`, 'PATCH', iteration.token, body)\n                \n              if(distinct.canModifyCollection === false){\n                expect(res.status).to.eql(403)\n                return\n              }\n              expect(res.status).to.eql(200)\n  \n              expect(res.body.labelId).to.equal(fullLabel.labelId)\n              expect(res.body.description).to.equal(body.description)\n              expect(res.body.color).to.equal(body.color)\n              expect(res.body.name).to.equal(body.name)\n          })\n          it(\"should throw SmError.NotFoundError when updating a label that doesn't exist.\",async function () {\n\n            const body = requestBodies.patchCollectionLabelById\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/labels/${uuidv4()}`, 'PATCH', iteration.token, body)\n              if(distinct.canModifyCollection === false){\n                  expect(res.status).to.eql(403)\n                  return\n              }\n              expect(res.status).to.eql(404)\n              expect(res.body.error).to.equal(\"Resource not found.\")\n          })\n\n          it('should return 403 for deleted collection', async function () {\n            const body = requestBodies.patchCollectionLabelById\n            // Use a dummy labelId for the deleted collection\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/labels/${reference.testCollection.fullLabel}`, 'PATCH', iteration.token, body)\n            expect(res.status).to.eql(403)\n          })\n        })\n        describe('patchCollectionMetadata - /collections/{collectionId}/metadata', function () {\n\n          it('Patch test collection metadata',async function () {\n              \n              const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metadata`, 'PATCH', iteration.token, {[reference.testCollection.collectionMetadataKey]: reference.testCollection.collectionMetadataValue})\n\n                if(distinct.canModifyCollection === false){\n                  expect(res.status).to.eql(403)\n                  return\n                }\n\n                expect(res.status).to.eql(200)\n                expect(res.body).to.contain({[reference.testCollection.collectionMetadataKey]: reference.testCollection.collectionMetadataValue})\n          })\n\n          it('should return 403 for deleted collection', async function () {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metadata`, 'PATCH', iteration.token, {[reference.testCollection.collectionMetadataKey]: reference.testCollection.collectionMetadataValue})\n            expect(res.status).to.eql(403)\n          })\n        })\n      })\n    }\n})\n"
  },
  {
    "path": "test/api/mocha/data/collection/collectionPost.test.js",
    "content": "import { v4 as uuidv4 } from 'uuid'\nimport JSZip from 'jszip';\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {requestBodies} from \"./requestBodies.js\"\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport { reviewsFromCkl, reviewsFromScc, reviewsFromCklb } from \"@nuwcdivnpt/stig-manager-client-modules\"\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\n\n\ndescribe('POST - Collection - not all tests run for all iterations', function () {\n\n  before(async function () {\n    await utils.loadAppData()\n    await utils.uploadTestStig(\"U_VPN_SRG_V1R0_Manual-xccdf.xml\")\n  })\n\n  for(const iteration of iterations) {\n    if (expectations[iteration.name] === undefined){\n      it(`No expectations for this iteration scenario: ${iteration.name}`,async function () {})\n      continue\n    }\n    describe(`iteration:${iteration.name}`, function () {\n      const distinct = expectations[iteration.name]\n      \n      before(async function () {\n        await utils.uploadTestStig(\"U_VPN_SRG_V1R0_Manual-xccdf.xml\")\n      })\n\n      after(async function () {\n     //   await utils.deleteStigByRevision(\"VPN_SRG_TEST\", \"V1R0\")\n      })\n  \n      describe(\"createCollection - /collections\", function () {\n\n        const random = utils.getUUIDSubString()\n\n        it(\"Create a Collection and test projections\",async function () {\n          const post = JSON.parse(JSON.stringify(requestBodies.createCollection))\n          post.name = \"testCollection\" + random\n          const res = await utils.executeRequest(`${config.baseUrl}/collections?projection=grants&projection=labels&projection=assets&projection=owners&projection=statistics&projection=stigs`, 'POST', iteration.token, post)\n          if(distinct.canCreateCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(201)\n          if (distinct.grant === 'none') {  \n            // grant = none iteration can create a collection, but does not give itself access to the collection\n            // TODO: Should eventually be changed to respond with empty object\n            return\n          }\n          expect(res.body.description).to.equal(\"Collection TEST description\")\n          expect(res.body.name).to.equal(post.name)\n          expect(res.body.settings.fields.detail.enabled).to.equal(post.settings.fields.detail.enabled)\n          expect(res.body.settings.fields.detail.required).to.equal(post.settings.fields.detail.required)\n          expect(res.body.settings.fields.comment.enabled).to.equal(post.settings.fields.comment.enabled)\n          expect(res.body.settings.fields.comment.required).to.equal(post.settings.fields.comment.required)\n          expect(res.body.settings.status.canAccept).to.equal(post.settings.status.canAccept)\n          expect(res.body.settings.status.minAcceptGrant).to.equal(post.settings.status.minAcceptGrant)\n          expect(res.body.settings.status.resetCriteria).to.equal(post.settings.status.resetCriteria)\n          expect(res.body.settings.history.maxReviews).to.equal(post.settings.history.maxReviews)\n\n          expect(res.body.settings.importOptions).to.deep.equalInAnyOrder(reference.defaultImportOptions)\n\n          expect(res.body.metadata.pocName).to.equal(post.metadata.pocName)\n          expect(res.body.metadata.pocEmail).to.equal(post.metadata.pocEmail)\n          expect(res.body.metadata.pocPhone).to.equal(post.metadata.pocPhone)\n          expect(res.body.metadata.reqRar).to.equal(post.metadata.reqRar)\n\n\n          // grants projection\n          expect(res.body.grants).to.have.lengthOf(1)\n          expect(res.body.grants[0].user.userId).to.equal(\"1\")\n          expect(res.body.grants[0].roleId).to.equal(4)\n          expect(res.body.grants[0].grantId).to.exist\n\n          // labels projection\n          expect(res.body.labels).to.have.lengthOf(1)\n          expect(res.body.labels[0].name).to.equal(\"TEST\")\n          expect(res.body.labels[0].description).to.equal(\"Collection label description\")\n          expect(res.body.labels[0].color).to.equal(\"ffffff\")\n\n          // assets projection\n          expect(res.body.assets).to.have.lengthOf(0)\n\n          // owners projection\n          expect(res.body.owners).to.have.lengthOf(1)\n          expect(res.body.owners[0].userId).to.equal(\"1\")\n\n          // statistics projection\n          expect(res.body.statistics.assetCount).to.equal(0)\n          expect(res.body.statistics.checklistCount).to.equal(0)\n      \n          // stigs projection\n          expect(res.body.stigs).to.have.lengthOf(0)\n\n          // just an extra check to make sure the collection was created\n          const createdCollection = await utils.getCollection(res.body.collectionId)\n            expect(createdCollection).to.exist\n        })\n\n        it(\"Create a Collection with no settings, expect the default\",async function () {\n          const defaultSettings = {\n            fields: {\n              detail: {\n                enabled: 'always',\n                required: 'always'\n              },\n              comment: {\n                enabled: 'findings',\n                required: 'findings'\n              }\n            },\n            status: {\n              canAccept: true,\n              resetCriteria: 'result',\n              minAcceptGrant: 3\n            },\n            history: {\n              maxReviews: 5\n            },\n            importOptions:{\n              autoStatus: {\n                fail: \"saved\",\n                notapplicable: \"saved\",\n                pass: \"saved\",\n              },\n              unreviewed: 'commented',\n              unreviewedCommented: 'informational',\n              emptyDetail: 'replace',\n              emptyComment: 'ignore',\n              allowCustom: true\n            }\n          }\n          const post = JSON.parse(JSON.stringify(requestBodies.collectionWithNoSettings))\n          post.name = post.name + random\n          const res = await utils.executeRequest(`${config.baseUrl}/collections?projection=grants&projection=labels&projection=assets&projection=owners&projection=statistics&projection=stigs`, 'POST', iteration.token, post)\n          if(distinct.canCreateCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(201)\n          if (distinct.grant === 'none') {  \n            // grant = none iteration can create a collection, but does not give itself access to the collection\n            // TODO: Should eventually be changed to respond with empty object\n            return\n          }\n          expect(res.body.name).to.equal(post.name)\n          expect(res.body.settings).to.deep.equalInAnyOrder(defaultSettings)\n\n        })\n\n\n        it(\"Create a Collection with partial settings, expect the defaults for the rest\",async function () {\n          const defaultSettings = {\n            fields: {\n              detail: {\n                enabled: 'always',\n                required: 'always'\n              },\n              comment: {\n                enabled: 'findings',\n                required: 'findings'\n              }\n            },\n            status: {\n              canAccept: true,\n              resetCriteria: 'result',\n              minAcceptGrant: 3\n            },\n            history: {\n              maxReviews: 5\n            },\n            importOptions:{\n              autoStatus: {\n                fail: \"saved\",\n                notapplicable: \"saved\",\n                pass: \"saved\",\n              },\n              unreviewed: 'commented',\n              unreviewedCommented: 'informational',\n              emptyDetail: 'replace',\n              emptyComment: 'ignore',\n              allowCustom: true\n            }\n          }\n\n          \n          const post = JSON.parse(JSON.stringify(requestBodies.collectionWithNoSettings))\n          post.name = post.name + utils.getUUIDSubString()\n          post.settings = {\n            history: {\n              maxReviews: 10\n            },\n          }\n          const res = await utils.executeRequest(`${config.baseUrl}/collections?projection=grants&projection=labels&projection=assets&projection=owners&projection=statistics&projection=stigs`, 'POST', iteration.token, post)\n          if(distinct.canCreateCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(201)\n          if (distinct.grant === 'none') {  \n            // grant = none iteration can create a collection, but does not give itself access to the collection\n            // TODO: Should eventually be changed to respond with empty object\n            return\n          }\n          expect(res.body.name).to.equal(post.name)\n          expect(res.body.settings.fields).to.deep.equalInAnyOrder(defaultSettings.fields)\n          expect(res.body.settings.status).to.deep.equalInAnyOrder(defaultSettings.status)\n          expect(res.body.settings.history).to.deep.equalInAnyOrder(post.settings.history)\n          expect(res.body.settings.importOptions).to.deep.equalInAnyOrder(defaultSettings.importOptions)\n\n\n        })\n        it(\"Create A colleciton with grant to a user group\",async function () {\n\n          const post = requestBodies.createCollectionWithTestGroup\n          let uuid = uuidv4().slice(0, 10)\n          post.name = \"testCollection\" + uuid\n          const res = await utils.executeRequest(`${config.baseUrl}/collections?projection=grants`, 'POST', iteration.token, post)\n          if(distinct.canCreateCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(201)\n          expect(res.body.grants).to.have.lengthOf(1)\n          expect(res.body.grants[0].userGroup.userGroupId).to.equal(\"1\")\n          expect(res.body.grants[0].roleId).to.equal(2)\n        })\n        it(\"should throw SmError.UnprocessableError due to duplicate user in grant array.\",async function () {\n\n          const post = JSON.parse(JSON.stringify(requestBodies.createCollection))\n          post.grants.push(post.grants[0])\n          post.name = \"TEST\" + utils.getUUIDSubString()\n          const res = await utils.executeRequest(`${config.baseUrl}/collections`, 'POST', iteration.token, post)\n            if(distinct.canCreateCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(422)\n            expect(res.body.error).to.equal(\"Unprocessable Entity.\")\n            expect(res.body.detail).to.equal(\"Duplicate user or user group in grant array\")\n        })\n        it(\"should throw SmError.UnprocessableError due to duplicate name exists \",async function () {\n          const post = JSON.parse(JSON.stringify(requestBodies.createCollection))\n          post.name = \"testCollection\" + random\n          const res = await utils.executeRequest(`${config.baseUrl}/collections?projection=grants&projection=labels&projection=assets&projection=owners&projection=statistics&projection=stigs`, 'POST', iteration.token, post)\n          if(distinct.canCreateCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          if (distinct.grant === 'none') {  \n            // grant = none iteration can create a collection, but does not give itself access to the collection\n            // TODO: Should eventually be changed to respond with empty object\n            return\n          }\n          expect(res.status).to.eql(422)\n          expect(res.body.error).to.equal(\"Unprocessable Entity.\")\n          expect(res.body.detail).to.equal(\"Duplicate name exists.\")\n        })\n      })\n\n      describe(\"postCklArchiveByCollection - /collections/{collectionId}/archive/ckl\", function () {\n\n        it(\"should download a CKL and get the test asset with test benchmark \",async function () {\n\n          const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/archive/ckl`\n          const requestBody = JSON.stringify(\n            requestBodies.postArchiveBenchmarkRevision,\n          )\n      \n          const options = {\n            method: 'POST',\n            headers: {\n              'Authorization': `Bearer ${iteration.token}`,\n              'Content-Type': 'application/json',\n            },\n            body: requestBody,\n          }\n      \n          // Fetch request\n          const res = await fetch(url, options)\n\n          if(iteration.name === \"collectioncreator\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          expect(res.status).to.eql(200)\n\n          const resArrayBuffer = await res.arrayBuffer();\n          const resBuffer = Buffer.from(resArrayBuffer);\n\n        \n          const zip = await JSZip.loadAsync(resBuffer)\n          const fileNames = Object.keys(zip.files)\n          expect(fileNames).to.have.lengthOf(2)\n          const data = await zip.files[\"U_Collection_X_lvl1_asset-1-VPN_SRG_TEST-V1R1.ckl\"].async(\"string\")\n          const assetData = reviewsFromCkl({\n            data,                    \n            fieldSettings: config.fieldSettings,  \n            allowAccept: true,       \n            importOptions: config.importOptions, \n            sourceRef: \"U_Collection_X_lvl1_asset-1-VPN_SRG_TEST-V1R1.ckl\"\n          })\n          expect(assetData.target.name).to.equal(reference.testAsset.name)\n          expect(assetData.target.metadata.cklRole).to.exist\n          expect(assetData.target.metadata.cklRole).to.equal(\"None\")\n          expect(assetData.checklists).to.have.lengthOf(1)\n          expect(assetData.checklists[0].benchmarkId).to.equal(reference.benchmark)\n          expect(assetData.checklists[0].revisionStr).to.equal(\"V1R1\")\n          expect(assetData.checklists[0].reviews).to.have.lengthOf(reference.testAsset.VPN_SRG_TEST_reviewCnt)\n        })\n\n        it(\"should download a CKL for an asset that does not have stigs attached, should throw. Lvl1 and collection creator do not  have access to asset\",async function () {\n\n        \n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/archive/ckl`, 'POST', iteration.token, requestBodies.postArchiveBenchmarkRevisionLvl1NoAccess)\n\n          if(iteration.name ==  \"lvl1\" || iteration.name == \"collectioncreator\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(422)\n        })\n\n        it(\"should download a CKL and get the test asset with test benchmark and no revision specified. should return latest\",async function () {\n\n          const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/archive/ckl`\n          const requestBody = JSON.stringify(\n            requestBodies.postArchiveBenchmark,\n          )\n      \n          const options = {\n            method: 'POST',\n            headers: {\n              'Authorization': `Bearer ${iteration.token}`,\n              'Content-Type': 'application/json',\n            },\n            body: requestBody,\n          }\n      \n          // Fetch request\n          const res = await fetch(url, options)\n\n          if(iteration.name === \"collectioncreator\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          expect(res.status).to.eql(200)\n\n          const resArrayBuffer = await res.arrayBuffer();\n          const resBuffer = Buffer.from(resArrayBuffer);\n\n        \n          const zip = await JSZip.loadAsync(resBuffer)\n            const fileNames = Object.keys(zip.files)\n            expect(fileNames).to.have.lengthOf(2)\n            const data = await zip.files[\"U_Collection_X_lvl1_asset-1-VPN_SRG_TEST-V1R1.ckl\"].async(\"string\")\n            const assetData = reviewsFromCkl({\n              data,                    \n              fieldSettings: config.fieldSettings,  \n              allowAccept: true,       \n              importOptions: config.importOptions, \n              sourceRef: \"U_Collection_X_lvl1_asset-1-VPN_SRG_TEST-V1R1.ckl\"\n            })\n            expect(assetData.target.name).to.equal(reference.testAsset.name)\n            expect(assetData.target.metadata.cklRole).to.exist\n            expect(assetData.target.metadata.cklRole).to.equal(\"None\")\n            expect(assetData.checklists).to.have.lengthOf(1)\n            expect(assetData.checklists[0].benchmarkId).to.equal(reference.benchmark)\n            expect(assetData.checklists[0].revisionStr).to.equal(\"V1R1\")\n            expect(assetData.checklists[0].reviews).to.have.lengthOf(reference.testAsset.VPN_SRG_TEST_reviewCnt)\n        })\n        it(\"should download a CKL and get the test asset with all benchmarks in a multi stig CKL file \",async function () {\n\n          const url =`${config.baseUrl}/collections/${reference.testCollection.collectionId}/archive/ckl?mode=multi`\n          const requestBody = JSON.stringify(\n            requestBodies.postArchiveDefault,\n          )\n      \n          const options = {\n            method: 'POST',\n            headers: {\n              'Authorization': `Bearer ${iteration.token}`,\n              'Content-Type': 'application/json',\n            },\n            body: requestBody,\n          }\n      \n          // Fetch request\n          const res = await fetch(url, options)\n\n          if(iteration.name === \"collectioncreator\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          expect(res.status).to.eql(200)\n\n          const resArrayBuffer = await res.arrayBuffer();\n          const resBuffer = Buffer.from(resArrayBuffer);\n\n        \n          const zip = await JSZip.loadAsync(resBuffer)\n            const fileNames = Object.keys(zip.files)\n            expect(fileNames).to.have.lengthOf(2)\n            const data = await zip.files[\"U_Collection_X_lvl1_asset-1.ckl\"].async(\"string\")\n            const assetData = reviewsFromCkl({\n              data,                    \n              fieldSettings: config.fieldSettings,  \n              allowAccept: true,       \n              importOptions: config.importOptions, \n              sourceRef: \"U_Collection_X_lvl1_asset-1.ckl\"\n            })\n            expect(assetData.target.name).to.equal(reference.testAsset.name)\n            expect(assetData.target.metadata.cklRole).to.exist\n            expect(assetData.target.metadata.cklRole).to.equal(\"None\")\n            expect(assetData.checklists).to.have.lengthOf(distinct.testAssetChecklists)\n            for(const checklist of assetData.checklists){\n              if(checklist.benchmarkId === reference.benchmark){\n                expect(checklist.revisionStr).to.equal(\"V1R1\")\n                expect(checklist.reviews).to.have.lengthOf(reference.testAsset.VPN_SRG_TEST_reviewCnt)\n              }\n              else {\n                expect(checklist.benchmarkId).to.equal(reference.windowsBenchmark)\n                expect(checklist.revisionStr).to.equal(\"V1R23\")\n                expect(checklist.reviews).to.have.lengthOf(3)\n              }\n            }\n        })\n      })\n\n      describe(\"postCklbArchiveByCollection - /collections/{collectionId}/archive/cklb\", function () {\n\n        it(\"should download a CKLB and get the test asset with test benchmark \",async function () {\n\n          const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/archive/cklb`\n          const requestBody = JSON.stringify(\n            requestBodies.postArchiveBenchmarkRevision,\n          )\n      \n          const options = {\n            method: 'POST',\n            headers: {\n              'Authorization': `Bearer ${iteration.token}`,\n              'Content-Type': 'application/json',\n            },\n            body: requestBody,\n          }\n      \n          const res = await fetch(url, options)\n\n          if(iteration.name === \"collectioncreator\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          expect(res.status).to.eql(200)\n\n          const resArrayBuffer = await res.arrayBuffer()\n          const resBuffer = Buffer.from(resArrayBuffer)\n          const zip = await JSZip.loadAsync(resBuffer)\n          const fileNames = Object.keys(zip.files)\n          expect(fileNames).to.have.lengthOf(2)\n          const data = await zip.files[\"U_Collection_X_lvl1_asset-1-VPN_SRG_TEST-V1R1.cklb\"].async(\"string\")\n          const assetData = reviewsFromCklb({\n            data,                    \n            fieldSettings: config.fieldSettings,  \n            allowAccept: true,       \n            importOptions: config.importOptions, \n            sourceRef: \"U_Collection_X_lvl1_asset-1-VPN_SRG_TEST-V1R1.cklb\"\n          })\n          expect(assetData.target.name).to.equal(reference.testAsset.name)\n          expect(assetData.target.metadata.cklRole).to.exist\n          expect(assetData.target.metadata.cklRole).to.equal(\"None\")\n          expect(assetData.checklists).to.have.lengthOf(1)\n          expect(assetData.checklists[0].benchmarkId).to.equal(reference.benchmark)\n        //   expect(assetData.checklists[0].revisionStr).to.equal(\"V1R1\") need new stigmancliet modules \n          expect(assetData.checklists[0].reviews).to.have.lengthOf(reference.testAsset.VPN_SRG_TEST_reviewCnt)\n        })\n\n        it(\"should download a CKLB for an asset that does not have stigs attached, should throw. Lvl1 and collection creator do not  have access to asset\",async function () {\n\n          const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/archive/cklb`\n          const requestBody = JSON.stringify(\n            requestBodies.postArchiveBenchmarkRevisionLvl1NoAccess,\n          )\n      \n          const options = {\n            method: 'POST',\n            headers: {\n              'Authorization': `Bearer ${iteration.token}`,\n              'Content-Type': 'application/json',\n            },\n            body: requestBody,\n          }\n      \n          const res = await fetch(url, options)\n\n          if(iteration.name ==  \"lvl1\" || iteration.name == \"collectioncreator\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(422)\n        })\n\n        it(\"should download a CKLB and get the test asset with test benchmark and no revision specified. should return latest\",async function () {\n\n          const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/archive/cklb`\n          const requestBody = JSON.stringify(\n            requestBodies.postArchiveBenchmark,\n          )\n      \n          const options = {\n            method: 'POST',\n            headers: {\n              'Authorization': `Bearer ${iteration.token}`,\n              'Content-Type': 'application/json',\n            },\n            body: requestBody,\n          }\n      \n          const res = await fetch(url, options)\n\n          if(iteration.name === \"collectioncreator\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          //expect(res.status).to.eql(200)\n          expect(res.status).to.eql(200)\n          const resArrayBuffer = await res.arrayBuffer()\n          const resBuffer = Buffer.from(resArrayBuffer)\n          const zip = await JSZip.loadAsync(resBuffer)\n            const fileNames = Object.keys(zip.files)\n            expect(fileNames).to.have.lengthOf(2)\n            const data = await zip.files[\"U_Collection_X_lvl1_asset-1-VPN_SRG_TEST-V1R1.cklb\"].async(\"string\")\n            const assetData = reviewsFromCklb({\n              data,                    \n              fieldSettings: config.fieldSettings,  \n              allowAccept: true,       \n              importOptions: config.importOptions, \n              sourceRef: \"U_Collection_X_lvl1_asset-1-VPN_SRG_TEST-V1R1.cklb\"\n            })\n            expect(assetData.target.name).to.equal(reference.testAsset.name)\n            expect(assetData.target.metadata.cklRole).to.exist\n            expect(assetData.target.metadata.cklRole).to.equal(\"None\")\n            expect(assetData.checklists).to.have.lengthOf(1)\n            expect(assetData.checklists[0].benchmarkId).to.equal(reference.benchmark)\n        //    expect(assetData.checklists[0].revisionStr).to.equal(\"V1R1\")\n            expect(assetData.checklists[0].reviews).to.have.lengthOf(reference.testAsset.VPN_SRG_TEST_reviewCnt)\n        })\n        it(\"should download a CKLB and get the test asset with all benchmarks in a multi stig CKLB file \",async function () {\n\n          const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/archive/cklb?mode=multi`\n          const requestBody = JSON.stringify(\n            requestBodies.postArchiveDefault,\n          )\n      \n          const options = {\n            method: 'POST',\n            headers: {\n              'Authorization': `Bearer ${iteration.token}`,\n              'Content-Type': 'application/json',\n            },\n            body: requestBody,\n          }\n      \n          const res = await fetch(url, options)\n\n          if(iteration.name === \"collectioncreator\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          expect(res.status).to.eql(200)\n          const resArrayBuffer = await res.arrayBuffer()\n          const resBuffer = Buffer.from(resArrayBuffer)\n          const zip = await JSZip.loadAsync(resBuffer)\n          const fileNames = Object.keys(zip.files)\n          expect(fileNames).to.have.lengthOf(2)\n          const data = await zip.files[\"U_Collection_X_lvl1_asset-1.cklb\"].async(\"string\")\n          const assetData = reviewsFromCklb({\n            data,                    \n            fieldSettings: config.fieldSettings,  \n            allowAccept: true,       \n            importOptions: config.importOptions, \n            sourceRef: \"U_Collection_X_lvl1_asset-1.cklb\"\n          })\n          expect(assetData.target.name).to.equal(reference.testAsset.name)\n          expect(assetData.target.metadata.cklRole).to.exist\n          expect(assetData.target.metadata.cklRole).to.equal(\"None\")\n          expect(assetData.checklists).to.have.lengthOf(distinct.testAssetChecklists)\n          for(const checklist of assetData.checklists){\n            if(checklist.benchmarkId === reference.benchmark){\n            //   expect(checklist.revisionStr).to.equal(\"V1R1\")\n              expect(checklist.reviews).to.have.lengthOf(reference.testAsset.VPN_SRG_TEST_reviewCnt)\n            }\n            else {\n              expect(checklist.benchmarkId).to.equal(reference.windowsBenchmark)\n          //     expect(checklist.revisionStr).to.equal(\"V1R23\")\n              expect(checklist.reviews).to.have.lengthOf(3)\n            }\n          }\n        })\n      })\n\n      describe(\"postXccdfArchiveByCollection - /collections/{collectionId}/archive/xccdf\", function () {\n\n        const dataArray = [\n          {\n            scapBenchmarkId: 'CAN_Ubuntu_18-04_STIG',\n            benchmarkId: 'U_CAN_Ubuntu_18-04_STIG'\n          },\n          { scapBenchmarkId: 'Mozilla_Firefox_RHEL', benchmarkId: 'Mozilla_Firefox' },\n          {\n            scapBenchmarkId: 'Mozilla_Firefox_Windows',\n            benchmarkId: 'Mozilla_Firefox'\n          },\n          { scapBenchmarkId: 'MOZ_Firefox_Linux', benchmarkId: 'MOZ_Firefox_STIG' },\n          { scapBenchmarkId: 'MOZ_Firefox_Windows', benchmarkId: 'MOZ_Firefox_STIG' },\n          { scapBenchmarkId: 'Solaris_10_X86_STIG', benchmarkId: 'Solaris_10_X86' }\n        ]\n        \n        const scapBenchmarkMap = new Map(\n          dataArray.map(item => [item.scapBenchmarkId, item])\n        )\n\n        it(\"should download a xccdf and get the test asset with test benchmark \",async function () {\n\n          const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/archive/xccdf`\n          const requestBody = JSON.stringify(\n            requestBodies.postArchiveBenchmarkRevision,\n          )\n      \n          const options = {\n            method: 'POST',\n            headers: {\n              'Authorization': `Bearer ${iteration.token}`,\n              'Content-Type': 'application/json',\n            },\n            body: requestBody,\n          }\n      \n          const res = await fetch(url, options)\n\n          if(iteration.name === \"collectioncreator\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          expect(res.status).to.eql(200)\n          const resArrayBuffer = await res.arrayBuffer()\n          const resBuffer = Buffer.from(resArrayBuffer)\n          const zip = await JSZip.loadAsync(resBuffer)\n          const fileNames = Object.keys(zip.files)\n          expect(fileNames).to.have.lengthOf(2)\n          const data = await zip.files[\"U_Collection_X_lvl1_asset-1-VPN_SRG_TEST-V1R1-xccdf.xml\"].async(\"string\")\n          const assetData = reviewsFromScc({\n            data,                    \n            fieldSettings: config.fieldSettings,  \n            allowAccept: true,       \n            importOptions: config.importOptions, \n            sourceRef: \"U_Collection_X_lvl1_asset-1-VPN_SRG_TEST-V1R1-xccdf.xml\"\n          })\n          expect(assetData.target.name).to.equal(reference.testAsset.name)\n          expect(assetData.target.metadata.testkey).to.exist\n          expect(assetData.target.metadata.testkey).to.equal(\"testvalue\")\n          expect(assetData.checklists).to.have.lengthOf(1)\n          expect(assetData.checklists[0].benchmarkId).to.equal(reference.benchmark)\n        //   expect(assetData.checklists[0].revisionStr).to.equal(\"V1R1\")\n          expect(assetData.checklists[0].reviews).to.have.lengthOf(reference.testAsset.VPN_SRG_TEST_reviewCnt)\n        })\n\n        it(\"should download a xccdf for an asset that does not have stigs attached, should throw. Lvl1 and collection creator do not  have access to asset\",async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/archive/xccdf`, 'POST', iteration.token, requestBodies.postArchiveBenchmarkRevisionLvl1NoAccess)\n\n          if(iteration.name ==  \"lvl1\" || iteration.name == \"collectioncreator\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(422)\n        })\n\n        it(\"should download a xccdf and get the test asset with test benchmark and no revision specified. should return latest\",async function () {\n\n          const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/archive/xccdf`\n\n          const requestBody = JSON.stringify(\n            requestBodies.postArchiveBenchmark,\n          )\n\n          const options = {\n            method: 'POST',\n            headers: {\n              'Authorization': `Bearer ${iteration.token}`,\n              'Content-Type': 'application/json',\n            },\n            body: requestBody,\n          }\n\n          const res = await fetch(url, options)\n\n          if(iteration.name === \"collectioncreator\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          expect(res.status).to.eql(200)\n          const resArrayBuffer = await res.arrayBuffer()\n          const resBuffer = Buffer.from(resArrayBuffer)\n          const zip = await JSZip.loadAsync(resBuffer)\n          const fileNames = Object.keys(zip.files)\n          expect(fileNames).to.have.lengthOf(2)\n          const data = await zip.files[\"U_Collection_X_lvl1_asset-1-VPN_SRG_TEST-V1R1-xccdf.xml\"].async(\"string\")\n          const assetData = reviewsFromScc({\n            data,                    \n            fieldSettings: config.fieldSettings,  \n            allowAccept: true,       \n            importOptions: config.importOptions, \n            sourceRef: \"U_Collection_X_lvl1_asset-1-VPN_SRG_TEST-V1R1-xccdf.xml\"\n          })\n          expect(assetData.target.name).to.equal(reference.testAsset.name)\n          expect(assetData.target.metadata.testkey).to.exist\n          expect(assetData.target.metadata.testkey).to.equal(\"testvalue\")\n          expect(assetData.checklists).to.have.lengthOf(1)\n          expect(assetData.checklists[0].benchmarkId).to.equal(reference.benchmark)\n      //    expect(assetData.checklists[0].revisionStr).to.equal(\"V1R1\")\n          expect(assetData.checklists[0].reviews).to.have.lengthOf(reference.testAsset.VPN_SRG_TEST_reviewCnt)\n        })\n\n        it(\"should download a xccdf and get the test asset with all benchmarks in a multi stig xccdf file \",async function () {\n\n          const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/archive/xccdf`\n\n          const requestBody = JSON.stringify(\n            requestBodies.postArchiveDefault,\n          )\n\n          const options = {\n            method: 'POST',\n            headers: {\n              'Authorization': `Bearer ${iteration.token}`,\n              'Content-Type': 'application/json',\n            },\n            body: requestBody,\n          }\n\n          const res = await fetch(url, options)\n\n          if(iteration.name === \"collectioncreator\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          expect(res.status).to.eql(200)\n          const resArrayBuffer = await res.arrayBuffer()\n          const resBuffer = Buffer.from(resArrayBuffer)\n          const zip = await JSZip.loadAsync(resBuffer)\n          const fileNames = Object.keys(zip.files)\n          if(iteration.name === \"lvl1\"){\n            expect(fileNames).to.have.lengthOf(2)\n          }\n          else {\n            expect(fileNames).to.have.lengthOf(3)\n          }\n          \n          const dataVPN = await zip.files[\"U_Collection_X_lvl1_asset-1-VPN_SRG_TEST-V1R1-xccdf.xml\"].async(\"string\")\n            \n          const assetDataVPN = reviewsFromScc({\n            data: dataVPN,                    \n            fieldSettings: config.fieldSettings,  \n            allowAccept: true,       \n            importOptions: config.importOptions, \n            sourceRef: \"U_Collection_X_lvl1_asset-1-VPN_SRG_TEST-V1R1-xccdf.xml\",\n            scapBenchmarkMap\n          })\n          expect(assetDataVPN.target.name).to.equal(reference.testAsset.name)\n          expect(assetDataVPN.target.metadata.testkey).to.exist\n          expect(assetDataVPN.target.metadata.testkey).to.equal(\"testvalue\")\n          expect(assetDataVPN.checklists).to.have.lengthOf(1)\n          for(const checklist of assetDataVPN.checklists){\n            //expect(checklist.revisionStr).to.equal(\"V1R1\")\n            expect(checklist.reviews).to.have.lengthOf(reference.testAsset.VPN_SRG_TEST_reviewCnt)\n          }\n\n          if(iteration.name === \"lvl1\"){\n            return\n          }\n          const dataWindows = await zip.files[\"U_Collection_X_lvl1_asset-1-Windows_10_STIG_TEST-V1R23-xccdf.xml\"].async(\"string\")\n          const assetDataWindows = reviewsFromScc({\n            data: dataWindows,\n            fieldSettings: config.fieldSettings,\n            allowAccept: true,\n            importOptions: config.importOptions,\n            sourceRef: \"U_Collection_X_lvl1_asset-1-Windows_10_STIG_TEST-V1R23-xccdf.xml\",\n            scapBenchmarkMap\n          })\n          expect(assetDataWindows.target.name).to.equal(reference.testAsset.name)\n          expect(assetDataWindows.target.metadata.testkey).to.exist\n          expect(assetDataWindows.target.metadata.testkey).to.equal(\"testvalue\")\n          expect(assetDataWindows.checklists).to.have.lengthOf(1)\n          for(const checklist of assetDataWindows.checklists){\n              expect(checklist.benchmarkId).to.equal(reference.windowsBenchmark)\n              //expect(checklist.revisionStr).to.equal(\"V1R23\")\n              expect(checklist.reviews).to.have.lengthOf(3)\n            }\n        })\n      })\n\n      describe(\"cloneCollection - /collections/{collectionId}/clone - test basic clone permissions (ie. must have owner grant + createCollection priv\", function () {\n\n        // this is flakey should be redesigned.\n        before(async function () {\n          await utils.setDefaultRevision(reference.testCollection.collectionId, reference.benchmark, reference.testCollection.pinRevision)\n        })\n\n        let clonedCollection = null\n\n        it(\"Clone test collection and check that cloned collection matches source \",async function () {\n\n          const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/clone?projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs&projection=labels&projection=users`\n\n          const requestBody = JSON.stringify({\n            name:\"Clone_\" + utils.getUUIDSubString() + \"_X\",\n            description: \"clone of test collection x\",\n            options: {\n              grants: true,\n              labels: true,\n              assets: true,\n              stigMappings: \"withReviews\",\n              pinRevisions: \"matchSource\",\n            },\n          })\n\n          const options = {\n            method: \"POST\",\n            headers: {\n                \"Authorization\": `Bearer ${iteration.token}`,\n                \"Content-Type\": \"application/json\",\n            },\n            body: requestBody,\n          }\n\n          const res = await fetch(url, options)\n          let clonedCollectionId = null\n          if(!(distinct.canCreateCollection && distinct.canModifyCollection)){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          const responseText = await res.text();\n          const response = responseText.split(\"\\n\");\n          expect(response).to.be.an('array')\n          for(const message of response){ \n              if(message.length > 0){\n                  let messageObj = JSON.parse(message)\n                  if(messageObj.stage == \"result\"){\n                      clonedCollectionId = messageObj.collection.collectionId\n                      clonedCollection = messageObj.collection.collectionId\n                      // assets \n                      expect(messageObj.collection.assets).to.have.lengthOf(reference.testCollection.assetsProjected.length)\n                      expect(message.grants).to.equal(message.users)\n\n                      for(const asset of messageObj.collection.assets){\n                        expect(asset.name).to.be.oneOf(reference.testCollection.assetsProjected.map(a => a.name))\n                      }\n                      // remove grantId from grants response and grantsProjected expected response ( this cannot be tested well q)\n                      let grantsProjectedResponse = []\n                      for (const grant of messageObj.collection.grants){\n                          let {grantId, ...grantCheckProps} = grant\n                          grantsProjectedResponse.push(grantCheckProps)\n                      }\n\n                      let expectedGrantsResponse = []\n                      for (let grant of reference.testCollection.grantsProjected){\n                          let {grantId, ...grantCheckProps} = grant\n                          expectedGrantsResponse.push(grantCheckProps)\n                      }\n                      expect(grantsProjectedResponse, \"check cloned collection grants\").to.eql(expectedGrantsResponse)\n\n                      // owners\n                      expect(messageObj.collection.owners).to.have.same.deep.members(reference.testCollection.ownersProjected)\n                      // statistics\n                      expect(messageObj.collection.statistics.assetCount).to.eql(reference.testCollection.statisticsProjected.assetCount);\n                      expect(messageObj.collection.statistics.checklistCount).to.eql(reference.testCollection.statisticsProjected.checklistCount);\n                      // // stigs \n                      expect(messageObj.collection.stigs).to.deep.equalInAnyOrder(reference.testCollection.stigsProjected)\n                      // labels\n                      expect(messageObj.collection.labels).to.have.lengthOf(reference.testCollection.labelsProjected.length)\n                      for(const label of messageObj.collection.labels){\n                          expect(label.name).to.be.oneOf(reference.testCollection.labelsProjected.map(l => l.name))\n                      }\n\n                      expect(messageObj.collection.settings.importOptions).to.deep.equalInAnyOrder(reference.testCollection.importOptions)\n\n                      // confirm that ACLs have been transfered. will check with the testGroup acl in new collection \n                      const testGroupGrantId = messageObj.collection.grants.find(g => g.userGroup?.userGroupId === reference.testCollection.testGroup.userGroupId).grantId\n\n                      const acl = await utils.executeRequest(`${config.baseUrl}/collections/${clonedCollection}/grants/${testGroupGrantId}/acl`, 'GET', iteration.token)\n                      expect(acl.status).to.eql(200)\n                      expect(acl.body.acl).to.have.lengthOf(3)\n                  }\n              }\n            }\n            \n            if(clonedCollectionId !== null){\n            // check reviews are there.\n            const clonedCollectionReviews = await utils.getReviews(clonedCollectionId)\n            const sourceCollectionReviews = await utils.getReviews(reference.testCollection.collectionId)\n            expect(clonedCollectionReviews).to.exist\n            expect(sourceCollectionReviews).to.exist\n            expect(clonedCollectionReviews).to.be.an('array').of.length(sourceCollectionReviews.length)\n            const reviewRegex = \"test\"\n            const assetRegex = \"asset\"\n\n            for(const review of clonedCollectionReviews){\n                expect(review.detail).to.match(new RegExp(reviewRegex))\n                expect(review.assetName).to.match(new RegExp(assetRegex))\n            }\n\n            // compare the cloned collection with the source collection should be the same\n            const clonedCollection = await utils.getCollection(clonedCollectionId)\n            const sourceCollection = await utils.getCollection(reference.testCollection.collectionId)\n            expect(sourceCollection).to.exist\n            expect(clonedCollection).to.exist \n\n            for(const asset of clonedCollection.assets){\n                expect(asset.name).to.be.oneOf(sourceCollection.assets.map(a => a.name))\n            }\n            expect(clonedCollection.assets).to.have.lengthOf(sourceCollection.assets.length)\n            expect(clonedCollection.grants).to.have.lengthOf(sourceCollection.grants.length)\n            expect(clonedCollection.labels).to.have.lengthOf(sourceCollection.labels.length)\n            expect(clonedCollection.owners).to.have.lengthOf(sourceCollection.owners.length)\n\n            const sourceMetricsResponse = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail`, 'GET', iteration.token)\n            expect(sourceMetricsResponse.status).to.eql(200)\n            const clonedMetricsResponse = await utils.executeRequest(`${config.baseUrl}/collections/${clonedCollectionId}/metrics/detail`, 'GET', iteration.token)\n            expect(clonedMetricsResponse.status).to.eql(200)\n            \n            // Normalize metrics responses by removing assetId, labelIds, and timestamp fields that are expected to differ\n            const normalizeMetrics = (metricsArray) => {\n              return metricsArray.map(item => {\n                const normalized = { ...item }\n                delete normalized.assetId\n                \n                // Remove labelId from labels array\n                if (normalized.labels && Array.isArray(normalized.labels)) {\n                  normalized.labels = normalized.labels.map(label => {\n                    const { labelId, ...labelWithoutId } = label\n                    return labelWithoutId\n                  })\n                }\n                \n                // Remove timestamp fields from metrics\n                if (normalized.metrics) {\n                  const { maxTs, minTs, maxTouchTs, ...metricsWithoutTs } = normalized.metrics\n                  normalized.metrics = metricsWithoutTs\n                }\n                \n                return normalized\n              })\n            }\n            \n            const normalizedSource = normalizeMetrics(sourceMetricsResponse.body)\n            const normalizedCloned = normalizeMetrics(clonedMetricsResponse.body)\n            expect(normalizedSource).to.deep.equalInAnyOrder(normalizedCloned)\n\n          }\n        })\n      })\n\n      describe(\"exportToCollection - /collections/{collectionId}/export-to/{dstCollectionId}\", function () {\n\n        before(async function () {\n          await utils.loadAppData()\n          await utils.uploadTestStig(\"U_VPN_SRG_V1R0_Manual-xccdf.xml\")\n        })\n        \n        it(\"export entire asset to another collection, should create asset in destination\",async function () {\n\n          const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/export-to/${reference.scrapCollection.collectionId}`\n\n          const requestBody = JSON.stringify([\n            {\n              assetId: reference.testAsset.assetId,\n            },\n          ])\n\n          const options = {\n            method: 'POST',\n            headers: {\n              'Authorization': `Bearer ${iteration.token}`,\n              'Content-Type': 'application/json',\n            },\n            body: requestBody,\n          }\n\n          const res = await fetch(url, options)\n            \n          if(distinct.canModifyCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          const responseText = await res.text()\n          const response = responseText.split(\"\\n\")\n          expect(response).to.be.an('array')\n          expect(response).to.have.lengthOf.at.least(1)\n\n          for(const message of response){ \n            if(message.length > 0){\n              let messageObj = JSON.parse(message)\n              if(messageObj.stage == \"result\"){\n                expect(messageObj.counts.assetsCreated).to.eql(1)\n                expect(messageObj.counts.stigsMapped).to.eql(reference.testAsset.validStigs.length)\n                expect(messageObj.counts.reviewsInserted).to.eql(reference.testAsset.reviewCnt)\n                expect(messageObj.counts.reviewsUpdated).to.eql(0)\n              }\n            }\n          }\n        })\n\n        it(\"export entire asset to another collection, asset already exists so we will be updating reviews\",async function () {\n\n          const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/export-to/${reference.scrapCollection.collectionId}`\n\n          const requestBody = JSON.stringify([\n            {\n              assetId: reference.testAsset.assetId,\n            },\n          ])\n\n          const options = {\n            method: 'POST',\n            headers: {\n              'Authorization': `Bearer ${iteration.token}`,\n              'Content-Type': 'application/json',\n            },\n            body: requestBody,\n          }\n\n          const res = await fetch(url, options)\n\n          if(distinct.canModifyCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n\n          expect(res.status).to.eql(200)\n          const responseText = await res.text()\n          const response = responseText.split(\"\\n\")\n          expect(response).to.be.an('array')\n          expect(response).to.have.lengthOf.at.least(1)\n          for(const message of response){ \n              if(message.length > 0){\n                  let messageObj = JSON.parse(message)\n                  if(messageObj.stage == \"result\"){\n                    expect(messageObj.counts.assetsCreated).to.eql(0)\n                    expect(messageObj.counts.stigsMapped).to.eql(0)\n                    expect(messageObj.counts.reviewsInserted).to.eql(0)\n                    expect(messageObj.counts.reviewsUpdated).to.eql(9)\n                  }\n              }\n          }\n        })\n      })\n\n      describe(\"createCollectionLabel - /collections/{collectionId}/labels\", function () {\n\n        let label = null\n\n        it(\"Create Label in a Collection\",async function () {\n\n          const request = {\n              \"name\": \"test-label-POST\",\n              \"description\": \"test label POSTED\",\n              \"color\": \"aa34cc\"\n            }\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/labels`, 'POST', iteration.token, request)\n\n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n            label = res.body\n            expect(res.status).to.eql(201)\n            expect(res.body.name).to.equal(request.name)\n            expect(res.body.description).to.equal(request.description)\n            expect(res.body.color).to.equal(request.color)\n            expect(res.body.uses).to.equal(0)\n        })\n        it(\"Clean up - delete label\",async function () {\n            if(label){\n              const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/labels/${label.labelId}`, 'DELETE', iteration.token)\n                expect(res.status).to.eql(204)\n            }\n        })\n      })\n\n      describe(\"createCollectionLabels - /collections/{collectionId}/labels/batch\", function () {\n\n        let labels = null\n\n        it(\"Create Label in a Collection\",async function () {\n\n          const request = [\n            {\n              \"color\": \"aa33cc\",\n              \"description\": \"label-POST-1\",\n              \"name\": \"label-POST-1\"\n            },\n            {\n              \"color\": \"aa34cc\",\n              \"description\": \"label-POST-2\",\n              \"name\": \"label-POST-2\"\n            },\n            {\n              \"color\": \"aa35cc\",\n              \"description\": \"label-POST-3\",\n              \"name\": \"label-POST-3\"\n            }\n          ]\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/labels/batch`, 'POST', iteration.token, request)\n\n          if(distinct.canModifyCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          labels = res.body\n          expect(res.status).to.eql(201)\n          expect(res.body).to.be.an('array').of.length(3)\n\n          for(const label of res.body){\n            expect(label.name).to.be.oneOf(request.map(l => l.name))\n            expect(label.description).to.be.oneOf(request.map(l => l.description))\n            expect(label.color).to.be.oneOf(request.map(l => l.color))\n            expect(label.uses).to.equal(0)\n          }\n  \n        })\n        it(\"Clean up - delete labels\",async function () {\n            if(labels){\n              for(const label of labels){\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/labels/${label.labelId}`, 'DELETE', iteration.token)\n                expect(res.status).to.eql(204)\n              }\n            }\n        })\n\n        it(\"should throw error, post must be array of length one.\", async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/labels/batch`, 'POST', iteration.token, [])\n          expect(res.status).to.eql(400)\n\n        })\n      })\n\n      describe(\"writeStigPropsByCollectionStig - /collections/{collectionId}/stigs/{benchmarkId}\", function () {\n        before(async function () {\n          await utils.loadAppData()\n          await utils.uploadTestStig(\"U_VPN_SRG_V1R0_Manual-xccdf.xml\")\n        })\n\n        it(\"Set revision v1r1 of test benchmark to assets\",async function () {\n\n          const post =\n          {\n            defaultRevisionStr: \"V1R1\",\n            assetIds: [\"62\", \"42\", \"154\"],\n          }\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}`, 'POST', iteration.token, post)\n\n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n\n            expect(res.status).to.eql(200)\n            expect(res.body.revisionStr).to.eql(requestBodies.writeStigPropsByCollectionStig.defaultRevisionStr)\n            expect(res.body.revisionPinned).to.eql(true)\n            expect(res.body.ruleCount).to.eql(reference.checklistLength)\n            expect(res.body.benchmarkId).to.eql(reference.testCollection.benchmark)\n            expect(res.body.assetCount).to.eql(requestBodies.writeStigPropsByCollectionStig.assetIds.length)\n        })\n\n        it(\"Set latest revision of the test benchmark to assets\",async function () {\n\n          const post = {\n            defaultRevisionStr: \"latest\",\n            assetIds: requestBodies.writeStigPropsByCollectionStig.assetIds,\n          }\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}`, 'POST', iteration.token, post)\n\n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n\n            expect(res.status).to.eql(200)\n            expect(res.body.revisionStr).to.equal(requestBodies.writeStigPropsByCollectionStig.defaultRevisionStr)\n            expect(res.body.revisionPinned).to.equal(false)\n            expect(res.body.ruleCount).to.eql(reference.checklistLength)\n            expect(res.body.benchmarkId).to.equal(reference.testCollection.benchmark)\n            expect(res.body.assetCount).to.eql(requestBodies.writeStigPropsByCollectionStig.assetIds.length)\n        })\n\n        it(\"map list of assets to test benchmark\",async function () {\n\n          const post = {\n            assetIds: requestBodies.writeStigPropsByCollectionStig.assetIds,\n          }\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}`, 'POST', iteration.token, post)\n\n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n\n            expect(res.status).to.eql(200)\n            expect(res.body.revisionStr).to.equal(requestBodies.writeStigPropsByCollectionStig.defaultRevisionStr)\n            expect(res.body.revisionPinned).to.equal(false)\n            expect(res.body.ruleCount).to.eql(reference.checklistLength)\n            expect(res.body.benchmarkId).to.equal(reference.testCollection.benchmark)\n            expect(res.body.assetCount).to.eql(requestBodies.writeStigPropsByCollectionStig.assetIds.length)\n        })\n\n        it(\"attempt to send invalid revision str, should cause error\",async function () {\n\n          const post = {\n          defaultRevisionStr: \"V1R5\"\n          }\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}`, 'POST', iteration.token, post)\n\n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n\n            expect(res.status).to.eql(422)\n        })\n\n        it(\"Set the default revision string of test benchmark (V1R0)\",async function () {\n\n          const post = {\n          defaultRevisionStr: reference.testCollection.pinRevision\n          }\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}`, 'POST', iteration.token, post)\n\n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n\n            expect(res.status).to.eql(200)\n            expect(res.body.revisionStr).to.equal(reference.testCollection.pinRevision)\n            expect(res.body.revisionPinned).to.equal(true)\n            expect(res.body.ruleCount).to.eql(reference.checklistLength)\n            expect(res.body.benchmarkId).to.equal(reference.testCollection.benchmark)\n            expect(res.body.assetCount).to.eql(requestBodies.writeStigPropsByCollectionStig.assetIds.length)\n        })\n\n        it(\"Set the Assets mapped to a STIG - clear assets\",async function () {\n\n          const post = {\n          assetIds: []\n          }\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}`, 'POST', iteration.token, post)\n\n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n\n            expect(res.status).to.eql(204)\n            expect(res.body).to.eql({})\n            \n        })\n      })\n\n      describe(\"postGrantsByCollection - /collections/{collectionId}/grants\", function () {\n\n        before(async function () {\n          await utils.loadAppData()\n        })\n\n        it(\"Add grants to a collection\",async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/grants?elevate=true`, 'POST', iteration.token, requestBodies.postGrantsByCollection)\n\n            if(iteration.name !== \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n\n            expect(res.status).to.eql(201)\n\n            expect(res.body).to.have.lengthOf(requestBodies.postGrantsByCollection.length)\n            for(const grant of res.body){\n              if(grant.user){\n                expect(grant.user.userId).to.eql(reference.lvl1User.userId)\n                expect(grant.user.username).to.eql(reference.lvl1User.username)\n                expect(grant.grantId).to.exist\n                expect(grant.roleId).to.equal(2)\n              }\n              if(grant.userGroup){\n                expect(grant.userGroup.userGroupId).to.eql(reference.testCollection.testGroup.userGroupId)\n                expect(grant.userGroup.name).to.eql(reference.testCollection.testGroup.name)\n                expect(grant.grantId).to.exist\n                expect(grant.roleId).to.equal(2)\n              }\n            }\n        })\n        it(\"attempt to create owner grant, elevates should only work for admin user\",async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/grants?elevate=true`, 'POST', iteration.token, requestBodies.postOwners)\n\n            if(iteration.name !== \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(201)\n        })\n        it(\"Post Owner grant to collection no elevate\",async function () {\n\n          const postGrantsByCollectionOwner = [\n            {\n              userId: \"43\",  \n              roleId: 4,\n            },\n          ]\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/grants`, 'POST', iteration.token, postGrantsByCollectionOwner)\n\n            if(iteration.name !== 'stigmanadmin' && iteration.name !== 'lvl4'){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(201)\n            expect(res.body[0].user.userId).to.eql(\"43\")\n            expect(res.body[0].roleId).to.equal(4)\n        })\n      })\n    })\n  }\n})\n\n\n"
  },
  {
    "path": "test/api/mocha/data/collection/collectionPut.test.js",
    "content": "import {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {requestBodies} from \"./requestBodies.js\"\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\n\ndescribe('PUT - Collection', function () {\n\n  before(async function () {\n      await utils.loadAppData()\n  })\n\n  for(const iteration of iterations){\n    if (expectations[iteration.name] === undefined){\n      it(`No expectations for this iteration scenario: ${iteration.name}`,async function () {})\n      continue\n    }\n\n    describe(`iteration:${iteration.name}`, function () {\n      const distinct = expectations[iteration.name]\n    \n      describe('replaceCollection - /collections/{collectionId}', function () {\n\n        after(async function () {\n          await utils.loadAppData()\n        })\n\n        it('Set all properties of a Collection',async function () {\n\n            const putRequest = requestBodies.replaceCollection\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}?projection=grants&projection=owners&projection=statistics&projection=stigs&projection=assets`, 'PUT', iteration.token, putRequest)\n\n              if(distinct.canModifyCollection === false){\n                  expect(res.status).to.eql(403)\n                  return\n              }\n              expect(res.status).to.eql(200)\n\n              expect(res.body.description).to.equal(\"test\")\n              expect(res.body.name).to.equal(\"SetAllProperties\")\n              expect(res.body.settings.fields.detail.enabled).to.equal(putRequest.settings.fields.detail.enabled)\n              expect(res.body.settings.fields.detail.required).to.equal(putRequest.settings.fields.detail.required)\n              expect(res.body.settings.fields.comment.enabled).to.equal(putRequest.settings.fields.comment.enabled)\n              expect(res.body.settings.fields.comment.required).to.equal(putRequest.settings.fields.comment.required)\n              expect(res.body.settings.status.canAccept).to.equal(putRequest.settings.status.canAccept)\n              expect(res.body.settings.status.minAcceptGrant).to.equal(putRequest.settings.status.minAcceptGrant)\n              expect(res.body.settings.status.resetCriteria).to.equal(putRequest.settings.status.resetCriteria)\n              expect(res.body.metadata.pocName).to.equal(putRequest.metadata.pocName)\n              expect(res.body.metadata.pocEmail).to.equal(putRequest.metadata.pocEmail)\n              expect(res.body.metadata.pocPhone).to.equal(putRequest.metadata.pocPhone)\n              expect(res.body.metadata.reqRar).to.equal(putRequest.metadata.reqRar)\n              \n            // grants projection\n            expect(res.body.grants).to.have.lengthOf(putRequest.grants.length)\n            for(let grant of res.body.grants) {\n              if(grant.userId){\n                  expect(grant.userId).to.be.oneOf(putRequest.grants.map(grant => grant.userId))\n              }\n              if(grant.userGroupId){\n                  expect(grant.userGroupId).to.be.oneOf(putRequest.grants.map(grant => grant.userGroupId))\n              }\n            }\n        \n            // assets projection\n            expect(res.body.assets).to.deep.equalInAnyOrder(reference.testCollection.assetsProjected)\n\n            // owners projection\n            expect(res.body.owners).to.have.lengthOf(reference.testCollection.owners.length)\n\n            // statistics projection\n            expect(res.body.statistics.assetCount).to.equal(reference.testCollection.assetIds.length)\n            expect(res.body.statistics.checklistCount).to.equal(reference.testCollection.statisticsProjected.checklistCount)\n        \n            // stigs projection\n            expect(res.body.stigs).to.have.lengthOf(reference.testCollection.validStigs.length)              \n        })\n\n        it(\"should throw SmError.UnprocessableError when replacing due to duplicate user in grant array.\",async function () {\n\n          const putRequest = JSON.parse(JSON.stringify(requestBodies.replaceCollection))\n          putRequest.grants.push(putRequest.grants[0])\n          putRequest.name = \"TEST\" + utils.getUUIDSubString()\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}`, 'PUT', iteration.token, putRequest)\n            if(distinct.canModifyCollection === false){\n                expect(res.status).to.eql(403)\n                return\n            }\n            expect(res.status).to.eql(422)\n            expect(res.body.error).to.equal(\"Unprocessable Entity.\")\n            expect(res.body.detail).to.equal(\"Duplicate user in grant array\")\n        })\n\n        it('Set all properties of a Collection- with metadata',async function () {\n\n          const putRequest = {\n            name: \"TestPutCollection\",\n            settings: {\n              fields: {\n                detail: {\n                  enabled: \"findings\",\n                  required: \"findings\",\n                },\n                comment: {\n                  enabled: \"always\",\n                  required: \"findings\",\n                },\n              },\n              status: {\n                canAccept: true,\n                minAcceptGrant: 2,\n                resetCriteria: \"result\",\n              },\n              history: {\n                maxReviews: 11,\n              },\n              importOptions: {\n                autoStatus: {\n                  fail: \"submitted\",\n                  notapplicable: \"submitted\",\n                  pass: \"submitted\",\n                },\n                unreviewed: \"commented\",\n                unreviewedCommented: \"informational\",\n                emptyDetail: \"replace\",\n                emptyComment: \"ignore\",\n                allowCustom: true,\n              },\n            },\n\n            description: \"hellodescription\",\n            metadata: {\n              [reference.testCollection.metadataKey]:\n                reference.testCollection.metadataValue,\n            },\n            grants: [\n              {\n                userId: \"1\",\n                roleId: 4,\n              },\n              {\n                userId: \"21\",\n                roleId: 2,\n              },\n              {\n                userId: \"44\",\n                roleId: 3,\n              },\n              {\n                userId: \"45\",\n                roleId: 4,\n              },\n              {\n                userId: \"87\",\n                roleId: 4,\n              },\n            ],\n          }\n\n      \n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}?projection=grants&projection=owners&projection=statistics&projection=stigs&projection=assets`, 'PUT', iteration.token, putRequest)\n            if(distinct.canModifyCollection === false){ \n              expect(res.status).to.eql(403)\n              return\n            } \n            expect(res.status).to.eql(200)\n            expect(res.body.description).to.equal(\"hellodescription\")\n            expect(res.body.name).to.equal(\"TestPutCollection\")\n            expect(res.body.settings.fields.detail.enabled).to.equal(putRequest.settings.fields.detail.enabled)\n            expect(res.body.settings.fields.detail.required).to.equal(putRequest.settings.fields.detail.required)\n            expect(res.body.settings.fields.comment.enabled).to.equal(putRequest.settings.fields.comment.enabled)\n            expect(res.body.settings.fields.comment.required).to.equal(putRequest.settings.fields.comment.required)\n            expect(res.body.settings.history.maxReviews).to.equal(putRequest.settings.history.maxReviews)\n            expect(res.body.settings.importOptions.autoStatus).to.eql(putRequest.settings.importOptions.autoStatus)\n            expect(res.body.settings.importOptions.unreviewed).to.equal(putRequest.settings.importOptions.unreviewed)\n            expect(res.body.settings.importOptions.unreviewedCommented).to.equal(putRequest.settings.importOptions.unreviewedCommented)\n            expect(res.body.settings.importOptions.emptyDetail).to.equal(putRequest.settings.importOptions.emptyDetail)\n            expect(res.body.settings.importOptions.emptyComment).to.equal(putRequest.settings.importOptions.emptyComment)\n            expect(res.body.settings.importOptions.allowCustom).to.equal(putRequest.settings.importOptions.allowCustom)\n            expect(res.body.settings.status.canAccept).to.equal(putRequest.settings.status.canAccept)\n            expect(res.body.settings.status.minAcceptGrant).to.equal(putRequest.settings.status.minAcceptGrant)\n            expect(res.body.settings.status.resetCriteria).to.equal(putRequest.settings.status.resetCriteria)\n            expect(res.body.metadata.testkey).to.equal(reference.testCollection.metadataValue)\n\n            // grants projection\n            expect(res.body.grants).to.have.lengthOf(5)\n            for(const grant of res.body.grants){\n              expect(grant.user.userId).to.be.oneOf(putRequest.grants.map(g => g.userId))\n            }\n        \n            // assets projection\n            expect(res.body.assets).to.have.lengthOf(4)\n\n            // owners projection\n            expect(res.body.owners).to.have.lengthOf(3)\n\n            // statistics projection\n            expect(res.body.statistics.assetCount).to.equal(4)\n            expect(res.body.statistics.checklistCount).to.equal(6)\n            //expect(res.body.statistics.grantCount).to.equal(5)\n\n            // stigs projection\n            expect(res.body.stigs).to.have.lengthOf(2)\n\n        })\n      })\n\n      describe('putCollectionMetadata - /collections/{collectionId}/metadata', function () {\n\n        it('Set all metadata of a Collection',async function () {\n\n            const putRequest = {\n                [reference.testCollection.metadataKey]: reference.testCollection.metadataValue\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metadata`, 'PUT', iteration.token, putRequest)\n\n              if(distinct.canModifyCollection === false){\n                expect(res.status).to.eql(403)\n                return\n              }\n              expect(res.status).to.eql(200)\n            expect(res.body[reference.testCollection.metadataKey]).to.equal(reference.testCollection.metadataValue)\n        })\n\n        it('should return 403 for deleted collection', async function () {\n          const putRequest = {\n            [reference.testCollection.metadataKey]: reference.testCollection.metadataValue\n          }\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metadata`, 'PUT', iteration.token, putRequest)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('putCollectionMetadataValue - /collections/{collectionId}/metadata/keys/{key}', function () {\n\n        it('Set one metadata key/value of a Collection',async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metadata/keys/${reference.testCollection.collectionMetadataKey}`, 'PUT', iteration.token, `${JSON.stringify(reference.testCollection.collectionMetadataValue)}`)\n\n          if(distinct.canModifyCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(204)\n        })\n\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metadata/keys/${reference.testCollection.collectionMetadataKey}`, 'PUT', iteration.token, `${JSON.stringify(reference.testCollection.collectionMetadataValue)}`)\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe(\"putGrantByCollectionGrant - /collections/{collectionId}/grants/{grantId}\", function () {\n        \n        before(async function () {\n          await utils.loadAppData()\n        })\n\n        it(\"should replace access level and keep the same user in the test group in the test colleciton, not elevated\", async function () {\n          \n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}`, 'PUT', iteration.token, {\n            \"userGroupId\": reference.testCollection.testGroup.userGroupId,\n            \"roleId\": 2\n          })\n          if(distinct.canModifyCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.userGroup.userGroupId).to.equal(reference.testCollection.testGroup.userGroupId)\n          expect(res.body.roleId).to.equal(2)\n          expect(res.body.grantId).to.equal(reference.testCollection.testGroup.testCollectionGrantId)\n        })\n\n        it(\"should replace access level and user of the test group grant id in the test colleciton,  elevated only stigmanadmin success\", async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}?elevate=true`, 'PUT', iteration.token, {\n            \"userId\": reference.wfTest.userId,\n            \"roleId\": 1\n          })\n          if(iteration.name !== \"stigmanadmin\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body.user.userId).to.equal(reference.wfTest.userId)\n          expect(res.body.grantId).to.equal(reference.testCollection.testGroup.testCollectionGrantId)\n        })\n\n        it(\"should throw error, the user does not have grant to the collection \", async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}`, 'PUT', iteration.token, {\n            \"userId\": reference.lvl1User.userId,\n            \"roleId\": 1\n          })\n          if(distinct.canModifyCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(404)\n        })\n\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}`, 'PUT', iteration.token, {\n            \"userGroupId\": reference.testCollection.testGroup.userGroupId,\n            \"roleId\": 2\n          })\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      it(\"should throw error, the user has < 4 access level and is attempting to modified an existing owners grant. \", async function () {\n\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.adminBurke.testCollectionGrantId}`, 'PUT', iterations[1].token, {\n          \"userId\": reference.adminBurke.userId,\n          \"roleId\": 2\n        })\n        if(distinct.roleId !== 4){\n          expect(res.status).to.eql(403)\n          return\n        }\n        expect(res.status).to.eql(403)\n      })\n\n      describe('putAclRulesByCollectionGrant - /collections/{collectionId}/grants/{grantId}/acl', function () {\n\n        before(async function () {\n          await utils.loadAppData()\n        })\n\n        it('Set all ACL rules of a Collection',async function () {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}/acl`, 'PUT', iteration.token, requestBodies.putGroupAcl)\n\n            if(distinct.canModifyCollection === false){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body.defaultAccess).to.equal(reference.testCollection.testGroup.defaultAccess)\n            expect(res.body.acl).to.be.lengthOf(2)\n            for(const item of res.body.acl){\n              if(item.assetId){\n                expect(item.assetId).to.be.equal(\"62\")\n                expect(item.access).to.be.equal(\"rw\") \n              }\n              else if(item.benchmarkId){\n                expect(item.benchmarkId).to.be.equal(\"VPN_SRG_TEST\")\n                expect(item.access).to.be.equal(\"rw\") \n              }\n            }\n        })\n\n        it(\"should throw 422 error, because groupId does not exist. \", async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${\"1234321\"}/acl`, 'PUT', iteration.token, requestBodies.putGroupAcl)\n          if(distinct.canModifyCollection === false){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(404)\n        })\n\n        it(\"Should throw 403 because collectionId does not exist\", async function () {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${1234321}/grants/${reference.testCollection.testGroup.testCollectionGrantId}/acl`, 'PUT', iteration.token, requestBodies.putGroupAcl)\n          expect(res.status).to.eql(403)\n        })\n\n        it('should return 403 for deleted collection', async function () {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}/acl`, 'PUT', iteration.token, requestBodies.putGroupAcl)\n          expect(res.status).to.eql(403)\n        })\n      })\n    })\n  }\n})\n"
  },
  {
    "path": "test/api/mocha/data/collection/expectations.js",
    "content": "//This data contains expected response data that varies by iteration \"scenario\" or \"iteration\" for each test case. These expectations are relative to the \"referenceData.js\" data used to construct the API requests. \r\nimport reference from '../../referenceData.js'\r\n\r\nexport const expectations = {\r\n  stigmanadmin: {\r\n    iteration: \"admin\",\r\n    acl: [],\r\n    aclByGrantId: [],\r\n    usersLength: 7,\r\n    defaultAccess: \"rw\",\r\n    roleId: 4,\r\n    userId: \"87\",\r\n    canElevate: true,\r\n    canCreateCollection: true,\r\n    canModifyOwnerGrants: true,\r\n    collectionCount: 6,\r\n    collectionIdsAccess: [\"21\", \"83\", \"1\", \"84\", \"85\", \"92\"],\r\n    collectionCountElevated: 7,\r\n    testAssetChecklists: 2,\r\n    collectionMatch: {\r\n      collectionExactMatchCnt: 1,\r\n      collectionContainsMatchCnt: 3,\r\n      collectionStartMatchCnt: 3,\r\n      collectionEndMatchCnt: 1,\r\n      collectionDeleteMatchCnt: 2,\r\n      collectionDeleteMatchCntElevated: 3,\r\n      collectionMetadataMatchCnt: 1,\r\n    },\r\n    //relative to testCollection\r\n    grant: \"lvl4\",\r\n    fullLabelUses: 2,\r\n    lvl1LabelUses: 1,\r\n    historyResponseStatus: 200,\r\n    checklistCnt: 6,\r\n    grantCnt: 7,\r\n    assetIds: [\"29\", \"62\", \"42\", \"154\"],\r\n    validStigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\"],\r\n    testBenchmarkAssignedCount: 3,\r\n    findings: {\r\n      findingsCnt: 8,\r\n      findingsByGroupCnt: 4,\r\n      findingsByRuleCnt: 3,\r\n      findingsByRuleForAssetCnt: 4,\r\n      findingsByRuleForBenchmarkCnt: 3,\r\n      findingsByCciCnt: 8,\r\n    },\r\n    canDeleteCollection: true,\r\n    canModifyCollection: true,\r\n    windowsStigAssetCount: 2,\r\n    vpnStigAssetCount: 2,\r\n  },\r\n  lvl1: {\r\n    iteration: \"lvl1\",\r\n    aclByGrantId:[\r\n      {\r\n        label: {\r\n          name: \"test-label-lvl1\",\r\n          color: \"99CCFF\",\r\n          labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\r\n        },\r\n        access: \"rw\",\r\n        benchmarkId: \"VPN_SRG_TEST\",\r\n      },\r\n      {\r\n        asset: {\r\n          name: \"Collection_X_asset\",\r\n          assetId: \"62\",\r\n        },\r\n        access: \"r\",\r\n      },\r\n      {\r\n        asset: {\r\n          name: \"Collection_X_lvl1_asset-2\",\r\n          assetId: \"154\",\r\n        },\r\n        access: \"r\",\r\n        benchmarkId: \"VPN_SRG_TEST\",\r\n      },\r\n    ],\r\n    acl: [\r\n      {\r\n        access: \"r\",\r\n        asset: {\r\n          name: \"Collection_X_asset\",\r\n          assetId: \"62\",\r\n        },\r\n        benchmarkId: \"VPN_SRG_TEST\",\r\n        aclSources: [\r\n          {\r\n            aclRule: {\r\n              asset: {\r\n                name: \"Collection_X_asset\",\r\n                assetId: \"62\",\r\n              },\r\n              access: \"r\",\r\n            },\r\n            grantee: {\r\n              name: \"TestGroup\",\r\n              roleId: 1,\r\n              userGroupId: \"1\",\r\n            },\r\n          },\r\n        ],\r\n      },\r\n      {\r\n        access: \"r\",\r\n        asset: {\r\n          name: \"Collection_X_asset\",\r\n          assetId: \"62\",\r\n        },\r\n        benchmarkId: \"Windows_10_STIG_TEST\",\r\n        aclSources: [\r\n          {\r\n            aclRule: {\r\n              asset: {\r\n                name: \"Collection_X_asset\",\r\n                assetId: \"62\",\r\n              },\r\n              access: \"r\",\r\n            },\r\n            grantee: {\r\n              name: \"TestGroup\",\r\n              roleId: 1,\r\n              userGroupId: \"1\",\r\n            },\r\n          },\r\n        ],\r\n      },\r\n      {\r\n        access: \"rw\",\r\n        asset: {\r\n          name: \"Collection_X_lvl1_asset-1\",\r\n          assetId: \"42\",\r\n        },\r\n        benchmarkId: \"VPN_SRG_TEST\",\r\n        aclSources: [\r\n          {\r\n            aclRule: {\r\n              label: {\r\n                name: \"test-label-lvl1\",\r\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\r\n              },\r\n              access: \"rw\",\r\n              benchmarkId: \"VPN_SRG_TEST\",\r\n            },\r\n            grantee: {\r\n              name: \"TestGroup\",\r\n              roleId: 1,\r\n              userGroupId: \"1\",\r\n            },\r\n          },\r\n        ],\r\n      },\r\n      {\r\n        access: \"r\",\r\n        asset: {\r\n          name: \"Collection_X_lvl1_asset-2\",\r\n          assetId: \"154\",\r\n        },\r\n        benchmarkId: \"VPN_SRG_TEST\",\r\n        aclSources: [\r\n          {\r\n            aclRule: {\r\n              asset: {\r\n                name: \"Collection_X_lvl1_asset-2\",\r\n                assetId: \"154\",\r\n              },\r\n              access: \"r\",\r\n              benchmarkId: \"VPN_SRG_TEST\",\r\n            },\r\n            grantee: {\r\n              name: \"TestGroup\",\r\n              roleId: 1,\r\n              userGroupId: \"1\",\r\n            },\r\n          },\r\n        ],\r\n      },\r\n    ],\r\n    usersLength: 3,\r\n    defaultAccess: \"none\",\r\n    userId: \"85\",\r\n    roleId: 1,\r\n    canElevate: false,\r\n    canCreateCollection: false,\r\n    canModifyOwnerGrants: false,\r\n    collectionCount: 1,\r\n    collectionIdsAccess: [\"21\"],\r\n    testAssetChecklists: 1,\r\n    collectionMatch: {\r\n      collectionExactMatchCnt: 1,\r\n      collectionContainsMatchCnt: 1,\r\n      collectionStartMatchCnt: 1,\r\n      collectionEndMatchCnt: 1,\r\n      collectionMetadataMatchCnt: 1,\r\n      collectionDeleteMatchCnt: 0,\r\n    },\r\n    //relative to testCollection\r\n    grant: \"restricted\",\r\n    fullLabelUses: 2,\r\n    lvl1LabelUses: 1,\r\n    historyResponseStatus: 403,\r\n    checklistCnt: 3,\r\n    grantCnt: 1,\r\n    assetIds: [\"42\", \"154\", \"62\"],\r\n    validStigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\"],\r\n    testBenchmarkAssignedCount: 3,\r\n    findings: {\r\n      findingsCnt: 7,\r\n      findingsByGroupCnt: 3,\r\n      findingsByRuleCnt: 3,\r\n      findingsByRuleForAssetCnt: 3,\r\n      findingsByRuleForBenchmarkCnt: 3,\r\n      findingsByCciCnt: 7,\r\n    },\r\n    canDeleteCollection: false,\r\n    canModifyCollection: false,\r\n    windowsStigAssetCount: 1,\r\n    vpnStigAssetCount: 2,\r\n  },\r\n  lvl2: {\r\n    iteration: \"lvl2\",\r\n    userId: \"87\",\r\n    acl: [],\r\n    aclByGrantId: [],\r\n    usersLength: 7,\r\n    defaultAccess: \"rw\",\r\n    roleId: 2,\r\n    canElevate: false,\r\n    canCreateCollection: false,\r\n    collectionCount: 2,\r\n    canModifyOwnerGrants: false,\r\n    collectionIdsAccess: [\"21\", \"1\"],\r\n    testAssetChecklists: 2,\r\n    collectionMatch: {\r\n      collectionExactMatchCnt: 1,\r\n      collectionContainsMatchCnt: 1,\r\n      collectionStartMatchCnt: 2,\r\n      collectionEndMatchCnt: 1,\r\n      collectionMetadataMatchCnt: 1,\r\n      collectionDeleteMatchCnt: 0,\r\n    },\r\n    //relative to testCollection\r\n    grant: \"full\",\r\n    fullLabelUses: 2,\r\n    lvl1LabelUses: 1,\r\n    historyResponseStatus: 200,\r\n    checklistCnt: 6,\r\n    grantCnt: 7,\r\n    assetIds: [\"29\", \"62\", \"42\", \"154\"],\r\n    validStigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\"],\r\n    testBenchmarkAssignedCount: 3,\r\n    findings: {\r\n      findingsCnt: 8,\r\n      findingsByGroupCnt: 4,\r\n      findingsByRuleCnt: 3,\r\n      findingsByRuleForAssetCnt: 4,\r\n      findingsByRuleForBenchmarkCnt: 3,\r\n      findingsByCciCnt: 8,\r\n    },\r\n    canDeleteCollection: false,\r\n    canModifyCollection: false,\r\n    windowsStigAssetCount: 2,\r\n    vpnStigAssetCount: 2,\r\n  },\r\n  lvl3: {\r\n    iteration: \"lvl3\",\r\n    acl: [],\r\n    aclByGrantId: [],\r\n    usersLength: 7,\r\n    defaultAccess: \"rw\",\r\n    userId: \"87\",\r\n    roleId: 3,\r\n    canElevate: false,\r\n    collectionCount: 2,\r\n    collectionIdsAccess: [\"21\", \"1\"],\r\n    canCreateCollection: false,\r\n    canModifyOwnerGrants: false,\r\n    testAssetChecklists: 2,\r\n    collectionMatch: {\r\n      collectionExactMatchCnt: 1,\r\n      collectionContainsMatchCnt: 1,\r\n      collectionStartMatchCnt: 2,\r\n      collectionEndMatchCnt: 1,\r\n      collectionMetadataMatchCnt: 1,\r\n      collectionDeleteMatchCnt: 0,\r\n    },\r\n    //relative to testCollection\r\n    grant: \"manage\",\r\n    fullLabelUses: 2,\r\n    lvl1LabelUses: 1,\r\n    historyResponseStatus: 200,\r\n    checklistCnt: 6,\r\n    grantCnt: 7,\r\n    assetIds: [\"29\", \"62\", \"42\", \"154\"],\r\n    validStigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\"],\r\n    testBenchmarkAssignedCount: 3,\r\n    findings: {\r\n      findingsCnt: 8,\r\n      findingsByGroupCnt: 4,\r\n      findingsByRuleCnt: 3,\r\n      findingsByRuleForAssetCnt: 4,\r\n      findingsByRuleForBenchmarkCnt: 3,\r\n      findingsByCciCnt: 8,\r\n    },\r\n    canDeleteCollection: false,\r\n    canModifyCollection: true,\r\n    windowsStigAssetCount: 2,\r\n    vpnStigAssetCount: 2,\r\n  },\r\n  lvl4: {\r\n    iteration: \"lvl4\",\r\n    acl: [],\r\n    aclByGrantId: [],\r\n    usersLength: 7,\r\n    defaultAccess: \"rw\",\r\n    userId: \"87\",\r\n    roleId: 4,\r\n    canCreateCollection: false,\r\n    canModifyOwnerGrants: true,\r\n    canElevate: false,\r\n    collectionCount: 3,\r\n    collectionIdsAccess: [\"21\", \"1\", \"85\"],\r\n    testAssetChecklists: 2,\r\n    collectionMatch: {\r\n      collectionExactMatchCnt: 1,\r\n      collectionContainsMatchCnt: 1,\r\n      collectionStartMatchCnt: 2,\r\n      collectionEndMatchCnt: 1,\r\n      collectionMetadataMatchCnt: 1,\r\n      collectionDeleteMatchCnt: 1,\r\n    },\r\n    //relative to testCollection\r\n    grant: \"owner\",\r\n    fullLabelUses: 2,\r\n    lvl1LabelUses: 1,\r\n    historyResponseStatus: 200,\r\n    checklistCnt: 6,\r\n    grantCnt: 7,\r\n    assetIds: [\"29\", \"62\", \"42\", \"154\"],\r\n    validStigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\"],\r\n    testBenchmarkAssignedCount: 3,\r\n    findings: {\r\n      findingsCnt: 8,\r\n      findingsByGroupCnt: 4,\r\n      findingsByRuleCnt: 3,\r\n      findingsByRuleForAssetCnt: 4,\r\n      findingsByRuleForBenchmarkCnt: 3,\r\n      findingsByCciCnt: 8,\r\n    },\r\n    canDeleteCollection: true,\r\n    canModifyCollection: true,\r\n    windowsStigAssetCount: 2,\r\n    vpnStigAssetCount: 2,\r\n  },\r\n  collectioncreator: {\r\n    iteration: \"collectioncreator\",\r\n    userId: \"82\",\r\n    roleId: -1,\r\n    canElevate: false,\r\n    canCreateCollection: true,\r\n    canModifyOwnerGrants: false,\r\n    collectionCount: 0,\r\n    collectionIdsAccess: [],\r\n    testAssetChecklists: 0,\r\n    collectionMatch: {\r\n      collectionExactMatchCnt: 0,\r\n      collectionContainsMatchCnt: 0,\r\n      collectionStartMatchCnt: 0,\r\n      collectionEndMatchCnt: 0,\r\n      collectionMetadataMatchCnt: 0,\r\n      collectionDeleteMatchCnt: 0,\r\n    },\r\n    //relative to testCollection\r\n    grant: \"none\",\r\n    fullLabelUses: 0,\r\n    lvl1LabelUses: 0,\r\n    historyResponseStatus: 403,\r\n    checklistCnt: 0,\r\n    grantCnt: 0,\r\n    assetIds: [],\r\n    validStigs: [],\r\n    testBenchmarkAssignedCount: 0,\r\n    findings: {\r\n      findingsCnt: 0,\r\n      findingsByGroupCnt: 0,\r\n      findingsByRuleCnt: 0,\r\n      findingsByRuleForAssetCnt: 0,\r\n      findingsByRuleForBenchmarkCnt: 0,\r\n      findingsByCciCnt: 0,\r\n    },\r\n    canDeleteCollection: false,\r\n    canModifyCollection: false,\r\n  },\r\n}\r\n"
  },
  {
    "path": "test/api/mocha/data/collection/requestBodies.js",
    "content": "//This data contains expected response data that varies by iteration \"scenario\" or \"iteration\" for each test case. These expectations are relative to the \"referenceData.js\" data used to construct the API requests.\r\n\r\nimport reference from '../../referenceData.js'\r\n\r\nexport const requestBodies = {\r\n  updateCollection: {\r\n    metadata: {\r\n      pocName: 'poc2Patched',\r\n      pocEmail: 'pocEmail@email.com',\r\n      pocPhone: '12342',\r\n      reqRar: 'true'\r\n    },\r\n    grants: [\r\n      {\r\n        userId: '1',\r\n        roleId: 4\r\n      },\r\n      {\r\n        userId: '21',\r\n        roleId: 1\r\n      },\r\n      {\r\n        userId: '44',\r\n        roleId: 3\r\n      },\r\n      {\r\n        userId: '45',\r\n        roleId: 4\r\n      },\r\n      {\r\n        userGroupId: '1',\r\n        roleId: 1\r\n      },\r\n      {\r\n        userId: '87',\r\n        roleId: 4\r\n      }\r\n    ]\r\n  },\r\n  patchCollectionLabelById: {\r\n    name: 'test-label-full',\r\n    description: 'test label patched',\r\n    color: 'aa34cc'\r\n  },\r\n  replaceCollection: {\r\n    name: 'SetAllProperties',\r\n    description: 'test',\r\n    settings: {\r\n      fields: {\r\n        detail: {\r\n          enabled: 'always',\r\n          required: 'findings'\r\n        },\r\n        comment: {\r\n          enabled: 'always',\r\n          required: 'findings'\r\n        }\r\n      },\r\n      status: {\r\n        canAccept: true,\r\n        minAcceptGrant: 2,\r\n        resetCriteria: 'result'\r\n      },\r\n      history: {\r\n        maxReviews: 11,\r\n      },\r\n      importOptions: {\r\n        autoStatus: {\r\n          fail: \"submitted\",\r\n          notapplicable: \"submitted\",\r\n          pass: \"submitted\",\r\n        },\r\n        unreviewed: \"commented\",\r\n        unreviewedCommented: \"informational\",\r\n        emptyDetail: \"replace\",\r\n        emptyComment: \"ignore\",\r\n        allowCustom: true,\r\n      },\r\n    },\r\n    metadata: {\r\n      pocName: 'poc2Patched',\r\n      pocEmail: 'pocEmail@email.com',\r\n      pocPhone: '12342',\r\n      reqRar: 'true'\r\n    },\r\n    labels: [\r\n      {\r\n        name: 'TEST',\r\n        description: 'Collection label description',\r\n        color: 'ffffff'\r\n      }\r\n    ],\r\n    grants: [\r\n      {\r\n        userId: '1',\r\n        roleId: 4\r\n      },\r\n      {\r\n        userId: '21',\r\n        roleId: 2\r\n      },\r\n      {\r\n        userId: '44',\r\n        roleId: 3\r\n      },\r\n      {\r\n        userId: '45',\r\n        roleId: 4\r\n      },\r\n      {\r\n        userId: '87',\r\n        roleId: 4\r\n      },\r\n      {\r\n        userGroupId: '1',\r\n        roleId: 1\r\n      }\r\n    ]\r\n  },\r\n  collectionWithNoSettings: {\r\n    name: 'noSettings',\r\n    description: 'Collection TEST description',\r\n    metadata: {},\r\n    grants: [\r\n      {\r\n        userId: '1',\r\n        roleId: 4\r\n      }\r\n    ],\r\n    labels: []\r\n  },\r\n  createCollection: {\r\n    name: 'TEST',\r\n    description: 'Collection TEST description',\r\n    settings: {\r\n      fields: {\r\n        detail: {\r\n          enabled: 'always',\r\n          required: 'findings'\r\n        },\r\n        comment: {\r\n          enabled: 'always',\r\n          required: 'findings'\r\n        }\r\n      },\r\n      status: {\r\n        canAccept: true,\r\n        minAcceptGrant: 2,\r\n        resetCriteria: 'result'\r\n      },\r\n      history: {\r\n        maxReviews: 11\r\n      },\r\n      importOptions: {\r\n        autoStatus: {\r\n          fail: \"saved\",\r\n          notapplicable: \"saved\",\r\n          pass: \"saved\",\r\n        },\r\n        unreviewed: 'commented',\r\n        unreviewedCommented: 'informational',\r\n        emptyDetail: 'replace',\r\n        emptyComment: 'ignore',\r\n        allowCustom: true\r\n      },\r\n    },\r\n    metadata: {\r\n      pocName: 'poc2Put',\r\n      pocEmail: 'pocEmailPut@email.com',\r\n      pocPhone: '12342',\r\n      reqRar: 'true'\r\n    },\r\n    grants: [\r\n      {\r\n        userId: '1',\r\n        roleId: 4\r\n      }\r\n    ],\r\n    labels: [\r\n      {\r\n        name: 'TEST',\r\n        description: 'Collection label description',\r\n        color: 'ffffff'\r\n      }\r\n    ]\r\n  },\r\n  createCollectionWithTestGroup: {\r\n    name: 'TEST',\r\n    description: 'Collection TEST description',\r\n    settings: {\r\n      fields: {\r\n        detail: {\r\n          enabled: 'always',\r\n          required: 'findings'\r\n        },\r\n        comment: {\r\n          enabled: 'always',\r\n          required: 'findings'\r\n        }\r\n      },\r\n      status: {\r\n        canAccept: true,\r\n        minAcceptGrant: 2,\r\n        resetCriteria: 'result'\r\n      },\r\n      history: {\r\n        maxReviews: 11\r\n      },\r\n      importOptions: {\r\n        autoStatus: {\r\n          fail: \"submitted\",\r\n          notapplicable: \"submitted\",\r\n          pass: \"submitted\",\r\n        },\r\n        unreviewed: \"commented\",\r\n        unreviewedCommented: \"informational\",\r\n        emptyDetail: \"replace\",\r\n        emptyComment: \"ignore\",\r\n        allowCustom: true\r\n      }\r\n    },\r\n    metadata: {\r\n      pocName: 'poc2Put',\r\n      pocEmail: 'pocEmailPut@email.com',\r\n      pocPhone: '12342',\r\n      reqRar: 'true'\r\n    },\r\n    grants: [\r\n      {\r\n        userGroupId: '1',\r\n        roleId: 2\r\n      }\r\n    ],\r\n    labels: [\r\n      {\r\n        name: 'TEST',\r\n        description: 'Collection label description',\r\n        color: 'ffffff'\r\n      }\r\n    ]\r\n  },\r\n  writeStigPropsByCollectionStig: {\r\n    defaultRevisionStr: 'V1R1',\r\n    assetIds: ['62', '42', '154']\r\n  },\r\n  resetTestCollection: {\r\n    name: 'Collection X',\r\n    description: null,\r\n    settings: {\r\n      fields: {\r\n        detail: {\r\n          enabled: 'always',\r\n          required: 'always'\r\n        },\r\n        comment: {\r\n          enabled: 'always',\r\n          required: 'findings'\r\n        }\r\n      },\r\n      status: {\r\n        canAccept: true,\r\n        minAcceptGrant: 3,\r\n        resetCriteria: 'result'\r\n      },\r\n      history: {\r\n        maxReviews: 5\r\n      },\r\n      importOptions: {\r\n        autoStatus: {\r\n          fail: \"submitted\",\r\n          notapplicable: \"submitted\",\r\n          pass: \"submitted\",\r\n        },\r\n        unreviewed: \"commented\",\r\n        unreviewedCommented: \"informational\",\r\n        emptyDetail: \"replace\",\r\n        emptyComment: \"ignore\",\r\n        allowCustom: true\r\n      }\r\n    },\r\n    metadata: {\r\n      pocName: 'true',\r\n      pocEmail: 'pocEmailPut@email.com',\r\n      pocPhone: '12342',\r\n      reqRar: 'true'\r\n    },\r\n    grants: [\r\n      {\r\n        userId: '1',\r\n        roleId: 4\r\n      },\r\n      {\r\n        userId: '45',\r\n        roleId: 4\r\n      },\r\n      {\r\n        userId: '87',\r\n        roleId: 4\r\n      },\r\n      {\r\n        userId: '44',\r\n        roleId: 3\r\n      },\r\n      {\r\n        userId: '21',\r\n        roleId: 2\r\n      },\r\n      {\r\n        userGroupId: '1',\r\n        roleId: 1\r\n      },\r\n      {\r\n        userId: '86',\r\n        roleId: 1\r\n      }\r\n    ],\r\n    labels: [\r\n      {\r\n        name: 'test-label-full',\r\n        description: '',\r\n        color: 'FF99CC'\r\n      },\r\n      {\r\n        name: 'test-label-lvl1',\r\n        description: '',\r\n        color: '99CCFF'\r\n      }\r\n    ]\r\n  },\r\n  recreateCollectionLabel: {\r\n    name: 'testLabel',\r\n    description: 'test label',\r\n    color: 'FF99CC'\r\n  },\r\n  postGrantsByCollection: [\r\n    {\r\n      userId: reference.lvl1User.userId,\r\n      roleId: 2\r\n    },\r\n    {\r\n      userGroupId: reference.testCollection.testGroup.userGroupId,\r\n      roleId: 2\r\n    }\r\n  ],\r\n  postOwners: [\r\n    {\r\n      userId: reference.wfTest.userId,\r\n      roleId: 4\r\n    }\r\n  ],\r\n  putGroupAcl: [\r\n    {\r\n      assetId: '62',\r\n      access: 'rw'\r\n    },\r\n    {\r\n      benchmarkId: 'VPN_SRG_TEST',\r\n      access: 'rw'\r\n    }\r\n  ],\r\n  postArchiveBenchmarkRevision: [\r\n    {\r\n      assetId: reference.testAsset.assetId,\r\n      stigs: [\r\n        {\r\n          benchmarkId: reference.benchmark,\r\n          revisionStr: reference.revisionStr\r\n        },\r\n      ]\r\n    }\r\n  ],\r\n  postArchiveBenchmarkRevisionLvl1NoAccess: [\r\n    {\r\n      assetId: reference.testAssetLvl1NoAccess,\r\n      stigs: [\r\n        {\r\n          benchmarkId: reference.benchmark,\r\n          revisionStr: reference.revisionStr\r\n        },\r\n      ]\r\n    }\r\n  ],\r\n  postArchiveBenchmark: [\r\n    {\r\n      assetId: reference.testAsset.assetId,\r\n      stigs: [\r\n      reference.benchmark,\r\n      ]\r\n    }\r\n  ],\r\n  postArchiveDefault: [\r\n    {\r\n      assetId: reference.testAsset.assetId,\r\n    }\r\n  ]\r\n}\r\n"
  },
  {
    "path": "test/api/mocha/data/metrics/expectations.js",
    "content": "//This data contains expected response data that varies by iteration \"scenario\" or \"iteration\" for each test case. These expectations are relative to the \"referenceData.js\" data used to construct the API requests.\n\nexport const expectations = {\n  stigmanadmin: {},\n  lvl1: {},\n  lvl2: {},\n  lvl3: {},\n  lvl4: {},\n  collectioncreator: {}\n}\n"
  },
  {
    "path": "test/api/mocha/data/metrics/metaMetricsGet.json",
    "content": "{\n  \"meta metrics detail - no agg - no params\": {\n    \"stigmanadmin\": {\n      \"collections\": 2,\n      \"assets\": 4,\n      \"stigs\": 2,\n      \"checklists\": 6,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 898,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 64,\n          \"high\": 96,\n          \"medium\": 738\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collections\": 1,\n      \"assets\": 1,\n      \"stigs\": 1,\n      \"checklists\": 1,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 1,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 6,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 2\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 1,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 81,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 7,\n          \"high\": 11,\n          \"medium\": 63\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"collectioncreator\": {\n      \"collections\": 0,\n      \"assets\": 0,\n      \"stigs\": 0,\n      \"checklists\": 0,\n      \"metrics\": {\n        \"maxTs\": null,\n        \"minTs\": null,\n        \"results\": {\n          \"fail\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 0,\n        \"findings\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": null,\n        \"assessments\": 0,\n        \"assessedBySeverity\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        }\n      }\n    }\n  },\n  \"meta metrics detail - no agg - coll param\": {\n    \"stigmanadmin\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collections\": 1,\n      \"assets\": 1,\n      \"stigs\": 1,\n      \"checklists\": 1,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 1,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 6,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 2\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 1,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 81,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 7,\n          \"high\": 11,\n          \"medium\": 63\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"collectioncreator\": {\n      \"collections\": 0,\n      \"assets\": 0,\n      \"stigs\": 0,\n      \"checklists\": 0,\n      \"metrics\": {\n        \"maxTs\": null,\n        \"minTs\": null,\n        \"results\": {\n          \"fail\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 0,\n        \"findings\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": null,\n        \"assessments\": 0,\n        \"assessedBySeverity\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        }\n      }\n    }\n  },\n  \"meta metrics detail - no agg - bench param\": {\n    \"stigmanadmin\": {\n      \"collections\": 2,\n      \"assets\": 4,\n      \"stigs\": 1,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 324,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 28,\n          \"high\": 44,\n          \"medium\": 252\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collections\": 1,\n      \"assets\": 1,\n      \"stigs\": 1,\n      \"checklists\": 1,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 1,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 6,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 2\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 1,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 81,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 7,\n          \"high\": 11,\n          \"medium\": 63\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 1,\n      \"checklists\": 2,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 162,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 14,\n          \"high\": 22,\n          \"medium\": 126\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 1,\n      \"checklists\": 2,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 162,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 14,\n          \"high\": 22,\n          \"medium\": 126\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 1,\n      \"checklists\": 2,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 162,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 14,\n          \"high\": 22,\n          \"medium\": 126\n        }\n      }\n    },\n    \"collectioncreator\": {\n      \"collections\": 0,\n      \"assets\": 0,\n      \"stigs\": 0,\n      \"checklists\": 0,\n      \"metrics\": {\n        \"maxTs\": null,\n        \"minTs\": null,\n        \"results\": {\n          \"fail\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 0,\n        \"findings\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": null,\n        \"assessments\": 0,\n        \"assessedBySeverity\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        }\n      }\n    }\n  },\n  \"meta metrics detail - agg by collection - no params\": {\n    \"stigmanadmin\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"collectionId\": \"83\",\n        \"name\": \"Collection Y\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 1,\n        \"stigs\": 1,\n        \"checklists\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  },\n  \"meta metrics detail - collection agg - coll param\": {\n    \"stigmanadmin\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 1,\n        \"stigs\": 1,\n        \"checklists\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  },\n  \"meta metrics detail - collection agg - bench param\": {\n    \"stigmanadmin\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"collectionId\": \"83\",\n        \"name\": \"Collection Y\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 1,\n        \"stigs\": 1,\n        \"checklists\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  },\n  \"meta metrics detail - collection agg - rev param\": {\n    \"stigmanadmin\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 1,\n        \"stigs\": 1,\n        \"checklists\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  },\n  \"meta metrics detail - stig agg - no params\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": \"U\",\n        \"revisionStr\": \"V1R0\",\n        \"revisionDate\": \"2010-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  },\n  \"meta metrics detail - stig agg - coll param\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  },\n  \"meta metrics detail - stig agg - bench param\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": \"U\",\n        \"revisionStr\": \"V1R0\",\n        \"revisionDate\": \"2010-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  },\n  \"meta metrics summary- no agg - no params\": {\n    \"stigmanadmin\": {\n      \"collections\": 2,\n      \"assets\": 4,\n      \"stigs\": 2,\n      \"checklists\": 6,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 898,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 64,\n          \"high\": 96,\n          \"medium\": 738\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collections\": 1,\n      \"assets\": 1,\n      \"stigs\": 1,\n      \"checklists\": 1,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 3,\n          \"pass\": 2,\n          \"other\": 0,\n          \"notapplicable\": 1\n        },\n        \"assessed\": 6,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 2\n        },\n        \"statuses\": {\n          \"saved\": 1,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 5\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 81,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 7,\n          \"high\": 11,\n          \"medium\": 63\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"collectioncreator\": {\n      \"collections\": 0,\n      \"assets\": 0,\n      \"stigs\": 0,\n      \"checklists\": 0,\n      \"metrics\": {\n        \"maxTs\": null,\n        \"minTs\": null,\n        \"results\": {\n          \"fail\": 0,\n          \"pass\": 0,\n          \"other\": 0,\n          \"notapplicable\": 0\n        },\n        \"assessed\": 0,\n        \"findings\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        },\n        \"statuses\": {\n          \"saved\": 0,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 0\n        },\n        \"maxTouchTs\": null,\n        \"assessments\": 0,\n        \"assessedBySeverity\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        }\n      }\n    }\n  },\n  \"meta metrics summary - no agg - collectionId param\": {\n    \"stigmanadmin\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collections\": 1,\n      \"assets\": 1,\n      \"stigs\": 1,\n      \"checklists\": 1,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 3,\n          \"pass\": 2,\n          \"other\": 0,\n          \"notapplicable\": 1\n        },\n        \"assessed\": 6,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 2\n        },\n        \"statuses\": {\n          \"saved\": 1,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 5\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 81,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 7,\n          \"high\": 11,\n          \"medium\": 63\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"collectioncreator\": {\n      \"collections\": 0,\n      \"assets\": 0,\n      \"stigs\": 0,\n      \"checklists\": 0,\n      \"metrics\": {\n        \"maxTs\": null,\n        \"minTs\": null,\n        \"results\": {\n          \"fail\": 0,\n          \"pass\": 0,\n          \"other\": 0,\n          \"notapplicable\": 0\n        },\n        \"assessed\": 0,\n        \"findings\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        },\n        \"statuses\": {\n          \"saved\": 0,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 0\n        },\n        \"maxTouchTs\": null,\n        \"assessments\": 0,\n        \"assessedBySeverity\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        }\n      }\n    }\n  },\n  \"meta metrics summary - no agg - benchmark param\": {\n    \"stigmanadmin\": {\n      \"collections\": 2,\n      \"assets\": 4,\n      \"stigs\": 1,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 4,\n          \"pass\": 2,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": 2,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 7\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 324,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 28,\n          \"high\": 44,\n          \"medium\": 252\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collections\": 1,\n      \"assets\": 1,\n      \"stigs\": 1,\n      \"checklists\": 1,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 3,\n          \"pass\": 2,\n          \"other\": 0,\n          \"notapplicable\": 1\n        },\n        \"assessed\": 6,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 2\n        },\n        \"statuses\": {\n          \"saved\": 1,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 5\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 81,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 7,\n          \"high\": 11,\n          \"medium\": 63\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 1,\n      \"checklists\": 2,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 4,\n          \"pass\": 2,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": 2,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 7\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 162,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 14,\n          \"high\": 22,\n          \"medium\": 126\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 1,\n      \"checklists\": 2,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 4,\n          \"pass\": 2,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": 2,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 7\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 162,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 14,\n          \"high\": 22,\n          \"medium\": 126\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collections\": 1,\n      \"assets\": 2,\n      \"stigs\": 1,\n      \"checklists\": 2,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 4,\n          \"pass\": 2,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": 2,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 7\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 162,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 14,\n          \"high\": 22,\n          \"medium\": 126\n        }\n      }\n    },\n    \"collectioncreator\": {\n      \"collections\": 0,\n      \"assets\": 0,\n      \"stigs\": 0,\n      \"checklists\": 0,\n      \"metrics\": {\n        \"maxTs\": null,\n        \"minTs\": null,\n        \"results\": {\n          \"fail\": 0,\n          \"pass\": 0,\n          \"other\": 0,\n          \"notapplicable\": 0\n        },\n        \"assessed\": 0,\n        \"findings\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        },\n        \"statuses\": {\n          \"saved\": 0,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 0\n        },\n        \"maxTouchTs\": null,\n        \"assessments\": 0,\n        \"assessedBySeverity\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 0,\n          \"high\": 0,\n          \"medium\": 0\n        }\n      }\n    }\n  },\n  \"Return meta metrics summary - collection agg - no params Copy\": {\n    \"stigmanadmin\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"collectionId\": \"83\",\n        \"name\": \"Collection Y\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 1,\n        \"stigs\": 1,\n        \"checklists\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  },\n  \"Return meta metrics summary - collection agg - collection param\": {\n    \"stigmanadmin\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 1,\n        \"stigs\": 1,\n        \"checklists\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 3,\n        \"stigs\": 2,\n        \"checklists\": 4,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  },\n  \"Return meta metrics summary - collection agg - benchmark param\": {\n    \"stigmanadmin\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"collectionId\": \"83\",\n        \"name\": \"Collection Y\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 1,\n        \"stigs\": 1,\n        \"checklists\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  },\n  \"Return meta metrics summary - collection agg - rev param\": {\n    \"stigmanadmin\": [\n      {\n        \"collectionId\": \"83\",\n        \"name\": \"Collection Y\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl1\": [],\n    \"lvl2\": [],\n    \"lvl3\": [],\n    \"lvl4\": [],\n    \"collectioncreator\": []\n  },\n  \"Return meta metrics summary - collection agg - rev param Copy\": {\n    \"stigmanadmin\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 1,\n        \"stigs\": 1,\n        \"checklists\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"collectionId\": \"21\",\n        \"name\": \"Collection X\",\n        \"assets\": 2,\n        \"stigs\": 1,\n        \"checklists\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  },\n  \"Return meta metrics summary - stig agg - no params\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": \"U\",\n        \"revisionStr\": \"V1R0\",\n        \"revisionDate\": \"2010-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  },\n  \"Return meta metrics summary - stig agg - collection param\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionDate\": \"2020-06-17\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  },\n  \"Return meta metrics summary - stig agg - benchmark param\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": \"U\",\n        \"revisionStr\": \"V1R0\",\n        \"revisionDate\": \"2010-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  },\n  \"Return meta metrics summary - stig agg - benchmark param and collection param\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionDate\": \"2019-07-19\",\n        \"collections\": 1,\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      }\n    ],\n    \"collectioncreator\": []\n  }\n}"
  },
  {
    "path": "test/api/mocha/data/metrics/metaMetricsGet.test.js",
    "content": "import {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {iterations} from '../../iterations.js'\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\nimport { dirname } from 'path'\nimport { fileURLToPath } from 'url'\n\n// import metaMetrics reference file, and set update file path\nimport metaMetrics from './metaMetricsGet.json' with { type: 'json' }\nconst metaMetricsUpdateFile = `${dirname(fileURLToPath(import.meta.url))}/metaMetricsGet.json`\n\n \ndescribe('GET - MetaMetrics', function () { \n  before(async function () {\n    const response = await utils.loadAppData(\"appdata-meta-metrics-with-pin.jsonl\")\n    try{\n        await utils.uploadTestStig(\"U_VPN_SRG_V1R0_Manual-xccdf.xml\")\n    }\n    catch(err){\n        console.log(\"no stig to upload\")\n    }\n  })\n\n  for(let iteration of iterations) {\n   \n    describe(`iteration:${iteration.name}`, function () {\n        \n        describe('GET - getMetricsDetailByMeta - /collections/meta/metrics/detail', function () {\n\n            it('meta metrics detail - no agg - no params', async function () {\n               \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/detail`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                console.log(this.test.title)\n                expect(res.status).to.eql(200)\n\n                if(iteration.name === \"lvl1\"){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[\"lvl1\"])\n                }\n                else if(iteration.name === \"stigmanadmin\")\n                {\n                   const data = expectedData[\"stigmanadmin\"]\n                   expect(res.body).to.deep.equalInAnyOrder(expectedData[\"stigmanadmin\"])\n                    //expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[\"collectioncreator\"])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                    // const data = expectedData[\"stigmanadmin\"]\n                    // expect(res.body).to.deep.equalInAnyOrder(expectedData[\"stigmanadmin\"])\n                }\n                \n            })\n            it('meta metrics detail - no agg - coll param', async function () {\n           \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/detail?collectionId=${reference.testCollection.collectionId}`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['collectioncreator'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n        \n            })\n            it('meta metrics detail - no agg - bench param', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/detail?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['collectioncreator'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n        })\n\n        describe('GET - getMetricsDetailByMetaAggCollection - /collections/meta/metrics/detail/collection', function () {\n\n            it('meta metrics detail - agg by collection - no params', async function () { \n               \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/detail/collection`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n            it('meta metrics detail - collection agg - coll param', async function () { \n               \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/detail/collection?collectionId=${reference.testCollection.collectionId}`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n            it('meta metrics detail - collection agg - bench param', async function () { \n                \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/detail/collection?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n            it('meta metrics detail - collection agg - rev param', async function () { \n       \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/detail/collection?revisionId=${'VPN_SRG_TEST-1-1'}`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n        })\n\n        describe('GET - getMetricsDetailByMetaAggStig - /collections/meta/metrics/detail/stig', function () {\n\n            it('meta metrics detail - stig agg - no params', async function () {\n              \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/detail/stig`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n            it('meta metrics detail - stig agg - coll param', async function () {\n               \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/detail/stig?collectionId=${reference.testCollection.collectionId}`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n            it('meta metrics detail - stig agg - bench param', async function () {\n              \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/detail/stig?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n        })\n\n        describe('GET - getMetricsSummaryByMeta - /collections/meta/metrics/summary', function () {\n\n            it('meta metrics summary- no agg - no params', async function () {\n              \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/summary`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['collectioncreator'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n            it('meta metrics summary - no agg - collectionId param', async function () {\n              \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/summary?collectionId=${reference.testCollection.collectionId}`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['collectioncreator'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n            it('meta metrics summary - no agg - benchmark param', async function () {\n            \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/summary?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['collectioncreator'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n        })\n\n        describe('GET - getMetricsSummaryByMetaAggCollection - /collections/meta/metrics/summary/collection', function () {\n            \n            it('Return meta metrics summary - collection agg - no params Copy', async function () {\n                  \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/summary/collection`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n            it('Return meta metrics summary - collection agg - collection param', async function () {\n                \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/summary/collection?collectionId=${reference.testCollection.collectionId}`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n            it('Return meta metrics summary - collection agg - benchmark param', async function () {\n              \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/summary/collection?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n            it('Return meta metrics summary - collection agg - rev param', async function () {\n              \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/summary/collection?revisionId=${'VPN_SRG_TEST'}-1-0`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n            it('Return meta metrics summary - collection agg - rev param Copy', async function () {\n              \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/summary/collection?revisionId=${'VPN_SRG_TEST'}-1-1`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n        })\n\n        describe('GET - getMetricsSummaryByMetaAggStig - /collections/meta/metrics/summary/stig', function () {\n\n            it('Return meta metrics summary - stig agg - no params', async function () {  \n               \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/summary/stig`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body). to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n            it('Return meta metrics summary - stig agg - collection param', async function () {  \n              \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/summary/stig?collectionId=${reference.testCollection.collectionId}`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n            it('Return meta metrics summary - stig agg - benchmark param', async function () {  \n              \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/summary/stig?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n            it('Return meta metrics summary - stig agg - benchmark param and collection param', async function () {  \n               \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/meta/metrics/summary/stig?benchmarkId=${reference.benchmark}&collectionId=${reference.testCollection.collectionId}`, 'GET', iteration.token)\n                \n                // Generates meta metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metaMetricsUpdateFile)\n                \n                const expectedData = metaMetrics[this.test.title]\n                expect(res.status).to.eql(200)\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else if(iteration.name === 'stigmanadmin')\n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                else if(iteration.name === \"collectioncreator\"){\n                    expect(res.body).to.eql([])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData[iteration.name])\n                }\n            })\n        })\n    })\n  }\n})\n\n"
  },
  {
    "path": "test/api/mocha/data/metrics/metricsGet.json",
    "content": "{\n  \"Return summary metrics - stig agg - param labelName\": {\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ]\n  },\n  \"Return detailed metrics for the specified Collection no param\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ]\n  },\n  \"Return detailed metrics for the specified Collection - with params\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ]\n  },\n  \"test metrics on empty collection\": {\n    \"stigmanadmin\": []\n  },\n  \"test metrics on collection with labelMatch=null\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - assset agg\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"29\",\n        \"name\": \"ACHERNAR_Collection_X_asset\",\n        \"labels\": [],\n        \"ip\": \"10.0.0.18\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [],\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 0,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"29\",\n        \"name\": \"ACHERNAR_Collection_X_asset\",\n        \"labels\": [],\n        \"ip\": \"10.0.0.18\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [],\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 0,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"29\",\n        \"name\": \"ACHERNAR_Collection_X_asset\",\n        \"labels\": [],\n        \"ip\": \"10.0.0.18\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [],\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 0,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"29\",\n        \"name\": \"ACHERNAR_Collection_X_asset\",\n        \"labels\": [],\n        \"ip\": \"10.0.0.18\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [],\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 0,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - asset agg - with param assetId\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - asset agg - with params\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - asset agg - with params - all\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - asset agg - with param labelId\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - asset agg - with param labelName\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - collection agg - no params\": {\n    \"stigmanadmin\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 4,\n      \"stigs\": 2,\n      \"checklists\": 6,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 8,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 17,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 6\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 6,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 11,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 1104,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 15\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 75,\n          \"high\": 111,\n          \"medium\": 918\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 3,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 14,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 530,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 12\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 39,\n          \"high\": 59,\n          \"medium\": 432\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 4,\n      \"stigs\": 2,\n      \"checklists\": 6,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 8,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 17,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 6\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 6,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 11,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 1104,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 15\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 75,\n          \"high\": 111,\n          \"medium\": 918\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 4,\n      \"stigs\": 2,\n      \"checklists\": 6,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 8,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 17,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 6\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 6,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 11,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 1104,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 15\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 75,\n          \"high\": 111,\n          \"medium\": 918\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 4,\n      \"stigs\": 2,\n      \"checklists\": 6,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 8,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 17,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 6\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 6,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 11,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 1104,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 15\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 75,\n          \"high\": 111,\n          \"medium\": 918\n        }\n      }\n    }\n  },\n  \"Return detail metrics - collection agg - asset param\": {\n    \"stigmanadmin\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 1,\n      \"stigs\": 2,\n      \"checklists\": 2,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 1,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 368,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 25,\n          \"high\": 37,\n          \"medium\": 306\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 1,\n      \"stigs\": 1,\n      \"checklists\": 1,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 1,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 6,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 2\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 1,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 81,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 7,\n          \"high\": 11,\n          \"medium\": 63\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 1,\n      \"stigs\": 2,\n      \"checklists\": 2,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 1,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 368,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 25,\n          \"high\": 37,\n          \"medium\": 306\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 1,\n      \"stigs\": 2,\n      \"checklists\": 2,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 1,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 368,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 25,\n          \"high\": 37,\n          \"medium\": 306\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 1,\n      \"stigs\": 2,\n      \"checklists\": 2,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 1,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 368,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 25,\n          \"high\": 37,\n          \"medium\": 306\n        }\n      }\n    }\n  },\n  \"Return detail metrics - collection agg - labelId param\": {\n    \"stigmanadmin\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 3,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 449,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 32,\n          \"high\": 48,\n          \"medium\": 369\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    }\n  },\n  \"Return detail metrics - collection agg - label name param\": {\n    \"stigmanadmin\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 3,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 2,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 449,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 32,\n          \"high\": 48,\n          \"medium\": 369\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    }\n  },\n  \"Return detail metrics - collection agg - benchmarkId param\": {\n    \"stigmanadmin\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 3,\n      \"stigs\": 1,\n      \"checklists\": 3,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 14,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 243,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 12\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 21,\n          \"high\": 33,\n          \"medium\": 189\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 3,\n      \"stigs\": 1,\n      \"checklists\": 3,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 14,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 243,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 12\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 21,\n          \"high\": 33,\n          \"medium\": 189\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 3,\n      \"stigs\": 1,\n      \"checklists\": 3,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 14,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 243,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 12\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 21,\n          \"high\": 33,\n          \"medium\": 189\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 3,\n      \"stigs\": 1,\n      \"checklists\": 3,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 14,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 243,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 12\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 21,\n          \"high\": 33,\n          \"medium\": 189\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 3,\n      \"stigs\": 1,\n      \"checklists\": 3,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": {\n            \"total\": 7,\n            \"resultEngine\": 0\n          },\n          \"pass\": {\n            \"total\": 3,\n            \"resultEngine\": 0\n          },\n          \"error\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"fixed\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"unknown\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notchecked\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notselected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"informational\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"notapplicable\": {\n            \"total\": 4,\n            \"resultEngine\": 0\n          }\n        },\n        \"assessed\": 14,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"statuses\": {\n          \"saved\": {\n            \"total\": 5,\n            \"resultEngine\": 0\n          },\n          \"accepted\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"rejected\": {\n            \"total\": 0,\n            \"resultEngine\": 0\n          },\n          \"submitted\": {\n            \"total\": 9,\n            \"resultEngine\": 0\n          }\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 243,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 12\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 21,\n          \"high\": 33,\n          \"medium\": 189\n        }\n      }\n    }\n  },\n  \"Return detail metrics - label agg\": {\n    \"stigmanadmin\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 449,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 32,\n            \"high\": 48,\n            \"medium\": 369\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - label agg - param benchmark\": {\n    \"stigmanadmin\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - label agg - param assetId\": {\n    \"stigmanadmin\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - label agg - param labelId\": {\n    \"stigmanadmin\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 449,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 32,\n            \"high\": 48,\n            \"medium\": 369\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - label agg - param labelName\": {\n    \"stigmanadmin\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - stig agg\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 3,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 861,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 54,\n            \"high\": 78,\n            \"medium\": 729\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 3,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 861,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 54,\n            \"high\": 78,\n            \"medium\": 729\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 3,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 861,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 54,\n            \"high\": 78,\n            \"medium\": 729\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 3,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 861,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 54,\n            \"high\": 78,\n            \"medium\": 729\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - stig agg - param benchmark\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 9,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - stig agg - param asset\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - stig agg - param labelId\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 4,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 7,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ]\n  },\n  \"Return detail metrics - stig agg - param labelName\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 3,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 5,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"pass\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            },\n            \"error\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"fixed\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"unknown\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notchecked\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notselected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"informational\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"notapplicable\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            }\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": {\n              \"total\": 1,\n              \"resultEngine\": 0\n            },\n            \"accepted\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"rejected\": {\n              \"total\": 0,\n              \"resultEngine\": 0\n            },\n            \"submitted\": {\n              \"total\": 2,\n              \"resultEngine\": 0\n            }\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics for the Collection - no agg - no params\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics for the Collection - benchmark param - no agg\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics for the Collection - asset param - no agg\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics for the Collection - labelId param - no agg\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics for the Collection - labelName param - no agg\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics asset agg - summary\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"29\",\n        \"name\": \"ACHERNAR_Collection_X_asset\",\n        \"labels\": [],\n        \"ip\": \"10.0.0.18\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [],\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 0,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"29\",\n        \"name\": \"ACHERNAR_Collection_X_asset\",\n        \"labels\": [],\n        \"ip\": \"10.0.0.18\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [],\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 0,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"29\",\n        \"name\": \"ACHERNAR_Collection_X_asset\",\n        \"labels\": [],\n        \"ip\": \"10.0.0.18\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [],\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 0,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"29\",\n        \"name\": \"ACHERNAR_Collection_X_asset\",\n        \"labels\": [],\n        \"ip\": \"10.0.0.18\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [],\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 0,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          }\n        }\n      },\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"Windows_10_STIG_TEST\",\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics - asset agg - with param assetId\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics - asset agg - with benchmarkID\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"assetId\": \"154\",\n        \"name\": \"Collection_X_lvl1_asset-2\",\n        \"labels\": [],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics - asset agg - with param labelId\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics - asset agg - with param labelName\": {\n    \"stigmanadmin\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"assetId\": \"62\",\n        \"name\": \"Collection_X_asset\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"10.1.1.1\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-01-26T01:23:06Z\",\n          \"minTs\": \"2020-08-11T23:37:48Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 2\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-01-26T01:23:06Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"assetId\": \"42\",\n        \"name\": \"Collection_X_lvl1_asset-1\",\n        \"labels\": [\n          {\n            \"name\": \"test-label-full\",\n            \"color\": \"FF99CC\",\n            \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\"\n          },\n          {\n            \"name\": \"test-label-lvl1\",\n            \"color\": \"99CCFF\",\n            \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n          }\n        ],\n        \"ip\": \"\",\n        \"fqdn\": null,\n        \"mac\": null,\n        \"benchmarkIds\": [\n          \"VPN_SRG_TEST\",\n          \"Windows_10_STIG_TEST\"\n        ],\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics - collection agg - no params\": {\n    \"stigmanadmin\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 4,\n      \"stigs\": 2,\n      \"checklists\": 6,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 8,\n          \"pass\": 5,\n          \"other\": 0,\n          \"notapplicable\": 4\n        },\n        \"assessed\": 17,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 6\n        },\n        \"statuses\": {\n          \"saved\": 6,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 11\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 1104,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 15\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 75,\n          \"high\": 111,\n          \"medium\": 918\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 3,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 7,\n          \"pass\": 3,\n          \"other\": 0,\n          \"notapplicable\": 4\n        },\n        \"assessed\": 14,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"statuses\": {\n          \"saved\": 5,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 530,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 12\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 39,\n          \"high\": 59,\n          \"medium\": 432\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 4,\n      \"stigs\": 2,\n      \"checklists\": 6,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 8,\n          \"pass\": 5,\n          \"other\": 0,\n          \"notapplicable\": 4\n        },\n        \"assessed\": 17,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 6\n        },\n        \"statuses\": {\n          \"saved\": 6,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 11\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 1104,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 15\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 75,\n          \"high\": 111,\n          \"medium\": 918\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 4,\n      \"stigs\": 2,\n      \"checklists\": 6,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 8,\n          \"pass\": 5,\n          \"other\": 0,\n          \"notapplicable\": 4\n        },\n        \"assessed\": 17,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 6\n        },\n        \"statuses\": {\n          \"saved\": 6,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 11\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 1104,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 15\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 75,\n          \"high\": 111,\n          \"medium\": 918\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 4,\n      \"stigs\": 2,\n      \"checklists\": 6,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 8,\n          \"pass\": 5,\n          \"other\": 0,\n          \"notapplicable\": 4\n        },\n        \"assessed\": 17,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 6\n        },\n        \"statuses\": {\n          \"saved\": 6,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 11\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 1104,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 15\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 75,\n          \"high\": 111,\n          \"medium\": 918\n        }\n      }\n    }\n  },\n  \"Return summary metrics - collection agg - asset param\": {\n    \"stigmanadmin\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 1,\n      \"stigs\": 2,\n      \"checklists\": 2,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 4,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 1\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": 2,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 7\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 368,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 25,\n          \"high\": 37,\n          \"medium\": 306\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 1,\n      \"stigs\": 1,\n      \"checklists\": 1,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 3,\n          \"pass\": 2,\n          \"other\": 0,\n          \"notapplicable\": 1\n        },\n        \"assessed\": 6,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 2\n        },\n        \"statuses\": {\n          \"saved\": 1,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 5\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 81,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 7,\n          \"high\": 11,\n          \"medium\": 63\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 1,\n      \"stigs\": 2,\n      \"checklists\": 2,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 4,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 1\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": 2,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 7\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 368,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 25,\n          \"high\": 37,\n          \"medium\": 306\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 1,\n      \"stigs\": 2,\n      \"checklists\": 2,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 4,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 1\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": 2,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 7\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 368,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 25,\n          \"high\": 37,\n          \"medium\": 306\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 1,\n      \"stigs\": 2,\n      \"checklists\": 2,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 4,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 1\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": 2,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 7\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 368,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 25,\n          \"high\": 37,\n          \"medium\": 306\n        }\n      }\n    }\n  },\n  \"Return summary metrics - collection agg - labelId param\": {\n    \"stigmanadmin\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 3,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 4,\n          \"pass\": 2,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": 2,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 7\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 449,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 32,\n          \"high\": 48,\n          \"medium\": 369\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    }\n  },\n  \"Return summary metrics - collection agg - label name  param\": {\n    \"stigmanadmin\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 3,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 4,\n          \"pass\": 2,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 9,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 3\n        },\n        \"statuses\": {\n          \"saved\": 2,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 7\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 449,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 8\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 32,\n          \"high\": 48,\n          \"medium\": 369\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 2,\n      \"stigs\": 2,\n      \"checklists\": 4,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 5,\n          \"pass\": 4,\n          \"other\": 0,\n          \"notapplicable\": 3\n        },\n        \"assessed\": 12,\n        \"findings\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 4\n        },\n        \"statuses\": {\n          \"saved\": 3,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 736,\n        \"assessedBySeverity\": {\n          \"low\": 1,\n          \"high\": 0,\n          \"medium\": 11\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 50,\n          \"high\": 74,\n          \"medium\": 612\n        }\n      }\n    }\n  },\n  \"Return summary metrics - collection agg - benchmark param\": {\n    \"stigmanadmin\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 3,\n      \"stigs\": 1,\n      \"checklists\": 3,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 7,\n          \"pass\": 3,\n          \"other\": 0,\n          \"notapplicable\": 4\n        },\n        \"assessed\": 14,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"statuses\": {\n          \"saved\": 5,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 243,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 12\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 21,\n          \"high\": 33,\n          \"medium\": 189\n        }\n      }\n    },\n    \"lvl1\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 3,\n      \"stigs\": 1,\n      \"checklists\": 3,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 7,\n          \"pass\": 3,\n          \"other\": 0,\n          \"notapplicable\": 4\n        },\n        \"assessed\": 14,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"statuses\": {\n          \"saved\": 5,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 243,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 12\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 21,\n          \"high\": 33,\n          \"medium\": 189\n        }\n      }\n    },\n    \"lvl2\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 3,\n      \"stigs\": 1,\n      \"checklists\": 3,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 7,\n          \"pass\": 3,\n          \"other\": 0,\n          \"notapplicable\": 4\n        },\n        \"assessed\": 14,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"statuses\": {\n          \"saved\": 5,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 243,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 12\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 21,\n          \"high\": 33,\n          \"medium\": 189\n        }\n      }\n    },\n    \"lvl3\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 3,\n      \"stigs\": 1,\n      \"checklists\": 3,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 7,\n          \"pass\": 3,\n          \"other\": 0,\n          \"notapplicable\": 4\n        },\n        \"assessed\": 14,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"statuses\": {\n          \"saved\": 5,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 243,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 12\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 21,\n          \"high\": 33,\n          \"medium\": 189\n        }\n      }\n    },\n    \"lvl4\": {\n      \"collectionId\": \"21\",\n      \"name\": \"Collection X\",\n      \"assets\": 3,\n      \"stigs\": 1,\n      \"checklists\": 3,\n      \"metrics\": {\n        \"maxTs\": \"2022-02-03T00:07:05Z\",\n        \"minTs\": \"2020-08-11T22:27:26Z\",\n        \"results\": {\n          \"fail\": 7,\n          \"pass\": 3,\n          \"other\": 0,\n          \"notapplicable\": 4\n        },\n        \"assessed\": 14,\n        \"findings\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 5\n        },\n        \"statuses\": {\n          \"saved\": 5,\n          \"accepted\": 0,\n          \"rejected\": 0,\n          \"submitted\": 9\n        },\n        \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n        \"assessments\": 243,\n        \"assessedBySeverity\": {\n          \"low\": 2,\n          \"high\": 0,\n          \"medium\": 12\n        },\n        \"assessmentsBySeverity\": {\n          \"low\": 21,\n          \"high\": 33,\n          \"medium\": 189\n        }\n      }\n    }\n  },\n  \"Return summary metrics - label agg\": {\n    \"stigmanadmin\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 449,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 32,\n            \"high\": 48,\n            \"medium\": 369\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics - label agg - param benchmark\": {\n    \"stigmanadmin\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"labelId\": null,\n        \"name\": null,\n        \"color\": null,\n        \"description\": null,\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-02T20:20:18Z\",\n          \"minTs\": \"2020-08-11T22:30:42Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 1,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 5,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2022-02-02T20:20:18Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics - label agg - param assetId\": {\n    \"stigmanadmin\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics - label agg - param labelId\": {\n    \"stigmanadmin\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 449,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 32,\n            \"high\": 48,\n            \"medium\": 369\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 2,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 5,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 12,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 4\n          },\n          \"statuses\": {\n            \"saved\": 3,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 736,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 11\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 50,\n            \"high\": 74,\n            \"medium\": 612\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics - label agg - param labelName\": {\n    \"stigmanadmin\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"labelId\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-full\",\n        \"color\": \"FF99CC\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      },\n      {\n        \"labelId\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n        \"name\": \"test-label-lvl1\",\n        \"color\": \"99CCFF\",\n        \"description\": \"\",\n        \"assets\": 1,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 4,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 368,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 25,\n            \"high\": 37,\n            \"medium\": 306\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics - stig agg\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 7,\n            \"pass\": 3,\n            \"other\": 0,\n            \"notapplicable\": 4\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": 5,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 3,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 861,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 54,\n            \"high\": 78,\n            \"medium\": 729\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 7,\n            \"pass\": 3,\n            \"other\": 0,\n            \"notapplicable\": 4\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": 5,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 7,\n            \"pass\": 3,\n            \"other\": 0,\n            \"notapplicable\": 4\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": 5,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 3,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 861,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 54,\n            \"high\": 78,\n            \"medium\": 729\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 7,\n            \"pass\": 3,\n            \"other\": 0,\n            \"notapplicable\": 4\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": 5,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 3,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 861,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 54,\n            \"high\": 78,\n            \"medium\": 729\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 7,\n            \"pass\": 3,\n            \"other\": 0,\n            \"notapplicable\": 4\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": 5,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 3,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 861,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 54,\n            \"high\": 78,\n            \"medium\": 729\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics - stig agg - param benchmark\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 7,\n            \"pass\": 3,\n            \"other\": 0,\n            \"notapplicable\": 4\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": 5,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 7,\n            \"pass\": 3,\n            \"other\": 0,\n            \"notapplicable\": 4\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": 5,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 7,\n            \"pass\": 3,\n            \"other\": 0,\n            \"notapplicable\": 4\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": 5,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 7,\n            \"pass\": 3,\n            \"other\": 0,\n            \"notapplicable\": 4\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": 5,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 3,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 7,\n            \"pass\": 3,\n            \"other\": 0,\n            \"notapplicable\": 4\n          },\n          \"assessed\": 14,\n          \"findings\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"statuses\": {\n            \"saved\": 5,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 9\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 243,\n          \"assessedBySeverity\": {\n            \"low\": 2,\n            \"high\": 0,\n            \"medium\": 12\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 21,\n            \"high\": 33,\n            \"medium\": 189\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics - stig agg - param asset\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 1,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 3,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 1\n          },\n          \"assessed\": 6,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 2\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 5\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 81,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 5\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 7,\n            \"high\": 11,\n            \"medium\": 63\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ]\n  },\n  \"Return summary metrics - stig agg - param labelId\": {\n    \"stigmanadmin\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl1\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 1,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": null,\n          \"minTs\": null,\n          \"results\": {\n            \"fail\": 0,\n            \"pass\": 0,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 0,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"statuses\": {\n            \"saved\": 0,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 0\n          },\n          \"maxTouchTs\": null,\n          \"assessments\": 287,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 18,\n            \"high\": 26,\n            \"medium\": 243\n          }\n        }\n      }\n    ],\n    \"lvl2\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl3\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ],\n    \"lvl4\": [\n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"title\": \"Virtual Private Network (VPN) Security Requirements Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R1\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2019-07-19\",\n        \"assets\": 2,\n        \"ruleCount\": 81,\n        \"metrics\": {\n          \"maxTs\": \"2022-02-03T00:07:05Z\",\n          \"minTs\": \"2020-08-11T22:27:26Z\",\n          \"results\": {\n            \"fail\": 4,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 3\n          },\n          \"assessed\": 9,\n          \"findings\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"statuses\": {\n            \"saved\": 2,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 7\n          },\n          \"maxTouchTs\": \"2022-02-03T00:07:07Z\",\n          \"assessments\": 162,\n          \"assessedBySeverity\": {\n            \"low\": 1,\n            \"high\": 0,\n            \"medium\": 8\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 14,\n            \"high\": 22,\n            \"medium\": 126\n          }\n        }\n      },\n      {\n        \"benchmarkId\": \"Windows_10_STIG_TEST\",\n        \"title\": \"Windows 10 Security Technical Implementation Guide\",\n        \"marking\": null,\n        \"revisionStr\": \"V1R23\",\n        \"revisionPinned\": false,\n        \"revisionDate\": \"2020-06-17\",\n        \"assets\": 2,\n        \"ruleCount\": 287,\n        \"metrics\": {\n          \"maxTs\": \"2020-08-18T20:48:29Z\",\n          \"minTs\": \"2020-08-11T22:29:16Z\",\n          \"results\": {\n            \"fail\": 1,\n            \"pass\": 2,\n            \"other\": 0,\n            \"notapplicable\": 0\n          },\n          \"assessed\": 3,\n          \"findings\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 1\n          },\n          \"statuses\": {\n            \"saved\": 1,\n            \"accepted\": 0,\n            \"rejected\": 0,\n            \"submitted\": 2\n          },\n          \"maxTouchTs\": \"2020-08-18T20:48:29Z\",\n          \"assessments\": 574,\n          \"assessedBySeverity\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 3\n          },\n          \"assessmentsBySeverity\": {\n            \"low\": 36,\n            \"high\": 52,\n            \"medium\": 486\n          }\n        }\n      }\n    ]\n  }\n}"
  },
  {
    "path": "test/api/mocha/data/metrics/metricsGet.test.js",
    "content": "import {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {iterations} from '../../iterations.js'\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\nimport { dirname } from 'path'\nimport { fileURLToPath } from 'url'\n\n// import metrics reference file, and set update file path\nimport metrics from './metricsGet.json' with { type: 'json' }\nconst metricsUpdateFile = `${dirname(fileURLToPath(import.meta.url))}/metricsGet.json`\n\n\ndescribe('GET - Metrics', function () { \n  before(async function () {\n    await utils.loadAppData()\n  })\n\n  for(const iteration of iterations){\n    describe(`iteration:${iteration.name}`, function () {\n        \n        describe('GET - getMetricsDetailByCollection - /collections/{collectionId}/metrics/detail', function () {\n\n            it('Return detailed metrics for the specified Collection no param', async function () {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail`, 'GET', iteration.token)\n            if(iteration.name === \"collectioncreator\"){\n                expect(res.status).to.eql(403)\n                return\n            }\n            expect(res.status).to.eql(200)\n            \n            // Generates metrics reference file if config.generateMetricsReferenceData=true\n            utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n            \n            const expectedData = metrics[this.test.title]\n          \n            if(iteration.name === 'lvl1'){\n                expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n            }\n            else \n            {\n                expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n            }\n\n            })\n            it('Return detailed metrics for the specified Collection - with params', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail?benchmarkId=${reference.benchmark}&assetId=${reference.testAsset.assetId}&labelName=${reference.testCollection.fullLabelName}`, 'GET', iteration.token)\n\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it(\"test metrics on empty collection\", async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${'84'}/metrics/detail`, 'GET', iteration.token)\n                if(iteration.name !== \"stigmanadmin\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                expect(res.body).to.be.empty\n\n            })\n            it(\"test metrics on collection with labelMatch=null\", async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail?labelMatch=null`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n\n            })\n            it('should return 403 for deleted collection', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metrics/detail`, 'GET', iteration.token)\n                expect(res.status).to.eql(403)\n            })\n        })\n\n        describe('GET - getMetricsDetailByCollectionAggAsset - /collections/{collectionId}/metrics/detail/asset', function () {\n        \n            it('Return detail metrics - assset agg', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/asset`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return detail metrics - asset agg - with param assetId', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/asset?assetId=${reference.testAsset.assetId}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return detail metrics - asset agg - with params', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/asset?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return detail metrics - asset agg - with params - all', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/asset?benchmarkId=${reference.benchmark}&assetId=${reference.testAsset.assetId}&labelId=${reference.testCollection.fullLabel}&labelName=${reference.testCollection.fullLabelName}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return detail metrics - asset agg - with param labelId', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/asset?labelId=${reference.testCollection.fullLabel}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return detail metrics - asset agg - with param labelName', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/asset?labelName=${reference.testCollection.fullLabelName}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('should return 403 for deleted collection', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metrics/detail/asset`, 'GET', iteration.token)\n                expect(res.status).to.eql(403)\n            })\n        })\n\n        describe('GET - getMetricsDetailByCollectionAgg - /collections/{collectionId}/metrics/detail/collection', function () {\n\n        \n\n            it('Return detail metrics - collection agg - no params', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/collection`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            \n            })\n            it('Return detail metrics - collection agg - asset param', async function () {\n\n              \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/collection?assetId=${reference.testAsset.assetId}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return detail metrics - collection agg - labelId param', async function () {\n            \n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/collection?labelId=${reference.testCollection.fullLabel}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return detail metrics - collection agg - label name param', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/collection?labelName=${reference.testCollection.fullLabelName}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return detail metrics - collection agg - benchmarkId param', async function () {\n            \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/collection?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('should return 403 for deleted collection', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metrics/detail/collection`, 'GET', iteration.token)\n                expect(res.status).to.eql(403)\n            })\n        })\n\n        describe('GET - getMetricsDetailByCollectionAggLabel - /collections/{collectionId}/metrics/detail/label', function () {\n\n            it('Return detail metrics - label agg', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/label`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return detail metrics - label agg - param benchmark', async function () {\n\n             \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/label?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return detail metrics - label agg - param assetId', async function () {\n\n            \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/label?assetId=${reference.testAsset.assetId}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return detail metrics - label agg - param labelId', async function () {\n\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/label?labelId=${reference.testCollection.fullLabel}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                \n            })\n            it('Return detail metrics - label agg - param labelName', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/label?labelName=${reference.testCollection.lvl1LabelName}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('should return 403 for deleted collection', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metrics/detail/label`, 'GET', iteration.token)\n                expect(res.status).to.eql(403)\n            })\n        })\n\n        describe('GET - getMetricsDetailByCollectionAggStig - /collections/{collectionId}/metrics/detail/stig', function () {\n\n            it('Return detail metrics - stig agg', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/stig`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n       \n            })\n            it('Return detail metrics - stig agg - param benchmark', async function () {\n\n            \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/stig?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return detail metrics - stig agg - param asset', async function () {\n\n            \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/stig?assetId=${reference.testAsset.assetId}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return detail metrics - stig agg - param labelId', async function () {\n\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/stig?labelId=${reference.testCollection.fullLabel}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return detail metrics - stig agg - param labelName', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/stig?labelName=${reference.testCollection.lvl1LabelName}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('should return 403 for deleted collection', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metrics/detail/stig`, 'GET', iteration.token)\n                expect(res.status).to.eql(403)\n            })\n        })\n\n\n        //summary\n        describe('GET - getMetricsSummaryByCollection - /collections/{collectionId}/metrics/summary', function () {\n\n        \n\n            it('Return summary metrics for the Collection - no agg - no params', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics for the Collection - benchmark param - no agg', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics for the Collection - asset param - no agg', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary?assetId=${reference.testAsset.assetId}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics for the Collection - labelId param - no agg', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary?labelId=${reference.testCollection.fullLabel}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics for the Collection - labelName param - no agg', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary?labelName=${reference.testCollection.lvl1LabelName}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('should return 403 for deleted collection', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metrics/summary`, 'GET', iteration.token)\n                expect(res.status).to.eql(403)\n            })\n        })\n\n        describe('GET - getMetricsSummaryByCollectionAggAsset - /collections/{collectionId}/metrics/summary/asset', function () {\n\n          \n            it('Return summary metrics asset agg - summary', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/asset`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics - asset agg - with param assetId', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/asset?assetId=${reference.testAsset.assetId}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics - asset agg - with benchmarkID', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/asset?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n        \n            it('Return summary metrics - asset agg - with param labelId', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/asset?labelId=${reference.testCollection.fullLabel}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics - asset agg - with param labelName', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/asset?labelName=${reference.testCollection.fullLabelName}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('should return 403 for deleted collection', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metrics/summary/asset`, 'GET', iteration.token)\n                expect(res.status).to.eql(403)\n            })\n        })\n\n        describe('GET - getMetricsSummaryByCollectionAgg - /collections/{collectionId}/metrics/summary/collection', function () {\n\n            it('Return summary metrics - collection agg - no params', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/collection`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics - collection agg - asset param', async function () {\n\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/collection?assetId=${reference.testAsset.assetId}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics - collection agg - labelId param', async function () {\n              \n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/collection?labelId=${reference.testCollection.fullLabel}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics - collection agg - label name  param', async function () {\n               \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/collection?labelName=${reference.testCollection.fullLabelName}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })    \n            it('Return summary metrics - collection agg - benchmark param', async function () {\n              \n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/collection?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('should return 403 for deleted collection', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metrics/summary/collection`, 'GET', iteration.token)\n                expect(res.status).to.eql(403)\n            })\n        })\n\n        describe('GET - getMetricsSummaryByCollectionAggLabel - /collections/{collectionId}/metrics/summary/label', function () {\n\n\n            it('Return summary metrics - label agg', async function () {\n\n               \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/label`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n                })\n            it('Return summary metrics - label agg - param benchmark', async function () {\n\n              \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/label?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics - label agg - param assetId', async function () {\n\n            \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/label?assetId=${reference.testAsset.assetId}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics - label agg - param labelId', async function () {\n\n        \n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/label?labelId=${reference.testCollection.fullLabel}`, 'GET', iteration.token)\n                   \n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n\n            })\n            it('Return summary metrics - label agg - param labelName', async function () {\n\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/label?labelName=${reference.testCollection.lvl1LabelName}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('should return 403 for deleted collection', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metrics/summary/label`, 'GET', iteration.token)\n                expect(res.status).to.eql(403)\n            })\n        })\n\n        describe('GET - getMetricsSummaryByCollectionAggStig - /collections/{collectionId}/metrics/summary/stig', function () {\n\n\n            it('Return summary metrics - stig agg', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/stig`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics - stig agg - param benchmark', async function () {\n\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/stig?benchmarkId=${reference.benchmark}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics - stig agg - param asset', async function () {\n\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/stig?assetId=${reference.testAsset.assetId}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics - stig agg - param labelId', async function () {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/stig?labelId=${reference.testCollection.fullLabel}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('Return summary metrics - stig agg - param labelName', async function () {\n                \n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/stig?labelName=${reference.testCollection.fullLabelName}`, 'GET', iteration.token)\n                if(iteration.name === \"collectioncreator\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                \n                // Generates metrics reference file if config.generateMetricsReferenceData=true\n                utils.conditionalMetricsOutput(this.test.title, iteration.name, res.body, metricsUpdateFile)\n                \n                const expectedData = metrics[this.test.title]\n\n                if(iteration.name === 'lvl1'){\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['lvl1'])\n                }\n                else \n                {\n                    expect(res.body).to.deep.equalInAnyOrder(expectedData['stigmanadmin'])\n                }\n            })\n            it('should return 403 for deleted collection', async function () {\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/metrics/summary/stig`, 'GET', iteration.token)\n                expect(res.status).to.eql(403)\n            })\n        })\n    })\n  }\n\n  describe('GET - getMetricsSummaryByCollection - large benchmarkId array', function () {\n    // Regression: express query parser defaults to `qs`. whose default arrayLimit (20) collapses repeated bare keys into an\n    // object, which the OpenAPI validator then wraps in [] and rejects with\n    // \"request/query/benchmarkId/0 must be string\". The api sets the query parser to `simple`\n    // and uses the built-in Node query parser which does not have this behavior\n    it('accepts 100 benchmarkId query values without a 400 from the validator', async function () {\n      const adminToken = iterations.find(i => i.name === 'stigmanadmin').token\n      const params = Array.from({length: 100}, (_, i) => `benchmarkId=Synthetic_Stig_${i}`).join('&')\n      const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary?${params}`, 'GET', adminToken)\n      expect(res.status).to.not.eql(400)\n    })\n  })\n})\n\n"
  },
  {
    "path": "test/api/mocha/data/operation/op.test.js",
    "content": "\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {iterations} from '../../iterations.js'\nimport { expect } from 'chai'\n\ndescribe('GET - Op', () => {\n  let disabledCollection\n  before(async function () {\n    await utils.loadAppData()\n  })\n\n  for(const iteration of iterations){\n    describe(`iteration:${iteration.name}`, () => {\n      describe('getAppData - /op/appdata', () => {\n        it('Export application data', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/op/appdata?format=jsonl&elevate=true`, 'GET', iteration.token)\n          if(iteration.name !== \"stigmanadmin\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n        })\n      })\n      describe('getConfiguration - /op/configuration', () => {\n        it('Return API version and configuration information', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/op/configuration`, 'GET', iteration.token)\n          expect(res.status).to.eql(200)\n        })\n        it('delate alter test', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/op/configuration`, 'GET', iteration.token)\n          expect(res.status).to.eql(200)\n        })\n      })\n      describe('getAppInfo - /op/appinfo', () => {\n        it('Return API Deployment Details', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/op/appinfo?elevate=true`, 'GET', iteration.token)\n          if(iteration.name !== \"stigmanadmin\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('object')\n          const rtc = reference.testCollection\n          expect(res.body).to.nested.include({\n            schema: 'stig-manager-appinfo-v1.1',\n            [`collections.${rtc.collectionId}.state`]: rtc.appinfo.state,\n            [`collections.${rtc.collectionId}.assets`]: rtc.appinfo.assets,\n            [`collections.${rtc.collectionId}.assetsDisabled`]: rtc.appinfo.assetsDisabled,\n            [`collections.${rtc.collectionId}.reviews`]: rtc.appinfo.reviews,\n            [`collections.${rtc.collectionId}.reviewsDisabled`]: rtc.appinfo.reviewsDisabled,\n           \n          })\n        })\n\n        it('Return API Deployment Details with includeRowCounts=true', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/op/appinfo?elevate=true&includeRowCounts=true`, 'GET', iteration.token)\n          if(iteration.name !== \"stigmanadmin\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('object')\n          expect(res.body.mysql).to.be.an('object')\n          expect(res.body.mysql.tables).to.be.an('object')\n          \n          // When includeRowCounts=true, rowCount should be actual numbers\n          for (const tableName in res.body.mysql.tables) {\n            const table = res.body.mysql.tables[tableName]\n            expect(table).to.have.property('rowCount')\n            expect(table.rowCount).to.be.a('number')\n          }\n        })\n\n        it('Return API Deployment Details with includeRowCounts=false', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/op/appinfo?elevate=true&includeRowCounts=false`, 'GET', iteration.token)\n          if(iteration.name !== \"stigmanadmin\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('object')\n          expect(res.body.mysql).to.be.an('object')\n          expect(res.body.mysql.tables).to.be.an('object')\n          \n          // When includeRowCounts=false, rowCount should be null\n          for (const tableName in res.body.mysql.tables) {\n            const table = res.body.mysql.tables[tableName]\n            expect(table).to.have.property('rowCount')\n            expect(table.rowCount).to.be.null\n          }\n        })\n\n        it('Return API Deployment Details without includeRowCounts param (should default to false)', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/op/appinfo?elevate=true`, 'GET', iteration.token)\n          if(iteration.name !== \"stigmanadmin\"){\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('object')\n          expect(res.body.mysql).to.be.an('object')\n          expect(res.body.mysql.tables).to.be.an('object')\n          \n          // When includeRowCounts is not specified, it defaults to false, so rowCount should be null\n          for (const tableName in res.body.mysql.tables) {\n            const table = res.body.mysql.tables[tableName]\n            expect(table).to.have.property('rowCount')\n            expect(table.rowCount).to.be.null\n          }\n        })\n      })\n      describe('getDefinition - /op/definition', () => {\n        it('Return API Deployment Definition', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/op/definition`, 'GET', iteration.token)\n          expect(res.status).to.eql(200)\n        })\n      })\n      describe('getDefinition - /op/definition - with jsonPath param', () => {\n        it('Return API Deployment Definition', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/op/definition?jsonpath=%24.components.schemas.RoleId`, 'GET', iteration.token)\n          expect(res.status).to.eql(200)\n          const expectedSchema =  [\n            {\n              maximum: 4,\n              minimum: 1,\n              type: \"integer\"\n            }\n          ]\n          expect(res.body[0]).to.deep.equal(expectedSchema[0])\n        })\n      })\n    })\n  }\n})\n"
  },
  {
    "path": "test/api/mocha/data/review/expectations.js",
    "content": "//This data contains expected response data that varies by iteration \"scenario\" or \"iteration\" for each test case. These expectations are relative to the \"referenceData.js\" data used to construct the API requests.\n\nexport const expectations = {\n    stigmanadmin: {\n      canPatchReview: true,\n      testAsset: {\n        reviewsAvailableToUser: 9,\n        reviewsForResultPass: 4,\n        reviewsForResultFail: 4,\n        reviewsForStatusSaved: 2,\n        reviewsForStatusSubmitted: 7\n      },\n      testCollection: {\n        reviewsForTestBenchmark: 14,\n        reviewsForResultFail: 8,\n        reviewsForResultFailAllAssets: 8,\n        reviewsForTestRuleId: 3,\n        reviewsForStatusSaved: 6,\n        reviewsForStigmanadmin: 14,\n        reviewsForResultPass: 4,\n        reviewsForTestGroup: 3,\n        reviewsForRulesAll: 17,\n        reviewsDefaultMapped: 0\n      },\n      postReviews:{\n        targetAssetsWholeStig:{\n          inserted: 4,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 4\n        },\n        targetAssetsOneRule:{\n          inserted: 2,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetAssetsAndRule:{\n          inserted: 2,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetStigWholeStig:{\n          inserted: 4,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 4\n        },\n        targetStigWholeStigInsert:{\n          inserted: 1,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetStigWholeStigMerge:{\n          inserted: 1,\n          updated: 1,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetRulesDefinedByStig:{\n          inserted:241,\n          updated: 2,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 6\n        },\n        targetByStigOneRuleValidationFailure:{\n          inserted: 0,\n          updated: 0,\n          failedValidation: 2,\n          validationErrors: 2,\n          reviewsLength: 0\n        },\n        update62Insert29:{\n          inserted: 1,\n          updated: 1,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        \n      },\n      roleId:4\n    },\n    lvl1: {\n      canPatchReview: false,\n      testAssetStats: {\n        ruleCount: 81,\n        stigCount: 1,\n        savedCount: 1,\n        acceptedCount: 0,\n        rejectedCount: 0,\n        submittedCount: 5\n      },\n      postReviews:{\n        targetAssetsWholeStig:{\n          inserted: 2,\n          updated: 0,\n          failedValidation: 2,\n          validationErrors: 2,\n          reviewsLength: 2\n        },\n        targetAssetsOneRule:{\n          inserted: 1,\n          updated: 0,\n          failedValidation: 1,\n          validationErrors: 1,\n          reviewsLength: 1\n        },\n        targetAssetsAndRule:{\n          inserted: 1,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 1\n        },\n        targetStigWholeStig:{\n          inserted: 2,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetStigWholeStigInsert:{\n          inserted: 0,\n          updated: 0,\n          failedValidation: 1,\n          validationErrors: 1,\n          reviewsLength: 1\n        },\n        targetStigWholeStigMerge:{\n          inserted: 1,\n          updated: 0,\n          failedValidation: 1,\n          validationErrors: 1,\n          reviewsLength: 1\n        },\n        targetRulesDefinedByStig:{\n          inserted:160,\n          updated: 2,\n          failedValidation: 81,\n          validationErrors: 50,\n          reviewsLength: 6\n        },\n        targetByStigOneRuleValidationFailure:{\n          inserted: 0,\n          updated: 0,\n          failedValidation: 1,\n          validationErrors: 1,\n          reviewsLength: 0\n        },\n        update62Insert29:{\n          inserted: 0,\n          updated: 1,\n          failedValidation: 1,\n          validationErrors: 1,\n          reviewsLength: 1\n        },\n      },\n      testAsset: {\n        reviewsAvailableToUser: 6,\n        reviewsForResultPass: 2,\n        reviewsForResultFail: 3,\n        reviewsForStatusSaved: 1,\n        reviewsForStatusSubmitted: 5\n      },\n      testCollection: {\n        reviewsForTestBenchmark: 14,\n        reviewsForResultFail: 6,\n        reviewsForTestRuleId: 3,\n        reviewsForResultFailAllAssets: 7,\n        reviewsForStatusSaved: 5,\n        reviewsForStigmanadmin: 11,\n        reviewsForResultPass: 2,\n        reviewsForTestGroup: 3,\n        reviewsForRulesAll: 14,\n        reviewsDefaultMapped: 0\n      },\n      roleId:1\n    },\n    lvl2: {\n      canPatchReview: true,\n      testAssetStats: {\n        ruleCount: 368,\n        stigCount: 2,\n        savedCount: 2,\n        acceptedCount: 0,\n        rejectedCount: 0,\n        submittedCount: 7\n      },\n      testAsset: {\n        reviewsAvailableToUser: 9,\n        reviewsForResultPass: 4,\n        reviewsForResultFail: 4,\n        reviewsForStatusSaved: 2,\n        reviewsForStatusSubmitted: 7\n        \n      },\n       postReviews:{\n        targetAssetsWholeStig:{\n          inserted: 4,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 4\n        },\n        targetAssetsOneRule:{\n          inserted: 2,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetAssetsAndRule:{\n          inserted: 2,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetStigWholeStig:{\n          inserted: 4,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 4\n        },\n        targetStigWholeStigInsert:{\n          inserted: 1,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetStigWholeStigMerge:{\n          inserted: 1,\n          updated: 1,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetRulesDefinedByStig:{\n          inserted:241,\n          updated: 2,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 6\n        },\n        targetByStigOneRuleValidationFailure:{\n          inserted: 0,\n          updated: 0,\n          failedValidation: 2,\n          validationErrors: 2,\n          reviewsLength: 0\n        },\n        update62Insert29:{\n          inserted: 1,\n          updated: 1,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n      },\n      testCollection: {\n        reviewsForTestBenchmark: 14,\n        reviewsForResultFail: 8,\n        reviewsForResultFailAllAssets: 8,\n        reviewsForTestRuleId: 3,\n        reviewsForStatusSaved: 6,\n        reviewsForStigmanadmin: 14,\n        reviewsForResultPass: 4,\n        reviewsForTestGroup: 3,\n        reviewsForRulesAll: 17,\n        reviewsDefaultMapped: 0\n      },\n      roleId:2\n    },\n    lvl3: {\n      canPatchReview: true,\n      testAssetStats: {\n        ruleCount: 368,\n        stigCount: 2,\n        savedCount: 2,\n        acceptedCount: 0,\n        rejectedCount: 0,\n        submittedCount: 7\n      },\n      testAsset: {\n        reviewsAvailableToUser: 9,\n        reviewsForResultPass: 4,\n        reviewsForResultFail: 4,\n        reviewsForStatusSaved: 2,\n        reviewsForStatusSubmitted: 7\n      },\n      testCollection: {\n        reviewsForTestBenchmark: 14,\n        reviewsForResultFailAllAssets: 8,\n        reviewsForTestRuleId: 3,\n        reviewsForStatusSaved: 6,\n        reviewsForStigmanadmin: 14,\n        reviewsForResultPass: 4,\n        reviewsForTestGroup: 3,\n        reviewsForRulesAll: 17,\n        reviewsDefaultMapped: 0\n      },\n      postReviews:{\n        targetAssetsWholeStig:{\n          inserted: 4,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 4\n        },\n        targetAssetsOneRule:{\n          inserted: 2,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetAssetsAndRule:{\n          inserted: 2,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetStigWholeStig:{\n          inserted: 4,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 4\n        },\n        targetStigWholeStigInsert:{\n          inserted: 1,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetStigWholeStigMerge:{\n          inserted: 1,\n          updated: 1,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetRulesDefinedByStig:{\n          inserted:241,\n          updated: 2,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 6\n        },\n        targetByStigOneRuleValidationFailure:{\n          inserted: 0,\n          updated: 0,\n          failedValidation: 2,\n          validationErrors: 2,\n          reviewsLength: 0\n        },\n        update62Insert29:{\n          inserted: 1,\n          updated: 1,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n      },\n      roleId:3\n    },\n    lvl4: {\n      canPatchReview: true,\n      testAssetStats: {\n        ruleCount: 368,\n        stigCount: 2,\n        savedCount: 2,\n        acceptedCount: 0,\n        rejectedCount: 0,\n        submittedCount: 7\n      },\n      testAsset: {\n        reviewsAvailableToUser: 9,\n        reviewsForResultPass: 4,\n        reviewsForResultFail: 4,\n        reviewsForStatusSaved: 2,\n        reviewsForStatusSubmitted: 7\n      },\n      testCollection: {\n        reviewsForTestBenchmark: 14,\n        reviewsForResultFail: 8,\n        reviewsForResultFailAllAssets: 8,\n        reviewsForTestRuleId: 3,\n        reviewsForStatusSaved: 6,\n        reviewsForStigmanadmin: 14,\n        reviewsForTestGroup: 3,\n        reviewsForRulesAll: 17,\n        reviewsDefaultMapped: 0\n      \n      },\n      postReviews:{\n        targetAssetsWholeStig:{\n          inserted: 4,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 4\n        },\n        targetAssetsOneRule:{\n          inserted: 2,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetAssetsAndRule:{\n          inserted: 2,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetStigWholeStig:{\n          inserted: 4,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 4\n        },\n        targetStigWholeStigInsert:{\n          inserted: 1,\n          updated: 0,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetStigWholeStigMerge:{\n          inserted: 1,\n          updated: 1,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n        targetRulesDefinedByStig:{\n          inserted:241,\n          updated: 2,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 6\n        },\n        targetByStigOneRuleValidationFailure:{\n          inserted: 0,\n          updated: 0,\n          failedValidation: 2,\n          validationErrors: 2,\n          reviewsLength: 0\n        },\n        update62Insert29:{\n          inserted: 1,\n          updated: 1,\n          failedValidation: 0,\n          validationErrors: 0,\n          reviewsLength: 2\n        },\n      },\n      roleId:4\n    }\n}\n"
  },
  {
    "path": "test/api/mocha/data/review/requestBodies.js",
    "content": "//This data contains expected response data that varies by iteration \"scenario\" or \"iteration\" for each test case. These expectations are relative to the \"referenceData.js\" data used to construct the API requests.\r\nimport reference from '../../referenceData.js'\r\n\r\nexport const requestBodies = {\r\n  resetRule: {\r\n    autoResult: false,\r\n    comment: \"\",\r\n    detail: \"test\\nvisible to lvl1\\nhas history\",\r\n    metadata: {},\r\n    result: 'notapplicable',\r\n    status: 'submitted',\r\n  }\r\n}\r\n"
  },
  {
    "path": "test/api/mocha/data/review/reviewDelete.test.js",
    "content": "import {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport { expect } from 'chai'\n\ndescribe('DELETE - Review', () => {\n\n  before(async function () {\n    await utils.loadAppData()\n  })\n    \n  for(const iteration of iterations) {\n    if (expectations[iteration.name] === undefined){\n      it(`No expectations for this iteration scenario: ${iteration.name}`, async () => {})\n      continue\n    }\n    describe(`iteration:${iteration.name}`, () => {\n      const distinct = expectations[iteration.name]\n      \n      describe('DELETE - deleteReviewByAssetRule - /collections/{collectionId}/reviews/{assetId}/{ruleId}', () => {\n        let review = null\n        beforeEach(async function () {\n          review = await utils.importReview(reference.testCollection.collectionId, reference.testAsset.assetId, reference.testAsset.testRuleId)\n          await utils.importReview(reference.testCollection.collectionId, reference.testCollection.lvl1ReadOnlyAssetId, reference.testAsset.testRuleId)\n        })\n        \n        it('Delete a Review', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testAsset.testRuleId}?projection=rule&projection=history&projection=stigs`, 'DELETE', iteration.token)\n\n          expect(res.status).to.eql(200)\n          expect(res.body.assetId).to.equal(reference.testAsset.assetId)\n          expect(res.body.rule.ruleId).to.equal(reference.testAsset.testRuleId)\n          expect(res.body.stigs).to.be.an('array').of.length(reference.testAsset.testRuleIdStigCount)\n\n          for(const history of res.body.history) {\n            expect(history.ruleId).to.equal(reference.testAsset.testRuleId)\n          }\n\n          for(const stig of res.body.stigs) { \n            expect(reference.testAsset.validStigs).to.include(stig.benchmarkId)\n          }\n       \n        })\n\n        it(\"Delete review that is read only for lvl1 user, expect 403 for lvl1 iteration\", async () => {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testCollection.lvl1ReadOnlyAssetId}/${reference.testAsset.testRuleId}`, 'DELETE', iteration.token)\n\n            if(iteration.name === \"lvl1\") {\n            expect(res.status).to.eql(403)\n          }\n          else {\n            expect(res.status).to.eql(200)\n          }\n        })\n\n        it('should return 403 for deleted collection', async () => {\n          const res = await utils.executeRequest(\n            `${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testAsset.testRuleId}`,\n            'DELETE',\n            iteration.token\n          )\n          expect(res.status).to.eql(403)\n        })\n      })\n\n      describe('DELETE - deleteReviewMetadataKey - /collections/{collectionId}/reviews/{assetId}/{ruleId}/metadata/keys/{key}', () => {\n\n        let review = null\n        before(async function () {\n          review = await utils.importReview(reference.testCollection.collectionId, reference.testAsset.assetId, reference.testAsset.testRuleId)\n        })\n\n        it('should create metadata to be deleted', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PUT', iteration.token, {[reference.reviewMetadataKey]: reference.reviewMetadataValue})\n          expect(res.status).to.eql(200)\n          expect(res.body).to.eql({[reference.reviewMetadataKey]: reference.reviewMetadataValue})\n\n        })\n        it('Delete one metadata key/value of a Review', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testAsset.testRuleId}/metadata/keys/${reference.reviewMetadataKey}`, 'DELETE', iteration.token, `${JSON.stringify(reference.reviewMetadataValue)}`)\n        \n          expect(res.status).to.eql(204)\n        })\n\n        it('should return 403 for deleted collection', async () => {\n          const res = await utils.executeRequest(\n            `${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testAsset.testRuleId}/metadata/keys/${reference.reviewMetadataKey}`,\n            'DELETE',\n            iteration.token,\n            `${JSON.stringify(reference.reviewMetadataValue)}`\n          )\n          expect(res.status).to.eql(403)\n        })\n      })\n    })\n  }\n})"
  },
  {
    "path": "test/api/mocha/data/review/reviewGet.test.js",
    "content": "\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport { expect } from 'chai'\n\ndescribe('GET - Review', () => {\n  \n  before(async function () {\n    await utils.loadAppData()\n  })\n\n  for(const iteration of iterations){\n    if (expectations[iteration.name] === undefined){\n      it(`No expectations for this iteration scenario: ${iteration.name}`, async () => {})\n      continue\n    }\n    describe(`iteration:${iteration.name}`, () => {\n      const distinct = expectations[iteration.name]\n      describe('GET - getReviewsByCollection - /collections/{collectionId}/reviews', () => {\n        \n        it('Return a list of reviews accessible to the requester', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?projection=rule&projection=stigs&projection=metadata`, 'GET', iteration.token)\n\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n\n          for(let review of res.body){\n            if(iteration.name === 'lvl1'){\n              if(review.assetId === \"62\"){\n                expect(review.access).to.be.equal('r')\n              }\n              if(review.assetId === \"154\" && review.ruleId === reference.testCollection.benchmark){\n                expect(review.access).to.be.equal('r')\n              }\n            }\n            else {\n              expect(review.access).to.be.equal('rw')\n            }\n            expect(review.assetId).to.be.oneOf(reference.testCollection.assetIds)\n            for(let assetLabelId of review.assetLabelIds){\n              expect(assetLabelId).to.be.oneOf(reference.testAsset.labels)\n            }\n            for(let stig of review.stigs){\n              expect(stig.benchmarkId).to.be.oneOf(reference.testCollection.validStigs)\n            }\n            if(review.assetId === reference.testAsset.assetId){\n              expect(review.status.label).to.be.oneOf(['saved', 'submitted'])\n              expect(review.ruleId).to.be.oneOf(reference.testAsset.reviewRuleIds)\n            }\n          }\n        })\n        it('Return a list of reviews accessible to the requester, assetId Projection.', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?assetId=${reference.testAsset.assetId}&projection=rule&projection=stigs&projection=metadata`, 'GET', iteration.token)\n  \n          expect(res.status).to.eql(200)\n    \n          expect(res.body).to.be.lengthOf(distinct.testAsset.reviewsAvailableToUser)\n\n          for(let review of res.body){\n            expect(review.access).to.be.equal('rw')\n            expect(review.assetId).to.be.equal(reference.testAsset.assetId)\n            for(let assetLabelId of review.assetLabelIds){\n              expect(assetLabelId).to.be.oneOf(reference.testAsset.labels)\n            }\n            expect(review.assetLabels).to.deep.equalInAnyOrder(reference.testAsset.fullLabels)\n            for(let stig of review.stigs){\n              expect(stig).to.have.property('benchmarkId')\n              expect(stig.benchmarkId).to.be.oneOf(reference.testCollection.validStigs)\n            }\n            if(review.assetId === reference.testAsset.assetId){\n              expect(review.status.label).to.be.oneOf(['saved', 'submitted'])\n              expect(review.ruleId).to.be.oneOf(reference.testAsset.reviewRuleIds)\n            }\n          }\n        })\n        it('Return a list of reviews accessible to the requester, benchmarkId Projection.', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?benchmarkId=${reference.benchmark}&projection=rule&projection=stigs&projection=metadata`, 'GET', iteration.token)\n         \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.lengthOf(distinct.testCollection.reviewsForTestBenchmark)\n          for(let review of res.body){\n            if(iteration.name === 'lvl1'){\n              if(review.assetId === \"62\"){\n                expect(review.access).to.be.equal('r')\n              }\n              if(review.assetId === \"154\" && review.ruleId === reference.testCollection.benchmark){\n                expect(review.access).to.be.equal('r')\n              }\n            }\n            else {\n              expect(review.access).to.be.equal('rw')\n            }\n            for(let stig of review.stigs){\n              expect(stig).to.have.property('benchmarkId')\n              expect(stig.benchmarkId).to.be.equal(reference.testCollection.benchmark)\n            }        \n          }\n        })\n        it('Return a list of reviews accessible to the requester, metadata Projection.', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?projection=rule&projection=stigs&metadata=${reference.reviewMetadataKey}%3A${reference.reviewMetadataValue}&projection=metadata`, 'GET', iteration.token)\n         \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n          expect(res.body).to.be.lengthOf(1)\n\n          for(let review of res.body){\n            expect(review.metadata).to.be.an('object')\n            expect(review.metadata).to.have.property(reference.reviewMetadataKey)\n            expect(review.metadata[reference.reviewMetadataKey]).to.be.equal(reference.reviewMetadataValue)\n          }\n        })\n        it('Return a list of reviews accessible to the requester, metadata Projection. issue 1357', async () => {\n          const tempCollectionWithMetadata = await utils.createTempCollection(\n            {\n              name: 'tempCollection' + utils.getUUIDSubString(),\n              description: 'Collection TEST description',\n              settings: {\n                fields: {\n                  detail: {\n                    enabled: 'always',\n                    required: 'findings'\n                  },\n                  comment: {\n                    enabled: 'always',\n                    required: 'findings'\n                  }\n                },\n                status: {\n                  canAccept: true,\n                  minAcceptGrant: 2,\n                  resetCriteria: 'result'\n                },\n                history: {\n                  maxReviews: 11\n                },\n                importOptions: {\n                  autoStatus: {\n                    fail: \"submitted\",\n                    notapplicable: \"submitted\",\n                    pass: \"submitted\",\n                  },\n                  unreviewed: \"commented\",\n                  unreviewedCommented: \"informational\",\n                  emptyDetail: \"replace\",\n                  emptyComment: \"ignore\",\n                  allowCustom: true\n                }\n              },\n              metadata: {\n                testKey: 'test:value',\n              },\n              grants: [\n                {\n                  userId: '1',\n                  roleId: 4\n                },\n                {\n                  userId: '85',\n                  roleId: 1\n                }\n              ],\n              labels: [\n              ]\n            })\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${tempCollectionWithMetadata.collectionId}/reviews?projection=rule&projection=stigs&metadata=testKey%3Atest%3Avalue&projection=metadata`, 'GET', iteration.token)\n          if(iteration.name === 'lvl2' || iteration.name === 'lvl3' || iteration.name === 'lvl4') {\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n          expect(res.body).to.be.lengthOf(0)\n        })\n        it('Return a list of reviews accessible to the requester, result projection fail only', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?result=fail&projection=rule&projection=stigs&projection=metadata`, 'GET', iteration.token)\n         \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n          expect(res.body).to.be.lengthOf(distinct.testCollection.reviewsForResultFailAllAssets)\n        \n          for(let review of res.body){\n            expect(review.result).to.be.equal('fail')\n          }\n        })\n        it('Return a list of reviews accessible to the requester, ruleid projection', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?ruleId=${reference.testCollection.ruleId}&projection=rule&projection=stigs&projection=metadata`, 'GET', iteration.token)\n          \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.lengthOf(distinct.testCollection.reviewsForTestRuleId)\n\n          for(let review of res.body){\n            expect(review.ruleId).to.be.equal(reference.testCollection.ruleId)\n            expect(review.rule.ruleId).to.be.equal(reference.testCollection.ruleId)\n            expect(review.ruleIds).to.include(reference.testCollection.ruleId)\n          }\n        })\n        it('Return a list of reviews accessible to the requester, status projection: saved.', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?status=saved&projection=rule&projection=stigs&projection=metadata`, 'GET', iteration.token)\n        \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n          expect(res.body).to.be.lengthOf(distinct.testCollection.reviewsForStatusSaved)\n\n          for(let review of res.body){\n            expect(review.status.label).to.be.equal('saved')\n          }\n        })\n        it('Return a list of reviews accessible to the requester, userId projection.', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?userId=${reference.stigmanadmin.userId}&projection=rule&projection=stigs&projection=metadata`, 'GET', iteration.token)\n          \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.lengthOf(distinct.testCollection.reviewsForStigmanadmin)\n\n          for(let review of res.body){\n            expect(review.userId).to.be.equal(reference.stigmanadmin.userId)\n          }\n        })\n        it('Return a list of reviews accessible to the requester, cci prjections', async () => {\n          \n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?cci=${reference.testCci.id}`, 'GET', iteration.token)\n\n          expect(res.status).to.eql(200)\n        })\n        it('Return a list of reviews accessible to the requester, groupid', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?groupId=${reference.testGroupId}`, 'GET', iteration.token)\n\n          expect(res.status).to.eql(200)\n\n          expect(res.body).to.be.an('array').of.length(distinct.testCollection.reviewsForTestGroup)\n\n          for(let review of res.body){\n            expect(review.assetId).to.be.oneOf(reference.testCollection.assetIds)\n          }\n        })\n        it('Return a list of reviews accessible to the requester, rules=all', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?rules=all`, 'GET', iteration.token)\n\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array').of.length(distinct.testCollection.reviewsForRulesAll)\n\n          for(let review of res.body){\n            expect(review.assetId).to.be.oneOf(reference.testCollection.assetIds)\n          }\n        })\n        it('Return a list of reviews accessible to the requester, rules=default-mapped', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?rules=default-mapped`, 'GET', iteration.token)\n\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array').of.length(distinct.testCollection.reviewsForRulesAll)\n\n          for(let review of res.body){\n            expect(review.assetId).to.be.oneOf(reference.testCollection.assetIds)\n          }\n        })\n        it('Return a list of reviews accessible to the requester, rules=not-default', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?rules=not-default`, 'GET', iteration.token)\n\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array').of.length(distinct.testCollection.reviewsDefaultMapped)\n\n          for(let review of res.body){\n            expect(review.assetId).to.be.oneOf(reference.testCollection.assetIds)\n          }\n        })\n        it('Return a list of reviews accessible to the requester, rules=default', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?rules=default`, 'GET', iteration.token)\n\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array').of.length(distinct.testCollection.reviewsForRulesAll)\n\n          for(let review of res.body){\n            expect(review.assetId).to.be.oneOf(reference.testCollection.assetIds)\n          }\n        })\n        it('Return a list of reviews accessible to the requester, rules=not-default-mapped', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?rules=not-default-mapped`, 'GET', iteration.token)\n\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array').of.length(0)\n        })\n        it(\"should return 403 for deleted collection\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n      describe('GET - getReviewsByAsset - /collections/{collectionId}/reviews/{assetId}', () => {\n\n        it('Return a list of Reviews for an Asset', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}?projection=rule&projection=stigs&projection=metadata`, 'GET', iteration.token)\n   \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array').of.length(distinct.testAsset.reviewsAvailableToUser)\n          for(let review of res.body){\n            expect(review.assetId).to.be.equal(reference.testAsset.assetId)\n            for(let assetLabelId of review.assetLabelIds){\n              expect(assetLabelId).to.be.oneOf(reference.testAsset.labels)\n            }\n            expect(review.assetLabels).to.deep.equalInAnyOrder(reference.testAsset.fullLabels)\n            for(let stig of review.stigs){\n              expect(stig.benchmarkId).to.be.oneOf(reference.testAsset.validStigs)\n              \n            }\n            if(review.ruleId === reference.testAsset.testRuleId){\n              expect(review.metadata, \"metadata\").to.eql({[reference.reviewMetadataKey]: reference.reviewMetadataValue})\n              expect(review.status.label, \"expect review to be submitted\").to.be.oneOf(['submitted'])\n              expect(review.result, \"expect result to be pass\").to.eql('pass')\n              for(const stig of review.stigs){\n                expect(stig.benchmarkId, \"expect stig attached to be test bernchmark\").to.be.equal(reference.benchmark)\n                expect(stig.ruleCount, \"Expect 81 rules for vpn srg test\").to.be.equal(reference.checklistLength)\n                expect(stig.revisionStr, \"expect default reviison\").to.be.equal(reference.revisionStr)\n              }\n            }\n            else{\n              expect(review.metadata).to.be.empty\n            }\n          }\n        })\n        it(\"should return all reviews for asset ID 62, which is r only for lvl1 user\", async () => {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/62`, 'GET', iteration.token)\n          expect(res.status).to.eql(200)\n          //expect(res.body).to.be.an('array').of.length(2)\n          for(let review of res.body){\n            expect(review.assetId).to.be.equal(\"62\")\n            if(iteration.name === 'lvl1'){\n              expect(review.access).to.be.equal('r')\n            }\n            else {\n              expect(review.access).to.be.equal('rw')\n            }\n          }\n\n        })\n        it('Return a list of Reviews for an Asset, benchmarkId Projection.', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}?benchmarkId=${reference.benchmark}&projection=rule&projection=stigs&projection=metadata`, 'GET', iteration.token)\n         \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n          expect(res.body).to.be.lengthOf(reference.testAsset.testBenchmarkReviews)\n\n          for(let review of res.body){\n            expect(review.assetId).to.be.equal(reference.testAsset.assetId)\n            for(let stig of review.stigs){\n              expect(stig).to.have.property('benchmarkId')\n              expect(stig.benchmarkId).to.be.equal(reference.testCollection.benchmark)\n            }\n            if(review.ruleId === reference.testAsset.testRuleId){\n              expect(review.metadata, \"metadata\").to.eql({[reference.reviewMetadataKey]: reference.reviewMetadataValue})\n              expect(review.status.label, \"expect review to be submitted\").to.be.oneOf(['submitted'])\n              expect(review.result, \"expect result to be pass\").to.eql('pass')\n              for(const stig of review.stigs){\n                expect(stig.benchmarkId, \"expect stig attached to be test bernchmark\").to.be.equal(reference.benchmark)\n                expect(stig.ruleCount, \"Expect 81 rules for vpn srg test\").to.be.equal(reference.checklistLength)\n                expect(stig.revisionStr, \"expect default reviison\").to.be.equal(reference.revisionStr)\n              }\n            }\n          }\n        })\n        it(\"should return all review for assetID 154 which for lvl1 is r only on benchmark VPN_SRG_TEST\", async () => {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/154?benchmarkId=VPN_SRG_TEST`, 'GET', iteration.token)\n          expect(res.status).to.eql(200)\n          for(let review of res.body){\n            expect(review.assetId).to.be.equal(\"154\")\n            if(iteration.name === 'lvl1'){\n              expect(review.access).to.be.equal('r')\n            }\n            else {\n              expect(review.access).to.be.equal('rw')\n            }\n          }\n\n        })\n        it('Return a list of Reviews for an Asset , metadata Projection.', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}?projection=rule&projection=stigs&metadata=${reference.reviewMetadataKey}%3A${reference.reviewMetadataValue}&projection=metadata`, 'GET', iteration.token)\n  \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n          expect(res.body).to.be.lengthOf(1)\n\n          for(let review of res.body){\n            expect(review.assetId).to.be.equal(reference.testAsset.assetId)\n            expect(review.metadata).to.be.an('object')\n            expect(review.metadata).to.have.property(reference.reviewMetadataKey)\n            expect(review.metadata[reference.reviewMetadataKey]).to.be.equal(reference.reviewMetadataValue)\n          }\n        })\n        it('Return a list of reviews accessible to the requester, result projection pass only', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}?result=pass&projection=rule&projection=stigs&projection=metadata`, 'GET', iteration.token)\n         \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n         \n          expect(res.body).to.be.lengthOf(distinct.testAsset.reviewsForResultPass)\n        \n\n          for(let review of res.body){\n            expect(review.assetId).to.be.equal(reference.testAsset.assetId)\n            expect(review.result).to.be.equal('pass')\n          }\n        })\n        it('Return a list of reviews accessible to the requester, result projection fail only', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}?result=fail&projection=rule&projection=stigs&projection=metadata`, 'GET', iteration.token)\n         \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n          expect(res.body).to.be.lengthOf(distinct.testAsset.reviewsForResultFail)\n\n          for(let review of res.body){\n            expect(review.assetId).to.be.equal(reference.testAsset.assetId)\n            expect(review.result).to.be.equal('fail')\n          }\n        })\n        it('Return a list of reviews accessible to the requester, result projection informational only', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}?result=informational&projection=rule&projection=stigs&projection=metadata`, 'GET', iteration.token)\n         \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n          expect(res.body).to.be.lengthOf(0)\n\n          for(let review of res.body){\n            expect(review.assetId).to.be.equal(reference.testAsset.assetId)\n            expect(review.result).to.be.equal('informational')\n          }\n        })\n        it('Return a list of reviews accessible to the requester, status projection: saved.', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}?status=saved&projection=rule&projection=stigs&projection=metadata`, 'GET', iteration.token)\n          \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n          expect(res.body).to.be.lengthOf(distinct.testAsset.reviewsForStatusSaved)\n         \n\n          for(let review of res.body){\n            expect(review.assetId).to.be.equal(reference.testAsset.assetId)\n            expect(review.status.label).to.be.equal('saved')\n          }\n        })\n        it('Return a list of reviews accessible to the requester, status projection: submitted.', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}?status=submitted&projection=rule&projection=stigs&projection=metadata`, 'GET', iteration.token)\n         \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('array')\n          expect(res.body).to.be.lengthOf(distinct.testAsset.reviewsForStatusSubmitted)\n          \n          for(let review of res.body){\n            expect(review.assetId).to.be.equal(reference.testAsset.assetId)\n            expect(review.status.label).to.be.equal('submitted')\n          }\n        })\n        it(\"should return 403 for deleted collection\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews/${reference.testAsset.assetId}`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n        it(\"should return 403 for deleted asset\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.deletedAsset.assetId}`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n        it(\"should return 403 for deleted asset and collection\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews/${reference.deletedAsset.assetId}`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n      describe('GET - getReviewByAssetRule - /collections/{collectionId}/reviews/{assetId}/{ruleId}', () => {\n\n        it('Return the Review for an Asset and Rule', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}?projection=rule&projection=stigs&projection=metadata&projection=history`, 'GET', iteration.token)\n        \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('object')\n\n          const review = res.body\n        \n          // checking for basic properties\n          expect(review.rule.ruleId).to.be.equal(reference.testCollection.ruleId)\n          expect(review.metadata).to.have.property(reference.reviewMetadataKey)\n          expect(review.metadata[reference.reviewMetadataKey]).to.be.equal(reference.reviewMetadataValue)\n          for(let stig of review.stigs){\n            expect(stig.benchmarkId, \"expect stig attached to be test bernchmark\").to.be.equal(reference.benchmark)\n            expect(stig.ruleCount, \"Expect 81 rules for vpn srg test\").to.be.equal(reference.checklistLength)\n            expect(stig.revisionStr, \"expect default reviison\").to.be.equal(reference.revisionStr)\n          }\n          expect(review.assetLabelIds).to.include.members(reference.testAsset.labels)\n          expect(review.status.label, \"expect review to be submitted\").to.be.oneOf(['submitted'])\n          expect(review.result, \"expect result to be pass\").to.eql('pass')\n        })\n        it(\"should return 403 for deleted collection\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.scrapRuleIdWindows10}`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n        it(\"should return 403 for deleted asset\", async () => { \n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.deletedAsset.assetId}/${reference.scrapRuleIdWindows10}`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n        it(\"should return 403 for deleted asset and collection\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews/${reference.deletedAsset.assetId}/${reference.scrapRuleIdWindows10}`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n      })\n      describe('GET - getReviewMetadata - /collections/{collectionId}/reviews/{assetId}/{ruleId}/metadata', () => {\n        it('Return the metadata for a Review', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'GET', iteration.token)\n         \n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('object')\n          expect(res.body).to.have.property(reference.reviewMetadataKey)\n          expect(res.body[reference.reviewMetadataKey]).to.be.equal(reference.reviewMetadataValue)\n        })\n\n        it(\"should return 403 for deleted collection\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.scrapRuleIdWindows10}/metadata`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n\n        it(\"should return 403 for deleted asset\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.deletedAsset.assetId}/${reference.scrapRuleIdWindows10}/metadata`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n        // useless if we test other users \n        if(iteration.name === 'lvl1'){\n          it(\"should return SmError.PrivilegeError if user cannot access review\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.scrapRuleIdWindows10}/metadata`, 'GET', iteration.token)\n            expect(res.status).to.eql(403)\n            expect(res.body.error).to.be.equal(\"User has insufficient privilege to complete this request.\")\n          })\n        }\n      })\n      describe('GET - getReviewMetadataKeys - /collections/{collectionId}/reviews/{assetId}/{ruleId}/metadata/keys', () => {\n          \n          it('Return the Review Metadata KEYS for an Asset and Rule', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata/keys`, 'GET', iteration.token)\n          \n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array')\n            expect(res.body).to.be.lengthOf(1)\n            expect(res.body).to.include(reference.reviewMetadataKey)\n          })\n          it(\"should return 403 for deleted collection\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.scrapRuleIdWindows10}/metadata/keys`, 'GET', iteration.token)\n            expect(res.status).to.eql(403)\n          })\n          it(\"should return 403 for deleted asset\", async () => { \n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.deletedAsset.assetId}/${reference.scrapRuleIdWindows10}/metadata/keys`, 'GET', iteration.token)\n            expect(res.status).to.eql(403)\n          })\n      })\n      describe('GET - getReviewMetadataValue - /collections/{collectionId}/reviews/{assetId}/{ruleId}/metadata/keys/{key}', () => {\n\n        it('Return the Review Metadata VALUE for an Asset/Rule/metadata KEY', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata/keys/${reference.reviewMetadataKey}`, 'GET', iteration.token)\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('string')\n          expect(res.body).to.equal(reference.reviewMetadataValue)  \n        })\n        it('Should throw SmError.NotFoundError no metadatakey found', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata/keys/notakey`, 'GET', iteration.token)\n          expect(res.status).to.eql(404)\n          expect(res.body.error).to.be.equal(\"Resource not found.\")\n        })\n        it(\"should return 403 for deleted collection\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.scrapRuleIdWindows10}/metadata/keys/${reference.reviewMetadataKey}`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n        it(\"should return 403 for deleted asset\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.deletedAsset.assetId}/${reference.scrapRuleIdWindows10}/metadata/keys/${reference.reviewMetadataKey}`, 'GET', iteration.token)\n          expect(res.status).to.eql(403)\n        })\n        // useless if we test other users\n      })\n    })\n  }\n})"
  },
  {
    "path": "test/api/mocha/data/review/reviewPatch.test.js",
    "content": "import {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {requestBodies} from \"./requestBodies.js\"\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport { expect } from 'chai'\n\ndescribe('PATCH - Review', () => {\n\n  before(async function () {\n      await utils.loadAppData()\n  })\n  \n  for(const iteration of iterations) {\n    if (expectations[iteration.name] === undefined){\n      it(`No expectations for this iteration scenario: ${iteration.name}`, async () => {})\n      continue\n    }\n    describe(`iteration:${iteration.name}`, () => {\n      const distinct = expectations[iteration.name]\n      describe('PATCH - patchReviewByAssetRule - /collections/{collectionId}/reviews/{assetId}/{ruleId}', () => {\n\n        beforeEach(async function () {\n          await utils.putReviewByAssetRule(reference.testCollection.collectionId, reference.testAsset.assetId, reference.testCollection.ruleId, requestBodies.resetRule)\n        })\n        it('PATCH Review with new details, expect status to remain', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PATCH', iteration.token, {detail:\"these details have changed, but the status remains\"})\n       \n          expect(res.status).to.eql(200)\n          expect(res.body.status).to.have.property('label').that.equals('submitted')\n        })\n        it('PATCH Review with new result, expect status to reset to saved', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PATCH', iteration.token, {result: \"pass\"})\n           \n            expect(res.status).to.eql(200)\n            expect(res.body.result).to.eql(\"pass\")\n            expect(res.body.status).to.have.property('label').that.equals('saved')\n        })\n        it('PATCH Review to submitted status', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PATCH', iteration.token, {status: \"submitted\"})\n           \n            expect(res.status).to.eql(200)\n            expect(res.body.status).to.have.property('label').that.equals('submitted')\n        })\n        it('PATCH Review patched and no longer meets Collection Requirements', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PATCH', iteration.token, {result: \"fail\"})\n           \n            expect(res.status).to.eql(200)\n            expect(res.body.result).to.eql(\"fail\")\n            expect(res.body.status).to.have.property('label').that.equals('saved')\n        })\n        it('PATCH Review to Accepted', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PATCH', iteration.token, {status: \"accepted\"})\n          \n          if(iteration.name === \"lvl1\" || iteration.name === \"lvl2\") {\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.have.property(\"touchTs\").to.eql(res.body.status.ts)\n        })\n        it('Merge provided properties with a Review', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PATCH', iteration.token, {\n              result: \"pass\",\n              detail: \"test\\nvisible to lvl1\",\n              comment: \"sure\",\n              status: \"submitted\",\n            })\n          \n          expect(res.status).to.eql(200)\n          expect(res.body.status.label).to.eql(\"submitted\")    \n          expect(res.body.result).to.eql(\"pass\")\n          expect(res.body.detail).to.eql(\"test\\nvisible to lvl1\")\n          expect(res.body.comment).to.eql(\"sure\")\n        })\n        it(\"patch review that is read only for lvl1 user expect 403 for lvl1 user iteration \", async () => {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testCollection.lvl1ReadOnlyAssetId}/${reference.testCollection.ruleId}`, 'PATCH', iteration.token, {\n              result: \"pass\",\n              detail: \"test\\nvisible to lvl1\",\n              comment: \"sure\",\n              status: \"submitted\",\n            })\n          if(iteration.name === \"lvl1\") {\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n        })\n        it('should return 403 for deleted collection', async () => {\n          const res = await utils.executeRequest(\n            `${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`,\n            'PATCH',\n            iteration.token,\n            { detail: \"irrelevant\" }\n          )\n          expect(res.status).to.eql(403)\n        })\n      })\n      describe('PATCH - patchReviewMetadata - /collections/{collectionId}/reviews/{assetId}/{ruleId}/metadata', () => {\n\n        it('Merge metadata property/value into a Review', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PATCH', iteration.token, {[reference.reviewMetadataKey]: reference.reviewMetadataValue})\n        \n          expect(res.status).to.eql(200)\n          expect(res.body).to.eql({[reference.reviewMetadataKey]: reference.reviewMetadataValue})\n        \n        })\n        it(\"patch review metadata to asset with read only for lvl1 user expect 403 for lvl1 user iteration \", async () => {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testCollection.lvl1ReadOnlyAssetId}/${reference.testCollection.ruleId}/metadata`, 'PATCH', iteration.token, {[reference.reviewMetadataKey]: reference.reviewMetadataValue})\n          if(iteration.name === \"lvl1\") {\n            expect(res.status).to.eql(403)\n            return\n          }\n          expect(res.status).to.eql(200)\n\n        })\n        it(\"should return SmError.PrivilegeError if user cannot modify review\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.scrapRuleIdWindows10}/metadata`, 'GET', iteration.token)\n          if(distinct.canPatchReview){\n            expect(res.status).to.eql(200)\n            return\n          }\n          expect(res.status).to.eql(403)\n          expect(res.body.error).to.be.equal(\"User has insufficient privilege to complete this request.\")\n        })\n        it('should return 403 for deleted collection', async () => {\n          const res = await utils.executeRequest(\n            `${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`,\n            'PATCH',\n            iteration.token,\n            { [reference.reviewMetadataKey]: reference.reviewMetadataValue }\n          )\n          expect(res.status).to.eql(403)\n        })\n      })\n    })\n  }\n})\n\n"
  },
  {
    "path": "test/api/mocha/data/review/reviewPost.test.js",
    "content": "\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\n\nconst otherTestRuleId = \"SV-106181r1_rule\"\n\ndescribe('POST - Review', () => {\n\n  for(const iteration of iterations){\n    if (expectations[iteration.name] === undefined){\n      it(`No expectations for this iteration scenario: ${iteration.name}`, async () => {})\n      continue\n    }\n    describe(`iteration:${iteration.name}`, () => {\n      const distinct = expectations[iteration.name]\n      describe('POST - postReviewBatch - /collections/{collectionId}/reviews', () => {\n\n        describe(`Batch Review Editing basic (no actions or update filters)`, () => {\n\n            before(async function () {\n                await utils.loadAppData(\"batch-test-data.jsonl\")\n                await utils.deleteReview(21, 62, \"SV-106181r1_rule\")\n                await utils.deleteReview(21, 62, \"SV-106181r1_rule\")\n                await utils.deleteReview(21, 29, \"SV-106181r1_rule\")\n                await utils.deleteReview(21, 29, \"SV-106181r1_rule\")\n                await utils.deleteReview(21, 62, \"SV-106179r1_rule\")\n                await utils.deleteReview(21, 62, \"SV-106179r1_rule\")\n                await utils.deleteReview(21, 29, \"SV-106179r1_rule\")\n                await utils.deleteReview(21, 29, \"SV-106179r1_rule\")\n            })\n            afterEach(async function () {\n              await utils.deleteReview(21, 62, \"SV-106181r1_rule\")\n              await utils.deleteReview(21, 62, \"SV-106181r1_rule\")\n              await utils.deleteReview(21, 29, \"SV-106181r1_rule\")\n              await utils.deleteReview(21, 29, \"SV-106181r1_rule\")\n              await utils.deleteReview(21, 62, \"SV-106179r1_rule\")\n              await utils.deleteReview(21, 62, \"SV-106179r1_rule\")\n              await utils.deleteReview(21, 29, \"SV-106179r1_rule\")\n              await utils.deleteReview(21, 29, \"SV-106179r1_rule\")\n            })\n\n            it(`POST batch review: target assets, whole stig`, async () => {\n\n              const postreview = {\n                source: {\n                  review: {\n                    result: 'fail',\n                    detail: 'tesetsetset'\n                  }\n                },\n                assets: {\n                  assetIds: ['62', '29']\n                },\n                rules: {\n                  benchmarkIds: ['VPN_SRG_TEST_Batch']\n                }\n              }\n\n              const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n              \n              expect(res.status).to.eql(200)\n            \n              const reviews = await utils.getReviews(reference.testCollection.collectionId)\n            \n              expect(res.body.inserted).to.eql(distinct.postReviews.targetAssetsWholeStig.inserted)\n              expect(res.body.updated).to.eql(distinct.postReviews.targetAssetsWholeStig.updated)\n              expect(res.body.failedValidation).to.eql(distinct.postReviews.targetAssetsWholeStig.failedValidation)\n              expect(res.body.validationErrors).to.have.length(distinct.postReviews.targetAssetsWholeStig.validationErrors)\n              expect(reviews).to.have.lengthOf(distinct.postReviews.targetAssetsWholeStig.reviewsLength)\n\n              for(let review of reviews){\n                expect(review.assetId).to.be.oneOf([\"62\", \"29\"])\n                expect(review.ruleId).to.be.oneOf([reference.testCollection.ruleId, otherTestRuleId])\n                expect(review.result).to.equal(postreview.source.review.result)\n                expect(review.detail).to.equal(postreview.source.review.detail)\n                expect(review.status.label).to.equal(\"saved\")\n                expect(review.status.user.username).to.equal(iteration.name)\n                expect(review.username).to.equal(iteration.name)\n              }\n            })\n            it(`POST batch Review: target by assets, and one rule`, async () => {\n\n              const postreview = {\n                source: {\n                  review: {\n                    result: 'fail',\n                    detail: 'tesetsetset'\n                  }\n                },\n                assets: {\n                  assetIds: ['62', '29']\n                },\n                rules: {\n                    ruleIds: ['SV-106179r1_rule']\n                  }\n              }\n\n              const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n              \n              expect(res.status).to.eql(200)\n\n              const reviews = await utils.getReviews(reference.testCollection.collectionId)\n              \n              expect(res.body.inserted).to.eql(distinct.postReviews.targetAssetsOneRule.inserted)\n              expect(res.body.updated).to.eql(distinct.postReviews.targetAssetsOneRule.updated)\n              expect(res.body.failedValidation).to.eql(distinct.postReviews.targetAssetsOneRule.failedValidation)\n              expect(res.body.validationErrors).to.have.length(distinct.postReviews.targetAssetsOneRule.validationErrors)\n              expect(reviews).to.have.lengthOf(distinct.postReviews.targetAssetsOneRule.reviewsLength)\n\n              for(let review of reviews){\n                expect(review.assetId).to.be.oneOf([\"62\", \"29\"])\n                expect(review.ruleId).to.be.equal(reference.testCollection.ruleId)\n                expect(review.result).to.equal(postreview.source.review.result)\n                expect(review.detail).to.equal(postreview.source.review.detail)\n                expect(review.status.label).to.equal(\"saved\")\n                expect(review.status.user.username).to.equal(iteration.name)\n                expect(review.username).to.equal(iteration.name)\n              }\n            })\n            it(`POST batch Review: target by assets, and rule`, async () => {\n\n              const postreview = {\n                source: {\n                  review: {\n                    result: 'fail',\n                    detail: 'tesetsetset'\n                  }\n                },\n                assets: {\n                  benchmarkIds: ['VPN_SRG_TEST_Batch']\n                },\n                rules: {\n                    ruleIds: ['SV-106179r1_rule']\n                  }\n                }\n\n              const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n          \n              expect(res.status).to.eql(200)\n              const reviews = await utils.getReviews(reference.testCollection.collectionId)\n              expect(res.body.inserted).to.eql(distinct.postReviews.targetAssetsAndRule.inserted)\n              expect(res.body.updated).to.eql( distinct.postReviews.targetAssetsAndRule.updated)\n              expect(res.body.failedValidation).to.eql(distinct.postReviews.targetAssetsAndRule.failedValidation)\n              expect(res.body.validationErrors).to.have.length(distinct.postReviews.targetAssetsAndRule.validationErrors)\n              expect(reviews).to.have.lengthOf(distinct.postReviews.targetAssetsAndRule.reviewsLength)\n\n              for(let review of reviews){\n                expect(review.assetId).to.be.oneOf([\"62\", \"29\"])\n                expect(review.ruleId).to.be.equal(reference.testCollection.ruleId)\n                expect(review.result).to.equal(postreview.source.review.result)\n                expect(review.detail).to.equal(postreview.source.review.detail)\n                expect(review.status.label).to.equal(\"saved\")\n                expect(review.status.user.username).to.equal(iteration.name)\n                expect(review.username).to.equal(iteration.name)\n              }\n            })\n            it(`POST batch review: target stig, whole stig`, async () => {\n\n              const postreview = {\n                source: {\n                  review: {\n                    result: 'fail',\n                    detail: 'tesetsetset'\n                  }\n                },\n                assets: {\n                  benchmarkIds: ['VPN_SRG_TEST_Batch']\n                },\n                rules: {\n                    benchmarkIds: ['VPN_SRG_TEST_Batch']\n                  }\n                }\n\n              const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n            \n              expect(res.status).to.eql(200)\n              expect(res.body).to.be.an('object')\n              expect(res.body).to.have.property('failedValidation')\n              expect(res.body).to.have.property('updated')\n              expect(res.body).to.have.property('inserted')\n              const reviews = await utils.getReviews(reference.testCollection.collectionId)\n\n              expect(res.body.inserted).to.eql(distinct.postReviews.targetStigWholeStig.inserted)\n              expect(res.body.updated).to.eql(distinct.postReviews.targetStigWholeStig.updated)\n              expect(res.body.failedValidation).to.eql(distinct.postReviews.targetStigWholeStig.failedValidation)\n              expect(res.body.validationErrors).to.have.length(distinct.postReviews.targetStigWholeStig.validationErrors)\n              expect(reviews).to.have.lengthOf(distinct.postReviews.targetStigWholeStig.reviewsLength)\n            \n              for(let review of reviews){\n                expect(review.assetId).to.be.oneOf([\"62\", \"29\"])\n                expect(review.ruleId).to.be.oneOf([reference.testCollection.ruleId, otherTestRuleId])\n                expect(review.result).to.equal(postreview.source.review.result)\n                expect(review.detail).to.equal(postreview.source.review.detail)\n                expect(review.status.label).to.equal(\"saved\")\n                expect(review.status.user.username).to.equal(iteration.name)\n                expect(review.username).to.equal(iteration.name)\n              }\n            })\n        })\n        describe(`Batch Review Editing update asset 69, insert on asset 29`, () => {\n\n          before(async function () {\n            await utils.loadAppData(\"batch-test-data.jsonl\")\n          })\n\n          it(\"create a review for asset 62, rule SV-106179r1_rule\", async () => {\n            const postreview = {\n              source: {\n                review: {\n                  result: 'pass',\n                  detail: 'testbatch'\n                }\n              },\n              assets: {\n                assetIds: ['62']\n              },\n              rules: {\n                ruleIds: ['SV-106179r1_rule']\n              }\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n\n            expect(res.status).to.eql(200)\n\n            expect(res.body.inserted).to.eql(1)\n            expect(res.body.updated).to.eql(0)\n            expect(res.body.failedValidation).to.eql(0)\n            expect(res.body.validationErrors).to.have.length(0)  \n          })\n\n          it(`should update asset 62 and insert new review for asset 29`, async () => {\n\n            const postreview = {\n              source: {\n                review: {\n                  result: 'fail',\n                  detail: 'tesetsetset'\n                }\n              },\n              assets: {\n                assetIds: ['62', '29']\n              },\n              rules: {\n                  ruleIds: ['SV-106179r1_rule']\n                }\n              }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n          \n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body).to.have.property('failedValidation')\n            expect(res.body).to.have.property('updated')\n            expect(res.body).to.have.property('inserted')\n\n            const reviews = await utils.getReviews(reference.testCollection.collectionId)\n            \n            expect(res.body.inserted).to.eql(distinct.postReviews.update62Insert29.inserted)\n            expect(res.body.updated).to.eql(distinct.postReviews.update62Insert29.updated)\n            expect(res.body.failedValidation).to.eql(distinct.postReviews.update62Insert29.failedValidation)\n            expect(res.body.validationErrors).to.have.length(distinct.postReviews.update62Insert29.validationErrors)\n            expect(reviews).to.have.lengthOf(distinct.postReviews.update62Insert29.reviewsLength)\n\n          })\n        })\n        describe(`Batch Review Editing - actions`, () => {\n\n          before(async function () {\n            await utils.loadAppData(\"batch-test-data.jsonl\")\n          })\n\n          it(\"create a review for asset 62, rule SV-106179r1_rule\", async () => {\n            const postreview = {\n              source: {\n                review: {\n                  result: 'pass',\n                  detail: 'testbatch'\n                }\n              },\n              assets: {\n                assetIds: ['62']\n              },\n              rules: {\n                ruleIds: ['SV-106179r1_rule']\n              }\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n\n            expect(res.status).to.eql(200)\n\n            expect(res.body.inserted).to.eql(1)\n            expect(res.body.updated).to.eql(0)\n            expect(res.body.failedValidation).to.eql(0)\n            expect(res.body.validationErrors).to.have.length(0)  \n          })\n\n          it(`POST batch review: target stig, whole stig - ACTION: insert. 62 already has review this should not be done`, async () => {\n\n            const postreview = {\n              source: {\n                review: {\n                  result: 'fail',\n                  detail: 'tesetsetset'\n                }\n              },\n              assets: {\n                assetIds: ['62', '29']\n              },\n              rules: {\n                  ruleIds: ['SV-106179r1_rule']\n                },\n                action: \"insert\"\n              }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n          \n            expect(res.status).to.eql(200)\n    \n            const reviews = await utils.getReviews(reference.testCollection.collectionId)\n\n            expect(res.body.inserted).to.eql(distinct.postReviews.targetStigWholeStigInsert.inserted)\n            // key here is updated is 0\n            expect(res.body.updated).to.eql(distinct.postReviews.targetStigWholeStigInsert.updated)\n            expect(res.body.failedValidation).to.eql(distinct.postReviews.targetStigWholeStigInsert.failedValidation)\n            expect(res.body.validationErrors).to.have.length(distinct.postReviews.targetStigWholeStigInsert.validationErrors)\n            expect(reviews).to.have.lengthOf(distinct.postReviews.targetStigWholeStigInsert.reviewsLength)\n            \n            for(let review of reviews){\n              expect(review.assetId).to.be.oneOf([\"62\", \"29\"])\n              expect(review.ruleId).to.be.equal(reference.testCollection.ruleId)\n              if(review.assetId == 62){\n                expect(review.result).to.equal(\"pass\")\n                expect(review.detail).to.equal(\"testbatch\")\n              }\n              else {\n                expect(review.result).to.equal(postreview.source.review.result)\n                expect(review.detail).to.equal(postreview.source.review.detail)\n              }\n              expect(review.status.label).to.equal(\"saved\")\n              expect(review.status.user.username).to.equal(iteration.name)\n              expect(review.username).to.equal(iteration.name)\n            }\n          })\n\n          it(\"delete the review for asset 62, rule SV-106179r1_rule\", async () => {\n            const res = await utils.deleteReview(21, 62, \"SV-106179r1_rule\")\n            expect(res).to.have.property(\"assetId\")\n          })\n           \n          it(`POST batch review: target stig, whole stig - ACTION: merge, should update on asset 29 and insert on asset 62`, async () => {\n\n            const postreview = {\n              source: {\n                review: {\n                  result: 'pass',\n                  detail: 'testbatch'\n                }\n              },\n              assets: {\n                assetIds: ['62', '29']\n              },\n              rules: {\n                  ruleIds: ['SV-106179r1_rule']\n                },\n                action: \"merge\"\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n           \n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body).to.have.property('failedValidation')\n            expect(res.body).to.have.property('updated')\n            expect(res.body).to.have.property('inserted')\n\n            const reviews = await utils.getReviews(reference.testCollection.collectionId)\n            \n            expect(res.body.inserted).to.eql(distinct.postReviews.targetStigWholeStigMerge.inserted)\n            expect(res.body.updated).to.eql(distinct.postReviews.targetStigWholeStigMerge.updated)\n            expect(res.body.failedValidation).to.eql(distinct.postReviews.targetStigWholeStigMerge.failedValidation)\n            expect(res.body.validationErrors).to.have.length(distinct.postReviews.targetStigWholeStigMerge.validationErrors)\n            expect(reviews).to.have.lengthOf(distinct.postReviews.targetStigWholeStigMerge.reviewsLength)\n\n            for(let review of reviews){\n              expect(review.assetId).to.be.oneOf([\"62\", \"29\"])\n              expect(review.ruleId).to.be.equal(reference.testCollection.ruleId)\n              expect(review.result).to.equal(postreview.source.review.result)\n              expect(review.detail).to.equal(postreview.source.review.detail)\n              expect(review.status.label).to.equal(\"saved\")\n              expect(review.status.user.username).to.equal(iteration.name)\n              expect(review.username).to.equal(iteration.name)\n            }\n          })\n        })\n        describe(`Batch Review Editing - update action with update filters`, () => {\n          \n          before(async function () {\n            await utils.loadAppData(\"batch-test-data.jsonl\")\n          })\n\n          it(\"create a review for asset 62, rule SV-106179r1_rule (uses stigmanadmin token)\", async () => {\n            const postreview = {\n              source: {\n                review: {\n                  result: 'pass',\n                  detail: 'testbatch'\n                }\n              },\n              assets: {\n                assetIds: ['62']\n              },\n              rules: {\n                ruleIds: ['SV-106179r1_rule']\n              }\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iterations[0].token, postreview)\n\n            expect(res.status).to.eql(200)\n\n            expect(res.body.inserted).to.eql(1)\n            expect(res.body.updated).to.eql(0)\n            expect(res.body.failedValidation).to.eql(0)\n            expect(res.body.validationErrors).to.have.length(0)  \n          })\n          it(`POST batch review: update but with exclusionary updateFilters`, async () => {\n            const postreview = {\n              source: {\n                review: {\n                  result: 'fail',\n                  detail: 'testUpdateFilter'\n                }\n              },\n              assets: {\n                assetIds: ['62', '29']\n              },\n              rules: {\n                ruleIds: ['SV-106179r1_rule']\n              },\n              updateFilters: [\n                {\n                  field: 'result',\n                  value: 'pass'\n                }\n              ],\n              action: 'update'\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n           \n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body).to.have.property('failedValidation')\n            expect(res.body).to.have.property('updated')\n            expect(res.body).to.have.property('inserted')\n\n            expect(res.body.inserted).to.eql(0)\n            expect(res.body.updated).to.eql(1)\n            expect(res.body.failedValidation).to.eql(0)\n            expect(res.body.validationErrors).to.have.length(0)\n\n            const reviews = await utils.getReviews(reference.testCollection.collectionId)\n            expect(reviews).to.have.lengthOf(1)\n            \n            for(let review of reviews){\n              if(review.ruleId == reference.testCollection.ruleId){\n                expect(review.resultEngine).to.eql(null)\n                expect(review.status.label).to.eql(\"saved\")\n                expect(review.status.user.username).to.eql(\"stigmanadmin\")\n                expect(review.username).to.eql(iteration.name)\n                expect(review.result).to.eql(\"fail\")\n                expect(review.detail).to.eql(\"testUpdateFilter\")\n              }\n            }\n          })\n          it(\"create a review for asset 62, rule SV-106179r1_rule (uses stigmanadmin token)\", async () => {\n            const postreview = {\n              source: {\n                review: {\n                  result: 'pass',\n                  detail: 'testbatch'\n                }\n              },\n              assets: {\n                assetIds: ['62']\n              },\n              rules: {\n                ruleIds: ['SV-106179r1_rule']\n              }\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iterations[0].token, postreview)\n\n            expect(res.status).to.eql(200)\n\n            expect(res.body.inserted).to.eql(0)\n            expect(res.body.updated).to.eql(1)\n            expect(res.body.failedValidation).to.eql(0)\n            expect(res.body.validationErrors).to.have.length(0)  \n          })\n          it(`POST batch review: update -  updateFilters update reviews where stigmanadmin (userid 1) reviews the asset. should only update 62 asset`, async () => {\n\n            const postreview = {\n              source: {\n                review: {\n                  result: 'fail',\n                  detail: 'testUserFilter'\n                }\n              },\n              assets: {\n                assetIds: ['62', '29']\n              },\n              rules: {\n                ruleIds: ['SV-106179r1_rule']\n              },\n              updateFilters: [\n                {\n                  field: 'userId',\n                  value: '1'\n                }\n              ],\n              action: 'update'\n              }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n          \n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body).to.have.property('failedValidation')\n            expect(res.body).to.have.property('updated')\n            expect(res.body).to.have.property('inserted')\n\n            expect(res.body.inserted).to.eql(0)\n            expect(res.body.updated).to.eql(1)\n            expect(res.body.failedValidation).to.eql(0)\n            expect(res.body.validationErrors).to.have.length(0)\n\n            const reviews = await utils.getReviews(reference.testCollection.collectionId)\n            \n            expect(reviews).to.have.lengthOf(1)\n\n            for(let review of reviews){\n              expect(review.assetId).to.eql(\"62\")\n              expect(review.ruleId).to.eql(reference.testCollection.ruleId)\n              expect(review.status.label).to.eql(\"saved\")\n              expect(review.status.user.username).to.eql(\"stigmanadmin\")\n              expect(review.username).to.eql(iteration.name)\n              expect(review.result).to.eql(postreview.source.review.result)\n              expect(review.detail).to.eql(postreview.source.review.detail)\n            } \n            \n          })\n          it(`POST batch review: update - updateFilters- before date`, async () => {\n\n            const currentTime = new Date().toISOString()\n\n            const postreview = {\n              source: {\n                review: {\n                  result: 'pass',\n                  detail: 'testDate'\n                }\n              },\n              assets: {\n                assetIds: ['62', '29']\n              },\n              rules: {\n                ruleIds: ['SV-106179r1_rule']\n              },\n              updateFilters: [\n                {\n                field: \"ts\",\n                condition : \"lessThan\",\n                value: currentTime\n                }\n              ],\n              action: 'update'\n              }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n            \n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body).to.have.property('failedValidation')\n            expect(res.body).to.have.property('updated')\n            expect(res.body).to.have.property('inserted')\n\n            expect(res.body.inserted).to.eql(0)\n            expect(res.body.updated).to.eql(1)\n            expect(res.body.failedValidation).to.eql(0)\n            expect(res.body.validationErrors).to.have.length(0)\n\n            const reviews = await utils.getReviews(reference.testCollection.collectionId)\n            expect(reviews).to.have.lengthOf(1)\n\n            for(let review of reviews){\n              expect(review.assetId).to.eql(\"62\")\n              expect(review.ruleId).to.eql(reference.testCollection.ruleId)\n              expect(review.status.label).to.eql(\"saved\")\n              expect(review.status.user.username).to.eql(\"stigmanadmin\")\n              expect(review.username).to.eql(iteration.name)\n              expect(review.result).to.eql(postreview.source.review.result)\n              expect(review.detail).to.eql(postreview.source.review.detail)\n              \n            }\n          })\n          it(\"create a review for asset 62, rule SV-106179r1_rule with detail ends with batch (uses stigmanadmin token)\", async () => {\n            const postreview = {\n              source: {\n                review: {\n                  result: 'fail',\n                  detail: 'testbatch'\n                }\n              },\n              assets: {\n                assetIds: ['62']\n              },\n              rules: {\n                ruleIds: ['SV-106179r1_rule']\n              }\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iterations[0].token, postreview)\n\n            expect(res.status).to.eql(200)\n\n            expect(res.body.inserted).to.eql(0)\n            expect(res.body.updated).to.eql(1)\n            expect(res.body.failedValidation).to.eql(0)\n            expect(res.body.validationErrors).to.have.length(0)  \n          })\n          it(`POST batch review: update with updateFilters - detail string ends with \"batch\"`, async () => {\n\n          const postreview = {\n              source: {\n                review: {\n                  result: 'fail',\n                  detail: 'testEndsWith'\n                }\n              },\n              assets: {\n                assetIds: ['62', '29']\n              },\n              rules: {\n                ruleIds: ['SV-106179r1_rule']\n              },\n              updateFilters: [\n                {\n                  field: 'detail',\n                  condition: 'endsWith',\n                  value: 'batch'\n                }\n              ],\n              action: 'update'\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n          \n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body).to.have.property('failedValidation')\n            expect(res.body).to.have.property('updated')\n            expect(res.body).to.have.property('inserted')\n\n            expect(res.body.inserted).to.eql(0)\n            expect(res.body.updated).to.eql(1)\n            expect(res.body.failedValidation).to.eql(0)\n            expect(res.body.validationErrors).to.have.length(0)\n\n            const reviews = await utils.getReviews(reference.testCollection.collectionId)\n            expect(reviews).to.have.lengthOf(1)\n\n            for(let review of reviews){\n              expect(review.assetId).to.eql(\"62\")\n              expect(review.ruleId).to.eql(reference.testCollection.ruleId)\n              expect(review.status.label).to.eql(\"saved\")\n              expect(review.status.user.username).to.eql(\"stigmanadmin\")\n              expect(review.username).to.eql(iteration.name)\n              expect(review.result).to.eql(postreview.source.review.result)\n              expect(review.detail).to.eql(postreview.source.review.detail)\n            }\n          })\n          it(\"create a review for asset 62, rule SV-106179r1_rule that submitts the review (uses stigmanadmin token)\", async () => {\n            const postreview = {\n              source: {\n                review: {\n                  result: 'pass',\n                  detail: 'testNotSubmitted',\n                  status: 'submitted'\n                }\n              },\n              assets: {\n                assetIds: ['62']\n              },\n              rules: {\n                ruleIds: ['SV-106179r1_rule']\n              }\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iterations[0].token, postreview)\n\n            expect(res.status).to.eql(200)\n\n            expect(res.body.inserted).to.eql(0)\n            expect(res.body.updated).to.eql(1)\n            expect(res.body.failedValidation).to.eql(0)\n            expect(res.body.validationErrors).to.have.length(0)  \n          })\n          it(`POST batch review: update - updateFilters- only non-saved status`, async () => {\n\n          const postreview = {\n              source: {\n                review: {\n                //  result: 'fail',\n                 // detail: 'testNotSubmitted',\n                  status: 'saved'\n                }\n              },\n              assets: {\n                assetIds: ['62', '29']\n              },\n              rules: {\n                ruleIds: ['SV-106179r1_rule']\n              },\n              updateFilters: [\n                {\n                  field: 'statusLabel',\n                  condition: 'notequal',\n                  value: 'saved'\n                }\n              ],\n              action: 'update'\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n          \n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body).to.have.property('failedValidation')\n            expect(res.body).to.have.property('updated')\n            expect(res.body).to.have.property('inserted')\n\n            expect(res.body.inserted).to.eql(0)\n            expect(res.body.updated).to.eql(1)\n            expect(res.body.failedValidation).to.eql(0)\n            expect(res.body.validationErrors).to.have.length(0)\n\n            const reviews = await utils.getReviews(reference.testCollection.collectionId)\n            expect(reviews).to.have.lengthOf(1)\n\n            for(let review of reviews){\n              expect(review.assetId).to.eql(\"62\")\n              expect(review.ruleId). to.eql(reference.testCollection.ruleId)\n              expect(review.status.label).to.eql(\"saved\")\n              expect(review.status.user.username).to.eql(iteration.name)\n              expect(review.username).to.eql(\"stigmanadmin\")\n              expect(review.result).to.eql(\"pass\")\n            }\n          })\n          it(\"create a review for asset 62, rule SV-106179r1_rule that saved and passes the review (uses stigmanadmin token)\", async () => {\n            const postreview = {\n              source: {\n                review: {\n                  result: 'pass',\n                  detail: 'testPassed',\n                  status: 'saved'\n                }\n              },\n              assets: {\n                assetIds: ['62']\n              },\n              rules: {\n                ruleIds: ['SV-106179r1_rule']\n              }\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iterations[0].token, postreview)\n\n            expect(res.status).to.eql(200)\n\n            expect(res.body.inserted).to.eql(0)\n            expect(res.body.updated).to.eql(1)\n            expect(res.body.failedValidation).to.eql(0)\n            expect(res.body.validationErrors).to.have.length(0)  \n          })\n          it(`POST batch review: update with updateFilters - pass only`, async () => {\n              const postreview = {\n                source: {\n                  review: {\n                    result: 'fail',\n                    detail: 'testPassOnly'\n                  }\n                },\n                assets: {\n                  assetIds: ['62', '29']\n                },\n                rules: {\n                  ruleIds: ['SV-106179r1_rule']\n                },\n                updateFilters: [\n                  {\n                    field: 'result',\n                    value: 'pass'\n                  }\n                ],\n                action: 'update'\n              }\n\n              const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n            \n              expect(res.status).to.eql(200)\n              expect(res.body).to.be.an('object')\n              expect(res.body).to.have.property('failedValidation')\n              expect(res.body).to.have.property('updated')\n              expect(res.body).to.have.property('inserted')\n      \n              expect(res.body.inserted).to.eql(0)\n              expect(res.body.updated).to.eql(1)\n              expect(res.body.failedValidation).to.eql(0)\n              expect(res.body.validationErrors).to.have.length(0)\n      \n              const reviews = await utils.getReviews(reference.testCollection.collectionId)\n              expect(reviews).to.have.lengthOf(1)\n      \n              for(let review of reviews){\n                expect(review.assetId).to.eql(\"62\")\n                expect(review.ruleId).to.eql(reference.testCollection.ruleId)\n                expect(review.status.label).to.eql(\"saved\")\n                expect(review.status.user.username).to.eql(\"stigmanadmin\")\n                expect(review.username).to.eql(iteration.name)\n                expect(review.result).to.eql(\"fail\")\n                expect(review.detail).to.eql(\"testPassOnly\")\n              }\n          })\n        })\n        describe(`Batch Review Editing - Validation Errors, expect failure. `, () => {\n              \n          before(async function () {\n            await utils.loadAppData(\"batch-test-data.jsonl\")\n          })\n\n          it(`POST batch Review: target by assets, and one rule, expect validation failure - invalid result for status`, async () => {\n              const postreview = {\n                source: {\n                  review: {\n                    result: 'informational',\n                    detail: 'tesetsetset',\n                    status: 'submitted'\n                  }\n                },\n                assets: {\n                  assetIds: ['62', '29']\n                },\n                rules: { ruleIds: ['SV-106179r1_rule'] }\n              }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n          \n            expect(res.status).to.eql(200)\n\n            expect(res.body.inserted).to.eql(0)\n            expect(res.body.updated).to.eql(0)\n            expect(res.body.failedValidation).to.eql(2)\n            expect(res.body.validationErrors).to.have.length(2)\n                  \n            if (iteration.name == \"lvl1\"){\n              for (const review of res.body.validationErrors){\n                  expect(review.error).to.be.oneOf([\"status is not allowed for the result\",\"no grant for this asset/ruleId\"])\n                  if (review.assetId == 29) {\n                      expect(review.error).to.eql(\"no grant for this asset/ruleId\")                \n                  }\n              }\n            }\n            else {\n              for (const review of res.body.validationErrors){\n                  expect(review.error).to.eql(\"status is not allowed for the result\")\n              }   \n            }    \n\n          })\n          it(`POST batch Review: target by stig, and one rule, expect validation failure - fail result, no comment`, async () => {\n            const postreview = {\n              source: {\n                review: {\n                  result: 'fail',\n                  detail: 'tesetsetset',\n                  comment: '',\n                  status: 'submitted'\n                }\n              },\n              assets: {\n                benchmarkIds: ['VPN_SRG_TEST_Batch']\n              },\n              rules: { ruleIds: ['SV-106179r1_rule'] }\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n        \n            expect(res.status).to.eql(200)\n            const reviews = await utils.getReviews(reference.testCollection.collectionId)\n\n            expect(res.body.inserted).to.eql(distinct.postReviews.targetByStigOneRuleValidationFailure.inserted)\n            expect(res.body.updated).to.eql(distinct.postReviews.targetByStigOneRuleValidationFailure.updated)\n            expect(res.body.failedValidation).to.eql(distinct.postReviews.targetByStigOneRuleValidationFailure.failedValidation)\n            expect(res.body.validationErrors).to.have.length(distinct.postReviews.targetByStigOneRuleValidationFailure.validationErrors)\n            expect(reviews).to.have.lengthOf(distinct.postReviews.targetByStigOneRuleValidationFailure.reviewsLength)\n      \n          })\n          it(`POST batch Review: target by stig, and one rule, expect validation failure - invalid result for status`, async () => {\n              const postreview = {\n                source: {\n                  review: {\n                    result: 'informational',\n                    detail: 'tesetsetset',\n                    status: 'submitted'\n                  }\n                },\n                assets: {\n                  benchmarkIds: ['VPN_SRG_TEST_Batch']\n                },\n                rules: { ruleIds: ['SV-106179r1_rule'] }\n              }\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n          \n          expect(res.status).to.eql(200)\n          \n          const reviews = await utils.getReviews(reference.testCollection.collectionId)\n      \n          expect(res.body.inserted).to.eql(distinct.postReviews.targetByStigOneRuleValidationFailure.inserted)\n          expect(res.body.updated).to.eql(distinct.postReviews.targetByStigOneRuleValidationFailure.updated)\n          expect(res.body.failedValidation).to.eql(distinct.postReviews.targetByStigOneRuleValidationFailure.failedValidation)\n          expect(res.body.validationErrors).to.have.length(distinct.postReviews.targetByStigOneRuleValidationFailure.validationErrors)\n          expect(reviews).to.have.lengthOf(distinct.postReviews.targetByStigOneRuleValidationFailure.reviewsLength)\n\n          })\n          it(`POST batch Review: target by stig, and one rule, expect validation failure - no detail`, async () => {\n            const postreview = {\n              source: {\n                review: {\n                  result: 'pass',\n                  detail: '',\n                  comment: 'test comment',\n                  status: 'submitted'\n                }\n              },\n              assets: {\n                benchmarkIds: ['VPN_SRG_TEST_Batch']\n              },\n              rules: { ruleIds: ['SV-106179r1_rule'] }\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, postreview)\n            \n            expect(res.status).to.eql(200)\n            const reviews = await utils.getReviews(reference.testCollection.collectionId)\n        \n            expect(res.body.inserted).to.eql(distinct.postReviews.targetByStigOneRuleValidationFailure.inserted)\n            expect(res.body.updated).to.eql(distinct.postReviews.targetByStigOneRuleValidationFailure.updated)\n            expect(res.body.failedValidation).to.eql(distinct.postReviews.targetByStigOneRuleValidationFailure.failedValidation)\n            expect(res.body.validationErrors).to.have.length(distinct.postReviews.targetByStigOneRuleValidationFailure.validationErrors)\n            expect(reviews).to.have.lengthOf(distinct.postReviews.targetByStigOneRuleValidationFailure.reviewsLength)\n          })\n        })\n        describe('Batch Review Editing - In code errors', () => {\n          let tempCollectionCanAcceptFalse\n          before(async function () {\n            tempCollectionCanAcceptFalse = await utils.createTempCollection({\n              name: 'temoCollection',\n              description: 'Collection TEST description',\n              settings: {\n                fields: {\n                  detail: {\n                    enabled: 'always',\n                    required: 'findings'\n                  },\n                  comment: {\n                    enabled: 'always',\n                    required: 'findings'\n                  }\n                },\n                status: {\n                  canAccept: false,\n                  minAcceptGrant: 2,\n                  resetCriteria: 'result'\n                },\n                history: {\n                  maxReviews: 11\n                },\n                importOptions: {\n                  autoStatus: {\n                    fail: \"submitted\",\n                    notapplicable: \"submitted\",\n                    pass: \"submitted\",\n                  },\n                  unreviewed: \"commented\",\n                  unreviewedCommented: \"informational\",\n                  emptyDetail: \"replace\",\n                  emptyComment: \"ignore\",\n                  allowCustom: true\n                }\n              },\n              metadata: {\n                pocName: 'poc2Put',\n                pocEmail: 'pocEmailPut@email.com',\n                pocPhone: '12342',\n                reqRar: 'true'\n              },\n              grants: [\n                {\n                  userId: '1',\n                  roleId: 4\n                },\n                {\n                  userId: '85',\n                  roleId: 1\n                }\n              ],\n              labels: [\n                {\n                  name: 'TEST',\n                  description: 'Collection label description',\n                  color: 'ffffff'\n                }\n              ]\n            })\n          })\n\n          after(async function () {\n            await utils.deleteCollection(tempCollectionCanAcceptFalse.collectionId)\n          })\n\n          it(`should throw SmError.PrivilegeError`, async () => {\n\n            const postreview = {\n              source: {\n                review: {\n                  status: 'accepted'\n                }\n              },\n              assets: {\n                assetIds: ['62', '42', '154']\n              },\n              rules: {\n                benchmarkIds: ['VPN_SRG_TEST_Batch']\n              }\n            }\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${tempCollectionCanAcceptFalse.collectionId}/reviews`, 'POST', iteration.token, postreview)\n            \n            expect(res.status).to.eql(403)\n          })\n          it(`should throw SmError.PrivilegeError`, async () => {\n\n            const postreview = {\n              source: {\n                review: {\n                  status: 'accepted'\n                }\n              },\n              assets: {\n                assetIds: ['62', '42', '154']\n              },\n              rules: {\n                benchmarkIds: ['VPN_SRG_TEST_Batch']\n              }\n            }\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${tempCollectionCanAcceptFalse.collectionId}/reviews`, 'POST', iteration.token, postreview)\n            expect(res.status).to.eql(403)\n          })\n          it(\"should throw SmError.PrivilegeError, lvl1 user no acccess to asset \", async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, {\n                source: {\n                  review: {\n                    result: 'fail',\n                    detail: 'tesetsetset'\n                  }\n                },\n                assets: {\n                  assetIds: [\"29\"]\n                },\n                rules: {\n                  ruleIds: ['SV-106179r1_rule']\n                }\n              })\n\n            expect(res.status).to.eql(200)\n            if(iteration.name === \"lvl1\"){\n              expect(res.body.failedValidation).to.eql(1)\n              expect(res.body.validationErrors[0].error).to.eql(\"no grant for this asset/ruleId\")\n              expect(res.body.validationErrors[0].assetId).to.eql(\"29\")\n            }\n            else \n            {\n              expect(res.body.failedValidation).to.eql(0)\n            }\n          })\n          it(\"should throw error, user cannot accept/reject reviews in colleciton \", async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', iteration.token, {\n                source: {\n                  review: {\n                    status: 'accepted'\n                  }\n                },\n                assets: {\n                  assetIds: ['62', '42', '154']\n                },\n                rules: {\n                  ruleIds: ['SV-106179r1_rule']\n                }\n              })\n\n            if(distinct.roleId < 3){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n          })\n        })\n      })\n      describe('POST - postReviewsByAsset - /collections/{collectionId}/reviews/{assetId}', () => {\n\n        let deletedCollection = reference.deletedCollection.collectionId\n        let deletedAsset = reference.deletedAsset.assetId\n        before(async function () {\n          await utils.loadAppData()\n          await utils.deleteReview(reference.testCollection.collectionId, reference.testAsset.assetId, reference.testCollection.ruleId)\n        })\n\n        it('Import one or more Reviews from a JSON body new ruleId', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}`, 'POST', iteration.token, [\n              {\n              \"ruleId\": reference.testCollection.ruleId,\n              \"result\": \"pass\",\n              \"detail\": \"test\\nvisible to lvl1\",\n              \"comment\": \"sure\",\n              \"autoResult\": false,\n              \"status\": \"submitted\"\n              }\n          ])\n          const expectedResponse = {\n            rejected: [],\n            affected: {\n                inserted: 1,\n                updated: 0\n            }\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('object')\n          expect(res.body).to.deep.equal(expectedResponse)\n        })\n        it(\"Import review for an asset, asset is read only for lvl1 user, expect rejection.\", async () => {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testCollection.lvl1ReadOnlyAssetId}`, 'POST', iteration.token, [\n              {\n              \"ruleId\": reference.testCollection.ruleId,\n              \"result\": \"pass\",\n              \"detail\": \"test\\nvisible to lvl1\",\n              \"comment\": \"sure\",\n              \"autoResult\": false,\n              \"status\": \"submitted\"\n              }\n          ])\n          expect(res.status).to.eql(200)\n          if(iteration.name == \"lvl1\"){\n            expect(res.body.rejected).to.have.length(1)\n            expect(res.body.rejected[0].reason).to.eql(\"no grant for this asset/ruleId\")\n            expect(res.body.affected.inserted).to.eql(0)\n            expect(res.body.affected.updated).to.eql(0)\n          }\n          else {\n            expect(res.body.rejected).to.have.length(0)\n            expect(res.body.affected.inserted).to.eql(0)\n            expect(res.body.affected.updated).to.eql(1)\n          }\n\n        })\n        it('Import one or more Reviews from a JSON body already used ruleId should be an update', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}`, 'POST', iteration.token, [\n              {\n              \"ruleId\": `${reference.testCollection.ruleId}`,\n              \"result\": \"pass\",\n              \"detail\": \"test\\nvisible to lvl1\",\n              \"comment\": \"sure\",\n              \"autoResult\": false,\n              \"status\": \"submitted\"\n              }\n          ])\n          const expectedResponse = {\n            rejected: [],\n            affected: {\n                inserted: 0,\n                updated: 1\n            }\n          }\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.an('object')\n          expect(res.body).to.deep.equal(expectedResponse)\n        })\n        it('Import reviews for asset in deleted collection and deleted asset', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${deletedCollection}/reviews/${deletedAsset}`, 'POST', iteration.token, [\n              {\n              \"ruleId\": `${reference.testCollection.ruleId}`,\n              \"result\": \"pass\",\n              \"detail\": \"test\\nvisible to lvl1\",\n              \"comment\": \"sure\",\n              \"autoResult\": false,\n              \"status\": \"submitted\"\n              }\n          ])\n          expect(res.status).to.eql(403) \n        })\n        it('Import reviews for asset in deleted collection', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${deletedCollection}/reviews/${reference.testAsset.assetId}`, 'POST', iteration.token, [\n              {\n              \"ruleId\": `${reference.testCollection.ruleId}`,\n              \"result\": \"pass\",\n              \"detail\": \"test\\nvisible to lvl1\",\n              \"comment\": \"sure\",\n              \"autoResult\": false,\n              \"status\": \"submitted\"\n              }\n          ])\n          expect(res.status).to.eql(403) \n        })\n        it('Import reviews for deleted Asset in an enabled collection', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${deletedAsset}`, 'POST', iteration.token, [\n              {\n              \"ruleId\": `${reference.testCollection.ruleId}`,\n              \"result\": \"pass\",\n              \"detail\": \"test\\nvisible to lvl1\",\n              \"comment\": \"sure\",\n              \"autoResult\": false,\n              \"status\": \"submitted\"\n              }\n          ])\n          expect(res.status).to.eql(403) \n        })\n      })\n    })\n  }\n})"
  },
  {
    "path": "test/api/mocha/data/review/reviewPut.test.js",
    "content": "import { XMLParser } from 'fast-xml-parser'\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {requestBodies} from \"./requestBodies.js\"\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport { expect } from 'chai'\n\ndescribe('PUT - Review', () => {\n\n    let deletedCollection = reference.deletedCollection.collectionId\n    before(async function () {\n        await utils.loadAppData()\n    })\n\n    for(const iteration of iterations){\n        if (expectations[iteration.name] === undefined){\n            it(`No expectations for this iteration scenario: ${iteration.name}`, async () => {})\n            continue\n        }\n        describe(`iteration:${iteration.name}`, () => {\n            const distinct = expectations[iteration.name]\n            describe('PUT - putReviewByAssetRule - /collections/{collectionId}/reviews/{assetId}/{ruleId}', () => {\n       \n                it('PUT Review: accepted, pass, no detail', async () => {\n\n                    const putBody = {\n                        result: 'pass',\n                        detail: '',\n                        comment: 'sure',\n                        status: 'accepted',\n                        autoResult: false\n                    }\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PUT', iteration.token, putBody)\n\n                    expect(res.status).to.eql(403)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body).to.have.property(\"error\")\n                })\n                it('PUT Review: saved, pass, no detail', async () => {\n\n                    const putBody = {\n                        result: 'pass',\n                        detail: '',\n                        comment: 'sure',\n                        status: 'saved',\n                        autoResult: false\n                    }\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PUT', iteration.token, putBody)\n                 \n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body).to.have.property(\"result\")\n                    expect(res.body).to.have.property(\"detail\")\n                    expect(res.body).to.have.property(\"comment\")\n                    expect(res.body).to.have.property(\"status\")\n                    expect(res.body.result).to.equal(putBody.result)\n                    expect(res.body.detail).to.equal(putBody.detail)\n                    expect(res.body.comment).to.equal(putBody.comment)\n                    expect(res.body.status.label).to.equal(putBody.status)\n                })\n                it('PUT Review: submit, fail, no comment', async () => {\n\n                    const putBody = {\n                        result: 'fail',\n                        detail: 'string',\n                        comment: '',\n                        status: 'submitted',\n                        autoResult: false\n                    }\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PUT', iteration.token, putBody)\n\n                    expect(res.status).to.eql(403)\n                })\n                it('PUT Review: submitted, pass, no detail Copy', async () => {\n\n                    const putBody = {\n                        result: 'pass',\n                        detail: '',\n                        comment: 'sure',\n                        status: 'submitted',\n                        autoResult: false\n                    }\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PUT', iteration.token, putBody)\n\n                    expect(res.status).to.eql(403)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body).to.have.property(\"error\")\n                })\n                it('Check that informational results are represented as NotReviewd with Finding Details data in .ckls', async () => {\n\n                    const putBody = {\n                    result: 'informational',\n                    detail:\n                        'test\\nvisible to lvl1, THIS REVIEW IS INFORMATIONAL (but comes back as Not_Reviewed in a ckl)',\n                    comment: 'sure',\n                    autoResult: false,\n                    status: 'saved'\n                    }\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}?projection=rule&projection=history&projection=stigs`, 'PUT', iteration.token, putBody)\n                  \n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body).to.have.property(\"result\")\n                    expect(res.body).to.have.property(\"detail\")\n                    expect(res.body).to.have.property(\"comment\")\n                    expect(res.body).to.have.property(\"status\")\n                    expect(res.body.result).to.equal(putBody.result)\n                    expect(res.body.detail).to.equal(putBody.detail)\n                    expect(res.body.comment).to.equal(putBody.comment)\n                    expect(res.body.status.label).to.equal(putBody.status)\n\n                    const review = await utils.getChecklist(reference.testAsset.assetId, reference.benchmark, reference.revisionStr)\n\n                    let cklData\n\n                    const parser = new XMLParser({ processEntities: { enabled: true, maxTotalExpansions: 200000 } })\n                    cklData = parser.parse(review)\n          \n                    let cklIStigs = cklData.CHECKLIST.STIGS.iSTIG\n                    let currentStigId\n\n                    cklIStigs = [cklIStigs]\n\n                    for(let stig of cklIStigs){\n                        for(let cklData of stig.STIG_INFO.SI_DATA){\n                            if (cklData.SID_NAME == 'stigid'){\n                                currentStigId = cklData.SID_DATA\n                                expect(currentStigId).to.be.oneOf(reference.testCollection.validStigs)\n                            }\n                        }\n                        let cklVulns = stig.VULN;\n                        expect(cklVulns).to.be.an('array')\n\n                        if (currentStigId == 'VPN_SRG_TEST') {\n                            expect(cklVulns).to.be.an('array').of.length(reference.checklistLength)\n                            for (let thisVuln of cklVulns){\n                                for (let stigData of thisVuln.STIG_DATA){\n                                    if (stigData.ATTRIBUTE_DATA == 'SV-106179r1_rule'){\n                                        var commentRegex = new RegExp(\"INFORMATIONAL\")\n                                        var statusRegex = new RegExp(\"Not_Reviewed\")\n                                        expect(thisVuln.FINDING_DETAILS).to.match(commentRegex)\n                                        expect(thisVuln.STATUS).to.match(statusRegex)\n                                    }\n                                }\n                            }\n\n                        }\n\n                    }\n                })\n                it('Set all properties of a Review - invalid result enum', async () => {\n\n                    const putBody = {\n                        result: 'invalid',\n                        detail: '',\n                        comment: 'sure',\n                        status: 'submitted',\n                        autoResult: false\n                    }\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PUT', iteration.token, putBody)\n\n                    expect(res.status).to.eql(400)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body).to.have.property(\"error\")\n                })\n                it('Set all properties of a Review - with metadata', async () => {\n\n                    const putBody = JSON.parse(JSON.stringify({\n                        result: 'pass',\n                        detail: 'test\\nvisible to lvl1',\n                        comment: 'sure',\n                        autoResult: false,\n                        status: 'submitted',\n                        metadata: {\n                            [reference.reviewMetadataKey]: reference.reviewMetadataValue\n                        }\n                    }))\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}?projection=rule&projection=history&projection=stigs&projection=metadata`, 'PUT', iteration.token, putBody)\n                   \n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body).to.have.property(\"result\")\n                    expect(res.body).to.have.property(\"detail\")\n                    expect(res.body).to.have.property(\"comment\")\n                    expect(res.body).to.have.property(\"status\")\n                    expect(res.body).to.have.property(\"metadata\")\n                    expect(res.body.result).to.equal(putBody.result)\n                    expect(res.body.detail).to.equal(putBody.detail)\n                    expect(res.body.comment).to.equal(putBody.comment)\n                    expect(res.body.status.label).to.equal(putBody.status)\n                    expect(res.body.metadata).to.be.an('object')\n                    expect(res.body.metadata).to.have.property(reference.reviewMetadataKey)\n                    expect(res.body.metadata[reference.reviewMetadataKey]).to.be.equal(reference.reviewMetadataValue)\n\n                })\n                it('PUT Review: asset in deleted collection', async () => {\n\n                    const putBody = {\n                        result: 'pass',\n                        detail: 'test\\nvisible to lvl1',\n                        comment: 'sure',\n                        autoResult: false,\n                        status: 'submitted'\n                    }\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${deletedCollection}/reviews/${reference.testCollection.testAssetId}/${reference.testCollection.ruleId}`, 'PUT', iteration.token, putBody)\n\n                    expect(res.status).to.eql(403)\n                })\n                it('should return 403 for deleted collection', async () => {\n                    const putBody = {\n                        result: 'pass',\n                        detail: 'irrelevant',\n                        comment: 'irrelevant',\n                        status: 'saved',\n                        autoResult: false\n                    }\n                    const res = await utils.executeRequest(\n                        `${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`,\n                        'PUT',\n                        iteration.token,\n                        putBody\n                    )\n                    expect(res.status).to.eql(403)\n                })\n                it('Test all projections are returned and contain accurate data. (besides history that is tested better elsewhere)', async () => {\n\n                    const putBody = {\n                        result: 'pass',\n                        detail: 'test\\nvisible to lvl1',\n                        comment: 'sure',\n                        autoResult: false,\n                        status: 'submitted'\n                    }\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}?projection=rule&projection=stigs&projection=metadata`, 'PUT', iteration.token, putBody)\n                   \n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body.result).to.equal(putBody.result)\n                    expect(res.body.detail).to.equal(putBody.detail)\n                    expect(res.body.comment).to.equal(putBody.comment)\n                    expect(res.body.status.label).to.equal(putBody.status)\n                    expect(res.body.metadata).to.be.an('object')\n                    expect(res.body.metadata).to.have.property(reference.reviewMetadataKey)\n                    expect(res.body.metadata[reference.reviewMetadataKey]).to.be.equal(reference.reviewMetadataValue)\n\n                    //projections\n                    expect(res.body).to.have.property(\"rule\")\n                    expect(res.body).to.have.property(\"stigs\")\n                    expect(res.body).to.have.property(\"metadata\")\n\n                    expect(res.body.rule.ruleId).to.be.eql(reference.testCollection.ruleId)\n                    expect(res.body.stigs).to.have.lengthOf(1)\n                    expect(res.body.metadata).to.have.property(reference.reviewMetadataKey)\n                    expect(res.body.metadata[reference.reviewMetadataKey]).to.be.equal(reference.reviewMetadataValue)\n\n                    expect(res.body.rule).to.be.an('object')\n                    expect(res.body.rule.ruleId).to.be.eql(reference.testCollection.ruleId)\n                })\n                it('Set properties of a Review ', async () => {\n\n                    const putBody = {\n                        \"autoResult\": true,\n                        \"comment\": \"comment\",\n                        \"detail\": \"detail\",\n                        \"metadata\": {\n                            \"additionalProp1\": \"string\",\n                            \n                        },\n                        \"result\": \"fail\",\n                        \"resultEngine\": {\n                            \"checkContent\": {\n                            \"component\": \"string\",\n                            \"location\": \"string\"\n                            },\n                            \"overrides\": [\n                            {\n                                \"authority\": \"string\",\n                                \"newResult\": \"fail\",\n                                \"oldResult\": \"fail\",\n                                \"remark\": \"string\",\n                                \"time\": \"2024-06-05T17:01:07.162Z\"\n                            }\n                            ],\n                            \"product\": \"string\",\n                            \"time\": \"2024-06-05T17:01:07.162Z\",\n                            \"type\": \"scap\",\n                            \"version\": \"string\"\n                        },\n                        \"status\": \"saved\"\n                    }\n                    \n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}?projection=rule&projection=history&projection=stigs&projection=metadata`, 'PUT', iteration.token, putBody)\n                   \n                    expect(res.status).to.eql(200)\n                    expect(res.body.assetId).to.be.eql(reference.testAsset.assetId)\n                    expect(res.body.result).to.be.eql(putBody.result)\n                    expect(res.body.detail).to.be.eql(putBody.detail)\n                    expect(res.body.comment).to.be.eql(putBody.comment)\n                    expect(res.body.status.label).to.be.eql(putBody.status)\n                    expect(res.body.metadata).to.be.eql(putBody.metadata)\n                    expect(res.body.resultEngine).to.be.eql(putBody.resultEngine)\n\n                })\n                it(\"set all properties of a Review, lvl1 has read only on asset, expect rejection for lvl1 iteration\", async () => {\n                    const putBody = {\n                        result: 'pass',\n                        detail: 'test\\nvisible to lvl1',\n                        comment: 'sure',\n                        autoResult: false,\n                        status: 'submitted'\n                    }\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testCollection.lvl1ReadOnlyAssetId}/${reference.testCollection.ruleId}`, 'PUT', iteration.token, putBody)\n                    if(iteration.name == 'lvl1'){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body).to.have.property(\"result\")\n                    expect(res.body).to.have.property(\"detail\")\n                    expect(res.body).to.have.property(\"comment\")\n                    expect(res.body).to.have.property(\"status\")\n                    expect(res.body.result).to.equal(putBody.result)\n                    expect(res.body.detail).to.equal(putBody.detail)\n                    expect(res.body.comment).to.equal(putBody.comment)\n                    expect(res.body.status.label).to.equal(putBody.status)\n                })\n                it(\"Attempt to put a review to a disabled asset in an enabled collection, expect 403\", async () => {\n\n                    const deletedAssetId = reference.deletedAsset.assetId\n\n                    const putBody = {\n                        result: 'pass',\n                        detail: 'test\\nvisible to lvl1',\n                        comment: 'sure',\n                        autoResult: false,\n                        status: 'submitted'\n                    }\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${deletedAssetId}/${reference.testCollection.ruleId}`, 'PUT', iteration.token, putBody)\n                    expect(res.status).to.eql(403)\n\n                })\n            })\n\n            describe('PUT - putReviewMetadata - /collections/{collectionId}/reviews/{assetId}/{ruleId}/metadata', () => {\n\n                before(async function () {\n                    await utils.putReviewByAssetRule(reference.testCollection.collectionId, reference.testAsset.assetId, reference.testCollection.ruleId, requestBodies.resetRule)\n                })\n                \n                it('Set all metadata of a Review', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PUT', iteration.token, {[reference.reviewMetadataKey]: reference.reviewMetadataValue})\n                    \n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.eql({[reference.reviewMetadataKey]: reference.reviewMetadataValue})\n\n                })\n                it('Set all metadata of a Review, lvl1 has r on asset, expect rejection for lvl1 iteration. ', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testCollection.lvl1ReadOnlyAssetId}/${reference.testCollection.ruleId}/metadata`, 'PUT', iteration.token, {[reference.reviewMetadataKey]: reference.reviewMetadataValue})\n                    \n                    if(iteration.name == 'lvl1'){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.eql({[reference.reviewMetadataKey]: reference.reviewMetadataValue})\n                })\n                it(\"should return SmError.PrivilegeError if user cannot put review\", async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.scrapRuleIdWindows10}/metadata`, 'GET', iteration.token)\n                    if(distinct.canPatchReview){\n                        expect(res.status).to.eql(200)\n                        return\n                    }\n                    expect(res.status).to.eql(403)\n                    expect(res.body.error).to.be.equal(\"User has insufficient privilege to complete this request.\")\n                })\n                it('should return 403 for deleted collection', async () => {\n                    const res = await utils.executeRequest(\n                        `${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`,\n                        'PUT',\n                        iteration.token,\n                        { [reference.reviewMetadataKey]: reference.reviewMetadataValue }\n                    )\n                    expect(res.status).to.eql(403)\n                })\n            })\n\n            describe('PUT - putReviewMetadataValue - /collections/{collectionId}/reviews/{assetId}/{ruleId}/metadata/keys/{key}', () => {\n\n                before(async function () {\n                    await utils.putReviewByAssetRule(reference.testCollection.collectionId, reference.testAsset.assetId, reference.testCollection.ruleId, requestBodies.resetRule)\n                })\n                it('Set one metadata key/value of a Review', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata/keys/${reference.reviewMetadataKey}`, 'PUT', iteration.token, `${JSON.stringify(reference.reviewMetadataValue)}`)\n                    \n                    expect(res.status).to.eql(204)\n                })\n                it('Set one metadata key/value of a Review, lvl1 has read only on asset, expect rejection for lvl1 iteration', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testCollection.lvl1ReadOnlyAssetId}/${reference.testCollection.ruleId}/metadata/keys/${reference.reviewMetadataKey}`, 'PUT', iteration.token, `${JSON.stringify(reference.reviewMetadataValue)}`)\n\n                    if(iteration.name == 'lvl1'){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(204)\n                })\n                it('should return 403 for deleted collection', async () => {\n                    const res = await utils.executeRequest(\n                        `${config.baseUrl}/collections/${reference.deletedCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata/keys/${reference.reviewMetadataKey}`,\n                        'PUT',\n                        iteration.token,\n                        `${JSON.stringify(reference.reviewMetadataValue)}`\n                    )\n                    expect(res.status).to.eql(403)\n                })\n            })\n        })\n    }\n})\n\n"
  },
  {
    "path": "test/api/mocha/data/stig/expectations.js",
    "content": "//This data contains expected response data that varies by iteration \"scenario\" or \"iteration\" for each test case. These expectations are relative to the \"referenceData.js\" data used to construct the API requests.\n\nexport const expectations = {\n    stigmanadmin: {\n      testBenchmarkCollections: [\"1\",\"21\",\"83\"],\n    },\n    lvl1: {\n      testBenchmarkCollections: [\"21\"],\n    },\n}\n  "
  },
  {
    "path": "test/api/mocha/data/stig/stigs.test.js",
    "content": "\nimport path from 'path'\nimport { readFileSync } from 'fs'\nimport { fileURLToPath } from 'url'\nimport {config } from '../../testConfig.js'\nimport { Blob } from 'buffer'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\n\ndescribe('GET - Stig', () => {\n\n    before(async function () {\n        await utils.loadAppData()\n        await utils.uploadTestStig(\"U_VPN_SRG_V1R0_Manual-xccdf.xml\")\n        await utils.uploadTestStig(\"U_VPN_SRG-OTHER_V1R1_twoRules-matchingFingerprints.xml\")\n    })\n\n    for(const iteration of iterations){\n        if (expectations[iteration.name] === undefined){\n            it(`No expectations for this iteration scenario: ${iteration.name}`, async () => {})\n            continue\n        }\n        describe(`iteration:${iteration.name}`, () => {\n            const distinct = expectations[iteration.name]\n            describe('GET - getSTIGs - /stigs', () => {\n\n                it('Return a list of available STIGs', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs`, 'GET', iteration.token)\n                   \n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('array')\n\n                    for(let stig of res.body){\n                        expect(stig).to.have.property('benchmarkId')\n                        expect(stig.benchmarkId, \"expect benchmarkId to be one of the stigs available\").to.be.oneOf(reference.allStigsForAdmin)\n                        if(stig.benchmarkId === reference.benchmark){\n                            expect(stig.collectionIds).to.deep.equalInAnyOrder(distinct.testBenchmarkCollections)\n                            expect(stig.lastRevisionStr, \"checking for correct revision string of test benchmark\").to.be.equal(reference.revisionStr)\n                            expect(stig.revisionStrs, \"checking for correct possible revision strings of test benchmark\").to.be.eql(reference.testBenchmarkAllRevisions)\n                            expect(stig.ruleCount, \"checking for correct checklist length of test benchmark\").to.be.equal(reference.checklistLength)\n                        }\n                    }\n                })\n                it('Return a list of available STIGs filter with title projection on vpn', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs?title=vpn`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('array').of.length(3)\n                    for(let stig of res.body){\n                        expect(stig.benchmarkId, \"expect stig benchmarkId returned to be a VPN variant\").to.be.oneOf(reference.vpnStigs)\n                        if(stig.benchmarkId === reference.benchmark){\n                            expect(stig.collectionIds).to.deep.equalInAnyOrder(distinct.testBenchmarkCollections)\n                            expect(stig.lastRevisionStr, \"checking for correct revision string of test benchmark\").to.be.equal(reference.revisionStr)\n                            expect(stig.revisionStrs, \"checking for correct possible revision strings of test benchmark\").to.be.eql(reference.testBenchmarkAllRevisions)\n                            expect(stig.ruleCount, \"checking for correct checklist length of test benchmark\").to.be.equal(reference.checklistLength)\n                        }\n                    }\n                })\n            })\n            describe('GET - getCci - /stigs/ccis/{cci}', () => {\n\n                it('Return data for the specified CCI', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/ccis/${reference.testCci.id}?projection=stigs&projection=emassAp&projection=references`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body.cci, \"expect to get back test cci\").to.be.equal(reference.testCci.id)\n                    expect(res.body.status, \"expect to get back test cci status\").to.be.equal(reference.testCci.status)\n             \n                })\n            })\n            describe('GET - getRuleByRuleId - /stigs/rules/{ruleId}', () => {\n                it('get test ruledata with all projections besides stigs and ruleIds', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/rules/${reference.testRule.ruleId}?projection=detail&projection=ccis&projection=check&projection=fix`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body.ruleId, \"expect ruleId returned to be the test ruleId\").to.be.equal(reference.testRule.ruleId)\n                    expect(res.body.groupId, \"expect fix groupId to be the test groupId\").to.be.equal(reference.testRule.groupId)\n                    expect(res.body.version, \"expect fix version to be the test version\").to.be.equal(reference.testRule.version)\n                    \n                })\n                it(\"get test rule data with all projections, uses a ruleId present in two revisions\", async () => {\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/rules/${reference.VPN_SRG_TEST_sharedRule}?projection=detail&projection=ccis&projection=check&projection=fix&projection=stigs&projection=ruleIds`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body.ruleId, \"expect ruleId returned to be the test ruleId\").to.be.equal(reference.VPN_SRG_TEST_sharedRule)\n                    expect(res.body.groupId, \"expect fix groupId to be the test groupId\").to.be.equal(\"V-97043\")\n                    expect(res.body.version, \"expect fix version to be the test version\").to.be.equal(\"SRG-NET-000041-VPN-000110\")\n                    expect(res.body.stigs, \"expect to get back two stig revisions\").to.be.lengthOf(2)\n                    for(let stig of res.body.stigs){\n                        expect(stig.benchmarkId, \"expect to get back test benchmark\").to.be.equal(reference.benchmark)\n                        expect(stig.revisionStr, \"expect to get back test revision string\").to.be.oneOf([\"V1R1\", \"V1R0\"])                   \n                    }\n                    for(let rule of res.body.ruleIds){\n                        expect(rule, \"expect ruleId returned to be the test ruleId\").to.be.equal(reference.VPN_SRG_TEST_sharedRule)\n                    }\n                })\n                it(\"get test rule data with stigs projection, expecting to get two stig revisions back which will contain a shared ruleId\", async () => {\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/rules/${reference.VPN_SRG_TEST_sharedRule}?projection=stigs`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body.ruleId, \"expect ruleId returned to be the test ruleId\").to.be.equal(reference.VPN_SRG_TEST_sharedRule)\n                    expect(res.body.groupId, \"expect fix groupId to be the test groupId\").to.be.equal(\"V-97043\")\n                    expect(res.body.version, \"expect fix version to be the test version\").to.be.equal(\"SRG-NET-000041-VPN-000110\")\n                    expect(res.body.stigs, \"expect to get back two stig revisions\").to.be.lengthOf(2)\n                    for(let stig of res.body.stigs){\n                        expect(stig.benchmarkId, \"expect to get back test benchmark\").to.be.equal(reference.benchmark)\n                        expect(stig.revisionStr, \"expect to get back test revision string\").to.be.oneOf([\"V1R1\", \"V1R0\"])                   \n                    }\n                })\n                it(\"get test rule data with ruleIds projection, should return ruleIds with equivalent check content hash + version. will query for both ruleIds in a single test\", async () => {\n\n                    const rule1 = \"SV-106179r1_zzzzzz\"\n                    const rule2 = \"SV-106179r1_xxxx\"\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/rules/${rule1}?projection=ruleIds`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body.ruleId, \"expect ruleId returned to be the test ruleId\").to.be.equal(rule1)\n                    expect(res.body.groupId, \"expect fix groupId to be the test groupId\").to.be.equal(\"V-97041\")\n                    expect(res.body.version, \"expect fix version to be the test version\").to.be.equal(\"SRG-NET-000019-VPN-000040\")\n                    expect(res.body.ruleIds, \"expect to get back two ruleIds with equivalent check content hash + version. \").to.be.lengthOf(2)\n                    for(let rule of res.body.ruleIds){\n                        expect(rule, \"expect ruleId returned to be the test ruleId\").to.be.oneOf([rule1, rule2])\n                    }\n\n                    const res2 = await utils.executeRequest(`${config.baseUrl}/stigs/rules/${rule2}?projection=ruleIds`, 'GET', iteration.token)\n                    expect(res2.status).to.eql(200)\n                    expect(res2.body.ruleId, \"expect ruleId returned to be the test ruleId\").to.be.equal(rule2)\n                    expect(res2.body.groupId, \"expect fix groupId to be the test groupId\").to.be.equal(res.body.groupId)\n                    expect(res2.body.version, \"expect fix version to be equal to previous clone rule\").to.be.equal(res.body.version)\n                    expect(res2.body.ruleIds, \"expect to get back two ruleIds with equivalent check content hash + version. \").to.be.lengthOf(2)\n                    for(let rule of res2.body.ruleIds){\n                        expect(rule, \"expect ruleId returned to be the test ruleId\").to.be.oneOf([rule1, rule2])\n                    }\n\n                })\n            })\n            describe('GET - getScapMap - /stigs/scap-maps', () => {\n                it('Return a list of SCAP maps', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/scap-maps`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.deep.equalInAnyOrder([\n                        {\n                        scapBenchmarkId: 'CAN_Ubuntu_18-04_STIG',\n                        benchmarkId: 'U_CAN_Ubuntu_18-04_STIG'\n                        },\n                        {\n                        scapBenchmarkId: 'Mozilla_Firefox_RHEL',\n                        benchmarkId: 'Mozilla_Firefox'\n                        },\n                        {\n                        scapBenchmarkId: 'Mozilla_Firefox_Windows',\n                        benchmarkId: 'Mozilla_Firefox'\n                        },\n                        {\n                        scapBenchmarkId: 'MOZ_Firefox_Linux',\n                        benchmarkId: 'MOZ_Firefox_STIG'\n                        },\n                        {\n                        scapBenchmarkId: 'MOZ_Firefox_Windows',\n                        benchmarkId: 'MOZ_Firefox_STIG'\n                        },    \n                        {\n                        scapBenchmarkId: 'Solaris_10_X86_STIG',\n                        benchmarkId: 'Solaris_10_X86'\n                        }\n                    ])\n                })\n            })\n            describe('GET - getStigById - /stigs/{benchmarkId}', () => {\n\n                it('Return properties of the test benchmark', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body).to.have.property('benchmarkId')\n                    expect(res.body.benchmarkId, \"expect returned benchmark to be the test ben\").to.be.equal(reference.benchmark)\n                    expect(res.body.collectionIds).to.deep.equalInAnyOrder(distinct.testBenchmarkCollections)\n                    expect(res.body.lastRevisionStr, \"expect returned last revision to be the test revision\").to.be.equal(reference.revisionStr)\n                    expect(res.body.ruleCount, \"expect returned ruleCount to be the test checklist length\").to.be.equal(reference.checklistLength)\n\n                    for(const revision of res.body.revisions){\n                        expect(revision.revisionStr, \"expect returned revision to be one of the test revisions\").to.be.oneOf(reference.testBenchmarkAllRevisions)\n                        expect(revision.ruleCount, \"expect returned ruleCount to be the test checklist length\").to.be.equal(reference.checklistLength)\n                    }\n\n                })\n            })\n            describe('GET - getRevisionsByBenchmarkId - /stigs/{benchmarkId}/revisions', () => {\n\n                it('Return a list of revisions for the test benchmark', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('array')\n                    expect(res.body).to.be.lengthOf(2)\n                    for(let revision of res.body){\n                        expect(revision.ruleCount).to.eql(reference.checklistLength)\n                        expect(revision.benchmarkId).to.be.equal(reference.benchmark)\n                        expect(revision.revisionStr).to.be.oneOf(reference.testBenchmarkAllRevisions)\n                    }\n                })\n            })\n            describe('GET - getRevisionByString - /stigs/{benchmarkId}/revisions/{revisionStr}', () => {\n\n                it('Return metadata for the test benchmark and revision str V1R1', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/${reference.revisionStr}`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body).to.have.property('revisionStr')\n                    expect(res.body.revisionStr, \"revision str to be V1R1\").to.be.equal(reference.revisionStr)\n                    expect(res.body.ruleCount, \"Expected ruleCount to match the reference checklist length (81) for the test benchmark, but it does not\").to.be.equal(reference.checklistLength)\n                    expect(res.body.benchmarkId).to.be.equal(reference.benchmark)\n\n                })\n            })\n            describe('GET - getCcisByRevision - /stigs/{benchmarkId}/revisions/{revisionStr}/ccis', () => {\n                it('Return a list of CCIs from a STIG revision', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/${reference.revisionStr}/ccis`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('array')\n                    expect(res.body, \"expected 80 ccis\").to.be.lengthOf(80)\n                })\n                it(\"Return a list of CCIs from a STIG revision latest\", async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/${'latest'}/ccis`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('array')\n                    expect(res.body, \"expected 80 ccis\").to.be.lengthOf(80)\n                })\n            })\n            describe('GET - getGroupsByRevision - /stigs/{benchmarkId}/revisions{revisionStr}/groups', () => {\n                it('Return the list of groups for the specified revision of a STIG.', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/${reference.revisionStr}/groups?projection=rules`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('array')\n                    expect(res.body).to.be.lengthOf(reference.checklistLength)\n                    for(let group of res.body){\n                        if(group.groupId === reference.testRule.groupId){\n                            for(const rule of group.rules){\n                                expect(rule.ruleId, `expect test ruleID  ${reference.testRule.ruleId}`).to.be.equal(reference.testRule.ruleId)\n                                expect(rule.version, `expect rule version to be the test version. ${reference.testRule.version}`).to.be.equal(reference.testRule.version)\n                            }\n                        }\n                    }\n                })\n                it(\"Return the list of groups for the specified revision of a STIG latest\", async () => {\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/${'latest'}/groups?projection=rules`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('array')\n                    expect(res.body).to.be.lengthOf(reference.checklistLength)\n                    for(let group of res.body){\n                        if(group.groupId === reference.testRule.groupId){\n                            for(const rule of group.rules){\n                                expect(rule.ruleId, `expect test ruleID  ${reference.testRule.ruleId}`).to.be.equal(reference.testRule.ruleId)\n                                expect(rule.version, `expect rule version to be the test version. ${reference.testRule.version}`).to.be.equal(reference.testRule.version)\n                            }\n                        }\n                    }\n                })\n            })\n            describe('GET - getGroupByRevision - /stigs/{benchmarkId}/revisions{revisionStr}/groups/{groupId}', () => {\n\n                it('Return the rules, checks and fixes for a Group from a specified revision of a STIG.', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/${reference.revisionStr}/groups/${reference.testRule.groupId}?projection=rules`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body).to.have.property('groupId')\n                    expect(res.body.groupId, `expect groupId to be ${reference.testRule.groupId}`).to.be.equal(reference.testRule.groupId)\n                    for(const rule of res.body.rules){\n                        expect(rule.ruleId, `expect ruleId to be ${reference.testRule.ruleId}`).to.be.equal(reference.testRule.ruleId)\n                        expect(rule.version, `expect rule version to be the test version, ${reference.testRule.version}`).to.be.equal(reference.testRule.version)\n                    }\n                })\n            }) \n            describe('GET - getRulesByRevision - /stigs/{benchmarkId}/revisions/{revisionStr}/rules', () => {\n                it(\"Return rule data for the LATEST revision of a STIG\", async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/${'latest'}/rules?projection=detail&projection=ccis&projection=check&projection=fix`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('array')\n                    expect(res.body).to.be.lengthOf(reference.checklistLength)\n                    for(const rule of res.body){\n                        if(rule.ruleId === reference.testRule.ruleId){\n                            expect(rule.groupId, `expect group id to match test group id, ${reference.testRule.groupId}`).to.be.equal(reference.testRule.groupId)\n                            expect(rule.version, `expect rule version to be the test version ${reference.testRule.version}`).to.be.equal(reference.testRule.version)\n                        }\n                    }\n                })\n                it(\"Return rule data for the specified revision of a STIG.\", async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/${reference.revisionStr}/rules?projection=detail&projection=ccis&projection=check&projection=fix`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('array')\n                    expect(res.body).to.be.lengthOf(81)\n                    for(const rule of res.body){\n                        if(rule.ruleId === reference.testRule.ruleId){\n                            expect(rule.groupId, `expect group id to match test group id: ${reference.testRule.groupId}`).to.be.equal(reference.testRule.groupId)\n                            expect(rule.version, `expect rule version to be the test version: ${reference.testRule.version}`).to.be.equal(reference.testRule.version)\n                        }\n                    }\n                })\n            }) \n            describe('GET - getRuleByRevision - /stigs/{benchmarkId}/revisions/{revisionStr}/rules/{ruleId}', () => {\n                it(`Return rule data for test benchmark ${reference.benchmark}, revision string, ${reference.revisionStr}, ${reference.testRule.ruleId}.`, async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/${reference.revisionStr}/rules/${reference.testRule.ruleId}?projection=detail&projection=ccis&projection=check&projection=fix`, 'GET', iteration.token)\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.be.an('object')\n                    expect(res.body.ruleId, `expect ${reference.testRule.ruleId}`).to.be.equal(reference.testRule.ruleId)\n                    expect(res.body.groupId, `expect group id to match test group id: ${reference.testRule.groupId}`).to.be.equal(reference.testRule.groupId)\n                    expect(res.body.version, `expect rule version to be the test version: ${reference.testRule.version}`).to.be.equal(reference.testRule.version)\n                })\n            })\n        })\n    }\n})\n\ndescribe('DELETE - Stig', () => {\n\n    for(const iteration of iterations){\n        if (expectations[iteration.name] === undefined){\n            it(`No expectations for this iteration scenario: ${iteration.name}`, async () => {})\n            continue\n        }\n        describe(`iteration:${iteration.name}`, () => {\n            const distinct = expectations[iteration.name]\n            describe('DELETE - deleteStigById - /stigs/{benchmarkId}', () => {\n\n                before(async function () {\n                    // this is neeed because we will be deleting these stigs on each iteration and we need theem to be assigned to an asset \n                  await utils.uploadTestStig('U_MS_Windows_10_STIG_V1R23_Manual-xccdf.xml')\n                  await utils.uploadTestStig('U_RHEL_7_STIG_V3R0-3_Manual-xccdf.xml')\n                  await utils.resetScrapAsset()\n                })\n\n                it('attempts to delete stig and all revisions, fails because no force.', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.windowsBenchmark}?elevate=true`, 'DELETE', iteration.token)\n                    if(iteration.name !== \"stigmanadmin\"){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(422)\n                })\n                it('Deletes a stig an all revisions', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.scrapBenchmark}?elevate=true&force=true`, 'DELETE', iteration.token)\n                    if(iteration.name !== \"stigmanadmin\"){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(200)\n\n                    const response = await utils.getStigByBenchmarkId(reference.scrapBenchmark)\n                    expect(response.status).to.equal(404)\n\n                })\n                it('should throw SmError.NotFoundError No matching benchmarkId found.', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${'trashdata'}?elevate=true&force=true`, 'DELETE', iteration.token)\n                    if(iteration.name !== \"stigmanadmin\"){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(404)\n                })\n            })\n            describe('DELETE - deleteRevisionByString - /stigs/{benchmarkId}/revisions/{revisionStr}', () => {\n\n                before(async function () {\n                    // this is neeed because we will be deleting these stigs on each iteration and we need theem to be assigned to an asset \n                  await utils.uploadTestStig('U_VPN_SRG_V1R1_Manual-xccdf.xml')\n                  await utils.resetScrapAsset()\n                })\n\n                it('attempts to delete latest of test benchmark, fails because latest is not a permitted revision for this endpoint!', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/latest?elevate=true&force=true`, 'DELETE', iteration.token)\n                    if(iteration.name !== \"stigmanadmin\"){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(400)\n                })\n                it('Deletes the specified revision of a STIG (v1r1 of test benchmark)', async () => {\n                \n                    const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/${reference.revisionStr}?elevate=true&force=true`, 'DELETE', iteration.token)\n                    if(iteration.name !== \"stigmanadmin\"){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(200)\n                })\n            })\n        })\n    }\n})\n\ndescribe('POST - Stig', () => {\n    before(async function () {\n        \n       await utils.deleteStig(reference.benchmark)\n    })\n\n    for(const iteration of iterations){\n        if (expectations[iteration.name] === undefined){\n            it(`No expectations for this iteration scenario: ${iteration.name}`, async () => {})\n            continue\n        }\n        describe(`iteration:${iteration.name}`, () => {\n            describe('POST - importBenchmark - /stigs', () => {\n\n                it('Import a new STIG - new', async () => {\n                    const filename = reference.testStigfile\n                 \n                   const __filename = fileURLToPath(import.meta.url)\n                   const __dirname = path.dirname(__filename)\n                   const filePath = path.join(__dirname, `../../../form-data-files/${filename}`)\n                   \n                   const fileContent = readFileSync(filePath, 'utf-8')\n                   \n                   // Create a Blob for the file content\n                   const blob = new Blob([fileContent], { type: 'text/xml' })\n                 \n                   const formData = new FormData()\n                   formData.append('importFile', blob, filename)\n                 \n                   const res = await fetch(`${config.baseUrl}/stigs?elevate=true&clobber=false`, {\n                     method: 'POST',\n                     headers: {\n                       Authorization: `Bearer ${iteration.token}`,\n                     },\n                     body: formData,\n                   })\n                    let expectedRevData = {\n                        benchmarkId: \"VPN_SRG_TEST\",\n                        revisionStr: \"V1R1\",\n                        marking: \"U\",\n                        action: \"inserted\",\n                    }\n                    if(iteration.name !== \"stigmanadmin\"){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(200)\n                    const data = await res.json()\n                    expect(data).to.deep.eql(expectedRevData)\n                })\n                it('should throw SmError.PrivilegeError() no elevate', async () => {\n                \n                    const filename = reference.testStigfile\n                    const __filename = fileURLToPath(import.meta.url)\n                    const __dirname = path.dirname(__filename)\n                    const filePath = path.join(__dirname, `../../../form-data-files/${filename}`)\n                    \n                    const fileContent = readFileSync(filePath, 'utf-8')\n                    \n                    const blob = new Blob([fileContent], { type: 'text/xml' })\n                  \n                    const formData = new FormData()\n                    formData.append('importFile', blob, filename)\n                  \n                    const res = await fetch(`${config.baseUrl}/stigs?clobber=false`, {\n                      method: 'POST',\n                      headers: {\n                        Authorization: `Bearer ${iteration.token}`,\n                      },\n                      body: formData,\n                    })\n                    expect(res.status).to.eql(403)\n                })\n                it('should throw SmError.ClientError not xml file', async () => {\n                \n                    const filename = 'appdata.jsonl'\n                    const __filename = fileURLToPath(import.meta.url)\n                    const __dirname = path.dirname(__filename)\n                    const filePath = path.join(__dirname, `../../../appdata/${filename}`)\n                    \n                    const fileContent = readFileSync(filePath, 'utf-8')\n                    \n                    const blob = new Blob([fileContent], { type: 'text/xml' })\n                  \n                    const formData = new FormData()\n                    formData.append('importFile', blob, filename)\n                  \n                    const res = await fetch(`${config.baseUrl}/stigs?elevate=true&clobber=false`, {\n                      method: 'POST',\n                      headers: {\n                        Authorization: `Bearer ${iteration.token}`,\n                      },\n                      body: formData,\n                    })\n                    if(iteration.name !== \"stigmanadmin\"){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(400)\n                })\n                it('Import a new STIG - preserve', async () => {\n                \n                    const filename = reference.testStigfile\n                 \n                    const __filename = fileURLToPath(import.meta.url)\n                    const __dirname = path.dirname(__filename)\n                    const filePath = path.join(__dirname, `../../../form-data-files/${filename}`)\n                    \n                    const fileContent = readFileSync(filePath, 'utf-8')\n                    \n                    // Create a Blob for the file content\n                    const blob = new Blob([fileContent], { type: 'text/xml' })\n                  \n                    const formData = new FormData()\n                    formData.append('importFile', blob, filename)\n                  \n                    const res = await fetch(`${config.baseUrl}/stigs?elevate=true&clobber=false`, {\n                      method: 'POST',\n                      headers: {\n                        Authorization: `Bearer ${iteration.token}`,\n                      },\n                      body: formData,\n                    })\n                    let expectedRevData = \n                    {\n                        \"benchmarkId\": \"VPN_SRG_TEST\",\n                        \"revisionStr\": \"V1R1\",\n                        \"marking\": \"U\",\n                        \"action\": \"preserved\"\n                    }\n                    if(iteration.name !== \"stigmanadmin\"){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(200)\n                    const data = await res.json()\n                    expect(data).to.deep.eql(expectedRevData)\n                })\n                it('Import a new STIG - clobber', async () => {\n                    const filename = reference.testStigfile\n\n                    const __filename = fileURLToPath(import.meta.url)\n                    const __dirname = path.dirname(__filename)\n                    const filePath = path.join(__dirname, `../../../form-data-files/${filename}`)\n                    const fileContent = readFileSync(filePath, 'utf-8')\n                    \n                    const blob = new Blob([fileContent], { type: 'text/xml' })\n                  \n                    const formData = new FormData()\n                    formData.append('importFile', blob, filename)\n                  \n                    const res = await fetch(`${config.baseUrl}/stigs?elevate=true&clobber=true`, {\n                      method: 'POST',\n                      headers: {\n                        Authorization: `Bearer ${iteration.token}`,\n                      },\n                      body: formData,\n                    })\n                    let expectedRevData = \n                    {\n                        \"benchmarkId\": \"VPN_SRG_TEST\",\n                        \"revisionStr\": \"V1R1\",\n                        \"marking\": \"U\",\n                        \"action\": \"replaced\"\n                    }\n                    if(iteration.name !== \"stigmanadmin\"){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(200)\n                    const data = await res.json()\n                    expect(data).to.deep.eql(expectedRevData)\n                })\n            })\n        })\n    }\n})\n\n"
  },
  {
    "path": "test/api/mocha/data/user/expectations.js",
    "content": "\nexport const expectations = {\n  stigmanadmin: {\n    iteration: \"admin\",\n    acl: [],\n    defaultAccess: \"rw\",\n    roleId: 4,\n    userId: \"87\",\n    userGroupIds: [],\n    collectionGrants: [\"21\", \"83\", \"1\", \"84\", \"85\", \"92\"],\n    privileges: {\n      admin: true,\n      create_collection: true,\n    },\n    webPreferences: {\n      darkMode: true,\n      lastWhatsNew: \"2000-01-01\"\n    }\n  },\n  lvl1: {\n    iteration: \"lvl1\",\n    acl: [\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_asset\",\n                assetId: \"62\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              name: \"TestGroup\",\n              roleId: 1,\n              userGroupId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_asset\",\n          assetId: \"62\",\n        },\n        benchmarkId: \"Windows_10_STIG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_asset\",\n                assetId: \"62\",\n              },\n              access: \"r\",\n            },\n            grantee: {\n              name: \"TestGroup\",\n              roleId: 1,\n              userGroupId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"rw\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-1\",\n          assetId: \"42\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              label: {\n                name: \"test-label-lvl1\",\n                labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\n              },\n              access: \"rw\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              name: \"TestGroup\",\n              roleId: 1,\n              userGroupId: 1,\n            },\n          },\n        ],\n      },\n      {\n        access: \"r\",\n        asset: {\n          name: \"Collection_X_lvl1_asset-2\",\n          assetId: \"154\",\n        },\n        benchmarkId: \"VPN_SRG_TEST\",\n        aclSources: [\n          {\n            aclRule: {\n              asset: {\n                name: \"Collection_X_lvl1_asset-2\",\n                assetId: \"154\",\n              },\n              access: \"r\",\n              benchmarkId: \"VPN_SRG_TEST\",\n            },\n            grantee: {\n              name: \"TestGroup\",\n              roleId: 1,\n              userGroupId: 1,\n            },\n          },\n        ],\n      },\n    ],\n    defaultAccess: \"none\",\n    userId: \"85\",\n    roleId: 1,\n    userGroupIds: [\"1\"],\n    collectionGrants: [\"21\"],\n    privileges: {\n      admin: false,\n      create_collection: false,\n    },\n    webPreferences: {\n      darkMode: true,\n      lastWhatsNew: \"2000-01-01\"\n    }\n   \n  },\n  lvl2: {\n    iteration: \"lvl2\",\n    userId: \"87\",\n    acl: [],\n    defaultAccess: \"rw\",\n    roleId: 2,\n    userGroupIds: [],\n    collectionGrants: [\"21\",\"1\"],\n    privileges: {\n      admin: false,\n      create_collection: false,\n    },\n    webPreferences: {\n      darkMode: true,\n      lastWhatsNew: \"2000-01-01\"\n    }\n  },\n  lvl3: {\n    iteration: \"lvl3\",\n    acl: [],\n    defaultAccess: \"rw\",\n    userId: \"87\",\n    roleId: 3,\n    userGroupIds: [],\n    collectionGrants: [\"21\", \"1\"],\n    privileges: {\n      admin: false,\n      create_collection: false,\n    },\n    webPreferences: {\n      darkMode: true,\n      lastWhatsNew: \"2000-01-01\"\n    }\n  },\n  lvl4: {\n    iteration: \"lvl4\",\n    acl: [],\n    defaultAccess: \"rw\",\n    userId: \"87\",\n    roleId: 4,\n    userGroupIds: [],\n    collectionGrants: [\"21\", \"1\", \"85\"],\n    privileges: {\n      admin: false,\n      create_collection: false,\n    },\n    webPreferences: {\n      darkMode: true,\n      lastWhatsNew: \"2000-01-01\"\n    }\n  },\n  collectioncreator: {\n    iteration: \"collectioncreator\",\n    userId: \"82\",\n    userGroupIds: [],\n    collectionGrants: [],\n    privileges: {\n      admin: false,\n      create_collection: true,\n    },\n    webPreferences: {\n      darkMode: true,\n      lastWhatsNew: \"2000-01-01\"\n    }\n  },\n}"
  },
  {
    "path": "test/api/mocha/data/user/requestBodies.js",
    "content": "//This data contains expected response data that varies by iteration \"scenario\" or \"iteration\" for each test case. These expectations are relative to the \"referenceData.js\" data used to construct the API requests.\r\nimport reference from '../../referenceData.js'\r\nexport const requestBodies = {\r\n  scrapUser: {\r\n      \"username\": \"additionalTemp\",\r\n      \"collectionGrants\": [\r\n          {\r\n              \"collectionId\": reference.scrapCollection.collectionId,\r\n              \"roleId\": 1\r\n          }\r\n      ]\r\n  }\r\n}\r\n"
  },
  {
    "path": "test/api/mocha/data/user/user.test.js",
    "content": "\nimport { v4 as uuidv4 } from 'uuid'\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {requestBodies} from \"./requestBodies.js\"\nimport {iterations} from '../../iterations.js'\nimport {expectations} from './expectations.js'\nimport { expect } from 'chai'\n\nlet testUser = null\nconst randomValue = utils.getUUIDSubString(10)\n\ndescribe('user', () => {\n\n  before(async function () {\n    await utils.loadAppData()\n  })\n\n  for(const iteration of iterations) {\n    const distinct = expectations[iteration.name]\n\n    describe(`iteration:${iteration.name}`, () => {\n\n      before(async function () {\n        await utils.loadAppData()\n          // this is here because after we do the gets we need to create a temp user to do all posts, patches, and puts etc on. \n      // as a result we will have an extra user in the gets to consider\n        const create =  JSON.parse(JSON.stringify(requestBodies.scrapUser))\n        create.username = create.username + utils.getUUIDSubString(10)\n        testUser = await utils.createUser(create)\n      })\n\n      describe('GET - user', () => {\n\n        describe(`getUser - /user`, () => {\n\n          it('Return the requesters user information - check user', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/user?projection=webPreferences`, 'GET', iteration.token)\n\n            expect(res.status).to.eql(200)\n            expect(res.body.username, \"expect username to be current user\").to.equal(iteration.name)\n            const userGroupIds = res.body.userGroups.map(group => group.userGroupId)\n            expect(userGroupIds).to.eql(distinct.userGroupIds)\n            for(const grant of res.body.collectionGrants) {\n              expect(grant.collection.collectionId).to.be.oneOf(distinct.collectionGrants)\n            }\n            expect(res.body.status).to.be.eql('available')\n            expect(res.body.userId, \"expect userId to be current user\").to.equal(iteration.userId)\n            expect(res.body.webPreferences).to.be.an('object')\n            expect(res.body.webPreferences).to.eql(distinct.webPreferences)\n          })\n\n          it(\"Return the requesters user information verify last access and privileges data\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/user`, 'GET', iteration.token)\n\n            expect(res.status).to.eql(200)\n            expect(res.body.username, \"expect username to be current user\").to.equal(iteration.name)\n            expect(res.body.lastAccess).to.be.a('number')\n            const lastAccessDate = new Date(res.body.lastAccess * 1000)\n            expect(lastAccessDate).to.be.lessThan(new Date())\n            expect(res.body.privileges).to.eql(distinct.privileges)\n\n          })\n        })\n        \n        describe(`getUsers - /user`, () => {\n\n          it('Return a list of users accessible to the requester USERNAME', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true&username=${reference.wfTest.username}&projection=collectionGrants&projection=statistics&projection=webPreferences`, 'GET', iteration.token)\n\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array')\n            expect(res.body[0].username, \"expect user to be wf-test\").to.equal('wf-test')\n            expect(res.body[0].userId, \"expect userId to be wfTest userId\").to.equal(reference.wfTest.userId)\n            expect(res.body[0].collectionGrants).to.be.an('array')\n            expect(res.body[0].statistics).to.be.an('object')\n            expect(res.body[0].webPreferences).to.be.an('object')\n            expect(res.body[0].webPreferences).to.eql(reference.wfTest.webPreferences)\n            for(let grant of res.body[0].collectionGrants) {\n              expect(grant).to.have.property('collection')\n              expect(grant).to.have.property('roleId')\n              expect(grant.collection.collectionId, \"expect collectionId to be scrapCollection Id\").to.equal(reference.scrapCollection.collectionId)\n            }\n          })\n          it('Return a list of users accessible to the requester username with match=exact', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true&username=${reference.wfTest.username}&username-match=exact&projection=collectionGrants&projection=statistics`, 'GET', iteration.token)\n\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array')\n            expect(res.body[0].username, \"expect user to be wf-test\").to.equal('wf-test')\n            expect(res.body[0].userId, \"expect userId to be wfTest userId\").to.equal(reference.wfTest.userId)\n          })\n          it('Return a list of users accessible to the requester username with match=startsWith', async () => {\n            // get first 3 characters of username\n            const username = reference.wfTest.username.substring(0, 3)\n            const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true&username=${username}&username-match=startsWith&projection=collectionGrants&projection=statistics`, 'GET', iteration.token)\n\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array')\n            expect(res.body[0].username, \"expect user to be wf-test\").to.equal('wf-test')\n            expect(res.body[0].userId, \"expect userId to be wfTest userId\").to.equal(reference.wfTest.userId)\n          })\n          it('Return a list of users accessible to the requester username with match=endsWith', async () => {\n            // get last 3 characters of username\n            const username = reference.wfTest.username.substring(reference.wfTest.username.length - 3)\n            const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true&username=${username}&username-match=endsWith&projection=collectionGrants&projection=statistics`, 'GET', iteration.token)\n\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array')\n            expect(res.body[0].username, \"expect user to be wf-test\").to.equal('wf-test')\n            expect(res.body[0].userId, \"expect userId to be wfTest userId\").to.equal(reference.wfTest.userId)\n          })\n          it('Return a list of users accessible to the requester username with match=contains', async () => {\n            // get middle 3 characters of username\n            const username = reference.wfTest.username.substring(3, 6)\n            const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true&username=${username}&username-match=contains&projection=collectionGrants&projection=statistics`, 'GET', iteration.token)\n\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array')\n            expect(res.body[0].username, \"expect user to be wf-test\").to.equal('wf-test')\n            expect(res.body[0].userId, \"expect userId to be wfTest userId\").to.equal(reference.wfTest.userId)\n          })\n          it('Return a list of user accessible to the requester USERNAME no projections', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true&username=${reference.wfTest.username}`, 'GET', iteration.token)\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array')\n            expect(res.body[0].username,\"expect user to be wf-test\").to.equal('wf-test')\n            expect(res.body[0].userId, \"expect userId to be wfTest userId\").to.equal(reference.wfTest.userId)\n          })\n          it('Return a list of user accessible to the requester with elevate and projections', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true&projection=collectionGrants&projection=statistics`, 'GET', iteration.token)\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array')\n            // plus one for test user created in before\n            expect(res.body, \"expect to get back all usersIds with elevate\").to.be.an('array').of.length(reference.allUserIds.length + 1)\n            for(let user of res.body) {\n              expect(user).to.have.property('collectionGrants')\n              expect(user).to.have.property('statistics')\n              expect(user).to.have.property('username')\n              expect(user).to.have.property('userId')\n              const newIds = reference.allUserIds.concat(testUser.userId)\n              expect(user.userId, \"expect userId to be one of the users the system\").to.be.oneOf(newIds)\n            }\n          })\n          it('Return a list of users accessible to the requester no projections for lvl1 success. ', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users`, 'GET', iteration.token)\n      \n            expect(res.status).to.eql(200)\n            // plus one for test user created in before\n            expect(res.body).to.be.an('array').of.length(reference.allUserIds.length + 1)\n            for(let user of res.body) {\n              // plus one for test user created in before\n              const newIds = reference.allUserIds.concat(testUser.userId)\n              expect(user.userId, \"expect userId to be one of the users the system\").to.be.oneOf(newIds)\n            }\n          })\n          it(\"return lvl1 user and verify its group membership\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true&username=lvl1&projection=userGroups`, 'GET', iteration.token)\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array')\n            expect(res.body[0].username, \"expect username to be lvl1\").to.equal('lvl1')\n            expect(res.body[0].userId, \"expect userId to be lvl1 userId\").to.equal(reference.lvl1User.userId)\n            expect(res.body[0].userGroups).to.be.an('array')\n            expect(res.body[0].userGroups, \"expect user to be in TestGroup\").to.eql([{ userGroupId: reference.testCollection.testGroup.userGroupId, name: reference.testCollection.testGroup.name }])\n\n          })\n          it(\"should return all users with admin privileges\", async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true&privilege=admin`, 'GET', iteration.token)\n\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n\n            for(const user of res.body) {\n              expect(user.privileges.admin, \"expect user to have admin privilege\").to.be.true\n            }\n          })\n          it(\"should return all users with create_collection privileges\", async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true&privilege=create_collection`, 'GET', iteration.token)\n\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            for(const user of res.body) {\n              expect(user.privileges.create_collection, \"expect user to have create_collection privilege\").to.be.true\n            }\n          })\n          it(\"should throw SmError.PrivilegeError no elevate with projections.\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users?projection=collectionGrants`, 'GET', iteration.token)\n            expect(res.status).to.eql(403)\n          })\n        })\n\n        describe(`getUserByUserId - /users{userId}`, async () => {\n\n          it('Return wfTest user user', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users/${reference.wfTest.userId}?elevate=true&projection=collectionGrants&projection=statistics&projection=webPreferences`, 'GET', iteration.token)\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body).to.have.property('collectionGrants')\n            expect(res.body).to.have.property('statistics')\n            expect(res.body.username, \"expect username to be wf-Test\").to.equal(reference.wfTest.username)\n            expect(res.body.userId, \"expect userId to be wf-Test userId (22)\").to.equal(reference.wfTest.userId)\n            expect(res.body.privileges).to.eql({admin: false, create_collection: false})\n            expect(res.body.webPreferences).eql(reference.wfTest.webPreferences)\n          })\n          it(\"return adminBurke user and verify its privileges\", async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/users/${reference.adminBurke.userId}?elevate=true`, 'GET', iteration.token)\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body.username, \"expect username to be admin\").to.equal(reference.adminBurke.username)\n            expect(res.body.userId, \"expect userId to be admin userId\").to.equal(reference.adminBurke.userId)\n            expect(res.body.privileges).to.eql({admin: true, create_collection: true})\n          })\n          it(\"return lvl1 user and verify its group membership\", async () => {\n            const res =  await utils.executeRequest(`${config.baseUrl}/users/${reference.lvl1User.userId}?elevate=true&projection=userGroups`, 'GET', iteration.token)\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body.username, \"expect username to be lvl1\").to.equal('lvl1')\n            expect(res.body.userId, \"expect userId to be lvl1 userId\").to.equal(reference.lvl1User.userId)\n            expect(res.body.userGroups).to.be.an('array')\n            expect(res.body.userGroups, \"expect user to be in TestGroup\").to.eql([{ userGroupId: reference.testCollection.testGroup.userGroupId, name: reference.testCollection.testGroup.name }])\n\n          })\n        })\n        \n        describe(`getUserWebPreferences - /user/web-preferences`, () => {\n          it(\"should return user web preferences for user\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/user/web-preferences`, 'GET', iteration.token)\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body.darkMode).to.eql(distinct.webPreferences.darkMode)\n            expect(res.body.lastWhatsNew).to.eql(distinct.webPreferences.lastWhatsNew)\n          })\n        })\n      })\n\n      describe('POST - user', () => {\n        describe(`POST - createUser - /users`, () => {\n          \n          let tempUser = null\n          it('Create a user', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true&projection=collectionGrants&projection=statistics`, 'POST', iteration.token, {\n                  \"username\": \"TEMP_USER\" +  randomValue,\n                  \"collectionGrants\": [\n                      {\n                          \"collectionId\": `${reference.scrapCollection.collectionId}`,\n                          \"roleId\": 1\n                      }\n                  ]\n              })\n              if(iteration.name != \"stigmanadmin\"){\n                expect(res.status).to.eql(403)\n                return\n              }\n              tempUser = res.body\n              expect(res.status).to.eql(201)\n              expect(res.body).to.be.an('object')\n              for(let grant of res.body.collectionGrants) {\n                expect(grant).to.have.property('collection')\n                expect(grant).to.have.property('roleId')\n                expect(grant.collection.collectionId, \"Expect collectionId to be scrapColleciton Id\").to.equal(reference.scrapCollection.collectionId)\n              }\n              const createdUser = await utils.getUser(res.body.userId)\n              expect(createdUser).to.be.an('object')\n              expect(createdUser.username, \"expecte created userId to be equal to the userId retured from API\").to.equal(res.body.username)\n              expect(createdUser.userId, ).to.equal(res.body.userId)\n              expect(createdUser.collectionGrants).to.be.an('array')\n              expect(createdUser.collectionGrants, \"expect created user to have a single grant to scrap collection\").to.have.lengthOf(1)\n          })\n          it(\"Create a user in test userGroup\", async () => {\n            const uuid10Chars = uuidv4().substring(0, 10)\n            const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true&projection=userGroups&projection=collectionGrants`, 'POST', iteration.token, {\n                  \"username\": \"TEMP_USER\" + uuid10Chars,\n                  \"userGroups\": [reference.testCollection.testGroup.userGroupId],\n                  \"collectionGrants\": []\n              })\n              if(iteration.name != \"stigmanadmin\"){\n                expect(res.status).to.eql(403)\n                return\n              }\n              expect(res.status).to.eql(201)\n              expect(res.body.username, \"expect username to be TEMP_USER\").to.equal(\"TEMP_USER\" + uuid10Chars)\n              expect(res.body.userGroups).to.be.an('array')\n              expect(res.body.userGroups, \"expect user to be in TestGroup\").to.eql([{ userGroupId: reference.testCollection.testGroup.userGroupId, name: reference.testCollection.testGroup.name }])\n              expect(res.body.collectionGrants).to.be.an('array').of.length(1)              \n              for(let grant of res.body.collectionGrants) {\n                expect(grant.collection.collectionId).to.be.eql(reference.testCollection.collectionId)\n                expect(grant.roleId, \"expect grant to be restricted\").to.equal(reference.testCollection.testGroup.roleId)\n                for(const grantee of grant.grantees) {\n                  expect(grantee.userGroupId, \"expect grantee to be in TestGroup\").to.equal(reference.testCollection.testGroup.userGroupId)\n                }\n              }\n          })\n          if(iteration.name == \"stigmanadmin\"){\n          \n            it('should throw SmError.UnprocessableError collectionIds are invalid.', async () => {\n              const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true`, 'POST', iteration.token, {\n                    \"username\": \"TEST_USER\" + randomValue,\n                    \"collectionGrants\": [\n                        {\n                            \"collectionId\": `${\"1234321\"}`,\n                            \"roleId\": 1\n                        }\n                    ]\n                })\n                if(iteration.name != \"stigmanadmin\"){\n                  expect(res.status).to.eql(403)\n                  return\n                }\n                expect(res.status).to.eql(422)\n            })\n            it('should throw SmError.UnprocessableError Duplicate name exists.', async () => {\n              const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true`, 'POST', iteration.token, {\n                    \"username\": `${tempUser.username}`,\n                    \"collectionGrants\": [\n                        {\n                            \"collectionId\": `${reference.scrapCollection.collectionId}`,\n                            \"roleId\": 1\n                        }\n                    ]\n                })\n                if(iteration.name != \"stigmanadmin\"){\n                  expect(res.status).to.eql(403)\n                  return\n                }\n                expect(res.status).to.eql(422)\n            })\n          }\n          if(iteration.name == \"stigmanadmin\"){\n            it('cleanup - delete temp user', async () => {\n              const res = await utils.executeRequest(`${config.baseUrl}/users/${tempUser.userId}?elevate=true`, 'DELETE', iteration.token)\n              if(iteration.name != \"stigmanadmin\"){\n                expect(res.status).to.eql(403)\n                return\n              }\n              expect(res.status).to.eql(200)\n            })\n          }\n        \n        })\n      })\n\n      describe('PATCH - user', () => {\n\n        describe(`PATCH - updateUser - /users{userId}`, async () => {\n\n          it('Merge provided properties with a user - Change Username', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users/${testUser.userId}?elevate=true&projection=collectionGrants&projection=statistics`, 'PATCH', iteration.token, {\n                    \"username\": \"PatchTest\",\n                })\n                if(iteration.name != \"stigmanadmin\"){\n                  expect(res.status).to.eql(403)\n                  return\n                }\n                expect(res.status).to.eql(200)\n                expect(res.body.username).to.equal('PatchTest')\n                expect(res.body.userId, \"expect userId to be equal to scraplvl1users userId\").to.equal(testUser.userId)\n\n                for(let grant of res.body.collectionGrants) {\n                  expect(grant).to.have.property('collection')\n                  expect(grant).to.have.property('roleId')\n                  expect(grant.collection.collectionId, \"expect collectionId to be scrapCollection Id\").to.equal(reference.scrapCollection.collectionId)\n                }\n\n                const userEffected = await utils.getUser(testUser.userId)\n\n                expect(userEffected).to.be.an('object')\n                expect(userEffected.username, \"expectthe effected user to be the one returned by the api\").to.equal(res.body.username)\n                expect(userEffected.userId,\"expectthe effected user to be the one returned by the api\").to.equal(res.body.userId)\n          })\n          it(\"edit lvl1 users group membership to no groups. \", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users/${reference.lvl1User.userId}?elevate=true&projection=userGroups&projection=collectionGrants`, 'PATCH', iteration.token, {\n                  \"userGroups\": []\n                })\n              if(iteration.name != \"stigmanadmin\"){\n                expect(res.status).to.eql(403)\n                return\n              }\n              expect(res.status).to.eql(200)\n              expect(res.body.username, \"expect username to be lvl1\").to.equal('lvl1')\n              expect(res.body.userId, \"expect userId to be lvl1 userId\").to.equal(reference.lvl1User.userId)\n              expect(res.body.userGroups).to.be.an('array').of.length(0)\n              expect(res.body.collectionGrants).to.be.an('array').of.length(0)\n          })\n          it(\"add lvl1 user back to test group\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users/${reference.lvl1User.userId}?elevate=true&projection=userGroups&projection=collectionGrants`, 'PATCH', iteration.token, {\n                  \"userGroups\": [reference.testCollection.testGroup.userGroupId]\n                })\n              if(iteration.name != \"stigmanadmin\"){\n                expect(res.status).to.eql(403)\n                return\n              }\n              expect(res.status).to.eql(200)\n              expect(res.body.username, \"expect username to be lvl1\").to.equal('lvl1')\n              expect(res.body.userId, \"expect userId to be lvl1 userId\").to.equal(reference.lvl1User.userId)\n              expect(res.body.userGroups).to.be.an('array').of.length(1)\n              expect(res.body.userGroups, \"expect user to be in TestGroup\").to.eql([{ userGroupId: reference.testCollection.testGroup.userGroupId, name: reference.testCollection.testGroup.name }])\n              expect(res.body.collectionGrants).to.be.an('array').of.length(1)\n\n          })\n          it(\"should throw SmError.UnprocessableError collectionIds are invalid.\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users/${testUser.userId}?elevate=true`, 'PATCH', iteration.token, {\n                  \"username\": \"PatchTest\",\n                  \"collectionGrants\": [\n                      {\n                          \"collectionId\": `1234321`,\n                          \"roleId\": 1\n                      }\n                  ]\n                })\n                if(iteration.name != \"stigmanadmin\"){\n                  expect(res.status).to.eql(403)\n                  return\n                }\n                expect(res.status).to.eql(422)\n          })\n          it(\"should throw 404 userId doesnt exist.\", async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/users/0?elevate=true`, 'PATCH', iteration.token, {\n                  \"username\": \"PatchTest\",\n                  \"collectionGrants\": [\n                      {\n                          \"collectionId\": `${reference.scrapCollection.collectionId}`,\n                          \"roleId\": 1\n                      }\n                  ]\n                })\n                if(iteration.name != \"stigmanadmin\"){\n                  expect(res.status).to.eql(403)\n                  return\n                }\n                expect(res.status).to.eql(404)\n          })\n        })\n\n        describe(`PATCH - patchUserWebPreferences - /user/web-preferences`, () => {\n          it(\"should update user web preferences for user\", async () => {\n            const patch = {\n              darkMode: false,\n              lastWhatsNew: \"2025-01-01\"\n            }\n            const res = await utils.executeRequest(`${config.baseUrl}/user/web-preferences`, 'PATCH', iteration.token, patch)\n            expect(res.status).to.eql(200)\n            expect(res.body).to.eql({\n              \"darkMode\": false,\n              \"lastWhatsNew\": \"2025-01-01\"\n            })\n          })\n\n          it('should reject request with invalid key', async () => {\n            const patch = {\n              invalidKey: false\n            }\n            const res = await utils.executeRequest(`${config.baseUrl}/user/web-preferences`, 'PATCH', iteration.token, patch)\n            expect(res.status).to.eql(400)\n          })\n\n          it('should reject request with invalid value type for darkMode', async () => {\n            const patch = {\n              darkMode: \"not-a-boolean\"\n            }\n            const res = await utils.executeRequest(`${config.baseUrl}/user/web-preferences`, 'PATCH', iteration.token, patch)\n            expect(res.status).to.eql(400)\n          })\n\n          it('should reject request with invalid value type for lastWhatsNew', async () => {  \n            const patch = {\n              lastWhatsNew: 1234567890 \n            }\n            const res = await utils.executeRequest(`${config.baseUrl}/user/web-preferences`, 'PATCH', iteration.token, patch)\n            expect(res.status).to.eql(400)\n          })\n        })\n      })\n        \n      describe('PUT - user', () => {\n        describe(`PUT - replaceUser - /users{/userId}`, async () => {\n\n          it(`Set all properties of a user - Change Username`, async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/users/${testUser.userId}?elevate=true&projection=collectionGrants&projection=statistics`, 'PUT', iteration.token, {\n              \"username\": \"putTesting\",\n              \"collectionGrants\": [\n                  {\n                      \"collectionId\": `${reference.scrapCollection.collectionId}`,\n                      \"roleId\": 1\n                  }\n              ]\n            })\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('object')\n            expect(res.body.username, \"expect username to be putTesting\").to.equal('putTesting')\n            expect(res.body.userId, \"expect userId to be scraplvl1\").to.equal(testUser.userId)\n            expect(res.body.collectionGrants).to.be.an('array')\n            expect(res.body.statistics).to.be.an('object')\n\n            for(let grant of res.body.collectionGrants) {\n              expect(grant).to.have.property('collection')\n              expect(grant).to.have.property('roleId')\n              expect(grant.collection.collectionId, \"expect to have grant to the scrap collection\").to.equal(reference.scrapCollection.collectionId)\n            }\n\n            const userEffected = await utils.getUser(res.body.userId)\n\n            expect(userEffected).to.be.an('object')\n            expect(userEffected.username, \"user effected to have username returned by API\").to.equal(res.body.username)\n            expect(userEffected.userId, \"user effected to have Id returned by API\").to.equal(res.body.userId)\n            expect(userEffected.collectionGrants).to.be.an('array')\n\n          })\n\n          it(\"should throw SmError.UnprocessableError collectionIds are invalid.\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users/${testUser.userId}?elevate=true`, 'PUT', iteration.token, {\n                  \"username\": \"putTesting\",\n                  \"collectionGrants\": [\n                      {\n                          \"collectionId\": `1234321`,\n                          \"roleId\": 1\n                      }\n                  ]\n                })\n                if(iteration.name != \"stigmanadmin\"){\n                  expect(res.status).to.eql(403)\n                  return\n                }\n                expect(res.status).to.eql(422)\n          })\n\n          it(\"edit lvl1 users group membership to no groups and add direct level 1 roleId to test collecton \", async () => {\n            const res = await utils.executeRequest(\n                `${config.baseUrl}/users/${reference.lvl1User.userId}?elevate=true&projection=userGroups&projection=collectionGrants`,\n                'PUT',\n                iteration.token,\n                {\n                  username: \"lvl1\",\n                  collectionGrants: [\n                    {\n                      roleId: 1,\n                      collectionId: reference.testCollection.collectionId,\n                    },\n                  ],\n                  userGroups: [],\n                }\n              )\n              if(iteration.name != \"stigmanadmin\"){\n                expect(res.status).to.eql(403)\n                return\n              }\n              expect(res.status).to.eql(200)\n              expect(res.body.username, \"expect username to be lvl1\").to.equal('lvl1')\n              expect(res.body.userId, \"expect userId to be lvl1 userId\").to.equal(reference.lvl1User.userId)\n              expect(res.body.userGroups).to.be.an('array').of.length(0)\n              expect(res.body.collectionGrants).to.be.an('array').of.length(1)\n              expect(res.body.collectionGrants[0].collection.collectionId, \"expect collectionId to be testCollection\").to.equal(reference.testCollection.collectionId)\n              expect(res.body.collectionGrants[0].roleId, \"expect roleId to be 1\").to.equal(1)\n              expect(res.body.collectionGrants[0].grantees).to.be.an('array').of.length(1)\n              expect(res.body.collectionGrants[0].grantees[0].userId, \"expect grantee to be the user\").to.equal(reference.lvl1User.userId)\n          })\n\n          it(\"add lvl1 user back to test group\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users/${reference.lvl1User.userId}?elevate=true&projection=userGroups&projection=collectionGrants`, 'PUT', iteration.token, {\n                    username: \"lvl1\",\n                    collectionGrants: [],\n                    userGroups: [reference.testCollection.testGroup.userGroupId]\n                })\n              if(iteration.name != \"stigmanadmin\"){\n                expect(res.status).to.eql(403)\n                return\n              }\n              expect(res.status).to.eql(200)\n              expect(res.body.username, \"expect username to be lvl1\").to.equal('lvl1')\n              expect(res.body.userId, \"expect userId to be lvl1 userId\").to.equal(reference.lvl1User.userId)\n              expect(res.body.userGroups).to.be.an('array').of.length(1)\n              expect(res.body.userGroups, \"expect user to be in TestGroup\").to.eql([{ userGroupId: reference.testCollection.testGroup.userGroupId, name: reference.testCollection.testGroup.name }])\n              expect(res.body.collectionGrants).to.be.an('array').of.length(1)\n\n          })\n\n          it(\"should throw error, no elevate\", async () => {  \n            const res = await utils.executeRequest(`${config.baseUrl}/users/${testUser.userId}`, 'PUT', iteration.token, {\n                  \"username\": \"putTesting\",\n                  \"collectionGrants\": [\n                      {\n                          \"collectionId\": `${reference.scrapCollection.collectionId}`,\n                          \"roleId\": 1\n                      }\n                  ]\n                })\n                expect(res.status).to.eql(403)\n          })\n\n          it(\"should throw 404 userId doesnt exist.\", async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/users/0?elevate=true`, 'PUT', iteration.token, {\n                  \"username\": \"put\",\n                  \"collectionGrants\": [\n                      {\n                          \"collectionId\": `${reference.scrapCollection.collectionId}`,\n                          \"roleId\": 1\n                      }\n                  ]\n                })\n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(404)\n          })\n        })\n      })\n\n      describe('DELETE - user', () => {\n\n        describe(`DELETE - deleteUser - /users/{userId}`, async () => {\n          it('Delete a user - fail due to user access record', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users/${reference.testCollection.collectionOwnerID}?elevate=true&projection=collectionGrants&projection=statistics`, 'DELETE', iteration.token)\n              if(iteration.name != \"stigmanadmin\"){\n                expect(res.status).to.eql(403)\n                return\n              }\n              expect(res.status).to.eql(422)\n          })\n          it('Delete a user - succeed, as user has never accessed the system', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users/${reference.deleteUser.userId}?elevate=true`, 'DELETE', iteration.token)\n              if(iteration.name != \"stigmanadmin\"){\n                expect(res.status).to.eql(403)\n                return\n              }\n              expect(res.status).to.eql(200)\n              const userEffected = await utils.getUser(\"43\")\n              expect(userEffected.status, \"expect 404 response (user delete worked)\").to.equal(404)\n          })\n          it('Delete a user - not elevated expect fail', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/users/${43}?elevate=false`, 'DELETE', iteration.token)\n              expect(res.status).to.eql(403)\n          })\n          if(iteration.name === \"stigmanadmin\"){\n            it('Delete test user for cleanup', async () => {\n              const res = await utils.executeRequest(`${config.baseUrl}/users/${testUser.userId}?elevate=true`, 'DELETE', iteration.token)\n                expect(res.status).to.eql(200)\n            })\n          }\n        })\n      })\n    })\n  }\n})"
  },
  {
    "path": "test/api/mocha/data/user-group/requestBodies.js",
    "content": "//This data contains expected response data that varies by iteration \"scenario\" or \"iteration\" for each test case. These expectations are relative to the \"referenceData.js\" data used to construct the API requests.\r\nimport reference from '../../referenceData.js'\r\nexport const requestBodies = {\r\n  scrapUser: {\r\n      \"username\": \"additionalTemp\",\r\n      \"collectionGrants\": [\r\n          {\r\n              \"collectionId\": reference.scrapCollection.collectionId,\r\n              \"roleId\": 1\r\n          }\r\n      ]\r\n  }\r\n}\r\n"
  },
  {
    "path": "test/api/mocha/data/user-group/user-group.test.js",
    "content": "\nimport { v4 as uuidv4 } from 'uuid'\nimport {config } from '../../testConfig.js'\nimport * as utils from '../../utils/testUtils.js'\nimport reference from '../../referenceData.js'\nimport {iterations} from '../../iterations.js'\nimport {expect} from 'chai'\n\ndescribe('user-group', () => {\n\n  for(const iteration of iterations) {\n\n    describe(`iteration:${iteration.name}`, () => {\n\n      describe('POST - user-groups', () => {\n\n        describe(`POST - createUserGroup - /user-groups`, () => {\n          before(async function () {\n            await utils.loadAppData()\n          })\n\n          it('should create a userGroup', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true&projection=collectionGrants&projection=users&projection=attributions`, 'POST', iteration.token, {\n                  \"name\": \"group\" +  uuidv4(),\n                  \"description\": \"test group\",\n                  \"userIds\": [\n                    iteration.userId,    \n                  ],\n                  \"collectionGrants\": [{\n                    collectionId: reference.testCollection.collectionId,\n                    roleId: 3 // manage\n                  }]\n              })\n              if(iteration.name != \"stigmanadmin\"){\n                expect(res.status).to.eql(403)\n                return\n              }\n              expect(res.status).to.eql(201)\n              expect(res.body.name).to.contain('group')\n              expect(res.body.description).to.equal('test group')\n              for(let grant of res.body.collectionGrants) {\n                expect(grant.collection.collectionId, \"expect collectionId to be equal to the collectionId returned from API\").to.equal(reference.testCollection.collectionId)\n                expect(grant.roleId, \"expect roleId to be equal to the roleId returned from API\").to.equal(3)\n              }\n              for(let user of res.body.users) {\n                expect(user.userId, \"expect userId to be equal to the userId returned from API\").to.equal(iteration.userId)\n                expect(user.username, \"expect username to be equal to the username returned from API\").to.equal(iteration.name)\n              }\n              expect(res.body.attributions.created.userId, \"expect userId to be equal to the userId returned from API\").to.equal(iteration.userId)\n              expect(res.body.attributions.created.username, \"expect username to be equal to the username returned from API\").to.equal(iteration.name)\n              expect(res.body.attributions.modified.userId, \"expect userId to be equal to the userId returned from API\").to.equal(iteration.userId)\n              expect(res.body.attributions.modified.username, \"expect username to be equal to the username returned from API\").to.equal(iteration.name)\n          })\n\n          if(iteration.name == \"stigmanadmin\"){\n          \n            it('should throw SmError.UnprocessableError Duplicate name exists.', async () => {\n              const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true`, 'POST', iteration.token, {\n                \"name\": reference.testCollection.testGroup.name,\n                \"description\": \"test group\",\n                \"userIds\": [\n                  iteration.userId   \n                ]\n              })\n              expect(res.status).to.eql(422)\n            })\n\n            it('should throw SmError.UnprocessableError userIds contains invalid userId.', async () => {\n              const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true`, 'POST', iteration.token, {\n                \"name\": \"group\" +  uuidv4(),\n                \"description\": \"test group\",\n                \"userIds\": [\n                  \"99999999\"   \n                ]\n              })\n              expect(res.status).to.eql(422)\n            })\n\n            it('should throw SmError.UnprocessableError collectionGrants contains invalid collectionId.', async () => {\n              const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true`, 'POST', iteration.token, {\n                \"name\": \"group\" +  uuidv4(),\n                \"description\": \"test group\",\n                \"collectionGrants\": [\n                  {\n                    \"collectionId\": \"99999999\",\n                    \"roleId\": 3\n                  }\n                ]\n              })\n              expect(res.status).to.eql(422)\n            })\n\n          }\n        })\n      })\n\n      describe('GET - user-groups', () => {\n        \n        before(async function () {\n            await utils.loadAppData()\n        })\n\n        describe(`getUserGroups - /user-groups`, () => {\n\n          it('should return all userGroups  ', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/user-groups?projection=users&projection=collectionGrants&elevate=true`, 'GET', iteration.token)\n            \n            if(iteration.name != \"stigmanadmin\"){\n              expect(res.status).to.eql(403)\n              return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(1)\n            expect(res.body[0].name).to.equal(reference.testCollection.testGroup.name)\n            expect(res.body[0].description).to.equal(reference.testCollection.testGroup.description)\n            expect(res.body[0].userGroupId).to.equal(reference.testCollection.testGroup.userGroupId)\n\n            expect(res.body[0].users).to.be.an('array').of.length(1)\n            for(const user of res.body[0].users) {\n              expect(user.userId, \"expect lvl1 user to be in the group\").to.equal(reference.lvl1User.userId)\n              expect(user.username, \"expect username to be equal to the username returned from API\").to.equal(reference.lvl1User.username)\n            }\n\n            expect(res.body[0].collectionGrants).to.be.an('array').of.length(1)\n\n            for(const collection of res.body[0].collectionGrants) {\n                expect(collection.collection.collectionId, \"expect that this group is in the test collection 21\").to.equal(reference.testCollection.collectionId)\n                expect(collection.collection.name, \"expect that this group is in the test collection 21\").to.equal(reference.testCollection.name)\n            }\n            \n          })\n          it('should return all userGroups no projections for all users sucess ', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/user-groups`, 'GET', iteration.token)\n              \n            expect(res.status).to.eql(200)\n            expect(res.body).to.be.an('array').of.length(1)\n            expect(res.body[0].name).to.equal(reference.testCollection.testGroup.name)\n            expect(res.body[0].description).to.equal(reference.testCollection.testGroup.description)\n            expect(res.body[0].userGroupId).to.equal(reference.testCollection.testGroup.userGroupId)\n          })\n        })\n        \n        describe(`getUserGroup - /user-groups/{userGroupId}`, () => {\n\n          it('should return the test usergroup', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/user-groups/${reference.testCollection.testGroup.userGroupId}`, 'GET', iteration.token)\n           \n            expect(res.status).to.eql(200)\n            expect(res.body.name).to.equal(reference.testCollection.testGroup.name)\n            expect(res.body.description).to.equal(reference.testCollection.testGroup.description)\n            expect(res.body.userGroupId).to.equal(reference.testCollection.testGroup.userGroupId)\n          })\n        })\n      })\n     \n      describe('PATCH - user-groups', () => {\n\n        describe(`PATCH - patchUserGroup - /user-groups/{userGroupId}`, async () => {\n\n            it(\"should change the name and description of the userGroup\", async () => {\n                const res = await utils.executeRequest(`${config.baseUrl}/user-groups/${reference.testCollection.testGroup.userGroupId}?elevate=true`, 'PATCH', iteration.token, {\n                        \"name\": \"patchedName\",\n                        \"description\": \"patchedDescription\"\n                    })\n\n                if(iteration.name != \"stigmanadmin\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                expect(res.body.name).to.equal('patchedName')\n                expect(res.body.description).to.equal('patchedDescription')\n                expect(res.body.userGroupId).to.equal(reference.testCollection.testGroup.userGroupId)\n            })\n\n            it(\"should change userId list of the group \", async () => {\n                const res = await utils.executeRequest(`${config.baseUrl}/user-groups/${reference.testCollection.testGroup.userGroupId}?elevate=true&projection=users`, 'PATCH', iteration.token, {\n                        \"userIds\": [\n                            reference.lvl1User.userId,\n                            reference.stigmanadmin.userId\n                        ]\n                    })\n\n                if(iteration.name != \"stigmanadmin\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(200)\n                expect(res.body.name).to.equal('patchedName')\n                expect(res.body.description).to.equal('patchedDescription')\n                expect(res.body.userGroupId).to.equal(reference.testCollection.testGroup.userGroupId)\n                expect(res.body.users).to.be.an('array').of.length(2)\n                for(const user of res.body.users) {\n                    expect(user.userId).to.be.oneOf([reference.lvl1User.userId, reference.stigmanadmin.userId])\n                }\n            })\n            \n            it(\"should return empty 404, usergroupId doesnt exist\", async () => {\n                let randomUserGroupId = \"1234321\"\n                const res = await utils.executeRequest(`${config.baseUrl}/user-groups/${randomUserGroupId}?elevate=true`, 'PATCH', iteration.token, {\n                        \"name\": \"test\",\n                        \"description\": \"patchedDescription\"\n                    })\n                if(iteration.name != \"stigmanadmin\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(404)\n            })\n        })\n      })\n\n      describe('PUT - user-groups', () => {\n\n        describe(`PUT - putUserGroup - /user-groups/{userGroupId}`, async () => {\n\n          it(`Set all properties of a user group`, async () => {\n            const newGroupName = \"putGroupName\" +  uuidv4()\n            const newDescription = \"putDescription\" + uuidv4()\n            const res = await utils.executeRequest(`${config.baseUrl}/user-groups/${reference.testCollection.testGroup.userGroupId}?elevate=true&projection=users`, 'PUT', iteration.token, {\n              \"name\": newGroupName,\n              \"description\": newDescription,\n              \"userIds\": [\n                reference.lvl1User.userId, reference.stigmanadmin.userId \n              ]\n            })\n\n            if(iteration.name != \"stigmanadmin\"){\n                expect(res.status).to.eql(403)\n                return\n            }\n            expect(res.status).to.eql(200)\n            expect(res.body.name).to.equal(newGroupName)\n            expect(res.body.description).to.equal(newDescription)\n            expect(res.body.userGroupId).to.equal(reference.testCollection.testGroup.userGroupId)\n            expect(res.body.users).to.be.an('array').of.length(2)\n            for(const user of res.body.users) {\n              expect(user.userId).to.be.oneOf([reference.lvl1User.userId, reference.stigmanadmin.userId])\n            }\n          })\n        })\n      })\n\n      describe('DELETE - user-groups', () => {\n\n\n        describe(`DELETE - deleteUserGroup - /user-groups/{userGroupId}`, async () => {\n\n            let testGroup\n\n            it('should create a userGroup if user can elevate ', async () => {\n                const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true`, 'POST', iteration.token, {\n                    \"name\": \"group\" +  uuidv4(),\n                    \"description\": \"test group\",\n                    \"userIds\": [\n                        iteration.userId,    \n                    ]\n                })\n                if(iteration.name != \"stigmanadmin\"){\n                    expect(res.status).to.eql(403)\n                    return\n                }\n                expect(res.status).to.eql(201)\n                testGroup = res.body\n            })\n            \n            if(iteration.name == \"stigmanadmin\"){\n                it(\"should delete the test userGroup\", async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/user-groups/${testGroup.userGroupId}?elevate=true`, 'DELETE', iteration.token)\n                    if(iteration.name != \"stigmanadmin\"){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(200)\n                    expect(res.body.userGroupId).to.equal(testGroup.userGroupId)\n                    expect(res.body.name).to.equal(testGroup.name)\n                    expect(res.body.description).to.equal(testGroup.description)\n                })\n\n                it(\"verify that the userGroup is deleted\", async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/user-groups/${testGroup.userGroupId}`, 'GET', iteration.token)\n                    expect(res.body.error).to.exist\n                })\n            }\n        })\n      })\n    })\n  }\n})"
  },
  {
    "path": "test/api/mocha/integration/access.test.js",
    "content": "import { v4 as uuidv4 } from 'uuid'\nimport { config } from '../testConfig.js'\nimport * as utils from '../utils/testUtils.js'\nimport reference from '../referenceData.js'\nimport { use, expect } from 'chai'\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nuse(deepEqualInAnyOrder)\n\nconst admin = {\n  name: 'admin',\n  grant: 'Owner',\n  token:\n    'eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ2ODEwMzUsImlhdCI6MTY3MDU0MDIzNiwiYXV0aF90aW1lIjoxNjcwNTQwMjM1LCJqdGkiOiI0N2Y5YWE3ZC1iYWM0LTQwOTgtOWJlOC1hY2U3NTUxM2FhN2YiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJiN2M3OGE2Mi1iODRmLTQ1NzgtYTk4My0yZWJjNjZmZDllZmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjMzNzhkYWZmLTA0MDQtNDNiMy1iNGFiLWVlMzFmZjczNDBhYyIsInNlc3Npb25fc3RhdGUiOiI4NzM2NWIzMy0yYzc2LTRiM2MtODQ4NS1mYmE1ZGJmZjRiOWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIiwiYWRtaW4iXX0sInJlc291cmNlX2FjY2VzcyI6eyJyZWFsbS1tYW5hZ2VtZW50Ijp7InJvbGVzIjpbInZpZXctdXNlcnMiLCJxdWVyeS1ncm91cHMiLCJxdWVyeS11c2VycyJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIHN0aWctbWFuYWdlcjpvcCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIHN0aWctbWFuYWdlcjpvcDpyZWFkIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlciBzdGlnLW1hbmFnZXI6c3RpZyIsInNpZCI6Ijg3MzY1YjMzLTJjNzYtNGIzYy04NDg1LWZiYTVkYmZmNGI5ZiIsIm5hbWUiOiJTVElHTUFOIEFkbWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RpZ21hbmFkbWluIiwiZ2l2ZW5fbmFtZSI6IlNUSUdNQU4iLCJmYW1pbHlfbmFtZSI6IkFkbWluIn0.a1XwJZw_FIzwMXKo-Dr-n11me5ut-SF9ni7ylX-7t7AVrH1eAqyBxX9DXaxFK0xs6YOhoPsh9NyW8UFVaYgtF68Ps6yzoiqFEeiRXkpN5ygICN3H3z6r-YwanLlEeaYR3P2EtHRcrBtCnt0VEKKbGPWOfeiNCVe3etlp9-NQo44'\n}\n\nconst lvl1 = {\n  name: 'lvl1',\n  userId: \"85\",\n  grantId: \"32\",\n  token:\n    'eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDg5ODQsImlhdCI6MTY3MDU2ODE4NCwiYXV0aF90aW1lIjoxNjcwNTY4MTg0LCJqdGkiOiIxMDhmMDc2MC0wYmY5LTRkZjEtYjE0My05NjgzNmJmYmMzNjMiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJlM2FlMjdiOC1kYTIwLTRjNDItOWRmOC02MDg5ZjcwZjc2M2IiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjE0ZmE5ZDdkLTBmZTAtNDQyNi04ZmQ5LTY5ZDc0YTZmMzQ2NCIsInNlc3Npb25fc3RhdGUiOiJiNGEzYWNmMS05ZGM3LTQ1ZTEtOThmOC1kMzUzNjJhZWM0YzciLCJhY3IiOiIxIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtc3RpZ21hbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb246cmVhZCIsInNpZCI6ImI0YTNhY2YxLTlkYzctNDVlMS05OGY4LWQzNTM2MmFlYzRjNyIsIm5hbWUiOiJyZXN0cmljdGVkIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibHZsMSIsImdpdmVuX25hbWUiOiJyZXN0cmljdGVkIn0.OqLARi5ILt3j2rMikXy0ECTTqjWco0-CrMwzE88gUv2i8rVO9kMgVsXbtPk2L2c9NNNujnxqg7QIr2_sqA51saTrZHvzXcsT8lBruf74OubRMwcTQqJap-COmrzb60S7512k0WfKTYlHsoCn_uAzOb9sp8Trjr0NksU8OXCElDU'\n}\n\nconst lvl3 = {\n  name: 'lvl3',\n  userId: \"44\",\n  grantId: '4',\n  token:\n    'eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDkxMjUsImlhdCI6MTY3MDU2ODMyNSwiYXV0aF90aW1lIjoxNjcwNTY4MzI1LCJqdGkiOiI4NTI5MjZmZi0xYzM4LTQwMDYtOTYwYi1kOWE0YmNhMjcxZjkiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiIzNWZhYmMwNi0wNzZlLTRmZjQtOGJkZS1mMzI1ZWE3ZGQ0ZmIiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjQxNmMwYmJkLTJmNjktNGZkMC04MmE1LTdjZDBmNmRlNzUzNSIsInNlc3Npb25fc3RhdGUiOiIzMThkOGNmZi0wY2U1LTQ3MzktODEyYy1iNWI0NjdlMWQ2YzEiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtc3RpZ21hbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb246cmVhZCIsInNpZCI6IjMxOGQ4Y2ZmLTBjZTUtNDczOS04MTJjLWI1YjQ2N2UxZDZjMSIsInByZWZlcnJlZF91c2VybmFtZSI6Imx2bDMifQ.KduimV7h4DSySAWBbWlpN1xwbfXBfNsscvx2qIx9SVAeZFSGbPZ0JtgThD9uray9xZjrk6qLNYnkoVyYQLS4M-pg8IlFp5yKJBCIeCpcTxA25MdV5VwZQcCD9pgwtEav-cgaDD2Ue6cHj_02cQGMClsfkJ2SuOUJ9nIu4B3m3Qk'\n}\n\nconst lvl1TestAcl = {\n  put: [\n    {\n      benchmarkId: reference.testCollection.benchmark,\n      labelId: reference.testCollection.fullLabel,\n      access: 'r'\n    },\n    { assetId: '154', access: 'rw' }\n  ],\n  putResponse: {\n    defaultAccess: 'none',\n    acl: [\n      {\n        label: {\n          name: 'test-label-full',\n          color: 'FF99CC',\n          labelId: '755b8a28-9a68-11ec-b1bc-0242ac110002'\n        },\n        access: 'r',\n        benchmarkId: 'VPN_SRG_TEST'\n      },\n      {\n        asset: {\n          name: 'Collection_X_lvl1_asset-2',\n          assetId: '154'\n        },\n        access: 'rw'\n      }\n    ]\n  },\n  effectiveAcl: [\n    {\n      access: 'r',\n      asset: {\n        name: 'Collection_X_asset',\n        assetId: '62'\n      },\n      benchmarkId: 'VPN_SRG_TEST',\n      aclSources: [\n        {\n          aclRule: {\n            label: {\n              name: 'test-label-full',\n              labelId: '755b8a28-9a68-11ec-b1bc-0242ac110002'\n            },\n            access: 'r',\n            benchmarkId: 'VPN_SRG_TEST'\n          },\n          grantee: {\n            userId: \"85\",\n            username: 'lvl1',\n            roleId: 1\n          }\n        }\n      ]\n    },\n    {\n      access: 'r',\n      asset: {\n        name: 'Collection_X_lvl1_asset-1',\n        assetId: '42'\n      },\n      benchmarkId: 'VPN_SRG_TEST',\n      aclSources: [\n        {\n          aclRule: {\n            label: {\n              name: 'test-label-full',\n              labelId: '755b8a28-9a68-11ec-b1bc-0242ac110002'\n            },\n            access: 'r',\n            benchmarkId: 'VPN_SRG_TEST'\n          },\n          grantee: {\n            userId: \"85\",\n            username: 'lvl1',\n            roleId: 1\n          }\n        }\n      ]\n    },\n    {\n      access: 'rw',\n      asset: {\n        name: 'Collection_X_lvl1_asset-2',\n        assetId: '154'\n      },\n      benchmarkId: 'VPN_SRG_TEST',\n      aclSources: [\n        {\n          aclRule: {\n            asset: {\n              name: 'Collection_X_lvl1_asset-2',\n              assetId: '154'\n            },\n            access: 'rw'\n          },\n          grantee: {\n            userId: \"85\",\n            username: 'lvl1',\n            roleId: 1\n          }\n        }\n      ]\n    },\n    {\n      access: 'rw',\n      asset: {\n        name: 'Collection_X_lvl1_asset-2',\n        assetId: '154'\n      },\n      benchmarkId: 'Windows_10_STIG_TEST',\n      aclSources: [\n        {\n          aclRule: {\n            asset: {\n              name: 'Collection_X_lvl1_asset-2',\n              assetId: '154'\n            },\n            access: 'rw'\n          },\n          grantee: {\n            userId: \"85\",\n            username: 'lvl1',\n            roleId: 1\n          }\n        }\n      ]\n    }\n  ]\n}\n\nconst lvl3TestAcl = {\n  put: [\n    {\n      benchmarkId: reference.testCollection.benchmark,\n      labelId: reference.testCollection.fullLabel,\n      access: 'r'\n    }\n  ],\n  response: [\n    {\n      access: 'r',\n      asset: {\n        name: 'Collection_X_asset',\n        assetId: '62'\n      },\n      benchmarkId: 'VPN_SRG_TEST',\n      aclSources: [\n        {\n          aclRule: {\n            label: {\n              name: 'test-label-full',\n              labelId: '755b8a28-9a68-11ec-b1bc-0242ac110002'\n            },\n            access: 'r',\n            benchmarkId: 'VPN_SRG_TEST'\n          },\n          grantee: {\n            userId: \"44\",\n            username: 'lvl3',\n            roleId: 3\n          }\n        }\n      ]\n    },\n    {\n      access: 'r',\n      asset: {\n        name: 'Collection_X_lvl1_asset-1',\n        assetId: '42'\n      },\n      benchmarkId: 'VPN_SRG_TEST',\n      aclSources: [\n        {\n          aclRule: {\n            label: {\n              name: 'test-label-full',\n              labelId: '755b8a28-9a68-11ec-b1bc-0242ac110002'\n            },\n            access: 'r',\n            benchmarkId: 'VPN_SRG_TEST'\n          },\n          grantee: {\n            userId: \"44\",\n            username: 'lvl3',\n            roleId: 3\n          }\n        }\n      ]\n    }\n  ]\n}\n\ndescribe(`Test Restricted user access controls`, () => {\n  let lvl1DirectGrantId = null\n\n  before(async function () {\n    await utils.loadAppData()\n  })\n  it('should give lvl1 user restricted access to test collection', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', admin.token, [\n      {\n        userId: lvl1.userId,\n        roleId: 1\n      }\n    ])\n    expect(res.status).to.eql(201)\n    lvl1DirectGrantId = res.body[0].grantId\n  })\n  it('Remove Base appdata userGroups grant from test Colleciton', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}`, 'DELETE', admin.token)\n    expect(res.status).to.eql(200)\n  })\n  it(`should set users ACL in test collection `, async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${lvl1DirectGrantId}/acl`, 'PUT', admin.token, lvl1TestAcl.put)\n    expect(res.status).to.eql(200)\n    expect(res.body.acl).to.deep.equalInAnyOrder(lvl1TestAcl.putResponse.acl)\n  })\n  it('should confirm users effective acl was set ', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${lvl1.userId}/effective-acl`, 'GET', admin.token)\n    expect(res.status).to.eql(200)\n    expect(res.body).to.deep.equalInAnyOrder(lvl1TestAcl.effectiveAcl)\n  })\n  it('should get reviews that is associated with the ACL and confirm that is it all read only.', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?rules=default-mapped`, 'GET', lvl1.token)\n    expect(res.status).to.eql(200)\n\n    for (const review of res.body) {\n      if (review.assetId === '154') {\n        expect(review.access).to.equal('rw')\n      } else if (review.assetId === reference.testAsset.assetId) {\n        expect(review.access).to.equal('r')\n      }\n      // sanity check\n      if (\n        review.assetId === reference.testAsset.assetId &&\n        review.ruleId === reference.testCollection.ruleId\n      ) {\n        expect(\n          review.access,\n          'expect that the test rule exists and is read only'\n        ).to.equal('r')\n      }\n    }\n  })\n  it('should reject PUT modification to reviews that is associated with the ACLs that are read only', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PUT', lvl1.token, {\n      result: 'pass',\n      detail: '',\n      comment: 'sure',\n      status: 'accepted',\n      autoResult: false\n    })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('no grant for this asset/ruleId')\n  })\n  it('should reject PATCH modification to read only review on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PATCH', lvl1.token, {\n      result: 'pass'\n    })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('no grant for this asset/ruleId')\n  })\n  it('should reject DELETE modification to read only review on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'DELETE', lvl1.token)\n    expect(res.status).to.eql(403)\n  })\n  it('should reject put modification to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PUT', lvl1.token, { [reference.reviewMetadataKey]: reference.reviewMetadataValue })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('User has insufficient privilege to put the review of this rule.')\n  })\n  it('should reject patch modification to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PATCH', lvl1.token, { [reference.reviewMetadataKey]: reference.reviewMetadataValue })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('User has insufficient privilege to patch the review of this rule.')\n  })\n  it('should reject put modification to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PUT', lvl1.token, { [reference.reviewMetadataKey]: reference.reviewMetadataValue })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('User has insufficient privilege to put the review of this rule.')\n  })\n  it('should reject delete modification  of metadata key to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testAsset.testRuleId}/metadata/keys/${reference.reviewMetadataKey}`, 'DELETE', lvl1.token, `${JSON.stringify(reference.reviewMetadataValue)}`)\n    expect(res.status).to.eql(403)\n  })\n})\n\ndescribe(`Test manage user access control`, () => {\n  before(async function () {\n    await utils.loadAppData()\n  })\n  it(`should set users ACL in test collection `, async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${lvl3.grantId}/acl`, 'PUT', admin.token, lvl3TestAcl.put)\n    expect(res.status).to.eql(200)\n    expect(res.body.acl).to.have.length(1)\n    expect(res.body.defaultAccess).to.equal('rw')\n  })\n  it('should confirm users effective acl was set ', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${lvl3.userId}/effective-acl`, 'GET', admin.token)\n    expect(res.status).to.eql(200)\n    expect(res.body).to.deep.equalInAnyOrder(lvl3TestAcl.response)\n  })\n  it('should get reviews that is associated with the ACL and confirm that is it all read only.', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?rules=default-mapped`, 'GET', lvl3.token)\n    expect(res.status).to.eql(200)\n\n    for (const review of res.body) {\n      if (\n        review.assetId === reference.testAsset.assetId &&\n        review.ruleId === reference.testCollection.ruleId\n      ) {\n        expect(review.access).to.equal('r')\n      }\n      if (review.assetId === '62') {\n        expect(review.access).to.equal('r')\n      }\n      if (review.assetId === '154') {\n        expect(review.access).to.equal('rw')\n      }\n    }\n  })\n  it('should reject POST  modification to reviews that is associated with the ACLs that are read only', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}`, 'POST', lvl3.token, [\n      {\n        ruleId: reference.testCollection.ruleId,\n        result: 'pass',\n        detail: 'test\\nvisible to lvl1',\n        comment: 'sure',\n        autoResult: false,\n        status: 'submitted'\n      }\n    ])\n    expect(res.status).to.eql(200)\n    expect(res.body.rejected).to.have.length(1)\n    expect(res.body.rejected[0].reason).to.equal('no grant for this asset/ruleId')\n  })\n  it('should reject PUT modification to reviews that is associated with the ACLs that are read only', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PUT', lvl3.token, {\n      result: 'pass',\n      detail: '',\n      comment: 'sure',\n      status: 'accepted',\n      autoResult: false\n    })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('no grant for this asset/ruleId')\n  })\n  it('should reject PATCH modification to read only review on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PATCH', lvl3.token, {\n      result: 'pass'\n    })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('no grant for this asset/ruleId')\n  })\n  it('should reject DELETE modification to read only review on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'DELETE', lvl3.token)\n    expect(res.status).to.eql(403)\n  })\n  it('should reject put modification to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PUT', lvl3.token, { [reference.reviewMetadataKey]: reference.reviewMetadataValue })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('User has insufficient privilege to put the review of this rule.')\n  })\n  it('should reject patch modification to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PATCH', lvl3.token, { [reference.reviewMetadataKey]: reference.reviewMetadataValue })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('User has insufficient privilege to patch the review of this rule.')\n  })\n  it('should reject put modification to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PUT', lvl3.token, { [reference.reviewMetadataKey]: reference.reviewMetadataValue })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('User has insufficient privilege to put the review of this rule.')\n  })\n  it('should reject delete modification  of metadata key to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testAsset.testRuleId}/metadata/keys/${reference.reviewMetadataKey}`, 'DELETE', lvl3.token, `${JSON.stringify(reference.reviewMetadataValue)}`)\n    expect(res.status).to.eql(403)\n  })\n})\n\ndescribe('Test restricted user group access controls', () => {\n  before(async function () {\n    await utils.loadAppData()\n  })\n  let userGroup = null\n\n  it('Remove Base appdata userGroup from test Colleciton', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}`, 'DELETE', admin.token)\n    expect(res.status).to.eql(200)\n  })\n  // make a group with lvl1 in it\n  it('should create a userGroup', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true&projection=collections&projection=users`, 'POST', admin.token, {\n      name: 'group' + uuidv4(),\n      description: 'test group',\n      userIds: [lvl1.userId]\n    })\n    userGroup = res.body\n    expect(res.status).to.eql(201)\n    expect(res.body.collectionGrants).to.be.empty\n    for (let user of res.body.users) {\n      expect(user.userId, 'expect userId to be equal to the userId returned from API').to.equal(lvl1.userId)\n      expect(user.username, 'expect username to be equal to the username returned from API').to.equal(lvl1.name)\n    }\n  })\n\n  // assign group to test collection with restricted\n  it('should assign group created to the test collection with restricted grant', async function () {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', admin.token, [\n      {\n        userGroupId: userGroup.userGroupId,\n        roleId: 1\n      }\n    ])\n    expect(res.status).to.eql(201)\n    expect(res.body[0].roleId).to.equal(1)\n    userGroup.grantId = res.body[0].grantId\n  })\n  // give it read only to something use lvl1TEstAcl object\n  it('should set userGroups ACL in test collection', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup.grantId}/acl`, 'PUT', admin.token, lvl1TestAcl.put)\n    expect(res.status).to.eql(200)\n    expect(res.body.defaultAccess).to.equal('none')\n  })\n  // get the effective acl and confirm that it is read only and grantee from the group\n  it('should confirm users effective acl was set ', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${lvl1.userId}/effective-acl`, 'GET', admin.token)\n    expect(res.status).to.eql(200)\n\n    for (const acl of res.body) {\n      if (acl.asset.assetId === reference.testAsset.assetId) {\n        expect(acl.access).to.equal('r')\n        expect(acl.aclSources[0].grantee.userGroupId).to.equal(userGroup.userGroupId)\n      }\n    }\n  })\n  it('should get reviews that is associated with the ACL and confirm that is it all read only.', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?rules=default-mapped`, 'GET', lvl1.token)\n    expect(res.status).to.eql(200)\n\n    for (const review of res.body) {\n      if (review.assetId === '154') {\n        expect(review.access).to.equal('rw')\n      } else if (review.assetId === reference.testAsset.assetId) {\n        expect(review.access).to.equal('r')\n      }\n      // sanity check\n      if (\n        review.assetId === reference.testAsset.assetId &&\n        review.ruleId === reference.testCollection.ruleId\n      ) {\n        expect(\n          review.access,\n          'expect that the test rule exists and is read only'\n        ).to.equal('r')\n      }\n    }\n  })\n  it('should reject PUT modification to reviews that is associated with the ACLs that are read only', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PUT', lvl1.token, {\n      result: 'pass',\n      detail: '',\n      comment: 'sure',\n      status: 'accepted',\n      autoResult: false\n    })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('no grant for this asset/ruleId')\n  })\n  it('should reject PATCH modification to read only review on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PATCH', lvl1.token, {\n      result: 'pass'\n    })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('no grant for this asset/ruleId')\n  })\n  it('should reject DELETE modification to read only review on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'DELETE', lvl1.token)\n    expect(res.status).to.eql(403)\n  })\n  it('should reject put modification to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PUT', lvl1.token, { [reference.reviewMetadataKey]: reference.reviewMetadataValue })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('User has insufficient privilege to put the review of this rule.')\n  })\n  it('should reject patch modification to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PATCH', lvl1.token, { [reference.reviewMetadataKey]: reference.reviewMetadataValue })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('User has insufficient privilege to patch the review of this rule.')\n  })\n  it('should reject put modification to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PUT', lvl1.token, { [reference.reviewMetadataKey]: reference.reviewMetadataValue })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('User has insufficient privilege to put the review of this rule.')\n  })\n  it('should reject delete modification  of metadata key to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testAsset.testRuleId}/metadata/keys/${reference.reviewMetadataKey}`, 'DELETE', lvl1.token, `${JSON.stringify(reference.reviewMetadataValue)}`)\n    expect(res.status).to.eql(403)\n  })\n})\n\ndescribe('Test manage user group access control', () => {\n  before(async function () {\n    await utils.loadAppData()\n  })\n\n  let userGroup = null\n\n  it('Remove Base appdata userGroup from test Colleciton', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}`, 'DELETE', admin.token)\n    expect(res.status).to.eql(200)\n  })\n  // make a group with lvl1 in it\n  it('should create a userGroup', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true&projection=collections&projection=users`, 'POST', admin.token, {\n      name: 'group' + uuidv4(),\n      description: 'test group',\n      userIds: [lvl1.userId]\n    })\n    userGroup = res.body\n    expect(res.status).to.eql(201)\n    expect(res.body.collectionGrants).to.be.empty\n    for (let user of res.body.users) {\n      expect(user.userId, 'expect userId to be equal to the userId returned from API').to.equal(lvl1.userId)\n      expect(user.username, 'expect username to be equal to the username returned from API').to.equal(lvl1.name)\n    }\n  })\n\n  // assign group to test collection with restricted\n  it('should assign group created to the test collection with manage grant', async function () {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', admin.token, [\n      {\n        userGroupId: userGroup.userGroupId,\n        roleId: 3\n      }\n    ])\n    expect(res.status).to.eql(201)\n    expect(res.body[0].roleId).to.equal(3)\n    userGroup.grantId = res.body[0].grantId\n  })\n  // give it read only to something use lvl1TEstAcl object\n  it('should set userGroups ACL in test collection', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup.grantId}/acl`, 'PUT', admin.token, lvl3TestAcl.put)\n    expect(res.status).to.eql(200)\n    expect(res.body.defaultAccess).to.equal('rw')\n  })\n  // get the effective acl and confirm that it is read only and grantee from the group\n  it('should confirm users effective acl was set ', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${lvl1.userId}/effective-acl`, 'GET', admin.token)\n    expect(res.status).to.eql(200)\n\n    for (const acl of res.body) {\n      if (\n        acl.asset.assetId === reference.testAsset.assetId ||\n        acl.asset.assetId === '62'\n      ) {\n        expect(acl.access).to.equal('r')\n        expect(acl.aclSources[0].grantee.userGroupId).to.equal(userGroup.userGroupId)\n      }\n    }\n  })\n  it('should get reviews that is associated with the ACL and confirm that is it all read only.', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews?rules=default-mapped`, 'GET', lvl1.token)\n    expect(res.status).to.eql(200)\n\n    for (const review of res.body) {\n      if (review.assetId === '154') {\n        expect(review.access).to.equal('rw')\n      } else if (\n        review.assetId === reference.testAsset.assetId &&\n        review.ruleId === reference.testCollection.ruleId\n      ) {\n        expect(\n          review.access,\n          'expect that the test rule exists and is read only'\n        ).to.equal('r')\n      }\n    }\n  })\n  it('should reject PUT modification to reviews that is associated with the ACLs that are read only', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PUT', lvl1.token, {\n      result: 'pass',\n      detail: '',\n      comment: 'sure',\n      status: 'accepted',\n      autoResult: false\n    })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('no grant for this asset/ruleId')\n  })\n  it('should reject PATCH modification to read only review on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PATCH', lvl1.token, {\n      result: 'pass'\n    })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('no grant for this asset/ruleId')\n  })\n  it('should reject DELETE modification to read only review on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'DELETE', lvl1.token)\n    expect(res.status).to.eql(403)\n  })\n  it('should reject put modification to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PUT', lvl1.token, { [reference.reviewMetadataKey]: reference.reviewMetadataValue })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('User has insufficient privilege to put the review of this rule.')\n  })\n  it('should reject patch modification to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PATCH', lvl1.token, { [reference.reviewMetadataKey]: reference.reviewMetadataValue })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('User has insufficient privilege to patch the review of this rule.')\n  })\n  it('should reject put modification to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}/metadata`, 'PUT', lvl1.token, { [reference.reviewMetadataKey]: reference.reviewMetadataValue })\n    expect(res.status).to.eql(403)\n    expect(res.body.detail).to.equal('User has insufficient privilege to put the review of this rule.')\n  })\n  it('should reject delete modification  of metadata key to read only review metadata on test asset with test ruleId', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testAsset.testRuleId}/metadata/keys/${reference.reviewMetadataKey}`, 'DELETE', lvl1.token, `${JSON.stringify(reference.reviewMetadataValue)}`)\n    expect(res.status).to.eql(403)\n  })\n})\n\ndescribe('Test getAssetsByStig access property', () => {\n\n  before(async function () {\n    await utils.loadAppData()\n  })\n\n  let lvl1DirectGrantId = null\n\n  it(\"delete all grant for lvl1 user in test collection\", async () => {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${lvl1.grantId}`, 'DELETE', admin.token)\n    expect(res.status).to.eql(200)\n  })\n\n  it(\"add grant to test collection for lvl1 user\", async () => {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', admin.token, [\n      {\n        userId: lvl1.userId,\n        roleId: 1\n      }\n    ])\n    expect(res.status).to.eql(201)\n    lvl1DirectGrantId = res.body[0].grantId\n  })\n\n  it(\"get assets by stig with lvl1 user\", async () => {\n    \n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}/assets`, 'GET', lvl1.token)\n    expect(res.status).to.eql(200)\n    expect(res.body).to.have.length(0)\n  })\n\n  it(\"add r to test Asset for lvl1 user\", async () => {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${lvl1DirectGrantId}/acl`, 'PUT', admin.token, [\n      {\n        assetId: reference.testAsset.assetId,\n        access: 'r'\n      }\n    ])\n    expect(res.status).to.eql(200)\n  })\n\n  it(\"get assets by stig with lvl1 user should have test asset with r only access\", async () => {\n    \n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}/assets`, 'GET', lvl1.token)\n    expect(res.status).to.eql(200)\n    expect(res.body).to.have.length(1)\n    expect(res.body[0].assetId).to.eql(reference.testAsset.assetId)\n    expect(res.body[0].access).to.eql('r')\n  })\n\n  it(\"get assets by stig with admin user should have test asset with rw access\", async () => {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}/assets`, 'GET', admin.token)\n    expect(res.status).to.eql(200)\n    expect(res.body).to.have.length(3)\n    for(let asset of res.body){\n      expect(asset.access).to.eql('rw')\n    }\n  })\n  it(\"add rw to test Asset for lvl1 user\", async () => {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${lvl1DirectGrantId}/acl`, 'PUT', admin.token, [\n      {\n        assetId: reference.testAsset.assetId,\n        access: 'rw'\n      }\n    ])\n    expect(res.status).to.eql(200)\n  })\n  it(\"get assets by stig with lvl1 user should have test asset with rw access\", async () => {\n    \n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}/assets`, 'GET', lvl1.token)\n    expect(res.status).to.eql(200)\n    expect(res.body).to.have.length(1)\n    expect(res.body[0].assetId).to.eql(reference.testAsset.assetId)\n    expect(res.body[0].access).to.eql('rw')\n  })\n})\n"
  },
  {
    "path": "test/api/mocha/integration/aclResolution.test.js",
    "content": "\nimport {config } from '../testConfig.js'\nimport * as utils from '../utils/testUtils.js'\nimport reference from '../referenceData.js'\nimport { expect } from 'chai'\n\nconst admin = {\n  name: \"admin\",\n  grant: \"Owner\",\n  token:\n    \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ2ODEwMzUsImlhdCI6MTY3MDU0MDIzNiwiYXV0aF90aW1lIjoxNjcwNTQwMjM1LCJqdGkiOiI0N2Y5YWE3ZC1iYWM0LTQwOTgtOWJlOC1hY2U3NTUxM2FhN2YiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJiN2M3OGE2Mi1iODRmLTQ1NzgtYTk4My0yZWJjNjZmZDllZmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjMzNzhkYWZmLTA0MDQtNDNiMy1iNGFiLWVlMzFmZjczNDBhYyIsInNlc3Npb25fc3RhdGUiOiI4NzM2NWIzMy0yYzc2LTRiM2MtODQ4NS1mYmE1ZGJmZjRiOWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIiwiYWRtaW4iXX0sInJlc291cmNlX2FjY2VzcyI6eyJyZWFsbS1tYW5hZ2VtZW50Ijp7InJvbGVzIjpbInZpZXctdXNlcnMiLCJxdWVyeS1ncm91cHMiLCJxdWVyeS11c2VycyJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIHN0aWctbWFuYWdlcjpvcCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIHN0aWctbWFuYWdlcjpvcDpyZWFkIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlciBzdGlnLW1hbmFnZXI6c3RpZyIsInNpZCI6Ijg3MzY1YjMzLTJjNzYtNGIzYy04NDg1LWZiYTVkYmZmNGI5ZiIsIm5hbWUiOiJTVElHTUFOIEFkbWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RpZ21hbmFkbWluIiwiZ2l2ZW5fbmFtZSI6IlNUSUdNQU4iLCJmYW1pbHlfbmFtZSI6IkFkbWluIn0.a1XwJZw_FIzwMXKo-Dr-n11me5ut-SF9ni7ylX-7t7AVrH1eAqyBxX9DXaxFK0xs6YOhoPsh9NyW8UFVaYgtF68Ps6yzoiqFEeiRXkpN5ygICN3H3z6r-YwanLlEeaYR3P2EtHRcrBtCnt0VEKKbGPWOfeiNCVe3etlp9-NQo44\",\n}\n\nconst lvl1 = {\n    name: \"lvl1\",\n    userId: \"85\",\n    token:\n      \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDg5ODQsImlhdCI6MTY3MDU2ODE4NCwiYXV0aF90aW1lIjoxNjcwNTY4MTg0LCJqdGkiOiIxMDhmMDc2MC0wYmY5LTRkZjEtYjE0My05NjgzNmJmYmMzNjMiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJlM2FlMjdiOC1kYTIwLTRjNDItOWRmOC02MDg5ZjcwZjc2M2IiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjE0ZmE5ZDdkLTBmZTAtNDQyNi04ZmQ5LTY5ZDc0YTZmMzQ2NCIsInNlc3Npb25fc3RhdGUiOiJiNGEzYWNmMS05ZGM3LTQ1ZTEtOThmOC1kMzUzNjJhZWM0YzciLCJhY3IiOiIxIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtc3RpZ21hbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb246cmVhZCIsInNpZCI6ImI0YTNhY2YxLTlkYzctNDVlMS05OGY4LWQzNTM2MmFlYzRjNyIsIm5hbWUiOiJyZXN0cmljdGVkIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibHZsMSIsImdpdmVuX25hbWUiOiJyZXN0cmljdGVkIn0.OqLARi5ILt3j2rMikXy0ECTTqjWco0-CrMwzE88gUv2i8rVO9kMgVsXbtPk2L2c9NNNujnxqg7QIr2_sqA51saTrZHvzXcsT8lBruf74OubRMwcTQqJap-COmrzb60S7512k0WfKTYlHsoCn_uAzOb9sp8Trjr0NksU8OXCElDU\"\n}\n\ndescribe(\"Multiple Group ACL Collisions\", () => {\n\n  before(async function () {\n      await utils.loadAppData()\n  })\n\n  let userGroup1\n  let userGroup2\n\n  it(\"Remove Base appdata userGroup grant from test Colleciton\", async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}`, 'DELETE', admin.token)\n    expect(res.status).to.eql(200)\n  })\n  \n  it('should create a test user group with lvl1 user in it.', async () => {\n      const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true&projection=collections`, 'POST', config.adminToken, {\n          \"name\": \"ACLCollisionGroup1\",\n          \"description\": \"test group\",\n          \"userIds\": [\n          lvl1.userId   \n          ]\n      })\n      userGroup1 = res.body\n      expect(res.status).to.eql(201)\n      expect(res.body.collectionGrants).to.be.empty\n  })\n\n  it('should another test user group with lvl1 user in it.', async () => {\n      const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true&projection=collections`, 'POST', config.adminToken, {\n          \"name\": \"ACLCollisionGroup2\",\n          \"description\": \"test group\",\n          \"userIds\": [\n              lvl1.userId   \n          ]\n      })\n      userGroup2 = res.body\n      expect(res.status).to.eql(201)\n      expect(res.body.collectionGrants).to.be.empty\n  })\n\n  it(\"should assign both groups created to the test collection with restricted grant\", async function () {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', config.adminToken, [{\n        userGroupId: userGroup1.userGroupId,\n        roleId: 1\n    }])\n    expect(res.status).to.eql(201)\n    expect(res.body[0].roleId).to.equal(1)\n    userGroup1.grantId = res.body[0].grantId\n\n    const res2 = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', config.adminToken, [{\n        userGroupId: userGroup2.userGroupId,\n        roleId: 1\n    }])\n    expect(res2.status).to.eql(201)\n    expect(res2.body[0].roleId).to.equal(1)\n    userGroup2.grantId = res2.body[0].grantId\n  })\n\n  /*\n  Do not run at this level, run at describe above\n  */\n  describe(\"Group 1: r, Group 2: rw on Asset\", () => {\n\n      it(`should set group1 acl to r on test asset`, async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup1.grantId}/acl`, 'PUT', config.adminToken, [{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}])\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(1)\n          expect(res.body.acl[0].access).to.equal(\"r\")\n          expect(res.body.acl[0].asset.assetId).to.equal(reference.testAsset.assetId)\n      })\n\n      it(`should set group2 acl to rw on test asset`, async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup2.grantId}/acl`, 'PUT', config.adminToken, [{\"assetId\":reference.testAsset.assetId,\"access\":\"rw\"}])\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(1)\n          expect(res.body.acl[0].access).to.equal(\"rw\")\n          expect(res.body.acl[0].asset.assetId).to.equal(reference.testAsset.assetId)\n      })\n\n      it(\"should confirm group1 acl was set\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup1.grantId}/acl`, 'GET', config.adminToken)\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(1)\n          expect(res.body.acl[0].access).to.equal(\"r\")\n      })\n\n      it(\"should confirm group2 acl was set\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup2.grantId}/acl`, 'GET', config.adminToken)\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(1)\n          expect(res.body.acl[0].access).to.equal(\"rw\")\n      })\n\n      it('should return all resources with access of \"r\" from ACLCollisionGroup1', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${lvl1.userId}/effective-acl`, 'GET', config.adminToken)\n          expect(res.status).to.eql(200)\n\n          for(const acl of res.body){\n              expect(acl.access).to.be.equal(\"r\")\n              expect(acl.asset.assetId).to.be.equal(reference.testAsset.assetId)\n              expect(acl.aclSources.length).to.be.equal(1)\n              expect(acl.aclSources[0].aclRule.access).to.be.equal(\"r\")\n              expect(acl.aclSources[0].grantee.name).to.be.equal(\"ACLCollisionGroup1\")\n              expect(acl.aclSources[0].grantee.roleId).to.be.equal(1)\n          }\n      })\n  })\n\n  describe(\"Group 1: r, Group 2: none on Asset\", () => {\n\n      it(`should set group1 acl to r on test asset`, async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup1.grantId}/acl`, 'PUT', config.adminToken, [{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}])\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(1)\n          expect(res.body.acl[0].access).to.equal(\"r\")\n          expect(res.body.acl[0].asset.assetId).to.equal(reference.testAsset.assetId)\n      })\n\n      it(`should set group2 acl to none on test asset`, async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup2.grantId}/acl`, 'PUT', config.adminToken, [{\"assetId\":reference.testAsset.assetId,\"access\":\"none\"}])\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(1)\n          expect(res.body.acl[0].access).to.equal(\"none\")\n          expect(res.body.acl[0].asset.assetId).to.equal(reference.testAsset.assetId)\n      })\n\n      it(\"should confirm group1 acl was set\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup1.grantId}/acl`, 'GET', config.adminToken)\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(1)\n          expect(res.body.acl[0].access).to.equal(\"r\")\n      })\n\n      it(\"should confirm group2 acl was set\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup2.grantId}/acl`, 'GET', config.adminToken)\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(1)\n          expect(res.body.acl[0].access).to.equal(\"none\")\n      })\n\n      it('should return empty array because user as \"none\"', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${lvl1.userId}/effective-acl`, 'GET', config.adminToken)\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.empty\n      })\n  })\n\n  describe(\"Group 1: rw, Group 2: r on Test Label\", () => {\n\n      it(`should set group1 acl to rw on test label`, async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup1.grantId}/acl`, 'PUT', config.adminToken, [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"rw\"}])\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(1)\n          expect(res.body.acl[0].access).to.equal(\"rw\")\n          expect(res.body.acl[0].label.labelId).to.equal(reference.testCollection.fullLabel)\n      })\n\n      it(`should set group2 acl to r on test label`, async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup2.grantId}/acl`, 'PUT', config.adminToken, [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}])\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(1)\n          expect(res.body.acl[0].access).to.equal(\"r\")\n          expect(res.body.acl[0].label.labelId).to.equal(reference.testCollection.fullLabel)\n      })\n\n      it(\"should confirm group1 acl was set\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup1.grantId}/acl`, 'GET', config.adminToken)\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(1)\n          expect(res.body.acl[0].access).to.equal(\"rw\")\n      })\n\n      it(\"should confirm group2 acl was set\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup2.grantId}/acl`, 'GET', config.adminToken)\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(1)\n          expect(res.body.acl[0].access).to.equal(\"r\")\n      })\n\n      it('should return read only assets from group 2s read ACL', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${lvl1.userId}/effective-acl`, 'GET', config.adminToken)\n          expect(res.status).to.eql(200)\n          for(const acl of res.body){\n              expect(acl.access).to.be.equal(\"r\")\n              expect(acl.asset.assetId).to.be.oneOf([\"42\",\"62\"])\n              expect(acl.aclSources.length).to.be.equal(1)\n              expect(acl.aclSources[0].aclRule.access).to.be.equal(\"r\")\n              expect(acl.aclSources[0].grantee.name).to.be.equal(\"ACLCollisionGroup2\")\n              expect(acl.aclSources[0].grantee.roleId).to.be.equal(1)\n          }\n      })\n  })\n\n  describe(\"Advanced ACL collision\", () => {\n\n      it(`should set group1 acl to rw on test label`, async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup1.grantId}/acl`, 'PUT', config.adminToken, [{\"labelId\":reference.testCollection.fullLabel, \"benchmarkId\":reference.testCollection.benchmark, \"access\":\"rw\"}, {\"assetId\":\"154\",\"access\":\"r\"}])\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(2)\n          for(const acl of res.body.acl){\n              if(acl.label){\n                  expect(acl.access).to.equal(\"rw\")\n              }\n              else {\n                  expect(acl.access).to.equal(\"r\")\n              }\n          }\n      })\n\n      it(`should set group2 acl to r on test label`, async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup2.grantId}/acl`, 'PUT', config.adminToken, [{\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"}])\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(1)\n          expect(res.body.acl[0].access).to.equal(\"r\")\n          expect(res.body.acl[0].label.labelId).to.equal(reference.testCollection.fullLabel)\n      })\n\n      it(\"should confirm group1 acl was set\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup1.grantId}/acl`, 'GET', config.adminToken)\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(2)\n          for(const acl of res.body.acl){\n              if(acl.label){\n                  expect(acl.access).to.equal(\"rw\")\n              }\n              else {\n                  expect(acl.access).to.equal(\"r\")\n              }\n          }\n      })\n\n      it(\"should confirm group2 acl was set\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup2.grantId}/acl`, 'GET', config.adminToken)\n          expect(res.status).to.eql(200)\n          expect(res.body.defaultAccess).to.equal(\"none\")\n          expect(res.body.acl.length).to.equal(1)\n          expect(res.body.acl[0].access).to.equal(\"r\")\n      })\n\n      it('should return effective ACLs belonging from a combination of both groups', async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${lvl1.userId}/effective-acl`, 'GET', config.adminToken)\n          expect(res.status).to.eql(200)\n          for(const acl of res.body){\n              if(acl.asset.assetId === \"154\"){\n                  expect(acl.access).to.be.equal(\"r\")\n                  expect(acl.aclSources[0].grantee.name).to.be.equal(\"ACLCollisionGroup1\")\n              }\n              else if(acl.asset.assetId === \"42\" || acl.asset.assetId === \"62\"){\n                 if(acl.benchmarkId === reference.testCollection.benchmark){\n                      expect(acl.access).to.be.equal(\"rw\")\n                      expect(acl.aclSources[0].grantee.name).to.be.equal(\"ACLCollisionGroup1\")\n                 }\n                 else {\n                      expect(acl.access).to.be.equal(\"r\")\n                      expect(acl.aclSources[0].grantee.name).to.be.equal(\"ACLCollisionGroup2\")\n                 }\n              }\n          }\n      })\n  })\n})   \n\ndescribe(\"Test sending acl for rw access to entire collection\", () => {\n\n    before(async function () {\n        await utils.loadAppData()\n    })\n\n    it(\"change test group to roleId 2 (full)\", async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}`, 'PUT', admin.token, {\n            \"userGroupId\": reference.testCollection.testGroup.userGroupId,\n            \"roleId\":2\n        })\n        expect(res.status).to.eql(200)\n        expect(res.body.roleId).to.equal(2)\n        expect(res.body.userGroup.userGroupId).to.equal(reference.testCollection.testGroup.userGroupId)\n    })\n\n    it(\"give testgroup r only on test asset\", async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}/acl`, 'PUT', admin.token, [{\"assetId\":reference.testAsset.assetId,\"access\":\"r\"}])\n        expect(res.status).to.eql(200)\n        expect(res.body.defaultAccess).to.equal(\"rw\")\n        expect(res.body.acl.length).to.equal(1)\n        expect(res.body.acl[0].access).to.equal(\"r\")\n        expect(res.body.acl[0].asset.assetId).to.equal(reference.testAsset.assetId)\n    })\n\n    it(\"confirm r access by attempting writing review to asset it should fail. request sent as lvl1\", async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PUT', lvl1.token, {\n            result: 'pass',\n            detail: '',\n            comment: 'sure',\n            status: 'submitted',\n            autoResult: false\n        })\n        expect(res.status).to.eql(403)\n    })\n\n    it(\"alter acl to [] (entire collection)\", async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}/acl`, 'PUT', admin.token, [])\n        expect(res.status).to.eql(200)\n        expect(res.body.defaultAccess).to.equal(\"rw\")\n        expect(res.body.acl).to.be.empty\n    })\n\n    it(\"confirm rw access to test asset\", async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`, 'PUT', lvl1.token, {\n            result: 'pass',\n            detail: 'required by collection settings',\n            comment: 'sure',\n            status: 'submitted',\n            autoResult: false\n        })\n        expect(res.status).to.eql(200)\n    })\n})"
  },
  {
    "path": "test/api/mocha/integration/asset.test.js",
    "content": "\nimport {config } from '../testConfig.js'\nimport * as utils from '../utils/testUtils.js'\nimport reference from '../referenceData.js'\nimport { expect } from 'chai'\n\nconst user = {\n  name: \"admin\",\n  grant: \"Owner\",\n  token:\n    \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ2ODEwMzUsImlhdCI6MTY3MDU0MDIzNiwiYXV0aF90aW1lIjoxNjcwNTQwMjM1LCJqdGkiOiI0N2Y5YWE3ZC1iYWM0LTQwOTgtOWJlOC1hY2U3NTUxM2FhN2YiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJiN2M3OGE2Mi1iODRmLTQ1NzgtYTk4My0yZWJjNjZmZDllZmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjMzNzhkYWZmLTA0MDQtNDNiMy1iNGFiLWVlMzFmZjczNDBhYyIsInNlc3Npb25fc3RhdGUiOiI4NzM2NWIzMy0yYzc2LTRiM2MtODQ4NS1mYmE1ZGJmZjRiOWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIiwiYWRtaW4iXX0sInJlc291cmNlX2FjY2VzcyI6eyJyZWFsbS1tYW5hZ2VtZW50Ijp7InJvbGVzIjpbInZpZXctdXNlcnMiLCJxdWVyeS1ncm91cHMiLCJxdWVyeS11c2VycyJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIHN0aWctbWFuYWdlcjpvcCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIHN0aWctbWFuYWdlcjpvcDpyZWFkIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlciBzdGlnLW1hbmFnZXI6c3RpZyIsInNpZCI6Ijg3MzY1YjMzLTJjNzYtNGIzYy04NDg1LWZiYTVkYmZmNGI5ZiIsIm5hbWUiOiJTVElHTUFOIEFkbWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RpZ21hbmFkbWluIiwiZ2l2ZW5fbmFtZSI6IlNUSUdNQU4iLCJmYW1pbHlfbmFtZSI6IkFkbWluIn0.a1XwJZw_FIzwMXKo-Dr-n11me5ut-SF9ni7ylX-7t7AVrH1eAqyBxX9DXaxFK0xs6YOhoPsh9NyW8UFVaYgtF68Ps6yzoiqFEeiRXkpN5ygICN3H3z6r-YwanLlEeaYR3P2EtHRcrBtCnt0VEKKbGPWOfeiNCVe3etlp9-NQo44\",\n}\n\ndescribe(`PUT - attachAssetsToStig - /collections/{collectionId}/stigs/{benchmarkId}/assets`, () => {\n\n  describe('gh-756 - stig-assignments issue', () => {\n\n    before(async function () {\n      await utils.loadAppData()\n    })\n    it('gh-756 issue (assigning a benchmark in one collection removes all assignements for that benchmark from all other collections) . assign a benchmark used in test Collection in scrap Collection', async function () {\n      const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/stigs/${reference.testCollection.benchmark}/assets`, 'PUT', user.token, [reference.scrapAsset.assetId])\n      \n      expect(res.status).to.eql(200)\n      expect(res.body).to.be.an('array')\n      expect(res.body).to.be.an('array').of.length(1)\n      expect(res.body[0].assetId).to.equal(reference.scrapAsset.assetId)\n    })\n    it('Verify that test collection still has expected benchmark assignments', async function () {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs`, 'GET', user.token)\n        expect(res.status).to.eql(200)\n        let returnedStigs = []\n        for (let stig of res.body) {\n            returnedStigs.push(stig.benchmarkId)\n        }\n        expect(returnedStigs).to.include(reference.testCollection.benchmark);\n    })\n  })\n})\n\ndescribe(`GET - getChecklistByAssetStig - /assets/{assetId}/checklists/{benchmarkId}/{revisionStr}`, () => { \n\n  describe('Testing that a valid filename can be produced from an asset that contains os reserved chars', () => {\n\n    before(async function () {\n      await utils.loadAppData()\n    })\n    \n    let createdAssetId = null\n    it('should Create an Asset in collection to be deleted', async function () {\n      const res = await utils.executeRequest(`${config.baseUrl}/assets?projection=stigs`, 'POST', user.token, {\n        \"name\": \"TxxxxxEST_\\\\slash:colon..x2\",\n        \"collectionId\": reference.scrapCollection.collectionId,\n        \"description\": \"test desc\",\n        \"ip\": \"1.1.1.1\",\n        \"noncomputing\": true,\n        \"metadata\": {\n            \"pocName\": \"poc2Put\",\n            \"pocEmail\": \"pocEmailPut@email.com\",\n            \"pocPhone\": \"12342\",\n            \"reqRar\": \"true\"\n        },\n        \"stigs\": [\n            reference.benchmark,\n            \"Windows_10_STIG_TEST\"\n        ]\n    })\n      expect(res.status).to.eql(201)\n      createdAssetId = res.body.assetId\n    })\n    it('Return the ckl for Asset with reserved chars', async function () {\n      const res = await utils.executeRequest(`${config.baseUrl}/assets/${createdAssetId}/checklists/${reference.benchmark}/${reference.testCollection.defaultRevision}?format=ckl`, 'GET', user.token)\n      expect(res.status).to.eql(200)\n      const regex = /^inline; filename=\"U_TxxxxxEST_&bsol;slash&colon;colon\\.\\.x2-VPN_SRG_TEST-V1R1/\n      expect(res.headers['content-disposition'], \"Content-Disposition is set with expected filename\").to.match(regex)\n\n    })\n    it('Return the cklB for Asset with reserved chars', async function () {\n      const res = await utils.executeRequest(`${config.baseUrl}/assets/${createdAssetId}/checklists/${reference.benchmark}/${reference.testCollection.defaultRevision}?format=cklb`, 'GET', user.token)\n      expect(res.status).to.eql(200)\n      const regex = /^inline; filename=\"U_TxxxxxEST_&bsol;slash&colon;colon\\.\\.x2-VPN_SRG_TEST-V1R1/\n      expect(res.headers['content-disposition'], \"Content-Disposition is set with expected filename\").to.match(regex)\n    })\n    it('Return the xccdf for Asset with reserved chars', async function () {\n      const res = await utils.executeRequest(`${config.baseUrl}/assets/${createdAssetId}/checklists/${reference.benchmark}/${reference.testCollection.defaultRevision}?format=xccdf`, 'GET', user.token)\n      expect(res.status).to.eql(200)\n      const regex = /^inline; filename=\"U_TxxxxxEST_&bsol;slash&colon;colon\\.\\.x2-VPN_SRG_TEST-V1R1/\n      expect(res.headers['content-disposition'], \"Content-Disposition is set with expected filename\").to.match(regex)\n    })\n  })\n})"
  },
  {
    "path": "test/api/mocha/integration/collection.test.js",
    "content": "\nimport path from 'path'\nimport fs from 'fs'\nimport { fileURLToPath } from 'url';\nimport {config } from '../testConfig.js'\nimport { Blob } from 'buffer'\nimport { readFileSync } from 'fs'\nimport * as utils from '../utils/testUtils.js'\nimport reference from '../referenceData.js'\nimport { expect } from 'chai'\nimport { v4 as uuidv4 } from 'uuid'\nconst user = {\n  name: \"admin\",\n  grant: \"Owner\",\n  token:\n    \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ2ODEwMzUsImlhdCI6MTY3MDU0MDIzNiwiYXV0aF90aW1lIjoxNjcwNTQwMjM1LCJqdGkiOiI0N2Y5YWE3ZC1iYWM0LTQwOTgtOWJlOC1hY2U3NTUxM2FhN2YiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJiN2M3OGE2Mi1iODRmLTQ1NzgtYTk4My0yZWJjNjZmZDllZmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjMzNzhkYWZmLTA0MDQtNDNiMy1iNGFiLWVlMzFmZjczNDBhYyIsInNlc3Npb25fc3RhdGUiOiI4NzM2NWIzMy0yYzc2LTRiM2MtODQ4NS1mYmE1ZGJmZjRiOWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIiwiYWRtaW4iXX0sInJlc291cmNlX2FjY2VzcyI6eyJyZWFsbS1tYW5hZ2VtZW50Ijp7InJvbGVzIjpbInZpZXctdXNlcnMiLCJxdWVyeS1ncm91cHMiLCJxdWVyeS11c2VycyJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIHN0aWctbWFuYWdlcjpvcCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIHN0aWctbWFuYWdlcjpvcDpyZWFkIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlciBzdGlnLW1hbmFnZXI6c3RpZyIsInNpZCI6Ijg3MzY1YjMzLTJjNzYtNGIzYy04NDg1LWZiYTVkYmZmNGI5ZiIsIm5hbWUiOiJTVElHTUFOIEFkbWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RpZ21hbmFkbWluIiwiZ2l2ZW5fbmFtZSI6IlNUSUdNQU4iLCJmYW1pbHlfbmFtZSI6IkFkbWluIn0.a1XwJZw_FIzwMXKo-Dr-n11me5ut-SF9ni7ylX-7t7AVrH1eAqyBxX9DXaxFK0xs6YOhoPsh9NyW8UFVaYgtF68Ps6yzoiqFEeiRXkpN5ygICN3H3z6r-YwanLlEeaYR3P2EtHRcrBtCnt0VEKKbGPWOfeiNCVe3etlp9-NQo44\",\n}\n\nconst lvl4 = {\n    name: \"lvl4\",\n    grant:\"Owner\",\n    userId: \"45\",\n    token: \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDkxNjMsImlhdCI6MTY3MDU2ODM2NCwiYXV0aF90aW1lIjoxNjcwNTY4MzYzLCJqdGkiOiI3MTgwZjU5Yy1kNGQzLTQ0MmYtYjVlNS03NmYxMjBhOTQ3YWEiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiI5MDJjZmE0Ni02MWIzLTQ5YTctOGU4YS02ZjcwYTkzYzJhOTciLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjFlYWE4NDQxLWRhZmItNGE5My04N2ZmLTFkNzM0MzdlMGVjYSIsInNlc3Npb25fc3RhdGUiOiJiZjRjY2Y0Yy03ZTQwLTQ3YjYtYjAyYi1jZmQwOWQ3MTk4OWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtc3RpZ21hbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb246cmVhZCIsInNpZCI6ImJmNGNjZjRjLTdlNDAtNDdiNi1iMDJiLWNmZDA5ZDcxOTg5ZiIsIm5hbWUiOiJsdmw0IiwicHJlZmVycmVkX3VzZXJuYW1lIjoibHZsNCIsImdpdmVuX25hbWUiOiJsdmw0In0.RE0q9YINAiwu8XobDN_eq6UDc-uZTUYwzt2OEF5H_wk4qMnmIEq97FShPsToLYeQONHYgp6VRvaFIQqEk4IeGfzgFUhkg-rqulZIYbz7y4EnDsWE3Afa4MKL7oKrjWxNdAtg-Kp7m6LqBKHF4DCN3_EbGoJweK6aD6SH8epO53o\"\n}\n\nconst collectioncreator = {\n    name: \"collectioncreator\",\n    grant:\"none\",\n    userId: \"82\",\n    token: \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDkyMDAsImlhdCI6MTY3MDU2ODQwMCwiYXV0aF90aW1lIjoxNjcwNTY4NDAwLCJqdGkiOiJkYTc1MWNkNy1iMWJkLTQ4MWQtOWU4MS01N2E0N2E2ZjRlYjgiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJkZDQ4ZjE5ZS04MWYwLTQ0Y2YtYTQxOC1jNGRlOThiNmI3ODMiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjIyN2VlMjQyLTFiYmItNGI1Ni04NmZhLTY3ZWY2NDZlZGM5MyIsInNlc3Npb25fc3RhdGUiOiJiNmRjZjI3OS04ZmI0LTQ0NGItODUwNi0yZjQ4ZDJhNzYzYmQiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsicmVhbG0tbWFuYWdlbWVudCI6eyJyb2xlcyI6WyJ2aWV3LXVzZXJzIiwicXVlcnktZ3JvdXBzIiwicXVlcnktdXNlcnMiXX0sImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIHN0aWctbWFuYWdlcjpjb2xsZWN0aW9uIHN0aWctbWFuYWdlcjpzdGlnOnJlYWQgc3RpZy1tYW5hZ2VyOnVzZXI6cmVhZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIiwic2lkIjoiYjZkY2YyNzktOGZiNC00NDRiLTg1MDYtMmY0OGQyYTc2M2JkIiwibmFtZSI6ImNvbGxlY3Rpb24gY3JlYXRvciIsInByZWZlcnJlZF91c2VybmFtZSI6ImNvbGxlY3Rpb25jcmVhdG9yIiwiZ2l2ZW5fbmFtZSI6ImNvbGxlY3Rpb24iLCJmYW1pbHlfbmFtZSI6ImNyZWF0b3IifQ.PM2fe_hZk9NxIGuHkIDcsqgbrwoBQHHqid_coWNAfmThPCfpZHlSXFjNZww_mWj4qV_sFY9247MsUsK_EdkmZC7cxFACJgLdb0LKfbqfAdvqbuG6JCrX4qGIhZ5wvCbUq1EtwfCsIgJzi9hBy4hW__enkj55z7937swU9U05rdk\"\n}\ndescribe('PATCH - updateCollection - /collections/{collectionId}', () => {\n\n    describe('Verify manager grant restrictions (ensure a manager cannot modify an \"owner\" grant)', () => {\n\n        before(async function () {\n            await utils.loadAppData()\n        })\n        it('should make admin user a manager', async () => {\n            const patchRequest = {\n                \"metadata\": {\n                  \"pocName\": \"poc2Patched\",\n                  \"pocEmail\": \"pocEmail@email.com\",\n                  \"pocPhone\": \"12342\",\n                  \"reqRar\": \"true\"\n                },\n                  \"grants\": [\n                      {\n                        \"userId\": \"1\",\n                        \"roleId\": 3\n                      },\n                      {\n                              \"userId\": \"21\",\n                          \"roleId\": 2\n                      },\n                      {\n                              \"userId\": \"44\",\n                          \"roleId\": 3\n                      },\n                      {\n                              \"userId\": \"45\",\n                          \"roleId\": 4\n                      }\n                  ]\n              } \n        \n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}`, 'PATCH', user.token, patchRequest)\n            expect(res.status).to.eql(200)\n        })\n        it('Merge provided properties with a Collection - manager attempts to change an owners grant should be rejected', async () => {\n            const patchRequest ={\n                \"metadata\": {\n                  \"pocName\": \"poc2Patched\",\n                  \"pocEmail\": \"pocEmail@email.com\",\n                  \"pocPhone\": \"12342\",\n                  \"reqRar\": \"true\"\n                },\n                  \"grants\": [\n                      {\n                        \"userId\": \"1\",\n                        \"roleId\": 3\n                      },\n                      {\n                              \"userId\": \"21\",\n                          \"roleId\": 2\n                      },\n                      {\n                              \"userId\": \"44\",\n                          \"roleId\": 3\n                      },\n                      {\n                              \"userId\": \"45\",\n                          \"roleId\": 3\n                      }\n                  ]\n              }\n        \n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}`, 'PATCH', user.token, patchRequest)\n            expect(res.status).to.eql(403)\n        })\n        it('Merge provided properties with a Collection - manager can set other manager grants', async () => {\n            const patchRequest = {\n                \"metadata\": {\n                  \"pocName\": \"poc2Patched\",\n                  \"pocEmail\": \"pocEmail@email.com\",\n                  \"pocPhone\": \"12342\",\n                  \"reqRar\": \"true\"\n                },\n                  \"grants\": [\n                      {\n                        \"userId\": \"1\",\n                        \"roleId\": 3\n                      },\n                      {\n                              \"userId\": \"21\",\n                          \"roleId\": 3\n                      },\n                      {\n                              \"userId\": \"44\",\n                          \"roleId\": 2\n                      },\n                      {\n                              \"userId\": \"45\",\n                          \"roleId\": 4\n                      }\n                  ]\n              }\n        \n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}`, 'PATCH', user.token, patchRequest)\n            expect(res.status).to.eql(200)\n        })\n        it('manager tries to give self owner. fails.', async () => {\n            const putRequest = {\n                \"name\": \"TEST_{{$randomNoun}}-{{$randomJobType}}\",\n                \"description\": null,\n                  \"settings\": {\n                      \"fields\": {\n                          \"detail\": {\n                              \"enabled\": \"always\",\n                              \"required\": \"findings\"\n                          },\n                          \"comment\": {\n                              \"enabled\": \"always\",\n                              \"required\": \"findings\"\n                          }\n                      },\n                      \"status\": {\n                          \"canAccept\": true,\n                          \"minAcceptGrant\": 2,\n                          \"resetCriteria\": \"result\"\n                        },\n                        \"history\": {\n                            \"maxReviews\": 11,\n                        },\n                        \"importOptions\": {\n                            \"autoStatus\": {\n                                \"fail\": \"submitted\",\n                                \"notapplicable\": \"submitted\",\n                                \"pass\": \"submitted\",\n                              },\n                            \"unreviewed\": \"commented\",\n                            \"unreviewedCommented\": \"informational\",\n                            \"emptyDetail\": \"replace\",\n                            \"emptyComment\": \"ignore\",\n                            \"allowCustom\": true,\n                        },\n                },\n                \"metadata\": {\n                  \"pocName\": \"poc2Patched\",\n                  \"pocEmail\": \"pocEmail@email.com\",\n                  \"pocPhone\": \"12342\",\n                  \"reqRar\": \"true\"\n                },\n                  \"grants\": [\n                      {\n                        \"userId\": \"1\",\n                        \"roleId\": 4\n                      },\n                      {\n                              \"userId\": \"21\",\n                          \"roleId\": 2\n                      },\n                      {\n                              \"userId\": \"44\",\n                          \"roleId\": 3\n                      },\n                      {\n                              \"userId\": \"45\",\n                          \"roleId\": 3\n                      }\n                  ]\n              }\n        \n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}?projection=grants&projection=owners`, 'PUT', user.token, putRequest)\n            expect(res.status).to.eql(403)\n        })\n    })\n})\ndescribe('POST - createCollection - /collections', () => {\n\n    describe('Collection Settings', () => {\n\n        it('Invalid fields.detail.required value', async () => {\n\n            const postRequest = {\n                \"name\": \"TEST_\" + utils.getUUIDSubString(10),\n                \"description\": \"Collection TEST description\",\n                \"settings\": {\n                    \"fields\": {\n                        \"detail\": {\n                            \"enabled\": \"findings\",\n                            \"required\": \"always\"\n                        },\n                        \"comment\": {\n                            \"enabled\": \"always\",\n                            \"required\": \"always\"\n                        }\n                    },\n                    \"status\": {\n                        \"canAccept\": true,\n                        \"minAcceptGrant\": 3,\n                        \"resetCriteria\": \"result\"\n                    },\n                    \"history\": {\n                        \"maxReviews\": 11,\n                    },\n                    \"importOptions\": {\n                        \"autoStatus\": {\n                            \"fail\": \"submitted\",\n                            \"notapplicable\": \"submitted\",\n                            \"pass\": \"submitted\",\n                        },\n                        \"unreviewed\": \"commented\",\n                        \"unreviewedCommented\": \"informational\",\n                        \"emptyDetail\": \"replace\",\n                        \"emptyComment\": \"ignore\",\n                        \"allowCustom\": true,\n                    },\n              },\n                \"metadata\": {},\n                \"grants\": [\n                    {\n                            \"userId\": \"1\",\n                            \"roleId\": 4\n                    }\n                ]\n            }\n            \n            const res = await utils.executeRequest(`${config.baseUrl}/collections`, 'POST', user.token, postRequest)\n            expect(res.status).to.eql(400)\n        })\n        it(\"Missing settings\",async function () {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections`, 'POST', user.token, {\n                name: \"{{$timestamp}}\",\n                description: \"Collection TEST description\",\n                metadata: {},\n                grants: [\n                  {\n                    userId: \"1\",\n                    roleId: 4,\n                  },\n                ],\n              })\n            expect(res.status).to.eql(201)\n          })\n    })\n\n})\ndescribe('POST - cloneCollection - /collections/{collectionId}/clone - test various clone params', () => {    \n\n    describe('Collection Cloning', () =>{\n\n        before(async function () {\n            await utils.loadAppData()\n        })\n        describe('clone data prep - set cloned collection default rev for test benchmark to non-\"latest\"', () => {\n            it('Import a new STIG - VPN R1V0 copy', async () => {\n                \n                const filename = \"U_VPN_SRG_V1R0_Manual-xccdf.xml\"\n                const __filename = fileURLToPath(import.meta.url)\n                const __dirname = path.dirname(__filename)\n                const filePath = path.join(__dirname, `../../form-data-files/${filename}`)\n                const fileContent = readFileSync(filePath, 'utf-8')\n                const blob = new Blob([fileContent], { type: 'text/xml' })\n                                  \n                const formData = new FormData()\n                formData.append('importFile', blob, filename)\n\n                const res = await fetch(`${config.baseUrl}/stigs?elevate=true&clobber=true`, {\n                    method: 'POST',\n                    headers: {\n                    Authorization: `Bearer ${user.token}`,\n                    },\n                    body: formData,\n                })\n                expect(res.status).to.eql(200)\n            })\n            it('Set default rev for VPN_TEST_STIG and revision V1R0', async () => {\n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.benchmark}`, 'POST', user.token, {\n                    \"defaultRevisionStr\": \"V1R0\"\n                })\n                expect(res.status).to.eql(200)\n                const expectedResponse = {\n                    benchmarkId: reference.benchmark,\n                    title: \"Virtual Private Network (VPN) Security Requirements Guide\",\n                    revisionStr: \"V1R0\",\n                    benchmarkDate: \"2010-07-19\",\n                    revisionPinned: true,\n                    ruleCount: 81,\n                    assetCount: 3,\n                }\n                expect(res.body).to.eql(expectedResponse)    \n            })\n        })\n        describe('clone param variations', () => {\n            it('clone test collection - checking that new colleciton matches source', async () => {\n\n                const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/clone?projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs&projection=labels`\n\n                const requestBody = JSON.stringify( {\n                \"name\": \"Clone_X\" + utils.getUUIDSubString(10),\n                \"description\": \"clone of test collection x\",\n                \"options\": {\n                    \"grants\": true,\n                    \"labels\": true,\n                    \"assets\": true,\n                    \"stigMappings\": \"withReviews\",\n                    \"pinRevisions\": \"matchSource\"\n                }\n                })\n                const options = {\n                method: \"POST\",\n                headers: {\n                    \"Authorization\": `Bearer ${user.token}`,\n                    \"Content-Type\": \"application/json\",\n                },\n                body: requestBody,\n                }\n                const res = await fetch(url, options)\n                expect(res.status).to.eql(200)\n                const responseText = await res.text();\n                const response = responseText.split(\"\\n\");\n                for(const message of response){\n                    if(message.length > 0){\n                        let messageObject = JSON.parse(message)\n                        if(messageObject.stage === \"result\"){\n                            expect(messageObject.collection).to.have.property('grants');\n                              // remove grantId from grants response and grantsProjected expected response ( this cannot be tested well q)\n                              let grantsProjectedResponse = []\n                              for (let grant of messageObject.collection.grants){\n                                  let {grantId, ...grantCheckProps} = grant\n                                  grantsProjectedResponse.push(grantCheckProps)\n                              }\n  \n                              let expectedGrantsResponse = []\n                              for (let grant of reference.testCollection.grantsProjected){\n                                  let {grantId, ...grantCheckProps} = grant\n                                  expectedGrantsResponse.push(grantCheckProps)\n                              }\n                              expect(grantsProjectedResponse, \"check cloned collection grants\").to.eql(expectedGrantsResponse)\n\n                            //stats\n                            expect(messageObject.collection, \"testing stats projection\").to.have.property('statistics')\n                            expect(messageObject.collection.statistics.assetCount, \"assetCount\").to.eql(reference.testCollection.statisticsProjected.assetCount)\n                            // expect(messageObject.collection.statistics.grantCount, \"grant Count\").to.eql(reference.testCollection.statisticsProjected.grantCount)\n                            expect(messageObject.collection.statistics.checklistCount, \"checklist Count\").to.eql(reference.testCollection.statisticsProjected.checklistCount)\n\n                            // labels \n                            expect(messageObject.collection).to.have.property('labels');\n                            let labelProjectedResponse = []\n                            for (let label of messageObject.collection.labels){\n                                let {labelId, ...labelCheckProps} = label\n                                labelProjectedResponse.push(labelCheckProps)\n                            }\n                            expect(labelProjectedResponse).to.eql(reference.testCollection.labelsProjected)\n\n                            //owners \n                            expect(messageObject.collection).to.have.property('owners');\n                            // let ownerProjectedResponse = []\n                            // for (owner of messageObject.collection.owners){\n                            //     let {email, ...ownerCheckProps} = owner\n                            //     ownerProjectedResponse.push(ownerCheckProps)\n                            // }\n                            expect(messageObject.collection.owners, \"checking owners were cloned\").to.have.same.deep.members(reference.testCollection.ownersProjected)\n\n                            //assets\n                            let assetsProjectedResponse = []\n                            for (let asset of messageObject.collection.assets){\n                                let {assetId, ...assetCheckProps} = asset\n                                assetsProjectedResponse.push(assetCheckProps)\n                            }                    \n                            \n                            const assetsProjectedWithoutId = reference.testCollection.assetsProjected.map(({ name }) => ({ name }));\n\n                            expect(assetsProjectedResponse, \"checking assets were cloned\").to.eql(assetsProjectedWithoutId)\n\n                            //stigs \n                            expect(messageObject.collection.stigs).to.eql(reference.testCollection.stigsProjected)\n                        }\n                    }\n                }\n            })\n            it('clone test collection - no grants - no grants should be transfered', async () => {\n\n                const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/clone?projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs&projection=labels`\n                const requestBody = JSON.stringify({\n                    \"name\": \"Clone_X\" + utils.getUUIDSubString(10),\n                    \"description\": \"clone of test collection x\",\n                    \"options\": {\n                      \"grants\": false,\n                      \"labels\": true,\n                      \"assets\": true,\n                      \"stigMappings\": \"withReviews\",\n                      \"pinRevisions\": \"matchSource\"\n                    }\n                  })\n                const options = {\n                    method: \"POST\",\n                    headers: {\n                        \"Authorization\": `Bearer ${user.token}`,\n                        \"Content-Type\": \"application/json\",\n                    },\n                    body: requestBody,\n                }\n                const res = await fetch(url, options)\n                expect(res.status).to.eql(200)\n                const responseText = await res.text();\n                const response = responseText.split(\"\\n\");\n                const grantsProjected = [\n                    {\n                        user: {\n                            userId: \"1\",\n                            username: \"stigmanadmin\",\n                            displayName: \"STIGMAN Admin\"\n                        },\n                        grantId: \"41\",\n                        roleId: 4\n                    }\n                ]\n                const ownersProjected = [\n                    {\n                        userId: \"1\",\n                        username: \"stigmanadmin\",\n                        displayName: \"STIGMAN Admin\"\n                    }\n                ]\n                for(const message of response){\n                    if(message.length > 0){\n                        let messageObject = JSON.parse(message)\n                        if(messageObject.stage === \"result\"){\n                            expect(messageObject.collection).to.have.property('grants');\n                            expect(messageObject.collection.grants, \"check cloned collection grants\").to.eql(grantsProjected)\n\n                            //stats\n                            expect(messageObject.collection, \"testing stats projection\").to.have.property('statistics')\n                            expect(messageObject.collection.statistics.assetCount, \"assetCount\").to.eql(reference.testCollection.statisticsProjected.assetCount)\n                            // expect(messageObject.collection.statistics.grantCount, \"grant Count\").to.eql(grantCount)\n                            expect(messageObject.collection.statistics.checklistCount, \"checklist Count\").to.eql(reference.testCollection.statisticsProjected.checklistCount)\n\n                            // labels \n                            expect(messageObject.collection).to.have.property('labels');\n                            let labelProjectedResponse = []\n                            for (let label of messageObject.collection.labels){\n                                let {labelId, ...labelCheckProps} = label\n                                labelProjectedResponse.push(labelCheckProps)\n                            }\n                            expect(labelProjectedResponse).to.eql(reference.testCollection.labelsProjected)\n\n                            //owners \n                            expect(messageObject.collection).to.have.property('owners');\n                            let ownerProjectedResponse = []\n                            for (let owner of messageObject.collection.owners){\n                                let {email, ...ownerCheckProps} = owner\n                                ownerProjectedResponse.push(ownerCheckProps)\n                            }\n                            expect(ownerProjectedResponse, \"checking owners were cloned\").to.eql(ownersProjected)\n\n                            //assets\n                            let assetsProjectedResponse = []\n                            for (let asset of messageObject.collection.assets){\n                                let {assetId, ...assetCheckProps} = asset\n                                assetsProjectedResponse.push(assetCheckProps)\n                            }        \n                            const assetsProjectedWithoutId = reference.testCollection.assetsProjected.map(({ name }) => ({ name }));\n\n                            expect(assetsProjectedResponse, \"checking assets were cloned\").to.eql(assetsProjectedWithoutId)            \n\n                            //stigs \n                            expect(messageObject.collection.stigs).to.eql(reference.testCollection.stigsProjected)\n                        }\n                    }\n                }\n            })\n            it('clone test collection - no labels will be transfered', async () => {\n\n                const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/clone?projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs&projection=labels`\n                const requestBody = JSON.stringify({\n                    \"name\": \"Clone_X\" + utils.getUUIDSubString(10),\n                    \"description\": \"clone of test collection x\",\n                    \"options\": {\n                      \"grants\": true,\n                      \"labels\": false,\n                      \"assets\": true,\n                      \"stigMappings\": \"withReviews\",\n                      \"pinRevisions\": \"matchSource\"\n                    }\n                  })\n                const options = {\n                    method: \"POST\",\n                    headers: {\n                        \"Authorization\": `Bearer ${user.token}`,\n                        \"Content-Type\": \"application/json\",\n                    },\n                    body: requestBody,\n                }\n                const res = await fetch(url, options)\n                expect(res.status).to.eql(200)\n                const responseText = await res.text();\n                const response = responseText.split(\"\\n\");\n\n                const labelsProjected = []\n\n                for(const message of response){\n                    if(message.length > 0){\n                        let messageObject = JSON.parse(message)\n                        if(messageObject.stage === \"result\"){\n                            expect(messageObject.collection).to.have.property('grants')\n\n                            // remove grantId from grants response and grantsProjected expected response ( this cannot be tested well q)\n                            let grantsProjectedResponse = []\n                            for (let grant of messageObject.collection.grants){\n                                let {grantId, ...grantCheckProps} = grant\n                                grantsProjectedResponse.push(grantCheckProps)\n                            }\n\n                            let expectedGrantsResponse = []\n                            for (let grant of reference.testCollection.grantsProjected){\n                                let {grantId, ...grantCheckProps} = grant\n                                expectedGrantsResponse.push(grantCheckProps)\n                            }\n                            expect(grantsProjectedResponse, \"check cloned collection grants\").to.eql(expectedGrantsResponse)\n                            \n                            //stats\n                            expect(messageObject.collection, \"testing stats projection\").to.have.property('statistics')\n                            expect(messageObject.collection.statistics.assetCount, \"assetCount\").to.eql(reference.testCollection.statisticsProjected.assetCount)\n                            // expect(messageObject.collection.statistics.grantCount, \"grant Count\").to.eql(reference.testCollection.statisticsProjected.grantCount)\n                            expect(messageObject.collection.statistics.checklistCount, \"checklist Count\").to.eql(reference.testCollection.statisticsProjected.checklistCount)\n\n                            // labels \n                            expect(messageObject.collection).to.have.property('labels');\n                            let labelProjectedResponse = []\n                            for (label of messageObject.collection.labels){\n                                let {labelId, ...labelCheckProps} = label\n                                labelProjectedResponse.push(labelCheckProps)\n                            }\n                            expect(labelProjectedResponse).to.eql(labelsProjected)\n\n                            //owners \n                            expect(messageObject.collection).to.have.property('owners');\n                            // let ownerProjectedResponse = []\n                            // for (owner of messageObject.collection.owners){\n                            //     let {email, ...ownerCheckProps} = owner\n                            //     ownerProjectedResponse.push(ownerCheckProps)\n                            // }\n                            expect(messageObject.collection.owners, \"checking owners were cloned\").to.have.same.deep.members(reference.testCollection.ownersProjected)\n\n                            //assets\n                            let assetsProjectedResponse = []\n                            for (let asset of messageObject.collection.assets){\n                                let {assetId, ...assetCheckProps} = asset\n                                assetsProjectedResponse.push(assetCheckProps)\n                            }        \n                            const assetsProjectedWithoutId = reference.testCollection.assetsProjected.map(({ name }) => ({ name }));\n\n                            expect(assetsProjectedResponse, \"checking assets were cloned\").to.eql(assetsProjectedWithoutId)            \n\n                            //stigs \n                            expect(messageObject.collection.stigs).to.eql(reference.testCollection.stigsProjected)\n                        }\n                    }\n                }\n            })\n            it('clone test collection - no assets will be transfered', async () => {\n\n                const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/clone?projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs&projection=labels`\n                const requestBody = JSON.stringify({\n                \"name\": \"Clone_X\" + utils.getUUIDSubString(10),\n                \"description\": \"clone of test collection x\",\n                \"options\": {\n                    \"grants\": true,\n                    \"labels\": true,\n                    \"assets\": false,\n                    \"stigMappings\": \"withReviews\",\n                    \"pinRevisions\": \"matchSource\"\n                }\n                })\n                const options = {\n                    method: \"POST\",\n                    headers: {\n                        \"Authorization\": `Bearer ${user.token}`,\n                        \"Content-Type\": \"application/json\",\n                    },\n                    body: requestBody,\n                }\n                const res = await fetch(url, options)\n                expect(res.status).to.eql(200)\n                const responseText = await res.text();\n                const response = responseText.split(\"\\n\");\n                const assetsProjected = []\n                const assetCount = 0\n                const checklistCount = 0\n                const stigsProjected = []\n                const labelsProjected = [\n                    {\n                      name: \"test-label-full\",\n                      description: \"\",\n                      color: \"FF99CC\",\n                      uses: 0\n                    },\n                    {\n                      name: \"test-label-lvl1\",\n                      description: \"\",\n                      color: \"99CCFF\",\n                      uses: 0\n                    }\n                  ]\n\n                for(const message of response){\n                    if(message.length > 0){\n                        let messageObject = JSON.parse(message)\n                        if(messageObject.stage === \"result\"){\n                            expect(messageObject.collection).to.have.property('grants');\n                              // remove grantId from grants response and grantsProjected expected response ( this cannot be tested well q)\n                              let grantsProjectedResponse = []\n                              for (let grant of messageObject.collection.grants){\n                                  let {grantId, ...grantCheckProps} = grant\n                                  grantsProjectedResponse.push(grantCheckProps)\n                              }\n  \n                              let expectedGrantsResponse = []\n                              for (let grant of reference.testCollection.grantsProjected){\n                                  let {grantId, ...grantCheckProps} = grant\n                                  expectedGrantsResponse.push(grantCheckProps)\n                              }\n                              expect(grantsProjectedResponse, \"check cloned collection grants\").to.eql(expectedGrantsResponse)\n\n                            //stats\n                            expect(messageObject.collection, \"testing stats projection\").to.have.property('statistics')\n                            expect(messageObject.collection.statistics.assetCount, \"assetCount\").to.eql(assetCount)\n                            // expect(messageObject.collection.statistics.grantCount, \"grant Count\").to.eql(reference.testCollection.statisticsProjected.grantCount)\n                            expect(messageObject.collection.statistics.checklistCount, \"checklist Count\").to.eql(checklistCount)\n\n                            // labels \n                            expect(messageObject.collection).to.have.property('labels');\n                            let labelProjectedResponse = []\n                            for (let label of messageObject.collection.labels){\n                                let {labelId, ...labelCheckProps} = label\n                                labelProjectedResponse.push(labelCheckProps)\n                            }\n                            expect(labelProjectedResponse).to.eql(labelsProjected)\n\n                            //owners \n                            expect(messageObject.collection).to.have.property('owners');\n                            // let ownerProjectedResponse = []\n                            // for (owner of messageObject.collection.owners){\n                            //     let {email, ...ownerCheckProps} = owner\n                            //     ownerProjectedResponse.push(ownerCheckProps)\n                            // }\n                            expect(messageObject.collection.owners, \"checking owners were cloned\").to.have.same.deep.members(reference.testCollection.ownersProjected)\n\n                            //assets\n                            let assetsProjectedResponse = []\n                            for (asset of messageObject.collection.assets){\n                                let {assetId, ...assetCheckProps} = asset\n                                assetsProjectedResponse.push(assetCheckProps)\n                            }                    \n                            expect(assetsProjectedResponse, \"checking assets were cloned\").to.eql(assetsProjected)\n\n                            //stigs \n                            expect(messageObject.collection.stigs).to.eql(stigsProjected)\n                        }\n                    }\n                }\n            })\n            it('clone test collection - stigMapping=none - stig mappings not transfered', async () => {\n\n                const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/clone?projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs&projection=labels`\n                const requestBody = JSON.stringify({\n                \"name\": \"Clone_X\" + utils.getUUIDSubString(10),\n                \"description\": \"clone of test collection x\",\n                \"options\": {\n                    \"grants\": true,\n                    \"labels\": true,\n                    \"assets\": true,\n                    \"stigMappings\": \"none\",\n                    \"pinRevisions\": \"matchSource\"\n                }\n                })\n                const options = {\n                    method: \"POST\",\n                    headers: {\n                        \"Authorization\": `Bearer ${user.token}`,\n                        \"Content-Type\": \"application/json\",\n                    },\n                    body: requestBody,\n                }\n                const res = await fetch(url, options)\n                expect(res.status).to.eql(200)\n                const responseText = await res.text();\n                const response = responseText.split(\"\\n\");\n\n                const checklistCount = 0\n                const stigsProjected = []\n\n                for(const message of response){\n                    if(message.length > 0){\n                        let messageObject = JSON.parse(message)\n                        if(messageObject.stage === \"result\"){\n                            expect(messageObject.collection).to.have.property('grants');\n                            // remove grantId from grants response and grantsProjected expected response ( this cannot be tested well q)\n                            let grantsProjectedResponse = []\n                            for (let grant of messageObject.collection.grants){\n                                let {grantId, ...grantCheckProps} = grant\n                                grantsProjectedResponse.push(grantCheckProps)\n                            }\n\n                            let expectedGrantsResponse = []\n                            for (let grant of reference.testCollection.grantsProjected){\n                                let {grantId, ...grantCheckProps} = grant\n                                expectedGrantsResponse.push(grantCheckProps)\n                            }\n                            expect(grantsProjectedResponse, \"check cloned collection grants\").to.eql(expectedGrantsResponse)\n\n                            //stats\n                            expect(messageObject.collection, \"testing stats projection\").to.have.property('statistics')\n                            expect(messageObject.collection.statistics.assetCount, \"assetCount\").to.eql(reference.testCollection.statisticsProjected.assetCount)\n                            // expect(messageObject.collection.statistics.grantCount, \"grant Count\").to.eql(reference.testCollection.statisticsProjected.grantCount)\n                            expect(messageObject.collection.statistics.checklistCount, \"checklist Count\").to.eql(checklistCount)\n\n                            // labels \n                            expect(messageObject.collection).to.have.property('labels');\n                            let labelProjectedResponse = []\n                            for (let label of messageObject.collection.labels){\n                                let {labelId, ...labelCheckProps} = label\n                                labelProjectedResponse.push(labelCheckProps)\n                            }\n                            expect(labelProjectedResponse).to.eql(reference.testCollection.labelsProjected)\n\n                            //owners \n                            expect(messageObject.collection).to.have.property('owners');\n                            // let ownerProjectedResponse = []\n                            // for (owner of messageObject.collection.owners){\n                            //     let {email, ...ownerCheckProps} = owner\n                            //     ownerProjectedResponse.push(ownerCheckProps)\n                            // }\n                            expect(messageObject.collection.owners, \"checking owners were cloned\").to.have.same.deep.members(reference.testCollection.ownersProjected)\n\n                            //assets\n                            let assetsProjectedResponse = []\n                            for (let asset of messageObject.collection.assets){\n                                let {assetId, ...assetCheckProps} = asset\n                                assetsProjectedResponse.push(assetCheckProps)\n                            }                    \n                            const assetsProjectedWithoutId = reference.testCollection.assetsProjected.map(({ name }) => ({ name }));\n\n                            expect(assetsProjectedResponse, \"checking assets were cloned\").to.eql(assetsProjectedWithoutId)       \n\n                            //stigs \n                            expect(messageObject.collection.stigs).to.eql(stigsProjected)\n                        }\n                    }\n                }\n            })\n            it('clone test collection - stigMapping=withoutReviews', async () => {\n\n                const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/clone?projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs&projection=labels`\n                const requestBody = JSON.stringify({\n                \"name\": \"Clone_X\" + utils.getUUIDSubString(10),\n                \"description\": \"clone of test collection x\",\n                \"options\": {\n                    \"grants\": true,\n                    \"labels\": true,\n                    \"assets\": true,\n                    \"stigMappings\": \"withoutReviews\",\n                    \"pinRevisions\": \"matchSource\"\n                }\n                })\n                const options = {\n                    method: \"POST\",\n                    headers: {\n                        \"Authorization\": `Bearer ${user.token}`,\n                        \"Content-Type\": \"application/json\",\n                    },\n                    body: requestBody,\n                }\n                const res = await fetch(url, options)\n                expect(res.status).to.eql(200)\n                const responseText = await res.text();\n                const response = responseText.split(\"\\n\");\n\n                for(const message of response){\n                    if(message.length > 0){\n                        let messageObject = JSON.parse(message)\n                        if(messageObject.stage === \"result\"){\n                            expect(messageObject.collection).to.have.property('grants');\n                            // remove grantId from grants response and grantsProjected expected response ( this cannot be tested well q)\n                            let grantsProjectedResponse = []\n                            for (let grant of messageObject.collection.grants){\n                                let {grantId, ...grantCheckProps} = grant\n                                grantsProjectedResponse.push(grantCheckProps)\n                            }\n\n                            let expectedGrantsResponse = []\n                            for (let grant of reference.testCollection.grantsProjected){\n                                let {grantId, ...grantCheckProps} = grant\n                                expectedGrantsResponse.push(grantCheckProps)\n                            }\n                            expect(grantsProjectedResponse, \"check cloned collection grants\").to.eql(expectedGrantsResponse)\n\n                            //stats\n                            expect(messageObject.collection, \"testing stats projection\").to.have.property('statistics')\n                            expect(messageObject.collection.statistics.assetCount, \"assetCount\").to.eql(reference.testCollection.statisticsProjected.assetCount)\n                            // expect(messageObject.collection.statistics.grantCount, \"grant Count\").to.eql(reference.testCollection.statisticsProjected.grantCount)\n                            expect(messageObject.collection.statistics.checklistCount, \"checklist Count\").to.eql(reference.testCollection.statisticsProjected.checklistCount)\n\n                            // labels \n                            expect(messageObject.collection).to.have.property('labels');\n                            let labelProjectedResponse = []\n                            for (let label of messageObject.collection.labels){\n                                let {labelId, ...labelCheckProps} = label\n                                labelProjectedResponse.push(labelCheckProps)\n                            }\n                            expect(labelProjectedResponse).to.eql(reference.testCollection.labelsProjected)\n\n                            //owners \n                            expect(messageObject.collection).to.have.property('owners');\n                            // let ownerProjectedResponse = []\n                            // for (owner of messageObject.collection.owners){\n                            //     let {email, ...ownerCheckProps} = owner\n                            //     ownerProjectedResponse.push(ownerCheckProps)\n                            // }\n                            expect(messageObject.collection.owners, \"checking owners were cloned\").to.have.same.deep.members(reference.testCollection.ownersProjected)\n\n                            //assets\n                            let assetsProjectedResponse = []\n                            for (let asset of messageObject.collection.assets){\n                                let {assetId, ...assetCheckProps} = asset\n                                assetsProjectedResponse.push(assetCheckProps)\n                            }                    \n                            const assetsProjectedWithoutId = reference.testCollection.assetsProjected.map(({ name }) => ({ name }));\n\n                            expect(assetsProjectedResponse, \"checking assets were cloned\").to.eql(assetsProjectedWithoutId)       \n\n                            //stigs \n                            expect(messageObject.collection.stigs).to.eql(reference.testCollection.stigsProjected)\n                        }\n                    }\n                }\n            })\n            it('clone test collection - sourceDefaults', async () => {\n\n                const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/clone?projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs&projection=labels`\n                const requestBody = JSON.stringify({\n                \"name\": \"Clone_X\" + utils.getUUIDSubString(10),\n                \"description\": \"clone of test collection x\",\n                \"options\": {\n                    \"grants\": true,\n                    \"labels\": true,\n                    \"assets\": true,\n                    \"stigMappings\": \"withReviews\",\n                    \"pinRevisions\": \"sourceDefaults\"\n                }\n                })\n                const options = {\n                    method: \"POST\",\n                    headers: {\n                        \"Authorization\": `Bearer ${user.token}`,\n                        \"Content-Type\": \"application/json\",\n                    },\n                    body: requestBody,\n                }\n                const res = await fetch(url, options)\n                expect(res.status).to.eql(200)\n                const responseText = await res.text();\n                const response = responseText.split(\"\\n\");\n\n                const stigsProjected = JSON.parse(JSON.stringify(reference.testCollection.stigsProjected))\n                stigsProjected[1].revisionPinned = true      \n\n                for(const message of response){\n                    if(message.length > 0){\n                        let messageObject = JSON.parse(message)\n                        if(messageObject.stage === \"result\"){\n                            expect(messageObject.collection).to.have.property('grants');\n                            // remove grantId from grants response and grantsProjected expected response ( this cannot be tested well q)\n                            let grantsProjectedResponse = []\n                            for (let grant of messageObject.collection.grants){\n                                let {grantId, ...grantCheckProps} = grant\n                                grantsProjectedResponse.push(grantCheckProps)\n                            }\n\n                            let expectedGrantsResponse = []\n                            for (let grant of reference.testCollection.grantsProjected){\n                                let {grantId, ...grantCheckProps} = grant\n                                expectedGrantsResponse.push(grantCheckProps)\n                            }\n                            expect(grantsProjectedResponse, \"check cloned collection grants\").to.eql(expectedGrantsResponse)\n\n                            //stats\n                            expect(messageObject.collection, \"testing stats projection\").to.have.property('statistics')\n                            expect(messageObject.collection.statistics.assetCount, \"assetCount\").to.eql(reference.testCollection.statisticsProjected.assetCount)\n                            // expect(messageObject.collection.statistics.grantCount, \"grant Count\").to.eql(reference.testCollection.statisticsProjected.grantCount)\n                            expect(messageObject.collection.statistics.checklistCount, \"checklist Count\").to.eql(reference.testCollection.statisticsProjected.checklistCount)\n\n                            // labels \n                            expect(messageObject.collection).to.have.property('labels');\n                            let labelProjectedResponse = []\n                            for (let label of messageObject.collection.labels){\n                                let {labelId, ...labelCheckProps} = label\n                                labelProjectedResponse.push(labelCheckProps)\n                            }\n                            expect(labelProjectedResponse).to.eql(reference.testCollection.labelsProjected)\n\n                            //owners \n                            expect(messageObject.collection).to.have.property('owners');\n                            // let ownerProjectedResponse = []\n                            // for (owner of messageObject.collection.owners){\n                            //     let {email, ...ownerCheckProps} = owner\n                            //     ownerProjectedResponse.push(ownerCheckProps)\n                            // }\n                            expect(messageObject.collection.owners, \"checking owners were cloned\").to.have.same.deep.members(reference.testCollection.ownersProjected)\n\n                            //assets\n                            let assetsProjectedResponse = []\n                            for (let asset of messageObject.collection.assets){\n                                let {assetId, ...assetCheckProps} = asset\n                                assetsProjectedResponse.push(assetCheckProps)\n                            }                    \n                            const assetsProjectedWithoutId = reference.testCollection.assetsProjected.map(({ name }) => ({ name }));\n\n                            expect(assetsProjectedResponse, \"checking assets were cloned\").to.eql(assetsProjectedWithoutId)       \n                            \n                            //stigs \n                            expect(messageObject.collection.stigs).to.eql(stigsProjected)\n                        }\n                    }\n                }\n            })\n        })\n        describe('check clone reviews', () => {\n\n            let clonedCollectionId = null\n\n            it('post collection for later review check', async () => {\n                const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/clone?projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs&projection=labels`\n                const requestBody = JSON.stringify({\n                \"name\": \"Clone_X\" + utils.getUUIDSubString(10),\n                \"description\": \"clone of test collection x\",\n                \"options\": {\n                    \"grants\": true,\n                    \"labels\": true,\n                    \"assets\": true,\n                    \"stigMappings\": \"withReviews\",\n                    \"pinRevisions\": \"matchSource\"\n                }\n                })\n                const options = {\n                    method: \"POST\",\n                    headers: {\n                        \"Authorization\": `Bearer ${user.token}`,\n                        \"Content-Type\": \"application/json\",\n                    },\n                    body: requestBody,\n                }\n                const res = await fetch(url, options)\n                expect(res.status).to.eql(200)\n                const responseText = await res.text();\n                const response = responseText.split(\"\\n\");\n\n                for(const message of response){\n                    if(message.length > 0){\n                        let messageObject = JSON.parse(message)\n                        if(messageObject.stage === \"result\"){\n                            clonedCollectionId = messageObject.collection.collectionId\n                        }\n                    }\n                }\n            })\n            it('Check Reviews in cloned collection', async () => {  \n\n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${clonedCollectionId}/reviews`, 'GET', user.token)\n                expect(res.status).to.eql(200)\n                expect(res.body, \"expect response to be array of length 14\").to.have.lengthOf(14)\n           \n                for(const review of res.body){\n                    expect(review.assetName, \"expect asset to be named same as source\").to.be.oneOf(reference.testCollection.assetsProjected.map(asset => asset.name))\n                }\n            })\n        })\n        describe('clone param variations - user is either not lvl4 or not collectioncreator', () => {\n            it('clone test collection - lvl4 - not collectioncreator', async () => {\n\n                const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/clone?projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs&projection=labels`\n                const requestBody = JSON.stringify({\n                    \"name\": \"Clone_X\" + utils.getUUIDSubString(10),\n                    \"description\": \"clone of test collection x\",\n                    \"options\": {\n                    \"grants\": true,\n                    \"labels\": true,\n                    \"assets\": true,\n                    \"stigMappings\": \"withReviews\",\n                    \"pinRevisions\": \"matchSource\"\n                    }\n                })\n                const options = {\n                    method: \"POST\",\n                    headers: {\n                        \"Authorization\": `Bearer ${lvl4.token}`,\n                        \"Content-Type\": \"application/json\",\n                    },\n                    body: requestBody,\n                }\n                const res = await fetch(url, options)\n                    \n                expect(res.status).to.eql(403)\n            })\n            it('clone test collection - lvl4 - not collectioncreator', async () => {\n\n                const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/clone?projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs&projection=labels`\n                const requestBody = JSON.stringify({\n                \"name\": \"Clone_X\" + utils.getUUIDSubString(10),\n                \"description\": \"clone of test collection x\",\n                \"options\": {\n                    \"grants\": true,\n                    \"labels\": true,\n                    \"assets\": true,\n                    \"stigMappings\": \"withReviews\",\n                    \"pinRevisions\": \"matchSource\"\n                }\n                })\n                const options = {\n                    method: \"POST\",\n                    headers: {\n                        \"Authorization\": `Bearer ${collectioncreator.token}`,\n                        \"Content-Type\": \"application/json\",\n                    },\n                    body: requestBody,\n                  }\n                const res = await fetch(url, options)\n                expect(res.status).to.eql(403)\n            })\n        })\n    })\n})\ndescribe('POST - exportToCollection - /collections/{collectionId}/export-to/{dstCollectionId}', () => {\n\n    describe('export-to', () => {\n\n        before(async function () {\n            await utils.loadAppData()\n        })\n        let exportedAsset \n        let exportedAssetResults \n        let exportedAssetStatuses\n        it('Merge provided properties with a Collection Copy', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}`, 'PATCH', user.token, {\n                \"metadata\": {\n                \"pocName\": \"poc2Patched\",\n                \"pocEmail\": \"pocEmail@email.com\",\n                \"pocPhone\": \"12342\",\n                \"reqRar\": \"true\"\n                },\n                \"settings\": {\n                    \"fields\": {\n                        \"detail\": {\n                            \"enabled\": \"always\",\n                            \"required\": \"always\"\n                        },\n                        \"comment\": {\n                            \"enabled\": \"findings\",\n                            \"required\": \"findings\"\n                        }\n                    },\n                    \"status\": {\n                        \"canAccept\": true,\n                        \"resetCriteria\": \"result\",\n                        \"minAcceptGrant\": 3\n                    },\n                    \"history\": {\n                        \"maxReviews\": 15\n                    },\n                    \"importOptions\": {\n                       \"autoStatus\": {\n                            \"fail\": \"submitted\",\n                            \"notapplicable\": \"submitted\",\n                            \"pass\": \"submitted\",\n                        },\n                        \"unreviewed\": \"commented\",\n                        \"unreviewedCommented\": \"informational\",\n                        \"emptyDetail\": \"replace\",\n                        \"emptyComment\": \"ignore\",\n                        \"allowCustom\": true\n                    }\n                },  \n                \"grants\": [\n                    {\n                        \"userId\": \"1\",\n                        \"roleId\": 4\n                    },\n                    {\n                            \"userId\": \"21\",\n                        \"roleId\": 1\n                    },\n                    {\n                            \"userId\": \"44\",\n                        \"roleId\": 3\n                    },\n                    {\n                            \"userId\": \"45\",\n                        \"roleId\": 4\n                    },\n                    {\n                            \"userId\": \"87\",\n                        \"roleId\": 4\n                    }\n                ]\n            })\n            \n            expect(res.status).to.eql(200)\n        })\n        it(\"export results to another collection - entire asset - create asset in destination\", async () => {\n\n            const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/export-to/${reference.scrapCollection.collectionId}`\n\n            const requestBody = JSON.stringify([\n                {\n                assetId: reference.testAsset.assetId,\n                },\n            ])\n          \n          const res = await fetch(url, {\n            method: 'POST',\n            headers: {\n              'Authorization': `Bearer ${user.token}`,\n              'Content-Type': 'application/json',\n            },\n            body: requestBody,\n          })\n            \n            expect(res.status).to.eql(200)\n            const responseText = await res.text()\n            const response = responseText.split(\"\\n\")\n            expect(response).to.be.an('array')\n            expect(response).to.have.lengthOf.at.least(1)\n\n            for(const message of response){ \n                if(message.length > 0){\n                    let messageObj = JSON.parse(message)\n                    if(messageObj.stage == \"result\"){\n                        expect(messageObj.counts.assetsCreated).to.eql(1)\n                        expect(messageObj.counts.stigsMapped).to.eql(2)\n                        expect(messageObj.counts.reviewsInserted).to.eql(9)\n                        expect(messageObj.counts.reviewsUpdated).to.eql(0)\n                    }\n                }\n            }\n        })\n        it('get asset created via export-to', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/assets?collectionId=${reference.scrapCollection.collectionId}&name=Collection_X_lvl1_asset-1`, 'GET', user.token)\n            expect(res.status).to.eql(200)\n            exportedAsset = res.body[0].assetId\n        })\n        it('Return detail metrics - asset agg - with param assetId SOURCE', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail/asset?assetId=${reference.testAsset.assetId}`, 'GET', user.token)\n            expect(res.status).to.eql(200)\n            exportedAssetStatuses = res.body[0].metrics.statuses\n            exportedAssetResults = res.body[0].metrics.results\n\n        })\n        it('Return detail metrics - asset agg - with param assetId DEST', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/metrics/detail/asset?assetId=${exportedAsset}`, 'GET', user.token)\n            expect(res.status).to.eql(200)\n            expect(res.body[0].metrics.results, \"comparing source asset to exported asset metrics\").to.eql(exportedAssetResults)\n\n        })\n        it('PUT Review: stigs and rule projections Copy', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/reviews/${exportedAsset}/${reference.ruleId}?projection=rule&projection=stigs`, 'PUT', user.token, {\n                \"result\": \"pass\",\n                \"detail\": \"test\\nvisible to lvl1\",\n                \"comment\": \"\",\n                \"autoResult\": false,\n                \"status\": \"accepted\"\n            })\n            expect(res.status).to.eql(200)\n\n        })\n        it(\"export results to another collection - entire asset - asset exists Copy\", async () => {\n\n            const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/export-to/${reference.scrapCollection.collectionId}`\n\n            const requestBody = JSON.stringify([\n                {\n                assetId: reference.testAsset.assetId,\n                },\n            ])\n          \n          const res = await fetch(url, {\n            method: 'POST',\n            headers: {\n              'Authorization': `Bearer ${user.token}`,\n              'Content-Type': 'application/json',\n            },\n            body: requestBody,\n          })\n            \n            expect(res.status).to.eql(200)\n            const responseText = await res.text()\n            const response = responseText.split(\"\\n\")\n            expect(response).to.be.an('array')\n            expect(response).to.have.lengthOf.at.least(1)\n            for(const message of response){ \n                if(message.length > 0){\n                    let messageObj = JSON.parse(message)\n                    if(messageObj.stage == \"result\"){\n                    expect(messageObj.counts.assetsCreated).to.eql(0)\n                    expect(messageObj.counts.stigsMapped).to.eql(0)\n                    expect(messageObj.counts.reviewsInserted).to.eql(0)\n                    expect(messageObj.counts.reviewsUpdated).to.eql(9)\n                    }\n                }\n            }\n        })\n        it('Return detail metrics - asset agg - with param assetId DEST Copy', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/metrics/detail/asset?assetId=${exportedAsset}`, 'GET', user.token)\n            expect(res.status).to.eql(200)\n            let expectedStatuses = {\n                \"saved\": {\n                    \"total\": 8,\n                    \"resultEngine\": 0\n                },\n                \"accepted\": {\n                    \"total\": 1,\n                    \"resultEngine\": 0\n                },\n                \"rejected\": {\n                    \"total\": 0,\n                    \"resultEngine\": 0\n                },\n                \"submitted\": {\n                    \"total\": 0,\n                    \"resultEngine\": 0\n                }\n            }\n            expect(res.body[0].metrics.results, \"comparing source asset to exported asset metrics\").to.eql(exportedAssetResults)\n            expect(res.body[0].metrics.statuses, \"comparing source asset to exported asset statuses\").to.eql(expectedStatuses);\n        })\n        it('Merge provided properties with a Collection Copy 2', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}`, 'PATCH', user.token, {\n                \"metadata\": {\n                \"pocName\": \"poc2Patched\",\n                \"pocEmail\": \"pocEmail@email.com\",\n                \"pocPhone\": \"12342\",\n                \"reqRar\": \"true\"\n                },\n                \"settings\": {\n                    \"fields\": {\n                        \"detail\": {\n                            \"enabled\": \"always\",\n                            \"required\": \"always\"\n                        },\n                        \"comment\": {\n                            \"enabled\": \"findings\",\n                            \"required\": \"findings\"\n                        }\n                    },\n                    \"status\": {\n                        \"canAccept\": true,\n                        \"resetCriteria\": \"any\",\n                        \"minAcceptGrant\": 3\n                    },\n                    \"history\": {\n                        \"maxReviews\": 15\n                    },\n                    \"importOptions\": {\n                        \"autoStatus\": {\n                            \"fail\": \"submitted\",\n                            \"notapplicable\": \"submitted\",\n                            \"pass\": \"submitted\",\n                        },\n                        \"unreviewed\": \"commented\",\n                        \"unreviewedCommented\": \"informational\",\n                        \"emptyDetail\": \"replace\",\n                        \"emptyComment\": \"ignore\",\n                        \"allowCustom\": true\n                    }\n                    \n                },  \n                \"grants\": [\n                    {\n                        \"userId\": \"1\",\n                        \"roleId\": 4\n                    },\n                    {\n                            \"userId\": \"21\",\n                        \"roleId\": 1\n                    },\n                    {\n                            \"userId\": \"44\",\n                        \"roleId\": 3\n                    },\n                    {\n                            \"userId\": \"45\",\n                        \"roleId\": 4\n                    },\n                    {\n                            \"userId\": \"87\",\n                        \"roleId\": 4\n                    }\n                ]\n            })\n            expect(res.status).to.eql(200)\n        })\n        it('PUT Review: stigs and rule projections Copy 2 ', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/reviews/${exportedAsset}/${reference.ruleId}?projection=rule&projection=stigs`, 'PUT', user.token, {\n                \"result\": \"pass\",\n                \"detail\": \"test\\nvisible to lvl1\",\n                \"comment\": \"\",\n                \"autoResult\": false,\n                \"status\": \"accepted\"\n            })\n            expect(res.status).to.eql(200)\n        })\n        it(\"export results to another collection - entire asset - asset exists Copy 2\", async () => {\n\n            const url = `${config.baseUrl}/collections/${reference.testCollection.collectionId}/export-to/${reference.scrapCollection.collectionId}`\n\n            const requestBody = JSON.stringify([\n                {\n                assetId: reference.testAsset.assetId,\n                },\n            ])\n          \n            const res = await fetch(url, {\n                method: 'POST',\n                headers: {\n                'Authorization': `Bearer ${user.token}`,\n                'Content-Type': 'application/json',\n                },\n                body: requestBody,\n            })\n            \n            expect(res.status).to.eql(200)\n            const responseText = await res.text()\n            const response = responseText.split(\"\\n\")\n            expect(response).to.be.an('array')\n            expect(response).to.have.lengthOf.at.least(1)\n            for(const message of response){ \n                if(message.length > 0){\n                    let messageObj = JSON.parse(message)\n                    if(messageObj.stage == \"result\"){\n                    expect(messageObj.counts.assetsCreated).to.eql(0)\n                    expect(messageObj.counts.stigsMapped).to.eql(0)\n                    expect(messageObj.counts.reviewsInserted).to.eql(0)\n                    expect(messageObj.counts.reviewsUpdated).to.eql(9)\n                    }\n                }\n            }\n        })\n        it('Return detail metrics - asset agg - with param assetId DEST Copy 2', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/metrics/detail/asset?assetId=${exportedAsset}`, 'GET', user.token)\n            expect(res.status).to.eql(200)\n            let expectedStatuses = {\n                \"saved\": {\n                    \"total\": 9,\n                    \"resultEngine\": 0\n                },\n                \"accepted\": {\n                    \"total\": 0,\n                    \"resultEngine\": 0\n                },\n                \"rejected\": {\n                    \"total\": 0,\n                    \"resultEngine\": 0\n                },\n                \"submitted\": {\n                    \"total\": 0,\n                    \"resultEngine\": 0\n                }\n            }\n            expect(res.body[0].metrics.results, \"comparing source asset to exported asset metrics\").to.eql(exportedAssetResults)\n            expect(res.body[0].metrics.statuses, \"comparing source asset to exported asset statuses\").to.eql(expectedStatuses);\n        })\n    })\n})\ndescribe('POST - postReviewsByAsset - /collections/{collectionId}/reviews/{assetId}', () => {\n\n    describe('Duplicate RuleIds/Rule Fingerprint', () => {\n\n        before(async function () {\n            await utils.loadAppData()\n        })\n        it('Import a new STIG - VPN  (as admin) Copy', async () => {\n\n            const testStigfile = reference.rulesMatchingFingerprints\n            const __filename = fileURLToPath(import.meta.url)\n            const __dirname = path.dirname(__filename)\n            const filePath = path.join(__dirname, `../../form-data-files/${testStigfile}`)\n            const fileContent = readFileSync(filePath, 'utf-8')\n            \n            const blob = new Blob([fileContent], { type: 'text/xml' })\n            const formData = new FormData()\n            formData.append('importFile', blob, testStigfile)\n\n            const res = await fetch(`${config.baseUrl}/stigs?elevate=true&clobber=true`, {\n                method: 'POST',\n                headers: {\n                  Authorization: `Bearer ${user.token}`,\n                },\n                body: formData,\n            })\n            expect(res.status).to.eql(200)\n        })\n        it('PUT a STIG assignment to an Asset Copy 2', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/stigs/VPN_SRG_Rule-fingerprint-match-test`, 'PUT', user.token)\n            expect(res.status).to.eql(200)\n        })\n        it('Import one or more Reviews with matching Rule Fingerprints - 2 of these rules have matching fingerprints, so only 2 rules are actually inserted and the other is ignored. ', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}`, 'POST', user.token, [\n                {\n                    \"ruleId\": \"SV-106179r1_xxxx\",\n                    \"result\": \"pass\",\n                    \"detail\": \"asfeee\",\n                    \"comment\": null,\n                    \"resultEngine\": null,\n                    \"status\": \"saved\"\n                },\n                {\n                    \"ruleId\": \"SV-106179r1_zzzzzz\",\n                    \"result\": \"pass\",\n                    \"detail\": \"asfeee\",\n                    \"comment\": null,\n                    \"resultEngine\": null,\n                    \"status\": \"saved\"\n                },\n                {\n                    \"ruleId\": \"SV-106181r1_xxxx\",\n                    \"result\": \"notapplicable\",\n                    \"detail\": \"asdfsef\",\n                    \"comment\": null,\n                    \"resultEngine\": null,\n                    \"status\": \"saved\"\n                }\n            ])\n            expect(res.status).to.eql(200)\n            const expectedResponse = {\n                rejected: [],\n                affected: {\n                    updated: 0,\n                    inserted: 2\n                }\n            }\n            expect(res.body).to.eql(expectedResponse)\n        })\n        it('Return detailed metrics for the specified Collection - with params Copy', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail?benchmarkId=VPN_SRG_Rule-fingerprint-match-test&assetId=${reference.testAsset.assetId}`, 'GET', user.token)\n            expect(res.status).to.eql(200)\n            let testChecklistLength = 3\n            let testBenchmark = \"VPN_SRG_Rule-fingerprint-match-test\"\n            for(let item of res.body){\n                expect(item.benchmarkId).to.eql(testBenchmark)\n                expect(item.assetId).to.eql(reference.testAsset.assetId)\n                let responseLabels = [];\n                for (let label of item.labels) {\n                    responseLabels.push(label.labelId)\n                }\n                expect(responseLabels, \"expect test label\").to.include(reference.testCollection.fullLabel)\n                if (item.assetId ==  reference.testAsset.assetId && item.benchmarkId == testBenchmark) {\n                    expect(item.metrics.findings.low).to.equal(0)\n                    expect(item.metrics.results.notapplicable.total).to.equal(1)\n                    expect(item.metrics.results.pass.total).to.equal(2)\n                    expect(item.metrics.results.fail.total).to.equal(0)\n                    expect(item.metrics.statuses.submitted.total).to.equal(0)\n                    expect(item.metrics.assessments).to.equal(testChecklistLength)\n                    expect(item.metrics.assessed).to.equal(3)\n                }\n            }\n        })\n        it('Delete a STIG assignment to an Asset Copy', async () => {\n                \n                const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/stigs/VPN_SRG_Rule-fingerprint-match-test`, 'DELETE', user.token)\n                expect(res.status).to.eql(200)\n        })\n        it('PUT a STIG assignment to an Asset Copy 2', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/stigs/VPN_SRG_Rule-fingerprint-match-test`, 'PUT', user.token)\n            expect(res.status).to.eql(200)\n        })\n        it('Return detailed metrics for the specified Collection - with params Copy 2', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail?benchmarkId=VPN_SRG_Rule-fingerprint-match-test&assetId=${reference.testAsset.assetId}`, 'GET', user.token)\n            expect(res.status).to.eql(200)\n            let testChecklistLength = 3\n            let testBenchmark = \"VPN_SRG_Rule-fingerprint-match-test\"\n            for(let item of res.body){\n                expect(item.benchmarkId).to.eql(testBenchmark)\n                expect(item.assetId).to.eql(reference.testAsset.assetId)\n                let responseLabels = [];\n                for (let label of item.labels) {\n                    responseLabels.push(label.labelId)\n                }\n                expect(responseLabels, \"expect test label\").to.include(reference.testCollection.fullLabel)\n                if (item.assetId ==  reference.testAsset.assetId && item.benchmarkId == testBenchmark) {\n                    expect(item.metrics.findings.low).to.equal(0)\n                    expect(item.metrics.results.notapplicable.total).to.equal(1)\n                    expect(item.metrics.results.pass.total).to.equal(2)\n                    expect(item.metrics.results.fail.total).to.equal(0)\n                    expect(item.metrics.statuses.submitted.total).to.equal(0)\n                    expect(item.metrics.assessments).to.equal(testChecklistLength)\n                    expect(item.metrics.assessed).to.equal(3)\n                }\n            }\n        })\n        it('Import and overwrite application data (as elevated Admin) Copy 2', async () => {\n            try{\n                // // await utils.uploadTestStigs()\n                await utils.loadAppData()\n            }\n            catch(err){\n                console.log(err)\n                throw new Error(\"This test should have passed\")\n            }\n        })\n        it('PUT a STIG assignment to an Asset Copy 3', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}/stigs/VPN_SRG_Rule-fingerprint-match-test`, 'PUT', user.token)\n            expect(res.status).to.eql(200)\n        })\n        it('Import one or more Reviews with matching RuleIds - 2 rules match, only one is inserted, 2 total.', async () => {\n                \n                const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}`, 'POST', user.token, [\n                    {\n                        \"ruleId\": \"SV-106179r1_xxxx\",\n                        \"result\": \"pass\",\n                        \"detail\": \"asfeee\",\n                        \"comment\": null,\n                        \"resultEngine\": null,\n                        \"status\": \"saved\"\n                    },\n                    {\n                        \"ruleId\": \"SV-106179r1_xxxx\",\n                        \"result\": \"pass\",\n                        \"detail\": \"asfeee\",\n                        \"comment\": null,\n                        \"resultEngine\": null,\n                        \"status\": \"saved\"\n                    },\n                    {\n                        \"ruleId\": \"SV-106181r1_xxxx\",\n                        \"result\": \"notapplicable\",\n                        \"detail\": \"asdfsef\",\n                        \"comment\": null,\n                        \"resultEngine\": null,\n                        \"status\": \"saved\"\n                    }\n                ])\n                expect(res.status).to.eql(200)\n                const expectedResponse = {\n                    rejected: [],\n                    affected: {\n                        updated: 0,\n                        inserted: 2\n                    }\n                }\n                expect(res.body).to.eql(expectedResponse)\n        })\n        it('Return detailed metrics for the specified Collection - with params Copy 2', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail?benchmarkId=VPN_SRG_Rule-fingerprint-match-test&assetId=${reference.testAsset.assetId}`, 'GET', user.token)\n            expect(res.status).to.eql(200)\n            let testChecklistLength = 3\n            let testBenchmark = \"VPN_SRG_Rule-fingerprint-match-test\"\n            for(let item of res.body){\n                expect(item.benchmarkId).to.eql(testBenchmark)\n                expect(item.assetId).to.eql(reference.testAsset.assetId)\n                let responseLabels = [];\n                for (let label of item.labels) {\n                    responseLabels.push(label.labelId)\n                }\n                expect(responseLabels, \"expect test label\").to.include(reference.testCollection.fullLabel)\n                if (item.assetId ==  reference.testAsset.assetId && item.benchmarkId == testBenchmark) {\n                    expect(item.metrics.findings.low).to.equal(0)\n                    expect(item.metrics.results.notapplicable.total).to.equal(1)\n                    expect(item.metrics.results.pass.total).to.equal(2)\n                    expect(item.metrics.results.fail.total).to.equal(0)\n                    expect(item.metrics.statuses.submitted.total).to.equal(0)\n                    expect(item.metrics.assessments).to.equal(testChecklistLength)\n                    expect(item.metrics.assessed).to.equal(3)\n                }\n            }\n        })\n    })\n})\ndescribe('GET - putAssetsByCollectionLabelId - /collections/{collectionId}/labels/{labelId}/assets', () => {\n\n    describe(`valid label checks - ensure asset labels are valid for that asset's collection.`, () => {\n\n        before(async function () {\n            await utils.loadAppData()\n        })\n\n        it('Merge provided properties with an Asset Copy', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.scrapAsset.assetId}?projection=statusStats&projection=stigs`, 'PATCH', user.token, {\n                \"collectionId\": reference.scrapCollection.collectionId,\n                \"description\": \"test desc\",\n                \"ip\": \"1.1.1.1\",\n                \"noncomputing\": true,\n                \"labelNames\": [\n                    \"scrapLabel\"\n                ],    \n                \"metadata\": {\n                    \"pocName\": \"poc2Put\",\n                    \"pocEmail\": \"pocEmailPut@email.com\",\n                    \"pocPhone\": \"12342\",\n                    \"reqRar\": \"true\"\n                },\n                \"stigs\": [\n                    \"VPN_SRG_TEST\",\n                    \"Windows_10_STIG_TEST\",\n                    \"RHEL_7_STIG_TEST\"\n                ]\n            })\n            expect(res.status).to.eql(200)\n        })\n        it('Replace an assets label', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/labels/${reference.scrapCollection.scrapLabel}/assets`, 'PUT', user.token, [\n                    `${reference.testAsset.assetId}`\n            ])\n            expect(res.status).to.eql(403)\n        })\n        it('Create an Asset Copy', async () => {\n\n            const request =  {\n                \"name\": \"testAsset\" + utils.getUUIDSubString(10),\n                \"collectionId\": reference.scrapCollection.collectionId,\n                \"description\": \"test desc\",\n                \"ip\": \"1.1.1.1\",\n                \"labelNames\": [],\n                \"noncomputing\": true,\n                \"metadata\": {\n                    \"pocName\": \"poc2Put\",\n                    \"pocEmail\": \"pocEmailPut@email.com\",\n                    \"pocPhone\": \"12342\",\n                    \"reqRar\": \"true\"\n                },\n                \"stigs\": [\n                    \"VPN_SRG_TEST\",\n                    \"Windows_10_STIG_TEST\"\n                ]\n            }\n\n            const res = await utils.executeRequest(`${config.baseUrl}/assets?projection=stigs`, 'POST', user.token, request)\n            expect(res.status).to.eql(201)\n            // remove labelNames property from request to match response\n            delete request.labelNames\n            request.labelIds =[]\n            request.labels =[]\n            expect(assetGetToPost(res.body)).to.eql(request)\n        })\n        it('Set all properties of an Asset Copy', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.scrapAsset.assetId}`, 'PUT', user.token, {\n                \"name\": utils.getUUIDSubString(10),\n                \"collectionId\": reference.scrapCollection.collectionId,\n                \"description\": \"test desc\",\n                \"ip\": \"1.1.1.1\",\n                \"noncomputing\": true,\n                \"labelNames\": [],\n                \"metadata\": {\n                    \"pocName\": \"poc2Put\",\n                    \"pocEmail\": \"pocEmailPut@email.com\",\n                    \"pocPhone\": \"12342\",\n                    \"reqRar\": \"true\"\n                },\n                \"stigs\": [\n                    \"VPN_SRG_TEST\",\n                    \"Windows_10_STIG_TEST\",\n                    \"RHEL_7_STIG_TEST\"\n                ]\n            })\n            expect(res.status).to.eql(200)\n        })\n        it('check that request body without collectionId properly sets labels - GH-1293', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.scrapAsset.assetId}`, 'PATCH', user.token, {\n                \"labelNames\": [\n                    \"scrapLabel\"\n                ]\n            })\n            expect(res.status).to.eql(200)\n            expect(res.body.labelIds).to.have.lengthOf(1);\n        })\n    })\n})\ndescribe('PUT - setStigAssetsByCollectionUser - /collections/{collectionId}/grants/user/{userId}/access', () => {\n\n    describe('restricted grant assignments outside of Collection boundary', () => {\n\n        it('Add restricted user to collection Y', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/83?elevate=true&projection=grants`, 'PATCH', user.token, {\n                  \"grants\": [\n                      {\n                        \"userId\": \"87\",\n                        \"roleId\": 4\n                      },\n                      {\n                              \"userId\": \"1\",\n                          \"roleId\": 4\n                      },\n                      {\n                              \"userId\": \"85\",\n                          \"roleId\": 1\n                      }\n                  ]\n              })\n            expect(res.status).to.eql(200)\n            expect(res.body.collectionId).to.eql('83')\n            expect(res.body.grants).to.be.an('array').of.length(3)\n            for(const grant of res.body.grants){\n                if(grant.userId === 85){\n                    expect(grant.roleId).to.eql(1)\n                }\n            }\n        })\n        it(\"should give lvl1 user restricted access to test collection\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', user.token, [{\n               userId: reference.lvl1User.userId,\n               roleId: 1\n            }])\n            expect(res.status).to.eql(201)\n            reference.lvl1User.grantId = res.body[0].grantId\n        })\n        it('set stig-asset grants for a lvl1 user in test collection, with asset from another collection', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.lvl1User.grantId}/acl`, 'PUT', user.token, [\n                {\n                    \"benchmarkId\": reference.benchmark,\n                    \"assetId\": \"62\",\n                    \"access\": \"rw\"\n                },\n                {\n                    \"benchmarkId\": reference.benchmark,\n                    \"assetId\": \"42\",\n                    \"access\": \"rw\"\n                }     \n            ])\n            expect(res.status).to.eql(200)\n        })\n        it('Return stig-asset grants for a lvl1 user in this collection. Copy', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/83/grants/${reference.lvl1User.grantId}/acl`, 'GET', user.token)\n            expect(res.status).to.eql(404)\n        })\n    })\n})\n\ndescribe('deleteGrantByCollectionGrant - /collections/{collectionId}/grants/{grantId}', function () {\n\n    describe('Owner delete another owner grant in collection they do not have a grant in', function () {\n\n        before(async function () {\n        await utils.loadAppData()\n        })  \n        it('Delete sitgmanadmin grant in Collection Y as stigmanadmin ',async function () {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/83/grants/9`, 'DELETE', user.token)\n                \n            expect(res.status).to.eql(200)\n            expect(res.body.grantId).to.eql(\"9\")\n            expect(res.body.user.userId).to.eql(\"1\")\n\n        })\n      \n        it(\"Delete admin burkes owner grant in Collection Y as stigmanadmin\",async function () {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/83/grants/8?elevate=true`, 'DELETE', user.token)\n            expect(res.status).to.eql(200)\n        })\n    })\n})\n\ndescribe('getCollection - /collections/{collectionId} -  check that empty usergroup will not be returned ', function () {\n\n    before(async function () {\n        await utils.loadAppData()\n    })\n\n    let userGroup = null\n\n\n    it('should create a userGroup', async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true`, 'POST', user.token, {\n            \"name\": \"no\" +  uuidv4(),\n            \"description\": \"notseeme\",\n            \"userIds\": [\n            ]\n        })\n        expect(res.status).to.eql(201)\n        userGroup = res.body\n    })\n\n    it('should add userGroup to collection', async () => {\n\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants?elevate=true`, 'POST', user.token, \n            [\n                {\n                    \"userGroupId\": userGroup.userGroupId,\n                    \"roleId\": 1\n                }\n            ]\n        )\n        expect(res.status).to.eql(201)\n    })\n            \n    it('Return a Collection with userGroup that has no users or acl ensure it is not returned by api',async function () { \n      const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}?projection=users`, 'GET', user.token)\n      expect(res.status).to.eql(200)\n      for(const user of res.body.users){\n        expect(user.grantees[0].userGroupId).to.not.eql(userGroup.userGroupId)\n      }\n    })\n})\n\n\nfunction assetGetToPost (assetGet) {\n    // extract the transformed and unposted properties\n    const { assetId, collection, stigs, mac, fqdn, ...assetPost } = assetGet\n  \n    // add transformed properties to the derived post\n    assetPost.collectionId = collection.collectionId\n    assetPost.stigs = stigsGetToPost(stigs)\n  \n    // the derived post object\n    return assetPost\n}\n  \nfunction stigsGetToPost (stigsGetArray) {\nconst stigsPostArray = []\nfor (const stig of stigsGetArray) {\nstigsPostArray.push(stig.benchmarkId)\n}\nreturn stigsPostArray\n}"
  },
  {
    "path": "test/api/mocha/integration/deleteHandling.test.js",
    "content": "\nimport {config } from '../testConfig.js'\nimport * as utils from '../utils/testUtils.js'\nimport reference from '../referenceData.js'\nimport { expect } from 'chai'\n\nconst user = {\n  name: \"admin\",\n  grant: \"Owner\",\n  token:\n    \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ2ODEwMzUsImlhdCI6MTY3MDU0MDIzNiwiYXV0aF90aW1lIjoxNjcwNTQwMjM1LCJqdGkiOiI0N2Y5YWE3ZC1iYWM0LTQwOTgtOWJlOC1hY2U3NTUxM2FhN2YiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJiN2M3OGE2Mi1iODRmLTQ1NzgtYTk4My0yZWJjNjZmZDllZmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjMzNzhkYWZmLTA0MDQtNDNiMy1iNGFiLWVlMzFmZjczNDBhYyIsInNlc3Npb25fc3RhdGUiOiI4NzM2NWIzMy0yYzc2LTRiM2MtODQ4NS1mYmE1ZGJmZjRiOWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIiwiYWRtaW4iXX0sInJlc291cmNlX2FjY2VzcyI6eyJyZWFsbS1tYW5hZ2VtZW50Ijp7InJvbGVzIjpbInZpZXctdXNlcnMiLCJxdWVyeS1ncm91cHMiLCJxdWVyeS11c2VycyJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIHN0aWctbWFuYWdlcjpvcCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIHN0aWctbWFuYWdlcjpvcDpyZWFkIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlciBzdGlnLW1hbmFnZXI6c3RpZyIsInNpZCI6Ijg3MzY1YjMzLTJjNzYtNGIzYy04NDg1LWZiYTVkYmZmNGI5ZiIsIm5hbWUiOiJTVElHTUFOIEFkbWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RpZ21hbmFkbWluIiwiZ2l2ZW5fbmFtZSI6IlNUSUdNQU4iLCJmYW1pbHlfbmFtZSI6IkFkbWluIn0.a1XwJZw_FIzwMXKo-Dr-n11me5ut-SF9ni7ylX-7t7AVrH1eAqyBxX9DXaxFK0xs6YOhoPsh9NyW8UFVaYgtF68Ps6yzoiqFEeiRXkpN5ygICN3H3z6r-YwanLlEeaYR3P2EtHRcrBtCnt0VEKKbGPWOfeiNCVe3etlp9-NQo44\",\n}\n\ndescribe('DELETE - deleteAsset - /assets/{assetId} - DELETE - deleteCollection - /collections/{collectionId}', () => {\n    describe('delete handling', () => {\n\n        before(async function () {\n            await utils.loadAppData()\n        })\n\n        let collectionToDelete = null\n        let assetToDelete = null\n        let deletedCollection = null\n        it('Create a Collection in order to delete it', async () => {\n            \n            const res = await utils.executeRequest(`${config.baseUrl}/collections?projection=grants&projection=labels`, 'POST', user.token, {\n                \"name\": \"TEST_\"+ utils.getUUIDSubString(),\n                \"description\": \"Collection TEST description\",\n                \"settings\": {\n                    \"fields\": {\n                        \"detail\": {\n                            \"enabled\": \"always\",\n                            \"required\": \"findings\"\n                        },\n                        \"comment\": {\n                            \"enabled\": \"always\",\n                            \"required\": \"findings\"\n                        }\n                    },\n                    \"status\": {\n                        \"canAccept\": true,\n                        \"minAcceptGrant\": 2,\n                        \"resetCriteria\": \"result\"\n                    },\n                    \"history\": {\n                        \"maxReviews\": 11\n                    },\n                    \"importOptions\": {\n                        \"autoStatus\": {\n                            \"fail\": \"submitted\",\n                            \"notapplicable\": \"submitted\",\n                            \"pass\": \"submitted\",\n                        },\n                        \"unreviewed\": \"commented\",\n                        \"unreviewedCommented\": \"informational\",\n                        \"emptyDetail\": \"replace\",\n                        \"emptyComment\": \"ignore\",\n                        \"allowCustom\": true\n                    }\n              },\n                \"metadata\": {\n                    \"pocName\": \"poc2Put\",\n                    \"pocEmail\": \"pocEmailPut@email.com\",\n                    \"pocPhone\": \"12342\",\n                    \"reqRar\": \"true\"\n                },\n                \"grants\": [\n                    {\n                            \"userId\": \"1\",\n                            \"roleId\": 4\n                    },\n                    {\n                            \"userId\": \"85\",\n                            \"roleId\": 1\n                    }        \n                ],\n                \"labels\": [\n                    {\n                        \"name\": \"TEST\",\n                        \"description\": \"Collection label description\",\n                        \"color\": \"ffffff\"\n                    }\n                ]\n            })\n            expect(res.status).to.eql(201)\n            collectionToDelete = res.body.collectionId\n        })\n        it('Create an Asset in collection to be deleted', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/assets?projection=stigs`, 'POST', user.token, {\n                \"name\": \"TEST_\"+ utils.getUUIDSubString(10),\n                \"collectionId\": collectionToDelete,\n                \"description\": \"test desc\",\n                \"ip\": \"1.1.1.1\",\n                \"labelNames\": [],\n                \"noncomputing\": true,\n                \"metadata\": {\n                    \"pocName\": \"poc2Put\",\n                    \"pocEmail\": \"pocEmailPut@email.com\",\n                    \"pocPhone\": \"12342\",\n                    \"reqRar\": \"true\"\n                },\n                \"stigs\": [\n                    \"VPN_SRG_TEST\",\n                    \"Windows_10_STIG_TEST\"\n                ]\n            })\n            expect(res.status).to.eql(201)\n            assetToDelete = res.body.assetId\n        })\n        it('Import one or more Reviews from a JSON body Copy', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${collectionToDelete}/reviews/${assetToDelete}`, 'POST', user.token, [\n                {\n                \"ruleId\": reference.ruleId,\n                \"result\": \"pass\",\n                \"detail\": \"test\\nvisible to lvl1\",\n                \"comment\": \"sure\",\n                \"autoResult\": false,\n                \"status\": \"submitted\"\n                }\n            ])\n            expect(res.status).to.eql(200)\n            const expectedResponse = {\n                rejected: [],\n                affected: {\n                    updated: 0,\n                    inserted: 1\n                }\n            }\n            \n            expect(res.body).to.eql(expectedResponse)\n        })\n        it(`Delete a Collection should now be deleted`, async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${collectionToDelete}?elevate=true`, 'DELETE', user.token)\n            expect(res.status).to.eql(200)\n            deletedCollection = res.body.collectionId\n        })\n        it('put review of an asset in a deleted collection should fail', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${collectionToDelete}/reviews/${assetToDelete}/${reference.ruleId}?projection=rule&projection=stigs`, 'PUT', user.token, {\n                \"result\": \"pass\",\n                \"detail\": \"test\\nvisible to lvl1\",\n                \"comment\": \"sure\",\n                \"autoResult\": false,\n                \"status\": \"submitted\"\n            })\n            expect(res.status).to.eql(403)\n        })\n        it('Return the STIGs - from deleted collection should fail', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${collectionToDelete}/stigs`, 'GET', user.token)\n            expect(res.status).to.eql(403)\n        })\n        it('import reviews for asset in deleted collection should fail', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${collectionToDelete}/reviews/${assetToDelete}`, 'POST', user.token, [\n                {\n                \"ruleId\": reference.ruleId,\n                \"result\": \"pass\",\n                \"detail\": \"test\\nvisible to lvl1\",\n                \"comment\": \"sure\",\n                \"autoResult\": false,\n                \"status\": \"submitted\"\n                }\n            ])\n            expect(res.status).to.eql(403)\n        })\n        it('Delete an asset in a deleted collection should fail', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/assets/${assetToDelete}`, 'DELETE', user.token)\n            expect(res.status).to.eql(403)\n        }) \n        it('Import reviews for deleted asset should fail', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${collectionToDelete}/reviews/${reference.testAsset.assetId}`, 'POST', user.token, [\n                {\n                \"ruleId\": reference.ruleId,\n                \"result\": \"pass\",\n                \"detail\": \"test\\nvisible to lvl1\",\n                \"comment\": \"sure\",\n                \"autoResult\": false,\n                \"status\": \"submitted\"\n                }\n            ])\n            expect(res.status).to.eql(403)\n        })\n        it('Return a deleted Collection no data returned 204', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${collectionToDelete}?elevate=true&projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs&projection=labels`, 'GET', user.token)\n            expect(res.status).to.eql(404)\n        })\n        it('Create an Asset in deleted collection should fail', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/assets?projection=stigs`, 'POST', user.token, {\n                \"name\": \"TEST_\"+ utils.getUUIDSubString(10),\n                \"collectionId\": deletedCollection,\n                \"description\": \"test desc\",\n                \"ip\": \"1.1.1.1\",\n                \"labelNames\": [reference.testCollection.fullLabelName],\n                \"noncomputing\": true,\n                \"metadata\": {\n                    \"pocName\": \"poc2Put\",\n                    \"pocEmail\": \"pocEmailPut@email.com\",\n                    \"pocPhone\": \"12342\",\n                    \"reqRar\": \"true\"\n                },\n                \"stigs\": [\n                    \"VPN_SRG_TEST\",\n                    \"Windows_10_STIG_TEST\"\n                ]\n            })\n            expect(res.status).to.eql(403)\n        })\n        it('should delete the test asset', async () => {\n\n            const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}`, 'DELETE', user.token)\n            expect(res.status).to.eql(200)\n        })\n        it('get asset, it should return 403 because asset is deleted', async () => {\n            \n            const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}`, 'GET', user.token)\n            expect(res.status).to.eql(403)\n        })\n    })\n})\n\n"
  },
  {
    "path": "test/api/mocha/integration/expectations.js",
    "content": "// only used in revision pinning \nexport const expectations = {\n  stigmanadmin: {\n    user: 'admin',\n    userId: '1',\n    grant: 'admin',\n    validStigs: ['VPN_SRG_TEST', 'Windows_10_STIG_TEST'],\n    pinnedRevStr: 'V1R0',\n    canElevate: true,\n    pinnedState: true,\n    canCreateCollection: true,\n    canDeleteCollection: true,\n    canModifyCollection: true\n  },\n  lvl1: {\n    user: 'lvl1',\n    userId: '85',\n    grant: 'restricted',\n    validStigs: ['VPN_SRG_TEST','Windows_10_STIG_TEST'],\n    pinnedRevStr: 'V1R1',\n    canElevate: false,\n    pinnedState: false,\n    canCreateCollection: false,\n    canDeleteCollection: false,\n    canModifyCollection: false\n  },\n  lvl2: {\n    user: 'lvl2',\n    userId: '21',\n    grant: 'lvl2',\n    validStigs: ['VPN_SRG_TEST', 'Windows_10_STIG_TEST'],\n    pinnedRevStr: 'V1R1',\n    canElevate: false,\n    pinnedState: false,\n    canCreateCollection: false,\n    canDeleteCollection: false,\n    canModifyCollection: false\n  },\n  lvl3: {\n    user: 'lvl3',\n    userId: '44',\n    grant: 'lvl3',\n    validStigs: ['VPN_SRG_TEST', 'Windows_10_STIG_TEST'],\n    pinnedRevStr: 'V1R0',\n    canElevate: false,\n    pinnedState: true,\n    canCreateCollection: false,\n    canDeleteCollection: false,\n    canModifyCollection: true\n  },\n  lvl4: {\n    user: 'lvl4',\n    userId: '45',\n    grant: 'lvl4',\n    validStigs: ['VPN_SRG_TEST', 'Windows_10_STIG_TEST'],\n    pinnedRevStr: 'V1R0',\n    pinnedState: true,\n    canCreateCollection: false,\n    canDeleteCollection: true,\n    canModifyCollection: true\n  },\n  collectioncreator: {\n    user: 'collectioncreator',\n    userId: '82',\n    grant: 'none',\n    validStigs: [],\n    canCreateCollection: true,\n    canDeleteCollection: false,\n    canModifyCollection: false\n  }\n}\n"
  },
  {
    "path": "test/api/mocha/integration/grantChange.test.js",
    "content": "\nimport {config } from '../testConfig.js'\nimport * as utils from '../utils/testUtils.js'\nimport reference from '../referenceData.js'\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\n\nconst admin = {\n  name: \"admin\",\n  grant: \"Owner\",\n  token:\n    \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ2ODEwMzUsImlhdCI6MTY3MDU0MDIzNiwiYXV0aF90aW1lIjoxNjcwNTQwMjM1LCJqdGkiOiI0N2Y5YWE3ZC1iYWM0LTQwOTgtOWJlOC1hY2U3NTUxM2FhN2YiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJiN2M3OGE2Mi1iODRmLTQ1NzgtYTk4My0yZWJjNjZmZDllZmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjMzNzhkYWZmLTA0MDQtNDNiMy1iNGFiLWVlMzFmZjczNDBhYyIsInNlc3Npb25fc3RhdGUiOiI4NzM2NWIzMy0yYzc2LTRiM2MtODQ4NS1mYmE1ZGJmZjRiOWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIiwiYWRtaW4iXX0sInJlc291cmNlX2FjY2VzcyI6eyJyZWFsbS1tYW5hZ2VtZW50Ijp7InJvbGVzIjpbInZpZXctdXNlcnMiLCJxdWVyeS1ncm91cHMiLCJxdWVyeS11c2VycyJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIHN0aWctbWFuYWdlcjpvcCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIHN0aWctbWFuYWdlcjpvcDpyZWFkIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlciBzdGlnLW1hbmFnZXI6c3RpZyIsInNpZCI6Ijg3MzY1YjMzLTJjNzYtNGIzYy04NDg1LWZiYTVkYmZmNGI5ZiIsIm5hbWUiOiJTVElHTUFOIEFkbWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RpZ21hbmFkbWluIiwiZ2l2ZW5fbmFtZSI6IlNUSUdNQU4iLCJmYW1pbHlfbmFtZSI6IkFkbWluIn0.a1XwJZw_FIzwMXKo-Dr-n11me5ut-SF9ni7ylX-7t7AVrH1eAqyBxX9DXaxFK0xs6YOhoPsh9NyW8UFVaYgtF68Ps6yzoiqFEeiRXkpN5ygICN3H3z6r-YwanLlEeaYR3P2EtHRcrBtCnt0VEKKbGPWOfeiNCVe3etlp9-NQo44\",\n}\n\ndescribe(`putGrantByCollectionGrant - /collections/{collectionId}/grants/{grantId}`, () => {\n\n    before(async () => {\n        await utils.loadAppData()\n    })\n\n    describe(\"Testing taking agrant and changing the user the grant applies to\", () => {\n\n        it(\"should verify the test groups grant info\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}`, 'GET', admin.token)\n            expect(res.status).to.equal(200)\n            expect(res.body.roleId).to.equal(1)\n            expect(res.body.userGroup.name).to.equal(reference.testCollection.testGroup.name)\n        })\n\n        it(\"should verify the test groups acl\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}/acl`, 'GET', admin.token)\n            expect(res.status).to.equal(200)\n            expect(res.body.acl).to.deep.equalInAnyOrder(reference.testCollection.testGroup.acl)\n        })\n\n        it(\"should alter the grantId associated with the test group and put it directly to the lvl1 user\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}`, 'PUT', admin.token, {\n                userId: reference.lvl1User.userId,\n                roleId: 1\n            })\n            expect(res.status).to.equal(200)\n            expect(res.body.user.userId).to.equal(reference.lvl1User.userId)\n        })\n\n        it(\"should verify lvl1 user has a direct acl that is equivalent to the appdata base usergroup\", async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}/acl`, 'GET', admin.token)\n            expect(res.status).to.equal(200)\n            expect(res.body.acl).to.deep.equalInAnyOrder(reference.testCollection.testGroup.acl)\n        })\n    })\n\n})\n\n\n"
  },
  {
    "path": "test/api/mocha/integration/job.test.js",
    "content": "import { config } from '../testConfig.js'\nimport * as utils from '../utils/testUtils.js'\nimport { expect } from 'chai'\n\nconst user = {\n  name: \"admin\",\n  grant: \"Owner\",\n  token:\n    \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ2ODEwMzUsImlhdCI6MTY3MDU0MDIzNiwiYXV0aF90aW1lIjoxNjcwNTQwMjM1LCJqdGkiOiI0N2Y5YWE3ZC1iYWM0LTQwOTgtOWJlOC1hY2U3NTUxM2FhN2YiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJiN2M3OGE2Mi1iODRmLTQ1NzgtYTk4My0yZWJjNjZmZDllZmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjMzNzhkYWZmLTA0MDQtNDNiMy1iNGFiLWVlMzFmZjczNDBhYyIsInNlc3Npb25fc3RhdGUiOiI4NzM2NWIzMy0yYzc2LTRiM2MtODQ4NS1mYmE1ZGJmZjRiOWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIiwiYWRtaW4iXX0sInJlc291cmNlX2FjY2VzcyI6eyJyZWFsbS1tYW5hZ2VtZW50Ijp7InJvbGVzIjpbInZpZXctdXNlcnMiLCJxdWVyeS1ncm91cHMiLCJxdWVyeS11c2VycyJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIHN0aWctbWFuYWdlcjpvcCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIHN0aWctbWFuYWdlcjpvcDpyZWFkIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlciBzdGlnLW1hbmFnZXI6c3RpZyIsInNpZCI6Ijg3MzY1YjMzLTJjNzYtNGIzYy04NDg1LWZiYTVkYmZmNGI5ZiIsIm5hbWUiOiJTVElHTUFOIEFkbWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RpZ21hbmFkbWluIiwiZ2l2ZW5fbmFtZSI6IlNUSUdNQU4iLCJmYW1pbHlfbmFtZSI6IkFkbWluIn0.a1XwJZw_FIzwMXKo-Dr-n11me5ut-SF9ni7ylX-7t7AVrH1eAqyBxX9DXaxFK0xs6YOhoPsh9NyW8UFVaYgtF68Ps6yzoiqFEeiRXkpN5ygICN3H3z6r-YwanLlEeaYR3P2EtHRcrBtCnt0VEKKbGPWOfeiNCVe3etlp9-NQo44\",\n}\n\ndescribe('GET - getAllTasks - /jobs/tasks', function () {\n\n  before(async function () {\n    await utils.loadAppData()\n  })\n\n  after(async function () {\n    // Clean up any jobs created during tests\n    const res = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'GET', user.token)\n    for (let job of res.body) {\n      if (job.name.startsWith('Test Job')) {\n        await utils.executeRequest(`${config.baseUrl}/jobs/${job.jobId}?elevate=true`, 'DELETE', user.token)\n      }\n    }\n  })\n\n  it('should get all tasks', async function () {\n    const res = await utils.executeRequest(`${config.baseUrl}/jobs/tasks?elevate=true`, 'GET', user.token)\n    expect(res.status).to.eql(200)\n    expect(res.body).to.be.an('array')\n    expect(res.body.length).to.be.greaterThan(0)\n  })\n})\n\ndescribe('Job endpoint tests', function () {\n  beforeEach(async function () {\n      await utils.loadAppData()\n  })\n\n  afterEach(deleteTestJobs)\n\n  describe('GET - getJobs - /jobs', function () { \n    it('should get all jobs', async function () {\n      const res = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'GET', user.token)\n      expect(res.status).to.eql(200)\n      expect(res.body).to.be.an('array')\n      expect(res.body.length).to.be.greaterThan(0)\n    })\n  })\n\n  describe('POST - createJob - /jobs', function () {\n    it('should create a job without event', async function () {\n      const res = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job With No Event\",\n        tasks: [\"1\"],\n      })\n      expect(res.status).to.eql(201)\n      expect(res.body).to.be.an('object')\n      expect(res.body).to.have.property('jobId')\n      expect(res.body).to.have.property('name', 'Test Job With No Event')\n      expect(res.body).to.have.property('tasks').that.is.an('array').with.length(1)\n    })\n\n    it('should create a job with one-time event', async function () {\n      const res = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job with Once Event\",\n        tasks: [\"1\"],\n        event: {\n          type: \"once\",\n          starts: '2035-01-01T00:00:00Z',\n        }\n      })\n      expect(res.status).to.eql(201)\n      expect(res.body).to.be.an('object')\n      expect(res.body).to.have.property('jobId')\n      expect(res.body).to.have.property('name', 'Test Job with Once Event')\n      expect(res.body).to.have.property('tasks').that.is.an('array').with.length(1)\n      expect(res.body).to.have.property('event').that.is.an('object')\n      expect(res.body.event).to.have.property('type', 'once')\n      expect(res.body.event).to.have.property('starts')\n    })\n\n    it('should create a job with recurring event enabled', async function () {\n\n      const res = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job with Recurring Event\",\n        tasks: [\"1\"],\n        event: {\n          type: \"recurring\",\n          interval: {\n            value: \"1\",\n            field: \"day\"\n          },\n          starts: '2035-01-01T00:00:00Z',\n        }\n      })\n      expect(res.status).to.eql(201)\n      expect(res.body).to.be.an('object')\n      expect(res.body).to.have.property('jobId')\n      expect(res.body).to.have.property('name', 'Test Job with Recurring Event')\n      expect(res.body).to.have.property('tasks').that.is.an('array').with.length(1)\n      expect(res.body).to.have.property('event').that.is.an('object')\n      expect(res.body.event).to.have.property('type', 'recurring')\n      expect(res.body.event).to.have.property('interval').that.is.an('object')\n      expect(res.body.event.interval).to.have.property('value', '1')\n      expect(res.body.event.interval).to.have.property('field', 'day')\n      expect(res.body.event).to.have.property('starts')\n      expect(res.body.event).to.have.property('enabled', true)\n    })\n    it('should fail to create a job with non-existent task', async function () {\n      const res = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job with Non-Existent Task\",\n        tasks: [\"999999\"],\n      })\n      expect(res.status).to.eql(422)\n      expect(res.body).to.be.an('object')\n      expect(res.body).to.have.property('detail', 'Unknown taskId in list')\n    })\n    it('should fail to create a job with duplicate name', async function () {\n      const res1 = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job with Duplicate Name\",\n        tasks: [\"1\"],\n      })\n      expect(res1.status).to.eql(201)\n\n      const res2 = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job with Duplicate Name\",\n        tasks: [\"1\"],\n      })\n      expect(res2.status).to.eql(422)\n      expect(res2.body).to.be.an('object')\n      expect(res2.body).to.have.property('detail', 'Job name already exists')\n    })\n  })\n\n  describe('GET - getJob - /jobs/{jobId}', function () {\n    it('should get a job by ID', async function () {\n      const createJobRes = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job to Get\",\n        tasks: [\"1\"]\n      })\n      expect(createJobRes.status).to.eql(201)\n      const jobId = createJobRes.body.jobId\n\n      const getRes = await utils.executeRequest(`${config.baseUrl}/jobs/${jobId}?elevate=true`, 'GET', user.token)\n      expect(getRes.status).to.eql(200)\n      expect(getRes.body).to.be.an('object')\n      expect(getRes.body).to.have.property('jobId', jobId)\n    })\n    it('should return 404 for a non-existent job ID', async function () {\n      const getRes = await utils.executeRequest(`${config.baseUrl}/jobs/999999?elevate=true`, 'GET', user.token)\n      expect(getRes.status).to.eql(404)\n    })\n  })\n\n  describe('PATCH - patchJob - /jobs/{jobId}', function () {\n    it('should patch a job to enable/disable event', async function () {\n      const createJobRes = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job to Patch\",\n        tasks: [\"1\"],\n        event: {\n          type: \"recurring\",\n          interval: {\n            value: \"1\",\n            field: \"day\"\n          },\n          starts: '2035-01-01T00:00:00Z',\n          enabled: true\n        }\n      })\n      expect(createJobRes.status).to.eql(201)\n      const jobId = createJobRes.body.jobId\n      expect(createJobRes.body.event).to.have.property('enabled', true)\n\n      // Now patch the job to disable the event\n      const patchRes = await utils.executeRequest(`${config.baseUrl}/jobs/${jobId}?elevate=true`, 'PATCH', user.token, {\n        event: {\n          type: \"recurring\",\n          interval: {\n            value: \"1\",\n            field: \"day\"\n          },\n          starts: '2035-01-01T00:00:00Z',\n          enabled: false\n        }\n      })\n      expect(patchRes.status).to.eql(200)\n      expect(patchRes.body.event).to.have.property('enabled', false)\n    })\n    it('should patch a job to change name and tasks', async function () {\n      const createJobRes = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job to Patch\",\n        tasks: [\"1\"],\n        event: {\n          type: \"recurring\",\n          interval: {\n            value: \"1\",\n            field: \"day\"\n          },\n          starts: '2035-01-01T00:00:00Z',\n          enabled: true\n        }\n      })\n      expect(createJobRes.status).to.eql(201)\n      const jobId = createJobRes.body.jobId\n\n      const patchRes = await utils.executeRequest(`${config.baseUrl}/jobs/${jobId}?elevate=true`, 'PATCH', user.token, {\n        name: \"Test Job Updated Name\",\n        tasks: [\"2\"]\n      })\n      expect(patchRes.status).to.eql(200)\n      expect(patchRes.body).to.have.property('name', \"Test Job Updated Name\")\n      expect(patchRes.body).to.have.property('tasks').that.is.an('array').with.length(1)\n      expect(patchRes.body.tasks[0]).to.have.property('taskId', '2')\n    })\n    it('should fail to patch tasks for a system job', async function () {\n      // Attempt to patch the system job with jobId 1\n      const patchRes = await utils.executeRequest(`${config.baseUrl}/jobs/1?elevate=true`, 'PATCH', user.token, {\n        tasks: [\"2\"]\n      })\n      expect(patchRes.status).to.eql(422)\n    })\n    it('should fail to patch name for a system job', async function () {\n      // Attempt to patch the system job with jobId 1\n      const patchRes = await utils.executeRequest(`${config.baseUrl}/jobs/1?elevate=true`, 'PATCH', user.token, {\n        name: \"Test Job Updated System Job Name\"\n      })\n      expect(patchRes.status).to.eql(422)\n    })\n    it('should fail to patch description for a system job', async function () {\n      // Attempt to patch the system job with jobId 1\n      const patchRes = await utils.executeRequest(`${config.baseUrl}/jobs/1?elevate=true`, 'PATCH', user.token, {\n        description: \"Updated System Job Description\"\n      })\n      expect(patchRes.status).to.eql(422)\n    })\n    it('should succeed to patch event for a system job', async function () {\n      // Attempt to patch the system job with jobId 2\n      const patchRes = await utils.executeRequest(`${config.baseUrl}/jobs/2?elevate=true`, 'PATCH', user.token, {\n        event: null\n      })\n      expect(patchRes.status).to.eql(200)\n      expect(patchRes.body.event).to.be.null\n    })\n    it('should fail to patch a non-existent job', async function () {\n      const patchRes = await utils.executeRequest(`${config.baseUrl}/jobs/999999?elevate=true`, 'PATCH', user.token, {\n        name: \"Test Job Updated Non-Existent Job Name\"\n      })\n      expect(patchRes.status).to.eql(404)\n    })\n    it('should fail to patch a job to a duplicate name', async function () {\n      let createJobRes = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job for Name Collision\",\n        tasks: [\"1\"],\n        event: {\n          type: \"recurring\",\n          interval: {\n            value: \"1\",\n            field: \"day\"\n          },\n          starts: '2035-01-01T00:00:00Z',\n          enabled: true\n        }\n      })\n      expect(createJobRes.status).to.eql(201)\n\n      createJobRes = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job to Patch\",\n        tasks: [\"1\"],\n        event: {\n          type: \"recurring\",\n          interval: {\n            value: \"1\",\n            field: \"day\"\n          },\n          starts: '2035-01-01T00:00:00Z',\n          enabled: true\n        }\n      })\n      expect(createJobRes.status).to.eql(201)\n      const jobId = createJobRes.body.jobId\n\n      const patchRes = await utils.executeRequest(`${config.baseUrl}/jobs/${jobId}?elevate=true`, 'PATCH', user.token, {\n        name: \"Test Job for Name Collision\",\n        tasks: [\"2\"]\n      })\n      expect(patchRes.status).to.eql(422)\n      expect(patchRes.body).to.be.an('object')\n      expect(patchRes.body).to.have.property('detail', 'Job name already exists')\n    })\n    it('should fail to patch a job with non-existent task', async function () {\n      const createJobRes = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job to Patch Non-Existent Task\",\n        tasks: [\"1\"],\n        event: {\n          type: \"recurring\",\n          interval: {\n            value: \"1\",\n            field: \"day\"\n          },\n          starts: '2035-01-01T00:00:00Z',\n          enabled: true\n        }\n      })\n      expect(createJobRes.status).to.eql(201)\n      const jobId = createJobRes.body.jobId\n\n      const patchRes = await utils.executeRequest(`${config.baseUrl}/jobs/${jobId}?elevate=true`, 'PATCH', user.token, {\n        tasks: [\"999999\"]\n      })\n      expect(patchRes.status).to.eql(422)\n      expect(patchRes.body).to.be.an('object')\n      expect(patchRes.body).to.have.property('detail', 'Unknown taskId in list')\n    })\n  })\n\n  describe('DELETE - deleteJob - /jobs/{jobId}', function () {\n    it('should delete a job', async function () {\n      const createJobRes = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job to Delete\",\n        tasks: [\"1\"],\n      })\n      expect(createJobRes.status).to.eql(201)\n      const jobId = createJobRes.body.jobId\n\n      const deleteRes = await utils.executeRequest(`${config.baseUrl}/jobs/${jobId}?elevate=true`, 'DELETE', user.token)\n      expect(deleteRes.status).to.eql(204)\n\n      // Verify job is deleted\n      const getRes = await utils.executeRequest(`${config.baseUrl}/jobs/${jobId}?elevate=true`, 'GET', user.token)\n      expect(getRes.status).to.eql(404)\n    })\n    it('should fail to delete a system job', async function () {\n      // Attempt to delete the system job with jobId 1\n      const deleteRes = await utils.executeRequest(`${config.baseUrl}/jobs/1?elevate=true`, 'DELETE', user.token)\n      expect(deleteRes.status).to.eql(422)\n    })\n    it('should fail to delete a non-existent job', async function () {\n      const deleteRes = await utils.executeRequest(`${config.baseUrl}/jobs/999999?elevate=true`, 'DELETE', user.token)\n      expect(deleteRes.status).to.eql(404)\n    })\n  })\n\n  describe('POST - runJob - /jobs/{jobId}/run', function () {\n    it('should run a job immediately', async function () {\n      const createJobRes = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job to Run\",\n        tasks: [\"1\"],\n      })\n      expect(createJobRes.status).to.eql(201)\n      const jobId = createJobRes.body.jobId\n\n      const runRes = await utils.executeRequest(`${config.baseUrl}/jobs/${jobId}/runs?elevate=true`, 'POST', user.token)\n      expect(runRes.status).to.eql(200)\n      expect(runRes.body).to.have.property('runId')\n    })\n    it('should fail to run a non-existent job', async function () {\n      const runRes = await utils.executeRequest(`${config.baseUrl}/jobs/999999/runs?elevate=true`, 'POST', user.token)\n      expect(runRes.status).to.eql(404)\n    })\n  })\n\n  describe('GET - getRunsByJob - /jobs/{jobId}/runs', function () {\n    it('should get runs for a job', async function () {\n      this.timeout(120_000) // increase timeout for this test\n      const createJobRes = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job to Get Runs\",\n        tasks: [\"1\"],\n      })\n      expect(createJobRes.status).to.eql(201)\n      const jobId = createJobRes.body.jobId\n\n      // Run the job twice\n      await runImmediateJob(jobId)\n      await new Promise(resolve => setTimeout(resolve, 1000)) // wait 1 second between runs to ensure different timestamps\n      await runImmediateJob(jobId)\n\n      const runsRes = await utils.executeRequest(`${config.baseUrl}/jobs/${jobId}/runs?elevate=true`, 'GET', user.token)\n      expect(runsRes.status).to.eql(200)\n      expect(runsRes.body).to.be.an('array')\n      expect(runsRes.body.length).to.be.at.least(2)\n      for (let run of runsRes.body) {\n        expect(run).to.have.property('runId')\n        expect(run).to.have.property('state')\n        expect(run).to.have.property('created')\n        expect(run).to.have.property('jobId', jobId)\n      }\n    })\n    it('should return 404 for runs of a non-existent job', async function () {\n      const runsRes = await utils.executeRequest(`${config.baseUrl}/jobs/999999/runs?elevate=true`, 'GET', user.token)\n      expect(runsRes.status).to.eql(404)\n    })\n  })\n\n  describe('GET - getRunById - /jobs/runs/{runId}', function () {\n    it('should get a specific run by ID', async function () {\n      const createJobRes = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job to Get Specific Run\",\n        tasks: [\"1\"],\n      })\n      expect(createJobRes.status).to.eql(201)\n      const jobId = createJobRes.body.jobId\n\n      const runId = await runImmediateJob(jobId)\n\n      const runRes = await utils.executeRequest(`${config.baseUrl}/jobs/runs/${runId}?elevate=true`, 'GET', user.token)\n      expect(runRes.status).to.eql(200)\n      expect(runRes.body).to.be.an('object')\n      expect(runRes.body).to.have.property('runId', runId)\n      expect(runRes.body).to.have.property('state')\n      expect(runRes.body).to.have.property('created')\n      expect(runRes.body).to.have.property('jobId', jobId)\n    })\n    it('should return 404 for a non-existent run ID', async function () {\n      const runRes = await utils.executeRequest(`${config.baseUrl}/jobs/runs/00000000-0000-0000-0000-000000000000?elevate=true`, 'GET', user.token)\n      expect(runRes.status).to.eql(404)\n    })\n  })\n\n  describe('DELETE - deleteRunById - /jobs/runs/{runId}', function () {\n    it('should delete a specific run by ID', async function () {\n      const createJobRes = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n        name: \"Test Job to Delete Specific Run\",\n        tasks: [\"1\"],\n      })\n      expect(createJobRes.status).to.eql(201)\n      const jobId = createJobRes.body.jobId\n\n      const runId = await runImmediateJob(jobId)\n      await new Promise(resolve => setTimeout(resolve, 1000)) // wait a second to ensure run is created before attempting delete\n\n      // Now delete the run\n      const deleteRes = await utils.executeRequest(`${config.baseUrl}/jobs/runs/${runId}?elevate=true`, 'DELETE', user.token)\n      expect(deleteRes.status).to.eql(204)\n\n      // Verify run is deleted\n      const getRes = await utils.executeRequest(`${config.baseUrl}/jobs/runs/${runId}?elevate=true`, 'GET', user.token)\n      expect(getRes.status).to.eql(404)\n    })\n    it('should return 404 when deleting a non-existent run ID', async function () {\n      const deleteRes = await utils.executeRequest(`${config.baseUrl}/jobs/runs/00000000-0000-0000-0000-000000000000?elevate=true`, 'DELETE', user.token)\n      expect(deleteRes.status).to.eql(404)\n    })\n  })\n\n}) \n\ndescribe('Task tests', function () {\n  beforeEach(async function () {\n      await utils.loadAppData()\n  })\n  afterEach(deleteTestJobs)\n  describe('Task - WipeDeletedObjects', function () {\n\n    before(async function () {\n      await utils.loadAppData()\n    })\n\n    after(deleteTestJobs)\n\n    it('should wipe deleted objects', async function () {\n      const deleteRes = await utils.executeRequest(`${config.baseUrl}/assets/62`, 'DELETE', user.token)\n      expect(deleteRes.status).to.eql(200)\n      const appInfoRes = await utils.executeRequest(`${config.baseUrl}/op/appinfo?elevate=true`, 'GET', user.token)\n      expect(appInfoRes.status).to.eql(200)\n      expect(appInfoRes.body).to.have.nested.property('collections.21.assetsDisabled', 2)\n      expect(appInfoRes.body).to.have.nested.property('collections.21.reviewsDisabled', 4)\n      expect(appInfoRes.body).to.have.nested.property('collections.93.state', 'disabled')\n\n      const runId = await runImmediateTask(\"WipeDeletedObjects\")\n      const state = await waitForRunFinish(runId, 30)\n      expect(state).to.eql('completed')\n\n      const finalAppInfoRes = await utils.executeRequest(`${config.baseUrl}/op/appinfo?elevate=true`, 'GET', user.token)\n      expect(finalAppInfoRes.status).to.eql(200)\n      expect(finalAppInfoRes.body).to.have.nested.property('collections.21.assetsDisabled', 0)\n      expect(finalAppInfoRes.body).to.have.nested.property('collections.21.reviewsDisabled', 0)\n      expect(finalAppInfoRes.body).to.not.have.nested.property('collections.93')\n    })\n\n  })\n\n  describe('Task - DeleteUnmappedReviews', function () {\n\n    before(async function () {\n      await utils.loadAppData()\n    })\n\n    after(deleteTestJobs)\n\n    it('should delete unmapped reviews in system context', async function () {\n      const removeRes = await utils.executeRequest(`${config.baseUrl}/stigs/VPN_SRG_TEST?elevate=true&force=true`, 'DELETE', user.token)\n      expect(removeRes.status).to.eql(200)\n      const reviewsRes = await utils.executeRequest(`${config.baseUrl}/collections/21/reviews?rules=not-default-mapped`, 'GET', user.token)\n      expect(reviewsRes.status).to.eql(200)\n      expect(reviewsRes.body).to.be.an('array')\n      expect(reviewsRes.body.length).to.eql(14)\n\n      const runId = await runImmediateTask(\"DeleteUnmappedReviews\")\n      const state = await waitForRunFinish(runId, 30)\n      expect(state).to.eql('completed')\n\n      const finalReviewsRes = await utils.executeRequest(`${config.baseUrl}/collections/21/reviews?rules=not-default-mapped`, 'GET', user.token)\n      expect(finalReviewsRes.status).to.eql(200)\n      expect(finalReviewsRes.body).to.be.an('array')\n      expect(finalReviewsRes.body.length).to.eql(0)\n    })\n  })\n\n  describe('Task - DeleteUnmappedAssetReviews', function () {\n\n    before(async function () {\n      await utils.loadAppData()\n    })\n\n    after(deleteTestJobs)\n\n    it('should delete unmapped reviews in asset context', async function () {\n      const removeRes = await utils.executeRequest(`${config.baseUrl}/assets/62`, 'PATCH', user.token, {\n        stigs: []\n      })\n      expect(removeRes.status).to.eql(200)\n      const reviewsRes = await utils.executeRequest(`${config.baseUrl}/collections/21/reviews/62?rules=not-mapped`, 'GET', user.token)\n      expect(reviewsRes.status).to.eql(200)\n      expect(reviewsRes.body).to.be.an('array')\n      expect(reviewsRes.body.length).to.eql(3)\n\n      const runId = await runImmediateTask(\"DeleteUnmappedAssetReviews\")\n      const state = await waitForRunFinish(runId, 30)\n      expect(state).to.eql('completed')\n\n      const finalReviewsRes = await utils.executeRequest(`${config.baseUrl}/collections/21/reviews/62?rules=not-mapped`, 'GET', user.token)\n      expect(finalReviewsRes.status).to.eql(200)\n      expect(finalReviewsRes.body).to.be.an('array')\n      expect(finalReviewsRes.body.length).to.eql(0)\n    })\n  })\n})\n\nasync function runImmediateJob(jobId) {\n  const runRes = await utils.executeRequest(`${config.baseUrl}/jobs/${jobId}/runs?elevate=true`, 'POST', user.token)\n  expect(runRes.status).to.eql(200)\n  expect(runRes.body).to.have.property('runId')\n  return runRes.body.runId\n}\n\nasync function runImmediateTask(taskname) {\n  const taskRes = await utils.executeRequest(`${config.baseUrl}/jobs/tasks?elevate=true`, 'GET', user.token)\n  const task = taskRes.body.find(t => t.name === taskname)\n  expect(task).to.exist\n  const taskId = task.taskId\n  const createJobRes = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'POST', user.token, {\n    name: \"Test Job to Run \" + taskname,\n    tasks: [taskId]\n  })\n  const jobId = createJobRes.body.jobId\n\n  const runRes = await utils.executeRequest(`${config.baseUrl}/jobs/${jobId}/runs?elevate=true`, 'POST', user.token)\n  expect(runRes.status).to.eql(200)\n  expect(runRes.body).to.have.property('runId')\n  return runRes.body.runId\n}\n\nasync function deleteTestJobs() {\n  const res = await utils.executeRequest(`${config.baseUrl}/jobs?elevate=true`, 'GET', user.token)\n  for (let job of res.body) {\n    if (job.name.startsWith('Test Job')) {\n      await utils.executeRequest(`${config.baseUrl}/jobs/${job.jobId}?elevate=true`, 'DELETE', user.token)\n    }\n  }\n}\n\nasync function waitForRunFinish(runId, timeoutSeconds = 30) {\n  let attempts = 0\n  await new Promise(resolve => setTimeout(resolve, 1000)) // wait 1 second before checking again\n  while (attempts < timeoutSeconds) {\n    const runRes = await utils.executeRequest(`${config.baseUrl}/jobs/runs/${runId}?elevate=true`, 'GET', user.token)\n    expect(runRes.status).to.eql(200)\n    if (['completed', 'failed'].includes(runRes.body.state)) {\n      return runRes.body.state\n    }\n    await new Promise(resolve => setTimeout(resolve, 1000)) // wait 1 second before checking again\n    attempts++\n  }\n  return 'timeout'\n}"
  },
  {
    "path": "test/api/mocha/integration/logStream.test.js",
    "content": "\nimport MockOidc from '../../../utils/mockOidc.js'\nimport WebSocket from 'ws';\nimport { expect } from 'chai'\n\nconst oidc = new MockOidc({ keyCount: 0, includeInsecureKid: true })\n\ndescribe('LogStream authorization', async function () {\n  this.timeout(5000)\n\n  it('should ask for a token on socket connection', async function () {\n    const socket = await openSocket()\n    await new Promise(r => setTimeout(r, 500)); // wait for socket to be ready\n    expect(socket.messages).to.have.lengthOf(1);\n    expect(socket.messages[0]).to.have.property('type', 'authorize');\n    socket.ws.close();\n  });\n\n  it('should close connection after timeout if no token is provided', async function () {\n    this.timeout(40000);\n    const socket = await openSocket()\n    await new Promise(r => setTimeout(r, 15000)); // wait for timeout (10s + buffer)\n    expect(socket.messages).to.have.lengthOf(2);\n    expect(socket.messages[0]).to.have.property('type', 'authorize');\n    expect(socket.messages[1]).to.have.property('type', 'close');\n    expect(socket.ws.readyState).to.equal(WebSocket.CLOSED);\n  });\n\n  it('should accept a valid token', async function () {\n    const socket = await openSocket();\n    await new Promise(r => setTimeout(r, 500)); // wait for socket to be ready\n    expect(socket.messages).to.have.lengthOf(1);\n    expect(socket.messages[0]).to.have.property('type', 'authorize');\n\n    const token = oidc.getToken({ sub: 'test-user', privileges: ['admin'] })\n    socket.ws.send(JSON.stringify({ type: 'authorize', data: { token } }));\n    await new Promise(r => setTimeout(r, 500));\n    expect(socket.messages).to.have.lengthOf(2);\n    expect(socket.messages[1]).to.have.property('type', 'authorize');\n    expect(socket.messages[1].data).to.have.property('state', 'authorized');\n    socket.ws.close();\n  });\n\n  it('should reject an expired token', async function () {\n    this.timeout(60000);\n    const socket = await openSocket()\n    await new Promise(r => setTimeout(r, 500)); // wait for socket to be ready\n    expect(socket.messages).to.have.lengthOf(1);\n    expect(socket.messages[0]).to.have.property('type', 'authorize');\n\n    const token = oidc.getToken({ sub: 'test-user', privileges: ['admin'], expiresIn: -10 })\n    socket.ws.send(JSON.stringify({ type: 'authorize', data: { token } }));\n    await new Promise(r => setTimeout(r, 500));\n    expect(socket.messages).to.have.lengthOf(2);\n    expect(socket.messages[1]).to.have.property('type', 'authorize');\n    expect(socket.messages[1].data).to.have.property('state', 'unauthorized');\n    expect(socket.messages[1].data).to.have.property('reason').that.includes('jwt expired');\n    socket.ws.close();\n  });\n\n  it('should reject a token without admin role', async function () {\n    const socket = await openSocket()\n    await new Promise(r => setTimeout(r, 500)); // wait for socket to be ready\n    expect(socket.messages).to.have.lengthOf(1);\n    expect(socket.messages[0]).to.have.property('type', 'authorize');\n\n    const token = oidc.getToken({ sub: 'test-user', privileges: [] })\n    socket.ws.send(JSON.stringify({ type: 'authorize', data: { token } }));\n    await new Promise(r => setTimeout(r, 500));\n    expect(socket.messages).to.have.lengthOf(2);\n    expect(socket.messages[1]).to.have.property('type', 'authorize');\n    expect(socket.messages[1].data).to.have.property('state', 'unauthorized');\n    expect(socket.messages[1].data).to.have.property('reason').that.includes('Authorization failed');\n    socket.ws.close();\n  });\n\n  it('should reject a malformed token', async function () {\n    const socket = await openSocket()\n    await new Promise(r => setTimeout(r, 500)); // wait for socket to be ready\n    expect(socket.messages).to.have.lengthOf(1);\n    expect(socket.messages[0]).to.have.property('type', 'authorize');\n\n    const token = 'malformed.token.value'\n    socket.ws.send(JSON.stringify({ type: 'authorize', data: { token } }));\n    await new Promise(r => setTimeout(r, 500));\n    expect(socket.messages).to.have.lengthOf(2);\n    expect(socket.messages[1]).to.have.property('type', 'authorize');\n    expect(socket.messages[1].data).to.have.property('state', 'unauthorized');\n    expect(socket.messages[1].data).to.have.property('reason').that.includes('Authorization failed');\n    socket.ws.close();\n  });\n  \n  it('should reject an empty token', async function () {\n    const socket = await openSocket()\n    await new Promise(r => setTimeout(r, 500)); // wait for socket to be ready\n    expect(socket.messages).to.have.lengthOf(1);\n    expect(socket.messages[0]).to.have.property('type', 'authorize');\n    socket.ws.send(JSON.stringify({ type: 'authorize', data: { token: '' } }));\n    await new Promise(r => setTimeout(r, 500));\n    expect(socket.messages).to.have.lengthOf(2);\n    expect(socket.messages[1]).to.have.property('type', 'authorize');\n    expect(socket.messages[1].data).to.have.property('state', 'unauthorized');\n    expect(socket.messages[1].data).to.have.property('reason').that.includes('Authorization failed');\n    socket.ws.close();\n  });\n\n  it('should reject an invalid message without token', async function () {\n    const socket = await openSocket()\n    await new Promise(r => setTimeout(r, 500)); // wait for socket to be ready\n    expect(socket.messages).to.have.lengthOf(1);\n    expect(socket.messages[0]).to.have.property('type', 'authorize');\n    socket.ws.send(JSON.stringify({ type: 'authorize', data: { } }));\n    await new Promise(r => setTimeout(r, 500));\n    expect(socket.messages).to.have.lengthOf(2);\n    expect(socket.messages[1]).to.have.property('type', 'error');\n    expect(socket.messages[1].data).to.match(/^Message validation failed/);\n    socket.ws.close();\n  });\n\n  it('should error when token expires', async function () {\n    const socket = await openSocket()\n    await new Promise(r => setTimeout(r, 500)); // wait for socket to be ready\n    expect(socket.messages).to.have.lengthOf(1);\n    expect(socket.messages[0]).to.have.property('type', 'authorize');\n\n    const token = oidc.getToken({ sub: 'test-user', privileges: ['admin'], expiresIn: 1 })\n    socket.ws.send(JSON.stringify({ type: 'authorize', data: { token } }));\n    await new Promise(r => setTimeout(r, 500));\n    expect(socket.messages).to.have.lengthOf(2);\n    expect(socket.messages[1]).to.have.property('type', 'authorize');\n    expect(socket.messages[1].data).to.have.property('state', 'authorized');\n\n    await new Promise(r => setTimeout(r, 2000)); // wait for token to expire\n    expect(socket.messages).to.have.lengthOf(3);\n    expect(socket.messages[2]).to.have.property('type', 'authorize');\n    expect(socket.messages[2].data).to.have.property('state', 'unauthorized');\n    expect(socket.messages[2].data).to.have.property('reason', 'jwt expired');\n    socket.ws.close();\n  });\n  \n  it('should stream log messages until token expires', async function () {\n    this.timeout(10000);\n    const socket = await openSocket();\n    await new Promise(r => setTimeout(r, 500));\n    expect(socket.messages).to.have.lengthOf(1);\n    expect(socket.messages[0]).to.have.property('type', 'authorize');\n\n    // Short-lived token (2s)\n    const token = oidc.getToken({ sub: 'test-user', privileges: ['admin'], expiresIn: 5 });\n    socket.ws.send(JSON.stringify({ type: 'authorize', data: { token } }));\n    await new Promise(r => setTimeout(r, 300));\n    expect(socket.messages).to.have.lengthOf(2);\n    expect(socket.messages[1]).to.have.property('type', 'authorize');\n    expect(socket.messages[1].data).to.have.property('state', 'authorized');\n\n    // Start log stream\n    socket.ws.send(JSON.stringify({ type: 'command', data: { command: 'stream-start' } }));\n    await new Promise(r => setTimeout(r, 200));\n\n    // Wait for log message to be received\n    let logReceived = false;\n    for (let i = 0; i < 10; i++) {\n      if (socket.messages.some(m => m.type === 'log')) {\n        logReceived = true;\n        break;\n      }\n      await new Promise(r => setTimeout(r, 100));\n    }\n    expect(logReceived, 'Log message should be received').to.be.true;\n\n    // Wait for token to expire and unauthorized message\n    let unauthorizedReceived = false;\n    for (let i = 0; i < 20; i++) {\n      if (socket.messages.some(m => m.type === 'authorize' && m.data && m.data.state === 'unauthorized')) {\n        unauthorizedReceived = true;\n        break;\n      }\n      await new Promise(r => setTimeout(r, 200));\n    }\n    expect(unauthorizedReceived, 'Should receive unauthorized after token expires').to.be.true;\n\n    // After unauthorized, further logs should not be received\n    // const logCountBefore = socket.messages.filter(m => m.type === 'log').length;\n    // await utils.executeRequest(`${config.baseUrl}/op/configuration`, 'GET', token);\n    // await new Promise(r => setTimeout(r, 500));\n    // const logCountAfter = socket.messages.filter(m => m.type === 'log').length;\n    // expect(logCountAfter).to.equal(logCountBefore);\n\n    socket.ws.close();\n  });\n});\n\n\nasync function openSocket() {\n  return new Promise((resolve, reject) => {\n    const ws = new WebSocket('ws://localhost:64001/socket/log-socket')\n    const resolution = {\n      ws,\n      messages: [],\n    }\n    ws.on('message', function incoming(data) {\n      const msg = JSON.parse(data)\n      resolution.messages.push(msg)\n    });\n    ws.on('error', function error(err) {\n      reject(err instanceof Error ? err : new Error(err))\n    });\n    ws.on('open', function open() {\n      resolve(resolution)\n    });\n  })\n}\n\n"
  },
  {
    "path": "test/api/mocha/integration/metrics.test.js",
    "content": "\nimport {config } from '../testConfig.js'\nimport * as utils from '../utils/testUtils.js'\nimport reference from '../referenceData.js'\nimport path from 'path'\nimport fs from 'fs'\nimport  { fileURLToPath } from 'url'\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\n\nconst user = {\n  name: 'stigmanadmin',\n  grant: 'Owner',\n  userId: '1',\n  token:\n    'eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ2ODEwMzUsImlhdCI6MTY3MDU0MDIzNiwiYXV0aF90aW1lIjoxNjcwNTQwMjM1LCJqdGkiOiI0N2Y5YWE3ZC1iYWM0LTQwOTgtOWJlOC1hY2U3NTUxM2FhN2YiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJiN2M3OGE2Mi1iODRmLTQ1NzgtYTk4My0yZWJjNjZmZDllZmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjMzNzhkYWZmLTA0MDQtNDNiMy1iNGFiLWVlMzFmZjczNDBhYyIsInNlc3Npb25fc3RhdGUiOiI4NzM2NWIzMy0yYzc2LTRiM2MtODQ4NS1mYmE1ZGJmZjRiOWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIiwiYWRtaW4iXX0sInJlc291cmNlX2FjY2VzcyI6eyJyZWFsbS1tYW5hZ2VtZW50Ijp7InJvbGVzIjpbInZpZXctdXNlcnMiLCJxdWVyeS1ncm91cHMiLCJxdWVyeS11c2VycyJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIHN0aWctbWFuYWdlcjpvcCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIHN0aWctbWFuYWdlcjpvcDpyZWFkIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlciBzdGlnLW1hbmFnZXI6c3RpZyIsInNpZCI6Ijg3MzY1YjMzLTJjNzYtNGIzYy04NDg1LWZiYTVkYmZmNGI5ZiIsIm5hbWUiOiJTVElHTUFOIEFkbWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RpZ21hbmFkbWluIiwiZ2l2ZW5fbmFtZSI6IlNUSUdNQU4iLCJmYW1pbHlfbmFtZSI6IkFkbWluIn0.a1XwJZw_FIzwMXKo-Dr-n11me5ut-SF9ni7ylX-7t7AVrH1eAqyBxX9DXaxFK0xs6YOhoPsh9NyW8UFVaYgtF68Ps6yzoiqFEeiRXkpN5ygICN3H3z6r-YwanLlEeaYR3P2EtHRcrBtCnt0VEKKbGPWOfeiNCVe3etlp9-NQo44'\n}\n\ndescribe('GET - getMetricsDetailByCollection - /collections/{collectionId}/metrics/detail', () => {\n  describe('transfer metrics recalculation', () => {\n    before(async function () {\n      await utils.loadAppData()\n      await utils.uploadTestStig(reference.testStigfileNonLatest)\n    })\n    it('Set the Assets mapped to a STIG - default rev only - scrap collection for transfer test', async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/stigs/${reference.benchmark}`, 'POST', user.token, {\n            \"defaultRevisionStr\": \"V1R0\"\n        })\n        expect(res.status).to.eql(200)\n        const expectedResponse = {\n            benchmarkId: reference.benchmark,\n            title: \"Virtual Private Network (VPN) Security Requirements Guide\",\n            revisionStr: \"V1R0\",\n            benchmarkDate: \"2010-07-19\",\n            revisionPinned: true,\n            ruleCount: 81,\n            assetCount: 3,\n        }    \n        expect(res.body).to.deep.equal(expectedResponse)\n    })\n    it('Set all properties of an Asset - Change Collection to scrap collection - then check for recalculated metrics', async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}`, 'PUT', user.token, {\n            \"name\": \"Collection_X_lvl1_asset-1\",\n            \"collectionId\": reference.scrapCollection.collectionId,\n            \"description\": \"test desc\",\n            \"ip\": \"1.1.1.1\",\n            \"noncomputing\": true,\n            \"metadata\": {},\n            \"stigs\": [\n                \"VPN_SRG_TEST\",\n                \"Windows_10_STIG_TEST\",\n                \"RHEL_7_STIG_TEST\"\n            ]\n        })\n        expect(res.status).to.eql(200)\n        expect(res.body.collection.collectionId, \"collectionId\").to.equal(reference.scrapCollection.collectionId)\n    })\n    it('verify metrics were recalculated relative to new pinned rev after transfer', async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.scrapCollection.collectionId}/metrics/detail`, 'GET', user.token)\n\n        let metricsReferenceCommon = {\n            assessed: 6,\n            assessments: reference.checklistLength,\n            maxTs: \"2022-02-03T00:07:05Z\",\n            minTs: \"2020-08-11T22:27:26Z\",\n            results: {\n                fail: {\n                    total: 3,\n                    resultEngine: 0\n                },\n                pass: {\n                    total: 1,\n                    resultEngine: 0\n                },\n                error: {\n                    total: 0,\n                    resultEngine: 0\n                },\n                fixed: {\n                    total: 0,\n                    resultEngine: 0\n                },\n                unknown: {\n                    total: 0,\n                    resultEngine: 0\n                },\n                notchecked: {\n                    total: 0,\n                    resultEngine: 0\n                },\n                notselected: {\n                    total: 0,\n                    resultEngine: 0\n                },\n                informational: {\n                    total: 0,\n                    resultEngine: 0\n                },\n                notapplicable: {\n                    total: 1,\n                    resultEngine: 0\n                }\n            },\n            findings: {\n                low: 1,\n                medium: 2,\n                high: 0\n            },    \n            statuses: {\n                saved: {\n                    total: 1,\n                    resultEngine: 0\n                },\n                accepted: {\n                    total: 0,\n                    resultEngine: 0\n                },\n                rejected: {\n                    total: 0,\n                    resultEngine: 0\n                },\n                submitted: {\n                    total: 4,\n                    resultEngine: 0\n                }\n            }\t \n        }\n    \n        metricsReferenceCommon.results.unassessed = {\n            total:  metricsReferenceCommon.results.informational.total + \n                    metricsReferenceCommon.results.notselected.total + \n                    metricsReferenceCommon.results.notchecked.total + \n                    metricsReferenceCommon.results.error.total + \n                    metricsReferenceCommon.results.fixed.total\n        }\n\n        for(const item of res.body){\n            if (item.assetId ==  reference.testAsset.assetId && item.benchmarkId == reference.benchmark) {\n                expect(item.metrics.maxTs).to.equal(metricsReferenceCommon.maxTs)\n                expect(item.metrics.minTs).to.equal(metricsReferenceCommon.minTs)\n                expect(item.metrics.findings.low).to.equal(metricsReferenceCommon.findings.low)\n                expect(item.metrics.findings.medium).to.equal(metricsReferenceCommon.findings.medium)\n                expect(item.metrics.findings.high).to.equal(metricsReferenceCommon.findings.high)\n                expect(item.metrics.results.notapplicable.total).to.equal(metricsReferenceCommon.results.notapplicable.total)\n                expect(item.metrics.results.pass.total).to.equal(metricsReferenceCommon.results.pass.total)\n                expect(item.metrics.results.fail.total).to.equal(metricsReferenceCommon.results.fail.total)\n                expect(item.metrics.results.informational.total).to.equal(metricsReferenceCommon.results.informational.total)\n                expect(item.metrics.results.notchecked.total).to.equal(metricsReferenceCommon.results.notchecked.total)\n                expect(item.metrics.results.notselected.total).to.equal(metricsReferenceCommon.results.notselected.total)\n                expect(item.metrics.results.error.total).to.equal(metricsReferenceCommon.results.error.total)\n                expect(item.metrics.results.fixed.total).to.equal(metricsReferenceCommon.results.fixed.total)\n                expect(item.metrics.statuses.saved.total).to.equal(metricsReferenceCommon.statuses.saved.total)\n                expect(item.metrics.statuses.submitted.total).to.equal(metricsReferenceCommon.statuses.submitted.total)\n                expect(item.metrics.statuses.accepted.total).to.equal(metricsReferenceCommon.statuses.accepted.total)\n                expect(item.metrics.statuses.rejected.total).to.equal(metricsReferenceCommon.statuses.rejected.total)\n                expect(item.metrics.assessments).to.equal(metricsReferenceCommon.assessments)\n                expect(item.metrics.assessed).to.equal(5)\n            }\n        }\n    })\n  })\n})\n\ndescribe('GET - getMetricsSummaryByCollectionAggStig - /collections/{collectionId}/metrics/summary/stig', function () {\n\n    describe('default-rev-recalc', function () {\n        before(async function () {\n            await utils.loadAppData()\n        })\n\n        it('Import a new STIG - new Copy', async function () {\n            const filename = 'U_VPN_SRG_V1R1_Manual-xccdf.xml'\n            const __filename = fileURLToPath(import.meta.url)\n            const __dirname = path.dirname(__filename)\n            const filePath = path.join(__dirname, `../../form-data-files/${filename}`)\n            const fileContent = fs.readFileSync(filePath, 'utf-8')\n            \n            const blob = new Blob([fileContent], { type: 'text/xml' })\n        \n            const formData = new FormData()\n            formData.append('importFile', blob, filename)\n\n            const res = await fetch(`${config.baseUrl}/stigs?elevate=true&clobber=true`, {\n                method: 'POST',\n                headers: {\n                  Authorization: `Bearer ${user.token}`,\n                },\n                body: formData,\n              })\n            let expectedRevData = \n            {\n                \"benchmarkId\": \"VPN_SRG_TEST\",\n                \"revisionStr\": \"V1R1\",\n                \"marking\": \"U\",\n                \"action\": \"replaced\"\n            }\n            expect(res.status).to.eql(200)\n            const data = await res.json()   \n            expect(data).to.deep.eql(expectedRevData)\n        })\n        it('Deletes the specified revision of a STIG v1r0 - with force - could fail if not present, so no tests Copy', async function () {\n            await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/V1R1?elevate=true&force=true`, 'DELETE', user.token)\n        })\n        it('Return summary metrics - check no null benchmarks', async function () {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/summary/stig`, 'GET', user.token)\n            expect(res.status).to.eql(200)\n            for (let stig of res.body){\n                expect(stig.benchmarkId).to.not.equal(null)\n            }\n        })\n    })\n})"
  },
  {
    "path": "test/api/mocha/integration/resultEngine.test.js",
    "content": "\nimport {config } from '../testConfig.js'\nimport * as utils from '../utils/testUtils.js'\nimport reference from '../referenceData.js'\nimport {iterations} from '../iterations.js'\nimport deepEqualInAnyOrder from 'deep-equal-in-any-order'\nimport {use, expect} from 'chai'\nuse(deepEqualInAnyOrder)\n\ndescribe('PATCH - patchReviewByAssetRule - /collections/{collectionId}/reviews/{assetId}/{ruleId} - PUT - putReviewByAssetRule - /collections/{collectionId}/reviews/{assetId}/{ruleId}', () => {\n    \n    for(const user of iterations){\n        describe(`user:${user.name}`, () => {\n            describe('resultEngine tests', () => {\n                before(async function () {\n                    await utils.loadAppData()\n                })\n                it('Delete a Review - freshRuleId - review may or may not exist', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.freshRuleId}`, 'DELETE', user.token)\n                    if(user.name === 'collectioncreator') {\n                      expect(res.status).to.eql(403)\n                      return\n                    }\n                    expect(res.status).to.eql(204)\n                })\n                it('Return the Review for an Asset and Rule', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.ruleId}?projection=rule&projection=stigs&projection=metadata&projection=history`, 'GET', user.token)\n                    if(user.name === 'collectioncreator') {\n                      expect(res.status).to.eql(403)\n                      return\n                    }\n                    expect(res.status).to.eql(200)\n                    const review = res.body\n                    // checking for basic properties\n                    expect(review.assetId).to.be.equal(reference.testAsset.assetId)\n          \n                    //check projectrions \n                    expect(review.rule.ruleId).to.be.equal(reference.ruleId)\n                    expect(review.metadata).to.have.property(reference.testAsset.metadataKey)\n                    expect(review.metadata[reference.testAsset.metadataKey]).to.be.equal(reference.testAsset.metadataValue)\n                    for(let stig of review.stigs){\n                      expect(stig.benchmarkId).to.be.oneOf(reference.testAsset.validStigs)\n                    } \n                })\n                it('resultEngine only - expect fail', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.ruleId}`, 'PATCH', user.token, {\n                      resultEngine: {\n                        type: \"script\",\n                        product: \"Evaluate-STIG\",\n                        version: \"1.2310.1\",\n                        time: \"2023-12-11T12:56:14.3576272-05:00\",\n                        checkContent: {\n                          location: \"VPN_Checks:1.2023.7.24\",\n                        },\n                        overrides: [\n                          {\n                            authority: \"Some_AnswerFile.xml\",\n                            oldResult: \"unknown\",\n                            newResult: \"pass\",\n                            remark: \"Evaluate-STIG Answer File\",\n                          },\n                        ],\n                      },\n                    })\n                    expect(res.status).to.eql(422)\n                })\n                it('resultEngine only - expect success', async () => {\n                  const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.ruleId}`, 'PATCH', user.token, {\n                    result: \"pass\",\n                    resultEngine: {\n                      type: \"script\",\n                      product: \"Evaluate-STIG\",\n                      version: \"1.2310.1\",\n                      time: \"2023-12-11T12:56:14.3576272-05:00\",\n                      checkContent: {\n                        location: \"VPN_Checks:1.2023.7.24\",\n                      },\n                      overrides: [\n                        {\n                          authority: \"Some_AnswerFile.xml\",\n                          oldResult: \"unknown\",\n                          newResult: \"pass\",\n                          remark: \"Evaluate-STIG Answer File\",\n                        },\n                      ],\n                    },\n                  })\n                  if(user.name === 'collectioncreator') {\n                    expect(res.status).to.eql(403)\n                    return\n                  }\n                  expect(res.status).to.eql(200)\n                  expect(res.body.result).to.eql(\"pass\")\n                  expect(res.body.touchTs).to.eql(res.body.ts)\n                  expect(res.body.status).to.have.property(\"ts\").to.not.eql(res.body.ts)\n                })\n                it('PUT Review: no resultEngine - check response does not include \"resultEngine\": 0', async () => {\n\n                    const putBody = {\n                        result: 'pass',\n                        detail: 'test',\n                        comment: null,\n                        status: 'saved'\n                    }\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.freshRuleId}`, 'PUT', user.token, putBody)\n                    if(user.name === 'collectioncreator') {\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(201)\n                    const expectedResponse = {  \n                      access: \"rw\",\n                      assetId: \"42\",\n                      assetName: \"Collection_X_lvl1_asset-1\",\n                      assetLabelIds: [\n                      \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n                      \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n                      ],\n                      assetLabels: reference.testAsset.fullLabels,\n                      ruleId: reference.freshRuleId,\n                      ruleIds: [\n                        reference.freshRuleId\n                      ],  \n                      result: putBody.result,\n                      resultEngine: null,\n                      detail: putBody.detail,\n                      autoResult: false,\n                      comment: \"\",\n                      userId: user.userId,\n                      username: user.name,\n                      ts: res.body.ts,\n                      touchTs: res.body.touchTs,\n                      status: {\n                        ts: res.body.status.ts,\n                        text: null,\n                        user: {\n                          userId: user.userId,\n                          username: user.name\n                        },\n                        label: putBody.status\n                      }\n                    }\n                \n                    expect(res.body).to.be.an('object')\n                    expect(res.body).to.eql(expectedResponse)\n                })\n                it('Delete a Review - freshRuleId - review may or may not exist', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.freshRuleId}`, 'DELETE', user.token)\n                    if(user.name === 'collectioncreator') {\n                      expect(res.status).to.eql(403)\n                      return\n                    }\n                    expect(res.status).to.eql(200)\n                })\n                it('Import one or more Reviews from a JSON body', async () => {\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}`, 'POST', user.token, [\n                      {\n                      \"ruleId\": reference.ruleId,\n                      \"result\": \"pass\",\n                      \"detail\": \"test\\nvisible to lvl1\",\n                      \"comment\": \"sure\",\n                      \"autoResult\": false,\n                      \"status\": \"submitted\"\n                      },\n                      {\n                      \"ruleId\": reference.freshRuleId,\n                      \"result\": \"pass\",\n                      \"detail\": \"test\",\n                      \"comment\": \"sure\",\n                      \"status\": \"saved\"\n                      }\n                    ])\n                    const expectedResponse = {\n                      rejected: [],\n                      affected: {\n                          inserted: 1,\n                          updated: 1\n                      }\n                    }\n                    if(user.name === 'collectioncreator') {\n                      expect(res.status).to.eql(403)\n                      return\n                    }\n                    expect(res.status).to.eql(200)\n                    expect(res.body).to.deep.equal(expectedResponse)\n                })\n            })\n        })\n    }\n})\n\n"
  },
  {
    "path": "test/api/mocha/integration/review.test.js",
    "content": "\nimport { XMLParser } from \"fast-xml-parser\"\nimport {config } from '../testConfig.js'\nimport * as utils from '../utils/testUtils.js'\nimport {iterations} from '../iterations.js'\nimport reference from '../referenceData.js'\nimport { expect } from 'chai'\n\nconst user =\n  {\n    \"name\": \"stigmanadmin\",\n    \"grant\": \"Owner\",\n    \"userId\": \"1\",\n    \"token\":\n      \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ2ODEwMzUsImlhdCI6MTY3MDU0MDIzNiwiYXV0aF90aW1lIjoxNjcwNTQwMjM1LCJqdGkiOiI0N2Y5YWE3ZC1iYWM0LTQwOTgtOWJlOC1hY2U3NTUxM2FhN2YiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJiN2M3OGE2Mi1iODRmLTQ1NzgtYTk4My0yZWJjNjZmZDllZmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjMzNzhkYWZmLTA0MDQtNDNiMy1iNGFiLWVlMzFmZjczNDBhYyIsInNlc3Npb25fc3RhdGUiOiI4NzM2NWIzMy0yYzc2LTRiM2MtODQ4NS1mYmE1ZGJmZjRiOWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIiwiYWRtaW4iXX0sInJlc291cmNlX2FjY2VzcyI6eyJyZWFsbS1tYW5hZ2VtZW50Ijp7InJvbGVzIjpbInZpZXctdXNlcnMiLCJxdWVyeS1ncm91cHMiLCJxdWVyeS11c2VycyJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIHN0aWctbWFuYWdlcjpvcCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIHN0aWctbWFuYWdlcjpvcDpyZWFkIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlciBzdGlnLW1hbmFnZXI6c3RpZyIsInNpZCI6Ijg3MzY1YjMzLTJjNzYtNGIzYy04NDg1LWZiYTVkYmZmNGI5ZiIsIm5hbWUiOiJTVElHTUFOIEFkbWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RpZ21hbmFkbWluIiwiZ2l2ZW5fbmFtZSI6IlNUSUdNQU4iLCJmYW1pbHlfbmFtZSI6IkFkbWluIn0.a1XwJZw_FIzwMXKo-Dr-n11me5ut-SF9ni7ylX-7t7AVrH1eAqyBxX9DXaxFK0xs6YOhoPsh9NyW8UFVaYgtF68Ps6yzoiqFEeiRXkpN5ygICN3H3z6r-YwanLlEeaYR3P2EtHRcrBtCnt0VEKKbGPWOfeiNCVe3etlp9-NQo44\"\n  }\n\ndescribe('PUT - putReviewByAssetRule - /collections/{collectionId}/reviews/{assetId}/{ruleId}', () => {\n \n    before(async function () {\n            await utils.loadAppData()\n        })\n\n    describe('Check that \"informational\" results are represented as NotReviewed with Finding Details data in .ckls', () => {\n\n        it('Set all properties of a Review with informational and a result comment', async () => {\n            const putBody = {\n                \"result\": \"informational\",\n                \"detail\": \"test\\nvisible to lvl1, THIS REVIEW IS INFORMATIONAL (but comes back as Not_Reviewed in a ckl)\",\n                \"comment\": \"sure\",\n                \"autoResult\": false,\n                \"status\": \"saved\"\n            }\n    \n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.ruleId}?projection=rule&projection=history&projection=stigs`, 'PUT', user.token, putBody)\n            expect(res.status).to.eql(200)\n        })\n        it('Return the Checklist for the supplied Asset and STIG XML (.ckl) - check that informational + detail exported as not_reviewed + finding_details', async () => {\n            \n            const url = `${config.baseUrl}/assets/${reference.testAsset.assetId}/checklists/${reference.testCollection.benchmark}/${'V1R1'}?format=ckl`\n\n            const options = {\n                method: 'GET',\n                headers: {\n                  Authorization: `Bearer ${user.token}`,\n                },\n            }\n            const res = await fetch(url, options)\n            expect(res.status).to.eql(200)\n            const bodyText = await res.text()\n\n            let cklData\n            const parser = new XMLParser({ processEntities: { enabled: true, maxTotalExpansions: 200000 } })\n            cklData = parser.parse(bodyText)\n  \n            let cklHostName = cklData.CHECKLIST.ASSET.HOST_NAME\n            let cklIStigs = cklData.CHECKLIST.STIGS.iSTIG\n            cklIStigs = [cklIStigs]\n            let currentStigId\n\n            for(const iStig of cklIStigs){\n                for (let cklSiDatum of iStig.STIG_INFO.SI_DATA){\n                    if (cklSiDatum.SID_NAME == 'stigid'){\n                        currentStigId = cklSiDatum.SID_DATA\n                        expect(currentStigId).to.be.oneOf(reference.testCollection.validStigs)\n                    }\n                }\n                let cklVulns = iStig.VULN;\n                if (currentStigId == 'VPN_SRG_TEST') {\n                    expect(cklVulns).to.be.an('array').of.length(reference.checklistLength)\n                    for (let thisVuln of cklVulns){\n                        for (let stigData of thisVuln.STIG_DATA){\n                            if (stigData.ATTRIBUTE_DATA == 'SV-106179r1_rule'){\n                                expect(thisVuln.STATUS).to.eql(\"Not_Reviewed\")\n                            }\n                        }\n                    }\n        \n                }\n            }\n        })\n        it('Set all properties of a Review - invalid result value', async () => {\n            const putBody = {\n                \"result\": \"INVALID\",\n                \"detail\": \"test\\nvisible to lvl1, test of invalid result enum\",\n                \"comment\": \"sure\",\n                \"autoResult\": false,\n                \"status\": \"saved\"\n            }\n    \n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}?projection=rule&projection=history&projection=stigs`, 'PUT', user.token, putBody)\n            expect(res.status).to.eql(400)\n        })\n    })\n})\n\ndescribe('PATCH - patchReviewByAssetRule - /collections/{collectionId}/reviews/{assetId}/{ruleId}', () => {\n\n    describe('review status reset check', () => {\n\n        before(async function () {\n            await utils.loadAppData()\n        })\n\n        it('PATCH Review with new details, expect status to remain', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${'SV-106181r1_rule'}`, 'PATCH', user.token, {detail:\"these details have changed, but the status remains\"})\n            expect(res.status).to.eql(200)\n            expect(res.body.status).to.have.property('label').that.equals('submitted')\n        })\n        it('PATCH Review with new result, expect status to reset to saved', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${'SV-106181r1_rule'}`, 'PATCH', user.token, {result: \"pass\"})\n            expect(res.status).to.eql(200)\n            expect(res.body.result).to.eql(\"pass\")\n            expect(res.body.status).to.have.property('label').that.equals('saved')\n        })\n        it('PATCH Review to submitted status, status should chnage to submitted', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${'SV-106181r1_rule'}`, 'PATCH', user.token, {status: \"submitted\"})\n            expect(res.status).to.eql(200)\n            expect(res.body.status).to.have.property('label').that.equals('submitted')\n        })\n        it('PATCH Review patched and no longer meets Collection Requirements expect saved', async () => {\n            const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${'SV-106181r1_rule'}`, 'PATCH', user.token, {result: \"fail\"})\n            expect(res.status).to.eql(200)\n            expect(res.body.result).to.eql(\"fail\")\n            expect(res.body.status).to.have.property('label').that.equals('saved')\n        })\n    })\n})\n\ndescribe('POST - postReviewsByAsset - /collections/{collectionId}/reviews/{assetId}', () => {\n\n    for(const user of iterations){\n        describe(`user:${user.name}`, () => {\n            describe('test history prune', () => {\n\n                before(async function () {\n                    await utils.loadAppData()\n                })\n\n                it('Set collection history max reviews to 2', async () => {\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}?projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs`, 'PATCH', user.token, {\n                        metadata: {\n                            pocName: \"poc2Patched\",\n                            pocEmail: \"pocEmail@email.com\",\n                            pocPhone: \"12342\",\n                            reqRar: \"true\",\n                        },\n                        settings: {\n                            fields: {\n                              detail: {\n                                enabled: 'always',\n                                required: 'findings'\n                              },\n                              comment: {\n                                enabled: 'always',\n                                required: 'findings'\n                              }\n                            },\n                            status: {\n                              canAccept: true,\n                              minAcceptGrant: 2,\n                              resetCriteria: 'result'\n                            },\n                            history: {\n                              maxReviews: 2\n                            },\n                            importOptions: {\n                             autoStatus: {\n                                fail: \"submitted\",\n                                notapplicable: \"submitted\",\n                                pass: \"submitted\",\n                              },\n                              unreviewed: \"commented\",\n                              unreviewedCommented: \"informational\",\n                              emptyDetail: \"replace\",\n                              emptyComment: \"ignore\",\n                              allowCustom: true\n                            }\n                          },\n                    })\n\n                    if(user.name  == \"lvl1\" || user.name  == \"lvl2\" || user.name  == \"collectioncreator\" ){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(200)\n                })\n                it('Post review, triggering history prune.', async () => {\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}`, 'POST', user.token, [\n                        {\n                          ruleId: reference.ruleId,\n                          result: \"pass\",\n                          detail: \"test\\nvisible to lvl1\",\n                          comment: \"sure\",\n                          autoResult: false,\n                          status: \"submitted\",\n                        },\n                      ])\n\n                    if(user.name  == \"collectioncreator\" ){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(200)\n                })\n                it('History stats - rule-asset - check history is pruned to 2', async () => {\n\n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/review-history/stats?assetId=${reference.testAsset.assetId}&ruleId=${reference.ruleId}`, 'GET', user.token)\n\n                    if(user.name  == \"lvl1\" ||  user.name  == \"collectioncreator\" ){\n                        expect(res.status).to.eql(403)\n                        return\n                    }\n                    expect(res.status).to.eql(200)\n                    \n                    if (user.name == \"lvl2\" ) {\n                        //lvl2 could not change collection settings, so history incremented\n                        expect(res.body.collectionHistoryEntryCount).to.eql(3)\n                    }\n                    else {\n                        //other iterations that made it this far could change collection settings, so history was pruned\n                        expect(res.body.collectionHistoryEntryCount).to.eql(2)\n                    }\n                })\n            })\n        })\n    }\n})\n\n\n"
  },
  {
    "path": "test/api/mocha/integration/revisionPinning.test.js",
    "content": "\nimport {config } from '../testConfig.js'\nimport * as utils from '../utils/testUtils.js'\nimport reference from '../referenceData.js'\nimport {iterations} from '../iterations.js'\nimport {expectations} from './expectations.js'\nimport { expect } from 'chai'\n\ndescribe(`POST - writeStigPropsByCollectionStig - /collections/{collectionId}/stigs/{benchmarkId} - postReviewBatch - /collections/{collectionId}/reviews`, () => {\n\n    for(const user of iterations){\n        if (expectations[user.name] === undefined){\n            it(`No expectations for this iteration scenario: ${user.name}`, async () => {})\n            continue\n        }\n        describe(`user:${user.name}`, () => {\n            const distinct = expectations[user.name]\n            describe('Revision Pinning', () => {\n\n                before(async function () {\n                    await utils.loadAppData()\n                    try{\n                        await utils.uploadTestStig(\"U_VPN_SRG_V1R0_Manual-xccdf.xml\")\n                    }\n                    catch(err){\n                        console.log(\"no stig to upload\")\n                    }\n                   \n                })\n                after(async function () {\n                    try{\n                        await utils.deleteStigByRevision(\"VPN_SRG_TEST\", \"V1R0\")\n                    }\n                    catch{\n                        console.log(\"no stig to delete\")\n                    }\n                   \n                })\n                describe('Pin Revision for Collection', () => {\n\n                    it('Return the STIGs mapped in the specified Collection', async () => {\n                        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs`, 'GET', user.token)\n                        if (distinct.grant === \"none\"){\n                            expect(res.status).to.eql(403)\n                            return\n                        }\n                        expect(res.status).to.eql(200)\n                        expect(res.body).to.be.an('array').of.length(distinct.validStigs.length)\n                        for(const stig of res.body){\n                            expect(distinct.validStigs).to.include(stig.benchmarkId)\n                            expect(stig.revisionPinned).to.equal(false)\n                        }\n                    })\n                    it(\"Set the Assets mapped to a STIG - default rev and assets\", async () => {\n\n                    const post = \n                     {\n                      defaultRevisionStr: \"V1R1\",\n                      assetIds: reference.writeStigPropsByCollectionStig,\n                     }\n            \n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}`, 'POST', user.token, post)\n            \n                        if(distinct.canModifyCollection === false){\n                        expect(res.status).to.eql(403)\n                        return\n                        }\n            \n                        expect(res.status).to.eql(200)\n                        expect(res.body.revisionStr).to.eql(post.defaultRevisionStr)\n                        expect(res.body.revisionPinned).to.eql(true)\n                        expect(res.body.ruleCount).to.eql(reference.checklistLength)\n                        expect(res.body.benchmarkId).to.eql(reference.testCollection.benchmark)\n                        expect(res.body.assetCount).to.eql(post.assetIds.length)\n                    })\n                    it(\"Set the Assets mapped to a STIG - default latest and assets\", async () => {\n            \n                    const post = {\n                        defaultRevisionStr: \"latest\",\n                        assetIds: [\"62\", \"42\", \"154\"],\n                    }\n            \n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}`, 'POST', user.token, post)\n            \n                        if(distinct.canModifyCollection === false){\n                        expect(res.status).to.eql(403)\n                        return\n                        }\n            \n                        expect(res.status).to.eql(200)\n                        expect(res.body.revisionStr).to.equal(reference.testCollection.defaultRevision)\n                        expect(res.body.revisionPinned).to.equal(false)\n                        expect(res.body.ruleCount).to.eql(reference.checklistLength)\n                        expect(res.body.benchmarkId).to.equal(reference.testCollection.benchmark)\n                        expect(res.body.assetCount).to.eql(post.assetIds.length)\n                    })\n                    it(\"Set the Assets mapped to a STIG - assets only\", async () => {\n            \n                    const post = {\n                        assetIds: reference.writeStigPropsByCollectionStig,\n                    }\n            \n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}`, 'POST', user.token, post)\n            \n                        if(distinct.canModifyCollection === false){\n                        expect(res.status).to.eql(403)\n                        return\n                        }\n            \n                        expect(res.status).to.eql(200)\n                        expect(res.body.revisionStr).to.equal(reference.testCollection.defaultRevision)\n                        expect(res.body.revisionPinned).to.equal(false)\n                        expect(res.body.ruleCount).to.eql(reference.checklistLength)\n                        expect(res.body.benchmarkId).to.equal(reference.testCollection.benchmark)\n                        expect(res.body.assetCount).to.eql(post.assetIds.length)\n                    })\n                    it(\"Set the Assets mapped to a STIG - invalid rev - expect 422\", async () => {\n            \n                    const post = {\n                    defaultRevisionStr: \"V1R5\"\n                    }\n            \n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}`, 'POST', user.token, post)\n            \n                        if(distinct.canModifyCollection === false){\n                        expect(res.status).to.eql(403)\n                        return\n                        }\n            \n                        expect(res.status).to.eql(422)\n                    })\n                    it(\"Set the Assets mapped to a STIG - default rev only\", async () => {\n            \n                    const post = {\n                        defaultRevisionStr: reference.testCollection.pinRevision\n                    }\n            \n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}`, 'POST', user.token, post)\n            \n                        if(distinct.canModifyCollection === false){\n                        expect(res.status).to.eql(403)\n                        return\n                        }\n            \n                        expect(res.status).to.eql(200)\n                        expect(res.body.revisionStr).to.equal(reference.testCollection.pinRevision)\n                        expect(res.body.revisionPinned).to.equal(true)\n                        expect(res.body.ruleCount).to.eql(reference.checklistLength)\n                        expect(res.body.benchmarkId).to.equal(reference.testCollection.benchmark)\n                        expect(res.body.assetCount).to.eql(reference.writeStigPropsByCollectionStig.length)\n                    })\n                    it(\"Return mapped STIGs - expect v1r0 pin\", async () => {\n\n                        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs`, 'GET', user.token)\n                        if (distinct.grant === \"none\"){\n                            expect(res.status).to.eql(403)\n                            return\n                        }\n                        expect(res.status).to.eql(200)\n\n                        for(const stig of res.body){\n                            expect(stig.benchmarkId).to.be.oneOf(distinct.validStigs)\n                            if(stig.benchmarkId === reference.testCollection.benchmark){\n                                expect(stig.revisionPinned).to.equal(distinct.pinnedState)\n                                expect(stig.revisionStr).to.equal(distinct.pinnedRevStr)\n                            }else{\n                                expect(stig.revisionPinned).to.equal(false)\n                            }\n                        }\n                    })\n                    it(\"verify metrics were recalculated relative to new pinned rev\", async () => {\n                        \n                        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail`, 'GET', user.token)\n                        if (distinct.grant === \"none\"){\n                            expect(res.status).to.eql(403)\n                            return\n                        }\n                        expect(res.status).to.eql(200)\n                        if(user.name === \"lvl1\" || user.name === \"lvl2\"){\n                            //nnot sure why we are returning look into it?? \n                            return\n                        }\n                        let metricsReferenceCommon = {\n                            assessed: 6,\n                            assessments: reference.checklistLength,\n                            maxTs: \"2022-02-03T00:07:05Z\",\n                            minTs: \"2020-08-11T22:27:26Z\",\n                            results: {\n                                fail: {\n                                    total: 3,\n                                    resultEngine: 0\n                                },\n                                pass: {\n                                    total: 1,\n                                    resultEngine: 0\n                                },\n                                error: {\n                                    total: 0,\n                                    resultEngine: 0\n                                },\n                                fixed: {\n                                    total: 0,\n                                    resultEngine: 0\n                                },\n                                unknown: {\n                                    total: 0,\n                                    resultEngine: 0\n                                },\n                                notchecked: {\n                                    total: 0,\n                                    resultEngine: 0\n                                },\n                                notselected: {\n                                    total: 0,\n                                    resultEngine: 0\n                                },\n                                informational: {\n                                    total: 0,\n                                    resultEngine: 0\n                                },\n                                notapplicable: {\n                                    total: 1,\n                                    resultEngine: 0\n                                }\n                            },\n                            findings: {\n                                low: 1,\n                                medium: 2,\n                                high: 0\n                            },    \n                            statuses: {\n                                saved: {\n                                    total: 1,\n                                    resultEngine: 0\n                                },\n                                accepted: {\n                                    total: 0,\n                                    resultEngine: 0\n                                },\n                                rejected: {\n                                    total: 0,\n                                    resultEngine: 0\n                                },\n                                submitted: {\n                                    total: 4,\n                                    resultEngine: 0\n                                }\n                            }\t \n                        }\n                    \n                        metricsReferenceCommon.results.unassessed = {\n                            total:  metricsReferenceCommon.results.informational.total + \n                                    metricsReferenceCommon.results.notselected.total + \n                                    metricsReferenceCommon.results.notchecked.total + \n                                    metricsReferenceCommon.results.error.total + \n                                    metricsReferenceCommon.results.fixed.total\n                        }\n\n                        for(const item of res.body){\n                            if (item.assetId ==  reference.testAsset.assetId && item.benchmarkId == reference.benchmark) {\n                               expect(item.metrics.maxTs).to.equal(metricsReferenceCommon.maxTs);\n                                expect(item.metrics.minTs).to.equal(metricsReferenceCommon.minTs);\n                                expect(item.metrics.findings.low).to.equal(metricsReferenceCommon.findings.low);\n                                expect(item.metrics.findings.medium).to.equal(metricsReferenceCommon.findings.medium);\n                                expect(item.metrics.findings.high).to.equal(metricsReferenceCommon.findings.high);\n                                expect(item.metrics.results.notapplicable.total).to.equal(metricsReferenceCommon.results.notapplicable.total);\n                                expect(item.metrics.results.pass.total).to.equal(metricsReferenceCommon.results.pass.total);\n                                expect(item.metrics.results.fail.total).to.equal(metricsReferenceCommon.results.fail.total);\n                                expect(item.metrics.results.informational.total).to.equal(metricsReferenceCommon.results.informational.total);\n                                expect(item.metrics.results.notchecked.total).to.equal(metricsReferenceCommon.results.notchecked.total);\n                                expect(item.metrics.results.notselected.total).to.equal(metricsReferenceCommon.results.notselected.total);\n                                expect(item.metrics.results.error.total).to.equal(metricsReferenceCommon.results.error.total);\n                                expect(item.metrics.results.fixed.total).to.equal(metricsReferenceCommon.results.fixed.total);\n                                expect(item.metrics.statuses.saved.total).to.equal(metricsReferenceCommon.statuses.saved.total);\n                                expect(item.metrics.statuses.submitted.total).to.equal(metricsReferenceCommon.statuses.submitted.total);\n                                expect(item.metrics.statuses.accepted.total).to.equal(metricsReferenceCommon.statuses.accepted.total);\n                                expect(item.metrics.statuses.rejected.total).to.equal(metricsReferenceCommon.statuses.rejected.total);\n                                expect(item.metrics.assessments).to.equal(metricsReferenceCommon.assessments);\n                                expect(item.metrics.assessed).to.equal(5);\n                            }\n                        }\n                    })\n                    it(\"Set the Assets mapped to a STIG - clear assets\", async () => {\n            \n                    const post = {\n                    assetIds: []\n                    }\n            \n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}`, 'POST', user.token, post)\n            \n                        if(distinct.canModifyCollection === false){\n                            expect(res.status).to.eql(403)\n                            return\n                        }\n            \n                        expect(res.status).to.eql(204)\n                    })\n                    it(\"Set the Assets mapped to a STIG - after pinned delete\", async () => {\n            \n                    const post = {\n                        assetIds: reference.writeStigPropsByCollectionStig,\n                    }\n            \n                    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}`, 'POST', user.token, post)\n            \n                        if(distinct.canModifyCollection === false){\n                            expect(res.status).to.eql(403)\n                            return\n                        }\n            \n                        expect(res.status).to.eql(200)\n                        expect(res.body.revisionStr).to.equal(reference.testCollection.defaultRevision)\n                        expect(res.body.revisionPinned).to.equal(false)\n                        expect(res.body.ruleCount).to.eql(reference.checklistLength)\n                        expect(res.body.benchmarkId).to.equal(reference.testCollection.benchmark)\n                        expect(res.body.assetCount).to.eql(reference.writeStigPropsByCollectionStig.length)\n                    })\n                    it(\"TEST that re-adding STIG does not have old pin\", async () => {\n\n                        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs`, 'GET', user.token)\n                        if (distinct.grant === \"none\"){\n                            expect(res.status).to.eql(403)\n                            return\n                        }\n                        expect(res.status).to.eql(200)\n\n                        for(const stig of res.body){\n                            expect(stig.benchmarkId).to.be.oneOf(distinct.validStigs)\n                            expect(stig.revisionPinned).to.equal(false)\n                        }\n                    })\n                    it(\"Set the Assets mapped to a STIG - default rev only copy\", async () => {\n            \n                        const post = {\n                        defaultRevisionStr: reference.testCollection.pinRevision\n                        }\n                \n                        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs/${reference.testCollection.benchmark}`, 'POST', user.token, post)\n                \n                            if(distinct.canModifyCollection === false){\n                                expect(res.status).to.eql(403)\n                                return\n                            }\n                            expect(res.status).to.eql(200)\n                            expect(res.body.revisionStr).to.equal(reference.testCollection.pinRevision)\n                            expect(res.body.revisionPinned).to.equal(true)\n                            expect(res.body.ruleCount).to.eql(reference.checklistLength)\n                            expect(res.body.benchmarkId).to.equal(reference.testCollection.benchmark)\n                            expect(res.body.assetCount).to.eql(reference.writeStigPropsByCollectionStig.length)\n                    })\n                })\n                describe('Post and Get Reviews against Colleciton with pinned rev', () => {\n                    \n                    it(\"PUT Review: rule only in latest, not default\", async () => {\n\n                        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.ruleId}?projection=rule&projection=stigs`, 'PUT', user.token, {\n                            \"result\": \"pass\",\n                            \"detail\": \"test\\nvisible to lvl1\",\n                            \"comment\": \"sure\",\n                            \"autoResult\": false,\n                            \"status\": \"submitted\"\n                        })\n                        if(distinct.grant === \"none\"){\n                            expect(res.status).to.eql(403)\n                            return\n                        }\n                        expect(res.status).to.eql(200)\n                        if(user.name === \"lvl1\" || user.name === \"lvl2\"){\n                            return\n                        }\n                        const expectedReview = {\n                            access: \"rw\",\n                            assetId: \"42\",\n                            assetName: \"Collection_X_lvl1_asset-1\",\n                            assetLabelIds: [\n                              \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n                              \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n                              ],\n                            assetLabels: reference.testAsset.fullLabels,\n                            ruleId: reference.ruleId,\n                           ruleIds: [\n                                  reference.ruleId\n                              ],  \n                            result: res.body.result,\n                            resultEngine: null,\n                            detail: res.body.detail,\n                            autoResult: res.body.autoResult,\n                            comment: res.body.comment,\n                            userId: distinct.userId,\n                            username: user.name,\n                            ts: res.body.ts,\n                            touchTs: res.body.touchTs,\n                            status: {\n                                ts: res.body.status.ts,\n                                text: null,\n                                user: {\n                                    userId: distinct.userId,\n                                    username: user.name\n                                },\n                                label: res.body.status.label\n                            },\n                            stigs: [\n                                  {\n                                      \"isDefault\": false,\n                                      \"ruleCount\": 81,\n                                      \"benchmarkId\": \"VPN_SRG_TEST\",\n                                      \"revisionStr\": \"V1R1\",\n                                      \"benchmarkDate\": \"2019-07-19\",\n                                      \"revisionPinned\": false\n                                  }\n                              ],\n                            rule: {\n                              title: \"The VPN Gateway must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.\",\n                              ruleId: \"SV-106179r1_rule\",\n                              version: \"SRG-NET-000019-VPN-000040\",\n                              severity: \"medium\"\n                            }\n                          }\n                          expect(res.body).to.eql(expectedReview)\n                    })\n                    it(\"PUT Review: rule is only in pinned rev - expect 201\", async () => {\n\n                        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.ruleIdPinnedRev}?projection=rule&projection=stigs`, 'PUT', user.token, {\n                            \"result\": \"pass\",\n                            \"detail\": \"test\\nvisible to lvl1\",\n                            \"comment\": \"sure\",\n                            \"autoResult\": false,\n                            \"status\": \"submitted\"\n                        })\n                        if(distinct.grant === \"none\"){\n                            expect(res.status).to.eql(403)\n                            return\n                        }\n                        expect(res.status).to.eql(201)\n                        let pinned = \"V1R0\"\n                        let pinnedState = true\n                        if(user.name === \"lvl1\" || user.name === \"lvl2\"){\n                            pinnedState = false\n                        }\n                        const expectedReview = {\n                            access: \"rw\",\n                            assetId: \"42\",\n                            assetName: \"Collection_X_lvl1_asset-1\",\n                            assetLabelIds: [\n                              \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n                              \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n                              ],\n                            assetLabels: reference.testAsset.fullLabels,\n                            ruleId: reference.ruleIdPinnedRev,\n                           ruleIds: [\n                                  reference.ruleIdPinnedRev\n                              ],  \n                            result: res.body.result,\n                            resultEngine: null,\n                            detail: res.body.detail,\n                            autoResult: res.body.autoResult,\n                            comment: res.body.comment,\n                            userId: distinct.userId,\n                            username: user.name,\n                            ts: res.body.ts,\n                            touchTs: res.body.touchTs,\n                            status: {\n                                ts: res.body.status.ts,\n                                text: null,\n                                user: {\n                                    userId: distinct.userId,\n                                    username: user.name\n                                },\n                                label: res.body.status.label\n                            },\n                            stigs: [\n                                  {\n                                      \"isDefault\": distinct.pinnedState,\n                                      \"ruleCount\": 81,\n                                      \"benchmarkId\": \"VPN_SRG_TEST\",\n                                      \"revisionStr\": pinned,\n                                      \"benchmarkDate\": \"2010-07-19\",\n                                      \"revisionPinned\": distinct.pinnedState\n                                  }\n                              ],\n                            rule: {\n                              title: \"The VPN Gateway must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.\",\n                              ruleId: reference.ruleIdPinnedRev,\n                              version: \"SRG-NET-000019-VPN-000040\",\n                              severity: \"medium\"\n                            }\n                          }\n                        expect(res.body).to.eql(expectedReview)\n                    })\n                    it(\"PUT Review: rule is only in pinned rev - 200 expected\", async () => {\n\n                        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${reference.ruleIdPinnedRev}?projection=rule&projection=stigs`, 'PUT', user.token, {\n                            \"result\": \"pass\",\n                            \"detail\": \"test\\nvisible to lvl1\",\n                            \"comment\": \"sure\",\n                            \"autoResult\": false,\n                            \"status\": \"submitted\"\n                        })\n                        if(distinct.grant === \"none\"){\n                            expect(res.status).to.eql(403)\n                            return\n                        }\n                        expect(res.status).to.eql(200)\n                        let pinned = \"V1R0\"\n                        let pinnedState = true\n                        if(user.name === \"lvl1\" || user.name === \"lvl2\"){\n                            pinnedState = false\n                        }\n                        const expectedReview = {\n                            access: \"rw\",\n                            assetId: \"42\",\n                            assetName: \"Collection_X_lvl1_asset-1\",\n                            assetLabelIds: [\n                              \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n                              \"5130dc84-9a68-11ec-b1bc-0242ac110002\"\n                              ],\n                            assetLabels: reference.testAsset.fullLabels,\n                            ruleId: reference.ruleIdPinnedRev,\n                           ruleIds: [\n                                  reference.ruleIdPinnedRev\n                              ],  \n                            result: res.body.result,\n                            resultEngine: null,\n                            detail: res.body.detail,\n                            autoResult: res.body.autoResult,\n                            comment: res.body.comment,\n                            userId: distinct.userId,\n                            username: user.name,\n                            ts: res.body.ts,\n                            touchTs: res.body.touchTs,\n                            status: {\n                                ts: res.body.status.ts,\n                                text: null,\n                                user: {\n                                    userId: distinct.userId,\n                                    username: user.name\n                                },\n                                label: res.body.status.label\n                            },\n                            stigs: [\n                                  {\n                                      \"isDefault\": pinnedState,\n                                      \"ruleCount\": 81,\n                                      \"benchmarkId\": \"VPN_SRG_TEST\",\n                                      \"revisionStr\": pinned,\n                                      \"benchmarkDate\": \"2010-07-19\",\n                                      \"revisionPinned\": pinnedState\n                                  }\n                              ],\n                            rule: {\n                              title: \"The VPN Gateway must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.\",\n                              ruleId: reference.ruleIdPinnedRev,\n                              version: \"SRG-NET-000019-VPN-000040\",\n                              severity: \"medium\"\n                            }\n                          }\n                        expect(res.body).to.eql(expectedReview)\n                    })\n                })\n                describe('batch', () => {\n\n                    it(\"POST batch review: target rules defined by stig (expect pinned rules only)\", async () => {\n\n                        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews`, 'POST', user.token, {\n                            source: {\n                              review: { result: \"fail\", detail: \"tesetsetset\" },\n                            },\n                            assets: { assetIds: [\"62\", \"42\", \"154\"] },\n                            rules: { benchmarkIds: [\"VPN_SRG_TEST\"] },\n                          })\n                        if(distinct.grant === \"none\"){\n                            expect(res.status).to.eql(403)\n                            return\n                        }\n                        expect(res.status).to.eql(200)\n                    })\n\n                    it(\"Return detailed metrics for the specified Collection - check previously empty asset for 80 assesments (overlap between pin and current)\", async () => {\n\n                        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/metrics/detail`, 'GET', user.token)\n                        if (distinct.grant === \"none\"){\n                            expect(res.status).to.eql(403)\n                            return\n                        }\n                        let testAsset = 154\n                        for(let item of res.body){\n                            if (item.assetId ==  reference.testAsset.assetId && item.benchmarkId == reference.benchmark) {\n                                expect(item.metrics.assessed).to.equal(reference.checklistLength)\n                            }\n                        }\n                    })\n                })\n                describe('STIG and Revision deletes', () => {\n\n                    it('Return the STIGs mapped in the specified Collection Copy', async () => {\n                        \n                        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/stigs`, 'GET', user.token)\n                        if (distinct.grant === \"none\"){\n                            expect(res.status).to.eql(403)\n                            return\n                        }\n                        expect(res.status).to.eql(200)\n                        let pinnedState = true;\n                        let testPinnedRevStr = \"V1R0\"\n                        if (user.name === \"lvl1\" || user.name === \"lvl2\" ) {\n                            pinnedState = false\n                            testPinnedRevStr = \"V1R1\"\n                        }\n                        for(const stig of res.body){\n                            expect(stig.benchmarkId).to.be.oneOf(distinct.validStigs)\n                            if(stig.benchmarkId === reference.testCollection.benchmark){\n                                expect(stig.revisionPinned).to.equal(pinnedState)\n                                expect(stig.revisionStr).to.equal(testPinnedRevStr)\n                            }else{\n                                expect(stig.revisionPinned).to.equal(false)\n                            }\n                        }\n                    })\n                })\n            })\n        })\n    }\n})\n\n"
  },
  {
    "path": "test/api/mocha/integration/roleResolution.test.js",
    "content": "\nimport { v4 as uuidv4 } from 'uuid'\nimport {config } from '../testConfig.js'\nimport * as utils from '../utils/testUtils.js'\nimport reference from '../referenceData.js'\nimport { expect } from 'chai'\n\nconst admin = {\n  name: \"admin\",\n  grant: \"Owner\",\n  token:\n    \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ2ODEwMzUsImlhdCI6MTY3MDU0MDIzNiwiYXV0aF90aW1lIjoxNjcwNTQwMjM1LCJqdGkiOiI0N2Y5YWE3ZC1iYWM0LTQwOTgtOWJlOC1hY2U3NTUxM2FhN2YiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJiN2M3OGE2Mi1iODRmLTQ1NzgtYTk4My0yZWJjNjZmZDllZmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjMzNzhkYWZmLTA0MDQtNDNiMy1iNGFiLWVlMzFmZjczNDBhYyIsInNlc3Npb25fc3RhdGUiOiI4NzM2NWIzMy0yYzc2LTRiM2MtODQ4NS1mYmE1ZGJmZjRiOWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIiwiYWRtaW4iXX0sInJlc291cmNlX2FjY2VzcyI6eyJyZWFsbS1tYW5hZ2VtZW50Ijp7InJvbGVzIjpbInZpZXctdXNlcnMiLCJxdWVyeS1ncm91cHMiLCJxdWVyeS11c2VycyJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIHN0aWctbWFuYWdlcjpvcCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIHN0aWctbWFuYWdlcjpvcDpyZWFkIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlciBzdGlnLW1hbmFnZXI6c3RpZyIsInNpZCI6Ijg3MzY1YjMzLTJjNzYtNGIzYy04NDg1LWZiYTVkYmZmNGI5ZiIsIm5hbWUiOiJTVElHTUFOIEFkbWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RpZ21hbmFkbWluIiwiZ2l2ZW5fbmFtZSI6IlNUSUdNQU4iLCJmYW1pbHlfbmFtZSI6IkFkbWluIn0.a1XwJZw_FIzwMXKo-Dr-n11me5ut-SF9ni7ylX-7t7AVrH1eAqyBxX9DXaxFK0xs6YOhoPsh9NyW8UFVaYgtF68Ps6yzoiqFEeiRXkpN5ygICN3H3z6r-YwanLlEeaYR3P2EtHRcrBtCnt0VEKKbGPWOfeiNCVe3etlp9-NQo44\",\n}\n\nconst lvl1 = {\n    name: \"lvl1\",\n    userId: \"85\",\n    token:\n      \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDg5ODQsImlhdCI6MTY3MDU2ODE4NCwiYXV0aF90aW1lIjoxNjcwNTY4MTg0LCJqdGkiOiIxMDhmMDc2MC0wYmY5LTRkZjEtYjE0My05NjgzNmJmYmMzNjMiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJlM2FlMjdiOC1kYTIwLTRjNDItOWRmOC02MDg5ZjcwZjc2M2IiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjE0ZmE5ZDdkLTBmZTAtNDQyNi04ZmQ5LTY5ZDc0YTZmMzQ2NCIsInNlc3Npb25fc3RhdGUiOiJiNGEzYWNmMS05ZGM3LTQ1ZTEtOThmOC1kMzUzNjJhZWM0YzciLCJhY3IiOiIxIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtc3RpZ21hbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb246cmVhZCIsInNpZCI6ImI0YTNhY2YxLTlkYzctNDVlMS05OGY4LWQzNTM2MmFlYzRjNyIsIm5hbWUiOiJyZXN0cmljdGVkIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibHZsMSIsImdpdmVuX25hbWUiOiJyZXN0cmljdGVkIn0.OqLARi5ILt3j2rMikXy0ECTTqjWco0-CrMwzE88gUv2i8rVO9kMgVsXbtPk2L2c9NNNujnxqg7QIr2_sqA51saTrZHvzXcsT8lBruf74OubRMwcTQqJap-COmrzb60S7512k0WfKTYlHsoCn_uAzOb9sp8Trjr0NksU8OXCElDU\"\n}\n\nconst lvl1TestAcl = {\n    put: [{\"benchmarkId\":reference.testCollection.benchmark,\"labelId\":reference.testCollection.fullLabel,\"access\":\"r\"},{\"assetId\":\"154\",\"access\":\"rw\"}],\n    response: [\n        {\n          access: \"r\",\n          asset: {\n            name: \"Collection_X_asset\",\n            assetId: \"62\",\n          },\n          benchmarkId: \"VPN_SRG_TEST\",\n          aclSources: [\n            {\n              aclRule: {\n                label: {\n                  name: \"test-label-full\",\n                  labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n                },\n                access: \"r\",\n                benchmarkId: \"VPN_SRG_TEST\",\n              },\n              grantee: {\n                userId: 85,\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        },\n        {\n          access: \"r\",\n          asset: {\n            name: \"Collection_X_lvl1_asset-1\",\n            assetId: \"42\",\n          },\n          benchmarkId: \"VPN_SRG_TEST\",\n          aclSources: [\n            {\n              aclRule: {\n                label: {\n                  name: \"test-label-full\",\n                  labelId: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n                },\n                access: \"r\",\n                benchmarkId: \"VPN_SRG_TEST\",\n              },\n              grantee: {\n                userId: 85,\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        },\n        {\n          access: \"rw\",\n          asset: {\n            name: \"Collection_X_lvl1_asset-2\",\n            assetId: \"154\",\n          },\n          benchmarkId: \"VPN_SRG_TEST\",\n          aclSources: [\n            {\n              aclRule: {\n                asset: {\n                  name: \"Collection_X_lvl1_asset-2\",\n                  assetId: \"154\",\n                },\n                access: \"rw\",\n              },\n              grantee: {\n                userId: 85,\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        },\n        {\n          access: \"rw\",\n          asset: {\n            name: \"Collection_X_lvl1_asset-2\",\n            assetId: \"154\",\n          },\n          benchmarkId: \"Windows_10_STIG_TEST\",\n          aclSources: [\n            {\n              aclRule: {\n                asset: {\n                  name: \"Collection_X_lvl1_asset-2\",\n                  assetId: \"154\",\n                },\n                access: \"rw\",\n              },\n              grantee: {\n                userId: 85,\n                username: \"lvl1\",\n                roleId: 1,\n              },\n            },\n          ],\n        },\n      ]\n}\n\ndescribe(\"Test grantee resolution is resolved from assigning a user to a group\", function () {\n\n  before(async function () {\n    await utils.loadAppData()\n  })\n\n  let tempUser = {}\n  let tempGroup = {}\n  // create test user \n  it(\"create a temporary user\", async function () {\n\n    let uuid = uuidv4()\n    //first 20 chars\n    uuid = uuid.substring(0, 20)\n\n    const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true&projection=collectionGrants&projection=statistics`, 'POST', admin.token, {\n      \"username\": \"TEMP_USER\" +  uuid,\n      \"collectionGrants\": [\n      ]\n    })\n  \n    expect(res.status).to.eql(201) \n    tempUser.userId = res.body.userId\n  })\n\n  // create test group\n  it(\"create a temporary userGroup with the user we created in it\", async function () {\n\n    let uuid = uuidv4()\n    //first 20 chars\n    uuid = uuid.substring(0, 20)\n\n    const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true`, 'POST', admin.token, {\n      \"name\": \"TEMP_GROUP\" +  uuid,\n      \"description\": \"TEMP_GROUP\" +  uuid,\n      userIds: [tempUser.userId]\n    })\n   \n    expect(res.status).to.eql(201) \n    tempGroup.userGroupId = res.body.userGroupId\n  })\n\n  // assign it to the test collection \n  it(\"assign the userGroup to the test collection with restricted grant\", async function () {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', admin.token, [{\n      userGroupId: tempGroup.userGroupId,\n      roleId: 1\n    }])\n    expect(res.status).to.eql(201)\n    tempGroup.grantId = res.body[0].grantId\n  })\n\n  // then get the grant and test grantee = userGroup.\n  it(\"should return the grant for the user in the collection and check that grantee is from a group grant\",async function () {\n    \n\n    const res = await utils.executeRequest(`${config.baseUrl}/users/${tempUser.userId}?elevate=true&projection=collectionGrants&projection=userGroups`, 'GET', config.adminToken)\n    expect(res.status).to.eql(200)\n\n    for(const grant of res.body.collectionGrants){\n        expect(grant.roleId).to.equal(1)\n        for(const grantee of grant.grantees){ \n            expect(grantee.userGroupId).to.be.eql(tempGroup.userGroupId)\n        }\n    }\n  })\n})\n\ndescribe(`Testing grantee resolution between a direct grant and group grant`, () => {\n  describe(`GET- getEffectiveAclByCollectionUser`, () => {\n      before(async function () {\n          await utils.loadAppData()\n      })\n\n      let userGroup = null\n      let userGroupGrantId = null\n      let lvl1DirectGrantId = null\n\n      it(\"Remove Base appdata userGroup from test Colleciton\", async () => {\n\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}`, 'DELETE', admin.token)\n    \n        expect(res.status).to.eql(200)\n      })\n\n      it(\"should give lvl1 user restricted access to test collection\", async () => {\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', admin.token, [{\n          \"userId\": lvl1.userId,\n          \"roleId\": 1\n        }])\n        expect(res.status).to.eql(201)\n        lvl1DirectGrantId = res.body[0].grantId\n      })\n      // user has direct grant to collection\n      it(\"make sure grantee has a userID property which means it has a direct grant \", async () => {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${lvl1.userId}/effective-acl`, 'GET', admin.token)\n      \n          expect(res.status).to.eql(200)\n          for(const grant of res.body){\n              for(const acl of grant.aclSources){\n                  expect(acl.grantee.userId).to.exist\n              }\n          }\n      })\n\n      // make group\n      it(\"should create a userGroup with lvl1 in it\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true&projection=users`, 'POST', admin.token, {\n              \"name\": \"group\" +  uuidv4(),\n              \"description\": \"test group\",\n              \"userIds\": [\n              lvl1.userId   \n              ]\n          })\n          \n          userGroup = res.body\n          expect(res.status).to.eql(201)\n          for(let user of res.body.users) {\n              expect(user.userId, \"expect userId to be equal to the userId returned from API\").to.equal(lvl1.userId)\n          }\n      })\n\n      // add group to collection\n      it(\"should give created group restricted access to test collection\", async () => {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', admin.token, [{\n              \"userGroupId\": userGroup.userGroupId,\n              roleId: 1\n          }])\n          expect(res.status).to.eql(201)\n          lvl1DirectGrantId = res.body[0].grantId\n      })\n\n      it(\"should set userGroups ACL in test collection\", async () => {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${lvl1DirectGrantId}/acl`, 'PUT', admin.token, lvl1TestAcl.put)\n          expect(res.status).to.eql(200)\n      })\n\n      it(\"should confirm users effective acl was set. User has group and direct grant expect to get effective from the direct\", async () => {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${lvl1.userId}/effective-acl`, 'GET', admin.token)\n      \n          expect(res.status).to.eql(200)\n          for(const grant of res.body){\n              for(const acl of grant.aclSources){\n                  expect(acl.grantee.userId).to.exist\n              }\n          }\n      })\n\n      it(\"should delete users direct grant to test collection\", async () => {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${lvl1DirectGrantId}`, 'DELETE', admin.token)\n          expect(res.status).to.eql(200)\n      })\n\n      it(\"should confirm that the direct grant was deleted\", async () => {  \n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${lvl1DirectGrantId}`, 'GET', admin.token)\n        expect(res.status).to.eql(404)\n      })\n      \n      it(\"User now only has a group grant, check that grantee was resolved from a group\", async () => {\n\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${lvl1.userId}/effective-acl`, 'GET', admin.token)\n        expect(res.status).to.eql(200)\n        for(const grant of res.body){\n            for(const acl of grant.aclSources){\n                expect(acl.grantee.userGroupId).to.exist\n            }\n        }\n      })\n\n      it(\"should delete the userGroup\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/user-groups/${userGroup.userGroupId}?elevate=true`, 'DELETE', admin.token)\n          expect(res.status).to.eql(200)\n      })\n\n      it(\"should confirm that the userGroup was deleted\", async () => {\n          const res = await utils.executeRequest(`${config.baseUrl}/user-groups/${userGroup.userGroupId}?elevate=true`, 'GET', admin.token)\n          expect(res.status).to.eql(404)\n      })\n      \n      it(\"User now has no grant to the collection should get 422 error\", async () => {\n\n          const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/users/${lvl1.userId}/effective-acl`, 'GET', admin.token)\n          expect(res.status).to.eql(200)\n          expect(res.body).to.be.empty\n      })\n  })\n})\n\ndescribe(`Multiple Group roleId Collisions`, () => {\n\n  before(async function () {\n      await utils.loadAppData()\n  })\n  \n  let userGroup1\n  let userGroup2\n  let userGroup3\n\n  it(\"Remove Base appdata userGroup from test Colleciton\", async () => {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${reference.testCollection.testGroup.testCollectionGrantId}`, 'DELETE', admin.token)\n\n    expect(res.status).to.eql(200)\n  })\n\n  it(\"Delete base appdata userGroup\", async () => {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/user-groups/${reference.testCollection.testGroup.userGroupId}?elevate=true`, 'DELETE', admin.token)\n    expect(res.status).to.eql(200)\n  })\n\n  it('should create a test user group with lvl1 user in it.', async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true&projection=collections`, 'POST', config.adminToken, {\n      \"name\": \"CollisionGroup1\",\n      \"description\": \"test group\",\n      \"userIds\": [\n        lvl1.userId   \n      ]\n    })\n    userGroup1 = res.body\n    expect(res.status).to.eql(201)\n    expect(res.body.collectionGrants).to.be.empty\n  })\n\n  it('should create another test user group with lvl1 user in it.', async () => {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true&projection=collections`, 'POST', config.adminToken, {\n      \"name\": \"CollisionGroup2\",\n      \"description\": \"test group\",\n      \"userIds\": [\n        lvl1.userId   \n      ]\n    })\n    userGroup2 = res.body\n    expect(res.status).to.eql(201)\n    expect(res.body.collectionGrants).to.be.empty\n  })\n  \n  it(\"should assign both groups created to the test collection with restricted grant\", async function () {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', config.adminToken, [{\n      userGroupId: userGroup1.userGroupId,\n      roleId: 1\n    }])\n    expect(res.status).to.eql(201)\n    expect(res.body[0].roleId).to.equal(1)\n    userGroup1.grantId = res.body[0].grantId\n\n    const res2 = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', config.adminToken, [{\n      userGroupId: userGroup2.userGroupId,\n      roleId: 1\n    }])\n    expect(res2.status).to.eql(201)\n    expect(res2.body[0].roleId).to.equal(1)\n    userGroup2.grantId = res2.body[0].grantId\n  })\n\n  it(\"get lvl1 user check that lvl1 user obtained roleId = 1 due to membership in two groups with roleId = 1\", async () => {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/users/${reference.lvl1User.userId}?elevate=true&projection=collectionGrants&projection=userGroups`, 'GET', config.adminToken)\n    expect(res.status).to.eql(200)\n\n    for(const grant of res.body.collectionGrants){\n      expect(grant.roleId).to.equal(1)\n      for(const grantee of grant.grantees){ \n        expect(grantee.name).to.be.oneOf([userGroup1.name, userGroup2.name])\n      }\n    }\n  })\n\n  it(\"should change userGroup1 roleId to 2\", async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup1.grantId}`, 'PUT', config.adminToken, {\n      userGroupId: userGroup1.userGroupId,\n      roleId: 2\n    })\n    expect(res.status).to.eql(200)\n    expect(res.body.roleId).to.equal(2)\n  })\n\n  it(\"get users assigned to the test collection and check that lvl1 user obtained roleId = 2 due to membership in two groups with highest being roleId = 2\", async () => {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/users/${reference.lvl1User.userId}?elevate=true&projection=collectionGrants&projection=userGroups`, 'GET', config.adminToken)\n    expect(res.status).to.eql(200) \n\n    for(const grant of res.body.collectionGrants){\n      expect(grant.roleId).to.equal(2)\n      for(const grantee of grant.grantees){ \n        expect(grantee.name).to.be.oneOf([userGroup1.name, userGroup2.name])\n      }\n    }\n  })\n\n  it(\"should change userGroup2 roleId to 3\", async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup2.grantId}`, 'PUT', config.adminToken, {\n      userGroupId: userGroup2.userGroupId,\n      roleId: 3\n    })\n    expect(res.status).to.eql(200)\n    expect(res.body.roleId).to.equal(3)\n  })\n\n  it(\"get users assigned to the test collection and check that lvl1 user obtained roleId = 3 due to membership in two groups with highest being roleId = 3\", async () => {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/users/${reference.lvl1User.userId}?elevate=true&projection=collectionGrants&projection=userGroups`, 'GET', config.adminToken)\n    expect(res.status).to.eql(200)\n\n    for(const grant of res.body.collectionGrants){\n      expect(grant.roleId).to.equal(3)\n      for(const grantee of grant.grantees){ \n        expect(grantee.name).to.be.oneOf([userGroup1.name, userGroup2.name])\n      }\n    }\n  })\n\n  it(\"should change userGroup1 roleId to 4\", async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants/${userGroup1.grantId}`, 'PUT', config.adminToken, {\n      userGroupId: userGroup1.userGroupId,\n      roleId: 4\n    })\n    expect(res.status).to.eql(200)\n    expect(res.body.roleId).to.equal(4)\n  })\n  \n  it(\"get users assigned to the test collection and check that lvl1 user obtained roleId = 4 due to membership in two groups with highest being roleId = 4\", async () => {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/users/${reference.lvl1User.userId}?elevate=true&projection=collectionGrants&projection=userGroups`, 'GET', config.adminToken)\n    expect(res.status).to.eql(200)\n\n    for(const grant of res.body.collectionGrants){\n      expect(grant.roleId).to.equal(4)\n      for(const grantee of grant.grantees){ \n        expect(grantee.name).to.be.oneOf([userGroup1.name, userGroup2.name])\n      }\n    }\n  })\n\n  it(\"create a new userGroup with lvl1 user in it\", async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true&projection=collections`, 'POST', config.adminToken, {\n      \"name\": \"CollisionGroup3\",\n      \"description\": \"test group\",\n      \"userIds\": [\n        lvl1.userId   \n      ]\n    })\n    userGroup3 = res.body\n    expect(res.status).to.eql(201)\n    expect(res.body.collectionGrants).to.be.empty\n  })\n\n  it(\"assign userGroup3 to the test collection with roleId = 4\", async () => {\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', config.adminToken, [{\n      userGroupId: userGroup3.userGroupId,\n      roleId: 4\n    }])\n    expect(res.status).to.eql(201)\n    expect(res.body[0].roleId).to.equal(4)\n  })\n\n  it(\"get users assigned to the test collection and check that lvl1 user obtained roleId = 4 due to membership in three groups with two groups being roleId = 4\", async () => {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/users/${reference.lvl1User.userId}?elevate=true&projection=collectionGrants&projection=userGroups`, 'GET', config.adminToken)\n\n    expect(res.status).to.eql(200)\n    for(const grant of res.body.collectionGrants){\n      expect(grant.roleId).to.equal(4)\n      expect(grant.grantees.length).to.equal(2)\n      for(const grantee of grant.grantees){ \n        expect(grantee.name).to.be.oneOf([userGroup1.name, userGroup2.name, userGroup3.name])\n      }\n    }\n  })\n})\n\ndescribe(\"Testing user grant for a user that has a 'grantee' from a userGroup grant\", function () {\n\n  before(async function () {\n    await utils.loadAppData()\n  })\n\n  let tempUserID = null\n  let tempGroupID = null\n  // create test user \n  it(\"create a temporary user with no grants\", async function () {\n\n    let uuid = uuidv4()\n    //first 20 chars\n    uuid = uuid.substring(0, 20)\n\n    const res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true&projection=collectionGrants&projection=statistics`, 'POST', admin.token, {\n      \"username\": \"TEMP_USER\" +  uuid,\n      \"collectionGrants\": [\n      ]\n    })\n  \n    expect(res.status).to.eql(201) \n    tempUserID = res.body.userId\n  })\n\n  // create test group\n  it(\"create a temporary userGroup with our temp user in it\", async function () {\n\n    let uuid = uuidv4()\n    //first 20 chars\n    uuid = uuid.substring(0, 20)\n    const res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true`, 'POST', admin.token, {\n      \"name\": \"TEMP_GROUP\" +  uuid,\n      \"description\": \"TEMP_GROUP\" +  uuid,\n      userIds: [tempUserID]\n    })\n   \n    expect(res.status).to.eql(201) \n    tempGroupID = res.body.userGroupId\n  })\n\n  // assign it to the test collection \n  it(\"assign the userGroup to the test collection with restricted grant\", async function () {\n\n    const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/grants`, 'POST', admin.token, [{\n      userGroupId: tempGroupID,\n      roleId: 1\n    }])\n    expect(res.status).to.eql(201)\n  })\n\n  // then get the grant and test grantee = userGroup.\n  it(\"should return the grant for the user in the collection and check that grantee is from a group grant\",async function () {\n    \n    const res = await utils.executeRequest(`${config.baseUrl}/users/${tempUserID}?elevate=true&projection=collectionGrants&projection=userGroups`, 'GET', config.adminToken)\n    expect(res.status).to.eql(200)\n\n    for(const grant of res.body.collectionGrants){\n        expect(grant.roleId).to.equal(1)\n    }\n  })\n})\n"
  },
  {
    "path": "test/api/mocha/integration/stig.test.js",
    "content": "\nimport { fileURLToPath } from 'url';\nimport {config } from '../testConfig.js'\nimport * as utils from '../utils/testUtils.js'\nimport reference from '../referenceData.js'\nimport path from 'path'\nimport fs from 'fs'\nimport { expect } from 'chai'\n\nconst user = {\n  name: \"stigmanadmin\",\n  grant: \"Owner\",\n  userId: \"1\",\n  token:\n    \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ2ODEwMzUsImlhdCI6MTY3MDU0MDIzNiwiYXV0aF90aW1lIjoxNjcwNTQwMjM1LCJqdGkiOiI0N2Y5YWE3ZC1iYWM0LTQwOTgtOWJlOC1hY2U3NTUxM2FhN2YiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJiN2M3OGE2Mi1iODRmLTQ1NzgtYTk4My0yZWJjNjZmZDllZmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjMzNzhkYWZmLTA0MDQtNDNiMy1iNGFiLWVlMzFmZjczNDBhYyIsInNlc3Npb25fc3RhdGUiOiI4NzM2NWIzMy0yYzc2LTRiM2MtODQ4NS1mYmE1ZGJmZjRiOWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIiwiYWRtaW4iXX0sInJlc291cmNlX2FjY2VzcyI6eyJyZWFsbS1tYW5hZ2VtZW50Ijp7InJvbGVzIjpbInZpZXctdXNlcnMiLCJxdWVyeS1ncm91cHMiLCJxdWVyeS11c2VycyJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIHN0aWctbWFuYWdlcjpvcCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIHN0aWctbWFuYWdlcjpvcDpyZWFkIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlciBzdGlnLW1hbmFnZXI6c3RpZyIsInNpZCI6Ijg3MzY1YjMzLTJjNzYtNGIzYy04NDg1LWZiYTVkYmZmNGI5ZiIsIm5hbWUiOiJTVElHTUFOIEFkbWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RpZ21hbmFkbWluIiwiZ2l2ZW5fbmFtZSI6IlNUSUdNQU4iLCJmYW1pbHlfbmFtZSI6IkFkbWluIn0.a1XwJZw_FIzwMXKo-Dr-n11me5ut-SF9ni7ylX-7t7AVrH1eAqyBxX9DXaxFK0xs6YOhoPsh9NyW8UFVaYgtF68Ps6yzoiqFEeiRXkpN5ygICN3H3z6r-YwanLlEeaYR3P2EtHRcrBtCnt0VEKKbGPWOfeiNCVe3etlp9-NQo44\",\n}\n\ndescribe(`POST - importBenchmark - /stigs`, () => {\n\n  describe('Review Key Change', () => {\n\n    before(async function () {\n      await utils.loadAppData()\n      await utils.uploadTestStig('U_VPN_SRG_V2R3_Manual-xccdf-reviewKeyChange.xml')\n    })\n\n    after(async function () {\n      await utils.deleteStigByRevision(\"VPN_SRG_OTHER\", \"V2R3\")\n    })\n    it('Import a new STIG - with new RuleID matching old content', async function () {\n      \n        const testStigfile = reference.reviewKeyChangeFile\n        const __filename = fileURLToPath(import.meta.url)\n        const __dirname = path.dirname(__filename)\n        const filePath = path.join(__dirname, `../../form-data-files/${testStigfile}`)\n        const fileContent = fs.readFileSync(filePath, 'utf-8')\n        \n        const blob = new Blob([fileContent], { type: 'text/xml' })\n        const formData = new FormData()\n        formData.append('importFile', blob, testStigfile)\n\n        const res = await fetch(`${config.baseUrl}/stigs?elevate=true&clobber=true`, {\n          method: 'POST',\n          headers: {\n            Authorization: `Bearer ${user.token}`,\n          },\n          body: formData,\n        })\n        expect(res.status).to.eql(200)\n    })\n    it('Return the Review for an Asset and Rule - rule matches on stigId/checkContent', async function () {\n\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${'SV-106179r1_yyyy'}?projection=stigs&projection=rule`, 'GET', user.token)\n        expect(res.status).to.eql(200)\n        expect(res.body.stigs).to.not.be.null\n        expect(res.body.rule).to.exist\n        expect(res.body.ruleId).to.eql(reference.ruleId)\n        expect(res.body.ruleIds).to.include(\"SV-106179r1_yyyy\");\n        expect(res.body.ruleIds).to.include(reference.ruleId)\n        const regex = new RegExp(reference.reviewMatchString)\n        expect(res.body.detail).to.match(regex)\n    })\n    it('PUT Review: stigs and rule projections Copy', async () => {\n\n        const putBody = {\n            \"result\": \"pass\",\n            \"detail\": \"test\\nvisible to lvl1\",\n            \"comment\": \"sure\",\n            \"autoResult\": false,\n            \"status\": \"submitted\"\n        }\n\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${'SV-106179r1_yyyy'}`, 'PUT', user.token, putBody)\n\n        expect(res.status).to.eql(403)\n    })    \n    it('Set all properties of an Asset - assign new STIG', async function () {\n        const res = await utils.executeRequest(`${config.baseUrl}/assets/${reference.testAsset.assetId}`, 'PUT', user.token, {\n            \"name\": 'Collection_X_lvl1_asset-1',\n            \"collectionId\": reference.testCollection.collectionId,\n            \"description\": \"test desc\",\n            \"ip\": \"1.1.1.1\",\n            \"noncomputing\": true,\n            \"metadata\": {\n                \"pocName\": \"poc2Put\",\n                \"pocEmail\": \"pocEmailPut@email.com\",\n                \"pocPhone\": \"12342\",\n                \"reqRar\": \"true\"\n            },\n            \"stigs\": [\n                \"VPN_SRG_TEST\",\n                \"VPN_SRG_OTHER\",\n                \"Windows_10_STIG_TEST\",\n                \"RHEL_7_STIG_TEST\"\n            ]\n        })\n        expect(res.status).to.eql(200)\n    })\n    it('PUT Review: stigs and rule projections- put review to alternate ruleId', async function () {\n\n        const reqData = {\n            \"result\": \"pass\",\n            \"detail\": \"test\\nvisible to lvl1\",\n            \"comment\": \"sure\",\n            \"autoResult\": false,\n            \"status\": \"submitted\"\n        }\n        const respData = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${'SV-106179r1_yyyy'}?projection=stigs&projection=rule`, 'PUT', user.token, reqData)\n\n          const expectedReview = {\n            access: \"rw\",\n            assetId: \"42\",\n            assetName: \"Collection_X_lvl1_asset-1\",\n            assetLabelIds: [\n                  \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\n                  \"5130dc84-9a68-11ec-b1bc-0242ac110002\"      \n            ],\n            assetLabels: reference.testAsset.fullLabels,\n            ruleId: \"SV-106179r1_yyyy\",\n            ruleIds: [\n              \"SV-106179r1_rule\",\n              \"SV-106179r1_yyyy\"\n              ],\n            result: reqData.result,\n            resultEngine: null,\n            detail: reqData.detail,\n            autoResult: reqData.autoResult,\n            comment: reqData.comment,\n            userId: user.userId,\n            username: user.name,\n            ts: respData.body.ts,\n            touchTs: respData.body.touchTs,\n            status: {\n                ts: respData.body.status.ts,\n                text: null,\n                user: {\n                    userId: user.userId,\n                    username: user.name\n                },\n                label: reqData.status\n            },\n            stigs: [        \n                {\n                      isDefault: true,\n                      ruleCount: 2,\n                      benchmarkId: \"VPN_SRG_OTHER\",\n                      revisionStr: \"V2R3\",\n                      benchmarkDate: \"2021-07-19\",\n                      revisionPinned: false\n                  }\n              ],\n            rule: {\n              title: \"This rule title has been replaced.\",\n              ruleId: \"SV-106179r1_yyyy\",\n              version: \"SRG-NET-000019-VPN-000040\",\n              severity: \"medium\"\n            }\n          }\n\n        expect(respData.status).to.eql(200)\n        expect(respData.body).to.deep.eql(expectedReview)\n    })\n    it('Return the Review for an Asset and Rule - rule matches on stigId/checkContent Copy', async function () {\n\n        const res = await utils.executeRequest(`${config.baseUrl}/collections/${reference.testCollection.collectionId}/reviews/${reference.testAsset.assetId}/${'SV-106179r1_yyyy'}?projection=stigs&projection=rule`, 'GET', user.token)\n        expect(res.status).to.eql(200)\n        expect(res.body.stigs).to.not.be.null\n        expect(res.body.rule).to.exist\n        expect(res.body.ruleId).to.eql(\"SV-106179r1_yyyy\")\n        expect(res.body.ruleIds).to.include(\"SV-106179r1_yyyy\");\n        expect(res.body.ruleIds).to.include(reference.ruleId)\n        const regex = new RegExp(reference.reviewMatchString)\n        expect(res.body.detail).to.match(regex)\n    })\n  })\n\n  describe('Checks for other revs, content matches', () => {\n\n    before(async function () {\n      await utils.loadAppData()\n      await utils.deleteStigByRevision(\"VPN_SRG_OTHER\", \"V2R2\")\n    })\n\n    after(async function () { \n      await utils.deleteStig(\"VPN_SRG_OTHER\")\n    })\n\n    it('Import a new STIG - clobber', async () => {\n                \n      const testStigfile = 'U_VPN_SRG_V1R1_Manual-xccdf.xml'\n      const __filename = fileURLToPath(import.meta.url)\n      const __dirname = path.dirname(__filename)\n      const filePath = path.join(__dirname, `../../form-data-files/${testStigfile}`)\n      const fileContent = fs.readFileSync(filePath, 'utf-8')\n      \n      const blob = new Blob([fileContent], { type: 'text/xml' })\n      const formData = new FormData()\n      formData.append('importFile', blob, testStigfile)\n\n      const res = await fetch(`${config.baseUrl}/stigs?elevate=true&clobber=true`, {\n        method: 'POST',\n        headers: {\n          Authorization: `Bearer ${user.token}`,\n        },\n        body: formData,\n      })\n      let expectedRevData = \n      {\n        \"benchmarkId\": \"VPN_SRG_TEST\",\n        \"revisionStr\": \"V1R1\",\n        \"action\": \"replaced\",\n        marking: \"U\"\n      }\n      expect(res.status).to.eql(200)\n      const data = await res.json()\n      expect(data).to.deep.eql(expectedRevData)\n    })\n    it('Import another stig with check-system collision', async () => {\n                  \n      const testStigfile = \"U_VPN_SRG-OTHER_V1R1_Manual-xccdf.xml\"    \n      const __filename = fileURLToPath(import.meta.url)\n      const __dirname = path.dirname(__filename)\n      const filePath = path.join(__dirname, `../../form-data-files/${testStigfile}`)\n      const fileContent = fs.readFileSync(filePath, 'utf-8')\n      \n      const blob = new Blob([fileContent], { type: 'text/xml' })\n      const formData = new FormData()\n      formData.append('importFile', blob, testStigfile)\n\n      const res = await fetch(`${config.baseUrl}/stigs?elevate=true&clobber=true`, {\n        method: 'POST',\n        headers: {\n          Authorization: `Bearer ${user.token}`,\n        },\n        body: formData,\n      })\n\n      expect(res.status).to.eql(200)\n      \n      let expectedRevData = \n      {\n        \"benchmarkId\": \"VPN_SRG_OTHER\",\n        \"revisionStr\": \"V2R2\",\n        \"action\": \"inserted\",\n        \"marking\": \"U\"\n    }\n      const data = await res.json()\n      expect(data).to.eql(expectedRevData)\n    })\n    it('Return rule data for the specified revision of a STIG - after import of \"other\" stig with checkId collision', async () => {\n\n      const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/${reference.testCollection.defaultRevision}/rules?projection=check`, 'GET', user.token)\n      expect(res.status).to.eql(200)\n      expect(res.body).to.be.an('array').of.length(reference.checklistLength)\n\n      let title = \"The VPN Gateway must ensure inbound and outbound traffic is configured with a security policy in compliance with information flow control policies.\"\n\n      for(const rule of res.body){\n        if(rule.ruleId === reference.ruleId){\n          expect(rule.title).to.eql(title)\n          if(rule.check.system === \"C-95877r1_chk\"){\n            expect(rule.check.content).to.not.eql(\"This check content has been replaced!\")\n          }\n        }\n      }\n    })\n    it(\"Return rule data for the specified revision of a STIG - expect matches to other rev - requests V2R2\", async () => {\n\n      const res = await utils.executeRequest(`${config.baseUrl}/stigs/${'VPN_SRG_OTHER'}/revisions/V2R2/rules?projection=check`, 'GET', user.token)\n      expect(res.status).to.eql(200)\n      \n      expect(res.body).to.be.an('array').of.length(2)\n      let testRuleId = \"SV-106179r1_xxxx\"\n      let title = \"This rule title has been replaced.\"\n\n      for(const rule of res.body){\n        if(rule.ruleId === testRuleId){\n          expect(rule.title).to.eql(title)\n          if(rule.check.system === \"C-95877r1_chk\"){\n            expect(rule.check.content).to.eql(\"This check content has been replaced!\")\n          }\n        }\n      }\n    })\n    it(\"Return rule data for the specified Rule in a revision of a STIG. request specific rule, expect one content match\", async () => {\n\n      const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/${reference.testCollection.defaultRevision}/rules/${reference.ruleId}?projection=check`, 'GET', user.token)\n      expect(res.status).to.eql(200)\n      expect(res.body.ruleId).to.eql(reference.ruleId)\n      expect(res.body.check.content).to.not.eql(\"This check content has been replaced!\")\n    })\n  })\n\n  describe('Replacement Tests', () => {\n\n    before(async function () {\n      try{\n        await utils.deleteStigByRevision(\"VPN_SRG_TEST\", \"V1R0\")\n      }\n      catch(e){\n        console.log(\"No V1R0 to delete\")\n      }\n    \n      await utils.loadAppData()\n    })\n\n    it('Import and replace a STIG revision', async function () {\n      \n      const testStigfile = 'U_VPN_SRG_V1R1_Manual-xccdf-replace.xml'\n      const __filename = fileURLToPath(import.meta.url)\n      const __dirname = path.dirname(__filename)\n      const filePath = path.join(__dirname, `../../form-data-files/${testStigfile}`)\n      const fileContent = fs.readFileSync(filePath, 'utf-8')\n      \n      const blob = new Blob([fileContent], { type: 'text/xml' })\n      const formData = new FormData()\n      formData.append('importFile', blob, testStigfile)\n\n      const res = await fetch(`${config.baseUrl}/stigs?elevate=true&clobber=true`, {\n        method: 'POST',\n        headers: {\n          Authorization: `Bearer ${user.token}`,\n        },\n        body: formData,\n      })\n\n      let expectedRevData = \n      {\n          \"benchmarkId\": \"VPN_SRG_TEST\",\n          \"revisionStr\": \"V1R1\",\n          \"action\": \"replaced\",\n          \"marking\": \"U\"\n      }\n      expect(res.status).to.eql(200)\n      const data = await res.json() \n      expect(data).to.deep.eql(expectedRevData)\n    })\n    it('Return a list of revisions for the specified STIG - check for updated revision', async function () {\n      const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions`, 'GET', user.token)\n      expect(res.status).to.eql(200)\n      expect(res.body).to.be.an('array').of.length(1)\n      for(const rev of res.body){\n        expect(rev.ruleCount).to.eql(2)\n      }\n    })\n    it('Return rule data for the specified revision of a STIG after update', async function () {\n      const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/${reference.testCollection.defaultRevision}/rules?projection=detail&projection=ccis&projection=check&projection=fix`, 'GET', user.token)\n      expect(res.status).to.eql(200)\n      let title = \"This rule title has been replaced.\"\n      expect(res.body).to.be.an('array').of.length(2)\n      for(const rule of res.body){\n        if (rule.ruleId === reference.ruleId){\n              expect(rule.title).to.eql(title)\n        }\n      }\n    })\n    it('Return rule data for the specified Rule in a revision of a STIG after update', async function () {\n\n      const res = await utils.executeRequest(`${config.baseUrl}/stigs/${reference.benchmark}/revisions/${reference.testCollection.defaultRevision}/rules/${reference.ruleId}?projection=detail&projection=ccis&projection=check&projection=fix`, 'GET', user.token)\n        expect(res.status).to.eql(200)\n        let title = \"This rule title has been replaced.\"\n        expect(res.body.title).to.eql(title)\n    })\n  })\n})"
  },
  {
    "path": "test/api/mocha/integration/userStatus.test.js",
    "content": "import {config } from '../testConfig.js'\nimport {expect, use} from 'chai'\nimport * as utils from '../utils/testUtils.js'\nimport chaiDateTime from 'chai-datetime'\nuse(chaiDateTime)\n\nconst users = [\n  {\n    userId: '1',\n    username: \"admin\",\n    token: 'eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjIwNTc3ODc4MjgsImlhdCI6MTc0MjQyNzgyOCwiYXV0aF90aW1lIjoxNzQyNDI3MjIxLCJqdGkiOiJmYjA2NGI1NS1jODk2LTRlNTctYTY5Ny04ZWY0ZjE1M2NiNmQiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvcmVhbG1zL3N0aWdtYW4iLCJzdWIiOiJiZjg3YTE2Zi0zOWU2LTQ2ZDktODk3MS1mMGVmNTFkZDNmODUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJzaWQiOiIzOGE3NDA5Yy00YTYzLTQzMTEtYWI2Mi01ZGU3OGY1NzNkNWMiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsiY3JlYXRlX2NvbGxlY3Rpb24iLCJhZG1pbiJdfSwic2NvcGUiOiJzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOm9wIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlcjpzdGlnIiwibmFtZSI6IkFkbWluIEJ1cmtlIiwicHJlZmVycmVkX3VzZXJuYW1lIjoiYWRtaW4iLCJnaXZlbl9uYW1lIjoiQWRtaW4iLCJmYW1pbHlfbmFtZSI6IkJ1cmtlIn0.gT0EHb8wxKrv9McDdka1r_a2h5ZAUIYuEqgifrCOPcq7qlN1VEfstQPUZFMQ3iLisF33pxLnWDoQxSyw5HP5ftsQC3zN-O_NM9Q1MMNZGFEttNMaYRnBdoOWg9yrzu_4ys1fHRuj_T8orObhw1w3nOczkjoVLY0kA1TrC40huGU',\n    status: 'available',\n    statusDate: new Date('2025-01-01T00:00:00Z'),\n    statusUser: null\n  },\n  {\n    userId: '2',\n    username: \"user01\",\n    token: 'eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjIwNTc3ODgxMjMsImlhdCI6MTc0MjQyODEyMywiYXV0aF90aW1lIjoxNzQyNDI4MTIzLCJqdGkiOiIzMmVmZmY2OC1jZWE2LTRlN2MtOTM2ZC0zNTYwMDY0ZDQ1NmMiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvcmVhbG1zL3N0aWdtYW4iLCJhdWQiOiJhY2NvdW50Iiwic3ViIjoiNzZkYThhODgtZmI0OC00NDc3LWE5MjAtZDg4YTZiODc0N2ZhIiwidHlwIjoiQmVhcmVyIiwiYXpwIjoic3RpZy1tYW5hZ2VyIiwic2lkIjoiNzU2ZDI4YmUtNDU2OC00ZDM5LTk2YzUtZDdlOGQ4ZDA3ODdmIiwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoic3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIiwibmFtZSI6Ik1hcmxleSBBdGtpbnNvbiIsInByZWZlcnJlZF91c2VybmFtZSI6InVzZXIwMSIsImdpdmVuX25hbWUiOiJNYXJsZXkiLCJmYW1pbHlfbmFtZSI6IkF0a2luc29uIn0.cJVTAfXst--mYmwIgWE07e_hqUlzTEoPN4AkcyI4w_6N_cOLgApSBZBiyIX_VZT4vZ41co73lGyXYQvM_ji9myQWVsjFoXmGG4Dcf72Ci42B5NxQSpuU3A_3zzNdj7QUvtwm5tIGpGkuBBJclZ_2719n7VFmpJ1ye4r-YKin248',\n    status: 'unavailable',\n    statusDate: new Date('2025-01-01T00:00:01Z'),\n    statusUser: '1'\n  }\n]\nconst statusErrorMessage = 'User status is \"unavailable\".'\nconst inconsistentErrorMessage = 'Setting collectionGrants or userGroups is inconsistent with status \"unavailable\".'\n\ndescribe('User Status GET Tests', function () {\n  before(async function () {\n    await utils.loadAppData('user-status-get-post.jsonl')\n  })\n  for (const user of users) {\n    describe(`GET - getUsers - /users - as ${user.username}`, function () {\n      let res\n      before(async function () {\n        res = await utils.executeRequest(`${config.baseUrl}/users`, 'GET', user.token)\n      })\n      if (user.status === 'unavailable') {\n        it(`returned a 403 status`, function () {\n          expect(res.status).to.equal(403)\n        })\n        it('returned the status error message', function () {\n          expect(res.body.error).to.eql(statusErrorMessage)\n        })\n      }\n      else {    \n        it('returned a list of two users', async function () {\n          expect(res.status).to.equal(200)\n          expect(res.body).to.be.an('array')\n          expect(res.body.length).to.eql(2)\n        })\n        for (const [index, user] of users.entries()) {\n          it(`returned item ${index} with userId = ${user.userId}`, function () {\n            expect(res.body[index].userId).to.eql(user.userId)\n          })\n          it(`returned item ${index} with username = ${user.username}`, function () {\n            expect(res.body[index].username).to.eql(user.username)\n          })\n          it(`returned item ${index} with status = ${user.status}`, function () {\n            expect(res.body[index].status).to.eql(user.status)\n          })\n          it(`returned item ${index} with statusDate = ${user.statusDate.toISOString()}`, function () {\n            expect(new Date(res.body[index].statusDate)).to.equalTime(user.statusDate)\n          })\n          it(`returned item ${index} with statusUser = ${user.statusUser}`, function () {\n            expect(res.body[index].statusUser).to.eql(user.statusUser)\n          })\n        }\n      }\n    })\n  }\n\n  describe('GET - getUsers - /users - available only', function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/users?status=available`, 'GET', users[0].token)\n    })\n    it('returned a list of one user', async function () {\n      expect(res.status).to.equal(200)\n      expect(res.body).to.be.an('array')\n      expect(res.body.length).to.eql(1)\n    })\n    it(`returned item 0 with username = admin`, function () {\n      expect(res.body[0].username).to.eql('admin')\n    })\n  })\n  \n  describe('GET - getUsers - /users - unavailable only', function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/users?status=unavailable`, 'GET', users[0].token)\n    })\n    it('returned a list of one user', async function () {\n      expect(res.status).to.equal(200)\n      expect(res.body).to.be.an('array')\n      expect(res.body.length).to.eql(1)\n    })\n    it(`returned item 0 with username = user01`, function () {\n      expect(res.body[0].username).to.eql('user01')\n    })\n\n  })\n\n  describe('GET - getUser - /user - as admin', function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/user`, 'GET', users[0].token)\n    })\n    it('returned a single user', async function () {\n      expect(res.status).to.equal(200)\n      expect(res.body).to.be.an('object')\n    })\n \n    it('returned user = admin', async function () {\n      expect(res.status).to.equal(200)\n      expect(res.body).to.be.an('object')\n      expect(res.body.username).to.eql(users[0].username)\n    })\n    it('returned user with status = available', async function () {\n      expect(res.body.status).to.eql(users[0].status)\n    })\n    it('returned user with statusDate = 2025-01-01T00:00:00Z', async function () {\n      expect(new Date(res.body.statusDate)).to.equalTime(users[0].statusDate)\n    })\n    it('returned user with statusUser = null', async function () {\n      expect(res.body.statusUser).to.eql(users[0].statusUser)\n    })\n  })\n\n  for (const user of users) {\n    describe('GET - getUserByUserId - /users/' + user.userId + ' - as admin', function () {\n      let res\n      before(async function () {\n        res = await utils.executeRequest(`${config.baseUrl}/users/${user.userId}?elevate=true&projection=statistics`, 'GET', users[0].token)\n      })\n      \n      it(`returned user = ${user.username}`, function () {\n        expect(res.status).to.equal(200)\n        expect(res.body).to.be.an('object')\n        expect(res.body.username).to.eql(user.username)\n      })\n      it(`returned user with status = ${user.status}`, function () {\n        expect(res.body.status).to.eql(user.status)\n      })\n      it(`returned user with statusDate = ${user.statusDate.toISOString()}`, function () {\n        expect(new Date(res.body.statusDate)).to.equalTime(user.statusDate)\n      })\n      it(`returned user with statusUser = ${user.statusUser}`, function () {\n        expect(res.body.statusUser).to.eql(user.statusUser)\n      })\n    })\n  }\n})\n\ndescribe('User Status POST Tests', function () {\n  before(async function () {\n    await utils.loadAppData('user-status-get-post.jsonl')\n  })\n  describe(`POST - createUser - /users`, function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/users?elevate=true`, 'POST', users[0].token, {\n        username: 'user02',\n        collectionGrants: [],\n        userGroups:[]\n      })\n    })\n    it('returned a 201 status', function () {\n      expect(res.status).to.equal(201)\n    })\n    it('returned the username', function () {\n      expect(res.body.username).to.eql('user02')\n    })\n    it('returned status = available', function () {\n      expect(res.body.status).to.eql('available')\n    })\n    it('returned statusDate = now', function () {\n      expect(new Date(res.body.statusDate)).to.be.closeToTime(new Date(), 1000)\n    })\n    it('returned statusUser = null', async function () {\n      expect(res.body.statusUser).to.eql(users[0].statusUser)\n    })\n  })\n  describe('POST - createCollection - /collections with unavailable user grant', function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/collections`, 'POST', users[0].token, {\n        name: 'collection02',\n        description: 'Collection 02',\n        grants: [\n          {\n            \"userId\": \"1\",\n            \"roleId\": 4\n          },\n          {\n            \"userId\": \"2\",\n            \"roleId\": 4\n          }\n        ]\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n  })\n  describe('POST - createUserGroup - /user-groups with unavailable user', function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/user-groups?elevate=true`, 'POST', users[0].token, {\n        name: 'group01',\n        userIds: [\"2\"]\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n  })\n  describe('POST - postGrantsByCollection - /collections/1/grants with unavailable user', function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/collections/1/grants/`, 'POST', users[0].token, [{\n        userId: '2',\n        roleId: 3\n      }])\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n  })    \n})\n\ndescribe('User Status PATCH Tests', function () {\n  before(async function () {\n    await utils.loadAppData('user-status-patch-put.jsonl')\n  })\n  describe(`PATCH - updateUser - /users/3 - available => unavailable`, function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/users/3?elevate=true&projection=collectionGrants&projection=userGroups`, 'PATCH', users[0].token, {\n        status: 'unavailable'\n      })\n    })\n    it('returned a 200 status', function () {\n      expect(res.status).to.equal(200)\n    })\n    it('returned the userId', function () {\n      expect(res.body.userId).to.be.a('string')\n    })\n    it('returned the username', function () {\n      expect(res.body.username).to.eql('user02')\n    })\n    it('returned status = unavailable', function () {\n      expect(res.body.status).to.eql('unavailable')\n    })\n    it('returned statusDate = now', function () {\n      expect(new Date(res.body.statusDate)).to.be.closeToTime(new Date(), 1)\n    })\n    it('returned statusUser = 1', function () {\n      expect(res.body.statusUser).to.eql('1')\n    })\n    it ('returned empty collection grants', function () {\n      expect(res.body.collectionGrants).to.eql([])\n    })\n    it ('returned empty user groups', function () {\n      expect(res.body.userGroups).to.eql([])\n    })\n  })\n  describe(`PATCH - updateUser - /users/4 - available => unavailable with grants`, function () {\n    let res\n    before(async function () {\n      await utils.loadAppData('user-status-patch-put.jsonl')\n      res = await utils.executeRequest(`${config.baseUrl}/users/4?elevate=true`, 'PATCH', users[0].token, {\n        status: 'unavailable',\n        collectionGrants: [{collectionId: '1', roleId: 3}]\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n  })\n  describe(`PATCH - updateUser - /users/4 - available => unavailable with groups`, function () {\n    let res\n    before(async function () {\n      await utils.loadAppData('user-status-patch-put.jsonl')\n      res = await utils.executeRequest(`${config.baseUrl}/users/4?elevate=true`, 'PATCH', users[0].token, {\n        status: 'unavailable',\n        userGroups: ['1']\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n  })\n  describe(`PATCH - updateUser - /users/2 - unavailable user given grants`, function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/users/2?elevate=true`, 'PATCH', users[0].token, {\n        collectionGrants: [{collectionId: '1', roleId: 3}]\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n  })\n  describe(`PATCH - updateUser - /users/2 - unavailable user given groups`, function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/users/2?elevate=true`, 'PATCH', users[0].token, {\n        userGroups: ['1'],\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n  })\n  // user 01 with id of 2 is unavailable at this point\n  describe(`PATCH - updateUser - /users/2 - unavailable => available`, function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/users/2?elevate=true&projection=collectionGrants&projection=userGroups`, 'PATCH', users[0].token, {\n        status: 'available',\n      })\n    })\n    it('returned a 200 status', function () {\n      expect(res.status).to.equal(200)\n    })\n    it('returned the userId', function () {\n      expect(res.body.userId).to.be.a('string')\n    })\n    it('returned the username', function () {\n      expect(res.body.username).to.eql('user01')\n    })\n    it('returned status = available', function () {\n      expect(res.body.status).to.eql('available')\n    })\n    it('returned statusDate = now', function () {\n      expect(new Date(res.body.statusDate)).to.be.closeToTime(new Date(), 1)\n    })\n    it('returned statusUser = 1', function () {\n      expect(res.body.statusUser).to.eql('1')\n    })\n    it ('returned empty collection grants', function () {\n      expect(res.body.collectionGrants).to.eql([])\n    })\n    it ('returned empty user groups', function () {\n      expect(res.body.userGroups).to.eql([])\n    })\n  })\n  describe(`PATCH - updateUser - /users/2 - unavailable => available with grants/groups`, function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/users/2?elevate=true&projection=collectionGrants&projection=userGroups`, 'PATCH', users[0].token, {\n        status: 'available',\n        collectionGrants: [ { collectionId: '1', roleId: 3 } ],\n        userGroups:[ '1' ]\n      })\n    })\n    it('returned a 200 status', function () {\n      expect(res.status).to.equal(200)\n    })\n    it('returned the userId', function () {\n      expect(res.body.userId).to.be.a('string')\n    })\n    it('returned the username', function () {\n      expect(res.body.username).to.eql(\"user01\")\n    })\n    it('returned status = available', function () {\n      expect(res.body.status).to.eql('available')\n    })\n    it('returned statusDate = now', function () {\n      expect(new Date(res.body.statusDate)).to.be.closeToTime(new Date(), 1)\n    })\n    it('returned statusUser = 1', function () {\n      expect(res.body.statusUser).to.eql('1')\n    })\n    it ('returned correct collection grants to collection 1', function () {\n      expect(res.body.collectionGrants).to.eql([\n        {\n          roleId: 3,\n          grantees: [\n            {\n              userId: \"2\",\n              username: \"user01\",\n            },\n          ],\n          collection: {\n            name: \"status-collection\",\n            collectionId: \"1\",\n          },\n        },\n      ])\n    })\n    it ('returned correct user groups to groupId 1', function () {\n      expect(res.body.userGroups).to.eql([\n        {\n          name: \"status-group\",\n          userGroupId: \"1\",\n        },\n      ])\n    })\n  })\n  describe(`PATCH - updateCollection - /collections/1 - with unavailable user grant`, function () {\n    let res\n    before(async function () {\n      await utils.loadAppData('user-status-patch-put.jsonl')\n      res = await utils.executeRequest(`${config.baseUrl}/collections/1`, 'PATCH', users[0].token, {\n        grants: [\n          {\n            \"userId\": \"1\",\n            \"roleId\": 4\n          },\n          {\n            \"userId\": \"2\",\n            \"roleId\": 4\n          }\n        ]\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n  })\n  describe('PATCH - patchUserGroup - /user-groups/1 with unavailable user', function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/user-groups/1?elevate=true`, 'PATCH', users[0].token, {\n        userIds: [\"2\"]\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n  })\n})\n\ndescribe('User Status PUT Tests', function () {\n  before(async function () {\n    await utils.loadAppData('user-status-patch-put.jsonl')\n  })\n  describe(`PUT - replaceUser - /users/3 - available => unavailable`, function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/users/3?elevate=true&projection=collectionGrants&projection=userGroups`, 'PUT', users[0].token, {\n        status: 'unavailable',\n        username: 'user02',\n        collectionGrants: [],\n        userGroups:[]\n      })\n    })\n    it('returned a 200 status', function () {\n      expect(res.status).to.equal(200)\n    })\n    it('returned the userId', function () {\n      expect(res.body.userId).to.be.a('string')\n    })\n    it('returned the username', function () {\n      expect(res.body.username).to.eql('user02')\n    })\n    it('returned status = unavailable', function () {\n      expect(res.body.status).to.eql('unavailable')\n    })\n    it('returned statusDate = now', function () {\n      expect(new Date(res.body.statusDate)).to.be.closeToTime(new Date(), 1)\n    })\n    it('returned statusUser = 1', function () {\n      expect(res.body.statusUser).to.eql('1')\n    })\n    it ('returned empty collection grants', function () {\n      expect(res.body.collectionGrants).to.eql([])\n    })\n    it ('returned empty user groups', function () {\n      expect(res.body.userGroups).to.eql([])\n    })\n  })\n  describe(`PUT - replaceUser - /users/4 - available => unavailable with grants`, function () {\n    let res\n    before(async function () {\n      await utils.loadAppData('user-status-patch-put.jsonl')\n      res = await utils.executeRequest(`${config.baseUrl}/users/4?elevate=true&projection=collectionGrants&projection=userGroups`, 'PUT', users[0].token, {\n        username: 'user03',\n        status: 'unavailable',\n        collectionGrants: [{collectionId: '1', roleId: 3}],\n        userGroups: []\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n    it('returned the error message', function () {\n      expect(res.body.error).to.eql(inconsistentErrorMessage)\n    })\n  })\n  describe(`PUT - replaceUser - /users/4 - available => unavailable with groups`, function () {\n    let res\n    before(async function () {\n      await utils.loadAppData('user-status-patch-put.jsonl')\n      res = await utils.executeRequest(`${config.baseUrl}/users/4?elevate=true&projection=collectionGrants&projection=userGroups`, 'PUT', users[0].token, {\n        username: 'user03',\n        status: 'unavailable',\n        collectionGrants: [],\n        userGroups: ['1']\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n    it('returned the error message', function () {\n      expect(res.body.error).to.eql(inconsistentErrorMessage)\n    })\n  })\n  describe(`PUT - replaceUser - /users/2 - unavailable given grants`, function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/users/2?elevate=true`, 'PUT', users[0].token, {\n        username: 'user01',\n        collectionGrants: [{collectionId: '1', roleId: 3}]\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n  })\n  describe(`PUT - replaceUser - /users/2 - unavailable given groups`, function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/users/2?elevate=true`, 'PATCH', users[0].token, {\n        username: 'user01',\n        userGroups: ['1'],\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n  })\n  describe(`PUT - replaceCollection - /collections/1 - with unavailable user grant`, function () {\n    let res\n    before(async function () {\n      // await utils.loadAppData('user-status-patch-put.jsonl')\n      res = await utils.executeRequest(`${config.baseUrl}/collections/1`, 'PATCH', users[0].token, {\n        name: 'status-collection',\n        grants: [\n          {\n            \"userId\": \"1\",\n            \"roleId\": 4\n          },\n          {\n            \"userId\": \"3\",\n            \"roleId\": 4\n          },\n          {\n            \"userId\": \"2\",\n            \"roleId\": 4\n          }\n        ]\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n  })\n  describe('PUT - putUserGroup - /user-groups/1 with unavailable user', function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/user-groups/1?elevate=true`, 'PATCH', users[0].token, {\n        name: 'status-group',\n        userIds: [\"2\"]\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n  })\n  describe('PUT - putGrantByCollectionGrant - /collections/1/grants/2 with unavailable user', function () {\n    let res\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/collections/1/grants/2`, 'PUT', users[0].token, {\n        userId: '2',\n        roleId: 3\n      })\n    })\n    it('returned a 422 status', function () {\n      expect(res.status).to.equal(422)\n    })\n  })\n  // user 02 is unavailable at this point\n  describe(`PUT - replaceUser - /users/2 - unavailable => available`, function () {\n    let res\n    let username = 'user02' + utils.getUUIDSubString(5)\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/users/2?elevate=true&projection=collectionGrants&projection=userGroups`, 'PUT', users[0].token, {\n        status: 'available',\n        username: username,\n        collectionGrants: [],\n        userGroups:[]\n      })\n    })\n    it('returned a 200 status', function () {\n      expect(res.status).to.equal(200)\n    })\n    it('returned the userId', function () {\n      expect(res.body.userId).to.be.a('string')\n    })\n    it('returned the username', function () {\n      expect(res.body.username).to.eql(username)\n    })\n    it('returned status = available', function () {\n      expect(res.body.status).to.eql('available')\n    })\n    it('returned statusDate = now', function () {\n      expect(new Date(res.body.statusDate)).to.be.closeToTime(new Date(), 1)\n    })\n    it('returned statusUser = 1', function () {\n      expect(res.body.statusUser).to.eql('1')\n    })\n    it ('returned empty collection grants', function () {\n      expect(res.body.collectionGrants).to.eql([])\n    })\n    it ('returned empty user groups', function () {\n      expect(res.body.userGroups).to.eql([])\n    })\n  })\n  describe(`PUT - replaceUser - /users/2 - unavailable => available with grants/groups`, function () {\n    let res\n    let username = 'user02' + utils.getUUIDSubString(5)\n    before(async function () {\n      res = await utils.executeRequest(`${config.baseUrl}/users/2?elevate=true&projection=collectionGrants&projection=userGroups`, 'PUT', users[0].token, {\n        status: 'available',\n        username: username,\n        collectionGrants: [ { collectionId: '1', roleId: 3 } ],\n        userGroups:[ '1' ]\n      })\n    })\n    it('returned a 200 status', function () {\n      expect(res.status).to.equal(200)\n    })\n    it('returned the userId', function () {\n      expect(res.body.userId).to.be.a('string')\n    })\n    it('returned the username', function () {\n      expect(res.body.username).to.eql(username)\n    })\n    it('returned status = available', function () {\n      expect(res.body.status).to.eql('available')\n    })\n    it('returned statusDate = now', function () {\n      expect(new Date(res.body.statusDate)).to.be.closeToTime(new Date(), 1)\n    })\n    it('returned statusUser = 1', function () {\n      expect(res.body.statusUser).to.eql('1')\n    })\n    it ('returned correct collection grants to collection 1', function () {\n      expect(res.body.collectionGrants).to.eql([\n        {\n          roleId: 3,\n          grantees: [\n            {\n              userId: \"2\",\n              username: username,\n            },\n          ],\n          collection: {\n            name: \"status-collection\",\n            collectionId: \"1\",\n          },\n        },\n      ])\n    })\n    it ('returned correct user groups to groupId 1', function () {\n      expect(res.body.userGroups).to.eql([\n        {\n          name: \"status-group\",\n          userGroupId: \"1\",\n        },\n      ])\n    })\n  })\n})\n"
  },
  {
    "path": "test/api/mocha/iterations.js",
    "content": "export const iterations = [\n  {\n    // Has admin and createCollection privileges, standard appdata: Owner roleId in all collections\n    name: \"stigmanadmin\",\n    userId: \"1\",\n    grantId: \"6\",\n    token:\n      \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ2ODEwMzUsImlhdCI6MTY3MDU0MDIzNiwiYXV0aF90aW1lIjoxNjcwNTQwMjM1LCJqdGkiOiI0N2Y5YWE3ZC1iYWM0LTQwOTgtOWJlOC1hY2U3NTUxM2FhN2YiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJiN2M3OGE2Mi1iODRmLTQ1NzgtYTk4My0yZWJjNjZmZDllZmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjMzNzhkYWZmLTA0MDQtNDNiMy1iNGFiLWVlMzFmZjczNDBhYyIsInNlc3Npb25fc3RhdGUiOiI4NzM2NWIzMy0yYzc2LTRiM2MtODQ4NS1mYmE1ZGJmZjRiOWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIiwiYWRtaW4iXX0sInJlc291cmNlX2FjY2VzcyI6eyJyZWFsbS1tYW5hZ2VtZW50Ijp7InJvbGVzIjpbInZpZXctdXNlcnMiLCJxdWVyeS1ncm91cHMiLCJxdWVyeS11c2VycyJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIHN0aWctbWFuYWdlcjpvcCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIHN0aWctbWFuYWdlcjpvcDpyZWFkIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlciBzdGlnLW1hbmFnZXI6c3RpZyIsInNpZCI6Ijg3MzY1YjMzLTJjNzYtNGIzYy04NDg1LWZiYTVkYmZmNGI5ZiIsIm5hbWUiOiJTVElHTUFOIEFkbWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RpZ21hbmFkbWluIiwiZ2l2ZW5fbmFtZSI6IlNUSUdNQU4iLCJmYW1pbHlfbmFtZSI6IkFkbWluIn0.a1XwJZw_FIzwMXKo-Dr-n11me5ut-SF9ni7ylX-7t7AVrH1eAqyBxX9DXaxFK0xs6YOhoPsh9NyW8UFVaYgtF68Ps6yzoiqFEeiRXkpN5ygICN3H3z6r-YwanLlEeaYR3P2EtHRcrBtCnt0VEKKbGPWOfeiNCVe3etlp9-NQo44\"\n  },\n  {\n    // no privileges, standard appdata: Restricted roleId in \"testCollection\" (ie. Collection X)\n    name: \"lvl1\",\n    userId: \"85\",\n    grantId: \"32\",\n    token:\n      \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDg5ODQsImlhdCI6MTY3MDU2ODE4NCwiYXV0aF90aW1lIjoxNjcwNTY4MTg0LCJqdGkiOiIxMDhmMDc2MC0wYmY5LTRkZjEtYjE0My05NjgzNmJmYmMzNjMiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJlM2FlMjdiOC1kYTIwLTRjNDItOWRmOC02MDg5ZjcwZjc2M2IiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjE0ZmE5ZDdkLTBmZTAtNDQyNi04ZmQ5LTY5ZDc0YTZmMzQ2NCIsInNlc3Npb25fc3RhdGUiOiJiNGEzYWNmMS05ZGM3LTQ1ZTEtOThmOC1kMzUzNjJhZWM0YzciLCJhY3IiOiIxIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtc3RpZ21hbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb246cmVhZCIsInNpZCI6ImI0YTNhY2YxLTlkYzctNDVlMS05OGY4LWQzNTM2MmFlYzRjNyIsIm5hbWUiOiJyZXN0cmljdGVkIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibHZsMSIsImdpdmVuX25hbWUiOiJyZXN0cmljdGVkIn0.OqLARi5ILt3j2rMikXy0ECTTqjWco0-CrMwzE88gUv2i8rVO9kMgVsXbtPk2L2c9NNNujnxqg7QIr2_sqA51saTrZHvzXcsT8lBruf74OubRMwcTQqJap-COmrzb60S7512k0WfKTYlHsoCn_uAzOb9sp8Trjr0NksU8OXCElDU\"\n  },\n  {\n    // No privileges, standard appdata: \"full\" roleId in \"testCollection\" (ie. Collection X) and Collection Y\n    name: \"lvl2\",\n    userId: \"21\",\n    grantId: \"3\",\n    token: \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDkwNzQsImlhdCI6MTY3MDU2ODI3NSwiYXV0aF90aW1lIjoxNjcwNTY4Mjc0LCJqdGkiOiIwM2Y0OWVmYy1jYzcxLTQ3MTItOWFjNy0xNGY5YzZiNDc1ZGEiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJjMTM3ZDYzNy1mMDU2LTRjNzItOWJlZi1lYzJhZjdjMWFiYzciLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjQ5MzY5ZTdmLWEyZGYtNDkxYS04YjQ0LWEwNDJjYWYyMzhlYyIsInNlc3Npb25fc3RhdGUiOiJjNmUyZTgyNi0xMzMzLTRmMDctOTc4OC03OTQxMGM5ZjJkMDYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtc3RpZ21hbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb246cmVhZCIsInNpZCI6ImM2ZTJlODI2LTEzMzMtNGYwNy05Nzg4LTc5NDEwYzlmMmQwNiIsIm5hbWUiOiJsdmwyIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibHZsMiIsImdpdmVuX25hbWUiOiJsdmwyIn0.F1i8VVLNkVsaW9i83vbVyB9eFiSxX_9ZpR6K7Zs0r7pKOCMJnSOHeKIHrlMO4hW8DrbmSRrkrrXExwNtw6zUsuH8_1uxx-SVUkaQyHEMfbx1_TstkTOFcjxIWqtlVvwPIt-DlTpQ_IFuby8wDAIxUvNwogn2OoybzAy1CDMcpIA\"\n  },\n  {\n    // No privileges, standard appdata: \"manage\" roleId in \"testCollection\" (ie. Collection X) and Collection Y\n    name: \"lvl3\",\n    userId: \"44\",\n    grantId: \"4\",\n    token: \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDkxMjUsImlhdCI6MTY3MDU2ODMyNSwiYXV0aF90aW1lIjoxNjcwNTY4MzI1LCJqdGkiOiI4NTI5MjZmZi0xYzM4LTQwMDYtOTYwYi1kOWE0YmNhMjcxZjkiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiIzNWZhYmMwNi0wNzZlLTRmZjQtOGJkZS1mMzI1ZWE3ZGQ0ZmIiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjQxNmMwYmJkLTJmNjktNGZkMC04MmE1LTdjZDBmNmRlNzUzNSIsInNlc3Npb25fc3RhdGUiOiIzMThkOGNmZi0wY2U1LTQ3MzktODEyYy1iNWI0NjdlMWQ2YzEiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtc3RpZ21hbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb246cmVhZCIsInNpZCI6IjMxOGQ4Y2ZmLTBjZTUtNDczOS04MTJjLWI1YjQ2N2UxZDZjMSIsInByZWZlcnJlZF91c2VybmFtZSI6Imx2bDMifQ.KduimV7h4DSySAWBbWlpN1xwbfXBfNsscvx2qIx9SVAeZFSGbPZ0JtgThD9uray9xZjrk6qLNYnkoVyYQLS4M-pg8IlFp5yKJBCIeCpcTxA25MdV5VwZQcCD9pgwtEav-cgaDD2Ue6cHj_02cQGMClsfkJ2SuOUJ9nIu4B3m3Qk\"\n  },\n  {\n    // No privileges, standard appdata: \"manage\" roleId in \"testCollection\" (ie. Collection X) and Collection Y\n    name: \"lvl4\",\n    userId: \"45\",\n    grantId: \"7\",\n    token: \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDkxNjMsImlhdCI6MTY3MDU2ODM2NCwiYXV0aF90aW1lIjoxNjcwNTY4MzYzLCJqdGkiOiI3MTgwZjU5Yy1kNGQzLTQ0MmYtYjVlNS03NmYxMjBhOTQ3YWEiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiI5MDJjZmE0Ni02MWIzLTQ5YTctOGU4YS02ZjcwYTkzYzJhOTciLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjFlYWE4NDQxLWRhZmItNGE5My04N2ZmLTFkNzM0MzdlMGVjYSIsInNlc3Npb25fc3RhdGUiOiJiZjRjY2Y0Yy03ZTQwLTQ3YjYtYjAyYi1jZmQwOWQ3MTk4OWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtc3RpZ21hbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb246cmVhZCIsInNpZCI6ImJmNGNjZjRjLTdlNDAtNDdiNi1iMDJiLWNmZDA5ZDcxOTg5ZiIsIm5hbWUiOiJsdmw0IiwicHJlZmVycmVkX3VzZXJuYW1lIjoibHZsNCIsImdpdmVuX25hbWUiOiJsdmw0In0.RE0q9YINAiwu8XobDN_eq6UDc-uZTUYwzt2OEF5H_wk4qMnmIEq97FShPsToLYeQONHYgp6VRvaFIQqEk4IeGfzgFUhkg-rqulZIYbz7y4EnDsWE3Afa4MKL7oKrjWxNdAtg-Kp7m6LqBKHF4DCN3_EbGoJweK6aD6SH8epO53o\"\n  },\n  {\n    // collection creator privilege, standard appdata: no grants\n    name: \"collectioncreator\",\n    userId: \"82\",\n    grantId: null,\n    token: \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDkyMDAsImlhdCI6MTY3MDU2ODQwMCwiYXV0aF90aW1lIjoxNjcwNTY4NDAwLCJqdGkiOiJkYTc1MWNkNy1iMWJkLTQ4MWQtOWU4MS01N2E0N2E2ZjRlYjgiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJkZDQ4ZjE5ZS04MWYwLTQ0Y2YtYTQxOC1jNGRlOThiNmI3ODMiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjIyN2VlMjQyLTFiYmItNGI1Ni04NmZhLTY3ZWY2NDZlZGM5MyIsInNlc3Npb25fc3RhdGUiOiJiNmRjZjI3OS04ZmI0LTQ0NGItODUwNi0yZjQ4ZDJhNzYzYmQiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsicmVhbG0tbWFuYWdlbWVudCI6eyJyb2xlcyI6WyJ2aWV3LXVzZXJzIiwicXVlcnktZ3JvdXBzIiwicXVlcnktdXNlcnMiXX0sImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIHN0aWctbWFuYWdlcjpjb2xsZWN0aW9uIHN0aWctbWFuYWdlcjpzdGlnOnJlYWQgc3RpZy1tYW5hZ2VyOnVzZXI6cmVhZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIiwic2lkIjoiYjZkY2YyNzktOGZiNC00NDRiLTg1MDYtMmY0OGQyYTc2M2JkIiwibmFtZSI6ImNvbGxlY3Rpb24gY3JlYXRvciIsInByZWZlcnJlZF91c2VybmFtZSI6ImNvbGxlY3Rpb25jcmVhdG9yIiwiZ2l2ZW5fbmFtZSI6ImNvbGxlY3Rpb24iLCJmYW1pbHlfbmFtZSI6ImNyZWF0b3IifQ.PM2fe_hZk9NxIGuHkIDcsqgbrwoBQHHqid_coWNAfmThPCfpZHlSXFjNZww_mWj4qV_sFY9247MsUsK_EdkmZC7cxFACJgLdb0LKfbqfAdvqbuG6JCrX4qGIhZ5wvCbUq1EtwfCsIgJzi9hBy4hW__enkj55z7937swU9U05rdk\"\n  }  \n]\n\n"
  },
  {
    "path": "test/api/mocha/referenceData.js",
    "content": "// This data represents components of the primary test Collections, Assets, etc. contained in the standard appdata.jsonl file without regard to access controls being exercised by the tests.  These Ids, etc. should be used to construct test case API requests. This data should only be used as expectations in cases where all test scenarios exercised are expected to return the same data. \r\n\r\n// The standard \"testCollection\" includes users named after the roles they have for that specific Collection, is used in most \"GET\" tests or tests not expected to change data that could alter expectations for subsequent tests. \"scrapCollection\" is used for tests that alter Collection data in some way.\r\n\r\nconst reference = {\r\n  // collectionId: \"21\",\r\n  // collectionName: \"Test Collection\",\r\n  // collectionDescription: \"This is a test collection\",\r\n  // collectionOwner: \"admin\",\r\n  //\r\n  // benchmark: \"VPN_SRG_TEST\",\r\n  // checklistLength: 81,\r\n  // revisionStr: \"V1R1\",\r\n  // grantCheckUserId: \"85\",\r\n  // lvl1ValidStigs: [\"VPN_SRG_TEST\"],\r\n  // testAssetLvl1NoAccess: \"62\",\r\n\r\n  // in appdata.jsonl\r\n  deletedCollection: {\r\n    collectionId: \"93\",\r\n  },\r\n  // in appdata.jsonl\r\n  deletedAsset: {\r\n    assetId: \"248\",\r\n  },\r\n\r\n  testCollection: {\r\n    name: \"Collection X\",\r\n    collectionId: \"21\",\r\n    benchmark: \"VPN_SRG_TEST\",\r\n    defaultRevision: \"V1R1\",\r\n    pinRevision: \"V1R0\",\r\n    collectionMetadataKey: \"pocName\",\r\n    collectionMetadataValue: \"poc2Patched\",\r\n    collectionOwnerID: \"87\",\r\n    owners: [\"87\", \"1\", \"45\"],\r\n    grantCheckUserId: \"85\",\r\n    assetIds: [\"29\", \"62\", \"42\", \"154\"],\r\n    assetsWithHistory: [\"42\", \"154\"],\r\n    testAssetId: \"42\",\r\n    ruleId: \"SV-106179r1_rule\",\r\n    validStigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\"],\r\n    labelCount: 2,\r\n    lvl1LabelName: \"test-label-lvl1\",\r\n    lvl1Label: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\r\n    lvl1LabelAssetIds: [\"42\"],\r\n    lvl1ReadOnlyAssetId: \"62\",\r\n    lvl1ReadOnlyAssetIds: [\"62\", \"154\"],\r\n    fullLabelName: \"test-label-full\",\r\n    fullLabel: \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\r\n    importOptions: {\r\n      autoStatus: {\r\n        fail: \"submitted\",\r\n        notapplicable: \"submitted\",\r\n        pass: \"submitted\",\r\n      },\r\n      unreviewed: \"commented\",\r\n      unreviewedCommented: \"informational\",\r\n      emptyDetail: \"replace\",\r\n      emptyComment: \"ignore\",\r\n      allowCustom: true\r\n    },\r\n    testGroup: {\r\n      userGroupId: \"1\",\r\n      name: \"TestGroup\",\r\n      description: \"TestGroup\",\r\n      users: [\"lvl1\"],\r\n      roleId: 1,\r\n      testCollectionGrantId: \"32\",\r\n      defaultAccess: \"none\",\r\n      acl: [\r\n        {\r\n          label: {\r\n            name: \"test-label-lvl1\",\r\n            color: \"99CCFF\",\r\n            labelId: \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\r\n          },\r\n          access: \"rw\",\r\n          benchmarkId: \"VPN_SRG_TEST\",\r\n        },\r\n        {\r\n          asset: {\r\n            name: \"Collection_X_asset\",\r\n            assetId: \"62\",\r\n          },\r\n          access: \"r\",\r\n        },\r\n        {\r\n          asset: {\r\n            name: \"Collection_X_lvl1_asset-2\",\r\n            assetId: \"154\",\r\n          },\r\n          access: \"r\",\r\n          benchmarkId: \"VPN_SRG_TEST\",\r\n        },\r\n      ]\r\n    },\r\n    labels: [\r\n      \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\r\n      \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\r\n    ],\r\n    fullLabels: [\r\n      {labelId: '755b8a28-9a68-11ec-b1bc-0242ac110002', name: 'test-label-full', color: 'FF99CC'},\r\n      {labelId: '5130dc84-9a68-11ec-b1bc-0242ac110002', name: 'test-label-lvl1', color: '99CCFF'}\r\n    ],\r\n    labelsMap: {\r\n      \"test-label-full\": \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\r\n      \"test-label-lvl1\": \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\r\n    },\r\n\r\n    allMetadata: [\r\n      {\r\n        key: \"pocEmail\",\r\n        value: \"pocEmail@email.com\",\r\n      },\r\n      {\r\n        key: \"pocName\",\r\n        value: \"poc2Patched\",\r\n      },\r\n      {\r\n        key: \"pocPhone\",\r\n        value: \"12342\",\r\n      },\r\n      {\r\n        key: \"reqRar\",\r\n        value: \"true\",\r\n      },\r\n    ],\r\n    reviewHistory: {\r\n      assetId: \"42\",\r\n      startDate: \"1900-10-01\",\r\n      endDate: \"2020-10-01\",\r\n      deletedEntriesByDate: 6,\r\n      deletedEntriesByDateAsset: 4,\r\n      ruleId: \"SV-106179r1_rule\",\r\n      status: \"submitted\",\r\n      rulesWithHistoryCnt: 2,\r\n      reviewHistoryRuleCnt: 2,\r\n      reviewHistoryTotalEntryCnt: 7,\r\n      reviewHistory_endDateCnt: 6,\r\n      reviewHistory_startAndEndDateCnt: 6,\r\n      reviewHistory_startDateCnt: 2,\r\n      reviewHistory_byStatusCnt: 3,\r\n      reviewHistory_testAssetCnt: 5,\r\n      reviewHistory_entriesByRuleIdCnt: 4,\r\n    },\r\n    assetsProjected: [\r\n      {\r\n        name: \"ACHERNAR_Collection_X_asset\",\r\n        assetId: \"29\",\r\n      },\r\n      {\r\n        name: \"Collection_X_asset\",\r\n        assetId: \"62\",\r\n      },\r\n      {\r\n        name: \"Collection_X_lvl1_asset-1\",\r\n        assetId: \"42\",\r\n      },\r\n      {\r\n        name: \"Collection_X_lvl1_asset-2\",\r\n        assetId: \"154\",\r\n      },\r\n    ],\r\n    grantsProjected: [\r\n      {\r\n        user: {\r\n          userId: \"86\",\r\n          username: \"bizarroLvl1\",\r\n          displayName: \"bizarroLvl1\",\r\n        },\r\n        grantId: \"1\",\r\n        roleId: 1,\r\n      },\r\n      {\r\n        user: {\r\n          userId: \"21\",\r\n          username: \"lvl2\",\r\n          displayName: \"lvl2\",\r\n        },\r\n        grantId: \"3\",\r\n        roleId: 2,\r\n      },\r\n      {\r\n        user: {\r\n          userId: \"44\",\r\n          username: \"lvl3\",\r\n          displayName: \"lvl3\",\r\n        },\r\n        grantId: \"4\",\r\n        roleId: 3,\r\n      },\r\n      {\r\n        user: {\r\n          userId: \"87\",\r\n          username: \"admin\",\r\n          displayName: \"Admin Burke\",\r\n        },\r\n        grantId: \"5\",\r\n        roleId: 4,\r\n      },\r\n      {\r\n        user: {\r\n          userId: \"1\",\r\n          username: \"stigmanadmin\",\r\n          displayName: \"STIGMAN Admin\",\r\n        },\r\n        grantId: \"6\",\r\n        roleId: 4,\r\n      },\r\n      {\r\n        user: {\r\n          userId: \"45\",\r\n          username: \"lvl4\",\r\n          displayName: \"lvl4\",\r\n        },\r\n        grantId: \"7\",\r\n        roleId: 4,\r\n      },\r\n      {\r\n        userGroup: {\r\n          name: \"TestGroup\",\r\n          description: \"TestGroup\",\r\n          userGroupId: \"1\",\r\n        },\r\n        grantId: \"32\",\r\n        roleId: 1,\r\n      },\r\n    ],\r\n    ownersProjected: [\r\n      {\r\n        // email: null,\r\n        userId: \"87\",\r\n        username: \"admin\",\r\n        displayName: \"Admin Burke\",\r\n      },\r\n      {\r\n        // email: null,\r\n        userId: \"1\",\r\n        username: \"stigmanadmin\",\r\n        displayName: \"STIGMAN Admin\",\r\n      },\r\n      {\r\n        // email: null,\r\n        userId: \"45\",\r\n        username: \"lvl4\",\r\n        displayName: null,\r\n      },\r\n    ],\r\n    stigsProjected: [\r\n      {\r\n        ruleCount: 81,\r\n        benchmarkId: \"VPN_SRG_TEST\",\r\n        revisionStr: \"V1R0\",\r\n        benchmarkDate: \"2010-07-19\",\r\n        revisionPinned: true,\r\n      },\r\n      {\r\n        ruleCount: 287,\r\n        benchmarkId: \"Windows_10_STIG_TEST\",\r\n        revisionStr: \"V1R23\",\r\n        benchmarkDate: \"2020-06-17\",\r\n        revisionPinned: false,\r\n      },\r\n    ],\r\n    statisticsProjected: {\r\n      assetCount: 4,\r\n      grantCount: 7,\r\n      checklistCount: 6,\r\n    },\r\n    appinfo: {\r\n      state: \"enabled\",\r\n      assets: 4,\r\n      assetsDisabled: 1,\r\n      reviews: 17,\r\n      reviewsDisabled: 1,\r\n    },\r\n    labelsProjected: [\r\n      {\r\n        name: \"test-label-full\",\r\n        description: \"\",\r\n        color: \"FF99CC\",\r\n        uses: 2,\r\n      },\r\n      {\r\n        name: \"test-label-lvl1\",\r\n        description: \"\",\r\n        color: \"99CCFF\",\r\n        uses: 1,\r\n      },\r\n    ],\r\n    usersProjected: [\r\n      {\r\n        user: {\r\n          userId: \"86\",\r\n          username: \"bizarroLvl1\",\r\n          displayName: \"bizarroLvl1\",\r\n        },\r\n        grantees: [\r\n          {\r\n            userId: \"86\",\r\n            username: \"bizarroLvl1\",\r\n          },\r\n        ],\r\n        roleId: 1,\r\n      },\r\n      {\r\n        user: {\r\n          userId: \"21\",\r\n          username: \"lvl2\",\r\n          displayName: \"lvl2\",\r\n        },\r\n        grantees: [\r\n          {\r\n            userId: \"21\",\r\n            username: \"lvl2\",\r\n          },\r\n        ],\r\n        roleId: 2,\r\n      },\r\n      {\r\n        user: {\r\n          userId: \"44\",\r\n          username: \"lvl3\",\r\n          displayName: \"lvl3\",\r\n        },\r\n        grantees: [\r\n          {\r\n            userId: \"44\",\r\n            username: \"lvl3\",\r\n          },\r\n        ],\r\n        roleId: 3,\r\n      },\r\n      {\r\n        user: {\r\n          userId: \"87\",\r\n          username: \"admin\",\r\n          displayName: \"Admin Burke\",\r\n        },\r\n        grantees: [\r\n          {\r\n            userId: \"87\",\r\n            username: \"admin\",\r\n          },\r\n        ],\r\n        roleId: 4,\r\n      },\r\n      {\r\n        user: {\r\n          userId: \"1\",\r\n          username: \"stigmanadmin\",\r\n        },\r\n        grantees: [\r\n          {\r\n            userId: \"1\",\r\n            username: \"stigmanadmin\",\r\n          },\r\n        ],\r\n        roleId: 4,\r\n      },\r\n      {\r\n        user: {\r\n          userId: \"45\",\r\n          username: \"lvl4\",\r\n          displayName: \"lvl4\",\r\n        },\r\n        grantees: [\r\n          {\r\n            userId: \"45\",\r\n            username: \"lvl4\",\r\n          },\r\n        ],\r\n        roleId: 4,\r\n      },\r\n      {\r\n        user: {\r\n          userId: \"85\",\r\n          username: \"lvl1\",\r\n          displayName: \"lvl1\",\r\n        },\r\n        grantees: [\r\n          {\r\n            name: \"TestGroup\",\r\n            userGroupId: \"1\",\r\n          },\r\n        ],\r\n        roleId: 1,\r\n      },\r\n    ]\r\n  },\r\n  deleteCollection: {\r\n    collectionId_adminOnly: \"84\",\r\n    collectionId: \"85\",\r\n  },\r\n  scrapCollection: {\r\n    collectionId: \"1\",\r\n    validStigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\", \"RHEL_7_STIG_TEST\"],\r\n    scrapLabel: \"df4e6836-a003-11ec-b1bc-0242ac110002\",\r\n    collectionMetadataKey: \"pocName\",\r\n    collectionMetadataValue: \"poc2Patched\",\r\n  },\r\n  defaultImportOptions: {\r\n    autoStatus: {\r\n      fail: \"saved\",\r\n      notapplicable: \"saved\",\r\n      pass: \"saved\",\r\n    },\r\n    unreviewed: 'commented',\r\n    unreviewedCommented: 'informational',\r\n    emptyDetail: 'replace',\r\n    emptyComment: 'ignore',\r\n    allowCustom: true\r\n  },\r\n\r\n  // Reference Asset data\r\n\r\n  testAssetLvl1NoAccess: \"29\",\r\n  testAsset: {\r\n    name: \"Collection_X_lvl1_asset-1\",\r\n    assetId: \"42\",\r\n    collectionId: \"21\",\r\n    usersWithGrant: [\"86\", \"85\"],\r\n    // benchmark: \"VPN_SRG_TEST\",\r\n    validStigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\"],\r\n    reviewCnt: 9,\r\n    VPN_SRG_TEST_reviewCnt: 6,\r\n    metadataKey: \"testkey\",\r\n    metadataValue: \"testvalue\",\r\n    ipaddress: \"1.1.1.1\",\r\n    labels: [\r\n      \"755b8a28-9a68-11ec-b1bc-0242ac110002\",\r\n      \"5130dc84-9a68-11ec-b1bc-0242ac110002\",\r\n    ],\r\n    fullLabels: [\r\n      {labelId: '755b8a28-9a68-11ec-b1bc-0242ac110002', name: 'test-label-full', color: 'FF99CC'},\r\n      {labelId: '5130dc84-9a68-11ec-b1bc-0242ac110002', name: 'test-label-lvl1', color: '99CCFF'}\r\n    ],\r\n    stats: {\r\n      ruleCount: 368,\r\n      stigCount: 2,\r\n      savedCount: 2,\r\n      acceptedCount: 0,\r\n      rejectedCount: 0,\r\n      submittedCount: 7,\r\n    },\r\n    testRuleId: \"SV-106179r1_rule\",\r\n    freshRuleId: \"SV-106195r1_rule\",\r\n    testRuleIdHistoryCount: 2,\r\n    testRuleIdStig: \"VPN_SRG_TEST\",\r\n    testRuleIdStigCount: 1,\r\n    testBenchmarkReviews: 6,\r\n    reviewRuleIds: [\r\n      \"SV-106179r1_rule\",\r\n      \"SV-106181r1_rule\",\r\n      \"SV-106183r1_rule\",\r\n      \"SV-106185r1_rule\",\r\n      \"SV-106187r1_rule\",\r\n      \"SV-106189r1_rule\",\r\n      \"SV-77813r6_rule\",\r\n      \"SV-77811r1_rule\",\r\n      \"SV-77809r3_rule\",\r\n    ],\r\n  },\r\n  scrapAsset: {\r\n    assetId: \"34\",\r\n    scrapBenchmark: \"RHEL_7_STIG_TEST\",\r\n    metadataKey: \"testkey\",\r\n    metadataValue: \"testvalue\",\r\n    ruleCount: 612,\r\n    validStigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\", \"RHEL_7_STIG_TEST\"],\r\n    name: \"test asset stigmanadmin\",\r\n  },\r\n  testAssetNoStigs: {\r\n    name: \"ACHERNAR_Collection_X_asset\",\r\n    assetId: \"29\",\r\n    collectionId: \"21\",\r\n    labels: [],\r\n    stigs: [],\r\n    stats: {\r\n      ruleCount: null,\r\n      stigCount: 0,\r\n      savedCount: null,\r\n      acceptedCount: null,\r\n      rejectedCount: null,\r\n      submittedCount: null,\r\n    },\r\n  },\r\n  testAssetNoMetadata: {\r\n    collectionId: \"21\",\r\n    assetId: \"154\",\r\n  },\r\n\r\n  //Reference User data\r\n  allUserIds: [\"87\", \"86\", \"82\", \"85\", \"21\", \"44\", \"45\", \"1\", \"22\", \"43\"],\r\n  lvl1User: {\r\n    username: \"lvl1\",\r\n    userId: \"85\",\r\n    testCollectionGrantId: \"34\"\r\n  },\r\n  stigmanadmin: {\r\n    username: \"stigmanadmin\",\r\n    userId: \"1\",\r\n    webPreferences: {\r\n      darkMode: true,\r\n      lastWhatsNew: \"2000-01-01\"\r\n    }\r\n  },\r\n  wfTest: {\r\n    username: \"wf-test\",\r\n    userId: \"22\",\r\n    webPreferences: {\r\n      darkMode: true,\r\n      lastWhatsNew: \"2000-01-01\"\r\n    }\r\n  },\r\n  deleteUser: {\r\n    username: \"workforce-60\",\r\n    userId: \"43\",\r\n  },\r\n  adminBurke: {\r\n    username: \"admin\",\r\n    userId: \"87\",\r\n    testCollectionGrantId: \"5\",\r\n    testCollectionrole: 4,\r\n  },\r\n  scrapLvl1User: {\r\n    userId: \"86\",\r\n    username: \"bizarroLvl1\",\r\n    testCollectionGrantId\r\n    : \"1\",\r\n  },\r\n\r\n  //review data\r\n  ruleId: \"SV-106179r1_rule\",\r\n  ruleIdPinnedRev: \"SV-106179r123456789_rule\",\r\n  reviewKeyChangeFile: \"U_VPN_SRG_V2R3_Manual-xccdf-reviewKeyChange.xml\",\r\n  ruleIdLvl1NoAccess: \"SV-77809r3_rule\",\r\n  writeStigPropsByCollectionStig: [\"62\", \"42\", \"154\"],\r\n  reviewMatchString: \"test\",\r\n  freshRuleId: \"SV-106195r1_rule\",\r\n  testGroupId: \"V-97041\",\r\n  reviewMetadataKey: \"testkey\",\r\n  reviewMetadataValue: \"testvalue\",\r\n  scrapRuleIdWindows10: \"SV-77809r3_rule\",\r\n\r\n  //Reference Stig and Rule data\r\n  benchmark: \"VPN_SRG_TEST\",\r\n  revisionStr: \"V1R1\",\r\n  checklistLength: 81,\r\n  testBenchmarkAllRevisions: [\"V1R1\", \"V1R0\"],\r\n  lvl1ValidStigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\"],\r\n  scrapBenchmark: \"RHEL_7_STIG_TEST\",\r\n  testStigfile: \"U_VPN_SRG_V1R1_Manual-xccdf.xml\",\r\n  windowsBenchmark: \"Windows_10_STIG_TEST\",\r\n  testStigfileNonLatest: \"U_VPN_SRG_V1R0_Manual-xccdf.xml\",\r\n  rulesMatchingFingerprints:\r\n    \"U_VPN_SRG-OTHER_V1R1_twoRules-matchingFingerprints.xml\",\r\n  testRule: {\r\n    ruleId: \"SV-106179r1_rule\",\r\n    groupId: \"V-97041\",\r\n    version: \"SRG-NET-000019-VPN-000040\",\r\n  },\r\n  VPN_SRG_TEST_sharedRule: \"SV-106181r1_rule\",\r\n  testRuleNoMetadata: {\r\n    ruleId: \"SV-106191r1_rule\",\r\n  },\r\n\r\n  vpnStigs: [\r\n    \"VPN_SRG_TEST\",\r\n    \"VPN_SRG_OTHER\",\r\n    \"VPN_SRG_Rule-fingerprint-match-test\",\r\n  ],\r\n  allStigsForAdmin: [\r\n    \"A10_Networks_ADC_ALG_STIG\",\r\n    \"AAA_Service_SRG\",\r\n    \"Adobe_Acrobat_Pro_DC_Continuous_STIG\",\r\n    \"RHEL_7_STIG_TEST\",\r\n    \"VPN_SRG_OTHER\",\r\n    \"VPN_SRG_Rule-fingerprint-match-test\",\r\n    \"VPN_SRG_TEST\",\r\n    \"Windows_10_STIG_TEST\",\r\n  ],\r\n  testCci: {\r\n    id: \"000015\",\r\n    status: \"draft\",\r\n  },\r\n  stigmanadmin: {\r\n    username: 'stigmanadmin',\r\n    userId: '1'\r\n  },\r\n  // reviewMetadataKey: 'testkey',\r\n  // reviewMetadataValue: 'testvalue',\r\n}\r\n\r\nexport default reference\r\n"
  },
  {
    "path": "test/api/mocha/security/reviewCrossCollectionWrite.test.js",
    "content": "/**\n * Security Regression Tests: Unauthorized Cross-Collection Review Write (Finding 1)\n *\n * VULNERABILITY SUMMARY\n * ---------------------\n * postReviewsByAsset  (POST  /collections/{collectionId}/reviews/{assetId})\n * putReviewByAssetRule  (PUT  /collections/{collectionId}/reviews/{assetId}/{ruleId})\n * patchReviewByAssetRule (PATCH /collections/{collectionId}/reviews/{assetId}/{ruleId})\n *\n * All three handlers verify that the caller holds a grant on the collectionId in the\n * URL path, and that the assetId exists. None verify that the asset belongs to that\n * collection.\n *\n * ReviewService.putReviewsByAsset builds cteGrant with:\n *   WHERE a.assetId = @assetId\n * with no AND a.collectionId = @collectionId predicate (ReviewService.js:1000-1011).\n * For non-Restricted callers (roleId > 1) the ACL join in cteGrant is a LEFT JOIN,\n * so it returns rules for any asset regardless of which collection owns it.\n * The write succeeds: reviews are inserted or updated in the review table for the\n * victim asset using the attacker's collection's validation settings.\n *\n * A secondary enabler in patchReviewByAssetRule: the pre-write existence check\n * (Review.js:202-206) calls getReviews with filter: {assetId, ruleId} and no\n * collectionId. This allows a review in the victim collection to satisfy the\n * \"review must exist to be patched\" gate (Review.js:207), enabling the PATCH\n * write path when the asset is in a foreign collection.\n *\n * ATTACK SCENARIO\n * ---------------\n * - Collection X  (collectionId: 21) — attacker's collection; attacker (lvl2) has Full grant\n * - Collection Y  (collectionId: 83) — victim collection; attacker has NO grant\n * - Asset 153     — belongs to Collection Y; has VPN_SRG_TEST STIG mapped and an\n *                   existing submitted review for ruleId SV-106179r1_rule\n * - Attacker      — user \"lvl2\" (userId: 21), Full grant on Collection X (21) only;\n *                   no grant on Collection Y (83)\n *\n * The attacker issues POST, PUT, or PATCH to a URL using Collection X's collectionId\n * but Asset 153's assetId (which belongs to Collection Y).\n *\n * CORRECT BEHAVIOUR (after fix)\n * ------------------------------\n * After verifying the caller's grant on the URL collectionId, the API must verify\n * that the assetId belongs to that collection. If it does not, the request must be\n * rejected with 403 before any write occurs.\n *\n * HOW THESE TESTS FAIL TODAY / PASS AFTER FIX\n * --------------------------------------------\n * Today:  POST, PUT, and PATCH all succeed (HTTP 200/201). The write-impact tests\n *         verify this by reading the victim asset's review via admin token after the\n *         attack and confirming the review was mutated — the test asserts it was NOT\n *         mutated, so it fails.\n * After fix: the API returns 403, no write occurs, the admin read-back confirms the\n *         original review is unchanged, and all assertions pass.\n */\n\nimport { config } from '../testConfig.js'\nimport * as utils from '../utils/testUtils.js'\nimport reference from '../referenceData.js'\nimport { expect } from 'chai'\n\n// ---------------------------------------------------------------------------\n// Actors\n// ---------------------------------------------------------------------------\n\n// The attacker: Full grant (roleId 2) on Collection X (21).\n// Has grants on collections 1 and 21 only — NO grant on Collection Y (83).\nconst attacker = {\n  name: 'lvl2',\n  userId: '21',\n  token:\n    'eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDkwNzQsImlhdCI6MTY3MDU2ODI3NSwiYXV0aF90aW1lIjoxNjcwNTY4Mjc0LCJqdGkiOiIwM2Y0OWVmYy1jYzcxLTQ3MTItOWFjNy0xNGY5YzZiNDc1ZGEiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJjMTM3ZDYzNy1mMDU2LTRjNzItOWJlZi1lYzJhZjdjMWFiYzciLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjQ5MzY5ZTdmLWEyZGYtNDkxYS04YjQ0LWEwNDJjYWYyMzhlYyIsInNlc3Npb25fc3RhdGUiOiJjNmUyZTgyNi0xMzMzLTRmMDctOTc4OC03OTQxMGM5ZjJkMDYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtc3RpZ21hbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb246cmVhZCIsInNpZCI6ImM2ZTJlODI2LTEzMzMtNGYwNy05Nzg4LTc5NDEwYzlmMmQwNiIsIm5hbWUiOiJsdmwyIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibHZsMiIsImdpdmVuX25hbWUiOiJsdmwyIn0.F1i8VVLNkVsaW9i83vbVyB9eFiSxX_9ZpR6K7Zs0r7pKOCMJnSOHeKIHrlMO4hW8DrbmSRrkrrXExwNtw6zUsuH8_1uxx-SVUkaQyHEMfbx1_TstkTOFcjxIWqtlVvwPIt-DlTpQ_IFuby8wDAIxUvNwogn2OoybzAy1CDMcpIA'\n}\n\n// The restricted attacker: Restricted grant (roleId 1) on Collection X (21) via group membership\n// (userId=85, belongs to userGroupId=1 which holds grantId=32, roleId=1 on collectionId=21).\n// No grant on Collection Y (83).\nconst restrictedAttacker = {\n  name: 'lvl1',\n  userId: '85',\n  token:\n    'eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ3MDg5ODQsImlhdCI6MTY3MDU2ODE4NCwiYXV0aF90aW1lIjoxNjcwNTY4MTg0LCJqdGkiOiIxMDhmMDc2MC0wYmY5LTRkZjEtYjE0My05NjgzNmJmYmMzNjMiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJlM2FlMjdiOC1kYTIwLTRjNDItOWRmOC02MDg5ZjcwZjc2M2IiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjE0ZmE5ZDdkLTBmZTAtNDQyNi04ZmQ5LTY5ZDc0YTZmMzQ2NCIsInNlc3Npb25fc3RhdGUiOiJiNGEzYWNmMS05ZGM3LTQ1ZTEtOThmOC1kMzUzNjJhZWM0YzciLCJhY3IiOiIxIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImRlZmF1bHQtcm9sZXMtc3RpZ21hbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7InJlYWxtLW1hbmFnZW1lbnQiOnsicm9sZXMiOlsidmlldy11c2VycyIsInF1ZXJ5LWdyb3VwcyIsInF1ZXJ5LXVzZXJzIl19LCJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb246cmVhZCIsInNpZCI6ImI0YTNhY2YxLTlkYzctNDVlMS05OGY4LWQzNTM2MmFlYzRjNyIsIm5hbWUiOiJyZXN0cmljdGVkIiwicHJlZmVycmVkX3VzZXJuYW1lIjoibHZsMSIsImdpdmVuX25hbWUiOiJyZXN0cmljdGVkIn0.OqLARi5ILt3j2rMikXy0ECTTqjWco0-CrMwzE88gUv2i8rVO9kMgVsXbtPk2L2c9NNNujnxqg7QIr2_sqA51saTrZHvzXcsT8lBruf74OubRMwcTQqJap-COmrzb60S7512k0WfKTYlHsoCn_uAzOb9sp8Trjr0NksU8OXCElDU'\n}\n\n// ---------------------------------------------------------------------------\n// Fixture identifiers\n// ---------------------------------------------------------------------------\n\n// Attacker's collection — attacker holds a Full grant here\nconst attackerCollectionId = '21'   // Collection X\n\n// Victim collection — attacker has NO grant here\nconst victimCollectionId = '83'     // Collection Y\n\n// Victim asset — belongs to Collection Y (83)\n// Has VPN_SRG_TEST mapped; seed review (reviewId 13) exists for victimRuleId\n// with detail \"test\\nvisible to lvl1\" and status submitted\nconst victimAssetId = '153'\n\n// Rule present in VPN_SRG_TEST, mapped to victimAsset via stig_asset_map\nconst victimRuleId = 'SV-106179r1_rule'\n\n// The seed review detail — used to confirm the review was NOT mutated after fix\nconst seedDetail = 'test\\nvisible to lvl1'\n\n// Attacker-controlled content — used to confirm mutation in the unfixed case\nconst attackerDetail = 'ATTACKER WROTE THIS VIA CROSS-COLLECTION WRITE'\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n// Read the victim review via admin token — source of truth for write-impact checks\nasync function getVictimReview () {\n  return utils.executeRequest(\n    `${config.baseUrl}/collections/${victimCollectionId}/reviews/${victimAssetId}/${victimRuleId}`,\n    'GET',\n    config.adminToken\n  )\n}\n\n// ---------------------------------------------------------------------------\n\ndescribe('Security Regression: Unauthorized Cross-Collection Review Write (Finding 1)', () => {\n\n  // -------------------------------------------------------------------------\n  // Sanity checks — confirm the prerequisite fixture state is correct.\n  // These must pass both before and after the fix.\n  // -------------------------------------------------------------------------\n  describe('Fixture sanity checks', () => {\n\n    before(async function () {\n      await utils.loadAppData()\n    })\n\n    it('attacker (lvl2) has no access to victim asset 153 via GET — confirming no grant on Collection Y', async () => {\n      const res = await utils.executeRequest(\n        `${config.baseUrl}/assets/${victimAssetId}`,\n        'GET',\n        attacker.token\n      )\n      expect(res.status).to.equal(403)\n    })\n\n    it('attacker (lvl2) can access Collection X (21) — confirming their grant is active', async () => {\n      const res = await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}`,\n        'GET',\n        attacker.token\n      )\n      expect(res.status).to.equal(200)\n    })\n\n    it('seed review exists on victim asset 153 with expected detail text', async () => {\n      const res = await getVictimReview()\n      expect(res.status).to.equal(200)\n      expect(res.body).to.have.property('detail', seedDetail)\n    })\n  })\n\n  // -------------------------------------------------------------------------\n  // POST /collections/{collectionId}/reviews/{assetId}\n  //\n  // Attack: collectionId = 21 (Collection X, attacker has Full grant)\n  //         assetId      = 153 (belongs to Collection Y, attacker has NO grant)\n  //\n  // CURRENT BEHAVIOUR (bug):  HTTP 200, review written to victim asset.\n  // EXPECTED BEHAVIOUR (fix): HTTP 403, no write occurs.\n  // -------------------------------------------------------------------------\n  describe('POST /collections/{collectionId}/reviews/{assetId} — cross-collection write', () => {\n\n    beforeEach(async function () {\n      await utils.loadAppData()\n    })\n\n    it('SECURITY: POST must return 403 when assetId belongs to a different collection than collectionId', async () => {\n      const res = await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${victimAssetId}`,\n        'POST',\n        attacker.token,\n        [{ ruleId: victimRuleId, result: 'pass', detail: attackerDetail, comment: 'attacker comment' }]\n      )\n      expect(res.status,\n        'Expected 403: asset 153 belongs to Collection Y (83), not Collection X (21). ' +\n        'The API must reject writes that cross collection boundaries. ' +\n        'If this is 200, the vulnerability is present.'\n      ).to.equal(403)\n    })\n\n    it('SECURITY: POST cross-collection attack must not mutate the victim review (write-impact verification)', async () => {\n      await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${victimAssetId}`,\n        'POST',\n        attacker.token,\n        [{ ruleId: victimRuleId, result: 'pass', detail: attackerDetail, comment: 'attacker comment' }]\n      )\n\n      // Read the victim review via admin to check whether it was actually written.\n      // After fix: the POST was rejected (403), so the review is unchanged.\n      // Today (bug): the POST succeeded, so the detail has been overwritten.\n      const adminRes = await getVictimReview()\n      expect(adminRes.status).to.equal(200)\n      expect(adminRes.body.detail,\n        'The victim review detail must not have been modified by the cross-collection POST. ' +\n        `Expected the seed value \"${seedDetail}\" to be unchanged. ` +\n        'If the detail was overwritten, the unauthorized write succeeded.'\n      ).to.equal(seedDetail)\n    })\n  })\n\n  // -------------------------------------------------------------------------\n  // PUT /collections/{collectionId}/reviews/{assetId}/{ruleId}\n  //\n  // CURRENT BEHAVIOUR (bug):  HTTP 200/201, review written to victim asset.\n  // EXPECTED BEHAVIOUR (fix): HTTP 403, no write occurs.\n  // -------------------------------------------------------------------------\n  describe('PUT /collections/{collectionId}/reviews/{assetId}/{ruleId} — cross-collection write', () => {\n\n    beforeEach(async function () {\n      await utils.loadAppData()\n    })\n\n    it('SECURITY: PUT must return 403 when assetId belongs to a different collection than collectionId', async () => {\n      const res = await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${victimAssetId}/${victimRuleId}`,\n        'PUT',\n        attacker.token,\n        { result: 'pass', detail: attackerDetail, comment: 'attacker comment', status: 'saved' }\n      )\n      expect(res.status,\n        'Expected 403: asset 153 belongs to Collection Y (83), not Collection X (21). ' +\n        'If this is 200, the vulnerability is present.'\n      ).to.equal(403)\n    })\n\n    it('SECURITY: PUT cross-collection attack must not mutate the victim review (write-impact verification)', async () => {\n      await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${victimAssetId}/${victimRuleId}`,\n        'PUT',\n        attacker.token,\n        { result: 'pass', detail: attackerDetail, comment: 'attacker comment', status: 'saved' }\n      )\n\n      const adminRes = await getVictimReview()\n      expect(adminRes.status).to.equal(200)\n      expect(adminRes.body.detail,\n        'The victim review detail must not have been modified by the cross-collection PUT. ' +\n        `Expected the seed value \"${seedDetail}\" to be unchanged.`\n      ).to.equal(seedDetail)\n    })\n  })\n\n  // -------------------------------------------------------------------------\n  // PATCH /collections/{collectionId}/reviews/{assetId}/{ruleId}\n  //\n  // The PATCH path has an additional enabler: the pre-write existence check\n  // (Review.js:202-206) calls getReviews without a collectionId filter.\n  // This allows the victim asset's existing review to satisfy the\n  // \"review must exist to be patched\" gate, enabling the write path.\n  //\n  // CURRENT BEHAVIOUR (bug):  HTTP 200, review patched on victim asset.\n  // EXPECTED BEHAVIOUR (fix): HTTP 403, no write occurs.\n  // -------------------------------------------------------------------------\n  describe('PATCH /collections/{collectionId}/reviews/{assetId}/{ruleId} — cross-collection write', () => {\n\n    beforeEach(async function () {\n      await utils.loadAppData()\n    })\n\n    it('SECURITY: PATCH must return 403 when assetId belongs to a different collection than collectionId', async () => {\n      const res = await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${victimAssetId}/${victimRuleId}`,\n        'PATCH',\n        attacker.token,\n        { detail: attackerDetail }\n      )\n      expect(res.status,\n        'Expected 403: asset 153 belongs to Collection Y (83), not Collection X (21). ' +\n        'The pre-write existence check must not satisfy itself using a review from a ' +\n        'foreign collection. If this is 200, the vulnerability is present.'\n      ).to.equal(403)\n    })\n\n    it('SECURITY: PATCH cross-collection attack must not mutate the victim review (write-impact verification)', async () => {\n      await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${victimAssetId}/${victimRuleId}`,\n        'PATCH',\n        attacker.token,\n        { detail: attackerDetail }\n      )\n\n      const adminRes = await getVictimReview()\n      expect(adminRes.status).to.equal(200)\n      expect(adminRes.body.detail,\n        'The victim review detail must not have been modified by the cross-collection PATCH. ' +\n        `Expected the seed value \"${seedDetail}\" to be unchanged.`\n      ).to.equal(seedDetail)\n    })\n  })\n\n  // -------------------------------------------------------------------------\n  // Restricted-role attacker — incidentally blocked today, must remain blocked after fix.\n  //\n  // When the attacker's grant roleId === 1 (Restricted), cteGrant in\n  // putReviewsByAsset uses an INNER JOIN on cteAclEffective (ReviewService.js:1006).\n  // cteAclEffective is built from the attacker's grant IDs in Collection X. The\n  // victim asset's stig_asset_map entries have saId values that never appear in\n  // Collection X's ACL, so cteGrant returns zero rules, every incoming review gets\n  // error = 'no grant for this asset/ruleId', and nothing is committed.\n  //\n  // These tests confirm that the Restricted path is blocked both before and after\n  // the fix, and that the fix does not accidentally change this behaviour.\n  // The tests should PASS today and continue to PASS after the fix.\n  // -------------------------------------------------------------------------\n  describe('Restricted-role attacker (lvl1) — blocked by ACL INNER JOIN, must stay blocked', () => {\n\n    beforeEach(async function () {\n      await utils.loadAppData()\n    })\n\n    it('Restricted attacker: POST returns 403 and does not mutate victim review', async () => {\n      const res = await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${victimAssetId}`,\n        'POST',\n        restrictedAttacker.token,\n        [{ ruleId: victimRuleId, result: 'pass', detail: attackerDetail, comment: 'restricted attacker comment' }]\n      )\n      // The membership check (added by the Finding 1 fix) fires before putReviewsByAsset\n      // is called, so the Restricted user gets 403 — the same as the Full-role attacker.\n      expect(res.status).to.equal(403)\n\n      const adminRes = await getVictimReview()\n      expect(adminRes.body.detail).to.equal(seedDetail)\n    })\n\n    it('Restricted attacker: PUT returns non-2xx and does not mutate victim review', async () => {\n      const res = await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${victimAssetId}/${victimRuleId}`,\n        'PUT',\n        restrictedAttacker.token,\n        { result: 'pass', detail: attackerDetail, comment: 'restricted attacker comment', status: 'saved' }\n      )\n      expect(res.status).to.equal(403)\n\n      const adminRes = await getVictimReview()\n      expect(adminRes.body.detail).to.equal(seedDetail)\n    })\n\n    it('Restricted attacker: PATCH returns 403 and does not mutate victim review', async () => {\n      const res = await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${victimAssetId}/${victimRuleId}`,\n        'PATCH',\n        restrictedAttacker.token,\n        { detail: attackerDetail }\n      )\n      // 403 is required in all cases — not 404.\n      //\n      // Today (before fix): the PATCH pre-write read (Review.js:202-206) calls getReviews\n      // without collectionId. For a Restricted caller the ACL join is an INNER JOIN, so\n      // the victim review is invisible to that read — currentReviews is empty and the\n      // handler throws NotFoundError (404). This is incorrect: a 404 tells the attacker\n      // that no review exists for this rule on this asset from the perspective of their\n      // ACL, which leaks review state across a collection boundary they cannot access.\n      //\n      // After fix: the asset-collection membership check must fire BEFORE the pre-write\n      // existence read, so the attacker receives 403 regardless of whether a review exists\n      // on the victim asset. This eliminates the 403/404 oracle.\n      expect(res.status,\n        'Expected 403 — not 404. A 404 leaks review state across a collection boundary: ' +\n        'it reveals whether a review exists for this rule on this asset, which is information ' +\n        'the caller has no grant to access. The collection-membership check must run before ' +\n        'the pre-write existence read.'\n      ).to.equal(403)\n\n      const adminRes = await getVictimReview()\n      expect(adminRes.body.detail).to.equal(seedDetail)\n    })\n  })\n\n  // -------------------------------------------------------------------------\n  // Negative controls — confirm the fix does not block legitimate same-collection writes.\n  // These tests must pass both before and after the fix.\n  // -------------------------------------------------------------------------\n  describe('Negative controls — legitimate same-collection writes must still succeed', () => {\n\n    before(async function () {\n      await utils.loadAppData()\n    })\n\n    // Full-role user (lvl2): asset 42 belongs to Collection X (21)\n    it('Full-role (lvl2): POST reviews to asset 42 in Collection X succeeds', async () => {\n      const res = await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${reference.testAsset.assetId}`,\n        'POST',\n        attacker.token,\n        [{ ruleId: reference.testCollection.ruleId, result: 'pass', detail: 'legitimate post from lvl2', comment: 'comment' }]\n      )\n      expect(res.status).to.equal(200)\n    })\n\n    it('Full-role (lvl2): PUT review to asset 42 in Collection X succeeds', async () => {\n      const res = await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`,\n        'PUT',\n        attacker.token,\n        { result: 'pass', detail: 'legitimate write from lvl2', comment: 'legitimate comment', status: 'saved' }\n      )\n      expect(res.status).to.equal(200)\n      expect(res.body).to.have.property('ruleId', reference.testCollection.ruleId)\n      expect(res.body).to.have.property('assetId', reference.testAsset.assetId)\n    })\n\n    it('Full-role (lvl2): PATCH review on asset 42 in Collection X succeeds', async () => {\n      const res = await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`,\n        'PATCH',\n        attacker.token,\n        { detail: 'legitimate patch from lvl2' }\n      )\n      expect(res.status).to.equal(200)\n      expect(res.body).to.have.property('ruleId', reference.testCollection.ruleId)\n    })\n\n    // Restricted-role user (lvl1): rw access via ACL rule —\n    // grantId=32 grants rw to label 'test-label-lvl1' (clId=2) + VPN_SRG_TEST.\n    // Asset 42 carries that label and has VPN_SRG_TEST mapped, so lvl1 has\n    // legitimate rw access to VPN_SRG_TEST rules on asset 42 within Collection X.\n    it('Restricted-role (lvl1): POST review to ACL-granted asset 42 / VPN_SRG_TEST in Collection X succeeds', async () => {\n      const res = await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${reference.testAsset.assetId}`,\n        'POST',\n        restrictedAttacker.token,\n        [{ ruleId: reference.testCollection.ruleId, result: 'pass', detail: 'legitimate post from lvl1', comment: 'comment' }]\n      )\n      expect(res.status).to.equal(200)\n    })\n\n    it('Restricted-role (lvl1): PUT review to ACL-granted asset 42 / VPN_SRG_TEST in Collection X succeeds', async () => {\n      const res = await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`,\n        'PUT',\n        restrictedAttacker.token,\n        { result: 'pass', detail: 'legitimate write from lvl1', comment: 'legitimate comment', status: 'saved' }\n      )\n      expect(res.status).to.equal(200)\n      expect(res.body).to.have.property('ruleId', reference.testCollection.ruleId)\n      expect(res.body).to.have.property('assetId', reference.testAsset.assetId)\n    })\n\n    it('Restricted-role (lvl1): PATCH review on ACL-granted asset 42 / VPN_SRG_TEST in Collection X succeeds', async () => {\n      const res = await utils.executeRequest(\n        `${config.baseUrl}/collections/${attackerCollectionId}/reviews/${reference.testAsset.assetId}/${reference.testCollection.ruleId}`,\n        'PATCH',\n        restrictedAttacker.token,\n        { detail: 'legitimate patch from lvl1' }\n      )\n      expect(res.status).to.equal(200)\n      expect(res.body).to.have.property('ruleId', reference.testCollection.ruleId)\n    })\n  })\n})\n"
  },
  {
    "path": "test/api/mocha/testConfig.js",
    "content": "export const config = {\n    \"baseUrl\": \"http://localhost:64001/api\", \n    \"adminToken\":  \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjE4NjQ2ODEwMzUsImlhdCI6MTY3MDU0MDIzNiwiYXV0aF90aW1lIjoxNjcwNTQwMjM1LCJqdGkiOiI0N2Y5YWE3ZC1iYWM0LTQwOTgtOWJlOC1hY2U3NTUxM2FhN2YiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvc3RpZ21hbiIsImF1ZCI6WyJyZWFsbS1tYW5hZ2VtZW50IiwiYWNjb3VudCJdLCJzdWIiOiJiN2M3OGE2Mi1iODRmLTQ1NzgtYTk4My0yZWJjNjZmZDllZmUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJub25jZSI6IjMzNzhkYWZmLTA0MDQtNDNiMy1iNGFiLWVlMzFmZjczNDBhYyIsInNlc3Npb25fc3RhdGUiOiI4NzM2NWIzMy0yYzc2LTRiM2MtODQ4NS1mYmE1ZGJmZjRiOWYiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImNyZWF0ZV9jb2xsZWN0aW9uIiwiZGVmYXVsdC1yb2xlcy1zdGlnbWFuIiwiYWRtaW4iXX0sInJlc291cmNlX2FjY2VzcyI6eyJyZWFsbS1tYW5hZ2VtZW50Ijp7InJvbGVzIjpbInZpZXctdXNlcnMiLCJxdWVyeS1ncm91cHMiLCJxdWVyeS11c2VycyJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgc3RpZy1tYW5hZ2VyOmNvbGxlY3Rpb24gc3RpZy1tYW5hZ2VyOnN0aWc6cmVhZCBzdGlnLW1hbmFnZXI6dXNlcjpyZWFkIHN0aWctbWFuYWdlcjpvcCBzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbjpyZWFkIHN0aWctbWFuYWdlcjpvcDpyZWFkIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlciBzdGlnLW1hbmFnZXI6c3RpZyIsInNpZCI6Ijg3MzY1YjMzLTJjNzYtNGIzYy04NDg1LWZiYTVkYmZmNGI5ZiIsIm5hbWUiOiJTVElHTUFOIEFkbWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RpZ21hbmFkbWluIiwiZ2l2ZW5fbmFtZSI6IlNUSUdNQU4iLCJmYW1pbHlfbmFtZSI6IkFkbWluIn0.a1XwJZw_FIzwMXKo-Dr-n11me5ut-SF9ni7ylX-7t7AVrH1eAqyBxX9DXaxFK0xs6YOhoPsh9NyW8UFVaYgtF68Ps6yzoiqFEeiRXkpN5ygICN3H3z6r-YwanLlEeaYR3P2EtHRcrBtCnt0VEKKbGPWOfeiNCVe3etlp9-NQo44\",\n    \"importOptions\": {\n        \"autoStatus\": {\n            \"fail\": \"saved\",\n            \"notapplicable\": \"saved\",\n            \"pass\": \"saved\",\n        },\n        \"unreviewed\": \"commented\",\n        \"unreviewedCommented\": \"informational\",\n        \"emptyDetail\": \"replace\",\n        \"emptyComment\": \"ignore\",\n        \"allowCustom\": true\n    },\n    \"fieldSettings\": {\n        \"detail\": {\n            \"enabled\": \"findings\",\n            \"required\": \"always\"\n        },\n        \"comment\": {\n            \"enabled\": \"always\",\n            \"required\": \"always\"\n        }\n    }\n}"
  },
  {
    "path": "test/api/mocha/utils/testUtils.js",
    "content": "import { config } from '../testConfig.js'\nimport { Blob } from 'buffer'\nimport { readFileSync, writeFileSync } from 'fs'\nimport { v4 as uuidv4 } from 'uuid'\nimport { fileURLToPath } from 'url';\nimport { join, dirname } from 'path';\nimport reference from '../referenceData.js';\n\nconst baseUrl = config.baseUrl\nconst adminToken = config.adminToken\nconst saveMetricsData = process.env.STIGMAN_SAVE_METRICS_DATA === 'true'\n// New flag to control whether to create new files or update existing ones\nconst createNewMetricsFiles = process.env.STIGMAN_NEW_METRICS_FILES === 'true'\n\nconst executeRequest = async (url, method, token, body = null) => {\n\n  const options = {\n    method,\n    headers: {\n      Authorization: `Bearer ${token}`,\n      'Content-Type': 'application/json'\n    },\n    body: body ? JSON.stringify(body) : null,\n  }\n  const response = await fetch(url, options)\n  const headers = {};\n  response.headers.forEach((value, key) => {\n    headers[key] = value;\n  })\n  return {\n    status: response.status,\n    headers,\n    body: await response.json().catch(() => ({}))\n  }\n}\n\n/**\n * Generic function to output metrics data to a JSON file\n * @param {string} testCaseName - The test case name\n * @param {string} username - The username\n * @param {Object} responseData - The response data to save\n * @param {string} outputMetricsResponsesFile - Path to the output file\n */\nconst outputMetricsToJSON = (testCaseName, username, responseData, outputMetricsResponsesFile) => {\n  // Determine the actual file path based on the createNewMetricsFiles flag\n  let actualOutputFile = outputMetricsResponsesFile\n  if (createNewMetricsFiles) {\n    // Extract directory and filename\n    const lastSlashIndex = outputMetricsResponsesFile.lastIndexOf('/')\n    const lastBackslashIndex = outputMetricsResponsesFile.lastIndexOf('\\\\')\n    const separatorIndex = Math.max(lastSlashIndex, lastBackslashIndex)\n    \n    if (separatorIndex >= 0) {\n      const dir = outputMetricsResponsesFile.substring(0, separatorIndex + 1)\n      const file = outputMetricsResponsesFile.substring(separatorIndex + 1)\n      actualOutputFile = `${dir}new-${file}`\n    } else {\n      // No directory in the path, just prepend 'new-'\n      actualOutputFile = `new-${outputMetricsResponsesFile}`\n    }\n  }\n \n  // Read existing file to preserve all data\n  let metricsData = {}\n  try {\n    const fileContent = readFileSync(actualOutputFile, 'utf8')\n    metricsData = JSON.parse(fileContent)\n  } catch (err) {\n    console.log(`Error creating new metrics file or parsing existing file: ${err.message}`)\n    // Continue with empty object if file doesn't exist or parsing fails\n  }\n  \n  // Update metrics data with new test case data\n  if (!metricsData[testCaseName]) {\n    metricsData[testCaseName] = {}\n  }\n  metricsData[testCaseName][username] = responseData\n  \n  // Write back to file as JSON\n  writeFileSync(actualOutputFile, JSON.stringify(metricsData, null, 2), 'utf8')\n}\n\n/**\n * Conditionally outputs metrics data based on the STIGMAN_SAVE_METRICS_DATA environment variable\n * Works for both regular metrics and meta metrics\n * @param {string} testCaseName - The test case name\n * @param {string} username - The username\n * @param {Object} responseData - The response data to save\n * @param {string} outputJsonFile - Path to the output file\n */\nconst conditionalMetricsOutput = (testCaseName, username, responseData, outputJsonFile) => {\n  // Only record metrics if the environment variable is set\n  if (saveMetricsData) {\n    outputMetricsToJSON(testCaseName, username, responseData, outputJsonFile)\n  }\n}\n\n\n\nconst getUUIDSubString = (length = 20) => {\n  return uuidv4().substring(0, length)\n}\n\nconst loadAppData = async (appdataFileName = 'appdata.jsonl') => {\n\n  const __filename = fileURLToPath(import.meta.url)\n  const __dirname = dirname(__filename)\n  const filePath = join(__dirname, `../../appdata/${appdataFileName}`);\n  \n  const fileContent = readFileSync(filePath, 'utf-8')\n  \n  const res = await fetch(`${baseUrl}/op/appdata?elevate=true`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/jsonl', \n    },\n    body: fileContent,\n  })\n  \n  if (!res.ok) {\n    const errorText = await res.text()\n    throw new Error(`HTTP error, Status: ${res.status}, Message: ${errorText}`)\n  }\n  const data = await res.text()\n  return data\n\n}\n\n\nconst createTempCollection = async (collectionPost) => {\n  // if no collecitonPost is passed in, use the default\n  if (!collectionPost) {\n    collectionPost = \n      {\n        name: 'temoCollection' + getUUIDSubString(),\n        description: 'Collection TEST description',\n        settings: {\n          fields: {\n            detail: {\n              enabled: 'always',\n              required: 'findings'\n            },\n            comment: {\n              enabled: 'always',\n              required: 'findings'\n            }\n          },\n          status: {\n            canAccept: true,\n            minAcceptGrant: 2,\n            resetCriteria: 'result'\n          },\n          history: {\n            maxReviews: 11\n          },\n          importOptions: {\n           autoStatus: {\n              fail: \"submitted\",\n              notapplicable: \"submitted\",\n              pass: \"submitted\",\n            },\n            unreviewed: \"commented\",\n            unreviewedCommented: \"informational\",\n            emptyDetail: \"replace\",\n            emptyComment: \"ignore\",\n            allowCustom: true\n          }\n        },\n        metadata: {\n          pocName: 'poc2Put',\n          pocEmail: 'pocEmailPut@email.com',\n          pocPhone: '12342',\n          reqRar: 'true'\n        },\n        grants: [\n          {\n            userId: '1',\n            roleId: 4\n          },\n          {\n            userId: '85',\n            roleId: 1\n          }\n        ],\n        labels: [\n          {\n            name: 'TEST',\n            description: 'Collection label description',\n            color: 'ffffff'\n          }\n        ]\n      }\n  }\n  \n  const res = await fetch(`${baseUrl}/collections?projection=grants&projection=labels`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n    body: JSON.stringify(collectionPost)\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst deleteCollection = async (collectionId) => {\n\n  const res = await fetch(`${baseUrl}/collections/${collectionId}?elevate=true&projection=assets&projection=grants&projection=owners&projection=statistics&projection=stigs`, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst createTempAsset = async asset => {\n  if (!asset) {\n    asset = {\n      name: 'tempAsset' + getUUIDSubString(),\n      collectionId: \"21\",\n      description: 'temp',\n      ip: '1.1.1.1',\n      noncomputing: true,\n      labelNames: [],\n      metadata: {\n        pocName: 'pocName',\n        pocEmail: 'pocEmail@example.com',\n        pocPhone: '12345',\n        reqRar: 'true'\n      },\n      stigs: ['VPN_SRG_TEST', 'Windows_10_STIG_TEST']\n    }\n  }\n\n  const res = await fetch(`${baseUrl}/assets`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n    body: JSON.stringify(asset)\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst deleteAsset = async assetId => {\n\n  const res = await fetch(`${baseUrl}/assets/${assetId}`, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst importReview = async (collectionId, assetId, ruleId = \"SV-106179r1_rule\") => {\n\n  const res = await fetch(`${baseUrl}/collections/${collectionId}/reviews/${assetId}`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n    body: JSON.stringify([\n      {\n        \"ruleId\": ruleId,\n        \"result\": \"pass\",\n        \"detail\": \"test\\nvisible to lvl1\",\n        \"comment\": \"sure\",\n        \"autoResult\": false,\n        \"status\": \"submitted\"\n      }\n    ])\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst uploadTestStig = async (filename) => {\n\n  const __filename = fileURLToPath(import.meta.url)\n  const __dirname = dirname(__filename)\n  const filePath = join(__dirname, `../../form-data-files/${filename}`)\n  \n  const fileContent = readFileSync(filePath, 'utf-8')\n  \n  // Create a Blob for the file content\n  const blob = new Blob([fileContent], { type: 'text/xml' })\n\n  const formData = new FormData()\n  formData.append('importFile', blob, filename)\n\n\n  const response = await fetch(`${baseUrl}/stigs?elevate=true&clobber=true`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n    },\n    body: formData,\n  })\n\n  if (!response.ok) {\n    const errorText = await response.text()\n    throw new Error(`HTTP error! Status: ${response.status}, Message: ${errorText}`)\n  }\n\n  const data = await response.json()\n  return data\n}\n\nconst deleteStigByRevision = async (benchmarkId, revisionStr) => {\n\n  const res = await fetch(`${baseUrl}/stigs/${benchmarkId}/revisions/${revisionStr}?elevate=true&force=true`, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst deleteStig = async (benchmarkId) => {\n\n  const res = await fetch(`${baseUrl}/stigs/${benchmarkId}?elevate=true&force=true`, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst getAsset = async assetId => {\n  const res = await fetch(`${baseUrl}/assets/${assetId}?projection=statusStats&projection=stigs`, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  if (!res.ok) { \n    if (res.status === 403) {\n      return { status: 403 }\n    }\n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n\n  return await res.json()\n}\n\nconst getStigByBenchmarkId = async benchmarkId => {\n  try {\n\n    const res = await fetch(`${baseUrl}/stigs/${benchmarkId}?elevate=true`, {\n      method: 'GET',\n      headers: {\n        Authorization: `Bearer ${adminToken}`,\n        'Content-Type': 'application/json'\n      },\n    })\n    if (!res.ok) { \n      if(res.status === 404) {\n        return { status: 404 }\n      }\n      throw new Error(`HTTP error, Status: ${res.status}`)\n    }\n    return res.json()\n  }\n  catch (e) {\n    if (e.response && e.response.status === 404) {\n      return { status: 404 } // return an object with the 404 status\n    }\n    throw e \n  }\n}\n\nconst getUser = async userId => {\n  try {\n\n    const res = await fetch(`${baseUrl}/users/${userId}?elevate=true&projection=collectionGrants&projection=statistics`, {\n      method: 'GET',\n      headers: {\n        Authorization: `Bearer ${adminToken}`,\n        'Content-Type': 'application/json'\n      },\n    })\n    if (!res.ok) { \n      if(res.status === 404) {\n        return { status: 404 }\n      }\n      throw new Error(`HTTP error, Status: ${res.status}`)\n    }\n    return res.json()\n  }\n  catch (e) {\n    if (e.response && e.response.status === 404) {\n      return { status: 404 } // return an object with the 404 status\n    }\n    throw e \n  }\n}\n\nconst getAssetsByLabel = async (collectionId, labelId) => {\n\n  const res = await fetch(`${baseUrl}/collections/${collectionId}/labels/${labelId}/assets`, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst getCollectionMetricsDetails = async (collectionId) => {\n\n  const res = await fetch(`${baseUrl}/collections/${collectionId}/metrics/detail`, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst getReviews = async (collectionId) => {\n\n  const res = await fetch(`${baseUrl}/collections/${collectionId}/reviews`, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst getChecklist = async (assetId, benchmarkId, revisionStr) => {\n\n  const res = await fetch(`${baseUrl}/assets/${assetId}/checklists/${benchmarkId}/${revisionStr}?format=ckl`, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.text()\n}\n\nconst getCollection = async (collectionId) => {\n\n  const res = await fetch(`${baseUrl}/collections/${collectionId}?projection=grants&projection=assets&projection=labels&projection=owners&projection=statistics&projection=stigs`, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n  })\n  if (!res.ok) { \n    if (res.status === 403) {\n      return { status: 403 }\n    }\n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst setDefaultRevision = async (collectionId, benchmarkId, revisionStr) => {\n\n  const res = await fetch(`${baseUrl}/collections/${collectionId}/stigs/${benchmarkId}`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n    body: JSON.stringify({\"defaultRevisionStr\": revisionStr})\n  })\n  if (!res.ok) {\n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst putReviewByAssetRule = async (collectionId, assetId, ruleId, body) => {\n\n  const res = await fetch(`${baseUrl}/collections/${collectionId}/reviews/${assetId}/${ruleId}`, {\n    method: 'PUT',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n    body: JSON.stringify(body)\n  })\n\n  if (!res.ok) {\n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst resetTestAsset = async () => {\n\n  const res = await putAsset(\"42\", {\n    name: \"Collection_X_lvl1_asset-1\",\n    collectionId: \"21\",\n    description: \"\",\n    fqdn: null,\n    ip: \"\",\n    noncomputing: true,\n    mac: null,\n    labelNames: [\n      reference.testCollection.fullLabelName,\n      reference.testCollection.lvl1LabelName,\n    ],\n    metadata: {\n      testkey: \"testvalue\",\n    },\n    stigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\"],\n  })\n  const res2 = await setRestrictedUsers(\"21\", \"1\", [\n    {\n      assetId: \"42\",\n      benchmarkId: \"Windows_10_STIG_TEST\",\n      access: \"rw\"\n    },\n  ])\n  const res3 = await setGroupAccess(\"21\", \"32\", \n    [\n      {\n        benchmarkId: 'VPN_SRG_TEST',\n        labelId: '5130dc84-9a68-11ec-b1bc-0242ac110002',\n        access: 'rw'\n      },\n      {\n        assetId: '62',\n        access: 'r'\n      },\n      {\n        benchmarkId: 'VPN_SRG_TEST',\n        assetId: '154',\n        access: 'r'\n      }\n    ])\n\n\n  \n}\n\nconst setGroupAccess = async (collectionId, grantId, body) => {\n\n  const res = await fetch(`${config.baseUrl}/collections/${collectionId}/grants/${grantId}/acl`, {\n    method: 'PUT',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n    body: JSON.stringify(body)\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst resetScrapAsset = async () => {\n  try{ \n    const res = await putAsset(\"34\", {\n      name: \"test asset stigmanadmin\",\n      collectionId: \"1\",\n      description: \"test desc\",\n      ip: \"1.1.1.1\",\n      fqdn: null,\n      noncomputing: true,\n      mac: null,\n      labelNames: [],\n      metadata: {},\n      stigs: [\"VPN_SRG_TEST\", \"Windows_10_STIG_TEST\",\"RHEL_7_STIG_TEST\"],\n      })\n  }\n  catch (e) {\n    console.error('Error resetting scrap asset:', e)\n    throw e\n  }\n\n}\n\nconst setRestrictedUsers = async (collectionId, grantId, body) => {\n\n  const res = await fetch(`${config.baseUrl}/collections/${collectionId}/grants/${grantId}/acl`, {\n    method: 'PUT',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n    body: JSON.stringify(body)\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst createUser = async (user) => {\n\n  const res = await fetch(`${baseUrl}/users?elevate=true`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n    body: JSON.stringify(user)\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst putAsset = async (assetId, asset) => {\n\n  const res = await fetch(`${baseUrl}/assets/${assetId}`, {\n    method: 'PUT',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n    body: JSON.stringify(asset)\n  })\n  if (!res.ok) { \n    // get the error message from the response if available\n    const errorText = await res.text()\n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst putCollection = async (collectionId, collection) => {\n\n  const res = await fetch(`${baseUrl}/collections/${collectionId}`, {\n    method: 'PUT',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n    body: JSON.stringify(collection)\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst createCollectionLabel = async (collectionId, label) => {\n\n  const res = await fetch(`${baseUrl}/collections/${collectionId}/labels`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n    body: JSON.stringify(label)\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  return res.json()\n}\n\nconst deleteReview = async (collectionId, assetId, ruleId) => {\n\n  const res = await fetch(`${baseUrl}/collections/${collectionId}/reviews/${assetId}/${ruleId}`, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${adminToken}`,\n      'Content-Type': 'application/json'\n    },\n  })\n  if (!res.ok) { \n    throw new Error(`HTTP error, Status: ${res.status}`)\n  }\n  if(res.status === 204) {\n    return { status: 204 }\n  }\n  return res.json()\n}\n\nconst wait = (ms) => new Promise(resolve => setTimeout(resolve, ms))\n\nexport {\n  deleteReview,\n  createCollectionLabel,\n  putCollection,\n  conditionalMetricsOutput,\n  putReviewByAssetRule,\n  createUser,\n  resetTestAsset,\n  resetScrapAsset,\n  setRestrictedUsers,\n  loadAppData,\n  deleteCollection,\n  deleteAsset,\n  putAsset,\n  setDefaultRevision,\n  createTempAsset,\n  createTempCollection,\n  getAsset,\n  getAssetsByLabel,\n  getUser,\n  getReviews,\n  getCollectionMetricsDetails,\n  getChecklist,\n  importReview,\n  deleteStig,\n  getStigByBenchmarkId,\n  getCollection,\n  uploadTestStig,\n  deleteStigByRevision,\n  getUUIDSubString,\n  executeRequest,\n  outputMetricsToJSON,\n  wait,\n}\n"
  },
  {
    "path": "test/api/mock-keycloak/auth/realms/stigman/.well-known/openid-configuration",
    "content": "{\"issuer\":\"http://127.0.0.1:8080/auth/realms/stigman\",\"authorization_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/auth\",\"token_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/token\",\"introspection_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/token/introspect\",\"userinfo_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/userinfo\",\"end_session_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/logout\",\"jwks_uri\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/certs\",\"check_session_iframe\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/login-status-iframe.html\",\"grant_types_supported\":[\"authorization_code\",\"implicit\",\"refresh_token\",\"password\",\"client_credentials\"],\"response_types_supported\":[\"code\",\"none\",\"id_token\",\"token\",\"id_token token\",\"code id_token\",\"code token\",\"code id_token token\"],\"subject_types_supported\":[\"public\",\"pairwise\"],\"id_token_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"id_token_encryption_alg_values_supported\":[\"RSA-OAEP\",\"RSA1_5\"],\"id_token_encryption_enc_values_supported\":[\"A256GCM\",\"A192GCM\",\"A128GCM\",\"A128CBC-HS256\",\"A192CBC-HS384\",\"A256CBC-HS512\"],\"userinfo_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\",\"none\"],\"request_object_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\",\"none\"],\"response_modes_supported\":[\"query\",\"fragment\",\"form_post\"],\"registration_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/clients-registrations/openid-connect\",\"token_endpoint_auth_methods_supported\":[\"private_key_jwt\",\"client_secret_basic\",\"client_secret_post\",\"tls_client_auth\",\"client_secret_jwt\"],\"token_endpoint_auth_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"claims_supported\":[\"aud\",\"sub\",\"iss\",\"auth_time\",\"name\",\"given_name\",\"family_name\",\"preferred_username\",\"email\",\"acr\"],\"claim_types_supported\":[\"normal\"],\"claims_parameter_supported\":false,\"scopes_supported\":[\"openid\",\"address\",\"email\",\"import-stig\",\"microprofile-jwt\",\"offline_access\",\"phone\",\"profile\",\"roles\",\"stig-manager\",\"stig-manager:collection\",\"stig-manager:collection:read\",\"stig-manager:op\",\"stig-manager:op:read\",\"stig-manager:stig\",\"stig-manager:stig:read\",\"stig-manager:user\",\"stig-manager:user:read\",\"web-origins\"],\"request_parameter_supported\":true,\"request_uri_parameter_supported\":true,\"code_challenge_methods_supported\":[\"plain\",\"S256\"],\"tls_client_certificate_bound_access_tokens\":true}"
  },
  {
    "path": "test/api/mock-keycloak/auth/realms/stigman/protocol/openid-connect/certs",
    "content": "{\"keys\":[{\"kid\":\"FJ86GcF3jTbNLOco4NvZkUCIUmfYCqoqtOQeMfbhNlE\",\"kty\":\"RSA\",\"alg\":\"RS256\",\"use\":\"sig\",\"n\":\"q1awrk7QK24Gmcy9Yb4dMbS-ZnO6NDaj1Z2F5C74HMIgtwYyxsNbRhBqCWlw7kmkZZaG5udyQYY8d91Db_uc_1DBuJMrQVsYXjVSpy-hoKpTWmzGhXzyzwhfJAICp7Iu_TTKPp-ip0mPGHlJnnP6dr4ztjY7EgFXFhEDFYSd9S8\",\"e\":\"AQAB\",\"x5c\":[\"MIIBkTCB+wIGAWuJ5WIOMA0GCSqGSIb3DQEBCwUAMA8xDTALBgNVBAMMBGRlbW8wHhcNMTkwNjI0MTQyODU5WhcNMjkwNjI0MTQzMDM5WjAPMQ0wCwYDVQQDDARkZW1vMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAJCiHCl/okF0Qg5mDtn53EJjRS3+RFgcu2op4mNv2LXyUXi7JXPM1YmzipN/simV69tMr/FfcvmtBfOGT/f8hd6xFKYGpSXheZcupRhD89nbEe25U5POiIWQNIPwJdxzxG6mERLcHnxv4Ax3WyIReflvs8Uk/dnk1dV6S622lqYP\"],\"x5t\":\"bOOJpVM-6LTc3y17y4Cbxu6xzQY\",\"x5t#S256\":\"O8Z8hTZPuG2zkX3JIARWm9B10lZ9Dc808li-dUn0108\"}]}"
  },
  {
    "path": "test/api/mock-keycloak-test-cases/no-jwks/auth/realms/stigman/.well-known/openid-configuration",
    "content": "{\"issuer\":\"http://127.0.0.1:8080/auth/realms/stigman\",\"authorization_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/auth\",\"token_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/token\",\"introspection_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/token/introspect\",\"userinfo_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/userinfo\",\"end_session_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/logout\",\"check_session_iframe\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/login-status-iframe.html\",\"grant_types_supported\":[\"authorization_code\",\"implicit\",\"refresh_token\",\"password\",\"client_credentials\"],\"response_types_supported\":[\"code\",\"none\",\"id_token\",\"token\",\"id_token token\",\"code id_token\",\"code token\",\"code id_token token\"],\"subject_types_supported\":[\"public\",\"pairwise\"],\"id_token_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"id_token_encryption_alg_values_supported\":[\"RSA-OAEP\",\"RSA1_5\"],\"id_token_encryption_enc_values_supported\":[\"A256GCM\",\"A192GCM\",\"A128GCM\",\"A128CBC-HS256\",\"A192CBC-HS384\",\"A256CBC-HS512\"],\"userinfo_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\",\"none\"],\"request_object_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\",\"none\"],\"response_modes_supported\":[\"query\",\"fragment\",\"form_post\"],\"registration_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/clients-registrations/openid-connect\",\"token_endpoint_auth_methods_supported\":[\"private_key_jwt\",\"client_secret_basic\",\"client_secret_post\",\"tls_client_auth\",\"client_secret_jwt\"],\"token_endpoint_auth_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"claims_supported\":[\"aud\",\"sub\",\"iss\",\"auth_time\",\"name\",\"given_name\",\"family_name\",\"preferred_username\",\"email\",\"acr\"],\"claim_types_supported\":[\"normal\"],\"claims_parameter_supported\":false,\"scopes_supported\":[\"openid\",\"address\",\"email\",\"import-stig\",\"microprofile-jwt\",\"offline_access\",\"phone\",\"profile\",\"roles\",\"stig-manager\",\"stig-manager:collection\",\"stig-manager:collection:read\",\"stig-manager:op\",\"stig-manager:op:read\",\"stig-manager:stig\",\"stig-manager:stig:read\",\"stig-manager:user\",\"stig-manager:user:read\",\"web-origins\"],\"request_parameter_supported\":true,\"request_uri_parameter_supported\":true,\"code_challenge_methods_supported\":[\"plain\",\"S256\"],\"tls_client_certificate_bound_access_tokens\":true}"
  },
  {
    "path": "test/api/mock-keycloak-test-cases/no-jwks/auth/realms/stigman/protocol/openid-connect/certs",
    "content": "{\"keys\":[{\"kid\":\"xxxxxxF3jTbNLOco4NvZkUCIUmfYCqoqtOQeMfbhNlE\",\"kty\":\"RSA\",\"alg\":\"RS256\",\"use\":\"sig\",\"n\":\"q1awrk7QK24Gmcy9Yb4dMbS-ZnO6NDaj1Z2F5C74HMIgtwYyxsNbRhBqCWlw7kmkZZaG5udyQYY8d91Db_uc_1DBuJMrQVsYXjVSpy-hoKpTWmzGhXzyzwhfJAICp7Iu_TTKPp-ip0mPGHlJnnP6dr4ztjY7EgFXFhEDFYSd9S8\",\"e\":\"AQAB\",\"x5c\":[\"MIIBkTCB+wIGAWuJ5WIOMA0GCSqGSIb3DQEBCwUAMA8xDTALBgNVBAMMBGRlbW8wHhcNMTkwNjI0MTQyODU5WhcNMjkwNjI0MTQzMDM5WjAPMQ0wCwYDVQQDDARkZW1vMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAJCiHCl/okF0Qg5mDtn53EJjRS3+RFgcu2op4mNv2LXyUXi7JXPM1YmzipN/simV69tMr/FfcvmtBfOGT/f8hd6xFKYGpSXheZcupRhD89nbEe25U5POiIWQNIPwJdxzxG6mERLcHnxv4Ax3WyIReflvs8Uk/dnk1dV6S622lqYP\"],\"x5t\":\"bOOJpVM-6LTc3y17y4Cbxu6xzQY\",\"x5t#S256\":\"O8Z8hTZPuG2zkX3JIARWm9B10lZ9Dc808li-dUn0108\"}]}"
  },
  {
    "path": "test/api/mock-keycloak-test-cases/secure-kid/auth/realms/stigman/.well-known/openid-configuration",
    "content": "{\"issuer\":\"http://127.0.0.1:8080/auth/realms/stigman\",\"authorization_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/auth\",\"token_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/token\",\"introspection_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/token/introspect\",\"userinfo_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/userinfo\",\"end_session_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/logout\",\"jwks_uri\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/certs\",\"check_session_iframe\":\"http://127.0.0.1:8080/auth/realms/stigman/protocol/openid-connect/login-status-iframe.html\",\"grant_types_supported\":[\"authorization_code\",\"implicit\",\"refresh_token\",\"password\",\"client_credentials\"],\"response_types_supported\":[\"code\",\"none\",\"id_token\",\"token\",\"id_token token\",\"code id_token\",\"code token\",\"code id_token token\"],\"subject_types_supported\":[\"public\",\"pairwise\"],\"id_token_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"id_token_encryption_alg_values_supported\":[\"RSA-OAEP\",\"RSA1_5\"],\"id_token_encryption_enc_values_supported\":[\"A256GCM\",\"A192GCM\",\"A128GCM\",\"A128CBC-HS256\",\"A192CBC-HS384\",\"A256CBC-HS512\"],\"userinfo_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\",\"none\"],\"request_object_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\",\"none\"],\"response_modes_supported\":[\"query\",\"fragment\",\"form_post\"],\"registration_endpoint\":\"http://127.0.0.1:8080/auth/realms/stigman/clients-registrations/openid-connect\",\"token_endpoint_auth_methods_supported\":[\"private_key_jwt\",\"client_secret_basic\",\"client_secret_post\",\"tls_client_auth\",\"client_secret_jwt\"],\"token_endpoint_auth_signing_alg_values_supported\":[\"PS384\",\"ES384\",\"RS384\",\"HS256\",\"HS512\",\"ES256\",\"RS256\",\"HS384\",\"ES512\",\"PS256\",\"PS512\",\"RS512\"],\"claims_supported\":[\"aud\",\"sub\",\"iss\",\"auth_time\",\"name\",\"given_name\",\"family_name\",\"preferred_username\",\"email\",\"acr\"],\"claim_types_supported\":[\"normal\"],\"claims_parameter_supported\":false,\"scopes_supported\":[\"openid\",\"address\",\"email\",\"import-stig\",\"microprofile-jwt\",\"offline_access\",\"phone\",\"profile\",\"roles\",\"stig-manager\",\"stig-manager:collection\",\"stig-manager:collection:read\",\"stig-manager:op\",\"stig-manager:op:read\",\"stig-manager:stig\",\"stig-manager:stig:read\",\"stig-manager:user\",\"stig-manager:user:read\",\"web-origins\"],\"request_parameter_supported\":true,\"request_uri_parameter_supported\":true,\"code_challenge_methods_supported\":[\"plain\",\"S256\"],\"tls_client_certificate_bound_access_tokens\":true}"
  },
  {
    "path": "test/api/mock-keycloak-test-cases/secure-kid/auth/realms/stigman/protocol/openid-connect/certs",
    "content": "{\"keys\":[{\"kid\":\"xxxxxxF3jTbNLOco4NvZkUCIUmfYCqoqtOQeMfbhNlE\",\"kty\":\"RSA\",\"alg\":\"RS256\",\"use\":\"sig\",\"n\":\"q1awrk7QK24Gmcy9Yb4dMbS-ZnO6NDaj1Z2F5C74HMIgtwYyxsNbRhBqCWlw7kmkZZaG5udyQYY8d91Db_uc_1DBuJMrQVsYXjVSpy-hoKpTWmzGhXzyzwhfJAICp7Iu_TTKPp-ip0mPGHlJnnP6dr4ztjY7EgFXFhEDFYSd9S8\",\"e\":\"AQAB\",\"x5c\":[\"MIIBkTCB+wIGAWuJ5WIOMA0GCSqGSIb3DQEBCwUAMA8xDTALBgNVBAMMBGRlbW8wHhcNMTkwNjI0MTQyODU5WhcNMjkwNjI0MTQzMDM5WjAPMQ0wCwYDVQQDDARkZW1vMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAJCiHCl/okF0Qg5mDtn53EJjRS3+RFgcu2op4mNv2LXyUXi7JXPM1YmzipN/simV69tMr/FfcvmtBfOGT/f8hd6xFKYGpSXheZcupRhD89nbEe25U5POiIWQNIPwJdxzxG6mERLcHnxv4Ax3WyIReflvs8Uk/dnk1dV6S622lqYP\"],\"x5t\":\"bOOJpVM-6LTc3y17y4Cbxu6xzQY\",\"x5t#S256\":\"O8Z8hTZPuG2zkX3JIARWm9B10lZ9Dc808li-dUn0108\"}]}"
  },
  {
    "path": "test/api/package.json",
    "content": "{\n  \"name\": \"api-mocha-testing\",\n  \"version\": \"1.0.0\",\n  \"description\": \"testing\",\n  \"scripts\": {\n    \"test\": \"mocha --reporter mochawesome --timeout 10000 --showFailed --exit './mocha/**/*.test.js'\",\n    \"update-appdata\": \"node ../utils/appdata-update.mjs\"\n  },\n  \"keywords\": [],\n  \"author\": \"\",\n  \"license\": \"ISC\",\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"@nuwcdivnpt/stig-manager-client-modules\": \"^1.6.7\",\n    \"chai\": \"^5.1.2\",\n    \"chai-datetime\": \"^1.8.1\",\n    \"deep-equal-in-any-order\": \"^2.0.6\",\n    \"fast-xml-parser\": \"5.7.0\",\n    \"jszip\": \"^3.10.1\",\n    \"mocha\": \"^11.7.5\",\n    \"uuid\": \"^14.0.0\",\n    \"ws\": \"^8.18.3\"\n  },\n  \"overrides\": {\n    \"serialize-javascript\": \"^7.0.5\",\n    \"diff\": \"^8.0.3\",\n    \"uuid\": \"^14.0.0\"\n  },    \n  \"devDependencies\": {\n    \"mochawesome\": \"^7.1.3\"\n  }\n}\n"
  },
  {
    "path": "test/api/runMocha.sh",
    "content": "#!/bin/bash\n\nusage() {\n  echo \"Usage: $0 [-p pattern ...] [-f file ...] [-d directory ...] [-i iteration name ...]\"\n  echo \"  -b bail        Stop running tests after the first failure.\"\n  echo \"  -c coverage    Run all tests with a response validation log and generate coverage report. (cannot be used with other options)\"\n  echo \"  -d directory   Run tests in specific directory.\"\n  echo \"  -f file        Run specific test file.\"\n  echo \"  -i iteration   Run tests for specific iteration.name (see iterations.js)\"\n  echo \"  -p pattern     Run tests matching the whole word.\"\n  echo \"  -s mode        Saves metrics reference data files during tests.\"\n  echo \"                 Use '-s new' to create new files with 'new-' prefix.\"\n  echo \"                 Use '-s update' to modify existing files.\"\n  echo -e \"  -h help        examples: \\n ./runMocha.sh \\n ./runMocha.sh -p \\\"the name of my test\\\" \\n ./runMocha.sh -p \\\"getCollections|getAsset\\\" \\n ./runMocha.sh -p getCollections \\n ./runMocha.sh -i lvl1 -i lvl2 -p getCollections \\n ./runMocha.sh -f collectionGet.test.js \\n ./runMocha.sh -d mocha/data/collection\"\n  exit \n}\n\nDEFAULT_COMMAND=\"npx mocha --reporter mochawesome --no-timeouts --showFailed --exit\"\nCOMMAND=$DEFAULT_COMMAND\nCOVERAGE=false\nSAVE_METRICS=false\nMETRICS_MODE=\"new\"  # by default -s generates new metrics reference data files\nGREP=()\nFILES=()\nDIRECTORIES=()\nITERATION=()\n\nwhile getopts \"bcd:f:s:hi:p:\" opt; do\n  case ${opt} in\n    b) COMMAND+=\" --bail\" ;;\n    c) COVERAGE=true ;;\n    d) DIRECTORIES+=(\"${OPTARG}\") ;;\n    f) FILES+=(\"./mocha/**/${OPTARG}\") ;;\n    h) usage ;;\n    i) ITERATION+=(\"${OPTARG}\") ;;\n    p) GREP+=(\"${OPTARG}\") ;;\n    s) \n       SAVE_METRICS=true\n       # Check if the argument starts with a dash, which means it's likely another option\n       if [[ \"$OPTARG\" == -* ]]; then\n         echo \"Error: Option -s requires an argument (new or update).\"\n         echo \"Did you mean '-s new -f metaMetricsGet.test.js'?\"\n         usage\n       fi\n       METRICS_MODE=\"$OPTARG\"\n       ;;    \n    *) usage ;;\n  esac\ndone\n\nif [ ${#FILES[@]} -gt 0 ] && [ ${#DIRECTORIES[@]} -gt 0 ]; then\n  echo \"Error: You can specify either files or directories, but not both.\"\n  usage\nfi\n\nif [ ${#DIRECTORIES[@]} -gt 0 ]; then\n  COMMAND+=\" ${DIRECTORIES[*]}\"\nelif [ ${#FILES[@]} -gt 0 ]; then\n  COMMAND+=\" ${FILES[*]}\"\nelse\n  COMMAND+=\" './mocha/**/*.test.js'\"\nfi\n\nif [ ${#GREP[@]} -gt 0 ] || [ ${#ITERATION[@]} -gt 0 ]; then\n  GREP_STRING=$(IFS='|'; echo \"${GREP[*]}\")\n  ITERATION_PATTERN=$(IFS='|'; echo \"${ITERATION[*]}\")\n  GREP_PATTERN=\"${ITERATION_PATTERN:+\\\\biteration:(${ITERATION_PATTERN})\\\\b}${GREP:+.*\\\\b(${GREP})\\\\b}\"\n  COMMAND+=\" -g \\\"/$GREP_PATTERN/\\\"\"\nfi\n\n# Set environment variables for metrics generation\nif $SAVE_METRICS; then\n  export STIGMAN_SAVE_METRICS_DATA=true\n  \n  # Set the appropriate mode based on the -s argument\n  if [ \"$METRICS_MODE\" = \"update\" ]; then\n    export STIGMAN_NEW_METRICS_FILES=false\n    echo \"Updating existing metrics reference data files...\"\n  else\n    export STIGMAN_NEW_METRICS_FILES=true\n    echo \"Generating new metrics reference data files with 'new-' prefix...\"\n  fi\nelse\n  export STIGMAN_SAVE_METRICS_DATA=false\n  export STIGMAN_NEW_METRICS_FILES=false\nfi\n\nvalidate_responses() {\n  local LOG_FILE=\"./api/source/api-log.json\"\n  local VALIDATION_FILE=\"./api/source/response-validation-errors.json\"\n\n  if [ -f \"$LOG_FILE\" ]; then\n    echo \"Running response validation...\"\n    jq -s 'map(select(.type==\"responseValidation\")|{method:.data.request.method,url:.data.request.url,errors:.data.error.errors,body:.data.body})' <(grep -E '^\\{.*\\}$' \"$LOG_FILE\") > \"$VALIDATION_FILE\"\n    local VALIDATION_COUNT=$(jq '. | length' \"$VALIDATION_FILE\")\n    echo \"Validation complete. Output in $VALIDATION_FILE.\"\n  else\n    echo \"Error: API log file not found.\"\n    return 1\n  fi\n}\n\ncoverage() {\n  SCRIPT_DIR=$(dirname \"$(readlink -f \"$0\")\")\n  API_DIR=\"$SCRIPT_DIR/../../api/source\"\n  PROJECT_DIR=\"$SCRIPT_DIR/../..\"\n  COVERAGE_DIR=\"$SCRIPT_DIR/coverage\"\n  \n  export STIGMAN_API_PORT=${STIGMAN_API_PORT:-64001}\n  export STIGMAN_DB_HOST=${STIGMAN_DB_HOST:-localhost}\n  export STIGMAN_DB_PORT=${STIGMAN_DB_PORT:-50001}\n  export STIGMAN_DB_PASSWORD=${STIGMAN_DB_PASSWORD:-stigman}\n  export STIGMAN_API_AUTHORITY=${STIGMAN_API_AUTHORITY:-\"http://127.0.0.1:8080/realms/stigman\"}\n  export STIGMAN_EXPERIMENTAL_APPDATA=${STIGMAN_EXPERIMENTAL_APPDATA:-true}\n  export STIGMAN_DEV_RESPONSE_VALIDATION=\"logOnly\"\n  export STIGMAN_DEV_ALLOW_INSECURE_TOKENS=\"true\"\n  export NODE_V8_COVERAGE=\"$COVERAGE_DIR\"\n\n  mkdir -p \"$NODE_V8_COVERAGE\"\n  cd \"$PROJECT_DIR\"\n\n  echo \"Make sure stigmanager api is not already running... will end any existing api process.\"\n  kill -9 $(lsof -t -i:${STIGMAN_API_PORT:-64001}) 2>/dev/null || echo \"No existing API process found.\"\n  c8 --reporter=html --reporter=text --reporter=lcov node -e \"\n    const { spawn } = require('child_process')\n    const fs = require('fs')\n\n     const logStream = fs.createWriteStream('./api/source/api-log.json', { flags: 'w' })\n    \n    console.log('Starting the API...')\n    const server = spawn('node', ['./api/source/index.js'], { stdio: 'pipe'})\n\n    server.stdout.pipe(logStream)\n    server.stderr.pipe(logStream)\n\n    // Wait for the API to start\n    setTimeout(() => {\n      console.log('Running Mocha tests...')\n      const tests = spawn('mocha', ['./test/api/mocha/**/*.test.js', '--no-timeouts', '--ignore', '*/**/node_modules/**/*', '--recursive', '--ignore', './node_modules/**'], { stdio: 'inherit'})\n\n      tests.on('close', (code) => {\n        console.log('Tests finished. Stopping server...')\n        server.kill()\n        logStream.end()\n        process.exit(code)\n      });\n    }, 5000);\n  \"\n\n  c8 report -r lcov -r text -r html --report-dir \"$COVERAGE_DIR\"\n  echo \"Coverage report is available at $COVERAGE_DIR\"\n}\n\nif $COVERAGE; then\n  coverage\n  validate_responses\nelse\n  echo \"Running command: $COMMAND\"\n  eval $COMMAND\nfi\n"
  },
  {
    "path": "test/state/drop-db.sh",
    "content": "#!/usr/bin/bash\n\nsudo iptables $1 OUTPUT -p tcp -m tcp --sport 50001 -s 127.0.0.1 -j DROP"
  },
  {
    "path": "test/state/mocha/bootstrap.test.js",
    "content": "import { expect } from 'chai'\nimport { getPorts, spawnApiPromise, spawnMySQL, simpleRequest, waitChildClose } from './lib.js'\nimport MockOidc from '../../utils/mockOidc.js'\nimport addContext from 'mochawesome/addContext.js'\n\nconst {apiPort, dbPort, oidcPort, apiOrigin} = getPorts(54000)\n\ndescribe('Boot with no dependencies', function () {\n  let api\n  const STIGMAN_DEPENDENCY_RETRIES = 2\n  \n  before(async function () {\n    this.timeout(60000)\n    api = await spawnApiPromise({\n      resolveOnType: 'listening',\n      env:{\n        STIGMAN_DEPENDENCY_RETRIES,\n        STIGMAN_API_PORT: apiPort,\n      }\n    })\n  })\n\n  after(async function () {\n    this.timeout(60000)\n    if (api) await api.stop().catch(() => {})\n    if (api) addContext(this, {title: 'api-log', value: api.logRecords})\n  })\n\n  describe('GET /op/state', function () {\n    it('should return state \"starting\"', async function () {\n      const res = await simpleRequest(`${apiOrigin}/api/op/state`)\n      expect(res.status).to.equal(200)\n      expect(res.body.currentState).to.equal('starting')\n      expect(res.body.dependencies).to.eql({db: false, oidc: false})\n    })\n  })\n  \n  describe('GET /op/configuration', function () {\n    it('should return 503 when dependencies are not available', async function () {\n      const res = await simpleRequest(`${apiOrigin}/api/op/configuration`)\n      expect(res.status).to.equal(503)\n      expect(res.body.currentState).to.equal('starting')\n      expect(res.body.dependencies).to.eql({db: false, oidc: false})\n    })\n  })\n\n  describe('exit code', function () {\n    it('should exit after all retries', async function () {\n      this.timeout(STIGMAN_DEPENDENCY_RETRIES * 6000)\n      await waitChildClose(api.process)\n    })\n    it('should have exited with code 1', function () {\n      expect(api.process.exitCode).to.equal(1)\n    })\n  })  \n\n  describe('dependency failure count', function () {\n    it('db', function () {\n      const failures = api.logRecords.filter(r => r.type === 'preflight' && r.component === 'mysql' && r.data.success === false)\n      expect(failures).to.have.lengthOf(STIGMAN_DEPENDENCY_RETRIES)\n    })\n    it('auth', function () {\n      const failures = api.logRecords.filter(r => r.type === 'discovery' && r.component === 'auth' && r.data.success === false)\n      expect(failures).to.have.lengthOf(STIGMAN_DEPENDENCY_RETRIES)\n    })\n  })\n\n  describe('dependency success count', function () {\n    it('db', function () {\n      const successes = api.logRecords.filter(r => r.type === 'preflight' && r.component === 'mysql' && r.data.success === true)\n      expect(successes).to.have.lengthOf(0)\n    })\n    it('auth', function () {\n      const successes = api.logRecords.filter(r => r.type === 'discovery' && r.component === 'auth' && r.data.success === true)\n      expect(successes).to.have.lengthOf(0)\n    })\n  })\n\n  describe('state-changed message', function () {\n    it('currentState = \"fail\"', function () {\n      const stateChanged = api.logRecords.filter(r => r.type === 'state-changed')\n      expect(stateChanged).to.have.lengthOf(1)\n      expect(stateChanged[0].data).to.eql({currentState: 'fail', previousState: 'starting', dependencyStatus: {db: false, oidc: false}})\n    })\n  })\n})\n\ndescribe('Boot with both dependencies', function () {\n  let api\n  let mysql\n  let oidc\n   \n  before(async function () {\n    this.timeout(60000)\n    console.log('    try oidc start')\n    oidc = new MockOidc({keyCount: 1, includeInsecureKid: false})\n    await oidc.start({port: oidcPort})\n    console.log('    ✔ oidc started')\n    console.log('    try mysql start')\n    mysql = await spawnMySQL({tag:'8.0.24', port:dbPort})\n    console.log('    ✔ mysql started')\n    console.log('    try api start')\n    api = await spawnApiPromise({\n      resolveOnType: 'started',\n      env: {\n        STIGMAN_API_PORT: apiPort,\n        STIGMAN_DEPENDENCY_RETRIES: 2,\n        STIGMAN_DB_PASSWORD: 'stigman',\n        STIGMAN_DB_PORT: dbPort,\n        STIGMAN_OIDC_PROVIDER: `http://localhost:${oidcPort}`,\n      }\n    })\n    console.log('    ✔ api started')\n  })\n\n  after(async function () {\n    this.timeout(60000)\n    if (api) await api.stop().catch(() => {})\n    if (mysql) await mysql.stop().catch(() => {})\n    if (oidc) await oidc.stop().catch(() => {})\n    if (api) addContext(this, {title: 'api-log', value: api.logRecords})\n  })\n\n  describe('GET /op/state', function () {\n    it('should return state \"available\"', async function () {\n      const res = await simpleRequest(`${apiOrigin}/api/op/state`)\n      expect(res.status).to.equal(200)\n      expect(res.body.currentState).to.equal('available')\n      expect(res.body.dependencies).to.eql({db: true, oidc: true})\n    })\n  })\n\n  describe('GET /op/configuration', function () {\n    it('should return 200 when dependencies are available', async function () {\n      const res = await simpleRequest(`${apiOrigin}/api/op/configuration`)\n      expect(res.status).to.equal(200)\n    })\n  })\n\n  describe('dependency failure count', function () {\n    it('db', function () {\n      const failures = api.logRecords.filter(r => r.type === 'preflight' && r.component === 'mysql' && r.data.success === false)\n      expect(failures).to.have.lengthOf(0)\n    })\n    it('auth', function () {\n      const failures = api.logRecords.filter(r => r.type === 'discovery' && r.component === 'auth' && r.data.success === false)\n      expect(failures).to.have.lengthOf(0)\n    })\n  })\n\n  describe('dependency success count', function () {\n    it('db', function () {\n      const successes = api.logRecords.filter(r => r.type === 'preflight' && r.component === 'mysql' && r.data.success === true)\n      expect(successes).to.have.lengthOf(1)\n    })\n    it('auth', function () {\n      const successes = api.logRecords.filter(r => r.type === 'discovery' && r.component === 'auth' && r.data.success === true)\n      expect(successes).to.have.lengthOf(1)\n    })\n  })\n\n  describe('state-changed message', function () {\n    it('currentState = \"available\"', function () {\n      const stateChanged = api.logRecords.filter(r => r.type === 'state-changed')\n      expect(stateChanged).to.have.lengthOf(1)\n      expect(stateChanged[0].data).to.eql({currentState: 'available', previousState: 'starting', dependencyStatus: {db: true, oidc: true}})\n    })\n  })\n})\n\ndescribe('Boot with old mysql', function () {\n  let api\n  let mysql\n  let oidc\n\n  before(async function () {\n    this.timeout(60000)\n    oidc = new MockOidc({keyCount: 1, includeInsecureKid: false})\n    await oidc.start({port: oidcPort})\n    mysql = await spawnMySQL({tag:'8.0.23', port:dbPort})\n    api = await spawnApiPromise({\n      resolveOnClose: true,\n      env:{\n        STIGMAN_API_PORT: apiPort,\n        STIGMAN_DEPENDENCY_RETRIES: 2,\n        STIGMAN_DB_PASSWORD: 'stigman',\n        STIGMAN_DB_PORT: dbPort,\n        STIGMAN_OIDC_PROVIDER: `http://localhost:${oidcPort}`\n      }\n    })\n  })\n\n  after(async function () {\n    this.timeout(60000)\n    if (api) await api.stop().catch(() => {})\n    if (mysql) await mysql.stop().catch(() => {})\n    if (oidc) await oidc.stop().catch(() => {})\n    if (api) addContext(this, {title: 'api-log', value: api.logRecords})\n  })\n\n  describe('exit code', function () {\n    it('should have exited with code 1', function () {\n      expect(api.process.exitCode).to.equal(1)\n    })\n  })  \n\n  describe('dependency failure count', function () {\n    it('db, check message', function () {\n      const failures = api.logRecords.filter(r => r.type === 'preflight' && r.component === 'mysql' && r.data.success === false)\n      expect(failures).to.have.lengthOf(1)\n      expect(failures[0].data.message).to.equal('MySQL release 8.0.23 is too old. Update to release 8.0.24 or later.')\n    })\n  })\n\n  describe('dependency success count', function () {\n    it('db', function () {\n      const successes = api.logRecords.filter(r => r.type === 'preflight' && r.component === 'mysql' && r.data.success === true)\n      expect(successes).to.have.lengthOf(0)\n    })\n  })\n\n  describe('state-changed message', function () {\n    it('currentState = \"fail\"', function () {\n      const stateChanged = api.logRecords.filter(r => r.type === 'state-changed')\n      expect(stateChanged).to.have.lengthOf(1)\n      expect(stateChanged[0].data.currentState).to.eql('fail')\n    })\n  })\n})\n\ndescribe('Boot with insecure kid - allow insecure tokens false', function () {\n  let api\n  let mysql\n  let oidc\n   \n  before(async function () {\n    this.timeout(60000)\n    oidc = new MockOidc({keyCount: 0, includeInsecureKid: true})\n    await oidc.start({port: oidcPort})\n    mysql = await spawnMySQL({tag:'8.0.24', port:dbPort})\n    api = await spawnApiPromise({\n      resolveOnClose: true,\n      env: {\n        STIGMAN_API_PORT: apiPort,\n        STIGMAN_DEPENDENCY_RETRIES: 2,\n        STIGMAN_DB_PASSWORD: 'stigman',\n        STIGMAN_DB_PORT: dbPort,\n        STIGMAN_OIDC_PROVIDER: `http://localhost:${oidcPort}`,\n        STIGMAN_DEV_ALLOW_INSECURE_TOKENS: 'false'\n      }\n    })\n  })\n\n  after(async function () {\n    this.timeout(60000)\n    if (api) await api.stop().catch(() => {})\n    if (mysql) await mysql.stop().catch(() => {})\n    if (oidc) await oidc.stop().catch(() => {})\n    if (api) addContext(this, {title: 'api-log', value: api.logRecords})\n  })\n\n  describe('exit code', function () {\n    it('should have exited with code 1', function () {\n      expect(api.process.exitCode).to.equal(1)\n    })\n  })  \n\n  describe('dependency failure count', function () {\n    it('auth, check message', function () {\n      const failures = api.logRecords.filter(r => r.type === 'discovery' && r.component === 'auth' && r.data.success === false)\n      expect(failures).to.have.lengthOf(1)\n      expect(failures[0].data.message).to.include('insecure_kid -')\n    })\n  })\n\n  describe('dependency success count', function () {\n    it('auth', function () {\n      const successes = api.logRecords.filter(r => r.type === 'discovery' && r.component === 'auth' && r.data.success === true)\n      expect(successes).to.have.lengthOf(0)\n    })\n  })\n\n  describe('state-changed message', function () {\n    it('currentState = \"fail\"', function () {\n      const stateChanged = api.logRecords.filter(r => r.type === 'state-changed')\n      expect(stateChanged).to.have.lengthOf(1)\n      expect(stateChanged[0].data).to.deep.include({currentState: 'fail', previousState: 'starting'})\n    })\n  })\n})\n\ndescribe('Boot without insecure kid - request with insecure token' , function () {\n  let api\n  let mysql\n  let oidc\n  let insecureToken\n   \n  before(async function () {\n    this.timeout(60000)\n    oidc = new MockOidc({keyCount: 0, includeInsecureKid: true})\n    insecureToken = oidc.getToken({username: 'insecure'})\n    oidc.rotateKeys({keyCount: 1, includeInsecureKid: false})\n    await oidc.start({port: oidcPort})\n    mysql = await spawnMySQL({tag:'8.0.24', port:dbPort})\n    api = await spawnApiPromise({\n      resolveOnType: 'started',\n      env: {\n        STIGMAN_API_PORT: apiPort,\n        STIGMAN_DEPENDENCY_RETRIES: 2,\n        STIGMAN_DB_PASSWORD: 'stigman',\n        STIGMAN_DB_PORT: dbPort,\n        STIGMAN_OIDC_PROVIDER: `http://localhost:${oidcPort}`,\n        STIGMAN_DEV_ALLOW_INSECURE_TOKENS: 'false'\n      }\n    })\n  })\n\n  after(async function () {\n    this.timeout(60000)\n    if (api) await api.stop().catch(() => {})\n    if (mysql) await mysql.stop().catch(() => {})\n    if (oidc) await oidc.stop().catch(() => {})\n    if (api) addContext(this, {title: 'api-log', value: api.logRecords})\n  })\n\n  describe('GET /op/state', function () {\n    it('should return state \"available\"', async function () {\n      const res = await simpleRequest(`${apiOrigin}/api/op/state`)\n      expect(res.status).to.equal(200)\n      expect(res.body.currentState).to.equal('available')\n      expect(res.body.dependencies).to.eql({db: true, oidc: true})\n    })\n  })\n  \n  describe('GET /user with insecure kid', function () {\n    it('should fail request with insecure kid', async () => {\n      const options = {\n        method: 'GET',\n        headers: {\n          Authorization: `Bearer ${insecureToken}`,\n          'Content-Type': 'application/json'\n        }\n      }\n      const res = await fetch(`${apiOrigin}/api/user`, options)\n      expect(res.status).to.eql(401)\n      const responseBody = await res.json()\n      expect(responseBody).to.have.property('error')\n        .that.equals('Insecure token presented and STIGMAN_DEV_ALLOW_INSECURE_TOKENS is false.')\n      expect(responseBody).to.have.property('detail')\n        .that.includes('Insecure kid found:')\n    })\n  })\n\n})\n\ndescribe('Boot with STIGMAN_JWKS_CACHE_MAX_AGE out of range', function () {\n  let api\n  let mysql\n  let oidc\n   \n  before(async function () {\n    this.timeout(60000)\n    oidc = new MockOidc({keyCount: 1, includeInsecureKid: false})\n    await oidc.start({port: oidcPort})\n    mysql = await spawnMySQL({tag:'8.0.24', port:dbPort})\n  })\n\n  after(async function () {\n    this.timeout(60000)\n    if (mysql) await mysql.stop().catch(() => {})\n    if (oidc) await oidc.stop().catch(() => {})\n    if (api) await api.stop().catch(() => {})\n    if (api) addContext(this, {title: 'api-log', value: api.logRecords})\n  })\n\n  describe('Mimimum value enforced', function () {\n    before(async function () {\n      this.timeout(60000)\n      api = await spawnApiPromise({\n        resolveOnType: 'started',\n        env: {\n          STIGMAN_DEPENDENCY_RETRIES: 2,\n          STIGMAN_DB_PASSWORD: 'stigman',\n          STIGMAN_DB_PORT: dbPort,\n          STIGMAN_OIDC_PROVIDER: `http://localhost:${oidcPort}`,\n          STIGMAN_JWKS_CACHE_MAX_AGE: 0\n        }\n      })\n    })\n    after(async function () {\n      this.timeout(60000)\n      if (api) await api.stop().catch(() => {})\n    })\n    it('should return minimum oauth.maxCacheAge (1)', async function () {\n      const configLog = api.logRecords.filter(r => r.type === 'configuration')[0]\n      expect(configLog.data.oauth.cacheMaxAge).to.eql(1)\n    })\n  })\n\n  describe('Maximum value enforced', function () {\n    before(async function () {\n      this.timeout(60000)\n      api = await spawnApiPromise({\n        resolveOnType: 'started',\n        env: {\n          STIGMAN_DEPENDENCY_RETRIES: 2,\n          STIGMAN_DB_PASSWORD: 'stigman',\n          STIGMAN_DB_PORT: dbPort,\n          STIGMAN_OIDC_PROVIDER: `http://localhost:${oidcPort}`,\n          STIGMAN_JWKS_CACHE_MAX_AGE: 36000\n        }\n      })\n    })\n    after(async function () {\n      this.timeout(60000)\n      if (api) await api.stop().catch(() => {})\n    })\n    it('should return maximum oauth.maxCacheAge (35791)', async function () {\n      const configLog = api.logRecords.filter(r => r.type === 'configuration')[0]\n      expect(configLog.data.oauth.cacheMaxAge).to.eql(35791)\n    })\n  })\n\n  describe('Handle non-number', function () {\n    before(async function () {\n      this.timeout(60000)\n      api = await spawnApiPromise({\n        resolveOnType: 'started',\n        env: {\n          STIGMAN_DEPENDENCY_RETRIES: 2,\n          STIGMAN_DB_PASSWORD: 'stigman',\n          STIGMAN_DB_PORT: dbPort,\n          STIGMAN_OIDC_PROVIDER: `http://localhost:${oidcPort}`,\n          STIGMAN_JWKS_CACHE_MAX_AGE: '2gether4ever'\n        }\n      })\n    })\n    after(async function () {\n      this.timeout(60000)\n      if (api) await api.stop().catch(() => {})\n    })\n    it('should return default oauth.maxCacheAge (10)', async function () {\n      const configLog = api.logRecords.filter(r => r.type === 'configuration')[0]\n      expect(configLog.data.oauth.cacheMaxAge).to.eql(10)\n    })\n  })\n\n}) "
  },
  {
    "path": "test/state/mocha/db.test.js",
    "content": "import { expect } from 'chai'\nimport { getPorts, spawnApiPromise, spawnMySQL, simpleRequest, execIpTables, waitForLog } from './lib.js'\nimport MockOidc from '../../utils/mockOidc.js'\nimport addContext from 'mochawesome/addContext.js'\n\nconst {apiPort, dbPort, oidcPort, apiOrigin, oidcOrigin} = getPorts(54010)\n\ndescribe('DB outage: shutdown', function () {\n  let api\n  let mysql\n  let oidc\n\n\n  before(async function () {\n    this.timeout(60000)\n    oidc = new MockOidc({keyCount: 1, includeInsecureKid: false})\n    console.log('    try oidc start')\n    await oidc.start({port: oidcPort})\n    console.log('    ✔ oidc started')\n    console.log('    try mysql start')\n    mysql = await spawnMySQL({tag:'8.0.24', port:dbPort})\n    console.log('    ✔ mysql started')\n    console.log('    try api start')\n    api = await spawnApiPromise({\n      resolveOnType: 'started',\n      resolveOnClose: false,\n      env: {\n        STIGMAN_API_PORT: apiPort,\n        STIGMAN_DEPENDENCY_RETRIES: 2,\n        STIGMAN_DB_PASSWORD: 'stigman',\n        STIGMAN_DB_HOST: '127.0.0.1',\n        STIGMAN_DB_PORT: dbPort,\n        STIGMAN_OIDC_PROVIDER: oidcOrigin,\n        STIGMAN_DEV_ALLOW_INSECURE_TOKENS: 'true'\n      }\n    })\n    console.log('    ✔ api started')\n  })\n\n  after(async function () {\n    this.timeout(60000)\n    if (api) await api.stop().catch(() => {})\n    if (mysql) await mysql.stop().catch(() => {})\n    if (oidc) await oidc.stop().catch(() => {})\n    if (api) addContext(this, {title: 'api-log', value: api.logRecords})\n  })\n\n  describe('DB up', function () {\n    it('should return state \"available\"', async function () {\n      this.timeout(20000)\n      const res = await simpleRequest(`${apiOrigin}/api/op/state`)\n      expect(res.status).to.equal(200)\n      expect(res.body.currentState).to.equal('available')\n      expect(res.body.dependencies).to.eql({db: true, oidc: true})\n    })\n  })\n\n  describe('DB shutdown', function () {\n    let logMark\n    before(async function () {\n      this.timeout(30000)\n      logMark = api.logRecords.length\n      await mysql.stop()\n      console.log('      mysql shutdown')\n    })\n    it('should return state \"unavailable\"', async function () {\n      this.timeout(30000)\n      const res = await simpleRequest(`${apiOrigin}/api/op/state`)\n      expect(res.status).to.equal(200)\n      expect(res.body.currentState).to.equal('unavailable')\n      expect(res.body.dependencies).to.eql({db: false, oidc: true})\n    })\n\n    it('should log retry fail', async function () {\n      this.timeout(30000)\n      console.log('      wait for log: restore (2)')\n      const log = await waitForLog(api, 'restore', {count: 2, since: logMark})\n      expect(log.data.message).to.equal(`connect ECONNREFUSED 127.0.0.1:${dbPort}`)\n    })\n  })\n\n  describe('DB restarted', function() {\n    let logMark\n    before( async function() {\n      this.timeout(30000)\n      console.log('      try mysql restart')\n      logMark = api.logRecords.length\n      mysql = await spawnMySQL({tag: '8.0.24', port: dbPort})\n      console.log('      ✔ mysql restarted')\n    })\n\n    it('should return state \"available\"', async function () {\n      this.timeout(60000)\n      console.log('      wait for log: state-changed')\n      const log = await waitForLog(api, 'state-changed', {since: logMark})\n      expect(log.data.currentState).to.equal('available')\n      expect(log.data.previousState).to.equal('unavailable')\n      const res = await simpleRequest(`${apiOrigin}/api/op/state`)\n      expect(res.status).to.equal(200)\n      expect(res.body.currentState).to.equal('available')\n      expect(res.body.dependencies).to.eql({db: true, oidc: true})\n    })\n  })\n})\n\ndescribe('DB outage: network/host down', function () {\n  let api\n  let mysql\n  let oidc\n\n  before(async function () {\n    this.timeout(60000)\n    oidc = new MockOidc({keyCount: 1, includeInsecureKid: false})\n    console.log('    try oidc start')\n    await oidc.start({port: oidcPort})\n    console.log('    ✔ oidc started')\n    console.log('    try mysql start')\n    mysql = await spawnMySQL({tag:'8.0.24', port: dbPort})\n    console.log('    ✔ mysql started')\n    console.log('    try api start')\n    api = await spawnApiPromise({\n      resolveOnType: 'started',\n      resolveOnClose: false,\n      env: {\n        STIGMAN_API_PORT: apiPort,\n        STIGMAN_DEPENDENCY_RETRIES: 2,\n        STIGMAN_DB_PASSWORD: 'stigman',\n        STIGMAN_DB_HOST: '127.0.0.1',\n        STIGMAN_DB_PORT: dbPort,\n        STIGMAN_OIDC_PROVIDER: oidcOrigin,\n        STIGMAN_DEV_ALLOW_INSECURE_TOKENS: 'true'\n      }\n    })\n    console.log('    ✔ api started')\n  })\n\n  after(async function () {\n    this.timeout(60000)\n    if (api) await api.stop().catch(() => {})\n    if (mysql) await mysql.stop().catch(() => {})\n    if (oidc) await oidc.stop().catch(() => {})\n    if (api) addContext(this, {title: 'api-log', value: api.logRecords})\n  })\n\n  describe('Network/host up', function () {\n    it('should return state \"available\"', async function () {\n      this.timeout(20000)\n      const res = await simpleRequest(`${apiOrigin}/api/op/state`)\n      expect(res.status).to.equal(200)\n      expect(res.body.currentState).to.equal('available')\n      expect(res.body.dependencies).to.eql({db: true, oidc: true})\n    })\n  })\n\n  describe('Network/host down', function () {\n    let logMark\n    before(async function () {\n      logMark = api.logRecords.length\n      execIpTables(`-A OUTPUT -p tcp --dport ${dbPort} -j DROP`)\n      console.log('      iptables dropping packets')\n    })\n    it('should return state \"unavailable\"', async function () {\n      this.timeout(30000)\n      console.log('      wait for log: state-changed')\n      const log = await waitForLog(api, 'state-changed', {since: logMark})\n      expect(log.data.currentState).to.equal('unavailable')\n      expect(log.data.previousState).to.equal('available')\n      const res = await simpleRequest(`${apiOrigin}/api/op/state`)\n      expect(res.status).to.equal(200)\n      expect(res.body.currentState).to.equal('unavailable')\n      expect(res.body.dependencies).to.eql({db: false, oidc: true})\n    })\n\n    it('should log retry fail', async function () {\n      this.timeout(45000)\n      console.log('      wait for log: restore (2)')\n      const log = await waitForLog(api, 'restore', {count: 2, since: logMark})\n      expect(log.data.message).to.equal('connect ETIMEDOUT')\n    })\n  })\n\n  describe('Network/host up', function() {\n    let logMark\n    before( async function() {\n      this.timeout(30000)\n      logMark = api.logRecords.length\n      execIpTables(`-D OUTPUT -p tcp --dport ${dbPort} -j DROP`)\n      console.log('      iptables accepting packets')\n    })\n\n    it('should return state \"available\"', async function () {\n      this.timeout(60000)\n      console.log('      wait for log: state-changed')\n      const log = await waitForLog(api, 'state-changed', {since: logMark})\n      expect(log.data.currentState).to.equal('available')\n      expect(log.data.previousState).to.equal('unavailable')\n      const res = await simpleRequest(`${apiOrigin}/api/op/state`)\n      expect(res.status).to.equal(200)\n      expect(res.body.currentState).to.equal('available')\n      expect(res.body.dependencies).to.eql({db: true, oidc: true})\n    })\n  })\n})\n"
  },
  {
    "path": "test/state/mocha/jwks.test.js",
    "content": "import { expect, use } from 'chai'\nimport { getPorts, spawnApiPromise, spawnMySQL, bearerRequest } from './lib.js'\nimport MockOidc from '../../utils/mockOidc.js'\nimport addContext from 'mochawesome/addContext.js'\nimport chaiDateTime from 'chai-datetime'\n\nuse(chaiDateTime)\n\ndescribe('JWKS Tests', function () {\n  let api\n  let mysql\n  let oidc\n  const tokens = {}\n\n  const {apiPort, dbPort, oidcPort, apiOrigin, oidcOrigin} = getPorts(54020)\n\n  before(async function () {\n    this.timeout(60000)\n    oidc = new MockOidc({keyCount: 1, includeInsecureKid: false})\n    tokens.rotation0 = oidc.getToken({username: 'prerotation', privileges:['create_collection']}) // default privileges\n    oidc.rotateKeys({keyCount: 1, includeInsecureKid: false})\n    tokens.rotation1 = oidc.getToken({username: 'rotation1', privileges:['create_collection']}) // default privileges\n    oidc.rotateKeys({keyCount: 1, includeInsecureKid: false})    \n    await oidc.start({port: oidcPort})\n    console.log('    ✔ oidc started')\n    console.log('    try mysql start')\n    mysql = await spawnMySQL({tag:'8.0.24', port: dbPort})\n    console.log('    ✔ mysql started')\n    console.log('    try api start')\n    api = await spawnApiPromise({\n      resolveOnType: 'started',\n      resolveOnClose: false,\n      inspect: false,\n      env: {\n        STIGMAN_API_PORT: apiPort,\n        STIGMAN_DEPENDENCY_RETRIES: 2,\n        STIGMAN_DB_PASSWORD: 'stigman',\n        STIGMAN_DB_HOST: '127.0.0.1',\n        STIGMAN_DB_PORT: `${dbPort}`, \n        STIGMAN_OIDC_PROVIDER: oidcOrigin,\n        STIGMAN_LOG_LEVEL: '4',\n        STIGMAN_JWKS_CACHE_MAX_AGE: 1\n      }\n    })\n    console.log('    ✔ api started')\n  })\n\n  after(async function () {\n    this.timeout(60000)\n    if (api) await api.stop().catch(() => {})\n    if (mysql) await mysql.stop().catch(() => {})\n    if (oidc) await oidc.stop().catch(() => {})\n    if (api) addContext(this, {title: 'api-log', value: api.logRecords})\n  })\n  \n  describe('Create user according to token', function () {\n    it('should return newly created user with create_collection', async function () {\n      this.timeout(20000)\n      const username = 'user01'\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username, privileges:['create_collection']})\n      })\n      expect(res.status).to.equal(200)\n      expect(res.body.username).to.eql(username)\n      expect(res.body.privileges).to.eql({create_collection: true, admin: false})\n      expect(new Date(res.body.statistics.created)).to.be.closeToTime(new Date(), 1000)\n    })\n    it('should return newly created user with create_collection and admin', async function () {\n      this.timeout(20000)\n      const username = 'user02'\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username, privileges:['create_collection', 'admin']})\n      })\n      expect(res.status).to.equal(200)\n      expect(res.body.username).to.eql(username)\n      expect(res.body.privileges).to.eql({create_collection: true, admin: true})\n      expect(new Date(res.body.statistics.created)).to.be.closeToTime(new Date(), 1000)\n    })\n    it('should return newly created user with no privileges', async function () {\n      this.timeout(20000)\n      const username = 'user03'\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username, privileges:[]})\n      })\n      expect(res.status).to.equal(200)\n      expect(res.body.username).to.eql(username)\n      expect(res.body.privileges).to.eql({create_collection: false, admin: false})\n      expect(new Date(res.body.statistics.created)).to.be.closeToTime(new Date(), 1000)\n    })\n  })\n\n  describe('Reject token with unknown kid after refreshing cache', function () {\n    it('should log a cache refresh and reject unknown kid', async function () {\n      this.timeout(20000)\n      const logLength = api.logRecords.length\n      const res = await bearerRequest({\n          url: `${apiOrigin}/api/user`,\n          method: 'GET',\n          token: tokens.rotation0\n        })\n        \n      expect(res.status).to.equal(401)\n      expect(res.body.error).to.equal('Unknown signing key, unable to validate token.')\n\n      const logSlice = api.logRecords.slice(logLength)\n      const cacheUpdateCount = logSlice.filter(log => log.type === 'jwksCacheEvent' && log.data.event === 'cacheUpdate').length\n      expect(cacheUpdateCount).to.equal(1)\n    })\n  })\n\n  describe('Reject token with unknown kid without refreshing cache', function () {\n    it('should reject unknown kid from cache', async function () {\n      this.timeout(20000)\n      const logLength = api.logRecords.length\n      const res = await bearerRequest({\n          url: `${apiOrigin}/api/user`,\n          method: 'GET',\n          token: tokens.rotation0\n        })\n        \n      expect(res.status).to.equal(401)\n      expect(res.body.error).to.equal('Unknown signing key, unable to validate token.')\n\n      const logSlice = api.logRecords.slice(logLength)\n      const cacheUpdateCount = logSlice.filter(log => log.type === 'jwksCacheEvent' && log.data.event === 'cacheUpdate').length\n      expect(cacheUpdateCount).to.equal(0)\n    })\n  })\n\n  describe('Reject token with NEW unknown kid while OIDC is unavailable', function () {\n    before( function () {\n      oidc.stop()\n    })\n\n    after(async function () {\n      await oidc.start({port: oidcPort})\n    })\n\n    it('should reject unknown kid when oidc unavailable', async function () {\n      this.timeout(5000)\n      const logLength = api.logRecords.length\n      const res = await bearerRequest({\n          url: `${apiOrigin}/api/user`,\n          method: 'GET',\n          token: tokens.rotation1\n        })\n        \n      expect(res.status).to.equal(401)\n      expect(res.body.error).to.equal('Unknown signing key, unable to validate token.')\n\n      const logSlice = api.logRecords.slice(logLength)\n      const cacheUpdateCount = logSlice.filter(log => log.type === 'jwksCacheEvent' && log.data.event === 'cacheUpdate').length\n      expect(cacheUpdateCount).to.equal(0)\n      const updateCacheError = logSlice.filter(log => log.type === 'refresh error' && log.data.message === 'updateCache returned false').length\n      expect(updateCacheError).to.equal(1)\n    })\n  })  \n\n\n  describe('Reject token with empty username', function () {\n    it('should reject empty username', async function () {\n      this.timeout(20000)\n      const res = await bearerRequest({\n          url: `${apiOrigin}/api/user`,\n          method: 'GET',\n          token: oidc.getToken({username: '', privileges:[]})\n        })\n      expect(res.status).to.equal(401)\n      expect(res.body.detail).to.equal('No token claim mappable to username found')\n    })\n  })\n\n  describe('Reject token without mappable username claim', function () {\n    it('should reject missing username', async function () {\n      this.timeout(20000)\n      const [kid, {privateKey}] = oidc.keys.entries().next().value\n      const token = oidc.getCustomToken({\n        payload: {\n          unknown_claim: 'newuser',\n          exp: Math.floor(Date.now() / 1000) + 60\n        },\n        privateKey: privateKey,\n        options: {\n          algorithm: 'RS256',\n          allowInsecureKeySizes: true,\n          keyid: kid\n        }\n      })\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token\n      })\n      expect(res.status).to.equal(401)\n      expect(res.body.detail).to.equal('No token claim mappable to username found')\n    })\n  })\n\n  describe('Reject expired token', function () {\n    it('should reject expired token', async function () {\n      this.timeout(20000)\n      const [kid, {privateKey}] = oidc.keys.entries().next().value\n      const token = oidc.getCustomToken({\n        payload: {\n          exp: Math.floor(Date.now() / 1000) - 60 // expired token\n        },\n        privateKey: privateKey,\n        options: {\n          algorithm: 'RS256',\n          allowInsecureKeySizes: true,\n          keyid: kid\n        }\n      })\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token\n      })\n      expect(res.status).to.equal(401)\n      expect(res.body.detail).to.equal('jwt expired')\n    })\n  })\n})"
  },
  {
    "path": "test/state/mocha/lib.js",
    "content": "import { spawn, execSync } from 'node:child_process'\nimport EventEmitter from 'node:events'\nimport * as readline from 'node:readline'\nimport { dirname } from 'path'\nimport { fileURLToPath } from 'url'\nconst __dirname = dirname(fileURLToPath(import.meta.url))\n\n// workaround PATH envvar not being honored by spawn within github actions\nconst nodeCmd = process.env.GITHUB_RUN_ID ? '/usr/local/bin/node':'node'\nconst pythonCmd = process.env.GITHUB_RUN_ID ? '/usr/bin/python3':'python3'\nconst dockerCmd = process.env.GITHUB_RUN_ID ? '/usr/bin/docker':'docker'\nconst iptablesCmd = process.env.GITHUB_RUN_ID ? 'sudo /usr/sbin/iptables':'sudo iptables'\n\n/**\n * Spawns the API as a node process.\n * Returns a promise that resolves when the API emits a log record \n * of the specified type (default 'started') or when the API process closes.\n * @param {Object} options - Options for spawning the API.\n * @param {string} [options.resolveOnType='started'] - The log record type to resolve the promise.\n * @param {boolean} [options.resolveOnClose=true] - Whether to resolve the promise when the API process closes.\n * @param {string} [options.apiPath=`${__dirname}/../../../api/source/index.js`] - The path to the API script.\n * @param {Object} [options.env] - Environment variables for the API process.\n * @returns {Promise<Object>} A promise that resolves with the API process and log records.\n */\nexport function spawnApiPromise ({\n  resolveOnType = 'started',\n  resolveOnClose = true,\n  apiPath = `${__dirname}/../../../api/source/index.js`,\n  inspect = false,\n  consoleLog = false,\n  env\n} = {}) {\n  return new Promise((resolve, reject) => {\n    const options = []\n    if (inspect) {\n      options.push('--inspect-brk')\n    }\n    options.push(apiPath)\n    const api = spawn(nodeCmd, options, {env})\n    \n    api.on('error', (err) => {\n      reject(err)\n    })\n\n    const resolution = {\n      process: api,\n      logRecords: [],\n      logEvents: new EventEmitter(),\n      stop: async function () {\n        if (this.process) {\n          this.process.kill()\n          await waitChildClose(this.process)\n        }\n      }\n    }\n\n    readline.createInterface({\n      input: api.stdout,\n      crlfDelay: Infinity\n    }).on('line', (line) => {\n      if (consoleLog) console.log(line)\n      const json = JSON.parse(line)\n      resolution.logRecords.push(json)\n      resolution.logEvents.emit(json.type, json)\n      if (json.type === resolveOnType) {\n        resolve(resolution)\n      }\n    })\n\n    api.on('close', () => {\n      if (resolveOnClose) {\n        resolve(resolution)\n      }\n    })\n    if (resolveOnType === null) {\n      resolve(resolution)\n    }\n  })\n}\n\n/**\n * Spawns the API as a node process.\n * @param {Object} [options] - Options for spawning the API.\n * @param {string} [options.apiPath=`${__dirname}/../../../api/source/index.js`] - The path to the API script.\n * @param {Object} [options.env] - Environment variables for the API process.\n * @returns {Object|null} The API process and log records, or null if an error occurred.\n */\nexport function spawnApi ({\n  apiPath = `${__dirname}/../../../api/source/index.js`,\n  env\n} = {}) {\n  try {\n    const api = spawn(nodeCmd, [apiPath], {env})\n\n    const value = {\n      process: api,\n      logRecords: []\n    }\n\n    readline.createInterface({\n      input: api.stdout,\n      crlfDelay: Infinity\n    }).on('line', (line) => {\n      const json = JSON.parse(line)\n      value.logRecords.push(json)\n    })\n\n    return value\n  }\n  catch (err) {\n    console.error(err)\n    return null\n  }\n}\n\n/**\n * Resolves with a log record matching `type` once `count` such records have\n * been seen at index >= `since` in `api.logRecords`. Race-safe: counts past\n * records so the helper still resolves if the trigger fired before the caller\n * awaited. Capture `api.logRecords.length` into `since` *before* triggering\n * the action that produces the event(s).\n * @param {Object} api - Result of spawnApiPromise; must have logRecords + logEvents.\n * @param {string} type - The log record type to wait for.\n * @param {Object} [opts]\n * @param {number} [opts.count=1] - Number of matching records before resolving.\n * @param {number} [opts.since=0] - Index in api.logRecords at which to start counting.\n * @param {(log: Object) => boolean} [opts.predicate] - Optional filter applied to each record.\n * @returns {Promise<Object>} Resolves with the count-th matching log record.\n */\nexport function waitForLog (api, type, { count = 1, since = 0, predicate = null } = {}) {\n  const past = api.logRecords.slice(since).filter(r =>\n    r.type === type && (!predicate || predicate(r))\n  )\n  if (past.length >= count) return Promise.resolve(past[count - 1])\n  let seen = past.length\n  return new Promise((resolve) => {\n    api.logEvents.on(type, (log) => {\n      if (predicate && !predicate(log)) return\n      seen++\n      if (seen >= count) resolve(log)\n    })\n  })\n}\n\n/**\n * Waits for a child process to close.\n * @param {ChildProcess} child - The child process to wait for.\n * @returns {Promise<number>} A promise that resolves with the exit code of the child process.\n */\nexport function waitChildClose (child) {\n  return new Promise((resolve, reject) => {\n    if (child.exitCode !== null) {\n      resolve(child.exitCode)\n    }\n    child.on('close', (code) => {\n      resolve(code)\n    })\n    child.on('error', (err) => {\n      reject(err)\n    })\n  })\n}\n\nexport function getPorts (basePort) {\n  return {\n    apiPort: basePort,\n    dbPort: basePort + 1,\n    oidcPort: basePort + 2,\n    apiOrigin: `http://localhost:${basePort}`,\n    oidcOrigin: `http://localhost:${basePort + 2}`,\n  }\n}\n\n/**\n * Makes a simple, non-authenticated request to a URL.\n * @param {string} url - The URL to request.\n * @param {string} method - The HTTP method to use.\n * @returns {Promise<Object>} A promise that resolves with the response status, headers, and body.\n */\nexport async function simpleRequest(url, method) {\n  const options = {\n    method\n  }\n  const response = await fetch(url, options)\n  const headers = {}\n  response.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n  return {\n    status: response.status,\n    headers,\n    body: await response.json().catch(() => ({}))\n  }\n}\n\nexport async function bearerRequest({url, method, token}) {\n  const options = {\n    method,\n    headers: {\n      Authorization: `Bearer ${token}`,\n    }\n  }\n  const response = await fetch(url, options)\n  const headers = {}\n  response.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n  return {\n    status: response.status,\n    headers,\n    body: await response.json().catch(() => ({}))\n  }\n}\n\n\n/**\n * Spawns a MySQL container.\n * Returns a promise that resolves when the MySQL container is ready for connections.\n * @param {Object} options - Options for spawning the MySQL container.\n * @param {string} [options.tag='8.0.24'] - The MySQL image tag to use.\n * @param {string} [options.port='3306'] - The port to map to the MySQL container.\n * @param {number} [options.readyCount=2] - The number of \"ready for connections\" messages to wait for.\n * @returns {Promise<ChildProcess>} A promise that resolves with the MySQL container process.\n */\nexport function spawnMySQL ({\n  tag = '8.0.24', \n  port = '3306',\n  readyCount = 2\n} = {}) {\n  let readySeen = 0\n  return new Promise((resolve, reject) => {\n    let resolved = false\n    const child = spawn(dockerCmd, [\n      'run', '--rm',\n      '-p', `${port}:3306`,\n      '-e', 'MYSQL_ROOT_PASSWORD=rootpw',\n      '-e', 'MYSQL_DATABASE=stigman',\n      '-e', 'MYSQL_USER=stigman',\n      '-e', 'MYSQL_PASSWORD=stigman',\n      `mysql:${tag}`\n    ])\n    const resolution = {\n      process: child,\n      stop: async function () {\n        if (this.process) {\n          this.process.kill()\n          await waitChildClose(this.process)\n        }\n      }\n    }\n\n\n    child.on('error', (err) => {\n      console.error('ERROR', err)\n      if (!resolved) reject(err)\n    })\n\n   readline.createInterface({\n      input: child.stderr,\n      crlfDelay: Infinity\n    }).on('line', (line) => {\n      if (line.includes('mysqld: ready for connections')) {\n        readySeen++\n        if (readySeen === readyCount) {\n          resolved = true\n          resolve(resolution)\n        } \n      }\n    })\n  })\n}\n\n/**\n * Spawns a Python HTTP server, by default serving from the mock-keycloak directory.\n * @param {Object} options - Options for spawning the HTTP server.\n * @param {string} [options.port='8080'] - The port to serve the HTTP server on.\n * @param {string} [options.cwd=`${__dirname}/../../api/mock-keycloak`] - The working directory to serve files from.\n * @returns {ChildProcess} The HTTP server process.\n */\nexport function spawnHttpServer ({\n  port = '8080',\n  cwd = `${__dirname}/../../api/mock-keycloak`\n} = {}) {\n  const child =  spawn(pythonCmd, ['-m', 'http.server', port], {cwd})\n  return child\n}\n\nexport function execIpTables (args) {\n  return execSync(`${iptablesCmd} ${args}`)\n}"
  },
  {
    "path": "test/state/mocha/oidc.test.js",
    "content": "import { expect } from 'chai'\nimport { getPorts, spawnApiPromise, spawnMySQL, simpleRequest, waitForLog } from './lib.js'\nimport MockOidc from '../../utils/mockOidc.js'\nimport addContext from 'mochawesome/addContext.js'\n\n\ndescribe('OIDC state', function () {\n  let api\n  let mysql\n  let oidc\n  let cachedKid\n\n  const {apiPort, dbPort, oidcPort, apiOrigin, oidcOrigin} = getPorts(54030)\n\n  before(async function () {\n    this.timeout(60000)\n    oidc = new MockOidc({keyCount: 1, includeInsecureKid: false})\n    await oidc.start({port: oidcPort})\n    console.log('    ✔ oidc started')\n    console.log('    try mysql start')\n    mysql = await spawnMySQL({tag:'8.0.24', port: dbPort})\n    console.log('    ✔ mysql started')\n    console.log('    try api start')\n    api = await spawnApiPromise({\n      resolveOnType: null,\n      resolveOnClose: false,\n      env: {\n        STIGMAN_API_PORT: apiPort,\n        STIGMAN_DEPENDENCY_RETRIES: 2,\n        STIGMAN_DB_PASSWORD: 'stigman',\n        STIGMAN_DB_HOST: '127.0.0.1',\n        STIGMAN_DB_PORT: dbPort, \n        STIGMAN_OIDC_PROVIDER: oidcOrigin,\n        STIGMAN_LOG_LEVEL: '4',\n        STIGMAN_JWKS_CACHE_MAX_AGE: 1\n      }\n    })\n    console.log('    ✔ api started')\n  })\n\n  after(async function () {\n    this.timeout(60000)\n    if (api) await api.stop().catch(() => {})\n    if (mysql) await mysql.stop().catch(() => {})\n    if (oidc) await oidc.stop().catch(() => {})\n    if (api) addContext(this, {title: 'api-log', value: api.logRecords})\n  })\n\n  describe('OIDC up', function () {\n    it('should log cacheUpdate with 1 kid', async function () {\n      this.timeout(20000)\n      console.log('      wait for log: jwksCacheEvent/cacheUpdate')\n      const log = await waitForLog(api, 'jwksCacheEvent')\n      expect(log.data.event).to.equal('cacheUpdate')\n      const kids = Object.keys(log.data.kids)\n      cachedKid = kids[0]\n      expect(kids).to.have.lengthOf(1)\n    })\n    it('should return state \"available\"', async function () {\n      this.timeout(20000)\n      await waitForLog(api, 'started')\n      const res = await simpleRequest(`${apiOrigin}/api/op/state`)\n      expect(res.status).to.equal(200)\n      expect(res.body.currentState).to.equal('available')\n      expect(res.body.dependencies).to.eql({db: true, oidc: true})\n    })\n  })\n\n  describe('OIDC down', function () {\n    let logMark\n    before(async function () {\n      logMark = api.logRecords.length\n      await oidc.stop()\n      console.log('      oidc shutdown')\n    })\n    it('should log cache update attempt', async function () {\n      this.timeout(45000)\n      console.log('      wait for log: refreshing cache')\n      const log = await waitForLog(api, 'refreshing cache', {since: logMark})\n      expect(log.data.uri).to.equal(`${oidcOrigin}/jwks`)\n    })\n    it('should log refresh error', async function () {\n      this.timeout(15000)\n      console.log('      wait for log: refresh error')\n      const log = await waitForLog(api, 'refresh error', {since: logMark})\n      expect(log.data.message).to.equal('updateCache returned false')\n    })\n    it('should return state \"unavailable\"', async function () {\n      this.timeout(75000)\n      console.log('      wait for log: state-changed')\n      const log = await waitForLog(api, 'state-changed', {since: logMark})\n      expect(log.data.currentState).to.equal('unavailable')\n      expect(log.data.previousState).to.equal('available')\n    })\n  })\n\n  describe('OIDC restarted', function () {\n    let logMark\n    before(async function () {\n      logMark = api.logRecords.length\n      await oidc.start({port: oidcPort})\n      console.log('      ✔ oidc started')\n    })\n    it('should log cacheUpdate with same kid as bootstrap', async function () {\n      this.timeout(20000)\n      console.log('      wait for log: jwksCacheEvent/cacheUpdate')\n      const log = await waitForLog(api, 'jwksCacheEvent', {since: logMark})\n      expect(log.data.event).to.equal('cacheUpdate')\n      const kids = Object.keys(log.data.kids)\n      expect(kids).to.have.lengthOf(1)\n      expect(kids[0]).to.be.equal(cachedKid)\n    })\n    it('should return state \"available\"', async function () {\n      this.timeout(75000)\n      const res = await simpleRequest(`${apiOrigin}/api/op/state`)\n      expect(res.status).to.equal(200)\n      expect(res.body.currentState).to.equal('available')\n      expect(res.body.dependencies).to.eql({db: true, oidc: true})\n    })\n  })\n\n  describe('OIDC rekeyed', function () {\n    let logMark\n    before(async function () {\n      logMark = api.logRecords.length\n      await oidc.rotateKeys({keyCount: 1, includeInsecureKid: false})\n      console.log('      ✔ oidc rekeyed')\n    })\n    it('should log cacheUpdate with different kid than bootstrap', async function () {\n      this.timeout(40000)\n      console.log('      wait for log: jwksCacheEvent/cacheUpdate')\n      const log = await waitForLog(api, 'jwksCacheEvent', {since: logMark})\n      expect(log.data.event).to.equal('cacheUpdate')\n      const kids = Object.keys(log.data.kids)\n      expect(kids).to.have.lengthOf(1)\n      expect(kids[0]).to.not.be.equal(cachedKid)\n    })\n  })\n})\n\n"
  },
  {
    "path": "test/state/mocha/tokenValidation.test.js",
    "content": "import { expect } from 'chai'\nimport { getPorts, spawnApiPromise, spawnMySQL, bearerRequest } from './lib.js'\nimport MockOidc from '../../utils/mockOidc.js'\nimport addContext from 'mochawesome/addContext.js'\n\nconst {apiPort, dbPort, oidcPort, apiOrigin} = getPorts(54000)\n\ndescribe('Token validation', function () {\n  let api\n  let mysql\n  let oidc\n\n  const {apiPort, dbPort, oidcPort, apiOrigin, oidcOrigin} = getPorts(54040)\n    \n  describe('Token audience validation', function () {\n    const STIGMAN_JWT_AUD_VALUE = 'audience-value'\n    before(async function () {\n      this.timeout(60000)\n      oidc = new MockOidc({keyCount: 1, includeInsecureKid: false})\n      await oidc.start({port: oidcPort})\n      console.log('    ✔ oidc started')\n      console.log('    try mysql start')\n      mysql = await spawnMySQL({tag:'8.0.24', port: dbPort})\n      console.log('    ✔ mysql started')\n      console.log('    try api start')\n      api = await spawnApiPromise({\n        resolveOnType: 'started',\n        resolveOnClose: false,\n        env: {\n          STIGMAN_API_PORT: apiPort,\n          STIGMAN_DEPENDENCY_RETRIES: 2,\n          STIGMAN_DB_PASSWORD: 'stigman',\n          STIGMAN_DB_HOST: '127.0.0.1',\n          STIGMAN_DB_PORT: dbPort, \n          STIGMAN_OIDC_PROVIDER: oidcOrigin,\n          STIGMAN_LOG_LEVEL: '4',\n          STIGMAN_JWT_AUD_VALUE\n        }\n      })\n      console.log('    ✔ api started')\n    })\n\n    after(async function () {\n      this.timeout(60000)\n      if (api) await api.stop().catch(() => {})\n      if (mysql) await mysql.stop().catch(() => {})\n      if (oidc) await oidc.stop().catch(() => {})\n      if (api) addContext(this, {title: 'api-log', value: api.logRecords})\n    })\n\n    it('should accept token having correct audience (string)', async function () {\n      const username = 'user01'\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username, audience: STIGMAN_JWT_AUD_VALUE})\n      })\n      expect(res.status).to.equal(200)\n    })\n    it('should accept token having correct audience (list)', async function () {\n      const username = 'user01'\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username, audience: [STIGMAN_JWT_AUD_VALUE, 'another-audience']})\n      })\n      expect(res.status).to.equal(200)\n    })\n    it('should reject token without an audience', async function () {\n      const username = 'user01'\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username})\n      })\n      expect(res.status).to.equal(401)\n      expect(res.body.error).to.equal(`Request not authorized.`)\n      expect(res.body.detail).to.equal(`jwt audience invalid. expected: ${STIGMAN_JWT_AUD_VALUE}`)\n    })\n    it('should reject token with incorrect audience', async function () {\n      const username = 'user01'\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username, audience: 'wrong-audience'})\n      })\n      expect(res.status).to.equal(401)\n      expect(res.body.error).to.equal(`Request not authorized.`)\n      expect(res.body.detail).to.equal(`jwt audience invalid. expected: ${STIGMAN_JWT_AUD_VALUE}`)\n    })\n    it('should reject expired token with correct audience', async function () {\n      const username = 'user01'\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username, audience: STIGMAN_JWT_AUD_VALUE, expiresIn: -60}) // token expired 60 seconds ago\n      })\n      expect(res.status).to.equal(401)\n      expect(res.body.error).to.equal(`Request not authorized.`)\n      expect(res.body.detail).to.equal(`jwt expired`)\n    })\n    it('should reject unscoped token with correct audience', async function () {\n      const username = 'user01'\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username, audience: STIGMAN_JWT_AUD_VALUE, scope: 'stig-manager:stig'})\n      })\n      expect(res.status).to.equal(403)\n      expect(res.body.error).to.equal(`Required scopes were not found in token.`)\n    })\n  })\n\n  describe('Token scope validation', function () {\n    const {apiPort, dbPort, oidcPort, apiOrigin, oidcOrigin} = getPorts(54080)\n\n    before(async function () {\n      this.timeout(60000)\n      oidc = new MockOidc({keyCount: 1, includeInsecureKid: false})\n      await oidc.start({port: oidcPort})\n      console.log('    ✔ oidc started')\n      console.log('    try mysql start')\n      mysql = await spawnMySQL({tag:'8.0.24', port: dbPort})\n      console.log('    ✔ mysql started')\n      console.log('    try api start')\n      api = await spawnApiPromise({\n        resolveOnType: 'started',\n        resolveOnClose: false,\n        env: {\n          STIGMAN_API_PORT: apiPort,\n          STIGMAN_DEPENDENCY_RETRIES: 2,\n          STIGMAN_DB_PASSWORD: 'stigman',\n          STIGMAN_DB_HOST: '127.0.0.1',\n          STIGMAN_DB_PORT: dbPort,\n          STIGMAN_OIDC_PROVIDER: oidcOrigin,\n          STIGMAN_LOG_LEVEL: '4'\n        }\n      })\n      console.log('    ✔ api started')\n    })\n\n    after(async function () {\n      this.timeout(60000)\n      if (api) await api.stop().catch(() => {})\n      if (mysql) await mysql.stop().catch(() => {})\n      if (oidc) await oidc.stop().catch(() => {})\n      if (api) addContext(this, {title: 'api-log', value: api.logRecords})\n    })\n\n    it('should accept top-level scope \"stig-manager\"', async function () {\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username: 'user01', scope: 'stig-manager'})\n      })\n      expect(res.status).to.equal(200)\n    })\n    it('should accept parent scope \"stig-manager:user\"', async function () {\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username: 'user01', scope: 'stig-manager:user'})\n      })\n      expect(res.status).to.equal(200)\n    })\n    it('should accept exact scope \"stig-manager:user:read\"', async function () {\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username: 'user01', scope: 'stig-manager:user:read'})\n      })\n      expect(res.status).to.equal(200)\n    })\n    it('should reject wrong branch scope \"stig-manager:stig\"', async function () {\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username: 'user01', scope: 'stig-manager:stig'})\n      })\n      expect(res.status).to.equal(403)\n      expect(res.body.error).to.equal('Required scopes were not found in token.')\n    })\n    it('should reject wrong branch scope \"stig-manager:collection:read\"', async function () {\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username: 'user01', scope: 'stig-manager:collection:read'})\n      })\n      expect(res.status).to.equal(403)\n      expect(res.body.error).to.equal('Required scopes were not found in token.')\n    })\n    it('should reject unrelated scopes \"openid profile\"', async function () {\n      const res = await bearerRequest({\n        url: `${apiOrigin}/api/user`,\n        method: 'GET',\n        token: oidc.getToken({username: 'user01', scope: 'openid profile'})\n      })\n      expect(res.status).to.equal(403)\n      expect(res.body.error).to.equal('Required scopes were not found in token.')\n    })\n  })\n})\n"
  },
  {
    "path": "test/state/package.json",
    "content": "{\n  \"type\": \"module\",\n  \"scripts\": {\n    \"test\": \"mocha --reporter mochawesome --showFailed --exit './mocha/**/*.test.js'\"\n  },\n  \"overrides\": {\n    \"serialize-javascript\": \"^7.0.5\",\n    \"diff\": \"^8.0.3\",\n    \"uuid\": \"^14.0.0\"\n  },    \n  \"dependencies\": {\n    \"chai\": \"^5.2.0\",\n    \"chai-datetime\": \"^1.8.1\",\n    \"mochawesome\": \"^7.1.3\"\n  }\n}\n"
  },
  {
    "path": "test/unit/mocha/asyncApiValidator.test.js",
    "content": "import { expect } from 'chai'\r\nimport { fileURLToPath } from 'node:url'\r\nimport path from 'node:path'\r\nimport fs from 'node:fs'\r\nimport os from 'node:os'\r\n\r\nconst __dirname = path.dirname(fileURLToPath(import.meta.url))\r\nconst specPath = path.resolve(__dirname, '../../../api/source/specification/log-socket.yaml')\r\n\r\n// CJS module imported into ESM — default import gets module.exports\r\nimport asyncApiValidator from '../../../api/source/utils/asyncApiValidator.js'\r\n\r\n// Minimal valid spec template for structural tests.\r\n// Returns a JSON string (valid YAML since YAML is a superset of JSON).\r\nfunction minimalSpec(overrides = {}) {\r\n  return JSON.stringify({\r\n    asyncapi: '3.0.0',\r\n    info: { title: 'Test', version: '1.0.0' },\r\n    channels: {\r\n      testChannel: {\r\n        messages: {\r\n          TestMessage: { $ref: '#/components/messages/TestMessage' }\r\n        }\r\n      }\r\n    },\r\n    operations: {\r\n      testOp: {\r\n        action: 'send',\r\n        channel: { $ref: '#/channels/testChannel' },\r\n        messages: [{ $ref: '#/channels/testChannel/messages/TestMessage' }]\r\n      }\r\n    },\r\n    components: {\r\n      messages: {\r\n        TestMessage: {\r\n          name: 'test',\r\n          payload: { $ref: '#/components/schemas/TestPayload' }\r\n        }\r\n      },\r\n      schemas: {\r\n        TestPayload: {\r\n          type: 'object',\r\n          properties: {\r\n            type: { const: 'test' }\r\n          }\r\n        }\r\n      }\r\n    },\r\n    ...overrides\r\n  })\r\n}\r\n\r\ndescribe('asyncApiValidator', function () {\r\n  const tmpFiles = []\r\n\r\n  afterEach(function () {\r\n    for (const f of tmpFiles) {\r\n      try { fs.unlinkSync(f) } catch {}\r\n    }\r\n    tmpFiles.length = 0\r\n  })\r\n\r\n  function tempSpec(content) {\r\n    const tmpPath = path.join(os.tmpdir(), `asyncapi-test-${Date.now()}-${Math.random().toString(36).slice(2)}.yaml`)\r\n    fs.writeFileSync(tmpPath, content, 'utf8')\r\n    tmpFiles.push(tmpPath)\r\n    return tmpPath\r\n  }\r\n\r\n  describe('fromSource - real spec', function () {\r\n    it('should load log-socket.yaml and return a validator', function () {\r\n      const validator = asyncApiValidator.fromSource(specPath)\r\n      expect(validator).to.be.an('object')\r\n      expect(validator.validate).to.be.a('function')\r\n    })\r\n  })\r\n\r\n  describe('fromSource - $ref resolution', function () {\r\n    it('should throw on circular $ref between schemas', function () {\r\n      const spec = JSON.parse(minimalSpec())\r\n      spec.components.schemas.TestPayload = {\r\n        type: 'object',\r\n        properties: {\r\n          child: { $ref: '#/components/schemas/CircularB' }\r\n        }\r\n      }\r\n      spec.components.schemas.CircularB = {\r\n        type: 'object',\r\n        properties: {\r\n          parent: { $ref: '#/components/schemas/TestPayload' }\r\n        }\r\n      }\r\n      const p = tempSpec(JSON.stringify(spec))\r\n      expect(() => asyncApiValidator.fromSource(p)).to.throw('Circular $ref detected')\r\n    })\r\n\r\n    it('should throw on dangling $ref in schema', function () {\r\n      const spec = JSON.parse(minimalSpec())\r\n      spec.components.schemas.TestPayload = {\r\n        type: 'object',\r\n        properties: {\r\n          child: { $ref: '#/components/schemas/DoesNotExist' }\r\n        }\r\n      }\r\n      const p = tempSpec(JSON.stringify(spec))\r\n      expect(() => asyncApiValidator.fromSource(p)).to.throw('Dangling $ref')\r\n    })\r\n  })\r\n\r\n  describe('validate - all message types registered', function () {\r\n    let validator\r\n\r\n    before(function () {\r\n      validator = asyncApiValidator.fromSource(specPath)\r\n    })\r\n\r\n    const sendMessages = [\r\n      ['authorize', { type: 'authorize', data: { state: 'unauthorized' } }],\r\n      ['log', { type: 'log', data: { timestamp: '2025-01-01' } }],\r\n      ['error', { type: 'error', data: 'something went wrong' }],\r\n      ['info', { type: 'info', data: { success: true } }],\r\n      ['close', { type: 'close', data: 'goodbye' }]\r\n    ]\r\n\r\n    const receiveMessages = [\r\n      ['authorize', { type: 'authorize', data: { token: 'abc' } }],\r\n      ['command', { type: 'command', data: { command: 'stream-start' } }]\r\n    ]\r\n\r\n    for (const [name, payload] of sendMessages) {\r\n      it(`should have send message type \"${name}\" registered`, function () {\r\n        expect(() => validator.validate(name, payload, 'logStream', 'send')).to.not.throw()\r\n      })\r\n    }\r\n\r\n    for (const [name, payload] of receiveMessages) {\r\n      it(`should have receive message type \"${name}\" registered`, function () {\r\n        expect(() => validator.validate(name, payload, 'logStream', 'receive')).to.not.throw()\r\n      })\r\n    }\r\n  })\r\n\r\n  describe('validate - accepts valid payloads', function () {\r\n    let validator\r\n\r\n    before(function () {\r\n      validator = asyncApiValidator.fromSource(specPath)\r\n    })\r\n\r\n    it('should accept authorize receive with token', function () {\r\n      expect(() => validator.validate('authorize', { type: 'authorize', data: { token: 'jwt.token.here' } }, 'logStream', 'receive')).to.not.throw()\r\n    })\r\n\r\n    it('should accept command receive with stream-start', function () {\r\n      expect(() => validator.validate('command', { type: 'command', data: { command: 'stream-start' } }, 'logStream', 'receive')).to.not.throw()\r\n    })\r\n\r\n    it('should accept command receive with stream-start and filter', function () {\r\n      const payload = { type: 'command', data: { command: 'stream-start', filter: { level: [1, 2], component: ['rest'] } } }\r\n      expect(() => validator.validate('command', payload, 'logStream', 'receive')).to.not.throw()\r\n    })\r\n\r\n    it('should accept command receive with stream-stop', function () {\r\n      expect(() => validator.validate('command', { type: 'command', data: { command: 'stream-stop' } }, 'logStream', 'receive')).to.not.throw()\r\n    })\r\n\r\n    it('should accept authorize send with state', function () {\r\n      expect(() => validator.validate('authorize', { type: 'authorize', data: { state: 'authorized' } }, 'logStream', 'send')).to.not.throw()\r\n    })\r\n\r\n    it('should accept authorize send with state and reason', function () {\r\n      expect(() => validator.validate('authorize', { type: 'authorize', data: { state: 'unauthorized', reason: 'token expired' } }, 'logStream', 'send')).to.not.throw()\r\n    })\r\n\r\n    it('should accept log send', function () {\r\n      expect(() => validator.validate('log', { type: 'log', data: { level: 3, component: 'rest' } }, 'logStream', 'send')).to.not.throw()\r\n    })\r\n\r\n    it('should accept error send', function () {\r\n      expect(() => validator.validate('error', { type: 'error', data: 'something failed' }, 'logStream', 'send')).to.not.throw()\r\n    })\r\n\r\n    it('should accept info send', function () {\r\n      expect(() => validator.validate('info', { type: 'info', data: { success: true } }, 'logStream', 'send')).to.not.throw()\r\n    })\r\n\r\n    it('should accept close send', function () {\r\n      expect(() => validator.validate('close', { type: 'close', data: 'closing connection' }, 'logStream', 'send')).to.not.throw()\r\n    })\r\n  })\r\n\r\n  describe('validate - rejects invalid payloads', function () {\r\n    let validator\r\n\r\n    before(function () {\r\n      validator = asyncApiValidator.fromSource(specPath)\r\n    })\r\n\r\n    it('should reject authorize receive missing token', function () {\r\n      expect(() => validator.validate('authorize', { type: 'authorize', data: {} }, 'logStream', 'receive')).to.throw()\r\n    })\r\n\r\n    it('should reject command receive with invalid command', function () {\r\n      expect(() => validator.validate('command', { type: 'command', data: { command: 'invalid' } }, 'logStream', 'receive')).to.throw()\r\n    })\r\n\r\n    it('should reject authorize send with wrong type const', function () {\r\n      expect(() => validator.validate('authorize', { type: 'wrong', data: { state: 'authorized' } }, 'logStream', 'send')).to.throw()\r\n    })\r\n\r\n    it('should reject authorize send with invalid state enum', function () {\r\n      expect(() => validator.validate('authorize', { type: 'authorize', data: { state: 'invalid' } }, 'logStream', 'send')).to.throw()\r\n    })\r\n\r\n    it('should reject authorize send with extra properties in data', function () {\r\n      expect(() => validator.validate('authorize', { type: 'authorize', data: { state: 'authorized', extra: true } }, 'logStream', 'send')).to.throw()\r\n    })\r\n\r\n    it('should reject error send with non-string data', function () {\r\n      expect(() => validator.validate('error', { type: 'error', data: { message: 'not a string' } }, 'logStream', 'send')).to.throw()\r\n    })\r\n\r\n    it('should reject close send with non-string data', function () {\r\n      expect(() => validator.validate('close', { type: 'close', data: 123 }, 'logStream', 'send')).to.throw()\r\n    })\r\n\r\n    it('should reject command receive with extra properties in data', function () {\r\n      expect(() => validator.validate('command', { type: 'command', data: { command: 'stream-stop', extra: true } }, 'logStream', 'receive')).to.throw()\r\n    })\r\n\r\n    it('should reject command receive with filter level out of range', function () {\r\n      const payload = { type: 'command', data: { command: 'stream-start', filter: { level: [0, 5] } } }\r\n      expect(() => validator.validate('command', payload, 'logStream', 'receive')).to.throw()\r\n    })\r\n\r\n    it('should reject command receive with extra filter properties', function () {\r\n      const payload = { type: 'command', data: { command: 'stream-start', filter: { level: [1], extra: true } } }\r\n      expect(() => validator.validate('command', payload, 'logStream', 'receive')).to.throw()\r\n    })\r\n  })\r\n\r\n  describe('validate - error cases', function () {\r\n    let validator\r\n\r\n    before(function () {\r\n      validator = asyncApiValidator.fromSource(specPath)\r\n    })\r\n\r\n    it('should throw for unknown channel', function () {\r\n      expect(() => validator.validate('authorize', {}, 'noSuchChannel', 'send')).to.throw('channel \"noSuchChannel\" not found')\r\n    })\r\n\r\n    it('should throw for unknown operation', function () {\r\n      expect(() => validator.validate('authorize', {}, 'logStream', 'publish')).to.throw('operation \"publish\" not found')\r\n    })\r\n\r\n    it('should throw for unknown message key', function () {\r\n      expect(() => validator.validate('noSuchMessage', {}, 'logStream', 'send')).to.throw('message \"noSuchMessage\"')\r\n    })\r\n  })\r\n})\r\n"
  },
  {
    "path": "test/unit/package.json",
    "content": "{\n  \"type\": \"module\",\n  \"scripts\": {\n    \"test\": \"mocha --reporter mochawesome --timeout 10000 --showFailed --exit './mocha/**/*.test.js'\"\n  },\n  \"overrides\": {\n    \"serialize-javascript\": \"^7.0.5\",\n    \"diff\": \"^8.0.3\",\n    \"uuid\": \"^14.0.0\"\n  },    \n  \"dependencies\": {\n    \"chai\": \"^5.2.0\",\n    \"mocha\": \"^11.7.5\",\n    \"mochawesome\": \"^7.1.3\"\n  }\n}\n"
  },
  {
    "path": "test/utils/appdata-update.js",
    "content": "import { readFileSync, writeFileSync } from 'fs'\r\nimport { fileURLToPath } from 'url';\r\nimport { join, dirname } from 'path';\r\nimport { readdir } from 'fs/promises'\r\n\r\nconst baseUrl = \"http://localhost:64001/api\"\r\nconst adminToken = \"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJGSjg2R2NGM2pUYk5MT2NvNE52WmtVQ0lVbWZZQ3FvcXRPUWVNZmJoTmxFIn0.eyJleHAiOjIwNTc3ODc4MjgsImlhdCI6MTc0MjQyNzgyOCwiYXV0aF90aW1lIjoxNzQyNDI3MjIxLCJqdGkiOiJmYjA2NGI1NS1jODk2LTRlNTctYTY5Ny04ZWY0ZjE1M2NiNmQiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvcmVhbG1zL3N0aWdtYW4iLCJzdWIiOiJiZjg3YTE2Zi0zOWU2LTQ2ZDktODk3MS1mMGVmNTFkZDNmODUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzdGlnLW1hbmFnZXIiLCJzaWQiOiIzOGE3NDA5Yy00YTYzLTQzMTEtYWI2Mi01ZGU3OGY1NzNkNWMiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsiY3JlYXRlX2NvbGxlY3Rpb24iLCJhZG1pbiJdfSwic2NvcGUiOiJzdGlnLW1hbmFnZXI6Y29sbGVjdGlvbiBzdGlnLW1hbmFnZXI6c3RpZzpyZWFkIHN0aWctbWFuYWdlcjp1c2VyOnJlYWQgc3RpZy1tYW5hZ2VyOm9wIHN0aWctbWFuYWdlcjp1c2VyIHN0aWctbWFuYWdlcjpzdGlnIiwibmFtZSI6IkFkbWluIEJ1cmtlIiwicHJlZmVycmVkX3VzZXJuYW1lIjoiYWRtaW4iLCJnaXZlbl9uYW1lIjoiQWRtaW4iLCJmYW1pbHlfbmFtZSI6IkJ1cmtlIn0.gT0EHb8wxKrv9McDdka1r_a2h5ZAUIYuEqgifrCOPcq7qlN1VEfstQPUZFMQ3iLisF33pxLnWDoQxSyw5HP5ftsQC3zN-O_NM9Q1MMNZGFEttNMaYRnBdoOWg9yrzu_4ys1fHRuj_T8orObhw1w3nOczkjoVLY0kA1TrC40huGU\"\r\n\r\nasync function main() {\r\n  try {\r\n    // Get path from command line argument or use default\r\n    const appdataPath = process.argv[2] || '../api/appdata'\r\n    console.log(`Starting appdata update process for path: ${appdataPath}...`)\r\n    const results = await loadAndExportAllAppData(appdataPath)\r\n    \r\n    console.log('\\nSummary of results:')\r\n    let successCount = 0\r\n    let failureCount = 0\r\n    \r\n    results.forEach(result => {\r\n      if (result.success) {\r\n        successCount++\r\n        console.log(`✅ ${result.file} -> ${result.outputPath}`)\r\n      } else {\r\n        failureCount++\r\n        console.log(`❌ ${result.file}: ${result.error}`)\r\n      }\r\n    })\r\n    \r\n    console.log(`\\nProcess completed: ${successCount} successful, ${failureCount} failed`)\r\n  } catch (error) {\r\n    console.error('Error during appdata update:', error)\r\n    process.exit(1)\r\n  }\r\n}\r\n\r\nmain()\r\n\r\n/**\r\n * Loads all appdata files from the appdata directory, then exports them as JSONL\r\n * @param {string} appdataDir - Directory containing appdata files (default: 'appdata')\r\n * @returns {Promise<Array>} - Results of processing each file\r\n */\r\nasync function loadAndExportAllAppData (appdataDir = '../api/appdata')\r\n{\r\n\r\n  const __filename = fileURLToPath(import.meta.url)\r\n  const __dirname = dirname(__filename)\r\n  const dirPath = join(__dirname, `${appdataDir}`)\r\n  \r\n  // Read all files in the directory\r\n  const files = await readdir(dirPath)\r\n  const results = []\r\n  \r\n  // Process each file\r\n  for (const file of files) {\r\n    try {\r\n      console.log(`Loading ${file}...`)\r\n      // Load the appdata file\r\n      await loadAppData(appdataDir, file)\r\n      \r\n      console.log(`Exporting data as JSONL...`)\r\n      // Export data in JSONL format using our utility function\r\n      const exportedData = await exportAppData({ format: 'jsonl' })\r\n      \r\n      // Create output filename\r\n      const outputPath = join(dirPath, file)\r\n      \r\n      // Save to new existing file\r\n      writeFileSync(outputPath, exportedData, 'utf8')\r\n      \r\n      console.log(`Saved to ${outputPath}`)\r\n      results.push({ file, success: true, outputPath })\r\n    } \r\n    catch (error) {\r\n      console.error(`Error processing ${file}:`, error)\r\n      results.push({ file, success: false, error: error.message })\r\n    }\r\n  }\r\n  \r\n  return results\r\n}\r\n\r\n/**\r\n * Export application data as JSONL\r\n * @param {object} options - Options for exporting\r\n * @param {string} options.format - Format of the exported data (default: 'jsonl')\r\n * @returns {Promise<string>} - The exported data\r\n */\r\nasync function exportAppData (options = {})\r\n{\r\n  const format = options.format || 'jsonl'\r\n  \r\n  const response = await fetch(`${baseUrl}/op/appdata?elevate=true&format=${format}`, {\r\n    method: 'GET',\r\n    headers: {\r\n      Authorization: `Bearer ${adminToken}`\r\n    }\r\n  })\r\n  \r\n  if (!response.ok) {\r\n    throw new Error(`Failed to export data: ${response.status} ${response.statusText}`)\r\n  }\r\n  \r\n  return response.text()\r\n}\r\n\r\nasync function loadAppData (appdataDir = '../api/appdata', appdataFileName = 'appdata.jsonl') \r\n{\r\n \r\n  const __filename = fileURLToPath(import.meta.url)\r\n  const __dirname = dirname(__filename)\r\n  const filePath = join(__dirname, `${appdataDir}/${appdataFileName}`);\r\n  \r\n  const fileContent = await readFileSync(filePath, 'utf-8')\r\n  \r\n  const res = await fetch(`${baseUrl}/op/appdata?elevate=true`, {\r\n    method: 'POST',\r\n    headers: {\r\n      Authorization: `Bearer ${adminToken}`,\r\n      'Content-Type': 'application/jsonl', \r\n    },\r\n    body: fileContent,\r\n  })\r\n  \r\n  if (!res.ok) {\r\n    const errorText = await res.text()\r\n    throw new Error(`HTTP error, Status: ${res.status}, Message: ${errorText}`)\r\n  }\r\n  const data = await res.text()\r\n  return data\r\n\r\n}"
  },
  {
    "path": "test/utils/mockOidc.js",
    "content": "import http from 'node:http'\nimport { URL, fileURLToPath } from 'node:url'\nimport jsonwebtoken from 'jsonwebtoken'\nimport crypto from 'node:crypto'\nimport ms from 'ms'\nimport path from 'node:path'\n\nclass MockOidc {\n  constructor ({includeInsecureKid = false, keyCount = 1} = {}) {\n    this.rotateKeys({keyCount, includeInsecureKid})\n    this.authCodes = {}\n    this.sids = {}\n  }\n\n  clientCredentialsLifetime = 3600\n\n  rotateKeys ({includeInsecureKid = false, keyCount = 1} = {}) {\n    this.keys = new Map()\n    \n    for (let i = 0; i < keyCount; i++) {\n      const {publicKey, privateKey} = crypto.generateKeyPairSync('rsa', {modulusLength: 1024})\n      const publicKeyJwk = publicKey.export({ format: 'jwk', type: 'spki' })\n      publicKeyJwk.alg = 'RS256'\n      publicKeyJwk.use = 'sig'\n      publicKeyJwk.kid = this.createKeyId(publicKey)\n      this.keys.set(publicKeyJwk.kid, { publicKeyJwk, privateKey, publicKey })\n    }\n    if (includeInsecureKid) {\n      const { kid, publicKeyJwk, privateKey, publicKey } = this.createInsecureKey()\n      this.keys.set(kid, { publicKeyJwk, privateKey, publicKey })\n    }\n    return this.keys\n  }\n\n  createKeyId (publicKey) {\n    // Compute the SHA-256 digest of the DER-encoded public key\n    const sha256Digest = crypto.createHash('sha256')\n      .update(publicKey.export({ format: 'der', type: 'spki' }))\n      .digest()\n    // Convert the digest to Base64\n    const base64Digest = sha256Digest.toString('base64')\n    // Convert Base64 to Base64url (replace + with -, / with _, and remove =)\n    const base64urlDigest = base64Digest.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n    return base64urlDigest\n  }\n\n  createInsecureKey () {\n    const privateKey = crypto.createPrivateKey({\n      key: {\n        kty: \"RSA\",\n        n: \"q1awrk7QK24Gmcy9Yb4dMbS-ZnO6NDaj1Z2F5C74HMIgtwYyxsNbRhBqCWlw7kmkZZaG5udyQYY8d91Db_uc_1DBuJMrQVsYXjVSpy-hoKpTWmzGhXzyzwhfJAICp7Iu_TTKPp-ip0mPGHlJnnP6dr4ztjY7EgFXFhEDFYSd9S8\",\n        e: \"AQAB\",\n        d: \"fmO8gVhyBxdqlxmIuglbz8bcjQbhXJLR2EoS8ngTXmN1bo2L90M0mUKSdc7qF10LgETBzqL8jYlQIbt-e6TH8fcEpKCjUlyq0Mf_vVbfZSNaVycY13nTzo27iPyWQHK5NLuJzn1xvxxrUeXI6A2WFpGEBLbHjwpx5WQG9A-2scE\",\n        p: \"73Z_TRO-Rz01T8QarBHds9dEypJfQmcbtdEG8t4kEJlixCfSzZst2nLyqxN4DImDVm-sRzyoiKjkdWrOy9uGkw\",\n        q: \"tyvQOlCvr5kAjVqrEKXalj0Tzewjweuxc0pskvArTI2Oo070h65GpoIKLc9jf-UA69cRtquwP93aZKtW06U8dQ\",\n        dp: \"F2Y44ks_mK5-eyDqik3koCI08qaC8HYq2wVl7G2QkJ6sbAaILtcvD92ToOvyGyeE0flvmDZxMYlvaZnaQ0lcSQ\",\n        dq: \"plTq6YmLf_F4RuQmox94tyUPbtcYQWg942uZ3HSrXQDOng18kBj5nwpHJAJHYEQb6g2K0E5n5hcX0oKkfdx2YQ\",\n        qi: \"cSKAmFiD7KQ6-vVqJlQwVPvYdTSOeZB7YVV6S4b4slS3ZObsa0yNMWgal_QnCtW5k3f185gCWj6dOLGB5btfxg\"\n      },\n      format: 'jwk'\n    })\n\n    const publicKey = crypto.createPublicKey({key: privateKey})\n    const publicKeyJwk = publicKey.export({ format: 'jwk', type: 'spki' })\n    publicKeyJwk.alg = 'RS256'\n    publicKeyJwk.use = 'sig'\n    publicKeyJwk.kid = this.createKeyId(publicKey)\n    return { kid: publicKeyJwk.kid, publicKeyJwk, privateKey, publicKey }\n  }\n\n  getJwks () {\n    return { \n      keys: Array.from(this.keys.values()).map(key => key.publicKeyJwk)\n    }\n  }\n\n  getMetadata (request = {}) {\n    let host = '127.0.0.1:8080'\n    let proto = 'http'\n    let prefix = ''\n    if (request.headers['x-forwarded-host']) {\n      host = request.headers['x-forwarded-host']\n    } else if (request.headers.host) {\n      host = request.headers.host\n    }\n    if (request.headers['x-forwarded-proto']) {\n      proto = request.headers['x-forwarded-proto']\n    }\n    if (request.headers['x-forwarded-prefix']) {\n      prefix = request.headers['x-forwarded-prefix']\n    }\n    const origin = `${host}${prefix}`\n\n    return {\n      issuer: `${proto}://${origin}`,\n      authorization_endpoint: `${proto}://${origin}/auth`,\n      token_endpoint: `${proto}://${origin}/token`,\n      jwks_uri: `${proto}://${origin}/jwks`,\n      end_session_endpoint: `${proto}://${origin}/logout`,\n      code_challenge_methods_supported: ['S256'],\n    }\n  }\n\n  getToken({\n    privileges = ['create_collection', 'admin'],\n    scope = 'stig-manager',\n    audience,\n    username = 'admin',\n    expiresIn = '1h',\n    algorithm = 'RS256',\n    name,\n    email,\n    issuedAt,\n    kid,\n    sid,\n    auth_time,\n    privilegesClaim = 'realm_access.roles',\n    usernameClaim = 'preferred_username',\n    nameClaim = 'name',\n    scopeClaim = 'scope',\n    emailClaim = 'email',\n    assertionClaim = 'jti'\n  }) {\n    let privateKey\n    if (kid) {\n      privateKey = this.keys.get(kid).privateKey\n      if (!privateKey) {\n        throw new Error(`Key with kid ${kid} not found`)\n      }\n    } else {\n      // Use the first entry if no kid is provided\n      [kid, { privateKey }] = this.keys.entries().next().value\n    }\n\n    if (typeof privileges === 'string') {\n      privileges = [privileges]\n    }\n    if (!name) {\n      name = username\n    }\n\n    // Helper function to construct any nested objects\n    const setDynamicClaim = (obj, path, value) => {\n      if (!value) return\n      const keys = path.split('.')\n      let current = obj\n      for (let i = 0; i < keys.length - 1; i++) {\n        const key = keys[i]\n        if (!current[key]) {\n          current[key] = {}\n        }\n        current = current[key]\n      }\n      current[keys[keys.length - 1]] = value\n    }\n\n    // Create the payload for the JWT\n    const payload = {}\n    setDynamicClaim(payload, assertionClaim, crypto.randomBytes(16).toString('hex'))\n    setDynamicClaim(payload, privilegesClaim, privileges)\n    setDynamicClaim(payload, usernameClaim, username)\n    setDynamicClaim(payload, nameClaim, name)\n    setDynamicClaim(payload, emailClaim, email)\n    setDynamicClaim(payload, scopeClaim, scope)\n\n    if (issuedAt) {\n      payload.iat = parseInt(issuedAt)\n    }\n    if (sid) {\n      payload.sid = sid\n    }\n    if (auth_time) {\n      payload.auth_time = auth_time\n    }\n    if (audience) {\n      payload.aud = audience\n    }\n\n    const options = {\n      algorithm,\n      expiresIn,\n      keyid: kid,\n      allowInsecureKeySizes: true,\n    }\n    return jsonwebtoken.sign(payload, privateKey, options)\n  }\n\n  getCustomToken ({payload, privateKey, options}) {\n    return jsonwebtoken.sign(payload, privateKey, options)\n  }\n\n  getRefreshToken ({sid, expiresIn = '1h', algorithm = 'RS256', kid}) {\n    let privateKey\n    if (kid) {\n      privateKey = this.keys.get(kid).privateKey\n      if (!privateKey) {\n        throw new Error(`Key with kid ${kid} not found`)\n      }\n    } else {\n      // Use the first entry if no kid is provided\n      [kid, {privateKey}] = this.keys.entries().next().value\n    }\n    const payload = { \n      sid\n    }\n    const options = {\n      algorithm,\n      expiresIn,\n      keyid: kid,\n      allowInsecureKeySizes: true\n    }\n    return jsonwebtoken.sign(payload, privateKey, options)\n  }\n\n  getAuthHtml({ state, redirect_uri, response_mode, prefix } = {}) {\n    const html = `\n  <!DOCTYPE html>\n  <html lang=\"en\">\n  <head>\n    <meta charset=\"UTF-8\">\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n    <title>Get Token Form</title>\n    <style>\n      body {\n        background-color: #121212;\n        color: #ffffff;\n        font-family: Arial, sans-serif;\n        margin: 0;\n        padding: 20px;\n      }\n      h1 {\n        color: #bb86fc;\n        text-align: center;\n      }\n      label {\n        color: #ffffff;\n      }\n      select, input, button {\n        background-color: #1e1e1e;\n        color: #ffffff;\n        border: 1px solid #bb86fc;\n        border-radius: 4px;\n        padding: 8px;\n        margin-top: 5px;\n        margin-bottom: 15px;\n        width: 100%;\n        box-sizing: border-box;\n        font-family: Arial, sans-serif;\n      }\n      input[type=\"checkbox\"] {\n        width: auto;\n      }\n      button {\n        cursor: pointer;\n        font-weight: bold;\n        grid-column: 2;\n        justify-self: right;\n        background-color: #38264f;\n        width: 120px;\n      }\n      button:hover {\n        background-color: #bb86fc;\n        color: #121212;\n      }\n      form {\n        max-width: 800px;\n        margin: 0 auto;\n        background-color: #212121;\n        padding: 20px;\n        border-radius: 24px;\n        display: grid;\n        grid-template-columns: 1fr 1fr;\n        gap: 15px;\n      }\n      .form-group {\n        display: flex;\n        flex-direction: column;\n      }\n      @media (max-height: 500px) {\n        form {\n          grid-template-columns: 1fr 1fr 1fr;\n          gap: 20px;\n        }\n      }\n    </style>\n    <script>\n      function loadFormValues() {\n        const fields = {\n          'username': 'admin',\n          'usernameClaim': 'preferred_username',\n          'privilege-admin': 'true',\n          'privilege-create-collection': 'true',\n          'privilegesClaim': 'realm_access.roles',\n          'expiresIn': '60s',\n          'refreshExpiresIn': '180s',\n          'sessionExpiresIn': '*unimplemented*',\n          'audience': 'stig-manager',\n          'scope': 'stig-manager',\n          'scopeClaim': 'scope',\n          'algorithm': 'RS256',\n          'kid': '0'\n        }\n        for (const field in fields) {\n          let value = localStorage.getItem(field);\n          if (!value) {\n            value = fields[field];\n          }\n          const input = document.getElementById(field);\n          if (input && input.type === 'checkbox') {\n            input.checked = value === 'true';\n          } else if (input && input.type === 'select-one') {\n            let index = parseInt(value);\n            if (isNaN(index) || index < 0 || index >= input.options.length) {\n              index = 0;\n            }\n            input.selectedIndex = index;\n          } else if (input) {\n            input.value = value;\n          }\n        }\n      }\n  \n      function saveFormValues() {\n        const fields = ['username', 'usernameClaim', 'audience', 'privilege-admin', 'privilege-create-collection', 'privilegesClaim', 'expiresIn', 'refreshExpiresIn', 'scope', 'scopeClaim', 'algorithm', 'kid'];\n        for (const field of fields) {\n          const input = document.getElementById(field);\n          if (input && input.type === 'checkbox') {\n            localStorage.setItem(field, input.checked);\n          } else if (input && input.type === 'select-one') {\n            localStorage.setItem(field, input.selectedIndex);\n          } else if (input) {\n            localStorage.setItem(field, input.value);\n          }\n        }\n      }\n  \n      window.onload = () => {\n        loadFormValues();\n\n        // Add keydown listener to the form for Enter key submission\n        window.addEventListener('keydown', (event) => {\n          if (event.key === 'Enter') {\n            event.preventDefault(); // Prevent default behavior\n            saveFormValues()\n            document.querySelector('form').submit(); // Submit the form programmatically\n          }\n        });\n      };\n\n      \n    </script>\n  </head>\n  <body>\n    <h1>Get Token</h1>\n    <form action=\"${prefix}/auth/callback\" method=\"GET\" onsubmit=\"saveFormValues()\">\n      <div class=\"form-group\">\n        <label for=\"username\">Username:</label>\n        <input type=\"text\" id=\"username\" name=\"username\">\n      </div>\n      <div class=\"form-group\">\n        <label for=\"usernameClaim\">Username claim:</label>\n        <input type=\"text\" id=\"usernameClaim\" name=\"usernameClaim\">\n      </div>\n\n      <div class=\"form-group\">\n        <label>Privileges:</label>\n        <div style=\"display: flex; gap: 10px; padding-top:10px;\">\n          <div>\n            <input type=\"checkbox\" id=\"privilege-create-collection\" name=\"privileges\" value=\"create_collection\" checked>\n            <label for=\"privilege-create-collection\">create_collection</label>\n          </div>\n          <div>\n            <input type=\"checkbox\" id=\"privilege-admin\" name=\"privileges\" value=\"admin\" checked>\n            <label for=\"privilege-admin\">admin</label>\n          </div>\n        </div>\n      </div>\n      <div class=\"form-group\">\n        <label for=\"privilegesClaim\">Privileges claim:</label>\n        <input type=\"text\" id=\"privilegesClaim\" name=\"privilegesClaim\">\n      </div>\n      <div class=\"form-group\">\n        <label for=\"expiresIn\">Expires In (e.g., 20s):</label>\n        <input type=\"text\" id=\"expiresIn\" name=\"expiresIn\">\n      </div>\n      <div class=\"form-group\">\n        <label for=\"refreshExpiresIn\">Refresh Expires In (e.g., 1m):</label>\n        <input type=\"text\" id=\"refreshExpiresIn\" name=\"refreshExpiresIn\">\n      </div>\n      <div class=\"form-group\">\n        <label for=\"sessionExpiresIn\">Session Expires In (e.g., 1h):</label>\n        <input type=\"text\" id=\"sessionExpiresIn\" name=\"sessionExpiresIn\" disabled>\n      </div>\n      <div class=\"form-group\">\n        <label for=\"audience\">Audience:</label>\n        <input type=\"text\" id=\"audience\" name=\"audience\">\n      </div>\n      <div class=\"form-group\">\n        <label for=\"scope\">Scope:</label>\n        <input type=\"text\" id=\"scope\" name=\"scope\">\n      </div>\n      <div class=\"form-group\">\n        <label for=\"scopeClaim\">Scope claim:</label>\n        <input type=\"text\" id=\"scopeClaim\" name=\"scopeClaim\">\n      </div>\n      <div class=\"form-group\">\n        <label for=\"algorithm\">Algorithm:</label>\n        <select id=\"algorithm\" name=\"algorithm\">\n          <option value=\"RS256\" selected>RS256</option>\n          <option value=\"RS384\">RS384</option>\n          <option value=\"RS512\">RS512</option>\n        </select>\n      </div>\n      <div class=\"form-group\">\n        <label for=\"kid\">Key ID (kid):</label>\n        <select id=\"kid\" name=\"kid\">\n          ${Array.from(this.keys.values()).map(key => `<option value=\"${key.publicKeyJwk.kid}\">${key.publicKeyJwk.kid}</option>`).join('')}\n        </select>\n      </div>\n      <input type=\"hidden\" id=\"state\" name=\"state\" value=\"${state}\">\n      <input type=\"hidden\" id=\"redirect_uri\" name=\"redirect_uri\" value=\"${redirect_uri}\">\n      <input type=\"hidden\" id=\"response_mode\" name=\"response_mode\" value=\"${response_mode}\">\n      <button type=\"submit\">Get Token</button>\n    </form>\n  </body>\n  </html>`;\n    return html;\n  }\n\n  parseQueryParams(request) {\n    // Construct a full URL using the request URL and a base URL\n    const fullUrl = new URL(request.url, `http://${request.headers.host}`)\n  \n    // Create an object to store query parameters\n    const queryParams = {}\n  \n    // Iterate over all keys in the searchParams\n    for (const key of fullUrl.searchParams.keys()) {\n      const values = fullUrl.searchParams.getAll(key) // Get all values for the key\n      queryParams[key] = values.length > 1 ? values : values[0] // Use array if multiple values, otherwise single value\n    }\n  \n    return queryParams\n  }\n\n  onRequest (request, response) {\n    const url = new URL(request.url, `http://${request.headers.host}`)\n    let data\n\n    const getCookie = (cookieName) => {\n      const cookies = request.headers.cookie; // Retrieve the 'Cookie' header\n      if (!cookies) return null; // Return null if no cookies are present\n  \n      // Split cookies into key-value pairs and find the desired cookie\n      const cookie = cookies.split(';').find((c) => c.trim().startsWith(`${cookieName}=`));\n      return cookie ? cookie.split('=')[1] : null; // Return the cookie value or null\n    };\n  \n    if (url.pathname === '/.well-known/openid-configuration') {\n      data = this.getMetadata(request)\n    } else if (url.pathname === '/jwks') {\n       data = this.getJwks()\n    } else if ( url.pathname === '/api/get-token') {\n      const { privileges, audience, scope, username, expiresIn, algorithm, kid, issuedAt } = this.parseQueryParams(request)\n      const token = this.getToken({ privileges: privileges === '' ? [] : privileges, audience, scope, username, expiresIn, algorithm, kid, issuedAt })\n      data = {\n        token,\n        tokenDecoded: jsonwebtoken.decode(token, {complete: true})\n      }\n    } else if ( url.pathname === '/api/rotate-keys') {\n      const { includeInsecureKid, keyCount } = this.parseQueryParams(request)\n      this.rotateKeys({ includeInsecureKid: includeInsecureKid === 'true', keyCount })\n      data = this.getJwks()\n    } else if (url.pathname === '/auth') {\n      const { redirect_uri, response_mode, state } = this.parseQueryParams(request)\n      const sid = getCookie('sid')\n      if (sid) {\n        const sessionParams = this.sids[sid]\n        if (sessionParams) {\n          const accessToken = this.getToken(sessionParams)\n          const refreshToken = sessionParams.refreshExpiresIn !== '0' ? this.getRefreshToken({ \n            sid: sessionParams.sid, \n            expiresIn:sessionParams.refreshExpiresIn, \n            algorithm:sessionParams.algorithm, \n            kid:sessionParams.kid }) : undefined\n          const code = crypto.randomBytes(16).toString('hex')\n          this.authCodes[code] = {accessToken, refreshToken, expiresIn: sessionParams.expiresIn}\n    \n          const responseUrl = new URL(redirect_uri)\n          const searchParams = new URLSearchParams()\n          searchParams.append('code', code)\n          if (state) {\n            searchParams.append('state', state)\n          }\n          if (response_mode === 'fragment') {\n            responseUrl.hash = searchParams.toString()\n          } else {\n            responseUrl.search = searchParams.toString()\n          }\n    \n          response.writeHead(302, {\n            Location: responseUrl.toString(),\n            'Set-Cookie': `sid=${sid}; Path=/;`\n          })\n        \n          response.end()\n          return\n        }\n      }\n      response.writeHead(200, { 'Content-Type': 'text/html'})\n      response.end(this.getAuthHtml({ redirect_uri, response_mode, state, prefix: request.headers['x-forwarded-prefix'] || '' }))\n      return\n    } else if (url.pathname === '/auth/callback') {\n      const {\n        state, \n        redirect_uri, \n        response_mode = 'query', \n        privileges = [], \n        scope, \n        username, \n        expiresIn, \n        refreshExpiresIn, \n        sessionExpiresIn,\n        audience,\n        algorithm, \n        issuedAt, \n        kid,\n        privilegesClaim = 'realm_access.roles',\n        usernameClaim = 'preferred_username',\n        scopeClaim = 'scope'\n      } = this.parseQueryParams(request)\n      const auth_time = Math.floor(Date.now() / 1000)\n      const sid = crypto.randomBytes(16).toString('hex')\n      this.sids[sid] = {\n        sid,\n        privileges, \n        scope, \n        username, \n        expiresIn, \n        refreshExpiresIn, \n        sessionExpiresIn,\n        audience,\n        auth_time, \n        algorithm, \n        issuedAt, \n        kid,\n        privilegesClaim,\n        usernameClaim,\n        scopeClaim\n      }\n      const accessToken = this.getToken({ privileges, scope, audience, username, expiresIn, algorithm, issuedAt, kid, sid, auth_time, privilegesClaim, usernameClaim, scopeClaim })\n      const refreshToken = refreshExpiresIn !== '0' ? this.getRefreshToken({ sid, expiresIn:refreshExpiresIn, algorithm, kid }) : undefined\n      const code = crypto.randomBytes(16).toString('hex')\n      this.authCodes[code] = {accessToken, refreshToken, expiresIn}\n\n      const responseUrl = new URL(redirect_uri)\n      const searchParams = new URLSearchParams()\n      searchParams.append('code', code)\n      if (state) {\n        searchParams.append('state', state)\n      }\n      if (response_mode === 'fragment') {\n        responseUrl.hash = searchParams.toString()\n      } else {\n        responseUrl.search = searchParams.toString()\n      }\n\n      response.writeHead(302, {\n        Location: responseUrl.toString(),\n        'Set-Cookie': `sid=${sid}; Path=/;`\n      })\n    \n      response.end()\n      return\n    } else if (url.pathname === '/token' && request.method === 'POST') {\n      let body = ''\n      \n      // Collect the POST body data\n      request.on('data', chunk => {\n        body += chunk.toString()\n      })\n\n      request.on('end', () => {\n        let data\n        // Parse the URL-encoded body\n        const params = new URLSearchParams(body)\n        const grantType = params.get('grant_type')\n        if (grantType === 'authorization_code') {\n          const code = params.get('code')\n\n          const auth = this.authCodes[code]\n          if (!auth) {\n            response.writeHead(400, {'Access-Control-Allow-Origin': '*' })\n            response.end('Invalid code')\n            return\n          }\n\n        // Prepare the token response\n          data = {\n            access_token: auth.accessToken,\n            refresh_token: auth.refreshToken,\n            token_type: 'Bearer',\n            expires_in: ms(auth.expiresIn) / 1000\n          }\n          delete this.authCodes[code]\n        } else if (grantType === 'refresh_token') {\n          const refreshToken = params.get('refresh_token')\n          const sid = jsonwebtoken.decode(refreshToken).sid\n          const sessionParams = this.sids[sid]\n          if (!sessionParams) {\n            response.writeHead(400, {'Access-Control-Allow-Origin': '*' })\n            response.end('Invalid refresh token')\n            return\n          }\n          const { privileges, audience, scope, username, expiresIn, refreshExpiresIn, auth_time, algorithm, issuedAt, kid } = sessionParams\n          const newAccessToken = this.getToken({ privileges, audience, scope, username, expiresIn, algorithm, issuedAt, kid, sid, auth_time })\n          const newRefreshToken = this.getRefreshToken({ sid, expiresIn:refreshExpiresIn, algorithm, kid })\n              \n          data = {\n            access_token: newAccessToken,\n            refresh_token: newRefreshToken,\n            token_type: 'Bearer',\n            expires_in: ms(expiresIn) / 1000\n          }\n        } else if (grantType === 'client_credentials') {\n          const basicAuth = request.headers.authorization\n          if (!basicAuth?.startsWith('Basic ')) {\n            response.writeHead(401)\n            response.end('Missing or invalid Basic Auth header')\n            return\n          }\n          const base64Credentials = basicAuth.split(' ')[1]\n          const credentials = Buffer.from(base64Credentials, 'base64').toString('utf-8')\n          const [clientId] = credentials.split(':')\n          // Check for scope parameter\n          if (!params.has('scope')) {\n            response.writeHead(400)\n            response.end('Missing scope parameter')\n            return\n          }\n          // Get the scope parameter\n          const scope = params.get('scope')\n\n\n          // Generate a new access token\n          data = {\n            access_token: this.getToken({ username: clientId, privileges: [], scope, expiresIn: this.clientCredentialsLifetime}),\n            token_type: 'Bearer',\n            expires_in: this.clientCredentialsLifetime\n          }\n        } else {\n          response.writeHead(400)\n          response.end('Invalid grant type')\n          return\n        }\n        // Send the token response\n        response.writeHead(200, { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' })\n        response.end(JSON.stringify(data))\n      })\n\n      return\n    } else if (url.pathname === '/logout') {\n      const sid = getCookie('sid')\n      if (!sid) {\n        response.writeHead(400, {'Access-Control-Allow-Origin': '*' })\n        response.end('Missing sid cookie')\n        return\n      }\n      delete this.sids[sid]\n      // const responseUrl = new URL(post_logout_redirect_uri)\n      // response.writeHead(302, { Location: responseUrl.toString() })\n      // response.end()\n      response.writeHead(200, { 'Content-Type': 'text/html', 'Access-Control-Allow-Origin': '*' })\n      response.end(`\n        <!DOCTYPE html>\n        <html lang=\"en\">\n        <head>\n          <meta charset=\"UTF-8\">\n          <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n          <title>Logout</title>\n          <style>\n            body {\n              background-color: #121212;\n              color: #ffffff;\n              font-family: Arial, sans-serif;\n              margin: 0;\n              padding: 20px;\n            }\n            h1 {\n              color: #bb86fc;\n              text-align: center;\n            }\n          </style>\n        </head>\n        <body>\n          <h1>Logged out successfully</h1>\n        </body>\n        </html>\n      `)\n      return\n    } else if (request.method === 'OPTIONS') {\n      response.writeHead(204, { 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Methods': 'GET, POST, OPTIONS', 'Access-Control-Allow-Headers':  'X-Requested-With'})\n      response.end()\n      return\n    } else {\n      response.writeHead(404)\n      response.end()\n      return\n    }\n    response.writeHead(200, { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*'})\n    response.end(JSON.stringify(data))\n  }\n\n  start ({port = 8080}) {\n    return new Promise((resolve, reject) => {\n      this.server = http.createServer()\n      this.server.on('error', reject)\n      this.server.on('request', this.onRequest.bind(this))\n      this.port = port\n      this.server.listen(port, () => {\n        resolve()\n      })\n    })\n  }\n  \n  stop () {\n    // Order matters: drop active connections first, then await close() so the\n    // returned promise doesn't resolve until the listening socket has been\n    // released. Resolving early lets a follow-up start() on the same port\n    // race with kernel teardown and intermittently throw EADDRINUSE.\n    return new Promise((resolve, reject) => {\n      if (!this.server) return resolve()\n      const server = this.server\n      this.server = null\n      server.closeAllConnections()\n      server.close((err) => err ? reject(err) : resolve())\n    })\n  }\n}\n\nexport default MockOidc\n\nif (fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {\n  // Parse command-line arguments\n  const args = process.argv.slice(2) // Exclude \"node\" and script name\n  const options = {\n    port: 8080,\n    includeInsecureKid: false,\n    keyCount: 1\n  }\n\n  // Simple argument parsing\n  for (const [index, arg] of args.entries()) {\n    if (arg === '--port' || arg === '-p') {\n      options.port = parseInt(args[index + 1], 10)\n    } else if (arg === '--include-insecure-kid' || arg === '-i') {\n      options.includeInsecureKid = true // Flag, no value needed\n    } else if (arg === '--key-count' || arg === '-k') {\n      options.keyCount = parseInt(args[index + 1], 10)\n    } else if (arg === '--help' || arg === '-h') {\n      console.log(`\n  Usage: node mockOidc.js [options]\n  \n  Options:\n    --port, -p <number>               Port to run the Mock OIDC server on (default: 8080)\n    --include-insecure-kid, -i        Include insecure key IDs (default: false)\n    --key-count, -k <number>          Number of keys to generate (default: 1)\n    --help, -h                        Show this help message\n  `)\n      process.exit(0)\n    }\n  }\n\n  // Create and start a MockOidc instance\n  const oidc = new MockOidc({\n    includeInsecureKid: options.includeInsecureKid,\n    keyCount: options.keyCount\n  })\n\n  try {\n    await oidc.start({ port: options.port })\n    console.log(`Mock OIDC server started on port ${options.port}, with ${options.keyCount} key${options.keyCount !== 1 ? 's':''}${options.includeInsecureKid ? ' (plus insecure key)' : ''}`)\n  } catch (err) {\n    console.error('Failed to start Mock OIDC server:', err)\n    process.exit(1)\n  }\n\n  // Gracefully handle termination signals\n  process.on('SIGINT', async () => {\n    console.log('Stopping Mock OIDC server...')\n    await oidc.stop()\n    console.log('Mock OIDC server stopped.')\n    process.exit(0)\n  })\n}"
  },
  {
    "path": "test/utils/package.json",
    "content": "{\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"jsonwebtoken\": \"^9.0.2\"\n  }\n}\n"
  }
]